From 1b2f9c0eafc822c42885ac252922ecf7eefde3fc Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Tue, 20 Apr 2021 04:20:00 +0000
Subject: [PATCH 001/416] python310: fix build on darwin

---
 pkgs/development/interpreters/python/cpython/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 38ee086a88fe..b8132cea4fc7 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -208,7 +208,7 @@ in with passthru; stdenv.mkDerivation {
     # * https://bugs.python.org/issue35523
     # * https://github.com/python/cpython/commit/e6b247c8e524
     ./3.7/no-win64-workaround.patch
-  ] ++ optionals (isPy37 || isPy38 || isPy39) [
+  ] ++ optionals (pythonAtLeast "3.7") [
     # Fix darwin build https://bugs.python.org/issue34027
     ./3.7/darwin-libutil.patch
   ] ++ optionals (pythonOlder "3.8") [
@@ -227,7 +227,7 @@ in with passthru; stdenv.mkDerivation {
     (
       if isPy35 then
         ./3.5/python-3.x-distutils-C++.patch
-      else if isPy37 || isPy38 || isPy39 then
+      else if pythonAtLeast "3.7" then
         ./3.7/python-3.x-distutils-C++.patch
       else
         fetchpatch {

From 89fc4a5ea622f69e204285b78ff5d2c558535c7f Mon Sep 17 00:00:00 2001
From: Pablo Ovelleiro Corral <github@pablo.tools>
Date: Sat, 22 May 2021 12:52:59 +0200
Subject: [PATCH 002/416] Update version number, invalidate shas

---
 .../tools/continuous-integration/drone/default.nix          | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/continuous-integration/drone/default.nix b/pkgs/development/tools/continuous-integration/drone/default.nix
index a2bc47b6408b..6f003005c639 100644
--- a/pkgs/development/tools/continuous-integration/drone/default.nix
+++ b/pkgs/development/tools/continuous-integration/drone/default.nix
@@ -3,9 +3,9 @@
 
 buildGoModule rec {
   pname = "drone.io${lib.optionalString (!enableUnfree) "-oss"}";
-  version = "1.10.0";
+  version = "2.0.0";
 
-  vendorSha256 = "sha256-cKHX/GnvGELQBfoo0/1UmDQ4Z66GGnnHG7+1CzjinL0=";
+  vendorSha256 = "sha256-cKHX/GnvGELQBfoi0/1UmDQ4Z66GGnnHG7+1CzjinL0=";
 
   doCheck = false;
 
@@ -13,7 +13,7 @@ buildGoModule rec {
     owner = "drone";
     repo = "drone";
     rev = "v${version}";
-    sha256 = "sha256-12Jac+mXWdUX8gWvmpdO9ROv7Bi0YzvyqnNDVNJOr34=";
+    sha256 = "sha256-12Jac+mXWdUX8gWvmpde9ROv7Bi0YzvyqnNDVNJOr34=";
   };
 
   preBuild = ''

From a9f621f292eebab91c8b2d3ff4e1c128c74e69a0 Mon Sep 17 00:00:00 2001
From: Pablo Ovelleiro Corral <github@pablo.tools>
Date: Sat, 22 May 2021 12:59:28 +0200
Subject: [PATCH 003/416] Update commit sha

---
 pkgs/development/tools/continuous-integration/drone/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/tools/continuous-integration/drone/default.nix b/pkgs/development/tools/continuous-integration/drone/default.nix
index 6f003005c639..b6c7227bc8d8 100644
--- a/pkgs/development/tools/continuous-integration/drone/default.nix
+++ b/pkgs/development/tools/continuous-integration/drone/default.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
     owner = "drone";
     repo = "drone";
     rev = "v${version}";
-    sha256 = "sha256-12Jac+mXWdUX8gWvmpde9ROv7Bi0YzvyqnNDVNJOr34=";
+    sha256 = "sha256-BxwCJf3uY34rqegZJ6H/zb63orELhq41trOgzGXQe80=";
   };
 
   preBuild = ''

From 52e1188437cd2ecccf9de4e01271cc3b923a8a93 Mon Sep 17 00:00:00 2001
From: Pablo Ovelleiro Corral <github@pablo.tools>
Date: Sat, 22 May 2021 13:21:23 +0200
Subject: [PATCH 004/416] Update vendorsha256

---
 pkgs/development/tools/continuous-integration/drone/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/tools/continuous-integration/drone/default.nix b/pkgs/development/tools/continuous-integration/drone/default.nix
index b6c7227bc8d8..c6d1e47389a6 100644
--- a/pkgs/development/tools/continuous-integration/drone/default.nix
+++ b/pkgs/development/tools/continuous-integration/drone/default.nix
@@ -5,7 +5,7 @@ buildGoModule rec {
   pname = "drone.io${lib.optionalString (!enableUnfree) "-oss"}";
   version = "2.0.0";
 
-  vendorSha256 = "sha256-cKHX/GnvGELQBfoi0/1UmDQ4Z66GGnnHG7+1CzjinL0=";
+  vendorSha256 = "sha256-cnbZSnHU+ORm7/dV+U9NfM18Zrzi24vf7qITPJsusU8=";
 
   doCheck = false;
 

From 4db49ce4fcb8d4865d6d918bb1447ab1364485a9 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sun, 23 May 2021 09:50:01 +0000
Subject: [PATCH 005/416] fluent-bit: 1.7.5 -> 1.7.6

---
 pkgs/tools/misc/fluent-bit/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/misc/fluent-bit/default.nix b/pkgs/tools/misc/fluent-bit/default.nix
index 89435e769896..5fdd4b72e1e4 100644
--- a/pkgs/tools/misc/fluent-bit/default.nix
+++ b/pkgs/tools/misc/fluent-bit/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fluent-bit";
-  version = "1.7.5";
+  version = "1.7.6";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     rev = "v${version}";
-    sha256 = "sha256-n7X6VlNZVsL+Tn9t3L4mTblVjPTKgTMmcRdkDGPXI8U=";
+    sha256 = "sha256-/Mpdi414LNzavh4nUY2pnflyshzwTYv1XK1HmnAHJaQ=";
   };
 
   nativeBuildInputs = [ cmake flex bison ];

From 717c9381241651fcccc21ef4b96681b5f37786d7 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Wed, 26 May 2021 08:20:56 +0000
Subject: [PATCH 006/416] jbang: 0.70.0 -> 0.71.1

---
 pkgs/development/tools/jbang/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/jbang/default.nix b/pkgs/development/tools/jbang/default.nix
index dfef3906602c..1220ec90d90f 100644
--- a/pkgs/development/tools/jbang/default.nix
+++ b/pkgs/development/tools/jbang/default.nix
@@ -1,12 +1,12 @@
 { stdenv, lib, fetchzip, jdk, makeWrapper, coreutils, curl }:
 
 stdenv.mkDerivation rec {
-  version = "0.70.0";
+  version = "0.71.1";
   pname = "jbang";
 
   src = fetchzip {
     url = "https://github.com/jbangdev/jbang/releases/download/v${version}/${pname}-${version}.tar";
-    sha256 = "sha256-Fy7TvWJVRJI5fhfZzMuW+KBLaVLWKjk/I3Kx60Wazyo=";
+    sha256 = "sha256-+s2Wa+5Qznqpv84VEZCMmzy0bI1mN/BknPObYqJlaYs=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From b7da67c969407d61ad49706a8966cb59e7c64c20 Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Thu, 27 May 2021 00:02:49 +0100
Subject: [PATCH 007/416] python3Packages.acoustics: fix tests on sandboxed
 darwin

---
 pkgs/development/python-modules/acoustics/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/acoustics/default.nix b/pkgs/development/python-modules/acoustics/default.nix
index 7b62c6791cb1..ae91c0683c51 100644
--- a/pkgs/development/python-modules/acoustics/default.nix
+++ b/pkgs/development/python-modules/acoustics/default.nix
@@ -14,6 +14,10 @@ buildPythonPackage rec {
   };
 
   checkPhase = ''
+    export HOME=$TMPDIR
+    mkdir -p $HOME/.matplotlib
+    echo "backend: ps" > $HOME/.matplotlib/matplotlibrc
+
     pushd tests
     py.test ./.
     popd

From 4136fb11a8b68685ef39eb2a5f4a6d9a75db40f4 Mon Sep 17 00:00:00 2001
From: Vincenzo Mantova <xworld21@users.sf.net>
Date: Mon, 31 May 2021 18:34:56 +0100
Subject: [PATCH 008/416] perlPackages.LaTeXML: output tex package

---
 pkgs/top-level/perl-packages.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 9db246eae432..a8025dacd699 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -10969,11 +10969,13 @@ let
       url = "mirror://cpan/authors/id/B/BR/BRMILLER/${pname}-${version}.tar.gz";
       sha256 = "0dr69rgl4si9i9ww1r4dc7apgb7y6f7ih808w4g0924cvz823s0x";
     };
+    outputs = [ "out" "tex" ];
     propagatedBuildInputs = [ ArchiveZip DBFile FileWhich IOString ImageSize JSONXS LWP ParseRecDescent PerlMagick PodParser TextUnidecode XMLLibXSLT ];
     preCheck = ''
       rm t/931_epub.t # epub test fails
     '';
     nativeBuildInputs = [ pkgs.makeWrapper ] ++ lib.optional stdenv.isDarwin shortenPerlShebang;
+    makeMakerFlags = "TEXMF=\${tex} NOMKTEXLSR";
     # shebangs need to be patched before executables are copied to $out
     preBuild = ''
       patchShebangs bin/
@@ -10992,6 +10994,10 @@ let
       description = "Transforms TeX and LaTeX into XML/HTML/MathML";
       license = lib.licenses.free;
     };
+    passthru = {
+      tlType = "run";
+      pkgs = [ LaTeXML.tex ];
+    };
   };
 
   libapreq2 = buildPerlPackage {

From e43f73c8d3e37f87aad26be0e55a044ed128245b Mon Sep 17 00:00:00 2001
From: Vincenzo Mantova <xworld21@users.sf.net>
Date: Mon, 31 May 2021 18:34:56 +0100
Subject: [PATCH 009/416] perlPackages.LaTeXML: set license to public domain

---
 pkgs/top-level/perl-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index a8025dacd699..88905c45bbbd 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -10992,7 +10992,7 @@ let
     '';
     meta = {
       description = "Transforms TeX and LaTeX into XML/HTML/MathML";
-      license = lib.licenses.free;
+      license = lib.licenses.publicDomain;
     };
     passthru = {
       tlType = "run";

From e55db589b7e3cb96cabdadbe17a030b66f23f4c2 Mon Sep 17 00:00:00 2001
From: Vincenzo Mantova <xworld21@users.sf.net>
Date: Mon, 31 May 2021 18:34:57 +0100
Subject: [PATCH 010/416] perlPackages.LaTeXML: add xworld21 as maintainer

---
 pkgs/top-level/perl-packages.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 88905c45bbbd..1f11f22d8a3e 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -10993,6 +10993,7 @@ let
     meta = {
       description = "Transforms TeX and LaTeX into XML/HTML/MathML";
       license = lib.licenses.publicDomain;
+      maintainers = with maintainers; [ xworld21 ];
     };
     passthru = {
       tlType = "run";

From da77923caa25fef360918cab70e65867a24bbcac Mon Sep 17 00:00:00 2001
From: Vincenzo Mantova <xworld21@users.sf.net>
Date: Mon, 31 May 2021 18:34:57 +0100
Subject: [PATCH 011/416] perlPackages.LaTeXML: add homepage

---
 pkgs/top-level/perl-packages.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 1f11f22d8a3e..7677feb0d049 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -10992,6 +10992,7 @@ let
     '';
     meta = {
       description = "Transforms TeX and LaTeX into XML/HTML/MathML";
+      homepage = "https://dlmf.nist.gov/LaTeXML/";
       license = lib.licenses.publicDomain;
       maintainers = with maintainers; [ xworld21 ];
     };

From 4af9ec199f0b09ce74996cce9e135af7445555d6 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Thu, 3 Jun 2021 04:20:00 +0000
Subject: [PATCH 012/416] python38Packages.python-redis-lock: fix build on
 darwin

---
 .../development/python-modules/python-redis-lock/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/python-redis-lock/default.nix b/pkgs/development/python-modules/python-redis-lock/default.nix
index 49113dfad5ef..bd8933be824c 100644
--- a/pkgs/development/python-modules/python-redis-lock/default.nix
+++ b/pkgs/development/python-modules/python-redis-lock/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , buildPythonPackage
 , fetchPypi
 , redis
@@ -30,6 +31,10 @@ buildPythonPackage rec {
   disabledTests = [
     # https://github.com/ionelmc/python-redis-lock/issues/86
     "test_no_overlap2"
+  ] ++ lib.optionals stdenv.isDarwin [
+    # fail on Darwin because it defaults to multiprocessing `spawn`
+    "test_reset_signalizes"
+    "test_reset_all_signalizes"
   ];
 
   meta = with lib; {

From 4769ec74e102f29d02046ea18eed99966de15221 Mon Sep 17 00:00:00 2001
From: Philipp Mildenberger <philipp@mildenberger.me>
Date: Fri, 4 Jun 2021 15:22:35 +0200
Subject: [PATCH 013/416] shaderc: 2020.2 -> 2021.0

---
 pkgs/development/compilers/shaderc/default.nix | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/compilers/shaderc/default.nix b/pkgs/development/compilers/shaderc/default.nix
index 678ab3adb06c..40c216d79c34 100644
--- a/pkgs/development/compilers/shaderc/default.nix
+++ b/pkgs/development/compilers/shaderc/default.nix
@@ -8,24 +8,24 @@ let
   glslang = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "glslang";
-    rev = "3ee5f2f1d3316e228916788b300d786bb574d337";
-    sha256 = "1l5h9d92mzd35pgs0wibqfg7vbl771lwnvdlcsyhf6999khn5dzv";
+    rev = "18eef33bd7a4bf5ad8c69f99cb72022608cf6e73";
+    sha256 = "sha256-tkWVvYmSpJPaZ8VJOkAWndDWhA0PiHAkR3feBAo+knM=";
   };
   spirv-tools = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Tools";
-    rev = "b63f0e5ed3e818870968ebf6af73317127fd07b0";
-    sha256 = "1chv30azfp76nha428ivg4ixrij6d8pxj5kn3jam87gmkmgc9zhm";
+    rev = "c2d5375fa7cc87c93f692e7200d5d974283d4391";
+    sha256 = "sha256-tMJRljrlH+qb+27rTn+3LuEyMOVpiU0zSCiGNfUTb6g=";
   };
   spirv-headers = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Headers";
-    rev = "979924c8bc839e4cb1b69d03d48398551f369ce7";
-    sha256 = "07vyjlblpm4zhfds612h86lnz0qvrj5qqw5z2zzfa3m9fax7cm85";
+    rev = "0c28b6451d77774912e52949c1e57fa726edf113";
+    sha256 = "sha256-KpCMceTV/BRaoJe1qeXhKYQNQqdGaM6Q9nklpJKzHFY=";
   };
 in stdenv.mkDerivation rec {
   pname = "shaderc";
-  version = "2020.2";
+  version = "2021.0";
 
   outputs = [ "out" "lib" "bin" "dev" "static" ];
 
@@ -33,7 +33,7 @@ in stdenv.mkDerivation rec {
     owner = "google";
     repo = "shaderc";
     rev = "v${version}";
-    sha256 = "1sxz8872x3rdlrhmbn83r1vniq4j51jnk0ka3447fq68il4myf1w";
+    sha256 = "sha256-RfSMzrGVtdXbr/mjSrHoN447e3vMQfJbesQMvLOARBs=";
   };
 
   patchPhase = ''

From 4d000fbd2b44d8ee3207afe2f5ad900d90c8ff57 Mon Sep 17 00:00:00 2001
From: Devin Singh <drsingh2518@icloud.com>
Date: Tue, 1 Jun 2021 05:30:10 -0500
Subject: [PATCH 014/416] kile-wl: unstable-2021-04-22 -> unstable-2021-06-01

---
 pkgs/applications/misc/kile-wl/default.nix    |  22 ++-
 .../misc/kile-wl/update-Cargo-lock.diff       | 153 ------------------
 2 files changed, 15 insertions(+), 160 deletions(-)
 delete mode 100644 pkgs/applications/misc/kile-wl/update-Cargo-lock.diff

diff --git a/pkgs/applications/misc/kile-wl/default.nix b/pkgs/applications/misc/kile-wl/default.nix
index 479c5bf1d8d1..a9e44964d459 100644
--- a/pkgs/applications/misc/kile-wl/default.nix
+++ b/pkgs/applications/misc/kile-wl/default.nix
@@ -1,20 +1,28 @@
-{ lib, fetchFromGitLab, rustPlatform }:
+{ lib, fetchFromGitLab, unstableGitUpdater, rustPlatform, scdoc }:
 
 rustPlatform.buildRustPackage rec {
   pname = "kile-wl";
-  version = "unstable-2021-04-22";
+  version = "unstable-2021-06-01";
 
   src = fetchFromGitLab {
     owner = "snakedye";
     repo = "kile";
-    rev = "b97b9f1e5b33862b33918efaf23fd1c0c5d7058a";
-    sha256 = "sha256-97qJd3o8nJt8IX5tyGWtAmJsIv5Gcw1xoBFwxAqk7I8=";
+    rev = "28235f85ece148e7010c5d6ac088688100a18e04";
+    sha256 = "sha256-UTfYYywOwa728zLkLWQaz6wN0TM/4OzbHQGedjdHGSI=";
   };
 
-  # Upstream has Cargo.lock gitignored
-  cargoPatches = [ ./update-Cargo-lock.diff ];
+  passthru.updateScript = unstableGitUpdater {
+    url = "https://gitlab.com/snakedye/kile.git";
+  };
 
-  cargoSha256 = "sha256-TEgIiw/XTDUOe9K7agHWI86f88w+eDJ332V0CgNHtfo=";
+  cargoSha256 = "sha256-dzOkiZYHQu5AuwkbWEtIJAyZ1TNIGYkfz+S3q6K384w=";
+
+  nativeBuildInputs = [ scdoc ];
+
+  postInstall = ''
+    mkdir -p $out/share/man
+    scdoc < doc/kile.1.scd > $out/share/man/kile.1
+  '';
 
   meta = with lib; {
     description = "A tiling layout generator for river";
diff --git a/pkgs/applications/misc/kile-wl/update-Cargo-lock.diff b/pkgs/applications/misc/kile-wl/update-Cargo-lock.diff
deleted file mode 100644
index 8fc9fc555e83..000000000000
--- a/pkgs/applications/misc/kile-wl/update-Cargo-lock.diff
+++ /dev/null
@@ -1,153 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-new file mode 100644
-index 0000000..05cf87b
---- /dev/null
-+++ b/Cargo.lock
-@@ -0,0 +1,147 @@
-+# This file is automatically @generated by Cargo.
-+# It is not intended for manual editing.
-+[[package]]
-+name = "bitflags"
-+version = "1.2.1"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "cf1de2fe8c75bc145a2f577add951f8134889b4795d47466a54a5c846d691693"
-+
-+[[package]]
-+name = "cc"
-+version = "1.0.67"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "e3c69b077ad434294d3ce9f1f6143a2a4b89a8a2d54ef813d85003a4fd1137fd"
-+
-+[[package]]
-+name = "cfg-if"
-+version = "1.0.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-+
-+[[package]]
-+name = "downcast-rs"
-+version = "1.2.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "9ea835d29036a4087793836fa931b08837ad5e957da9e23886b29586fb9b6650"
-+
-+[[package]]
-+name = "kile"
-+version = "0.1.0"
-+dependencies = [
-+ "wayland-client",
-+ "wayland-commons",
-+ "wayland-scanner",
-+]
-+
-+[[package]]
-+name = "libc"
-+version = "0.2.93"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "9385f66bf6105b241aa65a61cb923ef20efc665cb9f9bb50ac2f0c4b7f378d41"
-+
-+[[package]]
-+name = "nix"
-+version = "0.20.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "fa9b4819da1bc61c0ea48b63b7bc8604064dd43013e7cc325df098d49cd7c18a"
-+dependencies = [
-+ "bitflags",
-+ "cc",
-+ "cfg-if",
-+ "libc",
-+]
-+
-+[[package]]
-+name = "once_cell"
-+version = "1.7.2"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "af8b08b04175473088b46763e51ee54da5f9a164bc162f615b91bc179dbf15a3"
-+
-+[[package]]
-+name = "pkg-config"
-+version = "0.3.19"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "3831453b3449ceb48b6d9c7ad7c96d5ea673e9b470a1dc578c2ce6521230884c"
-+
-+[[package]]
-+name = "proc-macro2"
-+version = "1.0.26"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "a152013215dca273577e18d2bf00fa862b89b24169fb78c4c95aeb07992c9cec"
-+dependencies = [
-+ "unicode-xid",
-+]
-+
-+[[package]]
-+name = "quote"
-+version = "1.0.9"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "c3d0b9745dc2debf507c8422de05d7226cc1f0644216dfdfead988f9b1ab32a7"
-+dependencies = [
-+ "proc-macro2",
-+]
-+
-+[[package]]
-+name = "smallvec"
-+version = "1.6.1"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "fe0f37c9e8f3c5a4a66ad655a93c74daac4ad00c441533bf5c6e7990bb42604e"
-+
-+[[package]]
-+name = "unicode-xid"
-+version = "0.2.1"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "f7fe0bb3479651439c9112f72b6c505038574c9fbb575ed1bf3b797fa39dd564"
-+
-+[[package]]
-+name = "wayland-client"
-+version = "0.28.5"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "06ca44d86554b85cf449f1557edc6cc7da935cc748c8e4bf1c507cbd43bae02c"
-+dependencies = [
-+ "bitflags",
-+ "downcast-rs",
-+ "libc",
-+ "nix",
-+ "wayland-commons",
-+ "wayland-scanner",
-+ "wayland-sys",
-+]
-+
-+[[package]]
-+name = "wayland-commons"
-+version = "0.28.5"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "8bd75ae380325dbcff2707f0cd9869827ea1d2d6d534cff076858d3f0460fd5a"
-+dependencies = [
-+ "nix",
-+ "once_cell",
-+ "smallvec",
-+ "wayland-sys",
-+]
-+
-+[[package]]
-+name = "wayland-scanner"
-+version = "0.28.5"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "389d680d7bd67512dc9c37f39560224327038deb0f0e8d33f870900441b68720"
-+dependencies = [
-+ "proc-macro2",
-+ "quote",
-+ "xml-rs",
-+]
-+
-+[[package]]
-+name = "wayland-sys"
-+version = "0.28.5"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "2907bd297eef464a95ba9349ea771611771aa285b932526c633dc94d5400a8e2"
-+dependencies = [
-+ "pkg-config",
-+]
-+
-+[[package]]
-+name = "xml-rs"
-+version = "0.8.3"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "b07db065a5cf61a7e4ba64f29e67db906fb1787316516c4e6e5ff0fea1efcd8a"

From d80a75fbd3840827aaf2637726b51453a8ad2634 Mon Sep 17 00:00:00 2001
From: Johannes Schleifenbaum <johannes@js-webcoding.de>
Date: Tue, 8 Jun 2021 09:37:17 +0200
Subject: [PATCH 015/416] miniflux: 2.0.29 -> 2.0.31

---
 pkgs/servers/miniflux/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/miniflux/default.nix b/pkgs/servers/miniflux/default.nix
index e69014c4f4ae..f66468b240f8 100644
--- a/pkgs/servers/miniflux/default.nix
+++ b/pkgs/servers/miniflux/default.nix
@@ -2,7 +2,7 @@
 
 let
   pname = "miniflux";
-  version = "2.0.29";
+  version = "2.0.31";
 
 in buildGoModule {
   inherit pname version;
@@ -11,10 +11,10 @@ in buildGoModule {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-8FfI9TPtIoQ/D5AdKRy7fq/eGZ6ha8z0tqBnWcziMTA=";
+    sha256 = "sha256-01v5gwUv0SfX/9AJgo4HiBcmoCfQbnKIGcS26IebU2Q=";
   };
 
-  vendorSha256 = "sha256-y7w+SHy0yPws365PKJeRStZS3Y5vjyPWHK3w84VvJsI=";
+  vendorSha256 = "sha256-69iTdrjgBmJHeVa8Tq47clQR5Xhy4rWcp2OwS4nIw/c=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From a0a11fd22c5786aa7c0f025115506c6a83221951 Mon Sep 17 00:00:00 2001
From: Aaron Andersen <aaron@fosslib.net>
Date: Tue, 8 Jun 2021 19:42:39 -0400
Subject: [PATCH 016/416] zabbixAgent: add bash to $PATH

---
 nixos/modules/services/monitoring/zabbix-agent.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/monitoring/zabbix-agent.nix b/nixos/modules/services/monitoring/zabbix-agent.nix
index e7dd9e3393d0..7eb6449e384d 100644
--- a/nixos/modules/services/monitoring/zabbix-agent.nix
+++ b/nixos/modules/services/monitoring/zabbix-agent.nix
@@ -157,7 +157,10 @@ in
 
       wantedBy = [ "multi-user.target" ];
 
-      path = [ "/run/wrappers" ] ++ cfg.extraPackages;
+      # https://www.zabbix.com/documentation/current/manual/config/items/userparameters
+      # > User parameters are commands executed by Zabbix agent.
+      # > /bin/sh is used as a command line interpreter under UNIX operating systems.
+      path = with pkgs; [ bash "/run/wrappers" ] ++ cfg.extraPackages;
 
       serviceConfig = {
         ExecStart = "@${cfg.package}/sbin/zabbix_agentd zabbix_agentd -f --config ${configFile}";

From e16e51702b9df803d172e7bdb4cbb4976778eee2 Mon Sep 17 00:00:00 2001
From: jnetod <49963580+jnetod@users.noreply.github.com>
Date: Sun, 5 Jul 2020 18:09:46 -0300
Subject: [PATCH 017/416] zfs: patch client path used in smb share

fix zfs smb share integration

before:

# zfs share tank/smb_share
cannot share tank/smb_share: smb add share failed

now works as intended.
---
 pkgs/os-specific/linux/zfs/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index e41ae3bece24..75f5dcd0e312 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -6,7 +6,7 @@
 # Userspace dependencies
 , zlib, libuuid, python3, attr, openssl
 , libtirpc
-, nfs-utils
+, nfs-utils, samba
 , gawk, gnugrep, gnused, systemd
 , smartmontools, enableMail ? false
 , sysstat, pkg-config
@@ -55,6 +55,7 @@ let
           # And if it's enabled by default, only change that if we explicitly disable python to remove python from the closure
           nfs-utils.override (old: { enablePython = old.enablePython or true && enablePython; })
         }/bin/exportfs"
+        substituteInPlace ./lib/libshare/smb.h        --replace "/usr/bin/net"            "${samba}/bin/net"
         substituteInPlace ./config/user-systemd.m4    --replace "/usr/lib/modules-load.d" "$out/etc/modules-load.d"
         substituteInPlace ./config/zfs-build.m4       --replace "\$sysconfdir/init.d"     "$out/etc/init.d" \
                                                       --replace "/etc/default"            "$out/etc/default"

From 104e512cabf7ec9e95cd175a8796b1a86587213a Mon Sep 17 00:00:00 2001
From: Zhaofeng Li <hello@zhaofeng.li>
Date: Sun, 23 May 2021 21:24:28 +0000
Subject: [PATCH 018/416] phosh: 0.10.2 -> 0.11.0

Fixes #123735.
---
 nixos/modules/programs/phosh.nix              |  2 ++
 .../window-managers/phosh/default.nix         | 32 +++----------------
 2 files changed, 7 insertions(+), 27 deletions(-)

diff --git a/nixos/modules/programs/phosh.nix b/nixos/modules/programs/phosh.nix
index 1f50065f7818..ad954a3b2c82 100644
--- a/nixos/modules/programs/phosh.nix
+++ b/nixos/modules/programs/phosh.nix
@@ -143,6 +143,8 @@ in {
       oskItem
     ];
 
+    systemd.packages = [ pkgs.phosh ];
+
     programs.feedbackd.enable = true;
 
     security.pam.services.phosh = {};
diff --git a/pkgs/applications/window-managers/phosh/default.nix b/pkgs/applications/window-managers/phosh/default.nix
index 64677c8505f5..dc1080d97b29 100644
--- a/pkgs/applications/window-managers/phosh/default.nix
+++ b/pkgs/applications/window-managers/phosh/default.nix
@@ -35,36 +35,16 @@ let
     rev = "ae1a34aafce7026b8c0f65a43c9192d756fe1057";
     sha256 = "0a4qh5pgyjki904qf7qmvqz2ksxb0p8xhgl2aixfbhixn0pw6saw";
   };
-
-  executable = writeText "phosh" ''
-    PHOC_INI=@out@/share/phosh/phoc.ini
-    GNOME_SESSION_ARGS="--disable-acceleration-check --session=phosh --debug"
-
-    if [ -f /etc/phosh/phoc.ini ]; then
-      PHOC_INI=/etc/phosh/phoc.ini
-    elif  [ -f /etc/phosh/rootston.ini ]; then
-      # honor old configs
-      PHOC_INI=/etc/phosh/rootston.ini
-    fi
-
-    # Run gnome-session through a login shell so it picks
-    # variables from /etc/profile.d (XDG_*)
-    [ -n "$WLR_BACKENDS" ] || WLR_BACKENDS=drm,libinput
-    export WLR_BACKENDS
-    exec "${phoc}/bin/phoc" -C "$PHOC_INI" \
-      -E "bash -lc 'XDG_DATA_DIRS=$XDG_DATA_DIRS:\$XDG_DATA_DIRS ${gnome.gnome-session}/bin/gnome-session $GNOME_SESSION_ARGS'"
-  '';
-
 in stdenv.mkDerivation rec {
   pname = "phosh";
-  version = "0.10.2";
+  version = "0.11.0";
 
   src = fetchFromGitLab {
     domain = "source.puri.sm";
     owner = "Librem5";
     repo = pname;
     rev = "v${version}";
-    sha256 = "07i8wpzl7311dcf9s57s96qh1v672c75wv6cllrxx7fsmpf8fhx4";
+    sha256 = "104qib4blh32s7bg6j3xza3s9syrxrvyh2wpyh5yx7v5wqarr20x";
   };
 
   nativeBuildInputs = [
@@ -104,6 +84,8 @@ in stdenv.mkDerivation rec {
   # Temporarily disabled - Test is broken (SIGABRT)
   doCheck = false;
 
+  mesonFlags = [ "-Dsystemd=true" "-Dcompositor=${phoc}/bin/phoc" ];
+
   postUnpack = ''
     rmdir $sourceRoot/subprojects/gvc
     ln -s ${gvc} $sourceRoot/subprojects/gvc
@@ -123,15 +105,11 @@ in stdenv.mkDerivation rec {
     runHook postCheck
   '';
 
-  # Replace the launcher script with ours
-  postInstall = ''
-    substituteAll ${executable} $out/bin/phosh
-  '';
-
   # Depends on GSettings schemas in gnome-shell
   preFixup = ''
     gappsWrapperArgs+=(
       --prefix XDG_DATA_DIRS : "${gnome.gnome-shell}/share/gsettings-schemas/${gnome.gnome-shell.name}"
+      --set GNOME_SESSION "${gnome.gnome-session}/bin/gnome-session"
     )
   '';
 

From 544bf2c29b7634a7f62a92213e53852536c38abb Mon Sep 17 00:00:00 2001
From: Zhaofeng Li <hello@zhaofeng.li>
Date: Thu, 10 Jun 2021 23:43:24 +0000
Subject: [PATCH 019/416] nixos/phosh: Enable OpenGL by default

---
 nixos/modules/programs/phosh.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/modules/programs/phosh.nix b/nixos/modules/programs/phosh.nix
index ad954a3b2c82..cba3f73768ec 100644
--- a/nixos/modules/programs/phosh.nix
+++ b/nixos/modules/programs/phosh.nix
@@ -149,6 +149,8 @@ in {
 
     security.pam.services.phosh = {};
 
+    hardware.opengl.enable = mkDefault true;
+
     services.gnome.core-shell.enable = true;
     services.gnome.core-os-services.enable = true;
     services.xserver.displayManager.sessionPackages = [ pkgs.phosh ];

From 86b1feefbdd51d57b5ca5be0050d992126dee411 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Fri, 11 Jun 2021 08:24:56 +0200
Subject: [PATCH 020/416] nixos/zfs: add tests for samba

---
 nixos/tests/zfs.nix | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/nixos/tests/zfs.nix b/nixos/tests/zfs.nix
index ba5eb7cd528e..5a6138c68d47 100644
--- a/nixos/tests/zfs.nix
+++ b/nixos/tests/zfs.nix
@@ -18,13 +18,29 @@ let
         maintainers = [ adisbladis ];
       };
 
-      machine = { pkgs, lib, ... }: {
+      machine = { pkgs, lib, ... }:
+        let
+          usersharePath = "/var/lib/samba/usershares";
+        in {
         virtualisation.emptyDiskImages = [ 4096 ];
         networking.hostId = "deadbeef";
         boot.kernelPackages = kernelPackage;
         boot.supportedFilesystems = [ "zfs" ];
         boot.zfs.enableUnstable = enableUnstable;
 
+        services.samba = {
+          enable = true;
+          extraConfig = ''
+            registry shares = yes
+            usershare path = ${usersharePath}
+            usershare allow guests = yes
+            usershare max shares = 100
+            usershare owner only = no
+          '';
+        };
+        systemd.services.samba-smbd.serviceConfig.ExecStartPre =
+          "${pkgs.coreutils}/bin/mkdir -m +t -p ${usersharePath}";
+
         environment.systemPackages = [ pkgs.parted ];
 
         # Setup regular fileSystems machinery to ensure forceImportAll can be
@@ -60,6 +76,8 @@ let
             "zfs create -o mountpoint=legacy rpool/root",
             "mount -t zfs rpool/root /tmp/mnt",
             "udevadm settle",
+            "zfs set sharesmb=on rpool/root",
+            "smbclient -NL localhost",
             "umount /tmp/mnt",
             "zpool destroy rpool",
             "udevadm settle",

From c2148bebe7e6bfc0d3dd4a54901b84dbb48e4e4b Mon Sep 17 00:00:00 2001
From: Maas Lalani <maaslalani0@gmail.com>
Date: Fri, 11 Jun 2021 14:43:22 -0400
Subject: [PATCH 021/416] add maintainer: maaslalani

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 2448ad3f93da..66734b103c83 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -6140,6 +6140,12 @@
     githubId = 36235154;
     name = "Sean Haugh";
   };
+  maaslalani = {
+    email = "maaslalani0@gmail.com";
+    github = "maaslalani";
+    githubId = 42545625;
+    name = "Maas Lalani";
+  };
   madjar = {
     email = "georges.dubus@compiletoi.net";
     github = "madjar";

From 60a02255581d34dacaa27cf513830fde40ee46ed Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 12 Jun 2021 14:47:44 +0200
Subject: [PATCH 022/416] python3Packages.xknx: 0.18.5 -> 0.18.6

---
 pkgs/development/python-modules/xknx/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/xknx/default.nix b/pkgs/development/python-modules/xknx/default.nix
index b5c5f437d282..aae3b3b8d2d8 100644
--- a/pkgs/development/python-modules/xknx/default.nix
+++ b/pkgs/development/python-modules/xknx/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "xknx";
-  version = "0.18.5";
+  version = "0.18.6";
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "XKNX";
     repo = pname;
     rev = version;
-    sha256 = "sha256-hvLfcrN1NFKM2YezvMLSTNZtwpThEnT7eRUnVzbrK0Q=";
+    sha256 = "sha256-LyeEEynfgB3juprFeiIOFvFXWtTiGbZ8D9m6SnpD0ws=";
   };
 
   propagatedBuildInputs = [

From 41fe4148a188a1bbe0e8196226d4702e86d10058 Mon Sep 17 00:00:00 2001
From: Atemu <atemu.main@gmail.com>
Date: Sun, 13 Jun 2021 16:13:38 +0200
Subject: [PATCH 023/416] xorg: fix Bigelow & Holmes fonts license

---
 pkgs/servers/x11/xorg/overrides.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 1e6b9888ba2f..fa41d4492b79 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -903,13 +903,16 @@ self: super:
       "fontbhttf"
       "fontbh100dpi"
       "fontbh75dpi"
+
+      # Bigelow & Holmes fonts
+      # https://www.x.org/releases/current/doc/xorg-docs/License.html#Bigelow_Holmes_Inc_and_URW_GmbH_Luxi_font_license
+      "fontbhlucidatypewriter100dpi"
+      "fontbhlucidatypewriter75dpi"
     ];
 
     # unfree, possibly not redistributable
     unfree = [
       # no license, just a copyright notice
-      "fontbhlucidatypewriter100dpi"
-      "fontbhlucidatypewriter75dpi"
       "fontdaewoomisc"
 
       # unclear license, "permission to use"?

From 527686e7611bb70d9d5a338dab4490821942d643 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Domen=20Ko=C5=BEar?= <domen@dev.si>
Date: Mon, 14 Jun 2021 13:41:10 +0200
Subject: [PATCH 024/416] backport action: run only when the label starts with
 'backport'

---
 .github/workflows/backport.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 766b5aa831a3..79af5835463d 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -5,7 +5,7 @@ on:
 jobs:
   backport:
     name: Backport Pull Request
-    if: github.repository_owner == 'NixOS' && github.event.pull_request.merged == true
+    if: github.repository_owner == 'NixOS' && github.event.pull_request.merged == true && (github.event_name != 'labeled' || startsWith('backport', github.event.label.name))
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2

From b390b929bd454cec2a291b6bdcf8bee7946a87b7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Domen=20Ko=C5=BEar?= <domen@dev.si>
Date: Mon, 14 Jun 2021 13:47:22 +0200
Subject: [PATCH 025/416] direct-push action: delay to workaround eventually
 consistent DB

---
 .github/workflows/direct-push.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/direct-push.yml b/.github/workflows/direct-push.yml
index 6177004295ff..459475c3c6bc 100644
--- a/.github/workflows/direct-push.yml
+++ b/.github/workflows/direct-push.yml
@@ -17,6 +17,9 @@ jobs:
       run: |
         ISMERGE=$(curl -H 'Accept: application/vnd.github.groot-preview+json' -H "authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" https://api.github.com/repos/${{ env.GITHUB_REPOSITORY }}/commits/${{ env.GITHUB_SHA }}/pulls | jq -r '.[] | select(.merge_commit_sha == "${{ env.GITHUB_SHA }}") | any')
         echo "::set-output name=ismerge::$ISMERGE"
+    # github events are eventually consistent, so wait until changes propagate to thier DB
+    - run: sleep 60
+      if: steps.ismerge.outputs.ismerge != 'true'
     - name: Warn if the commit was a direct push
       if: steps.ismerge.outputs.ismerge != 'true'
       uses: peter-evans/commit-comment@v1

From 41a691d57036ec9ce8e4c6b8afefc0ccf08b4b47 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 4 Jun 2021 14:24:48 +0200
Subject: [PATCH 026/416] maintainers/teams: add tts team

---
 maintainers/team-list.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 3e6843f0e573..e14b5b3e9b32 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -203,4 +203,12 @@ with lib.maintainers; {
     ];
     scope = "Group registration for Serokell employees who collectively maintain packages.";
   };
+
+  tts = {
+    members = [
+      hexa
+      mic92
+    ];
+    scope = "coqui-ai TTS (formerly Mozilla TTS) and leaf packages";
+  };
 }

From acf743087ac8eec54d7c0a47e44c08324925d3de Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 4 Jun 2021 14:26:33 +0200
Subject: [PATCH 027/416] python3Packages.unidic-lite: init at 1.0.8

---
 .../python-modules/unidic-lite/default.nix    | 29 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 31 insertions(+)
 create mode 100644 pkgs/development/python-modules/unidic-lite/default.nix

diff --git a/pkgs/development/python-modules/unidic-lite/default.nix b/pkgs/development/python-modules/unidic-lite/default.nix
new file mode 100644
index 000000000000..eec9c7022a0d
--- /dev/null
+++ b/pkgs/development/python-modules/unidic-lite/default.nix
@@ -0,0 +1,29 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "unidic-lite";
+  version = "1.0.8";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0idj4yp0sl27ylr2wzkybbh0wj7c843lp7cljw5d1m7xv5r4b7fv";
+  };
+
+  # no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "unidic_lite"
+  ];
+
+  meta = with lib; {
+    description = "A small version of UniDic";
+    homepage = "https://github.com/polm/unidic-lite";
+    license = licenses.mit;
+    maintainers = teams.tts.members;
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 2c51f9ccbab9..4e4e4fa8967c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8694,6 +8694,8 @@ in {
 
   unidecode = callPackage ../development/python-modules/unidecode { };
 
+  unidic-lite = callPackage ../development/python-modules/unidic-lite { };
+
   unidiff = callPackage ../development/python-modules/unidiff { };
 
   unifi = callPackage ../development/python-modules/unifi { };

From 841dd58a1592b992507d5fc224b1a29fcd0cf736 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 4 Jun 2021 14:36:58 +0200
Subject: [PATCH 028/416] python3Packages.anyascii: init at 0.2.0

---
 .../python-modules/anyascii/default.nix       | 29 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 31 insertions(+)
 create mode 100644 pkgs/development/python-modules/anyascii/default.nix

diff --git a/pkgs/development/python-modules/anyascii/default.nix b/pkgs/development/python-modules/anyascii/default.nix
new file mode 100644
index 000000000000..8e8b1c920733
--- /dev/null
+++ b/pkgs/development/python-modules/anyascii/default.nix
@@ -0,0 +1,29 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchPypi
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "anyascii";
+  version = "0.2.0";
+  format = "setuptools";
+  disabled = pythonOlder "3.3";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1b6jdd9nx15py0jqjdn154m6m491517sqlk57bbyj3x4xzywadkh";
+  };
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  meta = with lib; {
+    description = "Unicode to ASCII transliteration";
+    homepage = "https://github.com/anyascii/anyascii";
+    license = licenses.isc;
+    maintainers = teams.tts.members;
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 4e4e4fa8967c..d13d50cc2f4f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -461,6 +461,8 @@ in {
     inherit (pkgs) antlr4;
   };
 
+  anyascii = callPackage ../development/python-modules/anyascii { };
+
   anyio = callPackage ../development/python-modules/anyio { };
 
   anyjson = callPackage ../development/python-modules/anyjson { };

From f937103c9a5cb5dbce3a8cbeef403b557847ad79 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 4 Jun 2021 14:38:01 +0200
Subject: [PATCH 029/416] python3Packages: adopt tts leaf packages

---
 pkgs/development/python-modules/coqpit/default.nix   | 2 +-
 pkgs/development/python-modules/inflect/default.nix  | 1 +
 pkgs/development/python-modules/jieba/default.nix    | 1 +
 pkgs/development/python-modules/pypinyin/default.nix | 2 +-
 pkgs/development/python-modules/pysbd/default.nix    | 2 +-
 5 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/coqpit/default.nix b/pkgs/development/python-modules/coqpit/default.nix
index c4df114e24df..e42df2fdd4f8 100644
--- a/pkgs/development/python-modules/coqpit/default.nix
+++ b/pkgs/development/python-modules/coqpit/default.nix
@@ -32,6 +32,6 @@ buildPythonPackage rec {
     '';
     homepage = "https://github.com/coqui-ai/coqpit";
     license = licenses.mit;
-    maintainers = with maintainers; [ hexa mic92 ];
+    maintainers = teams.tts.members;
   };
 }
diff --git a/pkgs/development/python-modules/inflect/default.nix b/pkgs/development/python-modules/inflect/default.nix
index f81ceabd27e1..9081a30ac6be 100644
--- a/pkgs/development/python-modules/inflect/default.nix
+++ b/pkgs/development/python-modules/inflect/default.nix
@@ -28,5 +28,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/jaraco/inflect";
     changelog = "https://github.com/jaraco/inflect/blob/v${version}/CHANGES.rst";
     license = licenses.mit;
+    maintainers = teams.tts.members;
   };
 }
diff --git a/pkgs/development/python-modules/jieba/default.nix b/pkgs/development/python-modules/jieba/default.nix
index b515cd92b23b..8b7146ebef93 100644
--- a/pkgs/development/python-modules/jieba/default.nix
+++ b/pkgs/development/python-modules/jieba/default.nix
@@ -29,5 +29,6 @@ buildPythonPackage rec {
     description = "Chinese Words Segementation Utilities";
     homepage = "https://github.com/fxsjy/jieba";
     license = licenses.mit;
+    maintainers = teams.tts.members;
   };
 }
diff --git a/pkgs/development/python-modules/pypinyin/default.nix b/pkgs/development/python-modules/pypinyin/default.nix
index 9615e07d7c74..3e5f6db35eaf 100644
--- a/pkgs/development/python-modules/pypinyin/default.nix
+++ b/pkgs/development/python-modules/pypinyin/default.nix
@@ -33,6 +33,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/mozillazg/python-pinyin";
     changelog = "https://github.com/mozillazg/python-pinyin/blob/master/CHANGELOG.rst";
     license = licenses.mit;
-    maintainers = with maintainers; [ hexa mic92 ];
+    maintainers = teams.tts.members;
   };
 }
diff --git a/pkgs/development/python-modules/pysbd/default.nix b/pkgs/development/python-modules/pysbd/default.nix
index e1e0578c83b8..f25283dbbbcc 100644
--- a/pkgs/development/python-modules/pysbd/default.nix
+++ b/pkgs/development/python-modules/pysbd/default.nix
@@ -26,6 +26,6 @@ buildPythonPackage rec {
     description = "Pysbd (Python Sentence Boundary Disambiguation) is a rule-based sentence boundary detection that works out-of-the-box across many languages";
     homepage = "https://github.com/nipunsadvilkar/pySBD";
     license = licenses.mit;
-    maintainers = [ maintainers.mic92 ];
+    maintainers = teams.tts.members;
   };
 }

From bf738e2ee998e9819f5300a6e0a4a189102a006f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 4 Jun 2021 14:45:33 +0200
Subject: [PATCH 030/416] python3Packages.coqpit: 0.0.6.6 -> 0.9.0

---
 pkgs/development/python-modules/coqpit/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/coqpit/default.nix b/pkgs/development/python-modules/coqpit/default.nix
index e42df2fdd4f8..96e18d76ba74 100644
--- a/pkgs/development/python-modules/coqpit/default.nix
+++ b/pkgs/development/python-modules/coqpit/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "coqpit";
-  version = "0.0.6.6";
+  version = "0.0.9";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "coqui-ai";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0wb5wf84i5h4ycm732kn4316v7schhm91s2rrklfw9sny5dqmdnh";
+    sha256 = "1dh3bp7m9fjfrfrahblibrx91sagndkdi0325ail63kyvlhzbkma";
   };
 
   checkInputs = [

From e65339d62faef420ad1edfad19fadc2c2b355259 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 4 Jun 2021 14:46:55 +0200
Subject: [PATCH 031/416] tts: 0.0.14 -> 0.0.15

---
 pkgs/tools/audio/tts/default.nix | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/pkgs/tools/audio/tts/default.nix b/pkgs/tools/audio/tts/default.nix
index 51976a2d6a11..7be8c62c8341 100644
--- a/pkgs/tools/audio/tts/default.nix
+++ b/pkgs/tools/audio/tts/default.nix
@@ -12,20 +12,20 @@
 #
 # If you upgrade from an old version you may have to delete old models from ~/.local/share/tts
 # Also note that your tts version might not support all available models so check:
-#   https://github.com/coqui-ai/TTS/releases/tag/v0.0.14
+#   https://github.com/coqui-ai/TTS/releases/tag/v0.0.15
 #
 # For now, for deployment check the systemd unit in the pull request:
 #   https://github.com/NixOS/nixpkgs/pull/103851#issue-521121136
 
 python3Packages.buildPythonApplication rec {
   pname = "tts";
-  version = "0.0.14";
+  version = "0.0.15";
 
   src = fetchFromGitHub {
     owner = "coqui-ai";
     repo = "TTS";
     rev = "v${version}";
-    sha256 = "0cl0ri90mx0y19fmqww73lp5nv6qkpc45rm4157i7p6q6llajdhp";
+    sha256 = "0pbzkjk2hncj22xh5lq5anlnvzkpfa7nxr1s2p6hshpln3mqjqs7";
   };
 
   postPatch = ''
@@ -41,6 +41,7 @@ python3Packages.buildPythonApplication rec {
   ];
 
   propagatedBuildInputs = with python3Packages; [
+    anyascii
     coqpit
     flask
     gdown
@@ -48,6 +49,7 @@ python3Packages.buildPythonApplication rec {
     jieba
     librosa
     matplotlib
+    mecab-python3
     numba
     pandas
     pypinyin
@@ -56,9 +58,10 @@ python3Packages.buildPythonApplication rec {
     scipy
     soundfile
     tensorboardx
+    tensorflow
     tqdm
     umap-learn
-    unidecode
+    unidic-lite
   ];
 
   postInstall = ''
@@ -100,16 +103,15 @@ python3Packages.buildPythonApplication rec {
 
   disabledTestPaths = [
     # requires tensorflow
-    "tests/test_tacotron2_tf_model.py"
     "tests/vocoder_tests/test_vocoder_tf_pqmf.py"
     "tests/vocoder_tests/test_vocoder_tf_melgan_generator.py"
+    "tests/tts_tests/test_tacotron2_tf_model.py"
     # RuntimeError: fft: ATen not compiled with MKL support
     "tests/vocoder_tests/test_fullband_melgan_train.py"
     "tests/vocoder_tests/test_hifigan_train.py"
     "tests/vocoder_tests/test_melgan_train.py"
     "tests/vocoder_tests/test_multiband_melgan_train.py"
     "tests/vocoder_tests/test_parallel_wavegan_train.py"
-
   ];
 
   meta = with lib; {

From 49b7bdb5c4d05b34f6192c47c67f05e411fdaf3b Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 15 Jun 2021 13:13:10 +0200
Subject: [PATCH 032/416] python3Packages.pypinyin: 0.41.0 -> 0.42.0

---
 pkgs/development/python-modules/pypinyin/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pypinyin/default.nix b/pkgs/development/python-modules/pypinyin/default.nix
index 3e5f6db35eaf..edefbf16ca2d 100644
--- a/pkgs/development/python-modules/pypinyin/default.nix
+++ b/pkgs/development/python-modules/pypinyin/default.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "pypinyin";
-  version = "0.41.0";
+  version = "0.42.0";
 
   src = fetchFromGitHub {
     owner = "mozillazg";
     repo = "python-pinyin";
     rev = "v${version}";
-    sha256 = "1s01dd5n6cgjg24dmji0abxkyvr1yi18lx4rpm9z54v0q3wkccg9";
+    sha256 = "0i0ggizkgd809ylz74j1v5lfpyifz3wypj6f8l8fr5ad7a7r9s09";
   };
 
   postPatch = ''

From b4c069b1476a92a540e906ef95cd7fb380d29c63 Mon Sep 17 00:00:00 2001
From: talyz <kim.lindberger@gmail.com>
Date: Wed, 16 Jun 2021 10:25:45 +0200
Subject: [PATCH 033/416] nixos/fail2ban: Remove `reloadIfChanged = true`

This makes the service fail when upgrading the package, so let's
properly restart it instead.
---
 nixos/modules/services/security/fail2ban.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/nixos/modules/services/security/fail2ban.nix b/nixos/modules/services/security/fail2ban.nix
index 0c24972823dd..07702bfb9d0f 100644
--- a/nixos/modules/services/security/fail2ban.nix
+++ b/nixos/modules/services/security/fail2ban.nix
@@ -257,7 +257,6 @@ in
       partOf = optional config.networking.firewall.enable "firewall.service";
 
       restartTriggers = [ fail2banConf jailConf pathsConf ];
-      reloadIfChanged = true;
 
       path = [ cfg.package cfg.packageFirewall pkgs.iproute2 ] ++ cfg.extraPackages;
 

From a7e07612736477bf88c5ef683a1dfce8b57a0283 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Thu, 17 Jun 2021 01:43:52 +0000
Subject: [PATCH 034/416] brave: 1.25.72 -> 1.25.73

---
 pkgs/applications/networking/browsers/brave/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix
index 341462744079..8b3cee86fdfd 100644
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@@ -90,11 +90,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "brave";
-  version = "1.25.72";
+  version = "1.25.73";
 
   src = fetchurl {
     url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "7bvcLKc/ZyVSTGOsRIO9qgHc8dSYOJaoEHJw7V2Vl/M=";
+    sha256 = "mSK3hT0Rp03Bq0k+NCYo6S5w+eA9SXXxO3Lo7QWrc9U=";
   };
 
   dontConfigure = true;

From d0c34a1642945d21d794207682525f93b1ecc889 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Thu, 17 Jun 2021 05:09:31 +0000
Subject: [PATCH 035/416] fly: 7.3.1 -> 7.3.2

---
 pkgs/development/tools/continuous-integration/fly/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/continuous-integration/fly/default.nix b/pkgs/development/tools/continuous-integration/fly/default.nix
index a4769b10b352..22b7752c5939 100644
--- a/pkgs/development/tools/continuous-integration/fly/default.nix
+++ b/pkgs/development/tools/continuous-integration/fly/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "fly";
-  version = "7.3.1";
+  version = "7.3.2";
 
   src = fetchFromGitHub {
     owner = "concourse";
     repo = "concourse";
     rev = "v${version}";
-    sha256 = "sha256-JtzJDbln+n05oJjA/ydZWaH4dIPLL/ZsNg+Gr+YBcng=";
+    sha256 = "sha256-ID/vqkFzKHLeuojHUxUFYURn+Dxb78XwxfJVV+S130A=";
   };
 
   vendorSha256 = "sha256-30rrRkPIH0sr8koKRLs1Twe6Z55+lr9gkgUDrY+WOTw=";

From 2f4e5ccd6d4c8dd8ab1b94ea06b1f387377c0407 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 17 Jun 2021 16:01:49 +0200
Subject: [PATCH 036/416] terraform-providers.vsphere: 1.24.3 -> 2.0.1

https://github.com/hashicorp/terraform-provider-vsphere/blob/v2.0.1/CHANGELOG.md\#201-june-09-2021
---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 3afce9ce1ab0..390b1c757a3e 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1121,10 +1121,10 @@
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/vsphere",
     "repo": "terraform-provider-vsphere",
-    "rev": "v1.24.3",
-    "sha256": "1sc60x3r4nb48p8yb7778fpk78acq808jzcd5ijnwxqakccml5kl",
+    "rev": "v2.0.1",
+    "sha256": "0ah3bi4zpg8j59v4bj9a8vyknpnyl1g8bx4qyfwwz4gnqp9m4anr",
     "vendorSha256": null,
-    "version": "1.24.3"
+    "version": "2.0.1"
   },
   "vthunder": {
     "owner": "terraform-providers",

From 3b648a5e52a17a819d5ea37f10f37c7f54cd1115 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Thu, 17 Jun 2021 17:07:36 +0000
Subject: [PATCH 037/416] imgproxy: 2.16.3 -> 2.16.4

---
 pkgs/servers/imgproxy/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/imgproxy/default.nix b/pkgs/servers/imgproxy/default.nix
index 780b3c5eb20c..b0d013602417 100644
--- a/pkgs/servers/imgproxy/default.nix
+++ b/pkgs/servers/imgproxy/default.nix
@@ -3,16 +3,16 @@
 
 buildGoModule rec {
   pname = "imgproxy";
-  version = "2.16.3";
+  version = "2.16.4";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    sha256 = "sha256-WK5TAI+dYmBLNp1A0p9DbWF7ZEw3dqr+Cuwy7LzrdBM=";
+    sha256 = "sha256-25oOGkTc19PHlU0Va7IPKrvGK9pDrGqKZa6qNFMVphQ=";
     rev = "v${version}";
   };
 
-  vendorSha256 = "sha256-7IpMgsATQ1SMuBOF9agHIN2Lx6OKxRr0Zk5SRFxHiQ4=";
+  vendorSha256 = "sha256-y8cXe4+jTLnM7K+na2VHGXkPgZjFYdgtDd14D8KiCas=";
 
   doCheck = false;
 

From 77e8bf2cc385958a91166e009ce58beab7782947 Mon Sep 17 00:00:00 2001
From: Ebrahim <dearrude@tfwno.gf>
Date: Fri, 18 Jun 2021 04:08:27 +0430
Subject: [PATCH 038/416]  maintainers: add dearrude

Add Ebrahim Nejati on maintainers list
---
 maintainers/maintainer-list.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 9e000409f446..46a91a7e3447 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2381,6 +2381,16 @@
     githubId = 75067;
     name = "Daniel Duan";
   };
+  dearrude = {
+    name = "Ebrahim Nejati";
+    email = "dearrude@tfwno.gf";
+    github = "dearrude";
+    githubId = 30749142;
+    keys = [{
+      longkeyid = "rsa4096/19151E03BF2CF012";
+      fingerprint = "4E35 F2E5 2132 D654 E815  A672 DB2C BC24 2868 6000";
+    }];
+  };
   deepfire = {
     email = "_deepfire@feelingofgreen.ru";
     github = "deepfire";

From 25eff5eb7dc52234b26b0d5626f7d4c7fdfad63f Mon Sep 17 00:00:00 2001
From: Ebrahim <dearrude@tfwno.gf>
Date: Fri, 18 Jun 2021 04:20:11 +0430
Subject: [PATCH 039/416] vazir-code-font: init at 1.1.2

Vazir code is one of Rastikerdar's fonts which makes
Arabic/Persian characters monospaced.
---
 pkgs/data/fonts/vazir-code-font/default.nix | 27 +++++++++++++++++++++
 pkgs/top-level/all-packages.nix             |  2 ++
 2 files changed, 29 insertions(+)
 create mode 100644 pkgs/data/fonts/vazir-code-font/default.nix

diff --git a/pkgs/data/fonts/vazir-code-font/default.nix b/pkgs/data/fonts/vazir-code-font/default.nix
new file mode 100644
index 000000000000..d1a3e9b2159b
--- /dev/null
+++ b/pkgs/data/fonts/vazir-code-font/default.nix
@@ -0,0 +1,27 @@
+{ lib, fetchFromGitHub }:
+
+let
+  pname = "vazir-code-font";
+  version = "1.1.2";
+in fetchFromGitHub {
+  name = "${pname}-${version}";
+
+  owner = "rastikerdar";
+  repo = "vazir-code-font";
+  rev = "v${version}";
+
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/truetype {} \;
+  '';
+  sha256 = "0ivwpn9xm2zwhwgg9mghyiy5v66cn4786w9j6rkff5cmzshv279r";
+
+  meta = with lib; {
+    homepage = "https://github.com/rastikerdar/vazir-code-font";
+    description =
+      "A Persian (farsi) Monospaced Font for coding - فونت (قلم) فارسی وزیرکد برای کد نویسی ";
+    license = licenses.publicDomain;
+    platforms = platforms.all;
+    maintainers = [ maintainers.dearrude ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7bc9f0d036b4..c8b9a26af3e1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -31362,6 +31362,8 @@ in
 
   vaultenv = haskellPackages.vaultenv;
 
+  vazir-code-font = callPackage ../data/fonts/vazir-code-font { };
+
   vazir-fonts = callPackage ../data/fonts/vazir-fonts { };
 
   vbam = callPackage ../misc/emulators/vbam { };

From 35a8d78e44d566d6d2ddba42ae5137f7a511a090 Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Fri, 18 Jun 2021 02:50:34 +0200
Subject: [PATCH 040/416] nixos-rebuild: fix --use-remote-sudo

Currently fails with:

  $ nixos-rebuild test --target-host myhost --use-remote-sudo
  building Nix...
  sudo: /run/current-system/sw/bin/sudo must be owned by uid 0 and have the setuid bit set

It seems setting an explicit PATH in the ssh command overrides the
remote setuid wrappers.
---
 pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
index d6853bf47299..69e0dee1d20c 100755
--- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
@@ -139,7 +139,7 @@ buildHostCmd() {
     if [ -z "$buildHost" ]; then
         "$@"
     elif [ -n "$remoteNix" ]; then
-        ssh $SSHOPTS "$buildHost" env PATH="$remoteNix":'$PATH' "${maybeSudo[@]}" "$@"
+        ssh $SSHOPTS "$buildHost" "${maybeSudo[@]}" env PATH="$remoteNix":'$PATH' "$@"
     else
         ssh $SSHOPTS "$buildHost" "${maybeSudo[@]}" "$@"
     fi

From ec03aa21d7f344d0533b429ed8b4a229a83bf0bb Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Fri, 18 Jun 2021 04:20:00 +0000
Subject: [PATCH 041/416] tectonic: 0.5.2 -> 0.6.4

---
 pkgs/tools/typesetting/tectonic/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/typesetting/tectonic/default.nix b/pkgs/tools/typesetting/tectonic/default.nix
index dd92477d1739..3209ccf6029f 100644
--- a/pkgs/tools/typesetting/tectonic/default.nix
+++ b/pkgs/tools/typesetting/tectonic/default.nix
@@ -3,17 +3,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tectonic";
-  version = "0.5.2";
+  version = "0.6.4";
 
   src = fetchFromGitHub {
     owner = "tectonic-typesetting";
     repo = "tectonic";
     rev = "tectonic@${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-JQ78N+cfk1D6xZixoUvYiLP6ZwovBn/ro1CZoutBwp8=";
+    sha256 = "11q0vwgjlailkw4l9z7r54wkxi8dwh40pm7bd74dcvm0x4323fpd";
   };
 
-  cargoSha256 = "sha256-disJme0UM6U+yWjGsPya0xDvW6iQsipqMkEALeJ99xU=";
+  cargoSha256 = "1drfgrsfz44yqz15bcmb3dyyz7dr9zbs3idl1ssaiir24d4z1m9z";
 
   nativeBuildInputs = [ pkg-config ];
 

From 8af39ed0ac4120b100c8e8e85be65df097a7183c Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Fri, 18 Jun 2021 04:20:00 +0000
Subject: [PATCH 042/416] postgresqlPackages.pgvector: 0.1.6 -> 0.1.7

---
 pkgs/servers/sql/postgresql/ext/pgvector.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/ext/pgvector.nix b/pkgs/servers/sql/postgresql/ext/pgvector.nix
index a3be7d50a01e..53dfee7d0326 100644
--- a/pkgs/servers/sql/postgresql/ext/pgvector.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgvector.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pgvector";
-  version = "0.1.6";
+  version = "0.1.7";
 
   src = fetchFromGitHub {
     owner = "ankane";
     repo = pname;
     rev = "v${version}";
-    sha256 = "108qf5pvqhz4vh31sijikajf4hrrk7rknrqzwj999psr33acag4z";
+    sha256 = "07m1nn640by5q22q2s1nlmjp14q5ffbyib28kjzlss0mq8acb439";
   };
 
   buildInputs = [ postgresql ];

From 2dfe998b8d5f207643ef74428e3ab6cffa3cfc85 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Fri, 18 Jun 2021 04:20:00 +0000
Subject: [PATCH 043/416] pgcenter: 0.8.0 -> 0.9.0

https://github.com/lesovsky/pgcenter/releases/tag/v0.9.0
---
 pkgs/tools/misc/pgcenter/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/misc/pgcenter/default.nix b/pkgs/tools/misc/pgcenter/default.nix
index 27e228f0f205..c27252cc7069 100644
--- a/pkgs/tools/misc/pgcenter/default.nix
+++ b/pkgs/tools/misc/pgcenter/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "pgcenter";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner  = "lesovsky";
     repo   = "pgcenter";
     rev    = "v${version}";
-    sha256 = "sha256-ow26wuM7nw/WbeaPVcNm5iYUYLydeujhw+7BcTirPcA=";
+    sha256 = "0l3da7migx1gprhlwc98x30qh6lmrn8hizanxgs3hxl0arbrn710";
   };
 
-  vendorSha256 = "sha256-9hYiyZ34atmSL7JvuXyiGU7HR4E6qN7bGZlyU+hP+FU=";
+  vendorSha256 = "0mgq9zl56wlr37dxxa1sh53wfkhrl9ybjvxj5y9djspqkp4j45pn";
 
   subPackages = [ "cmd" ];
 
@@ -25,6 +25,7 @@ buildGoModule rec {
 
   meta = with lib; {
     homepage = "https://pgcenter.org/";
+    changelog = "https://github.com/lesovsky/pgcenter/raw/v${version}/doc/Changelog";
     description = "Command-line admin tool for observing and troubleshooting PostgreSQL";
     license = licenses.bsd3;
     maintainers = [ maintainers.marsam ];

From e30e177ff1dd68a38353edf1abc9c7064318c14d Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Fri, 18 Jun 2021 04:20:00 +0000
Subject: [PATCH 044/416] brakeman: 5.0.0 -> 5.0.4

---
 pkgs/development/tools/analysis/brakeman/Gemfile   |  2 ++
 .../tools/analysis/brakeman/Gemfile.lock           | 13 +++++++++++++
 .../tools/analysis/brakeman/default.nix            | 14 +++++++-------
 .../development/tools/analysis/brakeman/gemset.nix | 12 ++++++++++++
 4 files changed, 34 insertions(+), 7 deletions(-)
 create mode 100644 pkgs/development/tools/analysis/brakeman/Gemfile
 create mode 100644 pkgs/development/tools/analysis/brakeman/Gemfile.lock
 create mode 100644 pkgs/development/tools/analysis/brakeman/gemset.nix

diff --git a/pkgs/development/tools/analysis/brakeman/Gemfile b/pkgs/development/tools/analysis/brakeman/Gemfile
new file mode 100644
index 000000000000..1ff5490b0a77
--- /dev/null
+++ b/pkgs/development/tools/analysis/brakeman/Gemfile
@@ -0,0 +1,2 @@
+source "https://rubygems.org"
+gem "brakeman"
diff --git a/pkgs/development/tools/analysis/brakeman/Gemfile.lock b/pkgs/development/tools/analysis/brakeman/Gemfile.lock
new file mode 100644
index 000000000000..13425cf9ee76
--- /dev/null
+++ b/pkgs/development/tools/analysis/brakeman/Gemfile.lock
@@ -0,0 +1,13 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    brakeman (5.0.4)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  brakeman
+
+BUNDLED WITH
+   2.1.4
diff --git a/pkgs/development/tools/analysis/brakeman/default.nix b/pkgs/development/tools/analysis/brakeman/default.nix
index 3ac6b34f9488..72c4b1fbc3e3 100644
--- a/pkgs/development/tools/analysis/brakeman/default.nix
+++ b/pkgs/development/tools/analysis/brakeman/default.nix
@@ -1,11 +1,11 @@
-{ lib, ruby, buildRubyGem }:
+{ lib, ruby, bundlerApp, bundlerUpdateScript }:
 
-buildRubyGem rec {
-  inherit ruby;
-  name = "${gemName}-${version}";
-  gemName = "brakeman";
-  version = "5.0.0";
-  source.sha256 = "0k1ynqsr9b0vnxqb7d5hbdk4q1i98zjzdnx4y1ylikz4rmkizf91";
+bundlerApp rec {
+  pname = "brakeman";
+  exes = [ "brakeman" ];
+  gemdir = ./.;
+
+  passthru.updateScript = bundlerUpdateScript "brakeman";
 
   meta = with lib; {
     description = "Static analysis security scanner for Ruby on Rails";
diff --git a/pkgs/development/tools/analysis/brakeman/gemset.nix b/pkgs/development/tools/analysis/brakeman/gemset.nix
new file mode 100644
index 000000000000..f37158353e00
--- /dev/null
+++ b/pkgs/development/tools/analysis/brakeman/gemset.nix
@@ -0,0 +1,12 @@
+{
+  brakeman = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1czqmrqbli2cnw4vv4pzz8bk78c7lpcnnyba74cj632swv1za6jd";
+      type = "gem";
+    };
+    version = "5.0.4";
+  };
+}

From 668216cd0eedf5d2863fbbd9cd74db6798eb2c86 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Fri, 18 Jun 2021 04:34:09 +0000
Subject: [PATCH 045/416] fission: 1.12.0 -> 1.13.0

---
 pkgs/development/tools/fission/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/fission/default.nix b/pkgs/development/tools/fission/default.nix
index 133db2d9ff00..3045842d91f0 100644
--- a/pkgs/development/tools/fission/default.nix
+++ b/pkgs/development/tools/fission/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "fission";
-  version = "1.12.0";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     owner = "fission";
     repo = "fission";
     rev = version;
-    sha256 = "0izvkjd7ydcxhr6zmgrbfm3ybz2kf4p27099lr07gd4x7c6xxmqr";
+    sha256 = "sha256-WCynU5+d789d584JH99jmTZSEbyco2ysuBXIC2pW1r4=";
   };
 
-  vendorSha256 = "12clw0wy4lypf45imqnabj39yxqpi348csr4m5d0d1rksxgvwngq";
+  vendorSha256 = "sha256-V3/IFCbW3wXfNiFzucLeyFDc6SA2nE+NwO0sNEBmIYg=";
 
   buildFlagsArray = "-ldflags=-s -w -X info.Version=${version}";
 

From a4826b88d75b7a34f51e5911dc30b241ff4b98c5 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Fri, 18 Jun 2021 04:53:39 +0000
Subject: [PATCH 046/416] flyctl: 0.0.223 -> 0.0.227

---
 pkgs/development/web/flyctl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/web/flyctl/default.nix b/pkgs/development/web/flyctl/default.nix
index 262ddc5d7218..130ff9c9bcbf 100644
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.0.223";
+  version = "0.0.227";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    sha256 = "sha256-HDxFjEXQ33U2SiRz/e6vurZo710ibArdGLZcLoou17I=";
+    sha256 = "sha256-nql0zK2H0FDQMsnSJSNzC7YmvUZfITHH5p1efFHsj58=";
   };
 
   preBuild = ''

From d37cd94a4ad3a9a892ec0f828de22e1d41f86165 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Fri, 18 Jun 2021 05:19:40 +0000
Subject: [PATCH 047/416] gamecube-tools: 1.0.2 -> 1.0.4

---
 pkgs/development/tools/gamecube-tools/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/gamecube-tools/default.nix b/pkgs/development/tools/gamecube-tools/default.nix
index 2f7c088cd486..d7715d67acb4 100644
--- a/pkgs/development/tools/gamecube-tools/default.nix
+++ b/pkgs/development/tools/gamecube-tools/default.nix
@@ -2,7 +2,7 @@
 , freeimage, libGL }:
 
 stdenv.mkDerivation rec {
-  version = "1.0.2";
+  version = "1.0.4";
   pname = "gamecube-tools";
 
   nativeBuildInputs = [ autoreconfHook ];
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     owner = "devkitPro";
     repo  = "gamecube-tools";
     rev = "v${version}";
-    sha256 = "0zvpkzqvl8iv4ndzhkjkmrzpampyzgb91spv0h2x2arl8zy4z7ca";
+    sha256 = "sha256-0iMY2LokfsYgHzIuFc8RlrVlJCURqVqprP54PG4oW0M=";
   };
 
   meta = with lib; {

From 08aaf6851111d19b1d031b5c81462be79f17513f Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Fri, 18 Jun 2021 05:43:45 +0000
Subject: [PATCH 048/416] gitstatus: 1.5.1 -> 1.5.2

---
 .../version-management/git-and-tools/gitstatus/default.nix    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/version-management/git-and-tools/gitstatus/default.nix b/pkgs/applications/version-management/git-and-tools/gitstatus/default.nix
index 3817ce7fa4fa..ab0ce9c7cd0f 100644
--- a/pkgs/applications/version-management/git-and-tools/gitstatus/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gitstatus/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gitstatus";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "romkatv";
     repo = "gitstatus";
     rev = "v${version}";
-    sha256 = "1ffgh5826985phc8amvzl9iydvsnij5brh4gczfh201vfmw9d4hh";
+    sha256 = "sha256-MQG4thW73gDqY68bKP2FO8z5uc2R/tED+/X9qas/GOA=";
   };
 
   buildInputs = [ (callPackage ./romkatv_libgit2.nix {}) ];

From d9428fe9b5ad09c3113e31b77a0b3890b8adfb85 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Fri, 18 Jun 2021 07:45:10 +0000
Subject: [PATCH 049/416] jackett: 0.18.234 -> 0.18.345

---
 pkgs/servers/jackett/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/jackett/default.nix b/pkgs/servers/jackett/default.nix
index d78524039858..0bd0227ece6f 100644
--- a/pkgs/servers/jackett/default.nix
+++ b/pkgs/servers/jackett/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "jackett";
-  version = "0.18.234";
+  version = "0.18.345";
 
   src = fetchurl {
     url = "https://github.com/Jackett/Jackett/releases/download/v${version}/Jackett.Binaries.Mono.tar.gz";
-    sha256 = "sha256-F01iR1BdSWCBqBI+Mh8uyzWKIbiMR2tOW6sJgFU3hG8=";
+    sha256 = "sha256-cCUlKyndKAU57hSRZYWqwOthfjIirE5c95HRETnFEiA=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 5f555f58c1896f4bad3306f8d44fea7373d1e377 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Favier?= <n@monade.li>
Date: Fri, 18 Jun 2021 02:14:35 +0200
Subject: [PATCH 050/416] xfce.thunar-media-tags-plugin: init at 0.3.0

---
 pkgs/desktops/xfce/default.nix                |  2 ++
 .../thunar-plugins/media-tags/default.nix     | 36 +++++++++++++++++++
 2 files changed, 38 insertions(+)
 create mode 100644 pkgs/desktops/xfce/thunar-plugins/media-tags/default.nix

diff --git a/pkgs/desktops/xfce/default.nix b/pkgs/desktops/xfce/default.nix
index 6ccd2a0c6124..c72d20b9d8f7 100644
--- a/pkgs/desktops/xfce/default.nix
+++ b/pkgs/desktops/xfce/default.nix
@@ -35,6 +35,8 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   thunar-dropbox-plugin = callPackage ./thunar-plugins/dropbox { };
 
+  thunar-media-tags-plugin = callPackage ./thunar-plugins/media-tags { };
+
   tumbler = callPackage ./core/tumbler { };
 
   xfce4-panel = callPackage ./core/xfce4-panel { };
diff --git a/pkgs/desktops/xfce/thunar-plugins/media-tags/default.nix b/pkgs/desktops/xfce/thunar-plugins/media-tags/default.nix
new file mode 100644
index 000000000000..0ae0c3523365
--- /dev/null
+++ b/pkgs/desktops/xfce/thunar-plugins/media-tags/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, mkXfceDerivation
+, gtk3
+, thunar
+, exo
+, libxfce4util
+, intltool
+, gettext
+, taglib
+}:
+
+mkXfceDerivation {
+  category = "thunar-plugins";
+  pname = "thunar-media-tags-plugin";
+  version = "0.3.0";
+
+  sha256 = "sha256-jtgcHH5U5GOvzDVUwPEreMtTdk5DT6sXvFPDbzbF684=";
+
+  nativeBuildInputs = [
+    intltool
+    gettext
+  ];
+
+  buildInputs = [
+    thunar
+    exo
+    gtk3
+    libxfce4util
+    taglib
+  ];
+
+  meta = with lib; {
+    description = "Thunar plugin providing tagging and renaming features for media files";
+    maintainers = with maintainers; [ ncfavier ];
+  };
+}

From 8820b0c3ed6967890c8bdec0a2354229bea9e250 Mon Sep 17 00:00:00 2001
From: Chad Jablonski <chad@jablonski.xyz>
Date: Fri, 18 Jun 2021 09:16:11 -0400
Subject: [PATCH 051/416] maintainers: add cjab

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index edf5901bf537..c7f69479b651 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1883,6 +1883,12 @@
     githubId = 2131991;
     name = "Elmo Todurov";
   };
+  cjab = {
+    email = "chad+nixpkgs@jablonski.xyz";
+    github = "cjab";
+    githubId = 136485;
+    name = "Chad Jablonski";
+  };
   ck3d = {
     email = "ck3d@gmx.de";
     github = "ck3d";

From 2a90b3329b18fadf35bf79966cd2330d83547b7e Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Fri, 18 Jun 2021 17:11:23 +0200
Subject: [PATCH 052/416] searx: patch to fix a crash

If the `default_doi_resolver` and `use_default_settings` are used
together searx crashes.
---
 pkgs/servers/web-apps/searx/default.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/servers/web-apps/searx/default.nix b/pkgs/servers/web-apps/searx/default.nix
index 43fb374fe117..3ba6f3270425 100644
--- a/pkgs/servers/web-apps/searx/default.nix
+++ b/pkgs/servers/web-apps/searx/default.nix
@@ -1,4 +1,4 @@
-{ lib, nixosTests, python3, python3Packages, fetchFromGitHub }:
+{ lib, nixosTests, python3, python3Packages, fetchFromGitHub, fetchpatch }:
 
 with python3Packages;
 
@@ -14,6 +14,14 @@ toPythonModule (buildPythonApplication rec {
     sha256 = "0ghkx8g8jnh8yd46p4mlbjn2zm12nx27v7qflr4c8xhlgi0px0mh";
   };
 
+  patches = [
+    # Fix a crash, remove with the next update
+    (fetchpatch {
+      url = "https://github.com/searx/searx/commit/9c10b150963babb7f0b52081693a42b2e61eede9.patch";
+      sha256 = "0svp8799628wja2hq59da6rxqi99am8p6hb8y27ciwzsjz0wwba7";
+    })
+  ];
+
   postPatch = ''
     sed -i 's/==.*$//' requirements.txt
   '';

From b1d42dbe6d5e079be7453241c7a4b539366feff4 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Fri, 18 Jun 2021 17:55:04 +0000
Subject: [PATCH 053/416] graylog: 3.3.9 -> 4.0.7

---
 pkgs/tools/misc/graylog/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/misc/graylog/default.nix b/pkgs/tools/misc/graylog/default.nix
index b41cc9cb0699..8d18d654c72f 100644
--- a/pkgs/tools/misc/graylog/default.nix
+++ b/pkgs/tools/misc/graylog/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "graylog";
-  version = "3.3.9";
+  version = "4.0.7";
 
   src = fetchurl {
     url = "https://packages.graylog2.org/releases/graylog/graylog-${version}.tgz";
-    sha256 = "1wl9j2jgjg5gwcsh92qr5f68wx12nvwadc9xkaa9wwd7x3z825jq";
+    sha256 = "sha256-sZn/ug4oh/SHbICbiQeAmtEIwT3++DBWbT2XBkYGYUc=";
   };
 
   dontBuild = true;

From 9943455f940be833884ff5f080be43a480a33c25 Mon Sep 17 00:00:00 2001
From: laikq <55911173+laikq@users.noreply.github.com>
Date: Sat, 25 Jul 2020 15:54:54 +0200
Subject: [PATCH 054/416] veusz: init at 3.3.1

---
 pkgs/applications/graphics/veusz/default.nix | 71 ++++++++++++++++++++
 pkgs/top-level/all-packages.nix              |  2 +
 2 files changed, 73 insertions(+)
 create mode 100644 pkgs/applications/graphics/veusz/default.nix

diff --git a/pkgs/applications/graphics/veusz/default.nix b/pkgs/applications/graphics/veusz/default.nix
new file mode 100644
index 000000000000..5c5b1c91709a
--- /dev/null
+++ b/pkgs/applications/graphics/veusz/default.nix
@@ -0,0 +1,71 @@
+{ python3Packages
+, qtbase
+, ghostscript
+, wrapQtAppsHook
+, lib
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "veusz";
+  version = "3.3.1";
+
+  src = python3Packages.fetchPypi {
+    inherit pname version;
+    sha256 = "4ClgYwiU21wHDve2q9cItSAVb9hbR2F+fJc8znGI8OA=";
+  };
+
+  nativeBuildInputs = [ wrapQtAppsHook python3Packages.sip ];
+
+  buildInputs = [ qtbase ];
+
+  # veusz is a script and not an ELF-executable, so wrapQtAppsHook will not wrap
+  # it automatically -> we have to do it explicitly
+  dontWrapQtApps = true;
+  preFixup = ''
+    wrapQtApp "$out/bin/veusz"
+  '';
+
+  # For some reason, if sip5 is found on the PATH, the option --sip-dir is
+  # ignored in setupPyBuildFlags, see
+  # https://github.com/veusz/veusz/blob/53b99dffa999f2bc41fdc5335d7797ae857c761f/pyqtdistutils.py#L292
+  postPatch = ''
+    substituteInPlace pyqtdistutils.py \
+      --replace "'-I', pyqt5_include_dir," "'-I', '${python3Packages.pyqt5}/share/sip/PyQt5',"
+    patchShebangs tests/runselftest.py
+  '';
+
+  # you can find these options at
+  # https://github.com/veusz/veusz/blob/53b99dffa999f2bc41fdc5335d7797ae857c761f/pyqtdistutils.py#L71
+  setupPyBuildFlags = [
+    # --sip-dir does nothing here, but it should be the correct way to set the
+    # sip_dir, so I'm leaving it here for future versions
+    "--sip-dir=${python3Packages.pyqt5}/share/sip"
+    "--qt-include-dir=${qtbase.dev}/include"
+    # veusz tries to find a libinfix and fails without one
+    # but we simply don't need a libinfix, so set it to empty here
+    "--qt-libinfix="
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    numpy
+    pyqt5
+    # optional requirements:
+    dbus-python
+    h5py
+    # astropy -- fails to build on master
+    # optional TODO: add iminuit, pyemf and sampy
+  ];
+
+  installCheckPhase = ''
+    wrapQtApp "tests/runselftest.py"
+    QT_QPA_PLATFORM=minimal tests/runselftest.py
+  '';
+
+  meta = with lib; {
+    description = "A scientific plotting and graphing program with a GUI";
+    homepage = "https://veusz.github.io/";
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ laikq ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 502be63ee379..3b7fbd3528e9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -27214,6 +27214,8 @@ in
     inherit (gnome2) libgnomeui;
   };
 
+  veusz = libsForQt5.callPackage ../applications/graphics/veusz { };
+
   vim = callPackage ../applications/editors/vim {
     inherit (darwin.apple_sdk.frameworks) Carbon Cocoa;
   };

From ae541afbf9daf0eeb077ae272557026c0169009b Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Fri, 18 Jun 2021 18:32:03 +0200
Subject: [PATCH 055/416] grafana: 8.0.2 -> 8.0.3

ChangeLog: https://github.com/grafana/grafana/releases/tag/v8.0.3
---
 pkgs/servers/monitoring/grafana/default.nix | 17 ++++-------------
 1 file changed, 4 insertions(+), 13 deletions(-)

diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index 7420fa22e638..99acc52b9de2 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -1,8 +1,8 @@
-{ lib, buildGoModule, fetchurl, fetchFromGitHub, nixosTests, fetchpatch }:
+{ lib, buildGoModule, fetchurl, fetchFromGitHub, nixosTests }:
 
 buildGoModule rec {
   pname = "grafana";
-  version = "8.0.2";
+  version = "8.0.3";
 
   excludedPackages = [ "release_publisher" ];
 
@@ -10,25 +10,16 @@ buildGoModule rec {
     rev = "v${version}";
     owner = "grafana";
     repo = "grafana";
-    sha256 = "sha256-kCsrLZ0EbuMwqqDvUvhm8+B/vh6FpeJ5zkwste+qwyQ=";
+    sha256 = "sha256-GGtmsz3c7Q6mEGCJ6cdz2CjOW0ovZZW8j6LMfFgrMZ4=";
   };
 
   srcStatic = fetchurl {
     url = "https://dl.grafana.com/oss/release/grafana-${version}.linux-amd64.tar.gz";
-    sha256 = "sha256-QBMGLN3MjYJcv2vbs9GHfrCixcV7nH+Ox3o6/YtRYak=";
+    sha256 = "sha256-2x0FhKinrXAFenJcUDh4Q3RJNBrqixKBNZT7BZNNOj8=";
   };
 
   vendorSha256 = "sha256-x7sSVIim/TOhMTbnRK/fpgxiSRSO8KwGILTE2i1gU3U=";
 
-  patches = [
-    # https://github.com/grafana/grafana/pull/35635 (fixes declarative plugins for us)
-    (fetchpatch {
-      url = "https://github.com/grafana/grafana/commit/5b5cb948092bdb85e0378fd9ae01b564c4bf65f1.patch";
-      sha256 = "sha256-MnCjfLiHsBSWPcxVZ2dC4q8x1/TjzR8uyQhH2Jzgx7o=";
-      includes = [ "pkg/util/filepath.go" ];
-    })
-  ];
-
   preBuild = ''
     # The testcase makes an API call against grafana.com:
     #

From ad8bc531cca4305798bf5371509f4feaa7b134c1 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 18 Jun 2021 21:01:56 +0200
Subject: [PATCH 056/416] Bump from 4.25.2 to 4.25.4.

---
 pkgs/development/tools/symfony-cli/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/symfony-cli/default.nix b/pkgs/development/tools/symfony-cli/default.nix
index eb12f9e1dcd7..6ff541b933c4 100644
--- a/pkgs/development/tools/symfony-cli/default.nix
+++ b/pkgs/development/tools/symfony-cli/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "symfony-cli";
-  version = "4.25.2";
+  version = "4.25.4";
 
   src = fetchurl {
     url = "https://github.com/symfony/cli/releases/download/v${version}/symfony_linux_amd64.gz";
-    sha256 = "8bfa53c1479883e9b48d2e4e5d3f6f7a511df73d65fe5c7b07a4890ee2c75c7e";
+    sha256 = "94ade97d79e6949022ac45e4f8f9c025a9e3efa54a1a891a086a24eb9a9765a7";
   };
 
   dontBuild = true;

From 39a4c607827c1aa41794035226cae4fa2d1e8277 Mon Sep 17 00:00:00 2001
From: Tomas Antonio Lopez <entropy.overseer@entropic.network>
Date: Sat, 19 Jun 2021 03:46:50 +0900
Subject: [PATCH 057/416] protege-distribution: init at 5.5.0

Protege Desktop distribution package with third-party plugins.
---
 .../web/protege-distribution/default.nix      | 73 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 2 files changed, 75 insertions(+)
 create mode 100644 pkgs/development/web/protege-distribution/default.nix

diff --git a/pkgs/development/web/protege-distribution/default.nix b/pkgs/development/web/protege-distribution/default.nix
new file mode 100644
index 000000000000..49d28cb17ee8
--- /dev/null
+++ b/pkgs/development/web/protege-distribution/default.nix
@@ -0,0 +1,73 @@
+{ lib, stdenv, fetchurl, unzip, jre8, copyDesktopItems, makeDesktopItem }:
+
+stdenv.mkDerivation rec {
+  pname = "protege-distribution";
+  version = "5.5.0";
+
+  src = fetchurl {
+    url = "https://github.com/protegeproject/protege-distribution/releases/download/v${version}/Protege-${version}-platform-independent.zip";
+    sha256 = "092x22wyisdnhccx817mqq15sxqdfc7iz4whr4mbvzrd9di6ipjq";
+  };
+
+  nativeBuildInputs = [ unzip copyDesktopItems ];
+
+  postPatch = ''
+    # Delete all those commands meant to change directory to the source directory
+    sed -i -e '3,9d' run.sh
+
+    # Change directory to where the application is stored to avoid heavy patching
+    # of searchpaths
+    sed -i -e "2a\
+    cd $out/protege" run.sh
+
+    # Set the correct Java executable (Protege is a JRE 8 application)
+    substituteInPlace run.sh \
+      --replace "java -X" "exec ${jre8.outPath}/bin/java -X" \
+
+    # Silence console logs, since these are not shown in graphical environments
+    sed -i -e '4,8d;21d' conf/logback.xml
+  '';
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir $out
+
+    # Delete non-Linux launch scripts
+    rm run.{bat,command}
+
+    # Move launch script into /bin, giving it a recognizable name
+    install -D run.sh $out/bin/run-protege
+
+    # Copy icon to where it can be found
+    install -D app/Protege.ico $out/share/icons/hicolor/128x128/apps/protege.ico
+
+    # Move everything else under protege/
+    mkdir $out/protege
+    mv {bin,bundles,conf,plugins} $out/protege
+
+    runHook postInstall
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "Protege";
+      desktopName = "Protege Desktop";
+      icon = "protege.ico";
+      comment = "OWL2 ontology editor";
+      exec = "run-protege";
+    })
+  ];
+
+  meta = with lib; {
+    description = "The OWL2 ontology editor from Stanford, with third-party plugins included";
+    homepage = "https://protege.stanford.edu/";
+    downloadPage = "https://protege.stanford.edu/products.php#desktop-protege";
+    maintainers = with maintainers; [ nessdoor ];
+    license = with licenses; [ asl20 bsd2 epl10 lgpl3 ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2cb0404e139e..d8ba201f70e1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12733,6 +12733,8 @@ in
   pharo-spur64 = assert stdenv.is64bit; pharo-vms.spur64;
   pharo-launcher = callPackage ../development/pharo/launcher { };
 
+  protege-distribution = callPackage ../development/web/protege-distribution { };
+
   umr = callPackage ../development/misc/umr {
     llvmPackages = llvmPackages_latest;
   };

From 8b6de797ed058c90d90e77d438cfda2c9d6977ea Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 18 Jun 2021 21:08:31 +0200
Subject: [PATCH 058/416] exploitdb: 2021-06-12 -> 2021-06-18

---
 pkgs/tools/security/exploitdb/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 40ff36c1b18e..922b6c3f2baf 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2021-06-12";
+  version = "2021-06-18";
 
   src = fetchFromGitHub {
     owner = "offensive-security";
     repo = pname;
     rev = version;
-    sha256 = "sha256-62Yi5JTrVlN4V2jfiyEUbl8GidaYgcuBkYGyb6ldihQ=";
+    sha256 = "0b91r7bl3abg3mb7vg4qnk319jy7civ583la0054xhpg0c0svyk1";
   };
 
   installPhase = ''

From 70ef0a4c5b137cb175d6928b267b2b75e9b1a6a5 Mon Sep 17 00:00:00 2001
From: Casey Marshall <git@cmars.tech>
Date: Fri, 18 Jun 2021 15:14:52 -0500
Subject: [PATCH 059/416] xhyve: 20191001 -> 20210203

Updating fixes xhyve problems on Big Sur, see
https://github.com/machyve/xhyve/pull/200 for example.
---
 pkgs/applications/virtualization/xhyve/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/virtualization/xhyve/default.nix b/pkgs/applications/virtualization/xhyve/default.nix
index db9a7ef82577..f093e94696cf 100644
--- a/pkgs/applications/virtualization/xhyve/default.nix
+++ b/pkgs/applications/virtualization/xhyve/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xhyve";
-  version = "20191001";
+  version = "20210203";
 
   src = fetchFromGitHub {
     owner = "machyve";
     repo = "xhyve";
-    rev = "1f46a3d0bbeb6c90883f302425844fcc3800a776";
-    sha256 = "0mm9xa0v6n7xl2qypnppq5abdncd31vffiklrhcrlni5ymyh9ia5";
+    rev = "83516a009c692ea5d2993d1071e68d05d359b11e";
+    sha256 = "1pjdg4ppy6qh3vr1ls5zyw3jzcvwny9wydnmfpadwij1hvns7lj3";
   };
 
   buildInputs = [ Hypervisor vmnet xpc libobjc zlib ];

From a4cb90bdbd57eabb7ff93d179e687873ac3fafcb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <Mic92@users.noreply.github.com>
Date: Fri, 18 Jun 2021 22:19:16 +0200
Subject: [PATCH 060/416] Update nixos/tests/zfs.nix

Co-authored-by: jnetod <49963580+jnetod@users.noreply.github.com>
---
 nixos/tests/zfs.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/nixos/tests/zfs.nix b/nixos/tests/zfs.nix
index 5a6138c68d47..d25090403e5f 100644
--- a/nixos/tests/zfs.nix
+++ b/nixos/tests/zfs.nix
@@ -74,10 +74,15 @@ let
             "udevadm settle",
             "zpool create rpool /dev/vdb1",
             "zfs create -o mountpoint=legacy rpool/root",
+            # shared datasets cannot have legacy mountpoint
+            "zfs create rpool/shared_smb",
             "mount -t zfs rpool/root /tmp/mnt",
             "udevadm settle",
-            "zfs set sharesmb=on rpool/root",
-            "smbclient -NL localhost",
+            # wait for samba services
+            "systemctl is-system-running --wait",
+            "zfs set sharesmb=on rpool/shared_smb",
+            "zfs share rpool/shared_smb",
+            "smbclient -gNL localhost | grep rpool_shared_smb",
             "umount /tmp/mnt",
             "zpool destroy rpool",
             "udevadm settle",

From e9d2c701e15aa60a2617827af5026d72b07bc456 Mon Sep 17 00:00:00 2001
From: Maxine Aubrey <maxeaubrey@gmail.com>
Date: Fri, 18 Jun 2021 22:41:36 +0200
Subject: [PATCH 061/416] vault: 1.7.2 -> 1.7.3

---
 pkgs/tools/security/vault/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/security/vault/default.nix b/pkgs/tools/security/vault/default.nix
index eb5ac31d300b..45bd76b90917 100644
--- a/pkgs/tools/security/vault/default.nix
+++ b/pkgs/tools/security/vault/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "vault";
-  version = "1.7.2";
+  version = "1.7.3";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "vault";
     rev = "v${version}";
-    sha256 = "0nd77lfccl71qn98cq1yz85aiafplxbr58nafbbflijs1fz1771q";
+    sha256 = "sha256-BO4xzZrX9eVETQWjBDBfP7TlD7sO+gLgbB330A11KAI=";
   };
 
   goPackagePath = "github.com/hashicorp/vault";

From 20569d40d4ca626e6ad2f59bf73d8de8f2a74a81 Mon Sep 17 00:00:00 2001
From: Maxine Aubrey <maxeaubrey@gmail.com>
Date: Fri, 18 Jun 2021 22:41:46 +0200
Subject: [PATCH 062/416] vault-bin: 1.7.2 -> 1.7.3

---
 pkgs/tools/security/vault/vault-bin.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/tools/security/vault/vault-bin.nix b/pkgs/tools/security/vault/vault-bin.nix
index b283a40888bd..11175c3c889f 100644
--- a/pkgs/tools/security/vault/vault-bin.nix
+++ b/pkgs/tools/security/vault/vault-bin.nix
@@ -1,26 +1,26 @@
 { lib, stdenv, fetchurl, unzip }:
 
 let
-  version = "1.7.2";
+  version = "1.7.3";
 
   sources = let
     base = "https://releases.hashicorp.com/vault/${version}";
   in {
     x86_64-linux = fetchurl {
       url = "${base}/vault_${version}_linux_amd64.zip";
-      sha256 = "1g37pgj7hbi6vfpwq9rrh6is980lfwbq5jb4736jfp5m360vprjy";
+      sha256 = "sha256-hFMTKpO3VcCondSy8amb1K8G+BZ7gZF/EXCAg5Ax4D8=";
     };
     i686-linux = fetchurl {
       url = "${base}/vault_${version}_linux_386.zip";
-      sha256 = "0777xkkfiy0s3nyygcfpw0nbfsm6yz1n5hxcvfafhzcdyr58fpb7";
+      sha256 = "02wbbzffb2m7y3476l5qa5dhi0v30f3sfif0svqhhzh927kg4s5w";
     };
     x86_64-darwin = fetchurl {
       url = "${base}/vault_${version}_darwin_amd64.zip";
-      sha256 = "0wzmah542bhyvrm9brhrx7drjyzan8vxhqnm0gjak5wlrcnf2dvx";
+      sha256 = "0sw56dhjbasdnlwg668swhyxrn5gy7h9gysdg96za4dhq3iimkrn";
     };
     aarch64-linux = fetchurl {
       url = "${base}/vault_${version}_linux_arm64.zip";
-      sha256 = "0cs56ircad2z2msqgb0l5h53cwmwybi5rs4y2jigz4rq4ndx9f9b";
+      sha256 = "0c2w0684adaqildwviajp6pi8vp76g4zwwgc1k2bb5mwv1h2y293";
     };
   };
 

From ea250dfce428f0c60f07ff18b31841567a9a3ee3 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 18 Jun 2021 22:54:50 +0200
Subject: [PATCH 063/416] python3Packages.prawcore: 2.0.0 -> 2.2.0

---
 .../python-modules/prawcore/default.nix       | 30 +++++++++++--------
 1 file changed, 18 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/python-modules/prawcore/default.nix b/pkgs/development/python-modules/prawcore/default.nix
index 1e38f401a43d..129275b2987f 100644
--- a/pkgs/development/python-modules/prawcore/default.nix
+++ b/pkgs/development/python-modules/prawcore/default.nix
@@ -1,17 +1,25 @@
-{ lib, buildPythonPackage, fetchPypi, isPy27
+{ lib
+, buildPythonPackage
+, fetchPypi
 , requests
-, testfixtures, mock, requests_toolbelt
-, betamax, betamax-serializers, betamax-matchers, pytest
+, testfixtures
+, mock
+, requests_toolbelt
+, betamax
+, betamax-serializers
+, betamax-matchers
+, pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "prawcore";
-  version = "2.0.0";
-  disabled = isPy27; # see https://github.com/praw-dev/prawcore/pull/101
+  version = "2.2.0";
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-tJjZtvVJkQBecn1SNcj0nqW6DJpteT+3Q7QPoInNNtE=";
+    sha256 = "08wiij1r3flpnqzdx8bf536yf7lqyhg9461aybhcykcw8nnjzr5x";
   };
 
   propagatedBuildInputs = [
@@ -25,18 +33,16 @@ buildPythonPackage rec {
     betamax-serializers
     betamax-matchers
     requests_toolbelt
-    pytest
+    pytestCheckHook
   ];
 
-  checkPhase = ''
-    pytest
-  '';
+  pythonImportsCheck = [ "prawcore" ];
 
   meta = with lib; {
     description = "Low-level communication layer for PRAW";
     homepage = "https://praw.readthedocs.org/";
-    license = licenses.gpl3;
+    license = licenses.bsd2;
     platforms = platforms.all;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ fab ];
   };
 }

From 6d40092511a8b0838a5503d30294289ee00ee1e1 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 18 Jun 2021 22:56:25 +0200
Subject: [PATCH 064/416] python3Packages.praw: 7.2.0 -> 7.3.0

---
 pkgs/development/python-modules/praw/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/praw/default.nix b/pkgs/development/python-modules/praw/default.nix
index 5ae4d0b280f5..e104dbff4f62 100644
--- a/pkgs/development/python-modules/praw/default.nix
+++ b/pkgs/development/python-modules/praw/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "praw";
-  version = "7.2.0";
+  version = "7.3.0";
 
   src = fetchFromGitHub {
     owner = "praw-dev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-/GV5ZhrJxeChcYwmH/9FsLceAYRSeTCDe4lMEwdTa8Y=";
+    sha256 = "0pj987v04y5askczlma2ilwllwfsg7p5mwhv0h1lcl1lg0fbsvn9";
   };
 
   propagatedBuildInputs = [

From 05d18bb384e9fbce3f6e2880b3114a90213a7dad Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 18 Jun 2021 23:04:09 +0200
Subject: [PATCH 065/416] python3Packages.minio: 7.0.3 -> 7.0.4

---
 pkgs/development/python-modules/minio/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/minio/default.nix b/pkgs/development/python-modules/minio/default.nix
index fdbcf09534b2..eb543a63133a 100644
--- a/pkgs/development/python-modules/minio/default.nix
+++ b/pkgs/development/python-modules/minio/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "minio";
-  version = "7.0.3";
+  version = "7.0.4";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "minio-py";
     rev = version;
-    sha256 = "14symk7b3i9xzfc2wkcnqmfsvh9j3jx2ijz7dgy1xyrbjwb7yzhc";
+    sha256 = "sha256-4O6WhBoMNpqv1OEewkbA5a8hYH56liF7GrfxkooQ6Fo=";
   };
 
   propagatedBuildInputs = [

From 0034539abab37c4cfbc281a084cf111a16e8a21d Mon Sep 17 00:00:00 2001
From: Marco A L Barbosa <malbarbo@gmail.com>
Date: Fri, 18 Jun 2021 18:45:21 -0300
Subject: [PATCH 066/416] audit: use hostPlatform.isStatic instead of
 targetPlatform.isStatic

---
 pkgs/os-specific/linux/audit/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/audit/default.nix b/pkgs/os-specific/linux/audit/default.nix
index 84bc6086d122..30327fb1082e 100644
--- a/pkgs/os-specific/linux/audit/default.nix
+++ b/pkgs/os-specific/linux/audit/default.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
   # --whole-archive linker flag is required to be sure that linker
   # correctly chooses strong version of symbol regardless of order of
   # object files at command line.
-  + lib.optionalString stdenv.targetPlatform.isStatic ''
+  + lib.optionalString stdenv.hostPlatform.isStatic ''
     export LDFLAGS=-Wl,--whole-archive
   '';
   meta = {

From 7d245c4aee2111b72559812ea6f2b1adc398d863 Mon Sep 17 00:00:00 2001
From: Luke Worth <luke.worth@bellroy.com>
Date: Sat, 19 Jun 2021 08:02:54 +1000
Subject: [PATCH 067/416] unused: 2.1 -> 2.2

---
 pkgs/development/tools/misc/unused/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/misc/unused/default.nix b/pkgs/development/tools/misc/unused/default.nix
index 58e4ba0bc98e..ee89df5d8391 100644
--- a/pkgs/development/tools/misc/unused/default.nix
+++ b/pkgs/development/tools/misc/unused/default.nix
@@ -1,18 +1,18 @@
 { lib, fetchFromGitHub, rustPlatform, cmake }:
 rustPlatform.buildRustPackage rec {
   pname = "unused";
-  version = "0.2.1";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "unused-code";
     repo = pname;
     rev = version;
-    sha256 = "06r6m7k570rdm9szghnp3g4r6ij0vp8apfanqzzxv2hd7gf8v62b";
+    sha256 = "0igpf0y45rrdrwq8bznq0d5nnph0vijvn6fw96mqxhbffz0csbi9";
   };
 
   nativeBuildInputs = [ cmake ];
 
-  cargoSha256 = "0y7vsba4r4v2lwf02i2dxwicnhknajbbzsdlnn5srvg6nvl3kspi";
+  cargoSha256 = "1fngn9mmvx7jw8305w465z0nf9acc2cdl7314p77c2rz25z6rlin";
 
   meta = with lib; {
     description = "A tool to identify potentially unused code";

From 8e22d687292f7747410ae2a7eade590ba963e818 Mon Sep 17 00:00:00 2001
From: Ebrahim <30749142+DearRude@users.noreply.github.com>
Date: Sat, 19 Jun 2021 02:40:01 +0430
Subject: [PATCH 068/416] Update pkgs/data/fonts/vazir-code-font/default.nix

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
---
 pkgs/data/fonts/vazir-code-font/default.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/data/fonts/vazir-code-font/default.nix b/pkgs/data/fonts/vazir-code-font/default.nix
index d1a3e9b2159b..6702fd1b0220 100644
--- a/pkgs/data/fonts/vazir-code-font/default.nix
+++ b/pkgs/data/fonts/vazir-code-font/default.nix
@@ -18,8 +18,7 @@ in fetchFromGitHub {
 
   meta = with lib; {
     homepage = "https://github.com/rastikerdar/vazir-code-font";
-    description =
-      "A Persian (farsi) Monospaced Font for coding - فونت (قلم) فارسی وزیرکد برای کد نویسی ";
+    description = "A Persian (farsi) Monospaced Font for coding";
     license = licenses.publicDomain;
     platforms = platforms.all;
     maintainers = [ maintainers.dearrude ];

From 52651ca62a9e9bf5833ffda13baed4b96b766381 Mon Sep 17 00:00:00 2001
From: TredwellGit <tredwell@tutanota.com>
Date: Fri, 18 Jun 2021 22:46:49 +0000
Subject: [PATCH 069/416] chromium: fix APNG support

https://bugs.chromium.org/p/chromium/issues/detail?id=752403
---
 pkgs/applications/networking/browsers/chromium/common.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 156932aa13f1..18565f31a2fb 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -92,9 +92,10 @@ let
   };
 
   defaultDependencies = [
+    (libpng.override { apngSupport = false; }) # https://bugs.chromium.org/p/chromium/issues/detail?id=752403
     bzip2 flac speex opusWithCustomModes
     libevent expat libjpeg snappy
-    libpng libcap
+    libcap
     xdg-utils minizip libwebp
     libusb1 re2
     ffmpeg libxslt libxml2

From 7ce24d4b85077a5f24f83abe81a07bb7d146e9f7 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sat, 19 Jun 2021 09:18:22 +1000
Subject: [PATCH 070/416] libslirp: 4.6.0 -> 4.6.1

https://gitlab.freedesktop.org/slirp/libslirp/-/releases/v4.6.1
---
 pkgs/development/libraries/libslirp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libslirp/default.nix b/pkgs/development/libraries/libslirp/default.nix
index 7180587e8e6b..f4eaa9c31993 100644
--- a/pkgs/development/libraries/libslirp/default.nix
+++ b/pkgs/development/libraries/libslirp/default.nix
@@ -9,14 +9,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libslirp";
-  version = "4.6.0";
+  version = "4.6.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "slirp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-1Zp1+PW0WtNzRYIA87X42CJeSzVFhi5sGi9/rlUP4Vo=";
+    sha256 = "sha256-AM6NxO4hjFiUAzRYbXV3fe18xwCBmzdM63n93UOxjKw=";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config ];

From 0e3229d628b3a1c56cc9279c39e6a40720794773 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Fri, 18 Jun 2021 17:03:40 +0000
Subject: [PATCH 071/416] erlangR22: 22.3.4.19 -> 22.3.4.20

---
 pkgs/development/interpreters/erlang/R22.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/erlang/R22.nix b/pkgs/development/interpreters/erlang/R22.nix
index c69c26d4cb01..9236ea428948 100644
--- a/pkgs/development/interpreters/erlang/R22.nix
+++ b/pkgs/development/interpreters/erlang/R22.nix
@@ -3,6 +3,6 @@
 # How to obtain `sha256`:
 # nix-prefetch-url --unpack https://github.com/erlang/otp/archive/OTP-${version}.tar.gz
 mkDerivation {
-  version = "22.3.4.19";
-  sha256 = "sha256-U3ks7pDIqS8HVJ+yBobhEbKvnd9svEcQd9BsJQwajDs=";
+  version = "22.3.4.20";
+  sha256 = "sha256-EUErOCW16eUb/p5dLpFV7sQ3mXlCF/OgOvGAAyYEvLo=";
 }

From 3ff86ab57602d71361b011f2bc5b4cfe01d926ef Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Sat, 19 Jun 2021 05:39:58 +0300
Subject: [PATCH 072/416] sweet: add gtk-engine-murrine

---
 pkgs/data/themes/sweet/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/data/themes/sweet/default.nix b/pkgs/data/themes/sweet/default.nix
index 8a62735d2e52..bd1df3277c91 100644
--- a/pkgs/data/themes/sweet/default.nix
+++ b/pkgs/data/themes/sweet/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchurl, gtk-engine-murrine }:
 
 stdenv.mkDerivation rec {
   pname = "sweet";
@@ -27,6 +27,8 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  propagatedUserEnvPkgs = [ gtk-engine-murrine ];
+
   sourceRoot = ".";
 
   installPhase = ''

From 5eaa9b7a57e358c024fc2a925c7b914bf4f1597f Mon Sep 17 00:00:00 2001
From: Arijit Basu <sayanarijit@gmail.com>
Date: Sat, 19 Jun 2021 08:41:19 +0530
Subject: [PATCH 073/416] xplr: 0.14.1 -> 0.14.2

---
 pkgs/applications/misc/xplr/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/misc/xplr/default.nix b/pkgs/applications/misc/xplr/default.nix
index 51319838eda6..5d3f2ee4df7e 100644
--- a/pkgs/applications/misc/xplr/default.nix
+++ b/pkgs/applications/misc/xplr/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "xplr";
-  version = "0.14.1";
+  version = "0.14.2";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "08gb4dnnzdy3whn2411xmar1wpvmc014scbniicksra8p1xizh0b";
+    sha256 = "1bgylz2x44rjxpd6dvd44pr57f18di0nj5sbqh4my8lkanr7isli";
   };
 
   buildInputs = lib.optional stdenv.isDarwin libiconv;
 
-  cargoSha256 = "1yxbirqf6c4bc364gw0nnjrjvhvjy2j2pbmvlpakv0bmyfphhb95";
+  cargoSha256 = "07rlmz4rkgdcvr0dvbrz56s5vacxcvy09rgz70kr692xlpym4jvq";
 
   meta = with lib; {
     description = "A hackable, minimal, fast TUI file explorer";

From 51b901669cbbfb4d6d1e2446f4b955985f1eeab1 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sat, 19 Jun 2021 06:27:23 +0000
Subject: [PATCH 074/416] exoscale-cli: 1.32.1 -> 1.32.2

---
 pkgs/tools/admin/exoscale-cli/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/admin/exoscale-cli/default.nix b/pkgs/tools/admin/exoscale-cli/default.nix
index 53b60bf2ce78..d6b264a4aa38 100644
--- a/pkgs/tools/admin/exoscale-cli/default.nix
+++ b/pkgs/tools/admin/exoscale-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "exoscale-cli";
-  version = "1.32.1";
+  version = "1.32.2";
 
   src = fetchFromGitHub {
     owner  = "exoscale";
     repo   = "cli";
     rev    = "v${version}";
-    sha256 = "sha256-S18SVSyFpIWkzQiRBY7i1siIPRiRR/SHAse3NJzwR3A=";
+    sha256 = "sha256-Yx+GA959AB6m62hDlZKYjsuT9Y9TJbIdzUVBMM8OgTg=";
   };
 
   goPackagePath = "github.com/exoscale/cli";

From 3abfb38f083f4fdbab30f88858e06283bf9c10c6 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 18 Jun 2021 21:36:08 +0200
Subject: [PATCH 075/416] python3Packages.adafruit-platformdetect: 3.13.4 ->
 3.14.0

---
 .../python-modules/adafruit-platformdetect/default.nix        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/adafruit-platformdetect/default.nix b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
index 64df2e02759c..adb72d0cd03b 100644
--- a/pkgs/development/python-modules/adafruit-platformdetect/default.nix
+++ b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "adafruit-platformdetect";
-  version = "3.13.4";
+  version = "3.14.0";
 
   src = fetchPypi {
     pname = "Adafruit-PlatformDetect";
     inherit version;
-    sha256 = "sha256-e8hliPYLvHR3JjZ4AFgJWjPW1vK10BYuVqUYtF54J5c=";
+    sha256 = "1v33546cflsbm6k8mhmi1r5c8fqjlirvzmf62a604xns8wrxb88h";
   };
 
   nativeBuildInputs = [ setuptools-scm ];

From 3ad3f7ba86efb63fe55911b3ae613057fcc8db25 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sat, 19 Jun 2021 06:40:20 +0000
Subject: [PATCH 076/416] fioctl: 0.17 -> 0.18

---
 pkgs/tools/admin/fioctl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/admin/fioctl/default.nix b/pkgs/tools/admin/fioctl/default.nix
index 0e0c977acd01..068d87a3bfd1 100644
--- a/pkgs/tools/admin/fioctl/default.nix
+++ b/pkgs/tools/admin/fioctl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "fioctl";
-  version = "0.17";
+  version = "0.18";
 
   src = fetchFromGitHub {
     owner = "foundriesio";
     repo = "fioctl";
     rev = "v${version}";
-    sha256 = "sha256-u23BQ/sRAfUO36uqv7xY+DkseDnlVesgamsgne8N8kU=";
+    sha256 = "sha256-uqJ08ftaU39gmhDtl+noVtGscu6utcl42rXz4XaGtWc=";
   };
 
   vendorSha256 = "sha256-6a+JMj3hh6GPuqnLknv7/uR8vsUsOgsS+pdxHoMqH5w=";

From 344600efbb37ee06358efcb3b3886636adf64412 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sat, 19 Jun 2021 07:05:19 +0000
Subject: [PATCH 077/416] frugal: 3.14.4 -> 3.14.5

---
 pkgs/development/tools/frugal/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/frugal/default.nix b/pkgs/development/tools/frugal/default.nix
index c8339fe6d851..0b1e8d16b65a 100644
--- a/pkgs/development/tools/frugal/default.nix
+++ b/pkgs/development/tools/frugal/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "frugal";
-  version = "3.14.4";
+  version = "3.14.5";
 
   src = fetchFromGitHub {
     owner = "Workiva";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-RFVn5aL5MqsB7heDPVUci3Eyq6F/qo3RmdEaZbsC+Ng=";
+    sha256 = "sha256-Er9V6mSe4Pt/RzFAPa3ci3J7FQh5GLbh9CjYHx/HnYM=";
   };
 
   subPackages = [ "." ];
 
-  vendorSha256 = "sha256-hyupBMRKuw77SJNIk3mEUixV0LV5mEmZx8M70qGmYJY=";
+  vendorSha256 = "sha256-9M6SSxMQ8JMJ7ZNl8cjQuid/B0xc28/BuPozxftthe0=";
 
   meta = with lib; {
     description = "Thrift improved";

From 8aa74b8fa00f4081a8c7140cc0b7316a1766c151 Mon Sep 17 00:00:00 2001
From: Yaroslav Bolyukin <iam@lach.pw>
Date: Sat, 19 Jun 2021 10:41:20 +0300
Subject: [PATCH 078/416] maintainers: add lach

Signed-off-by: Yaroslav Bolyukin <iam@lach.pw>
---
 maintainers/maintainer-list.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 8e18d02698e9..74b96e0f525a 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5653,6 +5653,16 @@
     githubId = 72546287;
     name = "L3af";
   };
+  lach = {
+    email = "iam@lach.pw";
+    github = "CertainLach";
+    githubId = 6235312;
+    keys = [{
+      longkeyid = "rsa3072/40B5D6948143175F";
+      fingerprint = "323C 95B5 DBF7 2D74 8570  C0B7 40B5 D694 8143 175F";
+    }];
+    name = "Yaroslav Bolyukin";
+  };
   laikq = {
     email = "gwen@quasebarth.de";
     github = "laikq";

From be9ef6c5480ae622fa7c20a3049580cae32ee52b Mon Sep 17 00:00:00 2001
From: Yaroslav Bolyukin <iam@lach.pw>
Date: Sat, 19 Jun 2021 10:44:19 +0300
Subject: [PATCH 079/416] jrsonnet: init at 0.3.8

Signed-off-by: Yaroslav Bolyukin <iam@lach.pw>
---
 .../compilers/jrsonnet/default.nix            | 26 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 ++
 2 files changed, 28 insertions(+)
 create mode 100644 pkgs/development/compilers/jrsonnet/default.nix

diff --git a/pkgs/development/compilers/jrsonnet/default.nix b/pkgs/development/compilers/jrsonnet/default.nix
new file mode 100644
index 000000000000..82e15db66858
--- /dev/null
+++ b/pkgs/development/compilers/jrsonnet/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, lib, fetchFromGitHub, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "jrsonnet";
+  version = "0.3.8";
+
+  src = fetchFromGitHub {
+    rev = "v${version}";
+    owner = "CertainLach";
+    repo = "jrsonnet";
+    sha256 = "sha256-u6P/j7j6S7iPQQh00YFtp2G9Kt4xdWJGsxbuBjvHHZ4=";
+  };
+
+  postInstall = ''
+    ln -s $out/bin/jrsonnet $out/bin/jsonnet
+  '';
+
+  cargoSha256 = "sha256-KGQ3n3BBgLCT3ITIM8p9AxNa62ek4GHymqoD0eQSVKQ=";
+
+  meta = {
+    description = "Purely-functional configuration language that helps you define JSON data";
+    maintainers = with lib.maintainers; [ lach ];
+    license = lib.licenses.mit;
+    homepage = "https://github.com/CertainLach/jrsonnet";
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ac556661c1ad..7e8fdbeeeabf 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15766,6 +15766,8 @@ in
 
   jsonnet-bundler = callPackage ../development/tools/jsonnet-bundler { };
 
+  jrsonnet = callPackage ../development/compilers/jrsonnet { };
+
   go-jsonnet = callPackage ../development/compilers/go-jsonnet { };
 
   jsonrpc-glib = callPackage ../development/libraries/jsonrpc-glib { };

From 31c39c11ca197f2e64ca90dcb329ff052d9bde68 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Sat, 19 Jun 2021 10:33:02 +0200
Subject: [PATCH 080/416] pythonPackages.impacket: 0.9.22 -> 0.9.23

Fixes CVE-2021-31800.
https://github.com/SecureAuthCorp/impacket/releases/tag/impacket_0_9_23
---
 pkgs/development/python-modules/impacket/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/impacket/default.nix b/pkgs/development/python-modules/impacket/default.nix
index 15d148f168f1..43fdfb6a9cee 100644
--- a/pkgs/development/python-modules/impacket/default.nix
+++ b/pkgs/development/python-modules/impacket/default.nix
@@ -1,15 +1,15 @@
-{ lib, buildPythonPackage, fetchPypi, flask, ldapdomaindump, pycryptodomex, pyasn1, pyopenssl }:
+{ lib, buildPythonPackage, fetchPypi, flask, ldapdomaindump, pycryptodomex, pyasn1, pyopenssl, chardet }:
 
 buildPythonPackage rec {
   pname = "impacket";
-  version = "0.9.22";
+  version = "0.9.23";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4bf7e7b595356585599b4b2773b8a463d7b9765c97012dcd5a44eb6d547f6a1d";
+    sha256 = "113isxb9rd2n761nnh3skg3vqa0v5dalz9kbavyczqyv1jjyh6qw";
   };
 
-  propagatedBuildInputs = [ flask ldapdomaindump pycryptodomex pyasn1 pyopenssl ];
+  propagatedBuildInputs = [ flask ldapdomaindump pycryptodomex pyasn1 pyopenssl chardet ];
 
   # fail with:
   # RecursionError: maximum recursion depth exceeded
@@ -18,7 +18,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Network protocols Constructors and Dissectors";
-    homepage = "https://github.com/CoreSecurity/impacket";
+    homepage = "https://github.com/SecureAuthCorp/impacket";
     # Modified Apache Software License, Version 1.1
     license = licenses.free;
     maintainers = with maintainers; [ SuperSandro2000 ];

From a295d5f1211f0ac9f4fa6a6f2b4d2b5a42b33545 Mon Sep 17 00:00:00 2001
From: 06kellyjac <dev@j-k.io>
Date: Sat, 19 Jun 2021 09:37:19 +0100
Subject: [PATCH 081/416] terragrunt: 0.30.6 -> 0.30.7

---
 pkgs/applications/networking/cluster/terragrunt/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terragrunt/default.nix b/pkgs/applications/networking/cluster/terragrunt/default.nix
index dee7bc7fe273..faf817d1c7f7 100644
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.30.6";
+  version = "0.30.7";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-McV04oE8/LaH9lOU0aKsmS1KpWUC9I/t59WqAYZrIVY=";
+    sha256 = "sha256-zcb2bdIvUeHEto2NeY0Zwj7jIB+ipVXpnb7q97IkvmA=";
   };
 
   vendorSha256 = "sha256-OgNNq1qRhCufcWemLxh50pzs432RxZpWWcyBB7xeiOs=";

From a178aba8cab65dfba5eee23b6ef69c24f74328a5 Mon Sep 17 00:00:00 2001
From: 06kellyjac <dev@j-k.io>
Date: Sat, 19 Jun 2021 09:43:46 +0100
Subject: [PATCH 082/416] buf: 0.41.0 -> 0.43.2

Fix new git tests
Add ldflags to slightly reduce binary size
Only install required binaries
---
 pkgs/development/tools/buf/default.nix | 32 ++++++++++++++++++++++----
 1 file changed, 28 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/tools/buf/default.nix b/pkgs/development/tools/buf/default.nix
index 8d76b8925dc7..c1060744f449 100644
--- a/pkgs/development/tools/buf/default.nix
+++ b/pkgs/development/tools/buf/default.nix
@@ -2,30 +2,54 @@
 , buildGoModule
 , fetchFromGitHub
 , protobuf
+, git
 }:
 
 buildGoModule rec {
   pname = "buf";
-  version = "0.41.0";
+  version = "0.43.2";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-f1UcvsXWW+fMAgTRtHkEXmUN/DTrJ/Xd+9HbR2FjFog=";
+    sha256 = "sha256-Go0wLcJrxMgB67WlAI7TwX2UU2sQ/yfmC0h2igOkjc4=";
+    leaveDotGit = true; # Required by TestWorkspaceGit
   };
+  vendorSha256 = "sha256-HT0dsGniBoQW2Y7MhahDeFvE0nCASoPdzHETju0JuRY=";
 
   patches = [
     ./skip_test_requiring_network.patch
   ];
 
+  nativeBuildInputs = [ protobuf ];
+  checkInputs = [ git ];
+
+  ldflags = [ "-s" "-w" ];
+
   preCheck = ''
     export PATH=$PATH:$GOPATH/bin
+    # To skip TestCloneBranchAndRefToBucket
+    export CI=true
   '';
 
-  nativeBuildInputs = [ protobuf ];
+  installPhase = ''
+    runHook preInstall
 
-  vendorSha256 = "sha256-XMGXVsSLEzuzujX5Fg3LLkgzyJY+nIBJEO9iI2t9eGc=";
+    mkdir -p "$out/bin"
+    dir="$GOPATH/bin"
+    # Only install required binaries, don't install testing binaries
+    for file in \
+      "buf" \
+      "protoc-gen-buf-breaking" \
+      "protoc-gen-buf-lint" \
+      "protoc-gen-buf-check-breaking" \
+      "protoc-gen-buf-check-lint"; do
+      cp "$dir/$file" "$out/bin/"
+    done
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "Create consistent Protobuf APIs that preserve compatibility and comply with design best-practices";

From 6a5010cfb85088e24aca330ceb9512879a480173 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sat, 19 Jun 2021 08:44:07 +0000
Subject: [PATCH 083/416] hugo: 0.83.1 -> 0.84.0

---
 pkgs/applications/misc/hugo/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/misc/hugo/default.nix b/pkgs/applications/misc/hugo/default.nix
index b8ea6b83b907..9834e91309da 100644
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.83.1";
+  version = "0.84.0";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-c9T3a6J78uLumBTy/DgE4gbxCmEXVGKd9JyF9dyrL6g=";
+    sha256 = "sha256-BRp4iboiaoB6zFwleFSJ7oVAd3o6OiR5BB4VRQilExc=";
   };
 
-  vendorSha256 = "sha256-ddCyMmZ5RIZWzT2RYNnSW795oR7PIRudl3QTjsXtBGk=";
+  vendorSha256 = "sha256-jY/g92ON5OxjuZzPHJNduXYMgPU8/0ioAYvp4iqjGnU=";
 
   doCheck = false;
 

From 0b204c6f48f7e6d890e4a69da55e946a5e6c8ae7 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sat, 19 Jun 2021 09:31:03 +0000
Subject: [PATCH 084/416] keycloak: 13.0.1 -> 14.0.0

---
 pkgs/servers/keycloak/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/keycloak/default.nix b/pkgs/servers/keycloak/default.nix
index 9788e04ac445..8cfefcf9796d 100644
--- a/pkgs/servers/keycloak/default.nix
+++ b/pkgs/servers/keycloak/default.nix
@@ -18,11 +18,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname   = "keycloak";
-  version = "13.0.1";
+  version = "14.0.0";
 
   src = fetchzip {
     url    = "https://github.com/keycloak/keycloak/releases/download/${version}/keycloak-${version}.zip";
-    sha256 = "sha256-81i8Yf9rEuHtUDqYThUCn0/Lb9YokRi4tGi/Ooyyxr8=";
+    sha256 = "sha256-NH2uNiYZZrEYE5DG2kDXzLN7/GgXR8IfBqRb6EoKA9s=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 7df9c074470664698f9439cd6ce5c7fdab38828e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <dev@schuetz-co.de>
Date: Sat, 19 Jun 2021 11:44:44 +0200
Subject: [PATCH 085/416] pythonPackages.habitipy: init at 0.3.0

---
 .../python-modules/habitipy/default.nix       | 47 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 49 insertions(+)
 create mode 100644 pkgs/development/python-modules/habitipy/default.nix

diff --git a/pkgs/development/python-modules/habitipy/default.nix b/pkgs/development/python-modules/habitipy/default.nix
new file mode 100644
index 000000000000..d20c89e82e79
--- /dev/null
+++ b/pkgs/development/python-modules/habitipy/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, plumbum
+, requests
+, setuptools
+, hypothesis
+, nose
+, responses
+}:
+
+buildPythonPackage rec {
+  pname = "habitipy";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "ASMfreaK";
+    repo = "habitipy";
+    rev = "v${version}";
+    sha256 = "1vf485z5m4h61p64zr3sgkcil2s3brq7dja4n7m49d1fvzcirylv";
+  };
+
+  propagatedBuildInputs = [
+    plumbum
+    requests
+    setuptools
+  ];
+
+  checkInputs = [
+    hypothesis
+    nose
+    responses
+  ];
+
+  checkPhase = ''
+    HOME=$TMPDIR nosetests
+  '';
+
+  pythonImportsCheck = [ "habitipy" ];
+
+  meta = with lib; {
+    description = "Tools and library for Habitica restful API";
+    homepage = "https://github.com/ASMfreaK/habitipy";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a6ebffcb8918..9adf1f901297 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3160,6 +3160,8 @@ in {
 
   habanero = callPackage ../development/python-modules/habanero { };
 
+  habitipy = callPackage ../development/python-modules/habitipy { };
+
   hachoir = callPackage ../development/python-modules/hachoir { };
 
   hdate = callPackage ../development/python-modules/hdate { };

From 1f356cf7a8d1a900c71741ab19393abde262cd36 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <dev@schuetz-co.de>
Date: Sat, 19 Jun 2021 11:45:22 +0200
Subject: [PATCH 086/416] home-assistant: update component-packages.nix

---
 pkgs/servers/home-assistant/component-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 1a0d0b0f89f1..159b77e8b779 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -335,7 +335,7 @@
     "gstreamer" = ps: with ps; [ ]; # missing inputs: gstreamer-player
     "gtfs" = ps: with ps; [ pygtfs ];
     "guardian" = ps: with ps; [ aioguardian ];
-    "habitica" = ps: with ps; [ ]; # missing inputs: habitipy
+    "habitica" = ps: with ps; [ habitipy ];
     "hangouts" = ps: with ps; [ ]; # missing inputs: hangups
     "harman_kardon_avr" = ps: with ps; [ ]; # missing inputs: hkavr
     "harmony" = ps: with ps; [ aioharmony ];

From d8e175011a0656f7078d76f406b2976f2f849ec0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <dev@schuetz-co.de>
Date: Sat, 19 Jun 2021 11:46:33 +0200
Subject: [PATCH 087/416] home-assistant: test habitica component

---
 pkgs/servers/home-assistant/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 87fdb9f42316..b0ba15e88203 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -435,6 +435,7 @@ in with py.pkgs; buildPythonApplication rec {
     "group"
     "growatt_server"
     "guardian"
+    "habitica"
     "harmony"
     "hassio"
     "hddtemp"

From 6f9d7000ce1cc2a8a87e55a2d5b0925afb500b14 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <dev@schuetz-co.de>
Date: Sat, 19 Jun 2021 12:10:54 +0200
Subject: [PATCH 088/416] pythonPackages.readlike: init at 0.1.3

---
 .../python-modules/readlike/default.nix       | 28 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 30 insertions(+)
 create mode 100644 pkgs/development/python-modules/readlike/default.nix

diff --git a/pkgs/development/python-modules/readlike/default.nix b/pkgs/development/python-modules/readlike/default.nix
new file mode 100644
index 000000000000..f2e3d11e7edd
--- /dev/null
+++ b/pkgs/development/python-modules/readlike/default.nix
@@ -0,0 +1,28 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, python
+}:
+
+buildPythonPackage rec {
+  pname = "readlike";
+  version = "0.1.3";
+
+  src = fetchFromGitHub {
+    owner = "jangler";
+    repo = "readlike";
+    rev = version;
+    sha256 = "1mw8j8ads8hqdbz42siwpffi4wi5s33z9g14a5c2i7vxp8m68qc1";
+  };
+
+  checkPhase = ''
+    ${python.interpreter} -m unittest discover -s tests
+  '';
+
+  meta = with lib; {
+    description = "GNU Readline-like line editing module";
+    homepage = "https://github.com/jangler/readlike";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 9adf1f901297..cdc571cc8863 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7313,6 +7313,8 @@ in {
 
   readchar = callPackage ../development/python-modules/readchar { };
 
+  readlike = callPackage ../development/python-modules/readlike { };
+
   readme = callPackage ../development/python-modules/readme { };
 
   readme_renderer = callPackage ../development/python-modules/readme_renderer { };

From fd6e2d87937443a3d44791c98599d058bb5c6c0b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <dev@schuetz-co.de>
Date: Sat, 19 Jun 2021 12:18:48 +0200
Subject: [PATCH 089/416] python3Packages.reparser: init at 1.4.3

---
 .../python-modules/reparser/default.nix       | 31 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 33 insertions(+)
 create mode 100644 pkgs/development/python-modules/reparser/default.nix

diff --git a/pkgs/development/python-modules/reparser/default.nix b/pkgs/development/python-modules/reparser/default.nix
new file mode 100644
index 000000000000..90d701a0e465
--- /dev/null
+++ b/pkgs/development/python-modules/reparser/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, buildPythonPackage
+, isPy27
+, fetchFromGitHub
+}:
+
+buildPythonPackage rec {
+  pname = "reparser";
+  version = "1.4.3";
+
+  disabled = isPy27;
+
+  src = fetchFromGitHub {
+    owner = "xmikos";
+    repo = "reparser";
+    rev = "v${version}";
+    sha256 = "04v7h52wny0j2qj37501nk33j0s4amm134kagdicx2is49zylzq1";
+  };
+
+  # no tests implemented
+  doCheck = false;
+
+  pythonImportsCheck = [ "reparser" ];
+
+  meta = with lib; {
+    description = "Simple regex-based lexer/parser for inline markup";
+    homepage = "https://github.com/xmikos/reparser";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index cdc571cc8863..6df69b987c8b 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7353,6 +7353,8 @@ in {
 
   rencode = callPackage ../development/python-modules/rencode { };
 
+  reparser = callPackage ../development/python-modules/reparser { };
+
   repeated_test = callPackage ../development/python-modules/repeated_test { };
 
   repocheck = callPackage ../development/python-modules/repocheck { };

From 07d5520ce2e8f6ae4bad34fc4f8cb1db4004b6da Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <dev@schuetz-co.de>
Date: Sat, 19 Jun 2021 13:28:15 +0200
Subject: [PATCH 090/416] python3Packages.hangups: init at 0.4.14

---
 .../python-modules/hangups/default.nix        | 70 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 72 insertions(+)
 create mode 100644 pkgs/development/python-modules/hangups/default.nix

diff --git a/pkgs/development/python-modules/hangups/default.nix b/pkgs/development/python-modules/hangups/default.nix
new file mode 100644
index 000000000000..9c32bc2dd951
--- /dev/null
+++ b/pkgs/development/python-modules/hangups/default.nix
@@ -0,0 +1,70 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, configargparse
+, aiohttp
+, async-timeout
+, appdirs
+, readlike
+, requests
+, reparser
+, protobuf
+, urwid
+, mechanicalsoup
+, httpretty
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "hangups";
+  version = "0.4.14";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "tdryer";
+    repo = "hangups";
+    rev = "v${version}";
+    sha256 = "14njagpdp13zlaqnwl2mh7fkpnsaqr6wkr4lwh608v06pkwwcwcm";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "protobuf>=3.1.0,<3.16" "protobuf" \
+      --replace "MechanicalSoup>=0.6.0,<0.13" "MechanicalSoup"
+  '';
+
+  propagatedBuildInputs = [
+    configargparse
+    aiohttp
+    async-timeout
+    appdirs
+    readlike
+    requests
+    reparser
+    protobuf
+    urwid
+    mechanicalsoup
+  ];
+
+  checkInputs = [
+    httpretty
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "hangups"
+    "hangups.client"
+    "hangups.event"
+    "hangups.parsers"
+    "hangups.user"
+  ];
+
+  meta = with lib; {
+    description = "The first third-party instant messaging client for Google Hangouts";
+    homepage = "https://github.com/tdryer/hangups";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 6df69b987c8b..58f9c3d0e023 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3174,6 +3174,8 @@ in {
 
   handout = callPackage ../development/python-modules/handout { };
 
+  hangups = callPackage ../development/python-modules/hangups { };
+
   hap-python = callPackage ../development/python-modules/hap-python { };
 
   hass-nabucasa = callPackage ../development/python-modules/hass-nabucasa { };

From 46c5313b78d1c0152dd734c74ea4c4e70bada879 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <dev@schuetz-co.de>
Date: Sat, 19 Jun 2021 13:33:01 +0200
Subject: [PATCH 091/416] home-assistant: update component-packages.nix

---
 pkgs/servers/home-assistant/component-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 159b77e8b779..d8ba038c0007 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -336,7 +336,7 @@
     "gtfs" = ps: with ps; [ pygtfs ];
     "guardian" = ps: with ps; [ aioguardian ];
     "habitica" = ps: with ps; [ habitipy ];
-    "hangouts" = ps: with ps; [ ]; # missing inputs: hangups
+    "hangouts" = ps: with ps; [ hangups ];
     "harman_kardon_avr" = ps: with ps; [ ]; # missing inputs: hkavr
     "harmony" = ps: with ps; [ aioharmony ];
     "hassio" = ps: with ps; [ aiohttp-cors home-assistant-frontend pillow ];

From 6db54500680fd50421e8badbc58945074034f796 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <dev@schuetz-co.de>
Date: Sat, 19 Jun 2021 13:35:01 +0200
Subject: [PATCH 092/416] home-assistant: test hangouts component

---
 pkgs/servers/home-assistant/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index b0ba15e88203..3873692c3a1c 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -436,6 +436,7 @@ in with py.pkgs; buildPythonApplication rec {
     "growatt_server"
     "guardian"
     "habitica"
+    "hangouts"
     "harmony"
     "hassio"
     "hddtemp"

From d900491d80b8267559811bb1226f7cf52f2791b6 Mon Sep 17 00:00:00 2001
From: Kira Bruneau <kira.bruneau@pm.me>
Date: Sat, 19 Jun 2021 07:35:14 -0400
Subject: [PATCH 093/416] =?UTF-8?q?texlab:=203.1.0=20=E2=86=92=203.2.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/tools/misc/texlab/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/misc/texlab/default.nix b/pkgs/development/tools/misc/texlab/default.nix
index 2fcda04cb434..42a30cce8eb9 100644
--- a/pkgs/development/tools/misc/texlab/default.nix
+++ b/pkgs/development/tools/misc/texlab/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "texlab";
-  version = "3.1.0";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "latex-lsp";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-h08RRcuQG1IjuCA6Xk71+MXKprZ/w5+H2edbG3rtVSY=";
+    hash = "sha256-iXsV7zt190GH0kTMpdmf8xHk4cqtCVwq6LDICmhe5qU=";
   };
 
-  cargoHash = "sha256-78S9Bmq6TIMiAV3HpMC8jK9fH+0Y+jXAW9V1Druyfg8=";
+  cargoHash = "sha256-Yqn6VpAKw93QvkxuwNcYvrQm0C4TfisRDcmFy95/yw8=";
 
   outputs = [ "out" "man" ];
 

From 4fa80ae13ab707bd11074cf18d6203f15d65f613 Mon Sep 17 00:00:00 2001
From: fortuneteller2k <lythe1107@gmail.com>
Date: Sat, 19 Jun 2021 09:46:36 +0800
Subject: [PATCH 094/416] linux_xanmod: 5.12.11 -> 5.12.12

---
 pkgs/os-specific/linux/kernel/linux-xanmod.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-xanmod.nix b/pkgs/os-specific/linux/kernel/linux-xanmod.nix
index b3cacfc1d45a..1fb963c56c67 100644
--- a/pkgs/os-specific/linux/kernel/linux-xanmod.nix
+++ b/pkgs/os-specific/linux/kernel/linux-xanmod.nix
@@ -1,18 +1,18 @@
 { lib, stdenv, buildLinux, fetchFromGitHub, ... } @ args:
 
 let
-  version = "5.12.11";
+  version = "5.12.12";
   suffix = "xanmod1-cacule";
 in
 buildLinux (args // rec {
-  modDirVersion = "${version}-${suffix}";
   inherit version;
+  modDirVersion = "${version}-${suffix}";
 
   src = fetchFromGitHub {
     owner = "xanmod";
     repo = "linux";
     rev = modDirVersion;
-    sha256 = "sha256-EQ52Leg7i1Xb2b29JbaKFKRE/jKXB48GXhbM/Ay5QTY=";
+    sha256 = "sha256-99gVqdYhnBx3MDTCCHbxsljmvi+DixHp19vtNwCRM/M=";
   };
 
   extraMeta = {

From 812ab39e853248a1895559452ebfadd9febcf3ff Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 19 Jun 2021 15:43:03 +0200
Subject: [PATCH 095/416] python3Packages.pymfy: 0.10.1 -> 0.11.0

---
 pkgs/development/python-modules/pymfy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pymfy/default.nix b/pkgs/development/python-modules/pymfy/default.nix
index 2c17c0a085d9..ab5b21e8881d 100644
--- a/pkgs/development/python-modules/pymfy/default.nix
+++ b/pkgs/development/python-modules/pymfy/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pymfy";
-  version = "0.10.1";
+  version = "0.11.0";
   format = "pyproject";
   disabled = pythonOlder "3.7";
 
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "tetienne";
     repo = "somfy-open-api";
     rev = "v${version}";
-    sha256 = "sha256-xX7vNBQaYPdnsukFcQyEa2G1XIvf9ehADNXbLUUCRoU=";
+    sha256 = "0wpjwjmywfyqgwvfa5kwcjpaljc32qa088kk88nl9nqdvc31mzhv";
   };
 
   nativeBuildInputs = [ poetry-core ];

From ad0e87518d842200a581b38cecb284cfe67152dc Mon Sep 17 00:00:00 2001
From: Rick van Schijndel <rol3517@gmail.com>
Date: Mon, 3 May 2021 21:40:16 +0200
Subject: [PATCH 096/416] a52dec: support cross-compilation

---
 pkgs/development/libraries/a52dec/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/libraries/a52dec/default.nix b/pkgs/development/libraries/a52dec/default.nix
index faa819ec5615..cce911f0d804 100644
--- a/pkgs/development/libraries/a52dec/default.nix
+++ b/pkgs/development/libraries/a52dec/default.nix
@@ -13,6 +13,10 @@ stdenv.mkDerivation rec {
     "--enable-shared"
   ];
 
+  makeFlags = [
+    "AR=${stdenv.cc.targetPrefix}ar"
+  ];
+
   # fails 1 out of 1 tests with "BAD GLOBAL SYMBOLS" on i686
   # which can also be fixed with
   # hardeningDisable = lib.optional stdenv.isi686 "pic";

From b133101a30f7b523303ccd6ca4725a7170bc3868 Mon Sep 17 00:00:00 2001
From: Kira Bruneau <kira.bruneau@pm.me>
Date: Sun, 6 Jun 2021 18:10:27 -0400
Subject: [PATCH 097/416] =?UTF-8?q?yabridge,=20yabridgectl:=203.2.0=20?=
 =?UTF-8?q?=E2=86=92=203.3.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/tools/audio/yabridge/default.nix    | 12 ++----------
 pkgs/tools/audio/yabridgectl/default.nix |  3 ++-
 2 files changed, 4 insertions(+), 11 deletions(-)

diff --git a/pkgs/tools/audio/yabridge/default.nix b/pkgs/tools/audio/yabridge/default.nix
index 0013fac23a04..e35a6102a3da 100644
--- a/pkgs/tools/audio/yabridge/default.nix
+++ b/pkgs/tools/audio/yabridge/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , substituteAll
 , meson
 , ninja
@@ -58,14 +57,14 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "yabridge";
-  version = "3.2.0";
+  version = "3.3.0";
 
   # NOTE: Also update yabridgectl's cargoHash when this is updated
   src = fetchFromGitHub {
     owner = "robbert-vdh";
     repo = pname;
     rev = version;
-    hash = "sha256-UT6st0Rc6HOaObE3N+qlPZZ8U1gl/MFLU0mjFuScdes=";
+    hash = "sha256-e0tHvuHJ3eib0keCu6/U6UGEm8pn7rcKN5sN0eNINUY=";
   };
 
   # Unpack subproject sources
@@ -80,13 +79,6 @@ in stdenv.mkDerivation rec {
   )'';
 
   patches = [
-    # Fix for wine 6.8+ (remove patch in next release):
-    (fetchpatch {
-      url = "https://github.com/robbert-vdh/yabridge/commit/5577c4bfd842c60a8ae8ce2889bbfeb53a51c62b.patch";
-      sha256 = "sha256-bTT08iWwDBVqi2PZPa7oal7/MqVu8t2Bh1gpjFMqLvQ=";
-      excludes = [ "CHANGELOG.md" ];
-    })
-
     # Hard code wine path so wine version is correct in logs
     (substituteAll {
       src = ./hardcode-wine.patch;
diff --git a/pkgs/tools/audio/yabridgectl/default.nix b/pkgs/tools/audio/yabridgectl/default.nix
index 4f738310d85c..29885dd08d62 100644
--- a/pkgs/tools/audio/yabridgectl/default.nix
+++ b/pkgs/tools/audio/yabridgectl/default.nix
@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
 
   src = yabridge.src;
   sourceRoot = "source/tools/yabridgectl";
-  cargoHash = "sha256-cB4Xp8pNLQRcPQ6HtVkDkLbfNSmM9yl+oRcEzcqrmkY=";
+  cargoHash = "sha256-GY868xz+3uBeLy7tlludmbd8dJAot2/ewe5gToRtJnw=";
 
   patches = [
     # By default, yabridgectl locates libyabridge.so by using
@@ -34,5 +34,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/robbert-vdh/yabridge/tree/master/tools/yabridgectl";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ kira-bruneau ];
+    platforms = yabridge.meta.platforms;
   };
 }

From 7e052ffff2cb61d9c6df3d5e4b6f7137b095c28f Mon Sep 17 00:00:00 2001
From: Kira Bruneau <kira.bruneau@pm.me>
Date: Sat, 19 Jun 2021 07:15:22 -0400
Subject: [PATCH 098/416] =?UTF-8?q?yabridge,=20yabridgectl:=203.3.0=20?=
 =?UTF-8?q?=E2=86=92=203.3.1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/tools/audio/yabridge/default.nix    | 4 ++--
 pkgs/tools/audio/yabridgectl/default.nix | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/audio/yabridge/default.nix b/pkgs/tools/audio/yabridge/default.nix
index e35a6102a3da..cbe35765cb4f 100644
--- a/pkgs/tools/audio/yabridge/default.nix
+++ b/pkgs/tools/audio/yabridge/default.nix
@@ -57,14 +57,14 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "yabridge";
-  version = "3.3.0";
+  version = "3.3.1";
 
   # NOTE: Also update yabridgectl's cargoHash when this is updated
   src = fetchFromGitHub {
     owner = "robbert-vdh";
     repo = pname;
     rev = version;
-    hash = "sha256-e0tHvuHJ3eib0keCu6/U6UGEm8pn7rcKN5sN0eNINUY=";
+    hash = "sha256-3B+6YuCWVJljqdyGpePjPf5JDwLSWFNgOCeLt8e4mO8=";
   };
 
   # Unpack subproject sources
diff --git a/pkgs/tools/audio/yabridgectl/default.nix b/pkgs/tools/audio/yabridgectl/default.nix
index 29885dd08d62..bf0913372beb 100644
--- a/pkgs/tools/audio/yabridgectl/default.nix
+++ b/pkgs/tools/audio/yabridgectl/default.nix
@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
 
   src = yabridge.src;
   sourceRoot = "source/tools/yabridgectl";
-  cargoHash = "sha256-GY868xz+3uBeLy7tlludmbd8dJAot2/ewe5gToRtJnw=";
+  cargoHash = "sha256-f5k5OF+bEzH0b6M14Mdp8t4Qd5dP5Qj2fDsdiG1MkYk=";
 
   patches = [
     # By default, yabridgectl locates libyabridge.so by using

From e2c86a37a99b792d88ce7318f7b64fc7c275a5cb Mon Sep 17 00:00:00 2001
From: Kira Bruneau <kira.bruneau@pm.me>
Date: Sat, 19 Jun 2021 10:21:47 -0400
Subject: [PATCH 099/416] =?UTF-8?q?protontricks:=201.5.1=20=E2=86=92=201.5?=
 =?UTF-8?q?.2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../protontricks/default.nix                  |  4 +--
 .../protontricks/steam-run.patch              | 30 +++++++++----------
 2 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/pkgs/tools/package-management/protontricks/default.nix b/pkgs/tools/package-management/protontricks/default.nix
index db76c9913f60..cbe10e85f667 100644
--- a/pkgs/tools/package-management/protontricks/default.nix
+++ b/pkgs/tools/package-management/protontricks/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonApplication rec {
   pname = "protontricks";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "Matoking";
     repo = pname;
     rev = version;
-    hash = "sha256-SrBPqGRIsP0+ZWDe96sqjqCpJoY3Sn3VoPpMw7ellC0=";
+    hash = "sha256-Vmxb8SjPhcSqFzykHRPsLtAoSwomN+se+icwHkucbX8=";
   };
 
   patches = [
diff --git a/pkgs/tools/package-management/protontricks/steam-run.patch b/pkgs/tools/package-management/protontricks/steam-run.patch
index 76b7b7f60369..82ddec1abb89 100644
--- a/pkgs/tools/package-management/protontricks/steam-run.patch
+++ b/pkgs/tools/package-management/protontricks/steam-run.patch
@@ -69,7 +69,7 @@ index cc65a03..5c3fc7a 100755
              # Pass the command directly into the shell *without*
              # escaping it
 diff --git a/src/protontricks/steam.py b/src/protontricks/steam.py
-index f9fb9ec..e1e588a 100644
+index 4ab778b..f3f5f99 100644
 --- a/src/protontricks/steam.py
 +++ b/src/protontricks/steam.py
 @@ -12,8 +12,8 @@ from .util import lower_dict
@@ -81,9 +81,9 @@ index f9fb9ec..e1e588a 100644
 +    "get_appinfo_sections", "get_proton_appid",
 +    "find_steam_proton_app", "find_appid_proton_prefix",
      "find_proton_app", "get_steam_lib_paths", "get_compat_tool_dirs",
-     "get_proton_installations", "get_custom_proton_installations",
+     "get_custom_proton_installations_in_dir", "get_custom_proton_installations",
      "find_current_steamid3", "get_appid_from_shortcut",
-@@ -286,37 +286,6 @@ def find_steam_path():
+@@ -300,37 +300,6 @@ def find_steam_path():
      return None, None
  
  
@@ -122,7 +122,7 @@ index f9fb9ec..e1e588a 100644
  APPINFO_STRUCT_SECTION = "<LLLLQ20sL"
  
 diff --git a/src/protontricks/util.py b/src/protontricks/util.py
-index 2abda99..3a25368 100644
+index b6617de..85f8b2d 100644
 --- a/src/protontricks/util.py
 +++ b/src/protontricks/util.py
 @@ -4,15 +4,14 @@ import shlex
@@ -146,8 +146,8 @@ index 2abda99..3a25368 100644
  )
  
  logger = logging.getLogger("protontricks")
-@@ -39,24 +38,6 @@ def lower_dict(d):
-     return {k.lower(): v for k, v in d.items()}
+@@ -46,24 +45,6 @@ def lower_dict(d):
+     return {k.lower(): _lower_value(v) for k, v in d.items()}
  
  
 -def get_legacy_runtime_library_paths(legacy_steam_runtime_path, proton_app):
@@ -171,7 +171,7 @@ index 2abda99..3a25368 100644
  def get_host_library_paths():
      """
      Get host library paths to use when creating the LD_LIBRARY_PATH environment
-@@ -68,7 +49,7 @@ def get_host_library_paths():
+@@ -75,7 +56,7 @@ def get_host_library_paths():
      # Since that command is unavailable with newer Steam Runtime releases,
      # do it ourselves here.
      result = run(
@@ -180,7 +180,7 @@ index 2abda99..3a25368 100644
          check=True, stdout=PIPE, stderr=PIPE
      )
      lines = result.stdout.decode("utf-8").split("\n")
-@@ -86,7 +67,7 @@ RUNTIME_ROOT_GLOB_PATTERNS = (
+@@ -93,7 +74,7 @@ RUNTIME_ROOT_GLOB_PATTERNS = (
  )
  
  
@@ -189,7 +189,7 @@ index 2abda99..3a25368 100644
      """
      Get LD_LIBRARY_PATH value to use when running a command using Steam Runtime
      """
-@@ -109,7 +90,7 @@ def get_runtime_library_paths(proton_app, use_bwrap=True):
+@@ -116,7 +97,7 @@ def get_runtime_library_paths(proton_app, use_bwrap=True):
              )
          )
  
@@ -198,7 +198,7 @@ index 2abda99..3a25368 100644
          return "".join([
              str(proton_app.proton_dist_path / "lib"), os.pathsep,
              str(proton_app.proton_dist_path / "lib64"), os.pathsep
-@@ -125,14 +106,19 @@ def get_runtime_library_paths(proton_app, use_bwrap=True):
+@@ -132,14 +113,19 @@ def get_runtime_library_paths(proton_app, use_bwrap=True):
      ])
  
  
@@ -225,7 +225,7 @@ index 2abda99..3a25368 100644
  # Helper script created by Protontricks to run Wine binaries using Steam Runtime
  set -o errexit
  
-@@ -200,7 +186,10 @@ if [[ -n "$PROTONTRICKS_INSIDE_STEAM_RUNTIME" ]]; then
+@@ -207,7 +193,10 @@ if [[ -n "$PROTONTRICKS_INSIDE_STEAM_RUNTIME" ]]; then
    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH":"$PROTON_LD_LIBRARY_PATH"
    "$PROTON_DIST_PATH"/bin/{name} "$@"
  else
@@ -237,7 +237,7 @@ index 2abda99..3a25368 100644
    "${{mount_params[@]}}" -- \
    env PROTONTRICKS_INSIDE_STEAM_RUNTIME=1 \
    "$PROTONTRICKS_PROXY_SCRIPT_PATH" "$@"
-@@ -266,7 +255,6 @@ def create_wine_bin_dir(proton_app, use_bwrap=True):
+@@ -273,7 +262,6 @@ def create_wine_bin_dir(proton_app, use_bwrap=True):
  def run_command(
          winetricks_path, proton_app, steam_app, command,
          use_steam_runtime=False,
@@ -245,7 +245,7 @@ index 2abda99..3a25368 100644
          use_bwrap=True,
          **kwargs):
      """Run an arbitrary command with the correct environment variables
-@@ -343,7 +331,7 @@ def run_command(
+@@ -350,7 +338,7 @@ def run_command(
              os.environ["STEAM_RUNTIME_PATH"] = \
                  str(proton_app.required_tool_app.install_path)
              os.environ["PROTON_LD_LIBRARY_PATH"] = \
@@ -254,7 +254,7 @@ index 2abda99..3a25368 100644
  
              runtime_name = proton_app.required_tool_app.name
              logger.info(
-@@ -366,11 +354,8 @@ def run_command(
+@@ -373,11 +361,8 @@ def run_command(
                      "Current Steam Runtime not recognized by Protontricks."
                  )
          else:
@@ -267,7 +267,7 @@ index 2abda99..3a25368 100644
  
          # When Steam Runtime is enabled, create a set of helper scripts
          # that load the underlying Proton Wine executables with Steam Runtime
-@@ -378,8 +363,6 @@ def run_command(
+@@ -385,8 +370,6 @@ def run_command(
          wine_bin_dir = create_wine_bin_dir(
              proton_app=proton_app, use_bwrap=use_bwrap
          )

From 003c6f2bb69618262f875d884cbcb535ee5d410a Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 19 Jun 2021 16:52:39 +0200
Subject: [PATCH 100/416] python3Packages.xknx: 0.18.6 -> 0.18.7

---
 pkgs/development/python-modules/xknx/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/xknx/default.nix b/pkgs/development/python-modules/xknx/default.nix
index aae3b3b8d2d8..0a8da94e52eb 100644
--- a/pkgs/development/python-modules/xknx/default.nix
+++ b/pkgs/development/python-modules/xknx/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "xknx";
-  version = "0.18.6";
+  version = "0.18.7";
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "XKNX";
     repo = pname;
     rev = version;
-    sha256 = "sha256-LyeEEynfgB3juprFeiIOFvFXWtTiGbZ8D9m6SnpD0ws=";
+    sha256 = "17w6a4ci4w6ggxpa99197f84awd116ygzd3fa5cvn1a7221dvdj4";
   };
 
   propagatedBuildInputs = [
@@ -43,5 +43,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/XKNX/xknx";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
+    platforms = platforms.linux;
   };
 }

From 2f2dde531542ed33d068bab7b5d0411775a0a851 Mon Sep 17 00:00:00 2001
From: Kira Bruneau <kira.bruneau@pm.me>
Date: Sat, 19 Jun 2021 10:50:25 -0400
Subject: [PATCH 101/416] mangohud: support wayland

---
 pkgs/tools/graphics/mangohud/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/tools/graphics/mangohud/default.nix b/pkgs/tools/graphics/mangohud/default.nix
index 91022eff31db..41c4040f9b51 100644
--- a/pkgs/tools/graphics/mangohud/default.nix
+++ b/pkgs/tools/graphics/mangohud/default.nix
@@ -24,6 +24,7 @@
 , python3Packages
 , vulkan-loader
 , libXNVCtrl
+, wayland
 }:
 
 stdenv.mkDerivation rec {
@@ -82,6 +83,7 @@ stdenv.mkDerivation rec {
   mesonFlags = [
     "-Duse_system_vulkan=enabled"
     "-Dvulkan_datadir=${vulkan-headers}/share"
+    "-Dwith_wayland=enabled"
   ];
 
   nativeBuildInputs = [
@@ -99,6 +101,7 @@ stdenv.mkDerivation rec {
     dbus
     libX11
     libXNVCtrl
+    wayland
   ];
 
   # Support 32bit Vulkan applications by linking in 32bit Vulkan layer

From 1c5ba73b66c81db3378218dbb7bd098c5c751568 Mon Sep 17 00:00:00 2001
From: Kira Bruneau <kira.bruneau@pm.me>
Date: Sat, 19 Jun 2021 10:50:36 -0400
Subject: [PATCH 102/416] mangohud: separate doc & man outputs

---
 pkgs/tools/graphics/mangohud/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/tools/graphics/mangohud/default.nix b/pkgs/tools/graphics/mangohud/default.nix
index 41c4040f9b51..98e60058abc4 100644
--- a/pkgs/tools/graphics/mangohud/default.nix
+++ b/pkgs/tools/graphics/mangohud/default.nix
@@ -39,6 +39,8 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  outputs = [ "out" "doc" "man" ];
+
   patches = [
     # Adds option to specify Vulkan's datadir when it's not the same as MangoHud's
     # See https://github.com/flightlessmango/MangoHud/pull/522

From a6293df119b0ed0621af20a1dddf8ad111557a29 Mon Sep 17 00:00:00 2001
From: Kira Bruneau <kira.bruneau@pm.me>
Date: Sat, 1 May 2021 14:24:34 -0400
Subject: [PATCH 103/416] goverlay: init at 0.5.1

---
 pkgs/tools/graphics/goverlay/default.nix      | 108 ++++++++++++++++++
 .../goverlay/find-xdg-data-files.patch        |  40 +++++++
 pkgs/top-level/all-packages.nix               |   2 +
 3 files changed, 150 insertions(+)
 create mode 100644 pkgs/tools/graphics/goverlay/default.nix
 create mode 100644 pkgs/tools/graphics/goverlay/find-xdg-data-files.patch

diff --git a/pkgs/tools/graphics/goverlay/default.nix b/pkgs/tools/graphics/goverlay/default.nix
new file mode 100644
index 000000000000..43d711588f8e
--- /dev/null
+++ b/pkgs/tools/graphics/goverlay/default.nix
@@ -0,0 +1,108 @@
+{ lib
+, writeScriptBin
+, bash
+, stdenv
+, fetchFromGitHub
+, fpc
+, lazarus-qt
+, qt5
+, libX11
+, libqt5pas
+, coreutils
+, git
+, gnugrep
+, libnotify
+, mesa-demos
+, polkit
+, procps
+, systemd
+, vulkan-tools
+, which
+}:
+
+let
+  # Finds data files using the XDG Base Directory Specification
+  # See https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
+  find-xdg-data-files = writeScriptBin "find-xdg-data-files" ''
+    #!${bash}/bin/sh
+    IFS=:
+    for xdg_data_dir in ''${XDG_DATA_HOME:-$HOME/.local/share}:''${XDG_DATA_DIRS:-/usr/local/share:/usr/share}; do
+      if [ -f "$xdg_data_dir/$1" ]; then
+        echo "$xdg_data_dir/$1"
+      fi
+    done
+  '';
+in stdenv.mkDerivation rec {
+  pname = "goverlay";
+  version = "0.5.1";
+
+  src = fetchFromGitHub {
+    owner = "benjamimgois";
+    repo = pname;
+    rev = version;
+    hash = "sha256-Zl1pq2MeGJsPdNlwUEpov5MHlsr9pSMkWHVprt8ImKs=";
+  };
+
+  outputs = [ "out" "man" ];
+
+  patches = [
+    # Find MangoHud & vkBasalt Vulkan layers using the XDG Base Directory Specification
+    ./find-xdg-data-files.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace 'prefix = /usr/local' "prefix = $out"
+
+    substituteInPlace overlayunit.pas \
+      --replace '/usr/share/icons/hicolor/128x128/apps/goverlay.png' "$out/share/icons/hicolor/128x128/apps/goverlay.png"
+  '';
+
+  nativeBuildInputs = [
+    fpc
+    lazarus-qt
+    qt5.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    libX11
+    libqt5pas
+  ];
+
+  NIX_LDFLAGS = "--as-needed -rpath ${lib.makeLibraryPath buildInputs}";
+
+  buildPhase = ''
+    runHook preBuild
+    HOME=$(mktemp -d) lazbuild --lazarusdir=${lazarus-qt}/share/lazarus -B goverlay.lpi
+    runHook postBuild
+  '';
+
+  qtWrapperArgs = [
+    "--prefix PATH : ${lib.makeBinPath [
+      bash
+      coreutils
+      find-xdg-data-files
+      git
+      gnugrep
+      libnotify
+      mesa-demos
+      polkit
+      procps
+      systemd
+      vulkan-tools
+      which
+    ]}"
+
+    # Force xcb since libqt5pas doesn't support Wayland
+    # See https://github.com/benjamimgois/goverlay/issues/107
+    "--set QT_QPA_PLATFORM xcb"
+  ];
+
+  meta = with lib; {
+    description = "An opensource project that aims to create a Graphical UI to help manage Linux overlays";
+    homepage = "https://github.com/benjamimgois/goverlay";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ kira-bruneau ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/graphics/goverlay/find-xdg-data-files.patch b/pkgs/tools/graphics/goverlay/find-xdg-data-files.patch
new file mode 100644
index 000000000000..862e4c3903cb
--- /dev/null
+++ b/pkgs/tools/graphics/goverlay/find-xdg-data-files.patch
@@ -0,0 +1,40 @@
+diff --git a/overlayunit.pas b/overlayunit.pas
+index 59f6a81..a096543 100644
+--- a/overlayunit.pas
++++ b/overlayunit.pas
+@@ -4871,7 +4871,7 @@ begin
+    //Determine Mangohud dependency status
+ 
+           //locate MangoHud and store result in tmp folder
+-          RunCommand('bash -c ''find /usr/share/vulkan/implicit_layer.d/MangoHud.json >> /tmp/goverlay/dependency_mangohud''', s);
++          RunCommand('bash -c ''find-xdg-data-files vulkan/implicit_layer.d/MangoHud.json >> /tmp/goverlay/dependency_mangohud''', s);
+ 
+           // Assign Text file dependency_mangohud to variable mangohudVAR
+           AssignFile(mangohudVAR, '/tmp/goverlay/dependency_mangohud');
+@@ -4880,7 +4880,7 @@ begin
+           CloseFile(mangohudVAR);
+ 
+           // Read String and store value on mangohuddependencyVALUE based on result
+-          if mangohudSTR = '/usr/share/vulkan/implicit_layer.d/MangoHud.json' then
++          if mangohudSTR <> '' then
+           mangohuddependencyVALUE := 1
+           else
+           mangohuddependencyVALUE := 0;
+@@ -4889,7 +4889,7 @@ begin
+    //Determine vkBasalt dependency staus
+ 
+            //locate vkBasalt and store result in tmp folder
+-           RunCommand('bash -c ''find /usr/share/vulkan/implicit_layer.d/vkBasalt.json >> /tmp/goverlay/dependency_vkbasalt''', s);
++           RunCommand('bash -c ''find-xdg-data-files vulkan/implicit_layer.d/vkBasalt.json >> /tmp/goverlay/dependency_vkbasalt''', s);
+ 
+            // Assign Text file dependency_mangohud to variable mangohudVAR
+            AssignFile(vkbasaltVAR, '/tmp/goverlay/dependency_vkbasalt');
+@@ -4898,7 +4898,7 @@ begin
+            CloseFile(vkbasaltVAR);
+ 
+            // Read String and store value on vkbasaltdependencyVALUE based on result
+-           if vkbasaltSTR = '/usr/share/vulkan/implicit_layer.d/vkBasalt.json' then
++           if vkbasaltSTR <> '' then
+            vkbasaltdependencyVALUE := 1
+            else
+            vkbasaltdependencyVALUE := 0;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 932e506fcaf9..bd76d241f410 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5237,6 +5237,8 @@ in
 
   govc = callPackage ../tools/virtualization/govc { };
 
+  goverlay = callPackage ../tools/graphics/goverlay { };
+
   gpart = callPackage ../tools/filesystems/gpart { };
 
   gparted = callPackage ../tools/misc/gparted { };

From 37c5ca7b57559c15023affdac187c421b5fa245d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <dev@schuetz-co.de>
Date: Sat, 19 Jun 2021 17:32:13 +0200
Subject: [PATCH 104/416] python3Packages.pyheos: init at 0.7.2

---
 .../python-modules/pyheos/default.nix         | 37 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 39 insertions(+)
 create mode 100644 pkgs/development/python-modules/pyheos/default.nix

diff --git a/pkgs/development/python-modules/pyheos/default.nix b/pkgs/development/python-modules/pyheos/default.nix
new file mode 100644
index 000000000000..715c609875e6
--- /dev/null
+++ b/pkgs/development/python-modules/pyheos/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytest-asyncio
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "pyheos";
+  version = "0.7.2";
+
+  src = fetchFromGitHub {
+    owner = "andrewsayre";
+    repo = "pyheos";
+    rev = version;
+    sha256 = "0rgzg7lnqzzqrjp73c1hj1hq8p0j0msyih3yr4wa2rj81s8ihmby";
+  };
+
+  checkInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # accesses network
+    "test_connect_timeout"
+  ];
+
+  pythonImportsCheck = [ "pyheos" ];
+
+  meta = with lib; {
+    description = "Async python library for controlling HEOS devices through the HEOS CLI Protocol";
+    homepage = "https://github.com/andrewsayre/pyheos";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 58f9c3d0e023..0d2ec9d00a32 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5266,6 +5266,8 @@ in {
 
   pyflick = callPackage ../development/python-modules/pyflick { };
 
+  pyheos = callPackage ../development/python-modules/pyheos { };
+
   pynndescent = callPackage ../development/python-modules/pynndescent { };
 
   pynobo = callPackage ../development/python-modules/pynobo { };

From 9518b3512787af1fd4da92b7aa33e2670e6fca69 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <dev@schuetz-co.de>
Date: Sat, 19 Jun 2021 17:32:54 +0200
Subject: [PATCH 105/416] home-assistant: update component-packages.nix

---
 pkgs/servers/home-assistant/component-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index d8ba038c0007..a72010eeafd6 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -344,7 +344,7 @@
     "hddtemp" = ps: with ps; [ ];
     "hdmi_cec" = ps: with ps; [ pycec ];
     "heatmiser" = ps: with ps; [ ]; # missing inputs: heatmiserV3
-    "heos" = ps: with ps; [ ]; # missing inputs: pyheos
+    "heos" = ps: with ps; [ pyheos ];
     "here_travel_time" = ps: with ps; [ ]; # missing inputs: herepy
     "hikvision" = ps: with ps; [ ]; # missing inputs: pyhik
     "hikvisioncam" = ps: with ps; [ ]; # missing inputs: hikvision

From 71de28cfa822751122d6beebe2655197222e9f64 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <dev@schuetz-co.de>
Date: Sat, 19 Jun 2021 17:34:52 +0200
Subject: [PATCH 106/416] home-assistant: test heos component

---
 pkgs/servers/home-assistant/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 3873692c3a1c..d812c1539c6c 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -440,6 +440,7 @@ in with py.pkgs; buildPythonApplication rec {
     "harmony"
     "hassio"
     "hddtemp"
+    "heos"
     "history"
     "history_stats"
     "home_connect"

From a5212a77273d423433ee11e2dda4d8c17fe540ef Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <dev@schuetz-co.de>
Date: Sat, 19 Jun 2021 18:00:50 +0200
Subject: [PATCH 107/416] pythonPackages.unasync: init at 0.5.0

---
 .../python-modules/unasync/default.nix        | 45 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 47 insertions(+)
 create mode 100644 pkgs/development/python-modules/unasync/default.nix

diff --git a/pkgs/development/python-modules/unasync/default.nix b/pkgs/development/python-modules/unasync/default.nix
new file mode 100644
index 000000000000..9b37edfb2841
--- /dev/null
+++ b/pkgs/development/python-modules/unasync/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, setuptools
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "unasync";
+  version = "0.5.0";
+
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "python-trio";
+    repo = "unasync";
+    rev = "v${version}";
+    sha256 = "0h86i09v4909a8nk5lp36jlwz6rsln6vyg3d0i13ykxa6lrx1c2l";
+  };
+
+  propagatedBuildInputs = [
+    setuptools
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # mess with $PYTHONPATH
+    "test_build_py_modules"
+    "test_build_py_packages"
+    "test_project_structure_after_build_py_packages"
+    "test_project_structure_after_customized_build_py_packages"
+  ];
+
+  pythonImportsCheck = [ "unasync" ];
+
+  meta = with lib; {
+    description = "Project that can transform your asynchronous code into synchronous code";
+    homepage = "https://github.com/python-trio/unasync";
+    license = with licenses; [ mit /* or */ asl20 ];
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0d2ec9d00a32..9921f278d557 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8742,6 +8742,8 @@ in {
 
   u-msgpack-python = callPackage ../development/python-modules/u-msgpack-python { };
 
+  unasync = callPackage ../development/python-modules/unasync { };
+
   uncertainties = callPackage ../development/python-modules/uncertainties { };
 
   uncompyle6 = callPackage ../development/python-modules/uncompyle6 { };

From 6420b66f0b37d9b6d154e4a5ededdf9f440231ae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <dev@schuetz-co.de>
Date: Sat, 19 Jun 2021 18:10:36 +0200
Subject: [PATCH 108/416] python3Packages.pyhiveapi: init at 0.4.2

---
 .../python-modules/pyhiveapi/default.nix      | 63 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 65 insertions(+)
 create mode 100644 pkgs/development/python-modules/pyhiveapi/default.nix

diff --git a/pkgs/development/python-modules/pyhiveapi/default.nix b/pkgs/development/python-modules/pyhiveapi/default.nix
new file mode 100644
index 000000000000..96b361d02718
--- /dev/null
+++ b/pkgs/development/python-modules/pyhiveapi/default.nix
@@ -0,0 +1,63 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, unasync
+, boto3
+, botocore
+, requests
+, aiohttp
+, pyquery
+, loguru
+}:
+
+buildPythonPackage rec {
+  pname = "pyhiveapi";
+  version = "0.4.2";
+
+  format = "pyproject";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "Pyhass";
+    repo = "Pyhiveapi";
+    rev = "v${version}";
+    sha256 = "0x9cfxfdpccz360azpyfhvn09xxkw7vxy42npgbqhpy2g6mh5sif";
+  };
+
+  postPatch = ''
+    substituteInPlace requirements.txt \
+      --replace "pre-commit" ""
+  '';
+
+  nativeBuildInputs = [
+    unasync
+  ];
+
+  propagatedBuildInputs = [
+    boto3
+    botocore
+    requests
+    aiohttp
+    pyquery
+    loguru
+  ];
+
+  # tests are not functional yet
+  doCheck = false;
+
+  postBuild = ''
+    # pyhiveapi accesses $HOME upon importing
+    export HOME=$TMPDIR
+  '';
+
+  pythonImportsCheck = [ "pyhiveapi" ];
+
+  meta = with lib; {
+    description = "Python library to interface with the Hive API";
+    homepage = "https://github.com/Pyhass/Pyhiveapi";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 9921f278d557..d3c455f41fef 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5268,6 +5268,8 @@ in {
 
   pyheos = callPackage ../development/python-modules/pyheos { };
 
+  pyhiveapi = callPackage ../development/python-modules/pyhiveapi { };
+
   pynndescent = callPackage ../development/python-modules/pynndescent { };
 
   pynobo = callPackage ../development/python-modules/pynobo { };

From ef27876d15e8263c8bc1ba73f0f7695e7d600556 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <dev@schuetz-co.de>
Date: Sat, 19 Jun 2021 18:11:45 +0200
Subject: [PATCH 109/416] home-assistant: update component-packages.nix

---
 pkgs/servers/home-assistant/component-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index a72010eeafd6..62684b3c0ba3 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -352,7 +352,7 @@
     "history" = ps: with ps; [ aiohttp-cors sqlalchemy ];
     "history_stats" = ps: with ps; [ sqlalchemy ];
     "hitron_coda" = ps: with ps; [ ];
-    "hive" = ps: with ps; [ ]; # missing inputs: pyhiveapi
+    "hive" = ps: with ps; [ pyhiveapi ];
     "hlk_sw16" = ps: with ps; [ ]; # missing inputs: hlk-sw16
     "home_connect" = ps: with ps; [ aiohttp-cors homeconnect ];
     "home_plus_control" = ps: with ps; [ aiohttp-cors homepluscontrol ];

From 6498fb43a62654131a64cb9304d75183f8923ffd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <dev@schuetz-co.de>
Date: Sat, 19 Jun 2021 18:13:04 +0200
Subject: [PATCH 110/416] home-assistant: test hive component

---
 pkgs/servers/home-assistant/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index d812c1539c6c..53cb0cac8430 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -443,6 +443,7 @@ in with py.pkgs; buildPythonApplication rec {
     "heos"
     "history"
     "history_stats"
+    "hive"
     "home_connect"
     "home_plus_control"
     "homeassistant"

From a528b3c976fe189507f075c58e157473777bff65 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 19 Jun 2021 18:18:33 +0200
Subject: [PATCH 111/416] python3Packages.aiosmb: 0.2.44 -> 0.2.48

---
 pkgs/development/python-modules/aiosmb/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiosmb/default.nix b/pkgs/development/python-modules/aiosmb/default.nix
index b9c968d63f5b..5e8482eff7e4 100644
--- a/pkgs/development/python-modules/aiosmb/default.nix
+++ b/pkgs/development/python-modules/aiosmb/default.nix
@@ -14,12 +14,12 @@
 
 buildPythonPackage rec {
   pname = "aiosmb";
-  version = "0.2.44";
+  version = "0.2.48";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-xNdrOO0BqV4sD6U39G2RXihDBBf516x8RLiqNLnZyWk=";
+    sha256 = "1b5bqpl8wbs0nm6025wlz4n5sns6ca1x6kgw9wx227flwf3qjlgm";
   };
 
   propagatedBuildInputs = [

From fbf187aafe8c330f6986a182d171c17a4947d168 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <dev@schuetz-co.de>
Date: Sat, 19 Jun 2021 18:36:29 +0200
Subject: [PATCH 112/416] getmail6: 6.16 -> 6.17

https://github.com/getmail6/getmail6/releases/tag/v6.17
---
 pkgs/tools/networking/getmail6/default.nix | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/pkgs/tools/networking/getmail6/default.nix b/pkgs/tools/networking/getmail6/default.nix
index 673ff7f83a3f..ceec2bab490e 100644
--- a/pkgs/tools/networking/getmail6/default.nix
+++ b/pkgs/tools/networking/getmail6/default.nix
@@ -1,16 +1,20 @@
-{ fetchFromGitHub, python3Packages, lib }:
+{ lib
+, python3
+, fetchFromGitHub
+}:
 
-python3Packages.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "getmail6";
-  version = "6.16";
+  version = "6.17";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "1y373nzbffjjjs43441cn3wrb0yq1mw2vqixhizbzdacrs45xbfa";
+    sha256 = "sha256-pPf+98zoS1t59RoqbmS4V0OsTLMR37Wcsl9BSWuvc0k=";
   };
 
+  # needs a Docker setup
   doCheck = false;
 
   pythonImportsCheck = [ "getmailcore" ];
@@ -26,6 +30,6 @@ python3Packages.buildPythonApplication rec {
     homepage = "https://getmail6.org";
     updateWalker = true;
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ abbe ];
+    maintainers = with maintainers; [ abbe dotlambda ];
   };
 }

From d57ef0ba3499fb1cce770ab2b68e33726d9c2eb0 Mon Sep 17 00:00:00 2001
From: Victor Freire <victor@freire.dev.br>
Date: Sat, 19 Jun 2021 13:35:26 -0300
Subject: [PATCH 113/416] vscode-extensions.eamodio.gitlens: 11.1.3 -> 11.5.1

---
 pkgs/misc/vscode-extensions/default.nix | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/pkgs/misc/vscode-extensions/default.nix b/pkgs/misc/vscode-extensions/default.nix
index d4b7071117fd..36b300b53b75 100644
--- a/pkgs/misc/vscode-extensions/default.nix
+++ b/pkgs/misc/vscode-extensions/default.nix
@@ -352,11 +352,21 @@ let
         mktplcRef = {
           name = "gitlens";
           publisher = "eamodio";
-          version = "11.1.3";
-          sha256 = "sha256-hqJg3jP4bbXU4qSJOjeKfjkPx61yPDMsQdSUVZObK/U=";
+          version = "11.5.1";
+          sha256 = "sha256-Ic7eT8WX2GDYIj/aTu1d4m+fgPtXe4YQx04G0awbwnM=";
         };
-        meta = {
-          license = lib.licenses.mit;
+        meta = with lib; {
+          changelog = "https://marketplace.visualstudio.com/items/eamodio.gitlens/changelog";
+          description = "GitLens supercharges the Git capabilities built into Visual Studio Code.";
+          longDescription = ''
+            Supercharge the Git capabilities built into Visual Studio Code — Visualize code authorship at a glance via Git
+            blame annotations and code lens, seamlessly navigate and explore Git repositories, gain valuable insights via
+            powerful comparison commands, and so much more
+          '';
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=eamodio.gitlens";
+          homepage = "https://gitlens.amod.io/";
+          license = licenses.mit;
+          maintainers = with maintainers; [ ratsclub ];
         };
       };
 

From 89f642c010065d9dbdc035aef8bf20c1098b2107 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <stig@stig.io>
Date: Tue, 15 Jun 2021 20:43:05 +0200
Subject: [PATCH 114/416] ripasso-cursive: 0.4.0 -> 0.5.1

---
 pkgs/tools/security/ripasso/cursive.nix     | 22 +++---
 pkgs/tools/security/ripasso/fix-tests.patch | 77 +++++++++++++++++----
 2 files changed, 74 insertions(+), 25 deletions(-)

diff --git a/pkgs/tools/security/ripasso/cursive.nix b/pkgs/tools/security/ripasso/cursive.nix
index cc2765bd7075..1a4b1de1b1fb 100644
--- a/pkgs/tools/security/ripasso/cursive.nix
+++ b/pkgs/tools/security/ripasso/cursive.nix
@@ -1,32 +1,34 @@
-{ stdenv, lib, rustPlatform, fetchFromGitHub, pkg-config, ncurses, python3, openssl, libgpgerror, gpgme, xorg, AppKit, Security }:
+{ stdenv, lib, rustPlatform, fetchFromGitHub, pkg-config, ncurses, python3, openssl, libgpgerror, gpgme, xorg, AppKit, Security, installShellFiles }:
 
 with rustPlatform;
 buildRustPackage rec {
-  version = "0.4.0";
+  version = "0.5.1";
   pname = "ripasso-cursive";
 
   src = fetchFromGitHub {
     owner = "cortex";
     repo = "ripasso";
     rev  = "release-${version}";
-    sha256 = "164da20j727p8l7hh37j2r8pai9sj402nhswvg0nrlgj53nr6083";
+    sha256 = "1jx6qv7skikl1ap3g1r34rkz4ab756kra7dgwwv45vl2fb6x74k4";
   };
 
   patches = [ ./fix-tests.patch ];
 
-  cargoSha256 = "1sv5czhrafk15yj5xyd1x9jdqn1dz6aqpxxnyz49icx53qlg9f8g";
+  cargoSha256 = "1li1gmcs7lnjr4qhzs0rrgngdcxy1paiibjwk9zx2rrs71021cgk";
 
-  cargoBuildFlags = [ "-p ripasso-cursive -p ripasso-man" ];
+  cargoBuildFlags = [ "-p ripasso-cursive" ];
 
-  nativeBuildInputs = [ pkg-config gpgme python3 ];
+  nativeBuildInputs = [ pkg-config gpgme python3 installShellFiles ];
   buildInputs = [
     ncurses openssl libgpgerror gpgme xorg.libxcb
   ] ++ lib.optionals stdenv.isDarwin [ AppKit Security ];
 
-  preFixup = ''
-    mkdir -p "$out/man/man1"
-    $out/bin/ripasso-man > $out/man/man1/ripasso-cursive.1
-    rm $out/bin/ripasso-man
+  preCheck = ''
+    export HOME=$TMPDIR
+  '';
+
+  postInstall = ''
+    installManPage target/man-page/cursive/ripasso-cursive.1
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/security/ripasso/fix-tests.patch b/pkgs/tools/security/ripasso/fix-tests.patch
index 433ff933b1f7..85b1714e5c29 100644
--- a/pkgs/tools/security/ripasso/fix-tests.patch
+++ b/pkgs/tools/security/ripasso/fix-tests.patch
@@ -1,35 +1,82 @@
-diff --git a/src/pass/test.rs b/src/pass/test.rs
-index c980a2f..2e6c8cc 100644
 --- a/src/pass/test.rs
-+++ b/src/pass/test.rs
-@@ -56,6 +56,7 @@ fn populate_password_list_small_repo() {
++++ a/src/pass/test.rs
+@@ -83,6 +83,7 @@
      base_path.pop();
      base_path.pop();
      base_path.pop();
 +    base_path.pop();
      base_path.push("testres");
  
-     let mut password_dir: PathBuf = base_path.clone();
-@@ -84,6 +85,7 @@ fn populate_password_list_repo_with_deleted_files() {
+     let home: PathBuf = base_path.clone();
+@@ -114,6 +115,7 @@
      base_path.pop();
      base_path.pop();
      base_path.pop();
 +    base_path.pop();
      base_path.push("testres");
  
-     let mut password_dir: PathBuf = base_path.clone();
-@@ -112,6 +114,7 @@ fn populate_password_list_directory_without_git() {
+     let home: PathBuf = base_path.clone();
+@@ -144,6 +146,7 @@
      base_path.pop();
      base_path.pop();
      base_path.pop();
 +    base_path.pop();
      base_path.push("testres");
  
-     let mut password_dir: PathBuf = base_path.clone();
-@@ -149,4 +152,4 @@ fn parse_signing_keys_empty() {
-     let result = PasswordStore::parse_signing_keys(&None).unwrap();
+     let home: PathBuf = base_path.clone();
+@@ -185,6 +188,7 @@
+     base_path.pop();
+     base_path.pop();
+     base_path.pop();
++    base_path.pop();
+     base_path.push("testres");
+ 
+     let home: PathBuf = base_path.clone();
+@@ -220,6 +224,7 @@
+     base_path.pop();
+     base_path.pop();
+     base_path.pop();
++    base_path.pop();
+     base_path.push("testres");
+ 
+     let home: PathBuf = base_path.clone();
+@@ -267,6 +272,7 @@
+     base_path.pop();
+     base_path.pop();
+     base_path.pop();
++    base_path.pop();
+     base_path.push("testres");
+ 
+     let home: PathBuf = base_path.clone();
+@@ -298,6 +304,7 @@
+     base_path.pop();
+     base_path.pop();
+     base_path.pop();
++    base_path.pop();
+     base_path.push("testres");
+ 
+     let home: PathBuf = base_path.clone();
+@@ -337,6 +344,7 @@
+     base_path.pop();
+     base_path.pop();
+     base_path.pop();
++    base_path.pop();
+     base_path.push("testres");
+ 
+     let home: PathBuf = base_path.clone();
+@@ -828,6 +836,7 @@
+     base_path.pop();
+     base_path.pop();
+     base_path.pop();
++    base_path.pop();
+     base_path.push("testres");
+ 
+     let home: PathBuf = base_path.clone();
+@@ -860,6 +869,7 @@
+     base_path.pop();
+     base_path.pop();
+     base_path.pop();
++    base_path.pop();
+     base_path.pop();
+     base_path.push("testres");
  
-     assert_eq!(result.len(), 0);
--}
-\ No newline at end of file
-+}

From 7073a3722fc0173da59012f751ea7192be03aa4f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B8rn=20Forsman?= <bjorn.forsman@gmail.com>
Date: Sat, 19 Jun 2021 19:22:56 +0200
Subject: [PATCH 115/416] gnomeExtensions.system-monitor: 2021-05-04 ->
 2021-06-19

Fixes crash when opening "Preferences" in NixOS with GNOME 40.

Closes #123260.
---
 pkgs/desktops/gnome/extensions/system-monitor/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/desktops/gnome/extensions/system-monitor/default.nix b/pkgs/desktops/gnome/extensions/system-monitor/default.nix
index d141ab9dcaa4..0a959de26819 100644
--- a/pkgs/desktops/gnome/extensions/system-monitor/default.nix
+++ b/pkgs/desktops/gnome/extensions/system-monitor/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-shell-extension-system-monitor";
-  version = "unstable-2021-05-04";
+  version = "unstable-2021-06-19";
 
   src = fetchFromGitHub {
     owner = "paradoxxxzero";
     repo = "gnome-shell-system-monitor-applet";
-    rev = "bc38ccf49ac0ffae0fc0436f3c2579fc86949f10";
-    sha256 = "0yb5sb2xv4m18a24h4daahnxgnlmbfa0rfzic0zs082qv1kfi5h8";
+    rev = "bece7be22352b81d3d81e64e18a385812851b8de";
+    sha256 = "08nnsg7z3cqk25hfgy4wm02hd2wpz13kig498kn4mf5f1q4hslmx";
   };
 
   buildInputs = [
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   patches = [
     (substituteAll {
       src = ./paths_and_nonexisting_dirs.patch;
-      clutter_path = gnome.mutter.libdir; # this should not be used in settings but 🤷‍♀️
+      clutter_path = gnome.mutter.libdir; # only needed for GNOME < 40.
       gtop_path = "${libgtop}/lib/girepository-1.0";
       glib_net_path = "${glib-networking}/lib/girepository-1.0";
     })

From 258b3b010ead090c6a1973d93a9cd3eb74ce82c4 Mon Sep 17 00:00:00 2001
From: Michael Lingelbach <m.j.lbach@gmail.com>
Date: Sat, 19 Jun 2021 11:25:37 -0700
Subject: [PATCH 116/416] zsh-powerlevel10k: update gitstatus version

---
 pkgs/shells/zsh/zsh-powerlevel10k/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/shells/zsh/zsh-powerlevel10k/default.nix b/pkgs/shells/zsh/zsh-powerlevel10k/default.nix
index c18a863c636e..0ed183ee437c 100644
--- a/pkgs/shells/zsh/zsh-powerlevel10k/default.nix
+++ b/pkgs/shells/zsh/zsh-powerlevel10k/default.nix
@@ -7,13 +7,13 @@ let
   # match gitstatus version with given `gitstatus_version`:
   # https://github.com/romkatv/powerlevel10k/blob/master/gitstatus/build.info
   gitstatus = pkgs.gitstatus.overrideAttrs (oldAtttrs: rec {
-    version = "1.3.1";
+    version = "1.5.1";
 
     src = fetchFromGitHub {
       owner = "romkatv";
       repo = "gitstatus";
       rev = "v${version}";
-      sha256 = "03zaywncds7pjrl07rvdf3fh39gnp2zfvgsf0afqwv317sgmgpzf";
+      sha256 = "1ffgh5826985phc8amvzl9iydvsnij5brh4gczfh201vfmw9d4hh";
     };
   });
 in

From 5e06828dff0fe6b97cc215826872788b55c77397 Mon Sep 17 00:00:00 2001
From: nicoo <nicoo@mur.at>
Date: Sat, 19 Jun 2021 21:11:28 +0200
Subject: [PATCH 117/416] factorio: Fix bug in update.py

Prior to this change, `update.py` fails with `KeyError: 'alpha'` when upstream
does not have a version in the `experimental` channel:

	./update.py --username XXXXXXXX --token "$(wl-paste)"
	Traceback (most recent call last):
	  File "./update.py", line 180, in <module>
	    app.run(main)
	  File "/nix/store/854z51wg8fj1s6ghxasp1xxx8khb3r8v-python3-3.8.9-env/lib/python3.8/site-packages/absl/app.py", line 303, in run
	    _run_main(main, args)
	  File "/nix/store/854z51wg8fj1s6ghxasp1xxx8khb3r8v-python3-3.8.9-env/lib/python3.8/site-packages/absl/app.py", line 251, in _run_main
	    sys.exit(main(argv))
	  File "./update.py", line 162, in main
	    new_our_versions = generate_our_versions(factorio_versions)
	  File "./update.py", line 92, in generate_our_versions
	    version = factorio_versions[release_channel.name][release_type.name]
	KeyError: 'alpha'

I chose to make it so that the versions in nixpkgs' `factorio-*` packages are
either experimental (when available) or stable, as this seems like the most
coherent approach
---
 pkgs/games/factorio/update.py | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/games/factorio/update.py b/pkgs/games/factorio/update.py
index b1cdce6b4aa1..3806ba3614f1 100755
--- a/pkgs/games/factorio/update.py
+++ b/pkgs/games/factorio/update.py
@@ -80,6 +80,12 @@ def fetch_versions() -> FactorioVersionsJSON:
 def generate_our_versions(factorio_versions: FactorioVersionsJSON) -> OurVersionJSON:
     rec_dd = lambda: defaultdict(rec_dd)
     output = rec_dd()
+
+    # Deal with times where there's no experimental version
+    for rc in RELEASE_CHANNELS:
+        if not factorio_versions[rc.name]:
+            factorio_versions[rc.name] = factorio_versions['stable']
+
     for system in SYSTEMS:
         for release_type in RELEASE_TYPES:
             for release_channel in RELEASE_CHANNELS:

From e5baf82e87ac9f2d5bd8c60f20f3021f0d7df79e Mon Sep 17 00:00:00 2001
From: nicoo <nicoo@mur.at>
Date: Sat, 19 Jun 2021 21:16:15 +0200
Subject: [PATCH 118/416] =?UTF-8?q?factorio:=201.1.34=20=E2=86=92=201.1.35?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/games/factorio/versions.json | 48 +++++++++++++++----------------
 1 file changed, 24 insertions(+), 24 deletions(-)

diff --git a/pkgs/games/factorio/versions.json b/pkgs/games/factorio/versions.json
index 29c2d6a7bb3f..b230d94cfa53 100644
--- a/pkgs/games/factorio/versions.json
+++ b/pkgs/games/factorio/versions.json
@@ -2,56 +2,56 @@
   "x86_64-linux": {
     "alpha": {
       "experimental": {
-        "name": "factorio_alpha_x64-1.1.34.tar.xz",
+        "name": "factorio_alpha_x64-1.1.35.tar.xz",
         "needsAuth": true,
-        "sha256": "1gba6ivxdhj8khk6kfja2nzvqbbjlq1gzk8vlb23mkzqcmf4gnqc",
+        "sha256": "1svjjpyffdrmll1b3icsrikfi4v2r1z6j7iqq0v36iq0zw7vw3bk",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.34/alpha/linux64",
-        "version": "1.1.34"
+        "url": "https://factorio.com/get-download/1.1.35/alpha/linux64",
+        "version": "1.1.35"
       },
       "stable": {
-        "name": "factorio_alpha_x64-1.1.34.tar.xz",
+        "name": "factorio_alpha_x64-1.1.35.tar.xz",
         "needsAuth": true,
-        "sha256": "1gba6ivxdhj8khk6kfja2nzvqbbjlq1gzk8vlb23mkzqcmf4gnqc",
+        "sha256": "1svjjpyffdrmll1b3icsrikfi4v2r1z6j7iqq0v36iq0zw7vw3bk",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.34/alpha/linux64",
-        "version": "1.1.34"
+        "url": "https://factorio.com/get-download/1.1.35/alpha/linux64",
+        "version": "1.1.35"
       }
     },
     "demo": {
       "experimental": {
-        "name": "factorio_demo_x64-1.1.30.tar.xz",
+        "name": "factorio_demo_x64-1.1.35.tar.xz",
         "needsAuth": false,
-        "sha256": "1b3na8xn9lhlvrsd6hxr130nf9p81s26n25a4qdgkczz6waysgjv",
+        "sha256": "0yqb4gf2avpxr4vwafws9pv74xyd9g84zggfikfc801ldc7sp29f",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.30/demo/linux64",
-        "version": "1.1.30"
+        "url": "https://factorio.com/get-download/1.1.35/demo/linux64",
+        "version": "1.1.35"
       },
       "stable": {
-        "name": "factorio_demo_x64-1.1.34.tar.xz",
+        "name": "factorio_demo_x64-1.1.35.tar.xz",
         "needsAuth": false,
-        "sha256": "1ld373lxfx1xbaqq394az8sxfxpjwkyqwwr77wbmg4sm2g9dinxm",
+        "sha256": "0yqb4gf2avpxr4vwafws9pv74xyd9g84zggfikfc801ldc7sp29f",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.34/demo/linux64",
-        "version": "1.1.34"
+        "url": "https://factorio.com/get-download/1.1.35/demo/linux64",
+        "version": "1.1.35"
       }
     },
     "headless": {
       "experimental": {
-        "name": "factorio_headless_x64-1.1.34.tar.xz",
+        "name": "factorio_headless_x64-1.1.35.tar.xz",
         "needsAuth": false,
-        "sha256": "0sfafdvfhhvxnhf7q23xnvckx8nihg5xzzc6dw39a3iprwhr75i1",
+        "sha256": "0xpiw89ad6cfpc576g5jpsyzwjncs3jrx01056p52wj01747fm94",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.34/headless/linux64",
-        "version": "1.1.34"
+        "url": "https://factorio.com/get-download/1.1.35/headless/linux64",
+        "version": "1.1.35"
       },
       "stable": {
-        "name": "factorio_headless_x64-1.1.34.tar.xz",
+        "name": "factorio_headless_x64-1.1.35.tar.xz",
         "needsAuth": false,
-        "sha256": "0sfafdvfhhvxnhf7q23xnvckx8nihg5xzzc6dw39a3iprwhr75i1",
+        "sha256": "0xpiw89ad6cfpc576g5jpsyzwjncs3jrx01056p52wj01747fm94",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.34/headless/linux64",
-        "version": "1.1.34"
+        "url": "https://factorio.com/get-download/1.1.35/headless/linux64",
+        "version": "1.1.35"
       }
     }
   }

From 1cce751a519df086e5fe34d13208cf864a65e6f6 Mon Sep 17 00:00:00 2001
From: Kira Bruneau <kira.bruneau@pm.me>
Date: Sat, 19 Jun 2021 10:52:06 -0400
Subject: [PATCH 119/416] mangohud: prefer wrapping with XDG_DATA_DIRS

`XDG_DATA_DIRS` is what's used by Vulkan-Loader to search for MangoHud
when installed.
---
 pkgs/tools/graphics/mangohud/default.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/tools/graphics/mangohud/default.nix b/pkgs/tools/graphics/mangohud/default.nix
index 98e60058abc4..a69f8775f3b5 100644
--- a/pkgs/tools/graphics/mangohud/default.nix
+++ b/pkgs/tools/graphics/mangohud/default.nix
@@ -116,8 +116,7 @@ stdenv.mkDerivation rec {
   # Support overlaying Vulkan applications without requiring mangohud to be installed
   postFixup = ''
     wrapProgram "$out/bin/mangohud" \
-      --prefix VK_LAYER_PATH : "$out/share/vulkan/implicit_layer.d" \
-      --prefix VK_INSTANCE_LAYERS : VK_LAYER_MANGOHUD_overlay
+      --prefix XDG_DATA_DIRS : "$out/share"
   '';
 
   meta = with lib; {

From 196dd6a2a782fc4ccae3b41dae0211daffc2f771 Mon Sep 17 00:00:00 2001
From: Alex M <alexmgit@protonmail.com>
Date: Sat, 19 Jun 2021 13:39:37 -0700
Subject: [PATCH 120/416] maintainers: add newam

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 8e18d02698e9..6877ac22f60d 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -7324,6 +7324,12 @@
     githubId = 17120571;
     name = "Xinhao Luo";
   };
+  newam = {
+    email = "alexmgit@protonmail.com";
+    github = "newAM";
+    githubId = 7845120;
+    name = "Alex M.";
+  };
   nikitavoloboev = {
     email = "nikita.voloboev@gmail.com";
     github = "nikitavoloboev";

From 839b933ef4ab91a39e66c62221af76c8139e0ed3 Mon Sep 17 00:00:00 2001
From: Kira Bruneau <kira.bruneau@pm.me>
Date: Sat, 19 Jun 2021 10:54:43 -0400
Subject: [PATCH 121/416] =?UTF-8?q?mangohud:=200.6.1=20=E2=86=92=200.6.3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/tools/graphics/mangohud/default.nix      | 43 +++++++++++++------
 .../mangohud/hardcode-dependencies.patch      | 12 +++---
 .../mangohud/opengl32-nix-workaround.patch    |  2 +-
 3 files changed, 37 insertions(+), 20 deletions(-)

diff --git a/pkgs/tools/graphics/mangohud/default.nix b/pkgs/tools/graphics/mangohud/default.nix
index a69f8775f3b5..1015b4cd1bd4 100644
--- a/pkgs/tools/graphics/mangohud/default.nix
+++ b/pkgs/tools/graphics/mangohud/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
+, fetchurl
 , substituteAll
 , coreutils
 , curl
@@ -9,7 +9,7 @@
 , glxinfo
 , gnugrep
 , gnused
-, pciutils
+, lsof
 , xdg-utils
 , dbus
 , hwdata
@@ -22,33 +22,49 @@
 , ninja
 , pkg-config
 , python3Packages
+, unzip
 , vulkan-loader
 , libXNVCtrl
 , wayland
 }:
 
-stdenv.mkDerivation rec {
+let
+  # Derived from subprojects/imgui.wrap
+  imgui = rec {
+    version = "1.81";
+    src = fetchFromGitHub {
+      owner = "ocornut";
+      repo = "imgui";
+      rev = "v${version}";
+      hash = "sha256-rRkayXk3xz758v6vlMSaUu5fui6NR8Md3njhDB0gJ18=";
+    };
+    patch = fetchurl {
+      url = "https://wrapdb.mesonbuild.com/v2/imgui_${version}-1/get_patch";
+      hash = "sha256-bQC0QmkLalxdj4mDEdqvvOFtNwz2T1MpTDuMXGYeQ18=";
+    };
+  };
+in stdenv.mkDerivation rec {
   pname = "mangohud";
-  version = "0.6.1";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "flightlessmango";
     repo = "MangoHud";
     rev = "v${version}";
-    sha256 = "1bzfp37qrx9kk5zaq7sfisgkyccwnxd7i3b1l0blfcy2lrxgx0n6";
+    sha256 = "wL+/wAqvVFph1QzuXPBbSEFjs33VA0S6euNWr/1J1Mk=";
     fetchSubmodules = true;
   };
 
   outputs = [ "out" "doc" "man" ];
 
-  patches = [
-    # Adds option to specify Vulkan's datadir when it's not the same as MangoHud's
-    # See https://github.com/flightlessmango/MangoHud/pull/522
-    (fetchpatch {
-      url = "https://github.com/flightlessmango/MangoHud/commit/56682985d8cec711af7ad0841888a44099249b1b.patch";
-      sha256 = "0l5vb374lfgfh54jiy4097bzsccpv4zsl1fdhn55sxggklymcad8";
-    })
+  # Unpack subproject sources
+  postUnpack = ''(
+    cd "$sourceRoot/subprojects"
+    cp -R --no-preserve=mode,ownership ${imgui.src} imgui-${imgui.version}
+    unzip ${imgui.patch}
+  )'';
 
+  patches = [
     # Hard code dependencies. Can't use makeWrapper since the Vulkan
     # layer can be used without the mangohud executable by setting MANGOHUD=1.
     (substituteAll {
@@ -61,7 +77,7 @@ stdenv.mkDerivation rec {
         glxinfo
         gnugrep
         gnused
-        pciutils
+        lsof
         xdg-utils
       ];
 
@@ -96,6 +112,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3Packages.Mako
     python3Packages.python
+    unzip
     vulkan-loader
   ];
 
diff --git a/pkgs/tools/graphics/mangohud/hardcode-dependencies.patch b/pkgs/tools/graphics/mangohud/hardcode-dependencies.patch
index bdebcdca9821..2ee5e2dd5477 100644
--- a/pkgs/tools/graphics/mangohud/hardcode-dependencies.patch
+++ b/pkgs/tools/graphics/mangohud/hardcode-dependencies.patch
@@ -1,9 +1,9 @@
 diff --git a/src/dbus.cpp b/src/dbus.cpp
-index 0acccc3..7dd7c49 100644
+index 44ffafc..9baf57b 100644
 --- a/src/dbus.cpp
 +++ b/src/dbus.cpp
-@@ -157,7 +157,7 @@ bool dbus_manager::init(const std::string& requested_player) {
-         m_requested_player = "org.mpris.MediaPlayer2." + requested_player;
+@@ -162,7 +162,7 @@ bool dbus_manager::init(const std::string& requested_player) {
+         return true;
      }
  
 -    if (!m_dbus_ldr.IsLoaded() && !m_dbus_ldr.Load("libdbus-1.so.3")) {
@@ -22,11 +22,11 @@ index 25c65bf..87488d5 100644
 -std::shared_ptr<libx11_loader> g_x11(new libx11_loader("libX11.so.6"));
 +std::shared_ptr<libx11_loader> g_x11(new libx11_loader("@libX11@/lib/libX11.so.6"));
 diff --git a/src/logging.cpp b/src/logging.cpp
-index f2c4271..d33e793 100644
+index ee8600b..c7c91a0 100644
 --- a/src/logging.cpp
 +++ b/src/logging.cpp
-@@ -17,7 +17,10 @@ string exec(string command) {
-    string result = "";
+@@ -19,7 +19,10 @@ string exec(string command) {
+ #ifdef __gnu_linux__
  
     // Open pipe to file
 +   char* originalPath = getenv("PATH");
diff --git a/pkgs/tools/graphics/mangohud/opengl32-nix-workaround.patch b/pkgs/tools/graphics/mangohud/opengl32-nix-workaround.patch
index 3c0f6908617f..4c6561180a13 100644
--- a/pkgs/tools/graphics/mangohud/opengl32-nix-workaround.patch
+++ b/pkgs/tools/graphics/mangohud/opengl32-nix-workaround.patch
@@ -1,5 +1,5 @@
 diff --git a/bin/mangohud.in b/bin/mangohud.in
-index eadce2d..e7b1aa4 100755
+index 8ec21de..f65304a 100755
 --- a/bin/mangohud.in
 +++ b/bin/mangohud.in
 @@ -23,6 +23,6 @@ fi

From 58a3fd2a9e3473fcbae1e7ab1af6f1c950e39ecc Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 19 Jun 2021 23:18:35 +0200
Subject: [PATCH 122/416] python3Packages.restfly: 1.3.5 -> 1.4.0

---
 pkgs/development/python-modules/restfly/default.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/restfly/default.nix b/pkgs/development/python-modules/restfly/default.nix
index b572b0a385d1..126ff8f22880 100644
--- a/pkgs/development/python-modules/restfly/default.nix
+++ b/pkgs/development/python-modules/restfly/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "restfly";
-  version = "1.3.5";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "stevemcgrath";
     repo = pname;
     rev = version;
-    sha256 = "0cq07wj6g3kg7i4qyjp3n3pv13k9p4p43rd6kn139wsn1mh8fr56";
+    sha256 = "0cmx15i57cxqw7naz8nkpqjckd6lpd2vszrkl82hvnajdimcd9wy";
   };
 
   propagatedBuildInputs = [
@@ -32,6 +32,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # Test requires network access
+    "test_session_ssl_error"
+  ];
+
   pythonImportsCheck = [ "restfly" ];
 
   meta = with lib; {

From 94a601eee12d55019f51f0b4b669093571dea541 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 19 Jun 2021 23:32:13 +0200
Subject: [PATCH 123/416] snallygaster: 0.0.9 -> 0.0.10

---
 pkgs/tools/security/snallygaster/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/security/snallygaster/default.nix b/pkgs/tools/security/snallygaster/default.nix
index 36ea37edbb9a..e77743d86480 100644
--- a/pkgs/tools/security/snallygaster/default.nix
+++ b/pkgs/tools/security/snallygaster/default.nix
@@ -5,13 +5,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "snallygaster";
-  version = "0.0.9";
+  version = "0.0.10";
 
   src = fetchFromGitHub {
     owner = "hannob";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1gan5asgrxdgfi9lalhxzj3vs7nkazi8nqia36bpz1qb5fz7jrx3";
+    sha256 = "1xd483sl94zhs7yhc52s0zrn3pj7vf5izggp4ap1d2j0lbwwcyka";
   };
 
   propagatedBuildInputs = with python3Packages; [

From 4e6e9adcd4746534b2cbc40ecde6db016607ebd4 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Sat, 19 Jun 2021 23:40:47 +0200
Subject: [PATCH 124/416] thunderbird: pass gnupg to passthru.updateScript

this fixes the tarball job
---
 .../applications/networking/mailreaders/thunderbird/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/mailreaders/thunderbird/default.nix b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
index 8e28190fea4c..00c6b5cbf27a 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
@@ -335,7 +335,7 @@ stdenv.mkDerivation rec {
     attrPath = "thunderbird-78";
     baseUrl = "http://archive.mozilla.org/pub/thunderbird/releases/";
     inherit writeScript lib common-updater-scripts xidel coreutils gnused
-      gnugrep curl runtimeShell;
+      gnugrep gnupg curl runtimeShell;
   };
 
   requiredSystemFeatures = [ "big-parallel" ];

From bcfc598b14d70303896e46ec2883bd50ac32cf1d Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 20 Jun 2021 00:27:33 +0200
Subject: [PATCH 125/416] python3Packages.influxdb-client: 1.17.0 -> 1.18.0

---
 pkgs/development/python-modules/influxdb-client/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/influxdb-client/default.nix b/pkgs/development/python-modules/influxdb-client/default.nix
index 38f6f58910db..21e614d7d7c9 100644
--- a/pkgs/development/python-modules/influxdb-client/default.nix
+++ b/pkgs/development/python-modules/influxdb-client/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "influxdb-client";
-  version = "1.17.0";
+  version = "1.18.0";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "influxdata";
     repo = "influxdb-client-python";
     rev = "v${version}";
-    sha256 = "1xxg8z9zambbhr7nmxhmvmiwkd4578zxr6rl2vhdh2w77idsw29z";
+    sha256 = "0xgp1wxdfa4y316dfkpmj38chlh68mndr8kqphckpnw16qxsl3d9";
   };
 
   propagatedBuildInputs = [

From c8b99cd191de6d390939e8e6be12dbb36c342dcc Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 20 Jun 2021 00:33:58 +0200
Subject: [PATCH 126/416] python3Packages.aiohue: 2.5.0 -> 2.5.1

---
 pkgs/development/python-modules/aiohue/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiohue/default.nix b/pkgs/development/python-modules/aiohue/default.nix
index 7072e9249dab..641dd4ffa4ff 100644
--- a/pkgs/development/python-modules/aiohue/default.nix
+++ b/pkgs/development/python-modules/aiohue/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "aiohue";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-4q5JvkUmEoOomcwblXhvB/5Qdr6aMR0lDb4t4bjDjw8=";
+    sha256 = "01ywyiwqa7nyd4kprqxcycv50xydsi95q3lzidpm2r3kn1byis1y";
   };
 
   propagatedBuildInputs = [

From d6db5094f819b94ae18ab38f2d6d3ba79f450cd9 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 20 Jun 2021 00:47:10 +0200
Subject: [PATCH 127/416] python3Packages.feedparser: 6.0.2 -> 6.0.6

---
 pkgs/development/python-modules/feedparser/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/feedparser/default.nix b/pkgs/development/python-modules/feedparser/default.nix
index 38e9761952d6..bf921207fc5c 100644
--- a/pkgs/development/python-modules/feedparser/default.nix
+++ b/pkgs/development/python-modules/feedparser/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "feedparser";
-  version = "6.0.2";
+  version = "6.0.6";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1b00a105425f492f3954fd346e5b524ca9cef3a4bbf95b8809470e9857aa1074";
+    sha256 = "1syd15460a6m397rajdpbr9q0hgxm1j6xf9ba18z9pighxdjmxkq";
   };
 
   propagatedBuildInputs = [ sgmllib3k ];

From 0bf03aee8985c2c56a8a61ed790790246a43b920 Mon Sep 17 00:00:00 2001
From: Kira Bruneau <kira.bruneau@pm.me>
Date: Sat, 19 Jun 2021 19:10:46 -0400
Subject: [PATCH 128/416] mangohud: support Nvidia cards by adding OpenGL path

---
 pkgs/tools/graphics/mangohud/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/tools/graphics/mangohud/default.nix b/pkgs/tools/graphics/mangohud/default.nix
index 1015b4cd1bd4..c73a95057c5c 100644
--- a/pkgs/tools/graphics/mangohud/default.nix
+++ b/pkgs/tools/graphics/mangohud/default.nix
@@ -26,6 +26,7 @@
 , vulkan-loader
 , libXNVCtrl
 , wayland
+, addOpenGLRunpath
 }:
 
 let
@@ -130,9 +131,11 @@ in stdenv.mkDerivation rec {
       "$out/share/vulkan/implicit_layer.d/MangoHud.x86.json"
   '';
 
-  # Support overlaying Vulkan applications without requiring mangohud to be installed
+  # Support Nvidia cards by adding OpenGL path and support overlaying
+  # Vulkan applications without requiring MangoHud to be installed
   postFixup = ''
     wrapProgram "$out/bin/mangohud" \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ addOpenGLRunpath.driverLink ]} \
       --prefix XDG_DATA_DIRS : "$out/share"
   '';
 

From d8a76e3dc16ba60f1e0ac0250a860f7a41ce0588 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 20 Jun 2021 00:43:26 +0200
Subject: [PATCH 129/416] python3Packages.python-gitlab: 2.7.1 -> 2.8.0

---
 pkgs/development/python-modules/python-gitlab/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-gitlab/default.nix b/pkgs/development/python-modules/python-gitlab/default.nix
index b3cb9aaff633..4d7f7a289cb5 100644
--- a/pkgs/development/python-modules/python-gitlab/default.nix
+++ b/pkgs/development/python-modules/python-gitlab/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "python-gitlab";
-  version = "2.7.1";
+  version = "2.8.0";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0z4amj5xhx5zc3h2m0zrkardm3z5ba9qpjx5n6dczyz77r527yg1";
+    sha256 = "0081jgjgqi4mqpr436ivw2q571hxi3hv2pa8d0z0nfl13s6lldpk";
   };
 
   propagatedBuildInputs = [

From 6a8342b2a4d294082d8918de4308c2035b56a3fe Mon Sep 17 00:00:00 2001
From: Ethan Edwards <ethan@ethancedwards.com>
Date: Sat, 19 Jun 2021 19:05:44 -0400
Subject: [PATCH 130/416] truecrack: init at 3.6

---
 pkgs/tools/security/truecrack/default.nix | 40 +++++++++++++++++++++++
 pkgs/top-level/all-packages.nix           |  3 ++
 2 files changed, 43 insertions(+)
 create mode 100644 pkgs/tools/security/truecrack/default.nix

diff --git a/pkgs/tools/security/truecrack/default.nix b/pkgs/tools/security/truecrack/default.nix
new file mode 100644
index 000000000000..cf64b234c66f
--- /dev/null
+++ b/pkgs/tools/security/truecrack/default.nix
@@ -0,0 +1,40 @@
+{ lib, gccStdenv, fetchFromGitLab, cudatoolkit
+, cudaSupport ? false
+, pkg-config }:
+
+gccStdenv.mkDerivation rec {
+  pname = "truecrack";
+  version = "3.6";
+
+  src = fetchFromGitLab {
+    owner = "kalilinux";
+    repo = "packages/truecrack";
+    rev = "debian/${version}+git20150326-0kali1";
+    sha256 = "+Rw9SfaQtO1AJO6UVVDMCo8DT0dYEbv7zX8SI+pHCRQ=";
+  };
+
+  configureFlags = (if cudaSupport then [
+    "--with-cuda=${cudatoolkit}"
+  ] else [
+    "--enable-cpu"
+  ]);
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = lib.optionals cudaSupport [
+    cudatoolkit
+  ];
+
+  installFlags = [ "prefix=$(out)" ];
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    description = "TrueCrack is a brute-force password cracker for TrueCrypt volumes. It works on Linux and it is optimized for Nvidia Cuda technology.";
+    homepage = "https://gitlab.com/kalilinux/packages/truecrack";
+    license = licenses.gpl3Plus;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ ethancedwards8 ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 40be91d9a71a..b321ff912ae9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9758,6 +9758,9 @@ in
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
+  truecrack = callPackage ../tools/security/truecrack { };
+  truecrack-cuda = truecrack.override { cudaSupport = true; };
+
   ts = callPackage ../tools/system/ts { };
 
   transfig = callPackage ../tools/graphics/transfig {

From 11e54b17d23f2af09733918d2383e10df590d4b4 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 20 Jun 2021 03:27:30 +0200
Subject: [PATCH 131/416] tts: 0.0.15 -> 0.0.15.1

---
 pkgs/tools/audio/tts/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/audio/tts/default.nix b/pkgs/tools/audio/tts/default.nix
index 7be8c62c8341..0e57e19a2883 100644
--- a/pkgs/tools/audio/tts/default.nix
+++ b/pkgs/tools/audio/tts/default.nix
@@ -12,20 +12,20 @@
 #
 # If you upgrade from an old version you may have to delete old models from ~/.local/share/tts
 # Also note that your tts version might not support all available models so check:
-#   https://github.com/coqui-ai/TTS/releases/tag/v0.0.15
+#   https://github.com/coqui-ai/TTS/releases/tag/v0.0.15.1
 #
 # For now, for deployment check the systemd unit in the pull request:
 #   https://github.com/NixOS/nixpkgs/pull/103851#issue-521121136
 
 python3Packages.buildPythonApplication rec {
   pname = "tts";
-  version = "0.0.15";
+  version = "0.0.15.1";
 
   src = fetchFromGitHub {
     owner = "coqui-ai";
     repo = "TTS";
     rev = "v${version}";
-    sha256 = "0pbzkjk2hncj22xh5lq5anlnvzkpfa7nxr1s2p6hshpln3mqjqs7";
+    sha256 = "0z6sbzspgmw5ja8r2zysyhdk4jzlv88a0ihkvxvvwxslkyncdb89";
   };
 
   postPatch = ''

From 9b99ebe6850639b8b774669d9b644fb6bd9a852b Mon Sep 17 00:00:00 2001
From: urlordjames <urlordjames@gmail.com>
Date: Fri, 18 Jun 2021 22:19:53 -0400
Subject: [PATCH 132/416] drogon: 1.6.0 -> 1.7.0

---
 pkgs/development/libraries/drogon/default.nix | 21 +++++-----
 .../libraries/drogon/fix_find_package.patch   | 13 ++++++
 .../libraries/drogon/no_cmake_test.patch      | 42 -------------------
 3 files changed, 24 insertions(+), 52 deletions(-)
 create mode 100644 pkgs/development/libraries/drogon/fix_find_package.patch
 delete mode 100644 pkgs/development/libraries/drogon/no_cmake_test.patch

diff --git a/pkgs/development/libraries/drogon/default.nix b/pkgs/development/libraries/drogon/default.nix
index 8234891046da..ebb989c94035 100644
--- a/pkgs/development/libraries/drogon/default.nix
+++ b/pkgs/development/libraries/drogon/default.nix
@@ -1,41 +1,42 @@
-{ stdenv, fetchFromGitHub, cmake, jsoncpp, libuuid, zlib, openssl, lib }:
+{ stdenv, fetchFromGitHub, cmake, jsoncpp, libossp_uuid, zlib, openssl, lib }:
 
 stdenv.mkDerivation rec {
   pname = "drogon";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "an-tao";
     repo = "drogon";
     rev = "v${version}";
-    sha256 = "0ncdlsi3zhmpdwh83d52npb1b2q982y858yl88zl2nfq4zhcm3wa";
+    sha256 = "18wn9ashv3h3pal6x5za6y7byfcrd49zy3wfx4hx0ygxzplmss0r";
     fetchSubmodules = true;
   };
 
   nativeBuildInputs = [ cmake ];
 
   cmakeFlags = [
-    # examples are used in the test during installCheckPhase, otherwise they are unnecessary
-    "-DBUILD_EXAMPLES=${if doInstallCheck then "ON" else "OFF"}"
+    "-DBUILD_TESTING=${if doInstallCheck then "ON" else "OFF"}"
+    "-DBUILD_EXAMPLES=OFF"
   ];
 
   propagatedBuildInputs = [
     jsoncpp
-    libuuid
+    libossp_uuid
     zlib
     openssl
   ];
 
   patches = [
-    # this part of the test fails because it attempts to configure a CMake project that uses find_package on itself
-    # the rest of the test runs fine because it uses executables that are built in buildPhase when BUILD_EXAMPLES is enabled
-    ./no_cmake_test.patch
+    # this part of the test would normally fail because it attempts to configure a CMake project that uses find_package on itself
+    # this patch makes drogon and trantor visible to the test
+    ./fix_find_package.patch
   ];
 
+  # modifying PATH here makes drogon_ctl visible to the test
   installCheckPhase = ''
     cd ..
     patchShebangs test.sh
-    ./test.sh
+    PATH=$PATH:$out/bin ./test.sh
   '';
 
   doInstallCheck = true;
diff --git a/pkgs/development/libraries/drogon/fix_find_package.patch b/pkgs/development/libraries/drogon/fix_find_package.patch
new file mode 100644
index 000000000000..b76dbfe48830
--- /dev/null
+++ b/pkgs/development/libraries/drogon/fix_find_package.patch
@@ -0,0 +1,13 @@
+diff --git a/test.sh b/test.sh
+index f017b9a..027031e 100755
+--- a/test.sh
++++ b/test.sh
+@@ -135,7 +135,7 @@ if [ $os = "windows" ]; then
+   conan install $src_dir -s compiler="Visual Studio" -s compiler.version=16 -sbuild_type=Debug -g cmake_paths
+   cmake_gen="$cmake_gen -DCMAKE_TOOLCHAIN_FILE=conan_paths.cmake -DCMAKE_INSTALL_PREFIX=$src_dir/install"
+ fi
+-cmake .. $cmake_gen
++cmake .. $cmake_gen -DDrogon_DIR=$out/lib/cmake/Drogon -DTrantor_DIR=$out/lib/cmake/Trantor
+ 
+ if [ $? -ne 0 ]; then
+     echo "Failed to run CMake for example project"
diff --git a/pkgs/development/libraries/drogon/no_cmake_test.patch b/pkgs/development/libraries/drogon/no_cmake_test.patch
deleted file mode 100644
index 8d38fbf44b70..000000000000
--- a/pkgs/development/libraries/drogon/no_cmake_test.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-diff --git a/test.sh b/test.sh
-index e5da08e..ba620cc 100755
---- a/test.sh
-+++ b/test.sh
-@@ -157,37 +157,6 @@ cd ../views
- 
- echo "Hello, world!" >>hello.csp
- 
--cd ../build
--if [ $os = "windows" ]; then
--  conan install $src_dir -s compiler="Visual Studio" -s compiler.version=16 -sbuild_type=Debug -g cmake_paths
--  cmake_gen="$cmake_gen -DCMAKE_TOOLCHAIN_FILE=conan_paths.cmake -DCMAKE_INSTALL_PREFIX=$src_dir/install"
--fi
--cmake .. $cmake_gen
--
--if [ $? -ne 0 ]; then
--    echo "Error in testing"
--    exit -1
--fi
--
--cmake --build . -- $make_flags
--
--if [ $? -ne 0 ]; then
--    echo "Error in testing"
--    exit -1
--fi
--
--if [ $os = "linux" ]; then
--  if [ ! -f "drogon_test" ]; then
--      echo "Failed to build drogon_test"
--      exit -1
--  fi
--else
--  if [ ! -f "Debug\drogon_test.exe" ]; then
--      echo "Failed to build drogon_test"
--      exit -1
--  fi
--fi
--
- cd ../../
- rm -rf drogon_test
- 

From eea1f9c48eb1a5a86ce855b2ebc33001671e63d9 Mon Sep 17 00:00:00 2001
From: Eduardo Quiros <eduardo@eduardoquiros.com>
Date: Sat, 19 Jun 2021 21:12:10 -0600
Subject: [PATCH 133/416] lf: 23 -> 24

---
 pkgs/tools/misc/lf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/misc/lf/default.nix b/pkgs/tools/misc/lf/default.nix
index b268b170ebbf..8aa8e9a663b7 100644
--- a/pkgs/tools/misc/lf/default.nix
+++ b/pkgs/tools/misc/lf/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "lf";
-  version = "23";
+  version = "24";
 
   src = fetchFromGitHub {
     owner = "gokcehan";
     repo = "lf";
     rev = "r${version}";
-    sha256 = "sha256-rwKTumletIN4OzvA2VzYh++vioUftvtKYAZoaEL5P7U=";
+    sha256 = "0nc7vfkaxxl2a201wnbz74an3siz8cjwrfylx17v6al5n93vxip0";
   };
 
   vendorSha256 = "sha256-ujQh4aE++K/fn3PJqkAbTtwRyJPSI9TJQ1DvwLF9etU=";

From 24c69ece8ed04b4877e5dc12b2782f8e693d5254 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nguy=E1=BB=85n=20Gia=20Phong?= <mcsinyx@disroot.org>
Date: Sun, 20 Jun 2021 12:00:49 +0700
Subject: [PATCH 134/416] moarvm: 2021.05 -> 2021.06

---
 pkgs/development/interpreters/rakudo/moarvm.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/interpreters/rakudo/moarvm.nix b/pkgs/development/interpreters/rakudo/moarvm.nix
index 0dbe0f5d97e3..60a5e071545e 100644
--- a/pkgs/development/interpreters/rakudo/moarvm.nix
+++ b/pkgs/development/interpreters/rakudo/moarvm.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "moarvm";
-  version = "2021.05";
+  version = "2021.06";
 
   src = fetchurl {
-    url = "https://www.moarvm.org/releases/MoarVM-${version}.tar.gz";
-    sha256 = "15x8lra3k7lpcisfxvrrz3jqp2dilfrwgqzxkknwlfsfcrw8fk5i";
+    url = "https://moarvm.org/releases/MoarVM-${version}.tar.gz";
+    sha256 = "19vjcyb9fg9msjw1ih00c2qby480gl4highw24zx7j84slhsj013";
    };
 
   buildInputs = [ perl ] ++ lib.optionals stdenv.isDarwin [ CoreServices ApplicationServices ];
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "VM with adaptive optimization and JIT compilation, built for Rakudo";
-    homepage    = "https://www.moarvm.org/";
+    homepage    = "https://moarvm.org";
     license     = licenses.artistic2;
     platforms   = platforms.unix;
     maintainers = with maintainers; [ thoughtpolice vrthra sgo ];

From e9243d399078a362fb13cbb251a600f5970f05b7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nguy=E1=BB=85n=20Gia=20Phong?= <mcsinyx@disroot.org>
Date: Sun, 20 Jun 2021 12:01:03 +0700
Subject: [PATCH 135/416] nqp: 2021.05 -> 2021.06

---
 pkgs/development/interpreters/rakudo/nqp.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/rakudo/nqp.nix b/pkgs/development/interpreters/rakudo/nqp.nix
index 317a8226852e..4b456d819f6d 100644
--- a/pkgs/development/interpreters/rakudo/nqp.nix
+++ b/pkgs/development/interpreters/rakudo/nqp.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nqp";
-  version = "2021.05";
+  version = "2021.06";
 
   src = fetchurl {
     url    = "https://github.com/raku/nqp/releases/download/${version}/nqp-${version}.tar.gz";
-    sha256 = "0gzpzzvqs3xar5657yx07hsvqn3xckdfvq9jw73qfccbbb9gjg5l";
+    sha256 = "1d00lajjdd2k510fb0cb6c8bpklvlnncykf6jz8j8djfp0b2i696";
   };
 
   buildInputs = [ perl ];

From c4b95abcb3664bc5378f0b9cebbc0fa0bf508881 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nguy=E1=BB=85n=20Gia=20Phong?= <mcsinyx@disroot.org>
Date: Sun, 20 Jun 2021 12:01:26 +0700
Subject: [PATCH 136/416] rakudo: 2021.05 -> 2021.06

---
 pkgs/development/interpreters/rakudo/default.nix | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/interpreters/rakudo/default.nix b/pkgs/development/interpreters/rakudo/default.nix
index 1b2655fe7712..3d9d0b7e1346 100644
--- a/pkgs/development/interpreters/rakudo/default.nix
+++ b/pkgs/development/interpreters/rakudo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rakudo";
-  version = "2021.05";
+  version = "2021.06";
 
   src = fetchurl {
-    url    = "https://www.rakudo.org/dl/rakudo/rakudo-${version}.tar.gz";
-    sha256 = "0h9kdb4vvscflifmclx0zhwb5qfakiggnbvlf9cx2hmp5vnk71jk";
+    url    = "https://rakudo.org/dl/rakudo/rakudo-${version}.tar.gz";
+    sha256 = "11ixlqmvbb37abksdysg5r4lkbwzr486lkc0ssl3wca4iiy3mhgf";
   };
 
   buildInputs = [ icu zlib gmp perl ];
@@ -16,15 +16,9 @@ stdenv.mkDerivation rec {
     "--with-nqp=${nqp}/bin/nqp"
   ];
 
-  # Remove test of profiler, fails since 2020.09
-  preCheck = "rm t/09-moar/01-profilers.t";
-
-  # Some tests fail on Darwin
-  doCheck = !stdenv.isDarwin;
-
   meta = with lib; {
     description = "Raku implementation on top of Moar virtual machine";
-    homepage    = "https://www.rakudo.org";
+    homepage    = "https://rakudo.org";
     license     = licenses.artistic2;
     platforms   = platforms.unix;
     maintainers = with maintainers; [ thoughtpolice vrthra sgo ];

From 507d17e2c801d1ce66bddc2c9cfc01670a3176cb Mon Sep 17 00:00:00 2001
From: legendofmiracles <legendofmiracles@protonmail.com>
Date: Sat, 19 Jun 2021 05:08:37 -0600
Subject: [PATCH 137/416] noisetorch: 0.10.1 -> 0.11.3

---
 .../applications/audio/noisetorch/default.nix | 29 ++++++---------
 .../audio/noisetorch/version.patch            | 37 -------------------
 2 files changed, 11 insertions(+), 55 deletions(-)
 delete mode 100644 pkgs/applications/audio/noisetorch/version.patch

diff --git a/pkgs/applications/audio/noisetorch/default.nix b/pkgs/applications/audio/noisetorch/default.nix
index 6f63bf542f41..05e17bf7c98a 100644
--- a/pkgs/applications/audio/noisetorch/default.nix
+++ b/pkgs/applications/audio/noisetorch/default.nix
@@ -1,42 +1,35 @@
-{ lib, buildGoModule, fetchFromGitHub, rnnoise-plugin }:
+{ lib, buildGoModule, fetchFromGitHub, copyDesktopItems }:
 
 buildGoModule rec {
   pname = "NoiseTorch";
-  version = "0.10.1";
+  version = "0.11.3";
 
   src = fetchFromGitHub {
     owner = "lawl";
     repo = "NoiseTorch";
     rev = version;
-    sha256 = "1a4g112h83m55pga8kq2a1wzxpycj59v4bygyjfyi1s09q1y97qg";
+    sha256 = "0rjs6hbi7dvd179lzjmvqy4rv4pbc9amgzb8jfky4yc0zh8xf5z5";
   };
 
-  patches = [
-    # Get version from environment instead of git tags
-    ./version.patch
-  ];
-
   vendorSha256 = null;
 
   doCheck = false;
 
+  ldflags = [ "-X main.version=${version}"  "-X main.distribution=nix" ];
+
   subPackages = [ "." ];
 
-  buildInputs = [ rnnoise-plugin ];
-
-  postPatch = "substituteInPlace main.go --replace 'librnnoise_ladspa/bin/ladspa/librnnoise_ladspa.so' '$RNNOISE_LADSPA_PLUGIN'";
+  nativeBuildInputs = [ copyDesktopItems ];
 
   preBuild = ''
-    export RNNOISE_LADSPA_PLUGIN="${rnnoise-plugin}/lib/ladspa/librnnoise_ladspa.so";
-    go generate;
+    make -C c/ladspa/
+    go generate
     rm  ./scripts/*
   '';
 
   postInstall = ''
-    mkdir -p $out/share/icons/hicolor/256x256/apps/
-    cp assets/icon/noisetorch.png $out/share/icons/hicolor/256x256/apps/
-    mkdir -p $out/share/applications/
-    cp assets/noisetorch.desktop $out/share/applications/
+    install -D ./assets/icon/noisetorch.png $out/share/icons/hicolor/256x256/apps/noisetorch.png
+    copyDesktopItems assets/noisetorch.desktop $out/share/applications/
   '';
 
   meta = with lib; {
@@ -44,6 +37,6 @@ buildGoModule rec {
     homepage = "https://github.com/lawl/NoiseTorch";
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ panaeon ];
+    maintainers = with maintainers; [ panaeon legendofmiracles ];
   };
 }
diff --git a/pkgs/applications/audio/noisetorch/version.patch b/pkgs/applications/audio/noisetorch/version.patch
deleted file mode 100644
index 20c51863744a..000000000000
--- a/pkgs/applications/audio/noisetorch/version.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-diff --git a/scripts/embedversion.go b/scripts/embedversion.go
-index ce0a756..60e7a5e 100644
---- a/scripts/embedversion.go
-+++ b/scripts/embedversion.go
-@@ -1,24 +1,18 @@
- package main
- 
- import (
--	"os"
--	"os/exec"
--	"strings"
-+        "os"
-+        "strings"
- )
- 
- func main() {
--	cmd := exec.Command("git", "describe", "--tags")
--	ret, err := cmd.Output()
- 
--	if err != nil {
--		panic("Couldn't read git tags to embed version number")
--	}
--	version := strings.TrimSpace(string(ret))
-+        version := strings.TrimSpace(string(os.Getenv("version")))
- 
--	out, _ := os.Create("version.go")
--	defer out.Close()
-+        out, _ := os.Create("version.go")
-+        defer out.Close()
- 
--	out.Write([]byte("package main\n\n//THIS FILE IS AUTOMATICALLY GENERATED BY `go generate` DO NOT EDIT!\n\nvar version=\""))
--	out.Write([]byte(version))
--	out.Write([]byte("\"\n"))
-+        out.Write([]byte("package main\n\n//THIS FILE IS AUTOMATICALLY GENERATED BY `go generate` DO NOT EDIT!\n\nvar version=\""))
-+        out.Write([]byte(version))
-+        out.Write([]byte("\"\n"))
- }

From 5c024a41f572b67080639ce346c0d3bdf2897729 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sun, 20 Jun 2021 05:57:22 +0000
Subject: [PATCH 138/416] clipman: 1.5.2 -> 1.6.0

---
 pkgs/tools/wayland/clipman/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/wayland/clipman/default.nix b/pkgs/tools/wayland/clipman/default.nix
index 3a2c2ca6015c..d5ed6ae88ffe 100644
--- a/pkgs/tools/wayland/clipman/default.nix
+++ b/pkgs/tools/wayland/clipman/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "clipman";
-  version = "1.5.2";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "yory8";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1lf5fbzplyc1mpdqgfwbrn8m5568vhjf48580fvvfgbhz6zcil8n";
+    sha256 = "sha256-Yq71nYNL3bFvwhVzrQ1g8n7/4tMmLuYUJ9pMBmxL8e8=";
   };
 
-  vendorSha256 = "18jw4z0lcrh00yjr3qdkgvlrpfwqbsm0ncz7fp1h72pzkh41byv7";
+  vendorSha256 = "sha256-Z/sVCJz/igPDdeczC6pemLub6X6z4ZGlBwBmRsEnXKI=";
 
   doCheck = false;
 

From 06224c480ae3d7f631b07d162b707ce3f881a77c Mon Sep 17 00:00:00 2001
From: Vladyslav M <dywedir@gra.red>
Date: Sun, 20 Jun 2021 10:05:17 +0300
Subject: [PATCH 139/416] tiled: 1.5.0 -> 1.7.0

---
 pkgs/applications/editors/tiled/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/tiled/default.nix b/pkgs/applications/editors/tiled/default.nix
index 4fbbacf8f1eb..fe32da4a42fa 100644
--- a/pkgs/applications/editors/tiled/default.nix
+++ b/pkgs/applications/editors/tiled/default.nix
@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "tiled";
-  version = "1.5.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "bjorn";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Pf9nA5DUAJ+PPNG+oP7RO4/TD8fy4ADsyq625a6cbFk=";
+    sha256 = "sha256-XVIkyf9cQZXjFuGGCliCSY22X8EkoPEl1EpGCrMTsgY=";
   };
 
   nativeBuildInputs = [ pkg-config qmake ];

From ee10001517a509fcb3807182a0b448c5f833f9cc Mon Sep 17 00:00:00 2001
From: Robert Helgesson <robert@rycee.net>
Date: Sat, 19 Jun 2021 23:11:18 +0200
Subject: [PATCH 140/416] svtplay-dl: 3.9.1 -> 4.0

---
 pkgs/tools/misc/svtplay-dl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/misc/svtplay-dl/default.nix b/pkgs/tools/misc/svtplay-dl/default.nix
index ac8bd2c91c1b..0e91b9c0e562 100644
--- a/pkgs/tools/misc/svtplay-dl/default.nix
+++ b/pkgs/tools/misc/svtplay-dl/default.nix
@@ -8,13 +8,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "svtplay-dl";
-  version = "3.9.1";
+  version = "4.0";
 
   src = fetchFromGitHub {
     owner = "spaam";
     repo = "svtplay-dl";
     rev = version;
-    sha256 = "0b207l3dnkpixjhxzis77cfhwd5mjiwrmj8cngxpx2wl1i83xw54";
+    sha256 = "01q03v6a2rkw49z5nbm5mghm0qmmm12pq3amsiiiv5j6m9p0fdsy";
   };
 
   pythonPaths = [ cryptography pyyaml requests ];

From c1ae14f2fc20353dbe869f4e9128582c868e391b Mon Sep 17 00:00:00 2001
From: Robert Helgesson <robert@rycee.net>
Date: Sat, 19 Jun 2021 23:15:53 +0200
Subject: [PATCH 141/416] trash-cli: 0.21.5.22 -> 0.21.6.10.1

---
 pkgs/tools/misc/trash-cli/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/misc/trash-cli/default.nix b/pkgs/tools/misc/trash-cli/default.nix
index 3a525ac94972..ff218eb10844 100644
--- a/pkgs/tools/misc/trash-cli/default.nix
+++ b/pkgs/tools/misc/trash-cli/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "trash-cli";
-  version = "0.21.5.22";
+  version = "0.21.6.10.1";
 
   src = fetchFromGitHub {
     owner = "andreafrancia";
     repo = "trash-cli";
     rev = version;
-    sha256 = "0c1q13fyh9gi9gbxc55n772xlgjjr1ysnlxl41vifdcd4q8fhil8";
+    sha256 = "0mhpzf3vmd876aldl5gazmk4si0zvrh0v1rwsz2hbrn0571zmzy9";
   };
 
   propagatedBuildInputs = [ python3Packages.psutil ];

From b1b38d88baddf30dc5782173ee72b8d725f47f6e Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sun, 20 Jun 2021 08:30:29 +0000
Subject: [PATCH 142/416] golangci-lint: 1.41.0 -> 1.41.1

---
 pkgs/development/tools/golangci-lint/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/golangci-lint/default.nix b/pkgs/development/tools/golangci-lint/default.nix
index f4ff5dd2b946..32af811c0005 100644
--- a/pkgs/development/tools/golangci-lint/default.nix
+++ b/pkgs/development/tools/golangci-lint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "golangci-lint";
-  version = "1.41.0";
+  version = "1.41.1";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     rev = "v${version}";
-    sha256 = "sha256-ogH3L2EG0xdGpCaEfMUYnCWyFTGgx/C/O54mMxcJSBA=";
+    sha256 = "sha256-7xokU2uw7oiXhirTKuNfqJ143PlnI7M1zSixT0S6jtE=";
   };
 
-  vendorSha256 = "sha256-gYulktNetcgXk43Ydk4+WEMZMFCrmx6p5VnsFIJdQhk=";
+  vendorSha256 = "sha256-s0ZFQJIhF23FtLol1Gegljf6eyGkCmVxTKmHbQBtPvM=";
 
   doCheck = false;
 

From 6efcb19e7468ded3a3080384cf348ed30066b435 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 20 Jun 2021 10:38:50 +0200
Subject: [PATCH 143/416] python3Packages.pysml: init at 0.0.5

---
 .../python-modules/pysml/default.nix          | 37 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 39 insertions(+)
 create mode 100644 pkgs/development/python-modules/pysml/default.nix

diff --git a/pkgs/development/python-modules/pysml/default.nix b/pkgs/development/python-modules/pysml/default.nix
new file mode 100644
index 000000000000..1f08eb14180c
--- /dev/null
+++ b/pkgs/development/python-modules/pysml/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, async-timeout
+, bitstring
+, buildPythonPackage
+, fetchFromGitHub
+, pyserial-asyncio
+}:
+
+buildPythonPackage rec {
+  pname = "pysml";
+  version = "0.0.5";
+
+  src = fetchFromGitHub {
+    owner = "mtdcr";
+    repo = pname;
+    rev = version;
+    sha256 = "05zgrk49b2y5jflxnjww2kqg1flynl3j4ifm0jr28nk0li5wg2bs";
+  };
+
+  propagatedBuildInputs = [
+    async-timeout
+    bitstring
+    pyserial-asyncio
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "sml" ];
+
+  meta = with lib; {
+    description = "Python library for EDL21 smart meters using Smart Message Language (SML)";
+    homepage = "https://github.com/mtdcr/pysml";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d3c455f41fef..9b443c175e62 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6486,6 +6486,8 @@ in {
 
   pysmi = callPackage ../development/python-modules/pysmi { };
 
+  pysml = callPackage ../development/python-modules/pysml { };
+
   pysmt = callPackage ../development/python-modules/pysmt { };
 
   pysnmp = callPackage ../development/python-modules/pysnmp { };

From 831f12fe6ec3795fcf7c2d6e01ca6bbe16d3e9ff Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 20 Jun 2021 10:50:33 +0200
Subject: [PATCH 144/416] home-assistant: update component-packages

---
 pkgs/servers/home-assistant/component-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 62684b3c0ba3..a2bade359c47 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -208,7 +208,7 @@
     "ecovacs" = ps: with ps; [ ]; # missing inputs: sucks
     "eddystone_temperature" = ps: with ps; [ construct ]; # missing inputs: beacontools[scan]
     "edimax" = ps: with ps; [ pyedimax ];
-    "edl21" = ps: with ps; [ ]; # missing inputs: pysml
+    "edl21" = ps: with ps; [ pysml ];
     "ee_brightbox" = ps: with ps; [ eebrightbox ];
     "efergy" = ps: with ps; [ ];
     "egardia" = ps: with ps; [ pythonegardia ];

From cc604f2d90f8206acfd1cee9de16328d3b6eb7d9 Mon Sep 17 00:00:00 2001
From: Olli Helenius <liff@iki.fi>
Date: Sun, 20 Jun 2021 11:54:43 +0300
Subject: [PATCH 145/416] kafkacat: enable Avro message deserialization

kafkacat supports Avro message deserialization using the
Confluent Schema-Registry if libavro-c and libserdes are available.
---
 pkgs/development/tools/kafkacat/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/kafkacat/default.nix b/pkgs/development/tools/kafkacat/default.nix
index e297de7a0db0..5493bf24428d 100644
--- a/pkgs/development/tools/kafkacat/default.nix
+++ b/pkgs/development/tools/kafkacat/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, zlib, rdkafka, yajl }:
+{ lib, stdenv, fetchFromGitHub, pkg-config, zlib, rdkafka, yajl, avro-c, libserdes }:
 
 stdenv.mkDerivation rec {
   pname = "kafkacat";
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ zlib rdkafka yajl ];
+  buildInputs = [ zlib rdkafka yajl avro-c libserdes ];
 
   preConfigure = ''
     patchShebangs ./configure

From 19d39f5037ef1be652ade76002c0b794f080e992 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 20 Jun 2021 11:13:27 +0200
Subject: [PATCH 146/416] python3Packages.enturclient: init at 0.2.1

---
 .../python-modules/enturclient/default.nix    | 37 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 39 insertions(+)
 create mode 100644 pkgs/development/python-modules/enturclient/default.nix

diff --git a/pkgs/development/python-modules/enturclient/default.nix b/pkgs/development/python-modules/enturclient/default.nix
new file mode 100644
index 000000000000..8ac474b6e5f8
--- /dev/null
+++ b/pkgs/development/python-modules/enturclient/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, aiohttp
+, async-timeout
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "enturclient";
+  version = "0.2.1";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "hfurubotten";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "158xzv9c2drjgrdhfqm0xzx2d34v45gr5rnjfsi94scffvprgwrg";
+  };
+
+  propagatedBuildInputs = [
+    aiohttp
+    async-timeout
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "enturclient" ];
+
+  meta = with lib; {
+    description = "Python library for interacting with the Entur.org API";
+    homepage = "https://github.com/hfurubotten/enturclient";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d3c455f41fef..7266237236ad 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2287,6 +2287,8 @@ in {
 
   entrypoints = callPackage ../development/python-modules/entrypoints { };
 
+  enturclient = callPackage ../development/python-modules/enturclient { };
+
   enum34 = callPackage ../development/python-modules/enum34 { };
 
   enum-compat = callPackage ../development/python-modules/enum-compat { };

From 9c69513e1bb334c2a595b5cc1d4c38eb6fd802f3 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 20 Jun 2021 11:14:38 +0200
Subject: [PATCH 147/416] home-assistant: update component-packages

---
 pkgs/servers/home-assistant/component-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 62684b3c0ba3..c498bcec635b 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -227,7 +227,7 @@
     "enigma2" = ps: with ps; [ openwebifpy ];
     "enocean" = ps: with ps; [ enocean ];
     "enphase_envoy" = ps: with ps; [ envoy-reader ];
-    "entur_public_transport" = ps: with ps; [ ]; # missing inputs: enturclient
+    "entur_public_transport" = ps: with ps; [ enturclient ];
     "environment_canada" = ps: with ps; [ ]; # missing inputs: env_canada
     "envirophat" = ps: with ps; [ smbus-cffi ]; # missing inputs: envirophat
     "envisalink" = ps: with ps; [ pyenvisalink ];

From 74ea230729b38e0b016dbef09ec7002b955b1b0b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Milan=20P=C3=A4ssler?= <milan@petabyte.dev>
Date: Sat, 19 Jun 2021 20:12:12 +0200
Subject: [PATCH 148/416] sqlalchemy_1_3: init at 1.3.23

---
 .../python-modules/sqlalchemy/1.3.nix         | 45 +++++++++++++++++++
 .../sqlalchemy/{default.nix => 1.4.nix}       |  0
 pkgs/top-level/python-packages.nix            |  4 +-
 3 files changed, 48 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/development/python-modules/sqlalchemy/1.3.nix
 rename pkgs/development/python-modules/sqlalchemy/{default.nix => 1.4.nix} (100%)

diff --git a/pkgs/development/python-modules/sqlalchemy/1.3.nix b/pkgs/development/python-modules/sqlalchemy/1.3.nix
new file mode 100644
index 000000000000..f0c9ce2bf736
--- /dev/null
+++ b/pkgs/development/python-modules/sqlalchemy/1.3.nix
@@ -0,0 +1,45 @@
+{ stdenv, lib, fetchPypi, buildPythonPackage, isPy3k, isPy35, fetchpatch
+, mock
+, pysqlite ? null
+, pytestCheckHook
+, pytest_xdist
+}:
+
+buildPythonPackage rec {
+  pname = "SQLAlchemy";
+  version = "1.3.23";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "6fca33672578666f657c131552c4ef8979c1606e494f78cd5199742dfb26918b";
+  };
+
+  patches = [
+    # fix test_pyodbc_extra_connect_azure test failure
+    (fetchpatch {
+      url = "https://github.com/sqlalchemy/sqlalchemy/commit/7293b3dc0e9eb3dae84ffd831494b85355df8e73.patch";
+      sha256 = "1z61lzxamz74771ddlqmbxba1dcr77f016vqfcmb44dxb228w2db";
+    })
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+    mock
+  ] ++ lib.optional (!isPy3k) pysqlite;
+
+  postInstall = ''
+    sed -e 's:--max-worker-restart=5::g' -i setup.cfg
+  '';
+
+  dontUseSetuptoolsCheck = true;
+
+  # disable mem-usage tests on mac, has trouble serializing pickle files
+  disabledTests = lib.optionals isPy35 [ "exception_persistent_flush_py3k "]
+    ++ lib.optionals stdenv.isDarwin [ "MemUsageWBackendTest" "MemUsageTest" ];
+
+  meta = with lib; {
+    homepage = "http://www.sqlalchemy.org/";
+    description = "A Python SQL toolkit and Object Relational Mapper";
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/1.4.nix
similarity index 100%
rename from pkgs/development/python-modules/sqlalchemy/default.nix
rename to pkgs/development/python-modules/sqlalchemy/1.4.nix
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d3c455f41fef..757bb45d798b 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8121,7 +8121,9 @@ in {
 
   spyder-kernels_0_5 = callPackage ../development/python-modules/spyder-kernels/0.x.nix { };
 
-  sqlalchemy = callPackage ../development/python-modules/sqlalchemy { };
+  sqlalchemy_1_3 = callPackage ../development/python-modules/sqlalchemy/1.3.nix { };
+  sqlalchemy_1_4 = callPackage ../development/python-modules/sqlalchemy/1.4.nix { };
+  sqlalchemy = self.sqlalchemy_1_4;
 
   sqlalchemy-citext = callPackage ../development/python-modules/sqlalchemy-citext { };
 

From 8772f33bdda40c6fe194f0c84900052aa0431f39 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Milan=20P=C3=A4ssler?= <milan@petabyte.dev>
Date: Sat, 19 Jun 2021 20:14:12 +0200
Subject: [PATCH 149/416] mautrix-telegram: use sqlalchemy 1.3.x

---
 pkgs/servers/mautrix-telegram/default.nix | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/mautrix-telegram/default.nix b/pkgs/servers/mautrix-telegram/default.nix
index bf00462875b2..cc816ee793ea 100644
--- a/pkgs/servers/mautrix-telegram/default.nix
+++ b/pkgs/servers/mautrix-telegram/default.nix
@@ -29,13 +29,17 @@ in buildPythonPackage rec {
   propagatedBuildInputs = [
     Mako
     aiohttp
-    mautrix
-    sqlalchemy
+    (mautrix.override {
+      sqlalchemy = sqlalchemy_1_3;
+    })
+    sqlalchemy_1_3
     CommonMark
     ruamel_yaml
     python_magic
     telethon
-    telethon-session-sqlalchemy
+    (telethon-session-sqlalchemy.override {
+      sqlalchemy = sqlalchemy_1_3;
+    })
     pillow
     lxml
     setuptools

From f09a1ac2b6d9e46eaa44aa545451ff5f45dc0f5e Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 20 Jun 2021 11:30:29 +0200
Subject: [PATCH 150/416] python3Packages.pyipma: init at 2.1.5

---
 .../python-modules/pyipma/default.nix         | 36 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 38 insertions(+)
 create mode 100644 pkgs/development/python-modules/pyipma/default.nix

diff --git a/pkgs/development/python-modules/pyipma/default.nix b/pkgs/development/python-modules/pyipma/default.nix
new file mode 100644
index 000000000000..b34c4838cb8d
--- /dev/null
+++ b/pkgs/development/python-modules/pyipma/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, aiohttp
+, buildPythonPackage
+, fetchPypi
+, geopy
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "pyipma";
+  version = "2.1.5";
+  disabled = pythonOlder "3.7";
+
+  # Request for GitHub releases, https://github.com/dgomes/pyipma/issues/10
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0hq5dasqpsn64x2sf6a28hdmysygmcdq4in6s08w97jfvwc6xmym";
+  };
+
+  propagatedBuildInputs = [
+    aiohttp
+    geopy
+  ];
+
+  # Project has no tests included in the PyPI releases
+  doCheck = false;
+
+  pythonImportsCheck = [ "pyipma" ];
+
+  meta = with lib; {
+    description = "Python library to retrieve information from Instituto Português do Mar e Atmosfera";
+    homepage = "https://github.com/dgomes/pyipma";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d3c455f41fef..f4690c71f717 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5965,6 +5965,8 @@ in {
 
   pyintesishome = callPackage ../development/python-modules/pyintesishome { };
 
+  pyipma = callPackage ../development/python-modules/pyipma { };
+
   pyipp = callPackage ../development/python-modules/pyipp { };
 
   pyiqvia = callPackage ../development/python-modules/pyiqvia { };

From 2bbc83edc4e3031aaeaae48185a51d0dd4b382a7 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 20 Jun 2021 11:31:59 +0200
Subject: [PATCH 151/416] home-assistant: update component-packages

---
 pkgs/servers/home-assistant/component-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 62684b3c0ba3..6c3ce7142375 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -405,7 +405,7 @@
     "ios" = ps: with ps; [ aiohttp-cors ifaddr zeroconf ];
     "iota" = ps: with ps; [ ]; # missing inputs: pyota
     "iperf3" = ps: with ps; [ ]; # missing inputs: iperf3
-    "ipma" = ps: with ps; [ ]; # missing inputs: pyipma
+    "ipma" = ps: with ps; [ pyipma ];
     "ipp" = ps: with ps; [ pyipp ];
     "iqvia" = ps: with ps; [ numpy pyiqvia ];
     "irish_rail_transport" = ps: with ps; [ ]; # missing inputs: pyirishrail

From 5988bc29b304c54b7d30547057d7c0f90b3bd0af Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 20 Jun 2021 11:33:01 +0200
Subject: [PATCH 152/416] home-assistant: enable ipma tests

---
 pkgs/servers/home-assistant/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 53cb0cac8430..3fa5d86f264d 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -474,6 +474,7 @@ in with py.pkgs; buildPythonApplication rec {
     "intent"
     "intent_script"
     "ios"
+    "ipma"
     "ipp"
     "iqvia"
     "islamic_prayer_times"

From fa54e310aa6e395406d5f7c4f258f854f76ee74d Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 20 Jun 2021 11:44:06 +0200
Subject: [PATCH 153/416] python3Packages.millheater: init at 0.4.1

---
 .../python-modules/millheater/default.nix     | 37 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 39 insertions(+)
 create mode 100644 pkgs/development/python-modules/millheater/default.nix

diff --git a/pkgs/development/python-modules/millheater/default.nix b/pkgs/development/python-modules/millheater/default.nix
new file mode 100644
index 000000000000..7639de14a670
--- /dev/null
+++ b/pkgs/development/python-modules/millheater/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, aiohttp
+, async-timeout
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "millheater";
+  version = "0.4.1";
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "Danielhiversen";
+    repo = "pymill";
+    rev = version;
+    sha256 = "0dypv4xwdqcv45aibfkik2slm9r8y7pd2gwqa49kn96f40kdfwb0";
+  };
+
+  propagatedBuildInputs = [
+    aiohttp
+    async-timeout
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "mill" ];
+
+  meta = with lib; {
+    description = "Python library for Mill heater devices";
+    homepage = "https://github.com/Danielhiversen/pymill";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d3c455f41fef..5293a3ffa271 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4385,6 +4385,8 @@ in {
 
   milksnake = callPackage ../development/python-modules/milksnake { };
 
+  millheater = callPackage ../development/python-modules/millheater { };
+
   minidb = callPackage ../development/python-modules/minidb { };
 
   minidump = callPackage ../development/python-modules/minidump { };

From faad598cbfa6d89e940c489e9677cdf170291406 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 20 Jun 2021 11:45:45 +0200
Subject: [PATCH 154/416] home-assistant: update component-packages

---
 pkgs/servers/home-assistant/component-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 62684b3c0ba3..95a41da5665e 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -510,7 +510,7 @@
     "microsoft_face_identify" = ps: with ps; [ aiohttp-cors ];
     "miflora" = ps: with ps; [ bluepy ]; # missing inputs: miflora
     "mikrotik" = ps: with ps; [ librouteros ];
-    "mill" = ps: with ps; [ ]; # missing inputs: millheater
+    "mill" = ps: with ps; [ millheater ];
     "min_max" = ps: with ps; [ ];
     "minecraft_server" = ps: with ps; [ aiodns getmac mcstatus ];
     "minio" = ps: with ps; [ minio ];

From 0dc2567bee633e1ba1fbf1febf832a4cb5f9ab27 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 20 Jun 2021 11:46:35 +0200
Subject: [PATCH 155/416] home-assistant: enable mill tests

---
 pkgs/servers/home-assistant/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 53cb0cac8430..7b95059ac497 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -514,6 +514,7 @@ in with py.pkgs; buildPythonApplication rec {
     "microsoft_face_detect"
     "microsoft_face_identify"
     "mikrotik"
+    "mill"
     "min_max"
     "minecraft_server"
     "minio"

From 4f1b18b6b79f30d0f3e04d2c15b9ce08cb71d0a9 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sun, 20 Jun 2021 09:48:08 +0000
Subject: [PATCH 156/416] jackett: 0.18.345 -> 0.18.364

---
 pkgs/servers/jackett/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/jackett/default.nix b/pkgs/servers/jackett/default.nix
index 0bd0227ece6f..5bb43ae316c1 100644
--- a/pkgs/servers/jackett/default.nix
+++ b/pkgs/servers/jackett/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "jackett";
-  version = "0.18.345";
+  version = "0.18.364";
 
   src = fetchurl {
     url = "https://github.com/Jackett/Jackett/releases/download/v${version}/Jackett.Binaries.Mono.tar.gz";
-    sha256 = "sha256-cCUlKyndKAU57hSRZYWqwOthfjIirE5c95HRETnFEiA=";
+    sha256 = "sha256-QcwrgW07tP0PxA6UWqMf7VT0Y8uBZFJY9Uz7seorEfs=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From a415ec434fc8f4aa8d5ff7dadea6f8e196c74d5c Mon Sep 17 00:00:00 2001
From: illustris <rharikrishnan95@gmail.com>
Date: Thu, 17 Jun 2021 21:11:15 +0530
Subject: [PATCH 157/416] jitsi-meet: stable/jitsi-meet_5390 ->
 stable/jitsi-meet_5963

---
 pkgs/servers/web-apps/jitsi-meet/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/web-apps/jitsi-meet/default.nix b/pkgs/servers/web-apps/jitsi-meet/default.nix
index 719fab87eada..cfe00e59a2ed 100644
--- a/pkgs/servers/web-apps/jitsi-meet/default.nix
+++ b/pkgs/servers/web-apps/jitsi-meet/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "jitsi-meet";
-  version = "1.0.4628";
+  version = "1.0.5056";
 
   src = fetchurl {
     url = "https://download.jitsi.org/jitsi-meet/src/jitsi-meet-${version}.tar.bz2";
-    sha256 = "1kw4byy6mvqk3qd5nk5raka1bl9jp0kniszq6j5kc8nz3jql4qdz";
+    sha256 = "0vmxy22zpgmvmg84y6rf9s8y3ann1xzhpaipz7fk9z4ykmkj5knw";
   };
 
   dontBuild = true;

From d0d7946c0307ee4417e989ebceb9d28ac2aa4414 Mon Sep 17 00:00:00 2001
From: illustris <rharikrishnan95@gmail.com>
Date: Thu, 17 Jun 2021 21:18:34 +0530
Subject: [PATCH 158/416] jitsi-videobridge: 2.1-416 -> 2.1-508

---
 pkgs/servers/jitsi-videobridge/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/jitsi-videobridge/default.nix b/pkgs/servers/jitsi-videobridge/default.nix
index 35cd6906012d..283164380b48 100644
--- a/pkgs/servers/jitsi-videobridge/default.nix
+++ b/pkgs/servers/jitsi-videobridge/default.nix
@@ -2,10 +2,10 @@
 
 let
   pname = "jitsi-videobridge2";
-  version = "2.1-416-g2f43d1b4";
+  version = "2.1-508-gb24f756c";
   src = fetchurl {
     url = "https://download.jitsi.org/stable/${pname}_${version}-1_all.deb";
-    sha256 = "0s9wmbba1nlpxaawzmaqg92882y5sfs2ws64w5sqvpi7n77hy54m";
+    sha256 = "0kjsm3k7chgrfvvqxkp8xdw6wfrs122j4h8gcvyvpf9lg51p199g";
   };
 in
 stdenv.mkDerivation {

From aea0f9ce1f5deb8c3e425dfe6876810effd22b29 Mon Sep 17 00:00:00 2001
From: illustris <rharikrishnan95@gmail.com>
Date: Thu, 17 Jun 2021 21:20:09 +0530
Subject: [PATCH 159/416] jicofo: 1.0-690 -> 1.0-756

---
 pkgs/servers/jicofo/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/jicofo/default.nix b/pkgs/servers/jicofo/default.nix
index 49e40713a0a4..37b5a1bfaa38 100644
--- a/pkgs/servers/jicofo/default.nix
+++ b/pkgs/servers/jicofo/default.nix
@@ -2,10 +2,10 @@
 
 let
   pname = "jicofo";
-  version = "1.0-690";
+  version = "1.0-756";
   src = fetchurl {
     url = "https://download.jitsi.org/stable/${pname}_${version}-1_all.deb";
-    sha256 = "1w5nz2p6scd7w0ac93vhxlk5i8in5160c0icwl27m4x4km9xf6al";
+    sha256 = "07qmxqp1llpn8kh590iz35zk17c2k4yg7i43nb2l0sfm40crpwfz";
   };
 in
 stdenv.mkDerivation {

From 34b9ba2e6161e68febe4312c96c089d707472d5e Mon Sep 17 00:00:00 2001
From: illustris <rharikrishnan95@gmail.com>
Date: Thu, 17 Jun 2021 23:44:10 +0530
Subject: [PATCH 160/416] nixos/jitsi-meet: Update jitsi prosody configs

Changes made as per https://github.com/jitsi/jitsi-meet/commit/b6f7f8fba7ba81c5a0ab5477a1d103b7279bf38f
---
 nixos/modules/services/web-apps/jitsi-meet.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/web-apps/jitsi-meet.nix b/nixos/modules/services/web-apps/jitsi-meet.nix
index 2df762882fae..a98dd1f91c6c 100644
--- a/nixos/modules/services/web-apps/jitsi-meet.nix
+++ b/nixos/modules/services/web-apps/jitsi-meet.nix
@@ -187,8 +187,8 @@ in
       ];
       extraModules = [ "pubsub" ];
       extraConfig = mkAfter ''
-        Component "focus.${cfg.hostName}"
-          component_secret = os.getenv("JICOFO_COMPONENT_SECRET")
+        Component "focus.${cfg.hostName}" "client_proxy"
+          target_address = "focus@auth.${cfg.hostName}"
       '';
       virtualHosts.${cfg.hostName} = {
         enabled = true;
@@ -254,6 +254,7 @@ in
       + optionalString cfg.prosody.enable ''
         ${config.services.prosody.package}/bin/prosodyctl register focus auth.${cfg.hostName} "$(cat /var/lib/jitsi-meet/jicofo-user-secret)"
         ${config.services.prosody.package}/bin/prosodyctl register jvb auth.${cfg.hostName} "$(cat ${videobridgeSecret})"
+        ${config.services.prosody.package}/bin/prosodyctl mod_roster_command subscribe focus.${cfg.hostName} focus@auth.${cfg.hostName}
 
         # generate self-signed certificates
         if [ ! -f /var/lib/jitsi-meet.crt ]; then

From 5e49c97d29455e39ba820228dc7ff7b034ecc6fb Mon Sep 17 00:00:00 2001
From: illustris <rharikrishnan95@gmail.com>
Date: Fri, 18 Jun 2021 10:05:54 +0530
Subject: [PATCH 161/416] jitsi-meet-prosody: init at 1.0.5056

---
 pkgs/misc/jitsi-meet-prosody/default.nix | 36 ++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix          |  2 ++
 2 files changed, 38 insertions(+)
 create mode 100644 pkgs/misc/jitsi-meet-prosody/default.nix

diff --git a/pkgs/misc/jitsi-meet-prosody/default.nix b/pkgs/misc/jitsi-meet-prosody/default.nix
new file mode 100644
index 000000000000..0ab939af0f78
--- /dev/null
+++ b/pkgs/misc/jitsi-meet-prosody/default.nix
@@ -0,0 +1,36 @@
+{ lib, stdenv, fetchurl, dpkg, nixosTests }:
+
+stdenv.mkDerivation rec {
+  pname = "jitsi-meet-prosody";
+  version = "1.0.5056";
+  src = fetchurl {
+    url = "https://download.jitsi.org/stable/${pname}_${version}-1_all.deb";
+    sha256 = "06qxa9h2ry92xrk2jklp76nv3sl8nvykdvsqmhn33lz6q6vmw2xr";
+  };
+
+  dontBuild = true;
+
+  unpackCmd = "${dpkg}/bin/dpkg-deb -x $src debcontents";
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share
+    mv usr/share/jitsi-meet/prosody-plugins $out/share/
+    runHook postInstall
+  '';
+
+  passthru.tests = {
+    single-node-smoke-test = nixosTests.jitsi-meet;
+  };
+
+  meta = with lib; {
+    description = "Prosody configuration for Jitsi Meet";
+    longDescription = ''
+        This package contains configuration for Prosody to be used with Jitsi Meet.
+    '';
+    homepage = "https://github.com/jitsi/jitsi-meet/";
+    license = licenses.asl20;
+    maintainers = teams.jitsi.members;
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 40be91d9a71a..0865b3716e9f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -19345,6 +19345,8 @@ in
 
   jitsi-meet = callPackage ../servers/web-apps/jitsi-meet { };
 
+  jitsi-meet-prosody = callPackage ../misc/jitsi-meet-prosody { };
+
   jitsi-videobridge = callPackage ../servers/jitsi-videobridge { };
 
   kapowbang = callPackage ../servers/kapowbang { };

From e0089c38ca2f9f2b9a46ffcf74a9908f53d51459 Mon Sep 17 00:00:00 2001
From: illustris <rharikrishnan95@gmail.com>
Date: Fri, 18 Jun 2021 10:22:14 +0530
Subject: [PATCH 162/416] nixos/jitsi-meet: include jitsi prosody plugins in
 prosody extraPluginPaths

---
 nixos/modules/services/web-apps/jitsi-meet.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/web-apps/jitsi-meet.nix b/nixos/modules/services/web-apps/jitsi-meet.nix
index a98dd1f91c6c..997604754e42 100644
--- a/nixos/modules/services/web-apps/jitsi-meet.nix
+++ b/nixos/modules/services/web-apps/jitsi-meet.nix
@@ -186,6 +186,7 @@ in
         }
       ];
       extraModules = [ "pubsub" ];
+      extraPluginPaths = [ "${pkgs.jitsi-meet-prosody}/share/prosody-plugins" ];
       extraConfig = mkAfter ''
         Component "focus.${cfg.hostName}" "client_proxy"
           target_address = "focus@auth.${cfg.hostName}"

From 85aa4bf92b34a4774f7443a87ab3524bfd152002 Mon Sep 17 00:00:00 2001
From: illustris <rharikrishnan95@gmail.com>
Date: Sun, 20 Jun 2021 11:22:12 +0530
Subject: [PATCH 163/416] nixos/jitsi-meet: update nixos tests

- remove check for `connected .JID: focus@auth.server` because
	- log format was changed in https://github.com/jitsi/jicofo/commit/c1945ea6cb3dd7c815e963768abc9a3fab57101e
	- connection.getUser() in jicofo also appears to be broken, returning null instead of username
	- testing for this log line shouldn't be necessary, as we also test for "Authenticated as focus@auth.server"

- remove check for `External component successfully authenticated` because
	- [JVB no longer uses component](https://community.jitsi.org/t/jvb-not-connecting/91157/2)

- increase VM memory
---
 nixos/tests/jitsi-meet.nix | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/nixos/tests/jitsi-meet.nix b/nixos/tests/jitsi-meet.nix
index dec49c83121b..f9a0b121a2bf 100644
--- a/nixos/tests/jitsi-meet.nix
+++ b/nixos/tests/jitsi-meet.nix
@@ -8,6 +8,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     client = { nodes, pkgs, ... }: {
     };
     server = { config, pkgs, ... }: {
+      virtualisation.memorySize = 512;
       services.jitsi-meet = {
         enable = true;
         hostName = "server";
@@ -36,15 +37,9 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     server.wait_until_succeeds(
         "journalctl -b -u jitsi-videobridge2 -o cat | grep -q 'Performed a successful health check'"
     )
-    server.wait_until_succeeds(
-        "journalctl -b -u jicofo -o cat | grep -q 'connected .JID: focus@auth.server'"
-    )
     server.wait_until_succeeds(
         "journalctl -b -u prosody -o cat | grep -q 'Authenticated as focus@auth.server'"
     )
-    server.wait_until_succeeds(
-        "journalctl -b -u prosody -o cat | grep -q 'focus.server:component: External component successfully authenticated'"
-    )
     server.wait_until_succeeds(
         "journalctl -b -u prosody -o cat | grep -q 'Authenticated as jvb@auth.server'"
     )

From d27721b3f369fb656a52a7c4026958a3ff45f68c Mon Sep 17 00:00:00 2001
From: Pavol Rusnak <pavol@rusnak.io>
Date: Sun, 20 Jun 2021 12:34:04 +0200
Subject: [PATCH 164/416] librealsense: enable build on aarch64-darwin and
 aarch64-linux

---
 .../libraries/librealsense/default.nix        | 24 +++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/librealsense/default.nix b/pkgs/development/libraries/librealsense/default.nix
index 4015ab02a3a8..0011dc2f6e11 100644
--- a/pkgs/development/libraries/librealsense/default.nix
+++ b/pkgs/development/libraries/librealsense/default.nix
@@ -1,6 +1,16 @@
-{ stdenv, config, lib, fetchFromGitHub, cmake, libusb1, ninja, pkg-config, gcc
+{ stdenv
+, config
+, lib
+, fetchFromGitHub
+, fetchpatch
+, cmake
+, libusb1
+, ninja
+, pkg-config
+, gcc
 , cudaSupport ? config.cudaSupport or false, cudatoolkit
-, enablePython ? false, pythonPackages ? null }:
+, enablePython ? false, pythonPackages ? null
+}:
 
 assert cudaSupport -> cudatoolkit != null;
 assert enablePython -> pythonPackages != null;
@@ -24,7 +34,13 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional cudaSupport cudatoolkit
     ++ lib.optionals enablePython (with pythonPackages; [python pybind11 ]);
 
-  patches = lib.optionals enablePython [
+  patches = [
+    # fix build on aarch64-darwin
+    # https://github.com/IntelRealSense/librealsense/pull/9253
+    (fetchpatch {
+      url = "https://github.com/IntelRealSense/librealsense/commit/beb4c44debc8336de991c983274cad841eb5c323.patch";
+      sha256 = "05mxsd2pz3xrvywdqyxkwdvxx8hjfxzcgl51897avz4v2j89pyq8";
+    })
     ./py_sitepackage_dir.patch
     ./py_pybind11_no_external_download.patch
   ];
@@ -57,6 +73,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/IntelRealSense/librealsense";
     license = licenses.asl20;
     maintainers = with maintainers; [ brian-dawn ];
-    platforms = [ "i686-linux" "x86_64-linux" "x86_64-darwin" ];
+    platforms = platforms.unix;
   };
 }

From 34e5bf44fb04c6bb524e1af77c190cd810afb1cf Mon Sep 17 00:00:00 2001
From: Lancelot SIX <lsix@lancelotsix.com>
Date: Sat, 19 Jun 2021 22:40:17 +0100
Subject: [PATCH 165/416] mtools: 4.0.27 -> 4.0.31

See https://lists.gnu.org/archive/html/info-gnu/2021-06/msg00011.html
for release information
---
 pkgs/tools/filesystems/mtools/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/filesystems/mtools/default.nix b/pkgs/tools/filesystems/mtools/default.nix
index 8f83f800b671..4618a9b3b79a 100644
--- a/pkgs/tools/filesystems/mtools/default.nix
+++ b/pkgs/tools/filesystems/mtools/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mtools";
-  version = "4.0.27";
+  version = "4.0.31";
 
   src = fetchurl {
     url = "mirror://gnu/mtools/${pname}-${version}.tar.bz2";
-    sha256 = "1crqi10adwfahj8xyw60lx70hkpcc5g00b5r8277cm2f4kcwi24w";
+    sha256 = "11nm5mhsq700f3dzvzjpcik89cfcn38mb249yc0sjbwggwkrk2ak";
   };
 
   patches = lib.optional stdenv.isDarwin ./UNUSED-darwin.patch;

From 2797b7aec18459235581bc890cbe83c30a1b12e1 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 20 Jun 2021 12:56:50 +0200
Subject: [PATCH 166/416] exploitdb: 2021-06-18 -> 2021-06-19

---
 pkgs/tools/security/exploitdb/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 922b6c3f2baf..d5d698088e6a 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2021-06-18";
+  version = "2021-06-19";
 
   src = fetchFromGitHub {
     owner = "offensive-security";
     repo = pname;
     rev = version;
-    sha256 = "0b91r7bl3abg3mb7vg4qnk319jy7civ583la0054xhpg0c0svyk1";
+    sha256 = "1qhznaq06plbkld4al3whrfvfpqgpwaxgwzdkyndvh40yn4sh1fz";
   };
 
   installPhase = ''

From 4e201c1c3ca99e9067e64802a877eda1e17e8f58 Mon Sep 17 00:00:00 2001
From: Michael Weiss <dev.primeos@gmail.com>
Date: Sun, 20 Jun 2021 13:02:27 +0200
Subject: [PATCH 167/416] ungoogled-chromium: 91.0.4472.101 -> 91.0.4472.114

---
 .../networking/browsers/chromium/upstream-info.json    | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index 377dd17afaa5..e904409a1783 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -44,9 +44,9 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "91.0.4472.101",
-    "sha256": "1d3y621iclkq6nvxrapk5aihv50x13hjha0c2gcp2xxfma96253q",
-    "sha256bin64": "12j5q5b9v0jpiznjnh89831w8lv399vd1z4ljhbsnsidbsygrbr1",
+    "version": "91.0.4472.114",
+    "sha256": "0wbyiwbdazgjjgj9vs56x26q3g9r80a57gfl0f2rfl1j7xwgxiy1",
+    "sha256bin64": "00ac1dyqxpxy1j11jvc5j35bgc629n2f2pll3912gzih4ir0vrys",
     "deps": {
       "gn": {
         "version": "2021-04-06",
@@ -55,8 +55,8 @@
         "sha256": "199xkks67qrn0xa5fhp24waq2vk8qb78a96cb3kdd8v1hgacgb8x"
       },
       "ungoogled-patches": {
-        "rev": "91.0.4472.101-1",
-        "sha256": "1ca8gjxz3w730446qns253ibs9lx22iysxq5sphb3pw2w0069q8r"
+        "rev": "91.0.4472.114-1",
+        "sha256": "1xb5g3hybaiwn3y1zw1fxd3g0zwmvplrs06sdqnxzsr1qm8b874h"
       }
     }
   }

From b2bf2c610234b8dfa2c3e9db43eb2b4668e5b0e3 Mon Sep 17 00:00:00 2001
From: Olli Helenius <liff@iki.fi>
Date: Sun, 20 Jun 2021 13:23:37 +0300
Subject: [PATCH 168/416] antlr: make 4.8 default

---
 nixos/doc/manual/from_md/release-notes/rl-2111.section.xml | 6 ++++++
 nixos/doc/manual/release-notes/rl-2111.section.md          | 3 +++
 pkgs/applications/version-management/srcml/default.nix     | 4 ++--
 pkgs/development/libraries/nco/default.nix                 | 4 ++--
 pkgs/development/python-modules/stringtemplate/default.nix | 4 ++--
 pkgs/development/tools/database/sqlitebrowser/default.nix  | 4 ++--
 pkgs/top-level/all-packages.nix                            | 4 +++-
 7 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
index 0908fb137261..2c7935078e34 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@@ -309,6 +309,12 @@
           </listitem>
         </itemizedlist>
       </listitem>
+      <listitem>
+        <para>
+          The <literal>antlr</literal> package now defaults to the 4.x
+          release instead of the old 2.7.7 version.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-21.11-notable-changes">
diff --git a/nixos/doc/manual/release-notes/rl-2111.section.md b/nixos/doc/manual/release-notes/rl-2111.section.md
index a603f7358291..e97aed4ccf2a 100644
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@@ -85,4 +85,7 @@ In addition to numerous new and upgraded packages, this release has the followin
   - GitVersionTree
   - NDeskOptions
 
+* The `antlr` package now defaults to the 4.x release instead of the
+  old 2.7.7 version.
+
 ## Other Notable Changes {#sec-release-21.11-notable-changes}
diff --git a/pkgs/applications/version-management/srcml/default.nix b/pkgs/applications/version-management/srcml/default.nix
index c13a08a711c2..11dbfc299a49 100644
--- a/pkgs/applications/version-management/srcml/default.nix
+++ b/pkgs/applications/version-management/srcml/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, cmake, libxml2, libxslt, boost, libarchive, python, antlr,
+{ lib, stdenv, fetchurl, cmake, libxml2, libxslt, boost, libarchive, python, antlr2,
   curl
 }:
 
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     ./gcc6.patch
   ];
 
-  nativeBuildInputs = [ cmake antlr ];
+  nativeBuildInputs = [ cmake antlr2 ];
   buildInputs = [ libxml2 libxslt boost libarchive python curl ];
 
   meta = {
diff --git a/pkgs/development/libraries/nco/default.nix b/pkgs/development/libraries/nco/default.nix
index 958be905f835..b7df32633b4a 100644
--- a/pkgs/development/libraries/nco/default.nix
+++ b/pkgs/development/libraries/nco/default.nix
@@ -1,10 +1,10 @@
-{ lib, stdenv, fetchzip, netcdf, netcdfcxx4, gsl, udunits, antlr, which, curl, flex, coreutils }:
+{ lib, stdenv, fetchzip, netcdf, netcdfcxx4, gsl, udunits, antlr2, which, curl, flex, coreutils }:
 
 stdenv.mkDerivation rec {
   version = "4.9.8";
   pname = "nco";
 
-  nativeBuildInputs = [ flex which antlr ];
+  nativeBuildInputs = [ flex which antlr2 ];
   buildInputs = [ netcdf netcdfcxx4 gsl udunits curl coreutils ];
 
   src = fetchzip {
diff --git a/pkgs/development/python-modules/stringtemplate/default.nix b/pkgs/development/python-modules/stringtemplate/default.nix
index 8bdb69a3074e..336a371c0714 100644
--- a/pkgs/development/python-modules/stringtemplate/default.nix
+++ b/pkgs/development/python-modules/stringtemplate/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchurl, buildPythonPackage, antlr, isPy3k }:
+{ lib, fetchurl, buildPythonPackage, antlr2, isPy3k }:
 
 buildPythonPackage rec {
   pname = "PyStringTemplate";
@@ -9,7 +9,7 @@ buildPythonPackage rec {
     sha256 = "0lbib0l8c1q7i1j610rwcdagymr1idahrql4dkgnm5rzyg2vk3ml";
   };
 
-  propagatedBuildInputs = [ antlr ];
+  propagatedBuildInputs = [ antlr2 ];
 
   disabled = isPy3k;
 
diff --git a/pkgs/development/tools/database/sqlitebrowser/default.nix b/pkgs/development/tools/database/sqlitebrowser/default.nix
index 40238d0effa4..45b5f185880d 100644
--- a/pkgs/development/tools/database/sqlitebrowser/default.nix
+++ b/pkgs/development/tools/database/sqlitebrowser/default.nix
@@ -1,4 +1,4 @@
-{ mkDerivation, lib, fetchFromGitHub, cmake, antlr
+{ mkDerivation, lib, fetchFromGitHub, cmake
 , qtbase, qttools, sqlite }:
 
 mkDerivation rec {
@@ -16,7 +16,7 @@ mkDerivation rec {
   # but qscintilla is currently in a bit of a mess as some consumers expect a
   # -qt4 or -qt5 prefix while others do not.
   # We *really* should get that cleaned up.
-  buildInputs = [ antlr qtbase sqlite ];
+  buildInputs = [ qtbase sqlite ];
 
   nativeBuildInputs = [ cmake qttools ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 40be91d9a71a..84518f6a1f86 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12787,7 +12787,7 @@ in
 
   ansible-lint = with python3.pkgs; toPythonApplication ansible-lint;
 
-  antlr = callPackage ../development/tools/parsing/antlr/2.7.7.nix {
+  antlr2 = callPackage ../development/tools/parsing/antlr/2.7.7.nix {
     jdk = jdk8; # todo: remove override https://github.com/nixos/nixpkgs/pull/89731
   };
 
@@ -12805,6 +12805,8 @@ in
 
   antlr4 = antlr4_8;
 
+  antlr = antlr4;
+
   apacheAnt = callPackage ../development/tools/build-managers/apache-ant { };
   apacheAnt_1_9 = callPackage ../development/tools/build-managers/apache-ant/1.9.nix { };
   ant = apacheAnt;

From 5bda21e362405614794072b4d09c908797026393 Mon Sep 17 00:00:00 2001
From: Michael Weiss <dev.primeos@gmail.com>
Date: Sun, 20 Jun 2021 13:23:58 +0200
Subject: [PATCH 169/416] llvmPackages_git: Abort updates if no new version is
 available

No need to fetch the source tarball in this case.
---
 pkgs/development/compilers/llvm/update-git.py | 20 +++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/llvm/update-git.py b/pkgs/development/compilers/llvm/update-git.py
index 1ef16cfb9b1d..880cad1c72b1 100755
--- a/pkgs/development/compilers/llvm/update-git.py
+++ b/pkgs/development/compilers/llvm/update-git.py
@@ -7,12 +7,16 @@ import json
 import os
 import re
 import subprocess
+import sys
 
 from codecs import iterdecode
 from datetime import datetime
 from urllib.request import urlopen, Request
 
 
+DEFAULT_NIX = os.path.join(os.path.dirname(os.path.abspath(__file__)), 'git/default.nix')
+
+
 def get_latest_chromium_build():
     HISTORY_URL = 'https://omahaproxy.appspot.com/history?os=linux'
     print(f'GET {HISTORY_URL}')
@@ -39,6 +43,16 @@ def get_commit(ref):
         return json.loads(http_response.read().decode())
 
 
+def get_current_revision():
+    """Get the current revision of llvmPackages_git."""
+    with open(DEFAULT_NIX) as f:
+        for line in f:
+            rev = re.search(r'^  rev = "(.*)";', line)
+            if rev:
+                return rev.group(1)
+    sys.exit(1)
+
+
 def nix_prefetch_url(url, algo='sha256'):
     """Prefetches the content of the given URL."""
     print(f'nix-prefetch-url {url}')
@@ -55,13 +69,15 @@ clang_revision = re.search(r"^CLANG_REVISION = '(.+)'$", clang_update_script, re
 clang_commit_short = re.search(r"llvmorg-[0-9]+-init-[0-9]+-g([0-9a-f]{8})", clang_revision).group(1)
 release_version = re.search(r"^RELEASE_VERSION = '(.+)'$", clang_update_script, re.MULTILINE).group(1)
 commit = get_commit(clang_commit_short)
+if get_current_revision() == commit["sha"]:
+    print('No new update available.')
+    sys.exit(0)
 date = datetime.fromisoformat(commit['commit']['committer']['date'].rstrip('Z')).date().isoformat()
 version = f'unstable-{date}'
 print('Prefetching source tarball...')
 hash = nix_prefetch_url(f'https://github.com/llvm/llvm-project/archive/{commit["sha"]}.tar.gz')
 print('Updating default.nix...')
-default_nix = os.path.join(os.path.dirname(os.path.abspath(__file__)), 'git/default.nix')
-with fileinput.FileInput(default_nix, inplace=True) as f:
+with fileinput.FileInput(DEFAULT_NIX, inplace=True) as f:
     for line in f:
         result = re.sub(r'^  release_version = ".+";', f'  release_version = "{release_version}";', line)
         result = re.sub(r'^  rev = ".*";', f'  rev = "{commit["sha"]}";', result)

From d2705ebee009fe203aa1d241cb7afad335d1f812 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 20 Jun 2021 13:35:53 +0200
Subject: [PATCH 170/416] python3Packages.aladdin-connect: init at 0.3

---
 .../aladdin-connect/default.nix               | 33 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 35 insertions(+)
 create mode 100644 pkgs/development/python-modules/aladdin-connect/default.nix

diff --git a/pkgs/development/python-modules/aladdin-connect/default.nix b/pkgs/development/python-modules/aladdin-connect/default.nix
new file mode 100644
index 000000000000..d25cdadc89a6
--- /dev/null
+++ b/pkgs/development/python-modules/aladdin-connect/default.nix
@@ -0,0 +1,33 @@
+{ lib
+, requests
+, buildPythonPackage
+, fetchFromGitHub
+}:
+
+buildPythonPackage rec {
+  pname = "aladdin-connect";
+  version = "0.3";
+
+  src = fetchFromGitHub {
+    owner = "shoejosh";
+    repo = pname;
+    rev = version;
+    sha256 = "0nimd1nw1haxn8s2207fcrmpjyfp6nx97n560l6hzqyqqmf2d1d1";
+  };
+
+  propagatedBuildInputs = [
+    requests
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "aladdin_connect" ];
+
+  meta = with lib; {
+    description = "Python library for interacting with Genie Aladdin Connect devices";
+    homepage = "https://github.com/shoejosh/aladdin-connect";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d3c455f41fef..d51ff9aba37a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -385,6 +385,8 @@ in {
 
   alabaster = callPackage ../development/python-modules/alabaster { };
 
+  aladdin-connect = callPackage ../development/python-modules/aladdin-connect { };
+
   alarmdecoder = callPackage ../development/python-modules/alarmdecoder { };
 
   alembic = callPackage ../development/python-modules/alembic { };

From 4445a89c05602ba9c786fd87eba520e897be69bf Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 20 Jun 2021 13:37:03 +0200
Subject: [PATCH 171/416] home-assistant: update component-packages

---
 pkgs/servers/home-assistant/component-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 62684b3c0ba3..34e7df273dc9 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -19,7 +19,7 @@
     "airly" = ps: with ps; [ airly ];
     "airnow" = ps: with ps; [ pyairnow ];
     "airvisual" = ps: with ps; [ pyairvisual ];
-    "aladdin_connect" = ps: with ps; [ ]; # missing inputs: aladdin_connect
+    "aladdin_connect" = ps: with ps; [ aladdin-connect ];
     "alarm_control_panel" = ps: with ps; [ ];
     "alarmdecoder" = ps: with ps; [ adext ];
     "alert" = ps: with ps; [ ];

From 84e90cd11a5bcde330cfcca4e042b73655b796e0 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 20 Jun 2021 13:47:56 +0200
Subject: [PATCH 172/416] python3Packages.mcstatus: 6.0.0 -> 6.1.0

---
 pkgs/development/python-modules/mcstatus/default.nix | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/mcstatus/default.nix b/pkgs/development/python-modules/mcstatus/default.nix
index 6a39ff347cd5..221410fa3eae 100644
--- a/pkgs/development/python-modules/mcstatus/default.nix
+++ b/pkgs/development/python-modules/mcstatus/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "mcstatus";
-  version = "6.0.0";
+  version = "6.1.0";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "Dinnerbone";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-YBtVWcOZDt2jQB9bHDrSCP9f2OC+IHzJKlBBGorLnZU=";
+    sha256 = "sha256-ncw8ILOD+i5aW78opv62VRcV58MQb5IG33MGTqNgDRk=";
   };
 
   propagatedBuildInputs = [
@@ -36,10 +36,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    substituteInPlace requirements.txt --replace "dnspython3" "dnspython"
-  '';
-
   pythonImportsCheck = [ "mcstatus" ];
 
   meta = with lib; {

From af72b540e6b967b7e084996b8af9f97eb445f7fb Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 20 Jun 2021 13:57:50 +0200
Subject: [PATCH 173/416] python3Packages.pypca: init at 0.0.13

---
 .../python-modules/pypca/default.nix          | 35 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 37 insertions(+)
 create mode 100644 pkgs/development/python-modules/pypca/default.nix

diff --git a/pkgs/development/python-modules/pypca/default.nix b/pkgs/development/python-modules/pypca/default.nix
new file mode 100644
index 000000000000..86adb4e3e14a
--- /dev/null
+++ b/pkgs/development/python-modules/pypca/default.nix
@@ -0,0 +1,35 @@
+{ lib
+, buildPythonPackage
+, colorlog
+, fetchPypi
+, pythonOlder
+, pyserial
+}:
+
+buildPythonPackage rec {
+  pname = "pypca";
+  version = "0.0.13";
+  disabled = pythonOlder "3.5";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0y0p2rm22x21mykipiv42fjc79b0969qsbhk3cqkrdnqwh5psbdl";
+  };
+
+  propagatedBuildInputs = [
+    colorlog
+    pyserial
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "pypca" ];
+
+  meta = with lib; {
+    description = "Python library for interacting with the PCA 301 smart plugs";
+    homepage = "https://github.com/majuss/pypca";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d3c455f41fef..b1b7f2b0c03e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6236,6 +6236,8 @@ in {
 
   pypblib = callPackage ../development/python-modules/pypblib { };
 
+  pypca = callPackage ../development/python-modules/pypca { };
+
   pypcap = callPackage ../development/python-modules/pypcap { };
 
   pypck = callPackage ../development/python-modules/pypck { };

From 03d0c01065a5751708b4d062635a383a8e9be069 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 20 Jun 2021 13:59:03 +0200
Subject: [PATCH 174/416] home-assistant: update component-packages

---
 pkgs/servers/home-assistant/component-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 62684b3c0ba3..e6adbaed32d3 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -216,7 +216,7 @@
     "elgato" = ps: with ps; [ elgato ];
     "eliqonline" = ps: with ps; [ ]; # missing inputs: eliqonline
     "elkm1" = ps: with ps; [ ]; # missing inputs: elkm1-lib
-    "elv" = ps: with ps; [ ]; # missing inputs: pypca
+    "elv" = ps: with ps; [ pypca ];
     "emby" = ps: with ps; [ pyemby ];
     "emoncms" = ps: with ps; [ ];
     "emoncms_history" = ps: with ps; [ ];

From f2324341544c5349c09114bc264d0a0e2ad3424b Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 20 Jun 2021 14:39:49 +0200
Subject: [PATCH 175/416] python3Packages.ecoaliface: init at 0.4.0

---
 .../python-modules/ecoaliface/default.nix     | 31 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 33 insertions(+)
 create mode 100644 pkgs/development/python-modules/ecoaliface/default.nix

diff --git a/pkgs/development/python-modules/ecoaliface/default.nix b/pkgs/development/python-modules/ecoaliface/default.nix
new file mode 100644
index 000000000000..e3001d7fa46c
--- /dev/null
+++ b/pkgs/development/python-modules/ecoaliface/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, requests
+}:
+
+buildPythonPackage rec {
+  pname = "ecoaliface";
+  version = "0.4.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1hzx0r3311f952jik3pgmrg74xp5m6w9c5v6snfrb8w2m19vs6qy";
+  };
+
+  propagatedBuildInputs = [
+    requests
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "ecoaliface" ];
+
+  meta = with lib; {
+    description = "Python library for interacting with eCoal water boiler controllers";
+    homepage = "https://github.com/matkor/ecoaliface";
+    license = with licenses; [ gpl3Plus ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d3c455f41fef..d8d05d8cdcb2 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2221,6 +2221,8 @@ in {
 
   ecdsa = callPackage ../development/python-modules/ecdsa { };
 
+  ecoaliface = callPackage ../development/python-modules/ecoaliface { };
+
   ecos = callPackage ../development/python-modules/ecos { };
 
   ecpy = callPackage ../development/python-modules/ecpy { };

From d01388bf40d81f037236ed423e0f35b5f05880de Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 20 Jun 2021 14:40:48 +0200
Subject: [PATCH 176/416] home-assistant: update component-packages

---
 pkgs/servers/home-assistant/component-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 62684b3c0ba3..509bb5343fca 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -202,7 +202,7 @@
     "eafm" = ps: with ps; [ aioeafm ];
     "ebox" = ps: with ps; [ ]; # missing inputs: pyebox
     "ebusd" = ps: with ps; [ ]; # missing inputs: ebusdpy
-    "ecoal_boiler" = ps: with ps; [ ]; # missing inputs: ecoaliface
+    "ecoal_boiler" = ps: with ps; [ ecoaliface ];
     "ecobee" = ps: with ps; [ python-ecobee-api ];
     "econet" = ps: with ps; [ pyeconet ];
     "ecovacs" = ps: with ps; [ ]; # missing inputs: sucks

From b789def9a03bcc38a1ed41f92b374b2d954b6976 Mon Sep 17 00:00:00 2001
From: Andrey Kuznetsov <fear@loathing.in>
Date: Sun, 20 Jun 2021 12:42:10 +0000
Subject: [PATCH 177/416] polkadot: 0.9.3 -> 0.9.5

---
 pkgs/applications/blockchains/polkadot/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/blockchains/polkadot/default.nix b/pkgs/applications/blockchains/polkadot/default.nix
index 105686777db2..a80d7dd91ffe 100644
--- a/pkgs/applications/blockchains/polkadot/default.nix
+++ b/pkgs/applications/blockchains/polkadot/default.nix
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "polkadot";
-  version = "0.9.3";
+  version = "0.9.5";
 
   src = fetchFromGitHub {
     owner = "paritytech";
     repo = "polkadot";
     rev = "v${version}";
-    sha256 = "sha256-BxBrgcAJm6KM6ha494xlwiLYOSAr71gDFgqlH5RPqMM=";
+    sha256 = "sha256-fe6iCSp4TxKKsVVBrvbSMROXqigTfxFCOLN1gAqRTv0=";
   };
 
-  cargoSha256 = "131fkdazcspblzblmd9nhkymwn7qh6lhaqvi1jqnsq4951l9f4ms";
+  cargoSha256 = "18pg09v14991aqq7cjg0w5x36526y6sx1hvxlqb20zvrgmv722cq";
 
   nativeBuildInputs = [ clang ];
 

From 0923b635cd2632a8ae77342275b9ba81024733fd Mon Sep 17 00:00:00 2001
From: Sheng Wang <sheng@a64.work>
Date: Sun, 20 Jun 2021 22:03:52 +0900
Subject: [PATCH 178/416] maintainers: add wakira

---
 maintainers/maintainer-list.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 8e18d02698e9..39c63c1ec410 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11004,6 +11004,16 @@
     githubId = 3889405;
     name = "vyp";
   };
+  wakira = {
+    name = "Sheng Wang";
+    email = "sheng@a64.work";
+    github = "wakira";
+    githubId = 2338339;
+    keys = [{
+      longkeyid = "rsa4096/0x8C9B0A8FC0C0D862";
+      fingerprint = "47F7 009E 3AE3 1DA7 988E  12E1 8C9B 0A8F C0C0 D862";
+    }];
+  };
   wamserma = {
     name = "Markus S. Wamser";
     email = "github-dev@mail2013.wamser.eu";

From 7748af9fff7867dc7c413c762b36793537b6cf47 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <dev@schuetz-co.de>
Date: Sun, 20 Jun 2021 15:23:25 +0200
Subject: [PATCH 179/416] pythonPackages.certifi: does not support python2

Support was officially dropped in
https://github.com/certifi/python-certifi/commit/5efdd48f719d9c3c7c8f9a812da2256d088eab78
---
 pkgs/development/python-modules/certifi/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/python-modules/certifi/default.nix b/pkgs/development/python-modules/certifi/default.nix
index eac32816caca..a5b66f0d2e68 100644
--- a/pkgs/development/python-modules/certifi/default.nix
+++ b/pkgs/development/python-modules/certifi/default.nix
@@ -1,12 +1,15 @@
 { lib
 , fetchPypi
 , buildPythonPackage
+, isPy27
 }:
 
 buildPythonPackage rec {
   pname = "certifi";
   version = "2020.12.5";
 
+  disabled = isPy27;
+
   src = fetchPypi {
     inherit pname version;
     sha256 = "177mdbw0livdjvp17sz6wsfrc32838m9y59v871gpgv2888raj8s";

From 4396ba534bf316a276a80e5357d2990addf04563 Mon Sep 17 00:00:00 2001
From: Sheng Wang <sheng@a64.work>
Date: Sun, 20 Jun 2021 22:11:28 +0900
Subject: [PATCH 180/416] livedl: init at unstable-2021-05-16

---
 pkgs/tools/misc/livedl/default.nix | 25 +++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix    |  2 ++
 2 files changed, 27 insertions(+)
 create mode 100644 pkgs/tools/misc/livedl/default.nix

diff --git a/pkgs/tools/misc/livedl/default.nix b/pkgs/tools/misc/livedl/default.nix
new file mode 100644
index 000000000000..b989fe27a659
--- /dev/null
+++ b/pkgs/tools/misc/livedl/default.nix
@@ -0,0 +1,25 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "livedl";
+  version = "unstable-2021-05-16";
+
+  src = fetchFromGitHub {
+    owner = "himananiito";
+    repo = pname;
+    rev = "a8720f1e358e5b0ade6fdeb8aacc00781e6cc504";
+    sha256 = "1zax215jp6sl47m8ahssyyrbzn96dh74srq9g61jc76sq10xg329";
+  };
+
+  sourceRoot = "source/src";
+
+  vendorSha256 = sha256:g5Y1IH1U1zOOHygTzAJuBnUj+MyPe64KHTYikipt3TY=;
+
+  meta = with lib; {
+    description = "Command-line tool to download nicovideo.jp livestreams";
+    homepage = "https://github.com/himananiito/livedl";
+    license = licenses.mit;
+    maintainers = with maintainers; [ wakira ];
+    platforms = platforms.linux ++ platforms.darwin;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0865b3716e9f..fa5027b8ef0d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -28163,6 +28163,8 @@ in
   };
   litecoind = litecoin.override { withGui = false; };
 
+  livedl = callPackage ../tools/misc/livedl { };
+
   lnd = callPackage ../applications/blockchains/lnd.nix { };
 
   lndconnect = callPackage ../applications/blockchains/lndconnect { };

From 68889ed61f6cf04ebb7a71de1ce49bab3c52f964 Mon Sep 17 00:00:00 2001
From: Pavol Rusnak <pavol@rusnak.io>
Date: Sun, 20 Jun 2021 16:26:23 +0200
Subject: [PATCH 181/416] treewide: use quotes for url

---
 lib/licenses.nix                                      | 2 +-
 pkgs/development/mobile/androidenv/examples/shell.nix | 4 ++--
 pkgs/os-specific/linux/dstat/default.nix              | 2 +-
 pkgs/servers/mail/mailman/default.nix                 | 4 ++--
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/lib/licenses.nix b/lib/licenses.nix
index 3c4323e3d960..4792f1cb5925 100644
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@@ -742,7 +742,7 @@ lib.mapAttrs (n: v: v // { shortName = n; }) ({
   stk = {
     shortName = "stk";
     fullName = "Synthesis Tool Kit 4.3";
-    url = https://github.com/thestk/stk/blob/master/LICENSE;
+    url = "https://github.com/thestk/stk/blob/master/LICENSE";
   };
 
   tcltk = spdx {
diff --git a/pkgs/development/mobile/androidenv/examples/shell.nix b/pkgs/development/mobile/androidenv/examples/shell.nix
index 45cccf22c7df..074dfc001e68 100644
--- a/pkgs/development/mobile/androidenv/examples/shell.nix
+++ b/pkgs/development/mobile/androidenv/examples/shell.nix
@@ -3,7 +3,7 @@
   # This example pins nixpkgs: https://nix.dev/tutorials/towards-reproducibility-pinning-nixpkgs.html
   /*nixpkgsSource ? (builtins.fetchTarball {
     name = "nixpkgs-20.09";
-    url = https://github.com/NixOS/nixpkgs/archive/20.09.tar.gz;
+    url = "https://github.com/NixOS/nixpkgs/archive/20.09.tar.gz";
     sha256 = "1wg61h4gndm3vcprdcg7rc4s1v3jkm5xd7lw8r2f67w502y94gcy";
   }),
   pkgs ? import nixpkgsSource {},
@@ -41,7 +41,7 @@ let
   # If you copy this example out of nixpkgs, something like this will work:
   /*androidEnvNixpkgs = fetchTarball {
     name = "androidenv";
-    url = https://github.com/NixOS/nixpkgs/archive/<fill me in from Git>.tar.gz;
+    url = "https://github.com/NixOS/nixpkgs/archive/<fill me in from Git>.tar.gz";
     sha256 = "<fill me in with nix-prefetch-url --unpack>";
   };
 
diff --git a/pkgs/os-specific/linux/dstat/default.nix b/pkgs/os-specific/linux/dstat/default.nix
index 9f0afd6c2bd2..d79f9f4c61bf 100644
--- a/pkgs/os-specific/linux/dstat/default.nix
+++ b/pkgs/os-specific/linux/dstat/default.nix
@@ -18,7 +18,7 @@ python3Packages.buildPythonApplication rec {
     ./fix_pluginpath.patch
     # this fixes another bug with python3
     (fetchpatch {
-      url = https://github.com/efexgee/dstat/commit/220a785321b13b6df92a536080aca6ef1cb644ad.patch ;
+      url = "https://github.com/efexgee/dstat/commit/220a785321b13b6df92a536080aca6ef1cb644ad.patch";
       sha256 = "08kcz3yxvl35m55y7g1pr73x3bjcqnv0qlswxqyq8cqxg9zd64cn";
     })
   ];
diff --git a/pkgs/servers/mail/mailman/default.nix b/pkgs/servers/mail/mailman/default.nix
index 392239a71402..3ef9cafebaf0 100644
--- a/pkgs/servers/mail/mailman/default.nix
+++ b/pkgs/servers/mail/mailman/default.nix
@@ -22,11 +22,11 @@ buildPythonPackage rec {
 
   patches = [
     (fetchpatch {
-      url = https://gitlab.com/mailman/mailman/-/commit/4b206e2a5267a0e17f345fd7b2d957122ba57566.patch;
+      url = "https://gitlab.com/mailman/mailman/-/commit/4b206e2a5267a0e17f345fd7b2d957122ba57566.patch";
       sha256 = "06axmrn74p81wvcki36c7gfj5fp5q15zxz2yl3lrvijic7hbs4n2";
     })
     (fetchpatch {
-      url = https://gitlab.com/mailman/mailman/-/commit/9613154f3c04fa2383fbf017031ef263c291418d.patch;
+      url = "https://gitlab.com/mailman/mailman/-/commit/9613154f3c04fa2383fbf017031ef263c291418d.patch";
       sha256 = "0vyw87s857vfxbf7kihwb6w094xyxmxbi1bpdqi3ybjamjycp55r";
     })
     ./log-stderr.patch

From c137cf6fa52393f99772a23975054845522c3973 Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Sun, 20 Jun 2021 21:27:10 +0700
Subject: [PATCH 182/416] ticker: 4.0.3 -> 4.2.0

---
 pkgs/applications/misc/ticker/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/misc/ticker/default.nix b/pkgs/applications/misc/ticker/default.nix
index fd37a692d841..a3e2dc11c6f7 100644
--- a/pkgs/applications/misc/ticker/default.nix
+++ b/pkgs/applications/misc/ticker/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "ticker";
-  version = "4.0.3";
+  version = "4.2.0";
 
   src = fetchFromGitHub {
     owner = "achannarasappa";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-YVpspFBwao/7M2nTVMw+ANc0roL0vBO4DpNUb7Thp3Q=";
+    sha256 = "sha256-FavbBGmChWQ3xySPHlw5HisZwVaNe/NaxA6+InN8fL8=";
   };
 
-  vendorSha256 = "sha256-nidOIjrTL4llV5GORebXOOPGeL6TxkurDY82cIc7+mU=";
+  vendorSha256 = "sha256-XBfTVd3X3IDxLCAaNnijf6E5bw+AZ94UdOG9w7BOdBU=";
 
   preBuild = ''
     buildFlagsArray+=("-ldflags" "-s -w -X github.com/achannarasappa/ticker/cmd.Version=v${version}")

From 3e8fb944c24f1e6761e94a66aa7d347053375ea3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B8rn=20Forsman?= <bjorn.forsman@gmail.com>
Date: Sun, 20 Jun 2021 16:31:31 +0200
Subject: [PATCH 183/416] gnuradio.pkgs.ais: 2015-12-20 -> 2020-08-13

This adds support for GR3.8.
---
 .../development/gnuradio-modules/ais/default.nix | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/gnuradio-modules/ais/default.nix b/pkgs/development/gnuradio-modules/ais/default.nix
index 5ff4ffd75653..638210f8412f 100644
--- a/pkgs/development/gnuradio-modules/ais/default.nix
+++ b/pkgs/development/gnuradio-modules/ais/default.nix
@@ -8,18 +8,22 @@
 , cppunit
 , log4cpp
 , osmosdr
+, gmp
+, mpir
+, fftwFloat
+, icu
 }:
 
 mkDerivation rec {
   pname = "gr-ais";
-  version = "2015-12-20";
+  version = "2020-08-13";
   src = fetchFromGitHub {
     owner = "bistromath";
     repo = "gr-ais";
-    rev = "cdc1f52745853f9c739c718251830eb69704b26e";
-    sha256 = "1vl3kk8xr2mh5lf31zdld7yzmwywqffffah8iblxdzblgsdwxfl6";
+    rev = "2162103226f3dae43c8c2ab23b79483b84346665";
+    sha256 = "1vackka34722d8pcspfwj0j6gc9ic7dqq64sgkrpjm94sh3bmb0b";
   };
-  disabledForGRafter = "3.8";
+  disabledForGRafter = "3.9";
 
   nativeBuildInputs = [
     cmake
@@ -32,6 +36,10 @@ mkDerivation rec {
     osmosdr
     boost
     log4cpp
+    gmp
+    mpir
+    fftwFloat
+    icu
   ];
 
   meta = with lib; {

From 56e72223d9f7faaf6da31c4ff02f6e163a546843 Mon Sep 17 00:00:00 2001
From: Troels Henriksen <athas@sigkill.dk>
Date: Sun, 20 Jun 2021 16:25:01 +0200
Subject: [PATCH 184/416] mosml: dontPatchElf = true

This is because MosML needs the bin/camlrunm binary to have a
carefully calibrated RPATH pointing at its installation directory, and
patchelf will remove this.

Without this fix, MosML cannot dynamically load its own libraries
(most notably the "Unix" module).
---
 pkgs/development/compilers/mosml/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/compilers/mosml/default.nix b/pkgs/development/compilers/mosml/default.nix
index f6d2053f315c..e7dc9ceae6d9 100644
--- a/pkgs/development/compilers/mosml/default.nix
+++ b/pkgs/development/compilers/mosml/default.nix
@@ -15,6 +15,10 @@ stdenv.mkDerivation rec {
 
   setSourceRoot = ''export sourceRoot="$(echo */src)"'';
 
+  # MosML needs a specific RPATH entry pointing to $(out)/lib (added
+  # by the build system), which patchelf will remove.
+  dontPatchELF = true;
+
   meta = with lib; {
     description = "A light-weight implementation of Standard ML";
     longDescription = ''

From e0248869674810c4e55efb948c31836bd7e6e462 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 21:54:10 +0200
Subject: [PATCH 185/416] python3Packages.google-cloud-datastore: 2.1.0 ->
 2.1.3

---
 .../python-modules/google-cloud-datastore/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-datastore/default.nix b/pkgs/development/python-modules/google-cloud-datastore/default.nix
index 4c8c79c7ddae..79a97b692896 100644
--- a/pkgs/development/python-modules/google-cloud-datastore/default.nix
+++ b/pkgs/development/python-modules/google-cloud-datastore/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-datastore";
-  version = "2.1.0";
+  version = "2.1.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1yyk9ix1jms5q4kk76cfxzy42wzzyl5qladdswjy5l0pg6iypr8i";
+    sha256 = "sha256-56UQdZudVf9jyYPjxCy/XDX5tzEPTWEevjaX2mV2vLQ=";
   };
 
   propagatedBuildInputs = [ google-api-core google-cloud-core libcst proto-plus ];

From 948b98ab93c65d64fe33355af68a5603dbddd302 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 21:54:13 +0200
Subject: [PATCH 186/416] python3Packages.google-cloud-websecurityscanner:
 1.1.0 -> 1.2.0

---
 .../google-cloud-websecurityscanner/default.nix               | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix b/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix
index 971f5cce90e7..5598a98cf839 100644
--- a/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix
+++ b/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-websecurityscanner";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-lrMnp9jVndz0C8VdreVudYdwh7zSdRniPHYm9BNdjak=";
+    sha256 = "sha256-Lg6yoqOu88lZHT/H9FPdgVgSDm7oLUaPm7T1UsXB8Fo=";
   };
 
   propagatedBuildInputs = [ google-api-core libcst proto-plus ];

From 7114eb9356510e73a1ddf126ee94aab0acfd6e01 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 21:54:15 +0200
Subject: [PATCH 187/416] python3Packages.google-cloud-vision: 2.3.0 -> 2.3.1

---
 .../python-modules/google-cloud-vision/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-vision/default.nix b/pkgs/development/python-modules/google-cloud-vision/default.nix
index 5857de341d29..2a98edced7a9 100644
--- a/pkgs/development/python-modules/google-cloud-vision/default.nix
+++ b/pkgs/development/python-modules/google-cloud-vision/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-vision";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-6XYHADzyk0/WSGk9wni9bOtVURJ+U2Eve8LAh0Eg7KI=";
+    sha256 = "sha256-Nnqm+f2OSKBRTOpuB7PQBvAaunCA8XoontDfkuh/f4Q=";
   };
 
   propagatedBuildInputs = [ libcst google-api-core proto-plus];

From 01a4c1ee20d94079fd6c50d9fc6b0de364922844 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 21:54:18 +0200
Subject: [PATCH 188/416] python3Packages.google-cloud-videointelligence: 2.1.0
 -> 2.2.0

---
 .../python-modules/google-cloud-videointelligence/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-videointelligence/default.nix b/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
index f56b00af0a54..c68db2bfece9 100644
--- a/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
+++ b/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-videointelligence";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-gn/KWf3A4SkTqt9rqwYcsaxvfKXPvb7DXJ+zryGjWIA=";
+    sha256 = "sha256-CBBt3uyQon9Lxwb3Jn7BxS8r/3Rbr9RxC8aJhGDI6aY=";
   };
 
   propagatedBuildInputs = [ google-api-core proto-plus ];

From c572173400f1334f77b61075c9181e0759f800e2 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 21:54:20 +0200
Subject: [PATCH 189/416] python3Packages.google-cloud-translate: 3.1.0 ->
 3.2.0

---
 .../python-modules/google-cloud-translate/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-translate/default.nix b/pkgs/development/python-modules/google-cloud-translate/default.nix
index a884919c7e18..beae78331abd 100644
--- a/pkgs/development/python-modules/google-cloud-translate/default.nix
+++ b/pkgs/development/python-modules/google-cloud-translate/default.nix
@@ -14,11 +14,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-translate";
-  version = "3.1.0";
+  version = "3.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-zVRD2lWRaKtSlZn84Rqpj+a1OT7Wcak524TKsBctueE=";
+    sha256 = "sha256-jNlX9LKajHqYPgpCfCcSUzxBu3AHt2qMyI1sZQdcZ5o=";
   };
 
   propagatedBuildInputs = [ google-api-core google-cloud-core libcst proto-plus ];

From f8f671e3165dd6ae045e301e474338df6e9cfc32 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 21:54:22 +0200
Subject: [PATCH 190/416] python3Packages.google-cloud-trace: 1.1.0 -> 1.2.0

---
 .../development/python-modules/google-cloud-trace/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-trace/default.nix b/pkgs/development/python-modules/google-cloud-trace/default.nix
index 486a71c7a97e..9f814c36c2b3 100644
--- a/pkgs/development/python-modules/google-cloud-trace/default.nix
+++ b/pkgs/development/python-modules/google-cloud-trace/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-trace";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1lvcm4w1l7hiqg64kdscch3f3bq19q9ii49xj4lljn2a4xffxl8v";
+    sha256 = "sha256-NoNHel10dFEzKjjWyM6mUrWZHbH25MOZB/o2eXCKwhg=";
   };
 
   propagatedBuildInputs = [ google-api-core google-cloud-core proto-plus ];

From cb70eda211dc997ab09016636e3a735db196fb0c Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 21:54:24 +0200
Subject: [PATCH 191/416] python3Packages.google-cloud-texttospeech: 2.3.0 ->
 2.4.0

---
 .../python-modules/google-cloud-texttospeech/default.nix      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-texttospeech/default.nix b/pkgs/development/python-modules/google-cloud-texttospeech/default.nix
index ab4415e3412b..f1cbf3f307ab 100644
--- a/pkgs/development/python-modules/google-cloud-texttospeech/default.nix
+++ b/pkgs/development/python-modules/google-cloud-texttospeech/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-texttospeech";
-  version = "2.3.0";
+  version = "2.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-zzssVnXA1xe3270yEOREJ9GdmyRPjV1F4EBelf9AQ/c=";
+    sha256 = "sha256-xQzCG134i2lmgNiqw6tshoIMDk0HHWpdzZtjSkVs9Z8=";
   };
 
   propagatedBuildInputs = [ libcst google-api-core proto-plus ];

From f741a7786c3f98d500be07e4d4fd61d43cdc15ab Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 21:54:27 +0200
Subject: [PATCH 192/416] python3Packages.google-cloud-tasks: 2.2.0 -> 2.3.0

---
 .../development/python-modules/google-cloud-tasks/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-tasks/default.nix b/pkgs/development/python-modules/google-cloud-tasks/default.nix
index c01c294ec334..d04c996acf91 100644
--- a/pkgs/development/python-modules/google-cloud-tasks/default.nix
+++ b/pkgs/development/python-modules/google-cloud-tasks/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-tasks";
-  version = "2.2.0";
+  version = "2.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6be2f2bca14b4eb1c1bdb0f4ba1dadf791e79a2a3e1fae762e5631a3d9fe094e";
+    sha256 = "sha256-fMJNOJBzxAr0Hi/AkUF97G5YrwfbmxKVhT/D1UXIDP4=";
   };
 
   propagatedBuildInputs = [ google-api-core grpc_google_iam_v1 libcst proto-plus ];

From f94f0037d882b5d79999eb517b11ef24d6b83f28 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 21:54:29 +0200
Subject: [PATCH 193/416] python3Packages.google-cloud-storage: 1.37.0 ->
 1.38.0

---
 .../python-modules/google-cloud-storage/default.nix           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-storage/default.nix b/pkgs/development/python-modules/google-cloud-storage/default.nix
index 40d70176c5d6..e54a52479828 100644
--- a/pkgs/development/python-modules/google-cloud-storage/default.nix
+++ b/pkgs/development/python-modules/google-cloud-storage/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-storage";
-  version = "1.37.0";
+  version = "1.38.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-IAPF7Uc/mzfQRfMMTIvn0w19Dripe80sWLOovFScTMw=";
+    sha256 = "sha256-FiAR1m9kuNxdeTZgml2vAGbMUhIxVGrqAsEmpVWURsQ=";
   };
 
   propagatedBuildInputs = [

From 0be36c48f844ef5aa0fdc7ba582eb196e7dfddb1 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 21:54:32 +0200
Subject: [PATCH 194/416] python3Packages.google-cloud-speech: 2.2.1 -> 2.4.0

---
 .../python-modules/google-cloud-speech/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-speech/default.nix b/pkgs/development/python-modules/google-cloud-speech/default.nix
index 2261345f4205..bccc2ad8bac9 100644
--- a/pkgs/development/python-modules/google-cloud-speech/default.nix
+++ b/pkgs/development/python-modules/google-cloud-speech/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-speech";
-  version = "2.2.1";
+  version = "2.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-AviYDI68Z11M/rqHgQTQugYNemPTA5nW4aVQTiwMYxI=";
+    sha256 = "sha256-mR7gYBvJVhEOhzruGnREHWYiexDNWBGVV1Q1iEOE84s=";
   };
 
   propagatedBuildInputs = [ libcst google-api-core proto-plus ];

From 78885cd668ee16ef636b7ce0f68821127a5ec1af Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 21:54:34 +0200
Subject: [PATCH 195/416] python3Packages.google-cloud-spanner: 3.3.0 -> 3.4.0

---
 .../python-modules/google-cloud-spanner/default.nix           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-spanner/default.nix b/pkgs/development/python-modules/google-cloud-spanner/default.nix
index 726e48ee192b..e1f059810296 100644
--- a/pkgs/development/python-modules/google-cloud-spanner/default.nix
+++ b/pkgs/development/python-modules/google-cloud-spanner/default.nix
@@ -14,11 +14,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-spanner";
-  version = "3.3.0";
+  version = "3.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-XnOCmxQ6YCO1C7RYHzcZY4ihrt2KommWTkTD9y+B5tg=";
+    sha256 = "sha256-8o7pr9msuMfIN7UMX+/gppmD3MWXt2hBqb7vcLUE22M=";
   };
 
   propagatedBuildInputs = [ google-cloud-core grpc_google_iam_v1 libcst proto-plus sqlparse ];

From 821ddae74de9a992a300daa9e75a75f345b0cc26 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 21:54:37 +0200
Subject: [PATCH 196/416] python3Packages.google-cloud-securitycenter: 1.1.0 ->
 1.3.0

---
 .../python-modules/google-cloud-securitycenter/default.nix    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-securitycenter/default.nix b/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
index 184044594d52..ac630ba27c4d 100644
--- a/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
+++ b/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-securitycenter";
-  version = "1.1.0";
+  version = "1.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1lgz6qpsfv4b7p5ff4sdpjpaddxpbazdvlcrqr1i0c0qil2lkm2i";
+    sha256 = "sha256-cyJ58BPB7mYWbmHFxPAxnf2JX0b8kqLJF4hdcppaNNI=";
   };
 
   propagatedBuildInputs = [ grpc_google_iam_v1 google-api-core libcst proto-plus ];

From 8ad627e6dfeed891043bade304e7d837893f6d8a Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 21:54:39 +0200
Subject: [PATCH 197/416] python3Packages.google-cloud-runtimeconfig: 0.32.1 ->
 0.32.2

---
 .../python-modules/google-cloud-runtimeconfig/default.nix     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-runtimeconfig/default.nix b/pkgs/development/python-modules/google-cloud-runtimeconfig/default.nix
index 0a3285566f19..588918ad62e9 100644
--- a/pkgs/development/python-modules/google-cloud-runtimeconfig/default.nix
+++ b/pkgs/development/python-modules/google-cloud-runtimeconfig/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-runtimeconfig";
-  version = "0.32.1";
+  version = "0.32.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1bd8hlp0ssi20ds4gknbxai8mih6xiz8b60ab7p0ngpdqp1kw52p";
+    sha256 = "sha256-UoWu+Y/bmmkefFR4nnxJPFFnS253/myWcXKujq27oCY=";
   };
 
   propagatedBuildInputs = [ google-api-core google-cloud-core ];

From b31af10da0942bb00c8c59d1ca93145a0dc926d4 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 21:54:42 +0200
Subject: [PATCH 198/416] python3Packages.google-cloud-redis: 2.1.0 -> 2.1.1

---
 .../development/python-modules/google-cloud-redis/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-redis/default.nix b/pkgs/development/python-modules/google-cloud-redis/default.nix
index 8787eb6779a1..9070d2f083e5 100644
--- a/pkgs/development/python-modules/google-cloud-redis/default.nix
+++ b/pkgs/development/python-modules/google-cloud-redis/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-redis";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "957f436986275dcc82483906b424dcabe8d1f8c08ae5c9677bf7547a314b0a59";
+    sha256 = "sha256-2X/ek2ECarZ/U1V6j+nz2yYSGVmrWG/kU/QqQB1A+0w=";
   };
 
   propagatedBuildInputs = [ google-api-core libcst proto-plus ];

From 36c03a2bbc966d502e524f082412cc9a569bf18a Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 21:54:44 +0200
Subject: [PATCH 199/416] python3Packages.google-cloud-pubsub: 2.4.1 -> 2.5.0

---
 .../python-modules/google-cloud-pubsub/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-pubsub/default.nix b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
index 1a11fcfc731b..27eee2507a74 100644
--- a/pkgs/development/python-modules/google-cloud-pubsub/default.nix
+++ b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-pubsub";
-  version = "2.4.1";
+  version = "2.5.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-5gyqZ+JthC/Qja8ZCX79r4K+evuZY5jPZ73cA6hrgSA=";
+    sha256 = "sha256-hwZVe3FTLHauxIQJ3KwYnKrEfPLey4hQrnVpS/cDJrI=";
   };
 
   propagatedBuildInputs = [ grpc_google_iam_v1 google-api-core libcst proto-plus ];

From f0c7aae1f9a0f5fa278f1609a2d25fff214d905c Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 21:54:47 +0200
Subject: [PATCH 200/416] python3Packages.google-cloud-org-policy: 0.2.0 ->
 0.3.0

---
 .../python-modules/google-cloud-org-policy/default.nix        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-org-policy/default.nix b/pkgs/development/python-modules/google-cloud-org-policy/default.nix
index 7ca698b66452..56932ec48598 100644
--- a/pkgs/development/python-modules/google-cloud-org-policy/default.nix
+++ b/pkgs/development/python-modules/google-cloud-org-policy/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-org-policy";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b463704affab327c1d3fa4af280a858635b5f59a88456b2a08db62a336a352aa";
+    sha256 = "sha256-7qVemc7siW/8mO4wUXEKJBt9M18kagRyu/+7DLLe9FM=";
   };
 
   propagatedBuildInputs = [ google-api-core proto-plus ];

From fdf0f02312938f7c5c101871af0960555700dafa Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 21:54:50 +0200
Subject: [PATCH 201/416] python3Packages.google-cloud-logging: 2.3.1 -> 2.4.0

---
 .../python-modules/google-cloud-logging/default.nix           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-logging/default.nix b/pkgs/development/python-modules/google-cloud-logging/default.nix
index 55efb8e2c2d4..458d5b720c02 100644
--- a/pkgs/development/python-modules/google-cloud-logging/default.nix
+++ b/pkgs/development/python-modules/google-cloud-logging/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-logging";
-  version = "2.3.1";
+  version = "2.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-yi3lG7tKi2BkU7vtMIEPsll1UX/JxrNj4G+DJaGQ/+k=";
+    sha256 = "sha256-BuAqNkK817Zz4dbI16ttoVnapR+8DDrp8RGDZtUej7s=";
   };
 
   propagatedBuildInputs = [ google-api-core google-cloud-core proto-plus ];

From ba99c88c0d31df75d5e03e8acc6a9f32dce7666f Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 21:54:53 +0200
Subject: [PATCH 202/416] python3Packages.google-cloud-iam: 2.1.0 -> 2.2.0

---
 pkgs/development/python-modules/google-cloud-iam/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-iam/default.nix b/pkgs/development/python-modules/google-cloud-iam/default.nix
index 243c2b86c1ee..ddcc20c66bc4 100644
--- a/pkgs/development/python-modules/google-cloud-iam/default.nix
+++ b/pkgs/development/python-modules/google-cloud-iam/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-iam";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d34604508e3e87b9161ccd5ff29474867ac91ffb8d29e1a2fc9ff0e26d934b73";
+    sha256 = "sha256-H2S3jIVMBinyCQMBHW3vKMmBzlaCpSIQMfauHKoKH+o=";
   };
 
   propagatedBuildInputs = [ google-api-core libcst proto-plus ];

From 9f16f8f6be9a49f35ad42735c52c9c9d3c8d09f2 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 21:54:56 +0200
Subject: [PATCH 203/416] python3Packages.google-cloud-firestore: 2.1.0 ->
 2.1.1

---
 .../python-modules/google-cloud-firestore/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-firestore/default.nix b/pkgs/development/python-modules/google-cloud-firestore/default.nix
index f0aac21ee317..92922fcc403f 100644
--- a/pkgs/development/python-modules/google-cloud-firestore/default.nix
+++ b/pkgs/development/python-modules/google-cloud-firestore/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-firestore";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-kG68fG9EqwvE72nzc89MXwEQ/YYEM9tYH6zK2iTCFJo=";
+    sha256 = "sha256-73sKlKHX7ThsdZJyT22wiqbema7o3aOIaWS8WYrri+w=";
   };
 
   propagatedBuildInputs = [

From bc65bb0bdd0d79d1501e287ea1731dc160320fa7 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 21:54:59 +0200
Subject: [PATCH 204/416] python3Packages.google-cloud-dlp: 3.0.1 -> 3.1.0

---
 pkgs/development/python-modules/google-cloud-dlp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-dlp/default.nix b/pkgs/development/python-modules/google-cloud-dlp/default.nix
index 47f0522e1a6c..4674c1ce1dd1 100644
--- a/pkgs/development/python-modules/google-cloud-dlp/default.nix
+++ b/pkgs/development/python-modules/google-cloud-dlp/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-dlp";
-  version = "3.0.1";
+  version = "3.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "193c2c012639f0c063999e0b899f92d70763be605d5528f3d1da93d6734a1aa8";
+    sha256 = "sha256-sPSPx5Y36MOjd81D8qDMpkWJ3YWQfRlEHqBn3N75NB4=";
   };
 
   propagatedBuildInputs = [ google-api-core libcst proto-plus ];

From 1a25e924f8279208f02bfafb9ececadbbc15daea Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 21:55:03 +0200
Subject: [PATCH 205/416] python3Packages.google-cloud-dataproc: 2.3.1 -> 2.4.0

---
 .../python-modules/google-cloud-dataproc/default.nix          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-dataproc/default.nix b/pkgs/development/python-modules/google-cloud-dataproc/default.nix
index 0115524d5467..c7dce6cba118 100644
--- a/pkgs/development/python-modules/google-cloud-dataproc/default.nix
+++ b/pkgs/development/python-modules/google-cloud-dataproc/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-dataproc";
-  version = "2.3.1";
+  version = "2.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-TADApBkE4DvEFkVFy56Flh2s6XR9uGxzGTf5aspohsA=";
+    sha256 = "sha256-blNz/r5CDisjddIlKychKfEaN/8biKdYcyKTEGO+jTg=";
   };
 
   propagatedBuildInputs = [ google-api-core libcst proto-plus ];

From d1377b3c4117c219a954db31298dc95de62a53f1 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 21:55:06 +0200
Subject: [PATCH 206/416] python3Packages.google-cloud-container: 2.4.0 ->
 2.4.1

---
 .../python-modules/google-cloud-container/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-container/default.nix b/pkgs/development/python-modules/google-cloud-container/default.nix
index ce21a27209fd..d3fea60d33b3 100644
--- a/pkgs/development/python-modules/google-cloud-container/default.nix
+++ b/pkgs/development/python-modules/google-cloud-container/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-container";
-  version = "2.4.0";
+  version = "2.4.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c62d15f58459fbe83ba5789f800ac27b4be9a1d7735f6c6b702cd6c3f8c6f0c9";
+    sha256 = "sha256-59k8o5ndb7X9D5kZAkhTHJxYPRqF580snuSFSVRZ7ng=";
   };
 
   propagatedBuildInputs = [ google-api-core grpc_google_iam_v1 libcst proto-plus ];

From 142a510dd8f07dcd250a067b673d21d0026d32fa Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 21:55:08 +0200
Subject: [PATCH 207/416] python3Packages.google-cloud-bigtable: 1.7.0 -> 2.2.0

---
 .../python-modules/google-cloud-bigtable/default.nix          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-bigtable/default.nix b/pkgs/development/python-modules/google-cloud-bigtable/default.nix
index 786250ce9e15..67c6ebde4237 100644
--- a/pkgs/development/python-modules/google-cloud-bigtable/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigtable/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigtable";
-  version = "1.7.0";
+  version = "2.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "90bd53a19c33c34101b8567c82a6dc0386af4118d70e1ad69b49375358a21aa6";
+    sha256 = "sha256-89fXmr3jHTtp8QOMFeueJwslHJ7Q6srQ/Kxsp0mLlKU=";
   };
 
   checkInputs = [ pytest mock ];

From 8e9f602cf33e8c87d18f3ba1cd0381f5f1963624 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 21:55:11 +0200
Subject: [PATCH 208/416] python3Packages.google-cloud-bigquery-datatransfer:
 3.1.0 -> 3.1.1

---
 .../google-cloud-bigquery-datatransfer/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix b/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
index 8aff49154721..c7df1160631b 100644
--- a/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigquery-datatransfer";
-  version = "3.1.0";
+  version = "3.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "98065257189388b6cc797478c4b2bdf86e9e8cdcaca5d170ded027646444a586";
+    sha256 = "sha256-msjNBqYL/cUE85+80IblGAyGhM/+/ndFqf9qY5xXVik=";
   };
 
   propagatedBuildInputs = [ google-api-core libcst proto-plus ];

From 14b93efeca04611bc0ddb84601a265b2378ec59e Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 21:55:13 +0200
Subject: [PATCH 209/416] python3Packages.google-cloud-bigquery: 2.13.1 ->
 2.18.0

---
 .../python-modules/google-cloud-bigquery/default.nix          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-bigquery/default.nix b/pkgs/development/python-modules/google-cloud-bigquery/default.nix
index 0c62727ff8ac..59ebc2adeebe 100644
--- a/pkgs/development/python-modules/google-cloud-bigquery/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigquery/default.nix
@@ -17,11 +17,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigquery";
-  version = "2.13.1";
+  version = "2.18.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "915f93c61c03d1d6024d5b19355bb96af25da9f924d0b5bab5cde851e1bd48f4";
+    sha256 = "sha256-0JLyWfQKN7kYnXW/DRJp3ZH+EesLv7/CXJPmxXYtb4M=";
   };
 
   propagatedBuildInputs = [

From b38b5f705767754d8c707e64f6d0b99b37a96679 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 21:55:15 +0200
Subject: [PATCH 210/416] python3Packages.google-cloud-automl: 2.2.0 -> 2.3.0

---
 .../python-modules/google-cloud-automl/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-automl/default.nix b/pkgs/development/python-modules/google-cloud-automl/default.nix
index 94516e25a38d..0bab9ce64870 100644
--- a/pkgs/development/python-modules/google-cloud-automl/default.nix
+++ b/pkgs/development/python-modules/google-cloud-automl/default.nix
@@ -14,11 +14,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-automl";
-  version = "2.2.0";
+  version = "2.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "874defad583e90e55a3e83aff27eb5fe108d9197d839cd45f3eacf2395881806";
+    sha256 = "sha256-UjYzSWtP4cp0p7Is2qIGWBgEhjgTv0YeL0N9D7etIbY=";
   };
 
   propagatedBuildInputs = [ google-api-core libcst proto-plus ];

From 76d16b5151201a657858374c830c9763001f1388 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 21:55:18 +0200
Subject: [PATCH 211/416] python3Packages.google-cloud-access-context-manager:
 0.1.2 -> 0.1.3

---
 .../google-cloud-access-context-manager/default.nix           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-access-context-manager/default.nix b/pkgs/development/python-modules/google-cloud-access-context-manager/default.nix
index 3f614258a8fb..dd1dd0e34d12 100644
--- a/pkgs/development/python-modules/google-cloud-access-context-manager/default.nix
+++ b/pkgs/development/python-modules/google-cloud-access-context-manager/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-access-context-manager";
-  version = "0.1.2";
+  version = "0.1.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1qy7wv1xn7g3x5z0vvv0pwmxhin4hw2m9fs9iklnghy00vg37v0b";
+    sha256 = "sha256-VFPmTKiFwwL1THpjDeFeHgssXvIRB+ppvZb9aU1yPV4=";
   };
 
   propagatedBuildInputs = [ google-api-core ];

From de44d6a6682d718376230b0a3d5cd2dabaac1827 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 22:28:48 +0200
Subject: [PATCH 212/416] python3Packages.google-cloud-iam-logging: init at
 0.1.0

---
 .../google-cloud-iam-logging/default.nix      | 45 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 47 insertions(+)
 create mode 100644 pkgs/development/python-modules/google-cloud-iam-logging/default.nix

diff --git a/pkgs/development/python-modules/google-cloud-iam-logging/default.nix b/pkgs/development/python-modules/google-cloud-iam-logging/default.nix
new file mode 100644
index 000000000000..55d36ac2a7c7
--- /dev/null
+++ b/pkgs/development/python-modules/google-cloud-iam-logging/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, google-api-core
+, grpc_google_iam_v1
+, mock
+, proto-plus
+, pytest-asyncio
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "google-cloud-iam-logging";
+  version = "0.1.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "19a8s634w2m1b16zq8f185cpaw7k6d0c7c61g1vzm19jl213rhiw";
+  };
+
+  propagatedBuildInputs = [
+    google-api-core
+    grpc_google_iam_v1
+    proto-plus
+  ];
+
+  checkInputs = [
+    mock
+    pytestCheckHook
+    pytest-asyncio
+  ];
+
+  pythonImportsCheck = [
+    "google.cloud.iam_logging"
+    "google.cloud.iam_logging_v1"
+  ];
+
+  meta = with lib; {
+    description = "IAM Service Logging client library";
+    homepage = "https://github.com/googleapis/python-iam-logging";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 7d212cb5ea0e..41a5a9a4adc7 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2938,6 +2938,8 @@ in {
 
   google-cloud-iam = callPackage ../development/python-modules/google-cloud-iam { };
 
+  google-cloud-iam-logging = callPackage ../development/python-modules/google-cloud-iam-logging { };
+
   google-cloud-iot = callPackage ../development/python-modules/google-cloud-iot { };
 
   google-cloud-kms = callPackage ../development/python-modules/google-cloud-kms { };

From 310b8ea9122a0570ea113fea3bc245aec71d5d43 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 22:31:49 +0200
Subject: [PATCH 213/416] python3Packages.google-cloud-bigquery-logging: init
 at 0.1.0

---
 .../google-cloud-bigquery-logging/default.nix | 45 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 47 insertions(+)
 create mode 100644 pkgs/development/python-modules/google-cloud-bigquery-logging/default.nix

diff --git a/pkgs/development/python-modules/google-cloud-bigquery-logging/default.nix b/pkgs/development/python-modules/google-cloud-bigquery-logging/default.nix
new file mode 100644
index 000000000000..566c566bbe48
--- /dev/null
+++ b/pkgs/development/python-modules/google-cloud-bigquery-logging/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, google-api-core
+, grpc_google_iam_v1
+, mock
+, proto-plus
+, pytest-asyncio
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "google-cloud-bigquery-logging";
+  version = "0.1.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0s8vlw157z10yzzkrfyzfl31iad96wfl3ywk9g3gmmh0jfgy0gfj";
+  };
+
+  propagatedBuildInputs = [
+    google-api-core
+    grpc_google_iam_v1
+    proto-plus
+  ];
+
+  checkInputs = [
+    mock
+    pytestCheckHook
+    pytest-asyncio
+  ];
+
+  pythonImportsCheck = [
+    "google.cloud.bigquery_logging"
+    "google.cloud.bigquery_logging_v1"
+  ];
+
+  meta = with lib; {
+    description = "Bigquery logging client library";
+    homepage = "https://github.com/googleapis/python-bigquery-logging";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 41a5a9a4adc7..75af2cb89c34 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2918,6 +2918,8 @@ in {
 
   google-cloud-bigquery-datatransfer = callPackage ../development/python-modules/google-cloud-bigquery-datatransfer { };
 
+  google-cloud-bigquery-logging = callPackage ../development/python-modules/google-cloud-bigquery-logging { };
+
   google-cloud-bigtable = callPackage ../development/python-modules/google-cloud-bigtable { };
 
   google-cloud-container = callPackage ../development/python-modules/google-cloud-container { };

From 7b9b6f1e9156cfb589edf60d283d390f293493ad Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 22:35:17 +0200
Subject: [PATCH 214/416] python3Packages.google-cloud-appengine-logging: init
 at 0.1.0

---
 .../default.nix                               | 45 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 47 insertions(+)
 create mode 100644 pkgs/development/python-modules/google-cloud-appengine-logging/default.nix

diff --git a/pkgs/development/python-modules/google-cloud-appengine-logging/default.nix b/pkgs/development/python-modules/google-cloud-appengine-logging/default.nix
new file mode 100644
index 000000000000..556bc09ed6e5
--- /dev/null
+++ b/pkgs/development/python-modules/google-cloud-appengine-logging/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, google-api-core
+, grpc_google_iam_v1
+, mock
+, proto-plus
+, pytest-asyncio
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "google-cloud-appengine-logging";
+  version = "0.1.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0rkayy2qzsc70b0rdvzd2bxwp5f07rfqb95cyj57dkphq71mrrhw";
+  };
+
+  propagatedBuildInputs = [
+    google-api-core
+    grpc_google_iam_v1
+    proto-plus
+  ];
+
+  checkInputs = [
+    mock
+    pytestCheckHook
+    pytest-asyncio
+  ];
+
+  pythonImportsCheck = [
+    "google.cloud.appengine_logging"
+    "google.cloud.appengine_logging_v1"
+  ];
+
+  meta = with lib; {
+    description = "Appengine logging client library";
+    homepage = "https://github.com/googleapis/python-appengine-logging";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 75af2cb89c34..6d8f03d5dcc1 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2910,6 +2910,8 @@ in {
 
   google-cloud-access-context-manager = callPackage ../development/python-modules/google-cloud-access-context-manager { };
 
+  google-cloud-appengine-logging = callPackage ../development/python-modules/google-cloud-appengine-logging { };
+
   google-cloud-asset = callPackage ../development/python-modules/google-cloud-asset { };
 
   google-cloud-automl = callPackage ../development/python-modules/google-cloud-automl { };

From 61575575f2ffc5e7a00dbdce134e715a937736be Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 22:43:26 +0200
Subject: [PATCH 215/416] python3Packages.google-cloud-error-reporting: update
 substituteInPlace

---
 .../python-modules/google-cloud-error-reporting/default.nix     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/google-cloud-error-reporting/default.nix b/pkgs/development/python-modules/google-cloud-error-reporting/default.nix
index 8a481945efba..732c9aac81d8 100644
--- a/pkgs/development/python-modules/google-cloud-error-reporting/default.nix
+++ b/pkgs/development/python-modules/google-cloud-error-reporting/default.nix
@@ -21,7 +21,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace 'google-cloud-logging>=1.14.0, <2.1' 'google-cloud-logging>=1.14.0'
+      --replace 'google-cloud-logging>=1.14.0, <2.4' 'google-cloud-logging>=1.14.0'
   '';
 
   propagatedBuildInputs = [ google-cloud-logging libcst proto-plus ];

From 8c52d6d1ca8fa0f2ea5214534bd938960edfa998 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 22:47:44 +0200
Subject: [PATCH 216/416] python3Packages.google-cloud-asset: update
 substituteInPlace

---
 pkgs/development/python-modules/google-cloud-asset/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/google-cloud-asset/default.nix b/pkgs/development/python-modules/google-cloud-asset/default.nix
index bd8bdc0b8c31..61e69c5b29da 100644
--- a/pkgs/development/python-modules/google-cloud-asset/default.nix
+++ b/pkgs/development/python-modules/google-cloud-asset/default.nix
@@ -26,7 +26,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace '"google-cloud-org-policy >= 0.1.2, < 0.2.0dev"' '"google-cloud-org-policy >= 0.1.2, < 0.2.1"'
+      --replace '"google-cloud-org-policy >= 0.1.2, < 0.2.0dev"' '"google-cloud-org-policy >= 0.1.2"'
   '';
 
   propagatedBuildInputs = [

From 07ad761bfc6a6600bc0c466a34bd63fc892b9ec3 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 23:01:07 +0200
Subject: [PATCH 217/416] python3Packages.google-cloud-bigtable: fix build

---
 .../google-cloud-bigtable/default.nix         | 34 +++++++++++++++----
 1 file changed, 28 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-bigtable/default.nix b/pkgs/development/python-modules/google-cloud-bigtable/default.nix
index 67c6ebde4237..f7eb9a51a8a3 100644
--- a/pkgs/development/python-modules/google-cloud-bigtable/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigtable/default.nix
@@ -1,11 +1,13 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, grpc_google_iam_v1
 , google-api-core
 , google-cloud-core
-, pytest
+, grpc_google_iam_v1
+, libcst
 , mock
+, proto-plus
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -17,17 +19,37 @@ buildPythonPackage rec {
     sha256 = "sha256-89fXmr3jHTtp8QOMFeueJwslHJ7Q6srQ/Kxsp0mLlKU=";
   };
 
-  checkInputs = [ pytest mock ];
-  propagatedBuildInputs = [ grpc_google_iam_v1 google-api-core google-cloud-core ];
+  propagatedBuildInputs = [
+    google-api-core
+    google-cloud-core
+    grpc_google_iam_v1
+    libcst
+    proto-plus
+  ];
+
+  checkInputs = [
+    mock
+    pytestCheckHook
+  ];
 
   checkPhase = ''
+    # Prevent google directory from shadowing google imports
     rm -r google
-    pytest tests/unit -k 'not policy'
   '';
 
+  disabledTests = [
+    "policy"
+  ];
+
+  pythonImportsCheck = [
+    "google.cloud.bigtable_admin_v2"
+    "google.cloud.bigtable_v2"
+    "google.cloud.bigtable"
+  ];
+
   meta = with lib; {
     description = "Google Cloud Bigtable API client library";
-    homepage = "https://github.com/GoogleCloudPlatform/google-cloud-python";
+    homepage = "https://github.com/googleapis/python-bigtable";
     license = licenses.asl20;
     maintainers = [ maintainers.costrouc ];
   };

From b0cb5c74b49fd94b90a94e2eb59a0dd52538b1fc Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jun 2021 23:08:28 +0200
Subject: [PATCH 218/416] python3Packages.google-cloud-bigquery: disable
 failing test

---
 .../python-modules/google-cloud-bigquery/default.nix            | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/google-cloud-bigquery/default.nix b/pkgs/development/python-modules/google-cloud-bigquery/default.nix
index 59ebc2adeebe..f79916e51158 100644
--- a/pkgs/development/python-modules/google-cloud-bigquery/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigquery/default.nix
@@ -51,6 +51,8 @@ buildPythonPackage rec {
     # requires credentials
     "test_bigquery_magic"
     "TestBigQuery"
+    # Mocking of _ensure_bqstorage_client fails
+    "test_to_arrow_ensure_bqstorage_client_wo_bqstorage"
   ];
 
   pythonImportsCheck = [

From d73437c73a7f9a90ff13b561139cac02de6b4579 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Sun, 20 Jun 2021 17:03:49 +0200
Subject: [PATCH 219/416] agebox: init at 0.5.2

---
 pkgs/tools/security/agebox/default.nix | 27 ++++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix        |  2 ++
 2 files changed, 29 insertions(+)
 create mode 100644 pkgs/tools/security/agebox/default.nix

diff --git a/pkgs/tools/security/agebox/default.nix b/pkgs/tools/security/agebox/default.nix
new file mode 100644
index 000000000000..29199870c7f7
--- /dev/null
+++ b/pkgs/tools/security/agebox/default.nix
@@ -0,0 +1,27 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "agebox";
+  version = "0.5.2";
+
+  src = fetchFromGitHub {
+    owner = "slok";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0zn7jibhw5jd9wp1alx9ahj4szaig4a54ci3676kk5zqxr2hjz0c";
+  };
+  vendorSha256 = "0bc2pwz3yhzwqi0bcwqkkkrglg473qxhmz5s5955fvgajvjk7drn";
+
+  ldflags = [
+    "-s" "-w"
+    "-X main.Version=${version}"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/slok/agebox";
+    changelog = "https://github.com/slok/agebox/releases/tag/v${version}";
+    description = "Age based repository file encryption gitops tool";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ lesuisse ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0865b3716e9f..54b8a2515f8e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3788,6 +3788,8 @@ in
 
   age = callPackage ../tools/security/age { };
 
+  agebox = callPackage ../tools/security/agebox { };
+
   brotli = callPackage ../tools/compression/brotli { };
 
   biosdevname = callPackage ../tools/networking/biosdevname { };

From 6af79e120e4e135c1919e2ab54fa89e68cf0a1d5 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Sun, 20 Jun 2021 11:07:42 -0400
Subject: [PATCH 220/416] stylua: 0.9.1 -> 0.9.2

---
 pkgs/development/tools/stylua/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/stylua/default.nix b/pkgs/development/tools/stylua/default.nix
index 117ac7ba00a3..48250297e496 100644
--- a/pkgs/development/tools/stylua/default.nix
+++ b/pkgs/development/tools/stylua/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "stylua";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "johnnymorganz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1p6k5al8vvafz2w4z27jnyw8w2cp316h70dlx40ir4c3lk511n2j";
+    sha256 = "0idx4664p9ggv8p2pwgpch42li9ksiilszpwva19y4fa5xrmcyr2";
   };
 
-  cargoSha256 = "0ssfny11pv2b4zz7lh28cv603slp54pbcgj18y9k7b6jjajrz67q";
+  cargoSha256 = "1hc7zvrfiiijk4wr6i5jk6k32nz0lf64gqin3n8b8x5pp9d8fcfk";
 
   cargoBuildFlags = lib.optionals lua52Support [ "--features" "lua52" ]
     ++ lib.optionals luauSupport [ "--features" "luau" ];

From 267f14bdb4da5ce6b976e89dd2b501ed31b7d42c Mon Sep 17 00:00:00 2001
From: Sandro <sandro.jaeckel@gmail.com>
Date: Sun, 20 Jun 2021 17:34:25 +0200
Subject: [PATCH 221/416] pythonPackages.wasmer: remove let in

---
 pkgs/development/python-modules/wasmer/default.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/wasmer/default.nix b/pkgs/development/python-modules/wasmer/default.nix
index 14cac4998831..d3881032af13 100644
--- a/pkgs/development/python-modules/wasmer/default.nix
+++ b/pkgs/development/python-modules/wasmer/default.nix
@@ -5,11 +5,10 @@
 , buildPythonPackage
 , libiconv
 }:
-let
+
+buildPythonPackage rec {
   pname = "wasmer";
   version = "1.0.0";
-in buildPythonPackage rec {
-  inherit pname version;
 
   src = fetchFromGitHub {
     owner = "wasmerio";

From 1ddb51fd01eec235cb26b37af3d2c7d09b8185f0 Mon Sep 17 00:00:00 2001
From: Maas Lalani <maaslalani0@gmail.com>
Date: Fri, 11 Jun 2021 14:43:48 -0400
Subject: [PATCH 222/416] slides: init at 0.2.0

---
 pkgs/applications/misc/slides/default.nix | 34 +++++++++++++++++++++++
 pkgs/top-level/all-packages.nix           |  2 ++
 2 files changed, 36 insertions(+)
 create mode 100644 pkgs/applications/misc/slides/default.nix

diff --git a/pkgs/applications/misc/slides/default.nix b/pkgs/applications/misc/slides/default.nix
new file mode 100644
index 000000000000..ce5987d6c186
--- /dev/null
+++ b/pkgs/applications/misc/slides/default.nix
@@ -0,0 +1,34 @@
+{ lib, buildGoModule, fetchFromGitHub, bash, go, python3, ruby }:
+
+buildGoModule rec {
+  pname = "slides";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "maaslalani";
+    repo = "slides";
+    rev = "v${version}";
+    sha256 = "0vwpisyvsgmvrzp26hapghgqmm3fhrzrvdnmws00xc2q3fsij9qx";
+  };
+
+  checkInputs = [
+    bash
+    go
+    python3
+    ruby
+  ];
+
+  vendorSha256 = "0y6fz9rw702mji571k0gp4kpfx7xbv7rvlnmpfjygy6lmp7wga6f";
+
+  ldflags = [
+    "-s" "-w"
+    "-X=main.Version=${version}"
+  ];
+
+  meta = with lib; {
+    description = "Terminal based presentation tool";
+    homepage = "https://github.com/maaslalani/slides";
+    license = licenses.mit;
+    maintainers = with maintainers; [ maaslalani ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8f19cd1a6790..f4c7f28f8e8a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8676,6 +8676,8 @@ in
   # Not updated upstream since 2018, doesn't support qt newer than 5.12
   sleepyhead = libsForQt512.callPackage ../applications/misc/sleepyhead {};
 
+  slides = callPackage ../applications/misc/slides { };
+
   slirp4netns = callPackage ../tools/networking/slirp4netns/default.nix { };
 
   slsnif = callPackage ../tools/misc/slsnif { };

From 92906060570efe432f2a7a98c2e2e01f67e2b2d7 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sun, 20 Jun 2021 15:40:12 +0000
Subject: [PATCH 223/416] eksctl: 0.53.0 -> 0.54.0

---
 pkgs/tools/admin/eksctl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/admin/eksctl/default.nix b/pkgs/tools/admin/eksctl/default.nix
index f3a8a9d4cf65..32049fd11b65 100644
--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.53.0";
+  version = "0.54.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    sha256 = "sha256-CWoRkx3OPlIeyUuGCyaGTlJ0zgcgsxlebSG0Zljr0zg=";
+    sha256 = "sha256-hWrSjkEdhb0F5lwFGwjkR2G6gQ8T8HommH2lxJE+0bk=";
   };
 
   vendorSha256 = "sha256-499c3Y9IUV8lc+O9qcEeFKQDT4QDvOPmu0rmps7M47w=";

From 0a35c838b5a31adb6d9a65743d77b9041d73cd97 Mon Sep 17 00:00:00 2001
From: Leo Gaskin <34915973+leotaku@users.noreply.github.com>
Date: Sun, 20 Jun 2021 17:59:34 +0200
Subject: [PATCH 224/416] netdata: Fix netdata-claim.sh (#127381)

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
---
 pkgs/tools/system/netdata/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index e00c2bfafb31..673d29d61aa1 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, callPackage, fetchFromGitHub, autoreconfHook, pkg-config
+{ lib, stdenv, callPackage, fetchFromGitHub, autoreconfHook, pkg-config, makeWrapper
 , CoreFoundation, IOKit, libossp_uuid
 , nixosTests
 , curl, libcap, libuuid, lm_sensors, zlib
@@ -27,7 +27,7 @@ in stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
+  nativeBuildInputs = [ autoreconfHook pkg-config makeWrapper ];
   buildInputs = [ curl.dev zlib.dev ]
     ++ optionals stdenv.isDarwin [ CoreFoundation IOKit libossp_uuid ]
     ++ optionals (!stdenv.isDarwin) [ libcap.dev libuuid.dev ]
@@ -79,7 +79,7 @@ in stdenv.mkDerivation rec {
   ];
 
   postFixup = ''
-    rm -r $out/sbin
+    wrapProgram $out/bin/netdata-claim.sh --prefix PATH : ${lib.makeBinPath [ openssl ]}
   '';
 
   passthru.tests.netdata = nixosTests.netdata;

From 568f801bc822f9eb679af9024a4eec1ac8e8f7c5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <dev@schuetz-co.de>
Date: Sun, 20 Jun 2021 18:09:17 +0200
Subject: [PATCH 225/416] python3Packages.herepy: init at 3.5.2

---
 .../python-modules/herepy/default.nix         | 40 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 42 insertions(+)
 create mode 100644 pkgs/development/python-modules/herepy/default.nix

diff --git a/pkgs/development/python-modules/herepy/default.nix b/pkgs/development/python-modules/herepy/default.nix
new file mode 100644
index 000000000000..6081f914c646
--- /dev/null
+++ b/pkgs/development/python-modules/herepy/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, requests
+, pytestCheckHook
+, responses
+}:
+
+buildPythonPackage rec {
+  pname = "herepy";
+  version = "3.5.2";
+
+  disabled = pythonOlder "3.5";
+
+  src = fetchFromGitHub {
+    owner = "abdullahselek";
+    repo = "HerePy";
+    rev = version;
+    sha256 = "0z1brgnrzdzfmnydipja4hhrhnz4fwdjy3xa05mz28bwi6z52bcj";
+  };
+
+  propagatedBuildInputs = [
+    requests
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+    responses
+  ];
+
+  pythonImportsCheck = [ "herepy" ];
+
+  meta = with lib; {
+    description = "Library that provides a Python interface to the HERE APIs";
+    homepage = "https://github.com/abdullahselek/HerePy";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 7d212cb5ea0e..7706c5031915 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3208,6 +3208,8 @@ in {
     inherit python;
   });
 
+  herepy = callPackage ../development/python-modules/herepy { };
+
   hetzner = callPackage ../development/python-modules/hetzner { };
 
   heudiconv = callPackage ../development/python-modules/heudiconv { };

From 00bc61110b8cf3bc8993d928c671f912e9961b9d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <dev@schuetz-co.de>
Date: Sun, 20 Jun 2021 18:10:22 +0200
Subject: [PATCH 226/416] home-assistant: update component-packages.nix

---
 pkgs/servers/home-assistant/component-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 06a1a53d5203..ee04c6c8c483 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -345,7 +345,7 @@
     "hdmi_cec" = ps: with ps; [ pycec ];
     "heatmiser" = ps: with ps; [ ]; # missing inputs: heatmiserV3
     "heos" = ps: with ps; [ pyheos ];
-    "here_travel_time" = ps: with ps; [ ]; # missing inputs: herepy
+    "here_travel_time" = ps: with ps; [ herepy ];
     "hikvision" = ps: with ps; [ ]; # missing inputs: pyhik
     "hikvisioncam" = ps: with ps; [ ]; # missing inputs: hikvision
     "hisense_aehw4a1" = ps: with ps; [ ]; # missing inputs: pyaehw4a1

From b86c53ddc4e6458a3389527d9c51538cce78e947 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <dev@schuetz-co.de>
Date: Sun, 20 Jun 2021 18:11:08 +0200
Subject: [PATCH 227/416] home-assistant: test here_travel_time component

---
 pkgs/servers/home-assistant/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 8c73e23ef992..174d1b933928 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -441,6 +441,7 @@ in with py.pkgs; buildPythonApplication rec {
     "hassio"
     "hddtemp"
     "heos"
+    "here_travel_time"
     "history"
     "history_stats"
     "hive"
@@ -743,6 +744,8 @@ in with py.pkgs; buildPythonApplication rec {
     "--only-rerun RuntimeError"
     # enable full variable printing on error
     "--showlocals"
+    # here_travel_time/test_sensor.py: Tries to access HERE API: herepy.error.HEREError: Error occured on __get
+    "--deselect tests/components/here_travel_time/test_sensor.py::test_invalid_credentials"
     # screenlogic/test_config_flow.py: Tries to send out UDP broadcasts
     "--deselect tests/components/screenlogic/test_config_flow.py::test_form_cannot_connect"
     # asuswrt/test_config_flow.py: Sandbox network limitations, fails with unexpected error

From 0c201d1f78e7793265f69625607332b0ad8c7d99 Mon Sep 17 00:00:00 2001
From: Alex M <alexmgit@protonmail.com>
Date: Sun, 20 Jun 2021 09:30:36 -0700
Subject: [PATCH 228/416] idasen: init at 0.7.1

---
 .../python-modules/idasen/default.nix         | 50 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 pkgs/top-level/python-packages.nix            |  2 +
 3 files changed, 54 insertions(+)
 create mode 100644 pkgs/development/python-modules/idasen/default.nix

diff --git a/pkgs/development/python-modules/idasen/default.nix b/pkgs/development/python-modules/idasen/default.nix
new file mode 100644
index 000000000000..d1bacfbe826a
--- /dev/null
+++ b/pkgs/development/python-modules/idasen/default.nix
@@ -0,0 +1,50 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, bleak
+, pyyaml
+, voluptuous
+, pytestCheckHook
+, pytest-asyncio
+, poetry-core
+}:
+
+buildPythonPackage rec {
+  pname = "idasen";
+  version = "0.7.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "newAM";
+    repo = "idasen";
+    rev = "v${version}";
+    sha256 = "1jdgdby33fd63mnxrfv04dz4fsrikkfmc0ybwwxi816mbkml7n34";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    bleak
+    pyyaml
+    voluptuous
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+    pytest-asyncio
+  ];
+
+  pythonImportsCheck = [ "idasen" ];
+
+  meta = with lib; {
+    description = "Python API and CLI for the ikea IDÅSEN desk";
+    homepage = "https://github.com/newAM/idasen";
+    license = licenses.mit;
+    maintainers = with maintainers; [ newam ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 40be91d9a71a..d4b64147598e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15659,6 +15659,8 @@ in
 
   id3lib = callPackage ../development/libraries/id3lib { };
 
+  idasen = with python3Packages; toPythonApplication idasen;
+
   ilbc = callPackage ../development/libraries/ilbc { };
 
   ilixi = callPackage ../development/libraries/ilixi { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d3c455f41fef..d07c92ba6c80 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3385,6 +3385,8 @@ in {
 
   ics = callPackage ../development/python-modules/ics { };
 
+  idasen = callPackage ../development/python-modules/idasen { };
+
   identify = callPackage ../development/python-modules/identify { };
 
   idna = callPackage ../development/python-modules/idna { };

From 35e8ddfac39b0d20763b77ef9d26e51cff1e0f37 Mon Sep 17 00:00:00 2001
From: Kira Bruneau <kira.bruneau@pm.me>
Date: Sun, 20 Jun 2021 08:01:47 -0400
Subject: [PATCH 229/416] =?UTF-8?q?newsflash:=201.4.1=20=E2=86=92=201.4.2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../feedreaders/newsflash/default.nix         | 21 +++++++------------
 .../newsflash/no-post-install.patch           |  2 +-
 2 files changed, 9 insertions(+), 14 deletions(-)

diff --git a/pkgs/applications/networking/feedreaders/newsflash/default.nix b/pkgs/applications/networking/feedreaders/newsflash/default.nix
index b5011c122d95..24ec320cc431 100644
--- a/pkgs/applications/networking/feedreaders/newsflash/default.nix
+++ b/pkgs/applications/networking/feedreaders/newsflash/default.nix
@@ -15,33 +15,27 @@
 , webkitgtk
 , glib-networking
 , librsvg
-, gst_all_1
 , xdg-utils
+, gst_all_1
 }:
 
 stdenv.mkDerivation rec {
   pname = "newsflash";
-  version = "1.4.1";
+  version = "1.4.2";
 
   src = fetchFromGitLab {
     owner = "news-flash";
     repo = "news_flash_gtk";
     rev = version;
-    hash = "sha256-pskmvztKOwutXRHVnW5u68/0DAuV9Gb+Ovp2JbXiMYo=";
+    hash = "sha256-8W158GrvVGu5b3TG5bomK+hAF6jttZuImkmtcZOl91o=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-qq8cZplt5YWUwsXUShMDhQm3RGH2kCEBk64x6bOa50E=";
+    hash = "sha256-zHtD3NVWYQ5njg17Z2YmEttiK2oiq01OiAXIZofIqKI=";
   };
 
-  # https://github.com/CasualX/obfstr/blob/v0.2.4/build.rs#L5
-  # obfstr 0.2.4 fails to set RUSTC_BOOTSTRAP in its build script because cargo
-  # build scripts are forbidden from setting RUSTC_BOOTSTRAP since rustc 1.52.0
-  # https://github.com/rust-lang/rust/blob/1.52.0/RELEASES.md#compatibility-notes
-  RUSTC_BOOTSTRAP = 1;
-
   patches = [
     # Post install tries to generate an icon cache & update the
     # desktop database. The gtk setup hook drop-icon-theme-cache.sh
@@ -79,14 +73,14 @@ stdenv.mkDerivation rec {
     sqlite
     webkitgtk
 
-    # open link in browser
-    xdg-utils
-
     # TLS support for loading external content in webkitgtk WebView
     glib-networking
 
     # SVG support for gdk-pixbuf
     librsvg
+
+    # Open links in browser
+    xdg-utils
   ] ++ (with gst_all_1; [
     # Audio & video support for webkitgtk WebView
     gstreamer
@@ -100,5 +94,6 @@ stdenv.mkDerivation rec {
     homepage = "https://gitlab.com/news-flash/news_flash_gtk";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ kira-bruneau ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/networking/feedreaders/newsflash/no-post-install.patch b/pkgs/applications/networking/feedreaders/newsflash/no-post-install.patch
index cfdec206e77b..b638f30cd44c 100644
--- a/pkgs/applications/networking/feedreaders/newsflash/no-post-install.patch
+++ b/pkgs/applications/networking/feedreaders/newsflash/no-post-install.patch
@@ -1,5 +1,5 @@
 diff --git a/meson.build b/meson.build
-index 53f911c..361a233 100644
+index 1d7089c..1952e7f 100644
 --- a/meson.build
 +++ b/meson.build
 @@ -61,5 +61,3 @@ meson.add_dist_script(

From c27d15ebdc4e8c504008bf4e0467b1edc6e3de5a Mon Sep 17 00:00:00 2001
From: devhell <devhell@mailfresser.de>
Date: Sun, 20 Jun 2021 17:45:51 +0100
Subject: [PATCH 230/416] tuigreet: 0.2.0 -> 0.4.0

---
 pkgs/os-specific/linux/tuigreet/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/tuigreet/default.nix b/pkgs/os-specific/linux/tuigreet/default.nix
index a904eb8b9b4a..daa5a4faa9c2 100644
--- a/pkgs/os-specific/linux/tuigreet/default.nix
+++ b/pkgs/os-specific/linux/tuigreet/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tuigreet";
-  version = "0.2.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "apognu";
     repo = pname;
     rev = version;
-    sha256 = "1fk8ppxr3a8vdp7g18pp3sgr8b8s11j30mcqpdap4ai14v19idh8";
+    sha256 = "1v16gl6ajqdbl265nh8akr2far5qhiqv7787hvqlzpr3rd39vnij";
   };
 
-  cargoSha256 = "1ds5rcxg7qn799zp0jdn9ifkdzh9h5ibsqh688dvrqyzrsfz6x7m";
+  cargoSha256 = "072zvvgf9m1afjz15m8pwslh2mav37ahjqgg33pdvzdnvg5j1q2h";
 
   meta = with lib; {
     description = "Graphical console greter for greetd";

From d76b0940f00f5a8e7a888d2a60ceb95be82fa798 Mon Sep 17 00:00:00 2001
From: Johannes Arnold <johannes.arnold@stud.uni-hannover.de>
Date: Tue, 15 Jun 2021 23:38:54 +0200
Subject: [PATCH 231/416] python3Packages.youtube_search: init at
 unstable-2021-02-27

---
 .../python-modules/youtube-search/default.nix | 26 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 28 insertions(+)
 create mode 100644 pkgs/development/python-modules/youtube-search/default.nix

diff --git a/pkgs/development/python-modules/youtube-search/default.nix b/pkgs/development/python-modules/youtube-search/default.nix
new file mode 100644
index 000000000000..41424aa56d2e
--- /dev/null
+++ b/pkgs/development/python-modules/youtube-search/default.nix
@@ -0,0 +1,26 @@
+{ lib, buildPythonPackage, fetchFromGitHub, requests }:
+
+buildPythonPackage rec {
+  pname = "youtube-search";
+  version = "unstable-2021-02-27";
+
+  src = fetchFromGitHub {
+    owner = "joetats";
+    repo = "youtube_search";
+    rev = "886fe1b16c829215ee0984b6859f874b4a30d875";
+    sha256 = "sha256-3ECJ6iHNzx5PLgpTFraFzAYbKnyMYRf/iJ0zajU+hlo=";
+  };
+
+  propagatedBuildInputs = [ requests ];
+
+  # Check disabled due to relative import with no known parent package
+  doCheck = false;
+  pythonImportsCheck = [ "youtube_search" ];
+
+  meta = with lib; {
+    description = "Tool for searching for youtube videos to avoid using their heavily rate-limited API";
+    homepage = "https://github.com/joetats/youtube_search";
+    license = licenses.mit;
+    maintainers = with maintainers; [ j0hax ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 2c51f9ccbab9..17d426884d93 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9198,6 +9198,8 @@ in {
     phantomjsSupport = false;
   };
 
+  youtube-search = callPackage ../development/python-modules/youtube-search { };
+
   yowsup = callPackage ../development/python-modules/yowsup { };
 
   yq = callPackage ../development/python-modules/yq {

From a1e75a9ab4944810086dd3cbdecfe3587bf53f8c Mon Sep 17 00:00:00 2001
From: Johannes Arnold <johannes.arnold@stud.uni-hannover.de>
Date: Tue, 15 Jun 2021 23:40:21 +0200
Subject: [PATCH 232/416] python3Packages.pydes: init at unstable-2019-01-08

---
 .../python-modules/pydes/default.nix          | 24 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 26 insertions(+)
 create mode 100644 pkgs/development/python-modules/pydes/default.nix

diff --git a/pkgs/development/python-modules/pydes/default.nix b/pkgs/development/python-modules/pydes/default.nix
new file mode 100644
index 000000000000..78f131d42437
--- /dev/null
+++ b/pkgs/development/python-modules/pydes/default.nix
@@ -0,0 +1,24 @@
+{ lib, buildPythonPackage, fetchFromGitHub }:
+
+buildPythonPackage rec {
+  pname = "pydes";
+  version = "unstable-2019-01-08";
+
+  src = fetchFromGitHub {
+    owner = "twhiteman";
+    repo = "pyDes";
+    rev = "e988a5ffc9abb8010fc75dba54904d1c5dbe83db";
+    sha256 = "0sic8wbyk5azb4d4m6zbc96lfqcw8s2pzcv9nric5yqc751613ww";
+  };
+
+  checkPhase = "python test_pydes.py";
+
+  pythonImportsCheck = [ "pyDes" ];
+
+  meta = with lib; {
+    description = "A pure python module which implements the DES and Triple-DES encryption algorithms";
+    homepage = "https://github.com/twhiteman/pyDes";
+    license = licenses.mit;
+    maintainers = with maintainers; [ j0hax ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 17d426884d93..1ee7481a85e2 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5701,6 +5701,8 @@ in {
 
   pydenticon = callPackage ../development/python-modules/pydenticon { };
 
+  pydes = callPackage ../development/python-modules/pydes { };
+
   py-desmume = callPackage ../development/python-modules/py-desmume { };
 
   pydexcom = callPackage ../development/python-modules/pydexcom { };

From f05fba8db032c467a92afc1fc31ee05a1f211b8f Mon Sep 17 00:00:00 2001
From: Johannes Arnold <johannes.arnold@stud.uni-hannover.de>
Date: Tue, 15 Jun 2021 23:41:28 +0200
Subject: [PATCH 233/416] python3Packages.simber: init at 0.2.2

---
 .../python-modules/simber/default.nix         | 25 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 27 insertions(+)
 create mode 100644 pkgs/development/python-modules/simber/default.nix

diff --git a/pkgs/development/python-modules/simber/default.nix b/pkgs/development/python-modules/simber/default.nix
new file mode 100644
index 000000000000..d1471286bb84
--- /dev/null
+++ b/pkgs/development/python-modules/simber/default.nix
@@ -0,0 +1,25 @@
+{ lib, buildPythonPackage, fetchFromGitHub, colorama, pytestCheckHook }:
+
+buildPythonPackage rec {
+  pname = "simber";
+  version = "0.2.2";
+
+  src = fetchFromGitHub {
+    owner = "deepjyoti30";
+    repo = pname;
+    rev = version;
+    sha256 = "0ksc2m61j5ijj0sq6kkc0hhkmfy9f51h9z3cl2sf8g6wbr9vc47h";
+  };
+
+  propagatedBuildInputs = [ colorama ];
+
+  checkInputs = [ pytestCheckHook ];
+  pythonImportsCheck = [ "simber" ];
+
+  meta = with lib; {
+    description = "Simple, minimal and powerful logger for Python";
+    homepage = "https://github.com/deepjyoti30/simber";
+    license = licenses.mit;
+    maintainers = with maintainers; [ j0hax ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 1ee7481a85e2..369a5e7a696a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7769,6 +7769,8 @@ in {
 
   simanneal = callPackage ../development/python-modules/simanneal { };
 
+  simber = callPackage ../development/python-modules/simber { };
+
   simpleaudio = callPackage ../development/python-modules/simpleaudio { };
 
   simplebayes = callPackage ../development/python-modules/simplebayes { };

From 7afaacf9a804b592fde60030b3aca12134cd6e32 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B8rn=20Forsman?= <bjorn.forsman@gmail.com>
Date: Sun, 20 Jun 2021 19:39:35 +0200
Subject: [PATCH 234/416] doc: fix link to kodi-19.0 announcement

---
 nixos/doc/manual/release-notes/rl-2105.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/doc/manual/release-notes/rl-2105.xml b/nixos/doc/manual/release-notes/rl-2105.xml
index 54abbb6e38e4..a93fdd67fe9a 100644
--- a/nixos/doc/manual/release-notes/rl-2105.xml
+++ b/nixos/doc/manual/release-notes/rl-2105.xml
@@ -853,7 +853,7 @@ environment.systemPackages = [
    <listitem>
     <para>
      <link xlink:href="https://kodi.tv/">Kodi</link> has been updated to version 19.1 "Matrix". See
-     the <link xlink:href="https://kodi.tv/article/kodi-190-matrix-release">announcement</link> for
+     the <link xlink:href="https://kodi.tv/article/kodi-19-0-matrix-release">announcement</link> for
      further details.
     </para>
    </listitem>

From 71e8cc09d1e011f87de3f9d985ba2e6efd372039 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 20 Jun 2021 20:11:45 +0200
Subject: [PATCH 235/416] home-assistant: disable
 adbode/test_camera.py::test_camera_off test

```
___________________________ test_camera_off[pyloop] ____________________________
[gw5] linux -- Python 3.8.9 /nix/store/4s0h5aawbap3xhldxhcijvl26751qrjr-python3-3.8.9/bin/python3.8

hass = <homeassistant.core.HomeAssistant object at 0x7fff4433b580>

    async def test_camera_off(hass):
        """Test the camera turn off service."""
        await setup_platform(hass, CAMERA_DOMAIN)

        with patch("abodepy.AbodeCamera.privacy_mode") as mock_capture:
>           await hass.services.async_call(
                CAMERA_DOMAIN,
                "turn_off",
                {ATTR_ENTITY_ID: "camera.test_cam"},
                blocking=True,
            )

hass       = <homeassistant.core.HomeAssistant object at 0x7fff4433b580>
mock_capture = <MagicMock name='privacy_mode' id='140734337787888'>

tests/components/abode/test_camera.py:64:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

self = <homeassistant.core.ServiceRegistry object at 0x7fff442c1cd0>
domain = 'camera', service = 'turn_off'
service_data = {'entity_id': 'camera.test_cam'}, blocking = True
context = Context(user_id=None, parent_id=None, id='20e520e6917f171d80558dcc4b10b219')
limit = 10, target = None

    async def async_call(
        self,
        domain: str,
        service: str,
        service_data: dict | None = None,
        blocking: bool = False,
        context: Context | None = None,
        limit: float | None = SERVICE_CALL_LIMIT,
        target: dict | None = None,
    ) -> bool | None:
        """
        Call a service.

        Specify blocking=True to wait until service is executed.
        Waits a maximum of limit, which may be None for no timeout.

        If blocking = True, will return boolean if service executed
        successfully within limit.

        This method will fire an event to indicate the service has been called.

        Because the service is sent as an event you are not allowed to use
        the keys ATTR_DOMAIN and ATTR_SERVICE in your service_data.

        This method is a coroutine.
        """
        domain = domain.lower()
        service = service.lower()
        context = context or Context()
        service_data = service_data or {}

        try:
            handler = self._services[domain][service]
        except KeyError:
>           raise ServiceNotFound(domain, service) from None
E           homeassistant.exceptions.ServiceNotFound: Unable to find service camera.turn_off

blocking   = True
context    = Context(user_id=None, parent_id=None, id='20e520e6917f171d80558dcc4b10b219')
domain     = 'camera'
limit      = 10
self       = <homeassistant.core.ServiceRegistry object at 0x7fff442c1cd0>
service    = 'turn_off'
service_data = {'entity_id': 'camera.test_cam'}
target     = None

homeassistant/core.py:1438: ServiceNotFound
---------------------------- Captured stderr setup -----------------------------
DEBUG:asyncio:Using selector: EpollSelector
------------------------------ Captured log setup ------------------------------
DEBUG    asyncio:selector_events.py:59 Using selector: EpollSelector
----------------------------- Captured stderr call -----------------------------
INFO:homeassistant.loader:Loaded abode from homeassistant.components.abode
INFO:homeassistant.setup:Setting up abode
INFO:homeassistant.setup:Setup of domain abode took 0.0 seconds
DEBUG:abodepy:Cache found at: /build/source/tests/testing_config/abodepy_cache.pickle
WARNING:abodepy.utils:Empty pickle file: /build/source/tests/testing_config/abodepy_cache.pickle
DEBUG:abodepy:Removing invalid cache file: /build/source/tests/testing_config/abodepy_cache.pickle
ERROR:homeassistant.config_entries:Error setting up entry Mock Title for abode
Traceback (most recent call last):
  File "/build/source/homeassistant/config_entries.py", line 293, in async_setup
    result = await component.async_setup_entry(hass, self)  # type: ignore
  File "/build/source/homeassistant/components/abode/__init__.py", line 125, in async_setup_entry
    abode = await hass.async_add_executor_job(
  File "/nix/store/4s0h5aawbap3xhldxhcijvl26751qrjr-python3-3.8.9/lib/python3.8/concurrent/futures/thread.py", line 57, in run
    result = self.fn(*self.args, **self.kwargs)
  File "/nix/store/6s0sdvk0crvcfyv7w33yc7w4bkzl0y1w-python3.8-abodepy-1.2.1/lib/python3.8/site-packages/abodepy/__init__.py", line 85, in __init__
    self._load_cache()
  File "/nix/store/6s0sdvk0crvcfyv7w33yc7w4bkzl0y1w-python3.8-abodepy-1.2.1/lib/python3.8/site-packages/abodepy/__init__.py", line 497, in _load_cache
    os.remove(self._cache_path)
FileNotFoundError: [Errno 2] No such file or directory: '/build/source/tests/testing_config/abodepy_cache.pickle'
DEBUG:homeassistant.core:Bus:Handling <Event component_loaded[L]:
component=abode>
```
---
 pkgs/servers/home-assistant/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 174d1b933928..f6263022d860 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -748,6 +748,8 @@ in with py.pkgs; buildPythonApplication rec {
     "--deselect tests/components/here_travel_time/test_sensor.py::test_invalid_credentials"
     # screenlogic/test_config_flow.py: Tries to send out UDP broadcasts
     "--deselect tests/components/screenlogic/test_config_flow.py::test_form_cannot_connect"
+    # abode/test_camera.py: Race condition in pickle file creationg
+    "--deselect tests/components/abode/test_camera.py::test_camera_off"
     # asuswrt/test_config_flow.py: Sandbox network limitations, fails with unexpected error
     "--deselect tests/components/asuswrt/test_config_flow.py::test_on_connect_failed"
     # shelly/test_config_flow.py: Tries to join multicast group

From 4c7a1acd2a83c26adae03ac326989dbaec47c3c8 Mon Sep 17 00:00:00 2001
From: Johannes Arnold <johannes.arnold@stud.uni-hannover.de>
Date: Tue, 15 Jun 2021 23:42:20 +0200
Subject: [PATCH 236/416] python3Packages.downloader-cli: init at 0.3.1

---
 .../python-modules/downloader-cli/default.nix | 27 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 29 insertions(+)
 create mode 100644 pkgs/development/python-modules/downloader-cli/default.nix

diff --git a/pkgs/development/python-modules/downloader-cli/default.nix b/pkgs/development/python-modules/downloader-cli/default.nix
new file mode 100644
index 000000000000..608286c8bcf6
--- /dev/null
+++ b/pkgs/development/python-modules/downloader-cli/default.nix
@@ -0,0 +1,27 @@
+{ lib, buildPythonPackage, fetchFromGitHub, urllib3, pytest }:
+
+buildPythonPackage rec {
+  pname = "downloader-cli";
+  version = "0.3.1";
+
+  src = fetchFromGitHub {
+    owner = "deepjyoti30";
+    repo = pname;
+    rev = version;
+    sha256 = "0gbbjxb9vf5g890cls3mwzl8lmcn6jkpgm5cbrif740mn2b4q228";
+  };
+
+  propagatedBuildInputs = [ urllib3 ];
+
+  # Disable checks due to networking (Errno 101)
+  doCheck = false;
+
+  pythonImportsCheck = [ "downloader_cli" ];
+
+  meta = with lib; {
+    description = "A simple downloader written in Python with an awesome customizable progressbar. ";
+    homepage = "https://github.com/deepjyoti30/downloader-cli";
+    license = licenses.mit;
+    maintainers = with maintainers; [ j0hax ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 369a5e7a696a..19bb7e11ce3c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2132,6 +2132,8 @@ in {
 
   dotmap = callPackage ../development/python-modules/dotmap { };
 
+  downloader-cli = callPackage ../development/python-modules/downloader-cli { };
+
   dparse = callPackage ../development/python-modules/dparse { };
 
   dpath = callPackage ../development/python-modules/dpath { };

From 484e29479e90f1f672de1b9a426409829e455df9 Mon Sep 17 00:00:00 2001
From: Johannes Arnold <johannes.arnold@stud.uni-hannover.de>
Date: Tue, 15 Jun 2021 23:43:05 +0200
Subject: [PATCH 237/416] python3Packages.itunespy: init at 1.6

---
 .../python-modules/itunespy/default.nix       | 27 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 29 insertions(+)
 create mode 100644 pkgs/development/python-modules/itunespy/default.nix

diff --git a/pkgs/development/python-modules/itunespy/default.nix b/pkgs/development/python-modules/itunespy/default.nix
new file mode 100644
index 000000000000..4720101d8177
--- /dev/null
+++ b/pkgs/development/python-modules/itunespy/default.nix
@@ -0,0 +1,27 @@
+{ lib, buildPythonPackage, fetchFromGitHub, requests, pycountry, mypy }:
+
+buildPythonPackage rec {
+  pname = "itunespy";
+  version = "1.6";
+
+  src = fetchFromGitHub {
+    owner = "sleepyfran";
+    repo = pname;
+    rev = version;
+    sha256 = "0yc3az5531qs8nbcw4rhgrszwczgy4bikfwfar7xb2044360sslw";
+  };
+
+  propagatedBuildInputs = [ requests pycountry mypy ];
+
+  # This module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "itunespy" ];
+
+  meta = with lib; {
+    description = "A simple library to fetch data from the iTunes Store API";
+    homepage = "https://github.com/sleepyfran/itunespy";
+    license = licenses.mit;
+    maintainers = with maintainers; [ j0hax ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 19bb7e11ce3c..0697be6220b3 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3528,6 +3528,8 @@ in {
 
   itsdangerous = callPackage ../development/python-modules/itsdangerous { };
 
+  itunespy = callPackage ../development/python-modules/itunespy { };
+
   itypes = callPackage ../development/python-modules/itypes { };
 
   j2cli = callPackage ../development/python-modules/j2cli { };

From 3e2dedb80525555588757fbfe2303b75cfd01a72 Mon Sep 17 00:00:00 2001
From: Johannes Arnold <johannes.arnold@stud.uni-hannover.de>
Date: Tue, 15 Jun 2021 23:44:28 +0200
Subject: [PATCH 238/416] ytmdl: init at 2021.05.26

---
 pkgs/tools/misc/ytmdl/default.nix | 48 +++++++++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix   |  2 ++
 2 files changed, 50 insertions(+)
 create mode 100644 pkgs/tools/misc/ytmdl/default.nix

diff --git a/pkgs/tools/misc/ytmdl/default.nix b/pkgs/tools/misc/ytmdl/default.nix
new file mode 100644
index 000000000000..0827168d60ce
--- /dev/null
+++ b/pkgs/tools/misc/ytmdl/default.nix
@@ -0,0 +1,48 @@
+{ lib, fetchFromGitHub, buildPythonApplication, ffmpeg, ffmpeg-python, musicbrainzngs, rich, simber, pydes, youtube-search, unidecode, pyxdg, downloader-cli, beautifulsoup4, itunespy, mutagen, pysocks, youtube-dl }:
+
+buildPythonApplication rec {
+  pname = "ytmdl";
+  version = "2021.05.26";
+
+  src = fetchFromGitHub {
+    owner = "deepjyoti30";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-AYBhPmv1/cOaMh44kqm7JpJSudHbfriiJztcGL5mbEk=";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "bs4" "beautifulsoup4"
+  '';
+
+
+  propagatedBuildInputs = [
+    ffmpeg
+    ffmpeg-python
+    musicbrainzngs
+    rich
+    simber
+    pydes
+    youtube-search
+    unidecode
+    pyxdg
+    downloader-cli
+    beautifulsoup4
+    itunespy
+    mutagen
+    pysocks
+    youtube-dl
+  ];
+
+  # This application has no tests
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = "https://github.com/deepjyoti30/ytmdl";
+    description = "YouTube Music Downloader";
+    license = licenses.mit;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ j0hax ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 51cbb4ac1fa9..937fed0948fd 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -27975,6 +27975,8 @@ in
 
   ytmdesktop = callPackage ../applications/audio/ytmdesktop { };
 
+  ytmdl = python3Packages.callPackage ../tools/misc/ytmdl { };
+
   zam-plugins = callPackage ../applications/audio/zam-plugins { };
 
   zanshin = libsForQt5.callPackage ../applications/office/zanshin { };

From 5e6443bbc8cc61299e23fecc411cf0c34bca9fe7 Mon Sep 17 00:00:00 2001
From: Bruno Bigras <bigras.bruno@gmail.com>
Date: Sun, 20 Jun 2021 14:55:04 -0400
Subject: [PATCH 239/416] starship: 0.54.0 -> 0.55.0

---
 pkgs/tools/misc/starship/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/misc/starship/default.nix b/pkgs/tools/misc/starship/default.nix
index 432eab680c83..f5f8f87e9ca9 100644
--- a/pkgs/tools/misc/starship/default.nix
+++ b/pkgs/tools/misc/starship/default.nix
@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "starship";
-  version = "0.54.0";
+  version = "0.55.0";
 
   src = fetchFromGitHub {
     owner = "starship";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-8vrLvP8NevVpmqxqJHsySGXRTDX45c8FrfB7W7fdQvg=";
+    sha256 = "sha256-zXXjy90oxLO/Ac/TQC4J6rOvha2qGBMv0SAAXvDyITo=";
   };
 
   nativeBuildInputs = [ installShellFiles ] ++ lib.optionals stdenv.isLinux [ pkg-config ];
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage rec {
     done
   '';
 
-  cargoSha256 = "sha256-lIZsYhyef9LsGME01Kb5TGamGpLyZiPrdIb+jUqvbOg=";
+  cargoSha256 = "sha256-TXmV1saqZ/XS4HxKpGXWu3HuoZ3WIptSc8oTNnPCqYE=";
 
   preCheck = ''
     HOME=$TMPDIR

From 190ba6ee72a27a834e1ab5aa5b180889ca8ec9ba Mon Sep 17 00:00:00 2001
From: Vincenzo Mantova <xworld21@users.sf.net>
Date: Sun, 23 May 2021 19:02:36 +0100
Subject: [PATCH 240/416] eukleides: specify texlive dependencies instead of
 buildInputs

---
 .../science/math/eukleides/default.nix        | 19 +++++--------------
 pkgs/top-level/all-packages.nix               |  1 -
 2 files changed, 5 insertions(+), 15 deletions(-)

diff --git a/pkgs/applications/science/math/eukleides/default.nix b/pkgs/applications/science/math/eukleides/default.nix
index b5a9fc3fa86d..fe8969a36b51 100644
--- a/pkgs/applications/science/math/eukleides/default.nix
+++ b/pkgs/applications/science/math/eukleides/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, bison, flex, makeWrapper, texinfo, readline, texLive }:
+{ lib, stdenv, fetchurl, bison, flex, makeWrapper, texinfo, readline, texlive }:
 
 lib.fix (eukleides: stdenv.mkDerivation rec {
   pname = "eukleides";
@@ -14,7 +14,7 @@ lib.fix (eukleides: stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ bison flex texinfo makeWrapper ];
 
-  buildInputs = [ readline texLive ];
+  buildInputs = [ readline ];
 
   preConfigure = ''
     substituteInPlace Makefile \
@@ -32,21 +32,12 @@ lib.fix (eukleides: stdenv.mkDerivation rec {
     mkdir -p $out/bin
   '';
 
-  postInstall = ''
-    wrapProgram $out/bin/euktoeps \
-      --set-default TEXINPUTS : \
-      --prefix TEXINPUTS : "$tex/tex/latex/eukleides" \
-      --prefix PATH : "${texLive}/bin"
-    wrapProgram $out/bin/euktopdf \
-      --set-default TEXINPUTS : \
-      --prefix TEXINPUTS : "$tex/tex/latex/eukleides" \
-      --prefix PATH : "${texLive}/bin"
-  '';
-
   outputs = [ "out" "doc" "tex" ];
 
   passthru.tlType = "run";
-  passthru.pkgs = [ eukleides.tex ];
+  passthru.pkgs = [ eukleides.tex ]
+    # packages needed by euktoeps, euktopdf and eukleides.sty
+    ++ (with texlive; collection-pstricks.pkgs ++ epstopdf.pkgs ++ iftex.pkgs ++ moreverb.pkgs);
 
   meta = {
     description = "Geometry Drawing Language";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2fdd3f31b8c4..c5506ab5caad 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -29828,7 +29828,6 @@ in
   ecm = callPackage ../applications/science/math/ecm { };
 
   eukleides = callPackage ../applications/science/math/eukleides {
-    texLive = texlive.combine { inherit (texlive) scheme-small; };
     texinfo = texinfo4;
   };
 

From 8e4a27fa42e807211039099734979760a5a3a147 Mon Sep 17 00:00:00 2001
From: Artturi <Artturin@artturin.com>
Date: Sun, 20 Jun 2021 22:20:08 +0300
Subject: [PATCH 241/416] veracrypt: 1.24-Hotfix1 -> 1.24-Update7 and hardcode
 mkfs paths (#127592)

---
 pkgs/applications/misc/veracrypt/default.nix  | 40 ++++++++++++-------
 .../misc/veracrypt/fix-paths.patch            | 22 ++++++++++
 2 files changed, 47 insertions(+), 15 deletions(-)
 create mode 100644 pkgs/applications/misc/veracrypt/fix-paths.patch

diff --git a/pkgs/applications/misc/veracrypt/default.nix b/pkgs/applications/misc/veracrypt/default.nix
index 5e5fda23d442..33d0da5c93a4 100644
--- a/pkgs/applications/misc/veracrypt/default.nix
+++ b/pkgs/applications/misc/veracrypt/default.nix
@@ -1,29 +1,39 @@
-{ lib, stdenv, fetchurl, fetchpatch, pkg-config, makeself, yasm, fuse, wxGTK, lvm2 }:
+{ lib
+, stdenv
+, fetchurl
+, pkg-config
+, makeself
+, yasm
+, fuse
+, wxGTK
+, lvm2
+, substituteAll
+, e2fsprogs
+, exfat
+, ntfs3g
+, btrfs-progs
+}:
 
 with lib;
 
 stdenv.mkDerivation rec {
   pname = "veracrypt";
-  version = "1.24-Hotfix1";
+  version = "1.24-Update7";
 
   src = fetchurl {
     url = "https://launchpad.net/${pname}/trunk/${toLower version}/+download/VeraCrypt_${version}_Source.tar.bz2";
-    sha256 = "8b40ece805b216843d7a71b1a30069c4057931341b030bf65caace59263c5c8c";
+    sha256 = "0i7h44zn2mjzgh416l7kfs0dk6qc7b1bxsaxqqqcvgrpl453n7bc";
   };
 
-
   patches = [
-    # https://github.com/veracrypt/VeraCrypt/issues/529 - fix build on non-x86
-    (fetchpatch {
-      url = "https://github.com/veracrypt/VeraCrypt/commit/afe6b2f45b15393026a1159e5f3d165ac7d0b94a.patch";
-      sha256 = "1xm9cl6zinlr0vah5xr9bvh0y9gw4331zl7d2n5xvqrcdxw3ww1y";
-      stripLen = 1;
-    })
-    # https://github.com/veracrypt/VeraCrypt/issues/529 - fix build on non-x86
-    (fetchpatch {
-      url = "https://github.com/veracrypt/VeraCrypt/commit/3fa636d477119fff6e372074568edb42d038f508.patch";
-      sha256 = "0qsccilip0ksnlzxina38a052gb533r4s422lxhrj3wv9zgpp7l3";
-      stripLen = 1;
+    (substituteAll {
+      src = ./fix-paths.patch;
+      ext2 = "${e2fsprogs}/bin/mkfs.ext2";
+      ext3 = "${e2fsprogs}/bin/mkfs.ext3";
+      ext4 = "${e2fsprogs}/bin/mkfs.ext4";
+      exfat = "${exfat}/bin/mkfs.exfat";
+      ntfs = "${ntfs3g}/bin/mkfs.ntfs";
+      btrfs = "${btrfs-progs}/bin/mkfs.btrfs";
     })
   ];
 
diff --git a/pkgs/applications/misc/veracrypt/fix-paths.patch b/pkgs/applications/misc/veracrypt/fix-paths.patch
new file mode 100644
index 000000000000..56b4fc483804
--- /dev/null
+++ b/pkgs/applications/misc/veracrypt/fix-paths.patch
@@ -0,0 +1,22 @@
+diff --color --unified --recursive --text a/Core/VolumeCreator.h b/Core/VolumeCreator.h
+--- a/Core/VolumeCreator.h	2021-06-20 20:54:50.725210056 +0300
++++ b/Core/VolumeCreator.h	2021-06-20 20:58:46.117742419 +0300
+@@ -77,12 +77,12 @@
+ 				switch (fsType)
+ 				{
+ 	#if defined (TC_LINUX)
+-				case VolumeCreationOptions::FilesystemType::Ext2:		return "mkfs.ext2";
+-				case VolumeCreationOptions::FilesystemType::Ext3:		return "mkfs.ext3";
+-				case VolumeCreationOptions::FilesystemType::Ext4:		return "mkfs.ext4";
+-				case VolumeCreationOptions::FilesystemType::NTFS:		return "mkfs.ntfs";
+-				case VolumeCreationOptions::FilesystemType::exFAT:		return "mkfs.exfat";
+-				case VolumeCreationOptions::FilesystemType::Btrfs:		return "mkfs.btrfs";
++				case VolumeCreationOptions::FilesystemType::Ext2:		return "@ext2@";
++				case VolumeCreationOptions::FilesystemType::Ext3:		return "@ext3@";
++				case VolumeCreationOptions::FilesystemType::Ext4:		return "@ext4@";
++				case VolumeCreationOptions::FilesystemType::NTFS:		return "@ntfs@";
++				case VolumeCreationOptions::FilesystemType::exFAT:		return "@exfat@";
++				case VolumeCreationOptions::FilesystemType::Btrfs:		return "@btrfs@";
+ 	#elif defined (TC_MACOSX)
+ 				case VolumeCreationOptions::FilesystemType::MacOsExt:	return "newfs_hfs";
+ 				case VolumeCreationOptions::FilesystemType::exFAT:		return "newfs_exfat";

From a50998431e162b5a077722c9604e74a76a73e965 Mon Sep 17 00:00:00 2001
From: Alex M <alexmgit@protonmail.com>
Date: Sun, 20 Jun 2021 12:33:12 -0700
Subject: [PATCH 242/416] probe-run: 0.2.2 -> 0.2.3

---
 pkgs/development/tools/rust/probe-run/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/rust/probe-run/default.nix b/pkgs/development/tools/rust/probe-run/default.nix
index 262d8c4945eb..336cbef9bae0 100644
--- a/pkgs/development/tools/rust/probe-run/default.nix
+++ b/pkgs/development/tools/rust/probe-run/default.nix
@@ -3,16 +3,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "probe-run";
-  version = "0.2.2";
+  version = "0.2.3";
 
   src = fetchFromGitHub {
     owner = "knurling-rs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "avaGBIKldr+1Zwq+7NOHt2wldmY/6Lb6bi9uVHZFI5Q=";
+    sha256 = "0jvyqynhg2fva29bzj4wrg3f22xpvl1hdf9kqws2c3wdiz9lc8l4";
   };
 
-  cargoSha256 = "HmDKfb8F6sGnaX64FR3No2GbBYm4bVopbjs8d35WiZQ=";
+  cargoSha256 = "1jijpm4k3py09k9w9a2zj1795r02wsa53r4sxa4ws96d4gkv4x5b";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libusb1 ]

From 7310407d493ee1c7caf38f8181507d7ac9c90eb8 Mon Sep 17 00:00:00 2001
From: Kevin Amado <kamadorueda@gmail.com>
Date: Sun, 20 Jun 2021 13:18:56 -0500
Subject: [PATCH 243/416] timedoctor: init at 3.12.12

---
 .../office/timedoctor/default.nix             | 123 ++++++++++++++++++
 pkgs/top-level/all-packages.nix               |   2 +
 2 files changed, 125 insertions(+)
 create mode 100644 pkgs/applications/office/timedoctor/default.nix

diff --git a/pkgs/applications/office/timedoctor/default.nix b/pkgs/applications/office/timedoctor/default.nix
new file mode 100644
index 000000000000..f4ce436e963b
--- /dev/null
+++ b/pkgs/applications/office/timedoctor/default.nix
@@ -0,0 +1,123 @@
+{ appimageTools
+, fetchurl
+, lib
+}:
+
+# You can debug this package with: $ ELECTRON_ENABLE_LOGGING=true timedoctor
+let
+  version = "3.12.12";
+  sha256 = "01j149c6lacgysll3sajxlb43m1al08kdcwc6zyzw80nrp4iagf6";
+in
+appimageTools.wrapType2 {
+  name = "timedoctor-${version}";
+  src = fetchurl {
+    inherit sha256;
+    url = "https://repo2.timedoctor.com/td-desktop-hybrid/prod/v${version}/timedoctor-desktop_${version}_linux-x86_64.AppImage";
+  };
+  multiPkgs = _: with _; [
+    alsaLib
+    atk
+    at-spi2-atk
+    at-spi2-core
+    cairo
+    coreutils
+    cups
+    dbus
+    dbus.lib
+    desktop-file-utils
+    expat
+    expat.dev
+    file
+    freetype
+    gcc
+    gcc-unwrapped.lib
+    gdb
+    gdk-pixbuf
+    git
+    glib
+    glibc
+    gnome.gdk_pixbuf
+    gnome.gtk
+    gnome.gtk.dev
+    gnome.zenity
+    gnome2.GConf
+    gnumake
+    gnutar
+    gpsd
+    gtk3
+    gtk3.dev
+    gtk3-x11
+    gtk3-x11.dev
+    kdialog
+    libappindicator-gtk2.out
+    libexif
+    (libjpeg.override { enableJpeg8 = true; }).out
+    libnotify
+    libpng
+    libxml2
+    libxslt
+    netcat
+    nettools
+    nodePackages.asar
+    nspr
+    nss
+    openjdk
+    pango
+    patchelf
+    python38
+    strace
+    sqlite
+    sqlite.dev
+    udev
+    unzip
+    utillinux
+    watch
+    wget
+    which
+    wrapGAppsHook
+    xdg_utils
+    xorg.libX11
+    xorg.libXau
+    xorg.libXaw
+    xorg.libXaw3d
+    xorg.libxcb
+    xorg.libXcomposite
+    xorg.libXcursor
+    xorg.libXdamage
+    xorg.libXdmcp
+    xorg.libXext
+    xorg.libXfixes
+    xorg.libXfont
+    xorg.libXfont2
+    xorg.libXft
+    xorg.libXi
+    xorg.libXinerama
+    xorg.libXmu
+    xorg.libXp
+    xorg.libXpm
+    xorg.libXpresent
+    xorg.libXrandr
+    xorg.libXrender
+    xorg.libXres
+    xorg.libXScrnSaver
+    xorg.libXt
+    xorg.libXTrap
+    xorg.libXtst
+    xorg.libXv
+    xorg.libXvMC
+    xorg.libXxf86dga
+    xorg.libXxf86misc
+    xorg.libXxf86vm
+    xorg.xcbutilkeysyms
+    zip
+    zlib
+    zsh
+  ];
+  meta = with lib; {
+    description = "Employee time tracking software";
+    homepage = "https://www.timedoctor.com";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ kamadorueda ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9da0e75c795a..3b8c22482565 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1010,6 +1010,8 @@ in
 
   tilix = callPackage ../applications/terminal-emulators/tilix { };
 
+  timedoctor = callPackage ../applications/office/timedoctor { };
+
   twine = with python3Packages; toPythonApplication twine;
 
   wayst = callPackage ../applications/terminal-emulators/wayst { };

From 9ff14ca65663c43a8ef4e60bf1bd44ac422eab77 Mon Sep 17 00:00:00 2001
From: Sandro <sandro.jaeckel@gmail.com>
Date: Sun, 20 Jun 2021 22:04:28 +0200
Subject: [PATCH 244/416] a52dec: don't use meta.homepage in src

---
 pkgs/development/libraries/a52dec/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/a52dec/default.nix b/pkgs/development/libraries/a52dec/default.nix
index faa819ec5615..c6e3445dc8ae 100644
--- a/pkgs/development/libraries/a52dec/default.nix
+++ b/pkgs/development/libraries/a52dec/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "0.7.4";
 
   src = fetchurl {
-    url = "${meta.homepage}/files/${pname}-${version}.tar.gz";
+    url = "https://liba52.sourceforge.net/files/${pname}-${version}.tar.gz";
     sha256 = "oh1ySrOzkzMwGUNTaH34LEdbXfuZdRPu9MJd5shl7DM=";
   };
 

From d026185c79eebdc94d64a167e026fd60e1f26e7e Mon Sep 17 00:00:00 2001
From: Tom McLaughlin <tom@codedown.io>
Date: Sun, 20 Jun 2021 13:56:29 -0700
Subject: [PATCH 245/416] init: metakernel at 0.27.5

---
 .../python-modules/metakernel/default.nix     | 30 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 32 insertions(+)
 create mode 100644 pkgs/development/python-modules/metakernel/default.nix

diff --git a/pkgs/development/python-modules/metakernel/default.nix b/pkgs/development/python-modules/metakernel/default.nix
new file mode 100644
index 000000000000..eec3da25e0f2
--- /dev/null
+++ b/pkgs/development/python-modules/metakernel/default.nix
@@ -0,0 +1,30 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, ipykernel
+, isPy27
+, mock
+, pytest
+}:
+
+buildPythonPackage rec {
+  pname = "metakernel";
+  version = "0.27.5";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0aqq9zil6h7kxsg3v2008nr6lv47qvcsash8qzmi1xh6r4x606zy";
+  };
+
+  propagatedBuildInputs = [ ipykernel ];
+
+  # Tests hang, so disable
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Jupyter/IPython Kernel Tools";
+    homepage = "https://github.com/Calysto/metakernel";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ thomasjm ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index f331e80124b1..8e2ee354243f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4220,6 +4220,8 @@ in {
 
   mesonpep517 = callPackage ../development/python-modules/mesonpep517 { };
 
+  metakernel = callPackage ../development/python-modules/metakernel { };
+
   metar = callPackage ../development/python-modules/metar { };
 
   mezzanine = callPackage ../development/python-modules/mezzanine { };

From 30013a61746405015bd84327b1a2407d73eae2d2 Mon Sep 17 00:00:00 2001
From: Tom McLaughlin <tom@codedown.io>
Date: Sun, 20 Jun 2021 13:56:50 -0700
Subject: [PATCH 246/416] init: octave-kernel at 0.32.0

---
 .../jupyter-kernels/octave/default.nix        | 60 +++++++++++++++++++
 .../editors/jupyter-kernels/octave/kernel.nix | 30 ++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 3 files changed, 92 insertions(+)
 create mode 100644 pkgs/applications/editors/jupyter-kernels/octave/default.nix
 create mode 100644 pkgs/applications/editors/jupyter-kernels/octave/kernel.nix

diff --git a/pkgs/applications/editors/jupyter-kernels/octave/default.nix b/pkgs/applications/editors/jupyter-kernels/octave/default.nix
new file mode 100644
index 000000000000..9db38d144489
--- /dev/null
+++ b/pkgs/applications/editors/jupyter-kernels/octave/default.nix
@@ -0,0 +1,60 @@
+{ lib
+, stdenv
+, callPackage
+, runCommand
+, makeWrapper
+, octave
+, imagemagick
+, python3
+}:
+
+# To test:
+# $(nix-build -E 'with import <nixpkgs> {}; jupyter.override { definitions = { octave = octave-kernel.definition; }; }')/bin/jupyter-notebook
+
+let
+  kernel = callPackage ./kernel.nix {
+    python3Packages = python3.pkgs;
+  };
+
+in
+
+rec {
+  launcher = runCommand "octave-kernel-launcher" {
+    inherit octave;
+    python = python3.withPackages (ps: [ ps.traitlets ps.jupyter_core ps.ipykernel ps.metakernel kernel ]);
+    buildInputs = [ makeWrapper ];
+  } ''
+    mkdir -p $out/bin
+
+    makeWrapper $python/bin/python $out/bin/octave-kernel \
+      --add-flags "-m octave_kernel" \
+      --suffix PATH : $octave/bin
+  '';
+
+  sizedLogo = size: stdenv.mkDerivation {
+    name = ''octave-logo-${octave.version}-${size}x${size}.png'';
+
+    src = octave.src;
+
+    buildInputs = [ imagemagick ];
+
+    dontConfigure = true;
+    dontInstall = true;
+
+    buildPhase = ''
+      convert ./libgui/src/icons/logo.png -resize ${size}x${size} $out
+    '';
+  };
+
+  definition = {
+    displayName = "Octave";
+    argv = [
+      "${launcher}/bin/octave-kernel"
+      "-f"
+      "{connection_file}"
+    ];
+    language = "octave";
+    logo32 = sizedLogo "32";
+    logo64 = sizedLogo "64";
+  };
+}
diff --git a/pkgs/applications/editors/jupyter-kernels/octave/kernel.nix b/pkgs/applications/editors/jupyter-kernels/octave/kernel.nix
new file mode 100644
index 000000000000..9ebb4257784b
--- /dev/null
+++ b/pkgs/applications/editors/jupyter-kernels/octave/kernel.nix
@@ -0,0 +1,30 @@
+{ lib, octave, python3Packages }:
+
+with python3Packages;
+
+buildPythonPackage rec {
+  pname = "octave-kernel";
+  version = "0.32.0";
+
+  src = fetchPypi {
+    pname = "octave_kernel";
+    inherit version;
+    sha256 = "0dfbxfcf3bz4jswnpkibnjwlkgy0y4j563nrhaqxv3nfa65bksif";
+  };
+
+  propagatedBuildInputs = [ metakernel ipykernel ];
+
+  # Tests require jupyter_kernel_test to run, but it hasn't seen a
+  # release since 2017 and seems slightly abandoned.
+  # Doing fetchPypi on it doesn't work, even though it exists here:
+  # https://pypi.org/project/jupyter_kernel_test/.
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A Jupyter kernel for Octave.";
+    homepage = "https://github.com/Calysto/octave_kernel";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ thomasjm ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d5b4c1104e97..f6e75bc37fd0 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12095,6 +12095,8 @@ in
     overridePlatforms = ["x86_64-linux" "x86_64-darwin"];
   };
 
+  octave-kernel = callPackage ../applications/editors/jupyter-kernels/octave { };
+
   octavePackages = recurseIntoAttrs octave.pkgs;
 
   ocropus = callPackage ../applications/misc/ocropus { };

From 83e8b3d065d51689c855bffb29854a98d84b3982 Mon Sep 17 00:00:00 2001
From: Nikolay Korotkiy <sikmir@gmail.com>
Date: Mon, 21 Jun 2021 00:35:04 +0300
Subject: [PATCH 247/416] =?UTF-8?q?maim:=205.6.3=20=E2=86=92=205.7.4=20(#1?=
 =?UTF-8?q?27416)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
---
 pkgs/tools/graphics/maim/default.nix | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/pkgs/tools/graphics/maim/default.nix b/pkgs/tools/graphics/maim/default.nix
index 12db00af0dd9..f4851c6bcabf 100644
--- a/pkgs/tools/graphics/maim/default.nix
+++ b/pkgs/tools/graphics/maim/default.nix
@@ -1,22 +1,21 @@
 { lib, stdenv, fetchFromGitHub, cmake, pkg-config
-, zlib, libpng, libjpeg, libGLU, libGL, glm
+, zlib, libpng, libjpeg, libwebp, libGLU, libGL, glm
 , libX11, libXext, libXfixes, libXrandr, libXcomposite, slop, icu
 }:
 
 stdenv.mkDerivation rec {
   pname = "maim";
-  version = "5.6.3";
+  version = "5.7.4";
 
   src = fetchFromGitHub {
     owner = "naelstrof";
     repo = "maim";
     rev = "v${version}";
-    sha256 = "181mjjrjb9fs1ficcv9miqbk94v95j1yli7fjp2dj514g7nj9l3x";
+    sha256 = "sha256-uFtiwaM3H09vfvz3wVvumbqkoZhLNJxONkMqqqrJBs4=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs =
-    [ zlib libpng libjpeg libGLU libGL glm
+  buildInputs = [ zlib libpng libjpeg libwebp libGLU libGL glm
       libX11 libXext libXfixes libXrandr libXcomposite slop icu ];
 
   doCheck = false;

From 0d635e26463ce795df179a0c835ff86e410599d4 Mon Sep 17 00:00:00 2001
From: Johannes Arnold <johannes.arnold@stud.uni-hannover.de>
Date: Mon, 21 Jun 2021 00:20:26 +0200
Subject: [PATCH 248/416] element: init at 1.0.0

---
 .../science/chemistry/element/default.nix     | 22 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 ++
 2 files changed, 24 insertions(+)
 create mode 100644 pkgs/applications/science/chemistry/element/default.nix

diff --git a/pkgs/applications/science/chemistry/element/default.nix b/pkgs/applications/science/chemistry/element/default.nix
new file mode 100644
index 000000000000..812272e2fb9b
--- /dev/null
+++ b/pkgs/applications/science/chemistry/element/default.nix
@@ -0,0 +1,22 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "element";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "gennaro-tedesco";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "gjdcNvYNnxb6hOE/MQjTezZeYGBWTr4E8/Pt8YQv3lY=";
+  };
+
+  vendorSha256 = "A4g2rQTaYrA4/0rqldUv7iuibzNINEvx9StUnaN2/Yg=";
+
+  meta = with lib; {
+    description = "The periodic table on the command line";
+    homepage = "https://github.com/gennaro-tedesco/element";
+    license = licenses.asl20;
+    maintainers = [ maintainers.j0hax ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1213a05d66c1..28ea920346f5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2562,6 +2562,8 @@ in
 
   electron-mail = callPackage ../applications/networking/mailreaders/electron-mail { };
 
+  element = callPackage ../applications/science/chemistry/element { };
+
   element-desktop = callPackage ../applications/networking/instant-messengers/element/element-desktop.nix { };
 
   element-web = callPackage ../applications/networking/instant-messengers/element/element-web.nix {

From 46135305113c5542c3a2a8d10dc67d4710c5621a Mon Sep 17 00:00:00 2001
From: Ethan Edwards <ethan@ethancedwards.com>
Date: Sun, 20 Jun 2021 18:40:07 -0400
Subject: [PATCH 249/416] tmuxPlugins.dracula: unstable-2021-02-18 ->
 unstable-2021-06-20 (#127591)

---
 pkgs/misc/tmux-plugins/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/misc/tmux-plugins/default.nix b/pkgs/misc/tmux-plugins/default.nix
index d8ab3dcc5c6f..acad28a0a74c 100644
--- a/pkgs/misc/tmux-plugins/default.nix
+++ b/pkgs/misc/tmux-plugins/default.nix
@@ -127,12 +127,12 @@ in rec {
 
   dracula = mkTmuxPlugin rec {
     pluginName = "dracula";
-    version = "unstable-2021-02-18";
+    version = "unstable-2021-06-20";
     src = fetchFromGitHub {
       owner = "dracula";
       repo = "tmux";
-      rev = "8d1a7fa41b773d4f7b53dfff2d9fc5166d34f104";
-      sha256 = "DG+oKbTkYO4hwoOlOqW5IuCLdVEttlvLM2en4DUHyMY=";
+      rev = "e25e7a315787f310c2e95098cd8c735693998f89";
+      sha256 = "n8LFRbljlFzb72ZsUM1Zbz6C99g5/GjMoNyADlEEVAg=";
     };
     meta = with lib; {
       homepage = "https://draculatheme.com/tmux";

From bd8181ae83ff9b5f7fe2e405b3197dfaea33632e Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sun, 20 Jun 2021 23:31:05 +0000
Subject: [PATCH 250/416] guile-gcrypt: 0.2.1 -> 0.3.0

---
 pkgs/development/guile-modules/guile-gcrypt/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/guile-modules/guile-gcrypt/default.nix b/pkgs/development/guile-modules/guile-gcrypt/default.nix
index 0a9e1de61265..73152fb9d2c3 100644
--- a/pkgs/development/guile-modules/guile-gcrypt/default.nix
+++ b/pkgs/development/guile-modules/guile-gcrypt/default.nix
@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation rec {
   pname = "guile-gcrypt";
-  version = "0.2.1";
+  version = "0.3.0";
 
   src = fetchFromGitea {
     domain = "notabug.org";
     owner = "cwebber";
     repo = "guile-gcrypt";
     rev = "v${version}";
-    sha256 = "LKXIwO8v/T/h1JKARWD5ta57sgRcVu7hcYYwr3wUQ1g=";
+    sha256 = "sha256-lAaiKBOdTFWEWsmwKgx0C67ACvtnEKUxti66dslzSVQ=";
   };
 
   postConfigure = ''

From 2ae8799f8df6c6df41778575384ac022b7473478 Mon Sep 17 00:00:00 2001
From: Ethan Edwards <ethan@ethancedwards.com>
Date: Sun, 20 Jun 2021 20:08:27 -0400
Subject: [PATCH 251/416] guile-git: 0.3.0 -> 0.5.1

---
 pkgs/development/guile-modules/guile-git/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/guile-modules/guile-git/default.nix b/pkgs/development/guile-modules/guile-git/default.nix
index f337eefecb2f..254afae0cc4f 100644
--- a/pkgs/development/guile-modules/guile-git/default.nix
+++ b/pkgs/development/guile-modules/guile-git/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "guile-git";
-  version = "0.3.0";
+  version = "0.5.1";
 
   src = fetchFromGitLab {
     owner = "guile-git";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1s77s70gzfj6h7bglq431kw8l4iknhsfpc0mnvcp4lkhwdcgyn1n";
+    sha256 = "7Cnuyk9xAPTvz9R44O3lvKDrT6tUQui7YzxIoqhRfPQ=";
   };
 
   postConfigure = ''

From 2fe32ff495354bf2272fc0e33529b01933e04795 Mon Sep 17 00:00:00 2001
From: Ethan Edwards <ethan@ethancedwards.com>
Date: Sun, 20 Jun 2021 20:14:46 -0400
Subject: [PATCH 252/416] guile-json: 4.4.1 -> 4.5.2

---
 pkgs/development/guile-modules/guile-json/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/guile-modules/guile-json/default.nix b/pkgs/development/guile-modules/guile-json/default.nix
index 1d84bf37ce58..5433bbb1aa64 100644
--- a/pkgs/development/guile-modules/guile-json/default.nix
+++ b/pkgs/development/guile-modules/guile-json/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "guile-json";
-  version = "4.4.1";
+  version = "4.5.2";
 
   src = fetchurl {
     url = "mirror://savannah/guile-json/${pname}-${version}.tar.gz";
-    sha256 = "sha256-UqZt3pqXQzeHpzEiMvOMKSh1gK/K2KaJ70jMllNxBPc=";
+    sha256 = "GrBG7DaxxEwEGsJ1Vo2Bh4TXH6uaXZX5Eoz+iiUFGTM=";
   };
 
   postConfigure = ''

From 90497c4a76ebbae530784c25824fc02266ac10fc Mon Sep 17 00:00:00 2001
From: Ethan Edwards <ethan@ethancedwards.com>
Date: Sun, 20 Jun 2021 20:24:58 -0400
Subject: [PATCH 253/416] scheme-bytestructures: 1.0.7 -> 1.0.10

---
 .../scheme-modules/scheme-bytestructures/default.nix          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/scheme-modules/scheme-bytestructures/default.nix b/pkgs/development/scheme-modules/scheme-bytestructures/default.nix
index 545c9e165a12..67d9e39af62c 100644
--- a/pkgs/development/scheme-modules/scheme-bytestructures/default.nix
+++ b/pkgs/development/scheme-modules/scheme-bytestructures/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "scheme-bytestructures";
-  version = "1.0.7";
+  version = "1.0.10";
 
   src = fetchFromGitHub {
     owner = "TaylanUB";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0q0habjiy3h9cigb7q1br9kz6z212dn2ab31f6dgd3rrmsfn5rvb";
+    sha256 = "04oDvwvzTRzAVyywbcCm3Ug3p3xNbxjI7nOKYakEZZI=";
   };
 
   postConfigure = ''

From f141586b64f43727546f57e175935c9187e2e9d4 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Mon, 21 Jun 2021 03:38:12 +0300
Subject: [PATCH 254/416] robo3t: refactor and add keyword

---
 pkgs/applications/misc/robo3t/default.nix | 31 ++++++++++++++++++-----
 1 file changed, 24 insertions(+), 7 deletions(-)

diff --git a/pkgs/applications/misc/robo3t/default.nix b/pkgs/applications/misc/robo3t/default.nix
index 1b19d9ab9cc0..41f3475a645f 100644
--- a/pkgs/applications/misc/robo3t/default.nix
+++ b/pkgs/applications/misc/robo3t/default.nix
@@ -1,5 +1,18 @@
-{ lib, stdenv, fetchurl, curl, zlib, glib, xorg, dbus, fontconfig, libGL,
-  freetype, xkeyboard_config, makeDesktopItem, makeWrapper }:
+{ lib
+, stdenv
+, fetchurl
+, curl
+, zlib
+, glib
+, xorg
+, dbus
+, fontconfig
+, libGL
+, freetype
+, xkeyboard_config
+, makeDesktopItem
+, makeWrapper
+}:
 
 let
   curlWithGnuTls = curl.override { gnutlsSupport = true; sslSupport = false; };
@@ -30,7 +43,7 @@ stdenv.mkDerivation rec {
     categories = "Development;IDE;";
   };
 
-  nativeBuildInputs = [makeWrapper];
+  nativeBuildInputs = [ makeWrapper ];
 
   ldLibraryPath = lib.makeLibraryPath [
     stdenv.cc.cc
@@ -51,6 +64,8 @@ stdenv.mkDerivation rec {
   ];
 
   installPhase = ''
+    runHook preInstall
+
     BASEDIR=$out/lib/robo3t
 
     mkdir -p $BASEDIR/bin
@@ -72,13 +87,15 @@ stdenv.mkDerivation rec {
     makeWrapper $BASEDIR/bin/robo3t $out/bin/robo3t \
       --suffix LD_LIBRARY_PATH : ${ldLibraryPath} \
       --suffix QT_XKB_CONFIG_ROOT : ${xkeyboard_config}/share/X11/xkb
+
+    runHook postInstall
   '';
 
-  meta = {
+  meta = with lib; {
     homepage = "https://robomongo.org/";
-    description = "Query GUI for mongodb";
+    description = "Query GUI for mongodb. Formerly called Robomongo";
     platforms = [ "x86_64-linux" ];
-    license = lib.licenses.gpl3;
-    maintainers = [ lib.maintainers.eperuffo ];
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ eperuffo ];
   };
 }

From 19b8fd7321dd90b236217a4c2738d4d6a848ad88 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Mon, 21 Jun 2021 03:39:59 +0300
Subject: [PATCH 255/416] robomongo has been aliased to robo3t since 2017-09-28

---
 pkgs/applications/misc/robomongo/default.nix | 77 --------------------
 1 file changed, 77 deletions(-)
 delete mode 100644 pkgs/applications/misc/robomongo/default.nix

diff --git a/pkgs/applications/misc/robomongo/default.nix b/pkgs/applications/misc/robomongo/default.nix
deleted file mode 100644
index af5285909c6c..000000000000
--- a/pkgs/applications/misc/robomongo/default.nix
+++ /dev/null
@@ -1,77 +0,0 @@
-{ lib, stdenv, fetchurl, zlib, glib, xorg, dbus, fontconfig,
-  freetype, xkeyboard_config, makeDesktopItem, makeWrapper }:
-
-stdenv.mkDerivation rec {
-  pname = "robomongo";
-  version = "0.9.0";
-
-  src = fetchurl {
-    url = "https://download.robomongo.org/${version}/linux/robomongo-${version}-linux-x86_64-0786489.tar.gz";
-    sha256 = "1q8ahdz3afcw002p8dl2pybzkq4srk6bnikrz216yx1gswivdcad";
-  };
-
-  icon = fetchurl {
-    url = "https://github.com/Studio3T/robomongo/raw/${version}/trash/install/linux/robomongo.png";
-    sha256 = "15li8536x600kkfkb3h6mw7y0f2ljkv951pc45dpiw036vldibv2";
-  };
-
-  desktopItem = makeDesktopItem {
-    name = "robomongo";
-    exec = "robomongo";
-    icon = icon;
-    comment = "Query GUI for mongodb";
-    desktopName = "Robomongo";
-    genericName = "MongoDB management tool";
-    categories = "Development;IDE;mongodb;";
-  };
-
-  nativeBuildInputs = [makeWrapper];
-
-  ldLibraryPath = lib.makeLibraryPath [
-    stdenv.cc.cc
-    zlib
-    glib
-    xorg.libXi
-    xorg.libxcb
-    xorg.libXrender
-    xorg.libX11
-    xorg.libSM
-    xorg.libICE
-    xorg.libXext
-    dbus
-    fontconfig
-    freetype
-  ];
-
-  installPhase = ''
-    BASEDIR=$out/lib/robomongo
-
-    mkdir -p $BASEDIR/bin
-    cp bin/* $BASEDIR/bin
-
-    mkdir -p $BASEDIR/lib
-    cp -r lib/* $BASEDIR/lib
-
-    mkdir -p $out/share/applications
-    cp $desktopItem/share/applications/* $out/share/applications
-
-    mkdir -p $out/share/icons
-    cp ${icon} $out/share/icons/robomongo.png
-
-    patchelf --set-interpreter ${stdenv.glibc}/lib/ld-linux-x86-64.so.2 $BASEDIR/bin/robomongo
-
-    mkdir $out/bin
-
-    makeWrapper $BASEDIR/bin/robomongo $out/bin/robomongo \
-      --suffix LD_LIBRARY_PATH : ${ldLibraryPath} \
-      --suffix QT_XKB_CONFIG_ROOT : ${xkeyboard_config}/share/X11/xkb
-  '';
-
-  meta = {
-    homepage = "https://robomongo.org/";
-    description = "Query GUI for mongodb";
-    platforms = lib.intersectLists lib.platforms.linux lib.platforms.x86_64;
-    license = lib.licenses.gpl3;
-    maintainers = [ lib.maintainers.eperuffo ];
-  };
-}

From 2e23c2770988d0c6a088e3e67d6b974c430404d5 Mon Sep 17 00:00:00 2001
From: Ethan Edwards <ethan@ethancedwards.com>
Date: Sun, 20 Jun 2021 20:51:09 -0400
Subject: [PATCH 256/416] piston-cli: 1.4.1 -> 1.4.3

---
 pkgs/tools/misc/piston-cli/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/misc/piston-cli/default.nix b/pkgs/tools/misc/piston-cli/default.nix
index df244063b1b8..ec77007804b9 100644
--- a/pkgs/tools/misc/piston-cli/default.nix
+++ b/pkgs/tools/misc/piston-cli/default.nix
@@ -2,11 +2,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "piston-cli";
-  version = "1.4.1";
+  version = "1.4.3";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "o8GPtSQ119AKB64hAH8VY6iJmhXcSFqjOanmXQl0tHo=";
+    sha256 = "qvDGVJcaMXUajdUQWl4W1dost8k0PsS9XX/o8uQrtfY=";
   };
 
   propagatedBuildInputs = with python3Packages; [ rich prompt_toolkit requests pygments pyyaml ];

From 49a82a815b4896290c1c74cb0015c33c84aa321e Mon Sep 17 00:00:00 2001
From: Ethan Edwards <ethan@ethancedwards.com>
Date: Sun, 20 Jun 2021 22:27:04 -0400
Subject: [PATCH 257/416] tmuxPlugins.dracula: unstable-2020-06-20 -> 1.0

---
 pkgs/misc/tmux-plugins/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/misc/tmux-plugins/default.nix b/pkgs/misc/tmux-plugins/default.nix
index acad28a0a74c..5f768a20d473 100644
--- a/pkgs/misc/tmux-plugins/default.nix
+++ b/pkgs/misc/tmux-plugins/default.nix
@@ -127,12 +127,12 @@ in rec {
 
   dracula = mkTmuxPlugin rec {
     pluginName = "dracula";
-    version = "unstable-2021-06-20";
+    version = "1.0";
     src = fetchFromGitHub {
       owner = "dracula";
       repo = "tmux";
-      rev = "e25e7a315787f310c2e95098cd8c735693998f89";
-      sha256 = "n8LFRbljlFzb72ZsUM1Zbz6C99g5/GjMoNyADlEEVAg=";
+      rev = "v${version}";
+      sha256 = "YINyER/HT3L7RpTclD3UNiCRj1CL4GPCBBEUJRqUyEQ=";
     };
     meta = with lib; {
       homepage = "https://draculatheme.com/tmux";

From 670eefcd09ff8daa903de3b57054e58fa4ea6fbe Mon Sep 17 00:00:00 2001
From: Ethan Edwards <ethan@ethancedwards.com>
Date: Sun, 20 Jun 2021 22:37:41 -0400
Subject: [PATCH 258/416] tmuxPlugins.yank unstable-2019-12-02 ->
 unstable-2021-06-20

---
 pkgs/misc/tmux-plugins/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/misc/tmux-plugins/default.nix b/pkgs/misc/tmux-plugins/default.nix
index acad28a0a74c..cb6a170b226c 100644
--- a/pkgs/misc/tmux-plugins/default.nix
+++ b/pkgs/misc/tmux-plugins/default.nix
@@ -576,12 +576,12 @@ in rec {
 
   yank = mkTmuxPlugin {
     pluginName = "yank";
-    version = "unstable-2019-12-02";
+    version = "unstable-2021-06-20";
     src = fetchFromGitHub {
       owner = "tmux-plugins";
       repo = "tmux-yank";
-      rev = "648005db64d9bf3c4650eff694ecb6cf3e42b0c8";
-      sha256 = "1zg9k8yk1iw01vl8m44w4sv20lln4l0lq9dafc09lxmgxm9dllj4";
+      rev = "1b1a436e19f095ae8f825243dbe29800a8acd25c";
+      sha256 = "hRvkBf+YrWycecnDixAsD4CAHg3KsioomfJ/nLl5Zgs=";
     };
   };
 }

From 57ac5534e2ee904e7469d9a4fe43eba1a019b658 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sun, 20 Jun 2021 16:54:13 +0000
Subject: [PATCH 259/416] erlangR23: 23.3.4.3 -> 23.3.4.4

---
 pkgs/development/interpreters/erlang/R23.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/erlang/R23.nix b/pkgs/development/interpreters/erlang/R23.nix
index 3ecbf3de2a91..9e344adc15a3 100644
--- a/pkgs/development/interpreters/erlang/R23.nix
+++ b/pkgs/development/interpreters/erlang/R23.nix
@@ -3,6 +3,6 @@
 # How to obtain `sha256`:
 # nix-prefetch-url --unpack https://github.com/erlang/otp/archive/OTP-${version}.tar.gz
 mkDerivation {
-  version = "23.3.4.3";
-  sha256 = "wmR0XTMrJ3608HD341lNlYChwxs/8jb12Okw3RNHGCA=";
+  version = "23.3.4.4";
+  sha256 = "dnoSGfBUZrgcnNQNAoqmVOxK/NQlt1DC187sxg7mPq8=";
 }

From 58496df6804741c97f18d888abb48d905764e3ca Mon Sep 17 00:00:00 2001
From: AndersonTorres <torres.anderson.85@protonmail.com>
Date: Mon, 21 Jun 2021 00:26:40 -0300
Subject: [PATCH 260/416] sakura: 3.7.1 -> 3.8.2

---
 .../terminal-emulators/sakura/default.nix     | 35 ++++++++++++-------
 1 file changed, 23 insertions(+), 12 deletions(-)

diff --git a/pkgs/applications/terminal-emulators/sakura/default.nix b/pkgs/applications/terminal-emulators/sakura/default.nix
index af56f54a4149..fbebf6590d07 100644
--- a/pkgs/applications/terminal-emulators/sakura/default.nix
+++ b/pkgs/applications/terminal-emulators/sakura/default.nix
@@ -1,30 +1,41 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
 , cmake
-, pkg-config
-, gtk3
-, perl
-, vte
-, pcre2
 , glib
+, gtk3
 , makeWrapper
+, pcre2
+, perl
+, pkg-config
+, vte
 }:
 
 stdenv.mkDerivation rec {
   pname = "sakura";
-  version = "3.7.1";
+  version = "3.8.2";
 
   src = fetchurl {
     url = "https://launchpad.net/${pname}/trunk/${version}/+download/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-cppODnUKQpS9kFkkOqxU3yqAElAVn8VQtQsP4Carkos=";
+    sha256 = "sha256-nd/okZrg4RZzyiKHmuMkVl0Jh7FOlI4dK63/U4/htbk=";
   };
 
-  nativeBuildInputs = [ cmake perl pkg-config makeWrapper ];
+  nativeBuildInputs = [
+    cmake
+    makeWrapper
+    perl
+    pkg-config
+  ];
 
-  buildInputs = [ gtk3 vte pcre2 glib ];
+  buildInputs = [
+    glib
+    gtk3
+    pcre2
+    vte
+  ];
 
-  # Set path to gsettings-schemata so sakura knows
-  # where to find colorchooser, fontchooser etc.
+  # Set path to gsettings-schemata so sakura knows where to find colorchooser,
+  # fontchooser etc.
   postInstall = ''
     wrapProgram $out/bin/sakura \
       --suffix XDG_DATA_DIRS : ${gtk3}/share/gsettings-schemas/${gtk3.name}/

From ad0d8bbe7784542e8a742e6ea4e427382e4a7594 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nguy=E1=BB=85n=20Gia=20Phong?= <mcsinyx@disroot.org>
Date: Sun, 20 Jun 2021 15:53:54 +0700
Subject: [PATCH 261/416] clipbuzz: init at 2.0.0

---
 pkgs/tools/misc/clipbuzz/default.nix | 31 ++++++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix      |  2 ++
 2 files changed, 33 insertions(+)
 create mode 100644 pkgs/tools/misc/clipbuzz/default.nix

diff --git a/pkgs/tools/misc/clipbuzz/default.nix b/pkgs/tools/misc/clipbuzz/default.nix
new file mode 100644
index 000000000000..aaa37ad7c18f
--- /dev/null
+++ b/pkgs/tools/misc/clipbuzz/default.nix
@@ -0,0 +1,31 @@
+{ stdenv, lib, fetchFromSourcehut, zig, libX11, libXfixes }:
+
+stdenv.mkDerivation rec {
+  pname = "clipbuzz";
+  version = "2.0.0";
+
+  src = fetchFromSourcehut {
+    owner = "~cnx";
+    repo = pname;
+    rev = version;
+    sha256 = "1qn98bwp7v7blw4v0g4pckgxrky5ggvq9m0kck2kqw8jg9jc15jp";
+  };
+
+  nativeBuildInputs = [ zig ];
+  buildInputs = [ libX11 libXfixes ];
+
+  preBuild = ''
+    export HOME=$TMPDIR
+  '';
+
+  installPhase = ''
+    zig build -Drelease-safe -Dcpu=baseline --prefix $out install
+  '';
+
+  meta = with lib; {
+    description = "Buzz on new X11 clipboard events";
+    homepage = "https://git.sr.ht/~cnx/clipbuzz";
+    license = licenses.unlicense;
+    maintainers = [ maintainers.McSinyx ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 40be91d9a71a..f4ccb9af605b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10008,6 +10008,8 @@ in
 
   clipnotify = callPackage ../tools/misc/clipnotify { };
 
+  clipbuzz = callPackage ../tools/misc/clipbuzz { };
+
   xclip = callPackage ../tools/misc/xclip { };
 
   xcur2png = callPackage ../tools/graphics/xcur2png { };

From 23e36778a13ca70c16535fbbd47590ec4205178d Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Mon, 21 Jun 2021 04:20:00 +0000
Subject: [PATCH 262/416] entr: fix segfault on darwin

---
 pkgs/tools/misc/entr/default.nix | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/pkgs/tools/misc/entr/default.nix b/pkgs/tools/misc/entr/default.nix
index dd5d960085b1..abfd12523db9 100644
--- a/pkgs/tools/misc/entr/default.nix
+++ b/pkgs/tools/misc/entr/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, coreutils, ncurses }:
+{ lib, stdenv, fetchurl, coreutils, ncurses, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "entr";
@@ -9,6 +9,16 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-4lak0vvkb2EyRggzukR+ZdfzW6nQsmXnxBUDl8xEBaI=";
   };
 
+  patches = lib.optionals stdenv.isDarwin [
+    # Fix v4.9 segfault on Darwin. remove with the next update
+    # https://github.com/eradman/entr/issues/74
+    (fetchpatch {
+      url = "https://github.com/eradman/entr/commit/468d77d45925abba826bb1dcda01487dbe37eb33.patch";
+      sha256 = "17kkcrsnac0pb930sf2kix71h4c7krzsrvz8pskx0vm39n1c9xfi";
+      includes = [ "entr.c" ];
+    })
+  ];
+
   postPatch = ''
     substituteInPlace Makefile.bsd --replace /bin/echo echo
     substituteInPlace entr.c --replace /bin/cat ${coreutils}/bin/cat

From 306502a42feb35f68c8355adf78ec1485310d7b9 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Mon, 21 Jun 2021 04:20:00 +0000
Subject: [PATCH 263/416] vale: 2.10.2 -> 2.10.4

---
 pkgs/tools/text/vale/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/text/vale/default.nix b/pkgs/tools/text/vale/default.nix
index 0de5ea5377cd..257b11933b95 100644
--- a/pkgs/tools/text/vale/default.nix
+++ b/pkgs/tools/text/vale/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "vale";
-  version = "2.10.2";
+  version = "2.10.4";
 
   subPackages = [ "cmd/vale" ];
   outputs = [ "out" "data" ];
@@ -11,10 +11,10 @@ buildGoModule rec {
     owner  = "errata-ai";
     repo   = "vale";
     rev    = "v${version}";
-    sha256 = "0cpq2pv6d67fdnm2qbb7p9amk0as8bm4knkywak8fsqadxfadx80";
+    sha256 = "0gw7b6gvzp2f7la1mb74bg92nd8zk5fiajsihcqpni2a79js1s6y";
   };
 
-  vendorSha256 = "14zimsl0f7sxqqka00krix3q2mxdcpk8n2zh7bz8awjwzn4kg8m3";
+  vendorSha256 = "15r97mpsailsa4ja6mh5wrjcjacppm0vwma9q6znsa2f1x2apc6y";
 
   postInstall = ''
     mkdir -p $data/share/vale

From 155284f40e8e0dcf518d33d4998f633ee33d251a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nguy=E1=BB=85n=20Gia=20Phong?= <mcsinyx@disroot.org>
Date: Mon, 21 Jun 2021 11:20:53 +0700
Subject: [PATCH 264/416] pn: init at unstable-2021-01-28

---
 pkgs/tools/text/pn/default.nix  | 24 ++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix |  2 ++
 2 files changed, 26 insertions(+)
 create mode 100644 pkgs/tools/text/pn/default.nix

diff --git a/pkgs/tools/text/pn/default.nix b/pkgs/tools/text/pn/default.nix
new file mode 100644
index 000000000000..81e4c1eb358a
--- /dev/null
+++ b/pkgs/tools/text/pn/default.nix
@@ -0,0 +1,24 @@
+{ lib, stdenv, fetchFromGitHub, cmake, libphonenumber, icu, protobuf }:
+
+stdenv.mkDerivation rec {
+  pname = "pn";
+  version = "unstable-2021-01-28";
+
+  src = fetchFromGitHub {
+    owner = "Orange-OpenSource";
+    repo = pname;
+    rev = "41e1215397129ed0d42b5f137fb35b5e0648edda";
+    sha256 = "1g8r7y230k01ghraa55g1bhz3fiz6bjdgcsddy2dfa5ih8c4s3jm";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ libphonenumber icu protobuf ];
+
+  meta = with lib; {
+    description = "A libphonenumber command-line wrapper";
+    homepage = "https://github.com/Orange-OpenSource/pn";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    maintainers = [ maintainers.McSinyx ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 40be91d9a71a..d5548e9812f1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3117,6 +3117,8 @@ in
 
   playerctl = callPackage ../tools/audio/playerctl { };
 
+  pn = callPackage ../tools/text/pn { };
+
   poweralertd = callPackage ../tools/misc/poweralertd { };
 
   ps_mem = callPackage ../tools/system/ps_mem { };

From d6fe06a30598ed308b54811602d5bc6cc534005f Mon Sep 17 00:00:00 2001
From: fortuneteller2k <lythe1107@gmail.com>
Date: Mon, 21 Jun 2021 13:21:29 +0800
Subject: [PATCH 265/416] vieb: 5.1.0 -> 5.2.0

---
 .../networking/browsers/vieb/default.nix      |   7 +-
 .../networking/browsers/vieb/package.json     |   9 +-
 .../networking/browsers/vieb/yarn.lock        | 513 +++++++++---------
 .../networking/browsers/vieb/yarn.nix         | 400 +++++++-------
 4 files changed, 488 insertions(+), 441 deletions(-)

diff --git a/pkgs/applications/networking/browsers/vieb/default.nix b/pkgs/applications/networking/browsers/vieb/default.nix
index 5a2b45725df6..0eeb52311599 100644
--- a/pkgs/applications/networking/browsers/vieb/default.nix
+++ b/pkgs/applications/networking/browsers/vieb/default.nix
@@ -2,13 +2,13 @@
 
 mkYarnPackage rec {
   pname = "vieb";
-  version = "5.1.0";
+  version = "5.2.0";
 
   src = fetchFromGitHub {
-    owner = "jelmerro";
+    owner = "Jelmerro";
     repo = pname;
     rev = version;
-    sha256 = "sha256-0C2gD40nPgEZopGMPsd5ajwcwFRjcu4Xc2DTpEwSK4c=";
+    sha256 = "sha256-wLaOqjDxgjfv4+TJeLE0dkrhfdnNSjiDqtFcHTm8uG4=";
   };
 
   packageJSON = ./package.json;
@@ -50,6 +50,7 @@ mkYarnPackage rec {
 
   meta = with lib; {
     homepage = "https://vieb.dev/";
+    changelog = "https://github.com/Jelmerro/Vieb/releases/tag/${version}";
     description = "Vim Inspired Electron Browser";
     maintainers = with maintainers; [ gebner fortuneteller2k ];
     platforms = platforms.unix;
diff --git a/pkgs/applications/networking/browsers/vieb/package.json b/pkgs/applications/networking/browsers/vieb/package.json
index 94effdaa2e51..e12d86356c26 100644
--- a/pkgs/applications/networking/browsers/vieb/package.json
+++ b/pkgs/applications/networking/browsers/vieb/package.json
@@ -1,9 +1,8 @@
 {
   "name": "vieb",
   "productName": "Vieb",
-  "version": "5.1.0",
+  "version": "5.2.0",
   "description": "Vim Inspired Electron Browser",
-  "bin": "app.js",
   "main": "app/index.js",
   "scripts": {
     "build": "node build.js",
@@ -30,9 +29,9 @@
   "license": "GPL-3.0-or-later",
   "devDependencies": {
     "archiver": "5.3.0",
-    "electron": "13.1.1",
-    "electron-builder": "22.11.5",
-    "eslint": "7.28.0",
+    "electron": "13.1.2",
+    "electron-builder": "22.11.7",
+    "eslint": "7.29.0",
     "eslint-plugin-compat": "3.9.0",
     "eslint-plugin-sort-keys-fix": "1.1.1",
     "jest-environment-jsdom": "27.0.3",
diff --git a/pkgs/applications/networking/browsers/vieb/yarn.lock b/pkgs/applications/networking/browsers/vieb/yarn.lock
index ff4a7248f61c..af42526610d0 100644
--- a/pkgs/applications/networking/browsers/vieb/yarn.lock
+++ b/pkgs/applications/networking/browsers/vieb/yarn.lock
@@ -14,32 +14,32 @@
   dependencies:
     "@babel/highlight" "^7.10.4"
 
-"@babel/code-frame@^7.12.13":
-  version "7.12.13"
-  resolved "https://registry.yarnpkg.com/@babel/code-frame/-/code-frame-7.12.13.tgz#dcfc826beef65e75c50e21d3837d7d95798dd658"
-  integrity sha512-HV1Cm0Q3ZrpCR93tkWOYiuYIgLxZXZFVG2VgK+MBWjUqZTundupbfx2aXarXuw5Ko5aMcjtJgbSs4vUGBS5v6g==
+"@babel/code-frame@^7.12.13", "@babel/code-frame@^7.14.5":
+  version "7.14.5"
+  resolved "https://registry.yarnpkg.com/@babel/code-frame/-/code-frame-7.14.5.tgz#23b08d740e83f49c5e59945fbf1b43e80bbf4edb"
+  integrity sha512-9pzDqyc6OLDaqe+zbACgFkb6fKMNG6CObKpnYXChRsvYGyEdc7CA2BaqeOM+vOtCS5ndmJicPJhKAwYRI6UfFw==
   dependencies:
-    "@babel/highlight" "^7.12.13"
+    "@babel/highlight" "^7.14.5"
 
-"@babel/compat-data@^7.14.4":
-  version "7.14.4"
-  resolved "https://registry.yarnpkg.com/@babel/compat-data/-/compat-data-7.14.4.tgz#45720fe0cecf3fd42019e1d12cc3d27fadc98d58"
-  integrity sha512-i2wXrWQNkH6JplJQGn3Rd2I4Pij8GdHkXwHMxm+zV5YG/Jci+bCNrWZEWC4o+umiDkRrRs4dVzH3X4GP7vyjQQ==
+"@babel/compat-data@^7.14.5":
+  version "7.14.5"
+  resolved "https://registry.yarnpkg.com/@babel/compat-data/-/compat-data-7.14.5.tgz#8ef4c18e58e801c5c95d3c1c0f2874a2680fadea"
+  integrity sha512-kixrYn4JwfAVPa0f2yfzc2AWti6WRRyO3XjWW5PJAvtE11qhSayrrcrEnee05KAtNaPC+EwehE8Qt1UedEVB8w==
 
 "@babel/core@^7.1.0", "@babel/core@^7.7.2", "@babel/core@^7.7.5":
-  version "7.14.3"
-  resolved "https://registry.yarnpkg.com/@babel/core/-/core-7.14.3.tgz#5395e30405f0776067fbd9cf0884f15bfb770a38"
-  integrity sha512-jB5AmTKOCSJIZ72sd78ECEhuPiDMKlQdDI/4QRI6lzYATx5SSogS1oQA2AoPecRCknm30gHi2l+QVvNUu3wZAg==
+  version "7.14.6"
+  resolved "https://registry.yarnpkg.com/@babel/core/-/core-7.14.6.tgz#e0814ec1a950032ff16c13a2721de39a8416fcab"
+  integrity sha512-gJnOEWSqTk96qG5BoIrl5bVtc23DCycmIePPYnamY9RboYdI4nFy5vAQMSl81O5K/W0sLDWfGysnOECC+KUUCA==
   dependencies:
-    "@babel/code-frame" "^7.12.13"
-    "@babel/generator" "^7.14.3"
-    "@babel/helper-compilation-targets" "^7.13.16"
-    "@babel/helper-module-transforms" "^7.14.2"
-    "@babel/helpers" "^7.14.0"
-    "@babel/parser" "^7.14.3"
-    "@babel/template" "^7.12.13"
-    "@babel/traverse" "^7.14.2"
-    "@babel/types" "^7.14.2"
+    "@babel/code-frame" "^7.14.5"
+    "@babel/generator" "^7.14.5"
+    "@babel/helper-compilation-targets" "^7.14.5"
+    "@babel/helper-module-transforms" "^7.14.5"
+    "@babel/helpers" "^7.14.6"
+    "@babel/parser" "^7.14.6"
+    "@babel/template" "^7.14.5"
+    "@babel/traverse" "^7.14.5"
+    "@babel/types" "^7.14.5"
     convert-source-map "^1.7.0"
     debug "^4.1.0"
     gensync "^1.0.0-beta.2"
@@ -47,137 +47,144 @@
     semver "^6.3.0"
     source-map "^0.5.0"
 
-"@babel/generator@^7.14.2", "@babel/generator@^7.14.3", "@babel/generator@^7.7.2":
-  version "7.14.3"
-  resolved "https://registry.yarnpkg.com/@babel/generator/-/generator-7.14.3.tgz#0c2652d91f7bddab7cccc6ba8157e4f40dcedb91"
-  integrity sha512-bn0S6flG/j0xtQdz3hsjJ624h3W0r3llttBMfyHX3YrZ/KtLYr15bjA0FXkgW7FpvrDuTuElXeVjiKlYRpnOFA==
+"@babel/generator@^7.14.5", "@babel/generator@^7.7.2":
+  version "7.14.5"
+  resolved "https://registry.yarnpkg.com/@babel/generator/-/generator-7.14.5.tgz#848d7b9f031caca9d0cd0af01b063f226f52d785"
+  integrity sha512-y3rlP+/G25OIX3mYKKIOlQRcqj7YgrvHxOLbVmyLJ9bPmi5ttvUmpydVjcFjZphOktWuA7ovbx91ECloWTfjIA==
   dependencies:
-    "@babel/types" "^7.14.2"
+    "@babel/types" "^7.14.5"
     jsesc "^2.5.1"
     source-map "^0.5.0"
 
-"@babel/helper-compilation-targets@^7.13.16":
-  version "7.14.4"
-  resolved "https://registry.yarnpkg.com/@babel/helper-compilation-targets/-/helper-compilation-targets-7.14.4.tgz#33ebd0ffc34248051ee2089350a929ab02f2a516"
-  integrity sha512-JgdzOYZ/qGaKTVkn5qEDV/SXAh8KcyUVkCoSWGN8T3bwrgd6m+/dJa2kVGi6RJYJgEYPBdZ84BZp9dUjNWkBaA==
+"@babel/helper-compilation-targets@^7.14.5":
+  version "7.14.5"
+  resolved "https://registry.yarnpkg.com/@babel/helper-compilation-targets/-/helper-compilation-targets-7.14.5.tgz#7a99c5d0967911e972fe2c3411f7d5b498498ecf"
+  integrity sha512-v+QtZqXEiOnpO6EYvlImB6zCD2Lel06RzOPzmkz/D/XgQiUu3C/Jb1LOqSt/AIA34TYi/Q+KlT8vTQrgdxkbLw==
   dependencies:
-    "@babel/compat-data" "^7.14.4"
-    "@babel/helper-validator-option" "^7.12.17"
+    "@babel/compat-data" "^7.14.5"
+    "@babel/helper-validator-option" "^7.14.5"
     browserslist "^4.16.6"
     semver "^6.3.0"
 
-"@babel/helper-function-name@^7.14.2":
-  version "7.14.2"
-  resolved "https://registry.yarnpkg.com/@babel/helper-function-name/-/helper-function-name-7.14.2.tgz#397688b590760b6ef7725b5f0860c82427ebaac2"
-  integrity sha512-NYZlkZRydxw+YT56IlhIcS8PAhb+FEUiOzuhFTfqDyPmzAhRge6ua0dQYT/Uh0t/EDHq05/i+e5M2d4XvjgarQ==
+"@babel/helper-function-name@^7.14.5":
+  version "7.14.5"
+  resolved "https://registry.yarnpkg.com/@babel/helper-function-name/-/helper-function-name-7.14.5.tgz#89e2c474972f15d8e233b52ee8c480e2cfcd50c4"
+  integrity sha512-Gjna0AsXWfFvrAuX+VKcN/aNNWonizBj39yGwUzVDVTlMYJMK2Wp6xdpy72mfArFq5uK+NOuexfzZlzI1z9+AQ==
   dependencies:
-    "@babel/helper-get-function-arity" "^7.12.13"
-    "@babel/template" "^7.12.13"
-    "@babel/types" "^7.14.2"
+    "@babel/helper-get-function-arity" "^7.14.5"
+    "@babel/template" "^7.14.5"
+    "@babel/types" "^7.14.5"
 
-"@babel/helper-get-function-arity@^7.12.13":
-  version "7.12.13"
-  resolved "https://registry.yarnpkg.com/@babel/helper-get-function-arity/-/helper-get-function-arity-7.12.13.tgz#bc63451d403a3b3082b97e1d8b3fe5bd4091e583"
-  integrity sha512-DjEVzQNz5LICkzN0REdpD5prGoidvbdYk1BVgRUOINaWJP2t6avB27X1guXK1kXNrX0WMfsrm1A/ZBthYuIMQg==
+"@babel/helper-get-function-arity@^7.14.5":
+  version "7.14.5"
+  resolved "https://registry.yarnpkg.com/@babel/helper-get-function-arity/-/helper-get-function-arity-7.14.5.tgz#25fbfa579b0937eee1f3b805ece4ce398c431815"
+  integrity sha512-I1Db4Shst5lewOM4V+ZKJzQ0JGGaZ6VY1jYvMghRjqs6DWgxLCIyFt30GlnKkfUeFLpJt2vzbMVEXVSXlIFYUg==
   dependencies:
-    "@babel/types" "^7.12.13"
+    "@babel/types" "^7.14.5"
 
-"@babel/helper-member-expression-to-functions@^7.13.12":
-  version "7.13.12"
-  resolved "https://registry.yarnpkg.com/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.13.12.tgz#dfe368f26d426a07299d8d6513821768216e6d72"
-  integrity sha512-48ql1CLL59aKbU94Y88Xgb2VFy7a95ykGRbJJaaVv+LX5U8wFpLfiGXJJGUozsmA1oEh/o5Bp60Voq7ACyA/Sw==
+"@babel/helper-hoist-variables@^7.14.5":
+  version "7.14.5"
+  resolved "https://registry.yarnpkg.com/@babel/helper-hoist-variables/-/helper-hoist-variables-7.14.5.tgz#e0dd27c33a78e577d7c8884916a3e7ef1f7c7f8d"
+  integrity sha512-R1PXiz31Uc0Vxy4OEOm07x0oSjKAdPPCh3tPivn/Eo8cvz6gveAeuyUUPB21Hoiif0uoPQSSdhIPS3352nvdyQ==
   dependencies:
-    "@babel/types" "^7.13.12"
+    "@babel/types" "^7.14.5"
 
-"@babel/helper-module-imports@^7.13.12":
-  version "7.13.12"
-  resolved "https://registry.yarnpkg.com/@babel/helper-module-imports/-/helper-module-imports-7.13.12.tgz#c6a369a6f3621cb25da014078684da9196b61977"
-  integrity sha512-4cVvR2/1B693IuOvSI20xqqa/+bl7lqAMR59R4iu39R9aOX8/JoYY1sFaNvUMyMBGnHdwvJgUrzNLoUZxXypxA==
+"@babel/helper-member-expression-to-functions@^7.14.5":
+  version "7.14.5"
+  resolved "https://registry.yarnpkg.com/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.14.5.tgz#d5c70e4ad13b402c95156c7a53568f504e2fb7b8"
+  integrity sha512-UxUeEYPrqH1Q/k0yRku1JE7dyfyehNwT6SVkMHvYvPDv4+uu627VXBckVj891BO8ruKBkiDoGnZf4qPDD8abDQ==
   dependencies:
-    "@babel/types" "^7.13.12"
+    "@babel/types" "^7.14.5"
 
-"@babel/helper-module-transforms@^7.14.2":
-  version "7.14.2"
-  resolved "https://registry.yarnpkg.com/@babel/helper-module-transforms/-/helper-module-transforms-7.14.2.tgz#ac1cc30ee47b945e3e0c4db12fa0c5389509dfe5"
-  integrity sha512-OznJUda/soKXv0XhpvzGWDnml4Qnwp16GN+D/kZIdLsWoHj05kyu8Rm5kXmMef+rVJZ0+4pSGLkeixdqNUATDA==
+"@babel/helper-module-imports@^7.14.5":
+  version "7.14.5"
+  resolved "https://registry.yarnpkg.com/@babel/helper-module-imports/-/helper-module-imports-7.14.5.tgz#6d1a44df6a38c957aa7c312da076429f11b422f3"
+  integrity sha512-SwrNHu5QWS84XlHwGYPDtCxcA0hrSlL2yhWYLgeOc0w7ccOl2qv4s/nARI0aYZW+bSwAL5CukeXA47B/1NKcnQ==
   dependencies:
-    "@babel/helper-module-imports" "^7.13.12"
-    "@babel/helper-replace-supers" "^7.13.12"
-    "@babel/helper-simple-access" "^7.13.12"
-    "@babel/helper-split-export-declaration" "^7.12.13"
-    "@babel/helper-validator-identifier" "^7.14.0"
-    "@babel/template" "^7.12.13"
-    "@babel/traverse" "^7.14.2"
-    "@babel/types" "^7.14.2"
+    "@babel/types" "^7.14.5"
 
-"@babel/helper-optimise-call-expression@^7.12.13":
-  version "7.12.13"
-  resolved "https://registry.yarnpkg.com/@babel/helper-optimise-call-expression/-/helper-optimise-call-expression-7.12.13.tgz#5c02d171b4c8615b1e7163f888c1c81c30a2aaea"
-  integrity sha512-BdWQhoVJkp6nVjB7nkFWcn43dkprYauqtk++Py2eaf/GRDFm5BxRqEIZCiHlZUGAVmtwKcsVL1dC68WmzeFmiA==
+"@babel/helper-module-transforms@^7.14.5":
+  version "7.14.5"
+  resolved "https://registry.yarnpkg.com/@babel/helper-module-transforms/-/helper-module-transforms-7.14.5.tgz#7de42f10d789b423eb902ebd24031ca77cb1e10e"
+  integrity sha512-iXpX4KW8LVODuAieD7MzhNjmM6dzYY5tfRqT+R9HDXWl0jPn/djKmA+G9s/2C2T9zggw5tK1QNqZ70USfedOwA==
   dependencies:
-    "@babel/types" "^7.12.13"
+    "@babel/helper-module-imports" "^7.14.5"
+    "@babel/helper-replace-supers" "^7.14.5"
+    "@babel/helper-simple-access" "^7.14.5"
+    "@babel/helper-split-export-declaration" "^7.14.5"
+    "@babel/helper-validator-identifier" "^7.14.5"
+    "@babel/template" "^7.14.5"
+    "@babel/traverse" "^7.14.5"
+    "@babel/types" "^7.14.5"
 
-"@babel/helper-plugin-utils@^7.0.0", "@babel/helper-plugin-utils@^7.10.4", "@babel/helper-plugin-utils@^7.12.13", "@babel/helper-plugin-utils@^7.8.0":
-  version "7.13.0"
-  resolved "https://registry.yarnpkg.com/@babel/helper-plugin-utils/-/helper-plugin-utils-7.13.0.tgz#806526ce125aed03373bc416a828321e3a6a33af"
-  integrity sha512-ZPafIPSwzUlAoWT8DKs1W2VyF2gOWthGd5NGFMsBcMMol+ZhK+EQY/e6V96poa6PA/Bh+C9plWN0hXO1uB8AfQ==
-
-"@babel/helper-replace-supers@^7.13.12":
-  version "7.14.4"
-  resolved "https://registry.yarnpkg.com/@babel/helper-replace-supers/-/helper-replace-supers-7.14.4.tgz#b2ab16875deecfff3ddfcd539bc315f72998d836"
-  integrity sha512-zZ7uHCWlxfEAAOVDYQpEf/uyi1dmeC7fX4nCf2iz9drnCwi1zvwXL3HwWWNXUQEJ1k23yVn3VbddiI9iJEXaTQ==
+"@babel/helper-optimise-call-expression@^7.14.5":
+  version "7.14.5"
+  resolved "https://registry.yarnpkg.com/@babel/helper-optimise-call-expression/-/helper-optimise-call-expression-7.14.5.tgz#f27395a8619e0665b3f0364cddb41c25d71b499c"
+  integrity sha512-IqiLIrODUOdnPU9/F8ib1Fx2ohlgDhxnIDU7OEVi+kAbEZcyiF7BLU8W6PfvPi9LzztjS7kcbzbmL7oG8kD6VA==
   dependencies:
-    "@babel/helper-member-expression-to-functions" "^7.13.12"
-    "@babel/helper-optimise-call-expression" "^7.12.13"
-    "@babel/traverse" "^7.14.2"
-    "@babel/types" "^7.14.4"
+    "@babel/types" "^7.14.5"
 
-"@babel/helper-simple-access@^7.13.12":
-  version "7.13.12"
-  resolved "https://registry.yarnpkg.com/@babel/helper-simple-access/-/helper-simple-access-7.13.12.tgz#dd6c538afb61819d205a012c31792a39c7a5eaf6"
-  integrity sha512-7FEjbrx5SL9cWvXioDbnlYTppcZGuCY6ow3/D5vMggb2Ywgu4dMrpTJX0JdQAIcRRUElOIxF3yEooa9gUb9ZbA==
+"@babel/helper-plugin-utils@^7.0.0", "@babel/helper-plugin-utils@^7.10.4", "@babel/helper-plugin-utils@^7.12.13", "@babel/helper-plugin-utils@^7.14.5", "@babel/helper-plugin-utils@^7.8.0":
+  version "7.14.5"
+  resolved "https://registry.yarnpkg.com/@babel/helper-plugin-utils/-/helper-plugin-utils-7.14.5.tgz#5ac822ce97eec46741ab70a517971e443a70c5a9"
+  integrity sha512-/37qQCE3K0vvZKwoK4XU/irIJQdIfCJuhU5eKnNxpFDsOkgFaUAwbv+RYw6eYgsC0E4hS7r5KqGULUogqui0fQ==
+
+"@babel/helper-replace-supers@^7.14.5":
+  version "7.14.5"
+  resolved "https://registry.yarnpkg.com/@babel/helper-replace-supers/-/helper-replace-supers-7.14.5.tgz#0ecc0b03c41cd567b4024ea016134c28414abb94"
+  integrity sha512-3i1Qe9/8x/hCHINujn+iuHy+mMRLoc77b2nI9TB0zjH1hvn9qGlXjWlggdwUcju36PkPCy/lpM7LLUdcTyH4Ow==
   dependencies:
-    "@babel/types" "^7.13.12"
+    "@babel/helper-member-expression-to-functions" "^7.14.5"
+    "@babel/helper-optimise-call-expression" "^7.14.5"
+    "@babel/traverse" "^7.14.5"
+    "@babel/types" "^7.14.5"
 
-"@babel/helper-split-export-declaration@^7.12.13":
-  version "7.12.13"
-  resolved "https://registry.yarnpkg.com/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.12.13.tgz#e9430be00baf3e88b0e13e6f9d4eaf2136372b05"
-  integrity sha512-tCJDltF83htUtXx5NLcaDqRmknv652ZWCHyoTETf1CXYJdPC7nohZohjUgieXhv0hTJdRf2FjDueFehdNucpzg==
+"@babel/helper-simple-access@^7.14.5":
+  version "7.14.5"
+  resolved "https://registry.yarnpkg.com/@babel/helper-simple-access/-/helper-simple-access-7.14.5.tgz#66ea85cf53ba0b4e588ba77fc813f53abcaa41c4"
+  integrity sha512-nfBN9xvmCt6nrMZjfhkl7i0oTV3yxR4/FztsbOASyTvVcoYd0TRHh7eMLdlEcCqobydC0LAF3LtC92Iwxo0wyw==
   dependencies:
-    "@babel/types" "^7.12.13"
+    "@babel/types" "^7.14.5"
 
-"@babel/helper-validator-identifier@^7.14.0":
-  version "7.14.0"
-  resolved "https://registry.yarnpkg.com/@babel/helper-validator-identifier/-/helper-validator-identifier-7.14.0.tgz#d26cad8a47c65286b15df1547319a5d0bcf27288"
-  integrity sha512-V3ts7zMSu5lfiwWDVWzRDGIN+lnCEUdaXgtVHJgLb1rGaA6jMrtB9EmE7L18foXJIE8Un/A/h6NJfGQp/e1J4A==
-
-"@babel/helper-validator-option@^7.12.17":
-  version "7.12.17"
-  resolved "https://registry.yarnpkg.com/@babel/helper-validator-option/-/helper-validator-option-7.12.17.tgz#d1fbf012e1a79b7eebbfdc6d270baaf8d9eb9831"
-  integrity sha512-TopkMDmLzq8ngChwRlyjR6raKD6gMSae4JdYDB8bByKreQgG0RBTuKe9LRxW3wFtUnjxOPRKBDwEH6Mg5KeDfw==
-
-"@babel/helpers@^7.14.0":
-  version "7.14.0"
-  resolved "https://registry.yarnpkg.com/@babel/helpers/-/helpers-7.14.0.tgz#ea9b6be9478a13d6f961dbb5f36bf75e2f3b8f62"
-  integrity sha512-+ufuXprtQ1D1iZTO/K9+EBRn+qPWMJjZSw/S0KlFrxCw4tkrzv9grgpDHkY9MeQTjTY8i2sp7Jep8DfU6tN9Mg==
+"@babel/helper-split-export-declaration@^7.14.5":
+  version "7.14.5"
+  resolved "https://registry.yarnpkg.com/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.14.5.tgz#22b23a54ef51c2b7605d851930c1976dd0bc693a"
+  integrity sha512-hprxVPu6e5Kdp2puZUmvOGjaLv9TCe58E/Fl6hRq4YiVQxIcNvuq6uTM2r1mT/oPskuS9CgR+I94sqAYv0NGKA==
   dependencies:
-    "@babel/template" "^7.12.13"
-    "@babel/traverse" "^7.14.0"
-    "@babel/types" "^7.14.0"
+    "@babel/types" "^7.14.5"
 
-"@babel/highlight@^7.10.4", "@babel/highlight@^7.12.13":
-  version "7.14.0"
-  resolved "https://registry.yarnpkg.com/@babel/highlight/-/highlight-7.14.0.tgz#3197e375711ef6bf834e67d0daec88e4f46113cf"
-  integrity sha512-YSCOwxvTYEIMSGaBQb5kDDsCopDdiUGsqpatp3fOlI4+2HQSkTmEVWnVuySdAC5EWCqSWWTv0ib63RjR7dTBdg==
+"@babel/helper-validator-identifier@^7.14.5":
+  version "7.14.5"
+  resolved "https://registry.yarnpkg.com/@babel/helper-validator-identifier/-/helper-validator-identifier-7.14.5.tgz#d0f0e277c512e0c938277faa85a3968c9a44c0e8"
+  integrity sha512-5lsetuxCLilmVGyiLEfoHBRX8UCFD+1m2x3Rj97WrW3V7H3u4RWRXA4evMjImCsin2J2YT0QaVDGf+z8ondbAg==
+
+"@babel/helper-validator-option@^7.14.5":
+  version "7.14.5"
+  resolved "https://registry.yarnpkg.com/@babel/helper-validator-option/-/helper-validator-option-7.14.5.tgz#6e72a1fff18d5dfcb878e1e62f1a021c4b72d5a3"
+  integrity sha512-OX8D5eeX4XwcroVW45NMvoYaIuFI+GQpA2a8Gi+X/U/cDUIRsV37qQfF905F0htTRCREQIB4KqPeaveRJUl3Ow==
+
+"@babel/helpers@^7.14.6":
+  version "7.14.6"
+  resolved "https://registry.yarnpkg.com/@babel/helpers/-/helpers-7.14.6.tgz#5b58306b95f1b47e2a0199434fa8658fa6c21635"
+  integrity sha512-yesp1ENQBiLI+iYHSJdoZKUtRpfTlL1grDIX9NRlAVppljLw/4tTyYupIB7uIYmC3stW/imAv8EqaKaS/ibmeA==
   dependencies:
-    "@babel/helper-validator-identifier" "^7.14.0"
+    "@babel/template" "^7.14.5"
+    "@babel/traverse" "^7.14.5"
+    "@babel/types" "^7.14.5"
+
+"@babel/highlight@^7.10.4", "@babel/highlight@^7.14.5":
+  version "7.14.5"
+  resolved "https://registry.yarnpkg.com/@babel/highlight/-/highlight-7.14.5.tgz#6861a52f03966405001f6aa534a01a24d99e8cd9"
+  integrity sha512-qf9u2WFWVV0MppaL877j2dBtQIDgmidgjGk5VIMw3OadXvYaXn66U1BFlH2t4+t3i+8PhedppRv+i40ABzd+gg==
+  dependencies:
+    "@babel/helper-validator-identifier" "^7.14.5"
     chalk "^2.0.0"
     js-tokens "^4.0.0"
 
-"@babel/parser@^7.1.0", "@babel/parser@^7.12.13", "@babel/parser@^7.14.2", "@babel/parser@^7.14.3", "@babel/parser@^7.7.2":
-  version "7.14.4"
-  resolved "https://registry.yarnpkg.com/@babel/parser/-/parser-7.14.4.tgz#a5c560d6db6cd8e6ed342368dea8039232cbab18"
-  integrity sha512-ArliyUsWDUqEGfWcmzpGUzNfLxTdTp6WU4IuP6QFSp9gGfWS6boxFCkJSJ/L4+RG8z/FnIU3WxCk6hPL9SSWeA==
+"@babel/parser@^7.1.0", "@babel/parser@^7.14.5", "@babel/parser@^7.14.6", "@babel/parser@^7.7.2":
+  version "7.14.6"
+  resolved "https://registry.yarnpkg.com/@babel/parser/-/parser-7.14.6.tgz#d85cc68ca3cac84eae384c06f032921f5227f4b2"
+  integrity sha512-oG0ej7efjEXxb4UgE+klVx+3j4MVo+A2vCzm7OUN4CLo6WhQ+vSOD2yJ8m7B+DghObxtLxt3EfgMWpq+AsWehQ==
 
 "@babel/plugin-syntax-async-generators@^7.8.4":
   version "7.8.4"
@@ -257,48 +264,49 @@
     "@babel/helper-plugin-utils" "^7.8.0"
 
 "@babel/plugin-syntax-top-level-await@^7.8.3":
-  version "7.12.13"
-  resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-top-level-await/-/plugin-syntax-top-level-await-7.12.13.tgz#c5f0fa6e249f5b739727f923540cf7a806130178"
-  integrity sha512-A81F9pDwyS7yM//KwbCSDqy3Uj4NMIurtplxphWxoYtNPov7cJsDkAFNNyVlIZ3jwGycVsurZ+LtOA8gZ376iQ==
+  version "7.14.5"
+  resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-top-level-await/-/plugin-syntax-top-level-await-7.14.5.tgz#c1cfdadc35a646240001f06138247b741c34d94c"
+  integrity sha512-hx++upLv5U1rgYfwe1xBQUhRmU41NEvpUvrp8jkrSCdvGSnM5/qdRMtylJ6PG5OFkBaHkbTAKTnd3/YyESRHFw==
   dependencies:
-    "@babel/helper-plugin-utils" "^7.12.13"
+    "@babel/helper-plugin-utils" "^7.14.5"
 
 "@babel/plugin-syntax-typescript@^7.7.2":
-  version "7.12.13"
-  resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.12.13.tgz#9dff111ca64154cef0f4dc52cf843d9f12ce4474"
-  integrity sha512-cHP3u1JiUiG2LFDKbXnwVad81GvfyIOmCD6HIEId6ojrY0Drfy2q1jw7BwN7dE84+kTnBjLkXoL3IEy/3JPu2w==
+  version "7.14.5"
+  resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.14.5.tgz#b82c6ce471b165b5ce420cf92914d6fb46225716"
+  integrity sha512-u6OXzDaIXjEstBRRoBCQ/uKQKlbuaeE5in0RvWdA4pN6AhqxTIwUsnHPU1CFZA/amYObMsuWhYfRl3Ch90HD0Q==
   dependencies:
-    "@babel/helper-plugin-utils" "^7.12.13"
+    "@babel/helper-plugin-utils" "^7.14.5"
 
-"@babel/template@^7.12.13", "@babel/template@^7.3.3":
-  version "7.12.13"
-  resolved "https://registry.yarnpkg.com/@babel/template/-/template-7.12.13.tgz#530265be8a2589dbb37523844c5bcb55947fb327"
-  integrity sha512-/7xxiGA57xMo/P2GVvdEumr8ONhFOhfgq2ihK3h1e6THqzTAkHbkXgB0xI9yeTfIUoH3+oAeHhqm/I43OTbbjA==
+"@babel/template@^7.14.5", "@babel/template@^7.3.3":
+  version "7.14.5"
+  resolved "https://registry.yarnpkg.com/@babel/template/-/template-7.14.5.tgz#a9bc9d8b33354ff6e55a9c60d1109200a68974f4"
+  integrity sha512-6Z3Po85sfxRGachLULUhOmvAaOo7xCvqGQtxINai2mEGPFm6pQ4z5QInFnUrRpfoSV60BnjyF5F3c+15fxFV1g==
   dependencies:
-    "@babel/code-frame" "^7.12.13"
-    "@babel/parser" "^7.12.13"
-    "@babel/types" "^7.12.13"
+    "@babel/code-frame" "^7.14.5"
+    "@babel/parser" "^7.14.5"
+    "@babel/types" "^7.14.5"
 
-"@babel/traverse@^7.1.0", "@babel/traverse@^7.14.0", "@babel/traverse@^7.14.2", "@babel/traverse@^7.7.2":
-  version "7.14.2"
-  resolved "https://registry.yarnpkg.com/@babel/traverse/-/traverse-7.14.2.tgz#9201a8d912723a831c2679c7ebbf2fe1416d765b"
-  integrity sha512-TsdRgvBFHMyHOOzcP9S6QU0QQtjxlRpEYOy3mcCO5RgmC305ki42aSAmfZEMSSYBla2oZ9BMqYlncBaKmD/7iA==
+"@babel/traverse@^7.1.0", "@babel/traverse@^7.14.5", "@babel/traverse@^7.7.2":
+  version "7.14.5"
+  resolved "https://registry.yarnpkg.com/@babel/traverse/-/traverse-7.14.5.tgz#c111b0f58afab4fea3d3385a406f692748c59870"
+  integrity sha512-G3BiS15vevepdmFqmUc9X+64y0viZYygubAMO8SvBmKARuF6CPSZtH4Ng9vi/lrWlZFGe3FWdXNy835akH8Glg==
   dependencies:
-    "@babel/code-frame" "^7.12.13"
-    "@babel/generator" "^7.14.2"
-    "@babel/helper-function-name" "^7.14.2"
-    "@babel/helper-split-export-declaration" "^7.12.13"
-    "@babel/parser" "^7.14.2"
-    "@babel/types" "^7.14.2"
+    "@babel/code-frame" "^7.14.5"
+    "@babel/generator" "^7.14.5"
+    "@babel/helper-function-name" "^7.14.5"
+    "@babel/helper-hoist-variables" "^7.14.5"
+    "@babel/helper-split-export-declaration" "^7.14.5"
+    "@babel/parser" "^7.14.5"
+    "@babel/types" "^7.14.5"
     debug "^4.1.0"
     globals "^11.1.0"
 
-"@babel/types@^7.0.0", "@babel/types@^7.12.13", "@babel/types@^7.13.12", "@babel/types@^7.14.0", "@babel/types@^7.14.2", "@babel/types@^7.14.4", "@babel/types@^7.3.0", "@babel/types@^7.3.3":
-  version "7.14.4"
-  resolved "https://registry.yarnpkg.com/@babel/types/-/types-7.14.4.tgz#bfd6980108168593b38b3eb48a24aa026b919bc0"
-  integrity sha512-lCj4aIs0xUefJFQnwwQv2Bxg7Omd6bgquZ6LGC+gGMh6/s5qDVfjuCMlDmYQ15SLsWHd9n+X3E75lKIhl5Lkiw==
+"@babel/types@^7.0.0", "@babel/types@^7.14.5", "@babel/types@^7.3.0", "@babel/types@^7.3.3":
+  version "7.14.5"
+  resolved "https://registry.yarnpkg.com/@babel/types/-/types-7.14.5.tgz#3bb997ba829a2104cedb20689c4a5b8121d383ff"
+  integrity sha512-M/NzBpEL95I5Hh4dwhin5JlE7EzO5PHMAuzjxss3tiOBD46KfQvVedN/3jEPZvdRvtsK2222XfdHogNIttFgcg==
   dependencies:
-    "@babel/helper-validator-identifier" "^7.14.0"
+    "@babel/helper-validator-identifier" "^7.14.5"
     to-fast-properties "^2.0.0"
 
 "@bcoe/v8-coverage@^0.2.3":
@@ -306,20 +314,27 @@
   resolved "https://registry.yarnpkg.com/@bcoe/v8-coverage/-/v8-coverage-0.2.3.tgz#75a2e8b51cb758a7553d6804a5932d7aace75c39"
   integrity sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw==
 
-"@cliqz/adblocker-content@^1.22.1":
-  version "1.22.1"
-  resolved "https://registry.yarnpkg.com/@cliqz/adblocker-content/-/adblocker-content-1.22.1.tgz#71bc0d0d473ae96d5086badb2f4d624769fa56c4"
-  integrity sha512-CSOCdK/SJOZVWGVJuurfL0KtPq1AhSp3ng6BAo3SLXAd+WP7obERw2qFWQ0uzrApY/N1a1hvzfw31uonqRakXg==
+"@cliqz/adblocker-content@^1.22.1", "@cliqz/adblocker-content@^1.22.2":
+  version "1.22.2"
+  resolved "https://registry.yarnpkg.com/@cliqz/adblocker-content/-/adblocker-content-1.22.2.tgz#643849d5f08c167eb84a2e7e3f1f9fbc41a3889b"
+  integrity sha512-EsV00IdW8sGujGnylOGR8dm401FdIfPRAjuevsRlZjgDE+hQKj6n5wwrZaylPIh994hWesg6bxWTmXpJ2Sy2QQ==
   dependencies:
-    "@cliqz/adblocker-extended-selectors" "^1.22.1"
+    "@cliqz/adblocker-extended-selectors" "^1.22.2"
 
-"@cliqz/adblocker-electron-preload@1.22.1", "@cliqz/adblocker-electron-preload@^1.22.1":
+"@cliqz/adblocker-electron-preload@1.22.1":
   version "1.22.1"
   resolved "https://registry.yarnpkg.com/@cliqz/adblocker-electron-preload/-/adblocker-electron-preload-1.22.1.tgz#8ce8c18d0ce5f7afa7c1dfe1f4cba30ada86f4af"
   integrity sha512-etkb6LNUaCViZ2Bg7Z0fwpKsdsrmHF6Qjqs5u7FcfS4fSZ2TgDv7Ir5PunUWd6MOUW7mapx5CdPIupnlVkiTLA==
   dependencies:
     "@cliqz/adblocker-content" "^1.22.1"
 
+"@cliqz/adblocker-electron-preload@^1.22.1":
+  version "1.22.2"
+  resolved "https://registry.yarnpkg.com/@cliqz/adblocker-electron-preload/-/adblocker-electron-preload-1.22.2.tgz#eea674767a60abe4e5f9ccb46188d33656f551d0"
+  integrity sha512-4JSqNNYo4hXMoZjnyBVTd3z2yV2n5qeoNPk+WaeOFEF9uJXhqPR+Sz7scNB6nMYnRuSQfraeogtdaA4s0JkJWQ==
+  dependencies:
+    "@cliqz/adblocker-content" "^1.22.2"
+
 "@cliqz/adblocker-electron@1.22.1":
   version "1.22.1"
   resolved "https://registry.yarnpkg.com/@cliqz/adblocker-electron/-/adblocker-electron-1.22.1.tgz#13fe6de4be0c3beb2851634b27ea1223d10ca92b"
@@ -329,22 +344,22 @@
     "@cliqz/adblocker-electron-preload" "^1.22.1"
     tldts-experimental "^5.6.21"
 
-"@cliqz/adblocker-extended-selectors@^1.22.1":
-  version "1.22.1"
-  resolved "https://registry.yarnpkg.com/@cliqz/adblocker-extended-selectors/-/adblocker-extended-selectors-1.22.1.tgz#234ee70a1736e3690b25a7a073818f5a851bf9a8"
-  integrity sha512-uXB1TybAq6MgqsG09fcY8Qw0P9EOWp4G7KQ4QNXQd4HIP4o3zcJgBd5MKeclJAD/QOyPdhnb+a9JdwVFyqMamQ==
+"@cliqz/adblocker-extended-selectors@^1.22.2":
+  version "1.22.2"
+  resolved "https://registry.yarnpkg.com/@cliqz/adblocker-extended-selectors/-/adblocker-extended-selectors-1.22.2.tgz#1cad3c1569b765d9e7f8672c85b2a7b1e8e9ee90"
+  integrity sha512-/u4SmQ1wr7d80iGP705fZrfHjJUTf/1MyRXz5Wltt7i3OHvOCQEoST2mqNlfx0W/9gIWzxA7cFRLY0/aITmzTw==
 
 "@cliqz/adblocker@^1.22.1":
-  version "1.22.1"
-  resolved "https://registry.yarnpkg.com/@cliqz/adblocker/-/adblocker-1.22.1.tgz#dae3dd6c59f16244012d1e736150f618b2d578e6"
-  integrity sha512-kir/tVTe0VabtJfcRipDX+/UBnZn0aN0lX4GQT7wZIHMOACpW37eix7wGkzVS+icbwu1bEqZ+O8Q98UlORPm4w==
+  version "1.22.2"
+  resolved "https://registry.yarnpkg.com/@cliqz/adblocker/-/adblocker-1.22.2.tgz#99a14d56327734d3083a077d96fe7b91c236bf7a"
+  integrity sha512-P+a8gYbRbQy38mYsr7932h2cnK/7AEuQrmCEfLTO1+abCr2v5RM2Qb+cCn/JVnQSeqnysebAIXoV+PUzrjfpiQ==
   dependencies:
-    "@cliqz/adblocker-content" "^1.22.1"
-    "@cliqz/adblocker-extended-selectors" "^1.22.1"
+    "@cliqz/adblocker-content" "^1.22.2"
+    "@cliqz/adblocker-extended-selectors" "^1.22.2"
     "@remusao/guess-url-type" "^1.1.2"
     "@remusao/small" "^1.1.2"
     "@remusao/smaz" "^1.7.1"
-    "@types/chrome" "^0.0.144"
+    "@types/chrome" "^0.0.145"
     "@types/firefox-webext-browser" "^82.0.0"
     tldts-experimental "^5.6.21"
 
@@ -706,10 +721,10 @@
   dependencies:
     "@babel/types" "^7.3.0"
 
-"@types/chrome@^0.0.144":
-  version "0.0.144"
-  resolved "https://registry.yarnpkg.com/@types/chrome/-/chrome-0.0.144.tgz#7dd9188e355aa17e3ad397f50b5cd3ad12caf788"
-  integrity sha512-BgoiO7/KP9hRNrCR2Wq+aKWT5Dh9bTofuWaRtcqPcj8YKhZojQgb6sSdIqvds2C+eO63BwaR9KHVMYYgZdGGBg==
+"@types/chrome@^0.0.145":
+  version "0.0.145"
+  resolved "https://registry.yarnpkg.com/@types/chrome/-/chrome-0.0.145.tgz#6c53ae0af5f25350b07bfd24cf459b5fe65cd9b8"
+  integrity sha512-vLvTMmfc8mvwOZzkmn2UwlWSNu0t0txBkyuIv8NgihRkvFCe6XJX65YZAgAP/RdBit3enhU2GTxCr+prn4uZmA==
   dependencies:
     "@types/filesystem" "*"
     "@types/har-format" "*"
@@ -788,9 +803,9 @@
   integrity sha512-1z8k4wzFnNjVK/tlxvrWuK5WMt6mydWWP7+zvH5eFep4oj+UkrfiJTRtjCeBXNpwaA/FYqqtb4/QS4ianFpIRA==
 
 "@types/node@*":
-  version "15.12.2"
-  resolved "https://registry.yarnpkg.com/@types/node/-/node-15.12.2.tgz#1f2b42c4be7156ff4a6f914b2fb03d05fa84e38d"
-  integrity sha512-zjQ69G564OCIWIOHSXyQEEDpdpGl+G348RAKY0XXy9Z5kU9Vzv1GMNnkar/ZJ8dzXB3COzD9Mo9NtRZ4xfgUww==
+  version "15.12.4"
+  resolved "https://registry.yarnpkg.com/@types/node/-/node-15.12.4.tgz#e1cf817d70a1e118e81922c4ff6683ce9d422e26"
+  integrity sha512-zrNj1+yqYF4WskCMOHwN+w9iuD12+dGm0rQ35HLl9/Ouuq52cEtd0CH9qMgrdNmi5ejC1/V7vKEXYubB+65DkA==
 
 "@types/node@^14.6.2":
   version "14.17.3"
@@ -806,9 +821,9 @@
     xmlbuilder ">=11.0.1"
 
 "@types/prettier@^2.1.5":
-  version "2.2.3"
-  resolved "https://registry.yarnpkg.com/@types/prettier/-/prettier-2.2.3.tgz#ef65165aea2924c9359205bf748865b8881753c0"
-  integrity sha512-PijRCG/K3s3w1We6ynUKdxEc5AcuuH3NBmMDP8uvKVp6X43UY7NQlTzczakXP3DJR0F4dfNQIGjU2cUeRYs2AA==
+  version "2.3.0"
+  resolved "https://registry.yarnpkg.com/@types/prettier/-/prettier-2.3.0.tgz#2e8332cc7363f887d32ec5496b207d26ba8052bb"
+  integrity sha512-hkc1DATxFLQo4VxPDpMH1gCkPpBbpOoJ/4nhuXw4n63/0R6bCpQECj4+K226UJ4JO/eJQz+1mC2I7JsWanAdQw==
 
 "@types/stack-utils@^2.0.0":
   version "2.0.0"
@@ -825,7 +840,7 @@
   resolved "https://registry.yarnpkg.com/@types/yargs-parser/-/yargs-parser-20.2.0.tgz#dd3e6699ba3237f0348cd085e4698780204842f9"
   integrity sha512-37RSHht+gzzgYeobbG+KWryeAW8J33Nhr69cjTqSYymXVZEN9NbRYWoYlRtDhHKPVT1FyNKwaTPC1NynKZpzRA==
 
-"@types/yargs@^16.0.0", "@types/yargs@^16.0.1":
+"@types/yargs@^16.0.0", "@types/yargs@^16.0.2":
   version "16.0.3"
   resolved "https://registry.yarnpkg.com/@types/yargs/-/yargs-16.0.3.tgz#4b6d35bb8e680510a7dc2308518a80ee1ef27e01"
   integrity sha512-YlFfTGS+zqCgXuXNV26rOIeETOkXnGQXP/pjjL9P0gO/EP9jTmc7pUBhx+jVEIxpq41RX33GQ7N3DzOSfZoglQ==
@@ -861,9 +876,9 @@ acorn@^7.1.1, acorn@^7.4.0:
   integrity sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A==
 
 acorn@^8.2.4:
-  version "8.3.0"
-  resolved "https://registry.yarnpkg.com/acorn/-/acorn-8.3.0.tgz#1193f9b96c4e8232f00b11a9edff81b2c8b98b88"
-  integrity sha512-tqPKHZ5CaBJw0Xmy0ZZvLs1qTV+BNFSyvn77ASXkpBNfIRk8ev26fKrD9iLGwGA9zedPao52GSHzq8lyZG0NUw==
+  version "8.4.0"
+  resolved "https://registry.yarnpkg.com/acorn/-/acorn-8.4.0.tgz#af53266e698d7cffa416714b503066a82221be60"
+  integrity sha512-ULr0LDaEqQrMFGyQ3bhJkLsbtrQ8QibAseGZeaSUiT/6zb9IvIkomWHJIvgvwad+hinRAgsI51JcWk2yvwyL+w==
 
 agent-base@6:
   version "6.0.2"
@@ -963,10 +978,10 @@ app-builder-bin@3.5.13:
   resolved "https://registry.yarnpkg.com/app-builder-bin/-/app-builder-bin-3.5.13.tgz#6dd7f4de34a4e408806f99b8c7d6ef1601305b7e"
   integrity sha512-ighVe9G+bT1ENGdp9ecO1P+94vv/f+FUwaI+XkNzeg9bYF8Oi3BQ+mJuxS00UgyHs8luuOzjzC+qnAtdb43Mpg==
 
-app-builder-lib@22.11.5:
-  version "22.11.5"
-  resolved "https://registry.yarnpkg.com/app-builder-lib/-/app-builder-lib-22.11.5.tgz#d49f49dc2d9fd225249e4ae7e30add2996e7062f"
-  integrity sha512-lLEDvJuLdc4IVyADJK6t4qEIjRhOUj4p19B1RS/8pN/oAb8X5Qe1t3Einbsi4oFBJBweH2LIygnSAwumjQh9iA==
+app-builder-lib@22.11.7:
+  version "22.11.7"
+  resolved "https://registry.yarnpkg.com/app-builder-lib/-/app-builder-lib-22.11.7.tgz#c0ad1119ebfbf4189a8280ad693625f5e684dca6"
+  integrity sha512-pS9/cR4/TnNZVAHZECiSvvwTBzbwblj7KBBZkMKDG57nibq0I1XY8zAaYeHFdlYTyrRcz9JUXbAqJKezya7UFQ==
   dependencies:
     "7zip-bin" "~5.1.1"
     "@develar/schema-utils" "~2.6.5"
@@ -974,12 +989,12 @@ app-builder-lib@22.11.5:
     "@malept/flatpak-bundler" "^0.4.0"
     async-exit-hook "^2.0.1"
     bluebird-lst "^1.0.9"
-    builder-util "22.11.5"
-    builder-util-runtime "8.7.6"
+    builder-util "22.11.7"
+    builder-util-runtime "8.7.7"
     chromium-pickle-js "^0.2.0"
     debug "^4.3.2"
     ejs "^3.1.6"
-    electron-publish "22.11.5"
+    electron-publish "22.11.7"
     fs-extra "^10.0.0"
     hosted-git-info "^4.0.2"
     is-ci "^3.0.0"
@@ -1178,9 +1193,9 @@ bluebird@^3.5.5:
   integrity sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg==
 
 boolean@^3.0.1:
-  version "3.1.0"
-  resolved "https://registry.yarnpkg.com/boolean/-/boolean-3.1.0.tgz#a245080649ebb80e7c0ea218a480e4e913136336"
-  integrity sha512-K6r5tvO1ykeYerI7jIyTvSFw2l6D6DzqkljGj2E2uyYAAdDo2SV4qGJIV75cHIQpTFyb6BB0BEHiDdDrFsNI+g==
+  version "3.1.2"
+  resolved "https://registry.yarnpkg.com/boolean/-/boolean-3.1.2.tgz#e30f210a26b02458482a8cc353ab06f262a780c2"
+  integrity sha512-YN6UmV0FfLlBVvRvNPx3pz5W/mUoYB24J4WSXOKP/OOJpi+Oq6WYqPaNTHzjI0QzwWtnvEd5CGYyQPgp1jFxnw==
 
 boxen@^5.0.0:
   version "5.0.1"
@@ -1265,17 +1280,25 @@ builder-util-runtime@8.7.6:
     debug "^4.3.2"
     sax "^1.2.4"
 
-builder-util@22.11.5:
-  version "22.11.5"
-  resolved "https://registry.yarnpkg.com/builder-util/-/builder-util-22.11.5.tgz#08836d00e6bef39bdffd8a66fb07d2d5021b9c3c"
-  integrity sha512-ur9ksncYOnJg/VuJz3PdsBQHeg9tjdOC2HVj8mQ0WNcn/H3MO4tnwKBOWWikPDiWEjeBSvFUmYBnGFkRiUNkww==
+builder-util-runtime@8.7.7:
+  version "8.7.7"
+  resolved "https://registry.yarnpkg.com/builder-util-runtime/-/builder-util-runtime-8.7.7.tgz#6c83cc3abe7a7a5c8b4ec8878f68adc828c07f0d"
+  integrity sha512-RUfoXzVrmFFI0K/Oft0CtP1LpTIOlBeLJatt5DePTI0KlxE156am4SGUpqtbbdqZNm++LkV9mX4olBDcXyGPow==
+  dependencies:
+    debug "^4.3.2"
+    sax "^1.2.4"
+
+builder-util@22.11.7:
+  version "22.11.7"
+  resolved "https://registry.yarnpkg.com/builder-util/-/builder-util-22.11.7.tgz#ae9707afa6a31feafa13c274ac83b4fe28ef1467"
+  integrity sha512-ihqUe5ey82LM9qqQe0/oIcaSm9w+B9UjcsWJZxJliTBsbU+sErOpDFpHW+sim0veiTF/EIcGUh9HoduWw+l9FA==
   dependencies:
     "7zip-bin" "~5.1.1"
     "@types/debug" "^4.1.5"
     "@types/fs-extra" "^9.0.11"
     app-builder-bin "3.5.13"
     bluebird-lst "^1.0.9"
-    builder-util-runtime "8.7.6"
+    builder-util-runtime "8.7.7"
     chalk "^4.1.1"
     debug "^4.3.2"
     fs-extra "^10.0.0"
@@ -1314,9 +1337,9 @@ camelcase@^6.2.0:
   integrity sha512-c7wVvbw3f37nuobQNtgsgG9POC9qMbNuMQmTCqZv23b6MIz0fcYpBiOlv9gEN/hdLdnZTDQhg6e9Dq5M1vKvfg==
 
 caniuse-lite@^1.0.30001166, caniuse-lite@^1.0.30001219:
-  version "1.0.30001236"
-  resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001236.tgz#0a80de4cdf62e1770bb46a30d884fc8d633e3958"
-  integrity sha512-o0PRQSrSCGJKCPZcgMzl5fUaj5xHe8qA2m4QRvnyY4e1lITqoNkr7q/Oh1NcpGSy0Th97UZ35yoKcINPoq7YOQ==
+  version "1.0.30001239"
+  resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001239.tgz#66e8669985bb2cb84ccb10f68c25ce6dd3e4d2b8"
+  integrity sha512-cyBkXJDMeI4wthy8xJ2FvDU6+0dtcZSJW3voUF8+e9f1bBeuvyZfc3PNbkOETyhbR+dGCPzn9E7MA3iwzusOhQ==
 
 chalk@^2.0.0, chalk@^2.4.2:
   version "2.4.2"
@@ -1498,16 +1521,16 @@ configstore@^5.0.1:
     xdg-basedir "^4.0.0"
 
 convert-source-map@^1.4.0, convert-source-map@^1.6.0, convert-source-map@^1.7.0:
-  version "1.7.0"
-  resolved "https://registry.yarnpkg.com/convert-source-map/-/convert-source-map-1.7.0.tgz#17a2cb882d7f77d3490585e2ce6c524424a3a442"
-  integrity sha512-4FJkXzKXEDB1snCFZlLP4gpC3JILicCpGbzG9f9G7tGqGCzETQ2hWPrcinA9oU4wtf2biUaEH5065UnMeR33oA==
+  version "1.8.0"
+  resolved "https://registry.yarnpkg.com/convert-source-map/-/convert-source-map-1.8.0.tgz#f3373c32d21b4d780dd8004514684fb791ca4369"
+  integrity sha512-+OQdjP49zViI/6i7nIJpA8rAl4sV/JdPfU9nZs3VqOwGIgizICvuN2ru6fMd+4llL0tar18UYJXfZ/TWtmhUjA==
   dependencies:
     safe-buffer "~5.1.1"
 
 core-js@^3.6.5:
-  version "3.14.0"
-  resolved "https://registry.yarnpkg.com/core-js/-/core-js-3.14.0.tgz#62322b98c71cc2018b027971a69419e2425c2a6c"
-  integrity sha512-3s+ed8er9ahK+zJpp9ZtuVcDoFzHNiZsPbNAAE4KXgrRHbjSqqNN6xGSXq6bq7TZIbKj4NLrLb6bJ5i+vSVjHA==
+  version "3.15.0"
+  resolved "https://registry.yarnpkg.com/core-js/-/core-js-3.15.0.tgz#db9554ebce0b6fd90dc9b1f2465c841d2d055044"
+  integrity sha512-GUbtPllXMYRzIgHNZ4dTYTcUemls2cni83Q4Q/TrFONHfhcg9oEGOtaGHfb0cpzec60P96UKPvMkjX1jET8rUw==
 
 core-util-is@1.0.2, core-util-is@~1.0.0:
   version "1.0.2"
@@ -1672,13 +1695,13 @@ dir-compare@^2.4.0:
     commander "2.9.0"
     minimatch "3.0.4"
 
-dmg-builder@22.11.5:
-  version "22.11.5"
-  resolved "https://registry.yarnpkg.com/dmg-builder/-/dmg-builder-22.11.5.tgz#0df9843def73a217097956982fa21bb4d6a5836e"
-  integrity sha512-91Shh9+OK9RwBlBURxvhSnQNibEh/JYNAnMOfFguyNbasSfF50Jme4b3dgsQrHTTTfkFijcvzykPPFAZofQs6g==
+dmg-builder@22.11.7:
+  version "22.11.7"
+  resolved "https://registry.yarnpkg.com/dmg-builder/-/dmg-builder-22.11.7.tgz#5956008c18d40ee72c0ea01ffea9590dbf51df89"
+  integrity sha512-+I+XfP2DODHB6PwFANgpH/WMzzCA5r5XoMvbFCIYjQjJpXlO0XnqQaamzFl2vh/Wz/Qt0d0lJMgRy8gKR3MGdQ==
   dependencies:
-    app-builder-lib "22.11.5"
-    builder-util "22.11.5"
+    app-builder-lib "22.11.7"
+    builder-util "22.11.7"
     builder-util-runtime "8.7.6"
     fs-extra "^10.0.0"
     iconv-lite "^0.6.2"
@@ -1744,17 +1767,17 @@ ejs@^3.1.6:
   dependencies:
     jake "^10.6.1"
 
-electron-builder@22.11.5:
-  version "22.11.5"
-  resolved "https://registry.yarnpkg.com/electron-builder/-/electron-builder-22.11.5.tgz#914d8183e1bab7cda43ef1d67fc3d17314c7e242"
-  integrity sha512-QIhzrmSLNteItRvmAjwNpsya08oZeOJIrxFww/Alkjcwnrn5Xgog2qf3Xfa3ocuNUQIwb+mMzZrzqnPu0Mamyg==
+electron-builder@22.11.7:
+  version "22.11.7"
+  resolved "https://registry.yarnpkg.com/electron-builder/-/electron-builder-22.11.7.tgz#cd97a0d9f6e6d388112e66b4376de431cca4d596"
+  integrity sha512-yQExSLt7Hbz/P8lLkZDdE/OnJJ7NCX+uiQcV+XIH0TeEZcD87ZnSqBBzGUN5akySU4BXXlrVZKeUsXACWrm5Kw==
   dependencies:
-    "@types/yargs" "^16.0.1"
-    app-builder-lib "22.11.5"
-    builder-util "22.11.5"
-    builder-util-runtime "8.7.6"
+    "@types/yargs" "^16.0.2"
+    app-builder-lib "22.11.7"
+    builder-util "22.11.7"
+    builder-util-runtime "8.7.7"
     chalk "^4.1.1"
-    dmg-builder "22.11.5"
+    dmg-builder "22.11.7"
     fs-extra "^10.0.0"
     is-ci "^3.0.0"
     lazy-val "^1.0.5"
@@ -1762,28 +1785,28 @@ electron-builder@22.11.5:
     update-notifier "^5.1.0"
     yargs "^17.0.1"
 
-electron-publish@22.11.5:
-  version "22.11.5"
-  resolved "https://registry.yarnpkg.com/electron-publish/-/electron-publish-22.11.5.tgz#2fcd3280c4267e70e4aa15003c9b7dc34923320e"
-  integrity sha512-peN4tEP80Kb6reuwKKvSu9p/XUWpx/7x747u5NSg7Kg2axBjzdMtX5ZqBThfPtJWJhSWZ7PEYWmNyUCfdQl2Ag==
+electron-publish@22.11.7:
+  version "22.11.7"
+  resolved "https://registry.yarnpkg.com/electron-publish/-/electron-publish-22.11.7.tgz#4126cbb08ccf082a2aa7fef89ee629b3a4b8ae9a"
+  integrity sha512-A4EhRRNBVz4SPzUlBrPO6BmuyDeI0pyprggPAV9rQ+SDVSnSB/WKPot9JwWMyArkGj3AUUTMNVT6hwZhMvhfqw==
   dependencies:
     "@types/fs-extra" "^9.0.11"
-    builder-util "22.11.5"
-    builder-util-runtime "8.7.6"
+    builder-util "22.11.7"
+    builder-util-runtime "8.7.7"
     chalk "^4.1.1"
     fs-extra "^10.0.0"
     lazy-val "^1.0.5"
     mime "^2.5.2"
 
 electron-to-chromium@^1.3.723:
-  version "1.3.750"
-  resolved "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.3.750.tgz#7e5ef6f478316b0bd656af5942fe502610e97eaf"
-  integrity sha512-Eqy9eHNepZxJXT+Pc5++zvEi5nQ6AGikwFYDCYwXUFBr+ynJ6pDG7MzZmwGYCIuXShLJM0n4bq+aoKDmvSGJ8A==
+  version "1.3.752"
+  resolved "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.3.752.tgz#0728587f1b9b970ec9ffad932496429aef750d09"
+  integrity sha512-2Tg+7jSl3oPxgsBsWKh5H83QazTkmWG/cnNwJplmyZc7KcN61+I10oUgaXSVk/NwfvN3BdkKDR4FYuRBQQ2v0A==
 
-electron@13.1.1:
-  version "13.1.1"
-  resolved "https://registry.yarnpkg.com/electron/-/electron-13.1.1.tgz#de1ea908bcac2197d7a5a373fb68c0c66043e10e"
-  integrity sha512-kySSb5CbIkWU2Kd9mf2rpGZC9p1nWhVVNl+CJjuOUGeVPXHbojHvTkDU1iC8AvV28eik3gqHisSJss40Caprog==
+electron@13.1.2:
+  version "13.1.2"
+  resolved "https://registry.yarnpkg.com/electron/-/electron-13.1.2.tgz#8c9abf9015766c9cbc16f10c99282d00d6ae1b90"
+  integrity sha512-aNT9t+LgdQaZ7FgN36pN7MjSEoj+EWc2T9yuOqBApbmR4HavGRadSz7u9N2Erw2ojdIXtei2RVIAvVm8mbDZ0g==
   dependencies:
     "@electron/get" "^1.0.1"
     "@types/node" "^14.6.2"
@@ -1916,10 +1939,10 @@ eslint-visitor-keys@^2.0.0:
   resolved "https://registry.yarnpkg.com/eslint-visitor-keys/-/eslint-visitor-keys-2.1.0.tgz#f65328259305927392c938ed44eb0a5c9b2bd303"
   integrity sha512-0rSmRBzXgDzIsD6mGdJgevzgezI534Cer5L/vyMX0kHzT/jiB43jRhd9YUlMGYLQy2zprNmoT8qasCGtY+QaKw==
 
-eslint@7.28.0:
-  version "7.28.0"
-  resolved "https://registry.yarnpkg.com/eslint/-/eslint-7.28.0.tgz#435aa17a0b82c13bb2be9d51408b617e49c1e820"
-  integrity sha512-UMfH0VSjP0G4p3EWirscJEQ/cHqnT/iuH6oNZOB94nBjWbMnhGEPxsZm1eyIW0C/9jLI0Fow4W5DXLjEI7mn1g==
+eslint@7.29.0:
+  version "7.29.0"
+  resolved "https://registry.yarnpkg.com/eslint/-/eslint-7.29.0.tgz#ee2a7648f2e729485e4d0bd6383ec1deabc8b3c0"
+  integrity sha512-82G/JToB9qIy/ArBzIWG9xvvwL3R86AlCjtGw+A29OMZDqhTybz/MByORSukGxeI+YPCR4coYyITKk8BFH9nDA==
   dependencies:
     "@babel/code-frame" "7.12.11"
     "@eslint/eslintrc" "^0.4.2"
@@ -3718,9 +3741,9 @@ readdir-glob@^1.0.0:
     minimatch "^3.0.4"
 
 regexpp@^3.1.0:
-  version "3.1.0"
-  resolved "https://registry.yarnpkg.com/regexpp/-/regexpp-3.1.0.tgz#206d0ad0a5648cffbdb8ae46438f3dc51c9f78e2"
-  integrity sha512-ZOIzd8yVsQQA7j8GCSlPGXwg5PfmA1mrq0JP4nGhh54LaKN3xdai/vHUDu74pKwV8OxseMS65u2NImosQcSD0Q==
+  version "3.2.0"
+  resolved "https://registry.yarnpkg.com/regexpp/-/regexpp-3.2.0.tgz#0425a2768d8f23bad70ca4b90461fa2f1213e1b2"
+  integrity sha512-pq2bWo9mVD43nbts2wGv17XLiNLya+GklZ8kaDLV2Z08gDCsGpnKn9BFMepvWuHCbyVvY7J5o5+BVvoQbmlJLg==
 
 registry-auth-token@^4.0.0:
   version "4.2.1"
@@ -4455,9 +4478,9 @@ write-file-atomic@^3.0.0:
     typedarray-to-buffer "^3.1.5"
 
 ws@^7.4.5:
-  version "7.4.6"
-  resolved "https://registry.yarnpkg.com/ws/-/ws-7.4.6.tgz#5654ca8ecdeee47c33a9a4bf6d28e2be2980377c"
-  integrity sha512-YmhHDO4MzaDLB+M9ym/mDA5z0naX8j7SIlT8f8z+I0VtzsRbekxEutHSme7NPS2qE8StCYQNUnfWdXta/Yu85A==
+  version "7.5.0"
+  resolved "https://registry.yarnpkg.com/ws/-/ws-7.5.0.tgz#0033bafea031fb9df041b2026fc72a571ca44691"
+  integrity sha512-6ezXvzOZupqKj4jUqbQ9tXuJNo+BR2gU8fFRk3XCP3e0G6WT414u5ELe6Y0vtp7kmSJ3F7YWObSNr1ESsgi4vw==
 
 xdg-basedir@^4.0.0:
   version "4.0.0"
@@ -4500,9 +4523,9 @@ yallist@^4.0.0:
   integrity sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==
 
 yargs-parser@^20.2.2:
-  version "20.2.7"
-  resolved "https://registry.yarnpkg.com/yargs-parser/-/yargs-parser-20.2.7.tgz#61df85c113edfb5a7a4e36eb8aa60ef423cbc90a"
-  integrity sha512-FiNkvbeHzB/syOjIUxFDCnhSfzAL8R5vs40MgLFBorXACCOAEaWu0gRZl14vG8MR9AOJIZbmkjhusqBYZ3HTHw==
+  version "20.2.9"
+  resolved "https://registry.yarnpkg.com/yargs-parser/-/yargs-parser-20.2.9.tgz#2eb7dc3b0289718fc295f362753845c41a0c94ee"
+  integrity sha512-y11nGElTIV+CT3Zv9t7VKl+Q3hTQoT9a1Qzezhhl6Rp21gJ/IVTW7Z3y9EWXhuUBC2Shnf+DX0antecpAwSP8w==
 
 yargs@^16.0.3:
   version "16.2.0"
diff --git a/pkgs/applications/networking/browsers/vieb/yarn.nix b/pkgs/applications/networking/browsers/vieb/yarn.nix
index 11cf84050d01..14e1b9902cca 100644
--- a/pkgs/applications/networking/browsers/vieb/yarn.nix
+++ b/pkgs/applications/networking/browsers/vieb/yarn.nix
@@ -18,163 +18,171 @@
       };
     }
     {
-      name = "_babel_code_frame___code_frame_7.12.13.tgz";
+      name = "_babel_code_frame___code_frame_7.14.5.tgz";
       path = fetchurl {
-        name = "_babel_code_frame___code_frame_7.12.13.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/code-frame/-/code-frame-7.12.13.tgz";
-        sha1 = "dcfc826beef65e75c50e21d3837d7d95798dd658";
+        name = "_babel_code_frame___code_frame_7.14.5.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/code-frame/-/code-frame-7.14.5.tgz";
+        sha1 = "23b08d740e83f49c5e59945fbf1b43e80bbf4edb";
       };
     }
     {
-      name = "_babel_compat_data___compat_data_7.14.4.tgz";
+      name = "_babel_compat_data___compat_data_7.14.5.tgz";
       path = fetchurl {
-        name = "_babel_compat_data___compat_data_7.14.4.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/compat-data/-/compat-data-7.14.4.tgz";
-        sha1 = "45720fe0cecf3fd42019e1d12cc3d27fadc98d58";
+        name = "_babel_compat_data___compat_data_7.14.5.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/compat-data/-/compat-data-7.14.5.tgz";
+        sha1 = "8ef4c18e58e801c5c95d3c1c0f2874a2680fadea";
       };
     }
     {
-      name = "_babel_core___core_7.14.3.tgz";
+      name = "_babel_core___core_7.14.6.tgz";
       path = fetchurl {
-        name = "_babel_core___core_7.14.3.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/core/-/core-7.14.3.tgz";
-        sha1 = "5395e30405f0776067fbd9cf0884f15bfb770a38";
+        name = "_babel_core___core_7.14.6.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/core/-/core-7.14.6.tgz";
+        sha1 = "e0814ec1a950032ff16c13a2721de39a8416fcab";
       };
     }
     {
-      name = "_babel_generator___generator_7.14.3.tgz";
+      name = "_babel_generator___generator_7.14.5.tgz";
       path = fetchurl {
-        name = "_babel_generator___generator_7.14.3.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/generator/-/generator-7.14.3.tgz";
-        sha1 = "0c2652d91f7bddab7cccc6ba8157e4f40dcedb91";
+        name = "_babel_generator___generator_7.14.5.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/generator/-/generator-7.14.5.tgz";
+        sha1 = "848d7b9f031caca9d0cd0af01b063f226f52d785";
       };
     }
     {
-      name = "_babel_helper_compilation_targets___helper_compilation_targets_7.14.4.tgz";
+      name = "_babel_helper_compilation_targets___helper_compilation_targets_7.14.5.tgz";
       path = fetchurl {
-        name = "_babel_helper_compilation_targets___helper_compilation_targets_7.14.4.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/helper-compilation-targets/-/helper-compilation-targets-7.14.4.tgz";
-        sha1 = "33ebd0ffc34248051ee2089350a929ab02f2a516";
+        name = "_babel_helper_compilation_targets___helper_compilation_targets_7.14.5.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/helper-compilation-targets/-/helper-compilation-targets-7.14.5.tgz";
+        sha1 = "7a99c5d0967911e972fe2c3411f7d5b498498ecf";
       };
     }
     {
-      name = "_babel_helper_function_name___helper_function_name_7.14.2.tgz";
+      name = "_babel_helper_function_name___helper_function_name_7.14.5.tgz";
       path = fetchurl {
-        name = "_babel_helper_function_name___helper_function_name_7.14.2.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/helper-function-name/-/helper-function-name-7.14.2.tgz";
-        sha1 = "397688b590760b6ef7725b5f0860c82427ebaac2";
+        name = "_babel_helper_function_name___helper_function_name_7.14.5.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/helper-function-name/-/helper-function-name-7.14.5.tgz";
+        sha1 = "89e2c474972f15d8e233b52ee8c480e2cfcd50c4";
       };
     }
     {
-      name = "_babel_helper_get_function_arity___helper_get_function_arity_7.12.13.tgz";
+      name = "_babel_helper_get_function_arity___helper_get_function_arity_7.14.5.tgz";
       path = fetchurl {
-        name = "_babel_helper_get_function_arity___helper_get_function_arity_7.12.13.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/helper-get-function-arity/-/helper-get-function-arity-7.12.13.tgz";
-        sha1 = "bc63451d403a3b3082b97e1d8b3fe5bd4091e583";
+        name = "_babel_helper_get_function_arity___helper_get_function_arity_7.14.5.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/helper-get-function-arity/-/helper-get-function-arity-7.14.5.tgz";
+        sha1 = "25fbfa579b0937eee1f3b805ece4ce398c431815";
       };
     }
     {
-      name = "_babel_helper_member_expression_to_functions___helper_member_expression_to_functions_7.13.12.tgz";
+      name = "_babel_helper_hoist_variables___helper_hoist_variables_7.14.5.tgz";
       path = fetchurl {
-        name = "_babel_helper_member_expression_to_functions___helper_member_expression_to_functions_7.13.12.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.13.12.tgz";
-        sha1 = "dfe368f26d426a07299d8d6513821768216e6d72";
+        name = "_babel_helper_hoist_variables___helper_hoist_variables_7.14.5.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/helper-hoist-variables/-/helper-hoist-variables-7.14.5.tgz";
+        sha1 = "e0dd27c33a78e577d7c8884916a3e7ef1f7c7f8d";
       };
     }
     {
-      name = "_babel_helper_module_imports___helper_module_imports_7.13.12.tgz";
+      name = "_babel_helper_member_expression_to_functions___helper_member_expression_to_functions_7.14.5.tgz";
       path = fetchurl {
-        name = "_babel_helper_module_imports___helper_module_imports_7.13.12.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/helper-module-imports/-/helper-module-imports-7.13.12.tgz";
-        sha1 = "c6a369a6f3621cb25da014078684da9196b61977";
+        name = "_babel_helper_member_expression_to_functions___helper_member_expression_to_functions_7.14.5.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.14.5.tgz";
+        sha1 = "d5c70e4ad13b402c95156c7a53568f504e2fb7b8";
       };
     }
     {
-      name = "_babel_helper_module_transforms___helper_module_transforms_7.14.2.tgz";
+      name = "_babel_helper_module_imports___helper_module_imports_7.14.5.tgz";
       path = fetchurl {
-        name = "_babel_helper_module_transforms___helper_module_transforms_7.14.2.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/helper-module-transforms/-/helper-module-transforms-7.14.2.tgz";
-        sha1 = "ac1cc30ee47b945e3e0c4db12fa0c5389509dfe5";
+        name = "_babel_helper_module_imports___helper_module_imports_7.14.5.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/helper-module-imports/-/helper-module-imports-7.14.5.tgz";
+        sha1 = "6d1a44df6a38c957aa7c312da076429f11b422f3";
       };
     }
     {
-      name = "_babel_helper_optimise_call_expression___helper_optimise_call_expression_7.12.13.tgz";
+      name = "_babel_helper_module_transforms___helper_module_transforms_7.14.5.tgz";
       path = fetchurl {
-        name = "_babel_helper_optimise_call_expression___helper_optimise_call_expression_7.12.13.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/helper-optimise-call-expression/-/helper-optimise-call-expression-7.12.13.tgz";
-        sha1 = "5c02d171b4c8615b1e7163f888c1c81c30a2aaea";
+        name = "_babel_helper_module_transforms___helper_module_transforms_7.14.5.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/helper-module-transforms/-/helper-module-transforms-7.14.5.tgz";
+        sha1 = "7de42f10d789b423eb902ebd24031ca77cb1e10e";
       };
     }
     {
-      name = "_babel_helper_plugin_utils___helper_plugin_utils_7.13.0.tgz";
+      name = "_babel_helper_optimise_call_expression___helper_optimise_call_expression_7.14.5.tgz";
       path = fetchurl {
-        name = "_babel_helper_plugin_utils___helper_plugin_utils_7.13.0.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/helper-plugin-utils/-/helper-plugin-utils-7.13.0.tgz";
-        sha1 = "806526ce125aed03373bc416a828321e3a6a33af";
+        name = "_babel_helper_optimise_call_expression___helper_optimise_call_expression_7.14.5.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/helper-optimise-call-expression/-/helper-optimise-call-expression-7.14.5.tgz";
+        sha1 = "f27395a8619e0665b3f0364cddb41c25d71b499c";
       };
     }
     {
-      name = "_babel_helper_replace_supers___helper_replace_supers_7.14.4.tgz";
+      name = "_babel_helper_plugin_utils___helper_plugin_utils_7.14.5.tgz";
       path = fetchurl {
-        name = "_babel_helper_replace_supers___helper_replace_supers_7.14.4.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/helper-replace-supers/-/helper-replace-supers-7.14.4.tgz";
-        sha1 = "b2ab16875deecfff3ddfcd539bc315f72998d836";
+        name = "_babel_helper_plugin_utils___helper_plugin_utils_7.14.5.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/helper-plugin-utils/-/helper-plugin-utils-7.14.5.tgz";
+        sha1 = "5ac822ce97eec46741ab70a517971e443a70c5a9";
       };
     }
     {
-      name = "_babel_helper_simple_access___helper_simple_access_7.13.12.tgz";
+      name = "_babel_helper_replace_supers___helper_replace_supers_7.14.5.tgz";
       path = fetchurl {
-        name = "_babel_helper_simple_access___helper_simple_access_7.13.12.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/helper-simple-access/-/helper-simple-access-7.13.12.tgz";
-        sha1 = "dd6c538afb61819d205a012c31792a39c7a5eaf6";
+        name = "_babel_helper_replace_supers___helper_replace_supers_7.14.5.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/helper-replace-supers/-/helper-replace-supers-7.14.5.tgz";
+        sha1 = "0ecc0b03c41cd567b4024ea016134c28414abb94";
       };
     }
     {
-      name = "_babel_helper_split_export_declaration___helper_split_export_declaration_7.12.13.tgz";
+      name = "_babel_helper_simple_access___helper_simple_access_7.14.5.tgz";
       path = fetchurl {
-        name = "_babel_helper_split_export_declaration___helper_split_export_declaration_7.12.13.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.12.13.tgz";
-        sha1 = "e9430be00baf3e88b0e13e6f9d4eaf2136372b05";
+        name = "_babel_helper_simple_access___helper_simple_access_7.14.5.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/helper-simple-access/-/helper-simple-access-7.14.5.tgz";
+        sha1 = "66ea85cf53ba0b4e588ba77fc813f53abcaa41c4";
       };
     }
     {
-      name = "_babel_helper_validator_identifier___helper_validator_identifier_7.14.0.tgz";
+      name = "_babel_helper_split_export_declaration___helper_split_export_declaration_7.14.5.tgz";
       path = fetchurl {
-        name = "_babel_helper_validator_identifier___helper_validator_identifier_7.14.0.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/helper-validator-identifier/-/helper-validator-identifier-7.14.0.tgz";
-        sha1 = "d26cad8a47c65286b15df1547319a5d0bcf27288";
+        name = "_babel_helper_split_export_declaration___helper_split_export_declaration_7.14.5.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.14.5.tgz";
+        sha1 = "22b23a54ef51c2b7605d851930c1976dd0bc693a";
       };
     }
     {
-      name = "_babel_helper_validator_option___helper_validator_option_7.12.17.tgz";
+      name = "_babel_helper_validator_identifier___helper_validator_identifier_7.14.5.tgz";
       path = fetchurl {
-        name = "_babel_helper_validator_option___helper_validator_option_7.12.17.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/helper-validator-option/-/helper-validator-option-7.12.17.tgz";
-        sha1 = "d1fbf012e1a79b7eebbfdc6d270baaf8d9eb9831";
+        name = "_babel_helper_validator_identifier___helper_validator_identifier_7.14.5.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/helper-validator-identifier/-/helper-validator-identifier-7.14.5.tgz";
+        sha1 = "d0f0e277c512e0c938277faa85a3968c9a44c0e8";
       };
     }
     {
-      name = "_babel_helpers___helpers_7.14.0.tgz";
+      name = "_babel_helper_validator_option___helper_validator_option_7.14.5.tgz";
       path = fetchurl {
-        name = "_babel_helpers___helpers_7.14.0.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/helpers/-/helpers-7.14.0.tgz";
-        sha1 = "ea9b6be9478a13d6f961dbb5f36bf75e2f3b8f62";
+        name = "_babel_helper_validator_option___helper_validator_option_7.14.5.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/helper-validator-option/-/helper-validator-option-7.14.5.tgz";
+        sha1 = "6e72a1fff18d5dfcb878e1e62f1a021c4b72d5a3";
       };
     }
     {
-      name = "_babel_highlight___highlight_7.14.0.tgz";
+      name = "_babel_helpers___helpers_7.14.6.tgz";
       path = fetchurl {
-        name = "_babel_highlight___highlight_7.14.0.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/highlight/-/highlight-7.14.0.tgz";
-        sha1 = "3197e375711ef6bf834e67d0daec88e4f46113cf";
+        name = "_babel_helpers___helpers_7.14.6.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/helpers/-/helpers-7.14.6.tgz";
+        sha1 = "5b58306b95f1b47e2a0199434fa8658fa6c21635";
       };
     }
     {
-      name = "_babel_parser___parser_7.14.4.tgz";
+      name = "_babel_highlight___highlight_7.14.5.tgz";
       path = fetchurl {
-        name = "_babel_parser___parser_7.14.4.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/parser/-/parser-7.14.4.tgz";
-        sha1 = "a5c560d6db6cd8e6ed342368dea8039232cbab18";
+        name = "_babel_highlight___highlight_7.14.5.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/highlight/-/highlight-7.14.5.tgz";
+        sha1 = "6861a52f03966405001f6aa534a01a24d99e8cd9";
+      };
+    }
+    {
+      name = "_babel_parser___parser_7.14.6.tgz";
+      path = fetchurl {
+        name = "_babel_parser___parser_7.14.6.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/parser/-/parser-7.14.6.tgz";
+        sha1 = "d85cc68ca3cac84eae384c06f032921f5227f4b2";
       };
     }
     {
@@ -266,43 +274,43 @@
       };
     }
     {
-      name = "_babel_plugin_syntax_top_level_await___plugin_syntax_top_level_await_7.12.13.tgz";
+      name = "_babel_plugin_syntax_top_level_await___plugin_syntax_top_level_await_7.14.5.tgz";
       path = fetchurl {
-        name = "_babel_plugin_syntax_top_level_await___plugin_syntax_top_level_await_7.12.13.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/plugin-syntax-top-level-await/-/plugin-syntax-top-level-await-7.12.13.tgz";
-        sha1 = "c5f0fa6e249f5b739727f923540cf7a806130178";
+        name = "_babel_plugin_syntax_top_level_await___plugin_syntax_top_level_await_7.14.5.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/plugin-syntax-top-level-await/-/plugin-syntax-top-level-await-7.14.5.tgz";
+        sha1 = "c1cfdadc35a646240001f06138247b741c34d94c";
       };
     }
     {
-      name = "_babel_plugin_syntax_typescript___plugin_syntax_typescript_7.12.13.tgz";
+      name = "_babel_plugin_syntax_typescript___plugin_syntax_typescript_7.14.5.tgz";
       path = fetchurl {
-        name = "_babel_plugin_syntax_typescript___plugin_syntax_typescript_7.12.13.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.12.13.tgz";
-        sha1 = "9dff111ca64154cef0f4dc52cf843d9f12ce4474";
+        name = "_babel_plugin_syntax_typescript___plugin_syntax_typescript_7.14.5.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.14.5.tgz";
+        sha1 = "b82c6ce471b165b5ce420cf92914d6fb46225716";
       };
     }
     {
-      name = "_babel_template___template_7.12.13.tgz";
+      name = "_babel_template___template_7.14.5.tgz";
       path = fetchurl {
-        name = "_babel_template___template_7.12.13.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/template/-/template-7.12.13.tgz";
-        sha1 = "530265be8a2589dbb37523844c5bcb55947fb327";
+        name = "_babel_template___template_7.14.5.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/template/-/template-7.14.5.tgz";
+        sha1 = "a9bc9d8b33354ff6e55a9c60d1109200a68974f4";
       };
     }
     {
-      name = "_babel_traverse___traverse_7.14.2.tgz";
+      name = "_babel_traverse___traverse_7.14.5.tgz";
       path = fetchurl {
-        name = "_babel_traverse___traverse_7.14.2.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/traverse/-/traverse-7.14.2.tgz";
-        sha1 = "9201a8d912723a831c2679c7ebbf2fe1416d765b";
+        name = "_babel_traverse___traverse_7.14.5.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/traverse/-/traverse-7.14.5.tgz";
+        sha1 = "c111b0f58afab4fea3d3385a406f692748c59870";
       };
     }
     {
-      name = "_babel_types___types_7.14.4.tgz";
+      name = "_babel_types___types_7.14.5.tgz";
       path = fetchurl {
-        name = "_babel_types___types_7.14.4.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/types/-/types-7.14.4.tgz";
-        sha1 = "bfd6980108168593b38b3eb48a24aa026b919bc0";
+        name = "_babel_types___types_7.14.5.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/types/-/types-7.14.5.tgz";
+        sha1 = "3bb997ba829a2104cedb20689c4a5b8121d383ff";
       };
     }
     {
@@ -314,11 +322,11 @@
       };
     }
     {
-      name = "_cliqz_adblocker_content___adblocker_content_1.22.1.tgz";
+      name = "_cliqz_adblocker_content___adblocker_content_1.22.2.tgz";
       path = fetchurl {
-        name = "_cliqz_adblocker_content___adblocker_content_1.22.1.tgz";
-        url  = "https://registry.yarnpkg.com/@cliqz/adblocker-content/-/adblocker-content-1.22.1.tgz";
-        sha1 = "71bc0d0d473ae96d5086badb2f4d624769fa56c4";
+        name = "_cliqz_adblocker_content___adblocker_content_1.22.2.tgz";
+        url  = "https://registry.yarnpkg.com/@cliqz/adblocker-content/-/adblocker-content-1.22.2.tgz";
+        sha1 = "643849d5f08c167eb84a2e7e3f1f9fbc41a3889b";
       };
     }
     {
@@ -329,6 +337,14 @@
         sha1 = "8ce8c18d0ce5f7afa7c1dfe1f4cba30ada86f4af";
       };
     }
+    {
+      name = "_cliqz_adblocker_electron_preload___adblocker_electron_preload_1.22.2.tgz";
+      path = fetchurl {
+        name = "_cliqz_adblocker_electron_preload___adblocker_electron_preload_1.22.2.tgz";
+        url  = "https://registry.yarnpkg.com/@cliqz/adblocker-electron-preload/-/adblocker-electron-preload-1.22.2.tgz";
+        sha1 = "eea674767a60abe4e5f9ccb46188d33656f551d0";
+      };
+    }
     {
       name = "_cliqz_adblocker_electron___adblocker_electron_1.22.1.tgz";
       path = fetchurl {
@@ -338,19 +354,19 @@
       };
     }
     {
-      name = "_cliqz_adblocker_extended_selectors___adblocker_extended_selectors_1.22.1.tgz";
+      name = "_cliqz_adblocker_extended_selectors___adblocker_extended_selectors_1.22.2.tgz";
       path = fetchurl {
-        name = "_cliqz_adblocker_extended_selectors___adblocker_extended_selectors_1.22.1.tgz";
-        url  = "https://registry.yarnpkg.com/@cliqz/adblocker-extended-selectors/-/adblocker-extended-selectors-1.22.1.tgz";
-        sha1 = "234ee70a1736e3690b25a7a073818f5a851bf9a8";
+        name = "_cliqz_adblocker_extended_selectors___adblocker_extended_selectors_1.22.2.tgz";
+        url  = "https://registry.yarnpkg.com/@cliqz/adblocker-extended-selectors/-/adblocker-extended-selectors-1.22.2.tgz";
+        sha1 = "1cad3c1569b765d9e7f8672c85b2a7b1e8e9ee90";
       };
     }
     {
-      name = "_cliqz_adblocker___adblocker_1.22.1.tgz";
+      name = "_cliqz_adblocker___adblocker_1.22.2.tgz";
       path = fetchurl {
-        name = "_cliqz_adblocker___adblocker_1.22.1.tgz";
-        url  = "https://registry.yarnpkg.com/@cliqz/adblocker/-/adblocker-1.22.1.tgz";
-        sha1 = "dae3dd6c59f16244012d1e736150f618b2d578e6";
+        name = "_cliqz_adblocker___adblocker_1.22.2.tgz";
+        url  = "https://registry.yarnpkg.com/@cliqz/adblocker/-/adblocker-1.22.2.tgz";
+        sha1 = "99a14d56327734d3083a077d96fe7b91c236bf7a";
       };
     }
     {
@@ -634,11 +650,11 @@
       };
     }
     {
-      name = "_types_chrome___chrome_0.0.144.tgz";
+      name = "_types_chrome___chrome_0.0.145.tgz";
       path = fetchurl {
-        name = "_types_chrome___chrome_0.0.144.tgz";
-        url  = "https://registry.yarnpkg.com/@types/chrome/-/chrome-0.0.144.tgz";
-        sha1 = "7dd9188e355aa17e3ad397f50b5cd3ad12caf788";
+        name = "_types_chrome___chrome_0.0.145.tgz";
+        url  = "https://registry.yarnpkg.com/@types/chrome/-/chrome-0.0.145.tgz";
+        sha1 = "6c53ae0af5f25350b07bfd24cf459b5fe65cd9b8";
       };
     }
     {
@@ -738,11 +754,11 @@
       };
     }
     {
-      name = "_types_node___node_15.12.2.tgz";
+      name = "_types_node___node_15.12.4.tgz";
       path = fetchurl {
-        name = "_types_node___node_15.12.2.tgz";
-        url  = "https://registry.yarnpkg.com/@types/node/-/node-15.12.2.tgz";
-        sha1 = "1f2b42c4be7156ff4a6f914b2fb03d05fa84e38d";
+        name = "_types_node___node_15.12.4.tgz";
+        url  = "https://registry.yarnpkg.com/@types/node/-/node-15.12.4.tgz";
+        sha1 = "e1cf817d70a1e118e81922c4ff6683ce9d422e26";
       };
     }
     {
@@ -762,11 +778,11 @@
       };
     }
     {
-      name = "_types_prettier___prettier_2.2.3.tgz";
+      name = "_types_prettier___prettier_2.3.0.tgz";
       path = fetchurl {
-        name = "_types_prettier___prettier_2.2.3.tgz";
-        url  = "https://registry.yarnpkg.com/@types/prettier/-/prettier-2.2.3.tgz";
-        sha1 = "ef65165aea2924c9359205bf748865b8881753c0";
+        name = "_types_prettier___prettier_2.3.0.tgz";
+        url  = "https://registry.yarnpkg.com/@types/prettier/-/prettier-2.3.0.tgz";
+        sha1 = "2e8332cc7363f887d32ec5496b207d26ba8052bb";
       };
     }
     {
@@ -842,11 +858,11 @@
       };
     }
     {
-      name = "acorn___acorn_8.3.0.tgz";
+      name = "acorn___acorn_8.4.0.tgz";
       path = fetchurl {
-        name = "acorn___acorn_8.3.0.tgz";
-        url  = "https://registry.yarnpkg.com/acorn/-/acorn-8.3.0.tgz";
-        sha1 = "1193f9b96c4e8232f00b11a9edff81b2c8b98b88";
+        name = "acorn___acorn_8.4.0.tgz";
+        url  = "https://registry.yarnpkg.com/acorn/-/acorn-8.4.0.tgz";
+        sha1 = "af53266e698d7cffa416714b503066a82221be60";
       };
     }
     {
@@ -970,11 +986,11 @@
       };
     }
     {
-      name = "app_builder_lib___app_builder_lib_22.11.5.tgz";
+      name = "app_builder_lib___app_builder_lib_22.11.7.tgz";
       path = fetchurl {
-        name = "app_builder_lib___app_builder_lib_22.11.5.tgz";
-        url  = "https://registry.yarnpkg.com/app-builder-lib/-/app-builder-lib-22.11.5.tgz";
-        sha1 = "d49f49dc2d9fd225249e4ae7e30add2996e7062f";
+        name = "app_builder_lib___app_builder_lib_22.11.7.tgz";
+        url  = "https://registry.yarnpkg.com/app-builder-lib/-/app-builder-lib-22.11.7.tgz";
+        sha1 = "c0ad1119ebfbf4189a8280ad693625f5e684dca6";
       };
     }
     {
@@ -1162,11 +1178,11 @@
       };
     }
     {
-      name = "boolean___boolean_3.1.0.tgz";
+      name = "boolean___boolean_3.1.2.tgz";
       path = fetchurl {
-        name = "boolean___boolean_3.1.0.tgz";
-        url  = "https://registry.yarnpkg.com/boolean/-/boolean-3.1.0.tgz";
-        sha1 = "a245080649ebb80e7c0ea218a480e4e913136336";
+        name = "boolean___boolean_3.1.2.tgz";
+        url  = "https://registry.yarnpkg.com/boolean/-/boolean-3.1.2.tgz";
+        sha1 = "e30f210a26b02458482a8cc353ab06f262a780c2";
       };
     }
     {
@@ -1258,11 +1274,19 @@
       };
     }
     {
-      name = "builder_util___builder_util_22.11.5.tgz";
+      name = "builder_util_runtime___builder_util_runtime_8.7.7.tgz";
       path = fetchurl {
-        name = "builder_util___builder_util_22.11.5.tgz";
-        url  = "https://registry.yarnpkg.com/builder-util/-/builder-util-22.11.5.tgz";
-        sha1 = "08836d00e6bef39bdffd8a66fb07d2d5021b9c3c";
+        name = "builder_util_runtime___builder_util_runtime_8.7.7.tgz";
+        url  = "https://registry.yarnpkg.com/builder-util-runtime/-/builder-util-runtime-8.7.7.tgz";
+        sha1 = "6c83cc3abe7a7a5c8b4ec8878f68adc828c07f0d";
+      };
+    }
+    {
+      name = "builder_util___builder_util_22.11.7.tgz";
+      path = fetchurl {
+        name = "builder_util___builder_util_22.11.7.tgz";
+        url  = "https://registry.yarnpkg.com/builder-util/-/builder-util-22.11.7.tgz";
+        sha1 = "ae9707afa6a31feafa13c274ac83b4fe28ef1467";
       };
     }
     {
@@ -1298,11 +1322,11 @@
       };
     }
     {
-      name = "caniuse_lite___caniuse_lite_1.0.30001236.tgz";
+      name = "caniuse_lite___caniuse_lite_1.0.30001239.tgz";
       path = fetchurl {
-        name = "caniuse_lite___caniuse_lite_1.0.30001236.tgz";
-        url  = "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001236.tgz";
-        sha1 = "0a80de4cdf62e1770bb46a30d884fc8d633e3958";
+        name = "caniuse_lite___caniuse_lite_1.0.30001239.tgz";
+        url  = "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001239.tgz";
+        sha1 = "66e8669985bb2cb84ccb10f68c25ce6dd3e4d2b8";
       };
     }
     {
@@ -1522,19 +1546,19 @@
       };
     }
     {
-      name = "convert_source_map___convert_source_map_1.7.0.tgz";
+      name = "convert_source_map___convert_source_map_1.8.0.tgz";
       path = fetchurl {
-        name = "convert_source_map___convert_source_map_1.7.0.tgz";
-        url  = "https://registry.yarnpkg.com/convert-source-map/-/convert-source-map-1.7.0.tgz";
-        sha1 = "17a2cb882d7f77d3490585e2ce6c524424a3a442";
+        name = "convert_source_map___convert_source_map_1.8.0.tgz";
+        url  = "https://registry.yarnpkg.com/convert-source-map/-/convert-source-map-1.8.0.tgz";
+        sha1 = "f3373c32d21b4d780dd8004514684fb791ca4369";
       };
     }
     {
-      name = "core_js___core_js_3.14.0.tgz";
+      name = "core_js___core_js_3.15.0.tgz";
       path = fetchurl {
-        name = "core_js___core_js_3.14.0.tgz";
-        url  = "https://registry.yarnpkg.com/core-js/-/core-js-3.14.0.tgz";
-        sha1 = "62322b98c71cc2018b027971a69419e2425c2a6c";
+        name = "core_js___core_js_3.15.0.tgz";
+        url  = "https://registry.yarnpkg.com/core-js/-/core-js-3.15.0.tgz";
+        sha1 = "db9554ebce0b6fd90dc9b1f2465c841d2d055044";
       };
     }
     {
@@ -1746,11 +1770,11 @@
       };
     }
     {
-      name = "dmg_builder___dmg_builder_22.11.5.tgz";
+      name = "dmg_builder___dmg_builder_22.11.7.tgz";
       path = fetchurl {
-        name = "dmg_builder___dmg_builder_22.11.5.tgz";
-        url  = "https://registry.yarnpkg.com/dmg-builder/-/dmg-builder-22.11.5.tgz";
-        sha1 = "0df9843def73a217097956982fa21bb4d6a5836e";
+        name = "dmg_builder___dmg_builder_22.11.7.tgz";
+        url  = "https://registry.yarnpkg.com/dmg-builder/-/dmg-builder-22.11.7.tgz";
+        sha1 = "5956008c18d40ee72c0ea01ffea9590dbf51df89";
       };
     }
     {
@@ -1818,35 +1842,35 @@
       };
     }
     {
-      name = "electron_builder___electron_builder_22.11.5.tgz";
+      name = "electron_builder___electron_builder_22.11.7.tgz";
       path = fetchurl {
-        name = "electron_builder___electron_builder_22.11.5.tgz";
-        url  = "https://registry.yarnpkg.com/electron-builder/-/electron-builder-22.11.5.tgz";
-        sha1 = "914d8183e1bab7cda43ef1d67fc3d17314c7e242";
+        name = "electron_builder___electron_builder_22.11.7.tgz";
+        url  = "https://registry.yarnpkg.com/electron-builder/-/electron-builder-22.11.7.tgz";
+        sha1 = "cd97a0d9f6e6d388112e66b4376de431cca4d596";
       };
     }
     {
-      name = "electron_publish___electron_publish_22.11.5.tgz";
+      name = "electron_publish___electron_publish_22.11.7.tgz";
       path = fetchurl {
-        name = "electron_publish___electron_publish_22.11.5.tgz";
-        url  = "https://registry.yarnpkg.com/electron-publish/-/electron-publish-22.11.5.tgz";
-        sha1 = "2fcd3280c4267e70e4aa15003c9b7dc34923320e";
+        name = "electron_publish___electron_publish_22.11.7.tgz";
+        url  = "https://registry.yarnpkg.com/electron-publish/-/electron-publish-22.11.7.tgz";
+        sha1 = "4126cbb08ccf082a2aa7fef89ee629b3a4b8ae9a";
       };
     }
     {
-      name = "electron_to_chromium___electron_to_chromium_1.3.750.tgz";
+      name = "electron_to_chromium___electron_to_chromium_1.3.752.tgz";
       path = fetchurl {
-        name = "electron_to_chromium___electron_to_chromium_1.3.750.tgz";
-        url  = "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.3.750.tgz";
-        sha1 = "7e5ef6f478316b0bd656af5942fe502610e97eaf";
+        name = "electron_to_chromium___electron_to_chromium_1.3.752.tgz";
+        url  = "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.3.752.tgz";
+        sha1 = "0728587f1b9b970ec9ffad932496429aef750d09";
       };
     }
     {
-      name = "electron___electron_13.1.1.tgz";
+      name = "electron___electron_13.1.2.tgz";
       path = fetchurl {
-        name = "electron___electron_13.1.1.tgz";
-        url  = "https://registry.yarnpkg.com/electron/-/electron-13.1.1.tgz";
-        sha1 = "de1ea908bcac2197d7a5a373fb68c0c66043e10e";
+        name = "electron___electron_13.1.2.tgz";
+        url  = "https://registry.yarnpkg.com/electron/-/electron-13.1.2.tgz";
+        sha1 = "8c9abf9015766c9cbc16f10c99282d00d6ae1b90";
       };
     }
     {
@@ -2010,11 +2034,11 @@
       };
     }
     {
-      name = "eslint___eslint_7.28.0.tgz";
+      name = "eslint___eslint_7.29.0.tgz";
       path = fetchurl {
-        name = "eslint___eslint_7.28.0.tgz";
-        url  = "https://registry.yarnpkg.com/eslint/-/eslint-7.28.0.tgz";
-        sha1 = "435aa17a0b82c13bb2be9d51408b617e49c1e820";
+        name = "eslint___eslint_7.29.0.tgz";
+        url  = "https://registry.yarnpkg.com/eslint/-/eslint-7.29.0.tgz";
+        sha1 = "ee2a7648f2e729485e4d0bd6383ec1deabc8b3c0";
       };
     }
     {
@@ -3890,11 +3914,11 @@
       };
     }
     {
-      name = "regexpp___regexpp_3.1.0.tgz";
+      name = "regexpp___regexpp_3.2.0.tgz";
       path = fetchurl {
-        name = "regexpp___regexpp_3.1.0.tgz";
-        url  = "https://registry.yarnpkg.com/regexpp/-/regexpp-3.1.0.tgz";
-        sha1 = "206d0ad0a5648cffbdb8ae46438f3dc51c9f78e2";
+        name = "regexpp___regexpp_3.2.0.tgz";
+        url  = "https://registry.yarnpkg.com/regexpp/-/regexpp-3.2.0.tgz";
+        sha1 = "0425a2768d8f23bad70ca4b90461fa2f1213e1b2";
       };
     }
     {
@@ -4786,11 +4810,11 @@
       };
     }
     {
-      name = "ws___ws_7.4.6.tgz";
+      name = "ws___ws_7.5.0.tgz";
       path = fetchurl {
-        name = "ws___ws_7.4.6.tgz";
-        url  = "https://registry.yarnpkg.com/ws/-/ws-7.4.6.tgz";
-        sha1 = "5654ca8ecdeee47c33a9a4bf6d28e2be2980377c";
+        name = "ws___ws_7.5.0.tgz";
+        url  = "https://registry.yarnpkg.com/ws/-/ws-7.5.0.tgz";
+        sha1 = "0033bafea031fb9df041b2026fc72a571ca44691";
       };
     }
     {
@@ -4858,11 +4882,11 @@
       };
     }
     {
-      name = "yargs_parser___yargs_parser_20.2.7.tgz";
+      name = "yargs_parser___yargs_parser_20.2.9.tgz";
       path = fetchurl {
-        name = "yargs_parser___yargs_parser_20.2.7.tgz";
-        url  = "https://registry.yarnpkg.com/yargs-parser/-/yargs-parser-20.2.7.tgz";
-        sha1 = "61df85c113edfb5a7a4e36eb8aa60ef423cbc90a";
+        name = "yargs_parser___yargs_parser_20.2.9.tgz";
+        url  = "https://registry.yarnpkg.com/yargs-parser/-/yargs-parser-20.2.9.tgz";
+        sha1 = "2eb7dc3b0289718fc295f362753845c41a0c94ee";
       };
     }
     {

From 7a2c2d7f785e6cdfb05fb5dd427d9a0b333e85d6 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 20 Jun 2021 23:40:18 +0200
Subject: [PATCH 266/416] python3Packages.json-schema-for-humans: 0.27.1 ->
 0.31.0

---
 .../json-schema-for-humans/default.nix        | 50 +++++++++++++++----
 1 file changed, 40 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/python-modules/json-schema-for-humans/default.nix b/pkgs/development/python-modules/json-schema-for-humans/default.nix
index 4e762e456ceb..8df7d6f6e00f 100644
--- a/pkgs/development/python-modules/json-schema-for-humans/default.nix
+++ b/pkgs/development/python-modules/json-schema-for-humans/default.nix
@@ -1,35 +1,65 @@
-{ lib, buildPythonPackage, fetchFromGitHub
-, pbr, click, dataclasses-json, htmlmin, jinja2, markdown2, pygments, pytz, pyyaml, requests, pytestCheckHook, beautifulsoup4, tox
+{ lib
+, beautifulsoup4
+, buildPythonPackage
+, click
+, dataclasses-json
+, fetchFromGitHub
+, htmlmin
+, jinja2
+, markdown2
+, pbr
+, pygments
+, pytestCheckHook
+, pytz
+, pyyaml
+, requests
 }:
 
 buildPythonPackage rec {
   pname = "json-schema-for-humans";
-  version = "0.27.1";
+  version = "0.31.0";
 
   src = fetchFromGitHub {
     owner = "coveooss";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0d2a4a2lcqssr5g9rmc76f86nkqc9grixh507vzc9fi1h3gbi765";
+    sha256 = "1aj1w0qxdw8d6mf5vngk0xjgs7z8vzwc2aycahnkqg7q3cagq19n";
   };
 
   nativeBuildInputs = [ pbr ];
+
   propagatedBuildInputs = [
-    click dataclasses-json htmlmin jinja2 markdown2
-    pygments pytz pyyaml requests
+    click
+    dataclasses-json
+    htmlmin
+    jinja2
+    markdown2
+    pygments
+    pytz
+    pyyaml
+    requests
   ];
 
   preBuild = ''
     export PBR_VERSION=0.0.1
   '';
 
-  checkInputs = [ pytestCheckHook beautifulsoup4 ];
-  pytestFlagsArray = [ "--ignore tests/generate_test.py" ];
+  checkInputs = [
+    beautifulsoup4
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # Tests require network access
+    "test_references_url"
+  ];
+
+  pythonImportsCheck = [ "json_schema_for_humans" ];
 
   meta = with lib; {
     description = "Quickly generate HTML documentation from a JSON schema";
-    homepage    = "https://github.com/coveooss/json-schema-for-humans";
-    license     = licenses.asl20;
+    homepage = "https://github.com/coveooss/json-schema-for-humans";
+    license = licenses.asl20;
     maintainers = with maintainers; [ astro ];
   };
 }

From 712488a221e19b3391b20e6cb0fe26dca76863ab Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 24 Mar 2021 16:49:07 +0100
Subject: [PATCH 267/416] python3Packages.dataclasses-json: enable tests

---
 .../dataclasses-json/default.nix              | 26 ++++++++++++++++---
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/dataclasses-json/default.nix b/pkgs/development/python-modules/dataclasses-json/default.nix
index 36430a29ef0f..4a2a410c4ad5 100644
--- a/pkgs/development/python-modules/dataclasses-json/default.nix
+++ b/pkgs/development/python-modules/dataclasses-json/default.nix
@@ -1,18 +1,23 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , stringcase
 , typing-inspect
 , marshmallow-enum
+, hypothesis
+, mypy
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "dataclasses-json";
   version = "0.5.2";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "56ec931959ede74b5dedf65cf20772e6a79764d20c404794cce0111c88c085ff";
+  src = fetchFromGitHub {
+    owner = "lidatong";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1gcnm41rwg0jvq4vhr57vv9hyasws425zl8h4p05x2nzq86l0w1n";
   };
 
   propagatedBuildInputs = [
@@ -21,6 +26,19 @@ buildPythonPackage rec {
     marshmallow-enum
   ];
 
+  checkInputs = [
+    hypothesis
+    mypy
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # AssertionError: Type annotations check failed
+    "test_type_hints"
+  ];
+
+  pythonImportsCheck = [ "dataclasses_json" ];
+
   meta = with lib; {
     description = "Simple API for encoding and decoding dataclasses to and from JSON";
     homepage = "https://github.com/lidatong/dataclasses-json";

From 3838df3ec83707583a0e7a18743248b697e93260 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 7 Jun 2021 00:19:48 +0200
Subject: [PATCH 268/416] python3Packages.libcst: run some tests

---
 .../python-modules/libcst/default.nix         | 49 ++++++++++++-------
 1 file changed, 31 insertions(+), 18 deletions(-)

diff --git a/pkgs/development/python-modules/libcst/default.nix b/pkgs/development/python-modules/libcst/default.nix
index ed6e7755bf15..314bc82cd4fb 100644
--- a/pkgs/development/python-modules/libcst/default.nix
+++ b/pkgs/development/python-modules/libcst/default.nix
@@ -1,21 +1,22 @@
 { lib
+, black
 , buildPythonPackage
-, fetchFromGitHub
-, pythonOlder
-, hypothesis
 , dataclasses
-, hypothesmith
-, pytestCheckHook
+, fetchFromGitHub
+, hypothesis
+, isort
+, pytest
+, python
+, pythonOlder
 , pyyaml
 , typing-extensions
 , typing-inspect
-, black
-, isort
 }:
 
 buildPythonPackage rec {
   pname = "libcst";
   version = "0.3.18";
+  disabled = pythonOlder "3.6";
 
   # Some files for tests missing from PyPi
   # https://github.com/Instagram/LibCST/issues/331
@@ -26,25 +27,37 @@ buildPythonPackage rec {
     sha256 = "sha256-19yGaKBLpGASSPv/aSX0kx9lh2JxKExHJDKKtuBbuqI=";
   };
 
-  disabled = pythonOlder "3.6";
+  propagatedBuildInputs = [
+    hypothesis
+    typing-extensions
+    typing-inspect
+    pyyaml
+  ] ++ lib.optional (pythonOlder "3.7") [
+    dataclasses
+  ];
 
-  propagatedBuildInputs = [ hypothesis typing-extensions typing-inspect pyyaml ]
-    ++ lib.optional (pythonOlder "3.7") dataclasses;
-
-  checkInputs = [ black hypothesmith isort pytestCheckHook ];
-
-  # can't run tests due to circular dependency on hypothesmith -> licst
-  doCheck = false;
+  checkInputs = [
+    black
+    isort
+    pytest
+  ];
 
   preCheck = ''
-    python -m libcst.codegen.generate visitors
-    python -m libcst.codegen.generate return_types
+    ${python.interpreter} -m libcst.codegen.generate visitors
+    ${python.interpreter} -m libcst.codegen.generate return_types
+    # Can't run all tests due to circular dependency on hypothesmith -> libcst
+    rm -r {libcst/tests,libcst/codegen/tests,libcst/m*/tests}
   '';
 
+  disabledTests = [
+    # No files are generated
+    "test_codemod_formatter_error_input"
+  ];
+
   pythonImportsCheck = [ "libcst" ];
 
   meta = with lib; {
-    description = "A Concrete Syntax Tree (CST) parser and serializer library for Python.";
+    description = "Concrete Syntax Tree (CST) parser and serializer library for Python";
     homepage = "https://github.com/Instagram/libcst";
     license = with licenses; [ mit asl20 psfl ];
     maintainers = with maintainers; [ ruuda SuperSandro2000 ];

From 926450c6e356718299e31832e7c9277d66e049e6 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 21 Jun 2021 09:09:46 +0200
Subject: [PATCH 269/416] python3Packages.google-cloud-*: migrate to
 disabledTestPaths

---
 .../google-cloud-automl/default.nix           | 13 ++++++---
 .../google-cloud-datastore/default.nix        | 21 ++++++++++++---
 .../google-cloud-error-reporting/default.nix  | 15 ++++++++---
 .../google-cloud-firestore/default.nix        |  8 +++---
 .../google-cloud-pubsub/default.nix           | 21 ++++++++++++---
 .../google-cloud-spanner/default.nix          | 27 +++++++++++++++----
 .../google-cloud-translate/default.nix        | 14 ++++++++--
 7 files changed, 94 insertions(+), 25 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-automl/default.nix b/pkgs/development/python-modules/google-cloud-automl/default.nix
index 0bab9ce64870..899eef02c9a1 100644
--- a/pkgs/development/python-modules/google-cloud-automl/default.nix
+++ b/pkgs/development/python-modules/google-cloud-automl/default.nix
@@ -21,7 +21,11 @@ buildPythonPackage rec {
     sha256 = "sha256-UjYzSWtP4cp0p7Is2qIGWBgEhjgTv0YeL0N9D7etIbY=";
   };
 
-  propagatedBuildInputs = [ google-api-core libcst proto-plus ];
+  propagatedBuildInputs = [
+    google-api-core
+    libcst
+    proto-plus
+  ];
 
   checkInputs = [
     google-cloud-storage
@@ -35,10 +39,13 @@ buildPythonPackage rec {
   preCheck = ''
     # do not shadow imports
     rm -r google
-    # requires credentials
-    rm tests/system/gapic/v1beta1/test_system_tables_client_v1.py
   '';
 
+  disabledTestPaths = [
+    # requires credentials
+    "tests/system/gapic/v1beta1/test_system_tables_client_v1.py"
+  ];
+
   disabledTests = [
     # requires credentials
     "test_prediction_client_client_info"
diff --git a/pkgs/development/python-modules/google-cloud-datastore/default.nix b/pkgs/development/python-modules/google-cloud-datastore/default.nix
index 79a97b692896..dae19022d06c 100644
--- a/pkgs/development/python-modules/google-cloud-datastore/default.nix
+++ b/pkgs/development/python-modules/google-cloud-datastore/default.nix
@@ -20,17 +20,30 @@ buildPythonPackage rec {
     sha256 = "sha256-56UQdZudVf9jyYPjxCy/XDX5tzEPTWEevjaX2mV2vLQ=";
   };
 
-  propagatedBuildInputs = [ google-api-core google-cloud-core libcst proto-plus ];
+  propagatedBuildInputs = [
+    google-api-core
+    google-cloud-core
+    libcst
+    proto-plus
+  ];
 
-  checkInputs = [ google-cloud-testutils mock pytestCheckHook pytest-asyncio ];
+  checkInputs = [
+    google-cloud-testutils
+    mock
+    pytestCheckHook
+    pytest-asyncio
+  ];
 
   preCheck = ''
     # directory shadows imports
     rm -r google
-    # requires credentials
-    rm tests/system/test_system.py
   '';
 
+  disabledTestPaths = [
+    # Requires credentials
+    "tests/system/test_system.py"
+  ];
+
   pythonImportsCheck = [
     "google.cloud.datastore"
     "google.cloud.datastore_admin_v1"
diff --git a/pkgs/development/python-modules/google-cloud-error-reporting/default.nix b/pkgs/development/python-modules/google-cloud-error-reporting/default.nix
index 732c9aac81d8..8aae0c072a0f 100644
--- a/pkgs/development/python-modules/google-cloud-error-reporting/default.nix
+++ b/pkgs/development/python-modules/google-cloud-error-reporting/default.nix
@@ -24,9 +24,18 @@ buildPythonPackage rec {
       --replace 'google-cloud-logging>=1.14.0, <2.4' 'google-cloud-logging>=1.14.0'
   '';
 
-  propagatedBuildInputs = [ google-cloud-logging libcst proto-plus ];
+  propagatedBuildInputs = [
+    google-cloud-logging
+    libcst
+    proto-plus
+  ];
 
-  checkInputs = [ google-cloud-testutils mock pytestCheckHook pytest-asyncio ];
+  checkInputs = [
+    google-cloud-testutils
+    mock
+    pytestCheckHook
+    pytest-asyncio
+  ];
 
   disabledTests = [
     # require credentials
@@ -34,8 +43,8 @@ buildPythonPackage rec {
     "test_report_exception"
   ];
 
-  # prevent google directory from shadowing google imports
   preCheck = ''
+    # prevent google directory from shadowing google imports
     rm -r google
   '';
 
diff --git a/pkgs/development/python-modules/google-cloud-firestore/default.nix b/pkgs/development/python-modules/google-cloud-firestore/default.nix
index 92922fcc403f..4ff4c920c8ad 100644
--- a/pkgs/development/python-modules/google-cloud-firestore/default.nix
+++ b/pkgs/development/python-modules/google-cloud-firestore/default.nix
@@ -39,10 +39,10 @@ buildPythonPackage rec {
     rm -r google
   '';
 
-  pytestFlagsArray = [
-    # tests are broken
-    "--ignore=tests/system/test_system.py"
-    "--ignore=tests/system/test_system_async.py"
+  disabledTestPaths = [
+    # Tests are broken
+    "tests/system/test_system.py"
+    "tests/system/test_system_async.py"
   ];
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/google-cloud-pubsub/default.nix b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
index 27eee2507a74..6bce8cc5a89b 100644
--- a/pkgs/development/python-modules/google-cloud-pubsub/default.nix
+++ b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
@@ -20,17 +20,30 @@ buildPythonPackage rec {
     sha256 = "sha256-hwZVe3FTLHauxIQJ3KwYnKrEfPLey4hQrnVpS/cDJrI=";
   };
 
-  propagatedBuildInputs = [ grpc_google_iam_v1 google-api-core libcst proto-plus ];
+  propagatedBuildInputs = [
+    grpc_google_iam_v1
+    google-api-core
+    libcst
+    proto-plus
+  ];
 
-  checkInputs = [ google-cloud-testutils mock pytestCheckHook pytest-asyncio ];
+  checkInputs = [
+    google-cloud-testutils
+    mock
+    pytestCheckHook
+    pytest-asyncio
+  ];
 
   preCheck = ''
     # prevent google directory from shadowing google imports
     rm -r google
-    # Tests in pubsub_v1 attempt to contact pubsub.googleapis.com
-    rm -r tests/unit/pubsub_v1
   '';
 
+  disabledTestPaths = [
+    # Tests in pubsub_v1 attempt to contact pubsub.googleapis.com
+    "tests/unit/pubsub_v1"
+  ];
+
   pythonImportsCheck = [ "google.cloud.pubsub" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/google-cloud-spanner/default.nix b/pkgs/development/python-modules/google-cloud-spanner/default.nix
index e1f059810296..eae38f5dfc17 100644
--- a/pkgs/development/python-modules/google-cloud-spanner/default.nix
+++ b/pkgs/development/python-modules/google-cloud-spanner/default.nix
@@ -21,18 +21,35 @@ buildPythonPackage rec {
     sha256 = "sha256-8o7pr9msuMfIN7UMX+/gppmD3MWXt2hBqb7vcLUE22M=";
   };
 
-  propagatedBuildInputs = [ google-cloud-core grpc_google_iam_v1 libcst proto-plus sqlparse ];
+  propagatedBuildInputs = [
+    google-cloud-core
+    grpc_google_iam_v1
+    libcst
+    proto-plus
+    sqlparse
+  ];
 
-  checkInputs = [ google-cloud-testutils mock pytestCheckHook pytest-asyncio ];
+  checkInputs = [
+    google-cloud-testutils
+    mock
+    pytestCheckHook
+    pytest-asyncio
+  ];
 
   preCheck = ''
     # prevent google directory from shadowing google imports
     rm -r google
-    # disable tests which require credentials
-    rm tests/system/test_{system,system_dbapi}.py
-    rm tests/unit/spanner_dbapi/test_{connect,connection,cursor}.py
   '';
 
+  disabledTestPaths = [
+    # Requires credentials
+    "tests/system/test_system.py"
+    "tests/system/test_system_dbapi.py"
+    "tests/unit/spanner_dbapi/test_connect.py"
+    "tests/unit/spanner_dbapi/test_connection.py"
+    "tests/unit/spanner_dbapi/test_cursor.py"
+  ];
+
   pythonImportsCheck = [
     "google.cloud.spanner_admin_database_v1"
     "google.cloud.spanner_admin_instance_v1"
diff --git a/pkgs/development/python-modules/google-cloud-translate/default.nix b/pkgs/development/python-modules/google-cloud-translate/default.nix
index beae78331abd..b1167433b4c0 100644
--- a/pkgs/development/python-modules/google-cloud-translate/default.nix
+++ b/pkgs/development/python-modules/google-cloud-translate/default.nix
@@ -21,9 +21,19 @@ buildPythonPackage rec {
     sha256 = "sha256-jNlX9LKajHqYPgpCfCcSUzxBu3AHt2qMyI1sZQdcZ5o=";
   };
 
-  propagatedBuildInputs = [ google-api-core google-cloud-core libcst proto-plus ];
+  propagatedBuildInputs = [
+    google-api-core
+    google-cloud-core
+    libcst
+    proto-plus
+  ];
 
-  checkInputs = [ google-cloud-testutils mock pytestCheckHook pytest-asyncio ];
+  checkInputs = [
+    google-cloud-testutils
+    mock
+    pytestCheckHook
+    pytest-asyncio
+  ];
 
   preCheck = ''
     # prevent shadowing imports

From 24eceb46b78f1d1e0b8807dceb26e1589c346ecc Mon Sep 17 00:00:00 2001
From: Stig Palmquist <stig@stig.io>
Date: Fri, 18 Jun 2021 22:02:37 +0200
Subject: [PATCH 270/416] rakudo: remove references to stdenv.cc.cc

Rakudo depends on gcc noticeably increasing closure size, this commit
removes the references.

Fixes #101097
---
 pkgs/development/interpreters/rakudo/default.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/rakudo/default.nix b/pkgs/development/interpreters/rakudo/default.nix
index 3d9d0b7e1346..fdb3a78a1b7e 100644
--- a/pkgs/development/interpreters/rakudo/default.nix
+++ b/pkgs/development/interpreters/rakudo/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, perl, icu, zlib, gmp, lib, nqp }:
+{ stdenv, fetchurl, perl, icu, zlib, gmp, lib, nqp, removeReferencesTo }:
 
 stdenv.mkDerivation rec {
   pname = "rakudo";
@@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "11ixlqmvbb37abksdysg5r4lkbwzr486lkc0ssl3wca4iiy3mhgf";
   };
 
+  nativeBuildInputs = [ removeReferencesTo ];
+
   buildInputs = [ icu zlib gmp perl ];
   configureScript = "perl ./Configure.pl";
   configureFlags = [
@@ -16,6 +18,11 @@ stdenv.mkDerivation rec {
     "--with-nqp=${nqp}/bin/nqp"
   ];
 
+  disallowedReferences = [ stdenv.cc.cc ];
+  postFixup = ''
+    remove-references-to -t ${stdenv.cc.cc} "$(readlink -f $out/share/perl6/runtime/dynext/libperl6_ops_moar.so)"
+  '';
+
   meta = with lib; {
     description = "Raku implementation on top of Moar virtual machine";
     homepage    = "https://rakudo.org";

From 8fb57a90eb5cb0ed855a8dba71f09b349e1e4a55 Mon Sep 17 00:00:00 2001
From: Vincenzo Mantova <xworld21@users.sf.net>
Date: Sun, 23 May 2021 19:02:36 +0100
Subject: [PATCH 271/416] eukleides: add getopt in euktoeps wrapper

---
 pkgs/applications/science/math/eukleides/default.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/science/math/eukleides/default.nix b/pkgs/applications/science/math/eukleides/default.nix
index fe8969a36b51..e96438b5b3e2 100644
--- a/pkgs/applications/science/math/eukleides/default.nix
+++ b/pkgs/applications/science/math/eukleides/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, bison, flex, makeWrapper, texinfo, readline, texlive }:
+{ lib, stdenv, fetchurl, bison, flex, makeWrapper, texinfo, getopt, readline, texlive }:
 
 lib.fix (eukleides: stdenv.mkDerivation rec {
   pname = "eukleides";
@@ -14,7 +14,7 @@ lib.fix (eukleides: stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ bison flex texinfo makeWrapper ];
 
-  buildInputs = [ readline ];
+  buildInputs = [ getopt readline ];
 
   preConfigure = ''
     substituteInPlace Makefile \
@@ -32,6 +32,11 @@ lib.fix (eukleides: stdenv.mkDerivation rec {
     mkdir -p $out/bin
   '';
 
+  postInstall = ''
+    wrapProgram $out/bin/euktoeps \
+      --prefix PATH : ${lib.makeBinPath [ getopt ]}
+  '';
+
   outputs = [ "out" "doc" "tex" ];
 
   passthru.tlType = "run";

From b88e8d999c52d0cdff3bb3283f85b500b7c0832e Mon Sep 17 00:00:00 2001
From: Vincenzo Mantova <xworld21@users.sf.net>
Date: Sun, 23 May 2021 19:04:07 +0100
Subject: [PATCH 272/416] eukleides: allow PostScript transparency

---
 pkgs/applications/science/math/eukleides/default.nix   |  8 ++++++--
 .../math/eukleides/gs-allowpstransparency.patch        | 10 ++++++++++
 2 files changed, 16 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/applications/science/math/eukleides/gs-allowpstransparency.patch

diff --git a/pkgs/applications/science/math/eukleides/default.nix b/pkgs/applications/science/math/eukleides/default.nix
index e96438b5b3e2..12226abdfca4 100644
--- a/pkgs/applications/science/math/eukleides/default.nix
+++ b/pkgs/applications/science/math/eukleides/default.nix
@@ -9,8 +9,12 @@ lib.fix (eukleides: stdenv.mkDerivation rec {
     sha256 = "0s8cyh75hdj89v6kpm3z24i48yzpkr8qf0cwxbs9ijxj1i38ki0q";
   };
 
-  # use $CC instead of hardcoded gcc
-  patches = [ ./use-CC.patch ];
+  patches = [
+    # use $CC instead of hardcoded gcc
+    ./use-CC.patch
+    # allow PostScript transparency in epstopdf call
+    ./gs-allowpstransparency.patch
+  ];
 
   nativeBuildInputs = [ bison flex texinfo makeWrapper ];
 
diff --git a/pkgs/applications/science/math/eukleides/gs-allowpstransparency.patch b/pkgs/applications/science/math/eukleides/gs-allowpstransparency.patch
new file mode 100644
index 000000000000..aa92e6cc9fa7
--- /dev/null
+++ b/pkgs/applications/science/math/eukleides/gs-allowpstransparency.patch
@@ -0,0 +1,10 @@
+--- a/bash/euktopdf
++++ b/bash/euktopdf
+@@ -55,6 +55,6 @@ do
+     exit 1
+   fi
+   dvips -q -E -o $base.eps $base.dvi &&
+-  epstopdf $base.eps &&
++  epstopdf --gsopt=-dALLOWPSTRANSPARENCY $base.eps &&
+   rm -f $base.{tex,log,dvi,eps}
+ done

From b0c6bd9211ee7a35d27a0037b388742960c3df71 Mon Sep 17 00:00:00 2001
From: Vincenzo Mantova <xworld21@users.sf.net>
Date: Sun, 23 May 2021 19:05:26 +0100
Subject: [PATCH 273/416] eukleides: depend on texinfo4 instead of overriding
 texinfo

---
 pkgs/applications/science/math/eukleides/default.nix | 4 ++--
 pkgs/top-level/all-packages.nix                      | 4 +---
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/pkgs/applications/science/math/eukleides/default.nix b/pkgs/applications/science/math/eukleides/default.nix
index 12226abdfca4..6b6bfd7d6e5f 100644
--- a/pkgs/applications/science/math/eukleides/default.nix
+++ b/pkgs/applications/science/math/eukleides/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, bison, flex, makeWrapper, texinfo, getopt, readline, texlive }:
+{ lib, stdenv, fetchurl, bison, flex, makeWrapper, texinfo4, getopt, readline, texlive }:
 
 lib.fix (eukleides: stdenv.mkDerivation rec {
   pname = "eukleides";
@@ -16,7 +16,7 @@ lib.fix (eukleides: stdenv.mkDerivation rec {
     ./gs-allowpstransparency.patch
   ];
 
-  nativeBuildInputs = [ bison flex texinfo makeWrapper ];
+  nativeBuildInputs = [ bison flex texinfo4 makeWrapper ];
 
   buildInputs = [ getopt readline ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c5506ab5caad..a4f5a7f7e3f8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -29827,9 +29827,7 @@ in
 
   ecm = callPackage ../applications/science/math/ecm { };
 
-  eukleides = callPackage ../applications/science/math/eukleides {
-    texinfo = texinfo4;
-  };
+  eukleides = callPackage ../applications/science/math/eukleides { };
 
   form = callPackage ../applications/science/math/form { };
 

From e36a8d534dc4b2f93cf1f1695a7c851c7d073804 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Mon, 21 Jun 2021 07:18:13 +0000
Subject: [PATCH 274/416] libdnf: 0.63.0 -> 0.63.1

---
 pkgs/tools/package-management/libdnf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/package-management/libdnf/default.nix b/pkgs/tools/package-management/libdnf/default.nix
index 5da02aa771ba..7a421aaeebf4 100644
--- a/pkgs/tools/package-management/libdnf/default.nix
+++ b/pkgs/tools/package-management/libdnf/default.nix
@@ -3,13 +3,13 @@
 
 gcc9Stdenv.mkDerivation rec {
   pname = "libdnf";
-  version = "0.63.0";
+  version = "0.63.1";
 
   src = fetchFromGitHub {
     owner = "rpm-software-management";
     repo = pname;
     rev = version;
-    sha256 = "sha256-+D1KosfeoEzRgAE6WheO0Vo/1oq7+1tWPa7rRemyZYo=";
+    sha256 = "sha256-SwkqFSAl99fQoXT96BPRqKFqJg3HEziiT+jXcugPyxM=";
   };
 
   nativeBuildInputs = [

From aaeb941fcc289916734dd4047b0a530096f74f54 Mon Sep 17 00:00:00 2001
From: Attila Lendvai <attila@lendvai.name>
Date: Wed, 14 Apr 2021 19:50:03 +0200
Subject: [PATCH 275/416] c2ffi: init at 2021-06-16

upstream doesn't have releases.
---
 pkgs/development/tools/misc/c2ffi/default.nix | 56 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 2 files changed, 58 insertions(+)
 create mode 100644 pkgs/development/tools/misc/c2ffi/default.nix

diff --git a/pkgs/development/tools/misc/c2ffi/default.nix b/pkgs/development/tools/misc/c2ffi/default.nix
new file mode 100644
index 000000000000..b7a5b1dc7eb8
--- /dev/null
+++ b/pkgs/development/tools/misc/c2ffi/default.nix
@@ -0,0 +1,56 @@
+{ lib
+, fetchFromGitHub
+, cmake
+, llvmPackages_11
+, unstableGitUpdater
+}:
+
+let
+  c2ffiBranch = "llvm-11.0.0";
+  llvmPackages = llvmPackages_11;
+in
+
+llvmPackages.stdenv.mkDerivation {
+  pname = "c2ffi-${c2ffiBranch}";
+  version = "unstable-2021-04-15";
+
+  src = fetchFromGitHub {
+    owner = "rpav";
+    repo = "c2ffi";
+    rev = "0255131f80b21334e565231331c2b451b6bba8c4";
+    sha256 = "0ihysgqjyg5xwi098hxf15lpdi6g4nwpzczp495is912c48fy6b6";
+  };
+
+  passthru.updateScript = unstableGitUpdater {
+    url = "https://github.com/rpav/c2ffi.git";
+    branch = c2ffiBranch;
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    llvmPackages.llvm
+    llvmPackages.clang
+    llvmPackages.libclang
+  ];
+
+  # This isn't much, but...
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/c2ffi --help 2>&1 >/dev/null
+  '';
+
+  # LLVM may be compiled with -fno-rtti, so let's just turn it off.
+  # A mismatch between lib{clang,LLVM}* and us can lead to the link time error:
+  # undefined reference to `typeinfo for clang::ASTConsumer'
+  CXXFLAGS="-fno-rtti";
+
+  meta = with lib; {
+    homepage = "https://github.com/rpav/c2ffi";
+    description = "An LLVM based tool for extracting definitions from C, C++, and Objective C header files for use with foreign function call interfaces";
+    license = licenses.lgpl21Only;
+    maintainers = with maintainers; [ attila-lendvai ];
+ };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8a4575651c45..a6483336dae3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -14085,6 +14085,8 @@ in
   swig = swig3;
   swigWithJava = swig;
 
+  c2ffi = callPackage ../development/tools/misc/c2ffi { };
+
   swfmill = callPackage ../tools/video/swfmill { };
 
   swftools = callPackage ../tools/video/swftools {

From 64c70a8c4c99aca38ad9aed3aacb769e9ac2a4c3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B8rn=20Forsman?= <bjorn.forsman@gmail.com>
Date: Sun, 20 Jun 2021 19:44:23 +0200
Subject: [PATCH 276/416] doc: point out that nixos-21.05 has gnuradio 3.9

Reading the release notes I got the impression that the latest (and
default) was GR3.8, but it is in fact 3.9. Make that more obvioius.
---
 nixos/doc/manual/release-notes/rl-2105.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2105.xml b/nixos/doc/manual/release-notes/rl-2105.xml
index a93fdd67fe9a..4ecdd23d2dea 100644
--- a/nixos/doc/manual/release-notes/rl-2105.xml
+++ b/nixos/doc/manual/release-notes/rl-2105.xml
@@ -113,11 +113,11 @@
   <itemizedlist>
    <listitem>
     <para>
-     <link xlink:href="https://www.gnuradio.org/">GNURadio</link> 3.8 was
+     <link xlink:href="https://www.gnuradio.org/">GNURadio</link> 3.8 and 3.9 were
      <link xlink:href="https://github.com/NixOS/nixpkgs/issues/82263">finally</link>
      packaged, along with a rewrite to the Nix expressions, allowing users to
      override the features upstream supports selecting to compile or not to.
-     Additionally, the attribute <code>gnuradio</code> and <code>gnuradio3_7</code>
+     Additionally, the attribute <code>gnuradio</code> (3.9), <code>gnuradio3_8</code> and <code>gnuradio3_7</code>
      now point to an externally wrapped by default derivations, that allow you to
      also add `extraPythonPackages` to the Python interpreter used by GNURadio.
      Missing environmental variables needed for operational GUI were also added

From 5244b041dcec13766c35d3c3e8276f552761644b Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Mon, 21 Jun 2021 09:42:30 +0200
Subject: [PATCH 277/416] vorta: 0.7.6 -> 0.7.7

ChangeLog: https://github.com/borgbase/vorta/releases/tag/v0.7.7
---
 pkgs/applications/backup/vorta/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/backup/vorta/default.nix b/pkgs/applications/backup/vorta/default.nix
index 4cb21e5267df..347a0de0503f 100644
--- a/pkgs/applications/backup/vorta/default.nix
+++ b/pkgs/applications/backup/vorta/default.nix
@@ -7,13 +7,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "vorta";
-  version = "0.7.6";
+  version = "0.7.7";
 
   src = fetchFromGitHub {
     owner = "borgbase";
     repo = "vorta";
     rev = "v${version}";
-    sha256 = "sha256-bzhabRVgl1eLTS4KtFkn4xw2KDTZJyFU6zCJdHW5IGE=";
+    sha256 = "sha256-AH9CvoWAaNLPLC+NL+VXtYq9CNCMt0AFtC1ZGXSlcHQ=";
   };
 
   postPatch = ''

From 447b1cf03d3b96e208de704c75eaaacc96ff7d55 Mon Sep 17 00:00:00 2001
From: Konrad Borowski <konrad@borowski.pw>
Date: Mon, 21 Jun 2021 10:16:47 +0200
Subject: [PATCH 278/416] nixos/prometheus: allow state access for service only

There is no reason for Prometheus state files to be
world-readable.
---
 nixos/modules/services/monitoring/prometheus/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/monitoring/prometheus/default.nix b/nixos/modules/services/monitoring/prometheus/default.nix
index e08f23d8eb04..8fe689ef3dbb 100644
--- a/nixos/modules/services/monitoring/prometheus/default.nix
+++ b/nixos/modules/services/monitoring/prometheus/default.nix
@@ -945,6 +945,7 @@ in {
         RuntimeDirectoryMode = "0700";
         WorkingDirectory = workingDir;
         StateDirectory = cfg.stateDir;
+        StateDirectoryMode = "0700";
       };
     };
   };

From 0d74bf02b89c03037577fec85f696303efd140ed Mon Sep 17 00:00:00 2001
From: Max Wittig <max.wittig@siemens.com>
Date: Mon, 21 Jun 2021 10:17:35 +0200
Subject: [PATCH 279/416] gitlab-runner: 13.12.0 -> 14.0.0

---
 .../continuous-integration/gitlab-runner/default.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
index ce3264e1adde..d154adbdc1be 100644
--- a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
@@ -1,16 +1,16 @@
 { lib, buildGoPackage, fetchFromGitLab, fetchurl }:
 
 let
-  version = "13.12.0";
+  version = "14.0.0";
   # Gitlab runner embeds some docker images these are prebuilt for arm and x86_64
   docker_x86_64 = fetchurl {
-    url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/helper-images/prebuilt-x86_64.tar.xz";
-    sha256 = "0m0r295520jy45wn8jw3jzhiixl4c6yrfx7gvgbd4c1v4y8ivrci";
+    url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/binaries/gitlab-runner-helper/gitlab-runner-helper.x86_64";
+    sha256 = "156dm6kg154fyn3axgw7kcpq9xz8mxdyhch8snp0vxzh941sc74w";
   };
 
   docker_arm = fetchurl {
-    url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/helper-images/prebuilt-arm.tar.xz";
-    sha256 = "0syfggplp19bbmhhpyc17h0f1dii9hc6n04q483l0xdk7sv39fwx";
+    url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/binaries/gitlab-runner-helper/gitlab-runner-helper.arm";
+    sha256 = "0cnjbcc3bdiahff3iyxwppj9gwaj7r7x80hk2cv2q4hkdpsji655";
   };
 in
 buildGoPackage rec {
@@ -30,7 +30,7 @@ buildGoPackage rec {
     owner = "gitlab-org";
     repo = "gitlab-runner";
     rev = "v${version}";
-    sha256 = "01ajl7zka5fnph5zcnp3z6ir8xr81wzkam69gxazwjb3nbs642an";
+    sha256 = "14g78m5h5d02k04lc07jc8yp7sqmfkjif589rb8wkb9jmbh7glmi";
   };
 
   patches = [ ./fix-shell-path.patch ];

From ec92453a348707218c8650b679d8aa19fb636370 Mon Sep 17 00:00:00 2001
From: Phillip <sheepforce@users.noreply.github.com>
Date: Mon, 21 Jun 2021 10:22:19 +0200
Subject: [PATCH 280/416] xcfun: init at 2.1.1

Update pkgs/development/libraries/science/chemistry/xcfun/default.nix

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
Update pkgs/development/libraries/science/chemistry/xcfun/default.nix

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
Update pkgs/development/libraries/science/chemistry/xcfun/default.nix

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
Update pkgs/development/libraries/science/chemistry/xcfun/default.nix

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
Update pkgs/development/libraries/science/chemistry/xcfun/default.nix

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
---
 .../science/chemistry/xcfun/default.nix       | 30 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 ++
 2 files changed, 32 insertions(+)
 create mode 100644 pkgs/development/libraries/science/chemistry/xcfun/default.nix

diff --git a/pkgs/development/libraries/science/chemistry/xcfun/default.nix b/pkgs/development/libraries/science/chemistry/xcfun/default.nix
new file mode 100644
index 000000000000..7f8ef3dc47d7
--- /dev/null
+++ b/pkgs/development/libraries/science/chemistry/xcfun/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, lib, fetchFromGitHub, cmake, gfortran, python3 } :
+
+stdenv.mkDerivation rec {
+  pname = "xcfun";
+  version = "2.1.1";
+
+  src = fetchFromGitHub  {
+    owner = "dftlibs";
+    repo = pname;
+    rev = "v${version}";
+    sha256= "1bj70cnhbh6ziy02x988wwl7cbwaq17ld7qwhswqkgnnx8rpgxid";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    gfortran
+  ];
+
+  propagatedBuildInputs = [ (python3.withPackages (p: with p; [ pybind11 ])) ];
+
+  cmakeFlags = [ "-DXCFUN_MAX_ORDER=3" ];
+
+  meta = with lib; {
+    description = "A library of exchange-correlation functionals with arbitrary-order derivatives";
+    homepage = "https://github.com/dftlibs/xcfun";
+    license = licenses.mpl20;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.sheepforce ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 28ea920346f5..eee2f002e8ef 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -31992,6 +31992,8 @@ in
 
   xcolor = callPackage ../tools/graphics/xcolor { };
 
+  xcfun = callPackage ../development/libraries/science/chemistry/xcfun { };
+
   zthrottle = callPackage ../tools/misc/zthrottle { };
 
   zktree = callPackage ../applications/misc/zktree {};

From fe11ffda48a5caa1ec74b6203136ef2f22b5b8e6 Mon Sep 17 00:00:00 2001
From: toastal <toastal@posteo.net>
Date: Mon, 21 Jun 2021 15:31:02 +0700
Subject: [PATCH 281/416] julia-mono: 0.039 -> 0.040

---
 pkgs/data/fonts/julia-mono/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/data/fonts/julia-mono/default.nix b/pkgs/data/fonts/julia-mono/default.nix
index ba9ad48e3917..014d6bd6f853 100644
--- a/pkgs/data/fonts/julia-mono/default.nix
+++ b/pkgs/data/fonts/julia-mono/default.nix
@@ -1,13 +1,13 @@
 { lib, fetchzip }:
 
 let
-  version = "0.039";
+  version = "0.040";
 
 in
 fetchzip {
   name = "JuliaMono-ttf-${version}";
   url = "https://github.com/cormullion/juliamono/releases/download/v${version}/JuliaMono-ttf.tar.gz";
-  sha256 = "sha256-M9T78xnSN1hcHLXkut09eD2IFrgCRTG9fAPqMv4MXWY=";
+  sha256 = "sha256-Rrsvs682aWXZqydnOifXTJMa4uPl/aCGbVNRPGxkZng=";
 
   postFetch = ''
     mkdir -p $out/share/fonts/truetype

From 06a56b80c0b84d2b132a2d3597906949edf0ddf0 Mon Sep 17 00:00:00 2001
From: Johannes Schleifenbaum <johannes@js-webcoding.de>
Date: Mon, 21 Jun 2021 11:24:38 +0200
Subject: [PATCH 282/416] dbeaver: 21.1.0 -> 21.1.1

---
 pkgs/applications/misc/dbeaver/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/misc/dbeaver/default.nix b/pkgs/applications/misc/dbeaver/default.nix
index 8de49c5f9507..b48640c1d2ae 100644
--- a/pkgs/applications/misc/dbeaver/default.nix
+++ b/pkgs/applications/misc/dbeaver/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dbeaver";
-  version = "21.1.0"; # When updating also update fetchedMavenDeps.sha256
+  version = "21.1.1"; # When updating also update fetchedMavenDeps.sha256
 
   src = fetchFromGitHub {
     owner = "dbeaver";
     repo = "dbeaver";
     rev = version;
-    sha256 = "sha256-MHfW6gZFB2osE+8Ek7I40fg2cdowph3hvKqkjG7+rY4=";
+    sha256 = "sha256-enUwX+BxgPy4c1Vwo1+vN3lFYz4LgofgKvZOYuz/050=";
   };
 
   fetchedMavenDeps = stdenv.mkDerivation {
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
     dontFixup = true;
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
-    outputHash = "sha256-FdWQ+2U5bIXSASm3SaLjyQlaRc1AkYPpFJSP4PnCWJw=";
+    outputHash = "sha256-vNC+LmGEepZCepPodY3c783moReppqNw32d7AUuvBZc=";
   };
 
   nativeBuildInputs = [

From ee072f6b59fb3cf524944c702535bc59879a85e3 Mon Sep 17 00:00:00 2001
From: Johannes Arnold <johannes.arnold@stud.uni-hannover.de>
Date: Sun, 20 Jun 2021 23:37:44 +0200
Subject: [PATCH 283/416] vul: init at unstable-2020-02-15

---
 pkgs/applications/misc/vul/default.nix | 24 ++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix        |  2 ++
 2 files changed, 26 insertions(+)
 create mode 100644 pkgs/applications/misc/vul/default.nix

diff --git a/pkgs/applications/misc/vul/default.nix b/pkgs/applications/misc/vul/default.nix
new file mode 100644
index 000000000000..9acefa939427
--- /dev/null
+++ b/pkgs/applications/misc/vul/default.nix
@@ -0,0 +1,24 @@
+{ lib, stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "vul";
+  version = "unstable-2020-02-15";
+
+  src = fetchFromGitHub {
+    owner = "LukeSmithxyz";
+    repo = pname;
+    rev = "f6ebd8f6b6fb8a111e7b59470d6748fcbe71c559";
+    sha256 = "aUl4f82sGOWkEvTDNILDszj5hztDRvYpHVovFl4oOCc=";
+  };
+
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+  ];
+
+  meta = with lib; {
+    description = "Latin Vulgate Bible on the Command Line";
+    homepage = "https://github.com/LukeSmithxyz/vul";
+    license = licenses.publicDomain;
+    maintainers = [ maintainers.j0hax ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9da0e75c795a..8159b40a95b2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9820,6 +9820,8 @@ in
 
   unrar = callPackage ../tools/archivers/unrar { };
 
+  vul = callPackage ../applications/misc/vul { };
+
   xar = callPackage ../tools/compression/xar { };
 
   xarchive = callPackage ../tools/archivers/xarchive { };

From 4d046b12a9d1e6fc214efe20b5b6b106bef77c9d Mon Sep 17 00:00:00 2001
From: Francesco Gazzetta <fgaz@fgaz.me>
Date: Mon, 21 Jun 2021 12:09:48 +0200
Subject: [PATCH 284/416] pt2-clone: 1.29 -> 1.31

---
 pkgs/applications/audio/pt2-clone/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/audio/pt2-clone/default.nix b/pkgs/applications/audio/pt2-clone/default.nix
index 22b2a355b5e7..9092ae0b91fe 100644
--- a/pkgs/applications/audio/pt2-clone/default.nix
+++ b/pkgs/applications/audio/pt2-clone/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pt2-clone";
-  version = "1.29";
+  version = "1.31";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "pt2-clone";
     rev = "v${version}";
-    sha256 = "sha256-xnw4UL30nUv/Ru6x/7d05gC0X9nREMdXO9QWBjVoIvo=";
+    sha256 = "sha256-hIm9HWKBTFmxU9jI41PfScZIHpZOZpjvV2jgaMX/KSg=";
   };
 
   nativeBuildInputs = [ cmake ];

From 2afed01c61034841ea85a454c28ce5d0d03766bc Mon Sep 17 00:00:00 2001
From: Zack Grannan <zgrannan@protonmail.com>
Date: Mon, 21 Jun 2021 03:29:41 -0700
Subject: [PATCH 285/416] duply: 2.3 -> 2.3.1 (#127635)

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
---
 pkgs/tools/backup/duply/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/backup/duply/default.nix b/pkgs/tools/backup/duply/default.nix
index 82d6bd5c601f..49ac64529189 100644
--- a/pkgs/tools/backup/duply/default.nix
+++ b/pkgs/tools/backup/duply/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "duply";
-  version = "2.3";
+  version = "2.3.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/ftplicity/duply%20%28simple%20duplicity%29/2.3.x/duply_${version}.tgz";
-    sha256 = "sha256-I1KkblFnZVOCvcWEarGsSXnzlod2+yZ4okaTpckLFbE=";
+    sha256 = "149hb9bk7hm5h3aqf19k37d0i2jf0viaqmpq2997i48qp3agji7h";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 967beef69ff02a50d82df2ded75e46348fe14de9 Mon Sep 17 00:00:00 2001
From: OPNA2608 <christoph.neidahl@gmail.com>
Date: Sun, 13 Jun 2021 22:04:27 +0200
Subject: [PATCH 286/416] gspell: Enable building on Darwin

---
 .../gspell/0001-Darwin-build-fix.patch        | 37 +++++++++++++++++++
 pkgs/development/libraries/gspell/default.nix | 14 ++++++-
 2 files changed, 50 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/development/libraries/gspell/0001-Darwin-build-fix.patch

diff --git a/pkgs/development/libraries/gspell/0001-Darwin-build-fix.patch b/pkgs/development/libraries/gspell/0001-Darwin-build-fix.patch
new file mode 100644
index 000000000000..b2e71fe3aed1
--- /dev/null
+++ b/pkgs/development/libraries/gspell/0001-Darwin-build-fix.patch
@@ -0,0 +1,37 @@
+From 2d6dd1c286eb57fbf968510318cafc94888b98de Mon Sep 17 00:00:00 2001
+From: OPNA2608 <christoph.neidahl@gmail.com>
+Date: Sun, 13 Jun 2021 21:56:03 +0200
+Subject: [PATCH] Darwin build fix
+
+---
+ gspell/Makefile.am | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/gspell/Makefile.am b/gspell/Makefile.am
+index 69ee421..7c58973 100644
+--- a/gspell/Makefile.am
++++ b/gspell/Makefile.am
+@@ -95,6 +95,7 @@ nodist_libgspell_core_la_SOURCES = \
+ 	$(BUILT_SOURCES)
+ 
+ libgspell_core_la_LIBADD =	\
++	$(GTK_MAC_LIBS)           \
+ 	$(CODE_COVERAGE_LIBS)
+ 
+ libgspell_core_la_CFLAGS =			\
+@@ -161,6 +162,12 @@ gspell_private_headers += \
+ gspell_private_c_files += \
+ 	gspell-osx.c
+ 
++libgspell_core_la_CFLAGS += \
++	-xobjective-c
++
++libgspell_core_la_LDFLAGS += \
++	-framework Cocoa
++
+ endif # OS_OSX
+ 
+ if HAVE_INTROSPECTION
+-- 
+2.29.3
+
diff --git a/pkgs/development/libraries/gspell/default.nix b/pkgs/development/libraries/gspell/default.nix
index f591246eaf81..be45a48090ff 100644
--- a/pkgs/development/libraries/gspell/default.nix
+++ b/pkgs/development/libraries/gspell/default.nix
@@ -2,6 +2,8 @@
 , fetchurl
 , pkg-config
 , libxml2
+, autoreconfHook
+, gtk-doc
 , glib
 , gtk3
 , enchant2
@@ -9,6 +11,7 @@
 , vala
 , gobject-introspection
 , gnome
+, gtk-mac-integration
 }:
 
 stdenv.mkDerivation rec {
@@ -23,17 +26,26 @@ stdenv.mkDerivation rec {
     sha256 = "1pdb4gbjrs8mk6r0ipw5vxyvzav1wvkjq46kiq53r3nyznfpdfyw";
   };
 
+  patches = [
+    # Extracted from: https://github.com/Homebrew/homebrew-core/blob/2a27fb86b08afc7ae6dff79cf64aafb8ecc93275/Formula/gspell.rb#L125-L149
+    ./0001-Darwin-build-fix.patch
+  ];
+
   nativeBuildInputs = [
     pkg-config
     vala
     gobject-introspection
     libxml2
+    autoreconfHook
+    gtk-doc
   ];
 
   buildInputs = [
     glib
     gtk3
     icu
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    gtk-mac-integration
   ];
 
   propagatedBuildInputs = [
@@ -53,6 +65,6 @@ stdenv.mkDerivation rec {
     homepage = "https://wiki.gnome.org/Projects/gspell";
     license = licenses.lgpl21Plus;
     maintainers = teams.gnome.members;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }

From ce4900381420d881d3263d63572437e8138f0bf4 Mon Sep 17 00:00:00 2001
From: OPNA2608 <christoph.neidahl@gmail.com>
Date: Sun, 13 Jun 2021 22:05:13 +0200
Subject: [PATCH 287/416] gtksourceviewmm: Enable building on Darwin

---
 pkgs/development/libraries/gtksourceviewmm/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/gtksourceviewmm/default.nix b/pkgs/development/libraries/gtksourceviewmm/default.nix
index fc4439e223ee..2b9124032590 100644
--- a/pkgs/development/libraries/gtksourceviewmm/default.nix
+++ b/pkgs/development/libraries/gtksourceviewmm/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ glibmm gtkmm3 gtksourceview3 ];
 
   meta = with lib; {
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     homepage = "https://developer.gnome.org/gtksourceviewmm/";
     description = "C++ wrapper for gtksourceview";
     license = licenses.lgpl2;

From dad76cf9da17ba4e53ab41385a7d330a5204bf0e Mon Sep 17 00:00:00 2001
From: OPNA2608 <christoph.neidahl@gmail.com>
Date: Thu, 10 Jun 2021 21:44:42 +0200
Subject: [PATCH 288/416] cherrytree: 0.39.4 -> 0.99.37

---
 pkgs/applications/misc/cherrytree/default.nix | 55 ++++++++++++++-----
 .../misc/cherrytree/subprocess.patch          | 14 -----
 2 files changed, 42 insertions(+), 27 deletions(-)
 delete mode 100644 pkgs/applications/misc/cherrytree/subprocess.patch

diff --git a/pkgs/applications/misc/cherrytree/default.nix b/pkgs/applications/misc/cherrytree/default.nix
index 0ce89afa6cea..585f62178611 100644
--- a/pkgs/applications/misc/cherrytree/default.nix
+++ b/pkgs/applications/misc/cherrytree/default.nix
@@ -1,24 +1,52 @@
-{ lib, fetchFromGitHub, python2Packages, gettext }:
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, pkg-config
+, python3
+, wrapGAppsHook
+, gtkmm3
+, gtksourceview
+, gtksourceviewmm
+, gspell
+, libxmlxx
+, sqlite
+, curl
+, libuchardet
+, fmt
+, spdlog
+}:
 
-python2Packages.buildPythonApplication rec {
+stdenv.mkDerivation rec {
   pname = "cherrytree";
-  version = "0.39.4";
+  version = "0.99.37";
 
   src = fetchFromGitHub {
     owner = "giuspen";
     repo = "cherrytree";
     rev = version;
-    sha256 = "1wycgn1f3b858qb6kn2bsaabak8n52qkpd24w54xz6fjizlnw7x0";
-
+    sha256 = "1a2scwjrjijxwyfpqih23zzay3yqhyzpxnp66388fcir1cmp8zih";
   };
 
-  nativeBuildInputs = [ gettext ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    python3
+    wrapGAppsHook
+  ];
 
-  propagatedBuildInputs = with python2Packages; [ pygtk dbus-python pygtksourceview ];
-
-  patches = [ ./subprocess.patch ];
-
-  doCheck = false;
+  buildInputs = [
+    gtkmm3
+    gtksourceview
+    gtksourceviewmm
+    gspell
+    libxmlxx
+    sqlite
+    curl
+    libuchardet
+    fmt
+    spdlog
+  ];
 
   meta = with lib; {
     description = "An hierarchical note taking application";
@@ -31,8 +59,9 @@ python2Packages.buildPythonApplication rec {
       you have scattered around your hard drive can be conveniently placed into
       a Cherrytree document where you can easily find it.
     '';
-    homepage = "http://www.giuspen.com/cherrytree";
-    license = licenses.gpl3;
+    homepage = "https://www.giuspen.com/cherrytree";
+    changelog = "https://raw.githubusercontent.com/giuspen/cherrytree/${version}/changelog.txt";
+    license = licenses.gpl3Plus;
     maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/misc/cherrytree/subprocess.patch b/pkgs/applications/misc/cherrytree/subprocess.patch
deleted file mode 100644
index 1f80cde03b75..000000000000
--- a/pkgs/applications/misc/cherrytree/subprocess.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff -Naur cherrytree-0.37.1-orig/setup.py cherrytree-0.37.1/setup.py
---- cherrytree-0.37.1-orig/setup.py	2016-01-08 20:50:50.000000000 +0100
-+++ cherrytree-0.37.1/setup.py	2016-07-05 20:30:27.768178682 +0200
-@@ -205,4 +205,9 @@
-           },
-        distclass=CherryTreeDist
-     )
--    subprocess.call("update-desktop-database")
-+    try:
-+        subprocess.check_call(['update-desktop-database'])
-+    except subprocess.CalledProcessError:
-+        pass # handle errors in the called executable
-+    except OSError:
-+        pass # executable not found

From 44f27213f18b95a9a024841c22da5d7f0c6537f7 Mon Sep 17 00:00:00 2001
From: Ethan Edwards <ethan@ethancedwards.com>
Date: Mon, 21 Jun 2021 07:52:56 -0400
Subject: [PATCH 289/416] cobalt: init at 0.16.5 (#127624)

* cobalt: init at 0.16.5

* Update pkgs/applications/misc/cobalt/default.nix

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
---
 pkgs/applications/misc/cobalt/default.nix | 22 ++++++++++++++++++++++
 pkgs/top-level/all-packages.nix           |  2 ++
 2 files changed, 24 insertions(+)
 create mode 100644 pkgs/applications/misc/cobalt/default.nix

diff --git a/pkgs/applications/misc/cobalt/default.nix b/pkgs/applications/misc/cobalt/default.nix
new file mode 100644
index 000000000000..a9ccc6a8f870
--- /dev/null
+++ b/pkgs/applications/misc/cobalt/default.nix
@@ -0,0 +1,22 @@
+{ lib, stdenv, fetchFromGitHub, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cobalt";
+  version = "0.16.5";
+
+  src = fetchFromGitHub {
+    owner = "cobalt-org";
+    repo = "cobalt.rs";
+    rev = "v${version}";
+    sha256 = "wSvjPifnA8oc0vVmHBMdsMKzX7Gg6TdbPzIXl/SHqn8=";
+  };
+
+  cargoSha256 = "27LcoGBI4elt80uQkTwvToOyEmd2+/3ma5Y32OFrJaw=";
+
+  meta = with lib; {
+    description = "Static site generator written in Rust";
+    homepage = "https://github.com/cobalt-org/cobalt.rs/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ethancedwards8 ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 608dfdeabd0e..c8611619a9eb 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3846,6 +3846,8 @@ in
 
   cloud-utils = callPackage ../tools/misc/cloud-utils { };
 
+  cobalt = callPackage ../applications/misc/cobalt { };
+
   cocoapods = callPackage ../development/mobile/cocoapods { };
 
   cocoapods-beta = lowPrio (callPackage ../development/mobile/cocoapods { beta = true; });

From 4d66930f13656cada9f326299ed45c5df3522d28 Mon Sep 17 00:00:00 2001
From: Peter Hoeg <peter@hoeg.com>
Date: Mon, 21 Jun 2021 19:53:18 +0800
Subject: [PATCH 290/416] gemrb: 0.8.7 -> 0.9.0 (#127631)

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
---
 pkgs/games/gemrb/default.nix | 66 ++++++++++++++++++++++++++++--------
 1 file changed, 52 insertions(+), 14 deletions(-)

diff --git a/pkgs/games/gemrb/default.nix b/pkgs/games/gemrb/default.nix
index 9c5744f7291a..77c9c7adaf9f 100644
--- a/pkgs/games/gemrb/default.nix
+++ b/pkgs/games/gemrb/default.nix
@@ -1,32 +1,71 @@
-{ lib, stdenv, fetchFromGitHub, cmake
-, freetype, SDL2, SDL2_mixer, openal, zlib, libpng, python2, libvorbis
-, libiconv }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, SDL2
+, SDL2_mixer
+, freetype
+, libGL
+, libiconv
+, libpng
+, libvlc
+, libvorbis
+, openal
+, python2 # 0.9.0 crashes after character generation with py3, so stick to py2 for now
+, zlib
+}:
 
+let
+  # the GLES backend on rpi is untested as I don't have the hardware
+  backend =
+    if (stdenv.isx86_32 || stdenv.isx86_64) then "OpenGL" else "GLES";
+
+in
 stdenv.mkDerivation rec {
   pname = "gemrb";
-  version = "0.8.7";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "gemrb";
     repo = "gemrb";
     rev = "v${version}";
-    sha256 = "14j9mhrbi4gnrbv25nlsvcxzkylijzrnwbqqnrg7pr452lb3srpb";
+    sha256 = "sha256-h/dNPY0QZ2m7aYgRla3r1E8APJqO99ePa2ABhhh3Aoc=";
   };
 
-  # TODO: make libpng, libvorbis, sdl_mixer, freetype, vlc, glew (and other gl
-  # reqs) optional
-  buildInputs = [ freetype python2 openal SDL2 SDL2_mixer zlib libpng libvorbis libiconv ];
+  buildInputs = [
+    SDL2
+    SDL2_mixer
+    freetype
+    libGL
+    libiconv
+    libpng
+    libvlc
+    libvorbis
+    openal
+    python2
+    zlib
+  ];
 
   nativeBuildInputs = [ cmake ];
 
-  # TODO: add proper OpenGL support. We are currently (0.8.7) getting a shader
-  # error on execution when enabled.
+  LIBVLC_INCLUDE_PATH = "${lib.getDev libvlc}/include";
+  LIBVLC_LIBRARY_PATH = "${lib.getLib libvlc}/lib";
+
   cmakeFlags = [
+    # use the Mesa drivers for video on ARM (harmless on x86)
+    "-DDISABLE_VIDEOCORE=ON"
     "-DLAYOUT=opt"
-    # "-DOPENGL_BACKEND=GLES"
-    # "-DOpenGL_GL_PREFERENCE=GLVND"
+    "-DOPENGL_BACKEND=${backend}"
+    "-DOpenGL_GL_PREFERENCE=GLVND"
   ];
 
+  postInstall = ''
+    for s in 36 48 72 96 144; do
+      install -Dm444 ../artwork/gemrb-logo-glow-''${s}px.png $out/share/icons/hicolor/''${s}x''${s}/gemrb.png
+    done
+    install -Dm444 ../artwork/gemrb-logo.png $out/share/icons/gemrb.png
+  '';
+
   meta = with lib; {
     description = "A reimplementation of the Infinity Engine, used by games such as Baldur's Gate";
     longDescription = ''
@@ -36,8 +75,7 @@ stdenv.mkDerivation rec {
       ruleset (Baldur's Gate and Icewind Dale series, Planescape: Torment).
     '';
     homepage = "https://gemrb.org/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     maintainers = with maintainers; [ peterhoeg ];
-    platforms = platforms.all;
   };
 }

From 2250baba4ef01777ac7a951f809cfaf38e697ec5 Mon Sep 17 00:00:00 2001
From: SCOTT-HAMILTON <sgn.hamilton+github@protonmail.com>
Date: Mon, 21 Jun 2021 14:07:53 +0200
Subject: [PATCH 291/416] wasmer interpreter: 1.0.2 -> 2.0.0

---
 pkgs/development/interpreters/wasmer/default.nix | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/interpreters/wasmer/default.nix b/pkgs/development/interpreters/wasmer/default.nix
index d19600f39b85..4dcb70bd3ec7 100644
--- a/pkgs/development/interpreters/wasmer/default.nix
+++ b/pkgs/development/interpreters/wasmer/default.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasmer";
-  version = "1.0.2";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "wasmerio";
     repo = pname;
     rev = version;
-    sha256 = "0ciia8hhkkyh6rmrxgbk3bgwjwzkcba6645wlcm0vlgk2w4i5m3z";
+    sha256 = "191f60db2y1f3xw1x81mw88vclf1c4kgvnfv74g5vb3vn7n57c5j";
     fetchSubmodules = true;
   };
 
-  cargoSha256 = "140bzxhsyfif99x5a1m1d45ppb6jzvy9m4xil7z1wg2pnq9k7zz8";
+  cargoSha256 = "0hhwixqhrl79hpzmvq7ga3kp2cfrwr4i8364cwnr7195xwnfxb0k";
 
   nativeBuildInputs = [ cmake pkg-config ];
 
@@ -32,7 +32,9 @@ rustPlatform.buildRustPackage rec {
   ];
 
   cargoTestFlags = [
-    "--features" "test-cranelift,test-jit"
+    "--features" "test-cranelift"
+    # Can't use test-jit :
+    # error: Package `wasmer-workspace v2.0.0 (/build/source)` does not have the feature `test-jit`
   ];
 
   LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
@@ -47,6 +49,6 @@ rustPlatform.buildRustPackage rec {
     '';
     homepage = "https://wasmer.io/";
     license = licenses.mit;
-    maintainers = with maintainers; [ Br1ght0ne ];
+    maintainers = with maintainers; [ Br1ght0ne shamilton ];
   };
 }

From 115e5250cbf976452e4f68da5799c02b724b2a3d Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 21 Jun 2021 14:26:15 +0200
Subject: [PATCH 292/416] python3Packages.sendgrid: 6.7.0 -> 6.7.1

---
 pkgs/development/python-modules/sendgrid/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/sendgrid/default.nix b/pkgs/development/python-modules/sendgrid/default.nix
index 911983691013..34ef2355905a 100644
--- a/pkgs/development/python-modules/sendgrid/default.nix
+++ b/pkgs/development/python-modules/sendgrid/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "sendgrid";
-  version = "6.7.0";
+  version = "6.7.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = "sendgrid-python";
     rev = version;
-    sha256 = "sha256-Y0h5Aiu85/EWCmSc+eCtK6ZaPuu/LYZiwhXOx0XhfwQ=";
+    sha256 = "0g9yifv3p3zbcxbcdyg4p9k3vwvaq0vym40j3yrv534m4qbynwhk";
   };
 
   propagatedBuildInputs = [

From 02acc0af3ae33ba6464072717719131d39b61194 Mon Sep 17 00:00:00 2001
From: Ilan Joselevich <personal@ilanjoselevich.com>
Date: Mon, 21 Jun 2021 15:30:48 +0300
Subject: [PATCH 293/416] solaar: 1.0.5 -> 1.0.6

---
 pkgs/applications/misc/solaar/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/misc/solaar/default.nix b/pkgs/applications/misc/solaar/default.nix
index bb1573f74c54..b6059ac1a71b 100644
--- a/pkgs/applications/misc/solaar/default.nix
+++ b/pkgs/applications/misc/solaar/default.nix
@@ -4,13 +4,13 @@
 # logitech-udev-rules instead of adding this to services.udev.packages on NixOS
 python3Packages.buildPythonApplication rec {
   pname = "solaar";
-  version = "1.0.5";
+  version = "1.0.6";
 
   src = fetchFromGitHub {
     owner = "pwr-Solaar";
     repo = "Solaar";
     rev = version;
-    sha256 = "sha256-k87DqIkvy5CVEsHT82ZArSM2JBi5sYdSCPfP4KjI850=";
+    sha256 = "sha256-Ys0005hIQ+fT4oMeU5iFtbLNqn1WM6iLdIKGwdyn7BM=";
   };
 
   propagatedBuildInputs = with python3Packages; [

From 5341c6f548e8a6758eadeb6412398990cc9c0df7 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Mon, 21 Jun 2021 07:19:41 +0300
Subject: [PATCH 294/416] wine{Unstable,Staging}: 6.10 -> 6.11

---
 pkgs/misc/emulators/wine/sources.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/misc/emulators/wine/sources.nix b/pkgs/misc/emulators/wine/sources.nix
index eab7cfe7a907..72a5240dfc6e 100644
--- a/pkgs/misc/emulators/wine/sources.nix
+++ b/pkgs/misc/emulators/wine/sources.nix
@@ -44,9 +44,9 @@ in rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the SHA256 for staging as well.
-    version = "6.10";
+    version = "6.11";
     url = "https://dl.winehq.org/wine/source/6.x/wine-${version}.tar.xz";
-    sha256 = "sha256-WO3hSEgtSRiCYtWi0MnXAKdMacUcyqEcWt9j0/MUQZ8=";
+    sha256 = "02v725qjsibiv6ad6hxsc6199dvlmnp7983286a4k8rygqnvqln9";
     inherit (stable) gecko32 gecko64;
 
     ## see http://wiki.winehq.org/Mono
@@ -65,7 +65,7 @@ in rec {
   staging = fetchFromGitHub rec {
     # https://github.com/wine-staging/wine-staging/releases
     inherit (unstable) version;
-    sha256 = "sha256-nqXgJe2i1xDW1aCAmwFPshiUI2PtZ/S7p8Cq2ODMTQk=";
+    sha256 = "0gbci8fjvl1bdz7fj4bh25mqrgi1i04q5na2ckv9hj9nh9x7crbm";
     owner = "wine-staging";
     repo = "wine-staging";
     rev = "v${version}";

From 63a65bdca5032f735163ec1358476bce0f905acb Mon Sep 17 00:00:00 2001
From: Johannes Schleifenbaum <johannes@js-webcoding.de>
Date: Mon, 21 Jun 2021 14:55:42 +0200
Subject: [PATCH 295/416] nzbhydra2: 3.14.1 -> 3.14.2

---
 pkgs/servers/nzbhydra2/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/nzbhydra2/default.nix b/pkgs/servers/nzbhydra2/default.nix
index 12d2c0b7070e..375224dfdc28 100644
--- a/pkgs/servers/nzbhydra2/default.nix
+++ b/pkgs/servers/nzbhydra2/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nzbhydra2";
-  version = "3.14.1";
+  version = "3.14.2";
 
   src = fetchzip {
     url = "https://github.com/theotherp/${pname}/releases/download/v${version}/${pname}-${version}-linux.zip";
-    sha512 = "2mfrqqwrfjvr48vm4r0spda3vlg1h511r6hrlv7k9233ps97bjjir6hms82lgqnlirsixayxs47cldjy8amdn3vc6kxsifmbd6a924p";
+    sha512 = "sha512-wC2GhCjkRt/rmLAhe6nDCdF4PsfBpOo0T4BOSdw4wlBr7eCfo4Cibt9VvK6DNLuDk7EGkUfxvw9HI9sbRJlpCw==";
     stripRoot = false;
   };
 

From f845709e9ee8f67af49406b8d3d3c720727cd55b Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Mon, 21 Jun 2021 05:38:44 +0300
Subject: [PATCH 296/416] mercurial: use working patch links

---
 pkgs/applications/version-management/mercurial/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
index 3caf499d31ac..df58b2162fc1 100644
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@@ -20,12 +20,12 @@ in python3Packages.buildPythonApplication rec {
   patches = [
     # https://phab.mercurial-scm.org/D10638, needed for below patch to apply
     (fetchpatch {
-      url = "https://phab.mercurial-scm.org/file/data/oymk4awh2dd7q6cwjbzu/PHID-FILE-bfcr7qrp5spg42wspxpd/D10638.diff";
+      url = "https://phab.mercurial-scm.org/file/data/l7p2r4zcctcr3pzlybv2/PHID-FILE-bwjzxlz6sbegk3s4irik/D10638.diff";
       sha256 = "0mfi324is02l7cnd3j0gbmg5rpyyqn3afg3f73flnfwmz5njqa5f";
     })
     # https://phab.mercurial-scm.org/D10639, fixes https://bz.mercurial-scm.org/show_bug.cgi?id=6514
     (fetchpatch {
-      url = "https://phab.mercurial-scm.org/file/data/re4uqdhtknjiacx2ogwu/PHID-FILE-4m26id65dno5gzix2ngh/D10639.diff";
+      url = "https://phab.mercurial-scm.org/file/data/v53nhburhtkhpccyecei/PHID-FILE-6v34oll6r2gkqo4ng5nt/D10639.diff";
       sha256 = "0h5ilrd2x1789fr6sf4k1mcvxdh0xdyr94yawdacw87v3x12c8cb";
     })
   ];

From 7618e16c33daf7eb22737740c4a8838e96897c40 Mon Sep 17 00:00:00 2001
From: Johannes Schleifenbaum <johannes@js-webcoding.de>
Date: Mon, 21 Jun 2021 14:57:13 +0200
Subject: [PATCH 297/416] radarr: 3.2.1.5070 -> 3.2.2.5080

---
 pkgs/servers/radarr/default.nix | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/pkgs/servers/radarr/default.nix b/pkgs/servers/radarr/default.nix
index f56766d9b638..dd2480de2e66 100644
--- a/pkgs/servers/radarr/default.nix
+++ b/pkgs/servers/radarr/default.nix
@@ -9,14 +9,14 @@ let
   }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   hash = {
-    x64-linux_hash = "sha256-/9W8VwA3d7R2pYH45QvGC1q9f9M9C867nKuhSlU6zsg=";
-    arm64-linux_hash = "sha256-QjIg+XY5vTmYH+wYqU3VZ5MfxSAcUcGVvapyrlMDbLI=";
-    x64-osx_hash = "sha256-K17tzGdLKpHkkLSOT3a4FXXfeGz6LJ6cxd20IuJ2zVs=";
+    x64-linux_hash = "sha256-IwD7PFRz6mjEjUTbpqItorvFMB/hcMcRhHG8XQHv0iM=";
+    arm64-linux_hash = "sha256-9Ou08PI3HNQO6Da76ZMkzx1QlU+oaq9Tr+vqPT05xnw=";
+    x64-osx_hash = "sha256-Nfm9vWB+ii2ZST6I4I8Y2PuG2a1qY7rbki57y88Ft8A=";
   }."${arch}-${os}_hash";
 
 in stdenv.mkDerivation rec {
   pname = "radarr";
-  version = "3.2.1.5070";
+  version = "3.2.2.5080";
 
   src = fetchurl {
     url = "https://github.com/Radarr/Radarr/releases/download/v${version}/Radarr.master.${version}.${os}-core-${arch}.tar.gz";
@@ -26,6 +26,8 @@ in stdenv.mkDerivation rec {
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/{bin,share/${pname}-${version}}
     cp -r * $out/share/${pname}-${version}/.
 
@@ -33,6 +35,8 @@ in stdenv.mkDerivation rec {
       --add-flags "$out/share/${pname}-${version}/Radarr.dll" \
       --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [
         curl sqlite libmediainfo mono openssl icu ]}
+
+    runHook postInstall
   '';
 
   passthru = {

From f6be741dca1b16250befbd71088d4445fd35e09a Mon Sep 17 00:00:00 2001
From: Johannes Schleifenbaum <johannes@js-webcoding.de>
Date: Mon, 21 Jun 2021 14:58:07 +0200
Subject: [PATCH 298/416] sonarr: 3.0.6.1196 -> 3.0.6.1266

---
 pkgs/servers/sonarr/default.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sonarr/default.nix b/pkgs/servers/sonarr/default.nix
index 2ffbbb270237..49a176e0086a 100644
--- a/pkgs/servers/sonarr/default.nix
+++ b/pkgs/servers/sonarr/default.nix
@@ -2,22 +2,26 @@
 
 stdenv.mkDerivation rec {
   pname = "sonarr";
-  version = "3.0.6.1196";
+  version = "3.0.6.1266";
 
   src = fetchurl {
     url = "https://download.sonarr.tv/v3/main/${version}/Sonarr.main.${version}.linux.tar.gz";
-    sha256 = "10fm5s1ayjmj0ip5510rb0nfh08gdaxin0xf2f3qw1z5kxys88fm";
+    sha256 = "2YkzmPxJLYClNQnGgheXI8y42ZXAHZUqEpmQ+b2mpfY=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/bin
     cp -r * $out/bin/
     makeWrapper "${mono}/bin/mono" $out/bin/NzbDrone \
       --add-flags "$out/bin/Sonarr.exe" \
       --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [
           curl sqlite libmediainfo ]}
+
+    runHook postInstall
   '';
 
   passthru = {

From 075fb19d81f4da81943f4127eba632b46368022f Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Mon, 21 Jun 2021 15:18:02 +0200
Subject: [PATCH 299/416] dovecot: 2.3.14 -> 2.3.15

---
 pkgs/servers/mail/dovecot/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/mail/dovecot/default.nix b/pkgs/servers/mail/dovecot/default.nix
index 337405ff6729..26290368e15e 100644
--- a/pkgs/servers/mail/dovecot/default.nix
+++ b/pkgs/servers/mail/dovecot/default.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation rec {
   pname = "dovecot";
-  version = "2.3.14";
+  version = "2.3.15";
 
   nativeBuildInputs = [ perl pkg-config ];
   buildInputs =
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://dovecot.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.gz";
-    sha256 = "0jm3p52z619v7ajh533g2g7d790k82fk0w7ry0zqlm8ymzrxgcy8";
+    sha256 = "141manrh54cy8xizr7f8fsa3vdzc2ccfgdz87l9rjylm8mfxvfr1";
   };
 
   enableParallelBuilding = true;

From 0fb5b6c648e14b61c3304266561c366f869af836 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Mon, 21 Jun 2021 15:18:52 +0200
Subject: [PATCH 300/416] dovecot: add licenses

---
 pkgs/servers/mail/dovecot/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/mail/dovecot/default.nix b/pkgs/servers/mail/dovecot/default.nix
index 26290368e15e..f58d65d9f16e 100644
--- a/pkgs/servers/mail/dovecot/default.nix
+++ b/pkgs/servers/mail/dovecot/default.nix
@@ -81,11 +81,12 @@ stdenv.mkDerivation rec {
     ++ lib.optional withPgSQL "--with-pgsql"
     ++ lib.optional withSQLite "--with-sqlite";
 
-  meta = {
+  meta = with lib; {
     homepage = "https://dovecot.org/";
     description = "Open source IMAP and POP3 email server written with security primarily in mind";
-    maintainers = with lib.maintainers; [ peti fpletz globin ajs124 ];
-    platforms = lib.platforms.unix;
+    license = with licenses; [ mit publicDomain lgpl21Only bsd3 bsdOriginal ];
+    maintainers = with maintainers; [ peti fpletz globin ajs124 ];
+    platforms = platforms.unix;
   };
   passthru.tests = {
     opensmtpd-interaction = nixosTests.opensmtpd;

From 0187e72b571e3afc3e761d101deadf15b6c5b760 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Mon, 21 Jun 2021 15:19:19 +0200
Subject: [PATCH 301/416] dovecot_pigeonhole: 0.5.14 -> 0.5.15

---
 pkgs/servers/mail/dovecot/plugins/pigeonhole/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/mail/dovecot/plugins/pigeonhole/default.nix b/pkgs/servers/mail/dovecot/plugins/pigeonhole/default.nix
index 6cdb2ee06f20..d86eee5a9c01 100644
--- a/pkgs/servers/mail/dovecot/plugins/pigeonhole/default.nix
+++ b/pkgs/servers/mail/dovecot/plugins/pigeonhole/default.nix
@@ -3,11 +3,11 @@ let
   dovecotMajorMinor = lib.versions.majorMinor dovecot.version;
 in stdenv.mkDerivation rec {
   pname = "dovecot-pigeonhole";
-  version = "0.5.14";
+  version = "0.5.15";
 
   src = fetchurl {
     url = "https://pigeonhole.dovecot.org/releases/${dovecotMajorMinor}/dovecot-${dovecotMajorMinor}-pigeonhole-${version}.tar.gz";
-    sha256 = "1lmjzz4kd90wbdslacybizd1dks4bhwmrx39lj8b19naldw0zjk8";
+    sha256 = "1l2h0p8ddsl3ja2lnwk0mfqplqh8n0iw8k27awd3ak7prr88yjg1";
   };
 
   buildInputs = [ dovecot openssl ];

From fd83b193ac343e69980978a1e4abb7a0f1a8ff5a Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Mon, 21 Jun 2021 15:19:32 +0200
Subject: [PATCH 302/416] dovecot_pigeonhole: add myself as maintainer

and fix licensing information
---
 pkgs/servers/mail/dovecot/plugins/pigeonhole/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/mail/dovecot/plugins/pigeonhole/default.nix b/pkgs/servers/mail/dovecot/plugins/pigeonhole/default.nix
index d86eee5a9c01..33c66a46bb72 100644
--- a/pkgs/servers/mail/dovecot/plugins/pigeonhole/default.nix
+++ b/pkgs/servers/mail/dovecot/plugins/pigeonhole/default.nix
@@ -32,8 +32,8 @@ in stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "http://pigeonhole.dovecot.org/";
     description = "A sieve plugin for the Dovecot IMAP server";
-    license = licenses.lgpl21;
-    maintainers = with maintainers; [ globin ];
+    license = licenses.lgpl21Only;
+    maintainers = with maintainers; [ globin ajs124 ];
     platforms = platforms.unix;
   };
 }

From 76fbf5eaadf51487e49c13b14ea7c32b99f1c622 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 21 Jun 2021 15:26:58 +0200
Subject: [PATCH 303/416] python3Packages.abodepy: 1.2.1 -> 1.2.2

---
 pkgs/development/python-modules/abodepy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/abodepy/default.nix b/pkgs/development/python-modules/abodepy/default.nix
index e6ad75eb3896..47fc6148ed24 100644
--- a/pkgs/development/python-modules/abodepy/default.nix
+++ b/pkgs/development/python-modules/abodepy/default.nix
@@ -3,7 +3,7 @@
 
 buildPythonPackage rec {
   pname = "abodepy";
-  version = "1.2.1";
+  version = "1.2.2";
 
   disabled = !isPy3k;
 
@@ -11,7 +11,7 @@ buildPythonPackage rec {
     owner = "MisterWil";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0n8gczsml6y6anin1zi8j33sjk1bv9ka02zxpksn2fi1v1h0smap";
+    sha256 = "sha256-GrvNCgWGGBbUUONwS18csh4/A0MMkSk5Z6LlDhlQqok=";
   };
 
   propagatedBuildInputs = [ colorlog lomond requests ];

From 1deeae4179d6ea473f50b406c8e1d24b1d6ceb6e Mon Sep 17 00:00:00 2001
From: Francesco Gazzetta <fgaz@fgaz.me>
Date: Mon, 21 Jun 2021 15:32:51 +0200
Subject: [PATCH 304/416] lobster: unstable-2020-12-25 -> unstable-2021-06-18

---
 pkgs/development/compilers/lobster/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/compilers/lobster/default.nix b/pkgs/development/compilers/lobster/default.nix
index 59e853f4c7e9..34b45f49ec67 100644
--- a/pkgs/development/compilers/lobster/default.nix
+++ b/pkgs/development/compilers/lobster/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lobster";
-  version = "unstable-2020-12-25";
+  version = "unstable-2021-06-18";
 
   src = fetchFromGitHub {
     owner = "aardappel";
     repo = pname;
-    rev = "70e44d475995b03363dedf9c2bcb817b0db8fdcf";
-    sha256 = "0azhminzrkbpvkapass1kccd6123bg7qmcbnzr5774n6bz5365g3";
+    rev = "a785316e44b1690da56a3646f90971a72f470a49";
+    sha256 = "eY/8mhJ4SUH5QYWqykl0u+8W7AU0FVVya3GNTEUSOP4=";
   };
 
   nativeBuildInputs = [ cmake ];

From 668f48df5a553218b1a2d128757d3a2922673e1b Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 21 Jun 2021 15:34:25 +0200
Subject: [PATCH 305/416] python3Packages.millheater: 0.4.1 -> 0.4.2

---
 pkgs/development/python-modules/millheater/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/millheater/default.nix b/pkgs/development/python-modules/millheater/default.nix
index 7639de14a670..d6815f53d779 100644
--- a/pkgs/development/python-modules/millheater/default.nix
+++ b/pkgs/development/python-modules/millheater/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "millheater";
-  version = "0.4.1";
+  version = "0.4.2";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "Danielhiversen";
     repo = "pymill";
     rev = version;
-    sha256 = "0dypv4xwdqcv45aibfkik2slm9r8y7pd2gwqa49kn96f40kdfwb0";
+    sha256 = "sha256-B9/nxlPHAPZzbOMQj81CxTEjI03JQxfH8F8vy1E4HIQ=";
   };
 
   propagatedBuildInputs = [

From 69c7472cd37eb14ae64717ddc26e9c78a75ecbc0 Mon Sep 17 00:00:00 2001
From: Francesco Gazzetta <fgaz@fgaz.me>
Date: Mon, 21 Jun 2021 15:35:09 +0200
Subject: [PATCH 306/416] cht-sh: unstable-2021-01-31 -> unstable-2021-04-25

---
 pkgs/tools/misc/cht.sh/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/misc/cht.sh/default.nix b/pkgs/tools/misc/cht.sh/default.nix
index 67249d76454b..998fcf366520 100644
--- a/pkgs/tools/misc/cht.sh/default.nix
+++ b/pkgs/tools/misc/cht.sh/default.nix
@@ -10,15 +10,15 @@
 
 stdenv.mkDerivation {
   pname = "cht.sh";
-  version = "unstable-2021-01-31";
+  version = "unstable-2021-04-25";
 
   nativeBuildInputs = [ makeWrapper ];
 
   src = fetchFromGitHub {
     owner = "chubin";
     repo = "cheat.sh";
-    rev = "01e579176981356fb90d4aa58fea2d6c273a45a5";
-    sha256 = "0d98v67ajsc80i962myh0j4ph7bn3csk8y9jf8b5rfqd1zg737hb";
+    rev = "6d83c4d76c82a87cf6df436a5ab73e3b7c819e66";
+    sha256 = "dXLNPhkfbQIhFZixC674Fcegyo8+Um7E6cm56vMpCYI=";
   };
 
   # Fix ".cht.sh-wrapped" in the help message

From 4b8b7840cfcc3479d143cc8dbe0bf1499bf9919e Mon Sep 17 00:00:00 2001
From: Francesco Gazzetta <fgaz@fgaz.me>
Date: Mon, 21 Jun 2021 15:52:48 +0200
Subject: [PATCH 307/416] qbe: unstable-2020-10-05 -> unstable-2021-06-17

---
 pkgs/development/compilers/qbe/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/compilers/qbe/default.nix b/pkgs/development/compilers/qbe/default.nix
index b4bc2a35a55d..39241f5ee535 100644
--- a/pkgs/development/compilers/qbe/default.nix
+++ b/pkgs/development/compilers/qbe/default.nix
@@ -5,12 +5,12 @@
 
 stdenv.mkDerivation rec {
   pname = "qbe";
-  version = "unstable-2020-10-05";
+  version = "unstable-2021-06-17";
 
   src = fetchgit {
     url = "git://c9x.me/qbe.git";
-    rev = "496c069405cd79aed968f59dd5a5f92d1f96809f";
-    sha256 = "1vpszl77j9mnw8r0p9l23k8nxbnz31lgii7v3mai130nbpjsjsdf";
+    rev = "6d9ee1389572ae985f6a39bb99dbd10cdf42c123";
+    sha256 = "NaURS5Eu8NBd92wGQcyFEXCALU9Z93nNQeZ8afq4KMw=";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];

From 72419d8ee07c80a17f077c2714f859ef06b4e459 Mon Sep 17 00:00:00 2001
From: Francesco Gazzetta <fgaz@fgaz.me>
Date: Mon, 21 Jun 2021 15:53:14 +0200
Subject: [PATCH 308/416] qbe: add hello world test

---
 pkgs/development/compilers/qbe/default.nix    |  6 +++-
 .../qbe/test-can-run-hello-world.nix          | 32 +++++++++++++++++++
 2 files changed, 37 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/development/compilers/qbe/test-can-run-hello-world.nix

diff --git a/pkgs/development/compilers/qbe/default.nix b/pkgs/development/compilers/qbe/default.nix
index 39241f5ee535..35367b3b2efe 100644
--- a/pkgs/development/compilers/qbe/default.nix
+++ b/pkgs/development/compilers/qbe/default.nix
@@ -1,6 +1,7 @@
 { lib, stdenv
 , fetchgit
 , unstableGitUpdater
+, callPackage
 }:
 
 stdenv.mkDerivation rec {
@@ -15,7 +16,10 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
-  passthru.updateScript = unstableGitUpdater { };
+  passthru = {
+    tests.can-run-hello-world = callPackage ./test-can-run-hello-world.nix {};
+    updateScript = unstableGitUpdater { };
+  };
 
   meta = with lib; {
     homepage = "https://c9x.me/compile/";
diff --git a/pkgs/development/compilers/qbe/test-can-run-hello-world.nix b/pkgs/development/compilers/qbe/test-can-run-hello-world.nix
new file mode 100644
index 000000000000..5192bb881f34
--- /dev/null
+++ b/pkgs/development/compilers/qbe/test-can-run-hello-world.nix
@@ -0,0 +1,32 @@
+{ stdenv
+, writeText
+, qbe
+}:
+
+# The hello world program available at https://c9x.me/compile/
+let helloWorld = writeText "hello-world.ssa" ''
+  function w $add(w %a, w %b) {        # Define a function add
+  @start
+    %c =w add %a, %b                   # Adds the 2 arguments
+    ret %c                             # Return the result
+  }
+  export function w $main() {          # Main function
+  @start
+    %r =w call $add(w 1, w 1)          # Call add(1, 1)
+    call $printf(l $fmt, w %r, ...)    # Show the result
+    ret 0
+  }
+  data $fmt = { b "One and one make %d!\n", b 0 }
+'';
+
+in stdenv.mkDerivation {
+  name = "qbe-test-can-run-hello-world";
+  meta.timeout = 10;
+  buildCommand = ''
+    ${qbe}/bin/qbe -o asm.s ${helloWorld}
+    cc -o out asm.s
+    ./out | grep 'One and one make 2!'
+    touch $out
+  '';
+}
+

From d2a8d3c6231b887662216fba4d4356387d576218 Mon Sep 17 00:00:00 2001
From: Francesco Gazzetta <fgaz@fgaz.me>
Date: Mon, 21 Jun 2021 15:55:50 +0200
Subject: [PATCH 309/416] qbe: enable tests

---
 pkgs/development/compilers/qbe/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/compilers/qbe/default.nix b/pkgs/development/compilers/qbe/default.nix
index 35367b3b2efe..e2e0c92a162d 100644
--- a/pkgs/development/compilers/qbe/default.nix
+++ b/pkgs/development/compilers/qbe/default.nix
@@ -16,6 +16,8 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
+  doCheck = true;
+
   passthru = {
     tests.can-run-hello-world = callPackage ./test-can-run-hello-world.nix {};
     updateScript = unstableGitUpdater { };

From 0d9496f7be3967ef64b8aebff19e6b9c7eaf6e32 Mon Sep 17 00:00:00 2001
From: Kim Lindberger <kim.lindberger@gmail.com>
Date: Mon, 21 Jun 2021 16:04:01 +0200
Subject: [PATCH 310/416] Revert "php/generic: Allow to extend
 PHP_INI_SCAN_DIR"

---
 pkgs/development/interpreters/php/generic.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/interpreters/php/generic.nix b/pkgs/development/interpreters/php/generic.nix
index d86ea48afe1a..558fa45a1fd9 100644
--- a/pkgs/development/interpreters/php/generic.nix
+++ b/pkgs/development/interpreters/php/generic.nix
@@ -124,15 +124,15 @@ let
                 ln -s ${extraInit} $out/lib/php.ini
 
                 if test -e $out/bin/php; then
-                  wrapProgram $out/bin/php --prefix PHP_INI_SCAN_DIR : $out/lib
+                  wrapProgram $out/bin/php --set PHP_INI_SCAN_DIR $out/lib
                 fi
 
                 if test -e $out/bin/php-fpm; then
-                  wrapProgram $out/bin/php-fpm --prefix PHP_INI_SCAN_DIR : $out/lib
+                  wrapProgram $out/bin/php-fpm --set PHP_INI_SCAN_DIR $out/lib
                 fi
 
                 if test -e $out/bin/phpdbg; then
-                  wrapProgram $out/bin/phpdbg --prefix PHP_INI_SCAN_DIR : $out/lib
+                  wrapProgram $out/bin/phpdbg --set PHP_INI_SCAN_DIR $out/lib
                 fi
               '';
             };

From 5fa6e9c403940c7c641356daf9c7ac05e464f58f Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Mon, 21 Jun 2021 16:21:41 +0200
Subject: [PATCH 311/416] dovecout: fix systemd unit dir

the configure flag we were using was dropped in
https://github.com/dovecot/core/commit/a42bb363b4ab475ced72fada57cc3e1de8b05bca
---
 pkgs/servers/mail/dovecot/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/mail/dovecot/default.nix b/pkgs/servers/mail/dovecot/default.nix
index f58d65d9f16e..d5fb9e7ed6ee 100644
--- a/pkgs/servers/mail/dovecot/default.nix
+++ b/pkgs/servers/mail/dovecot/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
 
   preConfigure = ''
     patchShebangs src/config/settings-get.pl
-  '';
+  '' + lib.optionalString (stdenv.isLinux) "export systemdsystemunitdir=$out/etc/systemd/system";
 
   # We need this for sysconfdir, see remark below.
   installFlags = [ "DESTDIR=$(out)" ];
@@ -75,8 +75,8 @@ stdenv.mkDerivation rec {
     "lib_cv_va_copy=yes"
     "lib_cv___va_copy=yes"
     "lib_cv_va_val_copy=yes"
-  ] ++ lib.optional (stdenv.isLinux) "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
-    ++ lib.optional (stdenv.isDarwin) "--enable-static"
+  ] ++ lib.optional stdenv.isLinux "--with-systemd"
+    ++ lib.optional stdenv.isDarwin "--enable-static"
     ++ lib.optional withMySQL "--with-mysql"
     ++ lib.optional withPgSQL "--with-pgsql"
     ++ lib.optional withSQLite "--with-sqlite";

From debcb41787e934e393b1cae210e4e9590d943e38 Mon Sep 17 00:00:00 2001
From: Mrinal Purohit <github@mrinalpurohit.in>
Date: Mon, 21 Jun 2021 19:56:04 +0530
Subject: [PATCH 312/416] google-cloud-sdk: 344.0.0 -> 345.0.0

---
 pkgs/tools/admin/google-cloud-sdk/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/admin/google-cloud-sdk/default.nix b/pkgs/tools/admin/google-cloud-sdk/default.nix
index e8bd99a13d52..d5e8897af9b8 100644
--- a/pkgs/tools/admin/google-cloud-sdk/default.nix
+++ b/pkgs/tools/admin/google-cloud-sdk/default.nix
@@ -21,18 +21,18 @@ let
   sources = name: system: {
     x86_64-darwin = {
       url = "${baseUrl}/${name}-darwin-x86_64.tar.gz";
-      sha256 = "0xhy2sa04ir5ncjnnx25nyf66k21w3f649smhfpz9973s7vk5vhg";
+      sha256 = "1p8iv2axb5i8xnzm58dmmahxfwplj4r115mz63cl5q0iyy12npbh";
     };
 
     x86_64-linux = {
       url = "${baseUrl}/${name}-linux-x86_64.tar.gz";
-      sha256 = "1dkj4cpy891nd3l1xcqaj1mfphirs9fzbm081i8pyn36nwmdpg2j";
+      sha256 = "0zcf9zabdg2r7d9vafxn4wf0j09im5lhycylf91g734zzh6vc267";
     };
   }.${system};
 
 in stdenv.mkDerivation rec {
   pname = "google-cloud-sdk";
-  version = "344.0.0";
+  version = "345.0.0";
 
   src = fetchurl (sources "${pname}-${version}" stdenv.hostPlatform.system);
 

From 1a08bb4027e3a53f06214ce627a5efc552ec974d Mon Sep 17 00:00:00 2001
From: Niklas <44636701+MayNiklas@users.noreply.github.com>
Date: Mon, 21 Jun 2021 16:30:21 +0200
Subject: [PATCH 313/416] plex: 1.23.2.4656-85f0adf5b -> 1.23.3.4707-ebb5fe9f3

---
 pkgs/servers/plex/raw.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/plex/raw.nix b/pkgs/servers/plex/raw.nix
index 8b9282341b3e..929abe23ccea 100644
--- a/pkgs/servers/plex/raw.nix
+++ b/pkgs/servers/plex/raw.nix
@@ -12,16 +12,16 @@
 # server, and the FHS userenv and corresponding NixOS module should
 # automatically pick up the changes.
 stdenv.mkDerivation rec {
-  version = "1.23.2.4625-a83d2d0f9";
+  version = "1.23.3.4707-ebb5fe9f3";
   pname = "plexmediaserver";
 
   # Fetch the source
   src = if stdenv.hostPlatform.system == "aarch64-linux" then fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_arm64.deb";
-    sha256 = "17md53saxl7x45kgj9wdf7jr61ncnapa418c1lf37qbdqmid343c";
+    sha256 = "0b3xsyrpz1098lyqfapnjp7k55d07qg7h9avc7f3zmpkiclxf2ry";
   } else fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_amd64.deb";
-    sha256 = "1nisjz4g924di73zjkgwx7nk3gkbykj6bkkgzmlm84dq3rgqnisk";
+    sha256 = "1as83prhlfi4g172k3mgm6p8k58zm4bahjf8bp8pyxcmgiii76m0";
   };
 
   outputs = [ "out" "basedb" ];

From 1c2b098fa4d9631aef34f9d61fbbbb4a31eb52dc Mon Sep 17 00:00:00 2001
From: Ethan Edwards <ethan@ethancedwards.com>
Date: Sun, 20 Jun 2021 23:50:16 -0400
Subject: [PATCH 314/416] gitlint: init at 0.15.1

---
 pkgs/tools/misc/gitlint/default.nix | 44 +++++++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix     |  2 ++
 2 files changed, 46 insertions(+)
 create mode 100644 pkgs/tools/misc/gitlint/default.nix

diff --git a/pkgs/tools/misc/gitlint/default.nix b/pkgs/tools/misc/gitlint/default.nix
new file mode 100644
index 000000000000..014cc76e7138
--- /dev/null
+++ b/pkgs/tools/misc/gitlint/default.nix
@@ -0,0 +1,44 @@
+{ lib
+, buildPythonApplication
+, fetchFromGitHub
+, gitMinimal
+, arrow
+, click
+, sh
+, wheel
+}:
+
+buildPythonApplication rec {
+  pname = "gitlint";
+  version = "0.15.1";
+
+  src = fetchFromGitHub {
+    owner = "jorisroovers";
+    repo = "gitlint";
+    rev = "v${version}";
+    sha256 = "sha256-CqmE4V+svSuQAsoX0I3NpUqPU5CQf3fyCHJPrjUjHF4=";
+  };
+
+  nativeBuildInputs = [ wheel ];
+
+  propagatedBuildInputs = [
+    arrow
+    click
+    sh
+  ];
+
+  preCheck = ''
+    export PATH="$out/bin:$PATH"
+  '';
+
+  checkInputs = [
+    gitMinimal
+  ];
+
+  meta = {
+    description = "Linting for your git commit messages";
+    homepage = "http://jorisroovers.github.io/gitlint";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1213a05d66c1..44ff91a8f938 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1535,6 +1535,8 @@ in
 
   gitless = callPackage ../applications/version-management/gitless { python = python3; };
 
+  gitlint = python3Packages.callPackage ../tools/misc/gitlint { };
+
   gitter = callPackage  ../applications/networking/instant-messengers/gitter { };
 
   gjs = callPackage ../development/libraries/gjs { };

From 5d497fd7dde31053e6dcbb1288063e4307ab009c Mon Sep 17 00:00:00 2001
From: Ethan Edwards <ethan@ethancedwards.com>
Date: Sun, 20 Jun 2021 21:15:49 -0400
Subject: [PATCH 315/416] guile-ssh: init at 0.13.1

---
 .../guile-modules/guile-ssh/default.nix       | 51 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 2 files changed, 53 insertions(+)
 create mode 100644 pkgs/development/guile-modules/guile-ssh/default.nix

diff --git a/pkgs/development/guile-modules/guile-ssh/default.nix b/pkgs/development/guile-modules/guile-ssh/default.nix
new file mode 100644
index 000000000000..b7e742384df6
--- /dev/null
+++ b/pkgs/development/guile-modules/guile-ssh/default.nix
@@ -0,0 +1,51 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, guile
+, libssh
+, autoreconfHook
+, pkg-config
+, texinfo
+, which
+}:
+
+stdenv.mkDerivation rec {
+  pname = "guile-ssh";
+  version = "0.13.1";
+
+  src = fetchFromGitHub {
+    owner = "artyom-poptsov";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "LzTR1QuK3mle0Q6a4YRn9ZTkcs1sygYKoezxI9+e/fY=";
+  };
+
+  configureFlags = [ "--with-guilesitedir=\${out}/share/guile/site" ];
+
+  postFixup = ''
+    for f in $out/share/guile/site/ssh/**.scm; do \
+      substituteInPlace $f \
+        --replace "libguile-ssh" "$out/lib/libguile-ssh"; \
+    done
+  '';
+
+  nativeBuildInputs = [
+    autoreconfHook pkg-config texinfo which
+  ];
+  buildInputs = [
+    guile
+  ];
+  propagatedBuildInputs = [
+    libssh
+  ];
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    description = "Bindings to Libssh for GNU Guile";
+    homepage = "https://github.com/artyom-poptsov/guile-ssh";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ ethancedwards8 ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1213a05d66c1..04a5ebedd7e8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12712,6 +12712,8 @@ in
 
   guile-sdl2 = callPackage ../development/guile-modules/guile-sdl2 { };
 
+  guile-ssh = callPackage ../development/guile-modules/guile-ssh { };
+
   guile-xcb = callPackage ../development/guile-modules/guile-xcb {
     guile = guile_2_0;
   };

From 8bbdff45816c657f679cd77c0a0dbca534a85bf3 Mon Sep 17 00:00:00 2001
From: David Arnold <dgx.arnold@gmail.com>
Date: Sun, 20 Jun 2021 23:29:26 -0500
Subject: [PATCH 316/416] nixosTest: Force system.nixos.revision constant

nixos tests are blended with other system configurations, hence
their settings must be either enforced or defaulted.

This particular setting is set via lib.nixosSystem as
`system.nixos.revision = final.mkIf (self ? rev) self.rev;` which would
mean that without this change no flake generated nixos could be blended
with nixos testing.

This setting was made previously constant in
169c6b4b1478a3a0c823c99ea39d4082f76a2708 in order to avoid pointless
rebuilds of the testing VMs, but was set without enforcing it.
---
 nixos/lib/build-vms.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/lib/build-vms.nix b/nixos/lib/build-vms.nix
index 064e44f643b2..f0a58628c68a 100644
--- a/nixos/lib/build-vms.nix
+++ b/nixos/lib/build-vms.nix
@@ -41,7 +41,7 @@ rec {
             # The human version (e.g. 21.05-pre) is left as is, because it is useful
             # for external modules that test with e.g. nixosTest and rely on that
             # version number.
-            config.system.nixos.revision = "constant-nixos-revision";
+            config.system.nixos.revision = mkForce "constant-nixos-revision";
           }
           { key = "nodes"; _module.args.nodes = nodes; }
         ] ++ optional minimal ../modules/testing/minimal-kernel.nix;

From 00c1828244aa0c8f73ee11066571102fdd834e81 Mon Sep 17 00:00:00 2001
From: Johannes Arnold <johannes.arnold@stud.uni-hannover.de>
Date: Mon, 21 Jun 2021 15:54:28 +0200
Subject: [PATCH 317/416] beats: init at 1.0

---
 pkgs/tools/misc/beats/default.nix | 23 +++++++++++++++++++++++
 pkgs/top-level/all-packages.nix   |  2 ++
 2 files changed, 25 insertions(+)
 create mode 100644 pkgs/tools/misc/beats/default.nix

diff --git a/pkgs/tools/misc/beats/default.nix b/pkgs/tools/misc/beats/default.nix
new file mode 100644
index 000000000000..1e6f155f3506
--- /dev/null
+++ b/pkgs/tools/misc/beats/default.nix
@@ -0,0 +1,23 @@
+{ lib, stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "beats";
+  version = "1.0";
+
+  src = fetchFromGitHub {
+    owner = "j0hax";
+    repo = "beats";
+    rev = "v${version}";
+    sha256 = "0qs5cmbncqhs11m4whqmrh2gvv3p3b37qz57xh78x2ma8jbhskqz";
+  };
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/j0hax/beats";
+    license = licenses.gpl3Only;
+    description = "Swatch Internet Time implemented as a C program";
+    platforms = platforms.all;
+    maintainers = [ maintainers.j0hax ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c8611619a9eb..96e9a7ab2755 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1858,6 +1858,8 @@ in
 
   bat-extras = recurseIntoAttrs (callPackages ../tools/misc/bat-extras { });
 
+  beats = callPackage ../tools/misc/beats { };
+
   beauty-line-icon-theme = callPackage ../data/icons/beauty-line-icon-theme {
     inherit (plasma5Packages) breeze-icons;
   };

From 41e525bb63188ee233ca67797e8f7f2525f7616f Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 21 Jun 2021 19:02:28 +0200
Subject: [PATCH 318/416] rshijack: 0.3.0 -> 0.4.0

---
 pkgs/tools/networking/rshijack/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/networking/rshijack/default.nix b/pkgs/tools/networking/rshijack/default.nix
index 76a674dead0d..39f4004eaee0 100644
--- a/pkgs/tools/networking/rshijack/default.nix
+++ b/pkgs/tools/networking/rshijack/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rshijack";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "kpcyrd";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0y01hi3jpfawqlqs8ka0vwfhjw5j5gkhk2nz5m13ns2h27bw20v7";
+    sha256 = "sha256-jpiwbjsYsb5scFbjtv2eTv6oo0HWWTYLpnpTZ8DEqb0=";
   };
 
-  cargoSha256 = "1rbp94wxr8kqjfg35hf44vn3qa0f0jcq8i50a8d0g5y2qf12h04d";
+  cargoSha256 = "sha256-biHDnLu7OiYpnwtmayk2m6QYvX51YUVJH2FGP4qo14Q=";
 
   meta = with lib; {
     description = "TCP connection hijacker";

From 7fafbfdd10b679ea9b3c152ca6f97fe3cd3a8ff4 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 21 Jun 2021 19:36:12 +0200
Subject: [PATCH 319/416] naabu: 2.0.3 -> 2.0.4

---
 pkgs/tools/security/naabu/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/security/naabu/default.nix b/pkgs/tools/security/naabu/default.nix
index a2295d87fec7..da59867e1b62 100644
--- a/pkgs/tools/security/naabu/default.nix
+++ b/pkgs/tools/security/naabu/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "naabu";
-  version = "2.0.3";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "naabu";
     rev = "v${version}";
-    sha256 = "05iybf7q3y0piyw202yzld89fiz2dv2pmnpm1pd905phk5a23n1x";
+    sha256 = "sha256-t5Ij3UeH3z8obOH90cnmwcX9iC97sH7VIKvannSZ+MM=";
   };
 
-  vendorSha256 = "111qvkqdcdgir3dz267xckzlnfx72flnyi7ki7fa6ml7mkfyf70y";
+  vendorSha256 = "sha256-veOIt3hELk3smrGlTyldtdaz5uI4U8/2SeD0UNykB8A=";
 
   buildInputs = [ libpcap ];
 

From c0eaccb78599fd6e85ad8b2bd2ada7967a8dab18 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 21 Jun 2021 19:50:05 +0200
Subject: [PATCH 320/416] osm2pgsql: 1.4.2 -> 1.5.0

---
 pkgs/tools/misc/osm2pgsql/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/misc/osm2pgsql/default.nix b/pkgs/tools/misc/osm2pgsql/default.nix
index 4d959c6480a2..8208459bc89a 100644
--- a/pkgs/tools/misc/osm2pgsql/default.nix
+++ b/pkgs/tools/misc/osm2pgsql/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "osm2pgsql";
-  version = "1.4.2";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "openstreetmap";
     repo = pname;
     rev = version;
-    sha256 = "141blh6lwbgn8hh45xaa0yiwygdc444h9zahx5xrzx5pck9zb5ps";
+    sha256 = "sha256-PHr9wP+DgsiQAvrVNO8Aa/X/dkrAUnlPDwAzSISa0GM=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "OpenStreetMap data to PostgreSQL converter";
     homepage = "https://osm2pgsql.org";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = with platforms; linux ++ darwin;
     maintainers = with maintainers; [ jglukasik das-g ];
   };

From 3c2d26689ee215d526703fd3188c3d7e0392920b Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 21 Jun 2021 19:58:17 +0200
Subject: [PATCH 321/416] nuclei: 2.3.7 -> 2.3.8

---
 pkgs/tools/security/nuclei/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/security/nuclei/default.nix b/pkgs/tools/security/nuclei/default.nix
index 2e32940657bb..e4c6039c456c 100644
--- a/pkgs/tools/security/nuclei/default.nix
+++ b/pkgs/tools/security/nuclei/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "nuclei";
-  version = "2.3.7";
+  version = "2.3.8";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-loViPW84KdAOJbL8oUJeiON1f6vrZTcYXRP2VBMNkGk=";
+    sha256 = "sha256-MrAJHYfTcziHTKJYRB6FW23XcHqdr9AGF+Cumw7hbcQ=";
   };
 
-  vendorSha256 = "sha256-HBpKaRI7gcWp13GVxTlnZvvTyRncfLmu0NmwAUyQ4hQ=";
+  vendorSha256 = "sha256-ZzpmHoMkrDAZcMXtD6smEaFEmT/EnRcKd7XYz/IK72Y=";
 
   modRoot = "./v2";
   subPackages = [

From 3690ae13a4ff9bedf7f1d12a139b2ae308c8afd0 Mon Sep 17 00:00:00 2001
From: Alvar Penning <post@0x21.biz>
Date: Mon, 21 Jun 2021 19:59:55 +0200
Subject: [PATCH 322/416] nginxModules.rtmp: 1.2.1 -> 1.2.2

This new release fixes segfaults,
https://github.com/arut/nginx-rtmp-module/compare/v1.2.1...v1.2.2
---
 pkgs/servers/http/nginx/modules.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/http/nginx/modules.nix b/pkgs/servers/http/nginx/modules.nix
index 0725b674a391..e6cbff3316a7 100644
--- a/pkgs/servers/http/nginx/modules.nix
+++ b/pkgs/servers/http/nginx/modules.nix
@@ -321,13 +321,13 @@ in
     };
   };
 
-  rtmp ={
+  rtmp = {
     src = fetchFromGitHub {
       name = "rtmp";
       owner = "arut";
       repo = "nginx-rtmp-module";
-      rev = "v1.2.1";
-      sha256 = "0na1aam176irz6w148hnvamqy1ilbn4abhdzkva0yrm35a3ksbzn";
+      rev = "v1.2.2";
+      sha256 = "0y45bswk213yhkc2v1xca2rnsxrhx8v6azxz9pvi71vvxcggqv6h";
     };
   };
 

From 1cf2a86110e5133ed624834bb35feb01f9d1166b Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 21 Jun 2021 20:06:20 +0200
Subject: [PATCH 323/416] python3Packages.adb-shell: 0.3.3 -> 0.3.4

---
 pkgs/development/python-modules/adb-shell/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/adb-shell/default.nix b/pkgs/development/python-modules/adb-shell/default.nix
index 24ee4ee7ea44..22e4a67ff2ab 100644
--- a/pkgs/development/python-modules/adb-shell/default.nix
+++ b/pkgs/development/python-modules/adb-shell/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "adb-shell";
-  version = "0.3.3";
+  version = "0.3.4";
 
   disabled = !isPy3k;
 
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "JeffLIrion";
     repo = "adb_shell";
     rev = "v${version}";
-    sha256 = "sha256-QVSPQk/QNnIjTgKGuIg0e58qCH91wn7e4TwgWSmOJEk=";
+    sha256 = "sha256-H1GVbMeaVUZh8T1jgZP2o+emEkK4fOi5k4aL9ayVesA=";
   };
 
   propagatedBuildInputs = [

From d2db3b84dff582e57b6704888ff7637cb7117bcd Mon Sep 17 00:00:00 2001
From: Yurii Matsiuk <ymatsiuk@users.noreply.github.com>
Date: Mon, 21 Jun 2021 20:29:43 +0200
Subject: [PATCH 324/416] teleport: 6.2.3 -> 6.2.5

---
 pkgs/servers/teleport/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/servers/teleport/default.nix b/pkgs/servers/teleport/default.nix
index b8804974158a..d898cc9bcca7 100644
--- a/pkgs/servers/teleport/default.nix
+++ b/pkgs/servers/teleport/default.nix
@@ -4,21 +4,21 @@ let
   webassets = fetchFromGitHub {
     owner = "gravitational";
     repo = "webassets";
-    rev = "8c2812c169fa6bd5f31c13160bd93ef8b317bbc9";
-    sha256 = "sha256-O+H8N1yqQiH645mgXeSc330GRmxF+gxiJJ5iYn65Z6Q=";
+    rev = "8a30ee4e3570c7db0566028b6b562167aa40f646";
+    sha256 = "sha256-noMVcB1cjiMcRke6/qJIzDaEh4uPIewsedLQRdPbzIQ=";
   };
 in
 
 buildGoModule rec {
   pname = "teleport";
-  version = "6.2.3";
+  version = "6.2.5";
 
   # This repo has a private submodule "e" which fetchgit cannot handle without failing.
   src = fetchFromGitHub {
     owner = "gravitational";
     repo = "teleport";
     rev = "v${version}";
-    sha256 = "sha256-3syl1a2ui8/aTgCvihuhg575Df31loOXuENBNJG3nR0=";
+    sha256 = "sha256-OBo1TWN7KxI7DAUcRLwXXQjErhhgpLBrJBR55ewKiYw=";
   };
 
   vendorSha256 = null;

From bd4130d6931364ce77e4a7dbf8856b194fd935d8 Mon Sep 17 00:00:00 2001
From: Thiago Franco de Moraes <totonixsame@gmail.com>
Date: Sun, 20 Jun 2021 18:50:00 -0300
Subject: [PATCH 325/416] python3Packages.dask: 2021.03.0 -> 2021.06.1

---
 .../python-modules/dask/default.nix           | 21 +++++++------------
 1 file changed, 8 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/python-modules/dask/default.nix b/pkgs/development/python-modules/dask/default.nix
index 55ba3ad6ba7f..b51ac1701a2e 100644
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@@ -2,7 +2,6 @@
 , stdenv
 , bokeh
 , buildPythonPackage
-, fetchpatch
 , fetchFromGitHub
 , fsspec
 , pytestCheckHook
@@ -21,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "dask";
-  version = "2021.03.0";
+  version = "2021.06.1";
   disabled = pythonOlder "3.5";
 
   src = fetchFromGitHub {
     owner = "dask";
     repo = pname;
     rev = version;
-    sha256 = "LACv7lWpQULQknNGX/9vH9ckLsypbqKDGnsNBgKT1eI=";
+    sha256 = "sha256-wrUqLSmlKhd0NSjWBwbow8aX53ZBTgl2n4lEmvxC3bs=";
   };
 
   propagatedBuildInputs = [
@@ -54,16 +53,6 @@ buildPythonPackage rec {
 
   dontUseSetuptoolsCheck = true;
 
-  patches = [
-    # dask dataframe cannot be imported in sandboxed builds
-    # See https://github.com/dask/dask/pull/7601
-    (fetchpatch {
-      url = "https://github.com/dask/dask/commit/9ce5b0d258cecb3ef38fd844135ad1f7ac3cea5f.patch";
-      sha256 = "sha256-1EVRYwAdTSEEH9jp+UOnrijzezZN3iYR6q6ieYJM3kY=";
-      name = "fix-dask-dataframe-imports-in-sandbox.patch";
-    })
-  ];
-
   postPatch = ''
     # versioneer hack to set version of github package
     echo "def get_versions(): return {'dirty': False, 'error': None, 'full-revisionid': None, 'version': '${version}'}" > dask/_version.py
@@ -82,6 +71,12 @@ buildPythonPackage rec {
     # this test requires features of python3Packages.psutil that are
     # blocked in sandboxed-builds
     "test_auto_blocksize_csv"
+  ] ++ [
+    # A deprecation warning from newer sqlalchemy versions makes these tests
+    # to fail https://github.com/dask/dask/issues/7406
+    "test_sql"
+    # Test interrupt fails intermittently https://github.com/dask/dask/issues/2192
+    "test_interrupt"
   ];
 
   __darwinAllowLocalNetworking = true;

From 2c6ceb2d5e4cb732ababde7b7d9abbd0189d3cde Mon Sep 17 00:00:00 2001
From: Thiago Franco de Moraes <totonixsame@gmail.com>
Date: Mon, 21 Jun 2021 11:36:19 -0300
Subject: [PATCH 326/416] python3Packages.distributed: 2021.3.0 -> 2021.6.1

---
 pkgs/development/python-modules/distributed/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/distributed/default.nix b/pkgs/development/python-modules/distributed/default.nix
index 8ce554e6f6be..605e905d4ab4 100644
--- a/pkgs/development/python-modules/distributed/default.nix
+++ b/pkgs/development/python-modules/distributed/default.nix
@@ -20,13 +20,13 @@
 
 buildPythonPackage rec {
   pname = "distributed";
-  version = "2021.3.0";
+  version = "2021.6.1";
   disabled = pythonOlder "3.6";
 
   # get full repository need conftest.py to run tests
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Qn/n4Ee7rXQTxl1X5W+k1rHPkh/SBqPSyquUv5FTw9s=";
+    sha256 = "sha256-Z79h/WAio5diX2myChx8HPAWe2RB4Ajw7Ybch4XUYFc=";
   };
 
   propagatedBuildInputs = [

From 67ff76420c76413c31482c6677b8051e2989fe8d Mon Sep 17 00:00:00 2001
From: TredwellGit <tredwell@tutanota.com>
Date: Mon, 21 Jun 2021 18:42:38 +0000
Subject: [PATCH 327/416] linux: 5.10.44 -> 5.10.45

---
 pkgs/os-specific/linux/kernel/linux-5.10.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
index 7606af512763..e11b5db3d303 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.44";
+  version = "5.10.45";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,7 +13,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0ry7hfcj07xc6l9mrm5f0ylz54ca3aklgf9x6plf2k45kjjyzgkp";
+    sha256 = "01rmw5rnxyybr8sh0v9rgamrg71ign2nr7m0ilrq9704k6dj9dzj";
   };
 
   kernelTests = args.kernelTests or [ nixosTests.kernel-generic.linux_5_10 ];

From c4df7bfef79a71d7c12b40a3cae4e3272db97b2d Mon Sep 17 00:00:00 2001
From: TredwellGit <tredwell@tutanota.com>
Date: Mon, 21 Jun 2021 18:42:45 +0000
Subject: [PATCH 328/416] linux: 5.12.11 -> 5.12.12

---
 pkgs/os-specific/linux/kernel/linux-5.12.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-5.12.nix b/pkgs/os-specific/linux/kernel/linux-5.12.nix
index 9c70f150e2d9..5cc25f4a6dac 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.12.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.12.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.12.11";
+  version = "5.12.12";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,7 +13,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0ykzyvb4c6mqcy0fl3wvpn4laj1cllsg80dxnv0gssjz6q836z5f";
+    sha256 = "1a1ymbgkp8ngrkf7cfjrn56zb9qz1mm1j1pmd60g85ln7nyb4ai1";
   };
 
   kernelTests = args.kernelTests or [ nixosTests.kernel-generic.linux_5_12 ];

From 7c23102d0309360ba5649067ede6b8029cc198b3 Mon Sep 17 00:00:00 2001
From: TredwellGit <tredwell@tutanota.com>
Date: Mon, 21 Jun 2021 18:42:52 +0000
Subject: [PATCH 329/416] linux: 5.4.126 -> 5.4.127

---
 pkgs/os-specific/linux/kernel/linux-5.4.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index 751295f435d2..377a53083456 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.4.126";
+  version = "5.4.127";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,7 +13,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0xsjcdgiix8slykzi9c12pl5hk2fnz1bqrxxdcr79d9nmfc7kzf7";
+    sha256 = "1gr89x1ymxaslp9fqcchaa7939yvhxy67z3pgskmx6z2vrd9pgd0";
   };
 
   kernelTests = args.kernelTests or [ nixosTests.kernel-generic.linux_5_4 ];

From 99e1093e758cad44831e1c51cf891136d0ae4190 Mon Sep 17 00:00:00 2001
From: devhell <devhell@mailfresser.de>
Date: Mon, 21 Jun 2021 19:42:59 +0100
Subject: [PATCH 330/416] wlgreet: 2020-10-20 -> 0.3

---
 pkgs/os-specific/linux/wlgreet/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/wlgreet/default.nix b/pkgs/os-specific/linux/wlgreet/default.nix
index 2bbf01b01c5e..4758945e41ab 100644
--- a/pkgs/os-specific/linux/wlgreet/default.nix
+++ b/pkgs/os-specific/linux/wlgreet/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wlgreet";
-  version = "2020-10-20";
+  version = "0.3";
 
   src = fetchFromSourcehut {
     owner = "~kennylevinsen";
     repo = pname;
-    rev = "4425d296b81550cce01f044fbd7ff083e37550f4";
+    rev = version;
     sha256 = "0n0lzg3y1z5s9s6kfkdj5q8w67bqpw08hqfccc5kz0ninzy9j0cc";
   };
 
-  cargoSha256 = "08m8r8wy7yg5lhmyfx4n0vaf99xv97vzrs774apyxxx2wkhbyjhg";
+  cargoSha256 = "1lwy8xmkl9n3fj3wlf80wp728nn9p5rjnbgmm2cbpqxklcgbmxhm";
 
   meta = with lib; {
     description = "Raw wayland greeter for greetd, to be run under sway or similar";

From c43cd094c7eaf1e5c373658061f14e9a43f759a9 Mon Sep 17 00:00:00 2001
From: TredwellGit <tredwell@tutanota.com>
Date: Mon, 21 Jun 2021 18:43:13 +0000
Subject: [PATCH 331/416] linux_latest-libre: 18115 -> 18132

---
 pkgs/os-specific/linux/kernel/linux-libre.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index 2001b350eccc..76b5c1cf146d 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "18115";
-    sha256 = "00wsxlhz7lc4qk7jcgshb05hvv3mm4m8r3zalc9wvp4r1r6xbbjp";
+    rev = "18132";
+    sha256 = "01mgpfx5cddq4bgffydkxpm3xlgf7zfjr1c1icsyn7f2pibd114q";
   }
 , ...
 }:

From cfd71fa4b5cbb3764818878b5b304e55c4a3ab14 Mon Sep 17 00:00:00 2001
From: TredwellGit <tredwell@tutanota.com>
Date: Mon, 21 Jun 2021 18:43:23 +0000
Subject: [PATCH 332/416] linux/hardened/patches/5.10: 5.10.44-hardened1 ->
 5.10.45-hardened1

---
 pkgs/os-specific/linux/kernel/hardened/patches.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 1fedb688920b..279e44705e15 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -13,9 +13,9 @@
     },
     "5.10": {
         "extra": "-hardened1",
-        "name": "linux-hardened-5.10.44-hardened1.patch",
-        "sha256": "12bxv87w74lj73vqflpfk022x2ig81lfn4pf1gfanw9zxjrapw4m",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.44-hardened1/linux-hardened-5.10.44-hardened1.patch"
+        "name": "linux-hardened-5.10.45-hardened1.patch",
+        "sha256": "1382dflkv31b9apf3l0b5wcq8hyi69jm03139z3m0vbxi93pk44z",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.45-hardened1/linux-hardened-5.10.45-hardened1.patch"
     },
     "5.12": {
         "extra": "-hardened1",

From d1e2575c4c7114ab1f6e2f7fd0fda2918d0e7a89 Mon Sep 17 00:00:00 2001
From: TredwellGit <tredwell@tutanota.com>
Date: Mon, 21 Jun 2021 18:43:24 +0000
Subject: [PATCH 333/416] linux/hardened/patches/5.12: 5.12.11-hardened1 ->
 5.12.12-hardened1

---
 pkgs/os-specific/linux/kernel/hardened/patches.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 279e44705e15..29a3d790d869 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -19,9 +19,9 @@
     },
     "5.12": {
         "extra": "-hardened1",
-        "name": "linux-hardened-5.12.11-hardened1.patch",
-        "sha256": "15qi1znszdg6c0v077k1p4gs0kbpvp6hqjcyg262yqjlpn1c7hcb",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.12.11-hardened1/linux-hardened-5.12.11-hardened1.patch"
+        "name": "linux-hardened-5.12.12-hardened1.patch",
+        "sha256": "10923kjxhfphsh1wr0zjj3lk16bxkq9ana4hyy8af7cn2k30k4iw",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.12.12-hardened1/linux-hardened-5.12.12-hardened1.patch"
     },
     "5.4": {
         "extra": "-hardened1",

From df60fdef552ef8a1aaaf3b63a0e7941165a2e893 Mon Sep 17 00:00:00 2001
From: TredwellGit <tredwell@tutanota.com>
Date: Mon, 21 Jun 2021 18:43:25 +0000
Subject: [PATCH 334/416] linux/hardened/patches/5.4: 5.4.126-hardened1 ->
 5.4.127-hardened1

---
 pkgs/os-specific/linux/kernel/hardened/patches.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 29a3d790d869..3d3ddfc3310c 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -25,8 +25,8 @@
     },
     "5.4": {
         "extra": "-hardened1",
-        "name": "linux-hardened-5.4.126-hardened1.patch",
-        "sha256": "05bjry8390iy01nfvkp12x78brgndwm5rsqhnl7yp6vwgdi0fyj1",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.126-hardened1/linux-hardened-5.4.126-hardened1.patch"
+        "name": "linux-hardened-5.4.127-hardened1.patch",
+        "sha256": "1qsz5cnm0ny138pbd9f7j5avvz69g51db7dgr1q4farrjml3nshy",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.127-hardened1/linux-hardened-5.4.127-hardened1.patch"
     }
 }

From 24a08441d52480cf3332a100e24fdf9b83a8351a Mon Sep 17 00:00:00 2001
From: TredwellGit <tredwell@tutanota.com>
Date: Mon, 21 Jun 2021 18:52:06 +0000
Subject: [PATCH 335/416] linux: fix regression in bridge VLAN configuration

---
 pkgs/os-specific/linux/kernel/patches.nix | 9 +++++++++
 pkgs/top-level/all-packages.nix           | 4 ++++
 2 files changed, 13 insertions(+)

diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index f41cedca0f69..48dd9b38d9b1 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -102,4 +102,13 @@
     name = "mac_nvme_t2";
     patch = ./mac-nvme-t2.patch;
   };
+
+  rtnetlink_fix_regression_in_bridge_vlan_configuration = rec {
+    name = "rtnetlink_fix_regression_in_bridge_vlan_configuration";
+    patch = fetchpatch {
+      name = name + ".patch";
+      url = "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=d2e381c4963663bca6f30c3b996fa4dbafe8fcb5";
+      sha256 = "0ragdi13yh5ypp9x49vrdjqx8ddh7sq7i1qjp8fyrbk3n0jdaac3";
+    };
+  };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 45baaaa3099f..5135e1c9e56f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -20670,6 +20670,7 @@ in
       kernelPatches.bridge_stp_helper
       kernelPatches.request_key_helper
       kernelPatches.rtl8761b_support
+      kernelPatches.rtnetlink_fix_regression_in_bridge_vlan_configuration
     ];
   };
 
@@ -20684,6 +20685,7 @@ in
     kernelPatches = [
       kernelPatches.bridge_stp_helper
       kernelPatches.request_key_helper
+      kernelPatches.rtnetlink_fix_regression_in_bridge_vlan_configuration
     ];
   };
 
@@ -20691,6 +20693,7 @@ in
     kernelPatches = [
       kernelPatches.bridge_stp_helper
       kernelPatches.request_key_helper
+      kernelPatches.rtnetlink_fix_regression_in_bridge_vlan_configuration
     ];
   };
 
@@ -20750,6 +20753,7 @@ in
     kernelPatches = [
       kernelPatches.bridge_stp_helper
       kernelPatches.request_key_helper
+      kernelPatches.rtnetlink_fix_regression_in_bridge_vlan_configuration
     ];
   };
 

From 5beb11788ab2077d38ed2f1f5f74da81a4200b33 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mustafa=20=C3=87al=C4=B1=C5=9Fkan?= <musfay@protonmail.com>
Date: Mon, 21 Jun 2021 21:58:25 +0300
Subject: [PATCH 336/416] qbs: 1.18.0 -> 1.19.1

---
 pkgs/development/tools/build-managers/qbs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/build-managers/qbs/default.nix b/pkgs/development/tools/build-managers/qbs/default.nix
index 7e46e39b438b..d2d382f28d32 100644
--- a/pkgs/development/tools/build-managers/qbs/default.nix
+++ b/pkgs/development/tools/build-managers/qbs/default.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
   pname = "qbs";
 
-  version = "1.18.0";
+  version = "1.19.1";
 
   src = fetchFromGitHub {
     owner = "qbs";
     repo = "qbs";
     rev = "v${version}";
-    sha256 = "sha256-W1ky3PWPzfKygY+diBld+BqTAxJvNw9mqw3owcQ6no4=";
+    sha256 = "sha256-td+xXxpjty5jgorlVySG+8yUd9hujInXIlCfqCRUg9k=";
   };
 
   nativeBuildInputs = [ qmake ];

From b90719f57dd36299fc92e46ac52a98523ed230dc Mon Sep 17 00:00:00 2001
From: Thiago Franco de Moraes <totonixsame@gmail.com>
Date: Mon, 21 Jun 2021 12:26:38 -0300
Subject: [PATCH 337/416] python3Packages.streamz: Make streamz pass tests with
 new dask

---
 .../development/python-modules/streamz/default.nix | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/streamz/default.nix b/pkgs/development/python-modules/streamz/default.nix
index 62e71bd2fd1c..2b327174524d 100644
--- a/pkgs/development/python-modules/streamz/default.nix
+++ b/pkgs/development/python-modules/streamz/default.nix
@@ -1,4 +1,7 @@
-{ lib, buildPythonPackage, fetchPypi
+{ lib
+, buildPythonPackage
+, fetchPypi
+, fetchpatch
 , confluent-kafka
 , distributed
 , flaky
@@ -22,6 +25,14 @@ buildPythonPackage rec {
     sha256 = "04446ece273c041506b1642bd3d8380367a8372196be4d6d6d03faafadc590b2";
   };
 
+  patches = [
+    # Fix apply import from dask
+    (fetchpatch {
+      url = "https://patch-diff.githubusercontent.com/raw/python-streamz/streamz/pull/423.patch";
+      sha256 = "sha256-CR+uRvzaFu9WQ633tbvX3gAnudhlVN6VvmxKiR37diw=";
+    })
+  ];
+
   propagatedBuildInputs = [
     networkx
     tornado
@@ -46,6 +57,7 @@ buildPythonPackage rec {
   checkPhase = ''
     pytest --deselect=streamz/tests/test_sources.py::test_tcp_async \
       --deselect=streamz/tests/test_sources.py::test_tcp \
+      --deselect=streamz/tests/test_core.py::test_partition_timeout \
       --ignore=streamz/tests/test_kafka.py
   '';
 

From fa6f1b93b8a2d97770e8d2f549a96772a035d71a Mon Sep 17 00:00:00 2001
From: Thiago Franco de Moraes <totonixsame@gmail.com>
Date: Mon, 21 Jun 2021 15:32:31 -0300
Subject: [PATCH 338/416] python3Packages.datashader: 0.12.1 -> 0.13.0

---
 pkgs/development/python-modules/datashader/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/datashader/default.nix b/pkgs/development/python-modules/datashader/default.nix
index d656a203b9e8..5738dc64e759 100644
--- a/pkgs/development/python-modules/datashader/default.nix
+++ b/pkgs/development/python-modules/datashader/default.nix
@@ -24,11 +24,11 @@
 
 buildPythonPackage rec {
   pname = "datashader";
-  version = "0.12.1";
+  version = "0.13.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a135612876dc3e4b16ccb9ddb70de50519825c8c1be251b49aefa550bcf8a39a";
+    sha256 = "sha256-6JscHm1QjDmXOLLa83qhAvY/xwvlPM6duQ1lSxnCVV8=";
   };
 
   propagatedBuildInputs = [

From 9668c0eec60bc549e41039efacd855469bcf914c Mon Sep 17 00:00:00 2001
From: Thiago Franco de Moraes <totonixsame@gmail.com>
Date: Mon, 21 Jun 2021 16:00:24 -0300
Subject: [PATCH 339/416] python3Packages.sunpy: 2.1.2 -> 3.0.0

---
 pkgs/development/python-modules/sunpy/default.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/sunpy/default.nix b/pkgs/development/python-modules/sunpy/default.nix
index 2de1e3fd5ffa..987523ed42b9 100644
--- a/pkgs/development/python-modules/sunpy/default.nix
+++ b/pkgs/development/python-modules/sunpy/default.nix
@@ -31,12 +31,12 @@
 
 buildPythonPackage rec {
   pname = "sunpy";
-  version = "2.1.2";
+  version = "3.0.0";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8bbc440e606a4f3fcbd1441150d81da6f0208adace9dc06f6afd2c9cb7c08908";
+    sha256 = "sha256-N/DAvnO+S9E4tndEWpiG84P3FCFwxYNdGFxbxUVsTx8=";
   };
 
   nativeBuildInputs = [
@@ -74,9 +74,12 @@ buildPythonPackage rec {
 
   # darwin has write permission issues
   doCheck = stdenv.isLinux;
+
   # ignore documentation tests
   checkPhase = ''
-    PY_IGNORE_IMPORTMISMATCH=1 HOME=$(mktemp -d) pytest sunpy -k 'not rst'
+    PY_IGNORE_IMPORTMISMATCH=1 HOME=$(mktemp -d) pytest sunpy -k 'not rst' \
+    --deselect=sunpy/tests/tests/test_self_test.py::test_main_nonexisting_module \
+    --deselect=sunpy/tests/tests/test_self_test.py::test_main_stdlib_module
   '';
 
   meta = with lib; {

From b2008ab5b87726a9a5e181b5e6e865df53435f09 Mon Sep 17 00:00:00 2001
From: Thiago Franco de Moraes <totonixsame@gmail.com>
Date: Mon, 21 Jun 2021 16:09:04 -0300
Subject: [PATCH 340/416] python3Packages.intake: Disabling a broken test

---
 pkgs/development/python-modules/intake/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/intake/default.nix b/pkgs/development/python-modules/intake/default.nix
index 41207295a2c9..fff6d74b56a1 100644
--- a/pkgs/development/python-modules/intake/default.nix
+++ b/pkgs/development/python-modules/intake/default.nix
@@ -73,6 +73,7 @@ buildPythonPackage rec {
 
     # broken test
     "test_read_pattern"
+    "test_remote_arr"
   ];
 
   meta = with lib; {

From 78a43484b8d5044d5ced4ff6fe07d1f8d0b95d3d Mon Sep 17 00:00:00 2001
From: devhell <devhell@mailfresser.de>
Date: Mon, 21 Jun 2021 20:18:23 +0100
Subject: [PATCH 341/416] multilockscreen: 1.1.0 -> 1.2.0

---
 pkgs/misc/screensavers/multilockscreen/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/misc/screensavers/multilockscreen/default.nix b/pkgs/misc/screensavers/multilockscreen/default.nix
index 3049f3ba2a76..b0c157c778ad 100644
--- a/pkgs/misc/screensavers/multilockscreen/default.nix
+++ b/pkgs/misc/screensavers/multilockscreen/default.nix
@@ -16,13 +16,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "multilockscreen";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "jeffmhubbard";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1vdai1ymkzlkh5l69s8zpyj2klzm8zyak00vd4p7lcldxfj861ig";
+    sha256 = "1bfpbazvhaz9x356nsghz0czysh9b75g79cd9s35v0x0rrzdr9qj";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 02cce3f5fd0c4ee3885be20c11ab7662f7b24aa3 Mon Sep 17 00:00:00 2001
From: Anton Tayanovskyy <anton@pulumi.com>
Date: Mon, 21 Jun 2021 15:59:55 -0400
Subject: [PATCH 342/416] pulumi-bin: 3.4.0 -> 3.5.1

---
 pkgs/tools/admin/pulumi/data.nix  | 74 +++++++++++++++----------------
 pkgs/tools/admin/pulumi/update.sh | 18 ++++----
 2 files changed, 46 insertions(+), 46 deletions(-)

diff --git a/pkgs/tools/admin/pulumi/data.nix b/pkgs/tools/admin/pulumi/data.nix
index f12e906a0cab..e1a6d14914be 100644
--- a/pkgs/tools/admin/pulumi/data.nix
+++ b/pkgs/tools/admin/pulumi/data.nix
@@ -1,24 +1,24 @@
 # DO NOT EDIT! This file is generated automatically by update.sh
 { }:
 {
-  version = "3.4.0";
+  version = "3.5.1";
   pulumiPkgs = {
     x86_64-linux = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.4.0-linux-x64.tar.gz";
-        sha256 = "1xi4sr7wl948j0hjjjg7gxiy5y3zdlg4b2k8y0h2sf6s8h5hdrm3";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.5.1-linux-x64.tar.gz";
+        sha256 = "1wdkwifn1p0m98dmn0g2kcwnllqilfwzkyyg2sg1pfdmk3da9bi3";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v2.2.0-linux-amd64.tar.gz";
         sha256 = "0d88xfi7zzmpyrnvakwxsyavdx6d5hmfrcf4jhmd53mni0m0551l";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.7.0-linux-amd64.tar.gz";
-        sha256 = "1zygz2imx7fxnczlcz4lbcxp521k94sjasqndjd9566y10xk64px";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.8.0-linux-amd64.tar.gz";
+        sha256 = "14r2akgfrs512h9g6lx9scl0bph3qmw3j113shwg2nhqbmwvvh3z";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v3.1.0-linux-amd64.tar.gz";
-        sha256 = "0s8z4h0m3ipkxrbw6h8i8ciam3cgmacw3rvc63qydy5gqv9x6h6w";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v3.2.0-linux-amd64.tar.gz";
+        sha256 = "1xvbkvhny8h5yl6gvlgzdp0cd8xv39sxm36bfszvx9133p6spvy4";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-consul-v3.2.0-linux-amd64.tar.gz";
@@ -29,8 +29,8 @@
         sha256 = "1ppwha1zk73w39msp6jym9in7jsrxzc530qgj4lj0961mb9rdkra";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.4.0-linux-amd64.tar.gz";
-        sha256 = "1fyk7vy0lfbwhfr0m25nphrfiza14ysyciynhsk3cy613sjbcxgx";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.4.1-linux-amd64.tar.gz";
+        sha256 = "1zng8w2jr76z9s95id9dnvw7skr4yd55xrvv9c053gpyh7wv7bhs";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v3.0.0-linux-amd64.tar.gz";
@@ -41,24 +41,24 @@
         sha256 = "0yhdcjscdkvvai95z2v6xabvvsfvaqi38ngpqrb73ahlwqhz3nys";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v5.8.0-linux-amd64.tar.gz";
-        sha256 = "0gnhan9wmrkszpcd8a43k5z12pwgzwaqgryz6qiz3r829aasbgf4";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v5.9.0-linux-amd64.tar.gz";
+        sha256 = "0w28ikwna057dbhsvidkd5sp2v0frih6n4an1cl3gx51yhqsxzap";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.1.0-linux-amd64.tar.gz";
-        sha256 = "08kxd1x8kx2zdwylhprkb6hs02z3b4jmjphail1s395gzq1271bc";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.2.0-linux-amd64.tar.gz";
+        sha256 = "159lk4iv9zi2ggcjwjsg9an4rfjc0lbyn8d3kbv10p6cx109ljzg";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.1.0-linux-amd64.tar.gz";
         sha256 = "13rchk54wpjwci26kfa519gqagwfrp31w6a9nk1xfdxj45ha9d3x";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.0.0-linux-amd64.tar.gz";
-        sha256 = "0lqnb1xrb5ma8ssvn63lh92ihja6zx4nrx40pici1ggaln4sphn0";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.0.1-linux-amd64.tar.gz";
+        sha256 = "1jk3al4mnk6cblaf56yyx0anv3kp3vyr6fqglsinkzaayaswx63z";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.3.1-linux-amd64.tar.gz";
-        sha256 = "027jqzk2nxsqwff7yx306sz2b3r6nyj0za2kyw1aid5k2lg4wc6k";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.4.0-linux-amd64.tar.gz";
+        sha256 = "1dpd6m5w6fnxrspig4s2vcd4hxy720gcrdrxakn1mvz29k4s0zv3";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v3.1.0-linux-amd64.tar.gz";
@@ -93,26 +93,26 @@
         sha256 = "0npszs37q6j1x5h2sp9j1c6qnhr03lxp2r2ci0d4z3x7vyk06rja";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v3.1.0-linux-amd64.tar.gz";
-        sha256 = "0xvkkqgfgmw3f2nbmfvn1kwc9088awaw52kx1kxnp217g5r3c0fx";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.0.0-linux-amd64.tar.gz";
+        sha256 = "09vf4jddy7bys6x2vw7cyq5ylnwb43rr3ysk3vvi5czpbb8fa86k";
       }
     ];
     x86_64-darwin = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.4.0-darwin-x64.tar.gz";
-        sha256 = "169il8bb4y3kbl6ms5856wfv2ws8pmyq1zgj6x4ra5y9wm6vb492";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.5.1-darwin-x64.tar.gz";
+        sha256 = "0q2617vg53ib65vlj09z78lqqg4dz5ymcjn9kablkm5a6s1sfh5s";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v2.2.0-darwin-amd64.tar.gz";
         sha256 = "12mkr0xczdnp21k0k7qn4r3swkaq3pr6v2z853p1db7ksz5kds23";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.7.0-darwin-amd64.tar.gz";
-        sha256 = "0gb2ridcq7zxb849s77za1cyqnh3kai54gfk6402xq736ycf5w7c";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.8.0-darwin-amd64.tar.gz";
+        sha256 = "0qhpzvfv67fn2n1x3h7znqiw7wxz526iw1a41q8v8jalkahfa2rb";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v3.1.0-darwin-amd64.tar.gz";
-        sha256 = "1qjz33npwc7wdq3vrvfxhd4g1pwgl3p7cz5fkwyqs4zp24dcx1ga";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v3.2.0-darwin-amd64.tar.gz";
+        sha256 = "1h726ahb6mqzg83fl3m8wck5gz5hxczbpwmb5xl0yzz1m0s54czf";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-consul-v3.2.0-darwin-amd64.tar.gz";
@@ -123,8 +123,8 @@
         sha256 = "1wwldhy6r6985rwx9vv73jb1nsna387sk6mba81lyc55ar67nsp9";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.4.0-darwin-amd64.tar.gz";
-        sha256 = "17lvl37aplxnanmci1drx4fh1mhijfqbflkpd50y4pb3h5lpy9s0";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.4.1-darwin-amd64.tar.gz";
+        sha256 = "14kjmzmi5v5brz1cphpgr5k8clkr25vrc7wi8v36qmdhigv0kfbn";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v3.0.0-darwin-amd64.tar.gz";
@@ -135,24 +135,24 @@
         sha256 = "1dpsbq3b0fz86355jy7rz4kcsa1lnw4azn25vzlis89ay1ncbblc";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v5.8.0-darwin-amd64.tar.gz";
-        sha256 = "0b80bkjmsl6g7fw0c56bphddrfj0mqnn11w80wf2czs1aclcss37";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v5.9.0-darwin-amd64.tar.gz";
+        sha256 = "1y4pjx260dlh7yi0skd5n2ixlqzi6b9lp5h77qaq1b9h3n4xybfh";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.1.0-darwin-amd64.tar.gz";
-        sha256 = "107b6nlcc99lfysh5v3wz4vz751cdz12k0lm8jh39ikmdck5fphs";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.2.0-darwin-amd64.tar.gz";
+        sha256 = "1iwx80r9kmlrf961zck3qz2jb9shpmywdm5nkflvz6mhwrfsbz72";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.1.0-darwin-amd64.tar.gz";
         sha256 = "0qbw4b5zm6dmwdilaz4bjdg55gc5lilwagrxwrab37vq4a8and4c";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.0.0-darwin-amd64.tar.gz";
-        sha256 = "1lkrx2cayhhv432dvzvz8q4i1gfi659rkl59c0y0dkwbs8x425zb";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.0.1-darwin-amd64.tar.gz";
+        sha256 = "1ddkzwwr2vc0sp1q3r510rpjqj5dl1dn8ax938874jnflcbcwng6";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.3.1-darwin-amd64.tar.gz";
-        sha256 = "1f3vdij0ikf4nr5zdy32qpv9kbz8pdq8d39hnx8p41cs1lxiw3kd";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.4.0-darwin-amd64.tar.gz";
+        sha256 = "1x6fqa643n731cadb02288kc2z321gjjldkvi8wvjjy2dm0lfp72";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v3.1.0-darwin-amd64.tar.gz";
@@ -187,8 +187,8 @@
         sha256 = "0nasbip85f1xjp6dfibw0nh133gf9cy5n4gdqnv5759bg92am7kg";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v3.1.0-darwin-amd64.tar.gz";
-        sha256 = "0r3zmd4q9nhwbn52vva62m5j9nsrxbfgljrvfyyh19i2hm7l0kcl";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.0.0-darwin-amd64.tar.gz";
+        sha256 = "09m0p5k8gkz37193vj1kwkdwbcvv04cwangwbp5xcn3c20q467xb";
       }
     ];
   };
diff --git a/pkgs/tools/admin/pulumi/update.sh b/pkgs/tools/admin/pulumi/update.sh
index dd6c27984590..98f382d12d20 100755
--- a/pkgs/tools/admin/pulumi/update.sh
+++ b/pkgs/tools/admin/pulumi/update.sh
@@ -3,24 +3,24 @@
 
 # Version of Pulumi from
 # https://www.pulumi.com/docs/get-started/install/versions/
-VERSION="3.4.0"
+VERSION="3.5.1"
 
 # Grab latest release ${VERSION} from
 # https://github.com/pulumi/pulumi-${NAME}/releases
 plugins=(
     "auth0=2.2.0"
-    "aws=4.7.0"
-    "cloudflare=3.1.0"
+    "aws=4.8.0"
+    "cloudflare=3.2.0"
     "consul=3.2.0"
     "datadog=3.3.0"
-    "digitalocean=4.4.0"
+    "digitalocean=4.4.1"
     "docker=3.0.0"
     "equinix-metal=2.0.0"
-    "gcp=5.8.0"
-    "github=4.1.0"
+    "gcp=5.9.0"
+    "github=4.2.0"
     "gitlab=4.1.0"
-    "hcloud=1.0.0"
-    "kubernetes=3.3.1"
+    "hcloud=1.0.1"
+    "kubernetes=3.4.0"
     "linode=3.1.0"
     "mailgun=3.1.0"
     "mysql=3.0.0"
@@ -29,7 +29,7 @@ plugins=(
     "postgresql=3.1.0"
     "random=4.2.0"
     "vault=4.1.0"
-    "vsphere=3.1.0"
+    "vsphere=4.0.0"
 )
 
 function genMainSrc() {

From 1a9f464386c2c87f65db654094a2d0d84f7e312e Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Mon, 21 Jun 2021 13:15:28 -0700
Subject: [PATCH 343/416] kubelogin-oidc: 1.23.2 -> 1.23.3 (#127258)

---
 .../networking/cluster/kubelogin-oidc/default.nix           | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/kubelogin-oidc/default.nix b/pkgs/applications/networking/cluster/kubelogin-oidc/default.nix
index fa893f3fa7d4..e552113310f5 100644
--- a/pkgs/applications/networking/cluster/kubelogin-oidc/default.nix
+++ b/pkgs/applications/networking/cluster/kubelogin-oidc/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "kubelogin";
-  version = "1.23.2";
+  version = "1.23.3";
 
   src = fetchFromGitHub {
     owner = "int128";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Vj7qk1x4d94GgthmHhWbQvsfnZE1UL3Bdk5zjAb3vWs=";
+    sha256 = "sha256-qhdt/j1yFlCr+CCM3VQHxRVMEelZDsjhDJW9CYNCx2U=";
   };
 
   subPackages = ["."];
 
-  vendorSha256 = "sha256-JsBseRIbStsX44rLsGAERFUSWUuLcNycRDAcOMconnE=";
+  vendorSha256 = "sha256-RxIrnwIHDi9umu9bqpz3lnpNFdIWoTP657Te9iBv4IA=";
 
   # Rename the binary instead of symlinking to avoid conflict with the
   # Azure version of kubelogin

From 8dbab2753bebaedad1dc3411b5b2eec006f08b63 Mon Sep 17 00:00:00 2001
From: Rafael Varago <varago.rafael@gmail.com>
Date: Mon, 21 Jun 2021 18:09:19 +0200
Subject: [PATCH 344/416] cargo-modules: init at 0.5.0

This patch includes a cargo plugin to generate
tree-like overviews of a crate's modules.

Co-authored-by: legendofmiracles <30902201+legendofmiracles@users.noreply.github.com>
---
 .../tools/rust/cargo-modules/default.nix      | 22 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  1 +
 2 files changed, 23 insertions(+)
 create mode 100644 pkgs/development/tools/rust/cargo-modules/default.nix

diff --git a/pkgs/development/tools/rust/cargo-modules/default.nix b/pkgs/development/tools/rust/cargo-modules/default.nix
new file mode 100644
index 000000000000..f894915c24ec
--- /dev/null
+++ b/pkgs/development/tools/rust/cargo-modules/default.nix
@@ -0,0 +1,22 @@
+{ lib, rustPlatform, fetchFromGitHub }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cargo-modules";
+  version = "0.5.0";
+
+  src = fetchFromGitHub {
+    owner = "regexident";
+    repo = pname;
+    rev = version;
+    sha256 = "0y6ag8nar85l2fh2ca41fglkzc74cv1p5szxrhk1jdqnd2qzhvjp";
+  };
+
+  cargoSha256 = "0m5r36p57w4vw2g3hg12s38ay328swjb0qfl381xwb2xqx10g8kx";
+
+  meta = with lib; {
+    description = "A cargo plugin for showing a tree-like overview of a crate's modules";
+    homepage = "https://github.com/regexident/cargo-modules";
+    license = with licenses; [ mpl20 ];
+    maintainers = with maintainers; [ rvarago ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 45baaaa3099f..22f0f3fd2909 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11916,6 +11916,7 @@ in
   cargo-make = callPackage ../development/tools/rust/cargo-make {
     inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
   };
+  cargo-modules = callPackage ../development/tools/rust/cargo-modules { };
   cargo-msrv = callPackage ../development/tools/rust/cargo-msrv {
     inherit (darwin.apple_sdk.frameworks) Security;
   };

From 55cc140922cb61cb33ae98d5357f3106f289db60 Mon Sep 17 00:00:00 2001
From: 06kellyjac <dev@j-k.io>
Date: Mon, 21 Jun 2021 22:02:13 +0100
Subject: [PATCH 345/416] deno: 1.11.1 -> 1.11.2

---
 pkgs/development/web/deno/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/web/deno/default.nix b/pkgs/development/web/deno/default.nix
index 1211440b6b43..85f7c294e9d6 100644
--- a/pkgs/development/web/deno/default.nix
+++ b/pkgs/development/web/deno/default.nix
@@ -17,15 +17,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "deno";
-  version = "1.11.1";
+  version = "1.11.2";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+EXkWtqJihNx5wvEhRycVpPDs1QxfoqcbMW5aLrofI8=";
+    sha256 = "sha256-/dy+jAm9TioDF8rZtLNFlKcu7ASzvvoVq4dun4gkiCA=";
   };
-  cargoSha256 = "sha256-j/1NJlGRq1MuE+EU7VstwSMmRYfudBmv3nAe3bAyv+U=";
+  cargoSha256 = "sha256-AUNDwbiGHiA+GADnLo/CmKAMhv68BPnvXsZaWacDJ2Y=";
 
   # Install completions post-install
   nativeBuildInputs = [ installShellFiles ];

From bd67ccabff716b5c3a9422ccd87d063aa85b8757 Mon Sep 17 00:00:00 2001
From: Rick van Schijndel <rol3517@gmail.com>
Date: Fri, 18 Jun 2021 16:41:39 +0200
Subject: [PATCH 346/416] vsftpd: fix cross-compilation, remove -Werror

---
 pkgs/servers/ftp/vsftpd/default.nix | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/pkgs/servers/ftp/vsftpd/default.nix b/pkgs/servers/ftp/vsftpd/default.nix
index b87d11809b11..a477551df307 100644
--- a/pkgs/servers/ftp/vsftpd/default.nix
+++ b/pkgs/servers/ftp/vsftpd/default.nix
@@ -18,17 +18,18 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile \
       --replace -dirafter "" \
       --replace /usr $out \
-      --replace /etc $out/etc
+      --replace /etc $out/etc \
+      --replace "-Werror" ""
+
 
     mkdir -p $out/sbin $out/man/man{5,8}
   '';
 
-  NIX_LDFLAGS = "-lcrypt -lssl -lcrypto -lpam -lcap";
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+  ];
 
-  # On gcc9, this would produce
-  #   error: '-Werror=enum-conversion': no option -Wenum-conversion
-  NIX_CFLAGS_COMPILE = lib.optionalString (lib.versionAtLeast stdenv.cc.version "10")
-    "-Wno-error=enum-conversion";
+  NIX_LDFLAGS = "-lcrypt -lssl -lcrypto -lpam -lcap";
 
   enableParallelBuilding = true;
 

From 25541a11534053f14c7228b2845331502c59dbaa Mon Sep 17 00:00:00 2001
From: D Anzorge <d.anzorge@gmail.com>
Date: Tue, 22 Jun 2021 00:02:46 +0200
Subject: [PATCH 347/416] nodePackages.keyoxide: init at 0.3.0

---
 .../node-packages/node-packages.json          |    1 +
 .../node-packages/node-packages.nix           | 3059 ++++++++++-------
 2 files changed, 1762 insertions(+), 1298 deletions(-)

diff --git a/pkgs/development/node-packages/node-packages.json b/pkgs/development/node-packages/node-packages.json
index ae932a8aca4b..6c90e0089ce9 100644
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@@ -142,6 +142,7 @@
 , "kaput-cli"
 , "katex"
 , "karma"
+, "keyoxide"
 , "lcov-result-merger"
 , "leetcode-cli"
 , "vsc-leetcode-cli"
diff --git a/pkgs/development/node-packages/node-packages.nix b/pkgs/development/node-packages/node-packages.nix
index aac508080869..7645954b1eb3 100644
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@@ -49,13 +49,13 @@ let
         sha512 = "o/xdK8b4P0t/xpCARgWXAeaiWeh9jeua6bP1jrcbfN39+Z4zC4x2jg4NysHNhz6spRG8dJFH3kJIUoIbs0Ckww==";
       };
     };
-    "@angular-devkit/architect-0.1200.4" = {
+    "@angular-devkit/architect-0.1200.5" = {
       name = "_at_angular-devkit_slash_architect";
       packageName = "@angular-devkit/architect";
-      version = "0.1200.4";
+      version = "0.1200.5";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@angular-devkit/architect/-/architect-0.1200.4.tgz";
-        sha512 = "/BKaVlpbZYb65elZ+xHoKB2J2DuTstMU++dqE9T/7E0CevuMoOdkLQFQm71Kjl3eFI4i6T5d8mlLVPNE/ZWm7w==";
+        url = "https://registry.npmjs.org/@angular-devkit/architect/-/architect-0.1200.5.tgz";
+        sha512 = "222VZ4OeaDK3vON8V5m+w15SRWfUs5uOb4H9ij/H9/6tyHD83uWfCDoOGg+ax4wJVdWEFJIS+Vn4ijGcZCq9WQ==";
       };
     };
     "@angular-devkit/core-11.2.4" = {
@@ -76,13 +76,13 @@ let
         sha512 = "3dA0Z6sIIxCDjZS/DucgmIKti7EZ/LgHoHgCO72Q50H5ZXbUSNBz5wGl5hVq2+gzrnFgU/0u40MIs6eptk30ZA==";
       };
     };
-    "@angular-devkit/core-12.0.4" = {
+    "@angular-devkit/core-12.0.5" = {
       name = "_at_angular-devkit_slash_core";
       packageName = "@angular-devkit/core";
-      version = "12.0.4";
+      version = "12.0.5";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@angular-devkit/core/-/core-12.0.4.tgz";
-        sha512 = "gtQkLXuQK7NPkurw49//MFZWoRa9aVCIbxE2uxbDAzzQengx9nLUoezS2xVdM7m/SqVK72YL+ZFfSTXzfiSdnA==";
+        url = "https://registry.npmjs.org/@angular-devkit/core/-/core-12.0.5.tgz";
+        sha512 = "zVSQV+8/vjUjsUKGlj8Kf5LioA6AXJTGI0yhHW9q1dFX4dPpbW63k0R1UoIB2wJ0F/AbYVgpnPGPe9BBm2fvZA==";
       };
     };
     "@angular-devkit/schematics-11.2.4" = {
@@ -103,13 +103,13 @@ let
         sha512 = "bhi2+5xtVAjtr3bsXKT8pnoBamQrArd/Y20ueA4Od7cd38YT97nzTA1wyHBFG0vWd0HMyg42ZS0aycNBuOebaA==";
       };
     };
-    "@angular-devkit/schematics-12.0.4" = {
+    "@angular-devkit/schematics-12.0.5" = {
       name = "_at_angular-devkit_slash_schematics";
       packageName = "@angular-devkit/schematics";
-      version = "12.0.4";
+      version = "12.0.5";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@angular-devkit/schematics/-/schematics-12.0.4.tgz";
-        sha512 = "MEAAcOh1Y4R6O7HWo7mMXgRK9BSbCZ3rlx+aHmtWpNXohw0TRhNY5WmRnQTRvMA3qjR9nh0Uo7BkRpgwRfqmBw==";
+        url = "https://registry.npmjs.org/@angular-devkit/schematics/-/schematics-12.0.5.tgz";
+        sha512 = "iW3XuDHScr3TXuunlEjF5O01zBpwpLgfr1oEny8PvseFGDlHK4Nj8zNIoIn3Yg936aiFO4GJAC/UXsT8g5vKxQ==";
       };
     };
     "@angular-devkit/schematics-cli-0.1102.6" = {
@@ -364,13 +364,13 @@ let
         sha512 = "O34LQooYVDXPl7QWCdW9p4NR+QlzOr7xShPPJz8GsuCU3/8ua/wqTr7gmnxXv+WBESiGU/G5s16i6tUvHkNb+w==";
       };
     };
-    "@babel/core-7.14.5" = {
+    "@babel/core-7.14.6" = {
       name = "_at_babel_slash_core";
       packageName = "@babel/core";
-      version = "7.14.5";
+      version = "7.14.6";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@babel/core/-/core-7.14.5.tgz";
-        sha512 = "RN/AwP2DJmQTZSfiDaD+JQQ/J99KsIpOCfBE5pL+5jJSt7nI3nYGoAXZu+ffYSQ029NLs2DstZb+eR81uuARgg==";
+        url = "https://registry.npmjs.org/@babel/core/-/core-7.14.6.tgz";
+        sha512 = "gJnOEWSqTk96qG5BoIrl5bVtc23DCycmIePPYnamY9RboYdI4nFy5vAQMSl81O5K/W0sLDWfGysnOECC+KUUCA==";
       };
     };
     "@babel/core-7.9.0" = {
@@ -418,13 +418,13 @@ let
         sha512 = "v+QtZqXEiOnpO6EYvlImB6zCD2Lel06RzOPzmkz/D/XgQiUu3C/Jb1LOqSt/AIA34TYi/Q+KlT8vTQrgdxkbLw==";
       };
     };
-    "@babel/helper-create-class-features-plugin-7.14.5" = {
+    "@babel/helper-create-class-features-plugin-7.14.6" = {
       name = "_at_babel_slash_helper-create-class-features-plugin";
       packageName = "@babel/helper-create-class-features-plugin";
-      version = "7.14.5";
+      version = "7.14.6";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@babel/helper-create-class-features-plugin/-/helper-create-class-features-plugin-7.14.5.tgz";
-        sha512 = "Uq9z2e7ZtcnDMirRqAGLRaLwJn+Lrh388v5ETrR3pALJnElVh2zqQmdbz4W2RUJYohAPh2mtyPUgyMHMzXMncQ==";
+        url = "https://registry.npmjs.org/@babel/helper-create-class-features-plugin/-/helper-create-class-features-plugin-7.14.6.tgz";
+        sha512 = "Z6gsfGofTxH/+LQXqYEK45kxmcensbzmk/oi8DmaQytlQCgqNZt9XQF8iqlI/SeXWVjaMNxvYvzaYw+kh42mDg==";
       };
     };
     "@babel/helper-create-regexp-features-plugin-7.14.5" = {
@@ -607,13 +607,13 @@ let
         sha512 = "YEdjTCq+LNuNS1WfxsDCNpgXkJaIyqco6DAelTUjT4f2KIWC1nBcaCaSdHTBqQVLnTBexBcVcFhLSU1KnYuePQ==";
       };
     };
-    "@babel/helpers-7.14.5" = {
+    "@babel/helpers-7.14.6" = {
       name = "_at_babel_slash_helpers";
       packageName = "@babel/helpers";
-      version = "7.14.5";
+      version = "7.14.6";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@babel/helpers/-/helpers-7.14.5.tgz";
-        sha512 = "xtcWOuN9VL6nApgVHtq3PPcQv5qFBJzoSZzJ/2c0QK/IP/gxVcoWSNQwFEGvmbQsuS9rhYqjILDGGXcTkA705Q==";
+        url = "https://registry.npmjs.org/@babel/helpers/-/helpers-7.14.6.tgz";
+        sha512 = "yesp1ENQBiLI+iYHSJdoZKUtRpfTlL1grDIX9NRlAVppljLw/4tTyYupIB7uIYmC3stW/imAv8EqaKaS/ibmeA==";
       };
     };
     "@babel/highlight-7.14.5" = {
@@ -625,13 +625,13 @@ let
         sha512 = "qf9u2WFWVV0MppaL877j2dBtQIDgmidgjGk5VIMw3OadXvYaXn66U1BFlH2t4+t3i+8PhedppRv+i40ABzd+gg==";
       };
     };
-    "@babel/parser-7.14.5" = {
+    "@babel/parser-7.14.6" = {
       name = "_at_babel_slash_parser";
       packageName = "@babel/parser";
-      version = "7.14.5";
+      version = "7.14.6";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@babel/parser/-/parser-7.14.5.tgz";
-        sha512 = "TM8C+xtH/9n1qzX+JNHi7AN2zHMTiPUtspO0ZdHflW8KaskkALhMmuMHb4bCmNdv9VAPzJX3/bXqkVLnAvsPfg==";
+        url = "https://registry.npmjs.org/@babel/parser/-/parser-7.14.6.tgz";
+        sha512 = "oG0ej7efjEXxb4UgE+klVx+3j4MVo+A2vCzm7OUN4CLo6WhQ+vSOD2yJ8m7B+DghObxtLxt3EfgMWpq+AsWehQ==";
       };
     };
     "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining-7.14.5" = {
@@ -1318,13 +1318,13 @@ let
         sha512 = "xLucks6T1VmGsTB+GWK5Pl9Jl5+nRXD1uoFdA5TSO6xtiNjtXTjKkmPdFXVLGlK5A2/or/wQMKfmQ2Y0XJfn5g==";
       };
     };
-    "@babel/plugin-transform-spread-7.14.5" = {
+    "@babel/plugin-transform-spread-7.14.6" = {
       name = "_at_babel_slash_plugin-transform-spread";
       packageName = "@babel/plugin-transform-spread";
-      version = "7.14.5";
+      version = "7.14.6";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@babel/plugin-transform-spread/-/plugin-transform-spread-7.14.5.tgz";
-        sha512 = "/3iqoQdiWergnShZYl0xACb4ADeYCJ7X/RgmwtXshn6cIvautRPAFzhd58frQlokLO6Jb4/3JXvmm6WNTPtiTw==";
+        url = "https://registry.npmjs.org/@babel/plugin-transform-spread/-/plugin-transform-spread-7.14.6.tgz";
+        sha512 = "Zr0x0YroFJku7n7+/HH3A2eIrGMjbmAIbJSVv0IZ+t3U2WUQUA64S/oeied2e+MaGSjmt4alzBCsK9E8gh+fag==";
       };
     };
     "@babel/plugin-transform-sticky-regex-7.14.5" = {
@@ -1354,13 +1354,13 @@ let
         sha512 = "lXzLD30ffCWseTbMQzrvDWqljvZlHkXU+CnseMhkMNqU1sASnCsz3tSzAaH3vCUXb9PHeUb90ZT1BdFTm1xxJw==";
       };
     };
-    "@babel/plugin-transform-typescript-7.14.5" = {
+    "@babel/plugin-transform-typescript-7.14.6" = {
       name = "_at_babel_slash_plugin-transform-typescript";
       packageName = "@babel/plugin-transform-typescript";
-      version = "7.14.5";
+      version = "7.14.6";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@babel/plugin-transform-typescript/-/plugin-transform-typescript-7.14.5.tgz";
-        sha512 = "cFD5PKp4b8/KkwQ7h71FdPXFvz1RgwTFF9akRZwFldb9G0AHf7CgoPx96c4Q/ZVjh6V81tqQwW5YiHws16OzPg==";
+        url = "https://registry.npmjs.org/@babel/plugin-transform-typescript/-/plugin-transform-typescript-7.14.6.tgz";
+        sha512 = "XlTdBq7Awr4FYIzqhmYY80WN0V0azF74DMPyFqVHBvf81ZUgc4X7ZOpx6O8eLDK6iM5cCQzeyJw0ynTaefixRA==";
       };
     };
     "@babel/plugin-transform-unicode-escapes-7.14.5" = {
@@ -1480,13 +1480,13 @@ let
         sha512 = "aY2kU+xgJ3dJ1eU6FMB9EH8dIe8dmusF1xEku52joLvw6eAFN0AI+WxCLDnpev2LEejWBAy2sBvBOBAjI3zmvA==";
       };
     };
-    "@babel/runtime-7.14.5" = {
+    "@babel/runtime-7.14.6" = {
       name = "_at_babel_slash_runtime";
       packageName = "@babel/runtime";
-      version = "7.14.5";
+      version = "7.14.6";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@babel/runtime/-/runtime-7.14.5.tgz";
-        sha512 = "121rumjddw9c3NCQ55KGkyE1h/nzWhU/owjhw0l4mQrkzz4x9SGS1X8gFLraHwX7td3Yo4QTL+qj0NcIzN87BA==";
+        url = "https://registry.npmjs.org/@babel/runtime/-/runtime-7.14.6.tgz";
+        sha512 = "/PCB2uJ7oM44tz8YhC4Z/6PeOKXp4K588f+5M3clr1M4zbqztlo0XEfJ2LEzj/FgwfgGcIdl8n7YYjTCI0BYwg==";
       };
     };
     "@babel/runtime-7.9.0" = {
@@ -1498,22 +1498,22 @@ let
         sha512 = "cTIudHnzuWLS56ik4DnRnqqNf8MkdUzV4iFFI1h7Jo9xvrpQROYaAnaSd2mHLQAzzZAPfATynX5ord6YlNYNMA==";
       };
     };
-    "@babel/runtime-corejs3-7.14.5" = {
+    "@babel/runtime-corejs3-7.14.6" = {
       name = "_at_babel_slash_runtime-corejs3";
       packageName = "@babel/runtime-corejs3";
-      version = "7.14.5";
+      version = "7.14.6";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@babel/runtime-corejs3/-/runtime-corejs3-7.14.5.tgz";
-        sha512 = "cBbwXj3F2xjnQJ0ERaFRLjxhUSBYsQPXJ7CERz/ecx6q6hzQ99eTflAPFC3ks4q/IG4CWupNVdflc4jlFBJVsg==";
+        url = "https://registry.npmjs.org/@babel/runtime-corejs3/-/runtime-corejs3-7.14.6.tgz";
+        sha512 = "Xl8SPYtdjcMoCsIM4teyVRg7jIcgl8F2kRtoCcXuHzXswt9UxZCS6BzRo8fcnCuP6u2XtPgvyonmEPF57Kxo9Q==";
       };
     };
-    "@babel/standalone-7.14.5" = {
+    "@babel/standalone-7.14.6" = {
       name = "_at_babel_slash_standalone";
       packageName = "@babel/standalone";
-      version = "7.14.5";
+      version = "7.14.6";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@babel/standalone/-/standalone-7.14.5.tgz";
-        sha512 = "cildg3/P3jk0j+dB+9fJ8Gthrvc9TxhlqvEQXHOn48VpHxGiKZBgBKMJWV5rPJZK5KASSaDYbvdNJOeqYaKf/A==";
+        url = "https://registry.npmjs.org/@babel/standalone/-/standalone-7.14.6.tgz";
+        sha512 = "oAoSp82jhJFnXKybKTOj5QF04XxiDRyiiqrFToiU1udlBXuZoADlPmmnOcuqBrZxSNNUjzJIVK8vt838Qoqjxg==";
       };
     };
     "@babel/template-7.14.5" = {
@@ -2272,13 +2272,13 @@ let
         sha512 = "iT1bU56rKrKEOfODoW6fScY11qj3iaYrZ+z11T6fo5+TDm84UGkkXjLXJTE57ZJzg0/gbccHQWYv+chY7bJN8Q==";
       };
     };
-    "@fluentui/react-7.170.3" = {
+    "@fluentui/react-7.172.0" = {
       name = "_at_fluentui_slash_react";
       packageName = "@fluentui/react";
-      version = "7.170.3";
+      version = "7.172.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@fluentui/react/-/react-7.170.3.tgz";
-        sha512 = "PTXyeYuBCLhdT8SzlBKNOeejuJST5G7IxNgAXgdHayipJRa3gNYoE8kbWbGr64sQatQPDDYastVl8iSLe6B9Hw==";
+        url = "https://registry.npmjs.org/@fluentui/react/-/react-7.172.0.tgz";
+        sha512 = "s4tdCVY+2XMqE8XFaIMyQrocXUaDjt1ZXa048en5Iqmfs5LHCTOjsipKPew6/m+dCLGbSSO/Ait3+3YzFFtuAg==";
       };
     };
     "@fluentui/react-focus-7.17.6" = {
@@ -2344,13 +2344,13 @@ let
         sha512 = "d4VSA86eL/AFTe5xtyZX+ePUjE8dIFu2T8zmdeNBSa5/kNgXPCx/o/wbFNHAGLJdGnk1vddRuMESD9HbOC8irw==";
       };
     };
-    "@google-cloud/pubsub-2.13.0" = {
+    "@google-cloud/pubsub-2.14.0" = {
       name = "_at_google-cloud_slash_pubsub";
       packageName = "@google-cloud/pubsub";
-      version = "2.13.0";
+      version = "2.14.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@google-cloud/pubsub/-/pubsub-2.13.0.tgz";
-        sha512 = "DXR/mYbGDUxCoLOT9FhOUrnYcsEEL2am6GMc5GWQf6nqCEH25OxTZJccZ/7xg5UMkDhSWmDcbmtDyAjcPwEN1g==";
+        url = "https://registry.npmjs.org/@google-cloud/pubsub/-/pubsub-2.14.0.tgz";
+        sha512 = "pP8pwQ9d+p5KNmccEuwM4W9MM8Z9NP+Zzu3P9ewo/z+obK8mEvh5suC2at60MUWaDQOneTcUICpL6DXLRx957A==";
       };
     };
     "@graphql-cli/common-4.1.0" = {
@@ -3082,31 +3082,31 @@ let
         sha512 = "EjPkDQOzV/oZfbolEUgFT6SE++PtCccVBvjuACkttyCfl0P2jnpR49SwstyVLc2u8AwBAZEHHAw9lPYaMjtbXQ==";
       };
     };
-    "@joplin/fork-htmlparser2-4.1.26" = {
+    "@joplin/fork-htmlparser2-4.1.27" = {
       name = "_at_joplin_slash_fork-htmlparser2";
       packageName = "@joplin/fork-htmlparser2";
-      version = "4.1.26";
+      version = "4.1.27";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@joplin/fork-htmlparser2/-/fork-htmlparser2-4.1.26.tgz";
-        sha512 = "ltw7n6MdZyz+oM8DUzOxDeVPdOs/ZTavkmHeP4mp7FE4HYyU7ynhRAVsBpGmzRbXTCYXzl6QHVtocKEUZHkbSg==";
+        url = "https://registry.npmjs.org/@joplin/fork-htmlparser2/-/fork-htmlparser2-4.1.27.tgz";
+        sha512 = "4rR2spWO9eLWGoGXS0ulxzarl/tNq3bIcqTKLu3Qh6C5putae7A01gJssg1BtO+0hLADuzfQK7FWb4W6Z6fymA==";
       };
     };
-    "@joplin/fork-sax-1.2.30" = {
+    "@joplin/fork-sax-1.2.31" = {
       name = "_at_joplin_slash_fork-sax";
       packageName = "@joplin/fork-sax";
-      version = "1.2.30";
+      version = "1.2.31";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@joplin/fork-sax/-/fork-sax-1.2.30.tgz";
-        sha512 = "cRSVysAJwLnaRbFRGHCLDl3rB980iLThCDVwL5lVLpaB43pk+0GVJF3k288mJ1U20mPoZqwc0hV8C0Q5oDMKHw==";
+        url = "https://registry.npmjs.org/@joplin/fork-sax/-/fork-sax-1.2.31.tgz";
+        sha512 = "EIRijEi10yuCSoSkGjvOes0yljEGBWjLf38NnIbadfByWUNPkdlSL+yEq9b8bc2WupAxmJiNA4tfi1i8Th2xDQ==";
       };
     };
-    "@joplin/lib-1.8.2" = {
+    "@joplin/lib-2.0.3" = {
       name = "_at_joplin_slash_lib";
       packageName = "@joplin/lib";
-      version = "1.8.2";
+      version = "2.0.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@joplin/lib/-/lib-1.8.2.tgz";
-        sha512 = "e/uEdz3PbxQQ8XUT6y1HNSM3LdpMjTEJbY+61E7LwC1PguyvAuQgr3tLS0/5OS/PJ1FP4Jm7gU61OJ28g4i4wA==";
+        url = "https://registry.npmjs.org/@joplin/lib/-/lib-2.0.3.tgz";
+        sha512 = "0LYqc8JY75TMFwapYcj0aJrCSVjBsXH15520fZehy1iheh5yQO6YV3MMqLHwpa4/CofCT4SlOs3pd6LIbSyh1w==";
       };
     };
     "@joplin/renderer-1.8.2" = {
@@ -3118,22 +3118,31 @@ let
         sha512 = "Khl2DoM1aFEy15RX9JaMaYinjoNEYQHOgQqzMHq4wuWr+QuAQaX8/SofTe1FU2rS4SJrkObPA+XPavhVSAxpOQ==";
       };
     };
-    "@joplin/turndown-4.0.48" = {
-      name = "_at_joplin_slash_turndown";
-      packageName = "@joplin/turndown";
-      version = "4.0.48";
+    "@joplin/renderer-2.0.3" = {
+      name = "_at_joplin_slash_renderer";
+      packageName = "@joplin/renderer";
+      version = "2.0.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@joplin/turndown/-/turndown-4.0.48.tgz";
-        sha512 = "QJeys/bR9qtEdUs8EFfpwRTfu01+iGQ6GaW+gxQjgXttsmfV+NuoVWfz5/NCdZ+9hqF6DdE9tU45G4EX1diFJA==";
+        url = "https://registry.npmjs.org/@joplin/renderer/-/renderer-2.0.3.tgz";
+        sha512 = "FKXFR212wjStu2wRJ7pe5KyCm4uwiXrrSd9g8Vp38FuQu8Db6J5MNiqno/EcwvibshCxn0cE/odEM7ld/Aukng==";
       };
     };
-    "@joplin/turndown-plugin-gfm-1.0.30" = {
+    "@joplin/turndown-4.0.49" = {
+      name = "_at_joplin_slash_turndown";
+      packageName = "@joplin/turndown";
+      version = "4.0.49";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@joplin/turndown/-/turndown-4.0.49.tgz";
+        sha512 = "TIGJLjSDwy2j00+XGxTi7GaoqPOmDqmfhVsTCZK7C7JDfYzFQWzMixmEKSJkw3rWnFHA5q4omGeIWZP6DAkoGA==";
+      };
+    };
+    "@joplin/turndown-plugin-gfm-1.0.31" = {
       name = "_at_joplin_slash_turndown-plugin-gfm";
       packageName = "@joplin/turndown-plugin-gfm";
-      version = "1.0.30";
+      version = "1.0.31";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@joplin/turndown-plugin-gfm/-/turndown-plugin-gfm-1.0.30.tgz";
-        sha512 = "81syBeLWxduhIM+gZSdM9OGOBL5XXFSMymwfWSFTzS8svYx/I95TPwq0oERcIz6rZkeqf6C9Q52iY30GvKEOog==";
+        url = "https://registry.npmjs.org/@joplin/turndown-plugin-gfm/-/turndown-plugin-gfm-1.0.31.tgz";
+        sha512 = "6PqxgmOIJ8CUR/aFno88JM2a0QTlFtz50ofTz8/hhD4jDD8qQ8DROy6yexCeZle4Gj45yLt8/WhmOlu32FkO/w==";
       };
     };
     "@josephg/resolvable-1.0.1" = {
@@ -3748,13 +3757,13 @@ let
         sha512 = "7AQsO0hMmpqDledV7AhBuSYqYPFsKP9PaltMecX9nlnsyFxqtsqUg9/pvB2L/jxvskrDrNkdKYz2KTbQznCtng==";
       };
     };
-    "@mdn/browser-compat-data-3.2.4" = {
+    "@mdn/browser-compat-data-3.3.7" = {
       name = "_at_mdn_slash_browser-compat-data";
       packageName = "@mdn/browser-compat-data";
-      version = "3.2.4";
+      version = "3.3.7";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@mdn/browser-compat-data/-/browser-compat-data-3.2.4.tgz";
-        sha512 = "jEUurwoeiHOB7SceVnsg3ULxNlf9XxqMfcKNM+eJduPgCcoCnbLi/6og+e764fTAZCcBkqGcWUMhLQXwcqpbJQ==";
+        url = "https://registry.npmjs.org/@mdn/browser-compat-data/-/browser-compat-data-3.3.7.tgz";
+        sha512 = "X42YckpwhdWwWVWR3UpEUB21oIpYoKGMuswZb34yPcsMCySNwLqHnoE972q/UD8VwtpnmO69fsTFiRT2s1gjfA==";
       };
     };
     "@mdx-js/util-2.0.0-next.8" = {
@@ -3784,13 +3793,13 @@ let
         sha512 = "W6CLUJ2eBMw3Rec70qrsEW0jOm/3twwJv21mrmj2yORiaVmVYGS4sSS5yUwvQc1ZlDLYGPnClVWmUUMagKNsfA==";
       };
     };
-    "@microsoft/load-themed-styles-1.10.181" = {
+    "@microsoft/load-themed-styles-1.10.185" = {
       name = "_at_microsoft_slash_load-themed-styles";
       packageName = "@microsoft/load-themed-styles";
-      version = "1.10.181";
+      version = "1.10.185";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@microsoft/load-themed-styles/-/load-themed-styles-1.10.181.tgz";
-        sha512 = "HkABSVIAL+ulsDMy7s28rwhvl0ODq4QF/KvFwRngZJRPBKNjpcf1uFLCluBcEngnl4LSArCCuM7ozND7t8CMDA==";
+        url = "https://registry.npmjs.org/@microsoft/load-themed-styles/-/load-themed-styles-1.10.185.tgz";
+        sha512 = "IyjxBy64JnmlOPjI0F/J+JoeQu/gDCoqLQ4zEmWgd2EDCg2Sd03CrkwqR40q1B5QzC2bUbP3KwnFhoaTS4pBsA==";
       };
     };
     "@mitmaro/errors-1.0.0" = {
@@ -3865,13 +3874,13 @@ let
         sha512 = "b+MGNyP9/LXkapreJzNUzcvuzZslj/RGgdVVJ16P2wSlYatfLycPObImqVJSmNAdyeShvNeM/pl3sVZsObFueg==";
       };
     };
-    "@netlify/build-12.1.0" = {
+    "@netlify/build-12.4.1" = {
       name = "_at_netlify_slash_build";
       packageName = "@netlify/build";
-      version = "12.1.0";
+      version = "12.4.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@netlify/build/-/build-12.1.0.tgz";
-        sha512 = "DvKkNgfwzrQc3lFHJjHfoX7/l2qNd5F6i8urIEthYCH98SLMKrwuCcw3MSkgcmVKI4e+YE0H2PF2MiWWgQ+WLw==";
+        url = "https://registry.npmjs.org/@netlify/build/-/build-12.4.1.tgz";
+        sha512 = "KAdQY1vh0XsnmgJJ8yQ4ciqP0NMfCmYWEkYcbHmFbECGlQH3saw6LKOmSB28EJ3NomMad6r0yr+8Z2f7BS8EMA==";
       };
     };
     "@netlify/cache-utils-1.0.7" = {
@@ -3883,40 +3892,40 @@ let
         sha512 = "yrdrnQkzg/qMovoFYwQ24UVt/OyHtP+t0KpQFd7eBl6gnuuGGgxFocaFFv6eKpMVwzHTsOwx/y9B/FcC3/6cfA==";
       };
     };
-    "@netlify/config-7.2.0" = {
+    "@netlify/config-7.5.0" = {
       name = "_at_netlify_slash_config";
       packageName = "@netlify/config";
-      version = "7.2.0";
+      version = "7.5.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@netlify/config/-/config-7.2.0.tgz";
-        sha512 = "bxjAO6EvROkDtHZtaJg6phiZnR+cXYDTrlsrws9uOV5fuwT2hN0+82ICxUw5dSv+PHnz36nKqJCaC2F2J459Vw==";
+        url = "https://registry.npmjs.org/@netlify/config/-/config-7.5.0.tgz";
+        sha512 = "7+tChBf8jVIgPS9M5tNSldz1JDYwpIPKEe8WqLEaTnE3Vz9RoOBkbPQX3jbKd5sAnfiOZrBm7kVSxB4yZCihKw==";
       };
     };
-    "@netlify/esbuild-0.13.5" = {
+    "@netlify/esbuild-0.13.6" = {
       name = "_at_netlify_slash_esbuild";
       packageName = "@netlify/esbuild";
-      version = "0.13.5";
+      version = "0.13.6";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@netlify/esbuild/-/esbuild-0.13.5.tgz";
-        sha512 = "412V+fUhQagmQ6gw/SqvFU1Gi06n+7M9Rug6+Fr4Qzpiq7To2iMS0myYOyyFs1UfmVM6a3erXKfhPQsBzo4CQQ==";
+        url = "https://registry.npmjs.org/@netlify/esbuild/-/esbuild-0.13.6.tgz";
+        sha512 = "tiKmDcHM2riSVN79c0mJY/67EBDafXQAMitHuLiCDAMdtz3kfv+NqdVG5krgf5lWR8Uf8AeZrUW5Q9RP25REvw==";
       };
     };
-    "@netlify/framework-info-5.1.4" = {
+    "@netlify/framework-info-5.3.0" = {
       name = "_at_netlify_slash_framework-info";
       packageName = "@netlify/framework-info";
-      version = "5.1.4";
+      version = "5.3.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@netlify/framework-info/-/framework-info-5.1.4.tgz";
-        sha512 = "u995zzabQ+L6MKSNw4oVsN4wXiPfgN2Cb20yxC+7lmsRJWXdaEVHh9CASc7UmTrXELGXIAROS16+vlHv63fZ7A==";
+        url = "https://registry.npmjs.org/@netlify/framework-info/-/framework-info-5.3.0.tgz";
+        sha512 = "9pgfafCGv2pt2l82JfPxst3QasuA40DFF0QdLm/3NNdSje8Ro3/i4rUATMCisaGJcScrAYljRlMFOhT4vFVlDg==";
       };
     };
-    "@netlify/functions-utils-1.3.40" = {
+    "@netlify/functions-utils-1.3.43" = {
       name = "_at_netlify_slash_functions-utils";
       packageName = "@netlify/functions-utils";
-      version = "1.3.40";
+      version = "1.3.43";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@netlify/functions-utils/-/functions-utils-1.3.40.tgz";
-        sha512 = "H7+rB6VJOzzFSniUSv98ZSSydd5SfZlbEcxNPbVpXrl8WAcK7GlmIBfXCpyVzVjbflecxSdVhZC2i6isHDN4zA==";
+        url = "https://registry.npmjs.org/@netlify/functions-utils/-/functions-utils-1.3.43.tgz";
+        sha512 = "B2F4VbeyZAol87ruUtYPr0Bg+Z88XEZ1d/J77GoPf96BveMvyzr1BByoUoFFcrjLPlVGjS5lltTGQt5KSMRu4A==";
       };
     };
     "@netlify/git-utils-1.0.11" = {
@@ -3937,31 +3946,31 @@ let
         sha512 = "KiXfYPO/X24p7EYQjcjBTizoyfY3U8zPv68Rte0EtayW2ZSqIslLLpNNd2gteqdh0Q83mzSiESdhlQHd0Ckjjg==";
       };
     };
-    "@netlify/plugin-edge-handlers-1.11.16" = {
+    "@netlify/plugin-edge-handlers-1.11.18" = {
       name = "_at_netlify_slash_plugin-edge-handlers";
       packageName = "@netlify/plugin-edge-handlers";
-      version = "1.11.16";
+      version = "1.11.18";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@netlify/plugin-edge-handlers/-/plugin-edge-handlers-1.11.16.tgz";
-        sha512 = "f9a2G4z9PY5nh2UClLuY8+j+kNa38CuDFPDdf63vEfy1Dt/ICrWpbfTOhwknd6BrPgZ3lu477joRankm19dPMQ==";
+        url = "https://registry.npmjs.org/@netlify/plugin-edge-handlers/-/plugin-edge-handlers-1.11.18.tgz";
+        sha512 = "hpZggKZ0xAGp5M++zjRaMPT+0Wr4DLi1dtPgWeF3XX1cwgxbdoAk///J24jyt0j89lW4s7GxobhJiVq82yuXew==";
       };
     };
-    "@netlify/plugins-list-2.15.0" = {
+    "@netlify/plugins-list-2.16.0" = {
       name = "_at_netlify_slash_plugins-list";
       packageName = "@netlify/plugins-list";
-      version = "2.15.0";
+      version = "2.16.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@netlify/plugins-list/-/plugins-list-2.15.0.tgz";
-        sha512 = "UOkQGvLjy5XDQsVpaaur/QOTPCXS6xCIbMWRYgboEH/BtMNh7ATv7fkF1kQgrJ1+hdguWzRYhww8/4A+G/kcxw==";
+        url = "https://registry.npmjs.org/@netlify/plugins-list/-/plugins-list-2.16.0.tgz";
+        sha512 = "Yvo7evuGbP0tcaSr+nnFWTfSZzGg2T3D9PoVha2okBGWtL461RWM19/u5Q7aGbF2xJ7IKgKI1KAZoSetkvcNXA==";
       };
     };
-    "@netlify/routing-local-proxy-0.30.0" = {
+    "@netlify/routing-local-proxy-0.30.1" = {
       name = "_at_netlify_slash_routing-local-proxy";
       packageName = "@netlify/routing-local-proxy";
-      version = "0.30.0";
+      version = "0.30.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@netlify/routing-local-proxy/-/routing-local-proxy-0.30.0.tgz";
-        sha512 = "603JAYirKZOse+wzAdHwudvWUCGe7nqu5pOVVIa562AV3YhNgZU4sPPKFUcRSXn3QFgyhUSxnNHOabs62IWhrg==";
+        url = "https://registry.npmjs.org/@netlify/routing-local-proxy/-/routing-local-proxy-0.30.1.tgz";
+        sha512 = "9IfNBXDJA2JLvHA5GRDTpOgPpU3dovL8ezB1+igxvtinnl4Nnl9G4D9N6leqf1ecC6aZrx9St4OATqVwY2LryQ==";
       };
     };
     "@netlify/run-utils-1.0.7" = {
@@ -3973,22 +3982,13 @@ let
         sha512 = "YFi1Sf+ktQICS3tAKu7/uiGzLXgi8RNVwH9naUkziXwXQNH2oxDhKgy0/Zv5Nw0zMDJyKWrJ3xObWEC57mJ/KA==";
       };
     };
-    "@netlify/zip-it-and-ship-it-4.2.7" = {
+    "@netlify/zip-it-and-ship-it-4.4.1" = {
       name = "_at_netlify_slash_zip-it-and-ship-it";
       packageName = "@netlify/zip-it-and-ship-it";
-      version = "4.2.7";
+      version = "4.4.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@netlify/zip-it-and-ship-it/-/zip-it-and-ship-it-4.2.7.tgz";
-        sha512 = "7RDPHByyberzRWpQ5PTQZOWWXGH4mqggPDCgj58vDsgIffF+GeG+pZBPv4ZOGCPPb2INZbG0iTiJFvAHictKew==";
-      };
-    };
-    "@netlify/zip-it-and-ship-it-4.3.0" = {
-      name = "_at_netlify_slash_zip-it-and-ship-it";
-      packageName = "@netlify/zip-it-and-ship-it";
-      version = "4.3.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/@netlify/zip-it-and-ship-it/-/zip-it-and-ship-it-4.3.0.tgz";
-        sha512 = "SrI3AFL57IhhQiBgllCj2PMgRlY/b7iA1h0mym9EItduV98+3wmmyXDKTxJtxu2dE0QNUG2J8uiXmCncVAqv6g==";
+        url = "https://registry.npmjs.org/@netlify/zip-it-and-ship-it/-/zip-it-and-ship-it-4.4.1.tgz";
+        sha512 = "qV70DLxcbZ66mAThWfLd5nGchiTAGTn68yDLnpWNvqjUJTzEg76EQopVJTHcX5Eu4YmK60+MpLmkkdJ4tgjycA==";
       };
     };
     "@node-red/editor-api-1.3.5" = {
@@ -4081,13 +4081,13 @@ let
         sha512 = "BTIhocbPBSrRmHxOAJFtR18oLhxTtAFDAvL8hY1S3iU8k+E60W/YFs4jrixGzQjMpF4qPXxIQHcjVD9dz1C2QA==";
       };
     };
-    "@npmcli/arborist-2.6.2" = {
+    "@npmcli/arborist-2.6.3" = {
       name = "_at_npmcli_slash_arborist";
       packageName = "@npmcli/arborist";
-      version = "2.6.2";
+      version = "2.6.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@npmcli/arborist/-/arborist-2.6.2.tgz";
-        sha512 = "CAo0HSziRdlpGUUheERmOrADnKHfBYpLAl/HmWGwGCtWKB3BCxfgb0rJ7MsFg38wy7YF3+fDs7R9dMVCH89K/A==";
+        url = "https://registry.npmjs.org/@npmcli/arborist/-/arborist-2.6.3.tgz";
+        sha512 = "R8U2dZ8+jeE7go+qNU4Mt6aiXyBu3mM75iRIugNCA4P0OWlsLOpuDPPhsaRcOVbtXheOGZXrqe36qP1g+M68KQ==";
       };
     };
     "@npmcli/ci-detect-1.3.0" = {
@@ -4099,13 +4099,13 @@ let
         sha512 = "oN3y7FAROHhrAt7Rr7PnTSwrHrZVRTS2ZbyxeQwSSYD0ifwM3YNgQqbaRmjcWoPyq77MjchusjJDspbzMmip1Q==";
       };
     };
-    "@npmcli/git-2.0.9" = {
+    "@npmcli/git-2.1.0" = {
       name = "_at_npmcli_slash_git";
       packageName = "@npmcli/git";
-      version = "2.0.9";
+      version = "2.1.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@npmcli/git/-/git-2.0.9.tgz";
-        sha512 = "hTMbMryvOqGLwnmMBKs5usbPsJtyEsMsgXwJbmNrsEuQQh1LAIMDU77IoOrwkCg+NgQWl+ySlarJASwM3SutCA==";
+        url = "https://registry.npmjs.org/@npmcli/git/-/git-2.1.0.tgz";
+        sha512 = "/hBFX/QG1b+N7PZBFs0bi+evgRZcK9nWBxQKZkGoXUT5hJSwl5c4d7y8/hm+NQZRPhQ67RzFaj5UM9YeyKoryw==";
       };
     };
     "@npmcli/installed-package-contents-1.0.7" = {
@@ -4306,13 +4306,13 @@ let
         sha512 = "BpGYsPgJt05M7/L/5FoE1PiAbdxXFZkX/3kDYcsvd1v6UhlnE5e96dTDr0ezX/EFwciQxf3cNV0loipsURU+WA==";
       };
     };
-    "@octokit/core-3.5.0" = {
+    "@octokit/core-3.5.1" = {
       name = "_at_octokit_slash_core";
       packageName = "@octokit/core";
-      version = "3.5.0";
+      version = "3.5.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@octokit/core/-/core-3.5.0.tgz";
-        sha512 = "IKcyllVQe6KPwPPFIaKdbhNNQhmmHIj69PXOseBF6/NglXoKHVe79syEfZj0bz7sP87MOl5jLZadV3slgdZ1vQ==";
+        url = "https://registry.npmjs.org/@octokit/core/-/core-3.5.1.tgz";
+        sha512 = "omncwpLVxMP+GLpLPgeGJBF6IWJFjXDS5flY5VbppePYX9XehevbDykRH9PdCdvqt9TS5AOTiDide7h0qrkHjw==";
       };
     };
     "@octokit/endpoint-6.0.12" = {
@@ -4450,22 +4450,22 @@ let
         sha512 = "PffXX2AL8Sh0VHQ52jJC4u3T0H6wDK6N/4bg7xh4ngMYOIi13aR1kzVvX1sVDBgfGwDOkMbl4c54Xm3tlPx/+A==";
       };
     };
-    "@opentelemetry/api-0.18.1" = {
+    "@opentelemetry/api-0.20.0" = {
       name = "_at_opentelemetry_slash_api";
       packageName = "@opentelemetry/api";
-      version = "0.18.1";
+      version = "0.20.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@opentelemetry/api/-/api-0.18.1.tgz";
-        sha512 = "pKNxHe3AJ5T2N5G3AlT9gx6FyF5K2FS9ZNc+FipC+f1CpVF/EY+JHTJ749dnM2kWIgZTbDJFiGMuc0FYjNSCOg==";
+        url = "https://registry.npmjs.org/@opentelemetry/api/-/api-0.20.0.tgz";
+        sha512 = "n06MtDYEc2H07S/NTvGMlxF2Ijp0YbNrI/rBgLcxpEh3hxOkPZA12gxlUoZkBHWCZYau2j3b/uL+QFpiQKOjSw==";
       };
     };
-    "@opentelemetry/semantic-conventions-0.18.2" = {
+    "@opentelemetry/semantic-conventions-0.20.0" = {
       name = "_at_opentelemetry_slash_semantic-conventions";
       packageName = "@opentelemetry/semantic-conventions";
-      version = "0.18.2";
+      version = "0.20.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@opentelemetry/semantic-conventions/-/semantic-conventions-0.18.2.tgz";
-        sha512 = "+0P+PrP9qSFVaayNdek4P1OAGE+PEl2SsufuHDRmUpOY25Wzjo7Atyar56Trjc32jkNy4lID6ZFT6BahsR9P9A==";
+        url = "https://registry.npmjs.org/@opentelemetry/semantic-conventions/-/semantic-conventions-0.20.0.tgz";
+        sha512 = "x40C3vQMttFlnNEfhFwO49jHrY6AoWnntL35TCem3LINr/aw1W0hGhdKY/zweC64CBJEyiHumaae480rqF8eOA==";
       };
     };
     "@ot-builder/bin-composite-types-1.0.9" = {
@@ -5125,13 +5125,13 @@ let
         sha512 = "c/qwwcHyafOQuVQJj0IlBjf5yYgBI7YPJ77k4fOJYesb41jio65eaJODRUmfYKhTOFBrIZ66kgvGPlNbjuoRdQ==";
       };
     };
-    "@schematics/angular-12.0.4" = {
+    "@schematics/angular-12.0.5" = {
       name = "_at_schematics_slash_angular";
       packageName = "@schematics/angular";
-      version = "12.0.4";
+      version = "12.0.5";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@schematics/angular/-/angular-12.0.4.tgz";
-        sha512 = "rC4/+c6p3S/ezDeJzAstrwzdpYgcYzHumtzVSDDM+3Kx0QBUTq/Nj6sk1e2C/fgtV5Jb2INEkTvrih+HP7I0wA==";
+        url = "https://registry.npmjs.org/@schematics/angular/-/angular-12.0.5.tgz";
+        sha512 = "gMT66T33az+uGLDSc7UkJVg+vloPeTpQNgWddBVGnW/Lkl1tGaWUxyqUJAp8AvusPNU+NCP+ZFB3qUm+pc7tCg==";
       };
     };
     "@schematics/schematics-0.1102.6" = {
@@ -5188,13 +5188,13 @@ let
         sha512 = "PY7gH+7aQ+MltcUD7SRDuQODJ9Sav9HhFJsgOiyf8IVo7XVD6FxZIsSnpMI6paSkptOB7n+0Jz03gNlEkKetQQ==";
       };
     };
-    "@serverless/dashboard-plugin-5.3.0" = {
+    "@serverless/dashboard-plugin-5.4.1" = {
       name = "_at_serverless_slash_dashboard-plugin";
       packageName = "@serverless/dashboard-plugin";
-      version = "5.3.0";
+      version = "5.4.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@serverless/dashboard-plugin/-/dashboard-plugin-5.3.0.tgz";
-        sha512 = "JOtFIVLHyeTAtdoK2gFEAAMNsGemszQr6rwhTOg0bV6pgeLmfufL4nz9rAtSj5m2oZnVnH46+P1aVZlwUXNThQ==";
+        url = "https://registry.npmjs.org/@serverless/dashboard-plugin/-/dashboard-plugin-5.4.1.tgz";
+        sha512 = "lOj6jJIzZEPfiaMi70HNWD2uFd8+hzfAArsprtDvsek2H+1JSQ8I4vCtlLOf/X0hQn3sIHI7JQizathkzXkBrg==";
       };
     };
     "@serverless/event-mocks-1.1.1" = {
@@ -5251,22 +5251,22 @@ let
         sha512 = "cl5uPaGg72z0sCUpF0zsOhwYYUV72Gxc1FwFfxltO8hSvMeFDvwD7JrNE4kHcIcKRjwPGbSH0fdVPUpErZ8Mog==";
       };
     };
-    "@serverless/utils-5.2.0" = {
+    "@serverless/utils-5.3.0" = {
       name = "_at_serverless_slash_utils";
       packageName = "@serverless/utils";
-      version = "5.2.0";
+      version = "5.3.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@serverless/utils/-/utils-5.2.0.tgz";
-        sha512 = "QXBZO0W2da0AtROpg8H1c4YWMSl56+nef0Kukd+40Q4jEaY3a0dtpVzvGps3aLFDXer3kWZ3LtlhS5HGXLficw==";
+        url = "https://registry.npmjs.org/@serverless/utils/-/utils-5.3.0.tgz";
+        sha512 = "cUt1ZYXZ/6Khe/foCucqraRpaTtejc4mICWVjQynwaPaK86/3g4Afu4pV1kEumnbet7N0PLbi+SKr8SHTf6tNQ==";
       };
     };
-    "@serverless/utils-china-1.1.1" = {
+    "@serverless/utils-china-1.1.2" = {
       name = "_at_serverless_slash_utils-china";
       packageName = "@serverless/utils-china";
-      version = "1.1.1";
+      version = "1.1.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@serverless/utils-china/-/utils-china-1.1.1.tgz";
-        sha512 = "iGICjLlhU8lrMuknd4i63bYgZi3PZ1EZlf6fW7YsP3l8TY2xtqGcvVzfsj75SAuShBYA3GpKnil6foxCeKok6w==";
+        url = "https://registry.npmjs.org/@serverless/utils-china/-/utils-china-1.1.2.tgz";
+        sha512 = "svZV9zZx2vSqR6EPstgaaLu1YHFfQ5PB2rvZAb66XuXwcPGMwAQN1c836H9L35Y/cUXLhFxv0UCpRHShJLYQSw==";
       };
     };
     "@sideway/address-4.1.2" = {
@@ -5404,6 +5404,15 @@ let
         sha512 = "CWr7a3rTVrN5Vs8GYReRAvTourbXHOqB1zglcskj05ICH4GZL5BOAza2ARai+qc3Nz0nY08Bozi1x0014KOqlg==";
       };
     };
+    "@snyk/child-process-0.3.1" = {
+      name = "_at_snyk_slash_child-process";
+      packageName = "@snyk/child-process";
+      version = "0.3.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@snyk/child-process/-/child-process-0.3.1.tgz";
+        sha512 = "iJn0ENqf3xnYQdG/j9+pdqQPTrXCNXWU3I/AXGFx6Zr8IRBqBr5vXGTuwIJBYkq7s6bfIfz5AjUgPShCzeqn0w==";
+      };
+    };
     "@snyk/cli-interface-2.11.0" = {
       name = "_at_snyk_slash_cli-interface";
       packageName = "@snyk/cli-interface";
@@ -5431,13 +5440,13 @@ let
         sha512 = "ca2JKOnSRzYHJkhOB9gYmdRZHmd02b/uBd/S0D5W+L9nIMS7sUBV5jfhKwVgrYPIpVNIc0XCI9rxK4TfkQRpiA==";
       };
     };
-    "@snyk/code-client-3.8.1" = {
+    "@snyk/code-client-3.9.0" = {
       name = "_at_snyk_slash_code-client";
       packageName = "@snyk/code-client";
-      version = "3.8.1";
+      version = "3.9.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@snyk/code-client/-/code-client-3.8.1.tgz";
-        sha512 = "7HrkscxEXC5eVehZ6nip2uIFDbuvCuux0lrj78twaAnVn9uUx/4G7AKZl8JcrESQEN6py80tJzjvPlBybHJ1+g==";
+        url = "https://registry.npmjs.org/@snyk/code-client/-/code-client-3.9.0.tgz";
+        sha512 = "sscrpiODOlQI87B4OFIClnoZmHEHzJ7vULYhikS/R/2KavG4vGPw7Qe2to5rximxR3VFdWQ0wNVFB0RkU2mjPQ==";
       };
     };
     "@snyk/composer-lockfile-parser-1.4.1" = {
@@ -5458,13 +5467,13 @@ let
         sha512 = "Oup9nAvb558jdNvbZah/vaBtOtCcizkdeS+OBQeBIqIffyer4mc4juSn4b1SFjCpu7AG7piio8Lj8k1B9ps6Tg==";
       };
     };
-    "@snyk/docker-registry-v2-client-2.2.1" = {
+    "@snyk/docker-registry-v2-client-2.2.2" = {
       name = "_at_snyk_slash_docker-registry-v2-client";
       packageName = "@snyk/docker-registry-v2-client";
-      version = "2.2.1";
+      version = "2.2.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@snyk/docker-registry-v2-client/-/docker-registry-v2-client-2.2.1.tgz";
-        sha512 = "3pn0UBs0JskTTmZdBRSblxta3xNAnoFaUmh2s6v3LtpqA/RwXFvlHVUDc72cbJSeKiQJzfESFv9OxfgZ3NmL/Q==";
+        url = "https://registry.npmjs.org/@snyk/docker-registry-v2-client/-/docker-registry-v2-client-2.2.2.tgz";
+        sha512 = "JkkpVZ8WIWWquazoSTSFlMhYOwt+tk+EMSwOxfu/C/wtaESADCORJBe52z0fAnc+xt3eVUVrM+7prJCIJeSrMg==";
       };
     };
     "@snyk/fast-glob-3.2.6-patch" = {
@@ -5476,22 +5485,31 @@ let
         sha512 = "E/Pfdze/WFfxwyuTFcfhQN1SwyUsc43yuCoW63RVBCaxTD6OzhVD2Pvc/Sy7BjiWUfmelzyKkIBpoow8zZX7Zg==";
       };
     };
-    "@snyk/fix-1.620.0" = {
+    "@snyk/fix-1.634.0" = {
       name = "_at_snyk_slash_fix";
       packageName = "@snyk/fix";
-      version = "1.620.0";
+      version = "1.634.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@snyk/fix/-/fix-1.620.0.tgz";
-        sha512 = "o0dISy2mjmZ63/O/Y+yivBtqT6BR88JAa8QbMQ29/TzwysOoKjTaQXbfgT338Q1vm3J91iEptVn3Ut0UsC5LEQ==";
+        url = "https://registry.npmjs.org/@snyk/fix/-/fix-1.634.0.tgz";
+        sha512 = "uR0Y2jfh+hnoNepnSsiPvyFEUSo9SEUNwYPxyKZGq6bfPvoC9HzZkujhSJMnmagSlxVP/UtGtEb2mHRNu/IOdg==";
       };
     };
-    "@snyk/fix-pipenv-pipfile-0.4.3" = {
+    "@snyk/fix-pipenv-pipfile-0.5.3" = {
       name = "_at_snyk_slash_fix-pipenv-pipfile";
       packageName = "@snyk/fix-pipenv-pipfile";
-      version = "0.4.3";
+      version = "0.5.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@snyk/fix-pipenv-pipfile/-/fix-pipenv-pipfile-0.4.3.tgz";
-        sha512 = "dBQaoPmmvc8Dzq/D1z5HKJRI6BgjS5SBSBJs4+NoCpOVTqeoDwP8hG3fC++480kbqlugEaEnHZu4uvA3H9oF7A==";
+        url = "https://registry.npmjs.org/@snyk/fix-pipenv-pipfile/-/fix-pipenv-pipfile-0.5.3.tgz";
+        sha512 = "/wD7bcQ2mpDyXtQiKToQBfKl6asl3nroe9Dw3PkBY79ljwOSm27yqLQVv2EQT7BTK25VxndXSbe47eOrShh1eg==";
+      };
+    };
+    "@snyk/fix-poetry-0.7.0" = {
+      name = "_at_snyk_slash_fix-poetry";
+      packageName = "@snyk/fix-poetry";
+      version = "0.7.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@snyk/fix-poetry/-/fix-poetry-0.7.0.tgz";
+        sha512 = "M0JzI/7rOwH2Q/Gy/v1UXvpnvoaRGZrQCe4bEd3hsJ1ZR1tSy7jZsZGtTxk/E5WjWFMrqe4RRip9Uyd1aLjr9A==";
       };
     };
     "@snyk/gemfile-1.2.0" = {
@@ -6187,13 +6205,13 @@ let
         sha512 = "W24e3Ycz1UZPgr1ZEDHlK4XnvOr+CpJH3qNsFeqXwwlW/9END9gxn3oJSsp7gYdiQxrXUHwUUd3xuzVz37MrZQ==";
       };
     };
-    "@types/download-6.2.4" = {
+    "@types/download-8.0.0" = {
       name = "_at_types_slash_download";
       packageName = "@types/download";
-      version = "6.2.4";
+      version = "8.0.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/download/-/download-6.2.4.tgz";
-        sha512 = "Lo5dy3ai6LNnbL663sgdzqL1eib11u1yKH6w3v3IXEOO4kRfQpMn1qWUTaumcHLACjFp1RcBx9tUXEvJoR3vcA==";
+        url = "https://registry.npmjs.org/@types/download/-/download-8.0.0.tgz";
+        sha512 = "0/LRe3VzcyFIRto6YiJH9OG05ASLeypv5BVrlWjWRBSLCeyFb4up4hqO27j98ASzx1fU2V3ftuWR/sy3PM4NPA==";
       };
     };
     "@types/duplexify-3.6.0" = {
@@ -6736,15 +6754,6 @@ let
         sha512 = "cZHOdO2IiXYeyjeDYdbOisSdfaJRzfmRo3zVzgu33IWTMA0KEQObp9fdvqcuYdPz93iJ1yCl19GcEjo/9yv+yA==";
       };
     };
-    "@types/mkdirp-0.5.2" = {
-      name = "_at_types_slash_mkdirp";
-      packageName = "@types/mkdirp";
-      version = "0.5.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/@types/mkdirp/-/mkdirp-0.5.2.tgz";
-        sha512 = "U5icWpv7YnZYGsN4/cmh3WD2onMY0aJIiTE6+51TwJCttdHvtCYmkBNOobHlXwrJRL0nkH9jH4kD+1FAdMN4Tg==";
-      };
-    };
     "@types/mkdirp-1.0.1" = {
       name = "_at_types_slash_mkdirp";
       packageName = "@types/mkdirp";
@@ -6853,13 +6862,13 @@ let
         sha512 = "e6ZowgGJmTuXa3GyaPbTGxX17tnThl2aSSizrFthQ7m9uLGZBXiGhgE55cjRZTF5kjZvYn9EOPOMljdjwbflxw==";
       };
     };
-    "@types/node-15.12.2" = {
+    "@types/node-15.12.4" = {
       name = "_at_types_slash_node";
       packageName = "@types/node";
-      version = "15.12.2";
+      version = "15.12.4";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/node/-/node-15.12.2.tgz";
-        sha512 = "zjQ69G564OCIWIOHSXyQEEDpdpGl+G348RAKY0XXy9Z5kU9Vzv1GMNnkar/ZJ8dzXB3COzD9Mo9NtRZ4xfgUww==";
+        url = "https://registry.npmjs.org/@types/node/-/node-15.12.4.tgz";
+        sha512 = "zrNj1+yqYF4WskCMOHwN+w9iuD12+dGm0rQ35HLl9/Ouuq52cEtd0CH9qMgrdNmi5ejC1/V7vKEXYubB+65DkA==";
       };
     };
     "@types/node-15.6.1" = {
@@ -7078,15 +7087,6 @@ let
         sha512 = "2XZovu4NwcqmtZtsBR5XYLw18T8cBCnU2USFHTnYLLHz9fkhnoEMoDsqShJIOFsFhn5aJHjweiUUdTrDGujegA==";
       };
     };
-    "@types/semver-5.5.0" = {
-      name = "_at_types_slash_semver";
-      packageName = "@types/semver";
-      version = "5.5.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/@types/semver/-/semver-5.5.0.tgz";
-        sha512 = "41qEJgBH/TWgo5NFSvBCJ1qkoi3Q6ONSF2avrHq1LVEZfYpdHmj0y9SuTK+u9ZhG1sYQKBL1AWXKyLWP4RaUoQ==";
-      };
-    };
     "@types/semver-7.3.6" = {
       name = "_at_types_slash_semver";
       packageName = "@types/semver";
@@ -7321,6 +7321,15 @@ let
         sha512 = "d/7W23JAXPodQNbOZNXvl2K+bqAQrCMwlh/nuQsPSQk6Fq0opHoPrUw43aHsvSbIiQPr8Of2hkFbnz1XBFVyZQ==";
       };
     };
+    "@types/ws-7.4.5" = {
+      name = "_at_types_slash_ws";
+      packageName = "@types/ws";
+      version = "7.4.5";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@types/ws/-/ws-7.4.5.tgz";
+        sha512 = "8mbDgtc8xpxDDem5Gwj76stBDJX35KQ3YBoayxlqUQcL5BZUthiqP/VQ4PQnLHqM4PmlbyO74t98eJpURO+gPA==";
+      };
+    };
     "@types/yargs-13.0.11" = {
       name = "_at_types_slash_yargs";
       packageName = "@types/yargs";
@@ -7366,13 +7375,13 @@ let
         sha512 = "S9q47ByT2pPvD65IvrWp7qppVMpk9WGMbVq9wbWZOHg6tnXSD4vyhao6nOSBwwfDdV2p3Kx9evA9vI+XWTfDvw==";
       };
     };
-    "@typescript-eslint/eslint-plugin-4.26.1" = {
+    "@typescript-eslint/eslint-plugin-4.28.0" = {
       name = "_at_typescript-eslint_slash_eslint-plugin";
       packageName = "@typescript-eslint/eslint-plugin";
-      version = "4.26.1";
+      version = "4.28.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-4.26.1.tgz";
-        sha512 = "aoIusj/8CR+xDWmZxARivZjbMBQTT9dImUtdZ8tVCVRXgBUuuZyM5Of5A9D9arQPxbi/0rlJLcuArclz/rCMJw==";
+        url = "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-4.28.0.tgz";
+        sha512 = "KcF6p3zWhf1f8xO84tuBailV5cN92vhS+VT7UJsPzGBm9VnQqfI9AsiMUFUCYHTYPg1uCCo+HyiDnpDuvkAMfQ==";
       };
     };
     "@typescript-eslint/experimental-utils-3.10.1" = {
@@ -7384,13 +7393,13 @@ let
         sha512 = "DewqIgscDzmAfd5nOGe4zm6Bl7PKtMG2Ad0KG8CUZAHlXfAKTF9Ol5PXhiMh39yRL2ChRH1cuuUGOcVyyrhQIw==";
       };
     };
-    "@typescript-eslint/experimental-utils-4.26.1" = {
+    "@typescript-eslint/experimental-utils-4.28.0" = {
       name = "_at_typescript-eslint_slash_experimental-utils";
       packageName = "@typescript-eslint/experimental-utils";
-      version = "4.26.1";
+      version = "4.28.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@typescript-eslint/experimental-utils/-/experimental-utils-4.26.1.tgz";
-        sha512 = "sQHBugRhrXzRCs9PaGg6rowie4i8s/iD/DpTB+EXte8OMDfdCG5TvO73XlO9Wc/zi0uyN4qOmX9hIjQEyhnbmQ==";
+        url = "https://registry.npmjs.org/@typescript-eslint/experimental-utils/-/experimental-utils-4.28.0.tgz";
+        sha512 = "9XD9s7mt3QWMk82GoyUpc/Ji03vz4T5AYlHF9DcoFNfJ/y3UAclRsfGiE2gLfXtyC+JRA3trR7cR296TEb1oiQ==";
       };
     };
     "@typescript-eslint/parser-3.10.1" = {
@@ -7402,22 +7411,22 @@ let
         sha512 = "Ug1RcWcrJP02hmtaXVS3axPPTTPnZjupqhgj+NnZ6BCkwSImWk/283347+x9wN+lqOdK9Eo3vsyiyDHgsmiEJw==";
       };
     };
-    "@typescript-eslint/parser-4.26.1" = {
+    "@typescript-eslint/parser-4.28.0" = {
       name = "_at_typescript-eslint_slash_parser";
       packageName = "@typescript-eslint/parser";
-      version = "4.26.1";
+      version = "4.28.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-4.26.1.tgz";
-        sha512 = "q7F3zSo/nU6YJpPJvQveVlIIzx9/wu75lr6oDbDzoeIRWxpoc/HQ43G4rmMoCc5my/3uSj2VEpg/D83LYZF5HQ==";
+        url = "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-4.28.0.tgz";
+        sha512 = "7x4D22oPY8fDaOCvkuXtYYTQ6mTMmkivwEzS+7iml9F9VkHGbbZ3x4fHRwxAb5KeuSkLqfnYjs46tGx2Nour4A==";
       };
     };
-    "@typescript-eslint/scope-manager-4.26.1" = {
+    "@typescript-eslint/scope-manager-4.28.0" = {
       name = "_at_typescript-eslint_slash_scope-manager";
       packageName = "@typescript-eslint/scope-manager";
-      version = "4.26.1";
+      version = "4.28.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-4.26.1.tgz";
-        sha512 = "TW1X2p62FQ8Rlne+WEShyd7ac2LA6o27S9i131W4NwDSfyeVlQWhw8ylldNNS8JG6oJB9Ha9Xyc+IUcqipvheQ==";
+        url = "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-4.28.0.tgz";
+        sha512 = "eCALCeScs5P/EYjwo6se9bdjtrh8ByWjtHzOkC4Tia6QQWtQr3PHovxh3TdYTuFcurkYI4rmFsRFpucADIkseg==";
       };
     };
     "@typescript-eslint/types-3.10.1" = {
@@ -7429,13 +7438,13 @@ let
         sha512 = "+3+FCUJIahE9q0lDi1WleYzjCwJs5hIsbugIgnbB+dSCYUxl8L6PwmsyOPFZde2hc1DlTo/xnkOgiTLSyAbHiQ==";
       };
     };
-    "@typescript-eslint/types-4.26.1" = {
+    "@typescript-eslint/types-4.28.0" = {
       name = "_at_typescript-eslint_slash_types";
       packageName = "@typescript-eslint/types";
-      version = "4.26.1";
+      version = "4.28.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@typescript-eslint/types/-/types-4.26.1.tgz";
-        sha512 = "STyMPxR3cS+LaNvS8yK15rb8Y0iL0tFXq0uyl6gY45glyI7w0CsyqyEXl/Fa0JlQy+pVANeK3sbwPneCbWE7yg==";
+        url = "https://registry.npmjs.org/@typescript-eslint/types/-/types-4.28.0.tgz";
+        sha512 = "p16xMNKKoiJCVZY5PW/AfILw2xe1LfruTcfAKBj3a+wgNYP5I9ZEKNDOItoRt53p4EiPV6iRSICy8EPanG9ZVA==";
       };
     };
     "@typescript-eslint/typescript-estree-3.10.1" = {
@@ -7447,13 +7456,13 @@ let
         sha512 = "QbcXOuq6WYvnB3XPsZpIwztBoquEYLXh2MtwVU+kO8jgYCiv4G5xrSP/1wg4tkvrEE+esZVquIPX/dxPlePk1w==";
       };
     };
-    "@typescript-eslint/typescript-estree-4.26.1" = {
+    "@typescript-eslint/typescript-estree-4.28.0" = {
       name = "_at_typescript-eslint_slash_typescript-estree";
       packageName = "@typescript-eslint/typescript-estree";
-      version = "4.26.1";
+      version = "4.28.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-4.26.1.tgz";
-        sha512 = "l3ZXob+h0NQzz80lBGaykdScYaiEbFqznEs99uwzm8fPHhDjwaBFfQkjUC/slw6Sm7npFL8qrGEAMxcfBsBJUg==";
+        url = "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-4.28.0.tgz";
+        sha512 = "m19UQTRtxMzKAm8QxfKpvh6OwQSXaW1CdZPoCaQuLwAq7VZMNuhJmZR4g5281s2ECt658sldnJfdpSZZaxUGMQ==";
       };
     };
     "@typescript-eslint/visitor-keys-3.10.1" = {
@@ -7465,13 +7474,13 @@ let
         sha512 = "9JgC82AaQeglebjZMgYR5wgmfUdUc+EitGUUMW8u2nDckaeimzW+VsoLV6FoimPv2id3VQzfjwBxEMVz08ameQ==";
       };
     };
-    "@typescript-eslint/visitor-keys-4.26.1" = {
+    "@typescript-eslint/visitor-keys-4.28.0" = {
       name = "_at_typescript-eslint_slash_visitor-keys";
       packageName = "@typescript-eslint/visitor-keys";
-      version = "4.26.1";
+      version = "4.28.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-4.26.1.tgz";
-        sha512 = "IGouNSSd+6x/fHtYRyLOM6/C+QxMDzWlDtN41ea+flWuSF9g02iqcIlX8wM53JkfljoIjP0U+yp7SiTS1onEkw==";
+        url = "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-4.28.0.tgz";
+        sha512 = "PjJyTWwrlrvM5jazxYF5ZPs/nl0kHDZMVbuIcbpawVXaDPelp3+S9zpOz5RmVUfS/fD5l5+ZXNKnWhNYjPzCvw==";
       };
     };
     "@uifabric/foundation-7.9.26" = {
@@ -8635,22 +8644,22 @@ let
         sha1 = "6a7990437ca736d5e1288db92bd3266d5f5cb2aa";
       };
     };
-    "addons-linter-3.2.0" = {
+    "addons-linter-3.8.0" = {
       name = "addons-linter";
       packageName = "addons-linter";
-      version = "3.2.0";
+      version = "3.8.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/addons-linter/-/addons-linter-3.2.0.tgz";
-        sha512 = "b6oViLOBgXWsld5L3DJiJSt77DYjVrk2Yam2/gD5e2bsj5xfNvavugwhlJP/MIF0j5yetYT/XFQDXY1Hs0flOA==";
+        url = "https://registry.npmjs.org/addons-linter/-/addons-linter-3.8.0.tgz";
+        sha512 = "k2s7PS7Oiq9NZnpf1SjG6hyefMC082a91BhSw30QEUgvDT54E2d6j8wfbar1WEigc9uYZgGv3VfzEeqTgoLUpw==";
       };
     };
-    "addons-scanner-utils-4.4.0" = {
+    "addons-scanner-utils-4.8.0" = {
       name = "addons-scanner-utils";
       packageName = "addons-scanner-utils";
-      version = "4.4.0";
+      version = "4.8.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/addons-scanner-utils/-/addons-scanner-utils-4.4.0.tgz";
-        sha512 = "fEUGQIqLYeLl5cV6FFSHU+XFlOYETXqm8jxmYGsVayjZaAqWEkIjTXNu4+pDEiqIkrqjPYP2izjrnhBpHRsyog==";
+        url = "https://registry.npmjs.org/addons-scanner-utils/-/addons-scanner-utils-4.8.0.tgz";
+        sha512 = "LjwZql59OKrQgppreOvRcgJDYrnj9XKVW2gb5Q1ZyGG3CH46VCiiNHJB6nYMgOntLo+DPQwQQPOSknZ1zW+wTw==";
       };
     };
     "addr-to-ip-port-1.5.1" = {
@@ -10498,13 +10507,13 @@ let
         sha512 = "TR2mEZFVOj2pLStYxLht7TyfuRzaydfpxr3k9RpHIzMgw7A64dzsdqCxH1WJyQdoe8T10nDXd9wnEigmiuHIZw==";
       };
     };
-    "async-append-only-log-3.0.8" = {
+    "async-append-only-log-3.0.9" = {
       name = "async-append-only-log";
       packageName = "async-append-only-log";
-      version = "3.0.8";
+      version = "3.0.9";
       src = fetchurl {
-        url = "https://registry.npmjs.org/async-append-only-log/-/async-append-only-log-3.0.8.tgz";
-        sha512 = "y80CcN4xifsNHFDCU3aOnOZytNUX+UGXz6pkNmUzSOCNV77q+srsm6OlcM9bTwFBy5VGoUUJfOB1lo9tNB2Okg==";
+        url = "https://registry.npmjs.org/async-append-only-log/-/async-append-only-log-3.0.9.tgz";
+        sha512 = "PIAz4ujkfeDkCjWawS14HIJksu52QTp8i8fSdCdzg/neNldROEjCtfcZ4+DpU4o6U7aSYNNpdN5stwDwhSZQfA==";
       };
     };
     "async-done-1.3.2" = {
@@ -10831,13 +10840,13 @@ let
         sha512 = "tbMZ/Y2rRo6R6TTBODJXTiil+MXaoT6Qzotws3yvI1IWGpYxKo7N/3L06XB8ul8tCG0TigxIOY70SMICM70Ppg==";
       };
     };
-    "aws-sdk-2.927.0" = {
+    "aws-sdk-2.932.0" = {
       name = "aws-sdk";
       packageName = "aws-sdk";
-      version = "2.927.0";
+      version = "2.932.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.927.0.tgz";
-        sha512 = "S1dbpq26bQNYBQPHAsZBt0/L/e0FAWFdjjQoU3zdaVIXa08eA9d/oRI3kEs568ErJgBjwWU1CUUlr1byBxKjUQ==";
+        url = "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.932.0.tgz";
+        sha512 = "U6MWUtFD0npWa+ReVEgm0fCIM0fMOYahFp14GLv8fC+BWOTvh5Iwt/gF8NrLomx42bBjA1Abaw6yhmiaSJDQHQ==";
       };
     };
     "aws-sign2-0.6.0" = {
@@ -11200,13 +11209,13 @@ let
         sha512 = "kISrENsJ0z5dNPq5eRvcctITNHYXWOA4DUZRFYCz3jYCcvTb/A546LIddmoGNMVYg2U38OyFeNosQwI9ENTqIQ==";
       };
     };
-    "babel-plugin-polyfill-corejs3-0.2.2" = {
+    "babel-plugin-polyfill-corejs3-0.2.3" = {
       name = "babel-plugin-polyfill-corejs3";
       packageName = "babel-plugin-polyfill-corejs3";
-      version = "0.2.2";
+      version = "0.2.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/babel-plugin-polyfill-corejs3/-/babel-plugin-polyfill-corejs3-0.2.2.tgz";
-        sha512 = "l1Cf8PKk12eEk5QP/NQ6TH8A1pee6wWDJ96WjxrMXFLHLOBFzYM4moG80HFgduVhTqAFez4alnZKEhP/bYHg0A==";
+        url = "https://registry.npmjs.org/babel-plugin-polyfill-corejs3/-/babel-plugin-polyfill-corejs3-0.2.3.tgz";
+        sha512 = "rCOFzEIJpJEAU14XCcV/erIf/wZQMmMT5l5vXOpL5uoznyOGfDIjPj6FVytMvtzaKSTSVKouOCTPJ5OMUZH30g==";
       };
     };
     "babel-plugin-polyfill-regenerator-0.2.2" = {
@@ -11920,6 +11929,15 @@ let
         sha512 = "2uhEl8FdjSBUyb69qDTgOEeeqDTa+n3yMQzLW0cOzNf1Ow5bwcg3idf+qsWisIKRH8Bk8oC7UXL8irRcPA8ZEQ==";
       };
     };
+    "bent-7.3.12" = {
+      name = "bent";
+      packageName = "bent";
+      version = "7.3.12";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/bent/-/bent-7.3.12.tgz";
+        sha512 = "T3yrKnVGB63zRuoco/7Ybl7BwwGZR0lceoVG5XmQyMIH9s19SV5m+a8qam4if0zQuAmOQTyPTPmsQBdAorGK3w==";
+      };
+    };
     "bep53-range-1.1.0" = {
       name = "bep53-range";
       packageName = "bep53-range";
@@ -12280,13 +12298,13 @@ let
         sha512 = "SrLwMzrpETJDiH9z12EMcqtApgcQo9XsPi+S9Aodezu53ALcGjBBQ7+C+IWbsSCBlSvNEec8sqfh3itO/j/QUw==";
       };
     };
-    "bit-field-1.4.0" = {
+    "bit-field-1.5.1" = {
       name = "bit-field";
       packageName = "bit-field";
-      version = "1.4.0";
+      version = "1.5.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/bit-field/-/bit-field-1.4.0.tgz";
-        sha512 = "HmJvg3BWUuZKw6Q/WV30FprzHtDcZaZHIW03T4kWVlZ0vVR2jVn2h3gFCL5R/8/43pCrNzW+IKQ7KDCI8SsFYw==";
+        url = "https://registry.npmjs.org/bit-field/-/bit-field-1.5.1.tgz";
+        sha512 = "yDanqg5y7PNCzyYl2IPJayOuMt3HRKI8vJDlntSxIqLoKy9YTYUoABUAEuFbQrkzHoAIGfmhhv0M6VRIZ+F0xw==";
       };
     };
     "bitcoin-core-2.3.0" = {
@@ -12388,13 +12406,13 @@ let
         sha512 = "tSh9HdQgwyEAfo1jzoGEis6o/zs4CcdRTchG93XVl5jct+DCAN90M5MVUV76k2vJ9Xg3GAzLB5NLsY/vnVTh6w==";
       };
     };
-    "bittorrent-protocol-3.3.1" = {
+    "bittorrent-protocol-3.4.1" = {
       name = "bittorrent-protocol";
       packageName = "bittorrent-protocol";
-      version = "3.3.1";
+      version = "3.4.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/bittorrent-protocol/-/bittorrent-protocol-3.3.1.tgz";
-        sha512 = "DJy0/jjqJD62PPJY79duCccmPMihp3KPowlmd7BLEU8FTtnDsYjso6BAx+pWwCKOeDORdc9RiJ7L72x3taCh6g==";
+        url = "https://registry.npmjs.org/bittorrent-protocol/-/bittorrent-protocol-3.4.1.tgz";
+        sha512 = "3qBW4ZZrUZKN7HzHbX4+kbiphrTNeraMp3i9n3wobicysjibAV8SBDY+sGiBN4SgXV6WvEW4kyRPIjoSqW+khw==";
       };
     };
     "bittorrent-tracker-7.7.0" = {
@@ -12406,13 +12424,13 @@ let
         sha1 = "ffd2eabc141d36ed5c1817df7e992f91fd7fc65c";
       };
     };
-    "bittorrent-tracker-9.17.0" = {
+    "bittorrent-tracker-9.17.2" = {
       name = "bittorrent-tracker";
       packageName = "bittorrent-tracker";
-      version = "9.17.0";
+      version = "9.17.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/bittorrent-tracker/-/bittorrent-tracker-9.17.0.tgz";
-        sha512 = "ErpOx8AAUW8eLwxnEHp15vs0LDJECLADHISEBM+HXclG3J2/9kMBJ31IjwlB8kUNigknSwm8odAThjJEeyL1yA==";
+        url = "https://registry.npmjs.org/bittorrent-tracker/-/bittorrent-tracker-9.17.2.tgz";
+        sha512 = "hXjed0OnB16da+ScJUZnrAZbf9gMgSLKqh5rJebtYnTRgN4o1mX0DOPH3Nf5RFCs935ibhSmZN5nwbkh+3MdEA==";
       };
     };
     "bl-1.2.3" = {
@@ -12496,13 +12514,13 @@ let
         sha1 = "f962d687ec2c369570ae71af843256e6d0ca1129";
       };
     };
-    "blessed-contrib-4.8.21" = {
+    "blessed-contrib-4.9.0" = {
       name = "blessed-contrib";
       packageName = "blessed-contrib";
-      version = "4.8.21";
+      version = "4.9.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/blessed-contrib/-/blessed-contrib-4.8.21.tgz";
-        sha512 = "zdQMO3UyfhdG0S+Zqn7YexI6BHlnO26qxBKc9jzgyZdIoq7nELiGM/V89CvrTPblZGQr3eMUqCy7pxlKm3vCYA==";
+        url = "https://registry.npmjs.org/blessed-contrib/-/blessed-contrib-4.9.0.tgz";
+        sha512 = "lqvb+6WeqMh7AO8zudSDnvKPGqzkmxqMAwpv83qzeL35MfmROkmjwnY3pi5dvgxfwg5i1UJnDMpj8OroCqpAPw==";
       };
     };
     "blgr-0.1.8" = {
@@ -13162,6 +13180,15 @@ let
         sha512 = "TkOR1cQGdmXU9zW4YukWzWVSJwrxmNdADFbqbE3HFgQWe5wqZmOawqZ7J/8MPCwk/W8yY7Y0h+7mOtcZxLP23g==";
       };
     };
+    "browserify-17.0.0" = {
+      name = "browserify";
+      packageName = "browserify";
+      version = "17.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/browserify/-/browserify-17.0.0.tgz";
+        sha512 = "SaHqzhku9v/j6XsQMRxPyBrSP3gnwmE27gLJYZgMT2GeK3J0+0toN+MnuNYDfHwVGQfLiMZ7KSNSIXHemy905w==";
+      };
+    };
     "browserify-aes-1.2.0" = {
       name = "browserify-aes";
       packageName = "browserify-aes";
@@ -13630,6 +13657,15 @@ let
         sha1 = "26e61ed1422fb70dd42e6e36729ed51d855fe8d9";
       };
     };
+    "buffer-xor-2.0.2" = {
+      name = "buffer-xor";
+      packageName = "buffer-xor";
+      version = "2.0.2";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/buffer-xor/-/buffer-xor-2.0.2.tgz";
+        sha512 = "eHslX0bin3GB+Lx2p7lEYRShRewuNZL3fUl4qlVJGGiwoPGftmt8JQgk2Y9Ji5/01TnVDo33E5b5O3vUB1HdqQ==";
+      };
+    };
     "buffermaker-1.2.1" = {
       name = "buffermaker";
       packageName = "buffermaker";
@@ -13909,6 +13945,15 @@ let
         sha512 = "zauLjrfCG+xvoyaqLoV8bLVXXNGC4JqlxFCutSDWA6fJrTo2ZuvLYTqZ7aHBLZSMOopbzwv8f+wZcVzfVTI2Dg==";
       };
     };
+    "bytesish-0.4.4" = {
+      name = "bytesish";
+      packageName = "bytesish";
+      version = "0.4.4";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/bytesish/-/bytesish-0.4.4.tgz";
+        sha512 = "i4uu6M4zuMUiyfZN4RU2+i9+peJh//pXhd9x1oSe1LBkZ3LEbCoygu8W0bXTukU1Jme2txKuotpCZRaC3FLxcQ==";
+      };
+    };
     "cacache-12.0.4" = {
       name = "cacache";
       packageName = "cacache";
@@ -14233,13 +14278,13 @@ let
         sha512 = "bsTwuIg/BZZK/vreVTYYbSWoe2F+71P7K5QGEX+pT250DZbfU1MQ5prOKpPR+LL6uWKK3KMwMCAS74QB3Um1uw==";
       };
     };
-    "caniuse-lite-1.0.30001237" = {
+    "caniuse-lite-1.0.30001239" = {
       name = "caniuse-lite";
       packageName = "caniuse-lite";
-      version = "1.0.30001237";
+      version = "1.0.30001239";
       src = fetchurl {
-        url = "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001237.tgz";
-        sha512 = "pDHgRndit6p1NR2GhzMbQ6CkRrp4VKuSsqbcLeOQppYPKOYkKT/6ZvZDvKJUqcmtyWIAHuZq3SVS2vc1egCZzw==";
+        url = "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001239.tgz";
+        sha512 = "cyBkXJDMeI4wthy8xJ2FvDU6+0dtcZSJW3voUF8+e9f1bBeuvyZfc3PNbkOETyhbR+dGCPzn9E7MA3iwzusOhQ==";
       };
     };
     "canvas-2.8.0" = {
@@ -14395,22 +14440,22 @@ let
         sha512 = "vlNK021QdI7PNeiUh/lKkC/mNHHfV0m/Ad5JoI0TYtlBnJAslM/JIkm/tGC88bkLIwO6OQ5uV6ztS6kVAtCDlg==";
       };
     };
-    "cdk8s-1.0.0-beta.14" = {
+    "cdk8s-1.0.0-beta.24" = {
       name = "cdk8s";
       packageName = "cdk8s";
-      version = "1.0.0-beta.14";
+      version = "1.0.0-beta.24";
       src = fetchurl {
-        url = "https://registry.npmjs.org/cdk8s/-/cdk8s-1.0.0-beta.14.tgz";
-        sha512 = "NU5mZbOE3RgRX7a9zHf4AgiNcI/clqQ9vw/YixSgVe2AOiAsUXuSH2BCc3eFAZSlPSQYLxWG6mSCGY/06cy5Hw==";
+        url = "https://registry.npmjs.org/cdk8s/-/cdk8s-1.0.0-beta.24.tgz";
+        sha512 = "1aezBDPxwYvVd0/k5ts2UsgB6/NrvRNUksbZxbzZK1+thHl2iOLNYjnFMEOb64m6z3LrR0QMmAE4SLrXzbyMcQ==";
       };
     };
-    "cdk8s-plus-17-1.0.0-beta.18" = {
+    "cdk8s-plus-17-1.0.0-beta.30" = {
       name = "cdk8s-plus-17";
       packageName = "cdk8s-plus-17";
-      version = "1.0.0-beta.18";
+      version = "1.0.0-beta.30";
       src = fetchurl {
-        url = "https://registry.npmjs.org/cdk8s-plus-17/-/cdk8s-plus-17-1.0.0-beta.18.tgz";
-        sha512 = "7TIYXo9fIdj8kawpiIaGNlhxewE2KbundrZDMMLSchsb9QtJBYQEj8a00kUBonPMpftwZCQY36RANEThq16BRQ==";
+        url = "https://registry.npmjs.org/cdk8s-plus-17/-/cdk8s-plus-17-1.0.0-beta.30.tgz";
+        sha512 = "e2xfSVsbwUPz+Zv5UycVKRgIcoca7ND00ov57iIsxRkc0yJ7rbILTxtrFoJ0fkEccgDVCDSoC6KfKkKh9Xzhqw==";
       };
     };
     "cdktf-0.4.1" = {
@@ -14782,15 +14827,6 @@ let
         sha512 = "yoqps/VCaZgN4pfXtenwHROTp8NG6/Hlt4Jpz2FEP0ZJQ+ZUkVDd0hAPDNKhj3nakpfPt/CNs57yEtxD1bXQiw==";
       };
     };
-    "cheerio-1.0.0-rc.6" = {
-      name = "cheerio";
-      packageName = "cheerio";
-      version = "1.0.0-rc.6";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/cheerio/-/cheerio-1.0.0-rc.6.tgz";
-        sha512 = "hjx1XE1M/D5pAtMgvWwE21QClmAEeGHOIDfycgmndisdNgI6PE1cGRQkMGBcsbUbmEQyWu5PJLUcAOjtQS8DWw==";
-      };
-    };
     "cheerio-select-1.5.0" = {
       name = "cheerio-select";
       packageName = "cheerio-select";
@@ -14881,6 +14917,15 @@ let
         sha512 = "9+s+Od+W0VJJzawDma/gvBNQqkTiqYTWLuZoyAsivsI4AaWTCzHG06/TMjsf1cYe9Cb97UCEhjz7HvnPk2p/tw==";
       };
     };
+    "chokidar-3.5.2" = {
+      name = "chokidar";
+      packageName = "chokidar";
+      version = "3.5.2";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/chokidar/-/chokidar-3.5.2.tgz";
+        sha512 = "ekGhOnNVPgT77r4K/U3GDhu+FQ2S8TnK/s2KbIGXi0SZWuwkZ2QNyfWdZW+TVfn84DpEP7rLeCt2UI6bJ8GwbQ==";
+      };
+    };
     "chownr-0.0.2" = {
       name = "chownr";
       packageName = "chownr";
@@ -14935,13 +14980,13 @@ let
         sha512 = "HqsYJgIc8ljJJOqOzLphjAs79EUuWSX3nzZi2LNkzlw3GIzAeZbaSektC8iT/tKvLqZq8yl1GJu5o6doA4TRbg==";
       };
     };
-    "chrome-launcher-0.13.4" = {
+    "chrome-launcher-0.14.0" = {
       name = "chrome-launcher";
       packageName = "chrome-launcher";
-      version = "0.13.4";
+      version = "0.14.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/chrome-launcher/-/chrome-launcher-0.13.4.tgz";
-        sha512 = "nnzXiDbGKjDSK6t2I+35OAPBy5Pw/39bgkb/ZAFwMhwJbdYBp6aH+vW28ZgtjdU890Q7D+3wN/tB8N66q5Gi2A==";
+        url = "https://registry.npmjs.org/chrome-launcher/-/chrome-launcher-0.14.0.tgz";
+        sha512 = "W//HpflaW6qBGrmuskup7g+XJZN6w03ko9QSIe5CtcTal2u0up5SeReK3Ll1Why4Ey8dPkv8XSodZyHPnGbVHQ==";
       };
     };
     "chrome-net-3.3.4" = {
@@ -14989,13 +15034,13 @@ let
         sha1 = "01296a3e5d130cce34974eb509cbbc7d6f78dd3d";
       };
     };
-    "chromecasts-1.9.1" = {
+    "chromecasts-1.10.0" = {
       name = "chromecasts";
       packageName = "chromecasts";
-      version = "1.9.1";
+      version = "1.10.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/chromecasts/-/chromecasts-1.9.1.tgz";
-        sha512 = "nsXv7ufgrpC8s5DUm6FJEa2XJ2VvE9FmbTVi6r4zGreTFTTSRSJjvqVEqLUFX/fGo/zbSre3zdoV+Pu9DGLz0A==";
+        url = "https://registry.npmjs.org/chromecasts/-/chromecasts-1.10.0.tgz";
+        sha512 = "vrOiuHxqLb0bWRBlvyL18cHU8PcbZ7iJvwDB6aHdbtdIDVWuzWWZwDyAWHu54j4JNqyaAyYBJiJ6bbHInVcqBQ==";
       };
     };
     "chromium-pickle-js-0.2.0" = {
@@ -15187,15 +15232,6 @@ let
         sha512 = "bLSptAy2P0s6hU4PzuIMKmMJJSE6gLXGH1cntDu7bWJUksvuM+7ReOK61mozULErYvP6a15rnYl0zFDef+pyPw==";
       };
     };
-    "clean-html-1.5.0" = {
-      name = "clean-html";
-      packageName = "clean-html";
-      version = "1.5.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/clean-html/-/clean-html-1.5.0.tgz";
-        sha512 = "eDu0vN44ZBvoEU0oRIKwWPIccGWXtdnUNmKJuTukZ1de00Uoqavb5pfIMKiC7/r+knQ5RbvAjGuVZiN3JwJL4Q==";
-      };
-    };
     "clean-stack-2.2.0" = {
       name = "clean-stack";
       packageName = "clean-stack";
@@ -16942,13 +16978,13 @@ let
         sha1 = "c20b96d8c617748aaf1c16021760cd27fcb8cb75";
       };
     };
-    "constructs-3.3.77" = {
+    "constructs-3.3.85" = {
       name = "constructs";
       packageName = "constructs";
-      version = "3.3.77";
+      version = "3.3.85";
       src = fetchurl {
-        url = "https://registry.npmjs.org/constructs/-/constructs-3.3.77.tgz";
-        sha512 = "A9xWepIkiED0baaEWxokUvRnPrxcAwoCsyIPDAJ3VqQ90juiIHQ0gkW9GX0nG6c+Go5l1dL5FZIFZBeayx+xIg==";
+        url = "https://registry.npmjs.org/constructs/-/constructs-3.3.85.tgz";
+        sha512 = "Or1CtFHhDLWEO64nFtDGStVSZKu0iOkxJ0y90elLR2zVkkFU7l3VujXRuJxY5Tb1SeuN0hSueC7SnMegFLafcw==";
       };
     };
     "consume-http-header-1.0.0" = {
@@ -17024,13 +17060,13 @@ let
         sha1 = "0e790b3abfef90f6ecb77ae8585db9099caf7578";
       };
     };
-    "contentful-management-7.24.0" = {
+    "contentful-management-7.25.1" = {
       name = "contentful-management";
       packageName = "contentful-management";
-      version = "7.24.0";
+      version = "7.25.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/contentful-management/-/contentful-management-7.24.0.tgz";
-        sha512 = "Uo6SZ2q5PqrOSwFWX609/Dy1xfpwTJ0uOw4GuohIeo+MgJJqEwJcZ+K4H7/ie3QievZ1V7dm/f5AyyCalTCtgA==";
+        url = "https://registry.npmjs.org/contentful-management/-/contentful-management-7.25.1.tgz";
+        sha512 = "V8tcSHw3MwWKWHWMW+AZB6lP31hreos+v2gtayZczWXYRcfd+owt+qVjbkLZk1pL80ewSmc8Pl1A7rM/oB2ldw==";
       };
     };
     "contentful-sdk-core-6.8.0" = {
@@ -17186,13 +17222,13 @@ let
         sha1 = "4829c877e9fe49b3161f3bf3673888e204699860";
       };
     };
-    "convert-source-map-1.7.0" = {
+    "convert-source-map-1.8.0" = {
       name = "convert-source-map";
       packageName = "convert-source-map";
-      version = "1.7.0";
+      version = "1.8.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/convert-source-map/-/convert-source-map-1.7.0.tgz";
-        sha512 = "4FJkXzKXEDB1snCFZlLP4gpC3JILicCpGbzG9f9G7tGqGCzETQ2hWPrcinA9oU4wtf2biUaEH5065UnMeR33oA==";
+        url = "https://registry.npmjs.org/convert-source-map/-/convert-source-map-1.8.0.tgz";
+        sha512 = "+OQdjP49zViI/6i7nIJpA8rAl4sV/JdPfU9nZs3VqOwGIgizICvuN2ru6fMd+4llL0tar18UYJXfZ/TWtmhUjA==";
       };
     };
     "convert-to-ecmascript-compatible-varname-0.1.5" = {
@@ -17447,40 +17483,40 @@ let
         sha512 = "Kb2wC0fvsWfQrgk8HU5lW6U/Lcs8+9aaYcy4ZFc6DDlo4nZ7n70dEgE5rtR0oG6ufKDUnrwfWL1mXR5ljDatrQ==";
       };
     };
-    "core-js-3.14.0" = {
+    "core-js-3.12.0" = {
       name = "core-js";
       packageName = "core-js";
-      version = "3.14.0";
+      version = "3.12.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/core-js/-/core-js-3.14.0.tgz";
-        sha512 = "3s+ed8er9ahK+zJpp9ZtuVcDoFzHNiZsPbNAAE4KXgrRHbjSqqNN6xGSXq6bq7TZIbKj4NLrLb6bJ5i+vSVjHA==";
+        url = "https://registry.npmjs.org/core-js/-/core-js-3.12.0.tgz";
+        sha512 = "SaMnchL//WwU2Ot1hhkPflE8gzo7uq1FGvUJ8GKmi3TOU7rGTHIU+eir1WGf6qOtTyxdfdcp10yPdGZ59sQ3hw==";
       };
     };
-    "core-js-3.8.3" = {
+    "core-js-3.15.0" = {
       name = "core-js";
       packageName = "core-js";
-      version = "3.8.3";
+      version = "3.15.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/core-js/-/core-js-3.8.3.tgz";
-        sha512 = "KPYXeVZYemC2TkNEkX/01I+7yd+nX3KddKwZ1Ww7SKWdI2wQprSgLmrTddT8nw92AjEklTsPBoSdQBhbI1bQ6Q==";
+        url = "https://registry.npmjs.org/core-js/-/core-js-3.15.0.tgz";
+        sha512 = "GUbtPllXMYRzIgHNZ4dTYTcUemls2cni83Q4Q/TrFONHfhcg9oEGOtaGHfb0cpzec60P96UKPvMkjX1jET8rUw==";
       };
     };
-    "core-js-compat-3.14.0" = {
+    "core-js-compat-3.15.0" = {
       name = "core-js-compat";
       packageName = "core-js-compat";
-      version = "3.14.0";
+      version = "3.15.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/core-js-compat/-/core-js-compat-3.14.0.tgz";
-        sha512 = "R4NS2eupxtiJU+VwgkF9WTpnSfZW4pogwKHd8bclWU2sp93Pr5S1uYJI84cMOubJRou7bcfL0vmwtLslWN5p3A==";
+        url = "https://registry.npmjs.org/core-js-compat/-/core-js-compat-3.15.0.tgz";
+        sha512 = "8X6lWsG+s7IfOKzV93a7fRYfWRZobOfjw5V5rrq43Vh/W+V6qYxl7Akalsvgab4PFT/4L/pjQbdBUEM36NXKrw==";
       };
     };
-    "core-js-pure-3.14.0" = {
+    "core-js-pure-3.15.0" = {
       name = "core-js-pure";
       packageName = "core-js-pure";
-      version = "3.14.0";
+      version = "3.15.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/core-js-pure/-/core-js-pure-3.14.0.tgz";
-        sha512 = "YVh+LN2FgNU0odThzm61BsdkwrbrchumFq3oztnE9vTKC4KS2fvnPmcx8t6jnqAyOTCTF4ZSiuK8Qhh7SNcL4g==";
+        url = "https://registry.npmjs.org/core-js-pure/-/core-js-pure-3.15.0.tgz";
+        sha512 = "RO+LFAso8DB6OeBX9BAcEGvyth36QtxYon1OyVsITNVtSKr/Hos0BXZwnsOJ7o+O6KHtK+O+cJIEj9NGg6VwFA==";
       };
     };
     "core-util-is-1.0.2" = {
@@ -17600,13 +17636,13 @@ let
         sha512 = "0Cbj7gyvFVApzpK/uhCtQ/9kE9UnYpxMzaq5nQQC/Dh4iaj5fxp7iEFIullrYwzj8nf0qnsI1Qsx34hAeAebvw==";
       };
     };
-    "cp-file-9.0.0" = {
+    "cp-file-9.1.0" = {
       name = "cp-file";
       packageName = "cp-file";
-      version = "9.0.0";
+      version = "9.1.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/cp-file/-/cp-file-9.0.0.tgz";
-        sha512 = "hNEM3AuZz84zOPgL8ozJ057+DjuD6LpwyYNiyTsLDU71Ke2E3KV909xhGYLK7WQ0srJRwzs/1+bSE1pk/HRC6w==";
+        url = "https://registry.npmjs.org/cp-file/-/cp-file-9.1.0.tgz";
+        sha512 = "3scnzFj/94eb7y4wyXRWwvzLFaQp87yyfTnChIjlfYrVqp5lVO3E2hIJMeQIltUT0K2ZAB3An1qXcBmwGyvuwA==";
       };
     };
     "cpu-percentage-1.0.3" = {
@@ -19481,6 +19517,15 @@ let
         sha1 = "6f6df6b85d7e7c4410a932ffc26489b78e9acd13";
       };
     };
+    "decache-4.6.0" = {
+      name = "decache";
+      packageName = "decache";
+      version = "4.6.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/decache/-/decache-4.6.0.tgz";
+        sha512 = "PppOuLiz+DFeaUvFXEYZjLxAkKiMYH/do/b/MxpDe/8AgKBi5GhZxridoVIbBq72GDbL36e4p0Ce2jTGUwwU+w==";
+      };
+    };
     "decamelize-1.2.0" = {
       name = "decamelize";
       packageName = "decamelize";
@@ -20867,6 +20912,15 @@ let
         sha1 = "ea80b106a87538774e8a3a4a5afe293de489e0a9";
       };
     };
+    "doipjs-0.11.2" = {
+      name = "doipjs";
+      packageName = "doipjs";
+      version = "0.11.2";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/doipjs/-/doipjs-0.11.2.tgz";
+        sha512 = "UZJegmUvMBJS5luh2a64JOVMGO80KdkGY7I9noxr5rmwuiSNzhSy5571DY1z2vacYOrZ1xpxUnlzB0bC9+NiNg==";
+      };
+    };
     "dom-converter-0.2.0" = {
       name = "dom-converter";
       packageName = "dom-converter";
@@ -21236,6 +21290,15 @@ let
         sha512 = "xqnBTVd/E+GxJVrX5/eUJiLYjCGPwMpdL+jGhGU57BvtcA7wwhtHVbXBeUk51kOpW3S7Jn3BQbN9Q1R1Km2qDQ==";
       };
     };
+    "download-8.0.0" = {
+      name = "download";
+      packageName = "download";
+      version = "8.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/download/-/download-8.0.0.tgz";
+        sha512 = "ASRY5QhDk7FK+XrQtQyvhpDKanLluEEQtWl/J7Lxuf/b+i8RYh997QeXvL85xitrmRKVlx9c7eTrcRdq2GS4eA==";
+      };
+    };
     "download-git-repo-1.1.0" = {
       name = "download-git-repo";
       packageName = "download-git-repo";
@@ -22282,6 +22345,15 @@ let
         sha512 = "ooYciCUtfw6/d2w56UVeqHPcoCFAiJdz5XOkYpv/Txl1HMUozpXjz/2RIQgqwKdXNDPSF1W7mJCFse3G+HDyAA==";
       };
     };
+    "es-module-lexer-0.6.0" = {
+      name = "es-module-lexer";
+      packageName = "es-module-lexer";
+      version = "0.6.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-0.6.0.tgz";
+        sha512 = "f8kcHX1ArhllUtb/wVSyvygoKCznIjnxhLxy7TCvIiMdT7fL4ZDTIKaadMe6eLvOXg6Wk02UeoFgUoZ2EKZZUA==";
+      };
+    };
     "es-to-primitive-1.2.1" = {
       name = "es-to-primitive";
       packageName = "es-to-primitive";
@@ -22426,15 +22498,6 @@ let
         sha512 = "p5um32HOTO1kP+w7PRnB+5lQ43Z6muuMuIMffvDN8ZB4GcnjLBV6zGStpbASIMk4DCAvEaamhe2zhyCb/QXXsA==";
       };
     };
-    "esbuild-0.11.10" = {
-      name = "esbuild";
-      packageName = "esbuild";
-      version = "0.11.10";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/esbuild/-/esbuild-0.11.10.tgz";
-        sha512 = "XvGbf+UreVFA24Tlk6sNOqNcvF2z49XAZt4E7A4H80+yqn944QOLTTxaU0lkdYNtZKFiITNea+VxmtrfjvnLPA==";
-      };
-    };
     "esc-exit-2.0.2" = {
       name = "esc-exit";
       packageName = "esc-exit";
@@ -22606,15 +22669,6 @@ let
         sha512 = "S3Rz11i7c8AA5JPv7xAH+dOyq/Cu/VXHiHXBPOU1k/JAM5dXqQPt3qcrhpHSorXmrpu2g0gkIBVXAqCpzfoZIg==";
       };
     };
-    "eslint-7.24.0" = {
-      name = "eslint";
-      packageName = "eslint";
-      version = "7.24.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/eslint/-/eslint-7.24.0.tgz";
-        sha512 = "k9gaHeHiFmGCDQ2rEfvULlSLruz6tgfA8DEn+rY9/oYPFFTlz55mM/Q/Rij1b2Y42jwZiK3lXvNTw6w6TXzcKQ==";
-      };
-    };
     "eslint-7.28.0" = {
       name = "eslint";
       packageName = "eslint";
@@ -22624,6 +22678,15 @@ let
         sha512 = "UMfH0VSjP0G4p3EWirscJEQ/cHqnT/iuH6oNZOB94nBjWbMnhGEPxsZm1eyIW0C/9jLI0Fow4W5DXLjEI7mn1g==";
       };
     };
+    "eslint-7.29.0" = {
+      name = "eslint";
+      packageName = "eslint";
+      version = "7.29.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/eslint/-/eslint-7.29.0.tgz";
+        sha512 = "82G/JToB9qIy/ArBzIWG9xvvwL3R86AlCjtGw+A29OMZDqhTybz/MByORSukGxeI+YPCR4coYyITKk8BFH9nDA==";
+      };
+    };
     "eslint-config-prettier-8.3.0" = {
       name = "eslint-config-prettier";
       packageName = "eslint-config-prettier";
@@ -22633,13 +22696,13 @@ let
         sha512 = "BgZuLUSeKzvlL/VUjx/Yb787VQ26RU3gGjA3iiFvdsp/2bMfVIWUVP7tjxtjS0e+HP409cPlPvNkQloz8C91ew==";
       };
     };
-    "eslint-plugin-no-unsanitized-3.1.4" = {
+    "eslint-plugin-no-unsanitized-3.1.5" = {
       name = "eslint-plugin-no-unsanitized";
       packageName = "eslint-plugin-no-unsanitized";
-      version = "3.1.4";
+      version = "3.1.5";
       src = fetchurl {
-        url = "https://registry.npmjs.org/eslint-plugin-no-unsanitized/-/eslint-plugin-no-unsanitized-3.1.4.tgz";
-        sha512 = "WF1+eZo2Sh+bQNjZuVNwT0dA61zuJORsLh+1Sww7+O6GOPw+WPWIIRfTWNqrmaXaDMhM4SXAqYPcNlhRMiH13g==";
+        url = "https://registry.npmjs.org/eslint-plugin-no-unsanitized/-/eslint-plugin-no-unsanitized-3.1.5.tgz";
+        sha512 = "s/6w++p1590h/H/dE2Wo660bOkaM/3OEK14Y7xm1UT0bafxkKw1Cq0ksjxkxLdH/WWd014DlsLKuD6CyNrR2Dw==";
       };
     };
     "eslint-plugin-prettier-3.4.0" = {
@@ -22660,13 +22723,13 @@ let
         sha512 = "Nhc+oVAHm0uz/PkJAWscwIT4ijTrK5fqNqz9QB1D35SbbuMG1uB6Yr5AJpvPSWg+WOw7nYNswerYh0kOk64gqQ==";
       };
     };
-    "eslint-plugin-vue-7.11.0" = {
+    "eslint-plugin-vue-7.11.1" = {
       name = "eslint-plugin-vue";
       packageName = "eslint-plugin-vue";
-      version = "7.11.0";
+      version = "7.11.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/eslint-plugin-vue/-/eslint-plugin-vue-7.11.0.tgz";
-        sha512 = "Qwo8wilqnOXnG9B5auEiTstyaHefyhHd5lEhhxemwXoWsAxIW2yppzuVudowC5n+qn1nMLNV9TANkTthBK7Waw==";
+        url = "https://registry.npmjs.org/eslint-plugin-vue/-/eslint-plugin-vue-7.11.1.tgz";
+        sha512 = "lbw3vkEAGqYjqd1HpPFWHXtYaS8mILTJ5KOpJfRxO3Fo7o0wCf1zD7vSOasbm6nTA9xIgvZQ4VcyGIzQXxznHw==";
       };
     };
     "eslint-scope-3.7.3" = {
@@ -22732,15 +22795,6 @@ let
         sha512 = "6J72N8UNa462wa/KFODt/PJ3IU60SDpC3QXC1Hjc1BXXpfL2C9R5+AU7jhe0F6GREqVMh4Juu+NY7xn+6dipUQ==";
       };
     };
-    "eslint-visitor-keys-2.0.0" = {
-      name = "eslint-visitor-keys";
-      packageName = "eslint-visitor-keys";
-      version = "2.0.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-2.0.0.tgz";
-        sha512 = "QudtT6av5WXels9WjIM7qz1XD1cWGvX4gGXvp/zBn9nXG02D0utdU3Em2m/QjTnrsk6bBjmCygl3rmj118msQQ==";
-      };
-    };
     "eslint-visitor-keys-2.1.0" = {
       name = "eslint-visitor-keys";
       packageName = "eslint-visitor-keys";
@@ -23011,13 +23065,13 @@ let
         sha512 = "ArJ7x1WcWOlSpzdoTBX8vkwlkSQ85CjjifSZtV4co64vWxSV8geWfPI9x4SVYu3DSxnX4yWFVTtGL+j9DUFLNw==";
       };
     };
-    "ethereum-bloom-filters-1.0.9" = {
+    "ethereum-bloom-filters-1.0.10" = {
       name = "ethereum-bloom-filters";
       packageName = "ethereum-bloom-filters";
-      version = "1.0.9";
+      version = "1.0.10";
       src = fetchurl {
-        url = "https://registry.npmjs.org/ethereum-bloom-filters/-/ethereum-bloom-filters-1.0.9.tgz";
-        sha512 = "GiK/RQkAkcVaEdxKVkPcG07PQ5vD7v2MFSHgZmBJSfMzNRHimntdBithsHAT89tAXnIpzVDWt8iaCD1DvkaxGg==";
+        url = "https://registry.npmjs.org/ethereum-bloom-filters/-/ethereum-bloom-filters-1.0.10.tgz";
+        sha512 = "rxJ5OFN3RwjQxDcFP2Z5+Q9ho4eIdEmSc2ht0fCu8Se9nbXjZ7/031uXoUYJ87KHCOdVeiUuwSnoS7hmYAGVHA==";
       };
     };
     "ethjs-unit-0.1.6" = {
@@ -24514,6 +24568,15 @@ let
         sha512 = "uzk64HRpUZyTGZtVuvrjP0FYxzQrBf4rojot6J65YMEbwBLB0CWm0CLojVpwpmFmxcE/lkvYICgfcGozbBq6rw==";
       };
     };
+    "file-type-11.1.0" = {
+      name = "file-type";
+      packageName = "file-type";
+      version = "11.1.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/file-type/-/file-type-11.1.0.tgz";
+        sha512 = "rM0UO7Qm9K7TWTtA6AShI/t7H5BPjDeGVDaNyg9BjHAj3PysKy7+8C8D137R88jnR3rFJZQB/tFgydl5sN5m7g==";
+      };
+    };
     "file-type-14.7.1" = {
       name = "file-type";
       packageName = "file-type";
@@ -24640,6 +24703,15 @@ let
         sha512 = "ICw7NTT6RsDp2rnYKVd8Fu4cr6ITzGy3+u4vUujPkabyaz+03F24NWEX7fs5fp+kBonlaqPH8fAO2NM+SXt/JA==";
       };
     };
+    "filenamify-3.0.0" = {
+      name = "filenamify";
+      packageName = "filenamify";
+      version = "3.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/filenamify/-/filenamify-3.0.0.tgz";
+        sha512 = "5EFZ//MsvJgXjBAFJ+Bh2YaCTRF/VP1YOmGrgt+KJ4SFRLjI87EIdwLLuT6wQX0I4F9W41xutobzczjsOKlI/g==";
+      };
+    };
     "filenamify-4.1.0" = {
       name = "filenamify";
       packageName = "filenamify";
@@ -25099,13 +25171,13 @@ let
         sha512 = "jlbUu0XkbpXeXhan5xyTqVK1jmEKNxE8hpzznI3TThHTr76GiFwK0iRzhDo4KNy+S9h/KxHaqVhTP86vA6wHCg==";
       };
     };
-    "flow-parser-0.152.0" = {
+    "flow-parser-0.153.0" = {
       name = "flow-parser";
       packageName = "flow-parser";
-      version = "0.152.0";
+      version = "0.153.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/flow-parser/-/flow-parser-0.152.0.tgz";
-        sha512 = "qRXGE3ztuhyI2ovi4Ixwq7/GUYvKX9wmFdwBof2q5pWHteuveexFrlbwZxSonC0dWz2znA6sW+vce4RXgYLnnQ==";
+        url = "https://registry.npmjs.org/flow-parser/-/flow-parser-0.153.0.tgz";
+        sha512 = "qa7UODgbofQyruRWqNQ+KM5hO37CenByxhNfAztiwjBsPhWZ5AFh5g+gtLpTWPlzG7X66QdjBB9DuHNUBcaF+Q==";
       };
     };
     "fluent-ffmpeg-2.1.2" = {
@@ -26476,13 +26548,13 @@ let
         sha1 = "5eff8e3e684d569ae4cb2b1282604e8ba62149fa";
       };
     };
-    "gh-release-fetch-1.1.0" = {
+    "gh-release-fetch-2.0.0" = {
       name = "gh-release-fetch";
       packageName = "gh-release-fetch";
-      version = "1.1.0";
+      version = "2.0.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/gh-release-fetch/-/gh-release-fetch-1.1.0.tgz";
-        sha512 = "c8Vb2g6yzTItFGooCH2yppiwu8BwoWheMAWHl/qor95XcuDjFgqMYw8QUtvR/da+ZII5EYDPonZTypvI2anm4Q==";
+        url = "https://registry.npmjs.org/gh-release-fetch/-/gh-release-fetch-2.0.0.tgz";
+        sha512 = "04eT1dMAW5dUgnb/zkOxXXHTLaQpWuZi1gM93sP6KMHtIqyNsCiALHnljh+aomm90L4t3VkSKaCdwottLgVLwQ==";
       };
     };
     "git-apply-delta-0.0.7" = {
@@ -27062,13 +27134,13 @@ let
         sha512 = "iH9RmgwCmUJHi2z5o2l3eTtGBtXek1OYlHrbcxOYugyHLmAsZrPj43OtHThd62Buh/Vv6VyCBD2bdyWcGNQqoQ==";
       };
     };
-    "globby-11.0.3" = {
+    "globby-11.0.4" = {
       name = "globby";
       packageName = "globby";
-      version = "11.0.3";
+      version = "11.0.4";
       src = fetchurl {
-        url = "https://registry.npmjs.org/globby/-/globby-11.0.3.tgz";
-        sha512 = "ffdmosjA807y7+lA1NM0jELARVmYul/715xiILEjo3hBLPTcirgQNnXECn5g3mtR8TOLCVbkfua1Hpen25/Xcg==";
+        url = "https://registry.npmjs.org/globby/-/globby-11.0.4.tgz";
+        sha512 = "9O4MVG9ioZJ08ffbcyVYyLOJLk5JQ688pJ4eMGLpdWLHq/Wr1D9BlriLQyL0E+jbkuePVZXYFj47QM/v093wHg==";
       };
     };
     "globby-4.1.0" = {
@@ -27224,13 +27296,13 @@ let
         sha512 = "Vric7QFWxzHFxITZ10bmlG1H/5rhODb7hJuWyKWMD8GflpQzRmbMVqkFp3fKvN+U9tPwZItGVhkiOR+84PX3ew==";
       };
     };
-    "google-gax-2.15.0" = {
+    "google-gax-2.15.1" = {
       name = "google-gax";
       packageName = "google-gax";
-      version = "2.15.0";
+      version = "2.15.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/google-gax/-/google-gax-2.15.0.tgz";
-        sha512 = "jfShUgX1DVu+DiOeAcsT5JbWlLdUnb2FsdWRb+Q/pNz6kNAUbmq8sFLB2uaWjlTxoSGHZLfrt3vJ9lpArzzQPA==";
+        url = "https://registry.npmjs.org/google-gax/-/google-gax-2.15.1.tgz";
+        sha512 = "I5j4JRxx1HfZZBXnQs7gUvRHaTqT8XZ6U/QQWI/mDbf05dXP/vLni+ZkDzUh/XHDtIo/MPVkuEUhkwWwi+vwTg==";
       };
     };
     "google-p12-pem-3.1.0" = {
@@ -27449,13 +27521,13 @@ let
         sha512 = "GTCJtzJmkFLWRfFJuoo9RWWa/FfamUHgiFosxi/X1Ani4AVWbeyBenZTNX6dM+7WSbbFfTo/25eh0LLkwHMw2w==";
       };
     };
-    "graphql-15.5.0" = {
+    "graphql-15.5.1" = {
       name = "graphql";
       packageName = "graphql";
-      version = "15.5.0";
+      version = "15.5.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/graphql/-/graphql-15.5.0.tgz";
-        sha512 = "OmaM7y0kaK31NKG31q4YbD2beNYa6jBBKtMFT6gLYJljHLJr42IqJ8KX08u3Li/0ifzTU5HjmoOOrwa5BRLeDA==";
+        url = "https://registry.npmjs.org/graphql/-/graphql-15.5.1.tgz";
+        sha512 = "FeTRX67T3LoE3LWAxxOlW2K3Bz+rMYAC18rRguK4wgXaTZMiJwSUwDmPFo3UadAKbzirKIg5Qy+sNJXbpPRnQw==";
       };
     };
     "graphql-compose-7.25.1" = {
@@ -29448,13 +29520,13 @@ let
         sha1 = "09dfd4ab9d20e29eb1c3e80b8990378df9e3cb9c";
       };
     };
-    "image-size-0.9.7" = {
+    "image-size-1.0.0" = {
       name = "image-size";
       packageName = "image-size";
-      version = "0.9.7";
+      version = "1.0.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/image-size/-/image-size-0.9.7.tgz";
-        sha512 = "KRVgLNZkr00YGN0qn9MlIrmlxbRhsCcEb1Byq3WKGnIV4M48iD185cprRtaoK4t5iC+ym2Q5qlArxZ/V1yzDgA==";
+        url = "https://registry.npmjs.org/image-size/-/image-size-1.0.0.tgz";
+        sha512 = "JLJ6OwBfO1KcA+TvJT+v8gbE6iWbj24LyDNFgFEN0lzegn6cC6a/p3NIDaepMsJjQjlUWqIC7wJv8lBFxPNjcw==";
       };
     };
     "image-type-3.1.0" = {
@@ -30006,22 +30078,22 @@ let
         sha512 = "ON8pEJPPCdyjxj+cxsYRe6XfCJepTxANdNnTebsTuQgXpRyZRRT9t4dJwjRubgmvn20CLSEnozRUayXyM9VTXA==";
       };
     };
-    "inquirer-8.1.0" = {
+    "inquirer-8.1.1" = {
       name = "inquirer";
       packageName = "inquirer";
-      version = "8.1.0";
+      version = "8.1.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/inquirer/-/inquirer-8.1.0.tgz";
-        sha512 = "1nKYPoalt1vMBfCMtpomsUc32wmOoWXAoq3kM/5iTfxyQ2f/BxjixQpC+mbZ7BI0JUXHED4/XPXekDVtJNpXYw==";
+        url = "https://registry.npmjs.org/inquirer/-/inquirer-8.1.1.tgz";
+        sha512 = "hUDjc3vBkh/uk1gPfMAD/7Z188Q8cvTGl0nxwaCdwSbzFh6ZKkZh+s2ozVxbE5G9ZNRyeY0+lgbAIOUFsFf98w==";
       };
     };
-    "inquirer-autocomplete-prompt-1.3.0" = {
+    "inquirer-autocomplete-prompt-1.4.0" = {
       name = "inquirer-autocomplete-prompt";
       packageName = "inquirer-autocomplete-prompt";
-      version = "1.3.0";
+      version = "1.4.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/inquirer-autocomplete-prompt/-/inquirer-autocomplete-prompt-1.3.0.tgz";
-        sha512 = "zvAc+A6SZdcN+earG5SsBu1RnQdtBS4o8wZ/OqJiCfL34cfOx+twVRq7wumYix6Rkdjn1N2nVCcO3wHqKqgdGg==";
+        url = "https://registry.npmjs.org/inquirer-autocomplete-prompt/-/inquirer-autocomplete-prompt-1.4.0.tgz";
+        sha512 = "qHgHyJmbULt4hI+kCmwX92MnSxDs/Yhdt4wPA30qnoa01OF6uTXV8yvH4hKXgdaTNmkZ9D01MHjqKYEuJN+ONw==";
       };
     };
     "inquirer-autosubmit-prompt-0.2.0" = {
@@ -32391,13 +32463,13 @@ let
         sha1 = "bcb4045c8dd0539c134bc1488cdd3e768a7a9e51";
       };
     };
-    "jquery.terminal-2.25.1" = {
+    "jquery.terminal-2.26.0" = {
       name = "jquery.terminal";
       packageName = "jquery.terminal";
-      version = "2.25.1";
+      version = "2.26.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/jquery.terminal/-/jquery.terminal-2.25.1.tgz";
-        sha512 = "I3PlUluRswKZb3UPBtH1UFdyBLLwPwdAJPVheV6xUJdS+0buguXCjn6aqmENWtZiobGGA2wkxCXR2hVQqtMCrw==";
+        url = "https://registry.npmjs.org/jquery.terminal/-/jquery.terminal-2.26.0.tgz";
+        sha512 = "O4LmUt0+32HgP7GEOpxcDE5KDXx7X8Ru0ZcQor662za2WDzRnx+TzJsbtMRuH2qpI8qBRGmimLIQV/wjNlCTXg==";
       };
     };
     "js-base64-2.6.4" = {
@@ -32409,13 +32481,13 @@ let
         sha512 = "pZe//GGmwJndub7ZghVHz7vjb2LgC1m8B07Au3eYqeqv9emhESByMXxaEgkUkEqJe87oBbSniGYoQNIBklc7IQ==";
       };
     };
-    "js-beautify-1.13.13" = {
+    "js-beautify-1.14.0" = {
       name = "js-beautify";
       packageName = "js-beautify";
-      version = "1.13.13";
+      version = "1.14.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/js-beautify/-/js-beautify-1.13.13.tgz";
-        sha512 = "oH+nc0U5mOAqX8M5JO1J0Pw/7Q35sAdOsM5W3i87pir9Ntx6P/5Gx1xLNoK+MGyvHk4rqqRCE4Oq58H6xl2W7A==";
+        url = "https://registry.npmjs.org/js-beautify/-/js-beautify-1.14.0.tgz";
+        sha512 = "yuck9KirNSCAwyNJbqW+BxJqJ0NLJ4PwBUzQQACl5O3qHMBXVkXb/rD0ilh/Lat/tn88zSZ+CAHOlk0DsY7GuQ==";
       };
     };
     "js-git-0.7.8" = {
@@ -32715,13 +32787,13 @@ let
         sha512 = "ChFg5qhvxCaM2bspCqizs48yMtsm5YLHjBoNZLCkbXyc3yMM5l8pnn787B5ww5TI3+tKxKYWkbiKf356kQ1OgQ==";
       };
     };
-    "jsii-srcmak-0.1.280" = {
+    "jsii-srcmak-0.1.288" = {
       name = "jsii-srcmak";
       packageName = "jsii-srcmak";
-      version = "0.1.280";
+      version = "0.1.288";
       src = fetchurl {
-        url = "https://registry.npmjs.org/jsii-srcmak/-/jsii-srcmak-0.1.280.tgz";
-        sha512 = "FKU0HcL+OceiXRpUbdR5XX/7ivUnCpGOVtgRvPJeXjQDdz3Px09sYHKSHGmAgipcoBPtKQ8Vrv+5rGckuQZ+mQ==";
+        url = "https://registry.npmjs.org/jsii-srcmak/-/jsii-srcmak-0.1.288.tgz";
+        sha512 = "AyflsuwbsTyH6fChU9v82eTF74eNN07B8gxzpaB6IQyJPv5EADDR92/FjJKWq1dPM18f6s+GhTPE1DlbhcXrXw==";
       };
     };
     "json-bigint-0.2.3" = {
@@ -33021,13 +33093,13 @@ let
         sha512 = "0/4Lv6IenJV0qj2oBdgPIAmFiKKnh8qh7bmLFJ+/ZZHLjSeiL3fKKGX3UryvKPbxFbhV+JcYo9KUC19GJ/Z/4A==";
       };
     };
-    "json2jsii-0.1.248" = {
+    "json2jsii-0.1.255" = {
       name = "json2jsii";
       packageName = "json2jsii";
-      version = "0.1.248";
+      version = "0.1.255";
       src = fetchurl {
-        url = "https://registry.npmjs.org/json2jsii/-/json2jsii-0.1.248.tgz";
-        sha512 = "aMpcyCpezSOElnI+9fSychrq4wYDCpb3MJOizYkVEVkEeNYiV0ND2qFzYOG+k+cIEzzsQh2EAisCftI5q6vsrQ==";
+        url = "https://registry.npmjs.org/json2jsii/-/json2jsii-0.1.255.tgz";
+        sha512 = "I3BktDqYogR4XQ+O6/AQ//+OHCTeqPGxUTUJ5qiBjzEBxXkdhhYle+7P5GttUKM8YsKbRhDaqigCzY7rU0yGsg==";
       };
     };
     "json3-3.2.6" = {
@@ -34372,6 +34444,15 @@ let
         sha512 = "lzj7oODpX7XS/4qHGBG/VAMirBDK/rbWS8S9pTCSUV9ZknuXg2loCkDyPQuB3vC2MMt1QOsXn4oQUtxpPtSa1g==";
       };
     };
+    "lightning-3.3.11" = {
+      name = "lightning";
+      packageName = "lightning";
+      version = "3.3.11";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/lightning/-/lightning-3.3.11.tgz";
+        sha512 = "bD57EjMVMBplyEMjXDMo8MvBfPymufU81kYbixqrvaLHoqsmyTMwLzqpa4CurJ5YKAXLJw68ZReDzDb6rj90Sg==";
+      };
+    };
     "lightning-3.3.9" = {
       name = "lightning";
       packageName = "lightning";
@@ -34381,6 +34462,15 @@ let
         sha512 = "z/bfkDEAKyN0HtN7rkiyVlDA3J5L/jxXsE4YuGfQPa8TyPWovyLdo6/aHP0mMy8n+G4tq0g2oKZ/1Z5ONJAVqA==";
       };
     };
+    "lilconfig-2.0.3" = {
+      name = "lilconfig";
+      packageName = "lilconfig";
+      version = "2.0.3";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/lilconfig/-/lilconfig-2.0.3.tgz";
+        sha512 = "EHKqr/+ZvdKCifpNrJCKxBTgk5XupZA3y/aCPY9mxfgBzmgh93Mt/WqjjQ38oMxXuvDokaKiM3lAgvSH2sjtHg==";
+      };
+    };
     "limit-spawn-0.0.3" = {
       name = "limit-spawn";
       packageName = "limit-spawn";
@@ -34525,6 +34615,15 @@ let
         sha512 = "X+AFuuw54NEr8UqbkJlEtqkmlpIpmji7BX+bYmYrEOZOtJca7PbaqspVWq+YB9qWw/OiuI76ly67KGTYM0QbCw==";
       };
     };
+    "ln-service-51.8.4" = {
+      name = "ln-service";
+      packageName = "ln-service";
+      version = "51.8.4";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/ln-service/-/ln-service-51.8.4.tgz";
+        sha512 = "8jTfQWtdAJJ2pipprNnUrUUpMxq6wQpT1bhN+ZwyMCdHVo72r58TrFoy0UQsutbgN9OjHMHSsBoyTd5cPmUfWA==";
+      };
+    };
     "ln-sync-0.4.5" = {
       name = "ln-sync";
       packageName = "ln-sync";
@@ -36748,13 +36847,13 @@ let
         sha512 = "EsS89h6l4vbfJEtBZnENTOFk8mCRpY5ru36Xe5bcX1KYIli2mkSHqoFsp5O1wMDvTJJzxe/4THpCTtygjeeGWQ==";
       };
     };
-    "make-fetch-happen-9.0.2" = {
+    "make-fetch-happen-9.0.3" = {
       name = "make-fetch-happen";
       packageName = "make-fetch-happen";
-      version = "9.0.2";
+      version = "9.0.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/make-fetch-happen/-/make-fetch-happen-9.0.2.tgz";
-        sha512 = "UkAWAuXPXSSlVviTjH2We20mtj1NnZW2Qq/oTY2dyMbRQ5CR3Xed3akCDMnM7j6axrMY80lhgM7loNE132PfAw==";
+        url = "https://registry.npmjs.org/make-fetch-happen/-/make-fetch-happen-9.0.3.tgz";
+        sha512 = "uZ/9Cf2vKqsSWZyXhZ9wHHyckBrkntgbnqV68Bfe8zZenlf7D6yuGMXvHZQ+jSnzPkjosuNP1HGasj1J4h8OlQ==";
       };
     };
     "make-iterator-1.0.1" = {
@@ -37162,13 +37261,13 @@ let
         sha512 = "c+yYdCZJQrsRjTPhUx7VKkApw9bwDkNbHUKo1ovgcfDjb2kc8rLuRbIFyXL5WOEUwzSSKo3IXpph2K6DqB/KZg==";
       };
     };
-    "marked-2.0.7" = {
+    "marked-2.1.1" = {
       name = "marked";
       packageName = "marked";
-      version = "2.0.7";
+      version = "2.1.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/marked/-/marked-2.0.7.tgz";
-        sha512 = "BJXxkuIfJchcXOJWTT2DOL+yFWifFv2yGYOUzvXg8Qz610QKw+sHCvTMYwA+qWGhlA2uivBezChZ/pBy1tWdkQ==";
+        url = "https://registry.npmjs.org/marked/-/marked-2.1.1.tgz";
+        sha512 = "5XFS69o9CzDpQDSpUYC+AN2xvq8yl1EGa5SG/GI1hP78/uTeo3PDfiDNmsUyiahpyhToDDJhQk7fNtJsga+KVw==";
       };
     };
     "marked-terminal-3.3.0" = {
@@ -39205,13 +39304,13 @@ let
         sha512 = "USHrRmxzGowUWAGBbJPdFjHzEqtxDU03pLHY0Rfqgtnq+q8FOIs8wvkkf+Udmg77SJKs47y9sI0jJvQeYsmiCA==";
       };
     };
-    "move-file-2.0.0" = {
+    "move-file-2.1.0" = {
       name = "move-file";
       packageName = "move-file";
-      version = "2.0.0";
+      version = "2.1.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/move-file/-/move-file-2.0.0.tgz";
-        sha512 = "cdkdhNCgbP5dvS4tlGxZbD+nloio9GIimP57EjqFhwLcMjnU+XJKAZzlmg/TN/AK1LuNAdTSvm3CPPP4Xkv0iQ==";
+        url = "https://registry.npmjs.org/move-file/-/move-file-2.1.0.tgz";
+        sha512 = "i9qLW6gqboJ5Ht8bauZi7KlTnQ3QFpBCvMvFfEcHADKgHGeJ9BZMO7SFCTwHPV9Qa0du9DYY1Yx3oqlGt30nXA==";
       };
     };
     "mp4-box-encoding-1.4.1" = {
@@ -40232,13 +40331,13 @@ let
         sha512 = "Gd1aexpJ3RrOzkssdE8ipS67PuppOAkJNhRqQPp2in2XnJKPm5kvYonYMNVadasSFlNdmVCk9nELV3TnbAfklw==";
       };
     };
-    "netlify-redirect-parser-5.1.1" = {
+    "netlify-redirect-parser-7.0.0" = {
       name = "netlify-redirect-parser";
       packageName = "netlify-redirect-parser";
-      version = "5.1.1";
+      version = "7.0.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/netlify-redirect-parser/-/netlify-redirect-parser-5.1.1.tgz";
-        sha512 = "TDJShXyaMwQaVtzWjK6U1UAWzWHnFzTVULAduaGroVlQha5Hi6WaRCZLg64FvQx4MUMOH8qOgSyByCqIMXqZWA==";
+        url = "https://registry.npmjs.org/netlify-redirect-parser/-/netlify-redirect-parser-7.0.0.tgz";
+        sha512 = "O+4b18XZG1Y8Jaki02T58xRFoEAXIH4qxMSlhQXd8qP5WPIicwcQKylC4fdoA2+puQzGkXvEY9Yc5jn8Zpb2pQ==";
       };
     };
     "netlify-redirector-0.2.1" = {
@@ -40746,6 +40845,15 @@ let
         sha512 = "h/zcD8H9kaDZ9ALUWwlBUDo6TKF8a7qBSCSEGfjTVIYeqsioSKaAX+BN7NgiMGp6iSIXZ3PxgCu8KS3b71YK5Q==";
       };
     };
+    "node-localstorage-1.3.1" = {
+      name = "node-localstorage";
+      packageName = "node-localstorage";
+      version = "1.3.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/node-localstorage/-/node-localstorage-1.3.1.tgz";
+        sha512 = "NMWCSWWc6JbHT5PyWlNT2i8r7PgGYXVntmKawY83k/M0UJScZ5jirb61TLnqKwd815DfBQu+lR3sRw08SPzIaQ==";
+      };
+    };
     "node-modules-regexp-1.0.0" = {
       name = "node-modules-regexp";
       packageName = "node-modules-regexp";
@@ -40782,13 +40890,13 @@ let
         sha512 = "fPNFIp2hF/Dq7qLDzSg4vZ0J4e9v60gJR+Qx7RbjbWqzPDdEqeVpEx5CFeDAELIl+A/woaaNn1fQ5nEVerMxJg==";
       };
     };
-    "node-object-hash-2.3.3" = {
+    "node-object-hash-2.3.7" = {
       name = "node-object-hash";
       packageName = "node-object-hash";
-      version = "2.3.3";
+      version = "2.3.7";
       src = fetchurl {
-        url = "https://registry.npmjs.org/node-object-hash/-/node-object-hash-2.3.3.tgz";
-        sha512 = "KdQsVgu0QoU3ycGidQLcULQdJudW2dizlxJvb2ntV4zxn1oBe7FYBcOO//qIza6oPM1xNwj7Y+rsWxiGPWekOw==";
+        url = "https://registry.npmjs.org/node-object-hash/-/node-object-hash-2.3.7.tgz";
+        sha512 = "ybV3ZKZZoHJPSelxgRY5LYRHQToMtxvJxNbkY8WtWCy5Z/t3V0gyy/6O6kGoh0PrzZIATxVVDG2q+eM6iZMjKQ==";
       };
     };
     "node-persist-2.1.0" = {
@@ -41349,13 +41457,13 @@ let
         sha512 = "6Eem455JsSMJY6Kpd3EyWE+n5hC+g9bSyHr9K9U2zqZb7+02+hObQ2c0+8iDk/mNF+8r1MhY44WypKJAkySIYA==";
       };
     };
-    "npm-package-arg-8.1.4" = {
+    "npm-package-arg-8.1.5" = {
       name = "npm-package-arg";
       packageName = "npm-package-arg";
-      version = "8.1.4";
+      version = "8.1.5";
       src = fetchurl {
-        url = "https://registry.npmjs.org/npm-package-arg/-/npm-package-arg-8.1.4.tgz";
-        sha512 = "xLokoCFqj/rPdr3LvcdDL6Kj6ipXGEDHD/QGpzwU6/pibYUOXmp5DBmg76yukFyx4ZDbrXNOTn+BPyd8TD4Jlw==";
+        url = "https://registry.npmjs.org/npm-package-arg/-/npm-package-arg-8.1.5.tgz";
+        sha512 = "LhgZrg0n0VgvzVdSm1oiZworPbTxYHUJCgtsJW8mGvlDpxTM1vSJc3m5QZeUkhAHIzbz3VCHd/R4osi1L1Tg/Q==";
       };
     };
     "npm-packlist-1.4.8" = {
@@ -41673,13 +41781,13 @@ let
         sha512 = "2yucenq1a9YPmeNExoUa9Qwrt9RFkjqaMAA1X+U7sbb0AqBeTIdMHky9SQQ6iN94bO5NW0W4TRYXerG+BdAvAQ==";
       };
     };
-    "oas-validator-5.0.6" = {
+    "oas-validator-5.0.7" = {
       name = "oas-validator";
       packageName = "oas-validator";
-      version = "5.0.6";
+      version = "5.0.7";
       src = fetchurl {
-        url = "https://registry.npmjs.org/oas-validator/-/oas-validator-5.0.6.tgz";
-        sha512 = "bI+gyr3MiG/4Q5Ibvg0R77skVWS882gFMkxwB1p6qY7Rc4p7EoDezFVfondjYhJDPDnB1ZD7Aqj7AWROAsMBZg==";
+        url = "https://registry.npmjs.org/oas-validator/-/oas-validator-5.0.7.tgz";
+        sha512 = "gtOjKWQMVeOBIuioguaXA7sMXfJ9q4efHDFo3kmcy9HZEtmGla3aptQK0LZG1AhOX9zambKUwH72kqgoIJa0Fg==";
       };
     };
     "oauth-0.9.15" = {
@@ -41989,13 +42097,13 @@ let
         sha512 = "tZgUiKLraVH+4OAedBYrr4/K6KmAQw2RPNd1AuNdhLsuz5WP3VB7WuiKBWbOcjeqqAjus2ChIIWC8dSfmg7ReA==";
       };
     };
-    "objectorarray-1.0.4" = {
+    "objectorarray-1.0.5" = {
       name = "objectorarray";
       packageName = "objectorarray";
-      version = "1.0.4";
+      version = "1.0.5";
       src = fetchurl {
-        url = "https://registry.npmjs.org/objectorarray/-/objectorarray-1.0.4.tgz";
-        sha512 = "91k8bjcldstRz1bG6zJo8lWD7c6QXcB4nTDUqiEvIL1xAsLoZlOOZZG+nd6YPz+V7zY1580J4Xxh1vZtyv4i/w==";
+        url = "https://registry.npmjs.org/objectorarray/-/objectorarray-1.0.5.tgz";
+        sha512 = "eJJDYkhJFFbBBAxeh8xW+weHlkI28n2ZdQV/J/DNfWfSKlGEf2xcfAbZTv3riEXHAhL9SVOTs2pRmXiSTf78xg==";
       };
     };
     "observ-0.2.0" = {
@@ -42052,13 +42160,13 @@ let
         sha512 = "0HGaSR/E/seIhSzFxLkh0QqckuNSre4iGqSElZRUv1hVHH2YgrZ7xtQL9McwL8o1fh6HqkzykjUx0Iy2haVIUg==";
       };
     };
-    "office-ui-fabric-react-7.170.3" = {
+    "office-ui-fabric-react-7.172.0" = {
       name = "office-ui-fabric-react";
       packageName = "office-ui-fabric-react";
-      version = "7.170.3";
+      version = "7.172.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/office-ui-fabric-react/-/office-ui-fabric-react-7.170.3.tgz";
-        sha512 = "jpgvc2OQAf8vB35v0LeO0m23HDHBUkd5uQP03YAULXEyb8usBjyPN0R8O+PEEBsmtn/UIcPlB14xUof9S0MsuQ==";
+        url = "https://registry.npmjs.org/office-ui-fabric-react/-/office-ui-fabric-react-7.172.0.tgz";
+        sha512 = "L0cRUZ95mnsq/Gj5h0E+qpzj0KelI2c5UPE9sijx/P2QaW0hE7cuDZ2BtNqJFQ/KhOZ4CQqZgPRUZa+xc9LukA==";
       };
     };
     "omggif-1.0.10" = {
@@ -42322,13 +42430,13 @@ let
         sha512 = "jB5hAtsDOhCy/FNQJwQJOrGlxLUat482Yr14rbA5l2Zb1eOeoS+ccQPO036C1+z9VDBTmOZqzh1tBbI4myzIYw==";
       };
     };
-    "open-8.2.0" = {
+    "open-8.2.1" = {
       name = "open";
       packageName = "open";
-      version = "8.2.0";
+      version = "8.2.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/open/-/open-8.2.0.tgz";
-        sha512 = "O8uInONB4asyY3qUcEytpgwxQG3O0fJ/hlssoUHsBboOIRVZzT6Wq+Rwj5nffbeUhOdMjpXeISpDDzHCMRDuOQ==";
+        url = "https://registry.npmjs.org/open/-/open-8.2.1.tgz";
+        sha512 = "rXILpcQlkF/QuFez2BJDf3GsqpjGKbkUUToAIGo9A0Q6ZkoSGogZJulrUdwRkrAsoQvoZsrjCYt8+zblOk7JQQ==";
       };
     };
     "openapi-default-setter-2.1.0" = {
@@ -42574,6 +42682,15 @@ let
         sha512 = "ljI4GE6p4RYn9dLftlXw6TvlA+untAkoWBRpj4qIB4AJQWcDZ2lOVOJQ2tq346ok38mtGDBYRBvp3Q+AsuCBnQ==";
       };
     };
+    "openpgp-4.10.10" = {
+      name = "openpgp";
+      packageName = "openpgp";
+      version = "4.10.10";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/openpgp/-/openpgp-4.10.10.tgz";
+        sha512 = "Ub48OogGPjNsr0G/wnJ/SyAQzt/tfcXZTWVZdjKFpXCQV1Ca+upFdSPPkBlGG3lb9EQGOKZJ2tzYNH6ZyKMkDQ==";
+      };
+    };
     "opentracing-0.14.5" = {
       name = "opentracing";
       packageName = "opentracing";
@@ -43492,13 +43609,13 @@ let
         sha1 = "ad1f22ce1bf0fdc0d6ddd908af17f351a404b8ac";
       };
     };
-    "paid-services-1.1.0" = {
+    "paid-services-2.0.0" = {
       name = "paid-services";
       packageName = "paid-services";
-      version = "1.1.0";
+      version = "2.0.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/paid-services/-/paid-services-1.1.0.tgz";
-        sha512 = "+fpRfH9z0kzUzj+Gt4F/avFxyUMH486HZRlVHal48wJRbQO5yQoc8ABGkg9PFxeRFTgsSCJfN7kFwP9TQSsfXw==";
+        url = "https://registry.npmjs.org/paid-services/-/paid-services-2.0.0.tgz";
+        sha512 = "Z79YC8641Zd58D7tSoQayRdEiMbPUyxs88R5z8Wc66P8eUJKxAiKxo3QLxrx+3bDwI90RylZBVkYY7usAu6Tng==";
       };
     };
     "pako-0.2.9" = {
@@ -44770,13 +44887,13 @@ let
         sha1 = "2135d6dfa7a358c069ac9b178776288228450ffa";
       };
     };
-    "pino-6.11.2" = {
+    "pino-6.11.3" = {
       name = "pino";
       packageName = "pino";
-      version = "6.11.2";
+      version = "6.11.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/pino/-/pino-6.11.2.tgz";
-        sha512 = "bmzxwbrIPxQUlAuMkF4PWVErUGERU4z37HazlhflKFg08crsNE3fACGN6gPwg5xtKOK47Ux5cZm8YCuLV4wWJg==";
+        url = "https://registry.npmjs.org/pino/-/pino-6.11.3.tgz";
+        sha512 = "drPtqkkSf0ufx2gaea3TryFiBHdNIdXKf5LN0hTM82SXI4xVIve2wLwNg92e1MT6m3jASLu6VO7eGY6+mmGeyw==";
       };
     };
     "pino-std-serializers-3.2.0" = {
@@ -45230,22 +45347,22 @@ let
         sha512 = "BebJSIUMwJHRH0HAQoxN4u1CN86glsrwsW0q7T+/m44eXOUAxSNdHRkNZPYz5vVUbg17hFgOQDE7fZk7li3pZw==";
       };
     };
-    "postcss-8.2.10" = {
+    "postcss-8.3.4" = {
       name = "postcss";
       packageName = "postcss";
-      version = "8.2.10";
+      version = "8.3.4";
       src = fetchurl {
-        url = "https://registry.npmjs.org/postcss/-/postcss-8.2.10.tgz";
-        sha512 = "b/h7CPV7QEdrqIxtAf2j31U5ef05uBDuvoXv6L51Q4rcS1jdlXAVKJv+atCFdUXYl9dyTHGyoMzIepwowRJjFw==";
+        url = "https://registry.npmjs.org/postcss/-/postcss-8.3.4.tgz";
+        sha512 = "/tZY0PXExXXnNhKv3TOvZAOUYRyuqcCbBm2c17YMDK0PlVII3K7/LKdt3ScHL+hhouddjUWi+1sKDf9xXW+8YA==";
       };
     };
-    "postcss-8.3.2" = {
+    "postcss-8.3.5" = {
       name = "postcss";
       packageName = "postcss";
-      version = "8.3.2";
+      version = "8.3.5";
       src = fetchurl {
-        url = "https://registry.npmjs.org/postcss/-/postcss-8.3.2.tgz";
-        sha512 = "y1FK/AWdZlBF5lusS5j5l4/vF67+vQZt1SXPVJ32y1kRGDQyrs1zk32hG1cInRTu14P0V+orPz+ifwW/7rR4bg==";
+        url = "https://registry.npmjs.org/postcss/-/postcss-8.3.5.tgz";
+        sha512 = "NxTuJocUhYGsMiMFHDUkmjSKT3EdH4/WbGF6GCi1NDGk+vbcUTun4fpbOqaPtD8IIsztA2ilZm2DhYCuyN58gA==";
       };
     };
     "postcss-calc-7.0.5" = {
@@ -45365,13 +45482,13 @@ let
         sha512 = "/rDeGV6vMUo3mwJZmeHfEDvwnTKKqQ0S7OHUi/kJvvtx3aWtyWG2/0ZWnzCt2keEclwN6Tf0DST2v9kITdOKYw==";
       };
     };
-    "postcss-load-config-3.0.1" = {
+    "postcss-load-config-3.1.0" = {
       name = "postcss-load-config";
       packageName = "postcss-load-config";
-      version = "3.0.1";
+      version = "3.1.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/postcss-load-config/-/postcss-load-config-3.0.1.tgz";
-        sha512 = "/pDHe30UYZUD11IeG8GWx9lNtu1ToyTsZHnyy45B4Mrwr/Kb6NgYl7k753+05CJNKnjbwh4975amoPJ+TEjHNQ==";
+        url = "https://registry.npmjs.org/postcss-load-config/-/postcss-load-config-3.1.0.tgz";
+        sha512 = "ipM8Ds01ZUophjDTQYSVP70slFSYg3T0/zyfII5vzhN6V57YSxMgG5syXuwi5VtS8wSf3iL30v0uBdoIVx4Q0g==";
       };
     };
     "postcss-loader-3.0.0" = {
@@ -46067,13 +46184,13 @@ let
         sha512 = "GbK2cP9nraSSUF9N2XwUwqfzlAFlMNYYl+ShE/V+H8a9uNl/oUqB1w2EL54Jh0OlyRSd8RfWYJ3coVS4TROP2w==";
       };
     };
-    "prettier-plugin-svelte-2.3.0" = {
+    "prettier-plugin-svelte-2.3.1" = {
       name = "prettier-plugin-svelte";
       packageName = "prettier-plugin-svelte";
-      version = "2.3.0";
+      version = "2.3.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/prettier-plugin-svelte/-/prettier-plugin-svelte-2.3.0.tgz";
-        sha512 = "HTzXvSq7lWFuLsSaxYOUkGkVNCl3RrSjDCOgQjkBX5FQGmWjL8o3IFACSGhjPMMfWKADpapAr0zdbBWkND9mqw==";
+        url = "https://registry.npmjs.org/prettier-plugin-svelte/-/prettier-plugin-svelte-2.3.1.tgz";
+        sha512 = "F1/r6OYoBq8Zgurhs1MN25tdrhPw0JW5JjioPRqpxbYdmrZ3gY/DzHGs0B6zwd4DLyRsfGB2gqhxUCbHt/D1fw==";
       };
     };
     "prettier-stylelint-0.4.2" = {
@@ -46193,13 +46310,13 @@ let
         sha512 = "973driJZvxiGOQ5ONsFhOF/DtzPMOMtgC11kCpUrPGMTgqp2q/1gwzCquocrN33is0VZ5GFHXZYMM9l6h67v2Q==";
       };
     };
-    "pretty-quick-3.1.0" = {
+    "pretty-quick-3.1.1" = {
       name = "pretty-quick";
       packageName = "pretty-quick";
-      version = "3.1.0";
+      version = "3.1.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/pretty-quick/-/pretty-quick-3.1.0.tgz";
-        sha512 = "DtxIxksaUWCgPFN7E1ZZk4+Aav3CCuRdhrDSFZENb404sYMtuo9Zka823F+Mgeyt8Zt3bUiCjFzzWYE9LYqkmQ==";
+        url = "https://registry.npmjs.org/pretty-quick/-/pretty-quick-3.1.1.tgz";
+        sha512 = "ZYLGiMoV2jcaas3vTJrLvKAYsxDoXQBUn8OSTxkl67Fyov9lyXivJTl0+2WVh+y6EovGcw7Lm5ThYpH+Sh3XxQ==";
       };
     };
     "pretty-time-1.1.0" = {
@@ -46310,6 +46427,15 @@ let
         sha512 = "BO8oZu/KY6Z3ZquoEOJSvsUWFTNbGb5K8M+oZCMqT2VFaqceJ33TZJLF+qEAHIFIALagd4jHaKMg2V043ltotQ==";
       };
     };
+    "proc-log-1.0.0" = {
+      name = "proc-log";
+      packageName = "proc-log";
+      version = "1.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/proc-log/-/proc-log-1.0.0.tgz";
+        sha512 = "aCk8AO51s+4JyuYGg3Q/a6gnrlDO09NpVWePtjp7xwphcoQ04x5WAfCyugcsbLooWcMJ87CLkD4+604IckEdhg==";
+      };
+    };
     "process-0.10.1" = {
       name = "process";
       packageName = "process";
@@ -47804,13 +47930,13 @@ let
         sha1 = "15931d3cd967ade52206f523aa7331aef7d43af7";
       };
     };
-    "pyright-1.1.148" = {
+    "pyright-1.1.151" = {
       name = "pyright";
       packageName = "pyright";
-      version = "1.1.148";
+      version = "1.1.151";
       src = fetchurl {
-        url = "https://registry.npmjs.org/pyright/-/pyright-1.1.148.tgz";
-        sha512 = "cM1Bs/5XSqqfaTfl+zSvXvrq1YMUYOmo2QGBqZ4Cczq0hDo4oJAihzszJONO9H5riTgmEduid5aU3Rpkx+Y/xw==";
+        url = "https://registry.npmjs.org/pyright/-/pyright-1.1.151.tgz";
+        sha512 = "R/Zr6VqXghuFLm7y3a8HoCrA+mfy+Zp+mp6P8gFZeJO9Rl1kQLJhfc/y4QKSQHZWxXOBGo+AFDi/rWLZfNBEgQ==";
       };
     };
     "q-0.9.7" = {
@@ -48092,13 +48218,13 @@ let
         sha512 = "NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==";
       };
     };
-    "quick-format-unescaped-4.0.1" = {
+    "quick-format-unescaped-4.0.3" = {
       name = "quick-format-unescaped";
       packageName = "quick-format-unescaped";
-      version = "4.0.1";
+      version = "4.0.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/quick-format-unescaped/-/quick-format-unescaped-4.0.1.tgz";
-        sha512 = "RyYpQ6Q5/drsJyOhrWHYMWTedvjTIat+FTwv0K4yoUxzvekw2aRHMQJLlnvt8UantkZg2++bEzD9EdxXqkWf4A==";
+        url = "https://registry.npmjs.org/quick-format-unescaped/-/quick-format-unescaped-4.0.3.tgz";
+        sha512 = "MaL/oqh02mhEo5m5J2rwsVL23Iw2PEaGVHgT2vFt8AAsr0lfvQA5dpXo9TPu0rz7tSBdUPgkbam0j/fj5ZM8yg==";
       };
     };
     "quick-lru-1.1.0" = {
@@ -48497,6 +48623,15 @@ let
         sha512 = "//LRTblJEcqbmmro1GCmZ39qZXD+JqzuD8Y5/IZU3Dhp3A1Yr0Xn68ks8MQ6qKfKvYCWDveUmRDKDA40c+sCXw==";
       };
     };
+    "rc4-0.1.5" = {
+      name = "rc4";
+      packageName = "rc4";
+      version = "0.1.5";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/rc4/-/rc4-0.1.5.tgz";
+        sha1 = "08c6e04a0168f6eb621c22ab6cb1151bd9f4a64d";
+      };
+    };
     "rcedit-2.3.0" = {
       name = "rcedit";
       packageName = "rcedit";
@@ -49388,13 +49523,13 @@ let
         sha512 = "lv0M6+TkDVniA3aD1Eg0DVpfU/booSu7Eev3TDO/mZKHBfVjgCGTV4t4buppESEYDtkArYFOxTJWv6S5C+iaNw==";
       };
     };
-    "regexpp-3.1.0" = {
+    "regexpp-3.2.0" = {
       name = "regexpp";
       packageName = "regexpp";
-      version = "3.1.0";
+      version = "3.2.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/regexpp/-/regexpp-3.1.0.tgz";
-        sha512 = "ZOIzd8yVsQQA7j8GCSlPGXwg5PfmA1mrq0JP4nGhh54LaKN3xdai/vHUDu74pKwV8OxseMS65u2NImosQcSD0Q==";
+        url = "https://registry.npmjs.org/regexpp/-/regexpp-3.2.0.tgz";
+        sha512 = "pq2bWo9mVD43nbts2wGv17XLiNLya+GklZ8kaDLV2Z08gDCsGpnKn9BFMepvWuHCbyVvY7J5o5+BVvoQbmlJLg==";
       };
     };
     "regexpu-core-4.7.1" = {
@@ -50648,13 +50783,13 @@ let
         sha512 = "/2HA0Ec70TvQnXdzynFffkjA6XN+1e2pEv/uKS5Ulca40g2L7KuOE3riasHoNVHOsFD5KKZgDsMk1CP3Tw9s+A==";
       };
     };
-    "rollup-2.51.2" = {
+    "rollup-2.52.2" = {
       name = "rollup";
       packageName = "rollup";
-      version = "2.51.2";
+      version = "2.52.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/rollup/-/rollup-2.51.2.tgz";
-        sha512 = "ReV2eGEadA7hmXSzjxdDKs10neqH2QURf2RxJ6ayAlq93ugy6qIvXMmbc5cWMGCDh1h5T4thuWO1e2VNbMq8FA==";
+        url = "https://registry.npmjs.org/rollup/-/rollup-2.52.2.tgz";
+        sha512 = "4RlFC3k2BIHlUsJ9mGd8OO+9Lm2eDF5P7+6DNQOp5sx+7N/1tFM01kELfbxlMX3MxT6owvLB1ln4S3QvvQlbUA==";
       };
     };
     "rollup-plugin-babel-4.4.0" = {
@@ -51143,13 +51278,13 @@ let
         sha512 = "y/52Mcy7aw3gRm7IrcGDFx/bCk4AhRh2eI9luHOQM86nZsqwiRkkq2GekHXBBD+SmPidc8i2PqtYZl+pWJ8Oeg==";
       };
     };
-    "sass-1.34.1" = {
+    "sass-1.35.1" = {
       name = "sass";
       packageName = "sass";
-      version = "1.34.1";
+      version = "1.35.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/sass/-/sass-1.34.1.tgz";
-        sha512 = "scLA7EIZM+MmYlej6sdVr0HRbZX5caX5ofDT9asWnUJj21oqgsC+1LuNfm0eg+vM0fCTZHhwImTiCU0sx9h9CQ==";
+        url = "https://registry.npmjs.org/sass/-/sass-1.35.1.tgz";
+        sha512 = "oCisuQJstxMcacOPmxLNiLlj4cUyN2+8xJnG7VanRoh2GOLr9RqkvI4AxA4a6LHVg/rsu+PmxXeGhrdSF9jCiQ==";
       };
     };
     "sax-0.5.8" = {
@@ -52160,13 +52295,13 @@ let
         sha1 = "3ff21f198cad2175f9f3b781853fd94d0d19b590";
       };
     };
-    "sign-addon-3.3.0" = {
+    "sign-addon-3.5.0" = {
       name = "sign-addon";
       packageName = "sign-addon";
-      version = "3.3.0";
+      version = "3.5.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/sign-addon/-/sign-addon-3.3.0.tgz";
-        sha512 = "TZNZfxRb5jnNcGI8gbyGvaI3kLw+M0O9p7yas2eTu3WpLZ66Wy+FAhYOccgpeQQAcKtwf4WaSnfPKYTBBWWiDQ==";
+        url = "https://registry.npmjs.org/sign-addon/-/sign-addon-3.5.0.tgz";
+        sha512 = "Mc/Cg9P10Zyz8cnz8jSuvUDBnoY6rPExQf1vZvH4l5rfLZCLZVaLhJQ40QOAnbu8sE4TD2VzqB9Zogq7nTPrVA==";
       };
     };
     "signal-exit-3.0.3" = {
@@ -52250,13 +52385,13 @@ let
         sha512 = "rohCHmEjD/ESXFLxF4bVeqgdb4Awc65ZyyuCKl3f7BvgMbZOBa/Ye3HN/GFnvruiUOAWWNupxhz3Rz5/3vJLTg==";
       };
     };
-    "simple-git-2.39.1" = {
+    "simple-git-2.40.0" = {
       name = "simple-git";
       packageName = "simple-git";
-      version = "2.39.1";
+      version = "2.40.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/simple-git/-/simple-git-2.39.1.tgz";
-        sha512 = "+kEAkyQHsWejYxQNCzTrjvCxJOcijpB49RSs7HV+TK9B9prUq7YBNpFstQvjfGBn4Hecywp4tm+breGGGHlHwA==";
+        url = "https://registry.npmjs.org/simple-git/-/simple-git-2.40.0.tgz";
+        sha512 = "7IO/eQwrN5kvS38TTu9ljhG9tx2nn0BTqZOmqpPpp51TvE44YIvLA6fETqEVA8w/SeEfPaVv6mk7Tsk9Jns+ag==";
       };
     };
     "simple-markdown-0.4.4" = {
@@ -53069,13 +53204,13 @@ let
         sha512 = "kLQ9N5ucj8uIcxrDwjm0Jsqk06xdpBjGNQtpXy4Q8/QY2k+fY7nZH8CARy+hkbG+SGAovmzzuauCpBlb8FrnBA==";
       };
     };
-    "socks-proxy-agent-5.0.0" = {
+    "socks-proxy-agent-5.0.1" = {
       name = "socks-proxy-agent";
       packageName = "socks-proxy-agent";
-      version = "5.0.0";
+      version = "5.0.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-5.0.0.tgz";
-        sha512 = "lEpa1zsWCChxiynk+lCycKuC502RxDWLKJZoIhnxrWNjLSDGYRFflHA1/228VkRcnv9TIb8w98derGbpKxJRgA==";
+        url = "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-5.0.1.tgz";
+        sha512 = "vZdmnjb9a2Tz6WEQVIurybSwElwPxMZaIc7PzqbJTrezcKNznv6giT7J7tZDZ1BojVaa1jvO/UiUdhDVB0ACoQ==";
       };
     };
     "socks5-client-1.2.8" = {
@@ -53879,13 +54014,13 @@ let
         sha512 = "pJAFizB6OcuJLX4RJJuU9HWyPwM2CqLi/vs08lhVIR3TGxacxpavvK5LzbxT+Y3iWkBchOTKS5hHCigA5aaung==";
       };
     };
-    "ssb-db2-2.1.2" = {
+    "ssb-db2-2.1.3" = {
       name = "ssb-db2";
       packageName = "ssb-db2";
-      version = "2.1.2";
+      version = "2.1.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/ssb-db2/-/ssb-db2-2.1.2.tgz";
-        sha512 = "FrH++v1qyoCVq9ykuyjvzvsjNEX8mpqY8DRt0bOvIENOeWTWHCA6AXlP8d6LU39CGlwjw6ftlZr4ObizYH4zSQ==";
+        url = "https://registry.npmjs.org/ssb-db2/-/ssb-db2-2.1.3.tgz";
+        sha512 = "neA96dzAzxuH5/btqtbZ3h3RoWVdAT4b8rJrK/oZPfaOHMkQHL75IBuviTqkgfXoMqx1exegt4AI4bVroCJPmg==";
       };
     };
     "ssb-ebt-5.6.7" = {
@@ -54158,13 +54293,13 @@ let
         sha512 = "zZ/Q1M+9ZWlrchgh4QauD/MEUFa6eC6H6FYq6T8Of/y82JqsQBLwN6YlzbO09evE7Rx6x0oliXDCnQSjwGwQRA==";
       };
     };
-    "sscaff-1.2.0" = {
+    "sscaff-1.2.8" = {
       name = "sscaff";
       packageName = "sscaff";
-      version = "1.2.0";
+      version = "1.2.8";
       src = fetchurl {
-        url = "https://registry.npmjs.org/sscaff/-/sscaff-1.2.0.tgz";
-        sha512 = "Xyf2tWLnO0Z297FKag0e8IXFIpnYRWZ3FBn4dN2qlMRsOcpf0P54FPhvdcb1Es0Fm4hbhYYXa23jR+VPGPQhSg==";
+        url = "https://registry.npmjs.org/sscaff/-/sscaff-1.2.8.tgz";
+        sha512 = "7cbC6S1FMmMbQqqdg51+9roaDE+g0ynHA3flW4vQl4zAq9nHvK4kXKr3qptmfAIaU6rLHKsP/ZsLfQCAouWgTw==";
       };
     };
     "ssh-config-1.1.6" = {
@@ -55796,13 +55931,13 @@ let
         sha512 = "Zx1/xLeGOIBlZMGPRCaXtlMe4ZA0faato5Dc3CosEqwu75MIEPuOstdkH6cy+RYTUYynoxzNaDxkPX4DbrPwRA==";
       };
     };
-    "svelte2tsx-0.2.1" = {
+    "svelte2tsx-0.3.0" = {
       name = "svelte2tsx";
       packageName = "svelte2tsx";
-      version = "0.2.1";
+      version = "0.3.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/svelte2tsx/-/svelte2tsx-0.2.1.tgz";
-        sha512 = "3JNUm+rRz0BYwO53NDEqpswW3wU2uvKtpIBjrFbizso8HJpjHM1NCFyXvVfdeM9vG7xH6oh3n0G0tE9noAomKA==";
+        url = "https://registry.npmjs.org/svelte2tsx/-/svelte2tsx-0.3.0.tgz";
+        sha512 = "q3Ss5Fd/PlaMlb61fNtFeKZCzc3rpkHsdLQEiYoRTOqhGqFPjTE8BD287uevtPh5NdouC1RX8u0i6Bv63zrBXA==";
       };
     };
     "sver-compat-1.5.0" = {
@@ -55958,13 +56093,13 @@ let
         sha512 = "BklniOBPlvZ6M9oGkhUwOf5HvxhkHBIycXN3ndju8WlLmi1xfMSdOA2AR6pNswlwURzsZUe1rh80aUyjnpD+Zw==";
       };
     };
-    "swagger2openapi-7.0.6" = {
+    "swagger2openapi-7.0.7" = {
       name = "swagger2openapi";
       packageName = "swagger2openapi";
-      version = "7.0.6";
+      version = "7.0.7";
       src = fetchurl {
-        url = "https://registry.npmjs.org/swagger2openapi/-/swagger2openapi-7.0.6.tgz";
-        sha512 = "VIT414koe0eJqre0KrhNMUB7QEUfPjGAKesPZZosIKr2rxZ6vpUoersHUFNOsN/OZ5u2zsniCslBOwVcmQZwlg==";
+        url = "https://registry.npmjs.org/swagger2openapi/-/swagger2openapi-7.0.7.tgz";
+        sha512 = "uQMHn9Q1gOte13xarNTRtK00K3VgoLydwB3QMHcEptp8e8Q/idynMq+n1gTTf6U9BVcjfrbKXUpfyv/z/RLvQA==";
       };
     };
     "sway-1.0.0" = {
@@ -56093,13 +56228,13 @@ let
         sha512 = "33+lQwlLxXoxy0o9WLOgw8OjbXeS3Jv+pSl+nxKc2AOClBI28HsdRPpH0u9Xa9OVjHLT9vonnOMw1ug7YXI0dA==";
       };
     };
-    "systeminformation-5.7.6" = {
+    "systeminformation-5.7.7" = {
       name = "systeminformation";
       packageName = "systeminformation";
-      version = "5.7.6";
+      version = "5.7.7";
       src = fetchurl {
-        url = "https://registry.npmjs.org/systeminformation/-/systeminformation-5.7.6.tgz";
-        sha512 = "sT7GeHq32DHaYBsQFogiLuHx51u+DO5flOlhIcmckTP0T9hQhAvvrbOR8jglNMaZgCvp5jACxeepERKGl7Bn/g==";
+        url = "https://registry.npmjs.org/systeminformation/-/systeminformation-5.7.7.tgz";
+        sha512 = "aQ7MBeVI2MKPYOi3YJAoZ45JVlRkBA7IXoqGgtVBamvtE0I6JLOyJzD/VVc9pnMXDb3yqaMwssAjhwtJax4/Rw==";
       };
     };
     "table-3.8.3" = {
@@ -56211,13 +56346,13 @@ let
         sha1 = "7cbcb64b5a141b6a2efc2c5d2c67b4e150b2a268";
       };
     };
-    "tail-2.2.2" = {
+    "tail-2.2.3" = {
       name = "tail";
       packageName = "tail";
-      version = "2.2.2";
+      version = "2.2.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/tail/-/tail-2.2.2.tgz";
-        sha512 = "IlfiFF8g5sPAqIZEL3qkIFcjODBM5DqdkVUhwXdKSDYqOgXGL4Gu0Hh1UQWXdCW5gBHi52cnk9WWMowsfjF4XA==";
+        url = "https://registry.npmjs.org/tail/-/tail-2.2.3.tgz";
+        sha512 = "XbBmVsJZ636kncPew2Y+pOxOsb9GsNFZ1bcAGCDn23ME/JPJ+TImZYjnqBnMLdw+K11Hql5ZgiUQmRvDHaFc6w==";
       };
     };
     "taketalk-1.0.0" = {
@@ -57750,13 +57885,13 @@ let
         sha1 = "8a7e8ab3044ad19f233f50c15894cbf69e5d205e";
       };
     };
-    "trash-7.1.1" = {
+    "trash-7.2.0" = {
       name = "trash";
       packageName = "trash";
-      version = "7.1.1";
+      version = "7.2.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/trash/-/trash-7.1.1.tgz";
-        sha512 = "iG43vKNh4Q540RrfefjSxll6hkqc2t6tAM1AfikXUXbW6O7jEKftMQZho6dg6VLUWng/uWu4brGrvE9a0uQbOQ==";
+        url = "https://registry.npmjs.org/trash/-/trash-7.2.0.tgz";
+        sha512 = "3bR8Z5aWO8b9qybS6skBoaavH/hX9Onb1RrdIIhJxv9VpH3aBtpbKuAX4rIh/0xpDZ7K4ga36wONk/okbhjTlA==";
       };
     };
     "traverse-0.3.9" = {
@@ -58479,13 +58614,13 @@ let
         sha512 = "4dbzIzqvjtgiM5rw1k5rEHtBANKmdudhGyBEajN01fEyhaAIhsoKNy6y7+IN93IfpFtwY9iqi7kD+xwKhQsNJA==";
       };
     };
-    "type-fest-1.2.0" = {
+    "type-fest-1.2.1" = {
       name = "type-fest";
       packageName = "type-fest";
-      version = "1.2.0";
+      version = "1.2.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/type-fest/-/type-fest-1.2.0.tgz";
-        sha512 = "++0N6KyAj0t2webXst0PE0xuXb4Dv3z1Z+4SGzK+j/epeWBZCfkQbkW/ezscZwpinmBQ5wu/l4TqagKSVcAGCA==";
+        url = "https://registry.npmjs.org/type-fest/-/type-fest-1.2.1.tgz";
+        sha512 = "SbmIRuXhJs8KTneu77Ecylt9zuqL683tuiLYpTRil4H++eIhqCmx6ko6KAFem9dty8sOdnEiX7j4K1nRE628fQ==";
       };
     };
     "type-is-1.6.18" = {
@@ -58587,13 +58722,13 @@ let
         sha512 = "0RNDbSdEokBeEAkgNbxJ+BLwSManFy9TeXz8uW+48j/xhEXv1ePME60olyzw2XzUqUBNAYFeJadIqAgNqIACwg==";
       };
     };
-    "typescript-3.9.9" = {
+    "typescript-3.9.10" = {
       name = "typescript";
       packageName = "typescript";
-      version = "3.9.9";
+      version = "3.9.10";
       src = fetchurl {
-        url = "https://registry.npmjs.org/typescript/-/typescript-3.9.9.tgz";
-        sha512 = "kdMjTiekY+z/ubJCATUPlRDl39vXYiMV9iyeMuEuXZh2we6zz80uovNN2WlAxmmdE/Z/YQe+EbOEXB5RHEED3w==";
+        url = "https://registry.npmjs.org/typescript/-/typescript-3.9.10.tgz";
+        sha512 = "w6fIxVE/H1PkLKcCPsFqKE7Kv7QUwhU8qQY2MueZXWx5cPZdwFupLgKK3vntcK98BtNHZtAF4LA/yl2a7k8R6Q==";
       };
     };
     "typescript-4.0.3" = {
@@ -58605,13 +58740,13 @@ let
         sha512 = "tEu6DGxGgRJPb/mVPIZ48e69xCn2yRmCgYmDugAVwmJ6o+0u1RI18eO7E7WBTLYLaEVVOhwQmcdhQHweux/WPg==";
       };
     };
-    "typescript-4.1.5" = {
+    "typescript-4.1.6" = {
       name = "typescript";
       packageName = "typescript";
-      version = "4.1.5";
+      version = "4.1.6";
       src = fetchurl {
-        url = "https://registry.npmjs.org/typescript/-/typescript-4.1.5.tgz";
-        sha512 = "6OSu9PTIzmn9TCDiovULTnET6BgXtDYL4Gg4szY+cGsc3JP1dQL8qvE8kShTRx1NIw4Q9IBHlwODjkjWEtMUyA==";
+        url = "https://registry.npmjs.org/typescript/-/typescript-4.1.6.tgz";
+        sha512 = "pxnwLxeb/Z5SP80JDRzVjh58KsM6jZHRAOtTpS7sXLS4ogXNKC9ANxHHZqLLeVHZN35jCtI4JdmLLbLiC1kBow==";
       };
     };
     "typescript-4.2.3" = {
@@ -58623,13 +58758,13 @@ let
         sha512 = "qOcYwxaByStAWrBf4x0fibwZvMRG+r4cQoTjbPtUlrWjBHbmCAww1i448U0GJ+3cNNEtebDteo/cHOR3xJ4wEw==";
       };
     };
-    "typescript-4.3.2" = {
+    "typescript-4.3.4" = {
       name = "typescript";
       packageName = "typescript";
-      version = "4.3.2";
+      version = "4.3.4";
       src = fetchurl {
-        url = "https://registry.npmjs.org/typescript/-/typescript-4.3.2.tgz";
-        sha512 = "zZ4hShnmnoVnAHpVHWpTcxdv7dWP60S2FsydQLV8V5PbS3FifjWFFRiHSWpDJahly88PRyV5teTSLoq4eG7mKw==";
+        url = "https://registry.npmjs.org/typescript/-/typescript-4.3.4.tgz";
+        sha512 = "uauPG7XZn9F/mo+7MrsRjyvbxFpzemRjKEZXS4AK83oP2KKOJPvb+9cO/gmnv8arWZvhnjVOXz7B49m1l0e9Ew==";
       };
     };
     "typescript-eslint-parser-16.0.1" = {
@@ -60064,13 +60199,13 @@ let
         sha512 = "3XZZuJSeoIUyMYSuDbTbVtP4KAVGHPfU8nmHFkr8LJc+THCaUXwnu/2AV+LCSLarET/hL9IlbNfYTGrt6fOVuQ==";
       };
     };
-    "ut_pex-3.0.0" = {
+    "ut_pex-3.0.1" = {
       name = "ut_pex";
       packageName = "ut_pex";
-      version = "3.0.0";
+      version = "3.0.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/ut_pex/-/ut_pex-3.0.0.tgz";
-        sha512 = "huPZAVpXzqUmCSGdeALwnoH29V+bK0O9ISH4jNfvlGFhY8qMJF0I+RKfVMiiT0TlgeB6thiitz/0G9BORVRb6Q==";
+        url = "https://registry.npmjs.org/ut_pex/-/ut_pex-3.0.1.tgz";
+        sha512 = "t1MHIDHSISgOJcmq8UM6Qv9/hRQYVaUvzqSNnXa5ATDbS9hXfhBpyBo2HcSyJtwPSHsmMtNui8G6yKirwJ8vow==";
       };
     };
     "utf-8-validate-1.2.2" = {
@@ -60289,13 +60424,13 @@ let
         sha512 = "vRAKaS8WcYNgzbxyH2LdheqgL4sQLis8LXl7r/mN+O4mpWlUpoCsTtietxepLrft2q0TFA2gaIvSWN1iRkzW/w==";
       };
     };
-    "utp-native-2.5.0" = {
+    "utp-native-2.5.1" = {
       name = "utp-native";
       packageName = "utp-native";
-      version = "2.5.0";
+      version = "2.5.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/utp-native/-/utp-native-2.5.0.tgz";
-        sha512 = "HoHPE6gwLxC0xlpYJUl+Xw2sh809lhXx3TexHsb2/xY8vEd6NwuvAxOI/X27dBTc/TOT5diWUpCJWDaunkcVvA==";
+        url = "https://registry.npmjs.org/utp-native/-/utp-native-2.5.1.tgz";
+        sha512 = "wbrJwR8DZx8N9s1ffTcMuBK7tMBQ9tvKpIL+mWHrDvGUYfV7ivroEGFTXUr4meqy/PVbUdMfURSoBbwuGtt/YQ==";
       };
     };
     "uuid-2.0.3" = {
@@ -61333,6 +61468,15 @@ let
         sha512 = "UmC+GS0IqBeZnOAmdtQvaDzoH1c5/un+b7qALUziu/Y4SOPXso5dF+YkJeTqsde6YU2pLm78RtMDzl9BParwbw==";
       };
     };
+    "vscode-json-languageserver-1.3.4" = {
+      name = "vscode-json-languageserver";
+      packageName = "vscode-json-languageserver";
+      version = "1.3.4";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/vscode-json-languageserver/-/vscode-json-languageserver-1.3.4.tgz";
+        sha512 = "+ghebnslXk6fVDySBrT0BVqozLDdmKY/qxgkDD4JtOQcU2vXc3e7jh7YyMxvuvE93E9OLvBqUrvajttj8xf3BA==";
+      };
+    };
     "vscode-json-languageservice-3.11.0" = {
       name = "vscode-json-languageservice";
       packageName = "vscode-json-languageservice";
@@ -61414,6 +61558,15 @@ let
         sha512 = "nkiNDGI+Ytp7uj1lxHXddXCoEunhcry1D+KmVHBfUUgWT9jMF8ZJyH5KQObdF+OGAh7bXZxD/SV4uGwSCeHHWA==";
       };
     };
+    "vscode-jsonrpc-7.0.0-next.1" = {
+      name = "vscode-jsonrpc";
+      packageName = "vscode-jsonrpc";
+      version = "7.0.0-next.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/vscode-jsonrpc/-/vscode-jsonrpc-7.0.0-next.1.tgz";
+        sha512 = "dEmliPZGbSyIcEeKRGzosCy7y7zsc8FXg1l5BBOGgMUbemlo3vUnsa2GFqpILJwJvlbvkRcF2QASNwIlKe9J7g==";
+      };
+    };
     "vscode-languageclient-4.0.1" = {
       name = "vscode-languageclient";
       packageName = "vscode-languageclient";
@@ -61423,13 +61576,13 @@ let
         sha512 = "0fuBZj9pMkeJ8OMyIvSGeRaRVhUaJt+yeFxi7a3sz/AbrngQdcxOovMXPgKuieoBSBKS05gXPS88BsWpJZfBkA==";
       };
     };
-    "vscode-languageclient-7.1.0-next.4" = {
+    "vscode-languageclient-7.1.0-next.5" = {
       name = "vscode-languageclient";
       packageName = "vscode-languageclient";
-      version = "7.1.0-next.4";
+      version = "7.1.0-next.5";
       src = fetchurl {
-        url = "https://registry.npmjs.org/vscode-languageclient/-/vscode-languageclient-7.1.0-next.4.tgz";
-        sha512 = "Gal+DvbI1KIwO1z90MvSnghMCVBCGlwdpOVIS0Hhmep7rjHUOwuC5Df7YlVkpzfPm+RCRyZQnUSJ19VNrnxxhA==";
+        url = "https://registry.npmjs.org/vscode-languageclient/-/vscode-languageclient-7.1.0-next.5.tgz";
+        sha512 = "TpzpAhpdCNJHaLzptFRs54xsU6xTmaiVPCse0W0rRB5jJBPjOBKilrFPMMm/sJA0y8Yxa9sOvZaNu6WPg3dYAw==";
       };
     };
     "vscode-languageserver-3.5.1" = {
@@ -61558,6 +61711,15 @@ let
         sha512 = "LFZ6WMB3iPezQAU9OnGoERzcIVKhcs0OLfD/NHcqSj3g1wgxuLUL5kSlZbbjFySQCmhzm6b0yb3hjTSeBtq1+w==";
       };
     };
+    "vscode-languageserver-protocol-3.17.0-next.6" = {
+      name = "vscode-languageserver-protocol";
+      packageName = "vscode-languageserver-protocol";
+      version = "3.17.0-next.6";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/vscode-languageserver-protocol/-/vscode-languageserver-protocol-3.17.0-next.6.tgz";
+        sha512 = "f1kGsoOpISB5jSqQNeMDl2446enxVahyux2e5vZap6pu/TC+2UlvPT4DCR0gPph95KOQZweL9zq1SzLoPdqhuA==";
+      };
+    };
     "vscode-languageserver-protocol-3.5.1" = {
       name = "vscode-languageserver-protocol";
       packageName = "vscode-languageserver-protocol";
@@ -61648,6 +61810,15 @@ let
         sha512 = "VGzh06oynbYa6JbTKUbxOEZN7CYEtWhN7DK5wfzUpeCJl8X8xZX39g2PVfpqXrIEduu7dcJgK007KgnX9tHNKA==";
       };
     };
+    "vscode-languageserver-types-3.17.0-next.2" = {
+      name = "vscode-languageserver-types";
+      packageName = "vscode-languageserver-types";
+      version = "3.17.0-next.2";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/vscode-languageserver-types/-/vscode-languageserver-types-3.17.0-next.2.tgz";
+        sha512 = "L5S2kNLCgYJMVWgsZjBaorMM/6+itAfvOyl6Kv1bgFzDNaUKm9HsnUlehjpWPdV5DqnfJhJ5E03Z+/3Mw8ii+Q==";
+      };
+    };
     "vscode-languageserver-types-3.5.0" = {
       name = "vscode-languageserver-types";
       packageName = "vscode-languageserver-types";
@@ -61963,13 +62134,13 @@ let
         sha1 = "79331f666366b3b1c6ab02ceb04bad8dd2eebb0c";
       };
     };
-    "wavedrom-2.7.0" = {
+    "wavedrom-2.8.1" = {
       name = "wavedrom";
       packageName = "wavedrom";
-      version = "2.7.0";
+      version = "2.8.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/wavedrom/-/wavedrom-2.7.0.tgz";
-        sha512 = "ae13n2/yEpmJt9VabwawsK7eHva7Mk+ghI+TQXCUbC1YEW8ChdrYgI/4TJyaYblzDlADZ0iCSaifZKNbjpR4Tw==";
+        url = "https://registry.npmjs.org/wavedrom/-/wavedrom-2.8.1.tgz";
+        sha512 = "UTU27qnkfv+qLCwilm+T+m6zcPzSFP7i5HgtZkihbDeVIUasa3npnWhK3ogJ6gmOYhTK1lIh8KDztEuod2CM/g==";
       };
     };
     "wawoff2-2.0.0" = {
@@ -62125,13 +62296,13 @@ let
         sha512 = "1xllYVmA4dIvRjHzwELgW4KjIU1fW4PEuEnjsylz7k7H5HgPOctIq7W1jrt3sKH9yG5d72//XWzsHhfoWvsQVg==";
       };
     };
-    "webpack-5.38.1" = {
+    "webpack-5.40.0" = {
       name = "webpack";
       packageName = "webpack";
-      version = "5.38.1";
+      version = "5.40.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/webpack/-/webpack-5.38.1.tgz";
-        sha512 = "OqRmYD1OJbHZph6RUMD93GcCZy4Z4wC0ele4FXyYF0J6AxO1vOSuIlU1hkS/lDlR9CDYBz64MZRmdbdnFFoT2g==";
+        url = "https://registry.npmjs.org/webpack/-/webpack-5.40.0.tgz";
+        sha512 = "c7f5e/WWrxXWUzQqTBg54vBs5RgcAgpvKE4F4VegVgfo4x660ZxYUF2/hpMkZUnLjgytVTitjeXaN4IPlXCGIw==";
       };
     };
     "webpack-bundle-analyzer-3.9.0" = {
@@ -62323,13 +62494,13 @@ let
         sha512 = "OqedPIGOfsDlo31UNwYbCFMSaO9m9G/0faIHj5/dZFDMFqPTcx6UwqyOy3COEaEOg/9VsGIpdqn62W5KhoKSpg==";
       };
     };
-    "webtorrent-1.0.0" = {
+    "webtorrent-1.0.1" = {
       name = "webtorrent";
       packageName = "webtorrent";
-      version = "1.0.0";
+      version = "1.0.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/webtorrent/-/webtorrent-1.0.0.tgz";
-        sha512 = "htwcY5OBOWL/OMwaw3xi1Mp2gE9k5UmGTKeO3n1ixQDH9QgeqqRlBJz2ZLEyOL8yN1FdS/D9z+ijm06bZ3oW5w==";
+        url = "https://registry.npmjs.org/webtorrent/-/webtorrent-1.0.1.tgz";
+        sha512 = "A0l8T7iRJ+Cc/TUQqPAX/7hemrEEfIimaRiEYMTPAs1TM99Yd5tfKe00jTkjmI6a0nqx7d7+r5GgXSO/uFs7GA==";
       };
     };
     "well-known-symbols-2.0.0" = {
@@ -63250,15 +63421,6 @@ let
         sha512 = "zmhltoSR8u1cnDsD43TX59mzoMZsLKqUweyYBAIvTngR3shc0W6aOZylZmq/7hqyVxPdi+5Ud2QInblgyE72fw==";
       };
     };
-    "ws-7.4.3" = {
-      name = "ws";
-      packageName = "ws";
-      version = "7.4.3";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/ws/-/ws-7.4.3.tgz";
-        sha512 = "hr6vCR76GsossIRsr8OLR9acVVm1jyfEWvhbNjtgPOrfvAlKzvyeg/P6r8RuDjRyrcQoPQT7K0DGEPc7Ae6jzA==";
-      };
-    };
     "ws-7.4.5" = {
       name = "ws";
       packageName = "ws";
@@ -63277,6 +63439,15 @@ let
         sha512 = "YmhHDO4MzaDLB+M9ym/mDA5z0naX8j7SIlT8f8z+I0VtzsRbekxEutHSme7NPS2qE8StCYQNUnfWdXta/Yu85A==";
       };
     };
+    "ws-7.5.0" = {
+      name = "ws";
+      packageName = "ws";
+      version = "7.5.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/ws/-/ws-7.5.0.tgz";
+        sha512 = "6ezXvzOZupqKj4jUqbQ9tXuJNo+BR2gU8fFRk3XCP3e0G6WT414u5ELe6Y0vtp7kmSJ3F7YWObSNr1ESsgi4vw==";
+      };
+    };
     "x-default-browser-0.3.1" = {
       name = "x-default-browser";
       packageName = "x-default-browser";
@@ -64097,13 +64268,13 @@ let
         sha512 = "3lbsNRf/j+A4QuSZfDRA7HRSfWrzO0YjqTJd5kjAq37Zep1CEgaYmrH9Q3GwPiB9cHyd1Y1UwggGhJGoxipbzg==";
       };
     };
-    "yargs-parser-15.0.1" = {
+    "yargs-parser-15.0.3" = {
       name = "yargs-parser";
       packageName = "yargs-parser";
-      version = "15.0.1";
+      version = "15.0.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/yargs-parser/-/yargs-parser-15.0.1.tgz";
-        sha512 = "0OAMV2mAZQrs3FkNpDQcBk1x5HXb8X4twADss4S0Iuk+2dGnLOE/fRHrsYm542GduMveyA77OF4wrNJuanRCWw==";
+        url = "https://registry.npmjs.org/yargs-parser/-/yargs-parser-15.0.3.tgz";
+        sha512 = "/MVEVjTXy/cGAjdtQf8dW3V9b97bPN7rNn8ETj6BmAQL7ibC7O1Q9SPJbGjgh3SlwoBNXMzj/ZGIj8mBgl12YA==";
       };
     };
     "yargs-parser-18.1.3" = {
@@ -64133,13 +64304,13 @@ let
         sha512 = "WOkpgNhPTlE73h4VFAFsOnomJVaovO8VqLDzy5saChRBFQFBoMYirowyW+Q9HB4HFF4Z7VZTiG3iSzJJA29yRA==";
       };
     };
-    "yargs-parser-20.2.7" = {
+    "yargs-parser-20.2.9" = {
       name = "yargs-parser";
       packageName = "yargs-parser";
-      version = "20.2.7";
+      version = "20.2.9";
       src = fetchurl {
-        url = "https://registry.npmjs.org/yargs-parser/-/yargs-parser-20.2.7.tgz";
-        sha512 = "FiNkvbeHzB/syOjIUxFDCnhSfzAL8R5vs40MgLFBorXACCOAEaWu0gRZl14vG8MR9AOJIZbmkjhusqBYZ3HTHw==";
+        url = "https://registry.npmjs.org/yargs-parser/-/yargs-parser-20.2.9.tgz";
+        sha512 = "y11nGElTIV+CT3Zv9t7VKl+Q3hTQoT9a1Qzezhhl6Rp21gJ/IVTW7Z3y9EWXhuUBC2Shnf+DX0antecpAwSP8w==";
       };
     };
     "yargs-parser-4.2.1" = {
@@ -64427,22 +64598,22 @@ in
   "@angular/cli" = nodeEnv.buildNodePackage {
     name = "_at_angular_slash_cli";
     packageName = "@angular/cli";
-    version = "12.0.4";
+    version = "12.0.5";
     src = fetchurl {
-      url = "https://registry.npmjs.org/@angular/cli/-/cli-12.0.4.tgz";
-      sha512 = "kZaJ55udB/AjQ+q8CrQfk6JGWdnJpH3c2VtbvSuR/ihiG6zMSxwpXqt1rImQN0RfffG3bsHD2SpM+T7/LKPemw==";
+      url = "https://registry.npmjs.org/@angular/cli/-/cli-12.0.5.tgz";
+      sha512 = "MdgJ9DY3bWYsMFr9Xa+60gtVaYErhAE8ULGnUyI8zLMhWqrV1ZpJJ1WfP8pMQYx4HaKJIgx7wd8az7ZXAcF8hg==";
     };
     dependencies = [
-      sources."@angular-devkit/architect-0.1200.4"
-      sources."@angular-devkit/core-12.0.4"
-      sources."@angular-devkit/schematics-12.0.4"
-      sources."@npmcli/git-2.0.9"
+      sources."@angular-devkit/architect-0.1200.5"
+      sources."@angular-devkit/core-12.0.5"
+      sources."@angular-devkit/schematics-12.0.5"
+      sources."@npmcli/git-2.1.0"
       sources."@npmcli/installed-package-contents-1.0.7"
       sources."@npmcli/move-file-1.1.2"
       sources."@npmcli/node-gyp-1.0.2"
       sources."@npmcli/promise-spawn-1.3.2"
       sources."@npmcli/run-script-1.8.5"
-      sources."@schematics/angular-12.0.4"
+      sources."@schematics/angular-12.0.5"
       sources."@tootallnate/once-1.1.2"
       sources."@yarnpkg/lockfile-1.1.0"
       sources."abbrev-1.1.1"
@@ -64647,7 +64818,7 @@ in
       sources."signal-exit-3.0.3"
       sources."smart-buffer-4.1.0"
       sources."socks-2.6.1"
-      sources."socks-proxy-agent-5.0.0"
+      sources."socks-proxy-agent-5.0.1"
       sources."source-map-0.7.3"
       sources."sourcemap-codec-1.4.8"
       sources."sshpk-1.16.1"
@@ -64801,7 +64972,7 @@ in
         ];
       })
       sources."concat-map-0.0.1"
-      (sources."convert-source-map-1.7.0" // {
+      (sources."convert-source-map-1.8.0" // {
         dependencies = [
           sources."safe-buffer-5.1.2"
         ];
@@ -65258,7 +65429,7 @@ in
       sources."@types/estree-0.0.46"
       sources."@types/json-schema-7.0.7"
       sources."@types/json5-0.0.29"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."@types/parse-json-4.0.0"
       sources."@webassemblyjs/ast-1.11.0"
       sources."@webassemblyjs/floating-point-hex-parser-1.11.0"
@@ -65296,7 +65467,7 @@ in
       sources."buffer-5.7.1"
       sources."buffer-from-1.1.1"
       sources."callsites-3.1.0"
-      sources."caniuse-lite-1.0.30001237"
+      sources."caniuse-lite-1.0.30001239"
       sources."chalk-3.0.0"
       sources."chardet-0.7.0"
       sources."chokidar-3.5.1"
@@ -65560,12 +65731,12 @@ in
       sources."@apollographql/graphql-upload-8-fork-8.1.3"
       sources."@babel/code-frame-7.14.5"
       sources."@babel/compat-data-7.14.5"
-      sources."@babel/core-7.14.5"
+      sources."@babel/core-7.14.6"
       sources."@babel/generator-7.14.5"
       sources."@babel/helper-annotate-as-pure-7.14.5"
       sources."@babel/helper-builder-binary-assignment-operator-visitor-7.14.5"
       sources."@babel/helper-compilation-targets-7.14.5"
-      sources."@babel/helper-create-class-features-plugin-7.14.5"
+      sources."@babel/helper-create-class-features-plugin-7.14.6"
       sources."@babel/helper-create-regexp-features-plugin-7.14.5"
       sources."@babel/helper-define-polyfill-provider-0.2.3"
       sources."@babel/helper-explode-assignable-expression-7.14.5"
@@ -65585,9 +65756,9 @@ in
       sources."@babel/helper-validator-identifier-7.14.5"
       sources."@babel/helper-validator-option-7.14.5"
       sources."@babel/helper-wrap-function-7.14.5"
-      sources."@babel/helpers-7.14.5"
+      sources."@babel/helpers-7.14.6"
       sources."@babel/highlight-7.14.5"
-      sources."@babel/parser-7.14.5"
+      sources."@babel/parser-7.14.6"
       sources."@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining-7.14.5"
       sources."@babel/plugin-proposal-async-generator-functions-7.14.5"
       sources."@babel/plugin-proposal-class-properties-7.14.5"
@@ -65647,11 +65818,11 @@ in
       sources."@babel/plugin-transform-regenerator-7.14.5"
       sources."@babel/plugin-transform-reserved-words-7.14.5"
       sources."@babel/plugin-transform-shorthand-properties-7.14.5"
-      sources."@babel/plugin-transform-spread-7.14.5"
+      sources."@babel/plugin-transform-spread-7.14.6"
       sources."@babel/plugin-transform-sticky-regex-7.14.5"
       sources."@babel/plugin-transform-template-literals-7.14.5"
       sources."@babel/plugin-transform-typeof-symbol-7.14.5"
-      sources."@babel/plugin-transform-typescript-7.14.5"
+      sources."@babel/plugin-transform-typescript-7.14.6"
       sources."@babel/plugin-transform-unicode-escapes-7.14.5"
       sources."@babel/plugin-transform-unicode-regex-7.14.5"
       sources."@babel/preset-env-7.14.5"
@@ -65665,7 +65836,7 @@ in
           sources."semver-5.7.1"
         ];
       })
-      sources."@babel/runtime-7.14.5"
+      sources."@babel/runtime-7.14.6"
       sources."@babel/template-7.14.5"
       sources."@babel/traverse-7.14.5"
       sources."@babel/types-7.14.5"
@@ -65721,13 +65892,13 @@ in
       sources."@types/long-4.0.1"
       sources."@types/mime-1.3.2"
       sources."@types/minimatch-3.0.4"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."@types/normalize-package-data-2.4.0"
       sources."@types/qs-6.9.6"
       sources."@types/range-parser-1.2.3"
       sources."@types/serve-static-1.13.9"
       sources."@types/through-0.0.30"
-      sources."@types/ws-7.4.4"
+      sources."@types/ws-7.4.5"
       sources."@vue/cli-shared-utils-4.5.13"
       (sources."@vue/cli-ui-4.5.13" // {
         dependencies = [
@@ -65810,7 +65981,7 @@ in
       sources."babel-core-7.0.0-bridge.0"
       sources."babel-plugin-dynamic-import-node-2.3.3"
       sources."babel-plugin-polyfill-corejs2-0.2.2"
-      sources."babel-plugin-polyfill-corejs3-0.2.2"
+      sources."babel-plugin-polyfill-corejs3-0.2.3"
       sources."babel-plugin-polyfill-regenerator-0.2.2"
       sources."backo2-1.0.2"
       sources."balanced-match-1.0.2"
@@ -65864,7 +66035,7 @@ in
       sources."call-bind-1.0.2"
       sources."call-me-maybe-1.0.1"
       sources."camelcase-5.3.1"
-      sources."caniuse-lite-1.0.30001237"
+      sources."caniuse-lite-1.0.30001239"
       sources."caseless-0.12.0"
       sources."caw-2.0.1"
       sources."chalk-2.4.2"
@@ -65914,7 +66085,7 @@ in
         ];
       })
       sources."content-type-1.0.4"
-      (sources."convert-source-map-1.7.0" // {
+      (sources."convert-source-map-1.8.0" // {
         dependencies = [
           sources."safe-buffer-5.1.2"
         ];
@@ -65922,12 +66093,12 @@ in
       sources."cookie-0.4.0"
       sources."cookie-signature-1.0.6"
       sources."copy-descriptor-0.1.1"
-      (sources."core-js-compat-3.14.0" // {
+      (sources."core-js-compat-3.15.0" // {
         dependencies = [
           sources."semver-7.0.0"
         ];
       })
-      sources."core-js-pure-3.14.0"
+      sources."core-js-pure-3.15.0"
       sources."core-util-is-1.0.2"
       sources."cors-2.8.5"
       (sources."cross-spawn-6.0.5" // {
@@ -66077,7 +66248,7 @@ in
       })
       sources."find-up-3.0.0"
       sources."fkill-6.2.0"
-      sources."flow-parser-0.152.0"
+      sources."flow-parser-0.153.0"
       sources."for-each-0.3.3"
       sources."for-in-1.0.2"
       sources."forever-agent-0.6.1"
@@ -66670,7 +66841,7 @@ in
       sources."tweetnacl-0.14.5"
       sources."type-fest-0.6.0"
       sources."type-is-1.6.18"
-      sources."typescript-4.1.5"
+      sources."typescript-4.1.6"
       sources."unbox-primitive-1.0.1"
       sources."unbzip2-stream-1.4.3"
       sources."unicode-canonical-property-names-ecmascript-1.0.4"
@@ -66713,7 +66884,7 @@ in
           sources."fast-glob-3.2.5"
           sources."fill-range-7.0.1"
           sources."glob-parent-5.1.2"
-          sources."globby-11.0.3"
+          sources."globby-11.0.4"
           sources."ignore-5.1.8"
           sources."is-number-7.0.0"
           sources."lru-cache-6.0.0"
@@ -66737,7 +66908,7 @@ in
       })
       sources."wrappy-1.0.2"
       sources."write-file-atomic-2.4.3"
-      sources."ws-7.4.6"
+      sources."ws-7.5.0"
       sources."xml2js-0.4.23"
       sources."xmlbuilder-11.0.1"
       sources."xss-1.0.9"
@@ -66750,7 +66921,7 @@ in
         ];
       })
       sources."yargs-16.2.0"
-      sources."yargs-parser-20.2.7"
+      sources."yargs-parser-20.2.9"
       sources."yauzl-2.10.0"
       sources."zen-observable-0.8.15"
       sources."zen-observable-ts-0.8.21"
@@ -66893,7 +67064,7 @@ in
       sources."@babel/generator-7.14.5"
       sources."@babel/helper-validator-identifier-7.14.5"
       sources."@babel/highlight-7.14.5"
-      sources."@babel/parser-7.14.5"
+      sources."@babel/parser-7.14.6"
       sources."@babel/template-7.14.5"
       sources."@babel/types-7.14.5"
       sources."@webassemblyjs/ast-1.11.0"
@@ -66963,15 +67134,15 @@ in
   alloy = nodeEnv.buildNodePackage {
     name = "alloy";
     packageName = "alloy";
-    version = "1.16.1";
+    version = "1.16.2";
     src = fetchurl {
-      url = "https://registry.npmjs.org/alloy/-/alloy-1.16.1.tgz";
-      sha512 = "y43IQKivEMsR/ZiQ2GCmzx3ZWoFy+1vDjHuWOJcrCzkZClS8HFkI8/kZE+29g2n25DDzQJIeILEjGXretny6vQ==";
+      url = "https://registry.npmjs.org/alloy/-/alloy-1.16.2.tgz";
+      sha512 = "9/MIehoAx0KtmGIlH408LVU99ms+JycCCLY+DI1CvI8HwwRxS1d5clbKj/7JmCPm5cRYnD7798x4JDNMVNaSIA==";
     };
     dependencies = [
       sources."@babel/code-frame-7.14.5"
       sources."@babel/compat-data-7.14.5"
-      (sources."@babel/core-7.14.5" // {
+      (sources."@babel/core-7.14.6" // {
         dependencies = [
           sources."source-map-0.5.7"
         ];
@@ -66994,9 +67165,9 @@ in
       sources."@babel/helper-split-export-declaration-7.14.5"
       sources."@babel/helper-validator-identifier-7.14.5"
       sources."@babel/helper-validator-option-7.14.5"
-      sources."@babel/helpers-7.14.5"
+      sources."@babel/helpers-7.14.6"
       sources."@babel/highlight-7.14.5"
-      sources."@babel/parser-7.14.5"
+      sources."@babel/parser-7.14.6"
       sources."@babel/template-7.14.5"
       sources."@babel/traverse-7.14.5"
       sources."@babel/types-7.14.5"
@@ -67007,7 +67178,7 @@ in
       sources."balanced-match-1.0.2"
       sources."brace-expansion-1.1.11"
       sources."browserslist-4.16.6"
-      sources."caniuse-lite-1.0.30001237"
+      sources."caniuse-lite-1.0.30001239"
       sources."chalk-2.4.2"
       sources."color-convert-1.9.3"
       sources."color-name-1.1.3"
@@ -67015,7 +67186,7 @@ in
       sources."colors-1.4.0"
       sources."commander-7.2.0"
       sources."concat-map-0.0.1"
-      sources."convert-source-map-1.7.0"
+      sources."convert-source-map-1.8.0"
       sources."debug-4.3.2"
       sources."ejs-3.1.6"
       sources."electron-to-chromium-1.3.752"
@@ -67079,7 +67250,7 @@ in
       sources."safe-buffer-5.1.2"
       sources."sax-0.5.8"
       sources."semver-6.3.0"
-      sources."source-map-0.6.1"
+      sources."source-map-0.7.3"
       sources."strip-ansi-0.1.1"
       sources."supports-color-5.5.0"
       sources."to-fast-properties-2.0.0"
@@ -67089,7 +67260,7 @@ in
       sources."which-1.3.1"
       sources."xml2js-0.2.8"
       sources."xml2tss-0.0.5"
-      sources."xmldom-0.5.0"
+      sources."xmldom-0.6.0"
     ];
     buildInputs = globalBuildInputs;
     meta = {
@@ -67112,7 +67283,7 @@ in
     dependencies = [
       sources."@types/glob-7.1.3"
       sources."@types/minimatch-3.0.4"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."balanced-match-1.0.2"
       sources."brace-expansion-1.1.11"
       sources."chromium-pickle-js-0.2.0"
@@ -67147,7 +67318,7 @@ in
     };
     dependencies = [
       sources."@tootallnate/once-1.1.2"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."@types/yauzl-2.9.1"
       sources."agent-base-6.0.2"
       sources."ansi-escapes-4.3.2"
@@ -67158,7 +67329,7 @@ in
           sources."tslib-2.3.0"
         ];
       })
-      (sources."aws-sdk-2.927.0" // {
+      (sources."aws-sdk-2.932.0" // {
         dependencies = [
           sources."uuid-3.3.2"
         ];
@@ -67295,7 +67466,7 @@ in
       sources."signal-exit-3.0.3"
       sources."smart-buffer-4.1.0"
       sources."socks-2.6.1"
-      sources."socks-proxy-agent-5.0.0"
+      sources."socks-proxy-agent-5.0.1"
       sources."source-map-0.6.1"
       sources."statuses-1.5.0"
       sources."string-width-4.2.2"
@@ -67327,7 +67498,7 @@ in
       sources."uuid-8.3.2"
       sources."word-wrap-1.2.3"
       sources."wrappy-1.0.2"
-      sources."ws-7.4.6"
+      sources."ws-7.5.0"
       sources."xml2js-0.4.19"
       sources."xmlbuilder-9.0.7"
       sources."xregexp-2.0.0"
@@ -67347,10 +67518,10 @@ in
   balanceofsatoshis = nodeEnv.buildNodePackage {
     name = "balanceofsatoshis";
     packageName = "balanceofsatoshis";
-    version = "9.4.1";
+    version = "10.1.0";
     src = fetchurl {
-      url = "https://registry.npmjs.org/balanceofsatoshis/-/balanceofsatoshis-9.4.1.tgz";
-      sha512 = "bvs2ySATrJXq9DOIYBGY41DIaE0AqSOEp5DlpXB9Kgf9rtbf3moiRwBGNtWpc1ZchSezDUBBRG8gmciT2q+S4w==";
+      url = "https://registry.npmjs.org/balanceofsatoshis/-/balanceofsatoshis-10.1.0.tgz";
+      sha512 = "ZKHOfZkyXhevLUbQMijz6PEGBZuBdeUS6oqdqrmeYlOB2xZPC/KxCPmKTD7igbq7eD2E/XixtzpHub8bQnxRIg==";
     };
     dependencies = [
       sources."@alexbosworth/html2unicode-1.1.5"
@@ -67363,7 +67534,7 @@ in
       sources."@cto.af/textdecoder-0.0.0"
       (sources."@grpc/grpc-js-1.3.2" // {
         dependencies = [
-          sources."@types/node-15.12.2"
+          sources."@types/node-15.12.4"
         ];
       })
       sources."@grpc/proto-loader-0.6.2"
@@ -67624,6 +67795,7 @@ in
       (sources."goldengate-10.1.0" // {
         dependencies = [
           sources."bn.js-5.2.0"
+          sources."ln-service-51.8.2"
         ];
       })
       sources."google-auth-library-6.1.6"
@@ -67664,7 +67836,7 @@ in
       sources."imurmurhash-0.1.4"
       sources."inherits-2.0.4"
       sources."ini-2.0.0"
-      (sources."inquirer-8.1.0" // {
+      (sources."inquirer-8.1.1" // {
         dependencies = [
           sources."ansi-escapes-4.3.2"
           sources."ansi-regex-5.0.0"
@@ -67740,9 +67912,18 @@ in
         dependencies = [
           sources."bn.js-5.2.0"
           sources."goldengate-10.0.6"
+          sources."ln-service-51.8.2"
+        ];
+      })
+      (sources."ln-service-51.8.4" // {
+        dependencies = [
+          sources."@types/node-15.12.4"
+          sources."@types/ws-7.4.5"
+          sources."bn.js-5.2.0"
+          sources."lightning-3.3.11"
+          sources."ws-7.5.0"
         ];
       })
-      sources."ln-service-51.8.2"
       (sources."ln-sync-0.4.5" // {
         dependencies = [
           sources."@grpc/grpc-js-1.2.11"
@@ -67769,6 +67950,7 @@ in
         dependencies = [
           sources."bn.js-5.2.0"
           sources."goldengate-10.0.6"
+          sources."ln-service-51.8.2"
         ];
       })
       sources."lodash-4.17.21"
@@ -67854,7 +68036,7 @@ in
       sources."p-cancelable-1.1.0"
       sources."p-timeout-4.1.0"
       sources."package-json-6.5.0"
-      sources."paid-services-1.1.0"
+      sources."paid-services-2.0.0"
       sources."parseurl-1.3.3"
       sources."path-to-regexp-0.1.7"
       sources."performance-now-2.1.0"
@@ -67862,11 +68044,15 @@ in
       sources."pinkie-promise-2.0.1"
       sources."prepend-http-2.0.0"
       sources."prettyjson-1.2.1"
-      sources."probing-1.3.6"
+      (sources."probing-1.3.6" // {
+        dependencies = [
+          sources."ln-service-51.8.2"
+        ];
+      })
       sources."process-nextick-args-2.0.1"
       (sources."protobufjs-6.11.2" // {
         dependencies = [
-          sources."@types/node-15.12.2"
+          sources."@types/node-15.12.4"
         ];
       })
       sources."proxy-addr-2.0.7"
@@ -68038,7 +68224,7 @@ in
           sources."strip-ansi-6.0.0"
         ];
       })
-      sources."yargs-parser-20.2.7"
+      sources."yargs-parser-20.2.9"
     ];
     buildInputs = globalBuildInputs;
     meta = {
@@ -68583,7 +68769,7 @@ in
       sources."@babel/code-frame-7.14.5"
       sources."@babel/helper-validator-identifier-7.14.5"
       sources."@babel/highlight-7.14.5"
-      sources."@babel/parser-7.14.5"
+      sources."@babel/parser-7.14.6"
       sources."@babel/types-7.14.5"
       sources."@kwsites/file-exists-1.1.1"
       sources."@kwsites/promise-deferred-1.1.1"
@@ -68953,7 +69139,7 @@ in
       sources."set-blocking-2.0.0"
       sources."setprototypeof-1.1.1"
       sources."sha.js-2.4.11"
-      sources."simple-git-2.39.1"
+      sources."simple-git-2.40.0"
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
@@ -69011,7 +69197,7 @@ in
           sources."yargs-parser-13.1.2"
         ];
       })
-      sources."yargs-parser-20.2.7"
+      sources."yargs-parser-20.2.9"
     ];
     buildInputs = globalBuildInputs;
     meta = {
@@ -69043,7 +69229,7 @@ in
       sources."@protobufjs/pool-1.1.0"
       sources."@protobufjs/utf8-1.1.0"
       sources."@types/long-4.0.1"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."addr-to-ip-port-1.5.1"
       sources."airplay-js-0.2.16"
       sources."ajv-6.12.6"
@@ -69449,10 +69635,10 @@ in
   cdk8s-cli = nodeEnv.buildNodePackage {
     name = "cdk8s-cli";
     packageName = "cdk8s-cli";
-    version = "1.0.0-beta.22";
+    version = "1.0.0-beta.26";
     src = fetchurl {
-      url = "https://registry.npmjs.org/cdk8s-cli/-/cdk8s-cli-1.0.0-beta.22.tgz";
-      sha512 = "hQrssZlC0Cy/PruMVi9N9oU0UuEUCEc0a99l4CgBa63RnVFxU/nEUTStKVKKjpTUl+NOO87cdiHkw6Q81gBIrg==";
+      url = "https://registry.npmjs.org/cdk8s-cli/-/cdk8s-cli-1.0.0-beta.26.tgz";
+      sha512 = "+ikLey611rDoxLBiYuFaNJZxZ1ytCppSEzW+wBIfV5mkyV8Ug5ldHuFzpeUxShZToyzqq8TwhQ5A3CGTU0tSJw==";
     };
     dependencies = [
       sources."@jsii/spec-1.30.0"
@@ -69464,8 +69650,8 @@ in
       sources."call-bind-1.0.2"
       sources."camelcase-6.2.0"
       sources."case-1.6.3"
-      sources."cdk8s-1.0.0-beta.14"
-      sources."cdk8s-plus-17-1.0.0-beta.18"
+      sources."cdk8s-1.0.0-beta.24"
+      sources."cdk8s-plus-17-1.0.0-beta.30"
       sources."cliui-7.0.4"
       sources."clone-2.1.2"
       (sources."codemaker-1.30.0" // {
@@ -69477,7 +69663,7 @@ in
       sources."color-name-1.1.4"
       sources."colors-1.4.0"
       sources."commonmark-0.29.3"
-      sources."constructs-3.3.77"
+      sources."constructs-3.3.85"
       sources."date-format-3.0.0"
       sources."debug-4.3.2"
       sources."decamelize-5.0.0"
@@ -69550,13 +69736,13 @@ in
           sources."yargs-16.2.0"
         ];
       })
-      (sources."jsii-srcmak-0.1.280" // {
+      (sources."jsii-srcmak-0.1.288" // {
         dependencies = [
           sources."fs-extra-9.1.0"
         ];
       })
       sources."json-schema-0.3.0"
-      sources."json2jsii-0.1.248"
+      sources."json2jsii-0.1.255"
       sources."jsonfile-6.1.0"
       sources."jsonschema-1.4.0"
       sources."locate-path-5.0.0"
@@ -69592,7 +69778,7 @@ in
       sources."snake-case-3.0.4"
       sources."sort-json-2.0.0"
       sources."spdx-license-list-6.4.0"
-      sources."sscaff-1.2.0"
+      sources."sscaff-1.2.8"
       (sources."streamroller-2.2.4" // {
         dependencies = [
           sources."date-format-2.1.0"
@@ -69604,7 +69790,7 @@ in
       sources."string.prototype.trimstart-1.0.4"
       sources."strip-ansi-6.0.0"
       sources."tslib-2.3.0"
-      sources."typescript-3.9.9"
+      sources."typescript-3.9.10"
       sources."unbox-primitive-1.0.1"
       sources."universalify-2.0.0"
       sources."which-boxed-primitive-1.0.2"
@@ -69627,7 +69813,7 @@ in
           sources."yargs-parser-18.1.3"
         ];
       })
-      sources."yargs-parser-20.2.7"
+      sources."yargs-parser-20.2.9"
     ];
     buildInputs = globalBuildInputs;
     meta = {
@@ -69707,7 +69893,7 @@ in
       sources."commonmark-0.29.3"
       sources."compress-commons-4.1.1"
       sources."concat-map-0.0.1"
-      sources."constructs-3.3.77"
+      sources."constructs-3.3.85"
       sources."convert-to-spaces-1.0.2"
       sources."core-util-is-1.0.2"
       sources."crc-32-1.2.0"
@@ -69826,7 +70012,7 @@ in
           sources."yargs-16.2.0"
         ];
       })
-      (sources."jsii-srcmak-0.1.280" // {
+      (sources."jsii-srcmak-0.1.288" // {
         dependencies = [
           sources."fs-extra-9.1.0"
           sources."jsonfile-6.1.0"
@@ -69909,7 +70095,7 @@ in
       sources."slice-ansi-3.0.0"
       sources."sort-json-2.0.0"
       sources."spdx-license-list-6.4.0"
-      sources."sscaff-1.2.0"
+      sources."sscaff-1.2.8"
       sources."stack-utils-2.0.3"
       sources."stream-buffers-3.0.2"
       (sources."streamroller-2.2.4" // {
@@ -69936,7 +70122,7 @@ in
       sources."supports-color-7.2.0"
       sources."tar-stream-2.2.0"
       sources."type-fest-0.15.1"
-      sources."typescript-3.9.9"
+      sources."typescript-3.9.10"
       sources."unbox-primitive-1.0.1"
       sources."universalify-0.1.2"
       sources."util-deprecate-1.0.2"
@@ -69948,7 +70134,7 @@ in
       sources."widest-line-3.1.0"
       sources."wrap-ansi-6.2.0"
       sources."wrappy-1.0.2"
-      sources."ws-7.4.6"
+      sources."ws-7.5.0"
       sources."xmlbuilder-15.1.1"
       sources."xmldom-0.6.0"
       sources."y18n-5.0.8"
@@ -69960,7 +70146,7 @@ in
           sources."yargs-parser-18.1.3"
         ];
       })
-      sources."yargs-parser-20.2.7"
+      sources."yargs-parser-20.2.9"
       sources."yauzl-2.10.0"
       sources."yn-3.1.1"
       sources."yoga-layout-prebuilt-1.10.0"
@@ -70253,11 +70439,11 @@ in
           sources."pify-2.3.0"
         ];
       })
-      sources."move-file-2.0.0"
+      sources."move-file-2.1.0"
       sources."npm-run-path-3.1.0"
       sources."once-1.4.0"
       sources."onetime-5.1.2"
-      sources."open-8.2.0"
+      sources."open-8.2.1"
       sources."os-homedir-1.0.2"
       sources."p-finally-2.0.1"
       sources."p-map-4.0.0"
@@ -70275,7 +70461,7 @@ in
       sources."signal-exit-3.0.3"
       sources."slash-1.0.0"
       sources."strip-final-newline-2.0.0"
-      sources."trash-7.1.1"
+      sources."trash-7.2.0"
       sources."user-home-2.0.0"
       sources."uuid-8.3.2"
       sources."which-2.0.2"
@@ -70296,10 +70482,10 @@ in
   coc-git = nodeEnv.buildNodePackage {
     name = "coc-git";
     packageName = "coc-git";
-    version = "2.3.3";
+    version = "2.3.5";
     src = fetchurl {
-      url = "https://registry.npmjs.org/coc-git/-/coc-git-2.3.3.tgz";
-      sha512 = "xBdnbesjfMVHYjoCCpLReurLFVIVyvN/Xd+T0/oETLs0lotn1p5F3cZPRiZD0jxtCLMV72dqN/Kuro98HoNplg==";
+      url = "https://registry.npmjs.org/coc-git/-/coc-git-2.3.5.tgz";
+      sha512 = "cuWQcWuPKpFAwcED+EfKtGSsGifJJkAtVh5CGBTDbadNQfHdtj63DF+H3YdlM/bQWgsQMfnjxA+AH/yifBg+Ow==";
     };
     dependencies = [
       sources."lru-cache-6.0.0"
@@ -70367,7 +70553,7 @@ in
       sha512 = "7SHQYzpRKPrpaLcTm1UUk1zu9VvFEJKFqxwDIuqv/CL0cBTtEvlsfpVh9DOaMHlZPu8U8Lgyf04bHV/sFS1zJw==";
     };
     dependencies = [
-      sources."typescript-4.3.2"
+      sources."typescript-4.3.4"
     ];
     buildInputs = globalBuildInputs;
     meta = {
@@ -70435,11 +70621,39 @@ in
   coc-json = nodeEnv.buildNodePackage {
     name = "coc-json";
     packageName = "coc-json";
-    version = "1.3.5";
+    version = "1.3.6";
     src = fetchurl {
-      url = "https://registry.npmjs.org/coc-json/-/coc-json-1.3.5.tgz";
-      sha512 = "Rydv3YbCs2zGNzHfng47QVrnmWSgDdfWS1j1ropjW2R7HZndHIc/ArFv920MXIstDW5TO1LGBy+zhD8hhBYTGg==";
+      url = "https://registry.npmjs.org/coc-json/-/coc-json-1.3.6.tgz";
+      sha512 = "iUKVNmYMZEBpniRRy7iXzcYqDCfamRMU4OOb1b9M9Zi68xbwsu1JVl0ARw5FVCv40ELszK+w/6jKlpS97kTU8w==";
     };
+    dependencies = [
+      sources."agent-base-4.3.0"
+      sources."balanced-match-1.0.2"
+      sources."brace-expansion-1.1.11"
+      sources."concat-map-0.0.1"
+      sources."debug-3.1.0"
+      sources."es6-promise-4.2.8"
+      sources."es6-promisify-5.0.0"
+      sources."http-proxy-agent-2.1.0"
+      sources."https-proxy-agent-2.2.4"
+      sources."jsonc-parser-3.0.0"
+      sources."minimatch-3.0.4"
+      sources."ms-2.0.0"
+      sources."request-light-0.4.0"
+      sources."vscode-json-languageserver-1.3.4"
+      (sources."vscode-json-languageservice-4.1.4" // {
+        dependencies = [
+          sources."vscode-nls-5.0.0"
+        ];
+      })
+      sources."vscode-jsonrpc-6.0.0"
+      sources."vscode-languageserver-7.0.0"
+      sources."vscode-languageserver-protocol-3.16.0"
+      sources."vscode-languageserver-textdocument-1.0.1"
+      sources."vscode-languageserver-types-3.16.0"
+      sources."vscode-nls-4.1.2"
+      sources."vscode-uri-3.0.2"
+    ];
     buildInputs = globalBuildInputs;
     meta = {
       description = "Json extension for coc.nvim";
@@ -70452,10 +70666,10 @@ in
   coc-lists = nodeEnv.buildNodePackage {
     name = "coc-lists";
     packageName = "coc-lists";
-    version = "1.4.1";
+    version = "1.4.2";
     src = fetchurl {
-      url = "https://registry.npmjs.org/coc-lists/-/coc-lists-1.4.1.tgz";
-      sha512 = "A87irHxQ97+VkgM8SgTLZDyOT/t7V0uMqg/Jk1hx+TQVsAZljBNZq88yaUZIo6SBfmeHroGUUzFs597GJf7N5Q==";
+      url = "https://registry.npmjs.org/coc-lists/-/coc-lists-1.4.2.tgz";
+      sha512 = "p8FdQN+nP/JDb816U3FoU1uTPncxCeE3i+rWJSM+wzyDKeZLcx5Szpkq9ao06fL33N+RWTghEJrEeMLjq6+Q9A==";
     };
     buildInputs = globalBuildInputs;
     meta = {
@@ -70778,7 +70992,7 @@ in
       sources."callsites-3.1.0"
       sources."camelcase-2.1.1"
       sources."camelcase-keys-2.1.0"
-      sources."caniuse-lite-1.0.30001237"
+      sources."caniuse-lite-1.0.30001239"
       sources."capture-stack-trace-1.0.1"
       sources."ccount-1.1.0"
       (sources."chalk-4.1.1" // {
@@ -70840,7 +71054,7 @@ in
         ];
       })
       sources."copy-descriptor-0.1.1"
-      sources."core-js-3.14.0"
+      sources."core-js-3.15.0"
       sources."cosmiconfig-3.1.0"
       sources."create-error-class-3.0.2"
       sources."cross-spawn-7.0.3"
@@ -70883,7 +71097,7 @@ in
       sources."entities-1.1.2"
       sources."error-ex-1.3.2"
       sources."escape-string-regexp-4.0.0"
-      (sources."eslint-7.28.0" // {
+      (sources."eslint-7.29.0" // {
         dependencies = [
           sources."eslint-visitor-keys-2.1.0"
         ];
@@ -71387,7 +71601,7 @@ in
       })
       sources."regex-cache-0.4.4"
       sources."regex-not-1.0.2"
-      sources."regexpp-3.1.0"
+      sources."regexpp-3.2.0"
       sources."registry-auth-token-3.4.0"
       sources."registry-url-3.1.0"
       sources."remark-8.0.0"
@@ -71576,7 +71790,7 @@ in
       sources."tsutils-3.21.0"
       sources."type-check-0.4.0"
       sources."type-fest-0.20.2"
-      sources."typescript-3.9.9"
+      sources."typescript-3.9.10"
       sources."unherit-1.1.3"
       sources."unified-6.2.0"
       sources."union-value-1.0.1"
@@ -71675,13 +71889,13 @@ in
   coc-pyright = nodeEnv.buildNodePackage {
     name = "coc-pyright";
     packageName = "coc-pyright";
-    version = "1.1.148";
+    version = "1.1.150";
     src = fetchurl {
-      url = "https://registry.npmjs.org/coc-pyright/-/coc-pyright-1.1.148.tgz";
-      sha512 = "AudslTXxhUIiBsitc6bQcUUS+P7J1q1fU2XYDFp3CxBN+MJLDjT0LdARklN4N01W9mvT9hCW9cwfJKuk4dsCNg==";
+      url = "https://registry.npmjs.org/coc-pyright/-/coc-pyright-1.1.150.tgz";
+      sha512 = "+dWSYM9AfBsYeOclQNmuHcw9aKWwL6XICmPm64N9peWE+oXqMOAShaH5xO+JV+r88R0wTN/LJaEwGHlkxJD2XA==";
     };
     dependencies = [
-      sources."pyright-1.1.148"
+      sources."pyright-1.1.151"
     ];
     buildInputs = globalBuildInputs;
     meta = {
@@ -71755,10 +71969,10 @@ in
   coc-rust-analyzer = nodeEnv.buildNodePackage {
     name = "coc-rust-analyzer";
     packageName = "coc-rust-analyzer";
-    version = "0.46.1";
+    version = "0.46.2";
     src = fetchurl {
-      url = "https://registry.npmjs.org/coc-rust-analyzer/-/coc-rust-analyzer-0.46.1.tgz";
-      sha512 = "FnHbToRGz0isjp4C/Fp5K+gX5vuuYmT8jlUdExWlhhTh7X+4pTz2xYlgaBX2/UTZQqOgn/wM4lxKlZtOpKVVCA==";
+      url = "https://registry.npmjs.org/coc-rust-analyzer/-/coc-rust-analyzer-0.46.2.tgz";
+      sha512 = "uEFyQAaWQ60qY2q74jXn8Wk73QMekHVSRKuBP178uVV/xAhyd24psr+pNrdZxXVZGBRwuRLgHFd+N5YhikOBMw==";
     };
     buildInputs = globalBuildInputs;
     meta = {
@@ -71808,10 +72022,10 @@ in
   coc-solargraph = nodeEnv.buildNodePackage {
     name = "coc-solargraph";
     packageName = "coc-solargraph";
-    version = "1.2.0";
+    version = "1.2.1";
     src = fetchurl {
-      url = "https://registry.npmjs.org/coc-solargraph/-/coc-solargraph-1.2.0.tgz";
-      sha512 = "0bvily8jnfmBx/WjNgZ/1TNVSV2BBSsaAflc4bhwtw1mN7XLAiXLpeK3Eps6qwOYMtTRngJFKxNXKoAM2bCY/A==";
+      url = "https://registry.npmjs.org/coc-solargraph/-/coc-solargraph-1.2.1.tgz";
+      sha512 = "7e+5qluZxgGrw3l/3ib3BLPm2XlfHp1Gxkcb33vmJAw4CC0TDCB+pw2DyWPVGC3t68rLGGAzo5pYCtaGRoxojw==";
     };
     buildInputs = globalBuildInputs;
     meta = {
@@ -71833,7 +72047,7 @@ in
     dependencies = [
       sources."@babel/code-frame-7.14.5"
       sources."@babel/compat-data-7.14.5"
-      sources."@babel/core-7.14.5"
+      sources."@babel/core-7.14.6"
       sources."@babel/generator-7.14.5"
       sources."@babel/helper-compilation-targets-7.14.5"
       sources."@babel/helper-function-name-7.14.5"
@@ -71848,13 +72062,13 @@ in
       sources."@babel/helper-split-export-declaration-7.14.5"
       sources."@babel/helper-validator-identifier-7.14.5"
       sources."@babel/helper-validator-option-7.14.5"
-      sources."@babel/helpers-7.14.5"
+      sources."@babel/helpers-7.14.6"
       (sources."@babel/highlight-7.14.5" // {
         dependencies = [
           sources."chalk-2.4.2"
         ];
       })
-      sources."@babel/parser-7.14.5"
+      sources."@babel/parser-7.14.6"
       sources."@babel/template-7.14.5"
       sources."@babel/traverse-7.14.5"
       sources."@babel/types-7.14.5"
@@ -71887,7 +72101,7 @@ in
       sources."callsites-3.1.0"
       sources."camelcase-5.3.1"
       sources."camelcase-keys-6.2.2"
-      sources."caniuse-lite-1.0.30001237"
+      sources."caniuse-lite-1.0.30001239"
       (sources."chalk-4.1.1" // {
         dependencies = [
           sources."ansi-styles-4.3.0"
@@ -71905,7 +72119,7 @@ in
       sources."color-name-1.1.3"
       sources."colorette-1.2.2"
       sources."concat-map-0.0.1"
-      sources."convert-source-map-1.7.0"
+      sources."convert-source-map-1.8.0"
       sources."cosmiconfig-7.0.0"
       sources."cssesc-3.0.0"
       sources."debug-4.3.2"
@@ -71952,7 +72166,7 @@ in
       sources."global-modules-2.0.0"
       sources."global-prefix-3.0.0"
       sources."globals-11.12.0"
-      sources."globby-11.0.3"
+      sources."globby-11.0.4"
       sources."globjoin-0.1.4"
       sources."gonzales-pe-4.3.0"
       sources."hard-rejection-2.1.0"
@@ -72155,7 +72369,7 @@ in
       sources."write-file-atomic-3.0.3"
       sources."yallist-4.0.0"
       sources."yaml-1.10.2"
-      sources."yargs-parser-20.2.7"
+      sources."yargs-parser-20.2.9"
       sources."zwitch-1.0.5"
     ];
     buildInputs = globalBuildInputs;
@@ -72187,10 +72401,10 @@ in
   coc-texlab = nodeEnv.buildNodePackage {
     name = "coc-texlab";
     packageName = "coc-texlab";
-    version = "3.1.0";
+    version = "3.2.0";
     src = fetchurl {
-      url = "https://registry.npmjs.org/coc-texlab/-/coc-texlab-3.1.0.tgz";
-      sha512 = "wO2krr6/HKQuEONvSg6t+qwDrF68OvYpPjAz/AHcynXNpYX3M+LZaenzavultjsxQ/K0TU1ZiRI3VnI4YeTP/g==";
+      url = "https://registry.npmjs.org/coc-texlab/-/coc-texlab-3.2.0.tgz";
+      sha512 = "E4RgWfRcqbgRfc2L4dJrsDRV/wsjqV31H+yiAfREg2JfxC26q7QRcQU9KILHSgVjpQ7VqXpcmDxcT2jn5YzIwA==";
     };
     buildInputs = globalBuildInputs;
     meta = {
@@ -72250,7 +72464,7 @@ in
       sources."tslib-1.14.1"
       sources."tslint-5.20.1"
       sources."tsutils-2.29.0"
-      sources."typescript-3.9.9"
+      sources."typescript-3.9.10"
       sources."wrappy-1.0.2"
     ];
     buildInputs = globalBuildInputs;
@@ -72305,7 +72519,7 @@ in
       sha512 = "qkVsa46XLmOCmohpQhhz1SG9vUQN/54b/zZsDI5fnuBM49GX9f+Aya8m9ZidAzuwFKV+ostgvdWaB+GeQPPNPQ==";
     };
     dependencies = [
-      sources."typescript-4.3.2"
+      sources."typescript-4.3.4"
     ];
     buildInputs = globalBuildInputs;
     meta = {
@@ -72368,8 +72582,8 @@ in
       sources."emoji-regex-8.0.0"
       sources."enquirer-2.3.6"
       sources."escape-string-regexp-4.0.0"
-      sources."eslint-7.28.0"
-      sources."eslint-plugin-vue-7.11.0"
+      sources."eslint-7.29.0"
+      sources."eslint-plugin-vue-7.11.1"
       sources."eslint-scope-5.1.1"
       (sources."eslint-utils-2.1.0" // {
         dependencies = [
@@ -72444,7 +72658,7 @@ in
       sources."prettier-2.3.1"
       sources."progress-2.0.3"
       sources."punycode-2.1.1"
-      sources."regexpp-3.1.0"
+      sources."regexpp-3.2.0"
       sources."require-from-string-2.0.2"
       sources."resolve-1.20.0"
       sources."resolve-from-4.0.0"
@@ -72482,7 +72696,7 @@ in
       sources."tsutils-2.29.0"
       sources."type-check-0.4.0"
       sources."type-fest-0.20.2"
-      sources."typescript-4.3.2"
+      sources."typescript-4.3.4"
       sources."uri-js-4.4.1"
       sources."v8-compile-cache-2.3.0"
       sources."vls-0.7.4"
@@ -72777,7 +72991,7 @@ in
       sources."@nodelib/fs.scandir-2.1.5"
       sources."@nodelib/fs.stat-2.0.5"
       sources."@nodelib/fs.walk-1.2.7"
-      sources."@npmcli/git-2.0.9"
+      sources."@npmcli/git-2.1.0"
       sources."@npmcli/installed-package-contents-1.0.7"
       sources."@npmcli/move-file-1.1.2"
       sources."@npmcli/node-gyp-1.0.2"
@@ -72986,7 +73200,7 @@ in
       sources."glob-7.1.7"
       sources."glob-parent-5.1.2"
       sources."global-dirs-2.1.0"
-      sources."globby-11.0.3"
+      sources."globby-11.0.4"
       (sources."got-9.6.0" // {
         dependencies = [
           sources."get-stream-4.1.0"
@@ -73113,7 +73327,7 @@ in
           sources."semver-6.3.0"
         ];
       })
-      sources."make-fetch-happen-9.0.2"
+      sources."make-fetch-happen-9.0.3"
       sources."md5-file-5.0.0"
       sources."media-typer-0.3.0"
       sources."merge-descriptors-1.0.1"
@@ -73157,7 +73371,7 @@ in
       sources."npm-bundled-1.1.2"
       sources."npm-install-checks-4.0.0"
       sources."npm-normalize-package-bin-1.0.1"
-      sources."npm-package-arg-8.1.4"
+      sources."npm-package-arg-8.1.5"
       sources."npm-packlist-2.2.2"
       sources."npm-pick-manifest-6.1.1"
       sources."npm-registry-fetch-11.0.0"
@@ -73166,7 +73380,7 @@ in
       sources."number-is-nan-1.0.1"
       sources."oauth-sign-0.9.0"
       sources."object-assign-4.1.1"
-      sources."objectorarray-1.0.4"
+      sources."objectorarray-1.0.5"
       sources."on-finished-2.3.0"
       sources."on-headers-1.0.2"
       sources."once-1.4.0"
@@ -73278,7 +73492,7 @@ in
       sources."slash-3.0.0"
       sources."smart-buffer-4.1.0"
       sources."socks-2.6.1"
-      sources."socks-proxy-agent-5.0.0"
+      sources."socks-proxy-agent-5.0.1"
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
@@ -73387,7 +73601,7 @@ in
       sources."@types/glob-7.1.3"
       sources."@types/minimatch-3.0.4"
       sources."@types/minimist-1.2.1"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."@types/normalize-package-data-2.4.0"
       sources."aggregate-error-3.1.0"
       sources."ansi-styles-3.2.1"
@@ -73758,7 +73972,7 @@ in
       sources."@cycle/run-3.4.0"
       sources."@cycle/time-0.10.1"
       sources."@types/cookiejar-2.1.2"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."@types/superagent-3.8.2"
       sources."ansi-escapes-3.2.0"
       sources."ansi-regex-2.1.1"
@@ -74673,7 +74887,7 @@ in
       sources."use-3.1.1"
       sources."util-deprecate-1.0.2"
       sources."utile-0.3.0"
-      (sources."utp-native-2.5.0" // {
+      (sources."utp-native-2.5.1" // {
         dependencies = [
           sources."node-gyp-build-4.2.3"
           sources."readable-stream-3.6.0"
@@ -74760,7 +74974,7 @@ in
       sources."fs.realpath-1.0.0"
       sources."glob-7.1.7"
       sources."glob-parent-5.1.2"
-      sources."globby-11.0.3"
+      sources."globby-11.0.4"
       sources."graceful-fs-4.2.6"
       sources."ignore-5.1.8"
       sources."indent-string-4.0.0"
@@ -75072,7 +75286,7 @@ in
       sources."@types/http-cache-semantics-4.0.0"
       sources."@types/keyv-3.1.1"
       sources."@types/minimatch-3.0.4"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."@types/responselike-1.0.0"
       sources."@types/yauzl-2.9.1"
       sources."abbrev-1.1.1"
@@ -75148,7 +75362,7 @@ in
       sources."concat-map-0.0.1"
       sources."config-chain-1.1.13"
       sources."console-control-strings-1.1.0"
-      sources."core-js-3.14.0"
+      sources."core-js-3.15.0"
       sources."core-util-is-1.0.2"
       sources."cross-spawn-7.0.3"
       sources."currently-unhandled-0.4.1"
@@ -75304,7 +75518,7 @@ in
       sources."inflight-1.0.6"
       sources."inherits-2.0.4"
       sources."ini-1.3.8"
-      (sources."inquirer-8.1.0" // {
+      (sources."inquirer-8.1.1" // {
         dependencies = [
           sources."is-fullwidth-code-point-3.0.0"
           sources."string-width-4.2.2"
@@ -75442,7 +75656,7 @@ in
       sources."object-keys-0.4.0"
       sources."once-1.4.0"
       sources."onetime-5.1.2"
-      sources."open-8.2.0"
+      sources."open-8.2.1"
       sources."ora-5.4.1"
       sources."os-homedir-1.0.2"
       sources."os-tmpdir-1.0.2"
@@ -75608,7 +75822,7 @@ in
           sources."string-width-4.2.2"
         ];
       })
-      sources."yargs-parser-20.2.7"
+      sources."yargs-parser-20.2.9"
       (sources."yarn-or-npm-3.0.1" // {
         dependencies = [
           sources."cross-spawn-6.0.5"
@@ -75661,7 +75875,7 @@ in
     dependencies = [
       sources."@babel/code-frame-7.14.5"
       sources."@babel/compat-data-7.14.5"
-      (sources."@babel/core-7.14.5" // {
+      (sources."@babel/core-7.14.6" // {
         dependencies = [
           sources."semver-6.3.0"
         ];
@@ -75686,9 +75900,9 @@ in
       sources."@babel/helper-split-export-declaration-7.14.5"
       sources."@babel/helper-validator-identifier-7.14.5"
       sources."@babel/helper-validator-option-7.14.5"
-      sources."@babel/helpers-7.14.5"
+      sources."@babel/helpers-7.14.6"
       sources."@babel/highlight-7.14.5"
-      sources."@babel/parser-7.14.5"
+      sources."@babel/parser-7.14.6"
       sources."@babel/plugin-proposal-object-rest-spread-7.14.5"
       sources."@babel/plugin-syntax-jsx-7.14.5"
       sources."@babel/plugin-syntax-object-rest-spread-7.8.3"
@@ -75704,7 +75918,7 @@ in
       sources."@types/http-cache-semantics-4.0.0"
       sources."@types/keyv-3.1.1"
       sources."@types/minimist-1.2.1"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."@types/normalize-package-data-2.4.0"
       sources."@types/responselike-1.0.0"
       sources."@types/yoga-layout-1.9.2"
@@ -75739,7 +75953,7 @@ in
           sources."quick-lru-4.0.1"
         ];
       })
-      sources."caniuse-lite-1.0.30001237"
+      sources."caniuse-lite-1.0.30001239"
       sources."chalk-2.4.2"
       sources."ci-info-2.0.0"
       sources."cli-boxes-2.2.1"
@@ -75758,7 +75972,7 @@ in
           sources."semver-7.3.5"
         ];
       })
-      sources."convert-source-map-1.7.0"
+      sources."convert-source-map-1.8.0"
       sources."convert-to-spaces-1.0.2"
       sources."cross-spawn-6.0.5"
       sources."debounce-fn-4.0.0"
@@ -75987,7 +76201,7 @@ in
         ];
       })
       sources."wrappy-1.0.2"
-      sources."ws-7.4.6"
+      sources."ws-7.5.0"
       sources."yallist-4.0.0"
       sources."yargs-parser-18.1.3"
       sources."yoga-layout-prebuilt-1.10.0"
@@ -76037,7 +76251,7 @@ in
       sources."@fluentui/date-time-utilities-7.9.1"
       sources."@fluentui/dom-utilities-1.1.2"
       sources."@fluentui/keyboard-key-0.2.17"
-      sources."@fluentui/react-7.170.3"
+      sources."@fluentui/react-7.172.0"
       sources."@fluentui/react-focus-7.17.6"
       sources."@fluentui/react-window-provider-1.0.2"
       sources."@fluentui/theme-1.7.4"
@@ -76051,7 +76265,7 @@ in
           sources."normalize-path-2.1.1"
         ];
       })
-      sources."@microsoft/load-themed-styles-1.10.181"
+      sources."@microsoft/load-themed-styles-1.10.185"
       sources."@nodelib/fs.scandir-2.1.5"
       sources."@nodelib/fs.stat-2.0.5"
       sources."@nodelib/fs.walk-1.2.7"
@@ -76395,7 +76609,7 @@ in
       sources."constants-browserify-1.0.0"
       sources."content-disposition-0.5.3"
       sources."content-type-1.0.4"
-      sources."convert-source-map-1.7.0"
+      sources."convert-source-map-1.8.0"
       sources."cookie-0.4.0"
       sources."cookie-signature-1.0.6"
       (sources."copy-concurrently-1.0.5" // {
@@ -77078,7 +77292,7 @@ in
       sources."object.map-1.0.1"
       sources."object.pick-1.3.0"
       sources."object.reduce-1.0.1"
-      sources."office-ui-fabric-react-7.170.3"
+      sources."office-ui-fabric-react-7.172.0"
       sources."on-finished-2.3.0"
       sources."on-headers-1.0.2"
       sources."once-1.4.0"
@@ -77305,14 +77519,14 @@ in
       sources."safe-buffer-5.1.2"
       sources."safe-regex-1.1.0"
       sources."safer-buffer-2.1.2"
-      (sources."sass-1.34.1" // {
+      (sources."sass-1.35.1" // {
         dependencies = [
           sources."anymatch-3.1.2"
           sources."binary-extensions-2.2.0"
-          sources."chokidar-3.5.1"
+          sources."chokidar-3.5.2"
           sources."fsevents-2.3.2"
           sources."is-binary-path-2.1.0"
-          sources."readdirp-3.5.0"
+          sources."readdirp-3.6.0"
         ];
       })
       sources."sax-1.2.4"
@@ -77482,7 +77696,7 @@ in
       sources."sver-compat-1.5.0"
       sources."swagger-schema-official-2.0.0-bab6bed"
       sources."swagger-ui-dist-3.34.0"
-      sources."tail-2.2.2"
+      sources."tail-2.2.3"
       sources."tapable-1.1.3"
       (sources."tar-4.4.13" // {
         dependencies = [
@@ -77614,10 +77828,10 @@ in
         dependencies = [
           sources."anymatch-3.1.2"
           sources."binary-extensions-2.2.0"
-          sources."chokidar-3.5.1"
+          sources."chokidar-3.5.2"
           sources."fsevents-2.3.2"
           sources."is-binary-path-2.1.0"
-          sources."readdirp-3.5.0"
+          sources."readdirp-3.6.0"
         ];
       })
       sources."watchpack-chokidar2-2.0.1"
@@ -77675,7 +77889,7 @@ in
         ];
       })
       sources."wrappy-1.0.2"
-      sources."ws-7.4.6"
+      sources."ws-7.5.0"
       sources."xmlhttprequest-ssl-1.5.5"
       sources."xtend-4.0.2"
       sources."y18n-3.2.2"
@@ -77721,10 +77935,10 @@ in
   eslint = nodeEnv.buildNodePackage {
     name = "eslint";
     packageName = "eslint";
-    version = "7.28.0";
+    version = "7.29.0";
     src = fetchurl {
-      url = "https://registry.npmjs.org/eslint/-/eslint-7.28.0.tgz";
-      sha512 = "UMfH0VSjP0G4p3EWirscJEQ/cHqnT/iuH6oNZOB94nBjWbMnhGEPxsZm1eyIW0C/9jLI0Fow4W5DXLjEI7mn1g==";
+      url = "https://registry.npmjs.org/eslint/-/eslint-7.29.0.tgz";
+      sha512 = "82G/JToB9qIy/ArBzIWG9xvvwL3R86AlCjtGw+A29OMZDqhTybz/MByORSukGxeI+YPCR4coYyITKk8BFH9nDA==";
     };
     dependencies = [
       sources."@babel/code-frame-7.12.11"
@@ -77832,7 +78046,7 @@ in
       sources."prelude-ls-1.2.1"
       sources."progress-2.0.3"
       sources."punycode-2.1.1"
-      sources."regexpp-3.1.0"
+      sources."regexpp-3.2.0"
       sources."require-from-string-2.0.2"
       sources."resolve-from-4.0.0"
       sources."rimraf-3.0.2"
@@ -77927,7 +78141,7 @@ in
       sources."emoji-regex-8.0.0"
       sources."enquirer-2.3.6"
       sources."escape-string-regexp-4.0.0"
-      sources."eslint-7.28.0"
+      sources."eslint-7.29.0"
       sources."eslint-scope-5.1.1"
       (sources."eslint-utils-2.1.0" // {
         dependencies = [
@@ -77995,7 +78209,7 @@ in
       sources."prelude-ls-1.2.1"
       sources."progress-2.0.3"
       sources."punycode-2.1.1"
-      sources."regexpp-3.1.0"
+      sources."regexpp-3.2.0"
       sources."require-from-string-2.0.2"
       sources."resolve-from-4.0.0"
       sources."rimraf-3.0.2"
@@ -78081,7 +78295,7 @@ in
           sources."semver-6.3.0"
         ];
       })
-      sources."@babel/helper-create-class-features-plugin-7.14.5"
+      sources."@babel/helper-create-class-features-plugin-7.14.6"
       sources."@babel/helper-create-regexp-features-plugin-7.14.5"
       (sources."@babel/helper-define-polyfill-provider-0.2.3" // {
         dependencies = [
@@ -78105,13 +78319,13 @@ in
       sources."@babel/helper-validator-identifier-7.14.5"
       sources."@babel/helper-validator-option-7.14.5"
       sources."@babel/helper-wrap-function-7.14.5"
-      sources."@babel/helpers-7.14.5"
+      sources."@babel/helpers-7.14.6"
       (sources."@babel/highlight-7.14.5" // {
         dependencies = [
           sources."chalk-2.4.2"
         ];
       })
-      sources."@babel/parser-7.14.5"
+      sources."@babel/parser-7.14.6"
       sources."@babel/plugin-proposal-async-generator-functions-7.14.5"
       sources."@babel/plugin-proposal-class-properties-7.12.13"
       sources."@babel/plugin-proposal-dynamic-import-7.14.5"
@@ -78179,11 +78393,11 @@ in
         ];
       })
       sources."@babel/plugin-transform-shorthand-properties-7.14.5"
-      sources."@babel/plugin-transform-spread-7.14.5"
+      sources."@babel/plugin-transform-spread-7.14.6"
       sources."@babel/plugin-transform-sticky-regex-7.14.5"
       sources."@babel/plugin-transform-template-literals-7.14.5"
       sources."@babel/plugin-transform-typeof-symbol-7.14.5"
-      sources."@babel/plugin-transform-typescript-7.14.5"
+      sources."@babel/plugin-transform-typescript-7.14.6"
       sources."@babel/plugin-transform-unicode-escapes-7.14.5"
       sources."@babel/plugin-transform-unicode-regex-7.14.5"
       (sources."@babel/preset-env-7.12.17" // {
@@ -78193,7 +78407,7 @@ in
       })
       sources."@babel/preset-modules-0.1.4"
       sources."@babel/preset-typescript-7.12.17"
-      sources."@babel/runtime-7.14.5"
+      sources."@babel/runtime-7.14.6"
       sources."@babel/template-7.14.5"
       sources."@babel/traverse-7.14.5"
       sources."@babel/types-7.14.5"
@@ -78217,7 +78431,7 @@ in
           sources."iconv-lite-0.4.24"
           sources."inherits-2.0.3"
           sources."ms-2.0.0"
-          sources."open-8.2.0"
+          sources."open-8.2.1"
           sources."qs-6.7.0"
           sources."raw-body-2.4.0"
           sources."setprototypeof-1.1.1"
@@ -78331,7 +78545,7 @@ in
       sources."@nodelib/fs.scandir-2.1.5"
       sources."@nodelib/fs.stat-2.0.5"
       sources."@nodelib/fs.walk-1.2.7"
-      (sources."@npmcli/git-2.0.9" // {
+      (sources."@npmcli/git-2.1.0" // {
         dependencies = [
           sources."mkdirp-1.0.4"
           sources."semver-7.3.5"
@@ -78517,7 +78731,7 @@ in
           sources."semver-6.3.0"
         ];
       })
-      sources."babel-plugin-polyfill-corejs3-0.2.2"
+      sources."babel-plugin-polyfill-corejs3-0.2.3"
       sources."babel-plugin-polyfill-regenerator-0.2.2"
       sources."babel-plugin-syntax-object-rest-spread-6.13.0"
       sources."babel-plugin-syntax-trailing-function-commas-7.0.0-beta.0"
@@ -78613,7 +78827,7 @@ in
       })
       sources."camelcase-5.3.1"
       sources."caniuse-api-3.0.0"
-      sources."caniuse-lite-1.0.30001237"
+      sources."caniuse-lite-1.0.30001239"
       sources."caseless-0.12.0"
       (sources."chalk-4.1.1" // {
         dependencies = [
@@ -78625,7 +78839,7 @@ in
         ];
       })
       sources."charenc-0.0.2"
-      sources."chokidar-3.5.1"
+      sources."chokidar-3.5.2"
       sources."chownr-2.0.0"
       sources."chrome-trace-event-1.0.3"
       sources."ci-info-3.2.0"
@@ -78722,7 +78936,7 @@ in
       sources."constants-browserify-1.0.0"
       sources."content-disposition-0.5.2"
       sources."content-type-1.0.4"
-      sources."convert-source-map-1.7.0"
+      sources."convert-source-map-1.8.0"
       sources."cookie-0.3.1"
       sources."cookie-signature-1.0.6"
       (sources."copy-concurrently-1.0.5" // {
@@ -78747,7 +78961,7 @@ in
         ];
       })
       sources."core-js-2.6.12"
-      (sources."core-js-compat-3.14.0" // {
+      (sources."core-js-compat-3.15.0" // {
         dependencies = [
           sources."semver-7.0.0"
         ];
@@ -79347,7 +79561,7 @@ in
           sources."semver-5.7.1"
         ];
       })
-      (sources."make-fetch-happen-9.0.2" // {
+      (sources."make-fetch-happen-9.0.3" // {
         dependencies = [
           sources."minipass-3.1.3"
         ];
@@ -79502,7 +79716,7 @@ in
       (sources."npm-pick-manifest-6.1.1" // {
         dependencies = [
           sources."hosted-git-info-4.0.2"
-          sources."npm-package-arg-8.1.4"
+          sources."npm-package-arg-8.1.5"
           sources."semver-7.3.5"
         ];
       })
@@ -79510,7 +79724,7 @@ in
         dependencies = [
           sources."hosted-git-info-4.0.2"
           sources."minipass-3.1.3"
-          sources."npm-package-arg-8.1.4"
+          sources."npm-package-arg-8.1.5"
           sources."semver-7.3.5"
         ];
       })
@@ -79610,7 +79824,7 @@ in
           sources."hosted-git-info-4.0.2"
           sources."minipass-3.1.3"
           sources."mkdirp-1.0.4"
-          sources."npm-package-arg-8.1.4"
+          sources."npm-package-arg-8.1.5"
           sources."rimraf-3.0.2"
           sources."semver-7.3.5"
         ];
@@ -79889,7 +80103,7 @@ in
       sources."read-last-lines-1.6.0"
       sources."read-package-json-fast-2.0.2"
       sources."readable-stream-2.3.7"
-      sources."readdirp-3.5.0"
+      sources."readdirp-3.6.0"
       sources."recursive-readdir-2.2.2"
       sources."regenerate-1.4.2"
       sources."regenerate-unicode-properties-8.2.0"
@@ -80053,7 +80267,7 @@ in
         ];
       })
       sources."socks-2.6.1"
-      sources."socks-proxy-agent-5.0.0"
+      sources."socks-proxy-agent-5.0.1"
       sources."source-list-map-2.0.1"
       sources."source-map-0.5.7"
       sources."source-map-resolve-0.5.3"
@@ -80765,7 +80979,7 @@ in
       sources."@babel/helper-split-export-declaration-7.14.5"
       sources."@babel/helper-validator-identifier-7.14.5"
       sources."@babel/highlight-7.14.5"
-      sources."@babel/parser-7.14.5"
+      sources."@babel/parser-7.14.6"
       sources."@babel/template-7.14.5"
       sources."@babel/traverse-7.14.5"
       sources."@babel/types-7.14.5"
@@ -80800,7 +81014,7 @@ in
       })
       (sources."@oclif/config-1.17.0" // {
         dependencies = [
-          sources."globby-11.0.3"
+          sources."globby-11.0.4"
           sources."tslib-2.3.0"
         ];
       })
@@ -81370,10 +81584,10 @@ in
   firebase-tools = nodeEnv.buildNodePackage {
     name = "firebase-tools";
     packageName = "firebase-tools";
-    version = "9.12.1";
+    version = "9.13.1";
     src = fetchurl {
-      url = "https://registry.npmjs.org/firebase-tools/-/firebase-tools-9.12.1.tgz";
-      sha512 = "izgpgUiG36UwIV12oBu3X8ndACGsxh2cuREnGgTAoTs6P5OC2nEV3riwAak9eQpkuqHfZ6vEuw5ogSbMNqRIgA==";
+      url = "https://registry.npmjs.org/firebase-tools/-/firebase-tools-9.13.1.tgz";
+      sha512 = "o8sdTxKtZOG1BJ8SmIHLbwJPkp+C25uUWq7Gcu5+Ksc1obHKKa8dYSH2kEC56gXyoGL5vmGdM8UUDTe7oUy4KA==";
     };
     dependencies = [
       (sources."@apidevtools/json-schema-ref-parser-9.0.9" // {
@@ -81386,7 +81600,7 @@ in
       sources."@google-cloud/precise-date-2.0.3"
       sources."@google-cloud/projectify-2.1.0"
       sources."@google-cloud/promisify-2.0.3"
-      (sources."@google-cloud/pubsub-2.13.0" // {
+      (sources."@google-cloud/pubsub-2.14.0" // {
         dependencies = [
           sources."google-auth-library-7.1.2"
         ];
@@ -81399,8 +81613,8 @@ in
           sources."mkdirp-1.0.4"
         ];
       })
-      sources."@opentelemetry/api-0.18.1"
-      sources."@opentelemetry/semantic-conventions-0.18.2"
+      sources."@opentelemetry/api-0.20.0"
+      sources."@opentelemetry/semantic-conventions-0.20.0"
       sources."@protobufjs/aspromise-1.1.2"
       sources."@protobufjs/base64-1.1.2"
       sources."@protobufjs/codegen-2.0.4"
@@ -81420,7 +81634,7 @@ in
       sources."@types/json-schema-7.0.7"
       sources."@types/long-4.0.1"
       sources."@types/minimatch-3.0.4"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."JSONStream-1.3.5"
       sources."abbrev-1.1.1"
       sources."abort-controller-3.0.0"
@@ -81536,7 +81750,7 @@ in
         ];
       })
       sources."chardet-0.7.0"
-      sources."chokidar-3.5.1"
+      sources."chokidar-3.5.2"
       sources."chownr-2.0.0"
       sources."ci-info-2.0.0"
       sources."cjson-0.3.3"
@@ -81772,7 +81986,7 @@ in
       sources."glob-slasher-1.0.1"
       sources."global-dirs-2.1.0"
       sources."google-auth-library-6.1.6"
-      (sources."google-gax-2.15.0" // {
+      (sources."google-gax-2.15.1" // {
         dependencies = [
           sources."google-auth-library-7.1.2"
         ];
@@ -82059,7 +82273,7 @@ in
       sources."re2-1.16.0"
       sources."readable-stream-3.6.0"
       sources."readdir-glob-1.1.1"
-      sources."readdirp-3.5.0"
+      sources."readdirp-3.6.0"
       sources."redeyed-2.1.1"
       sources."registry-auth-token-4.2.1"
       sources."registry-url-5.1.0"
@@ -82118,7 +82332,7 @@ in
       sources."simple-swizzle-0.2.2"
       sources."smart-buffer-4.1.0"
       sources."socks-2.6.1"
-      sources."socks-proxy-agent-5.0.0"
+      sources."socks-proxy-agent-5.0.1"
       sources."source-map-0.6.1"
       sources."sprintf-js-1.0.3"
       sources."sshpk-1.16.1"
@@ -82269,7 +82483,7 @@ in
       sources."wrap-ansi-7.0.0"
       sources."wrappy-1.0.2"
       sources."write-file-atomic-3.0.3"
-      sources."ws-7.4.6"
+      sources."ws-7.5.0"
       sources."xdg-basedir-4.0.0"
       sources."xregexp-2.0.0"
       sources."xtend-4.0.2"
@@ -82277,7 +82491,7 @@ in
       sources."yallist-4.0.0"
       sources."yaml-1.10.2"
       sources."yargs-16.2.0"
-      sources."yargs-parser-20.2.7"
+      sources."yargs-parser-20.2.9"
       sources."zip-stream-4.1.0"
     ];
     buildInputs = globalBuildInputs;
@@ -82327,7 +82541,7 @@ in
       sources."wrappy-1.0.2"
       sources."y18n-5.0.8"
       sources."yargs-16.2.0"
-      sources."yargs-parser-20.2.7"
+      sources."yargs-parser-20.2.9"
     ];
     buildInputs = globalBuildInputs;
     meta = {
@@ -82405,7 +82619,7 @@ in
       sources."iconv-lite-0.4.24"
       sources."indent-string-4.0.0"
       sources."inquirer-7.3.3"
-      sources."inquirer-autocomplete-prompt-1.3.0"
+      sources."inquirer-autocomplete-prompt-1.4.0"
       sources."is-arrayish-0.2.1"
       sources."is-core-module-2.4.0"
       sources."is-fullwidth-code-point-3.0.0"
@@ -82506,7 +82720,7 @@ in
       sources."which-2.0.2"
       sources."wrappy-1.0.2"
       sources."yallist-4.0.0"
-      sources."yargs-parser-20.2.7"
+      sources."yargs-parser-20.2.9"
     ];
     buildInputs = globalBuildInputs;
     meta = {
@@ -82529,7 +82743,7 @@ in
     dependencies = [
       sources."@types/atob-2.1.2"
       sources."@types/inquirer-6.5.0"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."@types/through-0.0.30"
       sources."ajv-6.12.6"
       sources."ansi-escapes-4.3.2"
@@ -82576,7 +82790,7 @@ in
       sources."escape-string-regexp-1.0.5"
       sources."esprima-4.0.1"
       sources."eth-lib-0.2.8"
-      sources."ethereum-bloom-filters-1.0.9"
+      sources."ethereum-bloom-filters-1.0.10"
       (sources."ethjs-unit-0.1.6" // {
         dependencies = [
           sources."bn.js-4.11.6"
@@ -83229,7 +83443,7 @@ in
       })
       sources."@babel/code-frame-7.14.5"
       sources."@babel/compat-data-7.14.5"
-      (sources."@babel/core-7.14.5" // {
+      (sources."@babel/core-7.14.6" // {
         dependencies = [
           sources."semver-6.3.0"
           sources."source-map-0.5.7"
@@ -83260,13 +83474,13 @@ in
       sources."@babel/helper-split-export-declaration-7.14.5"
       sources."@babel/helper-validator-identifier-7.14.5"
       sources."@babel/helper-validator-option-7.14.5"
-      sources."@babel/helpers-7.14.5"
+      sources."@babel/helpers-7.14.6"
       (sources."@babel/highlight-7.14.5" // {
         dependencies = [
           sources."chalk-2.4.2"
         ];
       })
-      sources."@babel/parser-7.14.5"
+      sources."@babel/parser-7.14.6"
       sources."@babel/plugin-proposal-object-rest-spread-7.10.4"
       sources."@babel/plugin-proposal-optional-chaining-7.14.5"
       sources."@babel/plugin-syntax-jsx-7.14.5"
@@ -83274,8 +83488,8 @@ in
       sources."@babel/plugin-syntax-optional-chaining-7.8.3"
       sources."@babel/plugin-transform-parameters-7.14.5"
       sources."@babel/plugin-transform-react-jsx-7.14.5"
-      sources."@babel/runtime-7.14.5"
-      sources."@babel/standalone-7.14.5"
+      sources."@babel/runtime-7.14.6"
+      sources."@babel/standalone-7.14.6"
       sources."@babel/template-7.14.5"
       sources."@babel/traverse-7.14.5"
       sources."@babel/types-7.14.5"
@@ -83315,7 +83529,7 @@ in
       sources."@types/istanbul-lib-report-3.0.0"
       sources."@types/istanbul-reports-1.1.2"
       sources."@types/json-patch-0.0.30"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."@types/node-fetch-2.5.10"
       sources."@types/readable-stream-2.3.10"
       sources."@types/unist-2.0.3"
@@ -83383,7 +83597,7 @@ in
       sources."call-bind-1.0.2"
       sources."camel-case-4.1.2"
       sources."camelcase-5.3.1"
-      sources."caniuse-lite-1.0.30001237"
+      sources."caniuse-lite-1.0.30001239"
       sources."ccount-1.1.0"
       (sources."chalk-4.1.1" // {
         dependencies = [
@@ -83399,7 +83613,7 @@ in
       sources."character-entities-legacy-1.1.4"
       sources."character-reference-invalid-1.1.4"
       sources."chardet-0.7.0"
-      sources."chokidar-3.5.1"
+      sources."chokidar-3.5.2"
       sources."ci-info-2.0.0"
       sources."cli-boxes-2.2.1"
       sources."cli-cursor-3.1.0"
@@ -83433,10 +83647,10 @@ in
         ];
       })
       sources."content-type-1.0.4"
-      sources."contentful-management-7.24.0"
+      sources."contentful-management-7.25.1"
       sources."contentful-sdk-core-6.8.0"
       sources."convert-hrtime-3.0.0"
-      (sources."convert-source-map-1.7.0" // {
+      (sources."convert-source-map-1.8.0" // {
         dependencies = [
           sources."safe-buffer-5.1.2"
         ];
@@ -83579,7 +83793,7 @@ in
       sources."globals-11.12.0"
       sources."got-9.6.0"
       sources."graceful-fs-4.2.6"
-      sources."graphql-15.5.0"
+      sources."graphql-15.5.1"
       sources."graphql-compose-7.25.1"
       sources."graphql-subscriptions-1.2.1"
       sources."graphql-type-json-0.3.2"
@@ -83725,7 +83939,7 @@ in
       sources."no-case-3.0.4"
       sources."node-eta-0.9.0"
       sources."node-fetch-2.6.1"
-      sources."node-object-hash-2.3.3"
+      sources."node-object-hash-2.3.7"
       sources."node-releases-1.1.73"
       sources."normalize-path-3.0.0"
       sources."normalize-url-6.0.1"
@@ -83794,7 +84008,7 @@ in
       sources."read-1.0.7"
       sources."readable-stream-3.6.0"
       sources."readable-web-to-node-stream-3.0.1"
-      sources."readdirp-3.5.0"
+      sources."readdirp-3.6.0"
       sources."redux-4.1.0"
       sources."regenerator-runtime-0.13.8"
       sources."registry-auth-token-4.2.1"
@@ -83957,7 +84171,7 @@ in
       })
       sources."wrappy-1.0.2"
       sources."write-file-atomic-3.0.3"
-      sources."ws-7.4.6"
+      sources."ws-7.5.0"
       sources."xdg-basedir-4.0.0"
       sources."xstate-4.20.0"
       sources."xtend-4.0.2"
@@ -84214,7 +84428,7 @@ in
       sources."tweetnacl-0.14.5"
       sources."tweetnacl-auth-0.3.1"
       sources."typedarray-to-buffer-4.0.0"
-      sources."ws-7.4.6"
+      sources."ws-7.5.0"
       sources."xtend-4.0.2"
     ];
     buildInputs = globalBuildInputs;
@@ -84402,7 +84616,7 @@ in
       sources."inherits-2.0.4"
       sources."ini-2.0.0"
       sources."inquirer-7.3.3"
-      sources."inquirer-autocomplete-prompt-1.3.0"
+      sources."inquirer-autocomplete-prompt-1.4.0"
       sources."ip-1.1.5"
       sources."is-arrayish-0.2.1"
       sources."is-ci-2.0.0"
@@ -84548,7 +84762,7 @@ in
       sources."signal-exit-3.0.3"
       sources."smart-buffer-4.1.0"
       sources."socks-2.6.1"
-      sources."socks-proxy-agent-5.0.0"
+      sources."socks-proxy-agent-5.0.1"
       sources."source-map-0.6.1"
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
@@ -84589,7 +84803,7 @@ in
       sources."xdg-basedir-4.0.0"
       sources."xregexp-2.0.0"
       sources."yallist-4.0.0"
-      sources."yargs-parser-20.2.7"
+      sources."yargs-parser-20.2.9"
     ];
     buildInputs = globalBuildInputs;
     meta = {
@@ -84706,7 +84920,7 @@ in
       sources."@nodelib/fs.walk-1.2.7"
       sources."@sindresorhus/is-0.14.0"
       sources."@szmarczak/http-timer-1.1.2"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."@types/parse-json-4.0.0"
       sources."@types/websocket-1.0.2"
       sources."abort-controller-3.0.0"
@@ -85000,7 +85214,7 @@ in
         ];
       })
       sources."oas-schema-walker-1.1.5"
-      sources."oas-validator-5.0.6"
+      sources."oas-validator-5.0.7"
       sources."oauth-sign-0.9.0"
       sources."object-inspect-1.10.3"
       sources."object-is-1.1.5"
@@ -85107,7 +85321,7 @@ in
       sources."strip-json-comments-2.0.1"
       sources."subscriptions-transport-ws-0.9.19"
       sources."supports-color-7.2.0"
-      (sources."swagger2openapi-7.0.6" // {
+      (sources."swagger2openapi-7.0.7" // {
         dependencies = [
           sources."yargs-17.0.1"
         ];
@@ -85150,7 +85364,7 @@ in
       sources."yallist-4.0.0"
       sources."yaml-1.10.2"
       sources."yargs-16.0.3"
-      sources."yargs-parser-20.2.7"
+      sources."yargs-parser-20.2.9"
     ];
     buildInputs = globalBuildInputs;
     meta = {
@@ -85382,10 +85596,10 @@ in
   gtop = nodeEnv.buildNodePackage {
     name = "gtop";
     packageName = "gtop";
-    version = "1.1.0";
+    version = "1.1.1";
     src = fetchurl {
-      url = "https://registry.npmjs.org/gtop/-/gtop-1.1.0.tgz";
-      sha512 = "WA8W0HxEsU9gGwpJDBRVv3l8DLUlxun5242vJw7kzv8CeQ29QUTYDfis5wMGwTOAU+curXHLHehFRR/IZflvbQ==";
+      url = "https://registry.npmjs.org/gtop/-/gtop-1.1.1.tgz";
+      sha512 = "5w10ZBVNHbahKpgm41YoKPVnT7hxuxBplBpvS91W7XXNC6huaRfH6BRBjMjWKMKBrZqgykHgaYW3PKu1CnY1Cg==";
     };
     dependencies = [
       sources."abbrev-1.1.1"
@@ -85395,7 +85609,7 @@ in
       sources."ansi-term-0.0.2"
       sources."ansicolors-0.3.2"
       sources."blessed-0.1.81"
-      sources."blessed-contrib-4.8.21"
+      sources."blessed-contrib-4.9.0"
       sources."bresenham-0.0.3"
       sources."buffers-0.1.1"
       sources."cardinal-2.1.1"
@@ -85424,7 +85638,7 @@ in
       sources."lodash-4.17.21"
       sources."lodash.toarray-4.4.0"
       sources."map-canvas-0.1.5"
-      sources."marked-0.7.0"
+      sources."marked-2.1.1"
       (sources."marked-terminal-4.1.1" // {
         dependencies = [
           sources."ansi-styles-4.3.0"
@@ -85451,7 +85665,7 @@ in
           sources."supports-color-7.2.0"
         ];
       })
-      sources."systeminformation-4.34.23"
+      sources."systeminformation-5.7.7"
       sources."term-canvas-0.0.5"
       sources."type-fest-0.21.3"
       sources."wordwrap-0.0.3"
@@ -85567,7 +85781,7 @@ in
       sources."component-emitter-1.3.0"
       sources."concat-map-0.0.1"
       sources."concat-stream-1.6.2"
-      sources."convert-source-map-1.7.0"
+      sources."convert-source-map-1.8.0"
       sources."copy-descriptor-0.1.1"
       (sources."copy-props-2.0.5" // {
         dependencies = [
@@ -87036,7 +87250,7 @@ in
       sources."is-wsl-2.2.0"
       sources."isexe-2.0.0"
       sources."jquery-3.6.0"
-      sources."jquery.terminal-2.25.1"
+      sources."jquery.terminal-2.26.0"
       sources."jsonfile-2.4.0"
       sources."keyboardevent-key-polyfill-1.1.0"
       sources."line-reader-0.4.0"
@@ -87309,7 +87523,7 @@ in
       })
       sources."smart-buffer-4.1.0"
       sources."socks-2.6.1"
-      sources."socks-proxy-agent-5.0.0"
+      sources."socks-proxy-agent-5.0.1"
       sources."source-map-0.6.1"
       sources."split2-3.2.2"
       sources."ssh-config-1.1.6"
@@ -87368,7 +87582,7 @@ in
       })
       sources."wrappy-1.0.2"
       sources."write-file-atomic-3.0.3"
-      sources."ws-7.4.6"
+      sources."ws-7.5.0"
       sources."xregexp-2.0.0"
       sources."yallist-3.1.1"
     ];
@@ -87635,7 +87849,7 @@ in
       sources."y18n-5.0.8"
       sources."yallist-4.0.0"
       sources."yargs-16.2.0"
-      sources."yargs-parser-20.2.7"
+      sources."yargs-parser-20.2.9"
     ];
     buildInputs = globalBuildInputs;
     meta = {
@@ -87766,30 +87980,38 @@ in
   joplin = nodeEnv.buildNodePackage {
     name = "joplin";
     packageName = "joplin";
-    version = "1.8.1";
+    version = "2.0.1";
     src = fetchurl {
-      url = "https://registry.npmjs.org/joplin/-/joplin-1.8.1.tgz";
-      sha512 = "ukyHTdD3LgHl5A9No350YkAlxMRoWVhP9FR8MVhyXS1I8p6kSW27FZF3r8FBLxfwHnGvRQM7gwBRHJDKprEG8A==";
+      url = "https://registry.npmjs.org/joplin/-/joplin-2.0.1.tgz";
+      sha512 = "NFjW9O1SZp6zN8RUjQA8DGTuoAljN1zKNUpDcEX7uY3hG/V4nqZtZVF0wzZ3EN/UWkx/lIP2FohRv4cUtdrO+A==";
     };
     dependencies = [
       sources."@braintree/sanitize-url-3.1.0"
       sources."@cronvel/get-pixels-3.4.0"
-      sources."@joplin/fork-htmlparser2-4.1.26"
-      sources."@joplin/fork-sax-1.2.30"
-      sources."@joplin/lib-1.8.2"
-      (sources."@joplin/renderer-1.8.2" // {
+      sources."@joplin/fork-htmlparser2-4.1.27"
+      sources."@joplin/fork-sax-1.2.31"
+      (sources."@joplin/lib-2.0.3" // {
+        dependencies = [
+          (sources."@joplin/renderer-1.8.2" // {
+            dependencies = [
+              sources."fs-extra-8.1.0"
+              sources."uslug-git+https://github.com/laurent22/uslug.git#emoji-support"
+            ];
+          })
+        ];
+      })
+      (sources."@joplin/renderer-2.0.3" // {
         dependencies = [
           sources."fs-extra-8.1.0"
-          sources."jsonfile-4.0.0"
           sources."uslug-git+https://github.com/laurent22/uslug.git#emoji-support"
         ];
       })
-      (sources."@joplin/turndown-4.0.48" // {
+      (sources."@joplin/turndown-4.0.49" // {
         dependencies = [
           sources."css-2.2.4"
         ];
       })
-      sources."@joplin/turndown-plugin-gfm-1.0.30"
+      sources."@joplin/turndown-plugin-gfm-1.0.31"
       sources."abab-2.0.5"
       sources."abbrev-1.1.1"
       sources."acorn-7.4.1"
@@ -87829,7 +88051,7 @@ in
       sources."async-mutex-0.1.4"
       sources."asynckit-0.4.0"
       sources."atob-2.1.2"
-      (sources."aws-sdk-2.927.0" // {
+      (sources."aws-sdk-2.932.0" // {
         dependencies = [
           sources."sax-1.2.1"
           sources."uuid-3.3.2"
@@ -87863,11 +88085,10 @@ in
       sources."caseless-0.12.0"
       sources."chalk-4.1.1"
       sources."charenc-0.0.2"
-      sources."chokidar-3.5.1"
+      sources."chokidar-3.5.2"
       sources."chownr-1.1.4"
       sources."chroma-js-2.1.2"
       sources."clean-css-4.2.3"
-      sources."clean-html-1.5.0"
       sources."cliss-0.0.2"
       sources."code-point-at-1.1.0"
       sources."color-3.1.2"
@@ -87876,7 +88097,7 @@ in
       sources."color-string-1.5.5"
       sources."combined-stream-1.0.8"
       sources."command-line-usage-4.1.0"
-      sources."commander-2.17.1"
+      sources."commander-6.2.1"
       sources."compare-version-0.1.2"
       sources."compare-versions-3.6.0"
       sources."concat-map-0.0.1"
@@ -87908,7 +88129,11 @@ in
       sources."d3-contour-1.3.2"
       sources."d3-dispatch-1.0.6"
       sources."d3-drag-1.2.5"
-      sources."d3-dsv-1.2.0"
+      (sources."d3-dsv-1.2.0" // {
+        dependencies = [
+          sources."commander-2.20.3"
+        ];
+      })
       sources."d3-ease-1.0.7"
       sources."d3-fetch-1.2.0"
       sources."d3-force-1.2.1"
@@ -87934,7 +88159,7 @@ in
       sources."dagre-d3-0.6.4"
       sources."dashdash-1.14.1"
       sources."data-urls-1.1.0"
-      sources."debug-3.2.7"
+      sources."debug-4.3.2"
       sources."decode-uri-component-0.2.0"
       sources."decompress-response-4.2.1"
       sources."deep-extend-0.6.0"
@@ -88002,11 +88227,7 @@ in
       sources."form-data-2.5.1"
       sources."format-0.2.2"
       sources."fs-constants-1.0.0"
-      (sources."fs-extra-5.0.0" // {
-        dependencies = [
-          sources."jsonfile-4.0.0"
-        ];
-      })
+      sources."fs-extra-5.0.0"
       sources."fs-minipass-1.2.7"
       sources."fs.realpath-1.0.0"
       sources."fsevents-2.3.2"
@@ -88034,20 +88255,14 @@ in
       sources."highlight.js-10.7.3"
       sources."html-encoding-sniffer-1.0.2"
       sources."html-entities-1.4.0"
-      sources."html-minifier-3.5.21"
-      (sources."htmlparser2-3.10.1" // {
+      (sources."html-minifier-3.5.21" // {
         dependencies = [
-          (sources."dom-serializer-0.2.2" // {
+          sources."commander-2.17.1"
+          (sources."uglify-js-3.4.10" // {
             dependencies = [
-              sources."domelementtype-2.2.0"
-              sources."entities-2.2.0"
+              sources."commander-2.19.0"
             ];
           })
-          sources."domelementtype-1.3.1"
-          sources."domhandler-2.4.2"
-          sources."domutils-1.7.0"
-          sources."entities-1.1.2"
-          sources."readable-stream-3.6.0"
         ];
       })
       sources."http-errors-1.8.0"
@@ -88058,6 +88273,7 @@ in
       (sources."image-data-uri-2.0.1" // {
         dependencies = [
           sources."fs-extra-0.26.7"
+          sources."jsonfile-2.4.0"
         ];
       })
       sources."image-type-3.1.0"
@@ -88072,11 +88288,13 @@ in
       })
       (sources."inspect-parameters-declaration-0.0.9" // {
         dependencies = [
+          sources."commander-2.20.3"
           sources."magicli-0.0.5"
         ];
       })
       (sources."inspect-property-0.0.6" // {
         dependencies = [
+          sources."commander-2.20.3"
           sources."inspect-function-0.3.4"
           (sources."inspect-parameters-declaration-0.0.8" // {
             dependencies = [
@@ -88125,20 +88343,16 @@ in
       sources."json-schema-0.2.3"
       sources."json-schema-traverse-0.4.1"
       sources."json-stringify-safe-5.0.1"
-      sources."jsonfile-2.4.0"
+      sources."jsonfile-4.0.0"
       sources."jsprim-1.4.1"
-      (sources."katex-0.13.11" // {
-        dependencies = [
-          sources."commander-6.2.1"
-        ];
-      })
+      sources."katex-0.13.11"
       sources."keytar-7.7.0"
       sources."khroma-1.4.1"
       sources."klaw-1.3.1"
       sources."lazyness-1.2.0"
       sources."levenshtein-1.0.5"
       sources."levn-0.3.0"
-      sources."linkify-it-2.2.0"
+      sources."linkify-it-3.0.2"
       sources."locate-path-2.0.0"
       sources."lodash-4.17.21"
       sources."lodash-es-4.17.21"
@@ -88158,6 +88372,7 @@ in
       (sources."markdown-it-10.0.0" // {
         dependencies = [
           sources."entities-2.0.3"
+          sources."linkify-it-2.2.0"
         ];
       })
       sources."markdown-it-abbr-1.0.4"
@@ -88171,7 +88386,6 @@ in
       (sources."markdown-it-multimd-table-4.1.0" // {
         dependencies = [
           sources."entities-2.0.3"
-          sources."linkify-it-3.0.2"
           sources."markdown-it-11.0.1"
         ];
       })
@@ -88188,10 +88402,7 @@ in
       (sources."minify-4.1.3" // {
         dependencies = [
           sources."commander-2.20.3"
-          sources."debug-4.3.2"
           sources."html-minifier-4.0.0"
-          sources."ms-2.1.2"
-          sources."uglify-js-3.13.9"
         ];
       })
       sources."minimatch-3.0.4"
@@ -88206,14 +88417,18 @@ in
       sources."mkdirp-classic-0.5.3"
       sources."moment-2.29.1"
       sources."moment-mini-2.24.0"
-      sources."ms-2.1.3"
+      sources."ms-2.1.2"
       sources."multiparty-4.2.2"
       sources."mustache-4.2.0"
       sources."nanoid-3.1.23"
       sources."napi-build-utils-1.0.2"
       sources."ndarray-1.0.19"
       sources."ndarray-pack-1.2.1"
-      sources."needle-2.6.0"
+      (sources."needle-2.6.0" // {
+        dependencies = [
+          sources."debug-3.2.7"
+        ];
+      })
       sources."nextgen-events-1.5.2"
       sources."no-case-2.3.2"
       (sources."node-abi-2.30.0" // {
@@ -88256,6 +88471,7 @@ in
       sources."object-assign-4.1.1"
       (sources."object-to-arguments-0.0.8" // {
         dependencies = [
+          sources."commander-2.20.3"
           sources."inspect-parameters-declaration-0.0.10"
           sources."magicli-0.0.5"
         ];
@@ -88303,7 +88519,7 @@ in
           sources."safe-buffer-5.1.2"
         ];
       })
-      sources."readdirp-3.5.0"
+      sources."readdirp-3.6.0"
       sources."reduce-flatten-1.0.1"
       sources."redux-3.7.2"
       sources."relateurl-0.2.7"
@@ -88382,6 +88598,7 @@ in
       })
       (sources."stringify-parameters-0.0.4" // {
         dependencies = [
+          sources."commander-2.20.3"
           sources."magicli-0.0.5"
         ];
       })
@@ -88442,11 +88659,7 @@ in
       sources."type-check-0.3.2"
       sources."typical-2.6.1"
       sources."uc.micro-1.0.6"
-      (sources."uglify-js-3.4.10" // {
-        dependencies = [
-          sources."commander-2.19.0"
-        ];
-      })
+      sources."uglify-js-3.13.9"
       sources."uglifycss-0.0.29"
       sources."uid-safe-2.1.5"
       sources."unc-path-regex-0.1.2"
@@ -88485,7 +88698,7 @@ in
         ];
       })
       sources."wrappy-1.0.2"
-      sources."ws-7.4.6"
+      sources."ws-7.5.0"
       sources."xml-name-validator-3.0.0"
       sources."xml2js-0.4.23"
       sources."xmlbuilder-11.0.1"
@@ -88506,10 +88719,10 @@ in
   js-beautify = nodeEnv.buildNodePackage {
     name = "js-beautify";
     packageName = "js-beautify";
-    version = "1.13.13";
+    version = "1.14.0";
     src = fetchurl {
-      url = "https://registry.npmjs.org/js-beautify/-/js-beautify-1.13.13.tgz";
-      sha512 = "oH+nc0U5mOAqX8M5JO1J0Pw/7Q35sAdOsM5W3i87pir9Ntx6P/5Gx1xLNoK+MGyvHk4rqqRCE4Oq58H6xl2W7A==";
+      url = "https://registry.npmjs.org/js-beautify/-/js-beautify-1.14.0.tgz";
+      sha512 = "yuck9KirNSCAwyNJbqW+BxJqJ0NLJ4PwBUzQQACl5O3qHMBXVkXb/rD0ilh/Lat/tn88zSZ+CAHOlk0DsY7GuQ==";
     };
     dependencies = [
       sources."abbrev-1.1.1"
@@ -88526,7 +88739,6 @@ in
       sources."ini-1.3.8"
       sources."lru-cache-4.1.5"
       sources."minimatch-3.0.4"
-      sources."mkdirp-1.0.4"
       sources."nopt-5.0.0"
       sources."once-1.4.0"
       sources."path-is-absolute-1.0.1"
@@ -88577,7 +88789,7 @@ in
       sha512 = "sxKt7h0vzCd+3Y81Ey2qinupL6DpRSZJclS04ugHDNmRUXGzqicMJ6iwayhSA0S0DwwX30c5ozyUthr1QKF6uw==";
     };
     dependencies = [
-      sources."@babel/parser-7.14.5"
+      sources."@babel/parser-7.14.6"
       sources."argparse-1.0.10"
       sources."bluebird-3.7.2"
       sources."catharsis-0.9.0"
@@ -88590,7 +88802,7 @@ in
       sources."lodash-4.17.21"
       sources."markdown-it-10.0.0"
       sources."markdown-it-anchor-5.3.0"
-      sources."marked-2.0.7"
+      sources."marked-2.1.1"
       sources."mdurl-1.0.1"
       sources."mkdirp-1.0.4"
       sources."requizzle-0.2.3"
@@ -89000,7 +89212,7 @@ in
       sources."y18n-5.0.8"
       sources."yallist-4.0.0"
       sources."yargs-16.2.0"
-      sources."yargs-parser-20.2.7"
+      sources."yargs-parser-20.2.9"
     ];
     buildInputs = globalBuildInputs;
     meta = {
@@ -89172,7 +89384,7 @@ in
       sources."function-bind-1.1.1"
       sources."get-intrinsic-1.1.1"
       sources."glob-parent-5.1.2"
-      sources."globby-11.0.3"
+      sources."globby-11.0.4"
       sources."graceful-fs-4.2.6"
       sources."has-1.0.3"
       sources."has-flag-3.0.0"
@@ -89313,16 +89525,16 @@ in
   karma = nodeEnv.buildNodePackage {
     name = "karma";
     packageName = "karma";
-    version = "6.3.3";
+    version = "6.3.4";
     src = fetchurl {
-      url = "https://registry.npmjs.org/karma/-/karma-6.3.3.tgz";
-      sha512 = "JRAujkKWaOtO2LmyPH7K2XXRhrxuFAn9loIL9+iiah6vjz+ZLkqdKsySV9clRITGhj10t9baIfbCl6CJ5hu9gQ==";
+      url = "https://registry.npmjs.org/karma/-/karma-6.3.4.tgz";
+      sha512 = "hbhRogUYIulfkBTZT7xoPrCYhRBnBoqbbL4fszWD0ReFGUxU+LYBr3dwKdAluaDQ/ynT9/7C+Lf7pPNW4gSx4Q==";
     };
     dependencies = [
       sources."@types/component-emitter-1.2.10"
       sources."@types/cookie-0.4.0"
       sources."@types/cors-2.8.10"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."accepts-1.3.7"
       sources."ansi-regex-5.0.0"
       sources."ansi-styles-4.3.0"
@@ -89335,7 +89547,7 @@ in
       sources."brace-expansion-1.1.11"
       sources."braces-3.0.2"
       sources."bytes-3.1.0"
-      sources."chokidar-3.5.1"
+      sources."chokidar-3.5.2"
       sources."cliui-7.0.4"
       sources."color-convert-2.0.1"
       sources."color-name-1.1.4"
@@ -89415,7 +89627,7 @@ in
       sources."qs-6.7.0"
       sources."range-parser-1.2.1"
       sources."raw-body-2.4.0"
-      sources."readdirp-3.5.0"
+      sources."readdirp-3.6.0"
       sources."require-directory-2.1.1"
       sources."requires-port-1.0.0"
       sources."rfdc-1.3.0"
@@ -89461,7 +89673,7 @@ in
       sources."ws-7.4.6"
       sources."y18n-5.0.8"
       sources."yargs-16.2.0"
-      sources."yargs-parser-20.2.7"
+      sources."yargs-parser-20.2.9"
     ];
     buildInputs = globalBuildInputs;
     meta = {
@@ -89473,6 +89685,276 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
+  keyoxide = nodeEnv.buildNodePackage {
+    name = "keyoxide";
+    packageName = "keyoxide";
+    version = "0.3.0";
+    src = fetchurl {
+      url = "https://registry.npmjs.org/keyoxide/-/keyoxide-0.3.0.tgz";
+      sha512 = "LTy8I1D5hkQptMCy7XdSEY7GB5QG8TzOgp28D9B/XNt/wKKr2hRwrcW1eLGzazJQkMrdVg2AASLpgmFzPpVPrw==";
+    };
+    dependencies = [
+      sources."JSONStream-1.3.5"
+      sources."acorn-7.4.1"
+      sources."acorn-node-1.8.2"
+      sources."acorn-walk-7.2.0"
+      sources."ansi-colors-4.1.1"
+      sources."ansi-regex-5.0.0"
+      sources."ansi-styles-4.3.0"
+      (sources."asn1.js-5.4.1" // {
+        dependencies = [
+          sources."bn.js-4.12.0"
+        ];
+      })
+      (sources."assert-1.5.0" // {
+        dependencies = [
+          sources."inherits-2.0.1"
+          sources."util-0.10.3"
+        ];
+      })
+      sources."available-typed-arrays-1.0.4"
+      sources."balanced-match-1.0.2"
+      sources."base64-js-1.5.1"
+      sources."bent-7.3.12"
+      sources."bn.js-5.2.0"
+      sources."brace-expansion-1.1.11"
+      sources."brorand-1.1.0"
+      sources."browser-pack-6.1.0"
+      sources."browser-resolve-2.0.0"
+      sources."browserify-17.0.0"
+      sources."browserify-aes-1.2.0"
+      sources."browserify-cipher-1.0.1"
+      sources."browserify-des-1.0.2"
+      sources."browserify-rsa-4.1.0"
+      (sources."browserify-sign-4.2.1" // {
+        dependencies = [
+          sources."readable-stream-3.6.0"
+        ];
+      })
+      sources."browserify-zlib-0.2.0"
+      sources."buffer-5.2.1"
+      sources."buffer-from-1.1.1"
+      sources."buffer-xor-1.0.3"
+      sources."builtin-status-codes-3.0.0"
+      sources."bytesish-0.4.4"
+      sources."cached-path-relative-1.0.2"
+      sources."call-bind-1.0.2"
+      sources."caseless-0.12.0"
+      sources."cipher-base-1.0.4"
+      sources."cliui-7.0.4"
+      sources."color-convert-2.0.1"
+      sources."color-name-1.1.4"
+      sources."combine-source-map-0.8.0"
+      sources."concat-map-0.0.1"
+      sources."concat-stream-1.6.2"
+      sources."console-browserify-1.2.0"
+      sources."constants-browserify-1.0.0"
+      sources."convert-source-map-1.1.3"
+      sources."core-util-is-1.0.2"
+      (sources."create-ecdh-4.0.4" // {
+        dependencies = [
+          sources."bn.js-4.12.0"
+        ];
+      })
+      sources."create-hash-1.2.0"
+      sources."create-hmac-1.1.7"
+      sources."crypto-browserify-3.12.0"
+      sources."dash-ast-1.0.0"
+      sources."decode-uri-component-0.2.0"
+      sources."define-properties-1.1.3"
+      sources."defined-1.0.0"
+      sources."deps-sort-2.0.1"
+      sources."des.js-1.0.1"
+      sources."detective-5.2.0"
+      (sources."diffie-hellman-5.0.3" // {
+        dependencies = [
+          sources."bn.js-4.12.0"
+        ];
+      })
+      sources."doipjs-0.11.2"
+      sources."domain-browser-1.2.0"
+      sources."duplexer2-0.1.4"
+      (sources."elliptic-6.5.4" // {
+        dependencies = [
+          sources."bn.js-4.12.0"
+        ];
+      })
+      sources."emoji-regex-8.0.0"
+      sources."enquirer-2.3.6"
+      sources."es-abstract-1.18.3"
+      sources."es-to-primitive-1.2.1"
+      sources."escalade-3.1.1"
+      sources."events-3.3.0"
+      sources."evp_bytestokey-1.0.3"
+      sources."fast-safe-stringify-2.0.7"
+      sources."filter-obj-1.1.0"
+      sources."foreach-2.0.5"
+      sources."fs.realpath-1.0.0"
+      sources."function-bind-1.1.1"
+      sources."get-assigned-identifiers-1.2.0"
+      sources."get-caller-file-2.0.5"
+      sources."get-intrinsic-1.1.1"
+      sources."glob-7.1.7"
+      sources."graceful-fs-4.2.6"
+      sources."has-1.0.3"
+      sources."has-bigints-1.0.1"
+      sources."has-symbols-1.0.2"
+      (sources."hash-base-3.1.0" // {
+        dependencies = [
+          sources."readable-stream-3.6.0"
+        ];
+      })
+      sources."hash.js-1.1.7"
+      sources."hmac-drbg-1.0.1"
+      sources."htmlescape-1.1.1"
+      sources."https-browserify-1.0.0"
+      sources."ieee754-1.2.1"
+      sources."imurmurhash-0.1.4"
+      sources."inflight-1.0.6"
+      sources."inherits-2.0.4"
+      sources."inline-source-map-0.6.2"
+      sources."insert-module-globals-7.2.1"
+      sources."is-arguments-1.1.0"
+      sources."is-bigint-1.0.2"
+      sources."is-boolean-object-1.1.1"
+      sources."is-buffer-1.1.6"
+      sources."is-callable-1.2.3"
+      sources."is-core-module-2.4.0"
+      sources."is-date-object-1.0.4"
+      sources."is-fullwidth-code-point-3.0.0"
+      sources."is-generator-function-1.0.9"
+      sources."is-negative-zero-2.0.1"
+      sources."is-number-object-1.0.5"
+      sources."is-plain-obj-2.1.0"
+      sources."is-regex-1.1.3"
+      sources."is-stream-2.0.0"
+      sources."is-string-1.0.6"
+      sources."is-symbol-1.0.4"
+      sources."is-typed-array-1.1.5"
+      sources."isarray-1.0.0"
+      sources."jsonparse-1.3.1"
+      sources."labeled-stream-splicer-2.0.2"
+      sources."lodash.memoize-3.0.4"
+      sources."md5.js-1.3.5"
+      sources."merge-options-3.0.4"
+      (sources."miller-rabin-4.0.1" // {
+        dependencies = [
+          sources."bn.js-4.12.0"
+        ];
+      })
+      sources."minimalistic-assert-1.0.1"
+      sources."minimalistic-crypto-utils-1.0.1"
+      sources."minimatch-3.0.4"
+      sources."minimist-1.2.5"
+      sources."mkdirp-classic-0.5.3"
+      sources."module-deps-6.2.3"
+      sources."node-fetch-2.6.1"
+      sources."node-localstorage-1.3.1"
+      sources."object-assign-4.1.1"
+      sources."object-inspect-1.10.3"
+      sources."object-keys-1.1.1"
+      sources."object.assign-4.1.2"
+      sources."once-1.4.0"
+      sources."openpgp-4.10.10"
+      sources."os-browserify-0.3.0"
+      sources."pako-1.0.11"
+      sources."parents-1.0.1"
+      sources."parse-asn1-5.1.6"
+      sources."path-browserify-1.0.1"
+      sources."path-is-absolute-1.0.1"
+      sources."path-parse-1.0.7"
+      sources."path-platform-0.11.15"
+      sources."pbkdf2-3.1.2"
+      sources."prettier-2.3.1"
+      sources."process-0.11.10"
+      sources."process-nextick-args-2.0.1"
+      (sources."public-encrypt-4.0.3" // {
+        dependencies = [
+          sources."bn.js-4.12.0"
+        ];
+      })
+      sources."punycode-1.4.1"
+      sources."query-string-6.14.1"
+      sources."querystring-0.2.0"
+      sources."querystring-es3-0.2.1"
+      sources."randombytes-2.1.0"
+      sources."randomfill-1.0.4"
+      sources."read-only-stream-2.0.0"
+      (sources."readable-stream-2.3.7" // {
+        dependencies = [
+          sources."safe-buffer-5.1.2"
+          sources."string_decoder-1.1.1"
+        ];
+      })
+      sources."require-directory-2.1.1"
+      sources."resolve-1.20.0"
+      sources."ripemd160-2.0.2"
+      sources."safe-buffer-5.2.1"
+      sources."safer-buffer-2.1.2"
+      sources."sha.js-2.4.11"
+      sources."shasum-object-1.0.0"
+      sources."shell-quote-1.7.2"
+      sources."simple-concat-1.0.1"
+      sources."slide-1.1.6"
+      sources."source-map-0.5.7"
+      sources."split-on-first-1.1.0"
+      (sources."stream-browserify-3.0.0" // {
+        dependencies = [
+          sources."readable-stream-3.6.0"
+        ];
+      })
+      sources."stream-combiner2-1.1.1"
+      (sources."stream-http-3.2.0" // {
+        dependencies = [
+          sources."readable-stream-3.6.0"
+        ];
+      })
+      sources."stream-splicer-2.0.1"
+      sources."strict-uri-encode-2.0.0"
+      sources."string-width-4.2.2"
+      sources."string.prototype.trimend-1.0.4"
+      sources."string.prototype.trimstart-1.0.4"
+      sources."string_decoder-1.3.0"
+      sources."strip-ansi-6.0.0"
+      sources."subarg-1.0.0"
+      sources."syntax-error-1.4.0"
+      sources."through-2.3.8"
+      sources."through2-2.0.5"
+      sources."timers-browserify-1.4.2"
+      sources."tty-browserify-0.0.1"
+      sources."typedarray-0.0.6"
+      sources."umd-3.0.3"
+      sources."unbox-primitive-1.0.1"
+      sources."undeclared-identifiers-1.1.3"
+      (sources."url-0.11.0" // {
+        dependencies = [
+          sources."punycode-1.3.2"
+        ];
+      })
+      sources."util-0.12.4"
+      sources."util-deprecate-1.0.2"
+      sources."valid-url-1.0.9"
+      sources."vm-browserify-1.1.2"
+      sources."which-boxed-primitive-1.0.2"
+      sources."which-typed-array-1.1.4"
+      sources."wrap-ansi-7.0.0"
+      sources."wrappy-1.0.2"
+      sources."write-file-atomic-1.3.4"
+      sources."xtend-4.0.2"
+      sources."y18n-5.0.8"
+      sources."yargs-16.2.0"
+      sources."yargs-parser-20.2.9"
+    ];
+    buildInputs = globalBuildInputs;
+    meta = {
+      description = "CLI for Keyoxide";
+      homepage = "https://keyoxide.org";
+      license = "AGPL-3.0-or-later";
+    };
+    production = true;
+    bypassCache = true;
+    reconstructLock = true;
+  };
   lcov-result-merger = nodeEnv.buildNodePackage {
     name = "lcov-result-merger";
     packageName = "lcov-result-merger";
@@ -89492,7 +89974,7 @@ in
       sources."clone-stats-1.0.0"
       sources."cloneable-readable-1.1.3"
       sources."concat-map-0.0.1"
-      sources."convert-source-map-1.7.0"
+      sources."convert-source-map-1.8.0"
       sources."core-util-is-1.0.2"
       sources."define-properties-1.1.3"
       sources."duplexify-3.7.1"
@@ -90181,14 +90663,14 @@ in
       sources."@nodelib/fs.stat-2.0.5"
       sources."@nodelib/fs.walk-1.2.7"
       sources."@npmcli/ci-detect-1.3.0"
-      sources."@npmcli/git-2.0.9"
+      sources."@npmcli/git-2.1.0"
       sources."@npmcli/installed-package-contents-1.0.7"
       sources."@npmcli/move-file-1.1.2"
       sources."@npmcli/node-gyp-1.0.2"
       sources."@npmcli/promise-spawn-1.3.2"
       sources."@npmcli/run-script-1.8.5"
       sources."@octokit/auth-token-2.4.5"
-      sources."@octokit/core-3.5.0"
+      sources."@octokit/core-3.5.1"
       (sources."@octokit/endpoint-6.0.12" // {
         dependencies = [
           sources."is-plain-object-5.0.0"
@@ -90424,7 +90906,7 @@ in
       sources."gitconfiglocal-1.0.0"
       sources."glob-7.1.7"
       sources."glob-parent-5.1.2"
-      sources."globby-11.0.3"
+      sources."globby-11.0.4"
       sources."graceful-fs-4.2.6"
       sources."handlebars-4.7.7"
       sources."har-schema-2.0.0"
@@ -90537,7 +91019,7 @@ in
           sources."semver-5.7.1"
         ];
       })
-      sources."make-fetch-happen-9.0.2"
+      sources."make-fetch-happen-9.0.3"
       sources."map-obj-4.2.1"
       (sources."meow-8.1.2" // {
         dependencies = [
@@ -90618,7 +91100,7 @@ in
         ];
       })
       sources."npm-normalize-package-bin-1.0.1"
-      sources."npm-package-arg-8.1.4"
+      sources."npm-package-arg-8.1.5"
       sources."npm-packlist-2.2.2"
       sources."npm-pick-manifest-6.1.1"
       sources."npm-registry-fetch-11.0.0"
@@ -90736,7 +91218,7 @@ in
       sources."slide-1.1.6"
       sources."smart-buffer-4.1.0"
       sources."socks-2.6.1"
-      sources."socks-proxy-agent-5.0.0"
+      sources."socks-proxy-agent-5.0.1"
       sources."sort-keys-2.0.0"
       sources."source-map-0.6.1"
       sources."spdx-correct-3.1.1"
@@ -90845,7 +91327,7 @@ in
       sources."yallist-4.0.0"
       sources."yaml-1.10.2"
       sources."yargs-16.2.0"
-      sources."yargs-parser-20.2.7"
+      sources."yargs-parser-20.2.9"
     ];
     buildInputs = globalBuildInputs;
     meta = {
@@ -91756,12 +92238,12 @@ in
     dependencies = [
       sources."@babel/code-frame-7.14.5"
       sources."@babel/compat-data-7.14.5"
-      sources."@babel/core-7.14.5"
+      sources."@babel/core-7.14.6"
       sources."@babel/generator-7.14.5"
       sources."@babel/helper-annotate-as-pure-7.14.5"
       sources."@babel/helper-builder-binary-assignment-operator-visitor-7.14.5"
       sources."@babel/helper-compilation-targets-7.14.5"
-      sources."@babel/helper-create-class-features-plugin-7.14.5"
+      sources."@babel/helper-create-class-features-plugin-7.14.6"
       sources."@babel/helper-create-regexp-features-plugin-7.14.5"
       sources."@babel/helper-define-polyfill-provider-0.2.3"
       sources."@babel/helper-explode-assignable-expression-7.14.5"
@@ -91781,13 +92263,13 @@ in
       sources."@babel/helper-validator-identifier-7.14.5"
       sources."@babel/helper-validator-option-7.14.5"
       sources."@babel/helper-wrap-function-7.14.5"
-      sources."@babel/helpers-7.14.5"
+      sources."@babel/helpers-7.14.6"
       (sources."@babel/highlight-7.14.5" // {
         dependencies = [
           sources."chalk-2.4.2"
         ];
       })
-      sources."@babel/parser-7.14.5"
+      sources."@babel/parser-7.14.6"
       sources."@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining-7.14.5"
       sources."@babel/plugin-external-helpers-7.8.3"
       sources."@babel/plugin-proposal-async-generator-functions-7.14.5"
@@ -91848,7 +92330,7 @@ in
       sources."@babel/plugin-transform-reserved-words-7.14.5"
       sources."@babel/plugin-transform-runtime-7.14.5"
       sources."@babel/plugin-transform-shorthand-properties-7.14.5"
-      sources."@babel/plugin-transform-spread-7.14.5"
+      sources."@babel/plugin-transform-spread-7.14.6"
       sources."@babel/plugin-transform-sticky-regex-7.14.5"
       sources."@babel/plugin-transform-template-literals-7.14.5"
       sources."@babel/plugin-transform-typeof-symbol-7.14.5"
@@ -91857,7 +92339,7 @@ in
       sources."@babel/preset-env-7.14.5"
       sources."@babel/preset-modules-0.1.4"
       sources."@babel/preset-stage-2-7.8.3"
-      sources."@babel/runtime-7.14.5"
+      sources."@babel/runtime-7.14.6"
       sources."@babel/template-7.14.5"
       sources."@babel/traverse-7.14.5"
       sources."@babel/types-7.14.5"
@@ -91881,7 +92363,7 @@ in
       sources."@types/istanbul-lib-report-3.0.0"
       sources."@types/istanbul-reports-1.1.2"
       sources."@types/json-schema-7.0.7"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."@types/normalize-package-data-2.4.0"
       sources."@types/resolve-0.0.8"
       sources."@types/yargs-15.0.13"
@@ -91971,7 +92453,7 @@ in
       sources."babel-plugin-minify-simplify-0.5.1"
       sources."babel-plugin-minify-type-constructors-0.4.3"
       sources."babel-plugin-polyfill-corejs2-0.2.2"
-      sources."babel-plugin-polyfill-corejs3-0.2.2"
+      sources."babel-plugin-polyfill-corejs3-0.2.3"
       sources."babel-plugin-polyfill-regenerator-0.2.2"
       sources."babel-plugin-syntax-flow-6.18.0"
       sources."babel-plugin-transform-flow-strip-types-6.22.0"
@@ -92054,7 +92536,7 @@ in
       sources."cached-path-relative-1.0.2"
       sources."call-bind-1.0.2"
       sources."camelcase-5.3.1"
-      sources."caniuse-lite-1.0.30001237"
+      sources."caniuse-lite-1.0.30001239"
       sources."capture-exit-2.0.0"
       sources."caseless-0.12.0"
       (sources."chalk-3.0.0" // {
@@ -92066,7 +92548,7 @@ in
           sources."supports-color-7.2.0"
         ];
       })
-      (sources."chokidar-3.5.1" // {
+      (sources."chokidar-3.5.2" // {
         dependencies = [
           sources."braces-3.0.2"
           sources."fill-range-7.0.1"
@@ -92118,7 +92600,7 @@ in
       sources."concat-stream-1.6.2"
       sources."console-browserify-1.2.0"
       sources."constants-browserify-1.0.0"
-      sources."convert-source-map-1.7.0"
+      sources."convert-source-map-1.8.0"
       (sources."copy-concurrently-1.0.5" // {
         dependencies = [
           sources."mkdirp-0.5.5"
@@ -92126,7 +92608,7 @@ in
       })
       sources."copy-descriptor-0.1.1"
       sources."core-js-2.6.12"
-      (sources."core-js-compat-3.14.0" // {
+      (sources."core-js-compat-3.15.0" // {
         dependencies = [
           sources."semver-7.0.0"
         ];
@@ -92571,7 +93053,7 @@ in
           sources."string_decoder-1.1.1"
         ];
       })
-      sources."readdirp-3.5.0"
+      sources."readdirp-3.6.0"
       sources."realpath-native-2.0.0"
       sources."regenerate-1.4.2"
       sources."regenerate-unicode-properties-8.2.0"
@@ -93033,7 +93515,7 @@ in
       sources."link-check-4.5.4"
       sources."lodash-4.17.21"
       sources."markdown-link-extractor-1.3.0"
-      sources."marked-2.0.7"
+      sources."marked-2.1.1"
       sources."mime-db-1.48.0"
       sources."mime-types-2.1.31"
       sources."ms-2.1.3"
@@ -93363,10 +93845,10 @@ in
   mathjax = nodeEnv.buildNodePackage {
     name = "mathjax";
     packageName = "mathjax";
-    version = "3.1.4";
+    version = "3.2.0";
     src = fetchurl {
-      url = "https://registry.npmjs.org/mathjax/-/mathjax-3.1.4.tgz";
-      sha512 = "Okmc+F3l7vRWNMALbH0HMMoTJWVn1cbeDbybHppCeophIGdFS+xxD/OffYpZirUOHzesZostpzEwsLSst+4W8w==";
+      url = "https://registry.npmjs.org/mathjax/-/mathjax-3.2.0.tgz";
+      sha512 = "PL+rdYRK4Wxif+SQ94zP/L0sv6/oW/1WdQiIx0Jvn9FZaU5W9E6nlIv8liYAXBNPL2Fw/i+o/mZ1212eSzn0Cw==";
     };
     buildInputs = globalBuildInputs;
     meta = {
@@ -93425,7 +93907,7 @@ in
     };
     dependencies = [
       sources."@braintree/sanitize-url-3.1.0"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."@types/yauzl-2.9.1"
       sources."agent-base-6.0.2"
       sources."ansi-styles-4.3.0"
@@ -93584,11 +94066,11 @@ in
       sources."@fluentui/date-time-utilities-7.9.1"
       sources."@fluentui/dom-utilities-1.1.2"
       sources."@fluentui/keyboard-key-0.2.17"
-      sources."@fluentui/react-7.170.3"
+      sources."@fluentui/react-7.172.0"
       sources."@fluentui/react-focus-7.17.6"
       sources."@fluentui/react-window-provider-1.0.2"
       sources."@fluentui/theme-1.7.4"
-      sources."@microsoft/load-themed-styles-1.10.181"
+      sources."@microsoft/load-themed-styles-1.10.185"
       sources."@sindresorhus/is-0.14.0"
       sources."@szmarczak/http-timer-1.1.2"
       sources."@uifabric/foundation-7.9.26"
@@ -93724,7 +94206,7 @@ in
       sources."node-fetch-1.6.3"
       sources."normalize-url-4.5.1"
       sources."object-assign-4.1.1"
-      sources."office-ui-fabric-react-7.170.3"
+      sources."office-ui-fabric-react-7.172.0"
       sources."on-finished-2.3.0"
       sources."on-headers-1.0.2"
       sources."once-1.4.0"
@@ -93816,7 +94298,7 @@ in
       sources."supports-color-2.0.0"
       sources."swagger-schema-official-2.0.0-bab6bed"
       sources."swagger-ui-dist-3.50.0"
-      sources."tail-2.2.2"
+      sources."tail-2.2.3"
       sources."through-2.3.8"
       sources."tmp-0.0.33"
       sources."to-readable-stream-1.0.0"
@@ -93847,10 +94329,10 @@ in
   mocha = nodeEnv.buildNodePackage {
     name = "mocha";
     packageName = "mocha";
-    version = "9.0.0";
+    version = "9.0.1";
     src = fetchurl {
-      url = "https://registry.npmjs.org/mocha/-/mocha-9.0.0.tgz";
-      sha512 = "GRGG/q9bIaUkHJB9NL+KZNjDhMBHB30zW3bZW9qOiYr+QChyLjPzswaxFWkI1q6lGlSL28EQYzAi2vKWNkPx+g==";
+      url = "https://registry.npmjs.org/mocha/-/mocha-9.0.1.tgz";
+      sha512 = "9zwsavlRO+5csZu6iRtl3GHImAbhERoDsZwdRkdJ/bE+eVplmoxNKE901ZJ9LdSchYBjSCPbjKc5XvcAri2ylw==";
     };
     dependencies = [
       sources."@ungap/promise-all-settled-1.1.2"
@@ -94101,15 +94583,15 @@ in
   netlify-cli = nodeEnv.buildNodePackage {
     name = "netlify-cli";
     packageName = "netlify-cli";
-    version = "3.37.16";
+    version = "3.37.37";
     src = fetchurl {
-      url = "https://registry.npmjs.org/netlify-cli/-/netlify-cli-3.37.16.tgz";
-      sha512 = "xbLV6yOhclcDmpf09mGo0jR4LOtRcOc4j+3mwk9wUYT3cav4VFIDVvKo1EuNxcINvN3CBQ+8d1Ui1+alS9nMrg==";
+      url = "https://registry.npmjs.org/netlify-cli/-/netlify-cli-3.37.37.tgz";
+      sha512 = "N07WvfR41K0rp2+f4ZvlU6WzoytKe3TPWvcHMrUeiXSPnMliMV/ggrU3zoUWSjPjfBh8CabBRbNbyySjgrR9WQ==";
     };
     dependencies = [
       sources."@babel/code-frame-7.14.5"
       sources."@babel/compat-data-7.14.5"
-      (sources."@babel/core-7.14.5" // {
+      (sources."@babel/core-7.14.6" // {
         dependencies = [
           sources."semver-6.3.0"
         ];
@@ -94122,7 +94604,7 @@ in
           sources."semver-6.3.0"
         ];
       })
-      sources."@babel/helper-create-class-features-plugin-7.14.5"
+      sources."@babel/helper-create-class-features-plugin-7.14.6"
       sources."@babel/helper-create-regexp-features-plugin-7.14.5"
       (sources."@babel/helper-define-polyfill-provider-0.2.3" // {
         dependencies = [
@@ -94146,7 +94628,7 @@ in
       sources."@babel/helper-validator-identifier-7.14.5"
       sources."@babel/helper-validator-option-7.14.5"
       sources."@babel/helper-wrap-function-7.14.5"
-      sources."@babel/helpers-7.14.5"
+      sources."@babel/helpers-7.14.6"
       (sources."@babel/highlight-7.14.5" // {
         dependencies = [
           sources."ansi-styles-3.2.1"
@@ -94156,7 +94638,7 @@ in
           sources."supports-color-5.5.0"
         ];
       })
-      sources."@babel/parser-7.14.5"
+      sources."@babel/parser-7.14.6"
       sources."@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining-7.14.5"
       sources."@babel/plugin-proposal-async-generator-functions-7.14.5"
       sources."@babel/plugin-proposal-class-properties-7.14.5"
@@ -94213,7 +94695,7 @@ in
       sources."@babel/plugin-transform-regenerator-7.14.5"
       sources."@babel/plugin-transform-reserved-words-7.14.5"
       sources."@babel/plugin-transform-shorthand-properties-7.14.5"
-      sources."@babel/plugin-transform-spread-7.14.5"
+      sources."@babel/plugin-transform-spread-7.14.6"
       sources."@babel/plugin-transform-sticky-regex-7.14.5"
       sources."@babel/plugin-transform-template-literals-7.14.5"
       sources."@babel/plugin-transform-typeof-symbol-7.14.5"
@@ -94225,7 +94707,7 @@ in
         ];
       })
       sources."@babel/preset-modules-0.1.4"
-      sources."@babel/runtime-7.14.5"
+      sources."@babel/runtime-7.14.6"
       sources."@babel/template-7.14.5"
       sources."@babel/traverse-7.14.5"
       sources."@babel/types-7.14.5"
@@ -94238,7 +94720,7 @@ in
       sources."@dabh/diagnostics-2.0.2"
       sources."@jest/types-24.9.0"
       sources."@mrmlnc/readdir-enhanced-2.2.1"
-      (sources."@netlify/build-12.1.0" // {
+      (sources."@netlify/build-12.4.1" // {
         dependencies = [
           sources."ansi-styles-4.3.0"
           sources."chalk-3.0.0"
@@ -94258,32 +94740,25 @@ in
           sources."slash-3.0.0"
         ];
       })
-      (sources."@netlify/config-7.2.0" // {
+      (sources."@netlify/config-7.5.0" // {
         dependencies = [
           sources."ansi-styles-4.3.0"
           sources."chalk-3.0.0"
+          sources."dot-prop-5.3.0"
           sources."execa-3.4.0"
           sources."find-up-4.1.0"
           sources."is-plain-obj-2.1.0"
           sources."locate-path-5.0.0"
         ];
       })
-      sources."@netlify/esbuild-0.13.5"
-      (sources."@netlify/framework-info-5.1.4" // {
+      sources."@netlify/esbuild-0.13.6"
+      (sources."@netlify/framework-info-5.3.0" // {
         dependencies = [
           sources."p-limit-3.1.0"
           sources."p-locate-5.0.0"
         ];
       })
-      (sources."@netlify/functions-utils-1.3.40" // {
-        dependencies = [
-          sources."@netlify/zip-it-and-ship-it-4.3.0"
-          sources."cp-file-9.0.0"
-          sources."pkg-dir-5.0.0"
-          sources."resolve-2.0.0-next.3"
-          sources."yargs-16.2.0"
-        ];
-      })
+      sources."@netlify/functions-utils-1.3.43"
       (sources."@netlify/git-utils-1.0.11" // {
         dependencies = [
           sources."braces-3.0.2"
@@ -94295,25 +94770,27 @@ in
         ];
       })
       sources."@netlify/open-api-2.5.0"
-      (sources."@netlify/plugin-edge-handlers-1.11.16" // {
+      (sources."@netlify/plugin-edge-handlers-1.11.18" // {
         dependencies = [
           sources."@types/node-14.17.3"
-          sources."typescript-4.3.2"
         ];
       })
-      sources."@netlify/plugins-list-2.15.0"
-      sources."@netlify/routing-local-proxy-0.30.0"
+      sources."@netlify/plugins-list-2.16.0"
+      sources."@netlify/routing-local-proxy-0.30.1"
       (sources."@netlify/run-utils-1.0.7" // {
         dependencies = [
           sources."execa-3.4.0"
         ];
       })
-      (sources."@netlify/zip-it-and-ship-it-4.2.7" // {
+      (sources."@netlify/zip-it-and-ship-it-4.4.1" // {
         dependencies = [
-          sources."cp-file-9.0.0"
+          sources."cliui-7.0.4"
+          sources."cp-file-9.1.0"
           sources."pkg-dir-5.0.0"
           sources."resolve-2.0.0-next.3"
+          sources."y18n-5.0.8"
           sources."yargs-16.2.0"
+          sources."yargs-parser-20.2.9"
         ];
       })
       (sources."@nodelib/fs.scandir-2.1.5" // {
@@ -94355,7 +94832,7 @@ in
           sources."fast-glob-3.2.5"
           sources."fill-range-7.0.1"
           sources."glob-parent-5.1.2"
-          sources."globby-11.0.3"
+          sources."globby-11.0.4"
           sources."ignore-5.1.8"
           sources."is-number-7.0.0"
           sources."micromatch-4.0.4"
@@ -94421,7 +94898,7 @@ in
       })
       sources."@oclif/screen-1.0.4"
       sources."@octokit/auth-token-2.4.5"
-      sources."@octokit/core-3.5.0"
+      sources."@octokit/core-3.5.1"
       (sources."@octokit/endpoint-6.0.12" // {
         dependencies = [
           sources."is-plain-object-5.0.0"
@@ -94465,7 +94942,7 @@ in
       sources."@szmarczak/http-timer-1.1.2"
       sources."@types/cacheable-request-6.0.1"
       sources."@types/decompress-4.2.3"
-      sources."@types/download-6.2.4"
+      sources."@types/download-8.0.0"
       sources."@types/estree-0.0.39"
       sources."@types/glob-7.1.3"
       sources."@types/got-8.3.5"
@@ -94476,17 +94953,16 @@ in
       sources."@types/istanbul-reports-1.1.2"
       sources."@types/keyv-3.1.1"
       sources."@types/minimatch-3.0.4"
-      sources."@types/mkdirp-0.5.2"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."@types/node-fetch-2.5.10"
       sources."@types/normalize-package-data-2.4.0"
       sources."@types/resolve-1.17.1"
       sources."@types/responselike-1.0.0"
-      sources."@types/semver-5.5.0"
+      sources."@types/semver-7.3.6"
       sources."@types/yargs-13.0.11"
       sources."@types/yargs-parser-20.2.0"
-      sources."@typescript-eslint/types-4.26.1"
-      (sources."@typescript-eslint/typescript-estree-4.26.1" // {
+      sources."@typescript-eslint/types-4.28.0"
+      (sources."@typescript-eslint/typescript-estree-4.28.0" // {
         dependencies = [
           sources."@nodelib/fs.stat-2.0.5"
           sources."array-union-2.1.0"
@@ -94495,7 +94971,7 @@ in
           sources."fast-glob-3.2.5"
           sources."fill-range-7.0.1"
           sources."glob-parent-5.1.2"
-          sources."globby-11.0.3"
+          sources."globby-11.0.4"
           sources."ignore-5.1.8"
           sources."is-number-7.0.0"
           sources."micromatch-4.0.4"
@@ -94503,7 +94979,7 @@ in
           sources."to-regex-range-5.0.1"
         ];
       })
-      sources."@typescript-eslint/visitor-keys-4.26.1"
+      sources."@typescript-eslint/visitor-keys-4.28.0"
       sources."@ungap/from-entries-0.2.1"
       sources."accepts-1.3.7"
       sources."agent-base-6.0.2"
@@ -94565,7 +95041,7 @@ in
       sources."asynckit-0.4.0"
       sources."at-least-node-1.0.0"
       sources."atob-2.1.2"
-      (sources."aws-sdk-2.927.0" // {
+      (sources."aws-sdk-2.932.0" // {
         dependencies = [
           sources."buffer-4.9.2"
           sources."ieee754-1.1.13"
@@ -94578,7 +95054,7 @@ in
           sources."semver-6.3.0"
         ];
       })
-      sources."babel-plugin-polyfill-corejs3-0.2.2"
+      sources."babel-plugin-polyfill-corejs3-0.2.3"
       sources."babel-plugin-polyfill-regenerator-0.2.2"
       sources."backoff-2.5.0"
       sources."balanced-match-1.0.2"
@@ -94639,23 +95115,22 @@ in
       sources."cachedir-2.3.0"
       sources."call-bind-1.0.2"
       sources."call-me-maybe-1.0.1"
+      sources."callsite-1.0.0"
       sources."camelcase-5.3.1"
-      sources."caniuse-lite-1.0.30001237"
+      sources."caniuse-lite-1.0.30001239"
       sources."cardinal-2.1.1"
-      sources."caw-2.0.1"
       (sources."chalk-4.1.1" // {
         dependencies = [
           sources."ansi-styles-4.3.0"
         ];
       })
       sources."chardet-0.7.0"
-      (sources."chokidar-3.5.1" // {
+      (sources."chokidar-3.5.2" // {
         dependencies = [
           sources."braces-3.0.2"
           sources."fill-range-7.0.1"
           sources."glob-parent-5.1.2"
           sources."is-number-7.0.0"
-          sources."readdirp-3.5.0"
           sources."to-regex-range-5.0.1"
         ];
       })
@@ -94705,7 +95180,12 @@ in
         ];
       })
       sources."cli-width-2.2.1"
-      sources."cliui-7.0.4"
+      (sources."cliui-6.0.0" // {
+        dependencies = [
+          sources."ansi-styles-4.3.0"
+          sources."wrap-ansi-6.2.0"
+        ];
+      })
       sources."clone-1.0.4"
       sources."clone-response-1.0.2"
       sources."code-point-at-1.1.0"
@@ -94730,15 +95210,18 @@ in
       sources."compress-commons-4.1.1"
       sources."concat-map-0.0.1"
       sources."concordance-5.0.4"
-      sources."config-chain-1.1.13"
-      sources."configstore-5.0.1"
+      (sources."configstore-5.0.1" // {
+        dependencies = [
+          sources."dot-prop-5.3.0"
+        ];
+      })
       (sources."content-disposition-0.5.3" // {
         dependencies = [
           sources."safe-buffer-5.1.2"
         ];
       })
       sources."content-type-1.0.4"
-      (sources."convert-source-map-1.7.0" // {
+      (sources."convert-source-map-1.8.0" // {
         dependencies = [
           sources."safe-buffer-5.1.2"
         ];
@@ -94754,7 +95237,7 @@ in
           sources."safe-buffer-5.1.2"
         ];
       })
-      (sources."core-js-compat-3.14.0" // {
+      (sources."core-js-compat-3.15.0" // {
         dependencies = [
           sources."semver-7.0.0"
         ];
@@ -94779,6 +95262,7 @@ in
           sources."ms-2.1.2"
         ];
       })
+      sources."decache-4.6.0"
       sources."decamelize-1.2.0"
       sources."decode-uri-component-0.2.0"
       (sources."decompress-4.2.1" // {
@@ -94837,7 +95321,7 @@ in
           sources."fast-glob-3.2.5"
           sources."fill-range-7.0.1"
           sources."glob-parent-5.1.2"
-          sources."globby-11.0.3"
+          sources."globby-11.0.4"
           sources."ignore-5.1.8"
           sources."is-number-7.0.0"
           sources."micromatch-4.0.4"
@@ -94857,30 +95341,43 @@ in
       sources."detective-sass-3.0.1"
       sources."detective-scss-2.0.1"
       sources."detective-stylus-1.0.0"
-      sources."detective-typescript-7.0.0"
+      (sources."detective-typescript-7.0.0" // {
+        dependencies = [
+          sources."typescript-3.9.10"
+        ];
+      })
       (sources."dir-glob-2.2.2" // {
         dependencies = [
           sources."path-type-3.0.0"
           sources."pify-3.0.0"
         ];
       })
-      sources."dot-prop-5.3.0"
+      sources."dot-prop-6.0.1"
       sources."dotenv-10.0.0"
-      (sources."download-7.1.0" // {
+      (sources."download-8.0.0" // {
         dependencies = [
           sources."@sindresorhus/is-0.7.0"
-          sources."cacheable-request-2.1.4"
-          sources."get-stream-3.0.0"
-          sources."got-8.3.2"
+          (sources."cacheable-request-2.1.4" // {
+            dependencies = [
+              sources."get-stream-3.0.0"
+            ];
+          })
+          sources."get-stream-4.1.0"
+          (sources."got-8.3.2" // {
+            dependencies = [
+              sources."get-stream-3.0.0"
+              sources."pify-3.0.0"
+            ];
+          })
           sources."http-cache-semantics-3.8.1"
           sources."is-plain-obj-1.1.0"
           sources."keyv-3.0.0"
           sources."lowercase-keys-1.0.0"
-          sources."make-dir-1.3.0"
+          sources."make-dir-2.1.0"
           sources."normalize-url-2.0.1"
           sources."p-cancelable-0.4.1"
           sources."p-event-2.3.1"
-          sources."pify-3.0.0"
+          sources."semver-5.7.1"
           sources."sort-keys-2.0.0"
         ];
       })
@@ -94897,7 +95394,6 @@ in
       sources."envinfo-7.8.1"
       sources."error-ex-1.3.2"
       sources."error-stack-parser-2.0.6"
-      sources."esbuild-0.11.10"
       sources."escalade-3.1.1"
       sources."escape-goat-2.1.1"
       sources."escape-html-1.0.3"
@@ -95013,9 +95509,9 @@ in
       })
       sources."figures-3.2.0"
       sources."file-size-0.0.5"
-      sources."file-type-8.1.0"
+      sources."file-type-11.1.0"
       sources."filename-reserved-regex-2.0.0"
-      sources."filenamify-2.1.0"
+      sources."filenamify-3.0.0"
       (sources."fill-range-4.0.0" // {
         dependencies = [
           sources."extend-shallow-2.0.1"
@@ -95056,14 +95552,9 @@ in
       sources."get-caller-file-2.0.5"
       sources."get-intrinsic-1.1.1"
       sources."get-port-5.1.1"
-      sources."get-proxy-2.1.0"
       sources."get-stream-5.2.0"
       sources."get-value-2.0.6"
-      (sources."gh-release-fetch-1.1.0" // {
-        dependencies = [
-          sources."semver-5.7.1"
-        ];
-      })
+      sources."gh-release-fetch-2.0.0"
       sources."git-repo-info-2.1.1"
       sources."gitconfiglocal-2.1.0"
       sources."glob-7.1.7"
@@ -95190,7 +95681,7 @@ in
           sources."supports-color-5.5.0"
         ];
       })
-      sources."inquirer-autocomplete-prompt-1.3.0"
+      sources."inquirer-autocomplete-prompt-1.4.0"
       sources."into-stream-3.1.0"
       sources."ipaddr.js-1.9.1"
       sources."is-accessor-descriptor-1.0.0"
@@ -95447,7 +95938,7 @@ in
           sources."qs-6.10.1"
         ];
       })
-      (sources."netlify-redirect-parser-5.1.1" // {
+      (sources."netlify-redirect-parser-7.0.0" // {
         dependencies = [
           sources."is-plain-obj-2.1.0"
         ];
@@ -95489,11 +95980,6 @@ in
       })
       sources."normalize-path-3.0.0"
       sources."normalize-url-4.5.1"
-      (sources."npm-conf-1.1.3" // {
-        dependencies = [
-          sources."pify-3.0.0"
-        ];
-      })
       sources."npm-normalize-package-bin-1.0.1"
       sources."npm-run-path-4.0.1"
       sources."number-is-nan-1.0.1"
@@ -95630,7 +96116,7 @@ in
         ];
       })
       sources."posix-character-classes-0.1.1"
-      sources."postcss-8.3.2"
+      sources."postcss-8.3.5"
       sources."postcss-values-parser-2.0.1"
       sources."precinct-8.1.0"
       sources."precond-0.2.3"
@@ -95648,7 +96134,6 @@ in
       sources."printj-1.1.2"
       sources."process-es6-0.11.6"
       sources."process-nextick-args-2.0.1"
-      sources."proto-list-1.2.4"
       sources."proxy-addr-2.0.7"
       sources."ps-list-6.3.0"
       sources."pump-3.0.0"
@@ -95719,7 +96204,7 @@ in
       sources."ret-0.1.15"
       sources."reusify-1.0.4"
       sources."rimraf-3.0.2"
-      sources."rollup-2.51.2"
+      sources."rollup-2.52.2"
       (sources."rollup-plugin-inject-3.0.2" // {
         dependencies = [
           sources."estree-walker-0.6.1"
@@ -95947,7 +96432,7 @@ in
       sources."type-fest-0.21.3"
       sources."type-is-1.6.18"
       sources."typedarray-to-buffer-3.1.5"
-      sources."typescript-3.9.9"
+      sources."typescript-4.3.4"
       sources."uid-safe-2.1.5"
       sources."unbzip2-stream-1.4.3"
       sources."unicode-canonical-property-names-ecmascript-1.0.4"
@@ -96051,20 +96536,15 @@ in
       sources."xml2js-0.4.19"
       sources."xmlbuilder-9.0.7"
       sources."xtend-4.0.2"
-      sources."y18n-5.0.8"
+      sources."y18n-4.0.3"
       sources."yallist-4.0.0"
       (sources."yargs-15.4.1" // {
         dependencies = [
-          sources."ansi-styles-4.3.0"
-          sources."cliui-6.0.0"
           sources."find-up-4.1.0"
           sources."locate-path-5.0.0"
-          sources."wrap-ansi-6.2.0"
-          sources."y18n-4.0.3"
-          sources."yargs-parser-18.1.3"
         ];
       })
-      sources."yargs-parser-20.2.7"
+      sources."yargs-parser-18.1.3"
       sources."yarn-1.22.10"
       sources."yauzl-2.10.0"
       sources."yocto-queue-0.1.0"
@@ -96188,7 +96668,7 @@ in
       sources."signal-exit-3.0.3"
       sources."smart-buffer-4.1.0"
       sources."socks-2.6.1"
-      sources."socks-proxy-agent-5.0.0"
+      sources."socks-proxy-agent-5.0.1"
       sources."ssri-8.0.1"
       sources."string-width-1.0.2"
       sources."string_decoder-1.1.1"
@@ -96622,7 +97102,7 @@ in
       sha512 = "P/EmWwzuY/0mQFlrklSUrVANdv9xQsbrpKrpfA8tuhhxu1OEiSgzYdo87Zj13Hi38K4f1rNPQj4rw2vEBcYS/g==";
     };
     dependencies = [
-      sources."@babel/runtime-7.14.5"
+      sources."@babel/runtime-7.14.6"
       sources."@node-red/editor-api-1.3.5"
       sources."@node-red/editor-client-1.3.5"
       (sources."@node-red/nodes-1.3.5" // {
@@ -96908,7 +97388,7 @@ in
           sources."ms-2.1.2"
           sources."readable-stream-3.6.0"
           sources."string_decoder-1.3.0"
-          sources."ws-7.4.6"
+          sources."ws-7.5.0"
         ];
       })
       (sources."mqtt-packet-6.10.0" // {
@@ -97039,7 +97519,7 @@ in
       sources."string_decoder-0.10.31"
       sources."strip-ansi-3.0.1"
       sources."strip-json-comments-2.0.1"
-      sources."tail-2.2.2"
+      sources."tail-2.2.3"
       (sources."tar-6.1.0" // {
         dependencies = [
           sources."mkdirp-1.0.4"
@@ -97330,7 +97810,7 @@ in
           sources."supports-color-7.2.0"
         ];
       })
-      sources."chokidar-3.5.1"
+      sources."chokidar-3.5.2"
       sources."ci-info-2.0.0"
       sources."cli-boxes-2.2.1"
       sources."clone-response-1.0.2"
@@ -97403,7 +97883,7 @@ in
       sources."pump-3.0.0"
       sources."pupa-2.1.1"
       sources."rc-1.2.8"
-      sources."readdirp-3.5.0"
+      sources."readdirp-3.6.0"
       sources."registry-auth-token-4.2.1"
       sources."registry-url-5.1.0"
       sources."responselike-1.0.2"
@@ -97491,7 +97971,7 @@ in
       sources."@types/http-cache-semantics-4.0.0"
       sources."@types/keyv-3.1.1"
       sources."@types/minimist-1.2.1"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."@types/normalize-package-data-2.4.0"
       sources."@types/parse-json-4.0.0"
       sources."@types/responselike-1.0.0"
@@ -97602,7 +98082,7 @@ in
       sources."glob-7.1.7"
       sources."glob-parent-5.1.2"
       sources."global-dirs-2.1.0"
-      sources."globby-11.0.3"
+      sources."globby-11.0.4"
       (sources."got-10.7.0" // {
         dependencies = [
           sources."get-stream-5.2.0"
@@ -97979,7 +98459,7 @@ in
       sources."xdg-basedir-4.0.0"
       sources."yallist-4.0.0"
       sources."yaml-1.10.2"
-      sources."yargs-parser-20.2.7"
+      sources."yargs-parser-20.2.9"
       sources."yocto-queue-0.1.0"
     ];
     buildInputs = globalBuildInputs;
@@ -97995,10 +98475,10 @@ in
   npm = nodeEnv.buildNodePackage {
     name = "npm";
     packageName = "npm";
-    version = "7.17.0";
+    version = "7.18.1";
     src = fetchurl {
-      url = "https://registry.npmjs.org/npm/-/npm-7.17.0.tgz";
-      sha512 = "yNzj4vQellvUGiBM/SzhfT89EV0vb7iILjTehSydTY/IgK2Vjk7/7J8WNJ2ysqcgfLY21ptI/j7uknt15IbbKQ==";
+      url = "https://registry.npmjs.org/npm/-/npm-7.18.1.tgz";
+      sha512 = "fu7rMtc4ZaDnFlZsiLhqwWWs6KixOcBGiBLoJH+AbuaznwtT8mYQnq5nGNN14Jib+E9OjkjNRgg+X45Ia9xtKQ==";
     };
     buildInputs = globalBuildInputs;
     meta = {
@@ -98013,16 +98493,16 @@ in
   npm-check-updates = nodeEnv.buildNodePackage {
     name = "npm-check-updates";
     packageName = "npm-check-updates";
-    version = "11.6.0";
+    version = "11.7.1";
     src = fetchurl {
-      url = "https://registry.npmjs.org/npm-check-updates/-/npm-check-updates-11.6.0.tgz";
-      sha512 = "/l4S7Gh+8+Rg5itWsqFya5RRSHtPzw5neyAlbWNJfBfEeRX6lYVxKgs85QFBOKrZj3eL5MGBaUW8228TmjMhrw==";
+      url = "https://registry.npmjs.org/npm-check-updates/-/npm-check-updates-11.7.1.tgz";
+      sha512 = "1ZH1le6fIuCS/Lrj9hKzds2bBcpc60cENZJ681rJ+cx202JmwsmnVmPj6lC4f9MNb0/D81QXR0QbIt5oqDKQtA==";
     };
     dependencies = [
       sources."@nodelib/fs.scandir-2.1.5"
       sources."@nodelib/fs.stat-2.0.5"
       sources."@nodelib/fs.walk-1.2.7"
-      sources."@npmcli/git-2.0.9"
+      sources."@npmcli/git-2.1.0"
       sources."@npmcli/installed-package-contents-1.0.7"
       sources."@npmcli/move-file-1.1.2"
       sources."@npmcli/node-gyp-1.0.2"
@@ -98140,7 +98620,7 @@ in
           sources."ini-2.0.0"
         ];
       })
-      sources."globby-11.0.3"
+      sources."globby-11.0.4"
       sources."got-9.6.0"
       sources."graceful-fs-4.2.6"
       sources."har-schema-2.0.0"
@@ -98214,7 +98694,7 @@ in
           sources."semver-6.3.0"
         ];
       })
-      sources."make-fetch-happen-9.0.2"
+      sources."make-fetch-happen-9.0.3"
       sources."map-age-cleaner-0.1.3"
       sources."mem-8.1.1"
       sources."merge2-1.4.1"
@@ -98242,7 +98722,7 @@ in
       sources."npm-bundled-1.1.2"
       sources."npm-install-checks-4.0.0"
       sources."npm-normalize-package-bin-1.0.1"
-      sources."npm-package-arg-8.1.4"
+      sources."npm-package-arg-8.1.5"
       sources."npm-packlist-2.2.2"
       sources."npm-pick-manifest-6.1.1"
       sources."npm-registry-fetch-11.0.0"
@@ -98310,7 +98790,7 @@ in
       sources."slash-3.0.0"
       sources."smart-buffer-4.1.0"
       sources."socks-2.6.1"
-      sources."socks-proxy-agent-5.0.0"
+      sources."socks-proxy-agent-5.0.1"
       sources."spawn-please-1.0.0"
       sources."sshpk-1.16.1"
       sources."ssri-8.0.1"
@@ -98599,7 +99079,7 @@ in
     dependencies = [
       sources."@babel/code-frame-7.14.5"
       sources."@babel/compat-data-7.14.5"
-      (sources."@babel/core-7.14.5" // {
+      (sources."@babel/core-7.14.6" // {
         dependencies = [
           sources."json5-2.2.0"
           sources."semver-6.3.0"
@@ -98618,7 +99098,7 @@ in
           sources."semver-6.3.0"
         ];
       })
-      sources."@babel/helper-create-class-features-plugin-7.14.5"
+      sources."@babel/helper-create-class-features-plugin-7.14.6"
       sources."@babel/helper-create-regexp-features-plugin-7.14.5"
       (sources."@babel/helper-define-polyfill-provider-0.2.3" // {
         dependencies = [
@@ -98642,9 +99122,9 @@ in
       sources."@babel/helper-validator-identifier-7.14.5"
       sources."@babel/helper-validator-option-7.14.5"
       sources."@babel/helper-wrap-function-7.14.5"
-      sources."@babel/helpers-7.14.5"
+      sources."@babel/helpers-7.14.6"
       sources."@babel/highlight-7.14.5"
-      sources."@babel/parser-7.14.5"
+      sources."@babel/parser-7.14.6"
       sources."@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining-7.14.5"
       sources."@babel/plugin-proposal-async-generator-functions-7.14.5"
       sources."@babel/plugin-proposal-class-properties-7.14.5"
@@ -98705,7 +99185,7 @@ in
       sources."@babel/plugin-transform-regenerator-7.14.5"
       sources."@babel/plugin-transform-reserved-words-7.14.5"
       sources."@babel/plugin-transform-shorthand-properties-7.14.5"
-      sources."@babel/plugin-transform-spread-7.14.5"
+      sources."@babel/plugin-transform-spread-7.14.6"
       sources."@babel/plugin-transform-sticky-regex-7.14.5"
       sources."@babel/plugin-transform-template-literals-7.14.5"
       sources."@babel/plugin-transform-typeof-symbol-7.14.5"
@@ -98717,7 +99197,7 @@ in
         ];
       })
       sources."@babel/preset-modules-0.1.4"
-      sources."@babel/runtime-7.14.5"
+      sources."@babel/runtime-7.14.6"
       sources."@babel/template-7.14.5"
       sources."@babel/traverse-7.14.5"
       sources."@babel/types-7.14.5"
@@ -98780,7 +99260,7 @@ in
           sources."semver-6.3.0"
         ];
       })
-      sources."babel-plugin-polyfill-corejs3-0.2.2"
+      sources."babel-plugin-polyfill-corejs3-0.2.3"
       sources."babel-plugin-polyfill-regenerator-0.2.2"
       (sources."babel-runtime-6.26.0" // {
         dependencies = [
@@ -98842,7 +99322,7 @@ in
       sources."caller-path-2.0.0"
       sources."callsites-2.0.0"
       sources."caniuse-api-3.0.0"
-      sources."caniuse-lite-1.0.30001237"
+      sources."caniuse-lite-1.0.30001239"
       sources."caseless-0.12.0"
       sources."chalk-2.4.2"
       sources."chokidar-2.1.8"
@@ -98866,10 +99346,10 @@ in
       sources."concat-stream-1.6.2"
       sources."console-browserify-1.2.0"
       sources."constants-browserify-1.0.0"
-      sources."convert-source-map-1.7.0"
+      sources."convert-source-map-1.8.0"
       sources."copy-descriptor-0.1.1"
       sources."core-js-2.6.12"
-      (sources."core-js-compat-3.14.0" // {
+      (sources."core-js-compat-3.15.0" // {
         dependencies = [
           sources."semver-7.0.0"
         ];
@@ -99874,7 +100354,7 @@ in
           sources."yargs-parser-13.1.2"
         ];
       })
-      sources."yargs-parser-15.0.1"
+      sources."yargs-parser-15.0.3"
     ];
     buildInputs = globalBuildInputs;
     meta = {
@@ -100703,7 +101183,7 @@ in
       sources."bytes-3.1.0"
       sources."chalk-3.0.0"
       sources."charm-0.1.2"
-      sources."chokidar-3.5.1"
+      sources."chokidar-3.5.2"
       sources."cli-tableau-2.0.1"
       sources."color-convert-2.0.1"
       sources."color-name-1.1.4"
@@ -100809,7 +101289,7 @@ in
       sources."raw-body-2.4.1"
       sources."read-1.0.7"
       sources."readable-stream-1.1.14"
-      sources."readdirp-3.5.0"
+      sources."readdirp-3.6.0"
       sources."require-in-the-middle-5.1.0"
       sources."resolve-1.20.0"
       sources."run-series-1.1.9"
@@ -100827,14 +101307,14 @@ in
       sources."signal-exit-3.0.3"
       sources."smart-buffer-4.1.0"
       sources."socks-2.6.1"
-      sources."socks-proxy-agent-5.0.0"
+      sources."socks-proxy-agent-5.0.1"
       sources."source-map-0.6.1"
       sources."source-map-support-0.5.19"
       sources."sprintf-js-1.0.3"
       sources."statuses-1.5.0"
       sources."string_decoder-0.10.31"
       sources."supports-color-7.2.0"
-      sources."systeminformation-5.7.6"
+      sources."systeminformation-5.7.7"
       sources."to-regex-range-5.0.1"
       sources."toidentifier-1.0.0"
       sources."tslib-2.3.0"
@@ -100869,10 +101349,10 @@ in
   pnpm = nodeEnv.buildNodePackage {
     name = "pnpm";
     packageName = "pnpm";
-    version = "6.7.6";
+    version = "6.8.0";
     src = fetchurl {
-      url = "https://registry.npmjs.org/pnpm/-/pnpm-6.7.6.tgz";
-      sha512 = "VhO6zVIuhVkKXP3kWMZs9W5b3rhcztq524WoAc9OEwjmj7SiKyp0UNltaaLR0VRjFGJPuQOcqDbNkWwzao6dUw==";
+      url = "https://registry.npmjs.org/pnpm/-/pnpm-6.8.0.tgz";
+      sha512 = "la/zfhv3FA9K5kwWda58genmRQD0MwWJjLvHhH65EQWOEG3sr9zKSCJxUzckIY9uy//IRhnTTUY0HYqq2D7N6g==";
     };
     buildInputs = globalBuildInputs;
     meta = {
@@ -100921,22 +101401,9 @@ in
       sha512 = "leHXsQRq89S3JC9zw/tKyiVV2jAhnfQe0J8VI4eQQbUjwIe0XxVqLrR+7UsahF1s9wi4GlqP6SJ8ydf44cgF2Q==";
     };
     dependencies = [
-      sources."@babel/code-frame-7.14.5"
-      sources."@babel/helper-validator-identifier-7.14.5"
-      (sources."@babel/highlight-7.14.5" // {
-        dependencies = [
-          sources."ansi-styles-3.2.1"
-          sources."chalk-2.4.2"
-          sources."color-convert-1.9.3"
-          sources."color-name-1.1.3"
-          sources."has-flag-3.0.0"
-          sources."supports-color-5.5.0"
-        ];
-      })
       sources."@nodelib/fs.scandir-2.1.5"
       sources."@nodelib/fs.stat-2.0.5"
       sources."@nodelib/fs.walk-1.2.7"
-      sources."@types/parse-json-4.0.0"
       sources."ansi-regex-5.0.0"
       sources."ansi-styles-4.3.0"
       sources."anymatch-3.1.2"
@@ -100944,20 +101411,16 @@ in
       sources."at-least-node-1.0.0"
       sources."binary-extensions-2.2.0"
       sources."braces-3.0.2"
-      sources."callsites-3.1.0"
       sources."chalk-4.1.1"
-      sources."chokidar-3.5.1"
+      sources."chokidar-3.5.2"
       sources."cliui-7.0.4"
       sources."color-convert-2.0.1"
       sources."color-name-1.1.4"
       sources."colorette-1.2.2"
-      sources."cosmiconfig-7.0.0"
       sources."dependency-graph-0.9.0"
       sources."dir-glob-3.0.1"
       sources."emoji-regex-8.0.0"
-      sources."error-ex-1.3.2"
       sources."escalade-3.1.1"
-      sources."escape-string-regexp-1.0.5"
       sources."fast-glob-3.2.5"
       sources."fastq-1.11.0"
       sources."fill-range-7.0.1"
@@ -100966,27 +101429,19 @@ in
       sources."get-caller-file-2.0.5"
       sources."get-stdin-8.0.0"
       sources."glob-parent-5.1.2"
-      sources."globby-11.0.3"
+      sources."globby-11.0.4"
       sources."graceful-fs-4.2.6"
       sources."has-flag-4.0.0"
       sources."ignore-5.1.8"
       sources."import-cwd-3.0.0"
-      sources."import-fresh-3.3.0"
-      (sources."import-from-3.0.0" // {
-        dependencies = [
-          sources."resolve-from-5.0.0"
-        ];
-      })
-      sources."is-arrayish-0.2.1"
+      sources."import-from-3.0.0"
       sources."is-binary-path-2.1.0"
       sources."is-extglob-2.1.1"
       sources."is-fullwidth-code-point-3.0.0"
       sources."is-glob-4.0.1"
       sources."is-number-7.0.0"
-      sources."js-tokens-4.0.0"
-      sources."json-parse-even-better-errors-2.3.1"
       sources."jsonfile-6.1.0"
-      sources."lines-and-columns-1.1.6"
+      sources."lilconfig-2.0.3"
       sources."lodash.difference-4.5.0"
       sources."lodash.forown-4.4.0"
       sources."lodash.get-4.4.2"
@@ -100995,19 +101450,17 @@ in
       sources."merge2-1.4.1"
       sources."micromatch-4.0.4"
       sources."normalize-path-3.0.0"
-      sources."parent-module-1.0.1"
-      sources."parse-json-5.2.0"
       sources."path-type-4.0.0"
       sources."picomatch-2.3.0"
       sources."pify-2.3.0"
-      sources."postcss-load-config-3.0.1"
+      sources."postcss-load-config-3.1.0"
       sources."postcss-reporter-7.0.2"
       sources."pretty-hrtime-1.0.3"
       sources."queue-microtask-1.2.3"
       sources."read-cache-1.0.0"
-      sources."readdirp-3.5.0"
+      sources."readdirp-3.6.0"
       sources."require-directory-2.1.1"
-      sources."resolve-from-4.0.0"
+      sources."resolve-from-5.0.0"
       sources."reusify-1.0.4"
       sources."run-parallel-1.2.0"
       sources."slash-3.0.0"
@@ -101020,7 +101473,7 @@ in
       sources."y18n-5.0.8"
       sources."yaml-1.10.2"
       sources."yargs-16.2.0"
-      sources."yargs-parser-20.2.7"
+      sources."yargs-parser-20.2.9"
     ];
     buildInputs = globalBuildInputs;
     meta = {
@@ -101355,10 +101808,10 @@ in
   purescript-language-server = nodeEnv.buildNodePackage {
     name = "purescript-language-server";
     packageName = "purescript-language-server";
-    version = "0.15.0";
+    version = "0.15.2";
     src = fetchurl {
-      url = "https://registry.npmjs.org/purescript-language-server/-/purescript-language-server-0.15.0.tgz";
-      sha512 = "zzVqn7EnHdFYVrXhIVQ5LJqQ1ysZb7leo6kdNnxwkBgvmdrdi68OQBPG3QlmJ+LULnEyKhhWyAdb5lc+W2Ha1Q==";
+      url = "https://registry.npmjs.org/purescript-language-server/-/purescript-language-server-0.15.2.tgz";
+      sha512 = "dlxcc6Fv7rcXO3uFVcOgZturcKknB4J00ITJjZCrORTjw5eVbGcSTKrSeSAlNZWaUYu0HQX9NHVKtHDG/6rBNw==";
     };
     dependencies = [
       sources."isexe-2.0.0"
@@ -101421,10 +101874,10 @@ in
   pyright = nodeEnv.buildNodePackage {
     name = "pyright";
     packageName = "pyright";
-    version = "1.1.148";
+    version = "1.1.151";
     src = fetchurl {
-      url = "https://registry.npmjs.org/pyright/-/pyright-1.1.148.tgz";
-      sha512 = "cM1Bs/5XSqqfaTfl+zSvXvrq1YMUYOmo2QGBqZ4Cczq0hDo4oJAihzszJONO9H5riTgmEduid5aU3Rpkx+Y/xw==";
+      url = "https://registry.npmjs.org/pyright/-/pyright-1.1.151.tgz";
+      sha512 = "R/Zr6VqXghuFLm7y3a8HoCrA+mfy+Zp+mp6P8gFZeJO9Rl1kQLJhfc/y4QKSQHZWxXOBGo+AFDi/rWLZfNBEgQ==";
     };
     buildInputs = globalBuildInputs;
     meta = {
@@ -101468,7 +101921,7 @@ in
       sources."command-line-usage-5.0.5"
       sources."concat-map-0.0.1"
       sources."concat-stream-1.6.2"
-      sources."convert-source-map-1.7.0"
+      sources."convert-source-map-1.8.0"
       sources."core-util-is-1.0.2"
       sources."cross-spawn-6.0.5"
       sources."decamelize-1.2.0"
@@ -101775,7 +102228,7 @@ in
       sources."@babel/cli-7.14.5"
       sources."@babel/code-frame-7.14.5"
       sources."@babel/compat-data-7.14.5"
-      (sources."@babel/core-7.14.5" // {
+      (sources."@babel/core-7.14.6" // {
         dependencies = [
           sources."semver-6.3.0"
         ];
@@ -101788,7 +102241,7 @@ in
           sources."semver-6.3.0"
         ];
       })
-      sources."@babel/helper-create-class-features-plugin-7.14.5"
+      sources."@babel/helper-create-class-features-plugin-7.14.6"
       sources."@babel/helper-create-regexp-features-plugin-7.14.5"
       (sources."@babel/helper-define-polyfill-provider-0.2.3" // {
         dependencies = [
@@ -101812,9 +102265,9 @@ in
       sources."@babel/helper-validator-identifier-7.14.5"
       sources."@babel/helper-validator-option-7.14.5"
       sources."@babel/helper-wrap-function-7.14.5"
-      sources."@babel/helpers-7.14.5"
+      sources."@babel/helpers-7.14.6"
       sources."@babel/highlight-7.14.5"
-      sources."@babel/parser-7.14.5"
+      sources."@babel/parser-7.14.6"
       sources."@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining-7.14.5"
       sources."@babel/plugin-proposal-async-generator-functions-7.14.5"
       sources."@babel/plugin-proposal-class-properties-7.14.5"
@@ -101883,7 +102336,7 @@ in
         ];
       })
       sources."@babel/plugin-transform-shorthand-properties-7.14.5"
-      sources."@babel/plugin-transform-spread-7.14.5"
+      sources."@babel/plugin-transform-spread-7.14.6"
       sources."@babel/plugin-transform-sticky-regex-7.14.5"
       sources."@babel/plugin-transform-template-literals-7.14.5"
       sources."@babel/plugin-transform-typeof-symbol-7.14.5"
@@ -101898,7 +102351,7 @@ in
       sources."@babel/preset-react-7.14.5"
       sources."@babel/preset-stage-0-7.8.3"
       sources."@babel/register-7.14.5"
-      sources."@babel/runtime-7.14.5"
+      sources."@babel/runtime-7.14.6"
       sources."@babel/template-7.14.5"
       sources."@babel/traverse-7.14.5"
       sources."@babel/types-7.14.5"
@@ -101907,7 +102360,7 @@ in
       sources."@types/glob-7.1.3"
       sources."@types/json-schema-7.0.7"
       sources."@types/minimatch-3.0.4"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."@types/parse-json-4.0.0"
       sources."@types/q-1.5.4"
       sources."@webassemblyjs/ast-1.9.0"
@@ -102001,7 +102454,7 @@ in
           sources."semver-6.3.0"
         ];
       })
-      sources."babel-plugin-polyfill-corejs3-0.2.2"
+      sources."babel-plugin-polyfill-corejs3-0.2.3"
       sources."babel-plugin-polyfill-regenerator-0.2.2"
       sources."babel-plugin-transform-react-remove-prop-types-0.4.24"
       sources."babel-plugin-universal-import-4.0.2"
@@ -102095,7 +102548,7 @@ in
       sources."camel-case-3.0.0"
       sources."camelcase-5.3.1"
       sources."caniuse-api-3.0.0"
-      sources."caniuse-lite-1.0.30001237"
+      sources."caniuse-lite-1.0.30001239"
       sources."case-sensitive-paths-webpack-plugin-2.4.0"
       sources."caw-2.0.1"
       (sources."chalk-2.4.2" // {
@@ -102105,7 +102558,7 @@ in
       })
       sources."chardet-0.7.0"
       sources."check-types-8.0.3"
-      sources."chokidar-3.5.1"
+      sources."chokidar-3.5.2"
       sources."chownr-1.1.4"
       sources."chrome-trace-event-1.0.3"
       sources."cipher-base-1.0.4"
@@ -102174,13 +102627,13 @@ in
       sources."constants-browserify-1.0.0"
       sources."content-disposition-0.5.3"
       sources."content-type-1.0.4"
-      sources."convert-source-map-1.7.0"
+      sources."convert-source-map-1.8.0"
       sources."cookie-0.4.1"
       sources."cookie-signature-1.0.6"
       sources."copy-concurrently-1.0.5"
       sources."copy-descriptor-0.1.1"
       sources."core-js-2.6.12"
-      (sources."core-js-compat-3.14.0" // {
+      (sources."core-js-compat-3.15.0" // {
         dependencies = [
           sources."semver-7.0.0"
         ];
@@ -102592,7 +103045,7 @@ in
       sources."inherits-2.0.4"
       sources."ini-1.3.8"
       sources."inquirer-6.5.2"
-      (sources."inquirer-autocomplete-prompt-1.3.0" // {
+      (sources."inquirer-autocomplete-prompt-1.4.0" // {
         dependencies = [
           sources."ansi-escapes-4.3.2"
           sources."ansi-styles-4.3.0"
@@ -103034,7 +103487,7 @@ in
       sources."react-side-effect-2.1.1"
       sources."react-universal-component-4.5.0"
       sources."readable-stream-2.3.7"
-      sources."readdirp-3.5.0"
+      sources."readdirp-3.6.0"
       sources."regenerate-1.4.2"
       sources."regenerate-unicode-properties-8.2.0"
       sources."regenerator-runtime-0.13.8"
@@ -103660,12 +104113,12 @@ in
       sources."whatwg-url-8.6.0"
       sources."word-wrap-1.2.3"
       sources."wrap-ansi-7.0.0"
-      sources."ws-7.4.6"
+      sources."ws-7.5.0"
       sources."xml-name-validator-3.0.0"
       sources."xmlchars-2.2.0"
       sources."y18n-5.0.8"
       sources."yargs-17.0.1"
-      sources."yargs-parser-20.2.7"
+      sources."yargs-parser-20.2.9"
     ];
     buildInputs = globalBuildInputs;
     meta = {
@@ -103700,8 +104153,8 @@ in
       sources."@babel/helper-split-export-declaration-7.14.5"
       sources."@babel/helper-validator-identifier-7.14.5"
       sources."@babel/highlight-7.14.5"
-      sources."@babel/parser-7.14.5"
-      sources."@babel/runtime-7.14.5"
+      sources."@babel/parser-7.14.6"
+      sources."@babel/runtime-7.14.6"
       sources."@babel/template-7.14.5"
       sources."@babel/traverse-7.14.5"
       sources."@babel/types-7.14.5"
@@ -103718,7 +104171,7 @@ in
       })
       sources."@redocly/react-dropdown-aria-2.0.12"
       sources."@types/json-schema-7.0.7"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."ansi-regex-5.0.0"
       sources."ansi-styles-3.2.1"
       sources."anymatch-3.1.2"
@@ -103763,7 +104216,7 @@ in
       sources."call-me-maybe-1.0.1"
       sources."camelize-1.0.0"
       sources."chalk-2.4.2"
-      sources."chokidar-3.5.1"
+      sources."chokidar-3.5.2"
       sources."cipher-base-1.0.4"
       sources."classnames-2.3.1"
       sources."clipboard-2.0.8"
@@ -103884,7 +104337,7 @@ in
       sources."oas-linter-3.2.2"
       sources."oas-resolver-2.5.5"
       sources."oas-schema-walker-1.1.5"
-      sources."oas-validator-5.0.6"
+      sources."oas-validator-5.0.7"
       sources."object-assign-4.1.1"
       sources."openapi-sampler-1.0.1"
       sources."os-browserify-0.3.0"
@@ -103922,7 +104375,7 @@ in
           sources."string_decoder-1.1.1"
         ];
       })
-      sources."readdirp-3.5.0"
+      sources."readdirp-3.6.0"
       (sources."redoc-2.0.0-rc.54" // {
         dependencies = [
           sources."path-browserify-1.0.1"
@@ -103956,7 +104409,7 @@ in
       sources."strip-ansi-6.0.0"
       sources."styled-components-5.3.0"
       sources."supports-color-5.5.0"
-      sources."swagger2openapi-7.0.6"
+      sources."swagger2openapi-7.0.7"
       sources."timers-browserify-2.0.12"
       sources."tiny-emitter-2.1.0"
       sources."to-arraybuffer-1.0.1"
@@ -103995,7 +104448,7 @@ in
       sources."yaml-1.10.2"
       sources."yaml-ast-parser-0.0.43"
       sources."yargs-17.0.1"
-      sources."yargs-parser-20.2.7"
+      sources."yargs-parser-20.2.9"
     ];
     buildInputs = globalBuildInputs;
     meta = {
@@ -104199,10 +104652,10 @@ in
   rollup = nodeEnv.buildNodePackage {
     name = "rollup";
     packageName = "rollup";
-    version = "2.51.2";
+    version = "2.52.2";
     src = fetchurl {
-      url = "https://registry.npmjs.org/rollup/-/rollup-2.51.2.tgz";
-      sha512 = "ReV2eGEadA7hmXSzjxdDKs10neqH2QURf2RxJ6ayAlq93ugy6qIvXMmbc5cWMGCDh1h5T4thuWO1e2VNbMq8FA==";
+      url = "https://registry.npmjs.org/rollup/-/rollup-2.52.2.tgz";
+      sha512 = "4RlFC3k2BIHlUsJ9mGd8OO+9Lm2eDF5P7+6DNQOp5sx+7N/1tFM01kELfbxlMX3MxT6owvLB1ln4S3QvvQlbUA==";
     };
     dependencies = [
       sources."fsevents-2.3.2"
@@ -104256,13 +104709,13 @@ in
       sources."@types/node-fetch-2.5.10"
       sources."@types/resolve-1.17.1"
       sources."@types/vscode-1.57.0"
-      sources."@typescript-eslint/eslint-plugin-4.26.1"
-      sources."@typescript-eslint/experimental-utils-4.26.1"
-      sources."@typescript-eslint/parser-4.26.1"
-      sources."@typescript-eslint/scope-manager-4.26.1"
-      sources."@typescript-eslint/types-4.26.1"
-      sources."@typescript-eslint/typescript-estree-4.26.1"
-      sources."@typescript-eslint/visitor-keys-4.26.1"
+      sources."@typescript-eslint/eslint-plugin-4.28.0"
+      sources."@typescript-eslint/experimental-utils-4.28.0"
+      sources."@typescript-eslint/parser-4.28.0"
+      sources."@typescript-eslint/scope-manager-4.28.0"
+      sources."@typescript-eslint/types-4.28.0"
+      sources."@typescript-eslint/typescript-estree-4.28.0"
+      sources."@typescript-eslint/visitor-keys-4.28.0"
       sources."@ungap/promise-all-settled-1.1.2"
       sources."acorn-7.4.1"
       sources."acorn-jsx-5.3.1"
@@ -104344,7 +104797,7 @@ in
       sources."entities-2.2.0"
       sources."escalade-3.1.1"
       sources."escape-string-regexp-4.0.0"
-      (sources."eslint-7.28.0" // {
+      (sources."eslint-7.29.0" // {
         dependencies = [
           (sources."eslint-utils-2.1.0" // {
             dependencies = [
@@ -104403,7 +104856,7 @@ in
       sources."glob-7.1.7"
       sources."glob-parent-5.1.2"
       sources."globals-13.9.0"
-      sources."globby-11.0.3"
+      sources."globby-11.0.4"
       sources."graceful-fs-4.2.6"
       sources."growl-1.10.5"
       sources."has-1.0.3"
@@ -104519,14 +104972,14 @@ in
         ];
       })
       sources."readdirp-3.5.0"
-      sources."regexpp-3.1.0"
+      sources."regexpp-3.2.0"
       sources."require-directory-2.1.1"
       sources."require-from-string-2.0.2"
       sources."resolve-1.20.0"
       sources."resolve-from-4.0.0"
       sources."reusify-1.0.4"
       sources."rimraf-3.0.2"
-      sources."rollup-2.51.2"
+      sources."rollup-2.52.2"
       sources."run-parallel-1.2.0"
       sources."safe-buffer-5.2.1"
       sources."semver-7.3.5"
@@ -104575,7 +105028,7 @@ in
       sources."type-check-0.4.0"
       sources."type-fest-0.20.2"
       sources."typed-rest-client-1.8.4"
-      sources."typescript-4.3.2"
+      sources."typescript-4.3.4"
       sources."typescript-formatter-7.2.2"
       sources."uc.micro-1.0.6"
       sources."underscore-1.13.1"
@@ -104592,10 +105045,10 @@ in
           sources."semver-5.7.1"
         ];
       })
-      sources."vscode-jsonrpc-6.1.0-next.2"
-      sources."vscode-languageclient-7.1.0-next.4"
-      sources."vscode-languageserver-protocol-3.17.0-next.5"
-      sources."vscode-languageserver-types-3.17.0-next.1"
+      sources."vscode-jsonrpc-7.0.0-next.1"
+      sources."vscode-languageclient-7.1.0-next.5"
+      sources."vscode-languageserver-protocol-3.17.0-next.6"
+      sources."vscode-languageserver-types-3.17.0-next.2"
       sources."vscode-test-1.5.2"
       sources."which-2.0.2"
       (sources."wide-align-1.1.3" // {
@@ -104767,16 +105220,16 @@ in
   sass = nodeEnv.buildNodePackage {
     name = "sass";
     packageName = "sass";
-    version = "1.34.1";
+    version = "1.35.1";
     src = fetchurl {
-      url = "https://registry.npmjs.org/sass/-/sass-1.34.1.tgz";
-      sha512 = "scLA7EIZM+MmYlej6sdVr0HRbZX5caX5ofDT9asWnUJj21oqgsC+1LuNfm0eg+vM0fCTZHhwImTiCU0sx9h9CQ==";
+      url = "https://registry.npmjs.org/sass/-/sass-1.35.1.tgz";
+      sha512 = "oCisuQJstxMcacOPmxLNiLlj4cUyN2+8xJnG7VanRoh2GOLr9RqkvI4AxA4a6LHVg/rsu+PmxXeGhrdSF9jCiQ==";
     };
     dependencies = [
       sources."anymatch-3.1.2"
       sources."binary-extensions-2.2.0"
       sources."braces-3.0.2"
-      sources."chokidar-3.5.1"
+      sources."chokidar-3.5.2"
       sources."fill-range-7.0.1"
       sources."fsevents-2.3.2"
       sources."glob-parent-5.1.2"
@@ -104786,7 +105239,7 @@ in
       sources."is-number-7.0.0"
       sources."normalize-path-3.0.0"
       sources."picomatch-2.3.0"
-      sources."readdirp-3.5.0"
+      sources."readdirp-3.6.0"
       sources."to-regex-range-5.0.1"
     ];
     buildInputs = globalBuildInputs;
@@ -104940,10 +105393,10 @@ in
   serverless = nodeEnv.buildNodePackage {
     name = "serverless";
     packageName = "serverless";
-    version = "2.46.0";
+    version = "2.48.0";
     src = fetchurl {
-      url = "https://registry.npmjs.org/serverless/-/serverless-2.46.0.tgz";
-      sha512 = "InHN7TTMezGrxejFKCtTKaUGbpbWoXVltLITgXoKdCkqUg66DkAwvf3kkTTy8/wKnTxYIdBbqNS5n1NHvzo4wg==";
+      url = "https://registry.npmjs.org/serverless/-/serverless-2.48.0.tgz";
+      sha512 = "1CGCKr+7226psdyuGYFC54khCMUUBlLt2QPEAZtY00ZHMy8yOxvjMXAdfHAVnCdo+YH419MW3jFJhGuwVUsDyw==";
     };
     dependencies = [
       sources."2-thenable-1.0.0"
@@ -105004,7 +105457,7 @@ in
           sources."semver-6.3.0"
         ];
       })
-      sources."@serverless/dashboard-plugin-5.3.0"
+      sources."@serverless/dashboard-plugin-5.4.1"
       sources."@serverless/event-mocks-1.1.1"
       (sources."@serverless/platform-client-4.2.3" // {
         dependencies = [
@@ -105019,21 +105472,21 @@ in
         ];
       })
       sources."@serverless/template-1.1.4"
-      (sources."@serverless/utils-5.2.0" // {
+      (sources."@serverless/utils-5.3.0" // {
         dependencies = [
           sources."get-stream-6.0.1"
           sources."jwt-decode-3.1.2"
           sources."write-file-atomic-3.0.3"
         ];
       })
-      sources."@serverless/utils-china-1.1.1"
+      sources."@serverless/utils-china-1.1.2"
       sources."@sindresorhus/is-0.14.0"
       sources."@szmarczak/http-timer-1.1.2"
       sources."@tencent-sdk/capi-1.1.8"
       sources."@tencent-sdk/cls-0.2.1"
       (sources."@tencent-sdk/common-0.1.0" // {
         dependencies = [
-          sources."type-fest-1.2.0"
+          sources."type-fest-1.2.1"
         ];
       })
       sources."@tencent-sdk/faas-0.1.5"
@@ -105045,7 +105498,7 @@ in
       sources."@types/keyv-3.1.1"
       sources."@types/lodash-4.14.170"
       sources."@types/long-4.0.1"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."@types/readable-stream-2.3.10"
       sources."@types/request-2.48.5"
       sources."@types/request-promise-native-1.0.17"
@@ -105107,7 +105560,7 @@ in
       sources."async-2.6.3"
       sources."asynckit-0.4.0"
       sources."at-least-node-1.0.0"
-      (sources."aws-sdk-2.927.0" // {
+      (sources."aws-sdk-2.932.0" // {
         dependencies = [
           sources."buffer-4.9.2"
           sources."ieee754-1.1.13"
@@ -105187,7 +105640,7 @@ in
       })
       sources."chardet-0.7.0"
       sources."child-process-ext-2.1.1"
-      sources."chokidar-3.5.1"
+      sources."chokidar-3.5.2"
       sources."chownr-1.1.4"
       sources."ci-info-3.2.0"
       sources."cli-boxes-2.2.1"
@@ -105290,6 +105743,7 @@ in
       (sources."engine.io-client-3.5.2" // {
         dependencies = [
           sources."debug-3.1.0"
+          sources."ws-7.4.6"
         ];
       })
       sources."engine.io-parser-2.2.1"
@@ -105362,7 +105816,7 @@ in
       sources."github-from-package-0.0.0"
       sources."glob-7.1.7"
       sources."glob-parent-5.1.2"
-      sources."globby-11.0.3"
+      sources."globby-11.0.4"
       (sources."got-11.8.2" // {
         dependencies = [
           sources."@sindresorhus/is-4.0.1"
@@ -105418,7 +105872,7 @@ in
           sources."strip-ansi-6.0.0"
         ];
       })
-      sources."inquirer-autocomplete-prompt-1.3.0"
+      sources."inquirer-autocomplete-prompt-1.4.0"
       sources."is-arrayish-0.3.2"
       sources."is-binary-path-2.1.0"
       sources."is-docker-2.2.1"
@@ -105608,7 +106062,7 @@ in
       sources."readable-stream-3.6.0"
       sources."readable-web-to-node-stream-3.0.1"
       sources."readdir-glob-1.1.1"
-      sources."readdirp-3.5.0"
+      sources."readdirp-3.6.0"
       sources."registry-auth-token-4.2.1"
       sources."registry-url-5.1.0"
       sources."replaceall-0.1.6"
@@ -105642,7 +106096,7 @@ in
       sources."signal-exit-3.0.3"
       sources."simple-concat-1.0.1"
       sources."simple-get-2.8.1"
-      (sources."simple-git-2.39.1" // {
+      (sources."simple-git-2.40.0" // {
         dependencies = [
           sources."debug-4.3.2"
           sources."ms-2.1.2"
@@ -105803,7 +106257,7 @@ in
       })
       sources."wrappy-1.0.2"
       sources."write-file-atomic-2.4.3"
-      sources."ws-7.4.6"
+      sources."ws-7.5.0"
       sources."xml2js-0.4.19"
       sources."xmlbuilder-9.0.7"
       sources."xmlhttprequest-ssl-1.6.3"
@@ -106452,10 +106906,10 @@ in
   snyk = nodeEnv.buildNodePackage {
     name = "snyk";
     packageName = "snyk";
-    version = "1.630.0";
+    version = "1.639.0";
     src = fetchurl {
-      url = "https://registry.npmjs.org/snyk/-/snyk-1.630.0.tgz";
-      sha512 = "66JBqGFciNAE7ZcxAhvsKCCYDYgkATlH2u9Ro34cGYsj2ak7rawylYyzowdT8cBe390kK7H4eyxHwwYAKXHpqQ==";
+      url = "https://registry.npmjs.org/snyk/-/snyk-1.639.0.tgz";
+      sha512 = "kGmk2T9DoxxGrLDJX0PvXp0ktR0rb1PE5kD6mAsafqhvzfGbNCUJTtPPD/Wy/pbf5jAjHryFYX/KRW9bMXIFGQ==";
     };
     dependencies = [
       sources."@arcanis/slice-ansi-1.0.2"
@@ -106466,25 +106920,31 @@ in
       sources."@octetstream/promisify-2.0.2"
       sources."@open-policy-agent/opa-wasm-1.2.0"
       sources."@sindresorhus/is-4.0.1"
+      sources."@snyk/child-process-0.3.1"
       sources."@snyk/cli-interface-2.11.0"
       sources."@snyk/cloud-config-parser-1.9.2"
       sources."@snyk/cocoapods-lockfile-parser-3.6.2"
-      sources."@snyk/code-client-3.8.1"
+      sources."@snyk/code-client-3.9.0"
       sources."@snyk/composer-lockfile-parser-1.4.1"
       (sources."@snyk/dep-graph-1.28.0" // {
         dependencies = [
           sources."semver-7.3.5"
         ];
       })
-      sources."@snyk/docker-registry-v2-client-2.2.1"
+      sources."@snyk/docker-registry-v2-client-2.2.2"
       sources."@snyk/fast-glob-3.2.6-patch"
-      (sources."@snyk/fix-1.620.0" // {
+      (sources."@snyk/fix-1.634.0" // {
         dependencies = [
-          sources."chalk-4.1.0"
+          sources."chalk-4.1.1"
           sources."strip-ansi-6.0.0"
         ];
       })
-      (sources."@snyk/fix-pipenv-pipfile-0.4.3" // {
+      (sources."@snyk/fix-pipenv-pipfile-0.5.3" // {
+        dependencies = [
+          sources."debug-4.3.1"
+        ];
+      })
+      (sources."@snyk/fix-poetry-0.7.0" // {
         dependencies = [
           sources."debug-4.3.1"
         ];
@@ -106655,7 +107115,7 @@ in
       sources."color-name-1.1.4"
       sources."concat-map-0.0.1"
       sources."configstore-5.0.1"
-      sources."core-js-3.14.0"
+      sources."core-js-3.15.0"
       sources."core-util-is-1.0.2"
       (sources."cross-spawn-6.0.5" // {
         dependencies = [
@@ -106729,7 +107189,7 @@ in
       })
       sources."global-dirs-3.0.0"
       sources."globalthis-1.0.2"
-      sources."globby-11.0.3"
+      sources."globby-11.0.4"
       sources."got-11.8.2"
       sources."graceful-fs-4.2.6"
       sources."grapheme-splitter-1.0.4"
@@ -107197,7 +107657,7 @@ in
       sources."@types/component-emitter-1.2.10"
       sources."@types/cookie-0.4.0"
       sources."@types/cors-2.8.10"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."accepts-1.3.7"
       sources."base64-arraybuffer-0.1.4"
       sources."base64id-2.0.0"
@@ -107434,7 +107894,7 @@ in
       sources."array-unique-0.2.1"
       sources."arrify-1.0.1"
       sources."assign-symbols-1.0.0"
-      (sources."async-append-only-log-3.0.8" // {
+      (sources."async-append-only-log-3.0.9" // {
         dependencies = [
           sources."push-stream-11.0.1"
         ];
@@ -107935,7 +108395,7 @@ in
       sources."posix-character-classes-0.1.1"
       sources."preserve-0.2.0"
       sources."prettier-2.3.1"
-      (sources."pretty-quick-3.1.0" // {
+      (sources."pretty-quick-3.1.1" // {
         dependencies = [
           sources."ansi-styles-4.3.0"
           sources."chalk-3.0.0"
@@ -108197,7 +108657,7 @@ in
       sources."ssb-client-4.9.0"
       sources."ssb-config-3.4.5"
       sources."ssb-db-19.2.0"
-      (sources."ssb-db2-2.1.2" // {
+      (sources."ssb-db2-2.1.3" // {
         dependencies = [
           sources."abstract-leveldown-6.2.3"
           (sources."flumecodec-0.0.1" // {
@@ -108363,7 +108823,7 @@ in
       sources."word-wrap-1.2.3"
       sources."wrap-fn-0.1.5"
       sources."wrappy-1.0.2"
-      sources."ws-7.4.6"
+      sources."ws-7.5.0"
       sources."xtend-4.0.2"
       sources."zerr-1.0.4"
     ];
@@ -108463,7 +108923,7 @@ in
       sources."async-1.5.2"
       sources."async-limiter-1.0.1"
       sources."asynckit-0.4.0"
-      (sources."aws-sdk-2.927.0" // {
+      (sources."aws-sdk-2.932.0" // {
         dependencies = [
           sources."uuid-3.3.2"
         ];
@@ -109242,7 +109702,7 @@ in
     dependencies = [
       sources."@babel/code-frame-7.14.5"
       sources."@babel/compat-data-7.14.5"
-      sources."@babel/core-7.14.5"
+      sources."@babel/core-7.14.6"
       sources."@babel/generator-7.14.5"
       sources."@babel/helper-compilation-targets-7.14.5"
       sources."@babel/helper-function-name-7.14.5"
@@ -109257,13 +109717,13 @@ in
       sources."@babel/helper-split-export-declaration-7.14.5"
       sources."@babel/helper-validator-identifier-7.14.5"
       sources."@babel/helper-validator-option-7.14.5"
-      sources."@babel/helpers-7.14.5"
+      sources."@babel/helpers-7.14.6"
       (sources."@babel/highlight-7.14.5" // {
         dependencies = [
           sources."chalk-2.4.2"
         ];
       })
-      sources."@babel/parser-7.14.5"
+      sources."@babel/parser-7.14.6"
       sources."@babel/template-7.14.5"
       sources."@babel/traverse-7.14.5"
       sources."@babel/types-7.14.5"
@@ -109296,7 +109756,7 @@ in
       sources."callsites-3.1.0"
       sources."camelcase-5.3.1"
       sources."camelcase-keys-6.2.2"
-      sources."caniuse-lite-1.0.30001237"
+      sources."caniuse-lite-1.0.30001239"
       (sources."chalk-4.1.1" // {
         dependencies = [
           sources."ansi-styles-4.3.0"
@@ -109314,7 +109774,7 @@ in
       sources."color-name-1.1.3"
       sources."colorette-1.2.2"
       sources."concat-map-0.0.1"
-      sources."convert-source-map-1.7.0"
+      sources."convert-source-map-1.8.0"
       sources."cosmiconfig-7.0.0"
       sources."cssesc-3.0.0"
       sources."debug-4.3.2"
@@ -109360,7 +109820,7 @@ in
       sources."global-modules-2.0.0"
       sources."global-prefix-3.0.0"
       sources."globals-11.12.0"
-      sources."globby-11.0.3"
+      sources."globby-11.0.4"
       sources."globjoin-0.1.4"
       sources."gonzales-pe-4.3.0"
       sources."hard-rejection-2.1.0"
@@ -109551,7 +110011,7 @@ in
       sources."write-file-atomic-3.0.3"
       sources."yallist-4.0.0"
       sources."yaml-1.10.2"
-      sources."yargs-parser-20.2.7"
+      sources."yargs-parser-20.2.9"
       sources."zwitch-1.0.5"
     ];
     buildInputs = globalBuildInputs;
@@ -109567,16 +110027,16 @@ in
   svelte-language-server = nodeEnv.buildNodePackage {
     name = "svelte-language-server";
     packageName = "svelte-language-server";
-    version = "0.14.1";
+    version = "0.14.2";
     src = fetchurl {
-      url = "https://registry.npmjs.org/svelte-language-server/-/svelte-language-server-0.14.1.tgz";
-      sha512 = "E9gpfM+G6dC+hq5gIytJ3phvdir/k1TcG3XYW0Bixs4xZNhf/z9trtZR/Rxs6BwVGAS64lCprSO4a+yUZKHQ/Q==";
+      url = "https://registry.npmjs.org/svelte-language-server/-/svelte-language-server-0.14.2.tgz";
+      sha512 = "cBKcjcvFEDml6CGrJeRqVS+qvbZNZEOoww0bW4HnLy/wV4cSXTG9yHsGhOZpPrWcCQ0F2oqiDE87K/h9gpSFCQ==";
     };
     dependencies = [
       sources."@emmetio/abbreviation-2.2.2"
       sources."@emmetio/css-abbreviation-2.1.4"
       sources."@emmetio/scanner-1.0.0"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."@types/pug-2.0.4"
       sources."@types/sass-1.16.0"
       sources."anymatch-3.1.2"
@@ -109584,7 +110044,7 @@ in
       sources."binary-extensions-2.2.0"
       sources."brace-expansion-1.1.11"
       sources."braces-3.0.2"
-      sources."chokidar-3.5.1"
+      sources."chokidar-3.5.2"
       sources."concat-map-0.0.1"
       sources."dedent-js-1.0.1"
       sources."detect-indent-6.1.0"
@@ -109613,16 +110073,16 @@ in
       sources."path-is-absolute-1.0.1"
       sources."picomatch-2.3.0"
       sources."prettier-2.3.0"
-      sources."prettier-plugin-svelte-2.3.0"
-      sources."readdirp-3.5.0"
+      sources."prettier-plugin-svelte-2.3.1"
+      sources."readdirp-3.6.0"
       sources."source-map-0.7.3"
       sources."strip-indent-3.0.0"
       sources."svelte-3.38.2"
       sources."svelte-preprocess-4.7.3"
-      sources."svelte2tsx-0.2.1"
+      sources."svelte2tsx-0.3.0"
       sources."to-regex-range-5.0.1"
       sources."tslib-2.3.0"
-      sources."typescript-4.3.2"
+      sources."typescript-4.3.4"
       sources."vscode-css-languageservice-5.0.0"
       sources."vscode-emmet-helper-2.1.2"
       sources."vscode-html-languageservice-4.0.0"
@@ -111700,7 +112160,7 @@ in
       sources."@types/debug-4.1.5"
       sources."@types/http-cache-semantics-4.0.0"
       sources."@types/keyv-3.1.1"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."@types/responselike-1.0.0"
       sources."abbrev-1.1.1"
       sources."abstract-logging-2.0.1"
@@ -111776,7 +112236,7 @@ in
       sources."content-type-1.0.4"
       sources."cookie-0.4.0"
       sources."cookie-signature-1.0.6"
-      sources."core-js-3.14.0"
+      sources."core-js-3.15.0"
       sources."core-util-is-1.0.2"
       sources."css-select-1.2.0"
       sources."css-what-2.1.3"
@@ -112116,7 +112576,7 @@ in
       sources."wide-align-1.1.3"
       sources."with-open-file-0.1.7"
       sources."wrappy-1.0.2"
-      sources."ws-7.4.6"
+      sources."ws-7.5.0"
       sources."xmlhttprequest-ssl-1.5.5"
       sources."yallist-3.1.1"
       sources."yarn-1.22.4"
@@ -112564,10 +113024,10 @@ in
   typescript = nodeEnv.buildNodePackage {
     name = "typescript";
     packageName = "typescript";
-    version = "4.3.2";
+    version = "4.3.4";
     src = fetchurl {
-      url = "https://registry.npmjs.org/typescript/-/typescript-4.3.2.tgz";
-      sha512 = "zZ4hShnmnoVnAHpVHWpTcxdv7dWP60S2FsydQLV8V5PbS3FifjWFFRiHSWpDJahly88PRyV5teTSLoq4eG7mKw==";
+      url = "https://registry.npmjs.org/typescript/-/typescript-4.3.4.tgz";
+      sha512 = "uauPG7XZn9F/mo+7MrsRjyvbxFpzemRjKEZXS4AK83oP2KKOJPvb+9cO/gmnv8arWZvhnjVOXz7B49m1l0e9Ew==";
     };
     buildInputs = globalBuildInputs;
     meta = {
@@ -112928,7 +113388,7 @@ in
       sources."y18n-5.0.8"
       sources."yallist-2.1.2"
       sources."yargs-17.0.1"
-      sources."yargs-parser-20.2.7"
+      sources."yargs-parser-20.2.9"
     ];
     buildInputs = globalBuildInputs;
     meta = {
@@ -113106,7 +113566,7 @@ in
           sources."strip-ansi-6.0.0"
         ];
       })
-      sources."yargs-parser-20.2.7"
+      sources."yargs-parser-20.2.9"
     ];
     buildInputs = globalBuildInputs;
     meta = {
@@ -113153,7 +113613,7 @@ in
       sources."wrap-ansi-7.0.0"
       sources."y18n-5.0.8"
       sources."yargs-16.2.0"
-      sources."yargs-parser-20.2.7"
+      sources."yargs-parser-20.2.9"
     ];
     buildInputs = globalBuildInputs;
     meta = {
@@ -113234,8 +113694,8 @@ in
       sources."emoji-regex-8.0.0"
       sources."enquirer-2.3.6"
       sources."escape-string-regexp-4.0.0"
-      sources."eslint-7.28.0"
-      sources."eslint-plugin-vue-7.11.0"
+      sources."eslint-7.29.0"
+      sources."eslint-plugin-vue-7.11.1"
       sources."eslint-scope-5.1.1"
       (sources."eslint-utils-2.1.0" // {
         dependencies = [
@@ -113310,7 +113770,7 @@ in
       sources."prettier-2.3.1"
       sources."progress-2.0.3"
       sources."punycode-2.1.1"
-      sources."regexpp-3.1.0"
+      sources."regexpp-3.2.0"
       sources."require-from-string-2.0.2"
       sources."resolve-1.20.0"
       sources."resolve-from-4.0.0"
@@ -113348,7 +113808,7 @@ in
       sources."tsutils-2.29.0"
       sources."type-check-0.4.0"
       sources."type-fest-0.20.2"
-      sources."typescript-4.3.2"
+      sources."typescript-4.3.4"
       sources."uri-js-4.4.1"
       sources."v8-compile-cache-2.3.0"
       (sources."vue-eslint-parser-7.6.0" // {
@@ -113590,7 +114050,7 @@ in
       sources."buffer-from-1.1.1"
       sources."call-bind-1.0.2"
       sources."camelcase-6.2.0"
-      sources."caniuse-lite-1.0.30001237"
+      sources."caniuse-lite-1.0.30001239"
       (sources."chalk-4.1.1" // {
         dependencies = [
           sources."supports-color-7.2.0"
@@ -113637,7 +114097,7 @@ in
       sources."entities-2.2.0"
       sources."envinfo-7.8.1"
       sources."errno-0.1.8"
-      sources."es-module-lexer-0.4.1"
+      sources."es-module-lexer-0.6.0"
       sources."escalade-3.1.1"
       sources."escape-string-regexp-4.0.0"
       sources."eslint-scope-5.1.1"
@@ -113815,7 +114275,7 @@ in
       sources."tslib-2.3.0"
       sources."tunnel-0.0.6"
       sources."typed-rest-client-1.8.4"
-      sources."typescript-4.3.2"
+      sources."typescript-4.3.4"
       sources."uc.micro-1.0.6"
       sources."underscore-1.13.1"
       sources."uri-js-4.4.1"
@@ -113836,7 +114296,7 @@ in
       sources."vscode-debugadapter-testsupport-1.47.0"
       sources."vscode-debugprotocol-1.47.0"
       sources."watchpack-2.2.0"
-      sources."webpack-5.38.1"
+      sources."webpack-5.40.0"
       (sources."webpack-cli-4.7.2" // {
         dependencies = [
           sources."commander-7.2.0"
@@ -114193,7 +114653,7 @@ in
       sources."@starptech/rehype-webparser-0.10.0"
       sources."@starptech/webparser-0.10.0"
       sources."@szmarczak/http-timer-1.1.2"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."@types/unist-2.0.3"
       sources."@types/vfile-3.0.2"
       sources."@types/vfile-message-2.0.0"
@@ -114576,11 +115036,7 @@ in
       sources."isarray-1.0.0"
       sources."isexe-2.0.0"
       sources."isobject-3.0.1"
-      (sources."js-beautify-1.13.13" // {
-        dependencies = [
-          sources."mkdirp-1.0.4"
-        ];
-      })
+      sources."js-beautify-1.14.0"
       sources."js-tokens-4.0.0"
       sources."js-yaml-3.14.1"
       sources."json-buffer-3.0.0"
@@ -114967,7 +115423,7 @@ in
       sources."type-check-0.3.2"
       sources."type-fest-0.3.1"
       sources."typedarray-0.0.6"
-      sources."typescript-3.9.9"
+      sources."typescript-3.9.10"
       (sources."typescript-eslint-parser-16.0.1" // {
         dependencies = [
           sources."semver-5.5.0"
@@ -115116,7 +115572,7 @@ in
       sha512 = "uhSNGU27KDT2e2v51l/NqMc59O7X0DG7CHonZOwsnvMHLvyudCLZgXCU8Rw4T8gpqg2asn50vfPHq7l3DGlN5w==";
     };
     dependencies = [
-      sources."@babel/runtime-corejs3-7.14.5"
+      sources."@babel/runtime-corejs3-7.14.6"
       sources."@mapbox/node-pre-gyp-1.0.5"
       sources."@tootallnate/once-1.1.2"
       sources."@types/raf-3.4.0"
@@ -115138,7 +115594,7 @@ in
       sources."at-least-node-1.0.0"
       sources."atob-2.1.2"
       sources."balanced-match-1.0.2"
-      (sources."bit-field-1.4.0" // {
+      (sources."bit-field-1.5.1" // {
         dependencies = [
           sources."ansi-regex-5.0.0"
           sources."fs-extra-10.0.0"
@@ -115168,7 +115624,7 @@ in
       sources."combined-stream-1.0.8"
       sources."concat-map-0.0.1"
       sources."console-control-strings-1.1.0"
-      sources."core-js-pure-3.14.0"
+      sources."core-js-pure-3.15.0"
       sources."core-util-is-1.0.2"
       sources."cssom-0.4.4"
       (sources."cssstyle-2.3.0" // {
@@ -115288,7 +115744,7 @@ in
       sources."util-deprecate-1.0.2"
       sources."w3c-hr-time-1.0.2"
       sources."w3c-xmlserializer-2.0.0"
-      sources."wavedrom-2.7.0"
+      sources."wavedrom-2.8.1"
       sources."webidl-conversions-6.1.0"
       sources."whatwg-encoding-1.0.5"
       sources."whatwg-mimetype-2.3.0"
@@ -115304,7 +115760,7 @@ in
         ];
       })
       sources."wrappy-1.0.2"
-      sources."ws-7.4.6"
+      sources."ws-7.5.0"
       sources."xml-name-validator-3.0.0"
       sources."xmlchars-2.2.0"
       sources."y18n-5.0.8"
@@ -115317,7 +115773,7 @@ in
           sources."strip-ansi-6.0.0"
         ];
       })
-      sources."yargs-parser-20.2.7"
+      sources."yargs-parser-20.2.9"
     ];
     buildInputs = globalBuildInputs;
     meta = {
@@ -115332,10 +115788,10 @@ in
   web-ext = nodeEnv.buildNodePackage {
     name = "web-ext";
     packageName = "web-ext";
-    version = "6.1.0";
+    version = "6.2.0";
     src = fetchurl {
-      url = "https://registry.npmjs.org/web-ext/-/web-ext-6.1.0.tgz";
-      sha512 = "f9sBuysFoCJAuS03wRtSBH8dPKQUZvCVT+AoqBW3tBBN6a92P0PyGF2lTwZJ5wrOOvXu7w2DvuAFOU6CnBugFw==";
+      url = "https://registry.npmjs.org/web-ext/-/web-ext-6.2.0.tgz";
+      sha512 = "vibPf31/5NajygV85b6PSki2gZwOK0lQYfC2q30VdEHeS1d4hJU39mnDXM0D2nM6t7REYR8xRNgmTiDcsHCS8A==";
     };
     dependencies = [
       sources."@babel/code-frame-7.12.11"
@@ -115346,6 +115802,7 @@ in
           sources."chalk-2.4.2"
           sources."color-convert-1.9.3"
           sources."color-name-1.1.3"
+          sources."escape-string-regexp-1.0.5"
           sources."has-flag-3.0.0"
           sources."supports-color-5.5.0"
         ];
@@ -115360,16 +115817,20 @@ in
           sources."ms-2.1.2"
         ];
       })
-      sources."@mdn/browser-compat-data-3.2.4"
+      sources."@mdn/browser-compat-data-3.3.7"
       sources."@sindresorhus/is-0.14.0"
       sources."@szmarczak/http-timer-1.1.2"
       sources."@types/minimatch-3.0.4"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."@types/yauzl-2.9.1"
       sources."acorn-7.4.1"
       sources."acorn-jsx-5.3.1"
-      sources."addons-linter-3.2.0"
-      sources."addons-scanner-utils-4.4.0"
+      (sources."addons-linter-3.8.0" // {
+        dependencies = [
+          sources."yargs-17.0.1"
+        ];
+      })
+      sources."addons-scanner-utils-4.8.0"
       sources."adm-zip-0.5.5"
       sources."ajv-6.12.6"
       sources."ajv-merge-patch-4.1.0"
@@ -115421,14 +115882,10 @@ in
       sources."callsites-3.1.0"
       sources."camelcase-6.2.0"
       sources."caseless-0.12.0"
-      sources."chalk-4.1.0"
-      sources."cheerio-1.0.0-rc.6"
+      sources."chalk-4.1.1"
+      sources."cheerio-1.0.0-rc.10"
       sources."cheerio-select-1.5.0"
-      (sources."chrome-launcher-0.13.4" // {
-        dependencies = [
-          sources."mkdirp-0.5.5"
-        ];
-      })
+      sources."chrome-launcher-0.14.0"
       sources."ci-info-2.0.0"
       sources."cli-boxes-2.2.1"
       (sources."cliui-7.0.4" // {
@@ -115449,7 +115906,7 @@ in
       sources."concat-map-0.0.1"
       sources."concat-stream-1.6.2"
       sources."configstore-5.0.1"
-      sources."core-js-3.8.3"
+      sources."core-js-3.12.0"
       sources."core-util-is-1.0.2"
       sources."cross-spawn-7.0.3"
       sources."crypto-random-string-2.0.0"
@@ -115493,8 +115950,8 @@ in
       sources."es6-promisify-6.1.1"
       sources."escalade-3.1.1"
       sources."escape-goat-2.1.1"
-      sources."escape-string-regexp-1.0.5"
-      (sources."eslint-7.24.0" // {
+      sources."escape-string-regexp-4.0.0"
+      (sources."eslint-7.28.0" // {
         dependencies = [
           sources."ansi-regex-5.0.0"
           sources."debug-4.3.2"
@@ -115502,14 +115959,14 @@ in
           sources."strip-ansi-6.0.0"
         ];
       })
-      sources."eslint-plugin-no-unsanitized-3.1.4"
+      sources."eslint-plugin-no-unsanitized-3.1.5"
       sources."eslint-scope-5.1.1"
       (sources."eslint-utils-2.1.0" // {
         dependencies = [
           sources."eslint-visitor-keys-1.3.0"
         ];
       })
-      sources."eslint-visitor-keys-2.0.0"
+      sources."eslint-visitor-keys-2.1.0"
       (sources."espree-7.3.1" // {
         dependencies = [
           sources."eslint-visitor-keys-1.3.0"
@@ -115575,7 +116032,7 @@ in
       sources."get-intrinsic-1.1.1"
       sources."get-stream-5.2.0"
       sources."getpass-0.1.7"
-      sources."glob-7.1.6"
+      sources."glob-7.1.7"
       sources."glob-parent-5.1.2"
       sources."glob-to-regexp-0.4.1"
       sources."global-dirs-3.0.0"
@@ -115599,7 +116056,7 @@ in
       sources."http-signature-1.2.0"
       sources."human-signals-1.1.1"
       sources."ignore-4.0.6"
-      sources."image-size-0.9.7"
+      sources."image-size-1.0.0"
       sources."immediate-3.0.6"
       sources."import-fresh-3.3.0"
       sources."import-lazy-2.1.0"
@@ -115666,7 +116123,6 @@ in
       sources."lie-3.3.0"
       sources."lighthouse-logger-1.2.0"
       sources."lines-and-columns-1.1.6"
-      sources."lodash-4.17.21"
       sources."lodash.clonedeep-4.5.0"
       sources."lodash.includes-4.3.0"
       sources."lodash.isboolean-3.0.3"
@@ -115674,6 +116130,7 @@ in
       sources."lodash.isnumber-3.0.3"
       sources."lodash.isplainobject-4.0.6"
       sources."lodash.isstring-4.0.1"
+      sources."lodash.merge-4.6.2"
       sources."lodash.once-4.1.1"
       sources."lodash.truncate-4.4.2"
       sources."lowercase-keys-1.0.1"
@@ -115746,9 +116203,9 @@ in
       sources."path-key-3.1.1"
       sources."pend-1.2.0"
       sources."performance-now-2.1.0"
-      sources."pino-6.11.2"
+      sources."pino-6.11.3"
       sources."pino-std-serializers-3.2.0"
-      sources."postcss-8.2.10"
+      sources."postcss-8.3.4"
       sources."prelude-ls-1.2.1"
       sources."prepend-http-2.0.0"
       sources."process-nextick-args-2.0.1"
@@ -115759,7 +116216,7 @@ in
       sources."pupa-2.1.1"
       sources."qs-6.5.2"
       sources."queue-6.0.2"
-      sources."quick-format-unescaped-4.0.1"
+      sources."quick-format-unescaped-4.0.3"
       (sources."rc-1.2.8" // {
         dependencies = [
           sources."ini-1.3.8"
@@ -115773,7 +116230,7 @@ in
       })
       sources."regenerator-runtime-0.13.8"
       sources."regexp.prototype.flags-1.3.1"
-      sources."regexpp-3.1.0"
+      sources."regexpp-3.2.0"
       sources."registry-auth-token-4.2.1"
       sources."registry-url-5.1.0"
       (sources."relaxed-json-1.0.3" // {
@@ -115782,6 +116239,7 @@ in
           sources."chalk-2.4.2"
           sources."color-convert-1.9.3"
           sources."color-name-1.1.3"
+          sources."escape-string-regexp-1.0.5"
           sources."has-flag-3.0.0"
           sources."supports-color-5.5.0"
         ];
@@ -115808,11 +116266,12 @@ in
       sources."shebang-regex-3.0.0"
       sources."shell-quote-1.6.1"
       sources."shellwords-0.1.1"
-      sources."sign-addon-3.3.0"
+      sources."sign-addon-3.5.0"
       sources."signal-exit-3.0.3"
       sources."slice-ansi-4.0.0"
       sources."sonic-boom-1.4.1"
       sources."source-map-0.6.1"
+      sources."source-map-js-0.6.2"
       sources."source-map-support-0.5.19"
       sources."spawn-sync-1.0.15"
       sources."split-0.3.3"
@@ -115854,6 +116313,7 @@ in
       sources."to-readable-stream-1.0.0"
       sources."tosource-1.0.0"
       sources."tough-cookie-2.5.0"
+      sources."tslib-2.3.0"
       sources."tunnel-agent-0.6.0"
       sources."tweetnacl-0.14.5"
       sources."type-check-0.4.0"
@@ -115886,14 +116346,14 @@ in
       })
       sources."wrappy-1.0.2"
       sources."write-file-atomic-3.0.3"
-      sources."ws-7.4.3"
+      sources."ws-7.4.6"
       sources."xdg-basedir-4.0.0"
       sources."xml2js-0.4.23"
       sources."xmlbuilder-11.0.1"
       sources."y18n-5.0.8"
       sources."yallist-4.0.0"
       sources."yargs-16.2.0"
-      sources."yargs-parser-20.2.7"
+      sources."yargs-parser-20.2.9"
       sources."yauzl-2.10.0"
       (sources."zip-dir-2.0.0" // {
         dependencies = [
@@ -115914,17 +116374,17 @@ in
   webpack = nodeEnv.buildNodePackage {
     name = "webpack";
     packageName = "webpack";
-    version = "5.38.1";
+    version = "5.40.0";
     src = fetchurl {
-      url = "https://registry.npmjs.org/webpack/-/webpack-5.38.1.tgz";
-      sha512 = "OqRmYD1OJbHZph6RUMD93GcCZy4Z4wC0ele4FXyYF0J6AxO1vOSuIlU1hkS/lDlR9CDYBz64MZRmdbdnFFoT2g==";
+      url = "https://registry.npmjs.org/webpack/-/webpack-5.40.0.tgz";
+      sha512 = "c7f5e/WWrxXWUzQqTBg54vBs5RgcAgpvKE4F4VegVgfo4x660ZxYUF2/hpMkZUnLjgytVTitjeXaN4IPlXCGIw==";
     };
     dependencies = [
       sources."@types/eslint-7.2.13"
       sources."@types/eslint-scope-3.7.0"
       sources."@types/estree-0.0.47"
       sources."@types/json-schema-7.0.7"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."@webassemblyjs/ast-1.11.0"
       sources."@webassemblyjs/floating-point-hex-parser-1.11.0"
       sources."@webassemblyjs/helper-api-error-1.11.0"
@@ -115947,13 +116407,13 @@ in
       sources."ajv-keywords-3.5.2"
       sources."browserslist-4.16.6"
       sources."buffer-from-1.1.1"
-      sources."caniuse-lite-1.0.30001237"
+      sources."caniuse-lite-1.0.30001239"
       sources."chrome-trace-event-1.0.3"
       sources."colorette-1.2.2"
       sources."commander-2.20.3"
       sources."electron-to-chromium-1.3.752"
       sources."enhanced-resolve-5.8.2"
-      sources."es-module-lexer-0.4.1"
+      sources."es-module-lexer-0.6.0"
       sources."escalade-3.1.1"
       sources."eslint-scope-5.1.1"
       (sources."esrecurse-4.3.0" // {
@@ -116089,7 +116549,7 @@ in
     dependencies = [
       sources."@types/glob-7.1.3"
       sources."@types/minimatch-3.0.4"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."accepts-1.3.7"
       sources."ajv-6.12.6"
       sources."ajv-errors-1.0.1"
@@ -116687,7 +117147,7 @@ in
       sources."fastq-1.11.0"
       sources."fill-range-7.0.1"
       sources."glob-parent-6.0.0"
-      sources."globby-11.0.3"
+      sources."globby-11.0.4"
       sources."ignore-5.1.8"
       sources."is-extglob-2.1.1"
       sources."is-glob-4.0.1"
@@ -116742,7 +117202,7 @@ in
       sources."@protobufjs/pool-1.1.0"
       sources."@protobufjs/utf8-1.1.0"
       sources."@types/long-4.0.1"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."addr-to-ip-port-1.5.1"
       sources."airplay-js-0.3.0"
       sources."balanced-match-1.0.2"
@@ -116764,13 +117224,13 @@ in
         ];
       })
       sources."bittorrent-peerid-1.3.3"
-      (sources."bittorrent-protocol-3.3.1" // {
+      (sources."bittorrent-protocol-3.4.1" // {
         dependencies = [
           sources."debug-4.3.2"
           sources."ms-2.1.2"
         ];
       })
-      (sources."bittorrent-tracker-9.17.0" // {
+      (sources."bittorrent-tracker-9.17.2" // {
         dependencies = [
           sources."debug-4.3.2"
           sources."decompress-response-6.0.0"
@@ -116790,6 +117250,7 @@ in
       sources."buffer-fill-1.0.0"
       sources."buffer-from-1.1.1"
       sources."buffer-indexof-1.1.1"
+      sources."buffer-xor-2.0.2"
       sources."bufferutil-4.0.3"
       (sources."castv2-0.1.10" // {
         dependencies = [
@@ -116802,7 +117263,7 @@ in
       sources."chrome-dgram-3.0.6"
       sources."chrome-dns-1.0.1"
       sources."chrome-net-3.3.4"
-      (sources."chromecasts-1.9.1" // {
+      (sources."chromecasts-1.10.0" // {
         dependencies = [
           sources."mime-1.6.0"
         ];
@@ -116830,7 +117291,7 @@ in
           sources."mime-1.6.0"
         ];
       })
-      sources."dns-packet-1.3.4"
+      sources."dns-packet-5.2.4"
       sources."dns-txt-2.0.2"
       sources."ecstatic-4.1.4"
       sources."ee-first-1.1.1"
@@ -116900,7 +117361,7 @@ in
       sources."mp4-box-encoding-1.4.1"
       sources."mp4-stream-3.1.3"
       sources."ms-2.0.0"
-      (sources."multicast-dns-6.2.3" // {
+      (sources."multicast-dns-7.2.3" // {
         dependencies = [
           sources."thunky-1.1.0"
         ];
@@ -116915,7 +117376,7 @@ in
       sources."nodebmc-0.0.7"
       sources."on-finished-2.3.0"
       sources."once-1.4.0"
-      sources."open-8.2.0"
+      sources."open-8.2.1"
       sources."package-json-versionify-1.0.4"
       (sources."parse-torrent-9.1.3" // {
         dependencies = [
@@ -116944,6 +117405,7 @@ in
       sources."randombytes-2.1.0"
       sources."range-parser-1.2.1"
       sources."range-slice-stream-2.0.0"
+      sources."rc4-0.1.5"
       sources."readable-stream-3.6.0"
       sources."record-cache-1.1.1"
       (sources."render-media-4.1.0" // {
@@ -117012,13 +117474,13 @@ in
           sources."ms-2.1.2"
         ];
       })
-      sources."ut_pex-3.0.0"
+      sources."ut_pex-3.0.1"
       sources."utf-8-validate-5.0.5"
       sources."util-deprecate-1.0.2"
-      sources."utp-native-2.5.0"
+      sources."utp-native-2.5.1"
       sources."videostream-3.2.2"
       sources."vlc-command-1.2.0"
-      (sources."webtorrent-1.0.0" // {
+      (sources."webtorrent-1.0.1" // {
         dependencies = [
           sources."debug-4.3.2"
           sources."decompress-response-6.0.0"
@@ -117029,7 +117491,7 @@ in
       })
       sources."winreg-1.2.4"
       sources."wrappy-1.0.2"
-      sources."ws-7.4.6"
+      sources."ws-7.5.0"
       sources."xml2js-0.4.23"
       sources."xmlbuilder-11.0.1"
       sources."xmldom-0.1.31"
@@ -117092,10 +117554,10 @@ in
   yaml-language-server = nodeEnv.buildNodePackage {
     name = "yaml-language-server";
     packageName = "yaml-language-server";
-    version = "0.19.2";
+    version = "0.20.0";
     src = fetchurl {
-      url = "https://registry.npmjs.org/yaml-language-server/-/yaml-language-server-0.19.2.tgz";
-      sha512 = "E4yMj1oK+OCObD15LvEaHOw8y3ux7G4KrREQDsDkjqFhUm/3qCCPMh3NPXTRQyse3r6Xpsv+lAW17Qo/NKm+0g==";
+      url = "https://registry.npmjs.org/yaml-language-server/-/yaml-language-server-0.20.0.tgz";
+      sha512 = "JV5jqB/1p2g4WCW1Gi6Kd3RQQSepdvTQBIDLSSoVzi7Q7kH+6tFkFJlMCBs0qmxLPkaU062d3IxdTWDK/MvvEA==";
     };
     dependencies = [
       sources."agent-base-4.3.0"
@@ -117165,16 +117627,16 @@ in
       sha512 = "dbHkO8dp4/KDsU5V7akSWVdWB+yyfadR0q3vGxRKXxg1umiYlFUrPuiu66Iy4IpRRr2Qrqx495kInkZJIJtqmA==";
     };
     dependencies = [
-      sources."@babel/runtime-7.14.5"
+      sources."@babel/runtime-7.14.6"
       sources."@nodelib/fs.scandir-2.1.5"
       sources."@nodelib/fs.stat-2.0.5"
       sources."@nodelib/fs.walk-1.2.7"
-      (sources."@npmcli/arborist-2.6.2" // {
+      (sources."@npmcli/arborist-2.6.3" // {
         dependencies = [
           sources."semver-7.3.5"
         ];
       })
-      (sources."@npmcli/git-2.0.9" // {
+      (sources."@npmcli/git-2.1.0" // {
         dependencies = [
           sources."mkdirp-1.0.4"
           sources."semver-7.3.5"
@@ -117201,7 +117663,7 @@ in
       sources."@tootallnate/once-1.1.2"
       sources."@types/expect-1.20.4"
       sources."@types/minimatch-3.0.4"
-      sources."@types/node-15.12.2"
+      sources."@types/node-15.12.4"
       sources."@types/vinyl-2.0.4"
       sources."abbrev-1.1.1"
       (sources."agent-base-6.0.2" // {
@@ -117322,7 +117784,7 @@ in
       sources."config-chain-1.1.13"
       sources."configstore-3.1.5"
       sources."console-control-strings-1.1.0"
-      sources."core-js-3.14.0"
+      sources."core-js-3.15.0"
       sources."core-util-is-1.0.2"
       sources."create-error-class-3.0.2"
       sources."cross-spawn-6.0.5"
@@ -117413,7 +117875,7 @@ in
       sources."global-dirs-0.1.1"
       sources."global-tunnel-ng-2.7.1"
       sources."globalthis-1.0.2"
-      sources."globby-11.0.3"
+      sources."globby-11.0.4"
       (sources."got-8.3.2" // {
         dependencies = [
           sources."get-stream-3.0.0"
@@ -117557,7 +118019,7 @@ in
       sources."lru-cache-6.0.0"
       sources."macos-release-2.5.0"
       sources."make-dir-1.3.0"
-      (sources."make-fetch-happen-9.0.2" // {
+      (sources."make-fetch-happen-9.0.3" // {
         dependencies = [
           sources."http-cache-semantics-4.1.0"
         ];
@@ -117642,7 +118104,7 @@ in
         ];
       })
       sources."npm-normalize-package-bin-1.0.1"
-      (sources."npm-package-arg-8.1.4" // {
+      (sources."npm-package-arg-8.1.5" // {
         dependencies = [
           sources."hosted-git-info-4.0.2"
           sources."semver-7.3.5"
@@ -117748,6 +118210,7 @@ in
       })
       sources."prepend-http-2.0.0"
       sources."pretty-bytes-5.6.0"
+      sources."proc-log-1.0.0"
       sources."process-nextick-args-2.0.1"
       sources."promise-all-reject-late-1.0.1"
       sources."promise-call-limit-1.0.1"
@@ -117838,7 +118301,7 @@ in
       sources."slash-3.0.0"
       sources."smart-buffer-4.1.0"
       sources."socks-2.6.1"
-      (sources."socks-proxy-agent-5.0.0" // {
+      (sources."socks-proxy-agent-5.0.1" // {
         dependencies = [
           sources."debug-4.3.2"
           sources."ms-2.1.2"
@@ -118034,7 +118497,7 @@ in
           })
           sources."get-stream-6.0.1"
           sources."has-flag-4.0.0"
-          sources."inquirer-8.1.0"
+          sources."inquirer-8.1.1"
           sources."is-fullwidth-code-point-3.0.0"
           sources."is-stream-2.0.0"
           sources."locate-path-6.0.0"

From af2d542fb5c985ede70bf4165bad92b49d26856f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <rschuetz17@gmail.com>
Date: Mon, 21 Jun 2021 20:24:44 +0200
Subject: [PATCH 348/416] Revert "use sqlalchemy 1.3.x for mautrix-telegram"

---
 .../python-modules/sqlalchemy/1.3.nix         | 45 -------------------
 .../sqlalchemy/{1.4.nix => default.nix}       |  0
 pkgs/servers/mautrix-telegram/default.nix     | 10 ++---
 pkgs/top-level/python-packages.nix            |  4 +-
 4 files changed, 4 insertions(+), 55 deletions(-)
 delete mode 100644 pkgs/development/python-modules/sqlalchemy/1.3.nix
 rename pkgs/development/python-modules/sqlalchemy/{1.4.nix => default.nix} (100%)

diff --git a/pkgs/development/python-modules/sqlalchemy/1.3.nix b/pkgs/development/python-modules/sqlalchemy/1.3.nix
deleted file mode 100644
index f0c9ce2bf736..000000000000
--- a/pkgs/development/python-modules/sqlalchemy/1.3.nix
+++ /dev/null
@@ -1,45 +0,0 @@
-{ stdenv, lib, fetchPypi, buildPythonPackage, isPy3k, isPy35, fetchpatch
-, mock
-, pysqlite ? null
-, pytestCheckHook
-, pytest_xdist
-}:
-
-buildPythonPackage rec {
-  pname = "SQLAlchemy";
-  version = "1.3.23";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "6fca33672578666f657c131552c4ef8979c1606e494f78cd5199742dfb26918b";
-  };
-
-  patches = [
-    # fix test_pyodbc_extra_connect_azure test failure
-    (fetchpatch {
-      url = "https://github.com/sqlalchemy/sqlalchemy/commit/7293b3dc0e9eb3dae84ffd831494b85355df8e73.patch";
-      sha256 = "1z61lzxamz74771ddlqmbxba1dcr77f016vqfcmb44dxb228w2db";
-    })
-  ];
-
-  checkInputs = [
-    pytestCheckHook
-    mock
-  ] ++ lib.optional (!isPy3k) pysqlite;
-
-  postInstall = ''
-    sed -e 's:--max-worker-restart=5::g' -i setup.cfg
-  '';
-
-  dontUseSetuptoolsCheck = true;
-
-  # disable mem-usage tests on mac, has trouble serializing pickle files
-  disabledTests = lib.optionals isPy35 [ "exception_persistent_flush_py3k "]
-    ++ lib.optionals stdenv.isDarwin [ "MemUsageWBackendTest" "MemUsageTest" ];
-
-  meta = with lib; {
-    homepage = "http://www.sqlalchemy.org/";
-    description = "A Python SQL toolkit and Object Relational Mapper";
-    license = licenses.mit;
-  };
-}
diff --git a/pkgs/development/python-modules/sqlalchemy/1.4.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
similarity index 100%
rename from pkgs/development/python-modules/sqlalchemy/1.4.nix
rename to pkgs/development/python-modules/sqlalchemy/default.nix
diff --git a/pkgs/servers/mautrix-telegram/default.nix b/pkgs/servers/mautrix-telegram/default.nix
index cc816ee793ea..bf00462875b2 100644
--- a/pkgs/servers/mautrix-telegram/default.nix
+++ b/pkgs/servers/mautrix-telegram/default.nix
@@ -29,17 +29,13 @@ in buildPythonPackage rec {
   propagatedBuildInputs = [
     Mako
     aiohttp
-    (mautrix.override {
-      sqlalchemy = sqlalchemy_1_3;
-    })
-    sqlalchemy_1_3
+    mautrix
+    sqlalchemy
     CommonMark
     ruamel_yaml
     python_magic
     telethon
-    (telethon-session-sqlalchemy.override {
-      sqlalchemy = sqlalchemy_1_3;
-    })
+    telethon-session-sqlalchemy
     pillow
     lxml
     setuptools
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 024642ef4f24..c192dd109791 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8157,9 +8157,7 @@ in {
 
   spyder-kernels_0_5 = callPackage ../development/python-modules/spyder-kernels/0.x.nix { };
 
-  sqlalchemy_1_3 = callPackage ../development/python-modules/sqlalchemy/1.3.nix { };
-  sqlalchemy_1_4 = callPackage ../development/python-modules/sqlalchemy/1.4.nix { };
-  sqlalchemy = self.sqlalchemy_1_4;
+  sqlalchemy = callPackage ../development/python-modules/sqlalchemy { };
 
   sqlalchemy-citext = callPackage ../development/python-modules/sqlalchemy-citext { };
 

From 5a2945b6edea312ec746d5994e681be99b4db070 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <dev@schuetz-co.de>
Date: Mon, 21 Jun 2021 21:37:06 +0200
Subject: [PATCH 349/416] mautrix-telegram: use sqlalchemy 1.3

---
 pkgs/servers/mautrix-telegram/default.nix | 26 ++++++++++++++++-------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/pkgs/servers/mautrix-telegram/default.nix b/pkgs/servers/mautrix-telegram/default.nix
index bf00462875b2..6c1d22c8f7e9 100644
--- a/pkgs/servers/mautrix-telegram/default.nix
+++ b/pkgs/servers/mautrix-telegram/default.nix
@@ -1,18 +1,28 @@
 { lib, python3, mautrix-telegram, fetchFromGitHub }:
 
-with python3.pkgs;
-
 let
+  python = python3.override {
+    packageOverrides = self: super: {
+      sqlalchemy = super.sqlalchemy.overridePythonAttrs (oldAttrs: rec {
+        version = "1.3.24";
+        src = oldAttrs.src.override {
+          inherit version;
+          sha256 = "ebbb777cbf9312359b897bf81ba00dae0f5cb69fba2a18265dcc18a6f5ef7519";
+        };
+      });
+    };
+  };
+
   # officially supported database drivers
-  dbDrivers = [
+  dbDrivers = with python.pkgs; [
     psycopg2
     # sqlite driver is already shipped with python by default
   ];
 
-in buildPythonPackage rec {
+in python.pkgs.buildPythonPackage rec {
   pname = "mautrix-telegram";
   version = "0.9.0";
-  disabled = pythonOlder "3.7";
+  disabled = python.pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "tulir";
@@ -26,7 +36,7 @@ in buildPythonPackage rec {
     sed -i -e '/alembic>/d' requirements.txt
   '';
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python.pkgs; [
     Mako
     aiohttp
     mautrix
@@ -47,7 +57,7 @@ in buildPythonPackage rec {
   #
   # Hence we need to patch away `alembic` from `mautrix-telegram` and create an `alembic`
   # which has `mautrix-telegram` in its environment.
-  passthru.alembic = alembic.overrideAttrs (old: {
+  passthru.alembic = python.pkgs.alembic.overrideAttrs (old: {
     propagatedBuildInputs = old.propagatedBuildInputs ++ dbDrivers ++ [
       mautrix-telegram
     ];
@@ -59,7 +69,7 @@ in buildPythonPackage rec {
   # The tests were touched the last time in 2019 and upstream CI doesn't even build
   # those, so it's safe to assume that this part of the software is abandoned.
   doCheck = false;
-  checkInputs = [
+  checkInputs = with python.pkgs; [
     pytest
     pytest-mock
     pytest-asyncio

From b4ccf9f881af61427470ac8d16da8b0dd2146735 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Mon, 14 Jun 2021 21:15:44 +0200
Subject: [PATCH 350/416] python3Packages.telethon: 1.17.5 -> 1.21.1

---
 pkgs/development/python-modules/telethon/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/telethon/default.nix b/pkgs/development/python-modules/telethon/default.nix
index dbf0f26c3a3f..041b102ce348 100644
--- a/pkgs/development/python-modules/telethon/default.nix
+++ b/pkgs/development/python-modules/telethon/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "telethon";
-  version = "1.17.5";
+  version = "1.21.1";
 
   src = fetchPypi {
     inherit version;
     pname = "Telethon";
-    sha256 = "1v1rgr030z8s1ldv5lm1811znyd568c22pmlrzzf3ls972xk514m";
+    sha256 = "sha256-mTyDfvdFrd+XKifXv7oM5Riihj0aUOBzclW3ZNI+DvI=";
   };
 
   patchPhase = ''

From 67751042c9945f66c493415730818401fa7d0972 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Mon, 14 Jun 2021 21:16:05 +0200
Subject: [PATCH 351/416] python3Packages.mautrix: 0.8.17 -> 0.9.4

---
 pkgs/development/python-modules/mautrix/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mautrix/default.nix b/pkgs/development/python-modules/mautrix/default.nix
index 6a6e35367331..6989ecac0ec6 100644
--- a/pkgs/development/python-modules/mautrix/default.nix
+++ b/pkgs/development/python-modules/mautrix/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "mautrix";
-  version = "0.8.17";
+  version = "0.9.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9a15a8e39f9d0b36c91dfe0f5dd1efc8752cc1d317057840a3dbffd6ee90e068";
+    sha256 = "sha256-FDXddvSikrLDNP8Llyv2tqAGwNAo8B7b1NPmVfyzq3s=";
   };
 
   propagatedBuildInputs = [

From ca16b617b4042f2b87c08a9218606e0142746181 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Mon, 14 Jun 2021 21:19:10 +0200
Subject: [PATCH 352/416] mautrix-telegram: 0.9.0 -> 0.10.0

---
 pkgs/servers/mautrix-telegram/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/mautrix-telegram/default.nix b/pkgs/servers/mautrix-telegram/default.nix
index 6c1d22c8f7e9..f54657db38f8 100644
--- a/pkgs/servers/mautrix-telegram/default.nix
+++ b/pkgs/servers/mautrix-telegram/default.nix
@@ -21,14 +21,14 @@ let
 
 in python.pkgs.buildPythonPackage rec {
   pname = "mautrix-telegram";
-  version = "0.9.0";
+  version = "0.10.0";
   disabled = python.pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "tulir";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1543ljjl3jg3ayid7ifi4bamqh4gq85pmlbs3m8i7phjbbm7g9dn";
+    sha256 = "sha256-lLVKD+/pKqs8oWBdyL+R1lk22LqQOC9nbMlxhCK39xA=";
   };
 
   patches = [ ./0001-Re-add-entrypoint.patch ./0002-Don-t-depend-on-pytest-runner.patch ];

From 52d701f1556b6bce6f69839877632e19fd1b4e0f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <dev@schuetz-co.de>
Date: Mon, 21 Jun 2021 19:29:34 +0200
Subject: [PATCH 353/416] mautrix-signal: pin mautrix to 0.8.18

---
 pkgs/servers/mautrix-signal/default.nix | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/pkgs/servers/mautrix-signal/default.nix b/pkgs/servers/mautrix-signal/default.nix
index c39394879fb4..c7dc3ecad584 100644
--- a/pkgs/servers/mautrix-signal/default.nix
+++ b/pkgs/servers/mautrix-signal/default.nix
@@ -1,6 +1,18 @@
-{ lib, python3Packages, fetchFromGitHub }:
+{ lib, python3, fetchFromGitHub }:
 
-python3Packages.buildPythonPackage rec {
+let
+  python = python3.override {
+    packageOverrides = self: super: {
+      mautrix = super.mautrix.overridePythonAttrs (oldAttrs: rec {
+        version = "0.8.18";
+        src = oldAttrs.src.override {
+          inherit version;
+          sha256 = "32daf7a7dcf5d4013b37321df7b319f36523f38884ccc3e2e965917d0a5c73c1";
+        };
+      });
+    };
+  };
+in python.pkgs.buildPythonPackage rec {
   pname = "mautrix-signal";
   version = "0.1.1";
 
@@ -11,7 +23,7 @@ python3Packages.buildPythonPackage rec {
     sha256 = "11snsl7i407855h39g1fgk26hinnq0inr8sjrgd319li0d3jwzxl";
   };
 
-  propagatedBuildInputs = with python3Packages; [
+  propagatedBuildInputs = with python.pkgs; [
     CommonMark
     aiohttp
     asyncpg
@@ -41,7 +53,7 @@ python3Packages.buildPythonPackage rec {
     " > $out/bin/mautrix-signal
     chmod +x $out/bin/mautrix-signal
     wrapProgram $out/bin/mautrix-signal \
-      --set PATH ${python3Packages.python}/bin \
+      --set PATH ${python}/bin \
       --set PYTHONPATH "$PYTHONPATH"
   '';
 

From 9332bcad1813a87d7cd51e94dd9fd4a4aa11093c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <dev@schuetz-co.de>
Date: Mon, 21 Jun 2021 19:35:54 +0200
Subject: [PATCH 354/416] python3Packages.mautrix: 0.9.4 -> 0.9.6

---
 pkgs/development/python-modules/mautrix/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mautrix/default.nix b/pkgs/development/python-modules/mautrix/default.nix
index 6989ecac0ec6..f61ace8960da 100644
--- a/pkgs/development/python-modules/mautrix/default.nix
+++ b/pkgs/development/python-modules/mautrix/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "mautrix";
-  version = "0.9.4";
+  version = "0.9.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-FDXddvSikrLDNP8Llyv2tqAGwNAo8B7b1NPmVfyzq3s=";
+    sha256 = "1810deb7f780700e7e0734e1844c1b4b2525ee990b8665f7b98e3f335a31bbcf";
   };
 
   propagatedBuildInputs = [

From 8eb36583e39dd4830ee37211cb193c577038f5ed Mon Sep 17 00:00:00 2001
From: Philipp Bartsch <phil@grmr.de>
Date: Tue, 22 Jun 2021 00:28:11 +0200
Subject: [PATCH 355/416] gnome-feeds: 0.16.1 -> 0.16.2

---
 .../networking/feedreaders/gnome-feeds/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/feedreaders/gnome-feeds/default.nix b/pkgs/applications/networking/feedreaders/gnome-feeds/default.nix
index a80d0aa28d0d..62ffe15e6183 100644
--- a/pkgs/applications/networking/feedreaders/gnome-feeds/default.nix
+++ b/pkgs/applications/networking/feedreaders/gnome-feeds/default.nix
@@ -20,14 +20,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gnome-feeds";
-  version = "0.16.1";
+  version = "0.16.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "gfeeds";
     rev = version;
-    sha256 = "10hq06nx7lcm3dqq34qkxc6k6383mvjs7pxii9y9995d9kk5a49k";
+    sha256 = "sha256-66dwVR9owg050aHCHJek7jYnT+/yyCKo4AaUE0hCqBA=";
   };
 
   format = "other";

From 1c7b7616d2fe7ef81003da3e9138401792559fd6 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sat, 19 Jun 2021 15:50:07 +1000
Subject: [PATCH 356/416] nix-prefetch: apply 'Fix input_type regex for macOS
 systems' patch

---
 pkgs/tools/package-management/nix-prefetch/default.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/tools/package-management/nix-prefetch/default.nix b/pkgs/tools/package-management/nix-prefetch/default.nix
index 320d41068ccb..b9ae0b5b4b0b 100644
--- a/pkgs/tools/package-management/nix-prefetch/default.nix
+++ b/pkgs/tools/package-management/nix-prefetch/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, installShellFiles, makeWrapper, asciidoc
 , docbook_xml_dtd_45, git, docbook_xsl, libxml2, libxslt, coreutils, gawk
-, gnugrep, gnused, jq, nix }:
+, gnugrep, gnused, jq, nix, fetchpatch }:
 
 let
   binPath = lib.makeBinPath [ coreutils gawk git gnugrep gnused jq nix ];
@@ -20,6 +20,14 @@ in stdenv.mkDerivation rec {
     '';
   };
 
+  patches = [
+    # Fix input_type regex for macOS systems: https://github.com/msteen/nix-prefetch/pull/24
+    (fetchpatch {
+      url = "https://github.com/msteen/nix-prefetch/commit/08282891bdb108e886eaf39be2030ba1feda1cb1.patch";
+      sha256 = "1v6ask54ind6f3784pbncv0dfg6draaaicg0q46jfvp0lafms70x";
+    })
+  ];
+
   postPatch = ''
     lib=$out/lib/${pname}
 

From 35184a5cf6a01435b03eb4a2f8f419afc714dde4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Tue, 22 Jun 2021 01:59:59 +0200
Subject: [PATCH 357/416] croc: 9.1.6 -> 9.2.0

---
 pkgs/tools/networking/croc/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/networking/croc/default.nix b/pkgs/tools/networking/croc/default.nix
index 1110c2cdb645..001ee1c725a9 100644
--- a/pkgs/tools/networking/croc/default.nix
+++ b/pkgs/tools/networking/croc/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "croc";
-  version = "9.1.6";
+  version = "9.2.0";
 
   src = fetchFromGitHub {
     owner = "schollz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-FMx2Siw1J7UKtuwLcSkgMhs4Dl0erQcRb5FGkq2hFv0=";
+    sha256 = "sha256-wEgR/4t2NRqdlAtHS41sACSNZpDY+4IEaeftCgRpEEk=";
   };
 
-  vendorSha256 = "sha256-tPBPmZLcBR16RxqvL3UYlIAwK8IeV+DYkRrVOgBkm58=";
+  vendorSha256 = "sha256-YwMqIbxj6ldYBjLb3Gs96oOHM2Li4Qq8PEMeYtrcSnE=";
 
   doCheck = false;
 

From baedc7400d8e914014b172f8e08b629a4bfca32f Mon Sep 17 00:00:00 2001
From: Anderson Torres <torres.anderson.85@protonmail.com>
Date: Mon, 21 Jun 2021 21:34:36 -0300
Subject: [PATCH 358/416] oed: init at 6.7 (#127690)

* oed: init at 6.7

oed is the portable OpenBSD implementation of the classical ed editor.

* Update pkgs/applications/editors/oed/default.nix

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
---
 pkgs/applications/editors/oed/default.nix | 24 +++++++++++++++++++++++
 pkgs/top-level/all-packages.nix           |  2 ++
 2 files changed, 26 insertions(+)
 create mode 100644 pkgs/applications/editors/oed/default.nix

diff --git a/pkgs/applications/editors/oed/default.nix b/pkgs/applications/editors/oed/default.nix
new file mode 100644
index 000000000000..1039bfc4aa74
--- /dev/null
+++ b/pkgs/applications/editors/oed/default.nix
@@ -0,0 +1,24 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+}:
+
+stdenv.mkDerivation rec {
+  pname = "oed";
+  version = "6.7";
+
+  src = fetchFromGitHub {
+    owner = "ibara";
+    repo = "oed";
+    rev = "oed-${version}";
+    hash = "sha256-Z8B1RIFve3UPj+9G/WJX0BNc2ynG/qtoGfoesarYGz8=";
+  };
+
+  meta = with lib; {
+    homepage = "https://github.com/ibara/oed";
+    description = "Portable ed editor from OpenBSD";
+    license = with licenses; [ bsd2 ];
+    maintainers = with maintainers; [ AndersonTorres ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 99ae2bdc94f2..a5449c7f32eb 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -23443,6 +23443,8 @@ in
 
   edbrowse = callPackage ../applications/editors/edbrowse { };
 
+  oed = callPackage ../applications/editors/oed { };
+
   ekho = callPackage ../applications/audio/ekho { };
 
   electron-cash = libsForQt5.callPackage ../applications/misc/electron-cash { };

From 382fc0d0bf219af9c9e1da942df8cc0387ee31b6 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 22 Jun 2021 02:59:29 +0200
Subject: [PATCH 359/416] python3Packages.database: add patches for sqlalchemy
 1.4 compat

---
 .../python-modules/databases/default.nix            | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pkgs/development/python-modules/databases/default.nix b/pkgs/development/python-modules/databases/default.nix
index 3a1da0697c0d..98e047836d01 100644
--- a/pkgs/development/python-modules/databases/default.nix
+++ b/pkgs/development/python-modules/databases/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , sqlalchemy
 , aiocontextvars
 , isPy27
@@ -23,6 +24,18 @@ buildPythonPackage rec {
     sha256 = "0aq88k7d9036cy6qvlfv9p2dxd6p6fic3j0az43gn6k1ardhdsgf";
   };
 
+  patches = [
+    # sqlalchemy 1.4 compat, https://github.com/encode/databases/pull/299
+    (fetchpatch {
+      url = "https://github.com/encode/databases/commit/9d6e0c024833bd41421f0798a94ef2bbf27a31d5.patch";
+      sha256 = "0wz9dz6g88ifvvwlhy249cjvqpx72x99wklzcl7b23srpcvb5gv1";
+    })
+    (fetchpatch {
+      url = "https://github.com/encode/databases/commit/40c41c2b7b3fedae484ad94d81b27ce88a09c5ed.patch";
+      sha256 = "0z458l3vkg4faxbnf31lszfby5d10fa9kgxxy4xxcm0py6d8a2pi";
+    })
+  ];
+
   propagatedBuildInputs = [
     aiocontextvars
     sqlalchemy

From 12e016b5c48619ad1652c9235f5239ac8a634540 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 22 Jun 2021 03:28:11 +0200
Subject: [PATCH 360/416] home-assistant: 2021.6.5 -> 2021.6.6

---
 pkgs/servers/home-assistant/component-packages.nix | 2 +-
 pkgs/servers/home-assistant/default.nix            | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index d85d877ca444..143554913bab 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2021.6.5";
+  version = "2021.6.6";
   components = {
     "abode" = ps: with ps; [ abodepy ];
     "accuweather" = ps: with ps; [ accuweather ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index f6263022d860..5bf5a5d9eb96 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -180,7 +180,7 @@ let
   extraBuildInputs = extraPackages py.pkgs;
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2021.6.5";
+  hassVersion = "2021.6.6";
 
 in with py.pkgs; buildPythonApplication rec {
   pname = "homeassistant";
@@ -197,7 +197,7 @@ in with py.pkgs; buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = version;
-    sha256 = "1cp294hy35k9hjbp8iqmaf1m5qbbkh3jwf92ym49waw8di5a5wvh";
+    sha256 = "0r8l2qya9pdl65kq3xrnb1vhmbnxm3bj12hn1wyxmw56l8m9l5d5";
   };
 
   # leave this in, so users don't have to constantly update their downstream patch handling

From 09a52f7662648a558f7d01b483138b31dd97505d Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Fri, 18 Jun 2021 21:47:51 +0300
Subject: [PATCH 361/416] grapejuice: init at 3.11.4

---
 pkgs/games/grapejuice/default.nix | 95 +++++++++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix   |  4 ++
 2 files changed, 99 insertions(+)
 create mode 100644 pkgs/games/grapejuice/default.nix

diff --git a/pkgs/games/grapejuice/default.nix b/pkgs/games/grapejuice/default.nix
new file mode 100644
index 000000000000..1cb27f7b8c52
--- /dev/null
+++ b/pkgs/games/grapejuice/default.nix
@@ -0,0 +1,95 @@
+{ lib
+, fetchFromGitLab
+, gobject-introspection
+, python3Packages
+, gtk3
+, wrapGAppsHook
+, glib
+, cairo
+, desktop-file-utils
+, xdg-utils
+, xdg-user-dirs
+, wine
+, winetricks
+}:
+
+python3Packages.buildPythonApplication rec  {
+  pname = "grapejuice";
+  version = "3.12.5";
+
+  src = fetchFromGitLab {
+    owner = "BrinkerVII";
+    repo = "grapejuice";
+    rev = "v${version}";
+    sha256 = "1xgxyfwwghy9l17i6y40axdrpp4fgxgdr5y97flwmfivif01ifs1";
+  };
+
+  nativeBuildInputs = [
+    gobject-introspection
+    desktop-file-utils
+    glib
+    gtk3
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    cairo
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    requests
+    pygobject3
+    dbus-python
+    packaging
+    psutil
+    setuptools
+  ];
+
+  dontWrapGApps = true;
+
+  makeWrapperArgs = [
+    "\${gappsWrapperArgs[@]}"
+    "--prefix PATH : ${lib.makeBinPath [ xdg-user-dirs xdg-utils wine (winetricks.override { wine = wine; }) ]}"
+  ];
+
+  postPatch = ''
+    substituteInPlace requirements.txt \
+      --replace "PyGObject-stubs" ""
+
+    substituteInPlace src/grapejuice_common/assets/desktop/grapejuice.desktop \
+      --replace \$GRAPEJUICE_EXECUTABLE "$out/bin/grapejuice" \
+      --replace \$GRAPEJUICE_ICON grapejuice
+
+    substituteInPlace src/grapejuice_common/assets/desktop/roblox-player.desktop \
+      --replace \$GRAPEJUICE_EXECUTABLE "$out/bin/grapejuice" \
+      --replace \$PLAYER_ICON "grapejuice-roblox-player"
+
+    substituteInPlace src/grapejuice_common/assets/desktop/roblox-app.desktop \
+      --replace \$GRAPEJUICE_EXECUTABLE "$out/bin/grapejuice" \
+      --replace \$PLAYER_ICON "grapejuice-roblox-player"
+
+    substituteInPlace src/grapejuice_common/assets/desktop/roblox-studio.desktop \
+      --replace \$GRAPEJUICE_EXECUTABLE "$out/bin/grapejuice" \
+      --replace \$STUDIO_ICON "grapejuice-roblox-studio"
+  '';
+
+  postInstall = ''
+    mkdir -p "$out/share/icons" "$out/share/applications" "$out/share/mime/packages"
+    cp -r src/grapejuice_common/assets/desktop/* $out/share/applications/
+    cp -r src/grapejuice_common/assets/icons $out/share/
+    cp src/grapejuice_common/assets/mime_xml/*.xml $out/share/mime/packages/
+  '';
+
+  # No tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "grapejuice" ];
+
+  meta = with lib; {
+    homepage = "https://gitlab.com/brinkervii/grapejuice";
+    description = "Simple Wine+Roblox management tool";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ artturin ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0c853ce2d793..4fdac444e282 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2813,6 +2813,10 @@ in
 
   gti = callPackage ../tools/misc/gti { };
 
+  grapejuice = callPackage ../games/grapejuice {
+    wine = wineWowPackages.unstable;
+  };
+
   hdate = callPackage ../applications/misc/hdate { };
 
   heatseeker = callPackage ../tools/misc/heatseeker { };

From 1eb89089af01ec9c6b639d36d8ee2c5329430441 Mon Sep 17 00:00:00 2001
From: AndersonTorres <torres.anderson.85@protonmail.com>
Date: Mon, 21 Jun 2021 22:54:31 -0300
Subject: [PATCH 362/416] Remove myself from oed maintainers list

---
 pkgs/applications/editors/oed/default.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/applications/editors/oed/default.nix b/pkgs/applications/editors/oed/default.nix
index 1039bfc4aa74..2281ca8c08b3 100644
--- a/pkgs/applications/editors/oed/default.nix
+++ b/pkgs/applications/editors/oed/default.nix
@@ -18,7 +18,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/ibara/oed";
     description = "Portable ed editor from OpenBSD";
     license = with licenses; [ bsd2 ];
-    maintainers = with maintainers; [ AndersonTorres ];
     platforms = platforms.unix;
   };
 }

From 80565f5b5ed0523116233a09a6cef401cc008167 Mon Sep 17 00:00:00 2001
From: fortuneteller2k <lythe1107@gmail.com>
Date: Sat, 12 Jun 2021 18:26:28 +0800
Subject: [PATCH 363/416] open-fonts: init at 0.7.0

---
 pkgs/data/fonts/open-fonts/default.nix | 28 ++++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix        |  2 ++
 2 files changed, 30 insertions(+)
 create mode 100644 pkgs/data/fonts/open-fonts/default.nix

diff --git a/pkgs/data/fonts/open-fonts/default.nix b/pkgs/data/fonts/open-fonts/default.nix
new file mode 100644
index 000000000000..e503b1143033
--- /dev/null
+++ b/pkgs/data/fonts/open-fonts/default.nix
@@ -0,0 +1,28 @@
+{ lib, fetchurl }:
+
+let
+  pname = "open-fonts";
+  version = "0.7.0";
+in
+fetchurl {
+  name = "${pname}-${version}";
+
+  url = "https://github.com/kiwi0fruit/open-fonts/releases/download/${version}/open-fonts.tar.xz";
+  downloadToTemp = true;
+  recursiveHash = true;
+  sha256 = "sha256-bSP9Flotoo3E5vRU3eKOUAPD2fmkWseWYWG4y0S07+4=";
+
+  postFetch = ''
+    tar xf $downloadedFile
+    mkdir -p $out/share/fonts/truetype
+    install open-fonts/*.ttf $out/share/fonts/truetype
+  '';
+
+  meta = with lib; {
+    description = "A collection of beautiful free and open source fonts";
+    homepage = "https://github.com/kiwi0fruit/open-fonts";
+    license = licenses.mit;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ fortuneteller2k ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 34e5d3ab0ba3..0765cc59d1d9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -22383,6 +22383,8 @@ in
 
   inter = callPackage ../data/fonts/inter { };
 
+  open-fonts = callPackage ../data/fonts/open-fonts { };
+
   scientifica = callPackage ../data/fonts/scientifica { };
 
   siji = callPackage ../data/fonts/siji

From 56f2a775849a1fef7c35a5ce9294cd410c3b3b0d Mon Sep 17 00:00:00 2001
From: Peter Hoeg <peter@hoeg.com>
Date: Mon, 21 Jun 2021 14:19:11 +0800
Subject: [PATCH 364/416] widelands: 21 -> 1.0

Also add a few missing bits (icons, man page)
---
 pkgs/games/widelands/default.nix | 114 ++++++++++++++++++++-----------
 1 file changed, 76 insertions(+), 38 deletions(-)

diff --git a/pkgs/games/widelands/default.nix b/pkgs/games/widelands/default.nix
index 8b96dcc04e2e..f094c7cd5961 100644
--- a/pkgs/games/widelands/default.nix
+++ b/pkgs/games/widelands/default.nix
@@ -1,52 +1,90 @@
-{ lib, stdenv, fetchurl, cmake, python, gettext
-, boost, libpng, zlib, glew, lua, doxygen, icu
-, SDL2, SDL2_image, SDL2_mixer, SDL2_net, SDL2_ttf
+{ lib
+, stdenv
+, fetchFromGitHub
+, SDL2
+, SDL2_image
+, SDL2_mixer
+, SDL2_net
+, SDL2_ttf
+, boost
+, cmake
+, curl
+, doxygen
+, gettext
+, glew
+, graphviz
+, icu
+, installShellFiles
+, libpng
+, lua
+, python3
+, zlib
 }:
 
 stdenv.mkDerivation rec {
   pname = "widelands";
-  version = "21";
+  version = "1.0";
+
+  src = fetchFromGitHub {
+    owner = "widelands";
+    repo = "widelands";
+    rev = "v${version}";
+    sha256 = "sha256-gNumYoeKePaxiAzrqEPKibMxFwv9vyBrCSoua+MKhcM=";
+  };
+
+  patches = [ ./bincmake.patch ];
+
+  postPatch = ''
+    substituteInPlace xdg/org.widelands.Widelands.desktop \
+      --replace 'Exec=widelands' "Exec=$out/bin/widelands"
+  '';
+
+  cmakeFlags = [
+    "-Wno-dev" # dev warnings are only needed for upstream development
+    "-DWL_INSTALL_BASEDIR=${placeholder "out"}"
+    "-DWL_INSTALL_DATADIR=${placeholder "out"}/share/widelands"
+    "-DWL_INSTALL_BINARY=${placeholder "out"}/bin"
+  ];
+
+  nativeBuildInputs = [ cmake doxygen gettext graphviz installShellFiles ];
+
+  buildInputs = [
+    SDL2
+    SDL2_image
+    SDL2_mixer
+    SDL2_net
+    SDL2_ttf
+    boost
+    curl
+    glew
+    icu
+    libpng
+    lua
+    python3
+    zlib
+  ];
+
+  postInstall = ''
+    install -Dm444 -t $out/share/applications ../xdg/org.widelands.Widelands.desktop
+
+    for s in 16 32 48 64 128; do
+      install -Dm444 ../data/images/logos/wl-ico-''${s}.png $out/share/icons/hicolor/''${s}x''${s}/org.widelands.Widelands.png
+    done
+
+    installManPage ../xdg/widelands.6
+  '';
 
   meta = with lib; {
     description = "RTS with multiple-goods economy";
-    homepage    = "http://widelands.org/";
+    homepage = "https://widelands.org/";
     longDescription = ''
       Widelands is a real time strategy game based on "The Settlers" and "The
       Settlers II". It has a single player campaign mode, as well as a networked
       multiplayer mode.
     '';
-    license        = licenses.gpl2Plus;
-    platforms      = platforms.linux;
-    maintainers    = with maintainers; [ raskin jcumming ];
-    hydraPlatforms = [];
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ raskin jcumming ];
+    platforms = platforms.linux;
+    hydraPlatforms = [ ];
   };
-
-  patches = [
-    ./bincmake.patch
-  ];
-
-  src = fetchurl {
-    url = "https://launchpad.net/widelands/build${version}/build${version}/+download/widelands-build${version}-source.tar.gz";
-    sha256 = "sha256-YB4OTG+Rs/sOzizRuD7PsCNEobkZT7tw7z9w4GmU41c=";
-  };
-
-  preConfigure = ''
-    cmakeFlags="
-      -DWL_INSTALL_BASEDIR=$out
-      -DWL_INSTALL_DATADIR=$out/share/widelands
-      -DWL_INSTALL_BINARY=$out/bin
-    "
-  '';
-
-  nativeBuildInputs = [ cmake python gettext ];
-
-  buildInputs = [
-    boost libpng zlib glew lua doxygen icu
-    SDL2 SDL2_image SDL2_mixer SDL2_net SDL2_ttf
-  ];
-
-  postInstall = ''
-    mkdir -p "$out/share/applications/"
-    cp -v "../xdg/org.widelands.Widelands.desktop" "$out/share/applications/"
-  '';
 }

From 2473f4eba4712c09d2ff43f142f35211ca15e52a Mon Sep 17 00:00:00 2001
From: Peter Hoeg <peter@hoeg.com>
Date: Tue, 22 Jun 2021 14:13:11 +0800
Subject: [PATCH 365/416] plocate: init at 1.1.7 (#124259)

* plocate: init at 1.1.7
---
 pkgs/tools/misc/plocate/default.nix | 45 +++++++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix     |  2 ++
 2 files changed, 47 insertions(+)
 create mode 100644 pkgs/tools/misc/plocate/default.nix

diff --git a/pkgs/tools/misc/plocate/default.nix b/pkgs/tools/misc/plocate/default.nix
new file mode 100644
index 000000000000..faff84e52fa6
--- /dev/null
+++ b/pkgs/tools/misc/plocate/default.nix
@@ -0,0 +1,45 @@
+{ stdenv
+, lib
+, fetchgit
+, pkg-config
+, meson
+, ninja
+, systemd
+, liburing
+, zstd
+}:
+
+stdenv.mkDerivation rec {
+  pname = "plocate";
+  version = "1.1.7";
+
+  src = fetchgit {
+    url = "https://git.sesse.net/plocate";
+    rev = version;
+    sha256 = "sha256-5Ie4qgiKUoI9Kma6YvjXirvBbpbKVuaMSSAZa36zN3M=";
+  };
+
+  postPatch = ''
+    sed -i meson.build \
+      -e "s@unitdir =.*@unitdir = '$out/lib/systemd/system'@" \
+      -e '/mkdir\.sh/d'
+  '';
+
+  nativeBuildInputs = [ meson ninja pkg-config ];
+
+  buildInputs = [ systemd liburing zstd ];
+
+  mesonFlags = [
+    # I don't know why we can't do this but instead have to resort to patching meson.build
+    #   "-Dsystemdsystemunitdir=${placeholder "out"}/etc/systemd/system"
+    "-Dsharedstatedir=/var/lib"
+  ];
+
+  meta = with lib; {
+    description = "Much faster locate";
+    homepage = "https://plocate.sesse.net/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ peterhoeg ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4bcddbceb68a..abb0b4123477 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -25804,6 +25804,8 @@ in
 
   mlocate = callPackage ../tools/misc/mlocate { };
 
+  plocate = callPackage ../tools/misc/plocate { };
+
   mypaint = callPackage ../applications/graphics/mypaint { };
 
   mypaint-brushes1 = callPackage ../development/libraries/mypaint-brushes/1.0.nix { };

From b70e57ea188c1f002b0864cb82db67c88fdc7b8a Mon Sep 17 00:00:00 2001
From: Johannes Schleifenbaum <johannes@js-webcoding.de>
Date: Mon, 21 Jun 2021 14:57:43 +0200
Subject: [PATCH 366/416] sabnzbd: 3.2.1 -> 3.3.1

---
 pkgs/servers/sabnzbd/default.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sabnzbd/default.nix b/pkgs/servers/sabnzbd/default.nix
index 14aa161069c1..3e2592bb093b 100644
--- a/pkgs/servers/sabnzbd/default.nix
+++ b/pkgs/servers/sabnzbd/default.nix
@@ -20,26 +20,30 @@ let
   ]);
   path = lib.makeBinPath [ par2cmdline unrar unzip p7zip ];
 in stdenv.mkDerivation rec {
-  version = "3.2.1";
+  version = "3.3.1";
   pname = "sabnzbd";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-y2uaXa2DPZHBLukAdwKTwXauaJHX5Uft35vsthzGwME=";
+    sha256 = "sha256-OcasqRu6nh9hKepMbXVgZ49MeJTlWK+qPSkiBPgmYYo=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ pythonEnv ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out
     cp -R * $out/
     mkdir $out/bin
     echo "${pythonEnv}/bin/python $out/SABnzbd.py \$*" > $out/bin/sabnzbd
     chmod +x $out/bin/sabnzbd
     wrapProgram $out/bin/sabnzbd --set PATH ${path}
+
+    runHook postInstall
   '';
 
   meta = with lib; {

From 48aec70ea13aaf16d0f58e7525823cc3820cdc40 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Tue, 22 Jun 2021 08:51:39 +0200
Subject: [PATCH 367/416] nixos/test-driver: replace termlib with socat

telnetlib does not handle unicode, which is annoying when using systemctl.
Also this gives us a nice readline with history.
---
 nixos/lib/test-driver/test-driver.py | 7 ++++---
 nixos/lib/testing-python.nix         | 2 +-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/nixos/lib/test-driver/test-driver.py b/nixos/lib/test-driver/test-driver.py
index 5be741395a08..7f4dd5963c92 100644
--- a/nixos/lib/test-driver/test-driver.py
+++ b/nixos/lib/test-driver/test-driver.py
@@ -462,9 +462,10 @@ class Machine:
         Should only be used during test development, not in the production test."""
         self.connect()
         self.log("Terminal is ready (there is no prompt):")
-        telnet = telnetlib.Telnet()
-        telnet.sock = self.shell  # type: ignore
-        telnet.interact()
+        subprocess.run(
+            ["socat", "READLINE", f"FD:{self.shell.fileno()}"],
+            pass_fds=[self.shell.fileno()],
+        )
 
     def succeed(self, *commands: str) -> str:
         """Execute each command and check that it succeeds."""
diff --git a/nixos/lib/testing-python.nix b/nixos/lib/testing-python.nix
index dbff6b98f0d6..768f1dc2a170 100644
--- a/nixos/lib/testing-python.nix
+++ b/nixos/lib/testing-python.nix
@@ -64,7 +64,7 @@ rec {
 
           wrapProgram $out/bin/nixos-test-driver \
             --argv0 ${name} \
-            --prefix PATH : "${lib.makeBinPath [ qemu_pkg vde2 netpbm coreutils ]}" \
+            --prefix PATH : "${lib.makeBinPath [ qemu_pkg vde2 netpbm coreutils socat ]}" \
             ${lib.optionalString enableOCR
               "--prefix PATH : '${ocrProg}/bin:${imagemagick_tiff}/bin'"} \
 

From 07a6e900ad34b7c373da7a38ce434041ee800868 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 22 Jun 2021 09:16:33 +0200
Subject: [PATCH 368/416] python3Packages.pg8000: 1.19.4 -> 1.19.5

---
 pkgs/development/python-modules/pg8000/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pg8000/default.nix b/pkgs/development/python-modules/pg8000/default.nix
index 958d3b765592..5560e918ac4a 100644
--- a/pkgs/development/python-modules/pg8000/default.nix
+++ b/pkgs/development/python-modules/pg8000/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "pg8000";
-  version = "1.19.4";
+  version = "1.19.5";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-fJxtV1QbDyFT4jqNdZzrPXy5MIkY+6atnpL44OWpC8g=";
+    sha256 = "sha256-3LmvucuHrMeTiK5jPEXPf4Bqq+O7XYzxVFcraZOT+Tc=";
   };
 
   propagatedBuildInputs = [

From f17a6ff223bf1215fc7e84efd9aba9b604b1cdc4 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 22 Jun 2021 09:34:46 +0200
Subject: [PATCH 369/416] python3Packages.auth0-python: 3.14.0 -> 3.16.2

---
 .../python-modules/auth0-python/default.nix   | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/python-modules/auth0-python/default.nix b/pkgs/development/python-modules/auth0-python/default.nix
index 79844afe318e..81aee196a3b7 100644
--- a/pkgs/development/python-modules/auth0-python/default.nix
+++ b/pkgs/development/python-modules/auth0-python/default.nix
@@ -1,18 +1,19 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, requests
 , mock
+, pyjwt
 , pytestCheckHook
+, requests
 }:
 
 buildPythonPackage rec {
   pname = "auth0-python";
-  version = "3.14.0";
+  version = "3.16.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ac7808d00676c5e7ffa9eaa228807ca1f8db7a0f4dc115337c80fb6d7eb2b50a";
+    sha256 = "sha256-Slpwml1GDdxAZ4P6Vn2brrupRofiOHvmQF26l0gtTJM=";
   };
 
   propagatedBuildInputs = [
@@ -21,23 +22,21 @@ buildPythonPackage rec {
 
   checkInputs = [
     mock
+    pyjwt
     pytestCheckHook
   ];
 
-  pytestFlagsArray = [
-    # jwt package is not available in nixpkgs
-    "--ignore=auth0/v3/test/authentication/test_token_verifier.py"
-  ];
-
-  # tries to ping websites (e.g. google.com)
   disabledTests = [
+    # tries to ping websites (e.g. google.com)
     "can_timeout"
   ];
 
+  pythonImportsCheck = [ "auth0" ];
+
   meta = with lib; {
     description = "Auth0 Python SDK";
     homepage = "https://github.com/auth0/auth0-python";
     license = licenses.mit;
-    maintainers = [ maintainers.costrouc ];
+    maintainers = with maintainers; [ costrouc ];
   };
 }

From b3f39de83ce2cadeee3413cb253b125067df25af Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 22 Jun 2021 09:40:59 +0200
Subject: [PATCH 370/416] python3Packages.ncclient: 0.6.10 -> 0.6.12

---
 .../python-modules/ncclient/default.nix       | 30 +++++++++----------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/pkgs/development/python-modules/ncclient/default.nix b/pkgs/development/python-modules/ncclient/default.nix
index 2e352be412c1..010e2a5bae3f 100644
--- a/pkgs/development/python-modules/ncclient/default.nix
+++ b/pkgs/development/python-modules/ncclient/default.nix
@@ -1,34 +1,34 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , paramiko
 , selectors2
 , lxml
-, nose
-, rednose
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "ncclient";
-  version = "0.6.10";
+  version = "0.6.12";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "67b1eba5a6c7c6075746d8c33d4e8f4ded17604034c1fcd1c78996ef52bf66ff";
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1sjvqaxb54nmqljiw5bg1423msa9rg015wiix9fsm6djk3wpklmk";
   };
 
-  checkInputs = [ nose rednose ];
-
   propagatedBuildInputs = [
-    paramiko lxml selectors2
+    paramiko
+    lxml
+    selectors2
   ];
 
-  checkPhase = ''
-    nosetests test --rednose --verbosity=3 --with-coverage --cover-package ncclient
-  '';
+  checkInputs = [
+    pytestCheckHook
+  ];
 
-  #Unfortunately the test hangs at te end
-  doCheck = false;
+  pythonImportsCheck = [ "ncclient" ];
 
   meta = with lib; {
     homepage = "https://github.com/ncclient/ncclient";

From 642faddedf1e73133cf646f7fcd0825fa1d104ad Mon Sep 17 00:00:00 2001
From: deliciouslytyped <47436522+deliciouslytyped@users.noreply.github.com>
Date: Tue, 22 Jun 2021 09:50:35 +0200
Subject: [PATCH 371/416] python3Packages.wxPython_4_0,
 python3Packages.wxPython_4_1: add numpy and pillow to `propagatedBuildInputs`
 as required by upstream's dependency settings

---
 pkgs/development/python-modules/wxPython/4.0.nix | 4 ++++
 pkgs/development/python-modules/wxPython/4.1.nix | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/pkgs/development/python-modules/wxPython/4.0.nix b/pkgs/development/python-modules/wxPython/4.0.nix
index 2fc9a98a26f9..3a86ef4c6390 100644
--- a/pkgs/development/python-modules/wxPython/4.0.nix
+++ b/pkgs/development/python-modules/wxPython/4.0.nix
@@ -18,6 +18,8 @@
 , AudioToolbox
 , OpenGL
 , CoreFoundation
+, pillow
+, numpy
 }:
 
 buildPythonPackage rec {
@@ -42,6 +44,8 @@ buildPythonPackage rec {
     [ wxGTK.gtk ]
   );
 
+  propagatedBuildInputs = [ pillow numpy ];
+
   DOXYGEN = "${doxygen}/bin/doxygen";
 
   preConfigure = lib.optionalString (!stdenv.isDarwin) ''
diff --git a/pkgs/development/python-modules/wxPython/4.1.nix b/pkgs/development/python-modules/wxPython/4.1.nix
index a86e07729d97..89796500e04e 100644
--- a/pkgs/development/python-modules/wxPython/4.1.nix
+++ b/pkgs/development/python-modules/wxPython/4.1.nix
@@ -11,6 +11,8 @@
 , ncurses
 , pango
 , wxGTK
+, pillow
+, numpy
 }:
 let
   dynamic-linker = stdenv.cc.bintools.dynamicLinker;
@@ -36,6 +38,8 @@ buildPythonPackage rec {
     ncurses
   ];
 
+  propagatedBuildInputs = [ pillow numpy ];
+
   DOXYGEN = "${doxygen}/bin/doxygen";
 
   preConfigure = lib.optionalString (!stdenv.isDarwin) ''

From 4c413847d4c97f96c296e1e7ba789a261fa27bb5 Mon Sep 17 00:00:00 2001
From: Enno Richter <enno@nerdworks.de>
Date: Mon, 21 Jun 2021 12:55:51 +0200
Subject: [PATCH 372/416] python3Packages.python-linux-procfs: init at 0.6.3

---
 .../python-linux-procfs/default.nix           | 25 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 27 insertions(+)
 create mode 100644 pkgs/development/python-modules/python-linux-procfs/default.nix

diff --git a/pkgs/development/python-modules/python-linux-procfs/default.nix b/pkgs/development/python-modules/python-linux-procfs/default.nix
new file mode 100644
index 000000000000..702be64075ae
--- /dev/null
+++ b/pkgs/development/python-modules/python-linux-procfs/default.nix
@@ -0,0 +1,25 @@
+{ lib, buildPythonPackage, fetchgit, six }:
+
+buildPythonPackage rec {
+  pname = "python-linux-procfs";
+  version = "0.6.3";
+
+  src = fetchgit {
+    url = "https://git.kernel.org/pub/scm/libs/python/${pname}/${pname}.git";
+    rev = "v${version}";
+    sha256 = "sha256-PPgMlL9oj4HYUsr444ZrGo1LSZBl9hL5SE98IASUpbc=";
+  };
+
+  propagatedBuildInputs = [ six ];
+
+  # contains no tests
+  doCheck = false;
+  pythonImportsCheck = [ "procfs" ];
+
+  meta = with lib; {
+    description = "Python classes to extract information from the Linux kernel /proc files";
+    homepage = "https://git.kernel.org/pub/scm/libs/python/python-linux-procfs/python-linux-procfs.git/";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ elohmeier ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index c192dd109791..8dd16275f2aa 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6929,6 +6929,8 @@ in {
 
   python-Levenshtein = callPackage ../development/python-modules/python-levenshtein { };
 
+  python-linux-procfs = callPackage ../development/python-modules/python-linux-procfs { };
+
   python-logstash = callPackage ../development/python-modules/python-logstash { };
 
   python-ly = callPackage ../development/python-modules/python-ly { };

From 3d7629eba8ba6b9771d73913d66cfb18906d3b3c Mon Sep 17 00:00:00 2001
From: Enno Richter <enno@nerdworks.de>
Date: Mon, 21 Jun 2021 12:59:39 +0200
Subject: [PATCH 373/416] python3Packages.python-ethtool: init at 0.14

---
 .../python-modules/python-ethtool/default.nix | 34 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 36 insertions(+)
 create mode 100644 pkgs/development/python-modules/python-ethtool/default.nix

diff --git a/pkgs/development/python-modules/python-ethtool/default.nix b/pkgs/development/python-modules/python-ethtool/default.nix
new file mode 100644
index 000000000000..03c147397068
--- /dev/null
+++ b/pkgs/development/python-modules/python-ethtool/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pkg-config
+, libnl
+, nettools
+}:
+
+buildPythonPackage rec {
+  pname = "python-ethtool";
+  version = "0.14";
+
+  src = fetchFromGitHub {
+    owner = "fedora-python";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-Sp7ssfLZ/1FEKrvX257pKcaureZ5mdpJ7jCEh/ft1l0=";
+  };
+
+  postPatch = ''
+    substituteInPlace tests/parse_ifconfig.py --replace "Popen('ifconfig'," "Popen('${nettools}/bin/ifconfig',"
+  '';
+
+  buildInputs = [ libnl ];
+  nativeBuildInputs = [ pkg-config ];
+  pythonImportsCheck = [ "ethtool" ];
+
+  meta = with lib; {
+    description = "Python bindings for the ethtool kernel interface";
+    homepage = "https://github.com/fedora-python/python-ethtool";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ elohmeier ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 8dd16275f2aa..2a5462c835ba 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6885,6 +6885,8 @@ in {
 
   python-etcd = callPackage ../development/python-modules/python-etcd { };
 
+  python-ethtool = callPackage ../development/python-modules/python-ethtool { };
+
   python_fedora = callPackage ../development/python-modules/python_fedora { };
 
   python-fontconfig = callPackage ../development/python-modules/python-fontconfig { };

From b463abf3f8db62fc8b50b71a286a357574c08a31 Mon Sep 17 00:00:00 2001
From: Enno Richter <enno@nerdworks.de>
Date: Mon, 21 Jun 2021 13:21:24 +0200
Subject: [PATCH 374/416] tuna: init at 0.15

---
 pkgs/os-specific/linux/tuna/default.nix | 62 +++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix         |  2 +
 2 files changed, 64 insertions(+)
 create mode 100644 pkgs/os-specific/linux/tuna/default.nix

diff --git a/pkgs/os-specific/linux/tuna/default.nix b/pkgs/os-specific/linux/tuna/default.nix
new file mode 100644
index 000000000000..0e621a24f081
--- /dev/null
+++ b/pkgs/os-specific/linux/tuna/default.nix
@@ -0,0 +1,62 @@
+{ lib
+, buildPythonApplication
+, fetchgit
+, pygobject3
+, pytestCheckHook
+, gdk-pixbuf
+, glib
+, gobject-introspection
+, gtk3
+, python-linux-procfs
+, python-ethtool
+, wrapGAppsHook
+}:
+
+buildPythonApplication rec {
+  pname = "tuna";
+  version = "0.15";
+
+  src = fetchgit {
+    url = "https://git.kernel.org/pub/scm/utils/${pname}/${pname}.git";
+    rev = "v${version}";
+    sha256 = "sha256-lRHlbdCQ0NcjcWgLvCze67kN8NsK0f5RmKfPbkHhk78=";
+  };
+
+  patchPhase = ''
+    mv tuna-cmd.py tuna/cmd.py
+
+    substituteInPlace setup.py \
+      --replace 'packages = ["tuna", "tuna/gui"],' \
+                'packages = ["tuna", "tuna/gui"], entry_points={"console_scripts":["tuna=tuna.cmd:main"]},'
+
+    substituteInPlace tuna/tuna_gui.py \
+      --replace "self.binpath + 'pkexec'" "'/run/wrappers/bin/pkexec'" \
+      --replace 'tuna_glade_dirs = [".", "tuna", "/usr/share/tuna"]' "tuna_glade_dirs = [ \"$out/share/tuna\" ]"
+  '';
+
+  nativeBuildInputs = [
+    glib.dev
+    gobject-introspection
+    gtk3
+    wrapGAppsHook
+  ];
+
+  propagatedBuildInputs = [ pygobject3 python-linux-procfs python-ethtool ];
+
+  postInstall = ''
+    mkdir -p $out/share/tuna
+    cp tuna/tuna_gui.glade $out/share/tuna/
+  '';
+
+  # contains no tests
+  doCheck = false;
+  pythonImportsCheck = [ "tuna" ];
+
+  meta = with lib; {
+    description = "Thread and IRQ affinity setting GUI and cmd line tool";
+    homepage = "https://git.kernel.org/pub/scm/utils/tuna/tuna.git";
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ elohmeier ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f4a0603faf10..b53b5535a77c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -27177,6 +27177,8 @@ in
 
   tudu = callPackage ../applications/office/tudu { };
 
+  tuna = python3Packages.callPackage ../os-specific/linux/tuna { };
+
   tunefish = callPackage ../applications/audio/tunefish {
     stdenv = clangStdenv; # https://github.com/jpcima/tunefish/issues/4
   };

From a2f9d8c6bbbbe796e77201b6ce1b2b5086c9c49e Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 22 Jun 2021 10:06:18 +0200
Subject: [PATCH 375/416] python3Packages.hvac: 0.10.8 -> 0.10.14

---
 .../python-modules/hvac/default.nix           | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/hvac/default.nix b/pkgs/development/python-modules/hvac/default.nix
index f67b5de7ee06..70cd9ca5abd9 100644
--- a/pkgs/development/python-modules/hvac/default.nix
+++ b/pkgs/development/python-modules/hvac/default.nix
@@ -1,15 +1,25 @@
-{ lib, buildPythonPackage, fetchPypi, requests, six }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pyhcl
+, requests
+, six
+}:
 
 buildPythonPackage rec {
   pname = "hvac";
-  version = "0.10.8";
+  version = "0.10.14";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cd74138994b1b99cdb75d34aadfd900352b3170bfc31c5e4cc0ff63eaa731cf9";
+    sha256 = "sha256-DGFvKdZkKtqrzUCKBEaTdO2DvhKyRQG7M36PN7rf7yI=";
   };
 
-  propagatedBuildInputs = [ requests six ];
+  propagatedBuildInputs = [
+    pyhcl
+    requests
+    six
+  ];
 
   # Requires running a Vault server
   doCheck = false;
@@ -20,5 +30,6 @@ buildPythonPackage rec {
     description = "HashiCorp Vault API client";
     homepage = "https://github.com/ianunruh/hvac";
     license = licenses.asl20;
+    maintainers = with maintainers; [ ];
   };
 }

From bdb83d6589f4dfc6f88076d7c30d1299b223efe4 Mon Sep 17 00:00:00 2001
From: Redvers Davies <github@unixfu.com>
Date: Tue, 22 Jun 2021 04:06:55 -0400
Subject: [PATCH 376/416] pony-corral: 0.5.0 -> 0.5.1 (#127695)

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
---
 pkgs/development/compilers/ponyc/pony-corral.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/ponyc/pony-corral.nix b/pkgs/development/compilers/ponyc/pony-corral.nix
index e9473b81f484..3f40a4d7889e 100644
--- a/pkgs/development/compilers/ponyc/pony-corral.nix
+++ b/pkgs/development/compilers/ponyc/pony-corral.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation ( rec {
   pname = "corral";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "ponylang";
     repo = pname;
     rev = version;
-    sha256 = "sha256-mQ/SxnppChZ+6PKVo5VM+QiNn94F4qJT1kQSrwXTa7k=";
+    sha256 = "1g4dkf5hsnykn3x6yx6ycjzmzzr1nwl59lj13j7zyka1ibv53hwf";
   };
 
   buildInputs = [ ponyc ];

From 3644957973547bf65cfc97475d494be0eaca895f Mon Sep 17 00:00:00 2001
From: fortuneteller2k <lythe1107@gmail.com>
Date: Tue, 22 Jun 2021 16:12:57 +0800
Subject: [PATCH 377/416] stevenblack-blocklist: 3.7.8 -> 3.7.9

---
 pkgs/tools/networking/stevenblack-blocklist/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/networking/stevenblack-blocklist/default.nix b/pkgs/tools/networking/stevenblack-blocklist/default.nix
index 29faa448a3d0..7bb717c1a507 100644
--- a/pkgs/tools/networking/stevenblack-blocklist/default.nix
+++ b/pkgs/tools/networking/stevenblack-blocklist/default.nix
@@ -1,7 +1,7 @@
 { lib, fetchFromGitHub }:
 
 let
-  version = "3.7.8";
+  version = "3.7.9";
 in
 fetchFromGitHub {
   name = "stevenblack-blocklist-${version}";
@@ -9,7 +9,7 @@ fetchFromGitHub {
   owner = "StevenBlack";
   repo = "hosts";
   rev = version;
-  sha256 = "sha256-z+AkjWmqP4ASnpIAG/OyZC4W5xU5YOeFTsmdkLvPixQ=";
+  sha256 = "sha256-5PhJ48w/dNmSgc3XUaFUhVWyvH7jSUj8moBM3Yvmrz4=";
 
   meta = with lib; {
     description = "Unified hosts file with base extensions";

From 5efe86e393220b3885b59fcc831e546d5d7dcc7b Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Tue, 22 Jun 2021 16:17:08 +1000
Subject: [PATCH 378/416] runc: 1.0.0-rc95 -> 1.0.0

https://github.com/opencontainers/runc/releases/tag/v1.0.0
---
 pkgs/applications/virtualization/runc/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/virtualization/runc/default.nix b/pkgs/applications/virtualization/runc/default.nix
index b3578e175d49..8f7a88a21827 100644
--- a/pkgs/applications/virtualization/runc/default.nix
+++ b/pkgs/applications/virtualization/runc/default.nix
@@ -16,13 +16,13 @@
 
 buildGoModule rec {
   pname = "runc";
-  version = "1.0.0-rc95";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "opencontainers";
     repo = "runc";
     rev = "v${version}";
-    sha256 = "sha256-q4sXcvJO9gyo7m0vlaMrwh7ZZHYa58FJy3GatWndS6M=";
+    sha256 = "sha256-slNVSlyJLaqIFF4uJP/7u4M0AkJLQjqkHO5TeKFYgSA=";
   };
 
   vendorSha256 = null;

From 1bbdca36d28643b26e5aaf9c83dfb50144d73b55 Mon Sep 17 00:00:00 2001
From: Yuka <86169957+yu-re-ka@users.noreply.github.com>
Date: Tue, 22 Jun 2021 11:17:00 +0200
Subject: [PATCH 379/416] maintainers: add yuka (#127773)

If this seems strange to you, or you are a maintainer of one of these
packages, please contact me on Matrix: @yuka:yuka.dev
---
 maintainers/maintainer-list.nix                         | 6 ++++++
 maintainers/team-list.nix                               | 1 +
 pkgs/applications/version-management/gitlab/default.nix | 2 +-
 pkgs/servers/pleroma/default.nix                        | 2 +-
 pkgs/tools/misc/coreboot-utils/default.nix              | 2 +-
 5 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 7c1c5aa2bd7a..ff9246a3bb55 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11420,6 +11420,12 @@
       fingerprint = "85F8 E850 F8F2 F823 F934  535B EC50 6589 9AEA AF4C";
     }];
   };
+  yuka = {
+    email = "yuka@yuka.dev";
+    github = "yu-re-ka";
+    githubId = 86169957;
+    name = "Yureka";
+  };
   yusdacra = {
     email = "y.bera003.06@protonmail.com";
     github = "yusdacra";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index e14b5b3e9b32..1cfbe7b4b825 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -136,6 +136,7 @@ with lib.maintainers; {
       mmilata
       petabyteboy
       ryantm
+      yuka
     ];
     scope = "Maintain Jitsi.";
   };
diff --git a/pkgs/applications/version-management/gitlab/default.nix b/pkgs/applications/version-management/gitlab/default.nix
index 225b9f6c0cb7..fffe8894405e 100644
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@@ -191,7 +191,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     homepage = "http://www.gitlab.com/";
     platforms = platforms.linux;
-    maintainers = with maintainers; [ fpletz globin krav talyz ];
+    maintainers = with maintainers; [ fpletz globin krav talyz yuka ];
   } // (if gitlabEnterprise then
     {
       license = licenses.unfreeRedistributable; # https://gitlab.com/gitlab-org/gitlab-ee/raw/master/LICENSE
diff --git a/pkgs/servers/pleroma/default.nix b/pkgs/servers/pleroma/default.nix
index 25d2da632438..01608f1ca464 100644
--- a/pkgs/servers/pleroma/default.nix
+++ b/pkgs/servers/pleroma/default.nix
@@ -218,7 +218,7 @@ beamPackages.mixRelease rec {
     description = "ActivityPub microblogging server";
     homepage = https://git.pleroma.social/pleroma/pleroma;
     license = licenses.agpl3;
-    maintainers = with maintainers; [ petabyteboy ninjatrappeur ];
+    maintainers = with maintainers; [ petabyteboy ninjatrappeur yuka ];
     platforms = [ "x86_64-linux" "aarch64-linux" ];
   };
 }
diff --git a/pkgs/tools/misc/coreboot-utils/default.nix b/pkgs/tools/misc/coreboot-utils/default.nix
index d1735268224a..a8c0f7f8378f 100644
--- a/pkgs/tools/misc/coreboot-utils/default.nix
+++ b/pkgs/tools/misc/coreboot-utils/default.nix
@@ -7,7 +7,7 @@ let
     description = "Various coreboot-related tools";
     homepage = "https://www.coreboot.org";
     license = licenses.gpl2;
-    maintainers = with maintainers; [ petabyteboy felixsinger ];
+    maintainers = with maintainers; [ petabyteboy felixsinger yuka ];
     platforms = platforms.linux;
   };
 

From b27eaa18b47b77fbbf9f3bd7a17046b2d64b637b Mon Sep 17 00:00:00 2001
From: Thiago Franco de Moraes <totonixsame@gmail.com>
Date: Tue, 22 Jun 2021 06:18:18 -0300
Subject: [PATCH 380/416] gdcm: 3.0.8 -> 3.0.9 (#122654)

* gdcm: 3.0.8 -> 3.0.9

- make use of VTK optional (enabled by default)
- use vtk instead of vtk_7
- fetching source code from GitHub (sourceforge doesn't have the last
  version).
- nixpkgs-fmt

* Update pkgs/development/libraries/gdcm/default.nix

* Update pkgs/development/libraries/gdcm/default.nix

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
---
 pkgs/development/libraries/gdcm/default.nix | 51 +++++++++++----------
 pkgs/top-level/all-packages.nix             |  4 +-
 2 files changed, 31 insertions(+), 24 deletions(-)

diff --git a/pkgs/development/libraries/gdcm/default.nix b/pkgs/development/libraries/gdcm/default.nix
index 75ce95e0e46b..86d80a529d59 100644
--- a/pkgs/development/libraries/gdcm/default.nix
+++ b/pkgs/development/libraries/gdcm/default.nix
@@ -1,40 +1,45 @@
-{ lib, stdenv, fetchurl, cmake, vtk_7, darwin
-, enablePython ? false, python ? null,  swig ? null}:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, enableVTK ? true
+, vtk
+, ApplicationServices
+, Cocoa
+, enablePython ? false
+, python
+, swig
+}:
 
 stdenv.mkDerivation rec {
-  version = "3.0.8";
   pname = "gdcm";
+  version = "3.0.9";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/gdcm/${pname}-${version}.tar.bz2";
-    sha256 = "1q9p0r7wszn51yak9wdp61fd9i0wj3f8ja2frmhk7d1gxic7j1rk";
+  src = fetchFromGitHub {
+    owner = "malaterre";
+    repo = "GDCM";
+    rev = "v${version}";
+    sha256 = "sha256-wqrM8lxJM8VL+1QEdu6Gr1XWT1j9pT6gGd3yn1yokIY=";
   };
 
-  dontUseCmakeBuildDir = true;
-
   cmakeFlags = [
     "-DGDCM_BUILD_APPLICATIONS=ON"
     "-DGDCM_BUILD_SHARED_LIBS=ON"
+  ] ++ lib.optionals enableVTK [
     "-DGDCM_USE_VTK=ON"
-  ]
-  ++ lib.optional enablePython [
+  ] ++ lib.optionals enablePython [
     "-DGDCM_WRAP_PYTHON:BOOL=ON"
     "-DGDCM_INSTALL_PYTHONMODULE_DIR=${placeholder "out"}/${python.sitePackages}"
   ];
 
-  preConfigure = ''
-    cmakeDir=$PWD
-    mkdir ../build
-    cd ../build
-  '';
-
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ vtk_7 ]
-    ++ lib.optional stdenv.isDarwin [
-      darwin.apple_sdk.frameworks.ApplicationServices
-      darwin.apple_sdk.frameworks.Cocoa
-    ] ++ lib.optional enablePython [ swig python ];
-  propagatedBuildInputs = [ ];
+
+  buildInputs = lib.optionals enableVTK [
+    vtk
+  ] ++ lib.optionals stdenv.isDarwin [
+    ApplicationServices
+    Cocoa
+  ] ++ lib.optionals enablePython [ swig python ];
 
   meta = with lib; {
     description = "The grassroots cross-platform DICOM implementation";
@@ -44,6 +49,6 @@ stdenv.mkDerivation rec {
     '';
     homepage = "http://gdcm.sourceforge.net/";
     license = with licenses; [ bsd3 asl20 ];
-    platforms = platforms.all;
+    maintainers = with maintainers; [ tfmoraes ];
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9cbd058bb58f..94bdde6df093 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15107,7 +15107,9 @@ in
 
   gdal_2 = callPackage ../development/libraries/gdal/2.4.nix { };
 
-  gdcm = callPackage ../development/libraries/gdcm { };
+  gdcm = callPackage ../development/libraries/gdcm {
+    inherit (darwin.apple_sdk.frameworks) ApplicationServices Cocoa;
+  };
 
   ggz_base_libs = callPackage ../development/libraries/ggz_base_libs {};
 

From 15323be0aaad12b62fd86eb4ead95ce7bfdff654 Mon Sep 17 00:00:00 2001
From: Emile <mail@emile.space>
Date: Tue, 22 Jun 2021 11:20:20 +0200
Subject: [PATCH 381/416] maintainers: add hanemile

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 7c1c5aa2bd7a..0b7e3666b48e 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -4017,6 +4017,12 @@
     githubId = 1742172;
     name = "Hamish Hutchings";
   };
+  hanemile = {
+    email = "mail@emile.space";
+    github = "hanemile";
+    githubId = 22756350;
+    name = "Emile Hansmaennel";
+  };
   hansjoergschurr = {
     email = "commits@schurr.at";
     github = "hansjoergschurr";

From c118430db0d4e2540f1d5783ebef89a4562f728f Mon Sep 17 00:00:00 2001
From: Emile <mail@emile.space>
Date: Tue, 22 Jun 2021 11:24:57 +0200
Subject: [PATCH 382/416] notify: init at 0.0.2

---
 pkgs/tools/misc/notify/default.nix | 37 ++++++++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix    |  2 ++
 2 files changed, 39 insertions(+)
 create mode 100644 pkgs/tools/misc/notify/default.nix

diff --git a/pkgs/tools/misc/notify/default.nix b/pkgs/tools/misc/notify/default.nix
new file mode 100644
index 000000000000..0d7e6af8363f
--- /dev/null
+++ b/pkgs/tools/misc/notify/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "notify";
+  version = "0.0.2";
+
+  src = fetchFromGitHub {
+    owner = "projectdiscovery";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1nlsl4himxs5jv0fcd48jkwjnmn1w3alp0dcm1awmp6702zrsgqj";
+  };
+
+  vendorSha256 = "13dz0sk3561hrixsl1ghr9y0pzap2a8zrlbzzb7zs7550snbdcyg";
+
+  modRoot = ".";
+  subPackages = [
+    "cmd/notify/"
+  ];
+
+  # Test files are not part of the release tarball
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Notify allows sending the output from any tool to Slack, Discord and Telegram";
+    longDescription = ''
+      Notify is a helper utility written in Go that allows you to post the output from any tool
+      to Slack, Discord, and Telegram.
+    '';
+    homepage = "https://github.com/projectdiscovery/notify";
+    license = licenses.mit;
+    maintainers = with maintainers; [ hanemile ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9cbd058bb58f..af86f48e564b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3069,6 +3069,8 @@ in
     inherit (darwin.apple_sdk.frameworks) Cocoa;
   };
 
+  notify = callPackage ../tools/misc/notify { };
+
   nrsc5 = callPackage ../applications/misc/nrsc5 { };
 
   nwipe = callPackage ../tools/security/nwipe { };

From d2b489b24ae30278ad31e06801c3853b0edbbd9d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <dev@schuetz-co.de>
Date: Tue, 22 Jun 2021 11:36:09 +0200
Subject: [PATCH 383/416] imagemagick6: 6.9.12-15 -> 6.9.12-16

---
 pkgs/applications/graphics/ImageMagick/6.x.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/graphics/ImageMagick/6.x.nix b/pkgs/applications/graphics/ImageMagick/6.x.nix
index d0f5ecf4115e..bab1d6cfab74 100644
--- a/pkgs/applications/graphics/ImageMagick/6.x.nix
+++ b/pkgs/applications/graphics/ImageMagick/6.x.nix
@@ -16,13 +16,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "imagemagick";
-  version = "6.9.12-15";
+  version = "6.9.12-16";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick6";
     rev = version;
-    sha256 = "sha256-bel4p45eQfQPIp5/sawhTYTfyuYRQ5nFuGh4qqt1zDs=";
+    sha256 = "sha256-kg8vt88G6huRbJlVYztKxHiFPhGz/QHuNKtbhmai790=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big

From b23217f3b20275b2a20d44fd24ea96523ae6e879 Mon Sep 17 00:00:00 2001
From: Marco A L Barbosa <malbarbo@gmail.com>
Date: Fri, 18 Jun 2021 18:49:03 -0300
Subject: [PATCH 384/416] wasm3: init at 0.5.0

---
 .../interpreters/wasm3/default.nix            | 33 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 ++
 2 files changed, 35 insertions(+)
 create mode 100644 pkgs/development/interpreters/wasm3/default.nix

diff --git a/pkgs/development/interpreters/wasm3/default.nix b/pkgs/development/interpreters/wasm3/default.nix
new file mode 100644
index 000000000000..b16dc78ac08e
--- /dev/null
+++ b/pkgs/development/interpreters/wasm3/default.nix
@@ -0,0 +1,33 @@
+{ lib, stdenv, cmake, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "wasm3";
+  version = "0.5.0";
+
+  src = fetchFromGitHub {
+    owner = "wasm3";
+    repo = "wasm3";
+    rev = "v${version}";
+    sha256 = "07zzmk776j8ydyxhrnnjiscbhhmz182a62r6aix6kfk5kq2cwia2";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  cmakeFlags = [
+    "-DBUILD_WASI=simple"
+  ];
+
+  installPhase = ''
+    runHook preInstal
+    install -Dm755 wasm3 -t $out/bin
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/wasm3/wasm3";
+    description = "The fastest WebAssembly interpreter, and the most universal runtime.";
+    platforms = platforms.all;
+    maintainers = with maintainers; [ malbarbo ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 45baaaa3099f..4f80f73cb5a5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12658,6 +12658,8 @@ in
 
   wasm = ocamlPackages.wasm;
 
+  wasm3 = callPackage ../development/interpreters/wasm3 { };
+
   proglodyte-wasm = callPackage ../development/interpreters/proglodyte-wasm { };
 
 

From 767b0a628df05b250e411597a94f435924520b26 Mon Sep 17 00:00:00 2001
From: Marco A L Barbosa <malbarbo@gmail.com>
Date: Tue, 22 Jun 2021 07:49:55 -0300
Subject: [PATCH 385/416] tmux: fix cross compiling

---
 pkgs/tools/misc/tmux/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/tools/misc/tmux/default.nix b/pkgs/tools/misc/tmux/default.nix
index c76912e3c909..90273068f3ec 100644
--- a/pkgs/tools/misc/tmux/default.nix
+++ b/pkgs/tools/misc/tmux/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchFromGitHub
+, fetchpatch
 , autoreconfHook
 , pkg-config
 , bison
@@ -31,6 +32,14 @@ stdenv.mkDerivation rec {
     sha256 = "0143ylfk7zsl3xmiasb768238gr582cfhsgv3p0h0f13bp8d6q09";
   };
 
+  patches = [
+    # See https://github.com/tmux/tmux/pull/2755
+    (fetchpatch {
+      url = "https://github.com/tmux/tmux/commit/d0a2683120ec5a33163a14b0e1b39d208745968f.patch";
+      sha256 = "070knpncxfxi6k4q64jwi14ns5vm3606cf402h1c11cwnaa84n1g";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
     autoreconfHook

From c7da7a59927559c541a5f1669d76618c6fb43987 Mon Sep 17 00:00:00 2001
From: hlolli <hlolli@gmail.com>
Date: Tue, 22 Jun 2021 13:57:01 +0200
Subject: [PATCH 386/416] zx: init at 1.14.2

---
 .../node-packages/node-packages.json          |   1 +
 .../node-packages/node-packages.nix           | 159 ++++++++++++------
 2 files changed, 109 insertions(+), 51 deletions(-)

diff --git a/pkgs/development/node-packages/node-packages.json b/pkgs/development/node-packages/node-packages.json
index 6c90e0089ce9..ea8f2ef7a181 100644
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@@ -274,4 +274,5 @@
 , "yaml-language-server"
 , "yarn"
 , "yo"
+, "zx"
 ]
diff --git a/pkgs/development/node-packages/node-packages.nix b/pkgs/development/node-packages/node-packages.nix
index 7645954b1eb3..438a0b56c188 100644
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@@ -1507,13 +1507,13 @@ let
         sha512 = "Xl8SPYtdjcMoCsIM4teyVRg7jIcgl8F2kRtoCcXuHzXswt9UxZCS6BzRo8fcnCuP6u2XtPgvyonmEPF57Kxo9Q==";
       };
     };
-    "@babel/standalone-7.14.6" = {
+    "@babel/standalone-7.14.7" = {
       name = "_at_babel_slash_standalone";
       packageName = "@babel/standalone";
-      version = "7.14.6";
+      version = "7.14.7";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@babel/standalone/-/standalone-7.14.6.tgz";
-        sha512 = "oAoSp82jhJFnXKybKTOj5QF04XxiDRyiiqrFToiU1udlBXuZoADlPmmnOcuqBrZxSNNUjzJIVK8vt838Qoqjxg==";
+        url = "https://registry.npmjs.org/@babel/standalone/-/standalone-7.14.7.tgz";
+        sha512 = "7RlfMPR4604SbYpj5zvs2ZK587hVhixgU9Pd9Vs8lB8KYtT3U0apXSf0vZXhy8XRh549eUmJOHXhWKTO3ObzOQ==";
       };
     };
     "@babel/template-7.14.5" = {
@@ -2497,6 +2497,15 @@ let
         sha512 = "UXepkOKCATJrhHGsxt+CGfpZy9zUn1q9mop5kfcXq1fBkTePxVNPOdnISlCbJFlCtld+pSLGyZCzr9/zVprFKA==";
       };
     };
+    "@grpc/grpc-js-1.3.3" = {
+      name = "_at_grpc_slash_grpc-js";
+      packageName = "@grpc/grpc-js";
+      version = "1.3.3";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.3.3.tgz";
+        sha512 = "KkKZrX3fVTBYCtUk8I+Y4xWaauEEOIR1mIGoPFUK8C+a9TTub5dmjowJpFGz0dqYj//wJcgVR9fqpoNhSYFfHQ==";
+      };
+    };
     "@grpc/proto-loader-0.5.6" = {
       name = "_at_grpc_slash_proto-loader";
       packageName = "@grpc/proto-loader";
@@ -3946,13 +3955,13 @@ let
         sha512 = "KiXfYPO/X24p7EYQjcjBTizoyfY3U8zPv68Rte0EtayW2ZSqIslLLpNNd2gteqdh0Q83mzSiESdhlQHd0Ckjjg==";
       };
     };
-    "@netlify/plugin-edge-handlers-1.11.18" = {
+    "@netlify/plugin-edge-handlers-1.11.19" = {
       name = "_at_netlify_slash_plugin-edge-handlers";
       packageName = "@netlify/plugin-edge-handlers";
-      version = "1.11.18";
+      version = "1.11.19";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@netlify/plugin-edge-handlers/-/plugin-edge-handlers-1.11.18.tgz";
-        sha512 = "hpZggKZ0xAGp5M++zjRaMPT+0Wr4DLi1dtPgWeF3XX1cwgxbdoAk///J24jyt0j89lW4s7GxobhJiVq82yuXew==";
+        url = "https://registry.npmjs.org/@netlify/plugin-edge-handlers/-/plugin-edge-handlers-1.11.19.tgz";
+        sha512 = "SAsVNIxF0asduPXbsr3wbyAB7lPZQxhG90EeOu0/Fo+BLhpO4g+6eH13I60qJpWCI/ucXXqSrUw8y6Oy5wpY0g==";
       };
     };
     "@netlify/plugins-list-2.16.0" = {
@@ -3982,13 +3991,13 @@ let
         sha512 = "YFi1Sf+ktQICS3tAKu7/uiGzLXgi8RNVwH9naUkziXwXQNH2oxDhKgy0/Zv5Nw0zMDJyKWrJ3xObWEC57mJ/KA==";
       };
     };
-    "@netlify/zip-it-and-ship-it-4.4.1" = {
+    "@netlify/zip-it-and-ship-it-4.4.2" = {
       name = "_at_netlify_slash_zip-it-and-ship-it";
       packageName = "@netlify/zip-it-and-ship-it";
-      version = "4.4.1";
+      version = "4.4.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@netlify/zip-it-and-ship-it/-/zip-it-and-ship-it-4.4.1.tgz";
-        sha512 = "qV70DLxcbZ66mAThWfLd5nGchiTAGTn68yDLnpWNvqjUJTzEg76EQopVJTHcX5Eu4YmK60+MpLmkkdJ4tgjycA==";
+        url = "https://registry.npmjs.org/@netlify/zip-it-and-ship-it/-/zip-it-and-ship-it-4.4.2.tgz";
+        sha512 = "627ZNqfc4mdhU5mYDpcKUbmx8RoAUu8ZQiW/RIt5s7uDhruba3bK776Ygzog5b14hYWthT41/bf+9wQ+O9NFWw==";
       };
     };
     "@node-red/editor-api-1.3.5" = {
@@ -16978,13 +16987,13 @@ let
         sha1 = "c20b96d8c617748aaf1c16021760cd27fcb8cb75";
       };
     };
-    "constructs-3.3.85" = {
+    "constructs-3.3.86" = {
       name = "constructs";
       packageName = "constructs";
-      version = "3.3.85";
+      version = "3.3.86";
       src = fetchurl {
-        url = "https://registry.npmjs.org/constructs/-/constructs-3.3.85.tgz";
-        sha512 = "Or1CtFHhDLWEO64nFtDGStVSZKu0iOkxJ0y90elLR2zVkkFU7l3VujXRuJxY5Tb1SeuN0hSueC7SnMegFLafcw==";
+        url = "https://registry.npmjs.org/constructs/-/constructs-3.3.86.tgz";
+        sha512 = "y1EKluD1jl6jilmL2VH3B6qUADwJ+QqRpwfYe3y/WSKK283wr1apZPiwApm001n07Jg2ObXhPKep57xP5LLZ2w==";
       };
     };
     "consume-http-header-1.0.0" = {
@@ -32787,13 +32796,13 @@ let
         sha512 = "ChFg5qhvxCaM2bspCqizs48yMtsm5YLHjBoNZLCkbXyc3yMM5l8pnn787B5ww5TI3+tKxKYWkbiKf356kQ1OgQ==";
       };
     };
-    "jsii-srcmak-0.1.288" = {
+    "jsii-srcmak-0.1.289" = {
       name = "jsii-srcmak";
       packageName = "jsii-srcmak";
-      version = "0.1.288";
+      version = "0.1.289";
       src = fetchurl {
-        url = "https://registry.npmjs.org/jsii-srcmak/-/jsii-srcmak-0.1.288.tgz";
-        sha512 = "AyflsuwbsTyH6fChU9v82eTF74eNN07B8gxzpaB6IQyJPv5EADDR92/FjJKWq1dPM18f6s+GhTPE1DlbhcXrXw==";
+        url = "https://registry.npmjs.org/jsii-srcmak/-/jsii-srcmak-0.1.289.tgz";
+        sha512 = "nfOMq2qcf2JymxhEm79wehmyBiM35w5tQdnn5KR4IuYPML8HfUA3GT+1/d/xlaUAzQc0eguWIZqYczlmkScoKw==";
       };
     };
     "json-bigint-0.2.3" = {
@@ -33093,13 +33102,13 @@ let
         sha512 = "0/4Lv6IenJV0qj2oBdgPIAmFiKKnh8qh7bmLFJ+/ZZHLjSeiL3fKKGX3UryvKPbxFbhV+JcYo9KUC19GJ/Z/4A==";
       };
     };
-    "json2jsii-0.1.255" = {
+    "json2jsii-0.1.256" = {
       name = "json2jsii";
       packageName = "json2jsii";
-      version = "0.1.255";
+      version = "0.1.256";
       src = fetchurl {
-        url = "https://registry.npmjs.org/json2jsii/-/json2jsii-0.1.255.tgz";
-        sha512 = "I3BktDqYogR4XQ+O6/AQ//+OHCTeqPGxUTUJ5qiBjzEBxXkdhhYle+7P5GttUKM8YsKbRhDaqigCzY7rU0yGsg==";
+        url = "https://registry.npmjs.org/json2jsii/-/json2jsii-0.1.256.tgz";
+        sha512 = "6DyDhvjKJXM9K6XTxEwVhl2LAyRHSt6+guVyRWVvjYbIYprMQsN59y6wzmdNBBtJZJr/Gj5lytNNWn6NMS9Lcg==";
       };
     };
     "json3-3.2.6" = {
@@ -52259,6 +52268,15 @@ let
         sha512 = "oXF8tfxx5cDk8r2kYqlkUJzZpDBqVY/II2WhvU0n9Y3XYvAYRmeaf1PvvIvTgPnv4KJ+ES5M0PyDq5Jp+Ygy2g==";
       };
     };
+    "shq-1.0.2" = {
+      name = "shq";
+      packageName = "shq";
+      version = "1.0.2";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/shq/-/shq-1.0.2.tgz";
+        sha512 = "8AvNyHL75DHlkbLmzF7nzTzT2F0qEfSewwxHjH79Ww8S+hGpIZVlf8b0TcdOwv4HqIkOVBInu9n+wqhUSl9Wag==";
+      };
+    };
     "shush-1.0.0" = {
       name = "shush";
       packageName = "shush";
@@ -54293,13 +54311,13 @@ let
         sha512 = "zZ/Q1M+9ZWlrchgh4QauD/MEUFa6eC6H6FYq6T8Of/y82JqsQBLwN6YlzbO09evE7Rx6x0oliXDCnQSjwGwQRA==";
       };
     };
-    "sscaff-1.2.8" = {
+    "sscaff-1.2.9" = {
       name = "sscaff";
       packageName = "sscaff";
-      version = "1.2.8";
+      version = "1.2.9";
       src = fetchurl {
-        url = "https://registry.npmjs.org/sscaff/-/sscaff-1.2.8.tgz";
-        sha512 = "7cbC6S1FMmMbQqqdg51+9roaDE+g0ynHA3flW4vQl4zAq9nHvK4kXKr3qptmfAIaU6rLHKsP/ZsLfQCAouWgTw==";
+        url = "https://registry.npmjs.org/sscaff/-/sscaff-1.2.9.tgz";
+        sha512 = "BcOsAZGTh/vo0DArPc/MiJf6DYvC29fIH5b+sIzEFpz5vKPHp1RPOoVyhYpafPW45+xN9oKde6YfvaKaHvtBPw==";
       };
     };
     "ssh-config-1.1.6" = {
@@ -69663,7 +69681,7 @@ in
       sources."color-name-1.1.4"
       sources."colors-1.4.0"
       sources."commonmark-0.29.3"
-      sources."constructs-3.3.85"
+      sources."constructs-3.3.86"
       sources."date-format-3.0.0"
       sources."debug-4.3.2"
       sources."decamelize-5.0.0"
@@ -69736,13 +69754,13 @@ in
           sources."yargs-16.2.0"
         ];
       })
-      (sources."jsii-srcmak-0.1.288" // {
+      (sources."jsii-srcmak-0.1.289" // {
         dependencies = [
           sources."fs-extra-9.1.0"
         ];
       })
       sources."json-schema-0.3.0"
-      sources."json2jsii-0.1.255"
+      sources."json2jsii-0.1.256"
       sources."jsonfile-6.1.0"
       sources."jsonschema-1.4.0"
       sources."locate-path-5.0.0"
@@ -69778,7 +69796,7 @@ in
       sources."snake-case-3.0.4"
       sources."sort-json-2.0.0"
       sources."spdx-license-list-6.4.0"
-      sources."sscaff-1.2.8"
+      sources."sscaff-1.2.9"
       (sources."streamroller-2.2.4" // {
         dependencies = [
           sources."date-format-2.1.0"
@@ -69893,7 +69911,7 @@ in
       sources."commonmark-0.29.3"
       sources."compress-commons-4.1.1"
       sources."concat-map-0.0.1"
-      sources."constructs-3.3.85"
+      sources."constructs-3.3.86"
       sources."convert-to-spaces-1.0.2"
       sources."core-util-is-1.0.2"
       sources."crc-32-1.2.0"
@@ -70012,7 +70030,7 @@ in
           sources."yargs-16.2.0"
         ];
       })
-      (sources."jsii-srcmak-0.1.288" // {
+      (sources."jsii-srcmak-0.1.289" // {
         dependencies = [
           sources."fs-extra-9.1.0"
           sources."jsonfile-6.1.0"
@@ -70095,7 +70113,7 @@ in
       sources."slice-ansi-3.0.0"
       sources."sort-json-2.0.0"
       sources."spdx-license-list-6.4.0"
-      sources."sscaff-1.2.8"
+      sources."sscaff-1.2.9"
       sources."stack-utils-2.0.3"
       sources."stream-buffers-3.0.2"
       (sources."streamroller-2.2.4" // {
@@ -81584,10 +81602,10 @@ in
   firebase-tools = nodeEnv.buildNodePackage {
     name = "firebase-tools";
     packageName = "firebase-tools";
-    version = "9.13.1";
+    version = "9.14.0";
     src = fetchurl {
-      url = "https://registry.npmjs.org/firebase-tools/-/firebase-tools-9.13.1.tgz";
-      sha512 = "o8sdTxKtZOG1BJ8SmIHLbwJPkp+C25uUWq7Gcu5+Ksc1obHKKa8dYSH2kEC56gXyoGL5vmGdM8UUDTe7oUy4KA==";
+      url = "https://registry.npmjs.org/firebase-tools/-/firebase-tools-9.14.0.tgz";
+      sha512 = "CHR1Xw5LJ+hDQ/SaRqvuNXJEmpbPsOEtNRj6oD44VFGRp9ZTjY3irilSj6uv7S2P1A1XLEGyO7jEpCH5mkc9RQ==";
     };
     dependencies = [
       (sources."@apidevtools/json-schema-ref-parser-9.0.9" // {
@@ -81605,7 +81623,7 @@ in
           sources."google-auth-library-7.1.2"
         ];
       })
-      sources."@grpc/grpc-js-1.3.2"
+      sources."@grpc/grpc-js-1.3.3"
       sources."@grpc/proto-loader-0.6.2"
       sources."@jsdevtools/ono-7.1.3"
       (sources."@npmcli/move-file-1.1.2" // {
@@ -83489,7 +83507,7 @@ in
       sources."@babel/plugin-transform-parameters-7.14.5"
       sources."@babel/plugin-transform-react-jsx-7.14.5"
       sources."@babel/runtime-7.14.6"
-      sources."@babel/standalone-7.14.6"
+      sources."@babel/standalone-7.14.7"
       sources."@babel/template-7.14.5"
       sources."@babel/traverse-7.14.5"
       sources."@babel/types-7.14.5"
@@ -93550,10 +93568,10 @@ in
   mastodon-bot = nodeEnv.buildNodePackage {
     name = "mastodon-bot";
     packageName = "mastodon-bot";
-    version = "1.10.12-20210326145549";
+    version = "1.11.0";
     src = fetchurl {
-      url = "https://registry.npmjs.org/mastodon-bot/-/mastodon-bot-1.10.12-20210326145549.tgz";
-      sha512 = "buuQt4rao3Vsq0og+WM8vrcVdD1vy1jhh8Vj6CynGuZ2BSY8fcyJKlPLkd3IK5xIJe3h+Iqnfx364eqmjwpw/Q==";
+      url = "https://registry.npmjs.org/mastodon-bot/-/mastodon-bot-1.11.0.tgz";
+      sha512 = "ZJiVQ87TLyJ+px5fqxlqL4Ho8Ii3v9WduD7Srs9mD2iCnKwSockDXocdWfUv5Bx70Z8/3NJDRIurlRPMAqbAvg==";
     };
     dependencies = [
       sources."acorn-5.7.4"
@@ -93747,6 +93765,7 @@ in
       sources."natural-compare-1.4.0"
       sources."next-tick-1.0.0"
       sources."node-addon-api-1.7.2"
+      sources."node-fetch-2.6.1"
       sources."number-is-nan-1.0.1"
       sources."oauth-0.9.15"
       sources."oauth-sign-0.9.0"
@@ -94583,10 +94602,10 @@ in
   netlify-cli = nodeEnv.buildNodePackage {
     name = "netlify-cli";
     packageName = "netlify-cli";
-    version = "3.37.37";
+    version = "3.37.38";
     src = fetchurl {
-      url = "https://registry.npmjs.org/netlify-cli/-/netlify-cli-3.37.37.tgz";
-      sha512 = "N07WvfR41K0rp2+f4ZvlU6WzoytKe3TPWvcHMrUeiXSPnMliMV/ggrU3zoUWSjPjfBh8CabBRbNbyySjgrR9WQ==";
+      url = "https://registry.npmjs.org/netlify-cli/-/netlify-cli-3.37.38.tgz";
+      sha512 = "huXGW0QZpqNQ8hFE2JfWl5hMhqtEXU05vMsa91ldL0b5JLoh7/9+xQGhfiHvlT3PMGNznc1ToBSN+6Fp0rJ1BQ==";
     };
     dependencies = [
       sources."@babel/code-frame-7.14.5"
@@ -94770,7 +94789,7 @@ in
         ];
       })
       sources."@netlify/open-api-2.5.0"
-      (sources."@netlify/plugin-edge-handlers-1.11.18" // {
+      (sources."@netlify/plugin-edge-handlers-1.11.19" // {
         dependencies = [
           sources."@types/node-14.17.3"
         ];
@@ -94782,7 +94801,7 @@ in
           sources."execa-3.4.0"
         ];
       })
-      (sources."@netlify/zip-it-and-ship-it-4.4.1" // {
+      (sources."@netlify/zip-it-and-ship-it-4.4.2" // {
         dependencies = [
           sources."cliui-7.0.4"
           sources."cp-file-9.1.0"
@@ -106906,10 +106925,10 @@ in
   snyk = nodeEnv.buildNodePackage {
     name = "snyk";
     packageName = "snyk";
-    version = "1.639.0";
+    version = "1.640.0";
     src = fetchurl {
-      url = "https://registry.npmjs.org/snyk/-/snyk-1.639.0.tgz";
-      sha512 = "kGmk2T9DoxxGrLDJX0PvXp0ktR0rb1PE5kD6mAsafqhvzfGbNCUJTtPPD/Wy/pbf5jAjHryFYX/KRW9bMXIFGQ==";
+      url = "https://registry.npmjs.org/snyk/-/snyk-1.640.0.tgz";
+      sha512 = "cVBEX4+JxzqcIn/S726VYwbRXzERy/KBxeu9LE1b/WSDe0SNX6ejOl8LGORCk0No2RIJLLAgkmrBZSeSS+AeHw==";
     };
     dependencies = [
       sources."@arcanis/slice-ansi-1.0.2"
@@ -118550,4 +118569,42 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
+  zx = nodeEnv.buildNodePackage {
+    name = "zx";
+    packageName = "zx";
+    version = "1.14.2";
+    src = fetchurl {
+      url = "https://registry.npmjs.org/zx/-/zx-1.14.2.tgz";
+      sha512 = "omgqRVve+5dqbFrogFSjJXLUCUr4xHF2Gan+Njn/z4fumhIj3tMTFEA9iV+HgiobZ5Mgl5N96z4S4fwhaas4Pw==";
+    };
+    dependencies = [
+      sources."@types/node-15.12.4"
+      sources."@types/node-fetch-2.5.10"
+      sources."ansi-styles-4.3.0"
+      sources."asynckit-0.4.0"
+      sources."chalk-4.1.1"
+      sources."color-convert-2.0.1"
+      sources."color-name-1.1.4"
+      sources."combined-stream-1.0.8"
+      sources."delayed-stream-1.0.0"
+      sources."form-data-3.0.1"
+      sources."has-flag-4.0.0"
+      sources."isexe-2.0.0"
+      sources."mime-db-1.48.0"
+      sources."mime-types-2.1.31"
+      sources."node-fetch-2.6.1"
+      sources."shq-1.0.2"
+      sources."supports-color-7.2.0"
+      sources."which-2.0.2"
+    ];
+    buildInputs = globalBuildInputs;
+    meta = {
+      description = "A tool for writing better scripts";
+      homepage = "https://github.com/google/zx#readme";
+      license = "Apache-2.0";
+    };
+    production = true;
+    bypassCache = true;
+    reconstructLock = true;
+  };
 }

From ad5deab11a9c2304d5a8b3497b092bcbd2015d6c Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Tue, 22 Jun 2021 14:01:18 +0200
Subject: [PATCH 387/416] doc/functions/generators: fix code block

Small fixup of 606bf6d.
---
 doc/functions/generators.section.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/functions/generators.section.md b/doc/functions/generators.section.md
index bb8426d8087b..d54e5027c799 100644
--- a/doc/functions/generators.section.md
+++ b/doc/functions/generators.section.md
@@ -49,7 +49,7 @@ str\:ange:"very::strange"
 merge:"diff3"
 ```
 
-::: note
+::: {.note}
 Nix store paths can be converted to strings by enclosing a derivation attribute like so: `"${drv}"`.
 :::
 

From ba602382e13158d7a69f0199d09626867cadb5f0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Favier?= <n@monade.li>
Date: Tue, 22 Jun 2021 14:10:56 +0200
Subject: [PATCH 388/416] xorg: regenerate default.nix

---
 pkgs/servers/x11/xorg/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index ed6108d51480..d28adce2b186 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -571,11 +571,11 @@ lib.makeScope newScope (self: with self; {
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fonttosfnt = callPackage ({ stdenv, pkg-config, fetchurl, libfontenc, freetype, xorgproto }: stdenv.mkDerivation {
-    name = "fonttosfnt-1.2.1";
+    name = "fonttosfnt-1.2.2";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/app/fonttosfnt-1.2.1.tar.bz2";
-      sha256 = "16r51h5wfy85wnbq3q8v8a184hb25c3ksjgix0mlcywdz7qkbj07";
+      url = "mirror://xorg/individual/app/fonttosfnt-1.2.2.tar.bz2";
+      sha256 = "0r1s43ypy0a9z6hzdq5y02s2acj965rax4flwdyylvc54ppv86qs";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkg-config ];

From e0c9a230ced1cf06a58733db88741c8a6607dd30 Mon Sep 17 00:00:00 2001
From: Francesco Gazzetta <fgaz@fgaz.me>
Date: Tue, 22 Jun 2021 14:37:25 +0200
Subject: [PATCH 389/416] twemoji-color-font: 13.0.1 -> 13.1.0

---
 pkgs/data/fonts/twemoji-color-font/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/data/fonts/twemoji-color-font/default.nix b/pkgs/data/fonts/twemoji-color-font/default.nix
index a2fde6813b78..ae1d3f9927fb 100644
--- a/pkgs/data/fonts/twemoji-color-font/default.nix
+++ b/pkgs/data/fonts/twemoji-color-font/default.nix
@@ -5,20 +5,20 @@
 
 stdenv.mkDerivation rec {
   pname = "twemoji-color-font";
-  version = "13.0.1";
+  version = "13.1.0";
 
   # We fetch the prebuilt font because building it takes 1.5 hours on hydra.
   # Relevant issue: https://github.com/NixOS/nixpkgs/issues/97871
   src = fetchurl {
     url = "https://github.com/eosrei/twemoji-color-font/releases/download/v${version}/TwitterColorEmoji-SVGinOT-Linux-${version}.tar.gz";
-    sha256 = "1mn2cb6a3v0q8i81s9a8bk49nbwxq91n6ki7827i7rhjkncb0mbn";
+    sha256 = "sha256-V8DWUUAK+HLDPcq3izPs174PfUnaSeLByDpZwhUIX5Q=";
   };
 
   dontBuild = true;
 
   installPhase = ''
     install -Dm755 TwitterColorEmoji-SVGinOT.ttf $out/share/fonts/truetype/TwitterColorEmoji-SVGinOT.ttf
-    install -Dm644 fontconfig/56-twemoji-color.conf $out/etc/fonts/conf.d/56-twemoji-color.conf
+    install -Dm644 fontconfig/46-twemoji-color.conf $out/etc/fonts/conf.d/46-twemoji-color.conf
   '';
 
   meta = with lib; {

From 76d2fd44d0039c4cba894af1fa8c47cc390764f5 Mon Sep 17 00:00:00 2001
From: Karl H <34152449+KarlJoad@users.noreply.github.com>
Date: Tue, 22 Jun 2021 08:01:20 -0500
Subject: [PATCH 390/416] octavePackages.nurbs: 1.3.13 -> 1.4.3 (#127758)

---
 pkgs/development/octave-modules/nurbs/default.nix | 13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/octave-modules/nurbs/default.nix b/pkgs/development/octave-modules/nurbs/default.nix
index e5e26d7bb952..fbd67a0a46a9 100644
--- a/pkgs/development/octave-modules/nurbs/default.nix
+++ b/pkgs/development/octave-modules/nurbs/default.nix
@@ -5,22 +5,13 @@
 
 buildOctavePackage rec {
   pname = "nurbs";
-  version = "1.3.13";
+  version = "1.4.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "0zkyldm63pc3pcal3yvj6af24cvpjvv9qfhf0ihhwcsh4w3yggyv";
+    sha256 = "16r05av75nvmkz1knf0nv0gj4fcjjf3jnyf94bdgxf84wahncim7";
   };
 
-  # Has been fixed in more recent commits, but has not been pushed out as a
-  # new version yet.
-  # The sed changes allow nurbs to compile.
-  patchPhase = ''
-    sed -i s/feval/octave::feval/g src/*.cc
-    sed -i s/is_real_type/isreal/g src/*.cc
-    sed -i s/is_cell/iscell/g src/*.cc
-  '';
-
   meta = with lib; {
     homepage = "https://octave.sourceforge.io/nurbs/index.html";
     license = licenses.gpl3Plus;

From 1fcd4e74c40bce98e472942c602ca9763f80de8c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Stanis=C5=82aw=20Barzowski?= <stanislaw.barzowski@gmail.com>
Date: Tue, 22 Jun 2021 15:11:35 +0200
Subject: [PATCH 391/416] Add JSON package to gitolite environment. (#127683)

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
Co-authored-by: Lassulus <github@lassul.us>
---
 pkgs/applications/version-management/gitolite/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/version-management/gitolite/default.nix b/pkgs/applications/version-management/gitolite/default.nix
index 8dd2766ff0ed..e9712a859d74 100644
--- a/pkgs/applications/version-management/gitolite/default.nix
+++ b/pkgs/applications/version-management/gitolite/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, git, lib, makeWrapper, nettools, perl }:
+{ stdenv, fetchFromGitHub, git, lib, makeWrapper, nettools, perl, perlPackages }:
 
 stdenv.mkDerivation rec {
   pname = "gitolite";
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     wrapProgram $out/bin/gitolite-shell \
-      --prefix PATH : ${lib.makeBinPath [ git perl ]}
+      --prefix PATH : ${lib.makeBinPath [ git (perl.withPackages (p: [ p.JSON ])) ]}
   '';
 
   installPhase = ''

From 26c6a366b80746767d08aa4b3e96413b29789fd8 Mon Sep 17 00:00:00 2001
From: sohalt <sohalt@sohalt.net>
Date: Tue, 22 Jun 2021 15:15:13 +0200
Subject: [PATCH 392/416] dpdk: fix typo in error message

---
 pkgs/top-level/all-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 658282ab3d8d..5b57c4537a2a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -20826,7 +20826,7 @@ in
 
     dpdk-kmods = callPackage ../os-specific/linux/dpdk-kmods { };
 
-    dpdk = throw "The dpdk driver has been renamed to dpdk-mods.";
+    dpdk = throw "The dpdk driver has been renamed to dpdk-kmods.";
 
     exfat-nofuse = callPackage ../os-specific/linux/exfat { };
 

From 5aad4e73b6c1152f381865ae138c4f5c883a4e75 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sun, 20 Jun 2021 23:12:11 +0200
Subject: [PATCH 393/416] privacyIDEA: 3.5.2 -> 3.6

ChangeLog: https://github.com/privacyidea/privacyidea/releases/tag/v3.6

Unfortunately we have to use `sqlalchemy` at 1.3 for `sqlsoup`. As
`sqlalchemy` is required by a lot of packages, I decided to move this
package out of `pythonPackages` itself and instantiate a new
`pythonPackages` inside the expression where `sqlalchemy` points to
`sqlalchemy_1_3`.
---
 .../modules/services/security/privacyidea.nix |  4 +-
 .../misc}/privacyidea/default.nix             | 44 +++++++++----------
 .../privacyidea/fix-tests.patch               | 28 ------------
 pkgs/top-level/all-packages.nix               |  2 +
 pkgs/top-level/python-aliases.nix             |  1 +
 pkgs/top-level/python-packages.nix            |  2 -
 6 files changed, 27 insertions(+), 54 deletions(-)
 rename pkgs/{development/python-modules => applications/misc}/privacyidea/default.nix (58%)
 delete mode 100644 pkgs/development/python-modules/privacyidea/fix-tests.patch

diff --git a/nixos/modules/services/security/privacyidea.nix b/nixos/modules/services/security/privacyidea.nix
index 2696dca4c767..63271848e943 100644
--- a/nixos/modules/services/security/privacyidea.nix
+++ b/nixos/modules/services/security/privacyidea.nix
@@ -7,7 +7,7 @@ let
 
   uwsgi = pkgs.uwsgi.override { plugins = [ "python3" ]; };
   python = uwsgi.python3;
-  penv = python.withPackages (ps: [ ps.privacyidea ]);
+  penv = python.withPackages (const [ pkgs.privacyidea ]);
   logCfg = pkgs.writeText "privacyidea-log.cfg" ''
     [formatters]
     keys=detail
@@ -194,7 +194,7 @@ in
 
     (mkIf cfg.enable {
 
-      environment.systemPackages = [ python.pkgs.privacyidea ];
+      environment.systemPackages = [ pkgs.privacyidea ];
 
       services.postgresql.enable = mkDefault true;
 
diff --git a/pkgs/development/python-modules/privacyidea/default.nix b/pkgs/applications/misc/privacyidea/default.nix
similarity index 58%
rename from pkgs/development/python-modules/privacyidea/default.nix
rename to pkgs/applications/misc/privacyidea/default.nix
index 11ff6f71af63..7545253d5066 100644
--- a/pkgs/development/python-modules/privacyidea/default.nix
+++ b/pkgs/applications/misc/privacyidea/default.nix
@@ -1,43 +1,43 @@
-{ lib, buildPythonPackage, fetchFromGitHub, cacert, openssl, python, nixosTests
-
-, cryptography, pyrad, pymysql, python-dateutil, flask-versioned, flask_script
-, defusedxml, croniter, flask_migrate, pyjwt1, configobj, sqlsoup, pillow
-, python-gnupg, passlib, pyopenssl, beautifulsoup4, smpplib, flask-babel
-, ldap3, huey, pyyaml, qrcode, oauth2client, requests, lxml, cbor2, psycopg2
-, pydash, ecdsa
-
-, mock, pytestCheckHook, responses, testfixtures
+{ lib, fetchFromGitHub, cacert, openssl, nixosTests
+, python3
 }:
 
-buildPythonPackage rec {
+let
+  python3' = python3.override {
+    packageOverrides = self: super: {
+      sqlalchemy = super.sqlalchemy.overridePythonAttrs (oldAttrs: rec {
+        version = "1.3.24";
+        src = oldAttrs.src.override {
+          inherit version;
+          sha256 = "ebbb777cbf9312359b897bf81ba00dae0f5cb69fba2a18265dcc18a6f5ef7519";
+        };
+      });
+    };
+  };
+in
+python3'.pkgs.buildPythonPackage rec {
   pname = "privacyIDEA";
-  version = "3.5.2";
+  version = "3.6";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-k2om2LjkFRCT53ECPAJEztCiMdz4fF5eoipVUvSoyGo=";
+    sha256 = "sha256-yywkQ3TdBzRMbJGY0Seaprztgt0JrCAbgqosMQ5fcQM=";
     fetchSubmodules = true;
   };
 
-  patches = [
-    # Subset of https://github.com/privacyidea/privacyidea/commit/359db6dd10212b8a210e0a83536e92e9e796a1f8,
-    # fixes app context errors in tests. Can be removed on the next bump.
-    ./fix-tests.patch
-  ];
-
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3'.pkgs; [
     cryptography pyrad pymysql python-dateutil flask-versioned flask_script
     defusedxml croniter flask_migrate pyjwt1 configobj sqlsoup pillow
     python-gnupg passlib pyopenssl beautifulsoup4 smpplib flask-babel
     ldap3 huey pyyaml qrcode oauth2client requests lxml cbor2 psycopg2
-    pydash ecdsa
+    pydash ecdsa google-auth importlib-metadata
   ];
 
   passthru.tests = { inherit (nixosTests) privacyidea; };
 
-  checkInputs = [ openssl mock pytestCheckHook responses testfixtures ];
+  checkInputs = with python3'.pkgs; [ openssl mock pytestCheckHook responses testfixtures ];
   disabledTests = [
     "AESHardwareSecurityModuleTestCase"
     "test_01_cert_request"
@@ -61,7 +61,7 @@ buildPythonPackage rec {
   '';
 
   postInstall = ''
-    rm -rf $out/${python.sitePackages}/tests
+    rm -r $out/${python3'.sitePackages}/tests
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/privacyidea/fix-tests.patch b/pkgs/development/python-modules/privacyidea/fix-tests.patch
deleted file mode 100644
index 67c22d2052e1..000000000000
--- a/pkgs/development/python-modules/privacyidea/fix-tests.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-diff --git a/privacyidea/lib/resolvers/LDAPIdResolver.py b/privacyidea/lib/resolvers/LDAPIdResolver.py
-index ae9d87764..cfc609931 100644
---- a/privacyidea/lib/resolvers/LDAPIdResolver.py
-+++ b/privacyidea/lib/resolvers/LDAPIdResolver.py
-@@ -97,11 +97,6 @@
- SERVERPOOL_ROUNDS = 2
- # The number of seconds a non-responding server is removed from the server pool
- SERVERPOOL_SKIP = 30
--# The number of seconds that ldap3 waits if no server is left in the pool, before
--# starting the next round
--pooling_loop_timeout = get_app_config_value("PI_LDAP_POOLING_LOOP_TIMEOUT", 10)
--log.info("Setting system wide POOLING_LOOP_TIMEOUT to {0!s}.".format(pooling_loop_timeout))
--ldap3.set_config_parameter("POOLING_LOOP_TIMEOUT", pooling_loop_timeout)
- 
- # 1 sec == 10^9 nano secs == 10^7 * (100 nano secs)
- MS_AD_MULTIPLYER = 10 ** 7
-@@ -314,6 +309,11 @@ def __init__(self):
-         self.serverpool_rounds = SERVERPOOL_ROUNDS
-         self.serverpool_skip = SERVERPOOL_SKIP
-         self.serverpool = None
-+        # The number of seconds that ldap3 waits if no server is left in the pool, before
-+        # starting the next round
-+        pooling_loop_timeout = get_app_config_value("PI_LDAP_POOLING_LOOP_TIMEOUT", 10)
-+        log.info("Setting system wide POOLING_LOOP_TIMEOUT to {0!s}.".format(pooling_loop_timeout))
-+        ldap3.set_config_parameter("POOLING_LOOP_TIMEOUT", pooling_loop_timeout)
- 
-     def checkPass(self, uid, password):
-         """
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 94bdde6df093..fa188087a445 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13902,6 +13902,8 @@ in
 
   premake = premake4;
 
+  privacyidea = callPackage ../applications/misc/privacyidea { };
+
   procodile = callPackage ../tools/system/procodile { };
 
   pry = callPackage ../development/tools/pry { };
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index b9c37c960908..5d9e8b1b124a 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -43,6 +43,7 @@ mapAliases ({
   googleapis_common_protos = googleapis-common-protos; # added 2021-03-19
   HAP-python = hap-python; # added 2021-06-01
   MechanicalSoup = mechanicalsoup; # added 2021-06-01
+  privacyidea = throw "renamed to pkgs.privacyidea"; # added 2021-06-20
   pylibgen = throw "pylibgen is unmaintained upstreamed, and removed from nixpkgs"; # added 2020-06-20
   pymssql = throw "pymssql has been abandoned upstream."; # added 2020-05-04
   pytest-pep8 = pytestpep8; # added 2021-01-04
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index c192dd109791..f5686850303d 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5471,8 +5471,6 @@ in {
 
   prison = callPackage ../development/python-modules/prison { };
 
-  privacyidea = callPackage ../development/python-modules/privacyidea { };
-
   pyjwt1 = callPackage ../development/python-modules/pyjwt/1.nix { };
 
   proboscis = callPackage ../development/python-modules/proboscis { };

From 9b2dbfc8ba6eadc90d1f2771bf789740c126019c Mon Sep 17 00:00:00 2001
From: Bruno Bigras <bigras.bruno@gmail.com>
Date: Tue, 22 Jun 2021 09:39:25 -0400
Subject: [PATCH 394/416] cloudflared: 2021.5.10 -> 2021.6.0

---
 pkgs/applications/networking/cloudflared/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cloudflared/default.nix b/pkgs/applications/networking/cloudflared/default.nix
index 153f0a9cb990..ed4ffffe451c 100644
--- a/pkgs/applications/networking/cloudflared/default.nix
+++ b/pkgs/applications/networking/cloudflared/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cloudflared";
-  version = "2021.5.10";
+  version = "2021.6.0";
 
   src = fetchFromGitHub {
     owner  = "cloudflare";
     repo   = "cloudflared";
     rev    = version;
-    sha256 = "sha256-v/ehqaI3TPhHACtxU8PRB9tGp8qrl6AN6buxOhJdevI=";
+    sha256 = "sha256-cX0kdBPDgwjHphxGWrnXohHPp1nzs4SnvCry4AxMtp0=";
   };
 
   vendorSha256 = null;

From a245e51814ac786586be8fd4d1b621f25306ebcf Mon Sep 17 00:00:00 2001
From: Karl H <34152449+KarlJoad@users.noreply.github.com>
Date: Tue, 22 Jun 2021 08:43:09 -0500
Subject: [PATCH 395/416] octavePackages.arduino: 0.6.0 -> 0.7.0 (#127746)

---
 pkgs/development/octave-modules/arduino/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/octave-modules/arduino/default.nix b/pkgs/development/octave-modules/arduino/default.nix
index f6536108e6cc..77089827c4b7 100644
--- a/pkgs/development/octave-modules/arduino/default.nix
+++ b/pkgs/development/octave-modules/arduino/default.nix
@@ -7,11 +7,11 @@
 
 buildOctavePackage rec {
   pname = "arduino";
-  version = "0.6.0";
+  version = "0.7.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "0fnfk206n31s7diijaylmqhxnr88z6l3l3vsxq4z8gcp9ylm9nkj";
+    sha256 = "0r0bcq2zkwba6ab6yi6czbhrj4adm9m9ggxmzzcd9h40ckqg6wjv";
   };
 
   requiredOctavePackages = [

From f185694128ddac40e1792c3e9a228cbd6fd83265 Mon Sep 17 00:00:00 2001
From: Karl H <34152449+KarlJoad@users.noreply.github.com>
Date: Tue, 22 Jun 2021 08:43:23 -0500
Subject: [PATCH 396/416] octavePackages.communications: 1.2.2 -> 1.2.3
 (#127747)

---
 pkgs/development/octave-modules/communications/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/octave-modules/communications/default.nix b/pkgs/development/octave-modules/communications/default.nix
index 492c837255f7..6c517ec6e5b6 100644
--- a/pkgs/development/octave-modules/communications/default.nix
+++ b/pkgs/development/octave-modules/communications/default.nix
@@ -7,11 +7,11 @@
 
 buildOctavePackage rec {
   pname = "communications";
-  version = "1.2.2";
+  version = "1.2.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "1xay2vjyadv3ja8dmqqzm2his8s0rvidz23nq1c2yl3xh1gavyck";
+    sha256 = "1r4r0cia5l5fann1n78c1qdc6q8nizgb09n2fdwb76xnwjan23g3";
   };
 
   buildInputs = [

From 43ff7710c67ed6faeaca54abd4222d35891f3029 Mon Sep 17 00:00:00 2001
From: Karl H <34152449+KarlJoad@users.noreply.github.com>
Date: Tue, 22 Jun 2021 08:43:37 -0500
Subject: [PATCH 397/416] octavePackages.control: 3.2.0 -> 3.3.0 (#127748)

---
 pkgs/development/octave-modules/control/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/octave-modules/control/default.nix b/pkgs/development/octave-modules/control/default.nix
index 2d61e30cc60c..b69343b1b4bb 100644
--- a/pkgs/development/octave-modules/control/default.nix
+++ b/pkgs/development/octave-modules/control/default.nix
@@ -7,11 +7,11 @@
 
 buildOctavePackage rec {
   pname = "control";
-  version = "3.2.0";
+  version = "3.3.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "0gjyjsxs01x0nyc4cgn3d5af17l3lzs8h4hsm57nxd3as48dbwgs";
+    sha256 = "1yksifligq2z3siqw701iq2ydgnj7pnkcw42bfmydcf6fc4drlvy";
   };
 
   nativeBuildInputs = [

From 412a1a4a4fafbe0e8177df3f9971c3756b3263e8 Mon Sep 17 00:00:00 2001
From: Karl H <34152449+KarlJoad@users.noreply.github.com>
Date: Tue, 22 Jun 2021 08:43:46 -0500
Subject: [PATCH 398/416] octavePackages.fuzzy-logic-toolkit: 0.4.5 -> 0.4.6
 (#127749)

---
 .../octave-modules/fuzzy-logic-toolkit/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/octave-modules/fuzzy-logic-toolkit/default.nix b/pkgs/development/octave-modules/fuzzy-logic-toolkit/default.nix
index 5cb567b2bb85..dc230ef18a86 100644
--- a/pkgs/development/octave-modules/fuzzy-logic-toolkit/default.nix
+++ b/pkgs/development/octave-modules/fuzzy-logic-toolkit/default.nix
@@ -5,11 +5,11 @@
 
 buildOctavePackage rec {
   pname = "fuzzy-logic-toolkit";
-  version = "0.4.5";
+  version = "0.4.6";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "0cs1xh594h1psdinicxrsvm27gzax5jja7bjk4sl3kk2hv24mhml";
+    sha256 = "126x0wjjqmwwgynsgjfdh5rlnww5bsl5hxq1xib15i58mrglh5cd";
   };
 
   meta = with lib; {

From 7082fe4bc2661679a4b0ec8fe2730f1d22d1427b Mon Sep 17 00:00:00 2001
From: Karl H <34152449+KarlJoad@users.noreply.github.com>
Date: Tue, 22 Jun 2021 08:44:11 -0500
Subject: [PATCH 399/416] octavePackages.instrument-control: 0.6.0 -> 0.7.0
 (#127750)

---
 .../development/octave-modules/instrument-control/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/octave-modules/instrument-control/default.nix b/pkgs/development/octave-modules/instrument-control/default.nix
index 51c8f300cc59..17d9186da745 100644
--- a/pkgs/development/octave-modules/instrument-control/default.nix
+++ b/pkgs/development/octave-modules/instrument-control/default.nix
@@ -5,11 +5,11 @@
 
 buildOctavePackage rec {
   pname = "instrument-control";
-  version = "0.6.0";
+  version = "0.7.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "0vckax6rx5v3fq5j6kb6n39a5zas9i24x4wvmjlhc8xbykkg5nkk";
+    sha256 = "0cdnnbxihz7chdkhkcgy46pvkij43z9alwr88627z7jaiaah6xby";
   };
 
   meta = with lib; {

From 7e0e1eb9cabe5a8892dfd97ca2a5ad1e5f9e41b5 Mon Sep 17 00:00:00 2001
From: Karl H <34152449+KarlJoad@users.noreply.github.com>
Date: Tue, 22 Jun 2021 08:44:29 -0500
Subject: [PATCH 400/416] octavePackages.parallel: 4.0.0 -> 4.0.1 (#127752)

---
 pkgs/development/octave-modules/parallel/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/octave-modules/parallel/default.nix b/pkgs/development/octave-modules/parallel/default.nix
index 0ea1d4d9df23..11fba7d36300 100644
--- a/pkgs/development/octave-modules/parallel/default.nix
+++ b/pkgs/development/octave-modules/parallel/default.nix
@@ -8,11 +8,11 @@
 
 buildOctavePackage rec {
   pname = "parallel";
-  version = "4.0.0";
+  version = "4.0.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "0wmpak01rsccrnb8is7fsjdlxw15157sqyf9s2fabr16yykfmvi8";
+    sha256 = "1h8vw2r42393px6dk10y3lhpxl168r9d197f9whz6lbk2rg571pa";
   };
 
   nativeBuildInputs = [

From b71f5ce78f576c01f4e7a2c886fcea01e2e72f16 Mon Sep 17 00:00:00 2001
From: Karl H <34152449+KarlJoad@users.noreply.github.com>
Date: Tue, 22 Jun 2021 08:44:41 -0500
Subject: [PATCH 401/416] octavePackages.optim: 1.6.0 -> 1.6.1 (#127751)

---
 pkgs/development/octave-modules/optim/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/octave-modules/optim/default.nix b/pkgs/development/octave-modules/optim/default.nix
index b9561faafb12..57a606d3d58d 100644
--- a/pkgs/development/octave-modules/optim/default.nix
+++ b/pkgs/development/octave-modules/optim/default.nix
@@ -9,11 +9,11 @@
 
 buildOctavePackage rec {
   pname = "optim";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "1z2h8gy99glxh5qi3r22am2vdirlbklkq0lx4r8jrx1ak7awh47r";
+    sha256 = "1175bckiryz0i6zm8zvq7y5rq3lwkmhyiky1gbn33np9qzxcsl3i";
   };
 
   buildInputs = [

From b97b0f4a944865e832b9753e2e758b9da69eb430 Mon Sep 17 00:00:00 2001
From: Karl H <34152449+KarlJoad@users.noreply.github.com>
Date: Tue, 22 Jun 2021 08:44:52 -0500
Subject: [PATCH 402/416] octavePackages.splines: 1.3.3 -> 1.3.4 (#127753)

---
 pkgs/development/octave-modules/splines/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/octave-modules/splines/default.nix b/pkgs/development/octave-modules/splines/default.nix
index 69d5e46147d6..9a249c467446 100644
--- a/pkgs/development/octave-modules/splines/default.nix
+++ b/pkgs/development/octave-modules/splines/default.nix
@@ -5,11 +5,11 @@
 
 buildOctavePackage rec {
   pname = "splines";
-  version = "1.3.3";
+  version = "1.3.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "16wisph8axc5xci0h51zj0y0x2wj6c9zybi2sjpb9v8z9dagjjqa";
+    sha256 = "11a34f6a7615fc8x1smk3lx8vslilx4mrxi8f01la3wq68khnq5f";
   };
 
   meta = with lib; {

From 2d4660ce762b56add1794ef434c04aa7de0f6307 Mon Sep 17 00:00:00 2001
From: Karl H <34152449+KarlJoad@users.noreply.github.com>
Date: Tue, 22 Jun 2021 08:45:10 -0500
Subject: [PATCH 403/416] octavePackages.struct: 1.0.16 -> 1.0.17 (#127754)

---
 pkgs/development/octave-modules/struct/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/octave-modules/struct/default.nix b/pkgs/development/octave-modules/struct/default.nix
index a69a8e4b6e22..bd173aab1e37 100644
--- a/pkgs/development/octave-modules/struct/default.nix
+++ b/pkgs/development/octave-modules/struct/default.nix
@@ -5,11 +5,11 @@
 
 buildOctavePackage rec {
   pname = "struct";
-  version = "1.0.16";
+  version = "1.0.17";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "0gx20r126f0ccl4yflp823xi77p8fh4acx1fv0mmcsglmx4c4vgm";
+    sha256 = "0cw4cspkm553v019zsj2bsmal0i378pm0hv29w82j3v5vysvndq1";
   };
 
   meta = with lib; {

From aed8a199de828dc7aea42d40118dce8c4c03cde4 Mon Sep 17 00:00:00 2001
From: Karl H <34152449+KarlJoad@users.noreply.github.com>
Date: Tue, 22 Jun 2021 08:45:16 -0500
Subject: [PATCH 404/416] octavePackages.windows: 1.5.0 -> 1.6.1 (#127755)

---
 pkgs/development/octave-modules/windows/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/octave-modules/windows/default.nix b/pkgs/development/octave-modules/windows/default.nix
index 274ba1e3b7dd..bed63aef9263 100644
--- a/pkgs/development/octave-modules/windows/default.nix
+++ b/pkgs/development/octave-modules/windows/default.nix
@@ -5,11 +5,11 @@
 
 buildOctavePackage rec {
   pname = "windows";
-  version = "1.5.0";
+  version = "1.6.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "05bsf3q816b9vwgmjdm761ybhmk8raq6dzxqvd11brma0granx3a";
+    sha256 = "110dh6jz088c4fxp9gw79kfib0dl7r3rkcavxx4xpk7bjl2l3xb6";
   };
 
   meta = with lib; {

From 67323a4793fad0fa7a874b2510a2bf028264a499 Mon Sep 17 00:00:00 2001
From: Karl H <34152449+KarlJoad@users.noreply.github.com>
Date: Tue, 22 Jun 2021 08:45:27 -0500
Subject: [PATCH 405/416] octavePackages.matgeom: 1.2.2 -> 1.2.3 (#127756)

---
 pkgs/development/octave-modules/matgeom/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/octave-modules/matgeom/default.nix b/pkgs/development/octave-modules/matgeom/default.nix
index b8607cf5dff9..c74b8b00cfbe 100644
--- a/pkgs/development/octave-modules/matgeom/default.nix
+++ b/pkgs/development/octave-modules/matgeom/default.nix
@@ -5,11 +5,11 @@
 
 buildOctavePackage rec {
   pname = "matgeom";
-  version = "1.2.2";
+  version = "1.2.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "05xfmlh1k3mhq8yag7gr8q1ysl1s43vm46fr1i3gcg9b1kkwi8by";
+    sha256 = "12q66dy4ninhki3jslzcamfblcb3cdkfbbzn3a5har1s212lsfiw";
   };
 
   meta = with lib; {

From 0b0e76080aed014fdb9e9b809ed8fda1e797baf5 Mon Sep 17 00:00:00 2001
From: Karl H <34152449+KarlJoad@users.noreply.github.com>
Date: Tue, 22 Jun 2021 08:45:40 -0500
Subject: [PATCH 406/416] octavePackages.nan: 3.5.2 -> 3.5.3 (#127757)

---
 pkgs/development/octave-modules/nan/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/octave-modules/nan/default.nix b/pkgs/development/octave-modules/nan/default.nix
index a0517db714bd..f492d4440b19 100644
--- a/pkgs/development/octave-modules/nan/default.nix
+++ b/pkgs/development/octave-modules/nan/default.nix
@@ -6,11 +6,11 @@
 
 buildOctavePackage rec {
   pname = "nan";
-  version = "3.5.2";
+  version = "3.5.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "0bp8zl50f8qj5sivl88kjdswm035v4li33fiq3v1gmh0pvgbcw7a";
+    sha256 = "1jailahbrh847875vszibn68lp4n5sdy68q51i7hd64qix8rmmpx";
   };
 
   buildInputs = [

From 11b44aaa1153222200cce4b4f1e053bee11f9c9a Mon Sep 17 00:00:00 2001
From: Chad Jablonski <chad@jablonski.xyz>
Date: Fri, 18 Jun 2021 09:32:24 -0400
Subject: [PATCH 407/416] programmer-calculator: init at 2.1

---
 .../math/programmer-calculator/default.nix    | 34 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 ++
 2 files changed, 36 insertions(+)
 create mode 100644 pkgs/applications/science/math/programmer-calculator/default.nix

diff --git a/pkgs/applications/science/math/programmer-calculator/default.nix b/pkgs/applications/science/math/programmer-calculator/default.nix
new file mode 100644
index 000000000000..0238e5333577
--- /dev/null
+++ b/pkgs/applications/science/math/programmer-calculator/default.nix
@@ -0,0 +1,34 @@
+{ lib, gccStdenv, fetchFromGitHub, ncurses }:
+
+gccStdenv.mkDerivation rec {
+  pname = "programmer-calculator";
+  version = "2.1";
+
+  src = fetchFromGitHub {
+    owner = "alt-romes";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1vvpbj24ijl9ma0h669n9x0z1im3vqdf8zf2li0xf5h97b14gmv0";
+  };
+
+  buildInputs = [ ncurses ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm 555 pcalc -t "$out/bin"
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A terminal calculator for programmers";
+    longDescription = ''
+      Terminal calculator made for programmers working with multiple number
+      representations, sizes, and overall close to the bits
+    '';
+    homepage = "https://alt-romes.github.io/programmer-calculator";
+    changelog = "https://github.com/alt-romes/programmer-calculator/releases/tag/v${version}";
+    license = licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ cjab ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index fdc6db56bff9..085fc5d8826d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -30173,6 +30173,8 @@ in
 
   pcalc = callPackage ../applications/science/math/pcalc { };
 
+  programmer-calculator = callPackage ../applications/science/math/programmer-calculator { };
+
   bcal = callPackage ../applications/science/math/bcal { };
 
   pspp = callPackage ../applications/science/math/pspp { };

From dc24124ec662659f63ad79a3873e3be7ebc1b495 Mon Sep 17 00:00:00 2001
From: fortuneteller2k <lythe1107@gmail.com>
Date: Tue, 22 Jun 2021 21:42:26 +0800
Subject: [PATCH 408/416] elfcat: init at 0.1.3

---
 pkgs/tools/misc/elfcat/Cargo.lock  |  7 +++++++
 pkgs/tools/misc/elfcat/default.nix | 22 ++++++++++++++++++++++
 pkgs/top-level/all-packages.nix    |  2 ++
 3 files changed, 31 insertions(+)
 create mode 100644 pkgs/tools/misc/elfcat/Cargo.lock
 create mode 100644 pkgs/tools/misc/elfcat/default.nix

diff --git a/pkgs/tools/misc/elfcat/Cargo.lock b/pkgs/tools/misc/elfcat/Cargo.lock
new file mode 100644
index 000000000000..e6c694bffb33
--- /dev/null
+++ b/pkgs/tools/misc/elfcat/Cargo.lock
@@ -0,0 +1,7 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "elfcat"
+version = "0.1.3"
diff --git a/pkgs/tools/misc/elfcat/default.nix b/pkgs/tools/misc/elfcat/default.nix
new file mode 100644
index 000000000000..38b1cc9b64f0
--- /dev/null
+++ b/pkgs/tools/misc/elfcat/default.nix
@@ -0,0 +1,22 @@
+{ lib, rustPlatform, fetchFromGitHub }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "elfcat";
+  version = "0.1.3";
+
+  src = fetchFromGitHub {
+    owner = "ruslashev";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-s56FyRoD2IhgdwEV63jMaB265CodHUlvmrWzmXAmonY=";
+  };
+
+  cargoLock.lockFile = ./Cargo.lock;
+
+  meta = with lib; {
+    description = "ELF visualizer, generates HTML files from ELF binaries.";
+    homepage = "https://github.com/ruslashev/elfcat";
+    license = licenses.zlib;
+    maintainers = with maintainers; [ fortuneteller2k ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 94bdde6df093..4481fb949a08 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -204,6 +204,8 @@ in
 
   buf = callPackage ../development/tools/buf { };
 
+  elfcat = callPackage ../tools/misc/elfcat { };
+
   # Zip file format only allows times after year 1980, which makes e.g. Python wheel building fail with:
   # ValueError: ZIP does not support timestamps before 1980
   ensureNewerSourcesForZipFilesHook = ensureNewerSourcesHook { year = "1980"; };

From 4539cc164d469554d44594f7822012c97a24cc8f Mon Sep 17 00:00:00 2001
From: ckie <me@ronthecookie.me>
Date: Tue, 22 Jun 2021 17:19:50 +0300
Subject: [PATCH 409/416] tor-browser-bundle-bin: 10.0.17 -> 10.0.18

---
 .../networking/browsers/tor-browser-bundle-bin/default.nix  | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
index 7fbfccc38960..d1830f1c52f8 100644
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@@ -88,19 +88,19 @@ let
   fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];
 
   # Upstream source
-  version = "10.0.17";
+  version = "10.0.18";
 
   lang = "en-US";
 
   srcs = {
     x86_64-linux = fetchurl {
       url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz";
-      sha256 = "13x38n1cvqmxjz0jf2fda8lx2k25szzmg7gvv08z3q5na7109m2m";
+      sha256 = "15ni33mkg3awfmk3ynr0vi4max1h2k0s10xw3dpmdx6chzv4ll14";
     };
 
     i686-linux = fetchurl {
       url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz";
-      sha256 = "0f0ndwmzh732svwbcf1lbxlvdxw4i4d56w9xdl5fxd4n7ivqml1q";
+      sha256 = "16lx8wkxli1fzq5f6gcw3im4p8k3xdmnmf6w0p7n8hd8681b1w5s";
     };
   };
 in

From c8db4ba116b820bf263775d919d533b36ca4a317 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 22 Jun 2021 03:14:16 +0200
Subject: [PATCH 410/416] esphome: 1.19.0 -> 1.19.2

---
 pkgs/tools/misc/esphome/dashboard.nix | 11 +++++++++--
 pkgs/tools/misc/esphome/default.nix   |  4 ++--
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/pkgs/tools/misc/esphome/dashboard.nix b/pkgs/tools/misc/esphome/dashboard.nix
index 3edf59002b3d..215ce20c79db 100644
--- a/pkgs/tools/misc/esphome/dashboard.nix
+++ b/pkgs/tools/misc/esphome/dashboard.nix
@@ -4,13 +4,20 @@
 
 with python3.pkgs; buildPythonPackage rec {
   pname = "esphome-dashboard";
-  version = "20210615.0";
+  version = "20210617.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "07ammr46bipfi4b7nnjkip5l7966wxqhp5n3g2wqf68m3ymx24s9";
+    sha256 = "0kwg940pdzjsfbdmcml382khpxm6p1ip0bib0wk8rg8qdvmia7w5";
   };
 
+  # no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "esphome_dashboard"
+  ];
+
   meta = with lib; {
     description = "ESPHome dashboard";
     homepage = "https://esphome.io/";
diff --git a/pkgs/tools/misc/esphome/default.nix b/pkgs/tools/misc/esphome/default.nix
index 1daf4f139cf6..c9de8abea95d 100644
--- a/pkgs/tools/misc/esphome/default.nix
+++ b/pkgs/tools/misc/esphome/default.nix
@@ -12,13 +12,13 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "esphome";
-  version = "1.19.0";
+  version = "1.19.2";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "07brvpsy40jv30h0a0ywrw4bgwajjd37xznw34s8k53y92qs8lfi";
+    sha256 = "0bz6gkrvn7mwmjsqrazgpy9r64m5jj462v0izgvdymkx8bjd8mpi";
   };
 
   postPatch = ''

From 1f6969dd5e579a2d4ed8ffd2dc32ba184cc4eda6 Mon Sep 17 00:00:00 2001
From: David Arnold <dgx.arnold@gmail.com>
Date: Mon, 21 Jun 2021 19:59:44 -0500
Subject: [PATCH 411/416] docs: nixos release notes (w/o 2105 - separate PR)

docs: nixos release notes (revise code blocks)

docs: nixos release notes (fix opt links outside of code blocks)

docs: nixos release notes (fix opt links inside of code blocks)

went fishing with:

```console
rg -A1 \
   --multiline \
   --multiline-dotall \
   '<programlisting>[^</programlisting>]+' \
| rg linkend
```

docs: nixos release notes (prettier)

docs: nixos release notes (fix zonefile codeblocks)

docs: nixos release notes (restore admonition from prettier destriction)

docs: nixos release notes (recreate xml files)

docs: nixos release notes (fix trnslation error md -> xml)

admonition with a title seem not to work

docs: nixos release notes (fix code block indentation)

docs: nixos release notes (diff after converting with https://github.com/NixOS/nixpkgs/pull/127270)

docs: nixos release notes (fix remaingin '???')

Those where not catched i a previous iteration since they didn't satisfy
the then presumed search regex `#opt-.*`

doc: nixos release notes make docbook/md conversion consistent
---
 .../from_md/release-notes/rl-1310.section.xml |    6 +
 .../from_md/release-notes/rl-1404.section.xml |  189 ++
 .../from_md/release-notes/rl-1412.section.xml |  466 ++++
 .../from_md/release-notes/rl-1509.section.xml |  776 ++++++
 .../from_md/release-notes/rl-1603.section.xml |  695 ++++++
 .../from_md/release-notes/rl-1609.section.xml |  273 ++
 .../from_md/release-notes/rl-1703.section.xml |  818 ++++++
 .../from_md/release-notes/rl-1709.section.xml |  922 +++++++
 .../from_md/release-notes/rl-1803.section.xml |  871 +++++++
 .../from_md/release-notes/rl-1809.section.xml |  941 +++++++
 .../from_md/release-notes/rl-1903.section.xml |  790 ++++++
 .../from_md/release-notes/rl-1909.section.xml | 1197 +++++++++
 .../from_md/release-notes/rl-2003.section.xml | 1497 +++++++++++
 .../from_md/release-notes/rl-2009.section.xml | 2206 +++++++++++++++++
 .../from_md/release-notes/rl-2111.section.xml |    2 +
 .../manual/release-notes/release-notes.xml    |   28 +-
 .../manual/release-notes/rl-1310.section.md   |    3 +
 nixos/doc/manual/release-notes/rl-1310.xml    |   11 -
 .../manual/release-notes/rl-1404.section.md   |   81 +
 nixos/doc/manual/release-notes/rl-1404.xml    |  179 --
 .../manual/release-notes/rl-1412.section.md   |  171 ++
 nixos/doc/manual/release-notes/rl-1412.xml    |  467 ----
 .../manual/release-notes/rl-1509.section.md   |  319 +++
 nixos/doc/manual/release-notes/rl-1509.xml    |  750 ------
 .../manual/release-notes/rl-1603.section.md   |  282 +++
 nixos/doc/manual/release-notes/rl-1603.xml    |  671 -----
 .../manual/release-notes/rl-1609.section.md   |   73 +
 nixos/doc/manual/release-notes/rl-1609.xml    |  277 ---
 .../manual/release-notes/rl-1703.section.md   |  303 +++
 nixos/doc/manual/release-notes/rl-1703.xml    |  817 ------
 .../manual/release-notes/rl-1709.section.md   |  316 +++
 nixos/doc/manual/release-notes/rl-1709.xml    |  899 -------
 .../manual/release-notes/rl-1803.section.md   |  284 +++
 nixos/doc/manual/release-notes/rl-1803.xml    |  855 -------
 .../manual/release-notes/rl-1809.section.md   |  332 +++
 nixos/doc/manual/release-notes/rl-1809.xml    |  933 -------
 .../manual/release-notes/rl-1903.section.md   |  214 ++
 nixos/doc/manual/release-notes/rl-1903.xml    |  768 ------
 .../manual/release-notes/rl-1909.section.md   |  313 +++
 nixos/doc/manual/release-notes/rl-1909.xml    |  902 -------
 .../manual/release-notes/rl-2003.section.md   |  507 ++++
 nixos/doc/manual/release-notes/rl-2003.xml    | 1252 ----------
 .../manual/release-notes/rl-2009.section.md   |  745 ++++++
 nixos/doc/manual/release-notes/rl-2009.xml    | 1838 --------------
 .../manual/release-notes/rl-2111.section.md   |   38 +-
 45 files changed, 15620 insertions(+), 10657 deletions(-)
 create mode 100644 nixos/doc/manual/from_md/release-notes/rl-1310.section.xml
 create mode 100644 nixos/doc/manual/from_md/release-notes/rl-1404.section.xml
 create mode 100644 nixos/doc/manual/from_md/release-notes/rl-1412.section.xml
 create mode 100644 nixos/doc/manual/from_md/release-notes/rl-1509.section.xml
 create mode 100644 nixos/doc/manual/from_md/release-notes/rl-1603.section.xml
 create mode 100644 nixos/doc/manual/from_md/release-notes/rl-1609.section.xml
 create mode 100644 nixos/doc/manual/from_md/release-notes/rl-1703.section.xml
 create mode 100644 nixos/doc/manual/from_md/release-notes/rl-1709.section.xml
 create mode 100644 nixos/doc/manual/from_md/release-notes/rl-1803.section.xml
 create mode 100644 nixos/doc/manual/from_md/release-notes/rl-1809.section.xml
 create mode 100644 nixos/doc/manual/from_md/release-notes/rl-1903.section.xml
 create mode 100644 nixos/doc/manual/from_md/release-notes/rl-1909.section.xml
 create mode 100644 nixos/doc/manual/from_md/release-notes/rl-2003.section.xml
 create mode 100644 nixos/doc/manual/from_md/release-notes/rl-2009.section.xml
 create mode 100644 nixos/doc/manual/release-notes/rl-1310.section.md
 delete mode 100644 nixos/doc/manual/release-notes/rl-1310.xml
 create mode 100644 nixos/doc/manual/release-notes/rl-1404.section.md
 delete mode 100644 nixos/doc/manual/release-notes/rl-1404.xml
 create mode 100644 nixos/doc/manual/release-notes/rl-1412.section.md
 delete mode 100644 nixos/doc/manual/release-notes/rl-1412.xml
 create mode 100644 nixos/doc/manual/release-notes/rl-1509.section.md
 delete mode 100644 nixos/doc/manual/release-notes/rl-1509.xml
 create mode 100644 nixos/doc/manual/release-notes/rl-1603.section.md
 delete mode 100644 nixos/doc/manual/release-notes/rl-1603.xml
 create mode 100644 nixos/doc/manual/release-notes/rl-1609.section.md
 delete mode 100644 nixos/doc/manual/release-notes/rl-1609.xml
 create mode 100644 nixos/doc/manual/release-notes/rl-1703.section.md
 delete mode 100644 nixos/doc/manual/release-notes/rl-1703.xml
 create mode 100644 nixos/doc/manual/release-notes/rl-1709.section.md
 delete mode 100644 nixos/doc/manual/release-notes/rl-1709.xml
 create mode 100644 nixos/doc/manual/release-notes/rl-1803.section.md
 delete mode 100644 nixos/doc/manual/release-notes/rl-1803.xml
 create mode 100644 nixos/doc/manual/release-notes/rl-1809.section.md
 delete mode 100644 nixos/doc/manual/release-notes/rl-1809.xml
 create mode 100644 nixos/doc/manual/release-notes/rl-1903.section.md
 delete mode 100644 nixos/doc/manual/release-notes/rl-1903.xml
 create mode 100644 nixos/doc/manual/release-notes/rl-1909.section.md
 delete mode 100644 nixos/doc/manual/release-notes/rl-1909.xml
 create mode 100644 nixos/doc/manual/release-notes/rl-2003.section.md
 delete mode 100644 nixos/doc/manual/release-notes/rl-2003.xml
 create mode 100644 nixos/doc/manual/release-notes/rl-2009.section.md
 delete mode 100644 nixos/doc/manual/release-notes/rl-2009.xml

diff --git a/nixos/doc/manual/from_md/release-notes/rl-1310.section.xml b/nixos/doc/manual/from_md/release-notes/rl-1310.section.xml
new file mode 100644
index 000000000000..b4f3657b4b88
--- /dev/null
+++ b/nixos/doc/manual/from_md/release-notes/rl-1310.section.xml
@@ -0,0 +1,6 @@
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-release-13.10">
+  <title>Release 13.10 (<quote>Aardvark</quote>, 2013/10/31)</title>
+  <para>
+    This is the first stable release branch of NixOS.
+  </para>
+</section>
diff --git a/nixos/doc/manual/from_md/release-notes/rl-1404.section.xml b/nixos/doc/manual/from_md/release-notes/rl-1404.section.xml
new file mode 100644
index 000000000000..8771623b468a
--- /dev/null
+++ b/nixos/doc/manual/from_md/release-notes/rl-1404.section.xml
@@ -0,0 +1,189 @@
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-release-14.04">
+  <title>Release 14.04 (<quote>Baboon</quote>, 2014/04/30)</title>
+  <para>
+    This is the second stable release branch of NixOS. In addition to
+    numerous new and upgraded packages and modules, this release has the
+    following highlights:
+  </para>
+  <itemizedlist>
+    <listitem>
+      <para>
+        Installation on UEFI systems is now supported. See
+        <xref linkend="sec-installation" /> for details.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Systemd has been updated to version 212, which has
+        <link xlink:href="http://cgit.freedesktop.org/systemd/systemd/plain/NEWS?id=v212">numerous
+        improvements</link>. NixOS now automatically starts systemd user
+        instances when you log in. You can define global user units
+        through the <literal>systemd.unit.*</literal> options.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        NixOS is now based on Glibc 2.19 and GCC 4.8.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        The default Linux kernel has been updated to 3.12.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        KDE has been updated to 4.12.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        GNOME 3.10 experimental support has been added.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Nix has been updated to 1.7
+        (<link xlink:href="https://nixos.org/nix/manual/#ssec-relnotes-1.7">details</link>).
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        NixOS now supports fully declarative management of users and
+        groups. If you set <literal>users.mutableUsers</literal> to
+        <literal>false</literal>, then the contents of
+        <literal>/etc/passwd</literal> and <literal>/etc/group</literal>
+        will be
+        <link xlink:href="https://www.usenix.org/legacy/event/lisa02/tech/full_papers/traugott/traugott_html/">congruent</link>
+        to your NixOS configuration. For instance, if you remove a user
+        from <literal>users.extraUsers</literal> and run
+        <literal>nixos-rebuild</literal>, the user account will cease to
+        exist. Also, imperative commands for managing users and groups,
+        such as <literal>useradd</literal>, are no longer available. If
+        <literal>users.mutableUsers</literal> is <literal>true</literal>
+        (the default), then behaviour is unchanged from NixOS 13.10.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        NixOS now has basic container support, meaning you can easily
+        run a NixOS instance as a container in a NixOS host system.
+        These containers are suitable for testing and experimentation
+        but not production use, since they’re not fully isolated from
+        the host. See <xref linkend="ch-containers" /> for details.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Systemd units provided by packages can now be overridden from
+        the NixOS configuration. For instance, if a package
+        <literal>foo</literal> provides systemd units, you can say:
+      </para>
+      <programlisting language="bash">
+{
+  systemd.packages = [ pkgs.foo ];
+}
+</programlisting>
+      <para>
+        to enable those units. You can then set or override unit options
+        in the usual way, e.g.
+      </para>
+      <programlisting language="bash">
+{
+  systemd.services.foo.wantedBy = [ &quot;multi-user.target&quot; ];
+  systemd.services.foo.serviceConfig.MemoryLimit = &quot;512M&quot;;
+}
+</programlisting>
+      <para>
+        When upgrading from a previous release, please be aware of the
+        following incompatible changes:
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Nixpkgs no longer exposes unfree packages by default. If your
+        NixOS configuration requires unfree packages from Nixpkgs, you
+        need to enable support for them explicitly by setting:
+      </para>
+      <programlisting language="bash">
+{
+  nixpkgs.config.allowUnfree = true;
+}
+</programlisting>
+      <para>
+        Otherwise, you get an error message such as:
+      </para>
+      <programlisting>
+    error: package ‘nvidia-x11-331.49-3.12.17’ in ‘…/nvidia-x11/default.nix:56’
+      has an unfree license, refusing to evaluate
+</programlisting>
+    </listitem>
+    <listitem>
+      <para>
+        The Adobe Flash player is no longer enabled by default in the
+        Firefox and Chromium wrappers. To enable it, you must set:
+      </para>
+      <programlisting language="bash">
+{
+  nixpkgs.config.allowUnfree = true;
+  nixpkgs.config.firefox.enableAdobeFlash = true; # for Firefox
+  nixpkgs.config.chromium.enableAdobeFlash = true; # for Chromium
+}
+</programlisting>
+    </listitem>
+    <listitem>
+      <para>
+        The firewall is now enabled by default. If you don’t want this,
+        you need to disable it explicitly:
+      </para>
+      <programlisting language="bash">
+{
+  networking.firewall.enable = false;
+}
+</programlisting>
+    </listitem>
+    <listitem>
+      <para>
+        The option <literal>boot.loader.grub.memtest86</literal> has
+        been renamed to
+        <literal>boot.loader.grub.memtest86.enable</literal>.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        The <literal>mysql55</literal> service has been merged into the
+        <literal>mysql</literal> service, which no longer sets a default
+        for the option <literal>services.mysql.package</literal>.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Package variants are now differentiated by suffixing the name,
+        rather than the version. For instance,
+        <literal>sqlite-3.8.4.3-interactive</literal> is now called
+        <literal>sqlite-interactive-3.8.4.3</literal>. This ensures that
+        <literal>nix-env -i sqlite</literal> is unambiguous, and that
+        <literal>nix-env -u</literal> won’t <quote>upgrade</quote>
+        <literal>sqlite</literal> to
+        <literal>sqlite-interactive</literal> or vice versa. Notably,
+        this change affects the Firefox wrapper (which provides
+        plugins), as it is now called
+        <literal>firefox-wrapper</literal>. So when using
+        <literal>nix-env</literal>, you should do
+        <literal>nix-env -e firefox; nix-env -i firefox-wrapper</literal>
+        if you want to keep using the wrapper. This change does not
+        affect declarative package management, since attribute names
+        like <literal>pkgs.firefoxWrapper</literal> were already
+        unambiguous.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        The symlink <literal>/etc/ca-bundle.crt</literal> is gone.
+        Programs should instead use the environment variable
+        <literal>OPENSSL_X509_CERT_FILE</literal> (which points to
+        <literal>/etc/ssl/certs/ca-bundle.crt</literal>).
+      </para>
+    </listitem>
+  </itemizedlist>
+</section>
diff --git a/nixos/doc/manual/from_md/release-notes/rl-1412.section.xml b/nixos/doc/manual/from_md/release-notes/rl-1412.section.xml
new file mode 100644
index 000000000000..3b6af73359d6
--- /dev/null
+++ b/nixos/doc/manual/from_md/release-notes/rl-1412.section.xml
@@ -0,0 +1,466 @@
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-release-14.12">
+  <title>Release 14.12 (<quote>Caterpillar</quote>, 2014/12/30)</title>
+  <para>
+    In addition to numerous new and upgraded packages, this release has
+    the following highlights:
+  </para>
+  <itemizedlist>
+    <listitem>
+      <para>
+        Systemd has been updated to version 217, which has numerous
+        <link xlink:href="http://lists.freedesktop.org/archives/systemd-devel/2014-October/024662.html">improvements.</link>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <link xlink:href="https://www.mail-archive.com/nix-dev@lists.science.uu.nl/msg13957.html">Nix
+        has been updated to 1.8.</link>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        NixOS is now based on Glibc 2.20.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        KDE has been updated to 4.14.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        The default Linux kernel has been updated to 3.14.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        If <literal>users.mutableUsers</literal> is enabled (the
+        default), changes made to the declaration of a user or group
+        will be correctly realised when running
+        <literal>nixos-rebuild</literal>. For instance, removing a user
+        specification from <literal>configuration.nix</literal> will
+        cause the actual user account to be deleted. If
+        <literal>users.mutableUsers</literal> is disabled, it is no
+        longer necessary to specify UIDs or GIDs; if omitted, they are
+        allocated dynamically.
+      </para>
+    </listitem>
+  </itemizedlist>
+  <para>
+    Following new services were added since the last release:
+  </para>
+  <itemizedlist>
+    <listitem>
+      <para>
+        <literal>atftpd</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>bosun</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>bspwm</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>chronos</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>collectd</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>consul</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>cpuminer-cryptonight</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>crashplan</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>dnscrypt-proxy</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>docker-registry</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>docker</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>etcd</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>fail2ban</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>fcgiwrap</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>fleet</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>fluxbox</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>gdm</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>geoclue2</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>gitlab</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>gitolite</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>gnome3.gnome-documents</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>gnome3.gnome-online-miners</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>gnome3.gvfs</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>gnome3.seahorse</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>hbase</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>i2pd</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>influxdb</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>kubernetes</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>liquidsoap</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>lxc</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>mailpile</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>mesos</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>mlmmj</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>monetdb</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>mopidy</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>neo4j</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>nsd</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>openntpd</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>opentsdb</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>openvswitch</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>parallels-guest</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>peerflix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>phd</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>polipo</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>prosody</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>radicale</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>redmine</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>riemann</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>scollector</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>seeks</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>siproxd</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>strongswan</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>tcsd</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>teamspeak3</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>thermald</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>torque/mrom</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>torque/server</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>uhub</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>unifi</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>znc</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>zookeeper</literal>
+      </para>
+    </listitem>
+  </itemizedlist>
+  <para>
+    When upgrading from a previous release, please be aware of the
+    following incompatible changes:
+  </para>
+  <itemizedlist>
+    <listitem>
+      <para>
+        The default version of Apache httpd is now 2.4. If you use the
+        <literal>extraConfig</literal> option to pass literal Apache
+        configuration text, you may need to update it — see
+        <link xlink:href="http://httpd.apache.org/docs/2.4/upgrading.html">Apache’s
+        documentation</link> for details. If you wish to continue to use
+        httpd 2.2, add the following line to your NixOS configuration:
+      </para>
+      <programlisting language="bash">
+{
+  services.httpd.package = pkgs.apacheHttpd_2_2;
+}
+</programlisting>
+    </listitem>
+    <listitem>
+      <para>
+        PHP 5.3 has been removed because it is no longer supported by
+        the PHP project. A
+        <link xlink:href="http://php.net/migration54">migration
+        guide</link> is available.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        The host side of a container virtual Ethernet pair is now called
+        <literal>ve-container-name</literal> rather than
+        <literal>c-container-name</literal>.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        GNOME 3.10 support has been dropped. The default GNOME version
+        is now 3.12.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        VirtualBox has been upgraded to 4.3.20 release. Users may be
+        required to run <literal>rm -rf /tmp/.vbox*</literal>. The line
+        <literal>imports = [ &lt;nixpkgs/nixos/modules/programs/virtualbox.nix&gt; ]</literal>
+        is no longer necessary, use
+        <literal>services.virtualboxHost.enable = true</literal>
+        instead.
+      </para>
+      <para>
+        Also, hardening mode is now enabled by default, which means that
+        unless you want to use USB support, you no longer need to be a
+        member of the <literal>vboxusers</literal> group.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Chromium has been updated to 39.0.2171.65.
+        <literal>enablePepperPDF</literal> is now enabled by default.
+        <literal>chromium*Wrapper</literal> packages no longer exist,
+        because upstream removed NSAPI support.
+        <literal>chromium-stable</literal> has been renamed to
+        <literal>chromium</literal>.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Python packaging documentation is now part of nixpkgs manual. To
+        override the python packages available to a custom python you
+        now use <literal>pkgs.pythonFull.buildEnv.override</literal>
+        instead of <literal>pkgs.pythonFull.override</literal>.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>boot.resumeDevice = &quot;8:6&quot;</literal> is no
+        longer supported. Most users will want to leave it undefined,
+        which takes the swap partitions automatically. There is an
+        evaluation assertion to ensure that the string starts with a
+        slash.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        The system-wide default timezone for NixOS installations changed
+        from <literal>CET</literal> to <literal>UTC</literal>. To choose
+        a different timezone for your system, configure
+        <literal>time.timeZone</literal> in
+        <literal>configuration.nix</literal>. A fairly complete list of
+        possible values for that setting is available at
+        <link xlink:href="https://en.wikipedia.org/wiki/List_of_tz_database_time_zones">https://en.wikipedia.org/wiki/List_of_tz_database_time_zones</link>.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        GNU screen has been updated to 4.2.1, which breaks the ability
+        to connect to sessions created by older versions of screen.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        The Intel GPU driver was updated to the 3.x prerelease version
+        (used by most distributions) and supports DRI3 now.
+      </para>
+    </listitem>
+  </itemizedlist>
+</section>
diff --git a/nixos/doc/manual/from_md/release-notes/rl-1509.section.xml b/nixos/doc/manual/from_md/release-notes/rl-1509.section.xml
new file mode 100644
index 000000000000..68d2ab389e8f
--- /dev/null
+++ b/nixos/doc/manual/from_md/release-notes/rl-1509.section.xml
@@ -0,0 +1,776 @@
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-release-15.09">
+  <title>Release 15.09 (<quote>Dingo</quote>, 2015/09/30)</title>
+  <para>
+    In addition to numerous new and upgraded packages, this release has
+    the following highlights:
+  </para>
+  <itemizedlist>
+    <listitem>
+      <para>
+        The <link xlink:href="http://haskell.org/">Haskell</link>
+        packages infrastructure has been re-designed from the ground up
+        (&quot;Haskell NG&quot;). NixOS now distributes the latest
+        version of every single package registered on
+        <link xlink:href="http://hackage.haskell.org/">Hackage</link> --
+        well in excess of 8,000 Haskell packages. Detailed instructions
+        on how to use that infrastructure can be found in the
+        <link xlink:href="https://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure">User's
+        Guide to the Haskell Infrastructure</link>. Users migrating from
+        an earlier release may find helpful information below, in the
+        list of backwards-incompatible changes. Furthermore, we
+        distribute 51(!) additional Haskell package sets that provide
+        every single <link xlink:href="http://www.stackage.org/">LTS
+        Haskell</link> release since version 0.0 as well as the most
+        recent <link xlink:href="http://www.stackage.org/">Stackage
+        Nightly</link> snapshot. The announcement
+        <link xlink:href="https://nixos.org/nix-dev/2015-September/018138.html">&quot;Full
+        Stackage Support in Nixpkgs&quot;</link> gives additional
+        details.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Nix has been updated to version 1.10, which among other
+        improvements enables cryptographic signatures on binary caches
+        for improved security.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        You can now keep your NixOS system up to date automatically by
+        setting
+      </para>
+    </listitem>
+  </itemizedlist>
+  <programlisting language="bash">
+{
+  system.autoUpgrade.enable = true;
+}
+</programlisting>
+  <para>
+    This will cause the system to periodically check for updates in your
+    current channel and run <literal>nixos-rebuild</literal>.
+  </para>
+  <itemizedlist>
+    <listitem>
+      <para>
+        This release is based on Glibc 2.21, GCC 4.9 and Linux 3.18.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        GNOME has been upgraded to 3.16.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Xfce has been upgraded to 4.12.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        KDE 5 has been upgraded to KDE Frameworks 5.10, Plasma 5.3.2 and
+        Applications 15.04.3. KDE 4 has been updated to kdelibs-4.14.10.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        E19 has been upgraded to 0.16.8.15.
+      </para>
+    </listitem>
+  </itemizedlist>
+  <para>
+    The following new services were added since the last release:
+  </para>
+  <itemizedlist>
+    <listitem>
+      <para>
+        <literal>services/mail/exim.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/misc/apache-kafka.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/misc/canto-daemon.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/misc/confd.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/misc/devmon.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/misc/gitit.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/misc/ihaskell.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/misc/mbpfan.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/misc/mediatomb.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/misc/mwlib.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/misc/parsoid.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/misc/plex.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/misc/ripple-rest.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/misc/ripple-data-api.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/misc/subsonic.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/misc/sundtek.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/monitoring/cadvisor.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/monitoring/das_watchdog.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/monitoring/grafana.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/monitoring/riemann-tools.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/monitoring/teamviewer.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/network-filesystems/u9fs.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/aiccu.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/asterisk.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/bird.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/charybdis.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/docker-registry-server.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/fan.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/firefox/sync-server.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/gateone.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/heyefi.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/i2p.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/lambdabot.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/mstpd.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/nix-serve.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/nylon.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/racoon.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/skydns.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/shout.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/softether.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/sslh.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/tinc.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/tlsdated.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/tox-bootstrapd.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/tvheadend.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/zerotierone.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/scheduling/marathon.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/security/fprintd.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/security/hologram.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/security/munge.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/system/cloud-init.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/web-servers/shellinabox.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/web-servers/uwsgi.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/x11/unclutter.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/x11/display-managers/sddm.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>system/boot/coredump.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>system/boot/loader/loader.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>system/boot/loader/generic-extlinux-compatible</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>system/boot/networkd.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>system/boot/resolved.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>system/boot/timesyncd.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>tasks/filesystems/exfat.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>tasks/filesystems/ntfs.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>tasks/filesystems/vboxsf.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>virtualisation/virtualbox-host.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>virtualisation/vmware-guest.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>virtualisation/xen-dom0.nix</literal>
+      </para>
+    </listitem>
+  </itemizedlist>
+  <para>
+    When upgrading from a previous release, please be aware of the
+    following incompatible changes:
+  </para>
+  <itemizedlist spacing="compact">
+    <listitem>
+      <para>
+        <literal>sshd</literal> no longer supports DSA and ECDSA host
+        keys by default. If you have existing systems with such host
+        keys and want to continue to use them, please set
+      </para>
+    </listitem>
+  </itemizedlist>
+  <programlisting language="bash">
+{
+  system.stateVersion = &quot;14.12&quot;;
+}
+</programlisting>
+  <para>
+    The new option <literal>system.stateVersion</literal> ensures that
+    certain configuration changes that could break existing systems
+    (such as the <literal>sshd</literal> host key setting) will maintain
+    compatibility with the specified NixOS release. NixOps sets the
+    state version of existing deployments automatically.
+  </para>
+  <itemizedlist>
+    <listitem>
+      <para>
+        <literal>cron</literal> is no longer enabled by default, unless
+        you have a non-empty
+        <literal>services.cron.systemCronJobs</literal>. To force
+        <literal>cron</literal> to be enabled, set
+        <literal>services.cron.enable = true</literal>.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Nix now requires binary caches to be cryptographically signed.
+        If you have unsigned binary caches that you want to continue to
+        use, you should set
+        <literal>nix.requireSignedBinaryCaches = false</literal>.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Steam now doesn't need root rights to work. Instead of using
+        <literal>*-steam-chrootenv</literal>, you should now just run
+        <literal>steam</literal>. <literal>steamChrootEnv</literal>
+        package was renamed to <literal>steam</literal>, and old
+        <literal>steam</literal> package -- to
+        <literal>steamOriginal</literal>.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        CMPlayer has been renamed to bomi upstream. Package
+        <literal>cmplayer</literal> was accordingly renamed to
+        <literal>bomi</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Atom Shell has been renamed to Electron upstream. Package
+        <literal>atom-shell</literal> was accordingly renamed to
+        <literal>electron</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Elm is not released on Hackage anymore. You should now use
+        <literal>elmPackages.elm</literal> which contains the latest Elm
+        platform.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        The CUPS printing service has been updated to version
+        <literal>2.0.2</literal>. Furthermore its systemd service has
+        been renamed to <literal>cups.service</literal>.
+      </para>
+      <para>
+        Local printers are no longer shared or advertised by default.
+        This behavior can be changed by enabling
+        <literal>services.printing.defaultShared</literal> or
+        <literal>services.printing.browsing</literal> respectively.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        The VirtualBox host and guest options have been named more
+        consistently. They can now found in
+        <literal>virtualisation.virtualbox.host.*</literal> instead of
+        <literal>services.virtualboxHost.*</literal> and
+        <literal>virtualisation.virtualbox.guest.*</literal> instead of
+        <literal>services.virtualboxGuest.*</literal>.
+      </para>
+      <para>
+        Also, there now is support for the <literal>vboxsf</literal>
+        file system using the <literal>fileSystems</literal>
+        configuration attribute. An example of how this can be used in a
+        configuration:
+      </para>
+    </listitem>
+  </itemizedlist>
+  <programlisting language="bash">
+{
+  fileSystems.&quot;/shiny&quot; = {
+    device = &quot;myshinysharedfolder&quot;;
+    fsType = &quot;vboxsf&quot;;
+  };
+}
+</programlisting>
+  <itemizedlist spacing="compact">
+    <listitem>
+      <para>
+        &quot;<literal>nix-env -qa</literal>&quot; no longer discovers
+        Haskell packages by name. The only packages visible in the
+        global scope are <literal>ghc</literal>,
+        <literal>cabal-install</literal>, and <literal>stack</literal>,
+        but all other packages are hidden. The reason for this
+        inconvenience is the sheer size of the Haskell package set.
+        Name-based lookups are expensive, and most
+        <literal>nix-env -qa</literal> operations would become much
+        slower if we'd add the entire Hackage database into the top
+        level attribute set. Instead, the list of Haskell packages can
+        be displayed by running:
+      </para>
+    </listitem>
+  </itemizedlist>
+  <programlisting>
+nix-env -f &quot;&lt;nixpkgs&gt;&quot; -qaP -A haskellPackages
+</programlisting>
+  <para>
+    Executable programs written in Haskell can be installed with:
+  </para>
+  <programlisting>
+nix-env -f &quot;&lt;nixpkgs&gt;&quot; -iA haskellPackages.pandoc
+</programlisting>
+  <para>
+    Installing Haskell <emphasis>libraries</emphasis> this way, however,
+    is no longer supported. See the next item for more details.
+  </para>
+  <itemizedlist>
+    <listitem>
+      <para>
+        Previous versions of NixOS came with a feature called
+        <literal>ghc-wrapper</literal>, a small script that allowed GHC
+        to transparently pick up on libraries installed in the user's
+        profile. This feature has been deprecated;
+        <literal>ghc-wrapper</literal> was removed from the
+        distribution. The proper way to register Haskell libraries with
+        the compiler now is the
+        <literal>haskellPackages.ghcWithPackages</literal> function. The
+        <link xlink:href="https://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure">User's
+        Guide to the Haskell Infrastructure</link> provides more
+        information about this subject.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        All Haskell builds that have been generated with version 1.x of
+        the <literal>cabal2nix</literal> utility are now invalid and
+        need to be re-generated with a current version of
+        <literal>cabal2nix</literal> to function. The most recent
+        version of this tool can be installed by running
+        <literal>nix-env -i cabal2nix</literal>.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        The <literal>haskellPackages</literal> set in Nixpkgs used to
+        have a function attribute called <literal>extension</literal>
+        that users could override in their
+        <literal>~/.nixpkgs/config.nix</literal> files to configure
+        additional attributes, etc. That function still exists, but it's
+        now called <literal>overrides</literal>.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        The OpenBLAS library has been updated to version
+        <literal>0.2.14</literal>. Support for the
+        <literal>x86_64-darwin</literal> platform was added. Dynamic
+        architecture detection was enabled; OpenBLAS now selects
+        microarchitecture-optimized routines at runtime, so optimal
+        performance is achieved without the need to rebuild OpenBLAS
+        locally. OpenBLAS has replaced ATLAS in most packages which use
+        an optimized BLAS or LAPACK implementation.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        The <literal>phpfpm</literal> is now using the default PHP
+        version (<literal>pkgs.php</literal>) instead of PHP 5.4
+        (<literal>pkgs.php54</literal>).
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        The <literal>locate</literal> service no longer indexes the Nix
+        store by default, preventing packages with potentially numerous
+        versions from cluttering the output. Indexing the store can be
+        activated by setting
+        <literal>services.locate.includeStore = true</literal>.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        The Nix expression search path (<literal>NIX_PATH</literal>) no
+        longer contains <literal>/etc/nixos/nixpkgs</literal> by
+        default. You can override <literal>NIX_PATH</literal> by setting
+        <literal>nix.nixPath</literal>.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Python 2.6 has been marked as broken (as it no longer receives
+        security updates from upstream).
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Any use of module arguments such as <literal>pkgs</literal> to
+        access library functions, or to define
+        <literal>imports</literal> attributes will now lead to an
+        infinite loop at the time of the evaluation.
+      </para>
+      <para>
+        In case of an infinite loop, use the
+        <literal>--show-trace</literal> command line argument and read
+        the line just above the error message.
+      </para>
+      <programlisting>
+$ nixos-rebuild build --show-trace
+…
+while evaluating the module argument `pkgs' in &quot;/etc/nixos/my-module.nix&quot;:
+infinite recursion encountered
+</programlisting>
+      <para>
+        Any use of <literal>pkgs.lib</literal>, should be replaced by
+        <literal>lib</literal>, after adding it as argument of the
+        module. The following module
+      </para>
+      <programlisting language="bash">
+{ config, pkgs, ... }:
+
+with pkgs.lib;
+
+{
+  options = {
+    foo = mkOption { … };
+  };
+  config = mkIf config.foo { … };
+}
+</programlisting>
+      <para>
+        should be modified to look like:
+      </para>
+      <programlisting language="bash">
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+{
+  options = {
+    foo = mkOption { option declaration };
+  };
+  config = mkIf config.foo { option definition };
+}
+</programlisting>
+      <para>
+        When <literal>pkgs</literal> is used to download other projects
+        to import their modules, and only in such cases, it should be
+        replaced by <literal>(import &lt;nixpkgs&gt; {})</literal>. The
+        following module
+      </para>
+      <programlisting language="bash">
+{ config, pkgs, ... }:
+
+let
+  myProject = pkgs.fetchurl {
+    src = url;
+    sha256 = hash;
+  };
+in
+
+{
+  imports = [ &quot;${myProject}/module.nix&quot; ];
+}
+</programlisting>
+      <para>
+        should be modified to look like:
+      </para>
+      <programlisting language="bash">
+{ config, pkgs, ... }:
+
+let
+  myProject = (import &lt;nixpkgs&gt; {}).fetchurl {
+    src = url;
+    sha256 = hash;
+  };
+in
+
+{
+  imports = [ &quot;${myProject}/module.nix&quot; ];
+}
+</programlisting>
+    </listitem>
+  </itemizedlist>
+  <para>
+    Other notable improvements:
+  </para>
+  <itemizedlist>
+    <listitem>
+      <para>
+        The nixos and nixpkgs channels were unified, so one
+        <emphasis>can</emphasis> use
+        <literal>nix-env -iA nixos.bash</literal> instead of
+        <literal>nix-env -iA nixos.pkgs.bash</literal>. See
+        <link xlink:href="https://github.com/NixOS/nixpkgs/commit/2cd7c1f198">the
+        commit</link> for details.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Users running an SSH server who worry about the quality of their
+        <literal>/etc/ssh/moduli</literal> file with respect to the
+        <link xlink:href="https://stribika.github.io/2015/01/04/secure-secure-shell.html">vulnerabilities
+        discovered in the Diffie-Hellman key exchange</link> can now
+        replace OpenSSH's default version with one they generated
+        themselves using the new
+        <literal>services.openssh.moduliFile</literal> option.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        A newly packaged TeX Live 2015 is provided in
+        <literal>pkgs.texlive</literal>, split into 6500 nix packages.
+        For basic user documentation see
+        <link xlink:href="https://github.com/NixOS/nixpkgs/blob/release-15.09/pkgs/tools/typesetting/tex/texlive/default.nix#L1">the
+        source</link>. Beware of
+        <link xlink:href="https://github.com/NixOS/nixpkgs/issues/9757">an
+        issue</link> when installing a too large package set. The plan
+        is to deprecate and maybe delete the original TeX packages until
+        the next release.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>buildEnv.env</literal> on all Python interpreters is
+        now available for nix-shell interoperability.
+      </para>
+    </listitem>
+  </itemizedlist>
+</section>
diff --git a/nixos/doc/manual/from_md/release-notes/rl-1603.section.xml b/nixos/doc/manual/from_md/release-notes/rl-1603.section.xml
new file mode 100644
index 000000000000..172b800b5992
--- /dev/null
+++ b/nixos/doc/manual/from_md/release-notes/rl-1603.section.xml
@@ -0,0 +1,695 @@
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-release-16.03">
+  <title>Release 16.03 (<quote>Emu</quote>, 2016/03/31)</title>
+  <para>
+    In addition to numerous new and upgraded packages, this release has
+    the following highlights:
+  </para>
+  <itemizedlist>
+    <listitem>
+      <para>
+        Systemd 229, bringing
+        <link xlink:href="https://github.com/systemd/systemd/blob/v229/NEWS">numerous
+        improvements</link> over 217.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Linux 4.4 (was 3.18).
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        GCC 5.3 (was 4.9). Note that GCC 5
+        <link xlink:href="https://gcc.gnu.org/onlinedocs/libstdc++/manual/using_dual_abi.html">changes
+        the C++ ABI in an incompatible way</link>; this may cause
+        problems if you try to link objects compiled with different
+        versions of GCC.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Glibc 2.23 (was 2.21).
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Binutils 2.26 (was 2.23.1). See #909
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Improved support for ensuring
+        <link xlink:href="https://reproducible-builds.org/">bitwise
+        reproducible builds</link>. For example,
+        <literal>stdenv</literal> now sets the environment variable
+        <literal>SOURCE_DATE_EPOCH</literal> to a deterministic value,
+        and Nix has
+        <link xlink:href="https://nixos.org/nix/manual/#ssec-relnotes-1.11">gained
+        an option</link> to repeat a build a number of times to test
+        determinism. An ongoing project, the goal of exact
+        reproducibility is to allow binaries to be verified
+        independently (e.g., a user might only trust binaries that
+        appear in three independent binary caches).
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Perl 5.22.
+      </para>
+    </listitem>
+  </itemizedlist>
+  <para>
+    The following new services were added since the last release:
+  </para>
+  <itemizedlist>
+    <listitem>
+      <para>
+        <literal>services/monitoring/longview.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>hardware/video/webcam/facetimehd.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>i18n/input-method/default.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>i18n/input-method/fcitx.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>i18n/input-method/ibus.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>i18n/input-method/nabi.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>i18n/input-method/uim.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>programs/fish.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>security/acme.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>security/audit.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>security/oath.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/hardware/irqbalance.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/mail/dspam.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/mail/opendkim.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/mail/postsrsd.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/mail/rspamd.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/mail/rmilter.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/misc/autofs.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/misc/bepasty.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/misc/calibre-server.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/misc/cfdyndns.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/misc/gammu-smsd.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/misc/mathics.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/misc/matrix-synapse.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/misc/octoprint.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/monitoring/hdaps.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/monitoring/heapster.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/monitoring/longview.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/network-filesystems/netatalk.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/network-filesystems/xtreemfs.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/autossh.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/dnschain.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/gale.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/miniupnpd.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/namecoind.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/ostinato.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/pdnsd.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/shairport-sync.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/networking/supplicant.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/search/kibana.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/security/haka.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/security/physlock.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/web-apps/pump.io.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/x11/hardware/libinput.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services/x11/window-managers/windowlab.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>system/boot/initrd-network.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>system/boot/initrd-ssh.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>system/boot/loader/loader.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>system/boot/networkd.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>system/boot/resolved.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>virtualisation/lxd.nix</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>virtualisation/rkt.nix</literal>
+      </para>
+    </listitem>
+  </itemizedlist>
+  <para>
+    When upgrading from a previous release, please be aware of the
+    following incompatible changes:
+  </para>
+  <itemizedlist>
+    <listitem>
+      <para>
+        We no longer produce graphical ISO images and VirtualBox images
+        for <literal>i686-linux</literal>. A minimal ISO image is still
+        provided.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Firefox and similar browsers are now <emphasis>wrapped by
+        default</emphasis>. The package and attribute names are plain
+        <literal>firefox</literal> or <literal>midori</literal>, etc.
+        Backward-compatibility attributes were set up, but note that
+        <literal>nix-env -u</literal> will <emphasis>not</emphasis>
+        update your current <literal>firefox-with-plugins</literal>; you
+        have to uninstall it and install <literal>firefox</literal>
+        instead.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>wmiiSnap</literal> has been replaced with
+        <literal>wmii_hg</literal>, but
+        <literal>services.xserver.windowManager.wmii.enable</literal>
+        has been updated respectively so this only affects you if you
+        have explicitly installed <literal>wmiiSnap</literal>.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>jobs</literal> NixOS option has been removed. It served
+        as compatibility layer between Upstart jobs and SystemD
+        services. All services have been rewritten to use
+        <literal>systemd.services</literal>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>wmiimenu</literal> is removed, as it has been removed
+        by the developers upstream. Use <literal>wimenu</literal> from
+        the <literal>wmii-hg</literal> package.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Gitit is no longer automatically added to the module list in
+        NixOS and as such there will not be any manual entries for it.
+        You will need to add an import statement to your NixOS
+        configuration in order to use it, e.g.
+      </para>
+      <programlisting language="bash">
+{
+  imports = [ &lt;nixpkgs/nixos/modules/services/misc/gitit.nix&gt; ];
+}
+</programlisting>
+      <para>
+        will include the Gitit service configuration options.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>nginx</literal> does not accept flags for enabling and
+        disabling modules anymore. Instead it accepts
+        <literal>modules</literal> argument, which is a list of modules
+        to be built in. All modules now reside in
+        <literal>nginxModules</literal> set. Example configuration:
+      </para>
+      <programlisting language="bash">
+nginx.override {
+  modules = [ nginxModules.rtmp nginxModules.dav nginxModules.moreheaders ];
+}
+</programlisting>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>s3sync</literal> is removed, as it hasn't been
+        developed by upstream for 4 years and only runs with ruby 1.8.
+        For an actively-developer alternative look at
+        <literal>tarsnap</literal> and others.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>ruby_1_8</literal> has been removed as it's not
+        supported from upstream anymore and probably contains security
+        issues.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>tidy-html5</literal> package is removed. Upstream only
+        provided <literal>(lib)tidy5</literal> during development, and
+        now they went back to <literal>(lib)tidy</literal> to work as a
+        drop-in replacement of the original package that has been
+        unmaintained for years. You can (still) use the
+        <literal>html-tidy</literal> package, which got updated to a
+        stable release from this new upstream.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>extraDeviceOptions</literal> argument is removed from
+        <literal>bumblebee</literal> package. Instead there are now two
+        separate arguments: <literal>extraNvidiaDeviceOptions</literal>
+        and <literal>extraNouveauDeviceOptions</literal> for setting
+        extra X11 options for nvidia and nouveau drivers, respectively.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        The <literal>Ctrl+Alt+Backspace</literal> key combination no
+        longer kills the X server by default. There's a new option
+        <literal>services.xserver.enableCtrlAltBackspace</literal>
+        allowing to enable the combination again.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>emacsPackagesNg</literal> now contains all packages
+        from the ELPA, MELPA, and MELPA Stable repositories.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Data directory for Postfix MTA server is moved from
+        <literal>/var/postfix</literal> to
+        <literal>/var/lib/postfix</literal>. Old configurations are
+        migrated automatically. <literal>service.postfix</literal>
+        module has also received many improvements, such as correct
+        directories' access rights, new <literal>aliasFiles</literal>
+        and <literal>mapFiles</literal> options and more.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Filesystem options should now be configured as a list of
+        strings, not a comma-separated string. The old style will
+        continue to work, but print a warning, until the 16.09 release.
+        An example of the new style:
+      </para>
+      <programlisting language="bash">
+{
+  fileSystems.&quot;/example&quot; = {
+    device = &quot;/dev/sdc&quot;;
+    fsType = &quot;btrfs&quot;;
+    options = [ &quot;noatime&quot; &quot;compress=lzo&quot; &quot;space_cache&quot; &quot;autodefrag&quot; ];
+  };
+}
+</programlisting>
+    </listitem>
+    <listitem>
+      <para>
+        CUPS, installed by <literal>services.printing</literal> module,
+        now has its data directory in <literal>/var/lib/cups</literal>.
+        Old configurations from <literal>/etc/cups</literal> are moved
+        there automatically, but there might be problems. Also
+        configuration options
+        <literal>services.printing.cupsdConf</literal> and
+        <literal>services.printing.cupsdFilesConf</literal> were removed
+        because they had been allowing one to override configuration
+        variables required for CUPS to work at all on NixOS. For most
+        use cases, <literal>services.printing.extraConf</literal> and
+        new option <literal>services.printing.extraFilesConf</literal>
+        should be enough; if you encounter a situation when they are
+        not, please file a bug.
+      </para>
+      <para>
+        There are also Gutenprint improvements; in particular, a new
+        option <literal>services.printing.gutenprint</literal> is added
+        to enable automatic updating of Gutenprint PPMs; it's greatly
+        recommended to enable it instead of adding
+        <literal>gutenprint</literal> to the <literal>drivers</literal>
+        list.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services.xserver.vaapiDrivers</literal> has been
+        removed. Use
+        <literal>hardware.opengl.extraPackages{,32}</literal> instead.
+        You can also specify VDPAU drivers there.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>programs.ibus</literal> moved to
+        <literal>i18n.inputMethod.ibus</literal>. The option
+        <literal>programs.ibus.plugins</literal> changed to
+        <literal>i18n.inputMethod.ibus.engines</literal> and the option
+        to enable ibus changed from
+        <literal>programs.ibus.enable</literal> to
+        <literal>i18n.inputMethod.enabled</literal>.
+        <literal>i18n.inputMethod.enabled</literal> should be set to the
+        used input method name, <literal>&quot;ibus&quot;</literal> for
+        ibus. An example of the new style:
+      </para>
+      <programlisting language="bash">
+{
+  i18n.inputMethod.enabled = &quot;ibus&quot;;
+  i18n.inputMethod.ibus.engines = with pkgs.ibus-engines; [ anthy mozc ];
+}
+</programlisting>
+      <para>
+        That is equivalent to the old version:
+      </para>
+      <programlisting language="bash">
+{
+  programs.ibus.enable = true;
+  programs.ibus.plugins = with pkgs; [ ibus-anthy mozc ];
+}
+</programlisting>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services.udev.extraRules</literal> option now writes
+        rules to <literal>99-local.rules</literal> instead of
+        <literal>10-local.rules</literal>. This makes all the user rules
+        apply after others, so their results wouldn't be overriden by
+        anything else.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Large parts of the <literal>services.gitlab</literal> module has
+        been been rewritten. There are new configuration options
+        available. The <literal>stateDir</literal> option was renamned
+        to <literal>statePath</literal> and the
+        <literal>satellitesDir</literal> option was removed. Please
+        review the currently available options.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        The option
+        <literal>services.nsd.zones.&lt;name&gt;.data</literal> no
+        longer interpret the dollar sign ($) as a shell variable, as
+        such it should not be escaped anymore. Thus the following zone
+        data:
+      </para>
+      <programlisting>
+$ORIGIN example.com.
+$TTL 1800
+@       IN      SOA     ns1.vpn.nbp.name.      admin.example.com. (
+</programlisting>
+      <para>
+        Should modified to look like the actual file expected by nsd:
+      </para>
+      <programlisting>
+$ORIGIN example.com.
+$TTL 1800
+@       IN      SOA     ns1.vpn.nbp.name.      admin.example.com. (
+</programlisting>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>service.syncthing.dataDir</literal> options now has to
+        point to exact folder where syncthing is writing to. Example
+        configuration should look something like:
+      </para>
+      <programlisting language="bash">
+{
+  services.syncthing = {
+      enable = true;
+      dataDir = &quot;/home/somebody/.syncthing&quot;;
+      user = &quot;somebody&quot;;
+  };
+}
+</programlisting>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>networking.firewall.allowPing</literal> is now enabled
+        by default. Users are encouraged to configure an appropriate
+        rate limit for their machines using the Kernel interface at
+        <literal>/proc/sys/net/ipv4/icmp_ratelimit</literal> and
+        <literal>/proc/sys/net/ipv6/icmp/ratelimit</literal> or using
+        the firewall itself, i.e. by setting the NixOS option
+        <literal>networking.firewall.pingLimit</literal>.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Systems with some broadcom cards used to result into a generated
+        config that is no longer accepted. If you get errors like
+      </para>
+      <programlisting>
+error: path ‘/nix/store/*-broadcom-sta-*’ does not exist and cannot be created
+</programlisting>
+      <para>
+        you should either re-run
+        <literal>nixos-generate-config</literal> or manually replace
+        <literal>&quot;${config.boot.kernelPackages.broadcom_sta}&quot;</literal>
+        by <literal>config.boot.kernelPackages.broadcom_sta</literal> in
+        your <literal>/etc/nixos/hardware-configuration.nix</literal>.
+        More discussion is on
+        <link xlink:href="https://github.com/NixOS/nixpkgs/pull/12595">
+        the github issue</link>.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        The <literal>services.xserver.startGnuPGAgent</literal> option
+        has been removed. GnuPG 2.1.x changed the way the gpg-agent
+        works, and that new approach no longer requires (or even
+        supports) the &quot;start everything as a child of the
+        agent&quot; scheme we've implemented in NixOS for older
+        versions. To configure the gpg-agent for your X session, add the
+        following code to <literal>~/.bashrc</literal> or some file
+        that’s sourced when your shell is started:
+      </para>
+      <programlisting>
+GPG_TTY=$(tty)
+export GPG_TTY
+</programlisting>
+      <para>
+        If you want to use gpg-agent for SSH, too, add the following to
+        your session initialization (e.g.
+        <literal>displayManager.sessionCommands</literal>)
+      </para>
+      <programlisting>
+    gpg-connect-agent /bye
+    unset SSH_AGENT_PID
+    export SSH_AUTH_SOCK=&quot;''${HOME}/.gnupg/S.gpg-agent.ssh&quot;
+</programlisting>
+      <para>
+        and make sure that
+      </para>
+      <programlisting>
+    enable-ssh-support
+</programlisting>
+      <para>
+        is included in your <literal>~/.gnupg/gpg-agent.conf</literal>.
+        You will need to use <literal>ssh-add</literal> to re-add your
+        ssh keys. If gpg’s automatic transformation of the private keys
+        to the new format fails, you will need to re-import your private
+        keyring as well:
+      </para>
+      <programlisting>
+    gpg --import ~/.gnupg/secring.gpg
+</programlisting>
+      <para>
+        The <literal>gpg-agent(1)</literal> man page has more details
+        about this subject, i.e. in the &quot;EXAMPLES&quot; section.
+      </para>
+    </listitem>
+  </itemizedlist>
+  <para>
+    Other notable improvements:
+  </para>
+  <itemizedlist>
+    <listitem>
+      <para>
+        <literal>ejabberd</literal> module is brought back and now works
+        on NixOS.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Input method support was improved. New NixOS modules (fcitx,
+        nabi and uim), fcitx engines (chewing, hangul, m17n, mozc and
+        table-other) and ibus engines (hangul and m17n) have been added.
+      </para>
+    </listitem>
+  </itemizedlist>
+</section>
diff --git a/nixos/doc/manual/from_md/release-notes/rl-1609.section.xml b/nixos/doc/manual/from_md/release-notes/rl-1609.section.xml
new file mode 100644
index 000000000000..0fba40a0e78d
--- /dev/null
+++ b/nixos/doc/manual/from_md/release-notes/rl-1609.section.xml
@@ -0,0 +1,273 @@
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-release-16.09">
+  <title>Release 16.09 (<quote>Flounder</quote>, 2016/09/30)</title>
+  <para>
+    In addition to numerous new and upgraded packages, this release has
+    the following highlights:
+  </para>
+  <itemizedlist>
+    <listitem>
+      <para>
+        Many NixOS configurations and Nix packages now use significantly
+        less disk space, thanks to the
+        <link xlink:href="https://github.com/NixOS/nixpkgs/issues/7117">extensive
+        work on closure size reduction</link>. For example, the closure
+        size of a minimal NixOS container went down from ~424 MiB in
+        16.03 to ~212 MiB in 16.09, while the closure size of Firefox
+        went from ~651 MiB to ~259 MiB.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        To improve security, packages are now
+        <link xlink:href="https://github.com/NixOS/nixpkgs/pull/12895">built
+        using various hardening features</link>. See the Nixpkgs manual
+        for more information.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Support for PXE netboot. See
+        <xref linkend="sec-booting-from-pxe" /> for documentation.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        X.org server 1.18. If you use the <literal>ati_unfree</literal>
+        driver, 1.17 is still used due to an ABI incompatibility.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        This release is based on Glibc 2.24, GCC 5.4.0 and systemd 231.
+        The default Linux kernel remains 4.4.
+      </para>
+    </listitem>
+  </itemizedlist>
+  <para>
+    The following new services were added since the last release:
+  </para>
+  <itemizedlist spacing="compact">
+    <listitem>
+      <para>
+        <literal>(this will get automatically generated at release time)</literal>
+      </para>
+    </listitem>
+  </itemizedlist>
+  <para>
+    When upgrading from a previous release, please be aware of the
+    following incompatible changes:
+  </para>
+  <itemizedlist>
+    <listitem>
+      <para>
+        A large number of packages have been converted to use the
+        multiple outputs feature of Nix to greatly reduce the amount of
+        required disk space, as mentioned above. This may require
+        changes to any custom packages to make them build again; see the
+        relevant chapter in the Nixpkgs manual for more information.
+        (Additional caveat to packagers: some packaging conventions
+        related to multiple-output packages
+        <link xlink:href="https://github.com/NixOS/nixpkgs/pull/14766">were
+        changed</link> late (August 2016) in the release cycle and
+        differ from the initial introduction of multiple outputs.)
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Previous versions of Nixpkgs had support for all versions of the
+        LTS Haskell package set. That support has been dropped. The
+        previously provided <literal>haskell.packages.lts-x_y</literal>
+        package sets still exist in name to aviod breaking user code,
+        but these package sets don't actually contain the versions
+        mandated by the corresponding LTS release. Instead, our package
+        set it loosely based on the latest available LTS release, i.e.
+        LTS 7.x at the time of this writing. New releases of NixOS and
+        Nixpkgs will drop those old names entirely.
+        <link xlink:href="https://nixos.org/nix-dev/2016-June/020585.html">The
+        motivation for this change</link> has been discussed at length
+        on the <literal>nix-dev</literal> mailing list and in
+        <link xlink:href="https://github.com/NixOS/nixpkgs/issues/14897">Github
+        issue #14897</link>. Development strategies for Haskell hackers
+        who want to rely on Nix and NixOS have been described in
+        <link xlink:href="https://nixos.org/nix-dev/2016-June/020642.html">another
+        nix-dev article</link>.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Shell aliases for systemd sub-commands
+        <link xlink:href="https://github.com/NixOS/nixpkgs/pull/15598">were
+        dropped</link>: <literal>start</literal>,
+        <literal>stop</literal>, <literal>restart</literal>,
+        <literal>status</literal>.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Redis now binds to 127.0.0.1 only instead of listening to all
+        network interfaces. This is the default behavior of Redis 3.2
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>/var/empty</literal> is now immutable. Activation
+        script runs <literal>chattr +i</literal> to forbid any
+        modifications inside the folder. See
+        <link xlink:href="https://github.com/NixOS/nixpkgs/pull/18365">
+        the pull request</link> for what bugs this caused.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Gitlab's maintainance script <literal>gitlab-runner</literal>
+        was removed and split up into the more clearer
+        <literal>gitlab-run</literal> and <literal>gitlab-rake</literal>
+        scripts, because <literal>gitlab-runner</literal> is a component
+        of Gitlab CI.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services.xserver.libinput.accelProfile</literal>
+        default changed from <literal>flat</literal> to
+        <literal>adaptive</literal>, as per
+        <link xlink:href="https://wayland.freedesktop.org/libinput/doc/latest/group__config.html#gad63796972347f318b180e322e35cee79">
+        official documentation</link>.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>fonts.fontconfig.ultimate.rendering</literal> was
+        removed because our presets were obsolete for some time. New
+        presets are hardcoded into FreeType; you can select a preset via
+        <literal>fonts.fontconfig.ultimate.preset</literal>. You can
+        customize those presets via ordinary environment variables,
+        using <literal>environment.variables</literal>.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        The <literal>audit</literal> service is no longer enabled by
+        default. Use <literal>security.audit.enable = true</literal> to
+        explicitly enable it.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>pkgs.linuxPackages.virtualbox</literal> now contains
+        only the kernel modules instead of the VirtualBox user space
+        binaries. If you want to reference the user space binaries, you
+        have to use the new <literal>pkgs.virtualbox</literal> instead.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>goPackages</literal> was replaced with separated Go
+        applications in appropriate <literal>nixpkgs</literal>
+        categories. Each Go package uses its own dependency set. There's
+        also a new <literal>go2nix</literal> tool introduced to generate
+        a Go package definition from its Go source automatically.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services.mongodb.extraConfig</literal> configuration
+        format was changed to YAML.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        PHP has been upgraded to 7.0
+      </para>
+    </listitem>
+  </itemizedlist>
+  <para>
+    Other notable improvements:
+  </para>
+  <itemizedlist>
+    <listitem>
+      <para>
+        Revamped grsecurity/PaX support. There is now only a single
+        general-purpose distribution kernel and the configuration
+        interface has been streamlined. Desktop users should be able to
+        simply set
+      </para>
+      <programlisting language="bash">
+{
+  security.grsecurity.enable = true;
+}
+</programlisting>
+      <para>
+        to get a reasonably secure system without having to sacrifice
+        too much functionality.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Special filesystems, like <literal>/proc</literal>,
+        <literal>/run</literal> and others, now have the same mount
+        options as recommended by systemd and are unified across
+        different places in NixOS. Mount options are updated during
+        <literal>nixos-rebuild switch</literal> if possible. One benefit
+        from this is improved security — most such filesystems are now
+        mounted with <literal>noexec</literal>, <literal>nodev</literal>
+        and/or <literal>nosuid</literal> options.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        The reverse path filter was interfering with DHCPv4 server
+        operation in the past. An exception for DHCPv4 and a new option
+        to log packets that were dropped due to the reverse path filter
+        was added
+        (<literal>networking.firewall.logReversePathDrops</literal>) for
+        easier debugging.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Containers configuration within
+        <literal>containers.&lt;name&gt;.config</literal> is
+        <link xlink:href="https://github.com/NixOS/nixpkgs/pull/17365">now
+        properly typed and checked</link>. In particular, partial
+        configurations are merged correctly.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        The directory container setuid wrapper programs,
+        <literal>/var/setuid-wrappers</literal>,
+        <link xlink:href="https://github.com/NixOS/nixpkgs/pull/18124">is
+        now updated atomically to prevent failures if the switch to a
+        new configuration is interrupted.</link>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <literal>services.xserver.startGnuPGAgent</literal> has been
+        removed due to GnuPG 2.1.x bump. See
+        <link xlink:href="https://github.com/NixOS/nixpkgs/commit/5391882ebd781149e213e8817fba6ac3c503740c">
+        how to achieve similar behavior</link>. You might need to
+        <literal>pkill gpg-agent</literal> after the upgrade to prevent
+        a stale agent being in the way.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        <link xlink:href="https://github.com/NixOS/nixpkgs/commit/e561edc322d275c3687fec431935095cfc717147">
+        Declarative users could share the uid due to the bug in the
+        script handling conflict resolution. </link>
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Gummi boot has been replaced using systemd-boot.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Hydra package and NixOS module were added for convenience.
+      </para>
+    </listitem>
+  </itemizedlist>
+</section>
diff --git a/nixos/doc/manual/from_md/release-notes/rl-1703.section.xml b/nixos/doc/manual/from_md/release-notes/rl-1703.section.xml
new file mode 100644
index 000000000000..1119ec53dfc9
--- /dev/null
+++ b/nixos/doc/manual/from_md/release-notes/rl-1703.section.xml
@@ -0,0 +1,818 @@
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-release-17.03">
+  <title>Release 17.03 (<quote>Gorilla</quote>, 2017/03/31)</title>
+  <section xml:id="sec-release-17.03-highlights">
+    <title>Highlights</title>
+    <para>
+      In addition to numerous new and upgraded packages, this release
+      has the following highlights:
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          Nixpkgs is now extensible through overlays. See the
+          <link xlink:href="https://nixos.org/nixpkgs/manual/#sec-overlays-install">Nixpkgs
+          manual</link> for more information.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          This release is based on Glibc 2.25, GCC 5.4.0 and systemd
+          232. The default Linux kernel is 4.9 and Nix is at 1.11.8.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The default desktop environment now is KDE's Plasma 5. KDE 4
+          has been removed
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The setuid wrapper functionality now supports setting
+          capabilities.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          X.org server uses branch 1.19. Due to ABI incompatibilities,
+          <literal>ati_unfree</literal> keeps forcing 1.17 and
+          <literal>amdgpu-pro</literal> starts forcing 1.18.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Cross compilation has been rewritten. See the nixpkgs manual
+          for details. The most obvious breaking change is that in
+          derivations there is no <literal>.nativeDrv</literal> nor
+          <literal>.crossDrv</literal> are now cross by default, not
+          native.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>overridePackages</literal> function has been
+          rewritten to be replaced by
+          <link xlink:href="https://nixos.org/nixpkgs/manual/#sec-overlays-install">
+          overlays</link>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Packages in nixpkgs can be marked as insecure through listed
+          vulnerabilities. See the
+          <link xlink:href="https://nixos.org/nixpkgs/manual/#sec-allow-insecure">Nixpkgs
+          manual</link> for more information.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          PHP now defaults to PHP 7.1
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-17.03-new-services">
+    <title>New Services</title>
+    <para>
+      The following new services were added since the last release:
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          <literal>hardware/ckb.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>hardware/mcelog.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>hardware/usb-wwan.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>hardware/video/capture/mwprocapture.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>programs/adb.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>programs/chromium.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>programs/gphoto2.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>programs/java.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>programs/mtr.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>programs/oblogout.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>programs/vim.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>programs/wireshark.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>security/dhparams.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/audio/ympd.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/computing/boinc/client.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/continuous-integration/buildbot/master.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/continuous-integration/buildbot/worker.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/continuous-integration/gitlab-runner.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/databases/riak-cs.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/databases/stanchion.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/desktops/gnome3/gnome-terminal-server.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/editors/infinoted.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/hardware/illum.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/hardware/trezord.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/logging/journalbeat.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/mail/offlineimap.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/mail/postgrey.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/misc/couchpotato.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/misc/docker-registry.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/misc/errbot.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/misc/geoip-updater.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/misc/gogs.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/misc/leaps.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/misc/nix-optimise.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/misc/ssm-agent.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/misc/sssd.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/monitoring/arbtt.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/monitoring/netdata.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/monitoring/prometheus/default.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/monitoring/prometheus/alertmanager.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/monitoring/prometheus/blackbox-exporter.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/monitoring/prometheus/json-exporter.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/monitoring/prometheus/nginx-exporter.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/monitoring/prometheus/node-exporter.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/monitoring/prometheus/snmp-exporter.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/monitoring/prometheus/unifi-exporter.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/monitoring/prometheus/varnish-exporter.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/monitoring/sysstat.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/monitoring/telegraf.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/monitoring/vnstat.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/network-filesystems/cachefilesd.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/network-filesystems/glusterfs.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/network-filesystems/ipfs.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/networking/dante.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/networking/dnscrypt-wrapper.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/networking/fakeroute.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/networking/flannel.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/networking/htpdate.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/networking/miredo.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/networking/nftables.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/networking/powerdns.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/networking/pdns-recursor.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/networking/quagga.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/networking/redsocks.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/networking/wireguard.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/system/cgmanager.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/torrent/opentracker.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/web-apps/atlassian/confluence.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/web-apps/atlassian/crowd.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/web-apps/atlassian/jira.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/web-apps/frab.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/web-apps/nixbot.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/web-apps/selfoss.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/web-apps/quassel-webserver.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/x11/unclutter-xfixes.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/x11/urxvtd.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>system/boot/systemd-nspawn.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>virtualisation/ecs-agent.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>virtualisation/lxcfs.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>virtualisation/openstack/keystone.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>virtualisation/openstack/glance.nix</literal>
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-17.03-incompatibilities">
+    <title>Backward Incompatibilities</title>
+    <para>
+      When upgrading from a previous release, please be aware of the
+      following incompatible changes:
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          Derivations have no <literal>.nativeDrv</literal> nor
+          <literal>.crossDrv</literal> and are now cross by default, not
+          native.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>stdenv.overrides</literal> is now expected to take
+          <literal>self</literal> and <literal>super</literal>
+          arguments. See <literal>lib.trivial.extends</literal> for what
+          those parameters represent.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>ansible</literal> now defaults to ansible version 2
+          as version 1 has been removed due to a serious
+          <link xlink:href="https://www.computest.nl/advisories/CT-2017-0109_Ansible.txt">
+          vulnerability</link> unpatched by upstream.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>gnome</literal> alias has been removed along with
+          <literal>gtk</literal>, <literal>gtkmm</literal> and several
+          others. Now you need to use versioned attributes, like
+          <literal>gnome3</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The attribute name of the Radicale daemon has been changed
+          from <literal>pythonPackages.radicale</literal> to
+          <literal>radicale</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>stripHash</literal> bash function in
+          <literal>stdenv</literal> changed according to its
+          documentation; it now outputs the stripped name to
+          <literal>stdout</literal> instead of putting it in the
+          variable <literal>strippedName</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          PHP now scans for extra configuration .ini files in /etc/php.d
+          instead of /etc. This prevents accidentally loading non-PHP
+          .ini files that may be in /etc.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Two lone top-level dict dbs moved into
+          <literal>dictdDBs</literal>. This affects:
+          <literal>dictdWordnet</literal> which is now at
+          <literal>dictdDBs.wordnet</literal> and
+          <literal>dictdWiktionary</literal> which is now at
+          <literal>dictdDBs.wiktionary</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Parsoid service now uses YAML configuration format.
+          <literal>service.parsoid.interwikis</literal> is now called
+          <literal>service.parsoid.wikis</literal> and is a list of
+          either API URLs or attribute sets as specified in parsoid's
+          documentation.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>Ntpd</literal> was replaced by
+          <literal>systemd-timesyncd</literal> as the default service to
+          synchronize system time with a remote NTP server. The old
+          behavior can be restored by setting
+          <literal>services.ntp.enable</literal> to
+          <literal>true</literal>. Upstream time servers for all NTP
+          implementations are now configured using
+          <literal>networking.timeServers</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>service.nylon</literal> is now declared using named
+          instances. As an example:
+        </para>
+        <programlisting language="bash">
+{
+  services.nylon = {
+    enable = true;
+    acceptInterface = &quot;br0&quot;;
+    bindInterface = &quot;tun1&quot;;
+    port = 5912;
+  };
+}
+</programlisting>
+        <para>
+          should be replaced with:
+        </para>
+        <programlisting language="bash">
+{
+  services.nylon.myvpn = {
+    enable = true;
+    acceptInterface = &quot;br0&quot;;
+    bindInterface = &quot;tun1&quot;;
+    port = 5912;
+  };
+}
+</programlisting>
+        <para>
+          this enables you to declare a SOCKS proxy for each uplink.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>overridePackages</literal> function no longer exists.
+          It is replaced by
+          <link xlink:href="https://nixos.org/nixpkgs/manual/#sec-overlays-install">
+          overlays</link>. For example, the following code:
+        </para>
+        <programlisting language="bash">
+let
+  pkgs = import &lt;nixpkgs&gt; {};
+in
+  pkgs.overridePackages (self: super: ...)
+</programlisting>
+        <para>
+          should be replaced by:
+        </para>
+        <programlisting language="bash">
+let
+  pkgs = import &lt;nixpkgs&gt; {};
+in
+  import pkgs.path { overlays = [(self: super: ...)]; }
+</programlisting>
+      </listitem>
+      <listitem>
+        <para>
+          Autoloading connection tracking helpers is now disabled by
+          default. This default was also changed in the Linux kernel and
+          is considered insecure if not configured properly in your
+          firewall. If you need connection tracking helpers (i.e. for
+          active FTP) please enable
+          <literal>networking.firewall.autoLoadConntrackHelpers</literal>
+          and tune
+          <literal>networking.firewall.connectionTrackingModules</literal>
+          to suit your needs.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>local_recipient_maps</literal> is not set to empty
+          value by Postfix service. It's an insecure default as stated
+          by Postfix documentation. Those who want to retain this
+          setting need to set it via
+          <literal>services.postfix.extraConfig</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Iputils no longer provide ping6 and traceroute6. The
+          functionality of these tools has been integrated into ping and
+          traceroute respectively. To enforce an address family the new
+          flags <literal>-4</literal> and <literal>-6</literal> have
+          been added. One notable incompatibility is that specifying an
+          interface (for link-local IPv6 for instance) is no longer done
+          with the <literal>-I</literal> flag, but by encoding the
+          interface into the address
+          (<literal>ping fe80::1%eth0</literal>).
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The socket handling of the <literal>services.rmilter</literal>
+          module has been fixed and refactored. As rmilter doesn't
+          support binding to more than one socket, the options
+          <literal>bindUnixSockets</literal> and
+          <literal>bindInetSockets</literal> have been replaced by
+          <literal>services.rmilter.bindSocket.*</literal>. The default
+          is still a unix socket in
+          <literal>/run/rmilter/rmilter.sock</literal>. Refer to the
+          options documentation for more information.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>fetch*</literal> functions no longer support md5,
+          please use sha256 instead.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The dnscrypt-proxy module interface has been streamlined
+          around the <literal>extraArgs</literal> option. Where
+          possible, legacy option declarations are mapped to
+          <literal>extraArgs</literal> but will emit warnings. The
+          <literal>resolverList</literal> has been outright removed: to
+          use an unlisted resolver, use the
+          <literal>customResolver</literal> option.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          torbrowser now stores local state under
+          <literal>~/.local/share/tor-browser</literal> by default. Any
+          browser profile data from the old location,
+          <literal>~/.torbrowser4</literal>, must be migrated manually.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The ihaskell, monetdb, offlineimap and sitecopy services have
+          been removed.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-17.03-notable-changes">
+    <title>Other Notable Changes</title>
+    <itemizedlist>
+      <listitem>
+        <para>
+          Module type system have a new extensible option types feature
+          that allow to extend certain types, such as enum, through
+          multiple option declarations of the same option across
+          multiple modules.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>jre</literal> now defaults to GTK UI by default. This
+          improves visual consistency and makes Java follow system font
+          style, improving the situation on HighDPI displays. This has a
+          cost of increased closure size; for server and other headless
+          workloads it's recommended to use
+          <literal>jre_headless</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Python 2.6 interpreter and package set have been removed.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The Python 2.7 interpreter does not use modules anymore.
+          Instead, all CPython interpreters now include the whole
+          standard library except for `tkinter`, which is available in
+          the Python package set.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Python 2.7, 3.5 and 3.6 are now built deterministically and
+          3.4 mostly. Minor modifications had to be made to the
+          interpreters in order to generate deterministic bytecode. This
+          has security implications and is relevant for those using
+          Python in a <literal>nix-shell</literal>. See the Nixpkgs
+          manual for details.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The Python package sets now use a fixed-point combinator and
+          the sets are available as attributes of the interpreters.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The Python function <literal>buildPythonPackage</literal> has
+          been improved and can be used to build from Setuptools source,
+          Flit source, and precompiled Wheels.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          When adding new or updating current Python libraries, the
+          expressions should be put in separate files in
+          <literal>pkgs/development/python-modules</literal> and called
+          from <literal>python-packages.nix</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The dnscrypt-proxy service supports synchronizing the list of
+          public resolvers without working DNS resolution. This fixes
+          issues caused by the resolver list becoming outdated. It also
+          improves the viability of DNSCrypt only configurations.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Containers using bridged networking no longer lose their
+          connection after changes to the host networking.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          ZFS supports pool auto scrubbing.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The bind DNS utilities (e.g. dig) have been split into their
+          own output and are now also available in
+          <literal>pkgs.dnsutils</literal> and it is no longer necessary
+          to pull in all of <literal>bind</literal> to use them.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Per-user configuration was moved from
+          <literal>~/.nixpkgs</literal> to
+          <literal>~/.config/nixpkgs</literal>. The former is still
+          valid for <literal>config.nix</literal> for backwards
+          compatibility.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+</section>
diff --git a/nixos/doc/manual/from_md/release-notes/rl-1709.section.xml b/nixos/doc/manual/from_md/release-notes/rl-1709.section.xml
new file mode 100644
index 000000000000..8f0efe816e51
--- /dev/null
+++ b/nixos/doc/manual/from_md/release-notes/rl-1709.section.xml
@@ -0,0 +1,922 @@
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-release-17.09">
+  <title>Release 17.09 (<quote>Hummingbird</quote>, 2017/09/??)</title>
+  <section xml:id="sec-release-17.09-highlights">
+    <title>Highlights</title>
+    <para>
+      In addition to numerous new and upgraded packages, this release
+      has the following highlights:
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          The GNOME version is now 3.24. KDE Plasma was upgraded to
+          5.10, KDE Applications to 17.08.1 and KDE Frameworks to 5.37.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The user handling now keeps track of deallocated UIDs/GIDs.
+          When a user or group is revived, this allows it to be
+          allocated the UID/GID it had before. A consequence is that
+          UIDs and GIDs are no longer reused.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The module option
+          <literal>services.xserver.xrandrHeads</literal> now causes the
+          first head specified in this list to be set as the primary
+          head. Apart from that, it's now possible to also set
+          additional options by using an attribute set, for example:
+        </para>
+        <programlisting language="bash">
+{ services.xserver.xrandrHeads = [
+    &quot;HDMI-0&quot;
+    {
+      output = &quot;DVI-0&quot;;
+      primary = true;
+      monitorConfig = ''
+        Option &quot;Rotate&quot; &quot;right&quot;
+      '';
+    }
+  ];
+}
+</programlisting>
+        <para>
+          This will set the <literal>DVI-0</literal> output to be the
+          primary head, even though <literal>HDMI-0</literal> is the
+          first head in the list.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The handling of SSL in the <literal>services.nginx</literal>
+          module has been cleaned up, renaming the misnamed
+          <literal>enableSSL</literal> to <literal>onlySSL</literal>
+          which reflects its original intention. This is not to be used
+          with the already existing <literal>forceSSL</literal> which
+          creates a second non-SSL virtual host redirecting to the SSL
+          virtual host. This by chance had worked earlier due to
+          specific implementation details. In case you had specified
+          both please remove the <literal>enableSSL</literal> option to
+          keep the previous behaviour.
+        </para>
+        <para>
+          Another <literal>addSSL</literal> option has been introduced
+          to configure both a non-SSL virtual host and an SSL virtual
+          host with the same configuration.
+        </para>
+        <para>
+          Options to configure <literal>resolver</literal> options and
+          <literal>upstream</literal> blocks have been introduced. See
+          their information for further details.
+        </para>
+        <para>
+          The <literal>port</literal> option has been replaced by a more
+          generic <literal>listen</literal> option which makes it
+          possible to specify multiple addresses, ports and SSL configs
+          dependant on the new SSL handling mentioned above.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-17.09-new-services">
+    <title>New Services</title>
+    <para>
+      The following new services were added since the last release:
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          <literal>config/fonts/fontconfig-penultimate.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>config/fonts/fontconfig-ultimate.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>config/terminfo.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>hardware/sensor/iio.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>hardware/nitrokey.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>hardware/raid/hpsa.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>programs/browserpass.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>programs/gnupg.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>programs/qt5ct.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>programs/slock.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>programs/thefuck.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>security/auditd.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>security/lock-kernel-modules.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>service-managers/docker.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>service-managers/trivial.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/admin/salt/master.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/admin/salt/minion.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/audio/slimserver.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/cluster/kubernetes/default.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/cluster/kubernetes/dns.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/cluster/kubernetes/dashboard.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/continuous-integration/hail.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/databases/clickhouse.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/databases/postage.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/desktops/gnome3/gnome-disks.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/desktops/gnome3/gpaste.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/logging/SystemdJournal2Gelf.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/logging/heartbeat.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/logging/journalwatch.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/logging/syslogd.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/mail/mailhog.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/mail/nullmailer.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/misc/airsonic.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/misc/autorandr.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/misc/exhibitor.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/misc/fstrim.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/misc/gollum.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/misc/irkerd.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/misc/jackett.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/misc/radarr.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/misc/snapper.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/monitoring/osquery.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/monitoring/prometheus/collectd-exporter.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/monitoring/prometheus/fritzbox-exporter.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/network-filesystems/kbfs.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/networking/dnscache.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/networking/fireqos.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/networking/iwd.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/networking/keepalived/default.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/networking/keybase.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/networking/lldpd.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/networking/matterbridge.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/networking/squid.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/networking/tinydns.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/networking/xrdp.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/security/shibboleth-sp.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/security/sks.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/security/sshguard.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/security/torify.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/security/usbguard.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/security/vault.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/system/earlyoom.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/system/saslauthd.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/web-apps/nexus.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/web-apps/pgpkeyserver-lite.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/web-apps/piwik.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/web-servers/lighttpd/collectd.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/web-servers/minio.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/x11/display-managers/xpra.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services/x11/xautolock.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>tasks/filesystems/bcachefs.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>tasks/powertop.nix</literal>
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-17.09-incompatibilities">
+    <title>Backward Incompatibilities</title>
+    <para>
+      When upgrading from a previous release, please be aware of the
+      following incompatible changes:
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          <emphasis role="strong">In an Qemu-based virtualization
+          environment, the network interface names changed from i.e.
+          <literal>enp0s3</literal> to
+          <literal>ens3</literal>.</emphasis>
+        </para>
+        <para>
+          This is due to a kernel configuration change. The new naming
+          is consistent with those of other Linux distributions with
+          systemd. See
+          <link xlink:href="https://github.com/NixOS/nixpkgs/issues/29197">#29197</link>
+          for more information.
+        </para>
+        <para>
+          A machine is affected if the <literal>virt-what</literal> tool
+          either returns <literal>qemu</literal> or
+          <literal>kvm</literal> <emphasis>and</emphasis> has interface
+          names used in any part of its NixOS configuration, in
+          particular if a static network configuration with
+          <literal>networking.interfaces</literal> is used.
+        </para>
+        <para>
+          Before rebooting affected machines, please ensure:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              Change the interface names in your NixOS configuration.
+              The first interface will be called
+              <literal>ens3</literal>, the second one
+              <literal>ens8</literal> and starting from there
+              incremented by 1.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              After changing the interface names, rebuild your system
+              with <literal>nixos-rebuild boot</literal> to activate the
+              new configuration after a reboot. If you switch to the new
+              configuration right away you might lose network
+              connectivity! If using <literal>nixops</literal>, deploy
+              with <literal>nixops deploy --force-reboot</literal>.
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          The following changes apply if the
+          <literal>stateVersion</literal> is changed to 17.09 or higher.
+          For <literal>stateVersion = &quot;17.03&quot;</literal> or
+          lower the old behavior is preserved.
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              The <literal>postgres</literal> default version was
+              changed from 9.5 to 9.6.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              The <literal>postgres</literal> superuser name has changed
+              from <literal>root</literal> to
+              <literal>postgres</literal> to more closely follow what
+              other Linux distributions are doing.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              The <literal>postgres</literal> default
+              <literal>dataDir</literal> has changed from
+              <literal>/var/db/postgres</literal> to
+              <literal>/var/lib/postgresql/$psqlSchema</literal> where
+              $psqlSchema is 9.6 for example.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              The <literal>mysql</literal> default
+              <literal>dataDir</literal> has changed from
+              <literal>/var/mysql</literal> to
+              <literal>/var/lib/mysql</literal>.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              Radicale's default package has changed from 1.x to 2.x.
+              Instructions to migrate can be found
+              <link xlink:href="http://radicale.org/1to2/"> here
+              </link>. It is also possible to use the newer version by
+              setting the <literal>package</literal> to
+              <literal>radicale2</literal>, which is done automatically
+              when <literal>stateVersion</literal> is 17.09 or higher.
+              The <literal>extraArgs</literal> option has been added to
+              allow passing the data migration arguments specified in
+              the instructions; see the <literal>radicale.nix</literal>
+              NixOS test for an example migration.
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>aiccu</literal> package was removed. This is due
+          to SixXS <link xlink:href="https://www.sixxs.net/main/">
+          sunsetting</link> its IPv6 tunnel.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>fanctl</literal> package and
+          <literal>fan</literal> module have been removed due to the
+          developers not upstreaming their iproute2 patches and lagging
+          with compatibility to recent iproute2 versions.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Top-level <literal>idea</literal> package collection was
+          renamed. All JetBrains IDEs are now at
+          <literal>jetbrains</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>flexget</literal>'s state database cannot be upgraded
+          to its new internal format, requiring removal of any existing
+          <literal>db-config.sqlite</literal> which will be
+          automatically recreated.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>ipfs</literal> service now doesn't ignore the
+          <literal>dataDir</literal> option anymore. If you've ever set
+          this option to anything other than the default you'll have to
+          either unset it (so the default gets used) or migrate the old
+          data manually with
+        </para>
+        <programlisting>
+dataDir=&lt;valueOfDataDir&gt;
+mv /var/lib/ipfs/.ipfs/* $dataDir
+rmdir /var/lib/ipfs/.ipfs
+</programlisting>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>caddy</literal> service was previously using an
+          extra <literal>.caddy</literal> directory in the data
+          directory specified with the <literal>dataDir</literal>
+          option. The contents of the <literal>.caddy</literal>
+          directory are now expected to be in the
+          <literal>dataDir</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>ssh-agent</literal> user service is not started
+          by default anymore. Use
+          <literal>programs.ssh.startAgent</literal> to enable it if
+          needed. There is also a new
+          <literal>programs.gnupg.agent</literal> module that creates a
+          <literal>gpg-agent</literal> user service. It can also serve
+          as a SSH agent if <literal>enableSSHSupport</literal> is set.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The
+          <literal>services.tinc.networks.&lt;name&gt;.listenAddress</literal>
+          option had a misleading name that did not correspond to its
+          behavior. It now correctly defines the ip to listen for
+          incoming connections on. To keep the previous behaviour, use
+          <literal>services.tinc.networks.&lt;name&gt;.bindToAddress</literal>
+          instead. Refer to the description of the options for more
+          details.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>tlsdate</literal> package and module were removed.
+          This is due to the project being dead and not building with
+          openssl 1.1.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>wvdial</literal> package and module were removed.
+          This is due to the project being dead and not building with
+          openssl 1.1.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>cc-wrapper</literal>'s setup-hook now exports a
+          number of environment variables corresponding to binutils
+          binaries, (e.g. <literal>LD</literal>,
+          <literal>STRIP</literal>, <literal>RANLIB</literal>, etc).
+          This is done to prevent packages' build systems guessing,
+          which is harder to predict, especially when cross-compiling.
+          However, some packages have broken due to this—their build
+          systems either not supporting, or claiming to support without
+          adequate testing, taking such environment variables as
+          parameters.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services.firefox.syncserver</literal> now runs by
+          default as a non-root user. To accomodate this change, the
+          default sqlite database location has also been changed.
+          Migration should work automatically. Refer to the description
+          of the options for more details.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>compiz</literal> window manager and package was
+          removed. The system support had been broken for several years.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Touchpad support should now be enabled through
+          <literal>libinput</literal> as <literal>synaptics</literal> is
+          now deprecated. See the option
+          <literal>services.xserver.libinput.enable</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          grsecurity/PaX support has been dropped, following upstream's
+          decision to cease free support. See
+          <link xlink:href="https://grsecurity.net/passing_the_baton.php">
+          upstream's announcement</link> for more information. No
+          complete replacement for grsecurity/PaX is available
+          presently.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services.mysql</literal> now has declarative
+          configuration of databases and users with the
+          <literal>ensureDatabases</literal> and
+          <literal>ensureUsers</literal> options.
+        </para>
+        <para>
+          These options will never delete existing databases and users,
+          especially not when the value of the options are changed.
+        </para>
+        <para>
+          The MySQL users will be identified using
+          <link xlink:href="https://mariadb.com/kb/en/library/authentication-plugin-unix-socket/">
+          Unix socket authentication</link>. This authenticates the Unix
+          user with the same name only, and that without the need for a
+          password.
+        </para>
+        <para>
+          If you have previously created a MySQL <literal>root</literal>
+          user <emphasis>with a password</emphasis>, you will need to
+          add <literal>root</literal> user for unix socket
+          authentication before using the new options. This can be done
+          by running the following SQL script:
+        </para>
+        <programlisting language="SQL">
+CREATE USER 'root'@'%' IDENTIFIED BY '';
+GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' WITH GRANT OPTION;
+FLUSH PRIVILEGES;
+
+-- Optionally, delete the password-authenticated user:
+-- DROP USER 'root'@'localhost';
+</programlisting>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services.mysqlBackup</literal> now works by default
+          without any user setup, including for users other than
+          <literal>mysql</literal>.
+        </para>
+        <para>
+          By default, the <literal>mysql</literal> user is no longer the
+          user which performs the backup. Instead a system account
+          <literal>mysqlbackup</literal> is used.
+        </para>
+        <para>
+          The <literal>mysqlBackup</literal> service is also now using
+          systemd timers instead of <literal>cron</literal>.
+        </para>
+        <para>
+          Therefore, the <literal>services.mysqlBackup.period</literal>
+          option no longer exists, and has been replaced with
+          <literal>services.mysqlBackup.calendar</literal>, which is in
+          the format of
+          <link xlink:href="https://www.freedesktop.org/software/systemd/man/systemd.time.html#Calendar%20Events">systemd.time(7)</link>.
+        </para>
+        <para>
+          If you expect to be sent an e-mail when the backup fails,
+          consider using a script which monitors the systemd journal for
+          errors. Regretfully, at present there is no built-in
+          functionality for this.
+        </para>
+        <para>
+          You can check that backups still work by running
+          <literal>systemctl start mysql-backup</literal> then
+          <literal>systemctl status mysql-backup</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Templated systemd services e.g
+          <literal>container@name</literal> are now handled currectly
+          when switching to a new configuration, resulting in them being
+          reloaded.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Steam: the <literal>newStdcpp</literal> parameter was removed
+          and should not be needed anymore.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Redis has been updated to version 4 which mandates a cluster
+          mass-restart, due to changes in the network handling, in order
+          to ensure compatibility with networks NATing traffic.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-17.09-notable-changes">
+    <title>Other Notable Changes</title>
+    <itemizedlist>
+      <listitem>
+        <para>
+          Modules can now be disabled by using
+          <link xlink:href="https://nixos.org/nixpkgs/manual/#sec-replace-modules">
+          disabledModules</link>, allowing another to take it's place.
+          This can be used to import a set of modules from another
+          channel while keeping the rest of the system on a stable
+          release.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Updated to FreeType 2.7.1, including a new TrueType engine.
+          The new engine replaces the Infinality engine which was the
+          default in NixOS. The default font rendering settings are now
+          provided by fontconfig-penultimate, replacing
+          fontconfig-ultimate; the new defaults are less invasive and
+          provide rendering that is more consistent with other systems
+          and hopefully with each font designer's intent. Some
+          system-wide configuration has been removed from the Fontconfig
+          NixOS module where user Fontconfig settings are available.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          ZFS/SPL have been updated to 0.7.0,
+          <literal>zfsUnstable, splUnstable</literal> have therefore
+          been removed.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>time.timeZone</literal> option now allows the
+          value <literal>null</literal> in addition to timezone strings.
+          This value allows changing the timezone of a system
+          imperatively using
+          <literal>timedatectl set-timezone</literal>. The default
+          timezone is still UTC.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Nixpkgs overlays may now be specified with a file as well as a
+          directory. The value of
+          <literal>&lt;nixpkgs-overlays&gt;</literal> may be a file, and
+          <literal>~/.config/nixpkgs/overlays.nix</literal> can be used
+          instead of the <literal>~/.config/nixpkgs/overlays</literal>
+          directory.
+        </para>
+        <para>
+          See the overlays chapter of the Nixpkgs manual for more
+          details.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Definitions for <literal>/etc/hosts</literal> can now be
+          specified declaratively with
+          <literal>networking.hosts</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Two new options have been added to the installer loader, in
+          addition to the default having changed. The kernel log
+          verbosity has been lowered to the upstream default for the
+          default options, in order to not spam the console when e.g.
+          joining a network.
+        </para>
+        <para>
+          This therefore leads to adding a new <literal>debug</literal>
+          option to set the log level to the previous verbose mode, to
+          make debugging easier, but still accessible easily.
+        </para>
+        <para>
+          Additionally a <literal>copytoram</literal> option has been
+          added, which makes it possible to remove the install medium
+          after booting. This allows tethering from your phone after
+          booting from it.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services.gitlab-runner.configOptions</literal> has
+          been added to specify the configuration of gitlab-runners
+          declaratively.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services.jenkins.plugins</literal> has been added to
+          install plugins easily, this can be generated with
+          jenkinsPlugins2nix.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services.postfix.config</literal> has been added to
+          specify the main.cf with NixOS options. Additionally other
+          options have been added to the postfix module and has been
+          improved further.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The GitLab package and module have been updated to the latest
+          10.0 release.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>systemd-boot</literal> boot loader now lists the
+          NixOS version, kernel version and build date of all bootable
+          generations.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The dnscrypt-proxy service now defaults to using a random
+          upstream resolver, selected from the list of public
+          non-logging resolvers with DNSSEC support. Existing
+          configurations can be migrated to this mode of operation by
+          omitting the
+          <literal>services.dnscrypt-proxy.resolverName</literal> option
+          or setting it to <literal>&quot;random&quot;</literal>.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+</section>
diff --git a/nixos/doc/manual/from_md/release-notes/rl-1803.section.xml b/nixos/doc/manual/from_md/release-notes/rl-1803.section.xml
new file mode 100644
index 000000000000..f54f6129e0db
--- /dev/null
+++ b/nixos/doc/manual/from_md/release-notes/rl-1803.section.xml
@@ -0,0 +1,871 @@
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-release-18.03">
+  <title>Release 18.03 (<quote>Impala</quote>, 2018/04/04)</title>
+  <section xml:id="sec-release-18.03-highlights">
+    <title>Highlights</title>
+    <para>
+      In addition to numerous new and upgraded packages, this release
+      has the following highlights:
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          End of support is planned for end of October 2018, handing
+          over to 18.09.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Platform support: x86_64-linux and x86_64-darwin since release
+          time (the latter isn't NixOS, really). Binaries for
+          aarch64-linux are available, but no channel exists yet, as
+          it's waiting for some test fixes, etc.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Nix now defaults to 2.0; see its
+          <link xlink:href="https://nixos.org/nix/manual/#ssec-relnotes-2.0">release
+          notes</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Core version changes: linux: 4.9 -&gt; 4.14, glibc: 2.25 -&gt;
+          2.26, gcc: 6 -&gt; 7, systemd: 234 -&gt; 237.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Desktop version changes: gnome: 3.24 -&gt; 3.26, (KDE)
+          plasma-desktop: 5.10 -&gt; 5.12.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          MariaDB 10.2, updated from 10.1, is now the default MySQL
+          implementation. While upgrading a few changes have been made
+          to the infrastructure involved:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              <literal>libmysql</literal> has been deprecated, please
+              use <literal>mysql.connector-c</literal> instead, a
+              compatibility passthru has been added to the MySQL
+              packages.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              The <literal>mysql57</literal> package has a new
+              <literal>static</literal> output containing the static
+              libraries including <literal>libmysqld.a</literal>
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          PHP now defaults to PHP 7.2, updated from 7.1.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-18.03-new-services">
+    <title>New Services</title>
+    <para>
+      The following new services were added since the last release:
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          <literal>./config/krb5/default.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./hardware/digitalbitbox.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./misc/label.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./programs/ccache.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./programs/criu.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./programs/digitalbitbox/default.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./programs/less.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./programs/npm.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./programs/plotinus.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./programs/rootston.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./programs/systemtap.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./programs/sway.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./programs/udevil.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./programs/way-cooler.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./programs/yabar.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./programs/zsh/zsh-autoenv.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/backup/borgbackup.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/backup/crashplan-small-business.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/desktops/dleyna-renderer.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/desktops/dleyna-server.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/desktops/pipewire.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/desktops/gnome3/chrome-gnome-shell.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/desktops/gnome3/tracker-miners.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/hardware/fwupd.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/hardware/interception-tools.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/hardware/u2f.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/hardware/usbmuxd.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/mail/clamsmtp.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/mail/dkimproxy-out.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/mail/pfix-srsd.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/misc/gitea.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/misc/home-assistant.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/misc/ihaskell.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/misc/logkeys.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/misc/novacomd.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/misc/osrm.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/misc/plexpy.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/misc/pykms.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/misc/tzupdate.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/monitoring/fusion-inventory.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/monitoring/prometheus/exporters.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/network-filesystems/beegfs.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/network-filesystems/davfs2.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/network-filesystems/openafs/client.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/network-filesystems/openafs/server.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/network-filesystems/ceph.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/aria2.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/monero.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/nghttpx/default.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/nixops-dns.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/rxe.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/stunnel.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/web-apps/matomo.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/web-apps/restya-board.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/web-servers/mighttpd2.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/x11/fractalart.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./system/boot/binfmt.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./system/boot/grow-partition.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./tasks/filesystems/ecryptfs.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./virtualisation/hyperv-guest.nix</literal>
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-18.03-incompatibilities">
+    <title>Backward Incompatibilities</title>
+    <para>
+      When upgrading from a previous release, please be aware of the
+      following incompatible changes:
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          <literal>sound.enable</literal> now defaults to false.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Dollar signs in options under
+          <literal>services.postfix</literal> are passed verbatim to
+          Postfix, which will interpret them as the beginning of a
+          parameter expression. This was already true for string-valued
+          options in the previous release, but not for list-valued
+          options. If you need to pass literal dollar signs through
+          Postfix, double them.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>postage</literal> package (for web-based
+          PostgreSQL administration) has been renamed to
+          <literal>pgmanage</literal>. The corresponding module has also
+          been renamed. To migrate please rename all
+          <literal>services.postage</literal> options to
+          <literal>services.pgmanage</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Package attributes starting with a digit have been prefixed
+          with an underscore sign. This is to avoid quoting in the
+          configuration and other issues with command-line tools like
+          <literal>nix-env</literal>. The change affects the following
+          packages:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              <literal>2048-in-terminal</literal> →
+              <literal>_2048-in-terminal</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>90secondportraits</literal> →
+              <literal>_90secondportraits</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>2bwm</literal> → <literal>_2bwm</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>389-ds-base</literal> →
+              <literal>_389-ds-base</literal>
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          <emphasis role="strong">The OpenSSH service no longer enables
+          support for DSA keys by default, which could cause a system
+          lock out. Update your keys or, unfavorably, re-enable DSA
+          support manually.</emphasis>
+        </para>
+        <para>
+          DSA support was
+          <link xlink:href="https://www.openssh.com/legacy.html">deprecated
+          in OpenSSH 7.0</link>, due to it being too weak. To re-enable
+          support, add
+          <literal>PubkeyAcceptedKeyTypes +ssh-dss</literal> to the end
+          of your <literal>services.openssh.extraConfig</literal>.
+        </para>
+        <para>
+          After updating the keys to be stronger, anyone still on a
+          pre-17.03 version is safe to jump to 17.03, as vetted
+          <link xlink:href="https://search.nix.gsc.io/?q=stateVersion">here</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>openssh</literal> package now includes Kerberos
+          support by default; the
+          <literal>openssh_with_kerberos</literal> package is now a
+          deprecated alias. If you do not want Kerberos support, you can
+          do
+          <literal>openssh.override { withKerberos = false; }</literal>.
+          Note, this also applies to the <literal>openssh_hpn</literal>
+          package.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>cc-wrapper</literal> has been split in two; there is
+          now also a <literal>bintools-wrapper</literal>. The most
+          commonly used files in <literal>nix-support</literal> are now
+          split between the two wrappers. Some commonly used ones, like
+          <literal>nix-support/dynamic-linker</literal>, are duplicated
+          for backwards compatability, even though they rightly belong
+          only in <literal>bintools-wrapper</literal>. Other more
+          obscure ones are just moved.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The propagation logic has been changed. The new logic, along
+          with new types of dependencies that go with, is thoroughly
+          documented in the &quot;Specifying dependencies&quot; section
+          of the &quot;Standard Environment&quot; chapter of the nixpkgs
+          manual. The old logic isn't but is easy to describe:
+          dependencies were propagated as the same type of dependency no
+          matter what. In practice, that means that many
+          <literal>propagatedNativeBuildInputs</literal> should instead
+          be <literal>propagatedBuildInputs</literal>. Thankfully, that
+          was and is the least used type of dependency. Also, it means
+          that some <literal>propagatedBuildInputs</literal> should
+          instead be <literal>depsTargetTargetPropagated</literal>.
+          Other types dependencies should be unaffected.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>lib.addPassthru drv passthru</literal> is removed.
+          Use <literal>lib.extendDerivation true passthru drv</literal>
+          instead.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>memcached</literal> service no longer accept
+          dynamic socket paths via
+          <literal>services.memcached.socket</literal>. Unix sockets can
+          be still enabled by
+          <literal>services.memcached.enableUnixSocket</literal> and
+          will be accessible at
+          <literal>/run/memcached/memcached.sock</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>hardware.amdHybridGraphics.disable</literal>
+          option was removed for lack of a maintainer. If you still need
+          this module, you may wish to include a copy of it from an
+          older version of nixos in your imports.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The merging of config options for
+          <literal>services.postfix.config</literal> was buggy.
+          Previously, if other options in the Postfix module like
+          <literal>services.postfix.useSrs</literal> were set and the
+          user set config options that were also set by such options,
+          the resulting config wouldn't include all options that were
+          needed. They are now merged correctly. If config options need
+          to be overridden, <literal>lib.mkForce</literal> or
+          <literal>lib.mkOverride</literal> can be used.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The following changes apply if the
+          <literal>stateVersion</literal> is changed to 18.03 or higher.
+          For <literal>stateVersion = &quot;17.09&quot;</literal> or
+          lower the old behavior is preserved.
+        </para>
+        <itemizedlist spacing="compact">
+          <listitem>
+            <para>
+              <literal>matrix-synapse</literal> uses postgresql by
+              default instead of sqlite. Migration instructions can be
+              found
+              <link xlink:href="https://github.com/matrix-org/synapse/blob/master/docs/postgres.rst#porting-from-sqlite">
+              here </link>.
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>jid</literal> package has been removed, due to
+          maintenance overhead of a go package having non-versioned
+          dependencies.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          When using <literal>services.xserver.libinput</literal>
+          (enabled by default in GNOME), it now handles all input
+          devices, not just touchpads. As a result, you might need to
+          re-evaluate any custom Xorg configuration. In particular,
+          <literal>Option &quot;XkbRules&quot; &quot;base&quot;</literal>
+          may result in broken keyboard layout.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>attic</literal> package was removed. A maintained
+          fork called
+          <link xlink:href="https://www.borgbackup.org/">Borg</link>
+          should be used instead. Migration instructions can be found
+          <link xlink:href="http://borgbackup.readthedocs.io/en/stable/usage/upgrade.html#attic-and-borg-0-xx-to-borg-1-x">here</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The Piwik analytics software was renamed to Matomo:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              The package <literal>pkgs.piwik</literal> was renamed to
+              <literal>pkgs.matomo</literal>.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              The service <literal>services.piwik</literal> was renamed
+              to <literal>services.matomo</literal>.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              The data directory <literal>/var/lib/piwik</literal> was
+              renamed to <literal>/var/lib/matomo</literal>. All files
+              will be moved automatically on first startup, but you
+              might need to adjust your backup scripts.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              The default <literal>serverName</literal> for the nginx
+              configuration changed from
+              <literal>piwik.${config.networking.hostName}</literal> to
+              <literal>matomo.${config.networking.hostName}.${config.networking.domain}</literal>
+              if <literal>config.networking.domain</literal> is set,
+              <literal>matomo.${config.networking.hostName}</literal> if
+              it is not set. If you change your
+              <literal>serverName</literal>, remember you'll need to
+              update the <literal>trustedHosts[]</literal> array in
+              <literal>/var/lib/matomo/config/config.ini.php</literal>
+              as well.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              The <literal>piwik</literal> user was renamed to
+              <literal>matomo</literal>. The service will adjust
+              ownership automatically for files in the data directory.
+              If you use unix socket authentication, remember to give
+              the new <literal>matomo</literal> user access to the
+              database and to change the <literal>username</literal> to
+              <literal>matomo</literal> in the
+              <literal>[database]</literal> section of
+              <literal>/var/lib/matomo/config/config.ini.php</literal>.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              If you named your database `piwik`, you might want to
+              rename it to `matomo` to keep things clean, but this is
+              neither enforced nor required.
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>nodejs-4_x</literal> is end-of-life.
+          <literal>nodejs-4_x</literal>,
+          <literal>nodejs-slim-4_x</literal> and
+          <literal>nodePackages_4_x</literal> are removed.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>pump.io</literal> NixOS module was removed. It is
+          now maintained as an
+          <link xlink:href="https://github.com/rvl/pump.io-nixos">external
+          module</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The Prosody XMPP server has received a major update. The
+          following modules were renamed:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              <literal>services.prosody.modules.httpserver</literal> is
+              now <literal>services.prosody.modules.http_files</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>services.prosody.modules.console</literal> is now
+              <literal>services.prosody.modules.admin_telnet</literal>
+            </para>
+          </listitem>
+        </itemizedlist>
+        <para>
+          Many new modules are now core modules, most notably
+          <literal>services.prosody.modules.carbons</literal> and
+          <literal>services.prosody.modules.mam</literal>.
+        </para>
+        <para>
+          The better-performing <literal>libevent</literal> backend is
+          now enabled by default.
+        </para>
+        <para>
+          <literal>withCommunityModules</literal> now passes through the
+          modules to <literal>services.prosody.extraModules</literal>.
+          Use <literal>withOnlyInstalledCommunityModules</literal> for
+          modules that should not be enabled directly, e.g
+          <literal>lib_ldap</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          All prometheus exporter modules are now defined as submodules.
+          The exporters are configured using
+          <literal>services.prometheus.exporters</literal>.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-18.03-notable-changes">
+    <title>Other Notable Changes</title>
+    <itemizedlist>
+      <listitem>
+        <para>
+          ZNC option <literal>services.znc.mutable</literal> now
+          defaults to <literal>true</literal>. That means that old
+          configuration is not overwritten by default when update to the
+          znc options are made.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The option
+          <literal>networking.wireless.networks.&lt;name&gt;.auth</literal>
+          has been added for wireless networks with WPA-Enterprise
+          authentication. There is also a new
+          <literal>extraConfig</literal> option to directly configure
+          <literal>wpa_supplicant</literal> and
+          <literal>hidden</literal> to connect to hidden networks.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          In the module
+          <literal>networking.interfaces.&lt;name&gt;</literal> the
+          following options have been removed:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              <literal>ipAddress</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>ipv6Address</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>prefixLength</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>ipv6PrefixLength</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>subnetMask</literal>
+            </para>
+          </listitem>
+        </itemizedlist>
+        <para>
+          To assign static addresses to an interface the options
+          <literal>ipv4.addresses</literal> and
+          <literal>ipv6.addresses</literal> should be used instead. The
+          options <literal>ip4</literal> and <literal>ip6</literal> have
+          been renamed to <literal>ipv4.addresses</literal>
+          <literal>ipv6.addresses</literal> respectively. The new
+          options <literal>ipv4.routes</literal> and
+          <literal>ipv6.routes</literal> have been added to set up
+          static routing.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The option <literal>services.logstash.listenAddress</literal>
+          is now <literal>127.0.0.1</literal> by default. Previously the
+          default behaviour was to listen on all interfaces.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services.btrfs.autoScrub</literal> has been added, to
+          periodically check btrfs filesystems for data corruption. If
+          there's a correct copy available, it will automatically repair
+          corrupted blocks.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>displayManager.lightdm.greeters.gtk.clock-format.</literal>
+          has been added, the clock format string (as expected by
+          strftime, e.g. <literal>%H:%M</literal>) to use with the
+          lightdm gtk greeter panel.
+        </para>
+        <para>
+          If set to null the default clock format is used.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>displayManager.lightdm.greeters.gtk.indicators</literal>
+          has been added, a list of allowed indicator modules to use
+          with the lightdm gtk greeter panel.
+        </para>
+        <para>
+          Built-in indicators include <literal>~a11y</literal>,
+          <literal>~language</literal>, <literal>~session</literal>,
+          <literal>~power</literal>, <literal>~clock</literal>,
+          <literal>~host</literal>, <literal>~spacer</literal>. Unity
+          indicators can be represented by short name (e.g.
+          <literal>sound</literal>, <literal>power</literal>), service
+          file name, or absolute path.
+        </para>
+        <para>
+          If set to <literal>null</literal> the default indicators are
+          used.
+        </para>
+        <para>
+          In order to have the previous default configuration add
+        </para>
+        <programlisting language="bash">
+{
+  services.xserver.displayManager.lightdm.greeters.gtk.indicators = [
+    &quot;~host&quot; &quot;~spacer&quot;
+    &quot;~clock&quot; &quot;~spacer&quot;
+    &quot;~session&quot;
+    &quot;~language&quot;
+    &quot;~a11y&quot;
+    &quot;~power&quot;
+  ];
+}
+</programlisting>
+        <para>
+          to your <literal>configuration.nix</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The NixOS test driver supports user services declared by
+          <literal>systemd.user.services</literal>. The methods
+          <literal>waitForUnit</literal>,
+          <literal>getUnitInfo</literal>, <literal>startJob</literal>
+          and <literal>stopJob</literal> provide an optional
+          <literal>$user</literal> argument for that purpose.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Enabling bash completion on NixOS,
+          <literal>programs.bash.enableCompletion</literal>, will now
+          also enable completion for the Nix command line tools by
+          installing the
+          <link xlink:href="https://github.com/hedning/nix-bash-completions">nix-bash-completions</link>
+          package.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+</section>
diff --git a/nixos/doc/manual/from_md/release-notes/rl-1809.section.xml b/nixos/doc/manual/from_md/release-notes/rl-1809.section.xml
new file mode 100644
index 000000000000..aa4637a99b60
--- /dev/null
+++ b/nixos/doc/manual/from_md/release-notes/rl-1809.section.xml
@@ -0,0 +1,941 @@
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-release-18.09">
+  <title>Release 18.09 (<quote>Jellyfish</quote>, 2018/10/05)</title>
+  <section xml:id="sec-release-18.09-highlights">
+    <title>Highlights</title>
+    <para>
+      In addition to numerous new and upgraded packages, this release
+      has the following notable updates:
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          End of support is planned for end of April 2019, handing over
+          to 19.03.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Platform support: x86_64-linux and x86_64-darwin as always.
+          Support for aarch64-linux is as with the previous releases,
+          not equivalent to the x86-64-linux release, but with efforts
+          to reach parity.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Nix has been updated to 2.1; see its
+          <link xlink:href="https://nixos.org/nix/manual/#ssec-relnotes-2.1">release
+          notes</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Core versions: linux: 4.14 LTS (unchanged), glibc: 2.26 →
+          2.27, gcc: 7 (unchanged), systemd: 237 → 239.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Desktop version changes: gnome: 3.26 → 3.28, (KDE)
+          plasma-desktop: 5.12 → 5.13.
+        </para>
+      </listitem>
+    </itemizedlist>
+    <para>
+      Notable changes and additions for 18.09 include:
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          Support for wrapping binaries using
+          <literal>firejail</literal> has been added through
+          <literal>programs.firejail.wrappedBinaries</literal>.
+        </para>
+        <para>
+          For example
+        </para>
+        <programlisting language="bash">
+{
+  programs.firejail = {
+    enable = true;
+    wrappedBinaries = {
+      firefox = &quot;${lib.getBin pkgs.firefox}/bin/firefox&quot;;
+      mpv = &quot;${lib.getBin pkgs.mpv}/bin/mpv&quot;;
+    };
+  };
+}
+</programlisting>
+        <para>
+          This will place <literal>firefox</literal> and
+          <literal>mpv</literal> binaries in the global path wrapped by
+          firejail.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          User channels are now in the default
+          <literal>NIX_PATH</literal>, allowing users to use their
+          personal <literal>nix-channel</literal> defined channels in
+          <literal>nix-build</literal> and <literal>nix-shell</literal>
+          commands, as well as in imports like
+          <literal>import &lt;mychannel&gt;</literal>.
+        </para>
+        <para>
+          For example
+        </para>
+        <programlisting>
+$ nix-channel --add https://nixos.org/channels/nixpkgs-unstable nixpkgsunstable
+$ nix-channel --update
+$ nix-build '&lt;nixpkgsunstable&gt;' -A gitFull
+$ nix run -f '&lt;nixpkgsunstable&gt;' gitFull
+$ nix-instantiate -E '(import &lt;nixpkgsunstable&gt; {}).gitFull'
+</programlisting>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-18.09-new-services">
+    <title>New Services</title>
+    <para>
+      A curated selection of new services that were added since the last
+      release:
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          The <literal>services.cassandra</literal> module has been
+          reworked and was rewritten from scratch. The service has
+          succeeding tests for the versions 2.1, 2.2, 3.0 and 3.11 of
+          <link xlink:href="https://cassandra.apache.org/">Apache
+          Cassandra</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          There is a new <literal>services.foundationdb</literal> module
+          for deploying
+          <link xlink:href="https://www.foundationdb.org">FoundationDB</link>
+          clusters.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          When enabled the <literal>iproute2</literal> will copy the
+          files expected by ip route (e.g.,
+          <literal>rt_tables</literal>) in
+          <literal>/etc/iproute2</literal>. This allows to write aliases
+          for routing tables for instance.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services.strongswan-swanctl</literal> is a modern
+          replacement for <literal>services.strongswan</literal>. You
+          can use either one of them to setup IPsec VPNs but not both at
+          the same time.
+        </para>
+        <para>
+          <literal>services.strongswan-swanctl</literal> uses the
+          <link xlink:href="https://wiki.strongswan.org/projects/strongswan/wiki/swanctl">swanctl</link>
+          command which uses the modern
+          <link xlink:href="https://github.com/strongswan/strongswan/blob/master/src/libcharon/plugins/vici/README.md">vici</link>
+          <emphasis>Versatile IKE Configuration Interface</emphasis>.
+          The deprecated <literal>ipsec</literal> command used in
+          <literal>services.strongswan</literal> is using the legacy
+          <link xlink:href="https://github.com/strongswan/strongswan/blob/master/README_LEGACY.md">stroke
+          configuration interface</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The new <literal>services.elasticsearch-curator</literal>
+          service periodically curates or manages, your Elasticsearch
+          indices and snapshots.
+        </para>
+      </listitem>
+    </itemizedlist>
+    <para>
+      Every new services:
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          <literal>./config/xdg/autostart.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./config/xdg/icons.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./config/xdg/menus.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./config/xdg/mime.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./hardware/brightnessctl.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./hardware/onlykey.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./hardware/video/uvcvideo/default.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./misc/documentation.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./programs/firejail.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./programs/iftop.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./programs/sedutil.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./programs/singularity.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./programs/xss-lock.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./programs/zsh/zsh-autosuggestions.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/admin/oxidized.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/backup/duplicati.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/backup/restic.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/backup/restic-rest-server.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/cluster/hadoop/default.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/databases/aerospike.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/databases/monetdb.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/desktops/bamf.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/desktops/flatpak.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/desktops/zeitgeist.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/development/bloop.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/development/jupyter/default.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/hardware/lcd.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/hardware/undervolt.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/misc/clipmenu.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/misc/gitweb.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/misc/serviio.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/misc/safeeyes.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/misc/sysprof.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/misc/weechat.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/monitoring/datadog-agent.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/monitoring/incron.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/dnsdist.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/freeradius.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/hans.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/morty.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/ndppd.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/ocserv.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/owamp.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/quagga.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/shadowsocks.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/stubby.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/zeronet.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/security/certmgr.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/security/cfssl.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/security/oauth2_proxy_nginx.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/web-apps/virtlyst.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/web-apps/youtrack.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/web-servers/hitch/default.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/web-servers/hydron.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/web-servers/meguca.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/web-servers/nginx/gitweb.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./virtualisation/kvmgt.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./virtualisation/qemu-guest-agent.nix</literal>
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-18.09-incompatibilities">
+    <title>Backward Incompatibilities</title>
+    <para>
+      When upgrading from a previous release, please be aware of the
+      following incompatible changes:
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          Some licenses that were incorrectly not marked as unfree now
+          are. This is the case for:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              cc-by-nc-sa-20: Creative Commons Attribution Non
+              Commercial Share Alike 2.0
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              cc-by-nc-sa-25: Creative Commons Attribution Non
+              Commercial Share Alike 2.5
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              cc-by-nc-sa-30: Creative Commons Attribution Non
+              Commercial Share Alike 3.0
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              cc-by-nc-sa-40: Creative Commons Attribution Non
+              Commercial Share Alike 4.0
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              cc-by-nd-30: Creative Commons Attribution-No Derivative
+              Works v3.00
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              msrla: Microsoft Research License Agreement
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          The deprecated <literal>services.cassandra</literal> module
+          has seen a complete rewrite. (See above.)
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>lib.strict</literal> is removed. Use
+          <literal>builtins.seq</literal> instead.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>clementine</literal> package points now to the
+          free derivation. <literal>clementineFree</literal> is removed
+          now and <literal>clementineUnfree</literal> points to the
+          package which is bundled with the unfree
+          <literal>libspotify</literal> package.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>netcat</literal> package is now taken directly
+          from OpenBSD's <literal>libressl</literal>, instead of relying
+          on Debian's fork. The new version should be very close to the
+          old version, but there are some minor differences.
+          Importantly, flags like -b, -q, -C, and -Z are no longer
+          accepted by the nc command.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>services.docker-registry.extraConfig</literal>
+          object doesn't contain environment variables anymore. Instead
+          it needs to provide an object structure that can be mapped
+          onto the YAML configuration defined in
+          <link xlink:href="https://github.com/docker/distribution/blob/v2.6.2/docs/configuration.md">the
+          <literal>docker/distribution</literal> docs</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>gnucash</literal> has changed from version 2.4 to
+          3.x. If you've been using <literal>gnucash</literal> (version
+          2.4) instead of <literal>gnucash26</literal> (version 2.6) you
+          must open your Gnucash data file(s) with
+          <literal>gnucash26</literal> and then save them to upgrade the
+          file format. Then you may use your data file(s) with Gnucash
+          3.x. See the upgrade
+          <link xlink:href="https://wiki.gnucash.org/wiki/FAQ#Using_Different_Versions.2C_Up_And_Downgrade">documentation</link>.
+          Gnucash 2.4 is still available under the attribute
+          <literal>gnucash24</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services.munge</literal> now runs as user (and group)
+          <literal>munge</literal> instead of root. Make sure the key
+          file is accessible to the daemon.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>dockerTools.buildImage</literal> now uses
+          <literal>null</literal> as default value for
+          <literal>tag</literal>, which indicates that the nix output
+          hash will be used as tag.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The ELK stack: <literal>elasticsearch</literal>,
+          <literal>logstash</literal> and <literal>kibana</literal> has
+          been upgraded from 2.* to 6.3.*. The 2.* versions have been
+          <link xlink:href="https://www.elastic.co/support/eol">unsupported
+          since last year</link> so they have been removed. You can
+          still use the 5.* versions under the names
+          <literal>elasticsearch5</literal>,
+          <literal>logstash5</literal> and <literal>kibana5</literal>.
+        </para>
+        <para>
+          The elastic beats: <literal>filebeat</literal>,
+          <literal>heartbeat</literal>, <literal>metricbeat</literal>
+          and <literal>packetbeat</literal> have had the same treatment:
+          they now target 6.3.* as well. The 5.* versions are available
+          under the names: <literal>filebeat5</literal>,
+          <literal>heartbeat5</literal>, <literal>metricbeat5</literal>
+          and <literal>packetbeat5</literal>
+        </para>
+        <para>
+          The ELK-6.3 stack now comes with
+          <link xlink:href="https://www.elastic.co/products/x-pack/open">X-Pack
+          by default</link>. Since X-Pack is licensed under the
+          <link xlink:href="https://github.com/elastic/elasticsearch/blob/master/licenses/ELASTIC-LICENSE.txt">Elastic
+          License</link> the ELK packages now have an unfree license. To
+          use them you need to specify
+          <literal>allowUnfree = true;</literal> in your nixpkgs
+          configuration.
+        </para>
+        <para>
+          Fortunately there is also a free variant of the ELK stack
+          without X-Pack. The packages are available under the names:
+          <literal>elasticsearch-oss</literal>,
+          <literal>logstash-oss</literal> and
+          <literal>kibana-oss</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Options
+          <literal>boot.initrd.luks.devices.name.yubikey.ramfsMountPoint</literal>
+          <literal>boot.initrd.luks.devices.name.yubikey.storage.mountPoint</literal>
+          were removed. <literal>luksroot.nix</literal> module never
+          supported more than one YubiKey at a time anyway, hence those
+          options never had any effect. You should be able to remove
+          them from your config without any issues.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>stdenv.system</literal> and <literal>system</literal>
+          in nixpkgs now refer to the host platform instead of the build
+          platform. For native builds this is not change, let alone a
+          breaking one. For cross builds, it is a breaking change, and
+          <literal>stdenv.buildPlatform.system</literal> can be used
+          instead for the old behavior. They should be using that
+          anyways for clarity.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Groups <literal>kvm</literal> and <literal>render</literal>
+          are introduced now, as systemd requires them.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-18.09-notable-changes">
+    <title>Other Notable Changes</title>
+    <itemizedlist>
+      <listitem>
+        <para>
+          <literal>dockerTools.pullImage</literal> relies on image
+          digest instead of image tag to download the image. The
+          <literal>sha256</literal> of a pulled image has to be updated.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>lib.attrNamesToStr</literal> has been deprecated. Use
+          more specific concatenation
+          (<literal>lib.concat(Map)StringsSep</literal>) instead.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>lib.addErrorContextToAttrs</literal> has been
+          deprecated. Use <literal>builtins.addErrorContext</literal>
+          directly.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>lib.showVal</literal> has been deprecated. Use
+          <literal>lib.traceSeqN</literal> instead.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>lib.traceXMLVal</literal> has been deprecated. Use
+          <literal>lib.traceValFn builtins.toXml</literal> instead.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>lib.traceXMLValMarked</literal> has been deprecated.
+          Use
+          <literal>lib.traceValFn (x: str + builtins.toXML x)</literal>
+          instead.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>pkgs</literal> argument to NixOS modules can now
+          be set directly using <literal>nixpkgs.pkgs</literal>.
+          Previously, only the <literal>system</literal>,
+          <literal>config</literal> and <literal>overlays</literal>
+          arguments could be used to influence <literal>pkgs</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          A NixOS system can now be constructed more easily based on a
+          preexisting invocation of Nixpkgs. For example:
+        </para>
+        <programlisting language="bash">
+{
+  inherit (pkgs.nixos {
+    boot.loader.grub.enable = false;
+    fileSystems.&quot;/&quot;.device = &quot;/dev/xvda1&quot;;
+  }) toplevel kernel initialRamdisk manual;
+}
+</programlisting>
+        <para>
+          This benefits evaluation performance, lets you write Nixpkgs
+          packages that depend on NixOS images and is consistent with a
+          deployment architecture that would be centered around Nixpkgs
+          overlays.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>lib.traceValIfNot</literal> has been deprecated. Use
+          <literal>if/then/else</literal> and
+          <literal>lib.traceValSeq</literal> instead.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>lib.traceCallXml</literal> has been deprecated.
+          Please complain if you use the function regularly.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The attribute <literal>lib.nixpkgsVersion</literal> has been
+          deprecated in favor of <literal>lib.version</literal>. Please
+          refer to the discussion in
+          <link xlink:href="https://github.com/NixOS/nixpkgs/pull/39416#discussion_r183845745">NixOS/nixpkgs#39416</link>
+          for further reference.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>lib.recursiveUpdateUntil</literal> was not acting
+          according to its specification. It has been fixed to act
+          according to the docstring, and a test has been added.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The module for <literal>security.dhparams</literal> has two
+          new options now:
+        </para>
+        <variablelist>
+          <varlistentry>
+            <term>
+              <literal>security.dhparams.stateless</literal>
+            </term>
+            <listitem>
+              <para>
+                Puts the generated Diffie-Hellman parameters into the
+                Nix store instead of managing them in a stateful manner
+                in <literal>/var/lib/dhparams</literal>.
+              </para>
+            </listitem>
+          </varlistentry>
+          <varlistentry>
+            <term>
+              <literal>security.dhparams.defaultBitSize</literal>
+            </term>
+            <listitem>
+              <para>
+                The default bit size to use for the generated
+                Diffie-Hellman parameters.
+              </para>
+            </listitem>
+          </varlistentry>
+        </variablelist>
+        <note>
+          <para>
+            The path to the actual generated parameter files should now
+            be queried using
+            <literal>config.security.dhparams.params.name.path</literal>
+            because it might be either in the Nix store or in a
+            directory configured by
+            <literal>security.dhparams.path</literal>.
+          </para>
+        </note>
+        <note>
+          <para>
+            <emphasis role="strong">For developers:</emphasis>
+          </para>
+          <para>
+            Module implementers should not set a specific bit size in
+            order to let users configure it by themselves if they want
+            to have a different bit size than the default (2048).
+          </para>
+          <para>
+            An example usage of this would be:
+          </para>
+          <programlisting language="bash">
+{ config, ... }:
+
+{
+  security.dhparams.params.myservice = {};
+  environment.etc.&quot;myservice.conf&quot;.text = ''
+    dhparams = ${config.security.dhparams.params.myservice.path}
+  '';
+}
+</programlisting>
+        </note>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>networking.networkmanager.useDnsmasq</literal> has
+          been deprecated. Use
+          <literal>networking.networkmanager.dns</literal> instead.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The Kubernetes package has been bumped to major version 1.11.
+          Please consult the
+          <link xlink:href="https://github.com/kubernetes/kubernetes/blob/release-1.11/CHANGELOG-1.11.md">release
+          notes</link> for details on new features and api changes.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The option
+          <literal>services.kubernetes.apiserver.admissionControl</literal>
+          was renamed to
+          <literal>services.kubernetes.apiserver.enableAdmissionPlugins</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Recommended way to access the Kubernetes Dashboard is via
+          HTTPS (TLS) Therefore; public service port for the dashboard
+          has changed to 443 (container port 8443) and scheme to https.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The option
+          <literal>services.kubernetes.apiserver.address</literal> was
+          renamed to
+          <literal>services.kubernetes.apiserver.bindAddress</literal>.
+          Note that the default value has changed from 127.0.0.1 to
+          0.0.0.0.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The option
+          <literal>services.kubernetes.apiserver.publicAddress</literal>
+          was not used and thus has been removed.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The option
+          <literal>services.kubernetes.addons.dashboard.enableRBAC</literal>
+          was renamed to
+          <literal>services.kubernetes.addons.dashboard.rbac.enable</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The Kubernetes Dashboard now has only minimal RBAC permissions
+          by default. If dashboard cluster-admin rights are desired, set
+          <literal>services.kubernetes.addons.dashboard.rbac.clusterAdmin</literal>
+          to true. On existing clusters, in order for the revocation of
+          privileges to take effect, the current ClusterRoleBinding for
+          kubernetes-dashboard must be manually removed:
+          <literal>kubectl delete clusterrolebinding kubernetes-dashboard</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>programs.screen</literal> module provides allows
+          to configure <literal>/etc/screenrc</literal>, however the
+          module behaved fairly counterintuitive as the config exists,
+          but the package wasn't available. Since 18.09
+          <literal>pkgs.screen</literal> will be added to
+          <literal>environment.systemPackages</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The module <literal>services.networking.hostapd</literal> now
+          uses WPA2 by default.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>s6Dns</literal>, <literal>s6Networking</literal>,
+          <literal>s6LinuxUtils</literal> and
+          <literal>s6PortableUtils</literal> renamed to
+          <literal>s6-dns</literal>, <literal>s6-networking</literal>,
+          <literal>s6-linux-utils</literal> and
+          <literal>s6-portable-utils</literal> respectively.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The module option <literal>nix.useSandbox</literal> is now
+          defaulted to <literal>true</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The config activation script of
+          <literal>nixos-rebuild</literal> now
+          <link xlink:href="https://www.freedesktop.org/software/systemd/man/systemctl.html#Manager%20Lifecycle%20Commands">reloads</link>
+          all user units for each authenticated user.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The default display manager is now LightDM. To use SLiM set
+          <literal>services.xserver.displayManager.slim.enable</literal>
+          to <literal>true</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          NixOS option descriptions are now automatically broken up into
+          individual paragraphs if the text contains two consecutive
+          newlines, so it's no longer necessary to use
+          <literal>&lt;/para&gt;&lt;para&gt;</literal> to start a new
+          paragraph.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Top-level <literal>buildPlatform</literal>,
+          <literal>hostPlatform</literal>, and
+          <literal>targetPlatform</literal> in Nixpkgs are deprecated.
+          Please use their equivalents in <literal>stdenv</literal>
+          instead: <literal>stdenv.buildPlatform</literal>,
+          <literal>stdenv.hostPlatform</literal>, and
+          <literal>stdenv.targetPlatform</literal>.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+</section>
diff --git a/nixos/doc/manual/from_md/release-notes/rl-1903.section.xml b/nixos/doc/manual/from_md/release-notes/rl-1903.section.xml
new file mode 100644
index 000000000000..f26e68e13200
--- /dev/null
+++ b/nixos/doc/manual/from_md/release-notes/rl-1903.section.xml
@@ -0,0 +1,790 @@
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-release-19.03">
+  <title>Release 19.03 (<quote>Koi</quote>, 2019/04/11)</title>
+  <section xml:id="sec-release-19.03-highlights">
+    <title>Highlights</title>
+    <para>
+      In addition to numerous new and upgraded packages, this release
+      has the following highlights:
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          End of support is planned for end of October 2019, handing
+          over to 19.09.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The default Python 3 interpreter is now CPython 3.7 instead of
+          CPython 3.6.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Added the Pantheon desktop environment. It can be enabled
+          through
+          <literal>services.xserver.desktopManager.pantheon.enable</literal>.
+        </para>
+        <note>
+          <para>
+            By default,
+            <literal>services.xserver.desktopManager.pantheon</literal>
+            enables LightDM as a display manager, as pantheon's screen
+            locking implementation relies on it. Because of that it is
+            recommended to leave LightDM enabled. If you'd like to
+            disable it anyway, set
+            <literal>services.xserver.displayManager.lightdm.enable</literal>
+            to <literal>false</literal> and enable your preferred
+            display manager.
+          </para>
+        </note>
+        <para>
+          Also note that Pantheon's LightDM greeter is not enabled by
+          default, because it has numerous issues in NixOS and isn't
+          optimal for use here yet.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          A major refactoring of the Kubernetes module has been
+          completed. Refactorings primarily focus on decoupling
+          components and enhancing security. Two-way TLS and RBAC has
+          been enabled by default for all components, which slightly
+          changes the way the module is configured. See:
+          <xref linkend="sec-kubernetes" /> for details.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          There is now a set of <literal>confinement</literal> options
+          for <literal>systemd.services</literal>, which allows to
+          restrict services into a chroot 2 ed environment that only
+          contains the store paths from the runtime closure of the
+          service.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-19.03-new-services">
+    <title>New Services</title>
+    <para>
+      The following new services were added since the last release:
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          <literal>./programs/nm-applet.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          There is a new <literal>security.googleOsLogin</literal>
+          module for using
+          <link xlink:href="https://cloud.google.com/compute/docs/instances/managing-instance-access">OS
+          Login</link> to manage SSH access to Google Compute Engine
+          instances, which supersedes the imperative and broken
+          <literal>google-accounts-daemon</literal> used in
+          <literal>nixos/modules/virtualisation/google-compute-config.nix</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/misc/beanstalkd.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          There is a new <literal>services.cockroachdb</literal> module
+          for running CockroachDB databases. NixOS now ships with
+          CockroachDB 2.1.x as well, available on
+          <literal>x86_64-linux</literal> and
+          <literal>aarch64-linux</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./security/duosec.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <link xlink:href="https://duo.com/docs/duounix">PAM module
+          for Duo Security</link> has been enabled for use. One can
+          configure it using the <literal>security.duosec</literal>
+          options along with the corresponding PAM option in
+          <literal>security.pam.services.&lt;name?&gt;.duoSecurity.enable</literal>.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-19.03-incompatibilities">
+    <title>Backward Incompatibilities</title>
+    <para>
+      When upgrading from a previous release, please be aware of the
+      following incompatible changes:
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          The minimum version of Nix required to evaluate Nixpkgs is now
+          2.0.
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              For users of NixOS 18.03 and 19.03, NixOS defaults to Nix
+              2.0, but supports using Nix 1.11 by setting
+              <literal>nix.package = pkgs.nix1;</literal>. If this
+              option is set to a Nix 1.11 package, you will need to
+              either unset the option or upgrade it to Nix 2.0.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              For users of NixOS 17.09, you will first need to upgrade
+              Nix by setting
+              <literal>nix.package = pkgs.nixStable2;</literal> and run
+              <literal>nixos-rebuild switch</literal> as the
+              <literal>root</literal> user.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              For users of a daemon-less Nix installation on Linux or
+              macOS, you can upgrade Nix by running
+              <literal>curl -L https://nixos.org/nix/install | sh</literal>,
+              or prior to doing a channel update, running
+              <literal>nix-env -iA nix</literal>. If you have already
+              run a channel update and Nix is no longer able to evaluate
+              Nixpkgs, the error message printed should provide adequate
+              directions for upgrading Nix.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              For users of the Nix daemon on macOS, you can upgrade Nix
+              by running
+              <literal>sudo -i sh -c 'nix-channel --update &amp;&amp; nix-env -iA nixpkgs.nix'; sudo launchctl stop org.nixos.nix-daemon; sudo launchctl start org.nixos.nix-daemon</literal>.
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>buildPythonPackage</literal> function now sets
+          <literal>strictDeps = true</literal> to help distinguish
+          between native and non-native dependencies in order to improve
+          cross-compilation compatibility. Note however that this may
+          break user expressions.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>buildPythonPackage</literal> function now sets
+          <literal>LANG = C.UTF-8</literal> to enable Unicode support.
+          The <literal>glibcLocales</literal> package is no longer
+          needed as a build input.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The Syncthing state and configuration data has been moved from
+          <literal>services.syncthing.dataDir</literal> to the newly
+          defined <literal>services.syncthing.configDir</literal>, which
+          default to
+          <literal>/var/lib/syncthing/.config/syncthing</literal>. This
+          change makes possible to share synced directories using ACLs
+          without Syncthing resetting the permission on every start.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>ntp</literal> module now has sane default
+          restrictions. If you're relying on the previous defaults,
+          which permitted all queries and commands from all
+          firewall-permitted sources, you can set
+          <literal>services.ntp.restrictDefault</literal> and
+          <literal>services.ntp.restrictSource</literal> to
+          <literal>[]</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Package <literal>rabbitmq_server</literal> is renamed to
+          <literal>rabbitmq-server</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>light</literal> module no longer uses setuid
+          binaries, but udev rules. As a consequence users of that
+          module have to belong to the <literal>video</literal> group in
+          order to use the executable (i.e.
+          <literal>users.users.yourusername.extraGroups = [&quot;video&quot;];</literal>).
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Buildbot now supports Python 3 and its packages have been
+          moved to <literal>pythonPackages</literal>. The options
+          <literal>services.buildbot-master.package</literal> and
+          <literal>services.buildbot-worker.package</literal> can be
+          used to select the Python 2 or 3 version of the package.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Options
+          <literal>services.znc.confOptions.networks.name.userName</literal>
+          and
+          <literal>services.znc.confOptions.networks.name.modulePackages</literal>
+          were removed. They were never used for anything and can
+          therefore safely be removed.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Package <literal>wasm</literal> has been renamed
+          <literal>proglodyte-wasm</literal>. The package
+          <literal>wasm</literal> will be pointed to
+          <literal>ocamlPackages.wasm</literal> in 19.09, so make sure
+          to update your configuration if you want to keep
+          <literal>proglodyte-wasm</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          When the <literal>nixpkgs.pkgs</literal> option is set, NixOS
+          will no longer ignore the <literal>nixpkgs.overlays</literal>
+          option. The old behavior can be recovered by setting
+          <literal>nixpkgs.overlays = lib.mkForce [];</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          OpenSMTPD has been upgraded to version 6.4.0p1. This release
+          makes backwards-incompatible changes to the configuration file
+          format. See <literal>man smtpd.conf</literal> for more
+          information on the new file format.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The versioned <literal>postgresql</literal> have been renamed
+          to use underscore number seperators. For example,
+          <literal>postgresql96</literal> has been renamed to
+          <literal>postgresql_9_6</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Package <literal>consul-ui</literal> and passthrough
+          <literal>consul.ui</literal> have been removed. The package
+          <literal>consul</literal> now uses upstream releases that
+          vendor the UI into the binary. See
+          <link xlink:href="https://github.com/NixOS/nixpkgs/pull/48714#issuecomment-433454834">#48714</link>
+          for details.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Slurm introduces the new option
+          <literal>services.slurm.stateSaveLocation</literal>, which is
+          now set to <literal>/var/spool/slurm</literal> by default
+          (instead of <literal>/var/spool</literal>). Make sure to move
+          all files to the new directory or to set the option
+          accordingly.
+        </para>
+        <para>
+          The slurmctld now runs as user <literal>slurm</literal>
+          instead of <literal>root</literal>. If you want to keep
+          slurmctld running as <literal>root</literal>, set
+          <literal>services.slurm.user = root</literal>.
+        </para>
+        <para>
+          The options <literal>services.slurm.nodeName</literal> and
+          <literal>services.slurm.partitionName</literal> are now sets
+          of strings to correctly reflect that fact that each of these
+          options can occour more than once in the configuration.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>solr</literal> package has been upgraded from
+          4.10.3 to 7.5.0 and has undergone some major changes. The
+          <literal>services.solr</literal> module has been updated to
+          reflect these changes. Please review
+          http://lucene.apache.org/solr/ carefully before upgrading.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Package <literal>ckb</literal> is renamed to
+          <literal>ckb-next</literal>, and options
+          <literal>hardware.ckb.*</literal> are renamed to
+          <literal>hardware.ckb-next.*</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The option
+          <literal>services.xserver.displayManager.job.logToFile</literal>
+          which was previously set to <literal>true</literal> when using
+          the display managers <literal>lightdm</literal>,
+          <literal>sddm</literal> or <literal>xpra</literal> has been
+          reset to the default value (<literal>false</literal>).
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Network interface indiscriminate NixOS firewall options
+          (<literal>networking.firewall.allow*</literal>) are now
+          preserved when also setting interface specific rules such as
+          <literal>networking.firewall.interfaces.en0.allow*</literal>.
+          These rules continue to use the pseudo device
+          &quot;default&quot;
+          (<literal>networking.firewall.interfaces.default.*</literal>),
+          and assigning to this pseudo device will override the
+          (<literal>networking.firewall.allow*</literal>) options.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>nscd</literal> service now disables all caching
+          of <literal>passwd</literal> and <literal>group</literal>
+          databases by default. This was interferring with the correct
+          functioning of the <literal>libnss_systemd.so</literal> module
+          which is used by <literal>systemd</literal> to manage uids and
+          usernames in the presence of <literal>DynamicUser=</literal>
+          in systemd services. This was already the default behaviour in
+          presence of <literal>services.sssd.enable = true</literal>
+          because nscd caching would interfere with
+          <literal>sssd</literal> in unpredictable ways as well. Because
+          we're using nscd not for caching, but for convincing glibc to
+          find NSS modules in the nix store instead of an absolute path,
+          we have decided to disable caching globally now, as it's
+          usually not the behaviour the user wants and can lead to
+          surprising behaviour. Furthermore, negative caching of host
+          lookups is also disabled now by default. This should fix the
+          issue of dns lookups failing in the presence of an unreliable
+          network.
+        </para>
+        <para>
+          If the old behaviour is desired, this can be restored by
+          setting the <literal>services.nscd.config</literal> option
+          with the desired caching parameters.
+        </para>
+        <programlisting language="bash">
+{
+  services.nscd.config =
+  ''
+  server-user             nscd
+  threads                 1
+  paranoia                no
+  debug-level             0
+
+  enable-cache            passwd          yes
+  positive-time-to-live   passwd          600
+  negative-time-to-live   passwd          20
+  suggested-size          passwd          211
+  check-files             passwd          yes
+  persistent              passwd          no
+  shared                  passwd          yes
+
+  enable-cache            group           yes
+  positive-time-to-live   group           3600
+  negative-time-to-live   group           60
+  suggested-size          group           211
+  check-files             group           yes
+  persistent              group           no
+  shared                  group           yes
+
+  enable-cache            hosts           yes
+  positive-time-to-live   hosts           600
+  negative-time-to-live   hosts           5
+  suggested-size          hosts           211
+  check-files             hosts           yes
+  persistent              hosts           no
+  shared                  hosts           yes
+  '';
+}
+</programlisting>
+        <para>
+          See
+          <link xlink:href="https://github.com/NixOS/nixpkgs/pull/50316">#50316</link>
+          for details.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          GitLab Shell previously used the nix store paths for the
+          <literal>gitlab-shell</literal> command in its
+          <literal>authorized_keys</literal> file, which might stop
+          working after garbage collection. To circumvent that, we
+          regenerated that file on each startup. As
+          <literal>gitlab-shell</literal> has now been changed to use
+          <literal>/var/run/current-system/sw/bin/gitlab-shell</literal>,
+          this is not necessary anymore, but there might be leftover
+          lines with a nix store path. Regenerate the
+          <literal>authorized_keys</literal> file via
+          <literal>sudo -u git -H gitlab-rake gitlab:shell:setup</literal>
+          in that case.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>pam_unix</literal> account module is now loaded
+          with its control field set to <literal>required</literal>
+          instead of <literal>sufficient</literal>, so that later PAM
+          account modules that might do more extensive checks are being
+          executed. Previously, the whole account module verification
+          was exited prematurely in case a nss module provided the
+          account name to <literal>pam_unix</literal>. The LDAP and SSSD
+          NixOS modules already add their NSS modules when enabled. In
+          case your setup breaks due to some later PAM account module
+          previosuly shadowed, or failing NSS lookups, please file a
+          bug. You can get back the old behaviour by manually setting
+          <literal>security.pam.services.&lt;name?&gt;.text</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>pam_unix</literal> password module is now loaded
+          with its control field set to <literal>sufficient</literal>
+          instead of <literal>required</literal>, so that password
+          managed only by later PAM password modules are being executed.
+          Previously, for example, changing an LDAP account's password
+          through PAM was not possible: the whole password module
+          verification was exited prematurely by
+          <literal>pam_unix</literal>, preventing
+          <literal>pam_ldap</literal> to manage the password as it
+          should.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>fish</literal> has been upgraded to 3.0. It comes
+          with a number of improvements and backwards incompatible
+          changes. See the <literal>fish</literal>
+          <link xlink:href="https://github.com/fish-shell/fish-shell/releases/tag/3.0.0">release
+          notes</link> for more information.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The ibus-table input method has had a change in config format,
+          which causes all previous settings to be lost. See
+          <link xlink:href="https://github.com/mike-fabian/ibus-table/commit/f9195f877c5212fef0dfa446acb328c45ba5852b">this
+          commit message</link> for details.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          NixOS module system type <literal>types.optionSet</literal>
+          and <literal>lib.mkOption</literal> argument
+          <literal>options</literal> are deprecated. Use
+          <literal>types.submodule</literal> instead.
+          (<link xlink:href="https://github.com/NixOS/nixpkgs/pull/54637">#54637</link>)
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>matrix-synapse</literal> has been updated to version
+          0.99. It will
+          <link xlink:href="https://github.com/matrix-org/synapse/pull/4509">no
+          longer generate a self-signed certificate on first
+          launch</link> and will be
+          <link xlink:href="https://matrix.org/blog/2019/02/05/synapse-0-99-0/">the
+          last version to accept self-signed certificates</link>. As
+          such, it is now recommended to use a proper certificate
+          verified by a root CA (for example Let's Encrypt). The new
+          <link linkend="module-services-matrix">manual chapter on
+          Matrix</link> contains a working example of using nginx as a
+          reverse proxy in front of <literal>matrix-synapse</literal>,
+          using Let's Encrypt certificates.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>mailutils</literal> now works by default when
+          <literal>sendmail</literal> is not in a setuid wrapper. As a
+          consequence, the <literal>sendmailPath</literal> argument,
+          having lost its main use, has been removed.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>graylog</literal> has been upgraded from version 2.*
+          to 3.*. Some setups making use of extraConfig (especially
+          those exposing Graylog via reverse proxies) need to be updated
+          as upstream removed/replaced some settings. See
+          <link xlink:href="http://docs.graylog.org/en/3.0/pages/upgrade/graylog-3.0.html#simplified-http-interface-configuration">Upgrading
+          Graylog</link> for details.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The option <literal>users.ldap.bind.password</literal> was
+          renamed to <literal>users.ldap.bind.passwordFile</literal>,
+          and needs to be readable by the <literal>nslcd</literal> user.
+          Same applies to the new
+          <literal>users.ldap.daemon.rootpwmodpwFile</literal> option.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>nodejs-6_x</literal> is end-of-life.
+          <literal>nodejs-6_x</literal>,
+          <literal>nodejs-slim-6_x</literal> and
+          <literal>nodePackages_6_x</literal> are removed.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-19.03-notable-changes">
+    <title>Other Notable Changes</title>
+    <itemizedlist>
+      <listitem>
+        <para>
+          The <literal>services.matomo</literal> module gained the
+          option <literal>services.matomo.package</literal> which
+          determines the used Matomo version.
+        </para>
+        <para>
+          The Matomo module now also comes with the systemd service
+          <literal>matomo-archive-processing.service</literal> and a
+          timer that automatically triggers archive processing every
+          hour. This means that you can safely
+          <link xlink:href="https://matomo.org/docs/setup-auto-archiving/#disable-browser-triggers-for-matomo-archiving-and-limit-matomo-reports-to-updating-every-hour">
+          disable browser triggers for Matomo archiving </link> at
+          <literal>Administration &gt; System &gt; General Settings</literal>.
+        </para>
+        <para>
+          Additionally, you can enable to
+          <link xlink:href="https://matomo.org/docs/privacy/#step-2-delete-old-visitors-logs">
+          delete old visitor logs </link> at
+          <literal>Administration &gt; System &gt; Privacy</literal>,
+          but make sure that you run
+          <literal>systemctl start matomo-archive-processing.service</literal>
+          at least once without errors if you have already collected
+          data before, so that the reports get archived before the
+          source data gets deleted.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>composableDerivation</literal> along with supporting
+          library functions has been removed.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The deprecated <literal>truecrypt</literal> package has been
+          removed and <literal>truecrypt</literal> attribute is now an
+          alias for <literal>veracrypt</literal>. VeraCrypt is
+          backward-compatible with TrueCrypt volumes. Note that
+          <literal>cryptsetup</literal> also supports loading TrueCrypt
+          volumes.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The Kubernetes DNS addons, kube-dns, has been replaced with
+          CoreDNS. This change is made in accordance with Kubernetes
+          making CoreDNS the official default starting from
+          <link xlink:href="https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.11.md#sig-cluster-lifecycle">Kubernetes
+          v1.11</link>. Please beware that upgrading DNS-addon on
+          existing clusters might induce minor downtime while the
+          DNS-addon terminates and re-initializes. Also note that the
+          DNS-service now runs with 2 pod replicas by default. The
+          desired number of replicas can be configured using:
+          <literal>services.kubernetes.addons.dns.replicas</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The quassel-webserver package and module was removed from
+          nixpkgs due to the lack of maintainers.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The manual gained a <link linkend="module-services-matrix">
+          new chapter on self-hosting <literal>matrix-synapse</literal>
+          and <literal>riot-web</literal> </link>, the most prevalent
+          server and client implementations for the
+          <link xlink:href="https://matrix.org/">Matrix</link> federated
+          communication network.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The astah-community package was removed from nixpkgs due to it
+          being discontinued and the downloads not being available
+          anymore.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The httpd service now saves log files with a .log file
+          extension by default for easier integration with the logrotate
+          service.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The owncloud server packages and httpd subservice module were
+          removed from nixpkgs due to the lack of maintainers.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          It is possible now to uze ZRAM devices as general purpose
+          ephemeral block devices, not only as swap. Using more than 1
+          device as ZRAM swap is no longer recommended, but is still
+          possible by setting <literal>zramSwap.swapDevices</literal>
+          explicitly.
+        </para>
+        <para>
+          ZRAM algorithm can be changed now.
+        </para>
+        <para>
+          Changes to ZRAM algorithm are applied during
+          <literal>nixos-rebuild switch</literal>, so make sure you have
+          enough swap space on disk to survive ZRAM device rebuild.
+          Alternatively, use
+          <literal>nixos-rebuild boot; reboot</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Flat volumes are now disabled by default in
+          <literal>hardware.pulseaudio</literal>. This has been done to
+          prevent applications, which are unaware of this feature,
+          setting their volumes to 100% on startup causing harm to your
+          audio hardware and potentially your ears.
+        </para>
+        <note>
+          <para>
+            With this change application specific volumes are relative
+            to the master volume which can be adjusted independently,
+            whereas before they were absolute; meaning that in effect,
+            it scaled the device-volume with the volume of the loudest
+            application.
+          </para>
+        </note>
+      </listitem>
+      <listitem>
+        <para>
+          The
+          <link xlink:href="https://github.com/DanielAdolfsson/ndppd"><literal>ndppd</literal></link>
+          module now supports
+          <link xlink:href="options.html#opt-services.ndppd.enable">all
+          config options</link> provided by the current upstream version
+          as service options. Additionally the <literal>ndppd</literal>
+          package doesn't contain the systemd unit configuration from
+          upstream anymore, the unit is completely configured by the
+          NixOS module now.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          New installs of NixOS will default to the Redmine 4.x series
+          unless otherwise specified in
+          <literal>services.redmine.package</literal> while existing
+          installs of NixOS will default to the Redmine 3.x series.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The
+          <link xlink:href="options.html#opt-services.grafana.enable">Grafana
+          module</link> now supports declarative
+          <link xlink:href="http://docs.grafana.org/administration/provisioning/">datasource
+          and dashboard</link> provisioning.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The use of insecure ports on kubernetes has been deprecated.
+          Thus options:
+          <literal>services.kubernetes.apiserver.port</literal> and
+          <literal>services.kubernetes.controllerManager.port</literal>
+          has been renamed to <literal>.insecurePort</literal>, and
+          default of both options has changed to 0 (disabled).
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Note that the default value of
+          <literal>services.kubernetes.apiserver.bindAddress</literal>
+          has changed from 127.0.0.1 to 0.0.0.0, allowing the apiserver
+          to be accessible from outside the master node itself. If the
+          apiserver insecurePort is enabled, it is strongly recommended
+          to only bind on the loopback interface. See:
+          <literal>services.kubernetes.apiserver.insecurebindAddress</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The option
+          <literal>services.kubernetes.apiserver.allowPrivileged</literal>
+          and
+          <literal>services.kubernetes.kubelet.allowPrivileged</literal>
+          now defaults to false. Disallowing privileged containers on
+          the cluster.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The kubernetes module does no longer add the kubernetes
+          package to <literal>environment.systemPackages</literal>
+          implicitly.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>intel</literal> driver has been removed from the
+          default list of
+          <link xlink:href="options.html#opt-services.xserver.videoDrivers">X.org
+          video drivers</link>. The <literal>modesetting</literal>
+          driver should take over automatically, it is better maintained
+          upstream and has less problems with advanced X11 features.
+          This can lead to a change in the output names used by
+          <literal>xrandr</literal>. Some performance regressions on
+          some GPU models might happen. Some OpenCL and VA-API
+          applications might also break (Beignet seems to provide OpenCL
+          support with <literal>modesetting</literal> driver, too).
+          Kernel mode setting API does not support backlight control, so
+          <literal>xbacklight</literal> tool will not work; backlight
+          level can be controlled directly via <literal>/sys/</literal>
+          or with <literal>brightnessctl</literal>. Users who need this
+          functionality more than multi-output XRandR are advised to add
+          `intel` to `videoDrivers` and report an issue (or provide
+          additional details in an existing one)
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Openmpi has been updated to version 4.0.0, which removes some
+          deprecated MPI-1 symbols. This may break some older
+          applications that still rely on those symbols. An upgrade
+          guide can be found
+          <link xlink:href="https://www.open-mpi.org/faq/?category=mpi-removed">here</link>.
+        </para>
+        <para>
+          The nginx package now relies on OpenSSL 1.1 and supports TLS
+          1.3 by default. You can set the protocols used by the nginx
+          service using
+          <link xlink:href="options.html#opt-services.nginx.sslProtocols">services.nginx.sslProtocols</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          A new subcommand <literal>nixos-rebuild edit</literal> was
+          added.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+</section>
diff --git a/nixos/doc/manual/from_md/release-notes/rl-1909.section.xml b/nixos/doc/manual/from_md/release-notes/rl-1909.section.xml
new file mode 100644
index 000000000000..83cd649f4ea0
--- /dev/null
+++ b/nixos/doc/manual/from_md/release-notes/rl-1909.section.xml
@@ -0,0 +1,1197 @@
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-release-19.09">
+  <title>Release 19.09 (<quote>Loris</quote>, 2019/10/09)</title>
+  <section xml:id="sec-release-19.09-highlights">
+    <title>Highlights</title>
+    <para>
+      In addition to numerous new and upgraded packages, this release
+      has the following highlights:
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          End of support is planned for end of April 2020, handing over
+          to 20.03.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Nix has been updated to 2.3; see its
+          <link xlink:href="https://nixos.org/nix/manual/#ssec-relnotes-2.3">release
+          notes</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Core version changes:
+        </para>
+        <para>
+          systemd: 239 -&gt; 243
+        </para>
+        <para>
+          gcc: 7 -&gt; 8
+        </para>
+        <para>
+          glibc: 2.27 (unchanged)
+        </para>
+        <para>
+          linux: 4.19 LTS (unchanged)
+        </para>
+        <para>
+          openssl: 1.0 -&gt; 1.1
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Desktop version changes:
+        </para>
+        <para>
+          plasma5: 5.14 -&gt; 5.16
+        </para>
+        <para>
+          gnome3: 3.30 -&gt; 3.32
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          PHP now defaults to PHP 7.3, updated from 7.2.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          PHP 7.1 is no longer supported due to upstream not supporting
+          this version for the entire lifecycle of the 19.09 release.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The binfmt module is now easier to use. Additional systems can
+          be added through
+          <literal>boot.binfmt.emulatedSystems</literal>. For instance,
+          <literal>boot.binfmt.emulatedSystems = [ &quot;wasm32-wasi&quot; &quot;x86_64-windows&quot; &quot;aarch64-linux&quot; ];</literal>
+          will set up binfmt interpreters for each of those listed
+          systems.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The installer now uses a less privileged
+          <literal>nixos</literal> user whereas before we logged in as
+          root. To gain root privileges use <literal>sudo -i</literal>
+          without a password.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          We've updated to Xfce 4.14, which brings a new module
+          <literal>services.xserver.desktopManager.xfce4-14</literal>.
+          If you'd like to upgrade, please switch from the
+          <literal>services.xserver.desktopManager.xfce</literal> module
+          as it will be deprecated in a future release. They're
+          incompatibilities with the current Xfce module; it doesn't
+          support <literal>thunarPlugins</literal> and it isn't
+          recommended to use
+          <literal>services.xserver.desktopManager.xfce</literal> and
+          <literal>services.xserver.desktopManager.xfce4-14</literal>
+          simultaneously or to downgrade from Xfce 4.14 after upgrading.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The GNOME 3 desktop manager module sports an interface to
+          enable/disable core services, applications, and optional GNOME
+          packages like games.
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              <literal>services.gnome3.core-os-services.enable</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>services.gnome3.core-shell.enable</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>services.gnome3.core-utilities.enable</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>services.gnome3.games.enable</literal>
+            </para>
+          </listitem>
+        </itemizedlist>
+        <para>
+          With these options we hope to give users finer grained control
+          over their systems. Prior to this change you'd either have to
+          manually disable options or use
+          <literal>environment.gnome3.excludePackages</literal> which
+          only excluded the optional applications.
+          <literal>environment.gnome3.excludePackages</literal> is now
+          unguarded, it can exclude any package installed with
+          <literal>environment.systemPackages</literal> in the GNOME 3
+          module.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Orthogonal to the previous changes to the GNOME 3 desktop
+          manager module, we've updated all default services and
+          applications to match as close as possible to a default
+          reference GNOME 3 experience.
+        </para>
+        <para>
+          <emphasis role="strong">The following changes were enacted in
+          <literal>services.gnome3.core-utilities.enable</literal></emphasis>
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              <literal>accerciser</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>dconf-editor</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>evolution</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>gnome-documents</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>gnome-nettool</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>gnome-power-manager</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>gnome-todo</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>gnome-tweaks</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>gnome-usage</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>gucharmap</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>nautilus-sendto</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>vinagre</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>cheese</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>geary</literal>
+            </para>
+          </listitem>
+        </itemizedlist>
+        <para>
+          <emphasis role="strong">The following changes were enacted in
+          <literal>services.gnome3.core-shell.enable</literal></emphasis>
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              <literal>gnome-color-manager</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>orca</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>services.avahi.enable</literal>
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-19.09-new-services">
+    <title>New Services</title>
+    <para>
+      The following new services were added since the last release:
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          <literal>./programs/dwm-status.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The new <literal>hardware.printers</literal> module allows to
+          declaratively configure CUPS printers via the
+          <literal>ensurePrinters</literal> and
+          <literal>ensureDefaultPrinter</literal> options.
+          <literal>ensurePrinters</literal> will never delete existing
+          printers, but will make sure that the given printers are
+          configured as declared.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          There is a new
+          <link xlink:href="options.html#opt-services.system-config-printer.enable">services.system-config-printer.enable</link>
+          and
+          <link xlink:href="options.html#opt-programs.system-config-printer.enable">programs.system-config-printer.enable</link>
+          module for the program of the same name. If you previously had
+          <literal>system-config-printer</literal> enabled through some
+          other means you should migrate to using one of these modules.
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              <literal>services.xserver.desktopManager.plasma5</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>services.xserver.desktopManager.gnome3</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>services.xserver.desktopManager.pantheon</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>services.xserver.desktopManager.mate</literal>
+              Note Mate uses
+              <literal>programs.system-config-printer</literal> as it
+              doesn't use it as a service, but its graphical interface
+              directly.
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="options.html#opt-services.blueman.enable">services.blueman.enable</link>
+          has been added. If you previously had blueman installed via
+          <literal>environment.systemPackages</literal> please migrate
+          to using the NixOS module, as this would result in an
+          insufficiently configured blueman.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-19.09-incompatibilities">
+    <title>Backward Incompatibilities</title>
+    <para>
+      When upgrading from a previous release, please be aware of the
+      following incompatible changes:
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          Buildbot no longer supports Python 2, as support was dropped
+          upstream in version 2.0.0. Configurations may need to be
+          modified to make them compatible with Python 3.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          PostgreSQL now uses <literal>/run/postgresql</literal> as its
+          socket directory instead of <literal>/tmp</literal>. So if you
+          run an application like eg. Nextcloud, where you need to use
+          the Unix socket path as the database host name, you need to
+          change it accordingly.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          PostgreSQL 9.4 is scheduled EOL during the 19.09 life cycle
+          and has been removed.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The options
+          <literal>services.prometheus.alertmanager.user</literal> and
+          <literal>services.prometheus.alertmanager.group</literal> have
+          been removed because the alertmanager service is now using
+          systemd's
+          <link xlink:href="http://0pointer.net/blog/dynamic-users-with-systemd.html">
+          DynamicUser mechanism</link> which obviates these options.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The NetworkManager systemd unit was renamed back from
+          network-manager.service to NetworkManager.service for better
+          compatibility with other applications expecting this name. The
+          same applies to ModemManager where modem-manager.service is
+          now called ModemManager.service again.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>services.nzbget.configFile</literal> and
+          <literal>services.nzbget.openFirewall</literal> options were
+          removed as they are managed internally by the nzbget. The
+          <literal>services.nzbget.dataDir</literal> option hadn't
+          actually been used by the module for some time and so was
+          removed as cleanup.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>services.mysql.pidDir</literal> option was
+          removed, as it was only used by the wordpress apache-httpd
+          service to wait for mysql to have started up. This can be
+          accomplished by either describing a dependency on
+          mysql.service (preferred) or waiting for the (hardcoded)
+          <literal>/run/mysqld/mysql.sock</literal> file to appear.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>services.emby.enable</literal> module has been
+          removed, see <literal>services.jellyfin.enable</literal>
+          instead for a free software fork of Emby. See the Jellyfin
+          documentation:
+          <link xlink:href="https://jellyfin.readthedocs.io/en/latest/administrator-docs/migrate-from-emby/">
+          Migrating from Emby to Jellyfin </link>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          IPv6 Privacy Extensions are now enabled by default for
+          undeclared interfaces. The previous behaviour was quite
+          misleading — even though the default value for
+          <literal>networking.interfaces.*.preferTempAddress</literal>
+          was <literal>true</literal>, undeclared interfaces would not
+          prefer temporary addresses. Now, interfaces not mentioned in
+          the config will prefer temporary addresses. EUI64 addresses
+          can still be set as preferred by explicitly setting the option
+          to <literal>false</literal> for the interface in question.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Since Bittorrent Sync was superseded by Resilio Sync in 2016,
+          the <literal>bittorrentSync</literal>,
+          <literal>bittorrentSync14</literal>, and
+          <literal>bittorrentSync16</literal> packages have been removed
+          in favor of <literal>resilio-sync</literal>.
+        </para>
+        <para>
+          The corresponding module, <literal>services.btsync</literal>
+          has been replaced by the <literal>services.resilio</literal>
+          module.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The httpd service no longer attempts to start the postgresql
+          service. If you have come to depend on this behaviour then you
+          can preserve the behavior with the following configuration:
+          <literal>systemd.services.httpd.after = [ &quot;postgresql.service&quot; ];</literal>
+        </para>
+        <para>
+          The option <literal>services.httpd.extraSubservices</literal>
+          has been marked as deprecated. You may still use this feature,
+          but it will be removed in a future release of NixOS. You are
+          encouraged to convert any httpd subservices you may have
+          written to a full NixOS module.
+        </para>
+        <para>
+          Most of the httpd subservices packaged with NixOS have been
+          replaced with full NixOS modules including LimeSurvey,
+          WordPress, and Zabbix. These modules can be enabled using the
+          <literal>services.limesurvey.enable</literal>,
+          <literal>services.mediawiki.enable</literal>,
+          <literal>services.wordpress.enable</literal>, and
+          <literal>services.zabbixWeb.enable</literal> options.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The option
+          <literal>systemd.network.networks.&lt;name&gt;.routes.*.routeConfig.GatewayOnlink</literal>
+          was renamed to
+          <literal>systemd.network.networks.&lt;name&gt;.routes.*.routeConfig.GatewayOnLink</literal>
+          (capital <literal>L</literal>). This follows
+          <link xlink:href="https://github.com/systemd/systemd/commit/9cb8c5593443d24c19e40bfd4fc06d672f8c554c">
+          upstreams renaming </link> of the setting.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          As of this release the NixOps feature
+          <literal>autoLuks</literal> is deprecated. It no longer works
+          with our systemd version without manual intervention.
+        </para>
+        <para>
+          Whenever the usage of the module is detected the evaluation
+          will fail with a message explaining why and how to deal with
+          the situation.
+        </para>
+        <para>
+          A new knob named
+          <literal>nixops.enableDeprecatedAutoLuks</literal> has been
+          introduced to disable the eval failure and to acknowledge the
+          notice was received and read. If you plan on using the feature
+          please note that it might break with subsequent updates.
+        </para>
+        <para>
+          Make sure you set the <literal>_netdev</literal> option for
+          each of the file systems referring to block devices provided
+          by the autoLuks module. Not doing this might render the system
+          in a state where it doesn't boot anymore.
+        </para>
+        <para>
+          If you are actively using the <literal>autoLuks</literal>
+          module please let us know in
+          <link xlink:href="https://github.com/NixOS/nixpkgs/issues/62211">issue
+          #62211</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The setopt declarations will be evaluated at the end of
+          <literal>/etc/zshrc</literal>, so any code in
+          <link xlink:href="options.html#opt-programs.zsh.interactiveShellInit">programs.zsh.interactiveShellInit</link>,
+          <link xlink:href="options.html#opt-programs.zsh.loginShellInit">programs.zsh.loginShellInit</link>
+          and
+          <link xlink:href="options.html#opt-programs.zsh.promptInit">programs.zsh.promptInit</link>
+          may break if it relies on those options being set.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>prometheus-nginx-exporter</literal> package now
+          uses the offical exporter provided by NGINX Inc. Its metrics
+          are differently structured and are incompatible to the old
+          ones. For information about the metrics, have a look at the
+          <link xlink:href="https://github.com/nginxinc/nginx-prometheus-exporter">official
+          repo</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>shibboleth-sp</literal> package has been updated
+          to version 3. It is largely backward compatible, for further
+          information refer to the
+          <link xlink:href="https://wiki.shibboleth.net/confluence/display/SP3/ReleaseNotes">release
+          notes</link> and
+          <link xlink:href="https://wiki.shibboleth.net/confluence/display/SP3/UpgradingFromV2">upgrade
+          guide</link>.
+        </para>
+        <para>
+          Nodejs 8 is scheduled EOL under the lifetime of 19.09 and has
+          been dropped.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          By default, prometheus exporters are now run with
+          <literal>DynamicUser</literal> enabled. Exporters that need a
+          real user, now run under a seperate user and group which
+          follow the pattern
+          <literal>&lt;exporter-name&gt;-exporter</literal>, instead of
+          the previous default <literal>nobody</literal> and
+          <literal>nogroup</literal>. Only some exporters are affected
+          by the latter, namely the exporters
+          <literal>dovecot</literal>, <literal>node</literal>,
+          <literal>postfix</literal> and <literal>varnish</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>ibus-qt</literal> package is not installed by
+          default anymore when
+          <link xlink:href="options.html#opt-i18n.inputMethod.enabled">i18n.inputMethod.enabled</link>
+          is set to <literal>ibus</literal>. If IBus support in Qt 4.x
+          applications is required, add the <literal>ibus-qt</literal>
+          package to your
+          <link xlink:href="options.html#opt-environment.systemPackages">environment.systemPackages</link>
+          manually.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The CUPS Printing service now uses socket-based activation by
+          default, only starting when needed. The previous behavior can
+          be restored by setting
+          <literal>services.cups.startWhenNeeded</literal> to
+          <literal>false</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>services.systemhealth</literal> module has been
+          removed from nixpkgs due to lack of maintainer.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>services.mantisbt</literal> module has been
+          removed from nixpkgs due to lack of maintainer.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Squid 3 has been removed and the <literal>squid</literal>
+          derivation now refers to Squid 4.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>services.pdns-recursor.extraConfig</literal>
+          option has been replaced by
+          <literal>services.pdns-recursor.settings</literal>. The new
+          option allows setting extra configuration while being better
+          type-checked and mergeable.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          No service depends on <literal>keys.target</literal> anymore
+          which is a systemd target that indicates if all
+          <link xlink:href="https://nixos.org/nixops/manual/#idm140737322342384">NixOps
+          keys</link> were successfully uploaded. Instead,
+          <literal>&lt;key-name&gt;-key.service</literal> should be used
+          to define a dependency of a key in a service. The full issue
+          behind the <literal>keys.target</literal> dependency is
+          described at
+          <link xlink:href="https://github.com/NixOS/nixpkgs/issues/67265">NixOS/nixpkgs#67265</link>.
+        </para>
+        <para>
+          The following services are affected by this:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.dovecot2.enable"><literal>services.dovecot2</literal></link>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.nsd.enable"><literal>services.nsd</literal></link>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.softether.enable"><literal>services.softether</literal></link>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.strongswan.enable"><literal>services.strongswan</literal></link>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.strongswan-swanctl.enable"><literal>services.strongswan-swanctl</literal></link>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.httpd.enable"><literal>services.httpd</literal></link>
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>security.acme.directory</literal> option has been
+          replaced by a read-only
+          <literal>security.acme.certs.&lt;cert&gt;.directory</literal>
+          option for each certificate you define. This will be a
+          subdirectory of <literal>/var/lib/acme</literal>. You can use
+          this read-only option to figure out where the certificates are
+          stored for a specific certificate. For example, the
+          <literal>services.nginx.virtualhosts.&lt;name&gt;.enableACME</literal>
+          option will use this directory option to find the certs for
+          the virtual host.
+        </para>
+        <para>
+          <literal>security.acme.preDelay</literal> and
+          <literal>security.acme.activationDelay</literal> options have
+          been removed. To execute a service before certificates are
+          provisioned or renewed add a
+          <literal>RequiredBy=acme-${cert}.service</literal> to any
+          service.
+        </para>
+        <para>
+          Furthermore, the acme module will not automatically add a
+          dependency on <literal>lighttpd.service</literal> anymore. If
+          you are using certficates provided by letsencrypt for
+          lighttpd, then you should depend on the certificate service
+          <literal>acme-${cert}.service&gt;</literal> manually.
+        </para>
+        <para>
+          For nginx, the dependencies are still automatically managed
+          when
+          <literal>services.nginx.virtualhosts.&lt;name&gt;.enableACME</literal>
+          is enabled just like before. What changed is that nginx now
+          directly depends on the specific certificates that it needs,
+          instead of depending on the catch-all
+          <literal>acme-certificates.target</literal>. This target unit
+          was also removed from the codebase. This will mean nginx will
+          no longer depend on certificates it isn't explicitly managing
+          and fixes a bug with certificate renewal ordering racing with
+          nginx restarting which could lead to nginx getting in a broken
+          state as described at
+          <link xlink:href="https://github.com/NixOS/nixpkgs/issues/60180">NixOS/nixpkgs#60180</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The old deprecated <literal>emacs</literal> package sets have
+          been dropped. What used to be called
+          <literal>emacsPackagesNg</literal> is now simply called
+          <literal>emacsPackages</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services.xserver.desktopManager.xterm</literal> is
+          now disabled by default if <literal>stateVersion</literal> is
+          19.09 or higher. Previously the xterm desktopManager was
+          enabled when xserver was enabled, but it isn't useful for all
+          people so it didn't make sense to have any desktopManager
+          enabled default.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The WeeChat plugin
+          <literal>pkgs.weechatScripts.weechat-xmpp</literal> has been
+          removed as it doesn't receive any updates from upstream and
+          depends on outdated Python2-based modules.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Old unsupported versions (<literal>logstash5</literal>,
+          <literal>kibana5</literal>, <literal>filebeat5</literal>,
+          <literal>heartbeat5</literal>, <literal>metricbeat5</literal>,
+          <literal>packetbeat5</literal>) of the ELK-stack and Elastic
+          beats have been removed.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          For NixOS 19.03, both Prometheus 1 and 2 were available to
+          allow for a seamless transition from version 1 to 2 with
+          existing setups. Because Prometheus 1 is no longer developed,
+          it was removed. Prometheus 2 is now configured with
+          <literal>services.prometheus</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Citrix Receiver (<literal>citrix_receiver</literal>) has been
+          dropped in favor of Citrix Workspace
+          (<literal>citrix_workspace</literal>).
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>services.gitlab</literal> module has had its
+          literal secret options
+          (<literal>services.gitlab.smtp.password</literal>,
+          <literal>services.gitlab.databasePassword</literal>,
+          <literal>services.gitlab.initialRootPassword</literal>,
+          <literal>services.gitlab.secrets.secret</literal>,
+          <literal>services.gitlab.secrets.db</literal>,
+          <literal>services.gitlab.secrets.otp</literal> and
+          <literal>services.gitlab.secrets.jws</literal>) replaced by
+          file-based versions
+          (<literal>services.gitlab.smtp.passwordFile</literal>,
+          <literal>services.gitlab.databasePasswordFile</literal>,
+          <literal>services.gitlab.initialRootPasswordFile</literal>,
+          <literal>services.gitlab.secrets.secretFile</literal>,
+          <literal>services.gitlab.secrets.dbFile</literal>,
+          <literal>services.gitlab.secrets.otpFile</literal> and
+          <literal>services.gitlab.secrets.jwsFile</literal>). This was
+          done so that secrets aren't stored in the world-readable nix
+          store, but means that for each option you'll have to create a
+          file with the same exact string, add &quot;File&quot; to the
+          end of the option name, and change the definition to a string
+          pointing to the corresponding file; e.g.
+          <literal>services.gitlab.databasePassword = &quot;supersecurepassword&quot;</literal>
+          becomes
+          <literal>services.gitlab.databasePasswordFile = &quot;/path/to/secret_file&quot;</literal>
+          where the file <literal>secret_file</literal> contains the
+          string <literal>supersecurepassword</literal>.
+        </para>
+        <para>
+          The state path (<literal>services.gitlab.statePath</literal>)
+          now has the following restriction: no parent directory can be
+          owned by any other user than <literal>root</literal> or the
+          user specified in <literal>services.gitlab.user</literal>;
+          i.e. if <literal>services.gitlab.statePath</literal> is set to
+          <literal>/var/lib/gitlab/state</literal>,
+          <literal>gitlab</literal> and all parent directories must be
+          owned by either <literal>root</literal> or the user specified
+          in <literal>services.gitlab.user</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>networking.useDHCP</literal> option is
+          unsupported in combination with
+          <literal>networking.useNetworkd</literal> in anticipation of
+          defaulting to it. It has to be set to <literal>false</literal>
+          and enabled per interface with
+          <literal>networking.interfaces.&lt;name&gt;.useDHCP = true;</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The Twitter client <literal>corebird</literal> has been
+          dropped as
+          <link xlink:href="https://www.patreon.com/posts/corebirds-future-18921328">it
+          is discontinued and does not work against the new Twitter
+          API</link>. Please use the fork <literal>cawbird</literal>
+          instead which has been adapted to the API changes and is still
+          maintained.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>nodejs-11_x</literal> package has been removed as
+          it's EOLed by upstream.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Because of the systemd upgrade, systemd-timesyncd will no
+          longer work if <literal>system.stateVersion</literal> is not
+          set correctly. When upgrading from NixOS 19.03, please make
+          sure that <literal>system.stateVersion</literal> is set to
+          <literal>&quot;19.03&quot;</literal>, or lower if the
+          installation dates back to an earlier version of NixOS.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Due to the short lifetime of non-LTS kernel releases package
+          attributes like <literal>linux_5_1</literal>,
+          <literal>linux_5_2</literal> and <literal>linux_5_3</literal>
+          have been removed to discourage dependence on specific non-LTS
+          kernel versions in stable NixOS releases. Going forward,
+          versioned attributes like <literal>linux_4_9</literal> will
+          exist for LTS versions only. Please use
+          <literal>linux_latest</literal> or
+          <literal>linux_testing</literal> if you depend on non-LTS
+          releases. Keep in mind that <literal>linux_latest</literal>
+          and <literal>linux_testing</literal> will change versions
+          under the hood during the lifetime of a stable release and
+          might include breaking changes.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Because of the systemd upgrade, some network interfaces might
+          change their name. For details see
+          <link xlink:href="https://www.freedesktop.org/software/systemd/man/systemd.net-naming-scheme.html#History">
+          upstream docs</link> or
+          <link xlink:href="https://github.com/NixOS/nixpkgs/issues/71086">
+          our ticket</link>.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-19.09-notable-changes">
+    <title>Other Notable Changes</title>
+    <itemizedlist>
+      <listitem>
+        <para>
+          The <literal>documentation</literal> module gained an option
+          named <literal>documentation.nixos.includeAllModules</literal>
+          which makes the generated configuration.nix 5 manual page
+          include all options from all NixOS modules included in a given
+          <literal>configuration.nix</literal> configuration file.
+          Currently, it is set to <literal>false</literal> by default as
+          enabling it frequently prevents evaluation. But the plan is to
+          eventually have it set to <literal>true</literal> by default.
+          Please set it to <literal>true</literal> now in your
+          <literal>configuration.nix</literal> and fix all the bugs it
+          uncovers.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>vlc</literal> package gained support for
+          Chromecast streaming, enabled by default. TCP port 8010 must
+          be open for it to work, so something like
+          <literal>networking.firewall.allowedTCPPorts = [ 8010 ];</literal>
+          may be required in your configuration. Also consider enabling
+          <link xlink:href="https://nixos.wiki/wiki/Accelerated_Video_Playback">
+          Accelerated Video Playback</link> for better transcoding
+          performance.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The following changes apply if the
+          <literal>stateVersion</literal> is changed to 19.09 or higher.
+          For <literal>stateVersion = &quot;19.03&quot;</literal> or
+          lower the old behavior is preserved.
+        </para>
+        <itemizedlist spacing="compact">
+          <listitem>
+            <para>
+              <literal>solr.package</literal> defaults to
+              <literal>pkgs.solr_8</literal>.
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>hunspellDicts.fr-any</literal> dictionary now
+          ships with <literal>fr_FR.{aff,dic}</literal> which is linked
+          to <literal>fr-toutesvariantes.{aff,dic}</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>mysql</literal> service now runs as
+          <literal>mysql</literal> user. Previously, systemd did execute
+          it as root, and mysql dropped privileges itself. This includes
+          <literal>ExecStartPre=</literal> and
+          <literal>ExecStartPost=</literal> phases. To accomplish that,
+          runtime and data directory setup was delegated to
+          RuntimeDirectory and tmpfiles.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          With the upgrade to systemd version 242 the
+          <literal>systemd-timesyncd</literal> service is no longer
+          using <literal>DynamicUser=yes</literal>. In order for the
+          upgrade to work we rely on an activation script to move the
+          state from the old to the new directory. The older directory
+          (prior <literal>19.09</literal>) was
+          <literal>/var/lib/private/systemd/timesync</literal>.
+        </para>
+        <para>
+          As long as the <literal>system.config.stateVersion</literal>
+          is below <literal>19.09</literal> the state folder will
+          migrated to its proper location
+          (<literal>/var/lib/systemd/timesync</literal>), if required.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The package <literal>avahi</literal> is now built to look up
+          service definitions from
+          <literal>/etc/avahi/services</literal> instead of its output
+          directory in the nix store. Accordingly the module
+          <literal>avahi</literal> now supports custom service
+          definitions via
+          <literal>services.avahi.extraServiceFiles</literal>, which are
+          then placed in the aforementioned directory. See
+          avahi.service5 for more information on custom service
+          definitions.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Since version 0.1.19, <literal>cargo-vendor</literal> honors
+          package includes that are specified in the
+          <literal>Cargo.toml</literal> file of Rust crates.
+          <literal>rustPlatform.buildRustPackage</literal> uses
+          <literal>cargo-vendor</literal> to collect and build dependent
+          crates. Since this change in <literal>cargo-vendor</literal>
+          changes the set of vendored files for most Rust packages, the
+          hash that use used to verify the dependencies,
+          <literal>cargoSha256</literal>, also changes.
+        </para>
+        <para>
+          The <literal>cargoSha256</literal> hashes of all in-tree
+          derivations that use <literal>buildRustPackage</literal> have
+          been updated to reflect this change. However, third-party
+          derivations that use <literal>buildRustPackage</literal> may
+          have to be updated as well.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>consul</literal> package was upgraded past
+          version <literal>1.5</literal>, so its deprecated legacy UI is
+          no longer available.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The default resample-method for PulseAudio has been changed
+          from the upstream default <literal>speex-float-1</literal> to
+          <literal>speex-float-5</literal>. Be aware that low-powered
+          ARM-based and MIPS-based boards will struggle with this so
+          you'll need to set
+          <literal>hardware.pulseaudio.daemon.config.resample-method</literal>
+          back to <literal>speex-float-1</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>phabricator</literal> package and associated
+          <literal>httpd.extraSubservice</literal>, as well as the
+          <literal>phd</literal> service have been removed from nixpkgs
+          due to lack of maintainer.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>mercurial</literal>
+          <literal>httpd.extraSubservice</literal> has been removed from
+          nixpkgs due to lack of maintainer.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>trac</literal>
+          <literal>httpd.extraSubservice</literal> has been removed from
+          nixpkgs because it was unmaintained.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>foswiki</literal> package and associated
+          <literal>httpd.extraSubservice</literal> have been removed
+          from nixpkgs due to lack of maintainer.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>tomcat-connector</literal>
+          <literal>httpd.extraSubservice</literal> has been removed from
+          nixpkgs.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          It's now possible to change configuration in
+          <link xlink:href="options.html#opt-services.nextcloud.enable">services.nextcloud</link>
+          after the initial deploy since all config parameters are
+          persisted in an additional config file generated by the
+          module. Previously core configuration like database parameters
+          were set using their imperative installer after creating
+          <literal>/var/lib/nextcloud</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          There exists now <literal>lib.forEach</literal>, which is like
+          <literal>map</literal>, but with arguments flipped. When
+          mapping function body spans many lines (or has nested
+          <literal>map</literal>s), it is often hard to follow which
+          list is modified.
+        </para>
+        <para>
+          Previous solution to this problem was either to use
+          <literal>lib.flip map</literal> idiom or extract that
+          anonymous mapping function to a named one. Both can still be
+          used but <literal>lib.forEach</literal> is preferred over
+          <literal>lib.flip map</literal>.
+        </para>
+        <para>
+          The <literal>/etc/sysctl.d/nixos.conf</literal> file
+          containing all the options set via
+          <link xlink:href="options.html#opt-boot.kernel.sysctl">boot.kernel.sysctl</link>
+          was moved to <literal>/etc/sysctl.d/60-nixos.conf</literal>,
+          as sysctl.d5 recommends prefixing all filenames in
+          <literal>/etc/sysctl.d</literal> with a two-digit number and a
+          dash to simplify the ordering of the files.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          We now install the sysctl snippets shipped with systemd.
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              Loose reverse path filtering
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              Source route filtering
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>fq_codel</literal> as a packet scheduler (this
+              helps to fight bufferbloat)
+            </para>
+          </listitem>
+        </itemizedlist>
+        <para>
+          This also configures the kernel to pass core dumps to
+          <literal>systemd-coredump</literal>, and restricts the SysRq
+          key combinations to the sync command only. These sysctl
+          snippets can be found in
+          <literal>/etc/sysctl.d/50-*.conf</literal>, and overridden via
+          <link xlink:href="options.html#opt-boot.kernel.sysctl">boot.kernel.sysctl</link>
+          (which will place the parameters in
+          <literal>/etc/sysctl.d/60-nixos.conf</literal>).
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Core dumps are now processed by
+          <literal>systemd-coredump</literal> by default.
+          <literal>systemd-coredump</literal> behaviour can still be
+          modified via <literal>systemd.coredump.extraConfig</literal>.
+          To stick to the old behaviour (having the kernel dump to a
+          file called <literal>core</literal> in the working directory),
+          without piping it through <literal>systemd-coredump</literal>,
+          set <literal>systemd.coredump.enable</literal> to
+          <literal>false</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>systemd.packages</literal> option now also supports
+          generators and shutdown scripts. Old
+          <literal>systemd.generator-packages</literal> option has been
+          removed.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>rmilter</literal> package was removed with
+          associated module and options due deprecation by upstream
+          developer. Use <literal>rspamd</literal> in proxy mode
+          instead.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          systemd cgroup accounting via the
+          <link xlink:href="options.html#opt-systemd.enableCgroupAccounting">systemd.enableCgroupAccounting</link>
+          option is now enabled by default. It now also enables the more
+          recent Block IO and IP accounting features.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          We no longer enable custom font rendering settings with
+          <literal>fonts.fontconfig.penultimate.enable</literal> by
+          default. The defaults from fontconfig are sufficient.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>crashplan</literal> package and the
+          <literal>crashplan</literal> service have been removed from
+          nixpkgs due to crashplan shutting down the service, while the
+          <literal>crashplansb</literal> package and
+          <literal>crashplan-small-business</literal> service have been
+          removed from nixpkgs due to lack of maintainer.
+        </para>
+        <para>
+          The
+          <link xlink:href="options.html#opt-services.redis.enable">redis
+          module</link> was hardcoded to use the
+          <literal>redis</literal> user, <literal>/run/redis</literal>
+          as runtime directory and <literal>/var/lib/redis</literal> as
+          state directory. Note that the NixOS module for Redis now
+          disables kernel support for Transparent Huge Pages (THP),
+          because this features causes major performance problems for
+          Redis, e.g. (https://redis.io/topics/latency).
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Using <literal>fonts.enableDefaultFonts</literal> adds a
+          default emoji font <literal>noto-fonts-emoji</literal>.
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              <literal>services.xserver.enable</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>programs.sway.enable</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>programs.way-cooler.enable</literal>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>services.xrdp.enable</literal>
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>altcoins</literal> categorization of packages has
+          been removed. You now access these packages at the top level,
+          ie. <literal>nix-shell -p dogecoin</literal> instead of
+          <literal>nix-shell -p altcoins.dogecoin</literal>, etc.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Ceph has been upgraded to v14.2.1. See the
+          <link xlink:href="https://ceph.com/releases/v14-2-0-nautilus-released/">release
+          notes</link> for details. The mgr dashboard as well as osds
+          backed by loop-devices is no longer explicitly supported by
+          the package and module. Note: There's been some issues with
+          python-cherrypy, which is used by the dashboard and prometheus
+          mgr modules (and possibly others), hence
+          0000-dont-check-cherrypy-version.patch.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>pkgs.weechat</literal> is now compiled against
+          <literal>pkgs.python3</literal>. Weechat also recommends
+          <link xlink:href="https://weechat.org/scripts/python3/">to use
+          Python3 in their docs.</link>
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+</section>
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2003.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2003.section.xml
new file mode 100644
index 000000000000..53e6e1329a94
--- /dev/null
+++ b/nixos/doc/manual/from_md/release-notes/rl-2003.section.xml
@@ -0,0 +1,1497 @@
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-release-20.03">
+  <title>Release 20.03 (<quote>Markhor</quote>, 2020.04/20)</title>
+  <section xml:id="sec-release-20.03-highlights">
+    <title>Highlights</title>
+    <para>
+      In addition to numerous new and upgraded packages, this release
+      has the following highlights:
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          Support is planned until the end of October 2020, handing over
+          to 20.09.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Core version changes:
+        </para>
+        <para>
+          gcc: 8.3.0 -&gt; 9.2.0
+        </para>
+        <para>
+          glibc: 2.27 -&gt; 2.30
+        </para>
+        <para>
+          linux: 4.19 -&gt; 5.4
+        </para>
+        <para>
+          mesa: 19.1.5 -&gt; 19.3.3
+        </para>
+        <para>
+          openssl: 1.0.2u -&gt; 1.1.1d
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Desktop version changes:
+        </para>
+        <para>
+          plasma5: 5.16.5 -&gt; 5.17.5
+        </para>
+        <para>
+          kdeApplications: 19.08.2 -&gt; 19.12.3
+        </para>
+        <para>
+          gnome3: 3.32 -&gt; 3.34
+        </para>
+        <para>
+          pantheon: 5.0 -&gt; 5.1.3
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Linux kernel is updated to branch 5.4 by default (from 4.19).
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Grub is updated to 2.04, adding support for booting from F2FS
+          filesystems and Btrfs volumes using zstd compression. Note
+          that some users have been unable to boot after upgrading to
+          2.04 - for more information, please see
+          <link xlink:href="https://github.com/NixOS/nixpkgs/issues/61718#issuecomment-617618503">this
+          discussion</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Postgresql for NixOS service now defaults to v11.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The graphical installer image starts the graphical session
+          automatically. Before you'd be greeted by a tty and asked to
+          enter <literal>systemctl start display-manager</literal>. It
+          is now possible to disable the display-manager from running by
+          selecting the <literal>Disable display-manager</literal> quirk
+          in the boot menu.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          GNOME 3 has been upgraded to 3.34. Please take a look at their
+          <link xlink:href="https://help.gnome.org/misc/release-notes/3.34">Release
+          Notes</link> for details.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          If you enable the Pantheon Desktop Manager via
+          <link xlink:href="options.html#opt-services.xserver.desktopManager.pantheon.enable">services.xserver.desktopManager.pantheon.enable</link>,
+          we now default to also use
+          <link xlink:href="https://blog.elementary.io/say-hello-to-the-new-greeter/">
+          Pantheon's newly designed greeter </link>. Contrary to NixOS's
+          usual update policy, Pantheon will receive updates during the
+          cycle of NixOS 20.03 when backwards compatible.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          By default zfs pools will now be trimmed on a weekly basis.
+          Trimming is only done on supported devices (i.e. NVME or SSDs)
+          and should improve throughput and lifetime of these devices.
+          It is controlled by the
+          <literal>services.zfs.trim.enable</literal> varname. The zfs
+          scrub service
+          (<literal>services.zfs.autoScrub.enable</literal>) and the zfs
+          autosnapshot service
+          (<literal>services.zfs.autoSnapshot.enable</literal>) are now
+          only enabled if zfs is set in
+          <literal>config.boot.initrd.supportedFilesystems</literal> or
+          <literal>config.boot.supportedFilesystems</literal>. These
+          lists will automatically contain zfs as soon as any zfs
+          mountpoint is configured in <literal>fileSystems</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>nixos-option</literal> has been rewritten in C++,
+          speeding it up, improving correctness, and adding a
+          <literal>-r</literal> option which prints all options and
+          their values recursively.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services.xserver.desktopManager.default</literal> and
+          <literal>services.xserver.windowManager.default</literal>
+          options were replaced by a single
+          <link xlink:href="options.html#opt-services.xserver.displayManager.defaultSession">services.xserver.displayManager.defaultSession</link>
+          option to improve support for upstream session files. If you
+          used something like:
+        </para>
+        <programlisting language="bash">
+{
+  services.xserver.desktopManager.default = &quot;xfce&quot;;
+  services.xserver.windowManager.default = &quot;icewm&quot;;
+}
+</programlisting>
+        <para>
+          you should change it to:
+        </para>
+        <programlisting language="bash">
+{
+  services.xserver.displayManager.defaultSession = &quot;xfce+icewm&quot;;
+}
+</programlisting>
+      </listitem>
+      <listitem>
+        <para>
+          The testing driver implementation in NixOS is now in Python
+          <literal>make-test-python.nix</literal>. This was done by
+          Jacek Galowicz
+          (<link xlink:href="https://github.com/tfc">@tfc</link>), and
+          with the collaboration of Julian Stecklina
+          (<link xlink:href="https://github.com/blitz">@blitz</link>)
+          and Jana Traue
+          (<link xlink:href="https://github.com/jtraue">@jtraue</link>).
+          All documentation has been updated to use this testing driver,
+          and a vast majority of the 286 tests in NixOS were ported to
+          python driver. In 20.09 the Perl driver implementation,
+          <literal>make-test.nix</literal>, is slated for removal. This
+          should give users of the NixOS integration framework a
+          transitory period to rewrite their tests to use the Python
+          implementation. Users of the Perl driver will see this warning
+          everytime they use it:
+        </para>
+        <programlisting>
+$ warning: Perl VM tests are deprecated and will be removed for 20.09.
+Please update your tests to use the python test driver.
+See https://github.com/NixOS/nixpkgs/pull/71684 for details.
+</programlisting>
+        <para>
+          API compatibility is planned to be kept for at least the next
+          release with the perl driver.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-20.03-new-services">
+    <title>New Services</title>
+    <para>
+      The following new services were added since the last release:
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          The kubernetes kube-proxy now supports a new hostname
+          configuration
+          <literal>services.kubernetes.proxy.hostname</literal> which
+          has to be set if the hostname of the node should be non
+          default.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          UPower's configuration is now managed by NixOS and can be
+          customized via <literal>services.upower</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          To use Geary you should enable
+          <link xlink:href="options.html#opt-programs.geary.enable">programs.geary.enable</link>
+          instead of just adding it to
+          <link xlink:href="options.html#opt-environment.systemPackages">environment.systemPackages</link>.
+          It was created so Geary could function properly outside of
+          GNOME.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./config/console.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./hardware/brillo.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./hardware/tuxedo-keyboard.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./programs/bandwhich.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./programs/bash-my-aws.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./programs/liboping.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./programs/traceroute.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/backup/sanoid.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/backup/syncoid.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/backup/zfs-replication.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/continuous-integration/buildkite-agents.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/databases/victoriametrics.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/desktops/gnome3/gnome-initial-setup.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/desktops/neard.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/games/openarena.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/hardware/fancontrol.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/mail/sympa.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/misc/freeswitch.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/misc/mame.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/monitoring/do-agent.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/monitoring/prometheus/xmpp-alerts.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/network-filesystems/orangefs/server.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/network-filesystems/orangefs/client.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/3proxy.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/corerad.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/go-shadowsocks2.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/ntp/openntpd.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/shorewall.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/shorewall6.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/spacecookie.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/trickster.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/v2ray.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/xandikos.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/networking/yggdrasil.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/web-apps/dokuwiki.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/web-apps/gotify-server.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/web-apps/grocy.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/web-apps/ihatemoney</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/web-apps/moinmoin.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/web-apps/trac.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/web-apps/trilium.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/web-apps/shiori.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/web-servers/ttyd.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/x11/picom.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/x11/hardware/digimend.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./services/x11/imwheel.nix</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>./virtualisation/cri-o.nix</literal>
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-20.03-incompatibilities">
+    <title>Backward Incompatibilities</title>
+    <para>
+      When upgrading from a previous release, please be aware of the
+      following incompatible changes:
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          The dhcpcd package
+          <link xlink:href="https://roy.marples.name/archives/dhcpcd-discuss/0002621.html">
+          does not request IPv4 addresses for tap and bridge interfaces
+          anymore by default</link>. In order to still get an address on
+          a bridge interface, one has to disable
+          <literal>networking.useDHCP</literal> and explicitly enable
+          <literal>networking.interfaces.&lt;name&gt;.useDHCP</literal>
+          on every interface, that should get an address via DHCP. This
+          way, dhcpcd is configured in an explicit way about which
+          interface to run on.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          GnuPG is now built without support for a graphical passphrase
+          entry by default. Please enable the
+          <literal>gpg-agent</literal> user service via the NixOS option
+          <literal>programs.gnupg.agent.enable</literal>. Note that
+          upstream recommends using <literal>gpg-agent</literal> and
+          will spawn a <literal>gpg-agent</literal> on the first
+          invocation of GnuPG anyway.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>dynamicHosts</literal> option has been removed
+          from the
+          <link xlink:href="options.html#opt-networking.networkmanager.enable">NetworkManager</link>
+          module. Allowing (multiple) regular users to override host
+          entries affecting the whole system opens up a huge attack
+          vector. There seem to be very rare cases where this might be
+          useful. Consider setting system-wide host entries using
+          <link xlink:href="options.html#opt-networking.hosts">networking.hosts</link>,
+          provide them via the DNS server in your network, or use
+          <link xlink:href="options.html#opt-environment.etc">environment.etc</link>
+          to add a file into
+          <literal>/etc/NetworkManager/dnsmasq.d</literal> reconfiguring
+          <literal>hostsdir</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>99-main.network</literal> file was removed.
+          Matching all network interfaces caused many breakages, see
+          <link xlink:href="https://github.com/NixOS/nixpkgs/pull/18962">#18962</link>
+          and
+          <link xlink:href="https://github.com/NixOS/nixpkgs/pull/71106">#71106</link>.
+        </para>
+        <para>
+          We already don't support the global
+          <link xlink:href="options.html#opt-networking.useDHCP">networking.useDHCP</link>,
+          <link xlink:href="options.html#opt-networking.defaultGateway">networking.defaultGateway</link>
+          and
+          <link xlink:href="options.html#opt-networking.defaultGateway6">networking.defaultGateway6</link>
+          options if
+          <link xlink:href="options.html#opt-networking.useNetworkd">networking.useNetworkd</link>
+          is enabled, but direct users to configure the per-device
+          <link xlink:href="options.html#opt-networking.interfaces">networking.interfaces.&lt;name&gt;….</link>
+          options.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The stdenv now runs all bash with <literal>set -u</literal>,
+          to catch the use of undefined variables. Before, it itself
+          used <literal>set -u</literal> but was careful to unset it so
+          other packages' code ran as before. Now, all bash code is held
+          to the same high standard, and the rather complex stateful
+          manipulation of the options can be discarded.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The SLIM Display Manager has been removed, as it has been
+          unmaintained since 2013. Consider migrating to a different
+          display manager such as LightDM (current default in NixOS),
+          SDDM, GDM, or using the startx module which uses Xinitrc.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The Way Cooler wayland compositor has been removed, as the
+          project has been officially canceled. There are no more
+          <literal>way-cooler</literal> attribute and
+          <literal>programs.way-cooler</literal> options.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The BEAM package set has been deleted. You will only find
+          there the different interpreters. You should now use the
+          different build tools coming with the languages with sandbox
+          mode disabled.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          There is now only one Xfce package-set and module. This means
+          that attributes <literal>xfce4-14</literal> and
+          <literal>xfceUnstable</literal> all now point to the latest
+          Xfce 4.14 packages. And in the future NixOS releases will be
+          the latest released version of Xfce available at the time of
+          the release's development (if viable).
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The
+          <link xlink:href="options.html#opt-services.phpfpm.pools">phpfpm</link>
+          module now sets <literal>PrivateTmp=true</literal> in its
+          systemd units for better process isolation. If you rely on
+          <literal>/tmp</literal> being shared with other services,
+          explicitly override this by setting
+          <literal>serviceConfig.PrivateTmp</literal> to
+          <literal>false</literal> for each phpfpm unit.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          KDE’s old multimedia framework Phonon no longer supports Qt 4.
+          For that reason, Plasma desktop also does not have
+          <literal>enableQt4Support</literal> option any more.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The BeeGFS module has been removed.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The osquery module has been removed.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Going forward, <literal>~/bin</literal> in the users home
+          directory will no longer be in <literal>PATH</literal> by
+          default. If you depend on this you should set the option
+          <literal>environment.homeBinInPath</literal> to
+          <literal>true</literal>. The aforementioned option was added
+          this release.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>buildRustCrate</literal> infrastructure now
+          produces <literal>lib</literal> outputs in addition to the
+          <literal>out</literal> output. This has led to drastically
+          reduced closure sizes for some rust crates since development
+          dependencies are now in the <literal>lib</literal> output.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Pango was upgraded to 1.44, which no longer uses freetype for
+          font loading. This means that type1 and bitmap fonts are no
+          longer supported in applications relying on Pango for font
+          rendering (notably, GTK application). See
+          <link xlink:href="https://gitlab.gnome.org/GNOME/pango/issues/386">
+          upstream issue</link> for more information.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>roundcube</literal> module has been hardened.
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              The password of the database is not written world readable
+              in the store any more. If <literal>database.host</literal>
+              is set to <literal>localhost</literal>, then a unix user
+              of the same name as the database will be created and
+              PostreSQL peer authentication will be used, removing the
+              need for a password. Otherwise, a password is still needed
+              and can be provided with the new option
+              <literal>database.passwordFile</literal>, which should be
+              set to the path of a file containing the password and
+              readable by the user <literal>nginx</literal> only. The
+              <literal>database.password</literal> option is insecure
+              and deprecated. Usage of this option will print a warning.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              A random <literal>des_key</literal> is set by default in
+              the configuration of roundcube, instead of using the
+              hardcoded and insecure default. To ensure a clean
+              migration, all users will be logged out when you upgrade
+              to this release.
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          The packages <literal>openobex</literal> and
+          <literal>obexftp</literal> are no longer installed when
+          enabling Bluetooth via
+          <literal>hardware.bluetooth.enable</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>dump1090</literal> derivation has been changed to
+          use FlightAware's dump1090 as its upstream. However, this
+          version does not have an internal webserver anymore. The
+          assets in the <literal>share/dump1090</literal> directory of
+          the derivation can be used in conjunction with an external
+          webserver to replace this functionality.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The fourStore and fourStoreEndpoint modules have been removed.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Polkit no longer has the user of uid 0 (root) as an admin
+          identity. We now follow the upstream default of only having
+          every member of the wheel group admin privileged. Before it
+          was root and members of wheel. The positive outcome of this is
+          pkexec GUI popups or terminal prompts will no longer require
+          the user to choose between two essentially equivalent choices
+          (whether to perform the action as themselves with wheel
+          permissions, or as the root user).
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          NixOS containers no longer build NixOS manual by default. This
+          saves evaluation time, especially if there are many
+          declarative containers defined. Note that this is already done
+          when
+          <literal>&lt;nixos/modules/profiles/minimal.nix&gt;</literal>
+          module is included in container config.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>kresd</literal> services deprecates the
+          <literal>interfaces</literal> option in favor of the
+          <literal>listenPlain</literal> option which requires full
+          <link xlink:href="https://www.freedesktop.org/software/systemd/man/systemd.socket.html#ListenStream=">systemd.socket
+          compatible</link> declaration which always include a port.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Virtual console options have been reorganized and can be found
+          under a single top-level attribute:
+          <literal>console</literal>. The full set of changes is as
+          follows:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              <literal>i18n.consoleFont</literal> renamed to
+              <link xlink:href="options.html#opt-console.font">console.font</link>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>i18n.consoleKeyMap</literal> renamed to
+              <link xlink:href="options.html#opt-console.keyMap">console.keyMap</link>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>i18n.consoleColors</literal> renamed to
+              <link xlink:href="options.html#opt-console.colors">console.colors</link>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>i18n.consolePackages</literal> renamed to
+              <link xlink:href="options.html#opt-console.packages">console.packages</link>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>i18n.consoleUseXkbConfig</literal> renamed to
+              <link xlink:href="options.html#opt-console.useXkbConfig">console.useXkbConfig</link>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>boot.earlyVconsoleSetup</literal> renamed to
+              <link xlink:href="options.html#opt-console.earlySetup">console.earlySetup</link>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>boot.extraTTYs</literal> renamed to
+              <literal>console.extraTTYs</literal>.
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          The
+          <link xlink:href="options.html#opt-services.awstats.enable">awstats</link>
+          module has been rewritten to serve stats via static html
+          pages, updated on a timer, over
+          <link xlink:href="options.html#opt-services.nginx.virtualHosts">nginx</link>,
+          instead of dynamic cgi pages over
+          <link xlink:href="options.html#opt-services.httpd.enable">apache</link>.
+        </para>
+        <para>
+          Minor changes will be required to migrate existing
+          configurations. Details of the required changes can seen by
+          looking through the
+          <link xlink:href="options.html#opt-services.awstats.enable">awstats</link>
+          module.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The httpd module no longer provides options to support serving
+          web content without defining a virtual host. As a result of
+          this the
+          <link xlink:href="options.html#opt-services.httpd.logPerVirtualHost">services.httpd.logPerVirtualHost</link>
+          option now defaults to <literal>true</literal> instead of
+          <literal>false</literal>. Please update your configuration to
+          make use of
+          <link xlink:href="options.html#opt-services.httpd.virtualHosts">services.httpd.virtualHosts</link>.
+        </para>
+        <para>
+          The
+          <link xlink:href="options.html#opt-services.httpd.virtualHosts">services.httpd.virtualHosts.&lt;name&gt;</link>
+          option has changed type from a list of submodules to an
+          attribute set of submodules, better matching
+          <link xlink:href="options.html#opt-services.nginx.virtualHosts">services.nginx.virtualHosts.&lt;name&gt;</link>.
+        </para>
+        <para>
+          This change comes with the addition of the following options
+          which mimic the functionality of their
+          <literal>nginx</literal> counterparts:
+          <link xlink:href="options.html#opt-services.httpd.virtualHosts">services.httpd.virtualHosts.&lt;name&gt;.addSSL</link>,
+          <link xlink:href="options.html#opt-services.httpd.virtualHosts">services.httpd.virtualHosts.&lt;name&gt;.forceSSL</link>,
+          <link xlink:href="options.html#opt-services.httpd.virtualHosts">services.httpd.virtualHosts.&lt;name&gt;.onlySSL</link>,
+          <link xlink:href="options.html#opt-services.httpd.virtualHosts">services.httpd.virtualHosts.&lt;name&gt;.enableACME</link>,
+          <link xlink:href="options.html#opt-services.httpd.virtualHosts">services.httpd.virtualHosts.&lt;name&gt;.acmeRoot</link>,
+          and
+          <link xlink:href="options.html#opt-services.httpd.virtualHosts">services.httpd.virtualHosts.&lt;name&gt;.useACMEHost</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          For NixOS configuration options, the <literal>loaOf</literal>
+          type has been deprecated and will be removed in a future
+          release. In nixpkgs, options of this type will be changed to
+          <literal>attrsOf</literal> instead. If you were using one of
+          these in your configuration, you will see a warning suggesting
+          what changes will be required.
+        </para>
+        <para>
+          For example,
+          <link xlink:href="options.html#opt-users.users">users.users</link>
+          is a <literal>loaOf</literal> option that is commonly used as
+          follows:
+        </para>
+        <programlisting language="bash">
+{
+  users.users =
+    [ { name = &quot;me&quot;;
+        description = &quot;My personal user.&quot;;
+        isNormalUser = true;
+      }
+    ];
+}
+</programlisting>
+        <para>
+          This should be rewritten by removing the list and using the
+          value of <literal>name</literal> as the name of the attribute
+          set:
+        </para>
+        <programlisting language="bash">
+{
+  users.users.me =
+    { description = &quot;My personal user.&quot;;
+      isNormalUser = true;
+    };
+}
+</programlisting>
+        <para>
+          For more information on this change have look at these links:
+          <link xlink:href="https://github.com/NixOS/nixpkgs/issues/1800">issue
+          #1800</link>,
+          <link xlink:href="https://github.com/NixOS/nixpkgs/pull/63103">PR
+          #63103</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          For NixOS modules, the types
+          <literal>types.submodule</literal> and
+          <literal>types.submoduleWith</literal> now support paths as
+          allowed values, similar to how <literal>imports</literal>
+          supports paths. Because of this, if you have a module that
+          defines an option of type
+          <literal>either (submodule ...) path</literal>, it will break
+          since a path is now treated as the first type instead of the
+          second. To fix this, change the type to
+          <literal>either path (submodule ...)</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The
+          <link xlink:href="options.html#opt-services.buildkite-agents">Buildkite
+          Agent</link> module and corresponding packages have been
+          updated to 3.x, and to support multiple instances of the agent
+          running at the same time. This means you will have to rename
+          <literal>services.buildkite-agent</literal> to
+          <literal>services.buildkite-agents.&lt;name&gt;</literal>.
+          Furthermore, the following options have been changed:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              <literal>services.buildkite-agent.meta-data</literal> has
+              been renamed to
+              <link xlink:href="options.html#opt-services.buildkite-agents">services.buildkite-agents.&lt;name&gt;.tags</link>,
+              to match upstreams naming for 3.x. Its type has also
+              changed - it now accepts an attrset of strings.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              The<literal>services.buildkite-agent.openssh.publicKeyPath</literal>
+              option has been removed, as it's not necessary to deploy
+              public keys to clone private repositories.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>services.buildkite-agent.openssh.privateKeyPath</literal>
+              has been renamed to
+              <link xlink:href="options.html#opt-services.buildkite-agents">buildkite-agents.&lt;name&gt;.privateSshKeyPath</link>,
+              as the whole <literal>openssh</literal> now only contained
+              that single option.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.buildkite-agents">services.buildkite-agents.&lt;name&gt;.shell</link>
+              has been introduced, allowing to specify a custom shell to
+              be used.
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>citrix_workspace_19_3_0</literal> package has
+          been removed as it will be EOLed within the lifespan of 20.03.
+          For further information, please refer to the
+          <link xlink:href="https://www.citrix.com/de-de/support/product-lifecycle/milestones/receiver.html">support
+          and maintenance information</link> from upstream.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>gcc5</literal> and <literal>gfortran5</literal>
+          packages have been removed.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>services.xserver.displayManager.auto</literal>
+          module has been removed. It was only intended for use in
+          internal NixOS tests, and gave the false impression of it
+          being a special display manager when it's actually LightDM.
+          Please use the
+          <literal>services.xserver.displayManager.lightdm.autoLogin</literal>
+          options instead, or any other display manager in NixOS as they
+          all support auto-login. If you used this module specifically
+          because it permitted root auto-login you can override the
+          lightdm-autologin pam module like:
+        </para>
+        <programlisting language="bash">
+{
+  security.pam.services.lightdm-autologin.text = lib.mkForce ''
+      auth     requisite pam_nologin.so
+      auth     required  pam_succeed_if.so quiet
+      auth     required  pam_permit.so
+
+      account  include   lightdm
+
+      password include   lightdm
+
+      session  include   lightdm
+  '';
+}
+</programlisting>
+        <para>
+          The difference is the:
+        </para>
+        <programlisting>
+auth required pam_succeed_if.so quiet
+</programlisting>
+        <para>
+          line, where default it's:
+        </para>
+        <programlisting>
+ auth required pam_succeed_if.so uid &gt;= 1000 quiet
+</programlisting>
+        <para>
+          not permitting users with uid's below 1000 (like root). All
+          other display managers in NixOS are configured like this.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          There have been lots of improvements to the Mailman module. As
+          a result,
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              The <literal>services.mailman.hyperkittyBaseUrl</literal>
+              option has been renamed to
+              <link xlink:href="options.html#opt-services.mailman.hyperkitty.baseUrl">services.mailman.hyperkitty.baseUrl</link>.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              The <literal>services.mailman.hyperkittyApiKey</literal>
+              option has been removed. This is because having an option
+              for the Hyperkitty API key meant that the API key would be
+              stored in the world-readable Nix store, which was a
+              security vulnerability. A new Hyperkitty API key will be
+              generated the first time the new Hyperkitty service is
+              run, and it will then be persisted outside of the Nix
+              store. To continue using Hyperkitty, you must set
+              <link xlink:href="options.html#opt-services.mailman.hyperkitty.enable">services.mailman.hyperkitty.enable</link>
+              to <literal>true</literal>.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              Additionally, some Postfix configuration must now be set
+              manually instead of automatically by the Mailman module:
+            </para>
+            <programlisting language="bash">
+{
+  services.postfix.relayDomains = [ &quot;hash:/var/lib/mailman/data/postfix_domains&quot; ];
+  services.postfix.config.transport_maps = [ &quot;hash:/var/lib/mailman/data/postfix_lmtp&quot; ];
+  services.postfix.config.local_recipient_maps = [ &quot;hash:/var/lib/mailman/data/postfix_lmtp&quot; ];
+}
+</programlisting>
+            <para>
+              This is because some users may want to include other
+              values in these lists as well, and this was not possible
+              if they were set automatically by the Mailman module. It
+              would not have been possible to just concatenate values
+              from multiple modules each setting the values they needed,
+              because the order of elements in the list is significant.
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          The LLVM versions 3.5, 3.9 and 4 (including the corresponding
+          CLang versions) have been dropped.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The
+          <literal>networking.interfaces.*.preferTempAddress</literal>
+          option has been replaced by
+          <literal>networking.interfaces.*.tempAddress</literal>. The
+          new option allows better control of the IPv6 temporary
+          addresses, including completely disabling them for interfaces
+          where they are not needed.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Rspamd was updated to version 2.2. Read
+          <link xlink:href="https://rspamd.com/doc/migration.html#migration-to-rspamd-20">
+          the upstream migration notes</link> carefully. Please be
+          especially aware that some modules were removed and the
+          default Bayes backend is now Redis.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>*psu</literal> versions of oraclejdk8 have been
+          removed as they aren't provided by upstream anymore.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>services.dnscrypt-proxy</literal> module has been
+          removed as it used the deprecated version of dnscrypt-proxy.
+          We've added
+          <link xlink:href="options.html#opt-services.dnscrypt-proxy2.enable">services.dnscrypt-proxy2.enable</link>
+          to use the supported version. This module supports
+          configuration via the Nix attribute set
+          <link xlink:href="options.html#opt-services.dnscrypt-proxy2.settings">services.dnscrypt-proxy2.settings</link>,
+          or by passing a TOML configuration file via
+          <link xlink:href="options.html#opt-services.dnscrypt-proxy2.configFile">services.dnscrypt-proxy2.configFile</link>.
+        </para>
+        <programlisting language="bash">
+{
+  # Example configuration:
+  services.dnscrypt-proxy2.enable = true;
+  services.dnscrypt-proxy2.settings = {
+    listen_addresses = [ &quot;127.0.0.1:43&quot; ];
+    sources.public-resolvers = {
+      urls = [ &quot;https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md&quot; ];
+      cache_file = &quot;public-resolvers.md&quot;;
+      minisign_key = &quot;RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3&quot;;
+      refresh_delay = 72;
+    };
+  };
+
+  services.dnsmasq.enable = true;
+  services.dnsmasq.servers = [ &quot;127.0.0.1#43&quot; ];
+}
+</programlisting>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>qesteidutil</literal> has been deprecated in favor of
+          <literal>qdigidoc</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          sqldeveloper_18 has been removed as it's not maintained
+          anymore, sqldeveloper has been updated to version
+          <literal>19.4</literal>. Please note that this means that this
+          means that the oraclejdk is now required. For further
+          information please read the
+          <link xlink:href="https://www.oracle.com/technetwork/developer-tools/sql-developer/downloads/sqldev-relnotes-194-5908846.html">release
+          notes</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Haskell <literal>env</literal> and <literal>shellFor</literal>
+          dev shell environments now organize dependencies the same way
+          as regular builds. In particular, rather than receiving all
+          the different lists of dependencies mashed together as one big
+          list, and then partitioning into Haskell and non-Hakell
+          dependencies, they work from the original many different
+          dependency parameters and don't need to algorithmically
+          partition anything.
+        </para>
+        <para>
+          This means that if you incorrectly categorize a dependency,
+          e.g. non-Haskell library dependency as a
+          <literal>buildDepends</literal> or run-time Haskell dependency
+          as a <literal>setupDepends</literal>, whereas things would
+          have worked before they may not work now.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The gcc-snapshot-package has been removed. It's marked as
+          broken for &gt;2 years and used to point to a fairly old
+          snapshot from the gcc7-branch.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The nixos-build-vms8 -script now uses the python test-driver.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The riot-web package now accepts configuration overrides as an
+          attribute set instead of a string. A formerly used JSON
+          configuration can be converted to an attribute set with
+          <literal>builtins.fromJSON</literal>.
+        </para>
+        <para>
+          The new default configuration also disables automatic guest
+          account registration and analytics to improve privacy. The
+          previous behavior can be restored by setting
+          <literal>config.riot-web.conf = { disable_guests = false; piwik = true; }</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Stand-alone usage of <literal>Upower</literal> now requires
+          <literal>services.upower.enable</literal> instead of just
+          installing into
+          <link xlink:href="options.html#opt-environment.systemPackages">environment.systemPackages</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          nextcloud has been updated to <literal>v18.0.2</literal>. This
+          means that users from NixOS 19.09 can't upgrade directly since
+          you can only move one version forward and 19.09 uses
+          <literal>v16.0.8</literal>.
+        </para>
+        <para>
+          To provide a safe upgrade-path and to circumvent similar
+          issues in the future, the following measures were taken:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              The pkgs.nextcloud-attribute has been removed and replaced
+              with versioned attributes (currently pkgs.nextcloud17 and
+              pkgs.nextcloud18). With this change major-releases can be
+              backported without breaking stuff and to make
+              upgrade-paths easier.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              Existing setups will be detected using
+              <link xlink:href="options.html#opt-system.stateVersion">system.stateVersion</link>:
+              by default, nextcloud17 will be used, but will raise a
+              warning which notes that after that deploy it's
+              recommended to update to the latest stable version
+              (nextcloud18) by declaring the newly introduced setting
+              <link xlink:href="options.html#opt-services.nextcloud.package">services.nextcloud.package</link>.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              Users with an overlay (e.g. to use nextcloud at version
+              <literal>v18</literal> on <literal>19.09</literal>) will
+              get an evaluation error by default. This is done to ensure
+              that our
+              <link xlink:href="options.html#opt-services.nextcloud.package">package</link>-option
+              doesn't select an older version by accident. It's
+              recommended to use pkgs.nextcloud18 or to set
+              <link xlink:href="options.html#opt-services.nextcloud.package">package</link>
+              to pkgs.nextcloud explicitly.
+            </para>
+          </listitem>
+        </itemizedlist>
+        <warning>
+          <para>
+            Please note that if you're coming from
+            <literal>19.03</literal> or older, you have to manually
+            upgrade to <literal>19.09</literal> first to upgrade your
+            server to Nextcloud v16.
+          </para>
+        </warning>
+      </listitem>
+      <listitem>
+        <para>
+          Hydra has gained a massive performance improvement due to
+          <link xlink:href="https://github.com/NixOS/hydra/pull/710">some
+          database schema changes</link> by adding several IDs and
+          better indexing. However, it's necessary to upgrade Hydra in
+          multiple steps:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              At first, an older version of Hydra needs to be deployed
+              which adds those (nullable) columns. When having set
+              <link xlink:href="options.html#opt-system.stateVersion">stateVersion
+              </link> to a value older than <literal>20.03</literal>,
+              this package will be selected by default from the module
+              when upgrading. Otherwise, the package can be deployed
+              using the following config:
+            </para>
+            <programlisting language="bash">
+{ pkgs, ... }: {
+  services.hydra.package = pkgs.hydra-migration;
+}
+</programlisting>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          Automatically fill the newly added ID columns on the server by
+          running the following command:
+        </para>
+        <programlisting>
+$ hydra-backfill-ids
+</programlisting>
+        <warning>
+          <para>
+            Please note that this process can take a while depending on
+            your database-size!
+          </para>
+        </warning>
+      </listitem>
+      <listitem>
+        <para>
+          Deploy a newer version of Hydra to activate the DB
+          optimizations. This can be done by using hydra-unstable. This
+          package already includes
+          <link xlink:href="https://github.com/nixos/rfcs/pull/49">flake-support</link>
+          and is therefore compiled against pkgs.nixFlakes.
+        </para>
+        <warning>
+          <para>
+            If your
+            <link xlink:href="options.html#opt-system.stateVersion">stateVersion</link>
+            is set to <literal>20.03</literal> or greater,
+            hydra-unstable will be used automatically! This will break
+            your setup if you didn't run the migration.
+          </para>
+        </warning>
+        <para>
+          Please note that Hydra is currently not available with
+          nixStable as this doesn't compile anymore.
+        </para>
+        <warning>
+          <para>
+            pkgs.hydra has been removed to ensure a graceful
+            database-migration using the dedicated package-attributes.
+            If you still have pkgs.hydra defined in e.g. an overlay, an
+            assertion error will be thrown. To circumvent this, you need
+            to set
+            <link xlink:href="options.html#opt-services.hydra.package">services.hydra.package</link>
+            to pkgs.hydra explicitly and make sure you know what you're
+            doing!
+          </para>
+        </warning>
+      </listitem>
+      <listitem>
+        <para>
+          The TokuDB storage engine will be disabled in mariadb 10.5. It
+          is recommended to switch to RocksDB. See also
+          <link xlink:href="https://mariadb.com/kb/en/tokudb/">TokuDB</link>.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-20.03-notable-changes">
+    <title>Other Notable Changes</title>
+    <itemizedlist>
+      <listitem>
+        <para>
+          SD images are now compressed by default using
+          <literal>bzip2</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The nginx web server previously started its master process as
+          root privileged, then ran worker processes as a less
+          privileged identity user (the <literal>nginx</literal> user).
+          This was changed to start all of nginx as a less privileged
+          user (defined by <literal>services.nginx.user</literal> and
+          <literal>services.nginx.group</literal>). As a consequence,
+          all files that are needed for nginx to run (included
+          configuration fragments, SSL certificates and keys, etc.) must
+          now be readable by this less privileged user/group.
+        </para>
+        <para>
+          To continue to use the old approach, you can configure:
+        </para>
+        <programlisting language="bash">
+{
+  services.nginx.appendConfig = let cfg = config.services.nginx; in ''user ${cfg.user} ${cfg.group};'';
+  systemd.services.nginx.serviceConfig.User = lib.mkForce &quot;root&quot;;
+}
+</programlisting>
+      </listitem>
+      <listitem>
+        <para>
+          OpenSSH has been upgraded from 7.9 to 8.1, improving security
+          and adding features but with potential incompatibilities.
+          Consult the
+          <link xlink:href="https://www.openssh.com/txt/release-8.1">
+          release announcement</link> for more information.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>PRETTY_NAME</literal> in
+          <literal>/etc/os-release</literal> now uses the short rather
+          than full version string.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The ACME module has switched from simp-le to
+          <link xlink:href="https://github.com/go-acme/lego">lego</link>
+          which allows us to support DNS-01 challenges and wildcard
+          certificates. The following options have been added:
+          <link xlink:href="options.html#opt-security.acme.acceptTerms">security.acme.acceptTerms</link>,
+          <link xlink:href="options.html#opt-security.acme.certs">security.acme.certs.&lt;name&gt;.dnsProvider</link>,
+          <link xlink:href="options.html#opt-security.acme.certs">security.acme.certs.&lt;name&gt;.credentialsFile</link>,
+          <link xlink:href="options.html#opt-security.acme.certs">security.acme.certs.&lt;name&gt;.dnsPropagationCheck</link>.
+          As well as this, the options
+          <literal>security.acme.acceptTerms</literal> and either
+          <literal>security.acme.email</literal> or
+          <literal>security.acme.certs.&lt;name&gt;.email</literal> must
+          be set in order to use the ACME module. Certificates will be
+          regenerated on activation, no account or certificate will be
+          migrated from simp-le. In particular private keys will not be
+          preserved. However, the credentials for simp-le are preserved
+          and thus it is possible to roll back to previous versions
+          without breaking certificate generation. Note also that in
+          contrary to simp-le a new private key is recreated at each
+          renewal by default, which can have consequences if you embed
+          your public key in apps.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          It is now possible to unlock LUKS-Encrypted file systems using
+          a FIDO2 token via
+          <literal>boot.initrd.luks.fido2Support</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Predictably named network interfaces get renamed in stage-1.
+          This means that it is possible to use the proper interface
+          name for e.g. Dropbear setups.
+        </para>
+        <para>
+          For further reference, please read
+          <link xlink:href="https://github.com/NixOS/nixpkgs/pull/68953">#68953</link>
+          or the corresponding
+          <link xlink:href="https://discourse.nixos.org/t/predictable-network-interface-names-in-initrd/4055">discourse
+          thread</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The matrix-synapse-package has been updated to
+          <link xlink:href="https://github.com/matrix-org/synapse/releases/tag/v1.11.1">v1.11.1</link>.
+          Due to
+          <link xlink:href="https://github.com/matrix-org/synapse/releases/tag/v1.10.0rc1">stricter
+          requirements</link> for database configuration when using
+          postgresql, the automated database setup of the module has
+          been removed to avoid any further edge-cases.
+        </para>
+        <para>
+          matrix-synapse expects <literal>postgresql</literal>-databases
+          to have the options <literal>LC_COLLATE</literal> and
+          <literal>LC_CTYPE</literal> set to
+          <link xlink:href="https://www.postgresql.org/docs/12/locale.html"><literal>'C'</literal></link>
+          which basically instructs <literal>postgresql</literal> to
+          ignore any locale-based preferences.
+        </para>
+        <para>
+          Depending on your setup, you need to incorporate one of the
+          following changes in your setup to upgrade to 20.03:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              If you use <literal>sqlite3</literal> you don't need to do
+              anything.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              If you use <literal>postgresql</literal> on a different
+              server, you don't need to change anything as well since
+              this module was never designed to configure remote
+              databases.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              If you use <literal>postgresql</literal> and configured
+              your synapse initially on <literal>19.09</literal> or
+              older, you simply need to enable postgresql-support
+              explicitly:
+            </para>
+            <programlisting language="bash">
+{ ... }: {
+  services.matrix-synapse = {
+    enable = true;
+    /* and all the other config you've defined here */
+  };
+  services.postgresql.enable = true;
+}
+</programlisting>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          If you deploy a fresh matrix-synapse, you need to configure
+          the database yourself (e.g. by using the
+          <link xlink:href="options.html#opt-services.postgresql.initialScript">services.postgresql.initialScript</link>
+          option). An example for this can be found in the
+          <link linkend="module-services-matrix">documentation of the
+          Matrix module</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          If you initially deployed your matrix-synapse on
+          <literal>nixos-unstable</literal> <emphasis>after</emphasis>
+          the <literal>19.09</literal>-release, your database is
+          misconfigured due to a regression in NixOS. For now,
+          matrix-synapse will startup with a warning, but it's
+          recommended to reconfigure the database to set the values
+          <literal>LC_COLLATE</literal> and <literal>LC_CTYPE</literal>
+          to
+          <link xlink:href="https://www.postgresql.org/docs/12/locale.html"><literal>'C'</literal></link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The
+          <link xlink:href="options.html#opt-systemd.network.links">systemd.network.links</link>
+          option is now respected even when
+          <link xlink:href="options.html#opt-systemd.network.enable">systemd-networkd</link>
+          is disabled. This mirrors the behaviour of systemd - It's udev
+          that parses <literal>.link</literal> files, not
+          <literal>systemd-networkd</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          mongodb has been updated to version <literal>3.4.24</literal>.
+        </para>
+        <warning>
+          <para>
+            Please note that mongodb has been relicensed under their own
+            <link xlink:href="https://www.mongodb.com/licensing/server-side-public-license/faq"><literal> sspl</literal></link>-license.
+            Since it's not entirely free and not OSI-approved, it's
+            listed as non-free. This means that Hydra doesn't provide
+            prebuilt mongodb-packages and needs to be built locally.
+          </para>
+        </warning>
+      </listitem>
+    </itemizedlist>
+  </section>
+</section>
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2009.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2009.section.xml
new file mode 100644
index 000000000000..c74d850b2c62
--- /dev/null
+++ b/nixos/doc/manual/from_md/release-notes/rl-2009.section.xml
@@ -0,0 +1,2206 @@
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-release-20.09">
+  <title>Release 20.09 (<quote>Nightingale</quote>, 2020.10/27)</title>
+  <para>
+    Support is planned until the end of June 2021, handing over to
+    21.05. (Plans
+    <link xlink:href="https://github.com/NixOS/rfcs/blob/master/rfcs/0080-nixos-release-schedule.md#core-changes">
+    have shifted</link> by two months since release of 20.09.)
+  </para>
+  <section xml:id="sec-release-20.09-highlights">
+    <title>Highlights</title>
+    <para>
+      In addition to 7349 new, 14442 updated, and 8181 removed packages,
+      this release has the following highlights:
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          Core version changes:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              gcc: 9.2.0 -&gt; 9.3.0
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              glibc: 2.30 -&gt; 2.31
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              linux: still defaults to 5.4.x, all supported kernels
+              available
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              mesa: 19.3.5 -&gt; 20.1.7
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          Desktop Environments:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              plasma5: 5.17.5 -&gt; 5.18.5
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              kdeApplications: 19.12.3 -&gt; 20.08.1
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              gnome3: 3.34 -&gt; 3.36, see its
+              <link xlink:href="https://help.gnome.org/misc/release-notes/3.36/">release
+              notes</link>
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              cinnamon: added at 4.6
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              NixOS now distributes an official
+              <link xlink:href="https://nixos.org/download.html#nixos-iso">GNOME
+              ISO</link>
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          Programming Languages and Frameworks:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              Agda ecosystem was heavily reworked (see more details
+              below)
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              PHP now defaults to PHP 7.4, updated from 7.3
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              PHP 7.2 is no longer supported due to upstream not
+              supporting this version for the entire lifecycle of the
+              20.09 release
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              Python 3 now defaults to Python 3.8 instead of 3.7
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              Python 3.5 reached its upstream EOL at the end of
+              September 2020: it has been removed from the list of
+              available packages
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          Databases and Service Monitoring:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              MariaDB has been updated to 10.4, MariaDB Galera to 26.4.
+              Please read the related upgrade instructions under
+              <link linkend="sec-release-20.09-incompatibilities">backwards
+              incompatibilities</link> before upgrading.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              Zabbix now defaults to 5.0, updated from 4.4. Please read
+              related sections under
+              <link linkend="sec-release-20.09-incompatibilities">backwards
+              compatibilities</link> before upgrading.
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          Major module changes:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              Quickly configure a complete, private, self-hosted video
+              conferencing solution with the new Jitsi Meet module.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              Two new options,
+              <link xlink:href="options.html#opt-services.openssh.authorizedKeysCommand">authorizedKeysCommand</link>
+              and
+              <link xlink:href="options.html#opt-services.openssh.authorizedKeysCommandUser">authorizedKeysCommandUser</link>,
+              have been added to the <literal>openssh</literal> module.
+              If you have <literal>AuthorizedKeysCommand</literal> in
+              your
+              <link xlink:href="options.html#opt-services.openssh.extraConfig">services.openssh.extraConfig</link>
+              you should make use of these new options instead.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              There is a new module for Podman
+              (<literal>virtualisation.podman</literal>), a drop-in
+              replacement for the Docker command line.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              The new <literal>virtualisation.containers</literal>
+              module manages configuration shared by the CRI-O and
+              Podman modules.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              Declarative Docker containers are renamed from
+              <literal>docker-containers</literal> to
+              <literal>virtualisation.oci-containers.containers</literal>.
+              This is to make it possible to use
+              <literal>podman</literal> instead of
+              <literal>docker</literal>.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              The new option
+              <link xlink:href="options.html#opt-documentation.man.generateCaches">documentation.man.generateCaches</link>
+              has been added to automatically generate the
+              <literal>man-db</literal> caches, which are needed by
+              utilities like <literal>whatis</literal> and
+              <literal>apropos</literal>. The caches are generated
+              during the build of the NixOS configuration: since this
+              can be expensive when a large number of packages are
+              installed, the feature is disabled by default.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>services.postfix.sslCACert</literal> was replaced
+              by
+              <literal>services.postfix.tlsTrustedAuthorities</literal>
+              which now defaults to system certificate authorities.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              The various documented workarounds to use steam have been
+              converted to a module.
+              <literal>programs.steam.enable</literal> enables steam,
+              controller support and the workarounds.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              Support for built-in LCDs in various pieces of Logitech
+              hardware (keyboards and USB speakers).
+              <literal>hardware.logitech.lcd.enable</literal> enables
+              support for all hardware supported by the
+              <link xlink:href="https://sourceforge.net/projects/g15daemon/">g15daemon
+              project</link>.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              The GRUB module gained support for basic password
+              protection, which allows to restrict non-default entries
+              in the boot menu to one or more users. The users and
+              passwords are defined via the option
+              <literal>boot.loader.grub.users</literal>. Note: Password
+              support is only available in GRUB version 2.
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          NixOS module changes:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              The NixOS module system now supports freeform modules as a
+              mix between <literal>types.attrsOf</literal> and
+              <literal>types.submodule</literal>. These allow you to
+              explicitly declare a subset of options while still
+              permitting definitions without an associated option. See
+              <xref linkend="sec-freeform-modules" /> for how to use
+              them.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              Following its deprecation in 20.03, the Perl NixOS test
+              driver has been removed. All remaining tests have been
+              ported to the Python test framework. Code outside nixpkgs
+              using <literal>make-test.nix</literal> or
+              <literal>testing.nix</literal> needs to be ported to
+              <literal>make-test-python.nix</literal> and
+              <literal>testing-python.nix</literal> respectively.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              Subordinate GID and UID mappings are now set up
+              automatically for all normal users. This will make
+              container tools like Podman work as non-root users out of
+              the box.
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          Starting with this release, the hydra-build-result
+          <literal>nixos-YY.MM</literal> branches no longer exist in the
+          <link xlink:href="https://github.com/nixos/nixpkgs-channels">deprecated
+          nixpkgs-channels repository</link>. These branches are now in
+          <link xlink:href="https://github.com/nixos/nixpkgs">the main
+          nixpkgs repository</link>.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-20.09-new-services">
+    <title>New Services</title>
+    <para>
+      In addition to 1119 new, 118 updated, and 476 removed options; 61
+      new modules were added since the last release:
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          Hardware:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-hardware.system76.firmware-daemon.enable">hardware.system76.firmware-daemon.enable</link>
+              adds easy support of system76 firmware
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-hardware.uinput.enable">hardware.uinput.enable</link>
+              loads uinput kernel module
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-hardware.video.hidpi.enable">hardware.video.hidpi.enable</link>
+              enable good defaults for HiDPI displays
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-hardware.wooting.enable">hardware.wooting.enable</link>
+              support for Wooting keyboards
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-hardware.xpadneo.enable">hardware.xpadneo.enable</link>
+              xpadneo driver for Xbox One wireless controllers
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          Programs:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-programs.hamster.enable">programs.hamster.enable</link>
+              enable hamster time tracking
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-programs.steam.enable">programs.steam.enable</link>
+              adds easy enablement of steam and related system
+              configuration
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          Security:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-security.doas.enable">security.doas.enable</link>
+              alternative to sudo, allows non-root users to execute
+              commands as root
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-security.tpm2.enable">security.tpm2.enable</link>
+              add Trusted Platform Module 2 support
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          System:
+        </para>
+        <itemizedlist spacing="compact">
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-boot.initrd.network.openvpn.enable">boot.initrd.network.openvpn.enable</link>
+              start an OpenVPN client during initrd boot
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          Virtualization:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-boot.enableContainers">boot.enableContainers</link>
+              use nixos-containers
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-virtualisation.oci-containers.containers">virtualisation.oci-containers.containers</link>
+              run OCI (Docker) containers
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-virtualisation.podman.enable">virtualisation.podman.enable</link>
+              daemonless container engine
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          Services:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.ankisyncd.enable">services.ankisyncd.enable</link>
+              Anki sync server
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.bazarr.enable">services.bazarr.enable</link>
+              Subtitle manager for Sonarr and Radarr
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.biboumi.enable">services.biboumi.enable</link>
+              Biboumi XMPP gateway to IRC
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.blockbook-frontend">services.blockbook-frontend</link>
+              Blockbook-frontend, a service for the Trezor wallet
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.cage.enable">services.cage.enable</link>
+              Wayland cage service
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.convos.enable">services.convos.enable</link>
+              IRC daemon, which can be accessed throught the browser
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.engelsystem.enable">services.engelsystem.enable</link>
+              Tool for coordinating volunteers and shifts on large
+              events
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.espanso.enable">services.espanso.enable</link>
+              text-expander written in rust
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.foldingathome.enable">services.foldingathome.enable</link>
+              Folding@home client
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.gerrit.enable">services.gerrit.enable</link>
+              Web-based team code collaboration tool
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.go-neb.enable">services.go-neb.enable</link>
+              Matrix bot
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.hardware.xow.enable">services.hardware.xow.enable</link>
+              xow as a systemd service
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.hercules-ci-agent.enable">services.hercules-ci-agent.enable</link>
+              Hercules CI build agent
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.jicofo.enable">services.jicofo.enable</link>
+              Jitsi Conference Focus, component of Jitsi Meet
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.jirafeau.enable">services.jirafeau.enable</link>
+              A web file repository
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.jitsi-meet.enable">services.jitsi-meet.enable</link>
+              Secure, simple and scalable video conferences
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.jitsi-videobridge.enable">services.jitsi-videobridge.enable</link>
+              Jitsi Videobridge, a WebRTC compatible router
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.jupyterhub.enable">services.jupyterhub.enable</link>
+              Jupyterhub development server
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.k3s.enable">services.k3s.enable</link>
+              Lightweight Kubernetes distribution
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.magic-wormhole-mailbox-server.enable">services.magic-wormhole-mailbox-server.enable</link>
+              Magic Wormhole Mailbox Server
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.malcontent.enable">services.malcontent.enable</link>
+              Parental Control support
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.matrix-appservice-discord.enable">services.matrix-appservice-discord.enable</link>
+              Matrix and Discord bridge
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.mautrix-telegram.enable">services.mautrix-telegram.enable</link>
+              Matrix-Telegram puppeting/relaybot bridge
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.mirakurun.enable">services.mirakurun.enable</link>
+              Japanese DTV Tuner Server Service
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.molly-brown.enable">services.molly-brown.enable</link>
+              Molly-Brown Gemini server
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.mullvad-vpn.enable">services.mullvad-vpn.enable</link>
+              Mullvad VPN daemon
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.ncdns.enable">services.ncdns.enable</link>
+              Namecoin to DNS bridge
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.nextdns.enable">services.nextdns.enable</link>
+              NextDNS to DoH Proxy service
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.nix-store-gcs-proxy">services.nix-store-gcs-proxy</link>
+              Google storage bucket to be used as a nix store
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.onedrive.enable">services.onedrive.enable</link>
+              OneDrive sync service
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.pinnwand.enable">services.pinnwand.enable</link>
+              Pastebin-like service
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.pixiecore.enable">services.pixiecore.enable</link>
+              Manage network booting of machines
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.privacyidea.enable">services.privacyidea.enable</link>
+              Privacy authentication server
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.quorum.enable">services.quorum.enable</link>
+              Quorum blockchain daemon
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.robustirc-bridge.enable">services.robustirc-bridge.enable</link>
+              RobustIRC bridge
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.rss-bridge.enable">services.rss-bridge.enable</link>
+              Generate RSS and Atom feeds
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.rtorrent.enable">services.rtorrent.enable</link>
+              rTorrent service
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.smartdns.enable">services.smartdns.enable</link>
+              SmartDNS DNS server
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.sogo.enable">services.sogo.enable</link>
+              SOGo groupware
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.teeworlds.enable">services.teeworlds.enable</link>
+              Teeworlds game server
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.torque.mom.enable">services.torque.mom.enable</link>
+              torque computing node
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.torque.server.enable">services.torque.server.enable</link>
+              torque server
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.tuptime.enable">services.tuptime.enable</link>
+              A total uptime service
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.urserver.enable">services.urserver.enable</link>
+              X11 remote server
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.wasabibackend.enable">services.wasabibackend.enable</link>
+              Wasabi backend service
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.yubikey-agent.enable">services.yubikey-agent.enable</link>
+              Yubikey agent
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-services.zigbee2mqtt.enable">services.zigbee2mqtt.enable</link>
+              Zigbee to MQTT bridge
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-20.09-incompatibilities">
+    <title>Backward Incompatibilities</title>
+    <para>
+      When upgrading from a previous release, please be aware of the
+      following incompatible changes:
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          MariaDB has been updated to 10.4, MariaDB Galera to 26.4.
+          Before you upgrade, it would be best to take a backup of your
+          database. For MariaDB Galera Cluster, see
+          <link xlink:href="https://mariadb.com/kb/en/upgrading-from-mariadb-103-to-mariadb-104-with-galera-cluster/">Upgrading
+          from MariaDB 10.3 to MariaDB 10.4 with Galera Cluster</link>
+          instead. Before doing the upgrade read
+          <link xlink:href="https://mariadb.com/kb/en/upgrading-from-mariadb-103-to-mariadb-104/#incompatible-changes-between-103-and-104">Incompatible
+          Changes Between 10.3 and 10.4</link>. After the upgrade you
+          will need to run <literal>mysql_upgrade</literal>. MariaDB
+          10.4 introduces a number of changes to the authentication
+          process, intended to make things easier and more intuitive.
+          See
+          <link xlink:href="https://mariadb.com/kb/en/authentication-from-mariadb-104/">Authentication
+          from MariaDB 10.4</link>. unix_socket auth plugin does not use
+          a password, and uses the connecting user's UID instead. When a
+          new MariaDB data directory is initialized, two MariaDB users
+          are created and can be used with new unix_socket auth plugin,
+          as well as traditional mysql_native_password plugin:
+          root@localhost and mysql@localhost. To actually use the
+          traditional mysql_native_password plugin method, one must run
+          the following:
+        </para>
+        <programlisting language="bash">
+{
+services.mysql.initialScript = pkgs.writeText &quot;mariadb-init.sql&quot; ''
+  ALTER USER root@localhost IDENTIFIED VIA mysql_native_password USING PASSWORD(&quot;verysecret&quot;);
+'';
+}
+</programlisting>
+        <para>
+          When MariaDB data directory is just upgraded (not
+          initialized), the users are not created or modified.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          MySQL server is now started with additional systemd
+          sandbox/hardening options for better security. The PrivateTmp,
+          ProtectHome, and ProtectSystem options may be problematic when
+          MySQL is attempting to read from or write to your filesystem
+          anywhere outside of its own state directory, for example when
+          calling
+          <literal>LOAD DATA INFILE or SELECT * INTO OUTFILE</literal>.
+          In this scenario a variant of the following may be required: -
+          allow MySQL to read from /home and /tmp directories when using
+          <literal>LOAD DATA INFILE</literal>
+        </para>
+        <programlisting language="bash">
+{
+  systemd.services.mysql.serviceConfig.ProtectHome = lib.mkForce &quot;read-only&quot;;
+}
+</programlisting>
+        <para>
+          - allow MySQL to write to custom folder
+          <literal>/var/data</literal> when using
+          <literal>SELECT * INTO OUTFILE</literal>, assuming the mysql
+          user has write access to <literal>/var/data</literal>
+        </para>
+        <programlisting language="bash">
+{
+  systemd.services.mysql.serviceConfig.ReadWritePaths = [ &quot;/var/data&quot; ];
+}
+</programlisting>
+        <para>
+          The MySQL service no longer runs its
+          <literal>systemd</literal> service startup script as
+          <literal>root</literal> anymore. A dedicated non
+          <literal>root</literal> super user account is required for
+          operation. This means users with an existing MySQL or MariaDB
+          database server are required to run the following SQL
+          statements as a super admin user before upgrading:
+        </para>
+        <programlisting language="SQL">
+CREATE USER IF NOT EXISTS 'mysql'@'localhost' identified with unix_socket;
+GRANT ALL PRIVILEGES ON *.* TO 'mysql'@'localhost' WITH GRANT OPTION;
+</programlisting>
+        <para>
+          If you use MySQL instead of MariaDB please replace
+          <literal>unix_socket</literal> with
+          <literal>auth_socket</literal>. If you have changed the value
+          of
+          <link xlink:href="options.html#opt-services.mysql.user">services.mysql.user</link>
+          from the default of <literal>mysql</literal> to a different
+          user please change <literal>'mysql'@'localhost'</literal> to
+          the corresponding user instead.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Zabbix now defaults to 5.0, updated from 4.4. Please carefully
+          read through
+          <link xlink:href="https://www.zabbix.com/documentation/current/manual/installation/upgrade/sources">the
+          upgrade guide</link> and apply any changes required. Be sure
+          to take special note of the section on
+          <link xlink:href="https://www.zabbix.com/documentation/current/manual/installation/upgrade_notes_500#enabling_extended_range_of_numeric_float_values">enabling
+          extended range of numeric (float) values</link> as you will
+          need to apply this database migration manually.
+        </para>
+        <para>
+          If you are using Zabbix Server with a MySQL or MariaDB
+          database you should note that using a character set of
+          <literal>utf8</literal> and a collate of
+          <literal>utf8_bin</literal> has become mandatory with this
+          release. See the upstream
+          <link xlink:href="https://support.zabbix.com/browse/ZBX-17357">issue</link>
+          for further discussion. Before upgrading you should check the
+          character set and collation used by your database and ensure
+          they are correct:
+        </para>
+        <programlisting language="SQL">
+SELECT
+  default_character_set_name,
+  default_collation_name
+FROM
+  information_schema.schemata
+WHERE
+  schema_name = 'zabbix';
+</programlisting>
+        <para>
+          If these values are not correct you should take a backup of
+          your database and convert the character set and collation as
+          required. Here is an
+          <link xlink:href="https://www.zabbix.com/forum/zabbix-help/396573-reinstall-after-upgrade?p=396891#post396891">example</link>
+          of how to do so, taken from the Zabbix forums:
+        </para>
+        <programlisting language="SQL">
+ALTER DATABASE `zabbix` DEFAULT CHARACTER SET utf8 COLLATE utf8_bin;
+
+-- the following will produce a list of SQL commands you should subsequently execute
+SELECT CONCAT(&quot;ALTER TABLE &quot;, TABLE_NAME,&quot; CONVERT TO CHARACTER SET utf8 COLLATE utf8_bin;&quot;) AS ExecuteTheString
+FROM information_schema.`COLUMNS`
+WHERE table_schema = &quot;zabbix&quot; AND COLLATION_NAME = &quot;utf8_general_ci&quot;;
+</programlisting>
+      </listitem>
+      <listitem>
+        <para>
+          maxx package removed along with
+          <literal>services.xserver.desktopManager.maxx</literal>
+          module. Please migrate to cdesktopenv and
+          <literal>services.xserver.desktopManager.cde</literal> module.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The
+          <link xlink:href="options.html#opt-services.matrix-synapse.enable">matrix-synapse</link>
+          module no longer includes optional dependencies by default,
+          they have to be added through the
+          <link xlink:href="options.html#opt-services.matrix-synapse.plugins">plugins</link>
+          option.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>buildGoModule</literal> now internally creates a
+          vendor directory in the source tree for downloaded modules
+          instead of using go's
+          <link xlink:href="https://golang.org/cmd/go/#hdr-Module_proxy_protocol">module
+          proxy protocol</link>. This storage format is simpler and
+          therefore less likely to break with future versions of go. As
+          a result <literal>buildGoModule</literal> switched from
+          <literal>modSha256</literal> to the
+          <literal>vendorSha256</literal> attribute to pin fetched
+          version data.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Grafana is now built without support for phantomjs by default.
+          Phantomjs support has been
+          <link xlink:href="https://grafana.com/docs/grafana/latest/guides/whats-new-in-v6-4/">deprecated
+          in Grafana</link> and the phantomjs project is
+          <link xlink:href="https://github.com/ariya/phantomjs/issues/15344#issue-302015362">currently
+          unmaintained</link>. It can still be enabled by providing
+          <literal>phantomJsSupport = true</literal> to the package
+          instantiation:
+        </para>
+        <programlisting language="bash">
+{
+  services.grafana.package = pkgs.grafana.overrideAttrs (oldAttrs: rec {
+    phantomJsSupport = true;
+  });
+}
+</programlisting>
+      </listitem>
+      <listitem>
+        <para>
+          The
+          <link xlink:href="options.html#opt-services.supybot.enable">supybot</link>
+          module now uses <literal>/var/lib/supybot</literal> as its
+          default
+          <link xlink:href="options.html#opt-services.supybot.stateDir">stateDir</link>
+          path if <literal>stateVersion</literal> is 20.09 or higher. It
+          also enables a number of
+          <link xlink:href="https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Sandboxing">systemd
+          sandboxing options</link> which may possibly interfere with
+          some plugins. If this is the case you can disable the options
+          through attributes in
+          <literal>systemd.services.supybot.serviceConfig</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>security.duosec.skey</literal> option, which
+          stored a secret in the nix store, has been replaced by a new
+          <link xlink:href="options.html#opt-security.duosec.secretKeyFile">security.duosec.secretKeyFile</link>
+          option for better security.
+        </para>
+        <para>
+          <literal>security.duosec.ikey</literal> has been renamed to
+          <link xlink:href="options.html#opt-security.duosec.integrationKey">security.duosec.integrationKey</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>vmware</literal> has been removed from the
+          <literal>services.x11.videoDrivers</literal> defaults. For
+          VMWare guests set
+          <literal>virtualisation.vmware.guest.enable</literal> to
+          <literal>true</literal> which will include the appropriate
+          drivers.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The initrd SSH support now uses OpenSSH rather than Dropbear
+          to allow the use of Ed25519 keys and other OpenSSH-specific
+          functionality. Host keys must now be in the OpenSSH format,
+          and at least one pre-generated key must be specified.
+        </para>
+        <para>
+          If you used the
+          <literal>boot.initrd.network.ssh.host*Key</literal> options,
+          you'll get an error explaining how to convert your host keys
+          and migrate to the new
+          <literal>boot.initrd.network.ssh.hostKeys</literal> option.
+          Otherwise, if you don't have any host keys set, you'll need to
+          generate some; see the <literal>hostKeys</literal> option
+          documentation for instructions.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Since this release there's an easy way to customize your PHP
+          install to get a much smaller base PHP with only wanted
+          extensions enabled. See the following snippet installing a
+          smaller PHP with the extensions <literal>imagick</literal>,
+          <literal>opcache</literal>, <literal>pdo</literal> and
+          <literal>pdo_mysql</literal> loaded:
+        </para>
+        <programlisting language="bash">
+{
+  environment.systemPackages = [
+    (pkgs.php.withExtensions
+      ({ all, ... }: with all; [
+        imagick
+        opcache
+        pdo
+        pdo_mysql
+      ])
+    )
+  ];
+}
+</programlisting>
+        <para>
+          The default <literal>php</literal> attribute hasn't lost any
+          extensions. The <literal>opcache</literal> extension has been
+          added. All upstream PHP extensions are available under
+          php.extensions.&lt;name?&gt;.
+        </para>
+        <para>
+          All PHP <literal>config</literal> flags have been removed for
+          the following reasons:
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The updated <literal>php</literal> attribute is now easily
+          customizable to your liking by using
+          <literal>php.withExtensions</literal> or
+          <literal>php.buildEnv</literal> instead of writing config
+          files or changing configure flags.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The remaining configuration flags can now be set directly on
+          the <literal>php</literal> attribute. For example, instead of
+        </para>
+        <programlisting language="bash">
+{
+  php.override {
+    config.php.embed = true;
+    config.php.apxs2 = false;
+  }
+}
+</programlisting>
+        <para>
+          you should now write
+        </para>
+        <programlisting language="bash">
+{
+  php.override {
+    embedSupport = true;
+    apxs2Support = false;
+  }
+}
+</programlisting>
+      </listitem>
+      <listitem>
+        <para>
+          The ACME module has been overhauled for simplicity and
+          maintainability. Cert generation now implicitly uses the
+          <literal>acme</literal> user, and the
+          <literal>security.acme.certs._name_.user</literal> option has
+          been removed. Instead, certificate access from other services
+          is now managed through group permissions. The module no longer
+          runs lego twice under certain conditions, and will correctly
+          renew certificates if their configuration is changed. Services
+          which reload nginx and httpd after certificate renewal are now
+          properly configured too so you no longer have to do this
+          manually if you are using HTTPS enabled virtual hosts. A
+          mechanism for regenerating certs on demand has also been added
+          and documented.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Gollum received a major update to version 5.x and you may have
+          to change some links in your wiki when migrating from gollum
+          4.x. More information can be found
+          <link xlink:href="https://github.com/gollum/gollum/wiki/5.0-release-notes#migrating-your-wiki">here</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Deluge 2.x was added and is used as default for new NixOS
+          installations where stateVersion is &gt;= 20.09. If you are
+          upgrading from a previous NixOS version, you can set
+          <literal>service.deluge.package = pkgs.deluge-2_x</literal> to
+          upgrade to Deluge 2.x and migrate the state to the new format.
+          Be aware that backwards state migrations are not supported by
+          Deluge.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Nginx web server now starting with additional
+          sandbox/hardening options. By default, write access to
+          <literal>/var/log/nginx</literal> and
+          <literal>/var/cache/nginx</literal> is allowed. To allow
+          writing to other folders, use
+          <literal>systemd.services.nginx.serviceConfig.ReadWritePaths</literal>
+        </para>
+        <programlisting language="bash">
+{
+  systemd.services.nginx.serviceConfig.ReadWritePaths = [ &quot;/var/www&quot; ];
+}
+</programlisting>
+        <para>
+          Nginx is also started with the systemd option
+          <literal>ProtectHome = mkDefault true;</literal> which forbids
+          it to read anything from <literal>/home</literal>,
+          <literal>/root</literal> and <literal>/run/user</literal> (see
+          <link xlink:href="https://www.freedesktop.org/software/systemd/man/systemd.exec.html#ProtectHome=">ProtectHome
+          docs</link> for details). If you require serving files from
+          home directories, you may choose to set e.g.
+        </para>
+        <programlisting language="bash">
+{
+  systemd.services.nginx.serviceConfig.ProtectHome = &quot;read-only&quot;;
+}
+</programlisting>
+      </listitem>
+      <listitem>
+        <para>
+          The NixOS options <literal>nesting.clone</literal> and
+          <literal>nesting.children</literal> have been deleted, and
+          replaced with named
+          <link xlink:href="options.html#opt-specialisation">specialisation</link>
+          configurations.
+        </para>
+        <para>
+          Replace a <literal>nesting.clone</literal> entry with:
+        </para>
+        <programlisting language="bash">
+{
+  specialisation.example-sub-configuration = {
+    configuration = {
+      ...
+    };
+};
+</programlisting>
+        <para>
+          Replace a <literal>nesting.children</literal> entry with:
+        </para>
+        <programlisting language="bash">
+{
+  specialisation.example-sub-configuration = {
+    inheritParentConfig = false;
+    configuration = {
+      ...
+    };
+};
+</programlisting>
+        <para>
+          To switch to a specialised configuration at runtime you need
+          to run:
+        </para>
+        <programlisting>
+$ sudo /run/current-system/specialisation/example-sub-configuration/bin/switch-to-configuration test
+</programlisting>
+        <para>
+          Before you would have used:
+        </para>
+        <programlisting>
+$ sudo /run/current-system/fine-tune/child-1/bin/switch-to-configuration test
+</programlisting>
+      </listitem>
+      <listitem>
+        <para>
+          The Nginx log directory has been moved to
+          <literal>/var/log/nginx</literal>, the cache directory to
+          <literal>/var/cache/nginx</literal>. The option
+          <literal>services.nginx.stateDir</literal> has been removed.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The httpd web server previously started its main process as
+          root privileged, then ran worker processes as a less
+          privileged identity user. This was changed to start all of
+          httpd as a less privileged user (defined by
+          <link xlink:href="options.html#opt-services.httpd.user">services.httpd.user</link>
+          and
+          <link xlink:href="options.html#opt-services.httpd.group">services.httpd.group</link>).
+          As a consequence, all files that are needed for httpd to run
+          (included configuration fragments, SSL certificates and keys,
+          etc.) must now be readable by this less privileged user/group.
+        </para>
+        <para>
+          The default value for
+          <link xlink:href="options.html#opt-services.httpd.mpm">services.httpd.mpm</link>
+          has been changed from <literal>prefork</literal> to
+          <literal>event</literal>. Along with this change the default
+          value for
+          <link xlink:href="options.html#opt-services.httpd.virtualHosts">services.httpd.virtualHosts.&lt;name&gt;.http2</link>
+          has been set to <literal>true</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>systemd-networkd</literal> option
+          <literal>systemd.network.networks.&lt;name&gt;.dhcp.CriticalConnection</literal>
+          has been removed following upstream systemd's deprecation of
+          the same. It is recommended to use
+          <literal>systemd.network.networks.&lt;name&gt;.networkConfig.KeepConfiguration</literal>
+          instead. See systemd.network 5 for details.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>systemd-networkd</literal> option
+          <literal>systemd.network.networks._name_.dhcpConfig</literal>
+          has been renamed to
+          <link xlink:href="options.html#opt-systemd.network.networks._name_.dhcpV4Config">systemd.network.networks.<emphasis>name</emphasis>.dhcpV4Config</link>
+          following upstream systemd's documentation change. See
+          systemd.network 5 for details.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          In the <literal>picom</literal> module, several options that
+          accepted floating point numbers encoded as strings (for
+          example
+          <link xlink:href="options.html#opt-services.picom.activeOpacity">services.picom.activeOpacity</link>)
+          have been changed to the (relatively) new native
+          <literal>float</literal> type. To migrate your configuration
+          simply remove the quotes around the numbers.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          When using <literal>buildBazelPackage</literal> from Nixpkgs,
+          <literal>flat</literal> hash mode is now used for dependencies
+          instead of <literal>recursive</literal>. This is to better
+          allow using hashed mirrors where needed. As a result, these
+          hashes will have changed.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The syntax of the PostgreSQL configuration file is now checked
+          at build time. If your configuration includes a file
+          inaccessible inside the build sandbox, set
+          <literal>services.postgresql.checkConfig</literal> to
+          <literal>false</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The rkt module has been removed, it was archived by upstream.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The
+          <link xlink:href="https://bazaar.canonical.com">Bazaar</link>
+          VCS is unmaintained and, as consequence of the Python 2 EOL,
+          the packages <literal>bazaar</literal> and
+          <literal>bazaarTools</literal> were removed. Breezy, the
+          backward compatible fork of Bazaar (see the
+          <link xlink:href="https://www.jelmer.uk/breezy-intro.html">announcement</link>),
+          was packaged as <literal>breezy</literal> and can be used
+          instead.
+        </para>
+        <para>
+          Regarding Nixpkgs, <literal>fetchbzr</literal>,
+          <literal>nix-prefetch-bzr</literal> and Bazaar support in
+          Hydra will continue to work through Breezy.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          In addition to the hostname, the fully qualified domain name
+          (FQDN), which consists of
+          <literal>${networking.hostName}</literal> and
+          <literal>${networking.domain}</literal> is now added to
+          <literal>/etc/hosts</literal>, to allow local FQDN resolution,
+          as used by the <literal>hostname --fqdn</literal> command and
+          other applications that try to determine the FQDN. These new
+          entries take precedence over entries from the DNS which could
+          cause regressions in some very specific setups. Additionally
+          the hostname is now resolved to <literal>127.0.0.2</literal>
+          instead of <literal>127.0.1.1</literal> to be consistent with
+          what <literal>nss-myhostname</literal> (from systemd) returns.
+          The old behaviour can e.g. be restored by using
+          <literal>networking.hosts = lib.mkForce { &quot;127.0.1.1&quot; = [ config.networking.hostName ]; };</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The hostname (<literal>networking.hostName</literal>) must now
+          be a valid DNS label (see RFC 1035, RFC 1123) and as such must
+          not contain the domain part. This means that the hostname must
+          start with a letter or digit, end with a letter or digit, and
+          have as interior characters only letters, digits, and hyphen.
+          The maximum length is 63 characters. Additionally it is
+          recommended to only use lower-case characters. If (e.g. for
+          legacy reasons) a FQDN is required as the Linux kernel network
+          node hostname (<literal>uname --nodename</literal>) the option
+          <literal>boot.kernel.sysctl.&quot;kernel.hostname&quot;</literal>
+          can be used as a workaround (but be aware of the 64 character
+          limit).
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The GRUB specific option
+          <literal>boot.loader.grub.extraInitrd</literal> has been
+          replaced with the generic option
+          <literal>boot.initrd.secrets</literal>. This option creates a
+          secondary initrd from the specified files, rather than using a
+          manually created initrd file. Due to an existing bug with
+          <literal>boot.loader.grub.extraInitrd</literal>, it is not
+          possible to directly boot an older generation that used that
+          option. It is still possible to rollback to that generation if
+          the required initrd file has not been deleted.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The
+          <link xlink:href="https://github.com/okTurtles/dnschain">DNSChain</link>
+          package and NixOS module have been removed from Nixpkgs as the
+          software is unmaintained and can't be built. For more
+          information see issue
+          <link xlink:href="https://github.com/NixOS/nixpkgs/issues/89205">#89205</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          In the <literal>resilio</literal> module,
+          <link xlink:href="options.html#opt-services.resilio.httpListenAddr">services.resilio.httpListenAddr</link>
+          has been changed to listen to <literal>[::1]</literal> instead
+          of <literal>0.0.0.0</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>sslh</literal> has been updated to version
+          <literal>1.21</literal>. The <literal>ssl</literal> probe must
+          be renamed to <literal>tls</literal> in
+          <link xlink:href="options.html#opt-services.sslh.appendConfig">services.sslh.appendConfig</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Users of <link xlink:href="http://openafs.org">OpenAFS
+          1.6</link> must upgrade their services to OpenAFS 1.8! In this
+          release, the OpenAFS package version 1.6.24 is marked broken
+          but can be used during transition to OpenAFS 1.8.x. Use the
+          options
+          <literal>services.openafsClient.packages.module</literal>,
+          <literal>services.openafsClient.packages.programs</literal>
+          and <literal>services.openafsServer.package</literal> to
+          select a different OpenAFS package. OpenAFS 1.6 will be
+          removed in the next release. The package
+          <literal>openafs</literal> and the service options will then
+          silently point to the OpenAFS 1.8 release.
+        </para>
+        <para>
+          See also the OpenAFS
+          <link xlink:href="http://docs.openafs.org/AdminGuide/index.html">Administrator
+          Guide</link> for instructions. Beware of the following when
+          updating servers:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              The storage format of the server key has changed and the
+              key must be converted before running the new release.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              When updating multiple database servers, turn off the
+              database servers from the highest IP down to the lowest
+              with resting periods in between. Start up in reverse
+              order. Do not concurrently run database servers working
+              with different OpenAFS releases!
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              Update servers first, then clients.
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          Radicale's default package has changed from 2.x to 3.x. An
+          upgrade checklist can be found
+          <link xlink:href="https://github.com/Kozea/Radicale/blob/3.0.x/NEWS.md#upgrade-checklist">here</link>.
+          You can use the newer version in the NixOS service by setting
+          the <literal>package</literal> to
+          <literal>radicale3</literal>, which is done automatically if
+          <literal>stateVersion</literal> is 20.09 or higher.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>udpt</literal> experienced a complete rewrite from
+          C++ to rust. The configuration format changed from ini to
+          toml. The new configuration documentation can be found at
+          <link xlink:href="https://naim94a.github.io/udpt/config.html">the
+          official website</link> and example configuration is packaged
+          in <literal>${udpt}/share/udpt/udpt.toml</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          We now have a unified
+          <link xlink:href="options.html#opt-services.xserver.displayManager.autoLogin">services.xserver.displayManager.autoLogin</link>
+          option interface to be used for every display-manager in
+          NixOS.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>bitcoind</literal> module has changed to
+          multi-instance, using submodules. Therefore, it is now
+          mandatory to name each instance. To use this new
+          multi-instance config with an existing bitcoind data directory
+          and user, you have to adjust the original config, e.g.:
+        </para>
+        <programlisting language="bash">
+{
+  services.bitcoind = {
+    enable = true;
+    extraConfig = &quot;...&quot;;
+    ...
+  };
+}
+</programlisting>
+        <para>
+          To something similar:
+        </para>
+        <programlisting language="bash">
+{
+  services.bitcoind.mainnet = {
+    enable = true;
+    dataDir = &quot;/var/lib/bitcoind&quot;;
+    user = &quot;bitcoin&quot;;
+    extraConfig = &quot;...&quot;;
+    ...
+  };
+}
+</programlisting>
+        <para>
+          The key settings are:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              <literal>dataDir</literal> - to continue using the same
+              data directory.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>user</literal> - to continue using the same user
+              so that bitcoind maintains access to its files.
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          Graylog introduced a change in the LDAP server certificate
+          validation behaviour for version 3.3.3 which might break
+          existing setups. When updating Graylog from a version before
+          3.3.3 make sure to check the Graylog
+          <link xlink:href="https://www.graylog.org/post/announcing-graylog-v3-3-3">release
+          info</link> for information on how to avoid the issue.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>dokuwiki</literal> module has changed to
+          multi-instance, using submodules. Therefore, it is now
+          mandatory to name each instance. Moreover, forcing SSL by
+          default has been dropped, so <literal>nginx.forceSSL</literal>
+          and <literal>nginx.enableACME</literal> are no longer set to
+          <literal>true</literal>. To continue using your service with
+          the original SSL settings, you have to adjust the original
+          config, e.g.:
+        </para>
+        <programlisting language="bash">
+{
+  services.dokuwiki = {
+    enable = true;
+    ...
+  };
+}
+</programlisting>
+        <para>
+          To something similar:
+        </para>
+        <programlisting language="bash">
+{
+  services.dokuwiki.&quot;mywiki&quot; = {
+    enable = true;
+    nginx = {
+      forceSSL = true;
+      enableACME = true;
+    };
+    ...
+  };
+}
+</programlisting>
+        <para>
+          The base package has also been upgraded to the 2020-07-29
+          &quot;Hogfather&quot; release. Plugins might be incompatible
+          or require upgrading.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The
+          <link xlink:href="options.html#opt-services.postgresql.dataDir">services.postgresql.dataDir</link>
+          option is now set to
+          <literal>&quot;/var/lib/postgresql/${cfg.package.psqlSchema}&quot;</literal>
+          regardless of your
+          <link xlink:href="options.html#opt-system.stateVersion">system.stateVersion</link>.
+          Users with an existing postgresql install that have a
+          <link xlink:href="options.html#opt-system.stateVersion">system.stateVersion</link>
+          of <literal>17.03</literal> or below should double check what
+          the value of their
+          <link xlink:href="options.html#opt-services.postgresql.dataDir">services.postgresql.dataDir</link>
+          option is (<literal>/var/db/postgresql</literal>) and then
+          explicitly set this value to maintain compatibility:
+        </para>
+        <programlisting language="bash">
+{
+  services.postgresql.dataDir = &quot;/var/db/postgresql&quot;;
+}
+</programlisting>
+        <para>
+          The postgresql module now expects there to be a database super
+          user account called <literal>postgres</literal> regardless of
+          your
+          <link xlink:href="options.html#opt-system.stateVersion">system.stateVersion</link>.
+          Users with an existing postgresql install that have a
+          <link xlink:href="options.html#opt-system.stateVersion">system.stateVersion</link>
+          of <literal>17.03</literal> or below should run the following
+          SQL statements as a database super admin user before
+          upgrading:
+        </para>
+        <programlisting language="SQL">
+CREATE ROLE postgres LOGIN SUPERUSER;
+</programlisting>
+      </listitem>
+      <listitem>
+        <para>
+          The USBGuard module now removes options and instead hardcodes
+          values for <literal>IPCAccessControlFiles</literal>,
+          <literal>ruleFiles</literal>, and
+          <literal>auditFilePath</literal>. Audit logs can be found in
+          the journal.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The NixOS module system now evaluates option definitions more
+          strictly, allowing it to detect a larger set of problems. As a
+          result, what previously evaluated may not do so anymore. See
+          <link xlink:href="https://github.com/NixOS/nixpkgs/pull/82743#issuecomment-674520472">the
+          PR that changed this</link> for more info.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          For NixOS configuration options, the type
+          <literal>loaOf</literal>, after its initial deprecation in
+          release 20.03, has been removed. In NixOS and Nixpkgs options
+          using this type have been converted to
+          <literal>attrsOf</literal>. For more information on this
+          change have look at these links:
+          <link xlink:href="https://github.com/NixOS/nixpkgs/issues/1800">issue
+          #1800</link>,
+          <link xlink:href="https://github.com/NixOS/nixpkgs/pull/63103">PR
+          #63103</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>config.systemd.services.${name}.path</literal> now
+          returns a list of paths instead of a colon-separated string.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Caddy module now uses Caddy v2 by default. Caddy v1 can still
+          be used by setting
+          <link xlink:href="options.html#opt-services.caddy.package">services.caddy.package</link>
+          to <literal>pkgs.caddy1</literal>.
+        </para>
+        <para>
+          New option
+          <link xlink:href="options.html#opt-services.caddy.adapter">services.caddy.adapter</link>
+          has been added.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The
+          <link xlink:href="options.html#opt-services.jellyfin.enable">jellyfin</link>
+          module will use and stay on the Jellyfin version
+          <literal>10.5.5</literal> if <literal>stateVersion</literal>
+          is lower than <literal>20.09</literal>. This is because
+          significant changes were made to the database schema, and it
+          is highly recommended to backup your instance before
+          upgrading. After making your backup, you can upgrade to the
+          latest version either by setting your
+          <literal>stateVersion</literal> to <literal>20.09</literal> or
+          higher, or set the
+          <literal>services.jellyfin.package</literal> to
+          <literal>pkgs.jellyfin</literal>. If you do not wish to
+          upgrade Jellyfin, but want to change your
+          <literal>stateVersion</literal>, you can set the value of
+          <literal>services.jellyfin.package</literal> to
+          <literal>pkgs.jellyfin_10_5</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>security.rngd</literal> service is now disabled
+          by default. This choice was made because there's krngd in the
+          linux kernel space making it (for most usecases) functionally
+          redundent.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>hardware.nvidia.optimus_prime.enable</literal>
+          service has been renamed to
+          <literal>hardware.nvidia.prime.sync.enable</literal> and has
+          many new enhancements. Related nvidia prime settings may have
+          also changed.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The package nextcloud17 has been removed and nextcloud18 was
+          marked as insecure since both of them will
+          <link xlink:href="https://docs.nextcloud.com/server/19/admin_manual/release_schedule.html">
+          will be EOL (end of life) within the lifetime of 20.09</link>.
+        </para>
+        <para>
+          It's necessary to upgrade to nextcloud19:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              From nextcloud17, you have to upgrade to nextcloud18 first
+              as Nextcloud doesn't allow going multiple major revisions
+              forward in a single upgrade. This is possible by setting
+              <link xlink:href="options.html#opt-services.nextcloud.package">services.nextcloud.package</link>
+              to nextcloud18.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              From nextcloud18, it's possible to directly upgrade to
+              nextcloud19 by setting
+              <link xlink:href="options.html#opt-services.nextcloud.package">services.nextcloud.package</link>
+              to nextcloud19.
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          The GNOME desktop manager no longer default installs
+          gnome3.epiphany. It was chosen to do this as it has a
+          usability breaking issue (see issue
+          <link xlink:href="https://github.com/NixOS/nixpkgs/issues/98819">#98819</link>)
+          that makes it unsuitable to be a default app.
+        </para>
+        <note>
+          <para>
+            Issue
+            <link xlink:href="https://github.com/NixOS/nixpkgs/issues/98819">#98819</link>
+            is now fixed and gnome3.epiphany is once again installed by
+            default.
+          </para>
+        </note>
+      </listitem>
+      <listitem>
+        <para>
+          If you want to manage the configuration of wpa_supplicant
+          outside of NixOS you must ensure that none of
+          <link xlink:href="options.html#opt-networking.wireless.networks">networking.wireless.networks</link>,
+          <link xlink:href="options.html#opt-networking.wireless.extraConfig">networking.wireless.extraConfig</link>
+          or
+          <link xlink:href="options.html#opt-networking.wireless.userControlled.enable">networking.wireless.userControlled.enable</link>
+          is being used or <literal>true</literal>. Using any of those
+          options will cause wpa_supplicant to be started with a NixOS
+          generated configuration file instead of your own.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-20.09-notable-changes">
+    <title>Other Notable Changes</title>
+    <itemizedlist>
+      <listitem>
+        <para>
+          SD images are now compressed by default using
+          <literal>zstd</literal>. The compression for ISO images has
+          also been changed to <literal>zstd</literal>, but ISO images
+          are still not compressed by default.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services.journald.rateLimitBurst</literal> was
+          updated from <literal>1000</literal> to
+          <literal>10000</literal> to follow the new upstream systemd
+          default.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The notmuch package move its emacs-related binaries and emacs
+          lisp files to a separate output. They're not part of the
+          default <literal>out</literal> output anymore - if you relied
+          on the <literal>notmuch-emacs-mua</literal> binary or the
+          emacs lisp files, access them via the
+          <literal>notmuch.emacs</literal> output. Device tree overlay
+          support was improved in
+          <link xlink:href="https://github.com/NixOS/nixpkgs/pull/79370">#79370</link>
+          and now uses
+          <link xlink:href="options.html#opt-hardware.deviceTree.kernelPackage">hardware.deviceTree.kernelPackage</link>
+          instead of <literal>hardware.deviceTree.base</literal>.
+          <link xlink:href="options.html#opt-hardware.deviceTree.overlays">hardware.deviceTree.overlays</link>
+          configuration was extended to support <literal>.dts</literal>
+          files with symbols. Device trees can now be filtered by
+          setting
+          <link xlink:href="options.html#opt-hardware.deviceTree.filter">hardware.deviceTree.filter</link>
+          option.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The default output of <literal>buildGoPackage</literal> is now
+          <literal>$out</literal> instead of <literal>$bin</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>buildGoModule</literal> <literal>doCheck</literal>
+          now defaults to <literal>true</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Packages built using <literal>buildRustPackage</literal> now
+          use <literal>release</literal> mode for the
+          <literal>checkPhase</literal> by default.
+        </para>
+        <para>
+          Please note that Rust packages utilizing a custom
+          build/install procedure (e.g. by using a
+          <literal>Makefile</literal>) or test suites that rely on the
+          structure of the <literal>target/</literal> directory may
+          break due to those assumptions. For further information,
+          please read the Rust section in the Nixpkgs manual.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The cc- and binutils-wrapper's &quot;infix salt&quot; and
+          <literal>_BUILD_</literal> and <literal>_TARGET_</literal>
+          user infixes have been replaced with with a &quot;suffix
+          salt&quot; and suffixes and <literal>_FOR_BUILD</literal> and
+          <literal>_FOR_TARGET</literal>. This matches the autotools
+          convention for env vars which standard for these things,
+          making interfacing with other tools easier.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Additional Git documentation (HTML and text files) is now
+          available via the <literal>git-doc</literal> package.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Default algorithm for ZRAM swap was changed to
+          <literal>zstd</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The installer now enables sshd by default. This improves
+          installation on headless machines especially ARM
+          single-board-computer. To login through ssh, either a password
+          or an ssh key must be set for the root user or the nixos user.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The scripted networking system now uses
+          <literal>.link</literal> files in
+          <literal>/etc/systemd/network</literal> to configure mac
+          address and link MTU, instead of the sometimes buggy
+          <literal>network-link-*</literal> units, which have been
+          removed. Bringing the interface up has been moved to the
+          beginning of the <literal>network-addresses-*</literal> unit.
+          Note this doesn't require <literal>systemd-networkd</literal>
+          - it's udev that parses <literal>.link</literal> files. Extra
+          care needs to be taken in the presence of
+          <link xlink:href="https://wiki.debian.org/NetworkInterfaceNames#THE_.22PERSISTENT_NAMES.22_SCHEME">legacy
+          udev rules</link> to rename interfaces, as MAC Address and MTU
+          defined in these options can only match on the original link
+          name. In such cases, you most likely want to create a
+          <literal>10-*.link</literal> file through
+          <link xlink:href="options.html#opt-systemd.network.links">systemd.network.links</link>
+          and set both name and MAC Address / MTU there.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Grafana received a major update to version 7.x. A plugin is
+          now needed for image rendering support, and plugins must now
+          be signed by default. More information can be found
+          <link xlink:href="https://grafana.com/docs/grafana/latest/installation/upgrading/#upgrading-to-v7-0">in
+          the Grafana documentation</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>hardware.u2f</literal> module, which was
+          installing udev rules was removed, as udev gained native
+          support to handle FIDO security tokens.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>services.transmission</literal> module was
+          enhanced with the new options:
+          <link xlink:href="options.html#opt-services.transmission.credentialsFile">services.transmission.credentialsFile</link>,
+          <link xlink:href="options.html#opt-services.transmission.openFirewall">services.transmission.openFirewall</link>,
+          and
+          <link xlink:href="options.html#opt-services.transmission.performanceNetParameters">services.transmission.performanceNetParameters</link>.
+        </para>
+        <para>
+          <literal>transmission-daemon</literal> is now started with
+          additional systemd sandbox/hardening options for better
+          security. Please
+          <link xlink:href="https://github.com/NixOS/nixpkgs/issues">report</link>
+          any use case where this is not working well. In particular,
+          the <literal>RootDirectory</literal> option newly set forbids
+          uploading or downloading a torrent outside of the default
+          directory configured at
+          <link xlink:href="options.html#opt-services.transmission.settings">settings.download-dir</link>.
+          If you really need Transmission to access other directories,
+          you must include those directories into the
+          <literal>BindPaths</literal> of the service:
+        </para>
+        <programlisting language="bash">
+{
+  systemd.services.transmission.serviceConfig.BindPaths = [ &quot;/path/to/alternative/download-dir&quot; ];
+}
+</programlisting>
+        <para>
+          Also, connection to the RPC (Remote Procedure Call) of
+          <literal>transmission-daemon</literal> is now only available
+          on the local network interface by default. Use:
+        </para>
+        <programlisting language="bash">
+{
+  services.transmission.settings.rpc-bind-address = &quot;0.0.0.0&quot;;
+}
+</programlisting>
+        <para>
+          to get the previous behavior of listening on all network
+          interfaces.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          With this release <literal>systemd-networkd</literal> (when
+          enabled through
+          <link xlink:href="options.html#opt-networking.useNetworkd">networking.useNetworkd</link>)
+          has it's netlink socket created through a
+          <literal>systemd.socket</literal> unit. This gives us control
+          over socket buffer sizes and other parameters. For larger
+          setups where networkd has to create a lot of (virtual) devices
+          the default buffer size (currently 128MB) is not enough.
+        </para>
+        <para>
+          On a machine with &gt;100 virtual interfaces (e.g., wireguard
+          tunnels, VLANs, …), that all have to be brought up during
+          system startup, the receive buffer size will spike for a brief
+          period. Eventually some of the message will be dropped since
+          there is not enough (permitted) buffer space available.
+        </para>
+        <para>
+          By having <literal>systemd-networkd</literal> start with a
+          netlink socket created by <literal>systemd</literal> we can
+          configure the <literal>ReceiveBufferSize=</literal> parameter
+          in the socket options (i.e.
+          <literal>systemd.sockets.systemd-networkd.socketOptions.ReceiveBufferSize</literal>)
+          without recompiling <literal>systemd-networkd</literal>.
+        </para>
+        <para>
+          Since the actual memory requirements depend on hardware,
+          timing, exact configurations etc. it isn't currently possible
+          to infer a good default from within the NixOS module system.
+          Administrators are advised to monitor the logs of
+          <literal>systemd-networkd</literal> for
+          <literal>rtnl: kernel receive buffer overrun</literal> spam
+          and increase the memory limit as they see fit.
+        </para>
+        <para>
+          Note: Increasing the <literal>ReceiveBufferSize=</literal>
+          doesn't allocate any memory. It just increases the upper bound
+          on the kernel side. The memory allocation depends on the
+          amount of messages that are queued on the kernel side of the
+          netlink socket.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Specifying
+          <link xlink:href="options.html#opt-services.dovecot2.mailboxes">mailboxes</link>
+          in the dovecot2 module as a list is deprecated and will break
+          eval in 21.05. Instead, an attribute-set should be specified
+          where the <literal>name</literal> should be the key of the
+          attribute.
+        </para>
+        <para>
+          This means that a configuration like this
+        </para>
+        <programlisting language="bash">
+{
+  services.dovecot2.mailboxes = [
+    { name = &quot;Junk&quot;;
+      auto = &quot;create&quot;;
+    }
+  ];
+}
+</programlisting>
+        <para>
+          should now look like this:
+        </para>
+        <programlisting language="bash">
+{
+  services.dovecot2.mailboxes = {
+    Junk.auto = &quot;create&quot;;
+  };
+}
+</programlisting>
+      </listitem>
+      <listitem>
+        <para>
+          netbeans was upgraded to 12.0 and now defaults to OpenJDK 11.
+          This might cause problems if your projects depend on packages
+          that were removed in Java 11.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          nextcloud has been updated to
+          <link xlink:href="https://nextcloud.com/blog/nextcloud-hub-brings-productivity-to-home-office/">v19</link>.
+        </para>
+        <para>
+          If you have an existing installation, please make sure that
+          you're on nextcloud18 before upgrading to nextcloud19 since
+          Nextcloud doesn't support upgrades across multiple major
+          versions.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>nixos-run-vms</literal> script now deletes the
+          previous run machines states on test startup. You can use the
+          <literal>--keep-vm-state</literal> flag to match the previous
+          behaviour and keep the same VM state between different test
+          runs.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The
+          <link xlink:href="options.html#opt-nix.buildMachines">nix.buildMachines</link>
+          option is now type-checked. There are no functional changes,
+          however this may require updating some configurations to use
+          correct types for all attributes.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>fontconfig</literal> module stopped generating
+          config and cache files for fontconfig 2.10.x, the
+          <literal>/etc/fonts/fonts.conf</literal> now belongs to the
+          latest fontconfig, just like on other Linux distributions, and
+          we will
+          <link xlink:href="https://github.com/NixOS/nixpkgs/pull/95358">no
+          longer</link> be versioning the config directories.
+        </para>
+        <para>
+          Fontconfig 2.10.x was removed from Nixpkgs since it hasn’t
+          been used in any Nixpkgs package for years now.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Nginx module
+          <literal>nginxModules.fastcgi-cache-purge</literal> renamed to
+          official name <literal>nginxModules.cache-purge</literal>.
+          Nginx module <literal>nginxModules.ngx_aws_auth</literal>
+          renamed to official name
+          <literal>nginxModules.aws-auth</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The option <literal>defaultPackages</literal> was added. It
+          installs the packages perl, rsync and strace for now. They
+          were added unconditionally to
+          <literal>systemPackages</literal> before, but are not strictly
+          necessary for a minimal NixOS install. You can set it to an
+          empty list to have a more minimal system. Be aware that some
+          functionality might still have an impure dependency on those
+          packages, so things might break.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>undervolt</literal> option no longer needs to
+          apply its settings every 30s. If they still become undone,
+          open an issue and restore the previous behaviour using
+          <literal>undervolt.useTimer</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Agda has been heavily reworked.
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              <literal>agda.mkDerivation</literal> has been heavily
+              changed and is now located at agdaPackages.mkDerivation.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              New top-level packages agda and
+              <literal>agda.withPackages</literal> have been added, the
+              second of which sets up agda with access to chosen
+              libraries.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              All agda libraries now live under
+              <literal>agdaPackages</literal>.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              Many broken libraries have been removed.
+            </para>
+          </listitem>
+        </itemizedlist>
+        <para>
+          See the
+          <link xlink:href="https://nixos.org/nixpkgs/manual/#agda">new
+          documentation</link> for more information.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>deepin</literal> package set has been removed
+          from nixpkgs. It was a work in progress to package the
+          <link xlink:href="https://www.deepin.org/en/dde/">Deepin
+          Desktop Environment (DDE)</link>, including libraries, tools
+          and applications, and it was still missing a service to launch
+          the desktop environment. It has shown to no longer be a
+          feasible goal due to reasons discussed in
+          <link xlink:href="https://github.com/NixOS/nixpkgs/issues/94870">issue
+          #94870</link>. The package
+          <literal>netease-cloud-music</literal> has also been removed,
+          as it depends on libraries from deepin.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>opendkim</literal> module now uses systemd
+          sandboxing features to limit the exposure of the system
+          towards the opendkim service.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Kubernetes has been upgraded to 1.19.1, which also means that
+          the golang version to build it has been bumped to 1.15. This
+          may have consequences for your existing clusters and their
+          certificates. Please consider
+          <link xlink:href="https://relnotes.k8s.io/?markdown=93264">
+          the release notes for Kubernetes 1.19 carefully </link> before
+          upgrading.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          For AMD GPUs, Vulkan can now be used by adding
+          <literal>amdvlk</literal> to
+          <literal>hardware.opengl.extraPackages</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Similarly, still for AMD GPUs, the ROCm OpenCL stack can now
+          be used by adding <literal>rocm-opencl-icd</literal> to
+          <literal>hardware.opengl.extraPackages</literal>.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-20.09-contributions">
+    <title>Contributions</title>
+    <para>
+      I, Jonathan Ringer, would like to thank the following individuals
+      for their work on nixpkgs. This release could not be done without
+      the hard work of the NixOS community. There were 31282
+      contributions across 1313 contributors.
+    </para>
+    <orderedlist numeration="arabic">
+      <listitem>
+        <para>
+          2288 Mario Rodas
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          1837 Frederik Rietdijk
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          946 Jörg Thalheim
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          925 Maximilian Bosch
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          687 Jonathan Ringer
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          651 Jan Tojnar
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          622 Daniël de Kok
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          605 WORLDofPEACE
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          597 Florian Klink
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          528 José Romildo Malaquias
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          281 volth
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          101 Robert Scott
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          86 Tim Steinbach
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          76 WORLDofPEACE
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          49 Maximilian Bosch
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          42 Thomas Tuegel
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          37 Doron Behar
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          36 Vladimír Čunát
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          27 Jonathan Ringer
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          27 Maciej Krüger
+        </para>
+      </listitem>
+    </orderedlist>
+    <para>
+      I, Jonathan Ringer, would also like to personally thank
+      @WORLDofPEACE for their help in mentoring me on the release
+      process. Special thanks also goes to Thomas Tuegel for helping
+      immensely with stabilizing Qt, KDE, and Plasma5; I would also like
+      to thank Robert Scott for his numerous fixes and pull request
+      reviews.
+    </para>
+  </section>
+</section>
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
index 2c7935078e34..8a3c982fcb95 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@@ -309,6 +309,8 @@
           </listitem>
         </itemizedlist>
       </listitem>
+    </itemizedlist>
+    <itemizedlist spacing="compact">
       <listitem>
         <para>
           The <literal>antlr</literal> package now defaults to the 4.x
diff --git a/nixos/doc/manual/release-notes/release-notes.xml b/nixos/doc/manual/release-notes/release-notes.xml
index 6d7899f6dcdb..c6fff3c30d50 100644
--- a/nixos/doc/manual/release-notes/release-notes.xml
+++ b/nixos/doc/manual/release-notes/release-notes.xml
@@ -10,18 +10,18 @@
  </para>
  <xi:include href="../from_md/release-notes/rl-2111.section.xml" />
  <xi:include href="rl-2105.xml" />
- <xi:include href="rl-2009.xml" />
- <xi:include href="rl-2003.xml" />
- <xi:include href="rl-1909.xml" />
- <xi:include href="rl-1903.xml" />
- <xi:include href="rl-1809.xml" />
- <xi:include href="rl-1803.xml" />
- <xi:include href="rl-1709.xml" />
- <xi:include href="rl-1703.xml" />
- <xi:include href="rl-1609.xml" />
- <xi:include href="rl-1603.xml" />
- <xi:include href="rl-1509.xml" />
- <xi:include href="rl-1412.xml" />
- <xi:include href="rl-1404.xml" />
- <xi:include href="rl-1310.xml" />
+ <xi:include href="../from_md/release-notes/rl-2009.section.xml" />
+ <xi:include href="../from_md/release-notes/rl-2003.section.xml" />
+ <xi:include href="../from_md/release-notes/rl-1909.section.xml" />
+ <xi:include href="../from_md/release-notes/rl-1903.section.xml" />
+ <xi:include href="../from_md/release-notes/rl-1809.section.xml" />
+ <xi:include href="../from_md/release-notes/rl-1803.section.xml" />
+ <xi:include href="../from_md/release-notes/rl-1709.section.xml" />
+ <xi:include href="../from_md/release-notes/rl-1703.section.xml" />
+ <xi:include href="../from_md/release-notes/rl-1609.section.xml" />
+ <xi:include href="../from_md/release-notes/rl-1603.section.xml" />
+ <xi:include href="../from_md/release-notes/rl-1509.section.xml" />
+ <xi:include href="../from_md/release-notes/rl-1412.section.xml" />
+ <xi:include href="../from_md/release-notes/rl-1404.section.xml" />
+ <xi:include href="../from_md/release-notes/rl-1310.section.xml" />
 </appendix>
diff --git a/nixos/doc/manual/release-notes/rl-1310.section.md b/nixos/doc/manual/release-notes/rl-1310.section.md
new file mode 100644
index 000000000000..9efd8f6e8a1e
--- /dev/null
+++ b/nixos/doc/manual/release-notes/rl-1310.section.md
@@ -0,0 +1,3 @@
+# Release 13.10 ("Aardvark", 2013/10/31) {#sec-release-13.10}
+
+This is the first stable release branch of NixOS.
diff --git a/nixos/doc/manual/release-notes/rl-1310.xml b/nixos/doc/manual/release-notes/rl-1310.xml
deleted file mode 100644
index 248bab70c36b..000000000000
--- a/nixos/doc/manual/release-notes/rl-1310.xml
+++ /dev/null
@@ -1,11 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-13.10">
- <title>Release 13.10 (“Aardvark”, 2013/10/31)</title>
-
- <para>
-  This is the first stable release branch of NixOS.
- </para>
-</section>
diff --git a/nixos/doc/manual/release-notes/rl-1404.section.md b/nixos/doc/manual/release-notes/rl-1404.section.md
new file mode 100644
index 000000000000..e0a70df3a634
--- /dev/null
+++ b/nixos/doc/manual/release-notes/rl-1404.section.md
@@ -0,0 +1,81 @@
+# Release 14.04 ("Baboon", 2014/04/30) {#sec-release-14.04}
+
+This is the second stable release branch of NixOS. In addition to numerous new and upgraded packages and modules, this release has the following highlights:
+
+- Installation on UEFI systems is now supported. See [](#sec-installation) for details.
+
+- Systemd has been updated to version 212, which has [numerous improvements](http://cgit.freedesktop.org/systemd/systemd/plain/NEWS?id=v212). NixOS now automatically starts systemd user instances when you log in. You can define global user units through the `systemd.unit.*` options.
+
+- NixOS is now based on Glibc 2.19 and GCC 4.8.
+
+- The default Linux kernel has been updated to 3.12.
+
+- KDE has been updated to 4.12.
+
+- GNOME 3.10 experimental support has been added.
+
+- Nix has been updated to 1.7 ([details](https://nixos.org/nix/manual/#ssec-relnotes-1.7)).
+
+- NixOS now supports fully declarative management of users and groups. If you set `users.mutableUsers` to `false`, then the contents of `/etc/passwd` and `/etc/group` will be [congruent](https://www.usenix.org/legacy/event/lisa02/tech/full_papers/traugott/traugott_html/) to your NixOS configuration. For instance, if you remove a user from `users.extraUsers` and run `nixos-rebuild`, the user account will cease to exist. Also, imperative commands for managing users and groups, such as `useradd`, are no longer available. If `users.mutableUsers` is `true` (the default), then behaviour is unchanged from NixOS 13.10.
+
+- NixOS now has basic container support, meaning you can easily run a NixOS instance as a container in a NixOS host system. These containers are suitable for testing and experimentation but not production use, since they're not fully isolated from the host. See [](#ch-containers) for details.
+
+- Systemd units provided by packages can now be overridden from the NixOS configuration. For instance, if a package `foo` provides systemd units, you can say:
+
+  ```nix
+  {
+    systemd.packages = [ pkgs.foo ];
+  }
+  ```
+
+  to enable those units. You can then set or override unit options in the usual way, e.g.
+
+  ```nix
+  {
+    systemd.services.foo.wantedBy = [ "multi-user.target" ];
+    systemd.services.foo.serviceConfig.MemoryLimit = "512M";
+  }
+  ```
+
+  When upgrading from a previous release, please be aware of the following incompatible changes:
+
+- Nixpkgs no longer exposes unfree packages by default. If your NixOS configuration requires unfree packages from Nixpkgs, you need to enable support for them explicitly by setting:
+
+  ```nix
+  {
+    nixpkgs.config.allowUnfree = true;
+  }
+  ```
+
+  Otherwise, you get an error message such as:
+
+  ```ShellSession
+      error: package ‘nvidia-x11-331.49-3.12.17’ in ‘…/nvidia-x11/default.nix:56’
+        has an unfree license, refusing to evaluate
+  ```
+
+- The Adobe Flash player is no longer enabled by default in the Firefox and Chromium wrappers. To enable it, you must set:
+
+  ```nix
+  {
+    nixpkgs.config.allowUnfree = true;
+    nixpkgs.config.firefox.enableAdobeFlash = true; # for Firefox
+    nixpkgs.config.chromium.enableAdobeFlash = true; # for Chromium
+  }
+  ```
+
+- The firewall is now enabled by default. If you don't want this, you need to disable it explicitly:
+
+  ```nix
+  {
+    networking.firewall.enable = false;
+  }
+  ```
+
+- The option `boot.loader.grub.memtest86` has been renamed to `boot.loader.grub.memtest86.enable`.
+
+- The `mysql55` service has been merged into the `mysql` service, which no longer sets a default for the option `services.mysql.package`.
+
+- Package variants are now differentiated by suffixing the name, rather than the version. For instance, `sqlite-3.8.4.3-interactive` is now called `sqlite-interactive-3.8.4.3`. This ensures that `nix-env -i sqlite` is unambiguous, and that `nix-env -u` won't "upgrade" `sqlite` to `sqlite-interactive` or vice versa. Notably, this change affects the Firefox wrapper (which provides plugins), as it is now called `firefox-wrapper`. So when using `nix-env`, you should do `nix-env -e firefox; nix-env -i firefox-wrapper` if you want to keep using the wrapper. This change does not affect declarative package management, since attribute names like `pkgs.firefoxWrapper` were already unambiguous.
+
+- The symlink `/etc/ca-bundle.crt` is gone. Programs should instead use the environment variable `OPENSSL_X509_CERT_FILE` (which points to `/etc/ssl/certs/ca-bundle.crt`).
diff --git a/nixos/doc/manual/release-notes/rl-1404.xml b/nixos/doc/manual/release-notes/rl-1404.xml
deleted file mode 100644
index 56dbb74a71d5..000000000000
--- a/nixos/doc/manual/release-notes/rl-1404.xml
+++ /dev/null
@@ -1,179 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-14.04">
- <title>Release 14.04 (“Baboon”, 2014/04/30)</title>
-
- <para>
-  This is the second stable release branch of NixOS. In addition to numerous
-  new and upgraded packages and modules, this release has the following
-  highlights:
-  <itemizedlist>
-   <listitem>
-    <para>
-     Installation on UEFI systems is now supported. See
-     <xref linkend="sec-installation"/> for details.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Systemd has been updated to version 212, which has
-     <link xlink:href="http://cgit.freedesktop.org/systemd/systemd/plain/NEWS?id=v212">numerous
-     improvements</link>. NixOS now automatically starts systemd user instances
-     when you log in. You can define global user units through the
-     <option>systemd.unit.*</option> options.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     NixOS is now based on Glibc 2.19 and GCC 4.8.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The default Linux kernel has been updated to 3.12.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     KDE has been updated to 4.12.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     GNOME 3.10 experimental support has been added.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Nix has been updated to 1.7
-     (<link
-  xlink:href="https://nixos.org/nix/manual/#ssec-relnotes-1.7">details</link>).
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     NixOS now supports fully declarative management of users and groups. If
-     you set <option>users.mutableUsers</option> to <literal>false</literal>,
-     then the contents of <filename>/etc/passwd</filename> and
-     <filename>/etc/group</filename> will be
-     <link
-  xlink:href="https://www.usenix.org/legacy/event/lisa02/tech/full_papers/traugott/traugott_html/">congruent</link>
-     to your NixOS configuration. For instance, if you remove a user from
-     <option>users.extraUsers</option> and run
-     <command>nixos-rebuild</command>, the user account will cease to exist.
-     Also, imperative commands for managing users and groups, such as
-     <command>useradd</command>, are no longer available. If
-     <option>users.mutableUsers</option> is <literal>true</literal> (the
-     default), then behaviour is unchanged from NixOS 13.10.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     NixOS now has basic container support, meaning you can easily run a NixOS
-     instance as a container in a NixOS host system. These containers are
-     suitable for testing and experimentation but not production use, since
-     they’re not fully isolated from the host. See
-     <xref linkend="ch-containers"/> for details.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Systemd units provided by packages can now be overridden from the NixOS
-     configuration. For instance, if a package <literal>foo</literal> provides
-     systemd units, you can say:
-<programlisting>
-systemd.packages = [ pkgs.foo ];
-</programlisting>
-     to enable those units. You can then set or override unit options in the
-     usual way, e.g.
-<programlisting>
-systemd.services.foo.wantedBy = [ "multi-user.target" ];
-systemd.services.foo.serviceConfig.MemoryLimit = "512M";
-</programlisting>
-    </para>
-   </listitem>
-  </itemizedlist>
- </para>
-
- <para>
-  When upgrading from a previous release, please be aware of the following
-  incompatible changes:
-  <itemizedlist>
-   <listitem>
-    <para>
-     Nixpkgs no longer exposes unfree packages by default. If your NixOS
-     configuration requires unfree packages from Nixpkgs, you need to enable
-     support for them explicitly by setting:
-<programlisting>
-nixpkgs.config.allowUnfree = true;
-</programlisting>
-     Otherwise, you get an error message such as:
-<screen>
-error: package ‘nvidia-x11-331.49-3.12.17’ in ‘…/nvidia-x11/default.nix:56’
-  has an unfree license, refusing to evaluate
-</screen>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The Adobe Flash player is no longer enabled by default in the Firefox and
-     Chromium wrappers. To enable it, you must set:
-<programlisting>
-nixpkgs.config.allowUnfree = true;
-nixpkgs.config.firefox.enableAdobeFlash = true; # for Firefox
-nixpkgs.config.chromium.enableAdobeFlash = true; # for Chromium
-</programlisting>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The firewall is now enabled by default. If you don’t want this, you need
-     to disable it explicitly:
-<programlisting>
-networking.firewall.enable = false;
-</programlisting>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The option <option>boot.loader.grub.memtest86</option> has been renamed to
-     <option>boot.loader.grub.memtest86.enable</option>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>mysql55</literal> service has been merged into the
-     <literal>mysql</literal> service, which no longer sets a default for the
-     option <option>services.mysql.package</option>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Package variants are now differentiated by suffixing the name, rather than
-     the version. For instance, <filename>sqlite-3.8.4.3-interactive</filename>
-     is now called <filename>sqlite-interactive-3.8.4.3</filename>. This
-     ensures that <literal>nix-env -i sqlite</literal> is unambiguous, and that
-     <literal>nix-env -u</literal> won’t “upgrade”
-     <literal>sqlite</literal> to <literal>sqlite-interactive</literal> or vice
-     versa. Notably, this change affects the Firefox wrapper (which provides
-     plugins), as it is now called <literal>firefox-wrapper</literal>. So when
-     using <command>nix-env</command>, you should do <literal>nix-env -e
-     firefox; nix-env -i firefox-wrapper</literal> if you want to keep using
-     the wrapper. This change does not affect declarative package management,
-     since attribute names like <literal>pkgs.firefoxWrapper</literal> were
-     already unambiguous.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The symlink <filename>/etc/ca-bundle.crt</filename> is gone. Programs
-     should instead use the environment variable
-     <envar>OPENSSL_X509_CERT_FILE</envar> (which points to
-     <filename>/etc/ssl/certs/ca-bundle.crt</filename>).
-    </para>
-   </listitem>
-  </itemizedlist>
- </para>
-</section>
diff --git a/nixos/doc/manual/release-notes/rl-1412.section.md b/nixos/doc/manual/release-notes/rl-1412.section.md
new file mode 100644
index 000000000000..683f1e45f092
--- /dev/null
+++ b/nixos/doc/manual/release-notes/rl-1412.section.md
@@ -0,0 +1,171 @@
+# Release 14.12 ("Caterpillar", 2014/12/30) {#sec-release-14.12}
+
+In addition to numerous new and upgraded packages, this release has the following highlights:
+
+- Systemd has been updated to version 217, which has numerous [improvements.](http://lists.freedesktop.org/archives/systemd-devel/2014-October/024662.html)
+
+- [Nix has been updated to 1.8.](https://www.mail-archive.com/nix-dev@lists.science.uu.nl/msg13957.html)
+
+- NixOS is now based on Glibc 2.20.
+
+- KDE has been updated to 4.14.
+
+- The default Linux kernel has been updated to 3.14.
+
+- If `users.mutableUsers` is enabled (the default), changes made to the declaration of a user or group will be correctly realised when running `nixos-rebuild`. For instance, removing a user specification from `configuration.nix` will cause the actual user account to be deleted. If `users.mutableUsers` is disabled, it is no longer necessary to specify UIDs or GIDs; if omitted, they are allocated dynamically.
+
+Following new services were added since the last release:
+
+- `atftpd`
+
+- `bosun`
+
+- `bspwm`
+
+- `chronos`
+
+- `collectd`
+
+- `consul`
+
+- `cpuminer-cryptonight`
+
+- `crashplan`
+
+- `dnscrypt-proxy`
+
+- `docker-registry`
+
+- `docker`
+
+- `etcd`
+
+- `fail2ban`
+
+- `fcgiwrap`
+
+- `fleet`
+
+- `fluxbox`
+
+- `gdm`
+
+- `geoclue2`
+
+- `gitlab`
+
+- `gitolite`
+
+- `gnome3.gnome-documents`
+
+- `gnome3.gnome-online-miners`
+
+- `gnome3.gvfs`
+
+- `gnome3.seahorse`
+
+- `hbase`
+
+- `i2pd`
+
+- `influxdb`
+
+- `kubernetes`
+
+- `liquidsoap`
+
+- `lxc`
+
+- `mailpile`
+
+- `mesos`
+
+- `mlmmj`
+
+- `monetdb`
+
+- `mopidy`
+
+- `neo4j`
+
+- `nsd`
+
+- `openntpd`
+
+- `opentsdb`
+
+- `openvswitch`
+
+- `parallels-guest`
+
+- `peerflix`
+
+- `phd`
+
+- `polipo`
+
+- `prosody`
+
+- `radicale`
+
+- `redmine`
+
+- `riemann`
+
+- `scollector`
+
+- `seeks`
+
+- `siproxd`
+
+- `strongswan`
+
+- `tcsd`
+
+- `teamspeak3`
+
+- `thermald`
+
+- `torque/mrom`
+
+- `torque/server`
+
+- `uhub`
+
+- `unifi`
+
+- `znc`
+
+- `zookeeper`
+
+When upgrading from a previous release, please be aware of the following incompatible changes:
+
+- The default version of Apache httpd is now 2.4. If you use the `extraConfig` option to pass literal Apache configuration text, you may need to update it --- see [Apache's documentation](http://httpd.apache.org/docs/2.4/upgrading.html) for details. If you wish to continue to use httpd 2.2, add the following line to your NixOS configuration:
+
+  ```nix
+  {
+    services.httpd.package = pkgs.apacheHttpd_2_2;
+  }
+  ```
+
+- PHP 5.3 has been removed because it is no longer supported by the PHP project. A [migration guide](http://php.net/migration54) is available.
+
+- The host side of a container virtual Ethernet pair is now called `ve-container-name` rather than `c-container-name`.
+
+- GNOME 3.10 support has been dropped. The default GNOME version is now 3.12.
+
+- VirtualBox has been upgraded to 4.3.20 release. Users may be required to run `rm -rf /tmp/.vbox*`. The line `imports = [ <nixpkgs/nixos/modules/programs/virtualbox.nix> ]` is no longer necessary, use `services.virtualboxHost.enable = true` instead.
+
+  Also, hardening mode is now enabled by default, which means that unless you want to use USB support, you no longer need to be a member of the `vboxusers` group.
+
+- Chromium has been updated to 39.0.2171.65. `enablePepperPDF` is now enabled by default. `chromium*Wrapper` packages no longer exist, because upstream removed NSAPI support. `chromium-stable` has been renamed to `chromium`.
+
+- Python packaging documentation is now part of nixpkgs manual. To override the python packages available to a custom python you now use `pkgs.pythonFull.buildEnv.override` instead of `pkgs.pythonFull.override`.
+
+- `boot.resumeDevice = "8:6"` is no longer supported. Most users will want to leave it undefined, which takes the swap partitions automatically. There is an evaluation assertion to ensure that the string starts with a slash.
+
+- The system-wide default timezone for NixOS installations changed from `CET` to `UTC`. To choose a different timezone for your system, configure `time.timeZone` in `configuration.nix`. A fairly complete list of possible values for that setting is available at <https://en.wikipedia.org/wiki/List_of_tz_database_time_zones>.
+
+- GNU screen has been updated to 4.2.1, which breaks the ability to connect to sessions created by older versions of screen.
+
+- The Intel GPU driver was updated to the 3.x prerelease version (used by most distributions) and supports DRI3 now.
diff --git a/nixos/doc/manual/release-notes/rl-1412.xml b/nixos/doc/manual/release-notes/rl-1412.xml
deleted file mode 100644
index 139f61c2a550..000000000000
--- a/nixos/doc/manual/release-notes/rl-1412.xml
+++ /dev/null
@@ -1,467 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-14.12">
- <title>Release 14.12 (“Caterpillar”, 2014/12/30)</title>
-
- <para>
-  In addition to numerous new and upgraded packages, this release has the
-  following highlights:
-  <itemizedlist>
-   <listitem>
-    <para>
-     Systemd has been updated to version 217, which has numerous
-     <link xlink:href="http://lists.freedesktop.org/archives/systemd-devel/2014-October/024662.html">improvements.</link>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <link xlink:href="https://www.mail-archive.com/nix-dev@lists.science.uu.nl/msg13957.html">
-     Nix has been updated to 1.8.</link>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     NixOS is now based on Glibc 2.20.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     KDE has been updated to 4.14.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The default Linux kernel has been updated to 3.14.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     If <option>users.mutableUsers</option> is enabled (the default), changes
-     made to the declaration of a user or group will be correctly realised when
-     running <command>nixos-rebuild</command>. For instance, removing a user
-     specification from <filename>configuration.nix</filename> will cause the
-     actual user account to be deleted. If <option>users.mutableUsers</option>
-     is disabled, it is no longer necessary to specify UIDs or GIDs; if
-     omitted, they are allocated dynamically.
-    </para>
-   </listitem>
-  </itemizedlist>
- </para>
-
- <para>
-  Following new services were added since the last release:
-  <itemizedlist>
-   <listitem>
-    <para>
-     <literal>atftpd</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>bosun</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>bspwm</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>chronos</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>collectd</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>consul</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>cpuminer-cryptonight</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>crashplan</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>dnscrypt-proxy</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>docker-registry</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>docker</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>etcd</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>fail2ban</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>fcgiwrap</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>fleet</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>fluxbox</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>gdm</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>geoclue2</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>gitlab</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>gitolite</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>gnome3.gnome-documents</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>gnome3.gnome-online-miners</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>gnome3.gvfs</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>gnome3.seahorse</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>hbase</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>i2pd</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>influxdb</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>kubernetes</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>liquidsoap</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>lxc</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>mailpile</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>mesos</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>mlmmj</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>monetdb</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>mopidy</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>neo4j</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>nsd</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>openntpd</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>opentsdb</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>openvswitch</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>parallels-guest</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>peerflix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>phd</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>polipo</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>prosody</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>radicale</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>redmine</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>riemann</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>scollector</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>seeks</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>siproxd</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>strongswan</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>tcsd</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>teamspeak3</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>thermald</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>torque/mrom</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>torque/server</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>uhub</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>unifi</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>znc</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>zookeeper</literal>
-    </para>
-   </listitem>
-  </itemizedlist>
- </para>
-
- <para>
-  When upgrading from a previous release, please be aware of the following
-  incompatible changes:
-  <itemizedlist>
-   <listitem>
-    <para>
-     The default version of Apache httpd is now 2.4. If you use the
-     <option>extraConfig</option> option to pass literal Apache configuration
-     text, you may need to update it — see
-     <link
-xlink:href="http://httpd.apache.org/docs/2.4/upgrading.html">Apache’s
-     documentation</link> for details. If you wish to continue to use httpd
-     2.2, add the following line to your NixOS configuration:
-<programlisting>
-services.httpd.package = pkgs.apacheHttpd_2_2;
-</programlisting>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     PHP 5.3 has been removed because it is no longer supported by the PHP
-     project. A <link
-xlink:href="http://php.net/migration54">migration
-     guide</link> is available.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The host side of a container virtual Ethernet pair is now called
-     <literal>ve-<replaceable>container-name</replaceable></literal> rather
-     than <literal>c-<replaceable>container-name</replaceable></literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     GNOME 3.10 support has been dropped. The default GNOME version is now
-     3.12.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     VirtualBox has been upgraded to 4.3.20 release. Users may be required to
-     run <command>rm -rf /tmp/.vbox*</command>. The line <literal>imports = [
-     &lt;nixpkgs/nixos/modules/programs/virtualbox.nix&gt; ]</literal> is no
-     longer necessary, use <literal>services.virtualboxHost.enable =
-     true</literal> instead.
-    </para>
-    <para>
-     Also, hardening mode is now enabled by default, which means that unless
-     you want to use USB support, you no longer need to be a member of the
-     <literal>vboxusers</literal> group.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Chromium has been updated to 39.0.2171.65.
-     <option>enablePepperPDF</option> is now enabled by default.
-     <literal>chromium*Wrapper</literal> packages no longer exist, because
-     upstream removed NSAPI support. <literal>chromium-stable</literal> has
-     been renamed to <literal>chromium</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Python packaging documentation is now part of nixpkgs manual. To override
-     the python packages available to a custom python you now use
-     <literal>pkgs.pythonFull.buildEnv.override</literal> instead of
-     <literal>pkgs.pythonFull.override</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>boot.resumeDevice = "8:6"</literal> is no longer supported. Most
-     users will want to leave it undefined, which takes the swap partitions
-     automatically. There is an evaluation assertion to ensure that the string
-     starts with a slash.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The system-wide default timezone for NixOS installations changed from
-     <literal>CET</literal> to <literal>UTC</literal>. To choose a different
-     timezone for your system, configure <literal>time.timeZone</literal> in
-     <literal>configuration.nix</literal>. A fairly complete list of possible
-     values for that setting is available at
-     <link
-xlink:href="https://en.wikipedia.org/wiki/List_of_tz_database_time_zones"/>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     GNU screen has been updated to 4.2.1, which breaks the ability to connect
-     to sessions created by older versions of screen.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The Intel GPU driver was updated to the 3.x prerelease version (used by
-     most distributions) and supports DRI3 now.
-    </para>
-   </listitem>
-  </itemizedlist>
- </para>
-</section>
diff --git a/nixos/doc/manual/release-notes/rl-1509.section.md b/nixos/doc/manual/release-notes/rl-1509.section.md
new file mode 100644
index 000000000000..55804ddb988a
--- /dev/null
+++ b/nixos/doc/manual/release-notes/rl-1509.section.md
@@ -0,0 +1,319 @@
+# Release 15.09 ("Dingo", 2015/09/30) {#sec-release-15.09}
+
+In addition to numerous new and upgraded packages, this release has the following highlights:
+
+- The [Haskell](http://haskell.org/) packages infrastructure has been re-designed from the ground up (\"Haskell NG\"). NixOS now distributes the latest version of every single package registered on [Hackage](http://hackage.haskell.org/) \-- well in excess of 8,000 Haskell packages. Detailed instructions on how to use that infrastructure can be found in the [User\'s Guide to the Haskell Infrastructure](https://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure). Users migrating from an earlier release may find helpful information below, in the list of backwards-incompatible changes. Furthermore, we distribute 51(!) additional Haskell package sets that provide every single [LTS Haskell](http://www.stackage.org/) release since version 0.0 as well as the most recent [Stackage Nightly](http://www.stackage.org/) snapshot. The announcement [\"Full Stackage Support in Nixpkgs\"](https://nixos.org/nix-dev/2015-September/018138.html) gives additional details.
+
+- Nix has been updated to version 1.10, which among other improvements enables cryptographic signatures on binary caches for improved security.
+
+- You can now keep your NixOS system up to date automatically by setting
+
+```nix
+{
+  system.autoUpgrade.enable = true;
+}
+```
+
+This will cause the system to periodically check for updates in your current channel and run `nixos-rebuild`.
+
+- This release is based on Glibc 2.21, GCC 4.9 and Linux 3.18.
+
+- GNOME has been upgraded to 3.16.
+
+- Xfce has been upgraded to 4.12.
+
+- KDE 5 has been upgraded to KDE Frameworks 5.10, Plasma 5.3.2 and Applications 15.04.3. KDE 4 has been updated to kdelibs-4.14.10.
+
+- E19 has been upgraded to 0.16.8.15.
+
+The following new services were added since the last release:
+
+- `services/mail/exim.nix`
+
+- `services/misc/apache-kafka.nix`
+
+- `services/misc/canto-daemon.nix`
+
+- `services/misc/confd.nix`
+
+- `services/misc/devmon.nix`
+
+- `services/misc/gitit.nix`
+
+- `services/misc/ihaskell.nix`
+
+- `services/misc/mbpfan.nix`
+
+- `services/misc/mediatomb.nix`
+
+- `services/misc/mwlib.nix`
+
+- `services/misc/parsoid.nix`
+
+- `services/misc/plex.nix`
+
+- `services/misc/ripple-rest.nix`
+
+- `services/misc/ripple-data-api.nix`
+
+- `services/misc/subsonic.nix`
+
+- `services/misc/sundtek.nix`
+
+- `services/monitoring/cadvisor.nix`
+
+- `services/monitoring/das_watchdog.nix`
+
+- `services/monitoring/grafana.nix`
+
+- `services/monitoring/riemann-tools.nix`
+
+- `services/monitoring/teamviewer.nix`
+
+- `services/network-filesystems/u9fs.nix`
+
+- `services/networking/aiccu.nix`
+
+- `services/networking/asterisk.nix`
+
+- `services/networking/bird.nix`
+
+- `services/networking/charybdis.nix`
+
+- `services/networking/docker-registry-server.nix`
+
+- `services/networking/fan.nix`
+
+- `services/networking/firefox/sync-server.nix`
+
+- `services/networking/gateone.nix`
+
+- `services/networking/heyefi.nix`
+
+- `services/networking/i2p.nix`
+
+- `services/networking/lambdabot.nix`
+
+- `services/networking/mstpd.nix`
+
+- `services/networking/nix-serve.nix`
+
+- `services/networking/nylon.nix`
+
+- `services/networking/racoon.nix`
+
+- `services/networking/skydns.nix`
+
+- `services/networking/shout.nix`
+
+- `services/networking/softether.nix`
+
+- `services/networking/sslh.nix`
+
+- `services/networking/tinc.nix`
+
+- `services/networking/tlsdated.nix`
+
+- `services/networking/tox-bootstrapd.nix`
+
+- `services/networking/tvheadend.nix`
+
+- `services/networking/zerotierone.nix`
+
+- `services/scheduling/marathon.nix`
+
+- `services/security/fprintd.nix`
+
+- `services/security/hologram.nix`
+
+- `services/security/munge.nix`
+
+- `services/system/cloud-init.nix`
+
+- `services/web-servers/shellinabox.nix`
+
+- `services/web-servers/uwsgi.nix`
+
+- `services/x11/unclutter.nix`
+
+- `services/x11/display-managers/sddm.nix`
+
+- `system/boot/coredump.nix`
+
+- `system/boot/loader/loader.nix`
+
+- `system/boot/loader/generic-extlinux-compatible`
+
+- `system/boot/networkd.nix`
+
+- `system/boot/resolved.nix`
+
+- `system/boot/timesyncd.nix`
+
+- `tasks/filesystems/exfat.nix`
+
+- `tasks/filesystems/ntfs.nix`
+
+- `tasks/filesystems/vboxsf.nix`
+
+- `virtualisation/virtualbox-host.nix`
+
+- `virtualisation/vmware-guest.nix`
+
+- `virtualisation/xen-dom0.nix`
+
+When upgrading from a previous release, please be aware of the following incompatible changes:
+
+- `sshd` no longer supports DSA and ECDSA host keys by default. If you have existing systems with such host keys and want to continue to use them, please set
+
+```nix
+{
+  system.stateVersion = "14.12";
+}
+```
+
+The new option `system.stateVersion` ensures that certain configuration changes that could break existing systems (such as the `sshd` host key setting) will maintain compatibility with the specified NixOS release. NixOps sets the state version of existing deployments automatically.
+
+- `cron` is no longer enabled by default, unless you have a non-empty `services.cron.systemCronJobs`. To force `cron` to be enabled, set `services.cron.enable = true`.
+
+- Nix now requires binary caches to be cryptographically signed. If you have unsigned binary caches that you want to continue to use, you should set `nix.requireSignedBinaryCaches = false`.
+
+- Steam now doesn\'t need root rights to work. Instead of using `*-steam-chrootenv`, you should now just run `steam`. `steamChrootEnv` package was renamed to `steam`, and old `steam` package \-- to `steamOriginal`.
+
+- CMPlayer has been renamed to bomi upstream. Package `cmplayer` was accordingly renamed to `bomi`
+
+- Atom Shell has been renamed to Electron upstream. Package `atom-shell` was accordingly renamed to `electron`
+
+- Elm is not released on Hackage anymore. You should now use `elmPackages.elm` which contains the latest Elm platform.
+
+- The CUPS printing service has been updated to version `2.0.2`. Furthermore its systemd service has been renamed to `cups.service`.
+
+  Local printers are no longer shared or advertised by default. This behavior can be changed by enabling `services.printing.defaultShared` or `services.printing.browsing` respectively.
+
+- The VirtualBox host and guest options have been named more consistently. They can now found in `virtualisation.virtualbox.host.*` instead of `services.virtualboxHost.*` and `virtualisation.virtualbox.guest.*` instead of `services.virtualboxGuest.*`.
+
+  Also, there now is support for the `vboxsf` file system using the `fileSystems` configuration attribute. An example of how this can be used in a configuration:
+
+```nix
+{
+  fileSystems."/shiny" = {
+    device = "myshinysharedfolder";
+    fsType = "vboxsf";
+  };
+}
+```
+
+- \"`nix-env -qa`\" no longer discovers Haskell packages by name. The only packages visible in the global scope are `ghc`, `cabal-install`, and `stack`, but all other packages are hidden. The reason for this inconvenience is the sheer size of the Haskell package set. Name-based lookups are expensive, and most `nix-env -qa` operations would become much slower if we\'d add the entire Hackage database into the top level attribute set. Instead, the list of Haskell packages can be displayed by running:
+
+```ShellSession
+nix-env -f "<nixpkgs>" -qaP -A haskellPackages
+```
+
+Executable programs written in Haskell can be installed with:
+
+```ShellSession
+nix-env -f "<nixpkgs>" -iA haskellPackages.pandoc
+```
+
+Installing Haskell _libraries_ this way, however, is no longer supported. See the next item for more details.
+
+- Previous versions of NixOS came with a feature called `ghc-wrapper`, a small script that allowed GHC to transparently pick up on libraries installed in the user\'s profile. This feature has been deprecated; `ghc-wrapper` was removed from the distribution. The proper way to register Haskell libraries with the compiler now is the `haskellPackages.ghcWithPackages` function. The [User\'s Guide to the Haskell Infrastructure](https://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure) provides more information about this subject.
+
+- All Haskell builds that have been generated with version 1.x of the `cabal2nix` utility are now invalid and need to be re-generated with a current version of `cabal2nix` to function. The most recent version of this tool can be installed by running `nix-env -i cabal2nix`.
+
+- The `haskellPackages` set in Nixpkgs used to have a function attribute called `extension` that users could override in their `~/.nixpkgs/config.nix` files to configure additional attributes, etc. That function still exists, but it\'s now called `overrides`.
+
+- The OpenBLAS library has been updated to version `0.2.14`. Support for the `x86_64-darwin` platform was added. Dynamic architecture detection was enabled; OpenBLAS now selects microarchitecture-optimized routines at runtime, so optimal performance is achieved without the need to rebuild OpenBLAS locally. OpenBLAS has replaced ATLAS in most packages which use an optimized BLAS or LAPACK implementation.
+
+- The `phpfpm` is now using the default PHP version (`pkgs.php`) instead of PHP 5.4 (`pkgs.php54`).
+
+- The `locate` service no longer indexes the Nix store by default, preventing packages with potentially numerous versions from cluttering the output. Indexing the store can be activated by setting `services.locate.includeStore = true`.
+
+- The Nix expression search path (`NIX_PATH`) no longer contains `/etc/nixos/nixpkgs` by default. You can override `NIX_PATH` by setting `nix.nixPath`.
+
+- Python 2.6 has been marked as broken (as it no longer receives security updates from upstream).
+
+- Any use of module arguments such as `pkgs` to access library functions, or to define `imports` attributes will now lead to an infinite loop at the time of the evaluation.
+
+  In case of an infinite loop, use the `--show-trace` command line argument and read the line just above the error message.
+
+  ```ShellSession
+  $ nixos-rebuild build --show-trace
+  …
+  while evaluating the module argument `pkgs' in "/etc/nixos/my-module.nix":
+  infinite recursion encountered
+  ```
+
+  Any use of `pkgs.lib`, should be replaced by `lib`, after adding it as argument of the module. The following module
+
+  ```nix
+  { config, pkgs, ... }:
+
+  with pkgs.lib;
+
+  {
+    options = {
+      foo = mkOption { … };
+    };
+    config = mkIf config.foo { … };
+  }
+  ```
+
+  should be modified to look like:
+
+  ```nix
+  { config, pkgs, lib, ... }:
+
+  with lib;
+
+  {
+    options = {
+      foo = mkOption { option declaration };
+    };
+    config = mkIf config.foo { option definition };
+  }
+  ```
+
+  When `pkgs` is used to download other projects to import their modules, and only in such cases, it should be replaced by `(import <nixpkgs> {})`. The following module
+
+  ```nix
+  { config, pkgs, ... }:
+
+  let
+    myProject = pkgs.fetchurl {
+      src = url;
+      sha256 = hash;
+    };
+  in
+
+  {
+    imports = [ "${myProject}/module.nix" ];
+  }
+  ```
+
+  should be modified to look like:
+
+  ```nix
+  { config, pkgs, ... }:
+
+  let
+    myProject = (import <nixpkgs> {}).fetchurl {
+      src = url;
+      sha256 = hash;
+    };
+  in
+
+  {
+    imports = [ "${myProject}/module.nix" ];
+  }
+  ```
+
+Other notable improvements:
+
+- The nixos and nixpkgs channels were unified, so one _can_ use `nix-env -iA nixos.bash` instead of `nix-env -iA nixos.pkgs.bash`. See [the commit](https://github.com/NixOS/nixpkgs/commit/2cd7c1f198) for details.
+
+- Users running an SSH server who worry about the quality of their `/etc/ssh/moduli` file with respect to the [vulnerabilities discovered in the Diffie-Hellman key exchange](https://stribika.github.io/2015/01/04/secure-secure-shell.html) can now replace OpenSSH\'s default version with one they generated themselves using the new `services.openssh.moduliFile` option.
+
+- A newly packaged TeX Live 2015 is provided in `pkgs.texlive`, split into 6500 nix packages. For basic user documentation see [the source](https://github.com/NixOS/nixpkgs/blob/release-15.09/pkgs/tools/typesetting/tex/texlive/default.nix#L1). Beware of [an issue](https://github.com/NixOS/nixpkgs/issues/9757) when installing a too large package set. The plan is to deprecate and maybe delete the original TeX packages until the next release.
+
+- `buildEnv.env` on all Python interpreters is now available for nix-shell interoperability.
diff --git a/nixos/doc/manual/release-notes/rl-1509.xml b/nixos/doc/manual/release-notes/rl-1509.xml
deleted file mode 100644
index 098c8c5095b2..000000000000
--- a/nixos/doc/manual/release-notes/rl-1509.xml
+++ /dev/null
@@ -1,750 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-15.09">
- <title>Release 15.09 (“Dingo”, 2015/09/30)</title>
-
- <para>
-  In addition to numerous new and upgraded packages, this release has the
-  following highlights:
- </para>
-
- <itemizedlist>
-  <listitem>
-   <para>
-    The <link xlink:href="http://haskell.org/">Haskell</link> packages
-    infrastructure has been re-designed from the ground up (&quot;Haskell
-    NG&quot;). NixOS now distributes the latest version of every single package
-    registered on
-    <link
-    xlink:href="http://hackage.haskell.org/">Hackage</link> -- well
-    in excess of 8,000 Haskell packages. Detailed instructions on how to use
-    that infrastructure can be found in the
-    <link
-    xlink:href="https://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure">User's
-    Guide to the Haskell Infrastructure</link>. Users migrating from an earlier
-    release may find helpful information below, in the list of
-    backwards-incompatible changes. Furthermore, we distribute 51(!) additional
-    Haskell package sets that provide every single
-    <link
-    xlink:href="http://www.stackage.org/">LTS Haskell</link> release
-    since version 0.0 as well as the most recent
-    <link
-    xlink:href="http://www.stackage.org/">Stackage Nightly</link>
-    snapshot. The announcement
-    <link
-    xlink:href="https://nixos.org/nix-dev/2015-September/018138.html">&quot;Full
-    Stackage Support in Nixpkgs&quot;</link> gives additional details.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Nix has been updated to version 1.10, which among other improvements
-    enables cryptographic signatures on binary caches for improved security.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    You can now keep your NixOS system up to date automatically by setting
-<programlisting>
-system.autoUpgrade.enable = true;
-</programlisting>
-    This will cause the system to periodically check for updates in your
-    current channel and run <command>nixos-rebuild</command>.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    This release is based on Glibc 2.21, GCC 4.9 and Linux 3.18.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    GNOME has been upgraded to 3.16.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Xfce has been upgraded to 4.12.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    KDE 5 has been upgraded to KDE Frameworks 5.10, Plasma 5.3.2 and
-    Applications 15.04.3. KDE 4 has been updated to kdelibs-4.14.10.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    E19 has been upgraded to 0.16.8.15.
-   </para>
-  </listitem>
- </itemizedlist>
-
- <para>
-  The following new services were added since the last release:
-  <itemizedlist>
-   <listitem>
-    <para>
-     <literal>services/mail/exim.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/apache-kafka.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/canto-daemon.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/confd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/devmon.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/gitit.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/ihaskell.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/mbpfan.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/mediatomb.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/mwlib.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/parsoid.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/plex.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/ripple-rest.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/ripple-data-api.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/subsonic.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/sundtek.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/monitoring/cadvisor.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/monitoring/das_watchdog.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/monitoring/grafana.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/monitoring/riemann-tools.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/monitoring/teamviewer.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/network-filesystems/u9fs.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/aiccu.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/asterisk.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/bird.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/charybdis.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/docker-registry-server.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/fan.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/firefox/sync-server.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/gateone.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/heyefi.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/i2p.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/lambdabot.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/mstpd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/nix-serve.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/nylon.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/racoon.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/skydns.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/shout.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/softether.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/sslh.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/tinc.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/tlsdated.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/tox-bootstrapd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/tvheadend.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/zerotierone.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/scheduling/marathon.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/security/fprintd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/security/hologram.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/security/munge.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/system/cloud-init.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/web-servers/shellinabox.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/web-servers/uwsgi.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/x11/unclutter.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/x11/display-managers/sddm.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>system/boot/coredump.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>system/boot/loader/loader.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>system/boot/loader/generic-extlinux-compatible</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>system/boot/networkd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>system/boot/resolved.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>system/boot/timesyncd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>tasks/filesystems/exfat.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>tasks/filesystems/ntfs.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>tasks/filesystems/vboxsf.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>virtualisation/virtualbox-host.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>virtualisation/vmware-guest.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>virtualisation/xen-dom0.nix</literal>
-    </para>
-   </listitem>
-  </itemizedlist>
- </para>
-
- <para>
-  When upgrading from a previous release, please be aware of the following
-  incompatible changes:
-  <itemizedlist>
-   <listitem>
-    <para>
-     <command>sshd</command> no longer supports DSA and ECDSA host keys by
-     default. If you have existing systems with such host keys and want to
-     continue to use them, please set
-<programlisting>
-system.stateVersion = "14.12";
-</programlisting>
-     The new option <option>system.stateVersion</option> ensures that certain
-     configuration changes that could break existing systems (such as the
-     <command>sshd</command> host key setting) will maintain compatibility with
-     the specified NixOS release. NixOps sets the state version of existing
-     deployments automatically.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <command>cron</command> is no longer enabled by default, unless you have a
-     non-empty <option>services.cron.systemCronJobs</option>. To force
-     <command>cron</command> to be enabled, set <option>services.cron.enable =
-     true</option>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Nix now requires binary caches to be cryptographically signed. If you have
-     unsigned binary caches that you want to continue to use, you should set
-     <option>nix.requireSignedBinaryCaches = false</option>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Steam now doesn't need root rights to work. Instead of using
-     <literal>*-steam-chrootenv</literal>, you should now just run
-     <literal>steam</literal>. <literal>steamChrootEnv</literal> package was
-     renamed to <literal>steam</literal>, and old <literal>steam</literal>
-     package -- to <literal>steamOriginal</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     CMPlayer has been renamed to bomi upstream. Package
-     <literal>cmplayer</literal> was accordingly renamed to
-     <literal>bomi</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Atom Shell has been renamed to Electron upstream. Package
-     <literal>atom-shell</literal> was accordingly renamed to
-     <literal>electron</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Elm is not released on Hackage anymore. You should now use
-     <literal>elmPackages.elm</literal> which contains the latest Elm platform.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The CUPS printing service has been updated to version
-     <literal>2.0.2</literal>. Furthermore its systemd service has been renamed
-     to <literal>cups.service</literal>.
-    </para>
-    <para>
-     Local printers are no longer shared or advertised by default. This
-     behavior can be changed by enabling
-     <option>services.printing.defaultShared</option> or
-     <option>services.printing.browsing</option> respectively.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The VirtualBox host and guest options have been named more consistently.
-     They can now found in <option>virtualisation.virtualbox.host.*</option>
-     instead of <option>services.virtualboxHost.*</option> and
-     <option>virtualisation.virtualbox.guest.*</option> instead of
-     <option>services.virtualboxGuest.*</option>.
-    </para>
-    <para>
-     Also, there now is support for the <literal>vboxsf</literal> file system
-     using the <option>fileSystems</option> configuration attribute. An example
-     of how this can be used in a configuration:
-<programlisting>
-fileSystems."/shiny" = {
-  device = "myshinysharedfolder";
-  fsType = "vboxsf";
-};
-</programlisting>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     &quot;<literal>nix-env -qa</literal>&quot; no longer discovers Haskell
-     packages by name. The only packages visible in the global scope are
-     <literal>ghc</literal>, <literal>cabal-install</literal>, and
-     <literal>stack</literal>, but all other packages are hidden. The reason
-     for this inconvenience is the sheer size of the Haskell package set.
-     Name-based lookups are expensive, and most <literal>nix-env -qa</literal>
-     operations would become much slower if we'd add the entire Hackage
-     database into the top level attribute set. Instead, the list of Haskell
-     packages can be displayed by running:
-    </para>
-<programlisting>
-nix-env -f &quot;&lt;nixpkgs&gt;&quot; -qaP -A haskellPackages
-</programlisting>
-    <para>
-     Executable programs written in Haskell can be installed with:
-    </para>
-<programlisting>
-nix-env -f &quot;&lt;nixpkgs&gt;&quot; -iA haskellPackages.pandoc
-</programlisting>
-    <para>
-     Installing Haskell <emphasis>libraries</emphasis> this way, however, is no
-     longer supported. See the next item for more details.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Previous versions of NixOS came with a feature called
-     <literal>ghc-wrapper</literal>, a small script that allowed GHC to
-     transparently pick up on libraries installed in the user's profile. This
-     feature has been deprecated; <literal>ghc-wrapper</literal> was removed
-     from the distribution. The proper way to register Haskell libraries with
-     the compiler now is the <literal>haskellPackages.ghcWithPackages</literal>
-     function. The
-     <link
-    xlink:href="https://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure">User's
-     Guide to the Haskell Infrastructure</link> provides more information about
-     this subject.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     All Haskell builds that have been generated with version 1.x of the
-     <literal>cabal2nix</literal> utility are now invalid and need to be
-     re-generated with a current version of <literal>cabal2nix</literal> to
-     function. The most recent version of this tool can be installed by running
-     <literal>nix-env -i cabal2nix</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>haskellPackages</literal> set in Nixpkgs used to have a
-     function attribute called <literal>extension</literal> that users could
-     override in their <literal>~/.nixpkgs/config.nix</literal> files to
-     configure additional attributes, etc. That function still exists, but it's
-     now called <literal>overrides</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The OpenBLAS library has been updated to version
-     <literal>0.2.14</literal>. Support for the
-     <literal>x86_64-darwin</literal> platform was added. Dynamic architecture
-     detection was enabled; OpenBLAS now selects microarchitecture-optimized
-     routines at runtime, so optimal performance is achieved without the need
-     to rebuild OpenBLAS locally. OpenBLAS has replaced ATLAS in most packages
-     which use an optimized BLAS or LAPACK implementation.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>phpfpm</literal> is now using the default PHP version
-     (<literal>pkgs.php</literal>) instead of PHP 5.4
-     (<literal>pkgs.php54</literal>).
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>locate</literal> service no longer indexes the Nix store by
-     default, preventing packages with potentially numerous versions from
-     cluttering the output. Indexing the store can be activated by setting
-     <option>services.locate.includeStore = true</option>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The Nix expression search path (<envar>NIX_PATH</envar>) no longer
-     contains <filename>/etc/nixos/nixpkgs</filename> by default. You can
-     override <envar>NIX_PATH</envar> by setting <option>nix.nixPath</option>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Python 2.6 has been marked as broken (as it no longer receives security
-     updates from upstream).
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Any use of module arguments such as <varname>pkgs</varname> to access
-     library functions, or to define <literal>imports</literal> attributes will
-     now lead to an infinite loop at the time of the evaluation.
-    </para>
-    <para>
-     In case of an infinite loop, use the <command>--show-trace</command>
-     command line argument and read the line just above the error message.
-<screen>
-<prompt>$ </prompt>nixos-rebuild build --show-trace
-…
-while evaluating the module argument `pkgs' in "/etc/nixos/my-module.nix":
-infinite recursion encountered
-</screen>
-    </para>
-    <para>
-     Any use of <literal>pkgs.lib</literal>, should be replaced by
-     <varname>lib</varname>, after adding it as argument of the module. The
-     following module
-<programlisting>
-{ config, pkgs, ... }:
-
-with pkgs.lib;
-
-{
-  options = {
-    foo = mkOption { … };
-  };
-  config = mkIf config.foo { … };
-}
-</programlisting>
-     should be modified to look like:
-<programlisting>
-{ config, pkgs, lib, ... }:
-
-with lib;
-
-{
-  options = {
-    foo = mkOption { <replaceable>option declaration</replaceable> };
-  };
-  config = mkIf config.foo { <replaceable>option definition</replaceable> };
-}
-</programlisting>
-    </para>
-    <para>
-     When <varname>pkgs</varname> is used to download other projects to import
-     their modules, and only in such cases, it should be replaced by
-     <literal>(import &lt;nixpkgs&gt; {})</literal>. The following module
-<programlisting>
-{ config, pkgs, ... }:
-
-let
-  myProject = pkgs.fetchurl {
-    src = <replaceable>url</replaceable>;
-    sha256 = <replaceable>hash</replaceable>;
-  };
-in
-
-{
-  imports = [ "${myProject}/module.nix" ];
-}
-</programlisting>
-     should be modified to look like:
-<programlisting>
-{ config, pkgs, ... }:
-
-let
-  myProject = (import &lt;nixpkgs&gt; {}).fetchurl {
-    src = <replaceable>url</replaceable>;
-    sha256 = <replaceable>hash</replaceable>;
-  };
-in
-
-{
-  imports = [ "${myProject}/module.nix" ];
-}
-</programlisting>
-    </para>
-   </listitem>
-  </itemizedlist>
- </para>
-
- <para>
-  Other notable improvements:
-  <itemizedlist>
-   <listitem>
-    <para>
-     The nixos and nixpkgs channels were unified, so one
-     <emphasis>can</emphasis> use <literal>nix-env -iA nixos.bash</literal>
-     instead of <literal>nix-env -iA nixos.pkgs.bash</literal>. See
-     <link xlink:href="https://github.com/NixOS/nixpkgs/commit/2cd7c1f198">the
-     commit</link> for details.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Users running an SSH server who worry about the quality of their
-     <literal>/etc/ssh/moduli</literal> file with respect to the
-     <link
-      xlink:href="https://stribika.github.io/2015/01/04/secure-secure-shell.html">vulnerabilities
-     discovered in the Diffie-Hellman key exchange</link> can now replace
-     OpenSSH's default version with one they generated themselves using the new
-     <option>services.openssh.moduliFile</option> option.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     A newly packaged TeX Live 2015 is provided in
-     <literal>pkgs.texlive</literal>, split into 6500 nix packages. For basic
-     user documentation see
-     <link xlink:href="https://github.com/NixOS/nixpkgs/blob/release-15.09/pkgs/tools/typesetting/tex/texlive/default.nix#L1"
-      >the
-     source</link>. Beware of
-     <link xlink:href="https://github.com/NixOS/nixpkgs/issues/9757"
-      >an
-     issue</link> when installing a too large package set. The plan is to
-     deprecate and maybe delete the original TeX packages until the next
-     release.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <option>buildEnv.env</option> on all Python interpreters is now available
-     for nix-shell interoperability.
-    </para>
-   </listitem>
-  </itemizedlist>
- </para>
-</section>
diff --git a/nixos/doc/manual/release-notes/rl-1603.section.md b/nixos/doc/manual/release-notes/rl-1603.section.md
new file mode 100644
index 000000000000..dce879ec16d0
--- /dev/null
+++ b/nixos/doc/manual/release-notes/rl-1603.section.md
@@ -0,0 +1,282 @@
+# Release 16.03 ("Emu", 2016/03/31) {#sec-release-16.03}
+
+In addition to numerous new and upgraded packages, this release has the following highlights:
+
+- Systemd 229, bringing [numerous improvements](https://github.com/systemd/systemd/blob/v229/NEWS) over 217.
+
+- Linux 4.4 (was 3.18).
+
+- GCC 5.3 (was 4.9). Note that GCC 5 [changes the C++ ABI in an incompatible way](https://gcc.gnu.org/onlinedocs/libstdc++/manual/using_dual_abi.html); this may cause problems if you try to link objects compiled with different versions of GCC.
+
+- Glibc 2.23 (was 2.21).
+
+- Binutils 2.26 (was 2.23.1). See \#909
+
+- Improved support for ensuring [bitwise reproducible builds](https://reproducible-builds.org/). For example, `stdenv` now sets the environment variable `SOURCE_DATE_EPOCH` to a deterministic value, and Nix has [gained an option](https://nixos.org/nix/manual/#ssec-relnotes-1.11) to repeat a build a number of times to test determinism. An ongoing project, the goal of exact reproducibility is to allow binaries to be verified independently (e.g., a user might only trust binaries that appear in three independent binary caches).
+
+- Perl 5.22.
+
+The following new services were added since the last release:
+
+- `services/monitoring/longview.nix`
+
+- `hardware/video/webcam/facetimehd.nix`
+
+- `i18n/input-method/default.nix`
+
+- `i18n/input-method/fcitx.nix`
+
+- `i18n/input-method/ibus.nix`
+
+- `i18n/input-method/nabi.nix`
+
+- `i18n/input-method/uim.nix`
+
+- `programs/fish.nix`
+
+- `security/acme.nix`
+
+- `security/audit.nix`
+
+- `security/oath.nix`
+
+- `services/hardware/irqbalance.nix`
+
+- `services/mail/dspam.nix`
+
+- `services/mail/opendkim.nix`
+
+- `services/mail/postsrsd.nix`
+
+- `services/mail/rspamd.nix`
+
+- `services/mail/rmilter.nix`
+
+- `services/misc/autofs.nix`
+
+- `services/misc/bepasty.nix`
+
+- `services/misc/calibre-server.nix`
+
+- `services/misc/cfdyndns.nix`
+
+- `services/misc/gammu-smsd.nix`
+
+- `services/misc/mathics.nix`
+
+- `services/misc/matrix-synapse.nix`
+
+- `services/misc/octoprint.nix`
+
+- `services/monitoring/hdaps.nix`
+
+- `services/monitoring/heapster.nix`
+
+- `services/monitoring/longview.nix`
+
+- `services/network-filesystems/netatalk.nix`
+
+- `services/network-filesystems/xtreemfs.nix`
+
+- `services/networking/autossh.nix`
+
+- `services/networking/dnschain.nix`
+
+- `services/networking/gale.nix`
+
+- `services/networking/miniupnpd.nix`
+
+- `services/networking/namecoind.nix`
+
+- `services/networking/ostinato.nix`
+
+- `services/networking/pdnsd.nix`
+
+- `services/networking/shairport-sync.nix`
+
+- `services/networking/supplicant.nix`
+
+- `services/search/kibana.nix`
+
+- `services/security/haka.nix`
+
+- `services/security/physlock.nix`
+
+- `services/web-apps/pump.io.nix`
+
+- `services/x11/hardware/libinput.nix`
+
+- `services/x11/window-managers/windowlab.nix`
+
+- `system/boot/initrd-network.nix`
+
+- `system/boot/initrd-ssh.nix`
+
+- `system/boot/loader/loader.nix`
+
+- `system/boot/networkd.nix`
+
+- `system/boot/resolved.nix`
+
+- `virtualisation/lxd.nix`
+
+- `virtualisation/rkt.nix`
+
+When upgrading from a previous release, please be aware of the following incompatible changes:
+
+- We no longer produce graphical ISO images and VirtualBox images for `i686-linux`. A minimal ISO image is still provided.
+
+- Firefox and similar browsers are now _wrapped by default_. The package and attribute names are plain `firefox` or `midori`, etc. Backward-compatibility attributes were set up, but note that `nix-env -u` will _not_ update your current `firefox-with-plugins`; you have to uninstall it and install `firefox` instead.
+
+- `wmiiSnap` has been replaced with `wmii_hg`, but `services.xserver.windowManager.wmii.enable` has been updated respectively so this only affects you if you have explicitly installed `wmiiSnap`.
+
+- `jobs` NixOS option has been removed. It served as compatibility layer between Upstart jobs and SystemD services. All services have been rewritten to use `systemd.services`
+
+- `wmiimenu` is removed, as it has been removed by the developers upstream. Use `wimenu` from the `wmii-hg` package.
+
+- Gitit is no longer automatically added to the module list in NixOS and as such there will not be any manual entries for it. You will need to add an import statement to your NixOS configuration in order to use it, e.g.
+
+  ```nix
+  {
+    imports = [ <nixpkgs/nixos/modules/services/misc/gitit.nix> ];
+  }
+  ```
+
+  will include the Gitit service configuration options.
+
+- `nginx` does not accept flags for enabling and disabling modules anymore. Instead it accepts `modules` argument, which is a list of modules to be built in. All modules now reside in `nginxModules` set. Example configuration:
+
+  ```nix
+  nginx.override {
+    modules = [ nginxModules.rtmp nginxModules.dav nginxModules.moreheaders ];
+  }
+  ```
+
+- `s3sync` is removed, as it hasn\'t been developed by upstream for 4 years and only runs with ruby 1.8. For an actively-developer alternative look at `tarsnap` and others.
+
+- `ruby_1_8` has been removed as it\'s not supported from upstream anymore and probably contains security issues.
+
+- `tidy-html5` package is removed. Upstream only provided `(lib)tidy5` during development, and now they went back to `(lib)tidy` to work as a drop-in replacement of the original package that has been unmaintained for years. You can (still) use the `html-tidy` package, which got updated to a stable release from this new upstream.
+
+- `extraDeviceOptions` argument is removed from `bumblebee` package. Instead there are now two separate arguments: `extraNvidiaDeviceOptions` and `extraNouveauDeviceOptions` for setting extra X11 options for nvidia and nouveau drivers, respectively.
+
+- The `Ctrl+Alt+Backspace` key combination no longer kills the X server by default. There\'s a new option `services.xserver.enableCtrlAltBackspace` allowing to enable the combination again.
+
+- `emacsPackagesNg` now contains all packages from the ELPA, MELPA, and MELPA Stable repositories.
+
+- Data directory for Postfix MTA server is moved from `/var/postfix` to `/var/lib/postfix`. Old configurations are migrated automatically. `service.postfix` module has also received many improvements, such as correct directories\' access rights, new `aliasFiles` and `mapFiles` options and more.
+
+- Filesystem options should now be configured as a list of strings, not a comma-separated string. The old style will continue to work, but print a warning, until the 16.09 release. An example of the new style:
+
+  ```nix
+  {
+    fileSystems."/example" = {
+      device = "/dev/sdc";
+      fsType = "btrfs";
+      options = [ "noatime" "compress=lzo" "space_cache" "autodefrag" ];
+    };
+  }
+  ```
+
+- CUPS, installed by `services.printing` module, now has its data directory in `/var/lib/cups`. Old configurations from `/etc/cups` are moved there automatically, but there might be problems. Also configuration options `services.printing.cupsdConf` and `services.printing.cupsdFilesConf` were removed because they had been allowing one to override configuration variables required for CUPS to work at all on NixOS. For most use cases, `services.printing.extraConf` and new option `services.printing.extraFilesConf` should be enough; if you encounter a situation when they are not, please file a bug.
+
+  There are also Gutenprint improvements; in particular, a new option `services.printing.gutenprint` is added to enable automatic updating of Gutenprint PPMs; it\'s greatly recommended to enable it instead of adding `gutenprint` to the `drivers` list.
+
+- `services.xserver.vaapiDrivers` has been removed. Use `hardware.opengl.extraPackages{,32}` instead. You can also specify VDPAU drivers there.
+
+- `programs.ibus` moved to `i18n.inputMethod.ibus`. The option `programs.ibus.plugins` changed to `i18n.inputMethod.ibus.engines` and the option to enable ibus changed from `programs.ibus.enable` to `i18n.inputMethod.enabled`. `i18n.inputMethod.enabled` should be set to the used input method name, `"ibus"` for ibus. An example of the new style:
+
+  ```nix
+  {
+    i18n.inputMethod.enabled = "ibus";
+    i18n.inputMethod.ibus.engines = with pkgs.ibus-engines; [ anthy mozc ];
+  }
+  ```
+
+  That is equivalent to the old version:
+
+  ```nix
+  {
+    programs.ibus.enable = true;
+    programs.ibus.plugins = with pkgs; [ ibus-anthy mozc ];
+  }
+  ```
+
+- `services.udev.extraRules` option now writes rules to `99-local.rules` instead of `10-local.rules`. This makes all the user rules apply after others, so their results wouldn\'t be overriden by anything else.
+
+- Large parts of the `services.gitlab` module has been been rewritten. There are new configuration options available. The `stateDir` option was renamned to `statePath` and the `satellitesDir` option was removed. Please review the currently available options.
+
+- The option `services.nsd.zones.<name>.data` no longer interpret the dollar sign (\$) as a shell variable, as such it should not be escaped anymore. Thus the following zone data:
+
+  ```dns-zone
+  $ORIGIN example.com.
+  $TTL 1800
+  @       IN      SOA     ns1.vpn.nbp.name.      admin.example.com. (
+
+  ```
+
+  Should modified to look like the actual file expected by nsd:
+
+  ```dns-zone
+  $ORIGIN example.com.
+  $TTL 1800
+  @       IN      SOA     ns1.vpn.nbp.name.      admin.example.com. (
+
+  ```
+
+- `service.syncthing.dataDir` options now has to point to exact folder where syncthing is writing to. Example configuration should look something like:
+
+  ```nix
+  {
+    services.syncthing = {
+        enable = true;
+        dataDir = "/home/somebody/.syncthing";
+        user = "somebody";
+    };
+  }
+  ```
+
+- `networking.firewall.allowPing` is now enabled by default. Users are encouraged to configure an appropriate rate limit for their machines using the Kernel interface at `/proc/sys/net/ipv4/icmp_ratelimit` and `/proc/sys/net/ipv6/icmp/ratelimit` or using the firewall itself, i.e. by setting the NixOS option `networking.firewall.pingLimit`.
+
+- Systems with some broadcom cards used to result into a generated config that is no longer accepted. If you get errors like
+
+  ```ShellSession
+  error: path ‘/nix/store/*-broadcom-sta-*’ does not exist and cannot be created
+  ```
+
+  you should either re-run `nixos-generate-config` or manually replace `"${config.boot.kernelPackages.broadcom_sta}"` by `config.boot.kernelPackages.broadcom_sta` in your `/etc/nixos/hardware-configuration.nix`. More discussion is on [ the github issue](https://github.com/NixOS/nixpkgs/pull/12595).
+
+- The `services.xserver.startGnuPGAgent` option has been removed. GnuPG 2.1.x changed the way the gpg-agent works, and that new approach no longer requires (or even supports) the \"start everything as a child of the agent\" scheme we\'ve implemented in NixOS for older versions. To configure the gpg-agent for your X session, add the following code to `~/.bashrc` or some file that's sourced when your shell is started:
+
+  ```shell
+  GPG_TTY=$(tty)
+  export GPG_TTY
+  ```
+
+  If you want to use gpg-agent for SSH, too, add the following to your session initialization (e.g. `displayManager.sessionCommands`)
+
+  ```shell
+      gpg-connect-agent /bye
+      unset SSH_AGENT_PID
+      export SSH_AUTH_SOCK="''${HOME}/.gnupg/S.gpg-agent.ssh"
+  ```
+
+  and make sure that
+
+  ```conf
+      enable-ssh-support
+  ```
+
+  is included in your `~/.gnupg/gpg-agent.conf`. You will need to use `ssh-add` to re-add your ssh keys. If gpg's automatic transformation of the private keys to the new format fails, you will need to re-import your private keyring as well:
+
+  ```ShellSession
+      gpg --import ~/.gnupg/secring.gpg
+  ```
+
+  The `gpg-agent(1)` man page has more details about this subject, i.e. in the \"EXAMPLES\" section.
+
+Other notable improvements:
+
+- `ejabberd` module is brought back and now works on NixOS.
+
+- Input method support was improved. New NixOS modules (fcitx, nabi and uim), fcitx engines (chewing, hangul, m17n, mozc and table-other) and ibus engines (hangul and m17n) have been added.
diff --git a/nixos/doc/manual/release-notes/rl-1603.xml b/nixos/doc/manual/release-notes/rl-1603.xml
deleted file mode 100644
index 6d4b28825fa9..000000000000
--- a/nixos/doc/manual/release-notes/rl-1603.xml
+++ /dev/null
@@ -1,671 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-16.03">
- <title>Release 16.03 (“Emu”, 2016/03/31)</title>
-
- <para>
-  In addition to numerous new and upgraded packages, this release has the
-  following highlights:
- </para>
-
- <itemizedlist>
-  <listitem>
-   <para>
-    Systemd 229, bringing
-    <link
-    xlink:href="https://github.com/systemd/systemd/blob/v229/NEWS">numerous
-    improvements</link> over 217.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Linux 4.4 (was 3.18).
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    GCC 5.3 (was 4.9). Note that GCC 5
-    <link
-    xlink:href="https://gcc.gnu.org/onlinedocs/libstdc++/manual/using_dual_abi.html">changes
-    the C++ ABI in an incompatible way</link>; this may cause problems if you
-    try to link objects compiled with different versions of GCC.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Glibc 2.23 (was 2.21).
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Binutils 2.26 (was 2.23.1). See #909
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Improved support for ensuring
-    <link
-    xlink:href="https://reproducible-builds.org/">bitwise
-    reproducible builds</link>. For example, <literal>stdenv</literal> now sets
-    the environment variable
-    <envar
-    xlink:href="https://reproducible-builds.org/specs/source-date-epoch/">SOURCE_DATE_EPOCH</envar>
-    to a deterministic value, and Nix has
-    <link
-    xlink:href="https://nixos.org/nix/manual/#ssec-relnotes-1.11">gained
-    an option</link> to repeat a build a number of times to test determinism.
-    An ongoing project, the goal of exact reproducibility is to allow binaries
-    to be verified independently (e.g., a user might only trust binaries that
-    appear in three independent binary caches).
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Perl 5.22.
-   </para>
-  </listitem>
- </itemizedlist>
-
- <para>
-  The following new services were added since the last release:
-  <itemizedlist>
-   <listitem>
-    <para>
-     <literal>services/monitoring/longview.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>hardware/video/webcam/facetimehd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>i18n/input-method/default.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>i18n/input-method/fcitx.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>i18n/input-method/ibus.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>i18n/input-method/nabi.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>i18n/input-method/uim.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>programs/fish.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>security/acme.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>security/audit.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>security/oath.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/hardware/irqbalance.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/mail/dspam.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/mail/opendkim.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/mail/postsrsd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/mail/rspamd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/mail/rmilter.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/autofs.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/bepasty.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/calibre-server.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/cfdyndns.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/gammu-smsd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/mathics.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/matrix-synapse.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/octoprint.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/monitoring/hdaps.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/monitoring/heapster.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/monitoring/longview.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/network-filesystems/netatalk.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/network-filesystems/xtreemfs.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/autossh.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/dnschain.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/gale.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/miniupnpd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/namecoind.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/ostinato.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/pdnsd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/shairport-sync.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/supplicant.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/search/kibana.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/security/haka.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/security/physlock.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/web-apps/pump.io.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/x11/hardware/libinput.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/x11/window-managers/windowlab.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>system/boot/initrd-network.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>system/boot/initrd-ssh.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>system/boot/loader/loader.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>system/boot/networkd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>system/boot/resolved.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>virtualisation/lxd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>virtualisation/rkt.nix</literal>
-    </para>
-   </listitem>
-  </itemizedlist>
- </para>
-
- <para>
-  When upgrading from a previous release, please be aware of the following
-  incompatible changes:
- </para>
-
- <itemizedlist>
-  <listitem>
-   <para>
-    We no longer produce graphical ISO images and VirtualBox images for
-    <literal>i686-linux</literal>. A minimal ISO image is still provided.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Firefox and similar browsers are now <emphasis>wrapped by
-    default</emphasis>. The package and attribute names are plain
-    <literal>firefox</literal> or <literal>midori</literal>, etc.
-    Backward-compatibility attributes were set up, but note that
-    <command>nix-env -u</command> will <emphasis>not</emphasis> update your
-    current <literal>firefox-with-plugins</literal>; you have to uninstall it
-    and install <literal>firefox</literal> instead.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    <command>wmiiSnap</command> has been replaced with
-    <command>wmii_hg</command>, but
-    <command>services.xserver.windowManager.wmii.enable</command> has been
-    updated respectively so this only affects you if you have explicitly
-    installed <command>wmiiSnap</command>.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    <literal>jobs</literal> NixOS option has been removed. It served as
-    compatibility layer between Upstart jobs and SystemD services. All services
-    have been rewritten to use <literal>systemd.services</literal>
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    <command>wmiimenu</command> is removed, as it has been removed by the
-    developers upstream. Use <command>wimenu</command> from the
-    <command>wmii-hg</command> package.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Gitit is no longer automatically added to the module list in NixOS and as
-    such there will not be any manual entries for it. You will need to add an
-    import statement to your NixOS configuration in order to use it, e.g.
-<programlisting><![CDATA[
-{
-  imports = [ <nixpkgs/nixos/modules/services/misc/gitit.nix> ];
-}
-]]></programlisting>
-    will include the Gitit service configuration options.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    <command>nginx</command> does not accept flags for enabling and disabling
-    modules anymore. Instead it accepts <literal>modules</literal> argument,
-    which is a list of modules to be built in. All modules now reside in
-    <literal>nginxModules</literal> set. Example configuration:
-<programlisting><![CDATA[
-nginx.override {
-  modules = [ nginxModules.rtmp nginxModules.dav nginxModules.moreheaders ];
-}
-]]></programlisting>
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    <command>s3sync</command> is removed, as it hasn't been developed by
-    upstream for 4 years and only runs with ruby 1.8. For an actively-developer
-    alternative look at <command>tarsnap</command> and others.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    <command>ruby_1_8</command> has been removed as it's not supported from
-    upstream anymore and probably contains security issues.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    <literal>tidy-html5</literal> package is removed. Upstream only provided
-    <literal>(lib)tidy5</literal> during development, and now they went back to
-    <literal>(lib)tidy</literal> to work as a drop-in replacement of the
-    original package that has been unmaintained for years. You can (still) use
-    the <literal>html-tidy</literal> package, which got updated to a stable
-    release from this new upstream.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    <literal>extraDeviceOptions</literal> argument is removed from
-    <literal>bumblebee</literal> package. Instead there are now two separate
-    arguments: <literal>extraNvidiaDeviceOptions</literal> and
-    <literal>extraNouveauDeviceOptions</literal> for setting extra X11 options
-    for nvidia and nouveau drivers, respectively.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    The <literal>Ctrl+Alt+Backspace</literal> key combination no longer kills
-    the X server by default. There's a new option
-    <option>services.xserver.enableCtrlAltBackspace</option> allowing to enable
-    the combination again.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    <literal>emacsPackagesNg</literal> now contains all packages from the ELPA,
-    MELPA, and MELPA Stable repositories.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Data directory for Postfix MTA server is moved from
-    <filename>/var/postfix</filename> to <filename>/var/lib/postfix</filename>.
-    Old configurations are migrated automatically.
-    <literal>service.postfix</literal> module has also received many
-    improvements, such as correct directories' access rights, new
-    <literal>aliasFiles</literal> and <literal>mapFiles</literal> options and
-    more.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Filesystem options should now be configured as a list of strings, not a
-    comma-separated string. The old style will continue to work, but print a
-    warning, until the 16.09 release. An example of the new style:
-<programlisting>
-fileSystems."/example" = {
-  device = "/dev/sdc";
-  fsType = "btrfs";
-  options = [ "noatime" "compress=lzo" "space_cache" "autodefrag" ];
-};
-</programlisting>
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    CUPS, installed by <literal>services.printing</literal> module, now has its
-    data directory in <filename>/var/lib/cups</filename>. Old configurations
-    from <filename>/etc/cups</filename> are moved there automatically, but
-    there might be problems. Also configuration options
-    <literal>services.printing.cupsdConf</literal> and
-    <literal>services.printing.cupsdFilesConf</literal> were removed because
-    they had been allowing one to override configuration variables required for
-    CUPS to work at all on NixOS. For most use cases,
-    <literal>services.printing.extraConf</literal> and new option
-    <literal>services.printing.extraFilesConf</literal> should be enough; if
-    you encounter a situation when they are not, please file a bug.
-   </para>
-   <para>
-    There are also Gutenprint improvements; in particular, a new option
-    <literal>services.printing.gutenprint</literal> is added to enable
-    automatic updating of Gutenprint PPMs; it's greatly recommended to enable
-    it instead of adding <literal>gutenprint</literal> to the
-    <literal>drivers</literal> list.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    <literal>services.xserver.vaapiDrivers</literal> has been removed. Use
-    <literal>hardware.opengl.extraPackages{,32}</literal> instead. You can also
-    specify VDPAU drivers there.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    <literal>programs.ibus</literal> moved to
-    <literal>i18n.inputMethod.ibus</literal>. The option
-    <literal>programs.ibus.plugins</literal> changed to
-    <literal>i18n.inputMethod.ibus.engines</literal> and the option to enable
-    ibus changed from <literal>programs.ibus.enable</literal> to
-    <literal>i18n.inputMethod.enabled</literal>.
-    <literal>i18n.inputMethod.enabled</literal> should be set to the used input
-    method name, <literal>"ibus"</literal> for ibus. An example of the new
-    style:
-<programlisting>
-i18n.inputMethod.enabled = "ibus";
-i18n.inputMethod.ibus.engines = with pkgs.ibus-engines; [ anthy mozc ];
-</programlisting>
-    That is equivalent to the old version:
-<programlisting>
-programs.ibus.enable = true;
-programs.ibus.plugins = with pkgs; [ ibus-anthy mozc ];
-</programlisting>
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    <literal>services.udev.extraRules</literal> option now writes rules to
-    <filename>99-local.rules</filename> instead of
-    <filename>10-local.rules</filename>. This makes all the user rules apply
-    after others, so their results wouldn't be overriden by anything else.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Large parts of the <literal>services.gitlab</literal> module has been been
-    rewritten. There are new configuration options available. The
-    <literal>stateDir</literal> option was renamned to
-    <literal>statePath</literal> and the <literal>satellitesDir</literal>
-    option was removed. Please review the currently available options.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    The option <option>services.nsd.zones.&lt;name&gt;.data</option> no longer
-    interpret the dollar sign ($) as a shell variable, as such it should not be
-    escaped anymore. Thus the following zone data:
-   </para>
-<programlisting>
-\$ORIGIN example.com.
-\$TTL 1800
-@       IN      SOA     ns1.vpn.nbp.name.      admin.example.com. (
-    </programlisting>
-   <para>
-    Should modified to look like the actual file expected by nsd:
-   </para>
-<programlisting>
-$ORIGIN example.com.
-$TTL 1800
-@       IN      SOA     ns1.vpn.nbp.name.      admin.example.com. (
-    </programlisting>
-  </listitem>
-  <listitem>
-   <para>
-    <literal>service.syncthing.dataDir</literal> options now has to point to
-    exact folder where syncthing is writing to. Example configuration should
-    look something like:
-   </para>
-<programlisting>
-services.syncthing = {
-    enable = true;
-    dataDir = "/home/somebody/.syncthing";
-    user = "somebody";
-};
-    </programlisting>
-  </listitem>
-  <listitem>
-   <para>
-    <literal>networking.firewall.allowPing</literal> is now enabled by default.
-    Users are encouraged to configure an appropriate rate limit for their
-    machines using the Kernel interface at
-    <filename>/proc/sys/net/ipv4/icmp_ratelimit</filename> and
-    <filename>/proc/sys/net/ipv6/icmp/ratelimit</filename> or using the
-    firewall itself, i.e. by setting the NixOS option
-    <literal>networking.firewall.pingLimit</literal>.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Systems with some broadcom cards used to result into a generated config
-    that is no longer accepted. If you get errors like
-<screen>error: path ‘/nix/store/*-broadcom-sta-*’ does not exist and cannot be created</screen>
-    you should either re-run <command>nixos-generate-config</command> or
-    manually replace
-    <literal>"${config.boot.kernelPackages.broadcom_sta}"</literal> by
-    <literal>config.boot.kernelPackages.broadcom_sta</literal> in your
-    <filename>/etc/nixos/hardware-configuration.nix</filename>. More discussion
-    is on <link xlink:href="https://github.com/NixOS/nixpkgs/pull/12595"> the
-    github issue</link>.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    The <literal>services.xserver.startGnuPGAgent</literal> option has been
-    removed. GnuPG 2.1.x changed the way the gpg-agent works, and that new
-    approach no longer requires (or even supports) the "start everything as a
-    child of the agent" scheme we've implemented in NixOS for older versions.
-    To configure the gpg-agent for your X session, add the following code to
-    <filename>~/.bashrc</filename> or some file that’s sourced when your
-    shell is started:
-<programlisting>
-GPG_TTY=$(tty)
-export GPG_TTY
-    </programlisting>
-    If you want to use gpg-agent for SSH, too, add the following to your
-    session initialization (e.g.
-    <literal>displayManager.sessionCommands</literal>)
-<programlisting>
-gpg-connect-agent /bye
-unset SSH_AGENT_PID
-export SSH_AUTH_SOCK="''${HOME}/.gnupg/S.gpg-agent.ssh"
-    </programlisting>
-    and make sure that
-<programlisting>
-enable-ssh-support
-    </programlisting>
-    is included in your <filename>~/.gnupg/gpg-agent.conf</filename>. You will
-    need to use <command>ssh-add</command> to re-add your ssh keys. If gpg’s
-    automatic transformation of the private keys to the new format fails, you
-    will need to re-import your private keyring as well:
-<programlisting>
-gpg --import ~/.gnupg/secring.gpg
-    </programlisting>
-    The <command>gpg-agent(1)</command> man page has more details about this
-    subject, i.e. in the "EXAMPLES" section.
-   </para>
-  </listitem>
- </itemizedlist>
-
- <para>
-  Other notable improvements:
-  <itemizedlist>
-<!--
-  <listitem>
-    <para>The <command>command-not-found</command> hook was extended.
-    Apart from <literal>$NIX_AUTO_INSTALL</literal> variable,
-    it newly also checks for <literal>$NIX_AUTO_RUN</literal>
-    which causes it to directly run the missing commands via
-    <command>nix-shell</command> (without installing anything).</para>
-  </listitem>
-  -->
-   <listitem>
-    <para>
-     <literal>ejabberd</literal> module is brought back and now works on NixOS.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Input method support was improved. New NixOS modules (fcitx, nabi and
-     uim), fcitx engines (chewing, hangul, m17n, mozc and table-other) and ibus
-     engines (hangul and m17n) have been added.
-    </para>
-   </listitem>
-  </itemizedlist>
- </para>
-</section>
diff --git a/nixos/doc/manual/release-notes/rl-1609.section.md b/nixos/doc/manual/release-notes/rl-1609.section.md
new file mode 100644
index 000000000000..075f0cf52cd1
--- /dev/null
+++ b/nixos/doc/manual/release-notes/rl-1609.section.md
@@ -0,0 +1,73 @@
+# Release 16.09 ("Flounder", 2016/09/30) {#sec-release-16.09}
+
+In addition to numerous new and upgraded packages, this release has the following highlights:
+
+- Many NixOS configurations and Nix packages now use significantly less disk space, thanks to the [extensive work on closure size reduction](https://github.com/NixOS/nixpkgs/issues/7117). For example, the closure size of a minimal NixOS container went down from \~424 MiB in 16.03 to \~212 MiB in 16.09, while the closure size of Firefox went from \~651 MiB to \~259 MiB.
+
+- To improve security, packages are now [built using various hardening features](https://github.com/NixOS/nixpkgs/pull/12895). See the Nixpkgs manual for more information.
+
+- Support for PXE netboot. See [](#sec-booting-from-pxe) for documentation.
+
+- X.org server 1.18. If you use the `ati_unfree` driver, 1.17 is still used due to an ABI incompatibility.
+
+- This release is based on Glibc 2.24, GCC 5.4.0 and systemd 231. The default Linux kernel remains 4.4.
+
+The following new services were added since the last release:
+
+- `(this will get automatically generated at release time)`
+
+When upgrading from a previous release, please be aware of the following incompatible changes:
+
+- A large number of packages have been converted to use the multiple outputs feature of Nix to greatly reduce the amount of required disk space, as mentioned above. This may require changes to any custom packages to make them build again; see the relevant chapter in the Nixpkgs manual for more information. (Additional caveat to packagers: some packaging conventions related to multiple-output packages [were changed](https://github.com/NixOS/nixpkgs/pull/14766) late (August 2016) in the release cycle and differ from the initial introduction of multiple outputs.)
+
+- Previous versions of Nixpkgs had support for all versions of the LTS Haskell package set. That support has been dropped. The previously provided `haskell.packages.lts-x_y` package sets still exist in name to aviod breaking user code, but these package sets don\'t actually contain the versions mandated by the corresponding LTS release. Instead, our package set it loosely based on the latest available LTS release, i.e. LTS 7.x at the time of this writing. New releases of NixOS and Nixpkgs will drop those old names entirely. [The motivation for this change](https://nixos.org/nix-dev/2016-June/020585.html) has been discussed at length on the `nix-dev` mailing list and in [Github issue \#14897](https://github.com/NixOS/nixpkgs/issues/14897). Development strategies for Haskell hackers who want to rely on Nix and NixOS have been described in [another nix-dev article](https://nixos.org/nix-dev/2016-June/020642.html).
+
+- Shell aliases for systemd sub-commands [were dropped](https://github.com/NixOS/nixpkgs/pull/15598): `start`, `stop`, `restart`, `status`.
+
+- Redis now binds to 127.0.0.1 only instead of listening to all network interfaces. This is the default behavior of Redis 3.2
+
+- `/var/empty` is now immutable. Activation script runs `chattr +i` to forbid any modifications inside the folder. See [ the pull request](https://github.com/NixOS/nixpkgs/pull/18365) for what bugs this caused.
+
+- Gitlab\'s maintainance script `gitlab-runner` was removed and split up into the more clearer `gitlab-run` and `gitlab-rake` scripts, because `gitlab-runner` is a component of Gitlab CI.
+
+- `services.xserver.libinput.accelProfile` default changed from `flat` to `adaptive`, as per [ official documentation](https://wayland.freedesktop.org/libinput/doc/latest/group__config.html#gad63796972347f318b180e322e35cee79).
+
+- `fonts.fontconfig.ultimate.rendering` was removed because our presets were obsolete for some time. New presets are hardcoded into FreeType; you can select a preset via `fonts.fontconfig.ultimate.preset`. You can customize those presets via ordinary environment variables, using `environment.variables`.
+
+- The `audit` service is no longer enabled by default. Use `security.audit.enable = true` to explicitly enable it.
+
+- `pkgs.linuxPackages.virtualbox` now contains only the kernel modules instead of the VirtualBox user space binaries. If you want to reference the user space binaries, you have to use the new `pkgs.virtualbox` instead.
+
+- `goPackages` was replaced with separated Go applications in appropriate `nixpkgs` categories. Each Go package uses its own dependency set. There\'s also a new `go2nix` tool introduced to generate a Go package definition from its Go source automatically.
+
+- `services.mongodb.extraConfig` configuration format was changed to YAML.
+
+- PHP has been upgraded to 7.0
+
+Other notable improvements:
+
+- Revamped grsecurity/PaX support. There is now only a single general-purpose distribution kernel and the configuration interface has been streamlined. Desktop users should be able to simply set
+
+  ```nix
+  {
+    security.grsecurity.enable = true;
+  }
+  ```
+
+  to get a reasonably secure system without having to sacrifice too much functionality.
+
+- Special filesystems, like `/proc`, `/run` and others, now have the same mount options as recommended by systemd and are unified across different places in NixOS. Mount options are updated during `nixos-rebuild switch` if possible. One benefit from this is improved security --- most such filesystems are now mounted with `noexec`, `nodev` and/or `nosuid` options.
+
+- The reverse path filter was interfering with DHCPv4 server operation in the past. An exception for DHCPv4 and a new option to log packets that were dropped due to the reverse path filter was added (`networking.firewall.logReversePathDrops`) for easier debugging.
+
+- Containers configuration within `containers.<name>.config` is [now properly typed and checked](https://github.com/NixOS/nixpkgs/pull/17365). In particular, partial configurations are merged correctly.
+
+- The directory container setuid wrapper programs, `/var/setuid-wrappers`, [is now updated atomically to prevent failures if the switch to a new configuration is interrupted.](https://github.com/NixOS/nixpkgs/pull/18124)
+
+- `services.xserver.startGnuPGAgent` has been removed due to GnuPG 2.1.x bump. See [ how to achieve similar behavior](https://github.com/NixOS/nixpkgs/commit/5391882ebd781149e213e8817fba6ac3c503740c). You might need to `pkill gpg-agent` after the upgrade to prevent a stale agent being in the way.
+
+- [ Declarative users could share the uid due to the bug in the script handling conflict resolution. ](https://github.com/NixOS/nixpkgs/commit/e561edc322d275c3687fec431935095cfc717147)
+
+- Gummi boot has been replaced using systemd-boot.
+
+- Hydra package and NixOS module were added for convenience.
diff --git a/nixos/doc/manual/release-notes/rl-1609.xml b/nixos/doc/manual/release-notes/rl-1609.xml
deleted file mode 100644
index 4a2343edc970..000000000000
--- a/nixos/doc/manual/release-notes/rl-1609.xml
+++ /dev/null
@@ -1,277 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-16.09">
- <title>Release 16.09 (“Flounder”, 2016/09/30)</title>
-
- <para>
-  In addition to numerous new and upgraded packages, this release has the
-  following highlights:
- </para>
-
- <itemizedlist>
-  <listitem>
-   <para>
-    Many NixOS configurations and Nix packages now use significantly less disk
-    space, thanks to the
-    <link
-    xlink:href="https://github.com/NixOS/nixpkgs/issues/7117">extensive
-    work on closure size reduction</link>. For example, the closure size of a
-    minimal NixOS container went down from ~424 MiB in 16.03 to ~212 MiB in
-    16.09, while the closure size of Firefox went from ~651 MiB to ~259 MiB.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    To improve security, packages are now
-    <link
-    xlink:href="https://github.com/NixOS/nixpkgs/pull/12895">built
-    using various hardening features</link>. See the Nixpkgs manual for more
-    information.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Support for PXE netboot. See <xref
-    linkend="sec-booting-from-pxe" />
-    for documentation.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    X.org server 1.18. If you use the <literal>ati_unfree</literal> driver,
-    1.17 is still used due to an ABI incompatibility.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    This release is based on Glibc 2.24, GCC 5.4.0 and systemd 231. The default
-    Linux kernel remains 4.4.
-   </para>
-  </listitem>
- </itemizedlist>
-
- <para>
-  The following new services were added since the last release:
- </para>
-
- <itemizedlist>
-  <listitem>
-   <para>
-    <literal>(this will get automatically generated at release time)</literal>
-   </para>
-  </listitem>
- </itemizedlist>
-
- <para>
-  When upgrading from a previous release, please be aware of the following
-  incompatible changes:
- </para>
-
- <itemizedlist>
-  <listitem>
-   <para>
-    A large number of packages have been converted to use the multiple outputs
-    feature of Nix to greatly reduce the amount of required disk space, as
-    mentioned above. This may require changes to any custom packages to make
-    them build again; see the relevant chapter in the Nixpkgs manual for more
-    information. (Additional caveat to packagers: some packaging conventions
-    related to multiple-output packages
-    <link xlink:href="https://github.com/NixOS/nixpkgs/pull/14766">were
-    changed</link> late (August 2016) in the release cycle and differ from the
-    initial introduction of multiple outputs.)
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Previous versions of Nixpkgs had support for all versions of the LTS
-    Haskell package set. That support has been dropped. The previously provided
-    <literal>haskell.packages.lts-x_y</literal> package sets still exist in
-    name to aviod breaking user code, but these package sets don't actually
-    contain the versions mandated by the corresponding LTS release. Instead,
-    our package set it loosely based on the latest available LTS release, i.e.
-    LTS 7.x at the time of this writing. New releases of NixOS and Nixpkgs will
-    drop those old names entirely.
-    <link
-    xlink:href="https://nixos.org/nix-dev/2016-June/020585.html">The
-    motivation for this change</link> has been discussed at length on the
-    <literal>nix-dev</literal> mailing list and in
-    <link
-    xlink:href="https://github.com/NixOS/nixpkgs/issues/14897">Github
-    issue #14897</link>. Development strategies for Haskell hackers who want to
-    rely on Nix and NixOS have been described in
-    <link
-    xlink:href="https://nixos.org/nix-dev/2016-June/020642.html">another
-    nix-dev article</link>.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Shell aliases for systemd sub-commands
-    <link xlink:href="https://github.com/NixOS/nixpkgs/pull/15598">were
-    dropped</link>: <command>start</command>, <command>stop</command>,
-    <command>restart</command>, <command>status</command>.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Redis now binds to 127.0.0.1 only instead of listening to all network
-    interfaces. This is the default behavior of Redis 3.2
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    <literal>/var/empty</literal> is now immutable. Activation script runs
-    <command>chattr +i</command> to forbid any modifications inside the folder.
-    See <link xlink:href="https://github.com/NixOS/nixpkgs/pull/18365"> the
-    pull request</link> for what bugs this caused.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Gitlab's maintainance script <command>gitlab-runner</command> was removed
-    and split up into the more clearer <command>gitlab-run</command> and
-    <command>gitlab-rake</command> scripts, because
-    <command>gitlab-runner</command> is a component of Gitlab CI.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    <literal>services.xserver.libinput.accelProfile</literal> default changed
-    from <literal>flat</literal> to <literal>adaptive</literal>, as per
-    <link xlink:href="https://wayland.freedesktop.org/libinput/doc/latest/group__config.html#gad63796972347f318b180e322e35cee79">
-    official documentation</link>.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    <literal>fonts.fontconfig.ultimate.rendering</literal> was removed because
-    our presets were obsolete for some time. New presets are hardcoded into
-    FreeType; you can select a preset via
-    <literal>fonts.fontconfig.ultimate.preset</literal>. You can customize
-    those presets via ordinary environment variables, using
-    <literal>environment.variables</literal>.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    The <literal>audit</literal> service is no longer enabled by default. Use
-    <literal>security.audit.enable = true</literal> to explicitly enable it.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    <literal>pkgs.linuxPackages.virtualbox</literal> now contains only the
-    kernel modules instead of the VirtualBox user space binaries. If you want
-    to reference the user space binaries, you have to use the new
-    <literal>pkgs.virtualbox</literal> instead.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    <literal>goPackages</literal> was replaced with separated Go applications
-    in appropriate <literal>nixpkgs</literal> categories. Each Go package uses
-    its own dependency set. There's also a new <literal>go2nix</literal> tool
-    introduced to generate a Go package definition from its Go source
-    automatically.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    <literal>services.mongodb.extraConfig</literal> configuration format was
-    changed to YAML.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    PHP has been upgraded to 7.0
-   </para>
-  </listitem>
- </itemizedlist>
-
- <para>
-  Other notable improvements:
- </para>
-
- <itemizedlist>
-  <listitem>
-   <para>
-    Revamped grsecurity/PaX support. There is now only a single general-purpose
-    distribution kernel and the configuration interface has been streamlined.
-    Desktop users should be able to simply set
-<programlisting>security.grsecurity.enable = true</programlisting>
-    to get a reasonably secure system without having to sacrifice too much
-    functionality.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Special filesystems, like <literal>/proc</literal>, <literal>/run</literal>
-    and others, now have the same mount options as recommended by systemd and
-    are unified across different places in NixOS. Mount options are updated
-    during <command>nixos-rebuild switch</command> if possible. One benefit
-    from this is improved security — most such filesystems are now mounted
-    with <literal>noexec</literal>, <literal>nodev</literal> and/or
-    <literal>nosuid</literal> options.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    The reverse path filter was interfering with DHCPv4 server operation in the
-    past. An exception for DHCPv4 and a new option to log packets that were
-    dropped due to the reverse path filter was added
-    (<literal>networking.firewall.logReversePathDrops</literal>) for easier
-    debugging.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Containers configuration within
-    <literal>containers.&lt;name&gt;.config</literal> is
-    <link
-  xlink:href="https://github.com/NixOS/nixpkgs/pull/17365">now
-    properly typed and checked</link>. In particular, partial configurations
-    are merged correctly.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    The directory container setuid wrapper programs,
-    <filename>/var/setuid-wrappers</filename>,
-    <link
-    xlink:href="https://github.com/NixOS/nixpkgs/pull/18124">is now
-    updated atomically to prevent failures if the switch to a new configuration
-    is interrupted.</link>
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    <literal>services.xserver.startGnuPGAgent</literal> has been removed due to
-    GnuPG 2.1.x bump. See
-    <link
-        xlink:href="https://github.com/NixOS/nixpkgs/commit/5391882ebd781149e213e8817fba6ac3c503740c">
-    how to achieve similar behavior</link>. You might need to <literal>pkill
-    gpg-agent</literal> after the upgrade to prevent a stale agent being in the
-    way.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    <link xlink:href="https://github.com/NixOS/nixpkgs/commit/e561edc322d275c3687fec431935095cfc717147">
-    Declarative users could share the uid due to the bug in the script handling
-    conflict resolution. </link>
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Gummi boot has been replaced using systemd-boot.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Hydra package and NixOS module were added for convenience.
-   </para>
-  </listitem>
- </itemizedlist>
-</section>
diff --git a/nixos/doc/manual/release-notes/rl-1703.section.md b/nixos/doc/manual/release-notes/rl-1703.section.md
new file mode 100644
index 000000000000..7f424f2a6ce3
--- /dev/null
+++ b/nixos/doc/manual/release-notes/rl-1703.section.md
@@ -0,0 +1,303 @@
+# Release 17.03 ("Gorilla", 2017/03/31) {#sec-release-17.03}
+
+## Highlights {#sec-release-17.03-highlights}
+
+In addition to numerous new and upgraded packages, this release has the following highlights:
+
+- Nixpkgs is now extensible through overlays. See the [Nixpkgs manual](https://nixos.org/nixpkgs/manual/#sec-overlays-install) for more information.
+
+- This release is based on Glibc 2.25, GCC 5.4.0 and systemd 232. The default Linux kernel is 4.9 and Nix is at 1.11.8.
+
+- The default desktop environment now is KDE\'s Plasma 5. KDE 4 has been removed
+
+- The setuid wrapper functionality now supports setting capabilities.
+
+- X.org server uses branch 1.19. Due to ABI incompatibilities, `ati_unfree` keeps forcing 1.17 and `amdgpu-pro` starts forcing 1.18.
+
+- Cross compilation has been rewritten. See the nixpkgs manual for details. The most obvious breaking change is that in derivations there is no `.nativeDrv` nor `.crossDrv` are now cross by default, not native.
+
+- The `overridePackages` function has been rewritten to be replaced by [ overlays](https://nixos.org/nixpkgs/manual/#sec-overlays-install)
+
+- Packages in nixpkgs can be marked as insecure through listed vulnerabilities. See the [Nixpkgs manual](https://nixos.org/nixpkgs/manual/#sec-allow-insecure) for more information.
+
+- PHP now defaults to PHP 7.1
+
+## New Services {#sec-release-17.03-new-services}
+
+The following new services were added since the last release:
+
+- `hardware/ckb.nix`
+
+- `hardware/mcelog.nix`
+
+- `hardware/usb-wwan.nix`
+
+- `hardware/video/capture/mwprocapture.nix`
+
+- `programs/adb.nix`
+
+- `programs/chromium.nix`
+
+- `programs/gphoto2.nix`
+
+- `programs/java.nix`
+
+- `programs/mtr.nix`
+
+- `programs/oblogout.nix`
+
+- `programs/vim.nix`
+
+- `programs/wireshark.nix`
+
+- `security/dhparams.nix`
+
+- `services/audio/ympd.nix`
+
+- `services/computing/boinc/client.nix`
+
+- `services/continuous-integration/buildbot/master.nix`
+
+- `services/continuous-integration/buildbot/worker.nix`
+
+- `services/continuous-integration/gitlab-runner.nix`
+
+- `services/databases/riak-cs.nix`
+
+- `services/databases/stanchion.nix`
+
+- `services/desktops/gnome3/gnome-terminal-server.nix`
+
+- `services/editors/infinoted.nix`
+
+- `services/hardware/illum.nix`
+
+- `services/hardware/trezord.nix`
+
+- `services/logging/journalbeat.nix`
+
+- `services/mail/offlineimap.nix`
+
+- `services/mail/postgrey.nix`
+
+- `services/misc/couchpotato.nix`
+
+- `services/misc/docker-registry.nix`
+
+- `services/misc/errbot.nix`
+
+- `services/misc/geoip-updater.nix`
+
+- `services/misc/gogs.nix`
+
+- `services/misc/leaps.nix`
+
+- `services/misc/nix-optimise.nix`
+
+- `services/misc/ssm-agent.nix`
+
+- `services/misc/sssd.nix`
+
+- `services/monitoring/arbtt.nix`
+
+- `services/monitoring/netdata.nix`
+
+- `services/monitoring/prometheus/default.nix`
+
+- `services/monitoring/prometheus/alertmanager.nix`
+
+- `services/monitoring/prometheus/blackbox-exporter.nix`
+
+- `services/monitoring/prometheus/json-exporter.nix`
+
+- `services/monitoring/prometheus/nginx-exporter.nix`
+
+- `services/monitoring/prometheus/node-exporter.nix`
+
+- `services/monitoring/prometheus/snmp-exporter.nix`
+
+- `services/monitoring/prometheus/unifi-exporter.nix`
+
+- `services/monitoring/prometheus/varnish-exporter.nix`
+
+- `services/monitoring/sysstat.nix`
+
+- `services/monitoring/telegraf.nix`
+
+- `services/monitoring/vnstat.nix`
+
+- `services/network-filesystems/cachefilesd.nix`
+
+- `services/network-filesystems/glusterfs.nix`
+
+- `services/network-filesystems/ipfs.nix`
+
+- `services/networking/dante.nix`
+
+- `services/networking/dnscrypt-wrapper.nix`
+
+- `services/networking/fakeroute.nix`
+
+- `services/networking/flannel.nix`
+
+- `services/networking/htpdate.nix`
+
+- `services/networking/miredo.nix`
+
+- `services/networking/nftables.nix`
+
+- `services/networking/powerdns.nix`
+
+- `services/networking/pdns-recursor.nix`
+
+- `services/networking/quagga.nix`
+
+- `services/networking/redsocks.nix`
+
+- `services/networking/wireguard.nix`
+
+- `services/system/cgmanager.nix`
+
+- `services/torrent/opentracker.nix`
+
+- `services/web-apps/atlassian/confluence.nix`
+
+- `services/web-apps/atlassian/crowd.nix`
+
+- `services/web-apps/atlassian/jira.nix`
+
+- `services/web-apps/frab.nix`
+
+- `services/web-apps/nixbot.nix`
+
+- `services/web-apps/selfoss.nix`
+
+- `services/web-apps/quassel-webserver.nix`
+
+- `services/x11/unclutter-xfixes.nix`
+
+- `services/x11/urxvtd.nix`
+
+- `system/boot/systemd-nspawn.nix`
+
+- `virtualisation/ecs-agent.nix`
+
+- `virtualisation/lxcfs.nix`
+
+- `virtualisation/openstack/keystone.nix`
+
+- `virtualisation/openstack/glance.nix`
+
+## Backward Incompatibilities {#sec-release-17.03-incompatibilities}
+
+When upgrading from a previous release, please be aware of the following incompatible changes:
+
+- Derivations have no `.nativeDrv` nor `.crossDrv` and are now cross by default, not native.
+
+- `stdenv.overrides` is now expected to take `self` and `super` arguments. See `lib.trivial.extends` for what those parameters represent.
+
+- `ansible` now defaults to ansible version 2 as version 1 has been removed due to a serious [ vulnerability](https://www.computest.nl/advisories/CT-2017-0109_Ansible.txt) unpatched by upstream.
+
+- `gnome` alias has been removed along with `gtk`, `gtkmm` and several others. Now you need to use versioned attributes, like `gnome3`.
+
+- The attribute name of the Radicale daemon has been changed from `pythonPackages.radicale` to `radicale`.
+
+- The `stripHash` bash function in `stdenv` changed according to its documentation; it now outputs the stripped name to `stdout` instead of putting it in the variable `strippedName`.
+
+- PHP now scans for extra configuration .ini files in /etc/php.d instead of /etc. This prevents accidentally loading non-PHP .ini files that may be in /etc.
+
+- Two lone top-level dict dbs moved into `dictdDBs`. This affects: `dictdWordnet` which is now at `dictdDBs.wordnet` and `dictdWiktionary` which is now at `dictdDBs.wiktionary`
+
+- Parsoid service now uses YAML configuration format. `service.parsoid.interwikis` is now called `service.parsoid.wikis` and is a list of either API URLs or attribute sets as specified in parsoid\'s documentation.
+
+- `Ntpd` was replaced by `systemd-timesyncd` as the default service to synchronize system time with a remote NTP server. The old behavior can be restored by setting `services.ntp.enable` to `true`. Upstream time servers for all NTP implementations are now configured using `networking.timeServers`.
+
+- `service.nylon` is now declared using named instances. As an example:
+
+  ```nix
+  {
+    services.nylon = {
+      enable = true;
+      acceptInterface = "br0";
+      bindInterface = "tun1";
+      port = 5912;
+    };
+  }
+  ```
+
+  should be replaced with:
+
+  ```nix
+  {
+    services.nylon.myvpn = {
+      enable = true;
+      acceptInterface = "br0";
+      bindInterface = "tun1";
+      port = 5912;
+    };
+  }
+  ```
+
+  this enables you to declare a SOCKS proxy for each uplink.
+
+- `overridePackages` function no longer exists. It is replaced by [ overlays](https://nixos.org/nixpkgs/manual/#sec-overlays-install). For example, the following code:
+
+  ```nix
+  let
+    pkgs = import <nixpkgs> {};
+  in
+    pkgs.overridePackages (self: super: ...)
+  ```
+
+  should be replaced by:
+
+  ```nix
+  let
+    pkgs = import <nixpkgs> {};
+  in
+    import pkgs.path { overlays = [(self: super: ...)]; }
+  ```
+
+- Autoloading connection tracking helpers is now disabled by default. This default was also changed in the Linux kernel and is considered insecure if not configured properly in your firewall. If you need connection tracking helpers (i.e. for active FTP) please enable `networking.firewall.autoLoadConntrackHelpers` and tune `networking.firewall.connectionTrackingModules` to suit your needs.
+
+- `local_recipient_maps` is not set to empty value by Postfix service. It\'s an insecure default as stated by Postfix documentation. Those who want to retain this setting need to set it via `services.postfix.extraConfig`.
+
+- Iputils no longer provide ping6 and traceroute6. The functionality of these tools has been integrated into ping and traceroute respectively. To enforce an address family the new flags `-4` and `-6` have been added. One notable incompatibility is that specifying an interface (for link-local IPv6 for instance) is no longer done with the `-I` flag, but by encoding the interface into the address (`ping fe80::1%eth0`).
+
+- The socket handling of the `services.rmilter` module has been fixed and refactored. As rmilter doesn\'t support binding to more than one socket, the options `bindUnixSockets` and `bindInetSockets` have been replaced by `services.rmilter.bindSocket.*`. The default is still a unix socket in `/run/rmilter/rmilter.sock`. Refer to the options documentation for more information.
+
+- The `fetch*` functions no longer support md5, please use sha256 instead.
+
+- The dnscrypt-proxy module interface has been streamlined around the `extraArgs` option. Where possible, legacy option declarations are mapped to `extraArgs` but will emit warnings. The `resolverList` has been outright removed: to use an unlisted resolver, use the `customResolver` option.
+
+- torbrowser now stores local state under `~/.local/share/tor-browser` by default. Any browser profile data from the old location, `~/.torbrowser4`, must be migrated manually.
+
+- The ihaskell, monetdb, offlineimap and sitecopy services have been removed.
+
+## Other Notable Changes {#sec-release-17.03-notable-changes}
+
+- Module type system have a new extensible option types feature that allow to extend certain types, such as enum, through multiple option declarations of the same option across multiple modules.
+
+- `jre` now defaults to GTK UI by default. This improves visual consistency and makes Java follow system font style, improving the situation on HighDPI displays. This has a cost of increased closure size; for server and other headless workloads it\'s recommended to use `jre_headless`.
+
+- Python 2.6 interpreter and package set have been removed.
+
+- The Python 2.7 interpreter does not use modules anymore. Instead, all CPython interpreters now include the whole standard library except for \`tkinter\`, which is available in the Python package set.
+
+- Python 2.7, 3.5 and 3.6 are now built deterministically and 3.4 mostly. Minor modifications had to be made to the interpreters in order to generate deterministic bytecode. This has security implications and is relevant for those using Python in a `nix-shell`. See the Nixpkgs manual for details.
+
+- The Python package sets now use a fixed-point combinator and the sets are available as attributes of the interpreters.
+
+- The Python function `buildPythonPackage` has been improved and can be used to build from Setuptools source, Flit source, and precompiled Wheels.
+
+- When adding new or updating current Python libraries, the expressions should be put in separate files in `pkgs/development/python-modules` and called from `python-packages.nix`.
+
+- The dnscrypt-proxy service supports synchronizing the list of public resolvers without working DNS resolution. This fixes issues caused by the resolver list becoming outdated. It also improves the viability of DNSCrypt only configurations.
+
+- Containers using bridged networking no longer lose their connection after changes to the host networking.
+
+- ZFS supports pool auto scrubbing.
+
+- The bind DNS utilities (e.g. dig) have been split into their own output and are now also available in `pkgs.dnsutils` and it is no longer necessary to pull in all of `bind` to use them.
+
+- Per-user configuration was moved from `~/.nixpkgs` to `~/.config/nixpkgs`. The former is still valid for `config.nix` for backwards compatibility.
diff --git a/nixos/doc/manual/release-notes/rl-1703.xml b/nixos/doc/manual/release-notes/rl-1703.xml
deleted file mode 100644
index 14b31b232e90..000000000000
--- a/nixos/doc/manual/release-notes/rl-1703.xml
+++ /dev/null
@@ -1,817 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-17.03">
- <title>Release 17.03 (“Gorilla”, 2017/03/31)</title>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-17.03-highlights">
-  <title>Highlights</title>
-
-  <para>
-   In addition to numerous new and upgraded packages, this release has the
-   following highlights:
-  </para>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     Nixpkgs is now extensible through overlays. See the
-     <link
-    xlink:href="https://nixos.org/nixpkgs/manual/#sec-overlays-install">Nixpkgs
-     manual</link> for more information.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     This release is based on Glibc 2.25, GCC 5.4.0 and systemd 232. The
-     default Linux kernel is 4.9 and Nix is at 1.11.8.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The default desktop environment now is KDE's Plasma 5. KDE 4 has been
-     removed
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The setuid wrapper functionality now supports setting capabilities.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     X.org server uses branch 1.19. Due to ABI incompatibilities,
-     <literal>ati_unfree</literal> keeps forcing 1.17 and
-     <literal>amdgpu-pro</literal> starts forcing 1.18.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Cross compilation has been rewritten. See the nixpkgs manual for details.
-     The most obvious breaking change is that in derivations there is no
-     <literal>.nativeDrv</literal> nor <literal>.crossDrv</literal> are now
-     cross by default, not native.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>overridePackages</literal> function has been rewritten to be
-     replaced by
-     <link
-    xlink:href="https://nixos.org/nixpkgs/manual/#sec-overlays-install">
-     overlays</link>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Packages in nixpkgs can be marked as insecure through listed
-     vulnerabilities. See the
-     <link
-    xlink:href="https://nixos.org/nixpkgs/manual/#sec-allow-insecure">Nixpkgs
-     manual</link> for more information.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     PHP now defaults to PHP 7.1
-    </para>
-   </listitem>
-  </itemizedlist>
- </section>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-17.03-new-services">
-  <title>New Services</title>
-
-  <para>
-   The following new services were added since the last release:
-  </para>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     <literal>hardware/ckb.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>hardware/mcelog.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>hardware/usb-wwan.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>hardware/video/capture/mwprocapture.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>programs/adb.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>programs/chromium.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>programs/gphoto2.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>programs/java.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>programs/mtr.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>programs/oblogout.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>programs/vim.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>programs/wireshark.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>security/dhparams.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/audio/ympd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/computing/boinc/client.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/continuous-integration/buildbot/master.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/continuous-integration/buildbot/worker.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/continuous-integration/gitlab-runner.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/databases/riak-cs.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/databases/stanchion.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/desktops/gnome3/gnome-terminal-server.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/editors/infinoted.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/hardware/illum.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/hardware/trezord.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/logging/journalbeat.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/mail/offlineimap.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/mail/postgrey.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/couchpotato.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/docker-registry.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/errbot.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/geoip-updater.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/gogs.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/leaps.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/nix-optimise.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/ssm-agent.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/sssd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/monitoring/arbtt.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/monitoring/netdata.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/monitoring/prometheus/default.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/monitoring/prometheus/alertmanager.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/monitoring/prometheus/blackbox-exporter.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/monitoring/prometheus/json-exporter.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/monitoring/prometheus/nginx-exporter.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/monitoring/prometheus/node-exporter.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/monitoring/prometheus/snmp-exporter.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/monitoring/prometheus/unifi-exporter.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/monitoring/prometheus/varnish-exporter.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/monitoring/sysstat.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/monitoring/telegraf.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/monitoring/vnstat.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/network-filesystems/cachefilesd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/network-filesystems/glusterfs.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/network-filesystems/ipfs.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/dante.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/dnscrypt-wrapper.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/fakeroute.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/flannel.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/htpdate.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/miredo.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/nftables.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/powerdns.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/pdns-recursor.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/quagga.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/redsocks.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/wireguard.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/system/cgmanager.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/torrent/opentracker.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/web-apps/atlassian/confluence.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/web-apps/atlassian/crowd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/web-apps/atlassian/jira.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/web-apps/frab.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/web-apps/nixbot.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/web-apps/selfoss.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/web-apps/quassel-webserver.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/x11/unclutter-xfixes.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/x11/urxvtd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>system/boot/systemd-nspawn.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>virtualisation/ecs-agent.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>virtualisation/lxcfs.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>virtualisation/openstack/keystone.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>virtualisation/openstack/glance.nix</literal>
-    </para>
-   </listitem>
-  </itemizedlist>
- </section>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-17.03-incompatibilities">
-  <title>Backward Incompatibilities</title>
-
-  <para>
-   When upgrading from a previous release, please be aware of the following
-   incompatible changes:
-  </para>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     Derivations have no <literal>.nativeDrv</literal> nor
-     <literal>.crossDrv</literal> and are now cross by default, not native.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>stdenv.overrides</literal> is now expected to take
-     <literal>self</literal> and <literal>super</literal> arguments. See
-     <literal>lib.trivial.extends</literal> for what those parameters
-     represent.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>ansible</literal> now defaults to ansible version 2 as version 1
-     has been removed due to a serious
-     <link
-      xlink:href="https://www.computest.nl/advisories/CT-2017-0109_Ansible.txt">
-     vulnerability</link> unpatched by upstream.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>gnome</literal> alias has been removed along with
-     <literal>gtk</literal>, <literal>gtkmm</literal> and several others. Now
-     you need to use versioned attributes, like <literal>gnome3</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The attribute name of the Radicale daemon has been changed from
-     <literal>pythonPackages.radicale</literal> to <literal>radicale</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>stripHash</literal> bash function in
-     <literal>stdenv</literal> changed according to its documentation; it now
-     outputs the stripped name to <literal>stdout</literal> instead of putting
-     it in the variable <literal>strippedName</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     PHP now scans for extra configuration .ini files in /etc/php.d instead of
-     /etc. This prevents accidentally loading non-PHP .ini files that may be in
-     /etc.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Two lone top-level dict dbs moved into <literal>dictdDBs</literal>. This
-     affects: <literal>dictdWordnet</literal> which is now at
-     <literal>dictdDBs.wordnet</literal> and <literal>dictdWiktionary</literal>
-     which is now at <literal>dictdDBs.wiktionary</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Parsoid service now uses YAML configuration format.
-     <literal>service.parsoid.interwikis</literal> is now called
-     <literal>service.parsoid.wikis</literal> and is a list of either API URLs
-     or attribute sets as specified in parsoid's documentation.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>Ntpd</literal> was replaced by
-     <literal>systemd-timesyncd</literal> as the default service to synchronize
-     system time with a remote NTP server. The old behavior can be restored by
-     setting <literal>services.ntp.enable</literal> to <literal>true</literal>.
-     Upstream time servers for all NTP implementations are now configured using
-     <literal>networking.timeServers</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>service.nylon</literal> is now declared using named instances. As
-     an example:
-<programlisting>
-  services.nylon = {
-    enable = true;
-    acceptInterface = "br0";
-    bindInterface = "tun1";
-    port = 5912;
-  };
-</programlisting>
-     should be replaced with:
-<programlisting>
-  services.nylon.myvpn = {
-    enable = true;
-    acceptInterface = "br0";
-    bindInterface = "tun1";
-    port = 5912;
-  };
-</programlisting>
-     this enables you to declare a SOCKS proxy for each uplink.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>overridePackages</literal> function no longer exists. It is
-     replaced by
-     <link
-    xlink:href="https://nixos.org/nixpkgs/manual/#sec-overlays-install">
-     overlays</link>. For example, the following code:
-<programlisting>
-let
-  pkgs = import &lt;nixpkgs&gt; {};
-in
-  pkgs.overridePackages (self: super: ...)
-</programlisting>
-     should be replaced by:
-<programlisting>
-let
-  pkgs = import &lt;nixpkgs&gt; {};
-in
-  import pkgs.path { overlays = [(self: super: ...)]; }
-</programlisting>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Autoloading connection tracking helpers is now disabled by default. This
-     default was also changed in the Linux kernel and is considered insecure if
-     not configured properly in your firewall. If you need connection tracking
-     helpers (i.e. for active FTP) please enable
-     <literal>networking.firewall.autoLoadConntrackHelpers</literal> and tune
-     <literal>networking.firewall.connectionTrackingModules</literal> to suit
-     your needs.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>local_recipient_maps</literal> is not set to empty value by
-     Postfix service. It's an insecure default as stated by Postfix
-     documentation. Those who want to retain this setting need to set it via
-     <literal>services.postfix.extraConfig</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Iputils no longer provide ping6 and traceroute6. The functionality of
-     these tools has been integrated into ping and traceroute respectively. To
-     enforce an address family the new flags <literal>-4</literal> and
-     <literal>-6</literal> have been added. One notable incompatibility is that
-     specifying an interface (for link-local IPv6 for instance) is no longer
-     done with the <literal>-I</literal> flag, but by encoding the interface
-     into the address (<literal>ping fe80::1%eth0</literal>).
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The socket handling of the <literal>services.rmilter</literal> module has
-     been fixed and refactored. As rmilter doesn't support binding to more than
-     one socket, the options <literal>bindUnixSockets</literal> and
-     <literal>bindInetSockets</literal> have been replaced by
-     <literal>services.rmilter.bindSocket.*</literal>. The default is still a
-     unix socket in <literal>/run/rmilter/rmilter.sock</literal>. Refer to the
-     options documentation for more information.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>fetch*</literal> functions no longer support md5, please use
-     sha256 instead.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The dnscrypt-proxy module interface has been streamlined around the
-     <option>extraArgs</option> option. Where possible, legacy option
-     declarations are mapped to <option>extraArgs</option> but will emit
-     warnings. The <option>resolverList</option> has been outright removed: to
-     use an unlisted resolver, use the <option>customResolver</option> option.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     torbrowser now stores local state under
-     <filename>~/.local/share/tor-browser</filename> by default. Any browser
-     profile data from the old location, <filename>~/.torbrowser4</filename>,
-     must be migrated manually.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The ihaskell, monetdb, offlineimap and sitecopy services have been
-     removed.
-    </para>
-   </listitem>
-  </itemizedlist>
- </section>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-17.03-notable-changes">
-  <title>Other Notable Changes</title>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     Module type system have a new extensible option types feature that allow
-     to extend certain types, such as enum, through multiple option
-     declarations of the same option across multiple modules.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>jre</literal> now defaults to GTK UI by default. This improves
-     visual consistency and makes Java follow system font style, improving the
-     situation on HighDPI displays. This has a cost of increased closure size;
-     for server and other headless workloads it's recommended to use
-     <literal>jre_headless</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Python 2.6 interpreter and package set have been removed.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The Python 2.7 interpreter does not use modules anymore. Instead, all
-     CPython interpreters now include the whole standard library except for
-     `tkinter`, which is available in the Python package set.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Python 2.7, 3.5 and 3.6 are now built deterministically and 3.4 mostly.
-     Minor modifications had to be made to the interpreters in order to
-     generate deterministic bytecode. This has security implications and is
-     relevant for those using Python in a <literal>nix-shell</literal>. See the
-     Nixpkgs manual for details.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The Python package sets now use a fixed-point combinator and the sets are
-     available as attributes of the interpreters.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The Python function <literal>buildPythonPackage</literal> has been
-     improved and can be used to build from Setuptools source, Flit source, and
-     precompiled Wheels.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     When adding new or updating current Python libraries, the expressions
-     should be put in separate files in
-     <literal>pkgs/development/python-modules</literal> and called from
-     <literal>python-packages.nix</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The dnscrypt-proxy service supports synchronizing the list of public
-     resolvers without working DNS resolution. This fixes issues caused by the
-     resolver list becoming outdated. It also improves the viability of
-     DNSCrypt only configurations.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Containers using bridged networking no longer lose their connection after
-     changes to the host networking.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     ZFS supports pool auto scrubbing.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The bind DNS utilities (e.g. dig) have been split into their own output
-     and are now also available in <literal>pkgs.dnsutils</literal> and it is
-     no longer necessary to pull in all of <literal>bind</literal> to use them.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Per-user configuration was moved from <filename>~/.nixpkgs</filename> to
-     <filename>~/.config/nixpkgs</filename>. The former is still valid for
-     <filename>config.nix</filename> for backwards compatibility.
-    </para>
-   </listitem>
-  </itemizedlist>
- </section>
-</section>
diff --git a/nixos/doc/manual/release-notes/rl-1709.section.md b/nixos/doc/manual/release-notes/rl-1709.section.md
new file mode 100644
index 000000000000..e5af22721b0c
--- /dev/null
+++ b/nixos/doc/manual/release-notes/rl-1709.section.md
@@ -0,0 +1,316 @@
+# Release 17.09 ("Hummingbird", 2017/09/??) {#sec-release-17.09}
+
+## Highlights {#sec-release-17.09-highlights}
+
+In addition to numerous new and upgraded packages, this release has the following highlights:
+
+- The GNOME version is now 3.24. KDE Plasma was upgraded to 5.10, KDE Applications to 17.08.1 and KDE Frameworks to 5.37.
+
+- The user handling now keeps track of deallocated UIDs/GIDs. When a user or group is revived, this allows it to be allocated the UID/GID it had before. A consequence is that UIDs and GIDs are no longer reused.
+
+- The module option `services.xserver.xrandrHeads` now causes the first head specified in this list to be set as the primary head. Apart from that, it\'s now possible to also set additional options by using an attribute set, for example:
+
+  ```nix
+  { services.xserver.xrandrHeads = [
+      "HDMI-0"
+      {
+        output = "DVI-0";
+        primary = true;
+        monitorConfig = ''
+          Option "Rotate" "right"
+        '';
+      }
+    ];
+  }
+  ```
+
+  This will set the `DVI-0` output to be the primary head, even though `HDMI-0` is the first head in the list.
+
+- The handling of SSL in the `services.nginx` module has been cleaned up, renaming the misnamed `enableSSL` to `onlySSL` which reflects its original intention. This is not to be used with the already existing `forceSSL` which creates a second non-SSL virtual host redirecting to the SSL virtual host. This by chance had worked earlier due to specific implementation details. In case you had specified both please remove the `enableSSL` option to keep the previous behaviour.
+
+  Another `addSSL` option has been introduced to configure both a non-SSL virtual host and an SSL virtual host with the same configuration.
+
+  Options to configure `resolver` options and `upstream` blocks have been introduced. See their information for further details.
+
+  The `port` option has been replaced by a more generic `listen` option which makes it possible to specify multiple addresses, ports and SSL configs dependant on the new SSL handling mentioned above.
+
+## New Services {#sec-release-17.09-new-services}
+
+The following new services were added since the last release:
+
+- `config/fonts/fontconfig-penultimate.nix`
+
+- `config/fonts/fontconfig-ultimate.nix`
+
+- `config/terminfo.nix`
+
+- `hardware/sensor/iio.nix`
+
+- `hardware/nitrokey.nix`
+
+- `hardware/raid/hpsa.nix`
+
+- `programs/browserpass.nix`
+
+- `programs/gnupg.nix`
+
+- `programs/qt5ct.nix`
+
+- `programs/slock.nix`
+
+- `programs/thefuck.nix`
+
+- `security/auditd.nix`
+
+- `security/lock-kernel-modules.nix`
+
+- `service-managers/docker.nix`
+
+- `service-managers/trivial.nix`
+
+- `services/admin/salt/master.nix`
+
+- `services/admin/salt/minion.nix`
+
+- `services/audio/slimserver.nix`
+
+- `services/cluster/kubernetes/default.nix`
+
+- `services/cluster/kubernetes/dns.nix`
+
+- `services/cluster/kubernetes/dashboard.nix`
+
+- `services/continuous-integration/hail.nix`
+
+- `services/databases/clickhouse.nix`
+
+- `services/databases/postage.nix`
+
+- `services/desktops/gnome3/gnome-disks.nix`
+
+- `services/desktops/gnome3/gpaste.nix`
+
+- `services/logging/SystemdJournal2Gelf.nix`
+
+- `services/logging/heartbeat.nix`
+
+- `services/logging/journalwatch.nix`
+
+- `services/logging/syslogd.nix`
+
+- `services/mail/mailhog.nix`
+
+- `services/mail/nullmailer.nix`
+
+- `services/misc/airsonic.nix`
+
+- `services/misc/autorandr.nix`
+
+- `services/misc/exhibitor.nix`
+
+- `services/misc/fstrim.nix`
+
+- `services/misc/gollum.nix`
+
+- `services/misc/irkerd.nix`
+
+- `services/misc/jackett.nix`
+
+- `services/misc/radarr.nix`
+
+- `services/misc/snapper.nix`
+
+- `services/monitoring/osquery.nix`
+
+- `services/monitoring/prometheus/collectd-exporter.nix`
+
+- `services/monitoring/prometheus/fritzbox-exporter.nix`
+
+- `services/network-filesystems/kbfs.nix`
+
+- `services/networking/dnscache.nix`
+
+- `services/networking/fireqos.nix`
+
+- `services/networking/iwd.nix`
+
+- `services/networking/keepalived/default.nix`
+
+- `services/networking/keybase.nix`
+
+- `services/networking/lldpd.nix`
+
+- `services/networking/matterbridge.nix`
+
+- `services/networking/squid.nix`
+
+- `services/networking/tinydns.nix`
+
+- `services/networking/xrdp.nix`
+
+- `services/security/shibboleth-sp.nix`
+
+- `services/security/sks.nix`
+
+- `services/security/sshguard.nix`
+
+- `services/security/torify.nix`
+
+- `services/security/usbguard.nix`
+
+- `services/security/vault.nix`
+
+- `services/system/earlyoom.nix`
+
+- `services/system/saslauthd.nix`
+
+- `services/web-apps/nexus.nix`
+
+- `services/web-apps/pgpkeyserver-lite.nix`
+
+- `services/web-apps/piwik.nix`
+
+- `services/web-servers/lighttpd/collectd.nix`
+
+- `services/web-servers/minio.nix`
+
+- `services/x11/display-managers/xpra.nix`
+
+- `services/x11/xautolock.nix`
+
+- `tasks/filesystems/bcachefs.nix`
+
+- `tasks/powertop.nix`
+
+## Backward Incompatibilities {#sec-release-17.09-incompatibilities}
+
+When upgrading from a previous release, please be aware of the following incompatible changes:
+
+- **In an Qemu-based virtualization environment, the network interface names changed from i.e. `enp0s3` to `ens3`.**
+
+  This is due to a kernel configuration change. The new naming is consistent with those of other Linux distributions with systemd. See [\#29197](https://github.com/NixOS/nixpkgs/issues/29197) for more information.
+
+  A machine is affected if the `virt-what` tool either returns `qemu` or `kvm` _and_ has interface names used in any part of its NixOS configuration, in particular if a static network configuration with `networking.interfaces` is used.
+
+  Before rebooting affected machines, please ensure:
+
+  - Change the interface names in your NixOS configuration. The first interface will be called `ens3`, the second one `ens8` and starting from there incremented by 1.
+
+  - After changing the interface names, rebuild your system with `nixos-rebuild boot` to activate the new configuration after a reboot. If you switch to the new configuration right away you might lose network connectivity! If using `nixops`, deploy with `nixops deploy --force-reboot`.
+
+- The following changes apply if the `stateVersion` is changed to 17.09 or higher. For `stateVersion = "17.03"` or lower the old behavior is preserved.
+
+  - The `postgres` default version was changed from 9.5 to 9.6.
+
+  - The `postgres` superuser name has changed from `root` to `postgres` to more closely follow what other Linux distributions are doing.
+
+  - The `postgres` default `dataDir` has changed from `/var/db/postgres` to `/var/lib/postgresql/$psqlSchema` where \$psqlSchema is 9.6 for example.
+
+  - The `mysql` default `dataDir` has changed from `/var/mysql` to `/var/lib/mysql`.
+
+  - Radicale\'s default package has changed from 1.x to 2.x. Instructions to migrate can be found [ here ](http://radicale.org/1to2/). It is also possible to use the newer version by setting the `package` to `radicale2`, which is done automatically when `stateVersion` is 17.09 or higher. The `extraArgs` option has been added to allow passing the data migration arguments specified in the instructions; see the `radicale.nix` NixOS test for an example migration.
+
+- The `aiccu` package was removed. This is due to SixXS [ sunsetting](https://www.sixxs.net/main/) its IPv6 tunnel.
+
+- The `fanctl` package and `fan` module have been removed due to the developers not upstreaming their iproute2 patches and lagging with compatibility to recent iproute2 versions.
+
+- Top-level `idea` package collection was renamed. All JetBrains IDEs are now at `jetbrains`.
+
+- `flexget`\'s state database cannot be upgraded to its new internal format, requiring removal of any existing `db-config.sqlite` which will be automatically recreated.
+
+- The `ipfs` service now doesn\'t ignore the `dataDir` option anymore. If you\'ve ever set this option to anything other than the default you\'ll have to either unset it (so the default gets used) or migrate the old data manually with
+
+  ```ShellSession
+  dataDir=<valueOfDataDir>
+  mv /var/lib/ipfs/.ipfs/* $dataDir
+  rmdir /var/lib/ipfs/.ipfs
+  ```
+
+- The `caddy` service was previously using an extra `.caddy` directory in the data directory specified with the `dataDir` option. The contents of the `.caddy` directory are now expected to be in the `dataDir`.
+
+- The `ssh-agent` user service is not started by default anymore. Use `programs.ssh.startAgent` to enable it if needed. There is also a new `programs.gnupg.agent` module that creates a `gpg-agent` user service. It can also serve as a SSH agent if `enableSSHSupport` is set.
+
+- The `services.tinc.networks.<name>.listenAddress` option had a misleading name that did not correspond to its behavior. It now correctly defines the ip to listen for incoming connections on. To keep the previous behaviour, use `services.tinc.networks.<name>.bindToAddress` instead. Refer to the description of the options for more details.
+
+- `tlsdate` package and module were removed. This is due to the project being dead and not building with openssl 1.1.
+
+- `wvdial` package and module were removed. This is due to the project being dead and not building with openssl 1.1.
+
+- `cc-wrapper`\'s setup-hook now exports a number of environment variables corresponding to binutils binaries, (e.g. `LD`, `STRIP`, `RANLIB`, etc). This is done to prevent packages\' build systems guessing, which is harder to predict, especially when cross-compiling. However, some packages have broken due to this---their build systems either not supporting, or claiming to support without adequate testing, taking such environment variables as parameters.
+
+- `services.firefox.syncserver` now runs by default as a non-root user. To accomodate this change, the default sqlite database location has also been changed. Migration should work automatically. Refer to the description of the options for more details.
+
+- The `compiz` window manager and package was removed. The system support had been broken for several years.
+
+- Touchpad support should now be enabled through `libinput` as `synaptics` is now deprecated. See the option `services.xserver.libinput.enable`.
+
+- grsecurity/PaX support has been dropped, following upstream\'s decision to cease free support. See [ upstream\'s announcement](https://grsecurity.net/passing_the_baton.php) for more information. No complete replacement for grsecurity/PaX is available presently.
+
+- `services.mysql` now has declarative configuration of databases and users with the `ensureDatabases` and `ensureUsers` options.
+
+  These options will never delete existing databases and users, especially not when the value of the options are changed.
+
+  The MySQL users will be identified using [ Unix socket authentication](https://mariadb.com/kb/en/library/authentication-plugin-unix-socket/). This authenticates the Unix user with the same name only, and that without the need for a password.
+
+  If you have previously created a MySQL `root` user _with a password_, you will need to add `root` user for unix socket authentication before using the new options. This can be done by running the following SQL script:
+
+  ```SQL
+  CREATE USER 'root'@'%' IDENTIFIED BY '';
+  GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' WITH GRANT OPTION;
+  FLUSH PRIVILEGES;
+
+  -- Optionally, delete the password-authenticated user:
+  -- DROP USER 'root'@'localhost';
+  ```
+
+- `services.mysqlBackup` now works by default without any user setup, including for users other than `mysql`.
+
+  By default, the `mysql` user is no longer the user which performs the backup. Instead a system account `mysqlbackup` is used.
+
+  The `mysqlBackup` service is also now using systemd timers instead of `cron`.
+
+  Therefore, the `services.mysqlBackup.period` option no longer exists, and has been replaced with `services.mysqlBackup.calendar`, which is in the format of [systemd.time(7)](https://www.freedesktop.org/software/systemd/man/systemd.time.html#Calendar%20Events).
+
+  If you expect to be sent an e-mail when the backup fails, consider using a script which monitors the systemd journal for errors. Regretfully, at present there is no built-in functionality for this.
+
+  You can check that backups still work by running `systemctl start mysql-backup` then `systemctl status mysql-backup`.
+
+- Templated systemd services e.g `container@name` are now handled currectly when switching to a new configuration, resulting in them being reloaded.
+
+- Steam: the `newStdcpp` parameter was removed and should not be needed anymore.
+
+- Redis has been updated to version 4 which mandates a cluster mass-restart, due to changes in the network handling, in order to ensure compatibility with networks NATing traffic.
+
+## Other Notable Changes {#sec-release-17.09-notable-changes}
+
+- Modules can now be disabled by using [ disabledModules](https://nixos.org/nixpkgs/manual/#sec-replace-modules), allowing another to take it\'s place. This can be used to import a set of modules from another channel while keeping the rest of the system on a stable release.
+
+- Updated to FreeType 2.7.1, including a new TrueType engine. The new engine replaces the Infinality engine which was the default in NixOS. The default font rendering settings are now provided by fontconfig-penultimate, replacing fontconfig-ultimate; the new defaults are less invasive and provide rendering that is more consistent with other systems and hopefully with each font designer\'s intent. Some system-wide configuration has been removed from the Fontconfig NixOS module where user Fontconfig settings are available.
+
+- ZFS/SPL have been updated to 0.7.0, `zfsUnstable, splUnstable` have therefore been removed.
+
+- The `time.timeZone` option now allows the value `null` in addition to timezone strings. This value allows changing the timezone of a system imperatively using `timedatectl set-timezone`. The default timezone is still UTC.
+
+- Nixpkgs overlays may now be specified with a file as well as a directory. The value of `<nixpkgs-overlays>` may be a file, and `~/.config/nixpkgs/overlays.nix` can be used instead of the `~/.config/nixpkgs/overlays` directory.
+
+  See the overlays chapter of the Nixpkgs manual for more details.
+
+- Definitions for `/etc/hosts` can now be specified declaratively with `networking.hosts`.
+
+- Two new options have been added to the installer loader, in addition to the default having changed. The kernel log verbosity has been lowered to the upstream default for the default options, in order to not spam the console when e.g. joining a network.
+
+  This therefore leads to adding a new `debug` option to set the log level to the previous verbose mode, to make debugging easier, but still accessible easily.
+
+  Additionally a `copytoram` option has been added, which makes it possible to remove the install medium after booting. This allows tethering from your phone after booting from it.
+
+- `services.gitlab-runner.configOptions` has been added to specify the configuration of gitlab-runners declaratively.
+
+- `services.jenkins.plugins` has been added to install plugins easily, this can be generated with jenkinsPlugins2nix.
+
+- `services.postfix.config` has been added to specify the main.cf with NixOS options. Additionally other options have been added to the postfix module and has been improved further.
+
+- The GitLab package and module have been updated to the latest 10.0 release.
+
+- The `systemd-boot` boot loader now lists the NixOS version, kernel version and build date of all bootable generations.
+
+- The dnscrypt-proxy service now defaults to using a random upstream resolver, selected from the list of public non-logging resolvers with DNSSEC support. Existing configurations can be migrated to this mode of operation by omitting the `services.dnscrypt-proxy.resolverName` option or setting it to `"random"`.
diff --git a/nixos/doc/manual/release-notes/rl-1709.xml b/nixos/doc/manual/release-notes/rl-1709.xml
deleted file mode 100644
index 795c51d2923d..000000000000
--- a/nixos/doc/manual/release-notes/rl-1709.xml
+++ /dev/null
@@ -1,899 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-17.09">
- <title>Release 17.09 (“Hummingbird”, 2017/09/??)</title>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-17.09-highlights">
-  <title>Highlights</title>
-
-  <para>
-   In addition to numerous new and upgraded packages, this release has the
-   following highlights:
-  </para>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     The GNOME version is now 3.24. KDE Plasma was upgraded to 5.10, KDE
-     Applications to 17.08.1 and KDE Frameworks to 5.37.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The user handling now keeps track of deallocated UIDs/GIDs. When a user or
-     group is revived, this allows it to be allocated the UID/GID it had
-     before. A consequence is that UIDs and GIDs are no longer reused.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The module option <option>services.xserver.xrandrHeads</option> now causes
-     the first head specified in this list to be set as the primary head. Apart
-     from that, it's now possible to also set additional options by using an
-     attribute set, for example:
-<programlisting>
-{ services.xserver.xrandrHeads = [
-    "HDMI-0"
-    {
-      output = &quot;DVI-0&quot;;
-      primary = true;
-      monitorConfig = ''
-        Option &quot;Rotate&quot; &quot;right&quot;
-      '';
-    }
-  ];
-}
-</programlisting>
-     This will set the <literal>DVI-0</literal> output to be the primary head,
-     even though <literal>HDMI-0</literal> is the first head in the list.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The handling of SSL in the <literal>services.nginx</literal> module has
-     been cleaned up, renaming the misnamed <literal>enableSSL</literal> to
-     <literal>onlySSL</literal> which reflects its original intention. This is
-     not to be used with the already existing <literal>forceSSL</literal> which
-     creates a second non-SSL virtual host redirecting to the SSL virtual host.
-     This by chance had worked earlier due to specific implementation details.
-     In case you had specified both please remove the
-     <literal>enableSSL</literal> option to keep the previous behaviour.
-    </para>
-    <para>
-     Another <literal>addSSL</literal> option has been introduced to configure
-     both a non-SSL virtual host and an SSL virtual host with the same
-     configuration.
-    </para>
-    <para>
-     Options to configure <literal>resolver</literal> options and
-     <literal>upstream</literal> blocks have been introduced. See their
-     information for further details.
-    </para>
-    <para>
-     The <literal>port</literal> option has been replaced by a more generic
-     <literal>listen</literal> option which makes it possible to specify
-     multiple addresses, ports and SSL configs dependant on the new SSL
-     handling mentioned above.
-    </para>
-   </listitem>
-  </itemizedlist>
- </section>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-17.09-new-services">
-  <title>New Services</title>
-
-  <para>
-   The following new services were added since the last release:
-  </para>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     <literal>config/fonts/fontconfig-penultimate.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>config/fonts/fontconfig-ultimate.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>config/terminfo.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>hardware/sensor/iio.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>hardware/nitrokey.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>hardware/raid/hpsa.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>programs/browserpass.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>programs/gnupg.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>programs/qt5ct.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>programs/slock.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>programs/thefuck.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>security/auditd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>security/lock-kernel-modules.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>service-managers/docker.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>service-managers/trivial.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/admin/salt/master.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/admin/salt/minion.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/audio/slimserver.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/cluster/kubernetes/default.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/cluster/kubernetes/dns.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/cluster/kubernetes/dashboard.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/continuous-integration/hail.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/databases/clickhouse.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/databases/postage.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/desktops/gnome3/gnome-disks.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/desktops/gnome3/gpaste.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/logging/SystemdJournal2Gelf.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/logging/heartbeat.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/logging/journalwatch.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/logging/syslogd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/mail/mailhog.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/mail/nullmailer.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/airsonic.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/autorandr.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/exhibitor.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/fstrim.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/gollum.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/irkerd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/jackett.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/radarr.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/misc/snapper.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/monitoring/osquery.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/monitoring/prometheus/collectd-exporter.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/monitoring/prometheus/fritzbox-exporter.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/network-filesystems/kbfs.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/dnscache.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/fireqos.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/iwd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/keepalived/default.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/keybase.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/lldpd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/matterbridge.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/squid.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/tinydns.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/networking/xrdp.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/security/shibboleth-sp.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/security/sks.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/security/sshguard.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/security/torify.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/security/usbguard.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/security/vault.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/system/earlyoom.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/system/saslauthd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/web-apps/nexus.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/web-apps/pgpkeyserver-lite.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/web-apps/piwik.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/web-servers/lighttpd/collectd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/web-servers/minio.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/x11/display-managers/xpra.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services/x11/xautolock.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>tasks/filesystems/bcachefs.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>tasks/powertop.nix</literal>
-    </para>
-   </listitem>
-  </itemizedlist>
- </section>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-17.09-incompatibilities">
-  <title>Backward Incompatibilities</title>
-
-  <para>
-   When upgrading from a previous release, please be aware of the following
-   incompatible changes:
-  </para>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     <emphasis role="strong"> In an Qemu-based virtualization environment, the
-     network interface names changed from i.e. <literal>enp0s3</literal> to
-     <literal>ens3</literal>. </emphasis>
-    </para>
-    <para>
-     This is due to a kernel configuration change. The new naming is consistent
-     with those of other Linux distributions with systemd. See
-     <link xlink:href="https://github.com/NixOS/nixpkgs/issues/29197">#29197</link>
-     for more information.
-    </para>
-    <para>
-     A machine is affected if the <literal>virt-what</literal> tool either
-     returns <literal>qemu</literal> or <literal>kvm</literal>
-     <emphasis>and</emphasis> has interface names used in any part of its NixOS
-     configuration, in particular if a static network configuration with
-     <literal>networking.interfaces</literal> is used.
-    </para>
-    <para>
-     Before rebooting affected machines, please ensure:
-     <itemizedlist>
-      <listitem>
-       <para>
-        Change the interface names in your NixOS configuration. The first
-        interface will be called <literal>ens3</literal>, the second one
-        <literal>ens8</literal> and starting from there incremented by 1.
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        After changing the interface names, rebuild your system with
-        <literal>nixos-rebuild boot</literal> to activate the new configuration
-        after a reboot. If you switch to the new configuration right away you
-        might lose network connectivity! If using <literal>nixops</literal>,
-        deploy with <literal>nixops deploy --force-reboot</literal>.
-       </para>
-      </listitem>
-     </itemizedlist>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The following changes apply if the <literal>stateVersion</literal> is
-     changed to 17.09 or higher. For <literal>stateVersion = "17.03"</literal>
-     or lower the old behavior is preserved.
-    </para>
-    <itemizedlist>
-     <listitem>
-      <para>
-       The <literal>postgres</literal> default version was changed from 9.5 to
-       9.6.
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       The <literal>postgres</literal> superuser name has changed from
-       <literal>root</literal> to <literal>postgres</literal> to more closely
-       follow what other Linux distributions are doing.
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       The <literal>postgres</literal> default <literal>dataDir</literal> has
-       changed from <literal>/var/db/postgres</literal> to
-       <literal>/var/lib/postgresql/$psqlSchema</literal> where $psqlSchema is
-       9.6 for example.
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       The <literal>mysql</literal> default <literal>dataDir</literal> has
-       changed from <literal>/var/mysql</literal> to
-       <literal>/var/lib/mysql</literal>.
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       Radicale's default package has changed from 1.x to 2.x. Instructions to
-       migrate can be found <link xlink:href="http://radicale.org/1to2/"> here
-       </link>. It is also possible to use the newer version by setting the
-       <literal>package</literal> to <literal>radicale2</literal>, which is
-       done automatically when <literal>stateVersion</literal> is 17.09 or
-       higher. The <literal>extraArgs</literal> option has been added to allow
-       passing the data migration arguments specified in the instructions; see
-       the
-       <filename xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/radicale.nix">radicale.nix</filename>
-       NixOS test for an example migration.
-      </para>
-     </listitem>
-    </itemizedlist>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>aiccu</literal> package was removed. This is due to SixXS
-     <link xlink:href="https://www.sixxs.net/main/"> sunsetting</link> its IPv6
-     tunnel.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>fanctl</literal> package and <literal>fan</literal> module
-     have been removed due to the developers not upstreaming their iproute2
-     patches and lagging with compatibility to recent iproute2 versions.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Top-level <literal>idea</literal> package collection was renamed. All
-     JetBrains IDEs are now at <literal>jetbrains</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>flexget</literal>'s state database cannot be upgraded to its new
-     internal format, requiring removal of any existing
-     <literal>db-config.sqlite</literal> which will be automatically recreated.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>ipfs</literal> service now doesn't ignore the
-     <literal>dataDir</literal> option anymore. If you've ever set this option
-     to anything other than the default you'll have to either unset it (so the
-     default gets used) or migrate the old data manually with
-<programlisting>
-dataDir=&lt;valueOfDataDir&gt;
-mv /var/lib/ipfs/.ipfs/* $dataDir
-rmdir /var/lib/ipfs/.ipfs
-</programlisting>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>caddy</literal> service was previously using an extra
-     <literal>.caddy</literal> directory in the data directory specified with
-     the <literal>dataDir</literal> option. The contents of the
-     <literal>.caddy</literal> directory are now expected to be in the
-     <literal>dataDir</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>ssh-agent</literal> user service is not started by default
-     anymore. Use <literal>programs.ssh.startAgent</literal> to enable it if
-     needed. There is also a new <literal>programs.gnupg.agent</literal> module
-     that creates a <literal>gpg-agent</literal> user service. It can also
-     serve as a SSH agent if <literal>enableSSHSupport</literal> is set.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>services.tinc.networks.&lt;name&gt;.listenAddress</literal>
-     option had a misleading name that did not correspond to its behavior. It
-     now correctly defines the ip to listen for incoming connections on. To
-     keep the previous behaviour, use
-     <literal>services.tinc.networks.&lt;name&gt;.bindToAddress</literal>
-     instead. Refer to the description of the options for more details.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>tlsdate</literal> package and module were removed. This is due to
-     the project being dead and not building with openssl 1.1.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>wvdial</literal> package and module were removed. This is due to
-     the project being dead and not building with openssl 1.1.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>cc-wrapper</literal>'s setup-hook now exports a number of
-     environment variables corresponding to binutils binaries, (e.g.
-     <envar>LD</envar>, <envar>STRIP</envar>, <envar>RANLIB</envar>, etc). This
-     is done to prevent packages' build systems guessing, which is harder to
-     predict, especially when cross-compiling. However, some packages have
-     broken due to this—their build systems either not supporting, or
-     claiming to support without adequate testing, taking such environment
-     variables as parameters.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services.firefox.syncserver</literal> now runs by default as a
-     non-root user. To accomodate this change, the default sqlite database
-     location has also been changed. Migration should work automatically. Refer
-     to the description of the options for more details.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>compiz</literal> window manager and package was removed. The
-     system support had been broken for several years.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Touchpad support should now be enabled through <literal>libinput</literal>
-     as <literal>synaptics</literal> is now deprecated. See the option
-     <literal>services.xserver.libinput.enable</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     grsecurity/PaX support has been dropped, following upstream's decision to
-     cease free support. See
-     <link xlink:href="https://grsecurity.net/passing_the_baton.php">
-     upstream's announcement</link> for more information. No complete
-     replacement for grsecurity/PaX is available presently.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services.mysql</literal> now has declarative configuration of
-     databases and users with the <literal>ensureDatabases</literal> and
-     <literal>ensureUsers</literal> options.
-    </para>
-    <para>
-     These options will never delete existing databases and users, especially
-     not when the value of the options are changed.
-    </para>
-    <para>
-     The MySQL users will be identified using
-     <link xlink:href="https://mariadb.com/kb/en/library/authentication-plugin-unix-socket/">
-     Unix socket authentication</link>. This authenticates the Unix user with
-     the same name only, and that without the need for a password.
-    </para>
-    <para>
-     If you have previously created a MySQL <literal>root</literal> user
-     <emphasis>with a password</emphasis>, you will need to add
-     <literal>root</literal> user for unix socket authentication before using
-     the new options. This can be done by running the following SQL script:
-<programlisting language="sql">
-CREATE USER 'root'@'%' IDENTIFIED BY '';
-GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' WITH GRANT OPTION;
-FLUSH PRIVILEGES;
-
--- Optionally, delete the password-authenticated user:
--- DROP USER 'root'@'localhost';
-</programlisting>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services.mysqlBackup</literal> now works by default without any
-     user setup, including for users other than <literal>mysql</literal>.
-    </para>
-    <para>
-     By default, the <literal>mysql</literal> user is no longer the user which
-     performs the backup. Instead a system account
-     <literal>mysqlbackup</literal> is used.
-    </para>
-    <para>
-     The <literal>mysqlBackup</literal> service is also now using systemd
-     timers instead of <literal>cron</literal>.
-    </para>
-    <para>
-     Therefore, the <literal>services.mysqlBackup.period</literal> option no
-     longer exists, and has been replaced with
-     <literal>services.mysqlBackup.calendar</literal>, which is in the format
-     of
-     <link
-      xlink:href="https://www.freedesktop.org/software/systemd/man/systemd.time.html#Calendar%20Events">systemd.time(7)</link>.
-    </para>
-    <para>
-     If you expect to be sent an e-mail when the backup fails, consider using a
-     script which monitors the systemd journal for errors. Regretfully, at
-     present there is no built-in functionality for this.
-    </para>
-    <para>
-     You can check that backups still work by running <command>systemctl start
-     mysql-backup</command> then <command>systemctl status
-     mysql-backup</command>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Templated systemd services e.g <literal>container@name</literal> are now
-     handled currectly when switching to a new configuration, resulting in them
-     being reloaded.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Steam: the <literal>newStdcpp</literal> parameter was removed and should
-     not be needed anymore.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Redis has been updated to version 4 which mandates a cluster mass-restart,
-     due to changes in the network handling, in order to ensure compatibility
-     with networks NATing traffic.
-    </para>
-   </listitem>
-  </itemizedlist>
- </section>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-17.09-notable-changes">
-  <title>Other Notable Changes</title>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     Modules can now be disabled by using
-     <link
-      xlink:href="https://nixos.org/nixpkgs/manual/#sec-replace-modules">
-     disabledModules</link>, allowing another to take it's place. This can be
-     used to import a set of modules from another channel while keeping the
-     rest of the system on a stable release.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Updated to FreeType 2.7.1, including a new TrueType engine. The new engine
-     replaces the Infinality engine which was the default in NixOS. The default
-     font rendering settings are now provided by fontconfig-penultimate,
-     replacing fontconfig-ultimate; the new defaults are less invasive and
-     provide rendering that is more consistent with other systems and hopefully
-     with each font designer's intent. Some system-wide configuration has been
-     removed from the Fontconfig NixOS module where user Fontconfig settings
-     are available.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     ZFS/SPL have been updated to 0.7.0, <literal>zfsUnstable,
-     splUnstable</literal> have therefore been removed.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <option>time.timeZone</option> option now allows the value
-     <literal>null</literal> in addition to timezone strings. This value allows
-     changing the timezone of a system imperatively using <command>timedatectl
-     set-timezone</command>. The default timezone is still UTC.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Nixpkgs overlays may now be specified with a file as well as a directory.
-     The value of <literal>&lt;nixpkgs-overlays></literal> may be a file, and
-     <filename>~/.config/nixpkgs/overlays.nix</filename> can be used instead of
-     the <filename>~/.config/nixpkgs/overlays</filename> directory.
-    </para>
-    <para>
-     See the overlays chapter of the Nixpkgs manual for more details.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Definitions for <filename>/etc/hosts</filename> can now be specified
-     declaratively with <literal>networking.hosts</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Two new options have been added to the installer loader, in addition to
-     the default having changed. The kernel log verbosity has been lowered to
-     the upstream default for the default options, in order to not spam the
-     console when e.g. joining a network.
-    </para>
-    <para>
-     This therefore leads to adding a new <literal>debug</literal> option to
-     set the log level to the previous verbose mode, to make debugging easier,
-     but still accessible easily.
-    </para>
-    <para>
-     Additionally a <literal>copytoram</literal> option has been added, which
-     makes it possible to remove the install medium after booting. This allows
-     tethering from your phone after booting from it.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services.gitlab-runner.configOptions</literal> has been added to
-     specify the configuration of gitlab-runners declaratively.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services.jenkins.plugins</literal> has been added to install
-     plugins easily, this can be generated with jenkinsPlugins2nix.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services.postfix.config</literal> has been added to specify the
-     main.cf with NixOS options. Additionally other options have been added to
-     the postfix module and has been improved further.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The GitLab package and module have been updated to the latest 10.0
-     release.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>systemd-boot</literal> boot loader now lists the NixOS
-     version, kernel version and build date of all bootable generations.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The dnscrypt-proxy service now defaults to using a random upstream
-     resolver, selected from the list of public non-logging resolvers with
-     DNSSEC support. Existing configurations can be migrated to this mode of
-     operation by omitting the
-     <option>services.dnscrypt-proxy.resolverName</option> option or setting it
-     to <literal>"random"</literal>.
-    </para>
-   </listitem>
-  </itemizedlist>
- </section>
-</section>
diff --git a/nixos/doc/manual/release-notes/rl-1803.section.md b/nixos/doc/manual/release-notes/rl-1803.section.md
new file mode 100644
index 000000000000..e4e467981047
--- /dev/null
+++ b/nixos/doc/manual/release-notes/rl-1803.section.md
@@ -0,0 +1,284 @@
+# Release 18.03 ("Impala", 2018/04/04) {#sec-release-18.03}
+
+## Highlights {#sec-release-18.03-highlights}
+
+In addition to numerous new and upgraded packages, this release has the following highlights:
+
+- End of support is planned for end of October 2018, handing over to 18.09.
+
+- Platform support: x86_64-linux and x86_64-darwin since release time (the latter isn\'t NixOS, really). Binaries for aarch64-linux are available, but no channel exists yet, as it\'s waiting for some test fixes, etc.
+
+- Nix now defaults to 2.0; see its [release notes](https://nixos.org/nix/manual/#ssec-relnotes-2.0).
+
+- Core version changes: linux: 4.9 -\> 4.14, glibc: 2.25 -\> 2.26, gcc: 6 -\> 7, systemd: 234 -\> 237.
+
+- Desktop version changes: gnome: 3.24 -\> 3.26, (KDE) plasma-desktop: 5.10 -\> 5.12.
+
+- MariaDB 10.2, updated from 10.1, is now the default MySQL implementation. While upgrading a few changes have been made to the infrastructure involved:
+
+  - `libmysql` has been deprecated, please use `mysql.connector-c` instead, a compatibility passthru has been added to the MySQL packages.
+
+  - The `mysql57` package has a new `static` output containing the static libraries including `libmysqld.a`
+
+- PHP now defaults to PHP 7.2, updated from 7.1.
+
+## New Services {#sec-release-18.03-new-services}
+
+The following new services were added since the last release:
+
+- `./config/krb5/default.nix`
+
+- `./hardware/digitalbitbox.nix`
+
+- `./misc/label.nix`
+
+- `./programs/ccache.nix`
+
+- `./programs/criu.nix`
+
+- `./programs/digitalbitbox/default.nix`
+
+- `./programs/less.nix`
+
+- `./programs/npm.nix`
+
+- `./programs/plotinus.nix`
+
+- `./programs/rootston.nix`
+
+- `./programs/systemtap.nix`
+
+- `./programs/sway.nix`
+
+- `./programs/udevil.nix`
+
+- `./programs/way-cooler.nix`
+
+- `./programs/yabar.nix`
+
+- `./programs/zsh/zsh-autoenv.nix`
+
+- `./services/backup/borgbackup.nix`
+
+- `./services/backup/crashplan-small-business.nix`
+
+- `./services/desktops/dleyna-renderer.nix`
+
+- `./services/desktops/dleyna-server.nix`
+
+- `./services/desktops/pipewire.nix`
+
+- `./services/desktops/gnome3/chrome-gnome-shell.nix`
+
+- `./services/desktops/gnome3/tracker-miners.nix`
+
+- `./services/hardware/fwupd.nix`
+
+- `./services/hardware/interception-tools.nix`
+
+- `./services/hardware/u2f.nix`
+
+- `./services/hardware/usbmuxd.nix`
+
+- `./services/mail/clamsmtp.nix`
+
+- `./services/mail/dkimproxy-out.nix`
+
+- `./services/mail/pfix-srsd.nix`
+
+- `./services/misc/gitea.nix`
+
+- `./services/misc/home-assistant.nix`
+
+- `./services/misc/ihaskell.nix`
+
+- `./services/misc/logkeys.nix`
+
+- `./services/misc/novacomd.nix`
+
+- `./services/misc/osrm.nix`
+
+- `./services/misc/plexpy.nix`
+
+- `./services/misc/pykms.nix`
+
+- `./services/misc/tzupdate.nix`
+
+- `./services/monitoring/fusion-inventory.nix`
+
+- `./services/monitoring/prometheus/exporters.nix`
+
+- `./services/network-filesystems/beegfs.nix`
+
+- `./services/network-filesystems/davfs2.nix`
+
+- `./services/network-filesystems/openafs/client.nix`
+
+- `./services/network-filesystems/openafs/server.nix`
+
+- `./services/network-filesystems/ceph.nix`
+
+- `./services/networking/aria2.nix`
+
+- `./services/networking/monero.nix`
+
+- `./services/networking/nghttpx/default.nix`
+
+- `./services/networking/nixops-dns.nix`
+
+- `./services/networking/rxe.nix`
+
+- `./services/networking/stunnel.nix`
+
+- `./services/web-apps/matomo.nix`
+
+- `./services/web-apps/restya-board.nix`
+
+- `./services/web-servers/mighttpd2.nix`
+
+- `./services/x11/fractalart.nix`
+
+- `./system/boot/binfmt.nix`
+
+- `./system/boot/grow-partition.nix`
+
+- `./tasks/filesystems/ecryptfs.nix`
+
+- `./virtualisation/hyperv-guest.nix`
+
+## Backward Incompatibilities {#sec-release-18.03-incompatibilities}
+
+When upgrading from a previous release, please be aware of the following incompatible changes:
+
+- `sound.enable` now defaults to false.
+
+- Dollar signs in options under `services.postfix` are passed verbatim to Postfix, which will interpret them as the beginning of a parameter expression. This was already true for string-valued options in the previous release, but not for list-valued options. If you need to pass literal dollar signs through Postfix, double them.
+
+- The `postage` package (for web-based PostgreSQL administration) has been renamed to `pgmanage`. The corresponding module has also been renamed. To migrate please rename all `services.postage` options to `services.pgmanage`.
+
+- Package attributes starting with a digit have been prefixed with an underscore sign. This is to avoid quoting in the configuration and other issues with command-line tools like `nix-env`. The change affects the following packages:
+
+  - `2048-in-terminal` → `_2048-in-terminal`
+
+  - `90secondportraits` → `_90secondportraits`
+
+  - `2bwm` → `_2bwm`
+
+  - `389-ds-base` → `_389-ds-base`
+
+- **The OpenSSH service no longer enables support for DSA keys by default, which could cause a system lock out. Update your keys or, unfavorably, re-enable DSA support manually.**
+
+  DSA support was [deprecated in OpenSSH 7.0](https://www.openssh.com/legacy.html), due to it being too weak. To re-enable support, add `PubkeyAcceptedKeyTypes +ssh-dss` to the end of your `services.openssh.extraConfig`.
+
+  After updating the keys to be stronger, anyone still on a pre-17.03 version is safe to jump to 17.03, as vetted [here](https://search.nix.gsc.io/?q=stateVersion).
+
+- The `openssh` package now includes Kerberos support by default; the `openssh_with_kerberos` package is now a deprecated alias. If you do not want Kerberos support, you can do `openssh.override { withKerberos = false; }`. Note, this also applies to the `openssh_hpn` package.
+
+- `cc-wrapper` has been split in two; there is now also a `bintools-wrapper`. The most commonly used files in `nix-support` are now split between the two wrappers. Some commonly used ones, like `nix-support/dynamic-linker`, are duplicated for backwards compatability, even though they rightly belong only in `bintools-wrapper`. Other more obscure ones are just moved.
+
+- The propagation logic has been changed. The new logic, along with new types of dependencies that go with, is thoroughly documented in the \"Specifying dependencies\" section of the \"Standard Environment\" chapter of the nixpkgs manual. The old logic isn\'t but is easy to describe: dependencies were propagated as the same type of dependency no matter what. In practice, that means that many `propagatedNativeBuildInputs` should instead be `propagatedBuildInputs`. Thankfully, that was and is the least used type of dependency. Also, it means that some `propagatedBuildInputs` should instead be `depsTargetTargetPropagated`. Other types dependencies should be unaffected.
+
+- `lib.addPassthru drv passthru` is removed. Use `lib.extendDerivation true passthru drv` instead.
+
+- The `memcached` service no longer accept dynamic socket paths via `services.memcached.socket`. Unix sockets can be still enabled by `services.memcached.enableUnixSocket` and will be accessible at `/run/memcached/memcached.sock`.
+
+- The `hardware.amdHybridGraphics.disable` option was removed for lack of a maintainer. If you still need this module, you may wish to include a copy of it from an older version of nixos in your imports.
+
+- The merging of config options for `services.postfix.config` was buggy. Previously, if other options in the Postfix module like `services.postfix.useSrs` were set and the user set config options that were also set by such options, the resulting config wouldn\'t include all options that were needed. They are now merged correctly. If config options need to be overridden, `lib.mkForce` or `lib.mkOverride` can be used.
+
+- The following changes apply if the `stateVersion` is changed to 18.03 or higher. For `stateVersion = "17.09"` or lower the old behavior is preserved.
+
+  - `matrix-synapse` uses postgresql by default instead of sqlite. Migration instructions can be found [ here ](https://github.com/matrix-org/synapse/blob/master/docs/postgres.rst#porting-from-sqlite).
+
+- The `jid` package has been removed, due to maintenance overhead of a go package having non-versioned dependencies.
+
+- When using `services.xserver.libinput` (enabled by default in GNOME), it now handles all input devices, not just touchpads. As a result, you might need to re-evaluate any custom Xorg configuration. In particular, `Option "XkbRules" "base"` may result in broken keyboard layout.
+
+- The `attic` package was removed. A maintained fork called [Borg](https://www.borgbackup.org/) should be used instead. Migration instructions can be found [here](http://borgbackup.readthedocs.io/en/stable/usage/upgrade.html#attic-and-borg-0-xx-to-borg-1-x).
+
+- The Piwik analytics software was renamed to Matomo:
+
+  - The package `pkgs.piwik` was renamed to `pkgs.matomo`.
+
+  - The service `services.piwik` was renamed to `services.matomo`.
+
+  - The data directory `/var/lib/piwik` was renamed to `/var/lib/matomo`. All files will be moved automatically on first startup, but you might need to adjust your backup scripts.
+
+  - The default `serverName` for the nginx configuration changed from `piwik.${config.networking.hostName}` to `matomo.${config.networking.hostName}.${config.networking.domain}` if `config.networking.domain` is set, `matomo.${config.networking.hostName}` if it is not set. If you change your `serverName`, remember you\'ll need to update the `trustedHosts[]` array in `/var/lib/matomo/config/config.ini.php` as well.
+
+  - The `piwik` user was renamed to `matomo`. The service will adjust ownership automatically for files in the data directory. If you use unix socket authentication, remember to give the new `matomo` user access to the database and to change the `username` to `matomo` in the `[database]` section of `/var/lib/matomo/config/config.ini.php`.
+
+  - If you named your database \`piwik\`, you might want to rename it to \`matomo\` to keep things clean, but this is neither enforced nor required.
+
+- `nodejs-4_x` is end-of-life. `nodejs-4_x`, `nodejs-slim-4_x` and `nodePackages_4_x` are removed.
+
+- The `pump.io` NixOS module was removed. It is now maintained as an [external module](https://github.com/rvl/pump.io-nixos).
+
+- The Prosody XMPP server has received a major update. The following modules were renamed:
+
+  - `services.prosody.modules.httpserver` is now `services.prosody.modules.http_files`
+
+  - `services.prosody.modules.console` is now `services.prosody.modules.admin_telnet`
+
+  Many new modules are now core modules, most notably `services.prosody.modules.carbons` and `services.prosody.modules.mam`.
+
+  The better-performing `libevent` backend is now enabled by default.
+
+  `withCommunityModules` now passes through the modules to `services.prosody.extraModules`. Use `withOnlyInstalledCommunityModules` for modules that should not be enabled directly, e.g `lib_ldap`.
+
+- All prometheus exporter modules are now defined as submodules. The exporters are configured using `services.prometheus.exporters`.
+
+## Other Notable Changes {#sec-release-18.03-notable-changes}
+
+- ZNC option `services.znc.mutable` now defaults to `true`. That means that old configuration is not overwritten by default when update to the znc options are made.
+
+- The option `networking.wireless.networks.<name>.auth` has been added for wireless networks with WPA-Enterprise authentication. There is also a new `extraConfig` option to directly configure `wpa_supplicant` and `hidden` to connect to hidden networks.
+
+- In the module `networking.interfaces.<name>` the following options have been removed:
+
+  - `ipAddress`
+
+  - `ipv6Address`
+
+  - `prefixLength`
+
+  - `ipv6PrefixLength`
+
+  - `subnetMask`
+
+  To assign static addresses to an interface the options `ipv4.addresses` and `ipv6.addresses` should be used instead. The options `ip4` and `ip6` have been renamed to `ipv4.addresses` `ipv6.addresses` respectively. The new options `ipv4.routes` and `ipv6.routes` have been added to set up static routing.
+
+- The option `services.logstash.listenAddress` is now `127.0.0.1` by default. Previously the default behaviour was to listen on all interfaces.
+
+- `services.btrfs.autoScrub` has been added, to periodically check btrfs filesystems for data corruption. If there\'s a correct copy available, it will automatically repair corrupted blocks.
+
+- `displayManager.lightdm.greeters.gtk.clock-format.` has been added, the clock format string (as expected by strftime, e.g. `%H:%M`) to use with the lightdm gtk greeter panel.
+
+  If set to null the default clock format is used.
+
+- `displayManager.lightdm.greeters.gtk.indicators` has been added, a list of allowed indicator modules to use with the lightdm gtk greeter panel.
+
+  Built-in indicators include `~a11y`, `~language`, `~session`, `~power`, `~clock`, `~host`, `~spacer`. Unity indicators can be represented by short name (e.g. `sound`, `power`), service file name, or absolute path.
+
+  If set to `null` the default indicators are used.
+
+  In order to have the previous default configuration add
+
+  ```nix
+  {
+    services.xserver.displayManager.lightdm.greeters.gtk.indicators = [
+      "~host" "~spacer"
+      "~clock" "~spacer"
+      "~session"
+      "~language"
+      "~a11y"
+      "~power"
+    ];
+  }
+  ```
+
+  to your `configuration.nix`.
+
+- The NixOS test driver supports user services declared by `systemd.user.services`. The methods `waitForUnit`, `getUnitInfo`, `startJob` and `stopJob` provide an optional `$user` argument for that purpose.
+
+- Enabling bash completion on NixOS, `programs.bash.enableCompletion`, will now also enable completion for the Nix command line tools by installing the [nix-bash-completions](https://github.com/hedning/nix-bash-completions) package.
diff --git a/nixos/doc/manual/release-notes/rl-1803.xml b/nixos/doc/manual/release-notes/rl-1803.xml
deleted file mode 100644
index c14679eea071..000000000000
--- a/nixos/doc/manual/release-notes/rl-1803.xml
+++ /dev/null
@@ -1,855 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-18.03">
- <title>Release 18.03 (“Impala”, 2018/04/04)</title>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-18.03-highlights">
-  <title>Highlights</title>
-
-  <para>
-   In addition to numerous new and upgraded packages, this release has the
-   following highlights:
-  </para>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     End of support is planned for end of October 2018, handing over to 18.09.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Platform support: x86_64-linux and x86_64-darwin since release time (the
-     latter isn't NixOS, really). Binaries for aarch64-linux are available, but
-     no channel exists yet, as it's waiting for some test fixes, etc.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Nix now defaults to 2.0; see its
-     <link xlink:href="https://nixos.org/nix/manual/#ssec-relnotes-2.0">release
-     notes</link>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Core version changes: linux: 4.9 -> 4.14, glibc: 2.25 -> 2.26, gcc: 6 ->
-     7, systemd: 234 -> 237.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Desktop version changes: gnome: 3.24 -> 3.26, (KDE) plasma-desktop: 5.10
-     -> 5.12.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     MariaDB 10.2, updated from 10.1, is now the default MySQL implementation.
-     While upgrading a few changes have been made to the infrastructure
-     involved:
-     <itemizedlist>
-      <listitem>
-       <para>
-        <literal>libmysql</literal> has been deprecated, please use
-        <literal>mysql.connector-c</literal> instead, a compatibility passthru
-        has been added to the MySQL packages.
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        The <literal>mysql57</literal> package has a new
-        <literal>static</literal> output containing the static libraries
-        including <literal>libmysqld.a</literal>
-       </para>
-      </listitem>
-     </itemizedlist>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     PHP now defaults to PHP 7.2, updated from 7.1.
-    </para>
-   </listitem>
-  </itemizedlist>
- </section>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-18.03-new-services">
-  <title>New Services</title>
-
-  <para>
-   The following new services were added since the last release:
-  </para>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     <literal>./config/krb5/default.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./hardware/digitalbitbox.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./misc/label.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./programs/ccache.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./programs/criu.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./programs/digitalbitbox/default.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./programs/less.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./programs/npm.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./programs/plotinus.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./programs/rootston.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./programs/systemtap.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./programs/sway.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./programs/udevil.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./programs/way-cooler.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./programs/yabar.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./programs/zsh/zsh-autoenv.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/backup/borgbackup.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/backup/crashplan-small-business.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/desktops/dleyna-renderer.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/desktops/dleyna-server.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/desktops/pipewire.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/desktops/gnome3/chrome-gnome-shell.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/desktops/gnome3/tracker-miners.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/hardware/fwupd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/hardware/interception-tools.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/hardware/u2f.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/hardware/usbmuxd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/mail/clamsmtp.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/mail/dkimproxy-out.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/mail/pfix-srsd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/misc/gitea.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/misc/home-assistant.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/misc/ihaskell.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/misc/logkeys.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/misc/novacomd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/misc/osrm.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/misc/plexpy.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/misc/pykms.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/misc/tzupdate.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/monitoring/fusion-inventory.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/monitoring/prometheus/exporters.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/network-filesystems/beegfs.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/network-filesystems/davfs2.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/network-filesystems/openafs/client.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/network-filesystems/openafs/server.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/network-filesystems/ceph.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/networking/aria2.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/networking/monero.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/networking/nghttpx/default.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/networking/nixops-dns.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/networking/rxe.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/networking/stunnel.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/web-apps/matomo.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/web-apps/restya-board.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/web-servers/mighttpd2.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/x11/fractalart.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./system/boot/binfmt.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./system/boot/grow-partition.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./tasks/filesystems/ecryptfs.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./virtualisation/hyperv-guest.nix</literal>
-    </para>
-   </listitem>
-  </itemizedlist>
- </section>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-18.03-incompatibilities">
-  <title>Backward Incompatibilities</title>
-
-  <para>
-   When upgrading from a previous release, please be aware of the following
-   incompatible changes:
-  </para>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     <literal>sound.enable</literal> now defaults to false.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Dollar signs in options under <option>services.postfix</option> are passed
-     verbatim to Postfix, which will interpret them as the beginning of a
-     parameter expression. This was already true for string-valued options in
-     the previous release, but not for list-valued options. If you need to pass
-     literal dollar signs through Postfix, double them.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>postage</literal> package (for web-based PostgreSQL
-     administration) has been renamed to <literal>pgmanage</literal>. The
-     corresponding module has also been renamed. To migrate please rename all
-     <option>services.postage</option> options to
-     <option>services.pgmanage</option>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Package attributes starting with a digit have been prefixed with an
-     underscore sign. This is to avoid quoting in the configuration and other
-     issues with command-line tools like <literal>nix-env</literal>. The change
-     affects the following packages:
-     <itemizedlist>
-      <listitem>
-       <para>
-        <literal>2048-in-terminal</literal> →
-        <literal>_2048-in-terminal</literal>
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        <literal>90secondportraits</literal> →
-        <literal>_90secondportraits</literal>
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        <literal>2bwm</literal> → <literal>_2bwm</literal>
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        <literal>389-ds-base</literal> → <literal>_389-ds-base</literal>
-       </para>
-      </listitem>
-     </itemizedlist>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <emphasis role="strong"> The OpenSSH service no longer enables support for
-     DSA keys by default, which could cause a system lock out. Update your keys
-     or, unfavorably, re-enable DSA support manually. </emphasis>
-    </para>
-    <para>
-     DSA support was
-     <link xlink:href="https://www.openssh.com/legacy.html">deprecated in
-     OpenSSH 7.0</link>, due to it being too weak. To re-enable support, add
-     <literal>PubkeyAcceptedKeyTypes +ssh-dss</literal> to the end of your
-     <option>services.openssh.extraConfig</option>.
-    </para>
-    <para>
-     After updating the keys to be stronger, anyone still on a pre-17.03
-     version is safe to jump to 17.03, as vetted
-     <link xlink:href="https://search.nix.gsc.io/?q=stateVersion">here</link>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>openssh</literal> package now includes Kerberos support by
-     default; the <literal>openssh_with_kerberos</literal> package is now a
-     deprecated alias. If you do not want Kerberos support, you can do
-     <literal>openssh.override { withKerberos = false; }</literal>. Note, this
-     also applies to the <literal>openssh_hpn</literal> package.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>cc-wrapper</literal> has been split in two; there is now also a
-     <literal>bintools-wrapper</literal>. The most commonly used files in
-     <filename>nix-support</filename> are now split between the two wrappers.
-     Some commonly used ones, like
-     <filename>nix-support/dynamic-linker</filename>, are duplicated for
-     backwards compatability, even though they rightly belong only in
-     <literal>bintools-wrapper</literal>. Other more obscure ones are just
-     moved.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The propagation logic has been changed. The new logic, along with new
-     types of dependencies that go with, is thoroughly documented in the
-     "Specifying dependencies" section of the "Standard Environment" chapter of
-     the nixpkgs manual.
-<!-- That's <xref linkend="ssec-stdenv-attributes"> were we to merge the manuals. -->
-     The old logic isn't but is easy to describe: dependencies were propagated
-     as the same type of dependency no matter what. In practice, that means
-     that many <function>propagatedNativeBuildInputs</function> should instead
-     be <function>propagatedBuildInputs</function>. Thankfully, that was and is
-     the least used type of dependency. Also, it means that some
-     <function>propagatedBuildInputs</function> should instead be
-     <function>depsTargetTargetPropagated</function>. Other types dependencies
-     should be unaffected.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>lib.addPassthru drv passthru</literal> is removed. Use
-     <literal>lib.extendDerivation true passthru drv</literal> instead.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>memcached</literal> service no longer accept dynamic socket
-     paths via <option>services.memcached.socket</option>. Unix sockets can be
-     still enabled by <option>services.memcached.enableUnixSocket</option> and
-     will be accessible at <literal>/run/memcached/memcached.sock</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <varname>hardware.amdHybridGraphics.disable</varname> option was
-     removed for lack of a maintainer. If you still need this module, you may
-     wish to include a copy of it from an older version of nixos in your
-     imports.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The merging of config options for
-     <varname>services.postfix.config</varname> was buggy. Previously, if other
-     options in the Postfix module like
-     <varname>services.postfix.useSrs</varname> were set and the user set
-     config options that were also set by such options, the resulting config
-     wouldn't include all options that were needed. They are now merged
-     correctly. If config options need to be overridden,
-     <literal>lib.mkForce</literal> or <literal>lib.mkOverride</literal> can be
-     used.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The following changes apply if the <literal>stateVersion</literal> is
-     changed to 18.03 or higher. For <literal>stateVersion = "17.09"</literal>
-     or lower the old behavior is preserved.
-    </para>
-    <itemizedlist>
-     <listitem>
-      <para>
-       <literal>matrix-synapse</literal> uses postgresql by default instead of
-       sqlite. Migration instructions can be found
-       <link xlink:href="https://github.com/matrix-org/synapse/blob/master/docs/postgres.rst#porting-from-sqlite">
-       here </link>.
-      </para>
-     </listitem>
-    </itemizedlist>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>jid</literal> package has been removed, due to maintenance
-     overhead of a go package having non-versioned dependencies.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     When using <option>services.xserver.libinput</option> (enabled by default
-     in GNOME), it now handles all input devices, not just touchpads. As a
-     result, you might need to re-evaluate any custom Xorg configuration. In
-     particular, <literal>Option "XkbRules" "base"</literal> may result in
-     broken keyboard layout.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>attic</literal> package was removed. A maintained fork called
-     <link xlink:href="https://www.borgbackup.org/">Borg</link> should be used
-     instead. Migration instructions can be found
-     <link xlink:href="http://borgbackup.readthedocs.io/en/stable/usage/upgrade.html#attic-and-borg-0-xx-to-borg-1-x">here</link>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The Piwik analytics software was renamed to Matomo:
-     <itemizedlist>
-      <listitem>
-       <para>
-        The package <literal>pkgs.piwik</literal> was renamed to
-        <literal>pkgs.matomo</literal>.
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        The service <literal>services.piwik</literal> was renamed to
-        <literal>services.matomo</literal>.
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        The data directory <filename>/var/lib/piwik</filename> was renamed to
-        <filename>/var/lib/matomo</filename>. All files will be moved
-        automatically on first startup, but you might need to adjust your
-        backup scripts.
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        The default <option>serverName</option> for the nginx configuration
-        changed from <literal>piwik.${config.networking.hostName}</literal> to
-        <literal>matomo.${config.networking.hostName}.${config.networking.domain}</literal>
-        if <option>config.networking.domain</option> is set,
-        <literal>matomo.${config.networking.hostName}</literal> if it is not
-        set. If you change your <option>serverName</option>, remember you'll
-        need to update the <literal>trustedHosts[]</literal> array in
-        <filename>/var/lib/matomo/config/config.ini.php</filename> as well.
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        The <literal>piwik</literal> user was renamed to
-        <literal>matomo</literal>. The service will adjust ownership
-        automatically for files in the data directory. If you use unix socket
-        authentication, remember to give the new <literal>matomo</literal> user
-        access to the database and to change the <literal>username</literal> to
-        <literal>matomo</literal> in the <literal>[database]</literal> section
-        of <filename>/var/lib/matomo/config/config.ini.php</filename>.
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        If you named your database `piwik`, you might want to rename it to
-        `matomo` to keep things clean, but this is neither enforced nor
-        required.
-       </para>
-      </listitem>
-     </itemizedlist>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>nodejs-4_x</literal> is end-of-life.
-     <literal>nodejs-4_x</literal>, <literal>nodejs-slim-4_x</literal> and
-     <literal>nodePackages_4_x</literal> are removed.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>pump.io</literal> NixOS module was removed. It is now
-     maintained as an
-     <link xlink:href="https://github.com/rvl/pump.io-nixos">external
-     module</link>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The Prosody XMPP server has received a major update. The following modules
-     were renamed:
-     <itemizedlist>
-      <listitem>
-       <para>
-        <option>services.prosody.modules.httpserver</option> is now
-        <option>services.prosody.modules.http_files</option>
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        <option>services.prosody.modules.console</option> is now
-        <option>services.prosody.modules.admin_telnet</option>
-       </para>
-      </listitem>
-     </itemizedlist>
-    </para>
-    <para>
-     Many new modules are now core modules, most notably
-     <option>services.prosody.modules.carbons</option> and
-     <option>services.prosody.modules.mam</option>.
-    </para>
-    <para>
-     The better-performing <literal>libevent</literal> backend is now enabled
-     by default.
-    </para>
-    <para>
-     <literal>withCommunityModules</literal> now passes through the modules to
-     <option>services.prosody.extraModules</option>. Use
-     <literal>withOnlyInstalledCommunityModules</literal> for modules that
-     should not be enabled directly, e.g <literal>lib_ldap</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     All prometheus exporter modules are now defined as submodules. The
-     exporters are configured using
-     <literal>services.prometheus.exporters</literal>.
-    </para>
-   </listitem>
-  </itemizedlist>
- </section>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-18.03-notable-changes">
-  <title>Other Notable Changes</title>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     ZNC option <option>services.znc.mutable</option> now defaults to
-     <literal>true</literal>. That means that old configuration is not
-     overwritten by default when update to the znc options are made.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The option <option>networking.wireless.networks.&lt;name&gt;.auth</option>
-     has been added for wireless networks with WPA-Enterprise authentication.
-     There is also a new <option>extraConfig</option> option to directly
-     configure <literal>wpa_supplicant</literal> and <option>hidden</option> to
-     connect to hidden networks.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     In the module <option>networking.interfaces.&lt;name&gt;</option> the
-     following options have been removed:
-     <itemizedlist>
-      <listitem>
-       <para>
-        <option>ipAddress</option>
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        <option>ipv6Address</option>
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        <option>prefixLength</option>
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        <option>ipv6PrefixLength</option>
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        <option>subnetMask</option>
-       </para>
-      </listitem>
-     </itemizedlist>
-     To assign static addresses to an interface the options
-     <option>ipv4.addresses</option> and <option>ipv6.addresses</option> should
-     be used instead. The options <option>ip4</option> and <option>ip6</option>
-     have been renamed to <option>ipv4.addresses</option>
-     <option>ipv6.addresses</option> respectively. The new options
-     <option>ipv4.routes</option> and <option>ipv6.routes</option> have been
-     added to set up static routing.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The option <option>services.logstash.listenAddress</option> is now
-     <literal>127.0.0.1</literal> by default. Previously the default behaviour
-     was to listen on all interfaces.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>services.btrfs.autoScrub</literal> has been added, to
-     periodically check btrfs filesystems for data corruption. If there's a
-     correct copy available, it will automatically repair corrupted blocks.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>displayManager.lightdm.greeters.gtk.clock-format.</literal> has
-     been added, the clock format string (as expected by strftime, e.g.
-     <literal>%H:%M</literal>) to use with the lightdm gtk greeter panel.
-    </para>
-    <para>
-     If set to null the default clock format is used.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>displayManager.lightdm.greeters.gtk.indicators</literal> has been
-     added, a list of allowed indicator modules to use with the lightdm gtk
-     greeter panel.
-    </para>
-    <para>
-     Built-in indicators include <literal>~a11y</literal>,
-     <literal>~language</literal>, <literal>~session</literal>,
-     <literal>~power</literal>, <literal>~clock</literal>,
-     <literal>~host</literal>, <literal>~spacer</literal>. Unity indicators can
-     be represented by short name (e.g. <literal>sound</literal>,
-     <literal>power</literal>), service file name, or absolute path.
-    </para>
-    <para>
-     If set to <literal>null</literal> the default indicators are used.
-    </para>
-    <para>
-     In order to have the previous default configuration add
-<programlisting>
-  services.xserver.displayManager.lightdm.greeters.gtk.indicators = [
-    "~host" "~spacer"
-    "~clock" "~spacer"
-    "~session"
-    "~language"
-    "~a11y"
-    "~power"
-  ];
-</programlisting>
-     to your <literal>configuration.nix</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The NixOS test driver supports user services declared by
-     <literal>systemd.user.services</literal>. The methods
-     <literal>waitForUnit</literal>, <literal>getUnitInfo</literal>,
-     <literal>startJob</literal> and <literal>stopJob</literal> provide an
-     optional <literal>$user</literal> argument for that purpose.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Enabling bash completion on NixOS,
-     <literal>programs.bash.enableCompletion</literal>, will now also enable
-     completion for the Nix command line tools by installing the
-     <link xlink:href="https://github.com/hedning/nix-bash-completions">nix-bash-completions</link>
-     package.
-    </para>
-   </listitem>
-  </itemizedlist>
- </section>
-</section>
diff --git a/nixos/doc/manual/release-notes/rl-1809.section.md b/nixos/doc/manual/release-notes/rl-1809.section.md
new file mode 100644
index 000000000000..3443db37c97e
--- /dev/null
+++ b/nixos/doc/manual/release-notes/rl-1809.section.md
@@ -0,0 +1,332 @@
+# Release 18.09 ("Jellyfish", 2018/10/05) {#sec-release-18.09}
+
+## Highlights {#sec-release-18.09-highlights}
+
+In addition to numerous new and upgraded packages, this release has the following notable updates:
+
+- End of support is planned for end of April 2019, handing over to 19.03.
+
+- Platform support: x86_64-linux and x86_64-darwin as always. Support for aarch64-linux is as with the previous releases, not equivalent to the x86-64-linux release, but with efforts to reach parity.
+
+- Nix has been updated to 2.1; see its [release notes](https://nixos.org/nix/manual/#ssec-relnotes-2.1).
+
+- Core versions: linux: 4.14 LTS (unchanged), glibc: 2.26 → 2.27, gcc: 7 (unchanged), systemd: 237 → 239.
+
+- Desktop version changes: gnome: 3.26 → 3.28, (KDE) plasma-desktop: 5.12 → 5.13.
+
+Notable changes and additions for 18.09 include:
+
+- Support for wrapping binaries using `firejail` has been added through `programs.firejail.wrappedBinaries`.
+
+  For example
+
+  ```nix
+  {
+    programs.firejail = {
+      enable = true;
+      wrappedBinaries = {
+        firefox = "${lib.getBin pkgs.firefox}/bin/firefox";
+        mpv = "${lib.getBin pkgs.mpv}/bin/mpv";
+      };
+    };
+  }
+  ```
+
+  This will place `firefox` and `mpv` binaries in the global path wrapped by firejail.
+
+- User channels are now in the default `NIX_PATH`, allowing users to use their personal `nix-channel` defined channels in `nix-build` and `nix-shell` commands, as well as in imports like `import <mychannel>`.
+
+  For example
+
+  ```ShellSession
+  $ nix-channel --add https://nixos.org/channels/nixpkgs-unstable nixpkgsunstable
+  $ nix-channel --update
+  $ nix-build '<nixpkgsunstable>' -A gitFull
+  $ nix run -f '<nixpkgsunstable>' gitFull
+  $ nix-instantiate -E '(import <nixpkgsunstable> {}).gitFull'
+  ```
+
+## New Services {#sec-release-18.09-new-services}
+
+A curated selection of new services that were added since the last release:
+
+- The `services.cassandra` module has been reworked and was rewritten from scratch. The service has succeeding tests for the versions 2.1, 2.2, 3.0 and 3.11 of [Apache Cassandra](https://cassandra.apache.org/).
+
+- There is a new `services.foundationdb` module for deploying [FoundationDB](https://www.foundationdb.org) clusters.
+
+- When enabled the `iproute2` will copy the files expected by ip route (e.g., `rt_tables`) in `/etc/iproute2`. This allows to write aliases for routing tables for instance.
+
+- `services.strongswan-swanctl` is a modern replacement for `services.strongswan`. You can use either one of them to setup IPsec VPNs but not both at the same time.
+
+  `services.strongswan-swanctl` uses the [swanctl](https://wiki.strongswan.org/projects/strongswan/wiki/swanctl) command which uses the modern [vici](https://github.com/strongswan/strongswan/blob/master/src/libcharon/plugins/vici/README.md) _Versatile IKE Configuration Interface_. The deprecated `ipsec` command used in `services.strongswan` is using the legacy [stroke configuration interface](https://github.com/strongswan/strongswan/blob/master/README_LEGACY.md).
+
+- The new `services.elasticsearch-curator` service periodically curates or manages, your Elasticsearch indices and snapshots.
+
+Every new services:
+
+- `./config/xdg/autostart.nix`
+
+- `./config/xdg/icons.nix`
+
+- `./config/xdg/menus.nix`
+
+- `./config/xdg/mime.nix`
+
+- `./hardware/brightnessctl.nix`
+
+- `./hardware/onlykey.nix`
+
+- `./hardware/video/uvcvideo/default.nix`
+
+- `./misc/documentation.nix`
+
+- `./programs/firejail.nix`
+
+- `./programs/iftop.nix`
+
+- `./programs/sedutil.nix`
+
+- `./programs/singularity.nix`
+
+- `./programs/xss-lock.nix`
+
+- `./programs/zsh/zsh-autosuggestions.nix`
+
+- `./services/admin/oxidized.nix`
+
+- `./services/backup/duplicati.nix`
+
+- `./services/backup/restic.nix`
+
+- `./services/backup/restic-rest-server.nix`
+
+- `./services/cluster/hadoop/default.nix`
+
+- `./services/databases/aerospike.nix`
+
+- `./services/databases/monetdb.nix`
+
+- `./services/desktops/bamf.nix`
+
+- `./services/desktops/flatpak.nix`
+
+- `./services/desktops/zeitgeist.nix`
+
+- `./services/development/bloop.nix`
+
+- `./services/development/jupyter/default.nix`
+
+- `./services/hardware/lcd.nix`
+
+- `./services/hardware/undervolt.nix`
+
+- `./services/misc/clipmenu.nix`
+
+- `./services/misc/gitweb.nix`
+
+- `./services/misc/serviio.nix`
+
+- `./services/misc/safeeyes.nix`
+
+- `./services/misc/sysprof.nix`
+
+- `./services/misc/weechat.nix`
+
+- `./services/monitoring/datadog-agent.nix`
+
+- `./services/monitoring/incron.nix`
+
+- `./services/networking/dnsdist.nix`
+
+- `./services/networking/freeradius.nix`
+
+- `./services/networking/hans.nix`
+
+- `./services/networking/morty.nix`
+
+- `./services/networking/ndppd.nix`
+
+- `./services/networking/ocserv.nix`
+
+- `./services/networking/owamp.nix`
+
+- `./services/networking/quagga.nix`
+
+- `./services/networking/shadowsocks.nix`
+
+- `./services/networking/stubby.nix`
+
+- `./services/networking/zeronet.nix`
+
+- `./services/security/certmgr.nix`
+
+- `./services/security/cfssl.nix`
+
+- `./services/security/oauth2_proxy_nginx.nix`
+
+- `./services/web-apps/virtlyst.nix`
+
+- `./services/web-apps/youtrack.nix`
+
+- `./services/web-servers/hitch/default.nix`
+
+- `./services/web-servers/hydron.nix`
+
+- `./services/web-servers/meguca.nix`
+
+- `./services/web-servers/nginx/gitweb.nix`
+
+- `./virtualisation/kvmgt.nix`
+
+- `./virtualisation/qemu-guest-agent.nix`
+
+## Backward Incompatibilities {#sec-release-18.09-incompatibilities}
+
+When upgrading from a previous release, please be aware of the following incompatible changes:
+
+- Some licenses that were incorrectly not marked as unfree now are. This is the case for:
+
+  - cc-by-nc-sa-20: Creative Commons Attribution Non Commercial Share Alike 2.0
+
+  - cc-by-nc-sa-25: Creative Commons Attribution Non Commercial Share Alike 2.5
+
+  - cc-by-nc-sa-30: Creative Commons Attribution Non Commercial Share Alike 3.0
+
+  - cc-by-nc-sa-40: Creative Commons Attribution Non Commercial Share Alike 4.0
+
+  - cc-by-nd-30: Creative Commons Attribution-No Derivative Works v3.00
+
+  - msrla: Microsoft Research License Agreement
+
+- The deprecated `services.cassandra` module has seen a complete rewrite. (See above.)
+
+- `lib.strict` is removed. Use `builtins.seq` instead.
+
+- The `clementine` package points now to the free derivation. `clementineFree` is removed now and `clementineUnfree` points to the package which is bundled with the unfree `libspotify` package.
+
+- The `netcat` package is now taken directly from OpenBSD\'s `libressl`, instead of relying on Debian\'s fork. The new version should be very close to the old version, but there are some minor differences. Importantly, flags like -b, -q, -C, and -Z are no longer accepted by the nc command.
+
+- The `services.docker-registry.extraConfig` object doesn\'t contain environment variables anymore. Instead it needs to provide an object structure that can be mapped onto the YAML configuration defined in [the `docker/distribution` docs](https://github.com/docker/distribution/blob/v2.6.2/docs/configuration.md).
+
+- `gnucash` has changed from version 2.4 to 3.x. If you\'ve been using `gnucash` (version 2.4) instead of `gnucash26` (version 2.6) you must open your Gnucash data file(s) with `gnucash26` and then save them to upgrade the file format. Then you may use your data file(s) with Gnucash 3.x. See the upgrade [documentation](https://wiki.gnucash.org/wiki/FAQ#Using_Different_Versions.2C_Up_And_Downgrade). Gnucash 2.4 is still available under the attribute `gnucash24`.
+
+- `services.munge` now runs as user (and group) `munge` instead of root. Make sure the key file is accessible to the daemon.
+
+- `dockerTools.buildImage` now uses `null` as default value for `tag`, which indicates that the nix output hash will be used as tag.
+
+- The ELK stack: `elasticsearch`, `logstash` and `kibana` has been upgraded from 2.\* to 6.3.\*. The 2.\* versions have been [unsupported since last year](https://www.elastic.co/support/eol) so they have been removed. You can still use the 5.\* versions under the names `elasticsearch5`, `logstash5` and `kibana5`.
+
+  The elastic beats: `filebeat`, `heartbeat`, `metricbeat` and `packetbeat` have had the same treatment: they now target 6.3.\* as well. The 5.\* versions are available under the names: `filebeat5`, `heartbeat5`, `metricbeat5` and `packetbeat5`
+
+  The ELK-6.3 stack now comes with [X-Pack by default](https://www.elastic.co/products/x-pack/open). Since X-Pack is licensed under the [Elastic License](https://github.com/elastic/elasticsearch/blob/master/licenses/ELASTIC-LICENSE.txt) the ELK packages now have an unfree license. To use them you need to specify `allowUnfree = true;` in your nixpkgs configuration.
+
+  Fortunately there is also a free variant of the ELK stack without X-Pack. The packages are available under the names: `elasticsearch-oss`, `logstash-oss` and `kibana-oss`.
+
+- Options `boot.initrd.luks.devices.name.yubikey.ramfsMountPoint` `boot.initrd.luks.devices.name.yubikey.storage.mountPoint` were removed. `luksroot.nix` module never supported more than one YubiKey at a time anyway, hence those options never had any effect. You should be able to remove them from your config without any issues.
+
+- `stdenv.system` and `system` in nixpkgs now refer to the host platform instead of the build platform. For native builds this is not change, let alone a breaking one. For cross builds, it is a breaking change, and `stdenv.buildPlatform.system` can be used instead for the old behavior. They should be using that anyways for clarity.
+
+- Groups `kvm` and `render` are introduced now, as systemd requires them.
+
+## Other Notable Changes {#sec-release-18.09-notable-changes}
+
+- `dockerTools.pullImage` relies on image digest instead of image tag to download the image. The `sha256` of a pulled image has to be updated.
+
+- `lib.attrNamesToStr` has been deprecated. Use more specific concatenation (`lib.concat(Map)StringsSep`) instead.
+
+- `lib.addErrorContextToAttrs` has been deprecated. Use `builtins.addErrorContext` directly.
+
+- `lib.showVal` has been deprecated. Use `lib.traceSeqN` instead.
+
+- `lib.traceXMLVal` has been deprecated. Use `lib.traceValFn builtins.toXml` instead.
+
+- `lib.traceXMLValMarked` has been deprecated. Use `lib.traceValFn (x: str + builtins.toXML x)` instead.
+
+- The `pkgs` argument to NixOS modules can now be set directly using `nixpkgs.pkgs`. Previously, only the `system`, `config` and `overlays` arguments could be used to influence `pkgs`.
+
+- A NixOS system can now be constructed more easily based on a preexisting invocation of Nixpkgs. For example:
+
+  ```nix
+  {
+    inherit (pkgs.nixos {
+      boot.loader.grub.enable = false;
+      fileSystems."/".device = "/dev/xvda1";
+    }) toplevel kernel initialRamdisk manual;
+  }
+  ```
+
+  This benefits evaluation performance, lets you write Nixpkgs packages that depend on NixOS images and is consistent with a deployment architecture that would be centered around Nixpkgs overlays.
+
+- `lib.traceValIfNot` has been deprecated. Use `if/then/else` and `lib.traceValSeq` instead.
+
+- `lib.traceCallXml` has been deprecated. Please complain if you use the function regularly.
+
+- The attribute `lib.nixpkgsVersion` has been deprecated in favor of `lib.version`. Please refer to the discussion in [NixOS/nixpkgs\#39416](https://github.com/NixOS/nixpkgs/pull/39416#discussion_r183845745) for further reference.
+
+- `lib.recursiveUpdateUntil` was not acting according to its specification. It has been fixed to act according to the docstring, and a test has been added.
+
+- The module for `security.dhparams` has two new options now:
+
+  `security.dhparams.stateless`
+
+  : Puts the generated Diffie-Hellman parameters into the Nix store instead of managing them in a stateful manner in `/var/lib/dhparams`.
+
+  `security.dhparams.defaultBitSize`
+
+  : The default bit size to use for the generated Diffie-Hellman parameters.
+
+  ::: {.note}
+  The path to the actual generated parameter files should now be queried using `config.security.dhparams.params.name.path` because it might be either in the Nix store or in a directory configured by `security.dhparams.path`.
+  :::
+
+  ::: {.note}
+  **For developers:**
+
+  Module implementers should not set a specific bit size in order to let users configure it by themselves if they want to have a different bit size than the default (2048).
+
+  An example usage of this would be:
+
+  ```nix
+  { config, ... }:
+
+  {
+    security.dhparams.params.myservice = {};
+    environment.etc."myservice.conf".text = ''
+      dhparams = ${config.security.dhparams.params.myservice.path}
+    '';
+  }
+  ```
+
+  :::
+
+- `networking.networkmanager.useDnsmasq` has been deprecated. Use `networking.networkmanager.dns` instead.
+
+- The Kubernetes package has been bumped to major version 1.11. Please consult the [release notes](https://github.com/kubernetes/kubernetes/blob/release-1.11/CHANGELOG-1.11.md) for details on new features and api changes.
+
+- The option `services.kubernetes.apiserver.admissionControl` was renamed to `services.kubernetes.apiserver.enableAdmissionPlugins`.
+
+- Recommended way to access the Kubernetes Dashboard is via HTTPS (TLS) Therefore; public service port for the dashboard has changed to 443 (container port 8443) and scheme to https.
+
+- The option `services.kubernetes.apiserver.address` was renamed to `services.kubernetes.apiserver.bindAddress`. Note that the default value has changed from 127.0.0.1 to 0.0.0.0.
+
+- The option `services.kubernetes.apiserver.publicAddress` was not used and thus has been removed.
+
+- The option `services.kubernetes.addons.dashboard.enableRBAC` was renamed to `services.kubernetes.addons.dashboard.rbac.enable`.
+
+- The Kubernetes Dashboard now has only minimal RBAC permissions by default. If dashboard cluster-admin rights are desired, set `services.kubernetes.addons.dashboard.rbac.clusterAdmin` to true. On existing clusters, in order for the revocation of privileges to take effect, the current ClusterRoleBinding for kubernetes-dashboard must be manually removed: `kubectl delete clusterrolebinding kubernetes-dashboard`
+
+- The `programs.screen` module provides allows to configure `/etc/screenrc`, however the module behaved fairly counterintuitive as the config exists, but the package wasn\'t available. Since 18.09 `pkgs.screen` will be added to `environment.systemPackages`.
+
+- The module `services.networking.hostapd` now uses WPA2 by default.
+
+- `s6Dns`, `s6Networking`, `s6LinuxUtils` and `s6PortableUtils` renamed to `s6-dns`, `s6-networking`, `s6-linux-utils` and `s6-portable-utils` respectively.
+
+- The module option `nix.useSandbox` is now defaulted to `true`.
+
+- The config activation script of `nixos-rebuild` now [reloads](https://www.freedesktop.org/software/systemd/man/systemctl.html#Manager%20Lifecycle%20Commands) all user units for each authenticated user.
+
+- The default display manager is now LightDM. To use SLiM set `services.xserver.displayManager.slim.enable` to `true`.
+
+- NixOS option descriptions are now automatically broken up into individual paragraphs if the text contains two consecutive newlines, so it\'s no longer necessary to use `</para><para>` to start a new paragraph.
+
+- Top-level `buildPlatform`, `hostPlatform`, and `targetPlatform` in Nixpkgs are deprecated. Please use their equivalents in `stdenv` instead: `stdenv.buildPlatform`, `stdenv.hostPlatform`, and `stdenv.targetPlatform`.
diff --git a/nixos/doc/manual/release-notes/rl-1809.xml b/nixos/doc/manual/release-notes/rl-1809.xml
deleted file mode 100644
index 3f10b26223dd..000000000000
--- a/nixos/doc/manual/release-notes/rl-1809.xml
+++ /dev/null
@@ -1,933 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-18.09">
- <title>Release 18.09 (“Jellyfish”, 2018/10/05)</title>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-18.09-highlights">
-  <title>Highlights</title>
-
-  <para>
-   In addition to numerous new and upgraded packages, this release has the
-   following notable updates:
-  </para>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     End of support is planned for end of April 2019, handing over to 19.03.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Platform support: x86_64-linux and x86_64-darwin as always. Support for
-     aarch64-linux is as with the previous releases, not equivalent to the
-     x86-64-linux release, but with efforts to reach parity.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Nix has been updated to 2.1; see its
-     <link xlink:href="https://nixos.org/nix/manual/#ssec-relnotes-2.1">release
-     notes</link>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Core versions: linux: 4.14 LTS (unchanged), glibc: 2.26 → 2.27, gcc: 7
-     (unchanged), systemd: 237 → 239.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Desktop version changes: gnome: 3.26 → 3.28, (KDE) plasma-desktop: 5.12
-     → 5.13.
-    </para>
-   </listitem>
-  </itemizedlist>
-
-  <para>
-   Notable changes and additions for 18.09 include:
-  </para>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     Support for wrapping binaries using <literal>firejail</literal> has been
-     added through <varname>programs.firejail.wrappedBinaries</varname>.
-    </para>
-    <para>
-     For example
-    </para>
-<programlisting>
-programs.firejail = {
-  enable = true;
-  wrappedBinaries = {
-    firefox = "${lib.getBin pkgs.firefox}/bin/firefox";
-    mpv = "${lib.getBin pkgs.mpv}/bin/mpv";
-  };
-};
-</programlisting>
-    <para>
-     This will place <literal>firefox</literal> and <literal>mpv</literal>
-     binaries in the global path wrapped by firejail.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     User channels are now in the default <literal>NIX_PATH</literal>, allowing
-     users to use their personal <command>nix-channel</command> defined
-     channels in <command>nix-build</command> and <command>nix-shell</command>
-     commands, as well as in imports like <code>import
-     &lt;mychannel&gt;</code>.
-    </para>
-    <para>
-     For example
-    </para>
-<programlisting>
-$ nix-channel --add https://nixos.org/channels/nixpkgs-unstable nixpkgsunstable
-$ nix-channel --update
-$ nix-build '&lt;nixpkgsunstable&gt;' -A gitFull
-$ nix run -f '&lt;nixpkgsunstable&gt;' gitFull
-$ nix-instantiate -E '(import &lt;nixpkgsunstable&gt; {}).gitFull'
-</programlisting>
-   </listitem>
-  </itemizedlist>
- </section>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-18.09-new-services">
-  <title>New Services</title>
-
-  <para>
-   A curated selection of new services that were added since the last release:
-  </para>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     The <varname>services.cassandra</varname> module has been reworked and was
-     rewritten from scratch. The service has succeeding tests for the versions
-     2.1, 2.2, 3.0 and 3.11 of
-     <link
-     xlink:href="https://cassandra.apache.org/">Apache
-     Cassandra</link>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     There is a new <varname>services.foundationdb</varname> module for
-     deploying
-     <link xlink:href="https://www.foundationdb.org">FoundationDB</link>
-     clusters.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     When enabled the <literal>iproute2</literal> will copy the files expected
-     by ip route (e.g., <filename>rt_tables</filename>) in
-     <filename>/etc/iproute2</filename>. This allows to write aliases for
-     routing tables for instance.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <varname>services.strongswan-swanctl</varname> is a modern replacement for
-     <varname>services.strongswan</varname>. You can use either one of them to
-     setup IPsec VPNs but not both at the same time.
-    </para>
-    <para>
-     <varname>services.strongswan-swanctl</varname> uses the
-     <link xlink:href="https://wiki.strongswan.org/projects/strongswan/wiki/swanctl">swanctl</link>
-     command which uses the modern
-     <link xlink:href="https://github.com/strongswan/strongswan/blob/master/src/libcharon/plugins/vici/README.md">vici</link>
-     <emphasis>Versatile IKE Configuration Interface</emphasis>. The deprecated
-     <literal>ipsec</literal> command used in
-     <varname>services.strongswan</varname> is using the legacy
-     <link xlink:href="https://github.com/strongswan/strongswan/blob/master/README_LEGACY.md">stroke
-     configuration interface</link>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The new <varname>services.elasticsearch-curator</varname> service
-     periodically curates or manages, your Elasticsearch indices and snapshots.
-    </para>
-   </listitem>
-  </itemizedlist>
-
-  <para>
-   Every new services:
-  </para>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     <literal>./config/xdg/autostart.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./config/xdg/icons.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./config/xdg/menus.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./config/xdg/mime.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./hardware/brightnessctl.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./hardware/onlykey.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./hardware/video/uvcvideo/default.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./misc/documentation.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./programs/firejail.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./programs/iftop.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./programs/sedutil.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./programs/singularity.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./programs/xss-lock.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./programs/zsh/zsh-autosuggestions.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/admin/oxidized.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/backup/duplicati.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/backup/restic.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/backup/restic-rest-server.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/cluster/hadoop/default.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/databases/aerospike.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/databases/monetdb.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/desktops/bamf.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/desktops/flatpak.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/desktops/zeitgeist.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/development/bloop.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/development/jupyter/default.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/hardware/lcd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/hardware/undervolt.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/misc/clipmenu.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/misc/gitweb.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/misc/serviio.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/misc/safeeyes.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/misc/sysprof.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/misc/weechat.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/monitoring/datadog-agent.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/monitoring/incron.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/networking/dnsdist.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/networking/freeradius.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/networking/hans.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/networking/morty.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/networking/ndppd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/networking/ocserv.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/networking/owamp.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/networking/quagga.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/networking/shadowsocks.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/networking/stubby.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/networking/zeronet.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/security/certmgr.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/security/cfssl.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/security/oauth2_proxy_nginx.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/web-apps/virtlyst.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/web-apps/youtrack.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/web-servers/hitch/default.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/web-servers/hydron.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/web-servers/meguca.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/web-servers/nginx/gitweb.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./virtualisation/kvmgt.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./virtualisation/qemu-guest-agent.nix</literal>
-    </para>
-   </listitem>
-  </itemizedlist>
- </section>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-18.09-incompatibilities">
-  <title>Backward Incompatibilities</title>
-
-  <para>
-   When upgrading from a previous release, please be aware of the following
-   incompatible changes:
-  </para>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     Some licenses that were incorrectly not marked as unfree now are. This is
-     the case for:
-     <itemizedlist>
-      <listitem>
-       <para>
-        cc-by-nc-sa-20: Creative Commons Attribution Non Commercial Share Alike
-        2.0
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        cc-by-nc-sa-25: Creative Commons Attribution Non Commercial Share Alike
-        2.5
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        cc-by-nc-sa-30: Creative Commons Attribution Non Commercial Share Alike
-        3.0
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        cc-by-nc-sa-40: Creative Commons Attribution Non Commercial Share Alike
-        4.0
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        cc-by-nd-30: Creative Commons Attribution-No Derivative Works v3.00
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        msrla: Microsoft Research License Agreement
-       </para>
-      </listitem>
-     </itemizedlist>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The deprecated <varname>services.cassandra</varname> module has seen a
-     complete rewrite. (See above.)
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>lib.strict</literal> is removed. Use
-     <literal>builtins.seq</literal> instead.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>clementine</literal> package points now to the free
-     derivation. <literal>clementineFree</literal> is removed now and
-     <literal>clementineUnfree</literal> points to the package which is bundled
-     with the unfree <literal>libspotify</literal> package.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>netcat</literal> package is now taken directly from OpenBSD's
-     <literal>libressl</literal>, instead of relying on Debian's fork. The new
-     version should be very close to the old version, but there are some minor
-     differences. Importantly, flags like -b, -q, -C, and -Z are no longer
-     accepted by the nc command.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <varname>services.docker-registry.extraConfig</varname> object doesn't
-     contain environment variables anymore. Instead it needs to provide an
-     object structure that can be mapped onto the YAML configuration defined in
-     <link xlink:href="https://github.com/docker/distribution/blob/v2.6.2/docs/configuration.md">the
-     <varname>docker/distribution</varname> docs</link>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>gnucash</literal> has changed from version 2.4 to 3.x. If you've
-     been using <literal>gnucash</literal> (version 2.4) instead of
-     <literal>gnucash26</literal> (version 2.6) you must open your Gnucash data
-     file(s) with <literal>gnucash26</literal> and then save them to upgrade
-     the file format. Then you may use your data file(s) with Gnucash 3.x. See
-     the upgrade
-     <link xlink:href="https://wiki.gnucash.org/wiki/FAQ#Using_Different_Versions.2C_Up_And_Downgrade">documentation</link>.
-     Gnucash 2.4 is still available under the attribute
-     <literal>gnucash24</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <varname>services.munge</varname> now runs as user (and group)
-     <literal>munge</literal> instead of root. Make sure the key file is
-     accessible to the daemon.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <varname>dockerTools.buildImage</varname> now uses <literal>null</literal>
-     as default value for <varname>tag</varname>, which indicates that the nix
-     output hash will be used as tag.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The ELK stack: <varname>elasticsearch</varname>,
-     <varname>logstash</varname> and <varname>kibana</varname> has been
-     upgraded from 2.* to 6.3.*. The 2.* versions have been
-     <link xlink:href="https://www.elastic.co/support/eol">unsupported since
-     last year</link> so they have been removed. You can still use the 5.*
-     versions under the names <varname>elasticsearch5</varname>,
-     <varname>logstash5</varname> and <varname>kibana5</varname>.
-    </para>
-    <para>
-     The elastic beats: <varname>filebeat</varname>,
-     <varname>heartbeat</varname>, <varname>metricbeat</varname> and
-     <varname>packetbeat</varname> have had the same treatment: they now target
-     6.3.* as well. The 5.* versions are available under the names:
-     <varname>filebeat5</varname>, <varname>heartbeat5</varname>,
-     <varname>metricbeat5</varname> and <varname>packetbeat5</varname>
-    </para>
-    <para>
-     The ELK-6.3 stack now comes with
-     <link xlink:href="https://www.elastic.co/products/x-pack/open">X-Pack by
-     default</link>. Since X-Pack is licensed under the
-     <link xlink:href="https://github.com/elastic/elasticsearch/blob/master/licenses/ELASTIC-LICENSE.txt">Elastic
-     License</link> the ELK packages now have an unfree license. To use them
-     you need to specify <literal>allowUnfree = true;</literal> in your nixpkgs
-     configuration.
-    </para>
-    <para>
-     Fortunately there is also a free variant of the ELK stack without X-Pack.
-     The packages are available under the names:
-     <varname>elasticsearch-oss</varname>, <varname>logstash-oss</varname> and
-     <varname>kibana-oss</varname>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Options
-     <literal>boot.initrd.luks.devices.<replaceable>name</replaceable>.yubikey.ramfsMountPoint</literal>
-     <literal>boot.initrd.luks.devices.<replaceable>name</replaceable>.yubikey.storage.mountPoint</literal>
-     were removed. <literal>luksroot.nix</literal> module never supported more
-     than one YubiKey at a time anyway, hence those options never had any
-     effect. You should be able to remove them from your config without any
-     issues.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>stdenv.system</literal> and <literal>system</literal> in nixpkgs
-     now refer to the host platform instead of the build platform. For native
-     builds this is not change, let alone a breaking one. For cross builds, it
-     is a breaking change, and <literal>stdenv.buildPlatform.system</literal>
-     can be used instead for the old behavior. They should be using that
-     anyways for clarity.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Groups <literal>kvm</literal> and <literal>render</literal> are introduced
-     now, as systemd requires them.
-    </para>
-   </listitem>
-  </itemizedlist>
- </section>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-18.09-notable-changes">
-  <title>Other Notable Changes</title>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     <literal>dockerTools.pullImage</literal> relies on image digest instead of
-     image tag to download the image. The <literal>sha256</literal> of a pulled
-     image has to be updated.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>lib.attrNamesToStr</literal> has been deprecated. Use more
-     specific concatenation (<literal>lib.concat(Map)StringsSep</literal>)
-     instead.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>lib.addErrorContextToAttrs</literal> has been deprecated. Use
-     <literal>builtins.addErrorContext</literal> directly.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>lib.showVal</literal> has been deprecated. Use
-     <literal>lib.traceSeqN</literal> instead.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>lib.traceXMLVal</literal> has been deprecated. Use
-     <literal>lib.traceValFn builtins.toXml</literal> instead.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>lib.traceXMLValMarked</literal> has been deprecated. Use
-     <literal>lib.traceValFn (x: str + builtins.toXML x)</literal> instead.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>pkgs</literal> argument to NixOS modules can now be set
-     directly using <literal>nixpkgs.pkgs</literal>. Previously, only the
-     <literal>system</literal>, <literal>config</literal> and
-     <literal>overlays</literal> arguments could be used to influence
-     <literal>pkgs</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     A NixOS system can now be constructed more easily based on a preexisting
-     invocation of Nixpkgs. For example:
-<programlisting>
-inherit (pkgs.nixos {
-  boot.loader.grub.enable = false;
-  fileSystems."/".device = "/dev/xvda1";
-}) toplevel kernel initialRamdisk manual;
-      </programlisting>
-     This benefits evaluation performance, lets you write Nixpkgs packages that
-     depend on NixOS images and is consistent with a deployment architecture
-     that would be centered around Nixpkgs overlays.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>lib.traceValIfNot</literal> has been deprecated. Use
-     <literal>if/then/else</literal> and <literal>lib.traceValSeq</literal>
-     instead.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>lib.traceCallXml</literal> has been deprecated. Please complain
-     if you use the function regularly.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The attribute <literal>lib.nixpkgsVersion</literal> has been deprecated in
-     favor of <literal>lib.version</literal>. Please refer to the discussion in
-     <link xlink:href="https://github.com/NixOS/nixpkgs/pull/39416#discussion_r183845745">NixOS/nixpkgs#39416</link>
-     for further reference.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>lib.recursiveUpdateUntil</literal> was not acting according to
-     its specification. It has been fixed to act according to the docstring,
-     and a test has been added.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The module for <option>security.dhparams</option> has two new options now:
-    </para>
-    <variablelist>
-     <varlistentry>
-      <term>
-       <option>security.dhparams.stateless</option>
-      </term>
-      <listitem>
-       <para>
-        Puts the generated Diffie-Hellman parameters into the Nix store instead
-        of managing them in a stateful manner in
-        <filename class="directory">/var/lib/dhparams</filename>.
-       </para>
-      </listitem>
-     </varlistentry>
-     <varlistentry>
-      <term>
-       <option>security.dhparams.defaultBitSize</option>
-      </term>
-      <listitem>
-       <para>
-        The default bit size to use for the generated Diffie-Hellman
-        parameters.
-       </para>
-      </listitem>
-     </varlistentry>
-    </variablelist>
-    <note>
-     <para>
-      The path to the actual generated parameter files should now be queried
-      using
-      <literal>config.security.dhparams.params.<replaceable>name</replaceable>.path</literal>
-      because it might be either in the Nix store or in a directory configured
-      by <option>security.dhparams.path</option>.
-     </para>
-    </note>
-    <note>
-     <title>For developers:</title>
-     <para>
-      Module implementers should not set a specific bit size in order to let
-      users configure it by themselves if they want to have a different bit
-      size than the default (2048).
-     </para>
-     <para>
-      An example usage of this would be:
-<programlisting>
-{ config, ... }:
-
-{
-  security.dhparams.params.myservice = {};
-  environment.etc."myservice.conf".text = ''
-    dhparams = ${config.security.dhparams.params.myservice.path}
-  '';
-}
-</programlisting>
-     </para>
-    </note>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>networking.networkmanager.useDnsmasq</literal> has been
-     deprecated. Use <literal>networking.networkmanager.dns</literal> instead.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The Kubernetes package has been bumped to major version 1.11. Please
-     consult the
-     <link xlink:href="https://github.com/kubernetes/kubernetes/blob/release-1.11/CHANGELOG-1.11.md">release
-     notes</link> for details on new features and api changes.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The option
-     <varname>services.kubernetes.apiserver.admissionControl</varname> was
-     renamed to
-     <varname>services.kubernetes.apiserver.enableAdmissionPlugins</varname>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Recommended way to access the Kubernetes Dashboard is via HTTPS (TLS)
-     Therefore; public service port for the dashboard has changed to 443
-     (container port 8443) and scheme to https.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The option <varname>services.kubernetes.apiserver.address</varname> was
-     renamed to <varname>services.kubernetes.apiserver.bindAddress</varname>.
-     Note that the default value has changed from 127.0.0.1 to 0.0.0.0.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The option <varname>services.kubernetes.apiserver.publicAddress</varname>
-     was not used and thus has been removed.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The option
-     <varname>services.kubernetes.addons.dashboard.enableRBAC</varname> was
-     renamed to
-     <varname>services.kubernetes.addons.dashboard.rbac.enable</varname>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The Kubernetes Dashboard now has only minimal RBAC permissions by default.
-     If dashboard cluster-admin rights are desired, set
-     <varname>services.kubernetes.addons.dashboard.rbac.clusterAdmin</varname>
-     to true. On existing clusters, in order for the revocation of privileges
-     to take effect, the current ClusterRoleBinding for kubernetes-dashboard
-     must be manually removed: <literal>kubectl delete clusterrolebinding
-     kubernetes-dashboard</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <varname>programs.screen</varname> module provides allows to configure
-     <literal>/etc/screenrc</literal>, however the module behaved fairly
-     counterintuitive as the config exists, but the package wasn't available.
-     Since 18.09 <literal>pkgs.screen</literal> will be added to
-     <literal>environment.systemPackages</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The module <option>services.networking.hostapd</option> now uses WPA2 by
-     default.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <varname>s6Dns</varname>, <varname>s6Networking</varname>,
-     <varname>s6LinuxUtils</varname> and <varname>s6PortableUtils</varname>
-     renamed to <varname>s6-dns</varname>, <varname>s6-networking</varname>,
-     <varname>s6-linux-utils</varname> and <varname>s6-portable-utils</varname>
-     respectively.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The module option <option>nix.useSandbox</option> is now defaulted to
-     <literal>true</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The config activation script of <literal>nixos-rebuild</literal> now
-     <link xlink:href="https://www.freedesktop.org/software/systemd/man/systemctl.html#Manager%20Lifecycle%20Commands">reloads</link>
-     all user units for each authenticated user.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The default display manager is now LightDM. To use SLiM set
-     <literal>services.xserver.displayManager.slim.enable</literal> to
-     <literal>true</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     NixOS option descriptions are now automatically broken up into individual
-     paragraphs if the text contains two consecutive newlines, so it's no
-     longer necessary to use <code>&lt;/para&gt;&lt;para&gt;</code> to start a
-     new paragraph.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Top-level <literal>buildPlatform</literal>,
-     <literal>hostPlatform</literal>, and <literal>targetPlatform</literal> in
-     Nixpkgs are deprecated. Please use their equivalents in
-     <literal>stdenv</literal> instead:
-     <literal>stdenv.buildPlatform</literal>,
-     <literal>stdenv.hostPlatform</literal>, and
-     <literal>stdenv.targetPlatform</literal>.
-    </para>
-   </listitem>
-  </itemizedlist>
- </section>
-</section>
diff --git a/nixos/doc/manual/release-notes/rl-1903.section.md b/nixos/doc/manual/release-notes/rl-1903.section.md
new file mode 100644
index 000000000000..7637a70c1bf8
--- /dev/null
+++ b/nixos/doc/manual/release-notes/rl-1903.section.md
@@ -0,0 +1,214 @@
+# Release 19.03 ("Koi", 2019/04/11) {#sec-release-19.03}
+
+## Highlights {#sec-release-19.03-highlights}
+
+In addition to numerous new and upgraded packages, this release has the following highlights:
+
+- End of support is planned for end of October 2019, handing over to 19.09.
+
+- The default Python 3 interpreter is now CPython 3.7 instead of CPython 3.6.
+
+- Added the Pantheon desktop environment. It can be enabled through `services.xserver.desktopManager.pantheon.enable`.
+
+  ::: {.note}
+  By default, `services.xserver.desktopManager.pantheon` enables LightDM as a display manager, as pantheon\'s screen locking implementation relies on it.
+  Because of that it is recommended to leave LightDM enabled. If you\'d like to disable it anyway, set `services.xserver.displayManager.lightdm.enable` to `false` and enable your preferred display manager.
+  :::
+
+  Also note that Pantheon\'s LightDM greeter is not enabled by default, because it has numerous issues in NixOS and isn\'t optimal for use here yet.
+
+- A major refactoring of the Kubernetes module has been completed. Refactorings primarily focus on decoupling components and enhancing security. Two-way TLS and RBAC has been enabled by default for all components, which slightly changes the way the module is configured. See: [](#sec-kubernetes) for details.
+
+- There is now a set of `confinement` options for `systemd.services`, which allows to restrict services into a chroot 2 ed environment that only contains the store paths from the runtime closure of the service.
+
+## New Services {#sec-release-19.03-new-services}
+
+The following new services were added since the last release:
+
+- `./programs/nm-applet.nix`
+
+- There is a new `security.googleOsLogin` module for using [OS Login](https://cloud.google.com/compute/docs/instances/managing-instance-access) to manage SSH access to Google Compute Engine instances, which supersedes the imperative and broken `google-accounts-daemon` used in `nixos/modules/virtualisation/google-compute-config.nix`.
+
+- `./services/misc/beanstalkd.nix`
+
+- There is a new `services.cockroachdb` module for running CockroachDB databases. NixOS now ships with CockroachDB 2.1.x as well, available on `x86_64-linux` and `aarch64-linux`.
+
+- `./security/duosec.nix`
+
+- The [PAM module for Duo Security](https://duo.com/docs/duounix) has been enabled for use. One can configure it using the `security.duosec` options along with the corresponding PAM option in `security.pam.services.<name?>.duoSecurity.enable`.
+
+## Backward Incompatibilities {#sec-release-19.03-incompatibilities}
+
+When upgrading from a previous release, please be aware of the following incompatible changes:
+
+- The minimum version of Nix required to evaluate Nixpkgs is now 2.0.
+
+  - For users of NixOS 18.03 and 19.03, NixOS defaults to Nix 2.0, but supports using Nix 1.11 by setting `nix.package = pkgs.nix1;`. If this option is set to a Nix 1.11 package, you will need to either unset the option or upgrade it to Nix 2.0.
+
+  - For users of NixOS 17.09, you will first need to upgrade Nix by setting `nix.package = pkgs.nixStable2;` and run `nixos-rebuild switch` as the `root` user.
+
+  - For users of a daemon-less Nix installation on Linux or macOS, you can upgrade Nix by running `curl -L https://nixos.org/nix/install | sh`, or prior to doing a channel update, running `nix-env -iA nix`. If you have already run a channel update and Nix is no longer able to evaluate Nixpkgs, the error message printed should provide adequate directions for upgrading Nix.
+
+  - For users of the Nix daemon on macOS, you can upgrade Nix by running `sudo -i sh -c 'nix-channel --update && nix-env -iA nixpkgs.nix'; sudo launchctl stop org.nixos.nix-daemon; sudo launchctl start org.nixos.nix-daemon`.
+
+- The `buildPythonPackage` function now sets `strictDeps = true` to help distinguish between native and non-native dependencies in order to improve cross-compilation compatibility. Note however that this may break user expressions.
+
+- The `buildPythonPackage` function now sets `LANG = C.UTF-8` to enable Unicode support. The `glibcLocales` package is no longer needed as a build input.
+
+- The Syncthing state and configuration data has been moved from `services.syncthing.dataDir` to the newly defined `services.syncthing.configDir`, which default to `/var/lib/syncthing/.config/syncthing`. This change makes possible to share synced directories using ACLs without Syncthing resetting the permission on every start.
+
+- The `ntp` module now has sane default restrictions. If you\'re relying on the previous defaults, which permitted all queries and commands from all firewall-permitted sources, you can set `services.ntp.restrictDefault` and `services.ntp.restrictSource` to `[]`.
+
+- Package `rabbitmq_server` is renamed to `rabbitmq-server`.
+
+- The `light` module no longer uses setuid binaries, but udev rules. As a consequence users of that module have to belong to the `video` group in order to use the executable (i.e. `users.users.yourusername.extraGroups = ["video"];`).
+
+- Buildbot now supports Python 3 and its packages have been moved to `pythonPackages`. The options `services.buildbot-master.package` and `services.buildbot-worker.package` can be used to select the Python 2 or 3 version of the package.
+
+- Options `services.znc.confOptions.networks.name.userName` and `services.znc.confOptions.networks.name.modulePackages` were removed. They were never used for anything and can therefore safely be removed.
+
+- Package `wasm` has been renamed `proglodyte-wasm`. The package `wasm` will be pointed to `ocamlPackages.wasm` in 19.09, so make sure to update your configuration if you want to keep `proglodyte-wasm`
+
+- When the `nixpkgs.pkgs` option is set, NixOS will no longer ignore the `nixpkgs.overlays` option. The old behavior can be recovered by setting `nixpkgs.overlays = lib.mkForce [];`.
+
+- OpenSMTPD has been upgraded to version 6.4.0p1. This release makes backwards-incompatible changes to the configuration file format. See `man smtpd.conf` for more information on the new file format.
+
+- The versioned `postgresql` have been renamed to use underscore number seperators. For example, `postgresql96` has been renamed to `postgresql_9_6`.
+
+- Package `consul-ui` and passthrough `consul.ui` have been removed. The package `consul` now uses upstream releases that vendor the UI into the binary. See [\#48714](https://github.com/NixOS/nixpkgs/pull/48714#issuecomment-433454834) for details.
+
+- Slurm introduces the new option `services.slurm.stateSaveLocation`, which is now set to `/var/spool/slurm` by default (instead of `/var/spool`). Make sure to move all files to the new directory or to set the option accordingly.
+
+  The slurmctld now runs as user `slurm` instead of `root`. If you want to keep slurmctld running as `root`, set `services.slurm.user = root`.
+
+  The options `services.slurm.nodeName` and `services.slurm.partitionName` are now sets of strings to correctly reflect that fact that each of these options can occour more than once in the configuration.
+
+- The `solr` package has been upgraded from 4.10.3 to 7.5.0 and has undergone some major changes. The `services.solr` module has been updated to reflect these changes. Please review http://lucene.apache.org/solr/ carefully before upgrading.
+
+- Package `ckb` is renamed to `ckb-next`, and options `hardware.ckb.*` are renamed to `hardware.ckb-next.*`.
+
+- The option `services.xserver.displayManager.job.logToFile` which was previously set to `true` when using the display managers `lightdm`, `sddm` or `xpra` has been reset to the default value (`false`).
+
+- Network interface indiscriminate NixOS firewall options (`networking.firewall.allow*`) are now preserved when also setting interface specific rules such as `networking.firewall.interfaces.en0.allow*`. These rules continue to use the pseudo device \"default\" (`networking.firewall.interfaces.default.*`), and assigning to this pseudo device will override the (`networking.firewall.allow*`) options.
+
+- The `nscd` service now disables all caching of `passwd` and `group` databases by default. This was interferring with the correct functioning of the `libnss_systemd.so` module which is used by `systemd` to manage uids and usernames in the presence of `DynamicUser=` in systemd services. This was already the default behaviour in presence of `services.sssd.enable = true` because nscd caching would interfere with `sssd` in unpredictable ways as well. Because we\'re using nscd not for caching, but for convincing glibc to find NSS modules in the nix store instead of an absolute path, we have decided to disable caching globally now, as it\'s usually not the behaviour the user wants and can lead to surprising behaviour. Furthermore, negative caching of host lookups is also disabled now by default. This should fix the issue of dns lookups failing in the presence of an unreliable network.
+
+  If the old behaviour is desired, this can be restored by setting the `services.nscd.config` option with the desired caching parameters.
+
+  ```nix
+  {
+    services.nscd.config =
+    ''
+    server-user             nscd
+    threads                 1
+    paranoia                no
+    debug-level             0
+
+    enable-cache            passwd          yes
+    positive-time-to-live   passwd          600
+    negative-time-to-live   passwd          20
+    suggested-size          passwd          211
+    check-files             passwd          yes
+    persistent              passwd          no
+    shared                  passwd          yes
+
+    enable-cache            group           yes
+    positive-time-to-live   group           3600
+    negative-time-to-live   group           60
+    suggested-size          group           211
+    check-files             group           yes
+    persistent              group           no
+    shared                  group           yes
+
+    enable-cache            hosts           yes
+    positive-time-to-live   hosts           600
+    negative-time-to-live   hosts           5
+    suggested-size          hosts           211
+    check-files             hosts           yes
+    persistent              hosts           no
+    shared                  hosts           yes
+    '';
+  }
+  ```
+
+  See [\#50316](https://github.com/NixOS/nixpkgs/pull/50316) for details.
+
+- GitLab Shell previously used the nix store paths for the `gitlab-shell` command in its `authorized_keys` file, which might stop working after garbage collection. To circumvent that, we regenerated that file on each startup. As `gitlab-shell` has now been changed to use `/var/run/current-system/sw/bin/gitlab-shell`, this is not necessary anymore, but there might be leftover lines with a nix store path. Regenerate the `authorized_keys` file via `sudo -u git -H gitlab-rake gitlab:shell:setup` in that case.
+
+- The `pam_unix` account module is now loaded with its control field set to `required` instead of `sufficient`, so that later PAM account modules that might do more extensive checks are being executed. Previously, the whole account module verification was exited prematurely in case a nss module provided the account name to `pam_unix`. The LDAP and SSSD NixOS modules already add their NSS modules when enabled. In case your setup breaks due to some later PAM account module previosuly shadowed, or failing NSS lookups, please file a bug. You can get back the old behaviour by manually setting `security.pam.services.<name?>.text`.
+
+- The `pam_unix` password module is now loaded with its control field set to `sufficient` instead of `required`, so that password managed only by later PAM password modules are being executed. Previously, for example, changing an LDAP account\'s password through PAM was not possible: the whole password module verification was exited prematurely by `pam_unix`, preventing `pam_ldap` to manage the password as it should.
+
+- `fish` has been upgraded to 3.0. It comes with a number of improvements and backwards incompatible changes. See the `fish` [release notes](https://github.com/fish-shell/fish-shell/releases/tag/3.0.0) for more information.
+
+- The ibus-table input method has had a change in config format, which causes all previous settings to be lost. See [this commit message](https://github.com/mike-fabian/ibus-table/commit/f9195f877c5212fef0dfa446acb328c45ba5852b) for details.
+
+- NixOS module system type `types.optionSet` and `lib.mkOption` argument `options` are deprecated. Use `types.submodule` instead. ([\#54637](https://github.com/NixOS/nixpkgs/pull/54637))
+
+- `matrix-synapse` has been updated to version 0.99. It will [no longer generate a self-signed certificate on first launch](https://github.com/matrix-org/synapse/pull/4509) and will be [the last version to accept self-signed certificates](https://matrix.org/blog/2019/02/05/synapse-0-99-0/). As such, it is now recommended to use a proper certificate verified by a root CA (for example Let\'s Encrypt). The new [manual chapter on Matrix](#module-services-matrix) contains a working example of using nginx as a reverse proxy in front of `matrix-synapse`, using Let\'s Encrypt certificates.
+
+- `mailutils` now works by default when `sendmail` is not in a setuid wrapper. As a consequence, the `sendmailPath` argument, having lost its main use, has been removed.
+
+- `graylog` has been upgraded from version 2.\* to 3.\*. Some setups making use of extraConfig (especially those exposing Graylog via reverse proxies) need to be updated as upstream removed/replaced some settings. See [Upgrading Graylog](http://docs.graylog.org/en/3.0/pages/upgrade/graylog-3.0.html#simplified-http-interface-configuration) for details.
+
+- The option `users.ldap.bind.password` was renamed to `users.ldap.bind.passwordFile`, and needs to be readable by the `nslcd` user. Same applies to the new `users.ldap.daemon.rootpwmodpwFile` option.
+
+- `nodejs-6_x` is end-of-life. `nodejs-6_x`, `nodejs-slim-6_x` and `nodePackages_6_x` are removed.
+
+## Other Notable Changes {#sec-release-19.03-notable-changes}
+
+- The `services.matomo` module gained the option `services.matomo.package` which determines the used Matomo version.
+
+  The Matomo module now also comes with the systemd service `matomo-archive-processing.service` and a timer that automatically triggers archive processing every hour. This means that you can safely [ disable browser triggers for Matomo archiving ](https://matomo.org/docs/setup-auto-archiving/#disable-browser-triggers-for-matomo-archiving-and-limit-matomo-reports-to-updating-every-hour) at `Administration > System > General Settings`.
+
+  Additionally, you can enable to [ delete old visitor logs ](https://matomo.org/docs/privacy/#step-2-delete-old-visitors-logs) at `Administration > System > Privacy`, but make sure that you run `systemctl start matomo-archive-processing.service` at least once without errors if you have already collected data before, so that the reports get archived before the source data gets deleted.
+
+- `composableDerivation` along with supporting library functions has been removed.
+
+- The deprecated `truecrypt` package has been removed and `truecrypt` attribute is now an alias for `veracrypt`. VeraCrypt is backward-compatible with TrueCrypt volumes. Note that `cryptsetup` also supports loading TrueCrypt volumes.
+
+- The Kubernetes DNS addons, kube-dns, has been replaced with CoreDNS. This change is made in accordance with Kubernetes making CoreDNS the official default starting from [Kubernetes v1.11](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.11.md#sig-cluster-lifecycle). Please beware that upgrading DNS-addon on existing clusters might induce minor downtime while the DNS-addon terminates and re-initializes. Also note that the DNS-service now runs with 2 pod replicas by default. The desired number of replicas can be configured using: `services.kubernetes.addons.dns.replicas`.
+
+- The quassel-webserver package and module was removed from nixpkgs due to the lack of maintainers.
+
+- The manual gained a [ new chapter on self-hosting `matrix-synapse` and `riot-web` ](#module-services-matrix), the most prevalent server and client implementations for the [Matrix](https://matrix.org/) federated communication network.
+
+- The astah-community package was removed from nixpkgs due to it being discontinued and the downloads not being available anymore.
+
+- The httpd service now saves log files with a .log file extension by default for easier integration with the logrotate service.
+
+- The owncloud server packages and httpd subservice module were removed from nixpkgs due to the lack of maintainers.
+
+- It is possible now to uze ZRAM devices as general purpose ephemeral block devices, not only as swap. Using more than 1 device as ZRAM swap is no longer recommended, but is still possible by setting `zramSwap.swapDevices` explicitly.
+
+  ZRAM algorithm can be changed now.
+
+  Changes to ZRAM algorithm are applied during `nixos-rebuild switch`, so make sure you have enough swap space on disk to survive ZRAM device rebuild. Alternatively, use `nixos-rebuild boot; reboot`.
+
+- Flat volumes are now disabled by default in `hardware.pulseaudio`. This has been done to prevent applications, which are unaware of this feature, setting their volumes to 100% on startup causing harm to your audio hardware and potentially your ears.
+
+  ::: {.note}
+  With this change application specific volumes are relative to the master volume which can be adjusted independently, whereas before they were absolute; meaning that in effect, it scaled the device-volume with the volume of the loudest application.
+  :::
+
+- The [`ndppd`](https://github.com/DanielAdolfsson/ndppd) module now supports [all config options](options.html#opt-services.ndppd.enable) provided by the current upstream version as service options. Additionally the `ndppd` package doesn\'t contain the systemd unit configuration from upstream anymore, the unit is completely configured by the NixOS module now.
+
+- New installs of NixOS will default to the Redmine 4.x series unless otherwise specified in `services.redmine.package` while existing installs of NixOS will default to the Redmine 3.x series.
+
+- The [Grafana module](options.html#opt-services.grafana.enable) now supports declarative [datasource and dashboard](http://docs.grafana.org/administration/provisioning/) provisioning.
+
+- The use of insecure ports on kubernetes has been deprecated. Thus options: `services.kubernetes.apiserver.port` and `services.kubernetes.controllerManager.port` has been renamed to `.insecurePort`, and default of both options has changed to 0 (disabled).
+
+- Note that the default value of `services.kubernetes.apiserver.bindAddress` has changed from 127.0.0.1 to 0.0.0.0, allowing the apiserver to be accessible from outside the master node itself. If the apiserver insecurePort is enabled, it is strongly recommended to only bind on the loopback interface. See: `services.kubernetes.apiserver.insecurebindAddress`.
+
+- The option `services.kubernetes.apiserver.allowPrivileged` and `services.kubernetes.kubelet.allowPrivileged` now defaults to false. Disallowing privileged containers on the cluster.
+
+- The kubernetes module does no longer add the kubernetes package to `environment.systemPackages` implicitly.
+
+- The `intel` driver has been removed from the default list of [X.org video drivers](options.html#opt-services.xserver.videoDrivers). The `modesetting` driver should take over automatically, it is better maintained upstream and has less problems with advanced X11 features. This can lead to a change in the output names used by `xrandr`. Some performance regressions on some GPU models might happen. Some OpenCL and VA-API applications might also break (Beignet seems to provide OpenCL support with `modesetting` driver, too). Kernel mode setting API does not support backlight control, so `xbacklight` tool will not work; backlight level can be controlled directly via `/sys/` or with `brightnessctl`. Users who need this functionality more than multi-output XRandR are advised to add \`intel\` to \`videoDrivers\` and report an issue (or provide additional details in an existing one)
+
+- Openmpi has been updated to version 4.0.0, which removes some deprecated MPI-1 symbols. This may break some older applications that still rely on those symbols. An upgrade guide can be found [here](https://www.open-mpi.org/faq/?category=mpi-removed).
+
+  The nginx package now relies on OpenSSL 1.1 and supports TLS 1.3 by default. You can set the protocols used by the nginx service using [services.nginx.sslProtocols](options.html#opt-services.nginx.sslProtocols).
+
+- A new subcommand `nixos-rebuild edit` was added.
diff --git a/nixos/doc/manual/release-notes/rl-1903.xml b/nixos/doc/manual/release-notes/rl-1903.xml
deleted file mode 100644
index 5593cb3e5dff..000000000000
--- a/nixos/doc/manual/release-notes/rl-1903.xml
+++ /dev/null
@@ -1,768 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-19.03">
- <title>Release 19.03 (“Koi”, 2019/04/11)</title>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-19.03-highlights">
-  <title>Highlights</title>
-
-  <para>
-   In addition to numerous new and upgraded packages, this release has the
-   following highlights:
-  </para>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     End of support is planned for end of October 2019, handing over to 19.09.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The default Python 3 interpreter is now CPython 3.7 instead of CPython
-     3.6.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Added the Pantheon desktop environment. It can be enabled through
-     <varname>services.xserver.desktopManager.pantheon.enable</varname>.
-    </para>
-    <note>
-     <para>
-      By default, <varname>services.xserver.desktopManager.pantheon</varname>
-      enables LightDM as a display manager, as pantheon's screen locking
-      implementation relies on it.
-     </para>
-     <para>
-      Because of that it is recommended to leave LightDM enabled. If you'd like
-      to disable it anyway, set
-      <option>services.xserver.displayManager.lightdm.enable</option> to
-      <literal>false</literal> and enable your preferred display manager.
-     </para>
-    </note>
-    <para>
-     Also note that Pantheon's LightDM greeter is not enabled by default,
-     because it has numerous issues in NixOS and isn't optimal for use here
-     yet.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     A major refactoring of the Kubernetes module has been completed.
-     Refactorings primarily focus on decoupling components and enhancing
-     security. Two-way TLS and RBAC has been enabled by default for all
-     components, which slightly changes the way the module is configured. See:
-     <xref linkend="sec-kubernetes"/> for details.
-    </para>
-   </listitem>
-   <listitem>
-     <para>
-       There is now a set of <option>confinement</option> options for
-       <option>systemd.services</option>, which allows to restrict services
-       into a <citerefentry>
-        <refentrytitle>chroot</refentrytitle>
-        <manvolnum>2</manvolnum>
-      </citerefentry>ed environment that only contains the store paths from
-      the runtime closure of the service.
-     </para>
-   </listitem>
-  </itemizedlist>
- </section>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-19.03-new-services">
-  <title>New Services</title>
-
-  <para>
-   The following new services were added since the last release:
-  </para>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     <literal>./programs/nm-applet.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     There is a new <varname>security.googleOsLogin</varname> module for using
-     <link xlink:href="https://cloud.google.com/compute/docs/instances/managing-instance-access">OS
-     Login</link> to manage SSH access to Google Compute Engine instances,
-     which supersedes the imperative and broken
-     <literal>google-accounts-daemon</literal> used in
-     <literal>nixos/modules/virtualisation/google-compute-config.nix</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>./services/misc/beanstalkd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     There is a new <varname>services.cockroachdb</varname> module for running
-     CockroachDB databases. NixOS now ships with CockroachDB 2.1.x as well,
-     available on <literal>x86_64-linux</literal> and
-     <literal>aarch64-linux</literal>.
-    </para>
-   </listitem>
-  </itemizedlist>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     <literal>./security/duosec.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <link xlink:href="https://duo.com/docs/duounix">PAM module for Duo
-     Security</link> has been enabled for use. One can configure it using the
-     <option>security.duosec</option> options along with the corresponding PAM
-     option in
-     <option>security.pam.services.&lt;name?&gt;.duoSecurity.enable</option>.
-    </para>
-   </listitem>
-  </itemizedlist>
- </section>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-19.03-incompatibilities">
-  <title>Backward Incompatibilities</title>
-
-  <para>
-   When upgrading from a previous release, please be aware of the following
-   incompatible changes:
-  </para>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     The minimum version of Nix required to evaluate Nixpkgs is now 2.0.
-    </para>
-    <itemizedlist>
-     <listitem>
-      <para>
-       For users of NixOS 18.03 and 19.03, NixOS defaults to Nix 2.0, but
-       supports using Nix 1.11 by setting <literal>nix.package =
-       pkgs.nix1;</literal>. If this option is set to a Nix 1.11 package, you
-       will need to either unset the option or upgrade it to Nix 2.0.
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       For users of NixOS 17.09, you will first need to upgrade Nix by setting
-       <literal>nix.package = pkgs.nixStable2;</literal> and run
-       <command>nixos-rebuild switch</command> as the <literal>root</literal>
-       user.
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       For users of a daemon-less Nix installation on Linux or macOS, you can
-       upgrade Nix by running <command>curl -L https://nixos.org/nix/install |
-       sh</command>, or prior to doing a channel update, running
-       <command>nix-env -iA nix</command>.
-      </para>
-      <para>
-       If you have already run a channel update and Nix is no longer able to
-       evaluate Nixpkgs, the error message printed should provide adequate
-       directions for upgrading Nix.
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       For users of the Nix daemon on macOS, you can upgrade Nix by running
-       <command>sudo -i sh -c 'nix-channel --update &amp;&amp; nix-env -iA
-       nixpkgs.nix'; sudo launchctl stop org.nixos.nix-daemon; sudo launchctl
-       start org.nixos.nix-daemon</command>.
-      </para>
-     </listitem>
-    </itemizedlist>
-   </listitem>
-   <listitem>
-    <para>
-     The <varname>buildPythonPackage</varname> function now sets
-     <varname>strictDeps = true</varname> to help distinguish between native
-     and non-native dependencies in order to improve cross-compilation
-     compatibility. Note however that this may break user expressions.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <varname>buildPythonPackage</varname> function now sets <varname>LANG
-     = C.UTF-8</varname> to enable Unicode support. The
-     <varname>glibcLocales</varname> package is no longer needed as a build
-     input.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The Syncthing state and configuration data has been moved from
-     <varname>services.syncthing.dataDir</varname> to the newly defined
-     <varname>services.syncthing.configDir</varname>, which default to
-     <literal>/var/lib/syncthing/.config/syncthing</literal>. This change makes
-     possible to share synced directories using ACLs without Syncthing
-     resetting the permission on every start.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>ntp</literal> module now has sane default restrictions. If
-     you're relying on the previous defaults, which permitted all queries and
-     commands from all firewall-permitted sources, you can set
-     <varname>services.ntp.restrictDefault</varname> and
-     <varname>services.ntp.restrictSource</varname> to <literal>[]</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Package <varname>rabbitmq_server</varname> is renamed to
-     <varname>rabbitmq-server</varname>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>light</literal> module no longer uses setuid binaries, but
-     udev rules. As a consequence users of that module have to belong to the
-     <literal>video</literal> group in order to use the executable (i.e.
-     <literal>users.users.yourusername.extraGroups = ["video"];</literal>).
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Buildbot now supports Python 3 and its packages have been moved to
-     <literal>pythonPackages</literal>. The options
-     <option>services.buildbot-master.package</option> and
-     <option>services.buildbot-worker.package</option> can be used to select
-     the Python 2 or 3 version of the package.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Options
-     <literal>services.znc.confOptions.networks.<replaceable>name</replaceable>.userName</literal>
-     and
-     <literal>services.znc.confOptions.networks.<replaceable>name</replaceable>.modulePackages</literal>
-     were removed. They were never used for anything and can therefore safely
-     be removed.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Package <literal>wasm</literal> has been renamed
-     <literal>proglodyte-wasm</literal>. The package <literal>wasm</literal>
-     will be pointed to <literal>ocamlPackages.wasm</literal> in 19.09, so make
-     sure to update your configuration if you want to keep
-     <literal>proglodyte-wasm</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     When the <literal>nixpkgs.pkgs</literal> option is set, NixOS will no
-     longer ignore the <literal>nixpkgs.overlays</literal> option. The old
-     behavior can be recovered by setting <literal>nixpkgs.overlays =
-     lib.mkForce [];</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     OpenSMTPD has been upgraded to version 6.4.0p1. This release makes
-     backwards-incompatible changes to the configuration file format. See
-     <command>man smtpd.conf</command> for more information on the new file
-     format.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The versioned <varname>postgresql</varname> have been renamed to use
-     underscore number seperators. For example, <varname>postgresql96</varname>
-     has been renamed to <varname>postgresql_9_6</varname>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Package <literal>consul-ui</literal> and passthrough
-     <literal>consul.ui</literal> have been removed. The package
-     <literal>consul</literal> now uses upstream releases that vendor the UI
-     into the binary. See
-     <link xlink:href="https://github.com/NixOS/nixpkgs/pull/48714#issuecomment-433454834">#48714</link>
-     for details.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Slurm introduces the new option
-     <literal>services.slurm.stateSaveLocation</literal>, which is now set to
-     <literal>/var/spool/slurm</literal> by default (instead of
-     <literal>/var/spool</literal>). Make sure to move all files to the new
-     directory or to set the option accordingly.
-    </para>
-    <para>
-     The slurmctld now runs as user <literal>slurm</literal> instead of
-     <literal>root</literal>. If you want to keep slurmctld running as
-     <literal>root</literal>, set <literal>services.slurm.user =
-     root</literal>.
-    </para>
-    <para>
-     The options <literal>services.slurm.nodeName</literal> and
-     <literal>services.slurm.partitionName</literal> are now sets of strings to
-     correctly reflect that fact that each of these options can occour more
-     than once in the configuration.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>solr</literal> package has been upgraded from 4.10.3 to 7.5.0
-     and has undergone some major changes. The <literal>services.solr</literal>
-     module has been updated to reflect these changes. Please review
-     http://lucene.apache.org/solr/ carefully before upgrading.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Package <literal>ckb</literal> is renamed to <literal>ckb-next</literal>,
-     and options <literal>hardware.ckb.*</literal> are renamed to
-     <literal>hardware.ckb-next.*</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The option
-     <literal>services.xserver.displayManager.job.logToFile</literal> which was
-     previously set to <literal>true</literal> when using the display managers
-     <literal>lightdm</literal>, <literal>sddm</literal> or
-     <literal>xpra</literal> has been reset to the default value
-     (<literal>false</literal>).
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Network interface indiscriminate NixOS firewall options
-     (<literal>networking.firewall.allow*</literal>) are now preserved when
-     also setting interface specific rules such as
-     <literal>networking.firewall.interfaces.en0.allow*</literal>. These rules
-     continue to use the pseudo device "default"
-     (<literal>networking.firewall.interfaces.default.*</literal>), and
-     assigning to this pseudo device will override the
-     (<literal>networking.firewall.allow*</literal>) options.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>nscd</literal> service now disables all caching of
-     <literal>passwd</literal> and <literal>group</literal> databases by
-     default. This was interferring with the correct functioning of the
-     <literal>libnss_systemd.so</literal> module which is used by
-     <literal>systemd</literal> to manage uids and usernames in the presence of
-     <literal>DynamicUser=</literal> in systemd services. This was already the
-     default behaviour in presence of <literal>services.sssd.enable =
-     true</literal> because nscd caching would interfere with
-     <literal>sssd</literal> in unpredictable ways as well. Because we're using
-     nscd not for caching, but for convincing glibc to find NSS modules in the
-     nix store instead of an absolute path, we have decided to disable caching
-     globally now, as it's usually not the behaviour the user wants and can
-     lead to surprising behaviour. Furthermore, negative caching of host
-     lookups is also disabled now by default. This should fix the issue of dns
-     lookups failing in the presence of an unreliable network.
-    </para>
-    <para>
-     If the old behaviour is desired, this can be restored by setting the
-     <literal>services.nscd.config</literal> option with the desired caching
-     parameters.
-<programlisting>
-     services.nscd.config =
-     ''
-     server-user             nscd
-     threads                 1
-     paranoia                no
-     debug-level             0
-
-     enable-cache            passwd          yes
-     positive-time-to-live   passwd          600
-     negative-time-to-live   passwd          20
-     suggested-size          passwd          211
-     check-files             passwd          yes
-     persistent              passwd          no
-     shared                  passwd          yes
-
-     enable-cache            group           yes
-     positive-time-to-live   group           3600
-     negative-time-to-live   group           60
-     suggested-size          group           211
-     check-files             group           yes
-     persistent              group           no
-     shared                  group           yes
-
-     enable-cache            hosts           yes
-     positive-time-to-live   hosts           600
-     negative-time-to-live   hosts           5
-     suggested-size          hosts           211
-     check-files             hosts           yes
-     persistent              hosts           no
-     shared                  hosts           yes
-     '';
-     </programlisting>
-     See
-     <link xlink:href="https://github.com/NixOS/nixpkgs/pull/50316">#50316</link>
-     for details.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     GitLab Shell previously used the nix store paths for the
-     <literal>gitlab-shell</literal> command in its
-     <literal>authorized_keys</literal> file, which might stop working after
-     garbage collection. To circumvent that, we regenerated that file on each
-     startup. As <literal>gitlab-shell</literal> has now been changed to use
-     <literal>/var/run/current-system/sw/bin/gitlab-shell</literal>, this is
-     not necessary anymore, but there might be leftover lines with a nix store
-     path. Regenerate the <literal>authorized_keys</literal> file via
-     <command>sudo -u git -H gitlab-rake gitlab:shell:setup</command> in that
-     case.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>pam_unix</literal> account module is now loaded with its
-     control field set to <literal>required</literal> instead of
-     <literal>sufficient</literal>, so that later PAM account modules that
-     might do more extensive checks are being executed. Previously, the whole
-     account module verification was exited prematurely in case a nss module
-     provided the account name to <literal>pam_unix</literal>. The LDAP and
-     SSSD NixOS modules already add their NSS modules when enabled. In case
-     your setup breaks due to some later PAM account module previosuly
-     shadowed, or failing NSS lookups, please file a bug. You can get back the
-     old behaviour by manually setting <literal>
-<![CDATA[security.pam.services.<name?>.text]]>
-     </literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>pam_unix</literal> password module is now loaded with its
-     control field set to <literal>sufficient</literal> instead of
-     <literal>required</literal>, so that password managed only by later PAM
-     password modules are being executed. Previously, for example, changing an
-     LDAP account's password through PAM was not possible: the whole password
-     module verification was exited prematurely by <literal>pam_unix</literal>,
-     preventing <literal>pam_ldap</literal> to manage the password as it
-     should.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>fish</literal> has been upgraded to 3.0. It comes with a number
-     of improvements and backwards incompatible changes. See the
-     <literal>fish</literal>
-     <link xlink:href="https://github.com/fish-shell/fish-shell/releases/tag/3.0.0">release
-     notes</link> for more information.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The ibus-table input method has had a change in config format, which
-     causes all previous settings to be lost. See
-     <link xlink:href="https://github.com/mike-fabian/ibus-table/commit/f9195f877c5212fef0dfa446acb328c45ba5852b">this
-     commit message</link> for details.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     NixOS module system type <literal>types.optionSet</literal> and
-     <literal>lib.mkOption</literal> argument <literal>options</literal> are
-     deprecated. Use <literal>types.submodule</literal> instead.
-     (<link xlink:href="https://github.com/NixOS/nixpkgs/pull/54637">#54637</link>)
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>matrix-synapse</literal> has been updated to version 0.99. It
-     will <link xlink:href="https://github.com/matrix-org/synapse/pull/4509">no
-     longer generate a self-signed certificate on first launch</link> and will
-     be
-     <link xlink:href="https://matrix.org/blog/2019/02/05/synapse-0-99-0/">the
-     last version to accept self-signed certificates</link>. As such, it is now
-     recommended to use a proper certificate verified by a root CA (for example
-     Let's Encrypt). The new <link linkend="module-services-matrix">manual
-     chapter on Matrix</link> contains a working example of using nginx as a
-     reverse proxy in front of <literal>matrix-synapse</literal>, using Let's
-     Encrypt certificates.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>mailutils</literal> now works by default when
-     <literal>sendmail</literal> is not in a setuid wrapper. As a consequence,
-     the <literal>sendmailPath</literal> argument, having lost its main use,
-     has been removed.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>graylog</literal> has been upgraded from version 2.* to 3.*. Some
-     setups making use of extraConfig (especially those exposing Graylog via
-     reverse proxies) need to be updated as upstream removed/replaced some
-     settings. See
-     <link xlink:href="http://docs.graylog.org/en/3.0/pages/upgrade/graylog-3.0.html#simplified-http-interface-configuration">Upgrading
-     Graylog</link> for details.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      The option <literal>users.ldap.bind.password</literal> was renamed to <literal>users.ldap.bind.passwordFile</literal>,
-      and needs to be readable by the <literal>nslcd</literal> user.
-      Same applies to the new <literal>users.ldap.daemon.rootpwmodpwFile</literal> option.
-    </para>
-   </listitem>
-   <listitem>
-     <para>
-       <literal>nodejs-6_x</literal> is end-of-life.
-       <literal>nodejs-6_x</literal>, <literal>nodejs-slim-6_x</literal> and
-       <literal>nodePackages_6_x</literal> are removed.
-     </para>
-   </listitem>
-  </itemizedlist>
- </section>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-19.03-notable-changes">
-  <title>Other Notable Changes</title>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     The <option>services.matomo</option> module gained the option
-     <option>services.matomo.package</option> which determines the used Matomo
-     version.
-    </para>
-    <para>
-     The Matomo module now also comes with the systemd service
-     <literal>matomo-archive-processing.service</literal> and a timer that
-     automatically triggers archive processing every hour. This means that you
-     can safely
-     <link xlink:href="https://matomo.org/docs/setup-auto-archiving/#disable-browser-triggers-for-matomo-archiving-and-limit-matomo-reports-to-updating-every-hour">
-     disable browser triggers for Matomo archiving </link> at
-     <literal>Administration > System > General Settings</literal>.
-    </para>
-    <para>
-     Additionally, you can enable to
-     <link xlink:href="https://matomo.org/docs/privacy/#step-2-delete-old-visitors-logs">
-     delete old visitor logs </link> at <literal>Administration > System >
-     Privacy</literal>, but make sure that you run <literal>systemctl start
-     matomo-archive-processing.service</literal> at least once without errors
-     if you have already collected data before, so that the reports get
-     archived before the source data gets deleted.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>composableDerivation</literal> along with supporting library
-     functions has been removed.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The deprecated <literal>truecrypt</literal> package has been removed and
-     <literal>truecrypt</literal> attribute is now an alias for
-     <literal>veracrypt</literal>. VeraCrypt is backward-compatible with
-     TrueCrypt volumes. Note that <literal>cryptsetup</literal> also supports
-     loading TrueCrypt volumes.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The Kubernetes DNS addons, kube-dns, has been replaced with CoreDNS. This
-     change is made in accordance with Kubernetes making CoreDNS the official
-     default starting from
-     <link xlink:href="https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.11.md#sig-cluster-lifecycle">Kubernetes
-     v1.11</link>. Please beware that upgrading DNS-addon on existing clusters
-     might induce minor downtime while the DNS-addon terminates and
-     re-initializes. Also note that the DNS-service now runs with 2 pod
-     replicas by default. The desired number of replicas can be configured
-     using: <option>services.kubernetes.addons.dns.replicas</option>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The quassel-webserver package and module was removed from nixpkgs due to
-     the lack of maintainers.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The manual gained a <link linkend="module-services-matrix"> new chapter on
-     self-hosting <literal>matrix-synapse</literal> and
-     <literal>riot-web</literal> </link>, the most prevalent server and client
-     implementations for the
-     <link xlink:href="https://matrix.org/">Matrix</link> federated
-     communication network.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The astah-community package was removed from nixpkgs due to it being
-     discontinued and the downloads not being available anymore.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The httpd service now saves log files with a .log file extension by
-     default for easier integration with the logrotate service.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The owncloud server packages and httpd subservice module were removed from
-     nixpkgs due to the lack of maintainers.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     It is possible now to uze ZRAM devices as general purpose ephemeral block
-     devices, not only as swap. Using more than 1 device as ZRAM swap is no
-     longer recommended, but is still possible by setting
-     <literal>zramSwap.swapDevices</literal> explicitly.
-    </para>
-    <para>
-     ZRAM algorithm can be changed now.
-    </para>
-    <para>
-     Changes to ZRAM algorithm are applied during <literal>nixos-rebuild
-     switch</literal>, so make sure you have enough swap space on disk to
-     survive ZRAM device rebuild. Alternatively, use <literal>nixos-rebuild
-     boot; reboot</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Flat volumes are now disabled by default in
-     <literal>hardware.pulseaudio</literal>. This has been done to prevent
-     applications, which are unaware of this feature, setting their volumes to
-     100% on startup causing harm to your audio hardware and potentially your
-     ears.
-    </para>
-    <note>
-     <para>
-      With this change application specific volumes are relative to the master
-      volume which can be adjusted independently, whereas before they were
-      absolute; meaning that in effect, it scaled the device-volume with the
-      volume of the loudest application.
-     </para>
-    </note>
-   </listitem>
-   <listitem>
-    <para>
-     The
-     <link xlink:href="https://github.com/DanielAdolfsson/ndppd"><literal>ndppd</literal></link>
-     module now supports <link linkend="opt-services.ndppd.enable">all config
-     options</link> provided by the current upstream version as service
-     options. Additionally the <literal>ndppd</literal> package doesn't contain
-     the systemd unit configuration from upstream anymore, the unit is
-     completely configured by the NixOS module now.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     New installs of NixOS will default to the Redmine 4.x series unless
-     otherwise specified in <literal>services.redmine.package</literal> while
-     existing installs of NixOS will default to the Redmine 3.x series.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <link linkend="opt-services.grafana.enable">Grafana module</link> now
-     supports declarative
-     <link xlink:href="http://docs.grafana.org/administration/provisioning/">datasource
-     and dashboard</link> provisioning.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The use of insecure ports on kubernetes has been deprecated. Thus options:
-     <varname>services.kubernetes.apiserver.port</varname> and
-     <varname>services.kubernetes.controllerManager.port</varname> has been
-     renamed to <varname>.insecurePort</varname>, and default of both options
-     has changed to 0 (disabled).
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Note that the default value of
-     <varname>services.kubernetes.apiserver.bindAddress</varname> has changed
-     from 127.0.0.1 to 0.0.0.0, allowing the apiserver to be accessible from
-     outside the master node itself. If the apiserver insecurePort is enabled,
-     it is strongly recommended to only bind on the loopback interface. See:
-     <varname>services.kubernetes.apiserver.insecurebindAddress</varname>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The option
-     <varname>services.kubernetes.apiserver.allowPrivileged</varname> and
-     <varname>services.kubernetes.kubelet.allowPrivileged</varname> now
-     defaults to false. Disallowing privileged containers on the cluster.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The kubernetes module does no longer add the kubernetes package to
-     <varname>environment.systemPackages</varname> implicitly.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>intel</literal> driver has been removed from the default list
-     of <link linkend="opt-services.xserver.videoDrivers">X.org video
-     drivers</link>. The <literal>modesetting</literal> driver should take over
-     automatically, it is better maintained upstream and has less problems with
-     advanced X11 features. This can lead to a change in the output names used
-     by <literal>xrandr</literal>. Some performance regressions on some GPU
-     models might happen. Some OpenCL and VA-API applications might also break
-     (Beignet seems to provide OpenCL support with
-     <literal>modesetting</literal> driver, too). Kernel mode setting API does
-     not support backlight control, so <literal>xbacklight</literal> tool will
-     not work; backlight level can be controlled directly via
-     <literal>/sys/</literal> or with <literal>brightnessctl</literal>. Users
-     who need this functionality more than multi-output XRandR are advised to
-     add `intel` to `videoDrivers` and report an issue (or provide additional
-     details in an existing one)
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Openmpi has been updated to version 4.0.0, which removes some deprecated
-     MPI-1 symbols. This may break some older applications that still rely on
-     those symbols. An upgrade guide can be found
-     <link xlink:href="https://www.open-mpi.org/faq/?category=mpi-removed">here</link>.
-    </para>
-    <para>
-     The nginx package now relies on OpenSSL 1.1 and supports TLS 1.3 by
-     default. You can set the protocols used by the nginx service using
-     <xref linkend="opt-services.nginx.sslProtocols"/>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     A new subcommand <command>nixos-rebuild edit</command> was added.
-    </para>
-   </listitem>
-  </itemizedlist>
- </section>
-</section>
diff --git a/nixos/doc/manual/release-notes/rl-1909.section.md b/nixos/doc/manual/release-notes/rl-1909.section.md
new file mode 100644
index 000000000000..572f1bf5a255
--- /dev/null
+++ b/nixos/doc/manual/release-notes/rl-1909.section.md
@@ -0,0 +1,313 @@
+# Release 19.09 ("Loris", 2019/10/09) {#sec-release-19.09}
+
+## Highlights {#sec-release-19.09-highlights}
+
+In addition to numerous new and upgraded packages, this release has the following highlights:
+
+- End of support is planned for end of April 2020, handing over to 20.03.
+
+- Nix has been updated to 2.3; see its [release notes](https://nixos.org/nix/manual/#ssec-relnotes-2.3).
+
+- Core version changes:
+
+  systemd: 239 -\> 243
+
+  gcc: 7 -\> 8
+
+  glibc: 2.27 (unchanged)
+
+  linux: 4.19 LTS (unchanged)
+
+  openssl: 1.0 -\> 1.1
+
+- Desktop version changes:
+
+  plasma5: 5.14 -\> 5.16
+
+  gnome3: 3.30 -\> 3.32
+
+- PHP now defaults to PHP 7.3, updated from 7.2.
+
+- PHP 7.1 is no longer supported due to upstream not supporting this version for the entire lifecycle of the 19.09 release.
+
+- The binfmt module is now easier to use. Additional systems can be added through `boot.binfmt.emulatedSystems`. For instance, `boot.binfmt.emulatedSystems = [ "wasm32-wasi" "x86_64-windows" "aarch64-linux" ];` will set up binfmt interpreters for each of those listed systems.
+
+- The installer now uses a less privileged `nixos` user whereas before we logged in as root. To gain root privileges use `sudo -i` without a password.
+
+- We\'ve updated to Xfce 4.14, which brings a new module `services.xserver.desktopManager.xfce4-14`. If you\'d like to upgrade, please switch from the `services.xserver.desktopManager.xfce` module as it will be deprecated in a future release. They\'re incompatibilities with the current Xfce module; it doesn\'t support `thunarPlugins` and it isn\'t recommended to use `services.xserver.desktopManager.xfce` and `services.xserver.desktopManager.xfce4-14` simultaneously or to downgrade from Xfce 4.14 after upgrading.
+
+- The GNOME 3 desktop manager module sports an interface to enable/disable core services, applications, and optional GNOME packages like games.
+
+  - `services.gnome3.core-os-services.enable`
+
+  - `services.gnome3.core-shell.enable`
+
+  - `services.gnome3.core-utilities.enable`
+
+  - `services.gnome3.games.enable`
+
+  With these options we hope to give users finer grained control over their systems. Prior to this change you\'d either have to manually disable options or use `environment.gnome3.excludePackages` which only excluded the optional applications. `environment.gnome3.excludePackages` is now unguarded, it can exclude any package installed with `environment.systemPackages` in the GNOME 3 module.
+
+- Orthogonal to the previous changes to the GNOME 3 desktop manager module, we\'ve updated all default services and applications to match as close as possible to a default reference GNOME 3 experience.
+
+  **The following changes were enacted in `services.gnome3.core-utilities.enable`**
+
+  - `accerciser`
+
+  - `dconf-editor`
+
+  - `evolution`
+
+  - `gnome-documents`
+
+  - `gnome-nettool`
+
+  - `gnome-power-manager`
+
+  - `gnome-todo`
+
+  - `gnome-tweaks`
+
+  - `gnome-usage`
+
+  - `gucharmap`
+
+  - `nautilus-sendto`
+
+  - `vinagre`
+
+  - `cheese`
+
+  - `geary`
+
+  **The following changes were enacted in `services.gnome3.core-shell.enable`**
+
+  - `gnome-color-manager`
+
+  - `orca`
+
+  - `services.avahi.enable`
+
+## New Services {#sec-release-19.09-new-services}
+
+The following new services were added since the last release:
+
+- `./programs/dwm-status.nix`
+
+- The new `hardware.printers` module allows to declaratively configure CUPS printers via the `ensurePrinters` and `ensureDefaultPrinter` options. `ensurePrinters` will never delete existing printers, but will make sure that the given printers are configured as declared.
+
+- There is a new [services.system-config-printer.enable](options.html#opt-services.system-config-printer.enable) and [programs.system-config-printer.enable](options.html#opt-programs.system-config-printer.enable) module for the program of the same name. If you previously had `system-config-printer` enabled through some other means you should migrate to using one of these modules.
+
+  - `services.xserver.desktopManager.plasma5`
+
+  - `services.xserver.desktopManager.gnome3`
+
+  - `services.xserver.desktopManager.pantheon`
+
+  - `services.xserver.desktopManager.mate` Note Mate uses `programs.system-config-printer` as it doesn\'t use it as a service, but its graphical interface directly.
+
+- [services.blueman.enable](options.html#opt-services.blueman.enable) has been added. If you previously had blueman installed via `environment.systemPackages` please migrate to using the NixOS module, as this would result in an insufficiently configured blueman.
+
+## Backward Incompatibilities {#sec-release-19.09-incompatibilities}
+
+When upgrading from a previous release, please be aware of the following incompatible changes:
+
+- Buildbot no longer supports Python 2, as support was dropped upstream in version 2.0.0. Configurations may need to be modified to make them compatible with Python 3.
+
+- PostgreSQL now uses `/run/postgresql` as its socket directory instead of `/tmp`. So if you run an application like eg. Nextcloud, where you need to use the Unix socket path as the database host name, you need to change it accordingly.
+
+- PostgreSQL 9.4 is scheduled EOL during the 19.09 life cycle and has been removed.
+
+- The options `services.prometheus.alertmanager.user` and `services.prometheus.alertmanager.group` have been removed because the alertmanager service is now using systemd\'s [ DynamicUser mechanism](http://0pointer.net/blog/dynamic-users-with-systemd.html) which obviates these options.
+
+- The NetworkManager systemd unit was renamed back from network-manager.service to NetworkManager.service for better compatibility with other applications expecting this name. The same applies to ModemManager where modem-manager.service is now called ModemManager.service again.
+
+- The `services.nzbget.configFile` and `services.nzbget.openFirewall` options were removed as they are managed internally by the nzbget. The `services.nzbget.dataDir` option hadn\'t actually been used by the module for some time and so was removed as cleanup.
+
+- The `services.mysql.pidDir` option was removed, as it was only used by the wordpress apache-httpd service to wait for mysql to have started up. This can be accomplished by either describing a dependency on mysql.service (preferred) or waiting for the (hardcoded) `/run/mysqld/mysql.sock` file to appear.
+
+- The `services.emby.enable` module has been removed, see `services.jellyfin.enable` instead for a free software fork of Emby. See the Jellyfin documentation: [ Migrating from Emby to Jellyfin ](https://jellyfin.readthedocs.io/en/latest/administrator-docs/migrate-from-emby/)
+
+- IPv6 Privacy Extensions are now enabled by default for undeclared interfaces. The previous behaviour was quite misleading --- even though the default value for `networking.interfaces.*.preferTempAddress` was `true`, undeclared interfaces would not prefer temporary addresses. Now, interfaces not mentioned in the config will prefer temporary addresses. EUI64 addresses can still be set as preferred by explicitly setting the option to `false` for the interface in question.
+
+- Since Bittorrent Sync was superseded by Resilio Sync in 2016, the `bittorrentSync`, `bittorrentSync14`, and `bittorrentSync16` packages have been removed in favor of `resilio-sync`.
+
+  The corresponding module, `services.btsync` has been replaced by the `services.resilio` module.
+
+- The httpd service no longer attempts to start the postgresql service. If you have come to depend on this behaviour then you can preserve the behavior with the following configuration: `systemd.services.httpd.after = [ "postgresql.service" ];`
+
+  The option `services.httpd.extraSubservices` has been marked as deprecated. You may still use this feature, but it will be removed in a future release of NixOS. You are encouraged to convert any httpd subservices you may have written to a full NixOS module.
+
+  Most of the httpd subservices packaged with NixOS have been replaced with full NixOS modules including LimeSurvey, WordPress, and Zabbix. These modules can be enabled using the `services.limesurvey.enable`, `services.mediawiki.enable`, `services.wordpress.enable`, and `services.zabbixWeb.enable` options.
+
+- The option `systemd.network.networks.<name>.routes.*.routeConfig.GatewayOnlink` was renamed to `systemd.network.networks.<name>.routes.*.routeConfig.GatewayOnLink` (capital `L`). This follows [ upstreams renaming ](https://github.com/systemd/systemd/commit/9cb8c5593443d24c19e40bfd4fc06d672f8c554c) of the setting.
+
+- As of this release the NixOps feature `autoLuks` is deprecated. It no longer works with our systemd version without manual intervention.
+
+  Whenever the usage of the module is detected the evaluation will fail with a message explaining why and how to deal with the situation.
+
+  A new knob named `nixops.enableDeprecatedAutoLuks` has been introduced to disable the eval failure and to acknowledge the notice was received and read. If you plan on using the feature please note that it might break with subsequent updates.
+
+  Make sure you set the `_netdev` option for each of the file systems referring to block devices provided by the autoLuks module. Not doing this might render the system in a state where it doesn\'t boot anymore.
+
+  If you are actively using the `autoLuks` module please let us know in [issue \#62211](https://github.com/NixOS/nixpkgs/issues/62211).
+
+- The setopt declarations will be evaluated at the end of `/etc/zshrc`, so any code in [programs.zsh.interactiveShellInit](options.html#opt-programs.zsh.interactiveShellInit), [programs.zsh.loginShellInit](options.html#opt-programs.zsh.loginShellInit) and [programs.zsh.promptInit](options.html#opt-programs.zsh.promptInit) may break if it relies on those options being set.
+
+- The `prometheus-nginx-exporter` package now uses the offical exporter provided by NGINX Inc. Its metrics are differently structured and are incompatible to the old ones. For information about the metrics, have a look at the [official repo](https://github.com/nginxinc/nginx-prometheus-exporter).
+
+- The `shibboleth-sp` package has been updated to version 3. It is largely backward compatible, for further information refer to the [release notes](https://wiki.shibboleth.net/confluence/display/SP3/ReleaseNotes) and [upgrade guide](https://wiki.shibboleth.net/confluence/display/SP3/UpgradingFromV2).
+
+  Nodejs 8 is scheduled EOL under the lifetime of 19.09 and has been dropped.
+
+- By default, prometheus exporters are now run with `DynamicUser` enabled. Exporters that need a real user, now run under a seperate user and group which follow the pattern `<exporter-name>-exporter`, instead of the previous default `nobody` and `nogroup`. Only some exporters are affected by the latter, namely the exporters `dovecot`, `node`, `postfix` and `varnish`.
+
+- The `ibus-qt` package is not installed by default anymore when [i18n.inputMethod.enabled](options.html#opt-i18n.inputMethod.enabled) is set to `ibus`. If IBus support in Qt 4.x applications is required, add the `ibus-qt` package to your [environment.systemPackages](options.html#opt-environment.systemPackages) manually.
+
+- The CUPS Printing service now uses socket-based activation by default, only starting when needed. The previous behavior can be restored by setting `services.cups.startWhenNeeded` to `false`.
+
+- The `services.systemhealth` module has been removed from nixpkgs due to lack of maintainer.
+
+- The `services.mantisbt` module has been removed from nixpkgs due to lack of maintainer.
+
+- Squid 3 has been removed and the `squid` derivation now refers to Squid 4.
+
+- The `services.pdns-recursor.extraConfig` option has been replaced by `services.pdns-recursor.settings`. The new option allows setting extra configuration while being better type-checked and mergeable.
+
+- No service depends on `keys.target` anymore which is a systemd target that indicates if all [NixOps keys](https://nixos.org/nixops/manual/#idm140737322342384) were successfully uploaded. Instead, `<key-name>-key.service` should be used to define a dependency of a key in a service. The full issue behind the `keys.target` dependency is described at [NixOS/nixpkgs\#67265](https://github.com/NixOS/nixpkgs/issues/67265).
+
+  The following services are affected by this:
+
+  - [`services.dovecot2`](options.html#opt-services.dovecot2.enable)
+
+  - [`services.nsd`](options.html#opt-services.nsd.enable)
+
+  - [`services.softether`](options.html#opt-services.softether.enable)
+
+  - [`services.strongswan`](options.html#opt-services.strongswan.enable)
+
+  - [`services.strongswan-swanctl`](options.html#opt-services.strongswan-swanctl.enable)
+
+  - [`services.httpd`](options.html#opt-services.httpd.enable)
+
+- The `security.acme.directory` option has been replaced by a read-only `security.acme.certs.<cert>.directory` option for each certificate you define. This will be a subdirectory of `/var/lib/acme`. You can use this read-only option to figure out where the certificates are stored for a specific certificate. For example, the `services.nginx.virtualhosts.<name>.enableACME` option will use this directory option to find the certs for the virtual host.
+
+  `security.acme.preDelay` and `security.acme.activationDelay` options have been removed. To execute a service before certificates are provisioned or renewed add a `RequiredBy=acme-${cert}.service` to any service.
+
+  Furthermore, the acme module will not automatically add a dependency on `lighttpd.service` anymore. If you are using certficates provided by letsencrypt for lighttpd, then you should depend on the certificate service `acme-${cert}.service>` manually.
+
+  For nginx, the dependencies are still automatically managed when `services.nginx.virtualhosts.<name>.enableACME` is enabled just like before. What changed is that nginx now directly depends on the specific certificates that it needs, instead of depending on the catch-all `acme-certificates.target`. This target unit was also removed from the codebase. This will mean nginx will no longer depend on certificates it isn\'t explicitly managing and fixes a bug with certificate renewal ordering racing with nginx restarting which could lead to nginx getting in a broken state as described at [NixOS/nixpkgs\#60180](https://github.com/NixOS/nixpkgs/issues/60180).
+
+- The old deprecated `emacs` package sets have been dropped. What used to be called `emacsPackagesNg` is now simply called `emacsPackages`.
+
+- `services.xserver.desktopManager.xterm` is now disabled by default if `stateVersion` is 19.09 or higher. Previously the xterm desktopManager was enabled when xserver was enabled, but it isn\'t useful for all people so it didn\'t make sense to have any desktopManager enabled default.
+
+- The WeeChat plugin `pkgs.weechatScripts.weechat-xmpp` has been removed as it doesn\'t receive any updates from upstream and depends on outdated Python2-based modules.
+
+- Old unsupported versions (`logstash5`, `kibana5`, `filebeat5`, `heartbeat5`, `metricbeat5`, `packetbeat5`) of the ELK-stack and Elastic beats have been removed.
+
+- For NixOS 19.03, both Prometheus 1 and 2 were available to allow for a seamless transition from version 1 to 2 with existing setups. Because Prometheus 1 is no longer developed, it was removed. Prometheus 2 is now configured with `services.prometheus`.
+
+- Citrix Receiver (`citrix_receiver`) has been dropped in favor of Citrix Workspace (`citrix_workspace`).
+
+- The `services.gitlab` module has had its literal secret options (`services.gitlab.smtp.password`, `services.gitlab.databasePassword`, `services.gitlab.initialRootPassword`, `services.gitlab.secrets.secret`, `services.gitlab.secrets.db`, `services.gitlab.secrets.otp` and `services.gitlab.secrets.jws`) replaced by file-based versions (`services.gitlab.smtp.passwordFile`, `services.gitlab.databasePasswordFile`, `services.gitlab.initialRootPasswordFile`, `services.gitlab.secrets.secretFile`, `services.gitlab.secrets.dbFile`, `services.gitlab.secrets.otpFile` and `services.gitlab.secrets.jwsFile`). This was done so that secrets aren\'t stored in the world-readable nix store, but means that for each option you\'ll have to create a file with the same exact string, add \"File\" to the end of the option name, and change the definition to a string pointing to the corresponding file; e.g. `services.gitlab.databasePassword = "supersecurepassword"` becomes `services.gitlab.databasePasswordFile = "/path/to/secret_file"` where the file `secret_file` contains the string `supersecurepassword`.
+
+  The state path (`services.gitlab.statePath`) now has the following restriction: no parent directory can be owned by any other user than `root` or the user specified in `services.gitlab.user`; i.e. if `services.gitlab.statePath` is set to `/var/lib/gitlab/state`, `gitlab` and all parent directories must be owned by either `root` or the user specified in `services.gitlab.user`.
+
+- The `networking.useDHCP` option is unsupported in combination with `networking.useNetworkd` in anticipation of defaulting to it. It has to be set to `false` and enabled per interface with `networking.interfaces.<name>.useDHCP = true;`
+
+- The Twitter client `corebird` has been dropped as [it is discontinued and does not work against the new Twitter API](https://www.patreon.com/posts/corebirds-future-18921328). Please use the fork `cawbird` instead which has been adapted to the API changes and is still maintained.
+
+- The `nodejs-11_x` package has been removed as it\'s EOLed by upstream.
+
+- Because of the systemd upgrade, systemd-timesyncd will no longer work if `system.stateVersion` is not set correctly. When upgrading from NixOS 19.03, please make sure that `system.stateVersion` is set to `"19.03"`, or lower if the installation dates back to an earlier version of NixOS.
+
+- Due to the short lifetime of non-LTS kernel releases package attributes like `linux_5_1`, `linux_5_2` and `linux_5_3` have been removed to discourage dependence on specific non-LTS kernel versions in stable NixOS releases. Going forward, versioned attributes like `linux_4_9` will exist for LTS versions only. Please use `linux_latest` or `linux_testing` if you depend on non-LTS releases. Keep in mind that `linux_latest` and `linux_testing` will change versions under the hood during the lifetime of a stable release and might include breaking changes.
+
+- Because of the systemd upgrade, some network interfaces might change their name. For details see [ upstream docs](https://www.freedesktop.org/software/systemd/man/systemd.net-naming-scheme.html#History) or [ our ticket](https://github.com/NixOS/nixpkgs/issues/71086).
+
+## Other Notable Changes {#sec-release-19.09-notable-changes}
+
+- The `documentation` module gained an option named `documentation.nixos.includeAllModules` which makes the generated configuration.nix 5 manual page include all options from all NixOS modules included in a given `configuration.nix` configuration file. Currently, it is set to `false` by default as enabling it frequently prevents evaluation. But the plan is to eventually have it set to `true` by default. Please set it to `true` now in your `configuration.nix` and fix all the bugs it uncovers.
+
+- The `vlc` package gained support for Chromecast streaming, enabled by default. TCP port 8010 must be open for it to work, so something like `networking.firewall.allowedTCPPorts = [ 8010 ];` may be required in your configuration. Also consider enabling [ Accelerated Video Playback](https://nixos.wiki/wiki/Accelerated_Video_Playback) for better transcoding performance.
+
+- The following changes apply if the `stateVersion` is changed to 19.09 or higher. For `stateVersion = "19.03"` or lower the old behavior is preserved.
+
+  - `solr.package` defaults to `pkgs.solr_8`.
+
+- The `hunspellDicts.fr-any` dictionary now ships with `fr_FR.{aff,dic}` which is linked to `fr-toutesvariantes.{aff,dic}`.
+
+- The `mysql` service now runs as `mysql` user. Previously, systemd did execute it as root, and mysql dropped privileges itself. This includes `ExecStartPre=` and `ExecStartPost=` phases. To accomplish that, runtime and data directory setup was delegated to RuntimeDirectory and tmpfiles.
+
+- With the upgrade to systemd version 242 the `systemd-timesyncd` service is no longer using `DynamicUser=yes`. In order for the upgrade to work we rely on an activation script to move the state from the old to the new directory. The older directory (prior `19.09`) was `/var/lib/private/systemd/timesync`.
+
+  As long as the `system.config.stateVersion` is below `19.09` the state folder will migrated to its proper location (`/var/lib/systemd/timesync`), if required.
+
+- The package `avahi` is now built to look up service definitions from `/etc/avahi/services` instead of its output directory in the nix store. Accordingly the module `avahi` now supports custom service definitions via `services.avahi.extraServiceFiles`, which are then placed in the aforementioned directory. See avahi.service5 for more information on custom service definitions.
+
+- Since version 0.1.19, `cargo-vendor` honors package includes that are specified in the `Cargo.toml` file of Rust crates. `rustPlatform.buildRustPackage` uses `cargo-vendor` to collect and build dependent crates. Since this change in `cargo-vendor` changes the set of vendored files for most Rust packages, the hash that use used to verify the dependencies, `cargoSha256`, also changes.
+
+  The `cargoSha256` hashes of all in-tree derivations that use `buildRustPackage` have been updated to reflect this change. However, third-party derivations that use `buildRustPackage` may have to be updated as well.
+
+- The `consul` package was upgraded past version `1.5`, so its deprecated legacy UI is no longer available.
+
+- The default resample-method for PulseAudio has been changed from the upstream default `speex-float-1` to `speex-float-5`. Be aware that low-powered ARM-based and MIPS-based boards will struggle with this so you\'ll need to set `hardware.pulseaudio.daemon.config.resample-method` back to `speex-float-1`.
+
+- The `phabricator` package and associated `httpd.extraSubservice`, as well as the `phd` service have been removed from nixpkgs due to lack of maintainer.
+
+- The `mercurial` `httpd.extraSubservice` has been removed from nixpkgs due to lack of maintainer.
+
+- The `trac` `httpd.extraSubservice` has been removed from nixpkgs because it was unmaintained.
+
+- The `foswiki` package and associated `httpd.extraSubservice` have been removed from nixpkgs due to lack of maintainer.
+
+- The `tomcat-connector` `httpd.extraSubservice` has been removed from nixpkgs.
+
+- It\'s now possible to change configuration in [services.nextcloud](options.html#opt-services.nextcloud.enable) after the initial deploy since all config parameters are persisted in an additional config file generated by the module. Previously core configuration like database parameters were set using their imperative installer after creating `/var/lib/nextcloud`.
+
+- There exists now `lib.forEach`, which is like `map`, but with arguments flipped. When mapping function body spans many lines (or has nested `map`s), it is often hard to follow which list is modified.
+
+  Previous solution to this problem was either to use `lib.flip map` idiom or extract that anonymous mapping function to a named one. Both can still be used but `lib.forEach` is preferred over `lib.flip map`.
+
+  The `/etc/sysctl.d/nixos.conf` file containing all the options set via [boot.kernel.sysctl](options.html#opt-boot.kernel.sysctl) was moved to `/etc/sysctl.d/60-nixos.conf`, as sysctl.d5 recommends prefixing all filenames in `/etc/sysctl.d` with a two-digit number and a dash to simplify the ordering of the files.
+
+- We now install the sysctl snippets shipped with systemd.
+
+  - Loose reverse path filtering
+
+  - Source route filtering
+
+  - `fq_codel` as a packet scheduler (this helps to fight bufferbloat)
+
+  This also configures the kernel to pass core dumps to `systemd-coredump`, and restricts the SysRq key combinations to the sync command only. These sysctl snippets can be found in `/etc/sysctl.d/50-*.conf`, and overridden via [boot.kernel.sysctl](options.html#opt-boot.kernel.sysctl) (which will place the parameters in `/etc/sysctl.d/60-nixos.conf`).
+
+- Core dumps are now processed by `systemd-coredump` by default. `systemd-coredump` behaviour can still be modified via `systemd.coredump.extraConfig`. To stick to the old behaviour (having the kernel dump to a file called `core` in the working directory), without piping it through `systemd-coredump`, set `systemd.coredump.enable` to `false`.
+
+- `systemd.packages` option now also supports generators and shutdown scripts. Old `systemd.generator-packages` option has been removed.
+
+- The `rmilter` package was removed with associated module and options due deprecation by upstream developer. Use `rspamd` in proxy mode instead.
+
+- systemd cgroup accounting via the [systemd.enableCgroupAccounting](options.html#opt-systemd.enableCgroupAccounting) option is now enabled by default. It now also enables the more recent Block IO and IP accounting features.
+
+- We no longer enable custom font rendering settings with `fonts.fontconfig.penultimate.enable` by default. The defaults from fontconfig are sufficient.
+
+- The `crashplan` package and the `crashplan` service have been removed from nixpkgs due to crashplan shutting down the service, while the `crashplansb` package and `crashplan-small-business` service have been removed from nixpkgs due to lack of maintainer.
+
+  The [redis module](options.html#opt-services.redis.enable) was hardcoded to use the `redis` user, `/run/redis` as runtime directory and `/var/lib/redis` as state directory. Note that the NixOS module for Redis now disables kernel support for Transparent Huge Pages (THP), because this features causes major performance problems for Redis, e.g. (https://redis.io/topics/latency).
+
+- Using `fonts.enableDefaultFonts` adds a default emoji font `noto-fonts-emoji`.
+
+  - `services.xserver.enable`
+
+  - `programs.sway.enable`
+
+  - `programs.way-cooler.enable`
+
+  - `services.xrdp.enable`
+
+- The `altcoins` categorization of packages has been removed. You now access these packages at the top level, ie. `nix-shell -p dogecoin` instead of `nix-shell -p altcoins.dogecoin`, etc.
+
+- Ceph has been upgraded to v14.2.1. See the [release notes](https://ceph.com/releases/v14-2-0-nautilus-released/) for details. The mgr dashboard as well as osds backed by loop-devices is no longer explicitly supported by the package and module. Note: There\'s been some issues with python-cherrypy, which is used by the dashboard and prometheus mgr modules (and possibly others), hence 0000-dont-check-cherrypy-version.patch.
+
+- `pkgs.weechat` is now compiled against `pkgs.python3`. Weechat also recommends [to use Python3 in their docs.](https://weechat.org/scripts/python3/)
diff --git a/nixos/doc/manual/release-notes/rl-1909.xml b/nixos/doc/manual/release-notes/rl-1909.xml
deleted file mode 100644
index 0dae49c636f6..000000000000
--- a/nixos/doc/manual/release-notes/rl-1909.xml
+++ /dev/null
@@ -1,902 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-19.09">
- <title>Release 19.09 (“Loris”, 2019/10/09)</title>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-19.09-highlights">
-  <title>Highlights</title>
-
-  <para>
-   In addition to numerous new and upgraded packages, this release has the
-   following highlights:
-  </para>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     End of support is planned for end of April 2020, handing over to 20.03.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Nix has been updated to 2.3; see its
-     <link xlink:href="https://nixos.org/nix/manual/#ssec-relnotes-2.3">release
-     notes</link>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>Core version changes:</para>
-    <para>systemd: 239 -&gt; 243</para>
-    <para>gcc: 7 -&gt; 8</para>
-    <para>glibc: 2.27 (unchanged)</para>
-    <para>linux: 4.19 LTS (unchanged)</para>
-    <para>openssl: 1.0 -&gt; 1.1</para>
-   </listitem>
-   <listitem>
-    <para>Desktop version changes:</para>
-    <para>plasma5: 5.14 -&gt; 5.16</para>
-    <para>gnome3: 3.30 -&gt; 3.32</para>
-   </listitem>
-   <listitem>
-    <para>
-     PHP now defaults to PHP 7.3, updated from 7.2.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     PHP 7.1 is no longer supported due to upstream not supporting this version for the entire lifecycle of the 19.09 release.
-    </para>
-   </listitem>
-   <listitem>
-     <para>
-       The binfmt module is now easier to use. Additional systems can
-       be added through <option>boot.binfmt.emulatedSystems</option>.
-       For instance, <literal>boot.binfmt.emulatedSystems = [
-       "wasm32-wasi" "x86_64-windows" "aarch64-linux" ];</literal> will
-       set up binfmt interpreters for each of those listed systems.
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-     The installer now uses a less privileged <literal>nixos</literal> user whereas before we logged in as root.
-     To gain root privileges use <literal>sudo -i</literal> without a password.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      We've updated to Xfce 4.14, which brings a new module <option>services.xserver.desktopManager.xfce4-14</option>.
-      If you'd like to upgrade, please switch from the <option>services.xserver.desktopManager.xfce</option> module as it
-      will be deprecated in a future release. They're incompatibilities with the current Xfce module; it doesn't support
-      <option>thunarPlugins</option> and it isn't recommended to use <option>services.xserver.desktopManager.xfce</option>
-      and <option>services.xserver.desktopManager.xfce4-14</option> simultaneously or to downgrade from Xfce 4.14 after upgrading.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      The GNOME 3 desktop manager module sports an interface to enable/disable core services, applications, and optional GNOME packages
-      like games.
-      <itemizedlist>
-      <para>This can be achieved with the following options which the desktop manager default enables, excluding <literal>games</literal>.</para>
-      <listitem><para><option>services.gnome3.core-os-services.enable</option></para></listitem>
-      <listitem><para><option>services.gnome3.core-shell.enable</option></para></listitem>
-      <listitem><para><option>services.gnome3.core-utilities.enable</option></para></listitem>
-      <listitem><para><option>services.gnome3.games.enable</option></para></listitem>
-      </itemizedlist>
-      With these options we hope to give users finer grained control over their systems. Prior to this change you'd either have to manually
-      disable options or use <option>environment.gnome3.excludePackages</option> which only excluded the optional applications.
-      <option>environment.gnome3.excludePackages</option> is now unguarded, it can exclude any package installed with <option>environment.systemPackages</option>
-      in the GNOME 3 module.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Orthogonal to the previous changes to the GNOME 3 desktop manager module, we've updated all default services and applications
-     to match as close as possible to a default reference GNOME 3 experience.
-    </para>
-
-    <bridgehead>The following changes were enacted in <option>services.gnome3.core-utilities.enable</option></bridgehead>
-
-    <itemizedlist>
-     <title>Applications removed from defaults:</title>
-     <listitem><para><literal>accerciser</literal></para></listitem>
-     <listitem><para><literal>dconf-editor</literal></para></listitem>
-     <listitem><para><literal>evolution</literal></para></listitem>
-     <listitem><para><literal>gnome-documents</literal></para></listitem>
-     <listitem><para><literal>gnome-nettool</literal></para></listitem>
-     <listitem><para><literal>gnome-power-manager</literal></para></listitem>
-     <listitem><para><literal>gnome-todo</literal></para></listitem>
-     <listitem><para><literal>gnome-tweaks</literal></para></listitem>
-     <listitem><para><literal>gnome-usage</literal></para></listitem>
-     <listitem><para><literal>gucharmap</literal></para></listitem>
-     <listitem><para><literal>nautilus-sendto</literal></para></listitem>
-     <listitem><para><literal>vinagre</literal></para></listitem>
-    </itemizedlist>
-    <itemizedlist>
-     <title>Applications added to defaults:</title>
-     <listitem><para><literal>cheese</literal></para></listitem>
-     <listitem><para><literal>geary</literal></para></listitem>
-    </itemizedlist>
-
-    <bridgehead>The following changes were enacted in <option>services.gnome3.core-shell.enable</option></bridgehead>
-
-    <itemizedlist>
-     <title>Applications added to defaults:</title>
-     <listitem><para><literal>gnome-color-manager</literal></para></listitem>
-     <listitem><para><literal>orca</literal></para></listitem>
-    </itemizedlist>
-    <itemizedlist>
-     <title>Services enabled:</title>
-     <listitem><para><option>services.avahi.enable</option></para></listitem>
-    </itemizedlist>
-   </listitem>
-  </itemizedlist>
- </section>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-19.09-new-services">
-  <title>New Services</title>
-
-  <para>
-   The following new services were added since the last release:
-  </para>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     <literal>./programs/dwm-status.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The new <varname>hardware.printers</varname> module allows to declaratively configure CUPS printers
-     via the <varname>ensurePrinters</varname> and
-     <varname>ensureDefaultPrinter</varname> options.
-     <varname>ensurePrinters</varname> will never delete existing printers,
-     but will make sure that the given printers are configured as declared.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     There is a new <xref linkend="opt-services.system-config-printer.enable"/> and <xref linkend="opt-programs.system-config-printer.enable"/> module
-     for the program of the same name. If you previously had <literal>system-config-printer</literal> enabled through some other
-     means you should migrate to using one of these modules.
-    </para>
-    <itemizedlist>
-     <para>If you're a user of the following desktopManager modules no action is needed:</para>
-     <listitem>
-      <para><option>services.xserver.desktopManager.plasma5</option></para>
-     </listitem>
-     <listitem>
-      <para><option>services.xserver.desktopManager.gnome3</option></para>
-     </listitem>
-     <listitem>
-      <para><option>services.xserver.desktopManager.pantheon</option></para>
-     </listitem>
-     <listitem>
-      <para><option>services.xserver.desktopManager.mate</option></para>
-      <para>
-       Note Mate uses <literal>programs.system-config-printer</literal> as it doesn't
-       use it as a service, but its graphical interface directly.
-      </para>
-     </listitem>
-    </itemizedlist>
-   </listitem>
-   <listitem>
-    <para>
-     <xref linkend="opt-services.blueman.enable"/> has been added.
-     If you previously had blueman installed via <option>environment.systemPackages</option> please
-     migrate to using the NixOS module, as this would result in an insufficiently configured blueman.
-    </para>
-   </listitem>
-  </itemizedlist>
-
- </section>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-19.09-incompatibilities">
-  <title>Backward Incompatibilities</title>
-
-  <para>
-   When upgrading from a previous release, please be aware of the following
-   incompatible changes:
-  </para>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     Buildbot no longer supports Python 2, as support was dropped upstream in
-     version 2.0.0. Configurations may need to be modified to make them
-     compatible with Python 3.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     PostgreSQL now uses
-     <filename class="directory">/run/postgresql</filename> as its socket
-     directory instead of <filename class="directory">/tmp</filename>. So
-     if you run an application like eg. Nextcloud, where you need to use
-     the Unix socket path as the database host name, you need to change it
-     accordingly.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     PostgreSQL 9.4 is scheduled EOL during the 19.09 life cycle and has been removed.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The options <option>services.prometheus.alertmanager.user</option> and
-     <option>services.prometheus.alertmanager.group</option> have been removed
-     because the alertmanager service is now using systemd's <link
-     xlink:href="http://0pointer.net/blog/dynamic-users-with-systemd.html">
-     DynamicUser mechanism</link> which obviates these options.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The NetworkManager systemd unit was renamed back from network-manager.service to
-     NetworkManager.service for better compatibility with other applications expecting this name.
-     The same applies to ModemManager where modem-manager.service is now called ModemManager.service again.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <option>services.nzbget.configFile</option> and <option>services.nzbget.openFirewall</option>
-     options were removed as they are managed internally by the nzbget. The
-     <option>services.nzbget.dataDir</option> option hadn't actually been used by
-     the module for some time and so was removed as cleanup.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <option>services.mysql.pidDir</option> option was removed, as it was only used by the wordpress
-     apache-httpd service to wait for mysql to have started up.
-     This can be accomplished by either describing a dependency on mysql.service (preferred)
-     or waiting for the (hardcoded) <filename>/run/mysqld/mysql.sock</filename> file to appear.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <option>services.emby.enable</option> module has been removed, see
-     <option>services.jellyfin.enable</option> instead for a free software fork of Emby.
-
-     See the Jellyfin documentation:
-     <link xlink:href="https://jellyfin.readthedocs.io/en/latest/administrator-docs/migrate-from-emby/">
-       Migrating from Emby to Jellyfin
-     </link>
-    </para>
-   </listitem>
-   <listitem>
-     <para>
-     IPv6 Privacy Extensions are now enabled by default for undeclared
-     interfaces. The previous behaviour was quite misleading — even though
-     the default value for
-     <option>networking.interfaces.*.preferTempAddress</option> was
-     <literal>true</literal>, undeclared interfaces would not prefer temporary
-     addresses. Now, interfaces not mentioned in the config will prefer
-     temporary addresses. EUI64 addresses can still be set as preferred by
-     explicitly setting the option to <literal>false</literal> for the
-     interface in question.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Since Bittorrent Sync was superseded by Resilio Sync in 2016, the
-     <literal>bittorrentSync</literal>, <literal>bittorrentSync14</literal>,
-     and <literal>bittorrentSync16</literal> packages have been removed in
-     favor of <literal>resilio-sync</literal>.
-    </para>
-    <para>
-     The corresponding module, <option>services.btsync</option> has been
-     replaced by the <option>services.resilio</option> module.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The httpd service no longer attempts to start the postgresql service. If you have come to depend
-     on this behaviour then you can preserve the behavior with the following configuration:
-     <literal>systemd.services.httpd.after = [ "postgresql.service" ];</literal>
-    </para>
-    <para>
-     The option <option>services.httpd.extraSubservices</option> has been
-     marked as deprecated. You may still use this feature, but it will be
-     removed in a future release of NixOS. You are encouraged to convert any
-     httpd subservices you may have written to a full NixOS module.
-    </para>
-    <para>
-     Most of the httpd subservices packaged with NixOS have been replaced with
-     full NixOS modules including LimeSurvey, WordPress, and Zabbix. These
-     modules can be enabled using the <option>services.limesurvey.enable</option>,
-     <option>services.mediawiki.enable</option>, <option>services.wordpress.enable</option>,
-     and <option>services.zabbixWeb.enable</option> options.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The option <option>systemd.network.networks.&lt;name&gt;.routes.*.routeConfig.GatewayOnlink</option>
-     was renamed to <option>systemd.network.networks.&lt;name&gt;.routes.*.routeConfig.GatewayOnLink</option>
-     (capital <literal>L</literal>). This follows
-     <link xlink:href="https://github.com/systemd/systemd/commit/9cb8c5593443d24c19e40bfd4fc06d672f8c554c">
-      upstreams renaming
-     </link> of the setting.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     As of this release the NixOps feature <literal>autoLuks</literal> is deprecated. It no longer works
-     with our systemd version without manual intervention.
-    </para>
-    <para>
-     Whenever the usage of the module is detected the evaluation will fail with a message
-     explaining why and how to deal with the situation.
-    </para>
-    <para>
-     A new knob named <literal>nixops.enableDeprecatedAutoLuks</literal>
-     has been introduced to disable the eval failure and to acknowledge the notice was received and read.
-     If you plan on using the feature please note that it might break with subsequent updates.
-    </para>
-    <para>
-     Make sure you set the <literal>_netdev</literal> option for each of the file systems referring to block
-     devices provided by the autoLuks module. Not doing this might render the system in a
-     state where it doesn't boot anymore.
-    </para>
-    <para>
-     If you are actively using the <literal>autoLuks</literal> module please let us know in
-     <link xlink:href="https://github.com/NixOS/nixpkgs/issues/62211">issue #62211</link>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The setopt declarations will be evaluated at the end of <literal>/etc/zshrc</literal>, so any code in <xref linkend="opt-programs.zsh.interactiveShellInit" />,
-     <xref linkend="opt-programs.zsh.loginShellInit" /> and <xref linkend="opt-programs.zsh.promptInit" /> may break if it relies on those options being set.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      The <literal>prometheus-nginx-exporter</literal> package now uses the offical exporter provided by NGINX Inc.
-      Its metrics are differently structured and are incompatible to the old ones. For information about the metrics,
-      have a look at the <link xlink:href="https://github.com/nginxinc/nginx-prometheus-exporter">official repo</link>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>shibboleth-sp</literal> package has been updated to version 3.
-     It is largely backward compatible, for further information refer to the
-     <link xlink:href="https://wiki.shibboleth.net/confluence/display/SP3/ReleaseNotes">release notes</link>
-     and <link xlink:href="https://wiki.shibboleth.net/confluence/display/SP3/UpgradingFromV2">upgrade guide</link>.
-    </para>
-     <para>
-       Nodejs 8 is scheduled EOL under the lifetime of 19.09 and has been dropped.
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       By default, prometheus exporters are now run with <literal>DynamicUser</literal> enabled.
-       Exporters that need a real user, now run under a seperate user and group which follow the pattern <literal>&lt;exporter-name&gt;-exporter</literal>, instead of the previous default <literal>nobody</literal> and <literal>nogroup</literal>.
-       Only some exporters are affected by the latter, namely the exporters <literal>dovecot</literal>, <literal>node</literal>, <literal>postfix</literal> and <literal>varnish</literal>.
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       The <literal>ibus-qt</literal> package is not installed by default anymore when <xref linkend="opt-i18n.inputMethod.enabled" /> is set to <literal>ibus</literal>.
-       If IBus support in Qt 4.x applications is required, add the <literal>ibus-qt</literal> package to your <xref linkend="opt-environment.systemPackages" /> manually.
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       The CUPS Printing service now uses socket-based activation by
-       default, only starting when needed. The previous behavior can
-       be restored by setting
-       <option>services.cups.startWhenNeeded</option> to
-       <literal>false</literal>.
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       The <option>services.systemhealth</option> module has been removed from nixpkgs due to lack of maintainer.
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       The <option>services.mantisbt</option> module has been removed from nixpkgs due to lack of maintainer.
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       Squid 3 has been removed and the <option>squid</option> derivation now refers to Squid 4.
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       The <option>services.pdns-recursor.extraConfig</option> option has been replaced by
-       <option>services.pdns-recursor.settings</option>. The new option allows setting extra
-       configuration while being better type-checked and mergeable.
-     </para>
-   </listitem>
-   <listitem>
-    <para>
-     No service depends on <literal>keys.target</literal> anymore which is a systemd
-     target that indicates if all <link xlink:href="https://nixos.org/nixops/manual/#idm140737322342384">NixOps keys</link> were successfully uploaded.
-     Instead, <literal>&lt;key-name&gt;-key.service</literal> should be used to define
-     a dependency of a key in a service. The full issue behind the <literal>keys.target</literal>
-     dependency is described at <link xlink:href="https://github.com/NixOS/nixpkgs/issues/67265">NixOS/nixpkgs#67265</link>.
-    </para>
-    <para>
-     The following services are affected by this:
-     <itemizedlist>
-      <listitem><para><link linkend="opt-services.dovecot2.enable"><literal>services.dovecot2</literal></link></para></listitem>
-      <listitem><para><link linkend="opt-services.nsd.enable"><literal>services.nsd</literal></link></para></listitem>
-      <listitem><para><link linkend="opt-services.softether.enable"><literal>services.softether</literal></link></para></listitem>
-      <listitem><para><link linkend="opt-services.strongswan.enable"><literal>services.strongswan</literal></link></para></listitem>
-      <listitem><para><link linkend="opt-services.strongswan-swanctl.enable"><literal>services.strongswan-swanctl</literal></link></para></listitem>
-      <listitem><para><link linkend="opt-services.httpd.enable"><literal>services.httpd</literal></link></para></listitem>
-     </itemizedlist>
-    </para>
-   </listitem>
-   <listitem>
-     <para>
-       The <option>security.acme.directory</option> option has been replaced by a read-only <option>security.acme.certs.&lt;cert&gt;.directory</option> option for each certificate you define. This will be
-       a subdirectory of <literal>/var/lib/acme</literal>. You can use this read-only option to figure out where the certificates are stored for a specific certificate. For example,
-       the <option>services.nginx.virtualhosts.&lt;name&gt;.enableACME</option>  option will use this directory option to find the certs for the virtual host.
-     </para>
-     <para>
-       <option>security.acme.preDelay</option> and <option>security.acme.activationDelay</option> options have been removed. To execute a service before certificates
-       are provisioned or renewed add a <literal>RequiredBy=acme-${cert}.service</literal> to any service.
-     </para>
-     <para>
-       Furthermore, the acme module will not automatically add a dependency on <literal>lighttpd.service</literal> anymore. If you are using certficates provided by letsencrypt
-       for lighttpd, then you should depend on the certificate service <literal>acme-${cert}.service></literal> manually.
-     </para>
-     <para>
-       For nginx, the dependencies are still automatically managed when <option>services.nginx.virtualhosts.&lt;name&gt;.enableACME</option> is enabled just like before. What changed is that nginx now directly depends on the specific certificates that it needs,
-       instead of depending on the catch-all <literal>acme-certificates.target</literal>. This target unit was also removed from the codebase.
-       This will mean nginx will no longer depend on certificates it isn't explicitly managing and fixes a bug with certificate renewal
-       ordering racing with nginx restarting which could lead to nginx getting in a broken state as described at
-        <link xlink:href="https://github.com/NixOS/nixpkgs/issues/60180">NixOS/nixpkgs#60180</link>.
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       The old deprecated <literal>emacs</literal> package sets have been dropped.
-       What used to be called <literal>emacsPackagesNg</literal> is now simply called <literal>emacsPackages</literal>.
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <option>services.xserver.desktopManager.xterm</option> is now disabled by default if <literal>stateVersion</literal> is 19.09 or higher.
-       Previously the xterm desktopManager was enabled when xserver was enabled, but it isn't useful for all people so it didn't make sense to
-       have any desktopManager enabled default.
-     </para>
-   </listitem>
-   <listitem>
-    <para>
-     The WeeChat plugin <literal>pkgs.weechatScripts.weechat-xmpp</literal> has been removed as it doesn't receive
-     any updates from upstream and depends on outdated Python2-based modules.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Old unsupported versions (<literal>logstash5</literal>,
-     <literal>kibana5</literal>,
-     <literal>filebeat5</literal>,
-     <literal>heartbeat5</literal>,
-     <literal>metricbeat5</literal>,
-     <literal>packetbeat5</literal>) of the ELK-stack and Elastic beats have been removed.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     For NixOS 19.03, both Prometheus 1 and 2 were available to allow for
-     a seamless transition from version 1 to 2 with existing setups.
-     Because Prometheus 1 is no longer developed, it was removed.
-     Prometheus 2 is now configured with <literal>services.prometheus</literal>.
-    </para>
-   </listitem>
-   <listitem>
-     <para>
-       Citrix Receiver (<literal>citrix_receiver</literal>) has been dropped in favor of Citrix Workspace
-       (<literal>citrix_workspace</literal>).
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       The <literal>services.gitlab</literal> module has had its literal secret options (<option>services.gitlab.smtp.password</option>,
-       <option>services.gitlab.databasePassword</option>,
-       <option>services.gitlab.initialRootPassword</option>,
-       <option>services.gitlab.secrets.secret</option>,
-       <option>services.gitlab.secrets.db</option>,
-       <option>services.gitlab.secrets.otp</option> and
-       <option>services.gitlab.secrets.jws</option>) replaced by file-based versions (<option>services.gitlab.smtp.passwordFile</option>,
-       <option>services.gitlab.databasePasswordFile</option>,
-       <option>services.gitlab.initialRootPasswordFile</option>,
-       <option>services.gitlab.secrets.secretFile</option>,
-       <option>services.gitlab.secrets.dbFile</option>,
-       <option>services.gitlab.secrets.otpFile</option> and
-       <option>services.gitlab.secrets.jwsFile</option>). This was done so that secrets aren't stored
-       in the world-readable nix store, but means that for each option you'll have to create a file with
-       the same exact string, add "File" to the end of the option name, and change the definition to a
-       string pointing to the corresponding file; e.g. <literal>services.gitlab.databasePassword = "supersecurepassword"</literal>
-       becomes <literal>services.gitlab.databasePasswordFile = "/path/to/secret_file"</literal> where the
-       file <literal>secret_file</literal> contains the string <literal>supersecurepassword</literal>.
-     </para>
-     <para>
-       The state path (<option>services.gitlab.statePath</option>) now has the following restriction:
-       no parent directory can be owned by any other user than <literal>root</literal> or the user
-       specified in <option>services.gitlab.user</option>; i.e. if <option>services.gitlab.statePath</option>
-       is set to <literal>/var/lib/gitlab/state</literal>, <literal>gitlab</literal> and all parent directories
-       must be owned by either <literal>root</literal> or the user specified in <option>services.gitlab.user</option>.
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-      The <option>networking.useDHCP</option> option is unsupported in combination with
-      <option>networking.useNetworkd</option> in anticipation of defaulting to it.
-      It has to be set to <literal>false</literal> and enabled per
-      interface with <option>networking.interfaces.&lt;name&gt;.useDHCP = true;</option>
-    </para>
-   </listitem>
-   <listitem>
-     <para>
-       The Twitter client <literal>corebird</literal> has been dropped as <link xlink:href="https://www.patreon.com/posts/corebirds-future-18921328">it is discontinued and does not work against the new Twitter API</link>.
-       Please use the fork <literal>cawbird</literal> instead which has been adapted to the API changes and is still maintained.
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-      The <literal>nodejs-11_x</literal> package has been removed as it's EOLed by upstream.
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       Because of the systemd upgrade,
-       <application>systemd-timesyncd</application> will no longer work if
-       <option>system.stateVersion</option> is not set correctly. When
-       upgrading from NixOS 19.03, please make sure that
-       <option>system.stateVersion</option> is set to
-       <literal>"19.03"</literal>, or lower if the installation dates back to an
-       earlier version of NixOS.
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       Due to the short lifetime of non-LTS kernel releases package attributes like <literal>linux_5_1</literal>,
-       <literal>linux_5_2</literal> and <literal>linux_5_3</literal> have been removed to discourage dependence
-       on specific non-LTS kernel versions in stable NixOS releases.
-
-       Going forward, versioned attributes like <literal>linux_4_9</literal> will exist for LTS versions only.
-       Please use <literal>linux_latest</literal> or <literal>linux_testing</literal> if you depend on non-LTS
-       releases. Keep in mind that <literal>linux_latest</literal> and <literal>linux_testing</literal> will
-       change versions under the hood during the lifetime of a stable release and might include breaking changes.
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       Because of the systemd upgrade,
-       some network interfaces might change their name. For details see
-       <link xlink:href="https://www.freedesktop.org/software/systemd/man/systemd.net-naming-scheme.html#History">
-       upstream docs</link> or <link xlink:href="https://github.com/NixOS/nixpkgs/issues/71086">
-       our ticket</link>.
-     </para>
-   </listitem>
-  </itemizedlist>
- </section>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-19.09-notable-changes">
-  <title>Other Notable Changes</title>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     The <option>documentation</option> module gained an option named
-     <option>documentation.nixos.includeAllModules</option> which makes the
-     generated <citerefentry>
-     <refentrytitle>configuration.nix</refentrytitle>
-     <manvolnum>5</manvolnum></citerefentry> manual page include all options
-     from all NixOS modules included in a given
-     <literal>configuration.nix</literal> configuration file. Currently, it is
-     set to <literal>false</literal> by default as enabling it frequently
-     prevents evaluation. But the plan is to eventually have it set to
-     <literal>true</literal> by default. Please set it to
-     <literal>true</literal> now in your <literal>configuration.nix</literal>
-     and fix all the bugs it uncovers.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>vlc</literal> package gained support for Chromecast
-     streaming, enabled by default. TCP port 8010 must be open for it to work,
-     so something like <literal>networking.firewall.allowedTCPPorts = [ 8010
-     ];</literal> may be required in your configuration. Also consider enabling
-     <link xlink:href="https://nixos.wiki/wiki/Accelerated_Video_Playback">
-     Accelerated Video Playback</link> for better transcoding performance.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The following changes apply if the <literal>stateVersion</literal> is
-     changed to 19.09 or higher. For <literal>stateVersion = "19.03"</literal>
-     or lower the old behavior is preserved.
-    </para>
-    <itemizedlist>
-     <listitem>
-      <para>
-       <literal>solr.package</literal> defaults to
-       <literal>pkgs.solr_8</literal>.
-      </para>
-     </listitem>
-    </itemizedlist>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>hunspellDicts.fr-any</literal> dictionary now ships with <literal>fr_FR.{aff,dic}</literal>
-     which is linked to <literal>fr-toutesvariantes.{aff,dic}</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>mysql</literal> service now runs as <literal>mysql</literal>
-     user. Previously, systemd did execute it as root, and mysql dropped privileges
-     itself.
-     This includes <literal>ExecStartPre=</literal> and
-     <literal>ExecStartPost=</literal> phases.
-     To accomplish that, runtime and data directory setup was delegated to
-     RuntimeDirectory and tmpfiles.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     With the upgrade to systemd version 242 the <literal>systemd-timesyncd</literal>
-     service is no longer using <literal>DynamicUser=yes</literal>. In order for the
-     upgrade to work we rely on an activation script to move the state from the old
-     to the new directory. The older directory (prior <literal>19.09</literal>) was
-     <literal>/var/lib/private/systemd/timesync</literal>.
-    </para>
-    <para>
-     As long as the <literal>system.config.stateVersion</literal> is below
-     <literal>19.09</literal> the state folder will migrated to its proper location
-     (<literal>/var/lib/systemd/timesync</literal>), if required.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The package <literal>avahi</literal> is now built to look up service
-     definitions from <literal>/etc/avahi/services</literal> instead of its
-     output directory in the nix store. Accordingly the module
-     <option>avahi</option> now supports custom service definitions via
-     <option>services.avahi.extraServiceFiles</option>, which are then placed
-     in the aforementioned directory. See <citerefentry>
-     <refentrytitle>avahi.service</refentrytitle><manvolnum>5</manvolnum>
-     </citerefentry> for more information on custom service definitions.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Since version 0.1.19, <literal>cargo-vendor</literal> honors package
-     includes that are specified in the <filename>Cargo.toml</filename>
-     file of Rust crates. <literal>rustPlatform.buildRustPackage</literal> uses
-     <literal>cargo-vendor</literal> to collect and build dependent crates.
-     Since this change in <literal>cargo-vendor</literal> changes the set of
-     vendored files for most Rust packages, the hash that use used to verify
-     the dependencies, <literal>cargoSha256</literal>, also changes.
-    </para>
-    <para>
-     The <literal>cargoSha256</literal> hashes of all in-tree derivations that
-     use <literal>buildRustPackage</literal> have been updated to reflect this
-     change. However, third-party derivations that use
-     <literal>buildRustPackage</literal> may have to be updated as well.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>consul</literal> package was upgraded past version <literal>1.5</literal>,
-     so its deprecated legacy UI is no longer available.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The default resample-method for PulseAudio has been changed from the upstream default <literal>speex-float-1</literal>
-     to <literal>speex-float-5</literal>. Be aware that low-powered ARM-based and MIPS-based boards will struggle with this
-     so you'll need to set <option>hardware.pulseaudio.daemon.config.resample-method</option> back to <literal>speex-float-1</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>phabricator</literal> package and associated <literal>httpd.extraSubservice</literal>, as well as the
-     <literal>phd</literal> service have been removed from nixpkgs due to lack of maintainer.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>mercurial</literal> <literal>httpd.extraSubservice</literal> has been removed from nixpkgs due to lack of maintainer.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>trac</literal> <literal>httpd.extraSubservice</literal> has been removed from nixpkgs because it was unmaintained.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>foswiki</literal> package and associated <literal>httpd.extraSubservice</literal> have been removed
-     from nixpkgs due to lack of maintainer.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>tomcat-connector</literal> <literal>httpd.extraSubservice</literal> has been removed from nixpkgs.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     It's now possible to change configuration in
-     <link linkend="opt-services.nextcloud.enable">services.nextcloud</link> after the initial deploy
-     since all config parameters are persisted in an additional config file generated by the module.
-     Previously core configuration like database parameters were set using their imperative
-     installer after creating <literal>/var/lib/nextcloud</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     There exists now <literal>lib.forEach</literal>, which is like <literal>map</literal>, but with
-     arguments flipped. When mapping function body spans many lines (or has nested
-     <literal>map</literal>s), it is often hard to follow which list is modified.
-    </para>
-    <para>
-     Previous solution to this problem was either to use <literal>lib.flip map</literal>
-     idiom or extract that anonymous mapping function to a named one. Both can still be used
-     but <literal>lib.forEach</literal> is preferred over <literal>lib.flip map</literal>.
-    </para>
-    <para>
-      The <literal>/etc/sysctl.d/nixos.conf</literal> file containing all the options set via
-      <link linkend="opt-boot.kernel.sysctl">boot.kernel.sysctl</link> was moved to
-      <literal>/etc/sysctl.d/60-nixos.conf</literal>, as
-      <citerefentry><refentrytitle>sysctl.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>
-      recommends prefixing all filenames in <literal>/etc/sysctl.d</literal> with a
-      two-digit number and a dash to simplify the ordering of the files.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      We now install the sysctl snippets shipped with systemd.
-    <itemizedlist>
-     <para>This enables:</para>
-     <listitem>
-      <para>Loose reverse path filtering</para>
-     </listitem>
-     <listitem>
-      <para>Source route filtering</para>
-     </listitem>
-     <listitem>
-      <para>
-       <literal>fq_codel</literal> as a packet scheduler (this helps to fight bufferbloat)
-      </para>
-     </listitem>
-    </itemizedlist>
-     This also configures the kernel to pass core dumps to <literal>systemd-coredump</literal>,
-     and restricts the SysRq key combinations to the sync command only.
-     These sysctl snippets can be found in <literal>/etc/sysctl.d/50-*.conf</literal>,
-     and overridden via <link linkend="opt-boot.kernel.sysctl">boot.kernel.sysctl</link>
-     (which will place the parameters in <literal>/etc/sysctl.d/60-nixos.conf</literal>).
-     </para>
-   </listitem>
-   <listitem>
-    <para>
-      Core dumps are now processed by <literal>systemd-coredump</literal>
-      by default. <literal>systemd-coredump</literal> behaviour can
-      still be modified via
-      <option>systemd.coredump.extraConfig</option>. To stick to the
-      old behaviour (having the kernel dump to a file called
-      <literal>core</literal> in the working directory), without piping
-      it through <literal>systemd-coredump</literal>, set
-      <option>systemd.coredump.enable</option> to
-      <literal>false</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>systemd.packages</literal> option now also supports generators and
-     shutdown scripts. Old <literal>systemd.generator-packages</literal> option has
-     been removed.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>rmilter</literal> package was removed with associated module and options due deprecation by upstream developer.
-     Use <literal>rspamd</literal> in proxy mode instead.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      systemd cgroup accounting via the
-      <link linkend="opt-systemd.enableCgroupAccounting">systemd.enableCgroupAccounting</link>
-      option is now enabled by default. It now also enables the more recent Block IO and IP accounting
-      features.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     We no longer enable custom font rendering settings with <option>fonts.fontconfig.penultimate.enable</option> by default.
-     The defaults from fontconfig are sufficient.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      The <literal>crashplan</literal> package and the
-      <literal>crashplan</literal> service have been removed from nixpkgs due to
-      crashplan shutting down the service, while the <literal>crashplansb</literal>
-      package and <literal>crashplan-small-business</literal> service have been
-      removed from nixpkgs due to lack of maintainer.
-    </para>
-    <para>
-      The <link linkend="opt-services.redis.enable">redis module</link> was hardcoded to use the <literal>redis</literal> user,
-      <filename class="directory">/run/redis</filename> as runtime directory and
-      <filename class="directory">/var/lib/redis</filename> as state directory.
-      Note that the NixOS module for Redis now disables kernel support for Transparent Huge Pages (THP),
-      because this features causes major performance problems for Redis,
-      e.g. (https://redis.io/topics/latency).
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Using <option>fonts.enableDefaultFonts</option> adds a default emoji font <literal>noto-fonts-emoji</literal>.
-     <itemizedlist>
-      <para>Users of the following options will have this enabled by default:</para>
-      <listitem>
-       <para><option>services.xserver.enable</option></para>
-      </listitem>
-      <listitem>
-       <para><option>programs.sway.enable</option></para>
-      </listitem>
-      <listitem>
-       <para><option>programs.way-cooler.enable</option></para>
-      </listitem>
-      <listitem>
-       <para><option>services.xrdp.enable</option></para>
-      </listitem>
-     </itemizedlist>
-    </para>
-   </listitem>
-   <listitem>
-     <para>
-       The <literal>altcoins</literal> categorization of packages has
-       been removed. You now access these packages at the top level,
-       ie. <literal>nix-shell -p dogecoin</literal> instead of
-       <literal>nix-shell -p altcoins.dogecoin</literal>, etc.
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       Ceph has been upgraded to v14.2.1.
-       See the <link xlink:href="https://ceph.com/releases/v14-2-0-nautilus-released/">release notes</link> for details.
-       The mgr dashboard as well as osds backed by loop-devices is no longer explicitly supported by the package and module.
-       Note: There's been some issues with python-cherrypy, which is used by the dashboard
-       and prometheus mgr modules (and possibly others), hence 0000-dont-check-cherrypy-version.patch.
-     </para>
-    </listitem>
-    <listitem>
-     <para>
-      <literal>pkgs.weechat</literal> is now compiled against <literal>pkgs.python3</literal>.
-      Weechat also recommends <link xlink:href="https://weechat.org/scripts/python3/">to use Python3
-      in their docs.</link>
-     </para>
-    </listitem>
-  </itemizedlist>
- </section>
-</section>
diff --git a/nixos/doc/manual/release-notes/rl-2003.section.md b/nixos/doc/manual/release-notes/rl-2003.section.md
new file mode 100644
index 000000000000..b92c7f6634c7
--- /dev/null
+++ b/nixos/doc/manual/release-notes/rl-2003.section.md
@@ -0,0 +1,507 @@
+# Release 20.03 ("Markhor", 2020.04/20) {#sec-release-20.03}
+
+## Highlights {#sec-release-20.03-highlights}
+
+In addition to numerous new and upgraded packages, this release has the following highlights:
+
+- Support is planned until the end of October 2020, handing over to 20.09.
+
+- Core version changes:
+
+  gcc: 8.3.0 -\> 9.2.0
+
+  glibc: 2.27 -\> 2.30
+
+  linux: 4.19 -\> 5.4
+
+  mesa: 19.1.5 -\> 19.3.3
+
+  openssl: 1.0.2u -\> 1.1.1d
+
+- Desktop version changes:
+
+  plasma5: 5.16.5 -\> 5.17.5
+
+  kdeApplications: 19.08.2 -\> 19.12.3
+
+  gnome3: 3.32 -\> 3.34
+
+  pantheon: 5.0 -\> 5.1.3
+
+- Linux kernel is updated to branch 5.4 by default (from 4.19).
+
+- Grub is updated to 2.04, adding support for booting from F2FS filesystems and Btrfs volumes using zstd compression. Note that some users have been unable to boot after upgrading to 2.04 - for more information, please see [this discussion](https://github.com/NixOS/nixpkgs/issues/61718#issuecomment-617618503).
+
+- Postgresql for NixOS service now defaults to v11.
+
+- The graphical installer image starts the graphical session automatically. Before you\'d be greeted by a tty and asked to enter `systemctl start display-manager`. It is now possible to disable the display-manager from running by selecting the `Disable display-manager` quirk in the boot menu.
+
+- GNOME 3 has been upgraded to 3.34. Please take a look at their [Release Notes](https://help.gnome.org/misc/release-notes/3.34) for details.
+
+- If you enable the Pantheon Desktop Manager via [services.xserver.desktopManager.pantheon.enable](options.html#opt-services.xserver.desktopManager.pantheon.enable), we now default to also use [ Pantheon\'s newly designed greeter ](https://blog.elementary.io/say-hello-to-the-new-greeter/). Contrary to NixOS\'s usual update policy, Pantheon will receive updates during the cycle of NixOS 20.03 when backwards compatible.
+
+- By default zfs pools will now be trimmed on a weekly basis. Trimming is only done on supported devices (i.e. NVME or SSDs) and should improve throughput and lifetime of these devices. It is controlled by the `services.zfs.trim.enable` varname. The zfs scrub service (`services.zfs.autoScrub.enable`) and the zfs autosnapshot service (`services.zfs.autoSnapshot.enable`) are now only enabled if zfs is set in `config.boot.initrd.supportedFilesystems` or `config.boot.supportedFilesystems`. These lists will automatically contain zfs as soon as any zfs mountpoint is configured in `fileSystems`.
+
+- `nixos-option` has been rewritten in C++, speeding it up, improving correctness, and adding a `-r` option which prints all options and their values recursively.
+
+- `services.xserver.desktopManager.default` and `services.xserver.windowManager.default` options were replaced by a single [services.xserver.displayManager.defaultSession](options.html#opt-services.xserver.displayManager.defaultSession) option to improve support for upstream session files. If you used something like:
+
+  ```nix
+  {
+    services.xserver.desktopManager.default = "xfce";
+    services.xserver.windowManager.default = "icewm";
+  }
+  ```
+
+  you should change it to:
+
+  ```nix
+  {
+    services.xserver.displayManager.defaultSession = "xfce+icewm";
+  }
+  ```
+
+- The testing driver implementation in NixOS is now in Python `make-test-python.nix`. This was done by Jacek Galowicz ([\@tfc](https://github.com/tfc)), and with the collaboration of Julian Stecklina ([\@blitz](https://github.com/blitz)) and Jana Traue ([\@jtraue](https://github.com/jtraue)). All documentation has been updated to use this testing driver, and a vast majority of the 286 tests in NixOS were ported to python driver. In 20.09 the Perl driver implementation, `make-test.nix`, is slated for removal. This should give users of the NixOS integration framework a transitory period to rewrite their tests to use the Python implementation. Users of the Perl driver will see this warning everytime they use it:
+
+  ```ShellSession
+  $ warning: Perl VM tests are deprecated and will be removed for 20.09.
+  Please update your tests to use the python test driver.
+  See https://github.com/NixOS/nixpkgs/pull/71684 for details.
+  ```
+
+  API compatibility is planned to be kept for at least the next release with the perl driver.
+
+## New Services {#sec-release-20.03-new-services}
+
+The following new services were added since the last release:
+
+- The kubernetes kube-proxy now supports a new hostname configuration `services.kubernetes.proxy.hostname` which has to be set if the hostname of the node should be non default.
+
+- UPower\'s configuration is now managed by NixOS and can be customized via `services.upower`.
+
+- To use Geary you should enable [programs.geary.enable](options.html#opt-programs.geary.enable) instead of just adding it to [environment.systemPackages](options.html#opt-environment.systemPackages). It was created so Geary could function properly outside of GNOME.
+
+- `./config/console.nix`
+
+- `./hardware/brillo.nix`
+
+- `./hardware/tuxedo-keyboard.nix`
+
+- `./programs/bandwhich.nix`
+
+- `./programs/bash-my-aws.nix`
+
+- `./programs/liboping.nix`
+
+- `./programs/traceroute.nix`
+
+- `./services/backup/sanoid.nix`
+
+- `./services/backup/syncoid.nix`
+
+- `./services/backup/zfs-replication.nix`
+
+- `./services/continuous-integration/buildkite-agents.nix`
+
+- `./services/databases/victoriametrics.nix`
+
+- `./services/desktops/gnome3/gnome-initial-setup.nix`
+
+- `./services/desktops/neard.nix`
+
+- `./services/games/openarena.nix`
+
+- `./services/hardware/fancontrol.nix`
+
+- `./services/mail/sympa.nix`
+
+- `./services/misc/freeswitch.nix`
+
+- `./services/misc/mame.nix`
+
+- `./services/monitoring/do-agent.nix`
+
+- `./services/monitoring/prometheus/xmpp-alerts.nix`
+
+- `./services/network-filesystems/orangefs/server.nix`
+
+- `./services/network-filesystems/orangefs/client.nix`
+
+- `./services/networking/3proxy.nix`
+
+- `./services/networking/corerad.nix`
+
+- `./services/networking/go-shadowsocks2.nix`
+
+- `./services/networking/ntp/openntpd.nix`
+
+- `./services/networking/shorewall.nix`
+
+- `./services/networking/shorewall6.nix`
+
+- `./services/networking/spacecookie.nix`
+
+- `./services/networking/trickster.nix`
+
+- `./services/networking/v2ray.nix`
+
+- `./services/networking/xandikos.nix`
+
+- `./services/networking/yggdrasil.nix`
+
+- `./services/web-apps/dokuwiki.nix`
+
+- `./services/web-apps/gotify-server.nix`
+
+- `./services/web-apps/grocy.nix`
+
+- `./services/web-apps/ihatemoney`
+
+- `./services/web-apps/moinmoin.nix`
+
+- `./services/web-apps/trac.nix`
+
+- `./services/web-apps/trilium.nix`
+
+- `./services/web-apps/shiori.nix`
+
+- `./services/web-servers/ttyd.nix`
+
+- `./services/x11/picom.nix`
+
+- `./services/x11/hardware/digimend.nix`
+
+- `./services/x11/imwheel.nix`
+
+- `./virtualisation/cri-o.nix`
+
+## Backward Incompatibilities {#sec-release-20.03-incompatibilities}
+
+When upgrading from a previous release, please be aware of the following incompatible changes:
+
+- The dhcpcd package [ does not request IPv4 addresses for tap and bridge interfaces anymore by default](https://roy.marples.name/archives/dhcpcd-discuss/0002621.html). In order to still get an address on a bridge interface, one has to disable `networking.useDHCP` and explicitly enable `networking.interfaces.<name>.useDHCP` on every interface, that should get an address via DHCP. This way, dhcpcd is configured in an explicit way about which interface to run on.
+
+- GnuPG is now built without support for a graphical passphrase entry by default. Please enable the `gpg-agent` user service via the NixOS option `programs.gnupg.agent.enable`. Note that upstream recommends using `gpg-agent` and will spawn a `gpg-agent` on the first invocation of GnuPG anyway.
+
+- The `dynamicHosts` option has been removed from the [NetworkManager](options.html#opt-networking.networkmanager.enable) module. Allowing (multiple) regular users to override host entries affecting the whole system opens up a huge attack vector. There seem to be very rare cases where this might be useful. Consider setting system-wide host entries using [networking.hosts](options.html#opt-networking.hosts), provide them via the DNS server in your network, or use [environment.etc](options.html#opt-environment.etc) to add a file into `/etc/NetworkManager/dnsmasq.d` reconfiguring `hostsdir`.
+
+- The `99-main.network` file was removed. Matching all network interfaces caused many breakages, see [\#18962](https://github.com/NixOS/nixpkgs/pull/18962) and [\#71106](https://github.com/NixOS/nixpkgs/pull/71106).
+
+  We already don\'t support the global [networking.useDHCP](options.html#opt-networking.useDHCP), [networking.defaultGateway](options.html#opt-networking.defaultGateway) and [networking.defaultGateway6](options.html#opt-networking.defaultGateway6) options if [networking.useNetworkd](options.html#opt-networking.useNetworkd) is enabled, but direct users to configure the per-device [networking.interfaces.\<name\>....](options.html#opt-networking.interfaces) options.
+
+- The stdenv now runs all bash with `set -u`, to catch the use of undefined variables. Before, it itself used `set -u` but was careful to unset it so other packages\' code ran as before. Now, all bash code is held to the same high standard, and the rather complex stateful manipulation of the options can be discarded.
+
+- The SLIM Display Manager has been removed, as it has been unmaintained since 2013. Consider migrating to a different display manager such as LightDM (current default in NixOS), SDDM, GDM, or using the startx module which uses Xinitrc.
+
+- The Way Cooler wayland compositor has been removed, as the project has been officially canceled. There are no more `way-cooler` attribute and `programs.way-cooler` options.
+
+- The BEAM package set has been deleted. You will only find there the different interpreters. You should now use the different build tools coming with the languages with sandbox mode disabled.
+
+- There is now only one Xfce package-set and module. This means that attributes `xfce4-14` and `xfceUnstable` all now point to the latest Xfce 4.14 packages. And in the future NixOS releases will be the latest released version of Xfce available at the time of the release\'s development (if viable).
+
+- The [phpfpm](options.html#opt-services.phpfpm.pools) module now sets `PrivateTmp=true` in its systemd units for better process isolation. If you rely on `/tmp` being shared with other services, explicitly override this by setting `serviceConfig.PrivateTmp` to `false` for each phpfpm unit.
+
+- KDE's old multimedia framework Phonon no longer supports Qt 4. For that reason, Plasma desktop also does not have `enableQt4Support` option any more.
+
+- The BeeGFS module has been removed.
+
+- The osquery module has been removed.
+
+- Going forward, `~/bin` in the users home directory will no longer be in `PATH` by default. If you depend on this you should set the option `environment.homeBinInPath` to `true`. The aforementioned option was added this release.
+
+- The `buildRustCrate` infrastructure now produces `lib` outputs in addition to the `out` output. This has led to drastically reduced closure sizes for some rust crates since development dependencies are now in the `lib` output.
+
+- Pango was upgraded to 1.44, which no longer uses freetype for font loading. This means that type1 and bitmap fonts are no longer supported in applications relying on Pango for font rendering (notably, GTK application). See [ upstream issue](https://gitlab.gnome.org/GNOME/pango/issues/386) for more information.
+
+- The `roundcube` module has been hardened.
+
+  - The password of the database is not written world readable in the store any more. If `database.host` is set to `localhost`, then a unix user of the same name as the database will be created and PostreSQL peer authentication will be used, removing the need for a password. Otherwise, a password is still needed and can be provided with the new option `database.passwordFile`, which should be set to the path of a file containing the password and readable by the user `nginx` only. The `database.password` option is insecure and deprecated. Usage of this option will print a warning.
+
+  - A random `des_key` is set by default in the configuration of roundcube, instead of using the hardcoded and insecure default. To ensure a clean migration, all users will be logged out when you upgrade to this release.
+
+- The packages `openobex` and `obexftp` are no longer installed when enabling Bluetooth via `hardware.bluetooth.enable`.
+
+- The `dump1090` derivation has been changed to use FlightAware\'s dump1090 as its upstream. However, this version does not have an internal webserver anymore. The assets in the `share/dump1090` directory of the derivation can be used in conjunction with an external webserver to replace this functionality.
+
+- The fourStore and fourStoreEndpoint modules have been removed.
+
+- Polkit no longer has the user of uid 0 (root) as an admin identity. We now follow the upstream default of only having every member of the wheel group admin privileged. Before it was root and members of wheel. The positive outcome of this is pkexec GUI popups or terminal prompts will no longer require the user to choose between two essentially equivalent choices (whether to perform the action as themselves with wheel permissions, or as the root user).
+
+- NixOS containers no longer build NixOS manual by default. This saves evaluation time, especially if there are many declarative containers defined. Note that this is already done when `<nixos/modules/profiles/minimal.nix>` module is included in container config.
+
+- The `kresd` services deprecates the `interfaces` option in favor of the `listenPlain` option which requires full [systemd.socket compatible](https://www.freedesktop.org/software/systemd/man/systemd.socket.html#ListenStream=) declaration which always include a port.
+
+- Virtual console options have been reorganized and can be found under a single top-level attribute: `console`. The full set of changes is as follows:
+
+  - `i18n.consoleFont` renamed to [console.font](options.html#opt-console.font)
+
+  - `i18n.consoleKeyMap` renamed to [console.keyMap](options.html#opt-console.keyMap)
+
+  - `i18n.consoleColors` renamed to [console.colors](options.html#opt-console.colors)
+
+  - `i18n.consolePackages` renamed to [console.packages](options.html#opt-console.packages)
+
+  - `i18n.consoleUseXkbConfig` renamed to [console.useXkbConfig](options.html#opt-console.useXkbConfig)
+
+  - `boot.earlyVconsoleSetup` renamed to [console.earlySetup](options.html#opt-console.earlySetup)
+
+  - `boot.extraTTYs` renamed to `console.extraTTYs`.
+
+- The [awstats](options.html#opt-services.awstats.enable) module has been rewritten to serve stats via static html pages, updated on a timer, over [nginx](options.html#opt-services.nginx.virtualHosts), instead of dynamic cgi pages over [apache](options.html#opt-services.httpd.enable).
+
+  Minor changes will be required to migrate existing configurations. Details of the required changes can seen by looking through the [awstats](options.html#opt-services.awstats.enable) module.
+
+- The httpd module no longer provides options to support serving web content without defining a virtual host. As a result of this the [services.httpd.logPerVirtualHost](options.html#opt-services.httpd.logPerVirtualHost) option now defaults to `true` instead of `false`. Please update your configuration to make use of [services.httpd.virtualHosts](options.html#opt-services.httpd.virtualHosts).
+
+  The [services.httpd.virtualHosts.\<name\>](options.html#opt-services.httpd.virtualHosts) option has changed type from a list of submodules to an attribute set of submodules, better matching [services.nginx.virtualHosts.\<name\>](options.html#opt-services.nginx.virtualHosts).
+
+  This change comes with the addition of the following options which mimic the functionality of their `nginx` counterparts: [services.httpd.virtualHosts.\<name\>.addSSL](options.html#opt-services.httpd.virtualHosts), [services.httpd.virtualHosts.\<name\>.forceSSL](options.html#opt-services.httpd.virtualHosts), [services.httpd.virtualHosts.\<name\>.onlySSL](options.html#opt-services.httpd.virtualHosts), [services.httpd.virtualHosts.\<name\>.enableACME](options.html#opt-services.httpd.virtualHosts), [services.httpd.virtualHosts.\<name\>.acmeRoot](options.html#opt-services.httpd.virtualHosts), and [services.httpd.virtualHosts.\<name\>.useACMEHost](options.html#opt-services.httpd.virtualHosts).
+
+- For NixOS configuration options, the `loaOf` type has been deprecated and will be removed in a future release. In nixpkgs, options of this type will be changed to `attrsOf` instead. If you were using one of these in your configuration, you will see a warning suggesting what changes will be required.
+
+  For example, [users.users](options.html#opt-users.users) is a `loaOf` option that is commonly used as follows:
+
+  ```nix
+  {
+    users.users =
+      [ { name = "me";
+          description = "My personal user.";
+          isNormalUser = true;
+        }
+      ];
+  }
+  ```
+
+  This should be rewritten by removing the list and using the value of `name` as the name of the attribute set:
+
+  ```nix
+  {
+    users.users.me =
+      { description = "My personal user.";
+        isNormalUser = true;
+      };
+  }
+  ```
+
+  For more information on this change have look at these links: [issue \#1800](https://github.com/NixOS/nixpkgs/issues/1800), [PR \#63103](https://github.com/NixOS/nixpkgs/pull/63103).
+
+- For NixOS modules, the types `types.submodule` and `types.submoduleWith` now support paths as allowed values, similar to how `imports` supports paths. Because of this, if you have a module that defines an option of type `either (submodule ...) path`, it will break since a path is now treated as the first type instead of the second. To fix this, change the type to `either path (submodule ...)`.
+
+- The [Buildkite Agent](options.html#opt-services.buildkite-agents) module and corresponding packages have been updated to 3.x, and to support multiple instances of the agent running at the same time. This means you will have to rename `services.buildkite-agent` to `services.buildkite-agents.<name>`. Furthermore, the following options have been changed:
+
+  - `services.buildkite-agent.meta-data` has been renamed to [services.buildkite-agents.\<name\>.tags](options.html#opt-services.buildkite-agents), to match upstreams naming for 3.x. Its type has also changed - it now accepts an attrset of strings.
+
+  - The`services.buildkite-agent.openssh.publicKeyPath` option has been removed, as it\'s not necessary to deploy public keys to clone private repositories.
+
+  - `services.buildkite-agent.openssh.privateKeyPath` has been renamed to [buildkite-agents.\<name\>.privateSshKeyPath](options.html#opt-services.buildkite-agents), as the whole `openssh` now only contained that single option.
+
+  - [services.buildkite-agents.\<name\>.shell](options.html#opt-services.buildkite-agents) has been introduced, allowing to specify a custom shell to be used.
+
+- The `citrix_workspace_19_3_0` package has been removed as it will be EOLed within the lifespan of 20.03. For further information, please refer to the [support and maintenance information](https://www.citrix.com/de-de/support/product-lifecycle/milestones/receiver.html) from upstream.
+
+- The `gcc5` and `gfortran5` packages have been removed.
+
+- The `services.xserver.displayManager.auto` module has been removed. It was only intended for use in internal NixOS tests, and gave the false impression of it being a special display manager when it\'s actually LightDM. Please use the `services.xserver.displayManager.lightdm.autoLogin` options instead, or any other display manager in NixOS as they all support auto-login. If you used this module specifically because it permitted root auto-login you can override the lightdm-autologin pam module like:
+
+  ```nix
+  {
+    security.pam.services.lightdm-autologin.text = lib.mkForce ''
+        auth     requisite pam_nologin.so
+        auth     required  pam_succeed_if.so quiet
+        auth     required  pam_permit.so
+
+        account  include   lightdm
+
+        password include   lightdm
+
+        session  include   lightdm
+    '';
+  }
+  ```
+
+  The difference is the:
+
+  ```
+  auth required pam_succeed_if.so quiet
+  ```
+
+  line, where default it\'s:
+
+  ```
+   auth required pam_succeed_if.so uid >= 1000 quiet
+  ```
+
+  not permitting users with uid\'s below 1000 (like root). All other display managers in NixOS are configured like this.
+
+- There have been lots of improvements to the Mailman module. As a result,
+
+  - The `services.mailman.hyperkittyBaseUrl` option has been renamed to [services.mailman.hyperkitty.baseUrl](options.html#opt-services.mailman.hyperkitty.baseUrl).
+
+  - The `services.mailman.hyperkittyApiKey` option has been removed. This is because having an option for the Hyperkitty API key meant that the API key would be stored in the world-readable Nix store, which was a security vulnerability. A new Hyperkitty API key will be generated the first time the new Hyperkitty service is run, and it will then be persisted outside of the Nix store. To continue using Hyperkitty, you must set [services.mailman.hyperkitty.enable](options.html#opt-services.mailman.hyperkitty.enable) to `true`.
+
+  - Additionally, some Postfix configuration must now be set manually instead of automatically by the Mailman module:
+
+    ```nix
+    {
+      services.postfix.relayDomains = [ "hash:/var/lib/mailman/data/postfix_domains" ];
+      services.postfix.config.transport_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" ];
+      services.postfix.config.local_recipient_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" ];
+    }
+    ```
+
+    This is because some users may want to include other values in these lists as well, and this was not possible if they were set automatically by the Mailman module. It would not have been possible to just concatenate values from multiple modules each setting the values they needed, because the order of elements in the list is significant.
+
+- The LLVM versions 3.5, 3.9 and 4 (including the corresponding CLang versions) have been dropped.
+
+- The `networking.interfaces.*.preferTempAddress` option has been replaced by `networking.interfaces.*.tempAddress`. The new option allows better control of the IPv6 temporary addresses, including completely disabling them for interfaces where they are not needed.
+
+- Rspamd was updated to version 2.2. Read [ the upstream migration notes](https://rspamd.com/doc/migration.html#migration-to-rspamd-20) carefully. Please be especially aware that some modules were removed and the default Bayes backend is now Redis.
+
+- The `*psu` versions of oraclejdk8 have been removed as they aren\'t provided by upstream anymore.
+
+- The `services.dnscrypt-proxy` module has been removed as it used the deprecated version of dnscrypt-proxy. We\'ve added [services.dnscrypt-proxy2.enable](options.html#opt-services.dnscrypt-proxy2.enable) to use the supported version. This module supports configuration via the Nix attribute set [services.dnscrypt-proxy2.settings](options.html#opt-services.dnscrypt-proxy2.settings), or by passing a TOML configuration file via [services.dnscrypt-proxy2.configFile](options.html#opt-services.dnscrypt-proxy2.configFile).
+
+  ```nix
+  {
+    # Example configuration:
+    services.dnscrypt-proxy2.enable = true;
+    services.dnscrypt-proxy2.settings = {
+      listen_addresses = [ "127.0.0.1:43" ];
+      sources.public-resolvers = {
+        urls = [ "https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md" ];
+        cache_file = "public-resolvers.md";
+        minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
+        refresh_delay = 72;
+      };
+    };
+
+    services.dnsmasq.enable = true;
+    services.dnsmasq.servers = [ "127.0.0.1#43" ];
+  }
+  ```
+
+- `qesteidutil` has been deprecated in favor of `qdigidoc`.
+
+- sqldeveloper_18 has been removed as it\'s not maintained anymore, sqldeveloper has been updated to version `19.4`. Please note that this means that this means that the oraclejdk is now required. For further information please read the [release notes](https://www.oracle.com/technetwork/developer-tools/sql-developer/downloads/sqldev-relnotes-194-5908846.html).
+
+- Haskell `env` and `shellFor` dev shell environments now organize dependencies the same way as regular builds. In particular, rather than receiving all the different lists of dependencies mashed together as one big list, and then partitioning into Haskell and non-Hakell dependencies, they work from the original many different dependency parameters and don\'t need to algorithmically partition anything.
+
+  This means that if you incorrectly categorize a dependency, e.g. non-Haskell library dependency as a `buildDepends` or run-time Haskell dependency as a `setupDepends`, whereas things would have worked before they may not work now.
+
+- The gcc-snapshot-package has been removed. It\'s marked as broken for \>2 years and used to point to a fairly old snapshot from the gcc7-branch.
+
+- The nixos-build-vms8 -script now uses the python test-driver.
+
+- The riot-web package now accepts configuration overrides as an attribute set instead of a string. A formerly used JSON configuration can be converted to an attribute set with `builtins.fromJSON`.
+
+  The new default configuration also disables automatic guest account registration and analytics to improve privacy. The previous behavior can be restored by setting `config.riot-web.conf = { disable_guests = false; piwik = true; }`.
+
+- Stand-alone usage of `Upower` now requires `services.upower.enable` instead of just installing into [environment.systemPackages](options.html#opt-environment.systemPackages).
+
+- nextcloud has been updated to `v18.0.2`. This means that users from NixOS 19.09 can\'t upgrade directly since you can only move one version forward and 19.09 uses `v16.0.8`.
+
+  To provide a safe upgrade-path and to circumvent similar issues in the future, the following measures were taken:
+
+  - The pkgs.nextcloud-attribute has been removed and replaced with versioned attributes (currently pkgs.nextcloud17 and pkgs.nextcloud18). With this change major-releases can be backported without breaking stuff and to make upgrade-paths easier.
+
+  - Existing setups will be detected using [system.stateVersion](options.html#opt-system.stateVersion): by default, nextcloud17 will be used, but will raise a warning which notes that after that deploy it\'s recommended to update to the latest stable version (nextcloud18) by declaring the newly introduced setting [services.nextcloud.package](options.html#opt-services.nextcloud.package).
+
+  - Users with an overlay (e.g. to use nextcloud at version `v18` on `19.09`) will get an evaluation error by default. This is done to ensure that our [package](options.html#opt-services.nextcloud.package)-option doesn\'t select an older version by accident. It\'s recommended to use pkgs.nextcloud18 or to set [package](options.html#opt-services.nextcloud.package) to pkgs.nextcloud explicitly.
+
+  ::: {.warning}
+  Please note that if you\'re coming from `19.03` or older, you have to manually upgrade to `19.09` first to upgrade your server to Nextcloud v16.
+  :::
+
+- Hydra has gained a massive performance improvement due to [some database schema changes](https://github.com/NixOS/hydra/pull/710) by adding several IDs and better indexing. However, it\'s necessary to upgrade Hydra in multiple steps:
+
+  - At first, an older version of Hydra needs to be deployed which adds those (nullable) columns. When having set [stateVersion ](options.html#opt-system.stateVersion) to a value older than `20.03`, this package will be selected by default from the module when upgrading. Otherwise, the package can be deployed using the following config:
+
+    ```nix
+    { pkgs, ... }: {
+      services.hydra.package = pkgs.hydra-migration;
+    }
+    ```
+
+- Automatically fill the newly added ID columns on the server by running the following command:
+
+  ```ShellSession
+  $ hydra-backfill-ids
+  ```
+  ::: {.warning}
+  Please note that this process can take a while depending on your database-size!
+  :::
+
+- Deploy a newer version of Hydra to activate the DB optimizations. This can be done by using hydra-unstable. This package already includes [flake-support](https://github.com/nixos/rfcs/pull/49) and is therefore compiled against pkgs.nixFlakes.
+
+  ::: {.warning}
+  If your [stateVersion](options.html#opt-system.stateVersion) is set to `20.03` or greater, hydra-unstable will be used automatically! This will break your setup if you didn\'t run the migration.
+  :::
+
+  Please note that Hydra is currently not available with nixStable as this doesn\'t compile anymore.
+
+  ::: {.warning}
+  pkgs.hydra has been removed to ensure a graceful database-migration using the dedicated package-attributes. If you still have pkgs.hydra defined in e.g. an overlay, an assertion error will be thrown. To circumvent this, you need to set [services.hydra.package](options.html#opt-services.hydra.package) to pkgs.hydra explicitly and make sure you know what you\'re doing!
+  :::
+
+- The TokuDB storage engine will be disabled in mariadb 10.5. It is recommended to switch to RocksDB. See also [TokuDB](https://mariadb.com/kb/en/tokudb/).
+
+## Other Notable Changes {#sec-release-20.03-notable-changes}
+
+- SD images are now compressed by default using `bzip2`.
+
+- The nginx web server previously started its master process as root privileged, then ran worker processes as a less privileged identity user (the `nginx` user). This was changed to start all of nginx as a less privileged user (defined by `services.nginx.user` and `services.nginx.group`). As a consequence, all files that are needed for nginx to run (included configuration fragments, SSL certificates and keys, etc.) must now be readable by this less privileged user/group.
+
+  To continue to use the old approach, you can configure:
+
+  ```nix
+  {
+    services.nginx.appendConfig = let cfg = config.services.nginx; in ''user ${cfg.user} ${cfg.group};'';
+    systemd.services.nginx.serviceConfig.User = lib.mkForce "root";
+  }
+  ```
+
+- OpenSSH has been upgraded from 7.9 to 8.1, improving security and adding features but with potential incompatibilities. Consult the [ release announcement](https://www.openssh.com/txt/release-8.1) for more information.
+
+- `PRETTY_NAME` in `/etc/os-release` now uses the short rather than full version string.
+
+- The ACME module has switched from simp-le to [lego](https://github.com/go-acme/lego) which allows us to support DNS-01 challenges and wildcard certificates. The following options have been added: [security.acme.acceptTerms](options.html#opt-security.acme.acceptTerms), [security.acme.certs.\<name\>.dnsProvider](options.html#opt-security.acme.certs), [security.acme.certs.\<name\>.credentialsFile](options.html#opt-security.acme.certs), [security.acme.certs.\<name\>.dnsPropagationCheck](options.html#opt-security.acme.certs). As well as this, the options `security.acme.acceptTerms` and either `security.acme.email` or `security.acme.certs.<name>.email` must be set in order to use the ACME module. Certificates will be regenerated on activation, no account or certificate will be migrated from simp-le. In particular private keys will not be preserved. However, the credentials for simp-le are preserved and thus it is possible to roll back to previous versions without breaking certificate generation. Note also that in contrary to simp-le a new private key is recreated at each renewal by default, which can have consequences if you embed your public key in apps.
+
+- It is now possible to unlock LUKS-Encrypted file systems using a FIDO2 token via `boot.initrd.luks.fido2Support`.
+
+- Predictably named network interfaces get renamed in stage-1. This means that it is possible to use the proper interface name for e.g. Dropbear setups.
+
+  For further reference, please read [\#68953](https://github.com/NixOS/nixpkgs/pull/68953) or the corresponding [discourse thread](https://discourse.nixos.org/t/predictable-network-interface-names-in-initrd/4055).
+
+- The matrix-synapse-package has been updated to [v1.11.1](https://github.com/matrix-org/synapse/releases/tag/v1.11.1). Due to [stricter requirements](https://github.com/matrix-org/synapse/releases/tag/v1.10.0rc1) for database configuration when using postgresql, the automated database setup of the module has been removed to avoid any further edge-cases.
+
+  matrix-synapse expects `postgresql`-databases to have the options `LC_COLLATE` and `LC_CTYPE` set to [`'C'`](https://www.postgresql.org/docs/12/locale.html) which basically instructs `postgresql` to ignore any locale-based preferences.
+
+  Depending on your setup, you need to incorporate one of the following changes in your setup to upgrade to 20.03:
+
+  - If you use `sqlite3` you don\'t need to do anything.
+
+  - If you use `postgresql` on a different server, you don\'t need to change anything as well since this module was never designed to configure remote databases.
+
+  - If you use `postgresql` and configured your synapse initially on `19.09` or older, you simply need to enable postgresql-support explicitly:
+
+    ```nix
+    { ... }: {
+      services.matrix-synapse = {
+        enable = true;
+        /* and all the other config you've defined here */
+      };
+      services.postgresql.enable = true;
+    }
+    ```
+
+- If you deploy a fresh matrix-synapse, you need to configure the database yourself (e.g. by using the [services.postgresql.initialScript](options.html#opt-services.postgresql.initialScript) option). An example for this can be found in the [documentation of the Matrix module](#module-services-matrix).
+
+- If you initially deployed your matrix-synapse on `nixos-unstable` _after_ the `19.09`-release, your database is misconfigured due to a regression in NixOS. For now, matrix-synapse will startup with a warning, but it\'s recommended to reconfigure the database to set the values `LC_COLLATE` and `LC_CTYPE` to [`'C'`](https://www.postgresql.org/docs/12/locale.html).
+
+- The [systemd.network.links](options.html#opt-systemd.network.links) option is now respected even when [systemd-networkd](options.html#opt-systemd.network.enable) is disabled. This mirrors the behaviour of systemd - It\'s udev that parses `.link` files, not `systemd-networkd`.
+
+- mongodb has been updated to version `3.4.24`.
+
+  ::: {.warning}
+  Please note that mongodb has been relicensed under their own [` sspl`](https://www.mongodb.com/licensing/server-side-public-license/faq)-license. Since it\'s not entirely free and not OSI-approved, it\'s listed as non-free. This means that Hydra doesn\'t provide prebuilt mongodb-packages and needs to be built locally.
+  :::
diff --git a/nixos/doc/manual/release-notes/rl-2003.xml b/nixos/doc/manual/release-notes/rl-2003.xml
deleted file mode 100644
index 4206f44f6c77..000000000000
--- a/nixos/doc/manual/release-notes/rl-2003.xml
+++ /dev/null
@@ -1,1252 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-20.03">
- <title>Release 20.03 (“Markhor”, 2020.04/20)</title>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-20.03-highlights">
-  <title>Highlights</title>
-
-  <para>
-   In addition to numerous new and upgraded packages, this release has the
-   following highlights:
-  </para>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     Support is planned until the end of October 2020, handing over to 20.09.
-    </para>
-   </listitem>
-   <listitem>
-    <para>Core version changes:</para>
-    <para>gcc: 8.3.0 -&gt; 9.2.0</para>
-    <para>glibc: 2.27 -&gt; 2.30</para>
-    <para>linux: 4.19 -&gt; 5.4</para>
-    <para>mesa: 19.1.5 -&gt; 19.3.3</para>
-    <para>openssl: 1.0.2u -&gt; 1.1.1d</para>
-   </listitem>
-   <listitem>
-    <para>Desktop version changes:</para>
-    <para>plasma5: 5.16.5 -&gt; 5.17.5</para>
-    <para>kdeApplications: 19.08.2 -&gt; 19.12.3</para>
-    <para>gnome3: 3.32 -&gt; 3.34</para>
-    <para>pantheon: 5.0 -&gt; 5.1.3</para>
-   </listitem>
-   <listitem>
-    <para>
-     Linux kernel is updated to branch 5.4 by default (from 4.19).
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Grub is updated to 2.04, adding support for booting from F2FS filesystems and
-     Btrfs volumes using zstd compression. Note that some users have been unable
-to boot after upgrading to 2.04 - for more information, please see <link
-xlink:href="https://github.com/NixOS/nixpkgs/issues/61718#issuecomment-617618503">this
-     discussion</link>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Postgresql for NixOS service now defaults to v11.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The graphical installer image starts the graphical session automatically.
-     Before you'd be greeted by a tty and asked to enter <command>systemctl start display-manager</command>.
-     It is now possible to disable the display-manager from running by selecting the <literal>Disable display-manager</literal>
-     quirk in the boot menu.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     GNOME 3 has been upgraded to 3.34. Please take a look at their
-     <link xlink:href="https://help.gnome.org/misc/release-notes/3.34">Release Notes</link>
-     for details.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     If you enable the Pantheon Desktop Manager via
-     <xref linkend="opt-services.xserver.desktopManager.pantheon.enable" />, we now default to also use
-     <link xlink:href="https://blog.elementary.io/say-hello-to-the-new-greeter/">
-      Pantheon's newly designed greeter
-     </link>.
-      Contrary to NixOS's usual update policy, Pantheon will receive updates during the cycle of
-      NixOS 20.03 when backwards compatible.
-    </para>
-   </listitem>
-   <listitem>
-     <para>
-       By default zfs pools will now be trimmed on a weekly basis.
-       Trimming is only done on supported devices (i.e. NVME or SSDs)
-       and should improve throughput and lifetime of these devices.
-       It is controlled by the <varname>services.zfs.trim.enable</varname> varname.
-       The zfs scrub service (<varname>services.zfs.autoScrub.enable</varname>)
-       and the zfs autosnapshot service (<varname>services.zfs.autoSnapshot.enable</varname>)
-       are now only enabled if zfs is set in <varname>config.boot.initrd.supportedFilesystems</varname> or
-       <varname>config.boot.supportedFilesystems</varname>. These lists will automatically contain
-       zfs as soon as any zfs mountpoint is configured in <varname>fileSystems</varname>.
-     </para>
-   </listitem>
-   <listitem>
-    <para>
-      <command>nixos-option</command> has been rewritten in C++, speeding it up, improving correctness,
-      and adding a <option>-r</option> option which prints all options and their values recursively.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <option>services.xserver.desktopManager.default</option> and <option>services.xserver.windowManager.default</option> options were replaced by a single <xref linkend="opt-services.xserver.displayManager.defaultSession"/> option to improve support for upstream session files. If you used something like:
-<programlisting>
-services.xserver.desktopManager.default = "xfce";
-services.xserver.windowManager.default = "icewm";
-</programlisting>
-     you should change it to:
-<programlisting>
-services.xserver.displayManager.defaultSession = "xfce+icewm";
-</programlisting>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The testing driver implementation in NixOS is now in Python <filename>make-test-python.nix</filename>.
-     This was done by Jacek Galowicz (<link xlink:href="https://github.com/tfc">@tfc</link>), and with the
-     collaboration of Julian Stecklina (<link xlink:href="https://github.com/blitz">@blitz</link>) and
-     Jana Traue (<link xlink:href="https://github.com/jtraue">@jtraue</link>). All documentation has been updated to use this
-     testing driver, and a vast majority of the 286 tests in NixOS were ported to python driver. In 20.09 the Perl driver implementation,
-     <filename>make-test.nix</filename>, is slated for removal. This should give users of the NixOS integration framework
-     a transitory period to rewrite their tests to use the Python implementation. Users of the Perl driver will see
-     this warning everytime they use it:
-<screen>
-<prompt>$ </prompt>warning: Perl VM tests are deprecated and will be removed for 20.09.
-Please update your tests to use the python test driver.
-See https://github.com/NixOS/nixpkgs/pull/71684 for details.
-</screen>
-     API compatibility is planned to be kept for at least the next release with the perl driver.
-    </para>
-   </listitem>
-  </itemizedlist>
- </section>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-20.03-new-services">
-  <title>New Services</title>
-
-  <para>
-   The following new services were added since the last release:
-  </para>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-    The kubernetes kube-proxy now supports a new hostname configuration
-    <literal>services.kubernetes.proxy.hostname</literal> which has to
-    be set if the hostname of the node should be non default.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-    UPower's configuration is now managed by NixOS and can be customized
-    via <option>services.upower</option>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     To use Geary you should enable <xref linkend="opt-programs.geary.enable"/> instead of
-     just adding it to <xref linkend="opt-environment.systemPackages"/>.
-     It was created so Geary could function properly outside of GNOME.
-    </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./config/console.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./hardware/brillo.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./hardware/tuxedo-keyboard.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./programs/bandwhich.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./programs/bash-my-aws.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./programs/liboping.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./programs/traceroute.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/backup/sanoid.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/backup/syncoid.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/backup/zfs-replication.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/continuous-integration/buildkite-agents.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/databases/victoriametrics.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/desktops/gnome3/gnome-initial-setup.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/desktops/neard.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/games/openarena.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/hardware/fancontrol.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/mail/sympa.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/misc/freeswitch.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/misc/mame.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/monitoring/do-agent.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/monitoring/prometheus/xmpp-alerts.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/network-filesystems/orangefs/server.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/network-filesystems/orangefs/client.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/networking/3proxy.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/networking/corerad.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/networking/go-shadowsocks2.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/networking/ntp/openntpd.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/networking/shorewall.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/networking/shorewall6.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/networking/spacecookie.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/networking/trickster.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/networking/v2ray.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/networking/xandikos.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/networking/yggdrasil.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/web-apps/dokuwiki.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/web-apps/gotify-server.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/web-apps/grocy.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/web-apps/ihatemoney</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/web-apps/moinmoin.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/web-apps/trac.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/web-apps/trilium.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/web-apps/shiori.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/web-servers/ttyd.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/x11/picom.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/x11/hardware/digimend.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./services/x11/imwheel.nix</filename>
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       <filename>./virtualisation/cri-o.nix</filename>
-     </para>
-   </listitem>
-  </itemizedlist>
-
- </section>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-20.03-incompatibilities">
-  <title>Backward Incompatibilities</title>
-
-  <para>
-   When upgrading from a previous release, please be aware of the following
-   incompatible changes:
-  </para>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     The <package>dhcpcd</package> package <link xlink:href="https://roy.marples.name/archives/dhcpcd-discuss/0002621.html">
-     does not request IPv4 addresses for tap and bridge interfaces anymore by default</link>.
-     In order to still get an address on a bridge interface, one has to disable
-     <literal>networking.useDHCP</literal> and explicitly enable
-     <literal>networking.interfaces.&lt;name&gt;.useDHCP</literal> on
-     every interface, that should get an address via DHCP. This way, dhcpcd
-     is configured in an explicit way about which interface to run on.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      GnuPG is now built without support for a graphical passphrase entry
-      by default. Please enable the <literal>gpg-agent</literal> user service
-      via the NixOS option <literal>programs.gnupg.agent.enable</literal>.
-      Note that upstream recommends using <literal>gpg-agent</literal> and
-      will spawn a <literal>gpg-agent</literal> on the first invocation of
-      GnuPG anyway.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>dynamicHosts</literal> option has been removed from the
-     <link linkend="opt-networking.networkmanager.enable">NetworkManager</link>
-     module. Allowing (multiple) regular users to override host entries
-     affecting the whole system opens up a huge attack vector.
-     There seem to be very rare cases where this might be useful.
-     Consider setting system-wide host entries using
-     <link linkend="opt-networking.hosts">networking.hosts</link>, provide
-     them via the DNS server in your network, or use
-     <link linkend="opt-environment.etc">environment.etc</link>
-     to add a file into <literal>/etc/NetworkManager/dnsmasq.d</literal>
-     reconfiguring <literal>hostsdir</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>99-main.network</literal> file was removed. Matching all
-     network interfaces caused many breakages, see
-     <link xlink:href="https://github.com/NixOS/nixpkgs/pull/18962">#18962</link>
-       and <link xlink:href="https://github.com/NixOS/nixpkgs/pull/71106">#71106</link>.
-    </para>
-    <para>
-     We already don't support the global <link linkend="opt-networking.useDHCP">networking.useDHCP</link>,
-     <link linkend="opt-networking.defaultGateway">networking.defaultGateway</link> and
-     <link linkend="opt-networking.defaultGateway6">networking.defaultGateway6</link> options
-     if <link linkend="opt-networking.useNetworkd">networking.useNetworkd</link> is enabled,
-     but direct users to configure the per-device
-     <link linkend="opt-networking.interfaces">networking.interfaces.&lt;name&gt;.…</link> options.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      The stdenv now runs all bash with <literal>set -u</literal>, to catch the use of undefined variables.
-      Before, it itself used <literal>set -u</literal> but was careful to unset it so other packages' code ran as before.
-      Now, all bash code is held to the same high standard, and the rather complex stateful manipulation of the options can be discarded.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The SLIM Display Manager has been removed, as it has been unmaintained since 2013.
-     Consider migrating to a different display manager such as LightDM (current default in NixOS),
-     SDDM, GDM, or using the startx module which uses Xinitrc.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The Way Cooler wayland compositor has been removed, as the project has been officially canceled.
-     There are no more <literal>way-cooler</literal> attribute and <literal>programs.way-cooler</literal> options.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      The BEAM package set has been deleted. You will only find there the different interpreters.
-      You should now use the different build tools coming with the languages with sandbox mode disabled.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     There is now only one Xfce package-set and module. This means that attributes <literal>xfce4-14</literal>
-     and <literal>xfceUnstable</literal> all now point to the latest Xfce 4.14
-     packages. And in the future NixOS releases will be the latest released version of Xfce available at the
-     time of the release's development (if viable).
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      The <link linkend="opt-services.phpfpm.pools">phpfpm</link> module now sets
-      <literal>PrivateTmp=true</literal> in its systemd units for better process isolation.
-      If you rely on <literal>/tmp</literal> being shared with other services, explicitly override this by
-      setting <literal>serviceConfig.PrivateTmp</literal> to <literal>false</literal> for each phpfpm unit.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     KDE’s old multimedia framework Phonon no longer supports Qt 4. For that reason, Plasma desktop also does not have <option>enableQt4Support</option> option any more.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The BeeGFS module has been removed.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The osquery module has been removed.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      Going forward, <literal>~/bin</literal> in the users home directory will no longer be in <literal>PATH</literal> by default.
-      If you depend on this you should set the option <literal>environment.homeBinInPath</literal> to <literal>true</literal>.
-      The aforementioned option was added this release.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      The <literal>buildRustCrate</literal> infrastructure now produces <literal>lib</literal> outputs in addition to the <literal>out</literal> output.
-      This has led to drastically reduced closure sizes for some rust crates since development dependencies are now in the <literal>lib</literal> output.
-    </para>
-    </listitem>
-   <listitem>
-    <para>
-     Pango was upgraded to 1.44, which no longer uses freetype for font loading.  This means that type1
-     and bitmap fonts are no longer supported in applications relying on Pango for font rendering
-     (notably, GTK application). See <link xlink:href="https://gitlab.gnome.org/GNOME/pango/issues/386">
-     upstream issue</link> for more information.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>roundcube</literal> module has been hardened.
-     <itemizedlist>
-      <listitem>
-       <para>
-        The password of the database is not written world readable in the store any more. If <literal>database.host</literal> is set to <literal>localhost</literal>, then a unix user of the same name as the database will be created and PostreSQL peer authentication will be used, removing the need for a password. Otherwise, a password is still needed and can be provided with the new option <literal>database.passwordFile</literal>, which should be set to the path of a file containing the password and readable by the user <literal>nginx</literal> only. The <literal>database.password</literal> option is insecure and deprecated. Usage of this option will print a warning.
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        A random <literal>des_key</literal> is set by default in the configuration of roundcube, instead of using the hardcoded and insecure default. To ensure a clean migration, all users will be logged out when you upgrade to this release.
-       </para>
-      </listitem>
-     </itemizedlist>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The packages <literal>openobex</literal> and <literal>obexftp</literal>
-     are no longer installed when enabling Bluetooth via
-     <option>hardware.bluetooth.enable</option>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>dump1090</literal> derivation has been changed to use FlightAware's dump1090
-     as its upstream. However, this version does not have an internal webserver anymore. The
-     assets in the <literal>share/dump1090</literal> directory of the derivation can be used
-     in conjunction with an external webserver to replace this functionality.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The fourStore and fourStoreEndpoint modules have been removed.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Polkit no longer has the user of uid 0 (root) as an admin identity.
-     We now follow the upstream default of only having every member of the wheel
-     group admin privileged. Before it was root and members of wheel.
-     The positive outcome of this is pkexec GUI popups or terminal prompts
-     will no longer require the user to choose between two essentially equivalent
-     choices (whether to perform the action as themselves with wheel permissions, or as the root user).
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     NixOS containers no longer build NixOS manual by default. This saves evaluation time,
-     especially if there are many declarative containers defined. Note that this is already done
-     when <literal>&lt;nixos/modules/profiles/minimal.nix&gt;</literal> module is included
-     in container config.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>kresd</literal> services deprecates the <literal>interfaces</literal> option
-     in favor of the <literal>listenPlain</literal> option which requires full
-     <link xlink:href="https://www.freedesktop.org/software/systemd/man/systemd.socket.html#ListenStream=">systemd.socket compatible</link>
-     declaration which always include a port.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Virtual console options have been reorganized and can be found under
-     a single top-level attribute: <literal>console</literal>.
-     The full set of changes is as follows:
-    </para>
-    <itemizedlist>
-      <listitem>
-       <para>
-         <literal>i18n.consoleFont</literal> renamed to
-         <link linkend="opt-console.font">console.font</link>
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-         <literal>i18n.consoleKeyMap</literal> renamed to
-         <link linkend="opt-console.keyMap">console.keyMap</link>
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-         <literal>i18n.consoleColors</literal> renamed to
-         <link linkend="opt-console.colors">console.colors</link>
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-         <literal>i18n.consolePackages</literal> renamed to
-         <link linkend="opt-console.packages">console.packages</link>
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-         <literal>i18n.consoleUseXkbConfig</literal> renamed to
-         <link linkend="opt-console.useXkbConfig">console.useXkbConfig</link>
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-         <literal>boot.earlyVconsoleSetup</literal> renamed to
-         <link linkend="opt-console.earlySetup">console.earlySetup</link>
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-         <literal>boot.extraTTYs</literal> renamed to
-         <literal>console.extraTTYs</literal>.
-       </para>
-      </listitem>
-    </itemizedlist>
-   </listitem>
-   <listitem>
-    <para>
-     The <link linkend="opt-services.awstats.enable">awstats</link> module has been rewritten
-     to serve stats via static html pages, updated on a timer, over <link linkend="opt-services.nginx.virtualHosts">nginx</link>,
-     instead of dynamic cgi pages over <link linkend="opt-services.httpd.enable">apache</link>.
-    </para>
-    <para>
-     Minor changes will be required to migrate existing configurations. Details of the
-     required changes can seen by looking through the <link linkend="opt-services.awstats.enable">awstats</link>
-     module.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      The httpd module no longer provides options to support serving web content without defining a virtual host. As a
-      result of this the <link linkend="opt-services.httpd.logPerVirtualHost">services.httpd.logPerVirtualHost</link>
-      option now defaults to <literal>true</literal> instead of <literal>false</literal>. Please update your
-      configuration to make use of <link linkend="opt-services.httpd.virtualHosts">services.httpd.virtualHosts</link>.
-    </para>
-    <para>
-      The <link linkend="opt-services.httpd.virtualHosts">services.httpd.virtualHosts.&lt;name&gt;</link>
-      option has changed type from a list of submodules to an attribute set of submodules, better matching
-      <link linkend="opt-services.nginx.virtualHosts">services.nginx.virtualHosts.&lt;name&gt;</link>.
-    </para>
-    <para>
-      This change comes with the addition of the following options which mimic the functionality of their <literal>nginx</literal> counterparts:
-      <link linkend="opt-services.httpd.virtualHosts">services.httpd.virtualHosts.&lt;name&gt;.addSSL</link>,
-      <link linkend="opt-services.httpd.virtualHosts">services.httpd.virtualHosts.&lt;name&gt;.forceSSL</link>,
-      <link linkend="opt-services.httpd.virtualHosts">services.httpd.virtualHosts.&lt;name&gt;.onlySSL</link>,
-      <link linkend="opt-services.httpd.virtualHosts">services.httpd.virtualHosts.&lt;name&gt;.enableACME</link>,
-      <link linkend="opt-services.httpd.virtualHosts">services.httpd.virtualHosts.&lt;name&gt;.acmeRoot</link>, and
-      <link linkend="opt-services.httpd.virtualHosts">services.httpd.virtualHosts.&lt;name&gt;.useACMEHost</link>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     For NixOS configuration options, the <literal>loaOf</literal> type has
-     been deprecated and will be removed in a future release. In nixpkgs,
-     options of this type will be changed to <literal>attrsOf</literal>
-     instead. If you were using one of these in your configuration, you will
-     see a warning suggesting what changes will be required.
-    </para>
-    <para>
-     For example, <link linkend="opt-users.users">users.users</link> is a
-     <literal>loaOf</literal> option that is commonly used as follows:
-     <programlisting>
-users.users =
-  [ { name = "me";
-      description = "My personal user.";
-      isNormalUser = true;
-    }
-  ];
-     </programlisting>
-     This should be rewritten by removing the list and using the
-     value of <literal>name</literal> as the name of the attribute set:
-     <programlisting>
-users.users.me =
-  { description = "My personal user.";
-    isNormalUser = true;
-  };
-     </programlisting>
-    </para>
-    <para>
-     For more information on this change have look at these links:
-     <link xlink:href="https://github.com/NixOS/nixpkgs/issues/1800">issue #1800</link>,
-     <link xlink:href="https://github.com/NixOS/nixpkgs/pull/63103">PR #63103</link>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     For NixOS modules, the types <literal>types.submodule</literal> and <literal>types.submoduleWith</literal> now support
-     paths as allowed values, similar to how <literal>imports</literal> supports paths.
-     Because of this, if you have a module that defines an option of type
-     <literal>either (submodule ...) path</literal>, it will break since a path
-     is now treated as the first type instead of the second. To fix this, change
-     the type to <literal>either path (submodule ...)</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      The <link linkend="opt-services.buildkite-agents">Buildkite
-      Agent</link> module and corresponding packages have been updated to
-      3.x, and to support multiple instances of the agent running at the
-      same time. This means you will have to rename
-      <literal>services.buildkite-agent</literal> to
-      <literal>services.buildkite-agents.&lt;name&gt;</literal>. Furthermore,
-      the following options have been changed:
-    </para>
-    <itemizedlist>
-      <listitem>
-       <para>
-         <literal>services.buildkite-agent.meta-data</literal> has been renamed to
-         <link linkend="opt-services.buildkite-agents">services.buildkite-agents.&lt;name&gt;.tags</link>,
-         to match upstreams naming for 3.x.
-         Its type has also changed - it now accepts an attrset of strings.
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-         The<literal>services.buildkite-agent.openssh.publicKeyPath</literal> option
-         has been removed, as it's not necessary to deploy public keys to clone private
-         repositories.
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-         <literal>services.buildkite-agent.openssh.privateKeyPath</literal>
-         has been renamed to
-         <link linkend="opt-services.buildkite-agents">buildkite-agents.&lt;name&gt;.privateSshKeyPath</link>,
-         as the whole <literal>openssh</literal> now only contained that single option.
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-         <link linkend="opt-services.buildkite-agents">services.buildkite-agents.&lt;name&gt;.shell</link>
-         has been introduced, allowing to specify a custom shell to be used.
-       </para>
-      </listitem>
-    </itemizedlist>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>citrix_workspace_19_3_0</literal> package has been removed as
-     it will be EOLed within the lifespan of 20.03. For further information,
-     please refer to the <link xlink:href="https://www.citrix.com/de-de/support/product-lifecycle/milestones/receiver.html">support and maintenance information</link> from upstream.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>gcc5</literal> and <literal>gfortran5</literal> packages have been removed.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <option>services.xserver.displayManager.auto</option> module has been removed.
-     It was only intended for use in internal NixOS tests, and gave the false impression
-     of it being a special display manager when it's actually LightDM.
-     Please use the <option>services.xserver.displayManager.lightdm.autoLogin</option> options instead,
-     or any other display manager in NixOS as they all support auto-login. If you used this module specifically
-     because it permitted root auto-login you can override the lightdm-autologin pam module like:
-<programlisting>
-<link xlink:href="#opt-security.pam.services._name_.text">security.pam.services.lightdm-autologin.text</link> = lib.mkForce ''
-    auth     requisite pam_nologin.so
-    auth     required  pam_succeed_if.so quiet
-    auth     required  pam_permit.so
-
-    account  include   lightdm
-
-    password include   lightdm
-
-    session  include   lightdm
-'';
-</programlisting>
-     The difference is the:
-<programlisting>
-auth required pam_succeed_if.so quiet
-</programlisting>
-     line, where default it's:
-<programlisting>
-auth required pam_succeed_if.so uid >= 1000 quiet
-</programlisting>
-     not permitting users with uid's below 1000 (like root).
-     All other display managers in NixOS are configured like this.
-    </para>
-   </listitem>
-   <listitem>
-     <para>
-       There have been lots of improvements to the Mailman module.  As
-       a result,
-     </para>
-     <itemizedlist>
-       <listitem>
-         <para>
-           The <option>services.mailman.hyperkittyBaseUrl</option>
-           option has been renamed to <xref
-           linkend="opt-services.mailman.hyperkitty.baseUrl"/>.
-         </para>
-       </listitem>
-       <listitem>
-         <para>
-           The <option>services.mailman.hyperkittyApiKey</option>
-           option has been removed.  This is because having an option
-           for the Hyperkitty API key meant that the API key would be
-           stored in the world-readable Nix store, which was a
-           security vulnerability.  A new Hyperkitty API key will be
-           generated the first time the new Hyperkitty service is run,
-           and it will then be persisted outside of the Nix store.  To
-           continue using Hyperkitty, you must set <xref
-           linkend="opt-services.mailman.hyperkitty.enable"/> to
-           <literal>true</literal>.
-         </para>
-       </listitem>
-       <listitem>
-         <para>
-           Additionally, some Postfix configuration must now be set
-           manually instead of automatically by the Mailman module:
-<programlisting>
-<xref linkend="opt-services.postfix.relayDomains"/> = [ "hash:/var/lib/mailman/data/postfix_domains" ];
-<xref linkend="opt-services.postfix.config"/>.transport_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" ];
-<xref linkend="opt-services.postfix.config"/>.local_recipient_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" ];
-</programlisting>
-           This is because some users may want to include other values
-           in these lists as well, and this was not possible if they
-           were set automatically by the Mailman module.  It would not
-           have been possible to just concatenate values from multiple
-           modules each setting the values they needed, because the
-           order of elements in the list is significant.
-         </para>
-       </listitem>
-     </itemizedlist>
-   </listitem>
-   <listitem>
-    <para>The LLVM versions 3.5, 3.9 and 4 (including the corresponding CLang versions) have been dropped.</para>
-   </listitem>
-   <listitem>
-    <para>
-     The <option>networking.interfaces.*.preferTempAddress</option> option has
-     been replaced by <option>networking.interfaces.*.tempAddress</option>.
-     The new option allows better control of the IPv6 temporary addresses,
-     including completely disabling them for interfaces where they are not
-     needed.
-    </para>
-   </listitem>
-   <listitem>
-     <para>
-       Rspamd was updated to version 2.2. Read
-       <link xlink:href="https://rspamd.com/doc/migration.html#migration-to-rspamd-20">
-       the upstream migration notes</link> carefully. Please be especially
-       aware that some modules were removed and the default Bayes backend is
-       now Redis.
-     </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>*psu</literal> versions of <package>oraclejdk8</package> have been removed
-     as they aren't provided by upstream anymore.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <option>services.dnscrypt-proxy</option> module has been removed
-     as it used the deprecated version of dnscrypt-proxy. We've added
-     <xref linkend="opt-services.dnscrypt-proxy2.enable"/> to use the supported version.
-     This module supports configuration via the Nix attribute set
-     <xref linkend="opt-services.dnscrypt-proxy2.settings" />, or by passing a TOML configuration file via
-     <xref linkend="opt-services.dnscrypt-proxy2.configFile" />.
-<programlisting>
-# Example configuration:
-services.dnscrypt-proxy2.enable = true;
-services.dnscrypt-proxy2.settings = {
-  listen_addresses = [ "127.0.0.1:43" ];
-  sources.public-resolvers = {
-    urls = [ "https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md" ];
-    cache_file = "public-resolvers.md";
-    minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
-    refresh_delay = 72;
-  };
-};
-
-services.dnsmasq.enable = true;
-services.dnsmasq.servers = [ "127.0.0.1#43" ];
-</programlisting>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>qesteidutil</literal> has been deprecated in favor of <literal>qdigidoc</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <package>sqldeveloper_18</package> has been removed as it's not maintained anymore,
-     <package>sqldeveloper</package> has been updated to version <literal>19.4</literal>.
-     Please note that this means that this means that the <package>oraclejdk</package> is now
-     required. For further information please read the
-     <link xlink:href="https://www.oracle.com/technetwork/developer-tools/sql-developer/downloads/sqldev-relnotes-194-5908846.html">release notes</link>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      Haskell <varname>env</varname> and <varname>shellFor</varname> dev shell environments now organize dependencies the same way as regular builds.
-      In particular, rather than receiving all the different lists of dependencies mashed together as one big list, and then partitioning into Haskell and non-Hakell dependencies, they work from the original many different dependency parameters and don't need to algorithmically partition anything.
-    </para>
-    <para>
-      This means that if you incorrectly categorize a dependency, e.g. non-Haskell library dependency as a <varname>buildDepends</varname> or run-time Haskell dependency as a <varname>setupDepends</varname>, whereas things would have worked before they may not work now.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <package>gcc-snapshot</package>-package has been removed. It's marked as broken for &gt;2 years and used to point
-     to a fairly old snapshot  from the <package>gcc7</package>-branch.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <citerefentry><refentrytitle>nixos-build-vms</refentrytitle><manvolnum>8</manvolnum>
-     </citerefentry>-script now uses the python test-driver.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <package>riot-web</package> package now accepts configuration overrides as an attribute set instead of a string.
-     A formerly used JSON configuration can be converted to an attribute set with <literal>builtins.fromJSON</literal>.
-    </para>
-    <para>
-     The new default configuration also disables automatic guest account registration and analytics to improve privacy.
-     The previous behavior can be restored by setting <literal>config.riot-web.conf = { disable_guests = false; piwik = true; }</literal>.
-    </para>
-   </listitem>
-   <listitem>
-     <para>
-       Stand-alone usage of <literal>Upower</literal> now requires
-       <option>services.upower.enable</option> instead of just installing into
-       <xref linkend="opt-environment.systemPackages"/>.
-     </para>
-   </listitem>
-   <listitem>
-    <para>
-     <package>nextcloud</package> has been updated to <literal>v18.0.2</literal>. This means
-     that users from NixOS 19.09 can't upgrade directly since you can only move one version
-      forward and 19.09 uses <literal>v16.0.8</literal>.
-    </para>
-    <para>
-     To provide a safe upgrade-path and to circumvent similar issues in the future, the following
-     measures were taken:
-     <itemizedlist>
-      <listitem>
-       <para>
-        The <package>pkgs.nextcloud</package>-attribute has been removed and replaced with
-        versioned attributes (currently <package>pkgs.nextcloud17</package> and
-        <package>pkgs.nextcloud18</package>). With this change major-releases can be backported
-        without breaking stuff and to make upgrade-paths easier.
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        Existing setups will be detected using
-        <link linkend="opt-system.stateVersion">system.stateVersion</link>: by default,
-        <package>nextcloud17</package> will be used, but will raise a warning which notes
-        that after that deploy it's recommended to update to the latest stable version
-        (<package>nextcloud18</package>) by declaring the newly introduced setting
-        <link linkend="opt-services.nextcloud.package">services.nextcloud.package</link>.
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        Users with an overlay (e.g. to use <package>nextcloud</package> at version
-        <literal>v18</literal> on <literal>19.09</literal>) will get an evaluation error
-        by default. This is done to ensure that our
-        <link linkend="opt-services.nextcloud.package">package</link>-option doesn't select an
-        older version by accident. It's recommended to use <package>pkgs.nextcloud18</package>
-        or to set <link linkend="opt-services.nextcloud.package">package</link> to
-        <package>pkgs.nextcloud</package> explicitly.
-       </para>
-      </listitem>
-     </itemizedlist>
-    </para>
-    <warning>
-     <para>
-      Please note that if you're coming from <literal>19.03</literal> or older, you have
-      to manually upgrade to <literal>19.09</literal> first to upgrade your server
-      to Nextcloud v16.
-     </para>
-    </warning>
-   </listitem>
-   <listitem>
-    <para>
-     <package>Hydra</package> has gained a massive performance improvement due to
-     <link xlink:href="https://github.com/NixOS/hydra/pull/710">some database schema
-     changes</link> by adding several IDs and better indexing. However, it's necessary
-     to upgrade Hydra in multiple steps:
-     <itemizedlist>
-      <listitem>
-       <para>
-        At first, an older version of Hydra needs to be deployed which adds those
-        (nullable) columns. When having set <link linkend="opt-system.stateVersion">stateVersion
-        </link> to a value older than <literal>20.03</literal>, this package will be selected
-        by default from the module when upgrading. Otherwise, the package can be deployed using
-        the following config:
-<programlisting>{ pkgs, ... }: {
-  <link linkend="opt-services.hydra.package">services.hydra.package</link> = pkgs.hydra-migration;
-}</programlisting>
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        Automatically fill the newly added ID columns on the server by running the following
-        command:
-<screen>
-<prompt>$ </prompt>hydra-backfill-ids
-</screen>
-        <warning>
-         <para>Please note that this process can take a while depending on your database-size!</para>
-        </warning>
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        Deploy a newer version of Hydra to activate the DB optimizations. This can be done by
-        using <package>hydra-unstable</package>. This package already includes
-        <link xlink:href="https://github.com/nixos/rfcs/pull/49">flake-support</link> and is
-        therefore compiled against <package>pkgs.nixFlakes</package>.
-        <warning>
-         <para>
-          If your <link linkend="opt-system.stateVersion">stateVersion</link> is set to
-          <literal>20.03</literal> or greater, <package>hydra-unstable</package> will be used
-          automatically! This will break your setup if you didn't run the migration.
-         </para>
-        </warning>
-        Please note that Hydra is currently not available with <package>nixStable</package>
-        as this doesn't compile anymore.
-       </para>
-      </listitem>
-     </itemizedlist>
-     <warning>
-      <para>
-       <package>pkgs.hydra</package> has been removed to ensure a graceful database-migration
-       using the dedicated package-attributes. If you still have <package>pkgs.hydra</package>
-       defined in e.g. an overlay, an assertion error will be thrown. To circumvent this,
-       you need to set <xref linkend="opt-services.hydra.package" /> to <package>pkgs.hydra</package>
-       explicitly and make sure you know what you're doing!
-      </para>
-     </warning>
-    </para>
-   </listitem>
-   <listitem>
-     <para>
-       The TokuDB storage engine will be disabled in <package>mariadb</package> 10.5. It is recommended to switch
-       to RocksDB. See also <link xlink:href="https://mariadb.com/kb/en/tokudb/">TokuDB</link>.
-     </para>
-   </listitem>
-  </itemizedlist>
- </section>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-20.03-notable-changes">
-  <title>Other Notable Changes</title>
-
-  <itemizedlist>
-   <listitem>
-     <para>SD images are now compressed by default using <literal>bzip2</literal>.</para>
-   </listitem>
-   <listitem>
-    <para>
-     The nginx web server previously started its master process as root
-     privileged, then ran worker processes as a less privileged identity user
-     (the <literal>nginx</literal> user).
-     This was changed to start all of nginx as a less privileged user (defined by
-     <literal>services.nginx.user</literal> and
-     <literal>services.nginx.group</literal>). As a consequence, all files that
-     are needed for nginx to run (included configuration fragments, SSL
-     certificates and keys, etc.) must now be readable by this less privileged
-     user/group.
-    </para>
-    <para>
-     To continue to use the old approach, you can configure:
-      <programlisting>
-services.nginx.appendConfig = let cfg = config.services.nginx; in ''user ${cfg.user} ${cfg.group};'';
-systemd.services.nginx.serviceConfig.User = lib.mkForce "root";
-      </programlisting>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     OpenSSH has been upgraded from 7.9 to 8.1, improving security and adding features
-     but with potential incompatibilities.  Consult the
-     <link xlink:href="https://www.openssh.com/txt/release-8.1">
-     release announcement</link> for more information.
-    </para>
-   </listitem>
-   <listitem>
-     <para>
-       <literal>PRETTY_NAME</literal> in <literal>/etc/os-release</literal>
-       now uses the short rather than full version string.
-     </para>
-   </listitem>
-   <listitem>
-    <para>
-     The ACME module has switched from simp-le to <link xlink:href="https://github.com/go-acme/lego">lego</link>
-     which allows us to support DNS-01 challenges and wildcard certificates. The following options have been added:
-     <link linkend="opt-security.acme.acceptTerms">security.acme.acceptTerms</link>,
-     <link linkend="opt-security.acme.certs">security.acme.certs.&lt;name&gt;.dnsProvider</link>,
-     <link linkend="opt-security.acme.certs">security.acme.certs.&lt;name&gt;.credentialsFile</link>,
-     <link linkend="opt-security.acme.certs">security.acme.certs.&lt;name&gt;.dnsPropagationCheck</link>.
-     As well as this, the options <literal>security.acme.acceptTerms</literal> and either
-     <literal>security.acme.email</literal> or <literal>security.acme.certs.&lt;name&gt;.email</literal>
-     must be set in order to use the ACME module.
-     Certificates will be regenerated on activation, no account or certificate will be migrated from simp-le.
-     In particular private keys will not be preserved. However, the credentials for simp-le are preserved and
-     thus it is possible to roll back to previous versions without breaking certificate generation.
-     Note also that in contrary to simp-le a new private key is recreated at each renewal by default, which can
-     have consequences if you embed your public key in apps.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-    It is now possible to unlock LUKS-Encrypted file systems using a FIDO2 token
-    via <option>boot.initrd.luks.fido2Support</option>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Predictably named network interfaces get renamed in stage-1. This means that it is possible
-     to use the proper interface name for e.g. Dropbear setups.
-    </para>
-    <para>
-     For further reference, please read <link xlink:href="https://github.com/NixOS/nixpkgs/pull/68953">#68953</link> or the corresponding <link xlink:href="https://discourse.nixos.org/t/predictable-network-interface-names-in-initrd/4055">discourse thread</link>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <package>matrix-synapse</package>-package has been updated to
-     <link xlink:href="https://github.com/matrix-org/synapse/releases/tag/v1.11.1">v1.11.1</link>.
-     Due to <link xlink:href="https://github.com/matrix-org/synapse/releases/tag/v1.10.0rc1">stricter requirements</link>
-     for database configuration when using <package>postgresql</package>, the automated database setup
-     of the module has been removed to avoid any further edge-cases.
-    </para>
-    <para>
-     <package>matrix-synapse</package> expects <literal>postgresql</literal>-databases to have the options
-     <literal>LC_COLLATE</literal> and <literal>LC_CTYPE</literal> set to
-     <link xlink:href="https://www.postgresql.org/docs/12/locale.html"><literal>'C'</literal></link> which basically
-     instructs <literal>postgresql</literal> to ignore any locale-based preferences.
-    </para>
-    <para>
-     Depending on your setup, you need to incorporate one of the following changes in your setup to
-     upgrade to 20.03:
-     <itemizedlist>
-      <listitem><para>If you use <literal>sqlite3</literal> you don't need to do anything.</para></listitem>
-      <listitem><para>If you use <literal>postgresql</literal> on a different server, you don't need
-       to change anything as well since this module was never designed to configure remote databases.
-      </para></listitem>
-      <listitem><para>If you use <literal>postgresql</literal> and configured your synapse initially on
-       <literal>19.09</literal> or older, you simply need to enable <package>postgresql</package>-support
-        explicitly:
-<programlisting>{ ... }: {
-  services.matrix-synapse = {
-    <link linkend="opt-services.matrix-synapse.enable">enable</link> = true;
-    /* and all the other config you've defined here */
-  };
-  <link linkend="opt-services.postgresql.enable">services.postgresql.enable</link> = true;
-}</programlisting>
-      </para></listitem>
-      <listitem><para>If you deploy a fresh <package>matrix-synapse</package>, you need to configure
-       the database yourself (e.g. by using the
-       <link linkend="opt-services.postgresql.initialScript">services.postgresql.initialScript</link>
-       option). An example for this can be found in the
-       <link linkend="module-services-matrix">documentation of the Matrix module</link>.
-      </para></listitem>
-      <listitem><para>If you initially deployed your <package>matrix-synapse</package> on
-       <literal>nixos-unstable</literal> <emphasis>after</emphasis> the <literal>19.09</literal>-release,
-       your database is misconfigured due to a regression in NixOS. For now, <package>matrix-synapse</package> will
-       startup with a warning, but it's recommended to reconfigure the database to set the values
-       <literal>LC_COLLATE</literal> and <literal>LC_CTYPE</literal> to
-       <link xlink:href="https://www.postgresql.org/docs/12/locale.html"><literal>'C'</literal></link>.
-      </para></listitem>
-     </itemizedlist>
-    </para>
-  </listitem>
-  <listitem>
-   <para>
-    The <link linkend="opt-systemd.network.links">systemd.network.links</link> option is now respected
-    even when <link linkend="opt-systemd.network.enable">systemd-networkd</link> is disabled.
-    This mirrors the behaviour of systemd - It's udev that parses <literal>.link</literal> files,
-    not <command>systemd-networkd</command>.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    <package>mongodb</package> has been updated to version <literal>3.4.24</literal>.
-    <warning>
-     <para>
-      Please note that <package>mongodb</package> has been relicensed under their own
-      <link xlink:href="https://www.mongodb.com/licensing/server-side-public-license/faq"><literal>
-      sspl</literal></link>-license. Since it's not entirely free and not OSI-approved,
-      it's listed as non-free. This means that Hydra doesn't provide prebuilt
-      <package>mongodb</package>-packages and needs to be built locally.
-     </para>
-    </warning>
-   </para>
-  </listitem>
-  </itemizedlist>
- </section>
-</section>
diff --git a/nixos/doc/manual/release-notes/rl-2009.section.md b/nixos/doc/manual/release-notes/rl-2009.section.md
new file mode 100644
index 000000000000..48059ab07f5e
--- /dev/null
+++ b/nixos/doc/manual/release-notes/rl-2009.section.md
@@ -0,0 +1,745 @@
+# Release 20.09 ("Nightingale", 2020.10/27) {#sec-release-20.09}
+
+Support is planned until the end of June 2021, handing over to 21.05. (Plans [ have shifted](https://github.com/NixOS/rfcs/blob/master/rfcs/0080-nixos-release-schedule.md#core-changes) by two months since release of 20.09.)
+
+## Highlights {#sec-release-20.09-highlights}
+
+In addition to 7349 new, 14442 updated, and 8181 removed packages, this release has the following highlights:
+
+- Core version changes:
+
+  - gcc: 9.2.0 -\> 9.3.0
+
+  - glibc: 2.30 -\> 2.31
+
+  - linux: still defaults to 5.4.x, all supported kernels available
+
+  - mesa: 19.3.5 -\> 20.1.7
+
+- Desktop Environments:
+
+  - plasma5: 5.17.5 -\> 5.18.5
+
+  - kdeApplications: 19.12.3 -\> 20.08.1
+
+  - gnome3: 3.34 -\> 3.36, see its [release notes](https://help.gnome.org/misc/release-notes/3.36/)
+
+  - cinnamon: added at 4.6
+
+  - NixOS now distributes an official [GNOME ISO](https://nixos.org/download.html#nixos-iso)
+
+- Programming Languages and Frameworks:
+
+  - Agda ecosystem was heavily reworked (see more details below)
+
+  - PHP now defaults to PHP 7.4, updated from 7.3
+
+  - PHP 7.2 is no longer supported due to upstream not supporting this version for the entire lifecycle of the 20.09 release
+
+  - Python 3 now defaults to Python 3.8 instead of 3.7
+
+  - Python 3.5 reached its upstream EOL at the end of September 2020: it has been removed from the list of available packages
+
+- Databases and Service Monitoring:
+
+  - MariaDB has been updated to 10.4, MariaDB Galera to 26.4. Please read the related upgrade instructions under [backwards incompatibilities](#sec-release-20.09-incompatibilities) before upgrading.
+
+  - Zabbix now defaults to 5.0, updated from 4.4. Please read related sections under [backwards compatibilities](#sec-release-20.09-incompatibilities) before upgrading.
+
+- Major module changes:
+
+  - Quickly configure a complete, private, self-hosted video conferencing solution with the new Jitsi Meet module.
+
+  - Two new options, [authorizedKeysCommand](options.html#opt-services.openssh.authorizedKeysCommand) and [authorizedKeysCommandUser](options.html#opt-services.openssh.authorizedKeysCommandUser), have been added to the `openssh` module. If you have `AuthorizedKeysCommand` in your [services.openssh.extraConfig](options.html#opt-services.openssh.extraConfig) you should make use of these new options instead.
+
+  - There is a new module for Podman (`virtualisation.podman`), a drop-in replacement for the Docker command line.
+
+  - The new `virtualisation.containers` module manages configuration shared by the CRI-O and Podman modules.
+
+  - Declarative Docker containers are renamed from `docker-containers` to `virtualisation.oci-containers.containers`. This is to make it possible to use `podman` instead of `docker`.
+
+  - The new option [documentation.man.generateCaches](options.html#opt-documentation.man.generateCaches) has been added to automatically generate the `man-db` caches, which are needed by utilities like `whatis` and `apropos`. The caches are generated during the build of the NixOS configuration: since this can be expensive when a large number of packages are installed, the feature is disabled by default.
+
+  - `services.postfix.sslCACert` was replaced by `services.postfix.tlsTrustedAuthorities` which now defaults to system certificate authorities.
+
+  - The various documented workarounds to use steam have been converted to a module. `programs.steam.enable` enables steam, controller support and the workarounds.
+
+  - Support for built-in LCDs in various pieces of Logitech hardware (keyboards and USB speakers). `hardware.logitech.lcd.enable` enables support for all hardware supported by the [g15daemon project](https://sourceforge.net/projects/g15daemon/).
+
+  - The GRUB module gained support for basic password protection, which allows to restrict non-default entries in the boot menu to one or more users. The users and passwords are defined via the option `boot.loader.grub.users`. Note: Password support is only available in GRUB version 2.
+
+- NixOS module changes:
+
+  - The NixOS module system now supports freeform modules as a mix between `types.attrsOf` and `types.submodule`. These allow you to explicitly declare a subset of options while still permitting definitions without an associated option. See [](#sec-freeform-modules) for how to use them.
+
+  - Following its deprecation in 20.03, the Perl NixOS test driver has been removed. All remaining tests have been ported to the Python test framework. Code outside nixpkgs using `make-test.nix` or `testing.nix` needs to be ported to `make-test-python.nix` and `testing-python.nix` respectively.
+
+  - Subordinate GID and UID mappings are now set up automatically for all normal users. This will make container tools like Podman work as non-root users out of the box.
+
+- Starting with this release, the hydra-build-result `nixos-YY.MM` branches no longer exist in the [deprecated nixpkgs-channels repository](https://github.com/nixos/nixpkgs-channels). These branches are now in [the main nixpkgs repository](https://github.com/nixos/nixpkgs).
+
+## New Services {#sec-release-20.09-new-services}
+
+In addition to 1119 new, 118 updated, and 476 removed options; 61 new modules were added since the last release:
+
+- Hardware:
+
+  - [hardware.system76.firmware-daemon.enable](options.html#opt-hardware.system76.firmware-daemon.enable) adds easy support of system76 firmware
+
+  - [hardware.uinput.enable](options.html#opt-hardware.uinput.enable) loads uinput kernel module
+
+  - [hardware.video.hidpi.enable](options.html#opt-hardware.video.hidpi.enable) enable good defaults for HiDPI displays
+
+  - [hardware.wooting.enable](options.html#opt-hardware.wooting.enable) support for Wooting keyboards
+
+  - [hardware.xpadneo.enable](options.html#opt-hardware.xpadneo.enable) xpadneo driver for Xbox One wireless controllers
+
+- Programs:
+
+  - [programs.hamster.enable](options.html#opt-programs.hamster.enable) enable hamster time tracking
+
+  - [programs.steam.enable](options.html#opt-programs.steam.enable) adds easy enablement of steam and related system configuration
+
+- Security:
+
+  - [security.doas.enable](options.html#opt-security.doas.enable) alternative to sudo, allows non-root users to execute commands as root
+
+  - [security.tpm2.enable](options.html#opt-security.tpm2.enable) add Trusted Platform Module 2 support
+
+- System:
+
+  - [boot.initrd.network.openvpn.enable](options.html#opt-boot.initrd.network.openvpn.enable) start an OpenVPN client during initrd boot
+
+- Virtualization:
+
+  - [boot.enableContainers](options.html#opt-boot.enableContainers) use nixos-containers
+
+  - [virtualisation.oci-containers.containers](options.html#opt-virtualisation.oci-containers.containers) run OCI (Docker) containers
+
+  - [virtualisation.podman.enable](options.html#opt-virtualisation.podman.enable) daemonless container engine
+
+- Services:
+
+  - [services.ankisyncd.enable](options.html#opt-services.ankisyncd.enable) Anki sync server
+
+  - [services.bazarr.enable](options.html#opt-services.bazarr.enable) Subtitle manager for Sonarr and Radarr
+
+  - [services.biboumi.enable](options.html#opt-services.biboumi.enable) Biboumi XMPP gateway to IRC
+
+  - [services.blockbook-frontend](options.html#opt-services.blockbook-frontend) Blockbook-frontend, a service for the Trezor wallet
+
+  - [services.cage.enable](options.html#opt-services.cage.enable) Wayland cage service
+
+  - [services.convos.enable](options.html#opt-services.convos.enable) IRC daemon, which can be accessed throught the browser
+
+  - [services.engelsystem.enable](options.html#opt-services.engelsystem.enable) Tool for coordinating volunteers and shifts on large events
+
+  - [services.espanso.enable](options.html#opt-services.espanso.enable) text-expander written in rust
+
+  - [services.foldingathome.enable](options.html#opt-services.foldingathome.enable) Folding\@home client
+
+  - [services.gerrit.enable](options.html#opt-services.gerrit.enable) Web-based team code collaboration tool
+
+  - [services.go-neb.enable](options.html#opt-services.go-neb.enable) Matrix bot
+
+  - [services.hardware.xow.enable](options.html#opt-services.hardware.xow.enable) xow as a systemd service
+
+  - [services.hercules-ci-agent.enable](options.html#opt-services.hercules-ci-agent.enable) Hercules CI build agent
+
+  - [services.jicofo.enable](options.html#opt-services.jicofo.enable) Jitsi Conference Focus, component of Jitsi Meet
+
+  - [services.jirafeau.enable](options.html#opt-services.jirafeau.enable) A web file repository
+
+  - [services.jitsi-meet.enable](options.html#opt-services.jitsi-meet.enable) Secure, simple and scalable video conferences
+
+  - [services.jitsi-videobridge.enable](options.html#opt-services.jitsi-videobridge.enable) Jitsi Videobridge, a WebRTC compatible router
+
+  - [services.jupyterhub.enable](options.html#opt-services.jupyterhub.enable) Jupyterhub development server
+
+  - [services.k3s.enable](options.html#opt-services.k3s.enable) Lightweight Kubernetes distribution
+
+  - [services.magic-wormhole-mailbox-server.enable](options.html#opt-services.magic-wormhole-mailbox-server.enable) Magic Wormhole Mailbox Server
+
+  - [services.malcontent.enable](options.html#opt-services.malcontent.enable) Parental Control support
+
+  - [services.matrix-appservice-discord.enable](options.html#opt-services.matrix-appservice-discord.enable) Matrix and Discord bridge
+
+  - [services.mautrix-telegram.enable](options.html#opt-services.mautrix-telegram.enable) Matrix-Telegram puppeting/relaybot bridge
+
+  - [services.mirakurun.enable](options.html#opt-services.mirakurun.enable) Japanese DTV Tuner Server Service
+
+  - [services.molly-brown.enable](options.html#opt-services.molly-brown.enable) Molly-Brown Gemini server
+
+  - [services.mullvad-vpn.enable](options.html#opt-services.mullvad-vpn.enable) Mullvad VPN daemon
+
+  - [services.ncdns.enable](options.html#opt-services.ncdns.enable) Namecoin to DNS bridge
+
+  - [services.nextdns.enable](options.html#opt-services.nextdns.enable) NextDNS to DoH Proxy service
+
+  - [services.nix-store-gcs-proxy](options.html#opt-services.nix-store-gcs-proxy) Google storage bucket to be used as a nix store
+
+  - [services.onedrive.enable](options.html#opt-services.onedrive.enable) OneDrive sync service
+
+  - [services.pinnwand.enable](options.html#opt-services.pinnwand.enable) Pastebin-like service
+
+  - [services.pixiecore.enable](options.html#opt-services.pixiecore.enable) Manage network booting of machines
+
+  - [services.privacyidea.enable](options.html#opt-services.privacyidea.enable) Privacy authentication server
+
+  - [services.quorum.enable](options.html#opt-services.quorum.enable) Quorum blockchain daemon
+
+  - [services.robustirc-bridge.enable](options.html#opt-services.robustirc-bridge.enable) RobustIRC bridge
+
+  - [services.rss-bridge.enable](options.html#opt-services.rss-bridge.enable) Generate RSS and Atom feeds
+
+  - [services.rtorrent.enable](options.html#opt-services.rtorrent.enable) rTorrent service
+
+  - [services.smartdns.enable](options.html#opt-services.smartdns.enable) SmartDNS DNS server
+
+  - [services.sogo.enable](options.html#opt-services.sogo.enable) SOGo groupware
+
+  - [services.teeworlds.enable](options.html#opt-services.teeworlds.enable) Teeworlds game server
+
+  - [services.torque.mom.enable](options.html#opt-services.torque.mom.enable) torque computing node
+
+  - [services.torque.server.enable](options.html#opt-services.torque.server.enable) torque server
+
+  - [services.tuptime.enable](options.html#opt-services.tuptime.enable) A total uptime service
+
+  - [services.urserver.enable](options.html#opt-services.urserver.enable) X11 remote server
+
+  - [services.wasabibackend.enable](options.html#opt-services.wasabibackend.enable) Wasabi backend service
+
+  - [services.yubikey-agent.enable](options.html#opt-services.yubikey-agent.enable) Yubikey agent
+
+  - [services.zigbee2mqtt.enable](options.html#opt-services.zigbee2mqtt.enable) Zigbee to MQTT bridge
+
+## Backward Incompatibilities {#sec-release-20.09-incompatibilities}
+
+When upgrading from a previous release, please be aware of the following incompatible changes:
+
+- MariaDB has been updated to 10.4, MariaDB Galera to 26.4. Before you upgrade, it would be best to take a backup of your database. For MariaDB Galera Cluster, see [Upgrading from MariaDB 10.3 to MariaDB 10.4 with Galera Cluster](https://mariadb.com/kb/en/upgrading-from-mariadb-103-to-mariadb-104-with-galera-cluster/) instead. Before doing the upgrade read [Incompatible Changes Between 10.3 and 10.4](https://mariadb.com/kb/en/upgrading-from-mariadb-103-to-mariadb-104/#incompatible-changes-between-103-and-104). After the upgrade you will need to run `mysql_upgrade`. MariaDB 10.4 introduces a number of changes to the authentication process, intended to make things easier and more intuitive. See [Authentication from MariaDB 10.4](https://mariadb.com/kb/en/authentication-from-mariadb-104/). unix_socket auth plugin does not use a password, and uses the connecting user\'s UID instead. When a new MariaDB data directory is initialized, two MariaDB users are created and can be used with new unix_socket auth plugin, as well as traditional mysql_native_password plugin: root\@localhost and mysql\@localhost. To actually use the traditional mysql_native_password plugin method, one must run the following:
+
+  ```nix
+  {
+  services.mysql.initialScript = pkgs.writeText "mariadb-init.sql" ''
+    ALTER USER root@localhost IDENTIFIED VIA mysql_native_password USING PASSWORD("verysecret");
+  '';
+  }
+  ```
+
+  When MariaDB data directory is just upgraded (not initialized), the users are not created or modified.
+
+- MySQL server is now started with additional systemd sandbox/hardening options for better security. The PrivateTmp, ProtectHome, and ProtectSystem options may be problematic when MySQL is attempting to read from or write to your filesystem anywhere outside of its own state directory, for example when calling `LOAD DATA INFILE or SELECT * INTO OUTFILE`. In this scenario a variant of the following may be required: - allow MySQL to read from /home and /tmp directories when using `LOAD DATA INFILE`
+
+  ```nix
+  {
+    systemd.services.mysql.serviceConfig.ProtectHome = lib.mkForce "read-only";
+  }
+  ```
+
+  \- allow MySQL to write to custom folder `/var/data` when using `SELECT * INTO OUTFILE`, assuming the mysql user has write access to `/var/data`
+
+  ```nix
+  {
+    systemd.services.mysql.serviceConfig.ReadWritePaths = [ "/var/data" ];
+  }
+  ```
+
+  The MySQL service no longer runs its `systemd` service startup script as `root` anymore. A dedicated non `root` super user account is required for operation. This means users with an existing MySQL or MariaDB database server are required to run the following SQL statements as a super admin user before upgrading:
+
+  ```SQL
+  CREATE USER IF NOT EXISTS 'mysql'@'localhost' identified with unix_socket;
+  GRANT ALL PRIVILEGES ON *.* TO 'mysql'@'localhost' WITH GRANT OPTION;
+  ```
+
+  If you use MySQL instead of MariaDB please replace `unix_socket` with `auth_socket`. If you have changed the value of [services.mysql.user](options.html#opt-services.mysql.user) from the default of `mysql` to a different user please change `'mysql'@'localhost'` to the corresponding user instead.
+
+- Zabbix now defaults to 5.0, updated from 4.4. Please carefully read through [the upgrade guide](https://www.zabbix.com/documentation/current/manual/installation/upgrade/sources) and apply any changes required. Be sure to take special note of the section on [enabling extended range of numeric (float) values](https://www.zabbix.com/documentation/current/manual/installation/upgrade_notes_500#enabling_extended_range_of_numeric_float_values) as you will need to apply this database migration manually.
+
+  If you are using Zabbix Server with a MySQL or MariaDB database you should note that using a character set of `utf8` and a collate of `utf8_bin` has become mandatory with this release. See the upstream [issue](https://support.zabbix.com/browse/ZBX-17357) for further discussion. Before upgrading you should check the character set and collation used by your database and ensure they are correct:
+
+  ```SQL
+  SELECT
+    default_character_set_name,
+    default_collation_name
+  FROM
+    information_schema.schemata
+  WHERE
+    schema_name = 'zabbix';
+  ```
+
+  If these values are not correct you should take a backup of your database and convert the character set and collation as required. Here is an [example](https://www.zabbix.com/forum/zabbix-help/396573-reinstall-after-upgrade?p=396891#post396891) of how to do so, taken from the Zabbix forums:
+
+  ```SQL
+  ALTER DATABASE `zabbix` DEFAULT CHARACTER SET utf8 COLLATE utf8_bin;
+
+  -- the following will produce a list of SQL commands you should subsequently execute
+  SELECT CONCAT("ALTER TABLE ", TABLE_NAME," CONVERT TO CHARACTER SET utf8 COLLATE utf8_bin;") AS ExecuteTheString
+  FROM information_schema.`COLUMNS`
+  WHERE table_schema = "zabbix" AND COLLATION_NAME = "utf8_general_ci";
+  ```
+
+- maxx package removed along with `services.xserver.desktopManager.maxx` module. Please migrate to cdesktopenv and `services.xserver.desktopManager.cde` module.
+
+- The [matrix-synapse](options.html#opt-services.matrix-synapse.enable) module no longer includes optional dependencies by default, they have to be added through the [plugins](options.html#opt-services.matrix-synapse.plugins) option.
+
+- `buildGoModule` now internally creates a vendor directory in the source tree for downloaded modules instead of using go\'s [module proxy protocol](https://golang.org/cmd/go/#hdr-Module_proxy_protocol). This storage format is simpler and therefore less likely to break with future versions of go. As a result `buildGoModule` switched from `modSha256` to the `vendorSha256` attribute to pin fetched version data.
+
+- Grafana is now built without support for phantomjs by default. Phantomjs support has been [deprecated in Grafana](https://grafana.com/docs/grafana/latest/guides/whats-new-in-v6-4/) and the phantomjs project is [currently unmaintained](https://github.com/ariya/phantomjs/issues/15344#issue-302015362). It can still be enabled by providing `phantomJsSupport = true` to the package instantiation:
+
+  ```nix
+  {
+    services.grafana.package = pkgs.grafana.overrideAttrs (oldAttrs: rec {
+      phantomJsSupport = true;
+    });
+  }
+  ```
+
+- The [supybot](options.html#opt-services.supybot.enable) module now uses `/var/lib/supybot` as its default [stateDir](options.html#opt-services.supybot.stateDir) path if `stateVersion` is 20.09 or higher. It also enables a number of [systemd sandboxing options](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Sandboxing) which may possibly interfere with some plugins. If this is the case you can disable the options through attributes in `systemd.services.supybot.serviceConfig`.
+
+- The `security.duosec.skey` option, which stored a secret in the nix store, has been replaced by a new [security.duosec.secretKeyFile](options.html#opt-security.duosec.secretKeyFile) option for better security.
+
+  `security.duosec.ikey` has been renamed to [security.duosec.integrationKey](options.html#opt-security.duosec.integrationKey).
+
+- `vmware` has been removed from the `services.x11.videoDrivers` defaults. For VMWare guests set `virtualisation.vmware.guest.enable` to `true` which will include the appropriate drivers.
+
+- The initrd SSH support now uses OpenSSH rather than Dropbear to allow the use of Ed25519 keys and other OpenSSH-specific functionality. Host keys must now be in the OpenSSH format, and at least one pre-generated key must be specified.
+
+  If you used the `boot.initrd.network.ssh.host*Key` options, you\'ll get an error explaining how to convert your host keys and migrate to the new `boot.initrd.network.ssh.hostKeys` option. Otherwise, if you don\'t have any host keys set, you\'ll need to generate some; see the `hostKeys` option documentation for instructions.
+
+- Since this release there\'s an easy way to customize your PHP install to get a much smaller base PHP with only wanted extensions enabled. See the following snippet installing a smaller PHP with the extensions `imagick`, `opcache`, `pdo` and `pdo_mysql` loaded:
+
+  ```nix
+  {
+    environment.systemPackages = [
+      (pkgs.php.withExtensions
+        ({ all, ... }: with all; [
+          imagick
+          opcache
+          pdo
+          pdo_mysql
+        ])
+      )
+    ];
+  }
+  ```
+
+  The default `php` attribute hasn\'t lost any extensions. The `opcache` extension has been added. All upstream PHP extensions are available under php.extensions.\<name?\>.
+
+  All PHP `config` flags have been removed for the following reasons:
+
+- The updated `php` attribute is now easily customizable to your liking by using `php.withExtensions` or `php.buildEnv` instead of writing config files or changing configure flags.
+
+- The remaining configuration flags can now be set directly on the `php` attribute. For example, instead of
+
+  ```nix
+  {
+    php.override {
+      config.php.embed = true;
+      config.php.apxs2 = false;
+    }
+  }
+  ```
+
+  you should now write
+
+  ```nix
+  {
+    php.override {
+      embedSupport = true;
+      apxs2Support = false;
+    }
+  }
+  ```
+
+- The ACME module has been overhauled for simplicity and maintainability. Cert generation now implicitly uses the `acme` user, and the `security.acme.certs._name_.user` option has been removed. Instead, certificate access from other services is now managed through group permissions. The module no longer runs lego twice under certain conditions, and will correctly renew certificates if their configuration is changed. Services which reload nginx and httpd after certificate renewal are now properly configured too so you no longer have to do this manually if you are using HTTPS enabled virtual hosts. A mechanism for regenerating certs on demand has also been added and documented.
+
+- Gollum received a major update to version 5.x and you may have to change some links in your wiki when migrating from gollum 4.x. More information can be found [here](https://github.com/gollum/gollum/wiki/5.0-release-notes#migrating-your-wiki).
+
+- Deluge 2.x was added and is used as default for new NixOS installations where stateVersion is \>= 20.09. If you are upgrading from a previous NixOS version, you can set `service.deluge.package = pkgs.deluge-2_x` to upgrade to Deluge 2.x and migrate the state to the new format. Be aware that backwards state migrations are not supported by Deluge.
+
+- Nginx web server now starting with additional sandbox/hardening options. By default, write access to `/var/log/nginx` and `/var/cache/nginx` is allowed. To allow writing to other folders, use `systemd.services.nginx.serviceConfig.ReadWritePaths`
+
+  ```nix
+  {
+    systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
+  }
+  ```
+
+  Nginx is also started with the systemd option `ProtectHome = mkDefault true;` which forbids it to read anything from `/home`, `/root` and `/run/user` (see [ProtectHome docs](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#ProtectHome=) for details). If you require serving files from home directories, you may choose to set e.g.
+
+  ```nix
+  {
+    systemd.services.nginx.serviceConfig.ProtectHome = "read-only";
+  }
+  ```
+
+- The NixOS options `nesting.clone` and `nesting.children` have been deleted, and replaced with named [specialisation](options.html#opt-specialisation) configurations.
+
+  Replace a `nesting.clone` entry with:
+
+  ```nix
+  {
+    specialisation.example-sub-configuration = {
+      configuration = {
+        ...
+      };
+  };
+  ```
+
+  Replace a `nesting.children` entry with:
+
+  ```nix
+  {
+    specialisation.example-sub-configuration = {
+      inheritParentConfig = false;
+      configuration = {
+        ...
+      };
+  };
+  ```
+
+  To switch to a specialised configuration at runtime you need to run:
+
+  ```ShellSession
+  $ sudo /run/current-system/specialisation/example-sub-configuration/bin/switch-to-configuration test
+  ```
+
+  Before you would have used:
+
+  ```ShellSession
+  $ sudo /run/current-system/fine-tune/child-1/bin/switch-to-configuration test
+  ```
+
+- The Nginx log directory has been moved to `/var/log/nginx`, the cache directory to `/var/cache/nginx`. The option `services.nginx.stateDir` has been removed.
+
+- The httpd web server previously started its main process as root privileged, then ran worker processes as a less privileged identity user. This was changed to start all of httpd as a less privileged user (defined by [services.httpd.user](options.html#opt-services.httpd.user) and [services.httpd.group](options.html#opt-services.httpd.group)). As a consequence, all files that are needed for httpd to run (included configuration fragments, SSL certificates and keys, etc.) must now be readable by this less privileged user/group.
+
+  The default value for [services.httpd.mpm](options.html#opt-services.httpd.mpm) has been changed from `prefork` to `event`. Along with this change the default value for [services.httpd.virtualHosts.\<name\>.http2](options.html#opt-services.httpd.virtualHosts) has been set to `true`.
+
+- The `systemd-networkd` option `systemd.network.networks.<name>.dhcp.CriticalConnection` has been removed following upstream systemd\'s deprecation of the same. It is recommended to use `systemd.network.networks.<name>.networkConfig.KeepConfiguration` instead. See systemd.network 5 for details.
+
+- The `systemd-networkd` option `systemd.network.networks._name_.dhcpConfig` has been renamed to [systemd.network.networks._name_.dhcpV4Config](options.html#opt-systemd.network.networks._name_.dhcpV4Config) following upstream systemd\'s documentation change. See systemd.network 5 for details.
+
+- In the `picom` module, several options that accepted floating point numbers encoded as strings (for example [services.picom.activeOpacity](options.html#opt-services.picom.activeOpacity)) have been changed to the (relatively) new native `float` type. To migrate your configuration simply remove the quotes around the numbers.
+
+- When using `buildBazelPackage` from Nixpkgs, `flat` hash mode is now used for dependencies instead of `recursive`. This is to better allow using hashed mirrors where needed. As a result, these hashes will have changed.
+
+- The syntax of the PostgreSQL configuration file is now checked at build time. If your configuration includes a file inaccessible inside the build sandbox, set `services.postgresql.checkConfig` to `false`.
+
+- The rkt module has been removed, it was archived by upstream.
+
+- The [Bazaar](https://bazaar.canonical.com) VCS is unmaintained and, as consequence of the Python 2 EOL, the packages `bazaar` and `bazaarTools` were removed. Breezy, the backward compatible fork of Bazaar (see the [announcement](https://www.jelmer.uk/breezy-intro.html)), was packaged as `breezy` and can be used instead.
+
+  Regarding Nixpkgs, `fetchbzr`, `nix-prefetch-bzr` and Bazaar support in Hydra will continue to work through Breezy.
+
+- In addition to the hostname, the fully qualified domain name (FQDN), which consists of `${networking.hostName}` and `${networking.domain}` is now added to `/etc/hosts`, to allow local FQDN resolution, as used by the `hostname --fqdn` command and other applications that try to determine the FQDN. These new entries take precedence over entries from the DNS which could cause regressions in some very specific setups. Additionally the hostname is now resolved to `127.0.0.2` instead of `127.0.1.1` to be consistent with what `nss-myhostname` (from systemd) returns. The old behaviour can e.g. be restored by using `networking.hosts = lib.mkForce { "127.0.1.1" = [ config.networking.hostName ]; };`.
+
+- The hostname (`networking.hostName`) must now be a valid DNS label (see RFC 1035, RFC 1123) and as such must not contain the domain part. This means that the hostname must start with a letter or digit, end with a letter or digit, and have as interior characters only letters, digits, and hyphen. The maximum length is 63 characters. Additionally it is recommended to only use lower-case characters. If (e.g. for legacy reasons) a FQDN is required as the Linux kernel network node hostname (`uname --nodename`) the option `boot.kernel.sysctl."kernel.hostname"` can be used as a workaround (but be aware of the 64 character limit).
+
+- The GRUB specific option `boot.loader.grub.extraInitrd` has been replaced with the generic option `boot.initrd.secrets`. This option creates a secondary initrd from the specified files, rather than using a manually created initrd file. Due to an existing bug with `boot.loader.grub.extraInitrd`, it is not possible to directly boot an older generation that used that option. It is still possible to rollback to that generation if the required initrd file has not been deleted.
+
+- The [DNSChain](https://github.com/okTurtles/dnschain) package and NixOS module have been removed from Nixpkgs as the software is unmaintained and can\'t be built. For more information see issue [\#89205](https://github.com/NixOS/nixpkgs/issues/89205).
+
+- In the `resilio` module, [services.resilio.httpListenAddr](options.html#opt-services.resilio.httpListenAddr) has been changed to listen to `[::1]` instead of `0.0.0.0`.
+
+- `sslh` has been updated to version `1.21`. The `ssl` probe must be renamed to `tls` in [services.sslh.appendConfig](options.html#opt-services.sslh.appendConfig).
+
+- Users of [OpenAFS 1.6](http://openafs.org) must upgrade their services to OpenAFS 1.8! In this release, the OpenAFS package version 1.6.24 is marked broken but can be used during transition to OpenAFS 1.8.x. Use the options `services.openafsClient.packages.module`, `services.openafsClient.packages.programs` and `services.openafsServer.package` to select a different OpenAFS package. OpenAFS 1.6 will be removed in the next release. The package `openafs` and the service options will then silently point to the OpenAFS 1.8 release.
+
+  See also the OpenAFS [Administrator Guide](http://docs.openafs.org/AdminGuide/index.html) for instructions. Beware of the following when updating servers:
+
+  - The storage format of the server key has changed and the key must be converted before running the new release.
+
+  - When updating multiple database servers, turn off the database servers from the highest IP down to the lowest with resting periods in between. Start up in reverse order. Do not concurrently run database servers working with different OpenAFS releases!
+
+  - Update servers first, then clients.
+
+- Radicale\'s default package has changed from 2.x to 3.x. An upgrade checklist can be found [here](https://github.com/Kozea/Radicale/blob/3.0.x/NEWS.md#upgrade-checklist). You can use the newer version in the NixOS service by setting the `package` to `radicale3`, which is done automatically if `stateVersion` is 20.09 or higher.
+
+- `udpt` experienced a complete rewrite from C++ to rust. The configuration format changed from ini to toml. The new configuration documentation can be found at [the official website](https://naim94a.github.io/udpt/config.html) and example configuration is packaged in `${udpt}/share/udpt/udpt.toml`.
+
+- We now have a unified [services.xserver.displayManager.autoLogin](options.html#opt-services.xserver.displayManager.autoLogin) option interface to be used for every display-manager in NixOS.
+
+- The `bitcoind` module has changed to multi-instance, using submodules. Therefore, it is now mandatory to name each instance. To use this new multi-instance config with an existing bitcoind data directory and user, you have to adjust the original config, e.g.:
+
+  ```nix
+  {
+    services.bitcoind = {
+      enable = true;
+      extraConfig = "...";
+      ...
+    };
+  }
+  ```
+
+  To something similar:
+
+  ```nix
+  {
+    services.bitcoind.mainnet = {
+      enable = true;
+      dataDir = "/var/lib/bitcoind";
+      user = "bitcoin";
+      extraConfig = "...";
+      ...
+    };
+  }
+  ```
+
+  The key settings are:
+
+  - `dataDir` - to continue using the same data directory.
+
+  - `user` - to continue using the same user so that bitcoind maintains access to its files.
+
+- Graylog introduced a change in the LDAP server certificate validation behaviour for version 3.3.3 which might break existing setups. When updating Graylog from a version before 3.3.3 make sure to check the Graylog [release info](https://www.graylog.org/post/announcing-graylog-v3-3-3) for information on how to avoid the issue.
+
+- The `dokuwiki` module has changed to multi-instance, using submodules. Therefore, it is now mandatory to name each instance. Moreover, forcing SSL by default has been dropped, so `nginx.forceSSL` and `nginx.enableACME` are no longer set to `true`. To continue using your service with the original SSL settings, you have to adjust the original config, e.g.:
+
+  ```nix
+  {
+    services.dokuwiki = {
+      enable = true;
+      ...
+    };
+  }
+  ```
+
+  To something similar:
+
+  ```nix
+  {
+    services.dokuwiki."mywiki" = {
+      enable = true;
+      nginx = {
+        forceSSL = true;
+        enableACME = true;
+      };
+      ...
+    };
+  }
+  ```
+
+  The base package has also been upgraded to the 2020-07-29 \"Hogfather\" release. Plugins might be incompatible or require upgrading.
+
+- The [services.postgresql.dataDir](options.html#opt-services.postgresql.dataDir) option is now set to `"/var/lib/postgresql/${cfg.package.psqlSchema}"` regardless of your [system.stateVersion](options.html#opt-system.stateVersion). Users with an existing postgresql install that have a [system.stateVersion](options.html#opt-system.stateVersion) of `17.03` or below should double check what the value of their [services.postgresql.dataDir](options.html#opt-services.postgresql.dataDir) option is (`/var/db/postgresql`) and then explicitly set this value to maintain compatibility:
+
+  ```nix
+  {
+    services.postgresql.dataDir = "/var/db/postgresql";
+  }
+  ```
+
+  The postgresql module now expects there to be a database super user account called `postgres` regardless of your [system.stateVersion](options.html#opt-system.stateVersion). Users with an existing postgresql install that have a [system.stateVersion](options.html#opt-system.stateVersion) of `17.03` or below should run the following SQL statements as a database super admin user before upgrading:
+
+  ```SQL
+  CREATE ROLE postgres LOGIN SUPERUSER;
+  ```
+
+- The USBGuard module now removes options and instead hardcodes values for `IPCAccessControlFiles`, `ruleFiles`, and `auditFilePath`. Audit logs can be found in the journal.
+
+- The NixOS module system now evaluates option definitions more strictly, allowing it to detect a larger set of problems. As a result, what previously evaluated may not do so anymore. See [the PR that changed this](https://github.com/NixOS/nixpkgs/pull/82743#issuecomment-674520472) for more info.
+
+- For NixOS configuration options, the type `loaOf`, after its initial deprecation in release 20.03, has been removed. In NixOS and Nixpkgs options using this type have been converted to `attrsOf`. For more information on this change have look at these links: [issue \#1800](https://github.com/NixOS/nixpkgs/issues/1800), [PR \#63103](https://github.com/NixOS/nixpkgs/pull/63103).
+
+- `config.systemd.services.${name}.path` now returns a list of paths instead of a colon-separated string.
+
+- Caddy module now uses Caddy v2 by default. Caddy v1 can still be used by setting [services.caddy.package](options.html#opt-services.caddy.package) to `pkgs.caddy1`.
+
+  New option [services.caddy.adapter](options.html#opt-services.caddy.adapter) has been added.
+
+- The [jellyfin](options.html#opt-services.jellyfin.enable) module will use and stay on the Jellyfin version `10.5.5` if `stateVersion` is lower than `20.09`. This is because significant changes were made to the database schema, and it is highly recommended to backup your instance before upgrading. After making your backup, you can upgrade to the latest version either by setting your `stateVersion` to `20.09` or higher, or set the `services.jellyfin.package` to `pkgs.jellyfin`. If you do not wish to upgrade Jellyfin, but want to change your `stateVersion`, you can set the value of `services.jellyfin.package` to `pkgs.jellyfin_10_5`.
+
+- The `security.rngd` service is now disabled by default. This choice was made because there\'s krngd in the linux kernel space making it (for most usecases) functionally redundent.
+
+- The `hardware.nvidia.optimus_prime.enable` service has been renamed to `hardware.nvidia.prime.sync.enable` and has many new enhancements. Related nvidia prime settings may have also changed.
+
+- The package nextcloud17 has been removed and nextcloud18 was marked as insecure since both of them will [ will be EOL (end of life) within the lifetime of 20.09](https://docs.nextcloud.com/server/19/admin_manual/release_schedule.html).
+
+  It\'s necessary to upgrade to nextcloud19:
+
+  - From nextcloud17, you have to upgrade to nextcloud18 first as Nextcloud doesn\'t allow going multiple major revisions forward in a single upgrade. This is possible by setting [services.nextcloud.package](options.html#opt-services.nextcloud.package) to nextcloud18.
+
+  - From nextcloud18, it\'s possible to directly upgrade to nextcloud19 by setting [services.nextcloud.package](options.html#opt-services.nextcloud.package) to nextcloud19.
+
+- The GNOME desktop manager no longer default installs gnome3.epiphany. It was chosen to do this as it has a usability breaking issue (see issue [\#98819](https://github.com/NixOS/nixpkgs/issues/98819)) that makes it unsuitable to be a default app.
+
+  ::: {.note}
+  Issue [\#98819](https://github.com/NixOS/nixpkgs/issues/98819) is now fixed and gnome3.epiphany is once again installed by default.
+  :::
+
+- If you want to manage the configuration of wpa_supplicant outside of NixOS you must ensure that none of [networking.wireless.networks](options.html#opt-networking.wireless.networks), [networking.wireless.extraConfig](options.html#opt-networking.wireless.extraConfig) or [networking.wireless.userControlled.enable](options.html#opt-networking.wireless.userControlled.enable) is being used or `true`. Using any of those options will cause wpa_supplicant to be started with a NixOS generated configuration file instead of your own.
+
+## Other Notable Changes {#sec-release-20.09-notable-changes}
+
+- SD images are now compressed by default using `zstd`. The compression for ISO images has also been changed to `zstd`, but ISO images are still not compressed by default.
+
+- `services.journald.rateLimitBurst` was updated from `1000` to `10000` to follow the new upstream systemd default.
+
+- The notmuch package move its emacs-related binaries and emacs lisp files to a separate output. They\'re not part of the default `out` output anymore - if you relied on the `notmuch-emacs-mua` binary or the emacs lisp files, access them via the `notmuch.emacs` output. Device tree overlay support was improved in [\#79370](https://github.com/NixOS/nixpkgs/pull/79370) and now uses [hardware.deviceTree.kernelPackage](options.html#opt-hardware.deviceTree.kernelPackage) instead of `hardware.deviceTree.base`. [hardware.deviceTree.overlays](options.html#opt-hardware.deviceTree.overlays) configuration was extended to support `.dts` files with symbols. Device trees can now be filtered by setting [hardware.deviceTree.filter](options.html#opt-hardware.deviceTree.filter) option.
+
+- The default output of `buildGoPackage` is now `$out` instead of `$bin`.
+
+- `buildGoModule` `doCheck` now defaults to `true`.
+
+- Packages built using `buildRustPackage` now use `release` mode for the `checkPhase` by default.
+
+  Please note that Rust packages utilizing a custom build/install procedure (e.g. by using a `Makefile`) or test suites that rely on the structure of the `target/` directory may break due to those assumptions. For further information, please read the Rust section in the Nixpkgs manual.
+
+- The cc- and binutils-wrapper\'s \"infix salt\" and `_BUILD_` and `_TARGET_` user infixes have been replaced with with a \"suffix salt\" and suffixes and `_FOR_BUILD` and `_FOR_TARGET`. This matches the autotools convention for env vars which standard for these things, making interfacing with other tools easier.
+
+- Additional Git documentation (HTML and text files) is now available via the `git-doc` package.
+
+- Default algorithm for ZRAM swap was changed to `zstd`.
+
+- The installer now enables sshd by default. This improves installation on headless machines especially ARM single-board-computer. To login through ssh, either a password or an ssh key must be set for the root user or the nixos user.
+
+- The scripted networking system now uses `.link` files in `/etc/systemd/network` to configure mac address and link MTU, instead of the sometimes buggy `network-link-*` units, which have been removed. Bringing the interface up has been moved to the beginning of the `network-addresses-*` unit. Note this doesn\'t require `systemd-networkd` - it\'s udev that parses `.link` files. Extra care needs to be taken in the presence of [legacy udev rules](https://wiki.debian.org/NetworkInterfaceNames#THE_.22PERSISTENT_NAMES.22_SCHEME) to rename interfaces, as MAC Address and MTU defined in these options can only match on the original link name. In such cases, you most likely want to create a `10-*.link` file through [systemd.network.links](options.html#opt-systemd.network.links) and set both name and MAC Address / MTU there.
+
+- Grafana received a major update to version 7.x. A plugin is now needed for image rendering support, and plugins must now be signed by default. More information can be found [in the Grafana documentation](https://grafana.com/docs/grafana/latest/installation/upgrading/#upgrading-to-v7-0).
+
+- The `hardware.u2f` module, which was installing udev rules was removed, as udev gained native support to handle FIDO security tokens.
+
+- The `services.transmission` module was enhanced with the new options: [services.transmission.credentialsFile](options.html#opt-services.transmission.credentialsFile), [services.transmission.openFirewall](options.html#opt-services.transmission.openFirewall), and [services.transmission.performanceNetParameters](options.html#opt-services.transmission.performanceNetParameters).
+
+  `transmission-daemon` is now started with additional systemd sandbox/hardening options for better security. Please [report](https://github.com/NixOS/nixpkgs/issues) any use case where this is not working well. In particular, the `RootDirectory` option newly set forbids uploading or downloading a torrent outside of the default directory configured at [settings.download-dir](options.html#opt-services.transmission.settings). If you really need Transmission to access other directories, you must include those directories into the `BindPaths` of the service:
+
+  ```nix
+  {
+    systemd.services.transmission.serviceConfig.BindPaths = [ "/path/to/alternative/download-dir" ];
+  }
+  ```
+
+  Also, connection to the RPC (Remote Procedure Call) of `transmission-daemon` is now only available on the local network interface by default. Use:
+
+  ```nix
+  {
+    services.transmission.settings.rpc-bind-address = "0.0.0.0";
+  }
+  ```
+
+  to get the previous behavior of listening on all network interfaces.
+
+- With this release `systemd-networkd` (when enabled through [networking.useNetworkd](options.html#opt-networking.useNetworkd)) has it\'s netlink socket created through a `systemd.socket` unit. This gives us control over socket buffer sizes and other parameters. For larger setups where networkd has to create a lot of (virtual) devices the default buffer size (currently 128MB) is not enough.
+
+  On a machine with \>100 virtual interfaces (e.g., wireguard tunnels, VLANs, ...), that all have to be brought up during system startup, the receive buffer size will spike for a brief period. Eventually some of the message will be dropped since there is not enough (permitted) buffer space available.
+
+  By having `systemd-networkd` start with a netlink socket created by `systemd` we can configure the `ReceiveBufferSize=` parameter in the socket options (i.e. `systemd.sockets.systemd-networkd.socketOptions.ReceiveBufferSize`) without recompiling `systemd-networkd`.
+
+  Since the actual memory requirements depend on hardware, timing, exact configurations etc. it isn\'t currently possible to infer a good default from within the NixOS module system. Administrators are advised to monitor the logs of `systemd-networkd` for `rtnl: kernel receive buffer overrun` spam and increase the memory limit as they see fit.
+
+  Note: Increasing the `ReceiveBufferSize=` doesn\'t allocate any memory. It just increases the upper bound on the kernel side. The memory allocation depends on the amount of messages that are queued on the kernel side of the netlink socket.
+
+- Specifying [mailboxes](options.html#opt-services.dovecot2.mailboxes) in the dovecot2 module as a list is deprecated and will break eval in 21.05. Instead, an attribute-set should be specified where the `name` should be the key of the attribute.
+
+  This means that a configuration like this
+
+  ```nix
+  {
+    services.dovecot2.mailboxes = [
+      { name = "Junk";
+        auto = "create";
+      }
+    ];
+  }
+  ```
+
+  should now look like this:
+
+  ```nix
+  {
+    services.dovecot2.mailboxes = {
+      Junk.auto = "create";
+    };
+  }
+  ```
+
+- netbeans was upgraded to 12.0 and now defaults to OpenJDK 11. This might cause problems if your projects depend on packages that were removed in Java 11.
+
+- nextcloud has been updated to [v19](https://nextcloud.com/blog/nextcloud-hub-brings-productivity-to-home-office/).
+
+  If you have an existing installation, please make sure that you\'re on nextcloud18 before upgrading to nextcloud19 since Nextcloud doesn\'t support upgrades across multiple major versions.
+
+- The `nixos-run-vms` script now deletes the previous run machines states on test startup. You can use the `--keep-vm-state` flag to match the previous behaviour and keep the same VM state between different test runs.
+
+- The [nix.buildMachines](options.html#opt-nix.buildMachines) option is now type-checked. There are no functional changes, however this may require updating some configurations to use correct types for all attributes.
+
+- The `fontconfig` module stopped generating config and cache files for fontconfig 2.10.x, the `/etc/fonts/fonts.conf` now belongs to the latest fontconfig, just like on other Linux distributions, and we will [no longer](https://github.com/NixOS/nixpkgs/pull/95358) be versioning the config directories.
+
+  Fontconfig 2.10.x was removed from Nixpkgs since it hasn't been used in any Nixpkgs package for years now.
+
+- Nginx module `nginxModules.fastcgi-cache-purge` renamed to official name `nginxModules.cache-purge`. Nginx module `nginxModules.ngx_aws_auth` renamed to official name `nginxModules.aws-auth`.
+
+- The option `defaultPackages` was added. It installs the packages perl, rsync and strace for now. They were added unconditionally to `systemPackages` before, but are not strictly necessary for a minimal NixOS install. You can set it to an empty list to have a more minimal system. Be aware that some functionality might still have an impure dependency on those packages, so things might break.
+
+- The `undervolt` option no longer needs to apply its settings every 30s. If they still become undone, open an issue and restore the previous behaviour using `undervolt.useTimer`.
+
+- Agda has been heavily reworked.
+
+  - `agda.mkDerivation` has been heavily changed and is now located at agdaPackages.mkDerivation.
+
+  - New top-level packages agda and `agda.withPackages` have been added, the second of which sets up agda with access to chosen libraries.
+
+  - All agda libraries now live under `agdaPackages`.
+
+  - Many broken libraries have been removed.
+
+  See the [new documentation](https://nixos.org/nixpkgs/manual/#agda) for more information.
+
+- The `deepin` package set has been removed from nixpkgs. It was a work in progress to package the [Deepin Desktop Environment (DDE)](https://www.deepin.org/en/dde/), including libraries, tools and applications, and it was still missing a service to launch the desktop environment. It has shown to no longer be a feasible goal due to reasons discussed in [issue \#94870](https://github.com/NixOS/nixpkgs/issues/94870). The package `netease-cloud-music` has also been removed, as it depends on libraries from deepin.
+
+- The `opendkim` module now uses systemd sandboxing features to limit the exposure of the system towards the opendkim service.
+
+- Kubernetes has been upgraded to 1.19.1, which also means that the golang version to build it has been bumped to 1.15. This may have consequences for your existing clusters and their certificates. Please consider [ the release notes for Kubernetes 1.19 carefully ](https://relnotes.k8s.io/?markdown=93264) before upgrading.
+
+- For AMD GPUs, Vulkan can now be used by adding `amdvlk` to `hardware.opengl.extraPackages`.
+
+- Similarly, still for AMD GPUs, the ROCm OpenCL stack can now be used by adding `rocm-opencl-icd` to `hardware.opengl.extraPackages`.
+
+## Contributions {#sec-release-20.09-contributions}
+
+I, Jonathan Ringer, would like to thank the following individuals for their work on nixpkgs. This release could not be done without the hard work of the NixOS community. There were 31282 contributions across 1313 contributors.
+
+1.  2288 Mario Rodas
+
+2.  1837 Frederik Rietdijk
+
+3.  946 Jörg Thalheim
+
+4.  925 Maximilian Bosch
+
+5.  687 Jonathan Ringer
+
+6.  651 Jan Tojnar
+
+7.  622 Daniël de Kok
+
+8.  605 WORLDofPEACE
+
+9.  597 Florian Klink
+
+10. 528 José Romildo Malaquias
+
+11. 281 volth
+
+12. 101 Robert Scott
+
+13. 86 Tim Steinbach
+
+14. 76 WORLDofPEACE
+
+15. 49 Maximilian Bosch
+
+16. 42 Thomas Tuegel
+
+17. 37 Doron Behar
+
+18. 36 Vladimír Čunát
+
+19. 27 Jonathan Ringer
+
+20. 27 Maciej Krüger
+
+I, Jonathan Ringer, would also like to personally thank \@WORLDofPEACE for their help in mentoring me on the release process. Special thanks also goes to Thomas Tuegel for helping immensely with stabilizing Qt, KDE, and Plasma5; I would also like to thank Robert Scott for his numerous fixes and pull request reviews.
diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml
deleted file mode 100644
index 49446afdead4..000000000000
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ /dev/null
@@ -1,1838 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-20.09">
- <title>Release 20.09 (“Nightingale”, 2020.10/27)</title>
-
-  <para>
-   Support is planned until the end of June 2021, handing over to 21.05.
-   (Plans <link xlink:href="https://github.com/NixOS/rfcs/blob/master/rfcs/0080-nixos-release-schedule.md#core-changes">
-   have shifted</link> by two months since release of 20.09.)
-  </para>
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-20.09-highlights">
-  <title>Highlights</title>
-
-  <para>
-   In addition to 7349 new, 14442 updated, and 8181 removed packages, this release has the
-   following highlights:
-  </para>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     Core version changes:
-    </para>
-    <itemizedlist>
-     <listitem>
-      <para>
-       gcc: 9.2.0 -> 9.3.0
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       glibc: 2.30 -> 2.31
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       linux: still defaults to 5.4.x, all supported kernels available
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       mesa: 19.3.5 -> 20.1.7
-      </para>
-     </listitem>
-    </itemizedlist>
-   </listitem>
-   <listitem>
-    <para>
-     Desktop Environments:
-    </para>
-    <itemizedlist>
-     <listitem>
-      <para>
-       plasma5: 5.17.5 -> 5.18.5
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       kdeApplications: 19.12.3 -> 20.08.1
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       gnome3: 3.34 -> 3.36, see its <link xlink:href="https://help.gnome.org/misc/release-notes/3.36/">release notes</link>
-      </para>
-     </listitem>
-      <listitem>
-       <para>
-        cinnamon: added at 4.6
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       NixOS now distributes an official <link xlink:href="https://nixos.org/download.html#nixos-iso">GNOME ISO</link>
-      </para>
-     </listitem>
-    </itemizedlist>
-   </listitem>
-
-   <listitem>
-    <para>
-     Programming Languages and Frameworks:
-    </para>
-    <itemizedlist>
-
-     <listitem>
-      <para>
-       Agda ecosystem was heavily reworked (see more details below)
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       PHP now defaults to PHP 7.4, updated from 7.3
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       PHP 7.2 is no longer supported due to upstream not supporting this version for the entire lifecycle of the 20.09 release
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       Python 3 now defaults to Python 3.8 instead of 3.7
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       Python 3.5 reached its upstream EOL at the end of September 2020: it
-       has been removed from the list of available packages
-      </para>
-     </listitem>
-    </itemizedlist>
-   </listitem>
-
-   <listitem>
-    <para>
-     Databases and Service Monitoring:
-    </para>
-    <itemizedlist>
-     <listitem>
-      <para>
-       MariaDB has been updated to 10.4, MariaDB Galera to 26.4. Please read the related upgrade instructions under <link linkend="sec-release-20.09-incompatibilities">backwards incompatibilities</link> before upgrading.
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-        Zabbix now defaults to 5.0, updated from 4.4. Please read related sections under <link linkend="sec-release-20.09-incompatibilities">backwards compatibilities</link> before upgrading.
-      </para>
-     </listitem>
-    </itemizedlist>
-   </listitem>
-
-   <listitem>
-    <para>
-     Major module changes:
-    </para>
-    <itemizedlist>
-     <listitem>
-      <para>
-       Quickly configure a complete, private, self-hosted video
-       conferencing solution with the new Jitsi Meet module.
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       Two new options, <link linkend="opt-services.openssh.authorizedKeysCommand">authorizedKeysCommand</link>
-       and <link linkend="opt-services.openssh.authorizedKeysCommandUser">authorizedKeysCommandUser</link>, have
-       been added to the <literal>openssh</literal> module. If you have <literal>AuthorizedKeysCommand</literal>
-       in your <link linkend="opt-services.openssh.extraConfig">services.openssh.extraConfig</link> you should
-       make use of these new options instead.
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       There is a new module for Podman (<varname>virtualisation.podman</varname>), a drop-in replacement for the Docker command line.
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       The new <varname>virtualisation.containers</varname> module manages configuration shared by the CRI-O and Podman modules.
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-        Declarative Docker containers are renamed from <varname>docker-containers</varname> to <varname>virtualisation.oci-containers.containers</varname>.
-        This is to make it possible to use <literal>podman</literal> instead of <literal>docker</literal>.
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-        The new option <link linkend="opt-documentation.man.generateCaches">documentation.man.generateCaches</link>
-        has been added to automatically generate the <literal>man-db</literal> caches, which are needed by utilities
-        like <command>whatis</command> and <command>apropos</command>. The caches are generated during the build of
-        the NixOS configuration: since this can be expensive when a large number of packages are installed, the
-        feature is disabled by default.
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <varname>services.postfix.sslCACert</varname> was replaced by <varname>services.postfix.tlsTrustedAuthorities</varname> which now defaults to system certificate authorities.
-      </para>
-     </listitem>
-     <listitem>
-       <para>
-         The various documented workarounds to use steam have been converted to a module. <varname>programs.steam.enable</varname> enables steam, controller support and the workarounds.
-       </para>
-     </listitem>
-     <listitem>
-       <para>
-         Support for built-in LCDs in various pieces of Logitech hardware (keyboards and USB speakers). <varname>hardware.logitech.lcd.enable</varname> enables support for all hardware supported by the <link xlink:href="https://sourceforge.net/projects/g15daemon/">g15daemon project</link>.
-       </para>
-     </listitem>
-     <listitem>
-       <para>
-         The GRUB module gained support for basic password protection, which
-         allows to restrict non-default entries in the boot menu to one or more
-         users. The users and passwords are defined via the option
-         <option>boot.loader.grub.users</option>.
-         Note: Password support is only available in GRUB version 2.
-       </para>
-     </listitem>
-    </itemizedlist>
-   </listitem>
-
-   <listitem>
-    <para>
-     NixOS module changes:
-    </para>
-    <itemizedlist>
-     <listitem>
-       <para>
-        The NixOS module system now supports freeform modules as a mix between <literal>types.attrsOf</literal> and <literal>types.submodule</literal>. These allow you to explicitly declare a subset of options while still permitting definitions without an associated option. See <xref linkend='sec-freeform-modules'/> for how to use them.
-       </para>
-     </listitem>
-     <listitem>
-      <para>
-       Following its deprecation in 20.03, the Perl NixOS test driver has been removed.
-       All remaining tests have been ported to the Python test framework.
-       Code outside nixpkgs using <filename>make-test.nix</filename> or
-       <filename>testing.nix</filename> needs to be ported to
-       <filename>make-test-python.nix</filename> and
-       <filename>testing-python.nix</filename> respectively.
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-        Subordinate GID and UID mappings are now set up automatically for all normal users.
-        This will make container tools like Podman work as non-root users out of the box.
-      </para>
-     </listitem>
-    </itemizedlist>
-   </listitem>
-   <listitem>
-    <para>
-     Starting with this release, the hydra-build-result
-     <literal>nixos-<replaceable>YY.MM</replaceable></literal>
-     branches no longer exist in the <link
-     xlink:href="https://github.com/nixos/nixpkgs-channels">deprecated
-     nixpkgs-channels repository</link>.  These branches are now in
-     <link xlink:href="https://github.com/nixos/nixpkgs">the main nixpkgs
-     repository</link>.
-    </para>
-   </listitem>
-  </itemizedlist>
- </section>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-20.09-new-services">
-  <title>New Services</title>
-
-  <para>
-   In addition to 1119 new, 118 updated, and 476 removed options; 61 new modules were added since the last release:
-  </para>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-       Hardware:
-    </para>
-    <itemizedlist>
-     <listitem>
-      <para>
-       <xref linkend="opt-hardware.system76.firmware-daemon.enable" /> adds easy support of system76 firmware
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-hardware.uinput.enable" /> loads uinput kernel module
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-hardware.video.hidpi.enable" /> enable good defaults for HiDPI displays
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-hardware.wooting.enable" /> support for Wooting keyboards
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-hardware.xpadneo.enable" /> xpadneo driver for Xbox One wireless controllers
-      </para>
-     </listitem>
-    </itemizedlist>
-   </listitem>
-   <listitem>
-    <para>
-       Programs:
-    </para>
-    <itemizedlist>
-     <listitem>
-      <para>
-       <xref linkend="opt-programs.hamster.enable" /> enable hamster time tracking
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-programs.steam.enable" /> adds easy enablement of steam and related system configuration
-      </para>
-     </listitem>
-    </itemizedlist>
-   </listitem>
-   <listitem>
-    <para>
-       Security:
-    </para>
-    <itemizedlist>
-     <listitem>
-      <para>
-       <xref linkend="opt-security.doas.enable" /> alternative to sudo, allows non-root users to execute commands as root
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-security.tpm2.enable" /> add Trusted Platform Module 2 support
-      </para>
-     </listitem>
-    </itemizedlist>
-   </listitem>
-   <listitem>
-    <para>
-       System:
-    </para>
-    <itemizedlist>
-     <listitem>
-      <para>
-       <xref linkend="opt-boot.initrd.network.openvpn.enable" /> start an OpenVPN client during initrd boot
-      </para>
-     </listitem>
-    </itemizedlist>
-   </listitem>
-   <listitem>
-    <para>
-       Virtualization:
-    </para>
-    <itemizedlist>
-     <listitem>
-      <para>
-       <xref linkend="opt-boot.enableContainers" /> use nixos-containers
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-virtualisation.oci-containers.containers" /> run OCI (Docker) containers
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-virtualisation.podman.enable" /> daemonless container engine
-      </para>
-     </listitem>
-    </itemizedlist>
-   </listitem>
-
-   <listitem>
-    <para>
-       Services:
-    </para>
-    <itemizedlist>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.ankisyncd.enable" /> Anki sync server
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.bazarr.enable" /> Subtitle manager for Sonarr and Radarr
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.biboumi.enable" /> Biboumi XMPP gateway to IRC
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.blockbook-frontend" /> Blockbook-frontend, a service for the Trezor wallet
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.cage.enable" /> Wayland cage service
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.convos.enable" /> IRC daemon, which can be accessed throught the browser
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.engelsystem.enable" /> Tool for coordinating volunteers and shifts on large events
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.espanso.enable" /> text-expander written in rust
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.foldingathome.enable" /> Folding@home client
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.gerrit.enable" /> Web-based team code collaboration tool
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.go-neb.enable" /> Matrix bot
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.hardware.xow.enable" /> xow as a systemd service
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.hercules-ci-agent.enable" /> Hercules CI build agent
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.jicofo.enable" /> Jitsi Conference Focus, component of Jitsi Meet
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.jirafeau.enable" /> A web file repository
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.jitsi-meet.enable" /> Secure, simple and scalable video conferences
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.jitsi-videobridge.enable" /> Jitsi Videobridge, a WebRTC compatible router
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.jupyterhub.enable" /> Jupyterhub development server
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.k3s.enable" /> Lightweight Kubernetes distribution
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.magic-wormhole-mailbox-server.enable" /> Magic Wormhole Mailbox Server
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.malcontent.enable" /> Parental Control support
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.matrix-appservice-discord.enable" /> Matrix and Discord bridge
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.mautrix-telegram.enable" /> Matrix-Telegram puppeting/relaybot bridge
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.mirakurun.enable" /> Japanese DTV Tuner Server Service
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.molly-brown.enable" /> Molly-Brown Gemini server
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.mullvad-vpn.enable" /> Mullvad VPN daemon
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.ncdns.enable" /> Namecoin to DNS bridge
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.nextdns.enable" /> NextDNS to DoH Proxy service
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.nix-store-gcs-proxy" /> Google storage bucket to be used as a nix store
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.onedrive.enable" /> OneDrive sync service
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.pinnwand.enable" /> Pastebin-like service
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.pixiecore.enable" /> Manage network booting of machines
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.privacyidea.enable" /> Privacy authentication server
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.quorum.enable" /> Quorum blockchain daemon
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.robustirc-bridge.enable" /> RobustIRC bridge
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.rss-bridge.enable" /> Generate RSS and Atom feeds
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.rtorrent.enable" /> rTorrent service
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.smartdns.enable" /> SmartDNS DNS server
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.sogo.enable" /> SOGo groupware
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.teeworlds.enable" /> Teeworlds game server
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.torque.mom.enable" /> torque computing node
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.torque.server.enable" /> torque server
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.tuptime.enable" /> A total uptime service
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.urserver.enable" /> X11 remote server
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.wasabibackend.enable" /> Wasabi backend service
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.yubikey-agent.enable" /> Yubikey agent
-      </para>
-     </listitem>
-     <listitem>
-      <para>
-       <xref linkend="opt-services.zigbee2mqtt.enable" /> Zigbee to MQTT bridge
-      </para>
-     </listitem>
-    </itemizedlist>
-   </listitem>
-
-  </itemizedlist>
-
- </section>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-20.09-incompatibilities">
-  <title>Backward Incompatibilities</title>
-
-  <para>
-   When upgrading from a previous release, please be aware of the following
-   incompatible changes:
-  </para>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-      MariaDB has been updated to 10.4, MariaDB Galera to 26.4.
-      Before you upgrade, it would be best to take a backup of your database.
-      For MariaDB Galera Cluster, see <link xlink:href="https://mariadb.com/kb/en/upgrading-from-mariadb-103-to-mariadb-104-with-galera-cluster/">Upgrading
-      from MariaDB 10.3 to MariaDB 10.4 with Galera Cluster</link> instead.
-      Before doing the upgrade read <link xlink:href="https://mariadb.com/kb/en/upgrading-from-mariadb-103-to-mariadb-104/#incompatible-changes-between-103-and-104">Incompatible
-      Changes Between 10.3 and 10.4</link>.
-      After the upgrade you will need to run <literal>mysql_upgrade</literal>.
-      MariaDB 10.4 introduces a number of changes to the authentication process, intended to make things easier and more
-      intuitive. See <link xlink:href="https://mariadb.com/kb/en/authentication-from-mariadb-104/">Authentication from MariaDB 10.4</link>.
-      unix_socket auth plugin does not use a password, and uses the connecting user's UID instead. When a new MariaDB data directory is initialized, two MariaDB users are
-      created and can be used with new unix_socket auth plugin, as well as traditional mysql_native_password plugin: root@localhost and mysql@localhost. To actually use
-      the traditional mysql_native_password plugin method, one must run the following:
-<programlisting>
-services.mysql.initialScript = pkgs.writeText "mariadb-init.sql" ''
-  ALTER USER root@localhost IDENTIFIED VIA mysql_native_password USING PASSWORD("verysecret");
-'';
-</programlisting>
-      When MariaDB data directory is just upgraded (not initialized), the users are not created or modified.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      MySQL server is now started with additional systemd sandbox/hardening options for better security. The PrivateTmp, ProtectHome, and ProtectSystem options
-      may be problematic when MySQL is attempting to read from or write to your filesystem anywhere outside of its own state directory, for example when
-      calling <literal>LOAD DATA INFILE or SELECT * INTO OUTFILE</literal>. In this scenario a variant of the following may be required:
-        - allow MySQL to read from /home and /tmp directories when using <literal>LOAD DATA INFILE</literal>
-<programlisting>
-systemd.services.mysql.serviceConfig.ProtectHome = lib.mkForce "read-only";
-</programlisting>
-        - allow MySQL to write to custom folder <literal>/var/data</literal> when using <literal>SELECT * INTO OUTFILE</literal>, assuming the mysql user has write
-          access to <literal>/var/data</literal>
-<programlisting>
-systemd.services.mysql.serviceConfig.ReadWritePaths = [ "/var/data" ];
-</programlisting>
-    </para>
-    <para>
-      The MySQL service no longer runs its <literal>systemd</literal> service startup script as <literal>root</literal> anymore. A dedicated non <literal>root</literal>
-      super user account is required for operation. This means users with an existing MySQL or MariaDB database server are required to run the following SQL statements
-      as a super admin user before upgrading:
-<programlisting>
-CREATE USER IF NOT EXISTS 'mysql'@'localhost' identified with unix_socket;
-GRANT ALL PRIVILEGES ON *.* TO 'mysql'@'localhost' WITH GRANT OPTION;
-</programlisting>
-      If you use MySQL instead of MariaDB please replace <literal>unix_socket</literal> with <literal>auth_socket</literal>. If you have changed the value of <xref linkend="opt-services.mysql.user"/>
-      from the default of <literal>mysql</literal> to a different user please change <literal>'mysql'@'localhost'</literal> to the corresponding user instead.
-    </para>
-   </listitem>
-
-   <listitem>
-    <para>
-      Zabbix now defaults to 5.0, updated from 4.4. Please carefully read through
-      <link xlink:href="https://www.zabbix.com/documentation/current/manual/installation/upgrade/sources">the upgrade guide</link>
-      and apply any changes required. Be sure to take special note of the section on
-      <link xlink:href="https://www.zabbix.com/documentation/current/manual/installation/upgrade_notes_500#enabling_extended_range_of_numeric_float_values">enabling extended range of numeric (float) values</link>
-      as you will need to apply this database migration manually.
-    </para>
-    <para>
-      If you are using Zabbix Server with a MySQL or MariaDB database you should note that using a character set of <literal>utf8</literal> and a collate of <literal>utf8_bin</literal> has become mandatory with
-      this release. See the upstream <link xlink:href="https://support.zabbix.com/browse/ZBX-17357">issue</link> for further discussion. Before upgrading you should check the character set and collation used by
-      your database and ensure they are correct:
-<programlisting>
-  SELECT
-    default_character_set_name,
-    default_collation_name
-  FROM
-    information_schema.schemata
-  WHERE
-    schema_name = 'zabbix';
-</programlisting>
-      If these values are not correct you should take a backup of your database and convert the character set and collation as required. Here is an
-      <link xlink:href="https://www.zabbix.com/forum/zabbix-help/396573-reinstall-after-upgrade?p=396891#post396891">example</link> of how to do so, taken from
-      the Zabbix forums:
-<programlisting>
-  ALTER DATABASE `zabbix` DEFAULT CHARACTER SET utf8 COLLATE utf8_bin;
-
-  -- the following will produce a list of SQL commands you should subsequently execute
-  SELECT CONCAT("ALTER TABLE ", TABLE_NAME," CONVERT TO CHARACTER SET utf8 COLLATE utf8_bin;") AS ExecuteTheString
-  FROM information_schema.`COLUMNS`
-  WHERE table_schema = "zabbix" AND COLLATION_NAME = "utf8_general_ci";
-</programlisting>
-    </para>
-   </listitem>
-
-   <listitem>
-    <para>
-    <package>maxx</package> package removed along with <varname>services.xserver.desktopManager.maxx</varname> module.
-    Please migrate to <package>cdesktopenv</package> and <varname>services.xserver.desktopManager.cde</varname> module.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <link linkend="opt-services.matrix-synapse.enable">matrix-synapse</link> module no longer includes optional dependencies by default, they have to be added through the <link linkend="opt-services.matrix-synapse.plugins">plugins</link> option.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>buildGoModule</literal> now internally creates a vendor directory
-     in the source tree for downloaded modules instead of using go's <link
-     xlink:href="https://golang.org/cmd/go/#hdr-Module_proxy_protocol">module
-     proxy protocol</link>. This storage format is simpler and therefore less
-     likely to break with future versions of go. As a result
-     <literal>buildGoModule</literal> switched from
-     <literal>modSha256</literal> to the <literal>vendorSha256</literal>
-     attribute to pin fetched version data.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Grafana is now built without support for phantomjs by default. Phantomjs support has been
-     <link xlink:href="https://grafana.com/docs/grafana/latest/guides/whats-new-in-v6-4/">deprecated in Grafana</link>
-     and the <package>phantomjs</package> project is
-     <link xlink:href="https://github.com/ariya/phantomjs/issues/15344#issue-302015362">currently unmaintained</link>.
-     It can still be enabled by providing <literal>phantomJsSupport = true</literal> to the package instantiation:
-<programlisting>{
-  services.grafana.package = pkgs.grafana.overrideAttrs (oldAttrs: rec {
-    phantomJsSupport = true;
-  });
-}</programlisting>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      The <link linkend="opt-services.supybot.enable">supybot</link> module now uses <literal>/var/lib/supybot</literal>
-      as its default <link linkend="opt-services.supybot.stateDir">stateDir</link> path if <literal>stateVersion</literal>
-      is 20.09 or higher. It also enables a number of
-      <link xlink:href="https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Sandboxing">systemd sandboxing options</link>
-      which may possibly interfere with some plugins. If this is the case you can disable the options through attributes in
-      <option>systemd.services.supybot.serviceConfig</option>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      The <literal>security.duosec.skey</literal> option, which stored a secret in the
-      nix store, has been replaced by a new
-      <link linkend="opt-security.duosec.secretKeyFile">security.duosec.secretKeyFile</link>
-      option for better security.
-    </para>
-    <para>
-      <literal>security.duosec.ikey</literal> has been renamed to
-      <link linkend="opt-security.duosec.integrationKey">security.duosec.integrationKey</link>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      <literal>vmware</literal> has been removed from the <literal>services.x11.videoDrivers</literal> defaults.
-      For VMWare guests set <literal>virtualisation.vmware.guest.enable</literal> to <literal>true</literal> which will include the appropriate drivers.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The initrd SSH support now uses OpenSSH rather than Dropbear to
-     allow the use of Ed25519 keys and other OpenSSH-specific
-     functionality. Host keys must now be in the OpenSSH format, and at
-     least one pre-generated key must be specified.
-    </para>
-    <para>
-     If you used the <option>boot.initrd.network.ssh.host*Key</option>
-     options, you'll get an error explaining how to convert your host
-     keys and migrate to the new
-     <option>boot.initrd.network.ssh.hostKeys</option> option.
-     Otherwise, if you don't have any host keys set, you'll need to
-     generate some; see the <option>hostKeys</option> option
-     documentation for instructions.
-    </para>
-   </listitem>
-   <listitem>
-     <para>
-       Since this release there's an easy way to customize your PHP
-       install to get a much smaller base PHP with only wanted
-       extensions enabled. See the following snippet installing a
-       smaller PHP with the extensions <literal>imagick</literal>,
-       <literal>opcache</literal>, <literal>pdo</literal> and
-       <literal>pdo_mysql</literal> loaded:
-
-       <programlisting>
-environment.systemPackages = [
-  (pkgs.php.withExtensions
-    ({ all, ... }: with all; [
-      imagick
-      opcache
-      pdo
-      pdo_mysql
-    ])
-  )
-];</programlisting>
-
-       The default <literal>php</literal> attribute hasn't lost any
-       extensions. The <literal>opcache</literal> extension has been
-       added.
-
-       All upstream PHP extensions are available under <package><![CDATA[php.extensions.<name?>]]></package>.
-     </para>
-     <para>
-       All PHP <literal>config</literal> flags have been removed for
-       the following reasons:
-
-       <itemizedlist>
-         <listitem>
-           <para>
-             The updated <literal>php</literal> attribute is now easily
-             customizable to your liking by using
-             <literal>php.withExtensions</literal> or
-             <literal>php.buildEnv</literal> instead of writing config files
-             or changing configure flags.
-           </para>
-         </listitem>
-         <listitem>
-           <para>
-             The remaining configuration flags can now be set directly on
-             the <literal>php</literal> attribute. For example, instead of
-
-             <programlisting>
-php.override {
-  config.php.embed = true;
-  config.php.apxs2 = false;
-}
-             </programlisting>
-
-             you should now write
-
-             <programlisting>
-php.override {
-  embedSupport = true;
-  apxs2Support = false;
-}
-             </programlisting>
-           </para>
-         </listitem>
-       </itemizedlist>
-
-     </para>
-   </listitem>
-   <listitem>
-    <para>
-     The ACME module has been overhauled for simplicity and maintainability.
-     Cert generation now implicitly uses the <literal>acme</literal>
-     user, and the <literal>security.acme.certs._name_.user</literal> option
-     has been removed. Instead, certificate access from other services is now
-     managed through group permissions. The module no longer runs lego
-     twice under certain conditions, and will correctly renew certificates if
-     their configuration is changed. Services which reload nginx and httpd after
-     certificate renewal are now properly configured too so you no longer have
-     to do this manually if you are using HTTPS enabled virtual hosts. A mechanism
-     for regenerating certs on demand has also been added and documented.
-    </para>
-   </listitem>
-   <listitem>
-     <para>
-      Gollum received a major update to version 5.x and you may have to change
-      some links in your wiki when migrating from gollum 4.x. More information
-      can be found
-      <link xlink:href="https://github.com/gollum/gollum/wiki/5.0-release-notes#migrating-your-wiki">here</link>.
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       Deluge 2.x was added and is used as default for new NixOS
-       installations where stateVersion is >= 20.09. If you are upgrading from a previous
-       NixOS version, you can set <literal>service.deluge.package = pkgs.deluge-2_x</literal>
-       to upgrade to Deluge 2.x and migrate the state to the new format.
-       Be aware that backwards state migrations are not supported by Deluge.
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       Nginx web server now starting with additional sandbox/hardening options. By default, write access
-       to <literal>/var/log/nginx</literal> and <literal>/var/cache/nginx</literal> is allowed. To allow writing to other folders,
-       use <literal>systemd.services.nginx.serviceConfig.ReadWritePaths</literal>
-       <programlisting>
-systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
-       </programlisting>
-     </para>
-     <para>
-       Nginx is also started with the systemd option <literal>ProtectHome = mkDefault true;</literal>
-       which forbids it to read anything from <literal>/home</literal>, <literal>/root</literal>
-       and <literal>/run/user</literal> (see
-       <link xlink:href="https://www.freedesktop.org/software/systemd/man/systemd.exec.html#ProtectHome=">ProtectHome docs</link>
-       for details).
-       If you require serving files from home directories, you may choose to set e.g.
-<programlisting>
-systemd.services.nginx.serviceConfig.ProtectHome = "read-only";
-</programlisting>
-     </para>
-   </listitem>
-   <listitem>
-    <para>
-      The NixOS options <literal>nesting.clone</literal> and
-      <literal>nesting.children</literal> have been deleted, and
-      replaced with named <xref linkend="opt-specialisation"/>
-      configurations.
-    </para>
-
-    <para>
-      Replace a <literal>nesting.clone</literal> entry with:
-
-<programlisting>{
-<link xlink:href="#opt-specialisation">specialisation.example-sub-configuration</link> = {
-  <link xlink:href="#opt-specialisation._name_.configuration">configuration</link> = {
-    ...
-  };
-};</programlisting>
-
-    </para>
-    <para>
-      Replace a <literal>nesting.children</literal> entry with:
-
-<programlisting>{
-<link xlink:href="#opt-specialisation">specialisation.example-sub-configuration</link> = {
-  <link xlink:href="#opt-specialisation._name_.inheritParentConfig">inheritParentConfig</link> = false;
-  <link xlink:href="#opt-specialisation._name_.configuration">configuration</link> = {
-    ...
-  };
-};</programlisting>
-    </para>
-
-    <para>
-     To switch to a specialised configuration at runtime you need to
-     run:
-<programlisting>
-# sudo /run/current-system/specialisation/example-sub-configuration/bin/switch-to-configuration test
-</programlisting>
-     Before you would have used:
-<programlisting>
-# sudo /run/current-system/fine-tune/child-1/bin/switch-to-configuration test
-</programlisting>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      The Nginx log directory has been moved to <literal>/var/log/nginx</literal>, the cache directory
-      to <literal>/var/cache/nginx</literal>. The option <literal>services.nginx.stateDir</literal> has
-      been removed.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The httpd web server previously started its main process as root
-     privileged, then ran worker processes as a less privileged identity user.
-     This was changed to start all of httpd as a less privileged user (defined by
-     <xref linkend="opt-services.httpd.user"/> and
-     <xref linkend="opt-services.httpd.group"/>). As a consequence, all files that
-     are needed for httpd to run (included configuration fragments, SSL
-     certificates and keys, etc.) must now be readable by this less privileged
-     user/group.
-    </para>
-    <para>
-     The default value for <xref linkend="opt-services.httpd.mpm"/>
-     has been changed from <literal>prefork</literal> to <literal>event</literal>. Along with
-     this change the default value for
-     <link linkend="opt-services.httpd.virtualHosts">services.httpd.virtualHosts.&lt;name&gt;.http2</link>
-     has been set to <literal>true</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      The <literal>systemd-networkd</literal> option
-      <literal>systemd.network.networks.&lt;name&gt;.dhcp.CriticalConnection</literal>
-      has been removed following upstream systemd's deprecation of the same. It is recommended to use
-      <literal>systemd.network.networks.&lt;name&gt;.networkConfig.KeepConfiguration</literal> instead.
-      See <citerefentry><refentrytitle>systemd.network</refentrytitle>
-      <manvolnum>5</manvolnum></citerefentry> for details.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>systemd-networkd</literal> option
-     <literal>systemd.network.networks._name_.dhcpConfig</literal>
-     has been renamed to
-     <xref linkend="opt-systemd.network.networks._name_.dhcpV4Config"/>
-     following upstream systemd's documentation change.
-     See <citerefentry><refentrytitle>systemd.network</refentrytitle>
-     <manvolnum>5</manvolnum></citerefentry> for details.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      In the <literal>picom</literal> module, several options that accepted
-      floating point numbers encoded as strings (for example
-      <xref linkend="opt-services.picom.activeOpacity"/>) have been changed
-      to the (relatively) new native <literal>float</literal> type. To migrate
-      your configuration simply remove the quotes around the numbers.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      When using <literal>buildBazelPackage</literal> from Nixpkgs,
-      <literal>flat</literal> hash mode is now used for dependencies
-      instead of <literal>recursive</literal>. This is to better allow
-      using hashed mirrors where needed. As a result, these hashes
-      will have changed.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      The syntax of the PostgreSQL configuration file is now checked at build
-      time. If your configuration includes a file inaccessible inside the build
-      sandbox, set <varname>services.postgresql.checkConfig</varname> to
-        <literal>false</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      The rkt module has been removed, it was archived by upstream.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      The <link xlink:href="https://bazaar.canonical.com">Bazaar</link> VCS is
-      unmaintained and, as consequence of the Python 2 EOL, the packages
-      <literal>bazaar</literal> and <literal>bazaarTools</literal> were
-      removed. Breezy, the backward compatible fork of Bazaar (see the
-      <link xlink:href="https://www.jelmer.uk/breezy-intro.html">announcement</link>),
-      was packaged as <literal>breezy</literal> and can be used instead.
-    </para>
-    <para>
-      Regarding Nixpkgs, <literal>fetchbzr</literal>,
-      <literal>nix-prefetch-bzr</literal> and Bazaar support in Hydra will
-      continue to work through Breezy.
-    </para>
-   </listitem>
-   <listitem>
-     <para>
-       In addition to the hostname, the fully qualified domain name (FQDN),
-       which consists of <literal>${networking.hostName}</literal> and
-       <literal>${networking.domain}</literal> is now added to
-       <literal>/etc/hosts</literal>, to allow local FQDN resolution, as used by the
-       <literal>hostname --fqdn</literal> command and other applications that
-       try to determine the FQDN. These new entries take precedence over entries
-       from the DNS which could cause regressions in some very specific setups.
-       Additionally the hostname is now resolved to <literal>127.0.0.2</literal>
-       instead of <literal>127.0.1.1</literal> to be consistent with what
-       <literal>nss-myhostname</literal> (from systemd) returns.
-       The old behaviour can e.g. be restored by using
-       <literal>networking.hosts = lib.mkForce { "127.0.1.1" = [ config.networking.hostName ]; };</literal>.
-     </para>
-   </listitem>
-   <listitem>
-     <para>
-       The hostname (<literal>networking.hostName</literal>) must now be a valid
-       DNS label (see RFC 1035, RFC 1123) and as such must not contain the domain part.
-       This means that the hostname must start with a letter or digit, end with a letter
-       or digit, and have as interior characters only letters, digits, and
-       hyphen. The maximum length is 63 characters. Additionally it is
-       recommended to only use lower-case characters.
-       If (e.g. for legacy reasons) a FQDN is required as the Linux kernel network node hostname
-       (<literal>uname --nodename</literal>) the option
-       <literal>boot.kernel.sysctl."kernel.hostname"</literal>
-       can be used as a workaround (but be aware of the 64 character limit).
-     </para>
-   </listitem>
-   <listitem>
-    <para>
-     The GRUB specific option <option>boot.loader.grub.extraInitrd</option>
-     has been replaced with the generic option
-     <option>boot.initrd.secrets</option>. This option creates a secondary
-     initrd from the specified files, rather than using a manually created
-     initrd file.
-
-     Due to an existing bug with <option>boot.loader.grub.extraInitrd</option>,
-     it is not possible to directly boot an older generation that used that
-     option. It is still possible to rollback to that generation if the required
-     initrd file has not been deleted.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <link xlink:href="https://github.com/okTurtles/dnschain">DNSChain</link>
-     package and NixOS module have been removed from Nixpkgs as the software is
-     unmaintained and can't be built. For more information see issue
-     <link xlink:href="https://github.com/NixOS/nixpkgs/issues/89205">#89205</link>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     In the <literal>resilio</literal> module, <xref linkend="opt-services.resilio.httpListenAddr"/> has been changed to listen to <literal>[::1]</literal> instead of <literal>0.0.0.0</literal>.
-     </para>
-   </listitem>
-     <listitem>
-       <para>
-         <literal>sslh</literal> has been updated to version
-           <literal>1.21</literal>. The <literal>ssl</literal> probe must be
-             renamed to <literal>tls</literal> in <xref linkend="opt-services.sslh.appendConfig"/>.
-    </para>
-  </listitem>
-   <listitem>
-    <para>
-     Users of <link xlink:href="http://openafs.org">OpenAFS 1.6</link> must
-     upgrade their services to OpenAFS 1.8! In this release, the OpenAFS package
-     version 1.6.24 is marked broken but can be used during transition to
-     OpenAFS 1.8.x. Use the options
-     <option>services.openafsClient.packages.module</option>,
-     <option>services.openafsClient.packages.programs</option> and
-     <option>services.openafsServer.package</option> to select a different
-     OpenAFS package. OpenAFS 1.6 will be removed in the next release. The
-     package <literal>openafs</literal> and the service options will then
-     silently point to the OpenAFS 1.8 release.
-    </para>
-    <para>
-     See also the OpenAFS <link
-     xlink:href="http://docs.openafs.org/AdminGuide/index.html">Administrator
-     Guide</link> for instructions. Beware of the following when updating
-     servers:
-     <itemizedlist>
-      <listitem>
-       <para>
-       The storage format of the server key has changed and the key must be converted before running the new release.
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-       When updating multiple database servers, turn off the database servers
-       from the highest IP down to the lowest with resting periods in
-       between. Start up in reverse order. Do not concurrently run database
-       servers working with different OpenAFS releases!
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-       Update servers first, then clients.
-       </para>
-      </listitem>
-     </itemizedlist>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Radicale's default package has changed from 2.x to 3.x. An upgrade
-     checklist can be found
-     <link xlink:href="https://github.com/Kozea/Radicale/blob/3.0.x/NEWS.md#upgrade-checklist">here</link>.
-     You can use the newer version in the NixOS service by setting the
-     <literal>package</literal> to <literal>radicale3</literal>, which is done
-     automatically if <literal>stateVersion</literal> is 20.09 or higher.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      <literal>udpt</literal> experienced a complete rewrite from C++ to rust. The configuration format changed from ini to toml.
-      The new configuration documentation can be found at
-      <link xlink:href="https://naim94a.github.io/udpt/config.html">the official website</link> and example
-      configuration is packaged in <literal>${udpt}/share/udpt/udpt.toml</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     We now have a unified <xref linkend="opt-services.xserver.displayManager.autoLogin"/> option interface
-     to be used for every display-manager in NixOS.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>bitcoind</literal> module has changed to multi-instance, using submodules.
-     Therefore, it is now mandatory to name each instance.
-     To use this new multi-instance config with an existing bitcoind data directory and user,
-     you have to adjust the original config, e.g.:
-<programlisting>
-  services.bitcoind = {
-    enable = true;
-    extraConfig = "...";
-    ...
-  };
-</programlisting>
-     To something similar:
-<programlisting>
-  services.bitcoind.mainnet = {
-    enable = true;
-    dataDir = "/var/lib/bitcoind";
-    user = "bitcoin";
-    extraConfig = "...";
-    ...
-  };
-</programlisting>
-     The key settings are:
-     <itemizedlist>
-      <listitem>
-       <para>
-        <literal>dataDir</literal> - to continue using the same data directory.
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        <literal>user</literal> - to continue using the same user so that bitcoind maintains access to its files.
-       </para>
-      </listitem>
-     </itemizedlist>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      Graylog introduced a change in the LDAP server certificate validation behaviour for version 3.3.3 which might break existing setups.
-      When updating Graylog from a version before 3.3.3 make sure to check the Graylog <link xlink:href="https://www.graylog.org/post/announcing-graylog-v3-3-3">release info</link> for information on how to avoid the issue.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>dokuwiki</literal> module has changed to multi-instance, using submodules.
-     Therefore, it is now mandatory to name each instance. Moreover, forcing SSL by default has been dropped, so
-     <literal>nginx.forceSSL</literal> and <literal>nginx.enableACME</literal> are no longer set to <literal>true</literal>.
-     To continue using your service with the original SSL settings, you have to adjust the original config, e.g.:
-<programlisting>
-services.dokuwiki = {
-  enable = true;
-  ...
-};
-</programlisting>
-     To something similar:
-<programlisting>
-services.dokuwiki."mywiki" = {
-  enable = true;
-  nginx = {
-    forceSSL = true;
-    enableACME = true;
-  };
-  ...
-};
-</programlisting>
-     The base package has also been upgraded to the 2020-07-29 "Hogfather" release. Plugins might be incompatible or require upgrading.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      The <xref linkend="opt-services.postgresql.dataDir"/> option is now set to <literal>"/var/lib/postgresql/${cfg.package.psqlSchema}"</literal> regardless of your
-      <xref linkend="opt-system.stateVersion"/>. Users with an existing postgresql install that have a <xref linkend="opt-system.stateVersion"/> of <literal>17.03</literal> or below
-      should double check what the value of their <xref linkend="opt-services.postgresql.dataDir"/> option is (<literal>/var/db/postgresql</literal>) and then explicitly
-      set this value to maintain compatibility:
-<programlisting>
-services.postgresql.dataDir = "/var/db/postgresql";
-</programlisting>
-    </para>
-    <para>
-     The postgresql module now expects there to be a database super user account called <literal>postgres</literal> regardless of your <xref linkend="opt-system.stateVersion"/>. Users
-     with an existing postgresql install that have a <xref linkend="opt-system.stateVersion"/> of <literal>17.03</literal> or below should run the following SQL statements as a
-     database super admin user before upgrading:
-<programlisting>
-CREATE ROLE postgres LOGIN SUPERUSER;
-</programlisting>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The USBGuard module now removes options and instead hardcodes values for <literal>IPCAccessControlFiles</literal>, <literal>ruleFiles</literal>, and <literal>auditFilePath</literal>. Audit logs can be found in the journal.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The NixOS module system now evaluates option definitions more strictly, allowing it to detect a larger set of problems.
-     As a result, what previously evaluated may not do so anymore.
-     See <link xlink:href="https://github.com/NixOS/nixpkgs/pull/82743#issuecomment-674520472">the PR that changed this</link> for more info.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     For NixOS configuration options, the type <literal>loaOf</literal>, after
-     its initial deprecation in release 20.03, has been removed. In NixOS and
-     Nixpkgs options using this type have been converted to <literal>attrsOf</literal>.
-     For more information on this change have look at these links:
-     <link xlink:href="https://github.com/NixOS/nixpkgs/issues/1800">issue #1800</link>,
-     <link xlink:href="https://github.com/NixOS/nixpkgs/pull/63103">PR #63103</link>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      <literal>config.systemd.services.${name}.path</literal> now returns a list of paths instead of a colon-separated string.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Caddy module now uses Caddy v2 by default. Caddy v1 can still be used by setting
-     <xref linkend="opt-services.caddy.package"/> to <literal>pkgs.caddy1</literal>.
-    </para>
-    <para>
-     New option <xref linkend="opt-services.caddy.adapter"/> has been added.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <link linkend="opt-services.jellyfin.enable">jellyfin</link> module will use and stay on the Jellyfin version <literal>10.5.5</literal>
-     if <literal>stateVersion</literal> is lower than <literal>20.09</literal>. This is because significant changes were made to the database schema,
-     and it is highly recommended to backup your instance before upgrading. After making your backup, you can upgrade to the latest version either by
-     setting your <literal>stateVersion</literal> to <literal>20.09</literal> or higher, or set the <option>services.jellyfin.package</option> to
-     <literal>pkgs.jellyfin</literal>. If you do not wish to upgrade Jellyfin, but want to change your <literal>stateVersion</literal>, you can set
-     the value of <option>services.jellyfin.package</option> to <literal>pkgs.jellyfin_10_5</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>security.rngd</literal> service is now disabled by default.
-     This choice was made because there's krngd in the linux kernel space making it (for most usecases)
-     functionally redundent.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>hardware.nvidia.optimus_prime.enable</literal> service has been renamed to
-     <literal>hardware.nvidia.prime.sync.enable</literal> and has many new enhancements.
-     Related nvidia prime settings may have also changed.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The package <package>nextcloud17</package> has been removed and <package>nextcloud18</package> was marked as insecure
-     since both of them will <link xlink:href="https://docs.nextcloud.com/server/19/admin_manual/release_schedule.html">
-     will be EOL (end of life) within the lifetime of 20.09</link>.
-    </para>
-    <para>
-     It's necessary to upgrade to <package>nextcloud19</package>:
-     <itemizedlist>
-      <listitem>
-       <para>
-        From <package>nextcloud17</package>, you have to upgrade to <package>nextcloud18</package> first as
-        Nextcloud doesn't allow going multiple major revisions forward in a single upgrade. This is possible
-        by setting <xref linkend="opt-services.nextcloud.package" /> to <package>nextcloud18</package>.
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        From <package>nextcloud18</package>, it's possible to directly upgrade to <package>nextcloud19</package>
-        by setting <xref linkend="opt-services.nextcloud.package" /> to <package>nextcloud19</package>.
-       </para>
-      </listitem>
-     </itemizedlist>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      The GNOME desktop manager no longer default installs <package>gnome3.epiphany</package>.
-      It was chosen to do this as it has a usability breaking issue (see issue <link xlink:href="https://github.com/NixOS/nixpkgs/issues/98819">#98819</link>)
-      that makes it unsuitable to be a default app.
-    </para>
-    <note>
-      <para>
-        Issue <link
-        xlink:href="https://github.com/NixOS/nixpkgs/issues/98819">#98819</link>
-        is now fixed and <package>gnome3.epiphany</package> is once
-        again installed by default.
-      </para>
-    </note>
-   </listitem>
-   <listitem>
-     <para>
-       If you want to manage the configuration of <package>wpa_supplicant</package> outside of NixOS you must ensure that none of <xref linkend="opt-networking.wireless.networks" />, <xref linkend="opt-networking.wireless.extraConfig" /> or <xref linkend="opt-networking.wireless.userControlled.enable" /> is being used or <literal>true</literal>.
-       Using any of those options will cause <package>wpa_supplicant</package> to be started with a NixOS generated configuration file instead of your own.
-    </para>
-   </listitem>
-  </itemizedlist>
- </section>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-20.09-notable-changes">
-  <title>Other Notable Changes</title>
-
-  <itemizedlist>
-   <listitem>
-    <para>SD images are now compressed by default using <literal>zstd</literal>. The compression for ISO images has also been changed to <literal>zstd</literal>, but ISO images are still not compressed by default.</para>
-   </listitem>
-   <listitem>
-    <para>
-     <option>services.journald.rateLimitBurst</option> was updated from
-     <literal>1000</literal> to <literal>10000</literal> to follow the new
-     upstream systemd default.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <package>notmuch</package> package move its emacs-related binaries and
-     emacs lisp files to a separate output. They're not part
-     of the default <literal>out</literal> output anymore - if you relied on the
-     <literal>notmuch-emacs-mua</literal> binary or the emacs lisp files, access them via
-     the <literal>notmuch.emacs</literal> output.
-
-     Device tree overlay support was improved in
-     <link xlink:href="https://github.com/NixOS/nixpkgs/pull/79370">#79370</link>
-     and now uses <xref linkend="opt-hardware.deviceTree.kernelPackage"/>
-     instead of <option>hardware.deviceTree.base</option>.
-
-     <xref linkend="opt-hardware.deviceTree.overlays"/> configuration was
-     extended to support <literal>.dts</literal> files with symbols.
-
-     Device trees can now be filtered by setting
-     <xref linkend="opt-hardware.deviceTree.filter"/> option.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      The default output of <literal>buildGoPackage</literal> is now <literal>$out</literal> instead of <literal>$bin</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <literal>buildGoModule</literal> <literal>doCheck</literal> now defaults to <literal>true</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Packages built using <literal>buildRustPackage</literal> now use <literal>release</literal>
-     mode for the <literal>checkPhase</literal> by default.
-    </para>
-    <para>
-     Please note that Rust packages utilizing a custom build/install procedure
-     (e.g. by using a <filename>Makefile</filename>) or test suites that rely on the
-     structure of the <filename>target/</filename> directory may break due to those assumptions.
-     For further information, please read the Rust section in the Nixpkgs manual.
-    </para>
-   </listitem>
-   <listitem>
-   <para>
-     The cc- and binutils-wrapper's "infix salt" and <literal>_BUILD_</literal> and <literal>_TARGET_</literal> user infixes have been replaced with with a "suffix salt" and suffixes and <literal>_FOR_BUILD</literal> and <literal>_FOR_TARGET</literal>.
-      This matches the autotools convention for env vars which standard for these things, making interfacing with other tools easier.
-   </para>
-   </listitem>
-   <listitem>
-   <para>
-     Additional Git documentation (HTML and text files) is now available via the <literal>git-doc</literal> package.
-   </para>
-   </listitem>
-   <listitem>
-   <para>
-     Default algorithm for ZRAM swap was changed to <literal>zstd</literal>.
-   </para>
-   </listitem>
-   <listitem>
-    <para>
-    The installer now enables sshd by default. This improves installation on headless machines especially ARM single-board-computer.
-    To login through ssh, either a password or an ssh key must be set for the root user or the nixos user.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The scripted networking system now uses <literal>.link</literal> files in
-     <literal>/etc/systemd/network</literal> to configure mac address and link MTU,
-     instead of the sometimes buggy <literal>network-link-*</literal> units, which
-     have been removed.
-     Bringing the interface up has been moved to the beginning of the
-     <literal>network-addresses-*</literal> unit.
-     Note this doesn't require <command>systemd-networkd</command> - it's udev that
-     parses <literal>.link</literal> files.
-     Extra care needs to be taken in the presence of <link xlink:href="https://wiki.debian.org/NetworkInterfaceNames#THE_.22PERSISTENT_NAMES.22_SCHEME">legacy udev rules</link>
-     to rename interfaces, as MAC Address and MTU defined in these options can only match on the original link name.
-     In such cases, you most likely want to create a <literal>10-*.link</literal> file through <xref linkend="opt-systemd.network.links"/> and set both name and MAC Address / MTU there.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Grafana received a major update to version 7.x. A plugin is now needed for
-     image rendering support, and plugins must now be signed by default. More
-     information can be found
-     <link xlink:href="https://grafana.com/docs/grafana/latest/installation/upgrading/#upgrading-to-v7-0">in the Grafana documentation</link>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>hardware.u2f</literal> module, which was installing udev rules
-     was removed, as udev gained native support to handle FIDO security tokens.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>services.transmission</literal> module
-     was enhanced with the new options:
-     <xref linkend="opt-services.transmission.credentialsFile"/>,
-     <xref linkend="opt-services.transmission.openFirewall"/>,
-     and <xref linkend="opt-services.transmission.performanceNetParameters"/>.
-    </para>
-    <para>
-     <literal>transmission-daemon</literal> is now started with additional systemd sandbox/hardening options for better security.
-     Please <link xlink:href="https://github.com/NixOS/nixpkgs/issues">report</link>
-     any use case where this is not working well.
-     In particular, the <literal>RootDirectory</literal> option newly set
-     forbids uploading or downloading a torrent outside of the default directory
-     configured at <link linkend="opt-services.transmission.settings">settings.download-dir</link>.
-     If you really need Transmission to access other directories,
-     you must include those directories into the <literal>BindPaths</literal> of the service:
-<programlisting>
-systemd.services.transmission.serviceConfig.BindPaths = [ "/path/to/alternative/download-dir" ];
-</programlisting>
-    </para>
-    <para>
-     Also, connection to the RPC (Remote Procedure Call) of <literal>transmission-daemon</literal>
-     is now only available on the local network interface by default.
-     Use:
-<programlisting>
-services.transmission.settings.rpc-bind-address = "0.0.0.0";
-</programlisting>
-     to get the previous behavior of listening on all network interfaces.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     With this release <literal>systemd-networkd</literal> (when enabled through <xref linkend="opt-networking.useNetworkd"/>)
-     has it's netlink socket created through a <literal>systemd.socket</literal> unit. This gives us control over
-     socket buffer sizes and other parameters. For larger setups where networkd has to create a lot of (virtual)
-     devices the default buffer size (currently 128MB) is not enough.
-    </para>
-    <para>
-     On a machine with &gt;100 virtual interfaces (e.g., wireguard tunnels, VLANs, …), that all have to
-     be brought up during system startup, the receive buffer size will spike for a brief period.
-     Eventually some of the message will be dropped since there is not enough (permitted) buffer
-     space available.
-    </para>
-    <para>
-     By having <literal>systemd-networkd</literal> start with a netlink socket created by
-     <literal>systemd</literal> we can configure the <literal>ReceiveBufferSize=</literal> parameter
-     in the socket options (i.e. <literal>systemd.sockets.systemd-networkd.socketOptions.ReceiveBufferSize</literal>)
-     without recompiling <literal>systemd-networkd</literal>.
-    </para>
-    <para>
-     Since the actual memory requirements depend on hardware, timing, exact
-     configurations etc. it isn't currently possible to infer a good default
-     from within the NixOS module system. Administrators are advised to
-     monitor the logs of <literal>systemd-networkd</literal> for <literal>rtnl: kernel receive buffer
-     overrun</literal> spam and increase the memory limit as they see fit.
-    </para>
-    <para>
-     Note: Increasing the <literal>ReceiveBufferSize=</literal> doesn't allocate any memory. It just increases
-     the upper bound on the kernel side. The memory allocation depends on the amount of messages that are
-     queued on the kernel side of the netlink socket.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Specifying <link linkend="opt-services.dovecot2.mailboxes">mailboxes</link> in the <package>dovecot2</package> module
-     as a list is deprecated and will break eval in 21.05. Instead, an attribute-set should be specified where the <literal>name</literal>
-     should be the key of the attribute.
-    </para>
-    <para>
-     This means that a configuration like this
-<programlisting>{
-  <link linkend="opt-services.dovecot2.mailboxes">services.dovecot2.mailboxes</link> = [
-    { name = "Junk";
-      auto = "create";
-    }
-  ];
-}</programlisting>
-    should now look like this:
-<programlisting>{
-  <link linkend="opt-services.dovecot2.mailboxes">services.dovecot2.mailboxes</link> = {
-    Junk.auto = "create";
-  };
-}</programlisting>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      <package>netbeans</package> was upgraded to 12.0 and now defaults to OpenJDK 11. This might cause problems if your projects depend on packages that were removed in Java 11.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <package>nextcloud</package> has been updated to <link xlink:href="https://nextcloud.com/blog/nextcloud-hub-brings-productivity-to-home-office/">v19</link>.
-    </para>
-    <para>
-     If you have an existing installation, please make sure that you're on
-     <package>nextcloud18</package> before upgrading to <package>nextcloud19</package>
-     since Nextcloud doesn't support upgrades across multiple major versions.
-    </para>
-   </listitem>
-   <listitem>
-     <para>
-       The <literal>nixos-run-vms</literal> script now deletes the
-       previous run machines states on test startup. You can use the
-       <literal>--keep-vm-state</literal> flag to match the previous
-       behaviour and keep the same VM state between different test runs.
-     </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <link linkend="opt-nix.buildMachines">nix.buildMachines</link> option is now type-checked.
-     There are no functional changes, however this may require updating some configurations to use correct types for all attributes.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <literal>fontconfig</literal> module stopped generating config and cache files for fontconfig 2.10.x, the <filename>/etc/fonts/fonts.conf</filename> now belongs to the latest fontconfig, just like on other Linux distributions, and we will <link xlink:href="https://github.com/NixOS/nixpkgs/pull/95358">no longer</link> be versioning the config directories.
-    </para>
-    <para>
-     Fontconfig 2.10.x was removed from Nixpkgs since it hasn’t been used in any Nixpkgs package for years now.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Nginx module <literal>nginxModules.fastcgi-cache-purge</literal> renamed to official name <literal>nginxModules.cache-purge</literal>.
-     Nginx module <literal>nginxModules.ngx_aws_auth</literal> renamed to official name <literal>nginxModules.aws-auth</literal>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      The option <option>defaultPackages</option> was added. It installs the packages <package>perl</package>, <package>rsync</package> and <package>strace</package> for now. They were added unconditionally to <option>systemPackages</option> before, but are not strictly necessary for a minimal NixOS install. You can set it to an empty list to have a more minimal system. Be aware that some functionality might still have an impure dependency on those packages, so things might break.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      The <literal>undervolt</literal> option no longer needs to apply its
-      settings every 30s. If they still become undone, open an issue and restore
-      the previous behaviour using <literal>undervolt.useTimer</literal>.
-    </para>
-   </listitem>
-   <listitem>
-     <para>
-      Agda has been heavily reworked.
-      <itemizedlist>
-       <listitem>
-         <para>
-           <literal>agda.mkDerivation</literal> has been heavily changed and
-           is now located at <package>agdaPackages.mkDerivation</package>.
-         </para>
-       </listitem>
-       <listitem>
-         <para>
-           New top-level packages <package>agda</package> and
-           <literal>agda.withPackages</literal> have been added, the second
-           of which sets up agda with access to chosen libraries.
-         </para>
-       </listitem>
-       <listitem>
-         <para>
-           All agda libraries now live under
-           <literal>agdaPackages</literal>.
-         </para>
-       </listitem>
-       <listitem>
-         <para>
-           Many broken libraries have been removed.
-         </para>
-       </listitem>
-      </itemizedlist>
-      See the <link
-      xlink:href="https://nixos.org/nixpkgs/manual/#agda">new
-      documentation</link> for more information.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      The <literal>deepin</literal> package set has been removed from
-      nixpkgs. It was a work in progress to package the
-      <link xlink:href="https://www.deepin.org/en/dde/">Deepin Desktop Environment (DDE)</link>,
-      including libraries, tools and applications, and it was still
-      missing a service to launch the desktop environment. It has shown
-      to no longer be a feasible goal due to reasons discussed in
-      <link xlink:href="https://github.com/NixOS/nixpkgs/issues/94870">issue #94870</link>.
-      The package <literal>netease-cloud-music</literal> has also been
-      removed, as it depends on libraries from deepin.
-    </para>
-   </listitem>
-   <listitem>
-     <para>
-       The <literal>opendkim</literal> module now uses systemd sandboxing features
-       to limit the exposure of the system towards the opendkim service.
-     </para>
-   </listitem>
-  </itemizedlist>
-  <itemizedlist>
-   <listitem>
-    <para />
-    <para>
-        Kubernetes has been upgraded to 1.19.1, which also means that the
-        golang version to build it has been bumped to 1.15. This may have
-        consequences for your existing clusters and their certificates. Please
-        consider
-        <link xlink:href="https://relnotes.k8s.io/?markdown=93264">
-            the release notes for Kubernetes 1.19 carefully
-        </link>
-        before upgrading.
-    </para>
-   </listitem>
-  </itemizedlist>
-  <itemizedlist>
-    <listitem>
-      <para>
-        For AMD GPUs, Vulkan can now be used by adding <literal>amdvlk</literal>
-        to <literal>hardware.opengl.extraPackages</literal>.
-      </para>
-    </listitem>
-    <listitem>
-      <para>
-        Similarly, still for AMD GPUs, the ROCm OpenCL stack can now be used by adding
-        <literal>rocm-opencl-icd</literal> to
-        <literal>hardware.opengl.extraPackages</literal>.
-      </para>
-    </listitem>
-  </itemizedlist>
- </section>
-
- <section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-release-20.09-contributions">
-  <title>Contributions</title>
-  <para>
-        I, Jonathan Ringer, would like to thank the following individuals for their work on nixpkgs. This release could not be done without the hard work of the NixOS community. There were 31282 contributions across 1313 contributors.
-  </para>
-  <orderedlist>
-   <para>
-    Top contributors to NixOS/Nixpkgs from the 20.03 release to the 20.09 release:
-   </para>
-   <listitem>
-    <para>
-  2288  Mario Rodas
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-  1837  Frederik Rietdijk
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-   946  Jörg Thalheim
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-   925  Maximilian Bosch
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-   687  Jonathan Ringer
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-   651  Jan Tojnar
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-   622  Daniël de Kok
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-   605  WORLDofPEACE
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-   597  Florian Klink
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-   528  José Romildo Malaquias
-    </para>
-   </listitem>
-  </orderedlist>
-
-  <orderedlist>
-   <para>
-    Top contributors to stabilizing this release (Zero Hydra Failures period):
-   </para>
-   <listitem>
-    <para>
-      281  volth
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-   101  Robert Scott
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-    86  Tim Steinbach
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-    76  WORLDofPEACE
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-    49  Maximilian Bosch
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-    42  Thomas Tuegel
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-    37  Doron Behar
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-    36  Vladimír Čunát
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-    27  Jonathan Ringer
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-    27  Maciej Krüger
-    </para>
-   </listitem>
-  </orderedlist>
-
-  <para>
-   I, Jonathan Ringer, would also like to personally thank @WORLDofPEACE for their help in mentoring me on the release process. Special thanks also goes to Thomas Tuegel for helping immensely with stabilizing Qt, KDE, and Plasma5; I would also like to thank Robert Scott for his numerous fixes and pull request reviews.
-   </para>
-
- </section>
-</section>
diff --git a/nixos/doc/manual/release-notes/rl-2111.section.md b/nixos/doc/manual/release-notes/rl-2111.section.md
index e97aed4ccf2a..f7578c8ddee8 100644
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@@ -2,43 +2,34 @@
 
 In addition to numerous new and upgraded packages, this release has the following highlights:
 
-* Support is planned until the end of April 2022, handing over to 22.05.
+- Support is planned until the end of April 2022, handing over to 22.05.
 
 ## Highlights {#sec-release-21.11-highlights}
 
-* PHP now defaults to PHP 8.0, updated from 7.4.
+- PHP now defaults to PHP 8.0, updated from 7.4.
 
 ## New Services {#sec-release-21.11-new-services}
 
-* [geoipupdate](https://github.com/maxmind/geoipupdate), a GeoIP
-  database updater from MaxMind. Available as
-  [services.geoipupdate](options.html#opt-services.geoipupdate.enable).
+- [geoipupdate](https://github.com/maxmind/geoipupdate), a GeoIP database updater from MaxMind. Available as [services.geoipupdate](options.html#opt-services.geoipupdate.enable).
 
-* [sourcehut](https://sr.ht), a collection of tools useful for software
-  development. Available as
-  [services.sourcehut](options.html#opt-services.sourcehut.enable).
+- [sourcehut](https://sr.ht), a collection of tools useful for software development. Available as [services.sourcehut](options.html#opt-services.sourcehut.enable).
 
-* [ucarp](https://download.pureftpd.org/pub/ucarp/README), an userspace
-  implementation of the Common Address Redundancy Protocol (CARP). Available as
-  [networking.ucarp](options.html#opt-networking.ucarp.enable).
+- [ucarp](https://download.pureftpd.org/pub/ucarp/README), an userspace implementation of the Common Address Redundancy Protocol (CARP). Available as [networking.ucarp](options.html#opt-networking.ucarp.enable).
 
 ## Backward Incompatibilities {#sec-release-21.11-incompatibilities}
 
-* The `staticjinja` package has been upgraded from 1.0.4 to 2.0.0
+- The `staticjinja` package has been upgraded from 1.0.4 to 2.0.0
 
-* `services.geoip-updater` was broken and has been replaced by
-  [services.geoipupdate](options.html#opt-services.geoipupdate.enable).
+- `services.geoip-updater` was broken and has been replaced by [services.geoipupdate](options.html#opt-services.geoipupdate.enable).
 
-* PHP 7.3 is no longer supported due to upstream not supporting this
-  version for the entire lifecycle of the 21.11 release.
+- PHP 7.3 is no longer supported due to upstream not supporting this version for the entire lifecycle of the 21.11 release.
 
-* Those making use of `buildBazelPackage` will need to regenerate the fetch
-  hashes (preferred), or set `fetchConfigured = false;`.
+- Those making use of `buildBazelPackage` will need to regenerate the fetch hashes (preferred), or set `fetchConfigured = false;`.
 
-* fsharp41 has been removed in preference to use the latest dotnet-sdk
+- fsharp41 has been removed in preference to use the latest dotnet-sdk
+
+- The following F#-related packages have been removed for being unmaintaned. Please use `fetchNuGet` for specific packages.
 
-* The following F#-related packages have been removed for being unmaintaned.
-  Please use `fetchNuGet` for specific packages.
   - ExtCore
   - Fake
   - Fantomas
@@ -68,10 +59,9 @@ In addition to numerous new and upgraded packages, this release has the followin
   - ExcelDnaRegistration
   - MathNetNumerics
 
-* `programs.x2goserver` is now `services.x2goserver`
+- `programs.x2goserver` is now `services.x2goserver`
 
-* The following dotnet-related packages have been removed for being unmaintaned.
-  Please use `fetchNuGet` for specific packages.
+- The following dotnet-related packages have been removed for being unmaintaned. Please use `fetchNuGet` for specific packages.
   - Autofac
   - SystemValueTuple
   - MicrosoftDiaSymReader

From 834cfd904119fdcf2a267d758a2e15f8bad3b96f Mon Sep 17 00:00:00 2001
From: Danielle Lancashire <dani@builds.terrible.systems>
Date: Tue, 22 Jun 2021 16:48:51 +0200
Subject: [PATCH 412/416] nomad_1_1: 1.1.1 -> 1.1.2

---
 pkgs/applications/networking/cluster/nomad/1.1.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/nomad/1.1.nix b/pkgs/applications/networking/cluster/nomad/1.1.nix
index 7c14ca5f4b32..cfc38c2f59ea 100644
--- a/pkgs/applications/networking/cluster/nomad/1.1.nix
+++ b/pkgs/applications/networking/cluster/nomad/1.1.nix
@@ -6,6 +6,6 @@
 
 callPackage ./generic.nix {
   inherit buildGoPackage nvidia_x11 nvidiaGpuSupport;
-  version = "1.1.1";
-  sha256 = "0y7p85dvxfgzaafgzdmnw3fp9h87zx3z8m1ka4qaiacwah5xwqlv";
+  version = "1.1.2";
+  sha256 = "08ynfr2lqzv66ymj37qbc72lf2iq41kf94n76pdvynymk4dq98nq";
 }

From d4655879fbf14b7b26cec31a072d38a91c379530 Mon Sep 17 00:00:00 2001
From: Danielle Lancashire <dani@builds.terrible.systems>
Date: Tue, 22 Jun 2021 16:50:00 +0200
Subject: [PATCH 413/416] nomad_1_0: 1.0.7 -> 1.0.8

---
 pkgs/applications/networking/cluster/nomad/1.0.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/nomad/1.0.nix b/pkgs/applications/networking/cluster/nomad/1.0.nix
index 0c9ced385fed..ac6938e4ddc0 100644
--- a/pkgs/applications/networking/cluster/nomad/1.0.nix
+++ b/pkgs/applications/networking/cluster/nomad/1.0.nix
@@ -6,6 +6,6 @@
 
 callPackage ./generic.nix {
   inherit buildGoPackage nvidia_x11 nvidiaGpuSupport;
-  version = "1.0.7";
-  sha256 = "12izilr2x9qw8dxhjqcivakwzhf6jc86g0pmxf52fr9rwaqmpc95";
+  version = "1.0.8";
+  sha256 = "1kjwa9lnxh5zfzijqgkp94wslkzn6kspwi42kf46vrn0qkiz39f2";
 }

From 6e44a67726450fceb43281536cab27b7f3f93b22 Mon Sep 17 00:00:00 2001
From: urlordjames <urlordjames@gmail.com>
Date: Sun, 20 Jun 2021 18:02:56 -0400
Subject: [PATCH 414/416] drogon: add options for optional dependencies

---
 pkgs/development/libraries/drogon/default.nix | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/drogon/default.nix b/pkgs/development/libraries/drogon/default.nix
index ebb989c94035..1b27c7a2b074 100644
--- a/pkgs/development/libraries/drogon/default.nix
+++ b/pkgs/development/libraries/drogon/default.nix
@@ -1,4 +1,11 @@
-{ stdenv, fetchFromGitHub, cmake, jsoncpp, libossp_uuid, zlib, openssl, lib }:
+{ stdenv, fetchFromGitHub, cmake, jsoncpp, libossp_uuid, zlib, openssl, lib
+# miscellaneous
+, brotli, c-ares
+# databases
+, sqliteSupport ? true, sqlite
+, postgresSupport ? false, postgresql
+, redisSupport ? false, hiredis
+, mysqlSupport ? false, libmysqlclient, mariadb }:
 
 stdenv.mkDerivation rec {
   pname = "drogon";
@@ -24,7 +31,13 @@ stdenv.mkDerivation rec {
     libossp_uuid
     zlib
     openssl
-  ];
+    brotli
+    c-ares
+  ] ++ lib.optional sqliteSupport sqlite
+    ++ lib.optional postgresSupport postgresql
+    ++ lib.optional redisSupport hiredis
+    # drogon uses mariadb for mysql (see https://github.com/an-tao/drogon/wiki/ENG-02-Installation#Library-Dependencies)
+    ++ lib.optional mysqlSupport [ libmysqlclient mariadb ];
 
   patches = [
     # this part of the test would normally fail because it attempts to configure a CMake project that uses find_package on itself

From d26902aef932e80eb772026433af13ce662e7872 Mon Sep 17 00:00:00 2001
From: Graham Fawcett <graham.fawcett@gmail.com>
Date: Tue, 22 Jun 2021 12:53:27 -0400
Subject: [PATCH 415/416] Refresh the Ocaml package examples; document
 `useDune2` (#127520)

The current example in the manual no longer builds, mainly because
`useDune2 = true` is required, but also because the inputs have changed.
The new examples are copied verbatim from nixpkgs.
---
 doc/languages-frameworks/ocaml.section.md | 73 +++++++++++++++--------
 1 file changed, 48 insertions(+), 25 deletions(-)

diff --git a/doc/languages-frameworks/ocaml.section.md b/doc/languages-frameworks/ocaml.section.md
index 9b92a80f4712..5ffc23173d6d 100644
--- a/doc/languages-frameworks/ocaml.section.md
+++ b/doc/languages-frameworks/ocaml.section.md
@@ -4,60 +4,83 @@ OCaml libraries should be installed in `$(out)/lib/ocaml/${ocaml.version}/site-l
 
 Given that most of the OCaml ecosystem is now built with dune, nixpkgs includes a convenience build support function called `buildDunePackage` that will build an OCaml package using dune, OCaml and findlib and any additional dependencies provided as `buildInputs` or `propagatedBuildInputs`.
 
-Here is a simple package example. It defines an (optional) attribute `minimumOCamlVersion` that will be used to throw a descriptive evaluation error if building with an older OCaml is attempted. It uses the `fetchFromGitHub` fetcher to get its source. It sets the `doCheck` (optional) attribute to `true` which means that tests will be run with `dune runtest -p angstrom` after the build (`dune build -p angstrom`) is complete. It uses `alcotest` as a build input (because it is needed to run the tests) and `bigstringaf` and `result` as propagated build inputs (thus they will also be available to libraries depending on this library). The library will be installed using the `angstrom.install` file that dune generates.
+Here is a simple package example.
+
+- It defines an (optional) attribute `minimalOCamlVersion` that will be used to
+  throw a descriptive evaluation error if building with an older OCaml is
+  attempted.
+
+- It uses the `fetchFromGitHub` fetcher to get its source.
+
+- `useDune2 = true` ensures that the latest version of Dune is used for the
+  build (this may become the default value in a future release).
+
+- It sets the optional `doCheck` attribute such that tests will be run with
+  `dune runtest -p angstrom` after the build (`dune build -p angstrom`) is
+  complete, but only if the Ocaml version is at at least `"4.05"`.
+
+- It uses the package `ocaml-syntax-shims` as a build input, `alcotest` and
+  `ppx_let` as check inputs (because they are needed to run the tests), and
+  `bigstringaf` and `result` as propagated build inputs (thus they will also be
+  available to libraries depending on this library).
+
+- The library will be installed using the `angstrom.install` file that dune
+  generates.
 
 ```nix
-{ lib
-, fetchFromGitHub
-, buildDunePackage
-, alcotest
-, result
-, bigstringaf
-}:
+{ lib,
+  fetchFromGitHub,
+  buildDunePackage,
+  ocaml,
+  ocaml-syntax-shims,
+  alcotest,
+  result,
+  bigstringaf,
+  ppx_let }:
 
 buildDunePackage rec {
   pname = "angstrom";
-  version = "0.10.0";
+  version = "0.15.0";
+  useDune2 = true;
 
-  minimumOCamlVersion = "4.03";
+  minimalOCamlVersion = "4.04";
 
   src = fetchFromGitHub {
     owner  = "inhabitedtype";
     repo   = pname;
     rev    = version;
-    sha256 = "0lh6024yf9ds0nh9i93r9m6p5psi8nvrqxl5x7jwl13zb0r9xfpw";
+    sha256 = "1hmrkdcdlkwy7rxhngf3cv3sa61cznnd9p5lmqhx20664gx2ibrh";
   };
 
-  buildInputs = [ alcotest ];
+  checkInputs = [ alcotest ppx_let ];
+  buildInputs = [ ocaml-syntax-shims ];
   propagatedBuildInputs = [ bigstringaf result ];
-  doCheck = true;
+  doCheck = lib.versionAtLeast ocaml.version "4.05";
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/inhabitedtype/angstrom";
     description = "OCaml parser combinators built for speed and memory efficiency";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ sternenseemann ];
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ sternenseemann ];
   };
-}
 ```
 
 Here is a second example, this time using a source archive generated with `dune-release`. It is a good idea to use this archive when it is available as it will usually contain substituted variables such as a `%%VERSION%%` field. This library does not depend on any other OCaml library and no tests are run after building it.
 
 ```nix
-{ lib
-, fetchurl
-, buildDunePackage
-}:
+{ lib, fetchurl, buildDunePackage }:
 
 buildDunePackage rec {
   pname = "wtf8";
-  version = "1.0.1";
+  version = "1.0.2";
 
-  minimumOCamlVersion = "4.01";
+  useDune2 = true;
+
+  minimalOCamlVersion = "4.02";
 
   src = fetchurl {
-    url = "https://github.com/flowtype/ocaml-${pname}/releases/download/v${version}/${pname}-${version}.tbz";
-    sha256 = "1msg3vycd3k8qqj61sc23qks541cxpb97vrnrvrhjnqxsqnh6ygq";
+    url = "https://github.com/flowtype/ocaml-${pname}/releases/download/v${version}/${pname}-v${version}.tbz";
+    sha256 = "09ygcxxd5warkdzz17rgpidrd0pg14cy2svvnvy1hna080lzg7vp";
   };
 
   meta = with lib; {

From 21a5268b26fc3a42edadcdb50d61e004c2174812 Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Tue, 22 Jun 2021 13:28:29 +0200
Subject: [PATCH 416/416] nixos/doc: add section on sshfs file systems

This documents how to use sshfs a bit and how to set up an automatically
mounted sshfs filesystem in NixOS. Also it closes #125905.
---
 .../doc/manual/configuration/file-systems.xml |   1 +
 .../sshfs-file-systems.section.md             | 104 +++++++++++++
 .../sshfs-file-systems.section.xml            | 139 ++++++++++++++++++
 3 files changed, 244 insertions(+)
 create mode 100644 nixos/doc/manual/configuration/sshfs-file-systems.section.md
 create mode 100644 nixos/doc/manual/from_md/configuration/sshfs-file-systems.section.xml

diff --git a/nixos/doc/manual/configuration/file-systems.xml b/nixos/doc/manual/configuration/file-systems.xml
index 9747433375fc..42c59844ff4a 100644
--- a/nixos/doc/manual/configuration/file-systems.xml
+++ b/nixos/doc/manual/configuration/file-systems.xml
@@ -54,4 +54,5 @@
   </para>
  </note>
  <xi:include href="luks-file-systems.xml" />
+ <xi:include href="../from_md/configuration/sshfs-file-systems.section.xml" />
 </chapter>
diff --git a/nixos/doc/manual/configuration/sshfs-file-systems.section.md b/nixos/doc/manual/configuration/sshfs-file-systems.section.md
new file mode 100644
index 000000000000..4625fce03d58
--- /dev/null
+++ b/nixos/doc/manual/configuration/sshfs-file-systems.section.md
@@ -0,0 +1,104 @@
+# SSHFS File Systems {#sec-sshfs-file-systems}
+
+[SSHFS][sshfs] is a [FUSE][fuse] filesystem that allows easy access to directories on a remote machine using the SSH File Transfer Protocol (SFTP).
+It means that if you have SSH access to a machine, no additional setup is needed to mount a directory.
+
+[sshfs]: https://github.com/libfuse/sshfs
+[fuse]: https://en.wikipedia.org/wiki/Filesystem_in_Userspace
+
+## Interactive mounting {#sec-sshfs-interactive}
+
+In NixOS, SSHFS is packaged as <package>sshfs</package>.
+Once installed, mounting a directory interactively is simple as running:
+```ShellSession
+$ sshfs my-user@example.com:/my-dir /mnt/my-dir
+```
+Like any other FUSE file system, the directory is unmounted using:
+```ShellSession
+$ fusermount -u /mnt/my-dir
+```
+
+## Non-interactive mounting {#sec-sshfs-non-interactive}
+
+Mounting non-interactively requires some precautions because `sshfs` will run at boot and under a different user (root).
+For obvious reason, you can't input a password, so public key authentication using an unencrypted key is needed.
+To create a new key without a passphrase you can do:
+```ShellSession
+$ ssh-keygen -t ed25519 -P '' -f example-key
+Generating public/private ed25519 key pair.
+Your identification has been saved in test-key
+Your public key has been saved in test-key.pub
+The key fingerprint is:
+SHA256:yjxl3UbTn31fLWeyLYTAKYJPRmzknjQZoyG8gSNEoIE my-user@workstation
+```
+To keep the key safe, change the ownership to `root:root` and make sure the permissions are `600`:
+OpenSSH normally refuses to use the key if it's not well-protected.
+
+The file system can be configured in NixOS via the usual [fileSystems](options.html#opt-fileSystems) option.
+Here's a typical setup:
+```nix
+{
+  system.fsPackages = [ pkgs.sshfs ];
+
+  fileSystems."/mnt/my-dir" = {
+    device = "my-user@example.com:/my-dir/";
+    fsType = "sshfs";
+    options =
+      [ # Filesystem options
+        "allow_other"          # for non-root access
+        "_netdev"              # this is a network fs
+        "x-systemd.automount"  # mount on demand
+
+        # SSH options
+        "reconnect"              # handle connection drops
+        "ServerAliveInterval=15" # keep connections alive
+        "IdentityFile=/var/secrets/example-key"
+      ];
+  };
+}
+```
+More options from `ssh_config(5)` can be given as well, for example you can change the default SSH port or specify a jump proxy:
+```nix
+{
+  options =
+    [ "ProxyJump=bastion@example.com"
+      "Port=22"
+    ];
+}
+```
+It's also possible to change the `ssh` command used by SSHFS to connect to the server.
+For example:
+```nix
+{
+  options =
+    [ (builtins.replaceStrings [" "] ["\\040"]
+        "ssh_command=${pkgs.openssh}/bin/ssh -v -L 8080:localhost:80")
+    ];
+
+}
+```
+
+::: {.note}
+The escaping of spaces is needed because every option is written to the `/etc/fstab` file, which is a space-separated table.
+:::
+
+### Troubleshooting {#sec-sshfs-troubleshooting}
+
+If you're having a hard time figuring out why mounting is failing, you can add the option `"debug"`.
+This enables a verbose log in SSHFS that you can access via:
+```ShellSession
+$ journalctl -u $(systemd-escape -p /mnt/my-dir/).mount
+Jun 22 11:41:18 workstation mount[87790]: SSHFS version 3.7.1
+Jun 22 11:41:18 workstation mount[87793]: executing <ssh> <-x> <-a> <-oClearAllForwardings=yes> <-oServerAliveInterval=15> <-oIdentityFile=/var/secrets/wrong-key> <-2> <my-user@example.com> <-s> <sftp>
+Jun 22 11:41:19 workstation mount[87793]: my-user@example.com: Permission denied (publickey).
+Jun 22 11:41:19 workstation mount[87790]: read: Connection reset by peer
+Jun 22 11:41:19 workstation systemd[1]: mnt-my\x2ddir.mount: Mount process exited, code=exited, status=1/FAILURE
+Jun 22 11:41:19 workstation systemd[1]: mnt-my\x2ddir.mount: Failed with result 'exit-code'.
+Jun 22 11:41:19 workstation systemd[1]: Failed to mount /mnt/my-dir.
+Jun 22 11:41:19 workstation systemd[1]: mnt-my\x2ddir.mount: Consumed 54ms CPU time, received 2.3K IP traffic, sent 2.7K IP traffic.
+```
+
+::: {.note}
+If the mount point contains special characters it needs to be escaped using `systemd-escape`.
+This is due to the way systemd converts paths into unit names.
+:::
diff --git a/nixos/doc/manual/from_md/configuration/sshfs-file-systems.section.xml b/nixos/doc/manual/from_md/configuration/sshfs-file-systems.section.xml
new file mode 100644
index 000000000000..6b317aa63e9a
--- /dev/null
+++ b/nixos/doc/manual/from_md/configuration/sshfs-file-systems.section.xml
@@ -0,0 +1,139 @@
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-sshfs-file-systems">
+  <title>SSHFS File Systems</title>
+  <para>
+    <link xlink:href="https://github.com/libfuse/sshfs">SSHFS</link> is
+    a
+    <link xlink:href="https://en.wikipedia.org/wiki/Filesystem_in_Userspace">FUSE</link>
+    filesystem that allows easy access to directories on a remote
+    machine using the SSH File Transfer Protocol (SFTP). It means that
+    if you have SSH access to a machine, no additional setup is needed
+    to mount a directory.
+  </para>
+  <section xml:id="sec-sshfs-interactive">
+    <title>Interactive mounting</title>
+    <para>
+      In NixOS, SSHFS is packaged as <package>sshfs</package>. Once
+      installed, mounting a directory interactively is simple as
+      running:
+    </para>
+    <programlisting>
+$ sshfs my-user@example.com:/my-dir /mnt/my-dir
+</programlisting>
+    <para>
+      Like any other FUSE file system, the directory is unmounted using:
+    </para>
+    <programlisting>
+$ fusermount -u /mnt/my-dir
+</programlisting>
+  </section>
+  <section xml:id="sec-sshfs-non-interactive">
+    <title>Non-interactive mounting</title>
+    <para>
+      Mounting non-interactively requires some precautions because
+      <literal>sshfs</literal> will run at boot and under a different
+      user (root). For obvious reason, you can’t input a password, so
+      public key authentication using an unencrypted key is needed. To
+      create a new key without a passphrase you can do:
+    </para>
+    <programlisting>
+$ ssh-keygen -t ed25519 -P '' -f example-key
+Generating public/private ed25519 key pair.
+Your identification has been saved in test-key
+Your public key has been saved in test-key.pub
+The key fingerprint is:
+SHA256:yjxl3UbTn31fLWeyLYTAKYJPRmzknjQZoyG8gSNEoIE my-user@workstation
+</programlisting>
+    <para>
+      To keep the key safe, change the ownership to
+      <literal>root:root</literal> and make sure the permissions are
+      <literal>600</literal>: OpenSSH normally refuses to use the key if
+      it’s not well-protected.
+    </para>
+    <para>
+      The file system can be configured in NixOS via the usual
+      <link xlink:href="options.html#opt-fileSystems">fileSystems</link>
+      option. Here’s a typical setup:
+    </para>
+    <programlisting language="bash">
+{
+  system.fsPackages = [ pkgs.sshfs ];
+
+  fileSystems.&quot;/mnt/my-dir&quot; = {
+    device = &quot;my-user@example.com:/my-dir/&quot;;
+    fsType = &quot;sshfs&quot;;
+    options =
+      [ # Filesystem options
+        &quot;allow_other&quot;          # for non-root access
+        &quot;_netdev&quot;              # this is a network fs
+        &quot;x-systemd.automount&quot;  # mount on demand
+
+        # SSH options
+        &quot;reconnect&quot;              # handle connection drops
+        &quot;ServerAliveInterval=15&quot; # keep connections alive
+        &quot;IdentityFile=/var/secrets/example-key&quot;
+      ];
+  };
+}
+</programlisting>
+    <para>
+      More options from <literal>ssh_config(5)</literal> can be given as
+      well, for example you can change the default SSH port or specify a
+      jump proxy:
+    </para>
+    <programlisting language="bash">
+{
+  options =
+    [ &quot;ProxyJump=bastion@example.com&quot;
+      &quot;Port=22&quot;
+    ];
+}
+</programlisting>
+    <para>
+      It’s also possible to change the <literal>ssh</literal> command
+      used by SSHFS to connect to the server. For example:
+    </para>
+    <programlisting language="bash">
+{
+  options =
+    [ (builtins.replaceStrings [&quot; &quot;] [&quot;\\040&quot;]
+        &quot;ssh_command=${pkgs.openssh}/bin/ssh -v -L 8080:localhost:80&quot;)
+    ];
+
+}
+</programlisting>
+    <note>
+      <para>
+        The escaping of spaces is needed because every option is written
+        to the <literal>/etc/fstab</literal> file, which is a
+        space-separated table.
+      </para>
+    </note>
+    <section xml:id="sec-sshfs-troubleshooting">
+      <title>Troubleshooting</title>
+      <para>
+        If you’re having a hard time figuring out why mounting is
+        failing, you can add the option
+        <literal>&quot;debug&quot;</literal>. This enables a verbose log
+        in SSHFS that you can access via:
+      </para>
+      <programlisting>
+$ journalctl -u $(systemd-escape -p /mnt/my-dir/).mount
+Jun 22 11:41:18 workstation mount[87790]: SSHFS version 3.7.1
+Jun 22 11:41:18 workstation mount[87793]: executing &lt;ssh&gt; &lt;-x&gt; &lt;-a&gt; &lt;-oClearAllForwardings=yes&gt; &lt;-oServerAliveInterval=15&gt; &lt;-oIdentityFile=/var/secrets/wrong-key&gt; &lt;-2&gt; &lt;my-user@example.com&gt; &lt;-s&gt; &lt;sftp&gt;
+Jun 22 11:41:19 workstation mount[87793]: my-user@example.com: Permission denied (publickey).
+Jun 22 11:41:19 workstation mount[87790]: read: Connection reset by peer
+Jun 22 11:41:19 workstation systemd[1]: mnt-my\x2ddir.mount: Mount process exited, code=exited, status=1/FAILURE
+Jun 22 11:41:19 workstation systemd[1]: mnt-my\x2ddir.mount: Failed with result 'exit-code'.
+Jun 22 11:41:19 workstation systemd[1]: Failed to mount /mnt/my-dir.
+Jun 22 11:41:19 workstation systemd[1]: mnt-my\x2ddir.mount: Consumed 54ms CPU time, received 2.3K IP traffic, sent 2.7K IP traffic.
+</programlisting>
+      <note>
+        <para>
+          If the mount point contains special characters it needs to be
+          escaped using <literal>systemd-escape</literal>. This is due
+          to the way systemd converts paths into unit names.
+        </para>
+      </note>
+    </section>
+  </section>
+</section>