Merge branch 'master' into mattermost-6.3

2 years ago · 76aa0af628
parent 9db1fb4772 bed1dbe52f
commit 76aa0af628
227 changed files with 1576 additions and 1042 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -4256,6 +4256,16 @@
    githubId = 1313787;
    name = "Gabriel Gonzalez";
  };
+  gador = {
+    email = "florian.brandes@posteo.de";
+    github = "gador";
+    githubId = 1883533;
+    name = "Florian Brandes";
+    keys = [{
+      longkeyid = "rsa4096/0xBBB3E40E53797FD9";
+      fingerprint = "0200 3EF8 8D2B CF2D 8F00  FFDC BBB3 E40E 5379 7FD9";
+    }];
+  };
  gal_bolle = {
    email = "florent.becker@ens-lyon.org";
    github = "FlorentBecker";
@ -9820,6 +9830,13 @@
    githubId = 1016742;
    name = "Rafael García";
  };
+  raitobezarius = {
+    email = "ryan@lahfa.xyz";
+    matrix = "@raitobezarius:matrix.org";
+    github = "RaitoBezarius";
+    githubId = 314564;
+    name = "Ryan Lahfa";
+  };
  raquelgb = {
    email = "raquel.garcia.bautista@gmail.com";
    github = "raquelgb";
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@ -369,6 +369,28 @@
          <literal>~/.local/share/polymc/polymc.cfg</literal>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <literal>pkgs.noto-fonts-cjk</literal> is now deprecated in
+          favor of <literal>pkgs.noto-fonts-cjk-sans</literal> and
+          <literal>pkgs.noto-fonts-cjk-serif</literal> because they each
+          have different release schedules. To maintain compatibility
+          with prior releases of Nixpkgs,
+          <literal>pkgs.noto-fonts-cjk</literal> is currently an alias
+          of <literal>pkgs.noto-fonts-cjk-sans</literal> and doesn’t
+          include serif fonts.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The interface that allows activation scripts to restart units
+          has been reworked. Restarting and reloading is now done by a
+          single file
+          <literal>/run/nixos/activation-restart-list</literal> that
+          honors <literal>restartIfChanged</literal> and
+          <literal>reloadIfChanged</literal> of the units.
+        </para>
+      </listitem>
    </itemizedlist>
  </section>
  <section xml:id="sec-release-22.05-notable-changes">
@ -528,6 +550,31 @@
          Plugins are automatically repackaged using autoPatchelf.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The <literal>zrepl</literal> package has been updated from
+          0.4.0 to 0.5:
+        </para>
+        <itemizedlist spacing="compact">
+          <listitem>
+            <para>
+              The RPC protocol version was bumped; all zrepl daemons in
+              a setup must be updated and restarted before replication
+              can resume.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              A bug involving encrypt-on-receive has been fixed. Read
+              the
+              <link xlink:href="https://zrepl.github.io/configuration/sendrecvoptions.html#job-recv-options-placeholder">zrepl
+              documentation</link> and check the output of
+              <literal>zfs get -r encryption,zrepl:placeholder PATH_TO_ROOTFS</literal>
+              on the receiver.
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
    </itemizedlist>
  </section>
 </section>
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -114,6 +114,14 @@ In addition to numerous new and upgraded packages, this release has the followin

 - MultiMC has been replaced with the fork PolyMC due to upstream developers being hostile to 3rd party package maintainers. PolyMC removes all MultiMC branding and is aimed at providing proper 3rd party packages like the one contained in Nixpkgs. This change affects the data folder where game instances and other save and configuration files are stored. Users with existing installations should rename `~/.local/share/multimc` to `~/.local/share/polymc`. The main config file's path has also moved from `~/.local/share/multimc/multimc.cfg` to `~/.local/share/polymc/polymc.cfg`.

+- `pkgs.noto-fonts-cjk` is now deprecated in favor of `pkgs.noto-fonts-cjk-sans`
+  and `pkgs.noto-fonts-cjk-serif` because they each have different release
+  schedules. To maintain compatibility with prior releases of Nixpkgs,
+  `pkgs.noto-fonts-cjk` is currently an alias of `pkgs.noto-fonts-cjk-sans` and
+  doesn't include serif fonts.
+
+- The interface that allows activation scripts to restart units has been reworked. Restarting and reloading is now done by a single file `/run/nixos/activation-restart-list` that honors `restartIfChanged` and `reloadIfChanged` of the units.
+
 ## Other Notable Changes {#sec-release-22.05-notable-changes}

 - The option [services.redis.servers](#opt-services.redis.servers) was added
@ -181,3 +189,7 @@ In addition to numerous new and upgraded packages, this release has the followin

 - `services.mattermost.plugins` has been added to allow the declarative installation of Mattermost plugins.
  Plugins are automatically repackaged using autoPatchelf.
+
+- The `zrepl` package has been updated from 0.4.0 to 0.5:
+    * The RPC protocol version was bumped; all zrepl daemons in a setup must be updated and restarted before replication can resume.
+    * A bug involving encrypt-on-receive has been fixed.  Read the [zrepl documentation](https://zrepl.github.io/configuration/sendrecvoptions.html#job-recv-options-placeholder) and check the output of `zfs get -r encryption,zrepl:placeholder PATH_TO_ROOTFS` on the receiver.
--- a/nixos/modules/programs/chromium.nix
+++ b/nixos/modules/programs/chromium.nix
@ -7,6 +7,7 @@ let

  defaultProfile = filterAttrs (k: v: v != null) {
    HomepageLocation = cfg.homepageLocation;
+    DefaultSearchProviderEnabled = cfg.defaultSearchProviderEnabled;
    DefaultSearchProviderSearchURL = cfg.defaultSearchProviderSearchURL;
    DefaultSearchProviderSuggestURL = cfg.defaultSearchProviderSuggestURL;
    ExtensionInstallForcelist = cfg.extensions;
@ -50,6 +51,13 @@ in
        example = "https://nixos.org";
      };

+      defaultSearchProviderEnabled = mkOption {
+        type = types.nullOr types.bool;
+        description = "Enable the default search provider.";
+        default = null;
+        example = true;
+      };
+
      defaultSearchProviderSearchURL = mkOption {
        type = types.nullOr types.str;
        description = "Chromium default search provider url.";
--- a/nixos/modules/services/misc/ananicy.nix
+++ b/nixos/modules/services/misc/ananicy.nix
@ -84,7 +84,7 @@ in
      } // (if ((lib.getName cfg.package) == (lib.getName pkgs.ananicy-cpp)) then {
        # https://gitlab.com/ananicy-cpp/ananicy-cpp/-/blob/master/src/config.cpp#L12
        loglevel = mkOD "warn"; # default is info but its spammy
-        cgroup_realtime_workaround = mkOD true;
+        cgroup_realtime_workaround = mkOD config.systemd.enableUnifiedCgroupHierarchy;
      } else {
        # https://github.com/Nefelim4ag/Ananicy/blob/master/ananicy.d/ananicy.conf
        check_disks_schedulers = mkOD true;
--- a/nixos/modules/services/misc/heisenbridge.nix
+++ b/nixos/modules/services/misc/heisenbridge.nix
@ -23,7 +23,7 @@ let
 in
 {
  options.services.heisenbridge = {
-    enable = mkEnableOption "A bouncer-style Matrix IRC bridge";
+    enable = mkEnableOption "the Matrix to IRC bridge";

    package = mkOption {
      type = types.package;
@ -172,25 +172,39 @@ in
          ++ (map (lib.escapeShellArg) cfg.extraArgs)
        );

-        ProtectHome = true;
-        PrivateDevices = true;
-        ProtectKernelTunables = true;
-        ProtectKernelModules = true;
-        ProtectControlGroups = true;
-        StateDirectory = "heisenbridge";
-        StateDirectoryMode = "755";
+        # Hardening options

        User = "heisenbridge";
        Group = "heisenbridge";
+        RuntimeDirectory = "heisenbridge";
+        RuntimeDirectoryMode = "0700";
+        StateDirectory = "heisenbridge";
+        StateDirectoryMode = "0755";

-        CapabilityBoundingSet = [ "CAP_CHOWN" ] ++ optional (cfg.port < 1024 || cfg.identd.port < 1024) "CAP_NET_BIND_SERVICE";
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        RestrictSUIDSGID = true;
+        PrivateMounts = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectHostname = true;
+        ProtectClock = true;
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        RestrictNamespaces = true;
+        RemoveIPC = true;
+        UMask = "0077";
+
+        CapabilityBoundingSet = [ "CAP_CHOWN" ] ++ optional (cfg.port < 1024 || (cfg.identd.enable && cfg.identd.port < 1024)) "CAP_NET_BIND_SERVICE";
        AmbientCapabilities = CapabilityBoundingSet;
        NoNewPrivileges = true;
-
        LockPersonality = true;
        RestrictRealtime = true;
-        PrivateMounts = true;
-        SystemCallFilter = "~@aio @clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @raw-io @setuid @swap";
+        SystemCallFilter = ["@system-service" "~@priviledged" "@chown"];
        SystemCallArchitectures = "native";
        RestrictAddressFamilies = "AF_INET AF_INET6";
      };
--- a/nixos/modules/services/networking/adguardhome.nix
+++ b/nixos/modules/services/networking/adguardhome.nix
@ -87,6 +87,22 @@ in {
  };

  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.settings != { }
+          -> (hasAttrByPath [ "dns" "bind_host" ] cfg.settings)
+          || (hasAttrByPath [ "dns" "bind_hosts" ] cfg.settings);
+        message =
+          "AdGuard setting dns.bind_host or dns.bind_hosts needs to be configured for a minimal working configuration";
+      }
+      {
+        assertion = cfg.settings != { }
+          -> hasAttrByPath [ "dns" "bootstrap_dns" ] cfg.settings;
+        message =
+          "AdGuard setting dns.bootstrap_dns needs to be configured for a minimal working configuration";
+      }
+    ];
+
    systemd.services.adguardhome = {
      description = "AdGuard Home: Network-level blocker";
      after = [ "network.target" ];
@ -96,7 +112,7 @@ in {
        StartLimitBurst = 10;
      };

-      preStart = ''
+      preStart = optionalString (cfg.settings != { }) ''
        if    [ -e "$STATE_DIRECTORY/AdGuardHome.yaml" ] \
           && [ "${toString cfg.mutableSettings}" = "1" ]; then
          # Writing directly to AdGuardHome.yaml results in empty file
--- a/nixos/modules/services/networking/mosquitto.nix
+++ b/nixos/modules/services/networking/mosquitto.nix
@ -556,7 +556,7 @@ in
    systemd.services.mosquitto = {
      description = "Mosquitto MQTT Broker Daemon";
      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
+      after = [ "network-online.target" ];
      serviceConfig = {
        Type = "notify";
        NotifyAccess = "main";
--- a/nixos/modules/services/networking/nix-serve.nix
+++ b/nixos/modules/services/networking/nix-serve.nix
@ -26,6 +26,12 @@ in
        '';
      };

+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Open ports in the firewall for nix-serve.";
+      };
+
      secretKeyFile = mkOption {
        type = types.nullOr types.str;
        default = null;
@ -77,5 +83,9 @@ in
          "NIX_SECRET_KEY_FILE:${cfg.secretKeyFile}";
      };
    };
+
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.port ];
+    };
  };
 }
--- a/nixos/modules/system/activation/switch-to-configuration.pl
+++ b/nixos/modules/system/activation/switch-to-configuration.pl
@ -18,11 +18,13 @@ my $startListFile = "/run/nixos/start-list";
 my $restartListFile = "/run/nixos/restart-list";
 my $reloadListFile = "/run/nixos/reload-list";

-# Parse restart/reload requests by the activation script
+# Parse restart/reload requests by the activation script.
+# Activation scripts may write newline-separated units to this
+# file and switch-to-configuration will handle them. While
+# `stopIfChanged = true` is ignored, switch-to-configuration will
+# handle `restartIfChanged = false` and `reloadIfChanged = true`.
 my $restartByActivationFile = "/run/nixos/activation-restart-list";
-my $reloadByActivationFile = "/run/nixos/activation-reload-list";
 my $dryRestartByActivationFile = "/run/nixos/dry-activation-restart-list";
-my $dryReloadByActivationFile = "/run/nixos/dry-activation-reload-list";

 make_path("/run/nixos", { mode => oct(755) });

@ -382,7 +384,6 @@ sub filterUnits {
 }

 my @unitsToStopFiltered = filterUnits(\%unitsToStop);
-my @unitsToStartFiltered = filterUnits(\%unitsToStart);


 # Show dry-run actions.
@ -395,21 +396,39 @@ if ($action eq "dry-activate") {
    print STDERR "would activate the configuration...\n";
    system("$out/dry-activate", "$out");

-    $unitsToRestart{$_} = 1 foreach
-        split('\n', read_file($dryRestartByActivationFile, err_mode => 'quiet') // "");
+    # Handle the activation script requesting the restart or reload of a unit.
+    foreach (split('\n', read_file($dryRestartByActivationFile, err_mode => 'quiet') // "")) {
+        my $unit = $_;
+        my $baseUnit = $unit;
+        my $newUnitFile = "$out/etc/systemd/system/$baseUnit";
+
+        # Detect template instances.
+        if (!-e $newUnitFile && $unit =~ /^(.*)@[^\.]*\.(.*)$/) {
+          $baseUnit = "$1\@.$2";
+          $newUnitFile = "$out/etc/systemd/system/$baseUnit";
+        }
+
+        my $baseName = $baseUnit;
+        $baseName =~ s/\.[a-z]*$//;

-    $unitsToReload{$_} = 1 foreach
-        split('\n', read_file($dryReloadByActivationFile, err_mode => 'quiet') // "");
+        # Start units if they were not active previously
+        if (not defined $activePrev->{$unit}) {
+            $unitsToStart{$unit} = 1;
+            next;
+        }
+
+        handleModifiedUnit($unit, $baseName, $newUnitFile, $activePrev, \%unitsToRestart, \%unitsToRestart, \%unitsToReload, \%unitsToRestart, \%unitsToSkip);
+    }
+    unlink($dryRestartByActivationFile);

    print STDERR "would restart systemd\n" if $restartSystemd;
    print STDERR "would reload the following units: ", join(", ", sort(keys %unitsToReload)), "\n"
        if scalar(keys %unitsToReload) > 0;
    print STDERR "would restart the following units: ", join(", ", sort(keys %unitsToRestart)), "\n"
        if scalar(keys %unitsToRestart) > 0;
+    my @unitsToStartFiltered = filterUnits(\%unitsToStart);
    print STDERR "would start the following units: ", join(", ", @unitsToStartFiltered), "\n"
        if scalar @unitsToStartFiltered;
-    unlink($dryRestartByActivationFile);
-    unlink($dryReloadByActivationFile);
    exit 0;
 }

@ -433,13 +452,31 @@ print STDERR "activating the configuration...\n";
 system("$out/activate", "$out") == 0 or $res = 2;

 # Handle the activation script requesting the restart or reload of a unit.
-# We can only restart and reload (not stop/start) because the units to be
-# stopped are already stopped before the activation script is run.
-$unitsToRestart{$_} = 1 foreach
-    split('\n', read_file($restartByActivationFile, err_mode => 'quiet') // "");
+foreach (split('\n', read_file($restartByActivationFile, err_mode => 'quiet') // "")) {
+    my $unit = $_;
+    my $baseUnit = $unit;
+    my $newUnitFile = "$out/etc/systemd/system/$baseUnit";

-$unitsToReload{$_} = 1 foreach
-    split('\n', read_file($reloadByActivationFile, err_mode => 'quiet') // "");
+    # Detect template instances.
+    if (!-e $newUnitFile && $unit =~ /^(.*)@[^\.]*\.(.*)$/) {
+      $baseUnit = "$1\@.$2";
+      $newUnitFile = "$out/etc/systemd/system/$baseUnit";
+    }
+
+    my $baseName = $baseUnit;
+    $baseName =~ s/\.[a-z]*$//;
+
+    # Start units if they were not active previously
+    if (not defined $activePrev->{$unit}) {
+        $unitsToStart{$unit} = 1;
+        recordUnit($startListFile, $unit);
+        next;
+    }
+
+    handleModifiedUnit($unit, $baseName, $newUnitFile, $activePrev, \%unitsToRestart, \%unitsToRestart, \%unitsToReload, \%unitsToRestart, \%unitsToSkip);
+}
+# We can remove the file now because it has been propagated to the other restart/reload files
+unlink($restartByActivationFile);

 # Restart systemd if necessary. Note that this is done using the
 # current version of systemd, just in case the new one has trouble
@ -480,7 +517,6 @@ if (scalar(keys %unitsToReload) > 0) {
    print STDERR "reloading the following units: ", join(", ", sort(keys %unitsToReload)), "\n";
    system("@systemd@/bin/systemctl", "reload", "--", sort(keys %unitsToReload)) == 0 or $res = 4;
    unlink($reloadListFile);
-    unlink($reloadByActivationFile);
 }

 # Restart changed services (those that have to be restarted rather
@ -489,7 +525,6 @@ if (scalar(keys %unitsToRestart) > 0) {
    print STDERR "restarting the following units: ", join(", ", sort(keys %unitsToRestart)), "\n";
    system("@systemd@/bin/systemctl", "restart", "--", sort(keys %unitsToRestart)) == 0 or $res = 4;
    unlink($restartListFile);
-    unlink($restartByActivationFile);
 }

 # Start all active targets, as well as changed units we stopped above.
@ -498,6 +533,7 @@ if (scalar(keys %unitsToRestart) > 0) {
 # that are symlinks to other units.  We shouldn't start both at the
 # same time because we'll get a "Failed to add path to set" error from
 # systemd.
+my @unitsToStartFiltered = filterUnits(\%unitsToStart);
 print STDERR "starting the following units: ", join(", ", @unitsToStartFiltered), "\n"
    if scalar @unitsToStartFiltered;
 system("@systemd@/bin/systemctl", "start", "--", sort(keys %unitsToStart)) == 0 or $res = 4;
--- a/nixos/tests/adguardhome.nix
+++ b/nixos/tests/adguardhome.nix
@ -0,0 +1,57 @@
+import ./make-test-python.nix {
+  name = "adguardhome";
+
+  nodes = {
+    minimalConf = { ... }: {
+      services.adguardhome = { enable = true; };
+    };
+
+    declarativeConf = { ... }: {
+      services.adguardhome = {
+        enable = true;
+
+        mutableSettings = false;
+        settings = {
+          dns = {
+            bind_host = "0.0.0.0";
+            bootstrap_dns = "127.0.0.1";
+          };
+        };
+      };
+    };
+
+    mixedConf = { ... }: {
+      services.adguardhome = {
+        enable = true;
+
+        mutableSettings = true;
+        settings = {
+          dns = {
+            bind_host = "0.0.0.0";
+            bootstrap_dns = "127.0.0.1";
+          };
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    with subtest("Minimal config test"):
+        minimalConf.wait_for_unit("adguardhome.service")
+        minimalConf.wait_for_open_port(3000)
+
+    with subtest("Declarative config test, DNS will be reachable"):
+        declarativeConf.wait_for_unit("adguardhome.service")
+        declarativeConf.wait_for_open_port(53)
+        declarativeConf.wait_for_open_port(3000)
+
+    with subtest("Mixed config test, check whether merging works"):
+        mixedConf.wait_for_unit("adguardhome.service")
+        mixedConf.wait_for_open_port(53)
+        mixedConf.wait_for_open_port(3000)
+        # Test whether merging works properly, even if nothing is changed
+        mixedConf.systemctl("restart adguardhome.service")
+        mixedConf.wait_for_unit("adguardhome.service")
+        mixedConf.wait_for_open_port(3000)
+  '';
+}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -23,6 +23,7 @@ in
 {
  _3proxy = handleTest ./3proxy.nix {};
  acme = handleTest ./acme.nix {};
+  adguardhome = handleTest ./adguardhome.nix {};
  aesmd = handleTest ./aesmd.nix {};
  agda = handleTest ./agda.nix {};
  airsonic = handleTest ./airsonic.nix {};
--- a/nixos/tests/switch-test.nix
+++ b/nixos/tests/switch-test.nix
@ -45,6 +45,50 @@ import ./make-test-python.nix ({ pkgs, ...} : {
          systemd.services.test.restartIfChanged = false;
        };

+        restart-and-reload-by-activation-script.configuration = {
+          systemd.services = rec {
+            simple-service = {
+              # No wantedBy so we can check if the activation script restart triggers them
+              serviceConfig = {
+                Type = "oneshot";
+                RemainAfterExit = true;
+                ExecStart = "${pkgs.coreutils}/bin/true";
+                ExecReload = "${pkgs.coreutils}/bin/true";
+              };
+            };
+
+            simple-restart-service = simple-service // {
+              stopIfChanged = false;
+            };
+
+            simple-reload-service = simple-service // {
+              reloadIfChanged = true;
+            };
+
+            no-restart-service = simple-service // {
+              restartIfChanged = false;
+            };
+          };
+
+          system.activationScripts.restart-and-reload-test = {
+            supportsDryActivation = true;
+            deps = [];
+            text = ''
+              if [ "$NIXOS_ACTION" = dry-activate ]; then
+                f=/run/nixos/dry-activation-restart-list
+              else
+                f=/run/nixos/activation-restart-list
+              fi
+              cat <<EOF >> "$f"
+              simple-service.service
+              simple-restart-service.service
+              simple-reload-service.service
+              no-restart-service.service
+              EOF
+            '';
+          };
+        };
+
        mount.configuration = {
          systemd.mounts = [
            {
@ -261,6 +305,32 @@ import ./make-test-python.nix ({ pkgs, ...} : {
        assert_lacks(out, "as well:")
        assert_contains(out, "would start the following units: test.service\n")

+    with subtest("restart and reload by activation script"):
+        out = switch_to_specialisation("${machine}", "restart-and-reload-by-activation-script")
+        assert_contains(out, "stopping the following units: test.service\n")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_lacks(out, "reloading the following units:")
+        assert_lacks(out, "restarting the following units:")
+        assert_contains(out, "\nstarting the following units: no-restart-service.service, simple-reload-service.service, simple-restart-service.service, simple-service.service\n")
+        assert_lacks(out, "as well:")
+        # Switch to the same system where the example services get restarted
+        # by the activation script
+        out = switch_to_specialisation("${machine}", "restart-and-reload-by-activation-script")
+        assert_lacks(out, "stopping the following units:")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_contains(out, "reloading the following units: simple-reload-service.service\n")
+        assert_contains(out, "restarting the following units: simple-restart-service.service, simple-service.service\n")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_lacks(out, "as well:")
+        # The same, but in dry mode
+        out = switch_to_specialisation("${machine}", "restart-and-reload-by-activation-script", action="dry-activate")
+        assert_lacks(out, "would stop the following units:")
+        assert_lacks(out, "would NOT stop the following changed units:")
+        assert_contains(out, "would reload the following units: simple-reload-service.service\n")
+        assert_contains(out, "would restart the following units: simple-restart-service.service, simple-service.service\n")
+        assert_lacks(out, "\nwould start the following units:")
+        assert_lacks(out, "as well:")
+
    with subtest("mounts"):
        switch_to_specialisation("${machine}", "mount")
        out = machine.succeed("mount | grep 'on /testmount'")
--- a/pkgs/applications/audio/aumix/default.nix
+++ b/pkgs/applications/audio/aumix/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , gettext
 , ncurses
 , gtkGUI ? false
@ -17,6 +18,16 @@ stdenv.mkDerivation rec {
    sha256 = "0a8fwyxnc5qdxff8sl2sfsbnvgh6pkij4yafiln0fxgg6bal7knj";
  };

+  patches = [
+    # Pull Gentoo fix for -fno-common toolchains. Upstream does not
+    # seem to have the contacts
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-sound/aumix/files/aumix-2.9.1-fno-common.patch?id=496c9ec7355f06f6d1d19be780a6981503e6df1f";
+      sha256 = "0qwylhx1hawsmx1pc7ykrjq9phksc73dq9rss6ggq15n3ggnc95y";
+    })
+  ];
+
  buildInputs = [ gettext ncurses ]
    ++ lib.optionals gtkGUI [ pkg-config gtk2 ];

--- a/pkgs/applications/audio/rhvoice/default.nix
+++ b/pkgs/applications/audio/rhvoice/default.nix
@ -1,5 +1,5 @@
 { stdenv, lib, pkg-config, fetchFromGitHub, sconsPackages
-, python, glibmm, libpulseaudio, libao }:
+, glibmm, libpulseaudio, libao }:

 let
  version = "unstable-2018-02-10";
@ -19,7 +19,7 @@ in stdenv.mkDerivation {
  ];

  buildInputs = [
-    python glibmm libpulseaudio libao
+    glibmm libpulseaudio libao
  ];

  # SConstruct patch
--- a/pkgs/applications/audio/schismtracker/default.nix
+++ b/pkgs/applications/audio/schismtracker/default.nix
@ -3,7 +3,7 @@
 , fetchFromGitHub
 , autoreconfHook
 , alsa-lib
-, python
+, python3
 , SDL
 }:

@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
  configureFlags = [ "--enable-dependency-tracking" ]
    ++ lib.optional stdenv.isDarwin "--disable-sdltest";

-  nativeBuildInputs = [ autoreconfHook python ];
+  nativeBuildInputs = [ autoreconfHook python3 ];

  buildInputs = [ SDL ] ++ lib.optional stdenv.isLinux alsa-lib;

--- a/pkgs/applications/audio/sorcer/default.nix
+++ b/pkgs/applications/audio/sorcer/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub , boost, cairomm, cmake, libsndfile, lv2, ntk, pkg-config, python }:
+{ lib, stdenv, fetchFromGitHub , boost, cairomm, cmake, libsndfile, lv2, ntk, pkg-config }:

 stdenv.mkDerivation rec {
  pname = "sorcer";
@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ boost cairomm libsndfile lv2 ntk python ];
+  buildInputs = [ boost cairomm libsndfile lv2 ntk ];

  postPatch = ''
     # Fix build with lv2 1.18: https://github.com/brummer10/guitarix/commit/c0334c72
--- a/pkgs/applications/audio/split2flac/default.nix
+++ b/pkgs/applications/audio/split2flac/default.nix
@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, makeWrapper
 , shntool, cuetools
 , flac, faac, mp4v2, wavpack, mac
-, imagemagick, libiconv, enca, lame, pythonPackages, vorbis-tools
+, imagemagick, libiconv, enca, lame, mutagen, vorbis-tools
 , aacgain, mp3gain, vorbisgain
 }:

@ -12,7 +12,7 @@ let
      --prefix PATH : ${lib.makeBinPath [
        shntool cuetools
        flac faac mp4v2 wavpack mac
-        imagemagick libiconv enca lame pythonPackages.mutagen vorbis-tools
+        imagemagick libiconv enca lame mutagen vorbis-tools
        aacgain mp3gain vorbisgain
      ]}
  '';
--- a/pkgs/applications/audio/spot/default.nix
+++ b/pkgs/applications/audio/spot/default.nix
@ -21,19 +21,19 @@

 stdenv.mkDerivation rec {
  pname = "spot";
-  version = "0.2.2";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "xou816";
    repo = "spot";
    rev = version;
-    hash = "sha256-g0oVhlfez9i+Vv8lt/aNftCVqdgPMDySBBeLyOv7Zl8=";
+    hash = "sha256-An9PJsuXZkvJhP67cisWxFd2dpky53EY/xcR6StgWFY=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-n10aYzkRqEe1h2WPAfARjH79Npvv+3fdX9jCtxv2a34=";
+    hash = "sha256-2qMmPIBoZS6WT06VzCmnYWaIfLzWN2HUvk7y9GKuuXg=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/blockchains/chia-plotter/default.nix
+++ b/pkgs/applications/blockchains/chia-plotter/default.nix
@ -4,7 +4,7 @@
 , libsodium
 , cmake
 , substituteAll
-, pythonPackages
+, python3Packages
 }:

 stdenv.mkDerivation {
@ -23,7 +23,7 @@ stdenv.mkDerivation {
    # prevent CMake from trying to get libraries on the Internet
    (substituteAll {
      src = ./dont_fetch_dependencies.patch;
-      pybind11_src = pythonPackages.pybind11.src;
+      pybind11_src = python3Packages.pybind11.src;
      relic_src = fetchFromGitHub {
        owner = "relic-toolkit";
        repo = "relic";
--- a/pkgs/applications/editors/netbeans/default.nix
+++ b/pkgs/applications/editors/netbeans/default.nix
@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, makeWrapper, makeDesktopItem, which, unzip, libicns, imagemagick
-, jdk, perl, python
+, jdk, perl
 }:

 let
@ -58,7 +58,7 @@ stdenv.mkDerivation {
  '';

  nativeBuildInputs = [ makeWrapper unzip ];
-  buildInputs = [ perl python libicns imagemagick ];
+  buildInputs = [ perl libicns imagemagick ];

  meta = {
    description = "An integrated development environment for Java, C, C++ and PHP";
--- a/pkgs/applications/editors/tiled/default.nix
+++ b/pkgs/applications/editors/tiled/default.nix
@ -1,5 +1,5 @@
 { lib, mkDerivation, fetchFromGitHub, pkg-config, qmake
-, python, qtbase, qttools }:
+, python2, qtbase, qttools }:

 mkDerivation rec {
  pname = "tiled";
@ -13,7 +13,7 @@ mkDerivation rec {
  };

  nativeBuildInputs = [ pkg-config qmake ];
-  buildInputs = [ python qtbase qttools ];
+  buildInputs = [ python2 qtbase qttools ];

  meta = with lib; {
    description = "Free, easy to use and flexible tile map editor";
--- a/pkgs/applications/editors/wxhexeditor/default.nix
+++ b/pkgs/applications/editors/wxhexeditor/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, wxGTK, autoconf, automake, libtool, python, gettext }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, wxGTK, autoconf, automake, libtool, python2, gettext }:

 stdenv.mkDerivation rec {
  pname = "wxHexEditor";
@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
    sha256 = "08xnhaif8syv1fa0k6lc3jm7yg2k50b02lyds8w0jyzh4xi5crqj";
  };

-  buildInputs = [ wxGTK autoconf automake libtool python gettext ];
+  buildInputs = [ wxGTK autoconf automake libtool python2 gettext ];

  preConfigure = "patchShebangs .";

--- a/pkgs/applications/graphics/inkscape/default.nix
+++ b/pkgs/applications/graphics/inkscape/default.nix
@ -81,6 +81,14 @@ stdenv.mkDerivation rec {
      stripLen = 1;
      extraPrefix = "share/extensions/";
    })
+    # Remove mandatory break from end of paragraphs, added in Pango 1.49
+    # https://gitlab.com/inkscape/inkscape/-/merge_requests/3630
+    # TODO: Remove in Inkscape 1.1.2
+    (fetchpatch {
+      url = "https://gitlab.com/inkscape/inkscape/-/commit/b3dabef2245d4e4e977ee9d6776be9a134493515.patch";
+      sha256 = "YhqUlRBKL1vJ/iCM/DvdwbmPIsAHQpcgf4TPpjlnBng=";
+    })
+
  ];

  postPatch = ''
--- a/pkgs/applications/graphics/screencloud/default.nix
+++ b/pkgs/applications/graphics/screencloud/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, qt4, quazip, qt-mobility, qxt, pythonPackages }:
+{ lib, stdenv, fetchFromGitHub, cmake, qt4, quazip, qt-mobility, qxt, python2Packages }:

 with lib;
 stdenv.mkDerivation rec {
@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ cmake ];
-  buildInputs = [ qt4 quazip qt-mobility qxt pythonPackages.python pythonPackages.pycrypto ];
+  buildInputs = [ qt4 quazip qt-mobility qxt python2Packages.python python2Packages.pycrypto ];

  patchPhase = ''
    # Required to make the configure script work. Normally, screencloud's
@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
  postInstall = ''
    patchShebangs $prefix/opt/screencloud/screencloud.sh
    substituteInPlace "$prefix/opt/screencloud/screencloud.sh" --replace "/opt" "$prefix/opt"
-    sed -i "2 i\export PYTHONPATH=$(toPythonPath ${pythonPackages.pycrypto}):\$PYTHONPATH" "$prefix/opt/screencloud/screencloud.sh"
+    sed -i "2 i\export PYTHONPATH=$(toPythonPath ${python2Packages.pycrypto}):\$PYTHONPATH" "$prefix/opt/screencloud/screencloud.sh"
    mkdir $prefix/bin
    mkdir $prefix/lib
    ln -s $prefix/opt/screencloud/screencloud.sh $prefix/bin/screencloud
--- a/pkgs/applications/misc/auto-multiple-choice/default.nix
+++ b/pkgs/applications/misc/auto-multiple-choice/default.nix
@ -82,7 +82,7 @@ stdenv.mkDerivation rec {
      XMLWriter
    ]}:"$out/share/perl5 \
    --prefix XDG_DATA_DIRS : "$out/share" \
-    --set TEXINPUTS ":.:$out/share/texmf/tex/latex/AMC"
+    --set TEXINPUTS ":.:$out/tex/latex"
  '';

  nativeBuildInputs = [
--- a/pkgs/applications/misc/ocropus/default.nix
+++ b/pkgs/applications/misc/ocropus/default.nix
@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, fetchurl, pythonPackages, curl }:
+{ lib, fetchFromGitHub, fetchurl, python2Packages, curl }:

 let
  getmodel = name: sha256: {
@ -17,7 +17,7 @@ let
  ];

 in
-pythonPackages.buildPythonApplication rec {
+python2Packages.buildPythonApplication rec {
  pname = "ocropus";
  version = "1.3.3";

@ -28,7 +28,7 @@ pythonPackages.buildPythonApplication rec {
    owner = "tmbdev";
  };

-  propagatedBuildInputs = with pythonPackages; [ curl numpy scipy pillow
+  propagatedBuildInputs = with python2Packages; [ curl numpy scipy pillow
    matplotlib beautifulsoup4 pygtk lxml ];

  enableParallelBuilding = true;
--- a/pkgs/applications/misc/pdfdiff/default.nix
+++ b/pkgs/applications/misc/pdfdiff/default.nix
@ -1,6 +1,6 @@
-{ lib, pythonPackages, fetchurl, xpdf }:
+{ lib, python2Packages, fetchurl, xpdf }:
 let
-  py = pythonPackages;
+  py = python2Packages;
 in
 py.buildPythonApplication rec {
  name = "pdfdiff-${version}";
@ -11,7 +11,7 @@ py.buildPythonApplication rec {
    sha256 = "0zxwjjbklz87wkbhkmsvhc7xmv5php7m2a9vm6ydhmhlxsybf836";
  };

-  buildInputs = [  pythonPackages.wrapPython ];
+  buildInputs = [  python2Packages.wrapPython ];

  dontConfigure = true;
  dontBuild = true;
@ -29,7 +29,7 @@ py.buildPythonApplication rec {
    cp pdfdiff.py $out/bin/pdfdiff
    chmod +x $out/bin/pdfdiff

-    substituteInPlace $out/bin/pdfdiff --replace "#!/usr/bin/python" "#!${pythonPackages.python.interpreter}"
+    substituteInPlace $out/bin/pdfdiff --replace "#!/usr/bin/python" "#!${python2Packages.python.interpreter}"
    '';

  meta = with lib; {
--- a/pkgs/applications/misc/phwmon/default.nix
+++ b/pkgs/applications/misc/phwmon/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitLab, pythonPackages }:
+{ lib, stdenv, fetchFromGitLab, python2Packages }:

 stdenv.mkDerivation {
  pname = "phwmon";
@ -11,11 +11,11 @@ stdenv.mkDerivation {
    sha256 = "1hqmsq66y8bqkpvszw84jyk8haxq3cjnz105hlkmp7786vfmkisq";
  };

-  nativeBuildInputs = [ pythonPackages.wrapPython ];
+  nativeBuildInputs = [ python2Packages.wrapPython ];

-  buildInputs = [ pythonPackages.pygtk pythonPackages.psutil ];
+  buildInputs = [ python2Packages.pygtk python2Packages.psutil ];

-  pythonPath = [ pythonPackages.pygtk pythonPackages.psutil ];
+  pythonPath = [ python2Packages.pygtk python2Packages.psutil ];

  patchPhase = ''
    substituteInPlace install.sh --replace "/usr/local" "$out"
--- a/pkgs/applications/misc/rofi/wayland.nix
+++ b/pkgs/applications/misc/rofi/wayland.nix
@ -0,0 +1,31 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, rofi-unwrapped
+, wayland-protocols
+, wayland
+}:
+
+rofi-unwrapped.overrideAttrs (oldAttrs: rec {
+  pname = "rofi-wayland-unwrapped";
+  version = "1.7.2+wayland1";
+
+  src = fetchFromGitHub {
+    owner = "lbonn";
+    repo = "rofi";
+    rev = version;
+    fetchSubmodules = true;
+    sha256 = "sha256-INFYHOVjBNj8ks4UjKnxLW8mL7h1c8ySFPS/rUxOWwo=";
+  };
+
+  nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [ wayland-protocols ];
+  buildInputs = oldAttrs.buildInputs ++ [ wayland ];
+
+  meta = with lib; {
+    description = "Window switcher, run dialog and dmenu replacement for Wayland";
+    homepage = "https://github.com/lbonn/rofi";
+    license = licenses.mit;
+    maintainers = with maintainers; [ bew ];
+    platforms = with platforms; linux;
+  };
+})
--- a/pkgs/applications/misc/survex/default.nix
+++ b/pkgs/applications/misc/survex/default.nix
@ -9,7 +9,7 @@
 , proj_7
 , perl532
 , unscii
-, python
+, python2
 , libGL
 , libGLU
 , xlibsWrapper
@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
  pname = "survex";
  version = "1.2.44";

-  nativeBuildInputs = [ docbook5 docbook2x autoreconfHook pkg-config perlenv python ];
+  nativeBuildInputs = [ docbook5 docbook2x autoreconfHook pkg-config perlenv python2 ];

  buildInputs = [
    libGL libGLU ffmpeg proj_7
--- a/pkgs/applications/misc/weather/default.nix
+++ b/pkgs/applications/misc/weather/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pythonPackages, installShellFiles }:
+{ lib, stdenv, fetchurl, python2Packages, installShellFiles }:

 stdenv.mkDerivation rec {
  version = "2.4.2";
@ -11,7 +11,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [
    installShellFiles
-    pythonPackages.wrapPython
+    python2Packages.wrapPython
  ];

  dontConfigure = true;
@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
  # Upstream doesn't provide a setup.py or alike, so we follow:
  # http://fungi.yuggoth.org/weather/doc/install.rst#id3
  installPhase = ''
-    site_packages=$out/${pythonPackages.python.sitePackages}
+    site_packages=$out/${python2Packages.python.sitePackages}
    install -Dt $out/bin -m 755 weather
    install -Dt $site_packages weather.py
    install -Dt $out/share/weather-util \
--- a/pkgs/applications/networking/cluster/tanka/default.nix
+++ b/pkgs/applications/networking/cluster/tanka/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "tanka";
-  version = "0.17.3";
+  version = "0.19.0";

  src = fetchFromGitHub {
    owner = "grafana";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Khu6ovtcXkqqt3W4OoJ09INgv80tw/6uDcJS+jt3y0Y=";
+    sha256 = "sha256-SMPStxqzoeooBoqUJdFK6Zg3dzbNHrB/tv8iwa8GdbM=";
  };

-  vendorSha256 = "sha256-vpm2y/CxRNWkz6+AOMmmZH5AjRQWAa6WD5Fnx5lqJYw=";
+  vendorSha256 = "sha256-pqwdxFFcATfxGmz6quIH8OL4U2DZKmuVyOLEct2nBlE=";

  doCheck = false;

--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -21,10 +21,10 @@
    "owner": "aiven",
    "provider-source-address": "registry.terraform.io/aiven/aiven",
    "repo": "terraform-provider-aiven",
-    "rev": "v2.4.0",
-    "sha256": "0m43d2iaa9kywzvlgcnsya1ma9k570j9q8cq9l6ldpc8565fqq0i",
-    "vendorSha256": "1lpfnpg4sivy8vilkxamdn1hyn6k61lxsfcq67afxsq8pcy6q44v",
-    "version": "2.4.0"
+    "rev": "v2.5.0",
+    "sha256": "1x37bnykn28hmb80qi530zgk6jfqpk97nswrm0hdw8x5vac4v63a",
+    "vendorSha256": "0ldk06dj72551b6djsq7vil0hzfsp3ixwh3ikqb40shsdq10iplx",
+    "version": "2.5.0"
  },
  "akamai": {
    "owner": "akamai",
@ -40,10 +40,10 @@
    "owner": "aliyun",
    "provider-source-address": "registry.terraform.io/aliyun/alicloud",
    "repo": "terraform-provider-alicloud",
-    "rev": "v1.151.0",
-    "sha256": "0pdvbq9kfq7vwkfk75fjy6jaiq5bfkjmvr3z07712b76z29m10bz",
+    "rev": "v1.152.0",
+    "sha256": "1childp3dkdi6raya1865inkky2qx1jav95yq9c57gz20zs27x8a",
    "vendorSha256": "18chs2723i2cxhhm649mz52pp6wrfqzxgk12zxq9idrhicchqnzg",
-    "version": "1.151.0"
+    "version": "1.152.0"
  },
  "ansible": {
    "owner": "nbering",
@ -94,28 +94,28 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/aws",
    "repo": "terraform-provider-aws",
-    "rev": "v3.71.0",
-    "sha256": "0jr9mk6gvimh8picpcc47pcan323k4rml438743ma53g8jhcvn2a",
-    "vendorSha256": "02ax2717xci8qia3k7q19yknazn67idb64hf5mwahfnx1fjmdc22",
-    "version": "3.71.0"
+    "rev": "v3.72.0",
+    "sha256": "0xkwqh7akc7rf047w6by4368n2bpn4lijk9j6j3wsgbaffw0xjlb",
+    "vendorSha256": "0apvp3vb3qx2l6698x4ai3spz40l6mb3z8gn45ms2vlxcwp2wf7y",
+    "version": "3.72.0"
  },
  "azuread": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/azuread",
    "repo": "terraform-provider-azuread",
-    "rev": "v2.14.0",
-    "sha256": "0sjpwhywc165gkxd1ybkwi1aww4xivry82wh0mbh4bgs607mn8lg",
+    "rev": "v2.15.0",
+    "sha256": "1gjx91svfg25x0hlx6mfam40615x278b9vxsy5p88s3dl6xs3hdv",
    "vendorSha256": null,
-    "version": "2.14.0"
+    "version": "2.15.0"
  },
  "azurerm": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/azurerm",
    "repo": "terraform-provider-azurerm",
-    "rev": "v2.91.0",
-    "sha256": "0db23ch46wi5mjmwibp7n98y0j3cl06mq2pzmvw1scbzvgh0gcqp",
+    "rev": "v2.92.0",
+    "sha256": "0p4vxda4n7895xp7aqg4zqddynjn7hnzsc8am83y8hf9hbfaji8q",
    "vendorSha256": null,
-    "version": "2.91.0"
+    "version": "2.92.0"
  },
  "azurestack": {
    "owner": "hashicorp",
@ -185,10 +185,10 @@
    "owner": "cloudflare",
    "provider-source-address": "registry.terraform.io/cloudflare/cloudflare",
    "repo": "terraform-provider-cloudflare",
-    "rev": "v3.6.0",
-    "sha256": "1adpzk9vjllr18dq8kggxfabm3ax59m55ls98mkqh8lmgq96bh7d",
-    "vendorSha256": "1rdgjb1gfz5fs6s3c15nj92rm8ifb23n25wpxl16mz4aifkjgqam",
-    "version": "3.6.0"
+    "rev": "v3.7.0",
+    "sha256": "1d1wljk033b9j5sx01xjv5jmclw79f2f21s8zsix036mmzvaiswb",
+    "vendorSha256": "1g3fyxrdqa4ds6n9pcw2mvi8nfiz4dna57ssvggfwic4jl89q7zm",
+    "version": "3.7.0"
  },
  "cloudfoundry": {
    "owner": "cloudfoundry-community",
@ -266,10 +266,10 @@
    "owner": "digitalocean",
    "provider-source-address": "registry.terraform.io/digitalocean/digitalocean",
    "repo": "terraform-provider-digitalocean",
-    "rev": "v2.16.0",
-    "sha256": "0l67yd7l0s36lwp1hm44d77i7d5019j0ddjzf22aw8cv9xd5fhxw",
+    "rev": "v2.17.0",
+    "sha256": "0in6xg4kgqy1izi8zapdi0f6dsni3i27fxh1l4sqp5kwh3vgpn0d",
    "vendorSha256": null,
-    "version": "2.16.0"
+    "version": "2.17.0"
  },
  "dme": {
    "owner": "DNSMadeEasy",
@ -347,10 +347,10 @@
    "owner": "fastly",
    "provider-source-address": "registry.terraform.io/fastly/fastly",
    "repo": "terraform-provider-fastly",
-    "rev": "v0.39.0",
-    "sha256": "0sjjcz2z7qr1dmm6zzyi382cas4k5vdg0q7yxlpcqxqqrql636k8",
+    "rev": "v0.40.0",
+    "sha256": "11gf1xmj0qgn3hfw4hviqnfc23rrfd3qxz82idff4f1i7c5kym1i",
    "vendorSha256": null,
-    "version": "0.39.0"
+    "version": "0.40.0"
  },
  "flexibleengine": {
    "owner": "FlexibleEngineCloud",
@ -393,29 +393,29 @@
    "provider-source-address": "registry.terraform.io/hashicorp/google",
    "proxyVendor": true,
    "repo": "terraform-provider-google",
-    "rev": "v4.5.0",
-    "sha256": "173aqwrzqdb3y57wiq1dbgb74ksr063qqq1k178n4wrab4s1h3px",
+    "rev": "v4.6.0",
+    "sha256": "0vi0crc4i5myzw17knvb3zz0yjpg7v1qvp9rjrb0q6v89nafr30c",
    "vendorSha256": "17rlq86zl83cav8pinr8am3wkmva4slab2izmxddhiw3na60a4la",
-    "version": "4.5.0"
+    "version": "4.6.0"
  },
  "google-beta": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/google-beta",
    "proxyVendor": true,
    "repo": "terraform-provider-google-beta",
-    "rev": "v4.5.0",
-    "sha256": "17z2jy8b9gk0id8q0318a6k60fhcqps0p36s7d7kkqmr44shgzs4",
+    "rev": "v4.6.0",
+    "sha256": "0kbdpyln8yy3128g43y134v5li9k5a6mb2fwa0jl8zffmhfc209k",
    "vendorSha256": "17rlq86zl83cav8pinr8am3wkmva4slab2izmxddhiw3na60a4la",
-    "version": "4.5.0"
+    "version": "4.6.0"
  },
  "grafana": {
    "owner": "grafana",
    "provider-source-address": "registry.terraform.io/grafana/grafana",
    "repo": "terraform-provider-grafana",
-    "rev": "v1.17.0",
-    "sha256": "10mj1dvz7q3w250hvi3k4rj2x0mn592gw2xcy1j98x5ll6kx4ynd",
-    "vendorSha256": "1bhygkkgd3j971cg6wha57cyh4ggbkaihw6sn6p9jvdi1k1f63lw",
-    "version": "1.17.0"
+    "rev": "v1.18.0",
+    "sha256": "1qvhdshaiy1v7557nkh869k1wmz604pv2gchv98vrm3cp7zj83zn",
+    "vendorSha256": "1rgvil2kw38kbgbgcjy8mbkahj6zm91s187x41vd4x7ypc5kgbkn",
+    "version": "1.18.0"
  },
  "gridscale": {
    "owner": "gridscale",
@ -466,10 +466,10 @@
    "owner": "huaweicloud",
    "provider-source-address": "registry.terraform.io/huaweicloud/huaweicloud",
    "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.32.0",
-    "sha256": "1k5d4a488mrba6cvpcbhd9hqhhb977yi89p32wlfx266mf11w2yw",
+    "rev": "v1.32.1",
+    "sha256": "05rm1cmpbmavza1pyqjzrd316v6r68427cjhqy6bngb749nc1als",
    "vendorSha256": null,
-    "version": "1.32.0"
+    "version": "1.32.1"
  },
  "huaweicloudstack": {
    "owner": "huaweicloud",
@ -493,10 +493,10 @@
    "owner": "IBM-Cloud",
    "provider-source-address": "registry.terraform.io/IBM-Cloud/ibm",
    "repo": "terraform-provider-ibm",
-    "rev": "v1.37.1",
-    "sha256": "1m9038ylv44xhgws0jrqdynj7kd97x9jgk1npqblbfv86fccwqxc",
-    "vendorSha256": "1a8zy023j3mcy3bswyrmllkgv61wiyxa1f7bfj8mxx3701rsb4ji",
-    "version": "1.37.1"
+    "rev": "v1.38.0",
+    "sha256": "0cbyq74fy3y7ia8lywr8amwcjq53bn3psymyl5cnwqx8y97avx5w",
+    "vendorSha256": "0cgl87pij4amn77ksbrzl0qlf6a5ga29b64cnasq8lq03lbmqzw4",
+    "version": "1.38.0"
  },
  "icinga2": {
    "owner": "Icinga",
@ -674,10 +674,10 @@
    "owner": "mongodb",
    "provider-source-address": "registry.terraform.io/mongodb/mongodbatlas",
    "repo": "terraform-provider-mongodbatlas",
-    "rev": "v1.1.1",
-    "sha256": "0ifrpamajmrqa3fmsg4qyag1i7ghrswbhl0ixj8hgw7kzbzslsyd",
-    "vendorSha256": "1xrpgrzk5hr7qc5zm7nq5ljhc4sgzbsaxfszc8dlpc5y49j5q0ip",
-    "version": "1.1.1"
+    "rev": "v1.2.0",
+    "sha256": "08v1byvy7c2wdlbinjxb01vbzvsqfc73nc3cacp40n69z8wl70bi",
+    "vendorSha256": "19q835m219i85bq7mm5gafpw4q2y4lhbas2ppbfn3hkky15mvwks",
+    "version": "1.2.0"
  },
  "ncloud": {
    "owner": "NaverCloudPlatform",
@ -701,10 +701,10 @@
    "owner": "newrelic",
    "provider-source-address": "registry.terraform.io/newrelic/newrelic",
    "repo": "terraform-provider-newrelic",
-    "rev": "v2.34.1",
-    "sha256": "1j7r6cac1ajp8f6h2492dnz7ihkxbdi8js535dv04kiah79r49d5",
-    "vendorSha256": "0qbrrh5qdbcnzmf69jilcd9qql526w9mf4ix8y8bi94w7m0nwxap",
-    "version": "2.34.1"
+    "rev": "v2.35.0",
+    "sha256": "0pwy3vsj332v82n3is6xaw4mgvv968ffr8n41s1r7j39r8bpl77f",
+    "vendorSha256": "13xqrdv0xnza0yxdgk155x4vq8lai9jrjvnfp153jb5p5hfnzwmp",
+    "version": "2.35.0"
  },
  "nomad": {
    "owner": "hashicorp",
@ -757,19 +757,19 @@
    "owner": "terraform-providers",
    "provider-source-address": "registry.terraform.io/hashicorp/oci",
    "repo": "terraform-provider-oci",
-    "rev": "v4.58.0",
-    "sha256": "0cxzy9sj4n7yz7zbqhpkr92h7gqqfx7qxpr0a1jgh9a087j3752c",
+    "rev": "v4.59.0",
+    "sha256": "12i4j95g08c887xxplc90hcxwsrpwcn5qjyy5inazr21vqscjx2h",
    "vendorSha256": null,
-    "version": "4.58.0"
+    "version": "4.59.0"
  },
  "okta": {
    "owner": "okta",
    "provider-source-address": "registry.terraform.io/okta/okta",
    "repo": "terraform-provider-okta",
-    "rev": "v3.20.2",
-    "sha256": "0qlm99m4dljnczsypn4gmw9n4vvxkfazi21hvkbkgy2v3wmhsms9",
-    "vendorSha256": "0fyxm6wff5pz5g3rjnia23npar9qbwcv01pa3rsskxkl8jc3v13j",
-    "version": "3.20.2"
+    "rev": "v3.20.3",
+    "sha256": "0m9y0dagav1pw8cz6pv9zkhag59f9bbn8b6zi1h3lcgvmzf303wv",
+    "vendorSha256": "156nyjga5q5mgwiq6aynp199i0hn5mvckj2h7j3pfzc1yz8ri5cc",
+    "version": "3.20.3"
  },
  "oktaasa": {
    "owner": "oktadeveloper",
@ -857,10 +857,10 @@
    "owner": "PaloAltoNetworks",
    "provider-source-address": "registry.terraform.io/PaloAltoNetworks/panos",
    "repo": "terraform-provider-panos",
-    "rev": "v1.9.1",
-    "sha256": "05jsap80dcgmncxa8xbx1hnrbpi9bxjz2k9jnfnws1pmbjxl94hf",
+    "rev": "v1.9.2",
+    "sha256": "03585rm434lcp6xk58185i78iv5fjd18z7nrdnbhxxy94yhhf335",
    "vendorSha256": null,
-    "version": "1.9.1"
+    "version": "1.9.2"
  },
  "pass": {
    "owner": "camptocamp",
@ -1001,10 +1001,10 @@
    "owner": "spotinst",
    "provider-source-address": "registry.terraform.io/spotinst/spotinst",
    "repo": "terraform-provider-spotinst",
-    "rev": "v1.64.2",
-    "sha256": "0h47ik93lhb9mjg3ai9n76ya918h1mk3fyp70yr26rwc3rihvjm6",
-    "vendorSha256": "1lv305kamb3xnw3a2q45ndn7a88ifnh8j8ngv7awc41028j539w4",
-    "version": "1.64.2"
+    "rev": "v1.65.0",
+    "sha256": "1gk4v6lxa4k8za6c1zxrrrc6qw3ymsk46w97qhfri6y7vrc3vxh0",
+    "vendorSha256": "0xhzj8lmrh0mcpbxa7xkzhhgl3jfk6mz5adia0jgflgrx4wjaf38",
+    "version": "1.65.0"
  },
  "stackpath": {
    "owner": "stackpath",
@ -1046,10 +1046,10 @@
    "owner": "tencentcloudstack",
    "provider-source-address": "registry.terraform.io/tencentcloudstack/tencentcloud",
    "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.60.26",
-    "sha256": "1diwiyfswmgqm1iizj228s2ysrnx4z3lqlq82a7gp0z9p8rzd0vs",
+    "rev": "v1.61.1",
+    "sha256": "1v6b8ldg6pkphqy5aphdhig1q3iizzfrj611k39lyk1q3q914yf4",
    "vendorSha256": null,
-    "version": "1.60.26"
+    "version": "1.61.1"
  },
  "tfe": {
    "owner": "hashicorp",
@ -1128,10 +1128,10 @@
    "owner": "vmware",
    "provider-source-address": "registry.terraform.io/vmware/vcd",
    "repo": "terraform-provider-vcd",
-    "rev": "v3.5.0",
-    "sha256": "1sdcjizg0gip55042p0599wvjicibyx9kiymxq45af14yhnwqyv5",
+    "rev": "v3.5.1",
+    "sha256": "1fwkbsgnxn0jl84nji57grasdsbw0ydd7vzcllpv7r1z3jpa545q",
    "vendorSha256": "0bzp6807l4hspk1c1pmgnzk0axk0nir3v0lqmw9xvkij4c5rnz9s",
-    "version": "3.5.0"
+    "version": "3.5.1"
  },
  "venafi": {
    "deleteVendor": true,
--- a/pkgs/applications/networking/instant-messengers/franz/generic.nix
+++ b/pkgs/applications/networking/instant-messengers/franz/generic.nix
@ -24,6 +24,7 @@
 , libnotify
 , xdg-utils
 , mesa
+, libappindicator-gtk3
 }:

 # Helper function for building a derivation for Franz and forks.
@ -68,7 +69,7 @@ stdenv.mkDerivation rec {
    expat
    stdenv.cc.cc
  ];
-  runtimeDependencies = [ stdenv.cc.cc.lib (lib.getLib udev) libnotify ];
+  runtimeDependencies = [ stdenv.cc.cc.lib (lib.getLib udev) libnotify libappindicator-gtk3 ];

  unpackPhase = "dpkg-deb -x $src .";

--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-plugin-pack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-plugin-pack/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pidgin, intltool, python } :
+{ lib, stdenv, fetchurl, pidgin, intltool, python2 } :

 stdenv.mkDerivation rec {
  pname = "purple-plugin-pack";
@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
    sha256 = "0g5hmy7fwgjq59j52h9yps28jsjjrfkd4r18gyx6hfd3g3kzbg1b";
  };

-  buildInputs = [ pidgin intltool python ];
+  buildInputs = [ pidgin intltool python2 ];

  meta = with lib; {
    homepage = "https://bitbucket.org/rekkanoryo/purple-plugin-pack";
--- a/pkgs/applications/networking/instant-messengers/torchat/default.nix
+++ b/pkgs/applications/networking/instant-messengers/torchat/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, python, unzip, wxPython, wrapPython, tor }:
+{ lib, stdenv, fetchFromGitHub, python2, unzip, tor }:

 stdenv.mkDerivation rec {
  pname = "torchat";
@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ unzip ];
-  buildInputs = [ python wxPython wrapPython ];
-  pythonPath = [ wxPython ];
+  buildInputs = with python2.pkgs; [ python wxPython wrapPython ];
+  pythonPath = with python2.pkgs; [ wxPython ];

  preConfigure = "cd torchat/src; rm portable.txt";

@ -24,7 +24,7 @@ stdenv.mkDerivation rec {

    mkdir -p $out/lib/torchat
    cp -rf * $out/lib/torchat
-    makeWrapper ${python}/bin/python $out/bin/torchat \
+    makeWrapper ${python2}/bin/python $out/bin/torchat \
        --set PYTHONPATH $out/lib/torchat:$program_PYTHONPATH \
        --run "cd $out/lib/torchat" \
        --add-flags "-O $out/lib/torchat/torchat.py"
--- a/pkgs/applications/networking/p2p/twister/default.nix
+++ b/pkgs/applications/networking/p2p/twister/default.nix
@ -13,7 +13,10 @@ let
    };
  };

-  boostPython = boost.override { enablePython = true; };
+  boostPython = boost.override {
+    enablePython = true;
+    python = python2;
+  };

 in stdenv.mkDerivation rec {
  pname = "twister";
--- a/pkgs/applications/networking/ping/default.nix
+++ b/pkgs/applications/networking/ping/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , nix-update-script
 , meson
@ -14,7 +15,6 @@
 , libsoup
 , libgee
 , wrapGAppsHook
-, vala_0_40
 }:

 stdenv.mkDerivation rec {
@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [
    meson
    ninja
-    vala_0_40
+    vala
    pkg-config
    python3
    wrapGAppsHook
@ -65,5 +65,12 @@ stdenv.mkDerivation rec {
    platforms = platforms.linux;
    license = licenses.gpl3;
    mainProgram = "com.github.jeremyvaartjes.ping";
+    # Does not build with vala 0.48 or later
+    # ../src/Application.vala:696.46-696.57: error: Assignment: Cannot convert from
+    # `GLib.HashTable<weak string,weak string>' to `GLib.HashTable<string,string>?'
+    #                     HashTable<string,string> tempDataList = Soup.Form.decode(testObjs[id].data);
+    #                                              ^^^^^^^^^^^^
+    # Upstream has no activity since 28 Dec 2020
+    broken = true;
  };
 }
--- a/pkgs/applications/office/trilium/default.nix
+++ b/pkgs/applications/office/trilium/default.nix
@ -19,16 +19,16 @@ let
    maintainers = with maintainers; [ fliegendewurst ];
  };

-  version = "0.49.4";
+  version = "0.49.5";

  desktopSource = {
    url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-${version}.tar.xz";
-    sha256 = "078w7jjkn8af3i0y0s236ky54h08b2wgzcaiakqiqx4gxdpf6jrq";
+    sha256 = "0bis0xkpcr8rvhm9364v0np5cnvkscv2fgl90f455lcwy7kk9m12";
  };

  serverSource = {
    url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-server-${version}.tar.xz";
-    sha256 = "0hygdxb97373z5cn3s4wr66wc41w7a55kxjyb8alck1fl9l6agn1";
+    sha256 = "1wv9xz1asjadz1jzgpaxf6lzbj5azgsq0qpawp3y257h488r1z9k";
  };

 in {
--- a/pkgs/applications/radio/soapysdr/default.nix
+++ b/pkgs/applications/radio/soapysdr/default.nix
@ -2,7 +2,8 @@
 , fetchFromGitHub, cmake
 , libusb-compat-0_1, pkg-config
 , usePython ? false
-, python, ncurses, swig2
+, python ? null
+, ncurses, swig2
 , extraPackages ? []
 } :

--- a/pkgs/applications/science/biology/minimap2/default.nix
+++ b/pkgs/applications/science/biology/minimap2/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "minimap2";
-  version = "2.23";
+  version = "2.24";

  src = fetchFromGitHub {
    repo = pname;
    owner = "lh3";
    rev = "v${version}";
-    sha256 = "sha256-oNVpSINcXO2eKzOCr/Fl8tSMguRxzmlDNu7hLZeopoQ=";
+    sha256 = "sha256-sEp7/Y5ifV9LTqrkhlkfykTJYMMuc+VtF7PvmIpBxUw=";
  };

  buildInputs = [ zlib ];
@ -25,6 +25,7 @@ stdenv.mkDerivation rec {
    homepage = "https://lh3.github.io/minimap2";
    license = licenses.mit;
    platforms = platforms.all;
+    badPlatforms = platforms.aarch64;
    maintainers = [ maintainers.arcadio ];
  };
 }
--- a/pkgs/applications/science/biology/poretools/default.nix
+++ b/pkgs/applications/science/biology/poretools/default.nix
@ -1,6 +1,6 @@
-{ lib, pythonPackages, fetchFromGitHub }:
+{ lib, python2Packages, fetchFromGitHub }:

-pythonPackages.buildPythonPackage rec {
+python2Packages.buildPythonPackage rec {
  pname = "poretools";
  version = "unstable-2016-07-10";

@ -11,7 +11,7 @@ pythonPackages.buildPythonPackage rec {
    sha256 = "0bglj833wxpp3cq430p1d3xp085ls221js2y90w7ir2x5ay8l7am";
  };

-  propagatedBuildInputs = [pythonPackages.h5py pythonPackages.matplotlib pythonPackages.seaborn pythonPackages.pandas];
+  propagatedBuildInputs = [python2Packages.h5py python2Packages.matplotlib python2Packages.seaborn python2Packages.pandas];

  meta = {
    description = "a toolkit for working with nanopore sequencing data from Oxford Nanopore";
--- a/pkgs/applications/science/biology/tebreak/default.nix
+++ b/pkgs/applications/science/biology/tebreak/default.nix
@ -1,7 +1,7 @@
-{ lib, fetchFromGitHub, last, exonerate, minia, python3Packages, bwa
-, samtools, findutils, python }:
+{ lib, fetchFromGitHub, last, exonerate, minia, python3, bwa
+, samtools, findutils }:

-python3Packages.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
  pname = "tebreak";
  version = "1.1";

@ -12,8 +12,8 @@ python3Packages.buildPythonApplication rec {
    sha256 = "13mgh775d8hkl340923lfwwm4r5ps70girn8d6wgfxzwzxylz8iz";
  };

-  nativeBuildInputs = [ findutils python3Packages.cython ];
-  propagatedBuildInputs = with python3Packages; [
+  nativeBuildInputs = [ findutils python3.pkgs.cython ];
+  propagatedBuildInputs = with python3.pkgs; [
    pysam
    scipy
    bx-python
@ -35,7 +35,7 @@ python3Packages.buildPythonApplication rec {
  checkPhase = ''
    $out/bin/tebreak -b test/data/example.ins.bam  -r test/data/Homo_sapiens_chr4_50000000-60000000_assembly19.fasta -p 4 --pickle test/example.pickle --detail_out test/example.tebreak.detail.out -i lib/teref.human.fa
    pushd test
-    ${python.interpreter} checktest.py
+    ${python3.interpreter} checktest.py
  '';

  meta = with lib; {
--- a/pkgs/applications/science/logic/lean/default.nix
+++ b/pkgs/applications/science/logic/lean/default.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "lean";
-  version = "3.37.0";
+  version = "3.38.0";

  src = fetchFromGitHub {
    owner  = "leanprover-community";
@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
    # from. this is then used to check whether an olean file should be
    # rebuilt. don't use a tag as rev because this will get replaced into
    # src/githash.h.in in preConfigure.
-    rev    = "e69ab934262eb6f141344fdaec98ede68a9102b6";
-    sha256 = "19sigzbrdl90jqk7lvl3q8j6n4nnidzwp9zzmzgq3zxxgywa2ghp";
+    rev    = "a8cf8a0c9ea19a633baeb3aa7e8d706b86c2c0f9";
+    sha256 = "14dam91pnn266fgii5c2j5p9p2i31bghx0s2h3qnnqyvxi4s5isx";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/science/machine-learning/shogun/default.nix
+++ b/pkgs/applications/science/machine-learning/shogun/default.nix
@ -6,7 +6,7 @@
  # build
 , cmake
 , ctags
-, pythonPackages
+, python2Packages
 , swig
  # math
 , eigen
@ -36,7 +36,7 @@
 , withSvmLight ? false
 }:

-assert pythonSupport -> pythonPackages != null;
+assert pythonSupport -> python2Packages != null;
 assert opencvSupport -> opencv != null;

 assert (!blas.isILP64) && (!lapack.isILP64);
@ -101,7 +101,7 @@ stdenv.mkDerivation rec {
  ] ++ lib.optional (!withSvmLight) ./svmlight-scrubber.patch;

  nativeBuildInputs = [ cmake swig ctags ]
-    ++ (with pythonPackages; [ python jinja2 ply ]);
+    ++ (with python2Packages; [ python jinja2 ply ]);

  buildInputs = [
    eigen
@ -121,7 +121,7 @@ stdenv.mkDerivation rec {
    nlopt
    lp_solve
    colpack
-  ] ++ lib.optionals pythonSupport (with pythonPackages; [ python numpy ])
+  ] ++ lib.optionals pythonSupport (with python2Packages; [ python numpy ])
    ++ lib.optional opencvSupport opencv;

  cmakeFlags = let
--- a/pkgs/applications/science/misc/sasview/default.nix
+++ b/pkgs/applications/science/misc/sasview/default.nix
@ -1,25 +1,25 @@
-{ lib, fetchFromGitHub, gcc, python }:
+{ lib, fetchFromGitHub, gcc, python2 }:

 let
  xhtml2pdf = import ./xhtml2pdf.nix {
    inherit lib;
-    fetchPypi = python.pkgs.fetchPypi;
-    buildPythonPackage = python.pkgs.buildPythonPackage;
-    html5lib = python.pkgs.html5lib;
-    httplib2 = python.pkgs.httplib2;
-    nose = python.pkgs.nose;
-    pillow = python.pkgs.pillow;
-    pypdf2 = python.pkgs.pypdf2;
-    reportlab = python.pkgs.reportlab;
+    fetchPypi = python2.pkgs.fetchPypi;
+    buildPythonPackage = python2.pkgs.buildPythonPackage;
+    html5lib = python2.pkgs.html5lib;
+    httplib2 = python2.pkgs.httplib2;
+    nose = python2.pkgs.nose;
+    pillow = python2.pkgs.pillow;
+    pypdf2 = python2.pkgs.pypdf2;
+    reportlab = python2.pkgs.reportlab;
  };

 in

-python.pkgs.buildPythonApplication rec {
+python2.pkgs.buildPythonApplication rec {
  pname = "sasview";
  version = "4.2.0";

-  checkInputs = with python.pkgs; [
+  checkInputs = with python2.pkgs; [
    pytest
    unittest-xml-reporting
  ];
@ -35,7 +35,7 @@ python.pkgs.buildPythonApplication rec {
    HOME=$(mktemp -d) py.test
  '';

-  propagatedBuildInputs = with python.pkgs; [
+  propagatedBuildInputs = with python2.pkgs; [
    bumps
    gcc
    h5py
--- a/pkgs/applications/science/misc/tulip/default.nix
+++ b/pkgs/applications/science/misc/tulip/default.nix
@ -1,5 +1,5 @@
 { fetchurl, lib, stdenv, libxml2, freetype, libGLU, libGL, glew, qt4
-, cmake, makeWrapper, libjpeg, python }:
+, cmake, makeWrapper, libjpeg, python2 }:

 let version = "5.2.1"; in
 stdenv.mkDerivation rec {
@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
    sha256 = "0bqmqy6sri87a8xv5xf7ffaq5zin4hiaa13g0l64b84i7yckfwky";
  };

-  buildInputs = [ libxml2 freetype glew libGLU libGL qt4 libjpeg python ];
+  buildInputs = [ libxml2 freetype glew libGLU libGL qt4 libjpeg python2 ];

  nativeBuildInputs = [ cmake makeWrapper ];

--- a/pkgs/applications/terminal-emulators/mlterm/default.nix
+++ b/pkgs/applications/terminal-emulators/mlterm/default.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "mlterm";
-  version = "3.9.1";
+  version = "3.9.2";

  src = fetchFromGitHub {
    owner = "arakiken";
    repo = pname;
    rev = "rel-${lib.replaceStrings [ "." ] [ "_" ] version}"; # 3.9.1 -> rel-3_9_1
-    sha256 = "1hh196kz2n3asv8r8r2bdk5b2w93zq7rw4880ciiq1554h0ib7fj";
+    sha256 = "sha256-DvGR3rDegInpnLp3H+rXNXktCGhpjsBBPTRMwodeTro=";
  };

  nativeBuildInputs = [ pkg-config autoconf wrapGAppsHook ];
--- a/pkgs/applications/version-management/git-and-tools/git-workspace/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-workspace/default.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "git-workspace";
-  version = "0.8.0";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "orf";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-//EyGhuE8rMRL03TtECIi0X51/p/GvTqvr2FRQEIqFA=";
+    sha256 = "sha256-uP1sex4Hx57ZsqVG4b3809FzFB10Un48+vbwaWZ7HSg=";
  };

-  cargoSha256 = "sha256-X0jRwDUVzS1s2tG6N2RDaFqwUUAT+mPMEft11VkJy5A=";
+  cargoSha256 = "sha256-mkrC8uzfNpL0MQUMjcNaJf5c1wSdlBVg8AMgc/zxM6A=";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ openssl ]
--- a/pkgs/applications/version-management/rapidsvn/default.nix
+++ b/pkgs/applications/version-management/rapidsvn/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, wxGTK, subversion, apr, aprutil, python }:
+{ lib, stdenv, fetchurl, wxGTK, subversion, apr, aprutil, python2 }:

 stdenv.mkDerivation rec {
  pname = "rapidsvn";
@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
    sha256 = "1bmcqjc12k5w0z40k7fkk8iysqv4fw33i80gvcmbakby3d4d4i4p";
  };

-  buildInputs = [ wxGTK subversion apr aprutil python ];
+  buildInputs = [ wxGTK subversion apr aprutil python2 ];

  configureFlags = [ "--with-svn-include=${subversion.dev}/include"
    "--with-svn-lib=${subversion.out}/lib" ];
--- a/pkgs/applications/version-management/src/default.nix
+++ b/pkgs/applications/version-management/src/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, python, rcs, git, makeWrapper }:
+{ lib, stdenv, fetchurl, python2, rcs, git, makeWrapper }:

 stdenv.mkDerivation rec {
  pname = "src";
@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ python rcs git ];
+  buildInputs = [ python2 rcs git ];

  preConfigure = ''
    patchShebangs .
--- a/pkgs/applications/version-management/srcml/default.nix
+++ b/pkgs/applications/version-management/srcml/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, cmake, libxml2, libxslt, boost, libarchive, python, antlr2,
+{ lib, stdenv, fetchurl, cmake, libxml2, libxslt, boost, libarchive, python2, antlr2,
  curl
 }:

@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
  ];

  nativeBuildInputs = [ cmake antlr2 ];
-  buildInputs = [ libxml2 libxslt boost libarchive python curl ];
+  buildInputs = [ libxml2 libxslt boost libarchive python2 curl ];

  meta = {
    description = "Infrastructure for exploration, analysis, and manipulation of source code";
--- a/pkgs/applications/virtualization/runc/default.nix
+++ b/pkgs/applications/virtualization/runc/default.nix
@ -16,13 +16,13 @@

 buildGoModule rec {
  pname = "runc";
-  version = "1.0.3";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "opencontainers";
    repo = "runc";
    rev = "v${version}";
-    sha256 = "sha256-Tl/JKbIpao+FCjngPzaVkxse50zo3XQ9Mg/AdkblMcI=";
+    sha256 = "sha256-svLxxfiRDLWkdRuHXaDyH5Ta6qmptI8z+s41iZKgbWM=";
  };

  vendorSha256 = null;
--- a/pkgs/applications/window-managers/tabbed/default.nix
+++ b/pkgs/applications/window-managers/tabbed/default.nix
@ -18,9 +18,9 @@ stdenv.mkDerivation {

  buildInputs = [ xorgproto libX11 libXft ];

-  makeFlags = [
-    "PREFIX=$(out)"
-  ];
+  makeFlags = [ "CC:=$(CC)" ];
+
+  installFlags = [ "PREFIX=$(out)" ];

  meta = with lib; {
    homepage = "https://tools.suckless.org/tabbed";
--- a/pkgs/applications/window-managers/wmii-hg/default.nix
+++ b/pkgs/applications/window-managers/wmii-hg/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, unzip, pkg-config, libixp_hg, txt2tags, dash, python, which
+{ lib, stdenv, fetchurl, unzip, pkg-config, libixp_hg, txt2tags, dash, python2, which
 , libX11 , libXrender, libXext, libXinerama, libXrandr, libXft }:

 stdenv.mkDerivation rec {
@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
  '';

  nativeBuildInputs = [ pkg-config unzip ];
-  buildInputs = [ libixp_hg txt2tags dash python which
+  buildInputs = [ libixp_hg txt2tags dash python2 which
                  libX11 libXrender libXext libXinerama libXrandr libXft ];

  # For some reason including mercurial in buildInputs did not help
--- a/pkgs/data/fonts/noto-fonts/default.nix
+++ b/pkgs/data/fonts/noto-fonts/default.nix
@ -3,7 +3,6 @@
 , lib
 , fetchFromGitHub
 , fetchurl
-, fetchzip
 , cairo
 , python3
 , pkg-config
@ -61,6 +60,42 @@ let
        maintainers = with maintainers; [ mathnerd314 emily ];
      };
    };
+
+  mkNotoCJK = { typeface, version, rev, sha256 }:
+    stdenvNoCC.mkDerivation {
+      pname = "noto-fonts-cjk-${lib.toLower typeface}";
+      inherit version;
+
+      src = fetchFromGitHub {
+        owner = "googlefonts";
+        repo = "noto-cjk";
+        inherit rev sha256;
+      };
+
+      installPhase = ''
+        install -m444 -Dt $out/share/fonts/opentype/noto-cjk ${typeface}/Variable/OTC/*.otf.ttc
+      '';
+
+      meta = with lib; {
+        description = "Beautiful and free fonts for CJK languages";
+        homepage = "https://www.google.com/get/noto/help/cjk/";
+        longDescription = ''
+          Noto ${typeface} CJK is a ${lib.toLower typeface} typeface designed as
+          an intermediate style between the modern and traditional. It is
+          intended to be a multi-purpose digital font for user interface
+          designs, digital content, reading on laptops, mobile devices, and
+          electronic books. Noto ${typeface} CJK comprehensively covers
+          Simplified Chinese, Traditional Chinese, Japanese, and Korean in a
+          unified font family. It supports regional variants of ideographic
+          characters for each of the four languages. In addition, it supports
+          Japanese kana, vertical forms, and variant characters (itaiji); it
+          supports Korean hangeul — both contemporary and archaic.
+        '';
+        license = licenses.ofl;
+        platforms = platforms.all;
+        maintainers = with maintainers; [ mathnerd314 emily ];
+      };
+    };
 in

 {
@ -74,39 +109,18 @@ in
    weights = "{Black,Condensed,Extra,Medium,Semi,Thin}*";
  };

-  noto-fonts-cjk = let zip = fetchzip {
-    url = let rev = "be6c059ac1587e556e2412b27f5155c8eb3ddbe6"; in
-      "https://raw.githubusercontent.com/googlefonts/noto-cjk/${rev}/NotoSansCJK.ttc.zip";
-    # __MACOSX...
-    stripRoot = false;
-    sha256 = "0ik4z2b15i0pghskgfm3adzb0h35fr4gyzvz3bq49hhkhn9h85vi";
-  }; in stdenvNoCC.mkDerivation {
-    pname = "noto-fonts-cjk";
-    version = "2.001";
-
-    buildCommand = ''
-      install -m444 -Dt $out/share/fonts/opentype/noto-cjk ${zip}/*.ttc
-    '';
+  noto-fonts-cjk-sans = mkNotoCJK {
+    typeface = "Sans";
+    version = "2.004";
+    rev = "9f7f3c38eab63e1d1fddd8d50937fe4f1eacdb1d";
+    sha256 = "sha256-BX4tcDcz+RGka8mtced1k3BopUJQ14t1BtAVqTjyPik=";
+  };

-    meta = with lib; {
-      description = "Beautiful and free fonts for CJK languages";
-      homepage = "https://www.google.com/get/noto/help/cjk/";
-      longDescription =
-      ''
-        Noto Sans CJK is a sans serif typeface designed as an intermediate style
-        between the modern and traditional. It is intended to be a multi-purpose
-        digital font for user interface designs, digital content, reading on laptops,
-        mobile devices, and electronic books. Noto Sans CJK comprehensively covers
-        Simplified Chinese, Traditional Chinese, Japanese, and Korean in a unified font
-        family. It supports regional variants of ideographic characters for each of the
-        four languages. In addition, it supports Japanese kana, vertical forms, and
-        variant characters (itaiji); it supports Korean hangeul — both contemporary and
-        archaic.
-      '';
-      license = licenses.ofl;
-      platforms = platforms.all;
-      maintainers = with maintainers; [ mathnerd314 emily ];
-    };
+  noto-fonts-cjk-serif = mkNotoCJK {
+    typeface = "Serif";
+    version = "2.000";
+    rev = "9f7f3c38eab63e1d1fddd8d50937fe4f1eacdb1d";
+    sha256 = "sha256-BX4tcDcz+RGka8mtced1k3BopUJQ14t1BtAVqTjyPik=";
  };

  noto-fonts-emoji = let
--- a/pkgs/desktops/pantheon/apps/elementary-camera/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-camera/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , pkg-config
 , meson
@ -34,6 +35,15 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-xIv+mOlZV58XD0Z6Vc2wA1EQUxT5BaQ0zhYc9v+ne1w=";
  };

+  patches = [
+    # Fix build with meson 0.61
+    # https://github.com/elementary/camera/pull/216
+    (fetchpatch {
+      url = "https://github.com/elementary/camera/commit/ead143b7e3246c5fa9bb37c95d491fb07cea9e04.patch";
+      sha256 = "sha256-2zGigUi6DpjJx8SEvAE3Q3jrm7MggOvLc72lAPMPvs4=";
+    })
+  ];
+
  nativeBuildInputs = [
    appstream
    desktop-file-utils
--- a/pkgs/desktops/pantheon/apps/elementary-code/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-code/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , pkg-config
 , meson
@ -38,6 +39,15 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-AXmMcPj2hf33G5v3TUg+eZwaKOdVlRvoVXglMJFHRjw=";
  };

+  patches = [
+    # Fix build with meson 0.61
+    # https://github.com/elementary/code/pull/1165
+    (fetchpatch {
+      url = "https://github.com/elementary/code/commit/a2607cce3a6b1bb62d02456456d3cbc3c6530bb0.patch";
+      sha256 = "sha256-VKR83IOUYsQhBRlU9JUTlMJtXWv/AyG4wDsjMU2vmU8=";
+    })
+  ];
+
  passthru = {
    updateScript = nix-update-script {
      attrPath = "pantheon.${pname}";
--- a/pkgs/desktops/pantheon/apps/elementary-files/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-files/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , pkg-config
 , meson
@ -43,6 +44,15 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-5TSzV8MQG81aCCR8yiCPhKJaLrp/fwf4mjP32KkcbbY=";
  };

+  patches = [
+    # Fix build with meson 0.61
+    # https://github.com/elementary/files/pull/1973
+    (fetchpatch {
+      url = "https://github.com/elementary/files/commit/28428fbda905ece59d3427a3a40e986fdf71a916.patch";
+      sha256 = "sha256-GZTHAH9scQWrBqdrDI14cj57f61HD8o79zFcPCXjKmc=";
+    })
+  ];
+
  nativeBuildInputs = [
    desktop-file-utils
    gettext
--- a/pkgs/desktops/pantheon/apps/elementary-mail/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-mail/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , pkg-config
 , meson
@ -34,6 +35,15 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-wOu9jvvwG53vzcNa38nk4eREZWW7Cin8el4qApQ8gI8=";
  };

+  patches = [
+    # Fix build with meson 0.61
+    # https://github.com/elementary/mail/pull/751
+    (fetchpatch {
+      url = "https://github.com/elementary/mail/commit/bbadc56529276d8e0ff98e9df7d9bb1bf8fc5783.patch";
+      sha256 = "sha256-lJEnX5/G6e8PdKy1XGlwFIoCeSy6SR5p68tS4noj+44=";
+    })
+  ];
+
  nativeBuildInputs = [
    appstream
    desktop-file-utils
--- a/pkgs/desktops/pantheon/apps/elementary-music/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-music/default.nix
@ -50,6 +50,12 @@ stdenv.mkDerivation rec {
      url = "https://github.com/elementary/music/commit/aea97103d59afd213467403a48788e476e47c4c3.patch";
      sha256 = "1ayj8l6lb19hhl9bhsdfbq7jgchfmpjx0qkljnld90czcksn95yx";
    })
+    # Fix build with meson 0.61
+    # https://github.com/elementary/music/pull/674
+    (fetchpatch {
+      url = "https://github.com/elementary/music/commit/fb3d840049c1e2e0bf8fdddea378a2db647dd096.patch";
+      sha256 = "sha256-tQZv7hZExLqbkGXahZxDfg7bkgwCKYbDholC2zuwlNw=";
+    })
  ];

  passthru = {
--- a/pkgs/desktops/pantheon/apps/elementary-screenshot/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-screenshot/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , pkg-config
 , meson
@ -28,6 +29,15 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-n+L08C/W5YnHZ5P3F1NGUYE2SH94sc4+kr1x+wXZ+cw=";
  };

+  patches = [
+    # Fix build with meson 0.61
+    # https://github.com/elementary/screenshot/pull/241
+    (fetchpatch {
+      url = "https://github.com/elementary/screenshot/commit/80a5d942e813dd098e1ef0f6629b81d2ccef05ae.patch";
+      sha256 = "sha256-jOQuzUJvsjqytplLcW9BeIxzi9+/k2GFa4hHVZ3+wts=";
+    })
+  ];
+
  nativeBuildInputs = [
    desktop-file-utils
    meson
--- a/pkgs/desktops/pantheon/apps/elementary-terminal/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-terminal/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , pkg-config
 , meson
@ -32,6 +33,15 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-4q7YQ4LxuiM/TRae1cc3ncmw7QwE1soC2Sh+GZ+Gpq0=";
  };

+  patches = [
+    # Fix build with meson 0.61
+    # https://github.com/elementary/terminal/pull/649
+    (fetchpatch {
+      url = "https://github.com/elementary/terminal/commit/15e3ace08cb25e53941249fa1ee680a1e2f871b4.patch";
+      sha256 = "sha256-XVs+kq5qbX5KlxtkqxwJnatNYNeJiVLBec7sLjQsUxg=";
+    })
+  ];
+
  nativeBuildInputs = [
    appstream
    desktop-file-utils
--- a/pkgs/desktops/pantheon/apps/switchboard/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard/default.nix
@ -60,6 +60,12 @@ stdenv.mkDerivation rec {
      url = "https://github.com/elementary/switchboard/commit/8d6b5f4cbbaf134880252afbf1e25d70033e6402.patch";
      sha256 = "0gwq3wwj45jrnlhsmxfclbjw6xjr8kf6pp3a84vbnrazw76lg5nc";
    })
+    # Fix build with meson 0.61
+    # https://github.com/elementary/switchboard/pull/226
+    (fetchpatch {
+      url = "https://github.com/elementary/switchboard/commit/ecf2a6c42122946cc84150f6927ef69c1f67c909.patch";
+      sha256 = "sha256-J62tMeDfOpliBLHMSa3uBGTc0RBNzC6eDjDBDYySL+0=";
+    })
  ];

  postPatch = ''
--- a/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix
+++ b/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , linkFarm
 , substituteAll
@ -90,6 +91,12 @@ stdenv.mkDerivation rec {
      src = ./hardcode-fallback-background.patch;
      default_wallpaper = "${nixos-artwork.wallpapers.simple-dark-gray.gnomeFilePath}";
    })
+    # Fix build with meson 0.61
+    # https://github.com/elementary/greeter/pull/590
+    (fetchpatch {
+      url = "https://github.com/elementary/greeter/commit/a4b25244058fce794a9f13f6b22a8ff7735ebde9.patch";
+      sha256 = "sha256-qPXhdvmYG8YMDU/CjbEkfZ0glgRzxnu0TsOPtvWHxLY=";
+    })
  ];

  preFixup = ''
--- a/pkgs/desktops/pantheon/desktop/elementary-shortcut-overlay/default.nix
+++ b/pkgs/desktops/pantheon/desktop/elementary-shortcut-overlay/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , pkg-config
 , meson
@ -21,15 +22,22 @@ stdenv.mkDerivation rec {
  pname = "elementary-shortcut-overlay";
  version = "1.2.1";

-  repoName = "shortcut-overlay";
-
  src = fetchFromGitHub {
    owner = "elementary";
-    repo = repoName;
+    repo = "shortcut-overlay";
    rev = version;
    sha256 = "sha256-qmqzGCM3cVM6y80pzjm5CCyG6BO6XlKZiODAAEnwVrM=";
  };

+  patches = [
+    # Fix build with meson 0.61
+    # https://github.com/elementary/shortcut-overlay/pull/113
+    (fetchpatch {
+      url = "https://github.com/elementary/shortcut-overlay/commit/130f78eb4b7770586ea98ba0a5fdbbf5bb116f3f.patch";
+      sha256 = "sha256-XXWq9CEv3Z2B8ogcFQAJZCfy19XxNHs3c8NToE2m/aA=";
+    })
+  ];
+
  nativeBuildInputs = [
    desktop-file-utils
    libxml2
--- a/pkgs/desktops/pantheon/services/elementary-capnet-assist/default.nix
+++ b/pkgs/desktops/pantheon/services/elementary-capnet-assist/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , pkg-config
 , meson
@ -21,15 +22,22 @@ stdenv.mkDerivation rec {
  pname = "elementary-capnet-assist";
  version = "2.4.0";

-  repoName = "capnet-assist";
-
  src = fetchFromGitHub {
    owner = "elementary";
-    repo = repoName;
+    repo = "capnet-assist";
    rev = version;
    sha256 = "sha256-UdkS+w61c8z2TCJyG7YsDb0n0b2LOpFyaHzMbdCJsZI=";
  };

+  patches = [
+    # Fix build with meson 0.61
+    # https://github.com/elementary/capnet-assist/pull/76
+    (fetchpatch {
+      url = "https://github.com/elementary/capnet-assist/commit/0e77bf8023ba1b35e3a5badb72c246cabf6552b9.patch";
+      sha256 = "sha256-B/KEs/TCxR+i3uQSRtWxTi2+cu0n6QLcfKCbMCvSsvs=";
+    })
+  ];
+
  nativeBuildInputs = [
    desktop-file-utils
    meson
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-namebar-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-namebar-plugin/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, pkg-config, fetchFromGitHub, python3, vala_0_40
+{ lib, stdenv, pkg-config, fetchFromGitHub, python3, vala
 , gtk3, libwnck, libxfce4util, xfce4-panel, wafHook, xfce }:

 stdenv.mkDerivation rec {
@ -12,13 +12,7 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-aKrJzf9rwCyXAJsRIXdBzmJBASuXD5I5kZrp+atx4FA=";
  };

-  # Does not build with vala 0.48 or later
-  # Upstream has no activity for a while
-  # libxfce4panel-2.0.vapi:92.3-92.41: error: overriding method `Xfce.PanelPlugin.remote_event' is incompatible
-  # with base method `bool Xfce.PanelPluginProvider.remote_event (string, GLib.Value, uint)': too few parameters.
-  #               public virtual signal bool remote_event (string name, GLib.Value value);
-  #               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-  nativeBuildInputs = [ pkg-config vala_0_40 wafHook python3 ];
+  nativeBuildInputs = [ pkg-config vala wafHook python3 ];
  buildInputs = [ gtk3 libwnck libxfce4util xfce4-panel ];

  postPatch = ''
@ -39,5 +33,12 @@ stdenv.mkDerivation rec {
    license = licenses.mit;
    platforms = platforms.linux;
    maintainers = with maintainers; [ volth ] ++ teams.xfce.members;
+    # Does not build with vala 0.48 or later
+    # libxfce4panel-2.0.vapi:92.3-92.41: error: overriding method `Xfce.PanelPlugin.remote_event' is incompatible
+    # with base method `bool Xfce.PanelPluginProvider.remote_event (string, GLib.Value, uint)': too few parameters.
+    #               public virtual signal bool remote_event (string name, GLib.Value value);
+    #               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+    # Upstream has no activity since 20 May 2020
+    broken = true;
  };
 }
--- a/pkgs/development/compilers/hip/default.nix
+++ b/pkgs/development/compilers/hip/default.nix
@ -16,7 +16,7 @@
 , makeWrapper
 , numactl
 , perl
-, python
+, python2
 , rocclr
 , rocm-comgr
 , rocm-device-libs
@ -56,7 +56,7 @@ let
      substituteInPlace bin/hip_embed_pch.sh \
        --replace '$LLVM_DIR/bin/' ""

-      sed 's,#!/usr/bin/python,#!${python}/bin/python,' -i hip_prof_gen.py
+      sed 's,#!/usr/bin/python,#!${python2}/bin/python,' -i hip_prof_gen.py

      sed -e 's,$ROCM_AGENT_ENUM = "''${ROCM_PATH}/bin/rocm_agent_enumerator";,$ROCM_AGENT_ENUM = "${rocminfo}/bin/rocm_agent_enumerator";,' \
          -e 's,^\($DEVICE_LIB_PATH=\).*$,\1"${rocm-device-libs}/amdgcn/bitcode";,' \
@ -111,7 +111,7 @@ stdenv.mkDerivation rec {
    sha256 = "WvOuQu/EN81Kwcoc3ZtGlhb996edQJ3OWFsmPuqeNXE=";
  };

-  nativeBuildInputs = [ cmake python makeWrapper perl ];
+  nativeBuildInputs = [ cmake python2 makeWrapper perl ];
  buildInputs = [ libxml2 numactl libglvnd libX11 ];
  propagatedBuildInputs = [
    clang
--- a/pkgs/development/compilers/intel-graphics-compiler/default.nix
+++ b/pkgs/development/compilers/intel-graphics-compiler/default.nix
@ -77,5 +77,6 @@ stdenv.mkDerivation rec {
    license = licenses.mit;
    platforms = platforms.all;
    maintainers = with maintainers; [ gloaming ];
+    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/intel-graphics-compiler.x86_64-darwin
  };
 }
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@ -15,19 +15,7 @@ let
    # header file isn't available at all, but that patch (./gvc-compat.patch)
    # can be shared between all versions of Vala so far.
    graphvizPatch =
-      let
-        fp = { commit, sha256 }: fetchpatch {
-          url = "https://github.com/openembedded/openembedded-core/raw/${commit}/meta/recipes-devtools/vala/vala/disable-graphviz.patch";
-          inherit sha256;
-        };
-
-      in {
-
-        # NOTE: the openembedded-core project doesn't have a patch for 0.40.12
-        # We've fixed the single merge conflict in the following patch.
-        #     0.40.12: https://github.com/openembedded/openembedded-core/raw/8553c52f174af4c8c433c543f806f5ed5c1ec48c/meta/recipes-devtools/vala/vala/disable-graphviz.patch
-        "0.40" = ./disable-graphviz-0.40.12.patch;
-
+      {
        "0.48" = ./disable-graphviz-0.46.1.patch;

        "0.52" = ./disable-graphviz-0.46.1.patch;
@ -98,19 +86,14 @@ let
  });

 in rec {
-  vala_0_40 = generic {
-    version = "0.40.25";
-    sha256 = "1pxpack8rrmywlf47v440hc6rv3vi8q9c6niwqnwikxvb2pwf3w7";
-  };
-
  vala_0_48 = generic {
-    version = "0.48.21";
-    sha256 = "sha256-MFRVrrdo1u2bAYNgtVGC5IsW2xvBY6TluBQg+Y0h2Zg=";
+    version = "0.48.22";
+    sha256 = "sha256-27NHjEvjZvCTFkrGHNOu29zz5EQE2eNkFK4VEk525os=";
  };

  vala_0_52 = generic {
-    version = "0.52.9";
-    sha256 = "sha256-HpMH2B4hHxniUB6P5PtN0Z+5J8SEtV/873FOjFFdAHk=";
+    version = "0.52.10";
+    sha256 = "sha256-nCAb+BLZh04hveU/jZwU9lF0ixqBRB/1ySkSJESQEAg=";
  };

  vala_0_54 = generic {
--- a/pkgs/development/compilers/vala/disable-graphviz-0.40.12.patch
+++ b/pkgs/development/compilers/vala/disable-graphviz-0.40.12.patch
@ -1,208 +0,0 @@
-diff --git i/configure.ac w/configure.ac
-index 694ffd200..915062053 100644
--- i/configure.ac
-+++ w/configure.ac
-@@ -112,34 +112,38 @@ PKG_CHECK_MODULES(GMODULE, gmodule-2.0 >= $GLIB_REQUIRED)
- AC_SUBST(GMODULE_CFLAGS)
- AC_SUBST(GMODULE_LIBS)
- 
-PKG_CHECK_MODULES(LIBGVC, libgvc >= $LIBGVC_REQUIRED)
-AC_MSG_CHECKING([for CGRAPH])
-cgraph_tmp_LIBADD="$LIBADD"
-cgraph_tmp_CFLAGS="$CFLAGS"
-LIBADD="$LIBADD $LIBGVC_LIBS"
-CFLAGS="$CFLAGS $LIBGVC_CFLAGS"
-AC_RUN_IFELSE(
-	[AC_LANG_SOURCE([
-		#include <gvc.h>
-
-		int main(void) {
-			#ifdef WITH_CGRAPH
-				return 0;
-			#else
-				return -1;
-			#endif
-		}
-	])], [
-		AC_MSG_RESULT([yes])
-		VALAFLAGS="$VALAFLAGS -D WITH_CGRAPH"
-		have_cgraph=yes
-	], [
-		AC_MSG_RESULT([no])
-		have_cgraph=no
-	]
-)
-LIBADD="$cgraph_tmp_LIBADD"
-CFLAGS="$cgraph_tmp_CFLAGS"
-+AC_ARG_ENABLE(graphviz, AS_HELP_STRING([--disable-graphviz], [Disable graphviz usage for valadoc]), enable_graphviz=$enableval, enable_graphviz=yes)
-+if test x$enable_graphviz = xyes; then
-+	PKG_CHECK_MODULES(LIBGVC, libgvc >= $LIBGVC_REQUIRED)
-+	AC_MSG_CHECKING([for CGRAPH])
-+	VALAFLAGS="$VALAFLAGS -D HAVE_GRAPHVIZ"
-+	cgraph_tmp_LIBADD="$LIBADD"
-+	cgraph_tmp_CFLAGS="$CFLAGS"
-+	LIBADD="$LIBADD $LIBGVC_LIBS"
-+	CFLAGS="$CFLAGS $LIBGVC_CFLAGS"
-+	AC_RUN_IFELSE(
-+		[AC_LANG_SOURCE([
-+			#include <gvc.h>
-+			int main(void) {
-+				#ifdef WITH_CGRAPH
-+					return 0;
-+				#else
-+					return -1;
-+				#endif
-+			}
-+		])], [
-+			AC_MSG_RESULT([yes])
-+			VALAFLAGS="$VALAFLAGS -D WITH_CGRAPH"
-+			have_cgraph=yes
-+		], [
-+			AC_MSG_RESULT([no])
-+			have_cgraph=no
-+		]
-+	)
-+	LIBADD="$cgraph_tmp_LIBADD"
-+	CFLAGS="$cgraph_tmp_CFLAGS"
-+fi
-+AM_CONDITIONAL(ENABLE_GRAPHVIZ, test x$enable_graphviz = xyes)
- AM_CONDITIONAL(HAVE_CGRAPH, test "$have_cgraph" = "yes")
- 
- AC_PATH_PROG([XSLTPROC], [xsltproc], :)
-diff --git i/libvaladoc/Makefile.am w/libvaladoc/Makefile.am
-index f3f790e76..3c5dc4c80 100644
--- i/libvaladoc/Makefile.am
-+++ w/libvaladoc/Makefile.am
-@@ -128,10 +128,6 @@ libvaladoc_la_VALASOURCES = \
- 	content/tablerow.vala \
- 	content/taglet.vala \
- 	content/text.vala \
-	charts/chart.vala \
-	charts/chartfactory.vala \
-	charts/hierarchychart.vala \
-	charts/simplechartfactory.vala \
- 	parser/manyrule.vala \
- 	parser/oneofrule.vala \
- 	parser/optionalrule.vala \
-@@ -158,13 +154,24 @@ libvaladoc_la_VALASOURCES = \
- 	highlighter/codetoken.vala \
- 	highlighter/highlighter.vala \
- 	html/basicdoclet.vala \
-	html/htmlchartfactory.vala \
- 	html/linkhelper.vala \
- 	html/cssclassresolver.vala \
- 	html/htmlmarkupwriter.vala \
- 	html/htmlrenderer.vala \
- 	$(NULL)
- 
-+if ENABLE_GRAPHVIZ
-+libvaladoc_la_VALASOURCES += \
-+	charts/chart.vala \
-+	charts/chartfactory.vala \
-+	charts/hierarchychart.vala \
-+	charts/simplechartfactory.vala \
-+	html/htmlchartfactory.vala \
-+	$(NULL)
-+
-+LIBGVC_PKG = --vapidir $(top_srcdir)/vapi --pkg libgvc
-+endif
-+
- libvaladoc@PACKAGE_SUFFIX@_la_SOURCES = \
- 	libvaladoc.vala.stamp \
- 	$(libvaladoc_la_VALASOURCES:.vala=.c) \
-@@ -184,11 +191,11 @@ libvaladoc.vala.stamp: $(libvaladoc_la_VALASOURCES)
- 		--library valadoc \
- 		--vapi valadoc@PACKAGE_SUFFIX@.vapi \
- 		--vapidir $(top_srcdir)/vapi --pkg gmodule-2.0 \
-		--vapidir $(top_srcdir)/vapi --pkg libgvc \
- 		--vapidir $(top_srcdir)/gee --pkg gee \
- 		--vapidir $(top_srcdir)/vala --pkg vala \
- 		--vapidir $(top_srcdir)/ccode --pkg ccode \
- 		--vapidir $(top_srcdir)/codegen --pkg codegen \
-+		$(LIBGVC_PKG) \
- 		--pkg config \
- 		$(filter %.vala %.c,$^)
- 	touch $@
-@@ -217,6 +224,9 @@ nodist_pkgconfig_DATA = valadoc@PACKAGE_SUFFIX@.pc
- 
- valadoc@PACKAGE_SUFFIX@.pc: valadoc.pc
- 	cp $< $@
-+if !ENABLE_GRAPHVIZ
-+	sed -i "s/libgvc //g" $@
-+endif
- 
- vapidir = $(datadir)/vala/vapi
- dist_vapi_DATA = valadoc@PACKAGE_SUFFIX@.vapi
-@@ -224,6 +234,9 @@ nodist_vapi_DATA = valadoc@PACKAGE_SUFFIX@.deps
- 
- valadoc@PACKAGE_SUFFIX@.deps: valadoc.deps
- 	cp $< $@
-+if !ENABLE_GRAPHVIZ
-+	sed -i "s/libgvc//g" $@
-+endif
- 
- EXTRA_DIST = \
- 	$(libvaladoc_la_VALASOURCES) \
-diff --git i/libvaladoc/html/basicdoclet.vala w/libvaladoc/html/basicdoclet.vala
-index 192e488cd..ec0960222 100644
--- i/libvaladoc/html/basicdoclet.vala
-+++ w/libvaladoc/html/basicdoclet.vala
-@@ -46,7 +46,11 @@ public abstract class Valadoc.Html.BasicDoclet : Api.Visitor, Doclet {
- 	protected HtmlRenderer _renderer;
- 	protected Html.MarkupWriter writer;
- 	protected Html.CssClassResolver cssresolver;
-+#if HAVE_GRAPHVIZ
- 	protected Charts.Factory image_factory;
-+#else
-+	protected void* image_factory;
-+#endif
- 	protected ErrorReporter reporter;
- 	protected string package_list_link = "../index.html";
- 
-@@ -120,7 +124,9 @@ public abstract class Valadoc.Html.BasicDoclet : Api.Visitor, Doclet {
- 		this.linker = new LinkHelper ();
- 
- 		_renderer = new HtmlRenderer (settings, this.linker, this.cssresolver);
-+#if HAVE_GRAPHVIZ
- 		this.image_factory = new SimpleChartFactory (settings, linker);
-+#endif
- 	}
- 
- 
-@@ -1026,6 +1032,7 @@ public abstract class Valadoc.Html.BasicDoclet : Api.Visitor, Doclet {
- 	}
- 
- 	protected void write_image_block (Api.Node element) {
-+#if HAVE_GRAPHVIZ
- 		if (element is Class || element is Interface || element is Struct) {
- 			unowned string format = (settings.use_svg_images ? "svg" : "png");
- 			var chart = new Charts.Hierarchy (image_factory, element);
-@@ -1045,6 +1052,7 @@ public abstract class Valadoc.Html.BasicDoclet : Api.Visitor, Doclet {
- 									   this.get_img_path_html (element, format)});
- 			writer.add_usemap (chart);
- 		}
-+#endif
- 	}
- 
- 	public void write_namespace_content (Namespace node, Api.Node? parent) {
-diff --git i/libvaladoc/html/htmlmarkupwriter.vala w/libvaladoc/html/htmlmarkupwriter.vala
-index dcc4dad76..cf9c860b8 100644
--- i/libvaladoc/html/htmlmarkupwriter.vala
-+++ w/libvaladoc/html/htmlmarkupwriter.vala
-@@ -51,12 +51,16 @@ public class Valadoc.Html.MarkupWriter : Valadoc.MarkupWriter {
- 		}
- 	}
- 
-+#if HAVE_GRAPHVIZ
- 	public MarkupWriter add_usemap (Charts.Chart chart) {
- 		string? buf = (string?) chart.write_buffer ("cmapx");
- 		if (buf != null) {
- 			raw_text ("\n");
- 			raw_text ((!) buf);
- 		}
-+#else
-+	public MarkupWriter add_usemap (void* chart) {
-+#endif
- 
- 		return this;
- 	}
--- a/pkgs/development/interpreters/acl2/default.nix
+++ b/pkgs/development/interpreters/acl2/default.nix
@ -1,6 +1,6 @@
 { lib, stdenv, callPackage, fetchFromGitHub, runCommandLocal, makeWrapper, substituteAll
 , sbcl, bash, which, perl, hostname
-, openssl, glucose, minisat, abc-verifier, z3, python
+, openssl, glucose, minisat, abc-verifier, z3, python2
 , certifyBooks ? true
 } @ args:

@ -48,7 +48,7 @@ in stdenv.mkDerivation rec {
    which perl hostname makeWrapper
    # Some of the books require one or more of these external tools:
    openssl.out glucose minisat abc-verifier libipasir
-    z3 (python.withPackages (ps: [ ps.z3 ]))
+    z3 (python2.withPackages (ps: [ ps.z3 ]))
  ];

  # NOTE: Parallel building can be memory-intensive depending on the number of
--- a/pkgs/development/interpreters/clojurescript/lumo/default.nix
+++ b/pkgs/development/interpreters/clojurescript/lumo/default.nix
@ -8,7 +8,7 @@
 , unzip
 , nodePackages
 , xcbuild
-, python
+, python2
 , openssl
 , pkgs
 , fetchgit
@ -154,7 +154,7 @@ stdenv.mkDerivation {
    nodejs
    clojure
    jre
-    python
+    python2
    openssl
    gnutar
    nodePackages."lumo-build-deps-../interpreters/clojurescript/lumo"
--- a/pkgs/development/interpreters/php/7.4.nix
+++ b/pkgs/development/interpreters/php/7.4.nix
@ -2,8 +2,8 @@

 let
  base = callPackage ./generic.nix (_args // {
-    version = "7.4.26";
-    sha256 = "0k803j5wf4jv72px0zqz2z2hxyk2w3jr6xyczy568dx4z2l8i2yn";
+    version = "7.4.27";
+    sha256 = "184aaef313fbf28c9987f6aa07b655cd1b0eae9e7e17061775a3e7d880185563";
  });

 in
--- a/pkgs/development/interpreters/php/8.0.nix
+++ b/pkgs/development/interpreters/php/8.0.nix
@ -2,8 +2,8 @@

 let
  base = callPackage ./generic.nix (_args // {
-    version = "8.0.13";
-    sha256 = "0djqh650clz4fy1zifazf0jq383znksydx23f1s48prrlixrshf2";
+    version = "8.0.14";
+    sha256 = "0jydl388mpysrrxa7h9sxf3fpp38mmygg9ryq8j7rb8p93giyf5v";
  });

 in
--- a/pkgs/development/interpreters/wasmtime/default.nix
+++ b/pkgs/development/interpreters/wasmtime/default.nix
@ -1,4 +1,4 @@
-{ rustPlatform, fetchFromGitHub, lib, python, cmake, llvmPackages, clang, stdenv, darwin }:
+{ rustPlatform, fetchFromGitHub, lib, python2, cmake, llvmPackages, clang, stdenv, darwin }:

 rustPlatform.buildRustPackage rec {
  pname = "wasmtime";
@ -14,7 +14,7 @@ rustPlatform.buildRustPackage rec {

  cargoSha256 = "1wlig9gls7s1k1swxwhl82vfga30bady8286livxc4y2zp0vb18w";

-  nativeBuildInputs = [ python cmake clang ];
+  nativeBuildInputs = [ python2 cmake clang ];
  buildInputs = [ llvmPackages.libclang ] ++
   lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
--- a/pkgs/development/libraries/arrayfire/default.nix
+++ b/pkgs/development/libraries/arrayfire/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchFromGitHub, cmake, pkg-config
+{ lib, stdenv, fetchFromGitHub, cmake, pkg-config
 , opencl-clhpp, ocl-icd, fftw, fftwFloat
 , blas, lapack, boost, mesa, libGLU, libGL
 , freeimage, python3, clfft, clblas
@ -8,11 +8,14 @@

 stdenv.mkDerivation rec {
  pname = "arrayfire";
-  version = "3.6.4";
+  version = "3.7.3";

-  src = fetchurl {
-    url = "http://arrayfire.com/arrayfire_source/arrayfire-full-${version}.tar.bz2";
-    sha256 = "1fin7a9rliyqic3z83agkpb8zlq663q6gdxsnm156cs8s7f7rc9h";
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0gcbg6b6gs38xhks5pp0vkcqs89zl7rh9982jqlzsd0h724qddw0";
+    fetchSubmodules = true;
  };

  cmakeFlags = [
--- a/pkgs/development/libraries/blitz/default.nix
+++ b/pkgs/development/libraries/blitz/default.nix
@ -4,7 +4,7 @@
 , pkg-config
 , gfortran
 , texinfo
-, python
+, python2
 , boost
  # Select SIMD alignment width (in bytes) for vectorization.
 , simdWidth ? 1
@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
    sha256 = "0nq84vwvvbq7m0my6h835ijfw53bxdp42qjc6kjhk436888qy9rh";
  };

-  nativeBuildInputs = [ pkg-config python texinfo ];
+  nativeBuildInputs = [ pkg-config python2 texinfo ];
  buildInputs = [ gfortran texinfo boost ];

  configureFlags =
--- a/pkgs/development/libraries/freenect/default.nix
+++ b/pkgs/development/libraries/freenect/default.nix
@ -18,6 +18,11 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ cmake pkg-config ];

+  # see https://aur.archlinux.org/cgit/aur.git/commit/PKGBUILD?h=libfreenect&id=0d17db49ba64bcb9e3a4eed61cf55c9a5ceb97f1
+  patchPhase = lib.concatMapStrings (x: ''
+    substituteInPlace ${x} --replace "{GLUT_LIBRARY}" "{GLUT_LIBRARIES}"
+  '') [ "examples/CMakeLists.txt" "wrappers/cpp/CMakeLists.txt" ];
+
  meta = {
    description = "Drivers and libraries for the Xbox Kinect device on Windows, Linux, and macOS";
    homepage = "http://openkinect.org";
--- a/pkgs/development/libraries/ntrack/default.nix
+++ b/pkgs/development/libraries/ntrack/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, qt4, pkg-config, libnl, python }:
+{ lib, stdenv, fetchurl, qt4, pkg-config, libnl, python2 }:

 stdenv.mkDerivation rec {
  pname = "ntrack";
@ -11,7 +11,7 @@ stdenv.mkDerivation rec {

  buildInputs = [ libnl qt4 ];

-  nativeBuildInputs = [ pkg-config python ];
+  nativeBuildInputs = [ pkg-config python2 ];

  # error: ISO C does not support '__FUNCTION__' predefined identifier [-Werror=pedantic]
  NIX_CFLAGS_COMPILE = "-Wno-error";
--- a/pkgs/development/libraries/openbabel/2.nix
+++ b/pkgs/development/libraries/openbabel/2.nix
@ -1,4 +1,4 @@
-{stdenv, lib, fetchFromGitHub, fetchpatch, cmake, zlib, libxml2, eigen, python, cairo, pcre, pkg-config }:
+{stdenv, lib, fetchFromGitHub, fetchpatch, cmake, zlib, libxml2, eigen, python2, cairo, pcre, pkg-config }:

 stdenv.mkDerivation rec {
  pname = "openbabel";
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
    })
  ];

-  buildInputs = [ zlib libxml2 eigen python cairo pcre ];
+  buildInputs = [ zlib libxml2 eigen python2 cairo pcre ];

  nativeBuildInputs = [ cmake pkg-config ];

--- a/pkgs/development/libraries/opencv/default.nix
+++ b/pkgs/development/libraries/opencv/default.nix
@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, cmake, pkg-config, unzip
 , zlib
-, enablePython ? false, pythonPackages
+, enablePython ? false, python2Packages
 , enableGtk2 ? false, gtk2
 , enableJPEG ? true, libjpeg
 , enablePNG ? true, libpng
@ -44,7 +44,7 @@ stdenv.mkDerivation rec {

  buildInputs =
       [ zlib ]
-    ++ lib.optional enablePython pythonPackages.python
+    ++ lib.optional enablePython python2Packages.python
    ++ lib.optional enableGtk2 gtk2
    ++ lib.optional enableJPEG libjpeg
    ++ lib.optional enablePNG libpng
@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
    ++ lib.optionals stdenv.isDarwin [ Cocoa QTKit ]
    ;

-  propagatedBuildInputs = lib.optional enablePython pythonPackages.numpy;
+  propagatedBuildInputs = lib.optional enablePython python2Packages.numpy;

  nativeBuildInputs = [ cmake pkg-config unzip ];

--- a/pkgs/development/libraries/pcmsolver/default.nix
+++ b/pkgs/development/libraries/pcmsolver/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, perl, gfortran, python
+{ lib, stdenv, fetchFromGitHub, cmake, perl, gfortran, python2
 , boost, eigen, zlib
 } :

@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
    cmake
    gfortran
    perl
-    python
+    python2
  ];

  buildInputs = [
--- a/pkgs/development/libraries/physics/fastjet/default.nix
+++ b/pkgs/development/libraries/physics/fastjet/default.nix
@ -1,7 +1,7 @@
 { lib
 , stdenv
 , fetchurl
-, python
+, python ? null
 , withPython ? false
 }:

--- a/pkgs/development/libraries/ptex/default.nix
+++ b/pkgs/development/libraries/ptex/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, zlib, python, cmake, pkg-config }:
+{ lib, stdenv, fetchFromGitHub, zlib, python2, cmake, pkg-config }:

 stdenv.mkDerivation rec
 {
@ -15,7 +15,7 @@ stdenv.mkDerivation rec
  outputs = [ "bin" "dev" "out" "lib" ];

  nativeBuildInputs = [ cmake ];
-  buildInputs = [ zlib python pkg-config ];
+  buildInputs = [ zlib python2 pkg-config ];

  # Can be removed in the next release
  # https://github.com/wdas/ptex/pull/42
--- a/pkgs/development/libraries/rabbitmq-java-client/default.nix
+++ b/pkgs/development/libraries/rabbitmq-java-client/default.nix
@ -1,4 +1,4 @@
-{ fetchurl, lib, stdenv, ant, jdk, jre, python, makeWrapper }:
+{ fetchurl, lib, stdenv, ant, jdk, jre, python2, makeWrapper }:

 stdenv.mkDerivation rec {
  pname = "rabbitmq-java-client";
@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ ant jdk python ];
+  buildInputs = [ ant jdk python2 ];

  buildPhase = "ant dist";

--- a/pkgs/development/libraries/science/math/itpp/default.nix
+++ b/pkgs/development/libraries/science/math/itpp/default.nix
@ -49,5 +49,6 @@ stdenv.mkDerivation rec {
    license = licenses.gpl3;
    platforms = platforms.unix;
    maintainers = with maintainers; [ andrew-d ];
+    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/itpp.x86_64-darwin
  };
 }
--- a/pkgs/development/libraries/seasocks/default.nix
+++ b/pkgs/development/libraries/seasocks/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, python, zlib }:
+{ lib, stdenv, fetchFromGitHub, cmake, python3, zlib }:

 stdenv.mkDerivation rec {
  pname = "seasocks";
@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ cmake ];
-  buildInputs = [ zlib python ];
+  buildInputs = [ zlib python3 ];

  meta = with lib; {
    homepage = "https://github.com/mattgodbolt/seasocks";
--- a/pkgs/development/libraries/snack/default.nix
+++ b/pkgs/development/libraries/snack/default.nix
@ -1,6 +1,6 @@
-# alsa-lib vorbis-tools python can be made optional
+# alsa-lib vorbis-tools python2 can be made optional

-{ lib, stdenv, fetchurl, python, tcl, tk, vorbis-tools, pkg-config, xlibsWrapper }:
+{ lib, stdenv, fetchurl, python2, tcl, tk, vorbis-tools, pkg-config, xlibsWrapper }:

 stdenv.mkDerivation rec {
  pname = "snack";
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
  postUnpack = ''sourceRoot="$sourceRoot/unix"'';

  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ python tcl tk vorbis-tools xlibsWrapper ];
+  buildInputs = [ python2 tcl tk vorbis-tools xlibsWrapper ];

  hardeningDisable = [ "format" ];

--- a/pkgs/development/libraries/swiften/default.nix
+++ b/pkgs/development/libraries/swiften/default.nix
@ -1,6 +1,6 @@
 { stdenv
 , lib
-, python
+, python2
 , libidn
 , lua
 , miniupnpc
@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
-    python
+    python2
    libidn
    lua
    miniupnpc
--- a/pkgs/development/libraries/tiledb/default.nix
+++ b/pkgs/development/libraries/tiledb/default.nix
@ -13,7 +13,7 @@
 , libpqxx
 , clang-tools
 , catch2
-, python
+, python3
 , gtest
 , doxygen
 , fixDarwinDylibNames
@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [
    clang-tools
    cmake
-    python
+    python3
    doxygen
  ] ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;

--- a/pkgs/development/libraries/uriparser/default.nix
+++ b/pkgs/development/libraries/uriparser/default.nix
@ -14,10 +14,10 @@ stdenv.mkDerivation rec {

  cmakeFlags = [
    "-DURIPARSER_BUILD_DOCS=OFF"
-  ];
+  ] ++ lib.optional (!doCheck) "-DURIPARSER_BUILD_TESTS=OFF";

  checkInputs = [ gtest ];
-  doCheck = stdenv.targetPlatform.system == stdenv.hostPlatform.system;
+  doCheck = stdenv.buildPlatform == stdenv.hostPlatform;

  meta = with lib; {
    homepage = "https://uriparser.github.io/";
--- a/pkgs/development/ocaml-modules/llvm/default.nix
+++ b/pkgs/development/ocaml-modules/llvm/default.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, python, cmake, libllvm, ocaml, findlib, ctypes }:
+{ stdenv, lib, python2, cmake, libllvm, ocaml, findlib, ctypes }:

 let version = lib.getVersion libllvm; in

@ -9,7 +9,7 @@ stdenv.mkDerivation {
  inherit (libllvm) src;

  nativeBuildInputs = [ cmake ];
-  buildInputs = [ python ocaml findlib ctypes ];
+  buildInputs = [ python2 ocaml findlib ctypes ];
  propagatedBuildInputs = [ libllvm ];

  cmakeFlags = [
--- a/pkgs/development/ocaml-modules/pycaml/default.nix
+++ b/pkgs/development/ocaml-modules/pycaml/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, ocaml, findlib, ncurses, python, ocaml_make }:
+{ lib, stdenv, fetchurl, ocaml, findlib, ncurses, python2, ocaml_make }:

 # This is the original pycaml version with patches from debian.

@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
  sourceRoot = "pycaml";
  patches = [ "../debian/patches/*.patch" ];

-  buildInputs = [ ncurses ocaml findlib python ocaml_make ];
+  buildInputs = [ ncurses ocaml findlib python2 ocaml_make ];
  createFindlibDestdir = true;

  # the Makefile is not shipped with an install target, hence we do it ourselves.
--- a/pkgs/development/octave-modules/miscellaneous/default.nix
+++ b/pkgs/development/octave-modules/miscellaneous/default.nix
@ -2,7 +2,6 @@
 , lib
 , fetchurl
 # Build-time dependencies
-, mlterm
 , ncurses # >= 5
 , units
 }:
@ -17,7 +16,6 @@ buildOctavePackage rec {
  };

  buildInputs = [
-    mlterm
    ncurses
  ];

--- a/pkgs/development/python-modules/build/default.nix
+++ b/pkgs/development/python-modules/build/default.nix
@ -54,6 +54,8 @@ buildPythonPackage rec {
  pytestFlagsArray = [
    "-n"
    "$NIX_BUILD_CORES"
+    "-W"
+    "ignore::DeprecationWarning"
  ];

  disabledTests = [
--- a/pkgs/development/python-modules/cairocffi/default.nix
+++ b/pkgs/development/python-modules/cairocffi/default.nix
@ -12,16 +12,67 @@
 , cairo
 , cffi
 , numpy
-, withXcffib ? false, xcffib
+, withXcffib ? false
+, xcffib
 , python
 , glib
 , gdk-pixbuf
-}@args:
+}:
+
+buildPythonPackage rec {
+  pname = "cairocffi";
+  version = "1.3.0";

-import ./generic.nix ({
-  version = "1.2.0";
-  sha256 = "sha256-mpebUAxkyBef7ChvM36P5kTsovLNBYYM4LYtJfIuoUA=";
-  dlopen_patch = ./dlopen-paths.patch;
  disabled = pythonOlder "3.5";
-  inherit withXcffib;
-} // args)
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-EIo6fLCeIDvdhQHZuq2R14bSBFYb1x6TZOizSJfEe5E=";
+  };
+
+  LC_ALL = "en_US.UTF-8";
+
+  # checkPhase require at least one 'normal' font and one 'monospace',
+  # otherwise glyph tests fails
+  FONTCONFIG_FILE = makeFontsConf {
+    fontDirectories = [ freefont_ttf ];
+  };
+
+  propagatedBuildInputs = [ cairo cffi ] ++ lib.optional withXcffib xcffib;
+  propagatedNativeBuildInputs = [ cffi ];
+
+  # pytestCheckHook does not work
+  checkInputs = [ numpy pytest glibcLocales ];
+
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace "pytest-runner" "" \
+      --replace "pytest-cov" "" \
+      --replace "pytest-flake8" "" \
+      --replace "pytest-isort" "" \
+      --replace "--flake8 --isort" ""
+  '';
+
+  checkPhase = ''
+    py.test $out/${python.sitePackages}
+  '';
+
+  patches = [
+    # OSError: dlopen() failed to load a library: gdk-pixbuf-2.0 / gdk-pixbuf-2.0-0
+    (substituteAll {
+      src = ./dlopen-paths.patch;
+      ext = stdenv.hostPlatform.extensions.sharedLibrary;
+      cairo = cairo.out;
+      glib = glib.out;
+      gdk_pixbuf = gdk-pixbuf.out;
+    })
+    ./fix_test_scaled_font.patch
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/SimonSapin/cairocffi";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ SuperSandro2000 ];
+    description = "cffi-based cairo bindings for Python";
+  };
+}
--- a/pkgs/development/python-modules/cairocffi/generic.nix
+++ b/pkgs/development/python-modules/cairocffi/generic.nix
@ -1,63 +0,0 @@
-{ version
-, sha256
-, dlopen_patch
-, disabled ? false
-, ...
-}@args:
-
-with args;
-
-buildPythonPackage rec {
-  pname = "cairocffi";
-  inherit version disabled;
-
-  src = fetchPypi {
-    inherit pname version sha256;
-  };
-
-  LC_ALL = "en_US.UTF-8";
-
-  # checkPhase require at least one 'normal' font and one 'monospace',
-  # otherwise glyph tests fails
-  FONTCONFIG_FILE = makeFontsConf {
-    fontDirectories = [ freefont_ttf ];
-  };
-
-  propagatedBuildInputs = [ cairo cffi ] ++ lib.optional withXcffib xcffib;
-  propagatedNativeBuildInputs = [ cffi ];
-
-  # pytestCheckHook does not work
-  checkInputs = [ numpy pytest glibcLocales ];
-
-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "pytest-runner" "" \
-      --replace "pytest-cov" "" \
-      --replace "pytest-flake8" "" \
-      --replace "pytest-isort" "" \
-      --replace "--flake8 --isort" ""
-  '';
-
-  checkPhase = ''
-    py.test $out/${python.sitePackages}
-  '';
-
-  patches = [
-    # OSError: dlopen() failed to load a library: gdk-pixbuf-2.0 / gdk-pixbuf-2.0-0
-    (substituteAll {
-      src = dlopen_patch;
-      ext = stdenv.hostPlatform.extensions.sharedLibrary;
-      cairo = cairo.out;
-      glib = glib.out;
-      gdk_pixbuf = gdk-pixbuf.out;
-    })
-    ./fix_test_scaled_font.patch
-  ];
-
-  meta = with lib; {
-    homepage = "https://github.com/SimonSapin/cairocffi";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [];
-    description = "cffi-based cairo bindings for Python";
-  };
-}
--- a/Show More
+++ b/Show More