Merge master into staging-next

2 years ago · 86ec85655d
parent deef19c9a1 e04ca59317
commit 86ec85655d
47 changed files with 429 additions and 221 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -12168,6 +12168,12 @@
    githubId = 12984845;
    name = "Subhrajyoti Sen";
  };
+  sudosubin = {
+    email = "sudosubin@gmail.com";
+    github = "sudosubin";
+    githubId = 32478597;
+    name = "Subin Kim";
+  };
  suhr = {
    email = "suhr@i2pmail.org";
    github = "suhr";
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@ -725,6 +725,7 @@ in

      systemd.services.postfix-setup =
        { description = "Setup for Postfix mail server";
+          serviceConfig.RemainAfterExit = true;
          serviceConfig.Type = "oneshot";
          script = ''
            # Backwards compatibility
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@ -17,8 +17,8 @@ let
  gitalySocket = "${cfg.statePath}/tmp/sockets/gitaly.socket";
  pathUrlQuote = url: replaceStrings ["/"] ["%2F"] url;

-  databaseConfig = {
-    production = {
+  databaseConfig = let
+    val = {
      adapter = "postgresql";
      database = cfg.databaseName;
      host = cfg.databaseHost;
@ -26,6 +26,10 @@ let
      encoding = "utf8";
      pool = cfg.databasePool;
    } // cfg.extraDatabaseConfig;
+  in if lib.versionAtLeast (lib.getVersion cfg.packages.gitlab) "15.0" then {
+    production.main = val;
+  } else {
+    production = val;
  };

  # We only want to create a database if we're actually going to connect to it.
@ -1184,7 +1188,7 @@ in {
                fi

                jq <${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)} \
-                   '.production.password = $ENV.db_password' \
+                   '.${if lib.versionAtLeast (lib.getVersion cfg.packages.gitlab) "15.0" then "production.main" else "production"}.password = $ENV.db_password' \
                   >'${cfg.statePath}/config/database.yml'
              ''
              else ''
--- a/pkgs/applications/editors/neovim/default.nix
+++ b/pkgs/applications/editors/neovim/default.nix
@ -3,6 +3,7 @@
 , unibilium, gperf
 , libvterm-neovim
 , tree-sitter
+, CoreServices
 , glibcLocales ? null, procps ? null

 # now defaults to false because some tests can be flaky (clipboard etc), see
@ -60,7 +61,7 @@ in
      neovimLuaEnv
      tree-sitter
      unibilium
-    ] ++ optional stdenv.isDarwin libiconv
+    ] ++ optionals stdenv.isDarwin [ libiconv CoreServices ]
      ++ optionals doCheck [ glibcLocales procps ]
    ;

--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@ -14,17 +14,17 @@ let
  archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "1db5vwcwi3w11zm2b72cvddn5k9yav65rg7ii9wq4a0dym39f8ql";
-    x86_64-darwin = "1q5vjisdc0q5vigb1lwq8fkxbaar73jnk4ac0fqlhc4gqacz3cs3";
-    aarch64-linux = "01lcvjw9nfgp93ydl16bp91gbkivd23jn8pan220fjvdsgvcbg48";
-    aarch64-darwin = "06p6p2c9a3rav9c23pvfn8mmd77wc9z7pavpmkgm1f3wplx48q8q";
-    armv7l-linux = "0pzim9r2zzwyim3g6f8ixgqllgz4cijaiw76czi0wmz4dxxdljrw";
+    x86_64-linux = "0yahcv64jblmz5q0ylgg1sghcnyam4nq47var3y18ndjpaqyb1fl";
+    x86_64-darwin = "0zsizwrhc0na9dfics27i48q4x3kz0qq5m2vdjvrgi69y2iy5z4c";
+    aarch64-linux = "01wpi9pdf1fjxfx8w5g5da31q561qw7ykjm9spb3arvnivq20dp2";
+    aarch64-darwin = "0qk22jyn0vypsx8x4cmpab5wrmhqx6hdkm314k8k06mz5cg1v4r3";
+    armv7l-linux = "04r0x31flahzw8y0kkbzqnvcwllifaa0ysr163bb5b8kiyc189kk";
  }.${system};
 in
  callPackage ./generic.nix rec {
    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.67.1";
+    version = "1.67.2";
    pname = "vscode";

    executableName = "code" + lib.optionalString isInsiders "-insiders";
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@ -14,11 +14,11 @@ let
  archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "0hsq3b8j58xjl8pkrd5x3qh0lsl9gwbd9wgvhzlnx2h94iasr1v5";
-    x86_64-darwin = "04fbl8kp3af7xcicx17ay2piwy4y3yiyn9723hlmmf7s359rr1wn";
-    aarch64-linux = "0jljsa61zr3symfdsjx9jj4s3y1kqslxh8gc1gqx45zlm5rzr7k8";
-    aarch64-darwin = "1swkc0qb1xif8hj6cjp3jq1iqdfqsa681hhp7mxvrpqg0i2zppk3";
-    armv7l-linux = "1ssbdc4b11xmd45m7bzhdh6szx331pzah2mjpqjg7cz3ray3xvwy";
+    x86_64-linux = "1ns4cpkihbrwgh8pvn1kjlnipssinjkxy28szidnz6q71zyvsjyw";
+    x86_64-darwin = "05v0gxal74igc29qjy0ficlyna17bzh1lpfqvyxdpg22is894h2l";
+    aarch64-linux = "1x6lhcvdly3a2n0shp2vlgk3s2pj9byxn9dc9pjg4k5ff24dql7l";
+    aarch64-darwin = "03knkj0y6n45lin0v6288zbq1nz5qh81ijyw1w3zrpd7pijn9j0x";
+    armv7l-linux = "0iwlr5q1qwq3jgldrhz4bbyl3xmdhd4ss690x1lqb4vxm2m7v5jw";
  }.${system};

  sourceRoot = if stdenv.isDarwin then "" else ".";
@ -28,7 +28,7 @@ in

    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.67.1";
+    version = "1.67.2";
    pname = "vscodium";

    executableName = "codium";
--- a/pkgs/applications/networking/cluster/nomad/1.1.nix
+++ b/pkgs/applications/networking/cluster/nomad/1.1.nix
@ -6,7 +6,7 @@

 callPackage ./generic.nix {
  inherit buildGoModule nvidia_x11 nvidiaGpuSupport;
-  version = "1.1.12";
-  sha256 = "19y52sn4qz0vx9s188nf7rkr7y2cbq6h33l98sr4w85kmainn86s";
-  vendorSha256 = "0p582y2q6zpyn7vmv1p8p8r2gbh786pqc6lpipgr7rpxbnxf5v4b";
+  version = "1.1.14";
+  sha256 = "0jzcmv6kw555lz7mrm673qgjfmzm4pznibbz9qn3w1jj4x9ddncy";
+  vendorSha256 = "04nyd37viz521qb3frcy39alha0bpx029cy3kswldhh7wbyp7284";
 }
--- a/pkgs/applications/networking/cluster/nomad/1.2.nix
+++ b/pkgs/applications/networking/cluster/nomad/1.2.nix
@ -6,7 +6,7 @@

 callPackage ./generic.nix {
  inherit buildGoModule nvidia_x11 nvidiaGpuSupport;
-  version = "1.2.7";
-  sha256 = "13whyjl0shr00mn46f361ybz90zwkiyab9ygcs0hrs75lgvkmfm9";
-  vendorSha256 = "177gv0h8bhxd5j78sf4is86zzq8xl9schg1hbyh0hmwg4whhqm8a";
+  version = "1.2.8";
+  sha256 = "11yn8g9wsdb35q97wn5vy93kgbn5462k0a33wxlfdz14i5h00yj8";
+  vendorSha256 = "06wyfnlm37qjvd1pwzygflfpcp9p52f61wgi6pb9l7hnqy2ph6j5";
 }
--- a/pkgs/applications/networking/cluster/nomad/1.3.nix
+++ b/pkgs/applications/networking/cluster/nomad/1.3.nix
@ -6,7 +6,7 @@

 callPackage ./generic.nix {
  inherit buildGoModule nvidia_x11 nvidiaGpuSupport;
-  version = "1.3.0";
-  sha256 = "098sg7jl257r6zfi2fsp9dwm0rrzi8m2k85bb097q14n3p4s3pna";
-  vendorSha256 = "037bdgnyv8gkm2hz7h727ss46adnkywg28j6i1canmdacpi3qv5c";
+  version = "1.3.1";
+  sha256 = "03ckhqh5xznvhbk380ka0g9w9hrvsi389h5maw68f3g3acx68jm7";
+  vendorSha256 = "08k5dxaq4r2q0km6y9mc14haski6l7hmhmzn5wjb961hwf5hkfgh";
 }
--- a/pkgs/applications/networking/instant-messengers/gajim/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gajim/default.nix
@ -2,6 +2,7 @@

 # Native dependencies
 , python3, gtk3, gobject-introspection, gnome
+, gtksourceview4
 , glib-networking

 # Test dependencies
@ -21,15 +22,16 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "gajim";
-  version = "1.3.3";
+  version = "1.4.1";

  src = fetchurl {
    url = "https://gajim.org/downloads/${lib.versions.majorMinor version}/gajim-${version}.tar.gz";
-    sha256 = "1337qkpcv7j0fgws9scnk82mn2l7s17060vmrbh3ihinmxmbxg6x";
+    sha256 = "sha256:0mbx7s1d2xgk7bkhwqcdss6ynshkqdiwh3qgv7d45frb4c3k33l2";
  };

  buildInputs = [
    gobject-introspection gtk3 gnome.adwaita-icon-theme
+    gtksourceview4
    glib-networking
  ] ++ lib.optionals enableJingle [ farstream gstreamer gst-plugins-base gst-libav gst-plugins-good libnice ]
    ++ lib.optional enableSecrets libsecret
@ -74,7 +76,7 @@ python3.pkgs.buildPythonApplication rec {
  checkPhase = ''
    xvfb-run dbus-run-session \
      --config-file=${dbus.daemon}/share/dbus-1/session.conf \
-      ${python3.interpreter} -m unittest discover -s test/unit -v
+      ${python3.interpreter} -m unittest discover -s test/gtk -v
    ${python3.interpreter} -m unittest discover -s test/no_gui -v
  '';

--- a/pkgs/applications/networking/pjsip/default.nix
+++ b/pkgs/applications/networking/pjsip/default.nix
@ -2,22 +2,17 @@

 stdenv.mkDerivation rec {
  pname = "pjsip";
-  version = "2.12";
+  version = "2.12.1";

  src = fetchFromGitHub {
    owner = pname;
    repo = "pjproject";
    rev = version;
-    sha256 = "sha256-snp9+PlffU9Ay8o42PM8SqyP60hu9nozp457HM+0bM8=";
+    sha256 = "sha256-HIDL4xzzTu3irzrIOf8qSNCAvHGOMpi8EDeqZb8mMnc=";
  };

  patches = [
    ./fix-aarch64.patch
-    (fetchpatch {
-      name = "CVE-2022-24764.patch";
-      url = "https://github.com/pjsip/pjproject/commit/560a1346f87aabe126509bb24930106dea292b00.patch";
-      sha256 = "1fy78v3clm0gby7qcq3ny6f7d7f4qnn01lkqq67bf2s85k2phisg";
-    })
  ];

  buildInputs = [ openssl libsamplerate ]
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@ -1,14 +1,14 @@
 {
-  "version": "14.10.2",
-  "repo_hash": "0f7cfc1wrzz4m5yhd6jnp3dqpdy7vbj8bf826zjsi2ss48430bk0",
-  "yarn_hash": "17wxqvig34namf8kvh8bwci3y0f3k2nl4zs99jcvskdad9p45rlc",
+  "version": "15.0.0",
+  "repo_hash": "sha256-+ZLHo35BhgWlopuwrVGiMvcWl8qUvHUV2kAEIXWazyY=",
+  "yarn_hash": "1a8k3x3b9sirzicqkwmr10m27n593iljfh8awdc9700akbj155lr",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v14.10.2-ee",
+  "rev": "v15.0.0-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "14.10.2",
-    "GITLAB_PAGES_VERSION": "1.56.1",
-    "GITLAB_SHELL_VERSION": "13.25.1",
-    "GITLAB_WORKHORSE_VERSION": "14.10.2"
+    "GITALY_SERVER_VERSION": "15.0.0",
+    "GITLAB_PAGES_VERSION": "1.58.0",
+    "GITLAB_SHELL_VERSION": "14.3.0",
+    "GITLAB_WORKHORSE_VERSION": "15.0.0"
  }
 }
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@ -74,7 +74,7 @@ let
      rm lib/tasks/yarn.rake

      # The rake tasks won't run without a basic configuration in place
-      mv config/database.yml.env config/database.yml
+      mv config/database.yml.postgresql config/database.yml
      mv config/gitlab.yml.example config/gitlab.yml

      # Yarn and bundler wants a real home directory to write cache, config, etc to
--- a/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
@ -94,7 +94,7 @@ GEM
    jaeger-client (1.1.0)
      opentracing (~> 0.3)
      thrift
-    json (2.6.1)
+    json (2.5.1)
    licensee (9.14.1)
      dotenv (~> 2.0)
      octokit (~> 4.17)
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@ -11,8 +11,9 @@ let
    gemdir = ./.;
  };

-  version = "14.10.2";
-  gitaly_package = "gitlab.com/gitlab-org/gitaly/v${lib.versions.major version}";
+  version = "15.0.0";
+  package_version = "v14";
+  gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 in

 buildGoModule {
@ -23,10 +24,10 @@ buildGoModule {
    owner = "gitlab-org";
    repo = "gitaly";
    rev = "v${version}";
-    sha256 = "sha256-hLTzkW5GDq1AgTwe1pVj6Tiyd0JpJ76ATFu3Q+m9MVg=";
+    sha256 = "sha256-ib/gGkXo6W6LZ6j92oUMhJWdDYZRnA1p+tsOK6ewemk=";
  };

-  vendorSha256 = "sha256-ZL61t+Ii2Ns3TmitiF93exinod54+RCqrbdpU67HeY0=";
+  vendorSha256 = "sha256-/tHKWo09ZV31TSIqlOk36V3y7gNikziUJHf+nS1gHEw=";

  passthru = {
    inherit rubyEnv;
@ -42,7 +43,7 @@ buildGoModule {
  postInstall = ''
    mkdir -p $ruby
    cp -rv $src/ruby/{bin,lib,proto} $ruby
-    mv $out/bin/gitaly-git2go-v${lib.versions.major version} $out/bin/gitaly-git2go-${version}
+    mv $out/bin/gitaly-git2go-${package_version} $out/bin/gitaly-git2go-${version}
  '';

  outputs = [ "out" "ruby" ];
--- a/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
@ -372,10 +372,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1z9grvjyfz16ag55hg522d3q4dh07hf391sf9s96npc0vfi85xkz";
+      sha256 = "0lrirj0gw420kw71bjjlqkqhqbrplla61gbv1jzgsz6bv90qr3ci";
      type = "gem";
    };
-    version = "2.6.1";
+    version = "2.5.1";
  };
  licensee = {
    dependencies = ["dotenv" "octokit" "reverse_markdown" "rugged" "thor"];
--- a/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
@ -2,19 +2,19 @@

 buildGoModule rec {
  pname = "gitlab-shell";
-  version = "13.25.1";
+  version = "14.3.0";
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-shell";
    rev = "v${version}";
-    sha256 = "sha256-JItk6gfpBNxabI0vsIOHIBhK7L6E1ijPgrnzhQiKPYw=";
+    sha256 = "sha256-SFoNtWcY0iJREsA+vZRsVJHmNb2vNvOiBJnochxA/Us=";
  };

  buildInputs = [ ruby ];

  patches = [ ./remove-hardcoded-locations.patch ];

-  vendorSha256 = "sha256-S7bVQxb+p6o0LPAdx7S6dlsHLecPwMS7myjQZwYhHcU=";
+  vendorSha256 = "sha256-eSzJon8o7ktV3rFuTE1A4tzdkBzWBZf1JxnrcMj5s00=";

  postInstall = ''
    cp -r "$NIX_BUILD_TOP/source"/bin/* $out/bin
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@ -5,7 +5,7 @@ in
 buildGoModule rec {
  pname = "gitlab-workhorse";

-  version = "14.10.2";
+  version = "15.0.0";

  src = fetchFromGitLab {
    owner = data.owner;
@ -16,7 +16,7 @@ buildGoModule rec {

  sourceRoot = "source/workhorse";

-  vendorSha256 = "sha256-TNZtggUBMwIPO6ZZGk/EkRcilh7sztlAT7Hu4vhME0w=";
+  vendorSha256 = "sha256-7hNwBCDMdiiOliZa/lkYLo8gyAksAU0HanCSyaAMYLs=";
  buildInputs = [ git ];
  ldflags = [ "-X main.Version=${version}" ];
  doCheck = false;
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@ -4,7 +4,7 @@ source 'https://rubygems.org'

 gem 'rails', '~> 6.1.4.7'

-gem 'bootsnap', '~> 1.9.1', require: false
+gem 'bootsnap', '~> 1.9.4', require: false

 # Responders respond_to and respond_with
 gem 'responders', '~> 3.0'
@ -46,7 +46,6 @@ gem 'omniauth-facebook', '~> 4.0.0'
 gem 'omniauth-github', '~> 1.4'
 gem 'omniauth-gitlab', '~> 1.0.2'
 gem 'omniauth-google-oauth2', '~> 0.6.0'
-gem 'omniauth-kerberos', '~> 0.3.0', group: :kerberos
 gem 'omniauth-oauth2-generic', '~> 0.2.2'
 gem 'omniauth-saml', '~> 1.10'
 gem 'omniauth-shibboleth', '~> 1.3.0'
@ -61,6 +60,7 @@ gem 'jwt', '~> 2.1.0'

 # Kerberos authentication. EE-only
 gem 'gssapi', group: :kerberos
+gem 'timfel-krb5-auth', '~> 0.8', group: :kerberos

 # Spam and anti-bot protection
 gem 'recaptcha', '~> 4.11', require: 'recaptcha/rails'
@ -104,7 +104,7 @@ gem 'graphql', '~> 1.11.10'
 gem 'graphiql-rails', '~> 1.8'
 gem 'apollo_upload_server', '~> 2.1.0'
 gem 'graphql-docs', '~> 1.6.0', group: [:development, :test]
-gem 'graphlient', '~> 0.4.0' # Used by BulkImport feature (group::import)
+gem 'graphlient', '~> 0.5.0' # Used by BulkImport feature (group::import)

 gem 'hashie'
 # Disable strong_params so that Mash does not respond to :permitted?
@ -142,9 +142,9 @@ gem 'unf', '~> 0.1.4'
 gem 'seed-fu', '~> 2.3.7'

 # Search
-gem 'elasticsearch-model', '~> 6.1'
-gem 'elasticsearch-rails', '~> 6.1', require: 'elasticsearch/rails/instrumentation'
-gem 'elasticsearch-api',   '~> 6.8.2'
+gem 'elasticsearch-model', '~> 7.2'
+gem 'elasticsearch-rails', '~> 7.2', require: 'elasticsearch/rails/instrumentation'
+gem 'elasticsearch-api',   '7.13.3'
 gem 'aws-sdk-core', '~> 3'
 gem 'aws-sdk-cloudformation', '~> 1'
 gem 'aws-sdk-s3', '~> 1'
@ -345,6 +345,7 @@ gem 'warning', '~> 1.2.0'

 group :development do
  gem 'lefthook', '~> 0.7.0', require: false
+  gem 'rubocop'
  gem 'solargraph', '~> 0.44.3', require: false

  gem 'letter_opener_web', '~> 2.0.0'
@ -543,4 +544,4 @@ gem 'ipaddress', '~> 0.8.3'

 gem 'parslet', '~> 1.8'

-gem 'ipynbdiff', '0.4.5'
+gem 'ipynbdiff', '0.4.7'
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@ -143,7 +143,7 @@ GEM
      rack (>= 0.9.0)
    bindata (2.4.10)
    binding_ninja (0.2.3)
-    bootsnap (1.9.1)
+    bootsnap (1.9.4)
      msgpack (~> 1.0)
    bootstrap_form (4.2.0)
      actionpack (>= 5.0)
@ -306,17 +306,17 @@ GEM
    e2mmap (0.1.0)
    ecma-re-validator (0.3.0)
      regexp_parser (~> 2.0)
-    elasticsearch (6.8.2)
-      elasticsearch-api (= 6.8.2)
-      elasticsearch-transport (= 6.8.2)
-    elasticsearch-api (6.8.2)
+    elasticsearch (7.13.3)
+      elasticsearch-api (= 7.13.3)
+      elasticsearch-transport (= 7.13.3)
+    elasticsearch-api (7.13.3)
      multi_json
-    elasticsearch-model (6.1.1)
+    elasticsearch-model (7.2.0)
      activesupport (> 3)
-      elasticsearch (~> 6)
+      elasticsearch (~> 7)
      hashie
-    elasticsearch-rails (6.1.1)
-    elasticsearch-transport (6.8.2)
+    elasticsearch-rails (7.2.1)
+    elasticsearch-transport (7.13.3)
      faraday (~> 1)
      multi_json
    email_reply_trimmer (0.1.6)
@ -342,13 +342,17 @@ GEM
    factory_bot_rails (6.2.0)
      factory_bot (~> 6.2.0)
      railties (>= 5.0.0)
-    faraday (1.4.2)
+    faraday (1.10.0)
      faraday-em_http (~> 1.0)
      faraday-em_synchrony (~> 1.0)
      faraday-excon (~> 1.1)
+      faraday-httpclient (~> 1.0)
+      faraday-multipart (~> 1.0)
      faraday-net_http (~> 1.0)
-      faraday-net_http_persistent (~> 1.1)
-      multipart-post (>= 1.2, < 3)
+      faraday-net_http_persistent (~> 1.0)
+      faraday-patron (~> 1.0)
+      faraday-rack (~> 1.0)
+      faraday-retry (~> 1.0)
      ruby2_keywords (>= 0.0.4)
    faraday-cookie_jar (0.0.7)
      faraday (>= 0.8.0)
@ -358,9 +362,15 @@ GEM
    faraday-excon (1.1.0)
    faraday-http-cache (2.2.0)
      faraday (>= 0.8)
+    faraday-httpclient (1.0.1)
+    faraday-multipart (1.0.3)
+      multipart-post (>= 1.2, < 3)
    faraday-net_http (1.0.1)
-    faraday-net_http_persistent (1.1.0)
-    faraday_middleware (1.0.0)
+    faraday-net_http_persistent (1.2.0)
+    faraday-patron (1.0.0)
+    faraday-rack (1.0.0)
+    faraday-retry (1.0.3)
+    faraday_middleware (1.2.0)
      faraday (~> 1.0)
    faraday_middleware-aws-sigv4 (0.3.0)
      aws-sigv4 (~> 1.0)
@ -560,14 +570,14 @@ GEM
    graphiql-rails (1.8.0)
      railties
      sprockets-rails
-    graphlient (0.4.0)
+    graphlient (0.5.0)
      faraday (>= 1.0)
      faraday_middleware
      graphql-client
    graphql (1.11.10)
-    graphql-client (0.16.0)
+    graphql-client (0.17.0)
      activesupport (>= 3.0)
-      graphql (~> 1.8)
+      graphql (~> 1.10)
    graphql-docs (1.6.0)
      commonmarker (~> 0.16)
      escape_utils (~> 1.2)
@ -648,7 +658,7 @@ GEM
    invisible_captcha (1.1.0)
      rails (>= 4.2)
    ipaddress (0.8.3)
-    ipynbdiff (0.4.5)
+    ipynbdiff (0.4.7)
      diffy (~> 3.3)
      json (~> 2.5, >= 2.5.1)
    jaeger-client (1.1.0)
@ -767,7 +777,7 @@ GEM
      faraday (>= 0.9, < 2.0.0)
      faraday-cookie_jar (~> 0.0.6)
      ms_rest (~> 0.7.6)
-    msgpack (1.3.3)
+    msgpack (1.5.1)
    multi_json (1.14.1)
    multi_xml (0.6.0)
    multipart-post (2.1.1)
@ -856,11 +866,6 @@ GEM
      jwt (>= 2.0)
      omniauth (>= 1.1.1)
      omniauth-oauth2 (>= 1.5)
-    omniauth-kerberos (0.3.0)
-      omniauth-multipassword
-      timfel-krb5-auth (~> 0.8)
-    omniauth-multipassword (0.4.2)
-      omniauth (~> 1.0)
    omniauth-oauth (1.1.0)
      oauth
      omniauth (~> 1.0)
@ -1071,7 +1076,7 @@ GEM
    rspec-expectations (3.10.1)
      diff-lcs (>= 1.2.0, < 2.0)
      rspec-support (~> 3.10.0)
-    rspec-mocks (3.10.2)
+    rspec-mocks (3.10.3)
      diff-lcs (>= 1.2.0, < 2.0)
      rspec-support (~> 3.10.0)
    rspec-parameterized (0.5.0)
@ -1133,7 +1138,7 @@ GEM
      nokogiri (>= 1.10.5)
      rexml
    ruby-statistics (3.0.0)
-    ruby2_keywords (0.0.4)
+    ruby2_keywords (0.0.5)
    ruby_parser (3.15.0)
      sexp_processor (~> 4.9)
    rubyntlm (0.6.2)
@ -1430,7 +1435,7 @@ DEPENDENCIES
  benchmark-ips (~> 2.3.0)
  benchmark-memory (~> 0.1)
  better_errors (~> 2.9.0)
-  bootsnap (~> 1.9.1)
+  bootsnap (~> 1.9.4)
  bootstrap_form (~> 4.2.0)
  browser (~> 4.2)
  bullet (~> 6.1.3)
@ -1459,9 +1464,9 @@ DEPENDENCIES
  discordrb-webhooks (~> 3.4)
  doorkeeper (~> 5.5.0.rc2)
  doorkeeper-openid_connect (~> 1.7.5)
-  elasticsearch-api (~> 6.8.2)
-  elasticsearch-model (~> 6.1)
-  elasticsearch-rails (~> 6.1)
+  elasticsearch-api (= 7.13.3)
+  elasticsearch-model (~> 7.2)
+  elasticsearch-rails (~> 7.2)
  email_reply_trimmer (~> 0.1)
  email_spec (~> 2.2.0)
  erubi (~> 1.9.0)
@ -1513,7 +1518,7 @@ DEPENDENCIES
  grape-path-helpers (~> 1.7.0)
  grape_logging (~> 1.7)
  graphiql-rails (~> 1.8)
-  graphlient (~> 0.4.0)
+  graphlient (~> 0.5.0)
  graphql (~> 1.11.10)
  graphql-docs (~> 1.6.0)
  grpc (~> 1.42.0)
@ -1531,7 +1536,7 @@ DEPENDENCIES
  icalendar
  invisible_captcha (~> 1.1.0)
  ipaddress (~> 0.8.3)
-  ipynbdiff (= 0.4.5)
+  ipynbdiff (= 0.4.7)
  jira-ruby (~> 2.1.4)
  js_regex (~> 3.7)
  json (~> 2.5.1)
@ -1576,7 +1581,6 @@ DEPENDENCIES
  omniauth-github (~> 1.4)
  omniauth-gitlab (~> 1.0.2)
  omniauth-google-oauth2 (~> 0.6.0)
-  omniauth-kerberos (~> 0.3.0)
  omniauth-oauth2-generic (~> 0.2.2)
  omniauth-salesforce (~> 1.0.5)
  omniauth-saml (~> 1.10)
@ -1626,6 +1630,7 @@ DEPENDENCIES
  rspec-retry (~> 0.6.1)
  rspec_junit_formatter
  rspec_profiling (~> 0.0.6)
+  rubocop
  ruby-fogbugz (~> 0.2.1)
  ruby-magic (~> 0.5)
  ruby-prof (~> 1.3.0)
@ -1671,6 +1676,7 @@ DEPENDENCIES
  thin (~> 1.8.0)
  thrift (>= 0.14.0)
  timecop (~> 0.9.1)
+  timfel-krb5-auth (~> 0.8)
  toml-rb (~> 2.0)
  truncato (~> 0.7.11)
  typhoeus (~> 1.4.0)
--- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
@ -577,10 +577,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1ndjra3h86dq28njm2swmaw6n3vsywrycrf7i5iy9l8hrhfhv4x2";
+      sha256 = "19i4x2nascd74ahcvmrsnf03cygh1y4c9yf8rcv91fv0mcxpvb9n";
      type = "gem";
    };
-    version = "1.9.1";
+    version = "1.9.4";
  };
  bootstrap_form = {
    dependencies = ["actionpack" "activemodel"];
@ -1289,10 +1289,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "152z76sp2ymyaqrbm8c6y0p1ydkckwrr6iif66mdsc5s0433va3f";
+      sha256 = "0havyxmvl157a653prspnbhgdchlx44xqxl170v1im5ggxwavcaq";
      type = "gem";
    };
-    version = "6.8.2";
+    version = "7.13.3";
  };
  elasticsearch-api = {
    dependencies = ["multi_json"];
@ -1300,10 +1300,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "12rjfamnqspvkjs90bvpa5zs7g0nlr9pvlvj228mj71k5pym1x8p";
+      sha256 = "0bmssarkk7lqkjdn8c9j7jvxcnn4hg1zcmhsky8bfvc99k33b3w8";
      type = "gem";
    };
-    version = "6.8.2";
+    version = "7.13.3";
  };
  elasticsearch-model = {
    dependencies = ["activesupport" "elasticsearch" "hashie"];
@ -1311,20 +1311,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1q66mp28696qnr6xgsl1dym2l5wk4j2ifd673r09yi70hn9y5ji8";
+      sha256 = "1ivcz5pcrp0760j26590bm3jvwc8548wcy7z7v2274k18l583h9c";
      type = "gem";
    };
-    version = "6.1.1";
+    version = "7.2.0";
  };
  elasticsearch-rails = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "06k97w4xdkdj982b2mgz4bv0gvkpbscn4wxsrqj6kr1x7dxia394";
+      sha256 = "1r2nh6csdlbfk5hqq5qbvvw1kvv6qa382alil2ixjn33jl7dql07";
      type = "gem";
    };
-    version = "6.1.1";
+    version = "7.2.1";
  };
  elasticsearch-transport = {
    dependencies = ["faraday" "multi_json"];
@ -1332,10 +1332,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "02z7b26vl0wmvkzy10qp530vx5c7pdv2ynfsd7mc5qmz6m0z5pxp";
+      sha256 = "0blfii8qvj0m6bg9sbfynxc40in7zfmw2wpi4clv7d9gclk053db";
      type = "gem";
    };
-    version = "6.8.2";
+    version = "7.13.3";
  };
  email_reply_trimmer = {
    groups = ["default"];
@ -1484,15 +1484,15 @@
    version = "6.2.0";
  };
  faraday = {
-    dependencies = ["faraday-em_http" "faraday-em_synchrony" "faraday-excon" "faraday-net_http" "faraday-net_http_persistent" "multipart-post" "ruby2_keywords"];
+    dependencies = ["faraday-em_http" "faraday-em_synchrony" "faraday-excon" "faraday-httpclient" "faraday-multipart" "faraday-net_http" "faraday-net_http_persistent" "faraday-patron" "faraday-rack" "faraday-retry" "ruby2_keywords"];
    groups = ["danger" "default" "development" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "07mhk70gv453pg38md346470hknyhipdqppnplq706ll3k3lzb7v";
+      sha256 = "00palwawk897p5gypw5wjrh93d4p0xz2yl9w93yicb4kq7amh8d4";
      type = "gem";
    };
-    version = "1.4.2";
+    version = "1.10.0";
  };
  faraday-cookie_jar = {
    dependencies = ["faraday" "http-cookie"];
@ -1546,6 +1546,27 @@
    };
    version = "2.2.0";
  };
+  faraday-httpclient = {
+    groups = ["danger" "default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0fyk0jd3ks7fdn8nv3spnwjpzx2lmxmg2gh4inz3by1zjzqg33sc";
+      type = "gem";
+    };
+    version = "1.0.1";
+  };
+  faraday-multipart = {
+    dependencies = ["multipart-post"];
+    groups = ["danger" "default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "03qfi9020ynf7hkdiaq01sd2mllvw7fg4qiin3pk028b4wv23j3j";
+      type = "gem";
+    };
+    version = "1.0.3";
+  };
  faraday-net_http = {
    groups = ["danger" "default" "development" "test"];
    platforms = [];
@ -1561,10 +1582,40 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0l2c835wl7gv34xp49fhd1bl4czkpw2g3ahqsak2251iqv5589ka";
+      sha256 = "0dc36ih95qw3rlccffcb0vgxjhmipsvxhn6cw71l7ffs0f7vq30b";
      type = "gem";
    };
-    version = "1.1.0";
+    version = "1.2.0";
+  };
+  faraday-patron = {
+    groups = ["danger" "default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "19wgsgfq0xkski1g7m96snv39la3zxz6x7nbdgiwhg5v82rxfb6w";
+      type = "gem";
+    };
+    version = "1.0.0";
+  };
+  faraday-rack = {
+    groups = ["danger" "default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1h184g4vqql5jv9s9im6igy00jp6mrah2h14py6mpf9bkabfqq7g";
+      type = "gem";
+    };
+    version = "1.0.0";
+  };
+  faraday-retry = {
+    groups = ["danger" "default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "153i967yrwnswqgvnnajgwp981k9p50ys1h80yz3q94rygs59ldd";
+      type = "gem";
+    };
+    version = "1.0.3";
  };
  faraday_middleware = {
    dependencies = ["faraday"];
@ -1572,10 +1623,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0jik2kgfinwnfi6fpp512vlvs0mlggign3gkbpkg5fw1jr9his0r";
+      sha256 = "1bw8mfh4yin2xk7138rg3fhb2p5g2dlmdma88k82psah9mbmvlfy";
      type = "gem";
    };
-    version = "1.0.0";
+    version = "1.2.0";
  };
  faraday_middleware-aws-sigv4 = {
    dependencies = ["aws-sigv4" "faraday"];
@ -2251,10 +2302,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "04c32rcn3j4d8sh039lkdfzn8xpifsbpsp7f90vlp2s531wbs16a";
+      sha256 = "14pjw0hd9rmfc687yj1cfd8jjy8gh7k6zn6w9syvcl1f2hb98b0g";
      type = "gem";
    };
-    version = "0.4.0";
+    version = "0.5.0";
  };
  graphql = {
    groups = ["default" "development" "test"];
@ -2272,10 +2323,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0g971rccyrs3rk8812r6az54p28g66m4ngdcbszg31mvddjaqkr4";
+      sha256 = "0pgb1r4vkyrq8hzhkii48hn7cdlkmnrswzjsl0xqxg1diz705bss";
      type = "gem";
    };
-    version = "0.16.0";
+    version = "0.17.0";
  };
  graphql-docs = {
    dependencies = ["commonmarker" "escape_utils" "extended-markdown-filter" "gemoji" "graphql" "html-pipeline" "sass"];
@ -2623,10 +2674,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1r1pl4imiqi75bksh17r2j3w74x561z4bx1mpgv6cin1fcrzw9zy";
+      sha256 = "0bm7k1lga4jmbi7fx373npbi0smm7jkhhpvnh7jrjawnjmfii1bz";
      type = "gem";
    };
-    version = "0.4.5";
+    version = "0.4.7";
  };
  jaeger-client = {
    dependencies = ["opentracing" "thrift"];
@ -3175,10 +3226,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1lva6bkvb4mfa0m3bqn4lm4s4gi81c40jvdcsrxr6vng49q9daih";
+      sha256 = "1i0gbypr1yxwfkaxzrk0i1wz4n6v3mw7z24k65jy3q1h5lda5xbw";
      type = "gem";
    };
-    version = "1.3.3";
+    version = "1.5.1";
  };
  multi_json = {
    groups = ["default"];
@ -3572,28 +3623,6 @@
    };
    version = "0.6.0";
  };
-  omniauth-kerberos = {
-    dependencies = ["omniauth-multipassword" "timfel-krb5-auth"];
-    groups = ["kerberos"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "05xsv76qjxcxzrvabaar2bchv7435y8l2j0wk4zgchh3yv85kiq7";
-      type = "gem";
-    };
-    version = "0.3.0";
-  };
-  omniauth-multipassword = {
-    dependencies = ["omniauth"];
-    groups = ["default" "kerberos"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0qykp76hw80lkgb39hyzrv68hkbivc8cv0vbvrnycjh9fwfp1lv8";
-      type = "gem";
-    };
-    version = "0.4.2";
-  };
  omniauth-oauth = {
    dependencies = ["oauth" "omniauth"];
    groups = ["default"];
@ -4558,10 +4587,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1d13g6kipqqc9lmwz5b244pdwc97z15vcbnbq6n9rlf32bipdz4k";
+      sha256 = "02i64ihazgm2dp07y89q1m9pyk724g5n9l83cy21x6snnzcg7xnj";
      type = "gem";
    };
-    version = "3.10.2";
+    version = "3.10.3";
  };
  rspec-parameterized = {
    dependencies = ["binding_ninja" "parser" "proc_to_ast" "rspec" "unparser"];
@ -4773,10 +4802,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "15wfcqxyfgka05v2a7kpg64x57gl1y4xzvnc9lh60bqx5sf1iqrs";
+      sha256 = "1vz322p8n39hz3b4a9gkmz9y7a5jaz41zrm2ywf31dvkqm03glgz";
      type = "gem";
    };
-    version = "0.0.4";
+    version = "0.0.5";
  };
  ruby_parser = {
    dependencies = ["sexp_processor"];
--- a/pkgs/applications/virtualization/cloud-hypervisor/default.nix
+++ b/pkgs/applications/virtualization/cloud-hypervisor/default.nix
@ -2,19 +2,19 @@

 rustPlatform.buildRustPackage rec {
  pname = "cloud-hypervisor";
-  version = "23.0";
+  version = "23.1";

  src = fetchFromGitHub {
    owner = "cloud-hypervisor";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0gq23zhpl1rw8i3yv0f058lycsr078yfy8vkb5w382pifgrww1zh";
+    sha256 = "sha256-Pyocmj5cr2vOfeyRG3mBU11I3iXndUh3VifRSlnjoE8=";
  };

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ openssl ] ++ lib.optional stdenv.isAarch64 dtc;

-  cargoSha256 = "0r3r6r5scbw23ipz24glcyvaxx9sffy8kp27fpqvwdha915c1zkp";
+  cargoSha256 = "1rx4d38d0ajdq3qs638gmagmj3f9j29i5mhrrzw039mggahjbksw";

  OPENSSL_NO_VENDOR = true;

--- a/pkgs/data/fonts/pretendard/default.nix
+++ b/pkgs/data/fonts/pretendard/default.nix
@ -0,0 +1,46 @@
+{ lib, fetchzip }:
+
+let
+  version = "1.3.0";
+
+  mkPretendard = { pname, typeface, sha256 }:
+    fetchzip {
+      name = "${pname}-${version}";
+
+      url = "https://github.com/orioncactus/pretendard/releases/download/v${version}/${typeface}-${version}.zip";
+      inherit sha256;
+
+      postFetch = ''
+        mkdir -p $out/share/fonts/opentype
+        unzip -j $downloadedFile "*.otf" -d $out/share/fonts/opentype
+      '';
+
+      meta = with lib; {
+        homepage = "https://github.com/orioncactus/pretendard";
+        description = "An alternative font to system-ui for all platforms";
+        license = licenses.ofl;
+        platforms = platforms.all;
+        maintainers = with maintainers; [ sudosubin ];
+      };
+    };
+
+in
+{
+  pretendard = mkPretendard {
+    pname = "pretendard";
+    typeface = "Pretendard";
+    sha256 = "sha256-4DM8PZjxW93sgQChs+qu5Svo+iGlFnpglu6acYMCkSQ=";
+  };
+
+  pretendard-jp = mkPretendard {
+    pname = "pretendard-jp";
+    typeface = "PretendardJP";
+    sha256 = "sha256-3OOUUDiurCpIGNIVjrr2KW0CB3fCXt11P+13teK5kOQ=";
+  };
+
+  pretendard-std = mkPretendard {
+    pname = "pretendard-std";
+    typeface = "PretendardStd";
+    sha256 = "sha256-iVAPdA6qAiE7pseaB0NKPJBPNGdw/nT6PzXIsLajJH4=";
+  };
+}
--- a/pkgs/development/interpreters/spidermonkey/91.nix
+++ b/pkgs/development/interpreters/spidermonkey/91.nix
@ -1,20 +1,24 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
-, pkg-config
+
+# build time
+, buildPackages
+, cargo
+, m4
 , perl
+, pkg-config
 , python3
-, zip
-, buildPackages
+, rust-cbindgen
+, rustc
 , which
+, zip
+
+# runtime
+, icu
+, nspr
 , readline
 , zlib
-, icu69
-, cargo
-, rustc
-, rust-cbindgen
-, yasm
-, nspr
-, m4
 }:

 stdenv.mkDerivation rec {
@ -31,20 +35,19 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [
    cargo
-    rustc.llvmPackages.llvm # for llvm-objdump
+    m4
    perl
    pkg-config
    python3
    rust-cbindgen
    rustc
+    rustc.llvmPackages.llvm # for llvm-objdump
    which
-    yasm # to buid icu? seems weird
    zip
-    m4
  ];

  buildInputs = [
-    icu69
+    icu
    nspr
    readline
    zlib
--- a/pkgs/development/interpreters/wasmtime/default.nix
+++ b/pkgs/development/interpreters/wasmtime/default.nix
@ -1,24 +1,24 @@
-{ rustPlatform, fetchFromGitHub, lib, v8 }:
+{ rustPlatform, fetchFromGitHub, lib, stdenv, v8 }:

 rustPlatform.buildRustPackage rec {
  pname = "wasmtime";
-  version = "0.36.0";
+  version = "0.37.0";

  src = fetchFromGitHub {
    owner = "bytecodealliance";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-nSA78eQRbJ5JTDquaRqRgFU0V8RVCzvWUONgHxGj+Mc=";
+    sha256 = "sha256-ZUr1v94If8ER4lTHLwuP+F3xfXU7IW4ZEztBA2TPvVg=";
    fetchSubmodules = true;
  };

-  cargoSha256 = "sha256-/+uioJRXiugsV7SUwsDNHGaPxrxrhscQUGyXOzzwG/g=";
+  cargoSha256 = "sha256-X+KDeWavFTBaxbSPlIiyuiBC7wg1/5C/NXp+VEY8Mk8=";

  # This environment variable is required so that when wasmtime tries
  # to run tests by using the rusty_v8 crate, it does not try to
  # download a static v8 build from the Internet, what would break
  # build hermetism.
-  RUSTY_V8_ARCHIVE = "${v8}/lib/libv8.a";
+  RUSTY_V8_ARCHIVE = lib.optionalString stdenv.isLinux "${v8}/lib/libv8.a";

  doCheck = true;
  checkFlags = [
@ -36,6 +36,6 @@ rustPlatform.buildRustPackage rec {
    homepage = "https://github.com/bytecodealliance/wasmtime";
    license = licenses.asl20;
    maintainers = [ maintainers.matthewbauer ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/development/libraries/menu-cache/default.nix
+++ b/pkgs/development/libraries/menu-cache/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, glib, pkg-config, libfm-extra }:
+{ lib, stdenv, fetchurl, fetchpatch, glib, pkg-config, libfm-extra }:

 stdenv.mkDerivation rec {
  pname = "menu-cache";
@ -9,6 +9,16 @@ stdenv.mkDerivation rec {
    sha256 = "1iry4zlpppww8qai2cw4zid4081hh7fz8nzsp5lqyffbkm2yn0pd";
  };

+  patches = [
+    # Pull patch pending upstream inclusion for -fno-common toolchain support:
+    #   https://github.com/lxde/menu-cache/pull/19
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://github.com/lxde/menu-cache/commit/1ce739649b4d66339a03fc0ec9ee7a2f7c141780.patch";
+      sha256 = "08x3h0w2pl8ifj83v9jkf4j3zxcwsyzh251divlhhnwx0rw1pyn7";
+    })
+  ];
+
  nativeBuildInputs = [ pkg-config ];

  buildInputs = [ glib libfm-extra ];
--- a/pkgs/development/libraries/qt-5/modules/qtspeech.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtspeech.nix
@ -1,7 +1,9 @@
-{ qtModule }:
+{ qtModule, speechd, pkg-config }:

 qtModule {
  pname = "qtspeech";
  qtInputs = [ ];
+  buildInputs = [ speechd ];
+  nativeBuildInputs = [ pkg-config ];
  outputs = [ "out" "dev" ];
 }
--- a/pkgs/development/ocaml-modules/gd4o/default.nix
+++ b/pkgs/development/ocaml-modules/gd4o/default.nix
@ -0,0 +1,36 @@
+{ lib, stdenv, fetchurl, ocaml, gd, freetype, findlib, zlib, libpng, libjpeg }:
+
+stdenv.mkDerivation rec {
+  pname = "ocaml${ocaml.version}-gd4o";
+  version = "1.0a5";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/gd4o/gd4o/1.0%20Alpha%205/gd4o-1.0a5.tar.gz";
+    sha256 = "1vbyakz7byvxmqf3hj68rw15b4kb94ppcnhvmjv38rsyg05bc47s";
+  };
+
+  buildInputs = [ ocaml findlib libjpeg libpng ];
+  propagatedBuildInputs = [ gd zlib freetype ];
+
+
+  preInstall = ''
+    mkdir -p $OCAMLFIND_DESTDIR/stublibs
+  '';
+
+  buildFlags = [ "all" "opt" ];
+
+  checkPhase = ''
+    runHook preCheck
+    make test.opt
+    runHook postCheck
+  '';
+
+  doCheck = true;
+
+  meta = with lib; {
+    homepage = "https://sourceforge.net/projects/gd4o/";
+    description = "OCaml wrapper for the GD graphics library";
+    license = licenses.lgpl21Only;
+    maintainers = with maintainers; [ dandellion ];
+  };
+}
--- a/pkgs/development/ocaml-modules/irmin-watcher/default.nix
+++ b/pkgs/development/ocaml-modules/irmin-watcher/default.nix
@ -4,13 +4,13 @@

 buildDunePackage rec {
  pname = "irmin-watcher";
-  version = "0.4.1";
+  version = "0.5.0";

  useDune2 = true;

  src = fetchurl {
    url = "https://github.com/mirage/irmin-watcher/releases/download/${version}/irmin-watcher-${version}.tbz";
-    sha256 = "00d4ph4jbsw6adp3zqdrwi099hfcf7p1xzi0685qr7bgcmandjfv";
+    sha256 = "sha256-vq4kwaz4QUG9x0fGEbQMAuDGjlT3/6lm8xiXTUqJmZM=";
  };

  propagatedBuildInputs = [ astring fmt logs ocaml_lwt ];
--- a/pkgs/development/ocaml-modules/ppx_cstubs/default.nix
+++ b/pkgs/development/ocaml-modules/ppx_cstubs/default.nix
@ -14,7 +14,7 @@

 buildDunePackage rec {
  pname = "ppx_cstubs";
-  version = "0.6.1.2";
+  version = "0.7.0";

  minimalOCamlVersion = "4.08";

@ -24,7 +24,7 @@ buildDunePackage rec {
    owner = "fdopen";
    repo = "ppx_cstubs";
    rev = version;
-    sha256 = "15cjb9ygnvp2kv85rrb7ncz7yalifyl7wd2hp2cl8r1qrpgi1d0w";
+    sha256 = "sha256-qMmwRWCIfNyhCQYPKLiufnb57sTR3P+WInOqtPDywFs=";
  };

  nativeBuildInputs = [ cppo findlib ];
--- a/pkgs/development/python-modules/amaranth/default.nix
+++ b/pkgs/development/python-modules/amaranth/default.nix
@ -57,6 +57,10 @@ buildPythonPackage rec {
    substituteInPlace setup.py \
      --replace "Jinja2~=2.11" "Jinja2>=2.11" \
      --replace "pyvcd~=0.2.2" "pyvcd"
+
+    # jinja2.contextfunction was removed in jinja2 v3.1
+    substituteInPlace amaranth/build/plat.py \
+      --replace "@jinja2.contextfunction" "@jinja2.pass_context"
  '';

  pythonImportsCheck = [ "amaranth" ];
--- a/pkgs/development/python-modules/embrace/default.nix
+++ b/pkgs/development/python-modules/embrace/default.nix
@ -1,21 +1,40 @@
-{ stdenv, lib, buildPythonPackage, fetchFromSourcehut,
-  sqlparse, wrapt, pytestCheckHook }:
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchFromSourcehut
+, pytestCheckHook
+, pythonOlder
+, sqlparse
+, wrapt
+}:

 buildPythonPackage rec {
  pname = "embrace";
  version = "4.1.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchFromSourcehut {
    vc = "hg";
    owner = "~olly";
    repo = "embrace-sql";
    rev = "v${version}-release";
-    sha256 = "sha256-R6Ug4f8KFZNzaNWqWZkLvOwtsawCuerzvHlysr7bd6M=";
+    hash = "sha256-R6Ug4f8KFZNzaNWqWZkLvOwtsawCuerzvHlysr7bd6M=";
  };

-  propagatedBuildInputs = [ sqlparse wrapt ];
-  checkInputs = [ pytestCheckHook ];
-  pythonImportsCheck = [ "embrace" ];
+  propagatedBuildInputs = [
+    sqlparse
+    wrapt
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "embrace"
+  ];

  # Some test for hot-reload fails on Darwin, but the rest of the library
  # should remain usable. (https://todo.sr.ht/~olly/embrace-sql/4)
--- a/pkgs/development/python-modules/faraday-plugins/default.nix
+++ b/pkgs/development/python-modules/faraday-plugins/default.nix
@ -16,14 +16,14 @@

 buildPythonPackage rec {
  pname = "faraday-plugins";
-  version = "1.6.5";
+  version = "1.6.6";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "infobyte";
    repo = "faraday_plugins";
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-mzzUbUBlzOyFpDaoUwwjxC3dqbheLWAt8gXrIH0XXss=";
+    sha256 = "sha256-clhWUKpX4q3aXq7HrrGPda+qjPD/GuPS7PRZ7c4xxxI=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/fontparts/default.nix
+++ b/pkgs/development/python-modules/fontparts/default.nix
@ -6,13 +6,13 @@

 buildPythonPackage rec {
  pname = "fontParts";
-  version = "0.10.4";
+  version = "0.10.5";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1ic453q86s5hsw8mxnclk1vr4qp69fd67gywhv23zqwz9a7kb7lh";
+    sha256 = "sha256-VriGYcpd2uVDMXeF3DXGKCMRQ9pTjDkrUOt2YSUgd5M=";
    extension = "zip";
  };

--- a/pkgs/development/python-modules/greeclimate/default.nix
+++ b/pkgs/development/python-modules/greeclimate/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "greeclimate";
-  version = "1.1.1";
+  version = "1.2.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "cmroche";
    repo = "greeclimate";
    rev = "refs/tags/v${version}";
-    hash = "sha256-TFsuzw9twhoGrgOnTNSmYWqsUW4oqY+SGvrvPUT4tZY=";
+    hash = "sha256-DRVCBbGj0NfQBn9qNRc0Gu3LNO6KDNF1/ZdSAuhCVsM=";
  };

  propagatedBuildInputs = [
@ -43,6 +43,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Discover, connect and control Gree based minisplit systems";
    homepage = "https://github.com/cmroche/greeclimate";
+    changelog = "https://github.com/cmroche/greeclimate/blob/${src.rev}/CHANGELOG.md";
    license = licenses.gpl3Only;
    maintainers = with maintainers; [ dotlambda ];
  };
--- a/pkgs/development/python-modules/jwcrypto/default.nix
+++ b/pkgs/development/python-modules/jwcrypto/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "jwcrypto";
-  version = "1.3";
+  version = "1.3.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-DWRhuhP3wnHYusUBjuYN28rl/zlAP6+kI3X1fQjjmLs=";
+    hash = "sha256-VLVRsRX/tNErHx7pO4uipxu4VWuj2F1i9wdUlhPah3w=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/nbxmpp/default.nix
+++ b/pkgs/development/python-modules/nbxmpp/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "nbxmpp";
-  version = "2.0.6";
+  version = "3.0.2";

  disabled = pythonOlder "3.7";

@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "gajim";
    repo = "python-nbxmpp";
    rev = "nbxmpp-${version}";
-    sha256 = "sha256:03iydz0r9m8559srawwnhaqzqm9liwrnc8v6abj4w3m1lil32bid";
+    sha256 = "sha256:0wvganymqw90y9mz5a5mh531r2s9z0vrkbfspx5akk98syaq6f5p";
  };

  buildInputs = [
--- a/pkgs/development/python-modules/pybullet/default.nix
+++ b/pkgs/development/python-modules/pybullet/default.nix
@ -8,11 +8,11 @@

 buildPythonPackage rec {
  pname = "pybullet";
-  version = "3.2.4";
+  version = "3.2.5";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-lZ6FvABRMkucSroj15Nlt33iFvnO68OS+dVR/mOg68Y=";
+    sha256 = "sha256-G8ua+4eghr4bLeGPCE0f2rgZTaG/cfJkdDyia6o5w1E=";
  };

  buildInputs = [
--- a/pkgs/development/python-modules/ssh-mitm/default.nix
+++ b/pkgs/development/python-modules/ssh-mitm/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "ssh-mitm";
-  version = "2.0.1";
+  version = "2.0.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = pname;
    repo = pname;
    rev = version;
-    hash = "sha256-90ja1xckGC5W0A6xqeTOlR46QhONxGt4PLlue24DWX0=";
+    hash = "sha256-cFahID4+PMQPG/pDAR0bU5MZAa8LsNiirxrzGi2c/EE=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/watchdog/default.nix
+++ b/pkgs/development/python-modules/watchdog/default.nix
@ -12,12 +12,12 @@

 buildPythonPackage rec {
  pname = "watchdog";
-  version = "2.1.7";
+  version = "2.1.8";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-P9R4FTU76cRO68lMwo/iaysMW9iJ2vxKWny9+SQUNIA=";
+    sha256 = "sha256-bQMUkSaGSr0ycV1OkmfSdUzt4lppBSkBOZNWrTvF7P8=";
  };

  buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
--- a/pkgs/development/python-modules/yappi/default.nix
+++ b/pkgs/development/python-modules/yappi/default.nix
@ -2,24 +2,28 @@
 , buildPythonPackage
 , fetchFromGitHub
 , gevent
-, isPy27
 , python
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "yappi";
-  version = "1.3.2";
+  version = "1.3.5";
+  format = "setuptools";

-  disabled = isPy27; # invalid syntax
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "sumerc";
    repo = pname;
-    rev = "8bf7a650066f104f59c3cae4a189ec15e7d51c8c";
-    sha256 = "1q8lr9n0lny2g3mssy3mksbl9m4k1kqn1a4yv1hfqsahxdvpw2dp";
+    # https://github.com/sumerc/yappi/issues/102
+    rev = "1f41868a2cdfd1e935a5a60808f7bb09c871fa53";
+    hash = "sha256-XxUAYrDQAY7fD9yTSmoRUmWJEs+L6KSQ0/bIVf/o9ag=";
  };

-  patches = [ ./tests.patch ];
+  patches = [
+    ./tests.patch
+  ];

  checkInputs = [
    gevent
@ -34,8 +38,8 @@ buildPythonPackage rec {
  ];

  meta = with lib; {
-    homepage = "https://github.com/sumerc/yappi";
    description = "Python profiler that supports multithreading and measuring CPU time";
+    homepage = "https://github.com/sumerc/yappi";
    license = licenses.mit;
    maintainers = with maintainers; [ orivej ];
  };
--- a/pkgs/development/tools/jtc/default.nix
+++ b/pkgs/development/tools/jtc/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch }:

 stdenv.mkDerivation rec {
  pname = "jtc";
@ -11,6 +11,14 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-VATRlOOV4wBInLOm9J0Dp2vhtL5mb0Yxdl/ya0JiqEU=";
  };

+  patches = [
+    # Fix building with Clang. Removing with next release.
+    (fetchpatch {
+      url = "https://github.com/ldn-softdev/jtc/commit/92a5116e5524c0b6d2f539db7b5cc9fdd7c5b8ab.patch";
+      sha256 = "sha256-AAvDH0XsT8/CAguG611/odg0m1HR+veC0jbAw6KLHLM=";
+    })
+  ];
+
  buildPhase = ''
    runHook preBuild

--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@ -1,6 +1,10 @@
-{ lib, stdenv, fetchurl, pkg-config, zlib, shadow, libcap_ng
+{ lib, stdenv, fetchurl, pkg-config, zlib, shadow
+, capabilitiesSupport ? true
+, libcap_ng
 , ncursesSupport ? true
-, ncurses, pam
+, ncurses
+, pamSupport ? true
+, pam
 , systemdSupport ? stdenv.isLinux && !stdenv.hostPlatform.isStatic
 , systemd
 , nlsSupport ? true
@ -59,7 +63,9 @@ stdenv.mkDerivation rec {
  ];

  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ zlib pam libcap_ng ]
+  buildInputs = [ zlib ]
+    ++ lib.optionals pamSupport [ pam ]
+    ++ lib.optionals capabilitiesSupport [ libcap_ng ]
    ++ lib.optionals ncursesSupport [ ncurses ]
    ++ lib.optionals systemdSupport [ systemd ];

--- a/pkgs/tools/X11/setroot/default.nix
+++ b/pkgs/tools/X11/setroot/default.nix
@ -1,9 +1,7 @@
-{ lib, stdenv, fetchFromGitHub, libX11, imlib2
-, enableXinerama ? true, libXinerama ? null
+{ lib, stdenv, fetchFromGitHub, libX11, imlib2, pkg-config, fetchpatch
+, enableXinerama ? true, libXinerama
 }:

-assert enableXinerama -> libXinerama != null;
-
 stdenv.mkDerivation rec {
  version = "2.0.2";
  pname = "setroot";
@ -15,12 +13,21 @@ stdenv.mkDerivation rec {
    sha256 = "0w95828v0splk7bj5kfacp4pq6wxpyamvyjmahyvn5hc3ycq21mq";
  };

+  patches = [
+    (fetchpatch {
+      url = "https://github.com/ttzhou/setroot/commit/d8ff8edd7d7594d276d741186bf9ccf0bce30277.patch";
+      sha256 = "sha256-e0iMSpiOmTOpQnp599fjH2UCPU4Oq1VKXcVypVoR9hw=";
+    })
+  ];
+
+  nativeBuildInputs = [ pkg-config ];
+
  buildInputs = [ libX11 imlib2 ]
-    ++ lib.optional enableXinerama libXinerama;
+    ++ lib.optionals enableXinerama [ libXinerama ];

-  buildFlags = [ "CC=${stdenv.cc.targetPrefix}cc" (if enableXinerama then "xinerama=1" else "xinerama=0") ] ;
+  buildFlags = [ (if enableXinerama then "xinerama=1" else "xinerama=0") ] ;

-  installFlags = [ "DESTDIR=$(out)" "PREFIX=" ];
+  installFlags = [ "PREFIX=$(out)" ];

  meta = with lib; {
    description = "Simple X background setter inspired by imlibsetroot and feh";
--- a/pkgs/tools/misc/snore/default.nix
+++ b/pkgs/tools/misc/snore/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch }:

 stdenv.mkDerivation rec {
  version = "0.2";
@ -11,6 +11,14 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-EOwbRqtQEuGZ+aeCBNVfLUq4m/bFWJTvMDM6a+y74qc=";
  };

+  patches = [
+    # Fix POSIX_C_SOURCE macro. Remove with the next release.
+    (fetchpatch {
+      url = "https://github.com/clamiax/snore/commit/284e5aa56e775803d24879954136401a106aa063.patch";
+      sha256 = "sha256-len8E8h9CXC25WB2lmnLLJ0PR903tgllDh9K2RqzQk0=";
+    })
+  ];
+
  makeFlags = [ "PREFIX=${placeholder "out"}" ];

  meta = with lib; {
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -24807,6 +24807,11 @@ with pkgs;

  poppler_data = callPackage ../data/misc/poppler-data { };

+  inherit (callPackages ../data/fonts/pretendard { })
+    pretendard
+    pretendard-jp
+    pretendard-std;
+
  quattrocento = callPackage ../data/fonts/quattrocento {};

  quattrocento-sans = callPackage ../data/fonts/quattrocento-sans {};
@ -30252,6 +30257,7 @@ with pkgs;
  wrapNeovimUnstable = callPackage ../applications/editors/neovim/wrapper.nix { };
  wrapNeovim = neovim-unwrapped: lib.makeOverridable (neovimUtils.legacyWrapper neovim-unwrapped);
  neovim-unwrapped = callPackage ../applications/editors/neovim {
+    CoreServices =  darwin.apple_sdk.frameworks.CoreServices;
    lua = luajit;
  };

--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@ -450,6 +450,8 @@ let

    functory = callPackage ../development/ocaml-modules/functory { };

+    gd4o = callPackage ../development/ocaml-modules/gd4o { };
+
    gen = callPackage ../development/ocaml-modules/gen { };

    genspio = callPackage ../development/ocaml-modules/genspio { };