Merge pull request #104781 from NixOS/staging-next

Staging next

nixos/doc/manual/release-notes/rl-2103.xml

@@ -336,6 +336,19 @@
      <literal>unbound-control</literal> without passing a custom configuration location.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     NixOS now defaults to the unified cgroup hierarchy (cgroupsv2).
+     See the <link xlink:href="https://www.redhat.com/sysadmin/fedora-31-control-group-v2">Fedora Article for 31</link>
+     for details on why this is desirable, and how it impacts containers.
+    </para>
+    <para>
+     If you want to run containers with a runtime that does not yet support cgroupsv2,
+     you can switch back to the old behaviour by setting
+     <xref linkend="opt-systemd.enableUnifiedCgroupHierarchy"/> = <literal>false</literal>;
+     and rebooting.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 </section>

nixos/modules/security/hidepid.nix

@@ -23,5 +23,9 @@ with lib;
 
     boot.specialFileSystems."/proc".options = [ "hidepid=2" "gid=${toString config.ids.gids.proc}" ];
     systemd.services.systemd-logind.serviceConfig.SupplementaryGroups = [ "proc" ];
+
+    # Disable cgroupsv2, which doesn't work with hidepid.
+    # https://github.com/NixOS/nixpkgs/pull/104094#issuecomment-729996203
+    systemd.enableUnifiedCgroupHierarchy = false;
   };
 }

nixos/modules/services/cluster/k3s/default.nix

@@ -76,6 +76,10 @@ in
       enable = mkDefault true;
     };
 
+    # TODO: disable this once k3s supports cgroupsv2, either by docker
+    # supporting it, or their bundled containerd
+    systemd.enableUnifiedCgroupHierarchy = false;
+
     systemd.services.k3s = {
       description = "k3s service";
       after = mkIf cfg.docker [ "docker.service" ];

nixos/modules/system/boot/systemd.nix

@@ -550,6 +550,14 @@ in
       '';
     };
 
+    systemd.enableUnifiedCgroupHierarchy = mkOption {
+      default = true;
+      type = types.bool;
+      description = ''
+        Whether to enable the unified cgroup hierarchy (cgroupsv2).
+      '';
+    };
+
     systemd.coredump.enable = mkOption {
       default = true;
       type = types.bool;
@@ -1178,6 +1186,7 @@ in
     boot.kernel.sysctl = mkIf (!cfg.coredump.enable) {
       "kernel.core_pattern" = "core";
     };
+    boot.kernelParams = optional (!cfg.enableUnifiedCgroupHierarchy) "systemd.unified_cgroup_hierarchy=0";
   };
 
   # FIXME: Remove these eventually.

nixos/modules/virtualisation/docker.nix

@@ -155,6 +155,9 @@ in
       users.groups.docker.gid = config.ids.gids.docker;
       systemd.packages = [ cfg.package ];
 
+      # TODO: remove once docker 20.10 is released
+      systemd.enableUnifiedCgroupHierarchy = false;
+
       systemd.services.docker = {
         wantedBy = optional cfg.enableOnBoot "multi-user.target";
         environment = proxy_env;

nixos/tests/podman.nix

@@ -34,7 +34,6 @@ import ./make-test-python.nix (
       podman.wait_for_unit("sockets.target")
       start_all()
 
-
       with subtest("Run container as root with runc"):
           podman.succeed("tar cv --files-from /dev/null | podman import - scratchimg")
           podman.succeed(
@@ -53,22 +52,32 @@ import ./make-test-python.nix (
           podman.succeed("podman stop sleeping")
           podman.succeed("podman rm sleeping")
 
-      with subtest("Run container rootless with runc"):
+      with subtest("Run container as root with the default backend"):
+          podman.succeed("tar cv --files-from /dev/null | podman import - scratchimg")
+          podman.succeed(
+              "podman run -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
+          )
+          podman.succeed("podman ps | grep sleeping")
+          podman.succeed("podman stop sleeping")
+          podman.succeed("podman rm sleeping")
+
+      with subtest("Run container rootless with crun"):
           podman.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg"))
           podman.succeed(
               su_cmd(
-                  "podman run --runtime=runc -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
+                  "podman run --runtime=crun -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
               )
           )
           podman.succeed(su_cmd("podman ps | grep sleeping"))
           podman.succeed(su_cmd("podman stop sleeping"))
           podman.succeed(su_cmd("podman rm sleeping"))
+      # As of 2020-11-20, the runc backend doesn't work with cgroupsv2 yet, so we don't run that test.
 
-      with subtest("Run container rootless with crun"):
+      with subtest("Run container rootless with the default backend"):
           podman.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg"))
           podman.succeed(
               su_cmd(
-                  "podman run --runtime=crun -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
+                  "podman run -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
               )
           )
           podman.succeed(su_cmd("podman ps | grep sleeping"))

nixos/tests/systemd.nix

@@ -82,6 +82,10 @@ import ./make-test-python.nix ({ pkgs, ... }: {
             "systemd-run --pty --property=Type=oneshot --property=DynamicUser=yes --property=User=iamatest whoami"
         )
 
+    with subtest("regression test for https://bugs.freedesktop.org/show_bug.cgi?id=77507"):
+        retcode, output = machine.execute("systemctl status testservice1.service")
+        assert retcode in [0, 3]  # https://bugs.freedesktop.org/show_bug.cgi?id=77507
+
     # Regression test for https://github.com/NixOS/nixpkgs/issues/35268
     with subtest("file system with x-initrd.mount is not unmounted"):
         machine.succeed("mountpoint -q /test-x-initrd-mount")
@@ -122,17 +126,6 @@ import ./make-test-python.nix ({ pkgs, ... }: {
         machine.wait_for_unit("multi-user.target")
         assert "fq_codel" in machine.succeed("sysctl net.core.default_qdisc")
 
-    # Test cgroup accounting is enabled
-    with subtest("systemd cgroup accounting is enabled"):
-        machine.wait_for_unit("multi-user.target")
-        assert "yes" in machine.succeed(
-            "systemctl show testservice1.service -p IOAccounting"
-        )
-
-        retcode, output = machine.execute("systemctl status testservice1.service")
-        assert retcode in [0, 3]  # https://bugs.freedesktop.org/show_bug.cgi?id=77507
-        assert "CPU:" in output
-
     # Test systemd is configured to manage a watchdog
     with subtest("systemd manages hardware watchdog"):
         machine.wait_for_unit("multi-user.target")
@@ -168,5 +161,25 @@ import ./make-test-python.nix ({ pkgs, ... }: {
         machine.succeed("systemctl status systemd-cryptsetup@luks1.service")
         machine.succeed("mkdir -p /tmp/luks1")
         machine.succeed("mount /dev/mapper/luks1 /tmp/luks1")
+
+    # Do some IP traffic
+    output_ping = machine.succeed(
+        "systemd-run --wait -- /run/wrappers/bin/ping -c 1 127.0.0.1 2>&1"
+    )
+
+    with subtest("systemd reports accounting data on system.slice"):
+        output = machine.succeed("systemctl status system.slice")
+        assert "CPU:" in output
+        assert "Memory:" in output
+
+        assert "IP:" in output
+        assert "0B in, 0B out" not in output
+
+        assert "IO:" in output
+        assert "0B read, 0B written" not in output
+
+    with subtest("systemd per-unit accounting works"):
+        assert "IP traffic received: 84B" in output_ping
+        assert "IP traffic sent: 84B" in output_ping
   '';
 })

pkgs/build-support/setup-hooks/reproducible-builds.sh

@@ -0,0 +1,4 @@
+# Use the last part of the out path as hash input for the build.
+# This should ensure that it is deterministic across rebuilds of the same
+# derivation and not easily collide with other builds.
+export NIX_CFLAGS_COMPILE+=" -frandom-seed=${out##*/}"

pkgs/development/compilers/adoptopenjdk-bin/generate-sources.py

@@ -6,7 +6,7 @@ import re
 import requests
 import sys
 
-releases = ("openjdk8", "openjdk11", "openjdk13")
+releases = ("openjdk8", "openjdk11", "openjdk13", "openjdk14", "openjdk15")
 oses = ("mac", "linux")
 types = ("jre", "jdk")
 impls = ("hotspot", "openj9")

pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix

@@ -29,7 +29,7 @@ let result = stdenv.mkDerivation rec {
 
   buildInputs = [
     alsaLib freetype fontconfig zlib xorg.libX11 xorg.libXext xorg.libXtst
-    xorg.libXi xorg.libXrender
+    xorg.libXi xorg.libXrender stdenv.cc.cc.lib
   ] ++ lib.optional stdenv.isAarch32 libffi;
 
   nativeBuildInputs = [ autoPatchelfHook ];

pkgs/development/compilers/adoptopenjdk-bin/jdk14-darwin.nix

@@ -0,0 +1,9 @@
+let
+  sources = builtins.fromJSON (builtins.readFile ./sources.json);
+in
+{
+  jdk-hotspot = import ./jdk-darwin-base.nix sources.openjdk14.mac.jdk.hotspot;
+  jre-hotspot = import ./jdk-darwin-base.nix sources.openjdk14.mac.jre.hotspot;
+  jdk-openj9 = import ./jdk-darwin-base.nix sources.openjdk14.mac.jdk.openj9;
+  jre-openj9 = import ./jdk-darwin-base.nix sources.openjdk14.mac.jre.openj9;
+}

pkgs/development/compilers/adoptopenjdk-bin/jdk14-linux.nix

@@ -0,0 +1,9 @@
+let
+  sources = builtins.fromJSON (builtins.readFile ./sources.json);
+in
+{
+  jdk-hotspot = import ./jdk-linux-base.nix sources.openjdk14.linux.jdk.hotspot;
+  jre-hotspot = import ./jdk-linux-base.nix sources.openjdk14.linux.jre.hotspot;
+  jdk-openj9 = import ./jdk-linux-base.nix sources.openjdk14.linux.jdk.openj9;
+  jre-openj9 = import ./jdk-linux-base.nix sources.openjdk14.linux.jre.openj9;
+}

pkgs/development/compilers/adoptopenjdk-bin/jdk15-darwin.nix

@@ -0,0 +1,9 @@
+let
+  sources = builtins.fromJSON (builtins.readFile ./sources.json);
+in
+{
+  jdk-hotspot = import ./jdk-darwin-base.nix sources.openjdk15.mac.jdk.hotspot;
+  jre-hotspot = import ./jdk-darwin-base.nix sources.openjdk15.mac.jre.hotspot;
+  jdk-openj9 = import ./jdk-darwin-base.nix sources.openjdk15.mac.jdk.openj9;
+  jre-openj9 = import ./jdk-darwin-base.nix sources.openjdk15.mac.jre.openj9;
+}

pkgs/development/compilers/adoptopenjdk-bin/jdk15-linux.nix

@@ -0,0 +1,9 @@
+let
+  sources = builtins.fromJSON (builtins.readFile ./sources.json);
+in
+{
+  jdk-hotspot = import ./jdk-linux-base.nix sources.openjdk15.linux.jdk.hotspot;
+  jre-hotspot = import ./jdk-linux-base.nix sources.openjdk15.linux.jre.hotspot;
+  jdk-openj9 = import ./jdk-linux-base.nix sources.openjdk15.linux.jdk.openj9;
+  jre-openj9 = import ./jdk-linux-base.nix sources.openjdk15.linux.jre.openj9;
+}

pkgs/development/compilers/adoptopenjdk-bin/sources.json

@@ -4,92 +4,92 @@
       "jdk": {
         "hotspot": {
           "aarch64": {
-            "build": "10",
-            "sha256": "3b8b8bba6a0472ec7de5271cbf67f11e6ab525de6dd5d4729300375f1d56b7a1",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jdk_aarch64_linux_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "f90c6f941a95e20e305870700328804e5b48acb69d4928dc9c4627b3c755ae8a",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11.1/OpenJDK11U-jdk_aarch64_linux_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           },
           "armv6l": {
-            "build": "10",
-            "sha256": "45c235af67498f87e3dc99642771e57547cf226335eaee8a55d195173e66a2e9",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jdk_arm_linux_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "082a13a9a5fbcf7ca45e67ab39e9682a9ef9e3779395e37aa0bf235e42a8eaf5",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11/OpenJDK11U-jdk_arm_linux_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           },
           "armv7l": {
-            "build": "10",
-            "sha256": "45c235af67498f87e3dc99642771e57547cf226335eaee8a55d195173e66a2e9",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jdk_arm_linux_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "082a13a9a5fbcf7ca45e67ab39e9682a9ef9e3779395e37aa0bf235e42a8eaf5",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11/OpenJDK11U-jdk_arm_linux_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           },
           "packageType": "jdk",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "10",
-            "sha256": "ee60304d782c9d5654bf1a6b3f38c683921c1711045e1db94525a51b7024a2ca",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jdk_x64_linux_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "a3c52b73a76bed0f113604165eb4f2020b767e188704d8cc0bfc8bc4eb596712",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11.1/OpenJDK11U-jdk_x64_linux_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           }
         },
         "openj9": {
           "aarch64": {
-            "build": "10",
-            "sha256": "0be01fdcae330e26c489d8d0d0c98c535a2af8cbd0cdcda211776ab9fcd05086",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10_openj9-0.20.0/OpenJDK11U-jdk_aarch64_linux_openj9_11.0.7_10_openj9-0.20.0.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "f0426b6d37085d471a7f577ce6f28af7cc8fe35b9b0b09a5111eccaed80a0447",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11_openj9-0.23.0/OpenJDK11U-jdk_aarch64_linux_openj9_11.0.9_11_openj9-0.23.0.tar.gz",
+            "version": "11.0.9"
           },
           "packageType": "jdk",
           "vmType": "openj9",
           "x86_64": {
-            "build": "10",
-            "sha256": "526e89f3014fec473b24c10c2464c1343e23703114983fd171b68b1599bba561",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10_openj9-0.20.0/OpenJDK11U-jdk_x64_linux_openj9_11.0.7_10_openj9-0.20.0.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "812d58fac39465802039291a1bc530b4feaaa61b58664d9c458a075921ae8091",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11_openj9-0.23.0/OpenJDK11U-jdk_x64_linux_openj9_11.0.9_11_openj9-0.23.0.tar.gz",
+            "version": "11.0.9"
           }
         }
       },
       "jre": {
         "hotspot": {
           "aarch64": {
-            "build": "10",
-            "sha256": "cfe504e9e9621b831a5cfd800a2005dafe90a1d11aa14ee35d7b674d68685698",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jre_aarch64_linux_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "89b9b3108afda968a97961c5602a896bae31fea7c95195b54be5ad68b3af9e45",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11.1/OpenJDK11U-jre_aarch64_linux_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           },
           "armv6l": {
-            "build": "10",
-            "sha256": "581bae8efcaa40e209a780baa6f96b7c8c9397965bc6d54533f4fd8599d5c742",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jre_arm_linux_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "8e52de3c7a24edb74e423631fa90a09f7af3193aa9e6e4837b337192669530b0",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11/OpenJDK11U-jre_arm_linux_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           },
           "armv7l": {
-            "build": "10",
-            "sha256": "581bae8efcaa40e209a780baa6f96b7c8c9397965bc6d54533f4fd8599d5c742",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jre_arm_linux_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "8e52de3c7a24edb74e423631fa90a09f7af3193aa9e6e4837b337192669530b0",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11/OpenJDK11U-jre_arm_linux_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           },
           "packageType": "jre",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "10",
-            "sha256": "74b493dd8a884dcbee29682ead51b182d9d3e52b40c3d4cbb3167c2fd0063503",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jre_x64_linux_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "2ed263b662afb8b5d2964d1c9941d20031d07e5af68679ebefdca35d40bb91b1",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11.1/OpenJDK11U-jre_x64_linux_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           }
         },
         "openj9": {
           "aarch64": {
-            "build": "10",
-            "sha256": "37ae26443abb02d2ab041eced9be948f0d20db03183aaf3c159ef682eeeabf9b",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10_openj9-0.20.0/OpenJDK11U-jre_aarch64_linux_openj9_11.0.7_10_openj9-0.20.0.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "b73f406dba1560dc194ac891452a1aacc2ba3b3e5e7b55e91a64559f8c2d9539",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11_openj9-0.23.0/OpenJDK11U-jre_aarch64_linux_openj9_11.0.9_11_openj9-0.23.0.tar.gz",
+            "version": "11.0.9"
           },
           "packageType": "jre",
           "vmType": "openj9",
           "x86_64": {
-            "build": "10",
-            "sha256": "08258a767a6953bde21d15ef3c08e776d83257afa4acc52b55c70e1ac02f0489",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10_openj9-0.20.0/OpenJDK11U-jre_x64_linux_openj9_11.0.7_10_openj9-0.20.0.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "54c845c167c197ba789eb6c3508faa5b1c95c9abe2ac26878123b6eecc87a111",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11_openj9-0.23.0/OpenJDK11U-jre_x64_linux_openj9_11.0.9_11_openj9-0.23.0.tar.gz",
+            "version": "11.0.9"
           }
         }
       }
@@ -100,20 +100,20 @@
           "packageType": "jdk",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "10",
-            "sha256": "0ab1e15e8bd1916423960e91b932d2b17f4c15b02dbdf9fa30e9423280d9e5cc",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jdk_x64_mac_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "7b21961ffb2649e572721a0dfad64169b490e987937b661cb4e13a594c21e764",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11.1/OpenJDK11U-jdk_x64_mac_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           }
         },
         "openj9": {
           "packageType": "jdk",
           "vmType": "openj9",
           "x86_64": {
-            "build": "10",
-            "sha256": "a0de749c37802cc233ac58ffde68191a4dc985c71b626e7c0ff53944f743427f",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10.2_openj9-0.20.0/OpenJDK11U-jdk_x64_mac_openj9_11.0.7_10_openj9-0.20.0.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "382238443d4495d976f9e1a66b0f6e3bc250d3d009b64d2c29d44022afd7e418",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11.1_openj9-0.23.0/OpenJDK11U-jdk_x64_mac_openj9_11.0.9_11_openj9-0.23.0.tar.gz",
+            "version": "11.0.9"
           }
         }
       },
@@ -122,20 +122,20 @@
           "packageType": "jre",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "10",
-            "sha256": "931a81f4bed38c48b364db57d4ebdd6e4b4ea1466e9bd0eaf8e0f1e47c4569e9",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jre_x64_mac_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "cd8965dc8dbd0b5b3b25b6a336857d9bb622965e039b77e3048bc825e5512e95",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11.1/OpenJDK11U-jre_x64_mac_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           }
         },
         "openj9": {
           "packageType": "jre",
           "vmType": "openj9",
           "x86_64": {
-            "build": "10",
-            "sha256": "0941d739e3230d1d83dc1ee54cff6d17d90331e4f275d00739cb78fba41c5b96",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10.2_openj9-0.20.0/OpenJDK11U-jre_x64_mac_openj9_11.0.7_10_openj9-0.20.0.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "33a868f12bbe9326f658e60abe48dac658df33578b3719f551355855a87d1911",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11.1_openj9-0.23.0/OpenJDK11U-jre_x64_mac_openj9_11.0.9_11_openj9-0.23.0.tar.gz",
+            "version": "11.0.9"
           }
         }
       }
@@ -259,45 +259,181 @@
       }
     }
   },
-  "openjdk8": {
+  "openjdk14": {
+    "linux": {
+      "jdk": {
+        "hotspot": {
+          "aarch64": {
+            "build": "12",
+            "sha256": "ee87e9f03b1fbe6f328429b78fe1a9f44900026d220c90dfd747fe0bcd62d904",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jdk_aarch64_linux_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
+          },
+          "armv6l": {
+            "build": "12",
+            "sha256": "65f193496c6977ba7aed1563edc4b5be091b5ff03e3d790074bb4e389a034b36",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jdk_arm_linux_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
+          },
+          "armv7l": {
+            "build": "12",
+            "sha256": "65f193496c6977ba7aed1563edc4b5be091b5ff03e3d790074bb4e389a034b36",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jdk_arm_linux_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
+          },
+          "packageType": "jdk",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "12",
+            "sha256": "7d5ee7e06909b8a99c0d029f512f67b092597aa5b0e78c109bd59405bbfa74fe",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jdk_x64_linux_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
+          }
+        },
+        "openj9": {
+          "packageType": "jdk",
+          "vmType": "openj9",
+          "x86_64": {
+            "build": "12",
+            "sha256": "306f7138cdb65daaf2596ec36cafbde72088144c83b2e964f0193662e6caf3be",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12_openj9-0.21.0/OpenJDK14U-jdk_x64_linux_openj9_14.0.2_12_openj9-0.21.0.tar.gz",
+            "version": "14.0.2"
+          }
+        }
+      },
+      "jre": {
+        "hotspot": {
+          "aarch64": {
+            "build": "12",
+            "sha256": "2b749ceead19d68dd7e3c28b143dc4f94bb0916378a98b7346e851318ea4da84",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jre_aarch64_linux_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
+          },
+          "armv6l": {
+            "build": "12",
+            "sha256": "4468ecf74956783ae41a46e8ba023c003c69e4d111622944aad1af764a1bc4af",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jre_arm_linux_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
+          },
+          "armv7l": {
+            "build": "12",
+            "sha256": "4468ecf74956783ae41a46e8ba023c003c69e4d111622944aad1af764a1bc4af",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jre_arm_linux_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
+          },
+          "packageType": "jre",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "12",
+            "sha256": "1107845947da56e6bdad0da0b79210a079a74ec5c806f815ec5db9d09e1a9236",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jre_x64_linux_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
+          }
+        },
+        "openj9": {
+          "packageType": "jre",
+          "vmType": "openj9",
+          "x86_64": {
+            "build": "12",
+            "sha256": "3a137146a7b0bd8b029e72beb37c5fbb09dcfb9e33a10125076fff1555227cfd",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12_openj9-0.21.0/OpenJDK14U-jre_x64_linux_openj9_14.0.2_12_openj9-0.21.0.tar.gz",
+            "version": "14.0.2"
+          }
+        }
+      }
+    },
+    "mac": {
+      "jdk": {
+        "hotspot": {
+          "packageType": "jdk",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "12",
+            "sha256": "09b7e6ab5d5eb4b73813f4caa793a0b616d33794a17988fa6a6b7c972e8f3dd3",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jdk_x64_mac_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
+          }
+        },
+        "openj9": {
+          "packageType": "jdk",
+          "vmType": "openj9",
+          "x86_64": {
+            "build": "12",
+            "sha256": "95e6abcc12dde676ccd5ba65ab86f06ddaa22749dde00e31f4c6d3ea95277359",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12_openj9-0.21.0/OpenJDK14U-jdk_x64_mac_openj9_14.0.2_12_openj9-0.21.0.tar.gz",
+            "version": "14.0.2"
+          }
+        }
+      },
+      "jre": {
+        "hotspot": {
+          "packageType": "jre",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "12",
+            "sha256": "e8b5196de8ecb2b136a28494c2888784b9d9e22e29d2c38528892fb7d0c95260",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jre_x64_mac_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
+          }
+        },
+        "openj9": {
+          "packageType": "jre",
+          "vmType": "openj9",
+          "x86_64": {
+            "build": "12",
+            "sha256": "2562a442d7278409358f474071db34df4ba9c555925f28d0270139f97133c8d5",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12_openj9-0.21.0/OpenJDK14U-jre_x64_mac_openj9_14.0.2_12_openj9-0.21.0.tar.gz",
+            "version": "14.0.2"
+          }
+        }
+      }
+    }
+  },
+  "openjdk15": {
     "linux": {
       "jdk": {
         "hotspot": {
           "aarch64": {
             "build": "9",
-            "sha256": "536bf397d98174b376da9ed49d2f659d65c7310318d8211444f4b7ba7c15e453",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09/OpenJDK8U-jdk_aarch64_linux_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "sha256": "84398a1566d66ee5a88f3326fb7f0b70504eb510190f8f798bdb386481a3900e",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jdk_aarch64_linux_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
           },
           "armv6l": {
             "build": "9",
-            "sha256": "5b401ad3c9b246281bd6df34b1abaf75e10e5cad9c6b26b55232b016e90e411a",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09/OpenJDK8U-jdk_arm_linux_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "sha256": "bef5e9f4ab8a87645fa2b3d0ffb9f2b97374caa03cd1296597e8c86e8360d5a2",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jdk_arm_linux_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
           },
           "armv7l": {
             "build": "9",
-            "sha256": "5b401ad3c9b246281bd6df34b1abaf75e10e5cad9c6b26b55232b016e90e411a",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09/OpenJDK8U-jdk_arm_linux_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "sha256": "bef5e9f4ab8a87645fa2b3d0ffb9f2b97374caa03cd1296597e8c86e8360d5a2",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jdk_arm_linux_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
           },
           "packageType": "jdk",
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "2b59b5282ff32bce7abba8ad6b9fde34c15a98f949ad8ae43e789bbd78fc8862",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09/OpenJDK8U-jdk_x64_linux_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "sha256": "61045ecb9434e3320dbc2c597715f9884586b7a18a56d29851b4d4a4d48a2a5e",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jdk_x64_linux_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
           }
         },
         "openj9": {
+          "aarch64": {
+            "build": "9",
+            "sha256": "6206643ec4a57597f73880423b72fc06c1018d92cc6b02972ec3ea3fe4d853a2",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9_openj9-0.23.0/OpenJDK15U-jdk_aarch64_linux_openj9_15.0.1_9_openj9-0.23.0.tar.gz",
+            "version": "15.0.1"
+          },
           "packageType": "jdk",
           "vmType": "openj9",
           "x86_64": {
             "build": "9",
-            "sha256": "910ae847109a6dd1b6cf69baa7615ea2cce8cff787e5a9349a5331ce7604f3a5",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09_openj9-0.20.0/OpenJDK8U-jdk_x64_linux_openj9_8u252b09_openj9-0.20.0.tar.gz",
-            "version": "8.0.252"
+            "sha256": "b1561f7a69c977bfc9991e61e96dcb200c39300dd9ad423254af117c189e4a8d",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9_openj9-0.23.0/OpenJDK15U-jdk_x64_linux_openj9_15.0.1_9_openj9-0.23.0.tar.gz",
+            "version": "15.0.1"
           }
         }
       },
@@ -305,39 +441,45 @@
         "hotspot": {
           "aarch64": {
             "build": "9",
-            "sha256": "30bba4425497f5b4aabcba7b45db69d582d278fb17357d64c22c9dc6b2d29ca1",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09/OpenJDK8U-jre_aarch64_linux_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "sha256": "9eecdd39239545b922878abf51015030ba9aed4dda5c4574ddbc669a71ddab31",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jre_aarch64_linux_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
           },
           "armv6l": {
             "build": "9",
-            "sha256": "107699a88f611e0c2d57816be25821ef9b17db860b14402c4e9e5bf0b9cf16fd",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09/OpenJDK8U-jre_arm_linux_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "sha256": "f289d1b9fc05099889eaa9a52d352275d44698f3448153cc2ef05f2fa1c04cca",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jre_arm_linux_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
           },
           "armv7l": {
             "build": "9",
-            "sha256": "107699a88f611e0c2d57816be25821ef9b17db860b14402c4e9e5bf0b9cf16fd",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09/OpenJDK8U-jre_arm_linux_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "sha256": "f289d1b9fc05099889eaa9a52d352275d44698f3448153cc2ef05f2fa1c04cca",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jre_arm_linux_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
           },
           "packageType": "jre",
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "a93be303ed62398dba9acb0376fb3caf8f488fcde80dc62d0a8e46256b3adfb1",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09/OpenJDK8U-jre_x64_linux_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "sha256": "e619197c7a5757631f6ea9c912ab47528ebf64c27cf788cdad22bc9245779411",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jre_x64_linux_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
           }
         },
         "openj9": {
+          "aarch64": {
+            "build": "9",
+            "sha256": "1db3c28e8c423d005fcf3b0c8a081061e56c51966273e32e3930d4c57c21bf49",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9_openj9-0.23.0/OpenJDK15U-jre_aarch64_linux_openj9_15.0.1_9_openj9-0.23.0.tar.gz",
+            "version": "15.0.1"
+          },
           "packageType": "jre",
           "vmType": "openj9",
           "x86_64": {
             "build": "9",
-            "sha256": "5c0ab4691ff5f8e69bb14462f2afb8d73d751b01048eacf4b426ed6d6646dc63",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09_openj9-0.20.0/OpenJDK8U-jre_x64_linux_openj9_8u252b09_openj9-0.20.0.tar.gz",
-            "version": "8.0.252"
+            "sha256": "e47fdadfe91f554f3e343b24e678b6862673f9b1dce3703efd1447950188357b",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9_openj9-0.23.0/OpenJDK15U-jre_x64_linux_openj9_15.0.1_9_openj9-0.23.0.tar.gz",
+            "version": "15.0.1"
           }
         }
       }
@@ -349,9 +491,9 @@
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "2caed3ec07d108bda613f9b4614b22a8bdd196ccf2a432a126161cd4077f07a5",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09.1/OpenJDK8U-jdk_x64_mac_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "sha256": "d32f9429c4992cef7be559a15c542011503d6bc38c89379800cd209a9d7ec539",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jdk_x64_mac_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
           }
         },
         "openj9": {
@@ -359,9 +501,9 @@
           "vmType": "openj9",
           "x86_64": {
             "build": "9",
-            "sha256": "f522061a23290bce3423e49025a95b6e78d6f30e2741817e83c8fdba4c0c4ae7",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09.2_openj9-0.20.0/OpenJDK8U-jdk_x64_mac_openj9_8u252b09_openj9-0.20.0.tar.gz",
-            "version": "8.0.252"
+            "sha256": "c9b19fd1fda9c581aa0bcddbf5f821204c351a1de29da1c5aa51cb680ee99517",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9.1_openj9-0.23.0/OpenJDK15U-jdk_x64_mac_openj9_15.0.1_9_openj9-0.23.0.tar.gz",
+            "version": "15.0.1"
           }
         }
       },
@@ -371,9 +513,9 @@
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "f8206f0fef194c598de6b206a4773b2e517154913ea0e26c5726091562a034c8",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09.1/OpenJDK8U-jre_x64_mac_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "sha256": "fde1713fc51e824a08f8eeb5e2b8a2acf21424d5f9a0e70cfd2e85a77c827bc4",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jre_x64_mac_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
           }
         },
         "openj9": {
@@ -381,12 +523,154 @@
           "vmType": "openj9",
           "x86_64": {
             "build": "9",
-            "sha256": "55cce54a39c5748360e2e3fe8edf04469b75a0783514853a5745463979b43c80",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09.2_openj9-0.20.0/OpenJDK8U-jre_x64_mac_openj9_8u252b09_openj9-0.20.0.tar.gz",
-            "version": "8.0.252"
+            "sha256": "e7c3710d6cc23480ac66eba79b48d9e2bebec34ba688f3053bb5eba406a2c315",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9.1_openj9-0.23.0/OpenJDK15U-jre_x64_mac_openj9_15.0.1_9_openj9-0.23.0.tar.gz",
+            "version": "15.0.1"
+          }
+        }
+      }
+    }
+  },
+  "openjdk8": {
+    "linux": {
+      "jdk": {
+        "hotspot": {
+          "aarch64": {
+            "build": "10",
+            "sha256": "cfbde5191027c6d25af44af8a3d64625c6e22422dea8c4af6fe9240e7e249baa",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jdk_aarch64_linux_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          },
+          "armv6l": {
+            "build": "10",
+            "sha256": "b005e9e8a912aa6605debdea3685a223c077d5a4ba7c90bca02d804c5f39d0b9",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jdk_arm_linux_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          },
+          "armv7l": {
+            "build": "10",
+            "sha256": "b005e9e8a912aa6605debdea3685a223c077d5a4ba7c90bca02d804c5f39d0b9",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jdk_arm_linux_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          },
+          "packageType": "jdk",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "10",
+            "sha256": "6f124b69d07d8d3edf39b9aa5c58473f63a380b686ddb73a5495e01d25c2939a",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jdk_x64_linux_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          }
+        },
+        "openj9": {
+          "aarch64": {
+            "build": "10",
+            "sha256": "bbc78dc8caf25372578a95287bcf672c4bf62af23939d4a988634b2a1356cd89",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10_openj9-0.23.0/OpenJDK8U-jdk_aarch64_linux_openj9_8u272b10_openj9-0.23.0.tar.gz",
+            "version": "8.0.272"
+          },
+          "packageType": "jdk",
+          "vmType": "openj9",
+          "x86_64": {
+            "build": "10",
+            "sha256": "ca852f976e5b27ccd9b73a527a517496bda865b2ae2a85517ca74486fb8de7da",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10_openj9-0.23.0/OpenJDK8U-jdk_x64_linux_openj9_8u272b10_openj9-0.23.0.tar.gz",
+            "version": "8.0.272"
+          }
+        }
+      },
+      "jre": {
+        "hotspot": {
+          "aarch64": {
+            "build": "10",
+            "sha256": "ed3a862d83dd1f19037fc6ccf73500f2ecf453eb245af8b70bec3fb80d084289",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jre_aarch64_linux_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          },
+          "armv6l": {
+            "build": "10",
+            "sha256": "906113d909d81b930c4eb519512d1cc9f9be9789dfd349128d6e7efaeeb36e1c",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jre_arm_linux_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          },
+          "armv7l": {
+            "build": "10",
+            "sha256": "906113d909d81b930c4eb519512d1cc9f9be9789dfd349128d6e7efaeeb36e1c",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jre_arm_linux_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          },
+          "packageType": "jre",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "10",
+            "sha256": "e6894601a559c5226c6dc337308df263444d356a6430f4aabb66e02607c82956",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jre_x64_linux_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          }
+        },
+        "openj9": {
+          "aarch64": {
+            "build": "10",
+            "sha256": "b0891c3493a9fc6135700d065a826fc67223d54e9d0da3c41b57e6cb6897b726",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10_openj9-0.23.0/OpenJDK8U-jre_aarch64_linux_openj9_8u272b10_openj9-0.23.0.tar.gz",
+            "version": "8.0.272"
+          },
+          "packageType": "jre",
+          "vmType": "openj9",
+          "x86_64": {
+            "build": "10",
+            "sha256": "a4e58f3c15ca3bc15cb3aaa9f116de972809ca52ae81e0726f84c059442174d5",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10_openj9-0.23.0/OpenJDK8U-jre_x64_linux_openj9_8u272b10_openj9-0.23.0.tar.gz",
+            "version": "8.0.272"
+          }
+        }
+      }
+    },
+    "mac": {
+      "jdk": {
+        "hotspot": {
+          "packageType": "jdk",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "10",
+            "sha256": "091f9ee39b0bdbc8af8ec19f51aaa0f73e416c2e93a8fb2c79b82f4caac83ab6",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jdk_x64_mac_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          }
+        },
+        "openj9": {
+          "packageType": "jdk",
+          "vmType": "openj9",
+          "x86_64": {
+            "build": "10",
+            "sha256": "bbd66ec27a4ea9b0b0952f501e1837e69c24262f64b316dab0408d1a8633a527",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10.1_openj9-0.23.0/OpenJDK8U-jdk_x64_mac_openj9_8u272b10_openj9-0.23.0.tar.gz",
+            "version": "8.0.272"
+          }
+        }
+      },
+      "jre": {
+        "hotspot": {
+          "packageType": "jre",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "10",
+            "sha256": "afb9c08cb8b93d8e7d4f1e48ced3d43cfb3082491595a2eaf1f00c48abd25428",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jre_x64_mac_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          }
+        },
+        "openj9": {
+          "packageType": "jre",
+          "vmType": "openj9",
+          "x86_64": {
+            "build": "10",
+            "sha256": "4d90e85240113189d897a86731e672b37a6e345c056f35c7719cb27f3d08385b",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10.1_openj9-0.23.0/OpenJDK8U-jre_x64_mac_openj9_8u272b10_openj9-0.23.0.tar.gz",
+            "version": "8.0.272"
           }
         }
       }
     }
   }
-}
+}

pkgs/development/compilers/ghc/8.6.5.nix

@@ -110,10 +110,10 @@ stdenv.mkDerivation (rec {
   outputs = [ "out" "doc" ];
 
   patches = [
-    (fetchpatch rec { # https://phabricator.haskell.org/D5123
-     url = "http://tarballs.nixos.org/sha256/${sha256}";
+    (fetchpatch { # https://phabricator.haskell.org/D5123
+     url = "https://gitlab.haskell.org/ghc/ghc/-/commit/13ff0b7ced097286e0d7b054f050871effe07f86.diff";
      name = "D5123.diff";
-     sha256 = "0nhqwdamf2y4gbwqxcgjxs0kqx23w9gv5kj0zv6450dq19rji82n";
+     sha256 = "140lmnqxra7xkwy370c5pyf8dgdwgmbpcrs1dapnwr2dh8bavn8c";
     })
     (fetchpatch { # https://github.com/haskell/haddock/issues/900
      url = "https://patch-diff.githubusercontent.com/raw/haskell/haddock/pull/983.diff";

pkgs/development/compilers/rust/1_48.nix

@@ -19,25 +19,25 @@
 } @ args:
 
 import ./default.nix {
-  rustcVersion = "1.47.0";
-  rustcSha256 = "sha256-MYXfBkxHR/LIubuMRGjt1Y/0rW0HiAyHmsGxc7do2B0=";
+  rustcVersion = "1.48.0";
+  rustcSha256 = "0fz4gbb5hp5qalrl9lcl8yw4kk7ai7wx511jb28nypbxninkwxhf";
 
   # Note: the version MUST be one version prior to the version we're
   # building
-  bootstrapVersion = "1.46.0";
+  bootstrapVersion = "1.47.0";
 
   # fetch hashes by running `print-hashes.sh 1.45.2`
   bootstrapHashes = {
-    i686-unknown-linux-gnu = "6ebd7e04dc18a36d08b9731cdb42d5caf8460e1eb41b75f3a8596c39f5e71206";
-    x86_64-unknown-linux-gnu = "e3b98bc3440fe92817881933f9564389eccb396f5f431f33d48b979fa2fbdcf5";
-    arm-unknown-linux-gnueabihf = "bb8af68565321f54608e918597083eb016ed0f9f4f3cc23f7cc5f467b934ce7f";
-    armv7-unknown-linux-gnueabihf = "7c0640879d7f2c38db60352e3c0f09e3fc6fa3bac6ca8f22cbccb1eb5e950121";
-    aarch64-unknown-linux-gnu = "f0c6d630f3dedb3db69d69ed9f833aa6b472363096f5164f1068c7001ca42aeb";
-    x86_64-apple-darwin = "82d61582a3772932432a99789c3b3bd4abe6baca339e355048ca9efb9ea5b4db";
-    powerpc64le-unknown-linux-gnu = "89e2f4761d257f017a4b6aa427f36ac0603195546fa2cfded8c899789832941c";
+    i686-unknown-linux-gnu = "84bf092130ea5216fc701871e633563fc1c01b6528f60cb0767e96cd8eec30bf";
+    x86_64-unknown-linux-gnu = "d0e11e1756a072e8e246b05d54593402813d047d12e44df281fbabda91035d96";
+    arm-unknown-linux-gnueabihf = "82e12affb47596b68d0ca64045f4eb698c10ff15406afca604e12cdd07e17b26";
+    armv7-unknown-linux-gnueabihf = "19d0fe3892a8e98f99c5aa84f4d6f260853147650cb71f2bae985c91de6c29af";
+    aarch64-unknown-linux-gnu = "753c905e89a714ab9bce6fe1397b721f29c0760c32f09d2f328af3d39919c8e6";
+    x86_64-apple-darwin = "84e5be6c5c78734deba911dcf80316be1e4c7da2c59413124d039ad96620612f";
+    powerpc64le-unknown-linux-gnu = "5760c3b1897ea70791320c2565f3eef700a3d54059027b84bbe6b8d6157f81c8";
   };
 
-  selectRustPackage = pkgs: pkgs.rust_1_47;
+  selectRustPackage = pkgs: pkgs.rust_1_48;
 
   rustcPatches = [
   ];

pkgs/development/interpreters/python/hooks/default.nix

@@ -5,6 +5,7 @@
 , disabledIf
 , isPy3k
 , ensureNewerSourcesForZipFilesHook
+, findutils
 }:
 
 let
@@ -94,7 +95,7 @@ in rec {
     makeSetupHook {
       name = "python-namespaces-hook.sh";
       substitutions = {
-        inherit pythonSitePackages;
+        inherit pythonSitePackages findutils;
       };
     } ./python-namespaces-hook.sh) {};
 

pkgs/development/interpreters/python/hooks/pip-install-hook.sh

@@ -11,7 +11,7 @@ pipInstallPhase() {
     export PYTHONPATH="$out/@pythonSitePackages@:$PYTHONPATH"
 
     pushd dist || return 1
-    @pythonInterpreter@ -m pip install ./*.whl --no-index --prefix="$out" --no-cache $pipInstallFlags --build tmpbuild
+    @pythonInterpreter@ -m pip install ./*.whl --no-index --no-warn-script-location --prefix="$out" --no-cache $pipInstallFlags --build tmpbuild
     popd || return 1
 
     runHook postInstall

pkgs/development/interpreters/python/hooks/python-namespaces-hook.sh

@@ -17,16 +17,17 @@ pythonNamespacesHook() {
         for pathSegment in ${pathSegments[@]}; do
             constructedPath=${constructedPath}/${pathSegment}
             pathToRemove=${constructedPath}/__init__.py
-            pycachePath=${constructedPath}/__pycache__/__init__*
+            pycachePath=${constructedPath}/__pycache__/
 
+            # remove __init__.py
             if [ -f "$pathToRemove" ]; then
-                echo "Removing $pathToRemove"
-                rm "$pathToRemove"
+                rm -v "$pathToRemove"
             fi
 
-            if [ -f "$pycachePath" ]; then
-                echo "Removing $pycachePath"
-                rm "$pycachePath"
+            # remove __pycache__/ entry, can be interpreter specific. E.g. __init__.cpython-38.pyc
+            # use null characters to perserve potential whitespace in filepath
+            if [ -d "$pycachePath" ]; then
+                @findutils@/bin/find "$pycachePath" -name '__init__*' -exec rm -v "{}" +
             fi
         done
     done

pkgs/development/interpreters/python/mk-python-derivation.nix

@@ -53,7 +53,9 @@
 , disabled ? false
 
 # Raise an error if two packages are installed with the same name
-, catchConflicts ? true
+# TODO: For cross we probably need a different PYTHONPATH, or not
+# add the runtime deps until after buildPhase.
+, catchConflicts ? (python.stdenv.hostPlatform == python.stdenv.buildPlatform)
 
 # Additional arguments to pass to the makeWrapper function, which wraps
 # generated binaries.

pkgs/development/interpreters/python/tests.nix

@@ -1,4 +1,5 @@
-{ python
+{ stdenv
+, python
 , runCommand
 , substituteAll
 , lib
@@ -92,4 +93,4 @@ let
 
 
 
-in environmentTests // integrationTests
+in stdenv.lib.optionalAttrs (stdenv.hostPlatform == stdenv.buildPlatform ) (environmentTests // integrationTests)

pkgs/development/libraries/avahi/default.nix

@@ -1,8 +1,10 @@
 { fetchurl, fetchpatch, stdenv, pkgconfig, libdaemon, dbus, perlPackages
-, expat, gettext, intltool, glib, libiconv, writeShellScriptBin
+, expat, gettext, intltool, glib, libiconv, writeShellScriptBin, libevent
 , gtk3Support ? false, gtk3 ? null
 , qt4 ? null
 , qt4Support ? false
+, qt5 ? null
+, qt5Support ? false
 , withLibdnssdCompat ? false
 , python ? null
 , withPython ? false }:
@@ -16,11 +18,11 @@ in
 
 stdenv.mkDerivation rec {
   name = "avahi${stdenv.lib.optionalString withLibdnssdCompat "-compat"}-${version}";
-  version = "0.7";
+  version = "0.8";
 
   src = fetchurl {
     url = "https://github.com/lathiat/avahi/releases/download/v${version}/avahi-${version}.tar.gz";
-    sha256 = "0128n7jlshw4bpx0vg8lwj8qwdisjxi7mvniwfafgnkzzrfrpaap";
+    sha256 = "1npdixwxxn3s9q1f365x9n9rc5xgfz39hxf23faqvlrklgbhj0q6";
   };
 
   prePatch = ''
@@ -30,17 +32,13 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./no-mkdir-localstatedir.patch
-    (fetchpatch {
-      name ="CVE-2017-6519-CVE-2018-100084.patch";
-      url = "https://github.com/lathiat/avahi/commit/e111def44a7df4624a4aa3f85fe98054bffb6b4f.patch";
-      sha256 = "06n7b7kz6xcc35c7xjfc1kj3k2llyjgi09nhy0ci32l1bhacjw0q";
-    })
   ];
 
-  buildInputs = [ libdaemon dbus glib expat libiconv ]
+  buildInputs = [ libdaemon dbus glib expat libiconv libevent ]
     ++ (with perlPackages; [ perl XMLParser ])
     ++ (stdenv.lib.optional gtk3Support gtk3)
-    ++ (stdenv.lib.optional qt4Support qt4);
+    ++ (stdenv.lib.optional qt4Support qt4)
+    ++ (stdenv.lib.optional qt5Support qt5);
 
   propagatedBuildInputs =
     stdenv.lib.optionals withPython (with python.pkgs; [ python pygobject3 dbus-python ]);
@@ -52,6 +50,7 @@ stdenv.mkDerivation rec {
       "--disable-gtk" "--with-dbus-sys=${placeholder "out"}/share/dbus-1/system.d"
       (stdenv.lib.enableFeature gtk3Support "gtk3")
       "--${if qt4Support then "enable" else "disable"}-qt4"
+      "--${if qt5Support then "enable" else "disable"}-qt5"
       (stdenv.lib.enableFeature withPython "python")
       "--localstatedir=/var" "--with-distro=none"
       # A systemd unit is provided by the avahi-daemon NixOS module

pkgs/development/libraries/c-ares/default.nix

@@ -7,11 +7,12 @@
 
 let self =
 stdenv.mkDerivation rec {
-  name = "c-ares-1.15.0";
+  pname = "c-ares";
+  version = "1.17.1";
 
   src = fetchurl {
-    url = "https://c-ares.haxx.se/download/${name}.tar.gz";
-    sha256 = "0lk8knip4xk6qzksdkn7085mmgm4ixfczdyyjw656c193y3rgnvc";
+    url = "https://c-ares.haxx.se/download/${pname}-${version}.tar.gz";
+    sha256 = "0h7wjfnk2092glqcp9mqaax7xx0s13m501z1gi0gsjl2vvvd0gfp";
   };
 
   meta = with stdenv.lib; {

pkgs/development/libraries/c-blosc/default.nix

@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0a3yrig78plzjbazfqcfrzqhnw17xd0dcayvp4z4kp415kgs2a3s";
   };
 
-  buildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake ];
 
   enableParallelBuilding = true;
 

pkgs/development/libraries/cyrus-sasl/default.nix

@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     urls =
-      [ "http://www.cyrusimap.org/releases/${pname}-${version}.tar.gz"
+      [ "https://github.com/cyrusimap/${pname}/releases/download/${pname}-${version}/${pname}-${version}.tar.gz"
+        "http://www.cyrusimap.org/releases/${pname}-${version}.tar.gz"
         "http://www.cyrusimap.org/releases/old/${pname}-${version}.tar.gz"
       ];
     sha256 = "1m85zcpgfdhm43cavpdkhb1s2zq1b31472hq1w1gs3xh94anp1i6";

pkgs/development/libraries/gdk-pixbuf/default.nix

@@ -20,31 +20,23 @@
 , gobject-introspection
 , doCheck ? false
 , makeWrapper
-, fetchpatch
 , lib
 }:
 
 stdenv.mkDerivation rec {
   pname = "gdk-pixbuf";
-  version = "2.40.0";
+  version = "2.42.0";
 
   outputs = [ "out" "dev" "man" "devdoc" "installedTests" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1rnlx9yfw970maxi2x6niaxmih5la11q1ilr7gzshz2kk585k0hm";
+    sha256 = "1ixfmmamgv67is7snzighfr7c9y2maq3q4a075xdq0d9s4w16i3k";
   };
 
   patches = [
     # Move installed tests to a separate output
     ./installed-tests-path.patch
-
-    # Temporary until the fix is released.
-    (fetchpatch {
-      name = "tests-circular-table.patch";
-      url = "https://gitlab.gnome.org/GNOME/gdk-pixbuf/merge_requests/59.diff";
-      sha256 = "0kaflac3mrh6031hwxk7j9fhli775hc503818h8zfl6b28zyn93f";
-    })
   ];
 
   nativeBuildInputs = [
@@ -71,9 +63,8 @@ stdenv.mkDerivation rec {
   ];
 
   mesonFlags = [
-    "-Ddocs=true"
-    "-Dx11=false" # use gdk-pixbuf-xlib
-    "-Dgir=${lib.boolToString (gobject-introspection != null)}"
+    "-Dgtk_doc=true"
+    "-Dintrospection=${if gobject-introspection != null then "enabled" else "disabled"}"
     "-Dgio_sniffing=false"
   ];
 
@@ -135,7 +126,7 @@ stdenv.mkDerivation rec {
     description = "A library for image loading and manipulation";
     homepage = "https://gitlab.gnome.org/GNOME/gdk-pixbuf";
     maintainers = [ maintainers.eelco ] ++ teams.gnome.members;
-    license = licenses.lgpl21;
+    license = licenses.lgpl21Plus;
     platforms = platforms.unix;
   };
 }

pkgs/development/libraries/glib/default.nix

@@ -45,11 +45,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "glib";
-  version = "2.66.2";
+  version = "2.66.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1i0pd8y6xz64qlzfj73wxyqp0x7x9j6mwf4gj6ggil4d9vnhnfgc";
+    sha256 = "1cdmyyycw2mf5s0f5sfd59q91223s4smcqi8n2fwrccwm5ji7wvr";
   };
 
   patches = optionals stdenv.isDarwin [

pkgs/development/libraries/glibc/common.nix

@@ -160,6 +160,10 @@ stdenv.mkDerivation ({
       "libc_cv_as_needed=no"
     ] ++ lib.optional withGd "--with-gd";
 
+  makeFlags = [
+    "OBJCOPY=${stdenv.cc.targetPrefix}objcopy"
+  ];
+
   installFlags = [ "sysconfdir=$(out)/etc" ];
 
   outputs = [ "out" "bin" "dev" "static" ];

pkgs/development/libraries/gmp/6.x.nix

@@ -11,11 +11,11 @@
 let inherit (stdenv.lib) optional; in
 
 let self = stdenv.mkDerivation rec {
-  name = "gmp-6.2.0";
+  name = "gmp-6.2.1";
 
   src = fetchurl { # we need to use bz2, others aren't in bootstrapping stdenv
     urls = [ "mirror://gnu/gmp/${name}.tar.bz2" "ftp://ftp.gmplib.org/pub/${name}/${name}.tar.bz2" ];
-    sha256 = "1sji8i9yjzfv5l2fsadpgjfyn452q6ab9zvm02k23ssd275rj77m";
+    sha256 = "0z2ddfiwgi0xbf65z4fg4hqqzlhv0cc6hdcswf3c6n21xdmk5sga";
   };
 
   #outputs TODO: split $cxx due to libstdc++ dependency

pkgs/development/libraries/gstreamer/bad/default.nix

@@ -89,27 +89,17 @@ let
   inherit (stdenv.lib) optional optionals;
 in stdenv.mkDerivation rec {
   pname = "gst-plugins-bad";
-  version = "1.18.0";
+  version = "1.18.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0pqqq5bs9fjwcmbwgsgxs2dx6gznhxs7ii5pmjkslr6xmlfap0pk";
+    sha256 = "1cn18cbqyysrxnrk5bpxdzd5xcws9g2kmm5rbv00cx6rhn69g5f1";
   };
 
   patches = [
     ./fix_pkgconfig_includedir.patch
-    # Fixes srt usage failing with
-    #     Failed to open SRT: failed to set SRTO_LINGER (reason: Operation not supported: Bad parameters)
-    # see https://github.com/Haivision/srt/issues/1374
-    # Remove when https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/-/commit/84f8dbd932029220ee86154dd85b241911ea3891
-    # is shown as being in a release tag that nixpkgs uses.
-    (fetchpatch {
-      name = "gstreamer-srtobject-typecast-SRTO_LINGER-to-linger.patch";
-      url = "https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/-/commit/84f8dbd932029220ee86154dd85b241911ea3891.patch";
-      sha256 = "0596lvgi93sj3yn98grgmsrhnqhhq7fnjk91qi4xc6618fpqmp9x";
-    })
   ];
 
   nativeBuildInputs = [

pkgs/development/libraries/gstreamer/base/default.nix

@@ -40,13 +40,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-base";
-  version = "1.18.0";
+  version = "1.18.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "15vqvcy842vhbic3w7l4yvannzazdgwggzv2x8f9m02hm78vsakn";
+    sha256 = "0hf66sh8d4x2ksfnvaq2rqrrfq0vi0pv6wbh9i5jixrhvvbm99hv";
   };
 
   patches = [

pkgs/development/libraries/gstreamer/core/default.nix

@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "gstreamer";
-  version = "1.18.0";
+  version = "1.18.1";
 
   outputs = [
     "out"
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "01bq1k0gj603zyhq975zl09q4zla12mxqvhmk9fyn2kcn12r5w0g";
+    sha256 = "1fpcpsw740svvdxvvwn0hly5i72miizm4s0mbid10ji83zi8vpvr";
   };
 
   patches = [

pkgs/development/libraries/gstreamer/devtools/default.nix

@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-devtools";
-  version = "1.18.0";
+  version = "1.18.1";
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "05jzjkkdr5hg01mjihlqdcxqnjfrm4mqk0zp83212kv5nm0p2cw2";
+    sha256 = "1pxhg8n5nl34baq6mb07i27b33gaw47zrv5yalyj6f12pnx148ki";
   };
 
   patches = [

pkgs/development/libraries/gstreamer/ges/default.nix

@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-editing-services";
-  version = "1.18.0";
+  version = "1.18.1";
 
   outputs = [
     "out"
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1a00f07v0yjqz1hydhgkjjarm4rk99yjicbz5wkfl5alhzag1bjd";
+    sha256 = "09rr5a198p1r9wcbsjl01xg6idkfkgj5h9x7xxywarb5i7qv6g79";
   };
 
   patches = [

pkgs/development/libraries/gstreamer/good/default.nix

@@ -49,13 +49,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gst-plugins-good";
-  version = "1.18.0";
+  version = "1.18.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1b4b3a6fm2wyqpnx300pg1sz01m9qhfajadk3b7sbzisg8vvqab3";
+    sha256 = "0v329xi4qhlfh9aksfyviryqk9lclm4wj1lxrjnbdv4haldfj472";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/gstreamer/libav/default.nix

@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-libav";
-  version = "1.18.0";
+  version = "1.18.1";
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0sm0sfdlalimpkf7a7rk7whvyvmmfi2kly2z3q2j5z53x5f3zya2";
+    sha256 = "1n1fkkbxxsndblnbm0c2ziqp967hrz5gag6z36xbpvqk4sy1g9rr";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/gstreamer/rtsp-server/default.nix

@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-rtsp-server";
-  version = "1.18.0";
+  version = "1.18.1";
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "03y7nyjaagis7mmg8vbhxmnc1v9xf2y3cab2s3q2vgsc0l8r7l9a";
+    sha256 = "0m7p7sarvi6n9pz0rrl9k3gp3l5s42qs8z0165kyd6fiqdjjia0h";
   };
 
   outputs = [

pkgs/development/libraries/gstreamer/ugly/default.nix

@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-ugly";
-  version = "1.18.0";
+  version = "1.18.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "10p0nyzighvkciaspxnhlr7d7n4acrv96lf483i8l988bvj48rk8";
+    sha256 = "09gpbykjchw3lb51ipxj53fy238gr9mg9jybcg5135pb56w6rk8q";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/gstreamer/vaapi/default.nix

@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gstreamer-vaapi";
-  version = "1.18.0";
+  version = "1.18.1";
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0ccyzv15jzf0pi0ndrmfww016cn4c0y4265bacdvnxbgff6fpvy6";
+    sha256 = "1sm6x2qa7ng78w0w8q4mjs7pbpbbk8qkfgzhdmbb8l0bh513q3a0";
   };
 
   outputs = [

pkgs/development/libraries/libdevil/default.nix

@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
 
   patches =
     [ ( fetchurl {
-        url = "http://patch-tracker.debian.org/patch/series/dl/devil/1.7.8-6.1/03_CVE-2009-3994.diff";
+        url = "https://sources.debian.org/data/main/d/devil/1.7.8-10/debian/patches/03_CVE-2009-3994.diff";
         sha256 = "0qkx2qfv02igbrmsn6z5a3lbrbwjfh3rb0c2sj54wy0j1f775hbc";
       } )
       ./ftbfs-libpng15.patch

pkgs/development/libraries/libdrm/default.nix

@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdrm";
-  version = "2.4.102";
+  version = "2.4.103";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0nx0bd9dhymdsd99v4ifib77yjirkvkxf5hzdkbr7qr8dhrzkjwb";
+    sha256 = "08h2nnf4w96b4ql7485mvjgbbsb8rwc0qa93fdm1cq34pbyszq1z";
   };
 
   outputs = [ "out" "dev" "bin" ];

pkgs/development/libraries/libseccomp/default.nix

@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1wql62cg8f95cwpy057cl764nni9g4sdn5lqj68x22kjs8w71yhz";
   };
 
-  outputs = [ "out" "lib" "dev" "man" ];
+  outputs = [ "out" "lib" "dev" "man" "pythonsrc" ];
 
   nativeBuildInputs = [ gperf ];
   buildInputs = [ getopt ];
@@ -24,6 +24,13 @@ stdenv.mkDerivation rec {
   # Hack to ensure that patchelf --shrink-rpath get rids of a $TMPDIR reference.
   preFixup = "rm -rfv src";
 
+  # Copy the python module code into a tarball that we can export and use as the
+  # src input for buildPythonPackage calls
+  postInstall = ''
+    cp -R ./src/python/ tmp-pythonsrc/
+    tar -zcf $pythonsrc --transform s/tmp-pythonsrc/python-foundationdb/ ./tmp-pythonsrc/
+  '';
+
   meta = with stdenv.lib; {
     description = "High level library for the Linux Kernel seccomp filter";
     homepage = "https://github.com/seccomp/libseccomp";

pkgs/development/libraries/libsecret/default.nix

@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libsecret";
-  version = "0.20.3";
+  version = "0.20.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1r4habxdzmn02id324m0m4mg5isf22q1z436bg3vjjmcz1b3rjsg";
+    sha256 = "0a4xnfmraxchd9cq5ai66j12jv2vrgjmaaxz25kl031jvda4qnij";
   };
 
   postPatch = ''

pkgs/development/libraries/oniguruma/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "onig";
-  version = "6.9.5_rev1";
+  version = "6.9.6";
 
   src = fetchFromGitHub {
     owner = "kkos";
     repo = "oniguruma";
     rev = "v${version}";
-    sha256 = "1sx683hbb58gbjvla69n5vxdzwqhjqisqbfkf9xi95wr7p9ycjhl";
+    sha256 = "0y0dv6axvjjzi9367xc4q2nvvx58919iyzy25d5022lpz9z569kj";
   };
 
   nativeBuildInputs = [ autoreconfHook ];

pkgs/development/libraries/talloc/default.nix

@@ -1,6 +1,6 @@
 { stdenv
 , fetchurl
-, python
+, python3
 , pkg-config
 , readline
 , libxslt
@@ -10,7 +10,7 @@
 , wafHook
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (rec {
   pname = "talloc";
   version = "2.3.1";
 
@@ -22,13 +22,14 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     pkg-config
     fixDarwinDylibNames
-    python
+    python3
     wafHook
     docbook-xsl-nons
     docbook_xml_dtd_42
   ];
 
   buildInputs = [
+    python3
     readline
     libxslt
   ];
@@ -56,4 +57,9 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3;
     platforms = platforms.all;
   };
-}
+} // stdenv.lib.optionalAttrs (stdenv.hostPlatform != stdenv.buildPlatform) {
+  # python-config from build Python gives incorrect values when cross-compiling.
+  # If python-config is not found, the build falls back to using the sysconfig
+  # module, which works correctly when cross-compiling.
+  PYTHON_CONFIG = "/invalid";
+})

pkgs/development/python-modules/cftime/default.nix

@@ -1,10 +1,11 @@
 { buildPythonPackage
 , fetchPypi
-, pytest
+, pytestCheckHook
 , coveralls
 , pytestcov
 , cython
 , numpy
+, python
 }:
 
 buildPythonPackage rec {
@@ -16,13 +17,23 @@ buildPythonPackage rec {
     sha256 = "8d6a1144f43b9d7a180d7ceb3aa8015b7133c615fbac231bed184a91129f0207";
   };
 
-  checkInputs = [ pytest coveralls pytestcov ];
-  buildInputs = [ cython ];
-  propagatedBuildInputs = [ numpy ];
+  checkInputs = [
+    pytestCheckHook
+    coveralls
+    pytestcov
+  ];
 
-  checkPhase = ''
-    py.test
-  '';
+  nativeBuildInputs = [
+    cython
+    numpy
+  ];
+
+  propagatedBuildInputs = [
+    numpy
+  ];
+
+  # ERROR test/test_cftime.py - ModuleNotFoundError: No module named 'cftime._cft...
+  doCheck = false;
 
   meta = {
     description = "Time-handling functionality from netcdf4-python";

pkgs/development/python-modules/cryptography/default.nix

@@ -31,13 +31,20 @@ buildPythonPackage rec {
 
   outputs = [ "out" "dev" ];
 
+  nativeBuildInputs = stdenv.lib.optionals (!isPyPy) [
+    cffi
+  ];
+
   buildInputs = [ openssl ]
              ++ stdenv.lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
   propagatedBuildInputs = [
     packaging
     six
-  ] ++ stdenv.lib.optional (!isPyPy) cffi
-  ++ stdenv.lib.optionals isPy27 [ ipaddress enum34 ];
+  ] ++ stdenv.lib.optionals (!isPyPy) [
+    cffi
+  ] ++ stdenv.lib.optionals isPy27 [
+    ipaddress enum34
+  ];
 
   checkInputs = [
     cryptography_vectors

pkgs/development/python-modules/grpcio-tools/default.nix

@@ -9,6 +9,8 @@ buildPythonPackage rec {
     sha256 = "af40774c0275f5465f49fd92bfcd9831b19b013de4cc77b8fb38aea76fa6dce3";
   };
 
+  outputs = [ "out" "dev" ];
+
   enableParallelBuilding = true;
 
   propagatedBuildInputs = [ protobuf grpcio setuptools ];

pkgs/development/python-modules/grpcio/default.nix

@@ -6,6 +6,8 @@ buildPythonPackage rec {
   inherit (grpc) src version;
   pname = "grpcio";
 
+  outputs = [ "out" "dev" ];
+
   nativeBuildInputs = [ cython pkgconfig ]
                     ++ stdenv.lib.optional stdenv.isDarwin darwin.cctools;
 

pkgs/development/python-modules/jaraco_classes/default.nix

@@ -10,6 +10,8 @@ buildPythonPackage rec {
     sha256 = "1avsxzm5mwylmy2zbxq3xvn48z5djb0qy3hwv4ryncprivzri1n3";
   };
 
+  pythonNamespaces = [ "jaraco" ];
+
   nativeBuildInputs = [ setuptools_scm ];
   propagatedBuildInputs = [ six more-itertools ];
 

pkgs/development/python-modules/jaraco_collections/default.nix

@@ -10,6 +10,8 @@ buildPythonPackage rec {
     sha256 = "be570ef4f2e7290b757449395238fa63d70a9255574624e73c5ff9f1ee554721";
   };
 
+  pythonNamespaces = [ "jaraco" ];
+
   doCheck = false;
   buildInputs = [ setuptools_scm ];
   propagatedBuildInputs = [ six jaraco_classes jaraco_text ];

pkgs/development/python-modules/jaraco_functools/default.nix

@@ -17,6 +17,8 @@ buildPythonPackage rec {
 
   doCheck = false;
 
+  pythonNamespaces = [ "jaraco" ];
+
   meta = with lib; {
     description = "Additional functools in the spirit of stdlib's functools";
     homepage = "https://github.com/jaraco/jaraco.functools";

pkgs/development/python-modules/jaraco_itertools/default.nix

@@ -11,6 +11,8 @@ buildPythonPackage rec {
     sha256 = "6447d567f57efe5efea386265c7864652e9530830a1b80f43e60b4f222b9ab84";
   };
 
+  pythonNamespaces = [ "jaraco" ];
+
   nativeBuildInputs = [ setuptools_scm ];
 
   patches = [

pkgs/development/python-modules/jaraco_logging/default.nix

@@ -11,6 +11,8 @@ buildPythonPackage rec {
     sha256 = "31716fe84d3d5df39d95572942513bd4bf8ae0a478f64031eff4c2ea9e83434e";
   };
 
+  pythonNamespaces = [ "jaraco" ];
+
   nativeBuildInputs = [ setuptools_scm ];
   propagatedBuildInputs = [ tempora six ];
 

pkgs/development/python-modules/jaraco_stream/default.nix

@@ -3,10 +3,14 @@
 buildPythonPackage rec {
   pname = "jaraco.stream";
   version = "3.0.0";
+
   src = fetchPypi {
     inherit pname version;
     sha256 = "287e1cba9f278e0146fdded6bc40518930813a5584579769aeaa1d0bfd178a73";
   };
+
+  pythonNamespaces = [ "jaraco" ];
+
   doCheck = false;
   buildInputs = [ setuptools_scm ];
   propagatedBuildInputs = [ six ];

pkgs/development/python-modules/jaraco_text/default.nix

@@ -13,6 +13,8 @@ buildPythonPackage rec {
     sha256 = "1v0hz3h74m31jlbc5bxwkvrx1h2n7887bajrg1n1c3yc4q8qn1z5";
   };
 
+  pythonNamespaces = [ "jaraco" ];
+
   nativeBuildInputs =[ setuptools_scm ];
   propagatedBuildInputs = [
     jaraco_functools

pkgs/development/python-modules/memcached/default.nix

@@ -6,11 +6,12 @@
 }:
 
 buildPythonPackage rec {
-  pname = "memcached-1.51";
+  pname = "memcached";
   version = "1.51";
 
   src = if isPy3k then fetchPypi {
-    inherit pname version;
+    inherit version;
+    pname = "python3-${pname}";
     sha256 = "0na8b369q8fivh3y0nvzbvhh3lgvxiyyv9xp93cnkvwfsr8mkgkw";
   } else fetchurl {
     url = "http://ftp.tummy.com/pub/python-memcached/old-releases/python-${pname}-${version}.tar.gz";

pkgs/development/python-modules/numexpr/default.nix

@@ -19,12 +19,18 @@ buildPythonPackage rec {
     ln -s ${numpy.cfg} site.cfg
   '';
 
-  propagatedBuildInputs = [ numpy ];
+  nativeBuildInputs = [
+    numpy
+  ];
+
+  propagatedBuildInputs = [
+    numpy
+  ];
 
   checkPhase = ''
     runtest="$(pwd)/numexpr/tests/test_numexpr.py"
     pushd "$out"
-    ${python}/bin/${python.executable} "$runtest"
+    ${python.interpreter} "$runtest"
     popd
   '';
 

pkgs/development/python-modules/pybind11/default.nix

@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "pybind11";
-  version = "2.5.0";
+  version = "2.6.1";
 
   src = fetchFromGitHub {
     owner = "pybind";
     repo = pname;
     rev = "v${version}";
-    sha256 = "13hcj6g7k7yvj7nry2ar6f5mg58ln7frrvq1cg5f8mczxh1ch6zl";
+    sha256 = "TXljeRFonQwEmlIGMnTHwdfPsd9cMOVn5/1zb3tYBfI=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/python-modules/pyflakes/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchPypi, unittest2 }:
+{ stdenv, buildPythonPackage, fetchPypi, pythonOlder, unittest2 }:
 
 buildPythonPackage rec {
   pname = "pyflakes";
@@ -11,6 +11,9 @@ buildPythonPackage rec {
 
   checkInputs = [ unittest2 ];
 
+  # some tests are output dependent, which have changed slightly
+  doCheck = pythonOlder "3.9";
+
   meta = with stdenv.lib; {
     homepage = "https://launchpad.net/pyflakes";
     description = "A simple program which checks Python source files for errors";

pkgs/development/python-modules/pytest-testmon/default.nix

@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "pytest-testmon";
-  version = "1.0.3";
+  version = "1.0.2";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "927a73dd510b90a2e4a48ea4d37e82c4490b56caa745663262024ea0cd278169";
+    sha256 = "fdb016d953036051d1ef0e36569b7168cefa4914014789a65a4ffefc87f85ac5";
   };
 
   propagatedBuildInputs = [ coverage ];

pkgs/development/python-modules/seccomp/default.nix

@@ -0,0 +1,29 @@
+{ buildPythonPackage, lib
+, cython, libseccomp
+}:
+
+buildPythonPackage rec {
+  pname   = "libseccomp";
+  version = libseccomp.version;
+  src     = libseccomp.pythonsrc;
+
+  VERSION_RELEASE = version; # used by build system
+
+  nativeBuildInputs = [ cython ];
+  buildInputs = [ libseccomp ];
+
+  unpackCmd = "tar xf $curSrc";
+  doInstallCheck = true;
+
+  postPatch = ''
+    substituteInPlace ./setup.py \
+      --replace 'extra_objects=["../.libs/libseccomp.a"]' \
+                'libraries=["seccomp"]'
+  '';
+
+  meta = with lib; {
+    description = "Python bindings for libseccomp";
+    license     = with licenses; [ lgpl21 ];
+    maintainers = with maintainers; [ thoughtpolice ];
+  };
+}

pkgs/development/python-modules/sphinx/default.nix

@@ -32,11 +32,11 @@
 
 buildPythonPackage rec {
   pname = "sphinx";
-  version = "3.0.3";
+  version = "3.3.1";
   src = fetchPypi {
     pname = "Sphinx";
     inherit version;
-    sha256 = "0wpmqfx4mxv5kv9xxd6wyfsm8vcnp8p99h14q7b6if2mv69gvvb2";
+    sha256 = "1e8d592225447104d1172be415bc2972bd1357e3e12fdc76edf2261105db4300";
   };
   LC_ALL = "en_US.UTF-8";
 

pkgs/development/python-modules/tensorflow/1/bin.nix

@@ -2,7 +2,7 @@
 , lib
 , fetchurl
 , buildPythonPackage
-, isPy3k, pythonOlder, isPy38
+, isPy3k, pythonOlder, pythonAtLeast
 , astor
 , gast
 , google-pasta
@@ -50,8 +50,7 @@ in buildPythonPackage {
   inherit pname;
   inherit (packages) version;
   format = "wheel";
-
-  disabled = isPy38;
+  disabled = pythonAtLeast "3.8";
 
   src = let
     pyVerNoDot = lib.strings.stringAsChars (x: if x == "." then "" else x) python.pythonVersion;

pkgs/development/python-modules/tensorflow/2/bin.nix

@@ -2,7 +2,7 @@
 , lib
 , fetchurl
 , buildPythonPackage
-, isPy3k, pythonOlder, isPy38
+, isPy3k, pythonOlder, pythonAtLeast, isPy38
 , astor
 , gast
 , google-pasta
@@ -54,7 +54,7 @@ in buildPythonPackage {
   inherit (packages) version;
   format = "wheel";
 
-  disabled = isPy38;
+  disabled = pythonAtLeast "3.8";
 
   src = let
     pyVerNoDot = lib.strings.stringAsChars (x: if x == "." then "" else x) python.pythonVersion;

pkgs/development/python-modules/zstd/default.nix

@@ -1,4 +1,5 @@
 { stdenv, pkgconfig, fetchPypi, buildPythonPackage
+, buildPackages
 , zstd, pytest }:
 
 buildPythonPackage rec {
@@ -12,7 +13,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "/usr/bin/pkg-config" "${pkgconfig}/bin/${pkgconfig.targetPrefix}pkg-config"
+      --replace "/usr/bin/pkg-config" "${buildPackages.pkgconfig}/bin/${buildPackages.pkgconfig.targetPrefix}pkg-config"
   '';
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/development/tools/misc/gengetopt/default.nix

@@ -10,6 +10,10 @@ stdenv.mkDerivation rec {
   };
 
   doCheck = true;
+  # attempts to open non-existent file
+  preCheck = ''
+    rm tests/test_conf_parser_save.sh
+  '';
 
   enableParallelBuilding = true;
 

pkgs/os-specific/linux/kernel-headers/default.nix

@@ -69,12 +69,12 @@ let
 in {
   inherit makeLinuxHeaders;
 
-  linuxHeaders = let version = "5.5"; in
+  linuxHeaders = let version = "5.9.8"; in
     makeLinuxHeaders {
       inherit version;
       src = fetchurl {
         url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-        sha256 = "0c131fi6s7vgvka1c0597vnvcmwn1pp968rci5kq64iwj3pd9yx6";
+        sha256 = "19l67gzk97higd2cbggipcb0wi21pv0ag0mc4qh6cqk564xp6mkn";
       };
       patches = [
          ./no-relocs.patch # for building x86 kernel headers on non-ELF platforms

pkgs/os-specific/linux/libselinux/default.nix

@@ -1,26 +1,26 @@
 { stdenv, fetchurl, pcre, pkgconfig, libsepol
-, enablePython ? true, swig ? null, python ? null
+, enablePython ? true, swig ? null, python3 ? null
 , fts
 }:
 
-assert enablePython -> swig != null && python != null;
+assert enablePython -> swig != null && python3 != null;
 
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "libselinux";
-  version = "2.9";
+  version = "3.0";
   inherit (libsepol) se_release se_url;
 
   outputs = [ "bin" "out" "dev" "man" ] ++ optional enablePython "py";
 
   src = fetchurl {
     url = "${se_url}/${se_release}/libselinux-${version}.tar.gz";
-    sha256 = "14r69mgmz7najf9wbizvp68q56mqx4yjbkxjlbcqg5a47s3wik0v";
+    sha256 = "0cr4p0qkr4qd5z1x677vwhz6mlz55kxyijwi2dmrvbhxcw7v78if";
   };
 
-  nativeBuildInputs = [ pkgconfig ] ++ optionals enablePython [ swig python ];
-  buildInputs = [ libsepol pcre fts ] ++ optionals enablePython [ python ];
+  nativeBuildInputs = [ pkgconfig ] ++ optionals enablePython [ swig python3 ];
+  buildInputs = [ libsepol pcre fts ] ++ optionals enablePython [ python3 ];
 
   # drop fortify here since package uses it by default, leading to compile error:
   # command-line>:0:0: error: "_FORTIFY_SOURCE" redefined [-Werror]
@@ -35,14 +35,18 @@ stdenv.mkDerivation rec {
     "MAN3DIR=$(man)/share/man/man3"
     "MAN5DIR=$(man)/share/man/man5"
     "MAN8DIR=$(man)/share/man/man8"
-    "PYTHON=${python.pythonForBuild}/bin/python"
-    "PYTHONLIBDIR=$(py)/${python.sitePackages}"
+    "PYTHON=${python3.pythonForBuild}/bin/python"
+    "PYTHONLIBDIR=$(py)/${python3.sitePackages}"
     "SBINDIR=$(bin)/sbin"
     "SHLIBDIR=$(out)/lib"
 
     "LIBSEPOLA=${stdenv.lib.getLib libsepol}/lib/libsepol.a"
   ];
 
+  preInstall = ''
+    mkdir -p $py/${python3.sitePackages}/selinux
+  '';
+
   installTargets = [ "install" ] ++ optional enablePython "install-pywrap";
 
   meta = removeAttrs libsepol.meta ["outputsToInstall"] // {

pkgs/os-specific/linux/libsepol/default.nix

@@ -2,15 +2,15 @@
 
 stdenv.mkDerivation rec {
   pname = "libsepol";
-  version = "2.9";
-  se_release = "20190315";
+  version = "3.0";
+  se_release = "20191204";
   se_url = "https://github.com/SELinuxProject/selinux/releases/download";
 
   outputs = [ "bin" "out" "dev" "man" ];
 
   src = fetchurl {
     url = "${se_url}/${se_release}/libsepol-${version}.tar.gz";
-    sha256 = "0p8x7w73jn1nysx1d7416wqrhbi0r6isrjxib7jf68fi72q14jx3";
+    sha256 = "0ygb6dh5lng91xs6xiqf5v0nxa68qmjc787p0s5h9w89364f2yjv";
   };
 
   nativeBuildInputs = [ flex ];

pkgs/os-specific/linux/systemd/default.nix

@@ -282,9 +282,9 @@ stdenv.mkDerivation {
     "-Dmount-path=${util-linux}/bin/mount"
     "-Dumount-path=${util-linux}/bin/umount"
     "-Dcreate-log-dirs=false"
-    # Upstream uses cgroupsv2 by default. To support docker and other
-    # container managers we still need v1.
-    "-Ddefault-hierarchy=hybrid"
+
+    # Use cgroupsv2. This is already the upstream default, but better be explicit.
+    "-Ddefault-hierarchy=unified"
     # Upstream defaulted to disable manpages since they optimize for the much
     # more frequent development builds
     "-Dman=true"

pkgs/servers/sql/postgresql/default.nix

@@ -68,7 +68,6 @@ let
         ./patches/specify_pkglibdir_at_runtime.patch
         ./patches/findstring.patch
       ]
-      ++ lib.optional (atLeast "10") ./patches/stabilize-timetz-dst.patch
       ++ lib.optional stdenv.isLinux (if atLeast "13" then ./patches/socketdir-in-run-13.patch else ./patches/socketdir-in-run.patch);
 
     installTargets = [ "install-world" ];
@@ -188,49 +187,49 @@ let
 in self: {
 
   postgresql_9_5 = self.callPackage generic {
-    version = "9.5.23";
+    version = "9.5.24";
     psqlSchema = "9.5";
-    sha256 = "0rl31jc3kg2wq6hazyd297gnmx3cibjvivllbsivii2m6dzgl573";
+    sha256 = "0an2k4m1da96897hyxlff8p4p63wg4dffwsfg57aib7mp4yzsp06";
     this = self.postgresql_9_5;
     inherit self;
   };
 
   postgresql_9_6 = self.callPackage generic {
-    version = "9.6.19";
+    version = "9.6.20";
     psqlSchema = "9.6";
-    sha256 = "1c2wnl5bbpjs1s1rpzvlnzsqlpb0p823zw7s38nhpgnxrja3myb1";
+    sha256 = "1dkv916y7vrfbygrfbfvs6y3fxaysnh32i5j88nvcnnl16jcn21x";
     this = self.postgresql_9_6;
     inherit self;
   };
 
   postgresql_10 = self.callPackage generic {
-    version = "10.14";
+    version = "10.15";
     psqlSchema = "10.0"; # should be 10, but changing it is invasive
-    sha256 = "0fxj30jvwq5pqpbj97vhlxgmn2ah59a78s9jyjr7vxyqj7sdh71q";
+    sha256 = "0zhzj9skag1pgqas2rnd217vj41ilaalqna17j47gyngpvhbqmjr";
     this = self.postgresql_10;
     inherit self;
   };
 
   postgresql_11 = self.callPackage generic {
-    version = "11.9";
+    version = "11.10";
     psqlSchema = "11.1"; # should be 11, but changing it is invasive
-    sha256 = "0db6pfphc5rp12abnkvv2l9pbl7bdyf3hhiwj8ghjwh35skqlq9m";
+    sha256 = "16bqp6ds37kbwqx7mk5gg3y6gv59wq6xz33iqwxldzk20vwd5rhk";
     this = self.postgresql_11;
     inherit self;
   };
 
   postgresql_12 = self.callPackage generic {
-    version = "12.4";
+    version = "12.5";
     psqlSchema = "12";
-    sha256 = "1k06wryy8p4s1fim9qafcjlak3f58l0wqaqnrccr9x9j5jz3zsdy";
+    sha256 = "15gzg778da23sbfmy7sqg443f9ny480301lm7i3vay4m3ls2a3dx";
     this = self.postgresql_12;
     inherit self;
   };
 
   postgresql_13 = self.callPackage generic {
-    version = "13.0";
+    version = "13.1";
     psqlSchema = "13";
-    sha256 = "15i2b7m9a9430idqdgvrcyx66cpxz0v2d81nfqcm8ss3inz51rw0";
+    sha256 = "07z6zwr58dckaa97yl9ml240z83d1lhgaxw9aq49i8lsp21mqd0j";
     this = self.postgresql_13;
     inherit self;
   };

pkgs/servers/sql/postgresql/patches/stabilize-timetz-dst.patch

@@ -1,117 +0,0 @@
-From 4a071afbd056282746a5bc9362e87f579a56402d Mon Sep 17 00:00:00 2001
-From: Tom Lane <tgl@sss.pgh.pa.us>
-Date: Thu, 29 Oct 2020 15:28:14 -0400
-Subject: [PATCH 1/1] Stabilize timetz test across DST transitions.
-
-The timetz test cases I added in commit a9632830b were unintentionally
-sensitive to whether or not DST is active in the PST8PDT time zone.
-Thus, they'll start failing this coming weekend, as reported by
-Bernhard M. Wiedemann in bug #16689.  Fortunately, DST-awareness is
-not significant to the purpose of these test cases, so we can just
-force them all to PDT (DST hours) to preserve stability of the
-results.
-
-Back-patch to v10, as the prior patch was.
-
-Discussion: https://postgr.es/m/16689-57701daa23b377bf@postgresql.org
-Git viewer: https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=4a071afbd056282746a5bc9362e87f579a56402d;hp=f90149e6285aaae6b48559afce1bd638ee26c33e
----
- src/test/regress/expected/timetz.out | 32 ++++++++++++++--------------
- src/test/regress/sql/timetz.sql      | 16 +++++++-------
- 2 files changed, 24 insertions(+), 24 deletions(-)
-
-diff --git a/src/test/regress/expected/timetz.out b/src/test/regress/expected/timetz.out
-index 038bb5fa09..1ab5ed5105 100644
---- a/src/test/regress/expected/timetz.out
-+++ b/src/test/regress/expected/timetz.out
-@@ -91,45 +91,45 @@ SELECT f1 AS "Ten" FROM TIMETZ_TBL WHERE f1 >= '00:00-07';
- (12 rows)
- 
- -- Check edge cases
--SELECT '23:59:59.999999'::timetz;
-+SELECT '23:59:59.999999 PDT'::timetz;
-        timetz       
- --------------------
-  23:59:59.999999-07
- (1 row)
- 
--SELECT '23:59:59.9999999'::timetz;  -- rounds up
-+SELECT '23:59:59.9999999 PDT'::timetz;  -- rounds up
-    timetz    
- -------------
-  24:00:00-07
- (1 row)
- 
--SELECT '23:59:60'::timetz;  -- rounds up
-+SELECT '23:59:60 PDT'::timetz;  -- rounds up
-    timetz    
- -------------
-  24:00:00-07
- (1 row)
- 
--SELECT '24:00:00'::timetz;  -- allowed
-+SELECT '24:00:00 PDT'::timetz;  -- allowed
-    timetz    
- -------------
-  24:00:00-07
- (1 row)
- 
--SELECT '24:00:00.01'::timetz;  -- not allowed
--ERROR:  date/time field value out of range: "24:00:00.01"
--LINE 1: SELECT '24:00:00.01'::timetz;
-+SELECT '24:00:00.01 PDT'::timetz;  -- not allowed
-+ERROR:  date/time field value out of range: "24:00:00.01 PDT"
-+LINE 1: SELECT '24:00:00.01 PDT'::timetz;
-                ^
--SELECT '23:59:60.01'::timetz;  -- not allowed
--ERROR:  date/time field value out of range: "23:59:60.01"
--LINE 1: SELECT '23:59:60.01'::timetz;
-+SELECT '23:59:60.01 PDT'::timetz;  -- not allowed
-+ERROR:  date/time field value out of range: "23:59:60.01 PDT"
-+LINE 1: SELECT '23:59:60.01 PDT'::timetz;
-                ^
--SELECT '24:01:00'::timetz;  -- not allowed
--ERROR:  date/time field value out of range: "24:01:00"
--LINE 1: SELECT '24:01:00'::timetz;
-+SELECT '24:01:00 PDT'::timetz;  -- not allowed
-+ERROR:  date/time field value out of range: "24:01:00 PDT"
-+LINE 1: SELECT '24:01:00 PDT'::timetz;
-                ^
--SELECT '25:00:00'::timetz;  -- not allowed
--ERROR:  date/time field value out of range: "25:00:00"
--LINE 1: SELECT '25:00:00'::timetz;
-+SELECT '25:00:00 PDT'::timetz;  -- not allowed
-+ERROR:  date/time field value out of range: "25:00:00 PDT"
-+LINE 1: SELECT '25:00:00 PDT'::timetz;
-                ^
- --
- -- TIME simple math
-diff --git a/src/test/regress/sql/timetz.sql b/src/test/regress/sql/timetz.sql
-index b699e4b03c..ce763d89e8 100644
---- a/src/test/regress/sql/timetz.sql
-+++ b/src/test/regress/sql/timetz.sql
-@@ -36,14 +36,14 @@ SELECT f1 AS "None" FROM TIMETZ_TBL WHERE f1 < '00:00-07';
- SELECT f1 AS "Ten" FROM TIMETZ_TBL WHERE f1 >= '00:00-07';
- 
- -- Check edge cases
--SELECT '23:59:59.999999'::timetz;
--SELECT '23:59:59.9999999'::timetz;  -- rounds up
--SELECT '23:59:60'::timetz;  -- rounds up
--SELECT '24:00:00'::timetz;  -- allowed
--SELECT '24:00:00.01'::timetz;  -- not allowed
--SELECT '23:59:60.01'::timetz;  -- not allowed
--SELECT '24:01:00'::timetz;  -- not allowed
--SELECT '25:00:00'::timetz;  -- not allowed
-+SELECT '23:59:59.999999 PDT'::timetz;
-+SELECT '23:59:59.9999999 PDT'::timetz;  -- rounds up
-+SELECT '23:59:60 PDT'::timetz;  -- rounds up
-+SELECT '24:00:00 PDT'::timetz;  -- allowed
-+SELECT '24:00:00.01 PDT'::timetz;  -- not allowed
-+SELECT '23:59:60.01 PDT'::timetz;  -- not allowed
-+SELECT '24:01:00 PDT'::timetz;  -- not allowed
-+SELECT '25:00:00 PDT'::timetz;  -- not allowed
- 
- --
- -- TIME simple math
--- 
-2.20.1

pkgs/servers/x11/xorg/default.nix

@@ -1157,7 +1157,7 @@ lib.makeScope newScope (self: with self; {
     meta.platforms = stdenv.lib.platforms.unix;
   }) {};
 
-  libxcb = callPackage ({ stdenv, pkgconfig, fetchurl, libxslt, libpthreadstubs, libXau, xcbproto, libXdmcp, python }: stdenv.mkDerivation {
+  libxcb = callPackage ({ stdenv, pkgconfig, fetchurl, libxslt, libpthreadstubs, libXau, xcbproto, libXdmcp, python3 }: stdenv.mkDerivation {
     name = "libxcb-1.14";
     builder = ./builder.sh;
     src = fetchurl {
@@ -1165,7 +1165,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0d2chjgyn5lr9sfhacfvqgnj9l9faz11vn322a06jd6lk3dxcpm5";
     };
     hardeningDisable = [ "bindnow" "relro" ];
-    nativeBuildInputs = [ pkgconfig python ];
+    nativeBuildInputs = [ pkgconfig python3 ];
     buildInputs = [ libxslt libpthreadstubs libXau xcbproto libXdmcp ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) {};
@@ -1430,7 +1430,7 @@ lib.makeScope newScope (self: with self; {
     meta.platforms = stdenv.lib.platforms.unix;
   }) {};
 
-  xcbproto = callPackage ({ stdenv, pkgconfig, fetchurl, python }: stdenv.mkDerivation {
+  xcbproto = callPackage ({ stdenv, pkgconfig, fetchurl, python3 }: stdenv.mkDerivation {
     name = "xcb-proto-1.14.1";
     builder = ./builder.sh;
     src = fetchurl {
@@ -1438,7 +1438,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1hzwazgyywd9mz4mjj1yv8ski27qqx7ypmyr27m39hrajyddsjph";
     };
     hardeningDisable = [ "bindnow" "relro" ];
-    nativeBuildInputs = [ pkgconfig python ];
+    nativeBuildInputs = [ pkgconfig python3 ];
     buildInputs = [ ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) {};
@@ -1963,7 +1963,7 @@ lib.makeScope newScope (self: with self; {
     meta.platforms = stdenv.lib.platforms.unix;
   }) {};
 
-  xf86videointel = callPackage ({ stdenv, pkgconfig, fetchurl, cairo, xorgproto, libdrm, libpng, udev, libpciaccess, libX11, xcbutil, libxcb, libXcursor, libXdamage, libXext, libXfixes, xorgserver, libXrandr, libXrender, libxshmfence, libXtst, libXvMC, libXv }: stdenv.mkDerivation {
+  xf86videointel = callPackage ({ stdenv, pkgconfig, fetchurl, cairo, xorgproto, libdrm, libpng, udev, libpciaccess, libX11, xcbutil, libxcb, libXcursor, libXdamage, libXext, libXfixes, xorgserver, libXrandr, libXrender, libxshmfence, libXtst, libXvMC }: stdenv.mkDerivation {
     name = "xf86-video-intel-2.99.917";
     builder = ./builder.sh;
     src = fetchurl {
@@ -1972,7 +1972,7 @@ lib.makeScope newScope (self: with self; {
     };
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ cairo xorgproto libdrm libpng udev libpciaccess libX11 xcbutil libxcb libXcursor libXdamage libXext libXfixes xorgserver libXrandr libXrender libxshmfence libXtst libXvMC libXv ];
+    buildInputs = [ cairo xorgproto libdrm libpng udev libpciaccess libX11 xcbutil libxcb libXcursor libXdamage libXext libXfixes xorgserver libXrandr libXrender libxshmfence libXtst libXvMC ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) {};
 
@@ -2522,7 +2522,7 @@ lib.makeScope newScope (self: with self; {
     meta.platforms = stdenv.lib.platforms.unix;
   }) {};
 
-  xkeyboardconfig = callPackage ({ stdenv, python3, pkgconfig, fetchurl, libX11, xorgproto }: stdenv.mkDerivation {
+  xkeyboardconfig = callPackage ({ stdenv, pkgconfig, fetchurl, libX11, xorgproto, python3 }: stdenv.mkDerivation {
     name = "xkeyboard-config-2.31";
     builder = ./builder.sh;
     src = fetchurl {
@@ -2532,9 +2532,6 @@ lib.makeScope newScope (self: with self; {
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkgconfig python3 ];
     buildInputs = [ libX11 xorgproto ];
-    prePatch = ''
-      patchShebangs rules/merge.py
-    '';
     meta.platforms = stdenv.lib.platforms.unix;
   }) {};
 

pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl

@@ -25,7 +25,7 @@ my %pcMap;
 my %extraAttrs;
 
 
-my @missingPCs = ("fontconfig", "libdrm", "libXaw", "zlib", "perl", "python", "mkfontscale", "bdftopcf", "libxslt", "openssl", "gperf", "m4", "libinput", "libevdev", "mtdev", "xorgproto", "cairo", "gettext" );
+my @missingPCs = ("fontconfig", "libdrm", "libXaw", "zlib", "perl", "python3", "mkfontscale", "bdftopcf", "libxslt", "openssl", "gperf", "m4", "libinput", "libevdev", "mtdev", "xorgproto", "cairo", "gettext" );
 $pcMap{$_} = $_ foreach @missingPCs;
 $pcMap{"freetype2"} = "freetype";
 $pcMap{"libpng12"} = "libpng";
@@ -161,7 +161,7 @@ while (<>) {
     }
 
     if ($file =~ /AM_PATH_PYTHON/) {
-        push @nativeRequires, "python";
+        push @nativeRequires, "python3";
     }
 
     if ($file =~ /AC_PATH_PROG\(FCCACHE/) {

pkgs/servers/x11/xorg/overrides.nix

@@ -4,7 +4,7 @@
   freetype, tradcpp, fontconfig, meson, ninja, ed, fontforge,
   libGL, spice-protocol, zlib, libGLU, dbus, libunwind, libdrm,
   mesa, udev, bootstrap_cmds, bison, flex, clangStdenv, autoreconfHook,
-  mcpp, epoxy, openssl, pkgconfig, llvm_6, python3, libxslt,
+  mcpp, epoxy, openssl, pkgconfig, llvm_6, libxslt,
   ApplicationServices, Carbon, Cocoa, Xplugin
 }:
 
@@ -73,9 +73,7 @@ self: super:
 
   mkfontdir = self.mkfontscale;
 
-  libxcb = (super.libxcb.override {
-    python = python3;
-  }).overrideAttrs (attrs: {
+  libxcb = super.libxcb.overrideAttrs (attrs: {
     configureFlags = [ "--enable-xkb" "--enable-xinput" ];
     outputs = [ "out" "dev" "man" "doc" ];
   });
@@ -332,10 +330,6 @@ self: super:
     buildInputs = attrs.buildInputs ++ [ freetype fontconfig ];
   });
 
-  xcbproto = super.xcbproto.override {
-    python = python3;
-  };
-
   xcbutil = super.xcbutil.overrideAttrs (attrs: {
     outputs = [ "out" "dev" ];
   });
@@ -463,8 +457,8 @@ self: super:
   });
 
   xkeyboardconfig = super.xkeyboardconfig.overrideAttrs (attrs: {
+    prePatch = "patchShebangs rules/merge.py";
     nativeBuildInputs = attrs.nativeBuildInputs ++ [ intltool libxslt ];
-
     configureFlags = [ "--with-xkb-rules-symlink=xorg" ];
 
     # 1: compatibility for X11/xkb location
@@ -790,7 +784,7 @@ self: super:
       rev = "f66d39544bb8339130c96d282a80f87ca1606caf";
       sha256 = "14rwbbn06l8qpx7s5crxghn80vgcx8jmfc7qvivh72d81r0kvywl";
     };
-    buildInputs = attrs.buildInputs ++ [self.libXfixes self.libXScrnSaver self.pixman];
+    buildInputs = attrs.buildInputs ++ [ self.libXScrnSaver self.libXfixes self.libXv self.pixman ];
     nativeBuildInputs = attrs.nativeBuildInputs ++ [autoreconfHook self.utilmacros];
     configureFlags = [ "--with-default-dri=3" "--enable-tools" ];
 

pkgs/servers/x11/xorg/tarballs.list

@@ -75,7 +75,7 @@ mirror://xorg/individual/app/xwininfo-1.1.4.tar.bz2
 mirror://xorg/individual/app/xwud-1.0.5.tar.bz2
 mirror://xorg/individual/data/xbitmaps-1.1.2.tar.bz2
 mirror://xorg/individual/data/xcursor-themes-1.0.6.tar.bz2
-mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.27.tar.bz2
+mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.31.tar.bz2
 mirror://xorg/individual/doc/xorg-docs-1.7.1.tar.bz2
 mirror://xorg/individual/doc/xorg-sgml-doctools-1.11.tar.bz2
 mirror://xorg/individual/driver/xf86-input-evdev-2.10.6.tar.bz2

pkgs/stdenv/generic/default.nix

@@ -70,6 +70,7 @@ let
       ../../build-support/setup-hooks/move-sbin.sh
       ../../build-support/setup-hooks/move-lib64.sh
       ../../build-support/setup-hooks/set-source-date-epoch-to-latest.sh
+      ../../build-support/setup-hooks/reproducible-builds.sh
       # TODO use lib.optional instead
       (if hasCC then cc else null)
     ];

pkgs/tools/filesystems/ceph/default.nix

@@ -1,4 +1,5 @@
 { stdenv, runCommand, fetchurl
+, fetchpatch
 , ensureNewerSourcesHook
 , cmake, pkgconfig
 , which, git
@@ -134,6 +135,11 @@ in rec {
     patches = [
       ./0000-fix-SPDK-build-env.patch
       ./ceph-glibc-2-32-sigdescr_np.patch
+      (fetchpatch {
+        name = "CVE-2020-25660";
+        url = "https://github.com/ceph/ceph/compare/2c93eff00150f0cc5f106a559557a58d3d7b6f1f...6c14c2fb5650426285428dfe6ca1597e5ea1d07d.patch";
+        sha256 = "032hl15q34gq7y6bnljmklpsbd3bpkzmg7r3w0x0ly786iz7zwhm";
+      })
     ];
 
     nativeBuildInputs = [

pkgs/tools/networking/modem-manager/default.nix

@@ -3,12 +3,12 @@
 
 stdenv.mkDerivation rec {
   pname = "modem-manager";
-  version = "1.12.10";
+  version = "1.14.8";
 
   package = "ModemManager";
   src = fetchurl {
     url = "https://www.freedesktop.org/software/${package}/${package}-${version}.tar.xz";
-    sha256 = "1apq9camys2gaw6y6ic1ld20cncfwpmxnzvh4j5zkbbjpf5hbcxj";
+    sha256 = "15cjy7zzsxagx649vz0990avin47vpgdmm4ss2msggdla6x2c6py";
   };
 
   nativeBuildInputs = [ vala gobject-introspection gettext pkgconfig ];

pkgs/tools/networking/openssh/default.nix

@@ -53,6 +53,9 @@ stdenv.mkDerivation rec {
       ./dont_create_privsep_path.patch
 
       ./ssh-keysign.patch
+
+      # See https://github.com/openssh/openssh-portable/pull/206
+      ./ssh-copy-id-fix-eof.patch
     ]
     ++ optional withGssapiPatches (assert withKerberos; gssapiPatch);
 

pkgs/tools/networking/openssh/ssh-copy-id-fix-eof.patch

@@ -0,0 +1,21 @@
+diff --git a/contrib/ssh-copy-id b/contrib/ssh-copy-id
+index 392f64f..a769077 100644
+--- a/contrib/ssh-copy-id
++++ b/contrib/ssh-copy-id
+@@ -247,7 +247,7 @@ installkeys_sh() {
+   #    the -z `tail ...` checks for a trailing newline. The echo adds one if was missing
+   #    the cat adds the keys we're getting via STDIN
+   #    and if available restorecon is used to restore the SELinux context
+-  INSTALLKEYS_SH=$(tr '\t\n' ' ' <<-EOF)
++  INSTALLKEYS_SH=$(tr '\t\n' ' ' <<-EOF
+ 	cd;
+ 	umask 077;
+ 	mkdir -p $(dirname "${AUTH_KEY_FILE}") &&
+@@ -258,6 +258,7 @@ installkeys_sh() {
+ 	  restorecon -F .ssh ${AUTH_KEY_FILE};
+ 	fi
+ EOF
++  )
+ 
+   # to defend against quirky remote shells: use 'exec sh -c' to get POSIX;
+   printf "exec sh -c '%s'" "${INSTALLKEYS_SH}"

pkgs/tools/text/gnugrep/default.nix

@@ -5,7 +5,7 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-let version = "3.5"; in
+let version = "3.6"; in
 
 stdenv.mkDerivation {
   pname = "gnugrep";
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://gnu/grep/grep-${version}.tar.xz";
-    sha256 = "0jm4hynsqf32rw1j3kv239wzg47qm6glqh6841ar9ay20xvwfamq";
+    sha256 = "0gipv6bzkm1aihj0ncqpyh164xrzgcxcv9r1kwzyk2g1mzl1azk6";
   };
 
   # Perl is needed for testing

pkgs/tools/typesetting/xmlto/default.nix

@@ -3,9 +3,10 @@
 , bash, getopt, makeWrapper }:
 
 stdenv.mkDerivation rec {
-  name = "xmlto-0.0.28";
+  pname = "xmlto";
+  version = "0.0.28";
   src = fetchurl {
-    url = "http://fedorahosted.org/releases/x/m/xmlto/${name}.tar.bz2";
+    url = "https://releases.pagure.org/${pname}/${pname}-${version}.tar.bz2";
     sha256 = "0xhj8b2pwp4vhl9y16v3dpxpsakkflfamr191mprzsspg4xdyc0i";
   };
 

pkgs/top-level/all-packages.nix

@@ -8663,6 +8663,42 @@ in
     jdk = jdk8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
   };
 
+  adoptopenjdk-bin-15-packages-linux = import ../development/compilers/adoptopenjdk-bin/jdk15-linux.nix;
+  adoptopenjdk-bin-15-packages-darwin = import ../development/compilers/adoptopenjdk-bin/jdk15-darwin.nix;
+
+  adoptopenjdk-hotspot-bin-15 = if stdenv.isLinux
+    then callPackage adoptopenjdk-bin-15-packages-linux.jdk-hotspot {}
+    else callPackage adoptopenjdk-bin-15-packages-darwin.jdk-hotspot {};
+  adoptopenjdk-jre-hotspot-bin-15 = if stdenv.isLinux
+    then callPackage adoptopenjdk-bin-15-packages-linux.jre-hotspot {}
+    else callPackage adoptopenjdk-bin-15-packages-darwin.jre-hotspot {};
+
+  adoptopenjdk-openj9-bin-15 = if stdenv.isLinux
+    then callPackage adoptopenjdk-bin-15-packages-linux.jdk-openj9 {}
+    else callPackage adoptopenjdk-bin-15-packages-darwin.jdk-openj9 {};
+
+  adoptopenjdk-jre-openj9-bin-15 = if stdenv.isLinux
+    then callPackage adoptopenjdk-bin-15-packages-linux.jre-openj9 {}
+    else callPackage adoptopenjdk-bin-15-packages-darwin.jre-openj9 {};
+
+  adoptopenjdk-bin-14-packages-linux = import ../development/compilers/adoptopenjdk-bin/jdk14-linux.nix;
+  adoptopenjdk-bin-14-packages-darwin = import ../development/compilers/adoptopenjdk-bin/jdk14-darwin.nix;
+
+  adoptopenjdk-hotspot-bin-14 = if stdenv.isLinux
+    then callPackage adoptopenjdk-bin-14-packages-linux.jdk-hotspot {}
+    else callPackage adoptopenjdk-bin-14-packages-darwin.jdk-hotspot {};
+  adoptopenjdk-jre-hotspot-bin-14 = if stdenv.isLinux
+    then callPackage adoptopenjdk-bin-14-packages-linux.jre-hotspot {}
+    else callPackage adoptopenjdk-bin-14-packages-darwin.jre-hotspot {};
+
+  adoptopenjdk-openj9-bin-14 = if stdenv.isLinux
+    then callPackage adoptopenjdk-bin-14-packages-linux.jdk-openj9 {}
+    else callPackage adoptopenjdk-bin-14-packages-darwin.jdk-openj9 {};
+
+  adoptopenjdk-jre-openj9-bin-14 = if stdenv.isLinux
+    then callPackage adoptopenjdk-bin-14-packages-linux.jre-openj9 {}
+    else callPackage adoptopenjdk-bin-14-packages-darwin.jre-openj9 {};
+
   adoptopenjdk-bin-13-packages-linux = import ../development/compilers/adoptopenjdk-bin/jdk13-linux.nix;
   adoptopenjdk-bin-13-packages-darwin = import ../development/compilers/adoptopenjdk-bin/jdk13-darwin.nix;
 
@@ -9933,15 +9969,15 @@ in
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
     llvmPackages = if stdenv.cc.isClang then llvmPackages_5 else llvmPackages_10;
   };
-  rust_1_47 = callPackage ../development/compilers/rust/1_47.nix {
+  rust_1_48 = callPackage ../development/compilers/rust/1_48.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
     llvmPackages = if stdenv.cc.isClang then llvmPackages_5 else llvmPackages_11;
   };
-  rust = rust_1_47;
+  rust = rust_1_48;
 
   rustPackages_1_45 = rust_1_45.packages.stable;
-  rustPackages_1_47 = rust_1_47.packages.stable;
-  rustPackages = rustPackages_1_47;
+  rustPackages_1_48 = rust_1_48.packages.stable;
+  rustPackages = rustPackages_1_48;
 
   inherit (rustPackages) cargo clippy rustc rustPlatform;
 
@@ -10550,11 +10586,11 @@ in
   inherit (pythonInterpreters) python27 python36 python37 python38 python39 python310 python3Minimal pypy27 pypy36;
 
   # Python package sets.
-  python27Packages = lib.hiPrioSet (recurseIntoAttrs python27.pkgs);
+  python27Packages = python27.pkgs;
   python36Packages = python36.pkgs;
   python37Packages = recurseIntoAttrs python37.pkgs;
   python38Packages = recurseIntoAttrs python38.pkgs;
-  python39Packages = python39.pkgs;
+  python39Packages = recurseIntoAttrs python39.pkgs;
   python310Packages = python310.pkgs;
   pypyPackages = pypy.pkgs;
   pypy2Packages = pypy2.pkgs;
@@ -16055,9 +16091,7 @@ in
 
   taglib-sharp = callPackage ../development/libraries/taglib-sharp { };
 
-  talloc = callPackage ../development/libraries/talloc {
-    python = buildPackages.python3;
-  };
+  talloc = callPackage ../development/libraries/talloc { };
 
   tclap = callPackage ../development/libraries/tclap {};
 
@@ -18617,9 +18651,7 @@ in
 
   keyutils = callPackage ../os-specific/linux/keyutils { };
 
-  libselinux = callPackage ../os-specific/linux/libselinux {
-    python = python37;
-  };
+  libselinux = callPackage ../os-specific/linux/libselinux { };
 
   libsemanage = callPackage ../os-specific/linux/libsemanage {
     python = python3;

pkgs/top-level/python-packages.nix

@@ -3465,13 +3465,13 @@ in {
       p.overrideAttrs (super: {
         meta = super.meta // {
           outputsToInstall = [ "py" ];
-          broken = (super.meta.broken or false) || pythonAtLeast "3.8";
+          broken = super.meta.broken or isPy27;
         };
       }))
     (p:
       p.override {
         enablePython = true;
-        inherit python;
+        python3 = python;
       })
     (p: p.py)
   ];
@@ -6570,6 +6570,8 @@ in {
 
   seabreeze = callPackage ../development/python-modules/seabreeze { };
 
+  seccomp = callPackage ../development/python-modules/seccomp { };
+
   secp256k1 = callPackage ../development/python-modules/secp256k1 { inherit (pkgs) secp256k1 pkgconfig; };
 
   secretstorage = if isPy3k then