Merge master into haskell-updates

2 years ago · fe2a5e2ebb
parent 076cf3c73c bf97f8474a
commit fe2a5e2ebb
345 changed files with 3836 additions and 2200 deletions
--- a/.gitignore
+++ b/.gitignore
@ -5,13 +5,13 @@
 .idea/
 .vscode/
 outputs/
-result
 result-*
-source/
 /doc/NEWS.html
 /doc/NEWS.txt
 /doc/manual.html
 /doc/manual.pdf
+/result
+/source/
 .version-suffix

 .DS_Store
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@ -8,9 +8,9 @@

 Several versions of the Python interpreter are available on Nix, as well as a
 high amount of packages. The attribute `python3` refers to the default
-interpreter, which is currently CPython 3.9. The attribute `python` refers to
+interpreter, which is currently CPython 3.10. The attribute `python` refers to
 CPython 2.7 for backwards-compatibility. It is also possible to refer to
-specific versions, e.g. `python38` refers to CPython 3.8, and `pypy` refers to
+specific versions, e.g. `python39` refers to CPython 3.9, and `pypy` refers to
 the default PyPy interpreter.

 Python is used a lot, and in different ways. This affects also how it is
@ -26,10 +26,10 @@ however, are in separate sets, with one set per interpreter version.
 The interpreters have several common attributes. One of these attributes is
 `pkgs`, which is a package set of Python libraries for this specific
 interpreter. E.g., the `toolz` package corresponding to the default interpreter
-is `python.pkgs.toolz`, and the CPython 3.8 version is `python38.pkgs.toolz`.
+is `python.pkgs.toolz`, and the CPython 3.9 version is `python39.pkgs.toolz`.
 The main package set contains aliases to these package sets, e.g.
-`pythonPackages` refers to `python.pkgs` and `python38Packages` to
-`python38.pkgs`.
+`pythonPackages` refers to `python.pkgs` and `python39Packages` to
+`python39.pkgs`.

 #### Installing Python and packages {#installing-python-and-packages}

@ -54,7 +54,7 @@ with `python.buildEnv` or `python.withPackages` where the interpreter and other
 executables are wrapped to be able to find each other and all of the modules.

 In the following examples we will start by creating a simple, ad-hoc environment
-with a nix-shell that has `numpy` and `toolz` in Python 3.8; then we will create
+with a nix-shell that has `numpy` and `toolz` in Python 3.9; then we will create
 a re-usable environment in a single-file Python script; then we will create a
 full Python environment for development with this same environment.

@ -70,10 +70,10 @@ temporary shell session with a Python and a *precise* list of packages (plus
 their runtime dependencies), with no other Python packages in the Python
 interpreter's scope.

-To create a Python 3.8 session with `numpy` and `toolz` available, run:
+To create a Python 3.9 session with `numpy` and `toolz` available, run:

 ```sh
-$ nix-shell -p 'python38.withPackages(ps: with ps; [ numpy toolz ])'
+$ nix-shell -p 'python39.withPackages(ps: with ps; [ numpy toolz ])'
 ```

 By default `nix-shell` will start a `bash` session with this interpreter in our
@ -81,8 +81,8 @@ By default `nix-shell` will start a `bash` session with this interpreter in our

 ```Python console
 [nix-shell:~/src/nixpkgs]$ python3
-Python 3.8.1 (default, Dec 18 2019, 19:06:26)
-[GCC 9.2.0] on linux
+Python 3.9.12 (main, Mar 23 2022, 21:36:19)
+[GCC 11.3.0] on linux
 Type "help", "copyright", "credits" or "license" for more information.
 >>> import numpy; import toolz
 ```
@ -102,13 +102,16 @@ will still get 1 wrapped Python interpreter. We can start the interpreter
 directly like so:

 ```sh
-$ nix-shell -p 'python38.withPackages(ps: with ps; [ numpy toolz requests ])' --run python3
-these derivations will be built:
-  /nix/store/xbdsrqrsfa1yva5s7pzsra8k08gxlbz1-python3-3.8.1-env.drv
-building '/nix/store/xbdsrqrsfa1yva5s7pzsra8k08gxlbz1-python3-3.8.1-env.drv'...
-created 277 symlinks in user environment
-Python 3.8.1 (default, Dec 18 2019, 19:06:26)
-[GCC 9.2.0] on linux
+$ nix-shell -p "python39.withPackages (ps: with ps; [ numpy toolz requests ])" --run python3
+this derivation will be built:
+  /nix/store/mpn7k6bkjl41fm51342rafaqfsl10qs4-python3-3.9.12-env.drv
+this path will be fetched (0.09 MiB download, 0.41 MiB unpacked):
+  /nix/store/5gaiacnzi096b6prc6aa1pwrhncmhc8b-python3.9-toolz-0.11.2
+copying path '/nix/store/5gaiacnzi096b6prc6aa1pwrhncmhc8b-python3.9-toolz-0.11.2' from 'https://cache.nixos.org'...
+building '/nix/store/mpn7k6bkjl41fm51342rafaqfsl10qs4-python3-3.9.12-env.drv'...
+created 279 symlinks in user environment
+Python 3.9.12 (main, Mar 23 2022, 21:36:19)
+[GCC 11.3.0] on linux
 Type "help", "copyright", "credits" or "license" for more information.
 >>> import requests
 >>>
@ -147,7 +150,7 @@ Executing this script requires a `python3` that has `numpy`. Using what we learn
 in the previous section, we could startup a shell and just run it like so:

 ```ShellSession
-$ nix-shell -p 'python38.withPackages(ps: with ps; [ numpy ])' --run 'python3 foo.py'
+$ nix-shell -p 'python39.withPackages(ps: with ps; [ numpy ])' --run 'python3 foo.py'
 The dot product of [1 2] and [3 4] is: 11
 ```

@ -210,12 +213,12 @@ create a single script with Python dependencies, but in the course of normal
 development we're usually working in an entire package repository.

 As explained in the Nix manual, `nix-shell` can also load an expression from a
-`.nix` file. Say we want to have Python 3.8, `numpy` and `toolz`, like before,
+`.nix` file. Say we want to have Python 3.9, `numpy` and `toolz`, like before,
 in an environment. We can add a `shell.nix` file describing our dependencies:

 ```nix
 with import <nixpkgs> {};
-(python38.withPackages (ps: [ps.numpy ps.toolz])).env
+(python39.withPackages (ps: [ps.numpy ps.toolz])).env
 ```

 And then at the command line, just typing `nix-shell` produces the same
@ -229,7 +232,7 @@ What's happening here?
   imports the `<nixpkgs>` function, `{}` calls it and the `with` statement
   brings all attributes of `nixpkgs` in the local scope. These attributes form
   the main package set.
-2. Then we create a Python 3.8 environment with the `withPackages` function, as before.
+2. Then we create a Python 3.9 environment with the `withPackages` function, as before.
 3. The `withPackages` function expects us to provide a function as an argument
   that takes the set of all Python packages and returns a list of packages to
   include in the environment. Here, we select the packages `numpy` and `toolz`
@ -240,7 +243,7 @@ To combine this with `mkShell` you can:
 ```nix
 with import <nixpkgs> {};
 let
-  pythonEnv = python38.withPackages (ps: [
+  pythonEnv = python39.withPackages (ps: [
    ps.numpy
    ps.toolz
  ]);
@ -378,8 +381,8 @@ information. The output of the function is a derivation.

 An expression for `toolz` can be found in the Nixpkgs repository. As explained
 in the introduction of this Python section, a derivation of `toolz` is available
-for each interpreter version, e.g. `python38.pkgs.toolz` refers to the `toolz`
-derivation corresponding to the CPython 3.8 interpreter.
+for each interpreter version, e.g. `python39.pkgs.toolz` refers to the `toolz`
+derivation corresponding to the CPython 3.9 interpreter.

 The above example works when you're directly working on
 `pkgs/top-level/python-packages.nix` in the Nixpkgs repository. Often though,
@ -392,11 +395,11 @@ and adds it along with a `numpy` package to a Python environment.
 with import <nixpkgs> {};

 ( let
-    my_toolz = python38.pkgs.buildPythonPackage rec {
+    my_toolz = python39.pkgs.buildPythonPackage rec {
      pname = "toolz";
      version = "0.10.0";

-      src = python38.pkgs.fetchPypi {
+      src = python39.pkgs.fetchPypi {
        inherit pname version;
        sha256 = "08fdd5ef7c96480ad11c12d472de21acd32359996f69a5259299b540feba4560";
      };
@ -414,7 +417,7 @@ with import <nixpkgs> {};
 ```

 Executing `nix-shell` will result in an environment in which you can use
-Python 3.8 and the `toolz` package. As you can see we had to explicitly mention
+Python 3.9 and the `toolz` package. As you can see we had to explicitly mention
 for which Python version we want to build a package.

 So, what did we do here? Well, we took the Nix expression that we used earlier
@ -742,7 +745,7 @@ If we create a `shell.nix` file which calls `buildPythonPackage`, and if `src`
 is a local source, and if the local source has a `setup.py`, then development
 mode is activated.

-In the following example we create a simple environment that has a Python 3.8
+In the following example we create a simple environment that has a Python 3.9
 version of our package in it, as well as its dependencies and other packages we
 like to have in the environment, all specified with `propagatedBuildInputs`.
 Indeed, we can just add any package we like to have in our environment to
@ -750,7 +753,7 @@ Indeed, we can just add any package we like to have in our environment to

 ```nix
 with import <nixpkgs> {};
-with python38Packages;
+with python39Packages;

 buildPythonPackage rec {
  name = "mypackage";
@ -828,9 +831,9 @@ and in this case the `python38` interpreter is automatically used.

 ### Interpreters {#interpreters}

-Versions 2.7, 3.7, 3.8 and 3.9 of the CPython interpreter are available as
-respectively `python27`, `python37`, `python38` and `python39`. The
-aliases `python2` and `python3` correspond to respectively `python27` and
+Versions 2.7, 3.7, 3.8, 3.9 and 3.10 of the CPython interpreter are available
+as respectively `python27`, `python37`, `python38`, `python39` and `python310`.
+The aliases `python2` and `python3` correspond to respectively `python27` and
 `python39`. The attribute `python` maps to `python2`. The PyPy interpreters
 compatible with Python 2.7 and 3 are available as `pypy27` and `pypy3`, with
 aliases `pypy2` mapping to `pypy27` and `pypy` mapping to `pypy2`. The Nix
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -560,6 +560,12 @@
    githubId = 36147;
    name = "Alireza Meskin";
  };
+  alkasm = {
+    email = "alexreynolds00@gmail.com";
+    github = "alkasm";
+    githubId = 9651002;
+    name = "Alexander Reynolds";
+  };
  alkeryn = {
    email = "plbraundev@gmail.com";
    github = "Alkeryn";
@ -2523,6 +2529,13 @@
      fingerprint = "68B8 0D57 B2E5 4AC3 EC1F  49B0 B37E 0F23 7101 6A4C";
    }];
  };
+  colinsane = {
+    name = "Colin Sane";
+    email = "colin@uninsane.org";
+    matrix = "@colin:uninsane.org";
+    github = "uninsane";
+    githubId = 106709944;
+  };
  collares = {
    email = "mauricio@collares.org";
    github = "collares";
@ -12441,6 +12454,12 @@
    githubId = 1040871;
    name = "Mathis Antony";
  };
+  sven-of-cord = {
+    email = "sven@cord.com";
+    github = "sven-of-cord";
+    githubId = 98333944;
+    name = "Sven Over";
+  };
  svend = {
    email = "svend@svends.net";
    github = "svend";
@ -12697,6 +12716,12 @@
    githubId = 139251;
    name = "Tom Hunger";
  };
+  tejasag = {
+    name = "Tejas Agarwal";
+    email = "tejasagarwalbly@gmail.com";
+    github = "tejasag";
+    githubId = 67542663;
+  };
  telotortium = {
    email = "rirelan@gmail.com";
    github = "telotortium";
--- a/nixos/lib/systemd-unit-options.nix
+++ b/nixos/lib/systemd-unit-options.nix
@ -20,10 +20,15 @@ in rec {
    merge = loc: defs:
      let
        defs' = filterOverrides defs;
-        defs'' = getValues defs';
      in
-        if isList (head defs'')
-        then concatLists defs''
+        if isList (head defs').value
+        then concatMap (def:
+          if builtins.typeOf def.value == "list"
+          then def.value
+          else
+            throw "The definitions for systemd unit options should be either all lists, representing repeatable options, or all non-lists, but for the option ${showOption loc}, the definitions are a mix of list and non-list ${lib.options.showDefs defs'}"
+        ) defs'
+
        else mergeEqualOption loc defs';
  };

--- a/nixos/modules/hardware/device-tree.nix
+++ b/nixos/modules/hardware/device-tree.nix
@ -36,14 +36,11 @@ let
          /plugin/;
          / {
                  compatible = "raspberrypi";
-                  fragment@0 {
-                          target-path = "/soc";
-                          __overlay__ {
-                                  pps {
-                                          compatible = "pps-gpio";
-                                          status = "okay";
-                                  };
-                          };
+          };
+          &{/soc} {
+                  pps {
+                          compatible = "pps-gpio";
+                          status = "okay";
                  };
          };
        '';
@ -88,13 +85,14 @@ let

  # Compile single Device Tree overlay source
  # file (.dts) into its compiled variant (.dtbo)
-  compileDTS = name: f: pkgs.callPackage({ dtc }: pkgs.stdenv.mkDerivation {
+  compileDTS = name: f: pkgs.callPackage({ stdenv, dtc }: stdenv.mkDerivation {
    name = "${name}-dtbo";

    nativeBuildInputs = [ dtc ];

    buildCommand = ''
-      dtc -I dts ${f} -O dtb -@ -o $out
+      $CC -E -nostdinc -I${getDev cfg.kernelPackage}/lib/modules/${cfg.kernelPackage.modDirVersion}/source/scripts/dtc/include-prefixes -undef -D__DTS__ -x assembler-with-cpp ${f} | \
+        dtc -I dts -O dtb -@ -o $out
    '';
  }) {};

--- a/nixos/modules/services/audio/navidrome.nix
+++ b/nixos/modules/services/audio/navidrome.nix
@ -45,6 +45,8 @@ in {
        RootDirectory = "/run/navidrome";
        ReadWritePaths = "";
        BindReadOnlyPaths = [
+          # navidrome uses online services to download additional album metadata / covers
+          "${config.environment.etc."ssl/certs/ca-certificates.crt".source}:/etc/ssl/certs/ca-certificates.crt"
          builtins.storeDir
        ] ++ lib.optional (cfg.settings ? MusicFolder) cfg.settings.MusicFolder;
        CapabilityBoundingSet = "";
--- a/nixos/modules/services/desktops/pipewire/wireplumber.nix
+++ b/nixos/modules/services/desktops/pipewire/wireplumber.nix
@ -37,11 +37,19 @@ in
    environment.systemPackages = [ cfg.package ];

    environment.etc."wireplumber/main.lua.d/80-nixos.lua" = lib.mkIf (!pwUsedForAudio) {
-     text = ''
+      text = ''
        -- Pipewire is not used for audio, so prevent it from grabbing audio devices
        alsa_monitor.enable = function() end
      '';
    };
+    environment.etc."wireplumber/main.lua.d/80-systemwide.lua" = lib.mkIf config.services.pipewire.systemWide {
+      text = ''
+        -- When running system-wide, these settings need to be disabled (they
+        -- use functions that aren't available on the system dbus).
+        alsa_monitor.properties["alsa.reserve"] = false
+        default_access.properties["enable-flatpak-portal"] = false
+      '';
+    };

    systemd.packages = [ cfg.package ];

@ -50,5 +58,10 @@ in

    systemd.services.wireplumber.wantedBy = [ "pipewire.service" ];
    systemd.user.services.wireplumber.wantedBy = [ "pipewire.service" ];
+
+    systemd.services.wireplumber.environment = lib.mkIf config.services.pipewire.systemWide {
+      # Force wireplumber to use system dbus.
+      DBUS_SESSION_BUS_ADDRESS = "unix:path=/run/dbus/system_bus_socket";
+    };
  };
 }
--- a/nixos/modules/services/monitoring/grafana-agent.nix
+++ b/nixos/modules/services/monitoring/grafana-agent.nix
@ -7,7 +7,7 @@ let
 in
 {
  meta = {
-    maintainers = with maintainers; [ zimbatm ];
+    maintainers = with maintainers; [ flokli zimbatm ];
  };

  options.services.grafana-agent = {
@ -49,14 +49,7 @@ in
      };

      default = {
-        server = {
-          # Don't bind on 0.0.0.0
-          grpc_listen_address = "127.0.0.1";
-          http_listen_address = "127.0.0.1";
-          # Don't bind on the default port 80
-          http_listen_port = 9090;
-        };
-        prometheus = {
+        metrics = {
          wal_directory = "\${STATE_DIRECTORY}";
          global.scrape_interval = "5s";
        };
@ -69,7 +62,12 @@ in
      };

      example = {
-        loki.configs = [{
+        metrics.global.remote_write = [{
+          url = "\${METRICS_REMOTE_WRITE_URL}";
+          basic_auth.username = "\${METRICS_REMOTE_WRITE_USERNAME}";
+          basic_auth.password_file = "\${CREDENTIALS_DIRECTORY}/metrics_remote_write_password";
+        }];
+        logs.configs = [{
          name = "default";
          scrape_configs = [
            {
@ -101,13 +99,6 @@ in
            basic_auth.password_file = "\${CREDENTIALS_DIRECTORY}/logs_remote_write_password";
          }];
        }];
-        integrations = {
-          prometheus_remote_write = [{
-            url = "\${METRICS_REMOTE_WRITE_URL}";
-            basic_auth.username = "\${METRICS_REMOTE_WRITE_USERNAME}";
-            basic_auth.password_file = "\${CREDENTIALS_DIRECTORY}/metrics_remote_write_password";
-          }];
-        };
      };
    };
  };
--- a/nixos/tests/grafana-agent.nix
+++ b/nixos/tests/grafana-agent.nix
@ -23,9 +23,9 @@ import ./make-test-python.nix ({ lib, pkgs, ... }:

      with subtest("Grafana-agent is running"):
          machine.wait_for_unit("grafana-agent.service")
-          machine.wait_for_open_port(9090)
+          machine.wait_for_open_port(12345)
          machine.succeed(
-              "curl -sSfN http://127.0.0.1:9090/-/healthy"
+              "curl -sSfN http://127.0.0.1:12345/-/healthy"
          )
          machine.shutdown()
    '';
--- a/pkgs/applications/audio/quodlibet/default.nix
+++ b/pkgs/applications/audio/quodlibet/default.nix
@ -9,11 +9,11 @@
 let optionals = lib.optionals; in
 python3.pkgs.buildPythonApplication rec {
  pname = "quodlibet${tag}";
-  version = "4.4.0";
+  version = "4.5.0";

  src = fetchurl {
    url = "https://github.com/quodlibet/quodlibet/releases/download/release-${version}/quodlibet-${version}.tar.gz";
-    sha256 = "sha256-oDMY0nZ+SVlVF2PQqH+tl3OHr3EmCP5XJxQXaiS782c=";
+    sha256 = "sha256-MBYVgp9lLLr+2zVTkjcWKli8HucaVn0kn3eJ2SaCRbw=";
  };

  nativeBuildInputs = [ wrapGAppsHook gettext ];
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@ -162,7 +162,7 @@ let
          with on-the-fly code analysis, error prevention and
          automated refactorings for PHP and JavaScript code.
        '';
-        maintainers = with maintainers; [ schristo ma27 ];
+        maintainers = with maintainers; [ schristo ];
      };
    });

--- a/pkgs/applications/editors/neovim/build-neovim-plugin.nix
+++ b/pkgs/applications/editors/neovim/build-neovim-plugin.nix
@ -0,0 +1,35 @@
+{ lib
+, stdenv
+, buildVimPluginFrom2Nix
+, buildLuarocksPackage
+, lua51Packages
+, toVimPlugin
+}:
+let
+  # sanitizeDerivationName
+  normalizeName = lib.replaceStrings [ "." ] [ "-" ];
+in
+
+  # function to create vim plugin from lua packages that are already packaged in
+  # luaPackages
+  {
+    # the lua attribute name that matches this vim plugin. Both should be equal
+    # in the majority of cases but we make it possible to have different attribute names
+    luaAttr ? (normalizeName attrs.pname)
+    , ...
+  }@attrs:
+    let
+      originalLuaDrv = lua51Packages.${luaAttr};
+      luaDrv = lua51Packages.lib.overrideLuarocks originalLuaDrv (drv: {
+        extraConfig = ''
+          -- to create a flat hierarchy
+          lua_modules_path = "lua"
+        '';
+      });
+      finalDrv = toVimPlugin (luaDrv.overrideAttrs(oa: {
+          nativeBuildInputs = oa.nativeBuildInputs or [] ++ [
+            lua51Packages.luarocksMoveDataFolder
+          ];
+        }));
+    in
+      finalDrv
--- a/pkgs/applications/editors/neovim/default.nix
+++ b/pkgs/applications/editors/neovim/default.nix
@ -133,7 +133,7 @@ in
      # those contributions were copied from Vim (identified in the commit logs
      # by the vim-patch token). See LICENSE for details."
      license = with licenses; [ asl20 vim ];
-      maintainers = with maintainers; [ manveru rvolosatovs ma27 ];
+      maintainers = with maintainers; [ manveru rvolosatovs ];
      platforms   = platforms.unix;
    };
  }
--- a/pkgs/applications/editors/neovim/utils.nix
+++ b/pkgs/applications/editors/neovim/utils.nix
@ -1,4 +1,6 @@
 { lib
+, buildLuarocksPackage
+, callPackage
 , vimUtils
 , nodejs
 , neovim-unwrapped
@ -184,4 +186,9 @@ in
 {
  inherit makeNeovimConfig;
  inherit legacyWrapper;
+
+  buildNeovimPluginFrom2Nix = callPackage ./build-neovim-plugin.nix {
+    inherit (vimUtils) buildVimPluginFrom2Nix toVimPlugin;
+    inherit buildLuarocksPackage;
+  };
 }
--- a/pkgs/applications/editors/vim/plugins/build-vim-plugin.nix
+++ b/pkgs/applications/editors/vim/plugins/build-vim-plugin.nix
@ -4,6 +4,7 @@
 , vimCommandCheckHook
 , vimGenDocHook
 , neovimRequireCheckHook
+, toVimPlugin
 }:

 rec {
@ -23,11 +24,6 @@ rec {
    let drv = stdenv.mkDerivation (attrs // {
      name = namePrefix + name;

-      # dont move the doc folder since vim expects it
-      forceShare= [ "man" "info" ];
-
-      nativeBuildInputs = attrs.nativeBuildInputs or []
-      ++ lib.optionals (stdenv.hostPlatform == stdenv.buildPlatform) [ vimCommandCheckHook vimGenDocHook ];
      inherit unpackPhase configurePhase buildPhase addonInfo preInstall postInstall;

      installPhase = ''
@ -40,9 +36,9 @@ rec {
        runHook postInstall
      '';
    });
-    in  drv.overrideAttrs(oa: {
+    in toVimPlugin(drv.overrideAttrs(oa: {
      rtp = "${drv}";
-    });
+    }));

  buildVimPluginFrom2Nix = attrs: buildVimPlugin ({
    # vim plugins may override this
--- a/pkgs/applications/editors/vim/plugins/default.nix
+++ b/pkgs/applications/editors/vim/plugins/default.nix
@ -1,5 +1,8 @@
 # TODO check that no license information gets lost
-{ callPackage, config, lib, vimUtils, vim, darwin, llvmPackages, luaPackages }:
+{ callPackage, config, lib, vimUtils, vim, darwin, llvmPackages
+, neovimUtils
+, luaPackages
+}:

 let

@ -8,24 +11,11 @@ let

  inherit (lib) extends;

-  initialPackages = self: {
-    # Convert derivation to a vim plugin.
-    toVimPlugin = drv:
-      drv.overrideAttrs(oldAttrs: {
-
-        nativeBuildInputs = oldAttrs.nativeBuildInputs or [] ++ [
-          vimGenDocHook
-          vimCommandCheckHook
-        ];
-        passthru = (oldAttrs.passthru or {}) // {
-          vimPlugin = true;
-        };
-      });
-  };
+  initialPackages = self: { };

  plugins = callPackage ./generated.nix {
    inherit buildVimPluginFrom2Nix;
-    inherit (vimUtils) buildNeovimPluginFrom2Nix;
+    inherit (neovimUtils) buildNeovimPluginFrom2Nix;
  };

  # TL;DR
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -2527,7 +2527,7 @@ final: prev:
    meta.homepage = "https://github.com/nvim-lua/diagnostic-nvim/";
  };

-  diffview-nvim = buildNeovimPluginFrom2Nix {
+  diffview-nvim = buildVimPluginFrom2Nix {
    pname = "diffview.nvim";
    version = "2022-06-09";
    src = fetchFromGitHub {
@ -3154,7 +3154,7 @@ final: prev:
    meta.homepage = "https://github.com/ruifm/gitlinker.nvim/";
  };

-  gitsigns-nvim = buildNeovimPluginFrom2Nix {
+  gitsigns-nvim = buildVimPluginFrom2Nix {
    pname = "gitsigns.nvim";
    version = "2022-05-26";
    src = fetchFromGitHub {
@ -4282,7 +4282,7 @@ final: prev:
    meta.homepage = "https://github.com/iamcco/markdown-preview.nvim/";
  };

-  marks-nvim = buildNeovimPluginFrom2Nix {
+  marks-nvim = buildVimPluginFrom2Nix {
    pname = "marks.nvim";
    version = "2022-05-13";
    src = fetchFromGitHub {
@ -5110,7 +5110,7 @@ final: prev:
    meta.homepage = "https://github.com/RRethy/nvim-base16/";
  };

-  nvim-biscuits = buildNeovimPluginFrom2Nix {
+  nvim-biscuits = buildVimPluginFrom2Nix {
    pname = "nvim-biscuits";
    version = "2022-05-31";
    src = fetchFromGitHub {
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -1031,7 +1031,7 @@ self: super: {
        delve
        errcheck
        go-motion
-        go-tools
+        go-tools # contains staticcheck
        gocode
        gocode-gomod
        godef
@ -1041,7 +1041,8 @@ self: super: {
        gomodifytags
        gopls
        # gorename
-        gotools # contains staticcheck
+        # gotags
+        gotools
        # guru
        iferr
        impl
@ -1052,9 +1053,7 @@ self: super: {
    in
    {
      postPatch = ''
-        ${gnused}/bin/sed \
-          -Ee 's@"go_bin_path", ""@"go_bin_path", "${binPath}"@g' \
-          -i autoload/go/config.vim
+        sed -i autoload/go/config.vim -Ee 's@"go_bin_path", ""@"go_bin_path", "${binPath}"@g'
      '';
    });

--- a/pkgs/applications/editors/vim/plugins/vim-utils.nix
+++ b/pkgs/applications/editors/vim/plugins/vim-utils.nix
@ -205,9 +205,6 @@ let
      ln -sf ${plugin}/${rtpPath} $out/pack/${packageName}/${dir}/${lib.getName plugin}
    '';

-    link = pluginPath: if hasLuaModule pluginPath
-      then linkLuaPlugin pluginPath
-      else linkVimlPlugin pluginPath;

    packageLinks = packageName: {start ? [], opt ? []}:
    let
@ -225,9 +222,9 @@ let
      [ "mkdir -p $out/pack/${packageName}/start" ]
      # To avoid confusion, even dependencies of optional plugins are added
      # to `start` (except if they are explicitly listed as optional plugins).
-      ++ (builtins.map (x: link x packageName "start") allPlugins)
+      ++ (builtins.map (x: linkVimlPlugin x packageName "start") allPlugins)
      ++ ["mkdir -p $out/pack/${packageName}/opt"]
-      ++ (builtins.map (x: link x packageName "opt") opt)
+      ++ (builtins.map (x: linkVimlPlugin x packageName "opt") opt)
      # Assemble all python3 dependencies into a single `site-packages` to avoid doing recursive dependency collection
      # for each plugin.
      # This directory is only for python import search path, and will not slow down the startup time.
@ -290,14 +287,14 @@ let
      /* vim-plug is an extremely popular vim plugin manager.
      */
      plugImpl =
-      (''
+      ''
        source ${vimPlugins.vim-plug.rtp}/plug.vim
        silent! call plug#begin('/dev/null')

        '' + (lib.concatMapStringsSep "\n" (pkg: "Plug '${pkg.rtp}'") plug.plugins) + ''

        call plug#end()
-      '');
+      '';

      /*
       vim-addon-manager = VAM
@ -533,16 +530,11 @@ rec {
    } ./neovim-require-check-hook.sh) {};

  inherit (import ./build-vim-plugin.nix {
-    inherit lib stdenv rtpPath vim vimGenDocHook vimCommandCheckHook neovimRequireCheckHook;
+    inherit lib stdenv rtpPath vim vimGenDocHook
+      toVimPlugin vimCommandCheckHook neovimRequireCheckHook;
  }) buildVimPlugin buildVimPluginFrom2Nix;


-  # TODO placeholder to ease working on automatic plugin detection
-  # this should be a luarocks "flat" install with appropriate vim hooks
-  buildNeovimPluginFrom2Nix = attrs: let drv = (buildVimPluginFrom2Nix attrs); in drv.overrideAttrs(oa: {
-    nativeBuildInputs = oa.nativeBuildInputs ++ [ neovimRequireCheckHook ];
-  });
-
  # used to figure out which python dependencies etc. neovim needs
  requiredPlugins = {
    packages ? {},
@ -566,4 +558,21 @@ rec {
      nativePlugins = lib.concatMap ({start?[], opt?[], knownPlugins?vimPlugins}: start++opt) nativePluginsConfigs;
    in
      nativePlugins ++ nonNativePlugins;
+
+  toVimPlugin = drv:
+    drv.overrideAttrs(oldAttrs: {
+      # dont move the "doc" folder since vim expects it
+      forceShare = [ "man" "info" ];
+
+      nativeBuildInputs = oldAttrs.nativeBuildInputs or []
+      ++ lib.optionals (stdenv.hostPlatform == stdenv.buildPlatform) [
+        vimCommandCheckHook vimGenDocHook
+        # many neovim plugins keep using buildVimPlugin
+        neovimRequireCheckHook
+      ];
+
+      passthru = (oldAttrs.passthru or {}) // {
+        vimPlugin = true;
+      };
+    });
 }
--- a/pkgs/applications/finance/odoo/default.nix
+++ b/pkgs/applications/finance/odoo/default.nix
@ -1,14 +1,14 @@
 { stdenv
 , lib
 , fetchurl
-, python3
+, python39
 , nodePackages
 , wkhtmltopdf
 , nixosTests
 }:

 let
-  python = python3.override {
+  python = python39.override {
    packageOverrides = self: super: {
      click = super.click.overridePythonAttrs (old: rec {
        version = "7.1.2";
--- a/pkgs/applications/misc/archivebox/default.nix
+++ b/pkgs/applications/misc/archivebox/default.nix
@ -6,10 +6,21 @@ let
  python = python3.override {
    packageOverrides = self: super: {
      django = super.django_3.overridePythonAttrs (old: rec {
-        version = "3.1.7";
+        version = "3.1.14";
        src = old.src.override {
          inherit version;
-          sha256 = "sha256-Ms55Lum2oMu+w0ASPiKayfdl3/jCpK6SR6FLK6OjZac=";
+          sha256 = "72a4a5a136a214c39cf016ccdd6b69e2aa08c7479c66d93f3a9b5e4bb9d8a347";
+        };
+        meta = old.meta // {
+          knownVulnerabilities = [
+            "CVE-2021-45115"
+            "CVE-2021-45116"
+            "CVE-2021-45452"
+            "CVE-2022-23833"
+            "CVE-2022-22818"
+            "CVE-2022-28347"
+            "CVE-2022-28346"
+          ];
        };
      });
    };
--- a/pkgs/applications/misc/dmenu/wayland.nix
+++ b/pkgs/applications/misc/dmenu/wayland.nix
@ -39,6 +39,6 @@ stdenv.mkDerivation rec {
    platforms = platforms.linux;
    description = "dmenu for wayland-compositors";
    homepage = "https://github.com/nyyManni/dmenu-wayland";
-    maintainers = with maintainers; [ ma27 ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/applications/misc/kiwix/default.nix
+++ b/pkgs/applications/misc/kiwix/default.nix
@ -12,13 +12,13 @@

 mkDerivation rec {
  pname = "kiwix";
-  version = "2.0.5";
+  version = "2.2.1";

  src = fetchFromGitHub {
    owner = pname;
    repo = "${pname}-desktop";
    rev = version;
-    sha256 = "12v43bcg4g8fcp02y2srsfdvcb7dpl4pxb9z7a235006s0kfv8yn";
+    sha256 = "sha256-ks2d/guMp5pb2tiwGxNp3htQVm65MsYvZ/6tNjGXNr8=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/kiwix/lib.nix
+++ b/pkgs/applications/misc/kiwix/lib.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation rec {
  pname = "kiwix-lib";
-  version = "9.4.1";
+  version = "10.1.1";

  src = fetchFromGitHub {
    owner = "kiwix";
    repo = pname;
    rev = version;
-    sha256 = "034nk6l623v78clrs2d0k1vg69sbzrd8c0q79qiqmlkinck1nkxw";
+    sha256 = "sha256-ECvdraN1J5XJQLeZDngxO5I7frwZ8+W8tFpbB7o8UeM=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/privacyidea/default.nix
+++ b/pkgs/applications/misc/privacyidea/default.nix
@ -1,9 +1,9 @@
 { lib, fetchFromGitHub, cacert, openssl, nixosTests
-, python3
+, python39
 }:

 let
-  python3' = python3.override {
+  python3' = python39.override {
    packageOverrides = self: super: {
      sqlalchemy = super.sqlalchemy.overridePythonAttrs (oldAttrs: rec {
        version = "1.3.24";
@ -19,7 +19,7 @@ let
      });
      flask_migrate = super.flask_migrate.overridePythonAttrs (oldAttrs: rec {
        version = "2.7.0";
-        src = python3.pkgs.fetchPypi {
+        src = self.fetchPypi {
          pname = "Flask-Migrate";
          inherit version;
          sha256 = "ae2f05671588762dd83a21d8b18c51fe355e86783e24594995ff8d7380dffe38";
--- a/pkgs/applications/misc/whalebird/default.nix
+++ b/pkgs/applications/misc/whalebird/default.nix
@ -1,28 +1,51 @@
-{ lib, stdenv, fetchurl, dpkg, autoPatchelfHook, makeWrapper, electron
+{ lib, stdenv, fetchurl, autoPatchelfHook, makeDesktopItem, copyDesktopItems, makeWrapper, electron
 , nodePackages, alsa-lib, gtk3, libdbusmenu, libxshmfence, mesa, nss }:

 stdenv.mkDerivation rec {
  pname = "whalebird";
-  version = "4.5.4";
+  version = "4.6.0";

-  src = fetchurl {
-    url = "https://github.com/h3poteto/whalebird-desktop/releases/download/${version}/Whalebird-${version}-linux-x64.deb";
-    sha256 = "048c2hpnlzjli8r1lcm7hd32qfsq4p9vkimrgc049yw9f15ndjpr";
-  };
+  src = let
+    downloads = "https://github.com/h3poteto/whalebird-desktop/releases/download/${version}";
+  in
+    if stdenv.system == "x86_64-linux" then
+      fetchurl {
+        url = downloads + "/Whalebird-${version}-linux-x64.tar.bz2";
+        sha256 = "02f2f4b7184494926ef58523174acfa23738d5f27b4956d094836a485047c2f8";
+      }
+    else if stdenv.system == "aarch64-linux" then
+      fetchurl {
+        url = downloads + "/Whalebird-${version}-linux-arm64.tar.bz2";
+        sha256 = "de0cdf7cbd6f0305100a2440e2559ddce0a5e4ad73a341874d6774e23dc76974";
+      }
+    else
+      throw "Whalebird is not supported for ${stdenv.system}";

  nativeBuildInputs = [
-    dpkg
    autoPatchelfHook
    makeWrapper
+    copyDesktopItems
    nodePackages.asar
  ];

  buildInputs = [ alsa-lib gtk3 libdbusmenu libxshmfence mesa nss ];

-  dontConfigure = true;
+  desktopItems = [
+    (makeDesktopItem {
+      desktopName = "Whalebird";
+      comment = meta.description;
+      categories = [ "Network" ];
+      exec = "whalebird";
+      icon = "whalebird";
+      name = "whalebird";
+    })
+  ];

  unpackPhase = ''
-    dpkg-deb -x ${src} ./
+    mkdir -p opt
+    tar -xf ${src} -C opt
+    # remove the version/target suffix from the untar'd directory
+    mv opt/Whalebird-* opt/Whalebird
  '';

  buildPhase = ''
@ -31,7 +54,7 @@ stdenv.mkDerivation rec {
    # Necessary steps to find the tray icon
    asar extract opt/Whalebird/resources/app.asar "$TMP/work"
    substituteInPlace $TMP/work/dist/electron/main.js \
-      --replace "jo,\"tray_icon.png\"" "\"$out/opt/Whalebird/resources/build/icons/tray_icon.png\""
+      --replace "Do,\"tray_icon.png\"" "\"$out/opt/Whalebird/resources/build/icons/tray_icon.png\""
    asar pack --unpack='{*.node,*.ftz,rect-overlay}' "$TMP/work" opt/Whalebird/resources/app.asar

    runHook postBuild
@ -41,12 +64,17 @@ stdenv.mkDerivation rec {
    runHook preInstall

    mkdir $out
-    mv usr/share opt $out
+    mv opt $out
+
+    # install icons
+    for icon in $out/opt/Whalebird/resources/build/icons/*.png; do
+      mkdir -p "$out/share/icons/hicolor/$(basename $icon .png)/apps"
+      ln -s "$icon" "$out/share/icons/hicolor/$(basename $icon .png)/apps/whalebird.png"
+    done

-    substituteInPlace $out/share/applications/whalebird.desktop \
-      --replace '/opt/Whalebird' $out/bin
    makeWrapper ${electron}/bin/electron $out/bin/whalebird \
-      --add-flags $out/opt/Whalebird/resources/app.asar
+      --add-flags $out/opt/Whalebird/resources/app.asar \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"

    runHook postInstall
  '';
@ -55,7 +83,7 @@ stdenv.mkDerivation rec {
    description = "Electron based Mastodon, Pleroma and Misskey client for Windows, Mac and Linux";
    homepage = "https://whalebird.social";
    license = licenses.mit;
-    maintainers = with maintainers; [ wolfangaukang ];
-    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ wolfangaukang colinsane ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
  };
 }
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@ -21,6 +21,7 @@
 { lib
 , pkgs
 , stdenv
+, fetchpatch

 # build time
 , autoconf
@ -219,6 +220,12 @@ buildStdenv.mkDerivation ({
  ];

  patches = [
+    (fetchpatch {
+      # https://bugzilla.mozilla.org/show_bug.cgi?id=1773259
+      name = "rust-cbindgen-0.24.2-compat.patch";
+      url = "https://raw.githubusercontent.com/canonical/firefox-snap/5622734942524846fb0eb7108918c8cd8557fde3/patches/fix-ftbfs-newer-cbindgen.patch";
+      hash = "sha256-+wNZhkDB3HSknPRD4N6cQXY7zMT/DzNXx29jQH0Gb1o=";
+    })
  ]
  ++ lib.optional (lib.versionAtLeast version "86") ./env_var_for_system_dir-ff86.patch
  ++ lib.optional (lib.versionAtLeast version "90" && lib.versionOlder version "95") ./no-buildconfig-ffx90.patch
--- a/pkgs/applications/networking/cluster/terraform-providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@ -58,12 +58,11 @@ let
  # These are the providers that don't fall in line with the default model
  special-providers =
    {
-      # Packages that don't fit the default model
-
      brightbox = automated-providers.brightbox.override { mkProviderGoModule = buildGo118Module; };
      # mkisofs needed to create ISOs holding cloud-init data,
      # and wrapped to terraform via deecb4c1aab780047d79978c636eeb879dd68630
      libvirt = automated-providers.libvirt.overrideAttrs (_: { propagatedBuildInputs = [ cdrtools ]; });
+      linode = automated-providers.linode.override { mkProviderGoModule = buildGo118Module; };
    };

  # Put all the providers we not longer support in this list.
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -3,10 +3,10 @@
    "owner": "CiscoDevNet",
    "provider-source-address": "registry.terraform.io/CiscoDevNet/aci",
    "repo": "terraform-provider-aci",
-    "rev": "v2.2.1",
-    "sha256": "sha256-WYKlkvGmTeaI4+7uWLy6/y+NtFb9n3Lu9lrwSR8Vg/0=",
+    "rev": "v2.3.0",
+    "sha256": "sha256-V4LvMVWuKsGMVo/P8r79ICy3SrsVmCOMl75yRIixqAQ=",
    "vendorSha256": null,
-    "version": "2.2.1"
+    "version": "2.3.0"
  },
  "acme": {
    "owner": "vancluever",
@ -30,10 +30,10 @@
    "owner": "aiven",
    "provider-source-address": "registry.terraform.io/aiven/aiven",
    "repo": "terraform-provider-aiven",
-    "rev": "v3.0.0",
-    "sha256": "sha256-k3F6AUcGAddDD3Wy1THgTlcNzDBB403Vy+6c+avi+vQ=",
-    "vendorSha256": "sha256-gVZpN7Hwi+PbJDgEHSJRYq0tC1GVcetfPBY5pGhMPAc=",
-    "version": "3.0.0"
+    "rev": "v3.1.0",
+    "sha256": "sha256-or9zftygo0W0bcw2FZl9S8dp4K8enlC5MYrrqgB2IUs=",
+    "vendorSha256": "sha256-k6pKet1YdQYCyFICw67nKI3RGNZ4b+zA+T9jpa2ZLFM=",
+    "version": "3.1.0"
  },
  "akamai": {
    "owner": "akamai",
@ -49,10 +49,10 @@
    "owner": "aliyun",
    "provider-source-address": "registry.terraform.io/aliyun/alicloud",
    "repo": "terraform-provider-alicloud",
-    "rev": "v1.170.0",
-    "sha256": "sha256-qONJK3/Vr+v6sVphyDLBJDdbeuLUxdZSImvntvQ4Fbc=",
+    "rev": "v1.171.0",
+    "sha256": "sha256-p6F3KNJ0W58E5WgdrSUmvu58MOy7zFYMy0aOg37j7Lo=",
    "vendorSha256": "sha256-RbhpyldFMQYb/bsGtnFLHxHGgIcPPSTJlEzuQySfxEA=",
-    "version": "1.170.0"
+    "version": "1.171.0"
  },
  "ansible": {
    "owner": "nbering",
@ -103,19 +103,19 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/aws",
    "repo": "terraform-provider-aws",
-    "rev": "v4.18.0",
-    "sha256": "sha256-hiC0SwLQk2DaVOTs3ZV+VngN0QFcN/oJPkvdMbQzzlg=",
-    "vendorSha256": "sha256-ZTUPO867RuX9s33X3qsetRXQ8C1bfHFE1UYQIkK2KRo=",
-    "version": "4.18.0"
+    "rev": "v4.19.0",
+    "sha256": "sha256-0pgCGv6a+/cBBInISM8Lmfapz+FIPwxAaqd+Rd6jax0=",
+    "vendorSha256": "sha256-n3iXCX87bu5rETz18GgUdIcy1NH+OTuA4ff56yE7kNg=",
+    "version": "4.19.0"
  },
  "azuread": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/azuread",
    "repo": "terraform-provider-azuread",
-    "rev": "v2.23.0",
-    "sha256": "sha256-qHlC5BQnO8MusjTkbMcNp1yqm//nR4lL3BgsG584q38=",
+    "rev": "v2.24.0",
+    "sha256": "sha256-obaS2MzLTeIKskGRz8CanRgWzSKTaiK09xxc0kdMDeQ=",
    "vendorSha256": null,
-    "version": "2.23.0"
+    "version": "2.24.0"
  },
  "azurerm": {
    "owner": "hashicorp",
@ -158,10 +158,10 @@
    "owner": "DrFaust92",
    "provider-source-address": "registry.terraform.io/DrFaust92/bitbucket",
    "repo": "terraform-provider-bitbucket",
-    "rev": "v2.17.0",
-    "sha256": "sha256-nzwfhwiszzhoobq2PlgtKfCch46fLoBVbembzdnkrD4=",
-    "vendorSha256": "sha256-LLhnF0/tj44vN36yss1JzNvDYy64Iuk5WVRhehf0wkk=",
-    "version": "2.17.0"
+    "rev": "v2.20.0",
+    "sha256": "sha256-8GWxUb7ABulZ6jK9PATYfSbcyTCZ5Mqv3X3zjY3gquU=",
+    "vendorSha256": "sha256-h/hm5HtY3OCJ6Mtq+A3PBmH10xgYpKwjhwbDd1HtdoQ=",
+    "version": "2.20.0"
  },
  "brightbox": {
    "owner": "brightbox",
@ -195,10 +195,10 @@
    "owner": "CheckPointSW",
    "provider-source-address": "registry.terraform.io/CheckPointSW/checkpoint",
    "repo": "terraform-provider-checkpoint",
-    "rev": "v1.8.0",
-    "sha256": "sha256-+lcJr7C7FsvSzkfFwEfTrJedx6vMvOrTjNA+JTWBI4c=",
-    "vendorSha256": "sha256-mHLrrt6UJNfqtgjhWYDTvJcDtToHI34uoa0oyb9/XXk=",
-    "version": "1.8.0"
+    "rev": "v1.9.1",
+    "sha256": "sha256-5fyOw4Pu5a+kju4/RXKYZY0TBJ+6PVDwi/VjBWYCPHs=",
+    "vendorSha256": "sha256-LCKISUjXguV+T/rxde+++JzJZnVQisgxoUMRkeAusyQ=",
+    "version": "1.9.1"
  },
  "ciscoasa": {
    "owner": "CiscoDevNet",
@ -222,10 +222,10 @@
    "owner": "cloudflare",
    "provider-source-address": "registry.terraform.io/cloudflare/cloudflare",
    "repo": "terraform-provider-cloudflare",
-    "rev": "v3.16.0",
-    "sha256": "sha256-9MLk+M/M3U6hpAoaV6BUUZRSnTd9083nqI5tPATePw0=",
-    "vendorSha256": "sha256-Q9Gcq5xczrREMtFArpRpINZ4/N5pu4GdZwD4gGYTUVE=",
-    "version": "3.16.0"
+    "rev": "v3.17.0",
+    "sha256": "sha256-DggessI7mQgfO/s++2LQfTwodqWIps6gqUFSutle/UY=",
+    "vendorSha256": "sha256-2rlhl/VqvXPJxknizd28N3A+vYFXWajFLjCLH0RdnEQ=",
+    "version": "3.17.0"
  },
  "cloudfoundry": {
    "owner": "cloudfoundry-community",
@ -304,10 +304,10 @@
    "owner": "digitalocean",
    "provider-source-address": "registry.terraform.io/digitalocean/digitalocean",
    "repo": "terraform-provider-digitalocean",
-    "rev": "v2.20.0",
-    "sha256": "sha256-1RgQgxGORVvXovx4Ovm5SUsGgMD7CJjgHsgzw+bO8U4=",
+    "rev": "v2.21.0",
+    "sha256": "sha256-ei3nr3SAxQBXQikzPtRs9Y6VyOavTg9GXnLVfAI7QvU=",
    "vendorSha256": null,
-    "version": "2.20.0"
+    "version": "2.21.0"
  },
  "dme": {
    "owner": "DNSMadeEasy",
@ -331,10 +331,10 @@
    "owner": "dnsimple",
    "provider-source-address": "registry.terraform.io/dnsimple/dnsimple",
    "repo": "terraform-provider-dnsimple",
-    "rev": "v0.11.3",
-    "sha256": "sha256-fUs54xIecPgeQucuQmlpF2iHGonx4OsqFbhkMnO7d0c=",
-    "vendorSha256": "sha256-csooFX64RmwVV+gIejQS3HJljsRAp+bM8x/OoiF7jxs=",
-    "version": "0.11.3"
+    "rev": "v0.13.0",
+    "sha256": "sha256-Wt/2L4NHaQv5tV2JIjcRMH/mLyfbIk88PFYYmeVNlSQ=",
+    "vendorSha256": "sha256-emwD+bOkkZhh1BOQlW0dfdeD4Y68cULhC+3S7Xrjas4=",
+    "version": "0.13.0"
  },
  "docker": {
    "owner": "kreuzwerker",
@ -349,10 +349,10 @@
    "owner": "dome9",
    "provider-source-address": "registry.terraform.io/dome9/dome9",
    "repo": "terraform-provider-dome9",
-    "rev": "v1.25.4",
-    "sha256": "sha256-s/wglGsk/Lm45PWmqNHiVjj6sfQzXue+GnjEALp5yDc=",
+    "rev": "v1.26.0",
+    "sha256": "sha256-Edgtt+q1SPm/7wOIWUhe91lluXezNHfxUBu+h1NlEL4=",
    "vendorSha256": null,
-    "version": "1.25.4"
+    "version": "1.26.0"
  },
  "elasticsearch": {
    "owner": "phillbaker",
@ -367,10 +367,10 @@
    "owner": "exoscale",
    "provider-source-address": "registry.terraform.io/exoscale/exoscale",
    "repo": "terraform-provider-exoscale",
-    "rev": "v0.37.0",
-    "sha256": "sha256-Rx6T5tb5tZnUsmAOBTFryLFC/Pl06jOgHfFu0kIF7Hk=",
+    "rev": "v0.37.1",
+    "sha256": "sha256-PNm/As+N6+kB79J0lEaQM9LyybCwaRipG/eZCjTPMFY=",
    "vendorSha256": null,
-    "version": "0.37.0"
+    "version": "0.37.1"
  },
  "external": {
    "owner": "hashicorp",
@ -394,10 +394,10 @@
    "owner": "FlexibleEngineCloud",
    "provider-source-address": "registry.terraform.io/FlexibleEngineCloud/flexibleengine",
    "repo": "terraform-provider-flexibleengine",
-    "rev": "v1.29.0",
-    "sha256": "sha256-HPcJRLP20fDt3qr2edkol2jXSsWLotJkx13ZV7n7w8g=",
-    "vendorSha256": "sha256-De4NRWTdE4QutQkB0m0YlJg6LNysxi4bSSIxYY6lRP0=",
-    "version": "1.29.0"
+    "rev": "v1.30.0",
+    "sha256": "sha256-pkuoE0nX07chW4YMCHFAfLlw5qPRhuqv2S9WtFiL4pI=",
+    "vendorSha256": "sha256-bhufd2koz9pNHrWCBWngylqdJFD0poqvWy68GlWvDNc=",
+    "version": "1.30.0"
  },
  "fortios": {
    "owner": "fortinetdev",
@ -440,20 +440,20 @@
    "provider-source-address": "registry.terraform.io/hashicorp/google",
    "proxyVendor": true,
    "repo": "terraform-provider-google",
-    "rev": "v4.24.0",
-    "sha256": "sha256-3FnzaT8dROoSZX+JYFLu32UK6PQ272BYXkp1f9C7Z9I=",
-    "vendorSha256": "sha256-X75Ge7QQy5R3j6nXNMduAPPZlF+koJe6zI8l2KWwpJQ=",
-    "version": "4.24.0"
+    "rev": "v4.25.0",
+    "sha256": "sha256-5tgQpiWjMC+Xh5SPGrTqZVW3GDrlRKTc7K5XMHT6uRA=",
+    "vendorSha256": "sha256-uwyl79TGrnFOxJLBTJ5LaAZLZdb/VbS7IW4jQ2A5xQM=",
+    "version": "4.25.0"
  },
  "google-beta": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/google-beta",
    "proxyVendor": true,
    "repo": "terraform-provider-google-beta",
-    "rev": "v4.24.0",
-    "sha256": "sha256-YgpeilvUnm2HyhRoaQJa6K1+7OSjNESn180h4urFuQo=",
-    "vendorSha256": "sha256-X75Ge7QQy5R3j6nXNMduAPPZlF+koJe6zI8l2KWwpJQ=",
-    "version": "4.24.0"
+    "rev": "v4.25.0",
+    "sha256": "sha256-vIuZNjrgLGAF8szY0b9KeB1GoIDtlVLbnE5+IUXmccg=",
+    "vendorSha256": "sha256-uwyl79TGrnFOxJLBTJ5LaAZLZdb/VbS7IW4jQ2A5xQM=",
+    "version": "4.25.0"
  },
  "googleworkspace": {
    "owner": "hashicorp",
@ -495,10 +495,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/helm",
    "repo": "terraform-provider-helm",
-    "rev": "v2.5.1",
-    "sha256": "sha256-PX8mls0m/7B5WULEDVHutzvjAr0a54vg734mBbRQZNA=",
+    "rev": "v2.6.0",
+    "sha256": "sha256-OzxTPxk3lfmA13KfDGBvDd1AqCsKRw+bv7QiEo9fPQc=",
    "vendorSha256": null,
-    "version": "2.5.1"
+    "version": "2.6.0"
  },
  "heroku": {
    "owner": "heroku",
@ -621,10 +621,10 @@
    "owner": "kingsoftcloud",
    "provider-source-address": "registry.terraform.io/kingsoftcloud/ksyun",
    "repo": "terraform-provider-ksyun",
-    "rev": "v1.3.43",
-    "sha256": "sha256-HOZ1nhHLdiYy+WR2y4OsyRGReK+OJFTaWqYU0X4eEQ0=",
+    "rev": "v1.3.46",
+    "sha256": "sha256-qaRsja+pj0DgOZX9nNHSnCI2Ew18r3b5F0Ovqj3mR/Q=",
    "vendorSha256": "sha256-nbAEaRFtFtB4ftLgnCv3MmkjFFbcNkCuxZc+G8/ObPE=",
-    "version": "1.3.43"
+    "version": "1.3.46"
  },
  "kubectl": {
    "owner": "gavinbunney",
@ -666,10 +666,10 @@
    "owner": "linode",
    "provider-source-address": "registry.terraform.io/linode/linode",
    "repo": "terraform-provider-linode",
-    "rev": "v1.27.2",
-    "sha256": "sha256-Do9HOtgnSNnSUp3SSVwyzx9LPFSig/tO3GSigUrRcf4=",
-    "vendorSha256": "sha256-ZJQAZk4TaKT+hLM46gtV1XmBCtwuKwtoom9tPGaOWhc=",
-    "version": "1.27.2"
+    "rev": "v1.28.0",
+    "sha256": "sha256-FkfyyG+DcfsTQY319zmg5iiCgAW8Eu2PxWF35vd51Ng=",
+    "vendorSha256": "sha256-fWD1Qf6vFe/MH2K2yFufCFBcVuos7FD31ShOA9GvsWw=",
+    "version": "1.28.0"
  },
  "linuxbox": {
    "owner": "numtide",
@ -783,10 +783,10 @@
    "owner": "newrelic",
    "provider-source-address": "registry.terraform.io/newrelic/newrelic",
    "repo": "terraform-provider-newrelic",
-    "rev": "v2.47.0",
-    "sha256": "sha256-AXzf6wCQQyxQMRd6w+fiKTSCPebUtW1ZOGs3y7uNRNM=",
+    "rev": "v2.47.1",
+    "sha256": "sha256-iC4N8o+VJ5/TFGBO8O+SONMZVjHxZ+4+7ZuDDnAtZC4=",
    "vendorSha256": "sha256-sMH/sdrMxIw/2jzUcYL9WwVNUsn12K+gPMR68zpXYIA=",
-    "version": "2.47.0"
+    "version": "2.47.1"
  },
  "nomad": {
    "owner": "hashicorp",
@ -838,10 +838,10 @@
    "owner": "oracle",
    "provider-source-address": "registry.terraform.io/oracle/oci",
    "repo": "terraform-provider-oci",
-    "rev": "v4.79.0",
-    "sha256": "sha256-GFfrcRsFcSx/X5HpKkV+s2XCgt8qDGQSIdVUgVUjbXM=",
+    "rev": "v4.80.1",
+    "sha256": "sha256-suvtUABb+bLPAyMfS3btwVA4HVZofqKV1Lr/5RczBbw=",
    "vendorSha256": null,
-    "version": "4.79.0"
+    "version": "4.80.1"
  },
  "okta": {
    "owner": "okta",
@ -883,10 +883,10 @@
    "owner": "opentelekomcloud",
    "provider-source-address": "registry.terraform.io/opentelekomcloud/opentelekomcloud",
    "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.29.5",
-    "sha256": "sha256-/76lJWy5x2XKl0RtBNKH8thHf1vyups4TVWHI/Coxd0=",
-    "vendorSha256": "sha256-jxtkF3VXrsfF/Dpp7mDz+3XYootoxQX3YSp9bX7j6Cg=",
-    "version": "1.29.5"
+    "rev": "v1.29.6",
+    "sha256": "sha256-zhYmwTJ80+w7H7DJxPjMMtLTsHCEhW9G9x5sMz5IRkM=",
+    "vendorSha256": "sha256-SE6ty/mLRo8nvxrPBW1cVhbxpiYDXr3cmjifF40RrmM=",
+    "version": "1.29.6"
  },
  "opsgenie": {
    "owner": "opsgenie",
@ -901,10 +901,10 @@
    "owner": "ovh",
    "provider-source-address": "registry.terraform.io/ovh/ovh",
    "repo": "terraform-provider-ovh",
-    "rev": "v0.18.0",
-    "sha256": "sha256-GTyhXAFf0GqjeYh961DyE1ujjUlll5ifGryJGzo9BEI=",
+    "rev": "v0.18.1",
+    "sha256": "sha256-DoFjm2o6U/e16jhVNtezQ82dbSh1ZfTK/YPo38tHokA=",
    "vendorSha256": null,
-    "version": "0.18.0"
+    "version": "0.18.1"
  },
  "pagerduty": {
    "owner": "PagerDuty",
@ -919,10 +919,10 @@
    "owner": "PaloAltoNetworks",
    "provider-source-address": "registry.terraform.io/PaloAltoNetworks/panos",
    "repo": "terraform-provider-panos",
-    "rev": "v1.10.1",
-    "sha256": "sha256-acxObc7cgZgyxoCQusrkUzFC68cT3WhExiw2LscKoiQ=",
+    "rev": "v1.10.2",
+    "sha256": "sha256-da3ixmkg/xYr182cnAva6DqtCD5KTC3FkFHkvmMm9jA=",
    "vendorSha256": null,
-    "version": "1.10.1"
+    "version": "1.10.2"
  },
  "pass": {
    "owner": "camptocamp",
@ -982,10 +982,10 @@
    "owner": "tenstad",
    "provider-source-address": "registry.terraform.io/tenstad/remote",
    "repo": "terraform-provider-remote",
-    "rev": "v0.0.25",
-    "sha256": "sha256-sthHyzjf/6sgI0Acw//Z4ybxy4TwNpPIi8f7MmJh0N0=",
+    "rev": "v0.1.0",
+    "sha256": "sha256-h6V2sd6j2HzIN1MVMBMqquM54fzmzHPcPfsP5t4bU1A=",
    "vendorSha256": "sha256-ckPs3iaFbmHbBnwRuYn9XdnGZsj+UoYK4OE/9B6Z6Kc=",
-    "version": "0.0.25"
+    "version": "0.1.0"
  },
  "rundeck": {
    "owner": "rundeck",
@ -1063,10 +1063,10 @@
    "owner": "Snowflake-Labs",
    "provider-source-address": "registry.terraform.io/Snowflake-Labs/snowflake",
    "repo": "terraform-provider-snowflake",
-    "rev": "v0.35.0",
-    "sha256": "sha256-RSwSyNQmHzx5cn6aiaInP4m/fCgWkL/1lMoJAib3fkA=",
+    "rev": "v0.36.0",
+    "sha256": "sha256-OrQARzrraaXvwGyv4L/IVLFxgOk+JqMQAY3pXO7GTHM=",
    "vendorSha256": "sha256-I0d7Nm8h7vBHxvcyTousg7Uc+QuYu8FCPabPNMw8rGM=",
-    "version": "0.35.0"
+    "version": "0.36.0"
  },
  "sops": {
    "owner": "carlpett",
@ -1108,19 +1108,19 @@
    "owner": "SumoLogic",
    "provider-source-address": "registry.terraform.io/SumoLogic/sumologic",
    "repo": "terraform-provider-sumologic",
-    "rev": "v2.16.1",
-    "sha256": "sha256-CLqDFqYoScQTQuaB36CupWHuF8rUn8PBV8EJ0MJuIeE=",
+    "rev": "v2.16.2",
+    "sha256": "sha256-/JQXnGpUbAIsz2zErrHe97ggGdjnWkvhYm8SHTh/xCs=",
    "vendorSha256": "sha256-7DGY+L41bJJrtLwdWgu2aMCefgcmtR6tmH12foi68Kc=",
-    "version": "2.16.1"
+    "version": "2.16.2"
  },
  "tencentcloud": {
    "owner": "tencentcloudstack",
    "provider-source-address": "registry.terraform.io/tencentcloudstack/tencentcloud",
    "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.73.1",
-    "sha256": "sha256-vMWT4Kj8ROf3iTSd1Gy/CfuiDEQUUjfRR8+nSlbhrZo=",
+    "rev": "v1.73.3",
+    "sha256": "sha256-wb1OCD0WupHUSgQJSX1don8GPmqgTqKKap/8DpDasNQ=",
    "vendorSha256": null,
-    "version": "1.73.1"
+    "version": "1.73.3"
  },
  "tfe": {
    "owner": "hashicorp",
@ -1199,10 +1199,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/vault",
    "repo": "terraform-provider-vault",
-    "rev": "v3.6.0",
-    "sha256": "sha256-eeE6ThAz7RwePS65RZXbz+PUfm/KlE+f+nJWvLTCSmA=",
-    "vendorSha256": "sha256-KSGhIoUKadAuiMQkJEyYCDt7GXZ9deiV14LV4gEOpVg=",
-    "version": "3.6.0"
+    "rev": "v3.7.0",
+    "sha256": "sha256-n2sUc71Ymk2kI9bpQxp2TRG4hte5/xIP+NbUxBwyNaM=",
+    "vendorSha256": "sha256-TqhnjsK36EGpDlN4yy1jd/1KpdOT+hu4koMM3VCJEV0=",
+    "version": "3.7.0"
  },
  "vcd": {
    "owner": "vmware",
@ -1244,10 +1244,10 @@
    "owner": "vmware",
    "provider-source-address": "registry.terraform.io/vmware/vra7",
    "repo": "terraform-provider-vra7",
-    "rev": "v3.0.5",
-    "sha256": "sha256-4YhaABbuG4GhWYEiGrUvf4H/8dd7wWHY08CkTWCqgr8=",
+    "rev": "v3.0.6",
+    "sha256": "sha256-lHyrBJz6954te57uKpgrqOVztDsDUSqkHtWXnlG0QUw=",
    "vendorSha256": null,
-    "version": "3.0.5"
+    "version": "3.0.6"
  },
  "vsphere": {
    "owner": "hashicorp",
@ -1262,10 +1262,10 @@
    "owner": "vultr",
    "provider-source-address": "registry.terraform.io/vultr/vultr",
    "repo": "terraform-provider-vultr",
-    "rev": "v2.11.2",
-    "sha256": "sha256-cxNSsxAnCw7rZNljR87dN+vYvnwniN3j6VKeswIOv/g=",
+    "rev": "v2.11.3",
+    "sha256": "sha256-Dq4keHT2AWh1zfBYFj6ig2BfU3u4amsp7IB/5Szo/38=",
    "vendorSha256": null,
-    "version": "2.11.2"
+    "version": "2.11.3"
  },
  "wavefront": {
    "owner": "vmware",
--- a/pkgs/applications/networking/errbot/default.nix
+++ b/pkgs/applications/networking/errbot/default.nix
@ -1,32 +1,12 @@
 { lib
-, ansi
-, buildPythonApplication
-, colorlog
-, daemonize
-, deepmerge
-, dulwich
 , fetchFromGitHub
-, flask
 , glibcLocales
-, hypchat
-, irc
-, jinja2
-, markdown
-, mock
-, pyasn1
-, pyasn1-modules
-, pygments
-, pygments-markdown-lexer
-, pyopenssl
-, pytestCheckHook
-, requests
-, slackclient
-, sleekxmpp
-, telegram
-, webtest
+, python39
 }:

-buildPythonApplication rec {
+let
+  python3 = python39;
+in python3.pkgs.buildPythonApplication rec {
  pname = "errbot";
  version = "6.1.7";

@ -41,7 +21,7 @@ buildPythonApplication rec {

  buildInputs = [ glibcLocales ];

-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3.pkgs; [
    ansi
    colorlog
    daemonize
@ -64,7 +44,7 @@ buildPythonApplication rec {
    webtest
  ];

-  checkInputs = [
+  checkInputs = with python3.pkgs; [
    mock
    pytestCheckHook
  ];
--- a/pkgs/applications/networking/instant-messengers/jami/client-gnome.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/client-gnome.nix
@ -1,64 +0,0 @@
-{ version
-, src
-, jami-meta
-, stdenv
-, lib
-, pkg-config
-, cmake
-, wrapQtAppsHook
-, wrapGAppsHook
-, gtk3-x11
-, networkmanager # for libnm
-, libayatana-appindicator
-, libnotify
-, clutter-gtk
-, libcanberra-gtk3
-, webkitgtk
-, qrencode
-, jami-libclient
-, qttools
-}:
-
-stdenv.mkDerivation {
-  pname = "jami-client-gnome";
-  inherit version src;
-
-  sourceRoot = "source/client-gnome";
-
-  preConfigure = ''
-    echo ${version} > version.txt
-  '';
-
-  nativeBuildInputs = [
-    pkg-config
-    cmake
-    wrapGAppsHook
-    wrapQtAppsHook
-  ];
-  # To spare double wrapping
-  dontWrapGApps = true;
-  preFixup = ''
-    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
-    # Users that set CLUTTER_BACKEND=wayland in their default environment will
-    # encounter a segfault due to:
-    # https://git.jami.net/savoirfairelinux/jami-client-gnome/-/issues/1100 .
-    qtWrapperArgs+=("--unset" "CLUTTER_BACKEND")
-  '';
-
-  buildInputs = [
-    qttools
-    jami-libclient
-    gtk3-x11
-    networkmanager
-    libayatana-appindicator
-    libnotify
-    clutter-gtk
-    libcanberra-gtk3
-    webkitgtk
-    qrencode
-  ];
-
-  meta = jami-meta // {
-    description = "The client based on GTK" + jami-meta.description;
-  };
-}
--- a/pkgs/applications/networking/instant-messengers/jami/client-qt.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/client-qt.nix
@ -1,8 +1,8 @@
 { version
 , src
 , jami-meta
-, mkDerivation
 , lib
+, stdenv
 , pkg-config
 , cmake
 , networkmanager # for libnm
@ -10,18 +10,19 @@
 , qttools # for translations
 , wrapQtAppsHook
 , libnotify
-, qrencode
-, qtwebengine
+, qt5compat
+, qtbase
 , qtdeclarative
-, qtquickcontrols2
+, qrencode
 , qtmultimedia
+, qtnetworkauth
 , qtsvg
+, qtwebengine
 , qtwebchannel
-, qtgraphicaleffects # no gui without this
 , jami-libclient
 }:

-mkDerivation {
+stdenv.mkDerivation {
  pname = "jami-client-qt";
  inherit version src;

@ -33,6 +34,7 @@ mkDerivation {
  '';

  nativeBuildInputs = [
+    wrapQtAppsHook
    pkg-config
    cmake
    python3
@ -43,14 +45,20 @@ mkDerivation {
    jami-libclient
    networkmanager
    libnotify
+    qtbase
+    qt5compat
    qrencode
-    qtwebengine
+    qtnetworkauth
    qtdeclarative
-    qtquickcontrols2
    qtmultimedia
    qtsvg
    qtwebchannel
-    qtgraphicaleffects
+    qtwebengine
+  ];
+
+  qtWrapperArgs = [
+    # With wayland the titlebar is not themed and the wmclass is wrong.
+    "--set-default QT_QPA_PLATFORM xcb"
  ];

  meta = jami-meta // {
--- a/pkgs/applications/networking/instant-messengers/jami/config/pjsip_args_common
+++ b/pkgs/applications/networking/instant-messengers/jami/config/pjsip_args_common
@ -0,0 +1,19 @@
+--disable-sound
+--enable-video
+--enable-ext-sound
+--disable-speex-aec
+--disable-g711-codec
+--disable-l16-codec
+--disable-gsm-codec
+--disable-g722-codec
+--disable-g7221-codec
+--disable-speex-codec
+--disable-ilbc-codec
+--disable-opencore-amr
+--disable-silk
+--disable-sdl
+--disable-ffmpeg
+--disable-v4l2
+--disable-openh264
+--disable-resample
+--disable-libwebrtc
--- a/pkgs/applications/networking/instant-messengers/jami/config/pjsip_args_linux
+++ b/pkgs/applications/networking/instant-messengers/jami/config/pjsip_args_linux
@ -0,0 +1 @@
+--enable-epoll
--- a/pkgs/applications/networking/instant-messengers/jami/daemon.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/daemon.nix
@ -58,16 +58,22 @@ let

  pjsip-jami = pjsip.overrideAttrs (old:
    let
-      src-args = import ./pjproject-src.nix;
-      version = lib.concatStrings (lib.lists.take 7 (lib.stringToCharacters src-args.rev));
      patch-src = src + "/daemon/contrib/src/pjproject/";
    in
-    {
-      inherit version;
+    rec {
+      version = "e1f389d0b905011e0cb62cbdf7a8b37fc1bcde1a";

-      src = fetchFromGitHub src-args;
+      src = fetchFromGitHub {
+        owner = "savoirfairelinux";
+        repo = "pjproject";
+        rev = version;
+        sha256 = "sha256-6t+3b7pvvwi+VD05vxtujabEJmWmJTAeyD/Dapav10Y=";
+      };

      patches = old.patches ++ (map (x: patch-src + x) (readLinesToList ./config/pjsip_patches));
+
+      configureFlags = (readLinesToList ./config/pjsip_args_common)
+        ++ lib.optionals stdenv.isLinux (readLinesToList ./config/pjsip_args_linux);
    });

  opendht-jami = opendht.override {
--- a/pkgs/applications/networking/instant-messengers/jami/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/default.nix
@ -4,21 +4,21 @@
 , fetchzip
 , jack
 , udev
-, libsForQt5
+, qt6Packages
 }:

-rec {
-  version = "20211223.2.37be4c3";
+let
+  version = "20220503.1550.0f35faa";

  src = fetchzip {
    url = "https://dl.jami.net/release/tarballs/jami_${version}.tar.gz";
-    sha256 = "1zw9azwmxr4991nq5kl527lbwlj7psrissgvrkl1kxxbfbdncbhh";
+    hash = "sha256-iCmsgjgGogNjj1k0sYRqx59ZEwFZcJOeVGBNyBlcy1M=";

    stripRoot = false;
    postFetch = ''
      cd $out
-      mv ring-project/* ./
-      rm -r ring-project.rst ring-project client-android client-ios client-macosx client-uwp
+      mv jami-project/* ./
+      rm -r jami-project.rst jami-project client-android client-ios client-macosx client-uwp
      rm daemon/contrib/tarballs/*
    '';
  };
@ -30,12 +30,11 @@ rec {
    platforms = platforms.linux;
    maintainers = [ maintainers.linsui ];
  };
-
+in
+rec {
  jami-daemon = callPackage ./daemon.nix { inherit version src udev jack jami-meta; };

-  jami-libclient = libsForQt5.callPackage ./libclient.nix { inherit version src jami-meta; };
-
-  jami-client-gnome = libsForQt5.callPackage ./client-gnome.nix { inherit version src jami-meta; };
+  jami-libclient = qt6Packages.callPackage ./libclient.nix { inherit version src jami-meta; };

-  jami-client-qt = libsForQt5.callPackage ./client-qt.nix { inherit version src jami-meta; };
+  jami-client-qt = qt6Packages.callPackage ./client-qt.nix { inherit version src jami-meta; };
 }
--- a/pkgs/applications/networking/instant-messengers/jami/libclient.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/libclient.nix
@ -22,6 +22,7 @@ stdenv.mkDerivation {

  buildInputs = [
    jami-daemon
+    jami-daemon.ffmpeg
  ];

  patches = [
--- a/pkgs/applications/networking/instant-messengers/jami/pjproject-src.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/pjproject-src.nix
@ -1,6 +0,0 @@
-{
-  owner = "savoirfairelinux";
-  repo = "pjproject";
-  rev = "e1f389d0b905011e0cb62cbdf7a8b37fc1bcde1a";
-  sha256 = "0inpmyb6mhrzr0g309d6clkc99lddqdvyf9xajz0igvgp9pvgpza";
-}
--- a/pkgs/applications/networking/instant-messengers/jami/update.sh
+++ b/pkgs/applications/networking/instant-messengers/jami/update.sh
@ -3,11 +3,14 @@

 set -e

-jami_dir="$( dirname "${BASH_SOURCE[0]}" )"
+jami_dir=$(readlink -e $(dirname "${BASH_SOURCE[0]}"))
+
+cd $jami_dir/../../../../..

 # Update src version and hash
 version=$(curl -s 'https://dl.jami.net/release/tarballs/?C=M;O=D' | sed -n -E 's/^.*jami_([0-9.a-f]+)\.tar\.gz.*$/\1/p' | head -n 1)
-update-source-version jami-libclient "$version" --file=pkgs/applications/networking/instant-messengers/jami/default.nix
+
+update-source-version jami-libclient "$version" --file=$jami_dir/default.nix

 src=$(nix-build --no-out-link -A jami-libclient.src)

@ -43,8 +46,15 @@ echo "${pjsip_patches}" > "$config_dir/pjsip_patches"

 # Update pjsip version
 pjsip_version=$(sed -n -E 's/.*PJPROJECT_VERSION := ([0-9a-f]+).*/\1/p' ${src}/daemon/contrib/src/pjproject/rules.mak)
-nix-prefetch fetchFromGitHub \
-  --owner savoirfairelinux \
-  --repo pjproject \
-  --rev ${pjsip_version} \
-  --output nix > "${jami_dir}/pjproject-src.nix"
+update-source-version jami-daemon.pjsip "$pjsip_version" --file=pkgs/applications/networking/instant-messengers/jami/daemon.nix
+
+pjsip_rules="${src}/daemon/contrib/src/pjproject/rules.mak"
+
+# Update pjsip args
+pjsip_args_common=$(sed -n '/PJPROJECT_OPTIONS :=/,/with-gnutls/p' ${pjsip_rules} | sed -n -E 's/.*(--[0-9a-z=_-]+).*\\/\1/p')
+echo -e "Common args for pjsip:\n${pjsip_args_common}\n"
+echo "${pjsip_args_common}" > "$config_dir/pjsip_args_common"
+
+pjsip_args_linux=$(sed -n '/HAVE_LINUX/,/endif/p' ${pjsip_rules} | sed -n -E 's/.*(--[0-9a-z=_-]+).*/\1/p')
+echo -e "Linux args for pjsip:\n${pjsip_args_linux}\n"
+echo "${pjsip_args_linux}" > "$config_dir/pjsip_args_linux"
--- a/pkgs/applications/networking/instant-messengers/matrix-commander/default.nix
+++ b/pkgs/applications/networking/instant-messengers/matrix-commander/default.nix
@ -1,38 +1,63 @@
-{ stdenv, lib, fetchFromGitHub, cacert, python3 }:
+{ lib
+, fetchFromGitHub
+, buildPythonApplication
+, cacert
+, setuptools
+, matrix-nio
+, python-magic
+, markdown
+, pillow
+, urllib3
+, aiofiles
+, notify2
+, dbus-python
+, xdg
+, python-olm
+}:

-stdenv.mkDerivation {
+buildPythonApplication rec {
  pname = "matrix-commander";
-  version = "unstable-2021-08-05";
+  version = "2.37.3";

  src = fetchFromGitHub {
    owner = "8go";
    repo = "matrix-commander";
-    rev = "7ab3fd9a0ef4eb19d882cb3701d2025b4d41b63a";
-    sha256 = "sha256-WWf7GbJxGlqIdsS1d0T1DO0WN2RBepHGgJrl/nt7UIg=";
+    rev = "v${version}";
+    sha256 = "sha256-X5tCPR0EqY1dxViwh8/tEjJM2oo81L3H703pPzWzUv8=";
  };

-  buildInputs = [
-    cacert
-    (python3.withPackages(ps: with ps; [
-      matrix-nio
-      magic
-      markdown
-      pillow
-      urllib3
-      aiofiles
-      notify2
-    ]))];
-
-  installPhase = ''
-    runHook preInstall
+  format = "pyproject";

-    mkdir -p $out/bin
-    cp $src/matrix-commander.py $out/bin/matrix-commander
-    chmod +x $out/bin/matrix-commander
+  postPatch = ''
+    # Dependencies already bundled with Python
+    sed -i \
+      -e '/uuid/d' \
+      -e '/argparse/d' \
+      -e '/asyncio/d' \
+      -e '/datetime/d' \
+      setup.cfg requirements.txt

-    runHook postInstall
+    # Dependencies not correctly detected
+    sed -i \
+      -e '/dbus-python/d' \
+      setup.cfg requirements.txt
  '';

+  propagatedBuildInputs = [
+    cacert
+    setuptools
+    matrix-nio
+    python-magic
+    markdown
+    pillow
+    urllib3
+    aiofiles
+    notify2
+    dbus-python
+    xdg
+    python-olm
+  ];
+
  meta = with lib; {
    description = "Simple but convenient CLI-based Matrix client app for sending and receiving";
    homepage = "https://github.com/8go/matrix-commander";
--- a/pkgs/applications/networking/instant-messengers/turses/default.nix
+++ b/pkgs/applications/networking/instant-messengers/turses/default.nix
@ -19,6 +19,10 @@ let
          rev = "v${version}";
          sha256 = "0k4bdlwjna6f1k19jki4xqgckrinkkw8b9wihzymr1l04rwd05nw";
        };
+        propagatedBuildInputs = oldAttrs.propagatedBuildInputs ++ [
+          super.six
+          super.requests.optional-dependencies.socks
+        ];
        doCheck = false;
      });
    };
--- a/pkgs/applications/networking/sync/rsync/base.nix
+++ b/pkgs/applications/networking/sync/rsync/base.nix
@ -1,22 +0,0 @@
-{ lib, fetchurl, fetchpatch }:
-
-rec {
-  version = "3.2.4";
-  src = fetchurl {
-    # signed with key 0048 C8B0 26D4 C96F 0E58  9C2F 6C85 9FB1 4B96 A8C5
-    url = "mirror://samba/rsync/src/rsync-${version}.tar.gz";
-    sha256 = "sha256-b3YYONCAUrC2V5z39nN9k+R/AfTaBMXSTTRHt/Kl+tE=";
-  };
-  upstreamPatchTarball = fetchurl {
-    # signed with key 0048 C8B0 26D4 C96F 0E58  9C2F 6C85 9FB1 4B96 A8C5
-    url = "mirror://samba/rsync/rsync-patches-${version}.tar.gz";
-    sha256 = "sha256-cKWXWQr2xhzz0F1mNCn/n2D/4k5E+cc6TNxp69wTIqQ=";
-  };
-
-  meta = with lib; {
-    description = "Fast incremental file transfer utility";
-    homepage = "https://rsync.samba.org/";
-    license = licenses.gpl3Plus;
-    platforms = platforms.unix;
-  };
-}
--- a/pkgs/applications/networking/sync/rsync/default.nix
+++ b/pkgs/applications/networking/sync/rsync/default.nix
@ -20,27 +20,32 @@
 , nixosTests
 }:

-let
-  base = import ./base.nix { inherit lib fetchurl fetchpatch; };
-in
 stdenv.mkDerivation rec {
  pname = "rsync";
-  version = base.version;
+  version = "3.2.4";

-  mainSrc = base.src;
+  srcs = [
+    (fetchurl {
+      # signed with key 0048 C8B0 26D4 C96F 0E58  9C2F 6C85 9FB1 4B96 A8C5
+      url = "mirror://samba/rsync/src/rsync-${version}.tar.gz";
+      sha256 = "sha256-b3YYONCAUrC2V5z39nN9k+R/AfTaBMXSTTRHt/Kl+tE=";
+    })
+  ] ++ lib.optional enableCopyDevicesPatch (fetchurl {
+    # signed with key 0048 C8B0 26D4 C96F 0E58  9C2F 6C85 9FB1 4B96 A8C5
+    url = "mirror://samba/rsync/rsync-patches-${version}.tar.gz";
+    sha256 = "1wj21v57v135n6fnm2m2dxmb9lhrrg62jgkggldp1gb7d6s4arny";
+  });

-  patchesSrc = base.upstreamPatchTarball;
-
-  srcs = [ mainSrc ] ++ lib.optional enableCopyDevicesPatch patchesSrc;
  patches = lib.optional enableCopyDevicesPatch "./patches/copy-devices.diff";

+  nativeBuildInputs = [ perl ];
+
  buildInputs = [ libiconv zlib popt ]
    ++ lib.optional enableACLs acl
    ++ lib.optional enableZstd zstd
    ++ lib.optional enableLZ4 lz4
    ++ lib.optional enableOpenSSL openssl
    ++ lib.optional enableXXHash xxHash;
-  nativeBuildInputs = [ perl ];

  configureFlags = [
    "--with-nobody-group=nogroup"
@ -48,12 +53,22 @@ stdenv.mkDerivation rec {
    # disable the included zlib explicitly as it otherwise still compiles and
    # links them even.
    "--with-included-zlib=no"
-  ];
+  ]
+  # Work around issue with cross-compilation:
+  #     configure.sh: error: cannot run test program while cross compiling
+  # Remove once 3.2.4 or more recent is released.
+  # The following PR should fix the cross-compilation issue.
+  # Test using `nix-build -A pkgsCross.aarch64-multiplatform.rsync`.
+  # https://github.com/WayneD/rsync/commit/b7fab6f285ff0ff3816b109a8c3131b6ded0b484
+  ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "--enable-simd=no";

  passthru.tests = { inherit (nixosTests) rsyncd; };

-  meta = base.meta // {
-    description = "A fast incremental file transfer utility";
+  meta = with lib; {
+    description = "Fast incremental file transfer utility";
+    homepage = "https://rsync.samba.org/";
+    license = licenses.gpl3Plus;
+    platforms = platforms.unix;
    maintainers = with lib.maintainers; [ ehmry kampfschlaefer ];
  };
 }
--- a/pkgs/applications/networking/sync/rsync/rrsync.nix
+++ b/pkgs/applications/networking/sync/rsync/rrsync.nix
@ -1,13 +1,8 @@
 { lib, stdenv, fetchurl, perl, rsync, fetchpatch }:

-let
-  base = import ./base.nix { inherit lib fetchurl fetchpatch; };
-in
 stdenv.mkDerivation {
  pname = "rrsync";
-  version = base.version;
-
-  src = base.src;
+  inherit (rsync) version srcs;

  buildInputs = [ rsync perl ];

@ -16,6 +11,8 @@ stdenv.mkDerivation {
  dontConfigure = true;
  dontBuild = true;

+  inherit (rsync) patches;
+
  postPatch = ''
    substituteInPlace support/rrsync --replace /usr/bin/rsync ${rsync}/bin/rsync
  '';
@ -26,8 +23,7 @@ stdenv.mkDerivation {
    chmod a+x $out/bin/rrsync
  '';

-  meta = base.meta // {
+  meta = rsync.meta // {
    description = "A helper to run rsync-only environments from ssh-logins";
-    maintainers = [ lib.maintainers.kampfschlaefer ];
  };
 }
--- a/pkgs/applications/science/biology/MACS2/default.nix
+++ b/pkgs/applications/science/biology/MACS2/default.nix
@ -9,6 +9,12 @@ python3.pkgs.buildPythonPackage rec {
    sha256 = "1rcxj943kgzs746f5jrb72x1cp4v50rk3qmad0m99a02vndscb5d";
  };

+  postPatch = ''
+    # remove version check which breaks on 3.10
+    substituteInPlace setup.py \
+      --replace 'if float(sys.version[:3])<3.6:' 'if False:'
+  '';
+
  propagatedBuildInputs = with python3.pkgs; [ numpy ];

  # To prevent ERROR: diffpeak_cmd (unittest.loader._FailedTest) for obsolete
@ -21,5 +27,7 @@ python3.pkgs.buildPythonPackage rec {
    license = licenses.bsd3;
    maintainers = with maintainers; [ gschwartz ];
    platforms = platforms.linux;
+    # error: ‘PyThreadState’ {aka ‘struct _ts’} has no member named ‘use_tracing’; did you mean ‘tracing’?
+    broken = true;
  };
 }
--- a/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "lefthook";
-  version = "0.8.0";
+  version = "1.0.0";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "evilmartians";
    repo = "lefthook";
-    sha256 = "sha256-ahkTxuBjMbvBzPuLtW7AhM2OUtL9Rw+ZqgnGGTkeCQQ=";
+    sha256 = "sha256-UpMzqp4NVvj/Y3OdtI5nGhJHgPIfSlopmyv7jDDpWdM=";
  };

-  vendorSha256 = "sha256-Rp67FnFU27u85t02MIs7wZQoOa8oGsHVVPQ9OdIyTJg=";
+  vendorSha256 = "sha256-LCBQyVSkUywceIlioYRNuRc6FrbPKuhgfw5OocR3NvI=";

  doCheck = false;

--- a/pkgs/applications/version-management/got/default.nix
+++ b/pkgs/applications/version-management/got/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "got";
-  version = "0.69";
+  version = "0.70";

  src = fetchurl {
    url = "https://gameoftrees.org/releases/portable/got-portable-${version}.tar.gz";
-    sha256 = "1cnl0yk866wzjwgas587kvb08njq7db71b5xqsdrwd1varp010vm";
+    sha256 = "0kh7idgbiil58l043lkyjy9lz81yj03b6b3d7ra62jkrkzc4wlrf";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/applications/virtualization/lima/default.nix
+++ b/pkgs/applications/virtualization/lima/default.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "lima";
-  version = "0.11.0";
+  version = "0.11.1";

  src = fetchFromGitHub {
    owner = "lima-vm";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-OqsLHxY7dZKN/zazeDASBt5UsQGieU5laIUeshtS55w=";
+    sha256 = "sha256-tTa/FQiF2qZ36OGORr5fqvKR5i6qo7OTBJFGWJMShQ0=";
  };

-  vendorSha256 = "sha256-0Z+SAEHFJio+N7ATiviBkLPn6cNFlhE3Dsj8CxVtf7c=";
+  vendorSha256 = "sha256-wvb592mmxOeRSX8Rxx2m7tZ2S8wQTcQkL3b6z0F6OEQ=";

  nativeBuildInputs = [ makeWrapper installShellFiles ];

--- a/pkgs/applications/window-managers/sway/default.nix
+++ b/pkgs/applications/window-managers/sway/default.nix
@ -90,6 +90,6 @@ stdenv.mkDerivation rec {
    changelog   = "https://github.com/swaywm/sway/releases/tag/${version}";
    license     = licenses.mit;
    platforms   = platforms.linux;
-    maintainers = with maintainers; [ primeos synthetica ma27 ];
+    maintainers = with maintainers; [ primeos synthetica ];
  };
 }
--- a/pkgs/applications/window-managers/sway/lock-fancy.nix
+++ b/pkgs/applications/window-managers/sway/lock-fancy.nix
@ -46,6 +46,6 @@ in stdenv.mkDerivation rec {
    homepage = "https://github.com/Big-B/swaylock-fancy";
    license = licenses.mit;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ ma27 ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@ -492,6 +492,8 @@ stdenv.mkDerivation {
      hardening_unsupported_flags+=" format stackprotector strictoverflow"
    '' + optionalString cc.langD or false ''
      hardening_unsupported_flags+=" format"
+    '' + optionalString cc.langFortran or false ''
+      hardening_unsupported_flags+=" format"
    '' + optionalString targetPlatform.isWasm ''
      hardening_unsupported_flags+=" stackprotector fortify pie pic"
    ''
--- a/pkgs/data/misc/mailcap/default.nix
+++ b/pkgs/data/misc/mailcap/default.nix
@ -1,23 +1,25 @@
-{ lib, fetchzip }:
+{ lib, stdenv, fetchurl }:

-let
+stdenv.mkDerivation rec {
+  pname = "mailcap";
  version = "2.1.53";

-in fetchzip {
-  name = "mailcap-${version}";
+  src = fetchurl {
+    url = "https://releases.pagure.org/mailcap/mailcap-${version}.tar.xz";
+    sha256 = "sha256-Xuou8XswSXe6PsuHr61DGfoEQPgl5Pb7puj6L/64h4U=";
+  };

-  url = "https://releases.pagure.org/mailcap/mailcap-${version}.tar.xz";
-  sha256 = "sha256-6JPj2tZgoTEZ8hNEi9ZZhElBNm9SRTSXifMmCicwiLo=";
+  installPhase = ''
+    runHook preInstall

-  postFetch = ''
-    tar -xavf $downloadedFile --strip-components=1
    substituteInPlace mailcap --replace "/usr/bin/" ""
-    gzip mailcap.5
    sh generate-nginx-mimetypes.sh < mime.types > nginx-mime.types

    install -D -m0644 nginx-mime.types $out/etc/nginx/mime.types
    install -D -m0644 -t $out/etc mailcap mime.types
-    install -D -m0644 -t $out/share/man/man5 mailcap.5.gz
+    install -D -m0644 -t $out/share/man/man5 mailcap.5
+
+    runHook postInstall
  '';

  meta = with lib; {
--- a/pkgs/data/misc/mobile-broadband-provider-info/default.nix
+++ b/pkgs/data/misc/mobile-broadband-provider-info/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "mobile-broadband-provider-info";
-  version = "20220315";
+  version = "20220511";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-H82sctF52xQnl4Nm9wG+HDx1Nf1aZYvFzIKCR8b2RcY=";
+    sha256 = "sha256-dfk+iGZh8DWYMsPigjyvqG505AgEJbjOCpw7DQqyp3Q=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/pantheon/apps/elementary-files/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-files/default.nix
@ -5,7 +5,6 @@
 , pkg-config
 , meson
 , ninja
-, gettext
 , vala
 , python3
 , desktop-file-utils
@ -21,7 +20,6 @@
 , bamf
 , sqlite
 , zeitgeist
-, glib-networking
 , libcloudproviders
 , libgit2-glib
 , wrapGAppsHook
@ -30,7 +28,7 @@

 stdenv.mkDerivation rec {
  pname = "elementary-files";
-  version = "6.1.2";
+  version = "6.1.3";

  outputs = [ "out" "dev" ];

@ -38,13 +36,11 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = "files";
    rev = version;
-    sha256 = "sha256-g9g4wJXjjudk4Qt96XGUiV/X86Ae2lqhM+psh9h+XFE=";
+    sha256 = "sha256-aA3cerBKvxrh5vmDrLeWyLfbz7YjeN0aoTCX9NnVWhQ=";
  };

  nativeBuildInputs = [
    desktop-file-utils
-    gettext
-    glib-networking
    meson
    ninja
    pkg-config
--- a/pkgs/development/compilers/dtc/default.nix
+++ b/pkgs/development/compilers/dtc/default.nix
@ -1,5 +1,15 @@
-{ stdenv, lib, fetchgit, flex, bison, pkg-config, which
-, pythonSupport ? false, python ? null, swig, libyaml
+{ stdenv
+, lib
+, fetchgit
+, fetchpatch
+, flex
+, bison
+, pkg-config
+, which
+, pythonSupport ? false
+, python ? null
+, swig
+, libyaml
 }:

 stdenv.mkDerivation rec {
@ -12,8 +22,17 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-gx9LG3U9etWhPxm7Ox7rOu9X5272qGeHqZtOe68zFs4=";
  };

+  patches = [
+    # fix python 3.10 compatibility
+    # based on without requiring the setup.py rework
+    # https://git.kernel.org/pub/scm/utils/dtc/dtc.git/commit/?id=383e148b70a47ab15f97a19bb999d54f9c3e810f
+    ./python-3.10.patch
+  ];
+
+  nativeBuildInputs = [ flex bison pkg-config which ]
+    ++ lib.optionals pythonSupport [ python swig ];
+
  buildInputs = [ libyaml ];
-  nativeBuildInputs = [ flex bison pkg-config which ] ++ lib.optionals pythonSupport [ python swig ];

  postPatch = ''
    patchShebangs pylibfdt/
--- a/pkgs/development/compilers/dtc/python-3.10.patch
+++ b/pkgs/development/compilers/dtc/python-3.10.patch
@ -0,0 +1,28 @@
+diff --git a/pylibfdt/libfdt.i b/pylibfdt/libfdt.i
+index 51ee801..075ef70 100644
+--- a/pylibfdt/libfdt.i
+++ b/pylibfdt/libfdt.i
+@@ -1044,9 +1044,9 @@ typedef uint32_t fdt32_t;
+ 		$result = Py_None;
+ 	else
+         %#if PY_VERSION_HEX >= 0x03000000
+-            $result = Py_BuildValue("y#", $1, *arg4);
+            $result = Py_BuildValue("y#", $1, (Py_ssize_t)*arg4);
+         %#else
+-            $result = Py_BuildValue("s#", $1, *arg4);
+            $result = Py_BuildValue("s#", $1, (Py_ssize_t)*arg4);
+         %#endif
+ }
+ 
+diff --git a/pylibfdt/setup.py b/pylibfdt/setup.py
+index ef40f15..81e161a 100755
+--- a/pylibfdt/setup.py
+++ b/pylibfdt/setup.py
+@@ -42,6 +42,7 @@ def get_version():
+ libfdt_module = Extension(
+     '_libfdt',
+     sources=[os.path.join(srcdir, 'libfdt.i')],
+    define_macros=[('PY_SSIZE_T_CLEAN', None)],
+     include_dirs=[os.path.join(srcdir, '../libfdt')],
+     libraries=['fdt'],
+     library_dirs=[os.path.join(top_builddir, 'libfdt')],
--- a/pkgs/development/compilers/gcc/9/default.nix
+++ b/pkgs/development/compilers/gcc/9/default.nix
@ -58,22 +58,12 @@ with lib;
 with builtins;

 let majorVersion = "9";
-    /*
-      If you update, please build on aarch64-linux
-      and check braces adjacent to `cplusplus` lines in file
-      ./result/lib/gcc/aarch64-unknown-linux-gnu/9.*.0/include/arm_acle.h
-    */
-    version = "${majorVersion}.3.0";
+    version = "${majorVersion}.5.0";

    inherit (stdenv) buildPlatform hostPlatform targetPlatform;

    patches =
-      # Fix ICE: Max. number of generated reload insns per insn is achieved (90)
-      #
-      # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96796
-      #
-      # This patch can most likely be removed by a post 9.3.0-release.
-      [ ./avoid-cycling-subreg-reloads.patch ./gcc9-asan-glibc-2.34.patch ]
+      [ ]
      ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
      ++ optional targetPlatform.isNetBSD ../libstdc++-netbsd-ctypes.patch
      ++ optional noSysDirs ../no-sys-dirs.patch
@ -83,19 +73,13 @@ let majorVersion = "9";
        sha256 = ""; # TODO: uncomment and check hash when available.
      }) */
      ++ optional langAda ../gnat-cflags.patch
-      ++ optional langAda (fetchpatch {
-        name = "gnat-glibc-234.diff";
-        url = "https://github.com/gcc-mirror/gcc/commit/331763de7d4850702a0f67298f36017c73cdb103.diff";
-        sha256 = "eS4B7vJasnv2N+5v5yB8/iDpKPX8CJDAy2xabWWj+aU=";
-      })
      ++ optional langD ../libphobos.patch
      ++ optional langFortran ../gfortran-driving.patch
      ++ optional (targetPlatform.libc == "musl" && targetPlatform.isPower) ../ppc-musl.patch

      # Obtain latest patch with ../update-mcfgthread-patches.sh
      ++ optional (!crossStageStatic && targetPlatform.isMinGW) ./Added-mcf-thread-model-support-from-mcfgthread.patch
-
-      ++ [ ../libsanitizer-no-cyclades-9.patch ];
+      ;

    /* Cross-gcc settings (build == host != target) */
    crossMingw = targetPlatform != hostPlatform && targetPlatform.libc == "msvcrt";
@ -112,7 +96,7 @@ stdenv.mkDerivation ({

  src = fetchurl {
    url = "mirror://gcc/releases/gcc-${version}/gcc-${version}.tar.xz";
-    sha256 = "1la2yy27ziasyf0jvzk58y1i5b5bq2h176qil550bxhifs39gqbi";
+    sha256 = "13ygjmd938m0wmy946pxdhz9i1wq7z4w10l6pvidak0xxxj9yxi7";
  };

  inherit patches;
--- a/pkgs/development/compilers/go/1.17.nix
+++ b/pkgs/development/compilers/go/1.17.nix
@ -60,11 +60,11 @@ in

 stdenv.mkDerivation rec {
  pname = "go";
-  version = "1.17.10";
+  version = "1.17.11";

  src = fetchurl {
    url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "sha256-KZ5VrzDxVpGwFdjc+OyuckEkElaeWy7OIDYXU6RW8vk=";
+    sha256 = "sha256-rCZJpllExqWr5VBUAA7uPXcZaIDaNqNVX2LgZUDo61Q=";
  };

  strictDeps = true;
--- a/pkgs/development/compilers/go/1.18.nix
+++ b/pkgs/development/compilers/go/1.18.nix
@ -60,11 +60,11 @@ in

 stdenv.mkDerivation rec {
  pname = "go";
-  version = "1.18.2";
+  version = "1.18.3";

  src = fetchurl {
    url = "https://go.dev/dl/go${version}.src.tar.gz";
-    sha256 = "sha256-LETQPqLDQJITerkZumAvLCYaA40I60aFKKPzoo5WZ+I=";
+    sha256 = "sha256-ABI4bdy7XzNQ5AfGeZI4EdvSg/zcQhckkxYUqELsvC0=";
  };

  strictDeps = true;
--- a/pkgs/development/compilers/graalvm/community-edition/default.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/default.nix
@ -1,4 +1,4 @@
-{ callPackage, fetchpatch, zlib, Foundation }:
+{ callPackage, Foundation }:
 /*
  Add new graal versions and products here and then see update.nix on how to
  generate the sources.
@ -7,15 +7,6 @@
 let
  mkGraal = opts: callPackage (import ./mkGraal.nix opts) {
    inherit Foundation;
-    # remove this once zlib 1.2.13 is released
-    zlib = zlib.overrideAttrs (oldAttrs: {
-      patches = (oldAttrs.patches or [ ]) ++ [
-        (fetchpatch {
-          url = "https://github.com/madler/zlib/commit/ec3df00224d4b396e2ac6586ab5d25f673caa4c2.patch";
-          sha256 = "sha256-jSa3OCigBdpWFDllCWC2rgE9GxCNR0yjsc+bpwPDBEA=";
-        })
-      ];
-    });
  };

  /*
--- a/pkgs/development/interpreters/lua-5/CVE-2022-28805.patch
+++ b/pkgs/development/interpreters/lua-5/CVE-2022-28805.patch
@ -0,0 +1,10 @@
+--- a/src/lparser.c
+++ b/src/lparser.c
+@@ -301,6 +301,7 @@
+     expdesc key;
+     singlevaraux(fs, ls->envn, var, 1);  /* get environment variable */
+     lua_assert(var->k == VLOCAL || var->k == VUPVAL);
+    luaK_exp2anyregup(fs, var);  /* but could be a constant */
+     codestring(ls, &key, varname);  /* key is variable name */
+     luaK_indexed(fs, var, &key);  /* env[varname] */
+   }
--- a/pkgs/development/interpreters/lua-5/default.nix
+++ b/pkgs/development/interpreters/lua-5/default.nix
@ -7,7 +7,17 @@ rec {
    hash = "1yxvjvnbg4nyrdv10bq42gz6dr66pyan28lgzfygqfwy2rv24qgq";
    makeWrapper = makeBinaryWrapper;

-    patches = lib.optional stdenv.isDarwin ./5.4.darwin.patch;
+    patches = lib.optional stdenv.isDarwin ./5.4.darwin.patch
+      ++ [
+        (fetchpatch {
+          name = "CVE-2022-28805.patch";
+          url = "https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa.patch";
+          sha256 = "sha256-YTwoolSnRNJIHFPVijSO6ZDw35BG5oWYralZ8qOb9y8=";
+          stripLen = 1;
+          extraPrefix = "src/";
+          excludes = [ "src/testes/*" ];
+        })
+      ];
  };

  lua5_4_compat = lua5_4.override({
@ -32,7 +42,9 @@ rec {
    sourceVersion = { major = "5"; minor = "2"; patch = "4"; };
    hash = "0jwznq0l8qg9wh5grwg07b5cy3lzngvl5m2nl1ikp6vqssmf9qmr";
    makeWrapper = makeBinaryWrapper;
-    patches = lib.optional stdenv.isDarwin ./5.2.darwin.patch;
+    patches = [
+      ./CVE-2022-28805.patch
+    ] ++ lib.optional stdenv.isDarwin ./5.2.darwin.patch;
  };

  lua5_2_compat = lua5_2.override({
--- a/pkgs/development/interpreters/lua-5/hooks/default.nix
+++ b/pkgs/development/interpreters/lua-5/hooks/default.nix
@ -29,4 +29,12 @@ in {
      name = "luarocks-check-hook";
      deps = [ luarocks ];
    } ./luarocks-check-hook.sh) {};
+
+  # luarocks installs data in a non-overridable location. Until a proper luarocks patch,
+  # we move the files around ourselves
+  luarocksMoveDataFolder = callPackage ({ }:
+    makeSetupHook {
+      name = "luarocks-move-rock";
+      deps = [ ];
+    } ./luarocks-move-data.sh) {};
 }
--- a/pkgs/development/interpreters/lua-5/hooks/luarocks-move-data.sh
+++ b/pkgs/development/interpreters/lua-5/hooks/luarocks-move-data.sh
@ -0,0 +1,15 @@
+# luarocks installs data in a non-overridable location. Until a proper luarocks patch,
+# we move the files around ourselves
+echo "Sourcing luarocks-move-data-hook.sh"
+
+luarocksMoveDataHook () {
+    echo "Executing luarocksMoveDataHook"
+    if [ -d "$out/$rocksSubdir" ]; then
+        cp -rfv "$out/$rocksSubdir/$pname/$version/." "$out"
+    fi
+
+    echo "Finished executing luarocksMoveDataHook"
+}
+
+echo "Using luarocksMoveDataHook"
+preDistPhases+=" luarocksMoveDataHook"
--- a/pkgs/development/interpreters/oak/default.nix
+++ b/pkgs/development/interpreters/oak/default.nix
@ -0,0 +1,25 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "oak";
+  version = "0.2";
+
+  src = fetchFromGitHub {
+    owner = "thesephist";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-00UanINtrFyjQWiAw1ucB4eEODMr9+wT+99Zy2Oc1j4=";
+  };
+
+  vendorSha256 = "sha256-iQtb3zNa57nB6x4InVPw7FCmW7XPw5yuz0OcfASXPD8=";
+
+  meta = with lib; {
+    description = "Expressive, simple, dynamic programming language";
+    homepage = "https://oaklang.org/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ tejasag ];
+  };
+}
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@ -144,7 +144,19 @@ let
    # The configure script uses "arm" as the CPU name for all 32-bit ARM
    # variants when cross-compiling, but native builds include the version
    # suffix, so we do the same.
-    pythonHostPlatform = "${parsed.kernel.name}-${parsed.cpu.name}";
+    pythonHostPlatform = let
+      cpu = {
+        # According to PEP600, Python's name for the Power PC
+        # architecture is "ppc", not "powerpc".  Without the Rosetta
+        # Stone below, the PEP600 requirement that "${ARCH} matches
+        # the return value from distutils.util.get_platform()" fails.
+        # https://peps.python.org/pep-0600/
+        powerpc = "ppc";
+        powerpcle = "ppcle";
+        powerpc64 = "ppc64";
+        powerpc64le = "ppc64le";
+      }.${parsed.cpu.name} or parsed.cpu.name;
+    in "${parsed.kernel.name}-${cpu}";

    # https://github.com/python/cpython/blob/e488e300f5c01289c10906c2e53a8e43d6de32d8/configure.ac#L724
    multiarchCpu =
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@ -230,7 +230,7 @@ in {
    enableOptimizations = false;
    enableLTO = false;
    mimetypesSupport = false;
-  } // sources.python39)).overrideAttrs(old: {
+  } // sources.python310)).overrideAttrs(old: {
    # TODO(@Artturin): Add this to the main cpython expr
    strictDeps = true;
    pname = "python3-minimal";
--- a/pkgs/development/interpreters/spidermonkey/78.nix
+++ b/pkgs/development/interpreters/spidermonkey/78.nix
@ -4,7 +4,7 @@
 , autoconf213
 , pkg-config
 , perl
-, python3
+, python39
 , zip
 , buildPackages
 , which
@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
    rustc.llvmPackages.llvm # for llvm-objdump
    perl
    pkg-config
-    python3
+    python39
    rust-cbindgen
    rustc
    which
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@ -37,6 +37,10 @@ stdenv.mkDerivation rec {
  ] ++ (lib.optional stdenv.isSunOS ./implement-getgrouplist.patch);

  postPatch = ''
+    # We need to generate the file ourselves.
+    # https://gitlab.freedesktop.org/dbus/dbus/-/merge_requests/317
+    rm doc/catalog.xml
+
    substituteInPlace bus/Makefile.am \
      --replace 'install-data-hook:' 'disabled:' \
      --replace '$(mkinstalldirs) $(DESTDIR)$(localstatedir)/run/dbus' ':'
@ -98,6 +102,11 @@ stdenv.mkDerivation rec {

  doCheck = true;

+  makeFlags = [
+    # Fix paths in XML catalog broken by mismatching build/install datadir.
+    "dtddir=${placeholder "out"}/share/xml/dbus-1"
+  ];
+
  installFlags = [
    "sysconfdir=${placeholder "out"}/etc"
    "datadir=${placeholder "out"}/share"
--- a/pkgs/development/libraries/dbus/make-dbus-conf.nix
+++ b/pkgs/development/libraries/dbus/make-dbus-conf.nix
@ -1,4 +1,8 @@
-{ runCommand, writeText, libxslt, dbus
+{ runCommand
+, writeText
+, libxslt
+, dbus
+, findXMLCatalogs
 , serviceDirectories ? []
 , suidHelper ? "/var/setuid-wrappers/dbus-daemon-launch-helper"
 , apparmor ? "disabled" # one of enabled, disabled, required
@ -14,19 +18,15 @@ runCommand "dbus-1"
    inherit serviceDirectories suidHelper apparmor;
    preferLocalBuild = true;
    allowSubstitutes = false;
-    XML_CATALOG_FILES = writeText "dbus-catalog.xml" ''
-      <?xml version="1.0"?>
-      <!DOCTYPE catalog PUBLIC
-        "-//OASIS//DTD Entity Resolution XML Catalog V1.0//EN"
-        "http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd">

-      <catalog xmlns="urn:oasis:names:tc:entity:xmlns:xml:catalog">
-        <rewriteSystem
-          systemIdStartString="http://www.freedesktop.org/standards/dbus/1.0/"
-          rewritePrefix="file://${dbus}/share/xml/dbus-1/"/>
-      </catalog>
-    '';
-    nativeBuildInputs = [ libxslt.bin ];
+    nativeBuildInputs = [
+      libxslt.bin
+      findXMLCatalogs
+    ];
+
+    buildInputs = [
+      dbus.out
+    ];
  }
  ''
    mkdir -p $out
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@ -45,11 +45,11 @@ in

 stdenv.mkDerivation rec {
  pname = "glib";
-  version = "2.72.1";
+  version = "2.72.2";

  src = fetchurl {
    url = "mirror://gnome/sources/glib/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "wH5XFHslTO+SzoCgN43AwCpDWOfeRwLp9AMGl4EJX+I=";
+    sha256 = "eNWZoTPbp/4gNt+o24+2Exq5ZCeD/JV4sHogmVJS0t4=";
  };

  patches = optionals stdenv.isDarwin [
--- a/pkgs/development/libraries/gnu-efi/default.nix
+++ b/pkgs/development/libraries/gnu-efi/default.nix
@ -1,24 +1,17 @@
-{ lib, stdenv, buildPackages, fetchurl, fetchpatch, pciutils }:
+{ lib, stdenv, buildPackages, fetchurl, pciutils
+, gitUpdater }:

 with lib;

 stdenv.mkDerivation rec {
  pname = "gnu-efi";
-  version = "3.0.11";
+  version = "3.0.14";

  src = fetchurl {
    url = "mirror://sourceforge/gnu-efi/${pname}-${version}.tar.bz2";
-    sha256 = "1ffnc4xbzfggs37ymrgfx76j56kk2644c081ivhr2bjkla9ag3gj";
+    sha256 = "tztkOg1Wl9HzltdDFEjoht2AVmh4lXjj4aKCd8lShDU=";
  };

-  patches = [
-    # Fix build on armv6l
-    (fetchpatch {
-      url = "https://sourceforge.net/p/gnu-efi/patches/_discuss/thread/25bb273a18/9c4d/attachment/0001-Fix-ARCH-on-armv6-and-other-32-bit-ARM-platforms.patch";
-      sha256 = "0pj03h20g2bbz6fr753bj1scry6919h57l1h86z3b6q7hqfj0b4r";
-    })
-  ];
-
  buildInputs = [ pciutils ];

  hardeningDisable = [ "stackprotector" ];
@ -29,6 +22,12 @@ stdenv.mkDerivation rec {
    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
  ];

+  passthru.updateScript = gitUpdater {
+    inherit pname version;
+    # No nicer place to find latest release.
+    url = "https://git.code.sf.net/p/gnu-efi/code";
+  };
+
  meta = with lib; {
    description = "GNU EFI development toolchain";
    homepage = "https://sourceforge.net/projects/gnu-efi/";
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@ -93,6 +93,7 @@
 , Foundation
 , MediaToolbox
 , enableGplPlugins ? true
+, bluezSupport ? stdenv.isLinux
 }:

 stdenv.mkDerivation rec {
@ -181,8 +182,9 @@ stdenv.mkDerivation rec {
    mjpegtools
    faad2
    x265
-  ] ++ lib.optionals stdenv.isLinux [
+  ] ++ lib.optionals bluezSupport [
    bluez
+  ] ++ lib.optionals stdenv.isLinux [
    libva # vaapi requires libva -> libdrm -> libpciaccess, which is Linux-only in nixpkgs
    wayland
    wayland-protocols
@ -264,12 +266,12 @@ stdenv.mkDerivation rec {
    "-Dgs=disabled" # depends on `google-cloud-cpp`
    "-Donnx=disabled" # depends on `libonnxruntime` not packaged in nixpkgs as of writing
    "-Dopenaptx=enabled" # since gstreamer-1.20.1 `libfreeaptx` is supported for circumventing the dubious license conflict with `libopenaptx`
+    "-Dbluez=${if bluezSupport then "enabled" else "disabled"}"
  ]
  ++ lib.optionals (!stdenv.isLinux) [
    "-Dva=disabled" # see comment on `libva` in `buildInputs`
  ]
  ++ lib.optionals stdenv.isDarwin [
-    "-Dbluez=disabled"
    "-Dchromaprint=disabled"
    "-Ddirectfb=disabled"
    "-Dflite=disabled"
--- a/pkgs/development/libraries/jansson/default.nix
+++ b/pkgs/development/libraries/jansson/default.nix
@ -1,18 +1,28 @@
-{lib, stdenv, fetchurl}:
+{ lib, stdenv, fetchFromGitHub, cmake }:

 stdenv.mkDerivation rec {
  pname = "jansson";
-  version = "2.13.1";
+  version = "2.14";

-  src = fetchurl {
-    url = "https://digip.org/jansson/releases/${pname}-${version}.tar.gz";
-    sha256 = "0ks7gbs0j8p4dmmi2sq129mxy5gfg0z6220i1jk020mi2zd7gwzl";
+  src = fetchFromGitHub {
+    owner = "akheron";
+    repo = "jansson";
+    rev = "v${version}";
+    sha256 = "sha256-FQgy2+g3AyRVJeniqPQj0KNeHgPdza2pmEIXqSyYry4=";
  };

+  nativeBuildInputs = [ cmake ];
+
+  # networkmanager relies on libjansson.so:
+  #   https://github.com/NixOS/nixpkgs/pull/176302#issuecomment-1150239453
+  cmakeFlags = [ "-DJANSSON_BUILD_SHARED_LIBS=ON" ];
+
  meta = with lib; {
-    homepage = "http://www.digip.org/jansson/";
+    homepage = "https://github.com/akheron/jansson";
    description = "C library for encoding, decoding and manipulating JSON data";
+    changelog = "https://github.com/akheron/jansson/raw/v${version}/CHANGES";
    license = licenses.mit;
    platforms = platforms.all;
+    maintainers = [ maintainers.marsam ];
  };
 }
--- a/pkgs/development/libraries/json-c/default.nix
+++ b/pkgs/development/libraries/json-c/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "json-c";
-  version = "0.15";
+  version = "0.16";

  src = fetchurl {
    url    = "https://s3.amazonaws.com/json-c_releases/releases/${pname}-${version}.tar.gz";
-    sha256 = "1im484iz08j3gmzpw07v16brwq46pxxj65i996kkp2vivcfhmn5q";
+    sha256 = "sha256-jkWsj5bsd5Hq87t+5Q6cIQC7vIe40PHQMMW6igKI2Ws=";
  };

  outputs = [ "out" "dev" ];
@ -15,16 +15,15 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "A JSON implementation in C";
-    homepage    = "https://github.com/json-c/json-c/wiki";
-    maintainers = with maintainers; [ lovek323 ];
-    platforms   = platforms.unix;
-    license = licenses.mit;
-
    longDescription = ''
      JSON-C implements a reference counting object model that allows you to
      easily construct JSON objects in C, output them as JSON formatted strings
      and parse JSON formatted strings back into the C representation of JSON
      objects.
    '';
+    homepage    = "https://github.com/json-c/json-c/wiki";
+    maintainers = with maintainers; [ lovek323 ];
+    platforms   = platforms.unix;
+    license = licenses.mit;
  };
 }
--- a/pkgs/development/libraries/libffi/default.nix
+++ b/pkgs/development/libraries/libffi/default.nix
@ -7,11 +7,6 @@
 , dejagnu
 }:

-# Note: this package is used for bootstrapping fetchurl, and thus
-# cannot use fetchpatch! All mutable patches (generated by GitHub or
-# cgit) that are needed here should be included directly in Nixpkgs as
-# files.
-
 stdenv.mkDerivation rec {
  pname = "libffi";
  version = "3.4.2";
@ -21,7 +16,13 @@ stdenv.mkDerivation rec {
    sha256 = "081nx7wpzds168jbr59m34n6s3lyiq6r8zggvqxvlslsc4hvf3sl";
  };

-  patches = [];
+  # Note: this package is used for bootstrapping fetchurl, and thus
+  # cannot use fetchpatch! All mutable patches (generated by GitHub or
+  # cgit) that are needed here should be included directly in Nixpkgs as
+  # files.
+  patches = [
+    ./libffi-powerpc64.patch
+  ];

  strictDeps = true;
  outputs = [ "out" "dev" "man" "info" ];
--- a/pkgs/development/libraries/libffi/libffi-powerpc64.patch
+++ b/pkgs/development/libraries/libffi/libffi-powerpc64.patch
@ -0,0 +1,23 @@
+https://github.com/libffi/libffi/issues/668
+--- a/src/powerpc/linux64.S
+++ b/src/powerpc/linux64.S
+@@ -29,6 +29,8 @@
+ #include <fficonfig.h>
+ #include <ffi.h>
+ 
+	.machine altivec
+
+ #ifdef POWERPC64
+ 	.hidden	ffi_call_LINUX64
+ 	.globl	ffi_call_LINUX64
+--- a/src/powerpc/linux64_closure.S
+++ b/src/powerpc/linux64_closure.S
+@@ -30,6 +30,8 @@
+ 
+ 	.file	"linux64_closure.S"
+ 
+	.machine altivec
+
+ #ifdef POWERPC64
+ 	FFI_HIDDEN (ffi_closure_LINUX64)
+ 	.globl  ffi_closure_LINUX64
--- a/pkgs/development/libraries/libqmi/default.nix
+++ b/pkgs/development/libraries/libqmi/default.nix
@ -45,8 +45,8 @@ stdenv.mkDerivation rec {

  configureFlags = [
    "--with-udev-base-dir=${placeholder "out"}/lib/udev"
-    "--enable-gtk-doc"
-    "--enable-introspection"
+    "--enable-gtk-doc=${if (stdenv.buildPlatform == stdenv.hostPlatform) then "yes" else "no"}"
+    "--enable-introspection=${if (stdenv.buildPlatform == stdenv.hostPlatform) then "yes" else "no"}"
  ];

  enableParallelBuilding = true;
--- a/pkgs/development/libraries/libusb1/default.nix
+++ b/pkgs/development/libraries/libusb1/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "libusb";
-  version = "1.0.25";
+  version = "1.0.26";

  src = fetchFromGitHub {
    owner = "libusb";
    repo = "libusb";
    rev = "v${version}";
-    sha256 = "141wygijjcgka0h31504cdlvih4l2j02j67pcbb2l527p7dbc5pn";
+    sha256 = "sha256-LEy45YiFbueCCi8d2hguujMsxBezaTUERHUpFsTKGZQ=";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/mapnik/default.nix
+++ b/pkgs/development/libraries/mapnik/default.nix
@ -1,12 +1,15 @@
 { lib, stdenv, fetchzip
 , boost, cairo, freetype, gdal, harfbuzz, icu, libjpeg, libpng, libtiff
 , libwebp, libxml2, proj, python3, python ? python3, sqlite, zlib
+, sconsPackages

 # supply a postgresql package to enable the PostGIS input plugin
 , postgresql ? null
 }:

-stdenv.mkDerivation rec {
+let
+  scons = sconsPackages.scons_3_0_1;
+in stdenv.mkDerivation rec {
  pname = "mapnik";
  version = "3.1.0";

@ -16,10 +19,16 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-qqPqN4vs3ZsqKgnx21yQhX8OzHca/0O+3mvQ/vnC5EY=";
  };

+  postPatch = ''
+    substituteInPlace configure \
+      --replace '$PYTHON scons/scons.py' ${scons}/bin/scons
+    rm -r scons
+  '';
+
  # a distinct dev output makes python-mapnik fail
  outputs = [ "out" ];

-  nativeBuildInputs = [ python3 ];
+  nativeBuildInputs = [ scons ];

  buildInputs = [
    boost cairo freetype gdal harfbuzz icu libjpeg libpng libtiff
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@ -34,7 +34,8 @@ with lib;
 let
  # Release calendar: https://www.mesa3d.org/release-calendar.html
  # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "22.0.4";
+  # 22.1 on darwin won't build: https://gitlab.freedesktop.org/mesa/mesa/-/issues/6519
+  version = if stdenv.isDarwin then "22.0.4" else "22.1.1";
  branch  = versions.major version;

 self = stdenv.mkDerivation {
@ -48,7 +49,10 @@ self = stdenv.mkDerivation {
      "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
      "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
    ];
-    sha256 = "1m0y8wgy48hmcidsr7sbk5hcw3v0qr8359fd2x34fvl2z9c1z5y7";
+    sha256 = {
+      "22.1.1" = "1w8fpki67238l4yc92hsnsh4402py9zspirbmirxp577zxjhi526";
+      "22.0.4" = "1m0y8wgy48hmcidsr7sbk5hcw3v0qr8359fd2x34fvl2z9c1z5y7";
+    }.${version};
  };

  # TODO:
--- a/pkgs/development/libraries/nss/esr.nix
+++ b/pkgs/development/libraries/nss/esr.nix
@ -1,4 +1,4 @@
 import ./generic.nix {
-  version = "3.68.3";
-  sha256 = "sha256-5NDZsLVhfLM0gSZC7YAfjlH1mVyN2FwN78jMra/Lwzc=";
+  version = "3.68.4";
+  hash = "sha256-K5/T9aG0nzs7KdEgAmdPcEgRViV1b7R3KELsfDm+Fgs=";
 }
--- a/pkgs/development/libraries/nss/generic.nix
+++ b/pkgs/development/libraries/nss/generic.nix
@ -1,4 +1,4 @@
-{ version, sha256 }:
+{ version, hash }:
 { lib
 , stdenv
 , fetchurl
@ -31,7 +31,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/${pname}-${version}.tar.gz";
-    inherit sha256;
+    inherit hash;
  };

  depsBuildBuild = [ buildPackages.stdenv.cc ];
--- a/pkgs/development/libraries/nss/latest.nix
+++ b/pkgs/development/libraries/nss/latest.nix
@ -5,6 +5,6 @@
 #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert

 import ./generic.nix {
-  version = "3.78";
-  sha256 = "sha256-9FXzQeeHwRZzKOgKhPd7mlV9WVBm3aZIahh01y2miAA=";
+  version = "3.79";
+  hash = "sha256-698tapZhO2/nCtV56fmD4OlOARAXHPspmdtjPTOUpRQ=";
 }
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch

 # dependencies
 , cyrus_sasl
@ -21,6 +22,39 @@ stdenv.mkDerivation rec {
    hash = "sha256-gdCTRSMutiSG7PWsrNLFbAxFtKbIwGZhLn9CGiOhz4c";
  };

+  patches = [
+    # ITS#9840 - ldif-filter: fix parallel build failure
+    (fetchpatch {
+      url = "https://github.com/openldap/openldap/commit/7d977f51e6dfa570a471d163b9e8255bdd3dc12f.patch";
+      hash = "sha256:1vid6pj2gmqywbghnd380x19ml241ldc1fyslb6br6q27zpgbdlp";
+    })
+    # ITS#9840 - libraries/Makefile.in: ignore the mkdir errors
+    (fetchpatch {
+      url = "https://github.com/openldap/openldap/commit/71f24015c312171c00ce94c9ff9b9c6664bdca8d.patch";
+      hash = "sha256:1a81vv6nkhgiadnj4g1wyzgzdp2zd151h0vkwvv9gzmqvhwcnc04";
+    })
+    # ITS#7165 back-mdb: check for stale readers on
+    (fetchpatch {
+      url = "https://github.com/openldap/openldap/commit/7e7f01c301db454e8c507999c77b55a1d97efc21.patch";
+      hash = "sha256:1fc2yck2gn3zlpfqjdn56ar206npi8cmb8yg5ny4lww0ygmyzdfz";
+    })
+    # ITS#9858 back-mdb: delay indexer task startup
+    (fetchpatch {
+      url = "https://github.com/openldap/openldap/commit/ac061c684cc79d64ab4089fe3020921a0064a307.patch";
+      hash = "sha256:01f0y50zlcj6n5mfkmb0di4p5vrlgn31zccx4a9k5m8vzxaqmw9d";
+    })
+    # ITS#9858 back-mdb: fix index reconfig
+    (fetchpatch {
+      url = "https://github.com/openldap/openldap/commit/c43c7a937cfb3a781f99b458b7ad71eb564a2bc2.patch";
+      hash = "sha256:02yh0c8cyx14iir5qhfam5shrg5d3115s2nv0pmqdj6najrqc5mm";
+    })
+    # ITS#9157: check for NULL ld
+    (fetchpatch {
+      url = "https://github.com/openldap/openldap/commit/6675535cd6ad01f9519ecd5d75061a74bdf095c7.patch";
+      hash = "sha256:0dali5ifcwba8400s065f0fizl9h44i0mzb06qgxhygff6yfrgif";
+    })
+  ];
+
  # TODO: separate "out" and "bin"
  outputs = [
    "out"
@ -59,7 +93,7 @@ stdenv.mkDerivation rec {
    "ac_cv_func_memcmp_working=yes"
  ] ++ lib.optional stdenv.isFreeBSD "--with-pic";

-  makeFlags= [
+  makeFlags = [
    "CC=${stdenv.cc.targetPrefix}cc"
    "STRIP="  # Disable install stripping as it breaks cross-compiling. We strip binaries anyway in fixupPhase.
    "prefix=${placeholder "out"}"
@ -81,7 +115,7 @@ stdenv.mkDerivation rec {
  ];

  postBuild = ''
-    for module in ${lib.concatStringsSep " " extraContribModules}; do
+    for module in $extraContribModules; do
      make $makeFlags CC=$CC -C contrib/slapd-modules/$module
    done
  '';
@ -105,7 +139,7 @@ stdenv.mkDerivation rec {
  ];

  postInstall = ''
-    for module in ${lib.concatStringsSep " " extraContribModules}; do
+    for module in $extraContribModules; do
      make $installFlags install -C contrib/slapd-modules/$module
    done
    chmod +x "$out"/lib/*.{so,dylib}
@ -116,6 +150,6 @@ stdenv.mkDerivation rec {
    description = "An open source implementation of the Lightweight Directory Access Protocol";
    license = licenses.openldap;
    maintainers = with maintainers; [ ajs124 das_j hexa ];
-    platforms   = platforms.unix;
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@ -6,7 +6,9 @@
 , python3
 , meson
 , ninja
+, eudev
 , systemd
+, enableSystemd ? true
 , pkg-config
 , docutils
 , doxygen
@ -127,8 +129,8 @@ let
      vulkan-headers
      vulkan-loader
      webrtc-audio-processing
-      systemd
-    ] ++ lib.optionals gstreamerSupport [ gst_all_1.gst-plugins-base gst_all_1.gstreamer ]
+    ] ++ (if enableSystemd then [ systemd ] else [ eudev ])
+    ++ lib.optionals gstreamerSupport [ gst_all_1.gst-plugins-base gst_all_1.gstreamer ]
    ++ lib.optionals libcameraSupport [ libcamera libdrm ]
    ++ lib.optional ffmpegSupport ffmpeg
    ++ lib.optionals bluezSupport [ bluez libfreeaptx ldacbt sbc fdk_aac ]
@ -153,7 +155,9 @@ let
      "-Dlibpulse=${mesonEnableFeature pulseTunnelSupport}"
      "-Davahi=${mesonEnableFeature zeroconfSupport}"
      "-Dgstreamer=${mesonEnableFeature gstreamerSupport}"
-      "-Dsystemd-system-service=enabled"
+      "-Dsystemd-system-service=${mesonEnableFeature enableSystemd}"
+      "-Dudev=${mesonEnableFeature (!enableSystemd)}"
+      "-Dudevrulesdir=${placeholder "out"}/lib/udev/rules.d"
      "-Dffmpeg=${mesonEnableFeature ffmpegSupport}"
      "-Dbluez5=${mesonEnableFeature bluezSupport}"
      "-Dbluez5-backend-hsp-native=${mesonEnableFeature nativeHspSupport}"
@ -193,8 +197,11 @@ let
        cp ${buildPackages.pipewire}/nix-support/*.json "$out/nix-support"
      ''}

-      moveToOutput "share/systemd/user/pipewire-pulse.*" "$pulse"
-      moveToOutput "lib/systemd/user/pipewire-pulse.*" "$pulse"
+      ${lib.optionalString enableSystemd ''
+        moveToOutput "share/systemd/user/pipewire-pulse.*" "$pulse"
+        moveToOutput "lib/systemd/user/pipewire-pulse.*" "$pulse"
+      ''}
+
      moveToOutput "bin/pipewire-pulse" "$pulse"

      moveToOutput "bin/pw-jack" "$jack"
--- a/pkgs/development/libraries/portaudio/default.nix
+++ b/pkgs/development/libraries/portaudio/default.nix
@ -3,6 +3,7 @@
 , fetchurl
 , alsa-lib
 , pkg-config
+, which
 , AudioUnit
 , AudioToolbox
 , CoreAudio
@ -18,7 +19,8 @@ stdenv.mkDerivation rec {
    sha256 = "1vrdrd42jsnffh6rq8ap2c6fr4g9fcld89z649fs06bwqx1bzvs7";
  };

-  nativeBuildInputs = [ pkg-config ];
+  strictDeps = true;
+  nativeBuildInputs = [ pkg-config which ];
  buildInputs = lib.optional (!stdenv.isDarwin) alsa-lib;

  configureFlags = [ "--disable-mac-universal" "--enable-cxx" ];
@ -34,6 +36,11 @@ stdenv.mkDerivation rec {
  #     https://github.com/PortAudio/portaudio/commit/28d2781d9216115543aa3f0a0ffb7b4ee0fac551.patch
  enableParallelBuilding = false;

+  postPatch = ''
+    # workaround for the configure script which expects an absolute path
+    export AR=$(which $AR)
+  '';
+
  # not sure why, but all the headers seem to be installed by the make install
  installPhase = ''
    make install
--- a/pkgs/development/libraries/thrift/default.nix
+++ b/pkgs/development/libraries/thrift/default.nix
@ -1,5 +1,15 @@
-{ lib, stdenv, fetchurl, boost, zlib, libevent, openssl, python3, cmake, pkg-config
-, bison, flex
+{ lib
+, stdenv
+, fetchurl
+, boost
+, zlib
+, libevent
+, openssl
+, python3
+, cmake
+, pkg-config
+, bison
+, flex
 , static ? stdenv.hostPlatform.isStatic
 }:

@ -12,15 +22,39 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-9GC1wcow2JGP+V6j62KRs5Uc9RhVNWYIjz8r6JgfYgk=";
  };

-  # Workaround to make the python wrapper not drop this package:
+  # Workaround to make the Python wrapper not drop this package:
  # pythonFull.buildEnv.override { extraLibs = [ thrift ]; }
  pythonPath = [];

-  nativeBuildInputs = [ cmake pkg-config bison flex ];
-  buildInputs = [ boost zlib libevent openssl ]
-    ++ lib.optionals (!static) [ (python3.withPackages (ps: [ps.twisted])) ];
+  nativeBuildInputs = [
+    bison
+    cmake
+    flex
+    pkg-config
+  ];
+
+  buildInputs = [
+    boost
+    libevent
+    openssl
+    zlib
+  ] ++ lib.optionals (!static) [
+    (python3.withPackages (ps: [ps.twisted]))
+  ];
+
+  postPatch = ''
+    # Python 3.10 related failures:
+    # SystemError: PY_SSIZE_T_CLEAN macro must be defined for '#' formats
+    # AttributeError: module 'collections' has no attribute 'Hashable'
+    substituteInPlace test/py/RunClientServer.py \
+      --replace "'FastbinaryTest.py'," "" \
+      --replace "'TestEof.py'," "" \
+      --replace "'TestFrozen.py'," ""
+  '';

-  preConfigure = "export PY_PREFIX=$out";
+  preConfigure = ''
+    export PY_PREFIX=$out
+  '';

  patches = [
    # ToStringTest.cpp is failing from some reason due to locale issue, this
@ -43,12 +77,12 @@ stdenv.mkDerivation rec {
  disabledTests = [
    "PythonTestSSLSocket"
  ] ++ lib.optionals stdenv.isDarwin [
-    # tests that hang up in the darwin sandbox
+    # Tests that hang up in the Darwin sandbox
    "SecurityTest"
    "SecurityFromBufferTest"
    "python_test"

-    # tests that fail in the darwin sandbox when trying to use network
+    # Tests that fail in the Darwin sandbox when trying to use network
    "UnitTests"
    "TInterruptTest"
    "TServerIntegrationTest"
@ -62,6 +96,7 @@ stdenv.mkDerivation rec {
  ];

  doCheck = !static;
+
  checkPhase = ''
    runHook preCheck

@ -69,6 +104,7 @@ stdenv.mkDerivation rec {

    runHook postCheck
  '';
+
  enableParallelChecking = false;

  meta = with lib; {
@ -76,6 +112,6 @@ stdenv.mkDerivation rec {
    homepage = "https://thrift.apache.org/";
    license = licenses.asl20;
    platforms = platforms.linux ++ platforms.darwin;
-    maintainers = [ maintainers.bjornfor ];
+    maintainers = with maintainers; [ bjornfor ];
  };
 }
--- a/pkgs/development/libraries/tracker/default.nix
+++ b/pkgs/development/libraries/tracker/default.nix
@ -29,13 +29,13 @@

 stdenv.mkDerivation rec {
  pname = "tracker";
-  version = "3.3.0";
+  version = "3.3.1";

  outputs = [ "out" "dev" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "Bwb5b+f5XfQqzsgSwd57RZOg1kgyHKg1BqnXHiJBe9o=";
+    sha256 = "Wtb1vJd4Hr9V7NaUfNSuf/QZJRZYDRC9g4Dx3UcZbtI=";
  };

  nativeBuildInputs = [
@ -79,11 +79,7 @@ stdenv.mkDerivation rec {
  doCheck = true;

  postPatch = ''
-    patchShebangs utils/g-ir-merge/g-ir-merge
    patchShebangs utils/data-generators/cc/generate
-    patchShebangs tests/functional-tests/test-runner.sh.in
-    patchShebangs tests/functional-tests/*.py
-    patchShebangs examples/python/endpoint.py
  '';

  preCheck = ''
--- a/pkgs/development/libraries/unicorn/default.nix
+++ b/pkgs/development/libraries/unicorn/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , pkg-config
 , cmake
@ -7,17 +8,23 @@

 stdenv.mkDerivation rec {
  pname = "unicorn";
-  version = "2.0.0-rc5";
+  version = "2.0.0-rc7";

  src = fetchFromGitHub {
    owner = "unicorn-engine";
    repo = pname;
    rev = version;
-    sha256 = "1q9k8swnq4qsi54zdfaap69z56w3yj4n4ggm9pscmmmr69nply5f";
+    hash = "sha256-qlxtFCJBmouPuUEu8RduZM+rbOr52sGjdb8ZRHWmJ/w=";
  };

-  nativeBuildInputs = [ pkg-config cmake ];
-  buildInputs = lib.optionals stdenv.isDarwin [ IOKit ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    IOKit
+  ];

  meta = with lib; {
    description = "Lightweight multi-platform CPU emulator library";
--- a/pkgs/development/libraries/v8/8_x.nix
+++ b/pkgs/development/libraries/v8/8_x.nix
@ -1,5 +1,5 @@
 { stdenv, lib, fetchgit, fetchFromGitHub
-, gn, ninja, python3, glib, pkg-config, icu
+, gn, ninja, python39, glib, pkg-config, icu
 , xcbuild, darwin
 , fetchpatch
 }:
@ -132,11 +132,11 @@ stdenv.mkDerivation rec {
    myGn
    ninja
    pkg-config
-    python3
+    python39
  ] ++ lib.optionals stdenv.isDarwin [
    xcbuild
    darwin.DarwinTools
-    python3.pkgs.setuptools
+    python39.pkgs.setuptools
  ];
  buildInputs = [ glib icu ];

--- a/pkgs/development/libraries/xxHash/default.nix
+++ b/pkgs/development/libraries/xxHash/default.nix
@ -1,4 +1,9 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, fetchpatch
+}:

 stdenv.mkDerivation rec {
  pname = "xxHash";
@ -11,21 +16,35 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-2WoYCO6QRHWrbGP2mK04/sLNTyQLOuL3urVktilAwMA=";
  };

-  # Upstream Makefile does not anticipate that user may not want to
-  # build .so library.
-  postPatch = lib.optionalString stdenv.hostPlatform.isStatic ''
-    sed -i 's/lib: libxxhash.a libxxhash/lib: libxxhash.a/' Makefile
-    sed -i '/LIBXXH) $(DESTDIR/ d' Makefile
-  '';
+  # CMake build fixes
+  patches = [
+    # Merged in https://github.com/Cyan4973/xxHash/pull/649
+    # Should be present in next release
+    (fetchpatch {
+      name = "cmake-install-fix";
+      url = "https://github.com/Cyan4973/xxHash/commit/636f966ecc713c84ddd3b7ccfde2bfb2cc7492a0.patch";
+      sha256 = "sha256-B1PZ/0BXlOrSiPvgCPLvI/sjQvnR0n5PQHOO38LOij0=";
+    })

-  outputs = [ "out" "dev" ];
+    # Submitted at https://github.com/Cyan4973/xxHash/pull/723
+    (fetchpatch {
+      name = "cmake-pkgconfig-fix";
+      url = "https://github.com/Cyan4973/xxHash/commit/5db353bbd05ee5eb1f90afc08d10da9416154e55.patch";
+      sha256 = "sha256-dElgSu9DVo2hY6TTVHLTtt0zkXmQV3nc9i/KbrDkK8s=";
+    })
+  ];

-  makeFlags = [ "PREFIX=$(dev)" "EXEC_PREFIX=$(out)" ];

-  # pkgs/build-support/setup-hooks/compress-man-pages.sh hook fails
-  # to compress symlinked manpages. Avoid compressing manpages until
-  # it's fixed.
-  dontGzipMan = true;
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  # Using unofficial CMake build script to install CMake module files.
+  cmakeDir = "../cmake_unofficial";
+
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=${if stdenv.hostPlatform.isStatic then "OFF" else "ON"}"
+  ];

  meta = with lib; {
    description = "Extremely fast hash algorithm";
@ -39,6 +58,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/Cyan4973/xxHash";
    license = with licenses; [ bsd2 gpl2 ];
    maintainers = with maintainers; [ orivej ];
-    platforms = platforms.unix;
+    platforms = platforms.all;
  };
 }
--- a/pkgs/development/libraries/zimlib/default.nix
+++ b/pkgs/development/libraries/zimlib/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub
+{ lib, stdenv, fetchFromGitHub, fetchzip
 , meson, ninja, pkg-config
 , python3
 , icu
@ -11,13 +11,19 @@

 stdenv.mkDerivation rec {
  pname = "zimlib";
-  version = "6.3.2";
+  version = "7.2.2";

  src = fetchFromGitHub {
    owner = "openzim";
    repo = "libzim";
    rev = version;
-    sha256 = "sha256-xlYu74akK9WFy86hcQe7zp11TImwl8llgDIZBRgmbAI=";
+    sha256 = "sha256-AEhhjinnnMA4NbYL7NVHYeRZX/zfNiidbY/VeFjZuQs=";
+  };
+
+  testData = fetchzip rec {
+    passthru.version = "0.4";
+    url = "https://github.com/openzim/zim-testing-suite/releases/download/v${passthru.version}/zim-testing-suite-${passthru.version}.tar.gz";
+    sha256 = "sha256-2eJqmvs/GrvOD/pq8dTubaiO9ZpW2WqTNQByv354Z0w=";
  };

  nativeBuildInputs = [
@ -39,6 +45,8 @@ stdenv.mkDerivation rec {
    patchShebangs scripts
  '';

+  mesonFlags = [  "-Dtest_data_dir=${testData}" ];
+
  checkInputs = [
    gtest
  ];
--- a/pkgs/development/libraries/zlib/comprehensive-crc-validation-for-wrong-implementations.patch
+++ b/pkgs/development/libraries/zlib/comprehensive-crc-validation-for-wrong-implementations.patch
@ -0,0 +1,51 @@
+From ec3df00224d4b396e2ac6586ab5d25f673caa4c2 Mon Sep 17 00:00:00 2001
+From: Mark Adler <madler@alumni.caltech.edu>
+Date: Wed, 30 Mar 2022 11:14:53 -0700
+Subject: [PATCH] Correct incorrect inputs provided to the CRC functions.
+
+The previous releases of zlib were not sensitive to incorrect CRC
+inputs with bits set above the low 32. This commit restores that
+behavior, so that applications with such bugs will continue to
+operate as before.
+---
+ crc32.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/crc32.c b/crc32.c
+index a1bdce5c2..451887bc7 100644
+--- a/crc32.c
+++ b/crc32.c
+@@ -630,7 +630,7 @@ unsigned long ZEXPORT crc32_z(crc, buf, len)
+ #endif /* DYNAMIC_CRC_TABLE */
+ 
+     /* Pre-condition the CRC */
+-    crc ^= 0xffffffff;
+    crc = (~crc) & 0xffffffff;
+ 
+     /* Compute the CRC up to a word boundary. */
+     while (len && ((z_size_t)buf & 7) != 0) {
+@@ -749,7 +749,7 @@ unsigned long ZEXPORT crc32_z(crc, buf, len)
+ #endif /* DYNAMIC_CRC_TABLE */
+ 
+     /* Pre-condition the CRC */
+-    crc ^= 0xffffffff;
+    crc = (~crc) & 0xffffffff;
+ 
+ #ifdef W
+ 
+@@ -1077,7 +1077,7 @@ uLong ZEXPORT crc32_combine64(crc1, crc2, len2)
+ #ifdef DYNAMIC_CRC_TABLE
+     once(&made, make_crc_table);
+ #endif /* DYNAMIC_CRC_TABLE */
+-    return multmodp(x2nmodp(len2, 3), crc1) ^ crc2;
+    return multmodp(x2nmodp(len2, 3), crc1) ^ (crc2 & 0xffffffff);
+ }
+ 
+ /* ========================================================================= */
+@@ -1112,5 +1112,5 @@ uLong crc32_combine_op(crc1, crc2, op)
+     uLong crc2;
+     uLong op;
+ {
+-    return multmodp(op, crc1) ^ crc2;
+    return multmodp(op, crc1) ^ (crc2 & 0xffffffff);
+ }
--- a/pkgs/development/libraries/zlib/default.nix
+++ b/pkgs/development/libraries/zlib/default.nix
@ -42,6 +42,12 @@ stdenv.mkDerivation (rec {

  patches = [
    ./fix-configure-issue-cross.patch
+    # Starting zlib 1.2.12, zlib is stricter to incorrect CRC inputs
+    # with bits set above the low 32.
+    # see https://github.com/madler/zlib/issues/618
+    # TODO: remove the patch if upstream releases https://github.com/madler/zlib/commit/ec3df00224d4b396e2ac6586ab5d25f673caa4c2
+    # see https://github.com/NixOS/nixpkgs/issues/170539 for history.
+    ./comprehensive-crc-validation-for-wrong-implementations.patch
  ];

  strictDeps = true;
--- a/pkgs/development/mobile/adb-sync/default.nix
+++ b/pkgs/development/mobile/adb-sync/default.nix
@ -38,6 +38,6 @@ stdenv.mkDerivation {
    license = licenses.asl20;
    platforms = platforms.unix;
    hydraPlatforms = [];
-    maintainers = with maintainers; [ scolobb ma27 ];
+    maintainers = with maintainers; [ scolobb ];
  };
 }
--- a/pkgs/development/ocaml-modules/ppx_yojson_conv_lib/default.nix
+++ b/pkgs/development/ocaml-modules/ppx_yojson_conv_lib/default.nix
@ -2,7 +2,7 @@

 buildDunePackage rec {
  pname = "ppx_yojson_conv_lib";
-  version = "0.14.0";
+  version = "0.15.0";

  useDune2 = true;

@ -12,7 +12,7 @@ buildDunePackage rec {
    owner = "janestreet";
    repo = pname;
    rev = "v${version}";
-    sha256 = "12s3xshayy1f8cp9lk6zqwnw60n7cdap55gkksz5w65gdd8bfxmf";
+    sha256 = "sha256-Hpg4AKAe7Q5P5UkBpH+5l1nZbIVA2Dr1Q30D4zkrjGo=";
  };

  propagatedBuildInputs = [ yojson ];
--- a/pkgs/development/python-modules/GitPython/default.nix
+++ b/pkgs/development/python-modules/GitPython/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "gitpython";
-  version = "3.1.25";
+  version = "3.1.27";
  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "gitpython-developers";
    repo = "GitPython";
    rev = version;
-    sha256 = "sha256-ienc7zvLe6t8rkMtC6wVIewUqQBFdFbLc8iPT6aPVrE=";
+    sha256 = "sha256-RA+6JFXHUQoXGErV8+aYuJPsfXzNSZK3kTm6eMbQIss=";
  };

  patches = [
--- a/pkgs/development/python-modules/Rtree/default.nix
+++ b/pkgs/development/python-modules/Rtree/default.nix
@ -1,32 +1,36 @@
-{ lib,
-  stdenv,
-  buildPythonPackage,
-  fetchPypi,
-  libspatialindex,
-  numpy,
-  pytestCheckHook
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchPypi
+, libspatialindex
+, numpy
+, pytestCheckHook
+, pythonOlder
 }:

 buildPythonPackage rec {
-  pname = "Rtree";
-  version = "0.9.7";
+  pname = "rtree";
+  version = "1.0.0";
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
-    inherit pname version;
-    sha256 = "be8772ca34699a9ad3fb4cfe2cfb6629854e453c10b3328039301bbfc128ca3e";
+    pname = "Rtree";
+    inherit version;
+    sha256 = "sha256-0Eg0ghITRrCTuaQlGNQPkhrfRFkVt66jB+smdoyDloI=";
  };

-  buildInputs = [ libspatialindex ];
-
-  patchPhase = ''
+  postPatch = ''
    substituteInPlace rtree/finder.py --replace \
-      "find_library('spatialindex_c')" "'${libspatialindex}/lib/libspatialindex_c${stdenv.hostPlatform.extensions.sharedLibrary}'"
+      'find_library("spatialindex_c")' '"${libspatialindex}/lib/libspatialindex_c${stdenv.hostPlatform.extensions.sharedLibrary}"'
  '';

+  buildInputs = [ libspatialindex ];
+
  checkInputs = [
    numpy
    pytestCheckHook
  ];
+
  pythonImportsCheck = [ "rtree" ];

  meta = with lib; {
--- a/pkgs/development/python-modules/aiomusiccast/default.nix
+++ b/pkgs/development/python-modules/aiomusiccast/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "aiomusiccast";
-  version = "0.14.3";
+  version = "0.14.4";

  format = "pyproject";
  disabled = pythonOlder "3.8";
@ -16,8 +16,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "vigonotion";
    repo = "aiomusiccast";
-    rev = version;
-    hash = "sha256-ELdNxeU9dajWr4VeOyuvNrSi7B+ImVJM/BlZsw3tcKE=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-vSf4Fcioz+ZrXCaFQQbHzhz7vOknCOEFJXduXJlO/wE=";
  };

  postPatch = ''
--- a/Show More
+++ b/Show More