Merge master into haskell-updates

2022-02-20 00:11:55 +00:00 · 2022-02-20 00:11:55 +00:00 · a56ab263df
commit a56ab263df
parent 5c971a179d 508adb0115
249 changed files with 7381 additions and 6123 deletions
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@ -797,7 +797,7 @@ Hook executed at the start of the distribution phase.

 Hook executed at the end of the distribution phase.

-## Shell functions {#ssec-stdenv-functions}
+## Shell functions and utilities {#ssec-stdenv-functions}

 The standard environment provides a number of useful functions.

@ -821,6 +821,19 @@ There’s many more kinds of arguments, they are documented in `nixpkgs/pkgs/bui

 Using the `makeBinaryWrapper` implementation is usually preferred, as it creates a tiny _compiled_ wrapper executable, that can be used as a shebang interpreter. This is needed mostly on Darwin, where shebangs cannot point to scripts, [due to a limitation with the `execve`-syscall](https://stackoverflow.com/questions/67100831/macos-shebang-with-absolute-path-not-working). Compiled wrappers generated by `makeBinaryWrapper` can be inspected with `less <path-to-wrapper>` - by scrolling past the binary data you should be able to see the shell command that generated the executable and there see the environment variables that were injected into the wrapper.

+### `remove-references-to -t` \<storepath\> [ `-t` \<storepath\> ... ] \<file\> ... {#fun-remove-references-to}
+
+Removes the references of the specified files to the specified store files. This is done without changing the size of the file by replacing the hash by `eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee`, and should work on compiled executables. This is meant to be used to remove the dependency of the output on inputs that are known to be unnecessary at runtime. Of course, reckless usage will break the patched programs.
+To use this, add `removeReferencesTo` to `nativeBuildInputs`.
+
+As `remove-references-to` is an actual executable and not a shell function, it can be used with `find`.
+Example removing all references to the compiler in the output:
+```nix
+postInstall = ''
+  find "$out" -type f -exec remove-references-to -t ${stdenv.cc} '{}' +
+'';
+```
+
 ### `substitute` \<infile\> \<outfile\> \<subs\> {#fun-substitute}

 Performs string substitution on the contents of \<infile\>, writing the result to \<outfile\>. The substitutions in \<subs\> are of the following form:
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -13287,7 +13287,7 @@
  };
  yana = {
    email = "yana@riseup.net";
-    github = "alpakido";
+    github = "sowelisuwi";
    githubId = 1643293;
    name = "Yana Timoshenko";
  };
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@ -413,6 +413,15 @@
          <literal>virtualisation.docker.daemon.settings</literal>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          Ntopng (<literal>services.ntopng</literal>) is updated to
+          5.2.1 and uses a separate Redis instance if
+          <literal>system.stateVersion</literal> is at least
+          <literal>22.05</literal>. Existing setups shouldn’t be
+          affected.
+        </para>
+      </listitem>
      <listitem>
        <para>
          The backward compatibility in
@ -677,6 +686,12 @@
          wrapper for <literal>assert</literal> conditions.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The <literal>vpnc</literal> package has been changed to use
+          GnuTLS instead of OpenSSL by default for licensing reasons.
+        </para>
+      </listitem>
      <listitem>
        <para>
          <literal>pkgs.vimPlugins.onedark-nvim</literal> now refers to
@ -926,6 +941,12 @@
          <literal>programs.starship.settings</literal>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The <link xlink:href="https://dino.im">Dino</link> XMPP client
+          was updated to 0.3, adding support for audio and video calls.
+        </para>
+      </listitem>
      <listitem>
        <para>
          <literal>services.mattermost.plugins</literal> has been added
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -136,6 +136,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - If you previously used `/etc/docker/daemon.json`, you need to incorporate the changes into the new option `virtualisation.docker.daemon.settings`.

+- Ntopng (`services.ntopng`) is updated to 5.2.1 and uses a separate Redis instance if `system.stateVersion` is at least `22.05`. Existing setups shouldn't be affected.
+
 - The backward compatibility in `services.wordpress` to configure sites with
  the old interface has been removed. Please use `services.wordpress.sites`
  instead.
@ -213,6 +215,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - `lib.assertMsg` and `lib.assertOneOf` no longer return `false` if the passed condition is `false`, `throw`ing the given error message instead (which makes the resulting error message less cluttered). This will not impact the behaviour of code using these functions as intended, namely as top-level wrapper for `assert` conditions.

+- The `vpnc` package has been changed to use GnuTLS instead of OpenSSL by default for licensing reasons.
+
 - `pkgs.vimPlugins.onedark-nvim` now refers to [navarasu/onedark.nvim](https://github.com/navarasu/onedark.nvim)
  (formerly refers to [olimorris/onedarkpro.nvim](https://github.com/olimorris/onedarkpro.nvim)).

@ -311,6 +315,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 - A new module was added for the [Starship](https://starship.rs/) shell prompt,
  providing the options `programs.starship.enable` and `programs.starship.settings`.

+- The [Dino](https://dino.im) XMPP client was updated to 0.3, adding support for audio and video calls.
+
 - `services.mattermost.plugins` has been added to allow the declarative installation of Mattermost plugins.
  Plugins are automatically repackaged using autoPatchelf.

--- a/nixos/modules/hardware/network/b43.nix
+++ b/nixos/modules/hardware/network/b43.nix
@ -24,10 +24,6 @@ let kernelVersion = config.boot.kernelPackages.kernel.version; in
  ###### implementation

  config = mkIf config.networking.enableB43Firmware {
-    assertions = singleton
-      { assertion = lessThan 0 (builtins.compareVersions kernelVersion "3.2");
-        message = "b43 firmware for kernels older than 3.2 not packaged yet!";
-      };
    hardware.firmware = [ pkgs.b43Firmware_5_1_138 ];
  };

--- a/nixos/modules/hardware/video/capture/mwprocapture.nix
+++ b/nixos/modules/hardware/video/capture/mwprocapture.nix
@ -16,11 +16,6 @@ in

  config = mkIf cfg.enable {

-    assertions = singleton {
-      assertion = versionAtLeast kernelPackages.kernel.version "3.2";
-      message = "Magewell Pro Capture family module is not supported for kernels older than 3.2";
-    };
-
    boot.kernelModules = [ "ProCapture" ];

    environment.systemPackages = [ kernelPackages.mwprocapture ];
--- a/nixos/modules/security/wrappers/default.nix
+++ b/nixos/modules/security/wrappers/default.nix
@ -92,7 +92,6 @@ let
    , permissions
    , ...
    }:
-    assert (lib.versionAtLeast (lib.getVersion config.boot.kernelPackages.kernel) "4.3");
    ''
      cp ${securityWrapper}/bin/security-wrapper "$wrapperDir/${program}"
      echo -n "${source}" > "$wrapperDir/${program}.real"
--- a/nixos/modules/services/backup/mysql-backup.nix
+++ b/nixos/modules/services/backup/mysql-backup.nix
@ -113,9 +113,10 @@ in
        };
      };
      services.mysql-backup = {
-        description = "Mysql backup service";
+        description = "MySQL backup service";
        enable = true;
        serviceConfig = {
+          Type = "oneshot";
          User = cfg.user;
        };
        script = backupScript;
--- a/nixos/modules/services/misc/mbpfan.nix
+++ b/nixos/modules/services/misc/mbpfan.nix
@ -6,7 +6,7 @@ let
  cfg = config.services.mbpfan;
  verbose = if cfg.verbose then "v" else "";
  settingsFormat = pkgs.formats.ini {};
-  settingsFile = settingsFormat.generate "config.conf" cfg.settings;
+  settingsFile = settingsFormat.generate "mbpfan.ini" cfg.settings;

 in {
  options.services.mbpfan = {
@ -36,29 +36,35 @@ in {
        freeformType = settingsFormat.type;

        options.general.min_fan1_speed = mkOption {
-          type = types.int;
+          type = types.nullOr types.int;
          default = 2000;
-          description = "The minimum fan speed.";
+          description = ''
+            The minimum fan speed. Setting to null enables automatic detection.
+            Check minimum fan limits with "cat /sys/devices/platform/applesmc.768/fan*_min".
+          '';
        };
        options.general.max_fan1_speed = mkOption {
-          type = types.int;
+          type = types.nullOr types.int;
          default = 6199;
-          description = "The maximum fan speed.";
+          description = ''
+            The maximum fan speed. Setting to null enables automatic detection.
+            Check maximum fan limits with "cat /sys/devices/platform/applesmc.768/fan*_max".
+          '';
        };
        options.general.low_temp = mkOption {
          type = types.int;
          default = 55;
-          description = "The low temperature.";
+          description = "Temperature below which fan speed will be at minimum. Try ranges 55-63.";
        };
        options.general.high_temp = mkOption {
          type = types.int;
          default = 58;
-          description = "The high temperature.";
+          description = "Fan will increase speed when higher than this temperature. Try ranges 58-66.";
        };
        options.general.max_temp = mkOption {
          type = types.int;
          default = 86;
-          description = "The maximum temperature.";
+          description = "Fan will run at full speed above this temperature. Do not set it > 90.";
        };
        options.general.polling_interval = mkOption {
          type = types.int;
--- a/nixos/modules/services/misc/mediatomb.nix
+++ b/nixos/modules/services/misc/mediatomb.nix
@ -366,6 +366,7 @@ in {
      wantedBy = [ "multi-user.target" ];
      serviceConfig.ExecStart = "${binaryCommand} --port ${toString cfg.port} ${interfaceFlag} ${configFlag} --home ${cfg.dataDir}";
      serviceConfig.User = cfg.user;
+      serviceConfig.Group = cfg.group;
    };

    users.groups = optionalAttrs (cfg.group == "mediatomb") {
--- a/nixos/modules/services/networking/firewall.nix
+++ b/nixos/modules/services/networking/firewall.nix
@ -433,8 +433,6 @@ in
            drop the packet if the source address is not reachable via any
            interface) or false.  Defaults to the value of
            kernelHasRPFilter.
-
-            (needs kernel 3.3+)
          '';
      };

--- a/nixos/modules/services/networking/multipath.nix
+++ b/nixos/modules/services/networking/multipath.nix
@ -242,21 +242,6 @@ in {
            '';
          };

-          retain_attached_hw_handler = mkOption {
-            type = nullOr (enum [ "yes" "no" ]);
-            default = null; # real default: "yes"
-            description = ''
-              (Obsolete for kernels >= 4.3) If set to "yes" and the SCSI layer has
-              already attached a hardware_handler to the device, multipath will not
-              force the device to use the hardware_handler specified by mutipath.conf.
-              If the SCSI layer has not attached a hardware handler, multipath will
-              continue to use its configured hardware handler.
-
-              Important Note: Linux kernel 4.3 or newer always behaves as if
-              "retain_attached_hw_handler yes" was set.
-            '';
-          };
-
          detect_prio = mkOption {
            type = nullOr (enum [ "yes" "no" ]);
            default = null; # real default: "yes"
--- a/nixos/modules/services/networking/ntopng.nix
+++ b/nixos/modules/services/networking/ntopng.nix
@ -6,7 +6,13 @@ let

  cfg = config.services.ntopng;
  opt = options.services.ntopng;
-  redisCfg = config.services.redis;
+
+  createRedis = cfg.redis.createInstance != null;
+  redisService =
+    if cfg.redis.createInstance == "" then
+      "redis.service"
+    else
+      "redis-${cfg.redis.createInstance}.service";

  configFile = if cfg.configText != "" then
    pkgs.writeText "ntopng.conf" ''
@ -15,8 +21,10 @@ let
    else
    pkgs.writeText "ntopng.conf" ''
      ${concatStringsSep " " (map (e: "--interface=" + e) cfg.interfaces)}
-      --http-port=${toString cfg.http-port}
-      --redis=localhost:${toString redisCfg.port}
+      --http-port=${toString cfg.httpPort}
+      --redis=${cfg.redis.address}
+      --data-dir=/var/lib/ntopng
+      --user=ntopng
      ${cfg.extraConfig}
    '';

@ -24,6 +32,10 @@ in

 {

+  imports = [
+    (mkRenamedOptionModule [ "services" "ntopng" "http-port" ] [ "services" "ntopng" "httpPort" ])
+  ];
+
  options = {

    services.ntopng = {
@ -56,7 +68,7 @@ in
        '';
      };

-      http-port = mkOption {
+      httpPort = mkOption {
        default = 3000;
        type = types.int;
        description = ''
@ -64,6 +76,24 @@ in
        '';
      };

+      redis.address = mkOption {
+        type = types.str;
+        example = literalExpression "config.services.redis.ntopng.unixSocket";
+        description = ''
+          Redis address - may be a Unix socket or a network host and port.
+        '';
+      };
+
+      redis.createInstance = mkOption {
+        type = types.nullOr types.str;
+        default = if versionAtLeast config.system.stateVersion "22.05" then "ntopng" else "";
+        description = ''
+          Local Redis instance name. Set to <literal>null</literal> to disable
+          local Redis instance. Defaults to <literal>""</literal> for
+          <literal>system.stateVersion</literal> older than 22.05.
+        '';
+      };
+
      configText = mkOption {
        default = "";
        example = ''
@ -95,23 +125,36 @@ in
  config = mkIf cfg.enable {

    # ntopng uses redis for data storage
-    services.redis.enable = true;
+    services.ntopng.redis.address =
+      mkIf createRedis config.services.redis.servers.${cfg.redis.createInstance}.unixSocket;
+
+    services.redis.servers = mkIf createRedis {
+      ${cfg.redis.createInstance} = {
+        enable = true;
+        user = mkIf (cfg.redis.createInstance == "ntopng") "ntopng";
+      };
+    };

    # nice to have manual page and ntopng command in PATH
    environment.systemPackages = [ pkgs.ntopng ];

+    systemd.tmpfiles.rules = [ "d /var/lib/ntopng 0700 ntopng ntopng -" ];
+
    systemd.services.ntopng = {
      description = "Ntopng Network Monitor";
-      requires = [ "redis.service" ];
-      after = [ "network.target" "redis.service" ];
+      requires = optional createRedis redisService;
+      after = [ "network.target" ] ++ optional createRedis redisService;
      wantedBy = [ "multi-user.target" ];
-      preStart = "mkdir -p /var/lib/ntopng/";
      serviceConfig.ExecStart = "${pkgs.ntopng}/bin/ntopng ${configFile}";
      unitConfig.Documentation = "man:ntopng(8)";
    };

-    # ntopng drops priveleges to user "nobody" and that user is already defined
-    # in users-groups.nix.
+    users.extraUsers.ntopng = {
+      group = "ntopng";
+      isSystemUser = true;
+    };
+
+    users.extraGroups.ntopng = { };
  };

 }
--- a/nixos/modules/services/web-apps/mastodon.nix
+++ b/nixos/modules/services/web-apps/mastodon.nix
@ -92,6 +92,7 @@ let

  mastodonEnv = pkgs.writeShellScriptBin "mastodon-env" ''
    set -a
+    export RAILS_ROOT="${cfg.package}"
    source "${envFile}"
    source /var/lib/mastodon/.secrets_env
    eval -- "\$@"
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@ -1325,22 +1325,13 @@ in
          val = tempaddrValues.${opt}.sysctl;
         in nameValuePair "net.ipv6.conf.${replaceChars ["."] ["/"] i.name}.use_tempaddr" val));

-    # Capabilities won't work unless we have at-least a 4.3 Linux
-    # kernel because we need the ambient capability
-    security.wrappers = if (versionAtLeast (getVersion config.boot.kernelPackages.kernel) "4.3") then {
+    security.wrappers = {
      ping = {
        owner = "root";
        group = "root";
        capabilities = "cap_net_raw+p";
        source = "${pkgs.iputils.out}/bin/ping";
      };
-    } else {
-      ping = {
-        setuid = true;
-        owner = "root";
-        group = "root";
-        source = "${pkgs.iputils.out}/bin/ping";
-      };
    };
    security.apparmor.policies."bin.ping".profile = lib.mkIf config.security.apparmor.policies."bin.ping".enable (lib.mkAfter ''
      /run/wrappers/bin/ping {
--- a/nixos/tests/doh-proxy-rust.nix
+++ b/nixos/tests/doh-proxy-rust.nix
@ -38,6 +38,6 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
    machine.wait_for_unit("doh-proxy-rust.service")
    machine.wait_for_open_port(53)
    machine.wait_for_open_port(3000)
-    machine.succeed(f"curl --fail '{url}?dns={query}' | grep -F {bin_ip}")
+    machine.succeed(f"curl --fail -H 'Accept: application/dns-message' '{url}?dns={query}' | grep -F {bin_ip}")
  '';
 })
--- a/pkgs/applications/audio/helvum/default.nix
+++ b/pkgs/applications/audio/helvum/default.nix
@ -16,20 +16,20 @@

 stdenv.mkDerivation rec {
  pname = "helvum";
-  version = "0.3.2";
+  version = "0.3.4";

  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
-    owner = "ryuukyu";
+    owner = "pipewire";
    repo = pname;
    rev = version;
-    sha256 = "sha256-Kt6gnMRTOVXqjAjEZKlylcGhzl52ZzPNVbJhwzLhzkM=";
+    sha256 = "0nhv6zw2zzxz2bg2zj32w1brywnm5lv6j3cvmmvwshc389z2k5x1";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-kxJRY9GSPwnb431iYCfJdGcl5HjpFr2KkWrFDpGajp8=";
+    hash = "sha256-EIHO9qVPIXgezfFOaarlTU0an762nFmX1ELbQuAZ7rY";
  };

  nativeBuildInputs = [
@ -51,21 +51,9 @@ stdenv.mkDerivation rec {

  LIBCLANG_PATH = "${libclang.lib}/lib";

-  patches = [
-    # enables us to use gtk4-update-icon-cache instead of gtk3 one
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/ryuukyu/helvum/-/merge_requests/24.patch";
-      sha256 = "sha256-WmI6taBL/6t587j06n0mwByQ8x0eUA5ECvGNjg2/vtk=";
-    })
-  ];
-
-  postPatch = ''
-    patchShebangs build-aux/cargo.sh
-  '';
-
  meta = with lib; {
    description = "A GTK patchbay for pipewire";
-    homepage = "https://gitlab.freedesktop.org/ryuukyu/helvum";
+    homepage = "https://gitlab.freedesktop.org/pipewire/helvum";
    license = licenses.gpl3Only;
    maintainers = with maintainers; [ fufexan ];
    platforms = platforms.linux;
--- a/pkgs/applications/audio/pyradio/default.nix
+++ b/pkgs/applications/audio/pyradio/default.nix
@ -2,7 +2,7 @@

 python3Packages.buildPythonApplication rec {
  pname = "pyradio";
-  version = "0.8.9.12";
+  version = "0.8.9.14";

  propagatedBuildInputs = with python3Packages; [
    requests
@ -14,7 +14,7 @@ python3Packages.buildPythonApplication rec {
    owner = "coderholic";
    repo = pname;
    rev = version;
-    sha256 = "sha256-ZBlb0wpw5/s3JuyV2OpGZwlY1UcQzLHP1/VhGlEr6Zo=";
+    sha256 = "sha256-9q+YsQPFB7Ql5WnXvPj100cD7pGkmr1hHztqbpZStt8=";
  };

  checkPhase = ''
--- a/pkgs/applications/blockchains/aeon/default.nix
+++ b/pkgs/applications/blockchains/aeon/default.nix
@ -4,7 +4,7 @@
 }:

 let
-  version = "0.13.0.0";
+  version = "0.14.1.0";
 in
 stdenv.mkDerivation {
  pname = "aeon";
@ -15,7 +15,7 @@ stdenv.mkDerivation {
    repo = "aeon";
    rev = "v${version}-aeon";
    fetchSubmodules = true;
-    sha256 = "07d87n1j4dc9gfwj6xy5jdpryn45095xdh961g6xjnjzc5fivjch";
+    sha256 = "sha256-yej4w/2m9YXsMobqHwzA5GBbduhaeTVvmnHUJNWX87E=";
  };

  nativeBuildInputs = [ cmake pkg-config git doxygen graphviz ];
--- a/pkgs/applications/blockchains/exodus/default.nix
+++ b/pkgs/applications/blockchains/exodus/default.nix
@ -4,11 +4,11 @@ cups, vivaldi-ffmpeg-codecs, libpulseaudio, at-spi2-core, libxkbcommon, mesa }:

 stdenv.mkDerivation rec {
  pname = "exodus";
-  version = "21.10.25";
+  version = "21.12.3";

  src = fetchurl {
    url = "https://downloads.exodus.io/releases/${pname}-linux-x64-${version}.zip";
-    sha256 = "a85ddda4e73dfadddbb77cf9bc84c30fc6b893ead46367d702976bbf4da5afa4";
+    sha256 = "sha256-8Jgg9OxptkhD1SBjVBoklHQVCUOO+EePWnyEajqlivE=";
  };

  sourceRoot = ".";
--- a/pkgs/applications/blockchains/ledger-live-desktop/default.nix
+++ b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
@ -2,12 +2,12 @@

 let
  pname = "ledger-live-desktop";
-  version = "2.38.2";
+  version = "2.38.3";
  name = "${pname}-${version}";

  src = fetchurl {
    url = "https://github.com/LedgerHQ/${pname}/releases/download/v${version}/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-k6Rbxpe5BpRmlE+WL7iiFUtRCs5KlrLH2c3iSucUhqo=";
+    hash = "sha256-svNsVdenolrfMGKJvB/8HQMq08Ov5Oe5QooI1jFAcbI=";
  };

  appimageContents = appimageTools.extractType2 {
--- a/pkgs/applications/editors/nvi/default.nix
+++ b/pkgs/applications/editors/nvi/default.nix
@ -35,5 +35,6 @@ stdenv.mkDerivation rec {
    description = "The Berkeley Vi Editor";
    license = licenses.free;
    platforms = platforms.unix;
+    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/nvi.x86_64-darwin
  };
 }
--- a/pkgs/applications/emulators/attract-mode/default.nix
+++ b/pkgs/applications/emulators/attract-mode/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "attract-mode";
-  version = "2.6.1";
+  version = "2.6.2";

  src = fetchFromGitHub {
    owner = "mickelson";
    repo = "attract";
    rev = "v${version}";
-    sha256 = "16p369j0hanm0l2fiy6h9d9pn0f3qblcy9l39all6h7rfxnhp9ii";
+    sha256 = "sha256-gKxUU2y6Gtm5a/tXYw/fsaTBrriNh5vouPGICs3Ph3c=";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/applications/emulators/mednafen/default.nix
+++ b/pkgs/applications/emulators/mednafen/default.nix
@ -1,28 +1,46 @@
-{ lib, stdenv, fetchurl, pkg-config, freeglut, libGLU, libGL, libcdio, libjack2
-, libsamplerate, libsndfile, libX11, SDL2, SDL2_net, zlib, alsa-lib }:
+{ lib
+, stdenv
+, fetchurl
+, SDL2
+, SDL2_net
+, alsa-lib
+, flac
+, freeglut
+, libGL
+, libGLU
+, libX11
+, libcdio
+, libjack2
+, libsamplerate
+, libsndfile
+, pkg-config
+, zlib
+}:

 stdenv.mkDerivation rec {
  pname = "mednafen";
-  version = "1.26.1";
+  version = "1.29.0";

  src = fetchurl {
    url = "https://mednafen.github.io/releases/files/${pname}-${version}.tar.xz";
-    sha256 = "1x7xhxjhwsdbak8l0iyb497f043xkhibk73w96xck4j2bk10fac4";
+    hash = "sha256-2j+88Ch3+b4PAov6XRy1npU6QEm5D+fjk4ijOG2fNi4=";
  };

  nativeBuildInputs = [ pkg-config ];

  buildInputs = [
-    freeglut
-    libGLU libGL
-    libcdio
-    libjack2
-    alsa-lib
-    libsamplerate
-    libsndfile
-    libX11
    SDL2
    SDL2_net
+    alsa-lib
+    flac
+    freeglut
+    libGL
+    libGLU
+    libX11
+    libcdio
+    libjack2
+    libsamplerate
+    libsndfile
    zlib
  ];

@ -34,6 +52,7 @@ stdenv.mkDerivation rec {
  '';

  meta = with lib; {
+    homepage = "https://mednafen.github.io/";
    description = "A portable, CLI-driven, SDL+OpenGL-based, multi-system emulator";
    longDescription = ''
      Mednafen is a portable, utilizing OpenGL and SDL,
@ -66,8 +85,7 @@ stdenv.mkDerivation rec {
      - Sega Saturn (experimental, x86_64 only)
      - Sony PlayStation
    '';
-    homepage = "https://mednafen.github.io/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
    maintainers = with maintainers; [ AndersonTorres ];
    platforms = platforms.linux;
  };
--- a/pkgs/applications/graphics/openscad/default.nix
+++ b/pkgs/applications/graphics/openscad/default.nix
@ -57,8 +57,7 @@ mkDerivation rec {
      "SPNAV_LIBPATH=${libspnav}/lib"
    ];

-  # src/lexer.l:36:10: fatal error: parser.hxx: No such file or directory
-  enableParallelBuilding = false; # true by default due to qmake
+  enableParallelBuilding = true;

  postInstall = lib.optionalString stdenv.isDarwin ''
    mkdir $out/Applications
--- a/pkgs/applications/graphics/renderdoc/default.nix
+++ b/pkgs/applications/graphics/renderdoc/default.nix
@ -32,13 +32,13 @@ let
 in
 mkDerivation rec {
  pname = "renderdoc";
-  version = "1.17";
+  version = "1.18";

  src = fetchFromGitHub {
    owner = "baldurk";
    repo = "renderdoc";
    rev = "v${version}";
-    sha256 = "sha256-Zr7Av49mK48B4N+Ca2vPIgKuVNP4YLVEs4EQepukSs8=";
+    sha256 = "sha256-nwERwdNQYY1Fd7llwZHrJBzWDJNdsySRQ3ZvXZjB7YY=";
  };

  buildInputs = [
--- a/pkgs/applications/graphics/xrgears/default.nix
+++ b/pkgs/applications/graphics/xrgears/default.nix
@ -9,18 +9,22 @@
 , vulkan-headers
 , vulkan-loader
 , xxd
+, SDL2
+, makeWrapper
+, libGL
+, glib
 }:

 stdenv.mkDerivation rec {
  pname = "xrgears";
-  version = "unstable-2020-04-15";
+  version = "unstable-2021-06-19";

  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
    owner = "monado";
    repo = "demos/xrgears";
-    rev = "d0bee35fbf8f181e8313f1ead13d88c4fb85c154";
-    sha256 = "1k0k8dkclyiav99kf0933kyd2ymz3hs1p0ap2wbciq9s62jgz29i";
+    rev = "6331b98e065494995c9cc4b48ccdd9d5ccaef461";
+    sha256 = "sha256-buw2beTPIWScq+3VQjUyF+uOwS6VF+mnAPHZ2eFGZjc=";
  };

  nativeBuildInputs = [
@ -29,6 +33,7 @@ stdenv.mkDerivation rec {
    ninja
    pkg-config
    xxd
+    makeWrapper
  ];

  buildInputs = [
@ -36,8 +41,14 @@ stdenv.mkDerivation rec {
    openxr-loader
    vulkan-headers
    vulkan-loader
+    glib
  ];

+  fixupPhase = ''
+    wrapProgram $out/bin/xrgears \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ SDL2 libGL ]}
+  '';
+
  meta = with lib; {
    homepage = "https://gitlab.freedesktop.org/monado/demos/xrgears";
    description = "An OpenXR example using Vulkan for rendering";
--- a/pkgs/applications/misc/anytype/default.nix
+++ b/pkgs/applications/misc/anytype/default.nix
@ -2,13 +2,13 @@

 let
  pname = "anytype";
-  version = "0.23.0";
+  version = "0.23.5";
  name = "Anytype-${version}";
  nameExecutable = pname;
  src = fetchurl {
    url = "https://at9412003.fra1.digitaloceanspaces.com/Anytype-${version}.AppImage";
    name = "Anytype-${version}.AppImage";
-    sha256 = "sha256-53DyT8tunk0s1VGrlj6qQLOKNPN4Haqdyd8ozPi5z8w=";
+    sha256 = "sha256-kVM/F0LsIgMtur8jHZzUWkFIcfHe0i8y9Zxe3z5SkVM=";
  };
  appimageContents = appimageTools.extractType2 { inherit name src; };
 in
--- a/pkgs/applications/misc/cpu-x/default.nix
+++ b/pkgs/applications/misc/cpu-x/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation rec {
  pname = "cpu-x";
-  version = "4.2.0";
+  version = "4.3.0";

  src = fetchFromGitHub {
    owner = "X0rg";
    repo = "CPU-X";
    rev = "v${version}";
-    sha256 = "sha256-LWIcE86o+uU8G9DtumiH6iTqHhvq4y/QyQX7J3FhKEc=";
+    sha256 = "sha256-pYinePs7WFVfRMNYTY+Is8B+cv5w6IF7Ce+9v/mLRYg=";
  };

  nativeBuildInputs = [ cmake pkg-config wrapGAppsHook nasm makeWrapper ];
--- a/pkgs/applications/misc/cubocore-packages/coreaction/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/coreaction/default.nix
@ -1,24 +1,16 @@
-{ mkDerivation, lib, fetchFromGitLab, fetchpatch, qtsvg, qtbase, cmake, ninja, libcprime, libcsys }:
+{ mkDerivation, lib, fetchFromGitLab, qtsvg, qtbase, cmake, ninja, libcprime, libcsys }:

 mkDerivation rec {
  pname = "coreaction";
-  version = "4.2.0";
+  version = "4.3.0";

  src = fetchFromGitLab {
    owner = "cubocore/coreapps";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-5qEZNLvbgLoAOXij0wXoVw2iyvytsYZikSJDm6F6ddc=";
+    sha256 = "sha256-XQ/GcSjGSe+3d0dJxjmmcBFoDzrmM6zsHMfbDdzmpPs=";
  };

-  patches = [
-    ## Fix Plugin Error: "The shared library was not found." "libbatery.so"
-    (fetchpatch {
-      url = "https://gitlab.com/cubocore/coreapps/coreaction/-/commit/1d1307363614a117978723eaad2332e6e8c05b28.patch";
-      sha256 = "039x19rsm23l9vxd5mnbl6gvc3is0igahf47kv54v6apz2q72l3f";
-    })
-  ];
-
  nativeBuildInputs = [
    cmake
    ninja
--- a/pkgs/applications/misc/cubocore-packages/corearchiver/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corearchiver/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "corearchiver";
-  version = "4.2.0";
+  version = "4.3.0";

  src = fetchFromGitLab {
    owner = "cubocore/coreapps";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-FJGsQp1lbsrvlzKPiTv/FC9RH2+JRwwIvkLDTFW8t5s=";
+    sha256 = "sha256-EUcUivUuuUApIC9daS6BFA1YoE4yO3Kc8jG0VIks/Y0=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/cubocore-packages/corefm/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corefm/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "corefm";
-  version = "4.2.0";
+  version = "4.3.0";

  src = fetchFromGitLab {
    owner = "cubocore/coreapps";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-PczKIKY9uCD+cAzAC6Gkb+g+cn9KKCQYd3epoZK8bvA=";
+    sha256 = "sha256-uScM6cVRwYopZ6NY3PSAAyxNNyX3hVnFs6hkAyF29PA=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/cubocore-packages/coregarage/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/coregarage/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "coregarage";
-  version = "4.2.0";
+  version = "4.3.0";

  src = fetchFromGitLab {
    owner = "cubocore/coreapps";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-2pOQwSj+QKwpHVJp7VCyq6QpVW5wLUf/BE7ReXrJ78s=";
+    sha256 = "sha256-Jq0lIXfw/1Ixd+QIY7D1ErBCOSKmwkWBupcDxUUEliM=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/cubocore-packages/corehunt/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corehunt/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "corehunt";
-  version = "4.2.0";
+  version = "4.3.0";

  src = fetchFromGitLab {
    owner = "cubocore/coreapps";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-KnIqLI8MtLirFycW2YNHAjS7EDfU3dpqb6vVq9Tl6Ow=";
+    sha256 = "sha256-zhJadrdOXpl0bXxEPWjQ59Pzjg4MfIZXtYzCnJbh+pI=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/cubocore-packages/coreimage/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/coreimage/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "coreimage";
-  version = "4.2.0";
+  version = "4.3.0";

  src = fetchFromGitLab {
    owner = "cubocore/coreapps";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-dxRHzSG5ea1MhpTjgZbFztV9mElEaeOK4NsmieSgf5Q";
+    sha256 = "sha256-uG9/8sQK0G3f7O59OHEHqNHP8cUC73hmjsfpOnj0kFM=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/cubocore-packages/coreinfo/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/coreinfo/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "coreinfo";
-  version = "4.2.0";
+  version = "4.3.0";

  src = fetchFromGitLab {
    owner = "cubocore/coreapps";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-kLBOvvulHE1+4TyZVEVZwEA+Id7+w8fI3ll+QL2ukr0=";
+    sha256 = "sha256-KoX2U07giVF2xZR1diM6teiNfKYRiqjowTJgnsMlaN0=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/cubocore-packages/corekeyboard/0001-fix-installPhase.patch
+++ b/pkgs/applications/misc/cubocore-packages/corekeyboard/0001-fix-installPhase.patch
@ -0,0 +1,8 @@
+--- a/corekeyboard/CMakeLists.txt	2022-01-29 14:03:28.149607341 +0700
+++ b/CMakeLists.txt	2022-01-29 14:04:00.178733700 +0700
+@@ -55,5 +55,4 @@
+ 
+ install( TARGETS corekeyboard DESTINATION bin )
+ install( FILES org.cubocore.CoreKeyboard.desktop DESTINATION share/applications )
+-install( FILES org.cubocore.CoreKeyboard-Tray.desktop DESTINATION /etc/xdg/autostart )
+ install( FILES org.cubocore.CoreKeyboard.svg DESTINATION share/icons/hicolor/scalable/apps/ )
--- a/pkgs/applications/misc/cubocore-packages/corekeyboard/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corekeyboard/default.nix
@ -2,15 +2,20 @@

 mkDerivation rec {
  pname = "corekeyboard";
-  version = "4.2.0";
+  version = "4.3.0";

  src = fetchFromGitLab {
    owner = "cubocore/coreapps";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-0CbQ43BN4ORvtxs6FwNkgk/0jcVdFJq/tqvjUGYanM4=";
+    sha256 = "sha256-yJOcuE6HknDhXCr1qW/NJkerjvBABYntXos0owDDwcw=";
  };

+  patches = [
+    # Remove autostart
+    ./0001-fix-installPhase.patch
+  ];
+
  nativeBuildInputs = [
    cmake
    ninja
--- a/pkgs/applications/misc/cubocore-packages/corepad/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corepad/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "corepad";
-  version = "4.2.0";
+  version = "4.3.0";

  src = fetchFromGitLab {
    owner = "cubocore/coreapps";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-2bGHVv0+0NlkIqnvWm014Kr20uARWnOS5xSuNmCt/bQ=";
+    sha256 = "sha256-19qR08QhWeeXnJAQHe1SJjT0xnQLlbkXlzmd9uiMp14=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/cubocore-packages/corepaint/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corepaint/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "corepaint";
-  version = "4.2.0";
+  version = "4.3.0";

  src = fetchFromGitLab {
    owner = "cubocore/coreapps";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-nATraYm7FZEXoNWgXt1G86KdrAvRgM358F+YdfWcnkg=";
+    sha256 = "sha256-uAFV3NKtgNri8GQLD+MRacl9WYMfkMVZcoVML+oSX78=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/cubocore-packages/corepdf/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corepdf/default.nix
@ -1,14 +1,14 @@
-{ mkDerivation, lib, fetchFromGitLab, qtbase, poppler, cmake, ninja, libcprime, libcsys }:
+{ mkDerivation, lib, fetchFromGitLab, qtbase, poppler, qtwebengine, cmake, ninja, libcprime, libcsys }:

 mkDerivation rec {
  pname = "corepdf";
-  version = "4.2.0";
+  version = "4.3.0";

  src = fetchFromGitLab {
    owner = "cubocore/coreapps";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-HeOklgCwJ5h3DeelJOZqasG+eC9DGG3R0Cqg2yPKYhM=";
+    sha256 = "sha256-VwJ3H/jNP3u5C+LATPUSftiWm89upx77fN3NqzTnU7Y=";
  };

  nativeBuildInputs = [
@ -19,6 +19,7 @@ mkDerivation rec {
  buildInputs = [
    qtbase
    poppler
+    qtwebengine
    libcprime
    libcsys
  ];
--- a/pkgs/applications/misc/cubocore-packages/corepins/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corepins/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "corepins";
-  version = "4.2.0";
+  version = "4.3.0";

  src = fetchFromGitLab {
    owner = "cubocore/coreapps";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-H/l/MHHrTmkfznVKUHFAhim8b/arT5SNK5fxTvjsTE4=";
+    sha256 = "sha256-CVToPF8/Tw+n31/A0bzyBbwF7xPBVirsqVOUsM8QtH0=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/cubocore-packages/corerenamer/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corerenamer/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "corerenamer";
-  version = "4.2.0";
+  version = "4.3.0";

  src = fetchFromGitLab {
    owner = "cubocore/coreapps";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-OI7M7vV0CA42J5cWCqgGKEzUUHSgIJCWRTXmKRD6Jb0=";
+    sha256 = "sha256-WrMyz8Noq0EeBIxL4mSl6e+8wrivmwfoa1yKBrSgrRI=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/cubocore-packages/coreshot/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/coreshot/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "coreshot";
-  version = "4.2.0";
+  version = "4.3.0";

  src = fetchFromGitLab {
    owner = "cubocore/coreapps";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-HKgGeuM3CKGXwnFwSw6a0AB0klZKY5YS9C4q2UT6TN8=";
+    sha256 = "sha256-wEpo/YINtKAYHqlGYytUPh9ndkvQBw3tRIlyjnKJaf8=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/cubocore-packages/corestats/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corestats/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "corestats";
-  version = "4.2.0";
+  version = "4.3.0";

  src = fetchFromGitLab {
    owner = "cubocore/coreapps";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-/WBetvbd8e4v+j6e2xbGtSLwNMdLlaahSIks6r889B4=";
+    sha256 = "sha256-154BZIKb6QDrTC4DXh4dbFtN/Lq0ok/qOrqTkXa+rAo=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/cubocore-packages/corestuff/0001-fix-installPhase.patch
+++ b/pkgs/applications/misc/cubocore-packages/corestuff/0001-fix-installPhase.patch
@ -0,0 +1,11 @@
+--- a/corestuff/CMakeLists.txt	2022-01-29 14:09:02.699700817 +0700
+++ b/CMakeLists.txt	2022-01-29 14:09:23.211754633 +0700
+@@ -120,8 +120,3 @@
+ install( FILES org.cubocore.CoreStuff.desktop DESTINATION share/applications )
+ install( FILES org.cubocore.CoreStuff.svg DESTINATION share/icons/hicolor/scalable/apps/ )
+ install( FILES background/default.svg DESTINATION share/coreapps/background )
+-
+-if ( DEFINED ADD_AUTOSTART )
+-	message("INSTALLING TO AUTOSTART LOCATION")
+-	install( FILES org.cubocore.CoreStuff.desktop DESTINATION /etc/xdg/autostart )
+-endif()
--- a/pkgs/applications/misc/cubocore-packages/corestuff/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corestuff/default.nix
@ -2,15 +2,20 @@

 mkDerivation rec {
  pname = "corestuff";
-  version = "4.2.0";
+  version = "4.3.0";

  src = fetchFromGitLab {
    owner = "cubocore/coreapps";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-/mmCIHZXn/Jpjr37neI6owWuU1VO6o7wmRj6ZH8tUbo=";
+    sha256 = "sha256-snzW6cqxIyiXJLOD5MoEqmzen1aZN4IALESaIWIOMro=";
  };

+  patches = [
+    # Remove autostart
+    ./0001-fix-installPhase.patch
+  ];
+
  nativeBuildInputs = [
    cmake
    ninja
--- a/pkgs/applications/misc/cubocore-packages/coreterminal/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/coreterminal/default.nix
@ -12,13 +12,13 @@

 mkDerivation rec {
  pname = "coreterminal";
-  version = "4.2.0";
+  version = "4.3.0";

  src = fetchFromGitLab {
    owner = "cubocore/coreapps";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-YXs6VTem3AaK4n1DYwKP/jqNuf09Srn2THHyJJnArlc=";
+    sha256 = "sha256-0gxcbfDD43BnkxYWSdViK3hjzfgPGFruwzF4hCxFZ7c=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/cubocore-packages/coretime/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/coretime/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "coretime";
-  version = "4.2.0";
+  version = "4.3.0";

  src = fetchFromGitLab {
    owner = "cubocore/coreapps";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-b7oqHhsuHsy96IAXPUtw+WqneEHgn/nUDgHiJt2aXXM=";
+    sha256 = "sha256-MIcmgBfgyjEyJxXCq6IbQ/i6IdtL5cWVGpV2YZbzK58=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/cubocore-packages/coretoppings/0001-fix-install-phase.patch
+++ b/pkgs/applications/misc/cubocore-packages/coretoppings/0001-fix-install-phase.patch
@ -1,8 +1,8 @@
--- a/corepkit/CMakeLists.txt
-+++ b/corepkit/Cmakelists.txt
+--- a/corepkit/CMakeLists.txt	2021-12-25 17:52:20.000000000 +0700
+++ b/corepkit/CMakeLists.txt	2021-12-29 17:58:09.298024297 +0700
@@ -32,4 +32,4 @@
 target_link_libraries( corepkit  Qt5::Core )
 
 install( TARGETS corepkit DESTINATION libexec/coreapps/ )
-install( FILES org.cubocore.coreapps.policy DESTINATION /usr/share/polkit-1/actions/ )
+-install( FILES org.cubocore.coreapps.policy DESTINATION share/polkit-1/actions/ )
 +install( FILES org.cubocore.coreapps.policy DESTINATION ${CMAKE_INSTALL_PREFIX}/usr/share/polkit-1/actions/ )
--- a/pkgs/applications/misc/cubocore-packages/coretoppings/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/coretoppings/default.nix
@ -30,13 +30,13 @@

 mkDerivation rec {
  pname = "coretoppings";
-  version = "4.2.0";
+  version = "4.3.0";

  src = fetchFromGitLab {
    owner = "cubocore/coreapps";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-DpmzGqjW1swLirRLzd5nblAb40LHAmf8nL+VykQNL3E=";
+    sha256 = "sha256-Yq57dY1zIuQN2Gj9haxJMomafL32B+/9v3lWlY9fvcc=";
  };

  patches = [
--- a/pkgs/applications/misc/cubocore-packages/coreuniverse/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/coreuniverse/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "coreuniverse";
-  version = "4.2.0";
+  version = "4.3.0";

  src = fetchFromGitLab {
    owner = "cubocore/coreapps";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-YZCMyYMAvd/xQYNUnURIvmQwaM+X+Ql93OS4ZIyAZLY=";
+    sha256 = "sha256-KNjXrsm4OfBxida8mcAlKgomcpg0xJg51ZxEdhaiL84=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/cubocore-packages/libcprime/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/libcprime/default.nix
@ -10,13 +10,13 @@

 mkDerivation rec {
  pname = "libcprime";
-  version = "4.2.2";
+  version = "4.3.0";

  src = fetchFromGitLab {
    owner = "cubocore";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-RywvFATA/+fDP/TR5QRWaJlDgy3EID//iVmrJcj3GXI=";
+    sha256 = "sha256-+z5dXKaV2anN6OLMycEz87kDqQScgHHEKwGhDAdHSd4=";
  };

  patches = [
--- a/pkgs/applications/misc/cubocore-packages/libcsys/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/libcsys/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "libcsys";
-  version = "4.2.0";
+  version = "4.3.0";

  src = fetchFromGitLab {
    owner = "cubocore";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-9LH95uJJIn4FHfnikGi5UCI6nUNW+1cSZnJ/KpZDI5Y=";
+    sha256 = "sha256-/iRFppe08+rMQNFjWSyxo3Noy0iNaelg0JAczg/BYBs=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/gremlin-console/default.nix
+++ b/pkgs/applications/misc/gremlin-console/default.nix
@ -2,10 +2,10 @@

 stdenv.mkDerivation rec {
  pname = "gremlin-console";
-  version = "3.5.1";
+  version = "3.5.2";
  src = fetchzip {
    url = "https://downloads.apache.org/tinkerpop/${version}/apache-tinkerpop-gremlin-console-${version}-bin.zip";
-    sha256 = "sha256-66krBK5mSMT0scCgMmiaigT/9nmYfItxe1OTzSbX+kE=";
+    sha256 = "sha256-PCr8lDQzypgozKCzD8FV4X4ls5lYZRMey1vfcFzo+Uc=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/misc/moolticute/default.nix
+++ b/pkgs/applications/misc/moolticute/default.nix
@ -28,14 +28,14 @@ mkDerivation rec {

  preInstall = ''
    mkdir -p $udev/lib/udev/rules.d
-    sed -n '/^ \+cat > "$tmpfile" <<- EOF$/,/^EOF$/p' ../data/moolticute.sh |
+    sed -n '/^UDEV_RULE=="\$(cat <<-EOF$/,/^EOF$/p' ../data/moolticute.sh |
        sed '1d;$d' > $udev/lib/udev/rules.d/50-mooltipass.rules
 '';

  meta = with lib; {
    description = "GUI app and daemon to work with Mooltipass device via USB";
    longDescription = ''
-      To install udev rules, add `services.udev.packages == [ moolticute.udev ]`
+      To install udev rules, add `services.udev.packages = [ pkgs.moolticute.udev ]`
      into `nixos/configuration.nix`.
    '';
    homepage = "https://github.com/mooltipass/moolticute";
--- a/pkgs/applications/misc/spicetify-cli/default.nix
+++ b/pkgs/applications/misc/spicetify-cli/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "spicetify-cli";
-  version = "2.9.0";
+  version = "2.9.1";

  src = fetchFromGitHub {
    owner = "khanhas";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-PHKmrLN/JVPqefcK1FQByPWvMzNxHG5htXzgZ1D+Eds=";
+    sha256 = "sha256-Rs70LmJ/+pbISQpPuEYV2URFv7uf+jdTVQopUSKExSY=";
  };

  vendorSha256 = "sha256-g0RYIVIq4oMXdRZDBDnVYg7ombN5WEo/6O9hChQvOYs=";
--- a/pkgs/applications/misc/stork/default.nix
+++ b/pkgs/applications/misc/stork/default.nix
@ -3,29 +3,35 @@
 , fetchFromGitHub
 , openssl
 , pkg-config
+, stdenv
+, darwin
 }:

 rustPlatform.buildRustPackage rec {
  pname = "stork";
-  version = "1.3.0";
+  version = "1.4.0";

  src = fetchFromGitHub {
    owner = "jameslittle230";
    repo = "stork";
    rev = "v${version}";
-    sha256 = "sha256-or8PDEj97ChZq6r3WlwETYbU6EvoEuh8HfTyBIbbO8M=";
+    sha256 = "sha256-9fylJcUuModemkBRnXeFfB1b+CD9IvTxW+CnlqaUb60=";
  };

-  cargoSha256 = "sha256-UpIPbY2beO1H0YR9kV1SkG6C3qcO4x2acfgqI3x5jiM=";
+  cargoSha256 = "sha256-j7OXl66xuTuP6hWJs+xHrwtaBGAYt02OESCN6FH3KX0=";

  nativeBuildInputs = [ pkg-config ];

-  buildInputs = [ openssl ];
+  buildInputs = [ openssl ]
+    ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];

  meta = with lib; {
    description = "Impossibly fast web search, made for static sites";
    homepage = "https://github.com/jameslittle230/stork";
    license = with licenses; [ asl20 ];
    maintainers = with maintainers; [ chuahou ];
+    # TODO: Remove once nixpkgs uses macOS SDK 10.14+ for x86_64-darwin
+    # Undefined symbols for architecture x86_64: "_SecTrustEvaluateWithError"
+    broken = stdenv.isDarwin && stdenv.isx86_64;
  };
 }
--- a/pkgs/applications/misc/surface-control/default.nix
+++ b/pkgs/applications/misc/surface-control/default.nix
@ -1,19 +1,20 @@
-{ lib, rustPlatform, fetchFromGitHub, installShellFiles, coreutils }:
+{ lib, rustPlatform, fetchFromGitHub, pkg-config, installShellFiles, udev, coreutils }:

 rustPlatform.buildRustPackage rec {
  pname = "surface-control";
-  version = "0.3.1-2";
+  version = "0.4.1-2";

  src = fetchFromGitHub {
    owner = "linux-surface";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-SLJ4mwBafLGL5pneMTHLc4S4Tgds2xLqByWFH95TK1k=";
+    sha256 = "sha256-ZgtEmjk1HwoKkyuOiMWalK5RPb3ML8HM/wwz8OM9HoI=";
  };

-  cargoSha256 = "sha256-NH33AMuwf4bOF9zZJlONVMYgrrYSBq5VQClYW/rbzsM=";
+  cargoSha256 = "sha256-CsPyY/NA2+Lecemuor2nHd6yzf2PvMK7NZyvY3vewpI=";

-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [ pkg-config installShellFiles ];
+  buildInputs = [ udev ];

  postInstall = ''
    installShellCompletion \
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -7,10 +7,10 @@ in
 rec {
  firefox = common rec {
    pname = "firefox";
-    version = "97.0";
+    version = "97.0.1";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "a913695a42cb06ee9bda2a20e65cc573e40ca93e9f75b7ee0a43ebd1935b371e7e80d5fc8d5f126ad0712ab848635a8624bbeed43807e5c179537aa32c884186";
+      sha512 = "8620aace77167593aab5acd230860eb3e67eeddc49c0aad0491b5dc20bd0ddb6089dbb8975aed241426f57b2ad772238b04d03b95390175f580cbd80bb6d5f6c";
    };

    meta = {
--- a/pkgs/applications/networking/browsers/vieb/default.nix
+++ b/pkgs/applications/networking/browsers/vieb/default.nix
@ -2,13 +2,13 @@

 mkYarnPackage rec {
  pname = "vieb";
-  version = "6.1.0";
+  version = "6.2.0";

  src = fetchFromGitHub {
    owner = "Jelmerro";
    repo = pname;
    rev = version;
-    sha256 = "sha256-MJJeHnwfXouBygRT/wFWFMRHxQVf/3k2c7vp/tkD5co=";
+    sha256 = "sha256-FuaN9iUxR5Y6SnNmuegmNJXn1BYKgcobquTL3thuByM=";
  };

  packageJSON = ./package.json;
--- a/pkgs/applications/networking/cluster/cilium/default.nix
+++ b/pkgs/applications/networking/cluster/cilium/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "cilium-cli";
-  version = "0.10.2";
+  version = "0.10.3";

  src = fetchFromGitHub {
    owner = "cilium";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-EgIs5/0Nk4AtOCK7I+Lt50cqOGzvEegzV0Fb8Tv3bAg=";
+    sha256 = "sha256-nE2mrFALJCGxUce8anJ3ErUO8575GgR6pupG06rRCCM=";
  };

  vendorSha256 = null;
--- a/pkgs/applications/networking/cluster/istioctl/default.nix
+++ b/pkgs/applications/networking/cluster/istioctl/default.nix
@ -2,15 +2,15 @@

 buildGoModule rec {
  pname = "istioctl";
-  version = "1.12.2";
+  version = "1.13.0";

  src = fetchFromGitHub {
    owner = "istio";
    repo = "istio";
    rev = version;
-    sha256 = "sha256-6eVFyGVvOUr5RA5jeavKcLJedv4jOGXAg3aa4N3cNx8=";
+    sha256 = "sha256-f0e2jdiIMfakG97LqJCP5Jk41D93a6wxaChN7WwY5oA=";
  };
-  vendorSha256 = "sha256-ie7XRu+2+NmhMNtJEL2OgZH6wuTPJX9O2+cZBnI04JA=";
+  vendorSha256 = "sha256-gukwJp+qLbNJlBL5SemrVD6mExPnX0+19tbw/b4SJ8s=";

  doCheck = false;

--- a/pkgs/applications/networking/cluster/kconf/default.nix
+++ b/pkgs/applications/networking/cluster/kconf/default.nix
@ -2,16 +2,20 @@

 buildGoModule rec {
  pname = "kconf";
-  version = "1.10.1";
+  version = "1.11.0";

  src = fetchFromGitHub {
    owner = "particledecay";
    repo = "kconf";
    rev = "v${version}";
-    sha256 = "NlTpHQFOJJcIt/xMT3fvdrlxANyg//wtYMmXzEtaFXo=";
+    sha256 = "sha256-V+B1vqI/MLASqEy6DZiB71h7EkUfrxVKIMxriRK6pyY=";
  };

-  vendorSha256 = "2d4o87wE9QZltk2YOHc20XVYF8n0EOrDf5mJ6i6EB0c=";
+  vendorSha256 = "sha256-Fq3V3vYaofB0TWt3t7uW1Dd7MlwMvh8RaRVpdq9XZh4=";
+
+  ldflags = [
+      "-s" "-w" "-X github.com/particledecay/kconf/build.Version=${version}"
+  ];

  meta = with lib; {
    description = "An opinionated command line tool for managing multiple kubeconfigs";
--- a/pkgs/applications/networking/cluster/kubedb-cli/default.nix
+++ b/pkgs/applications/networking/cluster/kubedb-cli/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kubedb-cli";
-  version = "0.24.0";
+  version = "0.25.0";

  src = fetchFromGitHub {
    owner = "kubedb";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-b5LbA2qEsEA7J0djEMhDeBY9iV1cvGVtxTlmneQGKYY=";
+    sha256 = "sha256-hRLju3nVLy0eDgqGeReHaF8p7oOlpo1T0IbLq4h/uwg=";
  };

  vendorSha256 = null;
--- a/pkgs/applications/networking/cluster/kubeone/default.nix
+++ b/pkgs/applications/networking/cluster/kubeone/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "kubeone";
-  version = "1.3.3";
+  version = "1.4.0";

  src = fetchFromGitHub {
    owner = "kubermatic";
    repo = "kubeone";
    rev = "v${version}";
-    sha256 = "sha256-IgV1ULxwL17ECsm7MdRfQERcEVy9cEft2L7fHP3XCKo=";
+    sha256 = "sha256-uij5daVHKIfxx+8UTmU/HKSbf/RTRFuO8mCQdsC80qI=";
  };

-  vendorSha256 = "sha256-/rhV7JHuqejCTizcjKIkaJlbRcx7AfMcGqQYo6dlg48=";
+  vendorSha256 = "sha256-kI5i1us3Ooh603HOz9Y+HlfPUy/1J8z89/jvKEenpLw=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/applications/networking/cluster/temporal/default.nix
+++ b/pkgs/applications/networking/cluster/temporal/default.nix
@ -23,9 +23,9 @@ buildGoModule rec {
    mkdir -p $out/bin
    install -Dm755 "$GOPATH/bin/cli" -T $out/bin/tctl
    install -Dm755 "$GOPATH/bin/authorization" -T $out/bin/tctl-authorization-plugin
-    install -Dm755 "$GOPATH/bin/cassandra" -T $out/bin/temporal-cassandra
    install -Dm755 "$GOPATH/bin/server" -T $out/bin/temporal-server
-    install -Dm755 "$GOPATH/bin/sql" -T $out/bin/temporal-sql
+    install -Dm755 "$GOPATH/bin/cassandra" -T $out/bin/temporal-cassandra-tool
+    install -Dm755 "$GOPATH/bin/sql" -T $out/bin/temporal-sql-tool
    runHook postInstall
  '';

--- a/pkgs/applications/networking/instant-messengers/dino/default.nix
+++ b/pkgs/applications/networking/instant-messengers/dino/default.nix
@ -13,17 +13,19 @@
 , pcre
 , qrencode
 , icu
+, gspell
+, srtp, libnice, gnutls, gstreamer, gst-plugins-base, gst-plugins-good
 }:

 stdenv.mkDerivation rec {
  pname = "dino";
-  version = "0.2.2";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "dino";
    repo = "dino";
    rev = "v${version}";
-    sha256 = "sha256-uYP3D2uyvfRP91fq/1jKOaKgp/+How0SUwmxSrLLH4c=";
+    sha256 = "sha256-L5a5QlF9qlr4X/hGTabbbvOE5J1x/UVneWl/BRAa29Q=";
  };

  nativeBuildInputs = [
@ -56,6 +58,13 @@ stdenv.mkDerivation rec {
    icu
    libsignal-protocol-c
    librsvg
+    gspell
+    srtp
+    libnice
+    gnutls
+    gstreamer
+    gst-plugins-base
+    gst-plugins-good
  ] ++ lib.optionals (!stdenv.isDarwin) [
    xorg.libxcb
    xorg.libpthreadstubs
--- a/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
+++ b/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
@ -0,0 +1,31 @@
+{ lib
+, fetchFromGitLab
+, flutter
+, olm
+}:
+
+flutter.mkFlutterApp rec {
+  pname = "fluffychat";
+  version = "1.2.0";
+
+  vendorHash = "sha256-Qg0IlajbIl8e3BkKgn4O+mbZGvhfqr7XwllBLJQAA/I=";
+
+  src = fetchFromGitLab {
+    owner = "famedly";
+    repo = "fluffychat";
+    rev = "v${version}";
+    hash = "sha256-PJH3jMQc6u9R6Snn+9rNN8t+8kt6l3Xt7zKPbpqj13E=";
+  };
+
+  buildInputs = [
+    olm
+  ];
+
+  meta = with lib; {
+    description = "Chat with your friends (matrix client)";
+    homepage = "https://fluffychat.im/";
+    license = licenses.agpl3Plus;
+    maintainers = with maintainers; [ mkg20001 ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/networking/instant-messengers/jami/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/default.nix
@ -8,11 +8,11 @@
 }:

 rec {
-  version = "20211213.2.37be4c3";
+  version = "20211223.2.37be4c3";

  src = fetchzip {
    url = "https://dl.jami.net/release/tarballs/jami_${version}.tar.gz";
-    sha256 = "08abswvxwsxh6b0smb4l4cmymsbfiy7473b2sgvghj55w603prsc";
+    sha256 = "1zw9azwmxr4991nq5kl527lbwlj7psrissgvrkl1kxxbfbdncbhh";

    stripRoot = false;
    extraPostFetch = ''
--- a/pkgs/applications/networking/p2p/qbittorrent/default.nix
+++ b/pkgs/applications/networking/p2p/qbittorrent/default.nix
@ -12,13 +12,13 @@ assert trackerSearch -> (python3 != null);
 with lib;
 mkDerivation rec {
  pname = "qbittorrent";
-  version = "4.4.0";
+  version = "4.4.1";

  src = fetchFromGitHub {
    owner = "qbittorrent";
    repo = "qBittorrent";
    rev = "release-${version}";
-    sha256 = "sha256-xxQ6NGRSwRP+7kTxUsDB00VItHRHuaFopEroETtnGSs=";
+    sha256 = "sha256-HNgegPL7M0zwkn7+lcNcsgWgrCbY9/d0nuIlIC5hkAM=";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/networking/protonmail-bridge/default.nix
+++ b/pkgs/applications/networking/protonmail-bridge/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "protonmail-bridge";
-  version = "2.1.0";
+  version = "2.1.1";

  src = fetchFromGitHub {
    owner = "ProtonMail";
    repo = "proton-bridge";
    rev = "br-${version}";
-    sha256 = "sha256-3j2THRqhKK+bXIvTjyYDL9vJ9eH+Yy2LHE49auTKL5k=";
+    sha256 = "sha256-8oDA1QU5ZjtQZoCPVDa1U3P2KLzXtegtOxm6rNh+Ahk=";
  };

-  vendorSha256 = "sha256-LTsq3qk95LcgyDaEtTUJWCzQY0AjrMvgn61Dhcntdl8=";
+  vendorSha256 = "sha256-n+WwkNHT+/CrC4vWIVHqYs2a8Qe/LNc0L3uoPZWDTts=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@ -5,13 +5,13 @@

 mkDerivation rec {
  pname = "qownnotes";
-  version = "22.2.4";
+  version = "22.2.7";

  src = fetchurl {
    url = "https://download.tuxfamily.org/${pname}/src/${pname}-${version}.tar.xz";
    # Fetch the checksum of current version with curl:
    # curl https://download.tuxfamily.org/qownnotes/src/qownnotes-<version>.tar.xz.sha256
-    sha256 = "d4edaa353039beacab7c324496a165919709814be60d9d7536f9118aab1e4f7e";
+    sha256 = "f7c97f3dc3435ecdc740131548aacd390332c8b97c4e6fee98a3e80985786533";
  };

  nativeBuildInputs = [ qmake qttools ];
--- a/pkgs/applications/science/chemistry/marvin/default.nix
+++ b/pkgs/applications/science/chemistry/marvin/default.nix
@ -4,12 +4,12 @@ with lib;

 stdenv.mkDerivation rec {
  pname = "marvin";
-  version = "21.20.0";
+  version = "22.3.0";

  src = fetchurl {
    name = "marvin-${version}.deb";
    url = "http://dl.chemaxon.com/marvin/${version}/marvin_linux_${versions.majorMinor version}.deb";
-    sha256 = "sha256-xOtlJSUY7QLyggFXW0Ay3+6KNHIqljyDpyk0CP8jxWs=";
+    sha256 = "sha256-ASnweoVBYSnO/FjE9tpLgaOAgiPQeUnw7CzwkKRXnAg=";
  };

  nativeBuildInputs = [ dpkg makeWrapper ];
--- a/pkgs/applications/science/math/getdp/default.nix
+++ b/pkgs/applications/science/math/getdp/default.nix
@ -2,10 +2,10 @@

 stdenv.mkDerivation rec {
  pname = "getdp";
-  version = "3.3.0";
+  version = "3.4.0";
  src = fetchurl {
    url = "http://getdp.info/src/getdp-${version}-source.tgz";
-    sha256 = "1pfviy2bw8z5y6c15czvlvyjjg9pvpgrj9fr54xfi2gmvs7zkgpf";
+    sha256 = "sha256-d5YxJgtMf94PD6EHvIXpPBFPKC+skI/2v1K5Sad51hA=";
  };

  inherit (petsc) mpiSupport;
--- a/pkgs/applications/science/misc/simgrid/default.nix
+++ b/pkgs/applications/science/misc/simgrid/default.nix
@ -1,13 +1,14 @@
-{ lib, stdenv, fetchFromGitLab, fetchpatch, cmake, perl, python3, boost, valgrind
-# Optional requirements
-# Lua 5.3 needed and not available now
-#, luaSupport ? false, lua5
+{ stdenv, lib, fetchFromGitLab, cmake, perl, python3, boost
 , fortranSupport ? false, gfortran
 , buildDocumentation ? false, fig2dev, ghostscript, doxygen
 , buildJavaBindings ? false, openjdk
+, buildPythonBindings ? true, python3Packages
 , modelCheckingSupport ? false, libunwind, libevent, elfutils # Inside elfutils: libelf and libdw
+, minimalBindings ? false
 , debug ? false
+, optimize ? (!debug)
 , moreTests ? false
+, withoutBin ? false
 }:

 with lib;
@ -18,54 +19,35 @@ in

 stdenv.mkDerivation rec {
  pname = "simgrid";
-  version = "3.28";
+  version = "3.30";

  src = fetchFromGitLab {
    domain = "framagit.org";
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    sha256 = "0vylwgd4i89bvhbgfay0wq953324dwfmmr8jp9b4vvlc9m0017r9";
+    sha256 = "1dg8ywqif20g0fs8dnd6364n080nvwx7f444zcfwqwz6iax61qv1";
  };

-  patches = [
-    (fetchpatch {
-      name = "fix-smpi-dirs-absolute.patch";
-      url = "https://framagit.org/simgrid/simgrid/-/commit/71f01e667577be1076646eb841e0a57bd5388545.patch";
-      sha256 = "0x3y324b6269687zfy43ilc48bwrs4nb7svh2mpg88lrz53rky15";
-    })
-  ];
-
  propagatedBuildInputs = [ boost ];
-  nativeBuildInputs = [ cmake perl python3 valgrind ]
-      ++ optionals fortranSupport [ gfortran ]
-      ++ optionals buildJavaBindings [ openjdk ]
-      ++ optionals buildDocumentation [ fig2dev ghostscript doxygen ]
-      ++ optionals modelCheckingSupport [ libunwind libevent elfutils ];
+  nativeBuildInputs = [ cmake perl python3 ]
+    ++ optionals fortranSupport [ gfortran ]
+    ++ optionals buildJavaBindings [ openjdk ]
+    ++ optionals buildPythonBindings [ python3Packages.pybind11 ]
+    ++ optionals buildDocumentation [ fig2dev ghostscript doxygen ]
+    ++ optionals modelCheckingSupport [ libunwind libevent elfutils ];

-  #buildInputs = optional luaSupport lua5;
+  outputs = [ "out" ]
+    ++ optionals buildPythonBindings [ "python" ];

-  # Make it so that libsimgrid.so will be found when running programs from
-  # the build dir.
-  preConfigure = ''
-    export LD_LIBRARY_PATH="$PWD/build/lib"
-  '';
-
-  # Release mode is not supported in SimGrid
+  # "Release" does not work. non-debug mode is Debug compiled with optimization
  cmakeBuildType = "Debug";
-
-  # Disable/Enable functionality
-  # Note: those packages are not packaged in Nixpkgs yet so some options
-  # are disabled:
-  # - papi:   for enable_smpi_papi
-  # - ns3:    for enable_ns3
-  # - lua53:  for enable_lua
-  #
-  # For more information see:
-  # https://simgrid.org/doc/3.22/Installing_SimGrid.html#simgrid-compilation-options)
  cmakeFlags = [
    "-Denable_documentation=${optionOnOff buildDocumentation}"
    "-Denable_java=${optionOnOff buildJavaBindings}"
+    "-Denable_python=${optionOnOff buildPythonBindings}"
+    "-DSIMGRID_PYTHON_LIBDIR=./" # prevents CMake to install in ${python3} dir
+    "-Denable_msg=${optionOnOff buildJavaBindings}"
    "-Denable_fortran=${optionOnOff fortranSupport}"
    "-Denable_model-checking=${optionOnOff modelCheckingSupport}"
    "-Denable_ns3=off"
@ -75,27 +57,28 @@ stdenv.mkDerivation rec {
    "-Denable_mallocators=on"
    "-Denable_debug=on"
    "-Denable_smpi=on"
+    "-Dminimal-bindings=${optionOnOff minimalBindings}"
    "-Denable_smpi_ISP_testsuite=${optionOnOff moreTests}"
    "-Denable_smpi_MPICH3_testsuite=${optionOnOff moreTests}"
-    "-Denable_compile_warnings=${optionOnOff debug}"
-    "-Denable_compile_optimizations=${optionOnOff (!debug)}"
-    "-Denable_lto=${optionOnOff (!debug)}"
-    # "-Denable_lua=${optionOnOff luaSupport}"
-    # "-Denable_smpi_papi=${optionOnOff moreTests}"
+    "-Denable_compile_warnings=off"
+    "-Denable_compile_optimizations=${optionOnOff optimize}"
+    "-Denable_lto=${optionOnOff optimize}"
  ];
-
  makeFlags = optional debug "VERBOSE=1";

-  # Some Perl scripts are called to generate test during build which
-  # is before the fixupPhase, so do this manualy here:
+  # needed to run tests and to ensure correct shabangs in output scripts
  preBuild = ''
    patchShebangs ..
  '';

-  doCheck = true;
+  # needed by tests (so libsimgrid.so is found)
+  preConfigure = ''
+    export LD_LIBRARY_PATH="$PWD/build/lib"
+  '';

-  # Prevent the execution of tests known to fail.
+  doCheck = true;
  preCheck = ''
+    # prevent the execution of tests known to fail
    cat <<EOW >CTestCustom.cmake
    SET(CTEST_CUSTOM_TESTS_IGNORE smpi-replay-multiple)
    EOW
@ -104,6 +87,20 @@ stdenv.mkDerivation rec {
    make tests -j $NIX_BUILD_CORES
  '';

+  postInstall = lib.optionalString withoutBin ''
+    # remove bin from output if requested.
+    # having a specific bin output would be cleaner but it does not work currently (circular references)
+    rm -rf $out/bin
+  '' + lib.optionalString buildPythonBindings ''
+    # manually install the python binding if requested.
+    mkdir -p $python/lib/python${lib.versions.majorMinor python3.version}/site-packages/
+    cp ./lib/simgrid.cpython*.so $python/lib/python${lib.versions.majorMinor python3.version}/site-packages/
+   '';
+
+  # improve debuggability if requested
+  hardeningDisable = lib.optionals debug [ "fortify" ];
+  dontStrip = debug;
+
  meta = {
    description = "Framework for the simulation of distributed applications";
    longDescription = ''
@ -118,5 +115,6 @@ stdenv.mkDerivation rec {
    license = licenses.lgpl2Plus;
    maintainers = with maintainers; [ mickours mpoquet ];
    platforms = platforms.all;
+    broken = stdenv.isDarwin;
  };
 }
--- a/pkgs/applications/video/clipgrab/default.nix
+++ b/pkgs/applications/video/clipgrab/default.nix
@ -1,6 +1,7 @@
 { lib, fetchurl, makeDesktopItem, ffmpeg
 , qmake, qttools, mkDerivation
 , qtbase, qtdeclarative, qtlocation, qtquickcontrols2, qtwebchannel, qtwebengine
+, yt-dlp
 }:

 mkDerivation rec {
@ -16,7 +17,15 @@ mkDerivation rec {
  buildInputs = [ ffmpeg qtbase qtdeclarative qtlocation qtquickcontrols2 qtwebchannel qtwebengine ];
  nativeBuildInputs = [ qmake qttools ];

-  postPatch = lib.optionalString (ffmpeg != null) ''
+  patches = [
+    ./yt-dlp-path.patch
+  ];
+
+  postPatch = ''
+  substituteInPlace youtube_dl.cpp \
+    --replace 'QString YoutubeDl::path = QString();' \
+              'QString YoutubeDl::path = QString("${yt-dlp}/bin/yt-dlp");'
+  '' + lib.optionalString (ffmpeg != null) ''
  substituteInPlace converter_ffmpeg.cpp \
    --replace '"ffmpeg"' '"${ffmpeg.bin}/bin/ffmpeg"' \
    --replace '"ffmpeg ' '"${ffmpeg.bin}/bin/ffmpeg '
--- a/pkgs/applications/video/clipgrab/yt-dlp-path.patch
+++ b/pkgs/applications/video/clipgrab/yt-dlp-path.patch
@ -0,0 +1,86 @@
+--- a/main.cpp
+++ b/main.cpp
+@@ -91,14 +91,5 @@ int main(int argc, char *argv[])
+         w.show();
+     }
+ 
+-    QTimer::singleShot(0, [=] {
+-       cg->getUpdateInfo();
+-       QObject::connect(cg, &ClipGrab::updateInfoProcessed, [cg] {
+-           bool force = QSettings().value("forceYoutubeDlDownload", false).toBool();
+-           if (force) QSettings().setValue("forceYoutubeDlDownload", false);
+-           cg->downloadYoutubeDl(force);
+-       });
+-    });
+-
+     return app.exec();
+ }
+--- a/youtube_dl.cpp
+++ b/youtube_dl.cpp
+@@ -8,52 +8,16 @@ YoutubeDl::YoutubeDl()
+ QString YoutubeDl::path = QString();
+ 
+ QString YoutubeDl::find(bool force) {
+-    if (!force && !path.isEmpty()) return path;
+-
+-    // Prefer downloaded youtube-dl
+-    QString localPath = QStandardPaths::locate(QStandardPaths::AppDataLocation, "yt-dlp");
+-    QProcess* process = instance(localPath, QStringList() << "--version");
+-    process->start();
+-    process->waitForFinished();
+-    process->deleteLater();
+-    if (process->state() != QProcess::NotRunning) process->kill();
+-    if (process->exitCode() == QProcess::ExitStatus::NormalExit) {
+-        path = localPath;
+-        return path;
+-    }
+-
+-    // Try system-wide youtube-dlp installation
+-    QString globalPath = QStandardPaths::findExecutable("yt-dlp");
+-    process = instance(globalPath, QStringList() << "--version");
+-    process->start();
+-    process->waitForFinished();
+-    process->deleteLater();
+-    if (process->state() != QProcess::NotRunning) process->kill();
+-    if (process->exitCode() == QProcess::ExitStatus::NormalExit) {
+-        path = globalPath;
+-        return path;
+-    }
+-
+-    return "";
+    // We supply yt-dlp from nixpkgs, so the downloading
+    // machinery is not needed anymore.
+    (void)force;
+    return path;
+ }
+ 
+ QProcess* YoutubeDl::instance(QStringList arguments) {
+-    return instance(find(), arguments);
+-}
+-
+-QProcess* YoutubeDl::instance(QString path, QStringList arguments) {
+     QProcess *process = new QProcess();
+ 
+-    QString execPath = QCoreApplication::applicationDirPath();
+-    QProcessEnvironment env = QProcessEnvironment::systemEnvironment();
+-    env.insert("PATH", execPath + ":" + env.value("PATH"));
+-    process->setEnvironment(env.toStringList());
+-
+-    #if defined Q_OS_WIN
+-        process->setProgram(execPath + "/python/python.exe");
+-    #else
+-        process->setProgram(QStandardPaths::findExecutable("python3"));
+-    #endif
+    process->setProgram(path);
+ 
+     QSettings settings;
+     QStringList proxyArguments;
+@@ -81,7 +45,7 @@ QProcess* YoutubeDl::instance(QString path, QStringList arguments) {
+         networkArguments << "--force-ipv4";
+     }
+ 
+-    process->setArguments(QStringList() << path << arguments << proxyArguments << networkArguments);
+    process->setArguments(QStringList() << arguments << proxyArguments << networkArguments);
+     return process;
+ }
+ 
--- a/pkgs/applications/video/lbry/default.nix
+++ b/pkgs/applications/video/lbry/default.nix
@ -2,7 +2,7 @@

 let
  pname = "lbry-desktop";
-  version = "0.52.2";
+  version = "0.52.4";
 in appimageTools.wrapAppImage rec {
  name = "${pname}-${version}";

@ -12,7 +12,7 @@ in appimageTools.wrapAppImage rec {
    src = fetchurl {
      url = "https://github.com/lbryio/lbry-desktop/releases/download/v${version}/LBRY_${version}.AppImage";
      # Gotten from latest-linux.yml
-      sha512 = "+yymVTpEQ0hKrJYij9lNVxK5J8vnW1g5o1TkGJX/TkSAqIUFhwRUJyqDS3uCvgTrD8ywulewgk1TREd/PA615w==";
+      sha512 = "TWRFCVktSKs5PORtm8FvM6qNWuiL/1HN98ilr1busVUGvain0QXGZwB/Dzvsox1c+X9VofUdapzozSOT6r58qw==";
    };
  };

--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@ -2,7 +2,7 @@
 , perl, pixman, vde2, alsa-lib, texinfo, flex
 , bison, lzo, snappy, libaio, libtasn1, gnutls, nettle, curl, ninja, meson, sigtool
 , makeWrapper, runtimeShell
-, attr, libcap, libcap_ng
+, attr, libcap, libcap_ng, socat
 , CoreServices, Cocoa, Hypervisor, rez, setfile
 , numaSupport ? stdenv.isLinux && !stdenv.isAarch32, numactl
 , seccompSupport ? stdenv.isLinux, libseccomp
@ -31,6 +31,8 @@
                          ++ ["${stdenv.hostPlatform.qemuArch}-softmmu"])
                    else null)
 , nixosTestRunner ? false
+, doCheck ? false
+, qemu  # for passthru.tests
 }:

 stdenv.mkDerivation rec {
@ -158,7 +160,6 @@ stdenv.mkDerivation rec {
    ++ lib.optional smbdSupport "--smbd=${samba}/bin/smbd"
    ++ lib.optional uringSupport "--enable-linux-io-uring";

-  doCheck = false; # tries to access /dev
  dontWrapGApps = true;

  # QEMU attaches entitlements with codesign and strip removes those,
@ -182,6 +183,40 @@ stdenv.mkDerivation rec {
  '';
  preBuild = "cd build";

+  # tests can still timeout on slower systems
+  inherit doCheck;
+  checkInputs = [ socat ];
+  preCheck = ''
+    # time limits are a little meagre for a build machine that's
+    # potentially under load.
+    substituteInPlace ../tests/unit/meson.build \
+      --replace 'timeout: slow_tests' 'timeout: 50 * slow_tests'
+    substituteInPlace ../tests/qtest/meson.build \
+      --replace 'timeout: slow_qtests' 'timeout: 50 * slow_qtests'
+    substituteInPlace ../tests/fp/meson.build \
+      --replace 'timeout: 90)' 'timeout: 300)'
+
+    # point tests towards correct binaries
+    substituteInPlace ../tests/unit/test-qga.c \
+      --replace '/bin/echo' "$(type -P echo)"
+    substituteInPlace ../tests/unit/test-io-channel-command.c \
+      --replace '/bin/socat' "$(type -P socat)"
+
+    # combined with a long package name, some temp socket paths
+    # can end up exceeding max socket name len
+    substituteInPlace ../tests/qtest/bios-tables-test.c \
+      --replace 'qemu-test_acpi_%s_tcg_%s' '%s_%s'
+
+    # get-fsinfo attempts to access block devices, disallowed by sandbox
+    sed -i -e '/\/qga\/get-fsinfo/d' -e '/\/qga\/blacklist/d' \
+      ../tests/unit/test-qga.c
+  '' + lib.optionalString stdenv.isDarwin ''
+    # skip test that stalls on darwin, perhaps due to subtle differences
+    # in fifo behaviour
+    substituteInPlace ../tests/unit/meson.build \
+      --replace "'test-io-channel-command'" "#'test-io-channel-command'"
+  '';
+
  # Add a ‘qemu-kvm’ wrapper for compatibility/convenience.
  postInstall = ''
    ln -s $out/bin/qemu-system-${stdenv.hostPlatform.qemuArch} $out/bin/qemu-kvm
@ -189,6 +224,9 @@ stdenv.mkDerivation rec {

  passthru = {
    qemu-system-i386 = "bin/qemu-system-i386";
+    tests = {
+      qemu-tests = qemu.override { doCheck = true; };
+    };
  };

  # Builds in ~3h with 2 cores, and ~20m with a big-parallel builder.
--- a/pkgs/applications/virtualization/x11docker/default.nix
+++ b/pkgs/applications/virtualization/x11docker/default.nix
@ -1,12 +1,12 @@
 { lib, stdenv, fetchFromGitHub, makeWrapper, nx-libs, xorg, getopt, gnugrep, gawk, ps, mount, iproute2 }:
 stdenv.mkDerivation rec {
  pname = "x11docker";
-  version = "7.0.1";
+  version = "7.1.0";
  src = fetchFromGitHub {
    owner = "mviereck";
    repo = "x11docker";
    rev = "v${version}";
-    sha256 = "sha256-ojKloMFbpBsr8fykMbLIBAzrlVaJDv+4BL0lozXsgC4=";
+    sha256 = "sha256-SBX50wQbNUvgmnO0B0iXiEXEmJrkVmtNqUUv0O6yRic=";
  };
  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/applications/window-managers/i3/status-rust.nix
+++ b/pkgs/applications/window-managers/i3/status-rust.nix
@ -15,16 +15,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "i3status-rust";
-  version = "0.21.4";
+  version = "0.21.5";

  src = fetchFromGitHub {
    owner = "greshake";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-D/+SDKkrYfdzFw+cNBJrCshpDuFSLbr70jvFMbX3B0w=";
+    sha256 = "sha256-0maPT1NdWFkSupU6CL2cFd6hlZ2BMxAOK6f3rQbfFA8=";
  };

-  cargoSha256 = "sha256-tNwf2ShnzoSrb1R/g0hOGwQMulWYXyVCILU3Jb+Sfpg=";
+  cargoSha256 = "sha256-QUecTmw8pWqrTdcstbXoFf53dFfwFN51tQ7ngUzkyV0=";

  nativeBuildInputs = [ pkg-config makeWrapper ];

--- a/pkgs/applications/window-managers/leftwm/default.nix
+++ b/pkgs/applications/window-managers/leftwm/default.nix
@ -6,16 +6,16 @@ in

 rustPlatform.buildRustPackage rec {
  pname = "leftwm";
-  version = "0.2.10";
+  version = "0.2.11";

  src = fetchFromGitHub {
    owner = "leftwm";
    repo = "leftwm";
    rev = version;
-    sha256 = "sha256-WGss/XmryULq8Ly5MFmEqsL+9r4fnrvBEtetngJ05NY=";
+    sha256 = "sha256-GLHmX628UUdIM+xYJhPtqFg4whQqaF8hFxg0Z5grPac=";
  };

-  cargoSha256 = "sha256-9qvXzsAu4H2TAcArajrGqXwKF3BBDvmZbny7hiVO9Yo=";
+  cargoSha256 = "sha256-4Pu3TDLmi0c2nyUj1lTRincgRqL40A/g0PkyJOen0is=";

  buildInputs = rpathLibs;

--- a/pkgs/build-support/fetchgit/deterministic-git
+++ b/pkgs/build-support/fetchgit/deterministic-git
@ -0,0 +1,45 @@
+#!/bin/sh
+
+# some git commands print to stdout, which would contaminate our JSON output
+clean_git(){
+    git "$@" >&2
+}
+
+# Remove all remote branches, remove tags not reachable from HEAD, do a full
+# repack and then garbage collect unreferenced objects.
+make_deterministic_repo(){
+    local repo="$1"
+
+    # run in sub-shell to not touch current working directory
+    (
+    cd "$repo"
+    # Remove files that contain timestamps or otherwise have non-deterministic
+    # properties.
+    rm -rf .git/logs/ .git/hooks/ .git/index .git/FETCH_HEAD .git/ORIG_HEAD \
+        .git/refs/remotes/origin/HEAD .git/config
+
+    # Remove all remote branches.
+    git branch -r | while read -r branch; do
+        clean_git branch -rD "$branch"
+    done
+
+    # Remove tags not reachable from HEAD. If we're exactly on a tag, don't
+    # delete it.
+    maybe_tag=$(git tag --points-at HEAD)
+    git tag --contains HEAD | while read -r tag; do
+        if [ "$tag" != "$maybe_tag" ]; then
+            clean_git tag -d "$tag"
+        fi
+    done
+
+    # Do a full repack. Must run single-threaded, or else we lose determinism.
+    clean_git config pack.threads 1
+    clean_git repack -A -d -f
+    rm -f .git/config
+
+    # Garbage collect unreferenced objects.
+    # Note: --keep-largest-pack prevents non-deterministic ordering of packs
+    #   listed in .git/objects/info/packs by only using a single pack
+    clean_git gc --prune=all --keep-largest-pack
+    )
+}
--- a/pkgs/build-support/flutter/default.nix
+++ b/pkgs/build-support/flutter/default.nix
@ -0,0 +1,277 @@
+{ flutter
+, lib
+, llvmPackages_13
+, cmake
+, ninja
+, pkg-config
+, wrapGAppsHook
+, autoPatchelfHook
+, util-linux
+, libselinux
+, libsepol
+, libthai
+, libdatrie
+, libxkbcommon
+, at-spi2-core
+, libsecret
+, jsoncpp
+, xorg
+, dbus
+, gtk3
+, glib
+, pcre
+, libepoxy
+, stdenvNoCC
+, cacert
+, git
+, dart
+, nukeReferences
+, targetPlatform
+, bash
+, curl
+, unzip
+, which
+, xz
+}:
+
+# absolutely no mac support for now
+
+args:
+let
+  pl = n: "##FLUTTER_${n}_PLACEHOLDER_MARKER##";
+  placeholder_deps = pl "DEPS";
+  placeholder_flutter = pl "FLUTTER";
+  fetchAttrs = [ "src" "sourceRoot" "setSourceRoot" "unpackPhase" "patches" ];
+  getAttrsOrNull = names: attrs: lib.genAttrs names (name: if attrs ? ${name} then attrs.${name} else null);
+  flutterDeps = [
+    # flutter deps
+    flutter.unwrapped
+    bash
+    curl
+    flutter.dart
+    git
+    unzip
+    which
+    xz
+  ];
+  self =
+(self: llvmPackages_13.stdenv.mkDerivation (args // {
+  deps = stdenvNoCC.mkDerivation (lib.recursiveUpdate (getAttrsOrNull fetchAttrs args) {
+    name = "${self.name}-deps-flutter-v${flutter.unwrapped.version}-${targetPlatform.system}.tar.gz";
+
+    nativeBuildInputs = flutterDeps ++ [
+      nukeReferences
+    ];
+
+    installPhase = ''
+      . ${../fetchgit/deterministic-git}
+
+      TMP=$(mktemp -d)
+
+      export HOME="$TMP"
+      export PUB_CACHE=''${PUB_CACHE:-"$HOME/.pub-cache"}
+      export ANDROID_EMULATOR_USE_SYSTEM_LIBS=1
+
+      flutter config --no-analytics &>/dev/null # mute first-run
+      flutter config --enable-linux-desktop
+      flutter packages get
+      flutter build linux || true # so it downloads tools
+
+      RES="$TMP"
+
+      mkdir -p "$RES/f"
+
+      # so we can use lock, diff yaml
+      cp "pubspec.yaml" "$RES"
+      cp "pubspec.lock" "$RES"
+      mv .dart_tool .flutter-plugins .flutter-plugins-dependencies .packages "$RES/f"
+
+      # replace paths with placeholders
+      find "$RES" -type f -exec sed -i \
+        -e s,$TMP,${placeholder_deps},g \
+        -e s,${flutter.unwrapped},${placeholder_flutter},g \
+        {} +
+
+      remove_line_matching() {
+        replace_line_matching "$1" "$2" ""
+      }
+
+      replace_line_matching() {
+        sed "s|.*$2.*|$3|g" -r -i "$1"
+      }
+
+      # nuke nondeterminism
+
+      # clientId is random
+      remove_line_matching "$RES/.flutter" clientId
+
+      # deterministic git repos
+      find "$RES" -iname .git -type d | while read -r repoGit; do
+        make_deterministic_repo "$(dirname "$repoGit")"
+      done
+
+      # dart _fetchedAt, etc
+      DART_DATE=$(date --date="@$SOURCE_DATE_EPOCH" -In | sed "s|,|.|g" | sed "s|+.*||g")
+      find "$RES/.pub-cache" -iname "*.json" -exec sed -r 's|.*_fetchedAt.*|    "_fetchedAt": "'"$DART_DATE"'",|g' -i {} +
+      replace_line_matching "$RES/f/.dart_tool/package_config.json" '"generated"' '"generated": "'"$DART_DATE"'",'
+      replace_line_matching "$RES/f/.flutter-plugins-dependencies" '"date_created"' '"date_created": "'"$DART_DATE"'",'
+      remove_line_matching "$RES/f/.packages" "Generated by pub"
+
+      # nuke refs
+      find "$RES" -type f -exec nuke-refs {} +
+
+      # Build a reproducible tar, per instructions at https://reproducible-builds.org/docs/archives/
+      tar --owner=0 --group=0 --numeric-owner --format=gnu \
+          --sort=name --mtime="@$SOURCE_DATE_EPOCH" \
+          -czf "$out" -C "$RES" .
+    '';
+
+    GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+
+    impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
+      "GIT_PROXY_COMMAND" "NIX_GIT_SSL_CAINFO" "SOCKS_SERVER"
+    ];
+
+    # unnecesarry
+    dontFixup = true;
+
+    outputHashAlgo = if self ? vendorHash then null else "sha256";
+    # outputHashMode = "recursive";
+    outputHash = if self ? vendorHash then
+      self.vendorHash
+    else if self ? vendorSha256 then
+      self.vendorSha256
+    else
+      lib.fakeSha256;
+
+  });
+
+  nativeBuildInputs = flutterDeps ++ [
+    # flutter dev tools
+    cmake
+    ninja
+    pkg-config
+    wrapGAppsHook
+    # flutter likes dynamic linking
+    autoPatchelfHook
+  ] ++ lib.optionals (args ? nativeBuildInputs) args.nativeBuildInputs;
+
+  buildInputs = [
+    # cmake deps
+    gtk3
+    glib
+    pcre
+    util-linux
+    # also required by cmake, not sure if really needed or dep of all packages
+    libselinux
+    libsepol
+    libthai
+    libdatrie
+    xorg.libXdmcp
+    xorg.libXtst
+    libxkbcommon
+    dbus
+    at-spi2-core
+    libsecret
+    jsoncpp
+    # build deps
+    xorg.libX11
+    # directly required by build
+    libepoxy
+  ] ++ lib.optionals (args ? buildInputs) args.buildInputs;
+
+  # TODO: do we need this?
+  NIX_LDFLAGS = "-rpath ${lib.makeLibraryPath self.buildInputs}";
+  NIX_CFLAGS_COMPILE = "-I${xorg.libX11}/include";
+  LD_LIBRARY_PATH = lib.makeLibraryPath self.buildInputs;
+
+  configurePhase = ''
+    runHook preConfigure
+
+    # for some reason fluffychat build breaks without this - seems file gets overriden by some tool
+    cp pubspec.yaml pubspec-backup
+
+    # we get this from $depsFolder so disabled for now, but we might need it again once deps are fetched properly
+    # flutter config --no-analytics >/dev/null 2>/dev/null # mute first-run
+    # flutter config --enable-linux-desktop
+
+    # extract deps
+    depsFolder=$(mktemp -d)
+    tar xzf "$deps" -C "$depsFolder"
+
+    # after extracting update paths to point to real paths
+    find "$depsFolder" -type f -exec sed -i \
+      -e s,${placeholder_deps},$depsFolder,g \
+      -e s,${placeholder_flutter},${flutter.unwrapped},g \
+      {} +
+
+    # ensure we're using a lockfile for the right package version
+    if [ -e pubspec.lock ]; then
+      # diff -u pubspec.lock $depsFolder/pubspec.lock
+      true
+    else
+      cp -v "$depsFolder/pubspec.lock" .
+    fi
+    diff -u pubspec.yaml $depsFolder/pubspec.yaml
+
+    mv -v $(find $depsFolder/f -type f) .
+
+    # prepare
+    export HOME=$depsFolder
+    export PUB_CACHE=''${PUB_CACHE:-"$HOME/.pub-cache"}
+    export ANDROID_EMULATOR_USE_SYSTEM_LIBS=1
+
+    # binaries need to be patched
+    autoPatchelf -- "$depsFolder"
+
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    # for some reason fluffychat build breaks without this - seems file gets overriden by some tool
+    mv pubspec-backup pubspec.yaml
+    mkdir -p build/flutter_assets/fonts
+
+    flutter packages get --offline -v
+    flutter build linux --release -v
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    built=build/linux/*/release/bundle
+
+    mkdir -p $out/bin
+    mv $built $out/app
+
+    for f in $built/data/flutter_assets/assets/*.desktop; do
+      install -D $f $out/share/applications/$(basename $f)
+    done
+    for f in $(find $out/app -maxdepth 1 -type f); do
+      ln -s $f $out/bin/$(basename $f)
+    done
+
+    # this confuses autopatchelf hook otherwise
+    rm -rf "$depsFolder"
+
+    # make *.so executable
+    find $out/app -iname "*.so" -type f -exec chmod +x {} +
+
+    # remove stuff like /build/source/packages/ubuntu_desktop_installer/linux/flutter/ephemeral
+    for f in $(find $out/app -executable -type f); do
+      if patchelf --print-rpath "$f" | grep /build; then # this ignores static libs (e,g. libapp.so) also
+        echo "strip RPath of $f"
+        newrp=$(patchelf --print-rpath $f | sed -r "s|/build.*ephemeral:||g" | sed -r "s|/build.*profile:||g")
+        patchelf --set-rpath "$newrp" "$f"
+      fi
+    done
+
+    runHook postInstall
+  '';
+})) self;
+in
+  self
--- a/pkgs/common-updater/unstable-updater.nix
+++ b/pkgs/common-updater/unstable-updater.nix
@ -10,38 +10,103 @@
 # commit.
 { url ? null # The git url, if empty it will be set to src.url
 , branch ? null
+, stableVersion ? false # Use version format according to RFC 107 (i.e. LAST_TAG+date=YYYY-MM-DD)
+, tagPrefix ? "" # strip this prefix from a tag name when using stable version
 }:

 let
  updateScript = writeShellScript "unstable-update-script.sh" ''
    set -ex

-    url="$1"
+    url=""
+    branch=""
+    use_stable_version=""
+    tag_prefix=""
+
+    while (( $# > 0 )); do
+        flag="$1"
+        shift 1
+        case "$flag" in
+          --url=*)
+            url="''${flag#*=}"
+            ;;
+          --branch=*)
+            branch="''${flag#*=}"
+            ;;
+          --use-stable-version)
+            use_stable_version=1
+            ;;
+          --tag-prefix=*)
+            tag_prefix="''${flag#*=}"
+            ;;
+          *)
+            echo "$0: unknown option ‘''${flag}’"
+            exit 1
+            ;;
+        esac
+    done

    # By default we set url to src.url
    if [[ -z "$url" ]]; then
        url="$(${nix}/bin/nix-instantiate $systemArg --eval -E \
-                   "with import ./. {}; $UPDATE_NIX_ATTR_PATH.src.url" \
+                   "with import ./. {}; $UPDATE_NIX_ATTR_PATH.src.url or $UPDATE_NIX_ATTR_PATH.src.meta.homepage" \
            | tr -d '"')"
    fi

    # Get info about HEAD from a shallow git clone
    tmpdir="$(${coreutils}/bin/mktemp -d)"
-    ${git}/bin/git clone --bare --depth=1 \
-      ${lib.optionalString (branch != null) "--branch ${branch}"} \
-      "$url" "$tmpdir"
+
+    cloneArgs=(
+      --bare
+      --depth=1
+    )
+
+    if [[ -n "$branch" ]]; then
+        cloneArgs+=(--branch="$branch")
+    fi
+
+    ${git}/bin/git clone "''${cloneArgs[@]}" "$url" "$tmpdir"
+
    pushd "$tmpdir"
    commit_date="$(${git}/bin/git show -s --pretty='format:%cs')"
    commit_sha="$(${git}/bin/git show -s --pretty='format:%H')"
+    if [[ -z "$use_stable_version" ]]; then
+        new_version="unstable-$commit_date"
+    else
+        depth=100
+        while (( $depth < 10000 )); do
+            last_tag="$(${git}/bin/git describe --tags --abbrev=0 2> /dev/null || true)"
+            if [[ -n "$last_tag" ]]; then
+                break
+            fi
+            ${git}/bin/git fetch --depth="$depth" --tags
+            depth=$(( $depth * 2 ))
+        done
+        if [[ -z "$last_tag" ]]; then
+            echo "Cound not found a tag within last 10000 commits" > /dev/stderr
+            exit 1
+        fi
+        if [[ -n "$tag_prefix" ]]; then
+          last_tag="''${last_tag#$tag_prefix}"
+        fi
+        new_version="$last_tag+date=$commit_date"
+    fi
    popd
-    ${coreutils}/bin/rm -rf "$tmpdir"
+    # ${coreutils}/bin/rm -rf "$tmpdir"

    # update the nix expression
    ${common-updater-scripts}/bin/update-source-version \
        "$UPDATE_NIX_ATTR_PATH" \
-        "unstable-$commit_date" \
+        "$new_version" \
        --rev="$commit_sha"
  '';

-in [ updateScript url ]
-
+in [
+  updateScript
+  "--url=${builtins.toString url}"
+] ++ lib.optionals (branch != null) [
+  "--branch=${branch}"
+] ++ lib.optionals stableVersion [
+  "--use-stable-version"
+  "--tag-prefix=${tagPrefix}"
+]
--- a/pkgs/data/documentation/gnome-user-docs/default.nix
+++ b/pkgs/data/documentation/gnome-user-docs/default.nix
@ -9,11 +9,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-user-docs";
-  version = "41.1";
+  version = "41.2";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-user-docs/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "Ve499XfRcX/BUvwq64nQr3qeyoZsiXTGdfYL1jCIjEg=";
+    sha256 = "0xcIld06i7EXyfFIoLs/tJDRr3ExxEFod7G7/sWROVo=";
  };

  nativeBuildInputs = [
--- a/pkgs/data/fonts/sahel-fonts/default.nix
+++ b/pkgs/data/fonts/sahel-fonts/default.nix
@ -2,7 +2,7 @@

 let
  pname = "sahel-fonts";
-  version = "1.0.0-alpha22";
+  version = "3.4.0";
 in fetchFromGitHub {
  name = "${pname}-${version}";

@ -14,7 +14,7 @@ in fetchFromGitHub {
    tar xf $downloadedFile --strip=1
    find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/sahel-fonts {} \;
  '';
-  sha256 = "0vj8ydv50rjanb0favd7rh4r9rv5fl39vqwvzkpgfdcdawn0xjm7";
+  sha256 = "sha256-MrKSgz9WpVgLS37uH/7S0LPBD/n3GLXeUCMBD7x5CG8=";

  meta = with lib; {
    homepage = "https://github.com/rastikerdar/sahel-font";
--- a/pkgs/data/fonts/shabnam-fonts/default.nix
+++ b/pkgs/data/fonts/shabnam-fonts/default.nix
@ -2,7 +2,7 @@

 let
  pname = "shabnam-fonts";
-  version = "4.0.0";
+  version = "5.0.1";
 in fetchFromGitHub {
  name = "${pname}-${version}";

@ -14,7 +14,7 @@ in fetchFromGitHub {
    tar xf $downloadedFile --strip=1
    find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/shabnam-fonts {} \;
  '';
-  sha256 = "0wfyaaj2pq2knz12l7rsc4wc703cbz0r8gkcya5x69p0aixch8ba";
+  sha256 = "sha256-m4G4UtW/0S9CsvaSF7QfthfIxGQ02E7SucdDm5s3G7A=";

  meta = with lib; {
    homepage = "https://github.com/rastikerdar/shabnam-font";
--- a/pkgs/data/misc/ddccontrol-db/default.nix
+++ b/pkgs/data/misc/ddccontrol-db/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "ddccontrol-db";
-  version = "20220119";
+  version = "20220216";

  src = fetchFromGitHub {
    owner = "ddccontrol";
    repo = "ddccontrol-db";
    rev = version;
-    sha256 = "sha256-8JJ6RG7yA1ssoYsvgDYp3/r+h1+rKnOwwoDhRx2brY8=";
+    sha256 = "sha256-Nr8OvxbJRf9t2BUtEX3qBAH2BSs6KWLMzSpykiwYsHQ=";
  };

  preConfigure = ''
--- a/pkgs/data/misc/osinfo-db/default.nix
+++ b/pkgs/data/misc/osinfo-db/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "osinfo-db";
-  version = "20210312";
+  version = "20211216";

  src = fetchurl {
    url = "https://releases.pagure.org/libosinfo/${pname}-${version}.tar.xz";
-    sha256 = "sha256-dUjsCeRFynN4xc65njntyohX+Ck4MeCzy1WPQjCHDhA=";
+    sha256 = "sha256-CeznsOUhMw4x0SpZFx408JcYGny7zW+M1J+SiSO7EII=";
  };

  nativeBuildInputs = [ osinfo-db-tools gettext libxml2 ];
--- a/pkgs/data/misc/v2ray-geoip/default.nix
+++ b/pkgs/data/misc/v2ray-geoip/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "v2ray-geoip";
-  version = "202202100032";
+  version = "202202170030";

  src = fetchFromGitHub {
    owner = "v2fly";
    repo = "geoip";
-    rev = "0a16dba825e420425786ff74f51a6bb881a62624";
-    sha256 = "sha256-M3DitRNhvPh4AOocnG6omiQAPKgWziAcN4uO42/7BNE=";
+    rev = "ebc49c1ccbe7f267778ab42dbfa01d7ff8a5241c";
+    sha256 = "sha256-CxV7jKNeaSW7lVBKKr7Ih2XAehnFcapkyDogd5V32Zk=";
  };

  installPhase = ''
--- a/pkgs/desktops/gnome/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-shell/default.nix
@ -66,13 +66,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "gnome-shell";
-  version = "41.3";
+  version = "41.4";

  outputs = [ "out" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-shell/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "Hj36KgvklFQYK0rOd/EdENP1uYjvD8tzK3MTVzlJ3tE=";
+    sha256 = "x+73SvMEZJwDuG25m9C6x1oBH7/2d0yO41WD282tivQ=";
  };

  patches = [
--- a/pkgs/desktops/gnome/core/mutter/default.nix
+++ b/pkgs/desktops/gnome/core/mutter/default.nix
@ -46,13 +46,13 @@

 let self = stdenv.mkDerivation rec {
  pname = "mutter";
-  version = "41.3";
+  version = "41.4";

  outputs = [ "out" "dev" "man" ];

  src = fetchurl {
    url = "mirror://gnome/sources/mutter/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "cZxdEGDrYFwbpkO0hvtXsaPHGX59+DvWwzZvxLaEd+U=";
+    sha256 = "VYgmlQZKpvA4XNH39/qywqLtLJrsePV4+qB/UgnKUpw=";
  };

  patches = [
--- a/pkgs/desktops/gnome/extensions/dash-to-dock/default.nix
+++ b/pkgs/desktops/gnome/extensions/dash-to-dock/default.nix
@ -0,0 +1,48 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, glib
+, gettext
+, sassc
+, unstableGitUpdater
+}:
+
+stdenv.mkDerivation rec {
+  pname = "gnome-shell-extension-dash-to-dock";
+  version = "71+date=2022-01-24";
+
+  # Temporarily switched to commit hash because stable version is buggy.
+  src = fetchFromGitHub {
+    owner = "micheleg";
+    repo = "dash-to-dock";
+    rev = "53114b4e000482a753e8b42dfa10d6057c08d1c6";
+    sha256 = "Gv78I/dxhc6FpjZWk10uHBfD24tHE4KdkpaAo8UZpwU=";
+  };
+
+  nativeBuildInputs = [
+    glib
+    gettext
+    sassc
+  ];
+
+  makeFlags = [
+    "INSTALLBASE=${placeholder "out"}/share/gnome-shell/extensions"
+  ];
+
+  passthru = {
+    extensionUuid = "dash-to-dock@micxgx.gmail.com";
+    extensionPortalSlug = "dash-to-dock";
+
+    updateScript = unstableGitUpdater {
+      stableVersion = true;
+      tagPrefix = "extensions.gnome.org-v";
+    };
+  };
+
+  meta = with lib; {
+    description = "A dock for the Gnome Shell";
+    homepage = "https://micheleg.github.io/dash-to-dock/";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ eperuffo jtojnar rhoriguchi ];
+  };
+}
--- a/pkgs/desktops/gnome/extensions/extensionOverrides.nix
+++ b/pkgs/desktops/gnome/extensions/extensionOverrides.nix
@ -28,10 +28,6 @@ super: lib.trivial.pipe super [
    meta.maintainers = with lib.maintainers; [ eperuffo ];
  }))

-  (patchExtension "dash-to-dock@micxgx.gmail.com" (old: {
-    meta.maintainers = with lib.maintainers; [ eperuffo jtojnar rhoriguchi ];
-  }))
-
  (patchExtension "ddterm@amezin.github.com" (old: {
    # Requires gjs, zenity & vte via the typelib
    nativeBuildInputs = [ gobject-introspection wrapGAppsHook ];
--- a/pkgs/desktops/gnome/extensions/manuallyPackaged.nix
+++ b/pkgs/desktops/gnome/extensions/manuallyPackaged.nix
@ -2,6 +2,7 @@
 {
  "arcmenu@arcmenu.com" = callPackage ./arcmenu { };
  "clock-override@gnomeshell.kryogenix.org" = callPackage ./clock-override { };
+  "dash-to-dock@micxgx.gmail.com" = callPackage ./dash-to-dock { };
  "drop-down-terminal@gs-extensions.zzrough.org" = callPackage ./drop-down-terminal { };
  "EasyScreenCast@iacopodeenosee.gmail.com" = callPackage ./EasyScreenCast { };
  "emoji-selector@maestroschan.fr" = callPackage ./emoji-selector { };
--- a/pkgs/development/beam-modules/erlang-ls/default.nix
+++ b/pkgs/development/beam-modules/erlang-ls/default.nix
@ -1,7 +1,7 @@
 { fetchFromGitHub, fetchgit, fetchHex, rebar3Relx, buildRebar3, rebar3-proper
 , stdenv, writeScript, lib }:
 let
-  version = "0.23.0";
+  version = "0.23.1";
  owner = "erlang-ls";
  repo = "erlang_ls";
  deps = import ./rebar-deps.nix {
@ -19,7 +19,7 @@ rebar3Relx {
  inherit version;
  src = fetchFromGitHub {
    inherit owner repo;
-    sha256 = "sha256-OuTd8XhoWU598eMh1/OL2t3LHf+UAumiuAY7KocfI6c=";
+    sha256 = "sha256-N0jkdzwNi9dx0dmN4qL+mb8S60OII4C/MnR/y8G3GUY=";
    rev = version;
  };
  releaseType = "escript";
--- a/pkgs/development/compilers/flutter/flutter.nix
+++ b/pkgs/development/compilers/flutter/flutter.nix
@ -32,6 +32,7 @@
 , nss
 , systemd
 , which
+, callPackage
 }:
 let
  drvName = "flutter-${version}";
@ -146,6 +147,8 @@ let
  };

 in
+let
+self = (self:
 runCommand drvName
 {
  startScript = ''
@ -159,6 +162,9 @@ runCommand drvName
  passthru = {
    unwrapped = flutter;
    inherit dart;
+    mkFlutterApp = callPackage ../../../build-support/flutter {
+      flutter = self;
+    };
  };
  meta = with lib; {
    description = "Flutter is Google's SDK for building mobile, web and desktop with Dart";
@ -179,4 +185,6 @@ runCommand drvName

  echo -n "$startScript" > $out/bin/${pname}
  chmod +x $out/bin/${pname}
-''
+'') self;
+in
+self
--- a/Show More
+++ b/Show More