nixos/release-notes: move non-highlights to other mentions

(cherry picked from commit 9a3e8699976bd673f9f4eee64e254ccb7a1fadce)

.github/CODEOWNERS

@@ -46,7 +46,6 @@
 /nixos/default.nix          @nbp @infinisil
 /nixos/lib/from-env.nix     @nbp @infinisil
 /nixos/lib/eval-config.nix  @nbp @infinisil
-/nixos/doc @ryantm
 /nixos/doc/manual/configuration/abstractions.xml      @nbp
 /nixos/doc/manual/configuration/config-file.xml       @nbp
 /nixos/doc/manual/configuration/config-syntax.xml     @nbp

.github/workflows/nixos-manual.yml

@@ -1,20 +0,0 @@
-name: NixOS manual checks
-
-on:
-  pull_request:
-    branches-ignore:
-      - 'release-**'
-    paths:
-      - 'nixos/**/*.xml'
-      - 'nixos/**/*.md'
-
-jobs:
-  tests:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v2
-    - uses: cachix/install-nix-action@v12
-    - name: Check DocBook files generated from Markdown are consistent
-      run: |
-        nixos/doc/manual/md-to-db.sh
-        git diff --exit-code

.version

@@ -1 +1 @@
-21.11
+21.05

doc/contributing/coding-conventions.chapter.md

@@ -526,6 +526,16 @@ If you do need to do create this sort of patch file, one way to do so is with gi
     $ git diff > nixpkgs/pkgs/the/package/0001-changes.patch
     ```
 
+If a patch is available online but does not cleanly apply, it can be modified in some fixed ways by using additional optional arguments for `fetchpatch`:
+
+- `stripLen`: Remove the first `stripLen` components of pathnames in the patch.
+- `extraPrefix`: Prefix pathnames by this string.
+- `excludes`: Exclude files matching this pattern.
+- `includes`: Include only files matching this pattern.
+- `revert`: Revert the patch.
+
+Note that because the checksum is computed after applying these effects, using or modifying these arguments will have no effect unless the `sha256` argument is changed as well.
+
 ## Package tests {#sec-package-tests}
 
 Tests are important to ensure quality and make reviews and automatic updates easy.

lib/trivial.nix

@@ -171,7 +171,7 @@ rec {
      On each release the first letter is bumped and a new animal is chosen
      starting with that new letter.
   */
-  codeName = "Porcupine";
+  codeName = "Okapi";
 
   /* Returns the current nixpkgs version suffix as string. */
   versionSuffix =

nixos/doc/manual/contributing-to-this-manual.chapter.md

@@ -1,13 +0,0 @@
-# Contributing to this manual {#chap-contributing}
-
-The DocBook and CommonMark sources of NixOS' manual are in the [nixos/doc/manual](https://github.com/NixOS/nixpkgs/tree/master/nixos/doc/manual) subdirectory of the [Nixpkgs](https://github.com/NixOS/nixpkgs) repository.
-
-You can quickly check your edits with the following:
-
-```ShellSession
-$ cd /path/to/nixpkgs
-$ ./nixos/doc/manual/md-to-db.sh
-$ nix-build nixos/release.nix -A manual.x86_64-linux
-```
-
-If the build succeeds, the manual will be in `./result/share/doc/nixos/index.html`.

nixos/doc/manual/contributing-to-this-manual.xml

@@ -0,0 +1,22 @@
+<chapter xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xml:id="chap-contributing">
+ <title>Contributing to this manual</title>
+ <para>
+  The DocBook sources of NixOS' manual are in the <filename
+xlink:href="https://github.com/NixOS/nixpkgs/tree/master/nixos/doc/manual">
+nixos/doc/manual</filename> subdirectory of the <link
+xlink:href="https://github.com/NixOS/nixpkgs">Nixpkgs</link> repository.
+ </para>
+ <para>
+  You can quickly check your edits with the following:
+ </para>
+<screen>
+<prompt>$ </prompt>cd /path/to/nixpkgs
+<prompt>$ </prompt>nix-build nixos/release.nix -A manual.x86_64-linux
+</screen>
+ <para>
+  If the build succeeds, the manual will be in
+  <filename>./result/share/doc/nixos/index.html</filename>.
+ </para>
+</chapter>

nixos/doc/manual/development/building-nixos.chapter.md

@@ -1,18 +0,0 @@
-# Building Your Own NixOS CD {#sec-building-cd}
-Building a NixOS CD is as easy as configuring your own computer. The idea is to use another module which will replace your `configuration.nix` to configure the system that would be installed on the CD.
-
-Default CD/DVD configurations are available inside `nixos/modules/installer/cd-dvd`
-
-```ShellSession
-$ git clone https://github.com/NixOS/nixpkgs.git
-$ cd nixpkgs/nixos
-$ nix-build -A config.system.build.isoImage -I nixos-config=modules/installer/cd-dvd/installation-cd-minimal.nix default.nix
-```
-
-Before burning your CD/DVD, you can check the content of the image by mounting anywhere like suggested by the following command:
-
-```ShellSession
-# mount -o loop -t iso9660 ./result/iso/cd.iso /mnt/iso</screen>
-```
-
-If you want to customize your NixOS CD in more detail, or generate other kinds of images, you might want to check out [nixos-generators](https://github.com/nix-community/nixos-generators). This can also be a good starting point when you want to use Nix to build a 'minimal' image that doesn't include a NixOS installation.

nixos/doc/manual/development/building-nixos.xml

@@ -0,0 +1,33 @@
+<chapter xmlns="http://docbook.org/ns/docbook"
+        xmlns:xlink="http://www.w3.org/1999/xlink"
+        xmlns:xi="http://www.w3.org/2001/XInclude"
+        version="5.0"
+        xml:id="sec-building-cd">
+ <title>Building Your Own NixOS CD</title>
+ <para>
+  Building a NixOS CD is as easy as configuring your own computer. The idea is
+  to use another module which will replace your
+  <filename>configuration.nix</filename> to configure the system that would be
+  installed on the CD.
+ </para>
+ <para>
+  Default CD/DVD configurations are available inside
+  <filename>nixos/modules/installer/cd-dvd</filename>.
+<screen>
+<prompt>$ </prompt>git clone https://github.com/NixOS/nixpkgs.git
+<prompt>$ </prompt>cd nixpkgs/nixos
+<prompt>$ </prompt>nix-build -A config.system.build.isoImage -I nixos-config=modules/installer/cd-dvd/installation-cd-minimal.nix default.nix</screen>
+ </para>
+ <para>
+  Before burning your CD/DVD, you can check the content of the image by
+  mounting anywhere like suggested by the following command:
+<screen>
+<prompt># </prompt>mount -o loop -t iso9660 ./result/iso/cd.iso /mnt/iso</screen>
+ </para>
+ <para>
+ If you want to customize your NixOS CD in more detail, or generate other kinds
+ of images, you might want to check out <link
+ xlink:href="https://github.com/nix-community/nixos-generators">nixos-generators</link>. This can also be a good starting point when you want to use Nix to build a
+ 'minimal' image that doesn't include a NixOS installation.
+ </para>
+</chapter>

nixos/doc/manual/development/development.xml

@@ -13,7 +13,7 @@
  <xi:include href="writing-modules.xml" />
  <xi:include href="building-parts.xml" />
  <xi:include href="writing-documentation.xml" />
- <xi:include href="../from_md/development/building-nixos.chapter.xml" />
+ <xi:include href="building-nixos.xml" />
  <xi:include href="nixos-tests.xml" />
  <xi:include href="testing-installer.xml" />
  <xi:include href="releases.xml" />

nixos/doc/manual/from_md/README.md

@@ -1,5 +0,0 @@
-This directory is temporarily needed while we transition the manual to CommonMark. It stores the output of the ../md-to-db.sh script that converts CommonMark files back to DocBook.
-
-We are choosing to convert the Markdown to DocBook at authoring time instead of manual building time, because we do not want the pandoc toolchain to become part of the NixOS closure.
-
-Do not edit the DocBook files inside this directory or its subdirectories. Instead, edit the corresponding .md file in the normal manual directories, and run ../md-to-db.sh to update the file here.

nixos/doc/manual/from_md/contributing-to-this-manual.chapter.xml

@@ -1,22 +0,0 @@
-<chapter xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="chap-contributing">
-  <title>Contributing to this manual</title>
-  <para>
-    The DocBook and CommonMark sources of NixOS’ manual are in the
-    <link xlink:href="https://github.com/NixOS/nixpkgs/tree/master/nixos/doc/manual">nixos/doc/manual</link>
-    subdirectory of the
-    <link xlink:href="https://github.com/NixOS/nixpkgs">Nixpkgs</link>
-    repository.
-  </para>
-  <para>
-    You can quickly check your edits with the following:
-  </para>
-  <programlisting>
-$ cd /path/to/nixpkgs
-$ ./nixos/doc/manual/md-to-db.sh
-$ nix-build nixos/release.nix -A manual.x86_64-linux
-</programlisting>
-  <para>
-    If the build succeeds, the manual will be in
-    <literal>./result/share/doc/nixos/index.html</literal>.
-  </para>
-</chapter>

nixos/doc/manual/from_md/development/building-nixos.chapter.xml

@@ -1,33 +0,0 @@
-<chapter xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-building-cd">
-  <title>Building Your Own NixOS CD</title>
-  <para>
-    Building a NixOS CD is as easy as configuring your own computer. The
-    idea is to use another module which will replace your
-    <literal>configuration.nix</literal> to configure the system that
-    would be installed on the CD.
-  </para>
-  <para>
-    Default CD/DVD configurations are available inside
-    <literal>nixos/modules/installer/cd-dvd</literal>
-  </para>
-  <programlisting>
-$ git clone https://github.com/NixOS/nixpkgs.git
-$ cd nixpkgs/nixos
-$ nix-build -A config.system.build.isoImage -I nixos-config=modules/installer/cd-dvd/installation-cd-minimal.nix default.nix
-</programlisting>
-  <para>
-    Before burning your CD/DVD, you can check the content of the image
-    by mounting anywhere like suggested by the following command:
-  </para>
-  <programlisting>
-# mount -o loop -t iso9660 ./result/iso/cd.iso /mnt/iso&lt;/screen&gt;
-</programlisting>
-  <para>
-    If you want to customize your NixOS CD in more detail, or generate
-    other kinds of images, you might want to check out
-    <link xlink:href="https://github.com/nix-community/nixos-generators">nixos-generators</link>.
-    This can also be a good starting point when you want to use Nix to
-    build a <quote>minimal</quote> image that doesn’t include a NixOS
-    installation.
-  </para>
-</chapter>

nixos/doc/manual/from_md/release-notes/rl-2111.section.xml

@@ -1,15 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="release-21.11">
-  <title>Release 21.11 (<quote>?</quote>, 2021.11/??)</title>
-  <para>
-    In addition to numerous new and upgraded packages, this release has
-    the following highlights:
-  </para>
-  <itemizedlist spacing="compact">
-    <listitem>
-      <para>
-        Support is planned until the end of April 2022, handing over to
-        22.05.
-      </para>
-    </listitem>
-  </itemizedlist>
-</section>

nixos/doc/manual/installation/installing.xml

@@ -46,6 +46,12 @@
    to increase the font size.
   </para>
 
+  <para>
+    To install over a serial port connect with <literal>115200n8</literal>
+    (e.g. <command>picocom -b 115200 /dev/ttyUSB0</command>). When the
+    bootloader lists boot entries, select the serial console boot entry.
+  </para>
+
   <section xml:id="sec-installation-booting-networking">
    <title>Networking in the installer</title>
 

nixos/doc/manual/installation/upgrading.xml

@@ -14,7 +14,7 @@
     <para>
      <emphasis>Stable channels</emphasis>, such as
      <literal
-    xlink:href="https://nixos.org/channels/nixos-20.09">nixos-20.09</literal>.
+    xlink:href="https://nixos.org/channels/nixos-21.05">nixos-21.05</literal>.
      These only get conservative bug fixes and package upgrades. For instance,
      a channel update may cause the Linux kernel on your system to be upgraded
      from 4.19.34 to 4.19.38 (a minor bug fix), but not from
@@ -38,7 +38,7 @@
     <para>
      <emphasis>Small channels</emphasis>, such as
      <literal
-    xlink:href="https://nixos.org/channels/nixos-20.09-small">nixos-20.09-small</literal>
+    xlink:href="https://nixos.org/channels/nixos-21.05-small">nixos-21.05-small</literal>
      or
      <literal
     xlink:href="https://nixos.org/channels/nixos-unstable-small">nixos-unstable-small</literal>.
@@ -63,8 +63,8 @@
  <para>
   When you first install NixOS, you’re automatically subscribed to the NixOS
   channel that corresponds to your installation source. For instance, if you
-  installed from a 20.09 ISO, you will be subscribed to the
-  <literal>nixos-20.09</literal> channel. To see which NixOS channel you’re
+  installed from a 21.05 ISO, you will be subscribed to the
+  <literal>nixos-21.05</literal> channel. To see which NixOS channel you’re
   subscribed to, run the following as root:
 <screen>
 <prompt># </prompt>nix-channel --list | grep nixos
@@ -75,13 +75,13 @@ nixos https://nixos.org/channels/nixos-unstable
 <prompt># </prompt>nix-channel --add https://nixos.org/channels/<replaceable>channel-name</replaceable> nixos
 </screen>
   (Be sure to include the <literal>nixos</literal> parameter at the end.) For
-  instance, to use the NixOS 20.09 stable channel:
+  instance, to use the NixOS 21.05 stable channel:
 <screen>
-<prompt># </prompt>nix-channel --add https://nixos.org/channels/nixos-20.09 nixos
+<prompt># </prompt>nix-channel --add https://nixos.org/channels/nixos-21.05 nixos
 </screen>
   If you have a server, you may want to use the “small” channel instead:
 <screen>
-<prompt># </prompt>nix-channel --add https://nixos.org/channels/nixos-20.09-small nixos
+<prompt># </prompt>nix-channel --add https://nixos.org/channels/nixos-21.05-small nixos
 </screen>
   And if you want to live on the bleeding edge:
 <screen>
@@ -132,7 +132,7 @@ nixos https://nixos.org/channels/nixos-unstable
    kernel, initrd or kernel modules.
    You can also specify a channel explicitly, e.g.
 <programlisting>
-<xref linkend="opt-system.autoUpgrade.channel"/> = https://nixos.org/channels/nixos-20.09;
+<xref linkend="opt-system.autoUpgrade.channel"/> = https://nixos.org/channels/nixos-21.05;
 </programlisting>
   </para>
  </section>

nixos/doc/manual/manual.xml

@@ -19,6 +19,6 @@
   <xi:include href="./generated/options-db.xml"
                 xpointer="configuration-variable-list" />
  </appendix>
- <xi:include href="./from_md/contributing-to-this-manual.chapter.xml" />
+ <xi:include href="contributing-to-this-manual.xml" />
  <xi:include href="release-notes/release-notes.xml" />
 </book>

nixos/doc/manual/md-to-db.sh

@@ -1,33 +0,0 @@
-#! /usr/bin/env nix-shell
-#! nix-shell -I nixpkgs=channel:nixpkgs-unstable -i bash -p pandoc
-
-# This script is temporarily needed while we transition the manual to
-# CommonMark. It converts the .md files in the regular manual folder
-# into DocBook files in the from_md folder.
-
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
-pushd $DIR
-
-OUT="$DIR/from_md"
-mapfile -t MD_FILES < <(find . -type f -regex '.*\.md$')
-
-for mf in ${MD_FILES[*]}; do
-  if [ "${mf: -11}" == ".section.md" ]; then
-    mkdir -p $(dirname "$OUT/$mf")
-    pandoc "$mf" -t docbook \
-      --extract-media=media \
-      -f markdown+smart \
-    | cat  > "$OUT/${mf%".section.md"}.section.xml"
-  fi
-
-  if [ "${mf: -11}" == ".chapter.md" ]; then
-    mkdir -p $(dirname "$OUT/$mf")
-    pandoc "$mf" -t docbook \
-      --top-level-division=chapter \
-      --extract-media=media \
-      -f markdown+smart \
-    | cat  > "$OUT/${mf%".chapter.md"}.chapter.xml"
-  fi
-done
-
-popd

nixos/doc/manual/release-notes/release-notes.xml

@@ -8,7 +8,6 @@
   This section lists the release notes for each stable version of NixOS and
   current unstable revision.
  </para>
- <xi:include href="../from_md/release-notes/rl-2111.section.xml" />
  <xi:include href="rl-2105.xml" />
  <xi:include href="rl-2009.xml" />
  <xi:include href="rl-2003.xml" />

nixos/doc/manual/release-notes/rl-2105.xml

@@ -3,8 +3,11 @@
          xmlns:xi="http://www.w3.org/2001/XInclude"
          version="5.0"
          xml:id="sec-release-21.05">
- <title>Release 21.05 (“Okapi”, 2021.05/??)</title>
+ <title>Release 21.05 (“Okapi”, 2021.05/31)</title>
 
+ <para>
+  Support is planned until the end of December 2021, handing over to 21.11.
+ </para>
  <section xmlns="http://docbook.org/ns/docbook"
          xmlns:xlink="http://www.w3.org/1999/xlink"
          xmlns:xi="http://www.w3.org/2001/XInclude"
@@ -18,113 +21,81 @@
   </para>
 
   <itemizedlist>
+
    <listitem>
     <para>
-     Support is planned until the end of December 2021, handing over to 21.11.
+     Core version changes:
     </para>
-   </listitem>
-   <listitem>
-    <para>The default Linux kernel was updated to the 5.10 LTS series, coming from the 5.4 LTS series.</para>
-   </listitem>
-   <listitem>
-    <para>GNOME desktop environment was upgraded to 40, see the release notes for <link xlink:href="https://help.gnome.org/misc/release-notes/40.0/">40.0</link> and <link xlink:href="https://help.gnome.org/misc/release-notes/3.38/">3.38</link>. The <code>gnome3</code> attribute set has been renamed to <code>gnome</code> and so have been the NixOS options.</para>
+    <itemizedlist>
+     <listitem>
+      <para>
+       gcc: 9.3.0 -> 10.3.0
+      </para>
+     </listitem>
+     <listitem>
+      <para>
+       glibc: 2.30 -> 2.32
+      </para>
+     </listitem>
+     <listitem>
+      <para>
+        default linux: 5.4 -> 5.10, all supported kernels available
+      </para>
+     </listitem>
+     <listitem>
+      <para>
+        mesa: 20.1.7 -> 21.0.1
+      </para>
+     </listitem>
+    </itemizedlist>
    </listitem>
    <listitem>
     <para>
-     <link xlink:href="https://www.gnuradio.org/">GNURadio</link> 3.8 was
-     <link xlink:href="https://github.com/NixOS/nixpkgs/issues/82263">finally</link>
-     packaged, along with a rewrite to the Nix expressions, allowing users to
-     override the features upstream supports selecting to compile or not to.
-     Additionally, the attribute <code>gnuradio</code> and <code>gnuradio3_7</code>
-     now point to an externally wrapped by default derivations, that allow you to
-     also add `extraPythonPackages` to the Python interpreter used by GNURadio.
-     Missing environmental variables needed for operational GUI were also added
-     (<link xlink:href="https://github.com/NixOS/nixpkgs/issues/75478">#75478</link>).
+     Desktop Environments:
     </para>
+    <itemizedlist>
+     <listitem>
+      <para>
+        Gnome: 3.36 -> 3.40, see its <link xlink:href="https://help.gnome.org/misc/release-notes/3.40/">release notes</link>
+      </para>
+     </listitem>
+     <listitem>
+      <para>
+        Plasma5: 5.18.5 -> 5.21.3
+      </para>
+     </listitem>
+     <listitem>
+      <para>
+        kdeApplications: 20.08.1 -> 20.12.3
+      </para>
+     </listitem>
+      <listitem>
+       <para>
+         cinnamon: 4.6 -> 4.8.1
+      </para>
+     </listitem>
+    </itemizedlist>
    </listitem>
+
    <listitem>
     <para>
-     <link xlink:href="https://www.gnuradio.org/">GNURadio</link> has a
-     <code>pkgs</code> attribute set, and there's a <code>gnuradio.callPackage</code>
-     function that extends <code>pkgs</code> with a <code>mkDerivation</code>, and a
-     <code>mkDerivationWith</code>, like Qt5. Now all <code>gnuradio.pkgs</code> are
-     defined with <code>gnuradio.callPackage</code> and some packages that depend
-     on gnuradio are defined with this as well.
+     Programming Languages and Frameworks:
     </para>
+    <itemizedlist>
+
+     <listitem>
+      <para>
+       Python optimizations were disabled again. Builds with optimizations enabled
+       are not reproducible. Optimizations can now be enabled with an option.
+      </para>
+     </listitem>
+
+    </itemizedlist>
    </listitem>
    <listitem>
-    <para>
-     <link xlink:href="https://www.privoxy.org/">Privoxy</link> has been updated
-     to version 3.0.32 (See <link xlink:href="https://lists.privoxy.org/pipermail/privoxy-announce/2021-February/000007.html">announcement</link>).
-     Compared to the previous release, Privoxy has gained support for HTTPS
-     inspection (still experimental), Brotli decompression, several new filters
-     and lots of bug fixes, including security ones. In addition, the package
-     is now built with compression and external filters support, which were
-     previously disabled.
-    </para>
-    <para>
-     Regarding the NixOS module, new options for HTTPS inspection have been added
-     and <option>services.privoxy.extraConfig</option> has been replaced by the new
-     <xref linkend="opt-services.privoxy.settings"/>
-     (See <link xlink:href="https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md">RFC 0042</link>
-     for the motivation).
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Python optimizations were disabled again. Builds with optimizations enabled
-     are not reproducible. Optimizations can now be enabled with an option.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <link xlink:href="https://kodi.tv/">Kodi</link> has been updated to version 19.1 "Matrix". See
-     the <link xlink:href="https://kodi.tv/article/kodi-190-matrix-release">announcement</link> for
-     further details.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <option>services.packagekit.backend</option> option has been removed as
-     it only supported a single setting which would always be the default.
-     Instead new <link
-     xlink:href="https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md">RFC
-     0042</link> compliant <xref linkend="opt-services.packagekit.settings"/>
-     and <xref linkend="opt-services.packagekit.vendorSettings"/> options have
-     been introduced.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      <link xlink:href="https://nginx.org">Nginx</link> has been updated to stable version 1.20.0.
-      Now nginx uses the zlib-ng library by default.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     KDE Gear (formerly KDE Applications) is upgraded to 21.04, see its
-     <link xlink:href="https://kde.org/announcements/gear/21.04/">release
-     notes</link> for details.
-    </para>
-    <para>
-     The <code>kdeApplications</code> package set is now <code>kdeGear</code>,
-     in keeping with the new name. The old name remains for compatibility, but
-     it is deprecated.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <link xlink:href="https://libreswan.org/">Libreswan</link> has been updated
-     to version 4.4. The package now includes example configurations and manual
-     pages by default. The NixOS module has been changed to use the upstream
-     systemd units and write the configuration in the <literal>/etc/ipsec.d/
-     </literal> directory. In addition, two new options have been added to
-     specify connection policies
-     (<xref linkend="opt-services.libreswan.policies"/>)
-     and disable send/receive redirects
-     (<xref linkend="opt-services.libreswan.disableRedirects"/>).
-    </para>
+    <para>The <package>linux_latest</package> kernel was updated to the 5.12 series. It currently is not officially supported for use with the zfs filesystem. If you use zfs, you should use a different kernel version (either the LTS kernel, or track a specific one). </para>
    </listitem>
+
   </itemizedlist>
  </section>
 
@@ -140,6 +111,20 @@
   </para>
 
   <itemizedlist>
+   <listitem>
+    <para>
+     <link xlink:href="https://www.gnuradio.org/">GNURadio</link> 3.8 was
+     <link xlink:href="https://github.com/NixOS/nixpkgs/issues/82263">finally</link>
+     packaged, along with a rewrite to the Nix expressions, allowing users to
+     override the features upstream supports selecting to compile or not to.
+     Additionally, the attribute <code>gnuradio</code> and <code>gnuradio3_7</code>
+     now point to an externally wrapped by default derivations, that allow you to
+     also add `extraPythonPackages` to the Python interpreter used by GNURadio.
+     Missing environmental variables needed for operational GUI were also added
+     (<link xlink:href="https://github.com/NixOS/nixpkgs/issues/75478">#75478</link>).
+    </para>
+   </listitem>
+
    <listitem>
      <para>
        <link xlink:href="https://www.keycloak.org/">Keycloak</link>,
@@ -192,6 +177,10 @@
   </para>
 
   <itemizedlist>
+   <listitem>
+    <para>GNOME desktop environment was upgraded to 40, see the release notes for <link xlink:href="https://help.gnome.org/misc/release-notes/40.0/">40.0</link> and <link xlink:href="https://help.gnome.org/misc/release-notes/3.38/">3.38</link>. The <code>gnome3</code> attribute set has been renamed to <code>gnome</code> and so have been the NixOS options.</para>
+   </listitem>
+
    <listitem>
     <para>
      If you are using <option>services.udev.extraRules</option> to assign
@@ -305,6 +294,24 @@
       <literal>/var/lib/powerdns</literal> to <literal>/run/pdns</literal>.
     </para>
    </listitem>
+   <listitem>
+     <para>
+       The <literal>mediatomb</literal> service is
+       now using by default the new and maintained fork
+       <literal>gerbera</literal> package instead of the unmaintained
+       <literal>mediatomb</literal> package. If you want to keep the old
+       behavior, you must declare it with:
+       <programlisting>
+       services.mediatomb.package = pkgs.mediatomb;
+       </programlisting>
+       One new option <literal>openFirewall</literal> has been introduced which
+       defaults to false. If you relied on the service declaration to add the
+       firewall rules itself before, you should now declare it with:
+       <programlisting>
+       services.mediatomb.openFirewall = true;
+       </programlisting>
+     </para>
+   </listitem>
    <listitem>
      <para>
        xfsprogs was update from 4.19 to 5.11. It now enables reflink support by default on filesystem creation.
@@ -427,7 +434,7 @@
     </para>
     <programlisting>
       TMPDIR=$(mktemp -d)
-      slaptest -f /path/to/slapd.conf $TMPDIR
+      slaptest -f /path/to/slapd.conf -F $TMPDIR
       slapcat -F $TMPDIR -n0 -H 'ldap:///???(!(objectClass=olcSchemaConfig))'
     </programlisting>
     <para>
@@ -572,7 +579,7 @@ http://some.json-exporter.host:7979/probe?target=https://example.com/some/json/e
        <programlisting>
 self: super:
 {
- mpi = super.mpich;
+  mpi = super.mpich;
 }
        </programlisting>
      </para>
@@ -776,6 +783,16 @@ environment.systemPackages = [
      the deprecated <option>services.radicale.config</option> is used.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     In the <option>security.acme</option> module, use of <literal>--reuse-key</literal>
+     parameter  for Lego has been removed. It was introduced for HKPK, but this security
+     feature is now deprecated. It is a better security practice to rotate key pairs
+     instead of always keeping the same. If you need to keep this parameter, you can add
+     it back using <literal>extraLegoRenewFlags</literal> as an option for the
+     appropriate certificate.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 
@@ -795,6 +812,85 @@ environment.systemPackages = [
      for details.
     </para>
    </listitem>
+
+   <listitem>
+    <para>
+     <link xlink:href="https://www.gnuradio.org/">GNURadio</link> has a
+     <code>pkgs</code> attribute set, and there's a <code>gnuradio.callPackage</code>
+     function that extends <code>pkgs</code> with a <code>mkDerivation</code>, and a
+     <code>mkDerivationWith</code>, like Qt5. Now all <code>gnuradio.pkgs</code> are
+     defined with <code>gnuradio.callPackage</code> and some packages that depend
+     on gnuradio are defined with this as well.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <link xlink:href="https://www.privoxy.org/">Privoxy</link> has been updated
+     to version 3.0.32 (See <link xlink:href="https://lists.privoxy.org/pipermail/privoxy-announce/2021-February/000007.html">announcement</link>).
+     Compared to the previous release, Privoxy has gained support for HTTPS
+     inspection (still experimental), Brotli decompression, several new filters
+     and lots of bug fixes, including security ones. In addition, the package
+     is now built with compression and external filters support, which were
+     previously disabled.
+    </para>
+    <para>
+     Regarding the NixOS module, new options for HTTPS inspection have been added
+     and <option>services.privoxy.extraConfig</option> has been replaced by the new
+     <xref linkend="opt-services.privoxy.settings"/>
+     (See <link xlink:href="https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md">RFC 0042</link>
+     for the motivation).
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <link xlink:href="https://kodi.tv/">Kodi</link> has been updated to version 19.1 "Matrix". See
+     the <link xlink:href="https://kodi.tv/article/kodi-190-matrix-release">announcement</link> for
+     further details.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     The <option>services.packagekit.backend</option> option has been removed as
+     it only supported a single setting which would always be the default.
+     Instead new <link
+     xlink:href="https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md">RFC
+     0042</link> compliant <xref linkend="opt-services.packagekit.settings"/>
+     and <xref linkend="opt-services.packagekit.vendorSettings"/> options have
+     been introduced.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+      <link xlink:href="https://nginx.org">Nginx</link> has been updated to stable version 1.20.0.
+      Now nginx uses the zlib-ng library by default.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     KDE Gear (formerly KDE Applications) is upgraded to 21.04, see its
+     <link xlink:href="https://kde.org/announcements/gear/21.04/">release
+     notes</link> for details.
+    </para>
+    <para>
+     The <code>kdeApplications</code> package set is now <code>kdeGear</code>,
+     in keeping with the new name. The old name remains for compatibility, but
+     it is deprecated.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <link xlink:href="https://libreswan.org/">Libreswan</link> has been updated
+     to version 4.4. The package now includes example configurations and manual
+     pages by default. The NixOS module has been changed to use the upstream
+     systemd units and write the configuration in the <literal>/etc/ipsec.d/
+     </literal> directory. In addition, two new options have been added to
+     specify connection policies
+     (<xref linkend="opt-services.libreswan.policies"/>)
+     and disable send/receive redirects
+     (<xref linkend="opt-services.libreswan.disableRedirects"/>).
+    </para>
+   </listitem>
+
    <listitem>
     <para>
      The Mailman NixOS module (<literal>services.mailman</literal>) has a new
@@ -835,6 +931,29 @@ environment.systemPackages = [
      All services should use <xref linkend="opt-systemd.services._name_.startLimitIntervalSec" /> or <literal>StartLimitIntervalSec</literal> in <xref linkend="opt-systemd.services._name_.unitConfig" /> instead.
     </para>
    </listitem>
+   <listitem>
+     <para>
+       The <literal>mediatomb</literal> service
+       declares new options. It also adapts existing options so the
+       configuration generation is now lazy. The existing option
+       <literal>customCfg</literal> (defaults to false), when enabled, stops
+       the service configuration generation completely. It then expects the
+       users to provide their own correct configuration at the right location
+       (whereas the configuration was generated and not used at all before).
+       The new option <literal>transcodingOption</literal> (defaults to no)
+       allows a generated configuration. It makes the mediatomb service pulls
+       the necessary runtime dependencies in the nix store (whereas it was
+       generated with hardcoded values before). The new option
+       <literal>mediaDirectories</literal> allows the users to declare autoscan
+       media directories from their nixos configuration:
+       <programlisting>
+       services.mediatomb.mediaDirectories = [
+         { path = "/var/lib/mediatomb/pictures"; recursive = false; hidden-files = false; }
+         { path = "/var/lib/mediatomb/audio"; recursive = true; hidden-files = false; }
+       ];
+       </programlisting>
+     </para>
+   </listitem>
    <listitem>
     <para>
      The Unbound DNS resolver service (<literal>services.unbound</literal>) has been refactored to allow reloading, control sockets and to fix startup ordering issues.
@@ -933,7 +1052,8 @@ environment.systemPackages = [
      PulseAudio was upgraded to 14.0, with changes to the handling of default sinks.
      See its <link xlink:href="https://www.freedesktop.org/wiki/Software/PulseAudio/Notes/14.0/">release notes</link>.
     </para>
-
+   </listitem>
+   <listitem>
     <para>
      GNOME users may wish to delete their <literal>~/.config/pulse</literal> due to the changes to stream routing
      logic. See <link xlink:href="https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/issues/832">PulseAudio bug 832</link>

nixos/doc/manual/release-notes/rl-2111.section.md

@@ -1,5 +0,0 @@
-# Release 21.11 (“?”, 2021.11/??) {#release-21.11}
-
-In addition to numerous new and upgraded packages, this release has the following highlights:
-
-* Support is planned until the end of April 2022, handing over to 22.05.

nixos/modules/misc/version.nix

@@ -76,7 +76,7 @@ in
     defaultChannel = mkOption {
       internal = true;
       type = types.str;
-      default = "https://nixos.org/channels/nixos-unstable";
+      default = "https://nixos.org/channels/nixos-21.05";
       description = "Default NixOS channel to which the root user is subscribed.";
     };
 

nixos/modules/module-list.nix

@@ -472,7 +472,6 @@
   ./services/misc/cgminer.nix
   ./services/misc/confd.nix
   ./services/misc/couchpotato.nix
-  ./services/misc/dendrite.nix
   ./services/misc/devmon.nix
   ./services/misc/dictd.nix
   ./services/misc/duckling.nix

nixos/modules/security/acme.nix

@@ -152,7 +152,7 @@ let
     );
     renewOpts = escapeShellArgs (
       commonOpts
-      ++ [ "renew" "--reuse-key" ]
+      ++ [ "renew" ]
       ++ optionals data.ocspMustStaple [ "--must-staple" ]
       ++ data.extraLegoRenewFlags
     );

nixos/modules/services/misc/dendrite.nix

@@ -1,181 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.services.dendrite;
-  settingsFormat = pkgs.formats.yaml { };
-  configurationYaml = settingsFormat.generate "dendrite.yaml" cfg.settings;
-  workingDir = "/var/lib/dendrite";
-in
-{
-  options.services.dendrite = {
-    enable = lib.mkEnableOption "matrix.org dendrite";
-    httpPort = lib.mkOption {
-      type = lib.types.nullOr lib.types.port;
-      default = 8008;
-      description = ''
-        The port to listen for HTTP requests on.
-      '';
-    };
-    httpsPort = lib.mkOption {
-      type = lib.types.nullOr lib.types.port;
-      default = null;
-      description = ''
-        The port to listen for HTTPS requests on.
-      '';
-    };
-    tlsCert = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
-      example = "/var/lib/dendrite/server.cert";
-      default = null;
-      description = ''
-        The path to the TLS certificate.
-
-        <programlisting>
-          nix-shell -p dendrite --command "generate-keys --tls-cert server.crt --tls-key server.key"
-        </programlisting>
-      '';
-    };
-    tlsKey = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
-      example = "/var/lib/dendrite/server.key";
-      default = null;
-      description = ''
-        The path to the TLS key.
-
-        <programlisting>
-          nix-shell -p dendrite --command "generate-keys --tls-cert server.crt --tls-key server.key"
-        </programlisting>
-      '';
-    };
-    environmentFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
-      example = "/var/lib/dendrite/registration_secret";
-      default = null;
-      description = ''
-        Environment file as defined in <citerefentry>
-        <refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum>
-        </citerefentry>.
-        Secrets may be passed to the service without adding them to the world-readable
-        Nix store, by specifying placeholder variables as the option value in Nix and
-        setting these variables accordingly in the environment file. Currently only used
-        for the registration secret to allow secure registration when
-        client_api.registration_disabled is true.
-
-        <programlisting>
-          # snippet of dendrite-related config
-          services.dendrite.settings.client_api.registration_shared_secret = "$REGISTRATION_SHARED_SECRET";
-        </programlisting>
-
-        <programlisting>
-          # content of the environment file
-          REGISTRATION_SHARED_SECRET=verysecretpassword
-        </programlisting>
-
-        Note that this file needs to be available on the host on which
-        <literal>dendrite</literal> is running.
-      '';
-    };
-    settings = lib.mkOption {
-      type = lib.types.submodule {
-        freeformType = settingsFormat.type;
-        options.global = {
-          server_name = lib.mkOption {
-            type = lib.types.str;
-            example = "example.com";
-            description = ''
-              The domain name of the server, with optional explicit port.
-              This is used by remote servers to connect to this server.
-              This is also the last part of your UserID.
-            '';
-          };
-          private_key = lib.mkOption {
-            type = lib.types.path;
-            example = "${workingDir}/matrix_key.pem";
-            description = ''
-              The path to the signing private key file, used to sign
-              requests and events.
-
-              <programlisting>
-                nix-shell -p dendrite --command "generate-keys --private-key matrix_key.pem"
-              </programlisting>
-            '';
-          };
-          trusted_third_party_id_servers = lib.mkOption {
-            type = lib.types.listOf lib.types.str;
-            example = [ "matrix.org" ];
-            default = [ "matrix.org" "vector.im" ];
-            description = ''
-              Lists of domains that the server will trust as identity
-              servers to verify third party identifiers such as phone
-              numbers and email addresses
-            '';
-          };
-        };
-        options.client_api = {
-          registration_disabled = lib.mkOption {
-            type = lib.types.bool;
-            default = true;
-            description = ''
-              Whether to disable user registration to the server
-              without the shared secret.
-            '';
-          };
-        };
-      };
-      default = { };
-      description = ''
-        Configuration for dendrite, see:
-        <link xlink:href="https://github.com/matrix-org/dendrite/blob/master/dendrite-config.yaml"/>
-        for available options with which to populate settings.
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    assertions = [{
-      assertion = cfg.httpsPort != null -> (cfg.tlsCert != null && cfg.tlsKey != null);
-      message = ''
-        If Dendrite is configured to use https, tlsCert and tlsKey must be provided.
-
-        nix-shell -p dendrite --command "generate-keys --tls-cert server.crt --tls-key server.key"
-      '';
-    }];
-
-    systemd.services.dendrite = {
-      description = "Dendrite Matrix homeserver";
-      after = [
-        "network.target"
-      ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        Type = "simple";
-        DynamicUser = true;
-        StateDirectory = "dendrite";
-        WorkingDirectory = workingDir;
-        RuntimeDirectory = "dendrite";
-        RuntimeDirectoryMode = "0700";
-        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
-        ExecStartPre =
-          if (cfg.environmentFile != null) then ''
-            ${pkgs.envsubst}/bin/envsubst \
-              -i ${configurationYaml} \
-              -o /run/dendrite/dendrite.yaml
-          '' else ''
-            ${pkgs.coreutils}/bin/cp ${configurationYaml} /run/dendrite/dendrite.yaml
-          '';
-        ExecStart = lib.strings.concatStringsSep " " ([
-          "${pkgs.dendrite}/bin/dendrite-monolith-server"
-          "--config /run/dendrite/dendrite.yaml"
-        ] ++ lib.optionals (cfg.httpPort != null) [
-          "--http-bind-address :${builtins.toString cfg.httpPort}"
-        ] ++ lib.optionals (cfg.httpsPort != null) [
-          "--https-bind-address :${builtins.toString cfg.httpsPort}"
-          "--tls-cert ${cfg.tlsCert}"
-          "--tls-key ${cfg.tlsKey}"
-        ]);
-        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
-        Restart = "on-failure";
-      };
-    };
-  };
-  meta.maintainers = lib.teams.matrix.members;
-}

nixos/modules/services/misc/nix-daemon.nix

@@ -12,8 +12,6 @@ let
 
   isNix23 = versionAtLeast nixVersion "2.3pre";
 
-  isNix24 = versionAtLeast nixVersion "2.4pre";
-
   makeNixBuildUser = nr: {
     name  = "nixbld${toString nr}";
     value = {
@@ -43,11 +41,7 @@ let
         max-jobs = ${toString (cfg.maxJobs)}
         cores = ${toString (cfg.buildCores)}
         sandbox = ${if (builtins.isBool cfg.useSandbox) then boolToString cfg.useSandbox else cfg.useSandbox}
-        ${if isNix24 then ''
-          sandbox-paths = ${toString cfg.sandboxPaths}
-        '' else ''
-          extra-sandbox-paths = ${toString cfg.sandboxPaths}
-        ''}
+        extra-sandbox-paths = ${toString cfg.sandboxPaths}
         substituters = ${toString cfg.binaryCaches}
         trusted-substituters = ${toString cfg.trustedBinaryCaches}
         trusted-public-keys = ${toString cfg.binaryCachePublicKeys}

nixos/modules/services/networking/kresd.nix

@@ -115,6 +115,8 @@ in {
   config = mkIf cfg.enable {
     environment.etc."knot-resolver/kresd.conf".source = configFile; # not required
 
+    networking.resolvconf.useLocalResolver = mkDefault true;
+
     users.users.knot-resolver =
       { isSystemUser = true;
         group = "knot-resolver";

nixos/modules/services/networking/wireguard.nix

@@ -219,17 +219,6 @@ let
 
   };
 
-  generatePathUnit = name: values:
-    assert (values.privateKey == null);
-    assert (values.privateKeyFile != null);
-    nameValuePair "wireguard-${name}"
-      {
-        description = "WireGuard Tunnel - ${name} - Private Key";
-        requiredBy = [ "wireguard-${name}.service" ];
-        before = [ "wireguard-${name}.service" ];
-        pathConfig.PathExists = values.privateKeyFile;
-      };
-
   generateKeyServiceUnit = name: values:
     assert values.generatePrivateKeyFile;
     nameValuePair "wireguard-${name}-key"
@@ -448,9 +437,6 @@ in
       // (mapAttrs' generateKeyServiceUnit
       (filterAttrs (name: value: value.generatePrivateKeyFile) cfg.interfaces));
 
-    systemd.paths = mapAttrs' generatePathUnit
-      (filterAttrs (name: value: value.privateKeyFile != null) cfg.interfaces);
-
   });
 
 }

nixos/modules/services/security/bitwarden_rs/default.nix

@@ -121,7 +121,6 @@ in {
         EnvironmentFile = [ configFile ] ++ optional (cfg.environmentFile != null) cfg.environmentFile;
         ExecStart = "${bitwarden_rs}/bin/bitwarden_rs";
         LimitNOFILE = "1048576";
-        LimitNPROC = "64";
         PrivateTmp = "true";
         PrivateDevices = "true";
         ProtectHome = "true";

nixos/modules/services/web-apps/discourse.nix

@@ -5,11 +5,16 @@ let
 
   cfg = config.services.discourse;
 
+  # Keep in sync with https://github.com/discourse/discourse_docker/blob/master/image/base/Dockerfile#L5
+  upstreamPostgresqlVersion = lib.getVersion pkgs.postgresql_13;
+
   postgresqlPackage = if config.services.postgresql.enable then
                         config.services.postgresql.package
                       else
                         pkgs.postgresql;
 
+  postgresqlVersion = lib.getVersion postgresqlPackage;
+
   # We only want to create a database if we're actually going to connect to it.
   databaseActuallyCreateLocally = cfg.database.createLocally && cfg.database.host == null;
 
@@ -263,6 +268,17 @@ in
             Discourse database user.
           '';
         };
+
+        ignorePostgresqlVersion = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+          description = ''
+            Whether to allow other versions of PostgreSQL than the
+            recommended one. Only effective when
+            <option>services.discourse.database.createLocally</option>
+            is enabled.
+          '';
+        };
       };
 
       redis = {
@@ -398,6 +414,14 @@ in
               How OpenSSL checks the certificate, see http://api.rubyonrails.org/classes/ActionMailer/Base.html
             '';
           };
+
+          forceTLS = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            description = ''
+              Force implicit TLS as per RFC 8314 3.3.
+            '';
+          };
         };
 
         incoming = {
@@ -497,6 +521,12 @@ in
         assertion = cfg.hostname != "";
         message = "Could not automatically determine hostname, set service.discourse.hostname manually.";
       }
+      {
+        assertion = cfg.database.ignorePostgresqlVersion || (databaseActuallyCreateLocally -> upstreamPostgresqlVersion == postgresqlVersion);
+        message = "The PostgreSQL version recommended for use with Discourse is ${upstreamPostgresqlVersion}, you're using ${postgresqlVersion}. "
+                  + "Either update your PostgreSQL package to the correct version or set services.discourse.database.ignorePostgresqlVersion. "
+                  + "See https://nixos.org/manual/nixos/stable/index.html#module-postgresql for details on how to upgrade PostgreSQL.";
+      }
     ];
 
 
@@ -530,6 +560,7 @@ in
       smtp_authentication = cfg.mail.outgoing.authentication;
       smtp_enable_start_tls = cfg.mail.outgoing.enableStartTLSAuto;
       smtp_openssl_verify_mode = cfg.mail.outgoing.opensslVerifyMode;
+      smtp_force_tls = cfg.mail.outgoing.forceTLS;
 
       load_mini_profiler = true;
       mini_profiler_snapshots_period = 0;
@@ -542,8 +573,8 @@ in
 
       redis_host = cfg.redis.host;
       redis_port = 6379;
-      redis_slave_host = null;
-      redis_slave_port = 6379;
+      redis_replica_host = null;
+      redis_replica_port = 6379;
       redis_db = cfg.redis.dbNumber;
       redis_password = cfg.redis.passwordFile;
       redis_skip_client_commands = false;
@@ -552,8 +583,8 @@ in
       message_bus_redis_enabled = false;
       message_bus_redis_host = "localhost";
       message_bus_redis_port = 6379;
-      message_bus_redis_slave_host = null;
-      message_bus_redis_slave_port = 6379;
+      message_bus_redis_replica_host = null;
+      message_bus_redis_replica_port = 6379;
       message_bus_redis_db = 0;
       message_bus_redis_password = null;
       message_bus_redis_skip_client_commands = false;
@@ -606,6 +637,7 @@ in
       allowed_theme_repos = null;
       enable_email_sync_demon = false;
       max_digests_enqueued_per_30_mins_per_site = 10000;
+      cluster_name = null;
     };
 
     services.redis.enable = lib.mkDefault (cfg.redis.host == "localhost");
@@ -667,6 +699,7 @@ in
       environment = cfg.package.runtimeEnv // {
         UNICORN_TIMEOUT = builtins.toString cfg.unicornTimeout;
         UNICORN_SIDEKIQS = builtins.toString cfg.sidekiqProcesses;
+        MALLOC_ARENA_MAX = "2";
       };
 
       preStart =

nixos/modules/services/web-apps/wordpress.nix

@@ -61,8 +61,10 @@ let
     ?>
   '';
 
-  secretsVars = [ "AUTH_KEY" "SECURE_AUTH_KEY" "LOOGGED_IN_KEY" "NONCE_KEY" "AUTH_SALT" "SECURE_AUTH_SALT" "LOGGED_IN_SALT" "NONCE_SALT" ];
+  secretsVars = [ "AUTH_KEY" "SECURE_AUTH_KEY" "LOGGED_IN_KEY" "NONCE_KEY" "AUTH_SALT" "SECURE_AUTH_SALT" "LOGGED_IN_SALT" "NONCE_SALT" ];
   secretsScript = hostStateDir: ''
+    # The match in this line is not a typo, see https://github.com/NixOS/nixpkgs/pull/124839
+    grep -q "LOOGGED_IN_KEY" "${hostStateDir}/secret-keys.php" && rm "${hostStateDir}/secret-keys.php"
     if ! test -e "${hostStateDir}/secret-keys.php"; then
       umask 0177
       echo "<?php" >> "${hostStateDir}/secret-keys.php"

nixos/modules/tasks/filesystems.nix

@@ -321,6 +321,7 @@ in
             RemainAfterExit = true;
           };
           unitConfig = {
+            ConditionPathIsMountPoint = "!/sys/fs/pstore";
             ConditionVirtualization = "!container";
             DefaultDependencies = false; # needed to prevent a cycle
           };

nixos/modules/virtualisation/libvirtd.nix

@@ -159,7 +159,7 @@ in {
       etc."qemu/bridge.conf".text = lib.concatMapStringsSep "\n" (e:
         "allow ${e}") cfg.allowedBridges;
       systemPackages = with pkgs; [ libressl.nc iptables cfg.package cfg.qemuPackage ];
-      etc.ethertypes.source = "${pkgs.iptables}/etc/ethertypes";
+      etc.ethertypes.source = "${pkgs.ebtables}/etc/ethertypes";
     };
 
     boot.kernelModules = [ "tun" ];

nixos/release.nix

@@ -12,7 +12,7 @@ let
 
   version = fileContents ../.version;
   versionSuffix =
-    (if stableBranch then "." else "pre") + "${toString nixpkgs.revCount}.${nixpkgs.shortRev}";
+    (if stableBranch then "." else "beta") + "${toString (nixpkgs.revCount - 291486)}.${nixpkgs.shortRev}";
 
   # Run the tests for each platform.  You can run a test by doing
   # e.g. ‘nix-build -A tests.login.x86_64-linux’, or equivalently,

nixos/tests/all-tests.nix

@@ -53,7 +53,7 @@ in
   caddy = handleTest ./caddy.nix {};
   cadvisor = handleTestOn ["x86_64-linux"] ./cadvisor.nix {};
   cage = handleTestOn ["x86_64-linux"] ./cage.nix {};
-  cagebreak = handleTest ./cagebreak.nix {};
+  cagebreak = handleTestOn ["x86_64-linux"] ./cagebreak.nix {};
   calibre-web = handleTest ./calibre-web.nix {};
   cassandra_2_1 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_2_1; };
   cassandra_2_2 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_2_2; };
@@ -93,7 +93,6 @@ in
   custom-ca = handleTest ./custom-ca.nix {};
   croc = handleTest ./croc.nix {};
   deluge = handleTest ./deluge.nix {};
-  dendrite = handleTest ./dendrite.nix {};
   dhparams = handleTest ./dhparams.nix {};
   discourse = handleTest ./discourse.nix {};
   dnscrypt-proxy2 = handleTestOn ["x86_64-linux"] ./dnscrypt-proxy2.nix {};
@@ -395,7 +394,7 @@ in
   sssd-ldap = handleTestOn ["x86_64-linux"] ./sssd-ldap.nix {};
   strongswan-swanctl = handleTest ./strongswan-swanctl.nix {};
   sudo = handleTest ./sudo.nix {};
-  sway = handleTest ./sway.nix {};
+  sway = handleTestOn ["x86_64-linux"] ./sway.nix {};
   switchTest = handleTest ./switch-test.nix {};
   sympa = handleTest ./sympa.nix {};
   syncthing = handleTest ./syncthing.nix {};

nixos/tests/dendrite.nix

@@ -1,99 +0,0 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-    let
-      homeserverUrl = "http://homeserver:8008";
-
-      private_key = pkgs.runCommand "matrix_key.pem" {
-        buildInputs = [ pkgs.dendrite ];
-      } "generate-keys --private-key $out";
-    in
-      {
-        name = "dendrite";
-        meta = with pkgs.lib; {
-          maintainers = teams.matrix.members;
-        };
-
-        nodes = {
-          homeserver = { pkgs, ... }: {
-            services.dendrite = {
-              enable = true;
-              settings = {
-                global.server_name = "test-dendrite-server.com";
-                global.private_key = private_key;
-                client_api.registration_disabled = false;
-              };
-            };
-
-            networking.firewall.allowedTCPPorts = [ 8008 ];
-          };
-
-          client = { pkgs, ... }: {
-            environment.systemPackages = [
-              (
-                pkgs.writers.writePython3Bin "do_test"
-                  { libraries = [ pkgs.python3Packages.matrix-nio ]; } ''
-                  import asyncio
-
-                  from nio import AsyncClient
-
-
-                  async def main() -> None:
-                      # Connect to dendrite
-                      client = AsyncClient("http://homeserver:8008", "alice")
-
-                      # Register as user alice
-                      response = await client.register("alice", "my-secret-password")
-
-                      # Log in as user alice
-                      response = await client.login("my-secret-password")
-
-                      # Create a new room
-                      response = await client.room_create(federate=False)
-                      room_id = response.room_id
-
-                      # Join the room
-                      response = await client.join(room_id)
-
-                      # Send a message to the room
-                      response = await client.room_send(
-                          room_id=room_id,
-                          message_type="m.room.message",
-                          content={
-                              "msgtype": "m.text",
-                              "body": "Hello world!"
-                          }
-                      )
-
-                      # Sync responses
-                      response = await client.sync(timeout=30000)
-
-                      # Check the message was received by dendrite
-                      last_message = response.rooms.join[room_id].timeline.events[-1].body
-                      assert last_message == "Hello world!"
-
-                      # Leave the room
-                      response = await client.room_leave(room_id)
-
-                      # Close the client
-                      await client.close()
-
-                  asyncio.get_event_loop().run_until_complete(main())
-                ''
-              )
-            ];
-          };
-        };
-
-        testScript = ''
-          start_all()
-
-          with subtest("start the homeserver"):
-              homeserver.wait_for_unit("dendrite.service")
-              homeserver.wait_for_open_port(8008)
-
-          with subtest("ensure messages can be exchanged"):
-              client.succeed("do_test")
-        '';
-
-      }
-)

nixos/tests/discourse.nix

@@ -51,6 +51,8 @@ import ./make-test-python.nix (
 
         environment.systemPackages = [ pkgs.jq ];
 
+        services.postgresql.package = pkgs.postgresql_13;
+
         services.discourse = {
           enable = true;
           inherit admin;

pkgs/applications/audio/bjumblr/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "BJumblr";
-  version = "1.4.2";
+  version = "1.6.6";
 
   src = fetchFromGitHub {
     owner = "sjaehn";
     repo = pname;
     rev = version;
-    sha256 = "0kl6hrxmqrdf0195bfnzsa2h1073fgiqrfhg2276fm1954sm994v";
+    sha256 = "1nbxi54023vck3qgmr385cjzinmdnvz62ywb6bcksmc3shl080mg";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/applications/audio/goattracker/default.nix

@@ -27,16 +27,16 @@ let
 in stdenv.mkDerivation rec {
   inherit pname;
   version = if isStereo
-    then "2.76"  # stereo
-    else "2.75"; # normal
+    then "2.77"  # stereo
+    else "2.76"; # normal
 
   src = fetchurl {
     url = "mirror://sourceforge/goattracker2/GoatTracker_${version}${optionalString isStereo "_Stereo"}.zip";
     sha256 = if isStereo
-      then "12cz3780x5k047jqdv69n6rjgbfiwv67z850kfl4i37lxja432l7"  # stereo
-      else "1km97nl7qvk6qc5l5j69wncbm76hf86j47sgzgr968423g0bxxlk"; # normal
+      then "1hiig2d152sv9kazwz33i56x1c54h5sh21ipkqnp6qlnwj8x1ksy"  # stereo
+      else "0d7a3han4jw4bwiba3j87racswaajgl3pj4sb5lawdqdxicv3dn1"; # normal
   };
-  sourceRoot = (if isStereo then "gt2stereo/trunk" else "goattrk2") + "/src";
+  sourceRoot = "src";
 
   nativeBuildInputs = [ copyDesktopItems unzip imagemagick ];
   buildInputs = [ SDL ];

pkgs/applications/audio/gxplugins-lv2/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "GxPlugins.lv2";
-  version = "0.8";
+  version = "0.9";
 
   src = fetchFromGitHub {
     owner = "brummer10";
     repo = pname;
     rev = "v${version}";
-    sha256 = "11iv7bwvvspm74pisqvcpsxpg9xi6b08hq4i8q67mri4mvy9hmal";
+    sha256 = "02fksl8wr443ygwgcd1c2zab8kp67a6ps12k71ysqx7szv4zq877";
     fetchSubmodules = true;
   };
 
@@ -29,6 +29,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/brummer10/GxPlugins.lv2";
     description = "A set of extra lv2 plugins from the guitarix project";
     maintainers = [ maintainers.magnetophon ];
-    license = licenses.gpl3;
+    license = licenses.gpl3Plus;
   };
 }

pkgs/applications/audio/schismtracker/default.nix

@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "1n6cgjiw3vkv7a1h1nki5syyjxjb6icknr9s049w2jrag10bxssn";
   };
 
-  configureFlags = [ "--enable-dependency-tracking" ];
+  configureFlags = [ "--enable-dependency-tracking" ]
+    ++ lib.optional stdenv.isDarwin "--disable-sdltest";
 
   nativeBuildInputs = [ autoreconfHook python ];
 

pkgs/applications/audio/whipper/default.nix

@@ -1,7 +1,17 @@
-{ lib, fetchFromGitHub, python3, cdparanoia, cdrdao, flac
-, sox, accuraterip-checksum, libsndfile, util-linux, substituteAll }:
+{ lib
+, python3
+, fetchFromGitHub
+, libcdio-paranoia
+, cdrdao
+, libsndfile
+, flac
+, sox
+, util-linux
+}:
 
-python3.pkgs.buildPythonApplication rec {
+let
+  bins = [ libcdio-paranoia cdrdao flac sox util-linux ];
+in python3.pkgs.buildPythonApplication rec {
   pname = "whipper";
   version = "0.10.0";
 
@@ -12,44 +22,43 @@ python3.pkgs.buildPythonApplication rec {
     sha256 = "00cq03cy5dyghmibsdsq5sdqv3bzkzhshsng74bpnb5lasxp3ia5";
   };
 
-  pythonPath = with python3.pkgs; [
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools_scm
+    docutils
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
     musicbrainzngs
     mutagen
     pycdio
     pygobject3
-    requests
     ruamel_yaml
-    setuptools
-    setuptools_scm
+    discid
+    pillow
   ];
 
   buildInputs = [ libsndfile ];
 
   checkInputs = with python3.pkgs; [
     twisted
-  ];
-
-  patches = [
-    (substituteAll {
-      src = ./paths.patch;
-      inherit cdparanoia;
-    })
-  ];
+  ] ++ bins;
 
   makeWrapperArgs = [
-    "--prefix" "PATH" ":" (lib.makeBinPath [ accuraterip-checksum cdrdao util-linux flac sox ])
+    "--prefix" "PATH" ":" (lib.makeBinPath bins)
   ];
 
   preBuild = ''
     export SETUPTOOLS_SCM_PRETEND_VERSION="${version}"
   '';
 
-  # some tests require internet access
-  # https://github.com/JoeLametta/whipper/issues/291
-  doCheck = false;
-
-  preCheck = ''
-    HOME=$TMPDIR
+  checkPhase = ''
+    runHook preCheck
+    # disable tests that require internet access
+    # https://github.com/JoeLametta/whipper/issues/291
+    substituteInPlace whipper/test/test_common_accurip.py \
+      --replace "test_AccurateRipResponse" "dont_test_AccurateRipResponse"
+    HOME=$TMPDIR ${python3.interpreter} -m unittest discover
+    runHook postCheck
   '';
 
   meta = with lib; {

pkgs/applications/audio/whipper/paths.patch

@@ -1,32 +0,0 @@
---- a/whipper/program/cdparanoia.py
-+++ b/whipper/program/cdparanoia.py
-@@ -280,10 +280,10 @@
- 
-         bufsize = 1024
-         if self._overread:
--            argv = ["cd-paranoia", "--stderr-progress",
-+            argv = ["@cdparanoia@/bin/cdparanoia", "--stderr-progress",
-                     "--sample-offset=%d" % self._offset, "--force-overread", ]
-         else:
--            argv = ["cd-paranoia", "--stderr-progress",
-+            argv = ["@cdparanoia@/bin/cdparanoia", "--stderr-progress",
-                     "--sample-offset=%d" % self._offset, ]
-         if self._device:
-             argv.extend(["--force-cdrom-device", self._device, ])
-@@ -560,7 +560,7 @@
- 
- def getCdParanoiaVersion():
-     getter = common.VersionGetter('cd-paranoia',
--                                  ["cd-paranoia", "-V"],
-+                                  ["@cdparanoia@/bin/cdparanoia", "-V"],
-                                   _VERSION_RE,
-                                   "%(version)s %(release)s")
- 
-@@ -585,7 +585,7 @@
-     def __init__(self, device=None):
-         # cdparanoia -A *always* writes cdparanoia.log
-         self.cwd = tempfile.mkdtemp(suffix='.whipper.cache')
--        self.command = ['cd-paranoia', '-A']
-+        self.command = ['@cdparanoia@/bin/cdparanoia', '-A']
-         if device:
-             self.command += ['-d', device]

pkgs/applications/backup/pika-backup/default.nix

@@ -19,20 +19,20 @@
 
 stdenv.mkDerivation rec {
   pname = "pika-backup";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "pika-backup";
     rev = "v${version}";
-    sha256 = "0cr3axfp15nzwmsqyz6j781qhr2gsn9p69m0jfzy89pl83d6vcz0";
+    sha256 = "sha256-dKVyvB4s1MZHri0dFJDBUXQKsi2KgP30ZhsJ486M+og=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    sha256 = "1z0cbrkhxyzwf7vjjsvdppb7zhflpkw4m5cy90a2315nbll3hpbp";
+    sha256 = "1vsh8vqgmfady82d7wfxkknmrp7mq7nizpif2zwg3kqbl964mp3y";
   };
 
   patches = [

pkgs/applications/blockchains/stellar-core-dirty-version.patch

@@ -1,15 +0,0 @@
-Subject: Prevent "-dirty" from being erroneously added to the version
-
-diff --git a/src/Makefile.am b/src/Makefile.am
-index d36d1a3..00048fc 100644
---- a/src/Makefile.am
-+++ b/src/Makefile.am
-@@ -28,7 +28,7 @@ always:
- # Always rebuild because .git/HEAD is a symbolic ref one can't depend on
- StellarCoreVersion.h: always
- 	@vers=$$(cd "$(srcdir)" \
--		&& git describe --always --dirty --tags 2>/dev/null \
-+		&& git describe --always --tags 2>/dev/null \
- 		|| echo "$(PACKAGE) $(VERSION)"); \
- 	    echo "#define STELLAR_CORE_VERSION \"$$vers\"" > $@~
- 	@if cmp -s $@~ $@; then rm -f $@~; else \

pkgs/applications/blockchains/stellar-core.nix

@@ -1,31 +1,30 @@
-{ lib, stdenv, fetchgit, autoconf, libtool, automake, pkg-config, git
-, bison, flex, postgresql }:
+{ lib, stdenv, fetchFromGitHub, autoconf, libtool, automake, pkg-config, git
+, bison, flex, postgresql, ripgrep }:
 
-let
+stdenv.mkDerivation rec {
   pname = "stellar-core";
-  version = "0.5.1";
+  version = "17.0.0";
 
-in stdenv.mkDerivation {
-  name = "${pname}-${version}";
-
-  src = fetchgit {
-    url = "https://github.com/stellar/stellar-core.git";
-    rev = "refs/tags/v${version}";
-    sha256 = "0ldw3qr0sajgam38z2w2iym0214ial6iahbzx3b965cw92n8n88z";
+  src = fetchFromGitHub {
+    owner = "stellar";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1ngl8yjqb8xzhdwzlxzzxf14q2hgwy2ysb17sn5380rrn0jswin1";
     fetchSubmodules = true;
-    leaveDotGit = true;
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ autoconf automake libtool git ];
+  nativeBuildInputs = [ automake autoconf git libtool pkg-config ripgrep ];
 
   propagatedBuildInputs = [ bison flex postgresql ];
 
-  patches = [ ./stellar-core-dirty-version.patch ];
-
   preConfigure = ''
+    # Due to https://github.com/NixOS/nixpkgs/issues/8567 we cannot rely on
+    # having the .git directory present, so directly provide the version
+    substituteInPlace src/Makefile.am --replace '$$vers' '${pname} ${version}';
+
     # Everything needs to be staged in git because the build uses
     # `git ls-files` to search for source files to compile.
+    git init
     git add .
 
     ./autogen.sh

pkgs/applications/editors/neovim/neovide/default.nix

@@ -66,7 +66,7 @@ rustPlatform.buildRustPackage rec {
 
   SKIA_OFFLINE_NINJA_COMMAND = "${ninja}/bin/ninja";
   SKIA_OFFLINE_GN_COMMAND = "${gn}/bin/gn";
-  LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
+  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
 
   # test needs a valid fontconfig file
   FONTCONFIG_FILE = makeFontsConf { fontDirectories = [ ]; };

pkgs/applications/graphics/ImageMagick/7.0.nix

@@ -18,13 +18,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "imagemagick";
-  version = "7.0.11-9";
+  version = "7.0.11-13";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = version;
-    sha256 = "sha256-eL9zFrgkLb3pS8/UlQB5+p50UG8j3Q7TNDwcO/3BuXo=";
+    sha256 = "sha256-6dYc636m1OeRqIPv5NFz/K8OUvl6sgEQKjfvTngR2Ms=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big

pkgs/applications/misc/girara/default.nix

@@ -12,9 +12,10 @@ stdenv.mkDerivation rec {
     sha256 = "1n3i960b458172mc3pkq7m9dn5qxry6fms3c3k06v27cjp5whsyf";
   };
 
-  nativeBuildInputs = [ meson ninja pkg-config gettext check dbus xvfb-run ];
+  nativeBuildInputs = [ meson ninja pkg-config gettext check dbus ];
   buildInputs = [ libintl libiconv json_c ];
   propagatedBuildInputs = [ glib gtk ];
+  checkInputs = [ xvfb-run ];
 
   doCheck = !stdenv.isDarwin;
 

pkgs/applications/misc/tellico/default.nix

@@ -24,15 +24,15 @@
 
 mkDerivation rec {
   pname = "tellico";
-  version = "3.4";
+  version = "3.4.1";
 
   src = fetchurl {
-    # version 3.3.0 just uses 3.3 in its name
+    # version 3.3.0 just uses 3.3 in its file name
     urls = [
       "https://tellico-project.org/files/tellico-${version}.tar.xz"
       "https://tellico-project.org/files/tellico-${lib.versions.majorMinor version}.tar.xz"
     ];
-    sha256 = "sha256-YXMJrAkfehe3ox4WZ19igyFbXwtjO5wxN3bmgP01jPs=";
+    sha256 = "sha256-+FFN6sO0mvlage8JazyrqNZk4onejz1XJPiOK3gnhWE=";
   };
 
   nativeBuildInputs = [
@@ -63,7 +63,7 @@ mkDerivation rec {
   meta = with lib; {
     description = "Collection management software, free and simple";
     homepage = "https://tellico-project.org/";
-    license = with licenses; [ gpl2 gpl3 ];
+    license = with licenses; [ gpl2Only gpl3Only lgpl2Only ];
     maintainers = with maintainers; [ numkem ];
     platforms = platforms.linux;
   };

pkgs/applications/networking/browsers/chromium/common.nix

@@ -165,14 +165,10 @@ let
       ./patches/widevine-79.patch # For bundling Widevine (DRM), might be replaceable via bundle_widevine_cdm=true in gnFlags
       # Fix the build by adding a missing dependency (s. https://crbug.com/1197837):
       ./patches/fix-missing-atspi2-dependency.patch
-    ] ++ optionals (chromiumVersionAtLeast "91") [
       ./patches/closure_compiler-Use-the-Java-binary-from-the-system.patch
     ];
 
-    postPatch = lib.optionalString (chromiumVersionAtLeast "91") ''
-      # Required for patchShebangs (unsupported):
-      chmod -x third_party/webgpu-cts/src/tools/deno
-    '' + ''
+    postPatch = ''
       # remove unused third-party
       for lib in ${toString gnSystemLibraries}; do
         if [ -d "third_party/$lib" ]; then
@@ -191,6 +187,7 @@ let
         substituteInPlace third_party/harfbuzz-ng/src/src/update-unicode-tables.make \
           --replace "/usr/bin/env -S make -f" "/usr/bin/make -f"
       fi
+      chmod -x third_party/webgpu-cts/src/tools/deno
 
       # We want to be able to specify where the sandbox is via CHROME_DEVEL_SANDBOX
       substituteInPlace sandbox/linux/suid/client/setuid_sandbox_host.cc \

pkgs/applications/networking/browsers/chromium/upstream-info.json

@@ -1,20 +1,20 @@
 {
   "stable": {
-    "version": "90.0.4430.212",
-    "sha256": "17nmhrkl81qqvzbh861k2mmifncx4wg1mv1fmn52f8gzn461vqdb",
-    "sha256bin64": "1y33c5829s22yfj0qmsj8fpcxnjhcm3fsxz7744csfsa9cy4fjr7",
+    "version": "91.0.4472.77",
+    "sha256": "0c8vj3gq3nmb7ssiwj6875g0a8hcprss1a4gqw9h7llqywza9ma5",
+    "sha256bin64": "0caf47xam5igdnbhipal1iyicnxxvadhi61k199rwysrvyv5sdad",
     "deps": {
       "gn": {
-        "version": "2021-02-09",
+        "version": "2021-04-06",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "dfcbc6fed0a8352696f92d67ccad54048ad182b3",
-        "sha256": "1941bzg37c4dpsk3sh6ga3696gpq6vjzpcw9rsnf6kdr9mcgdxvn"
+        "rev": "dba01723a441c358d843a575cb7720d54ddcdf92",
+        "sha256": "199xkks67qrn0xa5fhp24waq2vk8qb78a96cb3kdd8v1hgacgb8x"
       }
     },
     "chromedriver": {
-      "version": "90.0.4430.24",
-      "sha256_linux": "0byibxrs4ggid8qn5h72mmnw8l4y8xya2q1jbc6z74pmw8r9hkj7",
-      "sha256_darwin": "0psll7vahj43jkj1wqq7mygf18l7ivp56ckc8wv4w5bnfmqv660k"
+      "version": "91.0.4472.19",
+      "sha256_linux": "0pg9y55644i87qxa0983lvfizbmfiak9bg9249xhifl5kykghrb2",
+      "sha256_darwin": "07v5k07100vrzsbm6r59xg8j80ffzs3gnnf2kcfgqrzprx284gf2"
     }
   },
   "beta": {
@@ -44,19 +44,19 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "90.0.4430.212",
-    "sha256": "17nmhrkl81qqvzbh861k2mmifncx4wg1mv1fmn52f8gzn461vqdb",
-    "sha256bin64": "1y33c5829s22yfj0qmsj8fpcxnjhcm3fsxz7744csfsa9cy4fjr7",
+    "version": "91.0.4472.77",
+    "sha256": "0c8vj3gq3nmb7ssiwj6875g0a8hcprss1a4gqw9h7llqywza9ma5",
+    "sha256bin64": "0caf47xam5igdnbhipal1iyicnxxvadhi61k199rwysrvyv5sdad",
     "deps": {
       "gn": {
-        "version": "2021-02-09",
+        "version": "2021-04-06",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "dfcbc6fed0a8352696f92d67ccad54048ad182b3",
-        "sha256": "1941bzg37c4dpsk3sh6ga3696gpq6vjzpcw9rsnf6kdr9mcgdxvn"
+        "rev": "dba01723a441c358d843a575cb7720d54ddcdf92",
+        "sha256": "199xkks67qrn0xa5fhp24waq2vk8qb78a96cb3kdd8v1hgacgb8x"
       },
       "ungoogled-patches": {
-        "rev": "90.0.4430.212-1",
-        "sha256": "05jh05a4g50ws7pr18dl5pwi95knygh6xywp7kyydir7wy1pbin8"
+        "rev": "91.0.4472.77-1",
+        "sha256": "1jfmmkw1y4rcjfgsm7b4v2lrgd3sks5qpajvq0djflbhkpsqxfk0"
       }
     }
   }

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -440,10 +440,10 @@
     "owner": "DeterminateSystems",
     "provider-source-address": "registry.terraform.io/DeterminateSystems/hydra",
     "repo": "terraform-provider-hydra",
-    "rev": "v0.1.0",
-    "sha256": "18c9j54fy1f2sfz317rlv8z7fb18bpc1a0baw1bgl72x5sgil5kv",
+    "rev": "v0.1.2",
+    "sha256": "1a1ah5pzng9ik8f18kqx87fdh1c5wqbn2bsbhqrzd1nb8fc5xl03",
     "vendorSha256": null,
-    "version": "0.1.0"
+    "version": "0.1.2"
   },
   "ibm": {
     "owner": "IBM-Cloud",

pkgs/applications/networking/cluster/tilt/default.nix

@@ -5,13 +5,13 @@ buildGoModule rec {
   /* Do not use "dev" as a version. If you do, Tilt will consider itself
     running in development environment and try to serve assets from the
     source tree, which is not there once build completes.  */
-  version = "0.18.10";
+  version = "0.20.5";
 
   src = fetchFromGitHub {
     owner  = "tilt-dev";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "sha256-SvvvHGR3UPyV61MaoFB68SaZKUT3ItYOPT1a7AddxlY=";
+    sha256 = "sha256-pUKKHrShED7yp5WSmHSbS+eiYs22Nm2/ouc2a8WYc38=";
   };
   vendorSha256 = null;
 

pkgs/applications/networking/feedreaders/newsflash/default.nix

@@ -35,6 +35,12 @@ stdenv.mkDerivation rec {
     hash = "sha256-qq8cZplt5YWUwsXUShMDhQm3RGH2kCEBk64x6bOa50E=";
   };
 
+  # https://github.com/CasualX/obfstr/blob/v0.2.4/build.rs#L5
+  # obfstr 0.2.4 fails to set RUSTC_BOOTSTRAP in its build script because cargo
+  # build scripts are forbidden from setting RUSTC_BOOTSTRAP since rustc 1.52.0
+  # https://github.com/rust-lang/rust/blob/1.52.0/RELEASES.md#compatibility-notes
+  RUSTC_BOOTSTRAP = 1;
+
   patches = [
     # Post install tries to generate an icon cache & update the
     # desktop database. The gtk setup hook drop-icon-theme-cache.sh

pkgs/applications/networking/instant-messengers/element/element-desktop-package.json

@@ -2,7 +2,7 @@
   "name": "element-desktop",
   "productName": "Element",
   "main": "src/electron-main.js",
-  "version": "1.7.28",
+  "version": "1.7.29",
   "description": "A feature-rich client for Matrix.org",
   "author": "Element",
   "repository": {

pkgs/applications/networking/instant-messengers/element/element-desktop.nix

@@ -8,12 +8,12 @@
 
 let
   executableName = "element-desktop";
-  version = "1.7.28";
+  version = "1.7.29";
   src = fetchFromGitHub {
     owner = "vector-im";
     repo = "element-desktop";
     rev = "v${version}";
-    sha256 = "0p88gw1y37q35qqf94w3qlb84s2shm41n1pw5fgx0c0ymlzpl636";
+    sha256 = "sha256-nCtgVVOdjZ/OK8gMInBbNeuJadchDYUO2UQxEmcOm4s=";
   };
 in mkYarnPackage rec {
   name = "element-desktop-${version}";
@@ -45,8 +45,7 @@ in mkYarnPackage rec {
 
     # executable wrapper
     makeWrapper '${electron}/bin/electron' "$out/bin/${executableName}" \
-      --add-flags "$out/share/element/electron" \
-      --set-default MOZ_DBUS_REMOTE 1
+      --add-flags "$out/share/element/electron"
   '';
 
   # Do not attempt generating a tarball for element-web again.

pkgs/applications/networking/instant-messengers/element/element-web.nix

@@ -12,11 +12,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "element-web";
-  version = "1.7.28";
+  version = "1.7.29";
 
   src = fetchurl {
     url = "https://github.com/vector-im/element-web/releases/download/v${version}/element-v${version}.tar.gz";
-    sha256 = "1adlpwq37yzmd3fq1pzbi476p4kr5hn5b5kwyd6cr5by0gsgkgyk";
+    sha256 = "sha256-wFC0B9v0V3JK9sLKH7GviVO/JEjePOJ06PwRq/MVqDE=";
   };
 
   installPhase = ''

pkgs/applications/networking/instant-messengers/signal-desktop/db-reencryption-wrapper.py

@@ -1,92 +0,0 @@
-#!@PYTHON@
-
-import json
-import os
-import re
-import shlex
-import sqlite3
-import subprocess
-import sys
-
-
-DB_PATH = os.path.join(os.environ['HOME'], '.config/Signal/sql/db.sqlite')
-DB_COPY = os.path.join(os.environ['HOME'], '.config/Signal/sql/db.tmp')
-CONFIG_PATH = os.path.join(os.environ['HOME'], '.config/Signal/config.json')
-
-
-def zenity_askyesno(title, text):
-    args = [
-        '@ZENITY@',
-        '--question',
-        '--title',
-        shlex.quote(title),
-        '--text',
-        shlex.quote(text)
-    ]
-    return subprocess.run(args).returncode == 0
-
-
-def start_signal():
-    os.execvp('@SIGNAL-DESKTOP@', ['@SIGNAL-DESKTOP@'] + sys.argv[1:])
-
-
-def copy_pragma(name):
-    result = subprocess.run([
-        '@SQLCIPHER@',
-        DB_PATH,
-        f"PRAGMA {name};"
-    ], check=True, capture_output=True).stdout
-    result = re.search(r'[0-9]+', result.decode()).group(0)
-    subprocess.run([
-        '@SQLCIPHER@',
-        DB_COPY,
-        f"PRAGMA key = \"x'{key}'\"; PRAGMA {name} = {result};"
-    ], check=True, capture_output=True)
-
-
-try:
-    # Test if DB is encrypted:
-    con = sqlite3.connect(f'file:{DB_PATH}?mode=ro', uri=True)
-    cursor = con.cursor()
-    cursor.execute("SELECT name FROM sqlite_master WHERE type='table';")
-    con.close()
-except:
-    # DB is encrypted, everything ok:
-    start_signal()
-
-
-# DB is unencrypted!
-answer = zenity_askyesno(
-        "Error: Signal-Desktop database is not encrypted",
-        "Should we try to fix this automatically?"
-        + "You likely want to backup ~/.config/Signal/ first."
-)
-if not answer:
-    answer = zenity_askyesno(
-            "Launch Signal-Desktop",
-            "DB is unencrypted, should we still launch Signal-Desktop?"
-            + "Warning: This could result in data loss!"
-    )
-    if not answer:
-        print('Aborted')
-        sys.exit(0)
-    start_signal()
-
-# Re-encrypt the DB:
-with open(CONFIG_PATH) as json_file:
-    key = json.load(json_file)['key']
-result = subprocess.run([
-    '@SQLCIPHER@',
-    DB_PATH,
-    f" ATTACH DATABASE '{DB_COPY}' AS signal_db KEY \"x'{key}'\";"
-    + " SELECT sqlcipher_export('signal_db');"
-    + " DETACH DATABASE signal_db;"
-]).returncode
-if result != 0:
-    print('DB encryption failed')
-    sys.exit(1)
-# Need to copy user_version and schema_version manually:
-copy_pragma('user_version')
-copy_pragma('schema_version')
-os.rename(DB_COPY, DB_PATH)
-start_signal()

pkgs/applications/networking/instant-messengers/signal-desktop/default.nix

@@ -10,9 +10,6 @@
 , hunspellDicts, spellcheckerLanguage ? null # E.g. "de_DE"
 # For a full list of available languages:
 # $ cat pkgs/development/libraries/hunspell/dictionaries.nix | grep "dictFileName =" | awk '{ print $3 }'
-, python3
-, gnome
-, sqlcipher
 }:
 
 let
@@ -28,7 +25,7 @@ let
       else "");
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "5.2.1"; # Please backport all updates to the stable channel.
+  version = "5.3.0"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -38,7 +35,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "0hkl8h49565kncvczv5fv4gak55lycygwb8i8igkgc4my0ykzs2z";
+    sha256 = "15lclxw3njih90zlh2n90v8ljg0wnglw5w8jrpa7rbd789yagvq7";
   };
 
   nativeBuildInputs = [
@@ -115,7 +112,7 @@ in stdenv.mkDerivation rec {
 
     # Symlink to bin
     mkdir -p $out/bin
-    ln -s $out/lib/Signal/signal-desktop $out/bin/signal-desktop-unwrapped
+    ln -s $out/lib/Signal/signal-desktop $out/bin/signal-desktop
 
     runHook postInstall
   '';
@@ -137,17 +134,7 @@ in stdenv.mkDerivation rec {
       --replace /opt/Signal/signal-desktop $out/bin/signal-desktop
 
     autoPatchelf --no-recurse -- $out/lib/Signal/
-    patchelf --add-needed ${libpulseaudio}/lib/libpulse.so $out/lib/Signal/resources/app.asar.unpacked/node_modules/ringrtc/build/linux/libringrtc.node
-  '';
-
-  postFixup = ''
-    # This hack is temporarily required to avoid data-loss for users:
-    cp ${./db-reencryption-wrapper.py} $out/bin/signal-desktop
-    substituteInPlace $out/bin/signal-desktop \
-      --replace '@PYTHON@' '${python3}/bin/python3' \
-      --replace '@ZENITY@' '${gnome.zenity}/bin/zenity' \
-      --replace '@SQLCIPHER@' '${sqlcipher}/bin/sqlcipher' \
-      --replace '@SIGNAL-DESKTOP@' "$out/bin/signal-desktop-unwrapped"
+    patchelf --add-needed ${libpulseaudio}/lib/libpulse.so $out/lib/Signal/resources/app.asar.unpacked/node_modules/ringrtc/build/linux/libringrtc-x64.node
   '';
 
   # Tests if the application launches and waits for "Link your phone to Signal Desktop":

pkgs/applications/networking/irc/catgirl/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "catgirl";
-  version = "1.7";
+  version = "1.8";
 
   src = fetchurl {
     url = "https://git.causal.agency/catgirl/snapshot/${pname}-${version}.tar.gz";
-    sha256 = "sha256-3shSdeq4l6Y5DEJZEVMHAngp6vjnkPjzpLpcp407X/0=";
+    sha256 = "0svpd2nqsr55ac98vczyhihs6pvgw7chspf6bdlwl98gch39dxif";
   };
 
   nativeBuildInputs = [ ctags pkg-config ];

pkgs/applications/networking/irc/weechat/scripts/wee-slack/0001-hardcode-json-file-path.patch

@@ -1,35 +0,0 @@
-From 5dd2593369645b11a9dc03e1930617d2f5dbd039 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
-Date: Wed, 11 Nov 2020 11:48:49 +0100
-Subject: [PATCH] hardcode json file path
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
----
- wee_slack.py | 8 +-------
- 1 file changed, 1 insertion(+), 7 deletions(-)
-
-diff --git a/wee_slack.py b/wee_slack.py
-index a3d779c..5942289 100644
---- a/wee_slack.py
-+++ b/wee_slack.py
-@@ -5136,13 +5136,7 @@ def create_slack_debug_buffer():
- 
- def load_emoji():
-     try:
--        weechat_dir = w.info_get('weechat_dir', '')
--        weechat_sharedir = w.info_get('weechat_sharedir', '')
--        local_weemoji, global_weemoji = ('{}/weemoji.json'.format(path)
--                for path in (weechat_dir, weechat_sharedir))
--        path = (global_weemoji if os.path.exists(global_weemoji) and
--                not os.path.exists(local_weemoji) else local_weemoji)
--        with open(path, 'r') as ef:
-+        with open('@out@/share/wee-slack/weemoji.json', 'r') as ef:
-             emojis = json.loads(ef.read())
-             if 'emoji' in emojis:
-                 print_error('The weemoji.json file is in an old format. Please update it.')
--- 
-2.29.0
-

pkgs/applications/networking/irc/weechat/scripts/wee-slack/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wee-slack";
-  version = "2.7.0";
+  version = "2.8.0";
 
   src = fetchFromGitHub {
     repo = "wee-slack";
     owner = "wee-slack";
     rev = "v${version}";
-    sha256 = "sha256-6Z/H15bKe0PKpNe9PCgc5mLOii3CILCAVon7EgzIkx8=";
+    sha256 = "0xfklr0gsc9jgxfyrrb2j756lclz9g8imcb0pk0xgyj8mhsw23zk";
   };
 
   patches = [
@@ -16,10 +16,13 @@ stdenv.mkDerivation rec {
       src = ./libpath.patch;
       env = "${buildEnv {
         name = "wee-slack-env";
-        paths = with python3Packages; [ websocket_client six ];
+        paths = with python3Packages; [
+          websocket_client
+          six
+        ];
       }}/${python3Packages.python.sitePackages}";
     })
-    ./0001-hardcode-json-file-path.patch
+    ./load_weemoji_path.patch
   ];
 
   postPatch = ''

pkgs/applications/networking/irc/weechat/scripts/wee-slack/libpath.patch

@@ -1,13 +1,13 @@
 diff --git a/wee_slack.py b/wee_slack.py
-index dbe6446..d1b7546 100644
+index e4716b4..f673b7c 100644
 --- a/wee_slack.py
 +++ b/wee_slack.py
-@@ -25,6 +25,8 @@ import random
- import socket
- import string
+@@ -31,6 +31,8 @@ import string
+ # See https://github.com/numpy/numpy/issues/11925
+ sys.modules["numpy"] = None
  
 +sys.path.append('@env@')
 +
- from websocket import ABNF, create_connection, WebSocketConnectionClosedException
- 
- try:
+ from websocket import (  # noqa: E402
+     ABNF,
+     create_connection,

pkgs/applications/networking/irc/weechat/scripts/wee-slack/load_weemoji_path.patch

@@ -0,0 +1,25 @@
+diff --git a/wee_slack.py b/wee_slack.py
+index e4716b4..ffd122d 100644
+--- a/wee_slack.py
++++ b/wee_slack.py
+@@ -6092,19 +6092,7 @@ def create_slack_debug_buffer():
+ 
+ def load_emoji():
+     try:
+-        weechat_dir = w.info_get("weechat_data_dir", "") or w.info_get(
+-            "weechat_dir", ""
+-        )
+-        weechat_sharedir = w.info_get("weechat_sharedir", "")
+-        local_weemoji, global_weemoji = (
+-            "{}/weemoji.json".format(path) for path in (weechat_dir, weechat_sharedir)
+-        )
+-        path = (
+-            global_weemoji
+-            if os.path.exists(global_weemoji) and not os.path.exists(local_weemoji)
+-            else local_weemoji
+-        )
+-        with open(path, "r") as ef:
++        with open("@out@/share/wee-slack/weemoji.json", "r") as ef:
+             emojis = json.loads(ef.read())
+             if "emoji" in emojis:
+                 print_error(

pkgs/applications/networking/mailreaders/mblaze/default.nix

@@ -1,10 +1,12 @@
-{ stdenv, lib, fetchFromGitHub, installShellFiles, libiconv, ruby ? null }:
+{ coreutils, fetchFromGitHub, fetchpatch, file, gawk, gnugrep, gnused
+, installShellFiles, less, lib, libiconv, makeWrapper, nano, stdenv, ruby
+}:
 
 stdenv.mkDerivation rec {
   pname = "mblaze";
   version = "1.1";
 
-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [ installShellFiles makeWrapper ];
   buildInputs = [ ruby ] ++ lib.optionals stdenv.isDarwin [ libiconv ];
 
   src = fetchFromGitHub {
@@ -22,6 +24,24 @@ stdenv.mkDerivation rec {
     installShellCompletion contrib/_mblaze
   '' + lib.optionalString (ruby != null) ''
     install -Dt $out/bin contrib/msuck contrib/mblow
+
+    # The following wrappings are used to preserve the executable
+    # names (the value of $0 in a script). The script mcom is
+    # designed to be run directly or via symlinks such as mrep. Using
+    # symlinks changes the value of $0 in the script, and makes it
+    # behave differently. When using the wrapProgram tool, the resulting
+    # wrapper breaks this behaviour. The following wrappers preserve it.
+
+    mkdir -p $out/wrapped
+    for x in mcom mbnc mfwd mrep; do
+      mv $out/bin/$x $out/wrapped
+      makeWrapper $out/wrapped/$x $out/bin/$x \
+        --argv0 $out/bin/$x \
+        --prefix PATH : $out/bin \
+        --prefix PATH : ${lib.makeBinPath [
+          coreutils file gawk gnugrep gnused
+        ]}
+    done
   '';
 
   meta = with lib; {

pkgs/applications/networking/mailreaders/neomutt/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, gettext, makeWrapper, tcl, which
+{ lib, stdenv, fetchFromGitHub, gettext, makeWrapper, tcl, which, fetchpatch
 , ncurses, perl , cyrus_sasl, gss, gpgme, libkrb5, libidn, libxml2, notmuch, openssl
 , lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42, w3m, mailcap, sqlite, zlib
 }:
@@ -14,6 +14,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ADg/+gmndOiuQHsncOzS5K4chthXeUFz6RRJsrZNeZY=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2021-32055.patch";
+      url = "https://github.com/neomutt/neomutt/commit/fa1db5785e5cfd9d3cd27b7571b9fe268d2ec2dc.patch";
+      sha256 = "0bb7gisjynq3w7hhl6vxa469h609bcz6fkdi8vf740pqrwhk68yn";
+    })
+  ];
+
   buildInputs = [
     cyrus_sasl gss gpgme libkrb5 libidn ncurses
     notmuch openssl perl lmdb

pkgs/applications/office/libreoffice/src-still/download.nix

@@ -721,25 +721,25 @@
     md5name = "505e70834d35383537b6491e7ae8641f1a4bed1876dbfe361201fc80868d88ca-libpng-1.6.37.tar.xz";
   }
   {
-    name = "poppler-0.82.0.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/poppler-0.82.0.tar.xz";
-    sha256 = "234f8e573ea57fb6a008e7c1e56bfae1af5d1adf0e65f47555e1ae103874e4df";
+    name = "poppler-21.01.0.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/poppler-21.01.0.tar.xz";
+    sha256 = "016dde34e5f868ea98a32ca99b643325a9682281500942b7113f4ec88d20e2f3";
     md5 = "";
-    md5name = "234f8e573ea57fb6a008e7c1e56bfae1af5d1adf0e65f47555e1ae103874e4df-poppler-0.82.0.tar.xz";
+    md5name = "016dde34e5f868ea98a32ca99b643325a9682281500942b7113f4ec88d20e2f3-poppler-21.01.0.tar.xz";
   }
   {
-    name = "postgresql-9.2.24.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/postgresql-9.2.24.tar.bz2";
-    sha256 = "a754c02f7051c2f21e52f8669a421b50485afcde9a581674d6106326b189d126";
+    name = "postgresql-13.1.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/postgresql-13.1.tar.bz2";
+    sha256 = "12345c83b89aa29808568977f5200d6da00f88a035517f925293355432ffe61f";
     md5 = "";
-    md5name = "a754c02f7051c2f21e52f8669a421b50485afcde9a581674d6106326b189d126-postgresql-9.2.24.tar.bz2";
+    md5name = "12345c83b89aa29808568977f5200d6da00f88a035517f925293355432ffe61f-postgresql-13.1.tar.bz2";
   }
   {
-    name = "Python-3.7.7.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/Python-3.7.7.tar.xz";
-    sha256 = "06a0a9f1bf0d8cd1e4121194d666c4e28ddae4dd54346de6c343206599f02136";
+    name = "Python-3.7.10.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/Python-3.7.10.tar.xz";
+    sha256 = "f8d82e7572c86ec9d55c8627aae5040124fd2203af400c383c821b980306ee6b";
     md5 = "";
-    md5name = "06a0a9f1bf0d8cd1e4121194d666c4e28ddae4dd54346de6c343206599f02136-Python-3.7.7.tar.xz";
+    md5name = "f8d82e7572c86ec9d55c8627aae5040124fd2203af400c383c821b980306ee6b-Python-3.7.10.tar.xz";
   }
   {
     name = "QR-Code-generator-1.4.0.tar.gz";

pkgs/applications/office/libreoffice/src-still/primary.nix

@@ -8,7 +8,7 @@ rec {
 
   major = "7";
   minor = "0";
-  patch = "4";
+  patch = "6";
   tweak = "2";
 
   subdir = "${major}.${minor}.${patch}";
@@ -17,13 +17,13 @@ rec {
 
   src = fetchurl {
     url = "https://download.documentfoundation.org/libreoffice/src/${subdir}/libreoffice-${version}.tar.xz";
-    sha256 = "1g9akxvm7fh6lnprnc3g184qdy8gbinhb4rb60gjpw82ip6d5acz";
+    sha256 = "0bk1dc6g8z5akrprfxxy3dm0vdmihaaxnsprxpqbqmqrqzkzg8cn";
   };
 
   # FIXME rename
   translations = fetchSrc {
     name = "translations";
-    sha256 = "1v3kpk56fm783d5wihx41jqidpclizkfxrg4n0pq95d79hdiljsl";
+    sha256 = "04f76r311hppil656ajab52x0xwqszazlgssyi5w97wak2zkmqgj";
   };
 
   # the "dictionaries" archive is not used for LO build because we already build hunspellDicts packages from
@@ -31,6 +31,6 @@ rec {
 
   help = fetchSrc {
     name = "help";
-    sha256 = "1np9f799ww12kggl5az6piv5fi9rf737il5a5r47r4wl2li56qqb";
+    sha256 = "1xmvlj9nrmg8448k4zfaxn5qqxa4amnvvhs1l1smi2bz3xh4xn2d";
   };
 }

pkgs/applications/office/paperwork/paperwork-gtk.nix

@@ -13,10 +13,24 @@
 , gettext
 , gobject-introspection
 , gdk-pixbuf
+, texlive
+, imagemagick
+, perlPackages
 }:
 
+let
+  documentation_deps = [
+    (texlive.combine {
+      inherit (texlive) scheme-small wrapfig was;
+    })
+    xvfb-run
+    imagemagick
+    perlPackages.Po4a
+  ];
+in
+
 python3Packages.buildPythonApplication rec {
-  inherit (import ./src.nix { inherit fetchFromGitLab; }) version src;
+  inherit (import ./src.nix { inherit fetchFromGitLab; }) version src sample_documents;
   pname = "paperwork";
 
   sourceRoot = "source/paperwork-gtk";
@@ -52,9 +66,16 @@ python3Packages.buildPythonApplication rec {
     for i in $site/data/paperwork_*.png; do
       ln -s $i $site/icon/out;
     done
+
+    export XDG_DATA_DIRS=$XDG_DATA_DIRS:${gnome.adwaita-icon-theme}/share
+    # build the user manual
+    PATH=$out/bin:$PATH PAPERWORK_TEST_DOCUMENTS=${sample_documents} make data
+    for i in src/paperwork_gtk/model/help/out/*.pdf; do
+      install -Dt $site/model/help/out $i
+    done
   '';
 
-  checkInputs = [ xvfb-run dbus.daemon ];
+  checkInputs = [ dbus.daemon ];
 
   nativeBuildInputs = [
     wrapGAppsHook
@@ -62,7 +83,7 @@ python3Packages.buildPythonApplication rec {
     (lib.getBin gettext)
     which
     gdk-pixbuf # for the setup hook
-  ];
+  ] ++ documentation_deps;
 
   buildInputs = [
     gnome.adwaita-icon-theme
@@ -78,13 +99,20 @@ python3Packages.buildPythonApplication rec {
     makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
   '';
 
-  # A few parts of chkdeps need to have a display and a dbus session, so we not
-  # only need to run a virtual X server + dbus but also have a large enough
-  # resolution, because the Cairo test tries to draw a 200x200 window.
-  preCheck = ''
+  checkPhase = ''
+    runHook preCheck
+
+    # A few parts of chkdeps need to have a display and a dbus session, so we not
+    # only need to run a virtual X server + dbus but also have a large enough
+    # resolution, because the Cairo test tries to draw a 200x200 window.
     xvfb-run -s '-screen 0 800x600x24' dbus-run-session \
       --config-file=${dbus.daemon}/share/dbus-1/session.conf \
       $out/bin/paperwork-gtk chkdeps
+
+    # content of make test, without the dep on make install
+    python -m unittest discover --verbose -s tests
+
+    runHook postCheck
   '';
 
   propagatedBuildInputs = with python3Packages; [
@@ -98,6 +126,8 @@ python3Packages.buildPythonApplication rec {
     setuptools
   ];
 
+  disallowedRequisites = documentation_deps;
+
   meta = {
     description = "A personal document manager for scanned documents";
     homepage = "https://openpaper.work/";

pkgs/applications/office/paperwork/src.nix

@@ -1,12 +1,22 @@
 {fetchFromGitLab}:
 rec {
-  version = "2.0.2";
+  version = "2.0.3";
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     repo = "paperwork";
     group = "World";
     owner = "OpenPaperwork";
     rev = version;
-    sha256 = "1di7nnl8ywyiwfpl5m1kvip1m0hvijbmqmkdpviwqw7ajizrr1ly";
+    sha256 = "02c2ysca75j59v87n1axqfncvs167kmdr40m0f05asdh2akwrbi9";
   };
+  sample_documents = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    repo = "paperwork-test-documents";
+    group = "World";
+    owner = "OpenPaperwork";
+    # https://gitlab.gnome.org/World/OpenPaperwork/paperwork/-/blob/master/paperwork-gtk/src/paperwork_gtk/model/help/screenshot.sh see TEST_DOCS_TAG
+    rev = "1.0";
+    sha256 = "155nhw2jmlgfi6c3wm241vrr3yma6lw85k9lxn844z96kyi7wbpr";
+  };
+
 }

pkgs/applications/office/softmaker/softmaker_office.nix

@@ -6,9 +6,9 @@
   # Softmaker Office or when the upstream archive was replaced and
   # nixpkgs is not in sync yet.
 , officeVersion ? {
-  version = "1030";
+  version = "1032";
   edition = "2021";
-  hash = "sha256-bpnyPyZnJc9RFVrFM2o3M7Gc4PSKFGpaM1Yo8ZKGHrE=";
+  hash = "sha256-LchSqLVBdkmWJQ8hCEvtwRPgIUSDE0URKPzCkEexGbc=";
 }
 
 , ... } @ args:

pkgs/applications/radio/welle-io/default.nix

@@ -1,20 +1,17 @@
 { mkDerivation, lib, fetchFromGitHub, cmake, pkg-config
 , qtbase, qtcharts, qtmultimedia, qtquickcontrols, qtquickcontrols2, qtgraphicaleffects
-, faad2, rtl-sdr, soapysdr-with-plugins, libusb-compat-0_1, fftwSinglePrec, lame, mpg123 }:
-let
-
-  version = "2.2";
-
-in mkDerivation {
+, faad2, rtl-sdr, soapysdr-with-plugins, libusb-compat-0_1, fftwSinglePrec, lame, mpg123
+} :
 
+mkDerivation rec {
   pname = "welle-io";
-  inherit version;
+  version = "2.3";
 
   src = fetchFromGitHub {
     owner = "AlbrechtL";
     repo = "welle.io";
     rev = "v${version}";
-    sha256 = "04fpm6sc431dl9i5h53xpd6k85j22sv8aawl7b6wv2fzpfsd9fwa";
+    sha256 = "1xl1lanw0xgmgks67dbfb2h52jxnrd1i2zik56v0q8dwsr7f0daw";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];

pkgs/applications/science/logic/lean/default.nix

@@ -7,7 +7,11 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner  = "leanprover-community";
     repo   = "lean";
-    rev    = "v${version}";
+    # lean's version string contains the commit sha1 it was built
+    # from. this is then used to check whether an olean file should be
+    # rebuilt. don't use a tag as rev because this will get replaced into
+    # src/githash.h.in in preConfigure.
+    rev    = "a5822ea47ebc52eec6323d8f1b60f6ec025daf99";
     sha256 = "sha256-gJhbkl19iilNyfCt2TfPmghYA3yCjg6kS+yk/x/k14Y=";
   };
 
@@ -20,6 +24,13 @@ stdenv.mkDerivation rec {
   # library.
   doCheck = true;
 
+  preConfigure = assert builtins.stringLength src.rev == 40; ''
+     substituteInPlace src/githash.h.in \
+       --subst-var-by GIT_SHA1 "${src.rev}"
+     substituteInPlace library/init/version.lean.in \
+       --subst-var-by GIT_SHA1 "${src.rev}"
+  '';
+
   postPatch = "patchShebangs .";
 
   postInstall = lib.optionalString stdenv.isDarwin ''

pkgs/applications/science/math/sage/sagedoc.nix

@@ -76,7 +76,7 @@ stdenv.mkDerivation rec {
     mv html/en/_static{,.tmp}
     for _dir in `find -name _static` ; do
           rm -r $_dir
-          ln -s html/en/_static $_dir
+          ln -rs html/en/_static $_dir
     done
     mv html/en/_static{.tmp,}
   '';

pkgs/applications/science/physics/xfitter/default.nix

@@ -16,9 +16,6 @@ stdenv.mkDerivation rec {
     ./undefined_behavior.patch
   ];
 
-  # patch needs to updated due to version bump
-  #CXXFLAGS = "-Werror=return-type";
-
   preConfigure =
   # Fix F77LD to workaround for a following build error:
   #
@@ -48,8 +45,6 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  hardeningDisable = [ "format" ];
-
   NIX_CFLAGS_COMPILE = lib.optional (stdenv.hostPlatform.libc == "glibc") "-I${libtirpc.dev}/include/tirpc";
   NIX_LDFLAGS = lib.optional (stdenv.hostPlatform.libc == "glibc") "-ltirpc";
 

pkgs/applications/version-management/git-and-tools/delta/default.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "delta";
-  version = "0.7.1";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "dandavison";
     repo = pname;
     rev = version;
-    sha256 = "02gm3fxqq91gn1hffy9kc6dkc0y7p09sl6f8njfpsaficij4bs7a";
+    sha256 = "01s73ld3npdmrjbay1lmd13bn9lg2pbmj14gklxi3j9aj0y2q8w8";
   };
 
-  cargoSha256 = "1w1w98vhjd561mkiwv89zb8k0nf1p5fc67jb5dddwg9nj6mqjrhp";
+  cargoSha256 = "1pi4sm07nm1irigrfgysfw99vw96zzz07a1qw5m7bmj6aqp0r3fr";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/applications/version-management/git-and-tools/git/default.nix

@@ -2,7 +2,7 @@
 , curl, openssl, zlib, expat, perlPackages, python3, gettext, cpio
 , gnugrep, gnused, gawk, coreutils # needed at runtime by git-filter-branch etc
 , openssh, pcre2
-, asciidoctor, texinfo, xmlto, docbook2x, docbook_xsl, docbook_xsl_ns, docbook_xml_dtd_45
+, asciidoc, texinfo, xmlto, docbook2x, docbook_xsl, docbook_xml_dtd_45
 , libxslt, tcl, tk, makeWrapper, libiconv
 , svnSupport, subversionClient, perlLibs, smtpPerlLibs
 , perlSupport ? stdenv.buildPlatform == stdenv.hostPlatform
@@ -68,8 +68,8 @@ stdenv.mkDerivation {
   '';
 
   nativeBuildInputs = [ gettext perlPackages.perl makeWrapper ]
-    ++ lib.optionals withManual [ asciidoctor texinfo xmlto docbook2x
-         docbook_xsl docbook_xsl_ns docbook_xml_dtd_45 libxslt ];
+    ++ lib.optionals withManual [ asciidoc texinfo xmlto docbook2x
+         docbook_xsl docbook_xml_dtd_45 libxslt ];
   buildInputs = [curl openssl zlib expat cpio libiconv]
     ++ lib.optionals perlSupport [ perlPackages.perl ]
     ++ lib.optionals guiSupport [tcl tk]
@@ -148,7 +148,7 @@ stdenv.mkDerivation {
       }
 
       # Install git-subtree.
-      make -C contrib/subtree install ${lib.optionalString withManual "USE_ASCIIDOCTOR=1 install-doc"}
+      make -C contrib/subtree install ${lib.optionalString withManual "install-doc"}
       rm -rf contrib/subtree
 
       # Install contrib stuff.
@@ -233,7 +233,7 @@ stdenv.mkDerivation {
       '')
 
    + lib.optionalString withManual ''# Install man pages
-       make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES USE_ASCIIDOCTOR=1 PERL_PATH="${buildPackages.perl}/bin/perl" cmd-list.made install install-html \
+       make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES PERL_PATH="${buildPackages.perl}/bin/perl" cmd-list.made install install-html \
          -C Documentation ''
 
    + (if guiSupport then ''

pkgs/applications/version-management/git-repo/default.nix

@@ -1,10 +1,10 @@
-{ lib, stdenv, fetchFromGitHub, makeWrapper
+{ lib, stdenv, fetchFromGitHub, makeWrapper, nix-update-script
 , python3, git, gnupg, less
 }:
 
 stdenv.mkDerivation rec {
   pname = "git-repo";
-  version = "2.14.5";
+  version = "2.15.3";
 
   src = fetchFromGitHub {
     owner = "android";
@@ -13,8 +13,6 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-3FSkWpHda1jVhy/633B+ippWcbKd83IlQcJYS9Qx5wQ=";
   };
 
-  patches = [ ./import-ssl-module.patch ];
-
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ python3 ];
 
@@ -25,8 +23,12 @@ stdenv.mkDerivation rec {
   '';
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/bin
     cp repo $out/bin/repo
+
+    runHook postInstall
   '';
 
   # Important runtime dependencies
@@ -35,6 +37,12 @@ stdenv.mkDerivation rec {
       "${lib.makeBinPath [ git gnupg less ]}"
   '';
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "gitRepo";
+    };
+  };
+
   meta = with lib; {
     description = "Android's repo management tool";
     longDescription = ''
@@ -45,7 +53,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://android.googlesource.com/tools/repo";
     license = licenses.asl20;
-    maintainers = [ ];
+    maintainers = with maintainers; [ otavio ];
     platforms = platforms.unix;
   };
 }

pkgs/applications/version-management/git-repo/import-ssl-module.patch

@@ -1,12 +0,0 @@
-diff --git a/repo b/repo
-index 8b05def..f394b3e 100755
---- a/repo
-+++ b/repo
-@@ -236,6 +236,7 @@ import optparse
- import re
- import shutil
- import stat
-+import ssl
- 
- if sys.version_info[0] == 3:
-   import urllib.request

pkgs/applications/version-management/gitlab/data.json

@@ -1,13 +1,13 @@
 {
-  "version": "13.11.2",
-  "repo_hash": "0xian17q8h5qdcvndyd27w278zqi3455svwycqfcv830g27c0csh",
+  "version": "13.12.0",
+  "repo_hash": "060bmfvpqh6zdrwdh4lx4xr1nbg0f7hcp8zh6k9qplv48szhj8m9",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v13.11.2-ee",
+  "rev": "v13.12.0-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "13.11.2",
-    "GITLAB_PAGES_VERSION": "1.38.0",
-    "GITLAB_SHELL_VERSION": "13.17.0",
-    "GITLAB_WORKHORSE_VERSION": "13.11.2"
+    "GITALY_SERVER_VERSION": "13.12.0",
+    "GITLAB_PAGES_VERSION": "1.39.0",
+    "GITLAB_SHELL_VERSION": "13.18.0",
+    "GITLAB_WORKHORSE_VERSION": "13.12.0"
   }
 }

pkgs/applications/version-management/gitlab/default.nix

@@ -125,15 +125,6 @@ stdenv.mkDerivation {
   patches = [
     # Change hardcoded paths to the NixOS equivalent
     ./remove-hardcoded-locations.patch
-
-    # Use the exactly 32 byte long version of db_key_base with
-    # aes-256-gcm, see
-    # https://gitlab.com/gitlab-org/gitlab/-/merge_requests/53602
-    (fetchpatch {
-      name = "secrets_db_key_base_length.patch";
-      url = "https://gitlab.com/gitlab-org/gitlab/-/commit/a5c78650441c31a522b18e30177c717ffdd7f401.patch";
-      sha256 = "1qcxr5f59slgzmpcbiwabdhpz1lxnq98yngg1xkyihk2zhv0g1my";
-    })
   ];
 
   postPatch = ''

pkgs/applications/version-management/gitlab/gitaly/default.nix

@@ -21,17 +21,17 @@ let
       };
   };
 in buildGoModule rec {
-  version = "13.11.2";
+  version = "13.12.0";
   pname = "gitaly";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitaly";
     rev = "v${version}";
-    sha256 = "sha256-qcrvNmnlrdJYXAlt65bA0Ij7zuX7QwVukC3A4KGL3sk=";
+    sha256 = "sha256-MGK0WjAeqApf2xUsbF1mtyzYMhJHC5LFtj8LSb0NQKI=";
   };
 
-  vendorSha256 = "sha256-VAXQPVyB+XdfOqGaT1H/83ed6xV+4Tr5fkBu1eyPe2k=";
+  vendorSha256 = "sha256-drS0L0olEFHYJVC0VYwEZeNYa8fjwrfxlhrEQa4pqzY=";
 
   passthru = {
     inherit rubyEnv;

pkgs/applications/version-management/gitlab/gitlab-shell/default.nix

@@ -2,19 +2,19 @@
 
 buildGoModule rec {
   pname = "gitlab-shell";
-  version = "13.17.0";
+  version = "13.18.0";
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${version}";
-    sha256 = "sha256-j/80AIIJdRSisu2fNXcqazb4oIzAQP5CfxHX3l6yijY=";
+    sha256 = "sha256-TPe2quDg/ljI2v1HciDajosSPm4Z/iT2skeveNdrKdo=";
   };
 
   buildInputs = [ ruby ];
 
   patches = [ ./remove-hardcoded-locations.patch ];
 
-  vendorSha256 = "sha256-/jJTMtS5fcbQroWuaPPfvYxy6znNS0FOXVN7IcE/spQ=";
+  vendorSha256 = "sha256-MvWpZ/Z9ieNE0+p975BG302BPzFbCZD3cACXMW5fiTQ=";
 
   postInstall = ''
     cp -r "$NIX_BUILD_TOP/source"/bin/* $out/bin

pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix

@@ -5,7 +5,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "13.11.2";
+  version = "13.12.0";
 
   src = fetchFromGitLab {
     owner = data.owner;
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   sourceRoot = "source/workhorse";
 
-  vendorSha256 = "sha256-m/Mx4Nr4tPK6yfcHxAFbjh9DI/1WnKReaaylWpNSrc8=";
+  vendorSha256 = "sha256-JJN1KqqbP4fIW/k6LebIaWdYOmIzHqxCDgOKrkbB7Nw=";
   buildInputs = [ git ];
   buildFlagsArray = "-ldflags=-X main.Version=${version}";
   doCheck = false;

pkgs/applications/version-management/gitlab/rubyEnv/Gemfile

@@ -18,11 +18,14 @@ gem 'default_value_for', '~> 3.4.0'
 gem 'pg', '~> 1.1'
 
 gem 'rugged', '~> 1.1'
-gem 'grape-path-helpers', '~> 1.6.1'
+gem 'grape-path-helpers', '~> 1.6.3'
 
 gem 'faraday', '~> 1.0'
 gem 'marginalia', '~> 1.10.0'
 
+# Authorization
+gem 'declarative_policy', '~> 1.0.0'
+
 # Authentication libraries
 gem 'devise', '~> 4.7.2'
 gem 'bcrypt', '~> 3.1', '>= 3.1.14'
@@ -46,7 +49,7 @@ gem 'omniauth-shibboleth', '~> 1.3.0'
 gem 'omniauth-twitter', '~> 1.4'
 gem 'omniauth_crowd', '~> 2.4.0'
 gem 'omniauth-authentiq', '~> 0.3.3'
-gem 'omniauth_openid_connect', '~> 0.3.5'
+gem 'gitlab-omniauth-openid-connect', '~> 0.4.0', require: 'omniauth_openid_connect'
 gem 'omniauth-salesforce', '~> 1.0.5'
 gem 'omniauth-atlassian-oauth2', '~> 0.2.0'
 gem 'rack-oauth2', '~> 1.16.0'
@@ -89,7 +92,7 @@ gem 'net-ldap', '~> 0.16.3'
 
 # API
 gem 'grape', '~> 1.5.2'
-gem 'grape-entity', '~> 0.7.1'
+gem 'grape-entity', '~> 0.9.0'
 gem 'rack-cors', '~> 1.0.6', require: 'rack/cors'
 
 # GraphQL API
@@ -264,7 +267,7 @@ gem 'kubeclient', '~> 4.9.1'
 
 # Sanitize user input
 gem 'sanitize', '~> 5.2.1'
-gem 'babosa', '~> 1.0.2'
+gem 'babosa', '~> 1.0.4'
 
 # Sanitizes SVG input
 gem 'loofah', '~> 2.2'
@@ -297,7 +300,7 @@ gem 'gon', '~> 6.4.0'
 gem 'request_store', '~> 1.5'
 gem 'base32', '~> 0.3.0'
 
-gem "gitlab-license", "~> 1.4"
+gem 'gitlab-license', '~> 1.5'
 
 # Protect against bruteforcing
 gem 'rack-attack', '~> 6.3.0'
@@ -306,12 +309,12 @@ gem 'rack-attack', '~> 6.3.0'
 gem 'sentry-raven', '~> 3.0'
 
 # PostgreSQL query parsing
-gem 'pg_query', '~> 1.3.0'
+gem 'pg_query', '~> 2.0.3'
 
 gem 'premailer-rails', '~> 1.10.3'
 
 # LabKit: Tracing and Correlation
-gem 'gitlab-labkit', '~> 0.16.2'
+gem 'gitlab-labkit', '~> 0.17.1'
 # Thrift is a dependency of gitlab-labkit, we want a version higher than 0.14.0
 # because of https://gitlab.com/gitlab-org/gitlab/-/issues/321900
 gem 'thrift', '>= 0.14.0'
@@ -343,6 +346,7 @@ end
 
 group :development do
   gem 'lefthook', '~> 0.7.0', require: false
+  gem 'solargraph', '~> 0.40.4', require: false
 
   gem 'letter_opener_web', '~> 1.4.0'
 
@@ -356,9 +360,9 @@ end
 group :development, :test do
   gem 'deprecation_toolkit', '~> 1.5.1', require: false
   gem 'bullet', '~> 6.1.3'
-  gem 'gitlab-pry-byebug', platform: :mri, require: ['pry-byebug', 'pry-byebug/pry_remote_ext']
+  gem 'pry-byebug'
   gem 'pry-rails', '~> 0.3.9'
-  gem 'pry-remote'
+  gem 'pry-shell', '~> 0.4.0'
 
   gem 'awesome_print', require: false
 
@@ -399,7 +403,7 @@ group :development, :test do
 end
 
 group :development, :test, :danger do
-  gem 'gitlab-dangerfiles', '~> 1.1.1', require: false
+  gem 'gitlab-dangerfiles', '~> 2.0.0', require: false
 end
 
 group :development, :test, :coverage do
@@ -413,13 +417,12 @@ group :development, :test, :omnibus do
 end
 
 group :test do
-  gem 'json-schema', '~> 2.8.0'
   gem 'fuubar', '~> 2.2.0'
   gem 'rspec-retry', '~> 0.6.1'
   gem 'rspec_profiling', '~> 0.0.6'
   gem 'rspec-parameterized', require: false
 
-  gem 'capybara', '~> 3.34.0'
+  gem 'capybara', '~> 3.35.3'
   gem 'capybara-screenshot', '~> 1.0.22'
   gem 'selenium-webdriver', '~> 3.142'
 
@@ -474,12 +477,15 @@ group :ed25519 do
   gem 'bcrypt_pbkdf', '~> 1.0'
 end
 
+# Spamcheck GRPC protocol definitions
+gem 'spamcheck', '~> 0.1.0'
+
 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 13.11.0.pre.rc1'
+gem 'gitaly', '~> 13.12.0.pre.rc1'
 
 gem 'grpc', '~> 1.30.2'
 
-gem 'google-protobuf', '~> 3.14.0'
+gem 'google-protobuf', '~> 3.15.8'
 
 gem 'toml-rb', '~> 1.0.0'
 
@@ -488,7 +494,7 @@ gem 'flipper', '~> 0.17.1'
 gem 'flipper-active_record', '~> 0.17.1'
 gem 'flipper-active_support_cache_store', '~> 0.17.1'
 gem 'unleash', '~> 0.1.5'
-gem 'gitlab-experiment', '~> 0.5.3'
+gem 'gitlab-experiment', '~> 0.5.4'
 
 # Structured logging
 gem 'lograge', '~> 0.5'
@@ -512,6 +518,7 @@ gem 'erubi', '~> 1.9.0'
 # See https://gitlab.com/gitlab-org/gitlab/issues/197386
 gem 'mail', '= 2.7.1'
 
+
 # File encryption
 gem 'lockbox', '~> 0.6.2'
 

pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock

@@ -125,11 +125,13 @@ GEM
       faraday_middleware (~> 1.0.0.rc1)
       net-http-persistent (~> 4.0)
       nokogiri (~> 1.11.0.rc2)
-    babosa (1.0.2)
+    babosa (1.0.4)
+    backport (1.1.2)
     base32 (0.3.2)
     batch-loader (2.0.1)
     bcrypt (3.1.16)
     bcrypt_pbkdf (1.0.0)
+    benchmark (0.1.1)
     benchmark-ips (2.3.0)
     benchmark-memory (0.1.2)
       memory_profiler (~> 0.9)
@@ -153,13 +155,13 @@ GEM
       bundler (>= 1.2.0, < 3)
       thor (>= 0.18, < 2)
     byebug (11.1.3)
-    capybara (3.34.0)
+    capybara (3.35.3)
       addressable
       mini_mime (>= 0.1.3)
       nokogiri (~> 1.8)
       rack (>= 1.6.0)
       rack-test (>= 0.6.3)
-      regexp_parser (~> 1.5)
+      regexp_parser (>= 1.5, < 3.0)
       xpath (~> 3.2)
     capybara-screenshot (1.0.22)
       capybara (>= 1.0, < 4)
@@ -238,6 +240,7 @@ GEM
       html-pipeline
     declarative (0.0.20)
     declarative-option (0.1.0)
+    declarative_policy (1.0.0)
     default_value_for (3.4.0)
       activerecord (>= 3.2.0, < 7.0)
     deprecation_toolkit (1.5.1)
@@ -299,6 +302,7 @@ GEM
       dry-equalizer (~> 0.3)
       dry-inflector (~> 0.1, >= 0.1.2)
       dry-logic (~> 1.0, >= 1.0.2)
+    e2mmap (0.1.0)
     ecma-re-validator (0.2.1)
       regexp_parser (~> 1.2)
     ed25519 (1.2.4)
@@ -428,7 +432,7 @@ GEM
       rails (>= 3.2.0)
     git (1.7.0)
       rchardet (~> 1.8)
-    gitaly (13.11.0.pre.rc1)
+    gitaly (13.12.0.pre.rc1)
       grpc (~> 1.0)
     github-markup (1.7.0)
     gitlab (4.16.1)
@@ -436,10 +440,11 @@ GEM
       terminal-table (~> 1.5, >= 1.5.1)
     gitlab-chronic (0.10.5)
       numerizer (~> 0.2)
-    gitlab-dangerfiles (1.1.1)
+    gitlab-dangerfiles (2.0.0)
       danger-gitlab
-    gitlab-experiment (0.5.3)
+    gitlab-experiment (0.5.4)
       activesupport (>= 3.0)
+      request_store (>= 1.0)
       scientist (~> 1.6, >= 1.6.0)
     gitlab-fog-azure-rm (1.0.1)
       azure-storage-blob (~> 2.0)
@@ -455,21 +460,22 @@ GEM
       fog-xml (~> 0.1.0)
       google-api-client (>= 0.44.2, < 0.51)
       google-cloud-env (~> 1.2)
-    gitlab-labkit (0.16.2)
+    gitlab-labkit (0.17.1)
       actionpack (>= 5.0.0, < 7.0.0)
       activesupport (>= 5.0.0, < 7.0.0)
       grpc (~> 1.19)
       jaeger-client (~> 1.1)
       opentracing (~> 0.4)
-      pg_query (~> 1.3)
+      pg_query (~> 2.0)
       redis (> 3.0.0, < 5.0.0)
-    gitlab-license (1.4.0)
+    gitlab-license (1.5.0)
     gitlab-mail_room (0.0.9)
     gitlab-markup (1.7.1)
     gitlab-net-dns (0.9.1)
-    gitlab-pry-byebug (3.9.0)
-      byebug (~> 11.0)
-      pry (~> 0.13.0)
+    gitlab-omniauth-openid-connect (0.4.0)
+      addressable (~> 2.7)
+      omniauth (~> 1.9)
+      openid_connect (~> 1.2)
     gitlab-sidekiq-fetcher (0.5.6)
       sidekiq (~> 5)
     gitlab-styles (6.2.0)
@@ -503,9 +509,9 @@ GEM
       signet (~> 0.12)
     google-cloud-env (1.4.0)
       faraday (>= 0.17.3, < 2.0)
-    google-protobuf (3.14.0)
-    googleapis-common-protos-types (1.0.5)
-      google-protobuf (~> 3.11)
+    google-protobuf (3.15.8)
+    googleapis-common-protos-types (1.0.6)
+      google-protobuf (~> 3.14)
     googleauth (0.14.0)
       faraday (>= 0.17.3, < 2.0)
       jwt (>= 1.4, < 3.0)
@@ -522,10 +528,10 @@ GEM
       mustermann-grape (~> 1.0.0)
       rack (>= 1.3.0)
       rack-accept
-    grape-entity (0.7.1)
-      activesupport (>= 4.0)
+    grape-entity (0.9.0)
+      activesupport (>= 3.0.0)
       multi_json (>= 1.3.2)
-    grape-path-helpers (1.6.1)
+    grape-path-helpers (1.6.3)
       activesupport
       grape (~> 1.3)
       rake (> 12)
@@ -626,6 +632,7 @@ GEM
     jaeger-client (1.1.0)
       opentracing (~> 0.3)
       thrift
+    jaro_winkler (1.5.4)
     jira-ruby (2.1.4)
       activesupport
       atlassian-jwt
@@ -641,8 +648,6 @@ GEM
       activesupport (>= 4.2)
       aes_key_wrap
       bindata
-    json-schema (2.8.1)
-      addressable (>= 2.4)
     json_schemer (0.2.12)
       ecma-re-validator (~> 0.2)
       hana (~> 1.3)
@@ -863,12 +868,8 @@ GEM
       activesupport
       nokogiri (>= 1.4.4)
       omniauth (~> 1.0)
-    omniauth_openid_connect (0.3.5)
-      addressable (~> 2.5)
-      omniauth (~> 1.9)
-      openid_connect (~> 1.1)
     open4 (1.3.4)
-    openid_connect (1.1.8)
+    openid_connect (1.2.0)
       activemodel
       attr_required (>= 1.0.0)
       json-jwt (>= 1.5.0)
@@ -890,10 +891,13 @@ GEM
     parser (3.0.0.0)
       ast (~> 2.4.1)
     parslet (1.8.2)
+    pastel (0.8.0)
+      tty-color (~> 0.5)
     peek (1.1.0)
       railties (>= 4.0.0)
     pg (1.2.3)
-    pg_query (1.3.0)
+    pg_query (2.0.3)
+      google-protobuf (~> 3.15.5)
     plist (3.6.0)
     png_quantizator (0.2.1)
     po_to_json (1.0.1)
@@ -914,11 +918,15 @@ GEM
     pry (0.13.1)
       coderay (~> 1.1)
       method_source (~> 1.0)
+    pry-byebug (3.9.0)
+      byebug (~> 11.0)
+      pry (~> 0.13.0)
     pry-rails (0.3.9)
       pry (>= 0.10.4)
-    pry-remote (0.1.8)
-      pry (~> 0.9)
-      slop (~> 3.0)
+    pry-shell (0.4.0)
+      pry (~> 0.13.0)
+      tty-markdown
+      tty-prompt
     public_suffix (4.0.6)
     puma (5.1.1)
       nio4r (~> 2.0)
@@ -1184,9 +1192,24 @@ GEM
     simplecov-html (0.12.2)
     sixarm_ruby_unaccent (1.2.0)
     slack-messenger (2.3.4)
-    slop (3.6.0)
     snowplow-tracker (0.6.1)
       contracts (~> 0.7, <= 0.11)
+    solargraph (0.40.4)
+      backport (~> 1.1)
+      benchmark
+      bundler (>= 1.17.2)
+      e2mmap
+      jaro_winkler (~> 1.5)
+      kramdown (~> 2.3)
+      kramdown-parser-gfm (~> 1.1)
+      parser (~> 3.0)
+      reverse_markdown (>= 1.0.5, < 3)
+      rubocop (>= 0.52)
+      thor (~> 1.0)
+      tilt (~> 2.0)
+      yard (~> 0.9, >= 0.9.24)
+    spamcheck (0.1.0)
+      grpc (~> 1.0)
     spring (2.1.1)
     spring-commands-rspec (1.0.4)
       spring (>= 0.9.1)
@@ -1208,7 +1231,12 @@ GEM
     state_machines-activerecord (0.8.0)
       activerecord (>= 5.1)
       state_machines-activemodel (>= 0.8.0)
-    swd (1.1.2)
+    strings (0.2.1)
+      strings-ansi (~> 0.2)
+      unicode-display_width (>= 1.5, < 3.0)
+      unicode_utils (~> 1.4)
+    strings-ansi (0.2.0)
+    swd (1.2.0)
       activesupport (>= 3)
       attr_required (>= 0.0.5)
       httpclient (>= 2.4)
@@ -1254,6 +1282,23 @@ GEM
     truncato (0.7.11)
       htmlentities (~> 4.3.1)
       nokogiri (>= 1.7.0, <= 2.0)
+    tty-color (0.6.0)
+    tty-cursor (0.7.1)
+    tty-markdown (0.7.0)
+      kramdown (>= 1.16.2, < 3.0)
+      pastel (~> 0.8)
+      rouge (~> 3.14)
+      strings (~> 0.2.0)
+      tty-color (~> 0.5)
+      tty-screen (~> 0.8)
+    tty-prompt (0.23.1)
+      pastel (~> 0.8)
+      tty-reader (~> 0.8)
+    tty-reader (0.9.0)
+      tty-cursor (~> 0.7)
+      tty-screen (~> 0.8)
+      wisper (~> 2.0)
+    tty-screen (0.8.1)
     tzinfo (1.2.9)
       thread_safe (~> 0.1)
     u2f (0.2.1)
@@ -1322,12 +1367,14 @@ GEM
       builder
       expression_parser
       rinku
+    wisper (2.0.1)
     with_env (1.1.0)
     wmi-lite (1.0.5)
     xml-simple (1.1.5)
     xpath (3.2.0)
       nokogiri (~> 1.8)
     yajl-ruby (1.4.1)
+    yard (0.9.26)
     zeitwerk (2.4.2)
 
 PLATFORMS
@@ -1353,7 +1400,7 @@ DEPENDENCIES
   aws-sdk-cloudformation (~> 1)
   aws-sdk-core (~> 3)
   aws-sdk-s3 (~> 1)
-  babosa (~> 1.0.2)
+  babosa (~> 1.0.4)
   base32 (~> 0.3.0)
   batch-loader (~> 2.0.1)
   bcrypt (~> 3.1, >= 3.1.14)
@@ -1366,7 +1413,7 @@ DEPENDENCIES
   browser (~> 4.2)
   bullet (~> 6.1.3)
   bundler-audit (~> 0.7.0.1)
-  capybara (~> 3.34.0)
+  capybara (~> 3.35.3)
   capybara-screenshot (~> 1.0.22)
   carrierwave (~> 1.3)
   charlock_holmes (~> 0.7.7)
@@ -1378,6 +1425,7 @@ DEPENDENCIES
   crystalball (~> 0.7.0)
   database_cleaner (~> 1.7.0)
   deckar01-task_list (= 2.3.1)
+  declarative_policy (~> 1.0.0)
   default_value_for (~> 3.4.0)
   deprecation_toolkit (~> 1.5.1)
   derailed_benchmarks
@@ -1418,30 +1466,30 @@ DEPENDENCIES
   gettext (~> 3.3)
   gettext_i18n_rails (~> 1.8.0)
   gettext_i18n_rails_js (~> 1.3)
-  gitaly (~> 13.11.0.pre.rc1)
+  gitaly (~> 13.12.0.pre.rc1)
   github-markup (~> 1.7.0)
   gitlab-chronic (~> 0.10.5)
-  gitlab-dangerfiles (~> 1.1.1)
-  gitlab-experiment (~> 0.5.3)
+  gitlab-dangerfiles (~> 2.0.0)
+  gitlab-experiment (~> 0.5.4)
   gitlab-fog-azure-rm (~> 1.0.1)
   gitlab-fog-google (~> 1.13)
-  gitlab-labkit (~> 0.16.2)
-  gitlab-license (~> 1.4)
+  gitlab-labkit (~> 0.17.1)
+  gitlab-license (~> 1.5)
   gitlab-mail_room (~> 0.0.9)
   gitlab-markup (~> 1.7.1)
   gitlab-net-dns (~> 0.9.1)
-  gitlab-pry-byebug
+  gitlab-omniauth-openid-connect (~> 0.4.0)
   gitlab-sidekiq-fetcher (= 0.5.6)
   gitlab-styles (~> 6.2.0)
   gitlab_chronic_duration (~> 0.10.6.2)
   gitlab_omniauth-ldap (~> 2.1.1)
   gon (~> 6.4.0)
   google-api-client (~> 0.33)
-  google-protobuf (~> 3.14.0)
+  google-protobuf (~> 3.15.8)
   gpgme (~> 2.0.19)
   grape (~> 1.5.2)
-  grape-entity (~> 0.7.1)
-  grape-path-helpers (~> 1.6.1)
+  grape-entity (~> 0.9.0)
+  grape-path-helpers (~> 1.6.3)
   grape_logging (~> 1.7)
   graphiql-rails (~> 1.4.10)
   graphlient (~> 0.4.0)
@@ -1465,7 +1513,6 @@ DEPENDENCIES
   jira-ruby (~> 2.1.4)
   js_regex (~> 3.4)
   json (~> 2.3.0)
-  json-schema (~> 2.8.0)
   json_schemer (~> 0.2.12)
   jwt (~> 2.1.0)
   kaminari (~> 1.0)
@@ -1513,18 +1560,18 @@ DEPENDENCIES
   omniauth-shibboleth (~> 1.3.0)
   omniauth-twitter (~> 1.4)
   omniauth_crowd (~> 2.4.0)
-  omniauth_openid_connect (~> 0.3.5)
   org-ruby (~> 0.9.12)
   parallel (~> 1.19)
   parslet (~> 1.8)
   peek (~> 1.1)
   pg (~> 1.1)
-  pg_query (~> 1.3.0)
+  pg_query (~> 2.0.3)
   png_quantizator (~> 0.2.1)
   premailer-rails (~> 1.10.3)
   prometheus-client-mmap (~> 0.12.0)
+  pry-byebug
   pry-rails (~> 0.3.9)
-  pry-remote
+  pry-shell (~> 0.4.0)
   puma (~> 5.1.1)
   puma_worker_killer (~> 0.3.1)
   rack (~> 2.2.3)
@@ -1579,6 +1626,8 @@ DEPENDENCIES
   simplecov-cobertura (~> 1.3.1)
   slack-messenger (~> 2.3.4)
   snowplow-tracker (~> 0.6.1)
+  solargraph (~> 0.40.4)
+  spamcheck (~> 0.1.0)
   spring (~> 2.1.0)
   spring-commands-rspec (~> 1.0.4)
   sprockets (~> 3.7.0)

pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix

@@ -455,10 +455,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "05rgxg4pz4bc4xk34w5grv0yp1j94wf571w84lf3xgqcbs42ip2f";
+      sha256 = "16dwqn33kmxkqkv51cwiikdkbrdjfsymlnc0rgbjwilmym8a9phq";
       type = "gem";
     };
-    version = "1.0.2";
+    version = "1.0.4";
+  };
+  backport = {
+    groups = ["default" "development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1xmjljpyx5ly078gi0lmmgkv4y0msxxa3hmv74bzxzp3l8qbn5vc";
+      type = "gem";
+    };
+    version = "1.1.2";
   };
   base32 = {
     groups = ["default"];
@@ -500,6 +510,16 @@
     };
     version = "1.0.0";
   };
+  benchmark = {
+    groups = ["default" "development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1jvrl7400fv7v2jjri1r7ilj3sri36hzipwwgpn5psib4c9c59c6";
+      type = "gem";
+    };
+    version = "0.1.1";
+  };
   benchmark-ips = {
     groups = ["development" "test"];
     platforms = [];
@@ -636,10 +656,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1i1bm7r8n67cafd9p3ck7vdmng921b41n9znvlfaz7cy8a3gsrgm";
+      sha256 = "1viqcpsngy9fqjd68932m43ad6xj656d1x33nx9565q57chgi29k";
       type = "gem";
     };
-    version = "3.34.0";
+    version = "3.35.3";
   };
   capybara-screenshot = {
     dependencies = ["capybara" "launchy"];
@@ -1014,6 +1034,16 @@
     };
     version = "0.1.0";
   };
+  declarative_policy = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0k2wl0jr0jq64gy7ibb1ipm2dzqil7y66vyffwx81g7sqchh7xh6";
+      type = "gem";
+    };
+    version = "1.0.0";
+  };
   default_value_for = {
     dependencies = ["activerecord"];
     groups = ["default"];
@@ -1248,6 +1278,16 @@
     };
     version = "1.4.0";
   };
+  e2mmap = {
+    groups = ["default" "development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0n8gxjb63dck3vrmsdcqqll7xs7f3wk78mw8w0gdk9wp5nx6pvj5";
+      type = "gem";
+    };
+    version = "0.1.0";
+  };
   ecma-re-validator = {
     dependencies = ["regexp_parser"];
     groups = ["default"];
@@ -1851,10 +1891,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1hbc2frfyxxlar9ggpnl4x090nw1nlriazzkdgjz3r4mx4ihja1b";
+      sha256 = "1l0zq04lhqbzg0grca1c0p3a5gb9jdlhy41dhlgnrsaf7k6xads6";
       type = "gem";
     };
-    version = "13.11.0.pre.rc1";
+    version = "13.12.0.pre.rc1";
   };
   github-markup = {
     groups = ["default"];
@@ -1894,21 +1934,21 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ivkbq50fhm39zwyfac4q3y0qkrsk3hmrk1ggyhz1yphkq38qvq7";
+      sha256 = "0h40p9v034jczialkh4brrv7karrx6a95mhrfpfs17p800lighzz";
       type = "gem";
     };
-    version = "1.1.1";
+    version = "2.0.0";
   };
   gitlab-experiment = {
-    dependencies = ["activesupport" "scientist"];
+    dependencies = ["activesupport" "request_store" "scientist"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ccjmm10pjvpzy5m7b86mxd2mg2x0k4y0c4cim0r4y7sy2c115mz";
+      sha256 = "18xc1785b9h0vwlqgi2m0mhjim6jaqqpi8nnl4hh8mbjd4d6kf1j";
       type = "gem";
     };
-    version = "0.5.3";
+    version = "0.5.4";
   };
   gitlab-fog-azure-rm = {
     dependencies = ["azure-storage-blob" "azure-storage-common" "fog-core" "fog-json" "mime-types" "ms_rest_azure"];
@@ -1938,20 +1978,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0184rq6sal3xz4f0w5iaa5zf3q55i4dh0rlvr25l1g0s2imwr3fa";
+      sha256 = "1y1sk3xmxj14nzx7v2zgq4q4d5lh4v1pvhs03n03j3kp4fbrj469";
       type = "gem";
     };
-    version = "0.16.2";
+    version = "0.17.1";
   };
   gitlab-license = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1rfyxchshl2h0c2dpsy1wa751l02i22nv5mkhygfwnbi0ndkzqmg";
+      sha256 = "07qcbdrxqwbri0kgiamrvx9y7cii3smf94g6scgn2l369m6955x1";
       type = "gem";
     };
-    version = "1.4.0";
+    version = "1.5.0";
   };
   gitlab-mail_room = {
     groups = ["default"];
@@ -1983,20 +2023,16 @@
     };
     version = "0.9.1";
   };
-  gitlab-pry-byebug = {
-    dependencies = ["byebug" "pry"];
-    groups = ["development" "test"];
-    platforms = [{
-      engine = "maglev";
-    } {
-      engine = "ruby";
-    }];
+  gitlab-omniauth-openid-connect = {
+    dependencies = ["addressable" "omniauth" "openid_connect"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0sp33vzzw8b7q9d8kb4pw8cl5fzlbffdpwz125x1g3kdiwz8xp3j";
+      sha256 = "16vbdyp2ml2i59xnpk0w5grh441kxcdpr639yzv69brjnrf3h9di";
       type = "gem";
     };
-    version = "3.9.0";
+    version = "0.4.0";
   };
   gitlab-sidekiq-fetcher = {
     dependencies = ["sidekiq"];
@@ -2091,10 +2127,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0pbm2kjhxvazx9d5c071bxcjx5cbip6d2y36dii2a4558nqjd12p";
+      sha256 = "0d9ayd4c69iag9nny7yydjx6dw4ymd52x1kv917ngv3vmsdkv51x";
       type = "gem";
     };
-    version = "3.14.0";
+    version = "3.15.8";
   };
   googleapis-common-protos-types = {
     dependencies = ["google-protobuf"];
@@ -2102,10 +2138,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1aava1b75n056s24gn7ajrkmm6s3xa3swl62dl5q9apw4marghji";
+      sha256 = "0074jk8fdl5rh7hfgx00n17sg493xrylkjkslx2d7cj5mk6hwn7d";
       type = "gem";
     };
-    version = "1.0.5";
+    version = "1.0.6";
   };
   googleauth = {
     dependencies = ["faraday" "jwt" "memoist" "multi_json" "os" "signet"];
@@ -2146,10 +2182,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1w78wylkhdkc0s6n6d20hggbb3pl3ladzzd5lx6ack2iswybx7b9";
+      sha256 = "0sqk33djlyvkinj0vxblfcib86bk9dy0iq2c3j2yalxyrpns3kfr";
       type = "gem";
     };
-    version = "0.7.1";
+    version = "0.9.0";
   };
   grape-path-helpers = {
     dependencies = ["activesupport" "grape" "rake" "ruby2_keywords"];
@@ -2157,10 +2193,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1xdp7b5fnvm89szy8ghpl6wm125iq7f0qnhibj5bxqrvg3xyhc2m";
+      sha256 = "1jbajciakiq9wwax2x11jzhmwzkcpkb4c0gfl01aj8a3l99gvgs9";
       type = "gem";
     };
-    version = "1.6.1";
+    version = "1.6.3";
   };
   grape_logging = {
     dependencies = ["grape" "rack"];
@@ -2566,6 +2602,16 @@
     };
     version = "1.1.0";
   };
+  jaro_winkler = {
+    groups = ["default" "development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1y8l6k34svmdyqxya3iahpwbpvmn3fswhwsvrz0nk1wyb8yfihsh";
+      type = "gem";
+    };
+    version = "1.5.4";
+  };
   jira-ruby = {
     dependencies = ["activesupport" "atlassian-jwt" "multipart-post" "oauth"];
     groups = ["default"];
@@ -2619,17 +2665,6 @@
     };
     version = "1.13.0";
   };
-  json-schema = {
-    dependencies = ["addressable"];
-    groups = ["test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1yv5lfmr2nzd14af498xqd5p89f3g080q8wk0klr3vxgypsikkb5";
-      type = "gem";
-    };
-    version = "2.8.1";
-  };
   json_schemer = {
     dependencies = ["ecma-re-validator" "hana" "regexp_parser" "uri_template"];
     groups = ["default"];
@@ -3620,17 +3655,6 @@
     };
     version = "2.4.0";
   };
-  omniauth_openid_connect = {
-    dependencies = ["addressable" "omniauth" "openid_connect"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1wxf52yggvwmyg6f9fiykh1sk51xx34i6x6m8f06ia56npslc4aw";
-      type = "gem";
-    };
-    version = "0.3.5";
-  };
   open4 = {
     groups = ["default" "development"];
     platforms = [];
@@ -3647,10 +3671,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0r50vwf9hsf6r8gx5mwqs3w3w92l864ikiz9d0fcibqsr1489pbg";
+      sha256 = "1nqhgvq006h6crbp8lffw66ll46zf319c2637g4sybdclglismma";
       type = "gem";
     };
-    version = "1.1.8";
+    version = "1.2.0";
   };
   openssl = {
     groups = ["default"];
@@ -3754,6 +3778,17 @@
     };
     version = "1.8.2";
   };
+  pastel = {
+    dependencies = ["tty-color"];
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0xash2gj08dfjvq4hy6l1z22s5v30fhizwgs10d6nviggpxsj7a8";
+      type = "gem";
+    };
+    version = "0.8.0";
+  };
   peek = {
     dependencies = ["railties"];
     groups = ["default"];
@@ -3776,14 +3811,15 @@
     version = "1.2.3";
   };
   pg_query = {
+    dependencies = ["google-protobuf"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1i9l3y502ddm2lq3ajhxhqq17vs9hgxkxm443yw221ccibcfh6qf";
+      sha256 = "1mii63kgppy2zil2qn54c94z93b6ama6x7gq6rbv4xxlfk8ncrag";
       type = "gem";
     };
-    version = "1.3.0";
+    version = "2.0.3";
   };
   plist = {
     groups = ["default"];
@@ -3884,6 +3920,17 @@
     };
     version = "0.13.1";
   };
+  pry-byebug = {
+    dependencies = ["byebug" "pry"];
+    groups = ["development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "096y5vmzpyy4x9h4ky4cs4y7d19vdq9vbwwrqafbh5gagzwhifiv";
+      type = "gem";
+    };
+    version = "3.9.0";
+  };
   pry-rails = {
     dependencies = ["pry"];
     groups = ["development" "test"];
@@ -3895,16 +3942,16 @@
     };
     version = "0.3.9";
   };
-  pry-remote = {
-    dependencies = ["pry" "slop"];
+  pry-shell = {
+    dependencies = ["pry" "tty-markdown" "tty-prompt"];
     groups = ["development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10g1wrkcy5v5qyg9fpw1cag6g5rlcl1i66kn00r7kwqkzrdhd7nm";
+      sha256 = "1315j8klxd404xxmcw1c6rlx7j445dzx62q5sggzvd59sl1amkf5";
       type = "gem";
     };
-    version = "0.1.8";
+    version = "0.4.0";
   };
   public_suffix = {
     groups = ["default" "development" "test"];
@@ -5078,16 +5125,6 @@
     };
     version = "2.3.4";
   };
-  slop = {
-    groups = ["default" "development" "test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "00w8g3j7k7kl8ri2cf1m58ckxk8rn350gp4chfscmgv6pq1spk3n";
-      type = "gem";
-    };
-    version = "3.6.0";
-  };
   snowplow-tracker = {
     dependencies = ["contracts"];
     groups = ["default"];
@@ -5099,6 +5136,28 @@
     };
     version = "0.6.1";
   };
+  solargraph = {
+    dependencies = ["backport" "benchmark" "e2mmap" "jaro_winkler" "kramdown" "kramdown-parser-gfm" "parser" "reverse_markdown" "rubocop" "thor" "tilt" "yard"];
+    groups = ["development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0xrad7amwf3nmdbif566qprk6xvwydxwz0s7arnzpvr01anc9gcl";
+      type = "gem";
+    };
+    version = "0.40.4";
+  };
+  spamcheck = {
+    dependencies = ["grpc"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0n307r7y819gq21yqhlni3r455cgcg3nc5318rhhx1bs99qs793r";
+      type = "gem";
+    };
+    version = "0.1.0";
+  };
   spring = {
     groups = ["development" "test"];
     platforms = [];
@@ -5214,16 +5273,37 @@
     };
     version = "0.8.0";
   };
+  strings = {
+    dependencies = ["strings-ansi" "unicode-display_width" "unicode_utils"];
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1yynb0qhhhplmpzavfrrlwdnd1rh7rkwzcs4xf0mpy2wr6rr6clk";
+      type = "gem";
+    };
+    version = "0.2.1";
+  };
+  strings-ansi = {
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "120wa6yjc63b84lprglc52f40hx3fx920n4dmv14rad41rv2s9lh";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
   swd = {
     dependencies = ["activesupport" "attr_required" "httpclient"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1s2vjb6f13za7p1iycl2p73d3p202xa6xny9fjrp8ynwsqix7lyd";
+      sha256 = "0c5cdpykx2h4jx8q01hjhv8f0plw5r9iqm2i1m0ijiyk7dqm824w";
       type = "gem";
     };
-    version = "1.1.2";
+    version = "1.2.0";
   };
   sys-filesystem = {
     dependencies = ["ffi"];
@@ -5465,6 +5545,69 @@
     };
     version = "0.7.11";
   };
+  tty-color = {
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0aik4kmhwwrmkysha7qibi2nyzb4c8kp42bd5vxnf8sf7b53g73g";
+      type = "gem";
+    };
+    version = "0.6.0";
+  };
+  tty-cursor = {
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0j5zw041jgkmn605ya1zc151bxgxl6v192v2i26qhxx7ws2l2lvr";
+      type = "gem";
+    };
+    version = "0.7.1";
+  };
+  tty-markdown = {
+    dependencies = ["kramdown" "pastel" "rouge" "strings" "tty-color" "tty-screen"];
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0hp6b6mcawg563098gs93wr49xmg871lkaj8m8gwk2va3zvqw7i5";
+      type = "gem";
+    };
+    version = "0.7.0";
+  };
+  tty-prompt = {
+    dependencies = ["pastel" "tty-reader"];
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1j4y8ik82azjxshgd4i1v4wwhsv3g9cngpygxqkkz69qaa8cxnzw";
+      type = "gem";
+    };
+    version = "0.23.1";
+  };
+  tty-reader = {
+    dependencies = ["tty-cursor" "tty-screen" "wisper"];
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1cf2k7w7d84hshg4kzrjvk9pkyc2g1m3nx2n1rpmdcf0hp4p4af6";
+      type = "gem";
+    };
+    version = "0.9.0";
+  };
+  tty-screen = {
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "18jr6s1cg8yb26wzkqa6874q0z93rq0y5aw092kdqazk71y6a235";
+      type = "gem";
+    };
+    version = "0.8.1";
+  };
   tzinfo = {
     dependencies = ["thread_safe"];
     groups = ["default" "development" "test"];
@@ -5751,6 +5894,16 @@
     };
     version = "0.8.1";
   };
+  wisper = {
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1rpsi0ziy78cj82sbyyywby4d0aw0a5q84v65qd28vqn79fbq5yf";
+      type = "gem";
+    };
+    version = "2.0.1";
+  };
   with_env = {
     groups = ["default" "development" "test"];
     platforms = [];
@@ -5802,6 +5955,16 @@
     };
     version = "1.4.1";
   };
+  yard = {
+    groups = ["default" "development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0qzr5j1a1cafv81ib3i51qyl8jnmwdxlqi3kbiraldzpbjh4ln9h";
+      type = "gem";
+    };
+    version = "0.9.26";
+  };
   zeitwerk = {
     groups = ["default" "development" "test"];
     platforms = [];

pkgs/applications/version-management/gitlab/update.py

@@ -131,9 +131,11 @@ def update_rubyenv():
     data = _get_data_json()
     rev = data['rev']
 
-    for fn in ['Gemfile.lock', 'Gemfile']:
-        with open(rubyenv_dir / fn, 'w') as f:
-            f.write(repo.get_file(fn, rev))
+    with open(rubyenv_dir / 'Gemfile.lock', 'w') as f:
+        f.write(repo.get_file('Gemfile.lock', rev))
+    with open(rubyenv_dir / 'Gemfile', 'w') as f:
+        original = repo.get_file('Gemfile', rev)
+        f.write(re.sub(r".*mail-smtp_pool.*", "", original))
 
     subprocess.check_output(['bundle', 'lock'], cwd=rubyenv_dir)
     subprocess.check_output(['bundix'], cwd=rubyenv_dir)

pkgs/applications/video/kooha/default.nix

@@ -1,17 +1,17 @@
 { lib, fetchFromGitHub, appstream-glib, desktop-file-utils, glib
-, gobject-introspection, gst_all_1, gtk3, libhandy, librsvg, meson, ninja
+, gobject-introspection, gst_all_1, gtk4, libadwaita, librsvg, meson, ninja
 , pkg-config, python3, wrapGAppsHook }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "kooha";
-  version = "1.1.3";
+  version = "1.2.1";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "SeaDve";
     repo = "Kooha";
     rev = "v${version}";
-    sha256 = "14lrx6wplvlk3cg3wij88h4ydp3m69pw7lvvzrq3j9qnh431bs36";
+    sha256 = "1qwbzdn0n1nxcfci1bhhkfchdhw5yz74fdvsa84cznyyx2jils8w";
   };
 
   buildInputs = [
@@ -19,8 +19,8 @@ python3.pkgs.buildPythonApplication rec {
     gobject-introspection
     gst_all_1.gstreamer
     gst_all_1.gst-plugins-base
-    gtk3
-    libhandy
+    gtk4
+    libadwaita
     librsvg
   ];
 
@@ -48,6 +48,10 @@ python3.pkgs.buildPythonApplication rec {
     patchShebangs build-aux/meson/postinstall.py
   '';
 
+  installCheckPhase = ''
+    $out/bin/kooha --help
+  '';
+
   meta = with lib; {
     description = "Simple screen recorder";
     homepage = "https://github.com/SeaDve/Kooha";

pkgs/applications/virtualization/virt-manager/default.nix

@@ -32,10 +32,9 @@ python3Packages.buildPythonApplication rec {
     gobject-introspection # Temporary fix, see https://github.com/NixOS/nixpkgs/issues/56943
   ] ++ optional spiceSupport spice-gtk;
 
-  propagatedBuildInputs = with python3Packages;
-    [
-      pygobject3 ipaddress libvirt libxml2 requests
-    ];
+  propagatedBuildInputs = with python3Packages; [
+    pygobject3 ipaddress libvirt libxml2 requests cdrtools
+  ];
 
   patchPhase = ''
     sed -i 's|/usr/share/libvirt/cpu_map.xml|${system-libvirt}/share/libvirt/cpu_map.xml|g' virtinst/capabilities.py

pkgs/build-support/pkg-config-wrapper/add-flags.sh

@@ -6,7 +6,7 @@ var_templates_list=(
 accumulateRoles
 
 for var in "${var_templates_list[@]}"; do
-    mangleVarList "$var" ${role_suffixes[@]+"${role_suffixes[@]}"}
+    mangleVarListGeneric ":" "$var" ${role_suffixes[@]+"${role_suffixes[@]}"}
 done
 
 export NIX_PKG_CONFIG_WRAPPER_FLAGS_SET_@suffixSalt@=1

pkgs/build-support/wrapper-common/utils.bash

@@ -13,7 +13,9 @@ accumulateRoles() {
     fi
 }
 
-mangleVarList() {
+mangleVarListGeneric() {
+    local sep="$1"
+    shift
     local var="$1"
     shift
     local -a role_suffixes=("$@")
@@ -25,11 +27,15 @@ mangleVarList() {
     for suffix in "${role_suffixes[@]}"; do
         local inputVar="${var}${suffix}"
         if [ -v "$inputVar" ]; then
-            export ${outputVar}+="${!outputVar:+ }${!inputVar}"
+            export ${outputVar}+="${!outputVar:+$sep}${!inputVar}"
         fi
     done
 }
 
+mangleVarList() {
+    mangleVarListGeneric " " "$@"
+}
+
 mangleVarBool() {
     local var="$1"
     shift

pkgs/development/compilers/halide/default.nix

@@ -41,7 +41,17 @@ llvmPackages.stdenv.mkDerivation rec {
   # Note: only openblas and not atlas part of this Nix expression
   # see pkgs/development/libraries/science/math/liblapack/3.5.0.nix
   # to get a hint howto setup atlas instead of openblas
-  buildInputs = [ llvmPackages.llvm libpng libjpeg mesa eigen openblas ];
+  buildInputs = [
+    llvmPackages.llvm
+    llvmPackages.lld
+    llvmPackages.openmp
+    llvmPackages.libclang
+    libpng
+    libjpeg
+    mesa
+    eigen
+    openblas
+  ];
 
   nativeBuildInputs = [ cmake ];
 

pkgs/development/compilers/llvm/10/clang/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, llvm_meta, fetch, cmake, libxml2, libllvm, version, clang-tools-extra_src, python3
+{ lib, stdenv, llvm_meta, fetch, substituteAll, cmake, libxml2, libllvm, version, clang-tools-extra_src, python3
 , buildLlvmTools
 , fixDarwinDylibNames
 , enableManpages ? false
@@ -46,6 +46,10 @@ let
       # https://reviews.llvm.org/D51899
       ./compiler-rt-baremetal.patch
       ./gnu-install-dirs.patch
+      (substituteAll {
+        src = ../../clang-6-10-LLVMgold-path.patch;
+        libllvmLibdir = "${libllvm.lib}/lib";
+      })
     ];
 
     postPatch = ''
@@ -64,12 +68,7 @@ let
 
     outputs = [ "out" "lib" "dev" "python" ];
 
-    # Clang expects to find LLVMgold in its own prefix
     postInstall = ''
-      if [ -e ${libllvm.lib}/lib/LLVMgold.so ]; then
-        ln -sv ${libllvm.lib}/lib/LLVMgold.so $lib/lib
-      fi
-
       ln -sv $out/bin/clang $out/bin/cpp
 
       # Move libclang to 'lib' output

pkgs/development/compilers/llvm/11/clang/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, llvm_meta, fetch, fetchpatch, cmake, libxml2, libllvm, version, clang-tools-extra_src, python3
+{ lib, stdenv, llvm_meta, fetch, fetchpatch, substituteAll, cmake, libxml2, libllvm, version, clang-tools-extra_src, python3
 , buildLlvmTools
 , fixDarwinDylibNames
 , enableManpages ? false
@@ -57,6 +57,10 @@ let
         excludes = [ "docs/*" "test/*" ];
         sha256 = "0gxgmi0qbm89mq911dahallhi8m6wa9vpklklqmxafx4rplrr8ph";
       })
+      (substituteAll {
+        src = ../../clang-11-12-LLVMgold-path.patch;
+        libllvmLibdir = "${libllvm.lib}/lib";
+      })
     ];
 
     postPatch = ''
@@ -75,12 +79,7 @@ let
 
     outputs = [ "out" "lib" "dev" "python" ];
 
-    # Clang expects to find LLVMgold in its own prefix
     postInstall = ''
-      if [ -e ${libllvm.lib}/lib/LLVMgold.so ]; then
-        ln -sv ${libllvm.lib}/lib/LLVMgold.so $lib/lib
-      fi
-
       ln -sv $out/bin/clang $out/bin/cpp
 
       # Move libclang to 'lib' output

pkgs/development/compilers/llvm/12/clang/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, llvm_meta, fetch, cmake, libxml2, libllvm, version, clang-tools-extra_src, python3
+{ lib, stdenv, llvm_meta, fetch, substituteAll, cmake, libxml2, libllvm, version, clang-tools-extra_src, python3
 , buildLlvmTools
 , fixDarwinDylibNames
 , enableManpages ? false
@@ -44,6 +44,10 @@ let
       ./purity.patch
       # https://reviews.llvm.org/D51899
       ./gnu-install-dirs.patch
+      (substituteAll {
+        src = ../../clang-11-12-LLVMgold-path.patch;
+        libllvmLibdir = "${libllvm.lib}/lib";
+      })
     ];
 
     postPatch = ''
@@ -59,12 +63,7 @@ let
 
     outputs = [ "out" "lib" "dev" "python" ];
 
-    # Clang expects to find LLVMgold in its own prefix
     postInstall = ''
-      if [ -e ${libllvm.lib}/lib/LLVMgold.so ]; then
-        ln -sv ${libllvm.lib}/lib/LLVMgold.so $lib/lib
-      fi
-
       ln -sv $out/bin/clang $out/bin/cpp
 
       # Move libclang to 'lib' output

pkgs/development/compilers/llvm/5/clang/LLVMgold-path.patch

@@ -0,0 +1,14 @@
+diff --git a/lib/Driver/ToolChains/CommonArgs.cpp b/lib/Driver/ToolChains/CommonArgs.cpp
+index 00bd60bc24bb..17416b0bd3c0 100644
+--- a/lib/Driver/ToolChains/CommonArgs.cpp
++++ b/lib/Driver/ToolChains/CommonArgs.cpp
+@@ -376,8 +376,7 @@ void tools::AddGoldPlugin(const ToolChain &ToolChain, const ArgList &Args,
+   // as gold requires -plugin to come before any -plugin-opt that -Wl might
+   // forward.
+   CmdArgs.push_back("-plugin");
+-  std::string Plugin =
+-      ToolChain.getDriver().Dir + "/../lib" CLANG_LIBDIR_SUFFIX "/LLVMgold.so";
++  std::string Plugin = "@libllvmLibdir@" "/LLVMgold.so";
+   CmdArgs.push_back(Args.MakeArgString(Plugin));
+ 
+   // Try to pass driver level flags relevant to LTO code generation down to

pkgs/development/compilers/llvm/5/clang/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, llvm_meta, fetch, cmake, libxml2, libllvm, version, clang-tools-extra_src, python3
+{ lib, stdenv, llvm_meta, fetch, substituteAll, cmake, libxml2, libllvm, version, clang-tools-extra_src, python3
 , buildLlvmTools
 , fixDarwinDylibNames
 , enableManpages ? false
@@ -43,6 +43,10 @@ let
     patches = [
       ./purity.patch
       ./gnu-install-dirs.patch
+      (substituteAll {
+        src = ./LLVMgold-path.patch;
+        libllvmLibdir = "${libllvm.lib}/lib";
+      })
     ];
 
     postPatch = ''
@@ -58,12 +62,7 @@ let
 
     outputs = [ "out" "lib" "dev" "python" ];
 
-    # Clang expects to find LLVMgold in its own prefix
     postInstall = ''
-      if [ -e ${libllvm.lib}/lib/LLVMgold.so ]; then
-        ln -sv ${libllvm.lib}/lib/LLVMgold.so $lib/lib
-      fi
-
       ln -sv $out/bin/clang $out/bin/cpp
 
       # Move libclang to 'lib' output