Merge master into haskell-updates

2024-09-22 05:19:00 +02:00 · 2021-08-22 00:06:15 +00:00 · 2021-08-22 00:06:15 +00:00 · 4c4f7353fa
parent 13f70bfa7a 1c145df9ae
commit 4c4f7353fa
238 changed files with 3748 additions and 1472 deletions
--- a/doc/languages-frameworks/index.xml
+++ b/doc/languages-frameworks/index.xml
@ -20,9 +20,9 @@
 <xi:include href="idris.section.xml" />
 <xi:include href="ios.section.xml" />
 <xi:include href="java.section.xml" />
+ <xi:include href="javascript.section.xml" />
 <xi:include href="lua.section.xml" />
 <xi:include href="maven.section.xml" />
- <xi:include href="node.section.xml" />
 <xi:include href="ocaml.section.xml" />
 <xi:include href="perl.section.xml" />
 <xi:include href="php.section.xml" />
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@ -0,0 +1,203 @@
+# Javascript {#language-javascript}
+
+## Introduction {#javascript-introduction}
+
+This contains instructions on how to package javascript applications. For instructions on how to add a cli package from npm please consult the #node.js section
+
+The various tools available will be listed in the [tools-overview](#javascript-tools-overview). Some general principles for packaging will follow. Finally some tool specific instructions will be given.
+
+## Tools overview {#javascript-tools-overview}
+
+## General principles {#javascript-general-principles}
+
+The following principles are given in order of importance with potential exceptions.
+
+### Try to use the same node version used upstream {#javascript-upstream-node-version}
+
+It is often not documented which node version is used upstream, but if it is, try to use the same version when packaging.
+
+This can be a problem if upstream is using the latest and greatest and you are trying to use an earlier version of node. Some cryptic errors regarding V8 may appear.
+
+An exception to this:
+
+### Try to respect the package manager originally used by upstream (and use the upstream lock file) {#javascript-upstream-package-manager}
+
+A lock file (package-lock.json, yarn.lock...) is supposed to make reproducible installations of node_modules for each tool.
+
+Guidelines of package managers, recommend to commit those lock files to the repos. If a particular lock file is present, it is a strong indication of which package manager is used upstream.
+
+It's better to try to use a nix tool that understand the lock file. Using a different tool might give you hard to understand error because different packages have been installed. An example of problems that could arise can be found [here](https://github.com/NixOS/nixpkgs/pull/126629). Upstream uses npm, but this is an attempt to package it with yarn2nix (that uses yarn.lock)
+
+Using a different tool forces to commit a lock file to the repository. Those files are fairly large, so when packaging for nixpkgs, this approach does not scale well.
+
+Exceptions to this rule are:
+
+- when you encounter one of the bugs from a nix tool. In each of the tool specific instructions, known problems will be detailed. If you have a problem with a particular tool, then it's best to try another tool, even if this means you will have to recreate a lock file and commit it to nixpkgs. In general yarn2nix has less known problems and so a simple search in nixpkgs will reveal many yarn.lock files commited
+- Some lock files contain particular version of a package that has been pulled off npm for some reason. In that case, you can recreate upstream lock (by removing the original and `npm install`, `yarn`, ...) and commit this to nixpkgs.
+- The only tool that supports workspaces (a feature of npm that helps manage sub-directories with different package.json from a single top level package.json) is yarn2nix. If upstream has workspaces you should try yarn2nix.
+
+### Try to use upstream package.json {#javascript-upstream-package-json}
+
+Exceptions to this rule are
+
+- Sometimes the upstream repo assumes some dependencies be installed globally. In that case you can add them manually to the upstream package.json (`yarn add xxx` or `npm install xxx`, ...). Dependencies that are installed locally can be executed with `npx` for cli tools. (e.g. `npx postcss ...`, this is how you can call those dependencies in the phases).
+- Sometimes there is a version conflict between some dependency requirements. In that case you can fix a version (by removing the `^`).
+- Sometimes the script defined in the package.json does not work as is. Some scripts for example use cli tools that might not be available, or cd in directory with a different package.json (for workspaces notably). In that case, it's perfectly fine to look at what the particular script is doing and break this down in the phases. In the build script you can see `build:*` calling in turns several other build scripts like `build:ui` or `build:server`. If one of those fails, you can try to separate those into:
+
+```Shell
+yarn build:ui
+yarn build:server
+# OR
+npm run build:ui
+npm run build:server
+```
+
+when you need to override a package.json. It's nice to use the one from the upstream src and do some explicit override. Here is an example.
+
+```nix
+patchedPackageJSON = final.runCommand "package.json" { } ''
+  ${jq}/bin/jq '.version = "0.4.0" |
+    .devDependencies."@jsdoc/cli" = "^0.2.5"
+    ${sonar-src}/package.json > $out
+'';
+```
+
+you will still need to commit the modified version of the lock files, but at least the overrides are explicit for everyone to see.
+
+### Using node_modules directly {#javascript-using-node_modules}
+
+each tool has an abstraction to just build the node_modules (dependencies) directory. you can always use the stdenv.mkDerivation with the node_modules to build the package (symlink the node_modules directory and then use the package build command). the node_modules abstraction can be also used to build some web framework frontends. For an example of this see how [plausible](https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/web-apps/plausible/default.nix) is built. mkYarnModules to make the derivation containing node_modules. Then when building the frontend you can just symlink the node_modules directory
+
+## javascript packages inside nixpkgs {#javascript-packages-nixpkgs}
+
+The `pkgs/development/node-packages` folder contains a generated collection of
+[NPM packages](https://npmjs.com/) that can be installed with the Nix package
+manager.
+
+As a rule of thumb, the package set should only provide _end user_ software
+packages, such as command-line utilities. Libraries should only be added to the
+package set if there is a non-NPM package that requires it.
+
+When it is desired to use NPM libraries in a development project, use the
+`node2nix` generator directly on the `package.json` configuration file of the
+project.
+
+The package set provides support for the official stable Node.js versions.
+The latest stable LTS release in `nodePackages`, as well as the latest stable
+Current release in `nodePackages_latest`.
+
+If your package uses native addons, you need to examine what kind of native
+build system it uses. Here are some examples:
+
+- `node-gyp`
+- `node-gyp-builder`
+- `node-pre-gyp`
+
+After you have identified the correct system, you need to override your package
+expression while adding in build system as a build input. For example, `dat`
+requires `node-gyp-build`, so [we override](https://github.com/NixOS/nixpkgs/blob/32f5e5da4a1b3f0595527f5195ac3a91451e9b56/pkgs/development/node-packages/default.nix#L37-L40) its expression in [`default.nix`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/node-packages/default.nix):
+
+```nix
+    dat = super.dat.override {
+      buildInputs = [ self.node-gyp-build pkgs.libtool pkgs.autoconf pkgs.automake ];
+      meta.broken = since "12";
+    };
+```
+
+To add a package from NPM to nixpkgs:
+
+1.  Modify `pkgs/development/node-packages/node-packages.json` to add, update
+    or remove package entries to have it included in `nodePackages` and
+    `nodePackages_latest`.
+2.  Run the script: `cd pkgs/development/node-packages && ./generate.sh`.
+3.  Build your new package to test your changes:
+    `cd /path/to/nixpkgs && nix-build -A nodePackages.<new-or-updated-package>`.
+    To build against the latest stable Current Node.js version (e.g. 14.x):
+    `nix-build -A nodePackages_latest.<new-or-updated-package>`
+4.  Add and commit all modified and generated files.
+
+For more information about the generation process, consult the
+[README.md](https://github.com/svanderburg/node2nix) file of the `node2nix`
+tool.
+
+## Tool specific instructions {#javascript-tool-specific}
+
+### node2nix {#javascript-node2nix}
+
+#### Preparation {#javascript-node2nix-preparation}
+
+you will need to generate a nix expression for the dependencies
+
+- don't forget the `-l package-lock.json` if there is a lock file
+- Most probably you will need the `--development` to include the `devDependencies`
+
+so the command will most likely be
+`node2nix --developmennt -l package-lock.json`
+
+[link to the doc in the repo](https://github.com/svanderburg/node2nix)
+
+#### Pitfalls {#javascript-node2nix-pitfalls}
+
+- if upstream package.json does not have a "version" attribute, node2nix will crash. You will need to add it like shown in [the package.json section](#javascript-upstream-package-json)
+- node2nix has some [bugs](https://github.com/svanderburg/node2nix/issues/238). related to working with lock files from npm distributed with nodejs-16_x
+- node2nix does not like missing packages from npm. If you see something like `Cannot resolve version: vue-loader-v16@undefined` then you might want to try another tool. The package might have been pulled off of npm.
+
+### yarn2nix {#javascript-yarn2nix}
+
+#### Preparation {#javascript-yarn2nix-preparation}
+
+you will need at least a yarn.lock and yarn.nix file
+
+- generate a yarn.lock in upstream if it is not already there
+- `yarn2nix > yarn.nix` will generate the dependencies in a nix format
+
+#### mkYarnPackage {#javascript-yarn2nix-mkYarnPackage}
+
+this will by default try to generate a binary. For package only generating static assets (Svelte, Vue, React...), you will need to explicitely override the build step with your instructions. It's important to use the `--offline` flag. For example if you script is `"build": "something"` in package.json use
+
+```nix
+buildPhase = ''
+  yarn build --offline
+'';
+```
+
+The dist phase is also trying to build a binary, the only way to override it is with
+
+```nix
+distPhase = "true";
+```
+
+the configure phase can sometimes fail because it tries to be too clever.
+One common override is
+
+```nix
+configurePhase = "ln -s $node_modules node_modules";
+```
+
+#### mkYarnModules {#javascript-yarn2nix-mkYarnModules}
+
+this will generate a derivation including the node_modules. If you have to build a derivation for an integrated web framework (rails, phoenix..), this is probably the easiest way. [Plausible](https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/web-apps/plausible/default.nix#L39) offers a good example of how to do this.
+
+#### Pitfalls {#javascript-yarn2nix-pitfalls}
+
+- if version is missing from upstream package.json, yarn will silently install nothing. In that case, you will need to override package.json as shown in the [package.json section](#javascript-upstream-package-json)
+
+## Outside of nixpkgs {#javascript-outside-nixpkgs}
+
+There are some other options available that can't be used inside nixpkgs. Those other options are written in nix. Importing them in nixpkgs will require moving the source code into nixpkgs. Using [Import From Derivation](https://nixos.wiki/wiki/Import_From_Derivation) is not allowed in hydra at present. If you are packaging something outside nixpkgs, those can be considered
+
+### npmlock2nix {#javascript-npmlock2nix}
+
+[npmlock2nix](https://github.com/nix-community/npmlock2nix) aims at building node_modules without code generation. It hasn't reached v1 yet, the api might be suject to change.
+
+#### Pitfalls {#javascript-npmlock2nix-pitfalls}
+
+- there are some [problems with npm v7](https://github.com/tweag/npmlock2nix/issues/45).
+
+### nix-npm-buildpackage {#javascript-nix-npm-buildpackage}
+
+[nix-npm-buildpackage](https://github.com/serokell/nix-npm-buildpackage) aims at building node_modules without code generation. It hasn't reached v1 yet, the api might change. It supports both package-lock.json and yarn.lock.
+
+#### Pitfalls {#javascript-nix-npm-buildpackage-pitfalls}
+
+- there are some [problems with npm v7](https://github.com/serokell/nix-npm-buildpackage/issues/33).
--- a/doc/languages-frameworks/node.section.md
+++ b/doc/languages-frameworks/node.section.md
@ -1,51 +0,0 @@
-# Node.js {#node.js}
-
-The `pkgs/development/node-packages` folder contains a generated collection of
-[NPM packages](https://npmjs.com/) that can be installed with the Nix package
-manager.
-
-As a rule of thumb, the package set should only provide *end user* software
-packages, such as command-line utilities. Libraries should only be added to the
-package set if there is a non-NPM package that requires it.
-
-When it is desired to use NPM libraries in a development project, use the
-`node2nix` generator directly on the `package.json` configuration file of the
-project.
-
-The package set provides support for the official stable Node.js versions.
-The latest stable LTS release in `nodePackages`, as well as the latest stable
-Current release in `nodePackages_latest`.
-
-If your package uses native addons, you need to examine what kind of native
-build system it uses. Here are some examples:
-
-* `node-gyp`
-* `node-gyp-builder`
-* `node-pre-gyp`
-
-After you have identified the correct system, you need to override your package
-expression while adding in build system as a build input. For example, `dat`
-requires `node-gyp-build`, so [we override](https://github.com/NixOS/nixpkgs/blob/32f5e5da4a1b3f0595527f5195ac3a91451e9b56/pkgs/development/node-packages/default.nix#L37-L40) its expression in [`default.nix`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/node-packages/default.nix):
-
-```nix
-    dat = super.dat.override {
-      buildInputs = [ self.node-gyp-build pkgs.libtool pkgs.autoconf pkgs.automake ];
-      meta.broken = since "12";
-    };
-```
-
-To add a package from NPM to nixpkgs:
-
- 1. Modify `pkgs/development/node-packages/node-packages.json` to add, update
-    or remove package entries to have it included in `nodePackages` and
-    `nodePackages_latest`.
- 2. Run the script: `cd pkgs/development/node-packages && ./generate.sh`.
- 3. Build your new package to test your changes:
-    `cd /path/to/nixpkgs && nix-build -A nodePackages.<new-or-updated-package>`.
-    To build against the latest stable Current Node.js version (e.g. 14.x):
-    `nix-build -A nodePackages_latest.<new-or-updated-package>`
- 4. Add and commit all modified and generated files.
-
-For more information about the generation process, consult the
-[README.md](https://github.com/svanderburg/node2nix) file of the `node2nix`
-tool.
--- a/doc/languages-frameworks/perl.section.md
+++ b/doc/languages-frameworks/perl.section.md
@ -122,7 +122,7 @@ ImageExifTool = buildPerlPackage {
  };

  buildInputs = lib.optional stdenv.isDarwin shortenPerlShebang;
-  postInstall = lib.optional stdenv.isDarwin ''
+  postInstall = lib.optionalString stdenv.isDarwin ''
    shortenPerlShebang $out/bin/exiftool
  '';
 };
--- a/doc/stdenv/meta.chapter.md
+++ b/doc/stdenv/meta.chapter.md
@ -114,6 +114,10 @@ For details, see [Licenses](#sec-meta-license).

 A list of the maintainers of this Nix expression. Maintainers are defined in [`nixpkgs/maintainers/maintainer-list.nix`](https://github.com/NixOS/nixpkgs/blob/master/maintainers/maintainer-list.nix). There is no restriction to becoming a maintainer, just add yourself to that list in a separate commit titled “maintainers: add alice”, and reference maintainers with `maintainers = with lib.maintainers; [ alice bob ]`.

+### `mainProgram` {#var-meta-mainProgram}
+
+The name of the main binary for the package. This effects the binary `nix run` executes and falls back to the name of the package. Example: `"rg"`
+
 ### `priority` {#var-meta-priority}

 The *priority* of the package, used by `nix-env` to resolve file name conflicts between packages. See the Nix manual page for `nix-env` for details. Example: `"10"` (a low-priority package).
--- a/lib/systems/platforms.nix
+++ b/lib/systems/platforms.nix
@ -233,7 +233,7 @@ rec {
    };
  };

-  scaleway-c1 = lib.recursiveUpdate armv7l-hf-multiplatform {
+  scaleway-c1 = armv7l-hf-multiplatform // {
    gcc = {
      cpu = "cortex-a9";
      fpu = "vfpv3";
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -4247,6 +4247,16 @@
    githubId = 147689;
    name = "Hans-Christian Esperer";
  };
+  hdhog = {
+    name = "Serg Larchenko";
+    email = "hdhog@hdhog.ru";
+    github = "hdhog";
+    githubId = 386666;
+    keys = [{
+      longkeyid = "rsa496/952EACB76703BA63";
+      fingerprint = "A25F 6321 AAB4 4151 4085  9924 952E ACB7 6703 BA63";
+    }];
+  };
  hectorj = {
    email = "hector.jusforgues+nixos@gmail.com";
    github = "hectorj";
@ -5358,7 +5368,7 @@
  };
  juaningan = {
    email = "juaningan@gmail.com";
-    github = "juaningan";
+    github = "uningan";
    githubId = 810075;
    name = "Juan Rodal";
  };
@ -5668,6 +5678,16 @@
    githubId = 148352;
    name = "Jim Fowler";
  };
+  kittywitch = {
+    email = "kat@kittywit.ch";
+    github = "kittywitch";
+    githubId = 67870215;
+    name = "kat witch";
+    keys = [{
+      longkeyid = "rsa4096/0x7248991EFA8EFBEE";
+      fingerprint = "01F5 0A29 D4AA 9117 5A11  BDB1 7248 991E FA8E FBEE";
+     }];
+  };
  kiwi = {
    email = "envy1988@gmail.com";
    github = "Kiwi";
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@ -182,6 +182,16 @@
        </para>
      </listitem>
    </itemizedlist>
+    <itemizedlist spacing="compact">
+      <listitem>
+        <para>
+          <link xlink:href="https://docs.fluidd.xyz/">fluidd</link>, a
+          Klipper web interface for managing 3d printers using
+          moonraker. Available as
+          <link linkend="opt-services.fluidd.enable">fluidd</link>.
+        </para>
+      </listitem>
+    </itemizedlist>
  </section>
  <section xml:id="sec-release-21.11-incompatibilities">
    <title>Backward Incompatibilities</title>
@ -273,7 +283,7 @@ Superuser created successfully.
      <listitem>
        <para>
          The <literal>staticjinja</literal> package has been upgraded
-          from 1.0.4 to 3.0.1
+          from 1.0.4 to 4.1.0
        </para>
      </listitem>
      <listitem>
@ -880,6 +890,14 @@ Superuser created successfully.
          New In Python 3.9 post</link> for more information.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <literal>qtile</literal> hase been updated from
+          <quote>0.16.0</quote> to <quote>0.18.0</quote>, please check
+          <link xlink:href="https://github.com/qtile/qtile/blob/master/CHANGELOG">qtile
+          changelog</link> for changes.
+        </para>
+      </listitem>
      <listitem>
        <para>
          The <literal>claws-mail</literal> package now references the
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@ -56,6 +56,8 @@ pt-services.clipcat.enable).
 * [navidrome](https://www.navidrome.org/), a personal music streaming server with
 subsonic-compatible api. Available as [navidrome](#opt-services.navidrome.enable).

+- [fluidd](https://docs.fluidd.xyz/), a Klipper web interface for managing 3d printers using moonraker. Available as [fluidd](#opt-services.fluidd.enable).
+
 ## Backward Incompatibilities {#sec-release-21.11-incompatibilities}

 - The `paperless` module and package have been removed. All users should migrate to the
@ -105,7 +107,7 @@ subsonic-compatible api. Available as [navidrome](#opt-services.navidrome.enable
      Superuser created successfully.
      ```

- The `staticjinja` package has been upgraded from 1.0.4 to 3.0.1
+- The `staticjinja` package has been upgraded from 1.0.4 to 4.1.0

 - The `erigon` ethereum node has moved to a new database format in `2021-05-04`, and requires a full resync

@ -254,6 +256,8 @@ To be able to access the web UI this port needs to be opened in the firewall.

 - `python3` now defaults to Python 3.9. Python 3.9 introduces many deprecation warnings, please look at the [What's New In Python 3.9 post](https://docs.python.org/3/whatsnew/3.9.html) for more information.

+- `qtile` hase been updated from '0.16.0' to '0.18.0', please check [qtile changelog](https://github.com/qtile/qtile/blob/master/CHANGELOG) for changes.
+
 - The `claws-mail` package now references the new GTK+ 3 release branch, major version 4. To use the GTK+ 2 releases, one can install the `claws-mail-gtk2` package.

 - The wordpress module provides a new interface which allows to use different webservers with the new option [`services.wordpress.webserver`](options.html#opt-services.wordpress.webserver).  Currently `httpd` and `nginx` are supported. The definitions of wordpress sites should now be set in [`services.wordpress.sites`](options.html#opt-services.wordpress.sites).
--- a/nixos/modules/hardware/all-firmware.nix
+++ b/nixos/modules/hardware/all-firmware.nix
@ -62,7 +62,7 @@ in {
        zd1211fw
        alsa-firmware
        sof-firmware
-        openelec-dvb-firmware
+        libreelec-dvb-firmware
      ] ++ optional (pkgs.stdenv.hostPlatform.isAarch32 || pkgs.stdenv.hostPlatform.isAarch64) raspberrypiWirelessFirmware
        ++ optionals (versionOlder config.boot.kernelPackages.kernel.version "4.13") [
        rtl8723bs-firmware
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -953,6 +953,7 @@
  ./services/web-apps/documize.nix
  ./services/web-apps/dokuwiki.nix
  ./services/web-apps/engelsystem.nix
+  ./services/web-apps/fluidd.nix
  ./services/web-apps/galene.nix
  ./services/web-apps/gerrit.nix
  ./services/web-apps/gotify-server.nix
--- a/nixos/modules/profiles/headless.nix
+++ b/nixos/modules/profiles/headless.nix
@ -9,7 +9,7 @@ with lib;
  boot.vesa = false;

  # Don't start a tty on the serial consoles.
-  systemd.services."serial-getty@ttyS0".enable = false;
+  systemd.services."serial-getty@ttyS0".enable = lib.mkDefault false;
  systemd.services."serial-getty@hvc0".enable = false;
  systemd.services."getty@tty1".enable = false;
  systemd.services."autovt@".enable = false;
--- a/nixos/modules/services/mail/dovecot.nix
+++ b/nixos/modules/services/mail/dovecot.nix
@ -467,10 +467,6 @@ in
    ];

    assertions = [
-      {
-        assertion = intersectLists cfg.protocols [ "pop3" "imap" ] != [];
-        message = "dovecot needs at least one of the IMAP or POP3 listeners enabled";
-      }
      {
        assertion = (cfg.sslServerCert == null) == (cfg.sslServerKey == null)
        && (cfg.sslCACert != null -> !(cfg.sslServerCert == null || cfg.sslServerKey == null));
--- a/nixos/modules/services/web-apps/fluidd.nix
+++ b/nixos/modules/services/web-apps/fluidd.nix
@ -0,0 +1,64 @@
+{ config, lib, pkgs, ... }:
+with lib;
+let
+  cfg = config.services.fluidd;
+  moonraker = config.services.moonraker;
+in
+{
+  options.services.fluidd = {
+    enable = mkEnableOption "Fluidd, a Klipper web interface for managing your 3d printer";
+
+    package = mkOption {
+      type = types.package;
+      description = "Fluidd package to be used in the module";
+      default = pkgs.fluidd;
+      defaultText = "pkgs.fluidd";
+    };
+
+    hostName = mkOption {
+      type = types.str;
+      default = "localhost";
+      description = "Hostname to serve fluidd on";
+    };
+
+    nginx = mkOption {
+      type = types.submodule
+        (import ../web-servers/nginx/vhost-options.nix { inherit config lib; });
+      default = { };
+      example = {
+        serverAliases = [ "fluidd.\${config.networking.domain}" ];
+      };
+      description = "Extra configuration for the nginx virtual host of fluidd.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.nginx = {
+      enable = true;
+      upstreams.fluidd-apiserver.servers."${moonraker.address}:${toString moonraker.port}" = { };
+      virtualHosts."${cfg.hostName}" = mkMerge [
+        cfg.nginx
+        {
+          root = mkForce "${cfg.package}/share/fluidd/htdocs";
+          locations = {
+            "/" = {
+              index = "index.html";
+              tryFiles = "$uri $uri/ /index.html";
+            };
+            "/index.html".extraConfig = ''
+              add_header Cache-Control "no-store, no-cache, must-revalidate";
+            '';
+            "/websocket" = {
+              proxyWebsockets = true;
+              proxyPass = "http://fluidd-apiserver/websocket";
+            };
+            "~ ^/(printer|api|access|machine|server)/" = {
+              proxyWebsockets = true;
+              proxyPass = "http://fluidd-apiserver$request_uri";
+            };
+          };
+        }
+      ];
+    };
+  };
+}
--- a/nixos/modules/services/web-servers/apache-httpd/default.nix
+++ b/nixos/modules/services/web-servers/apache-httpd/default.nix
@ -36,11 +36,12 @@ let
  dependentCertNames = unique (map (hostOpts: hostOpts.certName) acmeEnabledVhosts);

  mkListenInfo = hostOpts:
-    if hostOpts.listen != [] then hostOpts.listen
-    else (
-      optional (hostOpts.onlySSL || hostOpts.addSSL || hostOpts.forceSSL) { ip = "*"; port = 443; ssl = true; } ++
-      optional (!hostOpts.onlySSL) { ip = "*"; port = 80; ssl = false; }
-    );
+    if hostOpts.listen != [] then
+      hostOpts.listen
+    else
+      optionals (hostOpts.onlySSL || hostOpts.addSSL || hostOpts.forceSSL) (map (addr: { ip = addr; port = 443; ssl = true; }) hostOpts.listenAddresses) ++
+      optionals (!hostOpts.onlySSL) (map (addr: { ip = addr; port = 80; ssl = false; }) hostOpts.listenAddresses)
+    ;

  listenInfo = unique (concatMap mkListenInfo vhosts);

--- a/nixos/modules/services/web-servers/apache-httpd/vhost-options.nix
+++ b/nixos/modules/services/web-servers/apache-httpd/vhost-options.nix
@ -47,12 +47,29 @@ in
      ];
      description = ''
        Listen addresses and ports for this virtual host.
-        <note><para>
+        <note>
+        <para>
          This option overrides <literal>addSSL</literal>, <literal>forceSSL</literal> and <literal>onlySSL</literal>.
-        </para></note>
+        </para>
+        <para>
+          If you only want to set the addresses manually and not the ports, take a look at <literal>listenAddresses</literal>.
+        </para>
+        </note>
      '';
    };

+    listenAddresses = mkOption {
+      type = with types; nonEmptyListOf str;
+
+      description = ''
+        Listen addresses for this virtual host.
+        Compared to <literal>listen</literal> this only sets the addreses
+        and the ports are chosen automatically.
+      '';
+      default = [ "*" ];
+      example = [ "127.0.0.1" ];
+    };
+
    enableSSL = mkOption {
      type = types.bool;
      visible = false;
--- a/nixos/modules/services/x11/window-managers/qtile.nix
+++ b/nixos/modules/services/x11/window-managers/qtile.nix
@ -15,7 +15,7 @@ in
    services.xserver.windowManager.session = [{
      name = "qtile";
      start = ''
-        ${pkgs.qtile}/bin/qtile &
+        ${pkgs.qtile}/bin/qtile start &
        waitPID=$!
      '';
    }];
--- a/nixos/modules/virtualisation/amazon-image.nix
+++ b/nixos/modules/virtualisation/amazon-image.nix
@ -18,7 +18,15 @@ let
 in

 {
-  imports = [ ../profiles/headless.nix ./ec2-data.nix ./amazon-init.nix ];
+  imports = [
+    ../profiles/headless.nix
+    # Note: While we do use the headless profile, we also explicitly
+    # turn on the serial console on ttyS0 below. This is because
+    # AWS does support accessing the serial console:
+    # https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configure-access-to-serial-console.html
+    ./ec2-data.nix
+    ./amazon-init.nix
+  ];

  config = {

@ -49,7 +57,7 @@ in
    ];
    boot.initrd.kernelModules = [ "xen-blkfront" "xen-netfront" ];
    boot.initrd.availableKernelModules = [ "ixgbevf" "ena" "nvme" ];
-    boot.kernelParams = mkIf cfg.hvm [ "console=ttyS0" "random.trust_cpu=on" ];
+    boot.kernelParams = mkIf cfg.hvm [ "console=ttyS0,115200n8" "random.trust_cpu=on" ];

    # Prevent the nouveau kernel module from being loaded, as it
    # interferes with the nvidia/nvidia-uvm modules needed for CUDA.
@ -63,7 +71,12 @@ in
    boot.loader.grub.extraPerEntryConfig = mkIf (!cfg.hvm) "root (hd0)";
    boot.loader.grub.efiSupport = cfg.efi;
    boot.loader.grub.efiInstallAsRemovable = cfg.efi;
-    boot.loader.timeout = 0;
+    boot.loader.timeout = 1;
+    boot.loader.grub.extraConfig = ''
+      serial --unit=0 --speed=115200 --word=8 --parity=no --stop=1
+      terminal_output console serial
+      terminal_input console serial
+    '';

    boot.initrd.network.enable = true;

@ -127,15 +140,14 @@ in
        copy_bin_and_libs ${pkgs.util-linux}/sbin/swapon
      '';

-    # Don't put old configurations in the GRUB menu.  The user has no
-    # way to select them anyway.
-    boot.loader.grub.configurationLimit = 0;
-
    # Allow root logins only using the SSH key that the user specified
    # at instance creation time.
    services.openssh.enable = true;
    services.openssh.permitRootLogin = "prohibit-password";

+    # Enable the serial console on ttyS0
+    systemd.services."serial-getty@ttyS0".enable = true;
+
    # Creates symlinks for block device names.
    services.udev.packages = [ pkgs.ec2-utils ];

--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -136,6 +136,7 @@ in
  fish = handleTest ./fish.nix {};
  flannel = handleTestOn ["x86_64-linux"] ./flannel.nix {};
  fluentd = handleTest ./fluentd.nix {};
+  fluidd = handleTest ./fluidd.nix {};
  fontconfig-default-fonts = handleTest ./fontconfig-default-fonts.nix {};
  freeswitch = handleTest ./freeswitch.nix {};
  fsck = handleTest ./fsck.nix {};
--- a/nixos/tests/fluidd.nix
+++ b/nixos/tests/fluidd.nix
@ -0,0 +1,21 @@
+import ./make-test-python.nix ({ lib, ... }:
+
+with lib;
+
+{
+  name = "fluidd";
+  meta.maintainers = with maintainers; [ vtuan10 ];
+
+  nodes.machine = { pkgs, ... }: {
+    services.fluidd = {
+      enable = true;
+    };
+  };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("nginx.service")
+    machine.wait_for_open_port(80)
+    machine.succeed("curl -sSfL http://localhost/ | grep 'fluidd'")
+  '';
+})
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@ -1,30 +1,52 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
 , makeWrapper
-, alsa-lib
+, pkg-config
 , perl
-, withConplay ? !stdenv.targetPlatform.isWindows
+, withAlsa ? stdenv.hostPlatform.isLinux
+, alsa-lib
+, withPulse ? stdenv.hostPlatform.isLinux
+, libpulseaudio
+, withCoreAudio ? stdenv.hostPlatform.isDarwin
+, AudioUnit
+, AudioToolbox
+, withJack ? stdenv.hostPlatform.isUnix
+, jack
+, withConplay ? !stdenv.hostPlatform.isWindows
 }:

 stdenv.mkDerivation rec {
  pname = "mpg123";
-  version = "1.26.5";
+  version = "1.28.2";

  src = fetchurl {
    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-UCqX4Nk1vn432YczgCHY8wG641wohPKoPVnEtSRm7wY=";
+    sha256 = "006v44nz4nkpgvxz1k2vbbrfpa2m47hyydscs0wf3iysiyvd9vvy";
  };

  outputs = [ "out" ] ++ lib.optionals withConplay [ "conplay" ];

-  nativeBuildInputs = lib.optionals withConplay [ makeWrapper ];
+  nativeBuildInputs = lib.optionals withConplay [ makeWrapper ]
+    ++ lib.optionals (withPulse || withJack) [ pkg-config ];

  buildInputs = lib.optionals withConplay [ perl ]
-    ++ lib.optionals (!stdenv.isDarwin && !stdenv.targetPlatform.isWindows) [ alsa-lib ];
+    ++ lib.optionals withAlsa [ alsa-lib ]
+    ++ lib.optionals withPulse [ libpulseaudio ]
+    ++ lib.optionals withCoreAudio [ AudioUnit AudioToolbox ]
+    ++ lib.optionals withJack [ jack ];

-  configureFlags = lib.optional
-    (stdenv.hostPlatform ? mpg123)
-    "--with-cpu=${stdenv.hostPlatform.mpg123.cpu}";
+  configureFlags = [
+    "--with-audio=${lib.strings.concatStringsSep "," (
+      lib.optional withJack "jack"
+      ++ lib.optional withPulse "pulse"
+      ++ lib.optional withAlsa "alsa"
+      ++ lib.optional withCoreAudio "coreaudio"
+      ++ [ "dummy" ]
+    )}"
+  ] ++ lib.optional (stdenv.hostPlatform ? mpg123) "--with-cpu=${stdenv.hostPlatform.mpg123.cpu}";
+
+  enableParallelBuilding = true;

  postInstall = lib.optionalString withConplay ''
    mkdir -p $conplay/bin
@ -43,8 +65,8 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "Fast console MPEG Audio Player and decoder library";
    homepage = "https://mpg123.org";
-    license = licenses.lgpl21;
-    maintainers = [ maintainers.ftrvxmtrx ];
+    license = licenses.lgpl21Only;
+    maintainers = with maintainers; [ ftrvxmtrx ];
    platforms = platforms.all;
  };
 }
--- a/pkgs/applications/audio/zynaddsubfx/default.nix
+++ b/pkgs/applications/audio/zynaddsubfx/default.nix
@ -91,7 +91,7 @@ in stdenv.mkDerivation rec {

  # When building with zest GUI, patch plugins
  # and standalone executable to properly locate zest
-  postFixup = lib.optional (guiModule == "zest") ''
+  postFixup = lib.optionalString (guiModule == "zest") ''
    patchelf --set-rpath "${mruby-zest}:$(patchelf --print-rpath "$out/lib/lv2/ZynAddSubFX.lv2/ZynAddSubFX_ui.so")" \
      "$out/lib/lv2/ZynAddSubFX.lv2/ZynAddSubFX_ui.so"

--- a/pkgs/applications/blockchains/bisq-desktop/default.nix
+++ b/pkgs/applications/blockchains/bisq-desktop/default.nix
@ -8,63 +8,50 @@
 , openjdk11
 , dpkg
 , writeScript
-, coreutils
 , bash
 , tor
-, psmisc
+, gnutar
+, zip
+, xz
 }:

 let
  bisq-launcher = writeScript "bisq-launcher" ''
    #! ${bash}/bin/bash

-    # Setup a temporary Tor instance
-    TMPDIR=$(${coreutils}/bin/mktemp -d)
-    CONTROLPORT=$(${coreutils}/bin/shuf -i 9100-9499 -n 1)
-    SOCKSPORT=$(${coreutils}/bin/shuf -i 9500-9999 -n 1)
-    ${coreutils}/bin/head -c 1024 < /dev/urandom > $TMPDIR/cookie
+    # This is just a comment to convince Nix that Tor is a
+    # runtime dependency; The Tor binary is in a *.jar file,
+    # whereas Nix only scans for hashes in uncompressed text.
+    # ${bisq-tor}

-    ${tor}/bin/tor --SocksPort $SOCKSPORT --ControlPort $CONTROLPORT \
-      --ControlPortWriteToFile $TMPDIR/port --CookieAuthFile $TMPDIR/cookie \
-      --CookieAuthentication 1 >$TMPDIR/tor.log --RunAsDaemon 1
+    JAVA_TOOL_OPTIONS="-XX:+UseG1GC -XX:MaxHeapFreeRatio=10 -XX:MinHeapFreeRatio=5 -XX:+UseStringDeduplication" bisq-desktop-wrapped "$@"
+  '';

-    torpid=$(${psmisc}/bin/fuser $CONTROLPORT/tcp)
+  bisq-tor = writeScript "bisq-tor" ''
+    #! ${bash}/bin/bash

-    echo Temp directory: $TMPDIR
-    echo Tor PID: $torpid
-    echo Tor control port: $CONTROLPORT
-    echo Tor SOCKS port: $SOCKSPORT
-    echo Tor log: $TMPDIR/tor.log
-    echo Bisq log file: $TMPDIR/bisq.log
-
-    JAVA_TOOL_OPTIONS="-XX:MaxRAM=4g" bisq-desktop-wrapped \
-      --torControlCookieFile=$TMPDIR/cookie \
-      --torControlUseSafeCookieAuth \
-      --torControlPort $CONTROLPORT "$@" > $TMPDIR/bisq.log
-
-    echo Bisq exited. Killing Tor...
-    kill $torpid
+    exec ${tor}/bin/tor "$@"
  '';
 in
 stdenv.mkDerivation rec {
  pname = "bisq-desktop";
-  version = "1.7.0";
+  version = "1.7.2";

  src = fetchurl {
    url = "https://github.com/bisq-network/bisq/releases/download/v${version}/Bisq-64bit-${version}.deb";
-    sha256 = "0crry5k7crmrqn14wxiyrnhk09ac8a9ksqrwwky7jsnyah0bx5k4";
+    sha256 = "0b2rh9sphc9wffkawprrl20frgv0rah7y2k5sfxpjc3shgkqsw80";
  };

-  nativeBuildInputs = [ makeWrapper copyDesktopItems dpkg ];
+  nativeBuildInputs = [ makeWrapper copyDesktopItems imagemagick dpkg gnutar zip xz ];

  desktopItems = [
    (makeDesktopItem {
      name = "Bisq";
      exec = "bisq-desktop";
      icon = "bisq";
-      desktopName = "Bisq";
+      desktopName = "Bisq ${version}";
      genericName = "Decentralized bitcoin exchange";
-      categories = "Network;Utility;";
+      categories = "Network;P2P;";
    })
  ];

@ -72,6 +59,16 @@ stdenv.mkDerivation rec {
    dpkg -x $src .
  '';

+  buildPhase = ''
+    # Replace the embedded Tor binary (which is in a Tar archive)
+    # with one from Nixpkgs.
+
+    mkdir -p native/linux/x64/
+    cp ${bisq-tor} ./tor
+    tar -cJf native/linux/x64/tor.tar.xz tor
+    zip -r opt/bisq/lib/app/desktop-${version}-all.jar native
+  '';
+
  installPhase = ''
    runHook preInstall

@ -86,13 +83,15 @@ stdenv.mkDerivation rec {

    for n in 16 24 32 48 64 96 128 256; do
      size=$n"x"$n
-      ${imagemagick}/bin/convert opt/bisq/lib/Bisq.png -resize $size bisq.png
+      convert opt/bisq/lib/Bisq.png -resize $size bisq.png
      install -Dm644 -t $out/share/icons/hicolor/$size/apps bisq.png
    done;

    runHook postInstall
  '';

+  passthru.updateScript = ./update.sh;
+
  meta = with lib; {
    description = "A decentralized bitcoin exchange network";
    homepage = "https://bisq.network";
--- a/pkgs/applications/blockchains/bisq-desktop/update.sh
+++ b/pkgs/applications/blockchains/bisq-desktop/update.sh
@ -0,0 +1,22 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq gnused gnupg common-updater-scripts
+
+set -eu -o pipefail
+
+version="$(curl -s https://api.github.com/repos/bisq-network/bisq/releases| jq '.[] | {name,prerelease} | select(.prerelease==false) | limit(1;.[])' | sed 's/[\"v]//g' | head -n 1)"
+depname="Bisq-64bit-$version.deb"
+src="https://github.com/bisq-network/bisq/releases/download/v$version/$depname"
+signature="$src.asc"
+key="CB36 D7D2 EBB2 E35D 9B75 500B CD5D C1C5 29CD FD3B"
+
+pushd $(mktemp -d --suffix=-bisq-updater)
+export GNUPGHOME=$PWD/gnupg
+mkdir -m 700 -p "$GNUPGHOME"
+curl -L -o "$depname" -- "$src"
+curl -L -o signature.asc -- "$signature"
+gpg --batch --recv-keys "$key"
+gpg --batch --verify signature.asc "$depname"
+sha256=$(nix-prefetch-url --type sha256 "file://$PWD/$depname")
+popd
+
+update-source-version bisq-desktop "$version" "$sha256"
--- a/pkgs/applications/blockchains/bitcoin/default.nix
+++ b/pkgs/applications/blockchains/bitcoin/default.nix
@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
    ++ optionals withWallet [ db48 sqlite ]
    ++ optionals withGui [ qrencode qtbase qttools ];

-  postInstall = optional withGui ''
+  postInstall = optionalString withGui ''
    install -Dm644 ${desktop} $out/share/applications/bitcoin-qt.desktop
    substituteInPlace $out/share/applications/bitcoin-qt.desktop --replace "Icon=bitcoin128" "Icon=bitcoin"
    install -Dm644 share/pixmaps/bitcoin256.png $out/share/pixmaps/bitcoin.png
--- a/pkgs/applications/blockchains/go-ethereum/default.nix
+++ b/pkgs/applications/blockchains/go-ethereum/default.nix
@ -55,6 +55,6 @@ in buildGoModule rec {
    homepage = "https://geth.ethereum.org/";
    description = "Official golang implementation of the Ethereum protocol";
    license = with licenses; [ lgpl3Plus gpl3Plus ];
-    maintainers = with maintainers; [ adisbladis lionello xrelkd RaghavSood ];
+    maintainers = with maintainers; [ adisbladis lionello RaghavSood ];
  };
 }
--- a/pkgs/applications/blockchains/openethereum/default.nix
+++ b/pkgs/applications/blockchains/openethereum/default.nix
@ -44,7 +44,7 @@ rustPlatform.buildRustPackage rec {
    description = "Fast, light, robust Ethereum implementation";
    homepage = "http://parity.io/ethereum";
    license = licenses.gpl3;
-    maintainers = with maintainers; [ akru xrelkd ];
+    maintainers = with maintainers; [ akru ];
    platforms = lib.platforms.unix;
  };
 }
--- a/pkgs/applications/editors/jetbrains/common.nix
+++ b/pkgs/applications/editors/jetbrains/common.nix
@ -1,5 +1,5 @@
 { stdenv, lib, makeDesktopItem, makeWrapper, patchelf, writeText
-, coreutils, gnugrep, which, git, unzip, libsecret, libnotify
+, coreutils, gnugrep, which, git, unzip, libsecret, libnotify, e2fsprogs
 , vmopts ? null
 }:

@ -78,7 +78,7 @@ with stdenv; lib.makeOverridable mkDerivation rec {
      --prefix PATH : "$out/libexec/${name}:${lib.optionalString (stdenv.isDarwin) "${jdk}/jdk/Contents/Home/bin:"}${lib.makeBinPath [ jdk coreutils gnugrep which git ]}" \
      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath ([
        # Some internals want libstdc++.so.6
-        stdenv.cc.cc.lib libsecret
+        stdenv.cc.cc.lib libsecret e2fsprogs
        libnotify
      ] ++ extraLdPath)}" \
      --set JDK_HOME "$jdk" \
--- a/pkgs/applications/graphics/dosage/default.nix
+++ b/pkgs/applications/graphics/dosage/default.nix
@ -1,28 +1,30 @@
-{ lib, python3Packages, fetchFromGitHub }:
+{ lib, python3Packages }:

 python3Packages.buildPythonApplication rec {
  pname = "dosage";
-  version = "2018.04.08";
-  PBR_VERSION = version;
+  version = "2.17";

-  src = fetchFromGitHub {
-    owner = "webcomics";
-    repo = "dosage";
-    rev = "b2fdc13feb65b93762928f7e99bac7b1b7b31591";
-    sha256 = "1p6vllqaf9s6crj47xqp97hkglch1kd4y8y4lxvzx3g2shhhk9hh";
+  src = python3Packages.fetchPypi {
+    inherit pname version;
+    sha256 = "0vmxgn9wd3j80hp4gr5iq06jrl4gryz5zgfdd2ah30d12sfcfig0";
  };
-  checkInputs = with python3Packages; [ pytest responses ];
-  propagatedBuildInputs = with python3Packages; [ colorama lxml requests pbr setuptools ];
+
+  checkInputs = with python3Packages; [
+    pytestCheckHook pytest-xdist responses
+  ];
+
+  nativeBuildInputs = with python3Packages; [ setuptools-scm ];
+
+  propagatedBuildInputs = with python3Packages; [
+    colorama imagesize lxml requests setuptools six
+  ];

  disabled = python3Packages.pythonOlder "3.3";

-  checkPhase = ''
-    py.test tests/
-  '';
-
  meta = {
    description = "A comic strip downloader and archiver";
    homepage = "https://dosage.rocks/";
    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ toonn ];
  };
 }
--- a/pkgs/applications/graphics/drawpile/default.nix
+++ b/pkgs/applications/graphics/drawpile/default.nix
@ -2,7 +2,6 @@
 , lib
 , mkDerivation
 , fetchFromGitHub
-, fetchpatch
 , extra-cmake-modules

 # common deps
--- a/pkgs/applications/graphics/rx/default.nix
+++ b/pkgs/applications/graphics/rx/default.nix
@ -29,7 +29,7 @@ rustPlatform.buildRustPackage rec {
  # FIXME: GLFW (X11) requires DISPLAY env variable for all tests
  doCheck = false;

-  postInstall = optional stdenv.isLinux ''
+  postInstall = optionalString stdenv.isLinux ''
    mkdir -p $out/share/applications
    cp $src/rx.desktop $out/share/applications
    wrapProgram $out/bin/rx --prefix LD_LIBRARY_PATH : ${libGL}/lib
--- a/pkgs/applications/misc/anytype/default.nix
+++ b/pkgs/applications/misc/anytype/default.nix
@ -15,9 +15,8 @@ in
 appimageTools.wrapType2 {
  inherit name src;

-  extraPkgs = { pkgs, ... }@args: [
-    pkgs.gnome3.libsecret
-  ] ++ appimageTools.defaultFhsEnvArgs.multiPkgs args;
+  extraPkgs = pkgs: (appimageTools.defaultFhsEnvArgs.multiPkgs pkgs)
+    ++ [ pkgs.libsecret ];

  extraInstallCommands = ''
    mv $out/bin/${name} $out/bin/${pname}
--- a/pkgs/applications/misc/moonlight-embedded/default.nix
+++ b/pkgs/applications/misc/moonlight-embedded/default.nix
@ -18,10 +18,10 @@ stdenv.mkDerivation rec {

  outputs = [ "out" "man" ];

-  nativeBuildInputs = [ cmake perl ];
+  nativeBuildInputs = [ cmake perl pkg-config ];
  buildInputs = [
    alsa-lib libevdev libopus udev SDL2
-    ffmpeg pkg-config xorg.libxcb libvdpau libpulseaudio libcec
+    ffmpeg xorg.libxcb libvdpau libpulseaudio libcec
    xorg.libpthreadstubs curl expat avahi libuuid libva
  ];

--- a/pkgs/applications/misc/pwsafe/default.nix
+++ b/pkgs/applications/misc/pwsafe/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "pwsafe";
-  version = "3.55.0";
+  version = "3.56.0";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = version;
-    sha256 = "sha256-+Vfwz8xGmSzFNdiN5XYkRqGmFuBVIgexXdH3B+XYY3o=";
+    sha256 = "sha256-ZLX/3cs1cdia5+32QEwE6q3V0uFNkkmiIGboKW6Xej8=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/surface-control/default.nix
+++ b/pkgs/applications/misc/surface-control/default.nix
@ -31,7 +31,7 @@ rustPlatform.buildRustPackage rec {
      "Control various aspects of Microsoft Surface devices on Linux from the Command-Line";
    homepage = "https://github.com/linux-surface/surface-control";
    license = licenses.mit;
-    maintainers = with maintainers; [ winterqt ];
+    maintainers = with maintainers; [ ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/misc/ticker/default.nix
+++ b/pkgs/applications/misc/ticker/default.nix
@ -16,9 +16,9 @@ buildGoModule rec {

  vendorSha256 = "sha256-XBfTVd3X3IDxLCAaNnijf6E5bw+AZ94UdOG9w7BOdBU=";

-  preBuild = ''
-    buildFlagsArray+=("-ldflags" "-s -w -X github.com/achannarasappa/ticker/cmd.Version=v${version}")
-  '';
+  ldflags = [
+    "-s" "-w" "-X github.com/achannarasappa/ticker/cmd.Version=v${version}"
+  ];

  # Tests require internet
  doCheck = false;
--- a/pkgs/applications/misc/waybar/default.nix
+++ b/pkgs/applications/misc/waybar/default.nix
@ -78,7 +78,7 @@ stdenv.mkDerivation rec {
    "-Dman-pages=enabled"
  ];

-  preFixup = lib.optional withMediaPlayer ''
+  preFixup = lib.optionalString withMediaPlayer ''
      cp $src/resources/custom_modules/mediaplayer.py $out/bin/waybar-mediaplayer.py

      wrapProgram $out/bin/waybar-mediaplayer.py \
--- a/pkgs/applications/misc/wmname/default.nix
+++ b/pkgs/applications/misc/wmname/default.nix
@ -10,7 +10,7 @@ stdenv.mkDerivation rec {

  buildInputs = [ libX11 ];

-  preConfigure = [ ''sed -i "s@PREFIX = /usr/local@PREFIX = $out@g" config.mk'' ];
+  preConfigure = ''sed -i "s@PREFIX = /usr/local@PREFIX = $out@g" config.mk'';

  meta = {
    description = "Prints or set the window manager name property of the root window";
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -90,11 +90,11 @@ in

 stdenv.mkDerivation rec {
  pname = "brave";
-  version = "1.28.105";
+  version = "1.28.106";

  src = fetchurl {
    url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "1E2KWG5vHYBuph6Pv9J6FBOsUpegx4Ix/H99ZQ/x4zI=";
+    sha256 = "gr8d5Dh6ZHb2kThVOA61BoGo64MB77qF7ualUY2RRq0=";
  };

  dontConfigure = true;
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@ -88,19 +88,19 @@ let
  fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];

  # Upstream source
-  version = "10.5.2";
+  version = "10.5.5";

  lang = "en-US";

  srcs = {
    x86_64-linux = fetchurl {
      url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz";
-      sha256 = "16zk7d0sxm2j00vb002mjj38wxcxxlahnfdb9lmkmkfms9p9xfkb";
+      sha256 = "0847lib2z21fgb7x5szwvprc77fhdpmp4z5d6n1sk6d40dd34spn";
    };

    i686-linux = fetchurl {
      url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz";
-      sha256 = "0xc3ac2y9xf7ff3pqrp5n6l9j8i5hk3y2y3zwykwhnycnfi6dfv4";
+      sha256 = "0i26fb0r234nrwnvb2c9vk9yn869qghq0n4qlm1d7mr62dy6prxa";
    };
  };
 in
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@ -18,11 +18,11 @@ let
  vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
  pname = "vivaldi";
-  version = "4.1.2369.18-1";
+  version = "4.1.2369.21-1";

  src = fetchurl {
    url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}_amd64.deb";
-    sha256 = "062zh7a4mr52h9m09dnqrdc48ajnkq887kcbcvzcd20wsnvivi48";
+    sha256 = "03062mik6paqp219jz420jsg762jjrfxmj1daq129z2zgzq0qr8l";
  };

  unpackPhase = ''
--- a/pkgs/applications/networking/cluster/bosh-cli/default.nix
+++ b/pkgs/applications/networking/cluster/bosh-cli/default.nix
@ -8,13 +8,13 @@
 buildGoModule rec {
  pname = "bosh-cli";

-  version = "6.4.4";
+  version = "6.4.5";

  src = fetchFromGitHub {
    owner = "cloudfoundry";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-N7GrxePNewxhHnkQP/XBdUIEL5FsFD4avouZaIO+BKc=";
+    sha256 = "sha256-/1JRje7SNrIsb3V1tq5ZW5zsURaQUzM/Jp3TMR0MfKw=";
  };
  vendorSha256 = null;

--- a/pkgs/applications/networking/cluster/cilium/default.nix
+++ b/pkgs/applications/networking/cluster/cilium/default.nix
@ -0,0 +1,23 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "cilium-cli";
+  version = "0.8.6";
+
+  src = fetchFromGitHub {
+    owner = "cilium";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "07p62zifycw7gnwkd3230jsjns80k2q9fbj8drzp84s9cp7ddpa9";
+  };
+
+  vendorSha256 = null;
+
+  meta = with lib; {
+    description = "CLI to install, manage & troubleshoot Kubernetes clusters running Cilium";
+    license = licenses.asl20;
+    homepage = "https://www.cilium.io/";
+    maintainers = with maintainers; [ humancalico ];
+    mainProgram = "cilium";
+  };
+}
--- a/pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix
+++ b/pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix
@ -2,17 +2,17 @@

 buildGoModule rec {
  pname = "cloudfoundry-cli";
-  version = "7.2.0";
+  version = "7.3.0";

  src = fetchFromGitHub {
    owner = "cloudfoundry";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "0cf5vshyz6j70sv7x43r1404hdcmkzxgdb7514kjilp5z6wsr1nv";
+    sha256 = "sha256-I+4tFAMmmsmi5WH9WKXIja1vVWsPHNGkWbvjWGUCmkU=";
  };
  # vendor directory stale
  deleteVendor = true;
-  vendorSha256 = "0p0s0dr7kpmmnim4fps62vj4zki2qxxdq5ww0fzrf1372xbl4kp2";
+  vendorSha256 = null;

  subPackages = [ "." ];

--- a/pkgs/applications/networking/cluster/cni/plugins.nix
+++ b/pkgs/applications/networking/cluster/cni/plugins.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "cni-plugins";
-  version = "0.9.1";
+  version = "1.0.0";

  src = fetchFromGitHub {
    owner = "containernetworking";
    repo = "plugins";
    rev = "v${version}";
-    sha256 = "sha256-n+OtFXgFmW0xsGEtC6ua0qjdsJSbEjn08mAl5Z51Kp8=";
+    sha256 = "sha256-RcDZW/iOAcJodGiuzmeZk3obtD0/mQoMF9vL0xNehbQ=";
  };

  vendorSha256 = null;
@ -32,7 +32,6 @@ buildGoModule rec {
    "plugins/main/vlan"
    "plugins/meta/bandwidth"
    "plugins/meta/firewall"
-    "plugins/meta/flannel"
    "plugins/meta/portmap"
    "plugins/meta/sbr"
    "plugins/meta/tuning"
--- a/pkgs/applications/networking/cluster/kube3d/default.nix
+++ b/pkgs/applications/networking/cluster/kube3d/default.nix
@ -17,10 +17,10 @@ buildGoModule rec {

  excludedPackages = "\\(tools\\|docgen\\)";

-  preBuild = let t = "github.com/rancher/k3d/v4/version"; in
-    ''
-      buildFlagsArray+=("-ldflags" "-s -w -X ${t}.Version=v${version} -X ${t}.K3sVersion=v${k3sVersion}")
-    '';
+  ldflags = let t = "github.com/rancher/k3d/v4/version"; in
+    [
+      "-s" "-w" "-X ${t}.Version=v${version}" "-X ${t}.K3sVersion=v${k3sVersion}"
+    ];

  doCheck = false;

--- a/pkgs/applications/networking/cluster/octant/plugins/starboard-octant-plugin.nix
+++ b/pkgs/applications/networking/cluster/octant/plugins/starboard-octant-plugin.nix
@ -13,9 +13,9 @@ buildGoModule rec {

  vendorSha256 = "sha256-EM0lPwwWJuLD+aqZWshz1ILaeEtUU4wJ0Puwv1Ikgf4=";

-  preBuild = ''
-    buildFlagsArray+=("-ldflags" "-s -w")
-  '';
+  ldflags = [
+    "-s" "-w"
+  ];

  meta = with lib; {
    homepage = "https://github.com/aquasecurity/starboard-octant-plugin";
--- a/pkgs/applications/networking/cluster/starboard/default.nix
+++ b/pkgs/applications/networking/cluster/starboard/default.nix
@ -16,9 +16,9 @@ buildGoModule rec {
  # Don't build and check the integration tests
  excludedPackages = "itest";

-  preBuild = ''
-    buildFlagsArray+=("-ldflags" "-s -w -X main.version=v${version}")
-  '';
+  ldflags = [
+    "-s" "-w" "-X main.version=v${version}"
+  ];

  preCheck = ''
    # Remove test that requires networking
--- a/pkgs/applications/networking/mumble/default.nix
+++ b/pkgs/applications/networking/mumble/default.nix
@ -104,7 +104,7 @@ let
  server = source: generic {
    type = "murmur";

-    postPatch = lib.optional iceSupport ''
+    postPatch = lib.optionalString iceSupport ''
      grep -Rl '/usr/share/Ice' . | xargs sed -i 's,/usr/share/Ice/,${zeroc-ice.dev}/share/ice/,g'
    '';

--- a/pkgs/applications/networking/onionshare/default.nix
+++ b/pkgs/applications/networking/onionshare/default.nix
@ -23,12 +23,12 @@
 }:

 let
-  version = "2.3.2";
+  version = "2.3.3";
  src = fetchFromGitHub {
    owner = "micahflee";
    repo = "onionshare";
    rev = "v${version}";
-    sha256 = "sha256-mzLDvvpO82iGDnzY42wx1KCNmAxUgVhpaDVprtb+YOI=";
+    sha256 = "sha256-wU2020RNXlwJ2y9uzcLxIX4EECev1Z9YvNyiBalLj/Y=";
  };
  meta = with lib; {
    description = "Securely and anonymously send and receive files";
@ -94,6 +94,11 @@ in rec {
      # Tests use the home directory
      export HOME="$(mktemp -d)"
    '';
+
+    disabledTests = [
+      "test_firefox_like_behavior"
+      "test_if_unmodified_since"
+    ];
  };

  onionshare-gui = buildPythonApplication {
--- a/pkgs/applications/science/biology/neuron/default.nix
+++ b/pkgs/applications/science/biology/neuron/default.nix
@ -60,13 +60,13 @@ stdenv.mkDerivation rec {
                        else ["--without-mpi"]);


-  postInstall = lib.optionals (python != null) [ ''
+  postInstall = lib.optionalString (python != null) ''
    ## standardise python neuron install dir if any
    if [[ -d $out/lib/python ]]; then
        mkdir -p ''${out}/${python.sitePackages}
        mv ''${out}/lib/python/*  ''${out}/${python.sitePackages}/
    fi
-  ''];
+  '';

  propagatedBuildInputs = [ readline ncurses which libtool ];

--- a/pkgs/applications/science/electronics/kicad/base.nix
+++ b/pkgs/applications/science/electronics/kicad/base.nix
@ -64,7 +64,7 @@ assert lib.assertMsg (!(sanitizeAddress && sanitizeThreads))
  "'sanitizeAddress' and 'sanitizeThreads' are mutually exclusive, use one.";

 let
-  inherit (lib) optional optionals;
+  inherit (lib) optional optionals optionalString;
 in
 stdenv.mkDerivation rec {
  pname = "kicad-base";
@ -172,7 +172,7 @@ stdenv.mkDerivation rec {

  dontStrip = debug;

-  postInstall = optional (withI18n) ''
+  postInstall = optionalString (withI18n) ''
    mkdir -p $out/share
    lndir ${i18n}/share $out/share
  '';
--- a/pkgs/applications/science/math/ginac/default.nix
+++ b/pkgs/applications/science/math/ginac/default.nix
@ -1,30 +1,34 @@
 { lib, stdenv, fetchurl, cln, pkg-config, readline, gmp, python3 }:

 stdenv.mkDerivation rec {
-  name = "ginac-1.8.1";
+  pname = "ginac";
+  version = "1.8.1";

  src = fetchurl {
-    url    = "${meta.homepage}/${name}.tar.bz2";
+    url = "https://www.ginac.de/ginac-${version}.tar.bz2";
    sha256 = "sha256-8WldvWsYcGHvP7pQdkjJ1tukOPczsFjBb5J4y9z14as=";
  };

  propagatedBuildInputs = [ cln ];

-  buildInputs = [ readline ] ++ lib.optional stdenv.isDarwin gmp;
+  buildInputs = [ readline ]
+    ++ lib.optional stdenv.isDarwin gmp;

  nativeBuildInputs = [ pkg-config python3 ];

  strictDeps = true;

-  preConfigure = "patchShebangs ginsh";
+  preConfigure = ''
+    patchShebangs ginsh
+  '';

  configureFlags = [ "--disable-rpath" ];

  meta = with lib; {
    description = "GiNaC is Not a CAS";
-    homepage    = "https://www.ginac.de/";
+    homepage = "https://www.ginac.de/";
    maintainers = with maintainers; [ lovek323 ];
    license = licenses.gpl2;
-    platforms   = platforms.all;
+    platforms = platforms.all;
  };
 }
--- a/pkgs/applications/science/physics/sherpa/default.nix
+++ b/pkgs/applications/science/physics/sherpa/default.nix
@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
    sha256 = "1iwa17s8ipj6a2b8zss5csb1k5y9s5js38syvq932rxcinbyjsl4";
  };

-  postPatch = lib.optional (stdenv.hostPlatform.libc == "glibc") ''
+  postPatch = lib.optionalString (stdenv.hostPlatform.libc == "glibc") ''
    sed -ie '/sys\/sysctl.h/d' ATOOLS/Org/Run_Parameter.C
  '';

--- a/pkgs/applications/system/glances/default.nix
+++ b/pkgs/applications/system/glances/default.nix
@ -9,14 +9,14 @@

 buildPythonApplication rec {
  pname = "glances";
-  version = "3.2.3";
+  version = "3.2.3.1";
  disabled = isPyPy;

  src = fetchFromGitHub {
    owner = "nicolargo";
    repo = "glances";
    rev = "v${version}";
-    sha256 = "1nc8bdzzrzaircq3myd32w6arpy2prn739886cq2h47cpinxmvpr";
+    sha256 = "0h7y36z4rizl1lyxacq32vpmvbwn9w2nrvrxn791060cksfw4xwd";
  };

  # Some tests fail in the sandbox (they e.g. require access to /sys/class/power_supply):
@ -31,7 +31,7 @@ buildPythonApplication rec {
  ];

  doCheck = true;
-  preCheck = lib.optional stdenv.isDarwin ''
+  preCheck = lib.optionalString stdenv.isDarwin ''
    export DYLD_FRAMEWORK_PATH=/System/Library/Frameworks
  '';

--- a/pkgs/applications/terminal-emulators/kitty/default.nix
+++ b/pkgs/applications/terminal-emulators/kitty/default.nix
@ -21,14 +21,14 @@
 with python3Packages;
 buildPythonApplication rec {
  pname = "kitty";
-  version = "0.21.2";
+  version = "0.23.1";
  format = "other";

  src = fetchFromGitHub {
    owner = "kovidgoyal";
    repo = "kitty";
    rev = "v${version}";
-    sha256 = "0y0mg8rr18mn0wzym7v48x6kl0ixd5q387kr5jhbdln55ph2jk9d";
+    sha256 = "sha256-2RwDU6EOJWF0u2ikJFg9U2yqSXergDkJH3h2i+QJ7G4=";
  };

  buildInputs = [
@ -52,8 +52,14 @@ buildPythonApplication rec {
  ];

  nativeBuildInputs = [
-    pkg-config sphinx ncurses
    installShellFiles
+    ncurses
+    pkg-config
+    sphinx
+    furo
+    sphinx-copybutton
+    sphinxext-opengraph
+    sphinx-inline-tabs
  ] ++ lib.optionals stdenv.isDarwin [
    imagemagick
    libicns  # For the png2icns tool.
@ -111,12 +117,12 @@ buildPythonApplication rec {
    cp -r linux-package/{bin,share,lib} $out
    ''}
    wrapProgram "$out/bin/kitty" --prefix PATH : "$out/bin:${lib.makeBinPath [ imagemagick xsel ncurses.dev ]}"
-    runHook postInstall

    installShellCompletion --cmd kitty \
      --bash <("$out/bin/kitty" + complete setup bash) \
      --fish <("$out/bin/kitty" + complete setup fish) \
      --zsh  <("$out/bin/kitty" + complete setup zsh)
+    runHook postInstall
  '';

  postInstall = ''
@ -136,7 +142,7 @@ buildPythonApplication rec {
    homepage = "https://github.com/kovidgoyal/kitty";
    description = "A modern, hackable, featureful, OpenGL based terminal emulator";
    license = licenses.gpl3Only;
-    changelog = "https://sw.kovidgoyal.net/kitty/changelog.html";
+    changelog = "https://sw.kovidgoyal.net/kitty/changelog/";
    platforms = platforms.darwin ++ platforms.linux;
    maintainers = with maintainers; [ tex rvolosatovs Luflosi ];
  };
--- a/pkgs/applications/version-management/gitlab-triage/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab-triage/Gemfile.lock
@ -1,27 +1,35 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    activesupport (5.2.4.4)
+    activesupport (5.2.6)
      concurrent-ruby (~> 1.0, >= 1.0.2)
      i18n (>= 0.7, < 2)
      minitest (~> 5.1)
      tzinfo (~> 1.1)
-    concurrent-ruby (1.1.7)
-    gitlab-triage (1.13.0)
+    concurrent-ruby (1.1.9)
+    gitlab-triage (1.20.0)
      activesupport (~> 5.1)
+      globalid (~> 0.4)
+      graphql-client (~> 0.16)
      httparty (~> 0.17)
+    globalid (0.5.2)
+      activesupport (>= 5.0)
+    graphql (1.12.14)
+    graphql-client (0.16.0)
+      activesupport (>= 3.0)
+      graphql (~> 1.8)
    httparty (0.18.1)
      mime-types (~> 3.0)
      multi_xml (>= 0.5.2)
-    i18n (1.8.5)
+    i18n (1.8.10)
      concurrent-ruby (~> 1.0)
    mime-types (3.3.1)
      mime-types-data (~> 3.2015)
-    mime-types-data (3.2020.0512)
-    minitest (5.14.2)
+    mime-types-data (3.2021.0704)
+    minitest (5.14.4)
    multi_xml (0.6.0)
    thread_safe (0.3.6)
-    tzinfo (1.2.7)
+    tzinfo (1.2.9)
      thread_safe (~> 0.1)

 PLATFORMS
--- a/pkgs/applications/version-management/gitlab-triage/gemset.nix
+++ b/pkgs/applications/version-management/gitlab-triage/gemset.nix
@ -5,31 +5,63 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0dpnk20s754fz6jfz9sp3ri49hn46ksw4hf6ycnlw7s3hsdxqgcd";
+      sha256 = "1vybx4cj42hr6m8cdwbrqq2idh98zms8c11kr399xjczhl9ywjbj";
      type = "gem";
    };
-    version = "5.2.4.4";
+    version = "5.2.6";
  };
  concurrent-ruby = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1vnxrbhi7cq3p4y2v9iwd10v1c7l15is4var14hwnb2jip4fyjzz";
+      sha256 = "0nwad3211p7yv9sda31jmbyw6sdafzmdi2i2niaz6f0wk5nq9h0f";
      type = "gem";
    };
-    version = "1.1.7";
+    version = "1.1.9";
  };
  gitlab-triage = {
-    dependencies = ["activesupport" "httparty"];
+    dependencies = ["activesupport" "globalid" "graphql-client" "httparty"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "11sas3h3n638gni1mysck1ahyakqnl8gg6g21pc3krs6jrg9qxj9";
+      sha256 = "sha256-sg/YgRnp1+EcTcBqsm8vZrV0YuHTSJEFk/whhW8An6g=";
      type = "gem";
    };
-    version = "1.13.0";
+    version = "1.20.0";
+  };
+  globalid = {
+    dependencies = ["activesupport"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0k6ww3shk3mv119xvr9m99l6ql0czq91xhd66hm8hqssb18r2lvm";
+      type = "gem";
+    };
+    version = "0.5.2";
+  };
+  graphql = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "sha256-iweRDvp7EWY02B52iwbebEpiwL7Mj9E9RyeHYMuqc/o=";
+      type = "gem";
+    };
+    version = "1.12.14";
+  };
+  graphql-client = {
+    dependencies = ["activesupport" "graphql"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0g971rccyrs3rk8812r6az54p28g66m4ngdcbszg31mvddjaqkr4";
+      type = "gem";
+    };
+    version = "0.16.0";
  };
  httparty = {
    dependencies = ["mime-types" "multi_xml"];
@ -48,10 +80,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "153sx77p16vawrs4qpkv7qlzf9v5fks4g7xqcj1dwk40i6g7rfzk";
+      sha256 = "0g2fnag935zn2ggm5cn6k4s4xvv53v2givj1j90szmvavlpya96a";
      type = "gem";
    };
-    version = "1.8.5";
+    version = "1.8.10";
  };
  mime-types = {
    dependencies = ["mime-types-data"];
@ -69,20 +101,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1z75svngyhsglx0y2f9rnil2j08f9ab54b3l95bpgz67zq2if753";
+      sha256 = "0dlxwc75iy0dj23x824cxpvpa7c8aqcpskksrmb32j6m66h5mkcy";
      type = "gem";
    };
-    version = "3.2020.0512";
+    version = "3.2021.0704";
  };
  minitest = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "170y2cvx51gm3cm3nhdf7j36sxnkh6vv8ls36p90ric7w8w16h4v";
+      sha256 = "19z7wkhg59y8abginfrm2wzplz7py3va8fyngiigngqvsws6cwgl";
      type = "gem";
    };
-    version = "5.14.2";
+    version = "5.14.4";
  };
  multi_xml = {
    groups = ["default"];
@ -110,9 +142,9 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1i3jh086w1kbdj3k5l60lc3nwbanmzdf8yjj3mlrx9b2gjjxhi9r";
+      sha256 = "0zwqqh6138s8b321fwvfbywxy00lw1azw4ql3zr0xh1aqxf8cnvj";
      type = "gem";
    };
-    version = "1.2.7";
+    version = "1.2.9";
  };
 }
--- a/pkgs/applications/window-managers/qtile/0001-Substitution-vars-for-absolute-paths.patch
+++ b/pkgs/applications/window-managers/qtile/0001-Substitution-vars-for-absolute-paths.patch
@ -1,31 +0,0 @@
-diff --git a/libqtile/backend/x11/xcursors.py b/libqtile/backend/x11/xcursors.py
-index 24454b83..ef37875c 100644
--- a/libqtile/backend/x11/xcursors.py
-+++ b/libqtile/backend/x11/xcursors.py
-@@ -107,7 +107,7 @@ class Cursors(dict):
- 
-     def _setup_xcursor_binding(self):
-         try:
-            xcursor = ffi.dlopen('libxcb-cursor.so.0')
-+            xcursor = ffi.dlopen('@xcb-cursor@/lib/libxcb-cursor.so.0')
-         except OSError:
-             logger.warning("xcb-cursor not found, fallback to font pointer")
-             return False
-diff --git a/libqtile/pangocffi.py b/libqtile/pangocffi.py
-index dbae27ed..54c2c35f 100644
--- a/libqtile/pangocffi.py
-+++ b/libqtile/pangocffi.py
-@@ -52,10 +52,9 @@ try:
- except ImportError:
-     raise ImportError("No module named libqtile._ffi_pango, be sure to run `./scripts/ffibuild`")
- 
-gobject = ffi.dlopen('libgobject-2.0.so.0')
-pango = ffi.dlopen('libpango-1.0.so.0')
-pangocairo = ffi.dlopen('libpangocairo-1.0.so.0')
-
-+gobject = ffi.dlopen('@glib@/lib/libgobject-2.0.so.0')
-+pango = ffi.dlopen('@pango@/lib/libpango-1.0.so.0')
-+pangocairo = ffi.dlopen('@pango@/lib/libpangocairo-1.0.so.0')
- 
- def patch_cairo_context(cairo_t):
-     def create_layout():
--- a/pkgs/applications/window-managers/qtile/0002-Restore-PATH-and-PYTHONPATH.patch
+++ b/pkgs/applications/window-managers/qtile/0002-Restore-PATH-and-PYTHONPATH.patch
@ -1,71 +0,0 @@
-diff --git a/bin/qshell b/bin/qshell
-index 5c652b7a..2d169eb2 100755
--- a/bin/qshell
-+++ b/bin/qshell
-@@ -28,5 +28,6 @@ base_dir = os.path.abspath(os.path.join(this_dir, ".."))
- sys.path.insert(0, base_dir)
- 
- if __name__ == '__main__':
-+    __import__("importlib").import_module("libqtile.utils").restore_os_environment()
-     from libqtile.scripts import qshell
-     qshell.main()
-diff --git a/bin/qtile b/bin/qtile
-index ebc8fab5..08a965ef 100755
--- a/bin/qtile
-+++ b/bin/qtile
-@@ -29,5 +29,6 @@ base_dir = os.path.abspath(os.path.join(this_dir, ".."))
- sys.path.insert(0, base_dir)
- 
- if __name__ == '__main__':
-+    __import__("importlib").import_module("libqtile.utils").restore_os_environment()
-     from libqtile.scripts import qtile
-     qtile.main()
-diff --git a/bin/qtile-cmd b/bin/qtile-cmd
-index a2136ee6..3d37a6d9 100755
--- a/bin/qtile-cmd
-+++ b/bin/qtile-cmd
-@@ -8,5 +8,6 @@ base_dir = os.path.abspath(os.path.join(this_dir, ".."))
- sys.path.insert(0, base_dir)
- 
- if __name__ == '__main__':
-+    __import__("importlib").import_module("libqtile.utils").restore_os_environment()
-     from libqtile.scripts import qtile_cmd
-     qtile_cmd.main()
-diff --git a/bin/qtile-run b/bin/qtile-run
-index ac4cb1fd..74c589cb 100755
--- a/bin/qtile-run
-+++ b/bin/qtile-run
-@@ -8,5 +8,6 @@ base_dir = os.path.abspath(os.path.join(this_dir, ".."))
- sys.path.insert(0, base_dir)
- 
- if __name__ == '__main__':
-+    __import__("importlib").import_module("libqtile.utils").restore_os_environment()
-     from libqtile.scripts import qtile_run
-     qtile_run.main()
-diff --git a/bin/qtile-top b/bin/qtile-top
-index a6251f27..0d524b1d 100755
--- a/bin/qtile-top
-+++ b/bin/qtile-top
-@@ -8,5 +8,6 @@ base_dir = os.path.abspath(os.path.join(this_dir, ".."))
- sys.path.insert(0, base_dir)
- 
- if __name__ == '__main__':
-+    __import__("importlib").import_module("libqtile.utils").restore_os_environment()
-     from libqtile.scripts import qtile_top
-     qtile_top.main()
-diff --git a/libqtile/utils.py b/libqtile/utils.py
-index 2628c898..05117be7 100644
--- a/libqtile/utils.py
-+++ b/libqtile/utils.py
-@@ -270,3 +270,10 @@ def guess_terminal():
-         return terminal
- 
-     logger.error('Default terminal has not been found.')
-+
-+def restore_os_environment():
-+    pythonpath = os.environ.pop("QTILE_SAVED_PYTHONPATH", "")
-+    os.environ["PYTHONPATH"] = pythonpath
-+    path = os.environ.pop("QTILE_SAVED_PATH", None)
-+    if path:
-+        os.environ["PATH"] = path
-
--- a/pkgs/applications/window-managers/qtile/0003-Restart-executable.patch
+++ b/pkgs/applications/window-managers/qtile/0003-Restart-executable.patch
@ -1,13 +0,0 @@
-diff --git a/libqtile/core/manager.py b/libqtile/core/manager.py
-index c22eeb6a..2ffe4eab 100644
--- a/libqtile/core/manager.py
-+++ b/libqtile/core/manager.py
-@@ -278,7 +278,7 @@ class Qtile(CommandObject):
-             logger.error("Unable to pickle qtile state")
-         argv = [s for s in argv if not s.startswith('--with-state')]
-         argv.append('--with-state=' + buf.getvalue().decode())
-        self._restart = (sys.executable, argv)
-+        self._restart = (os.environ.get("QTILE_WRAPPER", "@out@/bin/qtile"), argv[1:])
-         self.stop()
- 
-     async def finalize(self):
--- a/pkgs/applications/window-managers/qtile/default.nix
+++ b/pkgs/applications/window-managers/qtile/default.nix
@ -1,66 +1,66 @@
-{ lib, fetchFromGitHub, python37Packages, glib, cairo, pango, pkg-config, libxcb, xcbutilcursor }:
+{ lib, fetchFromGitHub, python3, glib, cairo, pango, pkg-config, libxcb, xcbutilcursor }:

-let cairocffi-xcffib = python37Packages.cairocffi.override {
+let
+  enabled-xcffib = cairocffi-xcffib: cairocffi-xcffib.override {
    withXcffib = true;
  };
+
+  # make it easier to reference python
+  python = python3;
+  pythonPackages = python.pkgs;
+
+  unwrapped = pythonPackages.buildPythonPackage rec {
+    name = "qtile-${version}";
+    version = "0.18.0";
+
+    src = fetchFromGitHub {
+      owner = "qtile";
+      repo = "qtile";
+      rev = "v${version}";
+      sha256 = "sha256-S9G/EI18p9EAyWgI1ajDrLimeE+ETBC9feUDb/QthqI=";
+    };
+
+    postPatch = ''
+      substituteInPlace libqtile/pangocffi.py \
+        --replace libgobject-2.0.so.0 ${glib.out}/lib/libgobject-2.0.so.0 \
+        --replace libpangocairo-1.0.so.0 ${pango.out}/lib/libpangocairo-1.0.so.0 \
+        --replace libpango-1.0.so.0 ${pango.out}/lib/libpango-1.0.so.0
+      substituteInPlace libqtile/backend/x11/xcursors.py \
+        --replace libxcb-cursor.so.0 ${xcbutilcursor.out}/lib/libxcb-cursor.so.0
+    '';
+
+    SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+    nativeBuildInputs = [
+      pkg-config
+    ] ++ (with pythonPackages; [
+      setuptools-scm
+    ]);
+
+    propagatedBuildInputs = with pythonPackages; [
+      xcffib
+      (enabled-xcffib cairocffi)
+      setuptools
+      python-dateutil
+      dbus-python
+      mpd2
+      psutil
+      pyxdg
+      pygobject3
+    ];
+
+    doCheck = false; # Requires X server #TODO this can be worked out with the existing NixOS testing infrastructure.
+
+    meta = with lib; {
+      homepage = "http://www.qtile.org/";
+      license = licenses.mit;
+      description = "A small, flexible, scriptable tiling window manager written in Python";
+      platforms = platforms.linux;
+      maintainers = with maintainers; [ kamilchm ];
+    };
+  };
 in
-
-python37Packages.buildPythonApplication rec {
-  name = "qtile-${version}";
-  version = "0.16.0";
-
-  src = fetchFromGitHub {
-    owner = "qtile";
-    repo = "qtile";
-    rev = "v${version}";
-    sha256 = "1klv1k9847nyx71sfrhqyl1k51k2w8phqnp2bns4dvbqii7q125l";
-  };
-
-  patches = [
-    ./0001-Substitution-vars-for-absolute-paths.patch
-    ./0002-Restore-PATH-and-PYTHONPATH.patch
-    ./0003-Restart-executable.patch
-  ];
-
-  postPatch = ''
-    substituteInPlace libqtile/core/manager.py --subst-var-by out $out
-    substituteInPlace libqtile/pangocffi.py --subst-var-by glib ${glib.out}
-    substituteInPlace libqtile/pangocffi.py --subst-var-by pango ${pango.out}
-    substituteInPlace libqtile/backend/x11/xcursors.py --subst-var-by xcb-cursor ${xcbutilcursor.out}
-  '';
-
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ glib libxcb cairo pango python37Packages.xcffib ];
-
-  pythonPath = with python37Packages; [
-    xcffib
-    cairocffi-xcffib
-    setuptools
-    setuptools-scm
-    python-dateutil
-    dbus-python
-    mpd2
-    psutil
-    pyxdg
-    pygobject3
-  ];
-
-  postInstall = ''
-    wrapProgram $out/bin/qtile \
-      --run 'export QTILE_WRAPPER=$0' \
-      --run 'export QTILE_SAVED_PYTHONPATH=$PYTHONPATH' \
-      --run 'export QTILE_SAVED_PATH=$PATH'
-  '';
-
-  doCheck = false; # Requires X server #TODO this can be worked out with the existing NixOS testing infrastructure.
-
-  meta = with lib; {
-    homepage = "http://www.qtile.org/";
-    license = licenses.mit;
-    description = "A small, flexible, scriptable tiling window manager written in Python";
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ kamilchm ];
-  };
-}
+  (python.withPackages (ps: [ unwrapped ])).overrideAttrs (_: {
+    # export underlying qtile package
+    passthru = { inherit unwrapped; };
+  })
--- a/pkgs/build-support/fetchgx/default.nix
+++ b/pkgs/build-support/fetchgx/default.nix
@ -12,7 +12,9 @@ stdenvNoCC.mkDerivation {
  outputHashMode = "recursive";
  outputHash = sha256;

-  phases = [ "unpackPhase" "buildPhase" "installPhase" ];
+  dontConfigure = true;
+  doCheck = false;
+  doInstallCheck = false;

  buildPhase = ''
    export GOPATH=$(pwd)/vendor
--- a/pkgs/build-support/templaterpm/default.nix
+++ b/pkgs/build-support/templaterpm/default.nix
@ -7,7 +7,7 @@ stdenv.mkDerivation {
  nativeBuildInputs = [ makeWrapper ];
  buildInputs = [ python toposort rpm ];

-  phases = [ "installPhase" "fixupPhase" ];
+  dontUnpack = true;

  installPhase = ''
    mkdir -p $out/bin
--- a/pkgs/data/fonts/julia-mono/default.nix
+++ b/pkgs/data/fonts/julia-mono/default.nix
@ -1,13 +1,13 @@
 { lib, fetchzip }:

 let
-  version = "0.040";
+  version = "0.041";

 in
 fetchzip {
  name = "JuliaMono-ttf-${version}";
  url = "https://github.com/cormullion/juliamono/releases/download/v${version}/JuliaMono-ttf.tar.gz";
-  sha256 = "sha256-Rrsvs682aWXZqydnOifXTJMa4uPl/aCGbVNRPGxkZng=";
+  sha256 = "sha256-OjguPR2MFjbY72/PF0R43/g6i95uAPVPbXk+HS0B360=";

  postFetch = ''
    mkdir -p $out/share/fonts/truetype
--- a/pkgs/data/fonts/libertinus/default.nix
+++ b/pkgs/data/fonts/libertinus/default.nix
@ -1,29 +1,29 @@
-{ lib, fetchFromGitHub }:
+{ lib, fetchurl }:

 let
-  version = "6.9";
-in fetchFromGitHub rec {
+  version = "7.040";
+in fetchurl rec {
  name = "libertinus-${version}";
+  url = "https://github.com/alerque/libertinus/releases/download/v${version}/Libertinus-${version}.tar.xz";
+  sha256 = "0z658r88p52dyrcslv0wlccw0sw7m5jz8nbqizv95nf7bfw96iyk";

-  owner  = "alif-type";
-  repo   = "libertinus";
-  rev    = "v${version}";
+  downloadToTemp = true;
+  recursiveHash = true;

  postFetch = ''
    tar xf $downloadedFile --strip=1
-    install -m444 -Dt $out/share/fonts/opentype *.otf
-    install -m444 -Dt $out/share/doc/${name}    *.txt
+    install -m644 -Dt $out/share/fonts/opentype static/OTF/*.otf
  '';
-  sha256 = "0765a7w0askkhrjmjk638gcm9h6fcm1jpaza8iw9afr3sz1s0xlq";

  meta = with lib; {
-    description = "A fork of the Linux Libertine and Linux Biolinum fonts";
+    description = "The Libertinus font family";
    longDescription = ''
-      Libertinus fonts is a fork of the Linux Libertine and Linux Biolinum fonts
-      that started as an OpenType math companion of the Libertine font family,
-      but grown as a full fork to address some of the bugs in the fonts.
+      The Libertinus font project began as a fork of the Linux Libertine and
+      Linux Biolinum fonts. The original impetus was to add an OpenType math
+      companion to the Libertine font families. Over time it grew into to a
+      full-fledged fork addressing many of the bugs in the Libertine fonts.
    '';
-    homepage = "https://github.com/alif-type/libertinus";
+    homepage = "https://github.com/alerque/libertinus";
    license = licenses.ofl;
    maintainers = with maintainers; [ siddharthist ];
    platforms = platforms.all;
--- a/pkgs/desktops/gnome/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-shell/default.nix
@ -66,13 +66,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "gnome-shell";
-  version = "40.3";
+  version = "40.4";

  outputs = [ "out" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-shell/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-erEMbulpmCjdch6/jOHeRk3KqpHUlYI79LhMiTmejCs=";
+    sha256 = "160z8bz2kqmrs6a4cs2gakv0rl9ba69p3ij2xjakqav50n9r3i9b";
  };

  patches = [
--- a/pkgs/desktops/mate/atril/default.nix
+++ b/pkgs/desktops/mate/atril/default.nix
@ -24,11 +24,11 @@ with lib;

 stdenv.mkDerivation rec {
  pname = "atril";
-  version = "1.24.1";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "06nyicj96dqcv035yqnzmm6pk3m35glxj0ny6lk1vwqkk2l750xl";
+    sha256 = "0pz44k3axhjhhwfrfvnwvxak1dmjkwqs63rhrbcaagyymrp7cpki";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/mate/caja-dropbox/default.nix
+++ b/pkgs/desktops/mate/caja-dropbox/default.nix
@ -7,11 +7,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "caja-dropbox";
-  version = "1.24.0";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1rcn82q58mv9hn5xamvzay2pw1szfk6zns94362476fcp786lji2";
+    sha256 = "16w4r0zjps12lmzwiwpb9qnmbvd0p391q97296sxa8k88b1x14wn";
  };

  patches = [
--- a/pkgs/desktops/mate/caja-extensions/default.nix
+++ b/pkgs/desktops/mate/caja-extensions/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "caja-extensions";
-  version = "1.24.1";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "13jkynanqj8snys0if8lv6yx1y0jrm778s2152n4x65hsghc6cw5";
+    sha256 = "03zwv3yl5553cnp6jjn7vr4l28dcdhsap7qimlrbvy20119kj5gh";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/mate/caja/caja-extension-dirs.patch
+++ b/pkgs/desktops/mate/caja/caja-extension-dirs.patch
@ -1,46 +0,0 @@
-From 35e9e6a6f3ba6cbe62a3957044eb67864f5d8e66 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jos=C3=A9=20Romildo=20Malaquias?= <malaquias@gmail.com>
-Date: Tue, 11 Feb 2020 17:49:13 -0300
-Subject: [PATCH] Look for caja extentions at $CAJA_EXTENTSION_DIRS
-
-CAJA_EXTENSION_DIRS is a list of paths where caja extensions are
-looked for. It is needed for distributions like NixOS that do not
-install all extensions in the same directory. In NixOS each package is
-installed in a self contained directory.
---
- libcaja-private/caja-module.c | 14 ++++++++++++++
- 1 file changed, 14 insertions(+)
-
-diff --git a/libcaja-private/caja-module.c b/libcaja-private/caja-module.c
-index d54d7cf..9794e56 100644
--- a/libcaja-private/caja-module.c
-+++ b/libcaja-private/caja-module.c
-@@ -258,11 +258,25 @@ void
- caja_module_setup (void)
- {
-     static gboolean initialized = FALSE;
-+    gchar *caja_extension_dirs;
-+    gchar **dir_vector;
- 
-     if (!initialized)
-     {
-         initialized = TRUE;
- 
-+        caja_extension_dirs = (gchar *) g_getenv ("CAJA_EXTENSION_DIRS");
-+
-+        if (caja_extension_dirs)
-+        {
-+            dir_vector = g_strsplit (caja_extension_dirs, G_SEARCHPATH_SEPARATOR_S, 0);
-+
-+            for (gchar **dir = dir_vector; *dir != NULL; ++ dir)
-+                load_module_dir (*dir);
-+
-+            g_strfreev(dir_vector);
-+        }
-+
-         load_module_dir (CAJA_EXTENSIONDIR);
- 
-         eel_debug_call_at_shutdown (free_module_objects);
-- 
-2.25.0
-
--- a/pkgs/desktops/mate/caja/default.nix
+++ b/pkgs/desktops/mate/caja/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "caja";
-  version = "1.24.1";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0ylgb4b31vwgqmmknrhm4m9gfa1rzb9azpdd9myi0hscrr3h22z5";
+    sha256 = "1m0ai2r8b2mvlr8bqj9n6vg1pwzlwa46fqpq206wgyx5sgxac052";
  };

  nativeBuildInputs = [
@ -25,10 +25,6 @@ stdenv.mkDerivation rec {
    hicolor-icon-theme
  ];

-  patches = [
-    ./caja-extension-dirs.patch
-  ];
-
  configureFlags = [ "--disable-update-mimedb" ];

  enableParallelBuilding = true;
--- a/pkgs/desktops/mate/default.nix
+++ b/pkgs/desktops/mate/default.nix
@ -52,7 +52,7 @@ let
    mate-user-share = callPackage ./mate-user-share { };
    mate-utils = callPackage ./mate-utils { };
    mozo = callPackage ./mozo { };
-    pluma = callPackage ./pluma { };
+    pluma = callPackage ./pluma { inherit (pkgs.gnome) adwaita-icon-theme; };
    python-caja = callPackage ./python-caja { };

    basePackages = [
--- a/pkgs/desktops/mate/engrampa/default.nix
+++ b/pkgs/desktops/mate/engrampa/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "engrampa";
-  version = "1.24.2";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0x26djz73g3fjwzcpr7k60xb6qx5izhw7lf2ggn34iwpihl0sa7f";
+    sha256 = "1qsy0ynhj1v0kyn3g3yf62g31rwxmpglfh9xh0w5lc9j5k1b5kcp";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/mate/eom/default.nix
+++ b/pkgs/desktops/mate/eom/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "eom";
-  version = "1.24.2";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "08rjckr1hdw7c31f2hzz3vq0rn0c5z3hmvl409y6k6ns583k1bgf";
+    sha256 = "1nv7q0yw11grgxr5lyvll0f7fl823kpjp05z81bwgnvd76m6kw97";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/mate/libmatekbd/default.nix
+++ b/pkgs/desktops/mate/libmatekbd/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "libmatekbd";
-  version = "1.24.1";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "17mcxfkvl14p04id3n5kbhpjwjq00c8wmbyciyy2hm7kwdln6zx8";
+    sha256 = "1b8iv2hmy8z2zzdsx8j5g583ddxh178bq8dnlqng9ifbn35fh3i2";
  };

  nativeBuildInputs = [ pkg-config gettext ];
--- a/pkgs/desktops/mate/libmatemixer/default.nix
+++ b/pkgs/desktops/mate/libmatemixer/default.nix
@ -7,11 +7,11 @@

 stdenv.mkDerivation rec {
  pname = "libmatemixer";
-  version = "1.24.1";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1n6rq7k66zvfd6sb7h92xihh021w9hysfa4yd1mzjcbb7c62ybqx";
+    sha256 = "1wcz4ppg696m31f5x7rkyvxxdriik2vprsr83b4wbs97bdhcr6ws";
  };

  nativeBuildInputs = [ pkg-config gettext ];
--- a/pkgs/desktops/mate/libmateweather/default.nix
+++ b/pkgs/desktops/mate/libmateweather/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "libmateweather";
-  version = "1.24.1";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "02d7c59pami1fzxg73mp6risa9hvsdpgs68f62wkg09nrppzsk4v";
+    sha256 = "05bvc220p135l6qnhh3qskljxffds0f7fjbjnrpq524w149rgzd7";
  };

  nativeBuildInputs = [ pkg-config gettext ];
--- a/pkgs/desktops/mate/marco/default.nix
+++ b/pkgs/desktops/mate/marco/default.nix
@ -1,13 +1,13 @@
 { lib, stdenv, fetchurl, pkg-config, gettext, itstool, libxml2, libcanberra-gtk3, libgtop
-, libXdamage, libXpresent, libstartup_notification, gnome, gtk3, mate-settings-daemon, wrapGAppsHook, mateUpdateScript }:
+, libXdamage, libXpresent, libstartup_notification, gnome, glib, gtk3, mate-settings-daemon, wrapGAppsHook, mateUpdateScript }:

 stdenv.mkDerivation rec {
  pname = "marco";
-  version = "1.24.2";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "19s2y2s9immp86ni3395mgxl605m2wn10m8399y9qkgw2b5m10s9";
+    sha256 = "01avxrg2fc6grfrp6hl8b0im4scy9xf6011swfrhli87ig6hhg7n";
  };

  nativeBuildInputs = [
@ -29,6 +29,8 @@ stdenv.mkDerivation rec {
    mate-settings-daemon
  ];

+  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+
  enableParallelBuilding = true;

  passthru.updateScript = mateUpdateScript { inherit pname version; };
--- a/pkgs/desktops/mate/mate-applets/default.nix
+++ b/pkgs/desktops/mate/mate-applets/default.nix
@ -1,37 +1,39 @@
-{ lib, stdenv, fetchurl, pkg-config, gettext, itstool, gnome, glib, gtk3, gtksourceview3, libwnck
-, libgtop, libxml2, libnotify, polkit, upower, wirelesstools, mate, hicolor-icon-theme, wrapGAppsHook
-, mateUpdateScript }:
+{ lib, stdenv, fetchurl, pkg-config, gettext, itstool, dbus-glib, glib, gtk3, gtksourceview3
+, gucharmap, libmateweather, libnl, libwnck, libgtop, libxml2, libnotify, mate-panel, polkit
+, upower, wirelesstools, mate, hicolor-icon-theme, wrapGAppsHook, mateUpdateScript }:

 stdenv.mkDerivation rec {
  pname = "mate-applets";
-  version = "1.24.1";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0h70i4x3bk017pgv4zn280682wm58vwdjm7kni91ni8rmblnnvyp";
+    sha256 = "0xy9dwiqvmimqshbfq80jxq65aznlgx491lqq8rl4x8c9sdl7q5p";
  };

  nativeBuildInputs = [
-    pkg-config
    gettext
    itstool
+    pkg-config
    wrapGAppsHook
  ];

  buildInputs = [
+    dbus-glib
    gtk3
    gtksourceview3
-    gnome.gucharmap
-    libwnck
+    gucharmap
+    hicolor-icon-theme
    libgtop
-    libxml2
+    libmateweather
+    libnl
    libnotify
+    libwnck
+    libxml2
+    mate-panel
    polkit
    upower
    wirelesstools
-    mate.libmateweather
-    mate.mate-panel
-    hicolor-icon-theme
  ];

  configureFlags = [ "--enable-suid=no" ];
--- a/pkgs/desktops/mate/mate-backgrounds/default.nix
+++ b/pkgs/desktops/mate/mate-backgrounds/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-backgrounds";
-  version = "1.24.2";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1ixb2vlm3dr52ibp4ggrbkf38m3q6i5lxjg4ix82gxbb6h6a3gp5";
+    sha256 = "0379hngy3ap1r5kmqvmzs9r710k2c9nal2ps3hq765df4ir15j8d";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/mate/mate-calc/default.nix
+++ b/pkgs/desktops/mate/mate-calc/default.nix
@ -1,24 +1,26 @@
-{ lib, stdenv, fetchurl, pkg-config, gettext, itstool, gtk3, libxml2, wrapGAppsHook, mateUpdateScript }:
+{ lib, stdenv, fetchurl, pkg-config, gettext, itstool, gtk3, libmpc, libxml2, mpfr, wrapGAppsHook, mateUpdateScript }:

 stdenv.mkDerivation rec {
  pname = "mate-calc";
-  version = "1.24.2";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1yg8j0dqy37fljd20pwxdgna3f1v7k9wmdr9l4r1nqf4a7zwi96l";
+    sha256 = "0mddfh9ixhh60nfgx5kcprcl9liavwqyina11q3pnpfs3n02df3y";
  };

  nativeBuildInputs = [
-    pkg-config
    gettext
    itstool
+    pkg-config
    wrapGAppsHook
  ];

  buildInputs = [
    gtk3
+    libmpc
    libxml2
+    mpfr
  ];

  enableParallelBuilding = true;
--- a/pkgs/desktops/mate/mate-common/default.nix
+++ b/pkgs/desktops/mate/mate-common/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-common";
-  version = "1.24.2";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0srb2ly5pjq1g0cs8m39nbfv33dvsc2j4g2gw081xis3awzh3lki";
+    sha256 = "014wpfqpqmfkzv81paap4fz15mj1gsyvaxlrfqsp9a3yxw4f7jaf";
  };

  enableParallelBuilding = true;
--- a/pkgs/desktops/mate/mate-control-center/default.nix
+++ b/pkgs/desktops/mate/mate-control-center/default.nix
@ -6,11 +6,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-control-center";
-  version = "1.24.2";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "18vsqkcl4n3k5aa05fqha61jc3133zw07gd604sm0krslwrwdn39";
+    sha256 = "0jhkn0vaz8glji4j5ar6im8l2wf40kssl07gfkz40rcgfzm18rr8";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/mate/mate-desktop/default.nix
+++ b/pkgs/desktops/mate/mate-desktop/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-desktop";
-  version = "1.24.1";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1nd1dn8mm1z6x4r68a25q4vzys1a6fmbzc94ss1z1n1872pczs6i";
+    sha256 = "18sj8smf0b998m5qvki37hxg0agcx7wmgz9z7cwv6v48i2dnnz2z";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/mate/mate-icon-theme/default.nix
+++ b/pkgs/desktops/mate/mate-icon-theme/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-icon-theme";
-  version = "1.24.0";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0a2lz61ivwwcdznmwlmgjr6ipr9sdl5g2czbagnpxkwz8f3m77na";
+    sha256 = "0nha555fhhn0j5wmzmdc7bh93ckzwwdm8mwmzma5whkzslv09xa1";
  };

  nativeBuildInputs = [ pkg-config gettext iconnamingutils ];
--- a/pkgs/desktops/mate/mate-indicator-applet/default.nix
+++ b/pkgs/desktops/mate/mate-indicator-applet/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-indicator-applet";
-  version = "1.24.0";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0m7pvbs5hhy5f400wqb8wp0dw3pyjpjnjax9qzc73j97l1k3zawf";
+    sha256 = "144fh9f3lag2cqnmb6zxlh8k83ya8kha6rmd7r8gg3z5w3nzpyz4";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/mate/mate-media/default.nix
+++ b/pkgs/desktops/mate/mate-media/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-media";
-  version = "1.24.1";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "118i4w2i2g3hfgbfn3hjzjkfq8vjj6049r7my3vna9js23b7ab92";
+    sha256 = "0fiwzsir8i1bqz7g7b20g5zs28qq63j41v9c5z69q8fq7wh1nwwb";
  };

  buildInputs = [
--- a/pkgs/desktops/mate/mate-menus/default.nix
+++ b/pkgs/desktops/mate/mate-menus/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-menus";
-  version = "1.24.1";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "17zc9fn14jykhn30z8iwlw0qwk32ivj6gxgww3xrqvqk0da5yaas";
+    sha256 = "1r7zf64aclaplz77hkl9kq0xnz6jk1l49z64i8v56c41pm59c283";
  };

  nativeBuildInputs = [ pkg-config gettext gobject-introspection ];
--- a/pkgs/desktops/mate/mate-netbook/default.nix
+++ b/pkgs/desktops/mate/mate-netbook/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-netbook";
-  version = "1.24.0";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1bmk9gq5gcqkvfppa7i1hqfph8sajc3xs189s4ha97g0ifwd98a8";
+    sha256 = "12gdy69nfysl8vmd8lv8b0lknkaagplrrz88nh6n0rmjkxnipgz3";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/mate/mate-notification-daemon/default.nix
+++ b/pkgs/desktops/mate/mate-notification-daemon/default.nix
@ -1,13 +1,13 @@
 { lib, stdenv, fetchurl, pkg-config, gettext, glib, libcanberra-gtk3,
-  libnotify, libwnck, gtk3, libxml2, wrapGAppsHook, mateUpdateScript }:
+  libnotify, libwnck, gtk3, libxml2, mate-desktop, mate-panel, wrapGAppsHook, mateUpdateScript }:

 stdenv.mkDerivation rec {
  pname = "mate-notification-daemon";
-  version = "1.24.2";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "02mf9186cbziyvz7ycb0j9b7rn085a7f9hrm03n28q5kz0z1k92q";
+    sha256 = "1fmr6hlcy2invp2yxqfqgpdx1dp4qa8xskjq2rm6v4gmz20nag5j";
  };

  nativeBuildInputs = [
@ -22,6 +22,8 @@ stdenv.mkDerivation rec {
    libnotify
    libwnck
    gtk3
+    mate-desktop
+    mate-panel
  ];

  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
--- a/pkgs/desktops/mate/mate-panel/default.nix
+++ b/pkgs/desktops/mate/mate-panel/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-panel";
-  version = "1.24.2";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1sj851h71nq4ssrsd4k5b0vayxmspl5x3rhf488b2xpcj81vmi9h";
+    sha256 = "0r7a8wy9p2x6r0c4qaa81qhhjc080rxnc6fznz7i6fkv2z91wbh9";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/mate/mate-polkit/default.nix
+++ b/pkgs/desktops/mate/mate-polkit/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-polkit";
-  version = "1.24.0";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1450bqzlnvwy3xa98lj102j2cf7piqbxcd1cy2zp41rdl8ri3gvn";
+    sha256 = "0kkjv025l1l8352m5ky1g7hmk7isgi3dnfnh7sqg9pyhml97i9dd";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/mate/mate-power-manager/default.nix
+++ b/pkgs/desktops/mate/mate-power-manager/default.nix
@ -1,12 +1,12 @@
-{ lib, stdenv, fetchurl, pkg-config, gettext, glib, itstool, libxml2, mate-panel, libnotify, libcanberra-gtk3, dbus-glib, upower, gnome, gtk3, libtool, polkit, wrapGAppsHook, mateUpdateScript }:
+{ lib, stdenv, fetchurl, pkg-config, gettext, glib, itstool, libxml2, mate-panel, libnotify, libcanberra-gtk3, libsecret, dbus-glib, upower, gtk3, libtool, polkit, wrapGAppsHook, mateUpdateScript }:

 stdenv.mkDerivation rec {
  pname = "mate-power-manager";
-  version = "1.24.3";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1rmcrpii3hl35qjznk6h5cq72n60cs12n294hjyakxr9kvgns7l6";
+    sha256 = "0ybvwv24g8awxjl2asgvx6l2ghn4limcm48ylha68dkpy3607di6";
  };

  nativeBuildInputs = [
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     libxml2
     libcanberra-gtk3
     gtk3
-     gnome.libgnome-keyring
+     libsecret
     libnotify
     dbus-glib
     upower
--- a/pkgs/desktops/mate/mate-screensaver/default.nix
+++ b/pkgs/desktops/mate/mate-screensaver/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-screensaver";
-  version = "1.24.2";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "18hxhglryfcbpbns9izigiws7lvdv5dnsaaz226ih3aar5db1ysy";
+    sha256 = "0xmgzrb5nk7x6ganf7jd4gmdafanx7f0znga0lhsd8kd40r40la1";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/mate/mate-sensors-applet/default.nix
+++ b/pkgs/desktops/mate/mate-sensors-applet/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-sensors-applet";
-  version = "1.24.1";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1nb4fy3mcymv7pmnc0czpxgp1sqvs533jwnqv1b5cqby415ljb16";
+    sha256 = "0s19r30fsicqvvcnz57lv158pi35w9zn5i7h5hz59224y0zpqhsc";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/mate/mate-session-manager/default.nix
+++ b/pkgs/desktops/mate/mate-session-manager/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-session-manager";
-  version = "1.24.3";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "18mhv8dq18hvx28gi88c9499s3s1nsq55m64sas8fqlvnp2sx84h";
+    sha256 = "05hqi8wlwjr07mp5njhp7h06mgnv98zsxaxkmxc5w3iwb3va45ar";
  };

  patches = [
--- a/pkgs/desktops/mate/mate-settings-daemon/default.nix
+++ b/pkgs/desktops/mate/mate-settings-daemon/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-settings-daemon";
-  version = "1.24.2";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "051r7xrx1byllsszbwsk646sq4izyag9yxg8jw2rm6x6mgwb89cc";
+    sha256 = "0hbdwqagxh1mdpxfdqr1ps3yqvk0v0c5zm0bwk56y6l1zwbs0ymp";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/mate/mate-system-monitor/default.nix
+++ b/pkgs/desktops/mate/mate-system-monitor/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-system-monitor";
-  version = "1.24.2";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1mbny5hs5805398krvcsvi1jfhyq9a9dfciyrnis67n2yisr1hzp";
+    sha256 = "13rkrk7c326ng8164aqfp6i7334n7zrmbg61ncpjprbrvlx2qiw3";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/mate/mate-terminal/default.nix
+++ b/pkgs/desktops/mate/mate-terminal/default.nix
@ -1,31 +1,27 @@
-{ lib, stdenv, fetchurl, pkg-config, gettext, glib, itstool, libxml2, mate, dconf, gtk3, vte, pcre2, wrapGAppsHook, mateUpdateScript }:
+{ lib, stdenv, fetchurl, pkg-config, gettext, itstool, libxml2, mate-desktop, dconf, vte, pcre2, wrapGAppsHook, mateUpdateScript }:

 stdenv.mkDerivation rec {
  pname = "mate-terminal";
-  version = "1.24.1";
+  version = "1.26.0";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0qmyhxmarwkxad8k1m9q1iwx70zhfp6zc2mh74nv26nj4gr3h3am";
+    sha256 = "08mgxbviik2dwwnbclp0518wlag2fhcr6c2yadgcbhwiq4aff9vp";
  };

-  buildInputs = [
-     glib
-     itstool
-     libxml2
-
-     mate.mate-desktop
-
-     vte
-     gtk3
-     dconf
-     pcre2
+  nativeBuildInputs = [
+    gettext
+    itstool
+    pkg-config
+    wrapGAppsHook
  ];

-  nativeBuildInputs = [
-    pkg-config
-    gettext
-    wrapGAppsHook
+  buildInputs = [
+    dconf
+    libxml2
+    mate-desktop
+    pcre2
+    vte
  ];

  enableParallelBuilding = true;
@ -33,7 +29,7 @@ stdenv.mkDerivation rec {
  passthru.updateScript = mateUpdateScript { inherit pname version; };

  meta = with lib; {
-    description = "The MATE Terminal Emulator";
+    description = "MATE desktop terminal emulator";
    homepage = "https://mate-desktop.org";
    license = licenses.gpl3Plus;
    platforms = platforms.unix;
--- a/Show more
+++ b/Show more