Merge master into haskell-updates

2024-09-21 12:59:04 +02:00 · 2021-10-31 00:07:29 +00:00 · 2021-10-31 00:07:29 +00:00 · c885901d64
parent dbfe42bc77 c713c5d261
commit c885901d64
181 changed files with 1834 additions and 858 deletions
--- a/doc/languages-frameworks/crystal.section.md
+++ b/doc/languages-frameworks/crystal.section.md
@ -4,12 +4,12 @@

 This section uses [Mint](https://github.com/mint-lang/mint) as an example for how to build a Crystal package.

-If the Crystal project has any dependencies, the first step is to get a `shards.nix` file encoding those. Get a copy of the project and go to its root directory such that its `shard.lock` file is in the current directory, then run `crystal2nix` in it
-
+If the Crystal project has any dependencies, the first step is to get a `shards.nix` file encoding those. Get a copy of the project and go to its root directory such that its `shard.lock` file is in the current directory. Executable projects should usually commit the `shard.lock` file, but sometimes that's not the case, which means you need to generate it yourself. With an existing `shard.lock` file, `crystal2nix` can be run.
 ```bash
 $ git clone https://github.com/mint-lang/mint
 $ cd mint
 $ git checkout 0.5.0
+$ if [ ! -f shard.lock ]; then nix-shell -p shards --run "shards lock"; fi
 $ nix-shell -p crystal2nix --run crystal2nix
 ```

--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -3641,10 +3641,10 @@
  };
  expipiplus1 = {
    email = "nix@monoid.al";
-    matrix = "@joe:monoid.al";
+    matrix = "@ellie:monoid.al";
    github = "expipiplus1";
    githubId = 857308;
-    name = "Joe Hermaszewski";
+    name = "Ellie Hermaszewska";
  };
  extends = {
    email = "sharosari@gmail.com";
--- a/nixos/doc/manual/from_md/installation/installing.chapter.xml
+++ b/nixos/doc/manual/from_md/installation/installing.chapter.xml
@ -25,8 +25,11 @@
    <para>
      You are logged-in automatically as <literal>nixos</literal>. The
      <literal>nixos</literal> user account has an empty password so you
-      can use <literal>sudo</literal> without a password.
+      can use <literal>sudo</literal> without a password:
    </para>
+    <programlisting>
+$ sudo -i
+</programlisting>
    <para>
      If you downloaded the graphical ISO image, you can run
      <literal>systemctl start display-manager</literal> to start the
--- a/nixos/doc/manual/installation/installing.chapter.md
+++ b/nixos/doc/manual/installation/installing.chapter.md
@ -15,7 +15,10 @@ finished booting, it should have detected most of your hardware.
 The NixOS manual is available by running `nixos-help`.

 You are logged-in automatically as `nixos`. The `nixos` user account has
-an empty password so you can use `sudo` without a password.
+an empty password so you can use `sudo` without a password:
+```ShellSession
+$ sudo -i
+```

 If you downloaded the graphical ISO image, you can run `systemctl
 start display-manager` to start the desktop environment. If you want
--- a/nixos/modules/installer/tools/nixos-enter.sh
+++ b/nixos/modules/installer/tools/nixos-enter.sh
@ -60,6 +60,35 @@ chmod 0755 "$mountPoint/dev" "$mountPoint/sys"
 mount --rbind /dev "$mountPoint/dev"
 mount --rbind /sys "$mountPoint/sys"

+# modified from https://github.com/archlinux/arch-install-scripts/blob/bb04ab435a5a89cd5e5ee821783477bc80db797f/arch-chroot.in#L26-L52
+chroot_add_resolv_conf() {
+    local chrootdir=$1 resolv_conf=$1/etc/resolv.conf
+
+    [[ -e /etc/resolv.conf ]] || return 0
+
+    # Handle resolv.conf as a symlink to somewhere else.
+    if [[ -L $chrootdir/etc/resolv.conf ]]; then
+      # readlink(1) should always give us *something* since we know at this point
+      # it's a symlink. For simplicity, ignore the case of nested symlinks.
+      # We also ignore the possibility if `../`s escaping the root.
+      resolv_conf=$(readlink "$chrootdir/etc/resolv.conf")
+      if [[ $resolv_conf = /* ]]; then
+        resolv_conf=$chrootdir$resolv_conf
+      else
+        resolv_conf=$chrootdir/etc/$resolv_conf
+      fi
+    fi
+
+    # ensure file exists to bind mount over
+    if [[ ! -f $resolv_conf ]]; then
+      install -Dm644 /dev/null "$resolv_conf" || return 1
+    fi
+
+    mount --bind /etc/resolv.conf "$resolv_conf"
+}
+
+chroot_add_resolv_conf "$mountPoint" || print "ERROR: failed to set up resolv.conf"
+
 (
    # If silent, write both stdout and stderr of activation script to /dev/null
    # otherwise, write both streams to stderr of this process
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -992,6 +992,7 @@
  ./services/web-apps/jitsi-meet.nix
  ./services/web-apps/keycloak.nix
  ./services/web-apps/lemmy.nix
+  ./services/web-apps/invidious.nix
  ./services/web-apps/limesurvey.nix
  ./services/web-apps/mastodon.nix
  ./services/web-apps/mattermost.nix
--- a/nixos/modules/services/web-apps/invidious.nix
+++ b/nixos/modules/services/web-apps/invidious.nix
@ -0,0 +1,263 @@
+{ lib, config, pkgs, options, ... }:
+let
+  cfg = config.services.invidious;
+  # To allow injecting secrets with jq, json (instead of yaml) is used
+  settingsFormat = pkgs.formats.json { };
+  inherit (lib) types;
+
+  settingsFile = settingsFormat.generate "invidious-settings" cfg.settings;
+
+  serviceConfig = {
+    systemd.services.invidious = {
+      description = "Invidious (An alternative YouTube front-end)";
+      wants = [ "network-online.target" ];
+      after = [ "syslog.target" "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      script =
+        let
+          jqFilter = "."
+            + lib.optionalString (cfg.database.host != null) "[0].db.password = \"'\"'\"$(cat ${lib.escapeShellArg cfg.database.passwordFile})\"'\"'\""
+            + " | .[0]"
+            + lib.optionalString (cfg.extraSettingsFile != null) " * .[1]";
+          jqFiles = [ settingsFile ] ++ lib.optional (cfg.extraSettingsFile != null) cfg.extraSettingsFile;
+        in
+        ''
+          export INVIDIOUS_CONFIG="$(${pkgs.jq}/bin/jq -s "${jqFilter}" ${lib.escapeShellArgs jqFiles})"
+          exec ${cfg.package}/bin/invidious
+        '';
+
+      serviceConfig = {
+        RestartSec = "2s";
+        DynamicUser = true;
+
+        CapabilityBoundingSet = "";
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProtectHome = true;
+        ProtectKernelLogs = true;
+        ProtectProc = "invisible";
+        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
+      };
+    };
+
+    services.invidious.settings = {
+      inherit (cfg) port;
+
+      # Automatically initialises and migrates the database if necessary
+      check_tables = true;
+
+      db = {
+        user = lib.mkDefault "kemal";
+        dbname = lib.mkDefault "invidious";
+        port = cfg.database.port;
+        # Blank for unix sockets, see
+        # https://github.com/will/crystal-pg/blob/1548bb255210/src/pq/conninfo.cr#L100-L108
+        host = if cfg.database.host == null then "" else cfg.database.host;
+        # Not needed because peer authentication is enabled
+        password = lib.mkIf (cfg.database.host == null) "";
+      };
+    } // (lib.optionalAttrs (cfg.domain != null) {
+      inherit (cfg) domain;
+    });
+
+    assertions = [{
+      assertion = cfg.database.host != null -> cfg.database.passwordFile != null;
+      message = "If database host isn't null, database password needs to be set";
+    }];
+  };
+
+  # Settings necessary for running with an automatically managed local database
+  localDatabaseConfig = lib.mkIf cfg.database.createLocally {
+    # Default to using the local database if we create it
+    services.invidious.database.host = lib.mkDefault null;
+
+    services.postgresql = {
+      enable = true;
+      ensureDatabases = lib.singleton cfg.settings.db.dbname;
+      ensureUsers = lib.singleton {
+        name = cfg.settings.db.user;
+        ensurePermissions = {
+          "DATABASE ${cfg.settings.db.dbname}" = "ALL PRIVILEGES";
+        };
+      };
+      # This is only needed because the unix user invidious isn't the same as
+      # the database user. This tells postgres to map one to the other.
+      identMap = ''
+        invidious invidious ${cfg.settings.db.user}
+      '';
+      # And this specifically enables peer authentication for only this
+      # database, which allows passwordless authentication over the postgres
+      # unix socket for the user map given above.
+      authentication = ''
+        local ${cfg.settings.db.dbname} ${cfg.settings.db.user} peer map=invidious
+      '';
+    };
+
+    systemd.services.invidious-db-clean = {
+      description = "Invidious database cleanup";
+      documentation = [ "https://docs.invidious.io/Database-Information-and-Maintenance.md" ];
+      startAt = lib.mkDefault "weekly";
+      path = [ config.services.postgresql.package ];
+      script = ''
+        psql ${cfg.settings.db.dbname} ${cfg.settings.db.user} -c "DELETE FROM nonces * WHERE expire < current_timestamp"
+        psql ${cfg.settings.db.dbname} ${cfg.settings.db.user} -c "TRUNCATE TABLE videos"
+      '';
+      serviceConfig = {
+        DynamicUser = true;
+        User = "invidious";
+      };
+    };
+
+    systemd.services.invidious = {
+      requires = [ "postgresql.service" ];
+      after = [ "postgresql.service" ];
+
+      serviceConfig = {
+        User = "invidious";
+      };
+    };
+  };
+
+  nginxConfig = lib.mkIf cfg.nginx.enable {
+    services.invidious.settings = {
+      https_only = config.services.nginx.virtualHosts.${cfg.domain}.forceSSL;
+      external_port = 80;
+    };
+
+    services.nginx = {
+      enable = true;
+      virtualHosts.${cfg.domain} = {
+        locations."/".proxyPass = "http://127.0.0.1:${toString cfg.port}";
+
+        enableACME = lib.mkDefault true;
+        forceSSL = lib.mkDefault true;
+      };
+    };
+
+    assertions = [{
+      assertion = cfg.domain != null;
+      message = "To use services.invidious.nginx, you need to set services.invidious.domain";
+    }];
+  };
+in
+{
+  options.services.invidious = {
+    enable = lib.mkEnableOption "Invidious";
+
+    package = lib.mkOption {
+      type = types.package;
+      default = pkgs.invidious;
+      defaultText = "pkgs.invidious";
+      description = "The Invidious package to use.";
+    };
+
+    settings = lib.mkOption {
+      type = settingsFormat.type;
+      default = { };
+      description = ''
+        The settings Invidious should use.
+
+        See <link xlink:href="https://github.com/iv-org/invidious/blob/master/config/config.example.yml">config.example.yml</link> for a list of all possible options.
+      '';
+    };
+
+    extraSettingsFile = lib.mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        A file including Invidious settings.
+
+        It gets merged with the setttings specified in <option>services.invidious.settings</option>
+        and can be used to store secrets like <literal>hmac_key</literal> outside of the nix store.
+      '';
+    };
+
+    # This needs to be outside of settings to avoid infinite recursion
+    # (determining if nginx should be enabled and therefore the settings
+    # modified).
+    domain = lib.mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        The FQDN Invidious is reachable on.
+
+        This is used to configure nginx and for building absolute URLs.
+      '';
+    };
+
+    port = lib.mkOption {
+      type = types.port;
+      # Default from https://docs.invidious.io/Configuration.md
+      default = 3000;
+      description = ''
+        The port Invidious should listen on.
+
+        To allow access from outside,
+        you can use either <option>services.invidious.nginx</option>
+        or add <literal>config.services.invidious.port</literal> to <option>networking.firewall.allowedTCPPorts</option>.
+      '';
+    };
+
+    database = {
+      createLocally = lib.mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whether to create a local database with PostgreSQL.
+        '';
+      };
+
+      host = lib.mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          The database host Invidious should use.
+
+          If <literal>null</literal>, the local unix socket is used. Otherwise
+          TCP is used.
+        '';
+      };
+
+      port = lib.mkOption {
+        type = types.port;
+        default = options.services.postgresql.port.default;
+        description = ''
+          The port of the database Invidious should use.
+
+          Defaults to the the default postgresql port.
+        '';
+      };
+
+      passwordFile = lib.mkOption {
+        type = types.nullOr types.str;
+        apply = lib.mapNullable toString;
+        default = null;
+        description = ''
+          Path to file containing the database password.
+        '';
+      };
+    };
+
+    nginx.enable = lib.mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to configure nginx as a reverse proxy for Invidious.
+
+        It serves it under the domain specified in <option>services.invidious.settings.domain</option> with enabled TLS and ACME.
+        Further configuration can be done through <option>services.nginx.virtualHosts.''${config.services.invidious.settings.domain}.*</option>,
+        which can also be used to disable AMCE and TLS.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable (lib.mkMerge [
+    serviceConfig
+    localDatabaseConfig
+    nginxConfig
+  ]);
+}
--- a/nixos/modules/services/web-apps/lemmy.nix
+++ b/nixos/modules/services/web-apps/lemmy.nix
@ -214,8 +214,6 @@ in
      systemd.services.lemmy-postgresql = mkIf cfg.settings.database.createLocally {
        description = "Lemmy postgresql db";
        after = [ "postgresql.service" ];
-        bindsTo = [ "postgresql.service" ];
-        requiredBy = [ "lemmy.service" ];
        partOf = [ "lemmy.service" ];
        script = with cfg.settings.database; ''
          PSQL() {
--- a/nixos/modules/services/web-apps/plantuml-server.nix
+++ b/nixos/modules/services/web-apps/plantuml-server.nix
@ -58,8 +58,8 @@ in

      graphvizPackage = mkOption {
        type = types.package;
-        default = pkgs.graphviz_2_32;
-        defaultText = literalExpression "pkgs.graphviz_2_32";
+        default = pkgs.graphviz;
+        defaultText = literalExpression "pkgs.graphviz";
        description = "Package containing the dot executable.";
      };

--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -34,7 +34,6 @@ in
  avahi-with-resolved = handleTest ./avahi.nix { networkd = true; };
  awscli = handleTest ./awscli.nix { };
  babeld = handleTest ./babeld.nix {};
-  bat = handleTest ./bat.nix {};
  bazarr = handleTest ./bazarr.nix {};
  bcachefs = handleTestOn ["x86_64-linux"] ./bcachefs.nix {}; # linux-4.18.2018.10.12 is unsupported on aarch64
  beanstalkd = handleTest ./beanstalkd.nix {};
@ -174,6 +173,7 @@ in
  hedgedoc = handleTest ./hedgedoc.nix {};
  herbstluftwm = handleTest ./herbstluftwm.nix {};
  installed-tests = pkgs.recurseIntoAttrs (handleTest ./installed-tests {});
+  invidious = handleTest ./invidious.nix {};
  oci-containers = handleTestOn ["x86_64-linux"] ./oci-containers.nix {};
  # 9pnet_virtio used to mount /nix partition doesn't support
  # hibernation. This test happens to work on x86_64-linux but
--- a/nixos/tests/bat.nix
+++ b/nixos/tests/bat.nix
@ -1,12 +0,0 @@
-import ./make-test-python.nix ({ pkgs, ... }: {
-  name = "bat";
-  meta = with pkgs.lib.maintainers; { maintainers = [ nequissimus ]; };
-
-  machine = { pkgs, ... }: { environment.systemPackages = [ pkgs.bat ]; };
-
-  testScript = ''
-    machine.succeed("echo 'Foobar\n\n\n42' > /tmp/foo")
-    assert "Foobar" in machine.succeed("bat -p /tmp/foo")
-    assert "42" in machine.succeed("bat -p /tmp/foo -r 4:4")
-  '';
-})
--- a/nixos/tests/invidious.nix
+++ b/nixos/tests/invidious.nix
@ -0,0 +1,81 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "invidious";
+
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ sbruder ];
+  };
+
+  machine = { config, lib, pkgs, ... }: {
+    services.invidious = {
+      enable = true;
+    };
+
+    specialisation = {
+      nginx.configuration = {
+        services.invidious = {
+          nginx.enable = true;
+          domain = "invidious.example.com";
+        };
+        services.nginx.virtualHosts."invidious.example.com" = {
+          forceSSL = false;
+          enableACME = false;
+        };
+        networking.hosts."127.0.0.1" = [ "invidious.example.com" ];
+      };
+      postgres-tcp.configuration = {
+        services.invidious = {
+          database = {
+            createLocally = false;
+            host = "127.0.0.1";
+            passwordFile = toString (pkgs.writeText "database-password" "correct horse battery staple");
+          };
+        };
+        # Normally not needed because when connecting to postgres over TCP/IP
+        # the database is most likely on another host.
+        systemd.services.invidious = {
+          after = [ "postgresql.service" ];
+          requires = [ "postgresql.service" ];
+        };
+        services.postgresql =
+          let
+            inherit (config.services.invidious.settings.db) dbname user;
+          in
+          {
+            enable = true;
+            initialScript = pkgs.writeText "init-postgres-with-password" ''
+              CREATE USER kemal WITH PASSWORD 'correct horse battery staple';
+              CREATE DATABASE invidious;
+              GRANT ALL PRIVILEGES ON DATABASE invidious TO kemal;
+            '';
+          };
+      };
+    };
+  };
+
+  testScript = { nodes, ... }: ''
+    def curl_assert_status_code(url, code, form=None):
+        assert int(machine.succeed(f"curl -s -o /dev/null -w %{{http_code}} {'-F ' + form + ' ' if form else '''}{url}")) == code
+
+
+    def activate_specialisation(name: str):
+        machine.succeed(f"${nodes.machine.config.system.build.toplevel}/specialisation/{name}/bin/switch-to-configuration test >&2")
+
+
+    url = "http://localhost:${toString nodes.machine.config.services.invidious.port}"
+    port = ${toString nodes.machine.config.services.invidious.port}
+
+    machine.wait_for_open_port(port)
+    curl_assert_status_code(f"{url}/search", 200)
+
+    activate_specialisation("nginx")
+    machine.wait_for_open_port(80)
+    curl_assert_status_code("http://invidious.example.com/search", 200)
+
+    # Remove the state so the `initialScript` gets run
+    machine.succeed("systemctl stop postgresql")
+    machine.succeed("rm -r /var/lib/postgresql")
+    activate_specialisation("postgres-tcp")
+    machine.wait_for_open_port(port)
+    curl_assert_status_code(f"{url}/search", 200)
+  '';
+})
--- a/nixos/tests/sssd-ldap.nix
+++ b/nixos/tests/sssd-ldap.nix
@ -1,96 +1,94 @@
-({ pkgs, ... }:
-  let
-    dbDomain = "example.org";
-    dbSuffix = "dc=example,dc=org";
+let
+  dbDomain = "example.org";
+  dbSuffix = "dc=example,dc=org";

-    ldapRootUser = "admin";
-    ldapRootPassword = "foobar";
+  ldapRootUser = "admin";
+  ldapRootPassword = "foobar";

-    testUser = "alice";
-  in import ./make-test-python.nix {
-    name = "sssd-ldap";
+  testUser = "alice";
+in import ./make-test-python.nix ({pkgs, ...}: {
+  name = "sssd-ldap";

-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ bbigras ];
-    };
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ bbigras ];
+  };

-    machine = { pkgs, ... }: {
-      services.openldap = {
-        enable = true;
-        settings = {
-          children = {
-            "cn=schema".includes = [
-              "${pkgs.openldap}/etc/schema/core.ldif"
-              "${pkgs.openldap}/etc/schema/cosine.ldif"
-              "${pkgs.openldap}/etc/schema/inetorgperson.ldif"
-              "${pkgs.openldap}/etc/schema/nis.ldif"
-            ];
-            "olcDatabase={1}mdb" = {
-              attrs = {
-                objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
-                olcDatabase = "{1}mdb";
-                olcDbDirectory = "/var/db/openldap";
-                olcSuffix = dbSuffix;
-                olcRootDN = "cn=${ldapRootUser},${dbSuffix}";
-                olcRootPW = ldapRootPassword;
-              };
+  machine = { pkgs, ... }: {
+    services.openldap = {
+      enable = true;
+      settings = {
+        children = {
+          "cn=schema".includes = [
+            "${pkgs.openldap}/etc/schema/core.ldif"
+            "${pkgs.openldap}/etc/schema/cosine.ldif"
+            "${pkgs.openldap}/etc/schema/inetorgperson.ldif"
+            "${pkgs.openldap}/etc/schema/nis.ldif"
+          ];
+          "olcDatabase={1}mdb" = {
+            attrs = {
+              objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
+              olcDatabase = "{1}mdb";
+              olcDbDirectory = "/var/db/openldap";
+              olcSuffix = dbSuffix;
+              olcRootDN = "cn=${ldapRootUser},${dbSuffix}";
+              olcRootPW = ldapRootPassword;
            };
          };
        };
-        declarativeContents = {
-          ${dbSuffix} = ''
-            dn: ${dbSuffix}
-            objectClass: top
-            objectClass: dcObject
-            objectClass: organization
-            o: ${dbDomain}
-
-            dn: ou=posix,${dbSuffix}
-            objectClass: top
-            objectClass: organizationalUnit
-
-            dn: ou=accounts,ou=posix,${dbSuffix}
-            objectClass: top
-            objectClass: organizationalUnit
-
-            dn: uid=${testUser},ou=accounts,ou=posix,${dbSuffix}
-            objectClass: person
-            objectClass: posixAccount
-            # userPassword: somePasswordHash
-            homeDirectory: /home/${testUser}
-            uidNumber: 1234
-            gidNumber: 1234
-            cn: ""
-            sn: ""
-          '';
-        };
      };
+      declarativeContents = {
+        ${dbSuffix} = ''
+          dn: ${dbSuffix}
+          objectClass: top
+          objectClass: dcObject
+          objectClass: organization
+          o: ${dbDomain}

-      services.sssd = {
-        enable = true;
-        config = ''
-          [sssd]
-          config_file_version = 2
-          services = nss, pam, sudo
-          domains = ${dbDomain}
+          dn: ou=posix,${dbSuffix}
+          objectClass: top
+          objectClass: organizationalUnit

-          [domain/${dbDomain}]
-          auth_provider = ldap
-          id_provider = ldap
-          ldap_uri = ldap://127.0.0.1:389
-          ldap_search_base = ${dbSuffix}
-          ldap_default_bind_dn = cn=${ldapRootUser},${dbSuffix}
-          ldap_default_authtok_type = password
-          ldap_default_authtok = ${ldapRootPassword}
+          dn: ou=accounts,ou=posix,${dbSuffix}
+          objectClass: top
+          objectClass: organizationalUnit
+
+          dn: uid=${testUser},ou=accounts,ou=posix,${dbSuffix}
+          objectClass: person
+          objectClass: posixAccount
+          # userPassword: somePasswordHash
+          homeDirectory: /home/${testUser}
+          uidNumber: 1234
+          gidNumber: 1234
+          cn: ""
+          sn: ""
        '';
      };
    };

-    testScript = ''
-      machine.start()
-      machine.wait_for_unit("openldap.service")
-      machine.wait_for_unit("sssd.service")
-      machine.succeed("getent passwd ${testUser}")
-    '';
-  }
-)
+    services.sssd = {
+      enable = true;
+      config = ''
+        [sssd]
+        config_file_version = 2
+        services = nss, pam, sudo
+        domains = ${dbDomain}
+
+        [domain/${dbDomain}]
+        auth_provider = ldap
+        id_provider = ldap
+        ldap_uri = ldap://127.0.0.1:389
+        ldap_search_base = ${dbSuffix}
+        ldap_default_bind_dn = cn=${ldapRootUser},${dbSuffix}
+        ldap_default_authtok_type = password
+        ldap_default_authtok = ${ldapRootPassword}
+      '';
+    };
+  };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("openldap.service")
+    machine.wait_for_unit("sssd.service")
+    machine.succeed("getent passwd ${testUser}")
+  '';
+})
--- a/pkgs/applications/blockchains/ergo/default.nix
+++ b/pkgs/applications/blockchains/ergo/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "ergo";
-  version = "4.0.13";
+  version = "4.0.15";

  src = fetchurl {
    url = "https://github.com/ergoplatform/ergo/releases/download/v${version}/ergo-${version}.jar";
-    sha256 = "sha256-HNpyUD2Tep2XnY3lr5a3ec+NmJtt0VvJx6ujVvSugXo=";
+    sha256 = "sha256-4omuu/9EeywWDkk//4TTal/1siCe/4YMmEsIefBxsuY=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/editors/featherpad/default.nix
+++ b/pkgs/applications/editors/featherpad/default.nix
@ -3,13 +3,13 @@

 mkDerivation rec {
  pname = "featherpad";
-  version = "1.0.0";
+  version = "1.0.1";

  src = fetchFromGitHub {
    owner = "tsujan";
    repo = "FeatherPad";
    rev = "V${version}";
-    sha256 = "sha256-GcOvof6bD7GNrABXIR8jOfzjDEN5Lvnj24M154iqQgU=";
+    sha256 = "sha256-FeqTPDix2tqTJ3UU6i2e6FkmCO0KMNt4tLtrPjX57fc=";
  };

  nativeBuildInputs = [ cmake pkg-config qttools ];
--- a/pkgs/applications/logging/humioctl/default.nix
+++ b/pkgs/applications/logging/humioctl/default.nix
@ -1,8 +1,8 @@
 { buildGoModule, fetchFromGitHub, installShellFiles, lib }:

 let
-  humioCtlVersion = "0.28.6";
-  sha256 = "sha256-15RRoTr+N+DsILYF1KndAwsW329w+UxHfB1VaWnkEFI=";
+  humioCtlVersion = "0.28.11";
+  sha256 = "sha256-CdGeGpOEWYn7yIWJxWpRrSPHcuult+jtqpjYaSjfBLQ=";
  vendorSha256 = "sha256-fgRQ2n5tzj5s4rT65VIqh61wDwu+x/fWhpaKwyr8XWA=";
 in buildGoModule {
    name = "humioctl-${humioCtlVersion}";
--- a/pkgs/applications/misc/flavours/default.nix
+++ b/pkgs/applications/misc/flavours/default.nix
@ -2,18 +2,18 @@

 rustPlatform.buildRustPackage rec {
  pname = "flavours";
-  version = "0.5.0";
+  version = "0.5.1";

  src = fetchFromGitHub {
    owner = "Misterio77";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1bgi6p7l0bh9k4vkwvngk7q19ynia0z1ninb1cq8qnwwpll6kbya";
+    sha256 = "sha256-77nSz3J/9TsptpSHRFYY8mZAvn+o35gro2OwQkGzEC0=";
  };

  buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];

-  cargoSha256 = "07hwxhfcbqbwb3hz18w92h1lhdiwwy7abhwpimzx7syyavp4rmn4";
+  cargoSha256 = "sha256-UukLWMd8+wq5Y0dtePH312c1Nm4ztXPsoPHPN0nUb1w=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/misc/gxkb/default.nix
+++ b/pkgs/applications/misc/gxkb/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "gxkb";
-  version = "0.9.2";
+  version = "0.9.3";

  src = fetchFromGitHub {
    owner = "zen-tools";
    repo = "gxkb";
    rev = "v${version}";
-    sha256 = "sha256-KIlosBNfGSYCgtxBuSVeSfHaLsANdLgG/P5UtAL6Hms=";
+    sha256 = "sha256-9r1eZl7PgIt2ZpK+QQHaa460imIHT3Lh5mpzcFglyWc=";
  };

  nativeBuildInputs = [ pkg-config autoreconfHook ];
--- a/pkgs/applications/misc/heimer/default.nix
+++ b/pkgs/applications/misc/heimer/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "heimer";
-  version = "2.6.0";
+  version = "2.8.0";

  src = fetchFromGitHub {
    owner = "juzzlin";
    repo = pname;
    rev = version;
-    sha256 = "sha256-VSj6bSb92XMsfvDH+cey2GXLnJajUBaCqLMgkv2fnSo=";
+    sha256 = "sha256-838uH8nTxl3FJvtYrLDmS6tYYRdNnFzftZ5RZE8tVpE=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/misc/hunter/default.nix
+++ b/pkgs/applications/misc/hunter/default.nix
@ -1,77 +0,0 @@
-{ lib, stdenv, pkg-config, rustPlatform, fetchFromGitHub, fetchpatch
-, makeWrapper, glib, gst_all_1, CoreServices, IOKit, Security }:
-
-rustPlatform.buildRustPackage rec {
-  pname = "hunter";
-  version = "2020-05-25-unstable";
-
-  src = fetchFromGitHub {
-    owner = "rabite0";
-    repo = "hunter";
-    rev = "355d9a3101f6d8dc375807de79e368602f1cb87d";
-    sha256 = "sha256-R2wNkG8bFP7X2pdlebHK6GD15qmD/zD3L0MwVthvzzQ=";
-  };
-
-  patches = [
-    (fetchpatch {
-      name = "remove-dependencies-on-rust-nightly";
-      url = "https://github.com/06kellyjac/hunter/commit/a5943578e1ee679c8bc51b0e686c6dddcf74da2a.diff";
-      sha256 = "sha256-eOwBFfW5m8tPnu+whWY/53X9CaqiVj2WRr25G+Yy7qE=";
-    })
-    (fetchpatch {
-      name = "fix-accessing-core-when-moved-with-another-clone";
-      url = "https://github.com/06kellyjac/hunter/commit/2e95cc567c751263f8c318399f3c5bb01d36962a.diff";
-      sha256 = "sha256-yTzIXUw5qEaR2QZHwydg0abyZVXfK6fhJLVHBI7EAro=";
-    })
-    (fetchpatch {
-      name = "fix-resolve-breaking-changes-from-package-updates";
-      url = "https://github.com/06kellyjac/hunter/commit/2484f0db580bed1972fd5000e1e949a4082d2f01.diff";
-      sha256 = "sha256-K+WUxEr1eE68XejStj/JwQpMHlhkiOw6PmiSr1GO0kc=";
-    })
-  ];
-
-  cargoPatches = [
-    (fetchpatch {
-      name = "chore-cargo-update";
-      url = "https://github.com/06kellyjac/hunter/commit/b0be49a82191a4420b6900737901a71140433efd.diff";
-      sha256 = "sha256-ctxoDwyIJgEhMbMUfrjCTy2SeMUQqMi971szrqEOJeg=";
-    })
-    (fetchpatch {
-      name = "chore-cargo-upgrade-+-cargo-update";
-      url = "https://github.com/06kellyjac/hunter/commit/1b8de9248312878358afaf1dac569ebbccc4321a.diff";
-      sha256 = "sha256-+4DZ8SaKwKNmr2SEgJJ7KZBIctnYFMQFKgG+yCkbUv0=";
-    })
-  ];
-
-  RUSTC_BOOTSTRAP = 1;
-
-  nativeBuildInputs = [ makeWrapper pkg-config ];
-  buildInputs = [
-    glib
-  ] ++ (with gst_all_1; [
-    gstreamer
-    gst-plugins-base
-    gst-plugins-good
-    gst-plugins-ugly
-    gst-plugins-bad
-  ]) ++ lib.optionals stdenv.isDarwin [ CoreServices IOKit Security ];
-
-  cargoBuildFlags = [ "--no-default-features" "--features=img,video" ];
-
-  postInstall = ''
-    wrapProgram $out/bin/hunter --prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0"
-  '';
-
-  cargoSha256 = "sha256-Bd/gilebxC4H+/1A41OSSfWBlHcSczsFcU2b+USnI74=";
-
-  meta = with lib; {
-    description = "The fastest file manager in the galaxy!";
-    homepage = "https://github.com/rabite0/hunter";
-    license = licenses.wtfpl;
-    maintainers = with maintainers; [ fufexan ];
-    # error[E0308]: mismatched types
-    # --> src/files.rs:502:62
-    # expected raw pointer `*const u8`, found raw pointer `*const i8`
-    broken = stdenv.isAarch64;
-  };
-}
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -44,9 +44,9 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "95.0.4638.54",
-    "sha256": "1zb1009gg9962axn2l1krycz7ml20i8z2n3ka2psxpg68pbqivry",
-    "sha256bin64": "0mf9jfzwz6nkz1yg8lndz1gmsvmdh1rxhqkv0vd9nr04h5x9b41a",
+    "version": "95.0.4638.69",
+    "sha256": "1rzg48mbd5n75nq2rfwknyxpmfrddds199ic82c736kcgirpv8rq",
+    "sha256bin64": "1jhxm12sdlgvgnny0p56xsfyxd78mwn9qwc20c33qfvwxrzp9ajp",
    "deps": {
      "gn": {
        "version": "2021-08-11",
@ -55,8 +55,8 @@
        "sha256": "031znmkbm504iim5jvg3gmazj4qnkfc7zg8aymjsij18fhf7piz0"
      },
      "ungoogled-patches": {
-        "rev": "95.0.4638.54-1",
-        "sha256": "01jkkz5224aaj5cgdmqknf8v73fyaw4q8bzbqa520a0lvl7hwbg5"
+        "rev": "95.0.4638.69-1",
+        "sha256": "19azr4m4rd6za9vgcggijyq9x54jrjp0n07y4falgjrdz9q4f7aj"
      }
    }
  }
--- a/pkgs/applications/networking/browsers/elinks/default.nix
+++ b/pkgs/applications/networking/browsers/elinks/default.nix
@ -13,13 +13,13 @@ assert enablePython -> python != null;

 stdenv.mkDerivation rec {
  pname = "elinks";
-  version = "0.14.2";
+  version = "0.14.3";

  src = fetchFromGitHub {
    owner = "rkd77";
    repo = "felinks";
    rev = "v${version}";
-    sha256 = "sha256-/VsxMpITBDKJqyMwl1oitS8aUM4AziibV/OHRSHbRjg=";
+    sha256 = "sha256-vyzuMU2Qfz8DMRP0+QQmSx8J40ADTMJqg2jQOZJQxUA=";
  };

  buildInputs = [
--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@ -2,15 +2,15 @@

 buildGoModule rec {
  pname = "argocd";
-  version = "2.1.2";
-  commit = "7af9dfb3524c13e941ab604e36e49a617fe47d2e";
+  version = "2.1.6";
+  commit = "a346cf933e10d872eae26bff8e58c5e7ac40db25";
  tag = "v${version}";

  src = fetchFromGitHub {
    owner = "argoproj";
    repo = "argo-cd";
    rev = tag;
-    sha256 = "1pr48z1qhv7xxnllr00zz2v0ygxmq2hjdyk0j3zazflnqr2mc596";
+    sha256 = "sha256-8DeVO7Wr1bFZXTp2kaEPizDwNU5ZsA1fykccaDUivh8=";
  };

  vendorSha256 = "sha256-N45yRlBGZ/c9ve2YPcWA26pylV8hzxjPh6evKtkgnoc=";
--- a/pkgs/applications/networking/cluster/fluxcd/default.nix
+++ b/pkgs/applications/networking/cluster/fluxcd/default.nix
@ -1,9 +1,9 @@
 { lib, buildGoModule, fetchFromGitHub, fetchzip, installShellFiles }:

 let
-  version = "0.19.1";
-  sha256 = "184f5q3aa4p6gjdmr8x6a97rzaj64ws8bf3q8sz4xjyznznwcpp0";
-  manifestsSha256 = "1xxf572yvjmik7dvijz810lxzfj7irddznl4icidn7hrljzjrv95";
+  version = "0.20.0";
+  sha256 = "06n4d7l00lmrrs7s41mjfk06c0cj04v0s0mbs9b3ppzbws07wca5";
+  manifestsSha256 = "03hfnqc19n3iz47a5137lmwq4mgd6dxcl6ml057kq1bxm2qsq3y4";

  manifests = fetchzip {
    url = "https://github.com/fluxcd/flux2/releases/download/v${version}/manifests.tar.gz";
@ -23,7 +23,7 @@ buildGoModule rec {
    inherit sha256;
  };

-  vendorSha256 = "sha256-1ZIeS42LoreZKkzDNZxmF17HeDWWVo49CaZDrIR2U9g=";
+  vendorSha256 = "sha256-WkPdBipgEOBy0qjPaX7zGfspWfCtiFB1MUMHLlHGB/U=";

  postUnpack = ''
    cp -r ${manifests} source/cmd/flux/manifests
--- a/pkgs/applications/networking/cluster/helmsman/default.nix
+++ b/pkgs/applications/networking/cluster/helmsman/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "helmsman";
-  version = "3.7.5";
+  version = "3.7.7";

  src = fetchFromGitHub {
    owner = "Praqma";
    repo = "helmsman";
    rev = "v${version}";
-    sha256 = "sha256-QJXCVcEf23oaTDemoCV/2aaajbubfXg0AfZrlSTS4Ag=";
+    sha256 = "sha256-duNkvRMq3CKAGDDsrDWKydFZRt6fxuO0uP2Ff3HA+ek=";
  };

  vendorSha256 = "sha256-4imZrZfpR/5tw9ZFSTr7Gx4G9O1iHNE9YRYMOJFKvHU=";
--- a/pkgs/applications/networking/cluster/terraform-docs/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-docs/default.nix
@ -1,16 +1,16 @@
 { lib, buildGoModule, fetchFromGitHub }:
 buildGoModule rec {
  pname = "terraform-docs";
-  version = "0.15.0";
+  version = "0.16.0";

  src = fetchFromGitHub {
    owner = "terraform-docs";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-PzGlEEhootf2SCOy7+11aST7NMTNhNMQWeZO40mrMYQ=";
+    sha256 = "sha256-zSSK2WfcbD1DvqsFUKdTydLfyApWzm1h+ihSnLUmq2E=";
  };

-  vendorSha256 = "sha256-T/jgFPBUQMATX7DoWsDR/VFjka7Vxk7F4taE25cdnTk=";
+  vendorSha256 = "sha256-0Bkjx/gq2MAWjxoMSGtBcRzv40SSUVDZBh4PzEtKj5o=";

  subPackages = [ "." ];

--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "terragrunt";
-  version = "0.35.1";
+  version = "0.35.5";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-DCum3vCrN530Z0VW0WEoLtjN+kre/mU9O+sJxckZgfc=";
+    sha256 = "sha256-VUB1zZwRZ+TUFDcq/lBB9eAeM7d5zWhFy7nxzH5S6oc=";
  };

  vendorSha256 = "sha256-y84EFmoJS4SeA5YFIVFU0iWa5NnjU5yvOj7OFE+jGN0=";
--- a/pkgs/applications/networking/hyprspace/default.nix
+++ b/pkgs/applications/networking/hyprspace/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "hyprspace";
-  version = "0.1.6";
+  version = "0.1.7";

  propagatedBuildInputs = lib.optional stdenv.isDarwin iproute2mac;

@ -10,10 +10,10 @@ buildGoModule rec {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-g0oyI3jnqQADyOrpnK4IvpFQPEwNrpvyDS+DhBDXZGg=";
+    sha256 = "sha256-Ecdxs6see4uexY6DatZ/VSGgWR81zRjo3AeAsXSjJ4A=";
  };

-  vendorSha256 = "sha256-rw75xNBBV58F+HBVtD/EslPWxZxLbI3/mJVdJF4usKI=";
+  vendorSha256 = "sha256-nFiBHhtvTu9Ya6n1KUF+pOXrksHMOph7ABVtGSWVWlo=";

  meta = with lib; {
    description = "A Lightweight VPN Built on top of Libp2p for Truly Distributed Networks.";
--- a/pkgs/applications/networking/p2p/rqbit/default.nix
+++ b/pkgs/applications/networking/p2p/rqbit/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "rqbit";
-  version = "2.1.0";
+  version = "2.1.2";

  src = fetchFromGitHub {
    owner = "ikatson";
    repo = "rqbit";
    rev = "v${version}";
-    sha256 = "1dyf1sjfiwrrigk1186mzvx5vn196h45imvily394ky2di633av5";
+    sha256 = "0b9wxjwnhhs3vi1x55isdqck67lh1r7nf3dwmhlwcg5887smwp5c";
  };

-  cargoSha256 = "02z5gdmir1x80axnv516hs00478c7zbb30rdsbs966yh1725w12z";
+  cargoSha256 = "1s278d73mwqpq3n5vmrn5jb6g5dafaaplnhs8346pwcc6y16w3d3";

  nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config ];

--- a/pkgs/applications/radio/gqrx/default.nix
+++ b/pkgs/applications/radio/gqrx/default.nix
@ -20,13 +20,13 @@ assert pulseaudioSupport -> libpulseaudio != null;

 gnuradio3_8Minimal.pkgs.mkDerivation rec {
  pname = "gqrx";
-  version = "2.14.4";
+  version = "2.14.6";

  src = fetchFromGitHub {
    owner = "csete";
    repo = "gqrx";
    rev = "v${version}";
-    sha256 = "sha256-mMaxu0jq2GaNLWjLsJQXx+zCxtyiCAZQJJZ8GJtnllQ=";
+    sha256 = "sha256-DMmQXcGPudAVOwuc+LVrcIzfwMMQVBZPbM6Bt1w56D8=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/radio/wsjtx/default.nix
+++ b/pkgs/applications/radio/wsjtx/default.nix
@ -4,12 +4,12 @@

 stdenv.mkDerivation rec {
  pname = "wsjtx";
-  version = "2.4.0";
+  version = "2.5.1";

  # This is a "superbuild" tarball containing both wsjtx and a hamlib fork
  src = fetchurl {
    url = "http://physics.princeton.edu/pulsar/k1jt/wsjtx-${version}.tgz";
-    sha256 = "sha256-LpfGzI/Hpsp7/K0ZZu2EFVlvWcN0cnAQ1RNAxCMugcg=";
+    sha256 = "sha256-aof+OavQ+IBw3eef1+bQ9YwIXCdecYiADS+eRXTrmvQ=";
  };

  # Hamlib builds with autotools, wsjtx builds with cmake
--- a/pkgs/applications/terminal-emulators/hyper/default.nix
+++ b/pkgs/applications/terminal-emulators/hyper/default.nix
@ -15,11 +15,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "hyper";
-  version = "3.1.3";
+  version = "3.1.4";

  src = fetchurl {
    url = "https://github.com/vercel/hyper/releases/download/v${version}/hyper_${version}_amd64.deb";
-    sha256 = "sha256-w+FISIeGf3K1dnykIEzU3KevyaFNl4X0beT6DdLW+zQ=";
+    sha256 = "sha256-4C0vx4m/ojOJl5ownsbasSFiIrJ9kfJJWh0y4j/DGIQ=";
  };

  nativeBuildInputs = [ dpkg ];
--- a/pkgs/applications/version-management/git-and-tools/delta/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/delta/default.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "delta";
-  version = "0.9.1";
+  version = "0.9.2";

  src = fetchFromGitHub {
    owner = "dandavison";
    repo = pname;
    rev = version;
-    sha256 = "sha256-LyKkkQlYdCyvlru+o/QeA7CDWYgCRTFKAdAjJxJX+oM=";
+    sha256 = "sha256-DJG8C7oSTf4YKeSVytN4pVF4qVImg1bsTYbnfkR+U94=";
  };

-  cargoSha256 = "sha256-+ao2nVRkXNWs00oUiATgzsDTfPo09BV66AioZQqBhGk=";
+  cargoSha256 = "sha256-mweH+ZIcNGGmoGUhnmZzaB5y14eO/XkHqrL8Nz/b3Jg=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/version-management/git-and-tools/lucky-commit/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/lucky-commit/default.nix
@ -2,6 +2,8 @@
 , rustPlatform
 , fetchFromGitHub
 , withOpenCL ? true
+, stdenv
+, OpenCL
 , ocl-icd
 }:

@ -18,7 +20,7 @@ rustPlatform.buildRustPackage rec {

  cargoSha256 = "sha256-MvopLKhovwXaEmRgXnAzJeuhPgqnMjt0EtKUGSWFpaY=";

-  buildInputs = lib.optional withOpenCL [ ocl-icd ];
+  buildInputs = lib.optional withOpenCL (if stdenv.isDarwin then OpenCL else ocl-icd);

  cargoBuildFlags = lib.optional (!withOpenCL) "--no-default-features";

--- a/pkgs/applications/video/kodi/unwrapped.nix
+++ b/pkgs/applications/video/kodi/unwrapped.nix
@ -38,15 +38,15 @@ assert usbSupport -> !udevSupport; # libusb-compat-0_1 won't be used if udev is
 assert gbmSupport || waylandSupport || x11Support;

 let
-  kodiReleaseDate = "20211006";
-  kodiVersion = "19.2";
+  kodiReleaseDate = "20211024";
+  kodiVersion = "19.3";
  rel = "Matrix";

  kodi_src = fetchFromGitHub {
    owner  = "xbmc";
    repo   = "xbmc";
    rev    = "${kodiVersion}-${rel}";
-    sha256 = "sha256-w5m7xlnjQDJ4l75b3ctF0wMZ4kqi+H0X6WFLs0gV6lM=";
+    sha256 = "02bnknk87zzv9j6b6k9c0xx47q2gh399j6v25rm94g7rhzf8phbw";
  };

  ffmpeg = stdenv.mkDerivation rec {
--- a/pkgs/applications/window-managers/jwm/jwm-settings-manager.nix
+++ b/pkgs/applications/window-managers/jwm/jwm-settings-manager.nix
@ -1,14 +1,13 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, gettext, libXpm, libGL, fltk, hicolor-icon-theme, glib, gnome2, which }:
+{ lib, stdenv, fetchbzr, cmake, pkg-config, gettext, libXpm, libGL, fltk, hicolor-icon-theme, glib, gnome2, which }:

-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
  pname = "jwm-settings-manager";
-  version = "2018-10-19";
+  version = "2019-01-27";

-  src = fetchFromGitHub {
-    owner = "Israel-D";
-    repo = "jwm-settings-manager";
-    rev = "cb32a70563cf1f3927339093481542b85ec3c8c8";
-    sha256 = "0d5bqf74p8zg8azns44g46q973blhmp715k8kcd73x88g7sfir8s";
+  src = fetchbzr {
+    url = "lp:${pname}";
+    rev = "292";
+    sha256 = "1yqc1ac2pbkc88z7p1qags1jygdlr5y1rhc5mx6gapcf54bk0lmi";
  };

  nativeBuildInputs = [
@ -34,6 +33,11 @@ stdenv.mkDerivation {
      --replace 'DESTINATION usr/share' "DESTINATION share"
  '';

+  postConfigure = ''
+    substituteInPlace cmake_install.cmake \
+      --replace "/var/empty" "/usr"
+  '';
+
  meta = with lib; {
    description = "A full configuration manager for JWM";
    homepage = "https://joewing.net/projects/jwm";
--- a/pkgs/data/icons/whitesur-icon-theme/default.nix
+++ b/pkgs/data/icons/whitesur-icon-theme/default.nix
@ -2,13 +2,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "Whitesur-icon-theme";
-  version = "2021-08-26";
+  version = "2021-10-13";

  src = fetchFromGitHub {
    owner = "vinceliuice";
    repo = pname;
    rev = version;
-    sha256 = "O7nb6X20HvnzldijP/fXqAs/2qE5JUg3DEMb84ZMQp4=";
+    sha256 = "BP5hGi3G9zNUSfeCbwYUvd3jMcWhstXiDeZCJ6Hgey8=";
  };

  nativeBuildInputs = [ gtk3 ];
--- a/pkgs/data/themes/flat-remix-gnome/default.nix
+++ b/pkgs/data/themes/flat-remix-gnome/default.nix
@ -6,20 +6,20 @@

 stdenv.mkDerivation rec {
  pname = "flat-remix-gnome";
-  version = "20210921";
+  version = "20211028";

  src = fetchFromGitHub {
    owner = "daniruiz";
    repo = pname;
    rev = version;
-    hash = "sha256-HnbKqdDAre2jhZH1Osf3jigz/dQpx7k0fPsVaZz7xC8=";
+    hash = "sha256-sHJj81MmU9s5sUq5gaIT3leezuG0aVvgTD70Kho9Z0c=";
  };

  nativeBuildInputs = [ glib ];
  makeFlags = [ "PREFIX=$(out)" ];
  preInstall = ''
    # make install will back up this file, it will fail if the file doesn't exist.
-    # https://github.com/daniruiz/flat-remix-gnome/blob/20210921/Makefile#L53
+    # https://github.com/daniruiz/flat-remix-gnome/blob/20211028/Makefile#L54
    mkdir -p $out/share/gnome-shell/
    touch $out/share/gnome-shell/gnome-shell-theme.gresource
  '';
--- a/pkgs/desktops/arcan/arcan/000-openal.patch
+++ b/pkgs/desktops/arcan/arcan/000-openal.patch
@ -0,0 +1,15 @@
+diff -Naur source-old/src/CMakeLists.txt source-new/src/CMakeLists.txt
+--- source-old/src/CMakeLists.txt	1969-12-31 21:00:01.000000000 -0300
+++ source-new/src/CMakeLists.txt	2021-10-29 12:03:06.461399341 -0300
+@@ -362,10 +360,8 @@
+ 	if (EXISTS ${EXTERNAL_SRC_DIR}/git/openal AND STATIC_OPENAL)
+ 		amsg("${CL_YEL}Building OpenAL static from external/git mirror${CL_RST}")
+ 		ExternalProject_Add(OpenAL
+-			SOURCE_DIR ${CMAKE_CURRENT_BINARY_DIR}/openal
+			SOURCE_DIR "${EXTERNAL_SRC_DIR}/git/openal"
+ 			BINARY_DIR ${CMAKE_CURRENT_BINARY_DIR}/openal_static
+-			UPDATE_COMMAND ""
+-			GIT_REPOSITORY "${EXTERNAL_SRC_DIR}/git/openal"
+ 			${EXTERNAL_DEFS}
+ 			${CMAKE_EXTERNAL_DEFS}
+ 			-DALSOFT_BACKEND_DSOUND=OFF
--- a/pkgs/desktops/arcan/arcan/001-luajit.patch
+++ b/pkgs/desktops/arcan/arcan/001-luajit.patch
@ -0,0 +1,17 @@
+diff -Naur source-old/src/CMakeLists.txt source-new/src/CMakeLists.txt
+--- source-old/src/CMakeLists.txt	1969-12-31 21:00:01.000000000 -0300
+++ source-new/src/CMakeLists.txt	2021-10-29 12:03:06.461399341 -0300
+@@ -419,12 +415,7 @@
+ 		set(LUA_TAG "luajit51")
+ 		if (EXISTS ${EXTERNAL_SRC_DIR}/git/luajit)
+ 			ExternalProject_Add(luajit
+-				SOURCE_DIR ${CMAKE_CURRENT_BINARY_DIR}/luajit
+-				GIT_REPOSITORY "${EXTERNAL_SRC_DIR}/git/luajit"
+-				CONFIGURE_COMMAND ""
+-				GIT_TAG "v2.1.0-beta3"
+-				UPDATE_COMMAND ""
+-				INSTALL_COMMAND ""
+				SOURCE_DIR "${EXTERNAL_SRC_DIR}/git/luajit"
+ 				BUILD_IN_SOURCE 1
+ 				BUILD_COMMAND "${EXTMAKE_CMD}"
+ 				DEFAULT_CC=${CMAKE_C_COMPILER}
--- a/pkgs/desktops/arcan/arcan/002-libuvc.patch
+++ b/pkgs/desktops/arcan/arcan/002-libuvc.patch
@ -0,0 +1,15 @@
+diff -Naur source-old/src/frameserver/decode/default/CMakeLists.txt source-new/src/frameserver/decode/default/CMakeLists.txt
+--- source-old/src/frameserver/decode/default/CMakeLists.txt	1969-12-31 21:00:01.000000000 -0300
+++ source-new/src/frameserver/decode/default/CMakeLists.txt	2021-10-29 12:01:31.989933725 -0300
+@@ -62,10 +62,8 @@
+ 		if (STATIC_LIBUVC)
+ 			pkg_check_modules(LIBUSB_1 REQUIRED libusb-1.0)
+ 			ExternalProject_Add(libuvc
+-				SOURCE_DIR "${CMAKE_CURRENT_BINARY_DIR}/frameserver/decode/libuvc"
+				SOURCE_DIR "${EXTERNAL_SRC_DIR}/git/libuvc"
+ 				BINARY_DIR "${CMAKE_CURRENT_BINARY_DIR}/libuvc_static"
+-				UPDATE_COMMAND ""
+-				GIT_REPOSITORY "${EXTERNAL_SRC_DIR}/git/libuvc"
+ 				${EXTERNAL_DEFS}
+ 				${CMAKE_EXTERNAL_DEFS}
+ 				-DBUILD_UVC_STATIC=ON
--- a/pkgs/desktops/arcan/arcan/003-freetype.patch
+++ b/pkgs/desktops/arcan/arcan/003-freetype.patch
@ -0,0 +1,14 @@
+diff -Naur source-old/src/CMakeLists.txt source-new/src/CMakeLists.txt
+--- source-old/src/CMakeLists.txt	1969-12-31 21:00:01.000000000 -0300
+++ source-new/src/CMakeLists.txt	2021-10-29 12:03:06.461399341 -0300
+@@ -317,9 +317,7 @@
+ 		find_package(BZip2 REQUIRED QUIET)
+ 		pkg_check_modules(HARFBUZZ REQUIRED QUIET harfbuzz)
+ 		ExternalProject_Add(Freetype
+-			SOURCE_DIR "${CMAKE_CURRENT_BINARY_DIR}/freetype"
+-			UPDATE_COMMAND ""
+-			GIT_REPOSITORY "${EXTERNAL_SRC_DIR}/git/freetype"
+			SOURCE_DIR "${EXTERNAL_SRC_DIR}/git/freetype"
+ 			${EXTERNAL_DEFS}
+ 			${CMAKE_EXTERNAL_DEFS}
+ 			-DWITH_ZLIB=OFF
--- a/pkgs/desktops/arcan/arcan/clone-sources.nix
+++ b/pkgs/desktops/arcan/arcan/clone-sources.nix
@ -0,0 +1,25 @@
+{ fetchgit, fetchFromGitHub }:
+{
+  letoram-openal-src = fetchFromGitHub {
+    owner = "letoram";
+    repo = "openal";
+    rev = "1c7302c580964fee9ee9e1d89ff56d24f934bdef";
+    hash = "sha256-InqU59J0zvwJ20a7KU54xTM7d76VoOlFbtj7KbFlnTU=";
+  };
+  freetype-src = fetchgit {
+    url = "git://git.sv.nongnu.org/freetype/freetype2.git";
+    rev = "94cb3a2eb96b3f17a1a3bd0e6f7da97c0e1d8f57";
+    sha256 = "sha256-LzjqunX/T8khF2UjPlPYiQOwMGem8MqPYneR2LdZ5Fg=";
+  };
+  libuvc-src = fetchgit {
+    owner = "libuvc";
+    repo = "libuvc";
+    rev = "b2b01ae6a2875d05c99eb256bb15815018d6e837";
+    sha256 = "sha256-2zCTjyodRARkHM/Q0r4bdEH9LO1Z9xPCnY2xE4KZddA=";
+  };
+  luajit-src = fetchgit {
+    url = "https://luajit.org/git/luajit-2.0.git";
+    rev = "d3294fa63b344173db68dd612c6d3801631e28d4";
+    sha256 = "sha256-1iHBXcbYhWN4M8g5oH09S1j1WrjYzI6qcRbHsdfpRkk=";
+  };
+}
--- a/pkgs/desktops/arcan/arcan/default.nix
+++ b/pkgs/desktops/arcan/arcan/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchgit
 , SDL2
 , cmake
 , espeak
@ -23,6 +24,7 @@
 , libvncserver
 , libxcb
 , libxkbcommon
+, lua
 , luajit
 , makeWrapper
 , mesa
@ -36,22 +38,16 @@
 , xcbutil
 , xcbutilwm
 , xz
-, buildManpages ? true, ruby
+, buildManPages ? true, ruby
+, useBuiltinLua ? true
+, useStaticFreetype ? false
+, useStaticLibuvc ? false
+, useStaticOpenAL ? true
+, useStaticSqlite ? false
 }:

-let
-  # TODO: investigate vendoring, especially OpenAL
-  # WARN: vendoring of OpenAL is required for running arcan_lwa
-  # INFO: maybe it needs leaveDotGit, but it is dangerous/impure
-  letoram-openal-src = fetchFromGitHub {
-    owner = "letoram";
-    repo = "openal";
-    rev = "1c7302c580964fee9ee9e1d89ff56d24f934bdef";
-    hash = "sha256-InqU59J0zvwJ20a7KU54xTM7d76VoOlFbtj7KbFlnTU=";
-  };
-in
 stdenv.mkDerivation rec {
-  pname = "arcan";
+  pname = "arcan" + lib.optionalString useStaticOpenAL "-static-openal";
  version = "0.6.1pre1+unstable=2021-10-16";

  src = fetchFromGitHub {
@ -61,28 +57,11 @@ stdenv.mkDerivation rec {
    hash = "sha256-4FodFuO51ehvyjH4YaF/xBY9dwA6cP/e6/BvEsH4w7U=";
  };

-  postUnpack = ''
-    pushd .
-    cd $sourceRoot/external/git/
-    cp -a ${letoram-openal-src}/ openal/
-    chmod --recursive 744 openal/
-    popd
-  '';
-
-  # TODO: work with upstream in order to get rid of these hardcoded paths
-  postPatch = ''
-    substituteInPlace ./src/platform/posix/paths.c \
-      --replace "/usr/bin" "$out/bin" \
-      --replace "/usr/share" "$out/share"
-
-    substituteInPlace ./src/CMakeLists.txt --replace "SETUID" "# SETUID"
-  '';
-
  nativeBuildInputs = [
    cmake
    makeWrapper
    pkg-config
-  ] ++ lib.optionals buildManpages [
+  ] ++ lib.optionals buildManPages [
    ruby
  ];

@ -108,6 +87,7 @@ stdenv.mkDerivation rec {
    libvncserver
    libxcb
    libxkbcommon
+    lua
    luajit
    mesa
    openal
@ -121,11 +101,54 @@ stdenv.mkDerivation rec {
    xz
  ];

+  patches = [
+    # Nixpkgs-specific: redirect vendoring
+    ./000-openal.patch
+    ./001-luajit.patch
+    ./002-libuvc.patch
+    ./003-freetype.patch
+  ];
+
+  # Emulate external/git/clone.sh
+  postUnpack = let
+    inherit (import ./clone-sources.nix { inherit fetchFromGitHub fetchgit; })
+      letoram-openal-src freetype-src libuvc-src luajit-src;
+  in
+    ''
+      pushd $sourceRoot/external/git/
+    ''
+    + (lib.optionalString useStaticOpenAL ''
+      cp -a ${letoram-openal-src}/ openal
+      chmod --recursive 744 openal
+    '')
+    + (lib.optionalString useStaticFreetype ''
+      cp -a ${freetype-src}/ freetype
+      chmod --recursive 744 freetype
+    '')
+    + (lib.optionalString useStaticLibuvc ''
+      cp -a ${libuvc-src}/ libuvc
+      chmod --recursive 744 libuvc
+    '')
+    + (lib.optionalString useBuiltinLua ''
+      cp -a ${luajit-src}/ luajit
+      chmod --recursive 744 luajit
+    '') +
+    ''
+      popd
+    '';
+
+  postPatch = ''
+    substituteInPlace ./src/platform/posix/paths.c \
+      --replace "/usr/bin" "$out/bin" \
+      --replace "/usr/share" "$out/share"
+
+    substituteInPlace ./src/CMakeLists.txt --replace "SETUID" "# SETUID"
+  '';
+
  # INFO: According to the source code, the manpages need to be generated before
  # the configure phase
-  preConfigure = lib.optionalString buildManpages ''
-    pushd .
-    cd doc
+  preConfigure = lib.optionalString buildManPages ''
+    pushd doc
    ruby docgen.rb mangen
    popd
  '';
@ -136,7 +159,12 @@ stdenv.mkDerivation rec {
    "-DDISTR_TAG=Nixpkgs"
    "-DENGINE_BUILDTAG=${version}"
    "-DHYBRID_SDL=on"
-    "-DSTATIC_OPENAL=off"
+    "-DBUILTIN_LUA=${if useBuiltinLua then "on" else "off"}"
+    "-DDISABLE_JIT=${if useBuiltinLua then "on" else "off"}"
+    "-DSTATIC_FREETYPE=${if useStaticFreetype then "on" else "off"}"
+    "-DSTATIC_LIBUVC=${if useStaticLibuvc then "on" else "off"}"
+    "-DSTATIC_OPENAL=${if useStaticOpenAL then "on" else "off"}"
+    "-DSTATIC_SQLite3=${if useStaticSqlite then "on" else "off"}"
    "../src"
  ];

--- a/pkgs/desktops/gnome/misc/gpaste/default.nix
+++ b/pkgs/desktops/gnome/misc/gpaste/default.nix
@ -17,14 +17,14 @@
 }:

 stdenv.mkDerivation rec {
-  version = "3.42.0";
+  version = "3.42.1";
  pname = "gpaste";

  src = fetchFromGitHub {
    owner = "Keruspe";
    repo = "GPaste";
    rev = "v${version}";
-    sha256 = "sha256-YsAA487Q2BwDh4V2TPN/YwAFCw+F11OKMjatcNR98/c=";
+    sha256 = "sha256-yoJ/k9cXXF5ELKF0JXGtxsUjfQ/S1sccLRQOQG7YMXo=";
  };

  patches = [
--- a/pkgs/desktops/pantheon/apps/appcenter/default.nix
+++ b/pkgs/desktops/pantheon/apps/appcenter/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , nix-update-script
 , appstream
 , appstream-glib
@ -30,13 +31,13 @@

 stdenv.mkDerivation rec {
  pname = "appcenter";
-  version = "3.8.1";
+  version = "3.8.2";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "sha256-d7DGyAC8itBxTfuabDPN16W4S4d42s5UPp8AusZfy5k=";
+    sha256 = "sha256-NHKP1vzb8qu+EkUWDvLWLl4U4pW9ZxbE7YFI6Vwesfg=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/elementary-files/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-files/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , nix-update-script
 , pantheon
@ -32,7 +33,7 @@

 stdenv.mkDerivation rec {
  pname = "elementary-files";
-  version = "6.0.3";
+  version = "6.0.4";

  repoName = "files";

@ -42,7 +43,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "10hgj5rrqxzk4q8jlhkwwrs4hgyavlhz3z1pqf36y663bq3h0izv";
+    sha256 = "sha256-FH6EYtgKADp8jjBoCwsdRdknlKS9v3iOtPiT3CyEc/8=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/desktop/elementary-shortcut-overlay/default.nix
+++ b/pkgs/desktops/pantheon/desktop/elementary-shortcut-overlay/default.nix
@ -1,6 +1,6 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
-, fetchpatch
 , nix-update-script
 , pantheon
 , pkg-config
@ -20,7 +20,7 @@

 stdenv.mkDerivation rec {
  pname = "elementary-shortcut-overlay";
-  version = "1.2.0";
+  version = "1.2.1";

  repoName = "shortcut-overlay";

@ -28,22 +28,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "1zs2fpx4agr00rsfmpi00nhiw92mlypzm4p9x3g851p24m62fn79";
-  };
-
-  patches = [
-    # Upstream code not respecting our localedir
-    # https://github.com/elementary/shortcut-overlay/pull/100
-    (fetchpatch {
-      url = "https://github.com/elementary/shortcut-overlay/commit/f26e3684568e30cb6e151438e2d86c4d392626bf.patch";
-      sha256 = "0zxyqpk9xbxdm8lmgdwbb4yzzwbjlhypsca3xs34a2pl0b9pcdwd";
-    })
-  ];
-
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
+    sha256 = "sha256-qmqzGCM3cVM6y80pzjm5CCyG6BO6XlKZiODAAEnwVrM=";
  };

  nativeBuildInputs = [
@ -65,6 +50,12 @@ stdenv.mkDerivation rec {
    libhandy
  ];

+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
  meta = with lib; {
    description = "A native OS-wide shortcut overlay to be launched by Gala";
    homepage = "https://github.com/elementary/shortcut-overlay";
--- a/pkgs/desktops/pantheon/services/elementary-capnet-assist/default.nix
+++ b/pkgs/desktops/pantheon/services/elementary-capnet-assist/default.nix
@ -19,7 +19,7 @@

 stdenv.mkDerivation rec {
  pname = "elementary-capnet-assist";
-  version = "2.3.0";
+  version = "2.4.0";

  repoName = "capnet-assist";

@ -27,13 +27,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "1gma8a04ndivx1fd3ha9f45r642qq2li80wrd6dsrp4v3vqix9bn";
-  };
-
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
+    sha256 = "sha256-UdkS+w61c8z2TCJyG7YsDb0n0b2LOpFyaHzMbdCJsZI=";
  };

  nativeBuildInputs = [
@ -55,16 +49,17 @@ stdenv.mkDerivation rec {
    webkitgtk
  ];

-  # Not useful here or in elementary - See: https://github.com/elementary/capnet-assist/issues/3
-  patches = [
-    ./remove-capnet-test.patch
-  ];
-
  postPatch = ''
    chmod +x meson/post_install.py
    patchShebangs meson/post_install.py
  '';

+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
  meta = with lib; {
    description = "A small WebKit app that assists a user with login when a captive portal is detected";
    homepage = "https://github.com/elementary/capnet-assist";
--- a/pkgs/desktops/pantheon/services/elementary-capnet-assist/remove-capnet-test.patch
+++ b/pkgs/desktops/pantheon/services/elementary-capnet-assist/remove-capnet-test.patch
@ -1,13 +0,0 @@
-diff --git a/meson.build b/meson.build
-index 46c594b..ba0ea10 100644
--- a/meson.build
-+++ b/meson.build
-@@ -33,8 +33,3 @@ meson.add_install_script('meson/post_install.py')
- 
- subdir('data')
- subdir('po')
-
-install_data(
-    '90captive_portal_test',
-    install_dir: join_paths(get_option('sysconfdir'), 'NetworkManager', 'dispatcher.d')
-)
--- a/pkgs/development/compilers/graalvm/community-edition/default.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/default.nix
@ -9,10 +9,19 @@ in
  inherit mkGraal;

  graalvm11-ce = mkGraal rec {
-    version = lib.fileContents ./version;
+    version = "21.3.0";
    javaVersion = "11";
    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
  };

-  # TODO: added graalvm17-ce
+  # TODO: fix aarch64-linux, failing during Native Image compilation
+  # "Caused by: java.io.IOException: Cannot run program
+  # "/nix/store/1q1mif7h3lgxdaxg6j39hli5azikrfla-gcc-wrapper-9.3.0/bin/gcc" (in
+  # directory"/tmp/SVM-4194439592488143713"): error=0, Failed to exec spawn
+  # helper: pid: 19865, exit value: 1"
+  graalvm17-ce = mkGraal rec {
+    version = "21.3.0";
+    javaVersion = "17";
+    platforms = [ "x86_64-linux" "x86_64-darwin" ];
+  };
 }
--- a/pkgs/development/compilers/graalvm/community-edition/hashes.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/hashes.nix
@ -4,39 +4,53 @@
  {
    sha256 = {
      "11-linux-aarch64" = "0hsjxp6ly7jsn9k94fddcl7afc5gda66jyppcnfvslishbizqd0i";
+      "17-linux-aarch64" = "09hzl80m7f5ppmcvryz9aq0yw9scdkp5dqhblrqnkzyhvdjl5ycn";
      "11-linux-amd64" = "1ylk5l933z813k0k1xlayiv8fa0f1gmpr66bma51532iy3mch6rs";
+      "17-linux-amd64" = "1xn3shwkai61vvzsg595k8776a21ds00w2pjlscvfcbs1ag07n0i";
      "11-darwin-amd64" = "0qpqnnmqxvxzj3mwz05acpg4n8ffqsz0sji8lbl03fgswpvgfavc";
+      "17-darwin-amd64" = "1akpsrd9r2igcls0cvhpqw3jrnh59m8z80knx83lmj0cj836a8v0";
    }.${javaVersionPlatform} or null;
    url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-21.3.0/graalvm-ce-java${javaVersionPlatform}-21.3.0.tar.gz";
  }
  {
    sha256 = {
      "11-linux-aarch64" = "0qlmg5fwvqsb5ab3irj2hrcd5jc94mibnlz1gvzpnq85rw1zcb6h";
+      "17-linux-aarch64" = "0jmarhwngs6vpbcgsix0dxhj42qj9vnk3vln8fhdxmydwnns8r1m";
      "11-linux-amd64" = "0kvnjr55rizy53vn0ff9w27z1qh9d1vp3s7r1kdl0wyhrbhd8n49";
+      "17-linux-amd64" = "0h14sml42jda54agjs1prfnyjaxxsc67350fr51n8p20nl28lj6z";
      "11-darwin-amd64" = "1mg8c8hh8wmbwsisgarmp35jd0dall1fwdv49mggp74hicbc32h3";
+      "17-darwin-amd64" = "0qz0xf2ph9gi45vvri7vphxh35m11nk7sa8nkwxl28l8bza0kb40";
    }.${javaVersionPlatform} or null;
    url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-21.3.0/native-image-installable-svm-java${javaVersionPlatform}-21.3.0.jar";
  }
  {
    sha256 = {
      "11-linux-aarch64" = "02rvwl1nng8d3qn226rjx5yq2blxs4yz009ab928qanhmb4vhv8b";
+      "17-linux-aarch64" = "13kaxbgfp9pm6s28i5hfyg957iiwzrxf0ibibkv2yndgj64vj8xg";
      "11-linux-amd64" = "0zz62zr7imjaw9a3j5m66xs7c72cqb1i74ab3rnlh0dgs1mdpljg";
+      "17-linux-amd64" = "1v2iwznlav8dsjj30nlhvsvv7pxmyzkhkp1p7spjjma09d34q4iv";
      "11-darwin-amd64" = "1wiv0299b2xrc229alczmjfj1bsn90p0wdm64rr39xnyyhbqrr80";
+      "17-darwin-amd64" = "095sii8ibjcvvc6wnxk77ax151c4zgj8bpp81q3kyaazgpzvrk5s";
    }.${javaVersionPlatform} or null;
    url = "https://github.com/oracle/truffleruby/releases/download/vm-21.3.0/ruby-installable-svm-java${javaVersionPlatform}-21.3.0.jar";
  }
  {
    sha256 = {
      "11-linux-aarch64" = "1ck4c1z98h1zn4i6xhh1hb6w2jab6n17ddykb72xxw4vig9nhlc7";
+      "17-linux-aarch64" = "0p9gx5iq730br9wvacxs4403anxnjln6mx8v0dl4w4lhikjxsy8x";
      "11-linux-amd64" = "0gy8jj9d9msmj0i44sysiwq3j2k2w2g47fhq6y1aq47n3kmwj9kv";
+      "17-linux-amd64" = "0qk8rgbmnk84isnb33x5bbh17bnnmq9yqasfgy5p953min6pbxj7";
      "11-darwin-amd64" = "0agw6k3jn2jh8wyc9h8rvzlgs96qh4nlj0y8nyzsmidvwq2ahl00";
+      "17-darwin-amd64" = "0l1il0rq48sw6sha9jr0xphjgrm7q0kywy8z94mabm9maqh7l3rn";
    }.${javaVersionPlatform} or null;
    url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-21.3.0/wasm-installable-svm-java${javaVersionPlatform}-21.3.0.jar";
  }
  {
    sha256 = {
      "11-linux-amd64" = "1l5av2v459q88zfl83877h7b3426z3d86kp6wqjvz2441brvidi0";
+      "17-linux-amd64" = "100p1cgw0z4yfy4axb3gr32m8jnyx1f8bj6f6kk0mf3l8fv2kb7p";
      "11-darwin-amd64" = "06694n74dzsfwlli1sjdsrfbj9ngw7bhrcayvy4sgy2va5qpdjs0";
+      "17-darwin-amd64" = "1qwg45q0760lsa62h0nk2zdv0r1npr82bh6p1z3md6pjppm7i025";
    }.${javaVersionPlatform} or null;
    url = "https://github.com/graalvm/graalpython/releases/download/vm-21.3.0/python-installable-svm-java${javaVersionPlatform}-21.3.0.jar";
  }
--- a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
@ -1,4 +1,4 @@
-{ version, javaVersion, platforms }:
+{ version, javaVersion, platforms, hashes ? import ./hashes.nix }:

 { stdenv, lib, fetchurl, autoPatchelfHook, setJavaClassPath, makeWrapper
 # minimum dependencies
@ -35,9 +35,7 @@ let
        maybeFetchUrl = url: if url.sha256 != null then (fetchurl url) else null;
      in
      (lib.remove null
-        (map
-          maybeFetchUrl
-          (import ./hashes.nix { inherit javaVersionPlatform; })));
+        (map maybeFetchUrl (hashes { inherit javaVersionPlatform; })));

    buildInputs = lib.optionals stdenv.isLinux [
      alsa-lib # libasound.so wanted by lib/libjsound.so
@ -111,12 +109,6 @@ let
    outputs = [ "out" "lib" ];

    installPhase = let
-      nativePRNGWorkaround = path: ''
-        # BUG workaround http://mail.openjdk.java.net/pipermail/graal-dev/2017-December/005141.html
-        substituteInPlace ${path} \
-          --replace file:/dev/random    file:/dev/./urandom \
-          --replace NativePRNGBlocking  SHA1PRNG
-      '';
      copyClibrariesToOut = basepath: ''
        # provide libraries needed for static compilation
        for f in ${glibc}/lib/* ${glibc.static}/lib/* ${zlib.static}/lib/*; do
@ -134,25 +126,30 @@ let
      '';
    in {
      "11-linux-amd64" = ''
-        ${nativePRNGWorkaround "$out/conf/security/java.security"}
+        ${copyClibrariesToOut "$out/lib/svm/clibraries"}

+        ${copyClibrariesToLib}
+      '';
+      "17-linux-amd64" = ''
        ${copyClibrariesToOut "$out/lib/svm/clibraries"}

        ${copyClibrariesToLib}
      '';
      "11-linux-aarch64" = ''
-        ${nativePRNGWorkaround "$out/conf/security/java.security"}
-
        ${copyClibrariesToOut "$out/lib/svm/clibraries"}

        ${copyClibrariesToLib}
      '';
-      "11-darwin-amd64" = ''
-        # create empty $lib/lib to avoid breaking builds
-        mkdir -p $lib/lib
-        ${nativePRNGWorkaround "$out/conf/security/java.security"}
+      "17-linux-aarch64" = ''
+        ${copyClibrariesToOut "$out/lib/svm/clibraries"}
+
+        ${copyClibrariesToLib}
      '';
+      "11-darwin-amd64" = "";
+      "17-darwin-amd64" = "";
    }.${javaVersionPlatform} + ''
+      # ensure that $lib/lib exists to avoid breaking builds
+      mkdir -p $lib/lib
      # jni.h expects jni_md.h to be in the header search path.
      ln -s $out/include/linux/*_md.h $out/include/
    '';
@ -237,9 +234,12 @@ let
      }

      echo "Testing TruffleRuby"
+      # Hide warnings about wrong locale
+      export LANG=C
+      export LC_ALL=C
      $out/bin/ruby -e 'puts(1 + 1)'
-
-      ${# TODO: `irb` on MacOS gives an error saying "Could not find OpenSSL
+      ${# FIXME: irb is broken in all platforms
+        # TODO: `irb` on MacOS gives an error saying "Could not find OpenSSL
        # headers, install via Homebrew or MacPorts or set OPENSSL_PREFIX", even
        # though `openssl` is in `propagatedBuildInputs`. For more details see:
        # https://github.com/NixOS/nixpkgs/pull/105815
@ -252,7 +252,7 @@ let
          echo '1 + 1' | $out/bin/irb
        ''
      }
-      '';
+    '';

    passthru = {
      home = graalvmXXX-ce;
--- a/pkgs/development/compilers/graalvm/community-edition/update.sh
+++ b/pkgs/development/compilers/graalvm/community-edition/update.sh
@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -p curl -i bash coreutils nix common-updater-scripts curl jq
+#!nix-shell -p coreutils curl nix jq gnused -i bash

 set -eou pipefail

@ -13,18 +13,23 @@ verlte() {
    [  "$1" = "$(echo -e "$1\n$2" | sort -V | head -n1)" ]
 }

-readonly old_version="$(cat version)"
+readonly nixpkgs=../../../../..
+
+readonly old_version="$(nix-instantiate "$nixpkgs" --eval --strict -A graalvm11-ce.version)"

 if [[ -z "${1:-}" ]]; then
-  readonly gh_version="$(curl -s https://api.github.com/repos/graalvm/graalvm-ce-builds/releases/latest | jq --raw-output .tag_name)"
+  readonly gh_version="$(curl \
+      ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
+      -s https://api.github.com/repos/graalvm/graalvm-ce-builds/releases/latest | \
+      jq --raw-output .tag_name)"
  readonly new_version="${gh_version//vm-/}"
 else
  readonly new_version="$1"
 fi

-if verlte "$new_version" "$old_version"; then
-  info "graalvm-ce $old_version is up-to-date. Exiting..."
-  exit 0
+if verlte "$old_version" "$new_version"; then
+  info "graalvm-ce $old_version is up-to-date."
+  [[ -z "${FORCE:-}" ]]  && exit 0
 else
  info "graalvm-ce $old_version is out-of-date. Updating..."
 fi
@ -39,8 +44,11 @@ readonly urls=(

 readonly platforms=(
  "11-linux-aarch64"
+  "17-linux-aarch64"
  "11-linux-amd64"
+  "17-linux-amd64"
  "11-darwin-amd64"
+  "17-darwin-amd64"
 )

 info "Deleting old hashes.nix file..."
@ -66,7 +74,8 @@ done

 echo_file "]"

-info "Updating 'version' file..."
-echo "$new_version" > version
+info "Updating graalvm-ce version..."
+# update-source-version does not work here since it expects src attribute
+sed "s|$old_version|\"$new_version\"|" -i default.nix

 info "Done!"
--- a/pkgs/development/compilers/graalvm/community-edition/version
+++ b/pkgs/development/compilers/graalvm/community-edition/version
@ -1 +0,0 @@
-21.3.0
--- a/pkgs/development/compilers/sagittarius-scheme/default.nix
+++ b/pkgs/development/compilers/sagittarius-scheme/default.nix
@ -16,10 +16,10 @@ let platformLdLibraryPath = if stdenv.isDarwin then "DYLD_FALLBACK_LIBRARY_PATH"
 in
 stdenv.mkDerivation rec {
  pname = "sagittarius-scheme";
-  version = "0.9.7";
+  version = "0.9.8";
  src = fetchurl {
    url = "https://bitbucket.org/ktakashi/${pname}/downloads/sagittarius-${version}.tar.gz";
-    sha256 = "18pjj6f5qvixv5hbl1k4d3jqfcmi9qyx0gz0cjwrzpxa8brpwld8";
+    sha256 = "sha256-CdnBpTq+c04JdipfhIiI8EkVFsCc00Gh+cA5zYENMqI=";
  };
  preBuild = ''
           # since we lack rpath during build, need to explicitly add build path
--- a/pkgs/development/coq-modules/hierarchy-builder/default.nix
+++ b/pkgs/development/coq-modules/hierarchy-builder/default.nix
@ -1,6 +1,6 @@
 { lib, mkCoqDerivation, which, coq, coq-elpi, version ? null }:

-with lib; mkCoqDerivation {
+with lib; let hb = mkCoqDerivation {
  pname = "hierarchy-builder";
  owner = "math-comp";
  inherit version;
@ -21,8 +21,6 @@ with lib; mkCoqDerivation {

  mlPlugin = true;

-  buildPhase = "make build";
-
  installFlags = [ "DESTDIR=$(out)" "COQMF_COQLIB=lib/coq/${coq.coq-version}" ];
  extraInstallFlags = [ "VFILES=structures.v" ];

@ -31,4 +29,8 @@ with lib; mkCoqDerivation {
    maintainers = with maintainers; [ cohencyril siraben ];
    license = licenses.mit;
  };
-}
+}; in
+hb.overrideAttrs (o:
+  optionalAttrs (versions.isGe "1.2.0" o.version || o.version == "dev")
+    { buildPhase = "make build"; }
+)
--- a/pkgs/development/coq-modules/zorns-lemma/default.nix
+++ b/pkgs/development/coq-modules/zorns-lemma/default.nix
@ -1,9 +1,8 @@
 { lib, mkCoqDerivation, coq, version ? null }:
 with lib;

-mkCoqDerivation {
+(mkCoqDerivation {
  pname = "zorns-lemma";
-  repo = "topology";

  releaseRev = v: "v${v}";

@ -38,4 +37,4 @@ mkCoqDerivation {
    maintainers = with maintainers; [ siraben ];
    license = licenses.lgpl21Plus;
  };
-}
+}).overrideAttrs({version, ...}: if versions.isGe "9.0" version then { repo =  "topology"; } else {})
--- a/pkgs/development/interpreters/clojure/babashka.nix
+++ b/pkgs/development/interpreters/clojure/babashka.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "babashka";
-  version = "0.6.2";
+  version = "0.6.4";

  src = fetchurl {
    url = "https://github.com/babashka/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-exNOdm17Xg4HVpjX2avoftww/flejL4mB7kSIAJUSco=";
+    sha256 = "sha256-/ULBnC10lAYHYD0P0HGWEcCAqkX8IRcQ7W5ulho+JUM=";
  };

  dontUnpack = true;
--- a/pkgs/development/interpreters/gnudatalanguage/default.nix
+++ b/pkgs/development/interpreters/gnudatalanguage/default.nix
@ -102,13 +102,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "gnudatalanguage";
-  version = "1.0.0";
+  version = "1.0.1";

  src = fetchFromGitHub {
    owner = pname;
    repo = "gdl";
    rev = "v${version}";
-    sha256 = "sha256-Y9LVRaWjQqpWqjNngxB406PE/rl/9S8rs0u0CK5ivUA=";
+    sha256 = "sha256-IrCLL8MQp0SkWj7sbfZlma5FrnMbgdl4E/1nPGy0Y60=";
  };

  buildInputs = [
--- a/pkgs/development/libraries/folly/default.nix
+++ b/pkgs/development/libraries/folly/default.nix
@ -19,13 +19,13 @@

 stdenv.mkDerivation (rec {
  pname = "folly";
-  version = "2021.09.20.00";
+  version = "2021.10.25.00";

  src = fetchFromGitHub {
    owner = "facebook";
    repo = "folly";
    rev = "v${version}";
-    sha256 = "sha256-aFTFUtRQOGCDR3pbpw1ViuMFm02GSq04u9GgE9pq33A=";
+    sha256 = "sha256-+di8Dzt5NRbqIydBR4sB6bUbQrZZ8URUosdP2JGQMec=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/gdcm/default.nix
+++ b/pkgs/development/libraries/gdcm/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "gdcm";
-  version = "3.0.9";
+  version = "3.0.10";

  src = fetchFromGitHub {
    owner = "malaterre";
    repo = "GDCM";
    rev = "v${version}";
-    sha256 = "sha256-wqrM8lxJM8VL+1QEdu6Gr1XWT1j9pT6gGd3yn1yokIY=";
+    sha256 = "sha256-KFN13kGE0E8gQBgtErvkW7Fa+3YYqQh0RA2bPS90WUI=";
  };

  cmakeFlags = [
--- a/pkgs/development/libraries/gfbgraph/default.nix
+++ b/pkgs/development/libraries/gfbgraph/default.nix
@ -1,36 +1,52 @@
-{ lib, stdenv, fetchurl, pkg-config, glib, librest, gnome-online-accounts
-, gnome, libsoup, json-glib, gobject-introspection
-, gtk-doc, pkgs, docbook-xsl-nons, autoconf, automake, libtool }:
+{ stdenv
+, lib
+, fetchurl
+, pkg-config
+, glib
+, librest
+, gnome-online-accounts
+, gnome
+, libsoup
+, json-glib
+, gobject-introspection
+, gtk-doc
+, pkgs
+, docbook-xsl-nons
+}:

 stdenv.mkDerivation rec {
  pname = "gfbgraph";
-  version = "0.2.4";
+  version = "0.2.5";

  outputs = [ "out" "dev" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0yck7dwvjk16a52nafjpi0a39rxwmg0w833brj45acz76lgkjrb0";
+    sha256 = "nLOBs/eLoRNt+Xrz8G47EdzCqzOawI907aD4BX1mA+M=";
  };

  nativeBuildInputs = [
-    pkg-config gobject-introspection gtk-doc
-    docbook-xsl-nons autoconf automake libtool
+    pkg-config
+    gobject-introspection
+    gtk-doc
+    docbook-xsl-nons
  ];
-  buildInputs = [ glib gnome-online-accounts ];
-  propagatedBuildInputs = [ libsoup json-glib librest ];

-  configureFlags = [ "--enable-introspection" "--enable-gtk-doc" ];
+  buildInputs = [
+    glib
+    gnome-online-accounts
+  ];

-  prePatch = ''
-    patchShebangs autogen.sh
-    substituteInPlace autogen.sh \
-      --replace "which" "${pkgs.which}/bin/which"
-  '';
+  propagatedBuildInputs = [
+    libsoup
+    json-glib
+    librest
+  ];

-  preConfigure = ''
-    NOCONFIGURE=1 ./autogen.sh
-  '';
+  configureFlags = [
+    "--enable-introspection"
+    "--enable-gtk-doc"
+  ];

  enableParallelBuilding = true;

@ -45,7 +61,7 @@ stdenv.mkDerivation rec {
    homepage = "https://wiki.gnome.org/Projects/GFBGraph";
    description = "GLib/GObject wrapper for the Facebook Graph API";
    maintainers = teams.gnome.members;
-    license = licenses.lgpl2;
+    license = licenses.lgpl21Plus;
    platforms = platforms.linux;
  };
 }
--- a/pkgs/development/libraries/qtutilities/default.nix
+++ b/pkgs/development/libraries/qtutilities/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "qtutilities";
-  version = "6.5.0";
+  version = "6.5.1";

  src = fetchFromGitHub {
    owner = "Martchus";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-+W5EdnB0QbI22iDWRyj+ntp/l/Kc6VHca2LwmHA7pgA=";
+    sha256 = "sha256-J5yPezXU+AIvmLTBs4lWU35DvfP+0EuuhOJpxAzwRtw=";
  };

  buildInputs = [ qtbase cpp-utilities ];
@ -25,7 +25,7 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    homepage = "https://github.com/Martchus/qtutilities";
-    description = "Common C++ classes and routines used by @Martchus' applications featuring argument parser, IO and conversion utilities";
+    description = "Common Qt related C++ classes and routines used by @Martchus' applications such as dialogs, widgets and models Topics";
    license = licenses.gpl2Plus;
    maintainers = with maintainers; [ doronbehar ];
    platforms   = platforms.linux;
--- a/pkgs/development/libraries/rocksdb/default.nix
+++ b/pkgs/development/libraries/rocksdb/default.nix
@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "rocksdb";
-  version = "6.23.3";
+  version = "6.25.3";

  src = fetchFromGitHub {
    owner = "facebook";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-SsDqhjdCdtIGNlsMj5kfiuS3zSGwcxi4KV71d95h7yk=";
+    sha256 = "sha256-9Fs+znK7oEEBoPbRhNdVHuangBpuIVEvlxJNeNoEJZA=";
  };

  nativeBuildInputs = [ cmake ninja ];
@ -30,7 +30,8 @@ stdenv.mkDerivation rec {

  buildInputs = lib.optional enableJemalloc jemalloc;

-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-Wno-error=deprecated-copy -Wno-error=pessimizing-move";
+  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-Wno-error=deprecated-copy -Wno-error=pessimizing-move"
+    + lib.optionalString stdenv.cc.isClang "-Wno-error=unused-private-field";

  cmakeFlags = [
    "-DPORTABLE=1"
--- a/pkgs/development/libraries/xgboost/default.nix
+++ b/pkgs/development/libraries/xgboost/default.nix
@ -16,14 +16,14 @@ assert ncclSupport -> cudaSupport;

 stdenv.mkDerivation rec {
  pname = "xgboost";
-  version = "1.4.1";
+  version = "1.5.0";

  src = fetchFromGitHub {
    owner = "dmlc";
    repo = pname;
    rev = "v${version}";
    fetchSubmodules = true;
-    sha256 = "12b1417dg8jqyxd72kg5a3xhg5h11vz0k7bkv72mzrv83jvgn5ci";
+    sha256 = "sha256-xrRKpZ6NSBtEL2CBN7KggDwIvQKIPD8EBlA0oCJv8mw=";
  };

  nativeBuildInputs = [ cmake ] ++ lib.optional stdenv.isDarwin llvmPackages.openmp;
--- a/pkgs/development/ocaml-modules/awa/default.nix
+++ b/pkgs/development/ocaml-modules/awa/default.nix
@ -8,21 +8,21 @@

 buildDunePackage rec {
  pname = "awa";
-  version = "0.0.3";
+  version = "0.0.4";

  minimumOCamlVersion = "4.07";
  useDune2 = true;

  src = fetchurl {
    url = "https://github.com/mirage/awa-ssh/releases/download/v${version}/awa-v${version}.tbz";
-    sha256 = "5a7927363ffe672cccf12d5425386e84f6f553a17ffec2b01ae5dc28180c831a";
+    sha256 = "1l7nsd8jifxjq78xyzcc0z9igc02m2qlvv4cxzsgdim6n1jfzxj2";
  };

  nativeBuildInputs = [ ppx_sexp_conv ppx_cstruct ];

  propagatedBuildInputs = [
    mirage-crypto mirage-crypto-rng mirage-crypto-pk x509
-    cstruct cstruct-sexp sexplib rresult mtime
+    cstruct cstruct-sexp sexplib mtime
    logs base64 hacl_x25519 zarith
  ];

@ -33,6 +33,7 @@ buildDunePackage rec {
    description = "SSH implementation in OCaml";
    license = licenses.isc;
    homepage = "https://github.com/mirage/awa-ssh";
+    changelog = "https://github.com/mirage/awa-ssh/raw/v${version}/CHANGES.md";
    maintainers = [ maintainers.sternenseemann ];
  };
 }
--- a/pkgs/development/ocaml-modules/sedlex/default.nix
+++ b/pkgs/development/ocaml-modules/sedlex/default.nix
@ -1,16 +1,18 @@
-{ stdenv, lib, fetchzip, ocaml, findlib, gen, ppx_tools_versioned, ocaml-migrate-parsetree }:
+{ stdenv, lib, fetchFromGitHub, ocaml, findlib, gen, ppx_tools_versioned, ocaml-migrate-parsetree }:

 if !lib.versionAtLeast ocaml.version "4.02"
 then throw "sedlex is not available for OCaml ${ocaml.version}"
 else

 stdenv.mkDerivation rec {
-  name = "ocaml${ocaml.version}-sedlex-${version}";
+  pname = "ocaml${ocaml.version}-sedlex";
  version = "1.99.5";

-  src = fetchzip {
-    url = "https://github.com/ocaml-community/sedlex/archive/fb84e1766fc4b29e79ec40029ffee5cdb37b392f.tar.gz";
-    sha256 = "0phnqyn6mpv5byr1kkphl24y9q9fb2k3xg9yb457h5816q6ya72n";
+  src = fetchFromGitHub {
+    owner = "ocaml-community";
+    repo = "sedlex";
+    rev = "fb84e1766fc4b29e79ec40029ffee5cdb37b392f";
+    sha256 = "sha256-VhzlDTYBFXgKWT69PqZYLuHkiaDwzhmyX2XfaqzHFl4=";
  };

  buildInputs = [ ocaml findlib ];
--- a/pkgs/development/ocaml-modules/sqlite3EZ/default.nix
+++ b/pkgs/development/ocaml-modules/sqlite3EZ/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, ocaml, findlib, ocamlbuild, twt, ocaml_sqlite3 }:
+{ lib, stdenv, fetchFromGitHub, ocaml, findlib, ocamlbuild, twt, ocaml_sqlite3 }:

 assert lib.versionAtLeast (lib.getVersion ocaml) "3.12";

@ -6,12 +6,15 @@ if lib.versionAtLeast ocaml.version "4.06"
 then throw "sqlite3EZ is not available for OCaml ${ocaml.version}"
 else

-stdenv.mkDerivation {
-  name = "ocaml-sqlite3EZ-0.1.0";
+stdenv.mkDerivation rec {
+  pname = "ocaml-sqlite3EZ";
+  version = "0.1.0";

-  src = fetchurl {
-    url = "https://github.com/mlin/ocaml-sqlite3EZ/archive/v0.1.0.tar.gz";
-    sha256 = "8ed2c5d5914a65cbd95589ef11bfb8b38a020eb850cdd49b8adce7ee3a563748";
+  src = fetchFromGitHub {
+    owner = "mlin";
+    repo = "ocaml-sqlite3EZ";
+    rev = "v${version}";
+    sha256 = "sha256-pKysvth0efxJeyJQY2Dnqarg7OtsKyyLnFV/1ZhsfDY=";
  };

  buildInputs = [ ocaml findlib ocamlbuild twt ];
@ -25,6 +28,6 @@ stdenv.mkDerivation {
    description = "A thin wrapper for sqlite3-ocaml with a simplified interface";
    license = licenses.mit;
    maintainers = [ maintainers.vbgl ];
-    platforms = ocaml.meta.platforms or [];
+    platforms = ocaml.meta.platforms or [ ];
  };
 }
--- a/pkgs/development/ocaml-modules/twt/default.nix
+++ b/pkgs/development/ocaml-modules/twt/default.nix
@ -1,11 +1,14 @@
-{ lib, stdenv, fetchzip, ocaml, findlib }:
+{ lib, stdenv, fetchFromGitHub, ocaml, findlib }:

-stdenv.mkDerivation {
-  name = "ocaml${ocaml.version}-twt-0.94.0";
+stdenv.mkDerivation rec {
+  pname = "ocaml${ocaml.version}-twt";
+  version = "0.94.0";

-  src = fetchzip {
-    url = "https://github.com/mlin/twt/archive/v0.94.0.tar.gz";
-    sha256 = "0298gdgzl4cifxnc1d8sbrvz1lkiq5r5ifkq1fparm6gvqywpf65";
+  src = fetchFromGitHub {
+    owner = "mlin";
+    repo = "twt";
+    rev = "v${version}";
+    sha256 = "sha256-xbjLPd7P1KyuC3i6WHLBcdLwd14atcBsd5ER+l97KAk=";
  };

  buildInputs = [ ocaml findlib ];
@ -26,6 +29,6 @@ stdenv.mkDerivation {
    description = "“The Whitespace Thing” for OCaml";
    license = licenses.mit;
    maintainers = [ maintainers.vbgl ];
-    platforms = ocaml.meta.platforms or [];
+    platforms = ocaml.meta.platforms or [ ];
  };
 }
--- a/pkgs/development/ocaml-modules/typerep/default.nix
+++ b/pkgs/development/ocaml-modules/typerep/default.nix
@ -1,4 +1,4 @@
-{lib, buildOcaml, fetchurl, type_conv}:
+{ lib, buildOcaml, fetchFromGitHub, type_conv }:

 buildOcaml rec {
  name = "typerep";
@ -6,9 +6,11 @@ buildOcaml rec {

  minimumSupportedOcamlVersion = "4.00";

-  src = fetchurl {
-    url = "https://github.com/janestreet/typerep/archive/${version}.tar.gz";
-    sha256 = "4f1ab611a00aaf774e9774b26b687233e0c70d91f684415a876f094a9969eada";
+  src = fetchFromGitHub {
+    owner = "janestreet";
+    repo = "typerep";
+    rev = version;
+    sha256 = "sha256-XCdUZp9Buwmo6qPYAoPD2P/gUgyWHTR7boyecBPKlho=";
  };

  propagatedBuildInputs = [ type_conv ];
--- a/pkgs/development/ocaml-modules/variantslib/default.nix
+++ b/pkgs/development/ocaml-modules/variantslib/default.nix
@ -1,4 +1,4 @@
-{ lib, buildOcaml, ocaml, fetchurl, type_conv }:
+{ lib, buildOcaml, ocaml, fetchFromGitHub, type_conv }:

 if lib.versionAtLeast ocaml.version "4.06"
 then throw "variantslib-109.15.03 is not available for OCaml ${ocaml.version}"
@ -10,9 +10,11 @@ buildOcaml rec {

  minimumSupportedOcamlVersion = "4.00";

-  src = fetchurl {
-    url = "https://github.com/janestreet/variantslib/archive/${version}.tar.gz";
-    sha256 = "a948dcdd4ca54786fe0646386b6e37a9db03bf276c6557ea374d82740bf18055";
+  src = fetchFromGitHub {
+    owner = "janestreet";
+    repo = "variantslib";
+    rev = version;
+    sha256 = "sha256-pz3i3od2CqKSrm7uTQ2jdidFFwx7m7g1QuG4UdLk01k=";
  };

  propagatedBuildInputs = [ type_conv ];
--- a/pkgs/development/ocaml-modules/xml-light/default.nix
+++ b/pkgs/development/ocaml-modules/xml-light/default.nix
@ -1,4 +1,4 @@
-{stdenv, lib, fetchurl, ocaml, findlib}:
+{ stdenv, lib, fetchFromGitHub, ocaml, findlib }:
 let
  pname = "xml-light";
  version = "2.4";
@ -6,9 +6,11 @@ in
 stdenv.mkDerivation {
  name = "ocaml-${pname}-${version}";

-  src = fetchurl {
-    url = "https://github.com/ncannasse/${pname}/archive/${version}.tar.gz";
-    sha256 = "10b55qf6mvdp11ny3h0jv6k6wrs78jr9lhsiswl0xya7z8r8j0a2";
+  src = fetchFromGitHub {
+    owner = "ncannasse";
+    repo = "xml-light";
+    rev = version;
+    sha256 = "sha256-2txmkl/ZN5RGaLQJmr+orqwB4CbFk2RpLJd4gr7kPiE=";
  };

  buildInputs = [ ocaml findlib ];
@ -38,6 +40,6 @@ stdenv.mkDerivation {
    homepage = "http://tech.motion-twin.com/xmllight.html";
    license = lib.licenses.lgpl21;
    maintainers = [ lib.maintainers.romildo ];
-    platforms = ocaml.meta.platforms or [];
+    platforms = ocaml.meta.platforms or [ ];
  };
 }
--- a/pkgs/development/python-modules/adafruit-platformdetect/default.nix
+++ b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
@ -6,12 +6,12 @@

 buildPythonPackage rec {
  pname = "adafruit-platformdetect";
-  version = "3.16.1";
+  version = "3.17.1";

  src = fetchPypi {
    pname = "Adafruit-PlatformDetect";
    inherit version;
-    sha256 = "sha256-09EzoV+212Nj3abhfS82tRE+KDJQT/tujUtmuo2h2Wk=";
+    sha256 = "sha256-M+0q1u/ZcAg2Pii/B2n0v+rw/zIAjeVej/VThi9NLwI=";
  };

  nativeBuildInputs = [ setuptools-scm ];
--- a/pkgs/development/python-modules/asn1/default.nix
+++ b/pkgs/development/python-modules/asn1/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "asn1";
-  version = "2.4.1";
+  version = "2.4.2";

  disabled = pythonOlder "3.7";

@ -16,7 +16,7 @@ buildPythonPackage rec {
    owner = "andrivet";
    repo = "python-asn1";
    rev = "v${version}";
-    sha256 = "0g2d5cr1pxsm5ackba7padf7gvlgrgv807kh0312s5axjd2cww2l";
+    sha256 = "sha256-fx/kWOnh5Gk1DjeX0xiCJYnd5teD18RvKyOnawcfWWA=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/audiotools/default.nix
+++ b/pkgs/development/python-modules/audiotools/default.nix
@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, fetchurl
+, fetchFromGitHub
 , stdenv
 , darwin
 }:
@ -15,9 +15,11 @@ buildPythonPackage rec {
    CoreServices
  ]);

-  src = fetchurl {
-    url = "https://github.com/tuffy/python-audio-tools/archive/v${version}.tar.gz";
-    sha256 = "0ymlxvqkqhzk4q088qwir3dq0zgwqlrrdfnq7f0iq97g05qshm2c";
+  src = fetchFromGitHub {
+    owner = "tuffy";
+    repo = "python-audio-tools";
+    rev = "v3.1.1";
+    sha256 = "sha256-y+EiK9BktyTWowOiJvOb2YjtbPa7R62Wb5zinkyt1OM=";
  };

  meta = {
--- a/pkgs/development/python-modules/casbin/default.nix
+++ b/pkgs/development/python-modules/casbin/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "casbin";
-  version = "1.9.3";
+  version = "1.9.4";

  disabled = isPy27;

@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = pname;
    repo = "pycasbin";
    rev = "v${version}";
-    sha256 = "sha256-PN31/1BpXcNqsqBZ8sS/MM3UL47/Bi24bUh+jGOJevk=";
+    sha256 = "1d8wxj2hi68yr303v4h5wh4q7iv8gb2qm1q054vnf0kgczxnl732";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/certbot-dns-cloudflare/default.nix
+++ b/pkgs/development/python-modules/certbot-dns-cloudflare/default.nix
@ -2,16 +2,16 @@
 , acme
 , certbot
 , cloudflare
-, isPy3k
-, pytest
 , pytestCheckHook
+, pythonOlder
 }:

 buildPythonPackage rec {
-  inherit (certbot) src version;
-
  pname = "certbot-dns-cloudflare";

+  inherit (certbot) src version;
+  disabled = pythonOlder "3.6";
+
  propagatedBuildInputs = [
    acme
    certbot
@ -19,15 +19,12 @@ buildPythonPackage rec {
  ];

  checkInputs = [
-    pytest
    pytestCheckHook
  ];

-  disabled = !isPy3k;
-
  pytestFlagsArray = [ "-o cache_dir=$(mktemp -d)" ];

-  sourceRoot = "source/${pname}";
+  sourceRoot = "source/certbot-dns-cloudflare";

  meta = certbot.meta // {
    description = "Cloudflare DNS Authenticator plugin for Certbot";
--- a/pkgs/development/python-modules/certbot-dns-google/default.nix
+++ b/pkgs/development/python-modules/certbot-dns-google/default.nix
@ -0,0 +1,35 @@
+{ buildPythonPackage
+, acme
+, certbot
+, google-api-python-client
+, isPy3k
+, oauth2client
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "certbot-dns-google";
+
+  inherit (certbot) src version;
+  disabled = pythonOlder "3.6";
+
+  propagatedBuildInputs = [
+    acme
+    certbot
+    google-api-python-client
+    oauth2client
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [ "-o cache_dir=$(mktemp -d)" ];
+
+  sourceRoot = "source/certbot-dns-google";
+
+  meta = certbot.meta // {
+    description = "Google Cloud DNS Authenticator plugin for Certbot";
+  };
+}
--- a/pkgs/development/python-modules/certbot-dns-rfc2136/default.nix
+++ b/pkgs/development/python-modules/certbot-dns-rfc2136/default.nix
@ -3,15 +3,16 @@
 , certbot
 , dnspython
 , isPy3k
-, pytest
 , pytestCheckHook
+, pythonOlder
 }:

 buildPythonPackage rec {
-  inherit (certbot) src version;
-
  pname = "certbot-dns-rfc2136";

+  inherit (certbot) src version;
+  disabled = pythonOlder "3.6";
+
  propagatedBuildInputs = [
    acme
    certbot
@ -19,15 +20,12 @@ buildPythonPackage rec {
  ];

  checkInputs = [
-    pytest
    pytestCheckHook
  ];

-  disabled = !isPy3k;
-
  pytestFlagsArray = [ "-o cache_dir=$(mktemp -d)" ];

-  sourceRoot = "source/${pname}";
+  sourceRoot = "source/certbot-dns-rfc2136";

  meta = certbot.meta // {
    description = "RFC 2136 DNS Authenticator plugin for Certbot";
--- a/pkgs/development/python-modules/certbot-dns-route53/default.nix
+++ b/pkgs/development/python-modules/certbot-dns-route53/default.nix
@ -3,15 +3,16 @@
 , boto3
 , certbot
 , isPy3k
-, pytest
 , pytestCheckHook
+, pythonOlder
 }:

 buildPythonPackage rec {
-  inherit (certbot) src version;
-
  pname = "certbot-dns-route53";

+  inherit (certbot) src version;
+  disabled = pythonOlder "3.6";
+
  propagatedBuildInputs = [
    acme
    boto3
@ -19,15 +20,12 @@ buildPythonPackage rec {
  ];

  checkInputs = [
-    pytest
    pytestCheckHook
  ];

-  disabled = !isPy3k;
-
  pytestFlagsArray = [ "-o cache_dir=$(mktemp -d)" ];

-  sourceRoot = "source/${pname}";
+  sourceRoot = "source/certbot-dns-route53";

  meta = certbot.meta // {
    description = "Route53 DNS Authenticator plugin for Certbot";
--- a/pkgs/development/python-modules/cirq-core/default.nix
+++ b/pkgs/development/python-modules/cirq-core/default.nix
@ -3,6 +3,7 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
+, duet
 , matplotlib
 , networkx
 , numpy
@ -29,7 +30,7 @@

 buildPythonPackage rec {
  pname = "cirq-core";
-  version = "0.12.0";
+  version = "0.13.1";

  disabled = pythonOlder "3.6";

@ -37,7 +38,7 @@ buildPythonPackage rec {
    owner = "quantumlib";
    repo = "cirq";
    rev = "v${version}";
-    sha256 = "sha256-NPaADiRoPL0KoLugtk0vsnTGuRDK85e4j9kHv9aO/Po=";
+    sha256 = "sha256-MVfJ8iEeW8gFvCNTqrWfYpNNYuDAufHgcjd7Nh3qp8U=";
  };

  sourceRoot = "source/${pname}";
@ -50,6 +51,7 @@ buildPythonPackage rec {
  '';

  propagatedBuildInputs = [
+    duet
    matplotlib
    networkx
    numpy
--- a/pkgs/development/python-modules/cirq-rigetti/default.nix
+++ b/pkgs/development/python-modules/cirq-rigetti/default.nix
@ -39,7 +39,8 @@ buildPythonPackage rec {
      --replace "httpx~=0.15.5" "httpx" \
      --replace "idna~=2.10" "idna" \
      --replace "requests~=2.18" "requests" \
-      --replace "pyjwt~=1.7.1" "pyjwt"
+      --replace "pyjwt~=1.7.1" "pyjwt" \
+      --replace "qcs-api-client~=0.8.0" "qcs-api-client"
  '';

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/cirq/default.nix
+++ b/pkgs/development/python-modules/cirq/default.nix
@ -1,7 +1,12 @@
 { lib
 , buildPythonPackage
+, cirq-aqt
 , cirq-core
 , cirq-google
+, cirq-ionq
+, cirq-pasqal
+, cirq-rigetti
+, cirq-web
  # test inputs
 , pytestCheckHook
 }:
@ -11,8 +16,13 @@ buildPythonPackage rec {
  inherit (cirq-core) version src meta;

  propagatedBuildInputs = [
+    cirq-aqt
    cirq-core
+    cirq-ionq
    cirq-google
+    cirq-rigetti
+    cirq-pasqal
+    cirq-web
  ];

  # pythonImportsCheck = [ "cirq" "cirq.Circuit" ];  # cirq's importlib hook doesn't work here
@ -20,8 +30,13 @@ buildPythonPackage rec {

  # Don't run submodule or development tool tests
  disabledTestPaths = [
-    "cirq-google"
+    "cirq-aqt"
    "cirq-core"
+    "cirq-google"
+    "cirq-ionq"
+    "cirq-pasqal"
+    "cirq-rigetti"
+    "cirq-web"
    "dev_tools"
  ];

--- a/pkgs/development/python-modules/duet/default.nix
+++ b/pkgs/development/python-modules/duet/default.nix
@ -0,0 +1,28 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, typing-extensions
+}:
+
+buildPythonPackage rec {
+  pname = "duet";
+  version = "0.2.1";
+
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = "duet";
+    rev = "v${version}";
+    sha256 = "sha256-hK2Cx7dSm1mGM2z9oCoRogfa2aIsjyJcdpSSfdHhPmw=";
+  };
+
+  propagatedBuildInputs = [ typing-extensions ];
+
+  checkInputs = [ pytestCheckHook ];
+
+  meta = with lib; {
+    description = "A simple future-based async library for python";
+    homepage = "https://github.com/google/duet";
+    maintainers = with maintainers; [ drewrisinger ];
+  };
+}
--- a/pkgs/development/python-modules/dulwich/default.nix
+++ b/pkgs/development/python-modules/dulwich/default.nix
@ -15,12 +15,12 @@
 }:

 buildPythonPackage rec {
-  version = "0.20.25";
+  version = "0.20.26";
  pname = "dulwich";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "79baea81583eb61eb7bd4a819ab6096686b362c626a4640d84d4fc5539139353";
+    sha256 = "sha256-OKpQ+FnI6lMHGgScPx1cxU99xgpBNqGrYxdWp59lgrU=";
  };

  LC_ALL = "en_US.UTF-8";
--- a/pkgs/development/python-modules/elasticsearch/default.nix
+++ b/pkgs/development/python-modules/elasticsearch/default.nix
@ -12,11 +12,11 @@ buildPythonPackage (rec {
  # there's a clear path forward. See
  # https://github.com/elastic/elasticsearch-py/issues/1639 for more
  # info.
-  version = "7.13.1";
+  version = "7.15.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "d6bcca0b2e5665d08e6fe6fadc2d4d321affd76ce483603078fc9d3ccd2bc0f9";
+    sha256 = "1e9a6302945d98046899a7c9b3d345c881ac7b05ba176d3a49c9d2702b1e8bc8";
  };

  # Check is disabled because running them destroy the content of the local cluster!
--- a/pkgs/development/python-modules/etcd/default.nix
+++ b/pkgs/development/python-modules/etcd/default.nix
@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, fetchurl
+, fetchFromGitHub
 , simplejson
 , pytz
 , requests
@ -11,9 +11,11 @@ buildPythonPackage rec {
  version = "2.0.8";

  # PyPI package is incomplete
-  src = fetchurl {
-    url = "https://github.com/dsoprea/PythonEtcdClient/archive/${version}.tar.gz";
-    sha256 = "0fi6rxa1yxvz7nwrc7dw6fax3041d6bj3iyhywjgbkg7nadi9i8v";
+  src = fetchFromGitHub {
+    owner = "dsoprea";
+    repo = "PythonEtcdClient";
+    rev = version;
+    sha256 = "sha256-h+jYIRSNdrGkW3tBV1ifIDEXU46EQGyeJoz/Mxym4pI=";
  };

  patchPhase = ''
--- a/pkgs/development/python-modules/gdrivefs/default.nix
+++ b/pkgs/development/python-modules/gdrivefs/default.nix
@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, fetchurl
+, fetchFromGitHub
 , isPy3k
 , gipc
 , greenlet
@ -16,9 +16,11 @@ buildPythonPackage rec {
  pname = "gdrivefs";
  disabled = isPy3k;

-  src = fetchurl {
-    url = "https://github.com/dsoprea/GDriveFS/archive/${version}.tar.gz";
-    sha256 = "0m45z77idy0bs5fqlz0y534fy28ikamrd321hmqsc3q7d39kqzv0";
+  src = fetchFromGitHub {
+    owner = "dsoprea";
+    repo = "GDriveFS";
+    rev = version;
+    sha256 = "sha256-eDBy2rp3uitUrR9CG75x8mAio8+gaSckA/lEPAWO0Yo=";
  };

  buildInputs = [ gipc greenlet httplib2 six ];
--- a/pkgs/development/python-modules/herepy/default.nix
+++ b/pkgs/development/python-modules/herepy/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "herepy";
-  version = "3.5.5";
+  version = "3.5.6";
  format = "setuptools";

  disabled = pythonOlder "3.5";
@ -18,14 +18,9 @@ buildPythonPackage rec {
    owner = "abdullahselek";
    repo = "HerePy";
    rev = version;
-    sha256 = "sha256-nZ+91i+IBdRDN1TsDwmk9pNceFvcV6C155Ds1MQc9z4=";
+    sha256 = "sha256-I5u5PKB29jQNFdsx+y5ZJOE837D7Hpcsf3pwlCvmEqU=";
  };

-  postPatch = ''
-    substituteInPlace requirements.txt \
-      --replace "requests==2.25.1" "requests>=2.25.1"
-  '';
-
  propagatedBuildInputs = [
    requests
  ];
--- a/pkgs/development/python-modules/identify/default.nix
+++ b/pkgs/development/python-modules/identify/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "identify";
-  version = "2.3.0";
+  version = "2.3.1";


  src = fetchFromGitHub {
    owner = "pre-commit";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-V+pRxdbWPaIVqIJYcrmeZKPmmC1ouRgdFsaVVrDUsQc=";
+    sha256 = "sha256-6sErta+YnaXe7lHR3kR7UAoWuaw8He7e3gCML9vWYj8=";
  };

  checkInputs = [
--- a/pkgs/development/python-modules/jsonwatch/default.nix
+++ b/pkgs/development/python-modules/jsonwatch/default.nix
@ -1,18 +1,20 @@
 { lib
 , buildPythonPackage
-, fetchurl
+, fetchFromGitHub
 , six
 , isPyPy
 }:

-buildPythonPackage {
+buildPythonPackage rec {
  pname = "jsonwatch";
  version = "0.2.0";
  disabled = isPyPy; # doesn't find setuptools

-  src = fetchurl {
-    url = "https://github.com/dbohdan/jsonwatch/archive/v0.2.0.tar.gz";
-    sha256 = "04b616ef97b9d8c3887004995420e52b72a4e0480a92dbf60aa6c50317261e06";
+  src = fetchFromGitHub {
+    owner = "dbohdan";
+    repo = "jsonwatch";
+    rev = "v${version}";
+    sha256 = "sha256-yLN6jOxAz+B7zvV3tGT6Nxi17v9ZOtWpbtSi0o1h48U=";
  };

  propagatedBuildInputs = [ six ];
--- a/pkgs/development/python-modules/le/default.nix
+++ b/pkgs/development/python-modules/le/default.nix
@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, fetchurl
+, fetchFromGitHub
 , isPy3k
 , simplejson
 , psutil
@ -10,9 +10,11 @@ buildPythonPackage rec {
  pname = "le";
  version = "1.4.29";

-  src = fetchurl {
-    url = "https://github.com/logentries/le/archive/v${version}.tar.gz";
-    sha256 = "d29738937cb6e714b6ec2ae74b66b1983482ffd54b4faa40767af18509521d4c";
+  src = fetchFromGitHub {
+    owner = "logentries";
+    repo = "le";
+    rev = "v${version}";
+    sha256 = "sha256-67JPnof0olReu90rM78e1px8NvbGcj8pphFhPaiSVmA=";
  };

  disabled = isPy3k;
--- a/pkgs/development/python-modules/livestreamer-curses/default.nix
+++ b/pkgs/development/python-modules/livestreamer-curses/default.nix
@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, fetchurl
+, fetchFromGitHub
 , isPyPy
 , livestreamer
 }:
@ -10,9 +10,11 @@ buildPythonPackage rec {
  pname = "livestreamer-curses";
  disabled = isPyPy;

-  src = fetchurl {
-    url = "https://github.com/gapato/livestreamer-curses/archive/v${version}.tar.gz";
-    sha256 = "1v49sym6mrci9dxy0a7cpbp4bv6fg2ijj6rwk4wzg18c2x4qzkhn";
+  src = fetchFromGitHub {
+    owner = "gapato";
+    repo = "livestreamer-curses";
+    rev = "v1.5.2";
+    sha256 = "sha256-Pi0PIOUhMMAWft9ackB04IgF6DyPrXppNqyVjozIjN4=";
  };

  propagatedBuildInputs = [ livestreamer ];
--- a/pkgs/development/python-modules/livestreamer/default.nix
+++ b/pkgs/development/python-modules/livestreamer/default.nix
@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , pkgs
+, fetchFromGitHub
 , isPyPy
 , pycrypto
 , requests
@ -14,9 +15,11 @@ buildPythonPackage rec {
  pname = "livestreamer";
  disabled = isPyPy;

-  src = pkgs.fetchurl {
-    url = "https://github.com/chrippa/livestreamer/archive/v${version}.tar.gz";
-    sha256 = "1fp3d3z2grb1ls97smjkraazpxnvajda2d1g1378s6gzmda2jvjd";
+  src = fetchFromGitHub {
+    owner = "chrippa";
+    repo = "livestreamer";
+    rev = "v1.12.2";
+    sha256 = "sha256-PqqyBh+oMmu7Ynly3fqx/+6mQYX+6SpI0Okj2O+YLz0=";
  };

  nativeBuildInputs = [ pkgs.makeWrapper ];
--- a/pkgs/development/python-modules/mautrix/default.nix
+++ b/pkgs/development/python-modules/mautrix/default.nix
@ -4,11 +4,11 @@

 buildPythonPackage rec {
  pname = "mautrix";
-  version = "0.10.10";
+  version = "0.10.11";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "78309702392fe1ced000a23cfacb9bae0511ba533963b82d1d040f4a39924c09";
+    sha256 = "b3905fbd1381031b4c54258fdef9e99dd342c3a211abe0b827b2c480db4b1771";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/millheater/default.nix
+++ b/pkgs/development/python-modules/millheater/default.nix
@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "millheater";
-  version = "0.7.3";
+  version = "0.8.0";
  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "Danielhiversen";
    repo = "pymill";
    rev = version;
-    sha256 = "sha256-WMw07mNvQdrqm5cf3+YWRZsZQ59vOqYSps26scPFpNI=";
+    sha256 = "sha256-PL9qP6SKE8gsBUdfrPf9Fs+vU/lkpOjmkvq3cWw3Uak=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/mitogen/default.nix
+++ b/pkgs/development/python-modules/mitogen/default.nix
@ -5,13 +5,13 @@

 buildPythonPackage rec {
  pname = "mitogen";
-  version = "0.3.0rc1";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "mitogen-hq";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0hxb41sshybxjyvyarl2axs0v6w53vqxafgfjrmpp5k20z5kapz4";
+    sha256 = "sha256-SotxlsJDIeFd4BN9C7afyyybET5ST2yaoWVEyT/lr48=";
  };

  # Tests require network access and Docker support
--- a/pkgs/development/python-modules/msal/default.nix
+++ b/pkgs/development/python-modules/msal/default.nix
@ -9,11 +9,11 @@

 buildPythonPackage rec {
  pname = "msal";
-  version = "1.15.0";
+  version = "1.16.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "00d3cc77c3bcd8e2accaf178aa58a1d036918faa9c0f3039772cc16a470bdacc";
+    sha256 = "240fb04dba46a27fd6a3178db8334412d0d02e0be85166f9e05bb45d03399084";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/mypy-boto3-s3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3-s3/default.nix
@ -8,13 +8,13 @@

 buildPythonPackage rec {
  pname = "mypy-boto3-s3";
-  version = "1.19.4";
+  version = "1.19.7";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "47a2d1a5c7ea77a70d001d0f3ae6f2b06d3e533f817b165bb67e3dad1c2d0c11";
+    sha256 = "1e5e8a19b8ebc3118d32ce1e13ad3cc5f90d34b613779b66dfdec0658cf7036f";
  };

  propagatedBuildInputs = [
--- a/Show more
+++ b/Show more