diff --git a/third_party/nixpkgs/doc/builders/fetchers.chapter.md b/third_party/nixpkgs/doc/builders/fetchers.chapter.md
index 5b28b2dcb3..28388ba685 100644
--- a/third_party/nixpkgs/doc/builders/fetchers.chapter.md
+++ b/third_party/nixpkgs/doc/builders/fetchers.chapter.md
@@ -40,6 +40,24 @@ Used with Git. Expects `url` to a Git repo, `rev`, and `sha256`. `rev` in this c
 
 Additionally the following optional arguments can be given: `fetchSubmodules = true` makes `fetchgit` also fetch the submodules of a repository. If `deepClone` is set to true, the entire repository is cloned as opposing to just creating a shallow clone. `deepClone = true` also implies `leaveDotGit = true` which means that the `.git` directory of the clone won't be removed after checkout.
 
+If only parts of the repository are needed, `sparseCheckout` can be used. This will prevent git from fetching unnecessary blobs from server, see [git sparse-checkout](https://git-scm.com/docs/git-sparse-checkout) and [git clone --filter](https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---filterltfilter-specgt) for more infomation:
+
+```nix
+{ stdenv, fetchgit }:
+
+stdenv.mkDerivation {
+  name = "hello";
+  src = fetchgit {
+    url = "https://...";
+    sparseCheckout = ''
+      path/to/be/included
+      another/path
+    '';
+    sha256 = "0000000000000000000000000000000000000000000000000000";
+  };
+}
+```
+
 ## `fetchfossil` {#fetchfossil}
 
 Used with Fossil. Expects `url` to a Fossil archive, `rev`, and `sha256`.
diff --git a/third_party/nixpkgs/lib/default.nix b/third_party/nixpkgs/lib/default.nix
index 2dfe62e82a..2684225388 100644
--- a/third_party/nixpkgs/lib/default.nix
+++ b/third_party/nixpkgs/lib/default.nix
@@ -122,8 +122,9 @@ let
       mkRenamedOptionModule mkMergedOptionModule mkChangedOptionModule
       mkAliasOptionModule mkDerivedConfig doRename;
     inherit (self.options) isOption mkEnableOption mkSinkUndeclaredOptions
-      mergeDefaultOption mergeOneOption mergeEqualOption getValues
-      getFiles optionAttrSetToDocList optionAttrSetToDocList'
+      mergeDefaultOption mergeOneOption mergeEqualOption mergeUniqueOption
+      getValues getFiles
+      optionAttrSetToDocList optionAttrSetToDocList'
       scrubOptionValue literalExpression literalExample literalDocBook
       showOption showFiles unknownModule mkOption;
     inherit (self.types) isType setType defaultTypeMerge defaultFunctor
diff --git a/third_party/nixpkgs/lib/options.nix b/third_party/nixpkgs/lib/options.nix
index 794ca5e339..627aac24d2 100644
--- a/third_party/nixpkgs/lib/options.nix
+++ b/third_party/nixpkgs/lib/options.nix
@@ -172,11 +172,13 @@ rec {
     else if all isInt list && all (x: x == head list) list then head list
     else throw "Cannot merge definitions of `${showOption loc}'. Definition values:${showDefs defs}";
 
-  mergeOneOption = loc: defs:
-    if defs == [] then abort "This case should never happen."
-    else if length defs != 1 then
-      throw "The unique option `${showOption loc}' is defined multiple times. Definition values:${showDefs defs}"
-    else (head defs).value;
+  mergeOneOption = mergeUniqueOption { message = ""; };
+
+  mergeUniqueOption = { message }: loc: defs:
+    if length defs == 1
+    then (head defs).value
+    else assert length defs > 1;
+      throw "The option `${showOption loc}' is defined multiple times.\n${message}\nDefinition values:${showDefs defs}";
 
   /* "Merge" option definitions by checking that they all have the same value. */
   mergeEqualOption = loc: defs:
diff --git a/third_party/nixpkgs/lib/types.nix b/third_party/nixpkgs/lib/types.nix
index cc3ac5fdf6..f2f9b2bca9 100644
--- a/third_party/nixpkgs/lib/types.nix
+++ b/third_party/nixpkgs/lib/types.nix
@@ -32,7 +32,6 @@ let
     last
     length
     tail
-    unique
     ;
   inherit (lib.attrsets)
     attrNames
@@ -48,6 +47,7 @@ let
     mergeDefaultOption
     mergeEqualOption
     mergeOneOption
+    mergeUniqueOption
     showFiles
     showOption
     ;
@@ -470,6 +470,18 @@ rec {
       nestedTypes.elemType = elemType;
     };
 
+    unique = { message }: type: mkOptionType rec {
+      name = "unique";
+      inherit (type) description check;
+      merge = mergeUniqueOption { inherit message; };
+      emptyValue = type.emptyValue;
+      getSubOptions = type.getSubOptions;
+      getSubModules = type.getSubModules;
+      substSubModules = m: uniq (type.substSubModules m);
+      functor = (defaultFunctor name) // { wrapped = type; };
+      nestedTypes.elemType = type;
+    };
+
     # Null or value of ...
     nullOr = elemType: mkOptionType rec {
       name = "nullOr";
@@ -599,6 +611,7 @@ rec {
     # A value from a set of allowed ones.
     enum = values:
       let
+        inherit (lib.lists) unique;
         show = v:
                if builtins.isString v then ''"${v}"''
           else if builtins.isInt v then builtins.toString v
diff --git a/third_party/nixpkgs/maintainers/maintainer-list.nix b/third_party/nixpkgs/maintainers/maintainer-list.nix
index 9d1d35f01c..e991280a0f 100644
--- a/third_party/nixpkgs/maintainers/maintainer-list.nix
+++ b/third_party/nixpkgs/maintainers/maintainer-list.nix
@@ -515,6 +515,8 @@
   };
   algorith = {
     email = "dries_van_daele@telenet.be";
+    github = "DriesVanDaele";
+    githubId = 1141488;
     name = "Dries Van Daele";
   };
   alibabzo = {
@@ -3543,7 +3545,7 @@
     name = "Leo Maroni";
   };
   emmanuelrosa = {
-    email = "emmanuel_rosa@aol.com";
+    email = "emmanuelrosa@protonmail.com";
     matrix = "@emmanuelrosa:matrix.org";
     github = "emmanuelrosa";
     githubId = 13485450;
@@ -5982,6 +5984,13 @@
     githubId = 107689;
     name = "Josh Holland";
   };
+  jsierles = {
+    email = "joshua@hey.com";
+    matrix = "@jsierles:matrix.org";
+    name = "Joshua Sierles";
+    github = "jsierles";
+    githubId = 82;
+  };
   jtcoolen = {
     email = "jtcoolen@pm.me";
     name = "Julien Coolen";
@@ -7024,7 +7033,7 @@
     email = "nullarequest@vivlaid.net";
     github = "Lunarequest";
     githubId = 30698906;
-    name = "Advaith Madhukar"; # this is my legal name, I prefer Luna; please keep that in mind!
+    name = "Luna D Dragon";
   };
   lionello = {
     email = "lio@lunesu.com";
@@ -8586,6 +8595,12 @@
     githubId = 7845120;
     name = "Alex Martens";
   };
+  nialov = {
+    email = "nikolasovaskainen@gmail.com";
+    github = "nialov";
+    githubId = 47318483;
+    name = "Nikolas Ovaskainen";
+  };
   nikitavoloboev = {
     email = "nikita.voloboev@gmail.com";
     github = "nikitavoloboev";
@@ -12041,7 +12056,7 @@
     name = "Tiago Castro";
   };
   tilcreator = {
-    name = "Tilman Jackel";
+    name = "TilCreator";
     email = "contact.nixos@tc-j.de";
     matrix = "@tilcreator:matrix.org";
     github = "TilCreator";
diff --git a/third_party/nixpkgs/nixos/doc/manual/development/option-types.section.md b/third_party/nixpkgs/nixos/doc/manual/development/option-types.section.md
index ed55720665..56ffa8e9d7 100644
--- a/third_party/nixpkgs/nixos/doc/manual/development/option-types.section.md
+++ b/third_party/nixpkgs/nixos/doc/manual/development/option-types.section.md
@@ -250,6 +250,12 @@ Composed types are types that take a type as parameter. `listOf
 :   Ensures that type *`t`* cannot be merged. It is used to ensure option
     definitions are declared only once.
 
+`types.unique` `{ message = m }` *`t`*
+
+:   Ensures that type *`t`* cannot be merged. Prints the message *`m`*, after
+    the line `The option <option path> is defined multiple times.` and before
+    a list of definition locations.
+
 `types.either` *`t1 t2`*
 
 :   Type *`t1`* or type *`t2`*, e.g. `with types; either int str`.
diff --git a/third_party/nixpkgs/nixos/doc/manual/from_md/development/option-types.section.xml b/third_party/nixpkgs/nixos/doc/manual/from_md/development/option-types.section.xml
index c83ffa2add..76ffb6f837 100644
--- a/third_party/nixpkgs/nixos/doc/manual/from_md/development/option-types.section.xml
+++ b/third_party/nixpkgs/nixos/doc/manual/from_md/development/option-types.section.xml
@@ -496,6 +496,22 @@
           </para>
         </listitem>
       </varlistentry>
+      <varlistentry>
+        <term>
+          <literal>types.unique</literal>
+          <literal>{ message = m }</literal>
+          <emphasis><literal>t</literal></emphasis>
+        </term>
+        <listitem>
+          <para>
+            Ensures that type <emphasis><literal>t</literal></emphasis>
+            cannot be merged. Prints the message
+            <emphasis><literal>m</literal></emphasis>, after the line
+            <literal>The option &lt;option path&gt; is defined multiple times.</literal>
+            and before a list of definition locations.
+          </para>
+        </listitem>
+      </varlistentry>
       <varlistentry>
         <term>
           <literal>types.either</literal>
diff --git a/third_party/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/third_party/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index d1692c66a4..436157515e 100644
--- a/third_party/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/third_party/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -356,6 +356,19 @@
           loaded.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The iputils package, which is installed by default, no longer
+          provides the legacy tools <literal>tftpd</literal> and
+          <literal>traceroute6</literal>. More tools
+          (<literal>ninfod</literal>, <literal>rarpd</literal>, and
+          <literal>rdisc</literal>) are going to be removed in the next
+          release. See
+          <link xlink:href="https://github.com/iputils/iputils/releases/tag/20211215">upstream’s
+          release notes</link> for more details and available
+          replacements.
+        </para>
+      </listitem>
       <listitem>
         <para>
           <literal>services.thelounge.private</literal> was removed in
diff --git a/third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2205.section.md b/third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2205.section.md
index f2484c911e..9d919711cb 100644
--- a/third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -116,6 +116,12 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `idris2` now requires `--package` when using packages `contrib` and `network`, while previously these idris2 packages were automatically loaded.
 
+- The iputils package, which is installed by default, no longer provides the
+  legacy tools `tftpd` and `traceroute6`. More tools (`ninfod`, `rarpd`, and
+  `rdisc`) are going to be removed in the next release. See
+  [upstream's release notes](https://github.com/iputils/iputils/releases/tag/20211215)
+  for more details and available replacements.
+
 - `services.thelounge.private` was removed in favor of `services.thelounge.public`, to follow with upstream changes.
 
 - `pkgs.docbookrx` was removed since it's unmaintained
diff --git a/third_party/nixpkgs/nixos/modules/security/pam.nix b/third_party/nixpkgs/nixos/modules/security/pam.nix
index 21202c55fe..964cfe7040 100644
--- a/third_party/nixpkgs/nixos/modules/security/pam.nix
+++ b/third_party/nixpkgs/nixos/modules/security/pam.nix
@@ -1035,7 +1035,7 @@ in
         setuid = true;
         owner = "root";
         group = "root";
-        source = "${pkgs.pam}/sbin/unix_chkpwd.orig";
+        source = "${pkgs.pam}/bin/unix_chkpwd";
       };
     };
 
diff --git a/third_party/nixpkgs/nixos/modules/services/hardware/triggerhappy.nix b/third_party/nixpkgs/nixos/modules/services/hardware/triggerhappy.nix
index 4e979c4d8f..c2fa87875e 100644
--- a/third_party/nixpkgs/nixos/modules/services/hardware/triggerhappy.nix
+++ b/third_party/nixpkgs/nixos/modules/services/hardware/triggerhappy.nix
@@ -70,7 +70,7 @@ in
         type = types.listOf (types.submodule bindingCfg);
         default = [];
         example = lib.literalExpression ''
-          [ { keys = ["PLAYPAUSE"];  cmd = "''${pkgs.mpc_cli}/bin/mpc -q toggle"; } ]
+          [ { keys = ["PLAYPAUSE"];  cmd = "''${pkgs.mpc-cli}/bin/mpc -q toggle"; } ]
         '';
         description = ''
           Key bindings for <command>triggerhappy</command>.
diff --git a/third_party/nixpkgs/nixos/modules/services/misc/gitlab.nix b/third_party/nixpkgs/nixos/modules/services/misc/gitlab.nix
index 219155777d..6f6a9e3110 100644
--- a/third_party/nixpkgs/nixos/modules/services/misc/gitlab.nix
+++ b/third_party/nixpkgs/nixos/modules/services/misc/gitlab.nix
@@ -1099,7 +1099,9 @@ in {
       "d ${gitlabConfig.production.shared.path} 0750 ${cfg.user} ${cfg.group} -"
       "d ${gitlabConfig.production.shared.path}/artifacts 0750 ${cfg.user} ${cfg.group} -"
       "d ${gitlabConfig.production.shared.path}/lfs-objects 0750 ${cfg.user} ${cfg.group} -"
+      "d ${gitlabConfig.production.shared.path}/packages 0750 ${cfg.user} ${cfg.group} -"
       "d ${gitlabConfig.production.shared.path}/pages 0750 ${cfg.user} ${cfg.group} -"
+      "d ${gitlabConfig.production.shared.path}/terraform_state 0750 ${cfg.user} ${cfg.group} -"
       "L+ /run/gitlab/config - - - - ${cfg.statePath}/config"
       "L+ /run/gitlab/log - - - - ${cfg.statePath}/log"
       "L+ /run/gitlab/tmp - - - - ${cfg.statePath}/tmp"
diff --git a/third_party/nixpkgs/nixos/modules/services/misc/home-assistant.nix b/third_party/nixpkgs/nixos/modules/services/misc/home-assistant.nix
index 2de25d87ed..ac4c0222aa 100644
--- a/third_party/nixpkgs/nixos/modules/services/misc/home-assistant.nix
+++ b/third_party/nixpkgs/nixos/modules/services/misc/home-assistant.nix
@@ -278,6 +278,11 @@ in {
           "bluetooth_tracker"
           "bluetooth_le_tracker"
         ];
+        componentsUsingPing = [
+          # Components that require the capset syscall for the ping wrapper
+          "ping"
+          "wake_on_lan"
+        ];
         componentsUsingSerialDevices = [
           # Components that require access to serial devices (/dev/tty*)
           # List generated from home-assistant documentation:
@@ -382,6 +387,8 @@ in {
         SystemCallFilter = [
           "@system-service"
           "~@privileged"
+        ] ++ optionals (any useComponent componentsUsingPing) [
+          "capset"
         ];
         UMask = "0077";
       };
diff --git a/third_party/nixpkgs/nixos/modules/services/misc/matrix-synapse.nix b/third_party/nixpkgs/nixos/modules/services/misc/matrix-synapse.nix
index 404163d2de..feca4c5465 100644
--- a/third_party/nixpkgs/nixos/modules/services/misc/matrix-synapse.nix
+++ b/third_party/nixpkgs/nixos/modules/services/misc/matrix-synapse.nix
@@ -119,6 +119,30 @@ ${cfg.extraConfig}
 
   hasLocalPostgresDB = let args = cfg.database_args; in
     usePostgresql && (!(args ? host) || (elem args.host [ "localhost" "127.0.0.1" "::1" ]));
+
+  registerNewMatrixUser =
+    let
+      isIpv6 = x: lib.length (lib.splitString ":" x) > 1;
+      listener =
+        lib.findFirst (
+          listener: lib.any (
+            resource: lib.any (
+              name: name == "client"
+            ) resource.names
+          ) listener.resources
+        ) (lib.last cfg.listeners) cfg.listeners;
+    in
+    pkgs.writeShellScriptBin "matrix-synapse-register_new_matrix_user" ''
+      exec ${cfg.package}/bin/register_new_matrix_user \
+        $@ \
+        ${lib.concatMapStringsSep " " (x: "-c ${x}") ([ configFile ] ++ cfg.extraConfigFiles)} \
+        "${listener.type}://${
+          if (isIpv6 listener.bind_address) then
+            "[${listener.bind_address}]"
+          else
+            "${listener.bind_address}"
+        }:${builtins.toString listener.port}/"
+    '';
 in {
   options = {
     services.matrix-synapse = {
@@ -294,7 +318,7 @@ in {
                     description = ''
                       List of resources to host on this listener.
                     '';
-                    example = ["client" "webclient" "federation"];
+                    example = ["client" "federation"];
                   };
                   compress = mkOption {
                     type = types.bool;
@@ -319,7 +343,7 @@ in {
           tls = true;
           x_forwarded = false;
           resources = [
-            { names = ["client" "webclient"]; compress = true; }
+            { names = ["client"]; compress = true; }
             { names = ["federation"]; compress = false; }
           ];
         }];
@@ -792,6 +816,8 @@ in {
         UMask = "0077";
       };
     };
+
+    environment.systemPackages = [ registerNewMatrixUser ];
   };
 
   imports = [
diff --git a/third_party/nixpkgs/nixos/modules/services/networking/bird.nix b/third_party/nixpkgs/nixos/modules/services/networking/bird.nix
index c14adbda3c..fc06cdaa6e 100644
--- a/third_party/nixpkgs/nixos/modules/services/networking/bird.nix
+++ b/third_party/nixpkgs/nixos/modules/services/networking/bird.nix
@@ -31,7 +31,23 @@ let
             default = true;
             description = ''
               Whether the config should be checked at build time.
-              Disabling this might become necessary if the config includes files not present during build time.
+              When the config can't be checked during build time, for example when it includes
+              other files, either disable this option or use <code>preCheckConfig</code> to create
+              the included files before checking.
+            '';
+          };
+          preCheckConfig = mkOption {
+            type = types.lines;
+            default = "";
+            example = ''
+              echo "cost 100;" > include.conf
+            '';
+            description = ''
+              Commands to execute before the config file check. The file to be checked will be
+              available as <code>${variant}.conf</code> in the current directory.
+
+              Files created with this option will not be available at service runtime, only during
+              build time checking.
             '';
           };
         };
@@ -45,7 +61,9 @@ let
           name = "${variant}.conf";
           text = cfg.config;
           checkPhase = optionalString cfg.checkConfig ''
-            ${pkg}/bin/${birdBin} -d -p -c $out
+            ln -s $out ${variant}.conf
+            ${cfg.preCheckConfig}
+            ${pkg}/bin/${birdBin} -d -p -c ${variant}.conf
           '';
         };
 
diff --git a/third_party/nixpkgs/nixos/modules/services/security/tor.nix b/third_party/nixpkgs/nixos/modules/services/security/tor.nix
index f3ed1d160e..cafb44e124 100644
--- a/third_party/nixpkgs/nixos/modules/services/security/tor.nix
+++ b/third_party/nixpkgs/nixos/modules/services/security/tor.nix
@@ -794,6 +794,11 @@ in
               };
             }));
           };
+          options.ShutdownWaitLength = mkOption {
+            type = types.int;
+            default = 30;
+            description = descriptionGeneric "ShutdownWaitLength";
+          };
           options.SocksPolicy = optionStrings "SocksPolicy" // {
             example = ["accept *:*"];
           };
@@ -977,7 +982,7 @@ in
         ExecStart = "${cfg.package}/bin/tor -f ${torrc}";
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
         KillSignal = "SIGINT";
-        TimeoutSec = 30;
+        TimeoutSec = cfg.settings.ShutdownWaitLength + 30; # Wait a bit longer than ShutdownWaitLength before actually timing out
         Restart = "on-failure";
         LimitNOFILE = 32768;
         RuntimeDirectory = [
diff --git a/third_party/nixpkgs/nixos/modules/system/activation/top-level.nix b/third_party/nixpkgs/nixos/modules/system/activation/top-level.nix
index 8e53ec1ffa..18ac717f5d 100644
--- a/third_party/nixpkgs/nixos/modules/system/activation/top-level.nix
+++ b/third_party/nixpkgs/nixos/modules/system/activation/top-level.nix
@@ -55,8 +55,8 @@ let
       substituteInPlace $out/dry-activate --subst-var out
       chmod u+x $out/activate $out/dry-activate
       unset activationScript dryActivationScript
-      ${pkgs.stdenv.shell} -n $out/activate
-      ${pkgs.stdenv.shell} -n $out/dry-activate
+      ${pkgs.stdenv.shellDryRun} $out/activate
+      ${pkgs.stdenv.shellDryRun} $out/dry-activate
 
       cp ${config.system.build.bootStage2} $out/init
       substituteInPlace $out/init --subst-var-by systemConfig $out
@@ -109,9 +109,7 @@ let
     utillinux = pkgs.util-linux;
 
     kernelParams = config.boot.kernelParams;
-    installBootLoader =
-      config.system.build.installBootLoader
-      or "echo 'Warning: do not know how to make this configuration bootable; please enable a boot loader.' 1>&2; true";
+    installBootLoader = config.system.build.installBootLoader;
     activationScript = config.system.activationScripts.script;
     dryActivationScript = config.system.dryActivationScript;
     nixosLabel = config.system.nixos.label;
@@ -135,25 +133,27 @@ let
       pkgs.replaceDependency { inherit oldDependency newDependency drv; }
     ) baseSystemAssertWarn config.system.replaceRuntimeDependencies;
 
+  /* Workaround until https://github.com/NixOS/nixpkgs/pull/156533
+     Call can be replaced by argument when that's merged.
+  */
+  tmpFixupSubmoduleBoundary = subopts:
+    lib.mkOption {
+      type = lib.types.submoduleWith {
+        modules = [ { options = subopts; } ];
+      };
+    };
+
 in
 
 {
   imports = [
+    ../build.nix
     (mkRemovedOptionModule [ "nesting" "clone" ] "Use `specialisation.«name» = { inheritParentConfig = true; configuration = { ... }; }` instead.")
     (mkRemovedOptionModule [ "nesting" "children" ] "Use `specialisation.«name».configuration = { ... }` instead.")
   ];
 
   options = {
 
-    system.build = mkOption {
-      internal = true;
-      default = {};
-      type = with types; lazyAttrsOf (uniq unspecified);
-      description = ''
-        Attribute set of derivations used to setup the system.
-      '';
-    };
-
     specialisation = mkOption {
       default = {};
       example = lib.literalExpression "{ fewJobsManyCores.configuration = { nix.buildCores = 0; nix.maxJobs = 1; }; }";
@@ -224,6 +224,39 @@ in
       '';
     };
 
+    system.build = tmpFixupSubmoduleBoundary {
+      installBootLoader = mkOption {
+        internal = true;
+        # "; true" => make the `$out` argument from switch-to-configuration.pl
+        #             go to `true` instead of `echo`, hiding the useless path
+        #             from the log.
+        default = "echo 'Warning: do not know how to make this configuration bootable; please enable a boot loader.' 1>&2; true";
+        description = ''
+          A program that writes a bootloader installation script to the path passed in the first command line argument.
+
+          See <literal>nixos/modules/system/activation/switch-to-configuration.pl</literal>.
+        '';
+        type = types.unique {
+          message = ''
+            Only one bootloader can be enabled at a time. This requirement has not
+            been checked until NixOS 22.05. Earlier versions defaulted to the last
+            definition. Change your configuration to enable only one bootloader.
+          '';
+        } (types.either types.str types.package);
+      };
+
+      toplevel = mkOption {
+        type = types.package;
+        readOnly = true;
+        description = ''
+          This option contains the store path that typically represents a NixOS system.
+
+          You can read this path in a custom deployment tool for example.
+        '';
+      };
+    };
+
+
     system.copySystemConfiguration = mkOption {
       type = types.bool;
       default = false;
diff --git a/third_party/nixpkgs/nixos/modules/system/boot/systemd.nix b/third_party/nixpkgs/nixos/modules/system/boot/systemd.nix
index ec5dea075b..76c59c047e 100644
--- a/third_party/nixpkgs/nixos/modules/system/boot/systemd.nix
+++ b/third_party/nixpkgs/nixos/modules/system/boot/systemd.nix
@@ -210,20 +210,14 @@ let
   makeJobScript = name: text:
     let
       scriptName = replaceChars [ "\\" "@" ] [ "-" "_" ] (shellEscape name);
-      out = pkgs.writeTextFile {
+      out = (pkgs.writeShellScriptBin scriptName ''
+        set -e
+        ${text}
+      '').overrideAttrs (_: {
         # The derivation name is different from the script file name
         # to keep the script file name short to avoid cluttering logs.
         name = "unit-script-${scriptName}";
-        executable = true;
-        destination = "/bin/${scriptName}";
-        text = ''
-          #!${pkgs.runtimeShell} -e
-          ${text}
-        '';
-        checkPhase = ''
-          ${pkgs.stdenv.shell} -n "$out/bin/${scriptName}"
-        '';
-      };
+      });
     in "${out}/bin/${scriptName}";
 
   unitConfig = { config, options, ... }: {
diff --git a/third_party/nixpkgs/nixos/modules/system/build.nix b/third_party/nixpkgs/nixos/modules/system/build.nix
new file mode 100644
index 0000000000..58dc3f0d41
--- /dev/null
+++ b/third_party/nixpkgs/nixos/modules/system/build.nix
@@ -0,0 +1,21 @@
+{ lib, ... }:
+let
+  inherit (lib) mkOption types;
+in
+{
+  options = {
+
+    system.build = mkOption {
+      default = {};
+      description = ''
+        Attribute set of derivations used to set up the system.
+      '';
+      type = types.submoduleWith {
+        modules = [{
+          freeformType = with types; lazyAttrsOf (uniq unspecified);
+        }];
+      };
+    };
+
+  };
+}
diff --git a/third_party/nixpkgs/nixos/tests/all-tests.nix b/third_party/nixpkgs/nixos/tests/all-tests.nix
index 2f6e1dc989..62bc8acef6 100644
--- a/third_party/nixpkgs/nixos/tests/all-tests.nix
+++ b/third_party/nixpkgs/nixos/tests/all-tests.nix
@@ -46,6 +46,7 @@ in
   beanstalkd = handleTest ./beanstalkd.nix {};
   bees = handleTest ./bees.nix {};
   bind = handleTest ./bind.nix {};
+  bird = handleTest ./bird.nix {};
   bitcoind = handleTest ./bitcoind.nix {};
   bittorrent = handleTest ./bittorrent.nix {};
   blockbook-frontend = handleTest ./blockbook-frontend.nix {};
diff --git a/third_party/nixpkgs/nixos/tests/bcachefs.nix b/third_party/nixpkgs/nixos/tests/bcachefs.nix
index 146225e72c..211195586e 100644
--- a/third_party/nixpkgs/nixos/tests/bcachefs.nix
+++ b/third_party/nixpkgs/nixos/tests/bcachefs.nix
@@ -18,13 +18,13 @@ import ./make-test-python.nix ({ pkgs, ... }: {
         "mkdir /tmp/mnt",
         "udevadm settle",
         "parted --script /dev/vdb mklabel msdos",
-        "parted --script /dev/vdb -- mkpart primary 1024M -1s",
+        "parted --script /dev/vdb -- mkpart primary 1024M 50% mkpart primary 50% -1s",
         "udevadm settle",
         # Due to #32279, we cannot use encryption for this test yet
-        # "echo password | bcachefs format --encrypted /dev/vdb1",
+        # "echo password | bcachefs format --encrypted --metadata_replicas 2 --label vtest /dev/vdb1 /dev/vdb2",
         # "echo password | bcachefs unlock /dev/vdb1",
-        "bcachefs format /dev/vdb1",
-        "mount -t bcachefs /dev/vdb1 /tmp/mnt",
+        "bcachefs format --metadata_replicas 2 --label vtest /dev/vdb1 /dev/vdb2",
+        "mount -t bcachefs /dev/vdb1:/dev/vdb2 /tmp/mnt",
         "udevadm settle",
         "bcachefs fs usage /tmp/mnt",
         "umount /tmp/mnt",
diff --git a/third_party/nixpkgs/nixos/tests/bird.nix b/third_party/nixpkgs/nixos/tests/bird.nix
new file mode 100644
index 0000000000..50d397be14
--- /dev/null
+++ b/third_party/nixpkgs/nixos/tests/bird.nix
@@ -0,0 +1,205 @@
+# This test does a basic functionality check for all bird variants and demonstrates a use
+# of the preCheckConfig option.
+
+{ system ? builtins.currentSystem
+, pkgs ? import ../.. { inherit system; config = { }; }
+}:
+
+let
+  inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
+  inherit (pkgs.lib) optionalString;
+
+  hostShared = hostId: { pkgs, ... }: {
+    virtualisation.vlans = [ 1 ];
+
+    environment.systemPackages = with pkgs; [ jq ];
+
+    networking = {
+      useNetworkd = true;
+      useDHCP = false;
+      firewall.enable = false;
+    };
+
+    systemd.network.networks."01-eth1" = {
+      name = "eth1";
+      networkConfig.Address = "10.0.0.${hostId}/24";
+    };
+  };
+
+  birdTest = v4:
+    let variant = "bird${optionalString (!v4) "6"}"; in
+    makeTest {
+      name = variant;
+
+      nodes.host1 = makeBirdHost variant "1";
+      nodes.host2 = makeBirdHost variant "2";
+
+      testScript = makeTestScript variant v4 (!v4);
+    };
+
+  bird2Test = makeTest {
+    name = "bird2";
+
+    nodes.host1 = makeBird2Host "1";
+    nodes.host2 = makeBird2Host "2";
+
+    testScript = makeTestScript "bird2" true true;
+  };
+
+  makeTestScript = variant: v4: v6: ''
+    start_all()
+
+    host1.wait_for_unit("${variant}.service")
+    host2.wait_for_unit("${variant}.service")
+
+    ${optionalString v4 ''
+    with subtest("Waiting for advertised IPv4 routes"):
+      host1.wait_until_succeeds("ip --json r | jq -e 'map(select(.dst == \"10.10.0.2\")) | any'")
+      host2.wait_until_succeeds("ip --json r | jq -e 'map(select(.dst == \"10.10.0.1\")) | any'")
+    ''}
+    ${optionalString v6 ''
+    with subtest("Waiting for advertised IPv6 routes"):
+      host1.wait_until_succeeds("ip --json -6 r | jq -e 'map(select(.dst == \"fdff::2\")) | any'")
+      host2.wait_until_succeeds("ip --json -6 r | jq -e 'map(select(.dst == \"fdff::1\")) | any'")
+    ''}
+
+    with subtest("Check fake routes in preCheckConfig do not exists"):
+      ${optionalString v4 ''host1.fail("ip --json r | jq -e 'map(select(.dst == \"1.2.3.4\")) | any'")''}
+      ${optionalString v4 ''host2.fail("ip --json r | jq -e 'map(select(.dst == \"1.2.3.4\")) | any'")''}
+
+      ${optionalString v6 ''host1.fail("ip --json -6 r | jq -e 'map(select(.dst == \"fd00::\")) | any'")''}
+      ${optionalString v6 ''host2.fail("ip --json -6 r | jq -e 'map(select(.dst == \"fd00::\")) | any'")''}
+  '';
+
+  makeBirdHost = variant: hostId: { pkgs, ... }: {
+    imports = [ (hostShared hostId) ];
+
+    services.${variant} = {
+      enable = true;
+
+      config = ''
+        log syslog all;
+
+        debug protocols all;
+
+        router id 10.0.0.${hostId};
+
+        protocol device {
+        }
+
+        protocol kernel {
+          import none;
+          export all;
+        }
+
+        protocol static {
+          include "static.conf";
+        }
+
+        protocol ospf {
+          export all;
+          area 0 {
+            interface "eth1" {
+              hello 5;
+              wait 5;
+            };
+          };
+        }
+      '';
+
+      preCheckConfig =
+        let
+          route = { bird = "1.2.3.4/32"; bird6 = "fd00::/128"; }.${variant};
+        in
+        ''echo "route ${route} blackhole;" > static.conf'';
+    };
+
+    systemd.tmpfiles.rules =
+      let
+        route = { bird = "10.10.0.${hostId}/32"; bird6 = "fdff::${hostId}/128"; }.${variant};
+      in
+      [ "f /etc/bird/static.conf - - - - route ${route} blackhole;" ];
+  };
+
+  makeBird2Host = hostId: { pkgs, ... }: {
+    imports = [ (hostShared hostId) ];
+
+    services.bird2 = {
+      enable = true;
+
+      config = ''
+        log syslog all;
+
+        debug protocols all;
+
+        router id 10.0.0.${hostId};
+
+        protocol device {
+        }
+
+        protocol kernel kernel4 {
+          ipv4 {
+            import none;
+            export all;
+          };
+        }
+
+        protocol static static4 {
+          ipv4;
+          include "static4.conf";
+        }
+
+        protocol ospf v2 ospf4 {
+          ipv4 {
+            export all;
+          };
+          area 0 {
+            interface "eth1" {
+              hello 5;
+              wait 5;
+            };
+          };
+        }
+
+        protocol kernel kernel6 {
+          ipv6 {
+            import none;
+            export all;
+          };
+        }
+
+        protocol static static6 {
+          ipv6;
+          include "static6.conf";
+        }
+
+        protocol ospf v3 ospf6 {
+          ipv6 {
+            export all;
+          };
+          area 0 {
+            interface "eth1" {
+              hello 5;
+              wait 5;
+            };
+          };
+        }
+      '';
+
+      preCheckConfig = ''
+        echo "route 1.2.3.4/32 blackhole;" > static4.conf
+        echo "route fd00::/128 blackhole;" > static6.conf
+      '';
+    };
+
+    systemd.tmpfiles.rules = [
+      "f /etc/bird/static4.conf - - - - route 10.10.0.${hostId}/32 blackhole;"
+      "f /etc/bird/static6.conf - - - - route fdff::${hostId}/128 blackhole;"
+    ];
+  };
+in
+{
+  bird = birdTest true;
+  bird6 = birdTest false;
+  bird2 = bird2Test;
+}
diff --git a/third_party/nixpkgs/nixos/tests/home-assistant.nix b/third_party/nixpkgs/nixos/tests/home-assistant.nix
index 1ab5755863..5b1c07c92d 100644
--- a/third_party/nixpkgs/nixos/tests/home-assistant.nix
+++ b/third_party/nixpkgs/nixos/tests/home-assistant.nix
@@ -49,6 +49,12 @@ in {
           payload_on = "let_there_be_light";
           payload_off = "off";
         }];
+        wake_on_lan = {};
+        switch = [{
+          platform = "wake_on_lan";
+          mac = "00:11:22:33:44:55";
+          host = "127.0.0.1";
+        }];
         # tests component-based capability assignment (CAP_NET_BIND_SERVICE)
         emulated_hue = {
           host_ip = "127.0.0.1";
@@ -99,6 +105,10 @@ in {
         print("\n### home-assistant.log ###\n")
         print(output_log + "\n")
 
+    # wait for home-assistant to fully boot
+    hass.sleep(30)
+    hass.wait_for_unit("home-assistant.service")
+
     with subtest("Check that no errors were logged"):
         assert "ERROR" not in output_log
 
diff --git a/third_party/nixpkgs/nixos/tests/mpd.nix b/third_party/nixpkgs/nixos/tests/mpd.nix
index 5c969fc9c9..52d9c7fd33 100644
--- a/third_party/nixpkgs/nixos/tests/mpd.nix
+++ b/third_party/nixpkgs/nixos/tests/mpd.nix
@@ -96,7 +96,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
     };
 
   testScript = ''
-    mpc = "${pkgs.mpc_cli}/bin/mpc --wait"
+    mpc = "${pkgs.mpc-cli}/bin/mpc --wait"
 
     # Connects to the given server and attempts to play a tune.
     def play_some_music(server):
diff --git a/third_party/nixpkgs/pkgs/applications/audio/clerk/default.nix b/third_party/nixpkgs/pkgs/applications/audio/clerk/default.nix
index ff9dca961a..fa64cd74e7 100644
--- a/third_party/nixpkgs/pkgs/applications/audio/clerk/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/clerk/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , makeWrapper
 , rofi
-, mpc_cli
+, mpc-cli
 , perl
 , util-linux
 , python3Packages
@@ -28,11 +28,24 @@ stdenv.mkDerivation {
 
   strictDeps = true;
 
-  installPhase = ''
-    DESTDIR=$out PREFIX=/ make install
-    wrapProgram $out/bin/clerk \
-      --prefix PATH : "${lib.makeBinPath [ rofi mpc_cli perl util-linux libnotify ]}"
-  '';
+  installPhase =
+    let
+      binPath = lib.makeBinPath [
+        libnotify
+        mpc-cli
+        perl
+        rofi
+        util-linux
+      ];
+    in
+      ''
+        runHook preInstall
+
+        DESTDIR=$out PREFIX=/ make install
+        wrapProgram $out/bin/clerk --prefix PATH : "${binPath}"
+
+        runHook postInstall
+      '';
 
   meta = with lib; {
     description = "An MPD client built on top of rofi";
diff --git a/third_party/nixpkgs/pkgs/applications/audio/librespot/default.nix b/third_party/nixpkgs/pkgs/applications/audio/librespot/default.nix
index 64d59516f8..8772171c8c 100644
--- a/third_party/nixpkgs/pkgs/applications/audio/librespot/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/librespot/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, rustPlatform, pkg-config, openssl, withRodio ? true
+{ lib, stdenv, fetchFromGitHub, rustPlatform, pkg-config, openssl, withRodio ? true
 , withALSA ? true, alsa-lib ? null, withPulseAudio ? false, libpulseaudio ? null
 , withPortAudio ? false, portaudio ? null }:
 
@@ -35,5 +35,6 @@ rustPlatform.buildRustPackage rec {
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ bennofs ];
     platforms = platforms.unix;
+    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/librespot.x86_64-darwin
   };
 }
diff --git a/third_party/nixpkgs/pkgs/applications/audio/mpc/default.nix b/third_party/nixpkgs/pkgs/applications/audio/mpc/default.nix
index 0511367db3..cebf08f190 100644
--- a/third_party/nixpkgs/pkgs/applications/audio/mpc/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/mpc/default.nix
@@ -1,12 +1,14 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
+, installShellFiles
+, libiconv
+, libmpdclient
 , meson
 , ninja
 , pkg-config
-, libmpdclient
 , sphinx
-, libiconv
 }:
 
 stdenv.mkDerivation rec {
@@ -14,21 +16,47 @@ stdenv.mkDerivation rec {
   version = "0.34";
 
   src = fetchFromGitHub {
-    owner  = "MusicPlayerDaemon";
-    repo   = "mpc";
-    rev    = "v${version}";
-    sha256 = "sha256-2FjYBfak0IjibuU+CNQ0y9Ei8hTZhynS/BK2DNerhVw=";
+    owner = "MusicPlayerDaemon";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-2FjYBfak0IjibuU+CNQ0y9Ei8hTZhynS/BK2DNerhVw=";
   };
 
-  buildInputs = [ libmpdclient ] ++ lib.optionals stdenv.isDarwin [ libiconv ];
+  patches = [
+    # fix the build with meson 0.60 (https://github.com/MusicPlayerDaemon/mpc/pull/76)
+    (fetchpatch {
+      url = "https://github.com/MusicPlayerDaemon/mpc/commit/b656ca4b6c2a0d5b6cebd7f7daa679352f664e0e.patch";
+      sha256 = "sha256-fjjSlCKxgkz7Em08CaK7+JAzl8YTzLcpGGMz2HJlsVw=";
+    })
+  ];
 
-  nativeBuildInputs = [ meson ninja pkg-config sphinx ];
+  buildInputs = [
+    libmpdclient
+  ]
+  ++ lib.optionals stdenv.isDarwin [ libiconv ];
+
+  nativeBuildInputs = [
+    installShellFiles
+    meson
+    ninja
+    pkg-config
+    sphinx
+  ];
+
+  postInstall = ''
+    installShellCompletion --cmd mpc --bash $out/share/doc/mpc/contrib/mpc-completion.bash
+  '';
+
+  postFixup = ''
+    rm $out/share/doc/mpc/contrib/mpc-completion.bash
+  '';
 
   meta = with lib; {
-    description = "A minimalist command line interface to MPD";
     homepage = "https://www.musicpd.org/clients/mpc/";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ algorith ];
-    platforms = with platforms; linux ++ darwin;
+    description = "A minimalist command line interface to MPD";
+    changelog = "https://raw.githubusercontent.com/MusicPlayerDaemon/mpc/v${version}/NEWS";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ AndersonTorres ];
+    platforms = with platforms; unix;
   };
 }
diff --git a/third_party/nixpkgs/pkgs/applications/audio/parlatype/default.nix b/third_party/nixpkgs/pkgs/applications/audio/parlatype/default.nix
index 7b448cc69a..c1bb1102bf 100644
--- a/third_party/nixpkgs/pkgs/applications/audio/parlatype/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/parlatype/default.nix
@@ -40,8 +40,6 @@ stdenv.mkDerivation rec {
     hicolor-icon-theme
   ];
 
-  mesonFlags = [ "-Dlibreoffice=false" ];
-
   postPatch = ''
     chmod +x data/meson_post_install.py
     patchShebangs data/meson_post_install.py
diff --git a/third_party/nixpkgs/pkgs/applications/audio/shortwave/default.nix b/third_party/nixpkgs/pkgs/applications/audio/shortwave/default.nix
index 0f4ffa1422..49492d05d1 100644
--- a/third_party/nixpkgs/pkgs/applications/audio/shortwave/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/shortwave/default.nix
@@ -80,6 +80,7 @@ stdenv.mkDerivation rec {
       desktop. It is the successor to the older Gradio application.
     '';
     maintainers = with maintainers; [ lasandell ];
+    broken = true; # incompatible with latest libadwaita
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
   };
diff --git a/third_party/nixpkgs/pkgs/applications/audio/squishyball/default.nix b/third_party/nixpkgs/pkgs/applications/audio/squishyball/default.nix
index b44efc1534..4a7f819e29 100644
--- a/third_party/nixpkgs/pkgs/applications/audio/squishyball/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/squishyball/default.nix
@@ -16,8 +16,6 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ flac libao libvorbis ncurses opusfile ];
 
-  NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS";
-
   patches = [ ./gnu-screen.patch ];
 
   postInstall = ''
diff --git a/third_party/nixpkgs/pkgs/applications/audio/zrythm/default.nix b/third_party/nixpkgs/pkgs/applications/audio/zrythm/default.nix
index 8963cff4d1..70b7fbb745 100644
--- a/third_party/nixpkgs/pkgs/applications/audio/zrythm/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/zrythm/default.nix
@@ -13,7 +13,6 @@
 , curl
 , dconf
 , libepoxy
-, ffmpeg
 , fftw
 , fftwFloat
 , flex
@@ -95,7 +94,6 @@ stdenv.mkDerivation rec {
     curl
     dconf
     libepoxy
-    ffmpeg
     fftw
     fftwFloat
     flex
@@ -133,10 +131,9 @@ stdenv.mkDerivation rec {
   ];
 
   mesonFlags = [
-    "-Denable_ffmpeg=true"
-    "-Denable_rtmidi=true"
-    "-Denable_rtaudio=true"
-    "-Denable_sdl=true"
+    "-Drtmidi=enabled"
+    "-Drtaudio=enabled"
+    "-Dsdl=enabled"
     "-Dcarla=enabled"
     "-Dmanpage=true"
     # "-Duser_manual=true" # needs sphinx-intl
diff --git a/third_party/nixpkgs/pkgs/applications/editors/gnome-builder/default.nix b/third_party/nixpkgs/pkgs/applications/editors/gnome-builder/default.nix
index d9092b5501..0e2ffe46d2 100644
--- a/third_party/nixpkgs/pkgs/applications/editors/gnome-builder/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/gnome-builder/default.nix
@@ -5,6 +5,7 @@
 , appstream-glib
 , desktop-file-utils
 , fetchurl
+, fetchpatch
 , flatpak
 , gnome
 , libgit2-glib
@@ -18,7 +19,7 @@
 , jsonrpc-glib
 , libdazzle
 , libpeas
-, libportal
+, libportal-gtk3
 , libxml2
 , meson
 , ninja
@@ -48,6 +49,15 @@ stdenv.mkDerivation rec {
     sha256 = "4iUPyOnp8gAsRS5ZUNgmhXNNPESAs1Fnq1CKyHAlCeE=";
   };
 
+  patches = [
+    # Fix build with latest libportal
+    # https://gitlab.gnome.org/GNOME/gnome-builder/-/merge_requests/486
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gnome-builder/-/commit/b3bfa0df53a3749c3b73cb6c4bad5cab3fa549a1.patch";
+      sha256 = "B/uCcYavFvOAPhLHZ4MRNENDd6VytILiGYwDZRUSxTE=";
+    })
+  ];
+
   nativeBuildInputs = [
     appstream-glib
     desktop-file-utils
@@ -69,7 +79,7 @@ stdenv.mkDerivation rec {
     glade
     libgit2-glib
     libpeas
-    libportal
+    libportal-gtk3
     vte
     gspell
     gtk3
diff --git a/third_party/nixpkgs/pkgs/applications/editors/neovim/default.nix b/third_party/nixpkgs/pkgs/applications/editors/neovim/default.nix
index 7cec102561..03cc0b35b8 100644
--- a/third_party/nixpkgs/pkgs/applications/editors/neovim/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/neovim/default.nix
@@ -113,8 +113,10 @@ in
       substituteInPlace src/nvim/CMakeLists.txt --replace "    util" ""
     '';
 
-    # For treesitter plugins, libstdc++.so.6 will be needed
-    NIX_LDFLAGS = [ "-lstdc++"];
+    # For treesitter plugins, libstdc++.so.6, or equivalent will be needed
+    NIX_LDFLAGS =
+      lib.optionals stdenv.cc.isGNU [ "-lstdc++"]
+      ++ lib.optionals stdenv.cc.isClang [ "-lc++" ];
 
     # export PATH=$PWD/build/bin:${PATH}
     shellHook=''
diff --git a/third_party/nixpkgs/pkgs/applications/editors/vim/common.nix b/third_party/nixpkgs/pkgs/applications/editors/vim/common.nix
index 42cae79928..51a9b9af5b 100644
--- a/third_party/nixpkgs/pkgs/applications/editors/vim/common.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/vim/common.nix
@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.2.3877";
+  version = "8.2.4186";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    sha256 = "sha256-NqTO2TdhOs63eP7CdWY9U9nbR7No3hqPV5rGhYF9arA=";
+    sha256 = "0g276mbmq69z7c4kgj59r0azxmx9ih2sd8v83dx2gfph6wgw65ph";
   };
 
   enableParallelBuilding = true;
diff --git a/third_party/nixpkgs/pkgs/applications/graphics/gcolor3/default.nix b/third_party/nixpkgs/pkgs/applications/graphics/gcolor3/default.nix
index 2771559416..63725b9743 100644
--- a/third_party/nixpkgs/pkgs/applications/graphics/gcolor3/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/graphics/gcolor3/default.nix
@@ -6,7 +6,7 @@
 , pkg-config
 , libxml2
 , gtk3
-, libportal
+, libportal-gtk3
 , wrapGAppsHook
 }:
 
@@ -33,12 +33,16 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     gtk3
-    libportal
+    libportal-gtk3
   ];
 
   postPatch = ''
     chmod +x meson_install.sh # patchShebangs requires executable file
     patchShebangs meson_install.sh
+
+    # https://gitlab.gnome.org/World/gcolor3/merge_requests/151
+    substituteInPlace meson.build --replace "dependency(${"\n"}  'libportal'" "dependency(${"\n"}  'libportal-gtk3'"
+    substituteInPlace src/gcolor3-color-selection.c --replace "libportal/portal-gtk3.h" "libportal-gtk3/portal-gtk3.h"
   '';
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/applications/graphics/graphicsmagick/default.nix b/third_party/nixpkgs/pkgs/applications/graphics/graphicsmagick/default.nix
index 268e59d910..fe387ddc27 100644
--- a/third_party/nixpkgs/pkgs/applications/graphics/graphicsmagick/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/graphics/graphicsmagick/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "graphicsmagick";
-  version = "1.3.36";
+  version = "1.3.37";
 
   src = fetchurl {
     url = "mirror://sourceforge/graphicsmagick/GraphicsMagick-${version}.tar.xz";
-    sha256 = "0ilg6fkppb4avzais1dvi3qf6ln7v3mzj7gjm83w7pwwfpg3ynsx";
+    sha256 = "sha256-kNwi8ae9JA5MkGWpQJYr8T2kPJm8w2yxEcw8Gg10d9Q=";
   };
 
   patches = [
diff --git a/third_party/nixpkgs/pkgs/applications/kde/kamoso.nix b/third_party/nixpkgs/pkgs/applications/kde/kamoso.nix
index 9baa06275a..c80ed0c511 100644
--- a/third_party/nixpkgs/pkgs/applications/kde/kamoso.nix
+++ b/third_party/nixpkgs/pkgs/applications/kde/kamoso.nix
@@ -34,7 +34,7 @@ mkDerivation {
   ];
 
   qtWrapperArgs = [
-    "--prefix GST_PLUGIN_PATH : ${lib.makeSearchPath "lib/gstreamer-1.0" gst}"
+    "--prefix GST_PLUGIN_PATH : ${lib.makeSearchPathOutput "lib" "lib/gstreamer-1.0" gst}"
   ];
 
   meta = {
diff --git a/third_party/nixpkgs/pkgs/applications/misc/iptsd/default.nix b/third_party/nixpkgs/pkgs/applications/misc/iptsd/default.nix
index 297ea6dc6a..7347c4b784 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/iptsd/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/iptsd/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
       --replace "install_dir: rulesdir" "install_dir: datadir" \
   '';
   mesonFlags = [
-    "-Dsystemd=true"
+    "-Dservice_manager=systemd"
     "-Dsample_config=false"
     "-Ddebug_tool=false"
   ];
diff --git a/third_party/nixpkgs/pkgs/applications/misc/metadata-cleaner/default.nix b/third_party/nixpkgs/pkgs/applications/misc/metadata-cleaner/default.nix
index f113eed155..4412af583b 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/metadata-cleaner/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/metadata-cleaner/default.nix
@@ -9,7 +9,7 @@
 , itstool
 , libadwaita
 , librsvg
-, meson_0_60
+, meson
 , ninja
 , pkg-config
 , poppler_gi
@@ -18,7 +18,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "metadata-cleaner";
-  version = "2.1.3";
+  version = "2.1.4";
 
   format = "other";
 
@@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "rmnvgr";
     repo = "metadata-cleaner";
     rev = "v${version}";
-    hash = "sha256-9sLjgqqQBXcudlBRmqAwWcWMUXoIUyAK272zaNKbJNY=";
+    hash = "sha256-46J0iLXzZX5tww4CK8WhrADql023rauO0fpW7Asn5ZY=";
   };
 
   nativeBuildInputs = [
@@ -35,7 +35,7 @@ python3.pkgs.buildPythonApplication rec {
     glib
     gtk4
     itstool
-    meson_0_60
+    meson
     ninja
     pkg-config
     wrapGAppsHook
diff --git a/third_party/nixpkgs/pkgs/applications/misc/mob/default.nix b/third_party/nixpkgs/pkgs/applications/misc/mob/default.nix
index 13e7c60f51..15a7275bd8 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/mob/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/mob/default.nix
@@ -9,13 +9,13 @@
 
 buildGoPackage rec {
   pname = "mob";
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "remotemobprogramming";
     repo = pname;
-    sha256 = "sha256-nf0FSaUi8qX1f4Luo0cP4ZLoOKbyvgmpilMOWXbzzIM=";
+    sha256 = "sha256-1yE3KFGY51m6OL4LYrz+BSCHQSnbQRSpB3EUqAzSr+M=";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/applications/misc/notejot/default.nix b/third_party/nixpkgs/pkgs/applications/misc/notejot/default.nix
index aad182bd18..2452544393 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/notejot/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/notejot/default.nix
@@ -17,21 +17,27 @@
 
 stdenv.mkDerivation rec {
   pname = "notejot";
-  version = "3.2.0";
+  version = "3.3.3"; # make sure to recheck src.rev
 
   src = fetchFromGitHub {
     owner = "lainsce";
     repo = pname;
-    rev = version;
-    hash = "sha256-WyW1tGhO3+OykNa8BRavi93cBMOSBJw0M+0bwQHJOjU=";
+    # Note from Fedora spec file:
+    # https://src.fedoraproject.org/rpms/notejot/blob/bbe621cef4d5a2c27eed029063b8e8cfd7c8d400/f/notejot.spec
+    # Upstream confusingly made several bugfix post-releases of version 3.3.3,
+    # tagged as 3.4.x, but with prominent notices like "This is still 3.3.3". We
+    # respect upstream’s wishes (and the version numbers inside the source tarball)
+    # by packaging these releases as 3.3.3 with appropriate snapshot info.
+    # https://github.com/lainsce/notejot/releases/tag/3.4.9
+    #
+    # Note that sometimes upstream don't update their version in meson.build
+    # (https://github.com/lainsce/notejot/issues/236), always follow the version
+    # from Fedora Rawhide.
+    # https://github.com/lainsce/notejot/blob/3.4.9/meson.build#L1
+    rev = "3.4.9";
+    hash = "sha256-42k9CAnXAb7Ic580SIa95MDCkCWtso1F+0eD69HX8WI=";
   };
 
-  patches = [
-    # build: use gtk4-update-icon-cache
-    # https://github.com/lainsce/notejot/pull/307
-    ./use-gtk4-update-icon-cache.patch
-  ];
-
   nativeBuildInputs = [
     meson
     ninja
diff --git a/third_party/nixpkgs/pkgs/applications/misc/notejot/use-gtk4-update-icon-cache.patch b/third_party/nixpkgs/pkgs/applications/misc/notejot/use-gtk4-update-icon-cache.patch
deleted file mode 100644
index 9431c43cef..0000000000
--- a/third_party/nixpkgs/pkgs/applications/misc/notejot/use-gtk4-update-icon-cache.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-diff --git a/build-aux/post_install.py b/build-aux/post_install.py
-index 1278304..fface6d 100644
---- a/build-aux/post_install.py
-+++ b/build-aux/post_install.py
-@@ -2,11 +2,13 @@
- import os
- import subprocess
- 
--schemadir = os.path.join(os.environ['MESON_INSTALL_PREFIX'], 'share', 'glib-2.0', 'schemas')
-+install_prefix = os.environ['MESON_INSTALL_PREFIX']
-+icondir = os.path.join(install_prefix, 'share', 'icons', 'hicolor')
-+schemadir = os.path.join(install_prefix, 'share', 'glib-2.0', 'schemas')
- 
- if not os.environ.get('DESTDIR'):
-     print('Compiling gsettings schemas…')
-     subprocess.call(['glib-compile-schemas', schemadir], shell=False)
- 
-     print('Rebuilding desktop icons cache...')
--    subprocess.call(['gtk-update-icon-cache', '/usr/share/icons/hicolor/'], shell=False)
-+    subprocess.call(['gtk4-update-icon-cache', '-qtf', icondir], shell=False)
diff --git a/third_party/nixpkgs/pkgs/applications/misc/nwg-wrapper/default.nix b/third_party/nixpkgs/pkgs/applications/misc/nwg-wrapper/default.nix
index 770227186f..4e7f864f3e 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/nwg-wrapper/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/nwg-wrapper/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "nwg-wrapper";
-  version = "0.1.0";
+  version = "0.1.2";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0xkxyfbj8zljx7k5wbniz3x9jg0l4jnbbjv8hy5y5p4l10m0vpjs";
+    sha256 = "114y55mv2rgnp75a3c7rk46v5v84d1zqb6wkha7x16ab6xa9phzl";
   };
 
   nativeBuildInputs = [ gobject-introspection wrapGAppsHook ];
diff --git a/third_party/nixpkgs/pkgs/applications/misc/qt-video-wlr/default.nix b/third_party/nixpkgs/pkgs/applications/misc/qt-video-wlr/default.nix
index bdb434085d..ffd22be085 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/qt-video-wlr/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/qt-video-wlr/default.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchFromGitHub, pkg-config, meson, ninja, wayland, pixman, cairo, librsvg, wayland-protocols, wlroots, libxkbcommon, gst_all_1, wrapQtAppsHook, qtbase, qtmultimedia }:
 let
- gstreamerPath = with gst_all_1; lib.makeSearchPath "lib/gstreamer-1.0" [
+ gstreamerPath = with gst_all_1; lib.makeSearchPathOutput "lib" "lib/gstreamer-1.0" [
      gstreamer
      gst-plugins-base
      gst-plugins-good
diff --git a/third_party/nixpkgs/pkgs/applications/networking/blocky/default.nix b/third_party/nixpkgs/pkgs/applications/networking/blocky/default.nix
new file mode 100644
index 0000000000..8bc0963338
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/applications/networking/blocky/default.nix
@@ -0,0 +1,30 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+}:
+
+buildGoModule rec {
+  pname = "blocky";
+  version = "0.17";
+
+  src = fetchFromGitHub {
+    owner = "0xERR0R";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-vG6QAI8gBI2nLRQ0nOFWQHihyzgmJu69rgkWlg3iW3E=";
+  };
+
+  # needs network connection and fails at
+  # https://github.com/0xERR0R/blocky/blob/development/resolver/upstream_resolver_test.go
+  doCheck = false;
+
+  vendorSha256 = "sha256-+mpNPDejK9Trhw41SUXJPL/OX5wQR0QfA2+BXSlE0Jk=";
+
+  meta = with lib; {
+    description = "Fast and lightweight DNS proxy as ad-blocker for local network with many features.";
+    homepage = "https://0xerr0r.github.io/blocky";
+    changelog = "https://github.com/0xERR0R/blocky/releases";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ ratsclub ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/applications/networking/browsers/nyxt/default.nix b/third_party/nixpkgs/pkgs/applications/networking/browsers/nyxt/default.nix
index 59bb2adbf5..ccbc7a8dc8 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/browsers/nyxt/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/browsers/nyxt/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     xclip notify-osd enchant
   ] ++ gstBuildInputs;
 
-  GST_PLUGIN_SYSTEM_PATH_1_0 = lib.concatMapStringsSep ":" (p: "${p}/lib/gstreamer-1.0") gstBuildInputs;
+  GST_PLUGIN_SYSTEM_PATH_1_0 = lib.makeSearchPathOutput "lib" "lib/gstreamer-1.0" gstBuildInputs;
 
   dontWrapGApps = true;
   installPhase = ''
diff --git a/third_party/nixpkgs/pkgs/applications/networking/cluster/istioctl/default.nix b/third_party/nixpkgs/pkgs/applications/networking/cluster/istioctl/default.nix
index 1340133e71..02ed9b96f5 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/cluster/istioctl/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/cluster/istioctl/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "istioctl";
-  version = "1.12.1";
+  version = "1.12.2";
 
   src = fetchFromGitHub {
     owner = "istio";
     repo = "istio";
     rev = version;
-    sha256 = "sha256-oMf60mxreBSlgxVInTFM8kozYVZz5RdgzV3rYUnadnA=";
+    sha256 = "sha256-6eVFyGVvOUr5RA5jeavKcLJedv4jOGXAg3aa4N3cNx8=";
   };
-  vendorSha256 = "sha256-e8qh8J745TXUo6c1uMS8GyawEG9YFlMYl/nHpWIFK1Q=";
+  vendorSha256 = "sha256-ie7XRu+2+NmhMNtJEL2OgZH6wuTPJX9O2+cZBnI04JA=";
 
   doCheck = false;
 
diff --git a/third_party/nixpkgs/pkgs/applications/networking/cluster/lens/default.nix b/third_party/nixpkgs/pkgs/applications/networking/cluster/lens/default.nix
index 985ae17632..a2f13fdf9c 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/cluster/lens/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/cluster/lens/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchurl, appimageTools }:
+{ lib, fetchurl, appimageTools, wrapGAppsHook, gsettings-desktop-schemas, gtk3 }:
 
 let
   pname = "lens";
@@ -19,6 +19,10 @@ let
 in appimageTools.wrapType2 {
   inherit name src;
 
+  profile = ''
+    export XDG_DATA_DIRS=${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_DATA_DIRS
+  '';
+
   extraInstallCommands =
     ''
       mv $out/bin/${name} $out/bin/${pname}
diff --git a/third_party/nixpkgs/pkgs/applications/networking/cluster/minikube/default.nix b/third_party/nixpkgs/pkgs/applications/networking/cluster/minikube/default.nix
index 453ecda478..9b40f636bc 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/cluster/minikube/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/cluster/minikube/default.nix
@@ -11,9 +11,9 @@
 
 buildGoModule rec {
   pname = "minikube";
-  version = "1.24.0";
+  version = "1.25.1";
 
-  vendorSha256 = "sha256-jFE4aHHgVmVcQu8eH97h9P3zchtmKv/KUIfv7f2ws3I=";
+  vendorSha256 = "sha256-MnyXePsnhb1Tl76uAtVW/DLacE0etXREGsapgNiZbMo=";
 
   doCheck = false;
 
@@ -21,7 +21,7 @@ buildGoModule rec {
     owner = "kubernetes";
     repo = "minikube";
     rev = "v${version}";
-    sha256 = "sha256-WW5VVjm7cq/3/RGiIE2nn8O+VK0RHCtKkrlboIzhqC4=";
+    sha256 = "sha256-pRNOVN9u27im9fkUawJYjuGHTW0N7L5oJa3fQ6DUO+4=";
   };
 
   nativeBuildInputs = [ installShellFiles pkg-config which ];
diff --git a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/kdeltachat/default.nix b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/kdeltachat/default.nix
index 133355e074..5fe90d50a3 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/kdeltachat/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/kdeltachat/default.nix
@@ -14,13 +14,13 @@
 
 mkDerivation rec {
   pname = "kdeltachat";
-  version = "unstable-2021-12-26";
+  version = "unstable-2022-01-02";
 
   src = fetchFromSourcehut {
     owner = "~link2xt";
     repo = "kdeltachat";
-    rev = "aabe9421cb26f8e2537d49df5392e428bca8d72d";
-    hash = "sha256-5ql4KGMie9EbhHbPSNHIUQrvNpO//WgpTDIK6ETwdkg=";
+    rev = "ec545c8208c870c44312558f91c79e6ffce4444e";
+    hash = "sha256-s/dJ2ahdUK7ODKsna+tl81e+VQLkCAELb/iEXf9WlIM=";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/applications/networking/irc/hexchat/default.nix b/third_party/nixpkgs/pkgs/applications/networking/irc/hexchat/default.nix
index 504481479e..fbe9971f1d 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/irc/hexchat/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/irc/hexchat/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  mesonFlags = [ "-Dwith-lua=lua" "-Dwith-text=true" ];
+  mesonFlags = [ "-Dwith-lua=lua" "-Dtext-frontend=true" ];
 
   postInstall = ''
     wrapProgram $out/bin/hexchat --prefix PYTHONPATH : "$PYTHONPATH"
diff --git a/third_party/nixpkgs/pkgs/applications/networking/irc/wraith/configure.patch b/third_party/nixpkgs/pkgs/applications/networking/irc/wraith/configure.patch
index e5fa2feb20..16e65be00a 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/irc/wraith/configure.patch
+++ b/third_party/nixpkgs/pkgs/applications/networking/irc/wraith/configure.patch
@@ -1,8 +1,8 @@
 --- a/configure
 +++ b/configure
-@@ -6029,53 +6029,8 @@
+@@ -6143,53 +6143,8 @@ rm -f confcache
+ #AC_CHECK_HEADERS(openssl/ssl.h openssl/crypto.h)
  #AC_CHECK_HEADERS(zlib.h)
- #EGG_CHECK_ZLIB
  
 -{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for path to OpenSSL" >&5
 -$as_echo_n "checking for path to OpenSSL... " >&6; }
diff --git a/third_party/nixpkgs/pkgs/applications/networking/irc/wraith/default.nix b/third_party/nixpkgs/pkgs/applications/networking/irc/wraith/default.nix
index 3b1fa79aa2..30aec18c10 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/irc/wraith/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/irc/wraith/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "wraith";
-  version = "1.4.7";
+  version = "1.4.10";
   src = fetchurl {
     url = "mirror://sourceforge/wraithbotpack/wraith-v${version}.tar.gz";
-    sha256 = "0h6liac5y7im0jfm2sj18mibvib7d1l727fjs82irsjj1v9kif3j";
+    sha256 = "1h8159g6wh1hi69cnhqkgwwwa95fa6z1zrzjl219mynbf6vjjzkw";
   };
   hardeningDisable = [ "format" ];
   buildInputs = [ openssl ];
diff --git a/third_party/nixpkgs/pkgs/applications/networking/irc/wraith/dlopen.patch b/third_party/nixpkgs/pkgs/applications/networking/irc/wraith/dlopen.patch
index bfc854ef9e..5bf11eb726 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/irc/wraith/dlopen.patch
+++ b/third_party/nixpkgs/pkgs/applications/networking/irc/wraith/dlopen.patch
@@ -1,15 +1,15 @@
 diff --git a/src/libcrypto.cc b/src/libcrypto.cc
-index 0339258..68746c8 100644
+index 5139f66..517103f 100644
 --- a/src/libcrypto.cc
 +++ b/src/libcrypto.cc
-@@ -95,17 +95,9 @@ int load_libcrypto() {
+@@ -100,17 +100,9 @@ int load_libcrypto() {
    }
  
    sdprintf("Loading libcrypto");
 +  dlerror(); // Clear Errors
 +  libcrypto_handle = dlopen("@openssl@/lib/libcrypto.so", RTLD_LAZY|RTLD_GLOBAL);
  
--  bd::Array<bd::String> libs_list(bd::String("libcrypto.so." SHLIB_VERSION_NUMBER " libcrypto.so libcrypto.so.0.9.8 libcrypto.so.7 libcrypto.so.6").split(' '));
+-  bd::Array<bd::String> libs_list(bd::String("libcrypto.so." SHLIB_VERSION_NUMBER " libcrypto.so libcrypto.so.1.1 libcrypto.so.1.0.0 libcrypto.so.0.9.8 libcrypto.so.10 libcrypto.so.9 libcrypto.so.8 libcrypto.so.7 libcrypto.so.6").split(' '));
 -
 -  for (size_t i = 0; i < libs_list.length(); ++i) {
 -    dlerror(); // Clear Errors
@@ -23,17 +23,17 @@ index 0339258..68746c8 100644
      fprintf(stderr, STR("Unable to find libcrypto\n"));
      return(1);
 diff --git a/src/libssl.cc b/src/libssl.cc
-index b432c7b..8940998 100644
+index 6010abc..86e29fc 100644
 --- a/src/libssl.cc
 +++ b/src/libssl.cc
-@@ -68,17 +68,9 @@ int load_libssl() {
+@@ -78,17 +78,9 @@ int load_libssl() {
    }
  
    sdprintf("Loading libssl");
 +  dlerror(); // Clear Errors
 +  libssl_handle = dlopen("@openssl@/lib/libssl.so", RTLD_LAZY);
  
--  bd::Array<bd::String> libs_list(bd::String("libssl.so." SHLIB_VERSION_NUMBER " libssl.so libssl.so.0.9.8 libssl.so.7 libssl.so.6").split(' '));
+-  bd::Array<bd::String> libs_list(bd::String("libssl.so." SHLIB_VERSION_NUMBER " libssl.so libssl.so.1.1 libssl.so.1.0.0 libssl.so.0.9.8 libssl.so.10 libssl.so.9 libssl.so.8 libssl.so.7 libssl.so.6").split(' '));
 -
 -  for (size_t i = 0; i < libs_list.length(); ++i) {
 -    dlerror(); // Clear Errors
diff --git a/third_party/nixpkgs/pkgs/applications/networking/mailreaders/alot/default.nix b/third_party/nixpkgs/pkgs/applications/networking/mailreaders/alot/default.nix
index 6de601348c..3d09711fb3 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/mailreaders/alot/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/mailreaders/alot/default.nix
@@ -1,16 +1,29 @@
-{ lib, python3, fetchFromGitHub, file, gnupg, gawk, notmuch, procps, withManpage ? false
+{ lib
+, python3
+, fetchFromGitHub
+, file
+, gnupg
+, gawk
+, notmuch
+, procps
+, withManpage ? false
 }:
 
 with python3.pkgs;
-
 let
   notmuch2 = callPackage ./notmuch.nix {
     inherit notmuch;
   };
-in buildPythonApplication rec {
+in
+buildPythonApplication rec {
   pname = "alot";
   version = "0.10";
-  outputs = [ "out" ] ++ lib.optional withManpage "man";
+
+  outputs = [
+    "out"
+  ] ++ lib.optional withManpage [
+    "man"
+  ];
 
   disabled = !isPy3k;
 
@@ -22,48 +35,63 @@ in buildPythonApplication rec {
   };
 
   postPatch = ''
-    substituteInPlace alot/settings/manager.py --replace /usr/share "$out/share"
+    substituteInPlace alot/settings/manager.py \
+      --replace /usr/share "$out/share"
   '';
 
   nativeBuildInputs = lib.optional withManpage sphinx;
 
   propagatedBuildInputs = [
-    notmuch2
-    urwid
-    urwidtrees
-    twisted
-    python_magic
     configobj
-    service-identity
     file
     gpgme
+    notmuch2
+    python_magic
+    service-identity
+    twisted
+    urwid
+    urwidtrees
   ];
 
-  postBuild = lib.optionalString withManpage "make -C docs man";
+  checkInputs = [
+    future
+    gawk
+    gnupg
+    mock
+    procps
+    pytestCheckHook
+  ];
+
+  postBuild = lib.optionalString withManpage [
+    "make -C docs man"
+  ];
 
-  checkInputs = [ gawk future mock gnupg procps pytestCheckHook ];
-  # some twisted tests need internet access
   disabledTests = [
+    # Some twisted tests need internet access
     "test_env_set"
     "test_no_spawn_no_stdin_attached"
+    # DatabaseLockedError
+    "test_save_named_query"
   ];
 
-  postInstall = let
-    completionPython = python.withPackages (ps: [ ps.configobj ]);
-  in lib.optionalString withManpage ''
-    mkdir -p $out/man
-    cp -r docs/build/man $out/man
-  ''
-  + ''
-    mkdir -p $out/share/{applications,alot}
-    cp -r extra/themes $out/share/alot
+  postInstall =
+    let
+      completionPython = python.withPackages (ps: [ ps.configobj ]);
+    in
+    lib.optionalString withManpage ''
+      mkdir -p $out/man
+      cp -r docs/build/man $out/man
+    ''
+    + ''
+      mkdir -p $out/share/{applications,alot}
+      cp -r extra/themes $out/share/alot
 
-    substituteInPlace extra/completion/alot-completion.zsh \
-      --replace "python3" "${completionPython.interpreter}"
-    install -D extra/completion/alot-completion.zsh $out/share/zsh/site-functions/_alot
+      substituteInPlace extra/completion/alot-completion.zsh \
+        --replace "python3" "${completionPython.interpreter}"
+      install -D extra/completion/alot-completion.zsh $out/share/zsh/site-functions/_alot
 
-    sed "s,/usr/bin,$out/bin,g" extra/alot.desktop > $out/share/applications/alot.desktop
-  '';
+      sed "s,/usr/bin,$out/bin,g" extra/alot.desktop > $out/share/applications/alot.desktop
+    '';
 
   meta = with lib; {
     homepage = "https://github.com/pazz/alot";
diff --git a/third_party/nixpkgs/pkgs/applications/networking/vnstat/default.nix b/third_party/nixpkgs/pkgs/applications/networking/vnstat/default.nix
index 77812f88ad..a40f4cb2f5 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/vnstat/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/vnstat/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vnstat";
-  version = "2.8";
+  version = "2.9";
 
   src = fetchFromGitHub {
     owner = "vergoh";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-r+dmsL3bPgCDdBje7uzg+ArhMkqj+R/hepNLMDqe350=";
+    sha256 = "sha256-AEpq3Pn/WUiPDxYk6WKb1Uur5tD+OBfFAzLUDWnZH/0=";
   };
 
   postPatch = ''
diff --git a/third_party/nixpkgs/pkgs/applications/office/gtg/default.nix b/third_party/nixpkgs/pkgs/applications/office/gtg/default.nix
index 4b9237d23c..6d536ea60a 100644
--- a/third_party/nixpkgs/pkgs/applications/office/gtg/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/office/gtg/default.nix
@@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, fetchpatch
 , meson
 , python3Packages
 , ninja
@@ -25,6 +26,13 @@ python3Packages.buildPythonApplication rec {
     sha256 = "0b2slm7kjq6q8c7v4m7aqc8m1ynjxn3bl7445srpv1xc0dilq403";
   };
 
+  patches = [
+    # fix build with meson 0.60 (https://github.com/getting-things-gnome/gtg/pull/729)
+    (fetchpatch {
+      url = "https://github.com/getting-things-gnome/gtg/commit/1809d10663ae3d8f69c04138b66f9b4e66ee14f6.patch";
+      sha256 = "sha256-bYr5PAsuvcSqTf0vaJj2APtuBrwHdhXJxtXoAb7CfGk=";
+    })
+  ];
 
   nativeBuildInputs = [
     meson
diff --git a/third_party/nixpkgs/pkgs/applications/science/logic/coq/default.nix b/third_party/nixpkgs/pkgs/applications/science/logic/coq/default.nix
index 12c455d2fc..6d38d2a650 100644
--- a/third_party/nixpkgs/pkgs/applications/science/logic/coq/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/logic/coq/default.nix
@@ -46,7 +46,7 @@ let
    "8.13.2".sha256     = "1884vbmwmqwn9ngibax6dhnqh4cc02l0s2ajc6jb1xgr0i60whjk";
    "8.14.0".sha256     = "04y2z0qyvag66zanfyc3f9agvmzbn4lsr0p1l7ck6yjhqx7vbm17";
    "8.14.1".sha256     = "0sx78pgx0qw8v7v2r32zzy3l161zipzq95iacda628girim7psnl";
-   "8.15+rc1".sha256   = "sha256:0v9vnx5z2mbsmhdx08rpg0n8jn0d82mimpghn55vkwsscxmcrgnm";
+   "8.15.0".sha256     = "sha256:1ma76wfrpfsl72yh10w1ys2a0vi0mdc2jc79kdc8nrmxkhpw1nxx";
   };
   releaseRev = v: "V${v}";
   fetched = import ../../../../build-support/coq/meta-fetch/default.nix
diff --git a/third_party/nixpkgs/pkgs/applications/science/logic/tamarin-prover/default.nix b/third_party/nixpkgs/pkgs/applications/science/logic/tamarin-prover/default.nix
index 76dc559cb7..08b8a681b2 100644
--- a/third_party/nixpkgs/pkgs/applications/science/logic/tamarin-prover/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/logic/tamarin-prover/default.nix
@@ -79,6 +79,8 @@ mkDerivation (common "tamarin-prover" src // {
     # so that the package can be used as a vim plugin to install syntax coloration
     install -Dt $out/share/vim-plugins/tamarin-prover/syntax/ etc/syntax/spthy.vim
     install etc/filetype.vim -D $out/share/vim-plugins/tamarin-prover/ftdetect/tamarin.vim
+    # Emacs SPTHY major mode
+    install -Dt $out/share/emacs/site-lisp etc/spthy-mode.el
   '';
 
   checkPhase = "./dist/build/tamarin-prover/tamarin-prover test";
diff --git a/third_party/nixpkgs/pkgs/applications/science/misc/cwltool/default.nix b/third_party/nixpkgs/pkgs/applications/science/misc/cwltool/default.nix
index 745a14e512..190ba1af23 100644
--- a/third_party/nixpkgs/pkgs/applications/science/misc/cwltool/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/misc/cwltool/default.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "cwltool";
-  version = "3.1.20220119140128";
+  version = "3.1.20220124184855";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "common-workflow-language";
     repo = pname;
     rev = version;
-    sha256 = "1jmrm0qrqgka79avc1kq63fgh20gx6g07fc8p3iih4k85vhdyl3f";
+    sha256 = "0b0mxminfijbi3d9sslhwhs8awnagdsx8d2wh9x9ipdpwipihpmb";
   };
 
   postPatch = ''
diff --git a/third_party/nixpkgs/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix b/third_party/nixpkgs/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix
index 2c130bf02d..70ff4a4555 100644
--- a/third_party/nixpkgs/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix
@@ -2,6 +2,7 @@
 , libX11, libXt, libXft, libXrender
 , ncurses, fontconfig, freetype
 , pkg-config, gdk-pixbuf, perl
+, libptytty
 , perlSupport      ? true
 , gdkPixbufSupport ? true
 , unicode3Support  ? true
@@ -9,7 +10,7 @@
 
 let
   pname = "rxvt-unicode";
-  version = "9.26";
+  version = "9.30";
   description = "A clone of the well-known terminal emulator rxvt";
 
   desktopItem = makeDesktopItem {
@@ -31,12 +32,13 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "http://dist.schmorp.de/rxvt-unicode/Attic/rxvt-unicode-${version}.tar.bz2";
-    sha256 = "12y9p32q0v7n7rhjla0j2g9d5rj2dmwk20c9yhlssaaxlawiccb4";
+    sha256 = "0badnkjsn3zps24r5iggj8k5v4f00npc77wqg92pcn1q5z8r677y";
   };
 
   buildInputs =
     [ libX11 libXt libXft ncurses  # required to build the terminfo file
       fontconfig freetype pkg-config libXrender
+      libptytty
     ] ++ optional perlSupport perl
       ++ optional gdkPixbufSupport gdk-pixbuf;
 
diff --git a/third_party/nixpkgs/pkgs/applications/version-management/commitizen/default.nix b/third_party/nixpkgs/pkgs/applications/version-management/commitizen/default.nix
new file mode 100644
index 0000000000..fddffe6d19
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/applications/version-management/commitizen/default.nix
@@ -0,0 +1,49 @@
+{ buildPythonApplication
+, lib
+, fetchFromGitHub
+, poetry
+, termcolor
+, questionary
+, colorama
+, decli
+, tomlkit
+, jinja2
+, pyyaml
+, argcomplete
+, typing-extensions
+}:
+
+buildPythonApplication rec {
+  pname = "commitizen";
+  version = "2.20.3";
+
+  src = fetchFromGitHub {
+    owner = "commitizen-tools";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-rAm2GTRxZIHQmn/FM0IwwH/2h+oOvzGmeVr5xkvD/zA=";
+  };
+
+  format = "pyproject";
+
+  nativeBuildInputs = [ poetry ];
+
+  propagatedBuildInputs = [
+    termcolor
+    questionary
+    colorama
+    decli
+    tomlkit
+    jinja2
+    pyyaml
+    argcomplete
+    typing-extensions
+  ];
+
+  meta = with lib; {
+    description = "Tool to create committing rules for projects, auto bump versions, and generate changelogs";
+    homepage = "https://github.com/commitizen-tools/commitizen";
+    license = licenses.mit;
+    maintainers = with maintainers; [ lovesegfault ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/applications/version-management/git-lfs/default.nix b/third_party/nixpkgs/pkgs/applications/version-management/git-lfs/default.nix
index c5422d9a6c..78a393eb5e 100644
--- a/third_party/nixpkgs/pkgs/applications/version-management/git-lfs/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/git-lfs/default.nix
@@ -19,6 +19,12 @@ buildGoPackage rec {
 
   subPackages = [ "." ];
 
+  preBuild = ''
+    pushd go/src/github.com/git-lfs/git-lfs
+      go generate ./commands
+    popd
+  '';
+
   postBuild = ''
     make -C go/src/${goPackagePath} man
   '';
diff --git a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/data.json b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/data.json
index 9216070016..7a00d41df0 100644
--- a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/data.json
+++ b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/data.json
@@ -1,14 +1,14 @@
 {
-  "version": "14.6.3",
-  "repo_hash": "sha256-M8A6ZF1t+N48OTBhVwvOweITmavrl9+Z1Yqw4lxLk38=",
-  "yarn_hash": "1kcjbf8xn3bwac2s9i2i7dpgbkwcjh09wvgbgysm5yffpdswg6nl",
+  "version": "14.7.0",
+  "repo_hash": "0jam4krhwkbri99642vz4gjlnr7zfgd6mq7pgjyf00f6pggvhq79",
+  "yarn_hash": "1cv3lxfw4i9snlw5x6bcip1n97wg72v5zpz9mjxdpzd2i1bwp6da",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v14.6.3-ee",
+  "rev": "v14.7.0-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "14.6.3",
-    "GITLAB_PAGES_VERSION": "1.49.0",
-    "GITLAB_SHELL_VERSION": "13.22.1",
-    "GITLAB_WORKHORSE_VERSION": "14.6.3"
+    "GITALY_SERVER_VERSION": "14.7.0",
+    "GITLAB_PAGES_VERSION": "1.51.0",
+    "GITLAB_SHELL_VERSION": "13.22.2",
+    "GITLAB_WORKHORSE_VERSION": "14.7.0"
   }
 }
diff --git a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/default.nix b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/default.nix
index c386add243..f53c693c90 100644
--- a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/default.nix
@@ -22,12 +22,6 @@ let
     gemset =
       let x = import (gemdir + "/gemset.nix");
       in x // {
-        # grpc expects the AR environment variable to contain `ar rpc`. See the
-        # discussion in nixpkgs #63056.
-        grpc = x.grpc // {
-          patches = [ ./fix-grpc-ar.patch ];
-          dontBuild = false;
-        };
         # the openssl needs the openssl include files
         openssl = x.openssl // {
           buildInputs = [ openssl ];
diff --git a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/fix-grpc-ar.patch b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/fix-grpc-ar.patch
deleted file mode 100644
index 9b95e668e0..0000000000
--- a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/fix-grpc-ar.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- a/src/ruby/ext/grpc/extconf.rb
-+++ b/src/ruby/ext/grpc/extconf.rb
-@@ -27,6 +27,7 @@ ENV['MACOSX_DEPLOYMENT_TARGET'] = '10.7'
- if ENV['AR'].nil? || ENV['AR'].size == 0
-     ENV['AR'] = RbConfig::CONFIG['AR'] + ' rcs'
- end
-+ENV['AR'] = ENV['AR'] + ' rcs'
- if ENV['CC'].nil? || ENV['CC'].size == 0
-     ENV['CC'] = RbConfig::CONFIG['CC']
- end
diff --git a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitaly/Gemfile b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitaly/Gemfile
index bec450d047..70dd9c594c 100644
--- a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitaly/Gemfile
+++ b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitaly/Gemfile
@@ -3,11 +3,11 @@ source 'https://rubygems.org'
 gem 'rugged', '~> 1.2'
 gem 'github-linguist', '~> 7.12', require: 'linguist'
 gem 'gitlab-markup', '~> 1.7.1'
-gem 'activesupport', '~> 6.1.4.1'
+gem 'activesupport', '~> 6.1.4.4'
 gem 'rdoc', '~> 6.0'
-gem 'gitlab-gollum-lib', '~> 4.2.7.10.gitlab.1', require: false
+gem 'gitlab-gollum-lib', '~> 4.2.7.10.gitlab.2', require: false
 gem 'gitlab-gollum-rugged_adapter', '~> 0.4.4.4.gitlab.1', require: false
-gem 'grpc', '~> 1.30.2'
+gem 'grpc', '~> 1.42.0' # keep in lock-step with grpc-tools
 gem 'sentry-raven', '~> 3.0', require: false
 gem 'faraday', '~> 1.0'
 gem 'rbtrace', require: false
@@ -19,7 +19,7 @@ gem 'gitlab-labkit', '~> 0.21.1'
 # This version needs to be in sync with GitLab CE/EE
 gem 'licensee', '~> 9.14.1'
 
-gem 'google-protobuf', '~> 3.17.0'
+gem 'google-protobuf', '~> 3.19.0'
 
 group :development, :test do
   gem 'rubocop', '~> 0.69', require: false
@@ -29,7 +29,7 @@ group :development, :test do
   gem 'factory_bot', require: false
   gem 'pry', '~> 0.12.2', require: false
 
-  gem 'grpc-tools', '= 1.30.2'
+  gem 'grpc-tools', '~> 1.42.0'
 end
 
 # Gems required in omnibus-gitlab pipeline
diff --git a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
index 415ca4b167..fd0dea027e 100644
--- a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
+++ b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
@@ -2,20 +2,20 @@ GEM
   remote: https://rubygems.org/
   specs:
     abstract_type (0.0.7)
-    actionpack (6.1.4.1)
-      actionview (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    actionpack (6.1.4.4)
+      actionview (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
       rack (~> 2.0, >= 2.0.9)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actionview (6.1.4.1)
-      activesupport (= 6.1.4.1)
+    actionview (6.1.4.4)
+      activesupport (= 6.1.4.4)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activesupport (6.1.4.1)
+    activesupport (6.1.4.4)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
@@ -54,13 +54,13 @@ GEM
       mini_mime (~> 1.0)
       rugged (>= 0.25.1)
     github-markup (1.7.0)
-    gitlab-gollum-lib (4.2.7.10.gitlab.1)
+    gitlab-gollum-lib (4.2.7.10.gitlab.2)
       gemojione (~> 3.2)
       github-markup (~> 1.6)
-      gitlab-gollum-rugged_adapter (~> 0.4.4.3.gitlab.1)
+      gitlab-gollum-rugged_adapter (~> 0.4.4.4.gitlab.1)
       nokogiri (>= 1.6.1, < 2.0)
       rouge (~> 3.1)
-      sanitize (~> 4.6.4)
+      sanitize (~> 6.0)
       stringex (~> 2.6)
     gitlab-gollum-rugged_adapter (0.4.4.4.gitlab.1)
       mime-types (>= 1.15)
@@ -81,27 +81,27 @@ GEM
       with_env (= 1.1.0)
       xml-simple (~> 1.1.5)
     gitlab-markup (1.7.1)
-    google-protobuf (3.17.3)
-    googleapis-common-protos-types (1.1.0)
+    google-protobuf (3.19.1)
+    googleapis-common-protos-types (1.3.0)
       google-protobuf (~> 3.14)
-    grpc (1.30.2)
-      google-protobuf (~> 3.12)
+    grpc (1.42.0)
+      google-protobuf (~> 3.18)
       googleapis-common-protos-types (~> 1.0)
-    grpc-tools (1.30.2)
-    i18n (1.8.10)
+    grpc-tools (1.42.0)
+    i18n (1.8.11)
       concurrent-ruby (~> 1.0)
     ice_nine (0.11.2)
     jaeger-client (1.1.0)
       opentracing (~> 0.3)
       thrift
-    json (2.5.1)
+    json (2.6.1)
     licensee (9.14.1)
       dotenv (~> 2.0)
       octokit (~> 4.17)
       reverse_markdown (~> 1.0)
       rugged (>= 0.24, < 2.0)
       thor (>= 0.19, < 2.0)
-    loofah (2.12.0)
+    loofah (2.13.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
     memoizable (0.4.2)
@@ -111,15 +111,13 @@ GEM
       mime-types-data (~> 3.2015)
     mime-types-data (3.2020.1104)
     mini_mime (1.0.2)
-    mini_portile2 (2.5.1)
-    minitest (5.14.4)
+    mini_portile2 (2.6.1)
+    minitest (5.15.0)
     msgpack (1.3.3)
     multipart-post (2.1.1)
-    nokogiri (1.11.7)
-      mini_portile2 (~> 2.5.0)
+    nokogiri (1.12.5)
+      mini_portile2 (~> 2.6.1)
       racc (~> 1.4)
-    nokogumbo (1.5.0)
-      nokogiri
     octokit (4.20.0)
       faraday (>= 0.9)
       sawyer (~> 0.8.0, >= 0.5.3)
@@ -139,7 +137,7 @@ GEM
       coderay (~> 1.1.0)
       method_source (~> 0.9.0)
     public_suffix (4.0.6)
-    racc (1.5.2)
+    racc (1.6.0)
     rack (2.2.3)
     rack-test (1.1.0)
       rack (>= 1.0, < 3)
@@ -158,8 +156,8 @@ GEM
     regexp_parser (1.8.1)
     reverse_markdown (1.4.0)
       nokogiri
-    rexml (3.2.4)
-    rouge (3.26.0)
+    rexml (3.2.5)
+    rouge (3.27.0)
     rspec (3.8.0)
       rspec-core (~> 3.8.0)
       rspec-expectations (~> 3.8.0)
@@ -193,10 +191,9 @@ GEM
     ruby-progressbar (1.10.1)
     rubyzip (2.3.2)
     rugged (1.2.0)
-    sanitize (4.6.6)
+    sanitize (6.0.0)
       crass (~> 1.0.2)
-      nokogiri (>= 1.4.4)
-      nokogumbo (~> 1.4)
+      nokogiri (>= 1.12.0)
     sawyer (0.8.2)
       addressable (>= 2.3.5)
       faraday (> 0.8, < 2.0)
@@ -222,24 +219,24 @@ GEM
     with_env (1.1.0)
     xml-simple (1.1.9)
       rexml
-    zeitwerk (2.4.2)
+    zeitwerk (2.5.3)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
-  activesupport (~> 6.1.4.1)
+  activesupport (~> 6.1.4.4)
   factory_bot
   faraday (~> 1.0)
   github-linguist (~> 7.12)
-  gitlab-gollum-lib (~> 4.2.7.10.gitlab.1)
+  gitlab-gollum-lib (~> 4.2.7.10.gitlab.2)
   gitlab-gollum-rugged_adapter (~> 0.4.4.4.gitlab.1)
   gitlab-labkit (~> 0.21.1)
   gitlab-license_finder
   gitlab-markup (~> 1.7.1)
-  google-protobuf (~> 3.17.0)
-  grpc (~> 1.30.2)
-  grpc-tools (= 1.30.2)
+  google-protobuf (~> 3.19.0)
+  grpc (~> 1.42.0)
+  grpc-tools (~> 1.42.0)
   licensee (~> 9.14.1)
   pry (~> 0.12.2)
   rbtrace
diff --git a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitaly/default.nix b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitaly/default.nix
index bfccaafbc2..e2c5a8757f 100644
--- a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitaly/default.nix
@@ -21,19 +21,9 @@ let
     inherit ruby;
     copyGemFiles = true;
     gemdir = ./.;
-    gemset =
-      let x = import (gemdir + "/gemset.nix");
-      in x // {
-        # grpc expects the AR environment variable to contain `ar rpc`. See the
-        # discussion in nixpkgs #63056.
-        grpc = x.grpc // {
-          patches = [ ../fix-grpc-ar.patch ];
-          dontBuild = false;
-        };
-      };
   };
 
-  version = "14.6.3";
+  version = "14.7.0";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/v${lib.versions.major version}";
 in
 
@@ -45,10 +35,10 @@ buildGoModule {
     owner = "gitlab-org";
     repo = "gitaly";
     rev = "v${version}";
-    sha256 = "sha256-b4gNIYMtwsV2qv3mjKYDnCCGGmQseoqaTGN7k9mR1B8=";
+    sha256 = "sha256-hOtdeJSjZLGcPCZpu42lGtCtQoLE0/AQqfQWLUJ6Hf8=";
   };
 
-  vendorSha256 = "sha256-ZLd4E3+e25Hqmd6ZyF3X6BveMEg7OF0FX9IvNBWn3v0=";
+  vendorSha256 = "sha256-eapqtSstc7d3R7A/5krKV0uVr9GhGkHHMrmsBOpWAbo=";
 
   passthru = {
     inherit rubyEnv;
diff --git a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitaly/gemset.nix b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
index 5e9efe0a82..9539139fe4 100644
--- a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
@@ -13,10 +13,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0xgysqnibjsy6kdz10x2xb3kwa6lssiqhh0zggrbgs31ypwhlpia";
+      sha256 = "171ida68hrk21cq1zz1kfl9h94a3qw5p3afviqzsirl0kx6qjyv9";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   actionview = {
     dependencies = ["activesupport" "builder" "erubi" "rails-dom-testing" "rails-html-sanitizer"];
@@ -24,10 +24,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1yf4ic5kl324rs0raralpwx24s6hvvdzxfhinafylf8f3x7jj23z";
+      sha256 = "1lm2pf35p6q4ff78z175h6ihmzfg2j7ssn41374rb9iy9gpiiidm";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   activesupport = {
     dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo" "zeitwerk"];
@@ -35,10 +35,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "19gx1jcq46x9d1pi1w8xq0bgvvfw239y4lalr8asm291gj3q3ds4";
+      sha256 = "0rvnz9lsf9mrkpji748sf51f54m027snkw6rm8flyvf7fq18rm98";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   adamantium = {
     dependencies = ["ice_nine" "memoizable"];
@@ -247,10 +247,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0r6smbqnh0m84fxwb2g11qjfbcsljfin4vhnf43nmmbql2l1i3ah";
+      sha256 = "1vs6frgnhhfnyicsjck39xibmn7xc6ji7wvznvfmr53f4smqjk40";
       type = "gem";
     };
-    version = "4.2.7.10.gitlab.1";
+    version = "4.2.7.10.gitlab.2";
   };
   gitlab-gollum-rugged_adapter = {
     dependencies = ["mime-types" "rugged"];
@@ -300,10 +300,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0vmll4nnkha3vsqj1g76pwni6x7mp2i81pka4wdwq8qfhn210108";
+      sha256 = "1dwx4ns39bpmzmhglyip9d68i117zspf5lp865pf6hrsmmdf2k53";
       type = "gem";
     };
-    version = "3.17.3";
+    version = "3.19.1";
   };
   googleapis-common-protos-types = {
     dependencies = ["google-protobuf"];
@@ -311,10 +311,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1949w1lcd3iyiy4n6zgnrhdp78k9khbh2pbkrpkv263bbpmw8llg";
+      sha256 = "0w860lqs5j6n58a8qn4wr16hp0qz7cq5h67dgma04gncjwqiyhf5";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.3.0";
   };
   grpc = {
     dependencies = ["google-protobuf" "googleapis-common-protos-types"];
@@ -322,20 +322,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1rsglf7ag17n465iff7vlw83pn2rpl4kv9sb1rpf17nx6xpi7yl5";
+      sha256 = "0jjq2ing7px4zvdrg9xcq5a9qsciq6g3v14n95a3d9n6cyg69lmk";
       type = "gem";
     };
-    version = "1.30.2";
+    version = "1.42.0";
   };
   grpc-tools = {
     groups = ["development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0k9zhsqhamp02ryzgfb4y2bbick151vlhrhj0kqbbz9lyhms0bd4";
+      sha256 = "0xipvw8zcm1c3pna6fgmy83x0yvffii8d7wafwcxmszxa647brw1";
       type = "gem";
     };
-    version = "1.30.2";
+    version = "1.42.0";
   };
   i18n = {
     dependencies = ["concurrent-ruby"];
@@ -343,10 +343,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0g2fnag935zn2ggm5cn6k4s4xvv53v2givj1j90szmvavlpya96a";
+      sha256 = "0vdd1kii40qhbr9n8qx71k2gskq6rkl8ygy8hw5hfj8bb5a364xf";
       type = "gem";
     };
-    version = "1.8.10";
+    version = "1.8.11";
   };
   ice_nine = {
     source = {
@@ -372,10 +372,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0lrirj0gw420kw71bjjlqkqhqbrplla61gbv1jzgsz6bv90qr3ci";
+      sha256 = "1z9grvjyfz16ag55hg522d3q4dh07hf391sf9s96npc0vfi85xkz";
       type = "gem";
     };
-    version = "2.5.1";
+    version = "2.6.1";
   };
   licensee = {
     dependencies = ["dotenv" "octokit" "reverse_markdown" "rugged" "thor"];
@@ -394,10 +394,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1nqcya57x2n58y1dify60i0dpla40n4yir928khp4nj5jrn9mgmw";
+      sha256 = "17rvbrqcci1579d7dpbsfmz1f9g7msk82lyh9ip5h29dkrnixcgg";
       type = "gem";
     };
-    version = "2.12.0";
+    version = "2.13.0";
   };
   memoizable = {
     dependencies = ["thread_safe"];
@@ -452,20 +452,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0xg1x4708a4pn2wk8qs2d8kfzzdyv9kjjachg2f1phsx62ap2rx2";
+      sha256 = "1lvxm91hi0pabnkkg47wh1siv56s6slm2mdq1idfm86dyfidfprq";
       type = "gem";
     };
-    version = "2.5.1";
+    version = "2.6.1";
   };
   minitest = {
     groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "19z7wkhg59y8abginfrm2wzplz7py3va8fyngiigngqvsws6cwgl";
+      sha256 = "06xf558gid4w8lwx13jwfdafsch9maz8m0g85wnfymqj63x5nbbd";
       type = "gem";
     };
-    version = "5.14.4";
+    version = "5.15.0";
   };
   msgpack = {
     groups = ["default"];
@@ -493,19 +493,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1vrn31385ix5k9b0yalnlzv360isv6dincbcvi8psllnwz4sjxj9";
+      sha256 = "1v02g7k7cxiwdcahvlxrmizn3avj2q6nsjccgilq1idc89cr081b";
       type = "gem";
     };
-    version = "1.11.7";
-  };
-  nokogumbo = {
-    dependencies = ["nokogiri"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "09qc1c7acv9qm48vk2kzvnrq4ij8jrql1cv33nmv2nwmlggy0jyj";
-      type = "gem";
-    };
-    version = "1.5.0";
+    version = "1.12.5";
   };
   octokit = {
     dependencies = ["faraday" "sawyer"];
@@ -611,10 +602,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "178k7r0xn689spviqzhvazzvxfq6fyjldxb3ywjbgipbfi4s8j1g";
+      sha256 = "0la56m0z26j3mfn1a9lf2l03qx1xifanndf9p3vx1azf6sqy7v9d";
       type = "gem";
     };
-    version = "1.5.2";
+    version = "1.6.0";
   };
   rack = {
     groups = ["default"];
@@ -720,24 +711,24 @@
     version = "1.4.0";
   };
   rexml = {
-    groups = ["default" "development" "test"];
+    groups = ["default" "development" "omnibus" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mkvkcw9fhpaizrhca0pdgjcrbns48rlz4g6lavl5gjjq3rk2sq3";
+      sha256 = "08ximcyfjy94pm1rhcx04ny1vx2sk0x4y185gzn86yfsbzwkng53";
       type = "gem";
     };
-    version = "3.2.4";
+    version = "3.2.5";
   };
   rouge = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0b4b300i3m4m4kw7w1n9wgxwy16zccnb7271miksyzd0wq5b9pm3";
+      sha256 = "0530ri0p60km0bg0ib6swkhfnas427cva7vcdmnwl8df52a10y1k";
       type = "gem";
     };
-    version = "3.26.0";
+    version = "3.27.0";
   };
   rspec = {
     dependencies = ["rspec-core" "rspec-expectations" "rspec-mocks"];
@@ -857,13 +848,15 @@
     version = "1.2.0";
   };
   sanitize = {
-    dependencies = ["crass" "nokogiri" "nokogumbo"];
+    dependencies = ["crass" "nokogiri"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0j4j2a2mkk1a70vbx959pvx0gvr1zb9snjwvsppwj28bp0p0b2bv";
+      sha256 = "1zq8pxmsd1abw18zz6mazsm2jfpwmbgdxbpawb7bmwvkb2c5yyc1";
       type = "gem";
     };
-    version = "4.6.6";
+    version = "6.0.0";
   };
   sawyer = {
     dependencies = ["addressable" "faraday"];
@@ -1001,9 +994,9 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1746czsjarixq0x05f7p3hpzi38ldg6wxnxxw74kbjzh1sdjgmpl";
+      sha256 = "0lmg9x683gr9mkrbq9df2m0zb0650mdfxqna0bs10js44inv7znx";
       type = "gem";
     };
-    version = "2.4.2";
+    version = "2.5.3";
   };
 }
diff --git a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
index f1df035ca2..9dabd7c949 100644
--- a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
@@ -2,12 +2,12 @@
 
 buildGoModule rec {
   pname = "gitlab-shell";
-  version = "13.22.1";
+  version = "13.22.2";
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${version}";
-    sha256 = "sha256-uqdKiBZ290mG0JNi17EjimfES6bN3q1hF6LXs3URTZ8=";
+    sha256 = "sha256-jAH/MKmCIybLXsypHehQJaKf+mK9ko5XqWoDH/XKE5w=";
   };
 
   buildInputs = [ ruby ];
diff --git a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
index 8e196e50d5..3b1bc8cb1b 100644
--- a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@@ -5,7 +5,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "14.6.3";
+  version = "14.7.0";
 
   src = fetchFromGitLab {
     owner = data.owner;
diff --git a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
index a28a05536f..aab373095f 100644
--- a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@@ -2,7 +2,7 @@
 
 source 'https://rubygems.org'
 
-gem 'rails', '~> 6.1.4.1'
+gem 'rails', '~> 6.1.4.4'
 
 gem 'bootsnap', '~> 1.9.1', require: false
 
@@ -50,7 +50,7 @@ gem 'omniauth-shibboleth', '~> 1.3.0'
 gem 'omniauth-twitter', '~> 1.4'
 gem 'omniauth_crowd', '~> 2.4.0'
 gem 'omniauth-authentiq', '~> 0.3.3'
-gem 'gitlab-omniauth-openid-connect', '~> 0.8.0', require: 'omniauth_openid_connect'
+gem 'gitlab-omniauth-openid-connect', '~> 0.9.0', require: 'omniauth_openid_connect'
 gem 'omniauth-salesforce', '~> 1.0.5'
 gem 'omniauth-atlassian-oauth2', '~> 0.2.0'
 gem 'rack-oauth2', '~> 1.16.0'
@@ -74,7 +74,7 @@ gem 'u2f', '~> 0.2.1'
 gem 'validates_hostname', '~> 1.0.11'
 gem 'rubyzip', '~> 2.0.0', require: 'zip'
 # GitLab Pages letsencrypt support
-gem 'acme-client', '~> 2.0', '>= 2.0.6'
+gem 'acme-client', '~> 2.0', '>= 2.0.9'
 
 # Browser detection
 gem 'browser', '~> 4.2'
@@ -98,10 +98,7 @@ gem 'rack-cors', '~> 1.0.6', require: 'rack/cors'
 
 # GraphQL API
 gem 'graphql', '~> 1.11.10'
-# NOTE: graphiql-rails v1.5+ doesn't work: https://gitlab.com/gitlab-org/gitlab/issues/31771
-# TODO: remove app/views/graphiql/rails/editors/show.html.erb when https://github.com/rmosolgo/graphiql-rails/pull/71 is released:
-# https://gitlab.com/gitlab-org/gitlab/issues/31747
-gem 'graphiql-rails', '~> 1.4.10'
+gem 'graphiql-rails', '~> 1.8'
 gem 'apollo_upload_server', '~> 2.1.0'
 gem 'graphql-docs', '~> 1.6.0', group: [:development, :test]
 gem 'graphlient', '~> 0.4.0' # Used by BulkImport feature (group::import)
@@ -149,6 +146,7 @@ gem 'aws-sdk-core', '~> 3'
 gem 'aws-sdk-cloudformation', '~> 1'
 gem 'aws-sdk-s3', '~> 1'
 gem 'faraday_middleware-aws-sigv4', '~>0.3.0'
+gem 'typhoeus', '~> 1.4.0' # Used with Elasticsearch to support http keep-alive connections
 
 # Markdown and HTML processing
 gem 'html-pipeline', '~> 2.13.2'
@@ -166,10 +164,10 @@ gem 'asciidoctor', '~> 2.0.10'
 gem 'asciidoctor-include-ext', '~> 0.3.1', require: false
 gem 'asciidoctor-plantuml', '~> 0.0.12'
 gem 'asciidoctor-kroki', '~> 0.5.0', require: false
-gem 'rouge', '~> 3.26.1'
+gem 'rouge', '~> 3.27.0'
 gem 'truncato', '~> 0.7.11'
 gem 'bootstrap_form', '~> 4.2.0'
-gem 'nokogiri', '~> 1.11.4'
+gem 'nokogiri', '~> 1.12'
 gem 'escape_utils', '~> 1.1'
 
 # Calendar rendering
@@ -193,12 +191,12 @@ end
 # State machine
 gem 'state_machines-activerecord', '~> 0.8.0'
 
-# Issue tags
-gem 'acts-as-taggable-on', '~> 8.1'
+# CI domain tags
+gem 'acts-as-taggable-on', '~> 9.0'
 
 # Background jobs
 gem 'sidekiq', '~> 6.3'
-gem 'sidekiq-cron', '~> 1.0'
+gem 'sidekiq-cron', '~> 1.2'
 gem 'redis-namespace', '~> 1.8.1'
 gem 'gitlab-sidekiq-fetcher', '0.8.0', require: 'sidekiq-reliable-fetch'
 
@@ -263,7 +261,7 @@ gem 'ruby-fogbugz', '~> 0.2.1'
 gem 'kubeclient', '~> 4.9.2'
 
 # Sanitize user input
-gem 'sanitize', '~> 5.2.1'
+gem 'sanitize', '~> 6.0'
 gem 'babosa', '~> 1.0.4'
 
 # Sanitizes SVG input
@@ -276,7 +274,7 @@ gem 'licensee', '~> 9.14.1'
 gem 'charlock_holmes', '~> 0.7.7'
 
 # Detect mime content type from content
-gem 'ruby-magic', '~> 0.4'
+gem 'ruby-magic', '~> 0.5'
 
 # Faster blank
 gem 'fast_blank'
@@ -312,7 +310,7 @@ gem 'pg_query', '~> 2.1'
 gem 'premailer-rails', '~> 1.10.3'
 
 # LabKit: Tracing and Correlation
-gem 'gitlab-labkit', '~> 0.21.1'
+gem 'gitlab-labkit', '~> 0.21.3'
 # Thrift is a dependency of gitlab-labkit, we want a version higher than 0.14.0
 # because of https://gitlab.com/gitlab-org/gitlab/-/issues/321900
 gem 'thrift', '>= 0.14.0'
@@ -394,8 +392,6 @@ group :development, :test do
 
   gem 'parallel', '~> 1.19', require: false
 
-  gem 'rblineprof', '~> 0.3.6', platform: :mri, require: false
-
   gem 'test_file_finder', '~> 0.1.3'
 end
 
@@ -443,7 +439,8 @@ end
 
 gem 'octokit', '~> 4.15'
 
-# https://gitlab.com/gitlab-org/gitlab/issues/207207
+# Updating this gem version here is deprecated. See:
+# https://docs.gitlab.com/ee/development/emails.html#mailroom-gem-updates
 gem 'gitlab-mail_room', '~> 0.0.9', require: 'mail_room'
 
 gem 'email_reply_trimmer', '~> 0.1'
@@ -483,14 +480,14 @@ end
 gem 'spamcheck', '~> 0.1.0'
 
 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 14.4.0.pre.rc43'
+gem 'gitaly', '~> 14.6.0.pre.rc1'
 
 # KAS GRPC protocol definitions
 gem 'kas-grpc', '~> 0.0.2'
 
-gem 'grpc', '~> 1.30.2'
+gem 'grpc', '~> 1.42.0'
 
-gem 'google-protobuf', '~> 3.17.1'
+gem 'google-protobuf', '~> 3.19.0'
 
 gem 'toml-rb', '~> 2.0'
 
diff --git a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
index 3bfd392aba..666a1e7d02 100644
--- a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@@ -2,72 +2,72 @@ GEM
   remote: https://rubygems.org/
   specs:
     RedCloth (4.3.2)
-    acme-client (2.0.6)
+    acme-client (2.0.9)
       faraday (>= 0.17, < 2.0.0)
-    actioncable (6.1.4.1)
-      actionpack (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    actioncable (6.1.4.4)
+      actionpack (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
-    actionmailbox (6.1.4.1)
-      actionpack (= 6.1.4.1)
-      activejob (= 6.1.4.1)
-      activerecord (= 6.1.4.1)
-      activestorage (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    actionmailbox (6.1.4.4)
+      actionpack (= 6.1.4.4)
+      activejob (= 6.1.4.4)
+      activerecord (= 6.1.4.4)
+      activestorage (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
       mail (>= 2.7.1)
-    actionmailer (6.1.4.1)
-      actionpack (= 6.1.4.1)
-      actionview (= 6.1.4.1)
-      activejob (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    actionmailer (6.1.4.4)
+      actionpack (= 6.1.4.4)
+      actionview (= 6.1.4.4)
+      activejob (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 2.0)
-    actionpack (6.1.4.1)
-      actionview (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    actionpack (6.1.4.4)
+      actionview (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
       rack (~> 2.0, >= 2.0.9)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actiontext (6.1.4.1)
-      actionpack (= 6.1.4.1)
-      activerecord (= 6.1.4.1)
-      activestorage (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    actiontext (6.1.4.4)
+      actionpack (= 6.1.4.4)
+      activerecord (= 6.1.4.4)
+      activestorage (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
       nokogiri (>= 1.8.5)
-    actionview (6.1.4.1)
-      activesupport (= 6.1.4.1)
+    actionview (6.1.4.4)
+      activesupport (= 6.1.4.4)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activejob (6.1.4.1)
-      activesupport (= 6.1.4.1)
+    activejob (6.1.4.4)
+      activesupport (= 6.1.4.4)
       globalid (>= 0.3.6)
-    activemodel (6.1.4.1)
-      activesupport (= 6.1.4.1)
-    activerecord (6.1.4.1)
-      activemodel (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    activemodel (6.1.4.4)
+      activesupport (= 6.1.4.4)
+    activerecord (6.1.4.4)
+      activemodel (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
     activerecord-explain-analyze (0.1.0)
       activerecord (>= 4)
       pg
-    activestorage (6.1.4.1)
-      actionpack (= 6.1.4.1)
-      activejob (= 6.1.4.1)
-      activerecord (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    activestorage (6.1.4.4)
+      actionpack (= 6.1.4.4)
+      activejob (= 6.1.4.4)
+      activerecord (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
       marcel (~> 1.0.0)
       mini_mime (>= 1.1.0)
-    activesupport (6.1.4.1)
+    activesupport (6.1.4.4)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
       tzinfo (~> 2.0)
       zeitwerk (~> 2.3)
-    acts-as-taggable-on (8.1.0)
-      activerecord (>= 5.0, < 6.2)
+    acts-as-taggable-on (9.0.0)
+      activerecord (>= 6.0, < 7.1)
     addressable (2.8.0)
       public_suffix (>= 2.0.2, < 5.0)
     aes_key_wrap (1.1.0)
@@ -117,14 +117,14 @@ GEM
       aws-sigv4 (~> 1.1)
     aws-sigv4 (1.2.1)
       aws-eventstream (~> 1, >= 1.0.2)
-    azure-storage-blob (2.0.1)
+    azure-storage-blob (2.0.3)
       azure-storage-common (~> 2.0)
-      nokogiri (~> 1.11.0.rc2)
-    azure-storage-common (2.0.2)
+      nokogiri (~> 1, >= 1.10.8)
+    azure-storage-common (2.0.4)
       faraday (~> 1.0)
-      faraday_middleware (~> 1.0.0.rc1)
+      faraday_middleware (~> 1.0, >= 1.0.0.rc1)
       net-http-persistent (~> 4.0)
-      nokogiri (~> 1.11.0.rc2)
+      nokogiri (~> 1, >= 1.10.8)
     babosa (1.0.4)
     backport (1.2.0)
     base32 (0.3.2)
@@ -232,7 +232,6 @@ GEM
       danger
       gitlab (~> 4.2, >= 4.2.0)
     database_cleaner (1.7.0)
-    debugger-ruby_core_source (1.3.8)
     deckar01-task_list (2.3.1)
       html-pipeline
     declarative (0.0.20)
@@ -326,8 +325,10 @@ GEM
     escape_utils (1.2.1)
     et-orbi (1.2.1)
       tzinfo
+    ethon (0.15.0)
+      ffi (>= 1.15.0)
     eventmachine (1.2.7)
-    excon (0.71.1)
+    excon (0.90.0)
     execjs (2.8.1)
     expression_parser (0.9.0)
     extended-markdown-filter (0.6.0)
@@ -443,7 +444,7 @@ GEM
       rails (>= 3.2.0)
     git (1.7.0)
       rchardet (~> 1.8)
-    gitaly (14.4.0.pre.rc43)
+    gitaly (14.6.0.pre.rc1)
       grpc (~> 1.0)
     github-markup (1.7.0)
     gitlab (4.16.1)
@@ -465,10 +466,10 @@ GEM
       fog-json (~> 1.2.0)
       mime-types
       ms_rest_azure (~> 0.12.0)
-    gitlab-labkit (0.21.1)
+    gitlab-labkit (0.21.3)
       actionpack (>= 5.0.0, < 7.0.0)
       activesupport (>= 5.0.0, < 7.0.0)
-      grpc (~> 1.30.2)
+      grpc (>= 1.37)
       jaeger-client (~> 1.1)
       opentracing (~> 0.4)
       pg_query (~> 2.1)
@@ -484,7 +485,7 @@ GEM
     gitlab-mail_room (0.0.9)
     gitlab-markup (1.8.0)
     gitlab-net-dns (0.9.1)
-    gitlab-omniauth-openid-connect (0.8.0)
+    gitlab-omniauth-openid-connect (0.9.1)
       addressable (~> 2.7)
       omniauth (~> 1.9)
       openid_connect (~> 1.2)
@@ -504,7 +505,7 @@ GEM
       omniauth (~> 1.3)
       pyu-ruby-sasl (>= 0.0.3.3, < 0.1)
       rubyntlm (~> 0.5)
-    globalid (0.5.2)
+    globalid (1.0.0)
       activesupport (>= 5.0)
     gon (6.4.0)
       actionpack (>= 3.0.20)
@@ -522,8 +523,8 @@ GEM
       signet (~> 0.12)
     google-cloud-env (1.5.0)
       faraday (>= 0.17.3, < 2.0)
-    google-protobuf (3.17.3)
-    googleapis-common-protos-types (1.1.0)
+    google-protobuf (3.19.1)
+    googleapis-common-protos-types (1.3.0)
       google-protobuf (~> 3.14)
     googleauth (0.14.0)
       faraday (>= 0.17.3, < 2.0)
@@ -552,7 +553,7 @@ GEM
     grape_logging (1.8.3)
       grape
       rack
-    graphiql-rails (1.4.10)
+    graphiql-rails (1.8.0)
       railties
       sprockets-rails
     graphlient (0.4.0)
@@ -571,8 +572,8 @@ GEM
       graphql (~> 1.6)
       html-pipeline (~> 2.8)
       sass (~> 3.4)
-    grpc (1.30.2)
-      google-protobuf (~> 3.12)
+    grpc (1.42.0)
+      google-protobuf (~> 3.18)
       googleapis-common-protos-types (~> 1.0)
     gssapi (1.2.0)
       ffi (>= 1.0.1)
@@ -732,7 +733,7 @@ GEM
     lumberjack (1.2.7)
     mail (2.7.1)
       mini_mime (>= 0.1.1)
-    marcel (1.0.1)
+    marcel (1.0.2)
     marginalia (1.10.0)
       actionpack (>= 2.3)
       activerecord (>= 2.3)
@@ -745,7 +746,7 @@ GEM
     mini_histogram (0.3.1)
     mini_magick (4.10.1)
     mini_mime (1.1.1)
-    mini_portile2 (2.5.3)
+    mini_portile2 (2.6.1)
     minitest (5.11.3)
     mixlib-cli (2.1.8)
     mixlib-config (3.0.9)
@@ -783,11 +784,9 @@ GEM
     netrc (0.11.0)
     nio4r (2.5.8)
     no_proxy_fix (0.1.2)
-    nokogiri (1.11.7)
-      mini_portile2 (~> 2.5.0)
+    nokogiri (1.12.5)
+      mini_portile2 (~> 2.6.1)
       racc (~> 1.4)
-    nokogumbo (2.0.2)
-      nokogiri (~> 1.8, >= 1.8.4)
     notiffany (0.1.3)
       nenv (~> 0.1)
       shellany (~> 0.0)
@@ -880,7 +879,7 @@ GEM
       nokogiri (>= 1.4.4)
       omniauth (~> 1.0)
     open4 (1.3.4)
-    openid_connect (1.2.0)
+    openid_connect (1.3.0)
       activemodel
       attr_required (>= 1.0.0)
       json-jwt (>= 1.5.0)
@@ -945,7 +944,7 @@ GEM
       puma (>= 2.7)
     pyu-ruby-sasl (0.0.3.3)
     raabro (1.1.6)
-    racc (1.5.2)
+    racc (1.6.0)
     rack (2.2.3)
     rack-accept (0.4.5)
       rack (>= 0.4)
@@ -964,20 +963,20 @@ GEM
     rack-test (1.1.0)
       rack (>= 1.0, < 3)
     rack-timeout (0.5.2)
-    rails (6.1.4.1)
-      actioncable (= 6.1.4.1)
-      actionmailbox (= 6.1.4.1)
-      actionmailer (= 6.1.4.1)
-      actionpack (= 6.1.4.1)
-      actiontext (= 6.1.4.1)
-      actionview (= 6.1.4.1)
-      activejob (= 6.1.4.1)
-      activemodel (= 6.1.4.1)
-      activerecord (= 6.1.4.1)
-      activestorage (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    rails (6.1.4.4)
+      actioncable (= 6.1.4.4)
+      actionmailbox (= 6.1.4.4)
+      actionmailer (= 6.1.4.4)
+      actionpack (= 6.1.4.4)
+      actiontext (= 6.1.4.4)
+      actionview (= 6.1.4.4)
+      activejob (= 6.1.4.4)
+      activemodel (= 6.1.4.4)
+      activerecord (= 6.1.4.4)
+      activestorage (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
       bundler (>= 1.15.0)
-      railties (= 6.1.4.1)
+      railties (= 6.1.4.4)
       sprockets-rails (>= 2.0.0)
     rails-controller-testing (1.0.5)
       actionpack (>= 5.0.1.rc1)
@@ -991,9 +990,9 @@ GEM
     rails-i18n (6.0.0)
       i18n (>= 0.7, < 2)
       railties (>= 6.0.0, < 7)
-    railties (6.1.4.1)
-      actionpack (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    railties (6.1.4.4)
+      actionpack (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
       method_source
       rake (>= 0.13)
       thor (~> 1.0)
@@ -1002,8 +1001,6 @@ GEM
     rb-fsevent (0.10.4)
     rb-inotify (0.10.1)
       ffi (~> 1.0)
-    rblineprof (0.3.6)
-      debugger-ruby_core_source (~> 1.3)
     rbtrace (0.4.14)
       ffi (>= 1.0.6)
       msgpack (>= 0.4.3)
@@ -1049,7 +1046,7 @@ GEM
     rexml (3.2.5)
     rinku (2.0.0)
     rotp (6.2.0)
-    rouge (3.26.1)
+    rouge (3.27.0)
     rqrcode (0.7.0)
       chunky_png
     rqrcode-rails3 (0.1.7)
@@ -1117,8 +1114,8 @@ GEM
       rubocop-ast (>= 0.7.1)
     ruby-fogbugz (0.2.1)
       crack (~> 0.4)
-    ruby-magic (0.4.0)
-      mini_portile2 (~> 2.5.0)
+    ruby-magic (0.5.3)
+      mini_portile2 (~> 2.6)
     ruby-prof (1.3.1)
     ruby-progressbar (1.11.0)
     ruby-saml (1.13.0)
@@ -1135,10 +1132,9 @@ GEM
     safe_yaml (1.0.4)
     safety_net_attestation (0.4.0)
       jwt (~> 2.0)
-    sanitize (5.2.1)
+    sanitize (6.0.0)
       crass (~> 1.0.2)
-      nokogiri (>= 1.8.0)
-      nokogumbo (~> 2.0)
+      nokogiri (>= 1.12.0)
     sass (3.5.5)
       sass-listen (~> 4.0.0)
     sass-listen (4.0.0)
@@ -1177,7 +1173,7 @@ GEM
       connection_pool (>= 2.2.2)
       rack (~> 2.0)
       redis (>= 4.2.0)
-    sidekiq-cron (1.0.4)
+    sidekiq-cron (1.2.0)
       fugit (~> 1.1)
       sidekiq (>= 4.2.1)
     signet (0.14.0)
@@ -1244,7 +1240,7 @@ GEM
       unicode-display_width (>= 1.5, < 3.0)
       unicode_utils (~> 1.4)
     strings-ansi (0.2.0)
-    swd (1.2.0)
+    swd (1.3.0)
       activesupport (>= 3)
       attr_required (>= 0.0.5)
       httpclient (>= 2.4)
@@ -1304,6 +1300,8 @@ GEM
       tty-screen (~> 0.8)
       wisper (~> 2.0)
     tty-screen (0.8.1)
+    typhoeus (1.4.0)
+      ethon (>= 0.9.0)
     tzinfo (2.0.4)
       concurrent-ruby (~> 1.0)
     u2f (0.2.1)
@@ -1351,7 +1349,7 @@ GEM
       safety_net_attestation (~> 0.4.0)
       securecompare (~> 1.0)
       tpm-key_attestation (~> 0.9.0)
-    webfinger (1.1.0)
+    webfinger (1.2.0)
       activesupport
       httpclient (>= 2.4)
     webmock (3.9.1)
@@ -1374,16 +1372,16 @@ GEM
       nokogiri (~> 1.8)
     yajl-ruby (1.4.1)
     yard (0.9.26)
-    zeitwerk (2.5.1)
+    zeitwerk (2.5.3)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
   RedCloth (~> 4.3.2)
-  acme-client (~> 2.0, >= 2.0.6)
+  acme-client (~> 2.0, >= 2.0.9)
   activerecord-explain-analyze (~> 0.1)
-  acts-as-taggable-on (~> 8.1)
+  acts-as-taggable-on (~> 9.0)
   addressable (~> 2.8)
   akismet (~> 3.0)
   apollo_upload_server (~> 2.1.0)
@@ -1465,36 +1463,36 @@ DEPENDENCIES
   gettext (~> 3.3)
   gettext_i18n_rails (~> 1.8.0)
   gettext_i18n_rails_js (~> 1.3)
-  gitaly (~> 14.4.0.pre.rc43)
+  gitaly (~> 14.6.0.pre.rc1)
   github-markup (~> 1.7.0)
   gitlab-chronic (~> 0.10.5)
   gitlab-dangerfiles (~> 2.6.1)
   gitlab-experiment (~> 0.6.5)
   gitlab-fog-azure-rm (~> 1.2.0)
-  gitlab-labkit (~> 0.21.1)
+  gitlab-labkit (~> 0.21.3)
   gitlab-license (~> 2.0)
   gitlab-license_finder (~> 6.0)
   gitlab-mail_room (~> 0.0.9)
   gitlab-markup (~> 1.8.0)
   gitlab-net-dns (~> 0.9.1)
-  gitlab-omniauth-openid-connect (~> 0.8.0)
+  gitlab-omniauth-openid-connect (~> 0.9.0)
   gitlab-sidekiq-fetcher (= 0.8.0)
   gitlab-styles (~> 6.6.0)
   gitlab_chronic_duration (~> 0.10.6.2)
   gitlab_omniauth-ldap (~> 2.1.1)
   gon (~> 6.4.0)
   google-api-client (~> 0.33)
-  google-protobuf (~> 3.17.1)
+  google-protobuf (~> 3.19.0)
   gpgme (~> 2.0.19)
   grape (~> 1.5.2)
   grape-entity (~> 0.10.0)
   grape-path-helpers (~> 1.7.0)
   grape_logging (~> 1.7)
-  graphiql-rails (~> 1.4.10)
+  graphiql-rails (~> 1.8)
   graphlient (~> 0.4.0)
   graphql (~> 1.11.10)
   graphql-docs (~> 1.6.0)
-  grpc (~> 1.30.2)
+  grpc (~> 1.42.0)
   gssapi
   guard-rspec
   haml_lint (~> 0.36.0)
@@ -1537,7 +1535,7 @@ DEPENDENCIES
   net-ldap (~> 0.16.3)
   net-ntp
   net-ssh (~> 6.0)
-  nokogiri (~> 1.11.4)
+  nokogiri (~> 1.12)
   oauth2 (~> 1.4)
   octokit (~> 4.15)
   ohai (~> 16.10)
@@ -1581,11 +1579,10 @@ DEPENDENCIES
   rack-oauth2 (~> 1.16.0)
   rack-proxy (~> 0.6.0)
   rack-timeout (~> 0.5.1)
-  rails (~> 6.1.4.1)
+  rails (~> 6.1.4.4)
   rails-controller-testing
   rails-i18n (~> 6.0)
   rainbow (~> 3.0)
-  rblineprof (~> 0.3.6)
   rbtrace (~> 0.4)
   rdoc (~> 6.3.2)
   re2 (~> 1.2.0)
@@ -1597,7 +1594,7 @@ DEPENDENCIES
   responders (~> 3.0)
   retriable (~> 3.1.2)
   rexml (~> 3.2.5)
-  rouge (~> 3.26.1)
+  rouge (~> 3.27.0)
   rqrcode-rails3 (~> 0.1.7)
   rspec-parameterized
   rspec-rails (~> 5.0.1)
@@ -1605,14 +1602,14 @@ DEPENDENCIES
   rspec_junit_formatter
   rspec_profiling (~> 0.0.6)
   ruby-fogbugz (~> 0.2.1)
-  ruby-magic (~> 0.4)
+  ruby-magic (~> 0.5)
   ruby-prof (~> 1.3.0)
   ruby-progressbar (~> 1.10)
   ruby-saml (~> 1.13.0)
   ruby_parser (~> 3.15)
   rubyzip (~> 2.0.0)
   rugged (~> 1.2)
-  sanitize (~> 5.2.1)
+  sanitize (~> 6.0)
   sassc-rails (~> 2.1.0)
   sd_notify (~> 0.1.0)
   seed-fu (~> 2.3.7)
@@ -1621,7 +1618,7 @@ DEPENDENCIES
   settingslogic (~> 2.0.9)
   shoulda-matchers (~> 4.0.1)
   sidekiq (~> 6.3)
-  sidekiq-cron (~> 1.0)
+  sidekiq-cron (~> 1.2)
   simple_po_parser (~> 1.1.2)
   simplecov (~> 0.18.5)
   simplecov-cobertura (~> 1.3.1)
@@ -1647,6 +1644,7 @@ DEPENDENCIES
   timecop (~> 0.9.1)
   toml-rb (~> 2.0)
   truncato (~> 0.7.11)
+  typhoeus (~> 1.4.0)
   u2f (~> 0.2.1)
   undercover (~> 0.4.4)
   unf (~> 0.1.4)
diff --git a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
index 3ee8ea0512..a74ca37e00 100644
--- a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
@@ -5,10 +5,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1nwkzjamvg946xh2pv82hkwxb7vqq6gakig014gflss0cwx7bbxp";
+      sha256 = "1c4g3rl1bvcb8frh5061hwaxkxglkj8i888j5gww5qapn5sp2czq";
       type = "gem";
     };
-    version = "2.0.6";
+    version = "2.0.9";
   };
   actioncable = {
     dependencies = ["actionpack" "activesupport" "nio4r" "websocket-driver"];
@@ -16,10 +16,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ilq5mniarm0zlvnkagqj9n9p73ljrhphciz02aymrpfxxxclz2x";
+      sha256 = "0z3ab9n901craqd3p1yl87kawci0vfw1xlh4d0zkj7lx8hpk10sn";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   actionmailbox = {
     dependencies = ["actionpack" "activejob" "activerecord" "activestorage" "activesupport" "mail"];
@@ -27,10 +27,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "16azdnjws215clb056b9mabglx4b8f61hr82hv7hm80dmn89zqq6";
+      sha256 = "0q94js7ifm0a76xcwxin98bhr8nz0zqcsqi4y7j2mfwm3hq3bh0i";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   actionmailer = {
     dependencies = ["actionpack" "actionview" "activejob" "activesupport" "mail" "rails-dom-testing"];
@@ -38,10 +38,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "00s07l2ac5igch1g2rpa0linmiq7mhgk6v6wxkckg8gbiqijb592";
+      sha256 = "1gncnc5xl1ff70mfnqcys2qy65201yjrkwxx0hb5hl7jlamgvz9h";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   actionpack = {
     dependencies = ["actionview" "activesupport" "rack" "rack-test" "rails-dom-testing" "rails-html-sanitizer"];
@@ -49,10 +49,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0xgysqnibjsy6kdz10x2xb3kwa6lssiqhh0zggrbgs31ypwhlpia";
+      sha256 = "171ida68hrk21cq1zz1kfl9h94a3qw5p3afviqzsirl0kx6qjyv9";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   actiontext = {
     dependencies = ["actionpack" "activerecord" "activestorage" "activesupport" "nokogiri"];
@@ -60,10 +60,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0m4fy4qqh09vnzbhx383vjdfid6fzbs49bzzg415x05nmmjkx582";
+      sha256 = "1j9591z8lsp9lx3l75699prw6rgkhhlrfaj4lh5klcdffvxzkvi3";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   actionview = {
     dependencies = ["activesupport" "builder" "erubi" "rails-dom-testing" "rails-html-sanitizer"];
@@ -71,10 +71,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1yf4ic5kl324rs0raralpwx24s6hvvdzxfhinafylf8f3x7jj23z";
+      sha256 = "1lm2pf35p6q4ff78z175h6ihmzfg2j7ssn41374rb9iy9gpiiidm";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   activejob = {
     dependencies = ["activesupport" "globalid"];
@@ -82,10 +82,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1q7c0i0kwarxgcbxk71wa9jnlg45grbxmhlrh7dk9bgcv7r7r7hn";
+      sha256 = "0sf0nfjcj1na4v6zaxz6hjglax99yznaymjzpk1fi7mk71qf5hx4";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   activemodel = {
     dependencies = ["activesupport"];
@@ -93,10 +93,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "16ixam4lni8b5lgx0whnax0imzh1dh10fy5r9pxs52n83yz5nbq3";
+      sha256 = "0g3qdz8dw6zkgz45jd13lwfdnm7rhgczv1pssw63g9k6qj3bkxjm";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   activerecord = {
     dependencies = ["activemodel" "activesupport"];
@@ -104,10 +104,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ccgvlj767ybps3pxlaa4iw77n7wbriw2sr8754id3ngjfap08ja";
+      sha256 = "090d4wl1pq06m9mibpck0m5nm8h45fwhs3fjx27297kjmnv4gzik";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   activerecord-explain-analyze = {
     dependencies = ["activerecord" "pg"];
@@ -126,10 +126,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "17knzz9fvqg4x582vy0xmlgjkxfb13xyzl2rgw19qfma86hxsvvi";
+      sha256 = "0a6mmm1s8abv11ycqs6cq55kr6j89jpclkcnra9w2k47rl047vk4";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   activesupport = {
     dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo" "zeitwerk"];
@@ -137,10 +137,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "19gx1jcq46x9d1pi1w8xq0bgvvfw239y4lalr8asm291gj3q3ds4";
+      sha256 = "0rvnz9lsf9mrkpji748sf51f54m027snkw6rm8flyvf7fq18rm98";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   acts-as-taggable-on = {
     dependencies = ["activerecord"];
@@ -148,10 +148,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0kfnyix173bazjswab21bx7hmqmik71awj2kz090fsa2nv58c4mw";
+      sha256 = "11hv6pdsr0kd9bmd84sab21sbm209ck1cwqs5jqbf9g1xbh9nh2s";
       type = "gem";
     };
-    version = "8.1.0";
+    version = "9.0.0";
   };
   addressable = {
     dependencies = ["public_suffix"];
@@ -413,10 +413,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "01psx005lkrfk3zm816z76fa2pv4hd8jk7hxrjyy4hbvgcqi6rfy";
+      sha256 = "0qq3knsy7nj7a0r8m19spg2bgzns9b3j5vjbs9mpg49whhc63dv1";
       type = "gem";
     };
-    version = "2.0.1";
+    version = "2.0.3";
   };
   azure-storage-common = {
     dependencies = ["faraday" "faraday_middleware" "net-http-persistent" "nokogiri"];
@@ -424,10 +424,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0h5bwswc5768hblcxsschjz3y0lf9kvz3k7qqwypdhy8sr1lfxg8";
+      sha256 = "0swmsvvpmy8cdcl305p3dl2pi7m3dqjd7zywfcxmhsz0n2m4v3v0";
       type = "gem";
     };
-    version = "2.0.2";
+    version = "2.0.4";
   };
   babosa = {
     groups = ["default"];
@@ -957,20 +957,6 @@
     };
     version = "1.7.0";
   };
-  debugger-ruby_core_source = {
-    groups = ["default" "development"];
-    platforms = [{
-      engine = "maglev";
-    } {
-      engine = "ruby";
-    }];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1lp5dmm8a8dpwymv6r1y6yr24wxsj0gvgb2b8i7qq9rcv414snwd";
-      type = "gem";
-    };
-    version = "1.3.8";
-  };
   deckar01-task_list = {
     dependencies = ["html-pipeline"];
     groups = ["default"];
@@ -1393,6 +1379,17 @@
     };
     version = "1.2.1";
   };
+  ethon = {
+    dependencies = ["ffi"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0kd7c61f28f810fgxg480j7457nlvqarza9c2ra0zhav0dd80288";
+      type = "gem";
+    };
+    version = "0.15.0";
+  };
   eventmachine = {
     groups = ["default" "development"];
     platforms = [];
@@ -1408,10 +1405,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0nn8wk7j22ly4lzdp5pnm7qsrjxbgspiyxkw70g1qf9bn6pslmxr";
+      sha256 = "1bkh80zzjpfglm14rhz116qgz0nb5gvk3ydfjpg14av5407srgh1";
       type = "gem";
     };
-    version = "0.71.1";
+    version = "0.90.0";
   };
   execjs = {
     groups = ["default"];
@@ -1899,10 +1896,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "022amhic8rs09qmp3hy1zz5inxbxnrvg8j82bq4l2s8ml9hqfs3a";
+      sha256 = "175whfk08jrmvssh5lgk0zgsaksbnhv6p5fg3picknrw4v05vw85";
       type = "gem";
     };
-    version = "14.4.0.pre.rc43";
+    version = "14.6.0.pre.rc1";
   };
   github-markup = {
     groups = ["default"];
@@ -1975,10 +1972,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "09xci7jw5sckagnwfjlglz4cywylrf16r83f82asnnngvxadvvmq";
+      sha256 = "05fs11wpqn801dsscs845629hbgwbgs94qhig45jmalw4h9rira4";
       type = "gem";
     };
-    version = "0.21.1";
+    version = "0.21.3";
   };
   gitlab-license = {
     groups = ["default"];
@@ -2037,10 +2034,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bzblypm1d5bxn8a15l90vx4ad099i5nhnislr7fhs2axy3ssfr1";
+      sha256 = "1nxak6q0m0nd3m5a7vp9xqww9w5fqx97viv5g6pg3q62q9binm0j";
       type = "gem";
     };
-    version = "0.8.0";
+    version = "0.9.1";
   };
   gitlab-sidekiq-fetcher = {
     dependencies = ["sidekiq"];
@@ -2092,10 +2089,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0k6ww3shk3mv119xvr9m99l6ql0czq91xhd66hm8hqssb18r2lvm";
+      sha256 = "1n5yc058i8xhi1fwcp1w7mfi6xaxfmrifdb4r4hjfff33ldn8lqj";
       type = "gem";
     };
-    version = "0.5.2";
+    version = "1.0.0";
   };
   gon = {
     dependencies = ["actionpack" "i18n" "multi_json" "request_store"];
@@ -2135,10 +2132,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0vmll4nnkha3vsqj1g76pwni6x7mp2i81pka4wdwq8qfhn210108";
+      sha256 = "1dwx4ns39bpmzmhglyip9d68i117zspf5lp865pf6hrsmmdf2k53";
       type = "gem";
     };
-    version = "3.17.3";
+    version = "3.19.1";
   };
   googleapis-common-protos-types = {
     dependencies = ["google-protobuf"];
@@ -2146,10 +2143,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1949w1lcd3iyiy4n6zgnrhdp78k9khbh2pbkrpkv263bbpmw8llg";
+      sha256 = "0w860lqs5j6n58a8qn4wr16hp0qz7cq5h67dgma04gncjwqiyhf5";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.3.0";
   };
   googleauth = {
     dependencies = ["faraday" "jwt" "memoist" "multi_json" "os" "signet"];
@@ -2223,10 +2220,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10q5zipwgjgaan9lfqakdkm5ry8afgkq79bkimgksn6jyyvpz6w8";
+      sha256 = "1lcf0gc88i3wk8cs71qm62ac9lrc1a8v5sd0369c5ip2ic4wbqh2";
       type = "gem";
     };
-    version = "1.4.10";
+    version = "1.8.0";
   };
   graphlient = {
     dependencies = ["faraday" "faraday_middleware" "graphql-client"];
@@ -2277,10 +2274,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1rsglf7ag17n465iff7vlw83pn2rpl4kv9sb1rpf17nx6xpi7yl5";
+      sha256 = "0jjq2ing7px4zvdrg9xcq5a9qsciq6g3v14n95a3d9n6cyg69lmk";
       type = "gem";
     };
-    version = "1.30.2";
+    version = "1.42.0";
   };
   gssapi = {
     dependencies = ["ffi"];
@@ -2968,10 +2965,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bp001p687nsa4a8sp3q1iv8pfhs24w7s3avychjp64sdkg6jxq3";
+      sha256 = "0kky3yiwagsk8gfbzn3mvl2fxlh3b39v6nawzm4wpjs6xxvvc4x0";
       type = "gem";
     };
-    version = "1.0.1";
+    version = "1.0.2";
   };
   marginalia = {
     dependencies = ["actionpack" "activerecord"];
@@ -3074,10 +3071,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ad0mli9rc0f17zw4ibp24dbj1y39zkykijsjmnzl4gwpg5s0j6k";
+      sha256 = "1lvxm91hi0pabnkkg47wh1siv56s6slm2mdq1idfm86dyfidfprq";
       type = "gem";
     };
-    version = "2.5.3";
+    version = "2.6.1";
   };
   minitest = {
     groups = ["development" "test"];
@@ -3333,21 +3330,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1vrn31385ix5k9b0yalnlzv360isv6dincbcvi8psllnwz4sjxj9";
+      sha256 = "1v02g7k7cxiwdcahvlxrmizn3avj2q6nsjccgilq1idc89cr081b";
       type = "gem";
     };
-    version = "1.11.7";
-  };
-  nokogumbo = {
-    dependencies = ["nokogiri"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0sxjnpjvrn10gdmfw2dimhch861lz00f28hvkkz0b1gc2rb65k9s";
-      type = "gem";
-    };
-    version = "2.0.2";
+    version = "1.12.5";
   };
   notiffany = {
     dependencies = ["nenv" "shellany"];
@@ -3681,10 +3667,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1nqhgvq006h6crbp8lffw66ll46zf319c2637g4sybdclglismma";
+      sha256 = "0w474bz3s1hqhilvrddr33l2nkyikypaczp3808w0345jr88b5m7";
       type = "gem";
     };
-    version = "1.2.0";
+    version = "1.3.0";
   };
   openssl = {
     groups = ["default"];
@@ -4010,10 +3996,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "178k7r0xn689spviqzhvazzvxfq6fyjldxb3ywjbgipbfi4s8j1g";
+      sha256 = "0la56m0z26j3mfn1a9lf2l03qx1xifanndf9p3vx1azf6sqy7v9d";
       type = "gem";
     };
-    version = "1.5.2";
+    version = "1.6.0";
   };
   rack = {
     groups = ["default" "development" "kerberos" "test"];
@@ -4107,10 +4093,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1y59m2x8rdc581bjgyyr9dabi3vk3frqhhpbb5ldpbj622kxfpbz";
+      sha256 = "10vylypjzfp6c34zx175x7ql7h27llmjdhgjxp5bn2zmrx3lac8l";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   rails-controller-testing = {
     dependencies = ["actionpack" "actionview" "activesupport"];
@@ -4162,10 +4148,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1kwpm068cqys34p2g0j3l1g0cd5f3kxnsay5v7lmbd0sgarac0vy";
+      sha256 = "1nmyds2www6dmqbbd5ggq31gxxb9mwxd5llzmb3iyczssk6l7lla";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
   };
   rainbow = {
     groups = ["default" "development" "test"];
@@ -4208,21 +4194,6 @@
     };
     version = "0.10.1";
   };
-  rblineprof = {
-    dependencies = ["debugger-ruby_core_source"];
-    groups = ["development"];
-    platforms = [{
-      engine = "maglev";
-    } {
-      engine = "ruby";
-    }];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0m58kdjgncwf0h1qry3qk5h4bg8sj0idykqqijqcrr09mxfd9yc6";
-      type = "gem";
-    };
-    version = "0.3.6";
-  };
   rbtrace = {
     dependencies = ["ffi" "msgpack" "optimist"];
     groups = ["default"];
@@ -4479,10 +4450,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "197k0vskf72wxx0gzwld2jzg27bb7982xlvnzy9adlvkzp7nh8vf";
+      sha256 = "0530ri0p60km0bg0ib6swkhfnas427cva7vcdmnwl8df52a10y1k";
       type = "gem";
     };
-    version = "3.26.1";
+    version = "3.27.0";
   };
   rqrcode = {
     dependencies = ["chunky_png"];
@@ -4709,10 +4680,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mn1m682l6hv54afh1an5lh623zbllgl2aqjz2f62v892slzkq57";
+      sha256 = "192bc7a4jgqcjgsp8jzkb2f355k5shy133zbvfcrjb7rjla7n9l9";
       type = "gem";
     };
-    version = "0.4.0";
+    version = "0.5.3";
   };
   ruby-prof = {
     groups = ["default"];
@@ -4838,15 +4809,15 @@
     version = "0.4.0";
   };
   sanitize = {
-    dependencies = ["crass" "nokogiri" "nokogumbo"];
+    dependencies = ["crass" "nokogiri"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "18m3zcf207gcrmghx288w3n2kpphc22lbmbc1wdx1nzcn8g2yddh";
+      sha256 = "1zq8pxmsd1abw18zz6mazsm2jfpwmbgdxbpawb7bmwvkb2c5yyc1";
       type = "gem";
     };
-    version = "5.2.1";
+    version = "6.0.0";
   };
   sass = {
     dependencies = ["sass-listen"];
@@ -5034,10 +5005,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1aliswahmpxn1ib2brn4126gk97ac3zdnwr71mn8vzbr3vdd7fl0";
+      sha256 = "0hxvm42zbr27k40jvdba5v8ich2ys8q7a2wbia9sxb0mmcy8v2aj";
       type = "gem";
     };
-    version = "1.0.4";
+    version = "1.2.0";
   };
   signet = {
     dependencies = ["addressable" "faraday" "jwt" "multi_json"];
@@ -5318,10 +5289,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0c5cdpykx2h4jx8q01hjhv8f0plw5r9iqm2i1m0ijiyk7dqm824w";
+      sha256 = "12b3q2sw42nnilfb51nlqdv07f31vdv2j595kd99asnkw4cjlf5w";
       type = "gem";
     };
-    version = "1.2.0";
+    version = "1.3.0";
   };
   sys-filesystem = {
     dependencies = ["ffi"];
@@ -5605,6 +5576,17 @@
     };
     version = "0.8.1";
   };
+  typhoeus = {
+    dependencies = ["ethon"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1m22yrkmbj81rzhlny81j427qdvz57yk5wbcf3km0nf3bl6qiygz";
+      type = "gem";
+    };
+    version = "1.4.0";
+  };
   tzinfo = {
     dependencies = ["concurrent-ruby"];
     groups = ["default" "development" "test"];
@@ -5832,10 +5814,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0m0jh8k7c0ifh2jhbn7ihqrmn5fi754wflva97zgy70hpdvxyjar";
+      sha256 = "18jj50b44a471ig7hw1ax90wxaaz40acmrf6cm7m2iyshlffy53q";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.2.0";
   };
   webmock = {
     dependencies = ["addressable" "crack" "hashdiff"];
@@ -5966,9 +5948,9 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "18l4r6layck0d80ydc692mv1lxak5xbf6w2paj1x7m2ggbggzxgj";
+      sha256 = "0lmg9x683gr9mkrbq9df2m0zb0650mdfxqna0bs10js44inv7znx";
       type = "gem";
     };
-    version = "2.5.1";
+    version = "2.5.3";
   };
 }
diff --git a/third_party/nixpkgs/pkgs/applications/version-management/gitless/default.nix b/third_party/nixpkgs/pkgs/applications/version-management/gitless/default.nix
index ed8cd551fc..a721834725 100644
--- a/third_party/nixpkgs/pkgs/applications/version-management/gitless/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/gitless/default.nix
@@ -1,27 +1,42 @@
-{ fetchFromGitHub, python, lib }:
+{ lib
+, fetchFromGitHub
+, python3
+}:
 
-with python.pkgs;
-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "gitless";
   version = "0.8.8";
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "gitless-vcs";
-    repo = "gitless";
+    repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-xo5EWtP2aN8YzP8ro3bnxZwUGUp0PHD0g8hk+Y+gExE=";
+    hash = "sha256-xo5EWtP2aN8YzP8ro3bnxZwUGUp0PHD0g8hk+Y+gExE=";
   };
 
-  propagatedBuildInputs = with pythonPackages; [ sh pygit2 clint ];
+  propagatedBuildInputs = with python3.pkgs; [
+    sh
+    pygit2
+    clint
+  ];
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "pygit2==0.28.2" "pygit2>=0.28.2"
+  '';
 
   doCheck = false;
 
+  pythonImportsCheck = [
+    "gitless"
+  ];
+
   meta = with lib; {
+    description = "Version control system built on top of Git";
     homepage = "https://gitless.com/";
-    description = "A version control system built on top of Git";
-    license = licenses.gpl2;
+    license = licenses.mit;
+    maintainers = with maintainers; [ cransom ];
     platforms = platforms.all;
-    maintainers = [ maintainers.cransom ];
   };
 }
-
diff --git a/third_party/nixpkgs/pkgs/applications/video/kooha/default.nix b/third_party/nixpkgs/pkgs/applications/video/kooha/default.nix
index f5be866473..667dfd83d2 100644
--- a/third_party/nixpkgs/pkgs/applications/video/kooha/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/video/kooha/default.nix
@@ -68,6 +68,7 @@ stdenv.mkDerivation rec {
   # Fixes https://github.com/NixOS/nixpkgs/issues/31168
   postPatch = ''
     patchShebangs build-aux/meson_post_install.py
+    substituteInPlace meson.build --replace '>= 1.0.0-alpha.1' '>= 1.0.0'
   '';
 
   installCheckPhase = ''
diff --git a/third_party/nixpkgs/pkgs/applications/video/plex-mpv-shim/default.nix b/third_party/nixpkgs/pkgs/applications/video/plex-mpv-shim/default.nix
index f567827600..2d0643c4dd 100644
--- a/third_party/nixpkgs/pkgs/applications/video/plex-mpv-shim/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/video/plex-mpv-shim/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonApplication, fetchFromGitHub, mpv, requests, python-mpv-jsonipc }:
+{ lib, buildPythonApplication, fetchFromGitHub, mpv, requests, python-mpv-jsonipc, pystray, tkinter }:
 
 buildPythonApplication rec {
   pname = "plex-mpv-shim";
@@ -11,7 +11,7 @@ buildPythonApplication rec {
     sha256 = "0hgv9g17dkrh3zbsx27n80yvkgix9j2x0rgg6d3qsf7hp5j3xw4r";
   };
 
-  propagatedBuildInputs = [ mpv requests python-mpv-jsonipc ];
+  propagatedBuildInputs = [ mpv requests python-mpv-jsonipc pystray tkinter ];
 
   # does not contain tests
   doCheck = false;
diff --git a/third_party/nixpkgs/pkgs/applications/video/srtrelay/default.nix b/third_party/nixpkgs/pkgs/applications/video/srtrelay/default.nix
index 5fffdca9e3..898f728d3e 100644
--- a/third_party/nixpkgs/pkgs/applications/video/srtrelay/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/video/srtrelay/default.nix
@@ -1,17 +1,17 @@
 { lib, buildGoModule, fetchFromGitHub, srt, ffmpeg }:
 
 buildGoModule rec {
-  pname = "srtrelay-unstable";
-  version = "2021-07-28";
+  pname = "srtrelay";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "voc";
     repo = "srtrelay";
-    rev = "c4f02ff2e9637b01a0679b29e5a76f4521eeeef3";
-    sha256 = "06zbl97bjjyv51zp27qk37ffpbh1ylm9bsr0s5qlyd73pyavcj1g";
+    rev = "v${version}";
+    sha256 = "sha256-CA+UuFOWjZjSBDWM62rda3IKO1fwC3X52mP4tg1uoO4=";
   };
 
-  vendorSha256 = "1pdpb0my7gdvjjkka6jhj19b9nx575k6117hg536b106ij2n4zd2";
+  vendorSha256 = "sha256-xTYlfdijSo99ei+ZMX6N9gl+yw0DrPQ2wOhn6SS9S/E=";
 
   buildInputs = [ srt ];
   checkInputs = [ ffmpeg ];
diff --git a/third_party/nixpkgs/pkgs/applications/virtualization/conmon/default.nix b/third_party/nixpkgs/pkgs/applications/virtualization/conmon/default.nix
index 11df90ce6e..6777b8d6c8 100644
--- a/third_party/nixpkgs/pkgs/applications/virtualization/conmon/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/virtualization/conmon/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "conmon";
-  version = "2.0.32";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-aj0RQVVJp2S8cIYT7fsbK1TLaK0auvdgEIgkZJktsdo=";
+    sha256 = "sha256-75Xyp25+JJtrXJO+cRFPkDj64zgdlVTAygGwFuJ7jKA=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/third_party/nixpkgs/pkgs/applications/window-managers/qtile/default.nix b/third_party/nixpkgs/pkgs/applications/window-managers/qtile/default.nix
index 8c5d65d497..a505c852a9 100644
--- a/third_party/nixpkgs/pkgs/applications/window-managers/qtile/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/window-managers/qtile/default.nix
@@ -1,23 +1,15 @@
-{ lib, fetchFromGitHub, python3, mypy, glib, cairo, pango, pkg-config, libxcb, xcbutilcursor }:
+{ lib, fetchFromGitHub, python3, python3Packages, mypy, glib, pango, pkg-config, xcbutilcursor }:
 
 let
-  enabled-xcffib = cairocffi-xcffib: cairocffi-xcffib.override {
-    withXcffib = true;
-  };
-
-  # make it easier to reference python
-  python = python3;
-  pythonPackages = python.pkgs;
-
-  unwrapped = pythonPackages.buildPythonPackage rec {
+  unwrapped = python3Packages.buildPythonPackage rec {
     pname = "qtile";
-    version = "0.19.0";
+    version = "0.20.0";
 
     src = fetchFromGitHub {
       owner = "qtile";
       repo = "qtile";
       rev = "v${version}";
-      sha256 = "BLHGVPMQd8O4h5TVx/F/klzSra+FZYogp22V6Yq04T0=";
+      sha256 = "TRmul3t//izJRdViTvxFz29JZeGYsWc7WsJjagQ35nw=";
     };
 
     postPatch = ''
@@ -33,13 +25,13 @@ let
 
     nativeBuildInputs = [
       pkg-config
-    ] ++ (with pythonPackages; [
+    ] ++ (with python3Packages; [
       setuptools-scm
     ]);
 
-    propagatedBuildInputs = with pythonPackages; [
+    propagatedBuildInputs = with python3Packages; [
       xcffib
-      (enabled-xcffib cairocffi)
+      (cairocffi.override { withXcffib = true; })
       setuptools
       python-dateutil
       dbus-python
@@ -68,9 +60,9 @@ let
     };
   };
 in
-  (python.withPackages (ps: [ unwrapped ])).overrideAttrs (_: {
-    # otherwise will be exported as "env", this restores `nix search` behavior
-    name = "${unwrapped.pname}-${unwrapped.version}";
-    # export underlying qtile package
-    passthru = { inherit unwrapped; };
-  })
+(python3.withPackages (_: [ unwrapped ])).overrideAttrs (_: {
+  # otherwise will be exported as "env", this restores `nix search` behavior
+  name = "${unwrapped.pname}-${unwrapped.version}";
+  # export underlying qtile package
+  passthru = { inherit unwrapped; };
+})
diff --git a/third_party/nixpkgs/pkgs/applications/window-managers/river/default.nix b/third_party/nixpkgs/pkgs/applications/window-managers/river/default.nix
index e59ce5449e..ca95806b79 100644
--- a/third_party/nixpkgs/pkgs/applications/window-managers/river/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/window-managers/river/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "river";
-  version = "0.1.0";
+  version = "0.1.2";
 
   src = fetchFromGitHub {
-    owner = "ifreund";
+    owner = "riverwm";
     repo = pname;
     rev = "v${version}";
-    sha256 = "03pdgrcpj8db9s14249815z76dyjwwma8xv6p9hpw79flk6rk7v7";
+    sha256 = "0mysj6fmgiwzrfzm1rk09k4xa9qiqsdwvwr59b4rs010c1gsllwk";
     fetchSubmodules = true;
   };
 
@@ -55,10 +55,9 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  /*
-    Builder patch install dir into river to get default config
-    When installFlags is removed, river becomes half broken.
-    See https://github.com/ifreund/river/blob/7ffa2f4b9e7abf7d152134f555373c2b63ccfc1d/river/main.zig#L56
+  /* Builder patch install dir into river to get default config
+     When installFlags is removed, river becomes half broken.
+     See https://github.com/riverwm/river/blob/7ffa2f4b9e7abf7d152134f555373c2b63ccfc1d/river/main.zig#L56
   */
   installFlags = [ "DESTDIR=$(out)" ];
 
diff --git a/third_party/nixpkgs/pkgs/applications/window-managers/sway/default.nix b/third_party/nixpkgs/pkgs/applications/window-managers/sway/default.nix
index 72ca71d589..194525dcff 100644
--- a/third_party/nixpkgs/pkgs/applications/window-managers/sway/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/window-managers/sway/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, substituteAll, swaybg
-, meson_0_60, ninja, pkg-config, wayland-scanner, scdoc
+, meson, ninja, pkg-config, wayland-scanner, scdoc
 , wayland, libxkbcommon, pcre, json_c, dbus, libevdev
 , pango, cairo, libinput, libcap, pam, gdk-pixbuf, librsvg
 , wlroots, wayland-protocols, libdrm
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [
-    meson_0_60 ninja pkg-config wayland-scanner scdoc
+    meson ninja pkg-config wayland-scanner scdoc
   ];
 
   buildInputs = [
diff --git a/third_party/nixpkgs/pkgs/build-support/bintools-wrapper/ld-wrapper.sh b/third_party/nixpkgs/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
index 2f96480f80..fb01c5096d 100644
--- a/third_party/nixpkgs/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
+++ b/third_party/nixpkgs/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
@@ -30,7 +30,7 @@ expandResponseParams "$@"
 if [[ -n "${NIX_LINK_TYPE_@suffixSalt@:-}" ]]; then
     linkType=$NIX_LINK_TYPE_@suffixSalt@
 else
-    linkType=$(checkLinkType "$@")
+    linkType=$(checkLinkType "${params[@]}")
 fi
 
 if [[ "${NIX_ENFORCE_PURITY:-}" = 1 && -n "${NIX_STORE:-}"
diff --git a/third_party/nixpkgs/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/third_party/nixpkgs/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index aa25de3364..1220841162 100644
--- a/third_party/nixpkgs/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/third_party/nixpkgs/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -31,7 +31,7 @@ cxxLibrary=1
 cInclude=1
 
 expandResponseParams "$@"
-linkType=$(checkLinkType "$@")
+linkType=$(checkLinkType "${params[@]}")
 
 declare -i n=0
 nParams=${#params[@]}
diff --git a/third_party/nixpkgs/pkgs/build-support/fetchgit/builder.sh b/third_party/nixpkgs/pkgs/build-support/fetchgit/builder.sh
index 0047a335c7..c7c7d21709 100644
--- a/third_party/nixpkgs/pkgs/build-support/fetchgit/builder.sh
+++ b/third_party/nixpkgs/pkgs/build-support/fetchgit/builder.sh
@@ -11,6 +11,7 @@ $SHELL $fetcher --builder --url "$url" --out "$out" --rev "$rev" \
   ${fetchLFS:+--fetch-lfs} \
   ${deepClone:+--deepClone} \
   ${fetchSubmodules:+--fetch-submodules} \
+  ${sparseCheckout:+--sparse-checkout "$sparseCheckout"} \
   ${branchName:+--branch-name "$branchName"}
 
 runHook postFetch
diff --git a/third_party/nixpkgs/pkgs/build-support/fetchgit/default.nix b/third_party/nixpkgs/pkgs/build-support/fetchgit/default.nix
index 3a05008dac..1b59668ce4 100644
--- a/third_party/nixpkgs/pkgs/build-support/fetchgit/default.nix
+++ b/third_party/nixpkgs/pkgs/build-support/fetchgit/default.nix
@@ -15,6 +15,7 @@ in
 { url, rev ? "HEAD", md5 ? "", sha256 ? "", hash ? "", leaveDotGit ? deepClone
 , fetchSubmodules ? true, deepClone ? false
 , branchName ? null
+, sparseCheckout ? ""
 , name ? urlToName url rev
 , # Shell code executed after the file has been fetched
   # successfully. This can do things like check or transform the file.
@@ -74,7 +75,7 @@ stdenvNoCC.mkDerivation {
   else
     lib.fakeSha256;
 
-  inherit url rev leaveDotGit fetchLFS fetchSubmodules deepClone branchName postFetch;
+  inherit url rev leaveDotGit fetchLFS fetchSubmodules deepClone branchName sparseCheckout postFetch;
 
   postHook = if netrcPhase == null then null else ''
     ${netrcPhase}
diff --git a/third_party/nixpkgs/pkgs/build-support/fetchgit/nix-prefetch-git b/third_party/nixpkgs/pkgs/build-support/fetchgit/nix-prefetch-git
index be5068c7ad..4e6f25b8dd 100755
--- a/third_party/nixpkgs/pkgs/build-support/fetchgit/nix-prefetch-git
+++ b/third_party/nixpkgs/pkgs/build-support/fetchgit/nix-prefetch-git
@@ -48,6 +48,7 @@ Options:
       --rev ref       Any sha1 or references (such as refs/heads/master)
       --hash h        Expected hash.
       --branch-name   Branch name to check out into
+      --sparse-checkout Only fetch and checkout part of the repository.
       --deepClone     Clone the entire repository.
       --no-deepClone  Make a shallow clone of just the required ref.
       --leave-dotGit  Keep the .git directories.
@@ -75,6 +76,7 @@ for arg; do
             --hash) argfun=set_hashType;;
             --branch-name) argfun=set_branchName;;
             --deepClone) deepClone=true;;
+            --sparse-checkout) argfun=set_sparseCheckout;;
             --quiet) QUIET=true;;
             --no-deepClone) deepClone=;;
             --leave-dotGit) leaveDotGit=true;;
@@ -96,7 +98,7 @@ for arg; do
         case $argfun in
             set_*)
                 var=${argfun#set_}
-                eval $var=$arg
+                eval "$var=$(printf %q "$arg")"
                 ;;
         esac
         argfun=""
@@ -112,6 +114,10 @@ init_remote(){
     local url=$1
     clean_git init --initial-branch=master
     clean_git remote add origin "$url"
+    if [ -n "$sparseCheckout" ]; then
+        git config remote.origin.partialclonefilter "blob:none"
+        echo "$sparseCheckout" | git sparse-checkout set --stdin
+    fi
     ( [ -n "$http_proxy" ] && clean_git config http.proxy "$http_proxy" ) || true
 }
 
diff --git a/third_party/nixpkgs/pkgs/build-support/fetchgit/tests.nix b/third_party/nixpkgs/pkgs/build-support/fetchgit/tests.nix
index 6805473e29..c558fb6efa 100644
--- a/third_party/nixpkgs/pkgs/build-support/fetchgit/tests.nix
+++ b/third_party/nixpkgs/pkgs/build-support/fetchgit/tests.nix
@@ -7,4 +7,15 @@
     rev = "9d9dbe6ed05854e03811c361a3380e09183f4f4a";
     sha256 = "sha256-7DszvbCNTjpzGRmpIVAWXk20P0/XTrWZ79KSOGLrUWY=";
   };
+
+  sparseCheckout = invalidateFetcherByDrvHash fetchgit {
+    name = "nix-source";
+    url = "https://github.com/NixOS/nix";
+    rev = "9d9dbe6ed05854e03811c361a3380e09183f4f4a";
+    sparseCheckout = ''
+      src
+      tests
+    '';
+    sha256 = "sha256-FknO6C/PSnMPfhUqObD4vsW4PhkwdmPa9blNzcNvJQ4=";
+  };
 }
diff --git a/third_party/nixpkgs/pkgs/build-support/fetchgithub/default.nix b/third_party/nixpkgs/pkgs/build-support/fetchgithub/default.nix
index d40a0478ba..4e4162368b 100644
--- a/third_party/nixpkgs/pkgs/build-support/fetchgithub/default.nix
+++ b/third_party/nixpkgs/pkgs/build-support/fetchgithub/default.nix
@@ -3,6 +3,7 @@
 { owner, repo, rev, name ? "source"
 , fetchSubmodules ? false, leaveDotGit ? null
 , deepClone ? false, private ? false, forceFetchGit ? false
+, sparseCheckout ? ""
 , githubBase ? "github.com", varPrefix ? null
 , ... # For hash agility
 }@args:
@@ -10,7 +11,7 @@ let
   baseUrl = "https://${githubBase}/${owner}/${repo}";
   passthruAttrs = removeAttrs args [ "owner" "repo" "rev" "fetchSubmodules" "forceFetchGit" "private" "githubBase" "varPrefix" ];
   varBase = "NIX${if varPrefix == null then "" else "_${varPrefix}"}_GITHUB_PRIVATE_";
-  useFetchGit = fetchSubmodules || (leaveDotGit == true) || deepClone || forceFetchGit;
+  useFetchGit = fetchSubmodules || (leaveDotGit == true) || deepClone || forceFetchGit || (sparseCheckout != "");
   # We prefer fetchzip in cases we don't need submodules as the hash
   # is more stable in that case.
   fetcher = if useFetchGit then fetchgit else fetchzip;
@@ -30,7 +31,7 @@ let
   };
   fetcherArgs = (if useFetchGit
     then {
-      inherit rev deepClone fetchSubmodules; url = "${baseUrl}.git";
+      inherit rev deepClone fetchSubmodules sparseCheckout; url = "${baseUrl}.git";
     } // lib.optionalAttrs (leaveDotGit != null) { inherit leaveDotGit; }
     else { url = "${baseUrl}/archive/${rev}.tar.gz"; }
   ) // privateAttrs // passthruAttrs // { inherit name; };
diff --git a/third_party/nixpkgs/pkgs/build-support/libredirect/default.nix b/third_party/nixpkgs/pkgs/build-support/libredirect/default.nix
index 0c86ea9a79..9ed00c8a8f 100644
--- a/third_party/nixpkgs/pkgs/build-support/libredirect/default.nix
+++ b/third_party/nixpkgs/pkgs/build-support/libredirect/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, runCommand, lib, coreutils }:
+{ lib, stdenv, bintools-unwrapped, llvmPackages_13, coreutils }:
 
 if stdenv.hostPlatform.isStatic
 then throw ''
@@ -25,17 +25,36 @@ else stdenv.mkDerivation rec {
     cp ${./test.c} test.c
   '';
 
-  libName = "libredirect" + stdenv.targetPlatform.extensions.sharedLibrary;
-
   outputs = ["out" "hook"];
 
+  libName = "libredirect" + stdenv.targetPlatform.extensions.sharedLibrary;
+
   buildPhase = ''
     runHook preBuild
 
-    $CC -Wall -std=c99 -O3 -fPIC -ldl -shared \
-      ${lib.optionalString stdenv.isDarwin "-Wl,-install_name,$out/lib/$libName"} \
-      -o "$libName" \
-      libredirect.c
+    ${if stdenv.isDarwin && stdenv.isAarch64 then ''
+    # We need the unwrapped binutils and clang:
+    # We also want to build a fat library with x86_64, arm64, arm64e in there.
+    # Because we use the unwrapped tools, we need to provide -isystem for headers
+    # and the library search directory for libdl.
+    # We can't build this on x86_64, because the libSystem we point to doesn't
+    # like arm64(e).
+    PATH=${bintools-unwrapped}/bin:${llvmPackages_13.clang-unwrapped}/bin:$PATH \
+      clang -arch x86_64 -arch arm64 -arch arm64e \
+      -isystem ${llvmPackages_13.clang.libc}/include \
+      -isystem ${llvmPackages_13.libclang.lib}/lib/clang/*/include \
+      -L${llvmPackages_13.clang.libc}/lib \
+      -Wl,-install_name,$libName \
+      -Wall -std=c99 -O3 -fPIC libredirect.c \
+      -ldl -shared -o "$libName"
+    '' else if stdenv.isDarwin then ''
+    $CC -Wall -std=c99 -O3 -fPIC libredirect.c \
+      -Wl,-install_name,$out/lib/$libName \
+      -ldl -shared -o "$libName"
+    '' else ''
+    $CC -Wall -std=c99 -O3 -fPIC libredirect.c \
+      -ldl -shared -o "$libName"
+    ''}
 
     if [ -n "$doInstallCheck" ]; then
       $CC -Wall -std=c99 -O3 test.c -o test
@@ -54,6 +73,12 @@ else stdenv.mkDerivation rec {
 
     install -vD "$libName" "$out/lib/$libName"
 
+  '' + lib.optionalString (stdenv.isDarwin && stdenv.isAarch64) ''
+    # dylib will be rejected unless dylib rpath gets explictly set
+    install_name_tool \
+      -change $libName $out/lib/$libName \
+      $out/lib/$libName
+  '' + ''
     # Provide a setup hook that injects our library into every process.
     mkdir -p "$hook/nix-support"
     cat <<SETUP_HOOK > "$hook/nix-support/setup-hook"
diff --git a/third_party/nixpkgs/pkgs/build-support/libredirect/libredirect.c b/third_party/nixpkgs/pkgs/build-support/libredirect/libredirect.c
index 7dac468472..0dc7feb382 100644
--- a/third_party/nixpkgs/pkgs/build-support/libredirect/libredirect.c
+++ b/third_party/nixpkgs/pkgs/build-support/libredirect/libredirect.c
@@ -112,7 +112,8 @@ WRAPPER(int, open)(const char * path, int flags, ...)
 }
 WRAPPER_DEF(open)
 
-#ifndef __APPLE__
+// In musl libc, open64 is simply a macro for open
+#if !defined(__APPLE__) && !defined(open64)
 WRAPPER(int, open64)(const char * path, int flags, ...)
 {
     int (*open64_real) (const char *, int, mode_t) = LOOKUP_REAL(open64);
@@ -152,7 +153,7 @@ WRAPPER(FILE *, fopen)(const char * path, const char * mode)
 }
 WRAPPER_DEF(fopen)
 
-#ifndef __APPLE__
+#ifdef __GLIBC__
 WRAPPER(FILE *, __nss_files_fopen)(const char * path)
 {
     FILE * (*__nss_files_fopen_real) (const char *) = LOOKUP_REAL(__nss_files_fopen);
@@ -162,7 +163,8 @@ WRAPPER(FILE *, __nss_files_fopen)(const char * path)
 WRAPPER_DEF(__nss_files_fopen)
 #endif
 
-#ifndef __APPLE__
+// In musl libc, fopen64 is simply a macro for fopen
+#if !defined(__APPLE__) && !defined(fopen64)
 WRAPPER(FILE *, fopen64)(const char * path, const char * mode)
 {
     FILE * (*fopen64_real) (const char *, const char *) = LOOKUP_REAL(fopen64);
@@ -172,7 +174,7 @@ WRAPPER(FILE *, fopen64)(const char * path, const char * mode)
 WRAPPER_DEF(fopen64)
 #endif
 
-#ifndef __APPLE__
+#ifdef __linux__
 WRAPPER(int, __xstat)(int ver, const char * path, struct stat * st)
 {
     int (*__xstat_real) (int ver, const char *, struct stat *) = LOOKUP_REAL(__xstat);
@@ -182,7 +184,7 @@ WRAPPER(int, __xstat)(int ver, const char * path, struct stat * st)
 WRAPPER_DEF(__xstat)
 #endif
 
-#ifndef __APPLE__
+#ifdef __linux__
 WRAPPER(int, __xstat64)(int ver, const char * path, struct stat64 * st)
 {
     int (*__xstat64_real) (int ver, const char *, struct stat64 *) = LOOKUP_REAL(__xstat64);
diff --git a/third_party/nixpkgs/pkgs/build-support/rust/hooks/cargo-build-hook.sh b/third_party/nixpkgs/pkgs/build-support/rust/hooks/cargo-build-hook.sh
index 54ed765012..7503fae4cd 100644
--- a/third_party/nixpkgs/pkgs/build-support/rust/hooks/cargo-build-hook.sh
+++ b/third_party/nixpkgs/pkgs/build-support/rust/hooks/cargo-build-hook.sh
@@ -6,6 +6,9 @@ cargoBuildHook() {
     runHook preBuild
 
     if [ ! -z "${buildAndTestSubdir-}" ]; then
+        # ensure the output doesn't end up in the subdirectory
+        export CARGO_TARGET_DIR="$(pwd)/target"
+
         pushd "${buildAndTestSubdir}"
     fi
 
diff --git a/third_party/nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh b/third_party/nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh
index 8b7012677c..903e17c3b2 100644
--- a/third_party/nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh
+++ b/third_party/nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh
@@ -23,6 +23,7 @@ assertExecutable() {
 
 # --prefix          ENV SEP VAL   : suffix/prefix ENV with VAL, separated by SEP
 # --suffix
+# --prefix-each     ENV SEP VALS  : like --prefix, but VALS is a list
 # --suffix-each     ENV SEP VALS  : like --suffix, but VALS is a list
 # --prefix-contents ENV SEP FILES : like --suffix-each, but contents of FILES
 #                                   are read first and used as VALS
@@ -73,6 +74,14 @@ makeWrapper() {
                     echo "export $varName=${value@Q}\${$varName:+${separator@Q}}\$$varName" >> "$wrapper"
                 fi
             fi
+        elif [[ "$p" == "--prefix-each" ]]; then
+            varName="${params[$((n + 1))]}"
+            separator="${params[$((n + 2))]}"
+            values="${params[$((n + 3))]}"
+            n=$((n + 3))
+            for value in $values; do
+                echo "export $varName=${value@Q}\${$varName:+${separator@Q}}\$$varName" >> "$wrapper"
+            done
         elif [[ "$p" == "--suffix-each" ]]; then
             varName="${params[$((n + 1))]}"
             separator="${params[$((n + 2))]}"
diff --git a/third_party/nixpkgs/pkgs/build-support/trivial-builders.nix b/third_party/nixpkgs/pkgs/build-support/trivial-builders.nix
index a7120e3343..68f0f1bc4d 100644
--- a/third_party/nixpkgs/pkgs/build-support/trivial-builders.nix
+++ b/third_party/nixpkgs/pkgs/build-support/trivial-builders.nix
@@ -121,18 +121,18 @@ rec {
         allowSubstitutes = false;
       }
       ''
-        n=$out${destination}
-        mkdir -p "$(dirname "$n")"
+        target=$out${destination}
+        mkdir -p "$(dirname "$target")"
 
         if [ -e "$textPath" ]; then
-          mv "$textPath" "$n"
+          mv "$textPath" "$target"
         else
-          echo -n "$text" > "$n"
+          echo -n "$text" > "$target"
         fi
 
         eval "$checkPhase"
 
-        (test -n "$executable" && chmod +x "$n") || true
+        (test -n "$executable" && chmod +x "$target") || true
       '';
 
   /*
@@ -219,7 +219,7 @@ rec {
         ${text}
         '';
       checkPhase = ''
-        ${stdenv.shell} -n $out
+        ${stdenv.shellDryRun} "$target"
       '';
     };
 
@@ -246,7 +246,7 @@ rec {
         ${text}
         '';
       checkPhase = ''
-        ${stdenv.shell} -n $out/bin/${name}
+        ${stdenv.shellDryRun} "$target"
       '';
     };
 
@@ -295,8 +295,8 @@ rec {
       checkPhase =
         if checkPhase == null then ''
           runHook preCheck
-          ${stdenv.shell} -n $out/bin/${name}
-          ${shellcheck}/bin/shellcheck $out/bin/${name}
+          ${stdenv.shellDryRun} "$target"
+          ${shellcheck}/bin/shellcheck "$target"
           runHook postCheck
         ''
         else checkPhase;
diff --git a/third_party/nixpkgs/pkgs/build-support/trivial-builders/test-overriding.nix b/third_party/nixpkgs/pkgs/build-support/trivial-builders/test-overriding.nix
index ddd5dc0507..a16bbbee1b 100644
--- a/third_party/nixpkgs/pkgs/build-support/trivial-builders/test-overriding.nix
+++ b/third_party/nixpkgs/pkgs/build-support/trivial-builders/test-overriding.nix
@@ -1,10 +1,11 @@
 # Check that overriding works for trivial-builders like
 # `writeShellScript` via `overrideAttrs`. This is useful
-# to override the `checkPhase`, e. g. when you want
-# to enable extglob in `writeShellScript`.
+# to override the `checkPhase`, e. g. if you want
+# to disable extglob in `writeShellScript`.
 #
-# Run using `nix-build -A tests.trivial-overriding`.
+# Run using `nix-build -A tests.trivial-builders.overriding`.
 { lib
+, stdenv
 , runtimeShell
 , runCommand
 , callPackage
@@ -21,33 +22,6 @@ let
     rm success
   '';
 
-  # Reuse the old `checkPhase` of `writeShellScript`, but enable extglob.
-  allowExtglob = old: {
-    checkPhase = ''
-      # make sure we don't change the settings for
-      # the rest of the derivation's build
-      (
-        export BASHOPTS
-        shopt -s extglob
-        ${old.checkPhase}
-      )
-    '';
-  };
-
-  # Run old checkPhase, but only succeed if it fails.
-  # This HACK is required because we can't introspect build failures
-  # in nix: With `assertFail` we want to make sure that the default
-  # `checkPhase` would fail if extglob was used in the script.
-  assertFail = old: {
-    # write old checkPhase into a shell script, so we can check for
-    # the phase to fail even though we have `set -e`.
-    checkPhase = ''
-      if source ${writeShellScript "old-check-phase" old.checkPhase} 2>/dev/null; then
-        exit 1
-      fi
-    '';
-  };
-
   simpleCase = case:
     writeShellScript "test-trivial-overriding-${case}" extglobScript;
 
@@ -70,16 +44,33 @@ let
     executable = true;
   };
 
-  mkCase = f: type: isBin:
+    disallowExtglob = x: x.overrideAttrs (_: {
+      checkPhase = ''
+        ${stdenv.shell} -n "$target"
+      '';
+    });
+
+    # Run old checkPhase, but only succeed if it fails.
+    # This HACK is required because we can't introspect build failures
+    # in nix: With `assertFail` we want to make sure that the default
+    # `checkPhase` would fail if extglob was used in the script.
+    assertFail = x: x.overrideAttrs (old: {
+      checkPhase = ''
+        if
+          ${old.checkPhase}
+        then exit 1; fi
+      '';
+    });
+
+  mkCase = case: outcome: isBin:
     let
-      drv = (f type).overrideAttrs
-        (if type == "succ" then allowExtglob else assertFail);
+      drv = lib.pipe outcome ([ case ] ++ lib.optionals (outcome == "fail") [ disallowExtglob assertFail ]);
     in if isBin then "${drv}/bin/${drv.name}" else drv;
 
   writeTextOverrides = {
-    # Enabling globbing in checkPhase
+    # Make sure extglob works by default
     simpleSucc = mkCase simpleCase "succ" false;
-    # Ensure it's possible to fail; in this case globbing is not enabled.
+    # Ensure it's possible to fail; in this case extglob is not enabled
     simpleFail = mkCase simpleCase "fail" false;
     # Do the same checks after wrapping with callPackage
     # to make sure callPackage doesn't mess with the override
@@ -103,7 +94,7 @@ let
       name = script.name or (builtins.baseNameOf script);
     in writeShellScript "run-${name}" ''
       if [ "$(${script})" != "success" ]; then
-        echo "Failed in ${script}"
+        echo "Failed in ${name}"
         exit 1
       fi
     '';
diff --git a/third_party/nixpkgs/pkgs/data/misc/cacert/default.nix b/third_party/nixpkgs/pkgs/data/misc/cacert/default.nix
index b6d8a4b6b6..4d79521c25 100644
--- a/third_party/nixpkgs/pkgs/data/misc/cacert/default.nix
+++ b/third_party/nixpkgs/pkgs/data/misc/cacert/default.nix
@@ -20,7 +20,7 @@ let
   blocklist = writeText "cacert-blocklist.txt" (lib.concatStringsSep "\n" blacklist);
   extraCertificatesBundle = writeText "cacert-extra-certificates-bundle.crt" (lib.concatStringsSep "\n\n" extraCertificateStrings);
 
-  srcVersion = "3.71";
+  srcVersion = "3.74";
   version = if nssOverride != null then nssOverride.version else srcVersion;
   meta = with lib; {
     homepage = "https://curl.haxx.se/docs/caextract.html";
@@ -35,7 +35,7 @@ let
 
     src = if nssOverride != null then nssOverride.src else fetchurl {
       url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings ["."] ["_"] version}_RTM/src/nss-${version}.tar.gz";
-      sha256 = "0ly2l3dv6z5hlxs72h5x6796ni3x1bq60saavaf42ddgv4ax7b4r";
+      sha256 = "0mnhdkm4galhpvfz4rv0918jwmjlwkvcvb1f5va8f3zlz48qi4l8";
     };
 
     dontBuild = true;
diff --git a/third_party/nixpkgs/pkgs/data/misc/shared-mime-info/default.nix b/third_party/nixpkgs/pkgs/data/misc/shared-mime-info/default.nix
index 4c60895897..2feb5e2f5a 100644
--- a/third_party/nixpkgs/pkgs/data/misc/shared-mime-info/default.nix
+++ b/third_party/nixpkgs/pkgs/data/misc/shared-mime-info/default.nix
@@ -13,34 +13,24 @@
 }:
 
 stdenv.mkDerivation rec {
-  pname = "shared-mime-info";
-  version = "2.1";
+  pname = "shared-mime-info-unstable";
+  version = "2021-12-03";
 
   outputs = [ "out" "dev" ];
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "xdg";
-    repo = pname;
-    rev = version;
-    sha256 = "07bxv44p43pqq4ymfnyy50yli7lwdqymhvclna42rkn1cazq3vb5";
+    repo = "shared-mime-info";
+    rev = "5a406b06792e26a83c7346b3c2443c0bd8d4cdb2";
+    sha256 = "1v7dx7mr0m4lcff1aasg9gxn280zn0ffn6fjg9xc44pnllg01n6s";
   };
 
-  patches = [
-    # xmlto is only used for building the docs, which are not installed anyways.
-    (fetchpatch {
-      name = "xmlto-optional.patch";
-      url = "https://gitlab.freedesktop.org/xdg/shared-mime-info/-/merge_requests/110.patch";
-      sha256 = "0p5gxlcmn8ji5bc7pd105s1halqwa1d28lfx9yj43rn6mav7allx";
-    })
-  ];
-
   nativeBuildInputs = [
     meson
     ninja
     pkg-config
     gettext
-    itstool
     libxml2
   ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) shared-mime-info;
 
diff --git a/third_party/nixpkgs/pkgs/desktops/arcan/xarcan/default.nix b/third_party/nixpkgs/pkgs/desktops/arcan/xarcan/default.nix
index 6245471a7e..d72bf4ad5b 100644
--- a/third_party/nixpkgs/pkgs/desktops/arcan/xarcan/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/arcan/xarcan/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , arcan
 , audit
 , dbus
@@ -46,6 +47,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-UTIVDKnYD/q0K6G7NJUKh1tHcqnsuiJ/cQxWuPMJ2G4=";
   };
 
+  patches = [
+    # fix build with meson 0.60
+    (fetchpatch {
+      url = "https://github.com/letoram/xarcan/commit/b67e514dbb59bffc23b75d47ca7f24e96c4aeb05.patch";
+      sha256 = "sha256-tSQmNy1Id6nDIN+03dc1+rEEF8fMq0yJBiscNM60xic=";
+    })
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
diff --git a/third_party/nixpkgs/pkgs/desktops/gnome/apps/gnome-todo/default.nix b/third_party/nixpkgs/pkgs/desktops/gnome/apps/gnome-todo/default.nix
index f3dde6585a..32eb07fbd6 100644
--- a/third_party/nixpkgs/pkgs/desktops/gnome/apps/gnome-todo/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/gnome/apps/gnome-todo/default.nix
@@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchurl
+, fetchFromGitLab
 , fetchpatch
 , meson
 , ninja
@@ -16,21 +16,25 @@
 , libpeas
 , gnome-online-accounts
 , gsettings-desktop-schemas
-, libportal
+, libportal-gtk4
 , evolution-data-server
 , libical
 , librest
 , json-glib
 , itstool
+, unstableGitUpdater
 }:
 
 stdenv.mkDerivation rec {
   pname = "gnome-todo";
-  version = "41.0";
+  version = "unstable-2022-01-01";
 
-  src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "1r94880d4khbjhhfnhaba3y3d4hv2bri82rzfzxn27s5iybpqras";
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "GNOME";
+    repo = "gnome-todo";
+    rev = "4a6be8c38510d909a9f94ec34c4da1f31ac9f1ab";
+    sha256 = "5UGo9vMb8scPWK91gftYOjqkJs9tGMiH1lqyEqedF2A=";
   };
 
   patches = [
@@ -64,7 +68,7 @@ stdenv.mkDerivation rec {
     gnome.adwaita-icon-theme
 
     # Plug-ins
-    libportal # background
+    libportal-gtk4 # background
     evolution-data-server # eds
     libical
     librest # todoist
@@ -77,9 +81,8 @@ stdenv.mkDerivation rec {
   '';
 
   passthru = {
-    updateScript = gnome.updateScript {
-      packageName = pname;
-      attrPath = "gnome.${pname}";
+    updateScript = unstableGitUpdater {
+      url = "https://gitlab.gnome.org/GNOME/gnome-todo.git";
     };
   };
 
diff --git a/third_party/nixpkgs/pkgs/desktops/gnome/core/eog/default.nix b/third_party/nixpkgs/pkgs/desktops/gnome/core/eog/default.nix
index 620f7e7d9c..cdde96ae43 100644
--- a/third_party/nixpkgs/pkgs/desktops/gnome/core/eog/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/gnome/core/eog/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchurl
+, fetchpatch
 , meson
 , ninja
 , gettext
@@ -8,7 +9,7 @@
 , libxml2
 , libjpeg
 , libpeas
-, libportal
+, libportal-gtk3
 , gnome
 , gtk3
 , glib
@@ -35,6 +36,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-huG5ujnaz3QiavpFermDtBJTuJ9he/VBOcrQiS0C2Kk=";
   };
 
+  patches = [
+    # Fix build with latest libportal
+    # https://gitlab.gnome.org/GNOME/eog/-/merge_requests/115
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/eog/-/commit/a06e6325907e136678b0bbe7058c25d688034afd.patch";
+      sha256 = "ttcsfHubfmIbxA51YLnxXDagLLNutXYmoQyMQ4sHRak=";
+    })
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
@@ -49,7 +59,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     libjpeg
-    libportal
+    libportal-gtk3
     gtk3
     gdk-pixbuf
     glib
diff --git a/third_party/nixpkgs/pkgs/desktops/gnome/core/epiphany/default.nix b/third_party/nixpkgs/pkgs/desktops/gnome/core/epiphany/default.nix
index 0baab20ace..eb8caa4f1e 100644
--- a/third_party/nixpkgs/pkgs/desktops/gnome/core/epiphany/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/gnome/core/epiphany/default.nix
@@ -12,7 +12,7 @@
 , wrapGAppsHook
 , gnome
 , pantheon
-, libportal
+, libportal-gtk3
 , libxml2
 , libxslt
 , itstool
@@ -65,6 +65,13 @@ stdenv.mkDerivation rec {
       url = "https://raw.githubusercontent.com/elementary/browser/cc17559a7ac6effe593712b4f3d0bbefde6e3b62/navigation-buttons.patch";
       sha256 = "sha256-G1/JUjn/8DyO9sgL/5Kq205KbTOs4EMi4Vf3cJ8FHXU=";
     })
+  ] ++ [
+    # Fix build with latest libportal
+    # https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1051
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/epiphany/-/commit/84474398f6e59266b73170838219aa896729ce93.patch";
+      sha256 = "SeiLTo3FcOxuml5sJX9GqyGdyGf1jm1A76SOI0JJvoo=";
+    })
   ];
 
   nativeBuildInputs = [
@@ -100,7 +107,7 @@ stdenv.mkDerivation rec {
     json-glib
     libdazzle
     libhandy
-    libportal
+    libportal-gtk3
     libnotify
     libarchive
     libsecret
diff --git a/third_party/nixpkgs/pkgs/desktops/gnome/core/gnome-settings-daemon/3.38/default.nix b/third_party/nixpkgs/pkgs/desktops/gnome/core/gnome-settings-daemon/3.38/default.nix
index de48b72fac..aae01577a8 100644
--- a/third_party/nixpkgs/pkgs/desktops/gnome/core/gnome-settings-daemon/3.38/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/gnome/core/gnome-settings-daemon/3.38/default.nix
@@ -68,6 +68,12 @@ stdenv.mkDerivation rec {
       url = "https://gitlab.gnome.org/GNOME/gnome-settings-daemon/commit/82d88014dfca2df7e081712870e1fb017c16b808.patch";
       sha256 = "H5k/v+M2bRaswt5nrDJFNn4gS4BdB0UfzdjUCT4yLKg=";
     })
+
+    # Fix build with new meson
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/commit/28e28e9e598342c897ae5ca350d0da6f4aea057b.diff";
+      sha256 = "U+suR7wYjLWPqmkJpHm6pPOWL7sjL6GhIFX8MHrBRAY=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/desktops/gnome/core/nautilus/default.nix b/third_party/nixpkgs/pkgs/desktops/gnome/core/nautilus/default.nix
index 1b527bf49d..3f61f55db1 100644
--- a/third_party/nixpkgs/pkgs/desktops/gnome/core/nautilus/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/gnome/core/nautilus/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchurl
+, fetchpatch
 , meson
 , ninja
 , pkg-config
@@ -10,7 +11,7 @@
 , wrapGAppsHook
 , gtk3
 , libhandy
-, libportal
+, libportal-gtk3
 , gnome
 , gnome-autoar
 , glib-networking
@@ -52,6 +53,17 @@ stdenv.mkDerivation rec {
       src = ./fix-paths.patch;
       inherit tracker;
     })
+
+    # Fix build with latest libportal
+    # https://gitlab.gnome.org/GNOME/nautilus/-/merge_requests/749
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/nautilus/-/commit/55cfd66ccca391fc144f5863ff6bfc1f3b137e2d.patch";
+      sha256 = "xSb9l7xxEYpAwmdmeWT/t7Z9Ck3DPtsODzbReQW/Q70=";
+      excludes = [
+        "build-aux/flatpak/org.gnome.Nautilus.json"
+        "build-aux/flatpak/org.gnome.Nautilus.yml"
+      ];
+    })
   ];
 
   nativeBuildInputs = [
@@ -76,7 +88,7 @@ stdenv.mkDerivation rec {
     gst_all_1.gst-plugins-base
     gtk3
     libhandy
-    libportal
+    libportal-gtk3
     libexif
     libnotify
     libseccomp
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/elementary-code/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/elementary-code/default.nix
index 5007e29726..073ea45cbc 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/elementary-code/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/elementary-code/default.nix
@@ -48,12 +48,6 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
-
   nativeBuildInputs = [
     appstream
     desktop-file-utils
@@ -95,6 +89,12 @@ stdenv.mkDerivation rec {
     patchShebangs meson/post_install.py
   '';
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
   meta = with lib; {
     description = "Code editor designed for elementary OS";
     homepage = "https://github.com/elementary/code";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/elementary-feedback/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/elementary-feedback/default.nix
index 8a9256f2a6..9b760515ff 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/elementary-feedback/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/elementary-feedback/default.nix
@@ -24,11 +24,9 @@ stdenv.mkDerivation rec {
   pname = "elementary-feedback";
   version = "6.1.0";
 
-  repoName = "feedback";
-
   src = fetchFromGitHub {
     owner = "elementary";
-    repo = repoName;
+    repo = "feedback";
     rev = version;
     sha256 = "02wydbpa5qaa4xmmh4m7rbj4djbrn2i44zjakj5i6mzwjlj6sv5n";
   };
@@ -42,12 +40,6 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
-
   nativeBuildInputs = [
     gettext
     meson
@@ -74,6 +66,12 @@ stdenv.mkDerivation rec {
     patchShebangs meson/post_install.py
   '';
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
   meta = with lib; {
     description = "GitHub Issue Reporter designed for elementary OS";
     homepage = "https://github.com/elementary/feedback";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/elementary-mail/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/elementary-mail/default.nix
index 58be49ab4b..2963f98db4 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/elementary-mail/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/elementary-mail/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , nix-update-script
 , pkg-config
 , meson
@@ -26,24 +25,15 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-mail";
-  version = "6.3.1";
+  version = "6.4.0";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "mail";
     rev = version;
-    sha256 = "sha256-wOu9jvvwG53vzcNa38nk4eREZWW7Cin8el4qApQ8gI8=";
+    sha256 = "sha256-ooqVNMgeAqGlFcfachPPfhSiKTEEcNGv5oWdM7VLWOc=";
   };
 
-  patches = [
-    # Fix build with meson 0.61
-    # https://github.com/elementary/mail/pull/751
-    (fetchpatch {
-      url = "https://github.com/elementary/mail/commit/bbadc56529276d8e0ff98e9df7d9bb1bf8fc5783.patch";
-      sha256 = "sha256-lJEnX5/G6e8PdKy1XGlwFIoCeSy6SR5p68tS4noj+44=";
-    })
-  ];
-
   nativeBuildInputs = [
     appstream
     desktop-file-utils
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/elementary-music/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/elementary-music/default.nix
index cceeeabf15..d71835a653 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/elementary-music/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/elementary-music/default.nix
@@ -34,11 +34,9 @@ stdenv.mkDerivation rec {
   pname = "elementary-music";
   version = "5.1.1";
 
-  repoName = "music";
-
   src = fetchFromGitHub {
     owner = "elementary";
-    repo = repoName;
+    repo = "music";
     rev = version;
     sha256 = "1wqsn4ss9acg0scaqpg514ll2dj3bl71wly4mm79qkinhy30yv9n";
   };
@@ -58,12 +56,6 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
-
   nativeBuildInputs = [
     desktop-file-utils
     meson
@@ -108,6 +100,12 @@ stdenv.mkDerivation rec {
     patchShebangs meson/post_install.py
   '';
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
   meta = with lib; {
     description = "Music player and library designed for elementary OS";
     homepage = "https://github.com/elementary/music";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/elementary-photos/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/elementary-photos/default.nix
index ca7b6fd3a7..12f6242eaa 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/elementary-photos/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/elementary-photos/default.nix
@@ -36,11 +36,9 @@ stdenv.mkDerivation rec {
   pname = "elementary-photos";
   version = "2.7.3";
 
-  repoName = "photos";
-
   src = fetchFromGitHub {
     owner = "elementary";
-    repo = repoName;
+    repo = "photos";
     rev = version;
     sha256 = "sha256-ja4ElW0FNm9oNyn+00SdI2Cxep6LyWTYM8Blc6bnuiY=";
   };
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/elementary-tasks/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/elementary-tasks/default.nix
index 7ef0efaa49..f220db8868 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/elementary-tasks/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/elementary-tasks/default.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-tasks";
-  version = "6.1.0";
+  version = "6.2.0";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "tasks";
     rev = version;
-    sha256 = "sha256-Gt9Hp9m28QdAFnKIT1xcbiSM5cn6kW7wEXmi/iFfu8k=";
+    sha256 = "sha256-eHaWXntLkk5G+cR5uFwWsIvbSPsbrvpglYBh91ta/M0=";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/sideload/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/sideload/default.nix
index a065966ba1..d93b158168 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/sideload/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/sideload/default.nix
@@ -32,12 +32,6 @@ stdenv.mkDerivation rec {
     sha256 = "0abpcawmmv5mgzk2i5n9rlairmjr2v9rg9b8c9g7xa085s496bi9";
   };
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
-
   nativeBuildInputs = [
     desktop-file-utils
     gettext
@@ -66,6 +60,12 @@ stdenv.mkDerivation rec {
     patchShebangs meson/post_install.py
   '';
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
   meta = with lib; {
     homepage = "https://github.com/elementary/sideload";
     description = "Flatpak installer, designed for elementary OS";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/a11y/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/a11y/default.nix
index bcb7c39d17..152026e17a 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/a11y/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/a11y/default.nix
@@ -40,12 +40,6 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
-
   nativeBuildInputs = [
     meson
     ninja
@@ -61,6 +55,12 @@ stdenv.mkDerivation rec {
     wingpanel-indicator-a11y
   ];
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
   meta = with lib; {
     description = "Switchboard Universal Access Plug";
     homepage = "https://github.com/elementary/switchboard-plug-a11y";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/about/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/about/default.nix
index d48704736b..03964284ed 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/about/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/about/default.nix
@@ -29,11 +29,13 @@ stdenv.mkDerivation rec {
     sha256 = "0c075ac7iqz4hqbp2ph0cwyhiq0jn6c1g1jjfhygjbssv3vvd268";
   };
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
+  patches = [
+    # Use NixOS's default wallpaper
+    (substituteAll {
+      src = ./fix-background-path.patch;
+      default_wallpaper = "${nixos-artwork.wallpapers.simple-dark-gray.gnomeFilePath}";
+    })
+  ];
 
   nativeBuildInputs = [
     meson
@@ -53,13 +55,11 @@ stdenv.mkDerivation rec {
     switchboard
   ];
 
-  patches = [
-    # Use NixOS's default wallpaper
-    (substituteAll {
-      src = ./fix-background-path.patch;
-      default_wallpaper = "${nixos-artwork.wallpapers.simple-dark-gray.gnomeFilePath}";
-    })
-  ];
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
 
   meta = with lib; {
     description = "Switchboard About Plug";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/applications/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/applications/default.nix
index d24b755026..03fb7e9349 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/applications/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/applications/default.nix
@@ -24,12 +24,6 @@ stdenv.mkDerivation rec {
     sha256 = "18izmzhqp6x5ivha9yl8gyz9adyrsylw7w5p0cwm1bndgqbi7yh5";
   };
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
-
   nativeBuildInputs = [
     meson
     ninja
@@ -45,6 +39,12 @@ stdenv.mkDerivation rec {
     switchboard
   ];
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
   meta = with lib; {
     description = "Switchboard Applications Plug";
     homepage = "https://github.com/elementary/switchboard-plug-applications";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/bluetooth/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/bluetooth/default.nix
index 764845c020..53dc200a43 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/bluetooth/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/bluetooth/default.nix
@@ -35,12 +35,6 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
-
   nativeBuildInputs = [
     meson
     ninja
@@ -57,6 +51,12 @@ stdenv.mkDerivation rec {
     wingpanel-indicator-bluetooth # settings schema
   ];
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
   meta = with lib; {
     description = "Switchboard Bluetooth Plug";
     homepage = "https://github.com/elementary/switchboard-plug-bluetooth";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/datetime/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/datetime/default.nix
index 09717a584c..71bbda8edb 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/datetime/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/datetime/default.nix
@@ -27,12 +27,6 @@ stdenv.mkDerivation rec {
     sha256 = "10rqhxsqbl1xnz5n84d7m39c3vb71k153989xvyc55djia1wjx96";
   };
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
-
   patches = [
     (substituteAll {
       src = ./fix-paths.patch;
@@ -61,6 +55,12 @@ stdenv.mkDerivation rec {
     switchboard
   ];
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
   meta = with lib; {
     description = "Switchboard Date & Time Plug";
     homepage = "https://github.com/elementary/switchboard-plug-datetime";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/display/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/display/default.nix
index c25188add4..4a7ce6f6d4 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/display/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/display/default.nix
@@ -24,12 +24,6 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-3sYZCazGnTjIi3Iry5673TMI13sD0GuY+46AK+NJH70=";
   };
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
-
   nativeBuildInputs = [
     meson
     ninja
@@ -45,6 +39,12 @@ stdenv.mkDerivation rec {
     switchboard
   ];
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
   meta = with lib; {
     description = "Switchboard Displays Plug";
     homepage = "https://github.com/elementary/switchboard-plug-display";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/keyboard/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/keyboard/default.nix
index 01a3da26b1..1118d52fb4 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/keyboard/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/keyboard/default.nix
@@ -40,12 +40,6 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
-
   nativeBuildInputs = [
     libxml2
     meson
@@ -67,6 +61,12 @@ stdenv.mkDerivation rec {
     switchboard
   ];
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
   meta = with lib; {
     description = "Switchboard Keyboard Plug";
     homepage = "https://github.com/elementary/switchboard-plug-keyboard";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/mouse-touchpad/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/mouse-touchpad/default.nix
index a765eca6de..2c9b3833a0 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/mouse-touchpad/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/mouse-touchpad/default.nix
@@ -29,11 +29,12 @@ stdenv.mkDerivation rec {
     sha256 = "0nqgbpk1knvbj5xa078i0ka6lzqmaaa873gwj3mhjr5q2gzkw7y5";
   };
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
+  patches = [
+    (substituteAll {
+      src = ./fix-paths.patch;
+      touchegg = touchegg;
+    })
+  ];
 
   nativeBuildInputs = [
     meson
@@ -54,12 +55,11 @@ stdenv.mkDerivation rec {
     touchegg
   ];
 
-  patches = [
-    (substituteAll {
-      src = ./fix-paths.patch;
-      touchegg = touchegg;
-    })
-  ];
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
 
   meta = with lib; {
     description = "Switchboard Mouse & Touchpad Plug";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/network/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/network/default.nix
index b88f3f72d0..64a3083c6c 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/network/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/network/default.nix
@@ -27,11 +27,12 @@ stdenv.mkDerivation rec {
     sha256 = "0nqihsbrpjw4nx1c50g854bqybniw38adi78vzg8nyl6ikj2r0z4";
   };
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
+  patches = [
+    (substituteAll {
+      src = ./fix-paths.patch;
+      inherit networkmanagerapplet;
+    })
+  ];
 
   nativeBuildInputs = [
     meson
@@ -49,12 +50,11 @@ stdenv.mkDerivation rec {
     switchboard
   ];
 
-  patches = [
-    (substituteAll {
-      src = ./fix-paths.patch;
-      inherit networkmanagerapplet;
-    })
-  ];
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
 
   meta = with lib; {
     description = "Switchboard Networking Plug";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/notifications/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/notifications/default.nix
index fd5dfa3281..f142b8e9bb 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/notifications/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/notifications/default.nix
@@ -34,12 +34,6 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
-
   nativeBuildInputs = [
     meson
     ninja
@@ -55,6 +49,12 @@ stdenv.mkDerivation rec {
     switchboard
   ];
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
   meta = with lib; {
     description = "Switchboard Notifications Plug";
     homepage = "https://github.com/elementary/switchboard-plug-notifications";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/power/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/power/default.nix
index 16ed92b45d..2a531815f8 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/power/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/power/default.nix
@@ -28,12 +28,6 @@ stdenv.mkDerivation rec {
     sha256 = "006h8mrhmdrbd83vhdyahgrfk9wh6j9kjincpp7dz7sl8fsyhmcr";
   };
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
-
   nativeBuildInputs = [
     meson
     ninja
@@ -53,6 +47,12 @@ stdenv.mkDerivation rec {
     wingpanel-indicator-power # settings schema
   ];
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
   meta = with lib; {
     description = "Switchboard Power Plug";
     homepage = "https://github.com/elementary/switchboard-plug-power";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/printers/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/printers/default.nix
index dbca28038a..40b52affa0 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/printers/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/printers/default.nix
@@ -34,12 +34,6 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
-
   nativeBuildInputs = [
     meson
     ninja
@@ -55,6 +49,12 @@ stdenv.mkDerivation rec {
     switchboard
   ];
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
   meta = with lib; {
     description = "Switchboard Printers Plug";
     homepage = "https://github.com/elementary/switchboard-plug-printers";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/sharing/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/sharing/default.nix
index f41cfa2f74..2a480bb9e2 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/sharing/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/sharing/default.nix
@@ -33,12 +33,6 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
-
   nativeBuildInputs = [
     meson
     ninja
@@ -53,6 +47,12 @@ stdenv.mkDerivation rec {
     switchboard
   ];
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
   meta = with lib; {
     description = "Switchboard Sharing Plug";
     homepage = "https://github.com/elementary/switchboard-plug-sharing";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/wacom/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/wacom/default.nix
index e31768c764..904278f983 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/wacom/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/wacom/default.nix
@@ -37,12 +37,6 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
-
   nativeBuildInputs = [
     meson
     ninja
@@ -62,6 +56,12 @@ stdenv.mkDerivation rec {
     xorg.libXi
   ];
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
   meta = with lib; {
     description = "Switchboard Wacom Plug";
     homepage = "https://github.com/elementary/switchboard-plug-wacom";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard/default.nix
index 50a3317d6e..209fa1202f 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard/default.nix
@@ -28,12 +28,6 @@ stdenv.mkDerivation rec {
     sha256 = "02dfsrfmr297cxpyd5m3746ihcgjyfnb3d42ng9m4ljdvh0dxgim";
   };
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
-
   nativeBuildInputs = [
     gettext
     meson
@@ -73,6 +67,12 @@ stdenv.mkDerivation rec {
     patchShebangs meson/post_install.py
   '';
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
   meta = with lib; {
     description = "Extensible System Settings app for Pantheon";
     homepage = "https://github.com/elementary/switchboard";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/artwork/elementary-gtk-theme/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/artwork/elementary-gtk-theme/default.nix
index b76a874490..304e07749c 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/artwork/elementary-gtk-theme/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/artwork/elementary-gtk-theme/default.nix
@@ -12,11 +12,9 @@ stdenv.mkDerivation rec {
   pname = "elementary-gtk-theme";
   version = "6.1.1";
 
-  repoName = "stylesheet";
-
   src = fetchFromGitHub {
     owner = "elementary";
-    repo = repoName;
+    repo = "stylesheet";
     rev = version;
     sha256 = "sha256-gciBn5MQ5Cu+dROL5kCt2GCbNA7W4HOWXyjMBd4OP+8=";
   };
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/artwork/elementary-icon-theme/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/artwork/elementary-icon-theme/default.nix
index 450275d105..40522bbf02 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/artwork/elementary-icon-theme/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/artwork/elementary-icon-theme/default.nix
@@ -15,11 +15,9 @@ stdenv.mkDerivation rec {
   pname = "elementary-icon-theme";
   version = "6.1.0";
 
-  repoName = "icons";
-
   src = fetchFromGitHub {
     owner = "elementary";
-    repo = repoName;
+    repo = "icons";
     rev = version;
     sha256 = "sha256-WR4HV0nJKj0WeSFHXLK64O0LhX8myAJE4w0aztyhPn4=";
   };
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/artwork/elementary-sound-theme/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/artwork/elementary-sound-theme/default.nix
index 6bad05693f..2f326235c4 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/artwork/elementary-sound-theme/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/artwork/elementary-sound-theme/default.nix
@@ -11,11 +11,9 @@ stdenv.mkDerivation rec {
   pname = "elementary-sound-theme";
   version = "1.1.0";
 
-  repoName = "sound-theme";
-
   src = fetchFromGitHub {
     owner = "elementary";
-    repo = repoName;
+    repo = "sound-theme";
     rev = version;
     sha256 = "sha256-fR6gtKx9J6o2R1vQZ5yx4kEX3Ak+q8I6hRVMZzyB2E8=";
   };
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/elementary-default-settings/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/elementary-default-settings/default.nix
index a96bba4ab1..393186325b 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/elementary-default-settings/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/elementary-default-settings/default.nix
@@ -17,11 +17,9 @@ stdenv.mkDerivation rec {
   pname = "elementary-default-settings";
   version = "6.0.2";
 
-  repoName = "default-settings";
-
   src = fetchFromGitHub {
     owner = "elementary";
-    repo = repoName;
+    repo = "default-settings";
     rev = version;
     sha256 = "sha256-qaPj/Qp7RYzHgElFdM8bHV42oiPUbCMTC9Q+MUj4Q6Y=";
   };
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix
index 72df609c5a..38de716394 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix
@@ -40,16 +40,32 @@ stdenv.mkDerivation rec {
     sha256 = "1f606ds56sp1c58q8dblfpaq9pwwkqw9i4gkwksw45m2xkwlbflq";
   };
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-
-    xgreeters = linkFarm "pantheon-greeter-xgreeters" [{
-      path = "${elementary-greeter}/share/xgreeters/io.elementary.greeter.desktop";
-      name = "io.elementary.greeter.desktop";
-    }];
-  };
+  patches = [
+    ./sysconfdir-install.patch
+    # Needed until https://github.com/elementary/greeter/issues/360 is fixed
+    (substituteAll {
+      src = ./hardcode-fallback-background.patch;
+      default_wallpaper = "${nixos-artwork.wallpapers.simple-dark-gray.gnomeFilePath}";
+    })
+    # Revert "UserCard: use accent color for logged_in check (#566)"
+    # https://github.com/elementary/greeter/pull/566
+    # Fixes crash issue reported in:
+    # https://github.com/elementary/greeter/issues/578
+    # https://github.com/NixOS/nixpkgs/issues/151609
+    # Probably also fixes:
+    # https://github.com/elementary/greeter/issues/568
+    # https://github.com/elementary/greeter/issues/583
+    # https://github.com/NixOS/nixpkgs/issues/140513
+    # Revisit this when the greeter is ported to GTK 4:
+    # https://github.com/elementary/greeter/pull/591
+    ./revert-pr566.patch
+    # Fix build with meson 0.61
+    # https://github.com/elementary/greeter/pull/590
+    (fetchpatch {
+      url = "https://github.com/elementary/greeter/commit/a4b25244058fce794a9f13f6b22a8ff7735ebde9.patch";
+      sha256 = "sha256-qPXhdvmYG8YMDU/CjbEkfZ0glgRzxnu0TsOPtvWHxLY=";
+    })
+  ];
 
   nativeBuildInputs = [
     desktop-file-utils
@@ -84,21 +100,6 @@ stdenv.mkDerivation rec {
     "-Dgsd-dir=${gnome-settings-daemon}/libexec/" # trailing slash is needed
   ];
 
-  patches = [
-    ./sysconfdir-install.patch
-    # Needed until https://github.com/elementary/greeter/issues/360 is fixed
-    (substituteAll {
-      src = ./hardcode-fallback-background.patch;
-      default_wallpaper = "${nixos-artwork.wallpapers.simple-dark-gray.gnomeFilePath}";
-    })
-    # Fix build with meson 0.61
-    # https://github.com/elementary/greeter/pull/590
-    (fetchpatch {
-      url = "https://github.com/elementary/greeter/commit/a4b25244058fce794a9f13f6b22a8ff7735ebde9.patch";
-      sha256 = "sha256-qPXhdvmYG8YMDU/CjbEkfZ0glgRzxnu0TsOPtvWHxLY=";
-    })
-  ];
-
   preFixup = ''
     gappsWrapperArgs+=(
       # dbus-launch needed in path
@@ -125,6 +126,17 @@ stdenv.mkDerivation rec {
       --replace "Exec=io.elementary.greeter" "Exec=$out/bin/io.elementary.greeter"
   '';
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+
+    xgreeters = linkFarm "pantheon-greeter-xgreeters" [{
+      path = "${elementary-greeter}/share/xgreeters/io.elementary.greeter.desktop";
+      name = "io.elementary.greeter.desktop";
+    }];
+  };
+
   meta = with lib; {
     description = "LightDM Greeter for Pantheon";
     homepage = "https://github.com/elementary/greeter";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/elementary-greeter/revert-pr566.patch b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/elementary-greeter/revert-pr566.patch
new file mode 100644
index 0000000000..ed05ba24b8
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/elementary-greeter/revert-pr566.patch
@@ -0,0 +1,103 @@
+From 572a73cbc84dd9a0f5a7667a60c75ed5580d84a1 Mon Sep 17 00:00:00 2001
+From: Bobby Rong <rjl931189261@126.com>
+Date: Tue, 25 Jan 2022 10:03:31 +0800
+Subject: [PATCH] Revert "UserCard: use accent color for logged_in check
+ (#566)"
+
+This reverts commit 6f18c79c780582e43039032f6926816efa82e206.
+---
+ data/Check.css             | 11 -----------
+ data/greeter.gresource.xml |  1 -
+ src/Cards/UserCard.vala    | 29 +++--------------------------
+ 3 files changed, 3 insertions(+), 38 deletions(-)
+ delete mode 100644 data/Check.css
+
+diff --git a/data/Check.css b/data/Check.css
+deleted file mode 100644
+index 947db6b..0000000
+--- a/data/Check.css
++++ /dev/null
+@@ -1,11 +0,0 @@
+-check {
+-    background-color: @accent_color;
+-    border-radius: 99px;
+-    color: white;
+-    margin: 2px;
+-    min-height: 20px;
+-    min-width: 20px;
+-    -gtk-icon-shadow: 0 1px 1px shade(@accent_color, 0.7);
+-    -gtk-icon-source: -gtk-icontheme("check-active-symbolic");
+-    -gtk-icon-transform: scale(0.6);
+-}
+diff --git a/data/greeter.gresource.xml b/data/greeter.gresource.xml
+index 604c89a..ce9be29 100644
+--- a/data/greeter.gresource.xml
++++ b/data/greeter.gresource.xml
+@@ -2,7 +2,6 @@
+ <gresources>
+   <gresource prefix="/io/elementary/greeter">
+     <file alias="Card.css" compressed="true">Card.css</file>
+-    <file alias="Check.css" compressed="true">Check.css</file>
+     <file alias="DateTime.css" compressed="true">DateTime.css</file>
+     <file alias="MainWindow.css" compressed="true">MainWindow.css</file>
+   </gresource>
+diff --git a/src/Cards/UserCard.vala b/src/Cards/UserCard.vala
+index 83df22c..02d2b0a 100644
+--- a/src/Cards/UserCard.vala
++++ b/src/Cards/UserCard.vala
+@@ -42,7 +42,6 @@ public class Greeter.UserCard : Greeter.BaseCard {
+     private Gtk.Stack login_stack;
+     private Greeter.PasswordEntry password_entry;
+ 
+-    private unowned Gtk.StyleContext logged_in_context;
+     private weak Gtk.StyleContext main_grid_style_context;
+     private weak Gtk.StyleContext password_entry_context;
+ 
+@@ -214,14 +213,10 @@ public class Greeter.UserCard : Greeter.BaseCard {
+         };
+         avatar_overlay.add (avatar);
+ 
+-        var logged_in = new SelectionCheck () {
+-            halign = Gtk.Align.END,
+-            valign = Gtk.Align.END
+-        };
+-
+-        logged_in_context = logged_in.get_style_context ();
+-
+         if (lightdm_user.logged_in) {
++            var logged_in = new Gtk.Image.from_icon_name ("selection-checked", Gtk.IconSize.LARGE_TOOLBAR);
++            logged_in.halign = logged_in.valign = Gtk.Align.END;
++
+             avatar_overlay.add_overlay (logged_in);
+ 
+             session_button.sensitive = false;
+@@ -304,7 +299,6 @@ public class Greeter.UserCard : Greeter.BaseCard {
+         gtksettings.gtk_theme_name = "io.elementary.stylesheet." + accent_to_string (prefers_accent_color);
+ 
+         var style_provider = Gtk.CssProvider.get_named (gtksettings.gtk_theme_name, null);
+-        logged_in_context.add_provider (style_provider, Gtk.STYLE_PROVIDER_PRIORITY_APPLICATION);
+         password_entry_context.add_provider (style_provider, Gtk.STYLE_PROVIDER_PRIORITY_APPLICATION);
+     }
+ 
+@@ -451,21 +445,4 @@ public class Greeter.UserCard : Greeter.BaseCard {
+             return GLib.Source.REMOVE;
+         });
+     }
+-
+-    private class SelectionCheck : Gtk.Spinner {
+-        private static Gtk.CssProvider check_provider;
+-
+-        class construct {
+-            set_css_name (Gtk.STYLE_CLASS_CHECK);
+-        }
+-
+-        static construct {
+-            check_provider = new Gtk.CssProvider ();
+-            check_provider.load_from_resource ("/io/elementary/greeter/Check.css");
+-        }
+-
+-        construct {
+-            get_style_context ().add_provider (check_provider, Gtk.STYLE_PROVIDER_PRIORITY_USER);
+-        }
+-    }
+ }
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/elementary-onboarding/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/elementary-onboarding/default.nix
index e7a3d10b4f..c5c8810c6c 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/elementary-onboarding/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/elementary-onboarding/default.nix
@@ -26,15 +26,26 @@ stdenv.mkDerivation rec {
   pname = "elementary-onboarding";
   version = "6.1.0";
 
-  repoName = "onboarding";
-
   src = fetchFromGitHub {
     owner = "elementary";
-    repo = repoName;
+    repo = "onboarding";
     rev = version;
     sha256 = "sha256-9voy9eje3VlV4IMM664EyjKWTfSVogX5JoRCqhsUXTE=";
   };
 
+  patches = [
+    (substituteAll {
+      src = ./fix-paths.patch;
+      appcenter = appcenter;
+    })
+    # Provides the directory where the locales are actually installed
+    # https://github.com/elementary/onboarding/pull/147
+    (fetchpatch {
+      url = "https://github.com/elementary/onboarding/commit/af19c3dbefd1c0e0ec18eddacc1f21cb991f5513.patch";
+      sha256 = "sha256-fSFfjSd33W7rXXEUHY8b3rv9B9c31XfCjxjRxBBrqjs=";
+    })
+  ];
+
   nativeBuildInputs = [
     gettext
     meson
@@ -56,19 +67,6 @@ stdenv.mkDerivation rec {
     libhandy
   ];
 
-  patches = [
-    (substituteAll {
-      src = ./fix-paths.patch;
-      appcenter = appcenter;
-    })
-    # Provides the directory where the locales are actually installed
-    # https://github.com/elementary/onboarding/pull/147
-    (fetchpatch {
-      url = "https://github.com/elementary/onboarding/commit/af19c3dbefd1c0e0ec18eddacc1f21cb991f5513.patch";
-      sha256 = "sha256-fSFfjSd33W7rXXEUHY8b3rv9B9c31XfCjxjRxBBrqjs=";
-    })
-  ];
-
   postPatch = ''
     chmod +x meson/post_install.py
     patchShebangs meson/post_install.py
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/elementary-print-shim/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/elementary-print-shim/default.nix
index 119d5be213..cc25419f2e 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/elementary-print-shim/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/elementary-print-shim/default.nix
@@ -13,21 +13,13 @@ stdenv.mkDerivation rec {
   pname = "elementary-print-shim";
   version = "0.1.3";
 
-  repoName = "print";
-
   src = fetchFromGitHub {
     owner = "elementary";
-    repo = repoName;
+    repo = "print";
     rev = version;
     sha256 = "sha256-l2IUu9Mj22lZ5yajPcsGrJcJDakNu4srCV0Qea5ybPA=";
   };
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
-
   nativeBuildInputs = [
     meson
     ninja
@@ -37,6 +29,12 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ gtk3 ];
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
   meta = with lib; {
     description = "Simple shim for printing support via Contractor";
     homepage = "https://github.com/elementary/print";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/elementary-session-settings/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/elementary-session-settings/default.nix
index 2c0d2ae100..bf466c4d59 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/elementary-session-settings/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/elementary-session-settings/default.nix
@@ -80,7 +80,7 @@ let
     Name=Pantheon
     Comment=This session provides elementary experience
     Exec=@out@/libexec/pantheon
-    TryExec=${wingpanel}/bin/wingpanel
+    TryExec=${wingpanel}/bin/io.elementary.wingpanel
     Icon=
     DesktopNames=Pantheon
     Type=Application
@@ -92,11 +92,9 @@ stdenv.mkDerivation rec {
   pname = "elementary-session-settings";
   version = "6.0.0";
 
-  repoName = "session-settings";
-
   src = fetchFromGitHub {
     owner = "elementary";
-    repo = repoName;
+    repo = "session-settings";
     rev = version;
     sha256 = "1faglpa7q3a4335gnd074a3lnsdspyjdnskgy4bfnf6xmwjx7kjx";
   };
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel-indicators/a11y/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel-indicators/a11y/default.nix
index 7ffc2cebab..eab86136c7 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel-indicators/a11y/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel-indicators/a11y/default.nix
@@ -34,12 +34,6 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
-
   nativeBuildInputs = [
     meson
     ninja
@@ -60,6 +54,12 @@ stdenv.mkDerivation rec {
     patchShebangs meson/post_install.py
   '';
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
   meta = with lib; {
     description = "Universal Access Indicator for Wingpanel";
     homepage = "https://github.com/elementary/wingpanel-indicator-a11y";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel-indicators/bluetooth/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel-indicators/bluetooth/default.nix
index 56d59ed461..605b4b7709 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel-indicators/bluetooth/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel-indicators/bluetooth/default.nix
@@ -27,12 +27,6 @@ stdenv.mkDerivation rec {
     sha256 = "12rasf8wy3cqnfjlm9s2qnx4drzx0w0yviagkng3kspdzm3vzsqy";
   };
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
-
   nativeBuildInputs = [
     glib # for glib-compile-schemas
     libxml2
@@ -57,6 +51,12 @@ stdenv.mkDerivation rec {
     patchShebangs meson/post_install.py
   '';
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
   meta = with lib; {
     description = "Bluetooth Indicator for Wingpanel";
     homepage = "https://github.com/elementary/wingpanel-indicator-bluetooth";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel-indicators/keyboard/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel-indicators/keyboard/default.nix
index 4ce8fb0434..b36a95e8b2 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel-indicators/keyboard/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel-indicators/keyboard/default.nix
@@ -29,11 +29,18 @@ stdenv.mkDerivation rec {
     sha256 = "10zzsil5l6snz47nx887r22sl2n0j6bg4dhxmgk3j3xp3jhgmrgl";
   };
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
+  patches = [
+    (substituteAll {
+      src = ./fix-paths.patch;
+      gkbd_keyboard_display = "${libgnomekbd}/bin/gkbd-keyboard-display";
+    })
+    # Upstream code not respecting our localedir
+    # https://github.com/elementary/wingpanel-indicator-keyboard/pull/110
+    (fetchpatch {
+      url = "https://github.com/elementary/wingpanel-indicator-keyboard/commit/ea5df2f62a99a216ee5ed137268e710490a852a4.patch";
+      sha256 = "0fmdz10xgzsryj0f0dnpjrh9yygjkb91a7pxg0rwddxbprhnr7j0";
+    })
+  ];
 
   nativeBuildInputs = [
     meson
@@ -52,18 +59,11 @@ stdenv.mkDerivation rec {
     xorg.xkeyboardconfig
   ];
 
-  patches = [
-    (substituteAll {
-      src = ./fix-paths.patch;
-      gkbd_keyboard_display = "${libgnomekbd}/bin/gkbd-keyboard-display";
-    })
-    # Upstream code not respecting our localedir
-    # https://github.com/elementary/wingpanel-indicator-keyboard/pull/110
-    (fetchpatch {
-      url = "https://github.com/elementary/wingpanel-indicator-keyboard/commit/ea5df2f62a99a216ee5ed137268e710490a852a4.patch";
-      sha256 = "0fmdz10xgzsryj0f0dnpjrh9yygjkb91a7pxg0rwddxbprhnr7j0";
-    })
-  ];
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
 
   meta = with lib; {
     description = "Keyboard Indicator for Wingpanel";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel-indicators/nightlight/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel-indicators/nightlight/default.nix
index ecaa05bc35..9261bccd51 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel-indicators/nightlight/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel-indicators/nightlight/default.nix
@@ -34,12 +34,6 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
-
   nativeBuildInputs = [
     libxml2
     meson
@@ -55,6 +49,12 @@ stdenv.mkDerivation rec {
     wingpanel
   ];
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
   meta = with lib; {
     description = "Night Light Indicator for Wingpanel";
     homepage = "https://github.com/elementary/wingpanel-indicator-nightlight";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel-indicators/power/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel-indicators/power/default.nix
index 38a8fb2370..6c300536b2 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel-indicators/power/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel-indicators/power/default.nix
@@ -30,11 +30,12 @@ stdenv.mkDerivation rec {
     sha256 = "1zlpnl7983jkpy2nik08ih8lwrqvm456h993ixa6armzlazdvnjk";
   };
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
+  patches = [
+    (substituteAll {
+      src = ./fix-paths.patch;
+      gnome_power_manager = gnome.gnome-power-manager;
+    })
+  ];
 
   nativeBuildInputs = [
     meson
@@ -55,18 +56,17 @@ stdenv.mkDerivation rec {
     wingpanel
   ];
 
-  patches = [
-    (substituteAll {
-      src = ./fix-paths.patch;
-      gnome_power_manager = gnome.gnome-power-manager;
-    })
-  ];
-
   postPatch = ''
     chmod +x meson/post_install.py
     patchShebangs meson/post_install.py
   '';
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
   meta = with lib; {
     description = "Power Indicator for Wingpanel";
     homepage = "https://github.com/elementary/wingpanel-indicator-power";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel-indicators/session/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel-indicators/session/default.nix
index 510558f3cb..41039ff686 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel-indicators/session/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel-indicators/session/default.nix
@@ -35,12 +35,6 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
-
   nativeBuildInputs = [
     meson
     ninja
@@ -57,6 +51,12 @@ stdenv.mkDerivation rec {
     wingpanel
   ];
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
   meta = with lib; {
     description = "Session Indicator for Wingpanel";
     homepage = "https://github.com/elementary/wingpanel-indicator-session";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel/default.nix
index 0cd7a13c3e..2e3f51b4a6 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel/default.nix
@@ -31,6 +31,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-WvkQx+9YjKCINpyVg8KjCV0GAb0rJfblSFaO14/4oas=";
   };
 
+  patches = [
+    ./indicators.patch
+  ];
+
   nativeBuildInputs = [
     gettext
     meson
@@ -53,10 +57,6 @@ stdenv.mkDerivation rec {
     mesa # for libEGL
   ];
 
-  patches = [
-    ./indicators.patch
-  ];
-
   postPatch = ''
     chmod +x meson/post_install.py
     patchShebangs meson/post_install.py
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/services/contractor/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/services/contractor/default.nix
index a6c0cb8a3c..ba00be72e2 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/services/contractor/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/services/contractor/default.nix
@@ -25,12 +25,6 @@ stdenv.mkDerivation rec {
     sha256 = "1sqww7zlzl086pjww3d21ah1g78lfrc9aagrqhmsnnbji9gwb8ab";
   };
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
-
   nativeBuildInputs = [
     dbus
     meson
@@ -49,6 +43,12 @@ stdenv.mkDerivation rec {
 
   PKG_CONFIG_DBUS_1_SESSION_BUS_SERVICES_DIR = "${placeholder "out"}/share/dbus-1/services";
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
   meta = with lib; {
     description = "A desktop-wide extension service used by elementary OS";
     homepage = "https://github.com/elementary/contractor";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/services/elementary-notifications/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/services/elementary-notifications/default.nix
index 2ea13c9cb5..5a78bb9c8a 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/services/elementary-notifications/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/services/elementary-notifications/default.nix
@@ -19,11 +19,9 @@ stdenv.mkDerivation rec {
   pname = "elementary-notifications";
   version = "6.0.0";
 
-  repoName = "notifications";
-
   src = fetchFromGitHub {
     owner = "elementary";
-    repo = repoName;
+    repo = "notifications";
     rev = version;
     sha256 = "0jfppafbc8jwhhnillylicz4zfds789d8b31ifsx0qijlxa7kji9";
   };
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix
index 69a0c2a7bb..ff0cc92da3 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix
@@ -23,11 +23,9 @@ stdenv.mkDerivation rec {
   pname = "elementary-settings-daemon";
   version = "1.1.0";
 
-  repoName = "settings-daemon";
-
   src = fetchFromGitHub {
     owner = "elementary";
-    repo = repoName;
+    repo = "settings-daemon";
     rev = version;
     sha256 = "sha256-1Xp1uJzDFuGZlhJhKj00cYtb4Q1syMAm+82fTOtk0VI=";
   };
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/services/pantheon-agent-geoclue2/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/services/pantheon-agent-geoclue2/default.nix
index c135ea4e18..005ae0a461 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/services/pantheon-agent-geoclue2/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/services/pantheon-agent-geoclue2/default.nix
@@ -25,12 +25,6 @@ stdenv.mkDerivation rec {
     sha256 = "0hx3sky0vd2vshkscy3w5x3s18gd45cfqh510xhbmvc0sa32q9gd";
   };
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
-
   nativeBuildInputs = [
     desktop-file-utils
     meson
@@ -51,6 +45,12 @@ stdenv.mkDerivation rec {
     ${glib.dev}/bin/glib-compile-schemas $out/share/glib-2.0/schemas
   '';
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
   meta = with lib; {
     description = "Pantheon Geoclue2 Agent";
     homepage = "https://github.com/elementary/pantheon-agent-geoclue2";
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/services/pantheon-agent-polkit/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/services/pantheon-agent-polkit/default.nix
index 3644d9665d..b009954bc8 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/services/pantheon-agent-polkit/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/services/pantheon-agent-polkit/default.nix
@@ -24,12 +24,6 @@ stdenv.mkDerivation rec {
     sha256 = "1acqjjarl225yk0f68wkldsamcrzrj0ibpcxma04wq9w7jlmz60c";
   };
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
-
   nativeBuildInputs = [
     meson
     ninja
@@ -45,6 +39,12 @@ stdenv.mkDerivation rec {
     polkit
   ];
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
   meta = with lib; {
     description = "Polkit Agent for the Pantheon Desktop";
     homepage = "https://github.com/elementary/pantheon-agent-polkit";
diff --git a/third_party/nixpkgs/pkgs/development/compilers/gleam/default.nix b/third_party/nixpkgs/pkgs/development/compilers/gleam/default.nix
index e766683f02..891751a6ad 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/gleam/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/gleam/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gleam";
-  version = "0.18.2";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "gleam-lang";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-uakZmaIkBgC/FTQ7us58pJT6IzpcF1cQxBfehlB3bWk=";
+    sha256 = "sha256-pJ4RSijuwdKAL24WzcDIQen1RGofN1tUlbAA18zUvBE=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ] ++
     lib.optionals stdenv.isDarwin [ Security libiconv ];
 
-  cargoSha256 = "sha256-NogDrd7YWl/CV0aCd1jfYWYB9VZG7u890VLEktI3sOQ=";
+  cargoSha256 = "sha256-f/6LdvKRykpBX2GlRuyUcSD719f6XzhbMHzhrGNU0Cg=";
 
   meta = with lib; {
     description = "A statically typed language for the Erlang VM";
diff --git a/third_party/nixpkgs/pkgs/development/compilers/glslang/default.nix b/third_party/nixpkgs/pkgs/development/compilers/glslang/default.nix
index 97092950c6..7295db0d9d 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/glslang/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/glslang/default.nix
@@ -31,6 +31,11 @@ stdenv.mkDerivation rec {
     ln -s "${spirv-headers.src}" External/spirv-tools/external/spirv-headers
   '';
 
+  # This is a dirty fix for lib/cmake/SPIRVTargets.cmake:51 which includes this directory
+  postInstall = ''
+    mkdir $out/include/External
+  '';
+
   meta = with lib; {
     inherit (src.meta) homepage;
     description = "Khronos reference front-end for GLSL and ESSL";
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/10/clang/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/10/clang/default.nix
index b42f40b969..5336e4ea35 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/10/clang/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/10/clang/default.nix
@@ -29,7 +29,6 @@ let
       "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
-      "-DLLVM_CONFIG_PATH=${libllvm.dev}/bin/llvm-config${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-native"}"
     ] ++ lib.optionals enableManpages [
       "-DCLANG_INCLUDE_DOCS=ON"
       "-DLLVM_ENABLE_SPHINX=ON"
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/10/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/10/default.nix
index 8bd7e937e7..5cb6c27865 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/10/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/10/default.nix
@@ -89,7 +89,11 @@ let
     #   python3 = pkgs.python3;  # don't use python-boot
     # });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/10/llvm/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/10/llvm/default.nix
index b40d3070c0..bb1b90b36a 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/10/llvm/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/10/llvm/default.nix
@@ -57,6 +57,12 @@ in stdenv.mkDerivation (rec {
   propagatedBuildInputs = [ ncurses zlib ];
 
   patches = [
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     ./gnu-install-dirs.patch
     # On older CPUs (e.g. Hydra/wendy) we'd be getting an error in this test.
     (fetchpatch {
@@ -93,11 +99,6 @@ in stdenv.mkDerivation (rec {
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
@@ -122,6 +123,32 @@ in stdenv.mkDerivation (rec {
     rm test/ExecutionEngine/frem.ll
   '' + ''
     patchShebangs test/BugPoint/compile-custom.ll.py
+  '' + ''
+    # Tweak tests to ignore namespace part of type to support
+    # gcc-12: https://gcc.gnu.org/PR103598.
+    # The change below mangles strings like:
+    #    CHECK-NEXT: Starting llvm::Function pass manager run.
+    # to:
+    #    CHECK-NEXT: Starting {{.*}}Function pass manager run.
+    for f in \
+      test/Other/new-pass-manager.ll \
+      test/Other/new-pm-defaults.ll \
+      test/Other/new-pm-lto-defaults.ll \
+      test/Other/new-pm-thinlto-defaults.ll \
+      test/Other/pass-pipeline-parsing.ll \
+      test/Transforms/Inline/cgscc-incremental-invalidate.ll \
+      test/Transforms/Inline/clear-analyses.ll \
+      test/Transforms/LoopUnroll/unroll-loop-invalidation.ll \
+      test/Transforms/SCCP/ipsccp-preserve-analysis.ll \
+      test/Transforms/SCCP/preserve-analysis.ll \
+      test/Transforms/SROA/dead-inst.ll \
+      test/tools/gold/X86/new-pm.ll \
+      ; do
+      echo "PATCH: $f"
+      substituteInPlace $f \
+        --replace 'Starting llvm::' 'Starting {{.*}}' \
+        --replace 'Finished llvm::' 'Finished {{.*}}'
+    done
   '';
 
   # hacky fix: created binaries need to be run before installation
@@ -130,18 +157,28 @@ in stdenv.mkDerivation (rec {
     ln -sv $PWD/lib $out
   '';
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=ON"
+    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals enableSharedLibraries [
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
   ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -167,7 +204,21 @@ in stdenv.mkDerivation (rec {
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
@@ -197,7 +248,8 @@ in stdenv.mkDerivation (rec {
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32);
+  doCheck = stdenv.isLinux && (!stdenv.isx86_32)
+    && (stdenv.hostPlatform == stdenv.buildPlatform);
 
   checkTarget = "check-all";
 
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/10/llvm/outputs.patch b/third_party/nixpkgs/pkgs/development/compilers/llvm/10/llvm/outputs.patch
deleted file mode 100644
index 878460e05b..0000000000
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/10/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/11/clang/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/11/clang/default.nix
index f2236aee45..58439f02a5 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/11/clang/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/11/clang/default.nix
@@ -31,7 +31,6 @@ let
       "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
-      "-DLLVM_CONFIG_PATH=${libllvm.dev}/bin/llvm-config${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-native"}"
     ] ++ lib.optionals enableManpages [
       "-DCLANG_INCLUDE_DOCS=ON"
       "-DLLVM_ENABLE_SPHINX=ON"
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/11/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/11/default.nix
index ebd0dc672a..82a78af85c 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/11/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/11/default.nix
@@ -104,7 +104,11 @@ let
     #   python3 = pkgs.python3;  # don't use python-boot
     # });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/11/llvm/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/11/llvm/default.nix
index 8d14ee131b..e8cfd23faa 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/11/llvm/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/11/llvm/default.nix
@@ -57,6 +57,12 @@ in stdenv.mkDerivation (rec {
   propagatedBuildInputs = [ ncurses zlib ];
 
   patches = [
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     ./gnu-install-dirs.patch
     # On older CPUs (e.g. Hydra/wendy) we'd be getting an error in this test.
     (fetchpatch {
@@ -91,11 +97,6 @@ in stdenv.mkDerivation (rec {
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
@@ -120,6 +121,32 @@ in stdenv.mkDerivation (rec {
     rm test/ExecutionEngine/frem.ll
   '' + ''
     patchShebangs test/BugPoint/compile-custom.ll.py
+  '' + ''
+    # Tweak tests to ignore namespace part of type to support
+    # gcc-12: https://gcc.gnu.org/PR103598.
+    # The change below mangles strings like:
+    #    CHECK-NEXT: Starting llvm::Function pass manager run.
+    # to:
+    #    CHECK-NEXT: Starting {{.*}}Function pass manager run.
+    for f in \
+      test/Other/new-pass-manager.ll \
+      test/Other/new-pm-defaults.ll \
+      test/Other/new-pm-lto-defaults.ll \
+      test/Other/new-pm-thinlto-defaults.ll \
+      test/Other/pass-pipeline-parsing.ll \
+      test/Transforms/Inline/cgscc-incremental-invalidate.ll \
+      test/Transforms/Inline/clear-analyses.ll \
+      test/Transforms/LoopUnroll/unroll-loop-invalidation.ll \
+      test/Transforms/SCCP/ipsccp-preserve-analysis.ll \
+      test/Transforms/SCCP/preserve-analysis.ll \
+      test/Transforms/SROA/dead-inst.ll \
+      test/tools/gold/X86/new-pm.ll \
+      ; do
+      echo "PATCH: $f"
+      substituteInPlace $f \
+        --replace 'Starting llvm::' 'Starting {{.*}}' \
+        --replace 'Finished llvm::' 'Finished {{.*}}'
+    done
   '';
 
   # hacky fix: created binaries need to be run before installation
@@ -131,18 +158,38 @@ in stdenv.mkDerivation (rec {
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=ON"
+    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals enableSharedLibraries [
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
+  ] ++ optionals stdenv.hostPlatform.isStatic [
+    # Disables building of shared libs, -fPIC is still injected by cc-wrapper
+    "-DLLVM_ENABLE_PIC=OFF"
+    "-DLLVM_BUILD_STATIC=ON"
+    # libxml2 needs to be disabled because the LLVM build system ignores its .la
+    # file and doesn't link zlib as well.
+    # https://github.com/ClangBuiltLinux/tc-build/issues/150#issuecomment-845418812
+    "-DLLVM_ENABLE_LIBXML2=OFF"
+    # This is a Shared Library not tied to LLVM_ENABLE_PIC
+    "-DLLVM_TOOL_REMARKS_SHLIB_BUILD=OFF"
   ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -168,7 +215,21 @@ in stdenv.mkDerivation (rec {
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
@@ -198,7 +259,8 @@ in stdenv.mkDerivation (rec {
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl) && (!stdenv.hostPlatform.isRiscV);
+  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl) && (!stdenv.hostPlatform.isRiscV)
+    && (stdenv.hostPlatform == stdenv.buildPlatform);
 
   checkTarget = "check-all";
 
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/11/llvm/outputs.patch b/third_party/nixpkgs/pkgs/development/compilers/llvm/11/llvm/outputs.patch
deleted file mode 100644
index 878460e05b..0000000000
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/11/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/12/clang/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/12/clang/default.nix
index a411234959..0f1e160bbc 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/12/clang/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/12/clang/default.nix
@@ -32,7 +32,6 @@ let
       "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
-      "-DLLVM_CONFIG_PATH=${libllvm.dev}/bin/llvm-config${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-native"}"
     ] ++ lib.optionals enableManpages [
       "-DCLANG_INCLUDE_DOCS=ON"
       "-DLLVM_ENABLE_SPHINX=ON"
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/12/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/12/default.nix
index e68522faea..4a2a7ee878 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/12/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/12/default.nix
@@ -92,7 +92,11 @@ let
     #   python3 = pkgs.python3;  # don't use python-boot
     # });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/12/llvm/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/12/llvm/default.nix
index bb5676b9d4..2c035ee67a 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/12/llvm/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/12/llvm/default.nix
@@ -58,6 +58,15 @@ in stdenv.mkDerivation (rec {
     ++ [ zlib ];
 
   patches = [
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+    # Fix llvm being miscompiled by some gccs. See llvm/llvm-project#49955
+    # Fix llvm being miscompiled by some gccs. See https://github.com/llvm/llvm-project/issues/49955
+    ./fix-llvm-issue-49955.patch
+
     ./gnu-install-dirs.patch
     # On older CPUs (e.g. Hydra/wendy) we'd be getting an error in this test.
     (fetchpatch {
@@ -72,11 +81,6 @@ in stdenv.mkDerivation (rec {
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
@@ -105,6 +109,33 @@ in stdenv.mkDerivation (rec {
     rm test/ExecutionEngine/frem.ll
   '' + ''
     patchShebangs test/BugPoint/compile-custom.ll.py
+  '' + ''
+    # Tweak tests to ignore namespace part of type to support
+    # gcc-12: https://gcc.gnu.org/PR103598.
+    # The change below mangles strings like:
+    #    CHECK-NEXT: Starting llvm::Function pass manager run.
+    # to:
+    #    CHECK-NEXT: Starting {{.*}}Function pass manager run.
+    for f in \
+      test/Other/new-pass-manager.ll \
+      test/Other/new-pm-O0-defaults.ll \
+      test/Other/new-pm-defaults.ll \
+      test/Other/new-pm-lto-defaults.ll \
+      test/Other/new-pm-thinlto-defaults.ll \
+      test/Other/pass-pipeline-parsing.ll \
+      test/Transforms/Inline/cgscc-incremental-invalidate.ll \
+      test/Transforms/Inline/clear-analyses.ll \
+      test/Transforms/LoopUnroll/unroll-loop-invalidation.ll \
+      test/Transforms/SCCP/ipsccp-preserve-analysis.ll \
+      test/Transforms/SCCP/preserve-analysis.ll \
+      test/Transforms/SROA/dead-inst.ll \
+      test/tools/gold/X86/new-pm.ll \
+      ; do
+      echo "PATCH: $f"
+      substituteInPlace $f \
+        --replace 'Starting llvm::' 'Starting {{.*}}' \
+        --replace 'Finished llvm::' 'Finished {{.*}}'
+    done
   '';
 
   # hacky fix: created binaries need to be run before installation
@@ -116,18 +147,36 @@ in stdenv.mkDerivation (rec {
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=ON"
+    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals enableSharedLibraries [
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
+  ] ++ optionals stdenv.hostPlatform.isStatic [
+    # Disables building of shared libs, -fPIC is still injected by cc-wrapper
+    "-DLLVM_ENABLE_PIC=OFF"
+    "-DLLVM_BUILD_STATIC=ON"
+    # libxml2 needs to be disabled because the LLVM build system ignores its .la
+    # file and doesn't link zlib as well.
+    # https://github.com/ClangBuiltLinux/tc-build/issues/150#issuecomment-845418812
+    "-DLLVM_ENABLE_LIBXML2=OFF"
   ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -153,7 +202,21 @@ in stdenv.mkDerivation (rec {
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
@@ -183,7 +246,8 @@ in stdenv.mkDerivation (rec {
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl);
+  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
+    && (stdenv.hostPlatform == stdenv.buildPlatform);
 
   checkTarget = "check-all";
 
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/12/llvm/fix-llvm-issue-49955.patch b/third_party/nixpkgs/pkgs/development/compilers/llvm/12/llvm/fix-llvm-issue-49955.patch
new file mode 100644
index 0000000000..b515583a0c
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/12/llvm/fix-llvm-issue-49955.patch
@@ -0,0 +1,13 @@
+diff --git a/lib/CodeGen/AsmPrinter/CMakeLists.txt b/lib/CodeGen/AsmPrinter/CMakeLists.txt
+index eb924282..c77c140b 100644
+--- a/lib/CodeGen/AsmPrinter/CMakeLists.txt
++++ b/lib/CodeGen/AsmPrinter/CMakeLists.txt
+@@ -44,3 +44,8 @@ add_llvm_component_library(LLVMAsmPrinter
+   Support
+   Target
+   )
++
++if (CMAKE_COMPILER_IS_GNUCXX)
++  set_source_files_properties(DwarfCompileUnit.cpp PROPERTIES
++                              COMPILE_FLAGS -fno-strict-aliasing)
++endif()
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/12/llvm/outputs.patch b/third_party/nixpkgs/pkgs/development/compilers/llvm/12/llvm/outputs.patch
deleted file mode 100644
index 878460e05b..0000000000
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/12/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/13/clang/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/13/clang/default.nix
index 2429958397..6c227f1ae7 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/13/clang/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/13/clang/default.nix
@@ -22,7 +22,6 @@ let
       "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
-      "-DLLVM_CONFIG_PATH=${libllvm.dev}/bin/llvm-config${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-native"}"
     ] ++ lib.optionals enableManpages [
       "-DCLANG_INCLUDE_DOCS=ON"
       "-DLLVM_ENABLE_SPHINX=ON"
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/13/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/13/default.nix
index a89c6dabe3..be5e9404cd 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/13/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/13/default.nix
@@ -93,7 +93,11 @@ let
     #   python3 = pkgs.python3;  # don't use python-boot
     # });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/13/llvm/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/13/llvm/default.nix
index 115b56396e..abfb2b36d1 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/13/llvm/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/13/llvm/default.nix
@@ -52,6 +52,12 @@ in stdenv.mkDerivation (rec {
   checkInputs = [ which ];
 
   patches = [
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     ./gnu-install-dirs.patch
 
     # Fix random compiler crashes: https://bugs.llvm.org/show_bug.cgi?id=50611
@@ -66,11 +72,6 @@ in stdenv.mkDerivation (rec {
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
@@ -109,18 +110,36 @@ in stdenv.mkDerivation (rec {
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=ON"
+    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals enableSharedLibraries [
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
+  ] ++ optionals stdenv.hostPlatform.isStatic [
+    # Disables building of shared libs, -fPIC is still injected by cc-wrapper
+    "-DLLVM_ENABLE_PIC=OFF"
+    "-DLLVM_BUILD_STATIC=ON"
+    # libxml2 needs to be disabled because the LLVM build system ignores its .la
+    # file and doesn't link zlib as well.
+    # https://github.com/ClangBuiltLinux/tc-build/issues/150#issuecomment-845418812
+    "-DLLVM_ENABLE_LIBXML2=OFF"
   ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -146,7 +165,21 @@ in stdenv.mkDerivation (rec {
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
@@ -176,7 +209,8 @@ in stdenv.mkDerivation (rec {
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl);
+  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
+    && (stdenv.hostPlatform == stdenv.buildPlatform);
 
   checkTarget = "check-all";
 
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/13/llvm/outputs.patch b/third_party/nixpkgs/pkgs/development/compilers/llvm/13/llvm/outputs.patch
deleted file mode 100644
index 878460e05b..0000000000
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/13/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/5/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/5/default.nix
index 4593580b72..ef9886fb5e 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/5/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/5/default.nix
@@ -65,7 +65,11 @@ let
       python3 = pkgs.python3;  # don't use python-boot
     });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/5/llvm/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/5/llvm/default.nix
index 339c7a3693..cf668cd566 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/5/llvm/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/5/llvm/default.nix
@@ -27,7 +27,7 @@ let
     imap (i: _: concatStringsSep "." (take i parts)) parts;
 in
 
-stdenv.mkDerivation ({
+stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
 
@@ -65,6 +65,13 @@ stdenv.mkDerivation ({
     #  sha256 = "0injj1hqgrbcbihhwp2nbal88jfykad30r54f2cdcx7gws2fcy8i";
     #  stripLen = 1;
     #})
+
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     ./gnu-install-dirs.patch
 
     # Fix invalid std::string(nullptr) for GCC 12
@@ -80,11 +87,6 @@ stdenv.mkDerivation ({
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
@@ -100,6 +102,27 @@ stdenv.mkDerivation ({
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "add_subdirectory(DynamicLibrary)" ""
     rm unittests/Support/DynamicLibrary/DynamicLibraryTest.cpp
+  '' + ''
+    # Tweak tests to ignore namespace part of type to support
+    # gcc-12: https://gcc.gnu.org/PR103598.
+    # The change below mangles strings like:
+    #    CHECK-NEXT: Starting llvm::Function pass manager run.
+    # to:
+    #    CHECK-NEXT: Starting {{.*}}Function pass manager run.
+    for f in \
+      test/Other/new-pass-manager.ll \
+      test/Other/new-pm-defaults.ll \
+      test/Other/new-pm-lto-defaults.ll \
+      test/Other/new-pm-thinlto-defaults.ll \
+      test/Other/pass-pipeline-parsing.ll \
+      test/Transforms/Inline/cgscc-incremental-invalidate.ll \
+      test/Transforms/Inline/clear-analyses.ll \
+      ; do
+      echo "PATCH: $f"
+      substituteInPlace $f \
+        --replace 'Starting llvm::' 'Starting {{.*}}' \
+        --replace 'Finished llvm::' 'Finished {{.*}}'
+    done
   '';
 
   # hacky fix: created binaries need to be run before installation
@@ -108,20 +131,30 @@ stdenv.mkDerivation ({
     ln -sv $PWD/lib $out
   '';
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=ON"
+    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
 
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DTARGET_TRIPLE=${stdenv.hostPlatform.config}"
   ]
-  ++ lib.optional enableSharedLibraries
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
   ++ lib.optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -148,7 +181,21 @@ stdenv.mkDerivation ({
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
@@ -179,7 +226,8 @@ stdenv.mkDerivation ({
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isi686);
+  doCheck = stdenv.isLinux && (!stdenv.isi686)
+    && (stdenv.hostPlatform == stdenv.buildPlatform);
 
   checkTarget = "check-all";
 
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/5/llvm/outputs.patch b/third_party/nixpkgs/pkgs/development/compilers/llvm/5/llvm/outputs.patch
deleted file mode 100644
index 878460e05b..0000000000
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/5/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/6/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/6/default.nix
index 9b1caf410b..4acfe6cd85 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/6/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/6/default.nix
@@ -66,7 +66,11 @@ let
       python3 = pkgs.python3;  # don't use python-boot
     });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/6/llvm/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/6/llvm/default.nix
index 5847d50a6f..61f9234274 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/6/llvm/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/6/llvm/default.nix
@@ -27,7 +27,7 @@ let
     imap (i: _: concatStringsSep "." (take i parts)) parts;
 in
 
-stdenv.mkDerivation ({
+stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
 
@@ -63,6 +63,13 @@ stdenv.mkDerivation ({
       includes = [ "test/tools/gold/X86/common.ll" ];
       sha256 = "0fxgrxmfnjx17w3lcq19rk68b2xksh1bynz3ina784kma7hp4wdb";
     })
+
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     ./gnu-install-dirs.patch
 
     # Fix invalid std::string(nullptr) for GCC 12
@@ -78,11 +85,6 @@ stdenv.mkDerivation ({
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
@@ -93,6 +95,29 @@ stdenv.mkDerivation ({
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "add_subdirectory(DynamicLibrary)" ""
     rm unittests/Support/DynamicLibrary/DynamicLibraryTest.cpp
+  '' + ''
+    # Tweak tests to ignore namespace part of type to support
+    # gcc-12: https://gcc.gnu.org/PR103598.
+    # The change below mangles strings like:
+    #    CHECK-NEXT: Starting llvm::Function pass manager run.
+    # to:
+    #    CHECK-NEXT: Starting {{.*}}Function pass manager run.
+    for f in \
+      test/Other/new-pass-manager.ll \
+      test/Other/new-pm-defaults.ll \
+      test/Other/new-pm-lto-defaults.ll \
+      test/Other/new-pm-thinlto-defaults.ll \
+      test/Other/pass-pipeline-parsing.ll \
+      test/Transforms/Inline/cgscc-incremental-invalidate.ll \
+      test/Transforms/Inline/clear-analyses.ll \
+      test/Transforms/LoopUnroll/unroll-loop-invalidation.ll \
+      test/Transforms/SROA/dead-inst.ll \
+      ; do
+      echo "PATCH: $f"
+      substituteInPlace $f \
+        --replace 'Starting llvm::' 'Starting {{.*}}' \
+        --replace 'Finished llvm::' 'Finished {{.*}}'
+    done
   '';
 
   # hacky fix: created binaries need to be run before installation
@@ -101,19 +126,29 @@ stdenv.mkDerivation ({
     ln -sv $PWD/lib $out
   '';
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=ON"
+    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_EXPERIMENTAL_TARGETS_TO_BUILD=WebAssembly"
     "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals enableSharedLibraries [
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
   ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -139,7 +174,21 @@ stdenv.mkDerivation ({
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
@@ -170,7 +219,8 @@ stdenv.mkDerivation ({
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isi686);
+  doCheck = stdenv.isLinux && (!stdenv.isi686)
+    && (stdenv.hostPlatform == stdenv.buildPlatform);
 
   checkTarget = "check-all";
 
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/6/llvm/outputs.patch b/third_party/nixpkgs/pkgs/development/compilers/llvm/6/llvm/outputs.patch
deleted file mode 100644
index 878460e05b..0000000000
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/6/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/7/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/7/default.nix
index d014c043a8..f0908f3077 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/7/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/7/default.nix
@@ -96,7 +96,11 @@ let
       python3 = pkgs.python3;  # don't use python-boot
     });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/7/llvm/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/7/llvm/default.nix
index cfa4fdf7ac..b324e1a0e4 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/7/llvm/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/7/llvm/default.nix
@@ -31,7 +31,7 @@ let
     let parts = splitVersion release_version; in
     imap (i: _: concatStringsSep "." (take i parts)) parts;
 
-in stdenv.mkDerivation ({
+in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
 
@@ -67,6 +67,13 @@ in stdenv.mkDerivation ({
       url = "https://github.com/llvm-mirror/llvm/commit/cc1f2a595ead516812a6c50398f0f3480ebe031f.patch";
       sha256 = "0k6k1p5yisgwx417a67s7sr9930rqh1n0zv5jvply8vjjy4b3kf8";
     })
+
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     ./gnu-install-dirs.patch
 
     # Fix invalid std::string(nullptr) for GCC 12
@@ -82,11 +89,6 @@ in stdenv.mkDerivation ({
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
@@ -110,6 +112,31 @@ in stdenv.mkDerivation ({
     rm test/ExecutionEngine/frem.ll
   '' + ''
     patchShebangs test/BugPoint/compile-custom.ll.py
+  '' + ''
+    # Tweak tests to ignore namespace part of type to support
+    # gcc-12: https://gcc.gnu.org/PR103598.
+    # The change below mangles strings like:
+    #    CHECK-NEXT: Starting llvm::Function pass manager run.
+    # to:
+    #    CHECK-NEXT: Starting {{.*}}Function pass manager run.
+    for f in \
+      test/Other/new-pass-manager.ll \
+      test/Other/new-pm-defaults.ll \
+      test/Other/new-pm-lto-defaults.ll \
+      test/Other/new-pm-thinlto-defaults.ll \
+      test/Other/pass-pipeline-parsing.ll \
+      test/Transforms/Inline/cgscc-incremental-invalidate.ll \
+      test/Transforms/Inline/clear-analyses.ll \
+      test/Transforms/LoopUnroll/unroll-loop-invalidation.ll \
+      test/Transforms/SCCP/preserve-analysis.ll \
+      test/Transforms/SROA/dead-inst.ll \
+      test/tools/gold/X86/new-pm.ll \
+      ; do
+      echo "PATCH: $f"
+      substituteInPlace $f \
+        --replace 'Starting llvm::' 'Starting {{.*}}' \
+        --replace 'Finished llvm::' 'Finished {{.*}}'
+    done
   '';
 
   # hacky fix: created binaries need to be run before installation
@@ -118,19 +145,29 @@ in stdenv.mkDerivation ({
     ln -sv $PWD/lib $out
   '';
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=ON"
+    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_EXPERIMENTAL_TARGETS_TO_BUILD=WebAssembly"
     "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals enableSharedLibraries [
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
   ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -156,7 +193,21 @@ in stdenv.mkDerivation ({
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
@@ -187,7 +238,8 @@ in stdenv.mkDerivation ({
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32);
+  doCheck = stdenv.isLinux && (!stdenv.isx86_32)
+    && (stdenv.hostPlatform == stdenv.buildPlatform);
 
   checkTarget = "check-all";
 
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/7/llvm/outputs.patch b/third_party/nixpkgs/pkgs/development/compilers/llvm/7/llvm/outputs.patch
deleted file mode 100644
index 878460e05b..0000000000
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/7/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/8/clang/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/8/clang/default.nix
index 5cb7720d02..1d6a5b7d74 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/8/clang/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/8/clang/default.nix
@@ -30,7 +30,6 @@ let
       "-DCMAKE_CXX_FLAGS=-std=c++11"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
-      "-DLLVM_CONFIG_PATH=${libllvm.dev}/bin/llvm-config${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-native"}"
     ] ++ lib.optionals enableManpages [
       "-DCLANG_INCLUDE_DOCS=ON"
       "-DLLVM_ENABLE_SPHINX=ON"
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/8/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/8/default.nix
index 7252b75a33..43050a72b9 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/8/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/8/default.nix
@@ -97,7 +97,11 @@ let
       python3 = pkgs.python3;  # don't use python-boot
     });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/8/llvm/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/8/llvm/default.nix
index 902a379b7a..efd1707eb3 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/8/llvm/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/8/llvm/default.nix
@@ -30,7 +30,7 @@ let
   shortVersion = with lib;
     concatStringsSep "." (take 1 (splitVersion release_version));
 
-in stdenv.mkDerivation ({
+in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
 
@@ -57,6 +57,12 @@ in stdenv.mkDerivation ({
   propagatedBuildInputs = [ ncurses zlib ];
 
   patches = [
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     # Fix missing includes for GCC 10
     (fetchpatch {
       url = "https://bugs.gentoo.org/attachment.cgi?id=612792";
@@ -85,11 +91,6 @@ in stdenv.mkDerivation ({
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
@@ -104,6 +105,32 @@ in stdenv.mkDerivation ({
     rm test/CodeGen/AArch64/wineh4.mir
   '' + ''
     patchShebangs test/BugPoint/compile-custom.ll.py
+  '' + ''
+    # Tweak tests to ignore namespace part of type to support
+    # gcc-12: https://gcc.gnu.org/PR103598.
+    # The change below mangles strings like:
+    #    CHECK-NEXT: Starting llvm::Function pass manager run.
+    # to:
+    #    CHECK-NEXT: Starting {{.*}}Function pass manager run.
+    for f in \
+      test/Other/new-pass-manager.ll \
+      test/Other/new-pm-defaults.ll \
+      test/Other/new-pm-lto-defaults.ll \
+      test/Other/new-pm-thinlto-defaults.ll \
+      test/Other/pass-pipeline-parsing.ll \
+      test/Transforms/Inline/cgscc-incremental-invalidate.ll \
+      test/Transforms/Inline/clear-analyses.ll \
+      test/Transforms/LoopUnroll/unroll-loop-invalidation.ll \
+      test/Transforms/SCCP/ipsccp-preserve-analysis.ll \
+      test/Transforms/SCCP/preserve-analysis.ll \
+      test/Transforms/SROA/dead-inst.ll \
+      test/tools/gold/X86/new-pm.ll \
+      ; do
+      echo "PATCH: $f"
+      substituteInPlace $f \
+        --replace 'Starting llvm::' 'Starting {{.*}}' \
+        --replace 'Finished llvm::' 'Finished {{.*}}'
+    done
   '';
 
   # hacky fix: created binaries need to be run before installation
@@ -112,18 +139,28 @@ in stdenv.mkDerivation ({
     ln -sv $PWD/lib $out
   '';
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=ON"
+    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals enableSharedLibraries [
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
   ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -149,7 +186,21 @@ in stdenv.mkDerivation ({
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
@@ -179,7 +230,8 @@ in stdenv.mkDerivation ({
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32);
+  doCheck = stdenv.isLinux && (!stdenv.isx86_32)
+    && (stdenv.hostPlatform == stdenv.buildPlatform);
 
   checkTarget = "check-all";
 
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/8/llvm/outputs.patch b/third_party/nixpkgs/pkgs/development/compilers/llvm/8/llvm/outputs.patch
deleted file mode 100644
index 878460e05b..0000000000
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/8/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/9/clang/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/9/clang/default.nix
index c98b4a830c..ee124b43bf 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/9/clang/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/9/clang/default.nix
@@ -30,7 +30,6 @@ let
       "-DCMAKE_CXX_FLAGS=-std=c++11"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
-      "-DLLVM_CONFIG_PATH=${libllvm.dev}/bin/llvm-config${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-native"}"
     ] ++ lib.optionals enableManpages [
       "-DCLANG_INCLUDE_DOCS=ON"
       "-DLLVM_ENABLE_SPHINX=ON"
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/9/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/9/default.nix
index 9126a614b1..7efe8486a3 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/9/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/9/default.nix
@@ -97,7 +97,11 @@ let
       python3 = pkgs.python3;  # don't use python-boot
     });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/9/llvm/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/9/llvm/default.nix
index ed21ac74a1..1dd1455ed6 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/9/llvm/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/9/llvm/default.nix
@@ -57,6 +57,12 @@ in stdenv.mkDerivation (rec {
   propagatedBuildInputs = [ ncurses zlib ];
 
   patches = [
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     ./gnu-install-dirs.patch
     # Force a test to evaluate the saved benchmark for a CPU for which LLVM has
     # an execution model. See NixOS/nixpkgs#119673.
@@ -83,11 +89,6 @@ in stdenv.mkDerivation (rec {
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
@@ -119,6 +120,32 @@ in stdenv.mkDerivation (rec {
     # Fix x86 gold test on non-x86 platforms
     # (similar fix made to others in this directory previously, FWIW)
     patch -p1 -i  ${./fix-test-on-non-x86-like-others.patch}
+  '' + ''
+    # Tweak tests to ignore namespace part of type to support
+    # gcc-12: https://gcc.gnu.org/PR103598.
+    # The change below mangles strings like:
+    #    CHECK-NEXT: Starting llvm::Function pass manager run.
+    # to:
+    #    CHECK-NEXT: Starting {{.*}}Function pass manager run.
+    for f in \
+      test/Other/new-pass-manager.ll \
+      test/Other/new-pm-defaults.ll \
+      test/Other/new-pm-lto-defaults.ll \
+      test/Other/new-pm-thinlto-defaults.ll \
+      test/Other/pass-pipeline-parsing.ll \
+      test/Transforms/Inline/cgscc-incremental-invalidate.ll \
+      test/Transforms/Inline/clear-analyses.ll \
+      test/Transforms/LoopUnroll/unroll-loop-invalidation.ll \
+      test/Transforms/SCCP/ipsccp-preserve-analysis.ll \
+      test/Transforms/SCCP/preserve-analysis.ll \
+      test/Transforms/SROA/dead-inst.ll \
+      test/tools/gold/X86/new-pm.ll \
+      ; do
+      echo "PATCH: $f"
+      substituteInPlace $f \
+        --replace 'Starting llvm::' 'Starting {{.*}}' \
+        --replace 'Finished llvm::' 'Finished {{.*}}'
+    done
   '';
 
   # hacky fix: created binaries need to be run before installation
@@ -127,18 +154,28 @@ in stdenv.mkDerivation (rec {
     ln -sv $PWD/lib $out
   '';
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=ON"
+    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals enableSharedLibraries [
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
   ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -164,7 +201,21 @@ in stdenv.mkDerivation (rec {
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
@@ -194,7 +245,8 @@ in stdenv.mkDerivation (rec {
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isRiscV);
+  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isRiscV)
+    && (stdenv.hostPlatform == stdenv.buildPlatform);
 
   checkTarget = "check-all";
 
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/9/llvm/outputs.patch b/third_party/nixpkgs/pkgs/development/compilers/llvm/9/llvm/outputs.patch
deleted file mode 100644
index 878460e05b..0000000000
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/9/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/git/clang/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/git/clang/default.nix
index de2eff9f3e..3873bda2b6 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/git/clang/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/git/clang/default.nix
@@ -22,7 +22,6 @@ let
       "-DCMAKE_CXX_FLAGS=-std=c++14"
       "-DCLANGD_BUILD_XPC=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
-      "-DLLVM_CONFIG_PATH=${libllvm.dev}/bin/llvm-config${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-native"}"
     ] ++ lib.optionals enableManpages [
       "-DCLANG_INCLUDE_DOCS=ON"
       "-DLLVM_ENABLE_SPHINX=ON"
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/git/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/git/default.nix
index 666e9be3cd..890270c851 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/git/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/git/default.nix
@@ -93,7 +93,11 @@ let
     #   python3 = pkgs.python3;  # don't use python-boot
     # });
 
-    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+    # pick clang appropriate for package set we are targeting
+    clang =
+      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
+      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
+      else tools.libcxxClang;
 
     libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/git/llvm/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/git/llvm/default.nix
index 4c895f81db..fc7030810c 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/git/llvm/default.nix
@@ -51,6 +51,12 @@ in stdenv.mkDerivation (rec {
   checkInputs = [ which ];
 
   patches = [
+    # When cross-compiling we configure llvm-config-native with an approximation
+    # of the flags used for the normal LLVM build. To avoid the need for building
+    # a native libLLVM.so (which would fail) we force llvm-config to be linked
+    # statically against the necessary LLVM components always.
+    ../../llvm-config-link-static.patch
+
     ./gnu-install-dirs.patch
   ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
 
@@ -58,11 +64,6 @@ in stdenv.mkDerivation (rec {
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
-  ''
-  # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + ''
-    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
-    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
@@ -101,18 +102,36 @@ in stdenv.mkDerivation (rec {
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
-  cmakeFlags = with stdenv; [
-    "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+  cmakeFlags = with stdenv; let
+    # These flags influence llvm-config's BuildVariables.inc in addition to the
+    # general build. We need to make sure these are also passed via
+    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
+    # will return different results from the cross llvm-config.
+    #
+    # Some flags don't need to be repassed because LLVM already does so (like
+    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
+    flagsForLlvmConfig = [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ optionals enableSharedLibraries [
+      "-DLLVM_LINK_LLVM_DYLIB=ON"
+    ];
+  in flagsForLlvmConfig ++ [
     "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=ON"
+    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals enableSharedLibraries [
-    "-DLLVM_LINK_LLVM_DYLIB=ON"
+  ] ++ optionals stdenv.hostPlatform.isStatic [
+    # Disables building of shared libs, -fPIC is still injected by cc-wrapper
+    "-DLLVM_ENABLE_PIC=OFF"
+    "-DLLVM_BUILD_STATIC=ON"
+    # libxml2 needs to be disabled because the LLVM build system ignores its .la
+    # file and doesn't link zlib as well.
+    # https://github.com/ClangBuiltLinux/tc-build/issues/150#issuecomment-845418812
+    "-DLLVM_ENABLE_LIBXML2=OFF"
   ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
@@ -138,7 +157,21 @@ in stdenv.mkDerivation (rec {
           "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
           "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
         ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+        # We need to repass the custom GNUInstallDirs values, otherwise CMake
+        # will choose them for us, leading to wrong results in llvm-config-native
+        nativeInstallFlags = [
+          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
+          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
+        ];
+      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
+      + lib.concatStringsSep ";" (lib.concatLists [
+        flagsForLlvmConfig
+        nativeToolchainFlags
+        nativeInstallFlags
+      ])
     )
   ];
 
@@ -168,7 +201,8 @@ in stdenv.mkDerivation (rec {
     cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
   '';
 
-  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl);
+  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
+    && (stdenv.hostPlatform == stdenv.buildPlatform);
 
   checkTarget = "check-all";
 
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/git/llvm/outputs.patch b/third_party/nixpkgs/pkgs/development/compilers/llvm/git/llvm/outputs.patch
deleted file mode 100644
index 878460e05b..0000000000
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/git/llvm/outputs.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
-index 94d426b..37f7794 100644
---- a/tools/llvm-config/llvm-config.cpp
-+++ b/tools/llvm-config/llvm-config.cpp
-@@ -333,6 +333,11 @@ int main(int argc, char **argv) {
-     ActiveIncludeOption = "-I" + ActiveIncludeDir;
-   }
- 
-+  /// Nix-specific multiple-output handling: override ActiveLibDir
-+  if (!IsInDevelopmentTree) {
-+    ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
-+  }
-+
-   /// We only use `shared library` mode in cases where the static library form
-   /// of the components provided are not available; note however that this is
-   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/llvm-config-link-static.patch b/third_party/nixpkgs/pkgs/development/compilers/llvm/llvm-config-link-static.patch
new file mode 100644
index 0000000000..3881cc5206
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/llvm-config-link-static.patch
@@ -0,0 +1,12 @@
+diff --git llvm/tools/llvm-config/CMakeLists.txt llvm/tools/llvm-config/CMakeLists.txt
+index 16ba54c0cf2f..20b017195e84 100644
+--- llvm/tools/llvm-config/CMakeLists.txt
++++ llvm/tools/llvm-config/CMakeLists.txt
+@@ -6,6 +6,7 @@ set(BUILDVARIABLES_OBJPATH ${CMAKE_CURRENT_BINARY_DIR}/BuildVariables.inc)
+ # Add the llvm-config tool.
+ add_llvm_tool(llvm-config
+   llvm-config.cpp
++  DISABLE_LLVM_LINK_LLVM_DYLIB
+   )
+ 
+ # Compute the substitution values for various items.
diff --git a/third_party/nixpkgs/pkgs/development/compilers/orc/default.nix b/third_party/nixpkgs/pkgs/development/compilers/orc/default.nix
index 2d56d46162..fa4bf686a2 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/orc/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/orc/default.nix
@@ -15,6 +15,9 @@ in stdenv.mkDerivation rec {
   postPatch = lib.optionalString stdenv.isAarch32 ''
     # https://gitlab.freedesktop.org/gstreamer/orc/-/issues/20
     sed -i '/exec_opcodes_sys/d' testsuite/meson.build
+  '' + lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
+    # This benchmark times out on Hydra.nixos.org
+    sed -i '/memcpy_speed/d' testsuite/meson.build
   '';
 
   outputs = [ "out" "dev" ]
diff --git a/third_party/nixpkgs/pkgs/development/compilers/rust/rustc.nix b/third_party/nixpkgs/pkgs/development/compilers/rust/rustc.nix
index 187127cfbf..1087ac0590 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/rust/rustc.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/rust/rustc.nix
@@ -100,6 +100,9 @@ in stdenv.mkDerivation rec {
     "${setHost}.musl-root=${pkgsBuildHost.targetPackages.stdenv.cc.libc}"
   ] ++ optionals stdenv.targetPlatform.isMusl [
     "${setTarget}.musl-root=${pkgsBuildTarget.targetPackages.stdenv.cc.libc}"
+  ] ++ optionals (stdenv.isDarwin && stdenv.isx86_64) [
+    # https://github.com/rust-lang/rust/issues/92173
+    "--set rust.jemalloc"
   ];
 
   # The bootstrap.py will generated a Makefile that then executes the build.
diff --git a/third_party/nixpkgs/pkgs/development/compilers/vala/default.nix b/third_party/nixpkgs/pkgs/development/compilers/vala/default.nix
index 9a1365d0c9..17ba5b1421 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/vala/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/vala/default.nix
@@ -97,8 +97,8 @@ in rec {
   };
 
   vala_0_54 = generic {
-    version = "0.54.3";
-    sha256 = "7R1f5MvAzShF0N5PH/77Fa+waJLSMMfMppV4FnLo+2A=";
+    version = "0.54.6";
+    sha256 = "SdYNlqP99sQoc5dEK8bW2Vv0CqffZ47kkSjEsRum5Gk=";
   };
 
   vala = vala_0_54;
diff --git a/third_party/nixpkgs/pkgs/development/coq-modules/coq-ext-lib/default.nix b/third_party/nixpkgs/pkgs/development/coq-modules/coq-ext-lib/default.nix
index 410e585dce..a6e535e01d 100644
--- a/third_party/nixpkgs/pkgs/development/coq-modules/coq-ext-lib/default.nix
+++ b/third_party/nixpkgs/pkgs/development/coq-modules/coq-ext-lib/default.nix
@@ -5,13 +5,15 @@ with lib; mkCoqDerivation rec {
   owner = "coq-ext-lib";
   inherit version;
   defaultVersion = with versions; switch coq.coq-version [
+    { case = range "8.8" "8.15"; out = "0.11.6"; }
     { case = range "8.8" "8.14"; out = "0.11.4"; }
     { case = range "8.8" "8.13"; out = "0.11.3"; }
     { case = "8.7";              out = "0.9.7"; }
     { case = "8.6";              out = "0.9.5"; }
     { case = "8.5";              out = "0.9.4"; }
   ] null;
-  release."0.11.4".sha256 = "sha256:0yp8mhrhkc498nblvhq1x4j6i9aiidkjza4wzvrkp9p8rgx5g5y3";
+  release."0.11.6".sha256 = "0w6iyrdszz7zc8kaybhy3mwjain2d2f83q79xfd5di0hgdayh7q7";
+  release."0.11.4".sha256 = "0yp8mhrhkc498nblvhq1x4j6i9aiidkjza4wzvrkp9p8rgx5g5y3";
   release."0.11.3".sha256 = "1w99nzpk72lffxis97k235axss5lmzhy5z3lga2i0si95mbpil42";
   release."0.11.2".sha256 = "0iyka81g26x5n99xic7kqn8vxqjw8rz7vw9rs27iw04lf137vzv6";
   release."0.10.3".sha256 = "0795gs2dlr663z826mp63c8h2zfadn541dr8q0fvnvi2z7kfyslb";
diff --git a/third_party/nixpkgs/pkgs/development/coq-modules/coq-record-update/default.nix b/third_party/nixpkgs/pkgs/development/coq-modules/coq-record-update/default.nix
index 7c9ee2dca6..a95f4f6154 100644
--- a/third_party/nixpkgs/pkgs/development/coq-modules/coq-record-update/default.nix
+++ b/third_party/nixpkgs/pkgs/development/coq-modules/coq-record-update/default.nix
@@ -5,10 +5,11 @@ with lib; mkCoqDerivation rec {
   owner = "tchajed";
   inherit version;
   defaultVersion = with versions; switch coq.coq-version [
-    { case = range "8.10" "8.14";  out = "0.3.0"; }
+    { case = range "8.10" "8.15";  out = "0.3.0"; }
   ] null;
   release."0.3.0".sha256 = "1ffr21dd6hy19gxnvcd4if2450iksvglvkd6q5713fajd72hmc0z";
   releaseRev = v: "v${v}";
+  buildFlags = "NO_TEST=1";
   meta = {
     description = "Library to create Coq record update functions";
     maintainers = with maintainers; [ ineol ];
diff --git a/third_party/nixpkgs/pkgs/development/coq-modules/corn/default.nix b/third_party/nixpkgs/pkgs/development/coq-modules/corn/default.nix
index ee4a39dbd5..d3ac8332c1 100644
--- a/third_party/nixpkgs/pkgs/development/coq-modules/corn/default.nix
+++ b/third_party/nixpkgs/pkgs/development/coq-modules/corn/default.nix
@@ -5,7 +5,7 @@ with lib; mkCoqDerivation rec {
   inherit version;
   defaultVersion = switch coq.coq-version [
     { case = "8.6"; out = "8.8.1"; }
-    { case = (versions.range "8.7" "8.13"); out = "8.13.0"; }
+    { case = (versions.range "8.7" "8.15"); out = "8.13.0"; }
   ] null;
   release = {
     "8.8.1".sha256 = "0gh32j0f18vv5lmf6nb87nr5450w6ai06rhrnvlx2wwi79gv10wp";
diff --git a/third_party/nixpkgs/pkgs/development/coq-modules/deriving/default.nix b/third_party/nixpkgs/pkgs/development/coq-modules/deriving/default.nix
index 5f57238709..9d823c0bf9 100644
--- a/third_party/nixpkgs/pkgs/development/coq-modules/deriving/default.nix
+++ b/third_party/nixpkgs/pkgs/development/coq-modules/deriving/default.nix
@@ -9,7 +9,7 @@ mkCoqDerivation {
 
   inherit version;
   defaultVersion = with versions; switch coq.coq-version [
-    { case = range "8.11" "8.14"; out = "0.1.0"; }
+    { case = range "8.11" "8.15"; out = "0.1.0"; }
   ] null;
 
   releaseRev = v: "v${v}";
diff --git a/third_party/nixpkgs/pkgs/development/coq-modules/equations/default.nix b/third_party/nixpkgs/pkgs/development/coq-modules/equations/default.nix
index f563d17287..16b358b737 100644
--- a/third_party/nixpkgs/pkgs/development/coq-modules/equations/default.nix
+++ b/third_party/nixpkgs/pkgs/development/coq-modules/equations/default.nix
@@ -6,8 +6,9 @@ with lib; mkCoqDerivation {
   repo = "Coq-Equations";
   inherit version;
   defaultVersion = switch coq.coq-version [
-    { case = "8.14"; out = "1.3-8.14"; }
-    { case = "8.13"; out = "1.3-8.13"; }
+    { case = "8.15"; out = "1.3+8.15"; }
+    { case = "8.14"; out = "1.3+8.14"; }
+    { case = "8.13"; out = "1.3+8.13"; }
     { case = "8.12"; out = "1.2.4+coq8.12"; }
     { case = "8.11"; out = "1.2.4+coq8.11"; }
     { case = "8.10"; out = "1.2.1+coq8.10-2"; }
@@ -44,10 +45,12 @@ with lib; mkCoqDerivation {
     release."1.2.4+coq8.12".sha256    = "1n0w8is464qcq8mk2mv7amaf0khbjz5mpc9phf0rhpjm0lb22cb3";
     release."1.2.4+coq8.13".rev       = "v1.2.4-8.13";
     release."1.2.4+coq8.13".sha256    = "0i014lshsdflzw6h0qxra9d2f0q82vffxv2f29awbb9ad0p4rq4q";
-    release."1.3-8.13".rev            = "v1.3-8.13";
-    release."1.3-8.13".sha256         = "1jwjbkkkk4bwf6pz4zzz8fy5bb17aqyf4smkja59rgj9ya6nrdhg";
-    release."1.3-8.14".rev            = "v1.3-8.14";
-    release."1.3-8.14".sha256         = "19bj9nncd1r9g4273h5qx35gs3i4bw5z9bhjni24b413hyj55hkv";
+    release."1.3+8.13".rev            = "v1.3-8.13";
+    release."1.3+8.13".sha256         = "1jwjbkkkk4bwf6pz4zzz8fy5bb17aqyf4smkja59rgj9ya6nrdhg";
+    release."1.3+8.14".rev            = "v1.3-8.14";
+    release."1.3+8.14".sha256         = "19bj9nncd1r9g4273h5qx35gs3i4bw5z9bhjni24b413hyj55hkv";
+    release."1.3+8.15".rev            = "v1.3-8.15";
+    release."1.3+8.15".sha256         = "1vfcfpsp9zyj0sw0cwibk76nj6n0r6gwh8m1aa3lbvc0b1kbm32k";
 
   mlPlugin = true;
   preBuild = "coq_makefile -f _CoqProject -o Makefile";
diff --git a/third_party/nixpkgs/pkgs/development/coq-modules/math-classes/default.nix b/third_party/nixpkgs/pkgs/development/coq-modules/math-classes/default.nix
index e61019b91c..0a78191d8b 100644
--- a/third_party/nixpkgs/pkgs/development/coq-modules/math-classes/default.nix
+++ b/third_party/nixpkgs/pkgs/development/coq-modules/math-classes/default.nix
@@ -4,10 +4,10 @@ with lib; mkCoqDerivation {
 
   pname = "math-classes";
   inherit version;
-  defaultVersion = if versions.range "8.11" "8.13" coq.coq-version then "8.13.0" else
-                   if versions.range "8.6"  "8.10" coq.coq-version then "8.12.0" else null;
+  defaultVersion = if versions.range "8.6" "8.15" coq.coq-version then "8.15.0" else null;
   release."8.12.0".sha256 = "14nd6a08zncrl5yg2gzk0xf4iinwq4hxnsgm4fyv07ydbkxfb425";
   release."8.13.0".sha256 = "1ln7ziivfbxzbdvlhbvyg3v30jgblncmwcsam6gg3d1zz6r7cbby";
+  release."8.15.0".sha256 = "10w1hm537k6jx8a8vghq1yx12rsa0sjk2ipv3scgir71ln30hllw";
 
   extraBuildInputs = [ bignums ];
 
diff --git a/third_party/nixpkgs/pkgs/development/coq-modules/reglang/default.nix b/third_party/nixpkgs/pkgs/development/coq-modules/reglang/default.nix
index 1908c755cd..847ebb7808 100644
--- a/third_party/nixpkgs/pkgs/development/coq-modules/reglang/default.nix
+++ b/third_party/nixpkgs/pkgs/development/coq-modules/reglang/default.nix
@@ -10,7 +10,7 @@ mkCoqDerivation {
 
   inherit version;
   defaultVersion = with versions; switch coq.coq-version [
-    { case = range "8.10" "8.14"; out = "1.1.2"; }
+    { case = range "8.10" "8.15"; out = "1.1.2"; }
   ] null;
 
 
diff --git a/third_party/nixpkgs/pkgs/development/interpreters/elixir/1.13.nix b/third_party/nixpkgs/pkgs/development/interpreters/elixir/1.13.nix
index 78a7458443..e5eb36e752 100644
--- a/third_party/nixpkgs/pkgs/development/interpreters/elixir/1.13.nix
+++ b/third_party/nixpkgs/pkgs/development/interpreters/elixir/1.13.nix
@@ -3,7 +3,7 @@
 # How to obtain `sha256`:
 # nix-prefetch-url --unpack https://github.com/elixir-lang/elixir/archive/v${version}.tar.gz
 mkDerivation {
-  version = "1.13.1";
-  sha256 = "0z0b1w2vvw4vsnb99779c2jgn9bgslg7b1pmd9vlbv02nza9qj5p";
+  version = "1.13.2";
+  sha256 = "sha256-qv85aDP3RPCa1YBo45ykWRRZNanL6brNKDMPu9SZdbQ=";
   minimumOTPVersion = "22";
 }
diff --git a/third_party/nixpkgs/pkgs/development/interpreters/micropython/default.nix b/third_party/nixpkgs/pkgs/development/interpreters/micropython/default.nix
index 7591e997be..3c85b67a94 100644
--- a/third_party/nixpkgs/pkgs/development/interpreters/micropython/default.nix
+++ b/third_party/nixpkgs/pkgs/development/interpreters/micropython/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "micropython";
-  version = "1.17";
+  version = "1.18";
 
   src = fetchFromGitHub {
     owner  = "micropython";
     repo   = "micropython";
     rev    = "v${version}";
-    sha256 = "0aqij36iykmfdsv5dqrifvghmjx7qid8hmbxcpx3xpk3nizh7w84";
+    sha256 = "sha256-roskIDyY3ehasOm8Yn4braLNZtaeuItb9ZOUgF4CXww=";
     fetchSubmodules = true;
   };
 
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   skippedTests = ""
-    + lib.optionalString (stdenv.isDarwin) " -e uasyncio_basic -e uasyncio_wait_task"
+    + lib.optionalString (stdenv.isDarwin) " -e uasyncio_basic -e uasyncio_heaplock -e uasyncio_wait_task"
     + lib.optionalString (stdenv.isDarwin && stdenv.isAarch64) " -e ffi_callback"
     + lib.optionalString (stdenv.isLinux && stdenv.isAarch64) " -e float_parse"
   ;
diff --git a/third_party/nixpkgs/pkgs/development/interpreters/php/8.1.nix b/third_party/nixpkgs/pkgs/development/interpreters/php/8.1.nix
index 736d6c808c..d339e78010 100644
--- a/third_party/nixpkgs/pkgs/development/interpreters/php/8.1.nix
+++ b/third_party/nixpkgs/pkgs/development/interpreters/php/8.1.nix
@@ -2,8 +2,8 @@
 
 let
   base = callPackage ./generic.nix (_args // {
-    version = "8.1.1";
-    sha256 = "sha256-j4vJytbNEk7cER99sKEJdF4vY4dwoQGzwiopU/eptA4=";
+    version = "8.1.2";
+    sha256 = "1aakbfgjffha4v7fl6229wwzavw59s1qkb547sipyhl88gfwfgci";
   });
 
 in
diff --git a/third_party/nixpkgs/pkgs/development/interpreters/python/default.nix b/third_party/nixpkgs/pkgs/development/interpreters/python/default.nix
index b6d60ba8a8..5cdba9d320 100644
--- a/third_party/nixpkgs/pkgs/development/interpreters/python/default.nix
+++ b/third_party/nixpkgs/pkgs/development/interpreters/python/default.nix
@@ -219,6 +219,7 @@ in {
     sqlite = null;
     configd = null;
     tzdata = null;
+    libffi = pkgs.libffiBoot; # without test suite
     stripConfig = true;
     stripIdlelib = true;
     stripTests = true;
diff --git a/third_party/nixpkgs/pkgs/development/interpreters/spidermonkey/78.nix b/third_party/nixpkgs/pkgs/development/interpreters/spidermonkey/78.nix
index b4ed171eb7..4f525c8f0a 100644
--- a/third_party/nixpkgs/pkgs/development/interpreters/spidermonkey/78.nix
+++ b/third_party/nixpkgs/pkgs/development/interpreters/spidermonkey/78.nix
@@ -35,6 +35,15 @@ stdenv.mkDerivation rec {
       url = "https://salsa.debian.org/mozilla-team/firefox/commit/fd6847c9416f9eebde636e21d794d25d1be8791d.patch";
       sha256 = "02b7zwm6vxmk61aj79a6m32s1k5sr0hwm3q1j4v6np9jfyd10g1j";
     })
+
+    # Remove this when updating to 79 - The patches are already applied upstream
+    # https://bugzilla.mozilla.org/show_bug.cgi?id=1318905
+
+    # Combination of 3 changesets, modified to apply on 78:
+    # - https://hg.mozilla.org/mozilla-central/rev/06d7e1b6b7e7
+    # - https://hg.mozilla.org/mozilla-central/rev/ec48f15d085c
+    # - https://hg.mozilla.org/mozilla-central/rev/6803dda74d33
+    ./add-riscv64-support.patch
   ];
 
   outputs = [ "out" "dev" ];
@@ -98,6 +107,10 @@ stdenv.mkDerivation rec {
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
+  # cc-rs insists on using -mabi=lp64 (soft-float) for riscv64,
+  # while we have a double-float toolchain
+  NIX_CFLAGS_COMPILE = lib.optionalString (with stdenv.hostPlatform; isRiscV && is64bit) "-mabi=lp64d";
+
   # Remove unnecessary static lib
   preFixup = ''
     moveToOutput bin/js78-config "$dev"
diff --git a/third_party/nixpkgs/pkgs/development/interpreters/spidermonkey/add-riscv64-support.patch b/third_party/nixpkgs/pkgs/development/interpreters/spidermonkey/add-riscv64-support.patch
new file mode 100644
index 0000000000..9d5d7c5507
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/interpreters/spidermonkey/add-riscv64-support.patch
@@ -0,0 +1,123 @@
+# HG changeset patch
+# User John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+# Date 1592464269 0
+#      Thu Jun 18 07:11:09 2020 +0000
+# Node ID 5de7d747a962df5f8aefc016a62d7270ac18879e
+# Parent  e4b11f027efc1f8c2710ae3f52487a8f10a8fb39
+Bug 1318905 - build: Add riscv64 as target architecture to mozbuild r=glandium
+
+Adds the basic definitions for riscv64 to mozbuild, allowing to build Spidermonkey.
+
+Differential Revision: https://phabricator.services.mozilla.com/D78623
+
+diff -r e4b11f027efc -r 5de7d747a962 build/moz.configure/init.configure
+--- a/build/moz.configure/init.configure	Sun May 31 17:11:57 2020 +0000
++++ b/build/moz.configure/init.configure	Thu Jun 18 07:11:09 2020 +0000
+@@ -741,6 +741,9 @@
+     elif cpu.startswith('aarch64'):
+         canonical_cpu = 'aarch64'
+         endianness = 'little'
++    elif cpu in ('riscv64', 'riscv64gc'):
++        canonical_cpu = 'riscv64'
++        endianness = 'little'
+     elif cpu == 'sh4':
+         canonical_cpu = 'sh4'
+         endianness = 'little'
+diff -r e4b11f027efc -r 5de7d747a962 python/mozbuild/mozbuild/configure/constants.py
+--- a/python/mozbuild/mozbuild/configure/constants.py	Sun May 31 17:11:57 2020 +0000
++++ b/python/mozbuild/mozbuild/configure/constants.py	Thu Jun 18 07:11:09 2020 +0000
+@@ -49,6 +49,7 @@
+     'mips64': 64,
+     'ppc': 32,
+     'ppc64': 64,
++    'riscv64': 64,
+     's390': 32,
+     's390x': 64,
+     'sh4': 32,
+@@ -87,6 +88,7 @@
+     ('sparc', '__sparc__'),
+     ('mips64', '__mips64'),
+     ('mips32', '__mips__'),
++    ('riscv64', '__riscv && __riscv_xlen == 64'),
+     ('sh4', '__sh__'),
+ ))
+ 
+diff -r e4b11f027efc -r 5de7d747a962 python/mozbuild/mozbuild/test/configure/test_toolchain_configure.py
+--- a/python/mozbuild/mozbuild/test/configure/test_toolchain_configure.py	Sun May 31 17:11:57 2020 +0000
++++ b/python/mozbuild/mozbuild/test/configure/test_toolchain_configure.py	Thu Jun 18 07:11:09 2020 +0000
+@@ -1208,6 +1208,10 @@
+         'mips-unknown-linux-gnu': big_endian + {
+             '__mips__': 1,
+         },
++        'riscv64-unknown-linux-gnu': little_endian + {
++            '__riscv': 1,
++            '__riscv_xlen': 64,
++        },
+         'sh4-unknown-linux-gnu': little_endian + {
+             '__sh__': 1,
+         },
+# HG changeset patch
+# User John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+# Date 1592464269 0
+#      Thu Jun 18 07:11:09 2020 +0000
+# Node ID e3d924797cb2d508ff938414168e98ccf66f07fe
+# Parent  5de7d747a962df5f8aefc016a62d7270ac18879e
+Bug 1318905 - js:jit: Enable AtomicOperations-feeling-lucky.h on riscv64 r=lth
+
+This allows the build on riscv64 to use the atomic operations provided by GCC.
+
+Differential Revision: https://phabricator.services.mozilla.com/D78624
+
+diff -r 5de7d747a962 -r e3d924797cb2 js/src/jit/AtomicOperations.h
+--- a/js/src/jit/AtomicOperations.h	Thu Jun 18 07:11:09 2020 +0000
++++ b/js/src/jit/AtomicOperations.h	Thu Jun 18 07:11:09 2020 +0000
+@@ -391,7 +391,7 @@
+ #elif defined(__ppc__) || defined(__PPC__) || defined(__sparc__) ||     \
+     defined(__ppc64__) || defined(__PPC64__) || defined(__ppc64le__) || \
+     defined(__PPC64LE__) || defined(__alpha__) || defined(__hppa__) ||  \
+-    defined(__sh__) || defined(__s390__) || defined(__s390x__)
++    defined(__sh__) || defined(__s390__) || defined(__s390x__) || defined(__riscv)
+ #  include "jit/shared/AtomicOperations-feeling-lucky.h"
+ #else
+ #  error "No AtomicOperations support provided for this platform"
+diff -r 5de7d747a962 -r e3d924797cb2 js/src/jit/shared/AtomicOperations-feeling-lucky-gcc.h
+--- a/js/src/jit/shared/AtomicOperations-feeling-lucky-gcc.h	Thu Jun 18 07:11:09 2020 +0000
++++ b/js/src/jit/shared/AtomicOperations-feeling-lucky-gcc.h	Thu Jun 18 07:11:09 2020 +0000
+@@ -63,6 +63,11 @@
+ #  define HAS_64BIT_LOCKFREE
+ #endif
+ 
++#if defined(__riscv) && __riscv_xlen == 64
++#  define HAS_64BIT_ATOMICS
++#  define HAS_64BIT_LOCKFREE
++#endif
++
+ #ifdef __sparc__
+ #  ifdef __LP64__
+ #    define HAS_64BIT_ATOMICS
+# HG changeset patch
+# User John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+# Date 1592464269 0
+#      Thu Jun 18 07:11:09 2020 +0000
+# Node ID 3f652d12b8bc0bd213020d488ecb4d3710bb11fa
+# Parent  e3d924797cb2d508ff938414168e98ccf66f07fe
+Bug 1318905 - mfbt:tests: Define RETURN_INSTR for riscv64 in TestPoisonArea r=glandium
+
+Define RETURN_INSTR for riscv64 in TestPoisonArea, i.e. the riscv64 assembly
+opcodes for "ret ; ret".
+
+Differential Revision: https://phabricator.services.mozilla.com/D78625
+
+diff -r e3d924797cb2 -r 3f652d12b8bc mfbt/tests/TestPoisonArea.cpp
+--- a/mfbt/tests/TestPoisonArea.cpp	Thu Jun 18 07:11:09 2020 +0000
++++ b/mfbt/tests/TestPoisonArea.cpp	Thu Jun 18 07:11:09 2020 +0000
+@@ -132,6 +132,9 @@
+ #elif defined _ARCH_PPC || defined _ARCH_PWR || defined _ARCH_PWR2
+ #  define RETURN_INSTR 0x4E800020 /* blr */
+ 
++#elif defined __riscv
++#  define RETURN_INSTR 0x80828082 /* ret; ret */
++
+ #elif defined __sparc || defined __sparcv9
+ #  define RETURN_INSTR 0x81c3e008 /* retl */
+ 
diff --git a/third_party/nixpkgs/pkgs/development/libraries/aws-sdk-cpp/default.nix b/third_party/nixpkgs/pkgs/development/libraries/aws-sdk-cpp/default.nix
index c2ad242b47..769cc2d3bd 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/aws-sdk-cpp/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/aws-sdk-cpp/default.nix
@@ -18,13 +18,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "aws-sdk-cpp";
-  version = "1.9.121";
+  version = "1.9.150";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-sdk-cpp";
     rev = version;
-    sha256 = "sha256-VQpWauk0tdJ1QU0HmtdTwQdKbiAuTTXXsUo2cqpqmdU=";
+    sha256 = "sha256-fgLdXWQKHaCwulrw9KV3vpQ71DjnQAL4heIRW7Rk7UY=";
   };
 
   postPatch = ''
diff --git a/third_party/nixpkgs/pkgs/development/libraries/ffmpeg-full/default.nix b/third_party/nixpkgs/pkgs/development/libraries/ffmpeg-full/default.nix
index 77bd473485..e4a5d908d2 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/ffmpeg-full/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/ffmpeg-full/default.nix
@@ -132,6 +132,7 @@
 , xavs ? null # AVS encoder
 , xvidcore ? null # Xvid encoder, native encoder exists
 , zeromq4 ? null # Message passing
+, zimg ? null
 , zlib ? null
 , vulkan-loader ? null
 , glslang ? null
@@ -403,6 +404,7 @@ stdenv.mkDerivation rec {
     (enableFeature (xavs != null && gplLicensing) "libxavs")
     (enableFeature (xvidcore != null && gplLicensing) "libxvid")
     (enableFeature (zeromq4 != null) "libzmq")
+    (enableFeature (zimg != null) "libzimg")
     (enableFeature (zlib != null) "zlib")
     (enableFeature (isLinux && vulkan-loader != null) "vulkan")
     (enableFeature (isLinux && vulkan-loader != null && glslang != null) "libglslang")
@@ -431,7 +433,7 @@ stdenv.mkDerivation rec {
     libogg libopus librsvg libssh libtheora libvdpau libvorbis libvpx libwebp libX11
     libxcb libXv libXext xz openal openjpeg libpulseaudio rav1e svt-av1 rtmpdump opencore-amr
     samba SDL2 soxr speex srt vid-stab vo-amrwbenc x264 x265 xavs xvidcore
-    zeromq4 zlib
+    zeromq4 zimg zlib
   ] ++ optionals openglExtlib [ libGL libGLU ]
     ++ optionals nonfreeLicensing [ fdk_aac openssl ]
     ++ optional ((isLinux || isFreeBSD) && libva != null) libva
diff --git a/third_party/nixpkgs/pkgs/development/libraries/ffmpeg/generic.nix b/third_party/nixpkgs/pkgs/development/libraries/ffmpeg/generic.nix
index 8f74fbd5a3..e3b0534d2a 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/ffmpeg/generic.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, buildPackages, fetchurl, pkg-config, addOpenGLRunpath, perl, texinfo, yasm
 , alsa-lib, bzip2, fontconfig, freetype, gnutls, libiconv, lame, libass, libogg
 , libssh, libtheora, libva, libdrm, libvorbis, libvpx, xz, libpulseaudio, soxr
-, x264, x265, xvidcore, zlib, libopus, speex, nv-codec-headers, dav1d
+, x264, x265, xvidcore, zimg, zlib, libopus, speex, nv-codec-headers, dav1d
 , srt ? null
 , openglSupport ? false, libGLU ? null, libGL ? null
 , libmfxSupport ? false, intel-media-sdk ? null
@@ -154,6 +154,7 @@ stdenv.mkDerivation rec {
       (ifMinVer "1.2" "--enable-libsoxr")
       "--enable-libx264"
       "--enable-libxvid"
+      "--enable-libzimg"
       "--enable-zlib"
       (ifMinVer "2.8" "--enable-libopus")
       "--enable-libspeex"
@@ -176,7 +177,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     bzip2 fontconfig freetype gnutls libiconv lame libass libogg libssh libtheora
-    libvorbis xz soxr x264 x265 xvidcore zlib libopus speex srt nv-codec-headers
+    libvorbis xz soxr x264 x265 xvidcore zimg zlib libopus speex srt nv-codec-headers
   ] ++ optionals openglSupport [ libGL libGLU ]
     ++ optional libmfxSupport intel-media-sdk
     ++ optional libaomSupport libaom
diff --git a/third_party/nixpkgs/pkgs/development/libraries/glibc/2.33-master.patch.gz b/third_party/nixpkgs/pkgs/development/libraries/glibc/2.33-master.patch.gz
index 50f74b1582..aecf1550fe 100644
Binary files a/third_party/nixpkgs/pkgs/development/libraries/glibc/2.33-master.patch.gz and b/third_party/nixpkgs/pkgs/development/libraries/glibc/2.33-master.patch.gz differ
diff --git a/third_party/nixpkgs/pkgs/development/libraries/glibc/common.nix b/third_party/nixpkgs/pkgs/development/libraries/glibc/common.nix
index 6fa46d6d6c..1bc5bf08ee 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/glibc/common.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/glibc/common.nix
@@ -44,7 +44,7 @@
 
 let
   version = "2.33";
-  patchSuffix = "-59";
+  patchSuffix = "-62";
   sha256 = "sha256-LiVWAA4QXb1X8Layoy/yzxc73k8Nhd/8z9i35RoGd/8=";
 in
 
@@ -63,7 +63,7 @@ stdenv.mkDerivation ({
     [
       /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
           $ git fetch --all -p && git checkout origin/release/2.33/master && git describe
-          glibc-2.33-59-gf9592d65f2
+          glibc-2.33-62-gc493f6a0e4
           $ git show --minimal --reverse glibc-2.33.. | gzip -9n --rsyncable - > 2.33-master.patch.gz
 
          To compare the archive contents zdiff can be used.
diff --git a/third_party/nixpkgs/pkgs/development/libraries/grilo-plugins/default.nix b/third_party/nixpkgs/pkgs/development/libraries/grilo-plugins/default.nix
index ed8f8edd65..db968f4730 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/grilo-plugins/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/grilo-plugins/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     # * chromaprint (gst-plugins-bad)
     (substituteAll {
       src = ./chromaprint-gst-plugins.patch;
-      load_plugins = lib.concatMapStrings (plugin: ''gst_registry_scan_path(gst_registry_get(), "${plugin}/lib/gstreamer-1.0");'') (with gst_all_1; [
+      load_plugins = lib.concatMapStrings (plugin: ''gst_registry_scan_path(gst_registry_get(), "${lib.getLib plugin}/lib/gstreamer-1.0");'') (with gst_all_1; [
         gstreamer
         gst-plugins-base
         gst-plugins-bad
diff --git a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/bad/default.nix b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/bad/default.nix
index 8c6a8b0567..016a7a992e 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
 , meson
 , ninja
 , gettext
@@ -93,26 +92,18 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-bad";
-  version = "1.18.2";
+  version = "1.18.5";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "06ildd4rl6cynirv3p00d2ddf5is9svj4i7mkahldzhq24pq5mca";
+    sha256 = "sha256-oWSSO5Tw0IV4pvyuqsbgwF2niKRpA6EIaHDpykWtZ44=";
   };
 
   patches = [
     # Use pkgconfig to inject the includedirs
     ./fix_pkgconfig_includedir.patch
-    # Fix “error: cannot initialize a parameter of type 'unsigned long *' with an rvalue of type 'typename std::remove_reference<decltype(*(&opencv_dilate_erode_type))>::type *' (aka 'volatile unsigned long *')” on Darwin.
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/commit/640a65bf966df065d41a511e2d76d1f26a2e770c.patch";
-      sha256 = "E5pig+qEfR58Jticr6ydFxZOhM3ZJ8zgrf5K4BdiB/Y=";
-      includes = [
-        "ext/opencv/gstcvdilateerode.cpp"
-      ];
-    })
   ];
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/base/default.nix b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/base/default.nix
index 1edadf0a51..8b6073cb95 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/base/default.nix
@@ -41,13 +41,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-base";
-  version = "1.18.4";
+  version = "1.18.5";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "08w3ivbc6n4vdds2ap6q7l8zdk9if8417nznyqidf0adm0lk5r99";
+    sha256 = "sha256-lgt69FhXANsP3VuENVThHiVk/tngYfWR+uiKe+ZEb6M=";
   };
 
   patches = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/core/default.nix b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/core/default.nix
index 9cc1675de3..268da01716 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/core/default.nix
@@ -21,20 +21,20 @@
 
 stdenv.mkDerivation rec {
   pname = "gstreamer";
-  version = "1.18.4";
+  version = "1.18.5";
 
   outputs = [
+    "bin"
     "out"
     "dev"
     # "devdoc" # disabled until `hotdoc` is packaged in nixpkgs, see:
     # - https://github.com/NixOS/nixpkgs/pull/98767
     # - https://github.com/NixOS/nixpkgs/issues/98769#issuecomment-702296551
   ];
-  outputBin = "dev";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1igv9l4hm21kp1jmlwlagzs7ly1vaxv1sbda29q8247372dwkvls";
+    sha256 = "sha256-VYYiMqY0Wbv1ar694whcqa7CEbR46JHazqTW34yv6Ao=";
   };
 
   patches = [
@@ -94,14 +94,14 @@ stdenv.mkDerivation rec {
   '';
 
   postInstall = ''
-    for prog in "$dev/bin/"*; do
+    for prog in "$bin/bin/"*; do
         # We can't use --suffix here due to quoting so we craft the export command by hand
         wrapProgram "$prog" --run 'export GST_PLUGIN_SYSTEM_PATH_1_0=$GST_PLUGIN_SYSTEM_PATH_1_0''${GST_PLUGIN_SYSTEM_PATH_1_0:+:}$(unset _tmp; for profile in $NIX_PROFILES; do _tmp="$profile/lib/gstreamer-1.0''${_tmp:+:}$_tmp"; done; printf '%s' "$_tmp")'
     done
   '';
 
   preFixup = ''
-    moveToOutput "share/bash-completion" "$dev"
+    moveToOutput "share/bash-completion" "$bin"
   '';
 
   setupHook = ./setup-hook.sh;
diff --git a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/devtools/default.nix b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/devtools/default.nix
index 12cb6dac6f..0b7be2bd03 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/devtools/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/devtools/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-devtools";
-  version = "1.18.4";
+  version = "1.18.5";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1kvcabcfzm7wqih3lzgrg9xjbn4xpx43d1m2zkkvab4i8161kggz";
+    sha256 = "sha256-/s/8hkR9r1wqBoQ8dXqZHXRcqiBpRGoNdG6ZsT98sHk=";
   };
 
   patches = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/ges/default.nix b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/ges/default.nix
index 840b0f2528..0bfe6f3e0e 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/ges/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/ges/default.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-editing-services";
-  version = "1.18.4";
+  version = "1.18.5";
 
   outputs = [
     "out"
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "010xg960qsh5dwmf0y9l1q13h0cymmrgapzla2zsw66ylxqbi1s6";
+    sha256 = "sha256-ivSoOU0FHz4YKAaG20mm76zMlcDFmhfw9WTjIABZDfU=";
   };
 
   patches = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/good/default.nix b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/good/default.nix
index bc1656c191..a6ed248b66 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/good/default.nix
@@ -48,13 +48,13 @@ assert raspiCameraSupport -> (stdenv.isLinux && stdenv.isAarch64);
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-good";
-  version = "1.18.4";
+  version = "1.18.5";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1c1rpq709cy8maaykyn1n0kckj9c6fl3mhvixkk6xmdwkcx0xrdn";
+    sha256 = "sha256-Oq7up3Zfv4gBrM5KUDqbBfc/BOijU1Lp0AIyz9VVeWs=";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/libav/default.nix b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/libav/default.nix
index 009a1555f7..7f2828253c 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-libav";
-  version = "1.18.4";
+  version = "1.18.5";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "15n3x3vhshqa3icw93g4vqmqd46122anzqvfxwn6q8famlxlcjil";
+    sha256 = "sha256-gi4AipEOndE67b3Y3GP+3vQEDA7i6Se6sxEuneaTpUg=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/rtsp-server/default.nix b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
index d66376b649..a75af25224 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-rtsp-server";
-  version = "1.18.4";
+  version = "1.18.5";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "153c78klvzlmi86d0gmdf7w9crv11rkd4y82b14a0wdr83gbhsx4";
+    sha256 = "sha256-BNY79IgWxvQcc/beD5EqfO8KqznEQWKnvOzhkj38nR8=";
   };
 
   outputs = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/ugly/default.nix b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/ugly/default.nix
index 049e8a99f0..7c4b21f7c8 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/ugly/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/ugly/default.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-ugly";
-  version = "1.18.4";
+  version = "1.18.5";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0g6i4db1883q3j0l2gdv46fcqwiiaw63n6mhvsfcms1i1p7g1391";
+    sha256 = "sha256-3zKAPpj4qZeTc/osp+BeYvl3sQl1dtOoBhnZ9cafZtk=";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/vaapi/default.nix b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/vaapi/default.nix
index 19e65c5a75..5de9a247a5 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/vaapi/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/vaapi/default.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gstreamer-vaapi";
-  version = "1.18.4";
+  version = "1.18.5";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1sia4l88z7kkxm2z9j20l43rqkrnsa47xccski10s5gkhsprinwj";
+    sha256 = "sha256-SkYPuVVZ9BRE6ySGStLZ43kitu6pQVEDEDGfw+C6cns=";
   };
 
   outputs = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/gtk/3.x.nix b/third_party/nixpkgs/pkgs/development/libraries/gtk/3.x.nix
index 82bcad0b98..bb14515944 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/gtk/3.x.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/gtk/3.x.nix
@@ -44,6 +44,7 @@
 , cups
 , AppKit
 , Cocoa
+, QuartzCore
 , broadwaySupport ? true
 }:
 
@@ -59,7 +60,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gtk+3";
-  version = "3.24.30";
+  version = "3.24.31";
 
   outputs = [ "out" "dev" ] ++ lib.optional withGtkDoc "devdoc";
   outputBin = "dev";
@@ -71,7 +72,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/${lib.versions.majorMinor version}/gtk+-${version}.tar.xz";
-    sha256 = "sha256-unW//zIK0fTPvukrqBPsM2MizDxmDUBqrQFLBwh6O6k=";
+    sha256 = "sha256-Qjw+f9tMRZ7oieNf1Ncf0mI1YlQcEEGxHAflrR/xC/k=";
   };
 
   patches = [
@@ -83,6 +84,12 @@ stdenv.mkDerivation rec {
     # e.g. https://gitlab.gnome.org/GNOME/gtk/blob/3.24.4/gtk/gtk-launch.c#L31-33
     # https://gitlab.gnome.org/GNOME/gtk/merge_requests/536
     ./patches/3.0-darwin-x11.patch
+
+    # 3.24.31 does not declare QuartzCore dependency properly and fails to link
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/0ac61443694b477c41fc246cb387ef86aba441de.patch";
+      sha256 = "sha256-KaMeIdV/gfM4xzN9lIkY99E7bzAfTM6VETk5DEunB2w=";
+    })
   ];
 
   nativeBuildInputs = [
@@ -104,7 +111,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     libxkbcommon
-    libepoxy
+    (libepoxy.override { inherit x11Support; })
     isocodes
   ] ++ lib.optionals stdenv.isDarwin [
     AppKit
@@ -133,6 +140,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals stdenv.isDarwin [
     # explicitly propagated, always needed
     Cocoa
+    QuartzCore
   ] ++ lib.optionals waylandSupport [
     libGL
     wayland
diff --git a/third_party/nixpkgs/pkgs/development/libraries/gtk/4.x.nix b/third_party/nixpkgs/pkgs/development/libraries/gtk/4.x.nix
index d763c99882..2b6dfc8fb5 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/gtk/4.x.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/gtk/4.x.nix
@@ -23,6 +23,9 @@
 , xorg
 , libepoxy
 , libxkbcommon
+, libpng
+, libtiff
+, libjpeg
 , libxml2
 , gnome
 , gsettings-desktop-schemas
@@ -59,7 +62,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gtk4";
-  version = "4.4.1";
+  version = "4.6.0";
 
   outputs = [ "out" "dev" ] ++ lib.optionals x11Support [ "devdoc" ];
   outputBin = "dev";
@@ -71,7 +74,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk/${lib.versions.majorMinor version}/gtk-${version}.tar.xz";
-    sha256 = "D6ramD3GsLxAnLNMFxPB8yZ+Z8CT+GseOxfbYQCj3fQ=";
+    sha256 = "eC1ZUfv9WF/J7HbAnQfijmAUxy2wAftWf/8hf7luTYw=";
   };
 
   nativeBuildInputs = [
@@ -89,7 +92,10 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     libxkbcommon
-    libepoxy
+    libpng
+    libtiff
+    libjpeg
+    (libepoxy.override { inherit x11Support; })
     isocodes
   ] ++ lib.optionals vulkanSupport [
     vulkan-headers
@@ -130,6 +136,8 @@ stdenv.mkDerivation rec {
     glib
     graphene
     pango
+  ] ++ lib.optionals waylandSupport [
+    wayland
   ] ++ lib.optionals vulkanSupport [
     vulkan-loader
   ] ++ [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/hunspell/default.nix b/third_party/nixpkgs/pkgs/development/libraries/hunspell/default.nix
index fe4fc1e6d3..44f49adbd3 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/hunspell/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/hunspell/default.nix
@@ -1,12 +1,14 @@
-{ lib, stdenv, fetchurl, fetchpatch, ncurses, readline, autoreconfHook }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, ncurses, readline, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   version = "1.7.0";
   pname = "hunspell";
 
-  src = fetchurl {
-    url = "https://github.com/hunspell/hunspell/archive/v${version}.tar.gz";
-    sha256 = "12mwwqz6qkx7q1lg9vpjiiwh4fk4c8xs6g6g0xa2ia0hp5pbh9xv";
+  src = fetchFromGitHub {
+    owner = "hunspell";
+    repo = "hunspell";
+    rev = "v${version}";
+    sha256 = "sha256-YSJztik0QTZFNR8k8Xu1hakyE16NziDavYVkEUCbtGM=";
   };
 
   outputs = [ "bin" "dev" "out" "man" ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/iso-codes/default.nix b/third_party/nixpkgs/pkgs/development/libraries/iso-codes/default.nix
index 75ace8097c..1b4396bfee 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/iso-codes/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/iso-codes/default.nix
@@ -1,12 +1,12 @@
-{lib, stdenv, fetchurl, gettext, python3}:
+{ lib, stdenv, fetchurl, gettext, python3 }:
 
 stdenv.mkDerivation rec {
   pname = "iso-codes";
-  version = "4.6.0";
+  version = "4.9.0";
 
   src = fetchurl {
-    url = "https://salsa.debian.org/iso-codes-team/iso-codes/-/archive/${pname}-${version}/${pname}-${pname}-${version}.tar.bz2";
-    sha256 = "sha256-Ivd5538QpTFXP2r6ca/g12IZ0ZW1nduu0z4kiSb9Mxs=";
+    url = "https://salsa.debian.org/iso-codes-team/iso-codes/-/archive/v${version}/${pname}-v${version}.tar.gz";
+    sha256 = "02lq602ghws423w04jsyjr92p0nmrfp59n1m5hbbi1c6fhxryghc";
   };
 
   patchPhase = ''
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libadwaita/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libadwaita/default.nix
index 6a519841d7..0e1a0036dd 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libadwaita/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libadwaita/default.nix
@@ -5,7 +5,7 @@
 , gi-docgen
 , gtk-doc
 , libxml2
-, meson_0_60
+, meson
 , ninja
 , pkg-config
 , sassc
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libadwaita";
-  version = "1.0.0.alpha.4";
+  version = "1.0.1";
 
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "devdoc"; # demo app
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     owner = "GNOME";
     repo = "libadwaita";
     rev = version;
-    sha256 = "sha256-3aVeBaKSl6SaPQLodsyJHwnNOlXlWfIaLnbbl3+mlDA=";
+    sha256 = "sha256-2+elMEZwDPWkPDrmvLH5rxulh1tq6fgsMhbTdbrWe54=";
   };
 
   nativeBuildInputs = [
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     gi-docgen
     gtk-doc
     libxml2 # for xmllint
-    meson_0_60
+    meson
     ninja
     pkg-config
     sassc
@@ -95,7 +95,7 @@ stdenv.mkDerivation rec {
     description = "Library to help with developing UI for mobile devices using GTK/GNOME";
     homepage = "https://gitlab.gnome.org/GNOME/libadwaita";
     license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [ dotlambda ];
+    maintainers = teams.gnome.members ++ (with maintainers; [ dotlambda ]);
     platforms = platforms.linux;
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libdeltachat/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libdeltachat/default.nix
index 5db8e7524b..48c20c8b7c 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libdeltachat/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libdeltachat/default.nix
@@ -6,6 +6,7 @@
 , perl
 , pkg-config
 , rustPlatform
+, sqlcipher
 , sqlite
 , fixDarwinDylibNames
 , CoreFoundation
@@ -15,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libdeltachat";
-  version = "1.70.0";
+  version = "1.72.0";
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-core-rust";
     rev = version;
-    hash = "sha256-702XhFWvFG+g++3X97sy6C5DMNWogv1Xbr8QPR8QyLo=";
+    hash = "sha256-/StX22pSQtfOYbBTFL7vh0Y0V038Ohyq+qoDECITD80=";
   };
 
   patches = [
@@ -33,7 +34,7 @@ stdenv.mkDerivation rec {
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-MiSGJMXe8vouv4XEHXq274FHEvBMtd7IX6DyNJIWYeU=";
+    hash = "sha256-Jwf95oTyGsOikVMKAg+EaDNY78VW+kECD+lhNePSKWE=";
   };
 
   nativeBuildInputs = [
@@ -49,6 +50,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     openssl
+    sqlcipher
     sqlite
   ] ++ lib.optionals stdenv.isDarwin [
     CoreFoundation
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libepoxy/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libepoxy/default.nix
index bb6d6a1423..c54c3c86d2 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libepoxy/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libepoxy/default.nix
@@ -10,6 +10,7 @@
 , libX11
 , Carbon
 , OpenGL
+, x11Support ? !stdenv.isDarwin
 }:
 
 let
@@ -40,7 +41,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ meson ninja pkg-config utilmacros python3 ];
 
-  buildInputs = [
+  buildInputs = lib.optionals x11Support [
     libGL
     libX11
   ] ++ lib.optionals stdenv.isDarwin [
@@ -50,10 +51,10 @@ stdenv.mkDerivation rec {
 
   mesonFlags = [
     "-Dtests=${if doCheck then "true" else "false"}"
-  ]
-  ++ optional stdenv.isDarwin "-Dglx=yes";
+    "-Dglx=${if x11Support then "yes" else "no"}"
+  ];
 
-  NIX_CFLAGS_COMPILE = ''-DLIBGL_PATH="${getLib libGL}/lib"'';
+  NIX_CFLAGS_COMPILE = lib.optionalString x11Support ''-DLIBGL_PATH="${getLib libGL}/lib"'';
 
   # cgl_epoxy_api fails in darwin sandbox and on Hydra (because it's headless?)
   preCheck = lib.optionalString stdenv.isDarwin ''
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libextractor/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libextractor/default.nix
index cef1fbc512..7251e5b645 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libextractor/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libextractor/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     (substituteAll {
       src = ./gst-hardcode-plugins.patch;
       load_gst_plugins = lib.concatMapStrings
-        (plugin: ''gst_registry_scan_path(gst_registry_get(), "${plugin}/lib/gstreamer-1.0");'')
+        (plugin: ''gst_registry_scan_path(gst_registry_get(), "${lib.getLib plugin}/lib/gstreamer-1.0");'')
         (gstPlugins gst_all_1);
     })
   ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libfabric/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libfabric/default.nix
index c1c6ef7032..38c88fe70f 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libfabric/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libfabric/default.nix
@@ -3,7 +3,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libfabric";
-  version = "1.13.2";
+  version = "1.14.0";
 
   enableParallelBuilding = true;
 
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     owner = "ofiwg";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ydMZP83keUGDYDw9i/SCa4U1KEgfuqkFklwRKbfLoK8=";
+    sha256 = "sha256-MmvJV3Pne+bJtC91rdpNMZovoqMgm3gHFJwGH3tchgI=";
   };
 
   nativeBuildInputs = [ pkg-config autoreconfHook ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libffi/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libffi/default.nix
index 4332f43c5a..6a22d585fb 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libffi/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libffi/default.nix
@@ -1,6 +1,8 @@
 { lib, stdenv, fetchurl, fetchpatch
 , autoreconfHook
 
+, doCheck ? true # test suite depends on dejagnu which cannot be used during bootstrapping
+, dejagnu
 }:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
@@ -39,6 +41,10 @@ stdenv.mkDerivation rec {
 
   dontStrip = stdenv.hostPlatform != stdenv.buildPlatform; # Don't run the native `strip' when cross-compiling.
 
+  inherit doCheck;
+
+  checkInputs = [ dejagnu ];
+
   meta = with lib; {
     description = "A foreign function call interface library";
     longDescription = ''
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libfprint-tod/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libfprint-tod/default.nix
index 8d7df57896..bffafc5e44 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libfprint-tod/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libfprint-tod/default.nix
@@ -19,7 +19,9 @@ in  {
     sha256 = "0cj7iy5799pchyzqqncpkhibkq012g3bdpn18pfb19nm43svhn4j";
   };
 
-  mesonFlags = mesonFlags ++ [
+  mesonFlags = [
+    # Include virtual drivers for fprintd tests
+    "-Ddrivers=all"
     "-Dudev_hwdb_dir=${placeholder "out"}/lib/udev/hwdb.d"
   ];
 
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libgda/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libgda/default.nix
index 63acabb320..a9993b7255 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libgda/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libgda/default.nix
@@ -11,8 +11,6 @@
 , gobject-introspection
 , vala
 , libgee
-, overrideCC
-, gcc6
 , fetchpatch
 , autoreconfHook
 , gtk-doc
@@ -27,7 +25,7 @@
 assert mysqlSupport -> libmysqlclient != null;
 assert postgresSupport -> postgresql != null;
 
-(if stdenv.isAarch64 then overrideCC stdenv gcc6 else stdenv).mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "libgda";
   version = "5.2.10";
 
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libhttpseverywhere/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libhttpseverywhere/default.nix
index 975ad22581..80bc73e9a0 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libhttpseverywhere/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libhttpseverywhere/default.nix
@@ -15,12 +15,17 @@ in stdenv.mkDerivation rec {
   nativeBuildInputs = [ vala gobject-introspection meson ninja pkg-config ];
   buildInputs = [ glib libgee json-glib libsoup libarchive ];
 
-  # Fixes build with vala >=0.42
   patches = [
+    # Fixes build with vala >=0.42
     (fetchpatch {
       url = "https://gitlab.gnome.org/GNOME/libhttpseverywhere/commit/6da08ef1ade9ea267cecf14dd5cb2c3e6e5e50cb.patch";
       sha256 = "1nwjlh8iqgjayccwdh0fbpq2g1h8bg1k1g9i324f2bhhvyhmpq8f";
     })
+    # fix build with meson 0.60
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/libhttpseverywhere/-/commit/4c38b2ca25802c464f3204a62815201d8cf549fd.patch";
+      sha256 = "sha256-1+fmR0bpvJ9ISN2Hr+BTIQz+Bf6VfY1RdVZ/OohUlWU=";
+    })
   ];
 
   mesonFlags = [ "-Denable_valadoc=true" ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libhwy/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libhwy/default.nix
new file mode 100644
index 0000000000..7656e06382
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/libraries/libhwy/default.nix
@@ -0,0 +1,47 @@
+{ lib, stdenv, cmake, ninja, gtest, fetchpatch, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "libhwy";
+  version = "0.15.0";
+
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = "highway";
+    rev = version;
+    sha256 = "sha256-v2HyyHtBydr7QiI83DW1yRv2kWjUOGxFT6mmdrN9XPo=";
+  };
+
+  patches = [
+    # Remove on next release
+    # https://github.com/google/highway/issues/460
+    (fetchpatch {
+      name = "hwy-add-missing-includes.patch";
+      url = "https://github.com/google/highway/commit/8ccab40c2f931aca6004d175eec342cc60f6baec.patch";
+      sha256 = "sha256-wlp5gIvK2+OlKtsZwxq/pXTbESkUtimHXaYDjcBzmQ0=";
+    })
+  ];
+
+  nativeBuildInputs = [ cmake ninja ];
+
+  checkInputs = [ gtest ];
+
+  # Required for case-insensitive filesystems ("BUILD" exists)
+  dontUseCmakeBuildDir = true;
+
+  cmakeFlags = [
+    "-GNinja"
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+  ] ++ lib.optional doCheck "-DHWY_SYSTEM_GTEST:BOOL=ON";
+
+  # hydra's darwin machines run into https://github.com/libjxl/libjxl/issues/408
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
+  meta = with lib; {
+    description = "Performance-portable, length-agnostic SIMD with runtime dispatch";
+    homepage = "https://github.com/google/highway";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ zhaofengli ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libjxl/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libjxl/default.nix
index 828090875e..081ddaf498 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libjxl/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libjxl/default.nix
@@ -8,6 +8,7 @@
 , giflib
 , gperftools
 , gtest
+, libhwy
 , libjpeg
 , libpng
 , libwebp
@@ -37,14 +38,16 @@ stdenv.mkDerivation rec {
       url = "https://github.com/libjxl/libjxl/commit/88fe3fff3dc70c72405f57c69feffd9823930034.patch";
       sha256 = "1419fyiq4srpj72cynwyvqy8ldi7vn9asvkp5fsbmiqkyhb15jpk";
     })
-  ];
 
-  # hydra's darwin machines run into https://github.com/libjxl/libjxl/issues/408
-  # unless we disable highway's tests
-  postPatch = lib.optional stdenv.isDarwin ''
-    substituteInPlace third_party/highway/CMakeLists.txt \
-      --replace 'if(BUILD_TESTING)' 'if(false)'
-  '';
+    # "robust statistics" have been removed in upstream mainline as they are
+    # conidered to cause "interoperability problems". sure enough the tests
+    # fail with precision issues on aarch64.
+    (fetchpatch {
+      name = "remove-robust-and-descriptive-statistics.patch";
+      url = "https://github.com/libjxl/libjxl/commit/204f87a5e4d684544b13900109abf040dc0b402b.patch";
+      sha256 = "sha256-DoAaYWLmQ+R9GZbHMTYGe0gBL9ZesgtB+2WhmbARna8=";
+    })
+  ];
 
   nativeBuildInputs = [
     asciidoc # for docs
@@ -76,6 +79,7 @@ stdenv.mkDerivation rec {
     brotli
     giflib
     gperftools # provides `libtcmalloc`
+    libhwy
     libjpeg
     libpng
     libwebp
@@ -91,6 +95,9 @@ stdenv.mkDerivation rec {
     # using the vendorered ones is easier.
     "-DJPEGXL_FORCE_SYSTEM_BROTLI=ON"
 
+    # Use our version of highway, though it is still statically linked in
+    "-DJPEGXL_FORCE_SYSTEM_HWY=ON"
+
     # TODO: Update this package to enable this (overridably via an option):
     # Viewer tools for evaluation.
     # "-DJPEGXL_ENABLE_VIEWERS=ON"
@@ -102,13 +109,17 @@ stdenv.mkDerivation rec {
     # "-DJPEGXL_ENABLE_PLUGINS=ON"
   ];
 
+  LDFLAGS = lib.optionalString stdenv.hostPlatform.isRiscV "-latomic";
+
   doCheck = true;
 
   # The test driver runs a test `LibraryCLinkageTest` which without
   # LD_LIBRARY_PATH setting errors with:
   #     /build/source/build/tools/tests/libjxl_test: error while loading shared libraries: libjxl.so.0
   # The required file is in the build directory (`$PWD`).
-  preCheck = ''
+  preCheck = if stdenv.isDarwin then ''
+    export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}$PWD
+  '' else ''
     export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD
   '';
 
@@ -118,6 +129,5 @@ stdenv.mkDerivation rec {
     license = licenses.bsd3;
     maintainers = with maintainers; [ nh2 ];
     platforms = platforms.all;
-    broken = stdenv.hostPlatform.isAarch64; # `internal compiler error`, see https://github.com/NixOS/nixpkgs/pull/103160#issuecomment-866388610
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libmodulemd/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libmodulemd/default.nix
index 79f590af5f..8f59975a59 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libmodulemd/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libmodulemd/default.nix
@@ -56,7 +56,6 @@ stdenv.mkDerivation rec {
   ];
 
   mesonFlags = [
-    "-Ddeveloper_build=false"
     "-Dgobject_overrides_dir_py3=${placeholder "py"}/${python3.sitePackages}/gi/overrides"
   ];
 
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libnice/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libnice/default.nix
index 87f2d73271..42fb795d38 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libnice/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libnice/default.nix
@@ -13,6 +13,7 @@
 , gupnp-igd
 , gst_all_1
 , gnutls
+, graphviz
 }:
 
 stdenv.mkDerivation rec {
@@ -48,6 +49,7 @@ stdenv.mkDerivation rec {
     gtk-doc
     docbook_xsl
     docbook_xml_dtd_412
+    graphviz
   ];
 
   buildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libportal/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libportal/default.nix
index 97c5303eab..b261c0395e 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libportal/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libportal/default.nix
@@ -4,42 +4,66 @@
 , meson
 , ninja
 , pkg-config
-, gtk-doc
-, docbook-xsl-nons
-, docbook_xml_dtd_45
+, gobject-introspection
+, vala
+, gi-docgen
 , glib
+, gtk3
+, gtk4
+, libsForQt5
+, variant ? null
 }:
 
+assert variant == null || variant == "gtk3" || variant == "gtk4" || variant == "qt5";
+
 stdenv.mkDerivation rec {
-  pname = "libportal";
-  version = "0.4";
+  pname = "libportal" + lib.optionalString (variant != null) "-${variant}";
+  version = "0.5";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchFromGitHub {
     owner = "flatpak";
-    repo = pname;
+    repo = "libportal";
     rev = version;
-    sha256 = "fuYZWGkdazq6H0rThqpF6KIcvwgc17o+CiISb1LjBso=";
+    sha256 = "oPPO2f6NNeok0SGh4jELkkOP6VUxXZiwPM/n6CUHm0Q=";
   };
 
   nativeBuildInputs = [
     meson
     ninja
     pkg-config
-    gtk-doc
-    docbook-xsl-nons
-    docbook_xml_dtd_45
+    gi-docgen
+  ] ++ lib.optionals (variant != "qt5") [
+    gobject-introspection
+    vala
   ];
 
   propagatedBuildInputs = [
     glib
+  ] ++ lib.optionals (variant == "gtk3") [
+    gtk3
+  ] ++ lib.optionals (variant == "gtk4") [
+    gtk4
+  ] ++ lib.optionals (variant == "qt5") [
+    libsForQt5.qtbase
   ];
 
+  mesonFlags = [
+    "-Dbackends=${lib.optionalString (variant != null) variant}"
+    "-Dvapi=${if variant != "qt5" then "true" else "false"}"
+    "-Dintrospection=${if variant != "qt5" then "true" else "false"}"
+  ];
+
+  postFixup = ''
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    moveToOutput "share/doc" "$devdoc"
+  '';
+
   meta = with lib; {
     description = "Flatpak portal library";
     homepage = "https://github.com/flatpak/libportal";
-    license = licenses.lgpl2Plus;
+    license = licenses.lgpl3Plus;
     maintainers = with maintainers; [ jtojnar ];
     platforms = platforms.linux;
   };
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libptytty/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libptytty/default.nix
new file mode 100644
index 0000000000..63f50de287
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/libraries/libptytty/default.nix
@@ -0,0 +1,26 @@
+{ stdenv
+, lib
+, fetchurl
+, cmake
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libptytty";
+  version = "2.0";
+
+  src = fetchurl {
+    url = "http://dist.schmorp.de/libptytty/${pname}-${version}.tar.gz";
+    sha256 = "1xrikmrsdkxhdy9ggc0ci6kg5b1hn3bz44ag1mk5k1zjmlxfscw0";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with lib; {
+    description = "OS independent and secure pty/tty and utmp/wtmp/lastlog";
+    homepage = "http://dist.schmorp.de/libptytty";
+    maintainers = with maintainers; [ rnhmjoj ];
+    platforms = platforms.unix;
+    license = licenses.gpl2;
+  };
+
+}
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libseccomp/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libseccomp/default.nix
index 0a76e59e5b..d0e8bd163d 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libseccomp/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libseccomp/default.nix
@@ -1,12 +1,12 @@
-{ lib, stdenv, fetchurl, getopt, util-linux, gperf }:
+{ lib, stdenv, fetchurl, getopt, util-linux, gperf, nix-update-script }:
 
 stdenv.mkDerivation rec {
   pname = "libseccomp";
-  version = "2.5.2";
+  version = "2.5.3";
 
   src = fetchurl {
     url = "https://github.com/seccomp/libseccomp/releases/download/v${version}/libseccomp-${version}.tar.gz";
-    sha256 = "sha256-F6ZS37SR2Wvok5YOm3kZFJNu4WwTt3ejyvVi/kjLh98=";
+    sha256 = "sha256-WQZchzM2RyXpchukjDqZu8Uq+SHa9I30seAS+8exCnY=";
   };
 
   outputs = [ "out" "lib" "dev" "man" "pythonsrc" ];
@@ -31,6 +31,12 @@ stdenv.mkDerivation rec {
     tar -zcf $pythonsrc --mtime="@$SOURCE_DATE_EPOCH" --sort=name --transform s/tmp-pythonsrc/python-foundationdb/ ./tmp-pythonsrc/
   '';
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = pname;
+    };
+  };
+
   meta = with lib; {
     description = "High level library for the Linux Kernel seccomp filter";
     homepage = "https://github.com/seccomp/libseccomp";
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libsoup/3.x.nix b/third_party/nixpkgs/pkgs/development/libraries/libsoup/3.x.nix
index ef87c5f203..454a1cdf40 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libsoup/3.x.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libsoup/3.x.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libsoup";
-  version = "3.0.3";
+  version = "3.0.4";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-UWWwTa2uMCfpoogthoaUtFhq/9d4wZSYKuTeI3PS4l4=";
+    sha256 = "sha256-W9OLXgkfcH/X+j7Xw3qsyj+OFsZXh/HMF9w40dzeVns=";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libthai/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libthai/default.nix
index 97745813ef..7755fffc7a 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libthai/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libthai/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libthai";
-  version = "0.1.28";
+  version = "0.1.29";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://github.com/tlwg/libthai/releases/download/v${version}/libthai-${version}.tar.xz";
-    sha256 = "04g93bgxrcnay9fglpq2lj9nr7x1xh06i60m7haip8as9dxs3q7z";
+    sha256 = "sha256-/IDMfctQ4RMCtBfOvSTy0wqLmHKS534AMme5EA0PS80=";
   };
 
   strictDeps = true;
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libthreadar/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libthreadar/default.nix
index bff42af3ac..5a88d4ba20 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libthreadar/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libthreadar/default.nix
@@ -32,5 +32,6 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ izorkin ];
     license = licenses.lgpl3;
     platforms = platforms.unix;
+    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/libthreadar.x86_64-darwin
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libtiff/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libtiff/default.nix
index 2fe6159556..5f34a80d25 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libtiff/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libtiff/default.nix
@@ -8,11 +8,6 @@
 , libjpeg
 , xz
 , zlib
-
-, Cocoa
-, GLUT
-, libGL
-, libGLU
 }:
 
 #FIXME: fix aarch64-darwin build and get rid of ./aarch64-darwin.nix
@@ -52,8 +47,7 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ libjpeg xz zlib ]; #TODO: opengl support (bogus configure detection)
 
-  buildInputs = [ libdeflate ] # TODO: move all propagatedBuildInputs to buildInputs.
-    ++ lib.optionals (stdenv.isDarwin) [ Cocoa GLUT libGL libGLU ];
+  buildInputs = [ libdeflate ];
 
   enableParallelBuilding = true;
 
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libusbgx/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libusbgx/default.nix
new file mode 100644
index 0000000000..676870aee5
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/libraries/libusbgx/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, lib, fetchFromGitHub, cmake, bash-completion, pkg-config, libconfig, autoreconfHook }:
+stdenv.mkDerivation {
+  pname = "libusbgx";
+  version = "unstable-2021-10-31";
+  src = fetchFromGitHub {
+    owner = "linux-usb-gadgets";
+    repo = "libusbgx";
+    rev = "060784424609d5a4e3bce8355f788c93f09802a5";
+    sha256 = "172qh8gva17jr18ldhf9zi960w2bqzmp030w6apxq57c9nv6d8k7";
+  };
+  nativeBuildInputs = [ autoreconfHook pkg-config ];
+  buildInputs = [ libconfig ];
+  meta = {
+    description = "C library encapsulating the kernel USB gadget-configfs userspace API functionality";
+    license = with lib.licenses; [
+      lgpl21Plus # library
+      gpl2Plus # examples
+    ];
+    maintainers = with lib.maintainers; [ lheckemann ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libuv/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libuv/default.nix
index a3de139fb4..1d9354d48e 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libuv/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libuv/default.nix
@@ -1,14 +1,14 @@
 { stdenv, lib, fetchFromGitHub, autoconf, automake, libtool, pkg-config, ApplicationServices, CoreServices }:
 
 stdenv.mkDerivation rec {
-  version = "1.42.0";
+  version = "1.43.0";
   pname = "libuv";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "0f6mfbg750q26fa85nhmw2m0gyp8jcp1kyx9zn6lgi8bha5b7kny";
+    sha256 = "sha256-AsXJb2AGNx+SARPmY8uRFRLfX5vqTPNjwL8njSw/e7o=";
   };
 
   postPatch = let
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libzim/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libzim/default.nix
index 994fbe3f14..5191da60ce 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libzim/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libzim/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libzim";
-  version = "7.1.0";
+  version = "7.2.0";
 
   src = fetchFromGitHub {
     owner = "openzim";
     repo = pname;
     rev = version;
-    sha256 = "sha256-8mKUYvw/0aqrerNNKk0V7r5LByEaaJLg43R/0pwM4Z8=";
+    sha256 = "sha256-H4YUAbH4X6oJIZyhI23LemngtOtKNrHHl3KSU1ilAmo=";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/mesa/default.nix b/third_party/nixpkgs/pkgs/development/libraries/mesa/default.nix
index cb1d99aff2..69f43d31da 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/mesa/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/mesa/default.nix
@@ -33,7 +33,7 @@ with lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "21.3.3";
+  version = "21.3.4";
   branch  = versions.major version;
 
 self = stdenv.mkDerivation {
@@ -47,18 +47,20 @@ self = stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "08c118j440xpfbjjxmwzm6dfnv4y35q540mmzkchhpbwx89lczxd";
+    sha256 = "0zd6skf9qcwlk1k1ljgwijwlyz5si3pgi0h97gd6kkivm7a4y43p";
   };
 
   # TODO:
   #  revive ./dricore-gallium.patch when it gets ported (from Ubuntu), as it saved
   #  ~35 MB in $drivers; watch https://launchpad.net/ubuntu/+source/mesa/+changelog
   patches = [
-    # fixes pkgsMusl.mesa build
+    # To fix flickering on Intel GPUs (iris), see https://github.com/NixOS/nixpkgs/issues/153377:
     (fetchpatch {
-      url = "https://raw.githubusercontent.com/void-linux/void-packages/b9f58f303ae23754c95d5d1fe87a98b5a2d8f271/srcpkgs/mesa/patches/musl.patch";
-      sha256 = "sha256-Jyl7ILLhn8hBJG7afnEjE8H56Wz/1bxkvlqfrXK5U7I=";
+      url = "https://gitlab.freedesktop.org/mesa/mesa/-/commit/07dc3d4238e57901ccf98e0b506d9aad2c86b9d9.diff";
+      sha256 = "sha256-3fa1qHJes3x1/iXsxfjgy9HnEGlOyFtJatSkU1a3XDI=";
     })
+    # fixes pkgsMusl.mesa build
+    ./musl.patch
     (fetchpatch {
       url = "https://raw.githubusercontent.com/void-linux/void-packages/b9f58f303ae23754c95d5d1fe87a98b5a2d8f271/srcpkgs/mesa/patches/musl-endian.patch";
       sha256 = "sha256-eRc91qCaFlVzrxFrNUPpAHd1gsqKsLCCN0IW8pBQcqk=";
diff --git a/third_party/nixpkgs/pkgs/development/libraries/mesa/musl.patch b/third_party/nixpkgs/pkgs/development/libraries/mesa/musl.patch
new file mode 100644
index 0000000000..687a159c17
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/libraries/mesa/musl.patch
@@ -0,0 +1,59 @@
+diff --git a/src/amd/vulkan/winsys/amdgpu/radv_amdgpu_winsys.h b/src/amd/vulkan/winsys/amdgpu/radv_amdgpu_winsys.h
+index 06ca90564f0..bb244f8f358 100644
+--- a/src/amd/vulkan/winsys/amdgpu/radv_amdgpu_winsys.h
++++ b/src/amd/vulkan/winsys/amdgpu/radv_amdgpu_winsys.h
+@@ -30,6 +30,7 @@
+ 
+ #include <amdgpu.h>
+ #include <pthread.h>
++#include <sys/types.h>
+ #include "util/list.h"
+ #include "util/rwlock.h"
+ #include "ac_gpu_info.h"
+diff --git a/src/gallium/drivers/freedreno/freedreno_util.h b/src/gallium/drivers/freedreno/freedreno_util.h
+index 22f99c41909..2f3195926be 100644
+--- a/src/gallium/drivers/freedreno/freedreno_util.h
++++ b/src/gallium/drivers/freedreno/freedreno_util.h
+@@ -108,6 +108,8 @@ extern bool fd_binning_enabled;
+ #include <sys/types.h>
+ #include <sys/syscall.h>
+ 
++#define gettid() ((pid_t)syscall(SYS_gettid))
++
+ #define DBG(fmt, ...)                                                          \
+    do {                                                                        \
+       if (FD_DBG(MSGS))                                                        \
+diff --git a/src/gallium/frontends/nine/nine_debug.c b/src/gallium/frontends/nine/nine_debug.c
+index f3a6a945025..f4a6c41a612 100644
+--- a/src/gallium/frontends/nine/nine_debug.c
++++ b/src/gallium/frontends/nine/nine_debug.c
+@@ -65,7 +65,7 @@ _nine_debug_printf( unsigned long flag,
+ {
+     static boolean first = TRUE;
+     static unsigned long dbg_flags = DBG_ERROR | DBG_WARN;
+-    unsigned long tid = 0;
++    pthread_t tid = 0;
+ 
+     if (first) {
+         first = FALSE;
+@@ -74,7 +74,7 @@ _nine_debug_printf( unsigned long flag,
+ 
+ #if defined(HAVE_PTHREAD)
+     if (dbg_flags & DBG_TID)
+-        tid = (unsigned long)pthread_self();
++        tid = pthread_self();
+ #endif
+ 
+     if (dbg_flags & flag) {
+diff --git a/src/util/rand_xor.c b/src/util/rand_xor.c
+index 81b64f1ea71..56ebd2eccdf 100644
+--- a/src/util/rand_xor.c
++++ b/src/util/rand_xor.c
+@@ -28,6 +28,7 @@
+ #if defined(HAVE_GETRANDOM)
+ #include <sys/random.h>
+ #endif
++#include <sys/types.h>         /* size_t, ssize_t */
+ #include <unistd.h>
+ #include <fcntl.h>
+ #endif
diff --git a/third_party/nixpkgs/pkgs/development/libraries/ncnn/cmakelists.patch b/third_party/nixpkgs/pkgs/development/libraries/ncnn/cmakelists.patch
new file mode 100644
index 0000000000..23499a1b99
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/libraries/ncnn/cmakelists.patch
@@ -0,0 +1,13 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 98611276..989350bb 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -260,6 +260,8 @@ if(NCNN_VULKAN)
+                 include("${GLSLANG_TARGET_DIR}/HLSLTargets.cmake")
+             endif()
+             include("${GLSLANG_TARGET_DIR}/glslangTargets.cmake")
++            include("${GLSLANG_TARGET_DIR}/SPIRV-Tools/SPIRV-ToolsTarget.cmake")
++            include("${GLSLANG_TARGET_DIR}/SPIRV-Tools-opt/SPIRV-Tools-optTargets.cmake")
+             include("${GLSLANG_TARGET_DIR}/SPIRVTargets.cmake")
+ 
+             if (NOT TARGET glslang OR NOT TARGET SPIRV)
diff --git a/third_party/nixpkgs/pkgs/development/libraries/ncnn/default.nix b/third_party/nixpkgs/pkgs/development/libraries/ncnn/default.nix
new file mode 100644
index 0000000000..d53e0d9b42
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/libraries/ncnn/default.nix
@@ -0,0 +1,50 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, vulkan-headers
+, vulkan-loader
+, glslang
+, opencv
+, protobuf
+}:
+
+stdenv.mkDerivation rec {
+  pname = "ncnn";
+  version = "20211208";
+
+  src = fetchFromGitHub {
+    owner = "Tencent";
+    repo = pname;
+    rev = version;
+    sha256 = "1c9axrnafksnks7v5fmi6nzs0qim9n6j5kh5d0vfl3b4r22irhqr";
+  };
+
+  patches = [
+    ./cmakelists.patch
+    ./gpu-include.patch
+  ];
+
+  cmakeFlags = [
+    "-DNCNN_CMAKE_VERBOSE=1" # Only for debugging the build
+    "-DNCNN_SHARED_LIB=1"
+    "-DNCNN_ENABLE_LTO=1"
+    "-DNCNN_VULKAN=1"
+    "-DNCNN_BUILD_EXAMPLES=0"
+    "-DNCNN_BUILD_TOOLS=0"
+    "-DNCNN_SYSTEM_GLSLANG=1"
+    "-DNCNN_PYTHON=0" # Should be an attribute
+
+    "-DGLSLANG_TARGET_DIR=${glslang}/lib/cmake"
+  ];
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ vulkan-headers vulkan-loader glslang opencv protobuf ];
+
+  meta = with lib; {
+    description = "ncnn is a high-performance neural network inference framework optimized for the mobile platform";
+    homepage = "https://github.com/Tencent/ncnn";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ tilcreator ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/libraries/ncnn/gpu-include.patch b/third_party/nixpkgs/pkgs/development/libraries/ncnn/gpu-include.patch
new file mode 100644
index 0000000000..8f751c7699
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/libraries/ncnn/gpu-include.patch
@@ -0,0 +1,13 @@
+diff --git a/src/gpu.cpp b/src/gpu.cpp
+index 51cd7f95..bf7ed828 100644
+--- a/src/gpu.cpp
++++ b/src/gpu.cpp
+@@ -21,7 +21,7 @@
+ #include <vulkan/vulkan.h>
+ 
+ #include "glslang/SPIRV/GlslangToSpv.h"
+-#include "glslang/glslang/Public/ShaderLang.h"
++#include "glslang/Public/ShaderLang.h"
+ 
+ #include "command.h"
+ #include "layer.h"
diff --git a/third_party/nixpkgs/pkgs/development/libraries/ncurses/default.nix b/third_party/nixpkgs/pkgs/development/libraries/ncurses/default.nix
index bdce5f48ef..6c97b37a25 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/ncurses/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/ncurses/default.nix
@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation rec {
   # Note the revision needs to be adjusted.
-  version = "6.2";
+  version = "6.3";
   name = "ncurses-${version}" + lib.optionalString (abiVersion == "5") "-abi5-compat";
 
   # We cannot use fetchFromGitHub (which calls fetchzip)
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     rev = "v${version}";
   in fetchurl {
     url = "https://github.com/mirror/ncurses/archive/${rev}.tar.gz";
-    sha256 = "15r2456g0mlq2q7gh2z52vl6zv6y0z8sdchrs80kg4idqd8sm8fd";
+    sha256 = "1mawdjhzl2na2j0dylwc37f5w95rhgyvlwnfhww5rz2r7fgkvayv";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/nss/default.nix b/third_party/nixpkgs/pkgs/development/libraries/nss/default.nix
index e5819e1d75..e92b3dec07 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/nss/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/nss/default.nix
@@ -27,7 +27,7 @@ let
   #       It will rebuild itself using the version of this package (NSS) and if
   #       an update is required do the required changes to the expression.
   #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert
-  version = "3.73.1";
+  version = "3.74";
 
 in
 stdenv.mkDerivation rec {
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings [ "." ] [ "_" ] version}_RTM/src/${pname}-${version}.tar.gz";
-    sha256 = "x2j5/jEp6LzC6WeUVtft2UU6IleEqPx9xFAYBvH+mr4=";
+    sha256 = "0mnhdkm4galhpvfz4rv0918jwmjlwkvcvb1f5va8f3zlz48qi4l8";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/openexr/3.nix b/third_party/nixpkgs/pkgs/development/libraries/openexr/3.nix
index 24af4e429a..3cfe173875 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/openexr/3.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/openexr/3.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , zlib
 , cmake
 , imath
@@ -19,9 +20,26 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Bi6yTcZBWTsWWMm3A7FVYblvSXKLSkHmhGvpNYGiOzE=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2021-45942.patch";
+      url = "https://github.com/AcademySoftwareFoundation/openexr/commit/11cad77da87c4fa2aab7d58dd5339e254db7937e.patch";
+      sha256 = "1qa8662ga5i0lyfi9mkj9s9bygdg7h1i6ahki28c664kxrlsakch";
+    })
+  ];
+
+  # tests are determined to use /var/tmp on unix
+  postPatch = ''
+    cat <(find . -name tmpDir.h) <(echo src/test/OpenEXRCoreTest/main.cpp) | while read -r f ; do
+      substituteInPlace $f --replace '/var/tmp' "$TMPDIR"
+    done
+  '';
+
   nativeBuildInputs = [ cmake ];
   propagatedBuildInputs = [ imath zlib ];
 
+  doCheck = true;
+
   meta = with lib; {
     description = "A high dynamic-range (HDR) image file format";
     homepage = "https://www.openexr.com/";
diff --git a/third_party/nixpkgs/pkgs/development/libraries/openexr/default.nix b/third_party/nixpkgs/pkgs/development/libraries/openexr/default.nix
index d60b7b7fc4..31ca485527 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/openexr/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/openexr/default.nix
@@ -26,6 +26,13 @@ stdenv.mkDerivation rec {
       url = "https://github.com/AcademySoftwareFoundation/openexr/commit/2f19a01923885fda75ec9d19332de080ec7102bd.patch";
       sha256 = "1yxmrdzq1x1911wdzwnzr29jmg2r4wd4yx3vhjn0y5dpny0ri5y5";
     })
+    (fetchpatch {
+      name = "CVE-2021-45942.patch";
+      url = "https://github.com/AcademySoftwareFoundation/openexr/commit/11cad77da87c4fa2aab7d58dd5339e254db7937e.patch";
+      stripLen = 4;
+      extraPrefix = "OpenEXR/IlmImf/";
+      sha256 = "1wa2jn6sa0n3phaqvklnlbgk1bz60y756ad4jk4d757pzpnannsy";
+    })
   ];
 
   nativeBuildInputs = [ cmake ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/pango/default.nix b/third_party/nixpkgs/pkgs/development/libraries/pango/default.nix
index a70a19e931..964a364087 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/pango/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/pango/default.nix
@@ -24,14 +24,14 @@
 
 stdenv.mkDerivation rec {
   pname = "pango";
-  version = "1.50.0";
+  version = "1.50.3";
 
   outputs = [ "bin" "out" "dev" ]
     ++ lib.optionals withDocs [ "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "26i2Ld+G4Q9z+Tw9Ila3MjiyvK+HA3yiKbQL3AQOs/M=";
+    sha256 = "St0F7fUcH7N1oczedJiRQSDiPLKA3XOVsa60QfGDikw=";
   };
 
   strictDeps = !withIntrospection;
diff --git a/third_party/nixpkgs/pkgs/development/libraries/pangomm/2.48.nix b/third_party/nixpkgs/pkgs/development/libraries/pangomm/2.48.nix
index f3fa6acec7..cdc644ec9c 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/pangomm/2.48.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/pangomm/2.48.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pangomm";
-  version= "2.48.2";
+  version= "2.50.0";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-4ddVIsU/RieZh1zSR/m0nJHO1LGr5oOHrDWycTktTqU=";
+    sha256 = "sha256-onqnfgF7mvzp51HYW9HPiQq7s6WL9Z0PrJF+74LbO1s=";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/polkit/default.nix b/third_party/nixpkgs/pkgs/development/libraries/polkit/default.nix
index dcc077e3dd..3a3199cbd7 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/polkit/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/polkit/default.nix
@@ -60,6 +60,11 @@ stdenv.mkDerivation rec {
       url = "https://gitlab.freedesktop.org/polkit/polkit/-/commit/7ba07551dfcd4ef9a87b8f0d9eb8b91fabcb41b3.patch";
       sha256 = "ebbLILncq1hAZTBMsLm+vDGw6j0iQ0crGyhzyLZQgKA=";
     })
+    # pkexec: local privilege escalation (CVE-2021-4034)
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683.patch";
+      sha256 = "162jkpg2myq0rb0s5k3nfr4pqwv9im13jf6vzj8p5l39nazg5i4s";
+    })
   ] ++ lib.optionals stdenv.hostPlatform.isMusl [
     # Make netgroup support optional (musl does not have it)
     # Upstream MR: https://gitlab.freedesktop.org/polkit/polkit/merge_requests/10
diff --git a/third_party/nixpkgs/pkgs/development/libraries/qt-5/5.12/default.nix b/third_party/nixpkgs/pkgs/development/libraries/qt-5/5.12/default.nix
index 6b213567ad..ef053eba9c 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/qt-5/5.12/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/qt-5/5.12/default.nix
@@ -148,7 +148,7 @@ let
         inherit (srcs.qtbase) src version;
         patches = patches.qtbase;
         inherit bison cups harfbuzz libGL;
-        withGtk3 = true; inherit dconf gtk3;
+        withGtk3 = !stdenv.isDarwin; inherit dconf gtk3;
         inherit debug developerBuild decryptSslTraffic;
         inherit (darwin.apple_sdk.frameworks) AGL AppKit ApplicationServices Carbon Cocoa CoreAudio CoreBluetooth
           CoreLocation CoreServices DiskArbitration Foundation OpenGL MetalKit IOKit;
diff --git a/third_party/nixpkgs/pkgs/development/libraries/qt-5/5.14/default.nix b/third_party/nixpkgs/pkgs/development/libraries/qt-5/5.14/default.nix
index f12aadea73..1f893fb051 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/qt-5/5.14/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/qt-5/5.14/default.nix
@@ -149,7 +149,7 @@ let
         inherit (srcs.qtbase) src version;
         patches = patches.qtbase;
         inherit bison cups harfbuzz libGL;
-        withGtk3 = true; inherit dconf gtk3;
+        withGtk3 = !stdenv.isDarwin; inherit dconf gtk3;
         inherit debug developerBuild decryptSslTraffic;
         inherit (darwin.apple_sdk.frameworks) AGL AppKit ApplicationServices Carbon Cocoa CoreAudio CoreBluetooth
           CoreLocation CoreServices DiskArbitration Foundation OpenGL MetalKit IOKit;
diff --git a/third_party/nixpkgs/pkgs/development/libraries/qt-5/5.15/default.nix b/third_party/nixpkgs/pkgs/development/libraries/qt-5/5.15/default.nix
index 19cca4237f..2a76409ce4 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -111,7 +111,7 @@ let
         inherit (srcs.qtbase) src version;
         patches = patches.qtbase;
         inherit bison cups harfbuzz libGL;
-        withGtk3 = true; inherit dconf gtk3;
+        withGtk3 = !stdenv.isDarwin; inherit dconf gtk3;
         inherit developerBuild decryptSslTraffic;
         inherit (darwin.apple_sdk.frameworks) AGL AppKit ApplicationServices Carbon Cocoa CoreAudio CoreBluetooth
           CoreLocation CoreServices DiskArbitration Foundation OpenGL MetalKit IOKit;
diff --git a/third_party/nixpkgs/pkgs/development/libraries/re2/default.nix b/third_party/nixpkgs/pkgs/development/libraries/re2/default.nix
index a70ad0f69e..22d803c17b 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/re2/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/re2/default.nix
@@ -1,14 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, nix-update-script }:
 
 stdenv.mkDerivation rec {
   pname = "re2";
-  version = "2021-09-01";
+  version = "2021-11-01";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "re2";
     rev = version;
-    sha256 = "1fyhypw345xz8zdh53gz6j1fwgrx0gszk1d349ja37dpxh4jp2jh";
+    sha256 = "sha256-q8u7xNp6n17F6twPoVkix8iCKPWUN+qg6rhSR4Dv+bI=";
   };
 
   patches = [
@@ -39,6 +39,12 @@ stdenv.mkDerivation rec {
   doInstallCheck = true;
   installCheckTarget = "testinstall";
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = pname;
+    };
+  };
+
   meta = {
     homepage = "https://github.com/google/re2";
     description = "An efficient, principled regular expression library";
diff --git a/third_party/nixpkgs/pkgs/development/libraries/retro-gtk/default.nix b/third_party/nixpkgs/pkgs/development/libraries/retro-gtk/default.nix
index e1385f7a3e..113143311e 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/retro-gtk/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/retro-gtk/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , cmake
 , meson
 , ninja
@@ -27,6 +28,11 @@ stdenv.mkDerivation rec {
   patches = [
     # https://gitlab.gnome.org/GNOME/retro-gtk/-/merge_requests/150
     ./gio-unix.patch
+    # fix build with meson 0.60 (https://gitlab.gnome.org/GNOME/retro-gtk/-/merge_requests/167)
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/retro-gtk/-/commit/8016c10e7216394bc66281f2d9be740140b6fad6.patch";
+      sha256 = "sha256-HcQnqadK5sJM5mMqi4KERkJM3H+MUl8AJAorpFDsJ68=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/science/math/openblas/default.nix b/third_party/nixpkgs/pkgs/development/libraries/science/math/openblas/default.nix
index 964cadbb61..d61b6ee3ac 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/science/math/openblas/default.nix
@@ -129,7 +129,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "openblas";
-  version = "0.3.18";
+  version = "0.3.19";
 
   outputs = [ "out" "dev" ];
 
@@ -137,7 +137,7 @@ stdenv.mkDerivation rec {
     owner = "xianyi";
     repo = "OpenBLAS";
     rev = "v${version}";
-    sha256 = "sha256-b5i52rjsH65qAIlYGXQrzVxChi8/fwbD4eJTrxVq7Z8=";
+    sha256 = "sha256-EqA6oFM2theuvvuDOWeOx0Bv6AEFffmpWHJBzp23br0=";
   };
 
   inherit blas64;
diff --git a/third_party/nixpkgs/pkgs/development/libraries/sqlite/default.nix b/third_party/nixpkgs/pkgs/development/libraries/sqlite/default.nix
index de433ba500..6704d894f5 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/sqlite/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/sqlite/default.nix
@@ -11,12 +11,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite";
-  version = "3.37.0";
+  version = "3.37.2";
 
+  # nixpkgs-update: no auto update
   # NB! Make sure to update ./tools.nix src (in the same directory).
   src = fetchurl {
-    url = "https://sqlite.org/2021/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    sha256 = "sha256-cxpGUdTUs2/H0h21hrLeTdAK8x/VT7WppLf0kgV0efc=";
+    url = "https://sqlite.org/2022/sqlite-autoconf-${archiveVersion version}.tar.gz";
+    sha256 = "sha256-QImo2bRnU3s/JG8he4TNduALHRqXH+WsoeMOIw5Gstg=";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/sqlite/tools.nix b/third_party/nixpkgs/pkgs/development/libraries/sqlite/tools.nix
index 7309e1de0b..d8d3735fe3 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/sqlite/tools.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/sqlite/tools.nix
@@ -4,11 +4,12 @@ let
   archiveVersion = import ./archive-version.nix lib;
   mkTool = { pname, makeTarget, description, homepage }: stdenv.mkDerivation rec {
     inherit pname;
-    version = "3.37.0";
+    version = "3.37.2";
 
+    # nixpkgs-update: no auto update
     src = assert version == sqlite.version; fetchurl {
-      url = "https://sqlite.org/2021/sqlite-src-${archiveVersion version}.zip";
-      sha256 = "sha256-cJd/s5Qhh9RidBOv3pqUkvoCuVSFCBK1OXS2ox7Oj68=";
+      url = "https://sqlite.org/2022/sqlite-src-${archiveVersion version}.zip";
+      sha256 = "sha256-SGdwtNX4i1uw26VA3W7hdjBn11Od/uGKfGb+m7A9Ftk=";
     };
 
     nativeBuildInputs = [ unzip ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/tracker/default.nix b/third_party/nixpkgs/pkgs/development/libraries/tracker/default.nix
index 7dbe0d410f..727634a9fd 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/tracker/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/tracker/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchurl
+, fetchpatch
 , gettext
 , meson
 , ninja
@@ -44,6 +45,13 @@ stdenv.mkDerivation rec {
       src = ./fix-paths.patch;
       inherit asciidoc;
     })
+
+    # Filter out hidden (wrapped) subcommands
+    # https://gitlab.gnome.org/GNOME/tracker/-/merge_requests/481
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/tracker/-/commit/8c28c24e447f13da8cf804cd7a00f9b909c5d3f9.patch";
+      sha256 = "EYo1nOtEr4semaPC5wk6A7bliRXu8qsBHaltd0DEI6Y=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/wlroots/0.15.nix b/third_party/nixpkgs/pkgs/development/libraries/wlroots/0.15.nix
index e7cf7bc9b4..7b7ff1816d 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/wlroots/0.15.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/wlroots/0.15.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitLab, meson_0_60, ninja, pkg-config, wayland-scanner
+{ lib, stdenv, fetchFromGitLab, meson, ninja, pkg-config, wayland-scanner
 , libGL, wayland, wayland-protocols, libinput, libxkbcommon, pixman
 , xcbutilwm, libX11, libcap, xcbutilimage, xcbutilerrors, mesa
 , libpng, ffmpeg, xcbutilrenderutil, seatd, vulkan-loader, glslang
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
 
   depsBuildBuild = [ pkg-config ];
 
-  nativeBuildInputs = [ meson_0_60 ninja pkg-config wayland-scanner ];
+  nativeBuildInputs = [ meson ninja pkg-config wayland-scanner ];
 
   buildInputs = [
     libGL wayland wayland-protocols libinput libxkbcommon pixman
diff --git a/third_party/nixpkgs/pkgs/development/libraries/xxHash/default.nix b/third_party/nixpkgs/pkgs/development/libraries/xxHash/default.nix
index fbeadc2b35..f4fa061128 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/xxHash/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/xxHash/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xxHash";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "Cyan4973";
     repo = "xxHash";
     rev = "v${version}";
-    sha256 = "0hpbzdd6kfki5f61g103vp7pfczqkdj0js63avl0ss552jfb8h96";
+    sha256 = "sha256-2WoYCO6QRHWrbGP2mK04/sLNTyQLOuL3urVktilAwMA=";
   };
 
   # Upstream Makefile does not anticipate that user may not want to
@@ -22,6 +22,11 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(dev)" "EXEC_PREFIX=$(out)" ];
 
+  # pkgs/build-support/setup-hooks/compress-man-pages.sh hook fails
+  # to compress symlinked manpages. Avoid compressing manpages until
+  # it's fixed.
+  dontGzipMan = true;
+
   meta = with lib; {
     description = "Extremely fast hash algorithm";
     longDescription = ''
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/bigarray-compat/default.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/bigarray-compat/default.nix
index 487249ce5a..83c35edcc4 100644
--- a/third_party/nixpkgs/pkgs/development/ocaml-modules/bigarray-compat/default.nix
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/bigarray-compat/default.nix
@@ -6,6 +6,8 @@ buildDunePackage rec {
 
   useDune2 = true;
 
+  minimalOCamlVersion = "4.03";
+
   src = fetchFromGitHub {
     owner = "mirage";
     repo = pname;
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/ca-certs/default.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/ca-certs/default.nix
index acf869dbd2..ce8993b465 100644
--- a/third_party/nixpkgs/pkgs/development/ocaml-modules/ca-certs/default.nix
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/ca-certs/default.nix
@@ -18,7 +18,8 @@ buildDunePackage rec {
 
   propagatedBuildInputs = [ bos fpath rresult ptime mirage-crypto x509 astring logs ];
 
-  doCheck = true;
+  # Assumes nss-cacert < 3.74 https://github.com/mirage/ca-certs/issues/21
+  doCheck = false;
   checkInputs = [
     cacert    # for /etc/ssl/certs/ca-bundle.crt
     alcotest
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/adal/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/adal/default.nix
index d3826013c8..45c256b664 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/adal/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/adal/default.nix
@@ -1,19 +1,47 @@
-{ lib, buildPythonPackage, fetchPypi
-, requests, pyjwt, python-dateutil }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, httpretty
+, pyjwt
+, pytestCheckHook
+, python-dateutil
+, requests
+}:
 
 buildPythonPackage rec {
   pname = "adal";
   version = "1.2.7";
+  format = "setuptools";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "d74f45b81317454d96e982fd1c50e6fb5c99ac2223728aea8764433a39f566f1";
+  src = fetchFromGitHub {
+    owner = "AzureAD";
+    repo = "azure-activedirectory-library-for-python";
+    rev = version;
+    hash = "sha256-HE8/P0aohoZNeMdcQVKdz6M31FMrjsd7oVytiaD0idI=";
   };
 
-  propagatedBuildInputs =  [ requests pyjwt python-dateutil ];
+  propagatedBuildInputs = [
+    pyjwt
+    python-dateutil
+    requests
+  ];
+
+  checkInputs = [
+    httpretty
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # AssertionError: 'Mex [23 chars]tp error:...
+    "test_failed_request"
+  ];
+
+  pythonImportsCheck = [
+    "adal"
+  ];
 
   meta = with lib; {
-    description = "Library to make it easy for python application to authenticate to Azure Active Directory (AAD) in order to access AAD protected web resources";
+    description = "Python module to authenticate to Azure Active Directory (AAD) in order to access AAD protected web resources";
     homepage = "https://github.com/AzureAD/azure-activedirectory-library-for-python";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/aioesphomeapi/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/aioesphomeapi/default.nix
index 5023b03252..e0f1b1df3c 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "10.6.0";
+  version = "10.8.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "esphome";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1z9pybis8yi938i3cgzma4w452ik9vggyyhs3y542zpk4183d7xw";
+    sha256 = "1349b2as6r3m9sxlfss8plzafn31kf3rihwa58b4f7cmc4dhb2s8";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/aioftp/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/aioftp/default.nix
index e9988249e2..fab3a32a6a 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/aioftp/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/aioftp/default.nix
@@ -3,7 +3,6 @@
 , buildPythonPackage
 , fetchPypi
 , pytest-asyncio
-, pytest-cov
 , pytestCheckHook
 , pythonOlder
 , siosocks
@@ -29,7 +28,6 @@ buildPythonPackage rec {
   checkInputs = [
     async-timeout
     pytest-asyncio
-    pytest-cov
     pytestCheckHook
     trustme
   ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/aiohwenergy/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/aiohwenergy/default.nix
index 538f628abe..a3ec8edd6d 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/aiohwenergy/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/aiohwenergy/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "aiohwenergy";
-  version = "0.6.0";
+  version = "0.7.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "DCSBL";
     repo = pname;
     rev = version;
-    sha256 = "006q2kgc28dn43skk2x76d13fp51sy073nm8f2hrxn4wqwkccsx3";
+    sha256 = "0pgk9ky4kfb1kp0mpyxdinwql1q85a3bl5w34pr88wqdqdw467ms";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/aioshelly/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/aioshelly/default.nix
index f1c0c7fb26..d227f34192 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/aioshelly/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/aioshelly/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "aioshelly";
-  version = "1.0.7";
+  version = "1.0.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = pname;
     rev = version;
-    sha256 = "1jx2m03c8f76nn8r14vk0v7qq2kijgjhqcqwl95kih50cgmj0yzf";
+    sha256 = "0l6qhgpzg082zk9134w2psnzkzf5zr0jyvrkxnhhz5lx9q5k94pc";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/aiounifi/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/aiounifi/default.nix
index 8d31fccc56..1a8bdee922 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/aiounifi/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/aiounifi/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "aiounifi";
-  version = "29";
+  version = "30";
 
   disabled = pythonOlder "3.7";
 
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "Kane610";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-A2+jLxKpha7HV1m3uzy00o8tsjwx0Uuwn5x3DO9daTI=";
+    sha256 = "036yx1g80rc32g9mqx4khn8iqhmwl4kfch35pjslnna9kw3kb9i8";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/attrs/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/attrs/default.nix
index 08730e3d68..4b10f4203e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/attrs/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/attrs/default.nix
@@ -6,14 +6,17 @@
 
 buildPythonPackage rec {
   pname = "attrs";
-  version = "21.2.0";
+  version = "21.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ef6aaac3ca6cd92904cdd0d83f629a15f18053ec84e6432106f7a4d04ae4f5fb";
+    hash = "sha256-YmuoI0IR25joad92IwoTfExAoS1yRFxF1fW3FvB24v0=";
   };
 
-  outputs = [ "out" "testout" ];
+  outputs = [
+    "out"
+    "testout"
+  ];
 
   postInstall = ''
     # Install tests as the tests output.
@@ -21,7 +24,9 @@ buildPythonPackage rec {
     cp -R tests $testout/tests
   '';
 
-  pythonImportsCheck = [ "attr" ];
+  pythonImportsCheck = [
+    "attr"
+  ];
 
   # pytest depends on attrs, so we can't do this out-of-the-box.
   # Instead, we do this as a passthru.tests test.
@@ -35,5 +40,6 @@ buildPythonPackage rec {
     description = "Python attributes without boilerplate";
     homepage = "https://github.com/hynek/attrs";
     license = licenses.mit;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/azure-mgmt-compute/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/azure-mgmt-compute/default.nix
index e0f5ff579b..c9de9f9f47 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/azure-mgmt-compute/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/azure-mgmt-compute/default.nix
@@ -6,13 +6,13 @@
 }:
 
 buildPythonPackage rec {
-  version = "24.0.0";
+  version = "24.0.1";
   pname = "azure-mgmt-compute";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "04e60fd3e73fc036ad74497e81277faedb7e048c8c1d7511d37ad7471b4cfc50";
+    sha256 = "283195339ef6ba1181dbc866ebede8b06ffdfe09eb86c25a04e1c8059d654f6e";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/charset-normalizer/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/charset-normalizer/default.nix
index 7f7f54b73d..ba7dd1db3b 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/charset-normalizer/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/charset-normalizer/default.nix
@@ -2,17 +2,21 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "charset-normalizer";
-  version = "2.0.8";
+  version = "2.0.10";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.5";
 
   src = fetchFromGitHub {
     owner = "Ousret";
     repo = "charset_normalizer";
     rev = version;
-    sha256 = "sha256-+acnzdDcujnMa0FYlWaAX7Ga9APMRlvBLKoogIyY8YM=";
+    hash = "sha256-QsUqrC2oycvyCbOzGmHahgNi40YZ0sujb3Cj8EnsGS8=";
   };
 
   checkInputs = [
@@ -24,7 +28,9 @@ buildPythonPackage rec {
       --replace " --cov=charset_normalizer --cov-report=term-missing" ""
   '';
 
-  pythonImportsCheck = [ "charset_normalizer" ];
+  pythonImportsCheck = [
+    "charset_normalizer"
+  ];
 
   meta = with lib; {
     description = "Python module for encoding and language detection";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/datafusion/Cargo.lock.patch b/third_party/nixpkgs/pkgs/development/python-modules/datafusion/Cargo.lock.patch
new file mode 100644
index 0000000000..e4e5eca8af
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/datafusion/Cargo.lock.patch
@@ -0,0 +1,78 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index fa84a54c..3d790e1c 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -57,9 +57,9 @@ checksum = "be4dc07131ffa69b8072d35f5007352af944213cde02545e2103680baed38fcd"
+ 
+ [[package]]
+ name = "arrow"
+-version = "6.0.0"
++version = "6.5.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "337e668497751234149fd607f5cb41a6ae7b286b6329589126fe67f0ac55d637"
++checksum = "216c6846a292bdd93c2b93c1baab58c32ff50e2ab5e8d50db333ab518535dd8b"
+ dependencies = [
+  "bitflags",
+  "chrono",
+@@ -212,9 +212,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "comfy-table"
+-version = "4.1.1"
++version = "5.0.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "11e95a3e867422fd8d04049041f5671f94d53c32a9dcd82e2be268714942f3f3"
++checksum = "c42350b81f044f576ff88ac750419f914abb46a03831bb1747134344ee7a4e64"
+ dependencies = [
+  "strum",
+  "strum_macros",
+@@ -279,7 +279,7 @@ dependencies = [
+ 
+ [[package]]
+ name = "datafusion"
+-version = "5.1.0"
++version = "6.0.0"
+ dependencies = [
+  "ahash",
+  "arrow",
+@@ -310,7 +310,7 @@ dependencies = [
+ 
+ [[package]]
+ name = "datafusion-python"
+-version = "0.3.0"
++version = "0.4.0"
+ dependencies = [
+  "datafusion",
+  "pyo3",
+@@ -877,9 +877,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "parquet"
+-version = "6.0.0"
++version = "6.5.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "d263b9b59ba260518de9e57bd65931c3f765fea0fabacfe84f40d6fde38e841a"
++checksum = "788d9953f4cfbe9db1beff7bebd54299d105e34680d78b82b1ddc85d432cac9d"
+ dependencies = [
+  "arrow",
+  "base64",
+@@ -1228,15 +1228,15 @@ checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+ 
+ [[package]]
+ name = "strum"
+-version = "0.21.0"
++version = "0.22.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "aaf86bbcfd1fa9670b7a129f64fc0c9fcbbfe4f1bc4210e9e98fe71ffc12cde2"
++checksum = "f7ac893c7d471c8a21f31cfe213ec4f6d9afeed25537c772e08ef3f005f8729e"
+ 
+ [[package]]
+ name = "strum_macros"
+-version = "0.21.1"
++version = "0.22.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "d06aaeeee809dbc59eb4556183dd927df67db1540de5be8d3ec0b6636358a5ec"
++checksum = "339f799d8b549e3744c7ac7feb216383e4005d94bdb22561b3ab8f3b808ae9fb"
+ dependencies = [
+  "heck",
+  "proc-macro2",
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/datafusion/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/datafusion/default.nix
new file mode 100644
index 0000000000..4b36df22d1
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/datafusion/default.nix
@@ -0,0 +1,90 @@
+{ lib
+, stdenv
+, fetchurl
+, buildPythonPackage
+, fetchPypi
+, fetchFromGitHub
+, rustPlatform
+, maturin
+, pytestCheckHook
+, libiconv
+, numpy
+, pandas
+, pyarrow
+, pytest
+}:
+let
+  # le sigh, the perils of unrelated versions of software living in the same
+  # repo: there's no obvious way to map the top level source repo
+  # (arrow-datafusion) version to the version of contained repo
+  # (arrow-datafusion/python)
+  #
+  # A commit hash will do in a pinch, and ultimately the sha256 has the final
+  # say of what the content is when building
+  cargoLock = fetchurl {
+    url = "https://raw.githubusercontent.com/apache/arrow-datafusion/6.0.0/python/Cargo.lock";
+    sha256 = "sha256-xiv3drEU5jOGsEIh0U01ZQ1NBKobxO2ctp4mxy9iigw=";
+  };
+
+  postUnpack = ''
+    cp "${cargoLock}" $sourceRoot/Cargo.lock
+    chmod u+w $sourceRoot/Cargo.lock
+  '';
+in
+buildPythonPackage rec {
+  pname = "datafusion";
+  version = "0.4.0";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-+YqogteKfNhtI2QbVXv/5CIWm3PcOH653dwONm5ZcL8=";
+  };
+
+  inherit postUnpack;
+
+  # TODO: remove the patch hacking and postUnpack hooks after
+  # https://github.com/apache/arrow-datafusion/pull/1508 is merged
+  #
+  # the lock file isn't up to date as of 6.0.0 so we need to patch the source
+  # lockfile and the vendored cargo deps lockfile
+  patches = [ ./Cargo.lock.patch ];
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src pname version postUnpack;
+    sha256 = "sha256-JGyDxpfBXzduJaMF1sbmRm7KJajHYdVSj+WbiSETiY0=";
+    patches = [ ./Cargo.lock.patch ];
+  };
+
+  nativeBuildInputs = with rustPlatform; [
+    cargoSetupHook
+    maturinBuildHook
+  ];
+
+  buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
+
+  propagatedBuildInputs = [
+    numpy
+    pandas
+    pyarrow
+  ];
+
+  checkInputs = [ pytest ];
+  pythonImportsCheck = [ "datafusion" ];
+
+  checkPhase = ''
+    runHook preCheck
+    pytest --pyargs "${pname}"
+    runHook postCheck
+  '';
+
+  meta = with lib; {
+    description = "Extensible query execution framework";
+    longDescription = ''
+      DataFusion is an extensible query execution framework, written in Rust,
+      that uses Apache Arrow as its in-memory format.
+    '';
+    homepage = "https://arrow.apache.org/datafusion/";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ cpcloud ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/dbus/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/dbus/default.nix
index 599c911b99..0685ca6fcc 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/dbus/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/dbus/default.nix
@@ -24,7 +24,7 @@ buildPythonPackage rec {
   '' else null;
 
   configureFlags = [
-    "PYTHON_VERSION=${lib.versions.major python.version}"
+    "PYTHON=${python.pythonForBuild.interpreter}"
   ];
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/django-cleanup/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/django-cleanup/default.nix
index 240598cf18..9a399ed6ed 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/django-cleanup/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/django-cleanup/default.nix
@@ -3,10 +3,10 @@
 
 buildPythonPackage rec {
   pname = "django-cleanup";
-  version = "5.2.0";
+  version = "6.0.0";
   src = fetchPypi {
     inherit pname version;
-    sha256 = "909d10ff574f5ce1a40fa63bd5c94c9ed866fd7ae770994c46cdf66c3db3e846";
+    sha256 = "922e06ef8839c92bd3ab37a84db6058b8764f3fe44dbb4487bbca941d288280a";
   };
 
   checkInputs = [ django ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/django-oauth-toolkit/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/django-oauth-toolkit/default.nix
index e2c5f5e874..eca6721167 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/django-oauth-toolkit/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/django-oauth-toolkit/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "django-oauth-toolkit";
-  version = "1.6.3";
+  version = "1.7.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "jazzband";
     repo = pname;
     rev = version;
-    sha256 = "00vmnsj1xdaddxqkdp9zvnm255mblljldp90a0wjsh257d8nyvyh";
+    sha256 = "0rp7pjif54yvdxfxn0pnf8ha3fjxspnx1ijyr1f8npwk2x5vnvhb";
   };
 
   postPatch = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/django-redis/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/django-redis/default.nix
index b088876b3e..1ad52e22d0 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/django-redis/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/django-redis/default.nix
@@ -19,7 +19,7 @@
 
 let
   pname = "django-redis";
-  version = "5.1.0";
+  version = "5.2.0";
 in
 buildPythonPackage {
   inherit pname version;
@@ -30,7 +30,7 @@ buildPythonPackage {
     owner = "jazzband";
     repo = "django-redis";
     rev = version;
-    sha256 = "sha256-S94qH2W5e65yzGfPxpwBUKhvvVS0Uc/zSyo66bnvzf4=";
+    sha256 = "sha256-e8wCgfxBT+WKFY4H83CTMirTpQym3QAoeWnXbRCDO90=";
   };
 
   postPatch = ''
@@ -53,6 +53,11 @@ buildPythonPackage {
 
   preCheck = ''
     ${pkgs.redis}/bin/redis-server &
+    REDIS_PID=$!
+  '';
+
+  postCheck = ''
+    kill $REDIS_PID
   '';
 
   checkInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/django-taggit/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/django-taggit/default.nix
index 61541bbe25..9fa31b871e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/django-taggit/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/django-taggit/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "django-taggit";
-  version = "2.0.0";
+  version = "2.1.0";
   format = "setuptools";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a23ca776ee2709b455c3a95625be1e4b891ddf1ffb4173153c41806de4038d72";
+    sha256 = "a9f41e4ad58efe4b28d86f274728ee87eb98eeae90c9eb4b4efad39e5068184e";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/django/2.nix b/third_party/nixpkgs/pkgs/development/python-modules/django/2.nix
index 9a0d98034c..f20eb49c02 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/django/2.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/django/2.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "2.2.25";
+  version = "2.2.26";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-seZerzcTR9SxPrfgYbCXhslzBh3pU5DDJ8hcHiqiNJw=";
+    sha256 = "sha256-36U3Jn1SxiQ6YrMoVadEyoPDfHBgCqz/v9mLxdbYUY8=";
   };
 
   patches = lib.optional withGdal
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/django/3.nix b/third_party/nixpkgs/pkgs/development/python-modules/django/3.nix
index fdcb8129f2..a7bafcfb27 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/django/3.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/django/3.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "3.2.10";
+  version = "3.2.11";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-B06IGLS0Cs3CNp5n3NZVXVWDKXhUCNzSU0DumPHx1cQ=";
+    sha256 = "sha256-aclKvl1rGwiL9HXgm3t0QD+UPjTaEH55hGXSBF2ifnU=";
   };
 
   patches = lib.optional withGdal
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/django_classytags/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/django_classytags/default.nix
index 2ef8639c17..d4d67ba582 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/django_classytags/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/django_classytags/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "django-classy-tags";
-  version = "2.0.0";
+  version = "3.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d59d98bdf96a764dcf7a2929a86439d023b283a9152492811c7e44fc47555bc9";
+    sha256 = "2ef8b82b4f7d77d4fd152b25c45128d926e7a5840d862f2ecd3e5faf6acbe343";
   };
 
   propagatedBuildInputs = [ django six ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/dulwich/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/dulwich/default.nix
index 4a001796dd..ad0a853af2 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/dulwich/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/dulwich/default.nix
@@ -16,7 +16,7 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.20.31";
+  version = "0.20.32";
   pname = "dulwich";
   format = "setuptools";
 
@@ -24,7 +24,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-9vwYpVDNsU5xCjcqBflcnIMc/DEp/X7RGyASDuVwFYc=";
+    hash = "sha256-3FSYsHK9wSwe/+9LYgLNKkVCuxxtu03c/IxtU+CLSIw=";
   };
 
   LC_ALL = "en_US.UTF-8";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/dwdwfsapi/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/dwdwfsapi/default.nix
index 1a68e7474a..b6bb2927cc 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/dwdwfsapi/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/dwdwfsapi/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "dwdwfsapi";
-  version = "1.0.4";
+  version = "1.0.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-JOIg6rLrU8v39z1I6smIPEeiUPdSdJcD2avUsTQq+bU=";
+    sha256 = "8541eb93a6323bec6a2281aa06667e72b02c8e5fac40f899c402089b1c774472";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/envoy-reader/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/envoy-reader/default.nix
index a327c3f457..497d46f2d8 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/envoy-reader/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/envoy-reader/default.nix
@@ -1,30 +1,37 @@
 { lib
+, beautifulsoup4
 , buildPythonPackage
 , envoy-utils
 , fetchFromGitHub
 , fetchpatch
 , httpx
+, pyjwt
 , pytest-asyncio
-, pytest-raises
 , pytestCheckHook
+, pytest-raises
+, pythonOlder
 , respx
 }:
 
 buildPythonPackage rec {
   pname = "envoy-reader";
-  version = "0.20.0";
+  version = "0.21.3";
   format = "setuptools";
 
+  disabled = pythonOlder "3.7";
+
   src = fetchFromGitHub {
     owner = "jesserizzo";
     repo = "envoy_reader";
     rev = version;
-    sha256 = "sha256-nPB1Fvb1qwLHeFkXP2jXixD2ZGA09MtS1qXRhYGt0fM=";
+    sha256 = "sha256-aIpZ4ln4L57HwK8H0FqsyNnXosnAp3ingrJI6/MPS90=";
   };
 
   propagatedBuildInputs = [
+    beautifulsoup4
     envoy-utils
     httpx
+    pyjwt
   ];
 
   checkInputs = [
@@ -36,18 +43,10 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "pytest-runner>=5.2" ""
+      --replace "pytest-runner>=5.2" "" \
+      --replace "pyjwt==2.1.0" "pyjwt>=2.1.0"
   '';
 
-  patches = [
-    # Support for later httpx, https://github.com/jesserizzo/envoy_reader/pull/82
-    (fetchpatch {
-      name = "support-later-httpx.patch";
-      url = "https://github.com/jesserizzo/envoy_reader/commit/6019a89419fe9c830ba839be7d39ec54725268b0.patch";
-      sha256 = "17vsrx13rskvh8swvjisb2dk6x1jdbjcm8ikkpidia35pa24h272";
-    })
-  ];
-
   pythonImportsCheck = [
     "envoy_reader"
   ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/fastapi/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/fastapi/default.nix
index 53fab7e314..ec14e956c3 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/fastapi/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/fastapi/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "fastapi";
-  version = "0.71.0";
+  version = "0.73.0";
   format = "flit";
 
   disabled = pythonOlder "3.6";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "tiangolo";
     repo = pname;
     rev = version;
-    sha256 = "sha256-J4j7lQm22pbwfMkQGF1s2xyFU4MCwXrAqDmRJmLmKGg=";
+    sha256 = "0v3w9b8107b3g2rgy5y58f0p64inhwl1j9cybp627myypwpqx4b7";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/feedparser/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/feedparser/default.nix
index 56059e6dfe..39f13999d5 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/feedparser/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/feedparser/default.nix
@@ -3,11 +3,14 @@
 , fetchPypi
 , pythonOlder
 , sgmllib3k
+, python
 }:
 
 buildPythonPackage rec {
   pname = "feedparser";
   version = "6.0.8";
+  format = "setuptools";
+
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
@@ -15,13 +18,20 @@ buildPythonPackage rec {
     sha256 = "sha256-XOBBCgWrJIyMfPyjoOoiA5aO6f9EhgZzea9IJ6WflmE=";
   };
 
-  propagatedBuildInputs = [ sgmllib3k ];
+  propagatedBuildInputs = [
+    sgmllib3k
+  ];
 
   checkPhase = ''
-    python -Wd tests/runtests.py
+    # Tests are failing
+    # AssertionError: unexpected '~' char in declaration
+    rm tests/wellformed/sanitize/xml_declaration_unexpected_character.xml
+    ${python.interpreter} -Wd tests/runtests.py
   '';
 
-  pythonImportsCheck = [ "feedparser" ];
+  pythonImportsCheck = [
+    "feedparser"
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/kurtmckee/feedparser";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/flake8-length/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/flake8-length/default.nix
index 34e226bd46..6f82b8dd50 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/flake8-length/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/flake8-length/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "flake8-length";
-  version = "0.2.2";
+  version = "0.3.0";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3536fee1d2a19c01f56ebb909c4d81f686f8181091a9bc3ddf3a5621c464760a";
+    sha256 = "6e3c068005b0b3b5c8345923fe3e9a107c980baa1354dd19d820018f87409427";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/flit-core/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/flit-core/default.nix
index 7cb9ed2c6c..35bba06f1f 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/flit-core/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/flit-core/default.nix
@@ -2,12 +2,11 @@
 , buildPythonPackage
 , callPackage
 , flit
-, toml
 }:
 
 buildPythonPackage rec {
   pname = "flit-core";
-  version = "3.2.0";
+  version = "3.6.0";
   format = "pyproject";
 
   outputs = [
@@ -21,10 +20,6 @@ buildPythonPackage rec {
     cd flit_core
   '';
 
-  propagatedBuildInputs = [
-    toml
-  ];
-
   postInstall = ''
     mkdir $testsout
     cp -R ../tests $testsout/tests
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/flit/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/flit/default.nix
index 0a6d1ba315..830ed2702b 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/flit/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/flit/default.nix
@@ -3,13 +3,12 @@
 , fetchFromGitHub
 , docutils
 , requests
-, requests_download
-, zipfile36
-, pythonOlder
 , pytest
 , testpath
 , responses
 , flit-core
+, tomli
+, tomli-w
 }:
 
 # Flit is actually an application to build universal wheels.
@@ -19,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "flit";
-  version = "3.2.0";
+  version = "3.6.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "takluyver";
     repo = "flit";
     rev = version;
-    sha256 = "sha256-zN+/oAyXBo6Ho7n/xhOQ2mjtPGKA1anCvl3sVf7t+Do=";
+    sha256 = "sha256-D3q/1g6njrrmizooGmzNd9g2nKs00dMGj9jrrv3Y6HQ=";
   };
 
   nativeBuildInputs = [
@@ -36,10 +35,9 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     docutils
     requests
-    requests_download
     flit-core
-  ] ++ lib.optionals (pythonOlder "3.6") [
-    zipfile36
+    tomli
+    tomli-w
   ];
 
   checkInputs = [ pytest testpath responses ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/flux-led/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/flux-led/default.nix
index e5c7ea3251..0834b5fa22 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/flux-led/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/flux-led/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "flux-led";
-  version = "0.28.10";
+  version = "0.28.11";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "flux_led";
     rev = version;
-    sha256 = "sha256-kH+0W+MgdA7+owqC5KsOnqCidErCaQ3mEueZdP8eAS0=";
+    sha256 = "sha256-6EBHFqfCCDKMY9T8suPDIOoiA2LugMJh0OJiHoICioU=";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/gigalixir/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/gigalixir/default.nix
index e7d1909160..aa5512d991 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/gigalixir/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/gigalixir/default.nix
@@ -24,7 +24,9 @@ buildPythonApplication rec {
   };
 
   postPatch = ''
-    substituteInPlace setup.py --replace "'pytest-runner'," ""
+    substituteInPlace setup.py \
+      --replace "'pytest-runner'," "" \
+      --replace "cryptography==" "cryptography>="
   '';
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/glom/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/glom/default.nix
index ccef9ece37..5f8ab55e90 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/glom/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/glom/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "glom";
-  version = "20.11.0";
+  version = "22.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-VAUQcrzMnNs+u9ivBVkZUTemHTCPBL/xlnjkthNQ6xI=";
+    hash = "sha256-FRDGWHqPnGSiRmQbcAM8vF696Z8CrSRWk2eAOOghrrU=";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/groestlcoin_hash/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/groestlcoin_hash/default.nix
index 8bad39da29..859573d1ca 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/groestlcoin_hash/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/groestlcoin_hash/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "groestlcoin_hash";
-  version = "1.0.1";
+  version = "1.0.3";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Nkco8ZA0rJaT9Mx4NIcptMvzd4h0BsRn2+gomdesirg=";
+    sha256 = "31a8f6fa4c19db5258c3c73c071b71702102c815ba862b6015d9e4b75ece231e";
   };
 
   pythonImportsCheck = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/hahomematic/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/hahomematic/default.nix
index c20ff49b5c..58f3224e70 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/hahomematic/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/hahomematic/default.nix
@@ -5,6 +5,7 @@
 , pydevccu
 , pytest-aiohttp
 , pytestCheckHook
+, python-slugify
 , pythonOlder
 , voluptuous
 , websocket-client
@@ -13,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "0.21.2";
+  version = "0.27.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -22,11 +23,12 @@ buildPythonPackage rec {
     owner = "danielperna84";
     repo = pname;
     rev = version;
-    sha256 = "sha256-oD4HXdzlQJZ/+ceF9zfmGs6S8DEVoxzLv5h/IURJnOY=";
+    sha256 = "sha256-RPUj0We1nsKgAl1DTpa3pCD7gMm590N00+xwOVFIOaw=";
   };
 
   propagatedBuildInputs = [
     aiohttp
+    python-slugify
     voluptuous
   ];
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/heatzypy/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/heatzypy/default.nix
index a0647d2dd7..39d970272b 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/heatzypy/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/heatzypy/default.nix
@@ -1,4 +1,5 @@
 { lib
+, aiohttp
 , buildPythonPackage
 , fetchFromGitHub
 , requests
@@ -8,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "heatzypy";
-  version = "1.4.2";
+  version = "2.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -17,10 +18,11 @@ buildPythonPackage rec {
     owner = "Cyr-ius";
     repo = pname;
     rev = version;
-    sha256 = "nENuH2u9RtWq86TW/sDFFeYS8GTWGj7qfcFS8AHFRGk=";
+    sha256 = "sha256-PnDsgTfr2F/fgbONP2qvuPhbw3X50AqriEmsFFjll2Y=";
   };
 
   propagatedBuildInputs = [
+    aiohttp
     requests
   ];
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/hiredis/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/hiredis/default.nix
index 00ce786b00..eea5e5bf80 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/hiredis/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/hiredis/default.nix
@@ -1,25 +1,30 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, redis
+, pythonOlder
+
+# tested using
 , python
 }:
 
 buildPythonPackage rec {
   pname = "hiredis";
   version = "2.0.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "81d6d8e39695f2c37954d1011c0480ef7cf444d4e3ae24bc5e89ee5de360139a";
   };
-  propagatedBuildInputs = [ redis ];
+
+  pythonImportsCheck = [ "hiredis" ];
 
   checkPhase = ''
     mv hiredis _hiredis
     ${python.interpreter} test.py
   '';
-  pythonImportsCheck = [ "hiredis" ];
 
   meta = with lib; {
     description = "Wraps protocol parsing code in hiredis, speeds up parsing of multi bulk replies";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/html-sanitizer/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/html-sanitizer/default.nix
index 546f1acad0..ef029586be 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/html-sanitizer/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/html-sanitizer/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "html-sanitizer";
-  version = "1.9.1";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
     owner = "matthiask";
     repo = pname;
     rev = version;
-    sha256 = "0nnv34924r0yn01rwlk749j5ijy7yxyj302s1i57yjrkqr3zlvas";
+    sha256 = "sha256-ZPyGF7N+EZHfgqZfRQx4x1r83BMur+Zg2kdtVISn3I8=";
   };
 
   propagatedBuildInputs = [
@@ -26,9 +26,17 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pytestFlagsArray = [ "html_sanitizer/tests.py" ];
+  pytestFlagsArray = [
+    "html_sanitizer/tests.py"
+  ];
 
-  pythonImportsCheck = [ "html_sanitizer" ];
+  disabledTests = [
+    "test_billion_laughs"
+  ];
+
+  pythonImportsCheck = [
+    "html_sanitizer"
+  ];
 
   meta = with lib; {
     description = "Allowlist-based and very opinionated HTML sanitizer";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/html5lib/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/html5lib/default.nix
index 08ea5a2b3e..58da63d02e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/html5lib/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/html5lib/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , six
 , webencodings
 , mock
@@ -17,6 +18,15 @@ buildPythonPackage rec {
     sha256 = "b2e5b40261e20f354d198eae92afc10d750afb487ed5e50f9c4eaf07c184146f";
   };
 
+  patches = [
+    # Fix compatibility with pytest 6.
+    # Will be included in the next release after 1.1.
+    (fetchpatch {
+      url = "https://github.com/html5lib/html5lib-python/commit/2c19b9899ab3a3e8bd0ca35e5d78544334204169.patch";
+      sha256 = "sha256-VGCeB6o2QO/skeCZs8XLPfgEYVOSRL8cCpG7ajbZWEs=";
+    })
+  ];
+
   propagatedBuildInputs = [
     six
     webencodings
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/importlib-metadata/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/importlib-metadata/default.nix
index e13f736167..a607de5eb1 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/importlib-metadata/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/importlib-metadata/default.nix
@@ -10,15 +10,15 @@
 
 buildPythonPackage rec {
   pname = "importlib-metadata";
-  version = "4.8.2";
+  version = "4.10.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "importlib_metadata";
     inherit version;
-    sha256 = "sha256-db3sFMOX9ShyTBv9lwnWYLM6TS53OHozWPILhIu15fs=";
+    hash = "sha256-kqi1jOc0sqRJSHjg7PfXnM16EotfxgFMQB4LYfAG8PY=";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jdatetime/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/jdatetime/default.nix
index 8e8f0e4618..6989c4257c 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/jdatetime/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/jdatetime/default.nix
@@ -1,19 +1,34 @@
-{ lib, buildPythonPackage, fetchPypi, six }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, six
+, pythonOlder
+}:
 
 buildPythonPackage rec {
   pname = "jdatetime";
-  version = "3.8.0";
+  version = "3.8.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "389a0723a8011379a5e34386ec466cb3f65b2d5cb5422702c1d3aecb6ac192d0";
+    sha256 = "db57ee517356b1bfc1603ef412f5da61eae92241ba0bcaf0851028cae424780c";
   };
 
-  propagatedBuildInputs = [ six ];
+  propagatedBuildInputs = [
+    six
+  ];
+
+  pythonImportsCheck = [
+    "jdatetime"
+  ];
 
   meta = with lib; {
-    description = "Jalali datetime binding for python";
-    homepage = "https://pypi.python.org/pypi/jdatetime";
+    description = "Jalali datetime binding";
+    homepage = "https://github.com/slashmili/python-jalali";
     license = licenses.psfl;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/levenshtein/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/levenshtein/default.nix
index cc4a029b7b..64a9a3b5e9 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/levenshtein/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/levenshtein/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "levenshtein";
-  version = "0.16.0";
+  version = "0.17.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "maxbachmann";
     repo = "Levenshtein";
     rev = "v${version}";
-    sha256 = "agshUVkkqogj4FbonFd/rrGisMOomS62NND66YKZvjg=";
+    sha256 = "1a14cw2314jb5lrm979zipzk3av4630lxdr4jzj2wl5qh3yw4w52";
   };
 
   postPatch = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/lz4/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/lz4/default.nix
index cc84fa75c6..9e2cc9b31e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/lz4/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/lz4/default.nix
@@ -1,41 +1,68 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, future
-, isPy3k
+, pythonOlder
+
+# native inputs
 , pkgconfig
-, psutil
-, pytest
-, pytest-cov
-, pytest-runner
 , setuptools-scm
+
+# tests
+, psutil
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "python-lz4";
-  version = "3.1.10";
+  version = "3.1.12";
+  format = "setuptools";
 
-  # get full repository inorder to run tests
+  disabled = pythonOlder "3.5";
+
+  # get full repository in order to run tests
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = version;
-    sha256 = "0a4gic8xh3simkk5k8302rxwf765pr6y63k3js79mkl983vpxcim";
+    rev = "v${version}";
+    sha256 = "sha256-fqt9aJGqZpfbiYtU8cmm7UQaixZwbTKFBwRfR1B/qic=";
   };
 
-  nativeBuildInputs = [ setuptools-scm pkgconfig pytest-runner ];
-  checkInputs = [ pytest pytest-cov psutil ];
-  propagatedBuildInputs = lib.optionals (!isPy3k) [ future ];
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
-  # give a hint to setuptools-scm on package version
-  preBuild = ''
-    export SETUPTOOLS_SCM_PRETEND_VERSION="v${version}"
+  postPatch = ''
+    sed -i '/pytest-cov/d' setup.py
   '';
 
-  meta = {
-     description = "LZ4 Bindings for Python";
-     homepage = "https://github.com/python-lz4/python-lz4";
-     license = lib.licenses.bsd3;
-     maintainers = with lib.maintainers; [ costrouc ];
+  nativeBuildInputs = [
+    setuptools-scm
+    pkgconfig
+  ];
+
+  pythonImportsCheck = [
+    "lz4"
+    "lz4.block"
+    "lz4.frame"
+    "lz4.stream"
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+    psutil
+  ];
+
+  # leave build directory, so the installed library gets imported
+  preCheck = ''
+    pushd tests
+  '';
+
+  postCheck = ''
+    popd
+  '';
+
+  meta = with lib; {
+    description = "LZ4 Bindings for Python";
+    homepage = "https://github.com/python-lz4/python-lz4";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ costrouc ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/manimpango/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/manimpango/default.nix
index 0b84726d5a..73ddb17cac 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/manimpango/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/manimpango/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "manimpango";
-  version = "0.4.0.post0";
+  version = "0.4.0.post1";
 
   src = fetchFromGitHub {
     owner = "ManimCommunity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1avlh6wk6a2mq6fl2idqk2z5bncglyla8p9m7az0430k9vdv4qks";
+    sha256 = "1in9ibis91rlqmd7apbdp9c8y1mgnpm5bg6ldad8whx62nkkvwa3";
   };
 
   postPatch = ''
@@ -30,7 +30,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     homepage = "https://github.com/ManimCommunity/ManimPango";
-    license = licenses.gpl3Plus;
+    license = licenses.mit;
     description = "Binding for Pango";
     maintainers = [ maintainers.angustrau ];
   };
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/markdown-it-py/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/markdown-it-py/default.nix
index f056c104e7..c1a0f58789 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/markdown-it-py/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/markdown-it-py/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "markdown-it-py";
-  version = "2.0.0";
+  version = "2.0.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "executablebooks";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ahg+aAVpAh07PZ1mfrne0EP9K2J4tb8eLp5XXFpWp00=";
+    sha256 = "0qrsl4ajhi2263i5q1kivp2s3n7naq3byfbsv11rni18skw3i2a6";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/mat2/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/mat2/default.nix
index 0d54656c15..31bf90f7f0 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/mat2/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/mat2/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "mat2";
-  version = "0.12.2";
+  version = "0.12.3";
 
   disabled = pythonOlder "3.5";
 
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "jvoisin";
     repo = "mat2";
     rev = version;
-    sha256 = "sha256-KaHdBmTeBlCRaVkG3WsfDtFo45s/X69x7VGDYY7W5O8=";
+    hash = "sha256-TW+FwlZ+J1tanPL5WuwXtZJmtYB9LaimeIaPlN/jzqo=";
   };
 
   patches = [
@@ -40,8 +40,6 @@ buildPythonPackage rec {
       bwrap = "${bubblewrap}/bin/bwrap";
       exiftool = "${exiftool}/bin/exiftool";
       ffmpeg = "${ffmpeg}/bin/ffmpeg";
-      # remove once faf0f8a8a4134edbeec0a73de7f938453444186d is in master
-      mimetypes = "${mime-types}/etc/mime.types";
     } // lib.optionalAttrs dolphinIntegration {
       kdialog = "${plasma5Packages.kdialog}/bin/kdialog";
     }))
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/mat2/paths.patch b/third_party/nixpkgs/pkgs/development/python-modules/mat2/paths.patch
index 7e828d3f53..50b0c9aaa7 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/mat2/paths.patch
+++ b/third_party/nixpkgs/pkgs/development/python-modules/mat2/paths.patch
@@ -1,5 +1,5 @@
 diff --git a/dolphin/mat2.desktop b/dolphin/mat2.desktop
-index d365bc5..56313e2 100644
+index 41c8de4..11df258 100644
 --- a/dolphin/mat2.desktop
 +++ b/dolphin/mat2.desktop
 @@ -8,6 +8,6 @@ Type=Service
@@ -7,11 +7,11 @@ index d365bc5..56313e2 100644
  Name[de]=Metadaten löschen
  Name[es]=Limpiar metadatos
 -Icon=/usr/share/icons/hicolor/scalable/apps/mat2.svg
--Exec=kdialog --yesno  "$( mat2 -s %U )" --title "Clean Metadata?" && mat2 %U
--Exec[de]=kdialog --yesno  "$( mat2 -s %U )" --title "Metadaten löschen?" && mat2 %U
+-Exec=kdialog --yesno  "$( mat2 -s %F )" --title "Clean Metadata?" && mat2 %U
+-Exec[de]=kdialog --yesno  "$( mat2 -s %F )" --title "Metadaten löschen?" && mat2 %U
 +Icon=@mat2svg@
-+Exec=@kdialog@ --yesno  "$( mat2 -s %U )" --title "Clean Metadata?" && mat2 %U
-+Exec[de]=@kdialog@ --yesno  "$( mat2 -s %U )" --title "Metadaten löschen?" && mat2 %U
++Exec=@kdialog@ --yesno  "$( @mat2@ -s %F )" --title "Clean Metadata?" && @mat2@ %U
++Exec[de]=@kdialog@ --yesno  "$( @mat2@ -s %F )" --title "Metadaten löschen?" && @mat2@ %U
 diff --git a/libmat2/bubblewrap.py b/libmat2/bubblewrap.py
 index 970d5dd..5d3c0b7 100644
 --- a/libmat2/bubblewrap.py
@@ -76,20 +76,8 @@ index eb65b2a..51a0fa1 100644
 -
 -    raise RuntimeError("Unable to find exiftool")
 +    return '@exiftool@'
-diff --git a/libmat2/parser_factory.py b/libmat2/parser_factory.py
-index 9965432..bd45179 100644
---- a/libmat2/parser_factory.py
-+++ b/libmat2/parser_factory.py
-@@ -8,6 +8,7 @@ from . import abstract, UNSUPPORTED_EXTENSIONS
- 
- T = TypeVar('T', bound='abstract.AbstractParser')
- 
-+mimetypes.init(['@mimetypes@'])
- mimetypes.add_type('application/epub+zip', '.epub')
- mimetypes.add_type('application/x-dtbncx+xml', '.ncx')  # EPUB Navigation Control XML File
- 
 diff --git a/libmat2/video.py b/libmat2/video.py
-index b4a3232..3dd7ee5 100644
+index ae9e463..2acc65c 100644
 --- a/libmat2/video.py
 +++ b/libmat2/video.py
 @@ -1,6 +1,4 @@
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/matplotlib-inline/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/matplotlib-inline/default.nix
index 9ee23b87ee..d863239430 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/matplotlib-inline/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/matplotlib-inline/default.nix
@@ -1,5 +1,4 @@
 { lib, buildPythonPackage, fetchPypi
-, matplotlib
 , traitlets
 
 # tests
@@ -16,7 +15,6 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [
-    matplotlib # not documented, but required
     traitlets
   ];
 
diff --git a/third_party/nixpkgs/pkgs/development/tools/documentation/mkdocs/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/mkdocs/default.nix
similarity index 57%
rename from third_party/nixpkgs/pkgs/development/tools/documentation/mkdocs/default.nix
rename to third_party/nixpkgs/pkgs/development/python-modules/mkdocs/default.nix
index f7774cc712..7d4f1cc66c 100644
--- a/third_party/nixpkgs/pkgs/development/tools/documentation/mkdocs/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/mkdocs/default.nix
@@ -1,22 +1,47 @@
-{ lib
-, python3
+{
+  # eval time deps
+  lib
+, buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
+, pythonOlder
+  # runtime deps
+, click
+, ghp-import
+, importlib-metadata
+, jinja2
+, markdown
+, mergedeep
+, packaging
+, pyyaml
+, pyyaml-env-tag
+, watchdog
+  # testing deps
+, Babel
+, mock
+, pytestCheckHook
 }:
 
-with python3.pkgs;
-
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "mkdocs";
-  version = "1.2.1";
+  version = "1.2.3";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-JF3Zz1ObxeKsIF0pa8duJxqjLgMvmWsWMApHT43Z+EY=";
+    sha256 = "sha256-LBw2ftGyeNvARQ8xiYUho8BiQh+aIEqROP51gKvNxEo=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/mkdocs/mkdocs/commit/c93fc91e4dc0ef33e2ea418aaa32b0584a8d354a.patch";
+      sha256 = "sha256-7uLIuQOt6KU/+iS9cwhXkWPAHzZkQdMyNBxSMut5WK4=";
+      excludes = [ "tox.ini" ];
+    })
+  ];
+
   propagatedBuildInputs = [
     click
     jinja2
@@ -33,21 +58,19 @@ buildPythonApplication rec {
   checkInputs = [
     Babel
     mock
-    pytestCheckHook
   ];
 
-  postPatch = ''
-    # Remove test due to missing requirement
-    rm mkdocs/tests/theme_tests.py
+
+  checkPhase = ''
+    set -euo pipefail
+
+    runHook preCheck
+
+    python -m unittest discover -v -p '*tests.py' mkdocs --top-level-directory .
+
+    runHook postCheck
   '';
 
-  pytestFlagsArray = [ "mkdocs/tests/*.py" ];
-
-  disabledTests = [
-    # Don't start a test server
-    "testing_server"
-  ];
-
   pythonImportsCheck = [ "mkdocs" ];
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/moderngl_window/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/moderngl_window/default.nix
index e06d5aa378..6888356ec4 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/moderngl_window/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/moderngl_window/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "moderngl_window";
-  version = "2.1.0";
+  version = "2.4.1";
 
   src = fetchFromGitHub {
     owner = "moderngl";
     repo = pname;
     rev = version;
-    sha256 = "1p03j91pk2bwycd13p0qi8kns1sf357180hd2mkaip8mfaf33x3q";
+    sha256 = "12a5nl01c9b1ww7sj7i02xa7zmlrgg8jvi8cz004hw98kjcs9li8";
   };
 
   propagatedBuildInputs = [ numpy moderngl pyglet pillow pyrr glcontext ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/mypy/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/mypy/default.nix
index 149aefb9a5..5c5e985641 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/mypy/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/mypy/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "mypy";
-  version = "0.930";
+  version = "0.931";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "python";
     repo = "mypy";
     rev = "v${version}";
-    sha256 = "sha256-0yo6f9hRYFfwdfukOGNNTgPCIFO2MZdfMvzbci7FWRs=";
+    sha256 = "1v83flrdxh8grcp40qw04q4hzjflih9xwib64078vsxv2w36f817";
   };
 
   patches = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/nmapthon2/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/nmapthon2/default.nix
index 2f3b69b53c..a19dd946b8 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/nmapthon2/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/nmapthon2/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "nmapthon2";
-  version = "0.1.3";
+  version = "0.1.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "cblopez";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-t4gAcDwHHejfipQmJvMLhKmdz8D6UN/Mmsrhpq0cygY=";
+    hash = "sha256-4Na75TdKDywUomJF4tDWUWwCCtcOSxBUMOF7+FDhbpY=";
   };
 
   checkInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/od/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/od/default.nix
index 698795c75b..e2dd2f4bf9 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/od/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/od/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "od";
-  version = "1.0";
+  version = "2.0.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1az30snc3w6s4k1pi7mspcv8y0kp3ihf3ly44z517nszmz9lrjfi";
+    sha256 = "180fb0d13c3af1384047b8296c95683816b5d0c68a60c22d07c703be8bd755cb";
   };
 
   # repeated_test no longer exists in nixpkgs
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/packaging/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/packaging/default.nix
index d76b5b1723..648a548e52 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/packaging/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/packaging/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "packaging";
-  version = "20.9";
+  version = "21.3";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-WzJ6wTINyGPcpy9FFOzAhvMRhnRLhKIwN0zB/Xdv6uU=";
+    sha256 = "sha256-3UfEKSfYmrkR5gZRiQfMLTofOLvQJjhZcGQ/nFuOz+s=";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/paramiko/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/paramiko/default.nix
index 86154554b6..d271111d58 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/paramiko/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/paramiko/default.nix
@@ -1,48 +1,65 @@
-{ pkgs
-, buildPythonPackage
-, fetchPypi
-, cryptography
+{ lib
 , bcrypt
+, buildPythonPackage
+, cryptography
+, fetchPypi
 , invoke
-, pynacl
-, pyasn1
-, pytestCheckHook
-, pytest-relaxed
 , mock
+, pyasn1
+, pynacl
+, pytest-relaxed
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "paramiko";
-  version = "2.8.1";
+  version = "2.9.1";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "85b1245054e5d7592b9088cc6d08da22445417912d3a3e48138675c7a8616438";
+    hash = "sha256-of3e07VfYdIzieT+UtmuQolgrJWNLt9QNz+qXYkm7dA=";
   };
 
-  propagatedBuildInputs = [ bcrypt cryptography pynacl pyasn1 ];
+  propagatedBuildInputs = [
+    bcrypt
+    cryptography
+    pyasn1
+    pynacl
+  ];
+
+  checkInputs = [
+    invoke
+    mock
+    pytest-relaxed
+    pytestCheckHook
+  ];
 
   # with python 3.9.6+, the deprecation warnings will fail the test suite
   # see: https://github.com/pyinvoke/invoke/issues/829
   doCheck = false;
-  checkInputs = [ invoke pytestCheckHook pytest-relaxed mock ];
 
   disabledTestPaths = [
     "tests/test_sftp.py"
     "tests/test_config.py"
   ];
 
+  pythonImportsCheck = [
+    "paramiko"
+  ];
+
   __darwinAllowLocalNetworking = true;
 
-  meta = with pkgs.lib; {
+  meta = with lib; {
     homepage = "https://github.com/paramiko/paramiko/";
     description = "Native Python SSHv2 protocol library";
     license = licenses.lgpl21Plus;
     longDescription = ''
-      This is a library for making SSH2 connections (client or server).
-      Emphasis is on using SSH2 as an alternative to SSL for making secure
-      connections between python scripts. All major ciphers and hash methods
-      are supported. SFTP client and server mode are both supported too.
+      Library for making SSH2 connections (client or server). Emphasis is
+      on using SSH2 as an alternative to SSL for making secure connections
+      between python scripts. All major ciphers and hash methods are
+      supported. SFTP client and server mode are both supported too.
     '';
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/plaid-python/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/plaid-python/default.nix
index bd80fb725c..387853ad28 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/plaid-python/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/plaid-python/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "plaid-python";
-  version = "8.9.0";
+  version = "8.10.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ba2021812835bfeb19ad6d32a1afeb41cb01e45f4fd2b8145ae162800e4bc87f";
+    sha256 = "8930949bd43e3126289f50e927d1acacf53c57ec3227c764e0c1feb72bbb61a3";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/platformdirs/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/platformdirs/default.nix
index 062295a4ea..f2e8659914 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/platformdirs/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/platformdirs/default.nix
@@ -11,14 +11,16 @@
 
 buildPythonPackage rec {
   pname = "platformdirs";
-  version = "2.4.0";
-  disabled = pythonOlder "3.6";
+  version = "2.4.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-Ox1CVq2M2eddZtpuZx0IfvuOm6RPsAs27WkMdZSeh0E=";
+    sha256 = "sha256-Ce1dwE2g/7o91NPkmlM0uv0eMB7WzFCExV/8ZCAn22Y=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -33,7 +35,9 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
- pythonImportsCheck = [ "platformdirs" ];
+  pythonImportsCheck = [
+    "platformdirs"
+  ];
 
   meta = with lib; {
     description = "Python module for determining appropriate platform-specific directories";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/plexapi/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/plexapi/default.nix
index 8c0bd2d07e..4a21cebcab 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/plexapi/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/plexapi/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "plexapi";
-  version = "4.8.0";
+  version = "4.9.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "pkkid";
     repo = "python-plexapi";
     rev = version;
-    sha256 = "sha256-e+nZi84mF9Z/gbFyhmE9TlntkTyrfoNr3U/fwH55fjw=";
+    sha256 = "0c0zhbq6ggn5ck4cgbr92440xhfk3iz5a8fm25909idlx8vw0s3q";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/poetry/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/poetry/default.nix
index 2375800e3a..5efbe56ac5 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/poetry/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/poetry/default.nix
@@ -15,6 +15,7 @@
 , intreehooks
 , keyring
 , lockfile
+, packaging
 , pexpect
 , pkginfo
 , poetry-core
@@ -45,9 +46,10 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-     --replace 'importlib-metadata = {version = "^1.6.0", python = "<3.8"}' \
+      --replace 'importlib-metadata = {version = "^1.6.0", python = "<3.8"}' \
        'importlib-metadata = {version = ">=1.6", python = "<3.8"}' \
-     --replace 'version = "^21.2.0"' 'version = ">=21.2"'
+      --replace 'version = "^21.2.0"' 'version = ">=21.2"' \
+      --replace 'packaging = "^20.4"' 'packaging = "*"'
   '';
 
   nativeBuildInputs = [
@@ -64,6 +66,7 @@ buildPythonPackage rec {
     html5lib
     keyring
     lockfile
+    packaging
     pexpect
     pkginfo
     poetry-core
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pybind11/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pybind11/default.nix
index d33d9ffc57..d93bfe149c 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pybind11/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pybind11/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "pybind11";
-  version = "2.8.1";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "pybind";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Gk4ZN/g6SRWFm0ALCvyald/9zq3wBd48mGdqdGCeGYI=";
+    hash = "sha256-zYDgXXpn8Z1Zti8Eje8qxDvbQV70/LmezG3AtxzDG+o=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pycryptodome-test-vectors/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pycryptodome-test-vectors/default.nix
new file mode 100644
index 0000000000..4fbc259c18
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pycryptodome-test-vectors/default.nix
@@ -0,0 +1,30 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "pycryptodome-test-vectors";
+  version = "1.0.4";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-2+ZL8snmaB0tNxGZRbUM6SdfXZf4CM0nh3/wTOu9R50=";
+    extension = "zip";
+  };
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "pycryptodome_test_vectors"
+  ];
+
+  meta = with lib; {
+    description = "Test vectors for PyCryptodome cryptographic library";
+    homepage = "https://www.pycryptodome.org/";
+    license = with licenses; [ bsd2 /* and */ asl20 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pycryptodome/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pycryptodome/default.nix
index 19b2447acb..44e7ed0ad4 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pycryptodome/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pycryptodome/default.nix
@@ -1,17 +1,29 @@
-{ lib, fetchPypi, buildPythonPackage }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pycryptodome-test-vectors
+}:
 
 buildPythonPackage rec {
-  version = "3.11.0";
   pname = "pycryptodome";
+  version = "3.12.0";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "428096bbf7a77e207f418dfd4d7c284df8ade81d2dc80f010e92753a3e406ad0";
+    hash = "sha256-Esc0OuxaOz31xHJlKBsSthHybsk2e2EpGZ1n2lS3aME=";
+    extension = "zip";
   };
 
+  pythonImportsCheck = [
+    "Crypto"
+  ];
+
   meta = with lib; {
-    homepage = "https://www.pycryptodome.org/";
     description = "Python Cryptography Toolkit";
+    homepage = "https://www.pycryptodome.org/";
+    license = with licenses; [ bsd2 /* and */ asl20 ];
+    maintainers = with maintainers; [ fab ];
     platforms = platforms.unix;
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pycryptodomex/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pycryptodomex/default.nix
index eab3a6b0bb..c9f622d6c6 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pycryptodomex/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pycryptodomex/default.nix
@@ -1,23 +1,28 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pycryptodome-test-vectors
 }:
 
 buildPythonPackage rec {
   pname = "pycryptodomex";
-  version = "3.11.0";
+  version = "3.12.0";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0398366656bb55ebdb1d1d493a7175fc48ade449283086db254ac44c7d318d6d";
+    hash = "sha256-ki6drAFm5GF+XHmA0s/2kSputctcE+fs4iJDhlC9f2Y=";
+    extension = "zip";
   };
 
-  pythonImportsCheck = [ "Cryptodome" ];
+  pythonImportsCheck = [
+    "Cryptodome"
+  ];
 
   meta = with lib; {
     description = "A self-contained cryptographic library for Python";
     homepage = "https://www.pycryptodome.org";
-    license = licenses.bsd2;
+    license = with licenses; [ bsd2 /* and */ asl20 ];
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pydevccu/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pydevccu/default.nix
index f4ee3f6ad6..f6d1fbeeaa 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pydevccu/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pydevccu/default.nix
@@ -6,7 +6,7 @@
 
 buildPythonPackage rec {
   pname = "pydevccu";
-  version = "0.1.0";
+  version = "0.1.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
     owner = "danielperna84";
     repo = pname;
     rev = version;
-    sha256 = "sha256-bLXACJPiHZlJzoDm7N9RWskN+qQddSkGFX9d4YcTaLo=";
+    sha256 = "sha256-awTy1yQdiKvqcUb8ecgOMhgpzpF7HvFZw/W8urA92LU=";
   };
 
   # Module has no tests
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pygeos/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pygeos/default.nix
new file mode 100644
index 0000000000..57970ad2f3
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pygeos/default.nix
@@ -0,0 +1,48 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, python
+, geos
+, pytestCheckHook
+, cython
+, numpy
+}:
+
+buildPythonPackage rec {
+  pname = "pygeos";
+  version = "0.12.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-PEFULvZ8ZgFfRDrj5uaDUDqKIh+cJPsjgPauQq7RYAo=";
+  };
+
+  nativeBuildInputs = [
+    geos # for geos-config
+    cython
+  ];
+
+  propagatedBuildInputs = [ numpy ];
+
+  # The cythonized extensions are required to exist in the pygeos/ directory
+  # for the package to function. Therefore override of buildPhase was
+  # necessary.
+  buildPhase = ''
+    ${python.interpreter} setup.py build_ext --inplace
+    ${python.interpreter} setup.py bdist_wheel
+  '';
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "pygeos" ];
+
+  meta = with lib; {
+    description = "Wraps GEOS geometry functions in numpy ufuncs.";
+    homepage = "https://github.com/pygeos/pygeos";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ nialov ];
+  };
+}
+
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pylaunches/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pylaunches/default.nix
index 552d30c70f..56e93af84a 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pylaunches/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pylaunches/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pylaunches";
-  version = "1.2.1";
+  version = "1.2.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "ludeeus";
     repo = pname;
     rev = version;
-    sha256 = "sha256-WwtNgKP5YM9i7au02taOfJuKQy6DDmmBrE34EPvJYmA=";
+    sha256 = "16fh901qlcxwycq6gqgqn076dybjnj432hb596i28avaplml4qzx";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pylibftdi/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pylibftdi/default.nix
index c001594d62..d4dd2d6781 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pylibftdi/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pylibftdi/default.nix
@@ -3,15 +3,19 @@
 , fetchPypi
 , libftdi1
 , libusb1
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pylibftdi";
-  version = "0.19.0";
+  version = "0.20.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "bb0ec74df292ef884aa37bf1e98fb9df4d338718e1559eebda363317a792123e";
+    sha256 = "f4a87fc4af2c9c7d42badd4192ca9b529f32c9d96fdc8daea7e29c509226df5f";
   };
 
   propagatedBuildInputs = [
@@ -25,11 +29,13 @@ buildPythonPackage rec {
       --replace "self._load_library('libftdi')" "cdll.LoadLibrary('${libftdi1.out}/lib/libftdi1.so')"
   '';
 
-  pythonImportsCheck = [ "pylibftdi" ];
+  pythonImportsCheck = [
+    "pylibftdi"
+  ];
 
   meta = with lib; {
-    homepage = "https://bitbucket.org/codedstructure/pylibftdi/src/default/";
-    description = "Minimal pythonic wrapper to Intra2net's libftdi driver for FTDI's USB devices";
+    homepage = "https://pylibftdi.readthedocs.io/";
+    description = "Wrapper to Intra2net's libftdi driver for FTDI's USB devices";
     license = licenses.mit;
     maintainers = with maintainers; [ matthuszagh ];
   };
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pypoint/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pypoint/default.nix
index 9980d2384f..bd4a121d35 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pypoint/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pypoint/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "pypoint";
-  version = "2.2.1";
+  version = "2.3.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "fredrike";
     repo = "pypoint";
     rev = "v${version}";
-    sha256 = "sha256-Or7A/Br6BgiCF6OHRtN5TAt++Tu1RLS9mYRgD7Aljts=";
+    hash = "sha256-609Zme9IUl8eHNxzrYsRAg7bgZho/OklGM7oI+imyZQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pytenable/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pytenable/default.nix
index af3c2c9b65..e4417139bf 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pytenable/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pytenable/default.nix
@@ -9,6 +9,7 @@
 , pytestCheckHook
 , python-box
 , python-dateutil
+, pythonOlder
 , requests
 , requests-pkcs12
 , responses
@@ -19,13 +20,16 @@
 
 buildPythonPackage rec {
   pname = "pytenable";
-  version = "1.4.2";
+  version = "1.4.3";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "tenable";
     repo = "pyTenable";
     rev = version;
-    sha256 = "sha256-qljoJ+nYFVS5VHr/M4mITtO9Czuyb4HLzVjhprhyJIs=";
+    hash = "sha256-p9d3wZkOMhNQWJN6tCNUlW15A3irU8QN/nm7PLGTE/M=";
   };
 
   propagatedBuildInputs = [
@@ -59,7 +63,9 @@ buildPythonPackage rec {
     "test_uploads_docker_push_cs_tag_typeerror"
   ];
 
-  pythonImportsCheck = [ "tenable" ];
+  pythonImportsCheck = [
+    "tenable"
+  ];
 
   meta = with lib; {
     description = "Python library for the Tenable.io and TenableSC API";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pytest-subprocess/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pytest-subprocess/default.nix
index 74f1e7cddc..f095cbb997 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pytest-subprocess/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pytest-subprocess/default.nix
@@ -6,11 +6,14 @@
 , pytestCheckHook
 , docutils
 , pygments
+, pytest-rerunfailures
+, pytest-asyncio
+, anyio
 }:
 
 buildPythonPackage rec {
   pname = "pytest-subprocess";
-  version = "1.3.2";
+  version = "1.4.0";
 
   disabled = pythonOlder "3.6";
 
@@ -18,7 +21,7 @@ buildPythonPackage rec {
     owner = "aklajnert";
     repo = "pytest-subprocess";
     rev = version;
-    sha256 = "sha256-auPpqoPeYxmkWTVbbKhEZI6gJGH9Pf1D9YLkuD3FaX0=";
+    hash = "sha256-+bsxoOsY0yf77EivImrfqxgVW0T/VnFIJXvy8X5pmEY=";
   };
 
   buildInputs = [
@@ -29,6 +32,9 @@ buildPythonPackage rec {
     pytestCheckHook
     docutils
     pygments
+    pytest-rerunfailures
+    pytest-asyncio
+    anyio
   ];
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/python-izone/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/python-izone/default.nix
index 1d1eb5ac54..f1f8be9d3d 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/python-izone/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/python-izone/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "python-izone";
-  version = "1.2.3";
+  version = "1.2.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "Swamp-Ig";
     repo = "pizone";
     rev = "v${version}";
-    hash = "sha256-WF37t9vCEIyQMeN3/CWAiiZ5zsMRMFQ5UvMUqfoGM9I=";
+    hash = "sha256-HV8aQlwJ7VbGlJU0HpS9fK/QnRfYrk4ijKTGPWj0Jww=";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pytile/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pytile/default.nix
index 1673688657..f68200e996 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pytile/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pytile/default.nix
@@ -13,16 +13,16 @@
 
 buildPythonPackage rec {
   pname = "pytile";
-  version = "2021.12.0";
+  version = "2022.01.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "bachya";
     repo = pname;
     rev = version;
-    sha256 = "sha256-a76Qzk8ZsoV6HUOcDjMdnFVZJu/iKFbShoC9OZ0caDc=";
+    sha256 = "sha256-7iR2R/ESaBd29Xf6ZKMGY41/uU55tB62QOvT3dFSZaE=";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pywlroots/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pywlroots/default.nix
index 901161d634..a1f466cfe6 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pywlroots/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pywlroots/default.nix
@@ -12,21 +12,27 @@
 , wayland
 , pywayland
 , xkbcommon
+, xorg
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "pywlroots";
-  version = "0.14.12";
+  version = "0.15.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "80v1kuiYL3OdtDVJj0EvgrO9x1eN8xxUyRuI4Wb4giI=";
+    sha256 = "sCHeiD6KugHZLtxcVcLggdHC1gqCxStuHy1065TbGiY=";
   };
 
+  # The XWayland detection uses some hard-coded FHS paths. Since we
+  # know wlroots was built with xwayland support, replace its
+  # detection with `return True`.
+  patches = [ ./xwayland.patch ];
+
   nativeBuildInputs = [ pkg-config ];
   propagatedNativeBuildInputs = [ cffi ];
-  buildInputs = [ libinput libxkbcommon pixman udev wayland wlroots ];
+  buildInputs = [ libinput libxkbcommon pixman xorg.libxcb udev wayland wlroots ];
   propagatedBuildInputs = [ cffi pywayland xkbcommon ];
   checkInputs = [ pytestCheckHook ];
 
@@ -40,6 +46,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/flacjacket/pywlroots";
     description = "Python bindings to wlroots using cffi";
     license = licenses.ncsa;
+    platforms = platforms.linux;
     maintainers = with maintainers; [ chvp ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pywlroots/xwayland.patch b/third_party/nixpkgs/pkgs/development/python-modules/pywlroots/xwayland.patch
new file mode 100644
index 0000000000..f3aaecca26
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pywlroots/xwayland.patch
@@ -0,0 +1,25 @@
+diff --git a/wlroots/ffi_build.py b/wlroots/ffi_build.py
+index bb07ff8..f19efe3 100644
+--- a/wlroots/ffi_build.py
++++ b/wlroots/ffi_build.py
+@@ -55,19 +55,7 @@ def has_xwayland() -> bool:
+     Check for XWayland headers. If present, wlroots was built with XWayland support, so
+     pywlroots can be too.
+     """
+-    try:
+-        FFI().verify(
+-            "#include <wlr/xwayland.h>",
+-            define_macros=[("WLR_USE_UNSTABLE", 1)],
+-            include_dirs=["/usr/include/pixman-1", include_dir.as_posix()],
+-        )
+-        return True
+-    except VerificationError:
+-        print("If XWayland support is not required, ignore the above error message.")
+-        print(
+-            "If support is required, ensure wlroots was built with -Dxwayland=enabled."
+-        )
+-        return False
++    return True
+ 
+ 
+ # backend.h
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/qcs-api-client/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/qcs-api-client/default.nix
index 49c1c993e3..41412e16f8 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/qcs-api-client/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/qcs-api-client/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "qcs-api-client";
-  version = "0.20.9";
+  version = "0.20.10";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "rigetti";
     repo = "qcs-api-client-python";
     rev = "v${version}";
-    hash = "sha256-bQ+5TZzjxGnNRsENEW/sN7sF6SOcgWl4MFtLekD0D+8=";
+    hash = "sha256-pBC8pFrk6iNYPS3/LKaVo+ds2okN56bxzvffEfs6SrU=";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/redis/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/redis/default.nix
index 35109e836f..0731487575 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/redis/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/redis/default.nix
@@ -1,14 +1,49 @@
-{ lib, fetchPypi, buildPythonPackage }:
+{ lib
+, fetchPypi
+, buildPythonPackage
+, pythonOlder
+
+# propagates
+, cryptography
+, deprecated
+, hiredis
+, importlib-metadata
+, packaging
+, requests
+}:
 
 buildPythonPackage rec {
   pname = "redis";
-  version = "3.5.3";
+  version = "4.1.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0e7e0cfca8660dea8b7d5cd8c4f6c5e29e11f31158c0b0ae91a397f00e5a05a2";
+    sha256 = "sha256-IfCiO85weQkHbmuizgdsulm/9g0qsily4GR/32IP/kc=";
   };
 
+  propagatedBuildInputs = [
+    cryptography
+    deprecated
+    hiredis
+    packaging
+    requests
+  ] ++ lib.optionals (pythonOlder "3.8") [
+    importlib-metadata
+  ];
+
+  pythonImportsCheck = [
+    "redis"
+    "redis.client"
+    "redis.cluster"
+    "redis.connection"
+    "redis.exceptions"
+    "redis.sentinel"
+    "redis.utils"
+  ];
+
   # tests require a running redis
   doCheck = false;
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/restfly/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/restfly/default.nix
index 83d50cf134..d153a5f3c7 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/restfly/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/restfly/default.nix
@@ -6,18 +6,22 @@
 , pytest-vcr
 , pytestCheckHook
 , python-box
+, pythonOlder
 , requests
 }:
 
 buildPythonPackage rec {
   pname = "restfly";
   version = "1.4.5";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "stevemcgrath";
     repo = pname;
     rev = version;
-    sha256 = "sha256-wWFf8LFZkwzbHX545tA5w2sB3ClL7eFuF+jGX0fSiSc=";
+    hash = "sha256-wWFf8LFZkwzbHX545tA5w2sB3ClL7eFuF+jGX0fSiSc=";
   };
 
   propagatedBuildInputs = [
@@ -37,7 +41,9 @@ buildPythonPackage rec {
     "test_session_ssl_error"
   ];
 
-  pythonImportsCheck = [ "restfly" ];
+  pythonImportsCheck = [
+    "restfly"
+  ];
 
   meta = with lib; {
     description = "Python RESTfly API Library Framework";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/rollbar/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/rollbar/default.nix
index fb3d792edd..7ce7dd9a95 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/rollbar/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/rollbar/default.nix
@@ -1,20 +1,24 @@
-{ aiocontextvars
+{ lib
+, aiocontextvars
 , blinker
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , httpx
-, lib
 , mock
 , pytestCheckHook
 , requests
 , six
-, unittest2
+, pythonOlder
 , webob
 }:
 
 buildPythonPackage rec {
   pname = "rollbar";
   version = "0.16.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
@@ -29,14 +33,20 @@ buildPythonPackage rec {
   checkInputs = [
     webob
     blinker
-    unittest2
     mock
     httpx
     aiocontextvars
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "rollbar" ];
+  # Still supporting unittest2
+  # https://github.com/rollbar/pyrollbar/pull/346
+  # https://github.com/rollbar/pyrollbar/pull/340
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "rollbar"
+  ];
 
   meta = with lib; {
     description = "Error tracking and logging from Python to Rollbar";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/rtoml/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/rtoml/default.nix
index 9ff43bce08..2d2aef6f72 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/rtoml/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/rtoml/default.nix
@@ -1,16 +1,17 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, pythonOlder
-, setuptools-rust
-, rustPlatform
-, pytestCheckHook
 , libiconv
+, pytestCheckHook
+, pythonOlder
+, rustPlatform
+, setuptools-rust
 }:
 
 buildPythonPackage rec {
   pname = "rtoml";
   version = "0.7";
+
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
@@ -33,17 +34,29 @@ buildPythonPackage rec {
     cargoSetupHook
   ];
 
-  buildInputs = [ libiconv ];
+  buildInputs = [
+    libiconv
+  ];
 
-  pythonImportsCheck = [ "rtoml" ];
+  pythonImportsCheck = [
+    "rtoml"
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
 
-  checkInputs = [ pytestCheckHook ];
   preCheck = ''
     cd tests
   '';
 
+  pytestFlagsArray = [
+    "-W"
+    "ignore::DeprecationWarning"
+  ];
+
   meta = with lib; {
-    description = "Rust based TOML library for python";
+    description = "Rust based TOML library for Python";
     homepage = "https://github.com/samuelcolvin/rtoml";
     license = licenses.mit;
     maintainers = with maintainers; [ evils ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/sgmllib3k/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/sgmllib3k/default.nix
index 1104c843c6..c4b0d9bdb9 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/sgmllib3k/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/sgmllib3k/default.nix
@@ -2,14 +2,17 @@
 , buildPythonPackage
 , fetchFromGitHub
 , isPy27
+, pytestCheckHook
+, pythonAtLeast
 }:
 
 buildPythonPackage rec {
   pname = "sgmllib3k";
   version = "1.0.0";
+  format = "setuptools";
+
   disabled = isPy27;
 
-  # fetchFromGitHub instead of fetchPypi to run tests.
   src = fetchFromGitHub {
     owner = "hsoft";
     repo = "sgmllib";
@@ -17,6 +20,18 @@ buildPythonPackage rec {
     sha256 = "0bzf6pv85dzfxfysm6zbj8m40hp0xzr9h8qlk4hp3nmy88rznqvr";
   };
 
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTests = lib.optionals (pythonAtLeast "3.10") [
+    "test_declaration_junk_chars"
+  ];
+
+  pythonImportsCheck = [
+    "sgmllib"
+  ];
+
   meta = with lib; {
     homepage = "https://pypi.org/project/sgmllib3k/";
     description = "Python 3 port of sgmllib";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/siosocks/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/siosocks/default.nix
index 2a4803ef8b..4292c16778 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/siosocks/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/siosocks/default.nix
@@ -30,6 +30,13 @@ buildPythonPackage rec {
     pytest-trio
   ];
 
+  disabledTestPaths = [
+    # Timeout on Hydra
+    "tests/test_trio.py"
+    "tests/test_sansio.py"
+    "tests/test_socketserver.py"
+  ];
+
   pythonImportsCheck = [
     "siosocks"
   ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/sphinxcontrib-htmlhelp/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/sphinxcontrib-htmlhelp/default.nix
index 4efdb2633f..51084adf6e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/sphinxcontrib-htmlhelp/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/sphinxcontrib-htmlhelp/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   doCheck = false;
 
   meta = with lib; {
-    description = "sphinxcontrib-htmlhelp is a sphinx extension which ...";
+    description = "Sphinx extension which renders HTML help files";
     homepage = "http://sphinx-doc.org/";
     license = licenses.bsd0;
   };
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/sqlite-utils/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/sqlite-utils/default.nix
index ee1181e9c9..5247850173 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/sqlite-utils/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/sqlite-utils/default.nix
@@ -5,7 +5,7 @@
 , pythonOlder
 , click
 , click-default-group
-, dateutils
+, python-dateutil
 , sqlite-fts4
 , tabulate
 , pytestCheckHook
@@ -14,32 +14,18 @@
 
 buildPythonPackage rec {
   pname = "sqlite-utils";
-  version = "3.19";
+  version = "3.22";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "509099fce5f25faada6e76b6fb90e8ef5ba0f1715177933a816718be0c8e7244";
+    sha256 = "24803ea4d63e2123d2040db2da43fea95fabada80e1af1fe1da69643ae376689";
   };
 
-  patches = [
-    # https://github.com/simonw/sqlite-utils/pull/347
-    (fetchpatch {
-      name = "sqlite-utils-better-test_rebuild_fts.patch";
-      url = "https://github.com/simonw/sqlite-utils/pull/347/commits/1a7ef2fe2064ace01d5535fb771f941296fb642a.diff";
-      sha256 = "sha256-WKCQGMqr8WYjG7cmAH5pYBhgikowbt3r6hObwtMDDUY=";
-    })
-  ];
-
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace '"pytest-runner"' ""
-  '';
-
   propagatedBuildInputs = [
     click
     click-default-group
-    dateutils
+    python-dateutil
     sqlite-fts4
     tabulate
   ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/sunpy/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/sunpy/default.nix
index e2838ad526..4e61f8665b 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/sunpy/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/sunpy/default.nix
@@ -1,5 +1,5 @@
-{ stdenv
-, lib
+{ lib
+, stdenv
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
@@ -32,6 +32,8 @@
 buildPythonPackage rec {
   pname = "sunpy";
   version = "3.1.3";
+  format = "setuptools";
+
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
@@ -40,36 +42,36 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    setuptools-scm
     astropy-extension-helpers
+    setuptools-scm
   ];
 
   propagatedBuildInputs = [
-    numpy
-    scipy
-    matplotlib
-    pandas
+    asdf
     astropy
     astropy-helpers
-    h5netcdf
-    parfive
-    sqlalchemy
-    scikitimage
-    towncrier
-    glymur
     beautifulsoup4
     drms
+    glymur
+    h5netcdf
+    matplotlib
+    numpy
+    pandas
+    parfive
     python-dateutil
-    zeep
+    scikitimage
+    scipy
+    sqlalchemy
+    towncrier
     tqdm
-    asdf
+    zeep
   ];
 
   checkInputs = [
     hypothesis
-    pytestCheckHook
     pytest-astropy
     pytest-mock
+    pytestCheckHook
   ];
 
   # darwin has write permission issues
@@ -81,11 +83,20 @@ buildPythonPackage rec {
 
   disabledTests = [
     "rst"
+    "test_sunpy_warnings_logging"
+    "test_main_nonexisting_module"
+    "test_main_stdlib_module"
   ];
 
   disabledTestPaths = [
     "sunpy/io/special/asdf/schemas/sunpy.org/sunpy/coordinates/frames/helioprojective-1.0.0.yaml"
     "sunpy/io/special/asdf/schemas/sunpy.org/sunpy/coordinates/frames/heliocentric-1.0.0.yaml"
+    "sunpy/io/special/asdf/schemas/sunpy.org/sunpy/coordinates/frames/heliographic_carrington-*.yaml"
+    "sunpy/io/special/asdf/schemas/sunpy.org/sunpy/coordinates/frames/geocentricearthequatorial-1.0.0.yaml"
+    "sunpy/io/special/asdf/schemas/sunpy.org/sunpy/coordinates/frames/geocentricsolarecliptic-1.0.0.yaml"
+    "sunpy/io/special/asdf/schemas/sunpy.org/sunpy/coordinates/frames/heliocentricearthecliptic-1.0.0.yaml"
+    "sunpy/io/special/asdf/schemas/sunpy.org/sunpy/coordinates/frames/heliocentricinertial-1.0.0.yaml"
+    "sunpy/io/special/asdf/schemas/sunpy.org/sunpy/map/generic_map-1.0.0.yaml"
     # requires mpl-animators package
     "sunpy/map/tests/test_compositemap.py"
     "sunpy/map/tests/test_mapbase.py"
@@ -100,17 +111,24 @@ buildPythonPackage rec {
     "sunpy/visualization/colormaps/tests/test_cm.py"
     # requires cdflib package
     "sunpy/timeseries/tests/test_timeseries_factory.py"
+    # distutils is deprecated
+    "sunpy/io/setup_package.py"
   ];
 
   pytestFlagsArray = [
-    "--deselect=sunpy/tests/tests/test_self_test.py::test_main_nonexisting_module"
-    "--deselect=sunpy/tests/tests/test_self_test.py::test_main_stdlib_module"
+    "-W"
+    "ignore::DeprecationWarning"
   ];
 
+  # Wants a configuration file
+  # pythonImportsCheck = [
+  #   "sunpy"
+  # ];
+
   meta = with lib; {
-    description = "SunPy: Python for Solar Physics";
+    description = "Python for Solar Physics";
     homepage = "https://sunpy.org";
     license = licenses.bsd2;
-    maintainers = [ maintainers.costrouc ];
+    maintainers = with maintainers; [ costrouc ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/typing-extensions/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/typing-extensions/default.nix
index 939ca25eb1..1e29bc9a61 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/typing-extensions/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/typing-extensions/default.nix
@@ -1,27 +1,41 @@
-{ lib, buildPythonPackage, fetchPypi, pythonOlder, isPy3k, python, typing }:
-let
-  testDir = if isPy3k then "src_py3" else "src_py2";
+{ lib
+, buildPythonPackage
+, fetchPypi
+, flit-core
+, python
+, pythonOlder
+}:
 
-in buildPythonPackage rec {
-  pname = "typing_extensions";
-  version = "3.10.0.2";
+buildPythonPackage rec {
+  pname = "typing-extensions";
+  version = "4.0.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "49f75d16ff11f1cd258e1b988ccff82a3ca5570217d7ad8c5f48205dd99a677e";
+    pname = "typing_extensions";
+    inherit version;
+    hash = "sha256-TKCR3qFJ+UXsVq+0ja5xTyHoaS7yKjlSI7zTKJYbag4=";
   };
 
-  checkInputs = lib.optional (pythonOlder "3.5") typing;
+  nativeBuildInputs = [
+    flit-core
+  ];
 
-  # Error for Python3.6: ImportError: cannot import name 'ann_module'
-  # See https://github.com/python/typing/pull/280
-  doCheck = pythonOlder "3.6";
-
-  checkPhase = ''
-    cd ${testDir}
-    ${python.interpreter} -m unittest discover
+  postPatch = ''
+    # Remove metadata for README which are outdated
+    sed -i -e '11,24d' pyproject.toml
   '';
 
+  # Tests are not part of PyPI releases. GitHub source can't be used
+  # as it ends with an infinite recursion
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "typing_extensions"
+  ];
+
   meta = with lib; {
     description = "Backported and Experimental Type Hints for Python 3.5+";
     homepage = "https://github.com/python/typing";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/tzdata/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/tzdata/default.nix
index 7f1803d12c..cfc46a658d 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/tzdata/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/tzdata/default.nix
@@ -1,28 +1,32 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pythonOlder
-, pytestCheckHook
-, pytest-subtests
 , importlib-resources
+, pytest-subtests
+, pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "tzdata";
-  version = "2021.1";
+  version = "2021.5";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-4ZxzUfiHUioaxznSEEHlkt3ebdG3ZP3vqPeys1UdPTg=";
+    hash = "sha256-aNvkGv0BuGeJS739VPoD9GjPpPAIa/tK3NjejyTz7iE=";
   };
 
   checkInputs = [
     pytestCheckHook
     pytest-subtests
-  ] ++ lib.optional (pythonOlder "3.7") importlib-resources;
+  ] ++ lib.optional (pythonOlder "3.7") [
+    importlib-resources
+  ];
 
-  pythonImportsCheck = [ "tzdata" ];
+  pythonImportsCheck = [
+    "tzdata"
+  ];
 
   meta = with lib; {
     description = "Provider of IANA time zone data";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/unicodedata2/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/unicodedata2/default.nix
index 565f0f5572..a14895fa79 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/unicodedata2/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/unicodedata2/default.nix
@@ -1,18 +1,17 @@
-{ lib, buildPythonPackage, fetchFromGitHub, pytest }:
+{ lib, buildPythonPackage, fetchPypi, pytestCheckHook, isPy27 }:
 
 buildPythonPackage rec {
   pname = "unicodedata2";
-  version = "13.0.0-2";
+  version = "14.0.0";
 
-  src = fetchFromGitHub {
-    owner  = "mikekap";
-    repo   = pname;
-    rev    = version;
-    sha256 = "0p9brbiwyg98q52y0gfyps52xv57fwqfpq0mn18p1xc1imip3h2b";
+  disabled = isPy27;
+
+  src = fetchPypi {
+    inherit version pname;
+    sha256 = "110nnvh02ssp92xbmswy39aa186jrmb7m41x4220wigl8c0dzxs1";
   };
 
-  checkInputs = [ pytest ];
-  checkPhase = "pytest tests";
+  checkInputs = [ pytestCheckHook ];
 
   meta = with lib; {
     description = "Backport and updates for the unicodedata module";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/weboob/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/weboob/default.nix
index b1afa24210..4d0373105c 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/weboob/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/weboob/default.nix
@@ -1,9 +1,9 @@
-{ lib, buildPythonPackage, fetchPypi, isPy27
+{ lib
 , Babel
+, buildPythonPackage
 , cssselect
-, python-dateutil
 , feedparser
-, futures ? null
+, fetchPypi
 , gdata
 , gnupg
 , google-api-python-client
@@ -16,6 +16,9 @@
 , pillow
 , prettytable
 , pyqt5
+, pytestCheckHook
+, python-dateutil
+, pythonOlder
 , pyyaml
 , requests
 , simplejson
@@ -26,28 +29,18 @@
 buildPythonPackage rec {
   pname = "weboob";
   version = "2.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "1c69vzf8sg8471lcaafpz9iw2q3rfj5hmcpqrs2k59fkgbvy32zw";
   };
 
-  postPatch = ''
-    # Disable doctests that require networking:
-    sed -i -n -e '/^ *def \+pagination *(.*: *$/ {
-      p; n; p; /"""\|'\'\'\'''/!b
-
-      :loop
-      n; /^ *\(>>>\|\.\.\.\)/ { h; bloop }
-      x; /^ *\(>>>\|\.\.\.\)/bloop; x
-      p; /"""\|'\'\'\'''/b
-      bloop
-    }; p' weboob/browser/browsers.py weboob/browser/pages.py
-  '';
-
-  checkInputs = [ nose ];
-
-  nativeBuildInputs = [ pyqt5 ];
+  nativeBuildInputs = [
+    pyqt5
+  ];
 
   propagatedBuildInputs = [
     Babel
@@ -70,15 +63,35 @@ buildPythonPackage rec {
     simplejson
     termcolor
     unidecode
-  ] ++ lib.optionals isPy27 [ futures ];
+  ];
+
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace "with-doctest = 1" "" \
+      --replace "with-coverage = 1" "" \
+      --replace "weboob.browser.filters.standard," "" \
+      --replace "weboob.browser.tests.filters," "" \
+      --replace "weboob.tools.application.formatters.json," "" \
+      --replace "weboob.tools.application.formatters.table," "" \
+      --replace "weboob.tools.capabilities.bank.transactions," ""
+  '';
+
+  checkInputs = [
+    nose
+  ];
 
   checkPhase = ''
     nosetests
   '';
 
-  meta = {
+  pythonImportsCheck = [
+    "weboob"
+  ];
+
+  meta = with lib; {
+    description = "Collection of applications and APIs to interact with websites";
     homepage = "http://weboob.org";
-    description = "Collection of applications and APIs to interact with websites without requiring the user to open a browser";
-    license = lib.licenses.agpl3;
+    license = licenses.agpl3Plus;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/whodap/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/whodap/default.nix
index c09c8d7d4d..6bd22c56b9 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/whodap/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/whodap/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "whodap";
-  version = "0.1.2";
+  version = "0.1.3";
 
   disabled = pythonOlder "3.6";
 
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "pogzyb";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1map5m9i1hi4wb9mpp7hq89n8x9bgsi7gclqfixgqhpi5v5gybqc";
+    sha256 = "1pcn2jwqfvp67wz19lcpwnw0dkbc61bnbkzxlmac1yf2pz9ndn6l";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/woob/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/woob/default.nix
index fc5e6e9dc6..3c9529c264 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/woob/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/woob/default.nix
@@ -1,12 +1,10 @@
 { lib
-, buildPythonPackage
-, fetchPypi
-, isPy27
 , Babel
+, buildPythonPackage
 , colorama
 , cssselect
-, python-dateutil
 , feedparser
+, fetchFromGitLab
 , gdata
 , gnupg
 , google-api-python-client
@@ -19,6 +17,8 @@
 , pillow
 , prettytable
 , pyqt5
+, python-dateutil
+, pythonOlder
 , pyyaml
 , requests
 , simplejson
@@ -29,22 +29,21 @@
 buildPythonPackage rec {
   pname = "woob";
   version = "3.0";
-  disabled = isPy27;
+  format = "setuptools";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "09hpxy5zhn2b8li0xjf3zd7s46lawb0315p5mdcsci3bj3s4v1j7";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitLab {
+    owner = "woob";
+    repo = pname;
+    rev = version;
+    hash = "sha256-XLcHNidclORbxVXgcsHY6Ja/dak+EVSKTaVQmg1f/rw=";
   };
 
-  patches = [
-    # Disable doctests that require networking:
-    ./no-test-requiring-network.patch
+  nativeBuildInputs = [
+    pyqt5
   ];
 
-  checkInputs = [ nose ];
-
-  nativeBuildInputs = [ pyqt5 ];
-
   propagatedBuildInputs = [
     Babel
     colorama
@@ -69,14 +68,28 @@ buildPythonPackage rec {
     unidecode
   ];
 
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace "with-doctest = 1" "" \
+      --replace "with-coverage = 1" ""
+  '';
+
+  checkInputs = [
+    nose
+  ];
+
   checkPhase = ''
     nosetests
   '';
 
+  pythonImportsCheck = [
+    "woob"
+  ];
+
   meta = with lib; {
+    description = "Collection of applications and APIs to interact with websites";
     homepage = "https://woob.tech";
-    description = "Collection of applications and APIs to interact with websites without requiring the user to open a browser";
     license = licenses.lgpl3Plus;
-    maintainers = [ maintainers.DamienCassou ];
- };
+    maintainers = with maintainers; [ DamienCassou ];
+  };
 }
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/woob/no-test-requiring-network.patch b/third_party/nixpkgs/pkgs/development/python-modules/woob/no-test-requiring-network.patch
deleted file mode 100644
index 7095019d05..0000000000
--- a/third_party/nixpkgs/pkgs/development/python-modules/woob/no-test-requiring-network.patch
+++ /dev/null
@@ -1,54 +0,0 @@
---- a/woob/browser/browsers.py
-+++ b/woob/browser/browsers.py
-@@ -930,23 +930,6 @@
-
-         :class:`NextPage` constructor can take an url or a Request object.
-
--        >>> from .pages import HTMLPage
--        >>> class Page(HTMLPage):
--        ...     def iter_values(self):
--        ...         for el in self.doc.xpath('//li'):
--        ...             yield el.text
--        ...         for next in self.doc.xpath('//a'):
--        ...             raise NextPage(next.attrib['href'])
--        ...
--        >>> class Browser(PagesBrowser):
--        ...     BASEURL = 'https://woob.tech'
--        ...     list = URL('/tests/list-(?P<pagenum>\d+).html', Page)
--        ...
--        >>> b = Browser()
--        >>> b.list.go(pagenum=1) # doctest: +ELLIPSIS
--        <woob.browser.browsers.Page object at 0x...>
--        >>> list(b.pagination(lambda: b.page.iter_values()))
--        ['One', 'Two', 'Three', 'Four']
-         """
-         while True:
-             try:
---- a/woob/browser/pages.py
-+++ b/woob/browser/pages.py
-@@ -49,25 +49,6 @@
-
-     :class:`NextPage` constructor can take an url or a Request object.
-
--    >>> class Page(HTMLPage):
--    ...     @pagination
--    ...     def iter_values(self):
--    ...         for el in self.doc.xpath('//li'):
--    ...             yield el.text
--    ...         for next in self.doc.xpath('//a'):
--    ...             raise NextPage(next.attrib['href'])
--    ...
--    >>> from .browsers import PagesBrowser
--    >>> from .url import URL
--    >>> class Browser(PagesBrowser):
--    ...     BASEURL = 'https://woob.tech'
--    ...     list = URL('/tests/list-(?P<pagenum>\d+).html', Page)
--    ...
--    >>> b = Browser()
--    >>> b.list.go(pagenum=1) # doctest: +ELLIPSIS
--    <woob.browser.pages.Page object at 0x...>
--    >>> list(b.page.iter_values())
--    ['One', 'Two', 'Three', 'Four']
-     """
-
-     @wraps(func)
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/wrapt/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/wrapt/default.nix
index e567a8a672..b53c52d609 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/wrapt/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/wrapt/default.nix
@@ -1,23 +1,33 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "wrapt";
   version = "1.13.3";
+  format = "setuptools";
 
-  # No tests in archive
-  doCheck = false;
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1fea9cd438686e6682271d36f3481a9f3636195578bab9ca3382e2f5f01fc185";
+  src = fetchFromGitHub {
+    owner = "GrahamDumpleton";
+    repo = pname;
+    rev = version;
+    hash = "sha256-kq3Ujkn4HzonzjuQfVnPNnQV+2Rnbr3ZfYmrnY3upxU=";
   };
 
-  meta = {
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "wrapt"
+  ];
+
+  meta = with lib; {
     description = "Module for decorators, wrappers and monkey patching";
-    license = lib.licenses.bsd2;
     homepage = "https://github.com/GrahamDumpleton/wrapt";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/yapf/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/yapf/default.nix
index 9c759f3a2b..2d6fc9520c 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/yapf/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/yapf/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "yapf";
-  version = "0.31.0";
+  version = "0.32.0";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-QI+5orJUwwL0nbg8WfmqC0sP0OwlvjpcURgTJ5Iv9j0=";
+    hash = "sha256-o/UIXTfvfj4ATEup+bPkDFT/GQHNER8FFFrjE6fGfRs=";
   };
 
   checkInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/ruby-modules/bundled-common/functions.nix b/third_party/nixpkgs/pkgs/development/ruby-modules/bundled-common/functions.nix
index 35307a3fbd..746eb2bb11 100644
--- a/third_party/nixpkgs/pkgs/development/ruby-modules/bundled-common/functions.nix
+++ b/third_party/nixpkgs/pkgs/development/ruby-modules/bundled-common/functions.nix
@@ -76,7 +76,7 @@ in rec {
           bundledByPath = true;
           name = gemName;
           version = version;
-          outPath = path;
+          outPath = "${path}";
           outputs = [ "out" ];
           out = res;
           outputName = "out";
diff --git a/third_party/nixpkgs/pkgs/development/tools/analysis/checkov/default.nix b/third_party/nixpkgs/pkgs/development/tools/analysis/checkov/default.nix
index 1a4b296718..ab6cbbeba5 100644
--- a/third_party/nixpkgs/pkgs/development/tools/analysis/checkov/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/analysis/checkov/default.nix
@@ -22,13 +22,13 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.0.727";
+  version = "2.0.762";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    hash = "sha256-hegbkmM8ZN6zO2iANGRr2QRW3ErdtwYaTo618uELev0=";
+    hash = "sha256-7YINKTvEAAOGoGkc4t2YwuMBF4rvOxRD2XhJxJBWvis=";
   };
 
   nativeBuildInputs = with py.pkgs; [
@@ -60,6 +60,7 @@ buildPythonApplication rec {
     networkx
     packaging
     policyuniverse
+    prettytable
     pyyaml
     semantic-version
     tabulate
@@ -71,7 +72,6 @@ buildPythonApplication rec {
 
   checkInputs = with py.pkgs; [
     aioresponses
-    jsonschema
     mock
     pytest-asyncio
     pytest-mock
@@ -82,7 +82,11 @@ buildPythonApplication rec {
   postPatch = ''
     substituteInPlace setup.py \
       --replace "cyclonedx-python-lib>=0.11.0,<1.0.0" "cyclonedx-python-lib>=0.11.0" \
-      --replace "jsonschema==3.0.2" "jsonschema>=3.0.2"
+      --replace "prettytable>=3.0.0" "prettytable"
+  '';
+
+  preCheck = ''
+    export HOME=$(mktemp -d);
   '';
 
   disabledTests = [
@@ -92,6 +96,9 @@ buildPythonApplication rec {
     "TestSarifReport"
     # Will probably be fixed in one of the next releases
     "test_valid_cyclonedx_bom"
+    # Requires prettytable release which is only available in staging
+    "test_skipped_check_exists"
+    "test_record_relative_path_with_relative_dir"
   ];
 
   disabledTestPaths = [
@@ -101,6 +108,9 @@ buildPythonApplication rec {
     "tests/terraform/"
     # Performance tests have no value for us
     "performance_tests/test_checkov_performance.py"
+    # Requires prettytable release which is only available in staging
+    "tests/sca_package/"
+    "tests/test_runner_filter.py"
   ];
 
   pythonImportsCheck = [
diff --git a/third_party/nixpkgs/pkgs/development/tools/ashpd-demo/default.nix b/third_party/nixpkgs/pkgs/development/tools/ashpd-demo/default.nix
index 9e24309d98..a52a6ca817 100644
--- a/third_party/nixpkgs/pkgs/development/tools/ashpd-demo/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/ashpd-demo/default.nix
@@ -86,6 +86,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Tool for playing with XDG desktop portals";
     homepage = "https://github.com/bilelmoussaoui/ashpd/tree/master/ashpd-demo";
+    broken = true; # requires older libadwaita
     license = licenses.mit;
     maintainers = with maintainers; [ jtojnar ];
     platforms = platforms.linux;
diff --git a/third_party/nixpkgs/pkgs/development/tools/build-managers/bazel/bazel_5/actions_path.patch b/third_party/nixpkgs/pkgs/development/tools/build-managers/bazel/bazel_5/actions_path.patch
new file mode 100644
index 0000000000..1fa1e57483
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/tools/build-managers/bazel/bazel_5/actions_path.patch
@@ -0,0 +1,41 @@
+diff --git a/src/main/java/com/google/devtools/build/lib/exec/local/PosixLocalEnvProvider.java b/src/main/java/com/google/devtools/build/lib/exec/local/PosixLocalEnvProvider.java
+index 6fff2af..7e2877e 100644
+--- a/src/main/java/com/google/devtools/build/lib/exec/local/PosixLocalEnvProvider.java
++++ b/src/main/java/com/google/devtools/build/lib/exec/local/PosixLocalEnvProvider.java
+@@ -47,6 +47,16 @@ public final class PosixLocalEnvProvider implements LocalEnvProvider {
+       Map<String, String> env, BinTools binTools, String fallbackTmpDir) {
+     ImmutableMap.Builder<String, String> result = ImmutableMap.builder();
+     result.putAll(Maps.filterKeys(env, k -> !k.equals("TMPDIR")));
++
++    // In case we are running on NixOS.
++    // If bash is called with an unset PATH on this platform,
++    // it will set it to /no-such-path and default tools will be missings.
++    // See, https://github.com/NixOS/nixpkgs/issues/94222
++    // So we ensure that minimal dependencies are present.
++    if (!env.containsKey("PATH")){
++        result.put("PATH", "@actionsPathPatch@");
++    }
++ 
+     String p = clientEnv.get("TMPDIR");
+     if (Strings.isNullOrEmpty(p)) {
+       // Do not use `fallbackTmpDir`, use `/tmp` instead. This way if the user didn't export TMPDIR
+index 95642767c6..39d3c62461 100644
+--- a/src/main/java/com/google/devtools/build/lib/exec/local/XcodeLocalEnvProvider.java
++++ b/src/main/java/com/google/devtools/build/lib/exec/local/XcodeLocalEnvProvider.java
+@@ -74,6 +74,16 @@ public final class XcodeLocalEnvProvider implements LocalEnvProvider {
+
+     ImmutableMap.Builder<String, String> newEnvBuilder = ImmutableMap.builder();
+     newEnvBuilder.putAll(Maps.filterKeys(env, k -> !k.equals("TMPDIR")));
++
++    // In case we are running on NixOS.
++    // If bash is called with an unset PATH on this platform,
++    // it will set it to /no-such-path and default tools will be missings.
++    // See, https://github.com/NixOS/nixpkgs/issues/94222
++    // So we ensure that minimal dependencies are present.
++    if (!env.containsKey("PATH")){
++      newEnvBuilder.put("PATH", "@actionsPathPatch@");
++    }
++
+     String p = clientEnv.get("TMPDIR");
+     if (Strings.isNullOrEmpty(p)) {
+       // Do not use `fallbackTmpDir`, use `/tmp` instead. This way if the user didn't export TMPDIR
diff --git a/third_party/nixpkgs/pkgs/development/tools/build-managers/bazel/bazel_5/default.nix b/third_party/nixpkgs/pkgs/development/tools/build-managers/bazel/bazel_5/default.nix
new file mode 100644
index 0000000000..8770174ab2
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/tools/build-managers/bazel/bazel_5/default.nix
@@ -0,0 +1,669 @@
+{ stdenv, callPackage, lib, fetchurl, fetchpatch, fetchFromGitHub, installShellFiles
+, runCommand, runCommandCC, makeWrapper, recurseIntoAttrs
+# this package (through the fixpoint glass)
+, bazel_self
+# needed only for the updater
+, bazel_4
+, lr, xe, zip, unzip, bash, writeCBin, coreutils
+, which, gawk, gnused, gnutar, gnugrep, gzip, findutils
+# updater
+, python27, python3, writeScript
+# Apple dependencies
+, cctools, libcxx, CoreFoundation, CoreServices, Foundation
+# Allow to independently override the jdks used to build and run respectively
+, buildJdk, runJdk
+, runtimeShell
+# Downstream packages for tests
+, bazel-watcher
+# Always assume all markers valid (this is needed because we remove markers; they are non-deterministic).
+# Also, don't clean up environment variables (so that NIX_ environment variables are passed to compilers).
+, enableNixHacks ? false
+, gcc-unwrapped
+, autoPatchelfHook
+, file
+, substituteAll
+, writeTextFile
+}:
+
+let
+  version = "5.0.0";
+  sourceRoot = ".";
+
+  src = fetchurl {
+    url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";
+    sha256 = "By3WLSN9vBHgusAuEY2MLbTQujugnxoOseKkYPuEGds=";
+  };
+
+  # Update with `eval $(nix-build -A bazel.updater)`,
+  # then add new dependencies from the dict in ./src-deps.json as required.
+  srcDeps = lib.attrsets.attrValues srcDepsSet;
+  srcDepsSet =
+    let
+      srcs = lib.importJSON ./src-deps.json;
+      toFetchurl = d: lib.attrsets.nameValuePair d.name (fetchurl {
+        urls = d.urls;
+        sha256 = d.sha256;
+        });
+        in builtins.listToAttrs (map toFetchurl [
+      srcs.desugar_jdk_libs
+      srcs.io_bazel_skydoc
+      srcs.bazel_skylib
+      srcs.bazelci_rules
+      srcs.io_bazel_rules_sass
+      srcs.platforms
+      srcs."remote_java_tools_for_testing"
+      srcs."coverage_output_generator-v2.5.zip"
+      srcs.build_bazel_rules_nodejs
+      srcs."android_tools_pkg-0.23.0.tar.gz"
+      srcs.bazel_toolchains
+      srcs.com_github_grpc_grpc
+      srcs.upb
+      srcs.com_google_protobuf
+      srcs.rules_pkg
+      srcs.rules_cc
+      srcs.rules_java
+      srcs.rules_proto
+      srcs.com_google_absl
+      srcs.com_googlesource_code_re2
+      srcs.com_github_cares_cares
+      ]);
+
+  distDir = runCommand "bazel-deps" {} ''
+    mkdir -p $out
+    for i in ${builtins.toString srcDeps}; do cp $i $out/$(stripHash $i); done
+  '';
+
+  defaultShellUtils =
+    # Keep this list conservative. For more exotic tools, prefer to use
+    # @rules_nixpkgs to pull in tools from the nix repository. Example:
+    #
+    # WORKSPACE:
+    #
+    #     nixpkgs_git_repository(
+    #         name = "nixpkgs",
+    #         revision = "def5124ec8367efdba95a99523dd06d918cb0ae8",
+    #     )
+    #
+    #     # This defines an external Bazel workspace.
+    #     nixpkgs_package(
+    #         name = "bison",
+    #         repositories = { "nixpkgs": "@nixpkgs//:default.nix" },
+    #     )
+    #
+    # some/BUILD.bazel:
+    #
+    #     genrule(
+    #        ...
+    #        cmd = "$(location @bison//:bin/bison) -other -args",
+    #        tools = [
+    #            ...
+    #            "@bison//:bin/bison",
+    #        ],
+    #     )
+    #
+    # Some of the scripts explicitly depend on Python 2.7. Otherwise, we
+    # default to using python3. Therefore, both python27 and python3 are
+    # runtime dependencies.
+    [
+      bash
+      coreutils
+      file
+      findutils
+      gawk
+      gnugrep
+      gnused
+      gnutar
+      gzip
+      python27
+      python3
+      unzip
+      which
+      zip
+    ];
+
+  defaultShellPath = lib.makeBinPath defaultShellUtils;
+
+  platforms = lib.platforms.linux ++ lib.platforms.darwin;
+
+  system = if stdenv.hostPlatform.isDarwin then "darwin" else "linux";
+  arch = stdenv.hostPlatform.parsed.cpu.name;
+
+  bazelRC = writeTextFile {
+    name = "bazel-rc";
+    text = ''
+      startup --server_javabase=${runJdk}
+
+      # Can't use 'common'; https://github.com/bazelbuild/bazel/issues/3054
+      # Most commands inherit from 'build' anyway.
+      build --distdir=${distDir}
+      fetch --distdir=${distDir}
+      query --distdir=${distDir}
+
+      build --extra_toolchains=@bazel_tools//tools/jdk:nonprebuilt_toolchain_definition
+      build --tool_java_runtime_version=local_jdk_11
+      build --java_runtime_version=local_jdk_11
+
+      # load default location for the system wide configuration
+      try-import /etc/bazel.bazelrc
+    '';
+  };
+
+in
+stdenv.mkDerivation rec {
+  pname = "bazel";
+  inherit version;
+
+  meta = with lib; {
+    homepage = "https://github.com/bazelbuild/bazel/";
+    description = "Build tool that builds code quickly and reliably";
+    license = licenses.asl20;
+    maintainers = lib.teams.bazel.members;
+    inherit platforms;
+  };
+
+  inherit src;
+  inherit sourceRoot;
+  patches = [
+    # On Darwin, the last argument to gcc is coming up as an empty string. i.e: ''
+    # This is breaking the build of any C target. This patch removes the last
+    # argument if it's found to be an empty string.
+    ../trim-last-argument-to-gcc-if-empty.patch
+
+    # On Darwin, using clang 6 to build fails because of a linker error (see #105573),
+    # but using clang 7 fails because libarclite_macosx.a cannot be found when linking
+    # the xcode_locator tool.
+    # This patch removes using the -fobjc-arc compiler option and makes the code
+    # compile without automatic reference counting. Caveat: this leaks memory, but
+    # we accept this fact because xcode_locator is only a short-lived process used during the build.
+    (substituteAll {
+      src = ./no-arc.patch;
+      multiBinPatch = if stdenv.hostPlatform.system == "aarch64-darwin" then "arm64" else "x86_64";
+    })
+
+    # --experimental_strict_action_env (which may one day become the default
+    # see bazelbuild/bazel#2574) hardcodes the default
+    # action environment to a non hermetic value (e.g. "/usr/local/bin").
+    # This is non hermetic on non-nixos systems. On NixOS, bazel cannot find the required binaries.
+    # So we are replacing this bazel paths by defaultShellPath,
+    # improving hermeticity and making it work in nixos.
+    (substituteAll {
+      src = ../strict_action_env.patch;
+      strictActionEnvPatch = defaultShellPath;
+    })
+
+    (substituteAll {
+      src = ./actions_path.patch;
+      actionsPathPatch = defaultShellPath;
+    })
+
+    # bazel reads its system bazelrc in /etc
+    # override this path to a builtin one
+    (substituteAll {
+      src = ../bazel_rc.patch;
+      bazelSystemBazelRCPath = bazelRC;
+    })
+  ] ++ lib.optional enableNixHacks ../nix-hacks.patch;
+
+
+  # Additional tests that check bazel’s functionality. Execute
+  #
+  #     nix-build . -A bazel.tests
+  #
+  # in the nixpkgs checkout root to exercise them locally.
+  passthru.tests =
+    let
+      runLocal = name: attrs: script:
+      let
+        attrs' = removeAttrs attrs [ "buildInputs" ];
+        buildInputs = [ python3 which ] ++ (attrs.buildInputs or []);
+      in
+      runCommandCC name ({
+        inherit buildInputs;
+        preferLocalBuild = true;
+        meta.platforms = platforms;
+      } // attrs') script;
+
+      # bazel wants to extract itself into $install_dir/install every time it runs,
+      # so let’s do that only once.
+      extracted = bazelPkg:
+        let install_dir =
+          # `install_base` field printed by `bazel info`, minus the hash.
+          # yes, this path is kinda magic. Sorry.
+          "$HOME/.cache/bazel/_bazel_nixbld";
+        in runLocal "bazel-extracted-homedir" { passthru.install_dir = install_dir; } ''
+            export HOME=$(mktemp -d)
+            touch WORKSPACE # yeah, everything sucks
+            install_base="$(${bazelPkg}/bin/bazel info | grep install_base)"
+            # assert it’s actually below install_dir
+            [[ "$install_base" =~ ${install_dir} ]] \
+              || (echo "oh no! $install_base but we are \
+            trying to copy ${install_dir} to $out instead!"; exit 1)
+            cp -R ${install_dir} $out
+          '';
+
+      bazelTest = { name, bazelScript, workspaceDir, bazelPkg, buildInputs ? [] }:
+        let
+          be = extracted bazelPkg;
+        in runLocal name { inherit buildInputs; } (
+          # skip extraction caching on Darwin, because nobody knows how Darwin works
+          (lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
+            # set up home with pre-unpacked bazel
+            export HOME=$(mktemp -d)
+            mkdir -p ${be.install_dir}
+            cp -R ${be}/install ${be.install_dir}
+
+            # https://stackoverflow.com/questions/47775668/bazel-how-to-skip-corrupt-installation-on-centos6
+            # Bazel checks whether the mtime of the install dir files
+            # is >9 years in the future, otherwise it extracts itself again.
+            # see PosixFileMTime::IsUntampered in src/main/cpp/util
+            # What the hell bazel.
+            ${lr}/bin/lr -0 -U ${be.install_dir} | ${xe}/bin/xe -N0 -0 touch --date="9 years 6 months" {}
+          '')
+          +
+          ''
+            # Note https://github.com/bazelbuild/bazel/issues/5763#issuecomment-456374609
+            # about why to create a subdir for the workspace.
+            cp -r ${workspaceDir} wd && chmod u+w wd && cd wd
+
+            ${bazelScript}
+
+            touch $out
+          '');
+
+      bazelWithNixHacks = bazel_self.override { enableNixHacks = true; };
+
+      bazel-examples = fetchFromGitHub {
+        owner = "bazelbuild";
+        repo = "examples";
+        rev = "4183fc709c26a00366665e2d60d70521dc0b405d";
+        sha256 = "1mm4awx6sa0myiz9j4hwp71rpr7yh8vihf3zm15n2ii6xb82r31k";
+      };
+
+    in (if !stdenv.hostPlatform.isDarwin then {
+      # `extracted` doesn’t work on darwin
+      shebang = callPackage ../shebang-test.nix { inherit runLocal extracted bazelTest distDir; };
+    } else {}) // {
+      bashTools = callPackage ../bash-tools-test.nix { inherit runLocal bazelTest distDir; };
+      cpp = callPackage ../cpp-test.nix { inherit runLocal bazelTest bazel-examples distDir; };
+      java = callPackage ../java-test.nix { inherit runLocal bazelTest bazel-examples distDir; };
+      protobuf = callPackage ../protobuf-test.nix { inherit runLocal bazelTest distDir; };
+      pythonBinPath = callPackage ../python-bin-path-test.nix { inherit runLocal bazelTest distDir; };
+
+      bashToolsWithNixHacks = callPackage ../bash-tools-test.nix { inherit runLocal bazelTest distDir; bazel = bazelWithNixHacks; };
+
+      cppWithNixHacks = callPackage ../cpp-test.nix { inherit runLocal bazelTest bazel-examples distDir; bazel = bazelWithNixHacks; };
+      javaWithNixHacks = callPackage ../java-test.nix { inherit runLocal bazelTest bazel-examples distDir; bazel = bazelWithNixHacks; };
+      protobufWithNixHacks = callPackage ../protobuf-test.nix { inherit runLocal bazelTest distDir; bazel = bazelWithNixHacks; };
+      pythonBinPathWithNixHacks = callPackage ../python-bin-path-test.nix { inherit runLocal bazelTest distDir; bazel = bazelWithNixHacks; };
+
+      # downstream packages using buildBazelPackage
+      # fixed-output hashes of the fetch phase need to be spot-checked manually
+      downstream = recurseIntoAttrs ({
+        inherit bazel-watcher;
+      }
+          # dm-sonnet is only packaged for linux
+      // (lib.optionalAttrs stdenv.isLinux {
+          # TODO(timokau) dm-sonnet is broken currently
+          # dm-sonnet-linux = python3.pkgs.dm-sonnet;
+      }));
+    };
+
+  src_for_updater = stdenv.mkDerivation rec {
+    name = "updater-sources";
+    inherit src;
+    nativeBuildInputs = [ unzip ];
+    inherit sourceRoot;
+    installPhase = ''
+      runHook preInstall
+
+      cp -r . "$out"
+
+      runHook postInstall
+    '';
+  };
+  # update the list of workspace dependencies
+  passthru.updater = writeScript "update-bazel-deps.sh" ''
+    #!${runtimeShell}
+    (cd "${src_for_updater}" &&
+        BAZEL_USE_CPP_ONLY_TOOLCHAIN=1 \
+        "${bazel_4}"/bin/bazel \
+            query 'kind(http_archive, //external:all) + kind(http_file, //external:all) + kind(distdir_tar, //external:all) + kind(git_repository, //external:all)' \
+            --loading_phase_threads=1 \
+            --output build) \
+    | "${python3}"/bin/python3 "${./update-srcDeps.py}" \
+      "${builtins.toString ./src-deps.json}"
+  '';
+
+  # Necessary for the tests to pass on Darwin with sandbox enabled.
+  # Bazel starts a local server and needs to bind a local address.
+  __darwinAllowLocalNetworking = true;
+
+  postPatch = let
+
+    darwinPatches = ''
+      bazelLinkFlags () {
+        eval set -- "$NIX_LDFLAGS"
+        local flag
+        for flag in "$@"; do
+          printf ' -Wl,%s' "$flag"
+        done
+      }
+
+      # Disable Bazel's Xcode toolchain detection which would configure compilers
+      # and linkers from Xcode instead of from PATH
+      export BAZEL_USE_CPP_ONLY_TOOLCHAIN=1
+
+      # Explicitly configure gcov since we don't have it on Darwin, so autodetection fails
+      export GCOV=${coreutils}/bin/false
+
+      # Framework search paths aren't added by bintools hook
+      # https://github.com/NixOS/nixpkgs/pull/41914
+      export NIX_LDFLAGS+=" -F${CoreFoundation}/Library/Frameworks -F${CoreServices}/Library/Frameworks -F${Foundation}/Library/Frameworks"
+
+      # libcxx includes aren't added by libcxx hook
+      # https://github.com/NixOS/nixpkgs/pull/41589
+      export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -isystem ${lib.getDev libcxx}/include/c++/v1"
+
+      # don't use system installed Xcode to run clang, use Nix clang instead
+      sed -i -E "s;/usr/bin/xcrun (--sdk macosx )?clang;${stdenv.cc}/bin/clang $NIX_CFLAGS_COMPILE $(bazelLinkFlags) -framework CoreFoundation;g" \
+        scripts/bootstrap/compile.sh \
+        tools/osx/BUILD
+
+      substituteInPlace scripts/bootstrap/compile.sh --replace ' -mmacosx-version-min=10.9' ""
+
+      # nixpkgs's libSystem cannot use pthread headers directly, must import GCD headers instead
+      sed -i -e "/#include <pthread\/spawn.h>/i #include <dispatch/dispatch.h>" src/main/cpp/blaze_util_darwin.cc
+
+      # clang installed from Xcode has a compatibility wrapper that forwards
+      # invocations of gcc to clang, but vanilla clang doesn't
+      sed -i -e 's;_find_generic(repository_ctx, "gcc", "CC", overriden_tools);_find_generic(repository_ctx, "clang", "CC", overriden_tools);g' tools/cpp/unix_cc_configure.bzl
+
+      sed -i -e 's;/usr/bin/libtool;${cctools}/bin/libtool;g' tools/cpp/unix_cc_configure.bzl
+      wrappers=( tools/cpp/osx_cc_wrapper.sh tools/cpp/osx_cc_wrapper.sh.tpl )
+      for wrapper in "''${wrappers[@]}"; do
+        sed -i -e "s,/usr/bin/install_name_tool,${cctools}/bin/install_name_tool,g" $wrapper
+      done
+    '';
+
+    genericPatches = ''
+      # Substitute j2objc and objc wrapper's python shebang to plain python path.
+      # These scripts explicitly depend on Python 2.7, hence we use python27.
+      # See also `postFixup` where python27 is added to $out/nix-support
+      substituteInPlace tools/j2objc/j2objc_header_map.py --replace "$!/usr/bin/python2.7" "#!${python27}/bin/python"
+      substituteInPlace tools/j2objc/j2objc_wrapper.py --replace "$!/usr/bin/python2.7" "#!${python27}/bin/python"
+      substituteInPlace tools/objc/j2objc_dead_code_pruner.py --replace "$!/usr/bin/python2.7" "#!${python27}/bin/python"
+
+      # md5sum is part of coreutils
+      sed -i 's|/sbin/md5|md5sum|g' \
+        src/BUILD third_party/ijar/test/testenv.sh tools/objc/libtool.sh
+
+      # replace initial value of pythonShebang variable in BazelPythonSemantics.java
+      substituteInPlace src/main/java/com/google/devtools/build/lib/bazel/rules/python/BazelPythonSemantics.java \
+        --replace '"#!/usr/bin/env " + pythonExecutableName' "\"#!${python3}/bin/python\""
+
+      substituteInPlace src/main/java/com/google/devtools/build/lib/starlarkbuildapi/python/PyRuntimeInfoApi.java \
+        --replace '"#!/usr/bin/env python3"' "\"#!${python3}/bin/python\""
+
+      # substituteInPlace is rather slow, so prefilter the files with grep
+      grep -rlZ /bin/ src/main/java/com/google/devtools | while IFS="" read -r -d "" path; do
+        # If you add more replacements here, you must change the grep above!
+        # Only files containing /bin are taken into account.
+        # We default to python3 where possible. See also `postFixup` where
+        # python3 is added to $out/nix-support
+        substituteInPlace "$path" \
+          --replace /bin/bash ${bash}/bin/bash \
+          --replace "/usr/bin/env bash" ${bash}/bin/bash \
+          --replace "/usr/bin/env python" ${python3}/bin/python \
+          --replace /usr/bin/env ${coreutils}/bin/env \
+          --replace /bin/true ${coreutils}/bin/true
+      done
+
+      grep -rlZ /bin/ tools/python | while IFS="" read -r -d "" path; do
+        substituteInPlace "$path" \
+          --replace "/usr/bin/env python2" ${python27}/bin/python \
+          --replace "/usr/bin/env python3" ${python3}/bin/python \
+          --replace /usr/bin/env ${coreutils}/bin/env
+      done
+
+      # bazel test runner include references to /bin/bash
+      substituteInPlace tools/build_rules/test_rules.bzl \
+        --replace /bin/bash ${bash}/bin/bash
+
+      for i in $(find tools/cpp/ -type f)
+      do
+        substituteInPlace $i \
+          --replace /bin/bash ${bash}/bin/bash
+      done
+
+      # Fixup scripts that generate scripts. Not fixed up by patchShebangs below.
+      substituteInPlace scripts/bootstrap/compile.sh \
+          --replace /bin/bash ${bash}/bin/bash
+
+      # add nix environment vars to .bazelrc
+      cat >> .bazelrc <<EOF
+      # Limit the resources Bazel is allowed to use during the build to 1/2 the
+      # available RAM and 3/4 the available CPU cores. This should help avoid
+      # overwhelming the build machine.
+      build --local_ram_resources=HOST_RAM*.5
+      build --local_cpu_resources=HOST_CPUS*.75
+
+      build --distdir=${distDir}
+      fetch --distdir=${distDir}
+      build --copt="$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --copt="/g')"
+      build --host_copt="$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --host_copt="/g')"
+      build --linkopt="$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --linkopt="/g')"
+      build --host_linkopt="$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --host_linkopt="/g')"
+      build --linkopt="-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --linkopt="-Wl,/g')"
+      build --host_linkopt="-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --host_linkopt="-Wl,/g')"
+      build --extra_toolchains=@bazel_tools//tools/jdk:nonprebuilt_toolchain_definition
+      build --verbose_failures
+      build --curses=no
+      build --sandbox_debug
+      build --features=-layering_check
+      EOF
+
+      cat >> tools/jdk/BUILD.tools <<EOF
+      load("@bazel_tools//tools/jdk:default_java_toolchain.bzl", "default_java_toolchain", "NONPREBUILT_TOOLCHAIN_CONFIGURATION")
+      default_java_toolchain(
+        name = "nonprebuilt_toolchain",
+        configuration = NONPREBUILT_TOOLCHAIN_CONFIGURATION,
+        java_runtime = "@local_jdk//:jdk",
+      )
+      EOF
+
+      cat >> third_party/grpc/bazel_1.41.0.patch <<EOF
+      diff --git a/third_party/grpc/BUILD b/third_party/grpc/BUILD
+      index 39ee9f97c6..9128d20c85 100644
+      --- a/third_party/grpc/BUILD
+      +++ b/third_party/grpc/BUILD
+      @@ -28,7 +28,6 @@ licenses(["notice"])
+       package(
+           default_visibility = ["//visibility:public"],
+           features = [
+      -        "layering_check",
+               "-parse_headers",
+           ],
+       )
+      EOF
+
+      # add the same environment vars to compile.sh
+      sed -e "/\$command \\\\$/a --copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --copt=\"/g')\" \\\\" \
+          -e "/\$command \\\\$/a --host_copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --host_copt=\"/g')\" \\\\" \
+          -e "/\$command \\\\$/a --linkopt=\"$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --linkopt=\"/g')\" \\\\" \
+          -e "/\$command \\\\$/a --host_linkopt=\"$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --host_linkopt=\"/g')\" \\\\" \
+          -e "/\$command \\\\$/a --linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --linkopt=\"-Wl,/g')\" \\\\" \
+          -e "/\$command \\\\$/a --host_linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --host_linkopt=\"-Wl,/g')\" \\\\" \
+          -e "/\$command \\\\$/a --tool_java_runtime_version=local_jdk_11 \\\\" \
+          -e "/\$command \\\\$/a --java_runtime_version=local_jdk_11 \\\\" \
+          -e "/\$command \\\\$/a --verbose_failures \\\\" \
+          -e "/\$command \\\\$/a --curses=no \\\\" \
+          -e "/\$command \\\\$/a --features=-layering_check \\\\" \
+          -e "/\$command \\\\$/a --sandbox_debug \\\\" \
+          -i scripts/bootstrap/compile.sh
+
+      # This is necessary to avoid:
+      # "error: no visible @interface for 'NSDictionary' declares the selector
+      # 'initWithContentsOfURL:error:'"
+      # This can be removed when the apple_sdk is upgraded beyond 10.13+
+      sed -i '/initWithContentsOfURL:versionPlistUrl/ {
+        N
+        s/error:nil\];/\];/
+      }' tools/osx/xcode_locator.m
+
+      # append the PATH with defaultShellPath in tools/bash/runfiles/runfiles.bash
+      echo "PATH=\$PATH:${defaultShellPath}" >> runfiles.bash.tmp
+      cat tools/bash/runfiles/runfiles.bash >> runfiles.bash.tmp
+      mv runfiles.bash.tmp tools/bash/runfiles/runfiles.bash
+
+      patchShebangs .
+    '';
+    in lib.optionalString stdenv.hostPlatform.isDarwin darwinPatches
+     + genericPatches;
+
+  buildInputs = [buildJdk] ++ defaultShellUtils;
+
+  # when a command can’t be found in a bazel build, you might also
+  # need to add it to `defaultShellPath`.
+  nativeBuildInputs = [
+    coreutils
+    installShellFiles
+    makeWrapper
+    python3
+    unzip
+    which
+    zip
+    python3.pkgs.absl-py   # Needed to build fish completion
+  ] ++ lib.optionals (stdenv.isDarwin) [ cctools libcxx CoreFoundation CoreServices Foundation ];
+
+  # Bazel makes extensive use of symlinks in the WORKSPACE.
+  # This causes problems with infinite symlinks if the build output is in the same location as the
+  # Bazel WORKSPACE. This is why before executing the build, the source code is moved into a
+  # subdirectory.
+  # Failing to do this causes "infinite symlink expansion detected"
+  preBuildPhases = ["preBuildPhase"];
+  preBuildPhase = ''
+    mkdir bazel_src
+    shopt -s dotglob extglob
+    mv !(bazel_src) bazel_src
+  '';
+  buildPhase = ''
+    runHook preBuild
+
+    # Increasing memory during compilation might be necessary.
+    # export BAZEL_JAVAC_OPTS="-J-Xmx2g -J-Xms200m"
+
+    # If EMBED_LABEL isn't set, it'd be auto-detected from CHANGELOG.md
+    # and `git rev-parse --short HEAD` which would result in
+    # "3.7.0- (@non-git)" due to non-git build and incomplete changelog.
+    # Actual bazel releases use scripts/release/common.sh which is based
+    # on branch/tag information which we don't have with tarball releases.
+    # Note that .bazelversion is always correct and is based on bazel-*
+    # executable name, version checks should work fine
+    export EMBED_LABEL="${version}- (@non-git)"
+    ${bash}/bin/bash ./bazel_src/compile.sh
+    ./bazel_src/scripts/generate_bash_completion.sh \
+        --bazel=./bazel_src/output/bazel \
+        --output=./bazel_src/output/bazel-complete.bash \
+        --prepend=./bazel_src/scripts/bazel-complete-header.bash \
+        --prepend=./bazel_src/scripts/bazel-complete-template.bash
+    ${python3}/bin/python3 ./bazel_src/scripts/generate_fish_completion.py \
+        --bazel=./bazel_src/output/bazel \
+        --output=./bazel_src/output/bazel-complete.fish
+
+    # need to change directory for bazel to find the workspace
+    cd ./bazel_src
+    # build execlog tooling
+    export HOME=$(mktemp -d)
+    ./output/bazel build  src/tools/execlog:parser_deploy.jar
+    cd -
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+
+    # official wrapper scripts that searches for $WORKSPACE_ROOT/tools/bazel
+    # if it can’t find something in tools, it calls $out/bin/bazel-{version}-{os_arch}
+    # The binary _must_ exist with this naming if your project contains a .bazelversion
+    # file.
+    cp ./bazel_src/scripts/packages/bazel.sh $out/bin/bazel
+    mv ./bazel_src/output/bazel $out/bin/bazel-${version}-${system}-${arch}
+
+    mkdir $out/share
+    cp ./bazel_src/bazel-bin/src/tools/execlog/parser_deploy.jar $out/share/parser_deploy.jar
+    cat <<EOF > $out/bin/bazel-execlog
+    #!${runtimeShell} -e
+    ${runJdk}/bin/java -jar $out/share/parser_deploy.jar \$@
+    EOF
+    chmod +x $out/bin/bazel-execlog
+
+    # shell completion files
+    installShellCompletion --bash \
+      --name bazel.bash \
+      ./bazel_src/output/bazel-complete.bash
+    installShellCompletion --zsh \
+      --name _bazel \
+      ./bazel_src/scripts/zsh_completion/_bazel
+    installShellCompletion --fish \
+      --name bazel.fish \
+      ./bazel_src/output/bazel-complete.fish
+  '';
+
+  # Install check fails on `aarch64-darwin`
+  # https://github.com/NixOS/nixpkgs/issues/145587
+  doInstallCheck = stdenv.hostPlatform.system != "aarch64-darwin";
+  installCheckPhase = ''
+    export TEST_TMPDIR=$(pwd)
+
+    hello_test () {
+      $out/bin/bazel test \
+        --test_output=errors \
+        examples/cpp:hello-success_test \
+        examples/java-native/src/test/java/com/example/myproject:hello
+    }
+
+    cd ./bazel_src
+
+    # test whether $WORKSPACE_ROOT/tools/bazel works
+
+    mkdir -p tools
+    cat > tools/bazel <<"EOF"
+    #!${runtimeShell} -e
+    exit 1
+    EOF
+    chmod +x tools/bazel
+
+    # first call should fail if tools/bazel is used
+    ! hello_test
+
+    cat > tools/bazel <<"EOF"
+    #!${runtimeShell} -e
+    exec "$BAZEL_REAL" "$@"
+    EOF
+
+    # second call succeeds because it defers to $out/bin/bazel-{version}-{os_arch}
+    hello_test
+
+    runHook postInstall
+  '';
+
+  # Save paths to hardcoded dependencies so Nix can detect them.
+  # This is needed because the templates get tar’d up into a .jar.
+  postFixup = ''
+    mkdir -p $out/nix-support
+    echo "${defaultShellPath}" >> $out/nix-support/depends
+    # The string literal specifying the path to the bazel-rc file is sometimes
+    # stored non-contiguously in the binary due to gcc optimisations, which leads
+    # Nix to miss the hash when scanning for dependencies
+    echo "${bazelRC}" >> $out/nix-support/depends
+  '' + lib.optionalString stdenv.isDarwin ''
+    echo "${cctools}" >> $out/nix-support/depends
+  '';
+
+  dontStrip = true;
+  dontPatchELF = true;
+}
+
diff --git a/third_party/nixpkgs/pkgs/development/tools/build-managers/bazel/bazel_5/no-arc.patch b/third_party/nixpkgs/pkgs/development/tools/build-managers/bazel/bazel_5/no-arc.patch
new file mode 100644
index 0000000000..95d70a9db3
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/tools/build-managers/bazel/bazel_5/no-arc.patch
@@ -0,0 +1,42 @@
+diff --git a/tools/osx/BUILD b/tools/osx/BUILD
+index 990afe3e8c..cd5b7b1b7a 100644
+--- a/tools/osx/BUILD
++++ b/tools/osx/BUILD
+@@ -28,8 +28,8 @@ exports_files([
+ ])
+ 
+ DARWIN_XCODE_LOCATOR_COMPILE_COMMAND = """
+-  /usr/bin/xcrun --sdk macosx clang -mmacosx-version-min=10.9 -fobjc-arc -framework CoreServices \
+-      -framework Foundation -arch arm64 -arch x86_64 -Wl,-no_adhoc_codesign -Wl,-no_uuid -o $@ $< && \
++  /usr/bin/xcrun --sdk macosx clang -mmacosx-version-min=10.9 -framework CoreServices \
++      -framework Foundation -arch @multiBinPatch@ -Wl,-no_uuid -o $@ $< && \
+   env -i codesign --identifier $@ --force --sign - $@
+ """
+ 
+diff --git a/tools/osx/xcode_configure.bzl b/tools/osx/xcode_configure.bzl
+index 2b819f07ec..a98ce37673 100644
+--- a/tools/osx/xcode_configure.bzl
++++ b/tools/osx/xcode_configure.bzl
+@@ -127,7 +127,6 @@ def run_xcode_locator(repository_ctx, xcode_locator_src_label):
+         "macosx",
+         "clang",
+         "-mmacosx-version-min=10.9",
+-        "-fobjc-arc",
+         "-framework",
+         "CoreServices",
+         "-framework",
+diff --git a/tools/osx/xcode_locator.m b/tools/osx/xcode_locator.m
+index ed2ef87453..e0ce6dbdd1 100644
+--- a/tools/osx/xcode_locator.m
++++ b/tools/osx/xcode_locator.m
+@@ -21,10 +21,6 @@
+ // 6,6.4,6.4.1 = 6.4.1
+ // 6.3,6.3.0 = 6.3
+ 
+-#if !defined(__has_feature) || !__has_feature(objc_arc)
+-#error "This file requires ARC support."
+-#endif
+-
+ #import <CoreServices/CoreServices.h>
+ #import <Foundation/Foundation.h>
+ 
diff --git a/third_party/nixpkgs/pkgs/development/tools/build-managers/bazel/bazel_5/src-deps.json b/third_party/nixpkgs/pkgs/development/tools/build-managers/bazel/bazel_5/src-deps.json
new file mode 100644
index 0000000000..ff010d01aa
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/tools/build-managers/bazel/bazel_5/src-deps.json
@@ -0,0 +1,1990 @@
+{
+    "1.25.0.zip": {
+        "name": "1.25.0.zip",
+        "sha256": "c78be58f5e0a29a04686b628cf54faaee0094322ae0ac99da5a8a8afca59a647",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/rules_sass/archive/1.25.0.zip",
+            "https://github.com/bazelbuild/rules_sass/archive/1.25.0.zip"
+        ]
+    },
+    "1ef781ced3b1443dca3ed05dec1989eca1a4e1cd.tar.gz": {
+        "name": "1ef781ced3b1443dca3ed05dec1989eca1a4e1cd.tar.gz",
+        "sha256": "5a725b777976b77aa122b707d1b6f0f39b6020f66cd427bb111a585599c857b1",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/stardoc/archive/1ef781ced3b1443dca3ed05dec1989eca1a4e1cd.tar.gz",
+            "https://github.com/bazelbuild/stardoc/archive/1ef781ced3b1443dca3ed05dec1989eca1a4e1cd.tar.gz"
+        ]
+    },
+    "2de300726a1ba2de9a468468dc5ff9ed17a3215f.tar.gz": {
+        "name": "2de300726a1ba2de9a468468dc5ff9ed17a3215f.tar.gz",
+        "sha256": "6a5f67874af66b239b709c572ac1a5a00fdb1b29beaf13c3e6f79b1ba10dc7c4",
+        "urls": [
+            "https://mirror.bazel.build/github.com/protocolbuffers/upb/archive/2de300726a1ba2de9a468468dc5ff9ed17a3215f.tar.gz",
+            "https://github.com/protocolbuffers/upb/archive/2de300726a1ba2de9a468468dc5ff9ed17a3215f.tar.gz"
+        ]
+    },
+    "5847d6a06302136d95a14b4cbd4b55a9c9f1436e.zip": {
+        "name": "5847d6a06302136d95a14b4cbd4b55a9c9f1436e.zip",
+        "sha256": "299452e6f4a4981b2e6d22357f7332713382a63e4c137f5fd6b89579f6d610cb",
+        "urls": [
+            "https://mirror.bazel.build/github.com/google/desugar_jdk_libs/archive/5847d6a06302136d95a14b4cbd4b55a9c9f1436e.zip",
+            "https://github.com/google/desugar_jdk_libs/archive/5847d6a06302136d95a14b4cbd4b55a9c9f1436e.zip"
+        ]
+    },
+    "7cf3cefd652008d0a64a419c34c13bdca6c8f178.zip": {
+        "name": "7cf3cefd652008d0a64a419c34c13bdca6c8f178.zip",
+        "sha256": "bc81f1ba47ef5cc68ad32225c3d0e70b8c6f6077663835438da8d5733f917598",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/rules_java/archive/7cf3cefd652008d0a64a419c34c13bdca6c8f178.zip",
+            "https://github.com/bazelbuild/rules_java/archive/7cf3cefd652008d0a64a419c34c13bdca6c8f178.zip"
+        ]
+    },
+    "7e4afce6fe62dbff0a4a03450143146f9f2d7488.tar.gz": {
+        "name": "7e4afce6fe62dbff0a4a03450143146f9f2d7488.tar.gz",
+        "sha256": "8e7d59a5b12b233be5652e3d29f42fba01c7cbab09f6b3a8d0a57ed6d1e9a0da",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/rules_proto/archive/7e4afce6fe62dbff0a4a03450143146f9f2d7488.tar.gz",
+            "https://github.com/bazelbuild/rules_proto/archive/7e4afce6fe62dbff0a4a03450143146f9f2d7488.tar.gz"
+        ]
+    },
+    "997aaf3a28308eba1b9156aa35ab7bca9688e9f6.tar.gz": {
+        "name": "997aaf3a28308eba1b9156aa35ab7bca9688e9f6.tar.gz",
+        "sha256": "35f22ef5cb286f09954b7cc4c85b5a3f6221c9d4df6b8c4a1e9d399555b366ee",
+        "urls": [
+            "https://mirror.bazel.build/github.com/abseil/abseil-cpp/archive/997aaf3a28308eba1b9156aa35ab7bca9688e9f6.tar.gz",
+            "https://github.com/abseil/abseil-cpp/archive/997aaf3a28308eba1b9156aa35ab7bca9688e9f6.tar.gz"
+        ]
+    },
+    "aecba11114cf1fac5497aeb844b6966106de3eb6.tar.gz": {
+        "name": "aecba11114cf1fac5497aeb844b6966106de3eb6.tar.gz",
+        "sha256": "9f385e146410a8150b6f4cb1a57eab7ec806ced48d427554b1e754877ff26c3e",
+        "urls": [
+            "https://mirror.bazel.build/github.com/google/re2/archive/aecba11114cf1fac5497aeb844b6966106de3eb6.tar.gz",
+            "https://github.com/google/re2/archive/aecba11114cf1fac5497aeb844b6966106de3eb6.tar.gz"
+        ]
+    },
+    "android_tools": {
+        "name": "android_tools",
+        "sha256": "ed5290594244c2eeab41f0104519bcef51e27c699ff4b379fcbd25215270513e",
+        "url": "https://mirror.bazel.build/bazel_android_tools/android_tools_pkg-0.23.0.tar.gz"
+    },
+    "android_tools_for_testing": {
+        "name": "android_tools_for_testing",
+        "patch_cmds": [
+            "test -f BUILD && chmod u+w BUILD || true",
+            "echo >> BUILD",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "ed5290594244c2eeab41f0104519bcef51e27c699ff4b379fcbd25215270513e",
+        "url": "https://mirror.bazel.build/bazel_android_tools/android_tools_pkg-0.23.0.tar.gz"
+    },
+    "android_tools_pkg-0.23.0.tar.gz": {
+        "name": "android_tools_pkg-0.23.0.tar.gz",
+        "sha256": "ed5290594244c2eeab41f0104519bcef51e27c699ff4b379fcbd25215270513e",
+        "urls": [
+            "https://mirror.bazel.build/bazel_android_tools/android_tools_pkg-0.23.0.tar.gz"
+        ]
+    },
+    "b1c40e1de81913a3c40e5948f78719c28152486d.zip": {
+        "name": "b1c40e1de81913a3c40e5948f78719c28152486d.zip",
+        "sha256": "d0c573b94a6ef20ef6ff20154a23d0efcb409fb0e1ff0979cec318dfe42f0cdd",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/rules_cc/archive/b1c40e1de81913a3c40e5948f78719c28152486d.zip",
+            "https://github.com/bazelbuild/rules_cc/archive/b1c40e1de81913a3c40e5948f78719c28152486d.zip"
+        ]
+    },
+    "bazel-skylib-1.0.3.tar.gz": {
+        "name": "bazel-skylib-1.0.3.tar.gz",
+        "sha256": "1c531376ac7e5a180e0237938a2536de0c54d93f5c278634818e0efc952dd56c",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/bazel-skylib/releases/download/1.0.3/bazel-skylib-1.0.3.tar.gz",
+            "https://github.com/bazelbuild/bazel-skylib/releases/download/1.0.3/bazel-skylib-1.0.3.tar.gz"
+        ]
+    },
+    "bazel_compdb": {
+        "generator_function": "grpc_deps",
+        "generator_name": "bazel_compdb",
+        "name": "bazel_compdb",
+        "sha256": "bcecfd622c4ef272fd4ba42726a52e140b961c4eac23025f18b346c968a8cfb4",
+        "strip_prefix": "bazel-compilation-database-0.4.5",
+        "urls": [
+            "https://storage.googleapis.com/grpc-bazel-mirror/github.com/grailbio/bazel-compilation-database/archive/0.4.5.tar.gz",
+            "https://github.com/grailbio/bazel-compilation-database/archive/0.4.5.tar.gz"
+        ]
+    },
+    "bazel_gazelle": {
+        "generator_function": "grpc_deps",
+        "generator_name": "bazel_gazelle",
+        "name": "bazel_gazelle",
+        "sha256": "d987004a72697334a095bbaa18d615804a28280201a50ed6c234c40ccc41e493",
+        "strip_prefix": "bazel-gazelle-0.19.1",
+        "urls": [
+            "https://storage.googleapis.com/grpc-bazel-mirror/github.com/bazelbuild/bazel-gazelle/archive/v0.19.1.tar.gz",
+            "https://github.com/bazelbuild/bazel-gazelle/archive/v0.19.1.tar.gz"
+        ]
+    },
+    "bazel_j2objc": {
+        "name": "bazel_j2objc",
+        "sha256": "8d3403b5b7db57e347c943d214577f6879e5b175c2b59b7e075c0b6453330e9b",
+        "strip_prefix": "j2objc-2.5",
+        "urls": [
+            "https://mirror.bazel.build/github.com/google/j2objc/releases/download/2.5/j2objc-2.5.zip",
+            "https://github.com/google/j2objc/releases/download/2.5/j2objc-2.5.zip"
+        ]
+    },
+    "bazel_skylib": {
+        "generator_function": "dist_http_archive",
+        "generator_name": "bazel_skylib",
+        "name": "bazel_skylib",
+        "patch_cmds": [
+            "test -f BUILD && chmod u+w BUILD || true",
+            "echo >> BUILD",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "1c531376ac7e5a180e0237938a2536de0c54d93f5c278634818e0efc952dd56c",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/bazel-skylib/releases/download/1.0.3/bazel-skylib-1.0.3.tar.gz",
+            "https://github.com/bazelbuild/bazel-skylib/releases/download/1.0.3/bazel-skylib-1.0.3.tar.gz"
+        ]
+    },
+    "bazel_toolchains": {
+        "generator_function": "grpc_deps",
+        "generator_name": "bazel_toolchains",
+        "name": "bazel_toolchains",
+        "sha256": "0b36eef8a66f39c8dbae88e522d5bbbef49d5e66e834a982402c79962281be10",
+        "strip_prefix": "bazel-toolchains-1.0.1",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/bazel-toolchains/archive/1.0.1.tar.gz",
+            "https://github.com/bazelbuild/bazel-toolchains/releases/download/1.0.1/bazel-toolchains-1.0.1.tar.gz"
+        ]
+    },
+    "bazel_website": {
+        "build_file_content": "\nexports_files([\"_sass/style.scss\"])\n",
+        "name": "bazel_website",
+        "sha256": "a5f531dd1d62e6947dcfc279656ffc2fdf6f447c163914c5eabf7961b4cb6eb4",
+        "strip_prefix": "bazel-website-c174fa288aa079b68416d2ce2cc97268fa172f42",
+        "urls": [
+            "https://github.com/bazelbuild/bazel-website/archive/c174fa288aa079b68416d2ce2cc97268fa172f42.tar.gz"
+        ]
+    },
+    "bazelci_rules": {
+        "generator_function": "dist_http_archive",
+        "generator_name": "bazelci_rules",
+        "name": "bazelci_rules",
+        "patch_cmds": [
+            "test -f BUILD && chmod u+w BUILD || true",
+            "echo >> BUILD",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "eca21884e6f66a88c358e580fd67a6b148d30ab57b1680f62a96c00f9bc6a07e",
+        "strip_prefix": "bazelci_rules-1.0.0",
+        "urls": [
+            "https://github.com/bazelbuild/continuous-integration/releases/download/rules-1.0.0/bazelci_rules-1.0.0.tar.gz"
+        ]
+    },
+    "bazelci_rules-1.0.0.tar.gz": {
+        "name": "bazelci_rules-1.0.0.tar.gz",
+        "sha256": "eca21884e6f66a88c358e580fd67a6b148d30ab57b1680f62a96c00f9bc6a07e",
+        "urls": [
+            "https://github.com/bazelbuild/continuous-integration/releases/download/rules-1.0.0/bazelci_rules-1.0.0.tar.gz"
+        ]
+    },
+    "boringssl": {
+        "generator_function": "grpc_deps",
+        "generator_name": "boringssl",
+        "name": "boringssl",
+        "sha256": "6f640262999cd1fb33cf705922e453e835d2d20f3f06fe0d77f6426c19257308",
+        "strip_prefix": "boringssl-fc44652a42b396e1645d5e72aba053349992136a",
+        "urls": [
+            "https://storage.googleapis.com/grpc-bazel-mirror/github.com/google/boringssl/archive/fc44652a42b396e1645d5e72aba053349992136a.tar.gz",
+            "https://github.com/google/boringssl/archive/fc44652a42b396e1645d5e72aba053349992136a.tar.gz"
+        ]
+    },
+    "build_bazel_apple_support": {
+        "generator_function": "grpc_deps",
+        "generator_name": "build_bazel_apple_support",
+        "name": "build_bazel_apple_support",
+        "sha256": "122ebf7fe7d1c8e938af6aeaee0efe788a3a2449ece5a8d6a428cb18d6f88033",
+        "urls": [
+            "https://storage.googleapis.com/grpc-bazel-mirror/github.com/bazelbuild/apple_support/releases/download/0.7.1/apple_support.0.7.1.tar.gz",
+            "https://github.com/bazelbuild/apple_support/releases/download/0.7.1/apple_support.0.7.1.tar.gz"
+        ]
+    },
+    "build_bazel_rules_apple": {
+        "generator_function": "grpc_deps",
+        "generator_name": "build_bazel_rules_apple",
+        "name": "build_bazel_rules_apple",
+        "sha256": "bdc8e66e70b8a75da23b79f1f8c6207356df07d041d96d2189add7ee0780cf4e",
+        "strip_prefix": "rules_apple-b869b0d3868d78a1d4ffd866ccb304fb68aa12c3",
+        "urls": [
+            "https://storage.googleapis.com/grpc-bazel-mirror/github.com/bazelbuild/rules_apple/archive/b869b0d3868d78a1d4ffd866ccb304fb68aa12c3.tar.gz",
+            "https://github.com/bazelbuild/rules_apple/archive/b869b0d3868d78a1d4ffd866ccb304fb68aa12c3.tar.gz"
+        ]
+    },
+    "build_bazel_rules_nodejs": {
+        "generator_function": "dist_http_archive",
+        "generator_name": "build_bazel_rules_nodejs",
+        "name": "build_bazel_rules_nodejs",
+        "sha256": "f2194102720e662dbf193546585d705e645314319554c6ce7e47d8b59f459e9c",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/rules_nodejs/releases/download/2.2.2/rules_nodejs-2.2.2.tar.gz",
+            "https://github.com/bazelbuild/rules_nodejs/releases/download/2.2.2/rules_nodejs-2.2.2.tar.gz"
+        ]
+    },
+    "com_envoyproxy_protoc_gen_validate": {
+        "generator_function": "grpc_deps",
+        "generator_name": "com_envoyproxy_protoc_gen_validate",
+        "name": "com_envoyproxy_protoc_gen_validate",
+        "sha256": "dd4962e4a9e8388a4fbc5c33e64d73bdb222f103e4bad40ca5535f81c2c606c2",
+        "strip_prefix": "protoc-gen-validate-59da36e59fef2267fc2b1849a05159e3ecdf24f3",
+        "urls": [
+            "https://storage.googleapis.com/grpc-bazel-mirror/github.com/envoyproxy/protoc-gen-validate/archive/59da36e59fef2267fc2b1849a05159e3ecdf24f3.tar.gz",
+            "https://github.com/envoyproxy/protoc-gen-validate/archive/59da36e59fef2267fc2b1849a05159e3ecdf24f3.tar.gz"
+        ]
+    },
+    "com_github_cares_cares": {
+        "build_file": "@com_github_grpc_grpc//third_party:cares/cares.BUILD",
+        "generator_function": "grpc_deps",
+        "generator_name": "com_github_cares_cares",
+        "name": "com_github_cares_cares",
+        "sha256": "e8c2751ddc70fed9dc6f999acd92e232d5846f009ee1674f8aee81f19b2b915a",
+        "strip_prefix": "c-ares-e982924acee7f7313b4baa4ee5ec000c5e373c30",
+        "urls": [
+            "https://storage.googleapis.com/grpc-bazel-mirror/github.com/c-ares/c-ares/archive/e982924acee7f7313b4baa4ee5ec000c5e373c30.tar.gz",
+            "https://github.com/c-ares/c-ares/archive/e982924acee7f7313b4baa4ee5ec000c5e373c30.tar.gz"
+        ]
+    },
+    "com_github_google_benchmark": {
+        "generator_function": "grpc_deps",
+        "generator_name": "com_github_google_benchmark",
+        "name": "com_github_google_benchmark",
+        "sha256": "daa4a97e0547d76de300e325a49177b199f3689ce5a35e25d47696f7cb050f86",
+        "strip_prefix": "benchmark-73d4d5e8d6d449fc8663765a42aa8aeeee844489",
+        "urls": [
+            "https://storage.googleapis.com/grpc-bazel-mirror/github.com/google/benchmark/archive/73d4d5e8d6d449fc8663765a42aa8aeeee844489.tar.gz",
+            "https://github.com/google/benchmark/archive/73d4d5e8d6d449fc8663765a42aa8aeeee844489.tar.gz"
+        ]
+    },
+    "com_github_grpc_grpc": {
+        "generator_function": "dist_http_archive",
+        "generator_name": "com_github_grpc_grpc",
+        "name": "com_github_grpc_grpc",
+        "patch_args": [
+            "-p1"
+        ],
+        "patches": [
+            "//third_party/grpc:grpc_1.41.0.patch"
+        ],
+        "sha256": "e5fb30aae1fa1cffa4ce00aa0bbfab908c0b899fcf0bbc30e268367d660d8656",
+        "strip_prefix": "grpc-1.41.0",
+        "urls": [
+            "https://mirror.bazel.build/github.com/grpc/grpc/archive/v1.41.0.tar.gz",
+            "https://github.com/grpc/grpc/archive/v1.41.0.tar.gz"
+        ]
+    },
+    "com_google_absl": {
+        "generator_function": "grpc_deps",
+        "generator_name": "com_google_absl",
+        "name": "com_google_absl",
+        "sha256": "35f22ef5cb286f09954b7cc4c85b5a3f6221c9d4df6b8c4a1e9d399555b366ee",
+        "strip_prefix": "abseil-cpp-997aaf3a28308eba1b9156aa35ab7bca9688e9f6",
+        "urls": [
+            "https://storage.googleapis.com/grpc-bazel-mirror/github.com/abseil/abseil-cpp/archive/997aaf3a28308eba1b9156aa35ab7bca9688e9f6.tar.gz",
+            "https://github.com/abseil/abseil-cpp/archive/997aaf3a28308eba1b9156aa35ab7bca9688e9f6.tar.gz"
+        ]
+    },
+    "com_google_googleapis": {
+        "generator_function": "grpc_deps",
+        "generator_name": "com_google_googleapis",
+        "name": "com_google_googleapis",
+        "sha256": "5bb6b0253ccf64b53d6c7249625a7e3f6c3bc6402abd52d3778bfa48258703a0",
+        "strip_prefix": "googleapis-2f9af297c84c55c8b871ba4495e01ade42476c92",
+        "urls": [
+            "https://storage.googleapis.com/grpc-bazel-mirror/github.com/googleapis/googleapis/archive/2f9af297c84c55c8b871ba4495e01ade42476c92.tar.gz",
+            "https://github.com/googleapis/googleapis/archive/2f9af297c84c55c8b871ba4495e01ade42476c92.tar.gz"
+        ]
+    },
+    "com_google_googletest": {
+        "name": "com_google_googletest",
+        "sha256": "9dc9157a9a1551ec7a7e43daea9a694a0bb5fb8bec81235d8a1e6ef64c716dcb",
+        "strip_prefix": "googletest-release-1.10.0",
+        "urls": [
+            "https://mirror.bazel.build/github.com/google/googletest/archive/release-1.10.0.tar.gz",
+            "https://github.com/google/googletest/archive/release-1.10.0.tar.gz"
+        ]
+    },
+    "com_google_protobuf": {
+        "generator_function": "dist_http_archive",
+        "generator_name": "com_google_protobuf",
+        "name": "com_google_protobuf",
+        "patch_args": [
+            "-p1"
+        ],
+        "patch_cmds": [
+            "test -f BUILD && chmod u+w BUILD || true",
+            "echo >> BUILD",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "patches": [
+            "//third_party/protobuf:3.13.0.patch"
+        ],
+        "sha256": "9b4ee22c250fe31b16f1a24d61467e40780a3fbb9b91c3b65be2a376ed913a1a",
+        "strip_prefix": "protobuf-3.13.0",
+        "urls": [
+            "https://mirror.bazel.build/github.com/protocolbuffers/protobuf/archive/v3.13.0.tar.gz",
+            "https://github.com/protocolbuffers/protobuf/archive/v3.13.0.tar.gz"
+        ]
+    },
+    "com_google_testparameterinjector": {
+        "build_file_content": "\njava_library(\n    name = \"testparameterinjector\",\n    testonly = True,\n    srcs = glob([\"src/main/**/*.java\"]),\n    deps = [\n      \"@org_snakeyaml//:snakeyaml\",\n      \"@//third_party:auto_value\",\n      \"@//third_party:guava\",\n      \"@//third_party:junit4\",\n      \"@//third_party/protobuf:protobuf_java\",\n    ],\n    visibility = [\"//visibility:public\"],\n)\n",
+        "name": "com_google_testparameterinjector",
+        "sha256": "562a0e87eb413a7dcad29ebc8d578f6f97503473943585b051c1398a58189b06",
+        "strip_prefix": "TestParameterInjector-1.0",
+        "urls": [
+            "https://mirror.bazel.build/github.com/google/TestParameterInjector/archive/v1.0.tar.gz",
+            "https://github.com/google/TestParameterInjector/archive/v1.0.tar.gz"
+        ]
+    },
+    "com_googlesource_code_re2": {
+        "generator_function": "grpc_deps",
+        "generator_name": "com_googlesource_code_re2",
+        "name": "com_googlesource_code_re2",
+        "sha256": "9f385e146410a8150b6f4cb1a57eab7ec806ced48d427554b1e754877ff26c3e",
+        "strip_prefix": "re2-aecba11114cf1fac5497aeb844b6966106de3eb6",
+        "urls": [
+            "https://storage.googleapis.com/grpc-bazel-mirror/github.com/google/re2/archive/aecba11114cf1fac5497aeb844b6966106de3eb6.tar.gz",
+            "https://github.com/google/re2/archive/aecba11114cf1fac5497aeb844b6966106de3eb6.tar.gz"
+        ]
+    },
+    "coverage_output_generator-v2.5.zip": {
+        "name": "coverage_output_generator-v2.5.zip",
+        "sha256": "cd14f1cb4559e4723e63b7e7b06d09fcc3bd7ba58d03f354cdff1439bd936a7d",
+        "urls": [
+            "https://mirror.bazel.build/bazel_coverage_output_generator/releases/coverage_output_generator-v2.5.zip"
+        ]
+    },
+    "cython": {
+        "build_file": "@com_github_grpc_grpc//third_party:cython.BUILD",
+        "generator_function": "grpc_deps",
+        "generator_name": "cython",
+        "name": "cython",
+        "sha256": "e2e38e1f0572ca54d6085df3dec8b607d20e81515fb80215aed19c81e8fe2079",
+        "strip_prefix": "cython-0.29.21",
+        "urls": [
+            "https://github.com/cython/cython/archive/0.29.21.tar.gz"
+        ]
+    },
+    "desugar_jdk_libs": {
+        "generator_function": "dist_http_archive",
+        "generator_name": "desugar_jdk_libs",
+        "name": "desugar_jdk_libs",
+        "sha256": "299452e6f4a4981b2e6d22357f7332713382a63e4c137f5fd6b89579f6d610cb",
+        "strip_prefix": "desugar_jdk_libs-5847d6a06302136d95a14b4cbd4b55a9c9f1436e",
+        "urls": [
+            "https://mirror.bazel.build/github.com/google/desugar_jdk_libs/archive/5847d6a06302136d95a14b4cbd4b55a9c9f1436e.zip",
+            "https://github.com/google/desugar_jdk_libs/archive/5847d6a06302136d95a14b4cbd4b55a9c9f1436e.zip"
+        ]
+    },
+    "e982924acee7f7313b4baa4ee5ec000c5e373c30.tar.gz": {
+        "name": "e982924acee7f7313b4baa4ee5ec000c5e373c30.tar.gz",
+        "sha256": "e8c2751ddc70fed9dc6f999acd92e232d5846f009ee1674f8aee81f19b2b915a",
+        "urls": [
+            "https://mirror.bazel.build/github.com/c-ares/c-ares/archive/e982924acee7f7313b4baa4ee5ec000c5e373c30.tar.gz",
+            "https://github.com/c-ares/c-ares/archive/e982924acee7f7313b4baa4ee5ec000c5e373c30.tar.gz"
+        ]
+    },
+    "enum34": {
+        "build_file": "@com_github_grpc_grpc//third_party:enum34.BUILD",
+        "generator_function": "grpc_deps",
+        "generator_name": "enum34",
+        "name": "enum34",
+        "sha256": "8ad8c4783bf61ded74527bffb48ed9b54166685e4230386a9ed9b1279e2df5b1",
+        "strip_prefix": "enum34-1.1.6",
+        "urls": [
+            "https://files.pythonhosted.org/packages/bf/3e/31d502c25302814a7c2f1d3959d2a3b3f78e509002ba91aea64993936876/enum34-1.1.6.tar.gz"
+        ]
+    },
+    "envoy_api": {
+        "generator_function": "grpc_deps",
+        "generator_name": "envoy_api",
+        "name": "envoy_api",
+        "sha256": "330f2f9c938fc038b7ab438919b692d30cdfba3cf596e7824410f88da16c30b5",
+        "strip_prefix": "data-plane-api-2f0d081fab0b0823f088c6e368f40e1992f46fcd",
+        "urls": [
+            "https://storage.googleapis.com/grpc-bazel-mirror/github.com/envoyproxy/data-plane-api/archive/2f0d081fab0b0823f088c6e368f40e1992f46fcd.tar.gz",
+            "https://github.com/envoyproxy/data-plane-api/archive/2f0d081fab0b0823f088c6e368f40e1992f46fcd.tar.gz"
+        ]
+    },
+    "futures": {
+        "build_file": "@com_github_grpc_grpc//third_party:futures.BUILD",
+        "generator_function": "grpc_deps",
+        "generator_name": "futures",
+        "name": "futures",
+        "sha256": "7e033af76a5e35f58e56da7a91e687706faf4e7bdfb2cbc3f2cca6b9bcda9794",
+        "strip_prefix": "futures-3.3.0",
+        "urls": [
+            "https://files.pythonhosted.org/packages/47/04/5fc6c74ad114032cd2c544c575bffc17582295e9cd6a851d6026ab4b2c00/futures-3.3.0.tar.gz"
+        ]
+    },
+    "io_bazel_rules_go": {
+        "generator_function": "grpc_deps",
+        "generator_name": "io_bazel_rules_go",
+        "name": "io_bazel_rules_go",
+        "sha256": "dbf5a9ef855684f84cac2e7ae7886c5a001d4f66ae23f6904da0faaaef0d61fc",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/rules_go/releases/download/v0.24.11/rules_go-v0.24.11.tar.gz",
+            "https://github.com/bazelbuild/rules_go/releases/download/v0.24.11/rules_go-v0.24.11.tar.gz"
+        ]
+    },
+    "io_bazel_rules_python": {
+        "generator_function": "grpc_deps",
+        "generator_name": "io_bazel_rules_python",
+        "name": "io_bazel_rules_python",
+        "sha256": "aa96a691d3a8177f3215b14b0edc9641787abaaa30363a080165d06ab65e1161",
+        "url": "https://github.com/bazelbuild/rules_python/releases/download/0.0.1/rules_python-0.0.1.tar.gz"
+    },
+    "io_bazel_rules_sass": {
+        "generator_function": "dist_http_archive",
+        "generator_name": "io_bazel_rules_sass",
+        "name": "io_bazel_rules_sass",
+        "sha256": "c78be58f5e0a29a04686b628cf54faaee0094322ae0ac99da5a8a8afca59a647",
+        "strip_prefix": "rules_sass-1.25.0",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/rules_sass/archive/1.25.0.zip",
+            "https://github.com/bazelbuild/rules_sass/archive/1.25.0.zip"
+        ]
+    },
+    "io_bazel_skydoc": {
+        "generator_function": "dist_http_archive",
+        "generator_name": "io_bazel_skydoc",
+        "name": "io_bazel_skydoc",
+        "sha256": "5a725b777976b77aa122b707d1b6f0f39b6020f66cd427bb111a585599c857b1",
+        "strip_prefix": "stardoc-1ef781ced3b1443dca3ed05dec1989eca1a4e1cd",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/stardoc/archive/1ef781ced3b1443dca3ed05dec1989eca1a4e1cd.tar.gz",
+            "https://github.com/bazelbuild/stardoc/archive/1ef781ced3b1443dca3ed05dec1989eca1a4e1cd.tar.gz"
+        ]
+    },
+    "io_opencensus_cpp": {
+        "generator_function": "grpc_deps",
+        "generator_name": "io_opencensus_cpp",
+        "name": "io_opencensus_cpp",
+        "sha256": "90d6fafa8b1a2ea613bf662731d3086e1c2ed286f458a95c81744df2dbae41b1",
+        "strip_prefix": "opencensus-cpp-c9a4da319bc669a772928ffc55af4a61be1a1176",
+        "urls": [
+            "https://storage.googleapis.com/grpc-bazel-mirror/github.com/census-instrumentation/opencensus-cpp/archive/c9a4da319bc669a772928ffc55af4a61be1a1176.tar.gz",
+            "https://github.com/census-instrumentation/opencensus-cpp/archive/c9a4da319bc669a772928ffc55af4a61be1a1176.tar.gz"
+        ]
+    },
+    "java_tools-v11.6.zip": {
+        "name": "java_tools-v11.6.zip",
+        "sha256": "a7ac5922ee01e8b8fcb546ffc264ef314d0a0c679328b7fa4c432e5f54a86067",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/releases/java/v11.6/java_tools-v11.6.zip",
+            "https://github.com/bazelbuild/java_tools/releases/download/java_v11.6/java_tools-v11.6.zip"
+        ]
+    },
+    "java_tools_darwin-v11.6.zip": {
+        "name": "java_tools_darwin-v11.6.zip",
+        "sha256": "f17ee54582b61f1ebd84c8fa2c54df796914cfbaac3cb821fb1286b55b080bc0",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/releases/java/v11.6/java_tools_darwin-v11.6.zip",
+            "https://github.com/bazelbuild/java_tools/releases/download/java_v11.6/java_tools_darwin-v11.6.zip"
+        ]
+    },
+    "java_tools_langtools_javac11": {
+        "name": "java_tools_langtools_javac11",
+        "sha256": "cf0814fa002ef3d794582bb086516d8c9ed0958f83f19799cdb08949019fe4c7",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/jdk_langtools/langtools_jdk11_v2.zip"
+        ]
+    },
+    "java_tools_linux-v11.6.zip": {
+        "name": "java_tools_linux-v11.6.zip",
+        "sha256": "15da4f84a7d39cd179acf3035d9def638eea6ba89a0ed8f4e8a8e6e1d6c8e328",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/releases/java/v11.6/java_tools_linux-v11.6.zip",
+            "https://github.com/bazelbuild/java_tools/releases/download/java_v11.6/java_tools_linux-v11.6.zip"
+        ]
+    },
+    "java_tools_windows-v11.6.zip": {
+        "name": "java_tools_windows-v11.6.zip",
+        "sha256": "939f9d91f0df02851bbad8f5b1d26d24011329394cafe5668c1234e31ac2a1f7",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/releases/java/v11.6/java_tools_windows-v11.6.zip",
+            "https://github.com/bazelbuild/java_tools/releases/download/java_v11.6/java_tools_windows-v11.6.zip"
+        ]
+    },
+    "jekyll_tree_0_17_1": {
+        "name": "jekyll_tree_0_17_1",
+        "sha256": "02256ddd20eeaf70cf8fcfe9b2cdddd7be87aedd5848d549474fb0358e0031d3",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-0.17.1.tar"
+        ]
+    },
+    "jekyll_tree_0_17_2": {
+        "name": "jekyll_tree_0_17_2",
+        "sha256": "13b35dd309a0d52f0a2518a1193f42729c75255f5fae40cea68e4d4224bfaa2e",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-0.17.2.tar"
+        ]
+    },
+    "jekyll_tree_0_18_1": {
+        "name": "jekyll_tree_0_18_1",
+        "sha256": "98b77f48e37a50fc6f83100bf53f661e10732bb3ddbc226e02d0225cb7a9a7d8",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-0.18.1.tar"
+        ]
+    },
+    "jekyll_tree_0_19_1": {
+        "name": "jekyll_tree_0_19_1",
+        "sha256": "ec892c59ba18bb8de1f9ae2bde937db144e45f28d6d1c32a2cee847ee81b134d",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-0.19.1.tar"
+        ]
+    },
+    "jekyll_tree_0_19_2": {
+        "name": "jekyll_tree_0_19_2",
+        "sha256": "3c2d9f21ec2fd1c0b8a310f6eb6043027c838810cdfc2457d4346a0e5cdcaa7a",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-0.19.2.tar"
+        ]
+    },
+    "jekyll_tree_0_20_0": {
+        "name": "jekyll_tree_0_20_0",
+        "sha256": "bb79a63810bf1b0aa1f89bd3bbbeb4a547a30ab9af70c9be656cc6866f4b015b",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-0.20.0.tar"
+        ]
+    },
+    "jekyll_tree_0_21_0": {
+        "name": "jekyll_tree_0_21_0",
+        "sha256": "23ec39c0138d358c544151e5c81586716d5d1c6124f10a742bead70516e6eb93",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-0.21.0.tar"
+        ]
+    },
+    "jekyll_tree_0_22_0": {
+        "name": "jekyll_tree_0_22_0",
+        "sha256": "bec5cfaa5560e082e41e33bde276cf93f0f7bcfd2914a3e868f921df8b3ab725",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-0.22.0.tar"
+        ]
+    },
+    "jekyll_tree_0_23_0": {
+        "name": "jekyll_tree_0_23_0",
+        "sha256": "56c80fcf49dc606fab8ed5e737a7409e9a486585b7b98673be69b5a4984dd774",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-0.23.0.tar"
+        ]
+    },
+    "jekyll_tree_0_24_0": {
+        "name": "jekyll_tree_0_24_0",
+        "sha256": "988fa567906a73e50d3669909285187ef88c76ecd4aa277f4d1f355fc06a90c8",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-0.24.0.tar"
+        ]
+    },
+    "jekyll_tree_0_25_0": {
+        "name": "jekyll_tree_0_25_0",
+        "sha256": "e8ab61c047225e808982a564ecd692fd63bd243dccc88a8768ed069a5362a685",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-0.25.0.tar"
+        ]
+    },
+    "jekyll_tree_0_26_0": {
+        "name": "jekyll_tree_0_26_0",
+        "sha256": "3907dfc6fb27d246e67877e553e8951fac239bb49f2dec7e06b6b09cb0b98b8d",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-0.26.0.tar"
+        ]
+    },
+    "jekyll_tree_0_27_0": {
+        "name": "jekyll_tree_0_27_0",
+        "sha256": "97e2633fefee389daade775da43907aa68699b32212f4e48cb095abe18aa7e65",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-0.27.0.tar"
+        ]
+    },
+    "jekyll_tree_0_28_0": {
+        "name": "jekyll_tree_0_28_0",
+        "sha256": "64b3fc267fb1f4c56345d96f0ad9f07a2efe43bd15361f818368849cf941b3b7",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-0.28.0.tar"
+        ]
+    },
+    "jekyll_tree_0_29_0": {
+        "name": "jekyll_tree_0_29_0",
+        "sha256": "99d7a6bf9ef0145c59c54b4319fb31cb855681782080a5490909c4a5463c7215",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-0.29.0.tar"
+        ]
+    },
+    "jekyll_tree_0_29_1": {
+        "name": "jekyll_tree_0_29_1",
+        "sha256": "cf0a517f1660a7c4fd26a7ef6f3594bbefcf2b670bc0ed610bf3bb6ec3a9fdc3",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-0.29.1.tar"
+        ]
+    },
+    "jekyll_tree_1_0_0": {
+        "name": "jekyll_tree_1_0_0",
+        "sha256": "61ef65c738a8cd65059f58f2ee5f7eef493136ac4d5e5c3464787d17043febdf",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-1.0.0.tar"
+        ]
+    },
+    "jekyll_tree_1_1_0": {
+        "name": "jekyll_tree_1_1_0",
+        "sha256": "46d82c9249896903ee6be2295fc52a1346a9ee82f61f89b8a2181232c3bd999b",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-1.1.0.tar"
+        ]
+    },
+    "jekyll_tree_1_2_0": {
+        "name": "jekyll_tree_1_2_0",
+        "sha256": "d402a8391ca2624673f124ff42ba8d0d40d4139e5d23111f3995dc6c5f70f63d",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-1.2.0.tar"
+        ]
+    },
+    "jekyll_tree_2_0_0": {
+        "name": "jekyll_tree_2_0_0",
+        "sha256": "7d7c424ede503856c61b645d8fdc2513ec6ea8600d76c5e87c45a9a45c16de3e",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-2.0.0.tar"
+        ]
+    },
+    "jekyll_tree_2_1_0": {
+        "name": "jekyll_tree_2_1_0",
+        "sha256": "b0fd257b1d6b1b05705742d55a13b9a20d3e99f49c89334750c872d620e5b88f",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-2.1.0.tar"
+        ]
+    },
+    "jekyll_tree_2_2_0": {
+        "name": "jekyll_tree_2_2_0",
+        "sha256": "4c1506786ab98df8039ec7354b82da7b586b2ae4ab7f7e7d08f3caf74ff28e3d",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-2.2.0.tar"
+        ]
+    },
+    "jekyll_tree_3_0_0": {
+        "name": "jekyll_tree_3_0_0",
+        "sha256": "bd1096ad609c253fa7b1473edf4a3aa51f36243e188dbb62c68d8ed4aca2419d",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-3.0.0.tar"
+        ]
+    },
+    "jekyll_tree_3_1_0": {
+        "name": "jekyll_tree_3_1_0",
+        "sha256": "f9d2e22e24af426d6c9de163d91abe6d8af7eb1eabb1d7ff5e9cf4bededf465a",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-3.1.0-807b377.tar"
+        ]
+    },
+    "jekyll_tree_3_2_0": {
+        "name": "jekyll_tree_3_2_0",
+        "sha256": "6cff8654e739a0c3062183a5a6cc82fcf9a77323051f8c007866d7f4101052a6",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-3.2.0.tar"
+        ]
+    },
+    "jekyll_tree_3_3_0": {
+        "name": "jekyll_tree_3_3_0",
+        "sha256": "36b81e8ddf4f3caccf41acc82d9e49f000c1be9e92c9cc82793d60ff70636176",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-3.3.0.tar"
+        ]
+    },
+    "jekyll_tree_3_4_0": {
+        "name": "jekyll_tree_3_4_0",
+        "sha256": "af82e775d911135bcff76e500bb003c4a9fccb949f8ddf4d93c58eca195bf5e8",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-3.4.0.tar"
+        ]
+    },
+    "jekyll_tree_3_5_0": {
+        "name": "jekyll_tree_3_5_0",
+        "sha256": "aa96cbad14cfab0b422d1d17eac3107a75eb05854d40ab4f1379a6fc87b2e1f8",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-3.5.0.tar"
+        ]
+    },
+    "jekyll_tree_3_5_1": {
+        "name": "jekyll_tree_3_5_1",
+        "sha256": "1c949ba8da353c93c74a70638e5cb321ea1cd5582eda1b6ad88c6d2d0b569f2f",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-3.5.1.tar"
+        ]
+    },
+    "jekyll_tree_3_6_0": {
+        "name": "jekyll_tree_3_6_0",
+        "sha256": "1b7a16a2098ca0c290c208a11db886e950d6c523b2cac2d0a0cba4a04aa832f3",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-3.6.0.tar"
+        ]
+    },
+    "jekyll_tree_3_7_0": {
+        "name": "jekyll_tree_3_7_0",
+        "sha256": "a534d37ef3867c92fae8692852f92820a34f63a5f9092bbbec6505c0f69d8094",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-3.7.0.tar"
+        ]
+    },
+    "jekyll_tree_4_0_0": {
+        "name": "jekyll_tree_4_0_0",
+        "sha256": "9d8e350a17b85624d8d78291d440e05f6ba8af493c1ccb846d0493579dade1b6",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-4.0.0.tar"
+        ]
+    },
+    "jekyll_tree_4_1_0": {
+        "name": "jekyll_tree_4_1_0",
+        "sha256": "9ed45a322906029d161f5514371841fbec214c63b9517fccb225c8670ebb482a",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-4.1.0.tar"
+        ]
+    },
+    "jekyll_tree_4_2_0": {
+        "name": "jekyll_tree_4_2_0",
+        "sha256": "1188fc6c3354f85741bacbb2bc7dab6bbfd1d2f44475846293ff232fb01709b8",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-4.2.0.tar"
+        ]
+    },
+    "jekyll_tree_4_2_1": {
+        "name": "jekyll_tree_4_2_1",
+        "sha256": "b767b7aa949f96b602257587add3be38acbead03bf919fe871397bc80d97f8b2",
+        "urls": [
+            "https://mirror.bazel.build/bazel_versioned_docs/jekyll-tree-4.2.1.tar"
+        ]
+    },
+    "opencensus_proto": {
+        "generator_function": "grpc_deps",
+        "generator_name": "opencensus_proto",
+        "name": "opencensus_proto",
+        "sha256": "b7e13f0b4259e80c3070b583c2f39e53153085a6918718b1c710caf7037572b0",
+        "strip_prefix": "opencensus-proto-0.3.0/src",
+        "urls": [
+            "https://storage.googleapis.com/grpc-bazel-mirror/github.com/census-instrumentation/opencensus-proto/archive/v0.3.0.tar.gz",
+            "https://github.com/census-instrumentation/opencensus-proto/archive/v0.3.0.tar.gz"
+        ]
+    },
+    "openjdk11_darwin_aarch64_archive": {
+        "build_file_content": "\njava_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])\nexports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])\n",
+        "name": "openjdk11_darwin_aarch64_archive",
+        "sha256": "e908a0b4c0da08d41c3e19230f819b364ff2e5f1dafd62d2cf991a85a34d3a17",
+        "strip_prefix": "zulu11.50.19-ca-jdk11.0.12-macosx_aarch64",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.50.19-ca-jdk11.0.12/zulu11.50.19-ca-jdk11.0.12-macosx_aarch64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu11.50.19-ca-jdk11.0.12-macosx_aarch64.tar.gz"
+        ]
+    },
+    "openjdk11_darwin_archive": {
+        "build_file_content": "\njava_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])\nexports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])\n",
+        "name": "openjdk11_darwin_archive",
+        "sha256": "0b8c8b7cf89c7c55b7e2239b47201d704e8d2170884875b00f3103cf0662d6d7",
+        "strip_prefix": "zulu11.50.19-ca-jdk11.0.12-macosx_x64",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.50.19-ca-jdk11.0.12/zulu11.50.19-ca-jdk11.0.12-macosx_x64.tar.gz"
+        ]
+    },
+    "openjdk11_linux_archive": {
+        "build_file_content": "\njava_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])\nexports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])\n",
+        "name": "openjdk11_linux_archive",
+        "sha256": "b8e8a63b79bc312aa90f3558edbea59e71495ef1a9c340e38900dd28a1c579f3",
+        "strip_prefix": "zulu11.50.19-ca-jdk11.0.12-linux_x64",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.50.19-ca-jdk11.0.12/zulu11.50.19-ca-jdk11.0.12-linux_x64.tar.gz"
+        ]
+    },
+    "openjdk11_windows_archive": {
+        "build_file_content": "\njava_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])\nexports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])\n",
+        "name": "openjdk11_windows_archive",
+        "sha256": "42ae65e75d615a3f06a674978e1fa85fdf078cad94e553fee3e779b2b42bb015",
+        "strip_prefix": "zulu11.50.19-ca-jdk11.0.12-win_x64",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.50.19-ca-jdk11.0.12/zulu11.50.19-ca-jdk11.0.12-win_x64.zip"
+        ]
+    },
+    "openjdk15_darwin_aarch64_archive": {
+        "build_file_content": "\njava_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])\nexports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])\n",
+        "name": "openjdk15_darwin_aarch64_archive",
+        "sha256": "2613c3f15eef6b6ecd0fd102da92282b985e4573905dc902f1783d8059c1efc5",
+        "strip_prefix": "zulu15.29.15-ca-jdk15.0.2-macosx_aarch64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu15.29.15-ca-jdk15.0.2-macosx_aarch64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu15.29.15-ca-jdk15.0.2-macosx_aarch64.tar.gz"
+        ]
+    },
+    "openjdk15_darwin_archive": {
+        "build_file_content": "\njava_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])\nexports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])\n",
+        "name": "openjdk15_darwin_archive",
+        "sha256": "f80b2e0512d9d8a92be24497334c974bfecc8c898fc215ce0e76594f00437482",
+        "strip_prefix": "zulu15.27.17-ca-jdk15.0.0-macosx_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu15.27.17-ca-jdk15.0.0-macosx_x64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu15.27.17-ca-jdk15.0.0-macosx_x64.tar.gz"
+        ]
+    },
+    "openjdk15_linux_archive": {
+        "build_file_content": "\njava_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])\nexports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])\n",
+        "name": "openjdk15_linux_archive",
+        "sha256": "0a38f1138c15a4f243b75eb82f8ef40855afcc402e3c2a6de97ce8235011b1ad",
+        "strip_prefix": "zulu15.27.17-ca-jdk15.0.0-linux_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu15.27.17-ca-jdk15.0.0-linux_x64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu15.27.17-ca-jdk15.0.0-linux_x64.tar.gz"
+        ]
+    },
+    "openjdk15_windows_archive": {
+        "build_file_content": "\njava_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])\nexports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])\n",
+        "name": "openjdk15_windows_archive",
+        "sha256": "f535a530151e6c20de8a3078057e332b08887cb3ba1a4735717357e72765cad6",
+        "strip_prefix": "zulu15.27.17-ca-jdk15.0.0-win_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu15.27.17-ca-jdk15.0.0-win_x64.zip",
+            "https://cdn.azul.com/zulu/bin/zulu15.27.17-ca-jdk15.0.0-win_x64.zip"
+        ]
+    },
+    "openjdk16_darwin_aarch64_archive": {
+        "build_file_content": "\njava_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])\nexports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])\n",
+        "name": "openjdk16_darwin_aarch64_archive",
+        "sha256": "c92131e83bc71474850e667bc4e05fca33662b8feb009a0547aa14e76b40e890",
+        "strip_prefix": "zulu16.28.11-ca-jdk16.0.0-macosx_aarch64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu16.28.11-ca-jdk16.0.0-macosx_aarch64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu16.28.11-ca-jdk16.0.0-macosx_aarch64.tar.gz"
+        ]
+    },
+    "openjdk16_darwin_archive": {
+        "build_file_content": "\njava_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])\nexports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])\n",
+        "name": "openjdk16_darwin_archive",
+        "sha256": "6d47ef22dc56ce1f5a102ed39e21d9a97320f0bb786818e2c686393109d79bc5",
+        "strip_prefix": "zulu16.28.11-ca-jdk16.0.0-macosx_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu16.28.11-ca-jdk16.0.0-macosx_x64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu16.28.11-ca-jdk16.0.0-macosx_x64.tar.gz"
+        ]
+    },
+    "openjdk16_linux_archive": {
+        "build_file_content": "\njava_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])\nexports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])\n",
+        "name": "openjdk16_linux_archive",
+        "sha256": "236b5ea97aff3cb312e743848d7efa77faf305170e41371a732ca93c1b797665",
+        "strip_prefix": "zulu16.28.11-ca-jdk16.0.0-linux_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu16.28.11-ca-jdk16.0.0-linux_x64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu16.28.11-ca-jdk16.0.0-linux_x64.tar.gz"
+        ]
+    },
+    "openjdk16_windows_archive": {
+        "build_file_content": "\njava_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])\nexports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])\n",
+        "name": "openjdk16_windows_archive",
+        "sha256": "6cbf98ada27476526a5f6dff79fd5f2c15e2f671818e503bdf741eb6c8fed3d4",
+        "strip_prefix": "zulu16.28.11-ca-jdk16.0.0-win_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu16.28.11-ca-jdk16.0.0-win_x64.zip",
+            "https://cdn.azul.com/zulu/bin/zulu16.28.11-ca-jdk16.0.0-win_x64.zip"
+        ]
+    },
+    "openjdk17_darwin_aarch64_archive": {
+        "build_file_content": "\njava_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])\nexports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])\n",
+        "name": "openjdk17_darwin_aarch64_archive",
+        "sha256": "6b17f01f767ee7abf4704149ca4d86423aab9b16b68697b7d36e9b616846a8b0",
+        "strip_prefix": "zulu17.28.13-ca-jdk17.0.0-macosx_aarch64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.28.13-ca-jdk17.0.0-macosx_aarch64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu17.28.13-ca-jdk17.0.0-macosx_aarch64.tar.gz"
+        ]
+    },
+    "openjdk17_darwin_archive": {
+        "build_file_content": "\njava_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])\nexports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])\n",
+        "name": "openjdk17_darwin_archive",
+        "sha256": "6029b1fe6853cecad22ab99ac0b3bb4fb8c903dd2edefa91c3abc89755bbd47d",
+        "strip_prefix": "zulu17.28.13-ca-jdk17.0.0-macosx_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.28.13-ca-jdk17.0.0-macosx_x64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu17.28.13-ca-jdk17.0.0-macosx_x64.tar.gz"
+        ]
+    },
+    "openjdk17_linux_archive": {
+        "build_file_content": "\njava_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])\nexports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])\n",
+        "name": "openjdk17_linux_archive",
+        "sha256": "37c4f8e48536cceae8c6c20250d6c385e176972532fd35759fa7d6015c965f56",
+        "strip_prefix": "zulu17.28.13-ca-jdk17.0.0-linux_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.28.13-ca-jdk17.0.0-linux_x64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu17.28.13-ca-jdk17.0.0-linux_x64.tar.gz"
+        ]
+    },
+    "openjdk17_windows_archive": {
+        "build_file_content": "\njava_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])\nexports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])\n",
+        "name": "openjdk17_windows_archive",
+        "sha256": "f4437011239f3f0031c794bb91c02a6350bc941d4196bdd19c9f157b491815a3",
+        "strip_prefix": "zulu17.28.13-ca-jdk17.0.0-win_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.28.13-ca-jdk17.0.0-win_x64.zip",
+            "https://cdn.azul.com/zulu/bin/zulu17.28.13-ca-jdk17.0.0-win_x64.zip"
+        ]
+    },
+    "openjdk_linux": {
+        "downloaded_file_path": "zulu-linux.tar.gz",
+        "name": "openjdk_linux",
+        "sha256": "65bfe4e0ffa74a680ee4410db46b17e30cd9397b664a92a886599fe1f3530969",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.37.17-ca-jdk11.0.6/zulu11.37.17-ca-jdk11.0.6-linux_x64-linux_x64-allmodules-b23d4e05466f2aa1fdcd72d3d3a8e962206b64bf-1581689070.tar.gz"
+        ]
+    },
+    "openjdk_linux_aarch64": {
+        "downloaded_file_path": "zulu-linux-aarch64.tar.gz",
+        "name": "openjdk_linux_aarch64",
+        "sha256": "6b245793087300db3ee82ab0d165614f193a73a60f2f011e347756c1e6ca5bac",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.37.48-ca-jdk11.0.6/zulu11.37.48-ca-jdk11.0.6-linux_aarch64-allmodules-b23d4e05466f2aa1fdcd72d3d3a8e962206b64bf-1581690750.tar.gz"
+        ]
+    },
+    "openjdk_linux_aarch64_minimal": {
+        "downloaded_file_path": "zulu-linux-aarch64-minimal.tar.gz",
+        "name": "openjdk_linux_aarch64_minimal",
+        "sha256": "06f6520a877704c77614bcfc4f846cc7cbcbf5eaad149bf7f19f4f16e285c9de",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.37.48-ca-jdk11.0.6/zulu11.37.48-ca-jdk11.0.6-linux_aarch64-minimal-b23d4e05466f2aa1fdcd72d3d3a8e962206b64bf-1581690750.tar.gz"
+        ]
+    },
+    "openjdk_linux_aarch64_vanilla": {
+        "downloaded_file_path": "zulu-linux-aarch64-vanilla.tar.gz",
+        "name": "openjdk_linux_aarch64_vanilla",
+        "sha256": "a452f1b9682d9f83c1c14e54d1446e1c51b5173a3a05dcb013d380f9508562e4",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.37.48-ca-jdk11.0.6/zulu11.37.48-ca-jdk11.0.6-linux_aarch64.tar.gz"
+        ]
+    },
+    "openjdk_linux_minimal": {
+        "downloaded_file_path": "zulu-linux-minimal.tar.gz",
+        "name": "openjdk_linux_minimal",
+        "sha256": "91f7d52f695c681d4e21499b4319d548aadef249a6b3053e306308992e1e29ae",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.37.17-ca-jdk11.0.6/zulu11.37.17-ca-jdk11.0.6-linux_x64-minimal-b23d4e05466f2aa1fdcd72d3d3a8e962206b64bf-1581689068.tar.gz"
+        ]
+    },
+    "openjdk_linux_ppc64le_vanilla": {
+        "downloaded_file_path": "adoptopenjdk-ppc64le-vanilla.tar.gz",
+        "name": "openjdk_linux_ppc64le_vanilla",
+        "sha256": "a417db0295b1f4b538ecbaf7c774f3a177fab9657a665940170936c0eca4e71a",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7+10/OpenJDK11U-jdk_ppc64le_linux_hotspot_11.0.7_10.tar.gz",
+            "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7+10/OpenJDK11U-jdk_ppc64le_linux_hotspot_11.0.7_10.tar.gz"
+        ]
+    },
+    "openjdk_linux_s390x_vanilla": {
+        "downloaded_file_path": "adoptopenjdk-s390x-vanilla.tar.gz",
+        "name": "openjdk_linux_s390x_vanilla",
+        "sha256": "d9b72e87a1d3ebc0c9552f72ae5eb150fffc0298a7cb841f1ce7bfc70dcd1059",
+        "urls": [
+            "https://mirror.bazel.build/github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7+10/OpenJDK11U-jdk_s390x_linux_hotspot_11.0.7_10.tar.gz",
+            "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7+10/OpenJDK11U-jdk_s390x_linux_hotspot_11.0.7_10.tar.gz"
+        ]
+    },
+    "openjdk_linux_vanilla": {
+        "downloaded_file_path": "zulu-linux-vanilla.tar.gz",
+        "name": "openjdk_linux_vanilla",
+        "sha256": "360626cc19063bc411bfed2914301b908a8f77a7919aaea007a977fa8fb3cde1",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.37.17-ca-jdk11.0.6/zulu11.37.17-ca-jdk11.0.6-linux_x64.tar.gz"
+        ]
+    },
+    "openjdk_macos_aarch64": {
+        "downloaded_file_path": "zulu-macos-aarch64.tar.gz",
+        "name": "openjdk_macos_aarch64",
+        "sha256": "a900ef793cb34b03ac5d93ea2f67291b6842e99d500934e19393a8d8f9bfa6ff",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.45.27-ca-jdk11.0.10/zulu11.45.27-ca-jdk11.0.10-macosx_aarch64-allmodules-1611665569.tar.gz"
+        ]
+    },
+    "openjdk_macos_aarch64_minimal": {
+        "downloaded_file_path": "zulu-macos-aarch64-minimal.tar.gz",
+        "name": "openjdk_macos_aarch64_minimal",
+        "sha256": "f4f606926e6deeaa8b8397e299313d9df87642fe464b0ccf1ed0432aeb00640b",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.45.27-ca-jdk11.0.10/zulu11.45.27-ca-jdk11.0.10-macosx_aarch64-minimal-1611665562.tar.gz"
+        ]
+    },
+    "openjdk_macos_aarch64_vanilla": {
+        "downloaded_file_path": "zulu-macos-aarch64-vanilla.tar.gz",
+        "name": "openjdk_macos_aarch64_vanilla",
+        "sha256": "3dcc636e64ae58b922269c2dc9f20f6f967bee90e3f6847d643c4a566f1e8d8a",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu11.45.27-ca-jdk11.0.10-macosx_aarch64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu11.45.27-ca-jdk11.0.10-macosx_aarch64.tar.gz"
+        ]
+    },
+    "openjdk_macos_x86_64": {
+        "downloaded_file_path": "zulu-macos.tar.gz",
+        "name": "openjdk_macos_x86_64",
+        "sha256": "8e283cfd23c7555be8e17295ed76eb8f00324c88ab904b8de37bbe08f90e569b",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.37.17-ca-jdk11.0.6/zulu11.37.17-ca-jdk11.0.6-macosx_x64-allmodules-b23d4e05466f2aa1fdcd72d3d3a8e962206b64bf-1581689066.tar.gz"
+        ]
+    },
+    "openjdk_macos_x86_64_minimal": {
+        "downloaded_file_path": "zulu-macos-minimal.tar.gz",
+        "name": "openjdk_macos_x86_64_minimal",
+        "sha256": "1bacb1c07035d4066d79f0b65b4ea0ebd1954f3662bdfe3618da382ac8fd23a6",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.37.17-ca-jdk11.0.6/zulu11.37.17-ca-jdk11.0.6-macosx_x64-minimal-b23d4e05466f2aa1fdcd72d3d3a8e962206b64bf-1581689063.tar.gz"
+        ]
+    },
+    "openjdk_macos_x86_64_vanilla": {
+        "downloaded_file_path": "zulu-macos-vanilla.tar.gz",
+        "name": "openjdk_macos_x86_64_vanilla",
+        "sha256": "e1fe56769f32e2aaac95e0a8f86b5a323da5af3a3b4bba73f3086391a6cc056f",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.37.17-ca-jdk11.0.6/zulu11.37.17-ca-jdk11.0.6-macosx_x64.tar.gz"
+        ]
+    },
+    "openjdk_win": {
+        "downloaded_file_path": "zulu-win.zip",
+        "name": "openjdk_win",
+        "sha256": "8e1604b3a27dcf639bc6d1a73103f1211848139e4cceb081d0a74a99e1e6f995",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.37.17-ca-jdk11.0.6/zulu11.37.17-ca-jdk11.0.6-win_x64-allmodules-b23d4e05466f2aa1fdcd72d3d3a8e962206b64bf-1581689080.zip"
+        ]
+    },
+    "openjdk_win_minimal": {
+        "downloaded_file_path": "zulu-win-minimal.zip",
+        "name": "openjdk_win_minimal",
+        "sha256": "b90a713c9c2d9ea23cad44d2c2dfcc9af22faba9bde55dedc1c3bb9f556ac1ae",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.37.17-ca-jdk11.0.6/zulu11.37.17-ca-jdk11.0.6-win_x64-minimal-b23d4e05466f2aa1fdcd72d3d3a8e962206b64bf-1581689080.zip"
+        ]
+    },
+    "openjdk_win_vanilla": {
+        "downloaded_file_path": "zulu-win-vanilla.zip",
+        "name": "openjdk_win_vanilla",
+        "sha256": "a9695617b8374bfa171f166951214965b1d1d08f43218db9a2a780b71c665c18",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.37.17-ca-jdk11.0.6/zulu11.37.17-ca-jdk11.0.6-win_x64.zip"
+        ]
+    },
+    "org_snakeyaml": {
+        "build_file_content": "\njava_library(\n    name = \"snakeyaml\",\n    testonly = True,\n    srcs = glob([\"src/main/**/*.java\"]),\n    visibility = [\"@com_google_testparameterinjector//:__pkg__\"],\n)\n",
+        "name": "org_snakeyaml",
+        "sha256": "fd0e0cc6c5974fc8f08be3a15fb4a59954c7dd958b5b68186a803de6420b6e40",
+        "strip_prefix": "asomov-snakeyaml-b28f0b4d87c6",
+        "urls": [
+            "https://mirror.bazel.build/bitbucket.org/asomov/snakeyaml/get/snakeyaml-1.28.tar.gz"
+        ]
+    },
+    "platforms": {
+        "generator_function": "dist_http_archive",
+        "generator_name": "platforms",
+        "name": "platforms",
+        "sha256": "079945598e4b6cc075846f7fd6a9d0857c33a7afc0de868c2ccb96405225135d",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/platforms/releases/download/0.0.4/platforms-0.0.4.tar.gz",
+            "https://github.com/bazelbuild/platforms/releases/download/0.0.4/platforms-0.0.4.tar.gz"
+        ]
+    },
+    "platforms-0.0.4.tar.gz": {
+        "name": "platforms-0.0.4.tar.gz",
+        "sha256": "079945598e4b6cc075846f7fd6a9d0857c33a7afc0de868c2ccb96405225135d",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/platforms/releases/download/0.0.4/platforms-0.0.4.tar.gz",
+            "https://github.com/bazelbuild/platforms/releases/download/0.0.4/platforms-0.0.4.tar.gz"
+        ]
+    },
+    "remote_coverage_tools": {
+        "name": "remote_coverage_tools",
+        "sha256": "cd14f1cb4559e4723e63b7e7b06d09fcc3bd7ba58d03f354cdff1439bd936a7d",
+        "urls": [
+            "https://mirror.bazel.build/bazel_coverage_output_generator/releases/coverage_output_generator-v2.5.zip"
+        ]
+    },
+    "remote_java_tools_darwin": {
+        "generator_function": "maybe",
+        "generator_name": "remote_java_tools_darwin",
+        "name": "remote_java_tools_darwin",
+        "sha256": "d15b05d2061382748f779dc566537ea567a46bcba6fa34b56d7cb6e6d668adab",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/releases/javac11/v10.6/java_tools_javac11_darwin-v10.6.zip",
+            "https://github.com/bazelbuild/java_tools/releases/download/javac11_v10.6/java_tools_javac11_darwin-v10.6.zip"
+        ]
+    },
+    "remote_java_tools_darwin_for_testing": {
+        "generator_function": "dist_http_archive",
+        "generator_name": "remote_java_tools_darwin_for_testing",
+        "name": "remote_java_tools_darwin_for_testing",
+        "patch_cmds": [
+            "test -f BUILD && chmod u+w BUILD || true",
+            "echo >> BUILD",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "f17ee54582b61f1ebd84c8fa2c54df796914cfbaac3cb821fb1286b55b080bc0",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/releases/java/v11.6/java_tools_darwin-v11.6.zip",
+            "https://github.com/bazelbuild/java_tools/releases/download/java_v11.6/java_tools_darwin-v11.6.zip"
+        ]
+    },
+    "remote_java_tools_for_testing": {
+        "generator_function": "dist_http_archive",
+        "generator_name": "remote_java_tools_for_testing",
+        "name": "remote_java_tools_for_testing",
+        "patch_cmds": [
+            "test -f BUILD && chmod u+w BUILD || true",
+            "echo >> BUILD",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "a7ac5922ee01e8b8fcb546ffc264ef314d0a0c679328b7fa4c432e5f54a86067",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/releases/java/v11.6/java_tools-v11.6.zip",
+            "https://github.com/bazelbuild/java_tools/releases/download/java_v11.6/java_tools-v11.6.zip"
+        ]
+    },
+    "remote_java_tools_linux": {
+        "generator_function": "maybe",
+        "generator_name": "remote_java_tools_linux",
+        "name": "remote_java_tools_linux",
+        "sha256": "085c0ba53ba764e81d4c195524f3c596085cbf9cdc01dd8e6d2ae677e726af35",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/releases/javac11/v10.6/java_tools_javac11_linux-v10.6.zip",
+            "https://github.com/bazelbuild/java_tools/releases/download/javac11_v10.6/java_tools_javac11_linux-v10.6.zip"
+        ]
+    },
+    "remote_java_tools_linux_for_testing": {
+        "generator_function": "dist_http_archive",
+        "generator_name": "remote_java_tools_linux_for_testing",
+        "name": "remote_java_tools_linux_for_testing",
+        "patch_cmds": [
+            "test -f BUILD && chmod u+w BUILD || true",
+            "echo >> BUILD",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "15da4f84a7d39cd179acf3035d9def638eea6ba89a0ed8f4e8a8e6e1d6c8e328",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/releases/java/v11.6/java_tools_linux-v11.6.zip",
+            "https://github.com/bazelbuild/java_tools/releases/download/java_v11.6/java_tools_linux-v11.6.zip"
+        ]
+    },
+    "remote_java_tools_test": {
+        "generator_function": "dist_http_archive",
+        "generator_name": "remote_java_tools_test",
+        "name": "remote_java_tools_test",
+        "patch_cmds": [
+            "test -f BUILD && chmod u+w BUILD || true",
+            "echo >> BUILD",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "a7ac5922ee01e8b8fcb546ffc264ef314d0a0c679328b7fa4c432e5f54a86067",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/releases/java/v11.6/java_tools-v11.6.zip",
+            "https://github.com/bazelbuild/java_tools/releases/download/java_v11.6/java_tools-v11.6.zip"
+        ]
+    },
+    "remote_java_tools_test_darwin": {
+        "generator_function": "dist_http_archive",
+        "generator_name": "remote_java_tools_test_darwin",
+        "name": "remote_java_tools_test_darwin",
+        "patch_cmds": [
+            "test -f BUILD && chmod u+w BUILD || true",
+            "echo >> BUILD",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "f17ee54582b61f1ebd84c8fa2c54df796914cfbaac3cb821fb1286b55b080bc0",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/releases/java/v11.6/java_tools_darwin-v11.6.zip",
+            "https://github.com/bazelbuild/java_tools/releases/download/java_v11.6/java_tools_darwin-v11.6.zip"
+        ]
+    },
+    "remote_java_tools_test_linux": {
+        "generator_function": "dist_http_archive",
+        "generator_name": "remote_java_tools_test_linux",
+        "name": "remote_java_tools_test_linux",
+        "patch_cmds": [
+            "test -f BUILD && chmod u+w BUILD || true",
+            "echo >> BUILD",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "15da4f84a7d39cd179acf3035d9def638eea6ba89a0ed8f4e8a8e6e1d6c8e328",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/releases/java/v11.6/java_tools_linux-v11.6.zip",
+            "https://github.com/bazelbuild/java_tools/releases/download/java_v11.6/java_tools_linux-v11.6.zip"
+        ]
+    },
+    "remote_java_tools_test_windows": {
+        "generator_function": "dist_http_archive",
+        "generator_name": "remote_java_tools_test_windows",
+        "name": "remote_java_tools_test_windows",
+        "patch_cmds": [
+            "test -f BUILD && chmod u+w BUILD || true",
+            "echo >> BUILD",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "939f9d91f0df02851bbad8f5b1d26d24011329394cafe5668c1234e31ac2a1f7",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/releases/java/v11.6/java_tools_windows-v11.6.zip",
+            "https://github.com/bazelbuild/java_tools/releases/download/java_v11.6/java_tools_windows-v11.6.zip"
+        ]
+    },
+    "remote_java_tools_windows": {
+        "generator_function": "maybe",
+        "generator_name": "remote_java_tools_windows",
+        "name": "remote_java_tools_windows",
+        "sha256": "873f1e53d1fa9c8e46b717673816cd822bb7acc474a194a18ff849fd8fa6ff00",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/releases/javac11/v10.6/java_tools_javac11_windows-v10.6.zip",
+            "https://github.com/bazelbuild/java_tools/releases/download/javac11_v10.6/java_tools_javac11_windows-v10.6.zip"
+        ]
+    },
+    "remote_java_tools_windows_for_testing": {
+        "generator_function": "dist_http_archive",
+        "generator_name": "remote_java_tools_windows_for_testing",
+        "name": "remote_java_tools_windows_for_testing",
+        "patch_cmds": [
+            "test -f BUILD && chmod u+w BUILD || true",
+            "echo >> BUILD",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "939f9d91f0df02851bbad8f5b1d26d24011329394cafe5668c1234e31ac2a1f7",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/releases/java/v11.6/java_tools_windows-v11.6.zip",
+            "https://github.com/bazelbuild/java_tools/releases/download/java_v11.6/java_tools_windows-v11.6.zip"
+        ]
+    },
+    "remotejdk11_linux": {
+        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
+        "generator_function": "maybe",
+        "generator_name": "remotejdk11_linux",
+        "name": "remotejdk11_linux",
+        "sha256": "360626cc19063bc411bfed2914301b908a8f77a7919aaea007a977fa8fb3cde1",
+        "strip_prefix": "zulu11.37.17-ca-jdk11.0.6-linux_x64",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.37.17-ca-jdk11.0.6/zulu11.37.17-ca-jdk11.0.6-linux_x64.tar.gz"
+        ]
+    },
+    "remotejdk11_linux_aarch64": {
+        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
+        "generator_function": "maybe",
+        "generator_name": "remotejdk11_linux_aarch64",
+        "name": "remotejdk11_linux_aarch64",
+        "sha256": "a452f1b9682d9f83c1c14e54d1446e1c51b5173a3a05dcb013d380f9508562e4",
+        "strip_prefix": "zulu11.37.48-ca-jdk11.0.6-linux_aarch64",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.37.48-ca-jdk11.0.6/zulu11.37.48-ca-jdk11.0.6-linux_aarch64.tar.gz"
+        ]
+    },
+    "remotejdk11_linux_aarch64_for_testing": {
+        "build_file": "@local_jdk//:BUILD.bazel",
+        "name": "remotejdk11_linux_aarch64_for_testing",
+        "patch_cmds": [
+            "test -f BUILD.bazel && chmod u+w BUILD.bazel || true",
+            "echo >> BUILD.bazel",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD.bazel"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD.bazel -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "61254688067454d3ccf0ef25993b5dcab7b56c8129e53b73566c28a8dd4d48fb",
+        "strip_prefix": "zulu11.50.19-ca-jdk11.0.12-linux_aarch64",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.50.19-ca-jdk11.0.12/zulu11.50.19-ca-jdk11.0.12-linux_aarch64.tar.gz"
+        ]
+    },
+    "remotejdk11_linux_for_testing": {
+        "build_file": "@local_jdk//:BUILD.bazel",
+        "name": "remotejdk11_linux_for_testing",
+        "patch_cmds": [
+            "test -f BUILD.bazel && chmod u+w BUILD.bazel || true",
+            "echo >> BUILD.bazel",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD.bazel"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD.bazel -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "b8e8a63b79bc312aa90f3558edbea59e71495ef1a9c340e38900dd28a1c579f3",
+        "strip_prefix": "zulu11.50.19-ca-jdk11.0.12-linux_x64",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.50.19-ca-jdk11.0.12/zulu11.50.19-ca-jdk11.0.12-linux_x64.tar.gz"
+        ]
+    },
+    "remotejdk11_linux_ppc64le": {
+        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
+        "generator_function": "maybe",
+        "generator_name": "remotejdk11_linux_ppc64le",
+        "name": "remotejdk11_linux_ppc64le",
+        "sha256": "a417db0295b1f4b538ecbaf7c774f3a177fab9657a665940170936c0eca4e71a",
+        "strip_prefix": "jdk-11.0.7+10",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7+10/OpenJDK11U-jdk_ppc64le_linux_hotspot_11.0.7_10.tar.gz",
+            "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7+10/OpenJDK11U-jdk_ppc64le_linux_hotspot_11.0.7_10.tar.gz"
+        ]
+    },
+    "remotejdk11_linux_ppc64le_for_testing": {
+        "build_file": "@local_jdk//:BUILD.bazel",
+        "name": "remotejdk11_linux_ppc64le_for_testing",
+        "patch_cmds": [
+            "test -f BUILD.bazel && chmod u+w BUILD.bazel || true",
+            "echo >> BUILD.bazel",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD.bazel"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD.bazel -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "a417db0295b1f4b538ecbaf7c774f3a177fab9657a665940170936c0eca4e71a",
+        "strip_prefix": "jdk-11.0.7+10",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7+10/OpenJDK11U-jdk_ppc64le_linux_hotspot_11.0.7_10.tar.gz",
+            "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7+10/OpenJDK11U-jdk_ppc64le_linux_hotspot_11.0.7_10.tar.gz"
+        ]
+    },
+    "remotejdk11_linux_s390x": {
+        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
+        "generator_function": "maybe",
+        "generator_name": "remotejdk11_linux_s390x",
+        "name": "remotejdk11_linux_s390x",
+        "sha256": "d9b72e87a1d3ebc0c9552f72ae5eb150fffc0298a7cb841f1ce7bfc70dcd1059",
+        "strip_prefix": "jdk-11.0.7+10",
+        "urls": [
+            "https://mirror.bazel.build/github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7+10/OpenJDK11U-jdk_s390x_linux_hotspot_11.0.7_10.tar.gz",
+            "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7+10/OpenJDK11U-jdk_s390x_linux_hotspot_11.0.7_10.tar.gz"
+        ]
+    },
+    "remotejdk11_linux_s390x_for_testing": {
+        "build_file": "@local_jdk//:BUILD.bazel",
+        "name": "remotejdk11_linux_s390x_for_testing",
+        "patch_cmds": [
+            "test -f BUILD.bazel && chmod u+w BUILD.bazel || true",
+            "echo >> BUILD.bazel",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD.bazel"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD.bazel -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "d9b72e87a1d3ebc0c9552f72ae5eb150fffc0298a7cb841f1ce7bfc70dcd1059",
+        "strip_prefix": "jdk-11.0.7+10",
+        "urls": [
+            "https://mirror.bazel.build/github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7+10/OpenJDK11U-jdk_s390x_linux_hotspot_11.0.7_10.tar.gz",
+            "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7+10/OpenJDK11U-jdk_s390x_linux_hotspot_11.0.7_10.tar.gz"
+        ]
+    },
+    "remotejdk11_macos": {
+        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
+        "generator_function": "maybe",
+        "generator_name": "remotejdk11_macos",
+        "name": "remotejdk11_macos",
+        "sha256": "e1fe56769f32e2aaac95e0a8f86b5a323da5af3a3b4bba73f3086391a6cc056f",
+        "strip_prefix": "zulu11.37.17-ca-jdk11.0.6-macosx_x64",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.37.17-ca-jdk11.0.6/zulu11.37.17-ca-jdk11.0.6-macosx_x64.tar.gz"
+        ]
+    },
+    "remotejdk11_macos_aarch64": {
+        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
+        "generator_function": "maybe",
+        "generator_name": "remotejdk11_macos_aarch64",
+        "name": "remotejdk11_macos_aarch64",
+        "sha256": "3dcc636e64ae58b922269c2dc9f20f6f967bee90e3f6847d643c4a566f1e8d8a",
+        "strip_prefix": "zulu11.45.27-ca-jdk11.0.10-macosx_aarch64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu11.45.27-ca-jdk11.0.10-macosx_aarch64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu11.45.27-ca-jdk11.0.10-macosx_aarch64.tar.gz"
+        ]
+    },
+    "remotejdk11_macos_aarch64_for_testing": {
+        "build_file": "@local_jdk//:BUILD.bazel",
+        "name": "remotejdk11_macos_aarch64_for_testing",
+        "patch_cmds": [
+            "test -f BUILD.bazel && chmod u+w BUILD.bazel || true",
+            "echo >> BUILD.bazel",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD.bazel"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD.bazel -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "e908a0b4c0da08d41c3e19230f819b364ff2e5f1dafd62d2cf991a85a34d3a17",
+        "strip_prefix": "zulu11.50.19-ca-jdk11.0.12-macosx_aarch64",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.50.19-ca-jdk11.0.12/zulu11.50.19-ca-jdk11.0.12-macosx_aarch64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu11.50.19-ca-jdk11.0.12-macosx_aarch64.tar.gz"
+        ]
+    },
+    "remotejdk11_macos_for_testing": {
+        "build_file": "@local_jdk//:BUILD.bazel",
+        "name": "remotejdk11_macos_for_testing",
+        "patch_cmds": [
+            "test -f BUILD.bazel && chmod u+w BUILD.bazel || true",
+            "echo >> BUILD.bazel",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD.bazel"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD.bazel -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "0b8c8b7cf89c7c55b7e2239b47201d704e8d2170884875b00f3103cf0662d6d7",
+        "strip_prefix": "zulu11.50.19-ca-jdk11.0.12-macosx_x64",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.50.19-ca-jdk11.0.12/zulu11.50.19-ca-jdk11.0.12-macosx_x64.tar.gz"
+        ]
+    },
+    "remotejdk11_win": {
+        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
+        "generator_function": "maybe",
+        "generator_name": "remotejdk11_win",
+        "name": "remotejdk11_win",
+        "sha256": "a9695617b8374bfa171f166951214965b1d1d08f43218db9a2a780b71c665c18",
+        "strip_prefix": "zulu11.37.17-ca-jdk11.0.6-win_x64",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.37.17-ca-jdk11.0.6/zulu11.37.17-ca-jdk11.0.6-win_x64.zip"
+        ]
+    },
+    "remotejdk11_win_for_testing": {
+        "build_file": "@local_jdk//:BUILD.bazel",
+        "name": "remotejdk11_win_for_testing",
+        "patch_cmds": [
+            "test -f BUILD.bazel && chmod u+w BUILD.bazel || true",
+            "echo >> BUILD.bazel",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD.bazel"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD.bazel -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "42ae65e75d615a3f06a674978e1fa85fdf078cad94e553fee3e779b2b42bb015",
+        "strip_prefix": "zulu11.50.19-ca-jdk11.0.12-win_x64",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.50.19-ca-jdk11.0.12/zulu11.50.19-ca-jdk11.0.12-win_x64.zip"
+        ]
+    },
+    "remotejdk14_linux": {
+        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
+        "generator_function": "maybe",
+        "generator_name": "remotejdk14_linux",
+        "name": "remotejdk14_linux",
+        "sha256": "48bb8947034cd079ad1ef83335e7634db4b12a26743a0dc314b6b861480777aa",
+        "strip_prefix": "zulu14.28.21-ca-jdk14.0.1-linux_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu14.28.21-ca-jdk14.0.1-linux_x64.tar.gz"
+        ]
+    },
+    "remotejdk14_macos": {
+        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
+        "generator_function": "maybe",
+        "generator_name": "remotejdk14_macos",
+        "name": "remotejdk14_macos",
+        "sha256": "088bd4d0890acc9f032b738283bf0f26b2a55c50b02d1c8a12c451d8ddf080dd",
+        "strip_prefix": "zulu14.28.21-ca-jdk14.0.1-macosx_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu14.28.21-ca-jdk14.0.1-macosx_x64.tar.gz"
+        ]
+    },
+    "remotejdk14_win": {
+        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
+        "generator_function": "maybe",
+        "generator_name": "remotejdk14_win",
+        "name": "remotejdk14_win",
+        "sha256": "9cb078b5026a900d61239c866161f0d9558ec759aa15c5b4c7e905370e868284",
+        "strip_prefix": "zulu14.28.21-ca-jdk14.0.1-win_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu14.28.21-ca-jdk14.0.1-win_x64.zip"
+        ]
+    },
+    "remotejdk15_linux": {
+        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
+        "generator_function": "maybe",
+        "generator_name": "remotejdk15_linux",
+        "name": "remotejdk15_linux",
+        "sha256": "0a38f1138c15a4f243b75eb82f8ef40855afcc402e3c2a6de97ce8235011b1ad",
+        "strip_prefix": "zulu15.27.17-ca-jdk15.0.0-linux_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu15.27.17-ca-jdk15.0.0-linux_x64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu15.27.17-ca-jdk15.0.0-linux_x64.tar.gz"
+        ]
+    },
+    "remotejdk15_linux_for_testing": {
+        "build_file": "@local_jdk//:BUILD.bazel",
+        "name": "remotejdk15_linux_for_testing",
+        "patch_cmds": [
+            "test -f BUILD.bazel && chmod u+w BUILD.bazel || true",
+            "echo >> BUILD.bazel",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD.bazel"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD.bazel -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "0a38f1138c15a4f243b75eb82f8ef40855afcc402e3c2a6de97ce8235011b1ad",
+        "strip_prefix": "zulu15.27.17-ca-jdk15.0.0-linux_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu15.27.17-ca-jdk15.0.0-linux_x64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu15.27.17-ca-jdk15.0.0-linux_x64.tar.gz"
+        ]
+    },
+    "remotejdk15_macos": {
+        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
+        "generator_function": "maybe",
+        "generator_name": "remotejdk15_macos",
+        "name": "remotejdk15_macos",
+        "sha256": "f80b2e0512d9d8a92be24497334c974bfecc8c898fc215ce0e76594f00437482",
+        "strip_prefix": "zulu15.27.17-ca-jdk15.0.0-macosx_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu15.27.17-ca-jdk15.0.0-macosx_x64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu15.27.17-ca-jdk15.0.0-macosx_x64.tar.gz"
+        ]
+    },
+    "remotejdk15_macos_aarch64": {
+        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
+        "generator_function": "maybe",
+        "generator_name": "remotejdk15_macos_aarch64",
+        "name": "remotejdk15_macos_aarch64",
+        "sha256": "2613c3f15eef6b6ecd0fd102da92282b985e4573905dc902f1783d8059c1efc5",
+        "strip_prefix": "zulu15.29.15-ca-jdk15.0.2-macosx_aarch64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu15.29.15-ca-jdk15.0.2-macosx_aarch64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu15.29.15-ca-jdk15.0.2-macosx_aarch64.tar.gz"
+        ]
+    },
+    "remotejdk15_macos_aarch64_for_testing": {
+        "build_file": "@local_jdk//:BUILD.bazel",
+        "name": "remotejdk15_macos_aarch64_for_testing",
+        "patch_cmds": [
+            "test -f BUILD.bazel && chmod u+w BUILD.bazel || true",
+            "echo >> BUILD.bazel",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD.bazel"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD.bazel -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "2613c3f15eef6b6ecd0fd102da92282b985e4573905dc902f1783d8059c1efc5",
+        "strip_prefix": "zulu15.29.15-ca-jdk15.0.2-macosx_aarch64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu15.29.15-ca-jdk15.0.2-macosx_aarch64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu15.29.15-ca-jdk15.0.2-macosx_aarch64.tar.gz"
+        ]
+    },
+    "remotejdk15_macos_for_testing": {
+        "build_file": "@local_jdk//:BUILD.bazel",
+        "name": "remotejdk15_macos_for_testing",
+        "patch_cmds": [
+            "test -f BUILD.bazel && chmod u+w BUILD.bazel || true",
+            "echo >> BUILD.bazel",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD.bazel"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD.bazel -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "f80b2e0512d9d8a92be24497334c974bfecc8c898fc215ce0e76594f00437482",
+        "strip_prefix": "zulu15.27.17-ca-jdk15.0.0-macosx_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu15.27.17-ca-jdk15.0.0-macosx_x64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu15.27.17-ca-jdk15.0.0-macosx_x64.tar.gz"
+        ]
+    },
+    "remotejdk15_win": {
+        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
+        "generator_function": "maybe",
+        "generator_name": "remotejdk15_win",
+        "name": "remotejdk15_win",
+        "sha256": "f535a530151e6c20de8a3078057e332b08887cb3ba1a4735717357e72765cad6",
+        "strip_prefix": "zulu15.27.17-ca-jdk15.0.0-win_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu15.27.17-ca-jdk15.0.0-win_x64.zip",
+            "https://cdn.azul.com/zulu/bin/zulu15.27.17-ca-jdk15.0.0-win_x64.zip"
+        ]
+    },
+    "remotejdk15_win_for_testing": {
+        "build_file": "@local_jdk//:BUILD.bazel",
+        "name": "remotejdk15_win_for_testing",
+        "patch_cmds": [
+            "test -f BUILD.bazel && chmod u+w BUILD.bazel || true",
+            "echo >> BUILD.bazel",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD.bazel"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD.bazel -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "f535a530151e6c20de8a3078057e332b08887cb3ba1a4735717357e72765cad6",
+        "strip_prefix": "zulu15.27.17-ca-jdk15.0.0-win_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu15.27.17-ca-jdk15.0.0-win_x64.zip",
+            "https://cdn.azul.com/zulu/bin/zulu15.27.17-ca-jdk15.0.0-win_x64.zip"
+        ]
+    },
+    "remotejdk16_linux_for_testing": {
+        "build_file": "@local_jdk//:BUILD.bazel",
+        "name": "remotejdk16_linux_for_testing",
+        "patch_cmds": [
+            "test -f BUILD.bazel && chmod u+w BUILD.bazel || true",
+            "echo >> BUILD.bazel",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD.bazel"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD.bazel -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "236b5ea97aff3cb312e743848d7efa77faf305170e41371a732ca93c1b797665",
+        "strip_prefix": "zulu16.28.11-ca-jdk16.0.0-linux_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu16.28.11-ca-jdk16.0.0-linux_x64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu16.28.11-ca-jdk16.0.0-linux_x64.tar.gz"
+        ]
+    },
+    "remotejdk16_macos_aarch64_for_testing": {
+        "build_file": "@local_jdk//:BUILD.bazel",
+        "name": "remotejdk16_macos_aarch64_for_testing",
+        "patch_cmds": [
+            "test -f BUILD.bazel && chmod u+w BUILD.bazel || true",
+            "echo >> BUILD.bazel",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD.bazel"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD.bazel -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "c92131e83bc71474850e667bc4e05fca33662b8feb009a0547aa14e76b40e890",
+        "strip_prefix": "zulu16.28.11-ca-jdk16.0.0-macosx_aarch64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu16.28.11-ca-jdk16.0.0-macosx_aarch64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu16.28.11-ca-jdk16.0.0-macosx_aarch64.tar.gz"
+        ]
+    },
+    "remotejdk16_macos_for_testing": {
+        "build_file": "@local_jdk//:BUILD.bazel",
+        "name": "remotejdk16_macos_for_testing",
+        "patch_cmds": [
+            "test -f BUILD.bazel && chmod u+w BUILD.bazel || true",
+            "echo >> BUILD.bazel",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD.bazel"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD.bazel -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "6d47ef22dc56ce1f5a102ed39e21d9a97320f0bb786818e2c686393109d79bc5",
+        "strip_prefix": "zulu16.28.11-ca-jdk16.0.0-macosx_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu16.28.11-ca-jdk16.0.0-macosx_x64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu16.28.11-ca-jdk16.0.0-macosx_x64.tar.gz"
+        ]
+    },
+    "remotejdk16_win_for_testing": {
+        "build_file": "@local_jdk//:BUILD.bazel",
+        "name": "remotejdk16_win_for_testing",
+        "patch_cmds": [
+            "test -f BUILD.bazel && chmod u+w BUILD.bazel || true",
+            "echo >> BUILD.bazel",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD.bazel"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD.bazel -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "6cbf98ada27476526a5f6dff79fd5f2c15e2f671818e503bdf741eb6c8fed3d4",
+        "strip_prefix": "zulu16.28.11-ca-jdk16.0.0-win_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu16.28.11-ca-jdk16.0.0-win_x64.zip",
+            "https://cdn.azul.com/zulu/bin/zulu16.28.11-ca-jdk16.0.0-win_x64.zip"
+        ]
+    },
+    "remotejdk17_linux_for_testing": {
+        "build_file": "@local_jdk//:BUILD.bazel",
+        "name": "remotejdk17_linux_for_testing",
+        "patch_cmds": [
+            "test -f BUILD.bazel && chmod u+w BUILD.bazel || true",
+            "echo >> BUILD.bazel",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD.bazel"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD.bazel -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "37c4f8e48536cceae8c6c20250d6c385e176972532fd35759fa7d6015c965f56",
+        "strip_prefix": "zulu17.28.13-ca-jdk17.0.0-linux_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.28.13-ca-jdk17.0.0-linux_x64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu17.28.13-ca-jdk17.0.0-linux_x64.tar.gz"
+        ]
+    },
+    "remotejdk17_macos_aarch64_for_testing": {
+        "build_file": "@local_jdk//:BUILD.bazel",
+        "name": "remotejdk17_macos_aarch64_for_testing",
+        "patch_cmds": [
+            "test -f BUILD.bazel && chmod u+w BUILD.bazel || true",
+            "echo >> BUILD.bazel",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD.bazel"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD.bazel -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "6b17f01f767ee7abf4704149ca4d86423aab9b16b68697b7d36e9b616846a8b0",
+        "strip_prefix": "zulu17.28.13-ca-jdk17.0.0-macosx_aarch64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.28.13-ca-jdk17.0.0-macosx_aarch64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu17.28.13-ca-jdk17.0.0-macosx_aarch64.tar.gz"
+        ]
+    },
+    "remotejdk17_macos_for_testing": {
+        "build_file": "@local_jdk//:BUILD.bazel",
+        "name": "remotejdk17_macos_for_testing",
+        "patch_cmds": [
+            "test -f BUILD.bazel && chmod u+w BUILD.bazel || true",
+            "echo >> BUILD.bazel",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD.bazel"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD.bazel -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "6029b1fe6853cecad22ab99ac0b3bb4fb8c903dd2edefa91c3abc89755bbd47d",
+        "strip_prefix": "zulu17.28.13-ca-jdk17.0.0-macosx_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.28.13-ca-jdk17.0.0-macosx_x64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu17.28.13-ca-jdk17.0.0-macosx_x64.tar.gz"
+        ]
+    },
+    "remotejdk17_win_for_testing": {
+        "build_file": "@local_jdk//:BUILD.bazel",
+        "name": "remotejdk17_win_for_testing",
+        "patch_cmds": [
+            "test -f BUILD.bazel && chmod u+w BUILD.bazel || true",
+            "echo >> BUILD.bazel",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD.bazel"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD.bazel -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "f4437011239f3f0031c794bb91c02a6350bc941d4196bdd19c9f157b491815a3",
+        "strip_prefix": "zulu17.28.13-ca-jdk17.0.0-win_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.28.13-ca-jdk17.0.0-win_x64.zip",
+            "https://cdn.azul.com/zulu/bin/zulu17.28.13-ca-jdk17.0.0-win_x64.zip"
+        ]
+    },
+    "rules_cc": {
+        "generator_function": "dist_http_archive",
+        "generator_name": "rules_cc",
+        "name": "rules_cc",
+        "patch_cmds": [
+            "test -f BUILD && chmod u+w BUILD || true",
+            "echo >> BUILD",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "d0c573b94a6ef20ef6ff20154a23d0efcb409fb0e1ff0979cec318dfe42f0cdd",
+        "strip_prefix": "rules_cc-b1c40e1de81913a3c40e5948f78719c28152486d",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/rules_cc/archive/b1c40e1de81913a3c40e5948f78719c28152486d.zip",
+            "https://github.com/bazelbuild/rules_cc/archive/b1c40e1de81913a3c40e5948f78719c28152486d.zip"
+        ]
+    },
+    "rules_java": {
+        "generator_function": "dist_http_archive",
+        "generator_name": "rules_java",
+        "name": "rules_java",
+        "patch_cmds": [
+            "test -f BUILD && chmod u+w BUILD || true",
+            "echo >> BUILD",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "bc81f1ba47ef5cc68ad32225c3d0e70b8c6f6077663835438da8d5733f917598",
+        "strip_prefix": "rules_java-7cf3cefd652008d0a64a419c34c13bdca6c8f178",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/rules_java/archive/7cf3cefd652008d0a64a419c34c13bdca6c8f178.zip",
+            "https://github.com/bazelbuild/rules_java/archive/7cf3cefd652008d0a64a419c34c13bdca6c8f178.zip"
+        ]
+    },
+    "rules_nodejs-2.2.2.tar.gz": {
+        "name": "rules_nodejs-2.2.2.tar.gz",
+        "sha256": "f2194102720e662dbf193546585d705e645314319554c6ce7e47d8b59f459e9c",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/rules_nodejs/releases/download/2.2.2/rules_nodejs-2.2.2.tar.gz",
+            "https://github.com/bazelbuild/rules_nodejs/releases/download/2.2.2/rules_nodejs-2.2.2.tar.gz"
+        ]
+    },
+    "rules_pkg": {
+        "generator_function": "dist_http_archive",
+        "generator_name": "rules_pkg",
+        "name": "rules_pkg",
+        "sha256": "038f1caa773a7e35b3663865ffb003169c6a71dc995e39bf4815792f385d837d",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/rules_pkg/releases/download/0.4.0/rules_pkg-0.4.0.tar.gz",
+            "https://github.com/bazelbuild/rules_pkg/releases/download/0.4.0/rules_pkg-0.4.0.tar.gz"
+        ]
+    },
+    "rules_pkg-0.4.0.tar.gz": {
+        "name": "rules_pkg-0.4.0.tar.gz",
+        "sha256": "038f1caa773a7e35b3663865ffb003169c6a71dc995e39bf4815792f385d837d",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/rules_pkg/releases/download/0.4.0/rules_pkg-0.4.0.tar.gz",
+            "https://github.com/bazelbuild/rules_pkg/releases/download/0.4.0/rules_pkg-0.4.0.tar.gz"
+        ]
+    },
+    "rules_proto": {
+        "generator_function": "dist_http_archive",
+        "generator_name": "rules_proto",
+        "name": "rules_proto",
+        "patch_cmds": [
+            "test -f BUILD.bazel && chmod u+w BUILD.bazel || true",
+            "echo >> BUILD.bazel",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD.bazel"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD.bazel -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "8e7d59a5b12b233be5652e3d29f42fba01c7cbab09f6b3a8d0a57ed6d1e9a0da",
+        "strip_prefix": "rules_proto-7e4afce6fe62dbff0a4a03450143146f9f2d7488",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/rules_proto/archive/7e4afce6fe62dbff0a4a03450143146f9f2d7488.tar.gz",
+            "https://github.com/bazelbuild/rules_proto/archive/7e4afce6fe62dbff0a4a03450143146f9f2d7488.tar.gz"
+        ]
+    },
+    "six": {
+        "build_file": "@com_github_grpc_grpc//third_party:six.BUILD",
+        "generator_function": "grpc_deps",
+        "generator_name": "six",
+        "name": "six",
+        "sha256": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926",
+        "urls": [
+            "https://files.pythonhosted.org/packages/71/39/171f1c67cd00715f190ba0b100d606d440a28c93c7714febeca8b79af85e/six-1.16.0.tar.gz"
+        ]
+    },
+    "upb": {
+        "generator_function": "grpc_deps",
+        "generator_name": "upb",
+        "name": "upb",
+        "sha256": "6a5f67874af66b239b709c572ac1a5a00fdb1b29beaf13c3e6f79b1ba10dc7c4",
+        "strip_prefix": "upb-2de300726a1ba2de9a468468dc5ff9ed17a3215f",
+        "urls": [
+            "https://storage.googleapis.com/grpc-bazel-mirror/github.com/protocolbuffers/upb/archive/2de300726a1ba2de9a468468dc5ff9ed17a3215f.tar.gz",
+            "https://github.com/protocolbuffers/upb/archive/2de300726a1ba2de9a468468dc5ff9ed17a3215f.tar.gz"
+        ]
+    },
+    "v1.41.0.tar.gz": {
+        "name": "v1.41.0.tar.gz",
+        "sha256": "e5fb30aae1fa1cffa4ce00aa0bbfab908c0b899fcf0bbc30e268367d660d8656",
+        "urls": [
+            "https://mirror.bazel.build/github.com/grpc/grpc/archive/v1.41.0.tar.gz",
+            "https://github.com/grpc/grpc/archive/v1.41.0.tar.gz"
+        ]
+    },
+    "v1.5.0-4.zip": {
+        "name": "v1.5.0-4.zip",
+        "sha256": "d320d59b89a163c5efccbe4915ae6a49883ce653cdc670643dfa21c6063108e4",
+        "urls": [
+            "https://mirror.bazel.build/github.com/luben/zstd-jni/archive/v1.5.0-4.zip",
+            "https://github.com/luben/zstd-jni/archive/v1.5.0-4.zip"
+        ]
+    },
+    "v3.13.0.tar.gz": {
+        "name": "v3.13.0.tar.gz",
+        "sha256": "9b4ee22c250fe31b16f1a24d61467e40780a3fbb9b91c3b65be2a376ed913a1a",
+        "urls": [
+            "https://mirror.bazel.build/github.com/protocolbuffers/protobuf/archive/v3.13.0.tar.gz",
+            "https://github.com/protocolbuffers/protobuf/archive/v3.13.0.tar.gz"
+        ]
+    },
+    "zlib": {
+        "build_file": "@com_github_grpc_grpc//third_party:zlib.BUILD",
+        "generator_function": "grpc_deps",
+        "generator_name": "zlib",
+        "name": "zlib",
+        "sha256": "6d4d6640ca3121620995ee255945161821218752b551a1a180f4215f7d124d45",
+        "strip_prefix": "zlib-cacf7f1d4e3d44d871b605da3b647f07d718623f",
+        "urls": [
+            "https://storage.googleapis.com/grpc-bazel-mirror/github.com/madler/zlib/archive/cacf7f1d4e3d44d871b605da3b647f07d718623f.tar.gz",
+            "https://github.com/madler/zlib/archive/cacf7f1d4e3d44d871b605da3b647f07d718623f.tar.gz"
+        ]
+    },
+    "zstd-jni": {
+        "build_file": "//third_party:zstd-jni/zstd-jni.BUILD",
+        "generator_function": "dist_http_archive",
+        "generator_name": "zstd-jni",
+        "name": "zstd-jni",
+        "patch_args": [
+            "-p1"
+        ],
+        "patch_cmds": [
+            "test -f BUILD.bazel && chmod u+w BUILD.bazel || true",
+            "echo >> BUILD.bazel",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD.bazel"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD.bazel -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "patches": [
+            "//third_party:zstd-jni/Native.java.patch"
+        ],
+        "sha256": "d320d59b89a163c5efccbe4915ae6a49883ce653cdc670643dfa21c6063108e4",
+        "strip_prefix": "zstd-jni-1.5.0-4",
+        "urls": [
+            "https://mirror.bazel.build/github.com/luben/zstd-jni/archive/v1.5.0-4.zip",
+            "https://github.com/luben/zstd-jni/archive/v1.5.0-4.zip"
+        ]
+    },
+    "zulu11.50.19-ca-jdk11.0.12-linux_aarch64.tar.gz": {
+        "name": "zulu11.50.19-ca-jdk11.0.12-linux_aarch64.tar.gz",
+        "sha256": "61254688067454d3ccf0ef25993b5dcab7b56c8129e53b73566c28a8dd4d48fb",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.50.19-ca-jdk11.0.12/zulu11.50.19-ca-jdk11.0.12-linux_aarch64.tar.gz"
+        ]
+    },
+    "zulu11.50.19-ca-jdk11.0.12-linux_x64.tar.gz": {
+        "name": "zulu11.50.19-ca-jdk11.0.12-linux_x64.tar.gz",
+        "sha256": "b8e8a63b79bc312aa90f3558edbea59e71495ef1a9c340e38900dd28a1c579f3",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.50.19-ca-jdk11.0.12/zulu11.50.19-ca-jdk11.0.12-linux_x64.tar.gz"
+        ]
+    },
+    "zulu11.50.19-ca-jdk11.0.12-macosx_aarch64.tar.gz": {
+        "name": "zulu11.50.19-ca-jdk11.0.12-macosx_aarch64.tar.gz",
+        "sha256": "e908a0b4c0da08d41c3e19230f819b364ff2e5f1dafd62d2cf991a85a34d3a17",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.50.19-ca-jdk11.0.12/zulu11.50.19-ca-jdk11.0.12-macosx_aarch64.tar.gz"
+        ]
+    },
+    "zulu11.50.19-ca-jdk11.0.12-macosx_x64.tar.gz": {
+        "name": "zulu11.50.19-ca-jdk11.0.12-macosx_x64.tar.gz",
+        "sha256": "0b8c8b7cf89c7c55b7e2239b47201d704e8d2170884875b00f3103cf0662d6d7",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.50.19-ca-jdk11.0.12/zulu11.50.19-ca-jdk11.0.12-macosx_x64.tar.gz"
+        ]
+    },
+    "zulu11.50.19-ca-jdk11.0.12-win_x64.tar.gz": {
+        "name": "zulu11.50.19-ca-jdk11.0.12-win_x64.tar.gz",
+        "sha256": "42ae65e75d615a3f06a674978e1fa85fdf078cad94e553fee3e779b2b42bb015",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.50.19-ca-jdk11.0.12/zulu11.50.19-ca-jdk11.0.12-win_x64.zip"
+        ]
+    }
+}
diff --git a/third_party/nixpkgs/pkgs/development/tools/build-managers/bazel/bazel_5/update-srcDeps.py b/third_party/nixpkgs/pkgs/development/tools/build-managers/bazel/bazel_5/update-srcDeps.py
new file mode 100755
index 0000000000..d409a32e13
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/tools/build-managers/bazel/bazel_5/update-srcDeps.py
@@ -0,0 +1,54 @@
+#!/usr/bin/env python3
+import sys
+import json
+
+if len(sys.argv) != 2:
+    print("usage: ./this-script src-deps.json < WORKSPACE", file=sys.stderr)
+    print("Takes the bazel WORKSPACE file and reads all archives into a json dict (by evaling it as python code)", file=sys.stderr)
+    print("Hail Eris.", file=sys.stderr)
+    sys.exit(1)
+
+http_archives = []
+
+# just the kw args are the dict { name, sha256, urls … }
+def http_archive(**kw):
+    http_archives.append(kw)
+# like http_file
+def http_file(**kw):
+    http_archives.append(kw)
+
+# this is inverted from http_archive/http_file and bundles multiple archives
+def _distdir_tar(**kw):
+    for archive_name in kw['archives']:
+        http_archives.append({
+            "name": archive_name,
+            "sha256": kw['sha256'][archive_name],
+            "urls": kw['urls'][archive_name]
+        })
+
+# TODO?
+def git_repository(**kw):
+    print(json.dumps(kw, sort_keys=True, indent=4), file=sys.stderr)
+    sys.exit(1)
+
+# execute the WORKSPACE like it was python code in this module,
+# using all the function stubs from above.
+exec(sys.stdin.read())
+
+# transform to a dict with the names as keys
+d = { el['name']: el for el in http_archives }
+
+def has_urls(el):
+    return ('url' in el and el['url']) or ('urls' in el and el['urls'])
+def has_sha256(el):
+    return 'sha256' in el and el['sha256']
+bad_archives = list(filter(lambda el: not has_urls(el) or not has_sha256(el), d.values()))
+if bad_archives:
+    print('Following bazel dependencies are missing url or sha256', file=sys.stderr)
+    print('Check bazel sources for master or non-checksummed dependencies', file=sys.stderr)
+    for el in bad_archives:
+        print(json.dumps(el, sort_keys=True, indent=4), file=sys.stderr)
+    sys.exit(1)
+
+with open(sys.argv[1], "w") as f:
+    print(json.dumps(d, sort_keys=True, indent=4), file=f)
diff --git a/third_party/nixpkgs/pkgs/development/tools/build-managers/bazel/java-test.nix b/third_party/nixpkgs/pkgs/development/tools/build-managers/bazel/java-test.nix
index 9641a95c33..cfdfe84f79 100644
--- a/third_party/nixpkgs/pkgs/development/tools/build-managers/bazel/java-test.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/build-managers/bazel/java-test.nix
@@ -5,6 +5,7 @@
 , gccStdenv
 , lib
 , openjdk8
+, jdk11_headless
 , runLocal
 , runtimeShell
 , writeScript
@@ -41,18 +42,19 @@ let
     name = "bazel-test-java";
     inherit workspaceDir;
     bazelPkg = bazel;
-    buildInputs = [ openjdk8 ];
+    buildInputs = [ (if lib.strings.versionOlder bazel.version "5.0.0" then openjdk8 else jdk11_headless) ];
     bazelScript = ''
       ${bazel}/bin/bazel \
         run \
         --distdir=${distDir} \
-          --host_javabase='@local_jdk//:jdk' \
-          --java_toolchain='@bazel_tools//tools/jdk:toolchain_hostjdk8' \
-          --javabase='@local_jdk//:jdk' \
           --verbose_failures \
           --curses=no \
           --sandbox_debug \
-          //:ProjectRunner
+          //:ProjectRunner \
+    '' + lib.optionalString (lib.strings.versionOlder bazel.version "5.0.0") ''
+          --host_javabase='@local_jdk//:jdk' \
+          --java_toolchain='@bazel_tools//tools/jdk:toolchain_hostjdk8' \
+          --javabase='@local_jdk//:jdk' \
     '';
   };
 
diff --git a/third_party/nixpkgs/pkgs/development/tools/build-managers/bazel/protobuf-test.nix b/third_party/nixpkgs/pkgs/development/tools/build-managers/bazel/protobuf-test.nix
index d01e188872..f4872d1b12 100644
--- a/third_party/nixpkgs/pkgs/development/tools/build-managers/bazel/protobuf-test.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/build-managers/bazel/protobuf-test.nix
@@ -6,6 +6,7 @@
 , gccStdenv
 , lib
 , openjdk8
+, jdk11_headless
 , runLocal
 , runtimeShell
 , writeScript
@@ -160,18 +161,19 @@ let
     name = "bazel-test-protocol-buffers";
     inherit workspaceDir;
     bazelPkg = bazel;
-    buildInputs = [ openjdk8 ];
+    buildInputs = [ (if lib.strings.versionOlder bazel.version "5.0.0" then openjdk8 else jdk11_headless) ];
     bazelScript = ''
       ${bazel}/bin/bazel \
         build \
         --distdir=${distDir} \
-          --host_javabase='@local_jdk//:jdk' \
-          --java_toolchain='@bazel_tools//tools/jdk:toolchain_hostjdk8' \
-          --javabase='@local_jdk//:jdk' \
           --verbose_failures \
           --curses=no \
           --sandbox_debug \
-          //...
+          //... \
+    '' + lib.optionalString (lib.strings.versionOlder bazel.version "5.0.0") ''
+          --host_javabase='@local_jdk//:jdk' \
+          --java_toolchain='@bazel_tools//tools/jdk:toolchain_hostjdk8' \
+          --javabase='@local_jdk//:jdk' \
     '';
   };
 
diff --git a/third_party/nixpkgs/pkgs/development/tools/build-managers/gnumake/default.nix b/third_party/nixpkgs/pkgs/development/tools/build-managers/gnumake/default.nix
index 3b9f0add87..183548f5e3 100644
--- a/third_party/nixpkgs/pkgs/development/tools/build-managers/gnumake/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/build-managers/gnumake/default.nix
@@ -34,6 +34,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional stdenv.isDarwin "ac_cv_struct_st_mtim_nsec=no";
 
   outputs = [ "out" "man" "info" ];
+  separateDebugInfo = true;
 
   meta = with lib; {
     homepage = "https://www.gnu.org/software/make/";
diff --git a/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.57/boost-Do-not-add-system-paths-on-nix.patch b/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.57/boost-Do-not-add-system-paths-on-nix.patch
deleted file mode 100644
index 5b9020b3d5..0000000000
--- a/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.57/boost-Do-not-add-system-paths-on-nix.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 536108b10271f2f42d41c7d9ddb4ce2ea1851f4f Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Niklas=20Hamb=C3=BCchen?= <mail@nh2.me>
-Date: Sat, 17 Oct 2020 19:27:08 +0200
-Subject: [PATCH] boost: Do not add system paths on nix
-
----
- mesonbuild/dependencies/boost.py | 17 +----------------
- 1 file changed, 1 insertion(+), 16 deletions(-)
-
-diff --git a/mesonbuild/dependencies/boost.py b/mesonbuild/dependencies/boost.py
-index 907c0c275..ecaf11b18 100644
---- a/mesonbuild/dependencies/boost.py
-+++ b/mesonbuild/dependencies/boost.py
-@@ -643,22 +643,7 @@ class BoostDependency(ExternalDependency):
-             roots += [x for x in candidates if x.name.lower().startswith('boost') and x.is_dir()]
-         else:
-             tmp = []  # type: T.List[Path]
--
--            # Homebrew
--            brew_boost = Path('/usr/local/Cellar/boost')
--            if brew_boost.is_dir():
--                tmp += [x for x in brew_boost.iterdir()]
--
--            # Add some default system paths
--            tmp += [Path('/opt/local')]
--            tmp += [Path('/usr/local/opt/boost')]
--            tmp += [Path('/usr/local')]
--            tmp += [Path('/usr')]
--
--            # Cleanup paths
--            tmp = [x for x in tmp if x.is_dir()]
--            tmp = [x.resolve() for x in tmp]
--            roots += tmp
-+            # Do not add any non-explicit paths on nix
- 
-         return roots
- 
--- 
-2.25.4
-
diff --git a/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.57/default.nix b/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.57/default.nix
deleted file mode 100644
index 6fd93e8f86..0000000000
--- a/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.57/default.nix
+++ /dev/null
@@ -1,94 +0,0 @@
-{ lib
-, python3
-, writeTextDir
-, substituteAll
-, fetchpatch
-, installShellFiles
-}:
-
-python3.pkgs.buildPythonApplication rec {
-  pname = "meson";
-  version = "0.57.1";
-
-  src = python3.pkgs.fetchPypi {
-    inherit pname version;
-    sha256 = "19n8alcpzv6npgp27iqljkmvdmr7s2c7zm8y997j1nlvpa1cgqbj";
-  };
-
-  patches = [
-    # Upstream insists on not allowing bindir and other dir options
-    # outside of prefix for some reason:
-    # https://github.com/mesonbuild/meson/issues/2561
-    # We remove the check so multiple outputs can work sanely.
-    ./allow-dirs-outside-of-prefix.patch
-
-    # Meson is currently inspecting fewer variables than autoconf does, which
-    # makes it harder for us to use setup hooks, etc.  Taken from
-    # https://github.com/mesonbuild/meson/pull/6827
-    ./more-env-vars.patch
-
-    # Unlike libtool, vanilla Meson does not pass any information
-    # about the path library will be installed to to g-ir-scanner,
-    # breaking the GIR when path other than ${!outputLib}/lib is used.
-    # We patch Meson to add a --fallback-library-path argument with
-    # library install_dir to g-ir-scanner.
-    ./gir-fallback-path.patch
-
-    # In common distributions, RPATH is only needed for internal libraries so
-    # meson removes everything else. With Nix, the locations of libraries
-    # are not as predictable, therefore we need to keep them in the RPATH.
-    # At the moment we are keeping the paths starting with /nix/store.
-    # https://github.com/NixOS/nixpkgs/issues/31222#issuecomment-365811634
-    (substituteAll {
-      src = ./fix-rpath.patch;
-      inherit (builtins) storeDir;
-    })
-
-    # When Meson removes build_rpath from DT_RUNPATH entry, it just writes
-    # the shorter NUL-terminated new rpath over the old one to reduce
-    # the risk of potentially breaking the ELF files.
-    # But this can cause much bigger problem for Nix as it can produce
-    # cut-in-half-by-\0 store path references.
-    # Let’s just clear the whole rpath and hope for the best.
-    ./clear-old-rpath.patch
-
-    # Patch out default boost search paths to avoid impure builds on
-    # unsandboxed non-NixOS builds, see:
-    # https://github.com/NixOS/nixpkgs/issues/86131#issuecomment-711051774
-    ./boost-Do-not-add-system-paths-on-nix.patch
-  ];
-
-  setupHook = ./setup-hook.sh;
-
-  # 0.45 update enabled tests but they are failing
-  doCheck = false;
-  # checkInputs = [ ninja pkg-config ];
-  # checkPhase = "python ./run_project_tests.py";
-
-  postFixup = ''
-    pushd $out/bin
-    # undo shell wrapper as meson tools are called with python
-    for i in *; do
-      mv ".$i-wrapped" "$i"
-    done
-    popd
-
-    # Do not propagate Python
-    rm $out/nix-support/propagated-build-inputs
-  '';
-
-  nativeBuildInputs = [ installShellFiles ];
-
-  postInstall = ''
-    installShellCompletion --zsh data/shell-completions/zsh/_meson
-    installShellCompletion --bash data/shell-completions/bash/meson
-  '';
-
-  meta = with lib; {
-    homepage = "https://mesonbuild.com";
-    description = "SCons-like build system that use python as a front-end language and Ninja as a building backend";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ jtojnar mbe ];
-    platforms = platforms.all;
-  };
-}
diff --git a/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.57/gir-fallback-path.patch b/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.57/gir-fallback-path.patch
deleted file mode 100644
index 0c924bacf7..0000000000
--- a/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.57/gir-fallback-path.patch
+++ /dev/null
@@ -1,16 +0,0 @@
---- a/mesonbuild/modules/gnome.py
-+++ b/mesonbuild/modules/gnome.py
-@@ -807,6 +807,13 @@ class GnomeModule(ExtensionModule):
-         if fatal_warnings:
-             scan_command.append('--warn-error')
- 
-+        if len(set([girtarget.get_custom_install_dir()[0] for girtarget in girtargets])) > 1:
-+            raise MesonException('generate_gir tries to build multiple libraries with different install_dir at once: {}'.format(','.join([str(girtarget) for girtarget in girtargets])))
-+
-+        fallback_libpath = girtargets[0].get_custom_install_dir()[0]
-+        if fallback_libpath is not None and isinstance(fallback_libpath, str) and len(fallback_libpath) > 0 and fallback_libpath[0] == "/":
-+            scan_command += ['--fallback-library-path=' + fallback_libpath]
-+
-         scan_target = self._make_gir_target(state, girfile, scan_command, depends, kwargs)
- 
-         typelib_output = '%s-%s.typelib' % (ns, nsversion)
diff --git a/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.57/more-env-vars.patch b/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.57/more-env-vars.patch
deleted file mode 100644
index 4b2606e2d6..0000000000
--- a/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.57/more-env-vars.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/mesonbuild/environment.py b/mesonbuild/environment.py
-index 756dd8193..a5cc6ef8b 100644
---- a/mesonbuild/environment.py
-+++ b/mesonbuild/environment.py
-@@ -151,7 +151,7 @@ def _get_env_var(for_machine: MachineChoice, is_cross: bool, var_name: str) -> T
-         # compiling we fall back on the unprefixed host version. This
-         # allows native builds to never need to worry about the 'BUILD_*'
-         # ones.
--        ([var_name + '_FOR_BUILD'] if is_cross else [var_name]),
-+        [var_name + '_FOR_BUILD'] + ([] if is_cross else [var_name]),
-         # Always just the unprefixed host verions
-         [var_name]
-     )[for_machine]
diff --git a/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.60/allow-dirs-outside-of-prefix.patch b/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.60/allow-dirs-outside-of-prefix.patch
deleted file mode 100644
index 4eb292a2e5..0000000000
--- a/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.60/allow-dirs-outside-of-prefix.patch
+++ /dev/null
@@ -1,19 +0,0 @@
---- a/mesonbuild/coredata.py
-+++ b/mesonbuild/coredata.py
-@@ -506,7 +506,6 @@ class CoreData:
-             return value
-         if option.name.endswith('dir') and value.is_absolute() and \
-            option not in BULITIN_DIR_NOPREFIX_OPTIONS:
--            # Value must be a subdir of the prefix
-             # commonpath will always return a path in the native format, so we
-             # must use pathlib.PurePath to do the same conversion before
-             # comparing.
-@@ -518,7 +517,7 @@ class CoreData:
-             try:
-                 value = value.relative_to(prefix)
-             except ValueError:
--                raise MesonException(msg.format(option, value, prefix))
-+                pass
-             if '..' in str(value):
-                 raise MesonException(msg.format(option, value, prefix))
-         return value.as_posix()
diff --git a/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.60/clear-old-rpath.patch b/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.60/clear-old-rpath.patch
deleted file mode 100644
index f1e3c76e8b..0000000000
--- a/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.60/clear-old-rpath.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-diff --git a/mesonbuild/scripts/depfixer.py b/mesonbuild/scripts/depfixer.py
-index 4176b9a03..faaabf616 100644
---- a/mesonbuild/scripts/depfixer.py
-+++ b/mesonbuild/scripts/depfixer.py
-@@ -336,6 +336,15 @@ class Elf(DataSizes):
-         if not new_rpath:
-             self.remove_rpath_entry(entrynum)
-         else:
-+            # Clear old rpath to avoid stale references,
-+            # not heeding the warning above about de-duplication
-+            # since it does not seem to cause issues for us
-+            # and not doing so trips up Nix’s reference checker.
-+            # See https://github.com/NixOS/nixpkgs/pull/46020
-+            # and https://github.com/NixOS/nixpkgs/issues/95163
-+            self.bf.seek(rp_off)
-+            self.bf.write(b'\0'*len(old_rpath))
-+
-             self.bf.seek(rp_off)
-             self.bf.write(new_rpath)
-             self.bf.write(b'\0')
diff --git a/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.60/fix-rpath.patch b/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.60/fix-rpath.patch
deleted file mode 100644
index d34b6c4c43..0000000000
--- a/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.60/fix-rpath.patch
+++ /dev/null
@@ -1,24 +0,0 @@
---- a/mesonbuild/backend/backends.py
-+++ b/mesonbuild/backend/backends.py
-@@ -456,6 +456,21 @@ class Backend:
-                 args.extend(self.environment.coredata.get_external_link_args(target.for_machine, lang))
-             except Exception:
-                 pass
-+
-+        nix_ldflags = os.environ.get('NIX_LDFLAGS', '').split()
-+        next_is_path = False
-+        # Try to add rpaths set by user or ld-wrapper so that they are not removed.
-+        # Based on https://github.com/NixOS/nixpkgs/blob/69711a2f5ffe8cda208163be5258266172ff527f/pkgs/build-support/bintools-wrapper/ld-wrapper.sh#L148-L177
-+        for flag in nix_ldflags:
-+            if flag == '-rpath' or flag == '-L':
-+                next_is_path = True
-+            elif next_is_path or flag.startswith('-L/'):
-+                if flag.startswith('-L/'):
-+                    flag = flag[2:]
-+                if flag.startswith('@storeDir@'):
-+                    dirs.add(flag)
-+                next_is_path = False
-+
-         # Match rpath formats:
-         # -Wl,-rpath=
-         # -Wl,-rpath,
diff --git a/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.60/setup-hook.sh b/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.60/setup-hook.sh
deleted file mode 100644
index 3d946fcffd..0000000000
--- a/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.60/setup-hook.sh
+++ /dev/null
@@ -1,37 +0,0 @@
-mesonConfigurePhase() {
-    runHook preConfigure
-
-    if [ -z "${dontAddPrefix-}" ]; then
-        mesonFlags="--prefix=$prefix $mesonFlags"
-    fi
-
-    # See multiple-outputs.sh and meson’s coredata.py
-    mesonFlags="\
-        --libdir=${!outputLib}/lib --libexecdir=${!outputLib}/libexec \
-        --bindir=${!outputBin}/bin --sbindir=${!outputBin}/sbin \
-        --includedir=${!outputInclude}/include \
-        --mandir=${!outputMan}/share/man --infodir=${!outputInfo}/share/info \
-        --localedir=${!outputLib}/share/locale \
-        -Dauto_features=${mesonAutoFeatures:-enabled} \
-        -Dwrap_mode=${mesonWrapMode:-nodownload} \
-        $mesonFlags"
-
-    mesonFlags="${crossMesonFlags+$crossMesonFlags }--buildtype=${mesonBuildType:-plain} $mesonFlags"
-
-    echo "meson flags: $mesonFlags ${mesonFlagsArray[@]}"
-
-    meson build $mesonFlags "${mesonFlagsArray[@]}"
-    cd build
-
-    if ! [[ -v enableParallelBuilding ]]; then
-        enableParallelBuilding=1
-        echo "meson: enabled parallel building"
-    fi
-
-    runHook postConfigure
-}
-
-if [ -z "${dontUseMesonConfigure-}" -a -z "${configurePhase-}" ]; then
-    setOutputFlags=
-    configurePhase=mesonConfigurePhase
-fi
diff --git a/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.57/allow-dirs-outside-of-prefix.patch b/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch
similarity index 100%
rename from third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.57/allow-dirs-outside-of-prefix.patch
rename to third_party/nixpkgs/pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch
diff --git a/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.60/boost-Do-not-add-system-paths-on-nix.patch b/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/boost-Do-not-add-system-paths-on-nix.patch
similarity index 100%
rename from third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.60/boost-Do-not-add-system-paths-on-nix.patch
rename to third_party/nixpkgs/pkgs/development/tools/build-managers/meson/boost-Do-not-add-system-paths-on-nix.patch
diff --git a/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.57/clear-old-rpath.patch b/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/clear-old-rpath.patch
similarity index 100%
rename from third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.57/clear-old-rpath.patch
rename to third_party/nixpkgs/pkgs/development/tools/build-managers/meson/clear-old-rpath.patch
diff --git a/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.60/default.nix b/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/default.nix
similarity index 95%
rename from third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.60/default.nix
rename to third_party/nixpkgs/pkgs/development/tools/build-managers/meson/default.nix
index a5efccfac9..aeddf457f4 100644
--- a/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.60/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/default.nix
@@ -57,6 +57,10 @@ python3.pkgs.buildPythonApplication rec {
     # unsandboxed non-NixOS builds, see:
     # https://github.com/NixOS/nixpkgs/issues/86131#issuecomment-711051774
     ./boost-Do-not-add-system-paths-on-nix.patch
+
+    # Meson tries to update ld.so.cache which breaks when the target architecture
+    # differs from the build host's.
+    ./do-not-update-ldconfig-cache.patch
   ];
 
   setupHook = ./setup-hook.sh;
diff --git a/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/do-not-update-ldconfig-cache.patch b/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/do-not-update-ldconfig-cache.patch
new file mode 100644
index 0000000000..884023aaa7
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/do-not-update-ldconfig-cache.patch
@@ -0,0 +1,12 @@
+diff --git a/mesonbuild/minstall.py b/mesonbuild/minstall.py
+index cb87faf5c..878ec4cd6 100644
+--- a/mesonbuild/minstall.py
++++ b/mesonbuild/minstall.py
+@@ -551,7 +551,6 @@ class Installer:
+                 self.install_emptydir(d, dm, destdir, fullprefix)
+                 self.install_data(d, dm, destdir, fullprefix)
+                 self.restore_selinux_contexts(destdir)
+-                self.apply_ldconfig(dm, destdir)
+                 self.run_install_script(d, destdir, fullprefix)
+                 if not self.did_install_something:
+                     self.log('Nothing to install.')
diff --git a/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.57/fix-rpath.patch b/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/fix-rpath.patch
similarity index 100%
rename from third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.57/fix-rpath.patch
rename to third_party/nixpkgs/pkgs/development/tools/build-managers/meson/fix-rpath.patch
diff --git a/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.60/gir-fallback-path.patch b/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/gir-fallback-path.patch
similarity index 100%
rename from third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.60/gir-fallback-path.patch
rename to third_party/nixpkgs/pkgs/development/tools/build-managers/meson/gir-fallback-path.patch
diff --git a/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.60/more-env-vars.patch b/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/more-env-vars.patch
similarity index 100%
rename from third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.60/more-env-vars.patch
rename to third_party/nixpkgs/pkgs/development/tools/build-managers/meson/more-env-vars.patch
diff --git a/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.57/setup-hook.sh b/third_party/nixpkgs/pkgs/development/tools/build-managers/meson/setup-hook.sh
similarity index 100%
rename from third_party/nixpkgs/pkgs/development/tools/build-managers/meson/0.57/setup-hook.sh
rename to third_party/nixpkgs/pkgs/development/tools/build-managers/meson/setup-hook.sh
diff --git a/third_party/nixpkgs/pkgs/development/tools/database/sqlfluff/default.nix b/third_party/nixpkgs/pkgs/development/tools/database/sqlfluff/default.nix
index 260920b2d1..4dcaa7c432 100644
--- a/third_party/nixpkgs/pkgs/development/tools/database/sqlfluff/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/database/sqlfluff/default.nix
@@ -5,13 +5,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "sqlfluff";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    hash = "sha256-sA9iMTDQ7SjaRG0/Uy+wGQ/2yQDqbZP6M5r1lFLBex4=";
+    hash = "sha256-BzO7S2sxZeklzIh1qRHJ4mGLsKLNpg8PuGGRVAkPlzc=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/third_party/nixpkgs/pkgs/development/tools/golangci-lint/default.nix b/third_party/nixpkgs/pkgs/development/tools/golangci-lint/default.nix
index 706d8e428f..122b4e0831 100644
--- a/third_party/nixpkgs/pkgs/development/tools/golangci-lint/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/golangci-lint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "golangci-lint";
-  version = "1.43.0";
+  version = "1.44.0";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     rev = "v${version}";
-    sha256 = "sha256-8aIKFLP1x9B5IMuyQ12LLIq79of4XwCdmDwae4T5MPg=";
+    sha256 = "sha256-2hEru7fnc8v7F/RrOB3jFdfLPYLpm0OupzJP6iORs+U=";
   };
 
-  vendorSha256 = "sha256-Mxy9VFBwcxyQtnhwuOFWK+0y0pQQDdqtoj0e2UXEo5k=";
+  vendorSha256 = "sha256-DLvhkTYCaXfNfehEgCNKSKlKaGHo623wBnEhNeTJbmQ=";
 
   doCheck = false;
 
diff --git a/third_party/nixpkgs/pkgs/development/tools/misc/intel-gpu-tools/default.nix b/third_party/nixpkgs/pkgs/development/tools/misc/intel-gpu-tools/default.nix
index eca59819ba..40cf1e14e9 100644
--- a/third_party/nixpkgs/pkgs/development/tools/misc/intel-gpu-tools/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/misc/intel-gpu-tools/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , pkg-config
 , libdrm
 , libpciaccess
@@ -45,6 +46,14 @@ stdenv.mkDerivation rec {
     sha256 = "1dwvxh1yplsh1a7h3gpp40g91v12cfxy6yy99s1v9yr2kwxikm1n";
   };
 
+  patches = [
+    # fix build with meson 0.60
+    (fetchpatch {
+      url = "https://github.com/freedesktop/xorg-intel-gpu-tools/commit/963917a3565466832a3b2fc22e9285d34a0bf944.patch";
+      sha256 = "sha256-goO2N7aK2dJYMhFGS1DlvjEYMSijN6stV6Q5z/RP8Ko=";
+    })
+  ];
+
   nativeBuildInputs = [ pkg-config utilmacros meson ninja flex bison gtk-doc docutils docbook_xsl ];
   buildInputs = [
     libdrm
diff --git a/third_party/nixpkgs/pkgs/development/tools/ocaml/dune/2.nix b/third_party/nixpkgs/pkgs/development/tools/ocaml/dune/2.nix
index f80fabedeb..c55aae7878 100644
--- a/third_party/nixpkgs/pkgs/development/tools/ocaml/dune/2.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/ocaml/dune/2.nix
@@ -6,11 +6,11 @@ else
 
 stdenv.mkDerivation rec {
   pname = "dune";
-  version = "2.9.1";
+  version = "2.9.2";
 
   src = fetchurl {
-    url = "https://github.com/ocaml/dune/releases/download/${version}/dune-${version}.tbz";
-    sha256 = "09lzq04b642iy0ljp59p32lgk3q8iphjh8fkdp69q29l5frgwx5k";
+    url = "https://github.com/ocaml/dune/releases/download/${version}/dune-site-${version}.tbz";
+    sha256 = "sha256-uOfMUH+5eLRfb9yDnysyAdLB5hHkqOlyyMjP2FIudEc=";
   };
 
   nativeBuildInputs = [ ocaml findlib ];
diff --git a/third_party/nixpkgs/pkgs/development/tools/ocaml/js_of_ocaml/ocamlbuild.nix b/third_party/nixpkgs/pkgs/development/tools/ocaml/js_of_ocaml/ocamlbuild.nix
index 6abb1ac1b3..3375e5ac5a 100644
--- a/third_party/nixpkgs/pkgs/development/tools/ocaml/js_of_ocaml/ocamlbuild.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/ocaml/js_of_ocaml/ocamlbuild.nix
@@ -7,5 +7,7 @@ buildDunePackage {
 
   inherit (js_of_ocaml-compiler) version src meta useDune2;
 
+  minimalOCamlVersion = "4.03";
+
   propagatedBuildInputs = [ ocamlbuild ];
 }
diff --git a/third_party/nixpkgs/pkgs/development/tools/ocaml/ocamlbuild/default.nix b/third_party/nixpkgs/pkgs/development/tools/ocaml/ocamlbuild/default.nix
index e3043d46ee..7f53ba9203 100644
--- a/third_party/nixpkgs/pkgs/development/tools/ocaml/ocamlbuild/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/ocaml/ocamlbuild/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, ocaml, findlib }:
 stdenv.mkDerivation rec {
-  name = "ocamlbuild-${version}";
+  pname = "ocaml${ocaml.version}-ocamlbuild";
   version = "0.14.0";
 
   src = fetchFromGitHub {
diff --git a/third_party/nixpkgs/pkgs/development/tools/pandoc/default.nix b/third_party/nixpkgs/pkgs/development/tools/pandoc/default.nix
index 475fa6a93e..a61f39c15b 100644
--- a/third_party/nixpkgs/pkgs/development/tools/pandoc/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/pandoc/default.nix
@@ -26,7 +26,7 @@ in
     # This should ideally be fixed in haskellPackages (or even Cabal),
     # but a minimal pandoc is important enough to patch it manually.
     disallowedReferences = [ haskellPackages.pandoc-types haskellPackages.HTTP ];
-    postInstall = ''
+    postInstall = drv.postInstall or "" + ''
       remove-references-to \
         -t ${haskellPackages.pandoc-types} \
         $out/bin/pandoc
diff --git a/third_party/nixpkgs/pkgs/development/tools/parsing/tree-sitter/default.nix b/third_party/nixpkgs/pkgs/development/tools/parsing/tree-sitter/default.nix
index 79dd9a6b57..e81e5e48bd 100644
--- a/third_party/nixpkgs/pkgs/development/tools/parsing/tree-sitter/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/parsing/tree-sitter/default.nix
@@ -91,7 +91,7 @@ let
           in
           {
             name =
-              (lib.strings.replaceStrings ["-"] ["_"]
+              (lib.strings.replaceStrings [ "-" ] [ "_" ]
                 (lib.strings.removePrefix "tree-sitter-"
                   (lib.strings.removeSuffix "-grammar" name)))
               + stdenv.hostPlatform.extensions.sharedLibrary;
diff --git a/third_party/nixpkgs/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-markdown.json b/third_party/nixpkgs/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-markdown.json
index c908bde0df..e34455069b 100644
--- a/third_party/nixpkgs/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-markdown.json
+++ b/third_party/nixpkgs/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-markdown.json
@@ -1,9 +1,9 @@
 {
-  "url": "https://github.com/ikatyang/tree-sitter-markdown",
-  "rev": "8b8b77af0493e26d378135a3e7f5ae25b555b375",
-  "date": "2021-04-18T20:49:21+08:00",
-  "path": "/nix/store/4z2k0q6rwqmb7vbqr4vgc26w28szlan3-tree-sitter-markdown",
-  "sha256": "1a2899x7i6dgbsrf13qzmh133hgfrlvmjsr3bbpffi1ixw1h7azk",
+  "url": "https://github.com/MDeiml/tree-sitter-markdown",
+  "rev": "8bee14c30ecadd55c2d65633973b4e81f93525e0",
+  "date": "2022-01-16T14:47:09+01:00",
+  "path": "/nix/store/cv7xqvcj4bjifzddkx5n2jd723dc6vlf-tree-sitter-markdown",
+  "sha256": "0vibmpp86pkqllfhb0kg6zhaz09sh8m6a2d1xa8p2qdi7ryy7wqa",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/third_party/nixpkgs/pkgs/development/tools/parsing/tree-sitter/update.nix b/third_party/nixpkgs/pkgs/development/tools/parsing/tree-sitter/update.nix
index 328c0e8bb6..c0a5812d7e 100644
--- a/third_party/nixpkgs/pkgs/development/tools/parsing/tree-sitter/update.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/parsing/tree-sitter/update.nix
@@ -117,7 +117,7 @@ let
       repo = "tree-sitter-make";
     };
     "tree-sitter-markdown" = {
-      orga = "ikatyang";
+      orga = "MDeiml";
       repo = "tree-sitter-markdown";
     };
     "tree-sitter-rst" = {
diff --git a/third_party/nixpkgs/pkgs/development/web/flyctl/default.nix b/third_party/nixpkgs/pkgs/development/web/flyctl/default.nix
index 7bef336a5f..fb1eec870b 100644
--- a/third_party/nixpkgs/pkgs/development/web/flyctl/default.nix
+++ b/third_party/nixpkgs/pkgs/development/web/flyctl/default.nix
@@ -27,6 +27,6 @@ buildGoModule rec {
     description = "Command line tools for fly.io services";
     homepage = "https://fly.io/";
     license = licenses.asl20;
-    maintainers = with maintainers; [ aaronjanse ];
+    maintainers = with maintainers; [ aaronjanse jsierles ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/games/legendary-gl/default.nix b/third_party/nixpkgs/pkgs/games/legendary-gl/default.nix
index fe3761f12d..082b9220c0 100644
--- a/third_party/nixpkgs/pkgs/games/legendary-gl/default.nix
+++ b/third_party/nixpkgs/pkgs/games/legendary-gl/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonApplication rec {
   pname = "legendary-gl"; # Name in pypi
-  version = "0.20.24";
+  version = "0.20.25";
 
   src = fetchFromGitHub {
     owner = "derrod";
     repo = "legendary";
     rev = version;
-    sha256 = "sha256-4VN/2FoAXTaumPsplV9wgdUSQsFitC1hqWveAW/yt58=";
+    sha256 = "07z5ffi7lnvs64pksy30fbfv2i11dkkycyh31vyc4y7fsn1vd0vf";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/third_party/nixpkgs/pkgs/games/rogue/default.nix b/third_party/nixpkgs/pkgs/games/rogue/default.nix
index 127d65ff36..4865b85bbe 100644
--- a/third_party/nixpkgs/pkgs/games/rogue/default.nix
+++ b/third_party/nixpkgs/pkgs/games/rogue/default.nix
@@ -15,9 +15,6 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ncurses ];
 
-  # Fix build for recent ncurses versions
-  NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS=1";
-
   meta = with lib; {
     homepage = "http://rogue.rogueforge.net/rogue-5-4/";
     description = "The final version of the original Rogue game developed for the UNIX operating system";
diff --git a/third_party/nixpkgs/pkgs/games/shattered-pixel-dungeon/default.nix b/third_party/nixpkgs/pkgs/games/shattered-pixel-dungeon/default.nix
index 8dc205d51b..d8bf9d5f32 100644
--- a/third_party/nixpkgs/pkgs/games/shattered-pixel-dungeon/default.nix
+++ b/third_party/nixpkgs/pkgs/games/shattered-pixel-dungeon/default.nix
@@ -10,15 +10,15 @@
 
 let
   pname = "shattered-pixel-dungeon";
-  version = "1.1.0";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "00-Evan";
     repo = "shattered-pixel-dungeon";
     # NOTE: always use the commit sha, not the tag. Tags _will_ disappear!
     # https://github.com/00-Evan/shattered-pixel-dungeon/issues/596
-    rev = "7f29a03078647ea503d3c866476568511aa5af84";
-    sha256 = "sha256-+d8X7WFGX8YGb2rGu8jVO82QdlF9ec+6+Ti5wGEIwRg=";
+    rev = "5d1a2dce6b554b40f6737ead45d411fd98f4c67d";
+    sha256 = "sha256-Vu7K0NnqFY298BIQV9AwNEahV0eJl14tAeq+rw6KrtM=";
   };
 
   postPatch = ''
diff --git a/third_party/nixpkgs/pkgs/games/vdrift/default.nix b/third_party/nixpkgs/pkgs/games/vdrift/default.nix
index 04f65cf793..1939779464 100644
--- a/third_party/nixpkgs/pkgs/games/vdrift/default.nix
+++ b/third_party/nixpkgs/pkgs/games/vdrift/default.nix
@@ -12,7 +12,7 @@
 , bullet
 , curl
 , gettext
-, writeTextFile
+, writeShellScriptBin
 
 , data ? fetchsvn {
     url = "svn://svn.code.sf.net/p/vdrift/code/vdrift-data";
@@ -54,21 +54,15 @@ let
     };
   };
   wrappedName = "vdrift-${version}-with-data-${toString data.rev}";
-in writeTextFile {
+in
+(writeShellScriptBin "vdrift"  ''
+  export VDRIFT_DATA_DIRECTORY="${data}"
+  exec ${bin}/bin/vdrift "$@"
+'').overrideAttrs (_: {
   name = wrappedName;
-  text = ''
-    export VDRIFT_DATA_DIRECTORY="${data}"
-    exec ${bin}/bin/vdrift "$@"
-  '';
-  destination = "/bin/vdrift";
-  executable = true;
-  checkPhase = ''
-    ${stdenv.shell} -n $out/bin/vdrift
-  '';
-} // {
   meta = bin.meta // {
     hydraPlatforms = [ ];
   };
   unwrapped = bin;
   inherit bin data;
-}
+})
diff --git a/third_party/nixpkgs/pkgs/games/vintagestory/default.nix b/third_party/nixpkgs/pkgs/games/vintagestory/default.nix
index 5a4e8fe852..46d847dee6 100644
--- a/third_party/nixpkgs/pkgs/games/vintagestory/default.nix
+++ b/third_party/nixpkgs/pkgs/games/vintagestory/default.nix
@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation rec {
   pname = "vintagestory";
-  version = "1.16.0";
+  version = "1.16.1";
 
   src = fetchurl {
     url = "https://cdn.vintagestory.at/gamefiles/stable/vs_archive_${version}.tar.gz";
-    sha256 = "sha256-1lAcE+RwK16xPTGxGCz2Pdq6GhmXFwy60CSZyq3hgnM=";
+    sha256 = "sha256-o3FMuMvWxj9ECj77H/q5QkpcFbcZ0eNQ1OS51pUal3c=";
   };
 
   nativeBuildInputs = [ makeWrapper copyDesktopItems ];
diff --git a/third_party/nixpkgs/pkgs/misc/cups/default.nix b/third_party/nixpkgs/pkgs/misc/cups/default.nix
index bbada33054..0e9977f564 100644
--- a/third_party/nixpkgs/pkgs/misc/cups/default.nix
+++ b/third_party/nixpkgs/pkgs/misc/cups/default.nix
@@ -28,14 +28,14 @@ stdenv.mkDerivation rec {
   pname = "cups";
 
   # After 2.2.6, CUPS requires headers only available in macOS 10.12+
-  version = if stdenv.isDarwin then "2.2.6" else "2.3.3op2";
+  version = if stdenv.isDarwin then "2.2.6" else "2.4.0";
 
   src = fetchurl (if stdenv.isDarwin then {
     url = "https://github.com/apple/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
     sha256 = "16qn41b84xz6khrr2pa2wdwlqxr29rrrkjfi618gbgdkq9w5ff20";
   } else {
     url = "https://github.com/OpenPrinting/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
-    sha256 = "1pwndz4gwkm7311wkhhzlw2diy7wbck7yy026jbaxh3rprdmgcyy";
+    sha256 = "1pm6lf08z8vgs62g5b5rjw32qy3vr0q3sgidpg2lfs6a530wxgls";
   });
 
   outputs = [ "out" "lib" "dev" "man" ];
diff --git a/third_party/nixpkgs/pkgs/misc/ghostscript/default.nix b/third_party/nixpkgs/pkgs/misc/ghostscript/default.nix
index 5e27e5573c..e80ad8a839 100644
--- a/third_party/nixpkgs/pkgs/misc/ghostscript/default.nix
+++ b/third_party/nixpkgs/pkgs/misc/ghostscript/default.nix
@@ -30,22 +30,18 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "ghostscript";
-  version = "9.53.3";
+  version = "9.55.0";
 
   src = fetchurl {
     url = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs9${lib.versions.minor version}${lib.versions.patch version}/${pname}-${version}.tar.xz";
-    sha512 = "2vif3vgxa5wma16yxvhhkymk4p309y5204yykarq94r5rk890556d2lj5w7acnaa2ymkym6y0zd4vq9sy9ca2346igg2c6dxqkjr0zb";
+    sha512 = "27g72152mlwlalg232jxdhaf3ykgmqwi2pccbkwfygql1h9iz40plfbwbs1n0fkvm4zwzg5r9cr8g7w2dxih4jldiidv7rflxdy1is2";
   };
 
   patches = [
     (fetchpatch {
-      url = "https://github.com/ArtifexSoftware/ghostpdl/commit/41ef9a0bc36b9db7115fbe9623f989bfb47bbade.patch";
-      sha256 = "1qpc6q1fpxshqc0mqgg36kng47kgljk50bmr8p7wn21jgfkh7m8w";
-    })
-    (fetchpatch {
-      url = "https://git.ghostscript.com/?p=ghostpdl.git;a=patch;h=a9bd3dec9fde";
-      name = "CVE-2021-3781.patch";
-      sha256 = "FvbH7cb3ZDCbNRz9DF0kDmLdF7OWNYk90wv44pimU58=";
+      name = "fix-non-vendored-lcms2-typo.patch";
+      url = "https://github.com/ArtifexSoftware/ghostpdl/commit/830afae5454dea3bff903869d82022306890a96c.patch";
+      sha256 = "1w9yspsgxyabvrw9ld6pv6pb7708c44ihjqvag7qqh9v1lhm48j0";
     })
     ./urw-font-files.patch
     ./doc-no-ref.diff
@@ -88,6 +84,7 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--with-system-libtiff"
     "--enable-dynamic"
+    "--without-tesseract"
   ]
   ++ lib.optional x11Support "--with-x"
   ++ lib.optionals cupsSupport [
diff --git a/third_party/nixpkgs/pkgs/misc/sagetex/default.nix b/third_party/nixpkgs/pkgs/misc/sagetex/default.nix
new file mode 100644
index 0000000000..a30f037d9c
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/misc/sagetex/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, texlive
+}:
+
+stdenv.mkDerivation rec {
+  pname = "sagetex";
+  version = "3.6";
+  passthru.tlType = "run";
+
+  src = fetchFromGitHub {
+    owner = "sagemath";
+    repo = "sagetex";
+    rev = "v${version}";
+    sha256 = "8iHcJbaY/dh0vmvYyd6zj1ZbuJRaJGb6bUBK1v4gXWU=";
+  };
+
+  buildInputs = [
+    texlive.combined.scheme-basic
+  ];
+
+  buildPhase = ''
+    make sagetex.sty
+  '';
+
+  installPhase = ''
+    path="$out/tex/latex/sagetex"
+    mkdir -p "$path"
+    cp -va *.sty *.cfg *.def "$path/"
+  '';
+
+  meta = with lib; {
+    description = "Embed code, results of computations, and plots from Sage into LaTeX documents";
+    homepage = "https://github.com/sagemath/sagetex";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ alexnortung ];
+    platforms = platforms.all;
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/misc/scrcpy/default.nix b/third_party/nixpkgs/pkgs/misc/scrcpy/default.nix
index 871e5bff6c..594561593e 100644
--- a/third_party/nixpkgs/pkgs/misc/scrcpy/default.nix
+++ b/third_party/nixpkgs/pkgs/misc/scrcpy/default.nix
@@ -47,7 +47,6 @@ stdenv.mkDerivation rec {
     echo -n > server/meson.build
   '';
 
-  mesonFlags = [ "-Doverride_server_path=${prebuilt_server}" ];
   postInstall = ''
     mkdir -p "$out/share/scrcpy"
     ln -s "${prebuilt_server}" "$out/share/scrcpy/scrcpy-server"
diff --git a/third_party/nixpkgs/pkgs/misc/vim-plugins/generated.nix b/third_party/nixpkgs/pkgs/misc/vim-plugins/generated.nix
index fa706c5e00..c3599c908a 100644
--- a/third_party/nixpkgs/pkgs/misc/vim-plugins/generated.nix
+++ b/third_party/nixpkgs/pkgs/misc/vim-plugins/generated.nix
@@ -471,6 +471,18 @@ final: prev:
     meta.homepage = "https://github.com/bkad/camelcasemotion/";
   };
 
+  catppuccin-nvim = buildVimPluginFrom2Nix {
+    pname = "catppuccin-nvim";
+    version = "2022-01-23";
+    src = fetchFromGitHub {
+      owner = "catppuccin";
+      repo = "nvim";
+      rev = "c63ad901576729c46f443630a1fb61e4a7e93a0f";
+      sha256 = "1w90zb46fdvpp0b1i559yj3dvijfskl9dlqjkgn7fr8513fgblrz";
+    };
+    meta.homepage = "https://github.com/catppuccin/nvim/";
+  };
+
   caw-vim = buildVimPluginFrom2Nix {
     pname = "caw.vim";
     version = "2021-09-20";
@@ -485,12 +497,12 @@ final: prev:
 
   chadtree = buildVimPluginFrom2Nix {
     pname = "chadtree";
-    version = "2022-01-22";
+    version = "2022-01-24";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "chadtree";
-      rev = "e6fe7bcc3d354f7da68bea64c612eb2f78e959d1";
-      sha256 = "0rq82dz1s7xshbdydah50vpzhakbzcbxkx4j5mgg5pwgbglaj9xj";
+      rev = "7f1b916fabbae134b37c0a5ac09f0bfc555ab010";
+      sha256 = "0xmm0fikqj95m836nv8y6cyvqkn3p0iklqhqj32cxqfrvh0mbnb6";
     };
     meta.homepage = "https://github.com/ms-jpq/chadtree/";
   };
@@ -905,12 +917,12 @@ final: prev:
 
   coc-nvim = buildVimPluginFrom2Nix {
     pname = "coc.nvim";
-    version = "2022-01-21";
+    version = "2022-01-22";
     src = fetchFromGitHub {
       owner = "neoclide";
       repo = "coc.nvim";
-      rev = "6a510523b0bf697bffe5ba77d0e404532fd92e65";
-      sha256 = "1xp8zvj1wbywfgy2kgvqmxpw675wlmpjdgbqzmb53rjjhsb9w107";
+      rev = "5b8cc589540e82e6862b2948924f06461261a09a";
+      sha256 = "0j1v9nckv86b4z2pz6b9kssp59fl3da9hyadjplnqgilbbcqplxm";
     };
     meta.homepage = "https://github.com/neoclide/coc.nvim/";
   };
@@ -1122,12 +1134,12 @@ final: prev:
 
   conjure = buildVimPluginFrom2Nix {
     pname = "conjure";
-    version = "2021-12-23";
+    version = "2022-01-22";
     src = fetchFromGitHub {
       owner = "Olical";
       repo = "conjure";
-      rev = "2717348d1a0687327f59880914fa260e4ad9c685";
-      sha256 = "1fgn5j0sswnncbdkd5283rn2lfrszq00m7ilarm4ks006yxin3hq";
+      rev = "93a668527b203a3353ef2bd5337f6c55119bb7e6";
+      sha256 = "1a5w1wmc5vx3y32rci5km73wj6vq6cjgc4ss4w0w95s7sk8kaggn";
     };
     meta.homepage = "https://github.com/Olical/conjure/";
   };
@@ -1170,24 +1182,24 @@ final: prev:
 
   coq_nvim = buildVimPluginFrom2Nix {
     pname = "coq_nvim";
-    version = "2022-01-17";
+    version = "2022-01-24";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "coq_nvim";
-      rev = "9546c14f6664df71b9427b38fcebb7800b69799e";
-      sha256 = "0nr2w65mirbrpr7iyimwjq7l5vyi4qr46ncic3whwlmyi2amkrjk";
+      rev = "c878e9f1886f86a0210753fa9c146b2e863d84bc";
+      sha256 = "1nhzj0pslfzzski3z0synv5vpacfbx359ggsq1z5d9cyapsxchkx";
     };
     meta.homepage = "https://github.com/ms-jpq/coq_nvim/";
   };
 
   Coqtail = buildVimPluginFrom2Nix {
     pname = "Coqtail";
-    version = "2022-01-21";
+    version = "2022-01-23";
     src = fetchFromGitHub {
       owner = "whonore";
       repo = "Coqtail";
-      rev = "cbe08b44bf2cba835c541f4b7eddc9f533dbe584";
-      sha256 = "1g32297zkvdrmvjacwf6ig2q7whvzj8wzrxb71vzr9qskp0qx81v";
+      rev = "a036b5e3c15baeda71bd76f4b7e9d3de9a057e42";
+      sha256 = "1i2yygw4j6g7zihcbja58k2qh0sdn3mqbx277k91bdkf4y1hjdxd";
     };
     meta.homepage = "https://github.com/whonore/Coqtail/";
   };
@@ -1772,24 +1784,24 @@ final: prev:
 
   edge = buildVimPluginFrom2Nix {
     pname = "edge";
-    version = "2022-01-19";
+    version = "2022-01-24";
     src = fetchFromGitHub {
       owner = "sainnhe";
       repo = "edge";
-      rev = "8ddb984be3eb2b087c5a621513c8f1f9cc191f4f";
-      sha256 = "1amhf4csmp10ry3g7qqp4cgzz06011fkgncazpfp1l7gd5d3x1as";
+      rev = "840bbfd5158976ae6e0f0b79d110e40bdabd084c";
+      sha256 = "16gs2jfqwn081f12gmdgzkjxxha278rm57p95dsf752374gkn5v5";
     };
     meta.homepage = "https://github.com/sainnhe/edge/";
   };
 
   editorconfig-vim = buildVimPluginFrom2Nix {
     pname = "editorconfig-vim";
-    version = "2021-07-25";
+    version = "2022-01-22";
     src = fetchFromGitHub {
       owner = "editorconfig";
       repo = "editorconfig-vim";
-      rev = "3078cd10b28904e57d878c0d0dab42aa0a9fdc89";
-      sha256 = "1zjwhg3g56skqi9lndjhn9fh8hr478yvns8xz9xpnzcgzdaqbi1w";
+      rev = "a8e3e66deefb6122f476c27cee505aaae93f7109";
+      sha256 = "19k6nii3p6a4vfyf7xxrkhj7wfamjivdp22bn1mhx4zcw8h01lkn";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/editorconfig/editorconfig-vim/";
@@ -2063,12 +2075,12 @@ final: prev:
 
   friendly-snippets = buildVimPluginFrom2Nix {
     pname = "friendly-snippets";
-    version = "2022-01-20";
+    version = "2022-01-23";
     src = fetchFromGitHub {
       owner = "rafamadriz";
       repo = "friendly-snippets";
-      rev = "35bacce3c903dff2852e87a13196cad0dd166093";
-      sha256 = "0inq7d48j4ck3zfkbvmi76xvis1sybk15mda23zfnm6zj0k3hjh1";
+      rev = "a8efb538f4be58b4f4586bc964f9f10496c05e31";
+      sha256 = "0yj7ijr091jsd8rny4zx34427w8v87iywysig5pgrz7iz421wib4";
     };
     meta.homepage = "https://github.com/rafamadriz/friendly-snippets/";
   };
@@ -2147,24 +2159,24 @@ final: prev:
 
   fzf-lsp-nvim = buildVimPluginFrom2Nix {
     pname = "fzf-lsp.nvim";
-    version = "2022-01-13";
+    version = "2022-01-23";
     src = fetchFromGitHub {
       owner = "gfanto";
       repo = "fzf-lsp.nvim";
-      rev = "bd55968ff9e62a1760a7bc96126b021cc34d0449";
-      sha256 = "0znnwgdpkhnd029ybfyyh3jj3l11a20g5zynw33xjdwkh4w68nrc";
+      rev = "74a8b7d3f39dbcbcb920a99b63adc4867363e8c3";
+      sha256 = "0c80shgzxz90213qhx7bvd1fkzkdq9g79m157dnwvzh121jmpdap";
     };
     meta.homepage = "https://github.com/gfanto/fzf-lsp.nvim/";
   };
 
   fzf-vim = buildVimPluginFrom2Nix {
     pname = "fzf.vim";
-    version = "2022-01-16";
+    version = "2022-01-24";
     src = fetchFromGitHub {
       owner = "junegunn";
       repo = "fzf.vim";
-      rev = "66cb8b826477671fba81c2db5fbb080c7b89f955";
-      sha256 = "1gi83az726817chmrhp8agzn111m2qp76khw5ycnjmba3j9666zy";
+      rev = "91332acb1c48e7080539c5b5cd131816341c738c";
+      sha256 = "0s8695m25v2j5hpp80g3hd28g7ja17yxih5cd71jqmqvl3zwmqrg";
     };
     meta.homepage = "https://github.com/junegunn/fzf.vim/";
   };
@@ -2303,12 +2315,12 @@ final: prev:
 
   gitsigns-nvim = buildVimPluginFrom2Nix {
     pname = "gitsigns.nvim";
-    version = "2022-01-20";
+    version = "2022-01-22";
     src = fetchFromGitHub {
       owner = "lewis6991";
       repo = "gitsigns.nvim";
-      rev = "ddffc618ea9e11ae57129549e0eccf832cb8b37d";
-      sha256 = "0mkv3pl08i4920px3k1ffy65lnmycv717n65fmv94fyqa98al3zb";
+      rev = "f43cee333fdfeb27aae86bab73a38c5885d5c7f4";
+      sha256 = "1rxx8abg4kx6n6xbg2fyw3cjixcnynkg4l00xjh4yk44bi0f65f8";
     };
     meta.homepage = "https://github.com/lewis6991/gitsigns.nvim/";
   };
@@ -2447,12 +2459,12 @@ final: prev:
 
   gruvbox-material = buildVimPluginFrom2Nix {
     pname = "gruvbox-material";
-    version = "2022-01-19";
+    version = "2022-01-24";
     src = fetchFromGitHub {
       owner = "sainnhe";
       repo = "gruvbox-material";
-      rev = "74cad39cb9abdf89fd55b377bd814a913fcc4141";
-      sha256 = "0myf5qhb1bbdp8n3xwj1aa3p4rv0xq998arnparnzi5mxlvmjarz";
+      rev = "d043cd49c344e41cd07b19c5252ee31e356c8ebf";
+      sha256 = "10m7wk8p6kwc8zgfl64r901vkxrsfv9bwnzxi4cx3s03vvkq1c00";
     };
     meta.homepage = "https://github.com/sainnhe/gruvbox-material/";
   };
@@ -2699,12 +2711,12 @@ final: prev:
 
   indent-blankline-nvim = buildVimPluginFrom2Nix {
     pname = "indent-blankline.nvim";
-    version = "2022-01-14";
+    version = "2022-01-22";
     src = fetchFromGitHub {
       owner = "lukas-reineke";
       repo = "indent-blankline.nvim";
-      rev = "5a04e47278344326578a3d8717f1fc44f7834b2f";
-      sha256 = "19jij8i9a4n9cb2dkak9155p99yp68nx2k0dx1bw1k9rf7fwm4il";
+      rev = "2e35f7dcdc72f39b37c21e43cdb538d7a41c7e07";
+      sha256 = "1hgj7k3ml7n11nqn7cmn7bpls0rm6xh5z4sgrsgjyvrdnw6wckla";
     };
     meta.homepage = "https://github.com/lukas-reineke/indent-blankline.nvim/";
   };
@@ -2892,12 +2904,12 @@ final: prev:
 
   kanagawa-nvim = buildVimPluginFrom2Nix {
     pname = "kanagawa.nvim";
-    version = "2022-01-21";
+    version = "2022-01-23";
     src = fetchFromGitHub {
       owner = "rebelot";
       repo = "kanagawa.nvim";
-      rev = "e308a9e5e8b527d646bf485b9148db894a617560";
-      sha256 = "07hky7mqz8zj21y0cvb7fadiv0fmxzkm6f2i490d85dj3i3njijv";
+      rev = "7a3442f416174665e9114d617a9a366438bc9f3b";
+      sha256 = "12nilfk56va7y93yvi6nkh2fqw1a4w7bhzh085ir0kss66nma1bp";
     };
     meta.homepage = "https://github.com/rebelot/kanagawa.nvim/";
   };
@@ -3012,12 +3024,12 @@ final: prev:
 
   lean-nvim = buildVimPluginFrom2Nix {
     pname = "lean.nvim";
-    version = "2022-01-20";
+    version = "2022-01-24";
     src = fetchFromGitHub {
       owner = "Julian";
       repo = "lean.nvim";
-      rev = "8dc39f1ce00cf50890e7a55c3bc24017531338f7";
-      sha256 = "18aywn1hkhpxc3fgy9xys5fjh0l69nrgdwaiy9fzfqy8d6fk3ssf";
+      rev = "4d613c6aea73be9b8882d5710b11f502ef8692db";
+      sha256 = "16lcr9bbiq33agd9p1cwrrxmzsj3xmva1lva8ay4zrm1v2v45jn5";
     };
     meta.homepage = "https://github.com/Julian/lean.nvim/";
   };
@@ -3228,12 +3240,12 @@ final: prev:
 
   litee-filetree-nvim = buildVimPluginFrom2Nix {
     pname = "litee-filetree.nvim";
-    version = "2022-01-20";
+    version = "2022-01-24";
     src = fetchFromGitHub {
       owner = "ldelossa";
       repo = "litee-filetree.nvim";
-      rev = "e3cbf471d1c721c202cef17060c8b4737a73875b";
-      sha256 = "1003ib2ldgi6zansdlhbvaiylywiazvjy8dlmd0rs0chlqqd4g36";
+      rev = "15014fe3855848ebe48431c789d8e8ec2e9efe34";
+      sha256 = "1xwysily6lh8z9wd8g983102lfj4543dpqzfk7cr7zqd864qj951";
     };
     meta.homepage = "https://github.com/ldelossa/litee-filetree.nvim/";
   };
@@ -3323,12 +3335,12 @@ final: prev:
 
   lsp_signature-nvim = buildVimPluginFrom2Nix {
     pname = "lsp_signature.nvim";
-    version = "2022-01-14";
+    version = "2022-01-23";
     src = fetchFromGitHub {
       owner = "ray-x";
       repo = "lsp_signature.nvim";
-      rev = "68de04e557acdce7cf0a77defbef7ca9f0c6a457";
-      sha256 = "00amvq05cr2y6kb63a2z5xnbj5vp7hb1ycl98y5ikm61rbi2d60b";
+      rev = "64eb5cc8961e54b2888d363bb94d551203080b45";
+      sha256 = "0v3dza9mp351715i87x75zxkm0d5i7v77a5zq8c8mlhz1v31z0vx";
     };
     meta.homepage = "https://github.com/ray-x/lsp_signature.nvim/";
   };
@@ -3383,24 +3395,24 @@ final: prev:
 
   lualine-nvim = buildVimPluginFrom2Nix {
     pname = "lualine.nvim";
-    version = "2022-01-12";
+    version = "2022-01-24";
     src = fetchFromGitHub {
       owner = "nvim-lualine";
       repo = "lualine.nvim";
-      rev = "70691ae350fdbe1f15758e3b8e2973742a7967a9";
-      sha256 = "02djs872iy9w675yrh2777d5rbb9maz26y8nfwdw9j2xm182xm6y";
+      rev = "9208bae98fd5d1ab6145868a8c48bfee53c1a499";
+      sha256 = "1dz4kg3l79d128jgqs6cs8ikvr108z46ijv36wq7pw3dam4ybnaw";
     };
     meta.homepage = "https://github.com/nvim-lualine/lualine.nvim/";
   };
 
   luasnip = buildVimPluginFrom2Nix {
     pname = "luasnip";
-    version = "2022-01-13";
+    version = "2022-01-24";
     src = fetchFromGitHub {
       owner = "l3mon4d3";
       repo = "luasnip";
-      rev = "0222ee63c9e4b80e6000d064f8efd8edcc6d0c48";
-      sha256 = "1hjzzrxlq0h59mvd0ids62k5ps1invvawdj60q8my3arrlfbnb4v";
+      rev = "59576a5cf28556a393eedfe38467e998288fc905";
+      sha256 = "1bwmzvsm9d6ilq616697rwk3j29i0q3nzwdyapjyxdyhp9rivgsj";
     };
     meta.homepage = "https://github.com/l3mon4d3/luasnip/";
   };
@@ -3515,12 +3527,12 @@ final: prev:
 
   mini-nvim = buildVimPluginFrom2Nix {
     pname = "mini.nvim";
-    version = "2022-01-20";
+    version = "2022-01-23";
     src = fetchFromGitHub {
       owner = "echasnovski";
       repo = "mini.nvim";
-      rev = "91969103413bb2e29e4b4d7841e68a8a65959ccd";
-      sha256 = "1r74vs6kxdy2329xiqqczk1i1zpfiplrxk2pahmw06jf2ff6y3qn";
+      rev = "a89d87667eec94915121d8f5caf199f63f9ff81d";
+      sha256 = "0l6k5djgvhkl7y86g7wmaxs0yq5nv0g6aa46kjjc81lvycj9qg3m";
     };
     meta.homepage = "https://github.com/echasnovski/mini.nvim/";
   };
@@ -3947,12 +3959,12 @@ final: prev:
 
   neorg = buildVimPluginFrom2Nix {
     pname = "neorg";
-    version = "2022-01-21";
+    version = "2022-01-24";
     src = fetchFromGitHub {
       owner = "nvim-neorg";
       repo = "neorg";
-      rev = "e8b8cb0a75a4ca2da6b5a9bec79cd2002ef03882";
-      sha256 = "1nf74v4147jyc1cb3scvja49160wcjqvgppiq7whgili1ic8s1d6";
+      rev = "02b185ff04083df22d8d1f957eaee9d1d50c6684";
+      sha256 = "1kqcnyk8hb80w4ngggjmhnqnpmks3bzb8l0sqh3vdxzpz2d8bpj1";
     };
     meta.homepage = "https://github.com/nvim-neorg/neorg/";
   };
@@ -4247,24 +4259,24 @@ final: prev:
 
   nui-nvim = buildVimPluginFrom2Nix {
     pname = "nui.nvim";
-    version = "2022-01-20";
+    version = "2022-01-23";
     src = fetchFromGitHub {
       owner = "MunifTanjim";
       repo = "nui.nvim";
-      rev = "3d4e81891ae0dfa7afcd1f2b5e96c69ec1e36072";
-      sha256 = "1hdrq6v9dyrx79f0cqqp7b8w1snbwvmr562g1lmi94jv636agmg5";
+      rev = "0d603c19171fb2e127bc128e9229d48340a6beeb";
+      sha256 = "1d6j3syv86afj0cpfqy8jcwj8pxm53wa1xjl76f1j5h7y6ba1237";
     };
     meta.homepage = "https://github.com/MunifTanjim/nui.nvim/";
   };
 
   null-ls-nvim = buildVimPluginFrom2Nix {
     pname = "null-ls.nvim";
-    version = "2022-01-21";
+    version = "2022-01-23";
     src = fetchFromGitHub {
       owner = "jose-elias-alvarez";
       repo = "null-ls.nvim";
-      rev = "5213916f51a178287cf5162354f2f7c2c4e204bb";
-      sha256 = "0v34s75srr2ds3jw100hjr2mwbycwhvrv6y02ddzmgw0bsqfgw9c";
+      rev = "0adceda4fb3fdd25ff015e68ebe176268b12bb2c";
+      sha256 = "1nczxn4mxnl5qylzg0kmd7jbybf856x554xv83kwhjv4zzwpaj84";
     };
     meta.homepage = "https://github.com/jose-elias-alvarez/null-ls.nvim/";
   };
@@ -4293,18 +4305,6 @@ final: prev:
     meta.homepage = "https://github.com/ChristianChiarulli/nvcode-color-schemes.vim/";
   };
 
-  catppuccin-nvim = buildVimPluginFrom2Nix {
-    pname = "catppuccin-nvim";
-    version = "2022-01-21";
-    src = fetchFromGitHub {
-      owner = "catppuccin";
-      repo = "nvim";
-      rev = "baf9a2c5d81f4336b0504e35c148482535dc2ac9";
-      sha256 = "00nma5a4jybncm3dj388p03nd4kkpj11l1cmd1dfmnzd41iaia99";
-    };
-    meta.homepage = "https://github.com/catppuccin/nvim/";
-  };
-
   nvim-ale-diagnostic = buildVimPluginFrom2Nix {
     pname = "nvim-ale-diagnostic";
     version = "2021-11-06";
@@ -4379,12 +4379,12 @@ final: prev:
 
   nvim-cmp = buildVimPluginFrom2Nix {
     pname = "nvim-cmp";
-    version = "2022-01-20";
+    version = "2022-01-24";
     src = fetchFromGitHub {
       owner = "hrsh7th";
       repo = "nvim-cmp";
-      rev = "1797f9e1acd2e0b5b4b6805928aebc1dcc0ecbff";
-      sha256 = "122il3siyyqpb0bshg0mx7mi6ykjqf261hkci8pg0ybqwzjvz231";
+      rev = "27123b1297e37109bdb2fd0cd4638621b0eab65a";
+      sha256 = "0wn1jb9pfq541k7lq6qm6434p5vgd6bj7f374rn56x93nxlll1g1";
     };
     meta.homepage = "https://github.com/hrsh7th/nvim-cmp/";
   };
@@ -4451,24 +4451,24 @@ final: prev:
 
   nvim-cursorline = buildVimPluginFrom2Nix {
     pname = "nvim-cursorline";
-    version = "2021-09-28";
+    version = "2022-01-22";
     src = fetchFromGitHub {
       owner = "yamatsum";
       repo = "nvim-cursorline";
-      rev = "e4fa1d90c2c6169c18f7ea3275845a2de9335dbf";
-      sha256 = "06jvagrdvizygr1l4d6dbb0nrri6c2zv09xrzxysxmi3hjvf6zx8";
+      rev = "88232dd52f186e3bff9aa594aa9c3a062f400642";
+      sha256 = "1lgcfwkc3kq9jyh7r19v6rpmbflq2nplg46kvb79l07212pz64s0";
     };
     meta.homepage = "https://github.com/yamatsum/nvim-cursorline/";
   };
 
   nvim-dap = buildVimPluginFrom2Nix {
     pname = "nvim-dap";
-    version = "2022-01-19";
+    version = "2022-01-22";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-dap";
-      rev = "675e13a3f4dba3c33f04d4cf3b575d72bb7b8a4a";
-      sha256 = "0irczvrvq3r2g43bxxh07plj0264z6rabwc9iivgb93wqv67w3dz";
+      rev = "c9a58267524f560112ecb6faa36ab2b5bc2f78a3";
+      sha256 = "0sga5dv5zrm5cyxk0s3dp9avpx7j9nag8d8jv6bgzbq772szbfwf";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-dap/";
   };
@@ -4631,12 +4631,12 @@ final: prev:
 
   nvim-lint = buildVimPluginFrom2Nix {
     pname = "nvim-lint";
-    version = "2022-01-20";
+    version = "2022-01-24";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-lint";
-      rev = "187c70ffc6d1eb093bf1c9c102555565f53c100b";
-      sha256 = "15n1j8vjy5q9nf716zcxmycfiy9fxcgqljj7wbi42q6h4xgxnpm7";
+      rev = "e83f80295737e8f470329d768f6ae325bcd0bb23";
+      sha256 = "12b78p8lw94ixwgcl71chwssi6li7q46aj0ahdna9v77hk2mlvc8";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-lint/";
   };
@@ -4655,12 +4655,12 @@ final: prev:
 
   nvim-lspconfig = buildVimPluginFrom2Nix {
     pname = "nvim-lspconfig";
-    version = "2022-01-21";
+    version = "2022-01-24";
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "nvim-lspconfig";
-      rev = "58d2ba6b968539a20d701be0bf98ae154456e265";
-      sha256 = "04l70b5sl1c98gmk9s9zwa39gbp1w46ivwmyryr96g0znidh3ryk";
+      rev = "12a0d3a81af173a330c957ca51b81e5f66144ef8";
+      sha256 = "06qxdr8dzc7i9fvn9yyjnb1yypdgj35dppivx8752c8czd5bmshw";
     };
     meta.homepage = "https://github.com/neovim/nvim-lspconfig/";
   };
@@ -4751,12 +4751,12 @@ final: prev:
 
   nvim-solarized-lua = buildVimPluginFrom2Nix {
     pname = "nvim-solarized-lua";
-    version = "2022-01-18";
+    version = "2022-01-22";
     src = fetchFromGitHub {
       owner = "ishan9299";
       repo = "nvim-solarized-lua";
-      rev = "a391200d79c6342ce311ac57959565f4521a3da0";
-      sha256 = "00ay49rxx98jw4dy34751l05i2iwj7hn29d4hqi4akq24n2dwllf";
+      rev = "995ae7e0baa4b5d42c094ffa7d6b3fe9459397c3";
+      sha256 = "01dsbdlizckvw34hwzq7jkdhsv5008jzj9p140c177zv4qps2kll";
     };
     meta.homepage = "https://github.com/ishan9299/nvim-solarized-lua/";
   };
@@ -4799,12 +4799,12 @@ final: prev:
 
   nvim-treesitter = buildVimPluginFrom2Nix {
     pname = "nvim-treesitter";
-    version = "2022-01-21";
+    version = "2022-01-24";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter";
-      rev = "3c462d362f49611c295e6c4870c97e2ae7f530cd";
-      sha256 = "1sqr8q9mdggcwd2nm2wwdviad7nf9pzwxmv3wj7asnmw271a1n7b";
+      rev = "91fdda9b5c3896b4b630d98292d657afa00bba2d";
+      sha256 = "0qknkalnsjbyqfi9kgmscswwwck40vpwwx6cbrrk4pgkwykabi21";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
   };
@@ -4835,24 +4835,24 @@ final: prev:
 
   nvim-treesitter-refactor = buildVimPluginFrom2Nix {
     pname = "nvim-treesitter-refactor";
-    version = "2022-01-15";
+    version = "2022-01-22";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter-refactor";
-      rev = "7470880adf8b6fd20936aad33f24ce8fecdb6799";
-      sha256 = "1137n2nyvlwhaksd2syb7s4kq635da3xxm4dqj4d70irzx75bqmh";
+      rev = "0dc8069641226904f9757de786a6ab2273eb73ea";
+      sha256 = "193fk657wjxz7hfbkjw566bng62vv7432cjhb5rwcig04xd5izqm";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter-refactor/";
   };
 
   nvim-treesitter-textobjects = buildVimPluginFrom2Nix {
     pname = "nvim-treesitter-textobjects";
-    version = "2022-01-21";
+    version = "2022-01-23";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter-textobjects";
-      rev = "5681ed6e8754efd3de748fadd14ce9b8f06c1fd7";
-      sha256 = "0c3vj1lxp942qs0ghdp8m5ih1dxmnj8l14qjnh46dn5xrfxh73ss";
+      rev = "1ce9933a1be6e16f788d51dcaa9602accfa25030";
+      sha256 = "120gqzh205sx26gadilwawx761s6ibyzkbhwybfdd2f1fq832pag";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter-textobjects/";
   };
@@ -4883,12 +4883,12 @@ final: prev:
 
   nvim-ts-rainbow = buildVimPluginFrom2Nix {
     pname = "nvim-ts-rainbow";
-    version = "2022-01-21";
+    version = "2022-01-24";
     src = fetchFromGitHub {
       owner = "p00f";
       repo = "nvim-ts-rainbow";
-      rev = "5470a3bb6e7ad316d63fab0951fd181ccfdc5716";
-      sha256 = "1648zm3baqi9711r0ywpnj7a7c8giwy6bazbxhcwv0qsjnnm5n70";
+      rev = "38eb126412723fa4c3bfd137c1a3a811faf67eb5";
+      sha256 = "13igbd268z0533bsrz0r8s69lbryh0h4w33cpywmacghxy672jjl";
     };
     meta.homepage = "https://github.com/p00f/nvim-ts-rainbow/";
   };
@@ -4931,12 +4931,12 @@ final: prev:
 
   nvim_context_vt = buildVimPluginFrom2Nix {
     pname = "nvim_context_vt";
-    version = "2022-01-21";
+    version = "2022-01-22";
     src = fetchFromGitHub {
       owner = "haringsrob";
       repo = "nvim_context_vt";
-      rev = "9cf62516d16114c935eeb9bbe57b02e39c3bfbd7";
-      sha256 = "1fvsjfcfm83kvcfgps39j845pkh89s4vq2wk49a0qi5g8a8mjphx";
+      rev = "47afb03249e36cd740bda79907c0f279f4e28544";
+      sha256 = "18pbdp7ci5gb7i0als4rgcr151rbm8j3mc0pxc9h4x9cvxdl8x5f";
     };
     meta.homepage = "https://github.com/haringsrob/nvim_context_vt/";
   };
@@ -4979,12 +4979,12 @@ final: prev:
 
   octo-nvim = buildVimPluginFrom2Nix {
     pname = "octo.nvim";
-    version = "2022-01-20";
+    version = "2022-01-23";
     src = fetchFromGitHub {
       owner = "pwntester";
       repo = "octo.nvim";
-      rev = "c2ea3cba7d34ce9bce9d1e1d9710ab4b2be7e651";
-      sha256 = "126fq92v72ljmdxrdh384yck3kd4avmss37rcyfryzhzfrjj2gcj";
+      rev = "33224362e20e1b3e87eb7ef2d669de6c60e727db";
+      sha256 = "0z163sfxly71bypskxnph9rwqamgp3h01i24va9n41wbbfvr0pw3";
     };
     meta.homepage = "https://github.com/pwntester/octo.nvim/";
   };
@@ -5653,12 +5653,12 @@ final: prev:
 
   rust-tools-nvim = buildVimPluginFrom2Nix {
     pname = "rust-tools.nvim";
-    version = "2022-01-01";
+    version = "2022-01-24";
     src = fetchFromGitHub {
       owner = "simrat39";
       repo = "rust-tools.nvim";
-      rev = "7eb435069b307f55bdc3aa27bd3fe4ad704e66db";
-      sha256 = "1lc730wyv77yfgvcpwvc5h51g4abarxyk6si6q1bly368ms52dlc";
+      rev = "876089969aa8ccf8784039f7d6e6b4cab6d4a2b1";
+      sha256 = "0j3gi150gpj5m0i4kklcwjgrqk6fqv1ha8wh9mlhpjp26i68ylb6";
     };
     meta.homepage = "https://github.com/simrat39/rust-tools.nvim/";
   };
@@ -5701,12 +5701,12 @@ final: prev:
 
   SchemaStore-nvim = buildVimPluginFrom2Nix {
     pname = "SchemaStore.nvim";
-    version = "2022-01-20";
+    version = "2022-01-23";
     src = fetchFromGitHub {
       owner = "b0o";
       repo = "SchemaStore.nvim";
-      rev = "4d03a1db6d00e4a413e15d1e5f5b090a7bc5f4b6";
-      sha256 = "1zwc9n3rwsq7cqz0mryl05zggzdgir8kwsgpvd64lxmf92xzs1mv";
+      rev = "c9d7de2dc3dc23d2bd6d3f1d147f40ee4c016f79";
+      sha256 = "1va0zbhr7j2hym6arg4nfdgk30ypsw2k8nb6j3lfi1fj41l3lmr4";
     };
     meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
   };
@@ -5918,12 +5918,12 @@ final: prev:
 
   sonokai = buildVimPluginFrom2Nix {
     pname = "sonokai";
-    version = "2022-01-19";
+    version = "2022-01-24";
     src = fetchFromGitHub {
       owner = "sainnhe";
       repo = "sonokai";
-      rev = "237c85d3f6c12581a675f29b7f45bee35aae48b0";
-      sha256 = "1ji6yggmhpdvrsl6ky0680br9wbxzwmwk3bbrd3sjajnvj9567pz";
+      rev = "9a2ac50100b22599ac625484a76f192dfd80e2ce";
+      sha256 = "09qn6f898qvpxpn3xy0z4l7j5b84v7pd1b237g1xh3lkyy3xvmzg";
     };
     meta.homepage = "https://github.com/sainnhe/sonokai/";
   };
@@ -6147,12 +6147,12 @@ final: prev:
 
   surround-nvim = buildVimPluginFrom2Nix {
     pname = "surround.nvim";
-    version = "2022-01-21";
+    version = "2022-01-23";
     src = fetchFromGitHub {
       owner = "blackCauldron7";
       repo = "surround.nvim";
-      rev = "bc07f9d15535b76e464bc4e9e94702136a60b785";
-      sha256 = "1j0jq44a5kqfpca3hwhx1jzwl79d3apii0j5b3l4kwhgjgvjwjdm";
+      rev = "b0105011437ab148261b5c4ed6b84c735c54cd61";
+      sha256 = "1bs0ba29pfxvvz8j5qpam6mxch4b40idlpq7l39rsanrxyxl81yf";
     };
     meta.homepage = "https://github.com/blackCauldron7/surround.nvim/";
   };
@@ -6353,12 +6353,12 @@ final: prev:
 
   tcomment_vim = buildVimPluginFrom2Nix {
     pname = "tcomment_vim";
-    version = "2021-09-07";
+    version = "2022-01-24";
     src = fetchFromGitHub {
       owner = "tomtom";
       repo = "tcomment_vim";
-      rev = "5c5c31121ec607011c1e382163c0bce207ac2966";
-      sha256 = "1cbalg696gcw1bbvclacrg081w1ygb7xfpv6y2w969b50m17l2lc";
+      rev = "3729ae43318faca94b0a1e878f9c6717b171d55e";
+      sha256 = "07dhmfqrk6806648a0n9y98ngzk59b55j9nnsvvka0hl27q1mkl9";
     };
     meta.homepage = "https://github.com/tomtom/tcomment_vim/";
   };
@@ -6486,12 +6486,12 @@ final: prev:
 
   telescope-project-nvim = buildVimPluginFrom2Nix {
     pname = "telescope-project.nvim";
-    version = "2021-11-20";
+    version = "2022-01-23";
     src = fetchFromGitHub {
       owner = "nvim-telescope";
       repo = "telescope-project.nvim";
-      rev = "ad33c9eb67de635ded67069af7552d5162497b1e";
-      sha256 = "1m46h973wvr6bkb69msd9sj6413315qw2nndpr6rgk8vl2hd1vrr";
+      rev = "d317c3cef6917d650d9a638c627b54d3e1173031";
+      sha256 = "0kg2jh23cgbwjmvrc1cxvjka4y2j0qpi4r8dzzw0gs2nmdjmmic7";
     };
     meta.homepage = "https://github.com/nvim-telescope/telescope-project.nvim/";
   };
@@ -6823,12 +6823,12 @@ final: prev:
 
   ultisnips = buildVimPluginFrom2Nix {
     pname = "ultisnips";
-    version = "2022-01-21";
+    version = "2022-01-24";
     src = fetchFromGitHub {
       owner = "SirVer";
       repo = "ultisnips";
-      rev = "bc480c1aac4cb6237aa3316ab576e7a674f064ca";
-      sha256 = "1xkw1m70fr4cqc4wjawzbrkkankbyi7ma61d727sqrigzaqk1zjh";
+      rev = "e12dd76d4a4d9d18c985bbafe8b6a55f7f8ea917";
+      sha256 = "0i64rrg3q8w80hskwxsbs1a1nzbkbbwz5vs62dpd6vbi02ghkkzg";
     };
     meta.homepage = "https://github.com/SirVer/ultisnips/";
   };
@@ -9285,12 +9285,12 @@ final: prev:
 
   vim-markdown = buildVimPluginFrom2Nix {
     pname = "vim-markdown";
-    version = "2020-07-14";
+    version = "2022-01-24";
     src = fetchFromGitHub {
       owner = "preservim";
       repo = "vim-markdown";
-      rev = "8e5d86f7b85234d3d1b4207dceebc43a768ed5d4";
-      sha256 = "013vh2rnfifm5j56imar03rvchz68ll4lbgy9y8fbw7s9a0k6yaa";
+      rev = "9156bba66350d4c0c32b4ac783550c3e132d6a88";
+      sha256 = "0ghlswpc0qdxidc38y9xy22293nf0hjxqwvln71gzmxjlxj3rdgk";
     };
     meta.homepage = "https://github.com/preservim/vim-markdown/";
   };
@@ -9586,12 +9586,12 @@ final: prev:
 
   vim-ocaml = buildVimPluginFrom2Nix {
     pname = "vim-ocaml";
-    version = "2021-10-25";
+    version = "2022-01-24";
     src = fetchFromGitHub {
       owner = "ocaml";
       repo = "vim-ocaml";
-      rev = "2ebddd0ef575193e2aac31172f8f3a5f543f530f";
-      sha256 = "1n2k6picc99j5vs036mp2ws6v8iyal812k7s653zxv8qgvn676mi";
+      rev = "9485f5aa3aa8e3d8505fce9a70efecc38dfee329";
+      sha256 = "13lwc63iavqpwr25knrzs5f5mn7yrq8lhmm8p1d99vd5j7ngyy5x";
     };
     meta.homepage = "https://github.com/ocaml/vim-ocaml/";
   };
@@ -9658,12 +9658,12 @@ final: prev:
 
   vim-orgmode = buildVimPluginFrom2Nix {
     pname = "vim-orgmode";
-    version = "2022-01-03";
+    version = "2022-01-23";
     src = fetchFromGitHub {
       owner = "jceb";
       repo = "vim-orgmode";
-      rev = "7882e202a3115a07be5300fd596194c94d622911";
-      sha256 = "1idmlrgjvarsv620rkhpnknbqvrw372mjzxi3jrk3i2d6d9phsnb";
+      rev = "66cd7ee69a9cddc73f65566e32da159f1e51401f";
+      sha256 = "1ywf5vcn3b8isfw4gxqfplchn94jvbqvaap15w1yk5ljmp46gxgk";
     };
     meta.homepage = "https://github.com/jceb/vim-orgmode/";
   };
@@ -9886,12 +9886,12 @@ final: prev:
 
   vim-polyglot = buildVimPluginFrom2Nix {
     pname = "vim-polyglot";
-    version = "2022-01-01";
+    version = "2022-01-23";
     src = fetchFromGitHub {
       owner = "sheerun";
       repo = "vim-polyglot";
-      rev = "c96947b1c64c56f70125a9bac9c006f69e45d5d3";
-      sha256 = "1f2mgzp24ib5c1yjvnlsy0wlzrz79m4417p42vdblpfhgy3nd4ld";
+      rev = "2c5af8f89d3e61e04e761c07a1f043b0f35203c6";
+      sha256 = "1aajyfcxw7d9dfhakz6jzkhc6dvb6dckwv3q77f5cfnc5s6rfnz3";
     };
     meta.homepage = "https://github.com/sheerun/vim-polyglot/";
   };
@@ -10498,12 +10498,12 @@ final: prev:
 
   vim-snippets = buildVimPluginFrom2Nix {
     pname = "vim-snippets";
-    version = "2022-01-16";
+    version = "2022-01-22";
     src = fetchFromGitHub {
       owner = "honza";
       repo = "vim-snippets";
-      rev = "00a1e5e66813ac83d21a2836b00b3493980f8f82";
-      sha256 = "0j7biq2xipk5msg3bikqk0rds4838dxq98l2m236cpzyc9lva09a";
+      rev = "cbad57e5d0304198503648b5416ea28d2d1d437a";
+      sha256 = "08ayp2p840fri3yc0lydic2w9gzjxvnpydrr9fifmmf3sw9fbdcd";
     };
     meta.homepage = "https://github.com/honza/vim-snippets/";
   };
@@ -10739,12 +10739,12 @@ final: prev:
 
   vim-test = buildVimPluginFrom2Nix {
     pname = "vim-test";
-    version = "2022-01-07";
+    version = "2022-01-22";
     src = fetchFromGitHub {
       owner = "vim-test";
       repo = "vim-test";
-      rev = "1efc3def36eff8ac12ddb1f25837ef6101531047";
-      sha256 = "0cfx8wq6hq3kdd49vymqj595i5l16xfi55ngn8k2rq6wrd76y5f4";
+      rev = "2ace9a12253140f1bdf4318a46ca9076658dd147";
+      sha256 = "04bnymydy84z4gqnyjkkddvacmsqccbxiwm8p5hinlnyp6ahjjjd";
     };
     meta.homepage = "https://github.com/vim-test/vim-test/";
   };
@@ -10919,12 +10919,12 @@ final: prev:
 
   vim-tpipeline = buildVimPluginFrom2Nix {
     pname = "vim-tpipeline";
-    version = "2022-01-22";
+    version = "2022-01-24";
     src = fetchFromGitHub {
       owner = "vimpostor";
       repo = "vim-tpipeline";
-      rev = "4190d800ec8e29e446c61011fee0dcec61f20199";
-      sha256 = "0mq9mjypq101y593ji7biwvvqzbf5argwcdnpqzphk1ikldq3xh0";
+      rev = "72b956f668237a4cd9b020b2c173d013699b38b5";
+      sha256 = "1f0kkxclpa9x3qc81yzagl1qili13ihbicb6d84pnpycy482k0sj";
     };
     meta.homepage = "https://github.com/vimpostor/vim-tpipeline/";
   };
@@ -11399,12 +11399,12 @@ final: prev:
 
   vimspector = buildVimPluginFrom2Nix {
     pname = "vimspector";
-    version = "2022-01-21";
+    version = "2022-01-22";
     src = fetchFromGitHub {
       owner = "puremourning";
       repo = "vimspector";
-      rev = "2588e4c8dec5bd6a6803d1c86b9e7354409b7d8b";
-      sha256 = "07yv643amq7q8bpdqd5m806bw28yzjgpb2hrhnjnh0bj0fqxhkqb";
+      rev = "f0b135d091a2b78945ea46695fd8c667a92457c0";
+      sha256 = "01lsplkqv6h71z09p5sy0xmadd0gwn20nl94az7hb1igvlrangc4";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/puremourning/vimspector/";
@@ -11412,12 +11412,12 @@ final: prev:
 
   vimtex = buildVimPluginFrom2Nix {
     pname = "vimtex";
-    version = "2022-01-19";
+    version = "2022-01-22";
     src = fetchFromGitHub {
       owner = "lervag";
       repo = "vimtex";
-      rev = "700c40d018b25cc367c26ba348127fe4c6d87638";
-      sha256 = "1j4vdslrbkw9zswpcgsvxgwxanjxa8vm3j5513p2ignag8pmdfc6";
+      rev = "c7c084a5215c9402f1cdfdaa662a7eaa9b67d81b";
+      sha256 = "0mcd8wzq9xhidfyyir689050j2nfvwhgjp1ypnp3nib0m10n7kb8";
     };
     meta.homepage = "https://github.com/lervag/vimtex/";
   };
diff --git a/third_party/nixpkgs/pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh b/third_party/nixpkgs/pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh
index 3c49337a93..acd90b7aa2 100644
--- a/third_party/nixpkgs/pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh
+++ b/third_party/nixpkgs/pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh
@@ -3,4 +3,3 @@ getHostRole
 
 export NIX_LDFLAGS${role_post}+=" -lnbcompat"
 export NIX_CFLAGS_COMPILE${role_post}+=" -DHAVE_NBTOOL_CONFIG_H"
-export NIX_CFLAGS_COMPILE${role_post}+=" -include nbtool_config.h"
diff --git a/third_party/nixpkgs/pkgs/os-specific/bsd/netbsd/default.nix b/third_party/nixpkgs/pkgs/os-specific/bsd/netbsd/default.nix
index beaa176dae..25ac9ce451 100644
--- a/third_party/nixpkgs/pkgs/os-specific/bsd/netbsd/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/bsd/netbsd/default.nix
@@ -120,7 +120,17 @@ in lib.makeScopeWithSplicing
   } // lib.optionalAttrs (attrs.headersOnly or false) {
     installPhase = "includesPhase";
     dontBuild = true;
-  } // attrs));
+  } // attrs // {
+    postPatch = lib.optionalString (!stdenv'.hostPlatform.isNetBSD) ''
+      # Files that use NetBSD-specific macros need to have nbtool_config.h
+      # included ahead of them on non-NetBSD platforms.
+      set +e
+      grep -Zlr "^__RCSID
+      ^__BEGIN_DECLS" | xargs -0r grep -FLZ nbtool_config.h |
+          xargs -0tr sed -i '0,/^#/s//#include <nbtool_config.h>\n\0/'
+      set -e
+    '' + attrs.postPatch or "";
+  }));
 
   ##
   ## START BOOTSTRAPPING
@@ -182,6 +192,12 @@ in lib.makeScopeWithSplicing
     configurePlatforms = [ "build" "host" ];
     configureFlags = [
       "--cache-file=config.cache"
+    ] ++ lib.optionals stdenv.hostPlatform.isMusl [
+      # We include this header in our musl package only for legacy
+      # compatibility, and compat works fine without it (and having it
+      # know about sys/cdefs.h breaks packages like glib when built
+      # statically).
+      "ac_cv_header_sys_cdefs_h=no"
     ];
 
     nativeBuildInputs = with buildPackages.netbsd; commonDeps ++ [
diff --git a/third_party/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/configd/default.nix b/third_party/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/configd/default.nix
index 879d3a7b5f..37830c0665 100644
--- a/third_party/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/configd/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/configd/default.nix
@@ -1,14 +1,15 @@
-{ stdenv, appleDerivation', launchd, bootstrap_cmds, xnu, ppp, IOKit, eap8021x, Security }:
+{ lib, stdenv, appleDerivation', launchd, bootstrap_cmds, xnu, ppp, IOKit, eap8021x, Security
+, headersOnly ? false }:
 
 appleDerivation' stdenv {
   meta.broken = stdenv.cc.nativeLibc;
 
-  nativeBuildInputs = [ bootstrap_cmds ];
-  buildInputs = [ launchd ppp IOKit eap8021x ];
+  nativeBuildInputs = lib.optionals (!headersOnly) [ bootstrap_cmds ];
+  buildInputs = lib.optionals (!headersOnly) [ launchd ppp IOKit eap8021x ];
 
-  propagatedBuildInputs = [ Security ];
+  propagatedBuildInputs = lib.optionals (!headersOnly) [ Security ];
 
-  patchPhase = ''
+  patchPhase = lib.optionalString (!headersOnly) ''
     HACK=$PWD/hack
     mkdir $HACK
     cp -r ${xnu}/Library/Frameworks/System.framework/Versions/B/PrivateHeaders/net $HACK
@@ -63,6 +64,8 @@ appleDerivation' stdenv {
     EOF
   '';
 
+  dontBuild = headersOnly;
+
   buildPhase = ''
     pushd SystemConfiguration.fproj >/dev/null
 
@@ -206,7 +209,7 @@ appleDerivation' stdenv {
   installPhase = ''
     mkdir -p $out/include
     cp dnsinfo/*.h $out/include/
-
+  '' + lib.optionalString (!headersOnly) ''
     mkdir -p $out/Library/Frameworks/
     mv SystemConfiguration.fproj/SystemConfiguration.framework $out/Library/Frameworks
   '';
diff --git a/third_party/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/default.nix b/third_party/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/default.nix
index 5e098926d2..d2d21cc9d6 100644
--- a/third_party/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/default.nix
@@ -288,7 +288,9 @@ developerToolsPackages_11_3_1 // macosPackages_11_0_1 // {
     adv_cmds        = applePackage "adv_cmds"          "osx-10.11.6"    "12gbv35i09aij9g90p6b3x2f3ramw43qcb2gjrg8lzkzmwvcyw9q" {};
     basic_cmds      = applePackage "basic_cmds"        "osx-10.11.6"     "0hvab4b1v5q2x134hdkal0rmz5gsdqyki1vb0dbw4py1bqf0yaw9" {};
     developer_cmds  = applePackage "developer_cmds"    "osx-10.11.6"     "1r9c2b6dcl22diqf90x58psvz797d3lxh4r2wppr7lldgbgn24di" {};
-    diskdev_cmds    = applePackage "diskdev_cmds"      "osx-10.11.6"     "1ssdyiaq5m1zfy96yy38yyknp682ki6bvabdqd5z18fa0rv3m2ar" {};
+    diskdev_cmds    = applePackage "diskdev_cmds"      "osx-10.11.6"     "1ssdyiaq5m1zfy96yy38yyknp682ki6bvabdqd5z18fa0rv3m2ar" {
+      macosPackages_11_0_1 = macosPackages_11_0_1;
+    };
     network_cmds    = applePackage "network_cmds"      "osx-10.11.6"     "0lhi9wz84qr1r2ab3fb4nvmdg9gxn817n5ldg7zw9gnf3wwn42kw" {};
     file_cmds       = applePackage "file_cmds"         "osx-10.11.6"     "1zfxbmasps529pnfdjvc13p7ws2cfx8pidkplypkswyff0nff4wp" {};
     shell_cmds      = applePackage "shell_cmds"        "osx-10.11.6"     "0084k271v66h4jqp7q7rmjvv7w4mvhx3aq860qs8jbd30canm86n" {};
@@ -297,6 +299,12 @@ developerToolsPackages_11_3_1 // macosPackages_11_0_1 // {
     top             = applePackage "top"               "osx-10.11.6"     "0i9120rfwapgwdvjbfg0ya143i29s1m8zbddsxh39pdc59xnsg5l" {};
     PowerManagement = applePackage "PowerManagement"   "osx-10.11.6"     "1llimhvp0gjffd47322lnjq7cqwinx0c5z7ikli04ad5srpa68mh" {};
 
+    # `configdHeaders` can’t use an override because `pkgs.darwin.configd` on aarch64-darwin will
+    # be replaced by SystemConfiguration.framework from the macOS SDK.
+    configdHeaders  = applePackage "configd"           "osx-10.8.5"      "1gxakahk8gallf16xmhxhprdxkh3prrmzxnmxfvj0slr0939mmr2" {
+      headersOnly = true;
+      Security    = null;
+    };
     libutilHeaders  = pkgs.darwin.libutil.override { headersOnly = true; };
     hfsHeaders      = pkgs.darwin.hfs.override { headersOnly = true; };
     libresolvHeaders= pkgs.darwin.libresolv.override { headersOnly = true; };
diff --git a/third_party/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix b/third_party/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
index 1daa492961..ec252dca41 100644
--- a/third_party/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
@@ -1,7 +1,10 @@
-{ lib, appleDerivation, xcbuildHook
-, Libc, xnu, libutil }:
+{ lib, appleDerivation, xcbuildHook, Libc, stdenv, macosPackages_11_0_1, xnu
+, fetchurl, libutil }:
 
-appleDerivation {
+let
+  xnu-src = if stdenv.isAarch64 then macosPackages_11_0_1.xnu.src else xnu.src;
+  arch = if stdenv.isAarch64 then "arm" else "i386";
+in appleDerivation {
   nativeBuildInputs = [ xcbuildHook ];
   buildInputs = [ libutil ];
 
@@ -11,11 +14,11 @@ appleDerivation {
     # ugly hacks for missing headers
     # most are bsd related - probably should make this a drv
     unpackFile ${Libc.src}
-    unpackFile ${xnu.src}
-    mkdir System sys machine i386
+    unpackFile ${xnu-src}
+    mkdir System sys machine ${arch}
     cp xnu-*/bsd/sys/disklabel.h sys
     cp xnu-*/bsd/machine/disklabel.h machine
-    cp xnu-*/bsd/i386/disklabel.h i386
+    cp xnu-*/bsd/${arch}/disklabel.h ${arch}
     cp -r xnu-*/bsd/sys System
     cp -r Libc-*/uuid System
     substituteInPlace diskdev_cmds.xcodeproj/project.pbxproj \
diff --git a/third_party/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/libresolv/default.nix b/third_party/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/libresolv/default.nix
index 53fc019768..2a8a609472 100644
--- a/third_party/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/libresolv/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/libresolv/default.nix
@@ -1,9 +1,9 @@
-{ lib, appleDerivation', stdenv, stdenvNoCC, Libinfo, configd, mDNSResponder
+{ lib, appleDerivation', stdenv, stdenvNoCC, Libinfo, configdHeaders, mDNSResponder
 , headersOnly ? false
 }:
 
 appleDerivation' (if headersOnly then stdenvNoCC else stdenv) {
-  buildInputs = lib.optionals (!headersOnly) [ Libinfo configd mDNSResponder ];
+  buildInputs = lib.optionals (!headersOnly) [ Libinfo configdHeaders mDNSResponder ];
 
   buildPhase = lib.optionalString (!headersOnly) ''
     $CC -I. -c dns_util.c
diff --git a/third_party/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix b/third_party/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix
index 9e3d6e4920..672bb44324 100644
--- a/third_party/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix
@@ -20,6 +20,8 @@ appleDerivation {
     done
   '';
 
+  NIX_CFLAGS_COMPILE=[ "-Wno-error=format-security" ]; # hardeningDisable doesn't cut it
+
   meta = {
     platforms = lib.platforms.darwin;
     maintainers = with lib.maintainers; [ matthewbauer ];
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-lib/alsa-plugin-conf-multilib.patch b/third_party/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-lib/alsa-plugin-conf-multilib.patch
deleted file mode 100644
index b17df9a492..0000000000
--- a/third_party/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-lib/alsa-plugin-conf-multilib.patch
+++ /dev/null
@@ -1,232 +0,0 @@
-diff --git a/src/control/control.c b/src/control/control.c
-index d66ed75..42cecad 100644
---- a/src/control/control.c
-+++ b/src/control/control.c
-@@ -838,6 +838,10 @@ static int snd_ctl_open_conf(snd_ctl_t **ctlp, const char *name,
- #ifndef PIC
- 	extern void *snd_control_open_symbols(void);
- #endif
-+
-+	snd_config_t *libs = NULL;
-+	const char *libs_lib = NULL;
-+
- 	if (snd_config_get_type(ctl_conf) != SND_CONFIG_TYPE_COMPOUND) {
- 		if (name)
- 			SNDERR("Invalid type for CTL %s definition", name);
-@@ -879,6 +883,19 @@ static int snd_ctl_open_conf(snd_ctl_t **ctlp, const char *name,
- 					SNDERR("Invalid type for %s", id);
- 					goto _err;
- 				}
-+
-+				continue;
-+			}
-+			// Handle an array of extra libs.
-+			if (strcmp(id, "libs") == 0) {
-+				if (snd_config_get_type(n) != SND_CONFIG_TYPE_COMPOUND) {
-+					SNDERR("Invalid type for libs definition in CTL %s definition",
-+						str);
-+					goto _err;
-+				}
-+
-+				libs = n;
-+
- 				continue;
- 			}
- 			if (strcmp(id, "open") == 0) {
-@@ -903,7 +920,62 @@ static int snd_ctl_open_conf(snd_ctl_t **ctlp, const char *name,
- 		open_name = buf;
- 		sprintf(buf, "_snd_ctl_%s_open", str);
- 	}
--	if (!lib) {
-+
-+#ifndef PIC
-+	snd_control_open_symbols();
-+#endif
-+
-+	// Normal alsa behaviour when there is no libs array.
-+	if (!libs) {
-+		if (lib) {
-+			open_func = snd_dlobj_cache_get(lib, open_name,
-+				SND_DLSYM_VERSION(SND_CONTROL_DLSYM_VERSION), 1);
-+		}
-+	}
-+	// Handle libs array.
-+	// Suppresses error messages if any function is loaded successfully.
-+	else {
-+		if (lib) {
-+			open_func = snd_dlobj_cache_get(lib, open_name,
-+				SND_DLSYM_VERSION(SND_CONTROL_DLSYM_VERSION), 0);
-+		}
-+
-+		if (!open_func) {
-+			snd_config_for_each(i, next, libs) {
-+				snd_config_t *n = snd_config_iterator_entry(i);
-+
-+				err = snd_config_get_string(n, &libs_lib);
-+				if (err < 0) {
-+					SNDERR("Invalid entry in CTL %s libs definition", str);
-+					goto _err;
-+				}
-+
-+				if (!open_func) {
-+					open_func = snd_dlobj_cache_get(libs_lib, open_name,
-+						SND_DLSYM_VERSION(SND_CONTROL_DLSYM_VERSION), 0);
-+				}
-+			}
-+		}
-+
-+		// Print error messages.
-+		if (!open_func) {
-+			if (lib) {
-+				SNDERR("Either %s cannot be opened or %s was not defined inside",
-+					lib, open_name);
-+			}
-+
-+			snd_config_for_each(i, next, libs) {
-+				snd_config_t *n = snd_config_iterator_entry(i);
-+
-+				snd_config_get_string(n, &libs_lib);
-+				SNDERR("Either %s cannot be opened or %s was not defined inside",
-+					libs_lib, open_name);
-+			}
-+		}
-+	}
-+
-+	// Look in ALSA_PLUGIN_DIR iff we found nowhere else to look.
-+	if (!lib && (!libs || !libs_lib)) {
- 		const char *const *build_in = build_in_ctls;
- 		while (*build_in) {
- 			if (!strcmp(*build_in, str))
-@@ -919,12 +991,11 @@ static int snd_ctl_open_conf(snd_ctl_t **ctlp, const char *name,
- 			lib = buf1;
- 			sprintf(buf1, "%s/libasound_module_ctl_%s.so", ALSA_PLUGIN_DIR, str);
- 		}
--	}
--#ifndef PIC
--	snd_control_open_symbols();
--#endif
--	open_func = snd_dlobj_cache_get(lib, open_name,
-+
-+		open_func = snd_dlobj_cache_get(lib, open_name,
- 			SND_DLSYM_VERSION(SND_CONTROL_DLSYM_VERSION), 1);
-+	}
-+
- 	if (open_func) {
- 		err = open_func(ctlp, name, ctl_root, ctl_conf, mode);
- 		if (err >= 0) {
-diff --git a/src/pcm/pcm.c b/src/pcm/pcm.c
-index 2e24338..7f489f4 100644
---- a/src/pcm/pcm.c
-+++ b/src/pcm/pcm.c
-@@ -2116,6 +2116,10 @@ static int snd_pcm_open_conf(snd_pcm_t **pcmp, const char *name,
- #ifndef PIC
- 	extern void *snd_pcm_open_symbols(void);
- #endif
-+
-+	snd_config_t *libs = NULL;
-+	const char *libs_lib = NULL;
-+
- 	if (snd_config_get_type(pcm_conf) != SND_CONFIG_TYPE_COMPOUND) {
- 		char *val;
- 		id = NULL;
-@@ -2160,6 +2164,19 @@ static int snd_pcm_open_conf(snd_pcm_t **pcmp, const char *name,
- 					SNDERR("Invalid type for %s", id);
- 					goto _err;
- 				}
-+
-+				continue;
-+			}
-+			// Handle an array of extra libs.
-+			if (strcmp(id, "libs") == 0) {
-+				if (snd_config_get_type(n) != SND_CONFIG_TYPE_COMPOUND) {
-+					SNDERR("Invalid type for libs definition in PCM %s definition",
-+						str);
-+					goto _err;
-+				}
-+
-+				libs = n;
-+
- 				continue;
- 			}
- 			if (strcmp(id, "open") == 0) {
-@@ -2184,7 +2201,62 @@ static int snd_pcm_open_conf(snd_pcm_t **pcmp, const char *name,
- 		open_name = buf;
- 		sprintf(buf, "_snd_pcm_%s_open", str);
- 	}
--	if (!lib) {
-+
-+#ifndef PIC
-+	snd_pcm_open_symbols();	/* this call is for static linking only */
-+#endif
-+
-+	// Normal alsa behaviour when there is no libs array.
-+	if (!libs) {
-+		if (lib) {
-+			open_func = snd_dlobj_cache_get(lib, open_name,
-+				SND_DLSYM_VERSION(SND_PCM_DLSYM_VERSION), 1);
-+		}
-+	}
-+	// Handle libs array.
-+	// Suppresses error messages if any function is loaded successfully.
-+	else {
-+		if (lib) {
-+			open_func = snd_dlobj_cache_get(lib, open_name,
-+				SND_DLSYM_VERSION(SND_PCM_DLSYM_VERSION), 0);
-+		}
-+
-+		if (!open_func) {
-+			snd_config_for_each(i, next, libs) {
-+				snd_config_t *n = snd_config_iterator_entry(i);
-+
-+				err = snd_config_get_string(n, &libs_lib);
-+				if (err < 0) {
-+					SNDERR("Invalid entry in PCM %s libs definition", str);
-+					goto _err;
-+				}
-+
-+				if (!open_func) {
-+					open_func = snd_dlobj_cache_get(libs_lib, open_name,
-+						SND_DLSYM_VERSION(SND_PCM_DLSYM_VERSION), 0);
-+				}
-+			}
-+		}
-+
-+		// Print error messages.
-+		if (!open_func) {
-+			if (lib) {
-+				SNDERR("Either %s cannot be opened or %s was not defined inside",
-+					lib, open_name);
-+			}
-+
-+			snd_config_for_each(i, next, libs) {
-+				snd_config_t *n = snd_config_iterator_entry(i);
-+
-+				snd_config_get_string(n, &libs_lib);
-+				SNDERR("Either %s cannot be opened or %s was not defined inside",
-+					libs_lib, open_name);
-+			}
-+		}
-+	}
-+
-+	// Look in ALSA_PLUGIN_DIR iff we found nowhere else to look.
-+	if (!lib && (!libs || !libs_lib)) {
- 		const char *const *build_in = build_in_pcms;
- 		while (*build_in) {
- 			if (!strcmp(*build_in, str))
-@@ -2200,12 +2272,11 @@ static int snd_pcm_open_conf(snd_pcm_t **pcmp, const char *name,
- 			lib = buf1;
- 			sprintf(buf1, "%s/libasound_module_pcm_%s.so", ALSA_PLUGIN_DIR, str);
- 		}
--	}
--#ifndef PIC
--	snd_pcm_open_symbols();	/* this call is for static linking only */
--#endif
--	open_func = snd_dlobj_cache_get(lib, open_name,
-+
-+		open_func = snd_dlobj_cache_get(lib, open_name,
- 			SND_DLSYM_VERSION(SND_PCM_DLSYM_VERSION), 1);
-+	}
-+
- 	if (open_func) {
- 		err = open_func(pcmp, name, pcm_root, pcm_conf, stream, mode);
- 		if (err >= 0) {
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix
index a235027148..445d171d31 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix
@@ -7,24 +7,15 @@
 
 stdenv.mkDerivation rec {
   pname = "alsa-lib";
-  version = "1.2.5.1";
+  version = "1.2.6.1";
 
   src = fetchurl {
     url = "mirror://alsa/lib/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-YoQh2VDOyvI03j+JnVIMCmkjMTyWStdR/6wIHfMxQ44=";
+    hash = "sha256-rVgpk9Us21+xWaC+q2CmrFfqsMwb34XcTbbWGX8CMz8=";
   };
 
-  patches = [
-    ./alsa-plugin-conf-multilib.patch
-  ];
-
   enableParallelBuilding = true;
 
-  # Fix pcm.h file in order to prevent some compilation bugs
-  postPatch = ''
-    sed -i -e 's|//int snd_pcm_mixer_element(snd_pcm_t \*pcm, snd_mixer_t \*mixer, snd_mixer_elem_t \*\*elem);|/\*int snd_pcm_mixer_element(snd_pcm_t \*pcm, snd_mixer_t \*mixer, snd_mixer_elem_t \*\*elem);\*/|' include/pcm.h
-  '';
-
   postInstall = ''
     ln -s ${alsa-ucm-conf}/share/alsa/{ucm,ucm2} $out/share/alsa
     ln -s ${alsa-topology-conf}/share/alsa/topology $out/share/alsa
@@ -43,5 +34,6 @@ stdenv.mkDerivation rec {
 
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
+    maintainers = with maintainers; [ l-as ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/cryptsetup/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/cryptsetup/default.nix
index 9bbd6ddafe..939a7115e8 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/cryptsetup/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/cryptsetup/default.nix
@@ -24,12 +24,14 @@ stdenv.mkDerivation rec {
     substituteInPlace tests/unit-utils-io.c --replace "| O_DIRECT" ""
   '';
 
-  NIX_LDFLAGS = "-lgcc_s";
+  NIX_LDFLAGS = lib.optionalString (stdenv.cc.isGNU && !stdenv.hostPlatform.isStatic) "-lgcc_s";
 
   configureFlags = [
     "--enable-cryptsetup-reencrypt"
     "--with-crypto_backend=openssl"
     "--disable-ssh-token"
+  ] ++ lib.optionals stdenv.hostPlatform.isStatic [
+    "--enable-static-cryptsetup"
   ];
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/default.nix
index 71f6da0d13..077c37a72c 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -214,7 +214,7 @@ let
       "-Dc_link_args=-Wl,-rpath,${placeholder "out"}/lib"
     ] ++ lib.optionals (!haveDell) [
       "-Dplugin_dell=false"
-      "-Dplugin_synaptics=false"
+      "-Dplugin_synaptics_mst=false"
     ] ++ lib.optionals (!haveRedfish) [
       "-Dplugin_redfish=false"
     ] ++ lib.optionals haveFlashrom [
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/gt/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/gt/default.nix
new file mode 100644
index 0000000000..a7e4c07504
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/gt/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, lib, fetchFromGitHub, cmake, bash-completion, pkg-config, libconfig
+, asciidoc
+, libusbgx
+}:
+stdenv.mkDerivation {
+  pname = "gt";
+  version = "unstable-2021-09-30";
+
+  src = fetchFromGitHub {
+    owner = "linux-usb-gadgets";
+    repo = "gt";
+    rev = "7247547a14b2d092dc03fd83218ae65c2f7ff7d6";
+    sha256 = "1has9q2sghd5vyi25l3h2hd4d315vvpld076iwwsg01fx4d9vjmg";
+  };
+  sourceRoot = "source";
+
+  preConfigure = ''
+    cmakeFlagsArray+=("-DBASH_COMPLETION_COMPLETIONSDIR=$out/share/bash-completions/completions")
+  '';
+  nativeBuildInputs = [ cmake pkg-config asciidoc ];
+  buildInputs = [ bash-completion libconfig libusbgx];
+
+  meta = {
+    description = "Linux command line tool for setting up USB gadgets using configfs";
+    license = with lib.licenses; [ asl20 ];
+    maintainers = with lib.maintainers; [ lheckemann ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/ima-evm-utils/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/ima-evm-utils/default.nix
index 14ddc21bb6..afd46f0d9e 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/ima-evm-utils/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/ima-evm-utils/default.nix
@@ -2,20 +2,18 @@
 
 stdenv.mkDerivation rec {
   pname = "ima-evm-utils";
-  version = "1.1";
+  version = "1.4";
 
   src = fetchgit {
     url = "git://git.code.sf.net/p/linux-ima/ima-evm-utils";
     rev = "v${version}";
-    sha256 = "1dhfw6d9z4dv82q9zg2g025hgr179kamz9chy7v5w9b71aam8jf8";
+    sha256 = "1zmyv82232lzqk52m0s7fap9zb9hb1x6nsi5gznk0cbsnq2m67pc";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [ openssl attr keyutils asciidoc libxslt ];
 
-  patches = [ ./xattr.patch ];
-
-  buildPhase = "make prefix=$out MANPAGE_DOCBOOK_XSL=${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl";
+  MANPAGE_DOCBOOK_XSL = "${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl";
 
   meta = {
     description = "evmctl utility to manage digital signatures of the Linux kernel integrity subsystem (IMA/EVM)";
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/ima-evm-utils/xattr.patch b/third_party/nixpkgs/pkgs/os-specific/linux/ima-evm-utils/xattr.patch
deleted file mode 100644
index 2d27570a57..0000000000
--- a/third_party/nixpkgs/pkgs/os-specific/linux/ima-evm-utils/xattr.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-commit 6aea54d2ad2287b3e8894c262ee895f3d4a60516
-Author: André Draszik <git@andred.net>
-Date:   Mon Oct 17 12:45:32 2016 +0100
-
-    evmctl: use correct include for xattr.h
-    
-    The xattr API/ABI is provided by both the c-library, as well as by the
-    libattr package. The c-library's header file is sys/xattr.h, whereas
-    libattr's header file can be found in attr/xattr.h.
-    
-    Given none of the code here *links* against the libattr.so shared library, it
-    is wrong to *compile* against libattr's API (header file).
-    
-    Doing so avoids confusion as to which xattr.h is used as the least problem,
-    and potential ABI differences as the worst problem due the mismatching header
-    file used.
-    
-    So make sure we compile and link against the same thing, the c-library in
-    both cases.
-    
-    Signed-off-by: André Draszik <git@andred.net>
-    Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
-
-diff --git a/configure.ac b/configure.ac
-index 0497eb7..a5b4288 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -30,7 +30,7 @@ AC_SUBST(OPENSSL_LIBS)
- AC_CHECK_HEADER(unistd.h)
- AC_CHECK_HEADERS(openssl/conf.h)
- 
--AC_CHECK_HEADERS(attr/xattr.h, , [AC_MSG_ERROR([attr/xattr.h header not found. You need the libattr development package.])])
-+AC_CHECK_HEADERS(sys/xattr.h, , [AC_MSG_ERROR([sys/xattr.h header not found. You need the c-library development package.])])
- AC_CHECK_HEADERS(keyutils.h, , [AC_MSG_ERROR([keyutils.h header not found. You need the libkeyutils development package.])])
- 
- #debug support - yes for a while
-diff --git a/packaging/ima-evm-utils.spec b/packaging/ima-evm-utils.spec
-index a11a27a..63388d2 100644
---- a/packaging/ima-evm-utils.spec
-+++ b/packaging/ima-evm-utils.spec
-@@ -11,7 +11,6 @@ BuildRoot:	%{_tmppath}/%{name}-%{version}-%{release}-root
- BuildRequires:    autoconf
- BuildRequires:    automake
- BuildRequires:    openssl-devel
--BuildRequires:    libattr-devel
- BuildRequires:    keyutils-libs-devel
- 
- %description
-diff --git a/packaging/ima-evm-utils.spec.in b/packaging/ima-evm-utils.spec.in
-index 7ca6c6f..65c32f9 100644
---- a/packaging/ima-evm-utils.spec.in
-+++ b/packaging/ima-evm-utils.spec.in
-@@ -11,7 +11,6 @@ BuildRoot:	%{_tmppath}/%{name}-%{version}-%{release}-root
- BuildRequires:    autoconf
- BuildRequires:    automake
- BuildRequires:    openssl-devel
--BuildRequires:    libattr-devel
- BuildRequires:    keyutils-libs-devel
- 
- %description
-diff --git a/src/evmctl.c b/src/evmctl.c
-index 2ffee78..3fbcd33 100644
---- a/src/evmctl.c
-+++ b/src/evmctl.c
-@@ -49,7 +49,7 @@
- #include <stdint.h>
- #include <string.h>
- #include <dirent.h>
--#include <attr/xattr.h>
-+#include <sys/xattr.h>
- #include <linux/xattr.h>
- #include <getopt.h>
- #include <keyutils.h>
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/iputils/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/iputils/default.nix
index c949069885..0ca6d8aa18 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/iputils/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/iputils/default.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "20210722";
+  version = "20211215";
   sunAsIsLicense = {
     fullName = "AS-IS, SUN MICROSYSTEMS license";
     url = "https://github.com/iputils/iputils/blob/s${version}/rdisc.c";
@@ -19,14 +19,9 @@ in stdenv.mkDerivation rec {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "139fyifsjm0i012rhcx3ra3pxx2wxh77dfd551d8lgiv2mqd742j";
+    sha256 = "1vzdch1xi2x2j8mvnsr4wwwh7kdkgf926xafw5kkb74yy1wac5qv";
   };
 
-  postPatch = lib.optionalString (!doCheck) ''
-    # There isn't a Meson option for this yet:
-    sed -i '/##### TESTS #####/q' ping/meson.build
-  '';
-
   outputs = ["out" "apparmor"];
 
   # We don't have the required permissions inside the build sandbox:
@@ -35,11 +30,10 @@ in stdenv.mkDerivation rec {
 
   mesonFlags = [
     "-DBUILD_RARPD=true"
-    "-DBUILD_TRACEROUTE6=true"
-    "-DBUILD_TFTPD=true"
     "-DNO_SETCAP_OR_SUID=true"
     "-Dsystemdunitdir=etc/systemd/system"
     "-DINSTALL_SYSTEMD_UNITS=true"
+    "-DSKIP_TESTS=${lib.boolToString (!doCheck)}"
   ]
     # Disable idn usage w/musl (https://github.com/iputils/iputils/pull/111):
     ++ lib.optional stdenv.hostPlatform.isMusl "-DUSE_IDN=false";
@@ -87,9 +81,7 @@ in stdenv.mkDerivation rec {
       ping
       rarpd
       rdisc
-      tftpd
       tracepath
-      traceroute6
     '';
   };
 }
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/libbpf/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/libbpf/default.nix
index daee83e61d..81e86fe77e 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/libbpf/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/libbpf/default.nix
@@ -21,12 +21,16 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-/MLPflnfooe7Wjy8M3CTowAi5oYpscruSkDsaVzhmYQ=";
   };
 
+  patches = [(fetchpatch {
+    url = "https://github.com/libbpf/libbpf/pull/41.diff";
+    sha256 = "sha256-pg5WARqh6z0nkTHMBhftxwdV2SyswC2lfaCXCpez0VA=";
+  })];
+
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libelf zlib ];
 
-  sourceRoot = "source/src";
   enableParallelBuilding = true;
-  makeFlags = [ "PREFIX=$(out)" ];
+  makeFlags = [ "PREFIX=$(out)" "-C src" ];
 
   passthru.tests = {
     bpf = nixosTests.bpf;
@@ -34,7 +38,7 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     # install linux's libbpf-compatible linux/btf.h
-    install -Dm444 ../include/uapi/linux/btf.h -t $out/include/linux
+    install -Dm444 include/uapi/linux/btf.h -t $out/include/linux
   '';
 
   # FIXME: Multi-output requires some fixes to the way the pkg-config file is
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/lvm2/common.nix b/third_party/nixpkgs/pkgs/os-specific/linux/lvm2/common.nix
index 2c8014d700..0749292531 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/lvm2/common.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/lvm2/common.nix
@@ -9,7 +9,8 @@
 , libaio
 , enableCmdlib ? false
 , enableDmeventd ? false
-, udev ? null
+, udevSupport ? !stdenv.targetPlatform.isStatic, udev ? null
+, onlyLib ? stdenv.targetPlatform.isStatic
 , nixosTests
 }:
 
@@ -26,7 +27,13 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ udev libuuid libaio ];
+  buildInputs = [
+    libaio
+  ] ++ lib.optionals udevSupport [
+    udev
+  ] ++ lib.optionals (!onlyLib) [
+    libuuid
+  ];
 
   configureFlags = [
     "--disable-readline"
@@ -46,10 +53,11 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "ac_cv_func_malloc_0_nonnull=yes"
     "ac_cv_func_realloc_0_nonnull=yes"
-  ] ++
-  lib.optionals (udev != null) [
+  ] ++ lib.optionals udevSupport [
     "--enable-udev_rules"
     "--enable-udev_sync"
+  ] ++ lib.optionals stdenv.targetPlatform.isStatic [
+    "--enable-static_link"
   ];
 
   preConfigure = ''
@@ -58,9 +66,13 @@ stdenv.mkDerivation rec {
     substituteInPlace scripts/lvm2_activation_generator_systemd_red_hat.c \
       --replace /usr/bin/udevadm /run/current-system/systemd/bin/udevadm
     # https://github.com/lvmteam/lvm2/issues/36
+  '' + lib.optionalString (lib.versionOlder version "2.03.14") ''
+    substituteInPlace udev/69-dm-lvm-metad.rules.in \
+      --replace "(BINDIR)/systemd-run" /run/current-system/systemd/bin/systemd-run
+  '' + lib.optionalString (lib.versionAtLeast version "2.03.14") ''
     substituteInPlace udev/69-dm-lvm.rules.in \
       --replace "/usr/bin/systemd-run" /run/current-system/systemd/bin/systemd-run
-
+  '' + ''
     substituteInPlace make.tmpl.in --replace "@systemdsystemunitdir@" "$out/lib/systemd/system"
   '' + lib.optionalString (lib.versionAtLeast version "2.03") ''
     substituteInPlace libdm/make.tmpl.in --replace "@systemdsystemunitdir@" "$out/lib/systemd/system"
@@ -78,30 +90,41 @@ stdenv.mkDerivation rec {
       url = "https://git.alpinelinux.org/aports/plain/main/lvm2/mallinfo.patch?h=3.7-stable&id=31bd4a8c2dc00ae79a821f6fe0ad2f23e1534f50";
       sha256 = "0g6wlqi215i5s30bnbkn8w7axrs27y3bnygbpbnf64wwx7rxxlj0";
     })
+  ] ++ lib.optionals stdenv.targetPlatform.isStatic [
+    ./no-shared.diff
   ];
 
   doCheck = false; # requires root
 
-  makeFlags = lib.optionals (udev != null) [
+  makeFlags = lib.optionals udevSupport [
     "SYSTEMD_GENERATOR_DIR=$(out)/lib/systemd/system-generators"
+  ] ++ lib.optionals onlyLib [
+    "libdm.device-mapper"
   ];
 
   # To prevent make install from failing.
   installFlags = [ "OWNER=" "GROUP=" "confdir=$(out)/etc" ];
 
   # Install systemd stuff.
-  installTargets = [ "install" ] ++ lib.optionals (udev != null) [
+  installTargets = [ "install" ] ++ lib.optionals udevSupport [
     "install_systemd_generators"
     "install_systemd_units"
     "install_tmpfiles_configuration"
   ];
 
+  installPhase = lib.optionalString onlyLib ''
+    install -D -t $out/lib libdm/ioctl/libdevmapper.${if stdenv.targetPlatform.isStatic then "a" else "so"}
+    make -C libdm install_include
+    make -C libdm install_pkgconfig
+  '';
+
   # only split bin and lib out from out if cmdlib isn't enabled
   outputs = [
     "out"
+  ] ++ lib.optionals (!onlyLib) [
     "dev"
     "man"
-  ] ++ lib.optionals (enableCmdlib != true) [
+  ] ++ lib.optionals (!onlyLib && !enableCmdlib) [
     "bin"
     "lib"
   ];
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/lvm2/no-shared.diff b/third_party/nixpkgs/pkgs/os-specific/linux/lvm2/no-shared.diff
new file mode 100644
index 0000000000..d40dd85dfc
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/lvm2/no-shared.diff
@@ -0,0 +1,25 @@
+diff --git a/libdm/Makefile.in b/libdm/Makefile.in
+index 66ec39513..ab7123dae 100644
+--- a/libdm/Makefile.in
++++ b/libdm/Makefile.in
+@@ -44,7 +44,6 @@ endif
+ 
+ LIB_SHARED = $(interface)/libdevmapper.$(LIB_SUFFIX)
+ LIB_VERSION = $(LIB_VERSION_DM)
+-TARGETS = libdevmapper.$(LIB_SUFFIX) libdevmapper.$(LIB_SUFFIX).$(LIB_VERSION)
+ 
+ CFLOW_LIST = $(SOURCES)
+ CFLOW_LIST_TARGET = libdevmapper.cflow
+diff --git a/make.tmpl.in b/make.tmpl.in
+index e7780e8d4..ca4aa9fdd 100644
+--- a/make.tmpl.in
++++ b/make.tmpl.in
+@@ -346,7 +346,7 @@ SUBDIRS.cflow := $(SUBDIRS:=.cflow)
+ SUBDIRS.clean := $(SUBDIRS:=.clean)
+ SUBDIRS.distclean := $(SUBDIRS:=.distclean)
+ 
+-TARGETS += $(LIB_SHARED) $(LIB_STATIC)
++TARGETS += $(LIB_STATIC)
+ 
+ all: $(SUBDIRS) $(TARGETS)
+ 
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/pam/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/pam/default.nix
index 12ff9f493a..33ab4f784f 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/pam/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/pam/default.nix
@@ -23,18 +23,6 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  postInstall = ''
-    mv -v $out/sbin/unix_chkpwd{,.orig}
-    ln -sv /run/wrappers/bin/unix_chkpwd $out/sbin/unix_chkpwd
-  ''; /*
-    rm -rf $out/etc
-    mkdir -p $modules/lib
-    mv $out/lib/security $modules/lib/
-  '';*/
-  # don't move modules, because libpam needs to (be able to) find them,
-  # which is done by dlopening $out/lib/security/pam_foo.so
-  # $out/etc was also missed: pam_env(login:session): Unable to open config file
-
   preConfigure = lib.optionalString (stdenv.hostPlatform.libc == "musl") ''
       # export ac_cv_search_crypt=no
       # (taken from Alpine linux, apparently insecure but also doesn't build O:))
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/sgx/sdk/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/sgx/sdk/default.nix
index 18876f927e..93c12da94a 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/sgx/sdk/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/sgx/sdk/default.nix
@@ -46,6 +46,11 @@ stdenv.mkDerivation rec {
   '';
 
   patches = [
+    # Fix missing pthread_compat.h, see https://github.com/intel/linux-sgx/pull/784
+    (fetchpatch {
+      url = "https://github.com/intel/linux-sgx/commit/254b58f922a6bd49c308a4f47f05f525305bd760.patch";
+      sha256 = "sha256-sHU++K7NJ+PdITx3y0PwstA9MVh10rj2vrLn01N9F4w=";
+    })
     # Commit to add missing sgx_ippcp.h not yet part of this release
     (fetchpatch {
       name = "add-missing-sgx_ippcp-header.patch";
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/systemd/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/systemd/default.nix
index 3c11c03dfd..f17dd02e7c 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/systemd/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/systemd/default.nix
@@ -415,7 +415,7 @@ stdenv.mkDerivation {
     "-Dnetworkd=${lib.boolToString withNetworkd}"
     "-Doomd=${lib.boolToString withOomd}"
     "-Dpolkit=${lib.boolToString withPolkit}"
-    "-Dcryptsetup=${lib.boolToString withCryptsetup}"
+    "-Dlibcryptsetup=${lib.boolToString withCryptsetup}"
     "-Dportabled=${lib.boolToString withPortabled}"
     "-Dhwdb=${lib.boolToString withHwdb}"
     "-Dremote=${lib.boolToString withRemote}"
@@ -453,7 +453,6 @@ stdenv.mkDerivation {
     "-Dsysvinit-path="
     "-Dsysvrcnd-path="
 
-    "-Dkill-path=${coreutils}/bin/kill"
     "-Dkmod-path=${kmod}/bin/kmod"
     "-Dsulogin-path=${util-linux}/bin/sulogin"
     "-Dmount-path=${util-linux}/bin/mount"
@@ -471,7 +470,6 @@ stdenv.mkDerivation {
   ] ++ lib.optionals withEfi [
     "-Defi-libdir=${toString gnu-efi}/lib"
     "-Defi-includedir=${toString gnu-efi}/include/efi"
-    "-Defi-ldsdir=${toString gnu-efi}/lib"
   ] ++ lib.optionals (withShellCompletions == false) [
     "-Dbashcompletiondir=no"
     "-Dzshcompletiondir=no"
diff --git a/third_party/nixpkgs/pkgs/servers/adguardhome/bins.nix b/third_party/nixpkgs/pkgs/servers/adguardhome/bins.nix
index 45de659f38..c07933129f 100644
--- a/third_party/nixpkgs/pkgs/servers/adguardhome/bins.nix
+++ b/third_party/nixpkgs/pkgs/servers/adguardhome/bins.nix
@@ -1,19 +1,19 @@
 { fetchurl, fetchzip }:
 {
 "x86_64-darwin" = fetchzip {
-  sha256 = "sha256-vRfKVjFFy4cO/TrA+wEFYp6jcJSB/QDU3if0FDdYu+M=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.0/AdGuardHome_darwin_amd64.zip";
+  sha256 = "sha256-hB3TL1FocAtLpBe+Rv2Pyon4f1ld+Fqapz6TUQ0O1jU=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.3/AdGuardHome_darwin_amd64.zip";
 };
 "i686-linux" = fetchurl {
-  sha256 = "sha256-gWylZgCk+bGf1h2lTX2gRnW39P7C2ks0LH7anJW6JKw=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.0/AdGuardHome_linux_386.tar.gz";
+  sha256 = "sha256-ZPHmFxKLJ1oxT18P6FDv74/leCzlESTrhNYuC8T6u+I=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.3/AdGuardHome_linux_386.tar.gz";
 };
 "x86_64-linux" = fetchurl {
-  sha256 = "sha256-g2DIeXwaqTTfshYyyDNHbOU57YUbuxXDKJHFqKFrqzw=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.0/AdGuardHome_linux_amd64.tar.gz";
+  sha256 = "sha256-yOvkEimDp646BCCFV2fnmVGe6R8geFlxtWLfPMVQ9Uk=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.3/AdGuardHome_linux_amd64.tar.gz";
 };
 "aarch64-linux" = fetchurl {
-  sha256 = "sha256-PovduGRcfSUbhqX1cxRgMknN8mWJekjjpB0b1TE1//g=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.0/AdGuardHome_linux_arm64.tar.gz";
+  sha256 = "sha256-ayNv2O0Ge3dT6YAN4SW/gsyoErCB3BJYsx/daMbGHjs=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.3/AdGuardHome_linux_arm64.tar.gz";
 };
 }
diff --git a/third_party/nixpkgs/pkgs/servers/adguardhome/default.nix b/third_party/nixpkgs/pkgs/servers/adguardhome/default.nix
index dcf397ed4b..cce9a1c159 100644
--- a/third_party/nixpkgs/pkgs/servers/adguardhome/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/adguardhome/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "adguardhome";
-  version = "0.107.0";
+  version = "0.107.3";
 
   src = (import ./bins.nix { inherit fetchurl fetchzip; }).${stdenv.hostPlatform.system};
 
diff --git a/third_party/nixpkgs/pkgs/servers/bird/default.nix b/third_party/nixpkgs/pkgs/servers/bird/default.nix
index bc8c8df355..9da7d7e948 100644
--- a/third_party/nixpkgs/pkgs/servers/bird/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/bird/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, flex, bison, readline, libssh }:
+{ lib, stdenv, fetchurl, fetchpatch, flex, bison, readline, libssh, nixosTests }:
 
 with lib;
 
@@ -34,6 +34,8 @@ let
         "--localstatedir=/var"
       ] ++ optional enableIPv6 "--enable-ipv6";
 
+      passthru.tests = nixosTests.bird;
+
       meta = {
         description = "BIRD Internet Routing Daemon";
         homepage = "http://bird.network.cz";
diff --git a/third_party/nixpkgs/pkgs/servers/home-assistant/default.nix b/third_party/nixpkgs/pkgs/servers/home-assistant/default.nix
index 0cb5e13fbd..e26c38bc87 100644
--- a/third_party/nixpkgs/pkgs/servers/home-assistant/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/home-assistant/default.nix
@@ -206,17 +206,26 @@ in python.pkgs.buildPythonApplication rec {
     ./patches/tests-ignore-OSErrors-in-hass-fixture.patch
   ];
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "aiohttp==3.8.1" "aiohttp" \
-      --replace "async_timeout==4.0.0" "async_timeout" \
-      --replace "bcrypt==3.1.7" "bcrypt" \
-      --replace "cryptography==35.0.0" "cryptography" \
-      --replace "httpx==0.21.0" "httpx" \
-      --replace "pip>=8.0.3,<20.3" "pip" \
-      --replace "PyJWT==2.1.0" "PyJWT" \
-      --replace "pyyaml==6.0" "pyyaml" \
-      --replace "yarl==1.6.3" "yarl"
+  postPatch = let
+    relaxedConstraints = [
+      "aiohttp"
+      "async_timeout"
+      "attrs"
+      "awesomeversion"
+      "bcrypt"
+      "cryptography"
+      "httpx"
+      "pip"
+      "PyJWT"
+      "requests"
+      "yarl"
+    ];
+  in ''
+    sed -r -i \
+      ${lib.concatStringsSep "\n" (map (package:
+        ''-e 's@${package}[<>=]+.*@${package}",@g' \''
+      ) relaxedConstraints)}
+    setup.py
     substituteInPlace tests/test_config.py --replace '"/usr"' '"/build/media"'
   '';
 
diff --git a/third_party/nixpkgs/pkgs/servers/matrix-synapse/default.nix b/third_party/nixpkgs/pkgs/servers/matrix-synapse/default.nix
index e8a887fa93..b94257e6d5 100644
--- a/third_party/nixpkgs/pkgs/servers/matrix-synapse/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/matrix-synapse/default.nix
@@ -11,11 +11,11 @@ in
 with python3.pkgs;
 buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.50.1";
+  version = "1.51.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-fdO+HJ1+fk+s65jLkPDiG+Ei89x5Fbkh9BUUFQ3NJ3M=";
+    sha256 = "sha256-qhwFRveFCwflQmVCwzThC8sP+YCqckgCaXAc3IRms0g=";
   };
 
   buildInputs = [ openssl ];
diff --git a/third_party/nixpkgs/pkgs/servers/monitoring/prometheus/redis-exporter.nix b/third_party/nixpkgs/pkgs/servers/monitoring/prometheus/redis-exporter.nix
index 440a21a6b6..59ccf2c805 100644
--- a/third_party/nixpkgs/pkgs/servers/monitoring/prometheus/redis-exporter.nix
+++ b/third_party/nixpkgs/pkgs/servers/monitoring/prometheus/redis-exporter.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "redis_exporter";
-  version = "1.33.0";
+  version = "1.34.1";
 
   src = fetchFromGitHub {
     owner = "oliver006";
     repo = "redis_exporter";
     rev = "v${version}";
-    sha256 = "sha256-3b0hlRjPXrMjFhXi8j4VvKJyRGicIk9FZUBRsBUp+Xo=";
+    sha256 = "sha256-poD7cuOxrNhhyW/GRxBjlJlRle38aYrQJ/g1d8TZ5o0=";
   };
 
-  vendorSha256 = "sha256-MVDb4JN2QqZNxANDLUZywgoBc2NpcaPB8TkR1xrq+Yk=";
+  vendorSha256 = "sha256-1ogMI8Aw1xBd2PQ2QRiDLifQL3Z3kU4PbbCgHLHtp6A=";
 
   ldflags = [
     "-X main.BuildVersion=${version}"
diff --git a/third_party/nixpkgs/pkgs/servers/mpd/default.nix b/third_party/nixpkgs/pkgs/servers/mpd/default.nix
index 0833ede1bb..9eff996f78 100644
--- a/third_party/nixpkgs/pkgs/servers/mpd/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/mpd/default.nix
@@ -13,7 +13,7 @@
 # Outputs
 , alsa-lib, libjack2, libpulseaudio, libshout, pipewire
 # Misc
-, icu, sqlite, avahi, dbus, pcre, libgcrypt, expat
+, icu, sqlite, avahi, dbus, pcre2, libgcrypt, expat
 # Services
 , yajl
 # Client support
@@ -79,7 +79,7 @@ let
     dbus          = [ dbus ];
     expat         = [ expat ];
     icu           = [ icu ];
-    pcre          = [ pcre ];
+    pcre          = [ pcre2 ];
     sqlite        = [ sqlite ];
     syslog        = [ ];
     systemd       = [ systemd ];
@@ -116,13 +116,13 @@ let
 
     in stdenv.mkDerivation rec {
       pname = "mpd";
-      version = "0.23.4";
+      version = "0.23.5";
 
       src = fetchFromGitHub {
         owner  = "MusicPlayerDaemon";
         repo   = "MPD";
         rev    = "v${version}";
-        sha256 = "sha256-siMFLV1fKdRt8To6AhLXmAAsgqZCA/bbvmlhbb6hLic=";
+        sha256 = "sha256-zsxh/rUJtcuke0zYBrh225Qd6RKo1SiFDbMmROdkyjI=";
       };
 
       buildInputs = [
diff --git a/third_party/nixpkgs/pkgs/servers/pulseaudio/default.nix b/third_party/nixpkgs/pkgs/servers/pulseaudio/default.nix
index f8eecf4916..664d9ef9f7 100644
--- a/third_party/nixpkgs/pkgs/servers/pulseaudio/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/pulseaudio/default.nix
@@ -26,7 +26,7 @@
 , # Whether to build only the library.
   libOnly ? false
 
-, AudioUnit, Cocoa, CoreServices, Libc
+, AudioUnit, Cocoa, CoreServices
 }:
 
 stdenv.mkDerivation rec {
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
   buildInputs =
     [ libtool libsndfile soxr speexdsp fftwFloat ]
     ++ lib.optionals stdenv.isLinux [ glib dbus ]
-    ++ lib.optionals stdenv.isDarwin [ AudioUnit Cocoa CoreServices Libc ]
+    ++ lib.optionals stdenv.isDarwin [ AudioUnit Cocoa CoreServices ]
     ++ lib.optionals (!libOnly) (
       [ libasyncns webrtc-audio-processing ]
       ++ lib.optional jackaudioSupport libjack2
@@ -101,8 +101,6 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-I${Libc}";
-
   installFlags =
     [ "sysconfdir=${placeholder "out"}/etc"
       "pulseconfdir=${placeholder "out"}/etc/pulse"
diff --git a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/default.nix b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/default.nix
index 0d457debc1..14de87c902 100644
--- a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/default.nix
@@ -10,13 +10,13 @@
 }@args:
 
 let
-  version = "2.8.0.beta10";
+  version = "2.8.0.beta11";
 
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse";
     rev = "v${version}";
-    sha256 = "sha256-mlTOsHR8p0mTdhZHBESyDAa1XtMJ4uIht0VUcGD6Ses=";
+    sha256 = "sha256-dTem4or0SunXCJFpNkeM0CSXY+58AeQAuMaLzhfGMY0=";
   };
 
   runtimeDeps = [
diff --git a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-assign/default.nix b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-assign/default.nix
index 090bffd966..006eb0ee88 100644
--- a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-assign/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-assign/default.nix
@@ -5,8 +5,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-assign";
-    rev = "920503f5fc2cbec1b3ba4d431cffda2281e12509";
-    sha256 = "sha256-qMUlJwETu99Qmbh4sn/1Vn7Xgaj3Jhi+/E8ecIbnVH8=";
+    rev = "a52da2396c5787a07c2746890bb44a0921a149e9";
+    sha256 = "sha256-UzpDesqxC20teyKYwqizYvjvR47zApyLporCU71RNvk=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-docs";
diff --git a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-calendar/Gemfile.lock b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-calendar/Gemfile.lock
index 218927821f..d8596a5c2f 100644
--- a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-calendar/Gemfile.lock
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-calendar/Gemfile.lock
@@ -1,7 +1,7 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (7.0.0)
+    activesupport (7.0.1)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
diff --git a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-calendar/default.nix b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-calendar/default.nix
index 4e9860acdc..ef3309652d 100644
--- a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-calendar/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-calendar/default.nix
@@ -6,8 +6,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-calendar";
-    rev = "9c5516ff039225be04b1302c5c67837ce64fba9c";
-    sha256 = "sha256-tfQWhkQvHrIUl0+tIv8X65MvoUhUnKD7KHwQbBm3p7U=";
+    rev = "f3b64f7b8c009f18bdc16def7c7299f747ea08ab";
+    sha256 = "sha256-ACbPMfqyFj9877r56qr+wxHEln+L1sAuQg/YUDGpuds=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-calendar";
diff --git a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-calendar/gemset.nix b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-calendar/gemset.nix
index cd8b76c1bf..a03e644d9b 100644
--- a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-calendar/gemset.nix
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-calendar/gemset.nix
@@ -5,10 +5,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "04bsr3420wb8y5pagg3s0rkx44fix47wrjvfby2d205l9bq6azyk";
+      sha256 = "02lys9pnb99hsczs551iqzjn008i8k7c728xxba7acfi9rdw9pa6";
       type = "gem";
     };
-    version = "7.0.0";
+    version = "7.0.1";
   };
   concurrent-ruby = {
     groups = ["default"];
diff --git a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-canned-replies/default.nix b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-canned-replies/default.nix
index 6bf41b11ec..7d9042f67b 100644
--- a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-canned-replies/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-canned-replies/default.nix
@@ -5,8 +5,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-canned-replies";
-    rev = "dbbb8740287e44b5e9f0d8c968e3d237154e1f3c";
-    sha256 = "sha256-o4yZaXiQpt7Bb29kVKJOiIdNgcSEOnSiFAIhZtiX6ys=";
+    rev = "598946bc92171426792f120f0a68ad4ecaae1c91";
+    sha256 = "sha256-HLrmj/dHj6wWUEqsFAh8gIPaZCIaXN1kZo17UHJwP70=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-canned-replies";
diff --git a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-chat-integration/default.nix b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-chat-integration/default.nix
index 18f1b31304..48192bd4a3 100644
--- a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-chat-integration/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-chat-integration/default.nix
@@ -5,8 +5,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-chat-integration";
-    rev = "46b2c05cbd00dbc49bff87d78f8e1ec4fdd43735";
-    sha256 = "sha256-G17obAc03FR3Qzn/IR++Y5Z1TkpP6lY5UDJsm4Lmj0M=";
+    rev = "45a16e2c40f9b79a351e52b905c7816ddbd29bb3";
+    sha256 = "sha256-cu9JhBB4ggsVzKlxe9x2WQVgwzwAA5U6OEKhbiRQACU=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-chat-integration";
diff --git a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-checklist/default.nix b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-checklist/default.nix
index f8247e84a7..5bd5d6ad31 100644
--- a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-checklist/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-checklist/default.nix
@@ -5,8 +5,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-checklist";
-    rev = "b4e14bdac40131bd70a698015b35a111a18c9f88";
-    sha256 = "sha256-okxcLu6gXvEY37ylnhit5B+LwCdV5gMKBpC/m/PaGtc=";
+    rev = "80d448b92173398530643ee07a40d6c60e4a3a5e";
+    sha256 = "sha256-FJtb7s4UQ6A4SEezB/58pmvpN+f1gVBY/G4GUzE20ME=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-checklist";
diff --git a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-data-explorer/default.nix b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-data-explorer/default.nix
index 0933a347b6..f30f60827f 100644
--- a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-data-explorer/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-data-explorer/default.nix
@@ -5,8 +5,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-data-explorer";
-    rev = "f77f5999069dbe98c49302566c82e5f77bb72db2";
-    sha256 = "sha256-N9LmFnza1pA3JRBE9bT9b/NhdYMKoF5GOUpq9XYdokY=";
+    rev = "58cfe737f7eb3d401a059edc8d24ed0ec22fa2f7";
+    sha256 = "sha256-pwzW+HCby2HD5SsnFCi8kUqN/dQuZiVkdmqQ2P2XQ2c=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-data-explorer";
diff --git a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-docs/default.nix b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-docs/default.nix
index 9c25200cc4..52088b0fde 100644
--- a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-docs/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-docs/default.nix
@@ -5,8 +5,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-docs";
-    rev = "e56816eb502b5ea37606f65a8df188e233f77240";
-    sha256 = "sha256-qvuoFsVXKa2IZgjVeqCca7X9jfohEBaoieZRsSFJCto=";
+    rev = "f8ac536160c662f29c49111beb5b18b70dbe8cd9";
+    sha256 = "sha256-pU5Dl+G2HRKfWi+W+P4ZP6A8EMqi9xaIYXx1xUg9I54=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-docs";
diff --git a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-github/Gemfile.lock b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-github/Gemfile.lock
index 3404b8a22a..837fd40ee0 100644
--- a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-github/Gemfile.lock
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-github/Gemfile.lock
@@ -3,25 +3,29 @@ GEM
   specs:
     addressable (2.8.0)
       public_suffix (>= 2.0.2, < 5.0)
-    faraday (1.8.0)
+    faraday (1.9.3)
       faraday-em_http (~> 1.0)
       faraday-em_synchrony (~> 1.0)
       faraday-excon (~> 1.1)
-      faraday-httpclient (~> 1.0.1)
+      faraday-httpclient (~> 1.0)
+      faraday-multipart (~> 1.0)
       faraday-net_http (~> 1.0)
-      faraday-net_http_persistent (~> 1.1)
+      faraday-net_http_persistent (~> 1.0)
       faraday-patron (~> 1.0)
       faraday-rack (~> 1.0)
-      multipart-post (>= 1.2, < 3)
+      faraday-retry (~> 1.0)
       ruby2_keywords (>= 0.0.4)
     faraday-em_http (1.0.0)
     faraday-em_synchrony (1.0.0)
     faraday-excon (1.1.0)
     faraday-httpclient (1.0.1)
+    faraday-multipart (1.0.3)
+      multipart-post (>= 1.2, < 3)
     faraday-net_http (1.0.1)
     faraday-net_http_persistent (1.2.0)
     faraday-patron (1.0.0)
     faraday-rack (1.0.0)
+    faraday-retry (1.0.3)
     multipart-post (2.1.1)
     octokit (4.21.0)
       faraday (>= 0.9)
diff --git a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-github/default.nix b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-github/default.nix
index 06c4ec85fb..6888018b62 100644
--- a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-github/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-github/default.nix
@@ -6,8 +6,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-github";
-    rev = "9fae5e365c1330bc25265e3bb2a06d29adb38266";
-    sha256 = "sha256-0HUrhO78XbTr6ygNFT+Uh70n2z9dFpimawh4u8fpNjg=";
+    rev = "f4635f94f8c1eaf38f7b025d1fc236e404a39414";
+    sha256 = "sha256-kd8iCgLuFxFbu8HR9ttzmVFF4AK0P7cbo1q15kD9Dp4=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-github";
diff --git a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-github/gemset.nix b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-github/gemset.nix
index 5b9b4e0985..29a1e080e8 100644
--- a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-github/gemset.nix
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-github/gemset.nix
@@ -11,15 +11,15 @@
     version = "2.8.0";
   };
   faraday = {
-    dependencies = ["faraday-em_http" "faraday-em_synchrony" "faraday-excon" "faraday-httpclient" "faraday-net_http" "faraday-net_http_persistent" "faraday-patron" "faraday-rack" "multipart-post" "ruby2_keywords"];
+    dependencies = ["faraday-em_http" "faraday-em_synchrony" "faraday-excon" "faraday-httpclient" "faraday-multipart" "faraday-net_http" "faraday-net_http_persistent" "faraday-patron" "faraday-rack" "faraday-retry" "ruby2_keywords"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0afhlqgby2cizcwgh7h2sq5f77q01axjbdl25bsvfwsry9n7gyyi";
+      sha256 = "0y32gj994ll3zlcqjmwp78r7s03iiwayij6fz2pjpkfywgvp71s6";
       type = "gem";
     };
-    version = "1.8.0";
+    version = "1.9.3";
   };
   faraday-em_http = {
     groups = ["default"];
@@ -61,6 +61,17 @@
     };
     version = "1.0.1";
   };
+  faraday-multipart = {
+    dependencies = ["multipart-post"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "03qfi9020ynf7hkdiaq01sd2mllvw7fg4qiin3pk028b4wv23j3j";
+      type = "gem";
+    };
+    version = "1.0.3";
+  };
   faraday-net_http = {
     groups = ["default"];
     platforms = [];
@@ -101,6 +112,16 @@
     };
     version = "1.0.0";
   };
+  faraday-retry = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "153i967yrwnswqgvnnajgwp981k9p50ys1h80yz3q94rygs59ldd";
+      type = "gem";
+    };
+    version = "1.0.3";
+  };
   multipart-post = {
     groups = ["default"];
     platforms = [];
diff --git a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-ldap-auth/default.nix b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-ldap-auth/default.nix
index ea71c69a07..9010ee21a8 100644
--- a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-ldap-auth/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-ldap-auth/default.nix
@@ -6,8 +6,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "jonmbake";
     repo = "discourse-ldap-auth";
-    rev = "1c10221836393c3cfac470a7b08de6f31150c802";
-    sha256 = "sha256-IiAl3OTADXSUnL+OKKHJY9Xqd4zCNJ2wOrgTN3nm5Yw=";
+    rev = "fe014176bd635e7df24ee2978d356e1f87d8daed";
+    sha256 = "sha256-1Cx+65rJx292sTfPUfbzSfJAU71V1pKWvWdLNCq8M8A=";
   };
   meta = with lib; {
     homepage = "https://github.com/jonmbake/discourse-ldap-auth";
diff --git a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-math/default.nix b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-math/default.nix
index d934227556..b3a131bc4d 100644
--- a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-math/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-math/default.nix
@@ -5,8 +5,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-math";
-    rev = "3de98fc75b7d06d06651edc48449b1bb71d2171b";
-    sha256 = "sha256-HDhy6uvfmBxJq9UobLhAUdFcYULFvPZbb5vT1Sg7ung=";
+    rev = "33662c4b1d8a3faa6138261bd6a6043b4d9ac037";
+    sha256 = "sha256-UMGj2KqYHs7MtVHBGLUgUKA7wzhX32160b4OihiwgCI=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-math";
diff --git a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-openid-connect/default.nix b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-openid-connect/default.nix
index 6f1044939a..88ab125a2c 100644
--- a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-openid-connect/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-openid-connect/default.nix
@@ -6,8 +6,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-openid-connect";
-    rev = "aa6a628687edc041bd6f46eb2a38e9a71644bdda";
-    sha256 = "sha256-VdaeueESr7X4gB1pW9e//nDLz62GTaZEPyFIvvCfg18=";
+    rev = "bba36d68a44b1e1d19729d14fd04ad280fc32c58";
+    sha256 = "sha256-9CV5A3gQzYvokTLNOwoX1jQhGaZQBn4tn5jn7bfhLS4=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-openid-connect";
diff --git a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-prometheus/default.nix b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-prometheus/default.nix
index 1300292132..0695b01d95 100644
--- a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-prometheus/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-prometheus/default.nix
@@ -6,8 +6,8 @@
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-prometheus";
-    rev = "aaaf3eda30e5fc03c880c056c1f2388739569fb0";
-    sha256 = "sha256-8bfjPCcwDjEC7Tu0Jr9VZRpaDlP2nlIOWBH8pUQakxo=";
+    rev = "d71565f7ee4d3fe5cef8c8831a20cec5e52a1367";
+    sha256 = "sha256-Zn/ZzbMyHImQ9vc7KJI2gtVKYyqbWOZWK3qg7BK0xxQ=";
   };
 
   patches = [
diff --git a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-saved-searches/default.nix b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-saved-searches/default.nix
index c9e0b8a354..13976649bf 100644
--- a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-saved-searches/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-saved-searches/default.nix
@@ -5,8 +5,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-saved-searches";
-    rev = "0c14b9080306c2e35abf32f8211076286fdfbd2f";
-    sha256 = "sha256-ahNw2WL5J4qAyUBgpYWTiS4G+QmQa+gloG2Vu67qXR8=";
+    rev = "a10f2eb7ccbf3be037144978d0aa36d8fa44115b";
+    sha256 = "sha256-WIqju9JUy3bij2iHHjWv/+TfODev5icYNYS5kRruLcc=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-saved-searches";
diff --git a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-solved/default.nix b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-solved/default.nix
index 9ec64d2fde..b90c540669 100644
--- a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-solved/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-solved/default.nix
@@ -5,8 +5,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-solved";
-    rev = "6f50e2633545e160c01188bdfa9e57adf1d18adc";
-    sha256 = "sha256-+L4GzJrt15vYY29iYxVpPZFYhLygZJK4I5fqvhdI/HI=";
+    rev = "d7c8c95f2dbc7fa94b09d2590d70558346f6e81e";
+    sha256 = "sha256-utuv7JL/WJU48TE0+RIRoUpIFrcUpQGvPzfIXA2ZCL8=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-solved";
diff --git a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-spoiler-alert/default.nix b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-spoiler-alert/default.nix
index 13ea320f74..351f41b192 100644
--- a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-spoiler-alert/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-spoiler-alert/default.nix
@@ -5,8 +5,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-spoiler-alert";
-    rev = "f9545afaa557829f8f0c17a856e028a5be7407cf";
-    sha256 = "sha256-VhA7tK+uE2r6E66yn5FbT+Mdp9Ckj92xCF3Q9Wp60T8=";
+    rev = "0cbbaa20f5bf097a0d4ec1361534f97e4b7e1604";
+    sha256 = "sha256-FpA1+ZC5rInUkCrWMU3HU9Hmi/58f/OrfmeXd5nowvU=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-spoiler-alert";
diff --git a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-voting/default.nix b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-voting/default.nix
index 708e0b1169..df787e3835 100644
--- a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-voting/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-voting/default.nix
@@ -5,8 +5,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-voting";
-    rev = "c2d8b9456834796e90f2e13e7d11a08f389531e1";
-    sha256 = "sha256-z6JBsuq4nj1eqfU/xoU4xWcVNphuyr3C3iKO0chcSz4=";
+    rev = "5011df324caaa89433f089bb9d9cfdf919457b11";
+    sha256 = "sha256-2iPbC/nvTmJ8heqX1C8sfNnkTeO6jHn+gzEraAdJvMg=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-voting";
diff --git a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-yearly-review/default.nix b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-yearly-review/default.nix
index 95a65f49fb..82a34bedf2 100644
--- a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-yearly-review/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/plugins/discourse-yearly-review/default.nix
@@ -5,8 +5,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-yearly-review";
-    rev = "e42f48a576b753cb1e042e9693af35214333bb0f";
-    sha256 = "sha256-8+pwiQE0Ytva0t80bRDs+7mTZ82fPpmwb7Nk9boPFt8=";
+    rev = "69a6c2ca39a41d88ff07ebd7c38c082082415dc9";
+    sha256 = "sha256-jrpKjINnAxfkMdK89b0OyKkgivIC4L/aL5qU4XZdgnk=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-yearly-review";
diff --git a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
index aec33b300e..7acfba36ad 100644
--- a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
@@ -80,7 +80,7 @@ GEM
       rack (>= 0.9.0)
     binding_of_caller (1.0.0)
       debug_inspector (>= 0.0.1)
-    bootsnap (1.9.3)
+    bootsnap (1.9.4)
       msgpack (~> 1.0)
     builder (3.2.4)
     bullet (7.0.0)
@@ -104,7 +104,7 @@ GEM
     css_parser (1.11.0)
       addressable
     debug_inspector (1.1.0)
-    diff-lcs (1.4.4)
+    diff-lcs (1.5.0)
     diffy (3.4.0)
     discourse-ember-rails (0.18.6)
       active_model_serializers
@@ -119,8 +119,8 @@ GEM
       faker (~> 2.16)
       literate_randomizer
     docile (1.4.0)
-    ecma-re-validator (0.3.0)
-      regexp_parser (~> 2.0)
+    ecma-re-validator (0.4.0)
+      regexp_parser (~> 2.2)
     email_reply_trimmer (0.1.13)
     ember-data-source (3.0.2)
       ember-source (>= 2, < 3.0)
@@ -136,29 +136,33 @@ GEM
     faker (2.19.0)
       i18n (>= 1.6, < 2)
     fakeweb (1.3.0)
-    faraday (1.8.0)
+    faraday (1.9.3)
       faraday-em_http (~> 1.0)
       faraday-em_synchrony (~> 1.0)
       faraday-excon (~> 1.1)
-      faraday-httpclient (~> 1.0.1)
+      faraday-httpclient (~> 1.0)
+      faraday-multipart (~> 1.0)
       faraday-net_http (~> 1.0)
-      faraday-net_http_persistent (~> 1.1)
+      faraday-net_http_persistent (~> 1.0)
       faraday-patron (~> 1.0)
       faraday-rack (~> 1.0)
-      multipart-post (>= 1.2, < 3)
+      faraday-retry (~> 1.0)
       ruby2_keywords (>= 0.0.4)
     faraday-em_http (1.0.0)
     faraday-em_synchrony (1.0.0)
     faraday-excon (1.1.0)
     faraday-httpclient (1.0.1)
+    faraday-multipart (1.0.3)
+      multipart-post (>= 1.2, < 3)
     faraday-net_http (1.0.1)
     faraday-net_http_persistent (1.2.0)
     faraday-patron (1.0.0)
     faraday-rack (1.0.0)
+    faraday-retry (1.0.3)
     fast_blank (1.0.1)
     fast_xs (0.8.0)
     fastimage (2.2.6)
-    ffi (1.15.4)
+    ffi (1.15.5)
     fspath (3.1.2)
     gc_tracer (1.5.1)
     globalid (1.0.0)
@@ -166,7 +170,7 @@ GEM
     guess_html_encoding (0.0.11)
     hana (1.3.7)
     hashdiff (1.0.1)
-    hashie (4.1.0)
+    hashie (5.0.0)
     highline (2.0.3)
     hkdf (0.3.0)
     htmlentities (4.3.4)
@@ -182,7 +186,7 @@ GEM
     image_size (3.0.1)
     in_threads (1.5.4)
     ipaddr (1.2.3)
-    jmespath (1.4.0)
+    jmespath (1.5.0)
     jquery-rails (4.4.0)
       rails-dom-testing (>= 1, < 3)
       railties (>= 4.2.0)
@@ -218,12 +222,12 @@ GEM
     lz4-ruby (0.3.3)
     maxminddb (0.1.22)
     memory_profiler (1.0.0)
-    message_bus (3.3.8)
+    message_bus (4.0.0)
       rack (>= 1.1.3)
     method_source (1.0.0)
     mini_mime (1.1.2)
     mini_portile2 (2.6.1)
-    mini_racer (0.5.0)
+    mini_racer (0.6.1)
       libv8-node (~> 16.10.0.0)
     mini_scheduler (0.13.0)
       sidekiq (>= 4.2.3)
@@ -281,7 +285,7 @@ GEM
     parallel (1.21.0)
     parallel_tests (3.7.3)
       parallel
-    parser (3.0.3.2)
+    parser (3.1.0.0)
       ast (~> 2.4.1)
     pg (1.2.3)
     progress (3.6.0)
@@ -323,7 +327,7 @@ GEM
       method_source
       rake (>= 0.13)
       thor (~> 1.0)
-    rainbow (3.0.0)
+    rainbow (3.1.1)
     raindrops (0.20.0)
     rake (13.0.6)
     rb-fsevent (0.11.0)
@@ -378,21 +382,21 @@ GEM
       json-schema (~> 2.2)
       railties (>= 3.1, < 7.0)
     rtlit (0.0.5)
-    rubocop (1.23.0)
+    rubocop (1.24.1)
       parallel (~> 1.10)
       parser (>= 3.0.0.0)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 1.8, < 3.0)
       rexml
-      rubocop-ast (>= 1.12.0, < 2.0)
+      rubocop-ast (>= 1.15.1, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 1.4.0, < 3.0)
-    rubocop-ast (1.15.0)
+    rubocop-ast (1.15.1)
       parser (>= 3.0.1.1)
     rubocop-discourse (2.5.0)
       rubocop (>= 1.1.0)
       rubocop-rspec (>= 2.0.0)
-    rubocop-rspec (2.6.0)
+    rubocop-rspec (2.7.0)
       rubocop (~> 1.19)
     ruby-prof (1.4.3)
     ruby-progressbar (1.11.0)
@@ -416,7 +420,7 @@ GEM
     seed-fu (2.3.9)
       activerecord (>= 3.1)
       activesupport (>= 3.1)
-    shoulda-matchers (5.0.0)
+    shoulda-matchers (5.1.0)
       activesupport (>= 5.2.0)
     sidekiq (6.3.1)
       connection_pool (>= 2.2.2)
@@ -438,7 +442,7 @@ GEM
     sshkey (2.0.0)
     stackprof (0.2.17)
     test-prof (1.0.7)
-    thor (1.1.0)
+    thor (1.2.1)
     tilt (2.0.10)
     tzinfo (2.0.4)
       concurrent-ruby (~> 1.0)
@@ -448,7 +452,7 @@ GEM
       unf_ext
     unf_ext (0.0.8)
     unicode-display_width (2.1.0)
-    unicorn (6.0.0)
+    unicorn (6.1.0)
       kgio (~> 2.6)
       raindrops (~> 0.7)
     uniform_notifier (1.14.2)
@@ -462,7 +466,7 @@ GEM
       jwt (~> 2.0)
     xorcist (1.1.2)
     yaml-lint (0.0.10)
-    zeitwerk (2.5.1)
+    zeitwerk (2.5.3)
 
 PLATFORMS
   ruby
@@ -597,4 +601,4 @@ DEPENDENCIES
   yaml-lint
 
 BUNDLED WITH
-   2.2.26
+   2.3.4
diff --git a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix
index 36b50339e0..7ed5b54e30 100644
--- a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix
@@ -252,10 +252,10 @@
     }];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "18prmylz53gsw651f0sibb2mvdxgd2zzdzh6a9a1idpqhyxcnbg7";
+      sha256 = "19i4x2nascd74ahcvmrsnf03cygh1y4c9yf8rcv91fv0mcxpvb9n";
       type = "gem";
     };
-    version = "1.9.3";
+    version = "1.9.4";
   };
   builder = {
     groups = ["default" "development" "test"];
@@ -434,10 +434,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0m925b8xc6kbpnif9dldna24q1szg4mk0fvszrki837pfn46afmz";
+      sha256 = "0rwvjahnp7cpmracd8x732rjgnilqv2sx7d1gfrysslc3h039fa9";
       type = "gem";
     };
-    version = "1.4.4";
+    version = "1.5.0";
   };
   diffy = {
     groups = ["default"];
@@ -507,10 +507,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mz0nsl2093jd94nygw8qs13rwfwl1ax76xz3ypinr5hqbc5pab6";
+      sha256 = "1kqci9ixr1jfp2aaq5lsyz5lkn37z2k94ww9d2hyrd8ncrhrhx8f";
       type = "gem";
     };
-    version = "0.3.0";
+    version = "0.4.0";
   };
   email_reply_trimmer = {
     groups = ["default"];
@@ -630,15 +630,15 @@
     version = "1.3.0";
   };
   faraday = {
-    dependencies = ["faraday-em_http" "faraday-em_synchrony" "faraday-excon" "faraday-httpclient" "faraday-net_http" "faraday-net_http_persistent" "faraday-patron" "faraday-rack" "multipart-post" "ruby2_keywords"];
+    dependencies = ["faraday-em_http" "faraday-em_synchrony" "faraday-excon" "faraday-httpclient" "faraday-multipart" "faraday-net_http" "faraday-net_http_persistent" "faraday-patron" "faraday-rack" "faraday-retry" "ruby2_keywords"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0afhlqgby2cizcwgh7h2sq5f77q01axjbdl25bsvfwsry9n7gyyi";
+      sha256 = "0y32gj994ll3zlcqjmwp78r7s03iiwayij6fz2pjpkfywgvp71s6";
       type = "gem";
     };
-    version = "1.8.0";
+    version = "1.9.3";
   };
   faraday-em_http = {
     groups = ["default"];
@@ -680,6 +680,17 @@
     };
     version = "1.0.1";
   };
+  faraday-multipart = {
+    dependencies = ["multipart-post"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "03qfi9020ynf7hkdiaq01sd2mllvw7fg4qiin3pk028b4wv23j3j";
+      type = "gem";
+    };
+    version = "1.0.3";
+  };
   faraday-net_http = {
     groups = ["default"];
     platforms = [];
@@ -720,6 +731,16 @@
     };
     version = "1.0.0";
   };
+  faraday-retry = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "153i967yrwnswqgvnnajgwp981k9p50ys1h80yz3q94rygs59ldd";
+      type = "gem";
+    };
+    version = "1.0.3";
+  };
   fast_blank = {
     groups = ["default"];
     platforms = [{
@@ -771,10 +792,10 @@
     }];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ssxcywmb3flxsjdg13is6k01807zgzasdhj4j48dm7ac59cmksn";
+      sha256 = "1862ydmclzy1a0cjbvm8dz7847d9rch495ib0zb64y84d3xd4bkg";
       type = "gem";
     };
-    version = "1.15.4";
+    version = "1.15.5";
   };
   fspath = {
     groups = ["default"];
@@ -846,10 +867,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "02bsx12ihl78x0vdm37byp78jjw2ff6035y7rrmbd90qxjwxr43q";
+      sha256 = "1nh3arcrbz1rc1cr59qm53sdhqm137b258y8rcb4cvd3y98lwv4x";
       type = "gem";
     };
-    version = "4.1.0";
+    version = "5.0.0";
   };
   highline = {
     groups = ["default"];
@@ -948,10 +969,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1d4wac0dcd1jf6kc57891glih9w57552zgqswgy74d1xhgnk0ngf";
+      sha256 = "1ylph158dc3ql6cvkik00ab6gf2k1rv2dii63m196xclhkzwfyan";
       type = "gem";
     };
-    version = "1.4.0";
+    version = "1.5.0";
   };
   jquery-rails = {
     dependencies = ["rails-dom-testing" "railties" "thor"];
@@ -1175,10 +1196,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0xf3r47qpigg661krwa8z7k4f0z0rx9r5g2mgahrrwgjn67d332l";
+      sha256 = "0589k3ggj6s970mr2jaz8zfcnl5b926birwi6s3b6j3ijf2nh3s3";
       type = "gem";
     };
-    version = "3.3.8";
+    version = "4.0.0";
   };
   method_source = {
     groups = ["default" "development" "test"];
@@ -1216,10 +1237,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1b6lahs31m3ky4maq8s83w35lkariq0g1f6bjhnaxvwzjhhar5cf";
+      sha256 = "1j45mg8fs7i0g6ndbzd9qqs3fhq6wpvlp5s95k6mjn1as71l5l55";
       type = "gem";
     };
-    version = "0.5.0";
+    version = "0.6.1";
   };
   mini_scheduler = {
     dependencies = ["sidekiq"];
@@ -1530,10 +1551,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0sszdl9mpzqzn9kxrp28sqmg47mjxcwypr4d60vbajqba4v885di";
+      sha256 = "08q20ckhn58m49lccf93p0yv7pkc7hymmcz3di762kb658d5fd38";
       type = "gem";
     };
-    version = "3.0.3.2";
+    version = "3.1.0.0";
   };
   pg = {
     groups = ["default"];
@@ -1736,10 +1757,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bb2fpjspydr6x0s8pn1pqkzmxszvkfapv0p4627mywl7ky4zkhk";
+      sha256 = "0smwg4mii0fm38pyb5fddbmrdpifwv22zv3d3px2xx497am93503";
       type = "gem";
     };
-    version = "3.0.0";
+    version = "3.1.1";
   };
   raindrops = {
     groups = ["default"];
@@ -2020,10 +2041,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "03ivbqd5blsb7v5mhrzxvn23779rqpyrsm7l086pb6ihp47122qb";
+      sha256 = "1sn7ag295blmhpwv6x472m3fd0n25swz9imqwpk0hg21rdcdw7p0";
       type = "gem";
     };
-    version = "1.23.0";
+    version = "1.24.1";
   };
   rubocop-ast = {
     dependencies = ["parser"];
@@ -2031,10 +2052,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bj8ppl4143f7pkcwm4l5wcahid6yzracdlzh1w2fpss89pic2rf";
+      sha256 = "1xrij42166a71ixfpfr1pildqdrcmc0cb4906h2s8sk4kqdyngih";
       type = "gem";
     };
-    version = "1.15.0";
+    version = "1.15.1";
   };
   rubocop-discourse = {
     dependencies = ["rubocop" "rubocop-rspec"];
@@ -2053,10 +2074,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0g7kwmb1ilmc8pfyvfh87yjp26qzij2ib7h3lqcl42cp33cg2zzk";
+      sha256 = "1d76haw5gjpxlfanfzicn7sb5gziyizaksm7i999p7p5dmy5vf9q";
       type = "gem";
     };
-    version = "2.6.0";
+    version = "2.7.0";
   };
   ruby-prof = {
     groups = ["development"];
@@ -2163,10 +2184,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0z6v2acldnvqrnvfk70f9xq39ppw5j03kbz2hpz7s17lgnn21vx8";
+      sha256 = "01svmyma958sbqfz0v29lbqbr0ibvgcng352nhx6bsc9k5c207d0";
       type = "gem";
     };
-    version = "5.0.0";
+    version = "5.1.0";
   };
   sidekiq = {
     dependencies = ["connection_pool" "rack" "redis"];
@@ -2271,10 +2292,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "18yhlvmfya23cs3pvhr1qy38y41b6mhr5q9vwv5lrgk16wmf3jna";
+      sha256 = "0inl77jh4ia03jw3iqm5ipr76ghal3hyjrd6r8zqsswwvi9j2xdi";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.2.1";
   };
   tilt = {
     groups = ["default"];
@@ -2351,10 +2372,10 @@
     }];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1jcm85d7j7njfgims712svlgml32zjim6qwabm99645aj5laayln";
+      sha256 = "1h0gma14jjxiz6piyi6p99q7lya2mxrq79l03160hascvmx9ipa5";
       type = "gem";
     };
-    version = "6.0.0";
+    version = "6.1.0";
   };
   uniform_notifier = {
     groups = ["default" "development"];
@@ -2423,9 +2444,9 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "18l4r6layck0d80ydc692mv1lxak5xbf6w2paj1x7m2ggbggzxgj";
+      sha256 = "0lmg9x683gr9mkrbq9df2m0zb0650mdfxqna0bs10js44inv7znx";
       type = "gem";
     };
-    version = "2.5.1";
+    version = "2.5.3";
   };
 }
diff --git a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/unicorn_logging_and_timeout.patch b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/unicorn_logging_and_timeout.patch
index d78b511f6a..2541e7311b 100644
--- a/third_party/nixpkgs/pkgs/servers/web-apps/discourse/unicorn_logging_and_timeout.patch
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/discourse/unicorn_logging_and_timeout.patch
@@ -1,11 +1,11 @@
 diff --git a/config/unicorn.conf.rb b/config/unicorn.conf.rb
-index ffcafcb618..31ba691983 100644
+index e69979adfe..68cb04a036 100644
 --- a/config/unicorn.conf.rb
 +++ b/config/unicorn.conf.rb
-@@ -27,18 +27,10 @@ pid (ENV["UNICORN_PID_PATH"] || "#{discourse_path}/tmp/pids/unicorn.pid")
+@@ -27,17 +27,9 @@ pid (ENV["UNICORN_PID_PATH"] || "#{discourse_path}/tmp/pids/unicorn.pid")
  
  if ENV["RAILS_ENV"] != "production"
-   logger Logger.new($stdout)
+   logger Logger.new(STDOUT)
 -  # we want a longer timeout in dev cause first request can be really slow
 -  timeout (ENV["UNICORN_TIMEOUT"] && ENV["UNICORN_TIMEOUT"].to_i || 60)
 -else
diff --git a/third_party/nixpkgs/pkgs/servers/web-apps/wiki-js/default.nix b/third_party/nixpkgs/pkgs/servers/web-apps/wiki-js/default.nix
index bfbe46388d..3b4af1b86a 100644
--- a/third_party/nixpkgs/pkgs/servers/web-apps/wiki-js/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/wiki-js/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "wiki-js";
-  version = "2.5.268";
+  version = "2.5.272";
 
   src = fetchurl {
     url = "https://github.com/Requarks/wiki/releases/download/${version}/${pname}.tar.gz";
-    sha256 = "sha256-Ec4trrVETbgKs41aIc4Ne02c969Qc44QtoBf8tyk4+I=";
+    sha256 = "sha256-30thDjmjc24tChgih0FZyIUU6/aKKl4MAD5yqn0yYa4=";
   };
 
   sourceRoot = ".";
diff --git a/third_party/nixpkgs/pkgs/shells/dash/default.nix b/third_party/nixpkgs/pkgs/shells/dash/default.nix
index 2a0d731456..a1f789dc3a 100644
--- a/third_party/nixpkgs/pkgs/shells/dash/default.nix
+++ b/third_party/nixpkgs/pkgs/shells/dash/default.nix
@@ -5,6 +5,8 @@
 , fetchurl
 , fetchpatch
 , libedit
+, runCommand
+, dash
 }:
 
 stdenv.mkDerivation rec {
@@ -52,5 +54,13 @@ stdenv.mkDerivation rec {
 
   passthru = {
     shellPath = "/bin/dash";
+    tests = {
+      "execute-simple-command" = runCommand "${pname}-execute-simple-command" { } ''
+        mkdir $out
+        ${dash}/bin/dash -c 'echo "Hello World!" > $out/success'
+        [ -s $out/success ]
+        grep -q "Hello World" $out/success
+      '';
+    };
   };
 }
diff --git a/third_party/nixpkgs/pkgs/stdenv/booter.nix b/third_party/nixpkgs/pkgs/stdenv/booter.nix
index 51d617354e..f1d07e6461 100644
--- a/third_party/nixpkgs/pkgs/stdenv/booter.nix
+++ b/third_party/nixpkgs/pkgs/stdenv/booter.nix
@@ -124,7 +124,13 @@ stageFuns: let
       if buildPackages.stdenv.hasCC
       then
         if buildPackages.stdenv.cc.isClang or false
-        then buildPackages.clang
+        # buildPackages.clang checks targetPackages.stdenv.cc (i. e. this
+        # attribute) to get a sense of the its set's default compiler and
+        # chooses between libc++ and libstdc++ based on that. If we hit this
+        # code here, we'll cause an infinite recursion. Since a set with
+        # clang as its default compiler always means libc++, we can infer this
+        # decision statically.
+        then buildPackages.llvmPackages.libcxxClang
         else buildPackages.gcc
       else
         # This will blow up if anything uses it, but that's OK. The `if
diff --git a/third_party/nixpkgs/pkgs/stdenv/cross/default.nix b/third_party/nixpkgs/pkgs/stdenv/cross/default.nix
index 613b8d5304..e01ac74599 100644
--- a/third_party/nixpkgs/pkgs/stdenv/cross/default.nix
+++ b/third_party/nixpkgs/pkgs/stdenv/cross/default.nix
@@ -70,7 +70,7 @@ in lib.init bootStages ++ [
              # when there is a C compiler and everything should be fine.
              then throw "no C compiler provided for this platform"
            else if crossSystem.isDarwin
-             then buildPackages.llvmPackages.clang
+             then buildPackages.llvmPackages.libcxxClang
            else if crossSystem.useLLVM or false
              then buildPackages.llvmPackages.clangUseLLVM
            else buildPackages.gcc;
diff --git a/third_party/nixpkgs/pkgs/stdenv/darwin/default.nix b/third_party/nixpkgs/pkgs/stdenv/darwin/default.nix
index 24ad0cb695..a6f927c287 100644
--- a/third_party/nixpkgs/pkgs/stdenv/darwin/default.nix
+++ b/third_party/nixpkgs/pkgs/stdenv/darwin/default.nix
@@ -399,6 +399,8 @@ rec {
       persistent = self: super: with prevStage; {
         cmake = super.cmakeMinimal;
 
+        curl = super.curlMinimal;
+
         inherit pbzx cpio;
 
         python3 = super.python3Minimal;
@@ -755,6 +757,9 @@ rec {
         darwin.binutils
         darwin.binutils.bintools
         curl.out
+        zstd.out
+        libidn2.out
+        libunistring.out
         openssl.out
         libssh2.out
         nghttp2.lib
diff --git a/third_party/nixpkgs/pkgs/stdenv/generic/default.nix b/third_party/nixpkgs/pkgs/stdenv/generic/default.nix
index 49ebc67f85..4fb98e5e80 100644
--- a/third_party/nixpkgs/pkgs/stdenv/generic/default.nix
+++ b/third_party/nixpkgs/pkgs/stdenv/generic/default.nix
@@ -112,7 +112,7 @@ let
       # are absolute unless we go out of our way to make them relative (like with CF)
       # TODO: This really wants to be in stdenv/darwin but we don't have hostPlatform
       # there (yet?) so it goes here until then.
-      preHook = preHook+ lib.optionalString buildPlatform.isDarwin ''
+      preHook = preHook + lib.optionalString buildPlatform.isDarwin ''
         export NIX_DONT_SET_RPATH_FOR_BUILD=1
       '' + lib.optionalString (hostPlatform.isDarwin || (hostPlatform.parsed.kernel.execFormat != lib.systems.parse.execFormats.elf && hostPlatform.parsed.kernel.execFormat != lib.systems.parse.execFormats.macho)) ''
         export NIX_DONT_SET_RPATH=1
@@ -168,6 +168,11 @@ let
       inherit overrides;
 
       inherit cc hasCC;
+
+      # Convenience for doing some very basic shell syntax checking by parsing a script
+      # without running any commands. Because this will also skip `shopt -s extglob`
+      # commands and extglob affects the Bash parser, we enable extglob always.
+      shellDryRun = "${stdenv.shell} -n -O extglob";
     }
 
     # Propagate any extra attributes.  For instance, we use this to
diff --git a/third_party/nixpkgs/pkgs/stdenv/linux/bootstrap-files/aarch64.nix b/third_party/nixpkgs/pkgs/stdenv/linux/bootstrap-files/aarch64.nix
index 592f8ee6be..aa81cbd84a 100644
--- a/third_party/nixpkgs/pkgs/stdenv/linux/bootstrap-files/aarch64.nix
+++ b/third_party/nixpkgs/pkgs/stdenv/linux/bootstrap-files/aarch64.nix
@@ -1,11 +1,11 @@
 {
   busybox = import <nix/fetchurl.nix> {
-    url = "http://tarballs.nixos.org/stdenv-linux/aarch64/bb3ef8a95c9659596b8a34d27881cd30ffea2f9f/busybox";
-    sha256 = "12qcml1l67skpjhfjwy7gr10nc86gqcwjmz9ggp7knss8gq8pv7f";
+    url = "http://tarballs.nixos.org/stdenv-linux/aarch64/c7c997a0662bf88264db52cbc41e67884eb7a1ff/busybox";
+    sha256 = "sha256-4EN2vLvXUkelZZR2eKaAQA5kCEuHNvRZN6dcohxVY+c=";
     executable = true;
   };
   bootstrapTools = import <nix/fetchurl.nix> {
-    url = "http://tarballs.nixos.org/stdenv-linux/aarch64/c5aabb0d603e2c1ea05f5a93b3be82437f5ebf31/bootstrap-tools.tar.xz";
-    sha256 = "d3f1bf2a1495b97f45359d5623bdb1f8eb75db43d3bf2059fc127b210f059358";
+    url = "http://tarballs.nixos.org/stdenv-linux/aarch64/c7c997a0662bf88264db52cbc41e67884eb7a1ff/bootstrap-tools.tar.xz";
+    sha256 = "sha256-AjOvmaW8JFVZaBSRUMKufr9kJozg/tsZr7PvUEBQyi4=";
   };
 }
diff --git a/third_party/nixpkgs/pkgs/tools/admin/azure-cli/python-packages.nix b/third_party/nixpkgs/pkgs/tools/admin/azure-cli/python-packages.nix
index a917112cc5..0339caa72c 100644
--- a/third_party/nixpkgs/pkgs/tools/admin/azure-cli/python-packages.nix
+++ b/third_party/nixpkgs/pkgs/tools/admin/azure-cli/python-packages.nix
@@ -466,6 +466,8 @@ let
           inherit version;
           sha256 = "sha256-109FuBMXRU2W6YL9HFDm+1yZrCIjcorqh2RDOjn1ZvE=";
         };
+        # sdist lacks tests
+        doCheck = false;
       });
 
       semver = super.semver.overridePythonAttrs(oldAttrs: rec {
diff --git a/third_party/nixpkgs/pkgs/tools/admin/fits-cloudctl/default.nix b/third_party/nixpkgs/pkgs/tools/admin/fits-cloudctl/default.nix
index a71f6e8f63..322e3535b8 100644
--- a/third_party/nixpkgs/pkgs/tools/admin/fits-cloudctl/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/admin/fits-cloudctl/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "fits-cloudctl";
-  version = "0.10.5";
+  version = "0.10.6";
 
   src = fetchFromGitHub {
     owner = "fi-ts";
     repo = "cloudctl";
     rev = "v${version}";
-    sha256 = "sha256-l01c1tjS0L+T/kHreYx3A5/N/oRDuDywXS/GAvUCxSk=";
+    sha256 = "sha256-GSdVwpYmJ3VnZaMQ8SjzcHpeefFjSaZXRcUAXEI9PKo=";
   };
 
-  vendorSha256 = "sha256-iJlNNovsIgTOPfAzwqkumrmCQu2xI/neqH+Z4tvSXeY=";
+  vendorSha256 = "sha256-RZ4cy9XHpWRP85G4A1/qYPjt/4CZ7pgECf+rsViPjGE=";
 
   meta = with lib; {
     description = "Command-line client for FI-TS Finance Cloud Native services";
diff --git a/third_party/nixpkgs/pkgs/tools/audio/yabridge/default.nix b/third_party/nixpkgs/pkgs/tools/audio/yabridge/default.nix
index c468a845a1..688906e684 100644
--- a/third_party/nixpkgs/pkgs/tools/audio/yabridge/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/audio/yabridge/default.nix
@@ -105,11 +105,7 @@ in multiStdenv.mkDerivation rec {
     "-Dwith-bitbridge=true"
 
     # Requires CMake and is unnecessary
-    "-Dtomlplusplus:GENERATE_CMAKE_CONFIG=disabled"
-
-    # tomlplusplus examples and tests don't build with winegcc
-    "-Dtomlplusplus:BUILD_EXAMPLES=disabled"
-    "-Dtomlplusplus:BUILD_TESTS=disabled"
+    "-Dtomlplusplus:generate_cmake_config=false"
   ];
 
   installPhase = ''
diff --git a/third_party/nixpkgs/pkgs/tools/compression/zstd/default.nix b/third_party/nixpkgs/pkgs/tools/compression/zstd/default.nix
index 1f9b4a505a..a3184f6d1e 100644
--- a/third_party/nixpkgs/pkgs/tools/compression/zstd/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/compression/zstd/default.nix
@@ -7,17 +7,18 @@
 # these need to be ran on the host, thus disable when cross-compiling
 , buildContrib ? stdenv.hostPlatform == stdenv.buildPlatform
 , doCheck ? stdenv.hostPlatform == stdenv.buildPlatform
+, nix-update-script
 }:
 
 stdenv.mkDerivation rec {
   pname = "zstd";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "zstd";
     rev = "v${version}";
-    sha256 = "0icc0x89c35rq5bxd4d241vqxnz2i1qj2wwy01xls63p0z93brj7";
+    sha256 = "sha256-D9+kuIjPYnmg5ht/ezIeYCpyiLkrtdiH3fwpmemIPGM=";
   };
 
   nativeBuildInputs = [ cmake ]
@@ -28,12 +29,6 @@ stdenv.mkDerivation rec {
     # This patches makes sure we do not attempt to use the MD5 implementation
     # of the host platform when running the tests
     ./playtests-darwin.patch
-
-    # Fixes linking for static builds
-    (fetchpatch {
-      url = "https://github.com/facebook/zstd/pull/2724/commits/e1f85dbca3a0ed5ef06c8396912a0914db8dea6a.patch";
-      sha256 = "sha256-PuYAqnJWAE+L9bsroOnnBGJhERW8LHrGSLtIEkKU9vg=";
-    })
   ];
 
   postPatch = lib.optionalString (!static) ''
@@ -90,6 +85,12 @@ stdenv.mkDerivation rec {
     ++ lib.optional stdenv.hostPlatform.isUnix "man"
     ++ [ "out" ];
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = pname;
+    };
+  };
+
   meta = with lib; {
     description = "Zstandard real-time compression algorithm";
     longDescription = ''
diff --git a/third_party/nixpkgs/pkgs/tools/compression/zstd/playtests-darwin.patch b/third_party/nixpkgs/pkgs/tools/compression/zstd/playtests-darwin.patch
index bcb895a697..454489a24a 100644
--- a/third_party/nixpkgs/pkgs/tools/compression/zstd/playtests-darwin.patch
+++ b/third_party/nixpkgs/pkgs/tools/compression/zstd/playtests-darwin.patch
@@ -1,6 +1,6 @@
 --- a/tests/playTests.sh
 +++ b/tests/playTests.sh
-@@ -112,22 +112,12 @@ case "$OS" in
+@@ -112,29 +112,19 @@ case "$OS" in
  esac
  
  case "$UNAME" in
@@ -16,6 +16,13 @@
 -    Darwin | FreeBSD | OpenBSD | NetBSD) MTIME="stat -f %m" ;;
 -esac
  
+ assertSameMTime() {
+     MT1=$($MTIME "$1")
+     MT2=$($MTIME "$2")
+     echo MTIME $MT1 $MT2
+     [ "$MT1" = "$MT2" ] || die "mtime on $1 doesn't match mtime on $2 ($MT1 != $MT2)"
+ }
+ 
  GET_PERMS="stat -c %a"
 -case "$UNAME" in
 -    Darwin | FreeBSD | OpenBSD | NetBSD) GET_PERMS="stat -f %Lp" ;;
diff --git a/third_party/nixpkgs/pkgs/tools/filesystems/btrfs-progs/default.nix b/third_party/nixpkgs/pkgs/tools/filesystems/btrfs-progs/default.nix
index 9ad343f60a..936555f93a 100644
--- a/third_party/nixpkgs/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -2,6 +2,7 @@
 , asciidoc, docbook_xml_dtd_45, docbook_xsl, libxslt, pkg-config, python3, xmlto
 , zstd
 , acl, attr, e2fsprogs, libuuid, lzo, systemd, zlib
+, runCommand, btrfs-progs
 }:
 
 stdenv.mkDerivation rec {
@@ -18,7 +19,7 @@ stdenv.mkDerivation rec {
     python3 python3.pkgs.setuptools
   ];
 
-  buildInputs = [ acl attr e2fsprogs libuuid lzo python3 systemd zlib zstd ];
+  buildInputs = [ acl attr e2fsprogs libuuid lzo python3 zlib zstd ] ++ lib.optionals stdenv.hostPlatform.isGnu [ systemd ];
 
   # for python cross-compiling
   _PYTHON_HOST_PLATFORM = stdenv.hostPlatform.config;
@@ -31,12 +32,21 @@ stdenv.mkDerivation rec {
     install -v -m 444 -D btrfs-completion $out/share/bash-completion/completions/btrfs
   '';
 
-  configureFlags = lib.optional stdenv.hostPlatform.isMusl "--disable-backtrace";
+  configureFlags = lib.optional stdenv.hostPlatform.isMusl "--disable-backtrace --disable-libudev";
 
-  makeFlags = [ "udevruledir=$(out)/lib/udev/rules.d" ];
+  makeFlags = lib.optionals stdenv.hostPlatform.isGnu [ "udevruledir=$(out)/lib/udev/rules.d" ];
 
   enableParallelBuilding = true;
 
+  passthru.tests = {
+    simple-filesystem = runCommand "btrfs-progs-create-fs" {} ''
+      mkdir -p $out
+      truncate -s110M $out/disc
+      ${btrfs-progs}/bin/mkfs.btrfs $out/disc | tee $out/success
+      ${btrfs-progs}/bin/btrfs check $out/disc | tee $out/success
+      [ -e $out/success ]
+    '';
+  };
   meta = with lib; {
     description = "Utilities for the btrfs filesystem";
     homepage = "https://btrfs.wiki.kernel.org/";
diff --git a/third_party/nixpkgs/pkgs/tools/graphics/realesrgan-ncnn-vulkan/cmakelists.patch b/third_party/nixpkgs/pkgs/tools/graphics/realesrgan-ncnn-vulkan/cmakelists.patch
new file mode 100644
index 0000000000..5ee94a9172
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/tools/graphics/realesrgan-ncnn-vulkan/cmakelists.patch
@@ -0,0 +1,13 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index a234caa..cd9d2c5 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -114,6 +114,8 @@ if(USE_SYSTEM_NCNN)
+             include("${GLSLANG_TARGET_DIR}/HLSLTargets.cmake")
+         endif()
+         include("${GLSLANG_TARGET_DIR}/glslangTargets.cmake")
++        include("${GLSLANG_TARGET_DIR}/SPIRV-Tools/SPIRV-ToolsTarget.cmake")
++        include("${GLSLANG_TARGET_DIR}/SPIRV-Tools-opt/SPIRV-Tools-optTargets.cmake")
+         include("${GLSLANG_TARGET_DIR}/SPIRVTargets.cmake")
+ 
+         if (NOT TARGET glslang OR NOT TARGET SPIRV)
diff --git a/third_party/nixpkgs/pkgs/tools/graphics/realesrgan-ncnn-vulkan/default.nix b/third_party/nixpkgs/pkgs/tools/graphics/realesrgan-ncnn-vulkan/default.nix
new file mode 100644
index 0000000000..d66a06b7ee
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/tools/graphics/realesrgan-ncnn-vulkan/default.nix
@@ -0,0 +1,65 @@
+{ lib
+, stdenv
+, fetchzip
+, fetchFromGitHub
+, cmake
+, spirv-headers
+, vulkan-headers
+, vulkan-loader
+, glslang
+, libgcc
+, libwebp
+, ncnn
+}:
+
+stdenv.mkDerivation rec {
+  pname = "Real-ESRGAN-ncnn-vulkan";
+  version = "0.1.3.2";
+
+  src = fetchFromGitHub {
+    owner = "xinntao";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-eLAIlOl1sUxijeVPFG+NscZGxDdtrQqVkMuxhegESHk=";
+  };
+  sourceRoot = "source/src";
+
+  models = fetchzip {
+    # Choose the newst release from https://github.com/xinntao/Real-ESRGAN/releases to update
+    url = "https://github.com/xinntao/Real-ESRGAN/releases/download/v0.2.3.0/realesrgan-ncnn-vulkan-20211212-ubuntu.zip";
+    stripRoot = false;
+    sha256 = "sha256-17k6fewVEXxx7hi+vPXjHAOq4IIUHLh7WC80CwTeFKI=";
+  };
+
+  patches = [
+    ./cmakelists.patch
+    ./models_path.patch
+  ];
+
+  cmakeFlags = [
+    "-DUSE_SYSTEM_NCNN=1"
+    "-DUSE_SYSTEM_WEBP=1"
+
+    "-DGLSLANG_TARGET_DIR=${glslang}/lib/cmake"
+  ];
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ vulkan-headers vulkan-loader glslang libgcc libwebp ncnn ];
+
+  postPatch = ''
+    substituteInPlace main.cpp --replace REPLACE_MODELS $out/share/models
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin $out/share
+    cp realesrgan-ncnn-vulkan $out/bin/
+    cp -r ${models}/models $out/share
+  '';
+
+  meta = with lib; {
+    description = "NCNN implementation of Real-ESRGAN. Real-ESRGAN aims at developing Practical Algorithms for General Image Restoration.";
+    homepage = "https://github.com/xinntao/Real-ESRGAN-ncnn-vulkan";
+    license = licenses.mit;
+    maintainers = with maintainers; [ tilcreator ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/tools/graphics/realesrgan-ncnn-vulkan/models_path.patch b/third_party/nixpkgs/pkgs/tools/graphics/realesrgan-ncnn-vulkan/models_path.patch
new file mode 100644
index 0000000000..43b8e4503b
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/tools/graphics/realesrgan-ncnn-vulkan/models_path.patch
@@ -0,0 +1,22 @@
+diff --git a/main.cpp b/main.cpp
+index eb6f6c8..b230bed 100644
+--- a/main.cpp
++++ b/main.cpp
+@@ -110,7 +110,7 @@ static void print_usage()
+     fprintf(stderr, "  -o output-path       output image path (jpg/png/webp) or directory\n");
+     fprintf(stderr, "  -s scale             upscale ratio (can be 2, 4. default=4)\n");
+     fprintf(stderr, "  -t tile-size         tile size (>=32/0=auto, default=0) can be 0,0,0 for multi-gpu\n");
+-    fprintf(stderr, "  -m model-path        folder path to pre-trained models(default=models)\n");
++    fprintf(stderr, "  -m model-path        folder path to pre-trained models(default=REPLACE_MODELS)\n");
+     fprintf(stderr, "  -n model-name        model name (default=realesrgan-x4plus, can be realesrgan-x4plus | realesrgan-x4plus-anime | realesrnet-x4plus | RealESRGANv2-animevideo-xsx2 | RealESRGANv2-animevideo-xsx4 | RealESRGANv2-anime-xsx2 | RealESRGANv2-anime-xsx4)\n");
+     fprintf(stderr, "  -g gpu-id            gpu device to use (default=auto) can be 0,1,2 for multi-gpu\n");
+     fprintf(stderr, "  -j load:proc:save    thread count for load/proc/save (default=1:2:2) can be 1:2,2,2:2 for multi-gpu\n");
+@@ -438,7 +438,7 @@ int main(int argc, char** argv)
+     path_t outputpath;
+     int scale = 4;
+     std::vector<int> tilesize;
+-    path_t model = PATHSTR("models");
++    path_t model = PATHSTR("REPLACE_MODELS");
+     path_t modelname = PATHSTR("realesrgan-x4plus");
+     std::vector<int> gpuid;
+     int jobs_load = 1;
diff --git a/third_party/nixpkgs/pkgs/tools/misc/fluent-bit/default.nix b/third_party/nixpkgs/pkgs/tools/misc/fluent-bit/default.nix
index f6dd32396d..d860fe8cf3 100644
--- a/third_party/nixpkgs/pkgs/tools/misc/fluent-bit/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/fluent-bit/default.nix
@@ -1,14 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, flex, bison, systemd }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, flex, bison, systemd, openssl }:
 
 stdenv.mkDerivation rec {
   pname = "fluent-bit";
-  version = "1.8.9";
+  version = "1.8.11";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     rev = "v${version}";
-    sha256 = "sha256-b+MZuZQB/sl0HcioU1KCxH3TNiXYSPBfC9dBKqCVeXk=";
+    sha256 = "sha256-DULXfkddBdCvTWkuWXjSTEujRZ3mVVzy//qeB3j0Vz8=";
   };
 
   patches = lib.optionals stdenv.isDarwin [
@@ -32,7 +32,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake flex bison ];
 
-  buildInputs = lib.optionals stdenv.isLinux [ systemd ];
+  buildInputs = [ openssl ]
+    ++ lib.optionals stdenv.isLinux [ systemd ];
 
   cmakeFlags = [ "-DFLB_METRICS=ON" "-DFLB_HTTP_SERVER=ON" ];
 
diff --git a/third_party/nixpkgs/pkgs/tools/misc/topgrade/default.nix b/third_party/nixpkgs/pkgs/tools/misc/topgrade/default.nix
index 99d6a0100e..e1b96d9717 100644
--- a/third_party/nixpkgs/pkgs/tools/misc/topgrade/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/topgrade/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "topgrade";
-  version = "8.1.2";
+  version = "8.2.0";
 
   src = fetchFromGitHub {
     owner = "r-darwish";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-2ID3VVT4cQ1yZAD2WVKqkoE7qbe2nNMp1nlwfTxmlZo=";
+    sha256 = "sha256-WyiEKC5WUwIGCaxXqiqNyOcGVZgfd2lVFMxQxhgJhMc=";
   };
 
-  cargoSha256 = "sha256-o1V6u7FmP+p+ApL0AmaqTQTZ2f0sZTpx2ro4lR/DFi8=";
+  cargoSha256 = "sha256-ZcOSHEZHGa1XhGQlW4pR5hBJ2SpSbkKuRS6OSHGg9Lo=";
 
   buildInputs = lib.optional stdenv.isDarwin Foundation;
 
diff --git a/third_party/nixpkgs/pkgs/tools/misc/uutils-coreutils/default.nix b/third_party/nixpkgs/pkgs/tools/misc/uutils-coreutils/default.nix
index 6281060675..2fb3196b1f 100644
--- a/third_party/nixpkgs/pkgs/tools/misc/uutils-coreutils/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/uutils-coreutils/default.nix
@@ -12,19 +12,19 @@
 
 stdenv.mkDerivation rec {
   pname = "uutils-coreutils";
-  version = "0.0.8";
+  version = "0.0.12";
 
   src = fetchFromGitHub {
     owner = "uutils";
     repo = "coreutils";
     rev = version;
-    sha256 = "0hx5ypy58d182gxpgs0dxcw03pdgvrcikbhczg6yqpdjjh7163as";
+    sha256 = "01zwvadfd570vbsy52svp0vi5r2p873c33vn2h4mr7868myl6q9g";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256:1ynw97dr40yg18jaqgvz3shs0s0j6pvvlkrbka2ganiv8c9fvbyw";
+    hash = "sha256:19li3gmb5dmrmiiiy9ihr1rl68lz14j2gsgqpjcsn52rkcy17dzh";
   };
 
   nativeBuildInputs = [ rustPlatform.cargoSetupHook sphinx ];
diff --git a/third_party/nixpkgs/pkgs/tools/misc/wyrd/default.nix b/third_party/nixpkgs/pkgs/tools/misc/wyrd/default.nix
index 491c362eed..d1244cc73c 100644
--- a/third_party/nixpkgs/pkgs/tools/misc/wyrd/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/wyrd/default.nix
@@ -9,8 +9,6 @@ stdenv.mkDerivation rec {
     sha256 = "0zlrg602q781q8dij62lwdprpfliyy9j1rqfqcz8p2wgndpivddj";
   };
 
-  NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS=1";
-
   preConfigure = ''
     substituteInPlace curses/curses.ml --replace 'pp gcc' "pp $CC"
   '';
diff --git a/third_party/nixpkgs/pkgs/tools/networking/curl/default.nix b/third_party/nixpkgs/pkgs/tools/networking/curl/default.nix
index a5abbc26a7..bfd4889316 100644
--- a/third_party/nixpkgs/pkgs/tools/networking/curl/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/networking/curl/default.nix
@@ -1,12 +1,8 @@
-{ stdenv, lib, fetchurl, pkg-config, perl
-, http2Support ? true, nghttp2
-, idnSupport ? false, libidn ? null
-, ldapSupport ? false, openldap ? null
-, zlibSupport ? true, zlib ? null
-, opensslSupport ? zlibSupport, openssl ? null
+{ lib, stdenv, fetchurl, pkg-config, perl
+, brotliSupport ? false, brotli ? null
+, c-aresSupport ? false, c-ares ? null
 , gnutlsSupport ? false, gnutls ? null
-, wolfsslSupport ? false, wolfssl ? null
-, scpSupport ? zlibSupport && !stdenv.isSunOS && !stdenv.isCygwin, libssh2 ? null
+, gsaslSupport ? false, gsasl ? null
 , gssSupport ? with stdenv.hostPlatform; (
     !isWindows &&
     # disable gss becuase of: undefined reference to `k5_bcmp'
@@ -17,8 +13,17 @@
     # not worth the effort.
     !(isDarwin && (stdenv.buildPlatform != stdenv.hostPlatform))
   ), libkrb5 ? null
-, c-aresSupport ? false, c-ares ? null
-, brotliSupport ? false, brotli ? null
+, http2Support ? true, nghttp2 ? null
+, http3Support ? false, nghttp3, ngtcp2 ? null
+, idnSupport ? false, libidn2 ? null
+, ldapSupport ? false, openldap ? null
+, opensslSupport ? zlibSupport, openssl ? null
+, pslSupport ? false, libpsl ? null
+, rtmpSupport ? false, rtmpdump ? null
+, scpSupport ? zlibSupport && !stdenv.isSunOS && !stdenv.isCygwin, libssh2 ? null
+, wolfsslSupport ? false, wolfssl ? null
+, zlibSupport ? true, zlib ? null
+, zstdSupport ? false, zstd ? null
 }:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
@@ -26,31 +31,37 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-assert http2Support -> nghttp2 != null;
-assert idnSupport -> libidn != null;
-assert ldapSupport -> openldap != null;
-assert zlibSupport -> zlib != null;
-assert opensslSupport -> openssl != null;
 assert !(gnutlsSupport && opensslSupport);
 assert !(gnutlsSupport && wolfsslSupport);
 assert !(opensslSupport && wolfsslSupport);
-assert gnutlsSupport -> gnutls != null;
-assert wolfsslSupport -> wolfssl != null;
-assert scpSupport -> libssh2 != null;
-assert c-aresSupport -> c-ares != null;
 assert brotliSupport -> brotli != null;
+assert c-aresSupport -> c-ares != null;
+assert gnutlsSupport -> gnutls != null;
+assert gsaslSupport -> gsasl != null;
 assert gssSupport -> libkrb5 != null;
+assert http2Support -> nghttp2 != null;
+assert http3Support -> nghttp3 != null;
+assert http3Support -> ngtcp2 != null;
+assert idnSupport -> libidn2 != null;
+assert ldapSupport -> openldap != null;
+assert opensslSupport -> openssl != null;
+assert pslSupport -> libpsl !=null;
+assert rtmpSupport -> rtmpdump !=null;
+assert scpSupport -> libssh2 != null;
+assert wolfsslSupport -> wolfssl != null;
+assert zlibSupport -> zlib != null;
+assert zstdSupport -> zstd != null;
 
 stdenv.mkDerivation rec {
   pname = "curl";
-  version = "7.80.0";
+  version = "7.81.0";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/${pname}-${version}.tar.bz2"
       "https://github.com/curl/curl/releases/download/${lib.replaceStrings ["."] ["_"] pname}-${version}/${pname}-${version}.tar.bz2"
     ];
-    sha256 = "170qb2w2p5fga0vqhhnzi417z4h4vy764sz16pzhm5fd9471a3fx";
+    sha256 = "sha256-Hno41wGOwGDx8W34OYVPCInpThIsTPpdOjfC3Fbx4lg=";
   };
 
   patches = [
@@ -70,17 +81,22 @@ stdenv.mkDerivation rec {
   # "-lz -lssl", which aren't necessary direct build inputs of
   # applications that use Curl.
   propagatedBuildInputs = with lib;
-    optional http2Support nghttp2 ++
-    optional idnSupport libidn ++
-    optional ldapSupport openldap ++
-    optional zlibSupport zlib ++
-    optional gssSupport libkrb5 ++
+    optional brotliSupport brotli ++
     optional c-aresSupport c-ares ++
-    optional opensslSupport openssl ++
     optional gnutlsSupport gnutls ++
-    optional wolfsslSupport wolfssl ++
+    optional gsaslSupport gsasl ++
+    optional gssSupport libkrb5 ++
+    optional http2Support nghttp2 ++
+    optionals http3Support [ nghttp3 ngtcp2 ] ++
+    optional idnSupport libidn2 ++
+    optional ldapSupport openldap ++
+    optional opensslSupport openssl ++
+    optional pslSupport libpsl ++
+    optional rtmpSupport rtmpdump ++
     optional scpSupport libssh2 ++
-    optional brotliSupport brotli;
+    optional wolfsslSupport wolfssl ++
+    optional zlibSupport zlib ++
+    optional zstdSupport zstd;
 
   # for the second line see https://curl.haxx.se/mail/tracker-2014-03/0087.html
   preConfigure = ''
@@ -89,23 +105,28 @@ stdenv.mkDerivation rec {
   '';
 
   configureFlags = [
+      # Build without manual
+      "--disable-manual"
       # Disable default CA bundle, use NIX_SSL_CERT_FILE or fallback
       # to nss-cacert from the default profile.
       "--without-ca-bundle"
       "--without-ca-path"
-      # The build fails when using wolfssl with --with-ca-fallback
-      (lib.withFeature (!wolfsslSupport) "ca-fallback")
-      "--disable-manual"
-      (lib.withFeatureAs opensslSupport "openssl" (lib.getDev openssl))
-      (lib.withFeatureAs gnutlsSupport "gnutls" (lib.getDev gnutls))
-      (lib.withFeatureAs scpSupport "libssh2" (lib.getDev libssh2))
+      (lib.enableFeature c-aresSupport "ares")
       (lib.enableFeature ldapSupport "ldap")
       (lib.enableFeature ldapSupport "ldaps")
-      (lib.withFeatureAs idnSupport "libidn" (lib.getDev libidn))
-      (lib.withFeature brotliSupport "brotli")
+      # The build fails when using wolfssl with --with-ca-fallback
+      (lib.withFeature (!wolfsslSupport) "ca-fallback")
+      (lib.withFeature http3Support "nghttp3")
+      (lib.withFeature http3Support "ngtcp2")
+      (lib.withFeature rtmpSupport "librtmp")
+      (lib.withFeature zstdSupport "zstd")
+      (lib.withFeatureAs brotliSupport "brotli" (lib.getDev brotli))
+      (lib.withFeatureAs gnutlsSupport "gnutls" (lib.getDev gnutls))
+      (lib.withFeatureAs idnSupport "libidn2" (lib.getDev libidn2))
+      (lib.withFeatureAs opensslSupport "openssl" (lib.getDev openssl))
+      (lib.withFeatureAs scpSupport "libssh2" (lib.getDev libssh2))
+      (lib.withFeatureAs wolfsslSupport "wolfssl" (lib.getDev wolfssl))
     ]
-    ++ lib.optional wolfsslSupport "--with-wolfssl=${lib.getDev wolfssl}"
-    ++ lib.optional c-aresSupport "--enable-ares=${c-ares}"
     ++ lib.optional gssSupport "--with-gssapi=${lib.getDev libkrb5}"
        # For the 'urandom', maybe it should be a cross-system option
     ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
diff --git a/third_party/nixpkgs/pkgs/tools/networking/dnsproxy/default.nix b/third_party/nixpkgs/pkgs/tools/networking/dnsproxy/default.nix
index 6e1977531e..f4cea8bf57 100644
--- a/third_party/nixpkgs/pkgs/tools/networking/dnsproxy/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/networking/dnsproxy/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "dnsproxy";
-  version = "0.40.3";
+  version = "0.40.5";
 
   src = fetchFromGitHub {
     owner = "AdguardTeam";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-OkicEDu2sMEpvBbb7JFRGusMKJeQoVe3ShsbuNCoIis=";
+    sha256 = "sha256-wzPQ5cs/SXNcu73lLzy3D/527X3rylKwhUsPDu+v6r0=";
   };
 
   vendorSha256 = null;
diff --git a/third_party/nixpkgs/pkgs/tools/networking/gmrender-resurrect/default.nix b/third_party/nixpkgs/pkgs/tools/networking/gmrender-resurrect/default.nix
index d4fc1b22e8..28125ce113 100644
--- a/third_party/nixpkgs/pkgs/tools/networking/gmrender-resurrect/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/networking/gmrender-resurrect/default.nix
@@ -4,9 +4,7 @@
 let
   version = "0.0.9";
 
-  makePluginPath = plugins: builtins.concatStringsSep ":" (map (p: p + "/lib/gstreamer-1.0") plugins);
-
-  pluginPath = makePluginPath [ gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugins-ugly gst-libav ];
+  pluginPath = lib.makeSearchPathOutput "lib" "lib/gstreamer-1.0" [ gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugins-ugly gst-libav ];
 in
   stdenv.mkDerivation {
     pname = "gmrender-resurrect";
diff --git a/third_party/nixpkgs/pkgs/tools/networking/godns/default.nix b/third_party/nixpkgs/pkgs/tools/networking/godns/default.nix
index fffcbbb528..8a5440f6b0 100644
--- a/third_party/nixpkgs/pkgs/tools/networking/godns/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/networking/godns/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "godns";
-  version = "2.5.3";
+  version = "2.6";
 
   src = fetchFromGitHub {
     owner = "TimothyYe";
     repo = "godns";
     rev = "v${version}";
-    sha256 = "sha256-C2Auk0BJLhW8r4cnmoZiUddb8rcZqND5fER9L+3ooH4=";
+    sha256 = "sha256-U8fmjcPeTcKlf721UIbA4/JYeM4l+OIyAPGNp8IPvSk=";
   };
 
-  vendorSha256 = "sha256-/egdqQCkbmrxuQ3vPfHOtHxAgW143Y2eZEzKAsBVmaI=";
+  vendorSha256 = "sha256-8fluCDKrMNnIAlJFlDAisk/P+IYHBCdl7hkSbQtgy1A=";
 
   # Some tests require internet access, broken in sandbox
   doCheck = false;
diff --git a/third_party/nixpkgs/pkgs/tools/networking/kapp/default.nix b/third_party/nixpkgs/pkgs/tools/networking/kapp/default.nix
index 1c3f2de721..81757221a7 100644
--- a/third_party/nixpkgs/pkgs/tools/networking/kapp/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/networking/kapp/default.nix
@@ -1,13 +1,13 @@
 { lib, buildGoModule, fetchFromGitHub, installShellFiles }:
 buildGoModule rec {
   pname = "kapp";
-  version = "0.43.0";
+  version = "0.44.0";
 
   src = fetchFromGitHub {
     owner = "vmware-tanzu";
     repo = "carvel-kapp";
     rev = "v${version}";
-    sha256 = "sha256-9e5vgOIB8PHbM5nsDaasyEfWP5dr7j3vU3+WzFua6bI=";
+    sha256 = "sha256-4l1Hlkk9+X7mKqkAkUTigAR3v0Z6XXt8QC2QQvqad7I=";
   };
 
   vendorSha256 = null;
diff --git a/third_party/nixpkgs/pkgs/tools/networking/proxychains-ng/default.nix b/third_party/nixpkgs/pkgs/tools/networking/proxychains-ng/default.nix
index 6a131af031..35a6c7d7f8 100644
--- a/third_party/nixpkgs/pkgs/tools/networking/proxychains-ng/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/networking/proxychains-ng/default.nix
@@ -1,29 +1,19 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 }:
 
 stdenv.mkDerivation rec {
   pname = "proxychains-ng";
-  version = "4.15";
+  version = "4.16";
 
   src = fetchFromGitHub {
     owner = "rofl0r";
     repo = pname;
     rev = "v${version}";
-    sha256 = "128d502y8pn7q2ls6glx9bvibwzfh321sah5r5li6b6iywh2zqlc";
+    sha256 = "sha256-uu/zN6W0ue526/3a9QeYg6J4HLaovZJVOYXksjouYok=";
   };
 
-  patches = [
-    # Fix build on aarch64-darwin, should be removed in v4.16
-    # https://github.com/rofl0r/proxychains-ng/issues/400
-    (fetchpatch {
-      url = "https://github.com/rofl0r/proxychains-ng/commit/7de7dd0de1ff387a627620ac3482b4cd9b3fba95.patch?full_index=1";
-      sha256 = "sha256-m3a4Jal8L7w+xA0OJTPU68ILTaKgiITgsM1WVxuMce0=";
-    })
-  ];
-
   meta = with lib; {
     description = "A preloader which hooks calls to sockets in dynamically linked programs and redirects it through one or more socks/http proxies";
     homepage = "https://github.com/rofl0r/proxychains-ng";
diff --git a/third_party/nixpkgs/pkgs/tools/networking/strongswan/default.nix b/third_party/nixpkgs/pkgs/tools/networking/strongswan/default.nix
index 9edc1c79fb..560457bdaa 100644
--- a/third_party/nixpkgs/pkgs/tools/networking/strongswan/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/networking/strongswan/default.nix
@@ -7,6 +7,7 @@
 , enableTNC            ? false, trousers, sqlite, libxml2
 , enableNetworkManager ? false, networkmanager
 , darwin
+, nixosTests
 }:
 
 # Note on curl support: If curl is built with gnutls as its backend, the
@@ -17,13 +18,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "strongswan";
-  version = "5.9.4"; # Make sure to also update <nixpkgs/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix> when upgrading!
+  version = "5.9.5"; # Make sure to also update <nixpkgs/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix> when upgrading!
 
   src = fetchFromGitHub {
     owner = "strongswan";
     repo = "strongswan";
     rev = version;
-    sha256 = "1y1gs232x7hsbccjga9nbkf4bbi5wxazlkg00qd2v1nz86sfy4cd";
+    sha256 = "sha256-Jx0Wd/xgkl/WrBfcEvZPogPAQp0MW9HE+AQR2anP5Vo=";
   };
 
   dontPatchELF = true;
@@ -101,6 +102,8 @@ stdenv.mkDerivation rec {
 
   NIX_LDFLAGS = optionalString stdenv.cc.isGNU "-lgcc_s" ;
 
+  passthru.tests = { inherit (nixosTests) strongswan-swanctl; };
+
   meta = {
     description = "OpenSource IPsec-based VPN Solution";
     homepage = "https://www.strongswan.org";
diff --git a/third_party/nixpkgs/pkgs/tools/package-management/cargo-release/default.nix b/third_party/nixpkgs/pkgs/tools/package-management/cargo-release/default.nix
index 49864ad508..92d9532b22 100644
--- a/third_party/nixpkgs/pkgs/tools/package-management/cargo-release/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/package-management/cargo-release/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-release";
-  version = "0.19.0";
+  version = "0.19.3";
 
   src = fetchFromGitHub {
     owner = "crate-ci";
     repo = "cargo-release";
     rev = "v${version}";
-    sha256 = "sha256-u1XXkenMIflbXACxOeeq7Mg5ubel4oFXpL/uy6McQf0=";
+    sha256 = "sha256-/lY6NQN1oYH+gNyYLXVoqHhikJxd1R0KbpZvuSemnwI=";
   };
 
-  cargoSha256 = "sha256-7QOaSEaX2JXtTQQo3RXbMpZg6V2wzfoQbId9QOD9sCA=";
+  cargoSha256 = "sha256-iw4RPW4VwfsvDgaxphBIlSPM5IhCyVv07mrCpIPKaPI=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/third_party/nixpkgs/pkgs/tools/package-management/nix/default.nix b/third_party/nixpkgs/pkgs/tools/package-management/nix/default.nix
index 4cf6ef23b6..cfcc3c68c3 100644
--- a/third_party/nixpkgs/pkgs/tools/package-management/nix/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/package-management/nix/default.nix
@@ -225,79 +225,71 @@ common =
     sha256 = "sha256-SPnam4xNIjbMgnq6IP1AaM1V62X0yZNo4DEVmI8sHOo=";
   };
 
-in rec {
+  buildNix =
+  { version, suffix ? ""
+  , src ? null, sha256 ? null
+  , boehmgc ? boehmgc_nix, patches ? [ ]
+  }:
+    assert (src == null) -> (sha256 != null);
+    assert (sha256 == null) -> (src != null);
+    callPackage common {
+      pname = "nix";
+      version = "${version}${suffix}";
+      inherit suffix;
 
+      src =
+        if src != null
+        then src
+        else fetchFromGitHub {
+          owner = "NixOS";
+          repo = "nix";
+          rev = version;
+          inherit sha256;
+        };
+
+      inherit boehmgc patches;
+      inherit storeDir stateDir confDir;
+    };
+
+in rec {
   nix = nixStable;
 
   nixStable = nix_2_5;
 
-  nix_2_3 = callPackage common (rec {
-    pname = "nix";
+  nix_2_3 = buildNix rec {
     version = "2.3.16";
     src = fetchurl {
-      url = "https://nixos.org/releases/nix/${pname}-${version}/${pname}-${version}.tar.xz";
+      url = "https://nixos.org/releases/nix/nix-${version}/nix-${version}.tar.xz";
       sha256 = "sha256-fuaBtp8FtSVJLSAsO+3Nne4ZYLuBj2JpD2xEk7fCqrw=";
     };
-
     boehmgc = boehmgc_nix_2_3;
+  };
 
-    inherit storeDir stateDir confDir;
-  });
-
-  nix_2_4 = callPackage common (rec {
-    pname = "nix";
+  nix_2_4 = buildNix {
     version = "2.4";
-
-    src = fetchFromGitHub {
-      owner = "NixOS";
-      repo = "nix";
-      rev = version;
-      sha256 = "sha256-op48CCDgLHK0qV1Batz4Ln5FqBiRjlE6qHTiZgt3b6k=";
-    };
-
-    boehmgc = boehmgc_nix;
-
+    sha256 = "sha256-op48CCDgLHK0qV1Batz4Ln5FqBiRjlE6qHTiZgt3b6k=";
     patches = [ installNlohmannJsonPatch ];
+  };
 
-    inherit storeDir stateDir confDir;
-  });
-
-  nix_2_5 = callPackage common (rec {
-    pname = "nix";
+  nix_2_5 = buildNix {
     version = "2.5.1";
+    sha256 = "sha256-GOsiqy9EaTwDn2PLZ4eFj1VkXcBUbqrqHehRE9GuGdU=";
+    patches = [ installNlohmannJsonPatch ];
+  };
 
+  nix_2_6 = buildNix {
+    version = "2.6.0";
+    sha256 = "sha256-xEPeMcNJVOeZtoN+d+aRwolpW8mFSEQx76HTRdlhPhg=";
+  };
+
+  nixUnstable = lib.lowPrio (buildNix rec {
+    version = "2.7";
+    suffix = "pre20220124_${lib.substring 0 7 src.rev}";
     src = fetchFromGitHub {
       owner = "NixOS";
       repo = "nix";
-      rev = version;
-      sha256 = "sha256-GOsiqy9EaTwDn2PLZ4eFj1VkXcBUbqrqHehRE9GuGdU=";
+      rev = "0a70b37b5694c769fb855c1afe7642407d1db64f";
+      sha256 = "sha256-aOM9MPNlnWNMobx4CuD4JIXH2poRlG8AKkuxY7FysWg=";
     };
-
-    boehmgc = boehmgc_nix;
-
-    patches = [ installNlohmannJsonPatch ];
-
-    inherit storeDir stateDir confDir;
   });
-
-  nixUnstable = lib.lowPrio (callPackage common rec {
-    pname = "nix";
-    version = "2.6${suffix}";
-    suffix = "pre20211217_${lib.substring 0 7 src.rev}";
-
-    src = fetchFromGitHub {
-      owner = "NixOS";
-      repo = "nix";
-      rev = "6e6e998930f0d7361d64644eb37d9134e74e8501";
-      sha256 = "sha256-RZSWOJUPkXIlMNYMC5a+WNrOjpqAHyhzyqD57BGfNY8=";
-    };
-
-    boehmgc = boehmgc_nix;
-
-    patches = [ installNlohmannJsonPatch ];
-
-    inherit storeDir stateDir confDir;
-
-  });
-
 }
diff --git a/third_party/nixpkgs/pkgs/tools/security/cosign/default.nix b/third_party/nixpkgs/pkgs/tools/security/cosign/default.nix
index 0c934e3c69..fbbd26dea6 100644
--- a/third_party/nixpkgs/pkgs/tools/security/cosign/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/security/cosign/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cosign";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-WjYW9Fo27wE1pg/BqYsdHd8jwd8jG5bk37HmU1DqnyE=";
+    sha256 = "sha256-mxDLF9DQKySDR1c7jD/D0/xI+/R8a/ZlukliT/R4wCg=";
   };
 
   buildInputs = lib.optional (stdenv.isLinux && pivKeySupport) (lib.getDev pcsclite)
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ pkg-config installShellFiles ];
 
-  vendorSha256 = "sha256-6T98zu55BQ26e43a1i68rhebaLwY/iFM8CRqRcv2QwI=";
+  vendorSha256 = "sha256-xqwwvVGXWFFKKBtH4a/+akFSlZ2hCOC1v1sO0d2p9fs=";
 
   excludedPackages = "\\(sample\\|webhook\\|help\\)";
 
@@ -24,6 +24,10 @@ buildGoModule rec {
 
   ldflags = [ "-s" "-w" "-X github.com/sigstore/cosign/pkg/version.GitVersion=v${version}" ];
 
+  postPatch = ''
+    rm pkg/cosign/tuf/client_test.go # Require network access
+  '';
+
   postInstall = ''
     installShellCompletion --cmd cosign \
       --bash <($out/bin/cosign completion bash) \
diff --git a/third_party/nixpkgs/pkgs/tools/security/exploitdb/default.nix b/third_party/nixpkgs/pkgs/tools/security/exploitdb/default.nix
index 50dbebf23c..fabab51525 100644
--- a/third_party/nixpkgs/pkgs/tools/security/exploitdb/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/security/exploitdb/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2022-01-20";
+  version = "2022-01-25";
 
   src = fetchFromGitHub {
     owner = "offensive-security";
     repo = pname;
     rev = version;
-    sha256 = "sha256-tcoohr9ENRG+WFRJ3KG5NBpwatksV0TQ4HoEypqMjVo=";
+    sha256 = "sha256-kqb5MhdKA6qvIdnTzPNUscksyz2GWaiPJg2JxA1C3p0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/third_party/nixpkgs/pkgs/tools/security/gomapenum/default.nix b/third_party/nixpkgs/pkgs/tools/security/gomapenum/default.nix
index 68cdb5f355..ecfc74cac5 100644
--- a/third_party/nixpkgs/pkgs/tools/security/gomapenum/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/security/gomapenum/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "gomapenum";
-  version = "1.0.2";
+  version = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "nodauf";
     repo = "GoMapEnum";
     rev = "v${version}";
-    sha256 = "sha256-6AwbG3rs3ZjCGpCDeesddXW63OOxsoWdRtueNx35K38=";
+    sha256 = "sha256-AjHqD9r4ZU5NCqXEovvQuV4eeMLBy2jO/uqZQiCTyNI=";
   };
 
-  vendorSha256 = "sha256-Z/uLZIPKd75P9nI7kTFOwzWFkRTVwUojYEQms4OJ6Bk=";
+  vendorSha256 = "sha256-65NF814w1IUgSDuLLIqfbsf22va4AUC2E05ZgmuOHGY=";
 
   postInstall = ''
     mv $out/bin/src $out/bin/$pname
diff --git a/third_party/nixpkgs/pkgs/tools/security/kubescape/default.nix b/third_party/nixpkgs/pkgs/tools/security/kubescape/default.nix
index a604cbb80f..ef18a0f2d7 100644
--- a/third_party/nixpkgs/pkgs/tools/security/kubescape/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/security/kubescape/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "kubescape";
-  version = "2.0.141";
+  version = "2.0.143";
 
   src = fetchFromGitHub {
     owner = "armosec";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-4HVxPM+2SaFrhZiaRKwNuultE2df58aJMm9YSwbJBPM=";
+    hash = "sha256-ylmH3vQTWT9I57J+Q771PG/r6t8t3P6zNC+sGIx3C1A=";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/tools/security/lynis/default.nix b/third_party/nixpkgs/pkgs/tools/security/lynis/default.nix
index fbca5633fc..3c198e9b70 100644
--- a/third_party/nixpkgs/pkgs/tools/security/lynis/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/security/lynis/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lynis";
-  version = "3.0.6";
+  version = "3.0.7";
 
   src = fetchFromGitHub {
     owner = "CISOfy";
     repo = pname;
     rev = version;
-    sha256 = "sha256-RIz0GTuw3QJKSk25zl4c34o+HgMkpclzoPEbzKhCNqg=";
+    sha256 = "sha256-tO9/egY4eNwQpCZU0zx8G3k4UYsf7S3tUdr6pCMTAWU=";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
diff --git a/third_party/nixpkgs/pkgs/tools/virtualization/linode-cli/default.nix b/third_party/nixpkgs/pkgs/tools/virtualization/linode-cli/default.nix
index 5704922955..b7b20996bd 100644
--- a/third_party/nixpkgs/pkgs/tools/virtualization/linode-cli/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/virtualization/linode-cli/default.nix
@@ -13,8 +13,8 @@
 let
   sha256 = "10mlkkprky7qqjrkv43v1lzmlgdjpkzy3729k9xxdm5mpq5bjdwj";
   # specVersion taken from: https://www.linode.com/docs/api/openapi.yaml at `info.version`.
-  specVersion = "4.112.0";
-  specSha256 = "1z509qf5iidn6q5x3p7m8aifxn4bmwifx36wv8ii3nn7l4s9aymr";
+  specVersion = "4.112.3";
+  specSha256 = "15qlk0vd6l1gkxjbmvfwwdgjv7517y0kf0s3d32r3m2xqdsw9pc6";
   spec = fetchurl {
     url = "https://raw.githubusercontent.com/linode/linode-api-docs/v${specVersion}/openapi.yaml";
     sha256 = specSha256;
diff --git a/third_party/nixpkgs/pkgs/tools/wayland/swayr/default.nix b/third_party/nixpkgs/pkgs/tools/wayland/swayr/default.nix
index 9ccc13532c..1e0e963b8e 100644
--- a/third_party/nixpkgs/pkgs/tools/wayland/swayr/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/wayland/swayr/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "swayr";
-  version = "0.11.2";
+  version = "0.12.0";
 
   src = fetchFromSourcehut {
     owner = "~tsdh";
     repo = "swayr";
     rev = "v${version}";
-    sha256 = "sha256-IjOoQbKCiwuoCsh2bOmvcSH3/9KMmavmn1Ib1TLBH8w=";
+    sha256 = "sha256-bmMfrwxdriE/o8fezLbmhorBDvjtC4vaVamwDtrxiMQ=";
   };
 
-  cargoSha256 = "sha256-EYaISBnWKplKUAKa9SZufWcykeR/qeApvqwIGB9jt3Q=";
+  cargoSha256 = "sha256-5hTiu2fGyMcbsg05hLngQXsjw3Vql2q8zlW5e6jD9Ok=";
 
   patches = [
     ./icon-paths.patch
diff --git a/third_party/nixpkgs/pkgs/top-level/aliases.nix b/third_party/nixpkgs/pkgs/top-level/aliases.nix
index eaa5752e67..060f2c0687 100644
--- a/third_party/nixpkgs/pkgs/top-level/aliases.nix
+++ b/third_party/nixpkgs/pkgs/top-level/aliases.nix
@@ -631,6 +631,7 @@ mapAliases ({
   module_init_tools = kmod; # added 2016-04-22
   mozart = mozart2-binary; # added 2019-09-23
   mozart-binary = mozart2-binary; # added 2019-09-23
+  mpc_cli = mpc-cli; # moved from top-level 2022-01-24
   mpd_clientlib = libmpdclient; # added 2021-02-11
   mpich2 = mpich;  # added 2018-08-06
   msf = metasploit; # added 2018-04-25
diff --git a/third_party/nixpkgs/pkgs/top-level/all-packages.nix b/third_party/nixpkgs/pkgs/top-level/all-packages.nix
index 7ac4c0c528..0c8d9ed73a 100644
--- a/third_party/nixpkgs/pkgs/top-level/all-packages.nix
+++ b/third_party/nixpkgs/pkgs/top-level/all-packages.nix
@@ -1791,7 +1791,7 @@ with pkgs;
 
   github-to-sqlite = with python3Packages; toPythonApplication github-to-sqlite;
 
-  gitless = callPackage ../applications/version-management/gitless { python = python3; };
+  gitless = callPackage ../applications/version-management/gitless { };
 
   gistyc = with python3Packages; toPythonApplication gistyc;
 
@@ -2549,6 +2549,8 @@ with pkgs;
 
   comma = callPackage ../tools/package-management/comma { };
 
+  commitizen = python3Packages.callPackage ../applications/version-management/commitizen { };
+
   common-licenses = callPackage ../data/misc/common-licenses {};
 
   compactor = callPackage ../applications/networking/compactor { };
@@ -3392,9 +3394,7 @@ with pkgs;
 
   merriweather-sans = callPackage ../data/fonts/merriweather-sans { };
 
-  # TODO: call a sprintable to deprecate Meson 0.57 as soon as possible
-  meson = callPackage ../development/tools/build-managers/meson/0.57 { };
-  meson_0_60 = callPackage ../development/tools/build-managers/meson/0.60 { };
+  meson = callPackage ../development/tools/build-managers/meson { };
 
   meson-tools = callPackage ../misc/meson-tools { };
 
@@ -3601,10 +3601,7 @@ with pkgs;
 
   reg = callPackage ../tools/virtualization/reg { };
 
-  river = callPackage ../applications/window-managers/river {
-    wlroots = wlroots_0_14;
-    zig = zig_0_8_1;
-  };
+  river = callPackage ../applications/window-managers/river { };
 
   rivercarro = callPackage ../applications/misc/rivercarro { };
 
@@ -4483,10 +4480,19 @@ with pkgs;
 
   curlFull = curl.override {
     ldapSupport = true;
+    gsaslSupport = true;
+    rtmpSupport = true;
+    pslSupport = true;
+  };
+
+  curlHTTP3 = curl.override {
+    openssl = quictls;
+    http3Support = true;
   };
 
   curl = curlMinimal.override ({
     idnSupport = true;
+    zstdSupport = true;
   } // lib.optionalAttrs (!stdenv.hostPlatform.isStatic) {
     gssSupport = true;
     brotliSupport = true;
@@ -7433,6 +7439,9 @@ with pkgs;
   libpointmatcher = callPackage ../development/libraries/libpointmatcher { };
 
   libportal = callPackage ../development/libraries/libportal { };
+  libportal-gtk3 = libportal.override { variant = "gtk3"; };
+  libportal-gtk4 = libportal.override { variant = "gtk4"; };
+  libportal-qt5 = libportal.override { variant = "qt5"; };
 
   libmicrodns = callPackage ../development/libraries/libmicrodns { };
 
@@ -9166,6 +9175,8 @@ with pkgs;
 
   real_time_config_quick_scan = callPackage ../applications/audio/real_time_config_quick_scan { };
 
+  realesrgan-ncnn-vulkan = callPackage ../tools/graphics/realesrgan-ncnn-vulkan { };
+
   react-native-debugger = callPackage ../development/tools/react-native-debugger { };
 
   read-edid = callPackage ../os-specific/linux/read-edid { };
@@ -13300,7 +13311,11 @@ with pkgs;
       # Others should instead delegate to the next stage's choice with
       # `targetPackages.stdenv.cc.bintools`. This one is different just to
       # provide the default choice, avoiding infinite recursion.
-      bintools ? if stdenv.targetPlatform.isDarwin then darwin.binutils else binutils
+      # See the bintools attribute for the logic and reasoning. We need to provide
+      # a default here, since eval will hit this function when bootstrapping
+      # stdenv where the bintools attribute doesn't exist, but will never actually
+      # be evaluated -- callPackage ends up being too eager.
+      bintools ? pkgs.bintools
     , libc ? bintools.libc
     , # libc++ from the default LLVM version is bound at the top level, but we
       # want the C++ library to be explicitly chosen by the caller, and null by
@@ -14221,6 +14236,15 @@ with pkgs;
     bazel_self = bazel_4;
   };
 
+  bazel_5 = callPackage ../development/tools/build-managers/bazel/bazel_5 {
+    inherit (darwin) cctools;
+    inherit (darwin.apple_sdk.frameworks) CoreFoundation CoreServices Foundation;
+    buildJdk = jdk11_headless;
+    runJdk = jdk11_headless;
+    stdenv = if stdenv.cc.isClang then llvmPackages.stdenv else stdenv;
+    bazel_self = bazel_5;
+  };
+
   bazel-buildtools = callPackage ../development/tools/build-managers/bazel/buildtools { };
   buildifier = bazel-buildtools;
   buildozer = bazel-buildtools;
@@ -15107,7 +15131,7 @@ with pkgs;
 
   mkcert = callPackage ../development/tools/misc/mkcert { };
 
-  mkdocs = callPackage ../development/tools/documentation/mkdocs { };
+  mkdocs = with python3Packages; toPythonApplication mkdocs;
 
   mmtf-cpp = callPackage ../development/libraries/science/chemistry/mmtf-cpp { };
 
@@ -17012,7 +17036,7 @@ with pkgs;
   gtkextra = callPackage ../development/libraries/gtkextra { };
 
   gtk3 = callPackage ../development/libraries/gtk/3.x.nix {
-    inherit (darwin.apple_sdk.frameworks) AppKit Cocoa;
+    inherit (darwin.apple_sdk.frameworks) AppKit Cocoa QuartzCore;
   };
 
   gtk4 = callPackage ../development/libraries/gtk/4.x.nix {
@@ -17930,6 +17954,9 @@ with pkgs;
   libffcall = callPackage ../development/libraries/libffcall { };
 
   libffi = callPackage ../development/libraries/libffi { };
+  libffiBoot = libffi.override {
+    doCheck = false;
+  };
 
   libfreeaptx = callPackage ../development/libraries/libfreeaptx { };
 
@@ -17996,6 +18023,8 @@ with pkgs;
 
   libhugetlbfs = callPackage ../development/libraries/libhugetlbfs { };
 
+  libhwy = callPackage ../development/libraries/libhwy { };
+
   libHX = callPackage ../development/libraries/libHX { };
 
   libibmad = callPackage ../development/libraries/libibmad { };
@@ -18417,6 +18446,8 @@ with pkgs;
 
   libpst = callPackage ../development/libraries/libpst { };
 
+  libptytty = callPackage ../development/libraries/libptytty { };
+
   libpwquality = callPackage ../development/libraries/libpwquality { };
 
   libqalculate = callPackage ../development/libraries/libqalculate {
@@ -18520,9 +18551,7 @@ with pkgs;
 
   libtiff = if stdenv.isDarwin && stdenv.isAarch64
     then callPackage ../development/libraries/libtiff/aarch64-darwin.nix { }
-    else callPackage ../development/libraries/libtiff {
-      inherit (darwin.apple_sdk.frameworks) Cocoa GLUT;
-    };
+    else callPackage ../development/libraries/libtiff { };
 
   libtiger = callPackage ../development/libraries/libtiger { };
 
@@ -18609,6 +18638,8 @@ with pkgs;
     udev = systemdMinimal;
   };
 
+  libusbgx = callPackage ../development/libraries/libusbgx { };
+
   libusbmuxd = callPackage ../development/libraries/libusbmuxd { };
 
   libutempter = callPackage ../development/libraries/libutempter { };
@@ -19011,6 +19042,8 @@ with pkgs;
 
   nanovna-saver = libsForQt5.callPackage ../applications/science/electronics/nanovna-saver { };
 
+  ncnn = callPackage ../development/libraries/ncnn { };
+
   ndpi = callPackage ../development/libraries/ndpi { };
 
   nemo-qml-plugin-dbus = libsForQt5.callPackage ../development/libraries/nemo-qml-plugin-dbus { };
@@ -21410,7 +21443,6 @@ with pkgs;
   };
 
   pulseaudio = callPackage ../servers/pulseaudio ({
-    inherit (darwin) Libc;
     inherit (darwin.apple_sdk.frameworks) CoreServices AudioUnit Cocoa;
   } // lib.optionalAttrs stdenv.isDarwin {
     # Default autoreconfHook (2.70) fails on darwin,
@@ -22306,6 +22338,8 @@ with pkgs;
 
   gradm = callPackage ../os-specific/linux/gradm { };
 
+  gt = callPackage ../os-specific/linux/gt { };
+
   inherit (nodePackages) gtop;
 
   hd-idle = callPackage ../os-specific/linux/hd-idle { };
@@ -22338,9 +22372,7 @@ with pkgs;
 
   ifmetric = callPackage ../os-specific/linux/ifmetric {};
 
-  ima-evm-utils = callPackage ../os-specific/linux/ima-evm-utils {
-    openssl = openssl_1_0_2;
-  };
+  ima-evm-utils = callPackage ../os-specific/linux/ima-evm-utils {};
 
   intel2200BGFirmware = callPackage ../os-specific/linux/firmware/intel2200BGFirmware { };
 
@@ -22360,7 +22392,7 @@ with pkgs;
   iproute_mptcp = callPackage ../os-specific/linux/iproute/mptcp.nix { };
 
   iputils = hiPrio (callPackage ../os-specific/linux/iputils { });
-  # hiPrio for collisions with inetutils (ping and tftpd.8.gz)
+  # hiPrio for collisions with inetutils (ping)
 
   iptables = callPackage ../os-specific/linux/iptables { };
   iptables-legacy = callPackage ../os-specific/linux/iptables { nftablesCompat = false; };
@@ -24443,6 +24475,10 @@ with pkgs;
 
   bambootracker = libsForQt5.callPackage ../applications/audio/bambootracker { };
 
+  blocky = callPackage ../applications/networking/blocky {
+    buildGoModule = buildGo117Module;
+  };
+
   cadence = libsForQt5.callPackage ../applications/audio/cadence { };
 
   cheesecutter = callPackage ../applications/audio/cheesecutter { };
@@ -27334,7 +27370,7 @@ with pkgs;
 
   mpg321 = callPackage ../applications/audio/mpg321 { };
 
-  mpc_cli = callPackage ../applications/audio/mpc {
+  mpc-cli = callPackage ../applications/audio/mpc {
     inherit (python3Packages) sphinx;
   };
 
@@ -29327,9 +29363,7 @@ with pkgs;
 
   qpdfview = libsForQt5.callPackage ../applications/misc/qpdfview {};
 
-  qtile = callPackage ../applications/window-managers/qtile {
-    inherit (xorg) libxcb;
-  };
+  qtile = callPackage ../applications/window-managers/qtile { };
 
   vimpc = callPackage ../applications/audio/vimpc { };
 
@@ -32041,6 +32075,8 @@ with pkgs;
   sage = callPackage ../applications/science/math/sage { };
   sageWithDoc = sage.override { withDoc = true; };
 
+  sagetex = callPackage ../misc/sagetex { };
+
   subread = callPackage ../applications/science/biology/subread { };
 
   suitesparse_4_2 = callPackage ../development/libraries/science/math/suitesparse/4.2.nix { };
@@ -33106,6 +33142,7 @@ with pkgs;
     nix_2_3
     nix_2_4
     nix_2_5
+    nix_2_6
     nixUnstable;
 
   nixStatic = pkgsStatic.nix;
@@ -33938,9 +33975,7 @@ with pkgs;
 
   wprecon = callPackage ../tools/security/wprecon { };
 
-  wraith = callPackage ../applications/networking/irc/wraith {
-    openssl = openssl_1_0_2;
-  };
+  wraith = callPackage ../applications/networking/irc/wraith { };
 
   wxmupen64plus = callPackage ../misc/emulators/wxmupen64plus { };
 
diff --git a/third_party/nixpkgs/pkgs/top-level/nixpkgs-basic-release-checks.nix b/third_party/nixpkgs/pkgs/top-level/nixpkgs-basic-release-checks.nix
index fd302dfa5a..441f9b3382 100644
--- a/third_party/nixpkgs/pkgs/top-level/nixpkgs-basic-release-checks.nix
+++ b/third_party/nixpkgs/pkgs/top-level/nixpkgs-basic-release-checks.nix
@@ -19,15 +19,8 @@ pkgs.runCommand "nixpkgs-release-checks" { src = nixpkgs; buildInputs = [nix]; }
         exit 1
     fi
 
-    # Make sure that derivation paths do not depend on the Nixpkgs path.
-    mkdir $TMPDIR/foo
-    ln -s $(readlink -f $src) $TMPDIR/foo/bar
-    p1=$(nix-instantiate $src --dry-run -A firefox --show-trace)
-    p2=$(nix-instantiate $TMPDIR/foo/bar --dry-run -A firefox --show-trace)
-    if [ "$p1" != "$p2" ]; then
-        echo "Nixpkgs evaluation depends on Nixpkgs path ($p1 vs $p2)!"
-        exit 1
-    fi
+    src2=$TMPDIR/foo
+    cp -rd $src $src2
 
     # Check that all-packages.nix evaluates on a number of platforms without any warnings.
     for platform in ${pkgs.lib.concatStringsSep " " supportedSystems}; do
@@ -42,7 +35,25 @@ pkgs.runCommand "nixpkgs-release-checks" { src = nixpkgs; buildInputs = [nix]; }
             --arg config '{ allowAliases = false; }' \
             --option experimental-features 'no-url-literals' \
             -qa --drv-path --system-filter \* --system \
-            "''${opts[@]}" 2>&1 >/dev/null | tee eval-warnings.log
+            "''${opts[@]}" 2> eval-warnings.log > packages1
+
+        s1=$(sha1sum packages1 | cut -c1-40)
+        echo $s1
+
+        nix-env -f $src2 \
+            --show-trace --argstr system "$platform" \
+            --arg config '{ allowAliases = false; }' \
+            --option experimental-features 'no-url-literals' \
+            -qa --drv-path --system-filter \* --system \
+            "''${opts[@]}" > packages2
+
+        s2=$(sha1sum packages2 | cut -c1-40)
+
+        if [[ $s1 != $s2 ]]; then
+            echo "Nixpkgs evaluation depends on Nixpkgs path"
+            diff packages1 packages2
+            exit 1
+        fi
 
         # Catch any trace calls not caught by NIX_ABORT_ON_WARN (lib.warn)
         if [ -s eval-warnings.log ]; then
diff --git a/third_party/nixpkgs/pkgs/top-level/php-packages.nix b/third_party/nixpkgs/pkgs/top-level/php-packages.nix
index 25dda00172..9180421746 100644
--- a/third_party/nixpkgs/pkgs/top-level/php-packages.nix
+++ b/third_party/nixpkgs/pkgs/top-level/php-packages.nix
@@ -540,7 +540,15 @@ lib.makeScope pkgs.newScope (self: with self; {
             ++ lib.optionals (lib.versionOlder php.version "7.4") [ "--with-libxml-dir=${libxml2.dev}" ];
           doCheck = false;
         }
-        { name = "sockets"; doCheck = false; }
+        {
+          name = "sockets";
+          doCheck = false;
+          patches = lib.optional (php.version == "8.1.2")
+            (fetchpatch {
+              url = "https://github.com/php/php-src/commit/07aaa34cd418c44f7bc653fafbf49f07fc71b2bf.patch";
+              sha256 = "sha256-EwVb09/zV2vJ8PuyLpKFCovxe6yKct0UBvishZaordM=";
+            });
+        }
         { name = "sodium"; buildInputs = [ libsodium ]; }
         { name = "sqlite3"; buildInputs = [ sqlite ]; }
         { name = "sysvmsg"; }
diff --git a/third_party/nixpkgs/pkgs/top-level/python-packages.nix b/third_party/nixpkgs/pkgs/top-level/python-packages.nix
index ee34016a6f..183ea8574c 100644
--- a/third_party/nixpkgs/pkgs/top-level/python-packages.nix
+++ b/third_party/nixpkgs/pkgs/top-level/python-packages.nix
@@ -1994,6 +1994,8 @@ in {
 
   datadog = callPackage ../development/python-modules/datadog { };
 
+  datafusion = callPackage ../development/python-modules/datafusion { };
+
   datamodeldict = callPackage ../development/python-modules/datamodeldict { };
 
   dataset = callPackage ../development/python-modules/dataset { };
@@ -5039,6 +5041,8 @@ in {
 
   mizani = callPackage ../development/python-modules/mizani { };
 
+  mkdocs = callPackage ../development/python-modules/mkdocs { };
+
   mkl-service = callPackage ../development/python-modules/mkl-service { };
 
   ml-collections = callPackage ../development/python-modules/ml-collections { };
@@ -6626,6 +6630,8 @@ in {
 
   pycryptodome = callPackage ../development/python-modules/pycryptodome { };
 
+  pycryptodome-test-vectors = callPackage ../development/python-modules/pycryptodome-test-vectors { };
+
   pycryptodomex = callPackage ../development/python-modules/pycryptodomex { };
 
   pyct = callPackage ../development/python-modules/pyct { };
@@ -6823,6 +6829,8 @@ in {
 
   pygeoip = callPackage ../development/python-modules/pygeoip { };
 
+  pygeos = callPackage ../development/python-modules/pygeos { };
+
   pygetwindow = callPackage ../development/python-modules/pygetwindow { };
 
   pygit2 = callPackage ../development/python-modules/pygit2 { };
@@ -8272,9 +8280,7 @@ in {
 
   pywizlight = callPackage ../development/python-modules/pywizlight { };
 
-  pywlroots = callPackage ../development/python-modules/pywlroots {
-    wlroots = pkgs.wlroots_0_14;
-  };
+  pywlroots = callPackage ../development/python-modules/pywlroots { };
 
   pyxattr = callPackage ../development/python-modules/pyxattr { };