Project import generated by Copybara.

GitOrigin-RevId: 945ec499041db73043f745fad3b2a3a01e826081
2022-01-25 20:04:25 -08:00 · 2022-01-25 20:04:25 -08:00 · 68d7e71424
commit 68d7e71424
parent 0eeabdeb66
506 changed files with 7971 additions and 3167 deletions
--- a/third_party/nixpkgs/doc/builders/fetchers.chapter.md
+++ b/third_party/nixpkgs/doc/builders/fetchers.chapter.md
@ -40,6 +40,24 @@ Used with Git. Expects `url` to a Git repo, `rev`, and `sha256`. `rev` in this c

 Additionally the following optional arguments can be given: `fetchSubmodules = true` makes `fetchgit` also fetch the submodules of a repository. If `deepClone` is set to true, the entire repository is cloned as opposing to just creating a shallow clone. `deepClone = true` also implies `leaveDotGit = true` which means that the `.git` directory of the clone won't be removed after checkout.

+If only parts of the repository are needed, `sparseCheckout` can be used. This will prevent git from fetching unnecessary blobs from server, see [git sparse-checkout](https://git-scm.com/docs/git-sparse-checkout) and [git clone --filter](https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---filterltfilter-specgt) for more infomation:
+
+```nix
+{ stdenv, fetchgit }:
+
+stdenv.mkDerivation {
+  name = "hello";
+  src = fetchgit {
+    url = "https://...";
+    sparseCheckout = ''
+      path/to/be/included
+      another/path
+    '';
+    sha256 = "0000000000000000000000000000000000000000000000000000";
+  };
+}
+```
+
 ## `fetchfossil` {#fetchfossil}

 Used with Fossil. Expects `url` to a Fossil archive, `rev`, and `sha256`.
--- a/third_party/nixpkgs/lib/default.nix
+++ b/third_party/nixpkgs/lib/default.nix
@ -122,8 +122,9 @@ let
      mkRenamedOptionModule mkMergedOptionModule mkChangedOptionModule
      mkAliasOptionModule mkDerivedConfig doRename;
    inherit (self.options) isOption mkEnableOption mkSinkUndeclaredOptions
-      mergeDefaultOption mergeOneOption mergeEqualOption getValues
-      getFiles optionAttrSetToDocList optionAttrSetToDocList'
+      mergeDefaultOption mergeOneOption mergeEqualOption mergeUniqueOption
+      getValues getFiles
+      optionAttrSetToDocList optionAttrSetToDocList'
      scrubOptionValue literalExpression literalExample literalDocBook
      showOption showFiles unknownModule mkOption;
    inherit (self.types) isType setType defaultTypeMerge defaultFunctor
--- a/third_party/nixpkgs/lib/options.nix
+++ b/third_party/nixpkgs/lib/options.nix
@ -172,11 +172,13 @@ rec {
    else if all isInt list && all (x: x == head list) list then head list
    else throw "Cannot merge definitions of `${showOption loc}'. Definition values:${showDefs defs}";

-  mergeOneOption = loc: defs:
-    if defs == [] then abort "This case should never happen."
-    else if length defs != 1 then
-      throw "The unique option `${showOption loc}' is defined multiple times. Definition values:${showDefs defs}"
-    else (head defs).value;
+  mergeOneOption = mergeUniqueOption { message = ""; };
+
+  mergeUniqueOption = { message }: loc: defs:
+    if length defs == 1
+    then (head defs).value
+    else assert length defs > 1;
+      throw "The option `${showOption loc}' is defined multiple times.\n${message}\nDefinition values:${showDefs defs}";

  /* "Merge" option definitions by checking that they all have the same value. */
  mergeEqualOption = loc: defs:
--- a/third_party/nixpkgs/lib/types.nix
+++ b/third_party/nixpkgs/lib/types.nix
@ -32,7 +32,6 @@ let
    last
    length
    tail
-    unique
    ;
  inherit (lib.attrsets)
    attrNames
@ -48,6 +47,7 @@ let
    mergeDefaultOption
    mergeEqualOption
    mergeOneOption
+    mergeUniqueOption
    showFiles
    showOption
    ;
@ -470,6 +470,18 @@ rec {
      nestedTypes.elemType = elemType;
    };

+    unique = { message }: type: mkOptionType rec {
+      name = "unique";
+      inherit (type) description check;
+      merge = mergeUniqueOption { inherit message; };
+      emptyValue = type.emptyValue;
+      getSubOptions = type.getSubOptions;
+      getSubModules = type.getSubModules;
+      substSubModules = m: uniq (type.substSubModules m);
+      functor = (defaultFunctor name) // { wrapped = type; };
+      nestedTypes.elemType = type;
+    };
+
    # Null or value of ...
    nullOr = elemType: mkOptionType rec {
      name = "nullOr";
@ -599,6 +611,7 @@ rec {
    # A value from a set of allowed ones.
    enum = values:
      let
+        inherit (lib.lists) unique;
        show = v:
               if builtins.isString v then ''"${v}"''
          else if builtins.isInt v then builtins.toString v
--- a/third_party/nixpkgs/maintainers/maintainer-list.nix
+++ b/third_party/nixpkgs/maintainers/maintainer-list.nix
@ -515,6 +515,8 @@
  };
  algorith = {
    email = "dries_van_daele@telenet.be";
+    github = "DriesVanDaele";
+    githubId = 1141488;
    name = "Dries Van Daele";
  };
  alibabzo = {
@ -3543,7 +3545,7 @@
    name = "Leo Maroni";
  };
  emmanuelrosa = {
-    email = "emmanuel_rosa@aol.com";
+    email = "emmanuelrosa@protonmail.com";
    matrix = "@emmanuelrosa:matrix.org";
    github = "emmanuelrosa";
    githubId = 13485450;
@ -5982,6 +5984,13 @@
    githubId = 107689;
    name = "Josh Holland";
  };
+  jsierles = {
+    email = "joshua@hey.com";
+    matrix = "@jsierles:matrix.org";
+    name = "Joshua Sierles";
+    github = "jsierles";
+    githubId = 82;
+  };
  jtcoolen = {
    email = "jtcoolen@pm.me";
    name = "Julien Coolen";
@ -7024,7 +7033,7 @@
    email = "nullarequest@vivlaid.net";
    github = "Lunarequest";
    githubId = 30698906;
-    name = "Advaith Madhukar"; # this is my legal name, I prefer Luna; please keep that in mind!
+    name = "Luna D Dragon";
  };
  lionello = {
    email = "lio@lunesu.com";
@ -8586,6 +8595,12 @@
    githubId = 7845120;
    name = "Alex Martens";
  };
+  nialov = {
+    email = "nikolasovaskainen@gmail.com";
+    github = "nialov";
+    githubId = 47318483;
+    name = "Nikolas Ovaskainen";
+  };
  nikitavoloboev = {
    email = "nikita.voloboev@gmail.com";
    github = "nikitavoloboev";
@ -12041,7 +12056,7 @@
    name = "Tiago Castro";
  };
  tilcreator = {
-    name = "Tilman Jackel";
+    name = "TilCreator";
    email = "contact.nixos@tc-j.de";
    matrix = "@tilcreator:matrix.org";
    github = "TilCreator";
--- a/third_party/nixpkgs/nixos/doc/manual/development/option-types.section.md
+++ b/third_party/nixpkgs/nixos/doc/manual/development/option-types.section.md
@ -250,6 +250,12 @@ Composed types are types that take a type as parameter. `listOf
 :   Ensures that type *`t`* cannot be merged. It is used to ensure option
    definitions are declared only once.

+`types.unique` `{ message = m }` *`t`*
+
+:   Ensures that type *`t`* cannot be merged. Prints the message *`m`*, after
+    the line `The option <option path> is defined multiple times.` and before
+    a list of definition locations.
+
 `types.either` *`t1 t2`*

 :   Type *`t1`* or type *`t2`*, e.g. `with types; either int str`.
--- a/third_party/nixpkgs/nixos/doc/manual/from_md/development/option-types.section.xml
+++ b/third_party/nixpkgs/nixos/doc/manual/from_md/development/option-types.section.xml
@ -496,6 +496,22 @@
          </para>
        </listitem>
      </varlistentry>
+      <varlistentry>
+        <term>
+          <literal>types.unique</literal>
+          <literal>{ message = m }</literal>
+          <emphasis><literal>t</literal></emphasis>
+        </term>
+        <listitem>
+          <para>
+            Ensures that type <emphasis><literal>t</literal></emphasis>
+            cannot be merged. Prints the message
+            <emphasis><literal>m</literal></emphasis>, after the line
+            <literal>The option &lt;option path&gt; is defined multiple times.</literal>
+            and before a list of definition locations.
+          </para>
+        </listitem>
+      </varlistentry>
      <varlistentry>
        <term>
          <literal>types.either</literal>
--- a/third_party/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/third_party/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@ -356,6 +356,19 @@
          loaded.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The iputils package, which is installed by default, no longer
+          provides the legacy tools <literal>tftpd</literal> and
+          <literal>traceroute6</literal>. More tools
+          (<literal>ninfod</literal>, <literal>rarpd</literal>, and
+          <literal>rdisc</literal>) are going to be removed in the next
+          release. See
+          <link xlink:href="https://github.com/iputils/iputils/releases/tag/20211215">upstream’s
+          release notes</link> for more details and available
+          replacements.
+        </para>
+      </listitem>
      <listitem>
        <para>
          <literal>services.thelounge.private</literal> was removed in
--- a/third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2205.section.md
@ -116,6 +116,12 @@ In addition to numerous new and upgraded packages, this release has the followin

 - `idris2` now requires `--package` when using packages `contrib` and `network`, while previously these idris2 packages were automatically loaded.

+- The iputils package, which is installed by default, no longer provides the
+  legacy tools `tftpd` and `traceroute6`. More tools (`ninfod`, `rarpd`, and
+  `rdisc`) are going to be removed in the next release. See
+  [upstream's release notes](https://github.com/iputils/iputils/releases/tag/20211215)
+  for more details and available replacements.
+
 - `services.thelounge.private` was removed in favor of `services.thelounge.public`, to follow with upstream changes.

 - `pkgs.docbookrx` was removed since it's unmaintained
--- a/third_party/nixpkgs/nixos/modules/security/pam.nix
+++ b/third_party/nixpkgs/nixos/modules/security/pam.nix
@ -1035,7 +1035,7 @@ in
        setuid = true;
        owner = "root";
        group = "root";
-        source = "${pkgs.pam}/sbin/unix_chkpwd.orig";
+        source = "${pkgs.pam}/bin/unix_chkpwd";
      };
    };

--- a/third_party/nixpkgs/nixos/modules/services/hardware/triggerhappy.nix
+++ b/third_party/nixpkgs/nixos/modules/services/hardware/triggerhappy.nix
@ -70,7 +70,7 @@ in
        type = types.listOf (types.submodule bindingCfg);
        default = [];
        example = lib.literalExpression ''
-          [ { keys = ["PLAYPAUSE"];  cmd = "''${pkgs.mpc_cli}/bin/mpc -q toggle"; } ]
+          [ { keys = ["PLAYPAUSE"];  cmd = "''${pkgs.mpc-cli}/bin/mpc -q toggle"; } ]
        '';
        description = ''
          Key bindings for <command>triggerhappy</command>.
--- a/third_party/nixpkgs/nixos/modules/services/misc/gitlab.nix
+++ b/third_party/nixpkgs/nixos/modules/services/misc/gitlab.nix
@ -1099,7 +1099,9 @@ in {
      "d ${gitlabConfig.production.shared.path} 0750 ${cfg.user} ${cfg.group} -"
      "d ${gitlabConfig.production.shared.path}/artifacts 0750 ${cfg.user} ${cfg.group} -"
      "d ${gitlabConfig.production.shared.path}/lfs-objects 0750 ${cfg.user} ${cfg.group} -"
+      "d ${gitlabConfig.production.shared.path}/packages 0750 ${cfg.user} ${cfg.group} -"
      "d ${gitlabConfig.production.shared.path}/pages 0750 ${cfg.user} ${cfg.group} -"
+      "d ${gitlabConfig.production.shared.path}/terraform_state 0750 ${cfg.user} ${cfg.group} -"
      "L+ /run/gitlab/config - - - - ${cfg.statePath}/config"
      "L+ /run/gitlab/log - - - - ${cfg.statePath}/log"
      "L+ /run/gitlab/tmp - - - - ${cfg.statePath}/tmp"
--- a/third_party/nixpkgs/nixos/modules/services/misc/home-assistant.nix
+++ b/third_party/nixpkgs/nixos/modules/services/misc/home-assistant.nix
@ -278,6 +278,11 @@ in {
          "bluetooth_tracker"
          "bluetooth_le_tracker"
        ];
+        componentsUsingPing = [
+          # Components that require the capset syscall for the ping wrapper
+          "ping"
+          "wake_on_lan"
+        ];
        componentsUsingSerialDevices = [
          # Components that require access to serial devices (/dev/tty*)
          # List generated from home-assistant documentation:
@ -382,6 +387,8 @@ in {
        SystemCallFilter = [
          "@system-service"
          "~@privileged"
+        ] ++ optionals (any useComponent componentsUsingPing) [
+          "capset"
        ];
        UMask = "0077";
      };
--- a/third_party/nixpkgs/nixos/modules/services/misc/matrix-synapse.nix
+++ b/third_party/nixpkgs/nixos/modules/services/misc/matrix-synapse.nix
@ -119,6 +119,30 @@ ${cfg.extraConfig}

  hasLocalPostgresDB = let args = cfg.database_args; in
    usePostgresql && (!(args ? host) || (elem args.host [ "localhost" "127.0.0.1" "::1" ]));
+
+  registerNewMatrixUser =
+    let
+      isIpv6 = x: lib.length (lib.splitString ":" x) > 1;
+      listener =
+        lib.findFirst (
+          listener: lib.any (
+            resource: lib.any (
+              name: name == "client"
+            ) resource.names
+          ) listener.resources
+        ) (lib.last cfg.listeners) cfg.listeners;
+    in
+    pkgs.writeShellScriptBin "matrix-synapse-register_new_matrix_user" ''
+      exec ${cfg.package}/bin/register_new_matrix_user \
+        $@ \
+        ${lib.concatMapStringsSep " " (x: "-c ${x}") ([ configFile ] ++ cfg.extraConfigFiles)} \
+        "${listener.type}://${
+          if (isIpv6 listener.bind_address) then
+            "[${listener.bind_address}]"
+          else
+            "${listener.bind_address}"
+        }:${builtins.toString listener.port}/"
+    '';
 in {
  options = {
    services.matrix-synapse = {
@ -294,7 +318,7 @@ in {
                    description = ''
                      List of resources to host on this listener.
                    '';
-                    example = ["client" "webclient" "federation"];
+                    example = ["client" "federation"];
                  };
                  compress = mkOption {
                    type = types.bool;
@ -319,7 +343,7 @@ in {
          tls = true;
          x_forwarded = false;
          resources = [
-            { names = ["client" "webclient"]; compress = true; }
+            { names = ["client"]; compress = true; }
            { names = ["federation"]; compress = false; }
          ];
        }];
@ -792,6 +816,8 @@ in {
        UMask = "0077";
      };
    };
+
+    environment.systemPackages = [ registerNewMatrixUser ];
  };

  imports = [
--- a/third_party/nixpkgs/nixos/modules/services/networking/bird.nix
+++ b/third_party/nixpkgs/nixos/modules/services/networking/bird.nix
@ -31,7 +31,23 @@ let
            default = true;
            description = ''
              Whether the config should be checked at build time.
-              Disabling this might become necessary if the config includes files not present during build time.
+              When the config can't be checked during build time, for example when it includes
+              other files, either disable this option or use <code>preCheckConfig</code> to create
+              the included files before checking.
+            '';
+          };
+          preCheckConfig = mkOption {
+            type = types.lines;
+            default = "";
+            example = ''
+              echo "cost 100;" > include.conf
+            '';
+            description = ''
+              Commands to execute before the config file check. The file to be checked will be
+              available as <code>${variant}.conf</code> in the current directory.
+
+              Files created with this option will not be available at service runtime, only during
+              build time checking.
            '';
          };
        };
@ -45,7 +61,9 @@ let
          name = "${variant}.conf";
          text = cfg.config;
          checkPhase = optionalString cfg.checkConfig ''
-            ${pkg}/bin/${birdBin} -d -p -c $out
+            ln -s $out ${variant}.conf
+            ${cfg.preCheckConfig}
+            ${pkg}/bin/${birdBin} -d -p -c ${variant}.conf
          '';
        };

--- a/third_party/nixpkgs/nixos/modules/services/security/tor.nix
+++ b/third_party/nixpkgs/nixos/modules/services/security/tor.nix
@ -794,6 +794,11 @@ in
              };
            }));
          };
+          options.ShutdownWaitLength = mkOption {
+            type = types.int;
+            default = 30;
+            description = descriptionGeneric "ShutdownWaitLength";
+          };
          options.SocksPolicy = optionStrings "SocksPolicy" // {
            example = ["accept *:*"];
          };
@ -977,7 +982,7 @@ in
        ExecStart = "${cfg.package}/bin/tor -f ${torrc}";
        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
        KillSignal = "SIGINT";
-        TimeoutSec = 30;
+        TimeoutSec = cfg.settings.ShutdownWaitLength + 30; # Wait a bit longer than ShutdownWaitLength before actually timing out
        Restart = "on-failure";
        LimitNOFILE = 32768;
        RuntimeDirectory = [
--- a/third_party/nixpkgs/nixos/modules/system/activation/top-level.nix
+++ b/third_party/nixpkgs/nixos/modules/system/activation/top-level.nix
@ -55,8 +55,8 @@ let
      substituteInPlace $out/dry-activate --subst-var out
      chmod u+x $out/activate $out/dry-activate
      unset activationScript dryActivationScript
-      ${pkgs.stdenv.shell} -n $out/activate
-      ${pkgs.stdenv.shell} -n $out/dry-activate
+      ${pkgs.stdenv.shellDryRun} $out/activate
+      ${pkgs.stdenv.shellDryRun} $out/dry-activate

      cp ${config.system.build.bootStage2} $out/init
      substituteInPlace $out/init --subst-var-by systemConfig $out
@ -109,9 +109,7 @@ let
    utillinux = pkgs.util-linux;

    kernelParams = config.boot.kernelParams;
-    installBootLoader =
-      config.system.build.installBootLoader
-      or "echo 'Warning: do not know how to make this configuration bootable; please enable a boot loader.' 1>&2; true";
+    installBootLoader = config.system.build.installBootLoader;
    activationScript = config.system.activationScripts.script;
    dryActivationScript = config.system.dryActivationScript;
    nixosLabel = config.system.nixos.label;
@ -135,25 +133,27 @@ let
      pkgs.replaceDependency { inherit oldDependency newDependency drv; }
    ) baseSystemAssertWarn config.system.replaceRuntimeDependencies;

+  /* Workaround until https://github.com/NixOS/nixpkgs/pull/156533
+     Call can be replaced by argument when that's merged.
+  */
+  tmpFixupSubmoduleBoundary = subopts:
+    lib.mkOption {
+      type = lib.types.submoduleWith {
+        modules = [ { options = subopts; } ];
+      };
+    };
+
 in

 {
  imports = [
+    ../build.nix
    (mkRemovedOptionModule [ "nesting" "clone" ] "Use `specialisation.«name» = { inheritParentConfig = true; configuration = { ... }; }` instead.")
    (mkRemovedOptionModule [ "nesting" "children" ] "Use `specialisation.«name».configuration = { ... }` instead.")
  ];

  options = {

-    system.build = mkOption {
-      internal = true;
-      default = {};
-      type = with types; lazyAttrsOf (uniq unspecified);
-      description = ''
-        Attribute set of derivations used to setup the system.
-      '';
-    };
-
    specialisation = mkOption {
      default = {};
      example = lib.literalExpression "{ fewJobsManyCores.configuration = { nix.buildCores = 0; nix.maxJobs = 1; }; }";
@ -224,6 +224,39 @@ in
      '';
    };

+    system.build = tmpFixupSubmoduleBoundary {
+      installBootLoader = mkOption {
+        internal = true;
+        # "; true" => make the `$out` argument from switch-to-configuration.pl
+        #             go to `true` instead of `echo`, hiding the useless path
+        #             from the log.
+        default = "echo 'Warning: do not know how to make this configuration bootable; please enable a boot loader.' 1>&2; true";
+        description = ''
+          A program that writes a bootloader installation script to the path passed in the first command line argument.
+
+          See <literal>nixos/modules/system/activation/switch-to-configuration.pl</literal>.
+        '';
+        type = types.unique {
+          message = ''
+            Only one bootloader can be enabled at a time. This requirement has not
+            been checked until NixOS 22.05. Earlier versions defaulted to the last
+            definition. Change your configuration to enable only one bootloader.
+          '';
+        } (types.either types.str types.package);
+      };
+
+      toplevel = mkOption {
+        type = types.package;
+        readOnly = true;
+        description = ''
+          This option contains the store path that typically represents a NixOS system.
+
+          You can read this path in a custom deployment tool for example.
+        '';
+      };
+    };
+
+
    system.copySystemConfiguration = mkOption {
      type = types.bool;
      default = false;
--- a/third_party/nixpkgs/nixos/modules/system/boot/systemd.nix
+++ b/third_party/nixpkgs/nixos/modules/system/boot/systemd.nix
@ -210,20 +210,14 @@ let
  makeJobScript = name: text:
    let
      scriptName = replaceChars [ "\\" "@" ] [ "-" "_" ] (shellEscape name);
-      out = pkgs.writeTextFile {
+      out = (pkgs.writeShellScriptBin scriptName ''
+        set -e
+        ${text}
+      '').overrideAttrs (_: {
        # The derivation name is different from the script file name
        # to keep the script file name short to avoid cluttering logs.
        name = "unit-script-${scriptName}";
-        executable = true;
-        destination = "/bin/${scriptName}";
-        text = ''
-          #!${pkgs.runtimeShell} -e
-          ${text}
-        '';
-        checkPhase = ''
-          ${pkgs.stdenv.shell} -n "$out/bin/${scriptName}"
-        '';
-      };
+      });
    in "${out}/bin/${scriptName}";

  unitConfig = { config, options, ... }: {
--- a/third_party/nixpkgs/nixos/modules/system/build.nix
+++ b/third_party/nixpkgs/nixos/modules/system/build.nix
@ -0,0 +1,21 @@
+{ lib, ... }:
+let
+  inherit (lib) mkOption types;
+in
+{
+  options = {
+
+    system.build = mkOption {
+      default = {};
+      description = ''
+        Attribute set of derivations used to set up the system.
+      '';
+      type = types.submoduleWith {
+        modules = [{
+          freeformType = with types; lazyAttrsOf (uniq unspecified);
+        }];
+      };
+    };
+
+  };
+}
--- a/third_party/nixpkgs/nixos/tests/all-tests.nix
+++ b/third_party/nixpkgs/nixos/tests/all-tests.nix
@ -46,6 +46,7 @@ in
  beanstalkd = handleTest ./beanstalkd.nix {};
  bees = handleTest ./bees.nix {};
  bind = handleTest ./bind.nix {};
+  bird = handleTest ./bird.nix {};
  bitcoind = handleTest ./bitcoind.nix {};
  bittorrent = handleTest ./bittorrent.nix {};
  blockbook-frontend = handleTest ./blockbook-frontend.nix {};
--- a/third_party/nixpkgs/nixos/tests/bcachefs.nix
+++ b/third_party/nixpkgs/nixos/tests/bcachefs.nix
@ -18,13 +18,13 @@ import ./make-test-python.nix ({ pkgs, ... }: {
        "mkdir /tmp/mnt",
        "udevadm settle",
        "parted --script /dev/vdb mklabel msdos",
-        "parted --script /dev/vdb -- mkpart primary 1024M -1s",
+        "parted --script /dev/vdb -- mkpart primary 1024M 50% mkpart primary 50% -1s",
        "udevadm settle",
        # Due to #32279, we cannot use encryption for this test yet
-        # "echo password | bcachefs format --encrypted /dev/vdb1",
+        # "echo password | bcachefs format --encrypted --metadata_replicas 2 --label vtest /dev/vdb1 /dev/vdb2",
        # "echo password | bcachefs unlock /dev/vdb1",
-        "bcachefs format /dev/vdb1",
-        "mount -t bcachefs /dev/vdb1 /tmp/mnt",
+        "bcachefs format --metadata_replicas 2 --label vtest /dev/vdb1 /dev/vdb2",
+        "mount -t bcachefs /dev/vdb1:/dev/vdb2 /tmp/mnt",
        "udevadm settle",
        "bcachefs fs usage /tmp/mnt",
        "umount /tmp/mnt",
--- a/third_party/nixpkgs/nixos/tests/bird.nix
+++ b/third_party/nixpkgs/nixos/tests/bird.nix
@ -0,0 +1,205 @@
+# This test does a basic functionality check for all bird variants and demonstrates a use
+# of the preCheckConfig option.
+
+{ system ? builtins.currentSystem
+, pkgs ? import ../.. { inherit system; config = { }; }
+}:
+
+let
+  inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
+  inherit (pkgs.lib) optionalString;
+
+  hostShared = hostId: { pkgs, ... }: {
+    virtualisation.vlans = [ 1 ];
+
+    environment.systemPackages = with pkgs; [ jq ];
+
+    networking = {
+      useNetworkd = true;
+      useDHCP = false;
+      firewall.enable = false;
+    };
+
+    systemd.network.networks."01-eth1" = {
+      name = "eth1";
+      networkConfig.Address = "10.0.0.${hostId}/24";
+    };
+  };
+
+  birdTest = v4:
+    let variant = "bird${optionalString (!v4) "6"}"; in
+    makeTest {
+      name = variant;
+
+      nodes.host1 = makeBirdHost variant "1";
+      nodes.host2 = makeBirdHost variant "2";
+
+      testScript = makeTestScript variant v4 (!v4);
+    };
+
+  bird2Test = makeTest {
+    name = "bird2";
+
+    nodes.host1 = makeBird2Host "1";
+    nodes.host2 = makeBird2Host "2";
+
+    testScript = makeTestScript "bird2" true true;
+  };
+
+  makeTestScript = variant: v4: v6: ''
+    start_all()
+
+    host1.wait_for_unit("${variant}.service")
+    host2.wait_for_unit("${variant}.service")
+
+    ${optionalString v4 ''
+    with subtest("Waiting for advertised IPv4 routes"):
+      host1.wait_until_succeeds("ip --json r | jq -e 'map(select(.dst == \"10.10.0.2\")) | any'")
+      host2.wait_until_succeeds("ip --json r | jq -e 'map(select(.dst == \"10.10.0.1\")) | any'")
+    ''}
+    ${optionalString v6 ''
+    with subtest("Waiting for advertised IPv6 routes"):
+      host1.wait_until_succeeds("ip --json -6 r | jq -e 'map(select(.dst == \"fdff::2\")) | any'")
+      host2.wait_until_succeeds("ip --json -6 r | jq -e 'map(select(.dst == \"fdff::1\")) | any'")
+    ''}
+
+    with subtest("Check fake routes in preCheckConfig do not exists"):
+      ${optionalString v4 ''host1.fail("ip --json r | jq -e 'map(select(.dst == \"1.2.3.4\")) | any'")''}
+      ${optionalString v4 ''host2.fail("ip --json r | jq -e 'map(select(.dst == \"1.2.3.4\")) | any'")''}
+
+      ${optionalString v6 ''host1.fail("ip --json -6 r | jq -e 'map(select(.dst == \"fd00::\")) | any'")''}
+      ${optionalString v6 ''host2.fail("ip --json -6 r | jq -e 'map(select(.dst == \"fd00::\")) | any'")''}
+  '';
+
+  makeBirdHost = variant: hostId: { pkgs, ... }: {
+    imports = [ (hostShared hostId) ];
+
+    services.${variant} = {
+      enable = true;
+
+      config = ''
+        log syslog all;
+
+        debug protocols all;
+
+        router id 10.0.0.${hostId};
+
+        protocol device {
+        }
+
+        protocol kernel {
+          import none;
+          export all;
+        }
+
+        protocol static {
+          include "static.conf";
+        }
+
+        protocol ospf {
+          export all;
+          area 0 {
+            interface "eth1" {
+              hello 5;
+              wait 5;
+            };
+          };
+        }
+      '';
+
+      preCheckConfig =
+        let
+          route = { bird = "1.2.3.4/32"; bird6 = "fd00::/128"; }.${variant};
+        in
+        ''echo "route ${route} blackhole;" > static.conf'';
+    };
+
+    systemd.tmpfiles.rules =
+      let
+        route = { bird = "10.10.0.${hostId}/32"; bird6 = "fdff::${hostId}/128"; }.${variant};
+      in
+      [ "f /etc/bird/static.conf - - - - route ${route} blackhole;" ];
+  };
+
+  makeBird2Host = hostId: { pkgs, ... }: {
+    imports = [ (hostShared hostId) ];
+
+    services.bird2 = {
+      enable = true;
+
+      config = ''
+        log syslog all;
+
+        debug protocols all;
+
+        router id 10.0.0.${hostId};
+
+        protocol device {
+        }
+
+        protocol kernel kernel4 {
+          ipv4 {
+            import none;
+            export all;
+          };
+        }
+
+        protocol static static4 {
+          ipv4;
+          include "static4.conf";
+        }
+
+        protocol ospf v2 ospf4 {
+          ipv4 {
+            export all;
+          };
+          area 0 {
+            interface "eth1" {
+              hello 5;
+              wait 5;
+            };
+          };
+        }
+
+        protocol kernel kernel6 {
+          ipv6 {
+            import none;
+            export all;
+          };
+        }
+
+        protocol static static6 {
+          ipv6;
+          include "static6.conf";
+        }
+
+        protocol ospf v3 ospf6 {
+          ipv6 {
+            export all;
+          };
+          area 0 {
+            interface "eth1" {
+              hello 5;
+              wait 5;
+            };
+          };
+        }
+      '';
+
+      preCheckConfig = ''
+        echo "route 1.2.3.4/32 blackhole;" > static4.conf
+        echo "route fd00::/128 blackhole;" > static6.conf
+      '';
+    };
+
+    systemd.tmpfiles.rules = [
+      "f /etc/bird/static4.conf - - - - route 10.10.0.${hostId}/32 blackhole;"
+      "f /etc/bird/static6.conf - - - - route fdff::${hostId}/128 blackhole;"
+    ];
+  };
+in
+{
+  bird = birdTest true;
+  bird6 = birdTest false;
+  bird2 = bird2Test;
+}
--- a/third_party/nixpkgs/nixos/tests/home-assistant.nix
+++ b/third_party/nixpkgs/nixos/tests/home-assistant.nix
@ -49,6 +49,12 @@ in {
          payload_on = "let_there_be_light";
          payload_off = "off";
        }];
+        wake_on_lan = {};
+        switch = [{
+          platform = "wake_on_lan";
+          mac = "00:11:22:33:44:55";
+          host = "127.0.0.1";
+        }];
        # tests component-based capability assignment (CAP_NET_BIND_SERVICE)
        emulated_hue = {
          host_ip = "127.0.0.1";
@ -99,6 +105,10 @@ in {
        print("\n### home-assistant.log ###\n")
        print(output_log + "\n")

+    # wait for home-assistant to fully boot
+    hass.sleep(30)
+    hass.wait_for_unit("home-assistant.service")
+
    with subtest("Check that no errors were logged"):
        assert "ERROR" not in output_log

--- a/third_party/nixpkgs/nixos/tests/mpd.nix
+++ b/third_party/nixpkgs/nixos/tests/mpd.nix
@ -96,7 +96,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
    };

  testScript = ''
-    mpc = "${pkgs.mpc_cli}/bin/mpc --wait"
+    mpc = "${pkgs.mpc-cli}/bin/mpc --wait"

    # Connects to the given server and attempts to play a tune.
    def play_some_music(server):
--- a/third_party/nixpkgs/pkgs/applications/audio/clerk/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/clerk/default.nix
@ -3,7 +3,7 @@
 , fetchFromGitHub
 , makeWrapper
 , rofi
-, mpc_cli
+, mpc-cli
 , perl
 , util-linux
 , python3Packages
@ -28,11 +28,24 @@ stdenv.mkDerivation {

  strictDeps = true;

-  installPhase = ''
-    DESTDIR=$out PREFIX=/ make install
-    wrapProgram $out/bin/clerk \
-      --prefix PATH : "${lib.makeBinPath [ rofi mpc_cli perl util-linux libnotify ]}"
-  '';
+  installPhase =
+    let
+      binPath = lib.makeBinPath [
+        libnotify
+        mpc-cli
+        perl
+        rofi
+        util-linux
+      ];
+    in
+      ''
+        runHook preInstall
+
+        DESTDIR=$out PREFIX=/ make install
+        wrapProgram $out/bin/clerk --prefix PATH : "${binPath}"
+
+        runHook postInstall
+      '';

  meta = with lib; {
    description = "An MPD client built on top of rofi";
--- a/third_party/nixpkgs/pkgs/applications/audio/librespot/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/librespot/default.nix
@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, rustPlatform, pkg-config, openssl, withRodio ? true
+{ lib, stdenv, fetchFromGitHub, rustPlatform, pkg-config, openssl, withRodio ? true
 , withALSA ? true, alsa-lib ? null, withPulseAudio ? false, libpulseaudio ? null
 , withPortAudio ? false, portaudio ? null }:

@ -35,5 +35,6 @@ rustPlatform.buildRustPackage rec {
    license = with licenses; [ mit ];
    maintainers = with maintainers; [ bennofs ];
    platforms = platforms.unix;
+    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/librespot.x86_64-darwin
  };
 }
--- a/third_party/nixpkgs/pkgs/applications/audio/mpc/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/mpc/default.nix
@ -1,12 +1,14 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
+, installShellFiles
+, libiconv
+, libmpdclient
 , meson
 , ninja
 , pkg-config
-, libmpdclient
 , sphinx
-, libiconv
 }:

 stdenv.mkDerivation rec {
@ -14,21 +16,47 @@ stdenv.mkDerivation rec {
  version = "0.34";

  src = fetchFromGitHub {
-    owner  = "MusicPlayerDaemon";
-    repo   = "mpc";
-    rev    = "v${version}";
-    sha256 = "sha256-2FjYBfak0IjibuU+CNQ0y9Ei8hTZhynS/BK2DNerhVw=";
+    owner = "MusicPlayerDaemon";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-2FjYBfak0IjibuU+CNQ0y9Ei8hTZhynS/BK2DNerhVw=";
  };

-  buildInputs = [ libmpdclient ] ++ lib.optionals stdenv.isDarwin [ libiconv ];
+  patches = [
+    # fix the build with meson 0.60 (https://github.com/MusicPlayerDaemon/mpc/pull/76)
+    (fetchpatch {
+      url = "https://github.com/MusicPlayerDaemon/mpc/commit/b656ca4b6c2a0d5b6cebd7f7daa679352f664e0e.patch";
+      sha256 = "sha256-fjjSlCKxgkz7Em08CaK7+JAzl8YTzLcpGGMz2HJlsVw=";
+    })
+  ];

-  nativeBuildInputs = [ meson ninja pkg-config sphinx ];
+  buildInputs = [
+    libmpdclient
+  ]
+  ++ lib.optionals stdenv.isDarwin [ libiconv ];
+
+  nativeBuildInputs = [
+    installShellFiles
+    meson
+    ninja
+    pkg-config
+    sphinx
+  ];
+
+  postInstall = ''
+    installShellCompletion --cmd mpc --bash $out/share/doc/mpc/contrib/mpc-completion.bash
+  '';
+
+  postFixup = ''
+    rm $out/share/doc/mpc/contrib/mpc-completion.bash
+  '';

  meta = with lib; {
-    description = "A minimalist command line interface to MPD";
    homepage = "https://www.musicpd.org/clients/mpc/";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ algorith ];
-    platforms = with platforms; linux ++ darwin;
+    description = "A minimalist command line interface to MPD";
+    changelog = "https://raw.githubusercontent.com/MusicPlayerDaemon/mpc/v${version}/NEWS";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ AndersonTorres ];
+    platforms = with platforms; unix;
  };
 }
--- a/third_party/nixpkgs/pkgs/applications/audio/parlatype/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/parlatype/default.nix
@ -40,8 +40,6 @@ stdenv.mkDerivation rec {
    hicolor-icon-theme
  ];

-  mesonFlags = [ "-Dlibreoffice=false" ];
-
  postPatch = ''
    chmod +x data/meson_post_install.py
    patchShebangs data/meson_post_install.py
--- a/third_party/nixpkgs/pkgs/applications/audio/shortwave/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/shortwave/default.nix
@ -80,6 +80,7 @@ stdenv.mkDerivation rec {
      desktop. It is the successor to the older Gradio application.
    '';
    maintainers = with maintainers; [ lasandell ];
+    broken = true; # incompatible with latest libadwaita
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
  };
--- a/third_party/nixpkgs/pkgs/applications/audio/squishyball/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/squishyball/default.nix
@ -16,8 +16,6 @@ stdenv.mkDerivation rec {

  buildInputs = [ flac libao libvorbis ncurses opusfile ];

-  NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS";
-
  patches = [ ./gnu-screen.patch ];

  postInstall = ''
--- a/third_party/nixpkgs/pkgs/applications/audio/zrythm/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/zrythm/default.nix
@ -13,7 +13,6 @@
 , curl
 , dconf
 , libepoxy
-, ffmpeg
 , fftw
 , fftwFloat
 , flex
@ -95,7 +94,6 @@ stdenv.mkDerivation rec {
    curl
    dconf
    libepoxy
-    ffmpeg
    fftw
    fftwFloat
    flex
@ -133,10 +131,9 @@ stdenv.mkDerivation rec {
  ];

  mesonFlags = [
-    "-Denable_ffmpeg=true"
-    "-Denable_rtmidi=true"
-    "-Denable_rtaudio=true"
-    "-Denable_sdl=true"
+    "-Drtmidi=enabled"
+    "-Drtaudio=enabled"
+    "-Dsdl=enabled"
    "-Dcarla=enabled"
    "-Dmanpage=true"
    # "-Duser_manual=true" # needs sphinx-intl
--- a/third_party/nixpkgs/pkgs/applications/editors/gnome-builder/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/gnome-builder/default.nix
@ -5,6 +5,7 @@
 , appstream-glib
 , desktop-file-utils
 , fetchurl
+, fetchpatch
 , flatpak
 , gnome
 , libgit2-glib
@ -18,7 +19,7 @@
 , jsonrpc-glib
 , libdazzle
 , libpeas
-, libportal
+, libportal-gtk3
 , libxml2
 , meson
 , ninja
@ -48,6 +49,15 @@ stdenv.mkDerivation rec {
    sha256 = "4iUPyOnp8gAsRS5ZUNgmhXNNPESAs1Fnq1CKyHAlCeE=";
  };

+  patches = [
+    # Fix build with latest libportal
+    # https://gitlab.gnome.org/GNOME/gnome-builder/-/merge_requests/486
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gnome-builder/-/commit/b3bfa0df53a3749c3b73cb6c4bad5cab3fa549a1.patch";
+      sha256 = "B/uCcYavFvOAPhLHZ4MRNENDd6VytILiGYwDZRUSxTE=";
+    })
+  ];
+
  nativeBuildInputs = [
    appstream-glib
    desktop-file-utils
@ -69,7 +79,7 @@ stdenv.mkDerivation rec {
    glade
    libgit2-glib
    libpeas
-    libportal
+    libportal-gtk3
    vte
    gspell
    gtk3
--- a/third_party/nixpkgs/pkgs/applications/editors/neovim/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/neovim/default.nix
@ -113,8 +113,10 @@ in
      substituteInPlace src/nvim/CMakeLists.txt --replace "    util" ""
    '';

-    # For treesitter plugins, libstdc++.so.6 will be needed
-    NIX_LDFLAGS = [ "-lstdc++"];
+    # For treesitter plugins, libstdc++.so.6, or equivalent will be needed
+    NIX_LDFLAGS =
+      lib.optionals stdenv.cc.isGNU [ "-lstdc++"]
+      ++ lib.optionals stdenv.cc.isClang [ "-lc++" ];

    # export PATH=$PWD/build/bin:${PATH}
    shellHook=''
--- a/third_party/nixpkgs/pkgs/applications/editors/vim/common.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/vim/common.nix
@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.2.3877";
+  version = "8.2.4186";

  src = fetchFromGitHub {
    owner = "vim";
    repo = "vim";
    rev = "v${version}";
-    sha256 = "sha256-NqTO2TdhOs63eP7CdWY9U9nbR7No3hqPV5rGhYF9arA=";
+    sha256 = "0g276mbmq69z7c4kgj59r0azxmx9ih2sd8v83dx2gfph6wgw65ph";
  };

  enableParallelBuilding = true;
--- a/third_party/nixpkgs/pkgs/applications/graphics/gcolor3/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/graphics/gcolor3/default.nix
@ -6,7 +6,7 @@
 , pkg-config
 , libxml2
 , gtk3
-, libportal
+, libportal-gtk3
 , wrapGAppsHook
 }:

@ -33,12 +33,16 @@ stdenv.mkDerivation rec {

  buildInputs = [
    gtk3
-    libportal
+    libportal-gtk3
  ];

  postPatch = ''
    chmod +x meson_install.sh # patchShebangs requires executable file
    patchShebangs meson_install.sh
+
+    # https://gitlab.gnome.org/World/gcolor3/merge_requests/151
+    substituteInPlace meson.build --replace "dependency(${"\n"}  'libportal'" "dependency(${"\n"}  'libportal-gtk3'"
+    substituteInPlace src/gcolor3-color-selection.c --replace "libportal/portal-gtk3.h" "libportal-gtk3/portal-gtk3.h"
  '';

  meta = with lib; {
--- a/third_party/nixpkgs/pkgs/applications/graphics/graphicsmagick/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/graphics/graphicsmagick/default.nix
@ -4,11 +4,11 @@

 stdenv.mkDerivation rec {
  pname = "graphicsmagick";
-  version = "1.3.36";
+  version = "1.3.37";

  src = fetchurl {
    url = "mirror://sourceforge/graphicsmagick/GraphicsMagick-${version}.tar.xz";
-    sha256 = "0ilg6fkppb4avzais1dvi3qf6ln7v3mzj7gjm83w7pwwfpg3ynsx";
+    sha256 = "sha256-kNwi8ae9JA5MkGWpQJYr8T2kPJm8w2yxEcw8Gg10d9Q=";
  };

  patches = [
--- a/third_party/nixpkgs/pkgs/applications/kde/kamoso.nix
+++ b/third_party/nixpkgs/pkgs/applications/kde/kamoso.nix
@ -34,7 +34,7 @@ mkDerivation {
  ];

  qtWrapperArgs = [
-    "--prefix GST_PLUGIN_PATH : ${lib.makeSearchPath "lib/gstreamer-1.0" gst}"
+    "--prefix GST_PLUGIN_PATH : ${lib.makeSearchPathOutput "lib" "lib/gstreamer-1.0" gst}"
  ];

  meta = {
--- a/third_party/nixpkgs/pkgs/applications/misc/iptsd/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/iptsd/default.nix
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
      --replace "install_dir: rulesdir" "install_dir: datadir" \
  '';
  mesonFlags = [
-    "-Dsystemd=true"
+    "-Dservice_manager=systemd"
    "-Dsample_config=false"
    "-Ddebug_tool=false"
  ];
--- a/third_party/nixpkgs/pkgs/applications/misc/metadata-cleaner/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/metadata-cleaner/default.nix
@ -9,7 +9,7 @@
 , itstool
 , libadwaita
 , librsvg
-, meson_0_60
+, meson
 , ninja
 , pkg-config
 , poppler_gi
@ -18,7 +18,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "metadata-cleaner";
-  version = "2.1.3";
+  version = "2.1.4";

  format = "other";

@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "rmnvgr";
    repo = "metadata-cleaner";
    rev = "v${version}";
-    hash = "sha256-9sLjgqqQBXcudlBRmqAwWcWMUXoIUyAK272zaNKbJNY=";
+    hash = "sha256-46J0iLXzZX5tww4CK8WhrADql023rauO0fpW7Asn5ZY=";
  };

  nativeBuildInputs = [
@ -35,7 +35,7 @@ python3.pkgs.buildPythonApplication rec {
    glib
    gtk4
    itstool
-    meson_0_60
+    meson
    ninja
    pkg-config
    wrapGAppsHook
--- a/third_party/nixpkgs/pkgs/applications/misc/mob/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/mob/default.nix
@ -9,13 +9,13 @@

 buildGoPackage rec {
  pname = "mob";
-  version = "2.2.0";
+  version = "2.2.1";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "remotemobprogramming";
    repo = pname;
-    sha256 = "sha256-nf0FSaUi8qX1f4Luo0cP4ZLoOKbyvgmpilMOWXbzzIM=";
+    sha256 = "sha256-1yE3KFGY51m6OL4LYrz+BSCHQSnbQRSpB3EUqAzSr+M=";
  };

  nativeBuildInputs = [
--- a/third_party/nixpkgs/pkgs/applications/misc/notejot/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/notejot/default.nix
@ -17,21 +17,27 @@

 stdenv.mkDerivation rec {
  pname = "notejot";
-  version = "3.2.0";
+  version = "3.3.3"; # make sure to recheck src.rev

  src = fetchFromGitHub {
    owner = "lainsce";
    repo = pname;
-    rev = version;
-    hash = "sha256-WyW1tGhO3+OykNa8BRavi93cBMOSBJw0M+0bwQHJOjU=";
+    # Note from Fedora spec file:
+    # https://src.fedoraproject.org/rpms/notejot/blob/bbe621cef4d5a2c27eed029063b8e8cfd7c8d400/f/notejot.spec
+    # Upstream confusingly made several bugfix post-releases of version 3.3.3,
+    # tagged as 3.4.x, but with prominent notices like "This is still 3.3.3". We
+    # respect upstream’s wishes (and the version numbers inside the source tarball)
+    # by packaging these releases as 3.3.3 with appropriate snapshot info.
+    # https://github.com/lainsce/notejot/releases/tag/3.4.9
+    #
+    # Note that sometimes upstream don't update their version in meson.build
+    # (https://github.com/lainsce/notejot/issues/236), always follow the version
+    # from Fedora Rawhide.
+    # https://github.com/lainsce/notejot/blob/3.4.9/meson.build#L1
+    rev = "3.4.9";
+    hash = "sha256-42k9CAnXAb7Ic580SIa95MDCkCWtso1F+0eD69HX8WI=";
  };

-  patches = [
-    # build: use gtk4-update-icon-cache
-    # https://github.com/lainsce/notejot/pull/307
-    ./use-gtk4-update-icon-cache.patch
-  ];
-
  nativeBuildInputs = [
    meson
    ninja
--- a/third_party/nixpkgs/pkgs/applications/misc/notejot/use-gtk4-update-icon-cache.patch
+++ b/third_party/nixpkgs/pkgs/applications/misc/notejot/use-gtk4-update-icon-cache.patch
@ -1,20 +0,0 @@
-diff --git a/build-aux/post_install.py b/build-aux/post_install.py
-index 1278304..fface6d 100644
--- a/build-aux/post_install.py
-+++ b/build-aux/post_install.py
-@@ -2,11 +2,13 @@
- import os
- import subprocess
- 
-schemadir = os.path.join(os.environ['MESON_INSTALL_PREFIX'], 'share', 'glib-2.0', 'schemas')
-+install_prefix = os.environ['MESON_INSTALL_PREFIX']
-+icondir = os.path.join(install_prefix, 'share', 'icons', 'hicolor')
-+schemadir = os.path.join(install_prefix, 'share', 'glib-2.0', 'schemas')
- 
- if not os.environ.get('DESTDIR'):
-     print('Compiling gsettings schemas…')
-     subprocess.call(['glib-compile-schemas', schemadir], shell=False)
- 
-     print('Rebuilding desktop icons cache...')
-    subprocess.call(['gtk-update-icon-cache', '/usr/share/icons/hicolor/'], shell=False)
-+    subprocess.call(['gtk4-update-icon-cache', '-qtf', icondir], shell=False)
--- a/third_party/nixpkgs/pkgs/applications/misc/nwg-wrapper/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/nwg-wrapper/default.nix
@ -2,13 +2,13 @@

 python3Packages.buildPythonPackage rec {
  pname = "nwg-wrapper";
-  version = "0.1.0";
+  version = "0.1.2";

  src = fetchFromGitHub {
    owner = "nwg-piotr";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0xkxyfbj8zljx7k5wbniz3x9jg0l4jnbbjv8hy5y5p4l10m0vpjs";
+    sha256 = "114y55mv2rgnp75a3c7rk46v5v84d1zqb6wkha7x16ab6xa9phzl";
  };

  nativeBuildInputs = [ gobject-introspection wrapGAppsHook ];
--- a/third_party/nixpkgs/pkgs/applications/misc/qt-video-wlr/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/qt-video-wlr/default.nix
@ -1,6 +1,6 @@
 { stdenv, lib, fetchFromGitHub, pkg-config, meson, ninja, wayland, pixman, cairo, librsvg, wayland-protocols, wlroots, libxkbcommon, gst_all_1, wrapQtAppsHook, qtbase, qtmultimedia }:
 let
- gstreamerPath = with gst_all_1; lib.makeSearchPath "lib/gstreamer-1.0" [
+ gstreamerPath = with gst_all_1; lib.makeSearchPathOutput "lib" "lib/gstreamer-1.0" [
     gstreamer
     gst-plugins-base
     gst-plugins-good
--- a/third_party/nixpkgs/pkgs/applications/networking/blocky/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/blocky/default.nix
@ -0,0 +1,30 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+}:
+
+buildGoModule rec {
+  pname = "blocky";
+  version = "0.17";
+
+  src = fetchFromGitHub {
+    owner = "0xERR0R";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-vG6QAI8gBI2nLRQ0nOFWQHihyzgmJu69rgkWlg3iW3E=";
+  };
+
+  # needs network connection and fails at
+  # https://github.com/0xERR0R/blocky/blob/development/resolver/upstream_resolver_test.go
+  doCheck = false;
+
+  vendorSha256 = "sha256-+mpNPDejK9Trhw41SUXJPL/OX5wQR0QfA2+BXSlE0Jk=";
+
+  meta = with lib; {
+    description = "Fast and lightweight DNS proxy as ad-blocker for local network with many features.";
+    homepage = "https://0xerr0r.github.io/blocky";
+    changelog = "https://github.com/0xERR0R/blocky/releases";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ ratsclub ];
+  };
+}
--- a/third_party/nixpkgs/pkgs/applications/networking/browsers/nyxt/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/browsers/nyxt/default.nix
@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
    xclip notify-osd enchant
  ] ++ gstBuildInputs;

-  GST_PLUGIN_SYSTEM_PATH_1_0 = lib.concatMapStringsSep ":" (p: "${p}/lib/gstreamer-1.0") gstBuildInputs;
+  GST_PLUGIN_SYSTEM_PATH_1_0 = lib.makeSearchPathOutput "lib" "lib/gstreamer-1.0" gstBuildInputs;

  dontWrapGApps = true;
  installPhase = ''
--- a/third_party/nixpkgs/pkgs/applications/networking/cluster/istioctl/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/cluster/istioctl/default.nix
@ -2,15 +2,15 @@

 buildGoModule rec {
  pname = "istioctl";
-  version = "1.12.1";
+  version = "1.12.2";

  src = fetchFromGitHub {
    owner = "istio";
    repo = "istio";
    rev = version;
-    sha256 = "sha256-oMf60mxreBSlgxVInTFM8kozYVZz5RdgzV3rYUnadnA=";
+    sha256 = "sha256-6eVFyGVvOUr5RA5jeavKcLJedv4jOGXAg3aa4N3cNx8=";
  };
-  vendorSha256 = "sha256-e8qh8J745TXUo6c1uMS8GyawEG9YFlMYl/nHpWIFK1Q=";
+  vendorSha256 = "sha256-ie7XRu+2+NmhMNtJEL2OgZH6wuTPJX9O2+cZBnI04JA=";

  doCheck = false;

--- a/third_party/nixpkgs/pkgs/applications/networking/cluster/lens/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/cluster/lens/default.nix
@ -1,4 +1,4 @@
-{ lib, fetchurl, appimageTools }:
+{ lib, fetchurl, appimageTools, wrapGAppsHook, gsettings-desktop-schemas, gtk3 }:

 let
  pname = "lens";
@ -19,6 +19,10 @@ let
 in appimageTools.wrapType2 {
  inherit name src;

+  profile = ''
+    export XDG_DATA_DIRS=${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_DATA_DIRS
+  '';
+
  extraInstallCommands =
    ''
      mv $out/bin/${name} $out/bin/${pname}
--- a/third_party/nixpkgs/pkgs/applications/networking/cluster/minikube/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/cluster/minikube/default.nix
@ -11,9 +11,9 @@

 buildGoModule rec {
  pname = "minikube";
-  version = "1.24.0";
+  version = "1.25.1";

-  vendorSha256 = "sha256-jFE4aHHgVmVcQu8eH97h9P3zchtmKv/KUIfv7f2ws3I=";
+  vendorSha256 = "sha256-MnyXePsnhb1Tl76uAtVW/DLacE0etXREGsapgNiZbMo=";

  doCheck = false;

@ -21,7 +21,7 @@ buildGoModule rec {
    owner = "kubernetes";
    repo = "minikube";
    rev = "v${version}";
-    sha256 = "sha256-WW5VVjm7cq/3/RGiIE2nn8O+VK0RHCtKkrlboIzhqC4=";
+    sha256 = "sha256-pRNOVN9u27im9fkUawJYjuGHTW0N7L5oJa3fQ6DUO+4=";
  };

  nativeBuildInputs = [ installShellFiles pkg-config which ];
--- a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/kdeltachat/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/kdeltachat/default.nix
@ -14,13 +14,13 @@

 mkDerivation rec {
  pname = "kdeltachat";
-  version = "unstable-2021-12-26";
+  version = "unstable-2022-01-02";

  src = fetchFromSourcehut {
    owner = "~link2xt";
    repo = "kdeltachat";
-    rev = "aabe9421cb26f8e2537d49df5392e428bca8d72d";
-    hash = "sha256-5ql4KGMie9EbhHbPSNHIUQrvNpO//WgpTDIK6ETwdkg=";
+    rev = "ec545c8208c870c44312558f91c79e6ffce4444e";
+    hash = "sha256-s/dJ2ahdUK7ODKsna+tl81e+VQLkCAELb/iEXf9WlIM=";
  };

  nativeBuildInputs = [
--- a/third_party/nixpkgs/pkgs/applications/networking/irc/hexchat/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/irc/hexchat/default.nix
@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
    done
  '';

-  mesonFlags = [ "-Dwith-lua=lua" "-Dwith-text=true" ];
+  mesonFlags = [ "-Dwith-lua=lua" "-Dtext-frontend=true" ];

  postInstall = ''
    wrapProgram $out/bin/hexchat --prefix PYTHONPATH : "$PYTHONPATH"
--- a/third_party/nixpkgs/pkgs/applications/networking/irc/wraith/configure.patch
+++ b/third_party/nixpkgs/pkgs/applications/networking/irc/wraith/configure.patch
@ -1,8 +1,8 @@
 --- a/configure
 +++ b/configure
-@@ -6029,53 +6029,8 @@
+@@ -6143,53 +6143,8 @@ rm -f confcache
+ #AC_CHECK_HEADERS(openssl/ssl.h openssl/crypto.h)
 #AC_CHECK_HEADERS(zlib.h)
- #EGG_CHECK_ZLIB
 
 -{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for path to OpenSSL" >&5
 -$as_echo_n "checking for path to OpenSSL... " >&6; }
--- a/third_party/nixpkgs/pkgs/applications/networking/irc/wraith/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/irc/wraith/default.nix
@ -2,10 +2,10 @@

 stdenv.mkDerivation rec {
  pname = "wraith";
-  version = "1.4.7";
+  version = "1.4.10";
  src = fetchurl {
    url = "mirror://sourceforge/wraithbotpack/wraith-v${version}.tar.gz";
-    sha256 = "0h6liac5y7im0jfm2sj18mibvib7d1l727fjs82irsjj1v9kif3j";
+    sha256 = "1h8159g6wh1hi69cnhqkgwwwa95fa6z1zrzjl219mynbf6vjjzkw";
  };
  hardeningDisable = [ "format" ];
  buildInputs = [ openssl ];
--- a/third_party/nixpkgs/pkgs/applications/networking/irc/wraith/dlopen.patch
+++ b/third_party/nixpkgs/pkgs/applications/networking/irc/wraith/dlopen.patch
@ -1,15 +1,15 @@
 diff --git a/src/libcrypto.cc b/src/libcrypto.cc
-index 0339258..68746c8 100644
+index 5139f66..517103f 100644
 --- a/src/libcrypto.cc
 +++ b/src/libcrypto.cc
-@@ -95,17 +95,9 @@ int load_libcrypto() {
+@@ -100,17 +100,9 @@ int load_libcrypto() {
   }
 
   sdprintf("Loading libcrypto");
 +  dlerror(); // Clear Errors
 +  libcrypto_handle = dlopen("@openssl@/lib/libcrypto.so", RTLD_LAZY|RTLD_GLOBAL);
 
-  bd::Array<bd::String> libs_list(bd::String("libcrypto.so." SHLIB_VERSION_NUMBER " libcrypto.so libcrypto.so.0.9.8 libcrypto.so.7 libcrypto.so.6").split(' '));
+-  bd::Array<bd::String> libs_list(bd::String("libcrypto.so." SHLIB_VERSION_NUMBER " libcrypto.so libcrypto.so.1.1 libcrypto.so.1.0.0 libcrypto.so.0.9.8 libcrypto.so.10 libcrypto.so.9 libcrypto.so.8 libcrypto.so.7 libcrypto.so.6").split(' '));
 -
 -  for (size_t i = 0; i < libs_list.length(); ++i) {
 -    dlerror(); // Clear Errors
@ -23,17 +23,17 @@ index 0339258..68746c8 100644
     fprintf(stderr, STR("Unable to find libcrypto\n"));
     return(1);
 diff --git a/src/libssl.cc b/src/libssl.cc
-index b432c7b..8940998 100644
+index 6010abc..86e29fc 100644
 --- a/src/libssl.cc
 +++ b/src/libssl.cc
-@@ -68,17 +68,9 @@ int load_libssl() {
+@@ -78,17 +78,9 @@ int load_libssl() {
   }
 
   sdprintf("Loading libssl");
 +  dlerror(); // Clear Errors
 +  libssl_handle = dlopen("@openssl@/lib/libssl.so", RTLD_LAZY);
 
-  bd::Array<bd::String> libs_list(bd::String("libssl.so." SHLIB_VERSION_NUMBER " libssl.so libssl.so.0.9.8 libssl.so.7 libssl.so.6").split(' '));
+-  bd::Array<bd::String> libs_list(bd::String("libssl.so." SHLIB_VERSION_NUMBER " libssl.so libssl.so.1.1 libssl.so.1.0.0 libssl.so.0.9.8 libssl.so.10 libssl.so.9 libssl.so.8 libssl.so.7 libssl.so.6").split(' '));
 -
 -  for (size_t i = 0; i < libs_list.length(); ++i) {
 -    dlerror(); // Clear Errors
--- a/third_party/nixpkgs/pkgs/applications/networking/mailreaders/alot/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/mailreaders/alot/default.nix
@ -1,16 +1,29 @@
-{ lib, python3, fetchFromGitHub, file, gnupg, gawk, notmuch, procps, withManpage ? false
+{ lib
+, python3
+, fetchFromGitHub
+, file
+, gnupg
+, gawk
+, notmuch
+, procps
+, withManpage ? false
 }:

 with python3.pkgs;
-
 let
  notmuch2 = callPackage ./notmuch.nix {
    inherit notmuch;
  };
-in buildPythonApplication rec {
+in
+buildPythonApplication rec {
  pname = "alot";
  version = "0.10";
-  outputs = [ "out" ] ++ lib.optional withManpage "man";
+
+  outputs = [
+    "out"
+  ] ++ lib.optional withManpage [
+    "man"
+  ];

  disabled = !isPy3k;

@ -22,48 +35,63 @@ in buildPythonApplication rec {
  };

  postPatch = ''
-    substituteInPlace alot/settings/manager.py --replace /usr/share "$out/share"
+    substituteInPlace alot/settings/manager.py \
+      --replace /usr/share "$out/share"
  '';

  nativeBuildInputs = lib.optional withManpage sphinx;

  propagatedBuildInputs = [
-    notmuch2
-    urwid
-    urwidtrees
-    twisted
-    python_magic
    configobj
-    service-identity
    file
    gpgme
+    notmuch2
+    python_magic
+    service-identity
+    twisted
+    urwid
+    urwidtrees
  ];

-  postBuild = lib.optionalString withManpage "make -C docs man";
+  checkInputs = [
+    future
+    gawk
+    gnupg
+    mock
+    procps
+    pytestCheckHook
+  ];
+
+  postBuild = lib.optionalString withManpage [
+    "make -C docs man"
+  ];

-  checkInputs = [ gawk future mock gnupg procps pytestCheckHook ];
-  # some twisted tests need internet access
  disabledTests = [
+    # Some twisted tests need internet access
    "test_env_set"
    "test_no_spawn_no_stdin_attached"
+    # DatabaseLockedError
+    "test_save_named_query"
  ];

-  postInstall = let
-    completionPython = python.withPackages (ps: [ ps.configobj ]);
-  in lib.optionalString withManpage ''
-    mkdir -p $out/man
-    cp -r docs/build/man $out/man
-  ''
-  + ''
-    mkdir -p $out/share/{applications,alot}
-    cp -r extra/themes $out/share/alot
+  postInstall =
+    let
+      completionPython = python.withPackages (ps: [ ps.configobj ]);
+    in
+    lib.optionalString withManpage ''
+      mkdir -p $out/man
+      cp -r docs/build/man $out/man
+    ''
+    + ''
+      mkdir -p $out/share/{applications,alot}
+      cp -r extra/themes $out/share/alot

-    substituteInPlace extra/completion/alot-completion.zsh \
-      --replace "python3" "${completionPython.interpreter}"
-    install -D extra/completion/alot-completion.zsh $out/share/zsh/site-functions/_alot
+      substituteInPlace extra/completion/alot-completion.zsh \
+        --replace "python3" "${completionPython.interpreter}"
+      install -D extra/completion/alot-completion.zsh $out/share/zsh/site-functions/_alot

-    sed "s,/usr/bin,$out/bin,g" extra/alot.desktop > $out/share/applications/alot.desktop
-  '';
+      sed "s,/usr/bin,$out/bin,g" extra/alot.desktop > $out/share/applications/alot.desktop
+    '';

  meta = with lib; {
    homepage = "https://github.com/pazz/alot";
--- a/third_party/nixpkgs/pkgs/applications/networking/vnstat/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/vnstat/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "vnstat";
-  version = "2.8";
+  version = "2.9";

  src = fetchFromGitHub {
    owner = "vergoh";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-r+dmsL3bPgCDdBje7uzg+ArhMkqj+R/hepNLMDqe350=";
+    sha256 = "sha256-AEpq3Pn/WUiPDxYk6WKb1Uur5tD+OBfFAzLUDWnZH/0=";
  };

  postPatch = ''
--- a/third_party/nixpkgs/pkgs/applications/office/gtg/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/office/gtg/default.nix
@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, fetchpatch
 , meson
 , python3Packages
 , ninja
@ -25,6 +26,13 @@ python3Packages.buildPythonApplication rec {
    sha256 = "0b2slm7kjq6q8c7v4m7aqc8m1ynjxn3bl7445srpv1xc0dilq403";
  };

+  patches = [
+    # fix build with meson 0.60 (https://github.com/getting-things-gnome/gtg/pull/729)
+    (fetchpatch {
+      url = "https://github.com/getting-things-gnome/gtg/commit/1809d10663ae3d8f69c04138b66f9b4e66ee14f6.patch";
+      sha256 = "sha256-bYr5PAsuvcSqTf0vaJj2APtuBrwHdhXJxtXoAb7CfGk=";
+    })
+  ];

  nativeBuildInputs = [
    meson
--- a/third_party/nixpkgs/pkgs/applications/science/logic/coq/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/logic/coq/default.nix
@ -46,7 +46,7 @@ let
   "8.13.2".sha256     = "1884vbmwmqwn9ngibax6dhnqh4cc02l0s2ajc6jb1xgr0i60whjk";
   "8.14.0".sha256     = "04y2z0qyvag66zanfyc3f9agvmzbn4lsr0p1l7ck6yjhqx7vbm17";
   "8.14.1".sha256     = "0sx78pgx0qw8v7v2r32zzy3l161zipzq95iacda628girim7psnl";
-   "8.15+rc1".sha256   = "sha256:0v9vnx5z2mbsmhdx08rpg0n8jn0d82mimpghn55vkwsscxmcrgnm";
+   "8.15.0".sha256     = "sha256:1ma76wfrpfsl72yh10w1ys2a0vi0mdc2jc79kdc8nrmxkhpw1nxx";
  };
  releaseRev = v: "V${v}";
  fetched = import ../../../../build-support/coq/meta-fetch/default.nix
--- a/third_party/nixpkgs/pkgs/applications/science/logic/tamarin-prover/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/logic/tamarin-prover/default.nix
@ -79,6 +79,8 @@ mkDerivation (common "tamarin-prover" src // {
    # so that the package can be used as a vim plugin to install syntax coloration
    install -Dt $out/share/vim-plugins/tamarin-prover/syntax/ etc/syntax/spthy.vim
    install etc/filetype.vim -D $out/share/vim-plugins/tamarin-prover/ftdetect/tamarin.vim
+    # Emacs SPTHY major mode
+    install -Dt $out/share/emacs/site-lisp etc/spthy-mode.el
  '';

  checkPhase = "./dist/build/tamarin-prover/tamarin-prover test";
--- a/third_party/nixpkgs/pkgs/applications/science/misc/cwltool/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/misc/cwltool/default.nix
@ -7,14 +7,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "cwltool";
-  version = "3.1.20220119140128";
+  version = "3.1.20220124184855";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "common-workflow-language";
    repo = pname;
    rev = version;
-    sha256 = "1jmrm0qrqgka79avc1kq63fgh20gx6g07fc8p3iih4k85vhdyl3f";
+    sha256 = "0b0mxminfijbi3d9sslhwhs8awnagdsx8d2wh9x9ipdpwipihpmb";
  };

  postPatch = ''
--- a/third_party/nixpkgs/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix
@ -2,6 +2,7 @@
 , libX11, libXt, libXft, libXrender
 , ncurses, fontconfig, freetype
 , pkg-config, gdk-pixbuf, perl
+, libptytty
 , perlSupport      ? true
 , gdkPixbufSupport ? true
 , unicode3Support  ? true
@ -9,7 +10,7 @@

 let
  pname = "rxvt-unicode";
-  version = "9.26";
+  version = "9.30";
  description = "A clone of the well-known terminal emulator rxvt";

  desktopItem = makeDesktopItem {
@ -31,12 +32,13 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "http://dist.schmorp.de/rxvt-unicode/Attic/rxvt-unicode-${version}.tar.bz2";
-    sha256 = "12y9p32q0v7n7rhjla0j2g9d5rj2dmwk20c9yhlssaaxlawiccb4";
+    sha256 = "0badnkjsn3zps24r5iggj8k5v4f00npc77wqg92pcn1q5z8r677y";
  };

  buildInputs =
    [ libX11 libXt libXft ncurses  # required to build the terminfo file
      fontconfig freetype pkg-config libXrender
+      libptytty
    ] ++ optional perlSupport perl
      ++ optional gdkPixbufSupport gdk-pixbuf;

--- a/third_party/nixpkgs/pkgs/applications/version-management/commitizen/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/commitizen/default.nix
@ -0,0 +1,49 @@
+{ buildPythonApplication
+, lib
+, fetchFromGitHub
+, poetry
+, termcolor
+, questionary
+, colorama
+, decli
+, tomlkit
+, jinja2
+, pyyaml
+, argcomplete
+, typing-extensions
+}:
+
+buildPythonApplication rec {
+  pname = "commitizen";
+  version = "2.20.3";
+
+  src = fetchFromGitHub {
+    owner = "commitizen-tools";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-rAm2GTRxZIHQmn/FM0IwwH/2h+oOvzGmeVr5xkvD/zA=";
+  };
+
+  format = "pyproject";
+
+  nativeBuildInputs = [ poetry ];
+
+  propagatedBuildInputs = [
+    termcolor
+    questionary
+    colorama
+    decli
+    tomlkit
+    jinja2
+    pyyaml
+    argcomplete
+    typing-extensions
+  ];
+
+  meta = with lib; {
+    description = "Tool to create committing rules for projects, auto bump versions, and generate changelogs";
+    homepage = "https://github.com/commitizen-tools/commitizen";
+    license = licenses.mit;
+    maintainers = with maintainers; [ lovesegfault ];
+  };
+}
--- a/third_party/nixpkgs/pkgs/applications/version-management/git-lfs/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/git-lfs/default.nix
@ -19,6 +19,12 @@ buildGoPackage rec {

  subPackages = [ "." ];

+  preBuild = ''
+    pushd go/src/github.com/git-lfs/git-lfs
+      go generate ./commands
+    popd
+  '';
+
  postBuild = ''
    make -C go/src/${goPackagePath} man
  '';
--- a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/data.json
+++ b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/data.json
@ -1,14 +1,14 @@
 {
-  "version": "14.6.3",
-  "repo_hash": "sha256-M8A6ZF1t+N48OTBhVwvOweITmavrl9+Z1Yqw4lxLk38=",
-  "yarn_hash": "1kcjbf8xn3bwac2s9i2i7dpgbkwcjh09wvgbgysm5yffpdswg6nl",
+  "version": "14.7.0",
+  "repo_hash": "0jam4krhwkbri99642vz4gjlnr7zfgd6mq7pgjyf00f6pggvhq79",
+  "yarn_hash": "1cv3lxfw4i9snlw5x6bcip1n97wg72v5zpz9mjxdpzd2i1bwp6da",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v14.6.3-ee",
+  "rev": "v14.7.0-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "14.6.3",
-    "GITLAB_PAGES_VERSION": "1.49.0",
-    "GITLAB_SHELL_VERSION": "13.22.1",
-    "GITLAB_WORKHORSE_VERSION": "14.6.3"
+    "GITALY_SERVER_VERSION": "14.7.0",
+    "GITLAB_PAGES_VERSION": "1.51.0",
+    "GITLAB_SHELL_VERSION": "13.22.2",
+    "GITLAB_WORKHORSE_VERSION": "14.7.0"
  }
 }
--- a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/default.nix
@ -22,12 +22,6 @@ let
    gemset =
      let x = import (gemdir + "/gemset.nix");
      in x // {
-        # grpc expects the AR environment variable to contain `ar rpc`. See the
-        # discussion in nixpkgs #63056.
-        grpc = x.grpc // {
-          patches = [ ./fix-grpc-ar.patch ];
-          dontBuild = false;
-        };
        # the openssl needs the openssl include files
        openssl = x.openssl // {
          buildInputs = [ openssl ];
--- a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/fix-grpc-ar.patch
+++ b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/fix-grpc-ar.patch
@ -1,10 +0,0 @@
--- a/src/ruby/ext/grpc/extconf.rb
-+++ b/src/ruby/ext/grpc/extconf.rb
-@@ -27,6 +27,7 @@ ENV['MACOSX_DEPLOYMENT_TARGET'] = '10.7'
- if ENV['AR'].nil? || ENV['AR'].size == 0
-     ENV['AR'] = RbConfig::CONFIG['AR'] + ' rcs'
- end
-+ENV['AR'] = ENV['AR'] + ' rcs'
- if ENV['CC'].nil? || ENV['CC'].size == 0
-     ENV['CC'] = RbConfig::CONFIG['CC']
- end
--- a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitaly/Gemfile
+++ b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitaly/Gemfile
@ -3,11 +3,11 @@ source 'https://rubygems.org'
 gem 'rugged', '~> 1.2'
 gem 'github-linguist', '~> 7.12', require: 'linguist'
 gem 'gitlab-markup', '~> 1.7.1'
-gem 'activesupport', '~> 6.1.4.1'
+gem 'activesupport', '~> 6.1.4.4'
 gem 'rdoc', '~> 6.0'
-gem 'gitlab-gollum-lib', '~> 4.2.7.10.gitlab.1', require: false
+gem 'gitlab-gollum-lib', '~> 4.2.7.10.gitlab.2', require: false
 gem 'gitlab-gollum-rugged_adapter', '~> 0.4.4.4.gitlab.1', require: false
-gem 'grpc', '~> 1.30.2'
+gem 'grpc', '~> 1.42.0' # keep in lock-step with grpc-tools
 gem 'sentry-raven', '~> 3.0', require: false
 gem 'faraday', '~> 1.0'
 gem 'rbtrace', require: false
@ -19,7 +19,7 @@ gem 'gitlab-labkit', '~> 0.21.1'
 # This version needs to be in sync with GitLab CE/EE
 gem 'licensee', '~> 9.14.1'

-gem 'google-protobuf', '~> 3.17.0'
+gem 'google-protobuf', '~> 3.19.0'

 group :development, :test do
  gem 'rubocop', '~> 0.69', require: false
@ -29,7 +29,7 @@ group :development, :test do
  gem 'factory_bot', require: false
  gem 'pry', '~> 0.12.2', require: false

-  gem 'grpc-tools', '= 1.30.2'
+  gem 'grpc-tools', '~> 1.42.0'
 end

 # Gems required in omnibus-gitlab pipeline
--- a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
+++ b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
@ -2,20 +2,20 @@ GEM
  remote: https://rubygems.org/
  specs:
    abstract_type (0.0.7)
-    actionpack (6.1.4.1)
-      actionview (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    actionpack (6.1.4.4)
+      actionview (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
      rack (~> 2.0, >= 2.0.9)
      rack-test (>= 0.6.3)
      rails-dom-testing (~> 2.0)
      rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actionview (6.1.4.1)
-      activesupport (= 6.1.4.1)
+    actionview (6.1.4.4)
+      activesupport (= 6.1.4.4)
      builder (~> 3.1)
      erubi (~> 1.4)
      rails-dom-testing (~> 2.0)
      rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activesupport (6.1.4.1)
+    activesupport (6.1.4.4)
      concurrent-ruby (~> 1.0, >= 1.0.2)
      i18n (>= 1.6, < 2)
      minitest (>= 5.1)
@ -54,13 +54,13 @@ GEM
      mini_mime (~> 1.0)
      rugged (>= 0.25.1)
    github-markup (1.7.0)
-    gitlab-gollum-lib (4.2.7.10.gitlab.1)
+    gitlab-gollum-lib (4.2.7.10.gitlab.2)
      gemojione (~> 3.2)
      github-markup (~> 1.6)
-      gitlab-gollum-rugged_adapter (~> 0.4.4.3.gitlab.1)
+      gitlab-gollum-rugged_adapter (~> 0.4.4.4.gitlab.1)
      nokogiri (>= 1.6.1, < 2.0)
      rouge (~> 3.1)
-      sanitize (~> 4.6.4)
+      sanitize (~> 6.0)
      stringex (~> 2.6)
    gitlab-gollum-rugged_adapter (0.4.4.4.gitlab.1)
      mime-types (>= 1.15)
@ -81,27 +81,27 @@ GEM
      with_env (= 1.1.0)
      xml-simple (~> 1.1.5)
    gitlab-markup (1.7.1)
-    google-protobuf (3.17.3)
-    googleapis-common-protos-types (1.1.0)
+    google-protobuf (3.19.1)
+    googleapis-common-protos-types (1.3.0)
      google-protobuf (~> 3.14)
-    grpc (1.30.2)
-      google-protobuf (~> 3.12)
+    grpc (1.42.0)
+      google-protobuf (~> 3.18)
      googleapis-common-protos-types (~> 1.0)
-    grpc-tools (1.30.2)
-    i18n (1.8.10)
+    grpc-tools (1.42.0)
+    i18n (1.8.11)
      concurrent-ruby (~> 1.0)
    ice_nine (0.11.2)
    jaeger-client (1.1.0)
      opentracing (~> 0.3)
      thrift
-    json (2.5.1)
+    json (2.6.1)
    licensee (9.14.1)
      dotenv (~> 2.0)
      octokit (~> 4.17)
      reverse_markdown (~> 1.0)
      rugged (>= 0.24, < 2.0)
      thor (>= 0.19, < 2.0)
-    loofah (2.12.0)
+    loofah (2.13.0)
      crass (~> 1.0.2)
      nokogiri (>= 1.5.9)
    memoizable (0.4.2)
@ -111,15 +111,13 @@ GEM
      mime-types-data (~> 3.2015)
    mime-types-data (3.2020.1104)
    mini_mime (1.0.2)
-    mini_portile2 (2.5.1)
-    minitest (5.14.4)
+    mini_portile2 (2.6.1)
+    minitest (5.15.0)
    msgpack (1.3.3)
    multipart-post (2.1.1)
-    nokogiri (1.11.7)
-      mini_portile2 (~> 2.5.0)
+    nokogiri (1.12.5)
+      mini_portile2 (~> 2.6.1)
      racc (~> 1.4)
-    nokogumbo (1.5.0)
-      nokogiri
    octokit (4.20.0)
      faraday (>= 0.9)
      sawyer (~> 0.8.0, >= 0.5.3)
@ -139,7 +137,7 @@ GEM
      coderay (~> 1.1.0)
      method_source (~> 0.9.0)
    public_suffix (4.0.6)
-    racc (1.5.2)
+    racc (1.6.0)
    rack (2.2.3)
    rack-test (1.1.0)
      rack (>= 1.0, < 3)
@ -158,8 +156,8 @@ GEM
    regexp_parser (1.8.1)
    reverse_markdown (1.4.0)
      nokogiri
-    rexml (3.2.4)
-    rouge (3.26.0)
+    rexml (3.2.5)
+    rouge (3.27.0)
    rspec (3.8.0)
      rspec-core (~> 3.8.0)
      rspec-expectations (~> 3.8.0)
@ -193,10 +191,9 @@ GEM
    ruby-progressbar (1.10.1)
    rubyzip (2.3.2)
    rugged (1.2.0)
-    sanitize (4.6.6)
+    sanitize (6.0.0)
      crass (~> 1.0.2)
-      nokogiri (>= 1.4.4)
-      nokogumbo (~> 1.4)
+      nokogiri (>= 1.12.0)
    sawyer (0.8.2)
      addressable (>= 2.3.5)
      faraday (> 0.8, < 2.0)
@ -222,24 +219,24 @@ GEM
    with_env (1.1.0)
    xml-simple (1.1.9)
      rexml
-    zeitwerk (2.4.2)
+    zeitwerk (2.5.3)

 PLATFORMS
  ruby

 DEPENDENCIES
-  activesupport (~> 6.1.4.1)
+  activesupport (~> 6.1.4.4)
  factory_bot
  faraday (~> 1.0)
  github-linguist (~> 7.12)
-  gitlab-gollum-lib (~> 4.2.7.10.gitlab.1)
+  gitlab-gollum-lib (~> 4.2.7.10.gitlab.2)
  gitlab-gollum-rugged_adapter (~> 0.4.4.4.gitlab.1)
  gitlab-labkit (~> 0.21.1)
  gitlab-license_finder
  gitlab-markup (~> 1.7.1)
-  google-protobuf (~> 3.17.0)
-  grpc (~> 1.30.2)
-  grpc-tools (= 1.30.2)
+  google-protobuf (~> 3.19.0)
+  grpc (~> 1.42.0)
+  grpc-tools (~> 1.42.0)
  licensee (~> 9.14.1)
  pry (~> 0.12.2)
  rbtrace
--- a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitaly/default.nix
@ -21,19 +21,9 @@ let
    inherit ruby;
    copyGemFiles = true;
    gemdir = ./.;
-    gemset =
-      let x = import (gemdir + "/gemset.nix");
-      in x // {
-        # grpc expects the AR environment variable to contain `ar rpc`. See the
-        # discussion in nixpkgs #63056.
-        grpc = x.grpc // {
-          patches = [ ../fix-grpc-ar.patch ];
-          dontBuild = false;
-        };
-      };
  };

-  version = "14.6.3";
+  version = "14.7.0";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/v${lib.versions.major version}";
 in

@ -45,10 +35,10 @@ buildGoModule {
    owner = "gitlab-org";
    repo = "gitaly";
    rev = "v${version}";
-    sha256 = "sha256-b4gNIYMtwsV2qv3mjKYDnCCGGmQseoqaTGN7k9mR1B8=";
+    sha256 = "sha256-hOtdeJSjZLGcPCZpu42lGtCtQoLE0/AQqfQWLUJ6Hf8=";
  };

-  vendorSha256 = "sha256-ZLd4E3+e25Hqmd6ZyF3X6BveMEg7OF0FX9IvNBWn3v0=";
+  vendorSha256 = "sha256-eapqtSstc7d3R7A/5krKV0uVr9GhGkHHMrmsBOpWAbo=";

  passthru = {
    inherit rubyEnv;
--- a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
@ -13,10 +13,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0xgysqnibjsy6kdz10x2xb3kwa6lssiqhh0zggrbgs31ypwhlpia";
+      sha256 = "171ida68hrk21cq1zz1kfl9h94a3qw5p3afviqzsirl0kx6qjyv9";
      type = "gem";
    };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
  };
  actionview = {
    dependencies = ["activesupport" "builder" "erubi" "rails-dom-testing" "rails-html-sanitizer"];
@ -24,10 +24,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1yf4ic5kl324rs0raralpwx24s6hvvdzxfhinafylf8f3x7jj23z";
+      sha256 = "1lm2pf35p6q4ff78z175h6ihmzfg2j7ssn41374rb9iy9gpiiidm";
      type = "gem";
    };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
  };
  activesupport = {
    dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo" "zeitwerk"];
@ -35,10 +35,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "19gx1jcq46x9d1pi1w8xq0bgvvfw239y4lalr8asm291gj3q3ds4";
+      sha256 = "0rvnz9lsf9mrkpji748sf51f54m027snkw6rm8flyvf7fq18rm98";
      type = "gem";
    };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
  };
  adamantium = {
    dependencies = ["ice_nine" "memoizable"];
@ -247,10 +247,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0r6smbqnh0m84fxwb2g11qjfbcsljfin4vhnf43nmmbql2l1i3ah";
+      sha256 = "1vs6frgnhhfnyicsjck39xibmn7xc6ji7wvznvfmr53f4smqjk40";
      type = "gem";
    };
-    version = "4.2.7.10.gitlab.1";
+    version = "4.2.7.10.gitlab.2";
  };
  gitlab-gollum-rugged_adapter = {
    dependencies = ["mime-types" "rugged"];
@ -300,10 +300,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0vmll4nnkha3vsqj1g76pwni6x7mp2i81pka4wdwq8qfhn210108";
+      sha256 = "1dwx4ns39bpmzmhglyip9d68i117zspf5lp865pf6hrsmmdf2k53";
      type = "gem";
    };
-    version = "3.17.3";
+    version = "3.19.1";
  };
  googleapis-common-protos-types = {
    dependencies = ["google-protobuf"];
@ -311,10 +311,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1949w1lcd3iyiy4n6zgnrhdp78k9khbh2pbkrpkv263bbpmw8llg";
+      sha256 = "0w860lqs5j6n58a8qn4wr16hp0qz7cq5h67dgma04gncjwqiyhf5";
      type = "gem";
    };
-    version = "1.1.0";
+    version = "1.3.0";
  };
  grpc = {
    dependencies = ["google-protobuf" "googleapis-common-protos-types"];
@ -322,20 +322,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1rsglf7ag17n465iff7vlw83pn2rpl4kv9sb1rpf17nx6xpi7yl5";
+      sha256 = "0jjq2ing7px4zvdrg9xcq5a9qsciq6g3v14n95a3d9n6cyg69lmk";
      type = "gem";
    };
-    version = "1.30.2";
+    version = "1.42.0";
  };
  grpc-tools = {
    groups = ["development" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0k9zhsqhamp02ryzgfb4y2bbick151vlhrhj0kqbbz9lyhms0bd4";
+      sha256 = "0xipvw8zcm1c3pna6fgmy83x0yvffii8d7wafwcxmszxa647brw1";
      type = "gem";
    };
-    version = "1.30.2";
+    version = "1.42.0";
  };
  i18n = {
    dependencies = ["concurrent-ruby"];
@ -343,10 +343,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0g2fnag935zn2ggm5cn6k4s4xvv53v2givj1j90szmvavlpya96a";
+      sha256 = "0vdd1kii40qhbr9n8qx71k2gskq6rkl8ygy8hw5hfj8bb5a364xf";
      type = "gem";
    };
-    version = "1.8.10";
+    version = "1.8.11";
  };
  ice_nine = {
    source = {
@ -372,10 +372,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0lrirj0gw420kw71bjjlqkqhqbrplla61gbv1jzgsz6bv90qr3ci";
+      sha256 = "1z9grvjyfz16ag55hg522d3q4dh07hf391sf9s96npc0vfi85xkz";
      type = "gem";
    };
-    version = "2.5.1";
+    version = "2.6.1";
  };
  licensee = {
    dependencies = ["dotenv" "octokit" "reverse_markdown" "rugged" "thor"];
@ -394,10 +394,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1nqcya57x2n58y1dify60i0dpla40n4yir928khp4nj5jrn9mgmw";
+      sha256 = "17rvbrqcci1579d7dpbsfmz1f9g7msk82lyh9ip5h29dkrnixcgg";
      type = "gem";
    };
-    version = "2.12.0";
+    version = "2.13.0";
  };
  memoizable = {
    dependencies = ["thread_safe"];
@ -452,20 +452,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0xg1x4708a4pn2wk8qs2d8kfzzdyv9kjjachg2f1phsx62ap2rx2";
+      sha256 = "1lvxm91hi0pabnkkg47wh1siv56s6slm2mdq1idfm86dyfidfprq";
      type = "gem";
    };
-    version = "2.5.1";
+    version = "2.6.1";
  };
  minitest = {
    groups = ["default" "development" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "19z7wkhg59y8abginfrm2wzplz7py3va8fyngiigngqvsws6cwgl";
+      sha256 = "06xf558gid4w8lwx13jwfdafsch9maz8m0g85wnfymqj63x5nbbd";
      type = "gem";
    };
-    version = "5.14.4";
+    version = "5.15.0";
  };
  msgpack = {
    groups = ["default"];
@ -493,19 +493,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1vrn31385ix5k9b0yalnlzv360isv6dincbcvi8psllnwz4sjxj9";
+      sha256 = "1v02g7k7cxiwdcahvlxrmizn3avj2q6nsjccgilq1idc89cr081b";
      type = "gem";
    };
-    version = "1.11.7";
-  };
-  nokogumbo = {
-    dependencies = ["nokogiri"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "09qc1c7acv9qm48vk2kzvnrq4ij8jrql1cv33nmv2nwmlggy0jyj";
-      type = "gem";
-    };
-    version = "1.5.0";
+    version = "1.12.5";
  };
  octokit = {
    dependencies = ["faraday" "sawyer"];
@ -611,10 +602,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "178k7r0xn689spviqzhvazzvxfq6fyjldxb3ywjbgipbfi4s8j1g";
+      sha256 = "0la56m0z26j3mfn1a9lf2l03qx1xifanndf9p3vx1azf6sqy7v9d";
      type = "gem";
    };
-    version = "1.5.2";
+    version = "1.6.0";
  };
  rack = {
    groups = ["default"];
@ -720,24 +711,24 @@
    version = "1.4.0";
  };
  rexml = {
-    groups = ["default" "development" "test"];
+    groups = ["default" "development" "omnibus" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1mkvkcw9fhpaizrhca0pdgjcrbns48rlz4g6lavl5gjjq3rk2sq3";
+      sha256 = "08ximcyfjy94pm1rhcx04ny1vx2sk0x4y185gzn86yfsbzwkng53";
      type = "gem";
    };
-    version = "3.2.4";
+    version = "3.2.5";
  };
  rouge = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0b4b300i3m4m4kw7w1n9wgxwy16zccnb7271miksyzd0wq5b9pm3";
+      sha256 = "0530ri0p60km0bg0ib6swkhfnas427cva7vcdmnwl8df52a10y1k";
      type = "gem";
    };
-    version = "3.26.0";
+    version = "3.27.0";
  };
  rspec = {
    dependencies = ["rspec-core" "rspec-expectations" "rspec-mocks"];
@ -857,13 +848,15 @@
    version = "1.2.0";
  };
  sanitize = {
-    dependencies = ["crass" "nokogiri" "nokogumbo"];
+    dependencies = ["crass" "nokogiri"];
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0j4j2a2mkk1a70vbx959pvx0gvr1zb9snjwvsppwj28bp0p0b2bv";
+      sha256 = "1zq8pxmsd1abw18zz6mazsm2jfpwmbgdxbpawb7bmwvkb2c5yyc1";
      type = "gem";
    };
-    version = "4.6.6";
+    version = "6.0.0";
  };
  sawyer = {
    dependencies = ["addressable" "faraday"];
@ -1001,9 +994,9 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1746czsjarixq0x05f7p3hpzi38ldg6wxnxxw74kbjzh1sdjgmpl";
+      sha256 = "0lmg9x683gr9mkrbq9df2m0zb0650mdfxqna0bs10js44inv7znx";
      type = "gem";
    };
-    version = "2.4.2";
+    version = "2.5.3";
  };
 }
--- a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
@ -2,12 +2,12 @@

 buildGoModule rec {
  pname = "gitlab-shell";
-  version = "13.22.1";
+  version = "13.22.2";
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-shell";
    rev = "v${version}";
-    sha256 = "sha256-uqdKiBZ290mG0JNi17EjimfES6bN3q1hF6LXs3URTZ8=";
+    sha256 = "sha256-jAH/MKmCIybLXsypHehQJaKf+mK9ko5XqWoDH/XKE5w=";
  };

  buildInputs = [ ruby ];
--- a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@ -5,7 +5,7 @@ in
 buildGoModule rec {
  pname = "gitlab-workhorse";

-  version = "14.6.3";
+  version = "14.7.0";

  src = fetchFromGitLab {
    owner = data.owner;
--- a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@ -2,7 +2,7 @@

 source 'https://rubygems.org'

-gem 'rails', '~> 6.1.4.1'
+gem 'rails', '~> 6.1.4.4'

 gem 'bootsnap', '~> 1.9.1', require: false

@ -50,7 +50,7 @@ gem 'omniauth-shibboleth', '~> 1.3.0'
 gem 'omniauth-twitter', '~> 1.4'
 gem 'omniauth_crowd', '~> 2.4.0'
 gem 'omniauth-authentiq', '~> 0.3.3'
-gem 'gitlab-omniauth-openid-connect', '~> 0.8.0', require: 'omniauth_openid_connect'
+gem 'gitlab-omniauth-openid-connect', '~> 0.9.0', require: 'omniauth_openid_connect'
 gem 'omniauth-salesforce', '~> 1.0.5'
 gem 'omniauth-atlassian-oauth2', '~> 0.2.0'
 gem 'rack-oauth2', '~> 1.16.0'
@ -74,7 +74,7 @@ gem 'u2f', '~> 0.2.1'
 gem 'validates_hostname', '~> 1.0.11'
 gem 'rubyzip', '~> 2.0.0', require: 'zip'
 # GitLab Pages letsencrypt support
-gem 'acme-client', '~> 2.0', '>= 2.0.6'
+gem 'acme-client', '~> 2.0', '>= 2.0.9'

 # Browser detection
 gem 'browser', '~> 4.2'
@ -98,10 +98,7 @@ gem 'rack-cors', '~> 1.0.6', require: 'rack/cors'

 # GraphQL API
 gem 'graphql', '~> 1.11.10'
-# NOTE: graphiql-rails v1.5+ doesn't work: https://gitlab.com/gitlab-org/gitlab/issues/31771
-# TODO: remove app/views/graphiql/rails/editors/show.html.erb when https://github.com/rmosolgo/graphiql-rails/pull/71 is released:
-# https://gitlab.com/gitlab-org/gitlab/issues/31747
-gem 'graphiql-rails', '~> 1.4.10'
+gem 'graphiql-rails', '~> 1.8'
 gem 'apollo_upload_server', '~> 2.1.0'
 gem 'graphql-docs', '~> 1.6.0', group: [:development, :test]
 gem 'graphlient', '~> 0.4.0' # Used by BulkImport feature (group::import)
@ -149,6 +146,7 @@ gem 'aws-sdk-core', '~> 3'
 gem 'aws-sdk-cloudformation', '~> 1'
 gem 'aws-sdk-s3', '~> 1'
 gem 'faraday_middleware-aws-sigv4', '~>0.3.0'
+gem 'typhoeus', '~> 1.4.0' # Used with Elasticsearch to support http keep-alive connections

 # Markdown and HTML processing
 gem 'html-pipeline', '~> 2.13.2'
@ -166,10 +164,10 @@ gem 'asciidoctor', '~> 2.0.10'
 gem 'asciidoctor-include-ext', '~> 0.3.1', require: false
 gem 'asciidoctor-plantuml', '~> 0.0.12'
 gem 'asciidoctor-kroki', '~> 0.5.0', require: false
-gem 'rouge', '~> 3.26.1'
+gem 'rouge', '~> 3.27.0'
 gem 'truncato', '~> 0.7.11'
 gem 'bootstrap_form', '~> 4.2.0'
-gem 'nokogiri', '~> 1.11.4'
+gem 'nokogiri', '~> 1.12'
 gem 'escape_utils', '~> 1.1'

 # Calendar rendering
@ -193,12 +191,12 @@ end
 # State machine
 gem 'state_machines-activerecord', '~> 0.8.0'

-# Issue tags
-gem 'acts-as-taggable-on', '~> 8.1'
+# CI domain tags
+gem 'acts-as-taggable-on', '~> 9.0'

 # Background jobs
 gem 'sidekiq', '~> 6.3'
-gem 'sidekiq-cron', '~> 1.0'
+gem 'sidekiq-cron', '~> 1.2'
 gem 'redis-namespace', '~> 1.8.1'
 gem 'gitlab-sidekiq-fetcher', '0.8.0', require: 'sidekiq-reliable-fetch'

@ -263,7 +261,7 @@ gem 'ruby-fogbugz', '~> 0.2.1'
 gem 'kubeclient', '~> 4.9.2'

 # Sanitize user input
-gem 'sanitize', '~> 5.2.1'
+gem 'sanitize', '~> 6.0'
 gem 'babosa', '~> 1.0.4'

 # Sanitizes SVG input
@ -276,7 +274,7 @@ gem 'licensee', '~> 9.14.1'
 gem 'charlock_holmes', '~> 0.7.7'

 # Detect mime content type from content
-gem 'ruby-magic', '~> 0.4'
+gem 'ruby-magic', '~> 0.5'

 # Faster blank
 gem 'fast_blank'
@ -312,7 +310,7 @@ gem 'pg_query', '~> 2.1'
 gem 'premailer-rails', '~> 1.10.3'

 # LabKit: Tracing and Correlation
-gem 'gitlab-labkit', '~> 0.21.1'
+gem 'gitlab-labkit', '~> 0.21.3'
 # Thrift is a dependency of gitlab-labkit, we want a version higher than 0.14.0
 # because of https://gitlab.com/gitlab-org/gitlab/-/issues/321900
 gem 'thrift', '>= 0.14.0'
@ -394,8 +392,6 @@ group :development, :test do

  gem 'parallel', '~> 1.19', require: false

-  gem 'rblineprof', '~> 0.3.6', platform: :mri, require: false
-
  gem 'test_file_finder', '~> 0.1.3'
 end

@ -443,7 +439,8 @@ end

 gem 'octokit', '~> 4.15'

-# https://gitlab.com/gitlab-org/gitlab/issues/207207
+# Updating this gem version here is deprecated. See:
+# https://docs.gitlab.com/ee/development/emails.html#mailroom-gem-updates
 gem 'gitlab-mail_room', '~> 0.0.9', require: 'mail_room'

 gem 'email_reply_trimmer', '~> 0.1'
@ -483,14 +480,14 @@ end
 gem 'spamcheck', '~> 0.1.0'

 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 14.4.0.pre.rc43'
+gem 'gitaly', '~> 14.6.0.pre.rc1'

 # KAS GRPC protocol definitions
 gem 'kas-grpc', '~> 0.0.2'

-gem 'grpc', '~> 1.30.2'
+gem 'grpc', '~> 1.42.0'

-gem 'google-protobuf', '~> 3.17.1'
+gem 'google-protobuf', '~> 3.19.0'

 gem 'toml-rb', '~> 2.0'

--- a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@ -2,72 +2,72 @@ GEM
  remote: https://rubygems.org/
  specs:
    RedCloth (4.3.2)
-    acme-client (2.0.6)
+    acme-client (2.0.9)
      faraday (>= 0.17, < 2.0.0)
-    actioncable (6.1.4.1)
-      actionpack (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    actioncable (6.1.4.4)
+      actionpack (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
      nio4r (~> 2.0)
      websocket-driver (>= 0.6.1)
-    actionmailbox (6.1.4.1)
-      actionpack (= 6.1.4.1)
-      activejob (= 6.1.4.1)
-      activerecord (= 6.1.4.1)
-      activestorage (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    actionmailbox (6.1.4.4)
+      actionpack (= 6.1.4.4)
+      activejob (= 6.1.4.4)
+      activerecord (= 6.1.4.4)
+      activestorage (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
      mail (>= 2.7.1)
-    actionmailer (6.1.4.1)
-      actionpack (= 6.1.4.1)
-      actionview (= 6.1.4.1)
-      activejob (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    actionmailer (6.1.4.4)
+      actionpack (= 6.1.4.4)
+      actionview (= 6.1.4.4)
+      activejob (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
      mail (~> 2.5, >= 2.5.4)
      rails-dom-testing (~> 2.0)
-    actionpack (6.1.4.1)
-      actionview (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    actionpack (6.1.4.4)
+      actionview (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
      rack (~> 2.0, >= 2.0.9)
      rack-test (>= 0.6.3)
      rails-dom-testing (~> 2.0)
      rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actiontext (6.1.4.1)
-      actionpack (= 6.1.4.1)
-      activerecord (= 6.1.4.1)
-      activestorage (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    actiontext (6.1.4.4)
+      actionpack (= 6.1.4.4)
+      activerecord (= 6.1.4.4)
+      activestorage (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
      nokogiri (>= 1.8.5)
-    actionview (6.1.4.1)
-      activesupport (= 6.1.4.1)
+    actionview (6.1.4.4)
+      activesupport (= 6.1.4.4)
      builder (~> 3.1)
      erubi (~> 1.4)
      rails-dom-testing (~> 2.0)
      rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activejob (6.1.4.1)
-      activesupport (= 6.1.4.1)
+    activejob (6.1.4.4)
+      activesupport (= 6.1.4.4)
      globalid (>= 0.3.6)
-    activemodel (6.1.4.1)
-      activesupport (= 6.1.4.1)
-    activerecord (6.1.4.1)
-      activemodel (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    activemodel (6.1.4.4)
+      activesupport (= 6.1.4.4)
+    activerecord (6.1.4.4)
+      activemodel (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
    activerecord-explain-analyze (0.1.0)
      activerecord (>= 4)
      pg
-    activestorage (6.1.4.1)
-      actionpack (= 6.1.4.1)
-      activejob (= 6.1.4.1)
-      activerecord (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    activestorage (6.1.4.4)
+      actionpack (= 6.1.4.4)
+      activejob (= 6.1.4.4)
+      activerecord (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
      marcel (~> 1.0.0)
      mini_mime (>= 1.1.0)
-    activesupport (6.1.4.1)
+    activesupport (6.1.4.4)
      concurrent-ruby (~> 1.0, >= 1.0.2)
      i18n (>= 1.6, < 2)
      minitest (>= 5.1)
      tzinfo (~> 2.0)
      zeitwerk (~> 2.3)
-    acts-as-taggable-on (8.1.0)
-      activerecord (>= 5.0, < 6.2)
+    acts-as-taggable-on (9.0.0)
+      activerecord (>= 6.0, < 7.1)
    addressable (2.8.0)
      public_suffix (>= 2.0.2, < 5.0)
    aes_key_wrap (1.1.0)
@ -117,14 +117,14 @@ GEM
      aws-sigv4 (~> 1.1)
    aws-sigv4 (1.2.1)
      aws-eventstream (~> 1, >= 1.0.2)
-    azure-storage-blob (2.0.1)
+    azure-storage-blob (2.0.3)
      azure-storage-common (~> 2.0)
-      nokogiri (~> 1.11.0.rc2)
-    azure-storage-common (2.0.2)
+      nokogiri (~> 1, >= 1.10.8)
+    azure-storage-common (2.0.4)
      faraday (~> 1.0)
-      faraday_middleware (~> 1.0.0.rc1)
+      faraday_middleware (~> 1.0, >= 1.0.0.rc1)
      net-http-persistent (~> 4.0)
-      nokogiri (~> 1.11.0.rc2)
+      nokogiri (~> 1, >= 1.10.8)
    babosa (1.0.4)
    backport (1.2.0)
    base32 (0.3.2)
@ -232,7 +232,6 @@ GEM
      danger
      gitlab (~> 4.2, >= 4.2.0)
    database_cleaner (1.7.0)
-    debugger-ruby_core_source (1.3.8)
    deckar01-task_list (2.3.1)
      html-pipeline
    declarative (0.0.20)
@ -326,8 +325,10 @@ GEM
    escape_utils (1.2.1)
    et-orbi (1.2.1)
      tzinfo
+    ethon (0.15.0)
+      ffi (>= 1.15.0)
    eventmachine (1.2.7)
-    excon (0.71.1)
+    excon (0.90.0)
    execjs (2.8.1)
    expression_parser (0.9.0)
    extended-markdown-filter (0.6.0)
@ -443,7 +444,7 @@ GEM
      rails (>= 3.2.0)
    git (1.7.0)
      rchardet (~> 1.8)
-    gitaly (14.4.0.pre.rc43)
+    gitaly (14.6.0.pre.rc1)
      grpc (~> 1.0)
    github-markup (1.7.0)
    gitlab (4.16.1)
@ -465,10 +466,10 @@ GEM
      fog-json (~> 1.2.0)
      mime-types
      ms_rest_azure (~> 0.12.0)
-    gitlab-labkit (0.21.1)
+    gitlab-labkit (0.21.3)
      actionpack (>= 5.0.0, < 7.0.0)
      activesupport (>= 5.0.0, < 7.0.0)
-      grpc (~> 1.30.2)
+      grpc (>= 1.37)
      jaeger-client (~> 1.1)
      opentracing (~> 0.4)
      pg_query (~> 2.1)
@ -484,7 +485,7 @@ GEM
    gitlab-mail_room (0.0.9)
    gitlab-markup (1.8.0)
    gitlab-net-dns (0.9.1)
-    gitlab-omniauth-openid-connect (0.8.0)
+    gitlab-omniauth-openid-connect (0.9.1)
      addressable (~> 2.7)
      omniauth (~> 1.9)
      openid_connect (~> 1.2)
@ -504,7 +505,7 @@ GEM
      omniauth (~> 1.3)
      pyu-ruby-sasl (>= 0.0.3.3, < 0.1)
      rubyntlm (~> 0.5)
-    globalid (0.5.2)
+    globalid (1.0.0)
      activesupport (>= 5.0)
    gon (6.4.0)
      actionpack (>= 3.0.20)
@ -522,8 +523,8 @@ GEM
      signet (~> 0.12)
    google-cloud-env (1.5.0)
      faraday (>= 0.17.3, < 2.0)
-    google-protobuf (3.17.3)
-    googleapis-common-protos-types (1.1.0)
+    google-protobuf (3.19.1)
+    googleapis-common-protos-types (1.3.0)
      google-protobuf (~> 3.14)
    googleauth (0.14.0)
      faraday (>= 0.17.3, < 2.0)
@ -552,7 +553,7 @@ GEM
    grape_logging (1.8.3)
      grape
      rack
-    graphiql-rails (1.4.10)
+    graphiql-rails (1.8.0)
      railties
      sprockets-rails
    graphlient (0.4.0)
@ -571,8 +572,8 @@ GEM
      graphql (~> 1.6)
      html-pipeline (~> 2.8)
      sass (~> 3.4)
-    grpc (1.30.2)
-      google-protobuf (~> 3.12)
+    grpc (1.42.0)
+      google-protobuf (~> 3.18)
      googleapis-common-protos-types (~> 1.0)
    gssapi (1.2.0)
      ffi (>= 1.0.1)
@ -732,7 +733,7 @@ GEM
    lumberjack (1.2.7)
    mail (2.7.1)
      mini_mime (>= 0.1.1)
-    marcel (1.0.1)
+    marcel (1.0.2)
    marginalia (1.10.0)
      actionpack (>= 2.3)
      activerecord (>= 2.3)
@ -745,7 +746,7 @@ GEM
    mini_histogram (0.3.1)
    mini_magick (4.10.1)
    mini_mime (1.1.1)
-    mini_portile2 (2.5.3)
+    mini_portile2 (2.6.1)
    minitest (5.11.3)
    mixlib-cli (2.1.8)
    mixlib-config (3.0.9)
@ -783,11 +784,9 @@ GEM
    netrc (0.11.0)
    nio4r (2.5.8)
    no_proxy_fix (0.1.2)
-    nokogiri (1.11.7)
-      mini_portile2 (~> 2.5.0)
+    nokogiri (1.12.5)
+      mini_portile2 (~> 2.6.1)
      racc (~> 1.4)
-    nokogumbo (2.0.2)
-      nokogiri (~> 1.8, >= 1.8.4)
    notiffany (0.1.3)
      nenv (~> 0.1)
      shellany (~> 0.0)
@ -880,7 +879,7 @@ GEM
      nokogiri (>= 1.4.4)
      omniauth (~> 1.0)
    open4 (1.3.4)
-    openid_connect (1.2.0)
+    openid_connect (1.3.0)
      activemodel
      attr_required (>= 1.0.0)
      json-jwt (>= 1.5.0)
@ -945,7 +944,7 @@ GEM
      puma (>= 2.7)
    pyu-ruby-sasl (0.0.3.3)
    raabro (1.1.6)
-    racc (1.5.2)
+    racc (1.6.0)
    rack (2.2.3)
    rack-accept (0.4.5)
      rack (>= 0.4)
@ -964,20 +963,20 @@ GEM
    rack-test (1.1.0)
      rack (>= 1.0, < 3)
    rack-timeout (0.5.2)
-    rails (6.1.4.1)
-      actioncable (= 6.1.4.1)
-      actionmailbox (= 6.1.4.1)
-      actionmailer (= 6.1.4.1)
-      actionpack (= 6.1.4.1)
-      actiontext (= 6.1.4.1)
-      actionview (= 6.1.4.1)
-      activejob (= 6.1.4.1)
-      activemodel (= 6.1.4.1)
-      activerecord (= 6.1.4.1)
-      activestorage (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    rails (6.1.4.4)
+      actioncable (= 6.1.4.4)
+      actionmailbox (= 6.1.4.4)
+      actionmailer (= 6.1.4.4)
+      actionpack (= 6.1.4.4)
+      actiontext (= 6.1.4.4)
+      actionview (= 6.1.4.4)
+      activejob (= 6.1.4.4)
+      activemodel (= 6.1.4.4)
+      activerecord (= 6.1.4.4)
+      activestorage (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
      bundler (>= 1.15.0)
-      railties (= 6.1.4.1)
+      railties (= 6.1.4.4)
      sprockets-rails (>= 2.0.0)
    rails-controller-testing (1.0.5)
      actionpack (>= 5.0.1.rc1)
@ -991,9 +990,9 @@ GEM
    rails-i18n (6.0.0)
      i18n (>= 0.7, < 2)
      railties (>= 6.0.0, < 7)
-    railties (6.1.4.1)
-      actionpack (= 6.1.4.1)
-      activesupport (= 6.1.4.1)
+    railties (6.1.4.4)
+      actionpack (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
      method_source
      rake (>= 0.13)
      thor (~> 1.0)
@ -1002,8 +1001,6 @@ GEM
    rb-fsevent (0.10.4)
    rb-inotify (0.10.1)
      ffi (~> 1.0)
-    rblineprof (0.3.6)
-      debugger-ruby_core_source (~> 1.3)
    rbtrace (0.4.14)
      ffi (>= 1.0.6)
      msgpack (>= 0.4.3)
@ -1049,7 +1046,7 @@ GEM
    rexml (3.2.5)
    rinku (2.0.0)
    rotp (6.2.0)
-    rouge (3.26.1)
+    rouge (3.27.0)
    rqrcode (0.7.0)
      chunky_png
    rqrcode-rails3 (0.1.7)
@ -1117,8 +1114,8 @@ GEM
      rubocop-ast (>= 0.7.1)
    ruby-fogbugz (0.2.1)
      crack (~> 0.4)
-    ruby-magic (0.4.0)
-      mini_portile2 (~> 2.5.0)
+    ruby-magic (0.5.3)
+      mini_portile2 (~> 2.6)
    ruby-prof (1.3.1)
    ruby-progressbar (1.11.0)
    ruby-saml (1.13.0)
@ -1135,10 +1132,9 @@ GEM
    safe_yaml (1.0.4)
    safety_net_attestation (0.4.0)
      jwt (~> 2.0)
-    sanitize (5.2.1)
+    sanitize (6.0.0)
      crass (~> 1.0.2)
-      nokogiri (>= 1.8.0)
-      nokogumbo (~> 2.0)
+      nokogiri (>= 1.12.0)
    sass (3.5.5)
      sass-listen (~> 4.0.0)
    sass-listen (4.0.0)
@ -1177,7 +1173,7 @@ GEM
      connection_pool (>= 2.2.2)
      rack (~> 2.0)
      redis (>= 4.2.0)
-    sidekiq-cron (1.0.4)
+    sidekiq-cron (1.2.0)
      fugit (~> 1.1)
      sidekiq (>= 4.2.1)
    signet (0.14.0)
@ -1244,7 +1240,7 @@ GEM
      unicode-display_width (>= 1.5, < 3.0)
      unicode_utils (~> 1.4)
    strings-ansi (0.2.0)
-    swd (1.2.0)
+    swd (1.3.0)
      activesupport (>= 3)
      attr_required (>= 0.0.5)
      httpclient (>= 2.4)
@ -1304,6 +1300,8 @@ GEM
      tty-screen (~> 0.8)
      wisper (~> 2.0)
    tty-screen (0.8.1)
+    typhoeus (1.4.0)
+      ethon (>= 0.9.0)
    tzinfo (2.0.4)
      concurrent-ruby (~> 1.0)
    u2f (0.2.1)
@ -1351,7 +1349,7 @@ GEM
      safety_net_attestation (~> 0.4.0)
      securecompare (~> 1.0)
      tpm-key_attestation (~> 0.9.0)
-    webfinger (1.1.0)
+    webfinger (1.2.0)
      activesupport
      httpclient (>= 2.4)
    webmock (3.9.1)
@ -1374,16 +1372,16 @@ GEM
      nokogiri (~> 1.8)
    yajl-ruby (1.4.1)
    yard (0.9.26)
-    zeitwerk (2.5.1)
+    zeitwerk (2.5.3)

 PLATFORMS
  ruby

 DEPENDENCIES
  RedCloth (~> 4.3.2)
-  acme-client (~> 2.0, >= 2.0.6)
+  acme-client (~> 2.0, >= 2.0.9)
  activerecord-explain-analyze (~> 0.1)
-  acts-as-taggable-on (~> 8.1)
+  acts-as-taggable-on (~> 9.0)
  addressable (~> 2.8)
  akismet (~> 3.0)
  apollo_upload_server (~> 2.1.0)
@ -1465,36 +1463,36 @@ DEPENDENCIES
  gettext (~> 3.3)
  gettext_i18n_rails (~> 1.8.0)
  gettext_i18n_rails_js (~> 1.3)
-  gitaly (~> 14.4.0.pre.rc43)
+  gitaly (~> 14.6.0.pre.rc1)
  github-markup (~> 1.7.0)
  gitlab-chronic (~> 0.10.5)
  gitlab-dangerfiles (~> 2.6.1)
  gitlab-experiment (~> 0.6.5)
  gitlab-fog-azure-rm (~> 1.2.0)
-  gitlab-labkit (~> 0.21.1)
+  gitlab-labkit (~> 0.21.3)
  gitlab-license (~> 2.0)
  gitlab-license_finder (~> 6.0)
  gitlab-mail_room (~> 0.0.9)
  gitlab-markup (~> 1.8.0)
  gitlab-net-dns (~> 0.9.1)
-  gitlab-omniauth-openid-connect (~> 0.8.0)
+  gitlab-omniauth-openid-connect (~> 0.9.0)
  gitlab-sidekiq-fetcher (= 0.8.0)
  gitlab-styles (~> 6.6.0)
  gitlab_chronic_duration (~> 0.10.6.2)
  gitlab_omniauth-ldap (~> 2.1.1)
  gon (~> 6.4.0)
  google-api-client (~> 0.33)
-  google-protobuf (~> 3.17.1)
+  google-protobuf (~> 3.19.0)
  gpgme (~> 2.0.19)
  grape (~> 1.5.2)
  grape-entity (~> 0.10.0)
  grape-path-helpers (~> 1.7.0)
  grape_logging (~> 1.7)
-  graphiql-rails (~> 1.4.10)
+  graphiql-rails (~> 1.8)
  graphlient (~> 0.4.0)
  graphql (~> 1.11.10)
  graphql-docs (~> 1.6.0)
-  grpc (~> 1.30.2)
+  grpc (~> 1.42.0)
  gssapi
  guard-rspec
  haml_lint (~> 0.36.0)
@ -1537,7 +1535,7 @@ DEPENDENCIES
  net-ldap (~> 0.16.3)
  net-ntp
  net-ssh (~> 6.0)
-  nokogiri (~> 1.11.4)
+  nokogiri (~> 1.12)
  oauth2 (~> 1.4)
  octokit (~> 4.15)
  ohai (~> 16.10)
@ -1581,11 +1579,10 @@ DEPENDENCIES
  rack-oauth2 (~> 1.16.0)
  rack-proxy (~> 0.6.0)
  rack-timeout (~> 0.5.1)
-  rails (~> 6.1.4.1)
+  rails (~> 6.1.4.4)
  rails-controller-testing
  rails-i18n (~> 6.0)
  rainbow (~> 3.0)
-  rblineprof (~> 0.3.6)
  rbtrace (~> 0.4)
  rdoc (~> 6.3.2)
  re2 (~> 1.2.0)
@ -1597,7 +1594,7 @@ DEPENDENCIES
  responders (~> 3.0)
  retriable (~> 3.1.2)
  rexml (~> 3.2.5)
-  rouge (~> 3.26.1)
+  rouge (~> 3.27.0)
  rqrcode-rails3 (~> 0.1.7)
  rspec-parameterized
  rspec-rails (~> 5.0.1)
@ -1605,14 +1602,14 @@ DEPENDENCIES
  rspec_junit_formatter
  rspec_profiling (~> 0.0.6)
  ruby-fogbugz (~> 0.2.1)
-  ruby-magic (~> 0.4)
+  ruby-magic (~> 0.5)
  ruby-prof (~> 1.3.0)
  ruby-progressbar (~> 1.10)
  ruby-saml (~> 1.13.0)
  ruby_parser (~> 3.15)
  rubyzip (~> 2.0.0)
  rugged (~> 1.2)
-  sanitize (~> 5.2.1)
+  sanitize (~> 6.0)
  sassc-rails (~> 2.1.0)
  sd_notify (~> 0.1.0)
  seed-fu (~> 2.3.7)
@ -1621,7 +1618,7 @@ DEPENDENCIES
  settingslogic (~> 2.0.9)
  shoulda-matchers (~> 4.0.1)
  sidekiq (~> 6.3)
-  sidekiq-cron (~> 1.0)
+  sidekiq-cron (~> 1.2)
  simple_po_parser (~> 1.1.2)
  simplecov (~> 0.18.5)
  simplecov-cobertura (~> 1.3.1)
@ -1647,6 +1644,7 @@ DEPENDENCIES
  timecop (~> 0.9.1)
  toml-rb (~> 2.0)
  truncato (~> 0.7.11)
+  typhoeus (~> 1.4.0)
  u2f (~> 0.2.1)
  undercover (~> 0.4.4)
  unf (~> 0.1.4)
--- a/third_party/nixpkgs/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
@ -5,10 +5,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1nwkzjamvg946xh2pv82hkwxb7vqq6gakig014gflss0cwx7bbxp";
+      sha256 = "1c4g3rl1bvcb8frh5061hwaxkxglkj8i888j5gww5qapn5sp2czq";
      type = "gem";
    };
-    version = "2.0.6";
+    version = "2.0.9";
  };
  actioncable = {
    dependencies = ["actionpack" "activesupport" "nio4r" "websocket-driver"];
@ -16,10 +16,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0ilq5mniarm0zlvnkagqj9n9p73ljrhphciz02aymrpfxxxclz2x";
+      sha256 = "0z3ab9n901craqd3p1yl87kawci0vfw1xlh4d0zkj7lx8hpk10sn";
      type = "gem";
    };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
  };
  actionmailbox = {
    dependencies = ["actionpack" "activejob" "activerecord" "activestorage" "activesupport" "mail"];
@ -27,10 +27,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "16azdnjws215clb056b9mabglx4b8f61hr82hv7hm80dmn89zqq6";
+      sha256 = "0q94js7ifm0a76xcwxin98bhr8nz0zqcsqi4y7j2mfwm3hq3bh0i";
      type = "gem";
    };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
  };
  actionmailer = {
    dependencies = ["actionpack" "actionview" "activejob" "activesupport" "mail" "rails-dom-testing"];
@ -38,10 +38,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "00s07l2ac5igch1g2rpa0linmiq7mhgk6v6wxkckg8gbiqijb592";
+      sha256 = "1gncnc5xl1ff70mfnqcys2qy65201yjrkwxx0hb5hl7jlamgvz9h";
      type = "gem";
    };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
  };
  actionpack = {
    dependencies = ["actionview" "activesupport" "rack" "rack-test" "rails-dom-testing" "rails-html-sanitizer"];
@ -49,10 +49,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0xgysqnibjsy6kdz10x2xb3kwa6lssiqhh0zggrbgs31ypwhlpia";
+      sha256 = "171ida68hrk21cq1zz1kfl9h94a3qw5p3afviqzsirl0kx6qjyv9";
      type = "gem";
    };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
  };
  actiontext = {
    dependencies = ["actionpack" "activerecord" "activestorage" "activesupport" "nokogiri"];
@ -60,10 +60,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0m4fy4qqh09vnzbhx383vjdfid6fzbs49bzzg415x05nmmjkx582";
+      sha256 = "1j9591z8lsp9lx3l75699prw6rgkhhlrfaj4lh5klcdffvxzkvi3";
      type = "gem";
    };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
  };
  actionview = {
    dependencies = ["activesupport" "builder" "erubi" "rails-dom-testing" "rails-html-sanitizer"];
@ -71,10 +71,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1yf4ic5kl324rs0raralpwx24s6hvvdzxfhinafylf8f3x7jj23z";
+      sha256 = "1lm2pf35p6q4ff78z175h6ihmzfg2j7ssn41374rb9iy9gpiiidm";
      type = "gem";
    };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
  };
  activejob = {
    dependencies = ["activesupport" "globalid"];
@ -82,10 +82,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1q7c0i0kwarxgcbxk71wa9jnlg45grbxmhlrh7dk9bgcv7r7r7hn";
+      sha256 = "0sf0nfjcj1na4v6zaxz6hjglax99yznaymjzpk1fi7mk71qf5hx4";
      type = "gem";
    };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
  };
  activemodel = {
    dependencies = ["activesupport"];
@ -93,10 +93,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "16ixam4lni8b5lgx0whnax0imzh1dh10fy5r9pxs52n83yz5nbq3";
+      sha256 = "0g3qdz8dw6zkgz45jd13lwfdnm7rhgczv1pssw63g9k6qj3bkxjm";
      type = "gem";
    };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
  };
  activerecord = {
    dependencies = ["activemodel" "activesupport"];
@ -104,10 +104,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1ccgvlj767ybps3pxlaa4iw77n7wbriw2sr8754id3ngjfap08ja";
+      sha256 = "090d4wl1pq06m9mibpck0m5nm8h45fwhs3fjx27297kjmnv4gzik";
      type = "gem";
    };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
  };
  activerecord-explain-analyze = {
    dependencies = ["activerecord" "pg"];
@ -126,10 +126,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "17knzz9fvqg4x582vy0xmlgjkxfb13xyzl2rgw19qfma86hxsvvi";
+      sha256 = "0a6mmm1s8abv11ycqs6cq55kr6j89jpclkcnra9w2k47rl047vk4";
      type = "gem";
    };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
  };
  activesupport = {
    dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo" "zeitwerk"];
@ -137,10 +137,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "19gx1jcq46x9d1pi1w8xq0bgvvfw239y4lalr8asm291gj3q3ds4";
+      sha256 = "0rvnz9lsf9mrkpji748sf51f54m027snkw6rm8flyvf7fq18rm98";
      type = "gem";
    };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
  };
  acts-as-taggable-on = {
    dependencies = ["activerecord"];
@ -148,10 +148,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0kfnyix173bazjswab21bx7hmqmik71awj2kz090fsa2nv58c4mw";
+      sha256 = "11hv6pdsr0kd9bmd84sab21sbm209ck1cwqs5jqbf9g1xbh9nh2s";
      type = "gem";
    };
-    version = "8.1.0";
+    version = "9.0.0";
  };
  addressable = {
    dependencies = ["public_suffix"];
@ -413,10 +413,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "01psx005lkrfk3zm816z76fa2pv4hd8jk7hxrjyy4hbvgcqi6rfy";
+      sha256 = "0qq3knsy7nj7a0r8m19spg2bgzns9b3j5vjbs9mpg49whhc63dv1";
      type = "gem";
    };
-    version = "2.0.1";
+    version = "2.0.3";
  };
  azure-storage-common = {
    dependencies = ["faraday" "faraday_middleware" "net-http-persistent" "nokogiri"];
@ -424,10 +424,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0h5bwswc5768hblcxsschjz3y0lf9kvz3k7qqwypdhy8sr1lfxg8";
+      sha256 = "0swmsvvpmy8cdcl305p3dl2pi7m3dqjd7zywfcxmhsz0n2m4v3v0";
      type = "gem";
    };
-    version = "2.0.2";
+    version = "2.0.4";
  };
  babosa = {
    groups = ["default"];
@ -957,20 +957,6 @@
    };
    version = "1.7.0";
  };
-  debugger-ruby_core_source = {
-    groups = ["default" "development"];
-    platforms = [{
-      engine = "maglev";
-    } {
-      engine = "ruby";
-    }];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1lp5dmm8a8dpwymv6r1y6yr24wxsj0gvgb2b8i7qq9rcv414snwd";
-      type = "gem";
-    };
-    version = "1.3.8";
-  };
  deckar01-task_list = {
    dependencies = ["html-pipeline"];
    groups = ["default"];
@ -1393,6 +1379,17 @@
    };
    version = "1.2.1";
  };
+  ethon = {
+    dependencies = ["ffi"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0kd7c61f28f810fgxg480j7457nlvqarza9c2ra0zhav0dd80288";
+      type = "gem";
+    };
+    version = "0.15.0";
+  };
  eventmachine = {
    groups = ["default" "development"];
    platforms = [];
@ -1408,10 +1405,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0nn8wk7j22ly4lzdp5pnm7qsrjxbgspiyxkw70g1qf9bn6pslmxr";
+      sha256 = "1bkh80zzjpfglm14rhz116qgz0nb5gvk3ydfjpg14av5407srgh1";
      type = "gem";
    };
-    version = "0.71.1";
+    version = "0.90.0";
  };
  execjs = {
    groups = ["default"];
@ -1899,10 +1896,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "022amhic8rs09qmp3hy1zz5inxbxnrvg8j82bq4l2s8ml9hqfs3a";
+      sha256 = "175whfk08jrmvssh5lgk0zgsaksbnhv6p5fg3picknrw4v05vw85";
      type = "gem";
    };
-    version = "14.4.0.pre.rc43";
+    version = "14.6.0.pre.rc1";
  };
  github-markup = {
    groups = ["default"];
@ -1975,10 +1972,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "09xci7jw5sckagnwfjlglz4cywylrf16r83f82asnnngvxadvvmq";
+      sha256 = "05fs11wpqn801dsscs845629hbgwbgs94qhig45jmalw4h9rira4";
      type = "gem";
    };
-    version = "0.21.1";
+    version = "0.21.3";
  };
  gitlab-license = {
    groups = ["default"];
@ -2037,10 +2034,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0bzblypm1d5bxn8a15l90vx4ad099i5nhnislr7fhs2axy3ssfr1";
+      sha256 = "1nxak6q0m0nd3m5a7vp9xqww9w5fqx97viv5g6pg3q62q9binm0j";
      type = "gem";
    };
-    version = "0.8.0";
+    version = "0.9.1";
  };
  gitlab-sidekiq-fetcher = {
    dependencies = ["sidekiq"];
@ -2092,10 +2089,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0k6ww3shk3mv119xvr9m99l6ql0czq91xhd66hm8hqssb18r2lvm";
+      sha256 = "1n5yc058i8xhi1fwcp1w7mfi6xaxfmrifdb4r4hjfff33ldn8lqj";
      type = "gem";
    };
-    version = "0.5.2";
+    version = "1.0.0";
  };
  gon = {
    dependencies = ["actionpack" "i18n" "multi_json" "request_store"];
@ -2135,10 +2132,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0vmll4nnkha3vsqj1g76pwni6x7mp2i81pka4wdwq8qfhn210108";
+      sha256 = "1dwx4ns39bpmzmhglyip9d68i117zspf5lp865pf6hrsmmdf2k53";
      type = "gem";
    };
-    version = "3.17.3";
+    version = "3.19.1";
  };
  googleapis-common-protos-types = {
    dependencies = ["google-protobuf"];
@ -2146,10 +2143,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1949w1lcd3iyiy4n6zgnrhdp78k9khbh2pbkrpkv263bbpmw8llg";
+      sha256 = "0w860lqs5j6n58a8qn4wr16hp0qz7cq5h67dgma04gncjwqiyhf5";
      type = "gem";
    };
-    version = "1.1.0";
+    version = "1.3.0";
  };
  googleauth = {
    dependencies = ["faraday" "jwt" "memoist" "multi_json" "os" "signet"];
@ -2223,10 +2220,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "10q5zipwgjgaan9lfqakdkm5ry8afgkq79bkimgksn6jyyvpz6w8";
+      sha256 = "1lcf0gc88i3wk8cs71qm62ac9lrc1a8v5sd0369c5ip2ic4wbqh2";
      type = "gem";
    };
-    version = "1.4.10";
+    version = "1.8.0";
  };
  graphlient = {
    dependencies = ["faraday" "faraday_middleware" "graphql-client"];
@ -2277,10 +2274,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1rsglf7ag17n465iff7vlw83pn2rpl4kv9sb1rpf17nx6xpi7yl5";
+      sha256 = "0jjq2ing7px4zvdrg9xcq5a9qsciq6g3v14n95a3d9n6cyg69lmk";
      type = "gem";
    };
-    version = "1.30.2";
+    version = "1.42.0";
  };
  gssapi = {
    dependencies = ["ffi"];
@ -2968,10 +2965,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0bp001p687nsa4a8sp3q1iv8pfhs24w7s3avychjp64sdkg6jxq3";
+      sha256 = "0kky3yiwagsk8gfbzn3mvl2fxlh3b39v6nawzm4wpjs6xxvvc4x0";
      type = "gem";
    };
-    version = "1.0.1";
+    version = "1.0.2";
  };
  marginalia = {
    dependencies = ["actionpack" "activerecord"];
@ -3074,10 +3071,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1ad0mli9rc0f17zw4ibp24dbj1y39zkykijsjmnzl4gwpg5s0j6k";
+      sha256 = "1lvxm91hi0pabnkkg47wh1siv56s6slm2mdq1idfm86dyfidfprq";
      type = "gem";
    };
-    version = "2.5.3";
+    version = "2.6.1";
  };
  minitest = {
    groups = ["development" "test"];
@ -3333,21 +3330,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1vrn31385ix5k9b0yalnlzv360isv6dincbcvi8psllnwz4sjxj9";
+      sha256 = "1v02g7k7cxiwdcahvlxrmizn3avj2q6nsjccgilq1idc89cr081b";
      type = "gem";
    };
-    version = "1.11.7";
-  };
-  nokogumbo = {
-    dependencies = ["nokogiri"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0sxjnpjvrn10gdmfw2dimhch861lz00f28hvkkz0b1gc2rb65k9s";
-      type = "gem";
-    };
-    version = "2.0.2";
+    version = "1.12.5";
  };
  notiffany = {
    dependencies = ["nenv" "shellany"];
@ -3681,10 +3667,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1nqhgvq006h6crbp8lffw66ll46zf319c2637g4sybdclglismma";
+      sha256 = "0w474bz3s1hqhilvrddr33l2nkyikypaczp3808w0345jr88b5m7";
      type = "gem";
    };
-    version = "1.2.0";
+    version = "1.3.0";
  };
  openssl = {
    groups = ["default"];
@ -4010,10 +3996,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "178k7r0xn689spviqzhvazzvxfq6fyjldxb3ywjbgipbfi4s8j1g";
+      sha256 = "0la56m0z26j3mfn1a9lf2l03qx1xifanndf9p3vx1azf6sqy7v9d";
      type = "gem";
    };
-    version = "1.5.2";
+    version = "1.6.0";
  };
  rack = {
    groups = ["default" "development" "kerberos" "test"];
@ -4107,10 +4093,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1y59m2x8rdc581bjgyyr9dabi3vk3frqhhpbb5ldpbj622kxfpbz";
+      sha256 = "10vylypjzfp6c34zx175x7ql7h27llmjdhgjxp5bn2zmrx3lac8l";
      type = "gem";
    };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
  };
  rails-controller-testing = {
    dependencies = ["actionpack" "actionview" "activesupport"];
@ -4162,10 +4148,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1kwpm068cqys34p2g0j3l1g0cd5f3kxnsay5v7lmbd0sgarac0vy";
+      sha256 = "1nmyds2www6dmqbbd5ggq31gxxb9mwxd5llzmb3iyczssk6l7lla";
      type = "gem";
    };
-    version = "6.1.4.1";
+    version = "6.1.4.4";
  };
  rainbow = {
    groups = ["default" "development" "test"];
@ -4208,21 +4194,6 @@
    };
    version = "0.10.1";
  };
-  rblineprof = {
-    dependencies = ["debugger-ruby_core_source"];
-    groups = ["development"];
-    platforms = [{
-      engine = "maglev";
-    } {
-      engine = "ruby";
-    }];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0m58kdjgncwf0h1qry3qk5h4bg8sj0idykqqijqcrr09mxfd9yc6";
-      type = "gem";
-    };
-    version = "0.3.6";
-  };
  rbtrace = {
    dependencies = ["ffi" "msgpack" "optimist"];
    groups = ["default"];
@ -4479,10 +4450,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "197k0vskf72wxx0gzwld2jzg27bb7982xlvnzy9adlvkzp7nh8vf";
+      sha256 = "0530ri0p60km0bg0ib6swkhfnas427cva7vcdmnwl8df52a10y1k";
      type = "gem";
    };
-    version = "3.26.1";
+    version = "3.27.0";
  };
  rqrcode = {
    dependencies = ["chunky_png"];
@ -4709,10 +4680,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1mn1m682l6hv54afh1an5lh623zbllgl2aqjz2f62v892slzkq57";
+      sha256 = "192bc7a4jgqcjgsp8jzkb2f355k5shy133zbvfcrjb7rjla7n9l9";
      type = "gem";
    };
-    version = "0.4.0";
+    version = "0.5.3";
  };
  ruby-prof = {
    groups = ["default"];
@ -4838,15 +4809,15 @@
    version = "0.4.0";
  };
  sanitize = {
-    dependencies = ["crass" "nokogiri" "nokogumbo"];
+    dependencies = ["crass" "nokogiri"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "18m3zcf207gcrmghx288w3n2kpphc22lbmbc1wdx1nzcn8g2yddh";
+      sha256 = "1zq8pxmsd1abw18zz6mazsm2jfpwmbgdxbpawb7bmwvkb2c5yyc1";
      type = "gem";
    };
-    version = "5.2.1";
+    version = "6.0.0";
  };
  sass = {
    dependencies = ["sass-listen"];
@ -5034,10 +5005,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1aliswahmpxn1ib2brn4126gk97ac3zdnwr71mn8vzbr3vdd7fl0";
+      sha256 = "0hxvm42zbr27k40jvdba5v8ich2ys8q7a2wbia9sxb0mmcy8v2aj";
      type = "gem";
    };
-    version = "1.0.4";
+    version = "1.2.0";
  };
  signet = {
    dependencies = ["addressable" "faraday" "jwt" "multi_json"];
@ -5318,10 +5289,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0c5cdpykx2h4jx8q01hjhv8f0plw5r9iqm2i1m0ijiyk7dqm824w";
+      sha256 = "12b3q2sw42nnilfb51nlqdv07f31vdv2j595kd99asnkw4cjlf5w";
      type = "gem";
    };
-    version = "1.2.0";
+    version = "1.3.0";
  };
  sys-filesystem = {
    dependencies = ["ffi"];
@ -5605,6 +5576,17 @@
    };
    version = "0.8.1";
  };
+  typhoeus = {
+    dependencies = ["ethon"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1m22yrkmbj81rzhlny81j427qdvz57yk5wbcf3km0nf3bl6qiygz";
+      type = "gem";
+    };
+    version = "1.4.0";
+  };
  tzinfo = {
    dependencies = ["concurrent-ruby"];
    groups = ["default" "development" "test"];
@ -5832,10 +5814,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0m0jh8k7c0ifh2jhbn7ihqrmn5fi754wflva97zgy70hpdvxyjar";
+      sha256 = "18jj50b44a471ig7hw1ax90wxaaz40acmrf6cm7m2iyshlffy53q";
      type = "gem";
    };
-    version = "1.1.0";
+    version = "1.2.0";
  };
  webmock = {
    dependencies = ["addressable" "crack" "hashdiff"];
@ -5966,9 +5948,9 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "18l4r6layck0d80ydc692mv1lxak5xbf6w2paj1x7m2ggbggzxgj";
+      sha256 = "0lmg9x683gr9mkrbq9df2m0zb0650mdfxqna0bs10js44inv7znx";
      type = "gem";
    };
-    version = "2.5.1";
+    version = "2.5.3";
  };
 }
--- a/third_party/nixpkgs/pkgs/applications/version-management/gitless/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/gitless/default.nix
@ -1,27 +1,42 @@
-{ fetchFromGitHub, python, lib }:
+{ lib
+, fetchFromGitHub
+, python3
+}:

-with python.pkgs;
-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
  pname = "gitless";
  version = "0.8.8";
+  format = "setuptools";

  src = fetchFromGitHub {
    owner = "gitless-vcs";
-    repo = "gitless";
+    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-xo5EWtP2aN8YzP8ro3bnxZwUGUp0PHD0g8hk+Y+gExE=";
+    hash = "sha256-xo5EWtP2aN8YzP8ro3bnxZwUGUp0PHD0g8hk+Y+gExE=";
  };

-  propagatedBuildInputs = with pythonPackages; [ sh pygit2 clint ];
+  propagatedBuildInputs = with python3.pkgs; [
+    sh
+    pygit2
+    clint
+  ];
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "pygit2==0.28.2" "pygit2>=0.28.2"
+  '';

  doCheck = false;

+  pythonImportsCheck = [
+    "gitless"
+  ];
+
  meta = with lib; {
+    description = "Version control system built on top of Git";
    homepage = "https://gitless.com/";
-    description = "A version control system built on top of Git";
-    license = licenses.gpl2;
+    license = licenses.mit;
+    maintainers = with maintainers; [ cransom ];
    platforms = platforms.all;
-    maintainers = [ maintainers.cransom ];
  };
 }
-
--- a/third_party/nixpkgs/pkgs/applications/video/kooha/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/video/kooha/default.nix
@ -68,6 +68,7 @@ stdenv.mkDerivation rec {
  # Fixes https://github.com/NixOS/nixpkgs/issues/31168
  postPatch = ''
    patchShebangs build-aux/meson_post_install.py
+    substituteInPlace meson.build --replace '>= 1.0.0-alpha.1' '>= 1.0.0'
  '';

  installCheckPhase = ''
--- a/third_party/nixpkgs/pkgs/applications/video/plex-mpv-shim/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/video/plex-mpv-shim/default.nix
@ -1,4 +1,4 @@
-{ lib, buildPythonApplication, fetchFromGitHub, mpv, requests, python-mpv-jsonipc }:
+{ lib, buildPythonApplication, fetchFromGitHub, mpv, requests, python-mpv-jsonipc, pystray, tkinter }:

 buildPythonApplication rec {
  pname = "plex-mpv-shim";
@ -11,7 +11,7 @@ buildPythonApplication rec {
    sha256 = "0hgv9g17dkrh3zbsx27n80yvkgix9j2x0rgg6d3qsf7hp5j3xw4r";
  };

-  propagatedBuildInputs = [ mpv requests python-mpv-jsonipc ];
+  propagatedBuildInputs = [ mpv requests python-mpv-jsonipc pystray tkinter ];

  # does not contain tests
  doCheck = false;
--- a/third_party/nixpkgs/pkgs/applications/video/srtrelay/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/video/srtrelay/default.nix
@ -1,17 +1,17 @@
 { lib, buildGoModule, fetchFromGitHub, srt, ffmpeg }:

 buildGoModule rec {
-  pname = "srtrelay-unstable";
-  version = "2021-07-28";
+  pname = "srtrelay";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "voc";
    repo = "srtrelay";
-    rev = "c4f02ff2e9637b01a0679b29e5a76f4521eeeef3";
-    sha256 = "06zbl97bjjyv51zp27qk37ffpbh1ylm9bsr0s5qlyd73pyavcj1g";
+    rev = "v${version}";
+    sha256 = "sha256-CA+UuFOWjZjSBDWM62rda3IKO1fwC3X52mP4tg1uoO4=";
  };

-  vendorSha256 = "1pdpb0my7gdvjjkka6jhj19b9nx575k6117hg536b106ij2n4zd2";
+  vendorSha256 = "sha256-xTYlfdijSo99ei+ZMX6N9gl+yw0DrPQ2wOhn6SS9S/E=";

  buildInputs = [ srt ];
  checkInputs = [ ffmpeg ];
--- a/third_party/nixpkgs/pkgs/applications/virtualization/conmon/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/virtualization/conmon/default.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "conmon";
-  version = "2.0.32";
+  version = "2.1.0";

  src = fetchFromGitHub {
    owner = "containers";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-aj0RQVVJp2S8cIYT7fsbK1TLaK0auvdgEIgkZJktsdo=";
+    sha256 = "sha256-75Xyp25+JJtrXJO+cRFPkDj64zgdlVTAygGwFuJ7jKA=";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/third_party/nixpkgs/pkgs/applications/window-managers/qtile/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/window-managers/qtile/default.nix
@ -1,23 +1,15 @@
-{ lib, fetchFromGitHub, python3, mypy, glib, cairo, pango, pkg-config, libxcb, xcbutilcursor }:
+{ lib, fetchFromGitHub, python3, python3Packages, mypy, glib, pango, pkg-config, xcbutilcursor }:

 let
-  enabled-xcffib = cairocffi-xcffib: cairocffi-xcffib.override {
-    withXcffib = true;
-  };
-
-  # make it easier to reference python
-  python = python3;
-  pythonPackages = python.pkgs;
-
-  unwrapped = pythonPackages.buildPythonPackage rec {
+  unwrapped = python3Packages.buildPythonPackage rec {
    pname = "qtile";
-    version = "0.19.0";
+    version = "0.20.0";

    src = fetchFromGitHub {
      owner = "qtile";
      repo = "qtile";
      rev = "v${version}";
-      sha256 = "BLHGVPMQd8O4h5TVx/F/klzSra+FZYogp22V6Yq04T0=";
+      sha256 = "TRmul3t//izJRdViTvxFz29JZeGYsWc7WsJjagQ35nw=";
    };

    postPatch = ''
@ -33,13 +25,13 @@ let

    nativeBuildInputs = [
      pkg-config
-    ] ++ (with pythonPackages; [
+    ] ++ (with python3Packages; [
      setuptools-scm
    ]);

-    propagatedBuildInputs = with pythonPackages; [
+    propagatedBuildInputs = with python3Packages; [
      xcffib
-      (enabled-xcffib cairocffi)
+      (cairocffi.override { withXcffib = true; })
      setuptools
      python-dateutil
      dbus-python
@ -68,9 +60,9 @@ let
    };
  };
 in
-  (python.withPackages (ps: [ unwrapped ])).overrideAttrs (_: {
-    # otherwise will be exported as "env", this restores `nix search` behavior
-    name = "${unwrapped.pname}-${unwrapped.version}";
-    # export underlying qtile package
-    passthru = { inherit unwrapped; };
-  })
+(python3.withPackages (_: [ unwrapped ])).overrideAttrs (_: {
+  # otherwise will be exported as "env", this restores `nix search` behavior
+  name = "${unwrapped.pname}-${unwrapped.version}";
+  # export underlying qtile package
+  passthru = { inherit unwrapped; };
+})
--- a/third_party/nixpkgs/pkgs/applications/window-managers/river/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/window-managers/river/default.nix
@ -19,13 +19,13 @@

 stdenv.mkDerivation rec {
  pname = "river";
-  version = "0.1.0";
+  version = "0.1.2";

  src = fetchFromGitHub {
-    owner = "ifreund";
+    owner = "riverwm";
    repo = pname;
    rev = "v${version}";
-    sha256 = "03pdgrcpj8db9s14249815z76dyjwwma8xv6p9hpw79flk6rk7v7";
+    sha256 = "0mysj6fmgiwzrfzm1rk09k4xa9qiqsdwvwr59b4rs010c1gsllwk";
    fetchSubmodules = true;
  };

@ -55,10 +55,9 @@ stdenv.mkDerivation rec {
    runHook postInstall
  '';

-  /*
-    Builder patch install dir into river to get default config
-    When installFlags is removed, river becomes half broken.
-    See https://github.com/ifreund/river/blob/7ffa2f4b9e7abf7d152134f555373c2b63ccfc1d/river/main.zig#L56
+  /* Builder patch install dir into river to get default config
+     When installFlags is removed, river becomes half broken.
+     See https://github.com/riverwm/river/blob/7ffa2f4b9e7abf7d152134f555373c2b63ccfc1d/river/main.zig#L56
  */
  installFlags = [ "DESTDIR=$(out)" ];

--- a/third_party/nixpkgs/pkgs/applications/window-managers/sway/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/window-managers/sway/default.nix
@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, substituteAll, swaybg
-, meson_0_60, ninja, pkg-config, wayland-scanner, scdoc
+, meson, ninja, pkg-config, wayland-scanner, scdoc
 , wayland, libxkbcommon, pcre, json_c, dbus, libevdev
 , pango, cairo, libinput, libcap, pam, gdk-pixbuf, librsvg
 , wlroots, wayland-protocols, libdrm
@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
  ];

  nativeBuildInputs = [
-    meson_0_60 ninja pkg-config wayland-scanner scdoc
+    meson ninja pkg-config wayland-scanner scdoc
  ];

  buildInputs = [
--- a/third_party/nixpkgs/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
+++ b/third_party/nixpkgs/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
@ -30,7 +30,7 @@ expandResponseParams "$@"
 if [[ -n "${NIX_LINK_TYPE_@suffixSalt@:-}" ]]; then
    linkType=$NIX_LINK_TYPE_@suffixSalt@
 else
-    linkType=$(checkLinkType "$@")
+    linkType=$(checkLinkType "${params[@]}")
 fi

 if [[ "${NIX_ENFORCE_PURITY:-}" = 1 && -n "${NIX_STORE:-}"
--- a/third_party/nixpkgs/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/third_party/nixpkgs/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@ -31,7 +31,7 @@ cxxLibrary=1
 cInclude=1

 expandResponseParams "$@"
-linkType=$(checkLinkType "$@")
+linkType=$(checkLinkType "${params[@]}")

 declare -i n=0
 nParams=${#params[@]}
--- a/third_party/nixpkgs/pkgs/build-support/fetchgit/builder.sh
+++ b/third_party/nixpkgs/pkgs/build-support/fetchgit/builder.sh
@ -11,6 +11,7 @@ $SHELL $fetcher --builder --url "$url" --out "$out" --rev "$rev" \
  ${fetchLFS:+--fetch-lfs} \
  ${deepClone:+--deepClone} \
  ${fetchSubmodules:+--fetch-submodules} \
+  ${sparseCheckout:+--sparse-checkout "$sparseCheckout"} \
  ${branchName:+--branch-name "$branchName"}

 runHook postFetch
--- a/third_party/nixpkgs/pkgs/build-support/fetchgit/default.nix
+++ b/third_party/nixpkgs/pkgs/build-support/fetchgit/default.nix
@ -15,6 +15,7 @@ in
 { url, rev ? "HEAD", md5 ? "", sha256 ? "", hash ? "", leaveDotGit ? deepClone
 , fetchSubmodules ? true, deepClone ? false
 , branchName ? null
+, sparseCheckout ? ""
 , name ? urlToName url rev
 , # Shell code executed after the file has been fetched
  # successfully. This can do things like check or transform the file.
@ -74,7 +75,7 @@ stdenvNoCC.mkDerivation {
  else
    lib.fakeSha256;

-  inherit url rev leaveDotGit fetchLFS fetchSubmodules deepClone branchName postFetch;
+  inherit url rev leaveDotGit fetchLFS fetchSubmodules deepClone branchName sparseCheckout postFetch;

  postHook = if netrcPhase == null then null else ''
    ${netrcPhase}
--- a/third_party/nixpkgs/pkgs/build-support/fetchgit/nix-prefetch-git
+++ b/third_party/nixpkgs/pkgs/build-support/fetchgit/nix-prefetch-git
@ -48,6 +48,7 @@ Options:
      --rev ref       Any sha1 or references (such as refs/heads/master)
      --hash h        Expected hash.
      --branch-name   Branch name to check out into
+      --sparse-checkout Only fetch and checkout part of the repository.
      --deepClone     Clone the entire repository.
      --no-deepClone  Make a shallow clone of just the required ref.
      --leave-dotGit  Keep the .git directories.
@ -75,6 +76,7 @@ for arg; do
            --hash) argfun=set_hashType;;
            --branch-name) argfun=set_branchName;;
            --deepClone) deepClone=true;;
+            --sparse-checkout) argfun=set_sparseCheckout;;
            --quiet) QUIET=true;;
            --no-deepClone) deepClone=;;
            --leave-dotGit) leaveDotGit=true;;
@ -96,7 +98,7 @@ for arg; do
        case $argfun in
            set_*)
                var=${argfun#set_}
-                eval $var=$arg
+                eval "$var=$(printf %q "$arg")"
                ;;
        esac
        argfun=""
@ -112,6 +114,10 @@ init_remote(){
    local url=$1
    clean_git init --initial-branch=master
    clean_git remote add origin "$url"
+    if [ -n "$sparseCheckout" ]; then
+        git config remote.origin.partialclonefilter "blob:none"
+        echo "$sparseCheckout" | git sparse-checkout set --stdin
+    fi
    ( [ -n "$http_proxy" ] && clean_git config http.proxy "$http_proxy" ) || true
 }

--- a/third_party/nixpkgs/pkgs/build-support/fetchgit/tests.nix
+++ b/third_party/nixpkgs/pkgs/build-support/fetchgit/tests.nix
@ -7,4 +7,15 @@
    rev = "9d9dbe6ed05854e03811c361a3380e09183f4f4a";
    sha256 = "sha256-7DszvbCNTjpzGRmpIVAWXk20P0/XTrWZ79KSOGLrUWY=";
  };
+
+  sparseCheckout = invalidateFetcherByDrvHash fetchgit {
+    name = "nix-source";
+    url = "https://github.com/NixOS/nix";
+    rev = "9d9dbe6ed05854e03811c361a3380e09183f4f4a";
+    sparseCheckout = ''
+      src
+      tests
+    '';
+    sha256 = "sha256-FknO6C/PSnMPfhUqObD4vsW4PhkwdmPa9blNzcNvJQ4=";
+  };
 }
--- a/third_party/nixpkgs/pkgs/build-support/fetchgithub/default.nix
+++ b/third_party/nixpkgs/pkgs/build-support/fetchgithub/default.nix
@ -3,6 +3,7 @@
 { owner, repo, rev, name ? "source"
 , fetchSubmodules ? false, leaveDotGit ? null
 , deepClone ? false, private ? false, forceFetchGit ? false
+, sparseCheckout ? ""
 , githubBase ? "github.com", varPrefix ? null
 , ... # For hash agility
 }@args:
@ -10,7 +11,7 @@ let
  baseUrl = "https://${githubBase}/${owner}/${repo}";
  passthruAttrs = removeAttrs args [ "owner" "repo" "rev" "fetchSubmodules" "forceFetchGit" "private" "githubBase" "varPrefix" ];
  varBase = "NIX${if varPrefix == null then "" else "_${varPrefix}"}_GITHUB_PRIVATE_";
-  useFetchGit = fetchSubmodules || (leaveDotGit == true) || deepClone || forceFetchGit;
+  useFetchGit = fetchSubmodules || (leaveDotGit == true) || deepClone || forceFetchGit || (sparseCheckout != "");
  # We prefer fetchzip in cases we don't need submodules as the hash
  # is more stable in that case.
  fetcher = if useFetchGit then fetchgit else fetchzip;
@ -30,7 +31,7 @@ let
  };
  fetcherArgs = (if useFetchGit
    then {
-      inherit rev deepClone fetchSubmodules; url = "${baseUrl}.git";
+      inherit rev deepClone fetchSubmodules sparseCheckout; url = "${baseUrl}.git";
    } // lib.optionalAttrs (leaveDotGit != null) { inherit leaveDotGit; }
    else { url = "${baseUrl}/archive/${rev}.tar.gz"; }
  ) // privateAttrs // passthruAttrs // { inherit name; };
--- a/third_party/nixpkgs/pkgs/build-support/libredirect/default.nix
+++ b/third_party/nixpkgs/pkgs/build-support/libredirect/default.nix
@ -1,4 +1,4 @@
-{ stdenv, runCommand, lib, coreutils }:
+{ lib, stdenv, bintools-unwrapped, llvmPackages_13, coreutils }:

 if stdenv.hostPlatform.isStatic
 then throw ''
@ -25,17 +25,36 @@ else stdenv.mkDerivation rec {
    cp ${./test.c} test.c
  '';

-  libName = "libredirect" + stdenv.targetPlatform.extensions.sharedLibrary;
-
  outputs = ["out" "hook"];

+  libName = "libredirect" + stdenv.targetPlatform.extensions.sharedLibrary;
+
  buildPhase = ''
    runHook preBuild

-    $CC -Wall -std=c99 -O3 -fPIC -ldl -shared \
-      ${lib.optionalString stdenv.isDarwin "-Wl,-install_name,$out/lib/$libName"} \
-      -o "$libName" \
-      libredirect.c
+    ${if stdenv.isDarwin && stdenv.isAarch64 then ''
+    # We need the unwrapped binutils and clang:
+    # We also want to build a fat library with x86_64, arm64, arm64e in there.
+    # Because we use the unwrapped tools, we need to provide -isystem for headers
+    # and the library search directory for libdl.
+    # We can't build this on x86_64, because the libSystem we point to doesn't
+    # like arm64(e).
+    PATH=${bintools-unwrapped}/bin:${llvmPackages_13.clang-unwrapped}/bin:$PATH \
+      clang -arch x86_64 -arch arm64 -arch arm64e \
+      -isystem ${llvmPackages_13.clang.libc}/include \
+      -isystem ${llvmPackages_13.libclang.lib}/lib/clang/*/include \
+      -L${llvmPackages_13.clang.libc}/lib \
+      -Wl,-install_name,$libName \
+      -Wall -std=c99 -O3 -fPIC libredirect.c \
+      -ldl -shared -o "$libName"
+    '' else if stdenv.isDarwin then ''
+    $CC -Wall -std=c99 -O3 -fPIC libredirect.c \
+      -Wl,-install_name,$out/lib/$libName \
+      -ldl -shared -o "$libName"
+    '' else ''
+    $CC -Wall -std=c99 -O3 -fPIC libredirect.c \
+      -ldl -shared -o "$libName"
+    ''}

    if [ -n "$doInstallCheck" ]; then
      $CC -Wall -std=c99 -O3 test.c -o test
@ -54,6 +73,12 @@ else stdenv.mkDerivation rec {

    install -vD "$libName" "$out/lib/$libName"

+  '' + lib.optionalString (stdenv.isDarwin && stdenv.isAarch64) ''
+    # dylib will be rejected unless dylib rpath gets explictly set
+    install_name_tool \
+      -change $libName $out/lib/$libName \
+      $out/lib/$libName
+  '' + ''
    # Provide a setup hook that injects our library into every process.
    mkdir -p "$hook/nix-support"
    cat <<SETUP_HOOK > "$hook/nix-support/setup-hook"
--- a/third_party/nixpkgs/pkgs/build-support/libredirect/libredirect.c
+++ b/third_party/nixpkgs/pkgs/build-support/libredirect/libredirect.c
@ -112,7 +112,8 @@ WRAPPER(int, open)(const char * path, int flags, ...)
 }
 WRAPPER_DEF(open)

-#ifndef __APPLE__
+// In musl libc, open64 is simply a macro for open
+#if !defined(__APPLE__) && !defined(open64)
 WRAPPER(int, open64)(const char * path, int flags, ...)
 {
    int (*open64_real) (const char *, int, mode_t) = LOOKUP_REAL(open64);
@ -152,7 +153,7 @@ WRAPPER(FILE *, fopen)(const char * path, const char * mode)
 }
 WRAPPER_DEF(fopen)

-#ifndef __APPLE__
+#ifdef __GLIBC__
 WRAPPER(FILE *, __nss_files_fopen)(const char * path)
 {
    FILE * (*__nss_files_fopen_real) (const char *) = LOOKUP_REAL(__nss_files_fopen);
@ -162,7 +163,8 @@ WRAPPER(FILE *, __nss_files_fopen)(const char * path)
 WRAPPER_DEF(__nss_files_fopen)
 #endif

-#ifndef __APPLE__
+// In musl libc, fopen64 is simply a macro for fopen
+#if !defined(__APPLE__) && !defined(fopen64)
 WRAPPER(FILE *, fopen64)(const char * path, const char * mode)
 {
    FILE * (*fopen64_real) (const char *, const char *) = LOOKUP_REAL(fopen64);
@ -172,7 +174,7 @@ WRAPPER(FILE *, fopen64)(const char * path, const char * mode)
 WRAPPER_DEF(fopen64)
 #endif

-#ifndef __APPLE__
+#ifdef __linux__
 WRAPPER(int, __xstat)(int ver, const char * path, struct stat * st)
 {
    int (*__xstat_real) (int ver, const char *, struct stat *) = LOOKUP_REAL(__xstat);
@ -182,7 +184,7 @@ WRAPPER(int, __xstat)(int ver, const char * path, struct stat * st)
 WRAPPER_DEF(__xstat)
 #endif

-#ifndef __APPLE__
+#ifdef __linux__
 WRAPPER(int, __xstat64)(int ver, const char * path, struct stat64 * st)
 {
    int (*__xstat64_real) (int ver, const char *, struct stat64 *) = LOOKUP_REAL(__xstat64);
--- a/third_party/nixpkgs/pkgs/build-support/rust/hooks/cargo-build-hook.sh
+++ b/third_party/nixpkgs/pkgs/build-support/rust/hooks/cargo-build-hook.sh
@ -6,6 +6,9 @@ cargoBuildHook() {
    runHook preBuild

    if [ ! -z "${buildAndTestSubdir-}" ]; then
+        # ensure the output doesn't end up in the subdirectory
+        export CARGO_TARGET_DIR="$(pwd)/target"
+
        pushd "${buildAndTestSubdir}"
    fi

--- a/third_party/nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh
+++ b/third_party/nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh
@ -23,6 +23,7 @@ assertExecutable() {

 # --prefix          ENV SEP VAL   : suffix/prefix ENV with VAL, separated by SEP
 # --suffix
+# --prefix-each     ENV SEP VALS  : like --prefix, but VALS is a list
 # --suffix-each     ENV SEP VALS  : like --suffix, but VALS is a list
 # --prefix-contents ENV SEP FILES : like --suffix-each, but contents of FILES
 #                                   are read first and used as VALS
@ -73,6 +74,14 @@ makeWrapper() {
                    echo "export $varName=${value@Q}\${$varName:+${separator@Q}}\$$varName" >> "$wrapper"
                fi
            fi
+        elif [[ "$p" == "--prefix-each" ]]; then
+            varName="${params[$((n + 1))]}"
+            separator="${params[$((n + 2))]}"
+            values="${params[$((n + 3))]}"
+            n=$((n + 3))
+            for value in $values; do
+                echo "export $varName=${value@Q}\${$varName:+${separator@Q}}\$$varName" >> "$wrapper"
+            done
        elif [[ "$p" == "--suffix-each" ]]; then
            varName="${params[$((n + 1))]}"
            separator="${params[$((n + 2))]}"
--- a/third_party/nixpkgs/pkgs/build-support/trivial-builders.nix
+++ b/third_party/nixpkgs/pkgs/build-support/trivial-builders.nix
@ -121,18 +121,18 @@ rec {
        allowSubstitutes = false;
      }
      ''
-        n=$out${destination}
-        mkdir -p "$(dirname "$n")"
+        target=$out${destination}
+        mkdir -p "$(dirname "$target")"

        if [ -e "$textPath" ]; then
-          mv "$textPath" "$n"
+          mv "$textPath" "$target"
        else
-          echo -n "$text" > "$n"
+          echo -n "$text" > "$target"
        fi

        eval "$checkPhase"

-        (test -n "$executable" && chmod +x "$n") || true
+        (test -n "$executable" && chmod +x "$target") || true
      '';

  /*
@ -219,7 +219,7 @@ rec {
        ${text}
        '';
      checkPhase = ''
-        ${stdenv.shell} -n $out
+        ${stdenv.shellDryRun} "$target"
      '';
    };

@ -246,7 +246,7 @@ rec {
        ${text}
        '';
      checkPhase = ''
-        ${stdenv.shell} -n $out/bin/${name}
+        ${stdenv.shellDryRun} "$target"
      '';
    };

@ -295,8 +295,8 @@ rec {
      checkPhase =
        if checkPhase == null then ''
          runHook preCheck
-          ${stdenv.shell} -n $out/bin/${name}
-          ${shellcheck}/bin/shellcheck $out/bin/${name}
+          ${stdenv.shellDryRun} "$target"
+          ${shellcheck}/bin/shellcheck "$target"
          runHook postCheck
        ''
        else checkPhase;
--- a/third_party/nixpkgs/pkgs/build-support/trivial-builders/test-overriding.nix
+++ b/third_party/nixpkgs/pkgs/build-support/trivial-builders/test-overriding.nix
@ -1,10 +1,11 @@
 # Check that overriding works for trivial-builders like
 # `writeShellScript` via `overrideAttrs`. This is useful
-# to override the `checkPhase`, e. g. when you want
-# to enable extglob in `writeShellScript`.
+# to override the `checkPhase`, e. g. if you want
+# to disable extglob in `writeShellScript`.
 #
-# Run using `nix-build -A tests.trivial-overriding`.
+# Run using `nix-build -A tests.trivial-builders.overriding`.
 { lib
+, stdenv
 , runtimeShell
 , runCommand
 , callPackage
@ -21,33 +22,6 @@ let
    rm success
  '';

-  # Reuse the old `checkPhase` of `writeShellScript`, but enable extglob.
-  allowExtglob = old: {
-    checkPhase = ''
-      # make sure we don't change the settings for
-      # the rest of the derivation's build
-      (
-        export BASHOPTS
-        shopt -s extglob
-        ${old.checkPhase}
-      )
-    '';
-  };
-
-  # Run old checkPhase, but only succeed if it fails.
-  # This HACK is required because we can't introspect build failures
-  # in nix: With `assertFail` we want to make sure that the default
-  # `checkPhase` would fail if extglob was used in the script.
-  assertFail = old: {
-    # write old checkPhase into a shell script, so we can check for
-    # the phase to fail even though we have `set -e`.
-    checkPhase = ''
-      if source ${writeShellScript "old-check-phase" old.checkPhase} 2>/dev/null; then
-        exit 1
-      fi
-    '';
-  };
-
  simpleCase = case:
    writeShellScript "test-trivial-overriding-${case}" extglobScript;

@ -70,16 +44,33 @@ let
    executable = true;
  };

-  mkCase = f: type: isBin:
+    disallowExtglob = x: x.overrideAttrs (_: {
+      checkPhase = ''
+        ${stdenv.shell} -n "$target"
+      '';
+    });
+
+    # Run old checkPhase, but only succeed if it fails.
+    # This HACK is required because we can't introspect build failures
+    # in nix: With `assertFail` we want to make sure that the default
+    # `checkPhase` would fail if extglob was used in the script.
+    assertFail = x: x.overrideAttrs (old: {
+      checkPhase = ''
+        if
+          ${old.checkPhase}
+        then exit 1; fi
+      '';
+    });
+
+  mkCase = case: outcome: isBin:
    let
-      drv = (f type).overrideAttrs
-        (if type == "succ" then allowExtglob else assertFail);
+      drv = lib.pipe outcome ([ case ] ++ lib.optionals (outcome == "fail") [ disallowExtglob assertFail ]);
    in if isBin then "${drv}/bin/${drv.name}" else drv;

  writeTextOverrides = {
-    # Enabling globbing in checkPhase
+    # Make sure extglob works by default
    simpleSucc = mkCase simpleCase "succ" false;
-    # Ensure it's possible to fail; in this case globbing is not enabled.
+    # Ensure it's possible to fail; in this case extglob is not enabled
    simpleFail = mkCase simpleCase "fail" false;
    # Do the same checks after wrapping with callPackage
    # to make sure callPackage doesn't mess with the override
@ -103,7 +94,7 @@ let
      name = script.name or (builtins.baseNameOf script);
    in writeShellScript "run-${name}" ''
      if [ "$(${script})" != "success" ]; then
-        echo "Failed in ${script}"
+        echo "Failed in ${name}"
        exit 1
      fi
    '';
--- a/third_party/nixpkgs/pkgs/data/misc/cacert/default.nix
+++ b/third_party/nixpkgs/pkgs/data/misc/cacert/default.nix
@ -20,7 +20,7 @@ let
  blocklist = writeText "cacert-blocklist.txt" (lib.concatStringsSep "\n" blacklist);
  extraCertificatesBundle = writeText "cacert-extra-certificates-bundle.crt" (lib.concatStringsSep "\n\n" extraCertificateStrings);

-  srcVersion = "3.71";
+  srcVersion = "3.74";
  version = if nssOverride != null then nssOverride.version else srcVersion;
  meta = with lib; {
    homepage = "https://curl.haxx.se/docs/caextract.html";
@ -35,7 +35,7 @@ let

    src = if nssOverride != null then nssOverride.src else fetchurl {
      url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings ["."] ["_"] version}_RTM/src/nss-${version}.tar.gz";
-      sha256 = "0ly2l3dv6z5hlxs72h5x6796ni3x1bq60saavaf42ddgv4ax7b4r";
+      sha256 = "0mnhdkm4galhpvfz4rv0918jwmjlwkvcvb1f5va8f3zlz48qi4l8";
    };

    dontBuild = true;
--- a/third_party/nixpkgs/pkgs/data/misc/shared-mime-info/default.nix
+++ b/third_party/nixpkgs/pkgs/data/misc/shared-mime-info/default.nix
@ -13,34 +13,24 @@
 }:

 stdenv.mkDerivation rec {
-  pname = "shared-mime-info";
-  version = "2.1";
+  pname = "shared-mime-info-unstable";
+  version = "2021-12-03";

  outputs = [ "out" "dev" ];

  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
    owner = "xdg";
-    repo = pname;
-    rev = version;
-    sha256 = "07bxv44p43pqq4ymfnyy50yli7lwdqymhvclna42rkn1cazq3vb5";
+    repo = "shared-mime-info";
+    rev = "5a406b06792e26a83c7346b3c2443c0bd8d4cdb2";
+    sha256 = "1v7dx7mr0m4lcff1aasg9gxn280zn0ffn6fjg9xc44pnllg01n6s";
  };

-  patches = [
-    # xmlto is only used for building the docs, which are not installed anyways.
-    (fetchpatch {
-      name = "xmlto-optional.patch";
-      url = "https://gitlab.freedesktop.org/xdg/shared-mime-info/-/merge_requests/110.patch";
-      sha256 = "0p5gxlcmn8ji5bc7pd105s1halqwa1d28lfx9yj43rn6mav7allx";
-    })
-  ];
-
  nativeBuildInputs = [
    meson
    ninja
    pkg-config
    gettext
-    itstool
    libxml2
  ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) shared-mime-info;

--- a/third_party/nixpkgs/pkgs/desktops/arcan/xarcan/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/arcan/xarcan/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , arcan
 , audit
 , dbus
@ -46,6 +47,14 @@ stdenv.mkDerivation rec {
    hash = "sha256-UTIVDKnYD/q0K6G7NJUKh1tHcqnsuiJ/cQxWuPMJ2G4=";
  };

+  patches = [
+    # fix build with meson 0.60
+    (fetchpatch {
+      url = "https://github.com/letoram/xarcan/commit/b67e514dbb59bffc23b75d47ca7f24e96c4aeb05.patch";
+      sha256 = "sha256-tSQmNy1Id6nDIN+03dc1+rEEF8fMq0yJBiscNM60xic=";
+    })
+  ];
+
  nativeBuildInputs = [
    meson
    ninja
--- a/third_party/nixpkgs/pkgs/desktops/gnome/apps/gnome-todo/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/gnome/apps/gnome-todo/default.nix
@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchurl
+, fetchFromGitLab
 , fetchpatch
 , meson
 , ninja
@ -16,21 +16,25 @@
 , libpeas
 , gnome-online-accounts
 , gsettings-desktop-schemas
-, libportal
+, libportal-gtk4
 , evolution-data-server
 , libical
 , librest
 , json-glib
 , itstool
+, unstableGitUpdater
 }:

 stdenv.mkDerivation rec {
  pname = "gnome-todo";
-  version = "41.0";
+  version = "unstable-2022-01-01";

-  src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "1r94880d4khbjhhfnhaba3y3d4hv2bri82rzfzxn27s5iybpqras";
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "GNOME";
+    repo = "gnome-todo";
+    rev = "4a6be8c38510d909a9f94ec34c4da1f31ac9f1ab";
+    sha256 = "5UGo9vMb8scPWK91gftYOjqkJs9tGMiH1lqyEqedF2A=";
  };

  patches = [
@ -64,7 +68,7 @@ stdenv.mkDerivation rec {
    gnome.adwaita-icon-theme

    # Plug-ins
-    libportal # background
+    libportal-gtk4 # background
    evolution-data-server # eds
    libical
    librest # todoist
@ -77,9 +81,8 @@ stdenv.mkDerivation rec {
  '';

  passthru = {
-    updateScript = gnome.updateScript {
-      packageName = pname;
-      attrPath = "gnome.${pname}";
+    updateScript = unstableGitUpdater {
+      url = "https://gitlab.gnome.org/GNOME/gnome-todo.git";
    };
  };

--- a/Show more
+++ b/Show more