Project import generated by Copybara.

GitOrigin-RevId: 31ffc50c571e6683e9ecc9dbcbd4a8e9914b4497
2021-09-26 14:46:18 +02:00 · 2021-09-26 14:46:18 +02:00 · 8d28093ffb
commit 8d28093ffb
parent 9ed22f57ad
525 changed files with 13718 additions and 10091 deletions
--- a/third_party/nixpkgs/maintainers/maintainer-list.nix
+++ b/third_party/nixpkgs/maintainers/maintainer-list.nix
@ -736,6 +736,12 @@
    githubId = 1771266;
    name = "Vo Anh Duy";
  };
+  anirrudh = {
+    email = "anik597@gmail.com";
+    github = "anirrudh";
+    githubId = 6091755;
+    name = "Anirrudh Krishnan";
+  };
  ankhers = {
    email = "me@ankhers.dev";
    github = "ankhers";
--- a/third_party/nixpkgs/maintainers/scripts/rebuild-amount.sh
+++ b/third_party/nixpkgs/maintainers/scripts/rebuild-amount.sh
@ -9,10 +9,17 @@ if [ "$1" == "--print" ]; then
 fi

 if [ "$#" != 1 ] && [ "$#" != 2 ]; then
-	cat <<-EOF
-	Usage: $0 [--print] commit-spec [commit-spec]
+    cat <<EOF
+    Usage: $0 [--print] from-commit-spec [to-commit-spec]
        You need to be in a git-controlled nixpkgs tree.
        The current state of the tree will be used if the second commit is missing.
+
+        Examples:
+          effect of latest commit:
+              $ $0 HEAD^
+              $ $0 --print HEAD^
+          effect of the whole patch series for 'staging' branch:
+              $ $0 origin/staging staging
 EOF
    exit 1
 fi
@ -21,7 +28,7 @@ fi
 parallel="$(echo 'config.rebuild-amount.parallel or false' | nix-repl . 2>/dev/null \
            | grep -v '^\(nix-repl.*\)\?$' | tail -n 1 || true)"

-echo "Estimating rebuild amount by counting changed Hydra jobs."
+echo "Estimating rebuild amount by counting changed Hydra jobs (parallel=${parallel:-unset})."

 toRemove=()

@ -33,7 +40,7 @@ trap cleanup EXIT SIGINT SIGQUIT ERR
 MKTEMP='mktemp --tmpdir nix-rebuild-amount-XXXXXXXX'

 nixexpr() {
-	cat <<-EONIX
+    cat <<EONIX
        let
          lib = import $1/lib;
          hydraJobs = import $1/pkgs/top-level/release.nix
--- a/third_party/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/third_party/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@ -55,6 +55,16 @@
          actions.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          bash now defaults to major version 5.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Systemd was updated to version 249 (from 247).
+        </para>
+      </listitem>
      <listitem>
        <para>
          Pantheon desktop has been updated to version 6. Due to changes
@ -62,6 +72,15 @@
          <literal>gsettings set org.gnome.desktop.lockdown disable-lock-screen false</literal>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <literal>kubernetes-helm</literal> now defaults to 3.7.0,
+          which introduced some breaking changes to the experimental OCI
+          manifest format. See
+          <link xlink:href="https://github.com/helm/community/blob/main/hips/hip-0006.md">HIP
+          6</link> for more details.
+        </para>
+      </listitem>
    </itemizedlist>
  </section>
  <section xml:id="sec-release-21.11-new-services">
@ -97,6 +116,13 @@
          <link xlink:href="options.html#opt-services.kea">services.kea</link>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://owncast.online/">owncast</link>,
+          self-hosted video live streaming solution. Available at
+          <link xlink:href="options.html#opt-services.owncast">services.owncast</link>.
+        </para>
+      </listitem>
      <listitem>
        <para>
          <link xlink:href="https://sr.ht">sourcehut</link>, a
--- a/third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2111.section.md
@ -20,8 +20,14 @@ In addition to numerous new and upgraded packages, this release has the followin
  This allows activation scripts to output what they would change if the activation was really run.
  The users/modules activation script supports this and outputs some of is actions.

+- bash now defaults to major version 5.
+
+- Systemd was updated to version 249 (from 247).
+
 - Pantheon desktop has been updated to version 6. Due to changes of screen locker, if locking doesn't work for you, please try `gsettings set org.gnome.desktop.lockdown disable-lock-screen false`.

+- `kubernetes-helm` now defaults to 3.7.0, which introduced some breaking changes to the experimental OCI manifest format. See [HIP 6](https://github.com/helm/community/blob/main/hips/hip-0006.md) for more details.
+
 ## New Services {#sec-release-21.11-new-services}

 - [btrbk](https://digint.ch/btrbk/index.html), a backup tool for btrfs subvolumes, taking advantage of btrfs specific capabilities to create atomic snapshots and transfer them incrementally to your backup locations. Available as [services.btrbk](options.html#opt-services.brtbk.instances).
@ -33,6 +39,8 @@ pt-services.clipcat.enable).

 - [Kea](https://www.isc.org/kea/), ISCs 2nd generation DHCP and DDNS server suite. Available at [services.kea](options.html#opt-services.kea).

+- [owncast](https://owncast.online/), self-hosted video live streaming solution. Available at [services.owncast](options.html#opt-services.owncast).
+
 - [sourcehut](https://sr.ht), a collection of tools useful for software development. Available as [services.sourcehut](options.html#opt-services.sourcehut.enable).

 - [ucarp](https://download.pureftpd.org/pub/ucarp/README), an userspace implementation of the Common Address Redundancy Protocol (CARP). Available as [networking.ucarp](options.html#opt-networking.ucarp.enable).
@ -101,7 +109,9 @@ subsonic-compatible api. Available as [navidrome](#opt-services.navidrome.enable
  and advises all users to use `paperless-ng` instead.

  Users can use the `services.paperless-ng` module as a replacement while noting the following incompatibilities:
+
  - `services.paperless.ocrLanguages` has no replacement. Users should migrate to [`services.paperless-ng.extraConfig`](options.html#opt-services.paperless-ng.extraConfig) instead:
+
  ```nix
  {
    services.paperless-ng.extraConfig = {
@ -115,7 +125,7 @@ subsonic-compatible api. Available as [navidrome](#opt-services.navidrome.enable

  - If you previously specified `PAPERLESS_CONSUME_MAIL_*` settings in
    `services.paperless.extraConfig` you should remove those options now. You
-      now *must* define those settings in the admin interface of paperless-ng.
+    now _must_ define those settings in the admin interface of paperless-ng.

  - Option `services.paperless.manage` no longer exists.
    Use the script at `${services.paperless-ng.dataDir}/paperless-ng-manage` instead.
@ -129,6 +139,7 @@ subsonic-compatible api. Available as [navidrome](#opt-services.navidrome.enable
    To do so, enter the data directory (the value of
    `services.paperless-ng.dataDir`, `/var/lib/paperless` by default), switch
    to the paperless user and execute the management command like below:
+
    ```
    $ cd /var/lib/paperless
    $ su paperless -s /bin/sh
@ -237,28 +248,32 @@ subsonic-compatible api. Available as [navidrome](#opt-services.navidrome.enable
 * The `bitwarden_rs` packages and modules were renamed to `vaultwarden`
  [following upstream](https://github.com/dani-garcia/vaultwarden/discussions/1642). More specifically,

-  * `pkgs.bitwarden_rs`, `pkgs.bitwarden_rs-sqlite`, `pkgs.bitwarden_rs-mysql` and
+  - `pkgs.bitwarden_rs`, `pkgs.bitwarden_rs-sqlite`, `pkgs.bitwarden_rs-mysql` and
    `pkgs.bitwarden_rs-postgresql` were renamed to `pkgs.vaultwarden`, `pkgs.vaultwarden-sqlite`,
    `pkgs.vaultwarden-mysql` and `pkgs.vaultwarden-postgresql`, respectively.
-    * Old names are preserved as aliases for backwards compatibility, but may be removed in the future.
-    * The `bitwarden_rs` executable was also renamed to `vaultwarden` in all packages.

-  * `pkgs.bitwarden_rs-vault` was renamed to `pkgs.vaultwarden-vault`.
-    * `pkgs.bitwarden_rs-vault` is preserved as an alias for backwards compatibility, but may be removed in the future.
-    * The static files were moved from `/usr/share/bitwarden_rs` to `/usr/share/vaultwarden`.
+    - Old names are preserved as aliases for backwards compatibility, but may be removed in the future.
+    - The `bitwarden_rs` executable was also renamed to `vaultwarden` in all packages.

-  * The `services.bitwarden_rs` config module was renamed to `services.vaultwarden`.
-    * `services.bitwarden_rs` is preserved as an alias for backwards compatibility, but may be removed in the future.
+  - `pkgs.bitwarden_rs-vault` was renamed to `pkgs.vaultwarden-vault`.

-  * `systemd.services.bitwarden_rs`, `systemd.services.backup-bitwarden_rs` and `systemd.timers.backup-bitwarden_rs`
+    - `pkgs.bitwarden_rs-vault` is preserved as an alias for backwards compatibility, but may be removed in the future.
+    - The static files were moved from `/usr/share/bitwarden_rs` to `/usr/share/vaultwarden`.
+
+  - The `services.bitwarden_rs` config module was renamed to `services.vaultwarden`.
+
+    - `services.bitwarden_rs` is preserved as an alias for backwards compatibility, but may be removed in the future.
+
+  - `systemd.services.bitwarden_rs`, `systemd.services.backup-bitwarden_rs` and `systemd.timers.backup-bitwarden_rs`
    were renamed to `systemd.services.vaultwarden`, `systemd.services.backup-vaultwarden` and
    `systemd.timers.backup-vaultwarden`, respectively.
-    * Old names are preserved as aliases for backwards compatibility, but may be removed in the future.

-  * `users.users.bitwarden_rs` and `users.groups.bitwarden_rs` were renamed to `users.users.vaultwarden` and
+    - Old names are preserved as aliases for backwards compatibility, but may be removed in the future.
+
+  - `users.users.bitwarden_rs` and `users.groups.bitwarden_rs` were renamed to `users.users.vaultwarden` and
    `users.groups.vaultwarden`, respectively.

-  * The data directory remains located at `/var/lib/bitwarden_rs`, for backwards compatibility.
+  - The data directory remains located at `/var/lib/bitwarden_rs`, for backwards compatibility.

 - `yggdrasil` was upgraded to a new major release with breaking changes, see [upstream changelog](https://github.com/yggdrasil-network/yggdrasil-go/releases/tag/v0.4.0).

@ -271,6 +286,7 @@ subsonic-compatible api. Available as [navidrome](#opt-services.navidrome.enable
 - `tt-rss` was upgraded to the commit on 2021-06-21, which has breaking changes. If you use `services.tt-rss.extraConfig` you should migrate to the `putenv`-style configuration. See [this Discourse post](https://community.tt-rss.org/t/rip-config-php-hello-classes-config-php/4337) in the tt-rss forums for more details.

 - The following Visual Studio Code extensions were renamed to keep the naming convention uniform.
+
  - `bbenoist.Nix` -> `bbenoist.nix`
  - `CoenraadS.bracket-pair-colorizer` -> `coenraads.bracket-pair-colorizer`
  - `golang.Go` -> `golang.go`
--- a/third_party/nixpkgs/nixos/modules/module-list.nix
+++ b/third_party/nixpkgs/nixos/modules/module-list.nix
@ -560,6 +560,7 @@
  ./services/misc/octoprint.nix
  ./services/misc/ombi.nix
  ./services/misc/osrm.nix
+  ./services/misc/owncast.nix
  ./services/misc/packagekit.nix
  ./services/misc/paperless-ng.nix
  ./services/misc/parsoid.nix
--- a/third_party/nixpkgs/nixos/modules/services/misc/owncast.nix
+++ b/third_party/nixpkgs/nixos/modules/services/misc/owncast.nix
@ -0,0 +1,98 @@
+{ lib, pkgs, config, ... }:
+with lib;
+let cfg = config.services.owncast;
+in {
+
+  options.services.owncast = {
+
+    enable = mkEnableOption "owncast";
+
+    dataDir = mkOption {
+      type = types.str;
+      default = "/var/lib/owncast";
+      description = ''
+        The directory where owncast stores its data files. If left as the default value this directory will automatically be created before the owncast server starts, otherwise the sysadmin is responsible for ensuring the directory exists with appropriate ownership and permissions.
+      '';
+    };
+
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Open the appropriate ports in the firewall for owncast.
+      '';
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = "owncast";
+      description = "User account under which owncast runs.";
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = "owncast";
+      description = "Group under which owncast runs.";
+    };
+
+    listen = mkOption {
+      type = types.str;
+      default = "127.0.0.1";
+      example = "0.0.0.0";
+      description = "The IP address to bind the owncast web server to.";
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 8080;
+      description = ''
+        TCP port where owncast web-gui listens.
+      '';
+    };
+
+    rtmp-port = mkOption {
+      type = types.port;
+      default = 1935;
+      description = ''
+        TCP port where owncast rtmp service listens.
+      '';
+    };
+
+  };
+
+  config = mkIf cfg.enable {
+
+    systemd.services.owncast = {
+      description = "A self-hosted live video and web chat server";
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = mkMerge [
+        {
+          User = cfg.user;
+          Group = cfg.group;
+          WorkingDirectory = cfg.dataDir;
+          ExecStart = "${pkgs.owncast}/bin/owncast -webserverport ${toString cfg.port} -rtmpport ${toString cfg.rtmp-port} -webserverip ${cfg.listen}";
+          Restart = "on-failure";
+        }
+        (mkIf (cfg.dataDir == "/var/lib/owncast") {
+          StateDirectory = "owncast";
+        })
+      ];
+    };
+
+    users.users = mkIf (cfg.user == "owncast") {
+      owncast = {
+        isSystemUser = true;
+        group = cfg.group;
+        description = "owncast system user";
+      };
+    };
+
+    users.groups = mkIf (cfg.group == "owncast") { owncast = { }; };
+
+    networking.firewall =
+      mkIf cfg.openFirewall { allowedTCPPorts = [ cfg.rtmp-port ] ++ optional (cfg.listen != "127.0.0.1") cfg.port; };
+
+  };
+  meta = { maintainers = with lib.maintainers; [ MayNiklas ]; };
+}
--- a/third_party/nixpkgs/nixos/modules/services/search/meilisearch.md
+++ b/third_party/nixpkgs/nixos/modules/services/search/meilisearch.md
@ -0,0 +1,39 @@
+# Meilisearch {#module-services-meilisearch}
+
+Meilisearch is a lightweight, fast and powerful search engine. Think elastic search with a much smaller footprint.
+
+## Quickstart
+
+the minimum to start meilisearch is
+
+```nix
+services.meilisearch.enable = true;
+```
+
+this will start the http server included with meilisearch on port 7700.
+
+test with `curl -X GET 'http://localhost:7700/health'`
+
+## Usage
+
+you first need to add documents to an index before you can search for documents.
+
+### Add a documents to the `movies` index
+
+`curl -X POST 'http://127.0.0.1:7700/indexes/movies/documents' --data '[{"id": "123", "title": "Superman"}, {"id": 234, "title": "Batman"}]'`
+
+### Search documents in the `movies` index
+
+`curl 'http://127.0.0.1:7700/indexes/movies/search' --data '{ "q": "botman" }'` (note the typo is intentional and there to demonstrate the typo tolerant capabilities)
+
+## Defaults
+
+- The default nixos package doesn't come with the [dashboard](https://docs.meilisearch.com/learn/getting_started/quick_start.html#search), since the dashboard features makes some assets downloads at compile time.
+
+- Anonimized Analytics sent to meilisearch are disabled by default.
+
+- Default deployment is development mode. It doesn't require a secret master key. All routes are not protected and accessible.
+
+## Missing
+
+- the snapshot feature is not yet configurable from the module, it's just a matter of adding the relevant environment variables.
--- a/third_party/nixpkgs/nixos/modules/services/search/meilisearch.nix
+++ b/third_party/nixpkgs/nixos/modules/services/search/meilisearch.nix
@ -8,7 +8,10 @@ let
 in
 {

-  meta.maintainers = with maintainers; [ Br1ght0ne ];
+  meta.maintainers = with maintainers; [ Br1ght0ne happysalada ];
+  # Don't edit the docbook xml directly, edit the md and generate it:
+  # `pandoc meilisearch.md -t docbook --top-level-division=chapter --extract-media=media -f markdown+smart > meilisearch.xml`
+  meta.doc = ./meilisearch.xml;

  ###### interface

--- a/third_party/nixpkgs/nixos/modules/services/search/meilisearch.xml
+++ b/third_party/nixpkgs/nixos/modules/services/search/meilisearch.xml
@ -0,0 +1,85 @@
+<chapter xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="module-services-meilisearch">
+  <title>Meilisearch</title>
+  <para>
+    Meilisearch is a lightweight, fast and powerful search engine. Think
+    elastic search with a much smaller footprint.
+  </para>
+  <section xml:id="quickstart">
+    <title>Quickstart</title>
+    <para>
+      the minimum to start meilisearch is
+    </para>
+    <programlisting language="bash">
+services.meilisearch.enable = true;
+</programlisting>
+    <para>
+      this will start the http server included with meilisearch on port
+      7700.
+    </para>
+    <para>
+      test with
+      <literal>curl -X GET 'http://localhost:7700/health'</literal>
+    </para>
+  </section>
+  <section xml:id="usage">
+    <title>Usage</title>
+    <para>
+      you first need to add documents to an index before you can search
+      for documents.
+    </para>
+    <section xml:id="add-a-documents-to-the-movies-index">
+      <title>Add a documents to the <literal>movies</literal>
+      index</title>
+      <para>
+        <literal>curl -X POST 'http://127.0.0.1:7700/indexes/movies/documents' --data '[{&quot;id&quot;: &quot;123&quot;, &quot;title&quot;: &quot;Superman&quot;}, {&quot;id&quot;: 234, &quot;title&quot;: &quot;Batman&quot;}]'</literal>
+      </para>
+    </section>
+    <section xml:id="search-documents-in-the-movies-index">
+      <title>Search documents in the <literal>movies</literal>
+      index</title>
+      <para>
+        <literal>curl 'http://127.0.0.1:7700/indexes/movies/search' --data '{ &quot;q&quot;: &quot;botman&quot; }'</literal>
+        (note the typo is intentional and there to demonstrate the typo
+        tolerant capabilities)
+      </para>
+    </section>
+  </section>
+  <section xml:id="defaults">
+    <title>Defaults</title>
+    <itemizedlist>
+      <listitem>
+        <para>
+          The default nixos package doesn’t come with the
+          <link xlink:href="https://docs.meilisearch.com/learn/getting_started/quick_start.html#search">dashboard</link>,
+          since the dashboard features makes some assets downloads at
+          compile time.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Anonimized Analytics sent to meilisearch are disabled by
+          default.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Default deployment is development mode. It doesn’t require a
+          secret master key. All routes are not protected and
+          accessible.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="missing">
+    <title>Missing</title>
+    <itemizedlist spacing="compact">
+      <listitem>
+        <para>
+          the snapshot feature is not yet configurable from the module,
+          it’s just a matter of adding the relevant environment
+          variables.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+</chapter>
--- a/third_party/nixpkgs/nixos/modules/services/ttys/getty.nix
+++ b/third_party/nixpkgs/nixos/modules/services/ttys/getty.nix
@ -131,6 +131,14 @@ in
        restartIfChanged = false;
      };

+    systemd.services."autovt@" =
+      { serviceConfig.ExecStart = [
+          "" # override upstream default with an empty ExecStart
+          (gettyCmd "--noclear %I $TERM")
+        ];
+        restartIfChanged = false;
+      };
+
    systemd.services."container-getty@" =
      { serviceConfig.ExecStart = [
          "" # override upstream default with an empty ExecStart
--- a/third_party/nixpkgs/nixos/modules/services/web-apps/discourse.nix
+++ b/third_party/nixpkgs/nixos/modules/services/web-apps/discourse.nix
@ -172,6 +172,15 @@ in
      };

      admin = {
+        skipCreate = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+          description = ''
+            Do not create the admin account, instead rely on other
+            existing admin accounts.
+          '';
+        };
+
        email = lib.mkOption {
          type = lib.types.str;
          example = "admin@example.com";
@ -721,12 +730,24 @@ in
            lib.optionalString (file != null) ''
              replace-secret '${file}' '${file}' /run/discourse/config/discourse.conf
            '';
+
+          mkAdmin = ''
+            export ADMIN_EMAIL="${cfg.admin.email}"
+            export ADMIN_NAME="${cfg.admin.fullName}"
+            export ADMIN_USERNAME="${cfg.admin.username}"
+            ADMIN_PASSWORD="$(<${cfg.admin.passwordFile})"
+            export ADMIN_PASSWORD
+            discourse-rake admin:create_noninteractively
+          '';
+
        in ''
          set -o errexit -o pipefail -o nounset -o errtrace
          shopt -s inherit_errexit

          umask u=rwx,g=rx,o=

+          rm -rf /var/lib/discourse/tmp/*
+
          cp -r ${cfg.package}/share/discourse/config.dist/* /run/discourse/config/
          cp -r ${cfg.package}/share/discourse/public.dist/* /run/discourse/public/
          ln -sf /var/lib/discourse/uploads /run/discourse/public/uploads
@ -748,14 +769,9 @@ in
          )

          discourse-rake db:migrate >>/var/log/discourse/db_migration.log
-          chmod -R u+w /run/discourse/tmp/
+          chmod -R u+w /var/lib/discourse/tmp/

-          export ADMIN_EMAIL="${cfg.admin.email}"
-          export ADMIN_NAME="${cfg.admin.fullName}"
-          export ADMIN_USERNAME="${cfg.admin.username}"
-          ADMIN_PASSWORD="$(<${cfg.admin.passwordFile})"
-          export ADMIN_PASSWORD
-          discourse-rake admin:create_noninteractively
+          ${lib.optionalString (!cfg.admin.skipCreate) mkAdmin}

          discourse-rake themes:update
          discourse-rake uploads:regenerate_missing_optimized
@ -768,7 +784,6 @@ in
        RuntimeDirectory = map (p: "discourse/" + p) [
          "config"
          "home"
-          "tmp"
          "assets/javascripts/plugins"
          "public"
          "sockets"
@ -777,6 +792,7 @@ in
        StateDirectory = map (p: "discourse/" + p) [
          "uploads"
          "backups"
+          "tmp"
        ];
        StateDirectoryMode = 0750;
        LogsDirectory = "discourse";
--- a/third_party/nixpkgs/nixos/modules/services/x11/desktop-managers/gnome.nix
+++ b/third_party/nixpkgs/nixos/modules/services/x11/desktop-managers/gnome.nix
@ -476,6 +476,8 @@ in
    (mkIf serviceCfg.experimental-features.realtime-scheduling {
      security.wrappers.".gnome-shell-wrapped" = {
        source = "${pkgs.gnome.gnome-shell}/bin/.gnome-shell-wrapped";
+        owner = "root";
+        group = "root";
        capabilities = "cap_sys_nice=ep";
      };

--- a/third_party/nixpkgs/nixos/modules/system/boot/networkd.nix
+++ b/third_party/nixpkgs/nixos/modules/system/boot/networkd.nix
@ -384,6 +384,7 @@ let
          "AllMulticast"
          "Unmanaged"
          "RequiredForOnline"
+          "ActivationPolicy"
        ])
        (assertMacAddress "MACAddress")
        (assertByteFormat "MTUBytes")
@ -402,6 +403,14 @@ let
          "enslaved"
          "routable"
        ]))
+        (assertValueOneOf "ActivationPolicy" ([
+          "up"
+          "always-up"
+          "manual"
+          "always-down"
+          "down"
+          "bound"
+        ]))
      ];

      sectionNetwork = checkUnitConfig "Network" [
--- a/third_party/nixpkgs/nixos/tests/all-tests.nix
+++ b/third_party/nixpkgs/nixos/tests/all-tests.nix
@ -327,6 +327,7 @@ in
  openstack-image-metadata = (handleTestOn ["x86_64-linux"] ./openstack-image.nix {}).metadata or {};
  openstack-image-userdata = (handleTestOn ["x86_64-linux"] ./openstack-image.nix {}).userdata or {};
  opentabletdriver = handleTest ./opentabletdriver.nix {};
+  owncast = handleTest ./owncast.nix {};
  image-contents = handleTest ./image-contents.nix {};
  orangefs = handleTest ./orangefs.nix {};
  os-prober = handleTestOn ["x86_64-linux"] ./os-prober.nix {};
--- a/third_party/nixpkgs/nixos/tests/herbstluftwm.nix
+++ b/third_party/nixpkgs/nixos/tests/herbstluftwm.nix
@ -3,7 +3,6 @@ import ./make-test-python.nix ({ lib, ...} : {

  meta = {
    maintainers = with lib.maintainers; [ thibautmarty ];
-    timeout = 30;
  };

  machine = { pkgs, lib, ... }: {
--- a/third_party/nixpkgs/nixos/tests/owncast.nix
+++ b/third_party/nixpkgs/nixos/tests/owncast.nix
@ -0,0 +1,21 @@
+{ system ? builtins.currentSystem, config ? { }
+, pkgs ? import ../.. { inherit system config; } }:
+
+with import (nixpkgs + "/nixos/lib/testing-python.nix") { inherit system; };
+makeTest {
+  name = "owncast";
+  meta = with pkgs.stdenv.lib.maintainers; { maintainers = [ MayNiklas ]; };
+
+  nodes = {
+    client = { ... }: {
+      environment.systemPackages = [ curl ];
+      services.owncast = { enable = true; };
+    };
+  };
+
+  testScript = ''
+    start_all()
+    client.wait_for_unit("owncast.service")
+    client.succeed("curl localhost:8080/api/status")
+  '';
+}
--- a/third_party/nixpkgs/nixos/tests/prometheus-exporters.nix
+++ b/third_party/nixpkgs/nixos/tests/prometheus-exporters.nix
@ -280,6 +280,7 @@ let
      };
      exporterTest = ''
        wait_for_unit("prometheus-influxdb-exporter.service")
+        wait_for_open_port(9122)
        succeed(
          "curl -XPOST http://localhost:9122/write --data-binary 'influxdb_exporter,distro=nixos,added_in=21.09 value=1'"
        )
--- a/third_party/nixpkgs/nixos/tests/systemd-confinement.nix
+++ b/third_party/nixpkgs/nixos/tests/systemd-confinement.nix
@ -44,30 +44,26 @@ import ./make-test-python.nix {
      { config.confinement.mode = "chroot-only";
        testScript = ''
          with subtest("chroot-only confinement"):
-              machine.succeed(
-                  'test "$(chroot-exec ls -1 / | paste -sd,)" = bin,nix',
-                  'test "$(chroot-exec id -u)" = 0',
-                  "chroot-exec chown 65534 /bin",
-              )
+              paths = machine.succeed('chroot-exec ls -1 / | paste -sd,').strip()
+              assert_eq(paths, "bin,nix,run")
+              uid = machine.succeed('chroot-exec id -u').strip()
+              assert_eq(uid, "0")
+              machine.succeed("chroot-exec chown 65534 /bin")
        '';
      }
      { testScript = ''
          with subtest("full confinement with APIVFS"):
-              machine.fail(
-                  "chroot-exec ls -l /etc",
-                  "chroot-exec ls -l /run",
-                  "chroot-exec chown 65534 /bin",
-              )
-              machine.succeed(
-                  'test "$(chroot-exec id -u)" = 0',
-                  "chroot-exec chown 0 /bin",
-              )
+              machine.fail("chroot-exec ls -l /etc")
+              machine.fail("chroot-exec chown 65534 /bin")
+              assert_eq(machine.succeed('chroot-exec id -u').strip(), "0")
+              machine.succeed("chroot-exec chown 0 /bin")
        '';
      }
      { config.serviceConfig.BindReadOnlyPaths = [ "/etc" ];
        testScript = ''
          with subtest("check existence of bind-mounted /etc"):
-              machine.succeed('test -n "$(chroot-exec cat /etc/passwd)"')
+              passwd = machine.succeed('chroot-exec cat /etc/passwd').strip()
+              assert len(passwd) > 0, "/etc/passwd must not be empty"
        '';
      }
      { config.serviceConfig.User = "chroot-testuser";
@ -75,7 +71,8 @@ import ./make-test-python.nix {
        testScript = ''
          with subtest("check if User/Group really runs as non-root"):
              machine.succeed("chroot-exec ls -l /dev")
-              machine.succeed('test "$(chroot-exec id -u)" != 0')
+              uid = machine.succeed('chroot-exec id -u').strip()
+              assert uid != "0", "UID of chroot-testuser shouldn't be 0"
              machine.fail("chroot-exec touch /bin/test")
        '';
      }
@ -88,10 +85,8 @@ import ./make-test-python.nix {
        testScript = ''
          with subtest("check if symlinks are properly bind-mounted"):
              machine.fail("chroot-exec test -e /etc")
-              machine.succeed(
-                  "chroot-exec cat ${symlink} >&2",
-                  'test "$(chroot-exec cat ${symlink})" = "got me"',
-              )
+              text = machine.succeed('chroot-exec cat ${symlink}').strip()
+              assert_eq(text, "got me")
        '';
      })
      { config.serviceConfig.User = "chroot-testuser";
@ -158,6 +153,9 @@ import ./make-test-python.nix {
  };

  testScript = { nodes, ... }: ''
+    def assert_eq(a, b):
+        assert a == b, f"{a} != {b}"
+
    machine.wait_for_unit("multi-user.target")
  '' + nodes.machine.config.__testSteps;
 }
--- a/third_party/nixpkgs/pkgs/applications/editors/apostrophe/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/apostrophe/default.nix
@ -1,8 +1,8 @@
-{ lib, stdenv, fetchFromGitLab, meson, ninja, cmake
+{ lib, stdenv, fetchFromGitLab, meson, ninja
 , wrapGAppsHook, pkg-config, desktop-file-utils
 , appstream-glib, pythonPackages, glib, gobject-introspection
 , gtk3, webkitgtk, glib-networking, gnome, gspell, texlive
-, shared-mime-info, libhandy, fira
+, shared-mime-info, libhandy, fira, sassc
 }:

 let
@ -13,18 +13,18 @@ let

 in stdenv.mkDerivation rec {
  pname = "apostrophe";
-  version = "2.4";
+  version = "2.5";

  src = fetchFromGitLab {
-    owner  = "somas";
+    owner  = "World";
    repo   = pname;
    domain = "gitlab.gnome.org";
    rev    = "v${version}";
-    sha256 = "1qzy3zhi18wf42m034s8kcmx9gl05j620x3hf6rnycq2fvy7g4gz";
+    sha256 = "06yfiflmj3ip7ppcz41nb3xpgb5ggw5h74w0v87yaqqkq7qh31lp";
  };

-  nativeBuildInputs = [ meson ninja cmake pkg-config desktop-file-utils
-    appstream-glib wrapGAppsHook ];
+  nativeBuildInputs = [ meson ninja pkg-config desktop-file-utils
+    appstream-glib wrapGAppsHook sassc ];

  buildInputs = [ glib pythonEnv gobject-introspection gtk3
    gnome.adwaita-icon-theme webkitgtk gspell texlive
@ -49,7 +49,7 @@ in stdenv.mkDerivation rec {
  '';

  meta = with lib; {
-    homepage = "https://gitlab.gnome.org/somas/apostrophe";
+    homepage = "https://gitlab.gnome.org/World/apostrophe";
    description = "A distraction free Markdown editor for GNU/Linux";
    license = licenses.gpl3;
    platforms = platforms.linux;
--- a/third_party/nixpkgs/pkgs/applications/editors/rstudio/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/rstudio/default.nix
@ -135,7 +135,7 @@ mkDerivation rec {
    { description = "Set of integrated tools for the R language";
      homepage = "https://www.rstudio.com/";
      license = licenses.agpl3;
-      maintainers = with maintainers; [ ehmry changlinli ciil ];
+      maintainers = with maintainers; [ changlinli ciil ];
      platforms = platforms.linux;
    };
 }
--- a/third_party/nixpkgs/pkgs/applications/editors/vscode/generic.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/vscode/generic.nix
@ -112,7 +112,8 @@ let
    '';

    # See https://github.com/NixOS/nixpkgs/issues/49643#issuecomment-873853897
-    postPatch = ''
+    # linux only because of https://github.com/NixOS/nixpkgs/issues/138729
+    postPatch = lib.optionalString stdenv.isLinux ''
      # this is a fix for "save as root" functionality
      packed="resources/app/node_modules.asar"
      unpacked="resources/app/node_modules"
--- a/third_party/nixpkgs/pkgs/applications/editors/vscode/vscode.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/vscode/vscode.nix
@ -14,17 +14,17 @@ let
  archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "10iai5k0hvyvishp4gbamvsn9ff8dfm6kvql08h3plr8zrvmaian";
-    x86_64-darwin = "1cspla4cxw0l5cg44qywv3jgwyk2g7sx5lk1s4xhbrqz76knzcr7";
-    aarch64-linux = "1dc4gfaxlrsd637d8w2c5h4l8c96phv14pmkhmyc1jp1a0q6d5ja";
-    aarch64-darwin = "06d8ng6k62mh1qhba0c6nj2lag4vi7i50d2sx3nk8r2v8azwyrmk";
-    armv7l-linux = "030c8az831n73w35xfbjpympwvfprf1h4lxy8j5sysm4fbpzi03m";
+    x86_64-linux = "0ma8pysww4r3p73rf94wddxk2ar091yw8mk1gi9jawiqvb9ksx0m";
+    x86_64-darwin = "008v7hxv71bvfp52wfx3sg97s54bn2klvy5xfjh48wcaka10vsj0";
+    aarch64-linux = "1wi5bmjdjfy1la3lwb3c389cjbn4q12j1214vna9214d8if37dyv";
+    aarch64-darwin = "14v0gq4kj0lxa6pwi7nbdpw0l25yfcqydigfzhmwrp8ipbnma62k";
+    armv7l-linux = "0h94gzwxknlvfy9gcd0zq4qsjmr9zr22adbfrqm1gvv1aksmgm4b";
  }.${system};
 in
  callPackage ./generic.nix rec {
    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.60.1";
+    version = "1.60.2";
    pname = "vscode";

    executableName = "code" + lib.optionalString isInsiders "-insiders";
--- a/third_party/nixpkgs/pkgs/applications/graphics/ImageMagick/7.0.nix
+++ b/third_party/nixpkgs/pkgs/applications/graphics/ImageMagick/7.0.nix
@ -18,13 +18,13 @@ in

 stdenv.mkDerivation rec {
  pname = "imagemagick";
-  version = "7.1.0-4";
+  version = "7.1.0-6";

  src = fetchFromGitHub {
    owner = "ImageMagick";
    repo = "ImageMagick";
    rev = version;
-    sha256 = "sha256-CvrSeoKaTigR+4egelwLRr2++CQ5OWUePwX9e1/G1GM=";
+    sha256 = "sha256-rwaMAkbSBTdrJ+OVZfAOBIp1tmC7/TC34w5gBIe+J94=";
  };

  outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
--- a/third_party/nixpkgs/pkgs/applications/graphics/freecad/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/graphics/freecad/default.nix
@ -62,6 +62,7 @@ mkDerivation rec {
    ninja
    pkg-config
    pyside2-tools
+    gfortran
    wrapQtAppsHook
  ];

@ -70,7 +71,6 @@ mkDerivation rec {
    boost
    coin3d
    eigen
-    gfortran
    gts
    hdf5
    libGLU
--- a/third_party/nixpkgs/pkgs/applications/graphics/lightburn/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/graphics/lightburn/default.nix
@ -6,7 +6,7 @@

 stdenv.mkDerivation rec {
  pname = "lightburn";
-  version = "1.0.01";
+  version = "1.0.02";

  nativeBuildInputs = [
    p7zip
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://github.com/LightBurnSoftware/deployment/releases/download/${version}/LightBurn-Linux64-v${version}.7z";
-    sha256 = "sha256-UnTZcZjR8edHGflThkiu6OeWJU9x/bH/Ml/CRwWYgFU=";
+    sha256 = "sha256-JaKThw6ubutpOCsO1pVAPVxhhUTKpfYRHjBSu02nlN4=";
  };

  buildInputs = [
--- a/third_party/nixpkgs/pkgs/applications/graphics/mandelbulber/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/graphics/mandelbulber/default.nix
@ -19,13 +19,13 @@ assert withOpenCL -> ocl-icd != null;

 mkDerivation rec {
  pname = "mandelbulber";
-  version = "2.24";
+  version = "2.26";

  src = fetchFromGitHub {
    owner = "buddhi1980";
    repo = "mandelbulber2";
    rev = version;
-    sha256 = "sha256-JgpYGzD2FsqcCWnOKBiVCxUKqLfT4S++uUBZekhGWmA=";
+    sha256 = "sha256-RKpg7LBsrBFOlFozoDcALwGeZ9whPiCpFMZF5ljsp7Q=";
  };

  nativeBuildInputs = [
--- a/third_party/nixpkgs/pkgs/applications/kde/fetch.sh
+++ b/third_party/nixpkgs/pkgs/applications/kde/fetch.sh
@ -1 +1 @@
-WGET_ARGS=( http://download.kde.org/stable/release-service/21.08.0/src -A '*.tar.xz' )
+WGET_ARGS=( http://download.kde.org/stable/release-service/21.08.1/src -A '*.tar.xz' )
--- a/third_party/nixpkgs/pkgs/applications/kde/srcs.nix
+++ b/third_party/nixpkgs/pkgs/applications/kde/srcs.nix
--- a/third_party/nixpkgs/pkgs/applications/misc/bottles/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/bottles/default.nix
@ -3,18 +3,18 @@
 , desktop-file-utils, gsettings-desktop-schemas, libnotify, libhandy
 , python3Packages, gettext
 , appstream-glib, gdk-pixbuf, glib, gobject-introspection, gspell, gtk3
-, steam-run-native
+, steam-run, xdg-utils, pciutils, cabextract, wineWowPackages
 }:

 python3Packages.buildPythonApplication rec {
  pname = "bottles";
-  version = "2021.7.14-treviso";
+  version = "2021.7.28-treviso-2";

  src = fetchFromGitHub {
    owner = "bottlesdevs";
    repo = pname;
    rev = version;
-    sha256 = "0xhfk1ll8vacgrr0kkhynq4bryjhfjs29j824bark5mj9b6lkbix";
+    sha256 = "0kvwcajm9izvkwfg7ir7bks39bpc665idwa8mc8d536ajyjriysn";
  };

  postPatch = ''
@ -52,7 +52,14 @@ python3Packages.buildPythonApplication rec {
    dbus-python
    gst-python
    liblarch
-  ] ++ [ steam-run-native ];
+    patool
+  ] ++ [
+    steam-run
+    xdg-utils
+    pciutils
+    cabextract
+    wineWowPackages.minimal
+  ];

  format = "other";
  strictDeps = false; # broken with gobject-introspection setup hook, see https://github.com/NixOS/nixpkgs/issues/56943
@ -62,8 +69,10 @@ python3Packages.buildPythonApplication rec {
    substituteInPlace build-aux/meson/postinstall.py \
      --replace "'update-desktop-database'" "'${desktop-file-utils}/bin/update-desktop-database'"
    substituteInPlace src/runner.py \
-      --replace " {runner}" " ${steam-run-native}/bin/steam-run {runner}" \
-      --replace " {dxvk_setup}" " ${steam-run-native}/bin/steam-run {dxvk_setup}"
+      --replace " {runner}" " ${steam-run}/bin/steam-run {runner}" \
+      --replace " {dxvk_setup}" " ${steam-run}/bin/steam-run {dxvk_setup}"
+      substituteInPlace src/runner_utilities.py \
+        --replace " {runner}" " ${steam-run}/bin/steam-run {runner}" \
  '';

  preFixup = ''
--- a/third_party/nixpkgs/pkgs/applications/misc/cloak/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/cloak/default.nix
@ -0,0 +1,22 @@
+{ lib, rustPlatform, fetchFromGitHub }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cloak";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "evansmurithi";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "139z2ga0q7a0vwfnn5hpzsz5yrrrr7rgyd32yvfj5sxiywkmczs7";
+  };
+
+  cargoSha256 = "0af38wgwmsamnx63dwfm2nrkd8wmky3ai7zwy0knmifgkn4b7yyj";
+
+  meta = with lib; {
+    homepage = "https://github.com/evansmurithi/cloak";
+    description = "Command-line OTP authenticator application";
+    license = licenses.mit;
+    maintainers = with maintainers; [ mvs ];
+  };
+}
--- a/third_party/nixpkgs/pkgs/applications/misc/joshuto/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/joshuto/default.nix
@ -2,23 +2,19 @@

 rustPlatform.buildRustPackage rec {
  pname = "joshuto";
-  version = "0.9.0";
+  version = "0.9.1";

  src = fetchFromGitHub {
    owner = "kamiyaa";
    repo = pname;
    rev = version;
-    sha256 = "08d6h7xwcgycw5bdzwwc6aaikcrw3yc7inkiydgml9q261kql7zl";
-    # upstream includes an outdated Cargo.lock that stops cargo from compiling
-    postFetch = ''
-      mkdir -p $out
-      tar xf $downloadedFile --strip=1 -C $out
-      substituteInPlace $out/Cargo.lock \
-        --replace 0.8.6 ${version}
-    '';
+    sha256 = "sha256-+qKOvFoEF/gZL4ijL8lIRWE9ZWJM2eBlk29Lk46jAfQ=";
  };

-  cargoSha256 = "1scrqm7fs8y7anfiigimj7y5rjxcc2qvrxiq8ai7k5cwfc4v1ghm";
+  # upstream includes an outdated Cargo.lock that stops cargo from compiling
+  cargoPatches = [ ./fix-cargo-lock.patch ];
+
+  cargoSha256 = "sha256-JlekxU9pMkHNsIcH3+7b2I6MYUlxRqNX+0wwyVrQMAE=";

  buildInputs = lib.optional stdenv.isDarwin SystemConfiguration;

--- a/third_party/nixpkgs/pkgs/applications/misc/joshuto/fix-cargo-lock.patch
+++ b/third_party/nixpkgs/pkgs/applications/misc/joshuto/fix-cargo-lock.patch
@ -0,0 +1,11 @@
+--- a/Cargo.lock
+++ b/Cargo.lock
+@@ -512,7 +512,7 @@ checksum = "b71991ff56294aa922b450139ee08b3bfc70982c6b2c7562771375cf73542dd4"
+ 
+ [[package]]
+ name = "joshuto"
+-version = "0.9.0"
+version = "0.9.1"
+ dependencies = [
+  "alphanumeric-sort",
+  "chrono",
--- a/third_party/nixpkgs/pkgs/applications/misc/mediainfo-gui/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/mediainfo-gui/default.nix
@ -2,11 +2,11 @@
 , desktop-file-utils, libSM, imagemagick }:

 stdenv.mkDerivation rec {
-  version = "21.03";
+  version = "21.09";
  pname = "mediainfo-gui";
  src = fetchurl {
    url = "https://mediaarea.net/download/source/mediainfo/${version}/mediainfo_${version}.tar.xz";
-    sha256 = "07h2a1lbw5ak6c9bcn8qydchl0wpgk945rf9sfcqjyv05h5wll6y";
+    sha256 = "0mqcqm8y2whnbdi2ry7jd755gfl5ccdqhwjh67hsyr7c0ajxk3vv";
  };

  nativeBuildInputs = [ autoreconfHook pkg-config ];
--- a/third_party/nixpkgs/pkgs/applications/misc/mediainfo/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/mediainfo/default.nix
@ -1,11 +1,11 @@
 { lib, stdenv, fetchurl, autoreconfHook, pkg-config, libzen, libmediainfo, zlib }:

 stdenv.mkDerivation rec {
-  version = "21.03";
+  version = "21.09";
  pname = "mediainfo";
  src = fetchurl {
    url = "https://mediaarea.net/download/source/mediainfo/${version}/mediainfo_${version}.tar.xz";
-    sha256 = "07h2a1lbw5ak6c9bcn8qydchl0wpgk945rf9sfcqjyv05h5wll6y";
+    sha256 = "0mqcqm8y2whnbdi2ry7jd755gfl5ccdqhwjh67hsyr7c0ajxk3vv";
  };

  nativeBuildInputs = [ autoreconfHook pkg-config ];
--- a/third_party/nixpkgs/pkgs/applications/misc/menumaker/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/menumaker/default.nix
@ -1,12 +1,12 @@
-{ lib, fetchurl, python2Packages }:
+{ lib, fetchurl, python3Packages }:

-python2Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "menumaker";
-  version = "0.99.12";
+  version = "0.99.13";

  src = fetchurl {
    url = "mirror://sourceforge/menumaker/${pname}-${version}.tar.gz";
-    sha256 = "034v5204bsgkzzk6zfa5ia63q95gln47f7hwf96yvad5hrhmd8z3";
+    sha256 = "sha256-JBXs5hnt1snbnB1hi7q7HBI7rNp0OoalLeIM0uJCdkE=";
  };

  format = "other";
--- a/third_party/nixpkgs/pkgs/applications/misc/mop/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/mop/default.nix
@ -9,7 +9,7 @@ buildGoPackage rec {
  goDeps = ./deps.nix;

  preConfigure = ''
-    for i in $(find . -type f);do
+    for i in *.go **/*.go; do
        substituteInPlace $i --replace michaeldv/termbox-go nsf/termbox-go
    done
    substituteInPlace Makefile --replace mop/cmd mop/mop
--- a/third_party/nixpkgs/pkgs/applications/misc/navi/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/navi/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "navi";
-  version = "2.16.0";
+  version = "2.17.0";

  src = fetchFromGitHub {
    owner = "denisidoro";
    repo = "navi";
    rev = "v${version}";
-    sha256 = "sha256-ngSZFYGE+Varul/qwavMO3xcMIp8w2WETWXc573wYhQ=";
+    sha256 = "sha256-WH8FfQ7cD4aFUi9iE0tR/B+5oWy8tMVmMLxusDwXF7w=";
  };

-  cargoSha256 = "sha256-qtxFTk0iCxPa4Z7H9+QWSii+iYrLUV2LfiAEbePdhOQ=";
+  cargoSha256 = "sha256-TH9DNCoUVqH5g05Z4Vdv7F8CCLnaYezupI5FeJhYTaQ=";

  nativeBuildInputs = [ makeWrapper ];

@ -23,6 +23,11 @@ rustPlatform.buildRustPackage rec {
      --prefix PATH : ${lib.makeBinPath [ fzf wget ]}
  '';

+  checkFlags = [
+    # error: Found argument '--test-threads' which wasn't expected, or isn't valid in this context
+    "--skip=test_parse_variable_line"
+   ];
+
  meta = with lib; {
    description = "An interactive cheatsheet tool for the command-line and application launchers";
    homepage = "https://github.com/denisidoro/navi";
--- a/third_party/nixpkgs/pkgs/applications/misc/privacyidea/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/privacyidea/default.nix
@ -14,7 +14,8 @@ let
      });
      flask_migrate = super.flask_migrate.overridePythonAttrs (oldAttrs: rec {
        version = "2.7.0";
-        src = oldAttrs.src.override {
+        src = python3.pkgs.fetchPypi {
+          pname = "Flask-Migrate";
          inherit version;
          sha256 = "ae2f05671588762dd83a21d8b18c51fe355e86783e24594995ff8d7380dffe38";
        };
--- a/third_party/nixpkgs/pkgs/applications/misc/psi-notify/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/psi-notify/default.nix
@ -0,0 +1,39 @@
+{ lib, stdenv, fetchFromGitHub, systemd, libnotify, pkg-config }:
+
+stdenv.mkDerivation rec {
+  pname = "psi-notify";
+  version = "1.2.1";
+
+  src = fetchFromGitHub {
+    owner = "cdown";
+    repo = pname;
+    rev = version;
+    sha256 = "0hn37plim1smmlrjjmz8kybyms8pz3wxcgf8vmqjrsqi6bfcym7g";
+  };
+
+  buildInputs = [ systemd libnotify ];
+  nativeBuildInputs = [ pkg-config ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D psi-notify $out/bin/psi-notify
+    substituteInPlace psi-notify.service --replace psi-notify $out/bin/psi-notify
+    install -D psi-notify.service $out/share/systemd/user/psi-notify.service
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Alert on system resource saturation";
+    longDescription = ''
+      psi-notify can alert you when resources on your machine are becoming
+      oversaturated, and allow you to take action before your system slows to a
+      crawl.
+    '';
+    license = licenses.mit;
+    homepage = "https://github.com/cdown/psi-notify";
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ eduarrrd ];
+  };
+}
--- a/third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/browser.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/browser.nix
@ -19,8 +19,7 @@ mkChromiumDerivation (base: rec {
    cp -v "$buildPath/"*.so "$buildPath/"*.pak "$buildPath/"*.bin "$libExecPath/"
    cp -v "$buildPath/icudtl.dat" "$libExecPath/"
    cp -vLR "$buildPath/locales" "$buildPath/resources" "$libExecPath/"
-    ${lib.optionalString (!chromiumVersionAtLeast "94") ''cp -v "$buildPath/crashpad_handler" "$libExecPath/"''}
-    ${lib.optionalString (chromiumVersionAtLeast "94") ''cp -v "$buildPath/chrome_crashpad_handler" "$libExecPath/"''}
+    cp -v "$buildPath/chrome_crashpad_handler" "$libExecPath/"
    cp -v "$buildPath/chrome" "$libExecPath/$packageName"

    # Swiftshader
--- a/third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/common.nix
@ -160,21 +160,6 @@ let
      ./patches/no-build-timestamps.patch
      # For bundling Widevine (DRM), might be replaceable via bundle_widevine_cdm=true in gnFlags:
      ./patches/widevine-79.patch
-    ] ++ lib.optionals (versionRange "91" "94") [
-      # Fix the build by adding a missing dependency (s. https://crbug.com/1197837):
-      ./patches/fix-missing-atspi2-dependency.patch
-      # Required as dependency for the next patch:
-      (githubPatch {
-        # Reland "Reland "Linux sandbox syscall broker: use struct kernel_stat""
-        commit = "4b438323d68840453b5ef826c3997568e2e0e8c7";
-        sha256 = "1lf6yilx2ffd3r0840ilihp4px35w7jvr19ll56bncqmz4r5fd82";
-      })
-      # To fix the text rendering, see #131074:
-      (githubPatch {
-        # Linux sandbox: fix fstatat() crash
-        commit = "60d5e803ef2a4874d29799b638754152285e0ed9";
-        sha256 = "0apmsqqlfxprmdmi3qzp3kr9jc52mcc4xzps206kwr8kzwv48b70";
-      })
    ];

    postPatch = ''
@ -196,7 +181,7 @@ let
        substituteInPlace third_party/harfbuzz-ng/src/src/update-unicode-tables.make \
          --replace "/usr/bin/env -S make -f" "/usr/bin/make -f"
      fi
-      chmod -x third_party/webgpu-cts/src/tools/deno
+      chmod -x third_party/webgpu-cts/src/tools/${lib.optionalString (chromiumVersionAtLeast "96") "run_"}deno

      # We want to be able to specify where the sandbox is via CHROME_DEVEL_SANDBOX
      substituteInPlace sandbox/linux/suid/client/setuid_sandbox_host.cc \
@ -253,6 +238,7 @@ let
      # e.g. unsafe developer builds have developer-friendly features that may
      # weaken or disable security measures like sandboxing or ASLR):
      is_official_build = true;
+      disable_fieldtrial_testing_config = true;
      # Build Chromium using the system toolchain (for Linux distributions):
      custom_toolchain = "//build/toolchain/linux/unbundle:default";
      host_toolchain = "//build/toolchain/linux/unbundle:default";
@ -289,10 +275,6 @@ let
      enable_widevine = true;
      # Provides the enable-webrtc-pipewire-capturer flag to support Wayland screen capture:
      rtc_use_pipewire = true;
-    } // optionalAttrs (!chromiumVersionAtLeast "94") {
-      fieldtrial_testing_like_official_build = true;
-    } // optionalAttrs (chromiumVersionAtLeast "94") {
-      disable_fieldtrial_testing_config = true;
    } // optionalAttrs proprietaryCodecs {
      # enable support for the H.264 codec
      proprietary_codecs = true;
--- a/third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/patches/fix-missing-atspi2-dependency.patch
+++ b/third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/patches/fix-missing-atspi2-dependency.patch
@ -1,26 +0,0 @@
-From 6c5b9197076f6f384112e6566039116c56600909 Mon Sep 17 00:00:00 2001
-From: Michael Weiss <dev.primeos@gmail.com>
-Date: Sat, 10 Apr 2021 13:53:50 +0200
-Subject: [PATCH] Fix a missing atspi2 dependency
-
-See https://bugs.chromium.org/p/chromium/issues/detail?id=1197837 for
-more details.
---
- content/public/browser/BUILD.gn | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/content/public/browser/BUILD.gn b/content/public/browser/BUILD.gn
-index 7e7c436d90c7..20ef832f1d8c 100644
--- a/content/public/browser/BUILD.gn
-+++ b/content/public/browser/BUILD.gn
-@@ -535,6 +535,7 @@ source_set("browser_sources") {
- 
-   if (use_atk) {
-     sources += [ "ax_inspect_factory_auralinux.cc" ]
-+    configs += [ "//build/config/linux/atspi2" ]
-   }
- 
-   if (is_linux || is_chromeos) {
-- 
-2.20.1
-
--- a/third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -1,8 +1,8 @@
 {
  "stable": {
-    "version": "94.0.4606.54",
-    "sha256": "0p8kfnyhykbv1cylsx4hj2qdzqr2xdql9rhpva8bfla2w9hr8g83",
-    "sha256bin64": "0lq34l00zrr92g882xzqwq1lf2vf12x1mwidrr2qh6fz7v5418d3",
+    "version": "94.0.4606.61",
+    "sha256": "1gxrxmd2almwf067zycilyxkmc0d62h99ln8wp3n3i02bi9xnik4",
+    "sha256bin64": "116xrf8hcprbdpdx6a4xysac2phyvw88vs3n1bs24ly6pxydsasz",
    "deps": {
      "gn": {
        "version": "2021-08-11",
@ -18,9 +18,9 @@
    }
  },
  "beta": {
-    "version": "94.0.4606.54",
-    "sha256": "0p8kfnyhykbv1cylsx4hj2qdzqr2xdql9rhpva8bfla2w9hr8g83",
-    "sha256bin64": "1c2i9830r0fldigv16ggmj6r74l6d85abbhka0a5wpbbn6ay08jx",
+    "version": "95.0.4638.17",
+    "sha256": "1v5r8m3wlwh6prcj7bd4zprsr4g43869lhxv43m207c5nlnqiriz",
+    "sha256bin64": "0h88gd8y4i2jmvhiwadbq6hzqygddym8jy1fhzp8qnwfhc30qm4m",
    "deps": {
      "gn": {
        "version": "2021-08-11",
@ -31,9 +31,9 @@
    }
  },
  "dev": {
-    "version": "95.0.4638.17",
-    "sha256": "1v5r8m3wlwh6prcj7bd4zprsr4g43869lhxv43m207c5nlnqiriz",
-    "sha256bin64": "1azn9216jhcdg4yjr6frz8vp98qbcnnhifp9jn9bwvyg69lr0dwb",
+    "version": "96.0.4651.0",
+    "sha256": "0da1mhz3cy0k2igdh208i28k8fxca0yjfypvmj7624p7igrp4an6",
+    "sha256bin64": "1gslpdnpjp7w40lsl748rmbkbs31v22f2x45gahrijkvfrkgdqp9",
    "deps": {
      "gn": {
        "version": "2021-08-11",
@ -44,19 +44,19 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "93.0.4577.82",
-    "sha256": "0lr8zdq06smncdzd6knzww9hxl8ynvxadmrkyyl13fpwb1422rjx",
-    "sha256bin64": "0ydvcakpnl20gx7493hv6aqnyf8f28rkvzgwnm4gws92b92n9ify",
+    "version": "94.0.4606.54",
+    "sha256": "0p8kfnyhykbv1cylsx4hj2qdzqr2xdql9rhpva8bfla2w9hr8g83",
+    "sha256bin64": "0lq34l00zrr92g882xzqwq1lf2vf12x1mwidrr2qh6fz7v5418d3",
    "deps": {
      "gn": {
-        "version": "2021-07-08",
+        "version": "2021-08-11",
        "url": "https://gn.googlesource.com/gn",
-        "rev": "24e2f7df92641de0351a96096fb2c490b2436bb8",
-        "sha256": "1lwkyhfhw0zd7daqz466n7x5cddf0danr799h4jg3s0yvd4galjl"
+        "rev": "69ec4fca1fa69ddadae13f9e6b7507efa0675263",
+        "sha256": "031znmkbm504iim5jvg3gmazj4qnkfc7zg8aymjsij18fhf7piz0"
      },
      "ungoogled-patches": {
-        "rev": "93.0.4577.82-1",
-        "sha256": "199f78f5gvnkpkcvh7587pk35jslkszhvv1d648b4qphzxmw7c66"
+        "rev": "94.0.4606.54-1",
+        "sha256": "0phy87fiqdgikgl60yap7n1mvyvsidgznqp06j86287iihml3z2m"
      }
    }
  }
--- a/third_party/nixpkgs/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
--- a/third_party/nixpkgs/pkgs/applications/networking/browsers/firefox-bin/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/browsers/firefox-bin/default.nix
@ -28,7 +28,7 @@
 , libXt
 , libcanberra
 , libnotify
-, gnome
+, adwaita-icon-theme
 , libGLU, libGL
 , nspr
 , nss
@ -137,7 +137,7 @@ stdenv.mkDerivation {

  inherit gtk3;

-  buildInputs = [ wrapGAppsHook gtk3 gnome.adwaita-icon-theme ];
+  buildInputs = [ wrapGAppsHook gtk3 adwaita-icon-theme ];

  # "strip" after "patchelf" may break binaries.
  # See: https://github.com/NixOS/patchelf/issues/10
--- a/third_party/nixpkgs/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
--- a/third_party/nixpkgs/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/browsers/firefox/packages.nix
@ -7,10 +7,10 @@ in
 rec {
  firefox = common rec {
    pname = "firefox";
-    version = "92.0";
+    version = "92.0.1";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "1a73cc275ea1790120845f579a7d21713ea78db0867ced767f393dfc25b132292dfbb673290fccdb9dcde86684e0300d56565841985fa3f0115376c91154ba8e";
+      sha512 = "53361c231a4ac93a1808c9ccb29893d85b5e516fe939a770aac7f178abb4f43cbe3571097e5c5bf91b11fd95fc62b61f2aa215a45048357bfc9dad9eabdee9ef";
    };

    meta = {
--- a/third_party/nixpkgs/pkgs/applications/networking/browsers/google-chrome/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/browsers/google-chrome/default.nix
@ -6,7 +6,7 @@
 , alsa-lib, libXdamage, libXtst, libXrandr, libxshmfence, expat, cups
 , dbus, gtk3, gdk-pixbuf, gcc-unwrapped, at-spi2-atk, at-spi2-core
 , libkrb5, libdrm, mesa
-, libxkbcommon, wayland # ozone/wayland
+, libxkbcommon, pipewire, wayland # ozone/wayland

 # Command line programs
 , coreutils
@ -67,7 +67,7 @@ let
    flac harfbuzz icu libpng opusWithCustomModes snappy speechd
    bzip2 libcap at-spi2-atk at-spi2-core
    libkrb5 libdrm mesa coreutils
-    libxkbcommon wayland
+    libxkbcommon pipewire wayland
  ] ++ optional pulseSupport libpulseaudio
    ++ optional libvaSupport libva
    ++ optional vulkanSupport vulkan-loader
--- a/third_party/nixpkgs/pkgs/applications/networking/cluster/helm/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/cluster/helm/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "helm";
-  version = "3.6.3";
-  gitCommit = "ee407bdf364942bcb8e8c665f82e15aa28009b71";
+  version = "3.7.0";
+  gitCommit = "eeac83883cb4014fe60267ec6373570374ce770b";

  src = fetchFromGitHub {
    owner = "helm";
    repo = "helm";
    rev = "v${version}";
-    sha256 = "sha256-DfMI50eQsMHRX8S5rBzF3qlSfJizlYQyofA7HPkD4EQ=";
+    sha256 = "sha256-dV6Bx6XVzPqaRBeCzEFR473xnxjff4f24jd5vETVX78=";
  };
-  vendorSha256 = "sha256-PTAyRG6PZK+vaiheUd3oiu4iBGlnFjoCrci0CYbXjBk=";
+  vendorSha256 = "sha256-Q/ycpLCIvf+PP+03ug3fKT+uIOdzDwP7709VfFVJglk=";

  doCheck = false;

--- a/third_party/nixpkgs/pkgs/applications/networking/cluster/nomad/1.0.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/cluster/nomad/1.0.nix
@ -6,6 +6,6 @@

 callPackage ./generic.nix {
  inherit buildGoPackage nvidia_x11 nvidiaGpuSupport;
-  version = "1.0.10";
-  sha256 = "1yd4j35dmxzg9qapqyq3g3hnhxi5c4f57q43xbim8255bjyn94f0";
+  version = "1.0.11";
+  sha256 = "15h7w020p576zl91s5mr4npcmngrqqfj9xzlx6bk9i1cp6h4w0jy";
 }
--- a/third_party/nixpkgs/pkgs/applications/networking/cluster/nomad/1.1.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/cluster/nomad/1.1.nix
@ -6,7 +6,7 @@

 callPackage ./genericModule.nix {
  inherit buildGoModule nvidia_x11 nvidiaGpuSupport;
-  version = "1.1.4";
-  sha256 = "182f3sxw751s8qg16vbssplhl92i9gshgzvflwwvnxraz2795y7l";
-  vendorSha256 = "1nddknnsvb05sapbj1c52cv2fmibvdg48f88malxqblzw33wfziq";
+  version = "1.1.5";
+  sha256 = "03gxh12bd5mj1l4q3xilil806dsqaqmz93ff7ysf441frgkx3iy3";
+  vendorSha256 = "0rfd22rf76mwj489zhswah4g3dhhz6davm336xgm9dbnyaz9d8r0";
 }
--- a/third_party/nixpkgs/pkgs/applications/networking/ids/zeek/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/ids/zeek/default.nix
@ -21,11 +21,11 @@

 stdenv.mkDerivation rec {
  pname = "zeek";
-  version = "4.1.0";
+  version = "4.1.1";

  src = fetchurl {
    url = "https://download.zeek.org/zeek-${version}.tar.gz";
-    sha256 = "165kva8dgf152ahizqdk0g2y466ij2gyxja5fjxlkxcxr5p357pj";
+    sha256 = "0wq3kjc3zc5ikzwix7k7gr92v75rg6283kx5fzvc3lcdkaczq2lc";
  };

  nativeBuildInputs = [ cmake flex bison file ];
--- a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/chatterino2/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/chatterino2/default.nix
@ -2,12 +2,12 @@

 mkDerivation rec {
  pname = "chatterino2";
-  version = "2.3.0";
+  version = "2.3.4";
  src = fetchFromGitHub {
    owner = "Chatterino";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0x12zcrbkxn2nn0hqkj1amrxv4q032id282cajzsx7by970r1shd";
+    sha256 = "sha256-ZmUM56+YNH98J3XE/mWOOIfb0qBld2n4iuHpImbrU4o=";
    fetchSubmodules = true;
  };
  nativeBuildInputs = [ qmake pkg-config wrapQtAppsHook ];
--- a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
@ -20,13 +20,13 @@ let
    "${electron}/bin/electron";
 in nodePackages.deltachat-desktop.override rec {
  pname = "deltachat-desktop";
-  version = "1.22.1";
+  version = "1.22.2";

  src = fetchFromGitHub {
    owner = "deltachat";
    repo = "deltachat-desktop";
    rev = "v${version}";
-    sha256 = "0wrwjblpw3f5ky697b2nhi9lisn4q5bl05086fdkx5v5j2ghz3n9";
+    sha256 = "0in6w2vl4ypgjb9gfhyh77vg05ni5p3z24lah7wvvhywcpv1jp2n";
  };

  nativeBuildInputs = [
--- a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/deltachat-desktop/package.json
+++ b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/deltachat-desktop/package.json
@ -1,6 +1,6 @@
 {
  "name": "deltachat-desktop",
-  "version": "1.22.1",
+  "version": "1.22.2",
  "dependencies": {
    "@blueprintjs/core": "^3.22.3",
    "@mapbox/geojson-extent": "^1.0.0",
--- a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/gomuks/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/gomuks/default.nix
@ -13,16 +13,16 @@

 buildGoModule rec {
  pname = "gomuks";
-  version = "0.2.3";
+  version = "0.2.4";

  src = fetchFromGitHub {
    owner = "tulir";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0g0aa6h6bm00mdgkb38wm66rcrhqfvs2xj9rl04bwprsa05q5lca";
+    sha256 = "bTOfnEmJHTuniewH//SugNNDuKIFMQb1Safs0UVKH1c=";
  };

-  vendorSha256 = "14ya5advpv4q5il235h5dxy8c2ap2yzrvqs0sjqgw0v1vm6vpwdx";
+  vendorSha256 = "PuNROoxL7UmcuYDgfnsMUsGk9i1jnQyWtaUmT7vXdKE=";

  doCheck = false;

--- a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/gomuks/hardcoded_path.patch
+++ b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/gomuks/hardcoded_path.patch
@ -1,13 +1,15 @@
-diff --git a/lib/notification/notify_linux.go b/lib/notification/notify_linux.go
-index f93a95f..da6a61d 100644
--- a/lib/notification/notify_linux.go
-+++ b/lib/notification/notify_linux.go
-@@ -32,7 +32,7 @@ func Send(title, text string, critical, sound bool) error {
- 		if critical {
- 			soundName = "complete"
- 		}
-		exec.Command("paplay", "/usr/share/sounds/freedesktop/stereo/"+soundName+".oga").Run()
-+		exec.Command("paplay", "@soundTheme@/share/sounds/freedesktop/stereo/"+soundName+".oga").Run()
- 	}
- 	return exec.Command("notify-send", args...).Run()
- }
+diff --git a/lib/notification/notify_xdg.go b/lib/notification/notify_xdg.go
+index 7f102b8..996c15f 100644
+--- a/lib/notification/notify_xdg.go
+++ b/lib/notification/notify_xdg.go
+@@ -26,8 +26,8 @@ import (
+ var notifySendPath string
+ var audioCommand string
+ var tryAudioCommands = []string{"ogg123", "paplay"}
+-var soundNormal = "/usr/share/sounds/freedesktop/stereo/message-new-instant.oga"
+-var soundCritical = "/usr/share/sounds/freedesktop/stereo/complete.oga"
+var soundNormal = "@soundTheme@/share/sounds/freedesktop/stereo/message-new-instant.oga"
+var soundCritical = "@soundTheme@/share/sounds/freedesktop/stereo/complete.oga"
+ 
+ func getSoundPath(env, defaultPath string) string {
+ 	if path, ok := os.LookupEnv(env); ok {
--- a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/slack/default.nix
@ -44,14 +44,14 @@ let

  pname = "slack";

-  x86_64-darwin-version = "4.18.0";
-  x86_64-darwin-sha256 = "1qldmh0xdbl18gvxxsi2jvcq1ziwap3naxgax4gn36x5k25ipw5k";
+  x86_64-darwin-version = "4.19.0";
+  x86_64-darwin-sha256 = "0dj51lhxiba69as6x76ni8h20d36bcpf2xz3rxr1s8881mprpfsg";

-  x86_64-linux-version = "4.18.0";
-  x86_64-linux-sha256 = "1dhdmi2rvww8m6400c5dc0c6mrircvflgwcja2rr7ry0lv98n6kh";
+  x86_64-linux-version = "4.19.2";
+  x86_64-linux-sha256 = "02npmprwl1h7c2y03khvx8ifhk1gj1axbvlwigp2hkkjdw7y4b5a";

-  aarch64-darwin-version = "4.18.0";
-  aarch64-darwin-sha256 = "0qlfxskqq5gr45p1gfc2jcbr1abhc6di653jwjgh7yibim0hpjab";
+  aarch64-darwin-version = "4.19.0";
+  aarch64-darwin-sha256 = "1mvs1bdyyyrpqmrbqg4sxpy6ylgchwz39nr232s441iqdz45p87v";

  version = {
    x86_64-darwin = x86_64-darwin-version;
--- a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@ -60,7 +60,7 @@ let
 in
 mkDerivation rec {
  pname = "telegram-desktop";
-  version = "3.1.0";
+  version = "3.1.1";
  # Note: Update via pkgs/applications/networking/instant-messengers/telegram/tdesktop/update.py

  # Telegram-Desktop with submodules
@ -69,7 +69,7 @@ mkDerivation rec {
    repo = "tdesktop";
    rev = "v${version}";
    fetchSubmodules = true;
-    sha256 = "0507qdkz8gn0gyyhxsy4mc4rs2r94s1ipqfxrc6ghgj43jkrklx3";
+    sha256 = "0h4g8lw9hf9pwmdljavflyn9g9jvjvany7y4vji0qcc1kd99vsnp";
  };

  postPatch = ''
--- a/third_party/nixpkgs/pkgs/applications/networking/mailreaders/meli/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/mailreaders/meli/default.nix
@ -15,15 +15,15 @@

 rustPlatform.buildRustPackage rec {
  pname = "meli";
-  version = "alpha-0.6.2";
+  version = "alpha-0.7.1";

  src = fetchgit {
    url = "https://git.meli.delivery/meli/meli.git";
    rev = version;
-    sha256 = "0ycyksrrp4llwklzx3ipac8hmpfxa1pa7dqsm82wic0f6p5d1dp6";
+    sha256 = "00iai2z5zydx9bw0ii0n6d7zwm5rrkj03b4ymic0ybwjahqzvyfq";
  };

-  cargoSha256 = "sha256:0lxwhb2c16w5z7rqzch0ij8n8hxb5xcin31w9i28mzv1xm7sg8ks";
+  cargoSha256 = "1r54a51j91iv0ziasjygzw30vqqvqibcnwnkih5xv0ijbaly61n0";

  cargoBuildFlags = lib.optional withNotmuch "--features=notmuch";

--- a/third_party/nixpkgs/pkgs/applications/office/paperless-ng/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/office/paperless-ng/default.nix
@ -26,12 +26,20 @@ let
      # https://github.com/Koed00/django-q/issues/526
      django-q = super.django-q.overridePythonAttrs (oldAttrs: rec {
        version = "1.3.4";
-        src = super.fetchPypi {
-          inherit (oldAttrs) pname;
+        src = oldAttrs.src.override {
          inherit version;
          sha256 = "Uj1U3PG2YVLBtlj5FPAO07UYo0MqnezUiYc4yo274Q8=";
        };
      });
+
+      # Incompatible with aioredis 2
+      aioredis = super.aioredis.overridePythonAttrs (oldAttrs: rec {
+        version = "1.3.1";
+        src = oldAttrs.src.override {
+          inherit version;
+          sha256 = "0fi7jd5hlx8cnv1m97kv9hc4ih4l8v15wzkqwsp73is4n0qazy0m";
+        };
+      });
    };
  };

--- a/third_party/nixpkgs/pkgs/applications/office/watson/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/office/watson/default.nix
@ -30,6 +30,7 @@ in with python.pkgs; buildPythonApplication rec {
  postInstall = ''
    installShellCompletion --bash --name watson watson.completion
    installShellCompletion --zsh --name _watson watson.zsh-completion
+    installShellCompletion --fish watson.fish
  '';

  checkInputs = [ pytestCheckHook pytest-mock mock pytest-datafiles ];
--- a/third_party/nixpkgs/pkgs/applications/science/chemistry/openmolcas/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/chemistry/openmolcas/default.nix
@ -27,9 +27,15 @@ in stdenv.mkDerivation {
    ./openblasPath.patch
  ];

-  nativeBuildInputs = [ perl cmake texlive.combined.scheme-minimal makeWrapper ];
-  buildInputs = [
+  nativeBuildInputs = [
+    perl
    gfortran
+    cmake
+    texlive.combined.scheme-minimal
+    makeWrapper
+  ];
+
+  buildInputs = [
    openblas
    hdf5-cpp
    python
--- a/third_party/nixpkgs/pkgs/applications/science/chemistry/quantum-espresso/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/chemistry/quantum-espresso/default.nix
@ -28,7 +28,9 @@ stdenv.mkDerivation rec {
    patchShebangs configure
  '';

-  buildInputs = [ fftw blas lapack gfortran ]
+  nativeBuildInputs = [ gfortran ];
+
+  buildInputs = [ fftw blas lapack ]
    ++ (lib.optionals useMpi [ mpi ]);

  configureFlags = if useMpi then [ "LD=${mpi}/bin/mpif90" ] else [ "LD=${gfortran}/bin/gfortran" ];
--- a/third_party/nixpkgs/pkgs/applications/science/chemistry/siesta/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/chemistry/siesta/default.nix
@ -17,7 +17,9 @@ stdenv.mkDerivation {
    inherit mpi;
  };

-  buildInputs = [ blas lapack gfortran ]
+  nativeBuildInputs = [ gfortran ];
+
+  buildInputs = [ blas lapack ]
    ++ lib.optionals useMpi [ mpi scalapack ];

  enableParallelBuilding = true;
--- a/third_party/nixpkgs/pkgs/applications/science/math/caffe/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/math/caffe/default.nix
@ -91,7 +91,11 @@ stdenv.mkDerivation rec {
    inherit (python.sourceVersion) major minor;  # Should be changed in case of PyPy
  });

-  postPatch = lib.optionalString (cudaSupport && lib.versionAtLeast cudatoolkit.version "9.0") ''
+  postPatch = ''
+    substituteInPlace src/caffe/util/io.cpp --replace \
+      'SetTotalBytesLimit(kProtoReadBytesLimit, 536870912)' \
+      'SetTotalBytesLimit(kProtoReadBytesLimit)'
+  '' + lib.optionalString (cudaSupport && lib.versionAtLeast cudatoolkit.version "9.0") ''
    # CUDA 9.0 doesn't support sm_20
    sed -i 's,20 21(20) ,,' cmake/Cuda.cmake
  '';
--- a/third_party/nixpkgs/pkgs/applications/science/math/cntk/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/math/cntk/default.nix
@ -1,4 +1,5 @@
 { lib, stdenv, fetchgit, fetchFromGitHub, cmake
+, fetchpatch
 , openblas, blas, lapack, opencv3, libzip, boost, protobuf, mpi
 , onebitSGDSupport ? false
 , cudaSupport ? false, addOpenGLRunpath, cudatoolkit, nvidia_x11
@ -28,6 +29,26 @@ in stdenv.mkDerivation rec {
    sha256 = "18l9k7s966a26ywcf7flqyhm61788pcb9fj3wk61jrmgkhy2pcns";
  };

+  patches = [
+    # Fix build with protobuf 3.18+
+    # Remove with onnx submodule bump to 1.9+
+    (fetchpatch {
+      url = "https://github.com/onnx/onnx/commit/d3bc82770474761571f950347560d62a35d519d7.patch";
+      extraPrefix = "Source/CNTKv2LibraryDll/proto/onnx/onnx_repo/";
+      stripLen = 1;
+      sha256 = "00raqj8wx30b06ky6cdp5vvc1mrzs7hglyi6h58hchw5lhrwkzxp";
+    })
+  ];
+
+  postPatch = ''
+    # Fix build with protobuf 3.18+
+    substituteInPlace Source/CNTKv2LibraryDll/Serialization.cpp \
+      --replace 'SetTotalBytesLimit(INT_MAX, INT_MAX)' \
+                'SetTotalBytesLimit(INT_MAX)' \
+      --replace 'SetTotalBytesLimit(limit, limit)' \
+                'SetTotalBytesLimit(limit)'
+  '';
+
  nativeBuildInputs = [ cmake ] ++ lib.optional cudaSupport addOpenGLRunpath;

  # Force OpenMPI to use g++ in PATH.
--- a/third_party/nixpkgs/pkgs/applications/science/math/jags/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/math/jags/default.nix
@ -6,7 +6,11 @@ stdenv.mkDerivation rec {
    url = "mirror://sourceforge/mcmc-jags/${name}.tar.gz";
    sha256 = "1z3icccg2ic56vmhyrpinlsvpq7kcaflk1731rgpvz9bk1bxvica";
  };
-  buildInputs = [gfortran blas lapack];
+
+  nativeBuildInputs = [ gfortran ];
+
+  buildInputs = [ blas lapack ];
+
  configureFlags = [ "--with-blas=-lblas" "--with-lapack=-llapack" ];

  meta = with lib; {
--- a/third_party/nixpkgs/pkgs/applications/science/math/scilab/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/math/scilab/default.nix
@ -19,11 +19,12 @@ stdenv.mkDerivation rec {
    sha256 = "1adk6jqlj7i3gjklvlf1j3il1nb22axnp4rvwl314an62siih0sc";
  };

-  buildInputs = [gfortran ncurses]
+  nativeBuildInputs = [ gfortran ];
+
+  buildInputs = [ ncurses ]
    ++ lib.optionals withGtk [ gtk2 ]
    ++ lib.optionals withOCaml [ ocaml ]
-  ++ lib.optional withX xlibsWrapper
-  ;
+    ++ lib.optional withX xlibsWrapper;


 /*
--- a/third_party/nixpkgs/pkgs/applications/science/molecular-dynamics/dl-poly-classic/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/molecular-dynamics/dl-poly-classic/default.nix
@ -11,7 +11,9 @@ stdenv.mkDerivation {
    sha256 = "1r76zvln3bwycxlmqday0sqzv5j260y7mdh66as2aqny6jzd5ld7";
  };

-  buildInputs = [ mpi gfortran ];
+  nativeBuildInputs = [ gfortran ];
+
+  buildInputs = [ mpi ];

  configurePhase = ''
    cd source
--- a/third_party/nixpkgs/pkgs/applications/science/physics/elmerfem/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/physics/elmerfem/default.nix
@ -13,8 +13,8 @@ stdenv.mkDerivation rec {

  hardeningDisable = [ "format" ];

-  nativeBuildInputs = [ cmake pkg-config git ];
-  buildInputs = [ gfortran mpi blas liblapack qt4 qwt6_qt4 ];
+  nativeBuildInputs = [ cmake gfortran pkg-config git ];
+  buildInputs = [ mpi blas liblapack qt4 qwt6_qt4 ];

  preConfigure = ''
    patchShebangs ./
--- a/third_party/nixpkgs/pkgs/applications/science/physics/sherpa/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/physics/sherpa/default.nix
@ -13,7 +13,10 @@ stdenv.mkDerivation rec {
    sed -ie '/sys\/sysctl.h/d' ATOOLS/Org/Run_Parameter.C
  '';

-  buildInputs = [ gfortran sqlite lhapdf rivet ];
+
+  nativeBuildInputs = [ gfortran ];
+
+  buildInputs = [ sqlite lhapdf rivet ];

  enableParallelBuilding = true;

--- a/third_party/nixpkgs/pkgs/applications/terminal-emulators/xterm/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/terminal-emulators/xterm/default.nix
@ -4,14 +4,14 @@

 stdenv.mkDerivation rec {
  pname = "xterm";
-  version = "368";
+  version = "369";

  src = fetchurl {
    urls = [
      "ftp://ftp.invisible-island.net/xterm/${pname}-${version}.tgz"
      "https://invisible-mirror.net/archives/xterm/${pname}-${version}.tgz"
    ];
-    sha256 = "L/UWmTC2tJ7wuvteEzHJTxqYwxBEK7p3mK3YIcdq5xI=";
+    sha256 = "ce1qSNBkiT0hSXQaACeBqXNJb9JNUtrdNk9jQ5p2TiY=";
  };

  strictDeps = true;
--- a/third_party/nixpkgs/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/git-and-tools/git/default.nix
@ -65,6 +65,9 @@ stdenv.mkDerivation {
    # Fix references to gettext introduced by ./git-sh-i18n.patch
    substituteInPlace git-sh-i18n.sh \
        --subst-var-by gettext ${gettext}
+
+    # ensure we are using the correct shell when executing the test scripts
+    patchShebangs t/*.sh
  '';

  nativeBuildInputs = [ gettext perlPackages.perl makeWrapper ]
@ -318,6 +321,7 @@ stdenv.mkDerivation {

    # Flaky tests:
    disable_test t5319-multi-pack-index
+    disable_test t6421-merge-partial-clone

    ${lib.optionalString (!perlSupport) ''
      # request-pull is a Bash script that invokes Perl, so it is not available
--- a/third_party/nixpkgs/pkgs/build-support/alternatives/blas/default.nix
+++ b/third_party/nixpkgs/pkgs/build-support/alternatives/blas/default.nix
@ -82,7 +82,7 @@ stdenv.mkDerivation {
  patchelf --set-rpath "$(patchelf --print-rpath $out/lib/libblas${canonicalExtension}):${lib.getLib blasProvider}/lib" $out/lib/libblas${canonicalExtension}
 '' else if stdenv.hostPlatform.isDarwin then ''
  install_name_tool \
-    -id libblas${canonicalExtension} \
+    -id $out/lib/libblas${canonicalExtension} \
    -add_rpath ${lib.getLib blasProvider}/lib \
    $out/lib/libblas${canonicalExtension}
 '' else "") + ''
@ -114,7 +114,7 @@ EOF
  patchelf --set-rpath "$(patchelf --print-rpath $out/lib/libcblas${canonicalExtension}):${lib.getLib blasProvider}/lib" $out/lib/libcblas${canonicalExtension}
 '' else if stdenv.hostPlatform.isDarwin then ''
  install_name_tool \
-    -id libcblas${canonicalExtension} \
+    -id $out/lib/libcblas${canonicalExtension} \
    -add_rpath ${lib.getLib blasProvider}/lib \
    $out/lib/libcblas${canonicalExtension}
 '' else "") + ''
--- a/third_party/nixpkgs/pkgs/build-support/fetchfirefoxaddon/tests.nix
+++ b/third_party/nixpkgs/pkgs/build-support/fetchfirefoxaddon/tests.nix
@ -0,0 +1,10 @@
+{ invalidateFetcherByDrvHash, fetchFirefoxAddon, ... }:
+
+{
+  simple = invalidateFetcherByDrvHash fetchFirefoxAddon {
+    name = "image-search-options";
+    # Chosen because its only 147KB
+    url = "https://addons.mozilla.org/firefox/downloads/file/3059971/image_search_options-3.0.12-fx.xpi";
+    sha256 = "sha256-H73YWX/DKxvhEwKpWOo7orAQ7c/rQywpljeyxYxv0Gg=";
+  };
+}
--- a/third_party/nixpkgs/pkgs/build-support/setup-hooks/compress-man-pages.sh
+++ b/third_party/nixpkgs/pkgs/build-support/setup-hooks/compress-man-pages.sh
@ -9,7 +9,7 @@ compressManPages() {
    echo "gzipping man pages under $dir/share/man/"

    # Compress all uncompressed manpages.  Don't follow symlinks, etc.
-    find "$dir"/share/man/ -type f -a '!' -regex '.*\.\(bz2\|gz\)$' -print0 \
+    find "$dir"/share/man/ -type f -a '!' -regex '.*\.\(bz2\|gz\|xz\)$' -print0 \
        | while IFS= read -r -d $'\0' f
    do
        if gzip -c -n "$f" > "$f".gz; then
@ -20,7 +20,7 @@ compressManPages() {
    done

    # Point symlinks to compressed manpages.
-    find "$dir"/share/man/ -type l -a '!' -regex '.*\.\(bz2\|gz\)$' -print0 \
+    find "$dir"/share/man/ -type l -a '!' -regex '.*\.\(bz2\|gz\|xz\)$' -print0 \
        | sort -z \
        | while IFS= read -r -d $'\0' f
    do
--- a/third_party/nixpkgs/pkgs/build-support/setup-hooks/move-docs.sh
+++ b/third_party/nixpkgs/pkgs/build-support/setup-hooks/move-docs.sh
@ -6,7 +6,7 @@ preFixupHooks+=(_moveToShare)

 _moveToShare() {
    forceShare=${forceShare:=man doc info}
-    if [ -z "$forceShare" -o -z "$out" ]; then return; fi
+    if [[ -z "$out" ]]; then return; fi

    for d in $forceShare; do
        if [ -d "$out/$d" ]; then
--- a/third_party/nixpkgs/pkgs/data/fonts/chonburi/default.nix
+++ b/third_party/nixpkgs/pkgs/data/fonts/chonburi/default.nix
@ -0,0 +1,41 @@
+{ lib, stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "chonburi";
+  version = "unstable-2021-09-15";
+
+  src = fetchFromGitHub {
+    owner = "cadsondemak";
+    repo = pname;
+    rev = "daf26bf77d82fba50eaa3aa3fad905cb9f6b5e28";
+    sha256 = "sha256-oC7ZCfNOyvGtqT9+Ap/CfCHzdWNzeCuac2dJ9fctgB8=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/doc/chonburi $out/share/fonts/{opentype,truetype}
+
+    cp $src/OFL.txt $src/BRIEF.md $out/share/doc/chonburi
+    cp $src/fonts/*.otf $out/share/fonts/opentype
+    cp $src/fonts/*.ttf $out/share/fonts/truetype
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://cadsondemak.github.io/chonburi/";
+    description = "A Didonic Thai and Latin display typeface";
+    longDescription = ''
+      The objective of this project is to create a Thai and Latin Display
+      typeface. Chonburi is a display typeface with high contrast in a Didone
+      style. This single-weight typeface provides advance typographical support
+      with features such as discretionary ligature. This font can be extended
+      the family to other weights including both narrow and extended version. It
+      is also ready to be matched with other non-Latin script.
+    '';
+    license = licenses.ofl;
+    platforms = platforms.all;
+    maintainers = [ maintainers.toastal ];
+  };
+}
--- a/third_party/nixpkgs/pkgs/data/fonts/kanit/default.nix
+++ b/third_party/nixpkgs/pkgs/data/fonts/kanit/default.nix
@ -12,12 +12,16 @@ stdenv.mkDerivation rec {
  };

  installPhase = ''
-    mkdir -p $out/share/doc/${pname}/css/ $out/share/fonts/{opentype,truetype}
+    runHook preInstall

-    cp $src/OFL.txt $src/documentation/{BRIEF.md,features.html} $out/share/doc/${pname}
-    cp $src/documentation/css/fonts.css $out/share/doc/${pname}/css
+    mkdir -p $out/share/doc/kanit/css/ $out/share/fonts/{opentype,truetype}
+
+    cp $src/OFL.txt $src/documentation/{BRIEF.md,features.html} $out/share/doc/kanit
+    cp $src/documentation/css/fonts.css $out/share/doc/kanit/css
    cp $src/fonts/otf/*.otf $out/share/fonts/opentype
    cp $src/fonts/ttf/*.ttf $out/share/fonts/truetype
+
+    runHook postInstall
  '';

  meta = with lib; {
--- a/third_party/nixpkgs/pkgs/data/fonts/unifont/default.nix
+++ b/third_party/nixpkgs/pkgs/data/fonts/unifont/default.nix
@ -4,16 +4,16 @@

 stdenv.mkDerivation rec {
  pname = "unifont";
-  version = "13.0.06";
+  version = "14.0.01";

  ttf = fetchurl {
    url = "mirror://gnu/unifont/${pname}-${version}/${pname}-${version}.ttf";
-    sha256 = "0hp72lcj8q8cw490lxl5y1ygw9mcicryjwqr1mmkdz8zh4jh8g6p";
+    sha256 = "19algkm4nnixmzshc25rjgh8gfccqinallgi86wgvkcwcmn6ccn6";
  };

  pcf = fetchurl {
    url = "mirror://gnu/unifont/${pname}-${version}/${pname}-${version}.pcf.gz";
-    sha256 = "0y030km1x8mai8zrk661dqsb0yq8rpx6akl7p2sw5ijkcdsfm85f";
+    sha256 = "1aj29pswi6qwpvjwncv5w3ndwy2nzli0200i6dx6f80036z8nz9i";
  };

  nativeBuildInputs = [ libfaketime fonttosfnt mkfontscale ];
--- a/third_party/nixpkgs/pkgs/data/fonts/unifont_upper/default.nix
+++ b/third_party/nixpkgs/pkgs/data/fonts/unifont_upper/default.nix
@ -1,7 +1,7 @@
 { lib, fetchzip }:

 let
-  version = "13.0.06";
+  version = "14.0.01";
 in fetchzip rec {
  name = "unifont_upper-${version}";

@ -9,7 +9,7 @@ in fetchzip rec {

  postFetch = "install -Dm644 $downloadedFile $out/share/fonts/truetype/unifont_upper.ttf";

-  sha256 = "0bqw30h5b787dw8bn1dj8shz22mlxr1zmcfp68fpyll5vg02540n";
+  sha256 = "0sb3m2qg0ri7zmxhjvrq8n0jmxxjx8rrx9rpibh5f5fbfkibq4gm";

  meta = with lib; {
    description = "Unicode font for glyphs above the Unicode Basic Multilingual Plane";
--- a/third_party/nixpkgs/pkgs/data/misc/shared-mime-info/default.nix
+++ b/third_party/nixpkgs/pkgs/data/misc/shared-mime-info/default.nix
@ -16,6 +16,8 @@ stdenv.mkDerivation rec {
  pname = "shared-mime-info";
  version = "2.1";

+  outputs = [ "out" "dev" ];
+
  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
    owner = "xdg";
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/elementary-photos/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/elementary-photos/default.nix
@ -1,12 +1,11 @@
 { lib, stdenv
 , fetchFromGitHub
-, fetchpatch
 , nix-update-script
 , pantheon
 , meson
 , ninja
 , pkg-config
-, vala
+, vala_0_52
 , desktop-file-utils
 , gtk3
 , libaccounts-glib
@ -35,7 +34,7 @@

 stdenv.mkDerivation rec {
  pname = "elementary-photos";
-  version = "2.7.1";
+  version = "2.7.2";

  repoName = "photos";

@ -43,18 +42,9 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "1dql14k43rv3in451amiwv4z71hz3ailx67hd8gw1ka3yw12128p";
+    sha256 = "1zq9zfsc987vvrzadw9xqi3rlbi4jv2s82axkgy7ijm3ibi58ddc";
  };

-  patches = [
-    # Upstream code not respecting our localedir
-    # https://github.com/elementary/photos/pull/629
-    (fetchpatch {
-      url = "https://github.com/elementary/photos/commit/e5230a4305381734e93f1e3d1177da21a8a4121b.patch";
-      sha256 = "1igqq51sj1sx6rl8yrw037jsgnaxfwzfs0m6pqzb9q4jvfdimzfi";
-    })
-  ];
-
  passthru = {
    updateScript = nix-update-script {
      attrPath = "pantheon.${pname}";
@ -68,7 +58,9 @@ stdenv.mkDerivation rec {
    ninja
    pkg-config
    python3
-    vala
+    # Does not build with vala 0.54
+    # https://github.com/elementary/photos/issues/638
+    vala_0_52
    wrapGAppsHook
  ];

--- a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/keyboard/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/keyboard/default.nix
@ -2,7 +2,6 @@
 , fetchFromGitHub
 , nix-update-script
 , pantheon
-, fetchpatch
 , substituteAll
 , meson
 , ninja
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/mouse-touchpad/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/apps/switchboard-plugs/mouse-touchpad/default.nix
@ -1,6 +1,5 @@
 { lib, stdenv
 , fetchFromGitHub
-, fetchpatch
 , nix-update-script
 , substituteAll
 , pantheon
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix
@ -1,6 +1,5 @@
 { lib, stdenv
 , fetchFromGitHub
-, fetchpatch
 , nix-update-script
 , linkFarm
 , substituteAll
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/gala/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/gala/default.nix
@ -1,7 +1,6 @@
 { lib, stdenv
 , fetchFromGitHub
 , nix-update-script
-, fetchpatch
 , pantheon
 , pkg-config
 , meson
@ -30,13 +29,13 @@

 stdenv.mkDerivation rec {
  pname = "gala";
-  version = "6.0.1";
+  version = "6.2.0";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "0xp9vviamzdwlcnx4836sxaz2pyfkxswgvjm73ppn7fkdm0zjpzx";
+    sha256 = "1yxsfshahaxiqs5waj4v96rhjhdgyd1za4pwlg3vqq51p75k2b1g";
  };

  passthru = {
@ -75,13 +74,12 @@ stdenv.mkDerivation rec {
  ];

  patches = [
-    # Upstream code not respecting our localedir
-    # https://github.com/elementary/gala/pull/1205
-    (fetchpatch {
-      url = "https://github.com/elementary/gala/commit/605aa10ea2a78650e001b2a247c5f7afce478b05.patch";
-      sha256 = "0bg67wzrnmx8nlw93i35vhyfx8al0bj0lacgci98vwlp2m1jgbd2";
-    })
    ./plugins-dir.patch
+    # https://github.com/elementary/gala/pull/1259
+    # https://github.com/NixOS/nixpkgs/issues/139404
+    # Remove this patch when it is included in a new release
+    # of gala OR when we no longer use mutter 3.38 for pantheon
+    ./fix-session-crash-when-taking-screenshots.patch
  ];

  postPatch = ''
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/gala/fix-session-crash-when-taking-screenshots.patch
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/gala/fix-session-crash-when-taking-screenshots.patch
@ -0,0 +1,50 @@
+From fa3c39331d4ef56a13019f45d811bde1fc755c21 Mon Sep 17 00:00:00 2001
+From: Bobby Rong <rjl931189261@126.com>
+Date: Sat, 25 Sep 2021 23:21:01 +0800
+Subject: [PATCH] Fix session crash when taking screenshots with mutter 3.38
+
+---
+ src/ScreenshotManager.vala | 5 ++---
+ vapi/mutter-clutter.vapi   | 2 +-
+ 2 files changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/src/ScreenshotManager.vala b/src/ScreenshotManager.vala
+index 3ffb0123..388fee1a 100644
+--- a/src/ScreenshotManager.vala
+++ b/src/ScreenshotManager.vala
+@@ -354,12 +354,11 @@ namespace Gala {
+                 paint_flags |= Clutter.PaintFlag.FORCE_CURSORS;
+             }
+ 
+-            unowned var data = image.get_data ();
+             if (GLib.ByteOrder.HOST == GLib.ByteOrder.LITTLE_ENDIAN) {
+                 wm.stage.paint_to_buffer (
+                     {x, y, width, height},
+                     scale,
+-                    ref data,
+                    image.get_data (),
+                     image.get_stride (),
+                     Cogl.PixelFormat.BGRA_8888_PRE,
+                     paint_flags
+@@ -368,7 +367,7 @@ namespace Gala {
+                 wm.stage.paint_to_buffer (
+                     {x, y, width, height},
+                     scale,
+-                    ref data,
+                    image.get_data (),
+                     image.get_stride (),
+                     Cogl.PixelFormat.ARGB_8888_PRE,
+                     paint_flags
+diff --git a/vapi/mutter-clutter.vapi b/vapi/mutter-clutter.vapi
+index 5b778cb2..95de24be 100644
+--- a/vapi/mutter-clutter.vapi
+++ b/vapi/mutter-clutter.vapi
+@@ -7336,7 +7336,7 @@ namespace Clutter {
+ 		[Version (since = "1.2")]
+ 		public bool get_use_alpha ();
+ #if HAS_MUTTER338
+-		public bool paint_to_buffer (Cairo.RectangleInt rect, float scale, [CCode (array_length = false)] ref unowned uint8[] data, int stride, Cogl.PixelFormat format, Clutter.PaintFlag paint_flags) throws GLib.Error;
+		public bool paint_to_buffer (Cairo.RectangleInt rect, float scale, [CCode (array_length = false, type = "uint8_t*")] uint8[] data, int stride, Cogl.PixelFormat format, Clutter.PaintFlag paint_flags) throws GLib.Error;
+ 		public void paint_to_framebuffer (Cogl.Framebuffer framebuffer, Cairo.RectangleInt rect, float scale, Clutter.PaintFlag paint_flags);
+ #else
+ 		[Version (since = "0.4")]
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel-indicators/sound/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel-indicators/sound/default.nix
@ -7,7 +7,7 @@
 , meson
 , python3
 , ninja
-, vala
+, vala_0_52
 , gtk3
 , granite
 , wingpanel
@ -50,7 +50,9 @@ stdenv.mkDerivation rec {
    ninja
    pkg-config
    python3
-    vala
+    # Does not build with vala 0.54
+    # https://github.com/elementary/wingpanel-indicator-sound/issues/219
+    vala_0_52
  ];

  buildInputs = [
--- a/third_party/nixpkgs/pkgs/desktops/plasma-5/fetch.sh
+++ b/third_party/nixpkgs/pkgs/desktops/plasma-5/fetch.sh
@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/plasma/5.22.4/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/plasma/5.22.5/ -A '*.tar.xz' )
--- a/third_party/nixpkgs/pkgs/desktops/plasma-5/kwin/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/plasma-5/kwin/default.nix
@ -40,6 +40,18 @@ mkDerivation {
    ./0002-xwayland.patch
    ./0003-plugins-qpa-allow-using-nixos-wrapper.patch
    ./0001-NixOS-Unwrap-executable-name-for-.desktop-search.patch
+    # Fix build against libglvnd 1.3.4+
+    # Remove with release 5.22.90
+    (fetchpatch {
+      url = "https://invent.kde.org/plasma/kwin/-/commit/839710201c389b7f4ed248cb3818e755a37ce977.patch";
+      sha256 = "09rldhy0sbmqdfpyjzwm20cwnmrmj0w2751vyi5xlr414g0rzyc1";
+    })
+    # Fixup previous patch for i686
+    # Remove with release 5.22.90
+    (fetchpatch {
+      url = "https://invent.kde.org/plasma/kwin/-/commit/38e24ecd6416a975db0989c21b70d6a4cc242f35.patch";
+      sha256 = "0zsjmzswcnvfd2jm1c8i9aijpbap1141mjv6y4j282bplyqlp966";
+    })
  ];
  CXXFLAGS = [
    ''-DNIXPKGS_XWAYLAND=\"${lib.getBin xwayland}/bin/Xwayland\"''
--- a/third_party/nixpkgs/pkgs/desktops/plasma-5/srcs.nix
+++ b/third_party/nixpkgs/pkgs/desktops/plasma-5/srcs.nix
@ -4,427 +4,427 @@

 {
  bluedevil = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/bluedevil-5.22.4.tar.xz";
-      sha256 = "10bqk46ygnf72aqxxaxlx4khv1gwj46la1czsjmlszvkcqxrpwa0";
-      name = "bluedevil-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/bluedevil-5.22.5.tar.xz";
+      sha256 = "01fc5zk3qh3kx8z3dpikaaidi6vg21s75kmpd9w65rj5akg98452";
+      name = "bluedevil-5.22.5.tar.xz";
    };
  };
  breeze = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/breeze-5.22.4.tar.xz";
-      sha256 = "1b4zrwpaayd6mlwsnwg416ryba32zpg8w2dlh56qbmg6jxzjnybx";
-      name = "breeze-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/breeze-5.22.5.tar.xz";
+      sha256 = "09ll0bddsbbhz7ihqcn0wbd2llbjrblgk90gp556kpy09jh4rz73";
+      name = "breeze-5.22.5.tar.xz";
    };
  };
  breeze-grub = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/breeze-grub-5.22.4.tar.xz";
-      sha256 = "19zlhq3k80id676sxlf8nhk0a11rkrwmbd256aggdwhz1fivxc1c";
-      name = "breeze-grub-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/breeze-grub-5.22.5.tar.xz";
+      sha256 = "1p08pmhkac3s5pccryy5s33594kr0v8z6j1hg94l419nzaqqya1v";
+      name = "breeze-grub-5.22.5.tar.xz";
    };
  };
  breeze-gtk = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/breeze-gtk-5.22.4.tar.xz";
-      sha256 = "1p47vsr2xj00p1r2jhyns2wzchjlhymzzyv2xqy9xd4l8pkv8scb";
-      name = "breeze-gtk-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/breeze-gtk-5.22.5.tar.xz";
+      sha256 = "0lifs97wad9cg5hp1vdd5ag9fkcbqj3h2bkg6x5jd4f41j0x2fy2";
+      name = "breeze-gtk-5.22.5.tar.xz";
    };
  };
  breeze-plymouth = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/breeze-plymouth-5.22.4.tar.xz";
-      sha256 = "0b9sjn8lfhgyc2sz1r9rnknkas79526qmwi5j3wbxb0va2rcap9z";
-      name = "breeze-plymouth-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/breeze-plymouth-5.22.5.tar.xz";
+      sha256 = "1735ii7is873yz6rhcsrj81crvmdxj4a368k22rkj8nm374s44g1";
+      name = "breeze-plymouth-5.22.5.tar.xz";
    };
  };
  discover = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/discover-5.22.4.tar.xz";
-      sha256 = "0ij7b1fyv9rgiw6ywgxzj35c9bd3937w3njzqmkzi2l9zlnrzwvg";
-      name = "discover-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/discover-5.22.5.tar.xz";
+      sha256 = "1c22910ainm4819xzkri8j2x8lng0g6zgmh1k770jsgjyg49x069";
+      name = "discover-5.22.5.tar.xz";
    };
  };
  drkonqi = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/drkonqi-5.22.4.tar.xz";
-      sha256 = "1dy5v50icnlwa4pl5z30q5abv2sbznlrpgiy28hh1mf64hx6hl3w";
-      name = "drkonqi-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/drkonqi-5.22.5.tar.xz";
+      sha256 = "1f23p35wzsk0wx2kz0r7x616in6kizzdvl9j37v2a94hh8z3f7my";
+      name = "drkonqi-5.22.5.tar.xz";
    };
  };
  kactivitymanagerd = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/kactivitymanagerd-5.22.4.tar.xz";
-      sha256 = "1km0mlqyrvflq45gwffrbwvkrqirb44qn1rp37iif4d82pmx11yv";
-      name = "kactivitymanagerd-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/kactivitymanagerd-5.22.5.tar.xz";
+      sha256 = "069a862myj9b0303qc6j8iv3mdja8qhzx5ax52206pjrglvn9ar2";
+      name = "kactivitymanagerd-5.22.5.tar.xz";
    };
  };
  kde-cli-tools = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/kde-cli-tools-5.22.4.tar.xz";
-      sha256 = "1kh8pba9q61qjjpc945nvx42mm63vrj5bny4iv60jgcfxxwy7qj4";
-      name = "kde-cli-tools-5.22.4.tar.xz";
-    };
-  };
-  kdecoration = {
-    version = "5.22.4";
-    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/kdecoration-5.22.4.tar.xz";
-      sha256 = "0cc0lskm359lbg93bxny84cf1qnk0h53f64bxy3dvbyn5gmvzsch";
-      name = "kdecoration-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/kde-cli-tools-5.22.5.tar.xz";
+      sha256 = "1jj5vywai9di05wzr81dzvrcsb5h6l300llw3ma49f0jl4z3gjwh";
+      name = "kde-cli-tools-5.22.5.tar.xz";
    };
  };
  kde-gtk-config = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/kde-gtk-config-5.22.4.tar.xz";
-      sha256 = "0d56brzpk5yi7cdyvpqg3jlk5n3l2dvk98npw34fd4i3gw357px8";
-      name = "kde-gtk-config-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/kde-gtk-config-5.22.5.tar.xz";
+      sha256 = "0v0yjy6diwby3y71kkipx8h0wxfc49nwr2r3g2j8cf9ybqnwmy6s";
+      name = "kde-gtk-config-5.22.5.tar.xz";
+    };
+  };
+  kdecoration = {
+    version = "5.22.5";
+    src = fetchurl {
+      url = "${mirror}/stable/plasma/5.22.5/kdecoration-5.22.5.tar.xz";
+      sha256 = "1vqv44ls79x2d71ldkkkzpk4mzpv110y270wf1gbkmxaxwp20xxm";
+      name = "kdecoration-5.22.5.tar.xz";
    };
  };
  kdeplasma-addons = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/kdeplasma-addons-5.22.4.tar.xz";
-      sha256 = "1flf4mq0zcjh7fnv155hklliidfvflh20d1s84rj8q2ka7phcwk0";
-      name = "kdeplasma-addons-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/kdeplasma-addons-5.22.5.tar.xz";
+      sha256 = "00ricjqxcafhji8b33zqynrlh56z3nr516v5jghp8cz2wclvnh32";
+      name = "kdeplasma-addons-5.22.5.tar.xz";
    };
  };
  kgamma5 = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/kgamma5-5.22.4.tar.xz";
-      sha256 = "0fgx9i031iqrp7w7v7px1vha079cjcdv9w5ah4k1m53g8abriddl";
-      name = "kgamma5-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/kgamma5-5.22.5.tar.xz";
+      sha256 = "0m2h4wwkg3dnkvq31z8mvn4q1r7hwi1q2d7csy350ycrv9x7f402";
+      name = "kgamma5-5.22.5.tar.xz";
    };
  };
  khotkeys = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/khotkeys-5.22.4.tar.xz";
-      sha256 = "1lm1xrbrpym7nhvnzljdgr5nsas8z3i0hgda53j5k6svzk5r3qg8";
-      name = "khotkeys-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/khotkeys-5.22.5.tar.xz";
+      sha256 = "1l0p9q7bmljism188mzssryyd31b1x0alivnpsk0jhhjr9hwbqb4";
+      name = "khotkeys-5.22.5.tar.xz";
    };
  };
  kinfocenter = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/kinfocenter-5.22.4.tar.xz";
-      sha256 = "14vfz5j3fxhfb1fip00fgg9k6dc9ffjf0ss8ij1cx7bga14nmzvw";
-      name = "kinfocenter-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/kinfocenter-5.22.5.tar.xz";
+      sha256 = "1pxr4pihy6asflpij5r4payxnbagzkli3qm5zh4zgap4bhq447lm";
+      name = "kinfocenter-5.22.5.tar.xz";
    };
  };
  kmenuedit = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/kmenuedit-5.22.4.tar.xz";
-      sha256 = "186j8ky5z3l0mmxx327xzahhsyf7wlds1rsmzzmlxficpg43n90b";
-      name = "kmenuedit-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/kmenuedit-5.22.5.tar.xz";
+      sha256 = "1in8q0hd8wgcnwmx0cpv2w5l2w75xhv5j38mc5py322h9gkg1mqs";
+      name = "kmenuedit-5.22.5.tar.xz";
    };
  };
  kscreen = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/kscreen-5.22.4.tar.xz";
-      sha256 = "0hkn7ap55x4rzm6x3qdinjar9qhnb742zgzmvswy1kn3a8mxby17";
-      name = "kscreen-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/kscreen-5.22.5.tar.xz";
+      sha256 = "0q0ykp10nwfzzxjrcra11k4b81di4r37jbhis4b9wn9j0pqv3ykb";
+      name = "kscreen-5.22.5.tar.xz";
    };
  };
  kscreenlocker = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/kscreenlocker-5.22.4.tar.xz";
-      sha256 = "0i7c6a378h7366h7nl5051mwrx7cadzfaryfnhpskhlgy3l7119j";
-      name = "kscreenlocker-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/kscreenlocker-5.22.5.tar.xz";
+      sha256 = "107icbr0cdcpbzi5npgx3fw2m2wp1z91k1iw26n595dp3n2czv98";
+      name = "kscreenlocker-5.22.5.tar.xz";
    };
  };
  ksshaskpass = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/ksshaskpass-5.22.4.tar.xz";
-      sha256 = "01f2rz1xqb1jy83427f7rmsb3a7ivkgf2qmm04kwjv29zplg796f";
-      name = "ksshaskpass-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/ksshaskpass-5.22.5.tar.xz";
+      sha256 = "0ig2cx80ba57k9mq7bcnmriymjln7kvr81mgm5rsdi4asal2zpgp";
+      name = "ksshaskpass-5.22.5.tar.xz";
    };
  };
  ksystemstats = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/ksystemstats-5.22.4.tar.xz";
-      sha256 = "1daz3890v7qbkcsb9m535mfnijdq3rbasxwqs0ixhn2m400yivvg";
-      name = "ksystemstats-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/ksystemstats-5.22.5.tar.xz";
+      sha256 = "1cb5hbwnj6j9ziin6bflcz9b8jyvjqbqqhqbzvgs8dyji2xz0gb8";
+      name = "ksystemstats-5.22.5.tar.xz";
    };
  };
  kwallet-pam = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/kwallet-pam-5.22.4.tar.xz";
-      sha256 = "1ljrrgjvkvs3fsiijgaxj82hzp1fhsiy39r4amwp21v411c80jwq";
-      name = "kwallet-pam-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/kwallet-pam-5.22.5.tar.xz";
+      sha256 = "03rj2kgda1as547jjvvigkb4pblh1w9jv8hsrjrs5vwfir0ag8nq";
+      name = "kwallet-pam-5.22.5.tar.xz";
    };
  };
  kwayland-integration = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/kwayland-integration-5.22.4.tar.xz";
-      sha256 = "17nl033vl8i9a92bjbgwwwrkf03lg4726lwdbj3y8xajdp8ql1nb";
-      name = "kwayland-integration-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/kwayland-integration-5.22.5.tar.xz";
+      sha256 = "0kgv6klb32y7ckflsi5xbs8ajn7zg461621fqhmgn1x54w931g2c";
+      name = "kwayland-integration-5.22.5.tar.xz";
    };
  };
  kwayland-server = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/kwayland-server-5.22.4.tar.xz";
-      sha256 = "0z3ni5ar2bwpc75ssb3qmkbff85a489sxr7vzqhxa40n48bp85ns";
-      name = "kwayland-server-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/kwayland-server-5.22.5.tar.xz";
+      sha256 = "17gkbcam9dpqbw618rvb5ia8inp0yvpyr3bxd0fn4fdj57bbsr6x";
+      name = "kwayland-server-5.22.5.tar.xz";
    };
  };
  kwin = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/kwin-5.22.4.tar.xz";
-      sha256 = "1x5338aib7kn1lgpb06b8s06bfj2ybfgyr6k0q91zlc53x61qamh";
-      name = "kwin-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/kwin-5.22.5.tar.xz";
+      sha256 = "18zmzhmjr6q5vsfd7lr0ym5ga7l2x8xcxqizmpfnb7hv3kaax38j";
+      name = "kwin-5.22.5.tar.xz";
    };
  };
  kwrited = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/kwrited-5.22.4.tar.xz";
-      sha256 = "1rbkbqf5v8wqd2aldpg396ki8a9fsw82jmzmdhsirq33r5yznn4i";
-      name = "kwrited-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/kwrited-5.22.5.tar.xz";
+      sha256 = "02cffj88hqs5rfvrkkmk9z23qsdnqhavm98hksx1v5ajjh4rbgb3";
+      name = "kwrited-5.22.5.tar.xz";
    };
  };
  layer-shell-qt = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/layer-shell-qt-5.22.4.tar.xz";
-      sha256 = "11iqk4bla0y0w2frmvzxi4a3jxj3cj2m8y473z3nfb0z8i5yca0m";
-      name = "layer-shell-qt-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/layer-shell-qt-5.22.5.tar.xz";
+      sha256 = "0i9gsckqk9608drxvym6ghcwxqilcf6ilcxq48sbrnpswid71k7z";
+      name = "layer-shell-qt-5.22.5.tar.xz";
    };
  };
  libkscreen = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/libkscreen-5.22.4.tar.xz";
-      sha256 = "0z2mzha22f2yl7l0ijy4pqpab6n1ivib3grnd583znff02wvj4d2";
-      name = "libkscreen-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/libkscreen-5.22.5.tar.xz";
+      sha256 = "1qqnra28r698kbps6ywk22ncac4sm3f9d9wrwmicp963mkmwlksv";
+      name = "libkscreen-5.22.5.tar.xz";
    };
  };
  libksysguard = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/libksysguard-5.22.4.tar.xz";
-      sha256 = "14h66gs7z6gf7wrpdhpd1461431q2plv7kvfsh02fj52l1dzpcc0";
-      name = "libksysguard-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/libksysguard-5.22.5.tar.xz";
+      sha256 = "1hkjsjfl4hsxbk998hpq4f38rahqfx6nmznbh0dqrymadfbsn8m5";
+      name = "libksysguard-5.22.5.tar.xz";
    };
  };
  milou = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/milou-5.22.4.tar.xz";
-      sha256 = "11fa9bj3yzriaydfk8q9kc626yv0s0sal5ws13pcd6ksbhslz83s";
-      name = "milou-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/milou-5.22.5.tar.xz";
+      sha256 = "1d1zg1fbhl6cbxfhgrp9njvpcn052psn96cfyw314255v532phpp";
+      name = "milou-5.22.5.tar.xz";
    };
  };
  oxygen = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/oxygen-5.22.4.tar.xz";
-      sha256 = "1p5hklryi02xw0byy5zcaxx5zw81vd6vq3s1h8dyhj07vspimpzw";
-      name = "oxygen-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/oxygen-5.22.5.tar.xz";
+      sha256 = "0fy4dr8kjyh96w482qbf47vkbnb2qqwwp8d0jlf0xc20w6fb4fqc";
+      name = "oxygen-5.22.5.tar.xz";
    };
  };
  plasma-browser-integration = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/plasma-browser-integration-5.22.4.tar.xz";
-      sha256 = "023qbp77ga0jblhhx3437v9jjxx5va7q58abmnpv2nls1xwyq8hb";
-      name = "plasma-browser-integration-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/plasma-browser-integration-5.22.5.tar.xz";
+      sha256 = "1zkz4qd9nk2kw8zx0mj0p5q4yclmfgz5ihfmgqb2iw4j0d2ckw8f";
+      name = "plasma-browser-integration-5.22.5.tar.xz";
    };
  };
  plasma-desktop = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/plasma-desktop-5.22.4.tar.xz";
-      sha256 = "0c225lckhsmhig7xsnv5yfajys3w67g6xj4w1hvz1x3hqs79z3kj";
-      name = "plasma-desktop-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/plasma-desktop-5.22.5.tar.xz";
+      sha256 = "1kmcmpfjgmiazalczjchyrvgy365s1gqdnyv3xav4g4irb62llxl";
+      name = "plasma-desktop-5.22.5.tar.xz";
    };
  };
  plasma-disks = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/plasma-disks-5.22.4.tar.xz";
-      sha256 = "02brm36akqfhjz9fzyzfinjnb954glrrlwpyhiq1sx073v2ibyap";
-      name = "plasma-disks-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/plasma-disks-5.22.5.tar.xz";
+      sha256 = "14ml1vxdp6brms8yqg5x96bad2r9n81cki91fsq6qk0aq098dqbh";
+      name = "plasma-disks-5.22.5.tar.xz";
    };
  };
  plasma-firewall = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/plasma-firewall-5.22.4.tar.xz";
-      sha256 = "1c1mzpd45hd4sb6qsylqgq2x4fay1nskkgmcc1vswmnapcm9gp91";
-      name = "plasma-firewall-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/plasma-firewall-5.22.5.tar.xz";
+      sha256 = "19ii5ha3m9jmfrdg59z9nfx8frmp4f2gc3a7c0krsnajhyrm0npg";
+      name = "plasma-firewall-5.22.5.tar.xz";
    };
  };
  plasma-integration = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/plasma-integration-5.22.4.tar.xz";
-      sha256 = "0rslli0jsyyhm6prac3xgilwf58gjxqhsijgvr25sipg6200r2z0";
-      name = "plasma-integration-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/plasma-integration-5.22.5.tar.xz";
+      sha256 = "0w7jnsyz876k6kzppd6lx0i58ywbfhaycsnq3nn2s10im7ql7ir8";
+      name = "plasma-integration-5.22.5.tar.xz";
    };
  };
  plasma-nano = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/plasma-nano-5.22.4.tar.xz";
-      sha256 = "1ag57nphgkj3f17s42d81npk0z2n27623szbiz1hpgp7f6994l90";
-      name = "plasma-nano-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/plasma-nano-5.22.5.tar.xz";
+      sha256 = "0i8r8mxf00c0rfnybxy2nzl2hn2r7vqfzwlbmkykd6b1z333xfjh";
+      name = "plasma-nano-5.22.5.tar.xz";
    };
  };
  plasma-nm = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/plasma-nm-5.22.4.tar.xz";
-      sha256 = "1cvfawsqzk3yzjwnz6gc6l7p3pz9brbh0n6km23i1bis08rks168";
-      name = "plasma-nm-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/plasma-nm-5.22.5.tar.xz";
+      sha256 = "0jgwp41l4h16qyif2bwnsdfd190ykpddv7gi3zrcmc57fnhrzavz";
+      name = "plasma-nm-5.22.5.tar.xz";
    };
  };
  plasma-pa = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/plasma-pa-5.22.4.tar.xz";
-      sha256 = "1p000y08p89wvv73glv9ic0gdbdhc9fpzvphx72y420g5hhmnnwa";
-      name = "plasma-pa-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/plasma-pa-5.22.5.tar.xz";
+      sha256 = "1axm564si8g9j9f9ndvq39x7s6awiwiiyqnvs1wf76miyyjfdba0";
+      name = "plasma-pa-5.22.5.tar.xz";
    };
  };
  plasma-phone-components = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/plasma-phone-components-5.22.4.tar.xz";
-      sha256 = "0mkr7amxvr325y7f98y1368iv4gs6j2x6bkpi20rp8c2vifkvg5b";
-      name = "plasma-phone-components-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/plasma-phone-components-5.22.5.tar.xz";
+      sha256 = "1m2swgkydjrpxsnj87fs8zkyavba6zrfrzvimbhxf15c3199yrj0";
+      name = "plasma-phone-components-5.22.5.tar.xz";
    };
  };
  plasma-sdk = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/plasma-sdk-5.22.4.tar.xz";
-      sha256 = "0nrh3zbff25wr59hbsvrygjix56as8rd95smr5075qwdyamcqnhf";
-      name = "plasma-sdk-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/plasma-sdk-5.22.5.tar.xz";
+      sha256 = "0gvmvdlqjm2kvkb7bw3bhryql4d9mp0max89l9y25kzqadd6byad";
+      name = "plasma-sdk-5.22.5.tar.xz";
    };
  };
  plasma-systemmonitor = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/plasma-systemmonitor-5.22.4.tar.xz";
-      sha256 = "1gl6kjk6b8xwcfrk6xf41jf1lh3zxr5b6qvdv7z6i8wb3pll63cb";
-      name = "plasma-systemmonitor-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/plasma-systemmonitor-5.22.5.tar.xz";
+      sha256 = "18s72vdcx4jrjs1hfr7mq8zjng2pmba2x23k11jdk8hxl7msm7nx";
+      name = "plasma-systemmonitor-5.22.5.tar.xz";
    };
  };
  plasma-tests = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/plasma-tests-5.22.4.tar.xz";
-      sha256 = "1wf33c0izm9yyjcysiimcpiwmsa64b4ypklga2rbg7kkk7q0nq82";
-      name = "plasma-tests-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/plasma-tests-5.22.5.tar.xz";
+      sha256 = "1wmwm9mmdy98qrmr0r8h99j0cpmib2vyv66jk99wf43bwddy2hxi";
+      name = "plasma-tests-5.22.5.tar.xz";
    };
  };
  plasma-thunderbolt = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/plasma-thunderbolt-5.22.4.tar.xz";
-      sha256 = "1c5ihvam5hfk7xiy3m707jjhpv2rxgl7d2f6m0d764zynm6zax79";
-      name = "plasma-thunderbolt-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/plasma-thunderbolt-5.22.5.tar.xz";
+      sha256 = "13rjn21sdga5yx9983zx26jdb260lg5815ilfjnkdfp7g6ckjlmc";
+      name = "plasma-thunderbolt-5.22.5.tar.xz";
    };
  };
  plasma-vault = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/plasma-vault-5.22.4.tar.xz";
-      sha256 = "1p6bl8as8rx36nzwx2rymqmx4rg7dg0bfrxr0flx9jqp1adclf39";
-      name = "plasma-vault-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/plasma-vault-5.22.5.tar.xz";
+      sha256 = "1ap9kp9agnqljlszzkd14sivpfz9ihjlhq67lhg2sg570s8ng4a0";
+      name = "plasma-vault-5.22.5.tar.xz";
    };
  };
  plasma-workspace = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/plasma-workspace-5.22.4.tar.xz";
-      sha256 = "1fi0c66f2cgqcbshbaxzch75r28l5w4l3flggccil5c73lavf5mg";
-      name = "plasma-workspace-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/plasma-workspace-5.22.5.tar.xz";
+      sha256 = "01inn7jawqn5brcmbglqs3szfzkq637qzf39kya8siq3lgg14bpj";
+      name = "plasma-workspace-5.22.5.tar.xz";
    };
  };
  plasma-workspace-wallpapers = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/plasma-workspace-wallpapers-5.22.4.tar.xz";
-      sha256 = "0abz3qic8m7dcbd0m1ci8qspfds3fdsqhgv8m6ks2jkcm7z4vnnr";
-      name = "plasma-workspace-wallpapers-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/plasma-workspace-wallpapers-5.22.5.tar.xz";
+      sha256 = "1h582vqw14zyngfyjppg6lgs17d1nmc7gcr8kw1zzbc0ynbl68dy";
+      name = "plasma-workspace-wallpapers-5.22.5.tar.xz";
    };
  };
  plymouth-kcm = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/plymouth-kcm-5.22.4.tar.xz";
-      sha256 = "0vh39lidm0dqah14y7nkzqpanlkxpmylf7wc40giavady3d2i1y1";
-      name = "plymouth-kcm-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/plymouth-kcm-5.22.5.tar.xz";
+      sha256 = "1rn8c0z6ycagmxm72gs9cm6pwv1fy8zg5881brglpxy8x63prb9g";
+      name = "plymouth-kcm-5.22.5.tar.xz";
    };
  };
  polkit-kde-agent = {
-    version = "1-5.22.4";
+    version = "1-5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/polkit-kde-agent-1-5.22.4.tar.xz";
-      sha256 = "0pxrrn4qs96a5p9cp890vdq2g79ah72p655643ciqdb14936p0z2";
-      name = "polkit-kde-agent-1-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/polkit-kde-agent-1-5.22.5.tar.xz";
+      sha256 = "1a1b4baszlx01x4n66wikgw8z7wwnycz5rqzjr8r6q1b9dafmqv0";
+      name = "polkit-kde-agent-1-5.22.5.tar.xz";
    };
  };
  powerdevil = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/powerdevil-5.22.4.tar.xz";
-      sha256 = "17427sv6yh16hmgl94lyb4d7gds0r4hvx8vbbqhzysih2x81xl6m";
-      name = "powerdevil-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/powerdevil-5.22.5.tar.xz";
+      sha256 = "17qw7w9h60illpzd1zlymdipx0mpwfhn12d9k0f165qcabk02wsr";
+      name = "powerdevil-5.22.5.tar.xz";
    };
  };
  qqc2-breeze-style = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/qqc2-breeze-style-5.22.4.tar.xz";
-      sha256 = "15h9rjc4ry3kw18aw18r8y8av4cn2wckab8gyyi7zx7s54n6zpvc";
-      name = "qqc2-breeze-style-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/qqc2-breeze-style-5.22.5.tar.xz";
+      sha256 = "0qi8b11f45lnyy09w3b65h0s7qj7d40b7ppwy8mapr92m0zqrkpf";
+      name = "qqc2-breeze-style-5.22.5.tar.xz";
    };
  };
  sddm-kcm = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/sddm-kcm-5.22.4.tar.xz";
-      sha256 = "08j0qd288a5msagpyaqwrw0w6wymxsgqq3rlk8kv3n6qvrsm7174";
-      name = "sddm-kcm-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/sddm-kcm-5.22.5.tar.xz";
+      sha256 = "163p426bd9zfval5zz2hmq3na0px3pz016shzzgna3rqwh7s8sa6";
+      name = "sddm-kcm-5.22.5.tar.xz";
    };
  };
  systemsettings = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/systemsettings-5.22.4.tar.xz";
-      sha256 = "1ap2h1sa6hdakhf6lzy4bhaq5pxc8g7p32iz04894hd7dbb2iv8h";
-      name = "systemsettings-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/systemsettings-5.22.5.tar.xz";
+      sha256 = "1fvmp6nhmn71hxrf0nfg9m8ifp36kvk5k550hiazgz63l7x7hyfc";
+      name = "systemsettings-5.22.5.tar.xz";
    };
  };
  xdg-desktop-portal-kde = {
-    version = "5.22.4";
+    version = "5.22.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.22.4/xdg-desktop-portal-kde-5.22.4.tar.xz";
-      sha256 = "1xmlw66bw60cl530hjjab8g4krv6di4wpimjaz0a9mv3dnq9xz7m";
-      name = "xdg-desktop-portal-kde-5.22.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.22.5/xdg-desktop-portal-kde-5.22.5.tar.xz";
+      sha256 = "00d6dh9jh15y0ndcrm86wzhmpv81s9pm0x0pbiywdia606yp27c6";
+      name = "xdg-desktop-portal-kde-5.22.5.tar.xz";
    };
  };
 }
--- a/third_party/nixpkgs/pkgs/development/compilers/cudatoolkit/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/cudatoolkit/default.nix
@ -1,13 +1,15 @@
-{ lib
-, callPackage
+{ callPackage
 , fetchurl
 , gcc7
 , gcc9
+, gcc10
+, lib
 }:

 let
  common = callPackage ./common.nix;
-in rec {
+in
+rec {
  cudatoolkit_10_0 = common {
    version = "10.0.130";
    url = "https://developer.nvidia.com/compute/cuda/10.0/Prod/local_installers/cuda_10.0.130_410.48_linux";
@ -56,5 +58,19 @@ in rec {
    gcc = gcc9;
  };

+  cudatoolkit_11_3 = common {
+    version = "11.3.1";
+    url = "https://developer.download.nvidia.com/compute/cuda/11.3.1/local_installers/cuda_11.3.1_465.19.01_linux.run";
+    sha256 = "0d19pwcqin76scbw1s5kgj8n0z1p4v1hyfldqmamilyfxycfm4xd";
+    gcc = gcc9;
+  };
+
+  cudatoolkit_11_4 = common {
+    version = "11.4.1";
+    url = "https://developer.download.nvidia.com/compute/cuda/11.4.1/local_installers/cuda_11.4.1_470.57.02_linux.run";
+    sha256 = "0180pb1zfajb9l6blr467xkx01yp3snfwm2xix8x52crf6d36v6x";
+    gcc = gcc10; # can bump to 11 along with stdenv.cc
+  };
+
  cudatoolkit_11 = cudatoolkit_11_2;
 }
--- a/third_party/nixpkgs/pkgs/development/compilers/gcc/common/configure-flags.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/gcc/common/configure-flags.nix
@ -93,6 +93,7 @@ let
      # libsanitizer requires netrom/netrom.h which is not
      # available in uclibc.
      "--disable-libsanitizer"
+    ] ++ lib.optionals (targetPlatform.libc == "uclibc") [
      # In uclibc cases, libgomp needs an additional '-ldl'
      # and as I don't know how to pass it, I disable libgomp.
      "--disable-libgomp"
--- a/third_party/nixpkgs/pkgs/development/compilers/ghcjs/8.10/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/ghcjs/8.10/default.nix
@ -109,8 +109,7 @@ in stdenv.mkDerivation {
    inherit passthru;

    meta = {
-      # The emscripten is broken on darwin
-      platforms = lib.platforms.linux;
+      platforms = with lib.platforms; linux ++ darwin;

      # Hydra limits jobs to only outputting 1 gigabyte worth of files.
      # GHCJS outputs over 3 gigabytes.
--- a/third_party/nixpkgs/pkgs/development/compilers/graalvm/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/graalvm/default.nix
@ -370,9 +370,11 @@ in rec {
                ./009_remove_signedness_verifier.patch ./010_mx_substratevm.py
              ];

+    nativeBuildInputs = [ gfortran ];
+
    buildInputs = [ mx zlib.dev mercurial jvmci8 git llvm clang
                    python27withPackages icu ruby bzip2 which
-                    readline bzip2 xz pcre curl ed gfortran
+                    readline bzip2 xz pcre curl ed
                  ]  ++ lib.optional stdenv.isDarwin [
                    CoreFoundation gcc.cc.lib libiconv perl openssl
                  ];
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/13/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/13/default.nix
@ -19,7 +19,7 @@

 let
  release_version = "13.0.0";
-  candidate = "rc3"; # empty or "rcN"
+  candidate = "rc4"; # empty or "rcN"
  dash-candidate = lib.optionalString (candidate != "") "-${candidate}";
  rev = ""; # When using a Git commit
  rev-version = ""; # When using a Git commit
@ -30,7 +30,7 @@ let
    owner = "llvm";
    repo = "llvm-project";
    rev = if rev != "" then rev else "llvmorg-${version}";
-    sha256 = "1c781jdq0zmhhgdci201yvgl6hlpjqqmmrd6sm91azm3i99n8gw2";
+    sha256 = "0cjl0vssi4y2g4nfr710fb6cdhxmn5r0vis15sf088zsc5zydfhw";
  };

  llvm_meta = {
--- a/third_party/nixpkgs/pkgs/development/compilers/ocaml/4.13.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/ocaml/4.13.nix
@ -1,9 +1,6 @@
 import ./generic.nix {
  major_version = "4";
  minor_version = "13";
-  patch_version = "0-rc2";
-  src = fetchTarball {
-    url = "https://caml.inria.fr/pub/distrib/ocaml-4.13/ocaml-4.13.0~rc2.tar.xz";
-    sha256 = "1w4sdrs5s1bhbisgz44ysi2j1n13qd3slgs34ppglpwmqqw6ply2";
-  };
+  patch_version = "0";
+  sha256 = "sha256:1f7gnndzs6qcyy2gnzalnhm808pifxhvxg2qp5dnsziz6li7x303";
 }
--- a/third_party/nixpkgs/pkgs/development/compilers/osl/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/osl/default.nix
@ -17,7 +17,15 @@ in clangStdenv.mkDerivation rec {
    sha256 = "1dwf10f2fpxc55pymwkapql20nc462mq61hv21c527994c2qp1ll";
  };

-  cmakeFlags = [ "-DUSE_BOOST_WAVE=ON" "-DENABLERTTI=ON" ];
+  cmakeFlags = [
+    "-DUSE_BOOST_WAVE=ON"
+    "-DENABLERTTI=ON"
+
+    # Build system implies llvm-config and llvm-as are in the same directory.
+    # Override defaults.
+    "-DLLVM_DIRECTORY=${llvm}"
+    "-DLLVM_CONFIG=${llvm.dev}/bin/llvm-config"
+  ];

  preConfigure = "patchShebangs src/liboslexec/serialize-bc.bash ";

--- a/Show more
+++ b/Show more