Project import generated by Copybara.

GitOrigin-RevId: 39e6bf76474ce742eb027a88c4da6331f0a1526f
2021-05-04 23:07:42 +02:00 · 2021-05-04 23:07:42 +02:00 · a29f39726d
commit a29f39726d
parent 170c3b4027
79 changed files with 4640 additions and 5366 deletions
--- a/third_party/nixpkgs/nixos/doc/manual/development/settings-options.xml
+++ b/third_party/nixpkgs/nixos/doc/manual/development/settings-options.xml
@ -50,7 +50,7 @@
       </varlistentry>
       <varlistentry>
         <term>
-           <varname>pkgs.formats.ini</varname> { <replaceable>listsAsDuplicateKeys</replaceable> ? false, ... }
+           <varname>pkgs.formats.ini</varname> { <replaceable>listsAsDuplicateKeys</replaceable> ? false, <replaceable>listToValue</replaceable> ? null, ... }
         </term>
         <listitem>
           <para>
@ -66,6 +66,16 @@
                   </para>
                 </listitem>
               </varlistentry>
+               <varlistentry>
+                 <term>
+                   <varname>listToValue</varname>
+                 </term>
+                 <listitem>
+                   <para>
+                     A function for turning a list of values into a single value.
+                   </para>
+                 </listitem>
+               </varlistentry>
             </variablelist>
            It returns a set with INI-specific attributes <varname>type</varname> and <varname>generate</varname> as specified <link linkend='pkgs-formats-result'>below</link>.
           </para>
--- a/third_party/nixpkgs/nixos/lib/test-driver/test-driver.py
+++ b/third_party/nixpkgs/nixos/lib/test-driver/test-driver.py
@ -735,6 +735,7 @@ class Machine:
        shell_path = os.path.join(self.state_dir, "shell")
        self.shell_socket = create_socket(shell_path)

+        display_available = any(x in os.environ for x in ["DISPLAY", "WAYLAND_DISPLAY"])
        qemu_options = (
            " ".join(
                [
@ -744,7 +745,7 @@ class Machine:
                    "-device virtio-serial",
                    "-device virtconsole,chardev=shell",
                    "-device virtio-rng-pci",
-                    "-serial stdio" if "DISPLAY" in os.environ else "-nographic",
+                    "-serial stdio" if display_available else "-nographic",
                ]
            )
            + " "
--- a/third_party/nixpkgs/nixos/modules/services/computing/slurm/slurm.nix
+++ b/third_party/nixpkgs/nixos/modules/services/computing/slurm/slurm.nix
@ -403,9 +403,7 @@ in
      requires = [ "munged.service" "mysql.service" ];

      preStart = ''
-        cp ${slurmdbdConf} ${configPath}
-        chmod 600 ${configPath}
-        chown ${cfg.user} ${configPath}
+        install -m 600 -o ${cfg.user} -T ${slurmdbdConf} ${configPath}
        ${optionalString (cfg.dbdserver.storagePassFile != null) ''
          echo "StoragePass=$(cat ${cfg.dbdserver.storagePassFile})" \
            >> ${configPath}
--- a/third_party/nixpkgs/nixos/modules/services/networking/searx.nix
+++ b/third_party/nixpkgs/nixos/modules/services/networking/searx.nix
@ -4,23 +4,25 @@ with lib;

 let
  runDir = "/run/searx";
+
  cfg = config.services.searx;

+  settingsFile = pkgs.writeText "settings.yml"
+    (builtins.toJSON cfg.settings);
+
  generateConfig = ''
    cd ${runDir}

    # write NixOS settings as JSON
-    cat <<'EOF' > settings.yml
-      ${builtins.toJSON cfg.settings}
-    EOF
+    (
+      umask 077
+      cp --no-preserve=mode ${settingsFile} settings.yml
+    )

    # substitute environment variables
    env -0 | while IFS='=' read -r -d ''' n v; do
      sed "s#@$n@#$v#g" -i settings.yml
    done
-
-    # set strict permissions
-    chmod 400 settings.yml
  '';

  settingType = with types; (oneOf
--- a/third_party/nixpkgs/nixos/modules/services/web-apps/bookstack.nix
+++ b/third_party/nixpkgs/nixos/modules/services/web-apps/bookstack.nix
@ -292,6 +292,8 @@ in {
        WorkingDirectory = "${bookstack}";
      };
      script = ''
+        # set permissions
+        umask 077
        # create .env file
        echo "
        APP_KEY=base64:$(head -n1 ${cfg.appKeyFile})
@ -317,13 +319,14 @@ in {
        ${optionalString (cfg.nginx.addSSL || cfg.nginx.forceSSL || cfg.nginx.onlySSL || cfg.nginx.enableACME) "SESSION_SECURE_COOKIE=true"}
        ${toString cfg.extraConfig}
        " > "${cfg.dataDir}/.env"
-        # set permissions
-        chmod 700 "${cfg.dataDir}/.env"

        # migrate db
        ${pkgs.php}/bin/php artisan migrate --force

-        # create caches
+        # clear & create caches (needed in case of update)
+        ${pkgs.php}/bin/php artisan cache:clear
+        ${pkgs.php}/bin/php artisan config:clear
+        ${pkgs.php}/bin/php artisan view:clear
        ${pkgs.php}/bin/php artisan config:cache
        ${pkgs.php}/bin/php artisan route:cache
        ${pkgs.php}/bin/php artisan view:cache
--- a/third_party/nixpkgs/nixos/modules/services/web-apps/keycloak.nix
+++ b/third_party/nixpkgs/nixos/modules/services/web-apps/keycloak.nix
@ -168,10 +168,15 @@ in
      type = lib.types.str;
      default = "keycloak";
      description = ''
-        Username to use when connecting to the database.
-        This is also used for automatic provisioning of the database.
-        Changing this after the initial installation doesn't delete the
-        old user and can cause further problems.
+        Username to use when connecting to an external or manually
+        provisioned database; has no effect when a local database is
+        automatically provisioned.
+
+        To use this with a local database, set <xref
+        linkend="opt-services.keycloak.databaseCreateLocally" /> to
+        <literal>false</literal> and create the database and user
+        manually. The database should be called
+        <literal>keycloak</literal>.
      '';
    };

@ -588,8 +593,8 @@ in
            PSQL=${config.services.postgresql.package}/bin/psql

            db_password="$(<'${cfg.databasePasswordFile}')"
-            $PSQL -tAc "SELECT 1 FROM pg_roles WHERE rolname='${cfg.databaseUsername}'" | grep -q 1 || $PSQL -tAc "CREATE ROLE ${cfg.databaseUsername} WITH LOGIN PASSWORD '$db_password' CREATEDB"
-            $PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = 'keycloak'" | grep -q 1 || $PSQL -tAc 'CREATE DATABASE "keycloak" OWNER "${cfg.databaseUsername}"'
+            $PSQL -tAc "SELECT 1 FROM pg_roles WHERE rolname='keycloak'" | grep -q 1 || $PSQL -tAc "CREATE ROLE keycloak WITH LOGIN PASSWORD '$db_password' CREATEDB"
+            $PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = 'keycloak'" | grep -q 1 || $PSQL -tAc 'CREATE DATABASE "keycloak" OWNER "keycloak"'
          '';
        };

@ -607,9 +612,9 @@ in
            set -eu

            db_password="$(<'${cfg.databasePasswordFile}')"
-            ( echo "CREATE USER IF NOT EXISTS '${cfg.databaseUsername}'@'localhost' IDENTIFIED BY '$db_password';"
+            ( echo "CREATE USER IF NOT EXISTS 'keycloak'@'localhost' IDENTIFIED BY '$db_password';"
              echo "CREATE DATABASE keycloak CHARACTER SET utf8 COLLATE utf8_unicode_ci;"
-              echo "GRANT ALL PRIVILEGES ON keycloak.* TO '${cfg.databaseUsername}'@'localhost';"
+              echo "GRANT ALL PRIVILEGES ON keycloak.* TO 'keycloak'@'localhost';"
            ) | ${config.services.mysql.package}/bin/mysql -N
          '';
        };
--- a/third_party/nixpkgs/nixos/modules/virtualisation/ec2-metadata-fetcher.nix
+++ b/third_party/nixpkgs/nixos/modules/virtualisation/ec2-metadata-fetcher.nix
@ -71,7 +71,7 @@
  }

  wget_imds -O "$metaDir/ami-manifest-path" http://169.254.169.254/1.0/meta-data/ami-manifest-path
-  wget_imds -O "$metaDir/user-data" http://169.254.169.254/1.0/user-data && chmod 600 "$metaDir/user-data"
+  (umask 077 && wget_imds -O "$metaDir/user-data" http://169.254.169.254/1.0/user-data)
  wget_imds -O "$metaDir/hostname" http://169.254.169.254/1.0/meta-data/hostname
  wget_imds -O "$metaDir/public-keys-0-openssh-key" http://169.254.169.254/1.0/meta-data/public-keys/0/openssh-key
 ''
--- a/third_party/nixpkgs/nixos/modules/virtualisation/openstack-metadata-fetcher.nix
+++ b/third_party/nixpkgs/nixos/modules/virtualisation/openstack-metadata-fetcher.nix
@ -15,7 +15,7 @@
  }

  wget_imds -O "$metaDir/ami-manifest-path" http://169.254.169.254/1.0/meta-data/ami-manifest-path
-  wget_imds -O "$metaDir/user-data" http://169.254.169.254/1.0/user-data && chmod 600 "$metaDir/user-data"
+  (umask 077 && wget_imds -O "$metaDir/user-data" http://169.254.169.254/1.0/user-data)
  wget_imds -O "$metaDir/hostname" http://169.254.169.254/1.0/meta-data/hostname
  wget_imds -O "$metaDir/public-keys-0-openssh-key" http://169.254.169.254/1.0/meta-data/public-keys/0/openssh-key
 ''
--- a/third_party/nixpkgs/nixos/tests/keycloak.nix
+++ b/third_party/nixpkgs/nixos/tests/keycloak.nix
@ -20,6 +20,7 @@ let
          services.keycloak = {
            enable = true;
            inherit frontendUrl databaseType initialAdminPassword;
+            databaseUsername = "bogus";
            databasePasswordFile = pkgs.writeText "dbPassword" "wzf6vOCbPp6cqTH";
          };
          environment.systemPackages = with pkgs; [
--- a/third_party/nixpkgs/nixos/tests/prometheus-exporters.nix
+++ b/third_party/nixpkgs/nixos/tests/prometheus-exporters.nix
@ -334,13 +334,48 @@ let
        services.knot = {
          enable = true;
          extraArgs = [ "-v" ];
+          extraConfig = ''
+            server:
+              listen: 127.0.0.1@53
+
+            template:
+              - id: default
+                global-module: mod-stats
+                dnssec-signing: off
+                zonefile-sync: -1
+                journal-db: /var/lib/knot/journal
+                kasp-db: /var/lib/knot/kasp
+                timer-db: /var/lib/knot/timer
+                zonefile-load: difference
+                storage: ${pkgs.buildEnv {
+                  name = "foo";
+                  paths = [
+                    (pkgs.writeTextDir "test.zone" ''
+                      @ SOA ns.example.com. noc.example.com. 2019031301 86400 7200 3600000 172800
+                      @       NS      ns1
+                      @       NS      ns2
+                      ns1     A       192.168.0.1
+                    '')
+                  ];
+                }}
+
+            mod-stats:
+              - id: custom
+                edns-presence: on
+                query-type: on
+
+            zone:
+              - domain: test
+                file: test.zone
+                module: mod-stats/custom
+          '';
        };
      };
      exporterTest = ''
        wait_for_unit("knot.service")
        wait_for_unit("prometheus-knot-exporter.service")
        wait_for_open_port(9433)
-        succeed("curl -sSf 'localhost:9433' | grep -q 'knot_server_zone_count 0.0'")
+        succeed("curl -sSf 'localhost:9433' | grep -q 'knot_server_zone_count 1.0'")
      '';
    };

--- a/third_party/nixpkgs/pkgs/applications/audio/audacity/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/audacity/default.nix
@ -28,6 +28,7 @@
 , ffmpeg
 , soundtouch
 , pcre /*, portaudio - given up fighting their portaudio.patch */
+, linuxHeaders
 , at-spi2-core ? null
 , dbus ? null
 , epoxy ? null
@ -41,24 +42,35 @@
 }:

 # TODO
-# - as of 2.4.2, GTK2 is still the recommended version ref https://www.audacityteam.org/download/source/ check if that changes in future versions
+# - as of 3.0.2, GTK2 is still the recommended version ref https://www.audacityteam.org/download/source/ check if that changes in future versions
 # - detach sbsms

+let
+  wxGTK-audacity = wxGTK.overrideAttrs (oldAttrs: rec {
+    src = fetchFromGitHub {
+      owner = "audacity";
+      repo = "wxWidgets";
+      rev = "07e7d832c7a337aedba3537b90b2c98c4d8e2985";
+      sha256 = "1mawnkcrmqj98jp0jxlnh9xkc950ca033ccb51c7035pzmi9if9a";
+      fetchSubmodules = true;
+    };
+  });
+in
 stdenv.mkDerivation rec {
  pname = "audacity";
-  version = "2.4.2";
+  version = "3.0.2";

  src = fetchFromGitHub {
    owner = "audacity";
    repo = "audacity";
    rev = "Audacity-${version}";
-    sha256 = "sha256-hpRTo5B0EMyzORopsNPOgv6mohBkwJfWfCLnPvFmdFI=";
+    sha256 = "035qq2ff16cdl2cb9iply2bfjmhfl1dpscg79x6c9l0i9m8k41zj";
  };

  patches = [
    (fetchpatch {
-      url = "https://github.com/audacity/audacity/commit/a070b5d8a8ba10fb86edba6aeb8fdab0f66ba408.patch";
-      sha256 = "sha256-8UZupGcN+/tytAhyy5T1P0nufvsQPeyLgOUMGt7l8Oc=";
+      url = "https://github.com/audacity/audacity/commit/007852e51fcbb5f1f359d112f28b8984a604dac6.patch";
+      sha256 = "0zp2iydd46analda9cfnbmzdkjphz5m7dynrdj5qdnmq6j3px9fw";
      name = "audacity_xdg_paths.patch";
    })
  ];
@ -68,6 +80,10 @@ stdenv.mkDerivation rec {
    touch src/RevisionIdent.h
  '';

+  preConfigure = ''
+    substituteInPlace src/FileNames.cpp --replace /usr/include/linux/magic.h ${linuxHeaders}/include/linux/magic.h
+  '';
+
  # workaround for a broken cmake. Drop it with a later version to see if it works.
  # https://github.com/NixOS/nixpkgs/issues/94905
  cmakeFlags = lib.optional stdenv.isLinux "-DCMAKE_OSX_ARCHITECTURES=";
@ -86,7 +102,14 @@ stdenv.mkDerivation rec {
    "-lswscale"
  ];

-  nativeBuildInputs = [ cmake gettext pkg-config python3 ];
+  nativeBuildInputs = [
+    cmake
+    gettext
+    pkg-config
+    python3
+  ] ++ lib.optionals stdenv.isLinux [
+    linuxHeaders
+  ];

  buildInputs = [
    alsaLib
@ -110,8 +133,8 @@ stdenv.mkDerivation rec {
    sratom
    suil
    twolame
-    wxGTK
-    wxGTK.gtk
+    wxGTK-audacity
+    wxGTK-audacity.gtk
  ] ++ lib.optionals stdenv.isLinux [
    at-spi2-core
    dbus
--- a/third_party/nixpkgs/pkgs/applications/audio/pianobar/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/pianobar/default.nix
@ -1,16 +1,17 @@
-{ fetchurl, lib, stdenv, pkg-config, libao, json_c, libgcrypt, ffmpeg_3, curl }:
+{ fetchurl, lib, stdenv, pkg-config, libao, json_c, libgcrypt, ffmpeg, curl }:

 stdenv.mkDerivation rec {
-  name = "pianobar-2020.11.28";
+  pname = "pianobar";
+  version = "2020.11.28";

  src = fetchurl {
-    url = "http://6xq.net/projects/pianobar/${name}.tar.bz2";
+    url = "https://6xq.net/projects/pianobar/${pname}-${version}.tar.bz2";
    sha256 = "1znlwybfpxsjqr1jmr8j0ci8wzmpzmk2yxb0qcx9w9a8nnbgnfv5";
  };

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [
-    libao json_c libgcrypt ffmpeg_3 curl
+    libao json_c libgcrypt ffmpeg curl
  ];

  makeFlags = [ "PREFIX=$(out)" ];
--- a/third_party/nixpkgs/pkgs/applications/audio/spotify/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/spotify/default.nix
@ -1,6 +1,6 @@
 { fetchurl, lib, stdenv, squashfsTools, xorg, alsaLib, makeWrapper, openssl, freetype
 , glib, pango, cairo, atk, gdk-pixbuf, gtk3, cups, nspr, nss, libpng, libnotify
-, libgcrypt, systemd, fontconfig, dbus, expat, ffmpeg_3, curl, zlib, gnome3
+, libgcrypt, systemd, fontconfig, dbus, expat, ffmpeg, curl, zlib, gnome3
 , at-spi2-atk, at-spi2-core, libpulseaudio, libdrm, mesa, libxkbcommon
 }:

@ -29,7 +29,7 @@ let
    curl
    dbus
    expat
-    ffmpeg_3
+    ffmpeg
    fontconfig
    freetype
    gdk-pixbuf
@ -127,8 +127,8 @@ stdenv.mkDerivation {
      ln -s ${nspr.out}/lib/libnspr4.so $libdir/libnspr4.so
      ln -s ${nspr.out}/lib/libplc4.so $libdir/libplc4.so

-      ln -s ${ffmpeg_3.out}/lib/libavcodec.so* $libdir
-      ln -s ${ffmpeg_3.out}/lib/libavformat.so* $libdir
+      ln -s ${ffmpeg.out}/lib/libavcodec.so* $libdir
+      ln -s ${ffmpeg.out}/lib/libavformat.so* $libdir

      rpath="$out/share/spotify:$libdir"

--- a/third_party/nixpkgs/pkgs/applications/audio/transcribe/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/transcribe/default.nix
@ -0,0 +1,64 @@
+{ stdenv, fetchzip, lib, wrapGAppsHook, alsaLib, atk, cairo, gdk-pixbuf
+, glib, gst_all_1,  gtk3, libSM, libX11, libpng12, pango, zlib }:
+
+stdenv.mkDerivation rec {
+  pname = "transcribe";
+  version = "9.00";
+
+  src = if stdenv.hostPlatform.system == "x86_64-linux" then
+    fetchzip {
+      url = "https://www.seventhstring.com/xscribe/downlo/xscsetup-9.00.0.tar.gz";
+      sha256 = "0mgjx0hnps3jmc2d9hkskxbmwcqf7f9jx595j5sc501br1l84sdf";
+    }
+  else throw "Platform not supported";
+
+  nativeBuildInputs = [ wrapGAppsHook ];
+
+  buildInputs = with gst_all_1; [ gst-plugins-base gst-plugins-good
+    gst-plugins-bad gst-plugins-ugly ];
+
+  dontPatchELF = true;
+
+  libPath = with gst_all_1; lib.makeLibraryPath [
+    stdenv.cc.cc glib gtk3 atk pango cairo gdk-pixbuf alsaLib
+    libX11 libSM libpng12 gstreamer gst-plugins-base zlib
+  ];
+
+  installPhase = ''
+    mkdir -p $out/bin $out/libexec $out/share/doc
+    cp transcribe $out/libexec
+    cp xschelp.htb readme_gtk.html $out/share/doc
+    cp -r gtkicons $out/share/icons
+    ln -s $out/share/doc/xschelp.htb $out/libexec
+    patchelf \
+      --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) \
+      $out/libexec/transcribe
+  '';
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix GST_PLUGIN_SYSTEM_PATH : "$GST_PLUGIN_SYSTEM_PATH_1_0"
+      --prefix LD_LIBRARY_PATH : "${libPath}"
+    )
+  '';
+
+  postFixup = ''
+    ln -s $out/libexec/transcribe $out/bin/
+  '';
+
+  meta = with lib; {
+    description = "Software to help transcribe recorded music";
+    longDescription = ''
+      The Transcribe! application is an assistant for people who want
+      to work out a piece of music from a recording, in order to write
+      it out, or play it themselves, or both. It doesn't do the
+      transcribing for you, but it is essentially a specialised player
+      program which is optimised for the purpose of transcription. It
+      has many transcription-specific features not found on
+      conventional music players.
+    '';
+    homepage = "https://www.seventhstring.com/xscribe/";
+    license = licenses.unfree;
+    platforms = platforms.linux;
+  };
+}
--- a/third_party/nixpkgs/pkgs/applications/editors/emacs-modes/melpa-packages.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/emacs-modes/melpa-packages.nix
@ -362,6 +362,7 @@ let
        zmq = super.zmq.overrideAttrs (old: {
          stripDebugList = [ "share" ];
          preBuild = ''
+            export EZMQ_LIBDIR=$(mktemp -d)
            make
          '';
          nativeBuildInputs = [
@ -372,7 +373,7 @@ let
            (pkgs.zeromq.override { enableDrafts = true; })
          ];
          postInstall = ''
-            mv $out/share/emacs/site-lisp/elpa/zmq-*/src/.libs/emacs-zmq.so $out/share/emacs/site-lisp/elpa/zmq-*
+            mv $EZMQ_LIBDIR/emacs-zmq.* $out/share/emacs/site-lisp/elpa/zmq-*
            rm -r $out/share/emacs/site-lisp/elpa/zmq-*/src
            rm $out/share/emacs/site-lisp/elpa/zmq-*/Makefile
          '';
--- a/third_party/nixpkgs/pkgs/applications/misc/1password-gui/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/1password-gui/default.nix
@ -1,6 +1,6 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
-, appimageTools
 , makeWrapper
 , electron_11
 , openssl
@ -8,21 +8,15 @@

 stdenv.mkDerivation rec {
  pname = "1password";
-  version = "8.0.30";
+  version = "8.0.33-53.BETA";

  src = fetchurl {
-    url = "https://onepassword.s3.amazonaws.com/linux/appimage/${pname}-${version}.AppImage";
-    hash = "sha256-j+fp/f8nta+OOuOFU4mmUrGYlVmAqdaXO4rLJ0in+m8=";
+    url = "https://downloads.1password.com/linux/tar/beta/x86_64/1password-${version}.x64.tar.gz";
+    hash = "sha256-YUYER+UiM1QEDgGl0P9bIT65YVacUnuGtQVkV91teEU=";
  };

  nativeBuildInputs = [ makeWrapper ];

-  appimageContents = appimageTools.extractType2 {
-    name = "${pname}-${version}";
-    inherit src;
-  };
-
-  dontUnpack = true;
  dontConfigure = true;
  dontBuild = true;

@ -35,20 +29,33 @@ stdenv.mkDerivation rec {
    mkdir -p $out/bin $out/share/1password

    # Applications files.
-    cp -a ${appimageContents}/{locales,resources} $out/share/${pname}
+    cp -a {locales,resources} $out/share/${pname}
+    install -Dm0755 -t $out/share/${pname} {1Password-BrowserSupport,1Password-KeyringHelper}

    # Desktop file.
-    install -Dt $out/share/applications ${appimageContents}/${pname}.desktop
+    install -Dt $out/share/applications resources/${pname}.desktop
    substituteInPlace $out/share/applications/${pname}.desktop \
-      --replace 'Exec=AppRun' 'Exec=${pname}'
+      --replace 'Exec=/opt/1Password/${pname}' 'Exec=${pname}'

    # Icons.
-    cp -a ${appimageContents}/usr/share/icons $out/share
+    cp -a resources/icons $out/share

    # Wrap the application with Electron.
    makeWrapper "${electron_11}/bin/electron" "$out/bin/${pname}" \
      --add-flags "$out/share/${pname}/resources/app.asar" \
      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeLibs}"
+
+    # Set the interpreter for the helper binaries and wrap them with
+    # the runtime libraries.
+    interp="$(cat $NIX_CC/nix-support/dynamic-linker)"
+    patchelf --set-interpreter $interp \
+      $out/share/$pname/{1Password-BrowserSupport,1Password-KeyringHelper}
+
+    wrapProgram $out/share/${pname}/1Password-BrowserSupport \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeLibs}"
+
+    wrapProgram $out/share/${pname}/1Password-KeyringHelper \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeLibs}"
  '';

  passthru.updateScript = ./update.sh;
--- a/third_party/nixpkgs/pkgs/applications/misc/1password-gui/update.sh
+++ b/third_party/nixpkgs/pkgs/applications/misc/1password-gui/update.sh
@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -i bash -p curl gnused common-updater-scripts

-version="$(curl -sL https://onepassword.s3.amazonaws.com/linux/debian/dists/edge/main/binary-amd64/Packages | sed -r -n 's/^Version: (.*)-[0-9]+/\1/p' | head -n1)"
+version="$(curl -sL https://onepassword.s3.amazonaws.com/linux/debian/dists/edge/main/binary-amd64/Packages | sed -r -n 's/^Version: (.*)/\1/p' | head -n1)"
 update-source-version _1password-gui "$version"
--- a/third_party/nixpkgs/pkgs/applications/misc/hugo/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/hugo/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "hugo";
-  version = "0.82.1";
+  version = "0.83.1";

  src = fetchFromGitHub {
    owner = "gohugoio";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-6poWFcApwCos3XvS/Wq1VJyf5xTUWtqWNFXIhjNsXVs=";
+    sha256 = "sha256-c9T3a6J78uLumBTy/DgE4gbxCmEXVGKd9JyF9dyrL6g=";
  };

-  vendorSha256 = "sha256-pJBm+yyy1DbH28oVBQA+PHSDtSg3RcgbRlurrwnnEls=";
+  vendorSha256 = "sha256-ddCyMmZ5RIZWzT2RYNnSW795oR7PIRudl3QTjsXtBGk=";

  doCheck = false;

--- a/third_party/nixpkgs/pkgs/applications/misc/metadata-cleaner/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/metadata-cleaner/default.nix
@ -17,7 +17,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "metadata-cleaner";
-  version = "1.0.5";
+  version = "1.0.6";

  format = "other";

@ -25,7 +25,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "rmnvgr";
    repo = "metadata-cleaner";
    rev = "v${version}";
-    sha256 = "sha256-9s9i703Svql1Nn1M1sFp3FOtLGjuxXi6YR6nsUJCkeg=";
+    sha256 = "0k9qnycaqxnmsjsyxqgip6xr5w9affzxjc4zyb38ajbq4arfq5wv";
  };

  nativeBuildInputs = [
--- a/third_party/nixpkgs/pkgs/applications/misc/remarkable/restream/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/remarkable/restream/default.nix
@ -0,0 +1,48 @@
+{ lib
+, bash
+, stdenv
+, lz4
+, ffmpeg-full
+, fetchFromGitHub
+, openssh
+, makeWrapper
+}:
+
+stdenv.mkDerivation rec {
+  pname = "restream";
+  version = "1.1";
+
+  src = fetchFromGitHub {
+    owner = "rien";
+    repo = pname;
+    rev = version;
+    sha256 = "18z17chl7r5dg12xmr3f9gbgv97nslm8nijigd03iysaj6dhymp3";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D ${src}/restream.arm.static $out/libexec/restream.arm.static
+    install -D ${src}/reStream.sh $out/bin/restream
+
+    runHook postInstall
+  '';
+
+  postInstall = ''
+    # `ffmpeg-full` is used here to bring in `ffplay`, which is used to display
+    # the reMarkable framebuffer
+    wrapProgram "$out/bin/restream" --suffix PATH ":" "${lib.makeBinPath [ ffmpeg-full lz4 openssh ]}"
+  '';
+
+  meta = with lib; {
+    description = "reMarkable screen sharing over SSH";
+    homepage = "https://github.com/rien/reStream";
+    license = licenses.mit;
+    maintainers = [ maintainers.cpcloud ];
+  };
+}
--- a/third_party/nixpkgs/pkgs/applications/networking/browsers/opera/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/browsers/opera/default.nix
@ -30,6 +30,7 @@
 , libnotify
 , libpulseaudio
 , libuuid
+, libxshmfence
 , mesa
 , nspr
 , nss
@ -49,11 +50,11 @@ let
 in stdenv.mkDerivation rec {

  pname = "opera";
-  version = "68.0.3618.63";
+  version = "76.0.4017.94";

  src = fetchurl {
    url = "${mirror}/${version}/linux/${pname}-stable_${version}_amd64.deb";
-    sha256 = "1643043ywz94x2yr7xyw7krfq53iwkr8qxlbydzq6zb2zina7jxd";
+    sha256 = "sha256-vjSfzkl1jIQ9P1ARDa0eOuD8CmKHIEZ+IwMB2wIVjE8=";
  };

  unpackCmd = "${dpkg}/bin/dpkg-deb -x $curSrc .";
@ -94,6 +95,7 @@ in stdenv.mkDerivation rec {
    libnotify
    libuuid
    libxcb
+    libxshmfence
    mesa
    nspr
    nss
--- a/third_party/nixpkgs/pkgs/applications/networking/syncthing/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/syncthing/default.nix
@ -4,16 +4,16 @@ let
  common = { stname, target, postInstall ? "" }:
    buildGoModule rec {
      pname = stname;
-      version = "1.15.1";
+      version = "1.16.0";

      src = fetchFromGitHub {
        owner  = "syncthing";
        repo   = "syncthing";
        rev    = "v${version}";
-        sha256 = "sha256-d7b1hqW0ZWg74DyW1ZYMT7sIR7H89Ph38XE2Mhh7ySg=";
+        sha256 = "sha256-AAJLtykSQLM13I77E7LD1W8hXLvZQ3XqgOWrTBGYn3k=";
      };

-      vendorSha256 = "sha256-00DdGJNCZ94Wj6yvVXJYNJZEiGxYbqTkX6wwon0O1tc=";
+      vendorSha256 = "sha256-cN6Dgztq0/pAwfuBGFtTzK7XKXV7LrkgDGGzjkTDUN8=";

      doCheck = false;

--- a/third_party/nixpkgs/pkgs/applications/radio/dump1090/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/radio/dump1090/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "dump1090";
-  version = "4.0";
+  version = "5.0";

  src = fetchFromGitHub {
    owner = "flightaware";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1zacsqaqsiapljhzw31dwc4nld2rp98jm3ivkyznrhzk9n156p42";
+    sha256 = "1fckfcgypmplzl1lidd04jxiabczlfx9mv21d6rbsfknghsjpn03";
  };

  nativeBuildInputs = [ pkg-config ];
@ -28,9 +28,13 @@ stdenv.mkDerivation rec {
  ];

  installPhase = ''
+    runHook preInstall
+
    mkdir -p $out/bin $out/share
    cp -v dump1090 view1090 $out/bin
    cp -vr public_html $out/share/dump1090
+
+    runHook postInstall
  '';

  meta = with lib; {
--- a/third_party/nixpkgs/pkgs/applications/science/physics/xfitter/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/physics/xfitter/default.nix
@ -39,9 +39,10 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ gfortran which ];
  buildInputs =
-    [ apfel apfelgrid applgrid blas lhapdf lapack mela root5 qcdnum libtirpc ]
+    [ apfel apfelgrid applgrid blas lhapdf lapack mela root5 qcdnum ]
    # pdf2yaml requires fmemopen and open_memstream which are not readily available on Darwin
    ++ lib.optional (!stdenv.isDarwin) libyaml
+    ++ lib.optional (stdenv.hostPlatform.libc == "glibc") libtirpc
    ;
  propagatedBuildInputs = [ lynx ];

@ -49,8 +50,8 @@ stdenv.mkDerivation rec {

  hardeningDisable = [ "format" ];

-  NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
-  NIX_LDFLAGS = [ "-ltirpc" ];
+  NIX_CFLAGS_COMPILE = lib.optional (stdenv.hostPlatform.libc == "glibc") "-I${libtirpc.dev}/include/tirpc";
+  NIX_LDFLAGS = lib.optional (stdenv.hostPlatform.libc == "glibc") "-ltirpc";

  meta = with lib; {
    description = "The xFitter project is an open source QCD fit framework ready to extract PDFs and assess the impact of new data";
--- a/third_party/nixpkgs/pkgs/applications/version-management/mercurial/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/mercurial/default.nix
@ -1,29 +1,59 @@
-{ lib, stdenv, fetchurl, python3Packages, makeWrapper, unzip
+{ lib, stdenv, fetchurl, fetchpatch, python3Packages, makeWrapper, gettext
+, re2Support ? true
+, rustSupport ? stdenv.hostPlatform.isLinux, rustPlatform
 , guiSupport ? false, tk ? null
 , ApplicationServices
 }:

 let
-  inherit (python3Packages) docutils python;
+  inherit (python3Packages) docutils python fb-re2;

 in python3Packages.buildPythonApplication rec {
  pname = "mercurial";
-  version = "5.6";
+  version = "5.8";

  src = fetchurl {
    url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-    sha256 = "1hk2y30zzdnlv8f71kabvh0xi9c7qhp28ksh20vpd0r712sv79yz";
+    sha256 = "17rhlmmkqz5ll3k68jfzpcifg3nndbcbc2nx7kw8xn3qcj7nlpgw";
  };

+  patches = [
+    # https://phab.mercurial-scm.org/D10638, needed for below patch to apply
+    (fetchpatch {
+      url = "https://phab.mercurial-scm.org/file/data/oymk4awh2dd7q6cwjbzu/PHID-FILE-bfcr7qrp5spg42wspxpd/D10638.diff";
+      sha256 = "0mfi324is02l7cnd3j0gbmg5rpyyqn3afg3f73flnfwmz5njqa5f";
+    })
+    # https://phab.mercurial-scm.org/D10639, fixes https://bz.mercurial-scm.org/show_bug.cgi?id=6514
+    (fetchpatch {
+      url = "https://phab.mercurial-scm.org/file/data/re4uqdhtknjiacx2ogwu/PHID-FILE-4m26id65dno5gzix2ngh/D10639.diff";
+      sha256 = "0h5ilrd2x1789fr6sf4k1mcvxdh0xdyr94yawdacw87v3x12c8cb";
+    })
+  ];
+
  format = "other";

  passthru = { inherit python; }; # pass it so that the same version can be used in hg2git

-  nativeBuildInputs = [ makeWrapper unzip ];
+  cargoDeps = if rustSupport then rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    sha256 = "1kc2giqvfwsdl5fb0qmz96ws1gdrs3skfdzvpiif2i8f7r4nqlhd";
+    sourceRoot = "${pname}-${version}/rust";
+  } else null;
+  cargoRoot = if rustSupport then "rust" else null;
+
+  propagatedBuildInputs = lib.optional re2Support fb-re2;
+  nativeBuildInputs = [ makeWrapper gettext ]
+    ++ lib.optionals rustSupport (with rustPlatform; [
+         cargoSetupHook
+         rust.cargo
+         rust.rustc
+       ]);
  buildInputs = [ docutils ]
    ++ lib.optionals stdenv.isDarwin [ ApplicationServices ];

-  makeFlags = [ "PREFIX=$(out)" ];
+  makeFlags = [ "PREFIX=$(out)" ]
+    ++ lib.optional rustSupport "PURE=--rust";

  postInstall = (lib.optionalString guiSupport ''
    mkdir -p $out/etc/mercurial
@ -52,14 +82,14 @@ in python3Packages.buildPythonApplication rec {
    install -v -m644 -D contrib/zsh_completion $out/share/zsh/site-functions/_hg
  '';

-  meta = {
+  meta = with lib; {
    inherit version;
    description = "A fast, lightweight SCM system for very large distributed projects";
    homepage = "https://www.mercurial-scm.org";
    downloadPage = "https://www.mercurial-scm.org/release/";
-    license = lib.licenses.gpl2;
-    maintainers = [ lib.maintainers.eelco ];
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ eelco lukegb ];
    updateWalker = true;
-    platforms = lib.platforms.unix;
+    platforms = platforms.unix;
  };
 }
--- a/third_party/nixpkgs/pkgs/applications/version-management/tortoisehg/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/tortoisehg/default.nix
@ -9,12 +9,16 @@ let
    sha256 = "031bafj88wggpvw0lgvl0djhlbhs9nls9vzwvni8yn0m0bgzc9gr";
  };

-  tortoiseMercurial = mercurial.overridePythonAttrs (old: rec {
+  tortoiseMercurial = (mercurial.override {
+    rustSupport = false;
+    re2Support = lib.versionAtLeast tortoisehgSrc.meta.version "5.8";
+  }).overridePythonAttrs (old: rec {
    inherit (tortoisehgSrc.meta) version;
    src = fetchurl {
      url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
      sha256 = "1hk2y30zzdnlv8f71kabvh0xi9c7qhp28ksh20vpd0r712sv79yz";
    };
+    patches = [];
  });

 in python3Packages.buildPythonApplication {
--- a/third_party/nixpkgs/pkgs/applications/video/kodi-packages/inputstream-ffmpegdirect/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/video/kodi-packages/inputstream-ffmpegdirect/default.nix
@ -3,13 +3,13 @@
 buildKodiBinaryAddon rec {
  pname = "inputstream-ffmpegdirect";
  namespace = "inputstream.ffmpegdirect";
-  version = "1.21.1";
+  version = "1.21.2";

  src = fetchFromGitHub {
    owner = "xbmc";
    repo = "inputstream.ffmpegdirect";
    rev = "${version}-${rel}";
-    sha256 = "1x5gj7iq74ysyfrzvp135m0pjz47zamcgw1v1334xd7xcx5q178p";
+    sha256 = "sha256-FXtjR/4/f434gp78PBSt+QrYtMYcnljO3Htxss/wH7U=";
  };

  extraBuildInputs = [ bzip2 zlib kodi.ffmpeg ];
--- a/third_party/nixpkgs/pkgs/applications/video/kodi-packages/pvr-iptvsimple/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/video/kodi-packages/pvr-iptvsimple/default.nix
@ -6,13 +6,13 @@
 buildKodiBinaryAddon rec {
  pname = "pvr-iptvsimple";
  namespace = "pvr.iptvsimple";
-  version = "7.6.1";
+  version = "7.6.2";

  src = fetchFromGitHub {
    owner = "kodi-pvr";
    repo = "pvr.iptvsimple";
    rev = "${version}-${rel}";
-    sha256 = "1g1ildl2l6nl63qbfhijcbmvr6z84nqhjsy2lgx3dy25cmcqzir9";
+    sha256 = "sha256-MdgPUKkbqNt/WKUTrYNetlyUBQcYLSn0J8EHH2Z9I+g=";
  };

  extraBuildInputs = [
--- a/third_party/nixpkgs/pkgs/applications/virtualization/xen/0001-libxl-Spice-image-compression-setting-support-for-up.patch
+++ b/third_party/nixpkgs/pkgs/applications/virtualization/xen/0001-libxl-Spice-image-compression-setting-support-for-up.patch
@ -1,104 +0,0 @@
-From bd71555985efc423b1a119b6a3177de855763453 Mon Sep 17 00:00:00 2001
-From: Fabio Fantoni <fabio.fantoni@m2r.biz>
-Date: Tue, 20 Jan 2015 11:26:30 +0100
-Subject: [PATCH] libxl: Spice image compression setting support for upstream
- qemu
-
-Usage:
-spice_image_compression=[auto_glz|auto_lz|quic|glz|lz|off]
-
-Specifies what image compression is to be used by spice (if given),
-otherwise the qemu default will be used.
-
-Signed-off-by: Fabio Fantoni <fabio.fantoni@m2r.biz>
-Acked-by: Wei Liu <wei.liu2@citrix.com>
---
- docs/man/xl.cfg.pod.5       |  6 ++++++
- tools/libxl/libxl.h         | 11 +++++++++++
- tools/libxl/libxl_dm.c      |  4 ++++
- tools/libxl/libxl_types.idl |  1 +
- tools/libxl/xl_cmdimpl.c    |  2 ++
- 5 files changed, 24 insertions(+)
-
-diff --git a/docs/man/xl.cfg.pod.5 b/docs/man/xl.cfg.pod.5
-index e2f91fc..0c2cbac 100644
--- a/docs/man/xl.cfg.pod.5
-+++ b/docs/man/xl.cfg.pod.5
-@@ -1427,6 +1427,12 @@ for redirection of up to 4 usb devices from spice client to domU's qemu.
- It requires an usb controller and if not defined it will automatically adds
- an usb2 controller. The default is disabled (0).
- 
-+=item B<spice_image_compression=[auto_glz|auto_lz|quic|glz|lz|off]>
-+
-+Specifies what image compression is to be used by spice (if given), otherwise
-+the qemu default will be used. Please see documentations of your current qemu
-+version for details.
-+
- =back
- 
- =head3 Miscellaneous Emulated Hardware
-diff --git a/tools/libxl/libxl.h b/tools/libxl/libxl.h
-index 0a123f1..b8e0b67 100644
--- a/tools/libxl/libxl.h
-+++ b/tools/libxl/libxl.h
-@@ -528,6 +528,17 @@ typedef struct libxl__ctx libxl_ctx;
- #define LIBXL_HAVE_SPICE_USBREDIREDIRECTION 1
- 
- /*
-+ * LIBXL_HAVE_SPICE_IMAGECOMPRESSION
-+ *
-+ * If defined, then the libxl_spice_info structure will contain a string type
-+ * field: image_compression. This value defines what Spice image compression
-+ * is used.
-+ *
-+ * If this is not defined, the Spice image compression setting support is ignored.
-+ */
-+#define LIBXL_HAVE_SPICE_IMAGECOMPRESSION 1
-+
-+/*
-  * LIBXL_HAVE_DOMAIN_CREATE_RESTORE_PARAMS 1
-  *
-  * If this is defined, libxl_domain_create_restore()'s API has changed to
-diff --git a/tools/libxl/libxl_dm.c b/tools/libxl/libxl_dm.c
-index c2b0487..40c8649 100644
--- a/tools/libxl/libxl_dm.c
-+++ b/tools/libxl/libxl_dm.c
-@@ -398,6 +398,10 @@ static char *dm_spice_options(libxl__gc *gc,
-     if (!libxl_defbool_val(spice->clipboard_sharing))
-         opt = libxl__sprintf(gc, "%s,disable-copy-paste", opt);
- 
-+    if (spice->image_compression)
-+        opt = libxl__sprintf(gc, "%s,image-compression=%s", opt,
-+                             spice->image_compression);
-+
-     return opt;
- }
- 
-diff --git a/tools/libxl/libxl_types.idl b/tools/libxl/libxl_types.idl
-index 1214d2e..052ded9 100644
--- a/tools/libxl/libxl_types.idl
-+++ b/tools/libxl/libxl_types.idl
-@@ -241,6 +241,7 @@ libxl_spice_info = Struct("spice_info", [
-     ("vdagent",     libxl_defbool),
-     ("clipboard_sharing", libxl_defbool),
-     ("usbredirection", integer),
-+    ("image_compression", string),
-     ])
- 
- libxl_sdl_info = Struct("sdl_info", [
-diff --git a/tools/libxl/xl_cmdimpl.c b/tools/libxl/xl_cmdimpl.c
-index 0b02a6c..00aa69d 100644
--- a/tools/libxl/xl_cmdimpl.c
-+++ b/tools/libxl/xl_cmdimpl.c
-@@ -1948,6 +1948,8 @@ skip_vfb:
-                             &b_info->u.hvm.spice.clipboard_sharing, 0);
-         if (!xlu_cfg_get_long (config, "spiceusbredirection", &l, 0))
-             b_info->u.hvm.spice.usbredirection = l;
-+        xlu_cfg_replace_string (config, "spice_image_compression",
-+                                &b_info->u.hvm.spice.image_compression, 0);
-         xlu_cfg_get_defbool(config, "nographic", &b_info->u.hvm.nographic, 0);
-         xlu_cfg_get_defbool(config, "gfx_passthru",
-                             &b_info->u.hvm.gfx_passthru, 0);
-- 
-1.9.2
-
--- a/third_party/nixpkgs/pkgs/applications/virtualization/xen/0002-libxl-Spice-streaming-video-setting-support-for-upst.patch
+++ b/third_party/nixpkgs/pkgs/applications/virtualization/xen/0002-libxl-Spice-streaming-video-setting-support-for-upst.patch
@ -1,104 +0,0 @@
-From 296c7f3284efe655d95a8ae045a5dc1a20d6fff0 Mon Sep 17 00:00:00 2001
-From: Fabio Fantoni <fabio.fantoni@m2r.biz>
-Date: Tue, 20 Jan 2015 11:33:17 +0100
-Subject: [PATCH] libxl: Spice streaming video setting support for upstream
- qemu
-
-Usage:
-spice_streaming_video=[filter|all|off]
-
-Specifies what streaming video setting is to be used by spice (if
-given),
-otherwise the qemu default will be used.
-
-Signed-off-by: Fabio Fantoni <fabio.fantoni@m2r.biz>
-Acked-by: Wei Liu <wei.liu2@citrix.com>
---
- docs/man/xl.cfg.pod.5       |  5 +++++
- tools/libxl/libxl.h         | 11 +++++++++++
- tools/libxl/libxl_dm.c      |  4 ++++
- tools/libxl/libxl_types.idl |  1 +
- tools/libxl/xl_cmdimpl.c    |  2 ++
- 5 files changed, 23 insertions(+)
-
-diff --git a/docs/man/xl.cfg.pod.5 b/docs/man/xl.cfg.pod.5
-index 0c2cbac..408653f 100644
--- a/docs/man/xl.cfg.pod.5
-+++ b/docs/man/xl.cfg.pod.5
-@@ -1433,6 +1433,11 @@ Specifies what image compression is to be used by spice (if given), otherwise
- the qemu default will be used. Please see documentations of your current qemu
- version for details.
- 
-+=item B<spice_streaming_video=[filter|all|off]>
-+
-+Specifies what streaming video setting is to be used by spice (if given),
-+otherwise the qemu default will be used.
-+
- =back
- 
- =head3 Miscellaneous Emulated Hardware
-diff --git a/tools/libxl/libxl.h b/tools/libxl/libxl.h
-index b8e0b67..c219f59 100644
--- a/tools/libxl/libxl.h
-+++ b/tools/libxl/libxl.h
-@@ -539,6 +539,17 @@ typedef struct libxl__ctx libxl_ctx;
- #define LIBXL_HAVE_SPICE_IMAGECOMPRESSION 1
- 
- /*
-+ * LIBXL_HAVE_SPICE_STREAMINGVIDEO
-+ *
-+ * If defined, then the libxl_spice_info structure will contain a string type
-+ * field: streaming_video. This value defines what Spice streaming video setting
-+ * is used.
-+ *
-+ * If this is not defined, the Spice streaming video setting support is ignored.
-+ */
-+#define LIBXL_HAVE_SPICE_STREAMINGVIDEO 1
-+
-+/*
-  * LIBXL_HAVE_DOMAIN_CREATE_RESTORE_PARAMS 1
-  *
-  * If this is defined, libxl_domain_create_restore()'s API has changed to
-diff --git a/tools/libxl/libxl_dm.c b/tools/libxl/libxl_dm.c
-index 40c8649..d8d6f0c 100644
--- a/tools/libxl/libxl_dm.c
-+++ b/tools/libxl/libxl_dm.c
-@@ -402,6 +402,10 @@ static char *dm_spice_options(libxl__gc *gc,
-         opt = libxl__sprintf(gc, "%s,image-compression=%s", opt,
-                              spice->image_compression);
- 
-+    if (spice->streaming_video)
-+        opt = libxl__sprintf(gc, "%s,streaming-video=%s", opt,
-+                             spice->streaming_video);
-+
-     return opt;
- }
- 
-diff --git a/tools/libxl/libxl_types.idl b/tools/libxl/libxl_types.idl
-index 052ded9..02be466 100644
--- a/tools/libxl/libxl_types.idl
-+++ b/tools/libxl/libxl_types.idl
-@@ -242,6 +242,7 @@ libxl_spice_info = Struct("spice_info", [
-     ("clipboard_sharing", libxl_defbool),
-     ("usbredirection", integer),
-     ("image_compression", string),
-+    ("streaming_video", string),
-     ])
- 
- libxl_sdl_info = Struct("sdl_info", [
-diff --git a/tools/libxl/xl_cmdimpl.c b/tools/libxl/xl_cmdimpl.c
-index 00aa69d..b7eac29 100644
--- a/tools/libxl/xl_cmdimpl.c
-+++ b/tools/libxl/xl_cmdimpl.c
-@@ -1950,6 +1950,8 @@ skip_vfb:
-             b_info->u.hvm.spice.usbredirection = l;
-         xlu_cfg_replace_string (config, "spice_image_compression",
-                                 &b_info->u.hvm.spice.image_compression, 0);
-+        xlu_cfg_replace_string (config, "spice_streaming_video",
-+                                &b_info->u.hvm.spice.streaming_video, 0);
-         xlu_cfg_get_defbool(config, "nographic", &b_info->u.hvm.nographic, 0);
-         xlu_cfg_get_defbool(config, "gfx_passthru",
-                             &b_info->u.hvm.gfx_passthru, 0);
-- 
-1.9.2
-
--- a/third_party/nixpkgs/pkgs/applications/virtualization/xen/0003-Add-qxl-vga-interface-support-for-upstream-qem.patch
+++ b/third_party/nixpkgs/pkgs/applications/virtualization/xen/0003-Add-qxl-vga-interface-support-for-upstream-qem.patch
@ -1,165 +0,0 @@
-From 161212ef02312c0681d2d809c8ff1e1f0ea6f6f9 Mon Sep 17 00:00:00 2001
-From: Fabio Fantoni <fabio.fantoni@m2r.biz>
-Date: Wed, 29 Apr 2015 11:20:28 +0200
-Subject: [PATCH] libxl: Add qxl vga interface support for upstream qemu
-
-Usage:
-vga="qxl"
-
-Qxl vga support many resolutions that not supported by stdvga,
-mainly the 16:9 ones and other high up to 2560x1600.
-With QXL you can get improved performance and smooth video also
-with high resolutions and high quality.
-Require their drivers installed in the domU and spice used
-otherwise act as a simple stdvga.
-
-Signed-off-by: Fabio Fantoni <fabio.fantoni@m2r.biz>
-Signed-off-by: Zhou Peng <zpengxen@gmail.com>
-Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
-Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
-Acked-by: George Dunlap <george.dunlap@eu.citrix.com>
---
- docs/man/xl.cfg.pod.5       | 10 +++++++++-
- tools/libxl/libxl.h         | 10 ++++++++++
- tools/libxl/libxl_create.c  | 13 +++++++++++++
- tools/libxl/libxl_dm.c      |  8 ++++++++
- tools/libxl/libxl_types.idl |  1 +
- tools/libxl/xl_cmdimpl.c    |  2 ++
- 6 files changed, 43 insertions(+), 1 deletion(-)
-
-diff --git a/docs/man/xl.cfg.pod.5 b/docs/man/xl.cfg.pod.5
-index f936dfc..8e4154f 100644
--- a/docs/man/xl.cfg.pod.5
-+++ b/docs/man/xl.cfg.pod.5
-@@ -1360,6 +1360,9 @@ qemu-xen-traditional device-model, the amount of video RAM is fixed at 4 MB,
- which is sufficient for 1024x768 at 32 bpp. For the upstream qemu-xen
- device-model, the default and minimum is 8 MB.
- 
-+For B<qxl> vga, the default is both default and minimal 128MB.
-+If B<videoram> is set less than 128MB, an error will be triggered.
-+
- =item B<stdvga=BOOLEAN>
- 
- Select a standard VGA card with VBE (VESA BIOS Extensions) as the
-@@ -1371,9 +1374,14 @@ This option is deprecated, use vga="stdvga" instead.
- 
- =item B<vga="STRING">
- 
-Selects the emulated video card (none|stdvga|cirrus).
-+Selects the emulated video card (none|stdvga|cirrus|qxl).
- The default is cirrus.
- 
-+In general, QXL should work with the Spice remote display protocol
-+for acceleration, and QXL driver is necessary in guest in this case.
-+QXL can also work with the VNC protocol, but it will be like a standard
-+VGA without acceleration.
-+
- =item B<vnc=BOOLEAN>
- 
- Allow access to the display via the VNC protocol.  This enables the
-diff --git a/tools/libxl/libxl.h b/tools/libxl/libxl.h
-index 44bd8e2..efc0617 100644
--- a/tools/libxl/libxl.h
-+++ b/tools/libxl/libxl.h
-@@ -535,6 +535,16 @@ typedef struct libxl__ctx libxl_ctx;
- #define LIBXL_HAVE_DOMINFO_OUTSTANDING_MEMKB 1
- 
- /*
-+ * LIBXL_HAVE_QXL
-+ *
-+ * If defined, then the libxl_vga_interface_type will contain another value:
-+ * "QXL". This value define if qxl vga is supported.
-+ *
-+ * If this is not defined, the qxl vga support is missed.
-+ */
-+#define LIBXL_HAVE_QXL 1
-+
-+/*
-  * LIBXL_HAVE_SPICE_VDAGENT
-  *
-  * If defined, then the libxl_spice_info structure will contain a boolean type:
-diff --git a/tools/libxl/libxl_create.c b/tools/libxl/libxl_create.c
-index e5a343f..188f7df 100644
--- a/tools/libxl/libxl_create.c
-+++ b/tools/libxl/libxl_create.c
-@@ -248,6 +248,10 @@ int libxl__domain_build_info_setdefault(libxl__gc *gc,
-                 if (b_info->video_memkb == LIBXL_MEMKB_DEFAULT)
-                     b_info->video_memkb = 0;
-                 break;
-+            case LIBXL_VGA_INTERFACE_TYPE_QXL:
-+                LOG(ERROR,"qemu upstream required for qxl vga");
-+                return ERROR_INVAL;
-+                break;
-             case LIBXL_VGA_INTERFACE_TYPE_STD:
-                 if (b_info->video_memkb == LIBXL_MEMKB_DEFAULT)
-                     b_info->video_memkb = 8 * 1024;
-@@ -272,6 +276,15 @@ int libxl__domain_build_info_setdefault(libxl__gc *gc,
-                 if (b_info->video_memkb == LIBXL_MEMKB_DEFAULT)
-                     b_info->video_memkb = 0;
-                 break;
-+            case LIBXL_VGA_INTERFACE_TYPE_QXL:
-+                if (b_info->video_memkb == LIBXL_MEMKB_DEFAULT) {
-+                    b_info->video_memkb = (128 * 1024);
-+                } else if (b_info->video_memkb < (128 * 1024)) {
-+                    LOG(ERROR,
-+                        "128 Mib videoram is the minimum for qxl default");
-+                    return ERROR_INVAL;
-+                }
-+                break;
-             case LIBXL_VGA_INTERFACE_TYPE_STD:
-                 if (b_info->video_memkb == LIBXL_MEMKB_DEFAULT)
-                     b_info->video_memkb = 16 * 1024;
-diff --git a/tools/libxl/libxl_dm.c b/tools/libxl/libxl_dm.c
-index 30c1578..58c9b99 100644
--- a/tools/libxl/libxl_dm.c
-+++ b/tools/libxl/libxl_dm.c
-@@ -251,6 +251,8 @@ static char ** libxl__build_device_model_args_old(libxl__gc *gc,
-         case LIBXL_VGA_INTERFACE_TYPE_NONE:
-             flexarray_append_pair(dm_args, "-vga", "none");
-             break;
-+        case LIBXL_VGA_INTERFACE_TYPE_QXL:
-+            break;
-         }
- 
-         if (b_info->u.hvm.boot) {
-@@ -625,6 +627,12 @@ static char ** libxl__build_device_model_args_new(libxl__gc *gc,
-             break;
-         case LIBXL_VGA_INTERFACE_TYPE_NONE:
-             break;
-+        case LIBXL_VGA_INTERFACE_TYPE_QXL:
-+            /* QXL have 2 ram regions, ram and vram */
-+            flexarray_append_pair(dm_args, "-device",
-+                GCSPRINTF("qxl-vga,vram_size_mb=%"PRIu64",ram_size_mb=%"PRIu64,
-+                (b_info->video_memkb/2/1024), (b_info->video_memkb/2/1024) ) );
-+            break;
-         }
- 
-         if (b_info->u.hvm.boot) {
-diff --git a/tools/libxl/libxl_types.idl b/tools/libxl/libxl_types.idl
-index 117b61d..023b21e 100644
--- a/tools/libxl/libxl_types.idl
-+++ b/tools/libxl/libxl_types.idl
-@@ -183,6 +183,7 @@ libxl_vga_interface_type = Enumeration("vga_interface_type", [
-     (1, "CIRRUS"),
-     (2, "STD"),
-     (3, "NONE"),
-+    (4, "QXL"),
-     ], init_val = "LIBXL_VGA_INTERFACE_TYPE_CIRRUS")
- 
- libxl_vendor_device = Enumeration("vendor_device", [
-diff --git a/tools/libxl/xl_cmdimpl.c b/tools/libxl/xl_cmdimpl.c
-index 648ca08..526a1f6 100644
--- a/tools/libxl/xl_cmdimpl.c
-+++ b/tools/libxl/xl_cmdimpl.c
-@@ -2115,6 +2115,8 @@ skip_vfb:
-                 b_info->u.hvm.vga.kind = LIBXL_VGA_INTERFACE_TYPE_CIRRUS;
-             } else if (!strcmp(buf, "none")) {
-                 b_info->u.hvm.vga.kind = LIBXL_VGA_INTERFACE_TYPE_NONE;
-+            } else if (!strcmp(buf, "qxl")) {
-+                b_info->u.hvm.vga.kind = LIBXL_VGA_INTERFACE_TYPE_QXL;
-             } else {
-                 fprintf(stderr, "Unknown vga \"%s\" specified\n", buf);
-                 exit(1);
-- 
-1.9.2
-
--- a/third_party/nixpkgs/pkgs/applications/virtualization/xen/acpica-utils-20180427.patch
+++ b/third_party/nixpkgs/pkgs/applications/virtualization/xen/acpica-utils-20180427.patch
@ -1,63 +0,0 @@
-From 858dbaaeda33b05c1ac80aea0ba9a03924e09005 Mon Sep 17 00:00:00 2001
-From: =?utf8?q?Roger=20Pau=20Monn=C3=A9?= <roger.pau@citrix.com>
-Date: Wed, 9 May 2018 11:08:12 +0100
-Subject: [PATCH] libacpi: fixes for iasl >= 20180427
-MIME-Version: 1.0
-Content-Type: text/plain; charset=utf8
-Content-Transfer-Encoding: 8bit
-
-New versions of iasl have introduced improved C file generation, as
-reported in the changelog:
-
-iASL: Enhanced the -tc option (which creates an AML hex file in C,
-suitable for import into a firmware project):
-  1) Create a unique name for the table, to simplify use of multiple
-SSDTs.
-  2) Add a protection #ifdef in the file, similar to a .h header file.
-
-The net effect of that on generated files is:
-
-unsigned char AmlCode[] =
-+#ifndef __SSDT_S4_HEX__
-+#define __SSDT_S4_HEX__
-+
-+unsigned char ssdt_s4_aml_code[] =
-
-The above example is from ssdt_s4.asl.
-
-Fix the build with newer versions of iasl by stripping the '_aml_code'
-suffix from the variable name on generated files.
-
-Signed-off-by: Roger Pau MonnÃ© <roger.pau@citrix.com>
-Reviewed-by: Wei Liu <wei.liu2@citrix.com>
-Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Release-acked-by: Juergen Gross <jgross@suse.com>
---
- tools/libacpi/Makefile | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/tools/libacpi/Makefile b/tools/libacpi/Makefile
-index a47a658a25..c17f3924cc 100644
--- a/tools/libacpi/Makefile
-+++ b/tools/libacpi/Makefile
-@@ -43,7 +43,7 @@ all: $(C_SRC) $(H_SRC)
- 
- $(H_SRC): $(ACPI_BUILD_DIR)/%.h: %.asl iasl
- 	iasl -vs -p $(ACPI_BUILD_DIR)/$*.$(TMP_SUFFIX) -tc $<
-	sed -e 's/AmlCode/$*/g' $(ACPI_BUILD_DIR)/$*.hex >$@
-+	sed -e 's/AmlCode/$*/g' -e 's/_aml_code//g' $(ACPI_BUILD_DIR)/$*.hex >$@
- 	rm -f $(addprefix $(ACPI_BUILD_DIR)/, $*.aml $*.hex)
-  
- $(MK_DSDT): mk_dsdt.c
-@@ -76,7 +76,7 @@ $(ACPI_BUILD_DIR)/dsdt_anycpu_arm.asl: $(MK_DSDT)
- 
- $(C_SRC): $(ACPI_BUILD_DIR)/%.c: iasl $(ACPI_BUILD_DIR)/%.asl
- 	iasl -vs -p $(ACPI_BUILD_DIR)/$*.$(TMP_SUFFIX) -tc $(ACPI_BUILD_DIR)/$*.asl
-	sed -e 's/AmlCode/$*/g' $(ACPI_BUILD_DIR)/$*.hex > $@.$(TMP_SUFFIX)
-+	sed -e 's/AmlCode/$*/g' -e 's/_aml_code//g' $(ACPI_BUILD_DIR)/$*.hex > $@.$(TMP_SUFFIX)
- 	echo "int $*_len=sizeof($*);" >> $@.$(TMP_SUFFIX)
- 	mv -f $@.$(TMP_SUFFIX) $@
- 	rm -f $(addprefix $(ACPI_BUILD_DIR)/, $*.aml $*.hex)
-- 
-2.11.0
-
--- a/third_party/nixpkgs/pkgs/applications/virtualization/xen/qemu-gluster-6-compat.diff
+++ b/third_party/nixpkgs/pkgs/applications/virtualization/xen/qemu-gluster-6-compat.diff
@ -1,95 +0,0 @@
-diff --git a/block/gluster.c b/block/gluster.c
-index 01b479fbb9..29552e1186 100644
--- a/block/gluster.c
-+++ b/block/gluster.c
-@@ -15,6 +15,10 @@
- #include "qemu/uri.h"
- #include "qemu/error-report.h"
- 
-+#ifdef CONFIG_GLUSTERFS_FTRUNCATE_HAS_STAT
-+# define glfs_ftruncate(fd, offset) glfs_ftruncate(fd, offset, NULL, NULL)
-+#endif
-+
- #define GLUSTER_OPT_FILENAME        "filename"
- #define GLUSTER_OPT_VOLUME          "volume"
- #define GLUSTER_OPT_PATH            "path"
-@@ -613,7 +617,11 @@ static void qemu_gluster_complete_aio(void *opaque)
- /*
-  * AIO callback routine called from GlusterFS thread.
-  */
-static void gluster_finish_aiocb(struct glfs_fd *fd, ssize_t ret, void *arg)
-+static void gluster_finish_aiocb(struct glfs_fd *fd, ssize_t ret,
-+#ifdef CONFIG_GLUSTERFS_IOCB_HAS_STAT
-+                                 struct glfs_stat *pre, struct glfs_stat *post,
-+#endif
-+                                 void *arg)
- {
-     GlusterAIOCB *acb = (GlusterAIOCB *)arg;
- 
-diff --git a/configure b/configure
-index 4b808f9d17..89fb27fd0d 100755
--- a/configure
-+++ b/configure
-@@ -301,6 +301,8 @@ glusterfs=""
- glusterfs_xlator_opt="no"
- glusterfs_discard="no"
- glusterfs_zerofill="no"
-+glusterfs_ftruncate_has_stat="no"
-+glusterfs_iocb_has_stat="no"
- archipelago="no"
- gtk=""
- gtkabi=""
-@@ -3444,6 +3446,38 @@ if test "$glusterfs" != "no" ; then
-     if $pkg_config --atleast-version=6 glusterfs-api; then
-       glusterfs_zerofill="yes"
-     fi
-+    cat > $TMPC << EOF
-+#include <glusterfs/api/glfs.h>
-+
-+int
-+main(void)
-+{
-+	/* new glfs_ftruncate() passes two additional args */
-+	return glfs_ftruncate(NULL, 0, NULL, NULL);
-+}
-+EOF
-+    if compile_prog "$glusterfs_cflags" "$glusterfs_libs" ; then
-+      glusterfs_ftruncate_has_stat="yes"
-+    fi
-+    cat > $TMPC << EOF
-+#include <glusterfs/api/glfs.h>
-+
-+/* new glfs_io_cbk() passes two additional glfs_stat structs */
-+static void
-+glusterfs_iocb(glfs_fd_t *fd, ssize_t ret, struct glfs_stat *prestat, struct glfs_stat *poststat, void *data)
-+{}
-+
-+int
-+main(void)
-+{
-+	glfs_io_cbk iocb = &glusterfs_iocb;
-+	iocb(NULL, 0 , NULL, NULL, NULL);
-+	return 0;
-+}
-+EOF
-+    if compile_prog "$glusterfs_cflags" "$glusterfs_libs" ; then
-+      glusterfs_iocb_has_stat="yes"
-+    fi
-   else
-     if test "$glusterfs" = "yes" ; then
-       feature_not_found "GlusterFS backend support" \
-@@ -5415,6 +5449,14 @@ if test "$archipelago" = "yes" ; then
-   echo "ARCHIPELAGO_LIBS=$archipelago_libs" >> $config_host_mak
- fi
- 
-+if test "$glusterfs_ftruncate_has_stat" = "yes" ; then
-+  echo "CONFIG_GLUSTERFS_FTRUNCATE_HAS_STAT=y" >> $config_host_mak
-+fi
-+
-+if test "$glusterfs_iocb_has_stat" = "yes" ; then
-+  echo "CONFIG_GLUSTERFS_IOCB_HAS_STAT=y" >> $config_host_mak
-+fi
-+
- if test "$libssh2" = "yes" ; then
-   echo "CONFIG_LIBSSH2=m" >> $config_host_mak
-   echo "LIBSSH2_CFLAGS=$libssh2_cflags" >> $config_host_mak
--- a/third_party/nixpkgs/pkgs/applications/window-managers/cagebreak/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/window-managers/cagebreak/default.nix
@ -1,38 +1,75 @@
-{ lib, stdenv, fetchFromGitHub
-, meson, ninja, pkg-config, wayland, scdoc, makeWrapper
-, wlroots, wayland-protocols, pixman, libxkbcommon
-, cairo , pango, fontconfig, pandoc, systemd, mesa
-, withXwayland ? true, xwayland
+{ lib
+, stdenv
+, fetchFromGitHub
+, cairo
+, fontconfig
+, libxkbcommon
+, makeWrapper
+, mesa
+, meson
+, ninja
 , nixosTests
+, pandoc
+, pango
+, pixman
+, pkg-config
+, scdoc
+, systemd
+, wayland
+, wayland-protocols
+, withXwayland ? true , xwayland
+, wlroots
 }:

 stdenv.mkDerivation rec {
  pname = "cagebreak";
-  version = "1.6.0";
+  version = "1.7.0";

  src = fetchFromGitHub {
    owner = "project-repo";
-    repo = "cagebreak";
+    repo = pname;
    rev = version;
-    hash = "sha256-F7fqDVbJS6pVgmj6C1/l9PAaz5yzcYpaq6oc6a6v/Qk=";
+    hash = "sha256-HpAjJHu5sxZKof3ydnU3wcP5GpnH6Ax8m1T1vVoq+oI=";
  };

-  nativeBuildInputs = [ meson ninja pkg-config wayland scdoc makeWrapper ];
+  nativeBuildInputs = [
+    makeWrapper
+    meson
+    ninja
+    pandoc
+    pkg-config
+    scdoc
+    wayland
+  ];

  buildInputs = [
-    wlroots wayland wayland-protocols pixman libxkbcommon cairo
-    pango fontconfig pandoc systemd
+    cairo
+    fontconfig
+    libxkbcommon
    mesa # for libEGL headers
+    pango
+    pixman
+    systemd
+    wayland
+    wayland-protocols
+    wlroots
  ];

-  outputs = [ "out" "contrib" ];
+  outputs = [
+    "out"
+    "contrib"
+  ];

  mesonFlags = [
-    "-Dxwayland=${lib.boolToString withXwayland}"
-    "-Dversion_override=${version}"
    "-Dman-pages=true"
+    "-Dversion_override=${version}"
+    "-Dxwayland=${lib.boolToString withXwayland}"
  ];

+  postPatch = ''
+    sed -i -e 's|<drm_fourcc.h>|<libdrm/drm_fourcc.h>|' *.c
+  '';
+
  postInstall = ''
    mkdir -p $contrib/share/cagebreak
    cp $src/examples/config $contrib/share/cagebreak/config
--- a/third_party/nixpkgs/pkgs/development/compilers/openjdk/openjfx/15.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/openjdk/openjfx/15.nix
@ -95,8 +95,9 @@ in makePackage {

  postFixup = ''
    # Remove references to bootstrap.
+    export openjdkOutPath='${openjdk11_headless.outPath}'
    find "$out" -name \*.so | while read lib; do
-      new_refs="$(patchelf --print-rpath "$lib" | sed -E 's,:?${lib.escape ["+"] openjdk11_headless.outPath}[^:]*,,')"
+      new_refs="$(patchelf --print-rpath "$lib" | perl -pe 's,:?\Q$ENV{openjdkOutPath}\E[^:]*,,')"
      patchelf --set-rpath "$new_refs" "$lib"
    done
  '';
--- a/third_party/nixpkgs/pkgs/development/libraries/intel-gmmlib/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/intel-gmmlib/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "intel-gmmlib";
-  version = "21.1.2";
+  version = "21.1.3";

  src = fetchFromGitHub {
    owner  = "intel";
    repo   = "gmmlib";
    rev    = "${pname}-${version}";
-    sha256 = "0zs8l0q1q7xps3kxlch6jddxjiny8n8avdg1ghiwbkvgf76gb3as";
+    sha256 = "05vcr2rv6l38j7rv34mvcvzpgc2gjmvsb73wyprgdj71mcwrksyq";
  };

  nativeBuildInputs = [ cmake ];
--- a/third_party/nixpkgs/pkgs/development/libraries/libsvm/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libsvm/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "libsvm";
-  version = "3.24";
+  version = "3.25";

  src = fetchurl {
    url = "https://www.csie.ntu.edu.tw/~cjlin/libsvm/libsvm-${version}.tar.gz";
-    sha256 = "15l69y23fxslrap415dvqb383x5fxvbffp9giszjfqjf38h1m26m";
+    sha256 = "sha256-UjUOiqdAsXbh13Pp3AjxNAIYw34BvsN6uQ2wEn5LteU=";
  };

  buildPhase = ''
--- a/third_party/nixpkgs/pkgs/development/libraries/qscintilla/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/qscintilla/default.nix
@ -6,14 +6,14 @@

 let
  pname = "qscintilla-qt${if withQt5 then "5" else "4"}";
-  version = "2.11.5";
+  version = "2.11.6";

 in stdenv.mkDerivation rec {
  inherit pname version;

  src = fetchurl {
    url = "https://www.riverbankcomputing.com/static/Downloads/QScintilla/${version}/QScintilla-${version}.tar.gz";
-    sha256 = "k2Hib9f7e1gZp+uSxcGIChjem9PtndLrAI5XOIaWcWs=";
+    sha256 = "5zRgV9tH0vs4RGf6/M/LE6oHQTc8XVk7xytVsvDdIKc=";
  };

  sourceRoot = "QScintilla-${version}/Qt4Qt5";
--- a/third_party/nixpkgs/pkgs/development/libraries/xdg-desktop-portal-wlr/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/xdg-desktop-portal-wlr/default.nix
@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub
+{ lib, stdenv, fetchFromGitHub, makeWrapper
 , meson, ninja, pkg-config, wayland-protocols
-, pipewire, wayland, systemd, libdrm, iniparser, scdoc }:
+, pipewire, wayland, systemd, libdrm, iniparser, scdoc, grim }:

 stdenv.mkDerivation rec {
  pname = "xdg-desktop-portal-wlr";
@ -13,13 +13,17 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-6ArUQfWx5rNdpsd8Q22MqlpxLT8GTSsymAf21zGe1KI=";
  };

-  nativeBuildInputs = [ meson ninja pkg-config wayland-protocols ];
+  nativeBuildInputs = [ meson ninja pkg-config wayland-protocols makeWrapper ];
  buildInputs = [ pipewire wayland systemd libdrm iniparser scdoc ];

  mesonFlags = [
    "-Dsd-bus-provider=libsystemd"
  ];

+  postInstall = ''
+    wrapProgram $out/libexec/xdg-desktop-portal-wlr --prefix PATH ":" ${lib.makeBinPath [ grim ]}
+  '';
+
  meta = with lib; {
    homepage = "https://github.com/emersion/xdg-desktop-portal-wlr";
    description = "xdg-desktop-portal backend for wlroots";
--- a/third_party/nixpkgs/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/aioesphomeapi/default.nix
@ -22,6 +22,6 @@ buildPythonPackage rec {
    description = "Python Client for ESPHome native API";
    homepage = "https://github.com/esphome/aioesphomeapi";
    license = licenses.mit;
-    maintainers = with maintainers; [ dotlambda ];
+    maintainers = with maintainers; [ fab hexa ];
  };
 }
--- a/third_party/nixpkgs/pkgs/development/python-modules/authcaptureproxy/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/authcaptureproxy/default.nix
@ -0,0 +1,60 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, aiohttp
+, beautifulsoup4
+, httpx
+, importlib-metadata
+, multidict
+, typer
+, yarl
+, pytest-asyncio
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "authcaptureproxy";
+  version = "1.0.1";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "alandtse";
+    repo = "auth_capture_proxy";
+    rev = "v${version}";
+    sha256 = "1fbrmh6qa3dm3q3zdxaa0fls94wardbcvnjgwxk686wpjgs1xrs4";
+  };
+
+  postPatch = ''
+    # https://github.com/alandtse/auth_capture_proxy/issues/14
+    substituteInPlace pyproject.toml --replace \
+      "poetry.masonry.api" \
+      "poetry.core.masonry.api"
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    aiohttp
+    beautifulsoup4
+    httpx
+    importlib-metadata
+    multidict
+    typer
+    yarl
+  ];
+
+  checkInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  meta = with lib; {
+    description = "A proxy to capture authentication information from a webpage";
+    homepage = "https://github.com/alandtse/auth_capture_proxy";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ graham33 hexa ];
+  };
+}
--- a/third_party/nixpkgs/pkgs/development/python-modules/bellows/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/bellows/default.nix
@ -14,13 +14,13 @@

 buildPythonPackage rec {
  pname = "bellows";
-  version = "0.23.1";
+  version = "0.24.0";

  src = fetchFromGitHub {
    owner = "zigpy";
    repo = "bellows";
    rev = version;
-    sha256 = "sha256-c9rKRmGMlYrzVQmUuM9P3c/Jm4QVM2aBRSZ0OkyrPTY=";
+    sha256 = "00sa4x1qzv861z9d83lk4lp1g2pqiv9hpawj92w4qn1wnqxbz6rw";
  };

  prePatch = ''
--- a/third_party/nixpkgs/pkgs/development/python-modules/pysmappee/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pysmappee/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "pysmappee";
-  version = "0.2.24";
+  version = "0.2.25";
  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "smappee";
    repo = pname;
    rev = version;
-    sha256 = "sha256-M1qzwGf8q4WgkEL0nK1yjn3JSBbP7mr75IV45Oa+ypM=";
+    sha256 = "0ld3pb86dq61fcvr6zigdz1vjjcwf7izzkajyg82nmb508a570d7";
  };

  propagatedBuildInputs = [
--- a/third_party/nixpkgs/pkgs/development/python-modules/pysonos/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pysonos/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "pysonos";
-  version = "0.0.43";
+  version = "0.0.44";

  disabled = !isPy3k;

@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "amelchio";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-OobKlAymXXvQH6m77Uqn2eoTlWgs8EBxYIDFJ5wwMKA=";
+    sha256 = "108818mkb037zs4ikilrskfppcbmqslsm6zaxmy8pphjh7c299mz";
  };

  propagatedBuildInputs = [ ifaddr requests xmltodict ];
--- a/third_party/nixpkgs/pkgs/development/python-modules/simplisafe-python/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/simplisafe-python/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "simplisafe-python";
-  version = "9.6.9";
+  version = "9.6.10";
  format = "pyproject";
  disabled = pythonOlder "3.6";

@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "bachya";
    repo = pname;
    rev = version;
-    sha256 = "1q5w5pvrgj94bzd5wig79l4hipkfrcdah54rvwyi7b8q46gw77sg";
+    sha256 = "0cc5kxxishxhkg1nqmgbh36yxs8yjfynmimzjnaqkqfrs9iq46mr";
  };

  nativeBuildInputs = [ poetry-core ];
--- a/third_party/nixpkgs/pkgs/development/python-modules/teslajsonpy/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/teslajsonpy/default.nix
@ -1,10 +1,12 @@
 { lib
 , aiohttp
+, authcaptureproxy
 , backoff
 , beautifulsoup4
 , buildPythonPackage
 , fetchFromGitHub
 , fetchpatch
+, poetry-core
 , pytest-asyncio
 , pytestCheckHook
 , wrapt
@ -12,24 +14,22 @@

 buildPythonPackage rec {
  pname = "teslajsonpy";
-  version = "0.11.5";
+  version = "0.18.3";
+  format = "pyproject";

  src = fetchFromGitHub {
    owner = "zabuldon";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-s0IZ1UNldYddaR3zJoYS6ey8Kjxd1fr4fOwf0gNNbow=";
+    sha256 = "1hdc5gm6dg1vw6qfs3z6mg2m94scrvjphj0lin6pi8n3zqj1h26k";
  };

-  patches = [
-    (fetchpatch {
-      name = "dont-use-dummpy-module-bs4.patch";
-      url = "https://github.com/zabuldon/teslajsonpy/pull/138/commits/f5a788e47d8338c8ebb06d954f802ba1ec614db3.patch";
-      sha256 = "0rws7fhxmca8d5w0bkygx8scvzah3yvb3yfhn05qmp73mn3pmcb3";
-    })
+  nativeBuildInputs = [
+    poetry-core
  ];

  propagatedBuildInputs = [
+    authcaptureproxy
    aiohttp
    backoff
    beautifulsoup4
--- a/third_party/nixpkgs/pkgs/development/python-modules/yeelight/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/yeelight/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "yeelight";
-  version = "0.6.1";
+  version = "0.6.2";
  disabled = pythonOlder "3.4";

  src = fetchFromGitLab {
    owner = "stavros";
    repo = "python-yeelight";
    rev = "v${version}";
-    sha256 = "sha256-LB7A8E22hyqhVBElrOwtC3IPNkyQkU7ZJ1ScqaXQ6zs=";
+    sha256 = "0v0i0s8d5z6b63f2sy42wf85drdzrzswlm1hknzr7v6lfr52pwwm";
  };

  propagatedBuildInputs = [
@ -35,7 +35,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Python library for controlling YeeLight RGB bulbs";
    homepage = "https://gitlab.com/stavros/python-yeelight/";
-    license = licenses.asl20;
+    license = licenses.bsd2;
    maintainers = with maintainers; [ nyanloutre ];
  };
 }
--- a/third_party/nixpkgs/pkgs/development/tools/build-managers/mill/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/build-managers/mill/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "mill";
-  version = "0.9.5";
+  version = "0.9.6";

  src = fetchurl {
    url = "https://github.com/com-lihaoyi/mill/releases/download/${version}/${version}";
-    sha256 = "142vr40p60mapvvb5amn8hz6a8930kxsz510baql40hai4yhga7z";
+    sha256 = "sha256-cAhcTmSPkV5z5ryuCNrpxy9/1iWvvminiVYul9c/DwM=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/third_party/nixpkgs/pkgs/development/tools/misc/hydra/common.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/misc/hydra/common.nix
@ -37,6 +37,8 @@ let
        CatalystViewTT
        CatalystXScriptServerStarman
        CatalystXRoleApplicator
+        CryptPassphrase
+        CryptPassphraseArgon2
        CryptRandPasswd
        DBDPg
        DBDSQLite
@ -61,6 +63,7 @@ let
        SQLSplitStatement
        SetScalar
        Starman
+        StringCompareConstantTime
        SysHostnameLong
        TermSizeAny
        TextDiff
--- a/third_party/nixpkgs/pkgs/development/tools/misc/hydra/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/misc/hydra/default.nix
@ -2,12 +2,12 @@

 {
  hydra-unstable = callPackage ./common.nix {
-    version = "2021-04-29";
+    version = "2021-05-03";
    src = fetchFromGitHub {
      owner = "NixOS";
      repo = "hydra";
-      rev = "6047b1dd04d44acff9343b6b971ab609b73099d5";
-      sha256 = "sha256-E7JOHhSd4gIzE6FvSZVMxZE9WagbBkrfZVoibkanaYE=";
+      rev = "886e6f85e45a1f757e9b77d2a9e4539fbde29468";
+      sha256 = "t7Qb57Xjc0Ou+VDGC1N5u9AmeODW6MVOwKSrYRJq5f0=";
    };
    nix = nixFlakes;

--- a/third_party/nixpkgs/pkgs/development/tools/misc/strace/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/misc/strace/default.nix
@ -27,6 +27,6 @@ stdenv.mkDerivation rec {
    description = "A system call tracer for Linux";
    license =  with licenses; [ lgpl21Plus gpl2Plus ]; # gpl2Plus is for the test suite
    platforms = platforms.linux;
-    maintainers = with maintainers; [ globin ma27 ];
+    maintainers = with maintainers; [ globin ma27 qyliss ];
  };
 }
--- a/third_party/nixpkgs/pkgs/development/tools/rep/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/rep/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "rep";
-  version = "0.2.1";
+  version = "0.2.2";

  src = fetchFromGitHub {
    owner = "eraserhd";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1p0dbaj7f4irzzw1m44x3b3j3jjij9i4rs83wkrpiamlq61077di";
+    sha256 = "pqmISVm3rYGxRuwKieVpRwXE8ufWnBHEA6h2hrob51s=";
  };

  nativeBuildInputs = [
--- a/third_party/nixpkgs/pkgs/development/tools/rust/maturin/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/rust/maturin/default.nix
@ -10,7 +10,7 @@

 rustPlatform.buildRustPackage rec {
  pname = "maturin";
-  version = "0.9.4";
+  version = "0.10.4";

  src = fetchFromGitHub {
    owner = "PyO3";
@ -19,7 +19,7 @@ rustPlatform.buildRustPackage rec {
    hash = "sha256-9emrBajFd0eLHcsd9Uf6MLCWqZFqxmZdWPBLGIYc2kU=";
  };

-  cargoHash = "sha256-poMMEj+zrlU+v5axJbZai2kv36stEKgaciF4zd9A6Qg=";
+  cargoSha256 = "113i7a5hpz7qch45wwapp53ixvgssnlxm0810yjicxp3k61ak30j";

  nativeBuildInputs = [ pkg-config ];

--- a/third_party/nixpkgs/pkgs/development/tools/rust/sqlx-cli/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/rust/sqlx-cli/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "sqlx-cli";
-  version = "0.4.2";
+  version = "0.5.2";

  src = fetchFromGitHub {
    owner = "launchbadge";
    repo = "sqlx";
    rev = "v${version}";
-    sha256 = "1q6p4qly9qjn333nj72sar6nbyclfdw9i9l6rnimswylj0rr9n27";
+    sha256 = "0jz0gddw1xp51rnap0dsyq4886x2glmr087r1lf3fxlnv6anaqn9";
  };

-  cargoSha256 = "1393mwx6iccnqrry4ia4prcnnjxhp4zjq1s3gzwzfyzsrqyad54g";
+  cargoSha256 = "046blw366d6zjpq944g9n4cdhhv2w97qfi1ynljc9bnz03d8v39c";

  doCheck = false;
  cargoBuildFlags = [ "-p sqlx-cli" ];
--- a/third_party/nixpkgs/pkgs/games/factorio/versions.json
+++ b/third_party/nixpkgs/pkgs/games/factorio/versions.json
@ -2,12 +2,12 @@
  "x86_64-linux": {
    "alpha": {
      "experimental": {
-        "name": "factorio_alpha_x64-1.1.32.tar.xz",
+        "name": "factorio_alpha_x64-1.1.33.tar.xz",
        "needsAuth": true,
-        "sha256": "0ciz7y8xqlk9vg3akvflq1aabzgbqpazfnihyk4gsadk12b6a490",
+        "sha256": "0qgr609w8pgjpmh8ycf0b846v0i019b393x71i790lb7vcygl2aa",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.32/alpha/linux64",
-        "version": "1.1.32"
+        "url": "https://factorio.com/get-download/1.1.33/alpha/linux64",
+        "version": "1.1.33"
      },
      "stable": {
        "name": "factorio_alpha_x64-1.1.32.tar.xz",
@ -38,12 +38,12 @@
    },
    "headless": {
      "experimental": {
-        "name": "factorio_headless_x64-1.1.32.tar.xz",
+        "name": "factorio_headless_x64-1.1.33.tar.xz",
        "needsAuth": false,
-        "sha256": "0dg98ycs7m8rm996pk0p1iajalpmiy30p0pwr9dw2chf1d887kvz",
+        "sha256": "0iv667l25aaij3g9v3mqxhkpphfbc6dhdghsg5qdw4l59vh6fpd4",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.32/headless/linux64",
-        "version": "1.1.32"
+        "url": "https://factorio.com/get-download/1.1.33/headless/linux64",
+        "version": "1.1.33"
      },
      "stable": {
        "name": "factorio_headless_x64-1.1.32.tar.xz",
--- a/third_party/nixpkgs/pkgs/pkgs-lib/formats.nix
+++ b/third_party/nixpkgs/pkgs/pkgs-lib/formats.nix
@ -56,7 +56,16 @@ rec {
      };
    };

-  ini = { listsAsDuplicateKeys ? false, ... }@args: {
+  ini = {
+    # Represents lists as duplicate keys
+    listsAsDuplicateKeys ? false,
+    # Alternative to listsAsDuplicateKeys, converts list to non-list
+    # listToValue :: [IniAtom] -> IniAtom
+    listToValue ? null,
+    ...
+    }@args:
+    assert !listsAsDuplicateKeys || listToValue == null;
+    {

    type = with lib.types; let

@ -74,12 +83,25 @@ rec {
          coercedTo singleIniAtom lib.singleton (listOf singleIniAtom) // {
            description = singleIniAtom.description + " or a list of them for duplicate keys";
          }
+        else if listToValue != null then
+          coercedTo singleIniAtom lib.singleton (nonEmptyListOf singleIniAtom) // {
+            description = singleIniAtom.description + " or a non-empty list of them";
+          }
        else
          singleIniAtom;

    in attrsOf (attrsOf iniAtom);

-    generate = name: value: pkgs.writeText name (lib.generators.toINI args value);
+    generate = name: value:
+      let
+        transformedValue =
+          if listToValue != null
+          then
+            lib.mapAttrs (section: lib.mapAttrs (key: val:
+              if lib.isList val then listToValue val else val
+            )) value
+          else value;
+      in pkgs.writeText name (lib.generators.toINI (removeAttrs args ["listToValue"]) transformedValue);

  };

--- a/third_party/nixpkgs/pkgs/pkgs-lib/tests/formats.nix
+++ b/third_party/nixpkgs/pkgs/pkgs-lib/tests/formats.nix
@ -124,6 +124,22 @@ in runBuildTests {
    '';
  };

+  testIniListToValue = {
+    drv = evalFormat formats.ini { listToValue = concatMapStringsSep ", " (generators.mkValueStringDefault {}); } {
+      foo = {
+        bar = [ null true "test" 1.2 10 ];
+        baz = false;
+        qux = "qux";
+      };
+    };
+    expected = ''
+      [foo]
+      bar=null, true, test, 1.200000, 10
+      baz=false
+      qux=qux
+    '';
+  };
+
  testTomlAtoms = {
    drv = evalFormat formats.toml {} {
      false = false;
--- a/third_party/nixpkgs/pkgs/servers/computing/slurm/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/computing/slurm/default.nix
@ -9,7 +9,7 @@

 stdenv.mkDerivation rec {
  pname = "slurm";
-  version = "20.11.5.1";
+  version = "20.11.6.1";

  # N.B. We use github release tags instead of https://www.schedmd.com/downloads.php
  # because the latter does not keep older releases.
@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
    repo = "slurm";
    # The release tags use - instead of .
    rev = "${pname}-${builtins.replaceStrings ["."] ["-"] version}";
-    sha256 = "1anzjv9sdl1a3j6sxsy2q8dy4dax1a4yqc9rnprlzymjkgb8hy75";
+    sha256 = "1c2dqqddw5bfb27smq7rqa7v1wymdj155ky50rbyvl36pmhc9djp";
  };

  outputs = [ "out" "dev" ];
--- a/third_party/nixpkgs/pkgs/servers/home-assistant/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/home-assistant/default.nix
@ -389,6 +389,7 @@ in with py.pkgs; buildPythonApplication rec {
    "tasmota"
    "tcp"
    "template"
+    "tesla"
    "threshold"
    "time_date"
    "timer"
--- a/third_party/nixpkgs/pkgs/servers/mail/exim/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/mail/exim/default.nix
@ -9,11 +9,11 @@

 stdenv.mkDerivation rec {
  pname = "exim";
-  version = "4.94";
+  version = "4.94.2";

  src = fetchurl {
    url = "https://ftp.exim.org/pub/exim/exim4/${pname}-${version}.tar.xz";
-    sha256 = "1nsb2i5mqxfz1sl1bmbxmpb2qiaf3wffhfiw4j9vfpagy3xfhzpp";
+    sha256 = "0x4j698gsawm8a3bz531pf1k6izyxfvry4hj5wb0aqphi7y62605";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/third_party/nixpkgs/pkgs/servers/monitoring/prometheus/knot-exporter.nix
+++ b/third_party/nixpkgs/pkgs/servers/monitoring/prometheus/knot-exporter.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, lib, python3, nixosTests }:
+{ stdenv, fetchFromGitHub, lib, python3, nixosTests, fetchpatch }:

 stdenv.mkDerivation rec {
  pname = "knot-exporter";
@ -11,6 +11,15 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-4au4lpaq3jcqC2JXdCcf8h+YN8Nmm4eE0kZwA+1rWlc=";
  };

+  patches = [
+    # Fixes a crash with all metrics enabled. See
+    # https://github.com/ghedo/knot_exporter/pull/6 for further context.
+    (fetchpatch {
+      url = "https://github.com/ghedo/knot_exporter/commit/2317476e080369450ae51a707ccd30d4b89d680f.patch";
+      sha256 = "sha256-yEPu8EE1V/draNx9DeMrPj+bMfJRxauweo33dITl4AA=";
+    })
+  ];
+
  dontBuild = true;

  nativeBuildInputs = [ python3.pkgs.wrapPython ];
--- a/third_party/nixpkgs/pkgs/servers/teleport/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/teleport/default.nix
@ -11,14 +11,14 @@ in

 buildGoModule rec {
  pname = "teleport";
-  version = "6.1.2";
+  version = "6.1.3";

  # This repo has a private submodule "e" which fetchgit cannot handle without failing.
  src = fetchFromGitHub {
    owner = "gravitational";
    repo = "teleport";
    rev = "v${version}";
-    sha256 = "sha256-4ZaebTTgGrGRQbMfDw1PL/qtDKmHbSY6kPmWyFeIcAU=";
+    sha256 = "sha256-kb7qRPZKXDY0Qy3/72epAGaN2FCOO/XAN8lOoUYkoM0=";
  };

  vendorSha256 = null;
@ -27,6 +27,9 @@ buildGoModule rec {

  nativeBuildInputs = [ zip makeWrapper ];

+  # https://github.com/NixOS/nixpkgs/issues/120738
+  patches = [ ./tsh.patch ];
+
  postBuild = ''
    pushd .
    mkdir -p build
@ -54,8 +57,8 @@ buildGoModule rec {

  postInstall = ''
    install -Dm755 -t $client/bin $out/bin/tsh
-    wrapProgram $client/bin/tsh --prefix PATH : ${xdg-utils}/bin
-    wrapProgram $out/bin/tsh --prefix PATH : ${xdg-utils}/bin
+    wrapProgram $client/bin/tsh --prefix PATH : ${lib.makeBinPath [ xdg-utils ]}
+    wrapProgram $out/bin/tsh --prefix PATH : ${lib.makeBinPath [ xdg-utils ]}
  '';

  doInstallCheck = true;
--- a/third_party/nixpkgs/pkgs/servers/teleport/tsh.patch
+++ b/third_party/nixpkgs/pkgs/servers/teleport/tsh.patch
@ -0,0 +1,17 @@
+diff --git a/tool/tsh/tsh.go b/tool/tsh/tsh.go
+index 57379c40f..cb4d7b84c 100644
+--- a/tool/tsh/tsh.go
+++ b/tool/tsh/tsh.go
+@@ -514,10 +514,11 @@ func Run(args []string, opts ...cliOption) error {
+ 		}
+ 	}
+ 
+-	cf.executablePath, err = os.Executable()
+	tempBinaryPath, err := os.Executable()
+ 	if err != nil {
+ 		return trace.Wrap(err)
+ 	}
+	cf.executablePath = path.Dir(tempBinaryPath) + "/tsh"
+ 
+ 	if err := client.ValidateAgentKeyOption(cf.AddKeysToAgent); err != nil {
+ 		return trace.Wrap(err)
--- a/third_party/nixpkgs/pkgs/servers/web-apps/bookstack/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/bookstack/default.nix
@ -15,13 +15,13 @@ let

 in package.override rec {
  name = "bookstack";
-  version = "0.31.7";
+  version = "21.04.3";

  src = fetchFromGitHub {
    owner = "bookstackapp";
    repo = name;
    rev = "v${version}";
-    sha256 = "1jak6g2q4zbr0gxqj0bqhks687whmmw8ylzwm4saws7ikcxkwna4";
+    sha256 = "1vkl0v3c5q0734xvvqinq4zikhy37wjys6nj1h9qdbbka0h39592";
  };

  meta = with lib; {
--- a/third_party/nixpkgs/pkgs/servers/web-apps/bookstack/php-packages.nix
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/bookstack/php-packages.nix
@ -5,20 +5,20 @@ let
    "aws/aws-sdk-php" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "aws-aws-sdk-php-3e6143f5c12986d727307d5d19d6aec21575d903";
+        name = "aws-aws-sdk-php-0aa83b522d5ffa794c02e7411af87a0e241a3082";
        src = fetchurl {
-          url = https://api.github.com/repos/aws/aws-sdk-php/zipball/3e6143f5c12986d727307d5d19d6aec21575d903;
-          sha256 = "16hbw8gqscbc3bcvnfdsll6x1653lq2s4dga3d5jbpczil3ws9yb";
+          url = https://api.github.com/repos/aws/aws-sdk-php/zipball/0aa83b522d5ffa794c02e7411af87a0e241a3082;
+          sha256 = "03qahdj01bz76aar21limham7xnv5r0d61gfk1fph8ljf2gbg33i";
        };
      };
    };
    "barryvdh/laravel-dompdf" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "barryvdh-laravel-dompdf-30310e0a675462bf2aa9d448c8dcbf57fbcc517d";
+        name = "barryvdh-laravel-dompdf-5b99e1f94157d74e450f4c97e8444fcaffa2144b";
        src = fetchurl {
-          url = https://api.github.com/repos/barryvdh/laravel-dompdf/zipball/30310e0a675462bf2aa9d448c8dcbf57fbcc517d;
-          sha256 = "1fnan9b2g4xhqqvlfsn3alb4nx5jjlrapgiad2kca13b3gizv7zr";
+          url = https://api.github.com/repos/barryvdh/laravel-dompdf/zipball/5b99e1f94157d74e450f4c97e8444fcaffa2144b;
+          sha256 = "1r82fzrnjrjy5jgpyc071miiw1rwhwys9ccj81gs3yydq9hi4crw";
        };
      };
    };
@ -45,10 +45,20 @@ let
    "doctrine/dbal" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "doctrine-dbal-47433196b6390d14409a33885ee42b6208160643";
+        name = "doctrine-dbal-c800380457948e65bbd30ba92cc17cda108bf8c9";
        src = fetchurl {
-          url = https://api.github.com/repos/doctrine/dbal/zipball/47433196b6390d14409a33885ee42b6208160643;
-          sha256 = "0bcg9494hr31902zcmq5kk7ji78yxk074d5bd9chxn9q0xz4g2h8";
+          url = https://api.github.com/repos/doctrine/dbal/zipball/c800380457948e65bbd30ba92cc17cda108bf8c9;
+          sha256 = "1x6bij89yaj0d52ffx683rlpxrgxl0vx9q6a121mkz1zplnif647";
+        };
+      };
+    };
+    "doctrine/deprecations" = {
+      targetDir = "";
+      src = composerEnv.buildZipPackage {
+        name = "doctrine-deprecations-9504165960a1f83cc1480e2be1dd0a0478561314";
+        src = fetchurl {
+          url = https://api.github.com/repos/doctrine/deprecations/zipball/9504165960a1f83cc1480e2be1dd0a0478561314;
+          sha256 = "04kpbzk5iw86imspkg7dgs54xx877k9b5q0dfg2h119mlfkvxil6";
        };
      };
    };
@ -85,10 +95,10 @@ let
    "dompdf/dompdf" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "dompdf-dompdf-db91d81866c69a42dad1d2926f61515a1e3f42c5";
+        name = "dompdf-dompdf-8768448244967a46d6e67b891d30878e0e15d25c";
        src = fetchurl {
-          url = https://api.github.com/repos/dompdf/dompdf/zipball/db91d81866c69a42dad1d2926f61515a1e3f42c5;
-          sha256 = "10nsmaiqfk6wgv0l9wjsh7h8nigdfabygkhjk7wdbxdfvlvniddd";
+          url = https://api.github.com/repos/dompdf/dompdf/zipball/8768448244967a46d6e67b891d30878e0e15d25c;
+          sha256 = "0mgsry4mq5bx6b74h3akay1bp03rnsl8ppcjxjkfjlq4svq7m5yf";
        };
      };
    };
@ -115,10 +125,10 @@ let
    "facade/flare-client-php" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "facade-flare-client-php-ef0f5bce23b30b32d98fd9bb49c6fa37b40eb546";
+        name = "facade-flare-client-php-6bf380035890cb0a09b9628c491ae3866b858522";
        src = fetchurl {
-          url = https://api.github.com/repos/facade/flare-client-php/zipball/ef0f5bce23b30b32d98fd9bb49c6fa37b40eb546;
-          sha256 = "1car7k8zzkgib9wpi9lzw1dj9qgjak8s9dmiimxaigvb7q4bc5vk";
+          url = https://api.github.com/repos/facade/flare-client-php/zipball/6bf380035890cb0a09b9628c491ae3866b858522;
+          sha256 = "1y0rjlpd71jkl0zzl3q4flv5s9gbk87947xgfi8w62sg5g7jjgl2";
        };
      };
    };
@ -135,10 +145,10 @@ let
    "facade/ignition-contracts" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "facade-ignition-contracts-aeab1ce8b68b188a43e81758e750151ad7da796b";
+        name = "facade-ignition-contracts-3c921a1cdba35b68a7f0ccffc6dffc1995b18267";
        src = fetchurl {
-          url = https://api.github.com/repos/facade/ignition-contracts/zipball/aeab1ce8b68b188a43e81758e750151ad7da796b;
-          sha256 = "0b5hv56758fh2y6fqbygwn94qgqwjan8d2s1i10m242x80h9jjiw";
+          url = https://api.github.com/repos/facade/ignition-contracts/zipball/3c921a1cdba35b68a7f0ccffc6dffc1995b18267;
+          sha256 = "1nsjwd1k9q8qmfvh7m50rs42yxzxyq4f56r6dq205gwcmqsjb2j0";
        };
      };
    };
@ -155,40 +165,40 @@ let
    "filp/whoops" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "filp-whoops-df7933820090489623ce0be5e85c7e693638e536";
+        name = "filp-whoops-d501fd2658d55491a2295ff600ae5978eaad7403";
        src = fetchurl {
-          url = https://api.github.com/repos/filp/whoops/zipball/df7933820090489623ce0be5e85c7e693638e536;
-          sha256 = "0azpv2r8hc9s5pbk9wh2qk52qzycsbvpijr8w68l311igpcj4f78";
+          url = https://api.github.com/repos/filp/whoops/zipball/d501fd2658d55491a2295ff600ae5978eaad7403;
+          sha256 = "1mpgkl7yzw9j4pxkw404fvykapr42347lyz7jgrl1ks61pk6s9v5";
        };
      };
    };
    "guzzlehttp/guzzle" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "guzzlehttp-guzzle-0aa74dfb41ae110835923ef10a9d803a22d50e79";
+        name = "guzzlehttp-guzzle-7008573787b430c1c1f650e3722d9bba59967628";
        src = fetchurl {
-          url = https://api.github.com/repos/guzzle/guzzle/zipball/0aa74dfb41ae110835923ef10a9d803a22d50e79;
-          sha256 = "0gba1711dpi147fzi2ab2pg0k1g6zfanm5w5hf4c7w0b3h4ya5gj";
+          url = https://api.github.com/repos/guzzle/guzzle/zipball/7008573787b430c1c1f650e3722d9bba59967628;
+          sha256 = "10fiv9ifhz5vg78z4xa41dkwic5ql4m6xf8bglyvpw3x7b76l81m";
        };
      };
    };
    "guzzlehttp/promises" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "guzzlehttp-promises-60d379c243457e073cff02bc323a2a86cb355631";
+        name = "guzzlehttp-promises-8e7d04f1f6450fef59366c399cfad4b9383aa30d";
        src = fetchurl {
-          url = https://api.github.com/repos/guzzle/promises/zipball/60d379c243457e073cff02bc323a2a86cb355631;
-          sha256 = "0lvcr64bx9sb90qggxk7g7fsplz403gm3i8lnlcaifyjrlmdj5wb";
+          url = https://api.github.com/repos/guzzle/promises/zipball/8e7d04f1f6450fef59366c399cfad4b9383aa30d;
+          sha256 = "158wd8nmvvl386c24lkr4jkwdhqpdj0dxdbjwh8iv6a2rgccjr2q";
        };
      };
    };
    "guzzlehttp/psr7" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "guzzlehttp-psr7-53330f47520498c0ae1f61f7e2c90f55690c06a3";
+        name = "guzzlehttp-psr7-35ea11d335fd638b5882ff1725228b3d35496ab1";
        src = fetchurl {
-          url = https://api.github.com/repos/guzzle/psr7/zipball/53330f47520498c0ae1f61f7e2c90f55690c06a3;
-          sha256 = "0948mbbqn1xcz39diajhvlr9a7586vx3091kzx96m0z4ki3lhv7g";
+          url = https://api.github.com/repos/guzzle/psr7/zipball/35ea11d335fd638b5882ff1725228b3d35496ab1;
+          sha256 = "1nsd7sla2jpx9kzg0lzk4kvc66d30bnkf2yfzdp7gghb67wvajfa";
        };
      };
    };
@ -215,30 +225,30 @@ let
    "laravel/framework" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "laravel-framework-d0e4731e92ca88f4a78fe9e0c2c426a3e8c063c8";
+        name = "laravel-framework-d94c07d72c14f07e7d2027458e7f0a76f9ceb0d9";
        src = fetchurl {
-          url = https://api.github.com/repos/laravel/framework/zipball/d0e4731e92ca88f4a78fe9e0c2c426a3e8c063c8;
-          sha256 = "15zjpq6lbxs019vd0mm2nbfi91yyw40wsf5fl0jbw3s1ffvaq898";
+          url = https://api.github.com/repos/laravel/framework/zipball/d94c07d72c14f07e7d2027458e7f0a76f9ceb0d9;
+          sha256 = "02cml6rg3qxnr8gynnd8iqwdyzflqwnyivxw034dzbm60xpg6w93";
        };
      };
    };
    "laravel/socialite" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "laravel-socialite-8d25d574b4f2005411c0b9cb527ef5e745c1b07d";
+        name = "laravel-socialite-1960802068f81e44b2ae9793932181cf1cb91b5c";
        src = fetchurl {
-          url = https://api.github.com/repos/laravel/socialite/zipball/8d25d574b4f2005411c0b9cb527ef5e745c1b07d;
-          sha256 = "0ash56za1flniq9nnk3siyb8l0m2cjwn2n25315qfhmdgbxxjz68";
+          url = https://api.github.com/repos/laravel/socialite/zipball/1960802068f81e44b2ae9793932181cf1cb91b5c;
+          sha256 = "1v68icdk7x1qbnhzsvpzv4nj0hwdw70s75g2bzbvmli6ah0kvvck";
        };
      };
    };
    "league/commonmark" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "league-commonmark-11df9b36fd4f1d2b727a73bf14931d81373b9a54";
+        name = "league-commonmark-08fa59b8e4e34ea8a773d55139ae9ac0e0aecbaf";
        src = fetchurl {
-          url = https://api.github.com/repos/thephpleague/commonmark/zipball/11df9b36fd4f1d2b727a73bf14931d81373b9a54;
-          sha256 = "15chm1sa65b58b47am00ik03s2agnx49i8yww3mhqlijvbrjvxc3";
+          url = https://api.github.com/repos/thephpleague/commonmark/zipball/08fa59b8e4e34ea8a773d55139ae9ac0e0aecbaf;
+          sha256 = "10bs8r0qiq9bybypnascvk7a7181699cnwl27yq4m108cj1i223h";
        };
      };
    };
@ -305,10 +315,10 @@ let
    "nesbot/carbon" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "nesbot-carbon-528783b188bdb853eb21239b1722831e0f000a8d";
+        name = "nesbot-carbon-2fd2c4a77d58a4e95234c8a61c5df1f157a91bf4";
        src = fetchurl {
-          url = https://api.github.com/repos/briannesbitt/Carbon/zipball/528783b188bdb853eb21239b1722831e0f000a8d;
-          sha256 = "18pvfwjvclfj0mrgqvycgrbyx5jfcp1hks4yljc6mp66yxr787x4";
+          url = https://api.github.com/repos/briannesbitt/Carbon/zipball/2fd2c4a77d58a4e95234c8a61c5df1f157a91bf4;
+          sha256 = "0riizvfqxvvbkhhfadcqr8717s0q12p00qmffv26664h5kckl58r";
        };
      };
    };
@ -325,20 +335,20 @@ let
    "onelogin/php-saml" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "onelogin-php-saml-a7328b11887660ad248ea10952dd67a5aa73ba3b";
+        name = "onelogin-php-saml-f30f5062f3653c4d2082892d207f4dc3e577d979";
        src = fetchurl {
-          url = https://api.github.com/repos/onelogin/php-saml/zipball/a7328b11887660ad248ea10952dd67a5aa73ba3b;
-          sha256 = "0ycj3n22k5i3h8p7gn0xff6a7smjypazl2k5qvyzg86fjr7s3vfv";
+          url = https://api.github.com/repos/onelogin/php-saml/zipball/f30f5062f3653c4d2082892d207f4dc3e577d979;
+          sha256 = "0nl431rx1gngc2g92w4hjf2y26vjvscgbrwhq0m6kzm9kq043qzh";
        };
      };
    };
    "opis/closure" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "opis-closure-943b5d70cc5ae7483f6aff6ff43d7e34592ca0f5";
+        name = "opis-closure-06e2ebd25f2869e54a306dda991f7db58066f7f6";
        src = fetchurl {
-          url = https://api.github.com/repos/opis/closure/zipball/943b5d70cc5ae7483f6aff6ff43d7e34592ca0f5;
-          sha256 = "0y47ldgzzv22c5dnsdzqmbrsicq6acjyba0119d3dc6wa3n7zqi6";
+          url = https://api.github.com/repos/opis/closure/zipball/06e2ebd25f2869e54a306dda991f7db58066f7f6;
+          sha256 = "0fpa1w0rmwywj67jgaldmw563p7gycahs8gpkpjvrra9zhhj4yyc";
        };
      };
    };
@ -405,20 +415,20 @@ let
    "predis/predis" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "predis-predis-9930e933c67446962997b05201c69c2319bf26de";
+        name = "predis-predis-b240daa106d4e02f0c5b7079b41e31ddf66fddf8";
        src = fetchurl {
-          url = https://api.github.com/repos/predis/predis/zipball/9930e933c67446962997b05201c69c2319bf26de;
-          sha256 = "0qnpiyv96gs8yzy3b1ba918yw1pv8bgzw7skcf3k40ffpxsmkxv6";
+          url = https://api.github.com/repos/predis/predis/zipball/b240daa106d4e02f0c5b7079b41e31ddf66fddf8;
+          sha256 = "0wbsmq5c449vwfvsriyjwqaq5sjf9kw2chr4f2xlh3vqc4kw720j";
        };
      };
    };
    "psr/container" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "psr-container-b7ce3b176482dbbc1245ebf52b181af44c2cf55f";
+        name = "psr-container-8622567409010282b7aeebe4bb841fe98b58dcaf";
        src = fetchurl {
-          url = https://api.github.com/repos/php-fig/container/zipball/b7ce3b176482dbbc1245ebf52b181af44c2cf55f;
-          sha256 = "0rkz64vgwb0gfi09klvgay4qnw993l1dc03vyip7d7m2zxi6cy4j";
+          url = https://api.github.com/repos/php-fig/container/zipball/8622567409010282b7aeebe4bb841fe98b58dcaf;
+          sha256 = "0qfvyfp3mli776kb9zda5cpc8cazj3prk0bg0gm254kwxyfkfrwn";
        };
      };
    };
@ -565,10 +575,10 @@ let
    "socialiteproviders/slack" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "socialiteproviders-slack-8efb25c71d98bedf4010a829d1e41ff9fe449bcc";
+        name = "socialiteproviders-slack-2b781c95daf06ec87a8f3deba2ab613d6bea5e8d";
        src = fetchurl {
-          url = https://api.github.com/repos/SocialiteProviders/Slack/zipball/8efb25c71d98bedf4010a829d1e41ff9fe449bcc;
-          sha256 = "0ax3n4s1djidkhgvrcgv1qipv3k0fhfd0cvs273h6wh66bjniq66";
+          url = https://api.github.com/repos/SocialiteProviders/Slack/zipball/2b781c95daf06ec87a8f3deba2ab613d6bea5e8d;
+          sha256 = "1xilg7l1wc1vgwyakhfl8dpvgkjqx90g4khvzi411j9xa2wvpprh";
        };
      };
    };
@ -595,20 +605,20 @@ let
    "swiftmailer/swiftmailer" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "swiftmailer-swiftmailer-698a6a9f54d7eb321274de3ad19863802c879fb7";
+        name = "swiftmailer-swiftmailer-15f7faf8508e04471f666633addacf54c0ab5933";
        src = fetchurl {
-          url = https://api.github.com/repos/swiftmailer/swiftmailer/zipball/698a6a9f54d7eb321274de3ad19863802c879fb7;
-          sha256 = "1zmyr6szxvbc77rs4q1cp7f3vzw1wfx9rbbj7x9s65gh37z9fd1w";
+          url = https://api.github.com/repos/swiftmailer/swiftmailer/zipball/15f7faf8508e04471f666633addacf54c0ab5933;
+          sha256 = "1xiisdaxlmkzi16szh7lm3ay9vr9pdz0q2ah7vqaqrm2b4mwd90g";
        };
      };
    };
    "symfony/console" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "symfony-console-24026c44fc37099fa145707fecd43672831b837a";
+        name = "symfony-console-1ba4560dbbb9fcf5ae28b61f71f49c678086cf23";
        src = fetchurl {
-          url = https://api.github.com/repos/symfony/console/zipball/24026c44fc37099fa145707fecd43672831b837a;
-          sha256 = "19c5yczwxk0965pdg7ka8sa8wsr569r6l725rj4y9sabfd6mg6jf";
+          url = https://api.github.com/repos/symfony/console/zipball/1ba4560dbbb9fcf5ae28b61f71f49c678086cf23;
+          sha256 = "1zsmv0p0xxdp44301yd3n1w9j79g631bvvfp04zniqk4h5q6kvg9";
        };
      };
    };
@ -625,30 +635,30 @@ let
    "symfony/debug" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "symfony-debug-af4987aa4a5630e9615be9d9c3ed1b0f24ca449c";
+        name = "symfony-debug-157bbec4fd773bae53c5483c50951a5530a2cc16";
        src = fetchurl {
-          url = https://api.github.com/repos/symfony/debug/zipball/af4987aa4a5630e9615be9d9c3ed1b0f24ca449c;
-          sha256 = "15y1bgdrzq3859ql37ymx4fsvd28kyck69ncm6zyg84q3fhd8i19";
+          url = https://api.github.com/repos/symfony/debug/zipball/157bbec4fd773bae53c5483c50951a5530a2cc16;
+          sha256 = "0v7l7081fw2wr96xv472nhi1d0xzw6lnl8hnjgi9g3gnksfagwq8";
        };
      };
    };
    "symfony/deprecation-contracts" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "symfony-deprecation-contracts-5fa56b4074d1ae755beb55617ddafe6f5d78f665";
+        name = "symfony-deprecation-contracts-5f38c8804a9e97d23e0c8d63341088cd8a22d627";
        src = fetchurl {
-          url = https://api.github.com/repos/symfony/deprecation-contracts/zipball/5fa56b4074d1ae755beb55617ddafe6f5d78f665;
-          sha256 = "0ny59x0aaipqaj956wx7ak5f6d5rn90766swp5m18019v9cppg10";
+          url = https://api.github.com/repos/symfony/deprecation-contracts/zipball/5f38c8804a9e97d23e0c8d63341088cd8a22d627;
+          sha256 = "11k6a8v9b6p0j788fgykq6s55baba29lg37fwvmn4igxxkfwmbp3";
        };
      };
    };
    "symfony/error-handler" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "symfony-error-handler-d603654eaeb713503bba3e308b9e748e5a6d3f2e";
+        name = "symfony-error-handler-48e81a375525872e788c2418430f54150d935810";
        src = fetchurl {
-          url = https://api.github.com/repos/symfony/error-handler/zipball/d603654eaeb713503bba3e308b9e748e5a6d3f2e;
-          sha256 = "15xdk9bbyfdm8yf19jfb3zr1yaj0lprf9pmxgj630vbpbqkgsd8f";
+          url = https://api.github.com/repos/symfony/error-handler/zipball/48e81a375525872e788c2418430f54150d935810;
+          sha256 = "17hpwx8arv3h4cw4fwzkm7a39lsa92vwxsinyqmx723v1nr5z1d2";
        };
      };
    };
@ -675,50 +685,50 @@ let
    "symfony/finder" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "symfony-finder-25d79cfccfc12e84e7a63a248c3f0720fdd92db6";
+        name = "symfony-finder-2543795ab1570df588b9bbd31e1a2bd7037b94f6";
        src = fetchurl {
-          url = https://api.github.com/repos/symfony/finder/zipball/25d79cfccfc12e84e7a63a248c3f0720fdd92db6;
-          sha256 = "04fwddn12sj6vzr5xr4xd25m86cn4l15079490h3q3igprzvrqk8";
+          url = https://api.github.com/repos/symfony/finder/zipball/2543795ab1570df588b9bbd31e1a2bd7037b94f6;
+          sha256 = "0scclnfc9aphjsric1xaj51vbqqz56kiz6l8l6ldqv6cvyg8zlyi";
        };
      };
    };
    "symfony/http-client-contracts" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "symfony-http-client-contracts-41db680a15018f9c1d4b23516059633ce280ca33";
+        name = "symfony-http-client-contracts-7e82f6084d7cae521a75ef2cb5c9457bbda785f4";
        src = fetchurl {
-          url = https://api.github.com/repos/symfony/http-client-contracts/zipball/41db680a15018f9c1d4b23516059633ce280ca33;
-          sha256 = "1iia9rpbri1whp2dw4qfhh90gmkdvxhgjwxi54q7wlnlhijgga81";
+          url = https://api.github.com/repos/symfony/http-client-contracts/zipball/7e82f6084d7cae521a75ef2cb5c9457bbda785f4;
+          sha256 = "04mszmb94y0xjs0cwqxzhpf65kfqhhqznldifbxvrrlxb9nn23qc";
        };
      };
    };
    "symfony/http-foundation" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "symfony-http-foundation-8888741b633f6c3d1e572b7735ad2cae3e03f9c5";
+        name = "symfony-http-foundation-02d968647fe61b2f419a8dc70c468a9d30a48d3a";
        src = fetchurl {
-          url = https://api.github.com/repos/symfony/http-foundation/zipball/8888741b633f6c3d1e572b7735ad2cae3e03f9c5;
-          sha256 = "0qs389nxxqc6nwx5x6b9kz8ykdlhdx7k8k6nd2apppxpqalvk6sw";
+          url = https://api.github.com/repos/symfony/http-foundation/zipball/02d968647fe61b2f419a8dc70c468a9d30a48d3a;
+          sha256 = "1bq4why2v8p7wy8801bdml43xh7kb5fli16cv74bvqpwlp4cdv9f";
        };
      };
    };
    "symfony/http-kernel" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "symfony-http-kernel-07ea794a327d7c8c5d76e3058fde9fec6a711cb4";
+        name = "symfony-http-kernel-0248214120d00c5f44f1cd5d9ad65f0b38459333";
        src = fetchurl {
-          url = https://api.github.com/repos/symfony/http-kernel/zipball/07ea794a327d7c8c5d76e3058fde9fec6a711cb4;
-          sha256 = "0mnay6nn299ljjgaqqbk8kcl431wrzvzsqybvl648pf513mp9vy9";
+          url = https://api.github.com/repos/symfony/http-kernel/zipball/0248214120d00c5f44f1cd5d9ad65f0b38459333;
+          sha256 = "032ljl732x0bs3my26wjfmxrxplz8vlxs0xzlqsxrh18lnyv6z3h";
        };
      };
    };
    "symfony/mime" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "symfony-mime-7dee6a43493f39b51ff6c5bb2bd576fe40a76c86";
+        name = "symfony-mime-1b2092244374cbe48ae733673f2ca0818b37197b";
        src = fetchurl {
-          url = https://api.github.com/repos/symfony/mime/zipball/7dee6a43493f39b51ff6c5bb2bd576fe40a76c86;
-          sha256 = "0931zsmnpx75b9b34a03l0sfp22mailaa2y5az3cgx9v0bkc0vka";
+          url = https://api.github.com/repos/symfony/mime/zipball/1b2092244374cbe48ae733673f2ca0818b37197b;
+          sha256 = "0d2vhmd25d7yvh9xzl2vazx2bfsb8qyvd2kgvl9cry1va4vrpkj3";
        };
      };
    };
@ -815,50 +825,50 @@ let
    "symfony/routing" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "symfony-routing-87529f6e305c7acb162840d1ea57922038072425";
+        name = "symfony-routing-69919991c845b34626664ddc9b3aef9d09d2a5df";
        src = fetchurl {
-          url = https://api.github.com/repos/symfony/routing/zipball/87529f6e305c7acb162840d1ea57922038072425;
-          sha256 = "0qrgacividsp7c61y03qh8lb4vj30g0mvljnm5k60h4zzdmivlgc";
+          url = https://api.github.com/repos/symfony/routing/zipball/69919991c845b34626664ddc9b3aef9d09d2a5df;
+          sha256 = "0ghynrw6d9dpskhgyf3ljlz4pfmi68r3bzhr45lygadx21yacddw";
        };
      };
    };
    "symfony/service-contracts" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "symfony-service-contracts-d15da7ba4957ffb8f1747218be9e1a121fd298a1";
+        name = "symfony-service-contracts-f040a30e04b57fbcc9c6cbcf4dbaa96bd318b9bb";
        src = fetchurl {
-          url = https://api.github.com/repos/symfony/service-contracts/zipball/d15da7ba4957ffb8f1747218be9e1a121fd298a1;
-          sha256 = "168iq1lp2r5qb5h8j0s17da09iaj2h5hrrdc9rw2p73hq8rvm1w2";
+          url = https://api.github.com/repos/symfony/service-contracts/zipball/f040a30e04b57fbcc9c6cbcf4dbaa96bd318b9bb;
+          sha256 = "1i573rmajc33a9nrgwgc4k3svg29yp9xv17gp133rd1i705hwv1y";
        };
      };
    };
    "symfony/translation" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "symfony-translation-e1d0c67167a553556d9f974b5fa79c2448df317a";
+        name = "symfony-translation-eb8f5428cc3b40d6dffe303b195b084f1c5fbd14";
        src = fetchurl {
-          url = https://api.github.com/repos/symfony/translation/zipball/e1d0c67167a553556d9f974b5fa79c2448df317a;
-          sha256 = "1b6fj278i1wdf4l7py9n86lmhrqmzvjy7kapjpfkz03adn2ps127";
+          url = https://api.github.com/repos/symfony/translation/zipball/eb8f5428cc3b40d6dffe303b195b084f1c5fbd14;
+          sha256 = "0x80ijdhpfv9is847pp09jlr0g0hwg9sil95jknil7dgx5pjsa5z";
        };
      };
    };
    "symfony/translation-contracts" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "symfony-translation-contracts-e2eaa60b558f26a4b0354e1bbb25636efaaad105";
+        name = "symfony-translation-contracts-95c812666f3e91db75385749fe219c5e494c7f95";
        src = fetchurl {
-          url = https://api.github.com/repos/symfony/translation-contracts/zipball/e2eaa60b558f26a4b0354e1bbb25636efaaad105;
-          sha256 = "1k26yvgk84rz6ja9ml6l6iwbbi68qsqnq2cpky044g9ymvlg8d5g";
+          url = https://api.github.com/repos/symfony/translation-contracts/zipball/95c812666f3e91db75385749fe219c5e494c7f95;
+          sha256 = "073l1pbmwbkaviwwjq9ypb1w7dk366nn2vn1vancbal0zqk0zx7b";
        };
      };
    };
    "symfony/var-dumper" = {
      targetDir = "";
      src = composerEnv.buildZipPackage {
-        name = "symfony-var-dumper-a1eab2f69906dc83c5ddba4632180260d0ab4f7f";
+        name = "symfony-var-dumper-0da0e174f728996f5d5072d6a9f0a42259dbc806";
        src = fetchurl {
-          url = https://api.github.com/repos/symfony/var-dumper/zipball/a1eab2f69906dc83c5ddba4632180260d0ab4f7f;
-          sha256 = "1yw12jbx6gf5mvg7jrr1v57ah3b2s4hflz2p1m98nayi4qhdp20m";
+          url = https://api.github.com/repos/symfony/var-dumper/zipball/0da0e174f728996f5d5072d6a9f0a42259dbc806;
+          sha256 = "1qmv99bvq10siy8bbszqmn488cjcm70vip4xs8vxwm6x6x5cw1ia";
        };
      };
    };
--- a/third_party/nixpkgs/pkgs/servers/web-apps/hedgedoc/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/hedgedoc/default.nix
@ -3,13 +3,13 @@

 mkYarnPackage rec {
  name = "hedgedoc";
-  version = "1.7.2";
+  version = "1.8.0";

  src = fetchFromGitHub {
    owner  = "hedgedoc";
    repo   = "hedgedoc";
    rev    = version;
-    sha256 = "1w3si1k27c8d9yka2v91883dlz57n0wasan4agi6gw17h9dzb1l6";
+    sha256 = "1xi4gi1yjwggdsnz5hljx9xl4qhnm9r3c24q7i6d5y8yv6lh6lsr";
  };

  nativeBuildInputs = [ which makeWrapper ];
@ -37,6 +37,8 @@ mkYarnPackage rec {

    npm run build

+    patchShebangs bin/*
+
    runHook postBuild
  '';

--- a/third_party/nixpkgs/pkgs/servers/web-apps/hedgedoc/package.json
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/hedgedoc/package.json
@ -1,6 +1,6 @@
 {
  "name": "HedgeDoc",
-  "version": "1.7.2",
+  "version": "1.8.0",
  "description": "The best platform to write and share markdown.",
  "main": "app.js",
  "license": "AGPL-3.0",
@ -11,17 +11,17 @@
    "markdownlint": "remark .",
    "mocha-suite": "NODE_ENV=test CMD_DB_URL=\"sqlite::memory:\" mocha --exit",
    "standard": "echo 'standard is no longer being used, use `npm run eslint` instead!' && exit 1",
-    "dev": "webpack --config webpack.dev.js --progress --colors --watch",
+    "dev": "webpack --config webpack.dev.js --progress --watch",
    "heroku-prebuild": "bin/heroku",
-    "build": "webpack --config webpack.prod.js --progress --colors --bail",
-    "start": "sequelize db:migrate && node app.js"
+    "build": "webpack --config webpack.prod.js --progress",
+    "start": "node app.js"
  },
  "dependencies": {
    "@passport-next/passport-openid": "^1.0.0",
    "Idle.Js": "git+https://github.com/shawnmclean/Idle.js",
    "archiver": "^5.0.2",
-    "async": "^2.1.4",
-    "aws-sdk": "^2.521.0",
+    "async": "^3.0.0",
+    "aws-sdk": "^2.888.0",
    "azure-storage": "^2.7.0",
    "base64url": "^3.0.0",
    "body-parser": "^1.15.2",
@ -32,17 +32,17 @@
    "codemirror": "git+https://github.com/hedgedoc/CodeMirror.git",
    "compression": "^1.6.2",
    "connect-flash": "^0.1.1",
-    "connect-session-sequelize": "^6.0.0",
+    "connect-session-sequelize": "^7.0.0",
    "cookie": "^0.4.0",
    "cookie-parser": "^1.4.3",
    "deep-freeze": "^0.0.1",
    "diff-match-patch": "git+https://github.com/hackmdio/diff-match-patch.git",
-    "ejs": "^2.5.5",
+    "ejs": "^3.0.0",
    "emojify.js": "^1.1.0",
    "escape-html": "^1.0.3",
    "express": ">=4.14",
    "express-session": "^1.14.2",
-    "file-saver": "^1.3.3",
+    "file-saver": "^2.0.0",
    "file-type": "^16.1.0",
    "flowchart.js": "^1.6.4",
    "fork-awesome": "^1.1.3",
@ -50,11 +50,11 @@
    "gist-embed": "^2.6.0",
    "graceful-fs": "^4.1.11",
    "handlebars": "^4.5.2",
-    "helmet": "^3.21.1",
-    "highlight.js": "^9.12.0",
+    "helmet": "^4.5.0",
+    "highlight.js": "^10.0.0",
    "i18n": "^0.13.0",
-    "imgur": "git+https://github.com/hackmdio/node-imgur.git",
    "ionicons": "^2.0.1",
+    "is-svg": "^4.3.1",
    "jquery": "^3.5.1",
    "jquery-mousewheel": "^3.1.13",
    "jquery-ui": "^1.12.1",
@ -63,20 +63,20 @@
    "js-yaml": "^3.13.1",
    "jsdom-nogyp": "^0.8.3",
    "keymaster": "^1.6.2",
-    "list.js": "^1.5.0",
+    "list.js": "^2.0.0",
    "lodash": "^4.17.20",
    "lutim": "^1.0.2",
    "lz-string": "git+https://github.com/hackmdio/lz-string.git",
    "mariadb": "^2.1.2",
-    "markdown-it": "^10.0.0",
+    "markdown-it": "^12.0.0",
    "markdown-it-abbr": "^1.0.4",
-    "markdown-it-container": "^2.0.0",
+    "markdown-it-container": "^3.0.0",
    "markdown-it-deflist": "^2.0.1",
-    "markdown-it-emoji": "^1.3.0",
+    "markdown-it-emoji": "^2.0.0",
    "markdown-it-footnote": "^3.0.1",
    "markdown-it-imsize": "^2.0.1",
-    "markdown-it-ins": "^2.0.0",
-    "markdown-it-mark": "^2.0.0",
+    "markdown-it-ins": "^3.0.0",
+    "markdown-it-mark": "^3.0.0",
    "markdown-it-mathjax": "^2.0.0",
    "markdown-it-regexp": "^0.4.0",
    "markdown-it-sub": "^1.0.0",
@ -85,56 +85,57 @@
    "mattermost": "^3.4.0",
    "mermaid": "^8.5.1",
    "meta-marked": "git+https://github.com/hedgedoc/meta-marked",
-    "method-override": "^2.3.7",
+    "method-override": "^3.0.0",
    "minimist": "^1.2.0",
-    "minio": "^6.0.0",
+    "minio": "^7.0.0",
    "moment": "^2.17.1",
    "morgan": "^1.7.0",
    "mysql2": "^2.0.0",
+    "node-fetch": "^2.6.1",
    "passport": "^0.4.0",
    "passport-dropbox-oauth2": "^1.1.0",
-    "passport-facebook": "^2.1.1",
+    "passport-facebook": "^3.0.0",
    "passport-github": "^1.1.0",
-    "passport-gitlab2": "^4.0.0",
-    "passport-google-oauth20": "^1.0.0",
-    "passport-ldapauth": "^2.0.0",
+    "passport-gitlab2": "^5.0.0",
+    "passport-google-oauth20": "^2.0.0",
+    "passport-ldapauth": "^3.0.0",
    "passport-local": "^1.0.0",
    "passport-oauth2": "^1.4.0",
-    "passport-saml": "^1.0.0",
+    "passport-saml": "^2.0.0",
    "passport-twitter": "^1.0.4",
    "passport.socketio": "^3.7.0",
    "pdfobject": "^2.0.201604172",
    "pg": "^8.2.1",
    "pg-hstore": "^2.3.3",
    "prismjs": "^1.21.0",
+    "prom-client": "^13.1.0",
+    "prometheus-api-metrics": "^3.2.0",
    "randomcolor": "^0.6.0",
    "raphael": "^2.3.0",
    "readline-sync": "^1.4.7",
-    "request": "^2.88.0",
    "reveal.js": "^3.9.2",
    "rimraf": "^3.0.2",
-    "scrypt-async": "^2.0.1",
    "scrypt-kdf": "^2.0.1",
    "select2": "^3.5.2-browserify",
    "sequelize": "^5.21.1",
-    "sequelize-cli": "^5.5.1",
    "shortid": "2.2.16",
    "socket.io": "^2.1.1",
    "socket.io-client": "^2.1.1",
-    "spin.js": "^2.3.2",
-    "sqlite3": "^4.1.0",
+    "spin.js": "^4.0.0",
+    "sqlite3": "^5.0.0",
    "store": "^2.0.12",
    "string": "^3.3.3",
    "tedious": "^6.6.0",
    "toobusy-js": "^0.5.1",
-    "turndown": "^5.0.1",
-    "uuid": "^3.1.0",
-    "validator": "^10.4.0",
+    "turndown": "^7.0.0",
+    "umzug": "^2.3.0",
+    "uuid": "^8.0.0",
+    "validator": "^13.0.0",
    "velocity-animate": "^1.4.0",
-    "visibilityjs": "^1.2.4",
+    "visibilityjs": "^2.0.0",
    "viz.js": "^1.7.0",
    "winston": "^3.1.0",
-    "ws": "^6.0.0",
+    "ws": "^7.4.4",
    "wurl": "^2.5.3",
    "xss": "^1.0.3"
  },
@ -144,7 +145,7 @@
    "**/request": "^2.88.0"
  },
  "engines": {
-    "node": ">=10.13"
+    "node": ">=12"
  },
  "bugs": "https://github.com/hedgedoc/hedgedoc/issues",
  "keywords": [
@ -177,32 +178,32 @@
    "babel-preset-env": "1.7.0",
    "babel-runtime": "6.26.0",
    "copy-webpack-plugin": "6.4.1",
-    "css-loader": "3.6.0",
-    "eslint": "5.16.0",
-    "eslint-config-standard": "12.0.0",
+    "css-loader": "5.2.4",
+    "eslint": "7.25.0",
+    "eslint-config-standard": "16.0.2",
    "eslint-plugin-import": "2.22.1",
-    "eslint-plugin-node": "8.0.1",
-    "eslint-plugin-promise": "4.2.1",
+    "eslint-plugin-node": "11.1.0",
+    "eslint-plugin-promise": "5.1.0",
    "eslint-plugin-standard": "4.1.0",
-    "expose-loader": "0.7.5",
-    "file-loader": "4.3.0",
-    "html-webpack-plugin": "4.5.0",
-    "imports-loader": "0.8.0",
+    "expose-loader": "1.0.3",
+    "file-loader": "6.2.0",
+    "html-webpack-plugin": "4.5.2",
+    "imports-loader": "1.2.0",
    "jsonlint": "1.6.3",
-    "less": "3.13.1",
-    "less-loader": "5.0.0",
-    "mini-css-extract-plugin": "0.12.0",
-    "mocha": "5.2.0",
+    "less": "4.1.1",
+    "less-loader": "7.3.0",
+    "mini-css-extract-plugin": "1.6.0",
+    "mocha": "8.3.2",
    "mock-require": "3.0.3",
    "optimize-css-assets-webpack-plugin": "5.0.4",
-    "remark-cli": "8.0.1",
-    "remark-preset-lint-markdown-style-guide": "3.0.1",
+    "remark-cli": "9.0.0",
+    "remark-preset-lint-markdown-style-guide": "4.0.0",
    "script-loader": "0.7.2",
    "string-loader": "0.0.1",
-    "url-loader": "2.3.0",
-    "webpack": "4.44.2",
-    "webpack-cli": "3.3.12",
-    "webpack-merge": "4.2.2"
+    "url-loader": "4.1.1",
+    "webpack": "4.46.0",
+    "webpack-cli": "4.6.0",
+    "webpack-merge": "5.7.3"
  },
  "optionalDependencies": {
    "bufferutil": "^4.0.0",
--- a/third_party/nixpkgs/pkgs/servers/web-apps/hedgedoc/yarn.lock
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/hedgedoc/yarn.lock
--- a/third_party/nixpkgs/pkgs/servers/web-apps/hedgedoc/yarn.nix
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/hedgedoc/yarn.nix
--- a/third_party/nixpkgs/pkgs/test/texlive/default.nix
+++ b/third_party/nixpkgs/pkgs/test/texlive/default.nix
@ -1,4 +1,4 @@
-{ runCommandNoCC, fetchurl, file, texlive, writeShellScript }:
+{ lib, runCommandNoCC, fetchurl, file, texlive, writeShellScript }:

 {
  chktex = runCommandNoCC "texlive-test-chktex" {
@ -16,8 +16,9 @@
    grep "One warning printed" "$out"
  '';

+  dvipng = lib.recurseIntoAttrs {
    # https://github.com/NixOS/nixpkgs/issues/75605
-  dvipng.basic = runCommandNoCC "texlive-test-dvipng-basic" {
+    basic = runCommandNoCC "texlive-test-dvipng-basic" {
      nativeBuildInputs = [ file texlive.combined.scheme-medium ];
      input = fetchurl {
        name = "test_dvipng.tex";
@ -39,7 +40,7 @@
    '';

    # test dvipng's limited capability to render postscript specials via GS
-  dvipng.ghostscript = runCommandNoCC "texlive-test-ghostscript" {
+    ghostscript = runCommandNoCC "texlive-test-ghostscript" {
      nativeBuildInputs = [ file (with texlive; combine { inherit scheme-small dvipng; }) ];
      input = builtins.toFile "postscript-sample.tex" ''
        \documentclass{minimal}
@ -77,7 +78,7 @@
      mkdir "$out"
      mv document*.png "$out"/
    '';
-
+  };

  # https://github.com/NixOS/nixpkgs/issues/75070
  dvisvgm = runCommandNoCC "texlive-test-dvisvgm" {
--- a/third_party/nixpkgs/pkgs/tools/misc/entr/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/entr/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "entr";
-  version = "4.8";
+  version = "4.9";

  src = fetchurl {
    url = "https://eradman.com/entrproject/code/${pname}-${version}.tar.gz";
-    sha256 = "1bi5fhr93n72pkap4mqsjd1pwnqjf6czg359c5xwczavfk6mamgh";
+    sha256 = "sha256-4lak0vvkb2EyRggzukR+ZdfzW6nQsmXnxBUDl8xEBaI=";
  };

  postPatch = ''
--- a/third_party/nixpkgs/pkgs/tools/misc/esphome/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/esphome/default.nix
@ -49,6 +49,6 @@ in python.pkgs.buildPythonApplication rec {
    description = "Make creating custom firmwares for ESP32/ESP8266 super easy";
    homepage = "https://esphome.io/";
    license = licenses.mit;
-    maintainers = with maintainers; [ dotlambda globin elseym ];
+    maintainers = with maintainers; [ globin elseym hexa ];
  };
 }
--- a/third_party/nixpkgs/pkgs/tools/system/bpytop/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/system/bpytop/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "bpytop";
-  version = "1.0.64";
+  version = "1.0.65";

  src = fetchFromGitHub {
    owner = "aristocratos";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-BwpMBPTWSrfmz7SHYa1+SZ79V2YZdIkZcOTLtlVlgr8=";
+    sha256 = "sha256-sWANeoUbvnrTksqfeIRU4a5XeX7QVzT9+ZT3R5Utp+4=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/third_party/nixpkgs/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/third_party/nixpkgs/pkgs/tools/typesetting/tex/texlive/bin.nix
@ -3,7 +3,7 @@
 , zlib, libiconv, libpng, libX11
 , freetype, gd, libXaw, icu, ghostscript, libXpm, libXmu, libXext
 , perl, perlPackages, python3Packages, pkg-config
-, poppler, libpaper, graphite2, zziplib, harfbuzz, potrace, gmp, mpfr
+, libpaper, graphite2, zziplib, harfbuzz, potrace, gmp, mpfr
 , brotli, cairo, pixman, xorg, clisp, biber, woff2, xxHash
 , makeWrapper, shortenPerlShebang
 }:
@ -14,24 +14,22 @@
 let
  withSystemLibs = map (libname: "--with-system-${libname}");

-  year = "2020";
+  year = "2021";
  version = year; # keep names simple for now

  common = {
    src = fetchurl {
      urls = [
-        "http://ftp.math.utah.edu/pub/tex/historic/systems/texlive/${year}/texlive-${year}0406-source.tar.xz"
-              "ftp://tug.ctan.org/pub/tex/historic/systems/texlive/${year}/texlive-${year}0406-source.tar.xz"
+        "http://ftp.math.utah.edu/pub/tex/historic/systems/texlive/${year}/texlive-${year}0325-source.tar.xz"
+              "ftp://tug.ctan.org/pub/tex/historic/systems/texlive/${year}/texlive-${year}0325-source.tar.xz"
      ];
-      sha256 = "0y4h4j2qg714srhvf1hvn165w7sanr1j2vzrsgc23kxvrc43sbz3";
+      sha256 = "0jsq1p66l46k2qq0gbqmx25flj2nprsz4wrd1ybn286p11kdkvvs";
    };

    prePatch = ''
      for i in texk/kpathsea/mktex*; do
        sed -i '/^mydir=/d' "$i"
      done
-      cp -pv texk/web2c/pdftexdir/pdftoepdf{-poppler0.86.0,}.cc
-      cp -pv texk/web2c/pdftexdir/pdftosrc{-poppler0.83.0,}.cc
    '';

    configureFlags = [
@ -43,9 +41,8 @@ let
    ]
      ++ withSystemLibs [
      # see "from TL tree" vs. "Using installed"  in configure output
-      "zziplib" "xpdf" "poppler" "mpfr" "gmp"
+      "zziplib" "mpfr" "gmp"
      "pixman" "potrace" "gd" "freetype2" "libpng" "libpaper" "zlib"
-        # beware: xpdf means to use stuff from poppler :-/
    ];

    # clean broken links to stuff not built
@ -73,7 +70,7 @@ core = stdenv.mkDerivation rec {

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [
-    /*teckit*/ zziplib poppler mpfr gmp
+    /*teckit*/ zziplib mpfr gmp
    pixman gd freetype libpng libpaper zlib
    perl
  ];
@ -82,7 +79,7 @@ core = stdenv.mkDerivation rec {

  preConfigure = ''
    rm -r libs/{cairo,freetype2,gd,gmp,graphite2,harfbuzz,icu,libpaper,libpng} \
-      libs/{lua53,luajit,mpfr,pixman,poppler,xpdf,zlib,zziplib}
+      libs/{lua53,luajit,mpfr,pixman,zlib,zziplib}
    mkdir WorkDir
    cd WorkDir
  '';
@ -178,7 +175,7 @@ core-big = stdenv.mkDerivation { #TODO: upmendex
    luajit = lib.optionalString withLuaJIT ",luajit";
  in ''
    mkdir ./WorkDir && cd ./WorkDir
-    for path in libs/{teckit,lua53${luajit}} texk/web2c; do
+    for path in libs/{pplib,teckit,lua53${luajit}} texk/web2c; do
      (
        if [[ "$path" =~ "libs/lua" ]]; then
          extraConfig="--enable-static --disable-shared"
@ -247,18 +244,17 @@ chktex = stdenv.mkDerivation {

 dvisvgm = stdenv.mkDerivation rec {
  pname = "texlive-dvisvgm.bin";
-  version = "2.11";
-  # TODO: dvisvgm was switched to build from upstream sources
-  # to address https://github.com/NixOS/nixpkgs/issues/104847
-  # We might want to consider reverting that change in the future.
+  inherit version;

-  src = fetchurl {
-    url = "https://github.com/mgieseki/dvisvgm/releases/download/${version}/dvisvgm-${version}.tar.gz";
-    sha256 = "12b6h0h8rc487yjh3sq9zsdabm9cs2vqcrb0znnfi8277f87zf3j";
-  };
+  inherit (common) src;
+
+  preConfigure = "cd texk/dvisvgm";
+
+  configureFlags = common.configureFlags
+    ++ [ "--with-system-kpathsea" ];

  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ core/*kpathsea*/ brotli ghostscript zlib freetype woff2 potrace xxHash ];
+  buildInputs = [ core brotli ghostscript zlib freetype woff2 potrace xxHash ];

  enableParallelBuilding = true;
 };
--- a/third_party/nixpkgs/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/typesetting/tex/texlive/default.nix
@ -3,7 +3,7 @@
  - current html: https://nixos.org/nixpkgs/manual/#sec-language-texlive
 */
 { stdenv, lib, fetchurl, runCommand, writeText, buildEnv
-, callPackage, ghostscriptX, harfbuzz, poppler_min
+, callPackage, ghostscriptX, harfbuzz
 , makeWrapper, python3, ruby, perl
 , useFixedHashes ? true
 , recurseIntoAttrs
@ -11,7 +11,6 @@
 let
  # various binaries (compiled)
  bin = callPackage ./bin.nix {
-    poppler = poppler_min; # otherwise depend on various X stuff
    ghostscript = ghostscriptX;
    harfbuzz = harfbuzz.override {
      withIcu = true; withGraphite2 = true;
--- a/third_party/nixpkgs/pkgs/top-level/aliases.nix
+++ b/third_party/nixpkgs/pkgs/top-level/aliases.nix
@ -796,7 +796,6 @@ mapAliases ({
  torch-repl = throw "torch-repl has been removed, as the upstream project has been abandoned"; # added 2020-03-28
  torchPackages = throw "torchPackages has been removed, as the upstream project has been abandoned"; # added 2020-03-28
  trang = jing-trang; # added 2018-04-25
-  transcribe = throw "transcribe has been removed after being marked a broken for over a year"; # added 2020-09-16
  transmission_gtk = transmission-gtk; # added 2018-01-06
  transmission_remote_gtk = transmission-remote-gtk; # added 2018-01-06
  transmission-remote-cli = "transmission-remote-cli has been removed, as the upstream project has been abandoned. Please use tremc instead"; # added 2020-10-14
--- a/third_party/nixpkgs/pkgs/top-level/all-packages.nix
+++ b/third_party/nixpkgs/pkgs/top-level/all-packages.nix
@ -3003,6 +3003,8 @@ in

  remarkable-mouse = python3Packages.callPackage ../applications/misc/remarkable/remarkable-mouse { };

+  restream = callPackage ../applications/misc/remarkable/restream { };
+
  ryujinx = callPackage ../misc/emulators/ryujinx { };

  scour = with python3Packages; toPythonApplication scour;
@ -13486,7 +13488,9 @@ in
  sconsPackages = dontRecurseIntoAttrs (callPackage ../development/tools/build-managers/scons { });
  scons = sconsPackages.scons_latest;

-  mill = callPackage ../development/tools/build-managers/mill { };
+  mill = callPackage ../development/tools/build-managers/mill {
+    jre = jre8;
+  };

  sbt = callPackage ../development/tools/build-managers/sbt { };
  sbt-with-scala-native = callPackage ../development/tools/build-managers/sbt/scala-native.nix { };
@ -22156,9 +22160,7 @@ in
  audacious = libsForQt5.callPackage ../applications/audio/audacious { };
  audaciousQt5 = audacious;

-  audacity-gtk2 = callPackage ../applications/audio/audacity { wxGTK = wxGTK31-gtk2; };
-  audacity-gtk3 = callPackage ../applications/audio/audacity { wxGTK = wxGTK31-gtk3; };
-  audacity = audacity-gtk2;
+  audacity = callPackage ../applications/audio/audacity { wxGTK = wxGTK31-gtk2; };

  audio-recorder = callPackage ../applications/audio/audio-recorder { };

@ -26456,6 +26458,8 @@ in

  transcode = callPackage ../applications/audio/transcode { };

+  transcribe = callPackage ../applications/audio/transcribe { };
+
  transmission = callPackage ../applications/networking/p2p/transmission { };
  libtransmission = transmission.override {
    installLib = true;
@ -31275,9 +31279,7 @@ in

  bottom = callPackage ../tools/system/bottom {};

-  cagebreak = callPackage ../applications/window-managers/cagebreak/default.nix {
-    wlroots = wlroots_0_12;
-  };
+  cagebreak = callPackage ../applications/window-managers/cagebreak/default.nix { };

  psftools = callPackage ../os-specific/linux/psftools {};

--- a/third_party/nixpkgs/pkgs/top-level/perl-packages.nix
+++ b/third_party/nixpkgs/pkgs/top-level/perl-packages.nix
@ -3907,6 +3907,20 @@ let
    };
  };

+  CryptArgon2 = perlPackages.buildPerlModule {
+    pname = "Crypt-Argon2";
+    version = "0.010";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/L/LE/LEONT/Crypt-Argon2-0.010.tar.gz";
+      sha256 = "3ea1c006f10ef66fd417e502a569df15c4cc1c776b084e35639751c41ce6671a";
+    };
+    nativeBuildInputs = [ pkgs.ld-is-cc-hook ];
+    meta = {
+      description = "Perl interface to the Argon2 key derivation functions";
+      license = lib.licenses.cc0;
+    };
+  };
+
  CryptBlowfish = buildPerlPackage {
    pname = "Crypt-Blowfish";
    version = "2.14";
@ -4081,6 +4095,33 @@ let
    };
  };

+  CryptPassphrase = buildPerlPackage {
+    pname = "Crypt-Passphrase";
+    version = "0.003";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/L/LE/LEONT/Crypt-Passphrase-0.003.tar.gz";
+      sha256 = "685aa090f8179a86d6896212ccf8ccfde7a79cce857199bb14e2277a10d240ad";
+    };
+    meta = {
+      description = "A module for managing passwords in a cryptographically agile manner";
+      license = with lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
+  CryptPassphraseArgon2 = buildPerlPackage {
+    pname = "Crypt-Passphrase-Argon2";
+    version = "0.002";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/L/LE/LEONT/Crypt-Passphrase-Argon2-0.002.tar.gz";
+      sha256 = "3906ff81697d13804ee21bd5ab78ffb1c4408b4822ce020e92ecf4737ba1f3a8";
+    };
+    propagatedBuildInputs = with perlPackages; [ CryptArgon2 CryptPassphrase ];
+    meta = {
+      description = "An Argon2 encoder for Crypt::Passphrase";
+      license = with lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
  CryptPasswdMD5 = buildPerlModule {
    pname = "Crypt-PasswdMD5";
    version = "1.40";
@ -18819,6 +18860,19 @@ let
    };
  };

+  StringCompareConstantTime = buildPerlPackage {
+    pname = "String-Compare-ConstantTime";
+    version = "0.321";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/F/FR/FRACTAL/String-Compare-ConstantTime-0.321.tar.gz";
+      sha256 = "0b26ba2b121d8004425d4485d1d46f59001c83763aa26624dff6220d7735d7f7";
+    };
+    meta = {
+      description = "Timing side-channel protected string compare";
+      license = with lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
  StringCRC32 = buildPerlPackage {
    pname = "String-CRC32";
    version = "2";
--- a/third_party/nixpkgs/pkgs/top-level/python-packages.nix
+++ b/third_party/nixpkgs/pkgs/top-level/python-packages.nix
@ -605,6 +605,8 @@ in {

  auth0-python = callPackage ../development/python-modules/auth0-python { };

+  authcaptureproxy = callPackage ../development/python-modules/authcaptureproxy { };
+
  authheaders = callPackage ../development/python-modules/authheaders { };

  authlib = callPackage ../development/python-modules/authlib { };