Merge remote-tracking branch 'nixpkgs/master' into staging-next

Conflicts:
	pkgs/development/libraries/libunwind/default.nix

lib/default.nix

@@ -105,7 +105,7 @@ let
       makeScope makeScopeWithSplicing;
     inherit (self.meta) addMetaAttrs dontDistribute setName updateName
       appendToName mapDerivationAttrset setPrio lowPrio lowPrioSet hiPrio
-      hiPrioSet;
+      hiPrioSet getLicenseFromSpdxId;
     inherit (self.sources) pathType pathIsDirectory cleanSourceFilter
       cleanSource sourceByRegex sourceFilesBySuffices
       commitIdFromGitRepo cleanSourceWith pathHasContext

lib/meta.nix

@@ -99,4 +99,31 @@ rec {
   availableOn = platform: pkg:
     lib.any (platformMatch platform) pkg.meta.platforms &&
     lib.all (elem: !platformMatch platform elem) (pkg.meta.badPlatforms or []);
+
+  /* Get the corresponding attribute in lib.licenses
+     from the SPDX ID.
+     For SPDX IDs, see
+     https://spdx.org/licenses
+
+     Type:
+       getLicenseFromSpdxId :: str -> AttrSet
+
+     Example:
+       lib.getLicenseFromSpdxId "MIT" == lib.licenses.mit
+       => true
+       lib.getLicenseFromSpdxId "mIt" == lib.licenses.mit
+       => true
+       lib.getLicenseFromSpdxId "MY LICENSE"
+       => trace: warning: getLicenseFromSpdxId: No license matches the given SPDX ID: MY LICENSE
+       => { shortName = "MY LICENSE"; }
+  */
+  getLicenseFromSpdxId =
+    let
+      spdxLicenses = lib.mapAttrs (id: ls: assert lib.length ls == 1; builtins.head ls)
+        (lib.groupBy (l: lib.toLower l.spdxId) (lib.filter (l: l ? spdxId) (lib.attrValues lib.licenses)));
+    in licstr:
+      spdxLicenses.${ lib.toLower licstr } or (
+        lib.warn "getLicenseFromSpdxId: No license matches the given SPDX ID: ${licstr}"
+        { shortName = licstr; }
+      );
 }

lib/modules.nix

@@ -13,8 +13,6 @@ let
     elem
     filter
     findFirst
-    flip
-    foldl
     foldl'
     getAttrFromPath
     head
@@ -101,9 +99,31 @@ rec {
                   check ? true
                 }:
     let
+      withWarnings = x:
+        lib.warnIf (evalModulesArgs?args) "The args argument to evalModules is deprecated. Please set config._module.args instead."
+        lib.warnIf (evalModulesArgs?check) "The check argument to evalModules is deprecated. Please set config._module.check instead."
+        x;
+
+      legacyModules =
+        optional (evalModulesArgs?args) {
+          config = {
+            _module.args = args;
+          };
+        }
+        ++ optional (evalModulesArgs?check) {
+          config = {
+            _module.check = mkDefault check;
+          };
+        };
+      regularModules = modules ++ legacyModules;
+
       # This internal module declare internal options under the `_module'
       # attribute.  These options are fragile, as they are used by the
       # module system to change the interpretation of modules.
+      #
+      # When extended with extendModules or moduleType, a fresh instance of
+      # this module is used, to avoid conflicts and allow chaining of
+      # extendModules.
       internalModule = rec {
         _file = ./modules.nix;
 
@@ -125,7 +145,7 @@ rec {
           _module.check = mkOption {
             type = types.bool;
             internal = true;
-            default = check;
+            default = true;
             description = "Whether to check whether all option definitions have matching declarations.";
           };
 
@@ -151,14 +171,14 @@ rec {
           _module.args = {
             inherit extendModules;
             moduleType = type;
-          } // args;
+          };
         };
       };
 
       merged =
         let collected = collectModules
           (specialArgs.modulesPath or "")
-          (modules ++ [ internalModule ])
+          (regularModules ++ [ internalModule ])
           ({ inherit lib options config specialArgs; } // specialArgs);
         in mergeModules prefix (reverseList collected);
 
@@ -222,7 +242,7 @@ rec {
         prefix ? [],
         }:
           evalModules (evalModulesArgs // {
-            modules = evalModulesArgs.modules ++ modules;
+            modules = regularModules ++ modules;
             specialArgs = evalModulesArgs.specialArgs or {} // specialArgs;
             prefix = extendArgs.prefix or evalModulesArgs.prefix;
           });
@@ -231,7 +251,7 @@ rec {
         inherit modules specialArgs;
       };
 
-      result = {
+      result = withWarnings {
         options = checked options;
         config = checked (removeAttrs config [ "_module" ]);
         _module = checked (config._module);
@@ -452,7 +472,7 @@ rec {
           [{ inherit (module) file; inherit value; }]
         ) configs;
 
-      resultsByName = flip mapAttrs declsByName (name: decls:
+      resultsByName = mapAttrs (name: decls:
         # We're descending into attribute ‘name’.
         let
           loc = prefix ++ [name];
@@ -473,7 +493,7 @@ rec {
             in
               throw "The option `${showOption loc}' in `${firstOption._file}' is a prefix of options in `${firstNonOption._file}'."
           else
-            mergeModules' loc decls defns);
+            mergeModules' loc decls defns) declsByName;
 
       matchedOptions = mapAttrs (n: v: v.matchedOptions) resultsByName;
 
@@ -487,12 +507,19 @@ rec {
       inherit matchedOptions;
 
       # Transforms unmatchedDefnsByName into a list of definitions
-      unmatchedDefns = concatLists (mapAttrsToList (name: defs:
+      unmatchedDefns =
-        map (def: def // {
+        if configs == []
-          # Set this so we know when the definition first left unmatched territory
+        then
-          prefix = [name] ++ (def.prefix or []);
+          # When no config values exist, there can be no unmatched config, so
-        }) defs
+          # we short circuit and avoid evaluating more _options_ than necessary.
-      ) unmatchedDefnsByName);
+          []
+        else
+          concatLists (mapAttrsToList (name: defs:
+            map (def: def // {
+              # Set this so we know when the definition first left unmatched territory
+              prefix = [name] ++ (def.prefix or []);
+            }) defs
+          ) unmatchedDefnsByName);
     };
 
   /* Merge multiple option declarations into a single declaration.  In
@@ -906,7 +933,7 @@ rec {
   mkMergedOptionModule = from: to: mergeFn:
     { config, options, ... }:
     {
-      options = foldl recursiveUpdate {} (map (path: setAttrByPath path (mkOption {
+      options = foldl' recursiveUpdate {} (map (path: setAttrByPath path (mkOption {
         visible = false;
         # To use the value in mergeFn without triggering errors
         default = "_mkMergedOptionModule";
@@ -1010,7 +1037,7 @@ rec {
 
   /* Use this function to import a JSON file as NixOS configuration.
 
-     importJSON -> path -> attrs
+     modules.importJSON :: path -> attrs
   */
   importJSON = file: {
     _file = file;
@@ -1019,7 +1046,7 @@ rec {
 
   /* Use this function to import a TOML file as NixOS configuration.
 
-     importTOML -> path -> attrs
+     modules.importTOML :: path -> attrs
   */
   importTOML = file: {
     _file = file;

lib/tests/modules/declare-attrsOf.nix

@@ -1,6 +1,13 @@
-{ lib, ... }: {
+{ lib, ... }:
+let
+  deathtrapArgs = lib.mapAttrs
+    (k: _: throw "The module system is too strict, accessing an unused option's ${k} mkOption-attribute.")
+    (lib.functionArgs lib.mkOption);
+in
+{
   options.value = lib.mkOption {
     type = lib.types.attrsOf lib.types.str;
     default = {};
   };
+  options.testing-laziness-so-don't-read-me = lib.mkOption deathtrapArgs;
 }

lib/tests/modules/freeform-nested.nix

@@ -1,7 +1,14 @@
-{ lib, ... }: {
+{ lib, ... }:
+let
+  deathtrapArgs = lib.mapAttrs
+    (k: _: throw "The module system is too strict, accessing an unused option's ${k} mkOption-attribute.")
+    (lib.functionArgs lib.mkOption);
+in
+{
   options.nest.foo = lib.mkOption {
     type = lib.types.bool;
     default = false;
   };
+  options.nest.unused = lib.mkOption deathtrapArgs;
   config.nest.bar = "bar";
 }

maintainers/maintainer-list.nix

@@ -7675,6 +7675,12 @@
     githubId = 21156022;
     name = "Michal Minář";
   };
+  michzappa = {
+    email = "me@michzappa.com";
+    github = "michzappa";
+    githubId = 59343378;
+    name = "Michael Zappa";
+  };
   mickours = {
     email = "mickours@gmail.com<";
     github = "mickours";

nixos/doc/manual/from_md/release-notes/rl-2111.section.xml

@@ -273,6 +273,13 @@
           <link xlink:href="options.html#opt-services.peertube.enable">services.peertube</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://maddy.email">maddy</link>, a
+          composable all-in-one mail server. Available as
+          <link xlink:href="options.html#opt-services.maddy.enable">services.maddy</link>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           <link xlink:href="https://sr.ht">sourcehut</link>, a

nixos/doc/manual/release-notes/rl-2111.section.md

@@ -74,6 +74,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [PeerTube](https://joinpeertube.org/), developed by Framasoft, is the free and decentralized alternative to video platforms. Available at [services.peertube](options.html#opt-services.peertube.enable).
 
+- [maddy](https://maddy.email), a composable all-in-one mail server. Available as [services.maddy](options.html#opt-services.maddy.enable).
+
 - [sourcehut](https://sr.ht), a collection of tools useful for software development. Available as [services.sourcehut](options.html#opt-services.sourcehut.enable).
 
 - [ucarp](https://download.pureftpd.org/pub/ucarp/README), an userspace implementation of the Common Address Redundancy Protocol (CARP). Available as [networking.ucarp](options.html#opt-networking.ucarp.enable).

nixos/lib/eval-config.nix

@@ -8,6 +8,7 @@
 # as subcomponents (e.g. the container feature, or nixops if network
 # expressions are ever made modular at the top level) can just use
 # types.submodule instead of using eval-config.nix
+evalConfigArgs@
 { # !!! system can be set modularly, would be nice to remove
   system ? builtins.currentSystem
 , # !!! is this argument needed any more? The pkgs argument can
@@ -28,7 +29,7 @@
                  in if e == "" then [] else [(import e)]
 }:
 
-let extraArgs_ = extraArgs; pkgs_ = pkgs;
+let pkgs_ = pkgs;
 in
 
 let
@@ -51,28 +52,49 @@ let
     };
   };
 
-  noUserModules = lib.evalModules {
+  withWarnings = x:
-    inherit prefix check;
+    lib.warnIf (evalConfigArgs?args) "The extraArgs argument to eval-config.nix is deprecated. Please set config._module.args instead."
-    modules = baseModules ++ extraModules ++ [ pkgsModule ];
+    lib.warnIf (evalConfigArgs?check) "The check argument to eval-config.nix is deprecated. Please set config._module.check instead."
-    args = extraArgs;
+    x;
+
+  legacyModules =
+    lib.optional (evalConfigArgs?args) {
+      config = {
+        _module.args = extraArgs;
+      };
+    }
+    ++ lib.optional (evalConfigArgs?check) {
+      config = {
+        _module.check = lib.mkDefault check;
+      };
+    };
+  allUserModules = modules ++ legacyModules;
+
+  noUserModules = lib.evalModules ({
+    inherit prefix;
+    modules = baseModules ++ extraModules ++ [ pkgsModule modulesModule ];
     specialArgs =
       { modulesPath = builtins.toString ../modules; } // specialArgs;
+  });
+
+  # Extra arguments that are useful for constructing a similar configuration.
+  modulesModule = {
+    config = {
+      _module.args = {
+        inherit noUserModules baseModules extraModules modules;
+      };
+    };
   };
 
-  # These are the extra arguments passed to every module.  In
+  nixosWithUserModules = noUserModules.extendModules { modules = allUserModules; };
-  # particular, Nixpkgs is passed through the "pkgs" argument.
-  extraArgs = extraArgs_ // {
-    inherit noUserModules baseModules extraModules modules;
-  };
 
-in rec {
+in withWarnings {
 
   # Merge the option definitions in all modules, forming the full
   # system configuration.
-  inherit (noUserModules.extendModules { inherit modules; })
+  inherit (nixosWithUserModules) config options _module type;
-    config options _module type;
 
   inherit extraArgs;
 
-  inherit (_module.args) pkgs;
+  inherit (nixosWithUserModules._module.args) pkgs;
 }

nixos/modules/misc/documentation.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, baseModules, extraModules, modules, modulesPath, ... }:
+{ config, lib, pkgs, extendModules, noUserModules, ... }:
 
 with lib;
 
@@ -6,11 +6,8 @@ let
 
   cfg = config.documentation;
 
-  manualModules =
+  /* Modules for which to show options even when not imported. */
-    baseModules
+  extraDocModules = [ ../virtualisation/qemu-vm.nix ];
-    # Modules for which to show options even when not imported
-    ++ [ ../virtualisation/qemu-vm.nix ]
-    ++ optionals cfg.nixos.includeAllModules (extraModules ++ modules);
 
   /* For the purpose of generating docs, evaluate options with each derivation
     in `pkgs` (recursively) replaced by a fake with path "\${pkgs.attribute.path}".
@@ -24,13 +21,10 @@ let
     extraSources = cfg.nixos.extraModuleSources;
     options =
       let
-        scrubbedEval = evalModules {
+        extendNixOS = if cfg.nixos.includeAllModules then extendModules else noUserModules.extendModules;
-          modules = [ { nixpkgs.localSystem = config.nixpkgs.localSystem; } ] ++ manualModules;
+        scrubbedEval = extendNixOS {
-          args = (config._module.args) // { modules = [ ]; };
+          modules = extraDocModules;
-          specialArgs = {
+          specialArgs.pkgs = scrubDerivations "pkgs" pkgs;
-            pkgs = scrubDerivations "pkgs" pkgs;
-            inherit modulesPath;
-          };
         };
         scrubDerivations = namePrefix: pkgSet: mapAttrs
           (name: value:

nixos/modules/module-list.nix

@@ -467,6 +467,7 @@
   ./services/mail/dovecot.nix
   ./services/mail/dspam.nix
   ./services/mail/exim.nix
+  ./services/mail/maddy.nix
   ./services/mail/mail.nix
   ./services/mail/mailcatcher.nix
   ./services/mail/mailhog.nix

nixos/modules/security/acme.nix

@@ -325,7 +325,8 @@ let
 
       # Working directory will be /tmp
       script = ''
-        set -euxo pipefail
+        ${optionalString data.enableDebugLogs "set -x"}
+        set -euo pipefail
 
         # This reimplements the expiration date check, but without querying
         # the acme server first. By doing this offline, we avoid errors
@@ -438,6 +439,8 @@ let
         default = "_mkMergedOptionModule";
       };
 
+      enableDebugLogs = mkEnableOption "debug logging for this certificate" // { default = cfg.enableDebugLogs; };
+
       webroot = mkOption {
         type = types.nullOr types.str;
         default = null;
@@ -616,6 +619,8 @@ in {
   options = {
     security.acme = {
 
+      enableDebugLogs = mkEnableOption "debug logging for all certificates by default" // { default = true; };
+
       validMinDays = mkOption {
         type = types.int;
         default = 30;

nixos/modules/services/mail/maddy.nix

@@ -0,0 +1,247 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  name = "maddy";
+  cfg = config.services.maddy;
+  defaultConfig = ''
+    tls off
+
+    auth.pass_table local_authdb {
+      table sql_table {
+        driver sqlite3
+        dsn credentials.db
+        table_name passwords
+      }
+    }
+
+    storage.imapsql local_mailboxes {
+      driver sqlite3
+      dsn imapsql.db
+    }
+
+    table.chain local_rewrites {
+      optional_step regexp "(.+)\+(.+)@(.+)" "$1@$3"
+      optional_step static {
+        entry postmaster postmaster@$(primary_domain)
+      }
+      optional_step file /etc/maddy/aliases
+    }
+    msgpipeline local_routing {
+      destination postmaster $(local_domains) {
+        modify {
+          replace_rcpt &local_rewrites
+        }
+        deliver_to &local_mailboxes
+      }
+      default_destination {
+        reject 550 5.1.1 "User doesn't exist"
+      }
+    }
+
+    smtp tcp://0.0.0.0:25 {
+      limits {
+        all rate 20 1s
+        all concurrency 10
+      }
+      dmarc yes
+      check {
+        require_mx_record
+        dkim
+        spf
+      }
+      source $(local_domains) {
+        reject 501 5.1.8 "Use Submission for outgoing SMTP"
+      }
+      default_source {
+        destination postmaster $(local_domains) {
+          deliver_to &local_routing
+        }
+        default_destination {
+          reject 550 5.1.1 "User doesn't exist"
+        }
+      }
+    }
+
+    submission tcp://0.0.0.0:587 {
+      limits {
+        all rate 50 1s
+      }
+      auth &local_authdb
+      source $(local_domains) {
+        check {
+            authorize_sender {
+                prepare_email &local_rewrites
+                user_to_email identity
+            }
+        }
+        destination postmaster $(local_domains) {
+            deliver_to &local_routing
+        }
+        default_destination {
+            modify {
+                dkim $(primary_domain) $(local_domains) default
+            }
+            deliver_to &remote_queue
+        }
+      }
+      default_source {
+        reject 501 5.1.8 "Non-local sender domain"
+      }
+    }
+
+    target.remote outbound_delivery {
+      limits {
+        destination rate 20 1s
+        destination concurrency 10
+      }
+      mx_auth {
+        dane
+        mtasts {
+          cache fs
+          fs_dir mtasts_cache/
+        }
+        local_policy {
+            min_tls_level encrypted
+            min_mx_level none
+        }
+      }
+    }
+
+    target.queue remote_queue {
+      target &outbound_delivery
+      autogenerated_msg_domain $(primary_domain)
+      bounce {
+        destination postmaster $(local_domains) {
+          deliver_to &local_routing
+        }
+        default_destination {
+            reject 550 5.0.0 "Refusing to send DSNs to non-local addresses"
+        }
+      }
+    }
+
+    imap tcp://0.0.0.0:143 {
+      auth &local_authdb
+      storage &local_mailboxes
+    }
+  '';
+
+in {
+  options = {
+    services.maddy = {
+      enable = mkEnableOption "Maddy, a free an open source mail server";
+
+      user = mkOption {
+        default = "maddy";
+        type = with types; uniq string;
+        description = ''
+          Name of the user under which maddy will run. If not specified, a
+          default user will be created.
+        '';
+      };
+      group = mkOption {
+        default = "maddy";
+        type = with types; uniq string;
+        description = ''
+          Name of the group under which maddy will run. If not specified, a
+          default group will be created.
+        '';
+      };
+
+      hostname = mkOption {
+        default = "localhost";
+        type = with types; uniq string;
+        example = ''example.com'';
+        description = ''
+          Hostname to use. It should be FQDN.
+        '';
+      };
+      primaryDomain = mkOption {
+        default = "localhost";
+        type = with types; uniq string;
+        example = ''mail.example.com'';
+        description = ''
+          Primary MX domain to use. It should be FQDN.
+        '';
+      };
+      localDomains = mkOption {
+        type = with types; listOf str;
+        default = ["$(primary_domain)"];
+        example = [
+          "$(primary_domain)"
+          "example.com"
+          "other.example.com"
+        ];
+        description = ''
+          Define list of allowed domains.
+        '';
+      };
+      config = mkOption {
+        type = with types; nullOr lines;
+        default = defaultConfig;
+        description = ''
+          Server configuration.
+        '';
+      };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Open the configured incoming and outgoing mail server ports.
+        '';
+      };
+
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    systemd = {
+      packages = [ pkgs.maddy ];
+      services.maddy = {
+        serviceConfig = {
+          User = "${cfg.user}";
+          Group = "${cfg.group}";
+        };
+        wantedBy = [ "multi-user.target" ];
+      };
+    };
+
+    environment.etc."maddy/maddy.conf" = {
+      text = ''
+        $(hostname) = ${cfg.hostname}
+        $(primary_domain) = ${cfg.primaryDomain}
+        $(local_domains) = ${toString cfg.localDomains}
+        hostname ${cfg.hostname}
+        ${cfg.config}
+      '';
+    };
+
+    users.users = optionalAttrs (cfg.user == "maddy") {
+      maddy = {
+        description = "Maddy service user";
+        group = cfg.group;
+        home = "/var/lib/maddy";
+        createHome = true;
+        isSystemUser = true;
+      };
+    };
+
+    users.groups = mkIf (cfg.group == "maddy") {
+      maddy = pkgs.lib.mkForce {
+        name = cfg.group;
+      };
+    };
+
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ 25 143 587 ];
+    };
+
+    environment.systemPackages = [
+      pkgs.maddy
+    ];
+  };
+}

nixos/modules/services/networking/ddclient.nix

@@ -29,7 +29,7 @@ let
   configFile = if (cfg.configFile != null) then cfg.configFile else configFile';
 
   preStart = ''
-    install --mode=0400 ${configFile} /run/${RuntimeDirectory}/ddclient.conf
+    install ${configFile} /run/${RuntimeDirectory}/ddclient.conf
     ${lib.optionalString (cfg.configFile == null) (if (cfg.passwordFile != null) then ''
       password=$(printf "%q" "$(head -n 1 "${cfg.passwordFile}")")
       sed -i "s|^password=$|password=$password|" /run/${RuntimeDirectory}/ddclient.conf

nixos/modules/services/networking/freeradius.nix

@@ -28,6 +28,7 @@ let
         ProtectHome = "on";
         Restart = "on-failure";
         RestartSec = 2;
+        LogsDirectory = "radius";
     };
   };
 
@@ -73,6 +74,7 @@ in
       users.radius = {
         /*uid = config.ids.uids.radius;*/
         description = "Radius daemon user";
+        isSystemUser = true;
       };
     };
 

nixos/modules/services/networking/pleroma.nix

@@ -100,6 +100,7 @@ in {
       after = [ "network-online.target" "postgresql.service" ];
       wantedBy = [ "multi-user.target" ];
       restartTriggers = [ config.environment.etc."/pleroma/config.exs".source ];
+      environment.RELEASE_COOKIE = "/var/lib/pleroma/.cookie";
       serviceConfig = {
         User = cfg.user;
         Group = cfg.group;
@@ -116,8 +117,14 @@ in {
         # has not been updated. But the no-op process is pretty fast.
         # Better be safe than sorry migration-wise.
         ExecStartPre =
-          let preScript = pkgs.writers.writeBashBin "pleromaStartPre"
+          let preScript = pkgs.writers.writeBashBin "pleromaStartPre" ''
-            "${cfg.package}/bin/pleroma_ctl migrate";
+            if [ ! -f /var/lib/pleroma/.cookie ]
+            then
+              echo "Creating cookie file"
+              dd if=/dev/urandom bs=1 count=16 | hexdump -e '16/1 "%02x"' > /var/lib/pleroma/.cookie
+            fi
+            ${cfg.package}/bin/pleroma_ctl migrate
+          '';
           in "${preScript}/bin/pleromaStartPre";
 
         ExecStart = "${cfg.package}/bin/pleroma start";

nixos/modules/services/torrent/transmission.nix

@@ -167,13 +167,15 @@ in
       };
 
       downloadDirPermissions = mkOption {
-        type = types.str;
+        type = with types; nullOr str;
-        default = "770";
+        default = null;
-        example = "775";
+        example = "770";
         description = ''
-          The permissions set by <literal>systemd.activationScripts.transmission-daemon</literal>
+          If not <code>null</code>, is used as the permissions
-          on the directories <xref linkend="opt-services.transmission.settings.download-dir"/>
+          set by <literal>systemd.activationScripts.transmission-daemon</literal>
-          and <xref linkend="opt-services.transmission.settings.incomplete-dir"/>.
+          on the directories <xref linkend="opt-services.transmission.settings.download-dir"/>,
+          <xref linkend="opt-services.transmission.settings.incomplete-dir"/>.
+          and <xref linkend="opt-services.transmission.settings.watch-dir"/>.
           Note that you may also want to change
           <xref linkend="opt-services.transmission.settings.umask"/>.
         '';
@@ -246,15 +248,17 @@ in
     # when /home/foo is not owned by cfg.user.
     # Note also that using an ExecStartPre= wouldn't work either
     # because BindPaths= needs these directories before.
-    system.activationScripts.transmission-daemon = ''
+    system.activationScripts = mkIf (cfg.downloadDirPermissions != null)
-      install -d -m 700 '${cfg.home}/${settingsDir}'
+      { transmission-daemon = ''
-      chown -R '${cfg.user}:${cfg.group}' ${cfg.home}/${settingsDir}
+        install -d -m 700 '${cfg.home}/${settingsDir}'
-      install -d -m '${cfg.downloadDirPermissions}' -o '${cfg.user}' -g '${cfg.group}' '${cfg.settings.download-dir}'
+        chown -R '${cfg.user}:${cfg.group}' ${cfg.home}/${settingsDir}
-      '' + optionalString cfg.settings.incomplete-dir-enabled ''
+        install -d -m '${cfg.downloadDirPermissions}' -o '${cfg.user}' -g '${cfg.group}' '${cfg.settings.download-dir}'
-      install -d -m '${cfg.downloadDirPermissions}' -o '${cfg.user}' -g '${cfg.group}' '${cfg.settings.incomplete-dir}'
+        '' + optionalString cfg.settings.incomplete-dir-enabled ''
-      '' + optionalString cfg.settings.watch-dir-enabled ''
+        install -d -m '${cfg.downloadDirPermissions}' -o '${cfg.user}' -g '${cfg.group}' '${cfg.settings.incomplete-dir}'
-      install -d -m '${cfg.downloadDirPermissions}' -o '${cfg.user}' -g '${cfg.group}' '${cfg.settings.watch-dir}'
+        '' + optionalString cfg.settings.watch-dir-enabled ''
-      '';
+        install -d -m '${cfg.downloadDirPermissions}' -o '${cfg.user}' -g '${cfg.group}' '${cfg.settings.watch-dir}'
+        '';
+      };
 
     systemd.services.transmission = {
       description = "Transmission BitTorrent Service";
@@ -313,6 +317,14 @@ in
             cfg.settings.script-torrent-done-filename ++
           optional (cfg.settings.watch-dir-enabled && !cfg.settings.trash-original-torrent-files)
             cfg.settings.watch-dir;
+        StateDirectory = [
+          "transmission"
+          "transmission/.config/transmission-daemon"
+          "transmission/.incomplete"
+          "transmission/Downloads"
+          "transmission/watch-dir"
+        ];
+        StateDirectoryMode = mkDefault 750;
         # The following options are only for optimizing:
         # systemd-analyze security transmission
         AmbientCapabilities = "";

nixos/modules/services/web-servers/nginx/location-options.nix

@@ -102,7 +102,7 @@ with lib;
     };
 
     fastcgiParams = mkOption {
-      type = types.attrsOf types.str;
+      type = types.attrsOf (types.either types.str types.path);
       default = {};
       description = ''
         FastCGI parameters to override.  Unlike in the Nginx

nixos/tests/all-tests.nix

@@ -247,6 +247,7 @@ in
   lxd-image-server = handleTest ./lxd-image-server.nix {};
   #logstash = handleTest ./logstash.nix {};
   lorri = handleTest ./lorri/default.nix {};
+  maddy = handleTest ./maddy.nix {};
   magic-wormhole-mailbox-server = handleTest ./magic-wormhole-mailbox-server.nix {};
   magnetico = handleTest ./magnetico.nix {};
   mailcatcher = handleTest ./mailcatcher.nix {};

nixos/tests/maddy.nix

@@ -0,0 +1,58 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "maddy";
+  meta = with pkgs.lib.maintainers; { maintainers = [ onny ]; };
+
+  nodes = {
+    server = { ... }: {
+      services.maddy = {
+        enable = true;
+        hostname = "server";
+        primaryDomain = "server";
+        openFirewall = true;
+      };
+    };
+
+    client = { ... }: {
+      environment.systemPackages = [
+        (pkgs.writers.writePython3Bin "send-testmail" { } ''
+          import smtplib
+          from email.mime.text import MIMEText
+
+          msg = MIMEText("Hello World")
+          msg['Subject'] = 'Test'
+          msg['From'] = "postmaster@server"
+          msg['To'] = "postmaster@server"
+          with smtplib.SMTP('server', 587) as smtp:
+              smtp.login('postmaster@server', 'test')
+              smtp.sendmail('postmaster@server', 'postmaster@server', msg.as_string())
+        '')
+        (pkgs.writers.writePython3Bin "test-imap" { } ''
+          import imaplib
+
+          with imaplib.IMAP4('server') as imap:
+              imap.login('postmaster@server', 'test')
+              imap.select()
+              status, refs = imap.search(None, 'ALL')
+              assert status == 'OK'
+              assert len(refs) == 1
+              status, msg = imap.fetch(refs[0], 'BODY[TEXT]')
+              assert status == 'OK'
+              assert msg[0][1].strip() == b"Hello World"
+        '')
+      ];
+    };
+  };
+
+  testScript = ''
+    start_all()
+    server.wait_for_unit("maddy.service")
+    server.wait_for_open_port(143)
+    server.wait_for_open_port(587)
+
+    server.succeed("echo test | maddyctl creds create postmaster@server")
+    server.succeed("maddyctl imap-acct create postmaster@server")
+
+    client.succeed("send-testmail")
+    client.succeed("test-imap")
+  '';
+})

pkgs/applications/audio/ft2-clone/default.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ft2-clone";
-  version = "1.47";
+  version = "1.48";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "ft2-clone";
     rev = "v${version}";
-    sha256 = "sha256-KLHJROOtRPtGHBYEMByY7LG6FY4vES6WndCiz7okan8=";
+    sha256 = "sha256-ZE9uid/srHHuTRqzgbtHcfmM0VkVsdrK1CJ3Qwbvtao=";
   };
 
   # Adapt the linux-only CMakeLists to darwin (more reliable than make-macos.sh)

pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix

@@ -196,6 +196,35 @@
 
   power-mode = callPackage ./power-mode { };
 
+  prisma-mode = let
+    rev = "5283ca7403bcb21ca0cac8ecb063600752dfd9d4";
+  in melpaBuild {
+    pname = "prisma-mode";
+    version = "20211207.0";
+
+    commit = rev;
+
+    packageRequires = [ js2-mode ];
+
+    src = pkgs.fetchFromGitHub {
+      owner = "pimeys";
+      repo = "emacs-prisma-mode";
+      inherit rev;
+      sha256 = "sha256-DJJfjbu27Gi7Nzsa1cdi8nIQowKH8ZxgQBwfXLB0Q/I=";
+    };
+
+    recipe = pkgs.writeText "recipe" ''
+      (prisma-mode
+      :repo "pimeys/emacs-prisma-mode"
+      :fetcher github)
+    '';
+
+    meta = {
+      description = "Major mode for Prisma Schema Language";
+      license = gpl2Only;
+    };
+  };
+
   railgun = callPackage ./railgun { };
 
   structured-haskell-mode = self.shm;

pkgs/applications/misc/charm/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "charm";
-  version = "0.8.6";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "charm";
     rev = "v${version}";
-    sha256 = "0mjq0yy60czsw40h5n515qmi6bbvhrddll4sn5r2q1nf9pvviqr6";
+    sha256 = "1q5c2qka4srqj82f50iwmcj2j0yw2msz5dmrx2avqppp3fyi9jz3";
   };
 
-  vendorSha256 = "1spzawnk2fslc1m14dp8lx4vpnxwz7xgm1hxbpz4bqlqz1hfd6ax";
+  vendorSha256 = "1xycgzx706kyz37z3517p98129iy7py7zdizz34k38fvfpila5q5";
 
   doCheck = false;
 

pkgs/applications/misc/mob/default.nix

@@ -2,14 +2,14 @@
 
 buildGoPackage rec {
   pname = "mob";
-  version = "2.0.0";
+  version = "2.1.0";
   goPackagePath = "github.com/remotemobprogramming/mob";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "remotemobprogramming";
     repo = pname;
-    sha256 = "sha256-sSeXL+eHroxDr+91rwmUJ+WwDgefZgJBRTxy4wo6DDM=";
+    sha256 = "sha256-K8ID8cetzCaMc/PVRNMyIhrshtEUiD6U/jI4e0TcOO4=";
   };
 
   meta = with lib; {

pkgs/applications/misc/skate/default.nix

@@ -0,0 +1,26 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "skate";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "charmbracelet";
+    repo = "skate";
+    rev = "v${version}";
+    sha256 = "01brxckjz8vlgaq9917l45xf48078d4465qn9l0lyll6hic6p06c";
+  };
+
+  vendorSha256 = "0mvx4rzs0mvb1dyxj105mh2awfy0bmp716x7hpfdwhwz3p11fc7k";
+
+  doCheck = false;
+
+  ldflags = [ "-s" "-w" "-X=main.Version=${version}" ];
+
+  meta = with lib; {
+    description = "A personal multi-machine syncable key value store";
+    homepage = "https://github.com/charmbracelet/skate";
+    license = licenses.mit;
+    maintainers = with maintainers; [ penguwin ];
+  };
+}

pkgs/applications/misc/spicetify-cli/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "spicetify-cli";
-  version = "2.7.1";
+  version = "2.8.2";
 
   src = fetchFromGitHub {
     owner = "khanhas";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-fWh345J2fD9uoGrDiVZyEBiOlMy8giEGKHGMujT0mjo=";
+    sha256 = "sha256-YMVB9nKsHYy65McYs1w/ETy+1b8GkjuWFk6PZs4HFko=";
   };
 
   vendorSha256 = "sha256-g0RYIVIq4oMXdRZDBDnVYg7ombN5WEo/6O9hChQvOYs=";

pkgs/applications/networking/browsers/chromium/upstream-info.json

@@ -1,8 +1,8 @@
 {
   "stable": {
-    "version": "96.0.4664.45",
+    "version": "96.0.4664.93",
-    "sha256": "01q4fsf2cbx6g9nnaihvc5jj3ap8jq2gf16pnhf7ixzbhgcnm328",
+    "sha256": "14rlm91pzpdll6x2r1sxdswiv19h1ykxcq0csi9k9g0a9s71yyvw",
-    "sha256bin64": "0546i4yd1jahv088hjxpq0jc393pscvl5ap3s2qw5jrybliyfd2g",
+    "sha256bin64": "15233njj6ln7q3c112ssfh9s4m3shhp920zw8648z9dr7k8512qb",
     "deps": {
       "gn": {
         "version": "2021-09-24",
@@ -12,15 +12,15 @@
       }
     },
     "chromedriver": {
-      "version": "96.0.4664.35",
+      "version": "96.0.4664.45",
-      "sha256_linux": "0iq129a4mj4sjs08s68n82wd8563sw8196xda27wk3pfpprr23db",
+      "sha256_linux": "15wybxlh38sw7f2bzalf9ivfp8262cpcvhq08nw9d2cj3j39f13m",
-      "sha256_darwin": "1prc7zbgnljqz2d89clpk5c0y48r79zmb9in4vinf3j6p2rxn0vy"
+      "sha256_darwin": "0r3b8wgbd8xjb09f4vc402gp77y2aqjk9hpqvvr6xgdr7nqym20f"
     }
   },
   "beta": {
-    "version": "97.0.4692.20",
+    "version": "97.0.4692.36",
-    "sha256": "1njgfz3kz1pyyaaskqc47ldy2gzc3c9a8mjib81nalzrqbmd3372",
+    "sha256": "0p0f19svnymql8skx6alb6zy4fmc5115dc2avs8h2mca1q8n5r0s",
-    "sha256bin64": "0nsaf46a9pl8cxw5v2zsfp2ynja4m55qi1m4mhwhmyr50138655f",
+    "sha256bin64": "08p0rwn4jglrzma1vf4jnyqaffnk0c8xwc7jkgfpkasm43d72zim",
     "deps": {
       "gn": {
         "version": "2021-11-03",

pkgs/applications/networking/cluster/assign-lb-ip/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "assign-lb-ip";
-  version = "2.2.0";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "Nordix";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-PkMXjFP2brULCnD6mGz9wCufMpiwsmulDpINiwmkeys=";
+    sha256 = "sha256-VaxzU8HC+LQTyhL9pxvjiPa6T5v77RT2B7A0IuU/CUg=";
   };
 
   vendorSha256 = "sha256-j9SweQq45sYk0lH6zkFrmWRlVhhMO8rLJGQxS6smAVw=";

pkgs/applications/networking/cluster/clusterctl/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "clusterctl";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = "cluster-api";
     rev = "v${version}";
-    sha256 = "sha256-EkBZZUkr1u0u75WDDFAdLLpS01+3+eyXpu4HRg2Q780=";
+    sha256 = "sha256-esSpCNvgYhuz9i22AU4ZowU5A5ZOPZ15+XHB4OOfTa4=";
   };
 
   vendorSha256 = "sha256-VO1Z4NUWrd4JuFYFg0a01psqoIM8ps3vKd0djR5OELU=";

pkgs/applications/networking/cluster/hubble/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "hubble";
-  version = "0.8.2";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "cilium";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1n1930hlaflx7kzqbz7vvnxw9hrps84kqibaf2ixnjp998kqkl6d";
+    sha256 = "sha256-L8sRvIA89RiXjrG0WcH72iYKlNTFvmQrveA9k5EBRKo=";
   };
 
   vendorSha256 = null;

pkgs/applications/networking/cluster/kubedb-cli/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kubedb-cli";
-  version = "0.22.0";
+  version = "0.24.0";
 
   src = fetchFromGitHub {
     owner = "kubedb";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-pAvaScbwGJMW3iFS26D71nImWsXcEVx7ONUP82f6QDQ=";
+    sha256 = "sha256-b5LbA2qEsEA7J0djEMhDeBY9iV1cvGVtxTlmneQGKYY=";
   };
 
   vendorSha256 = null;

pkgs/applications/networking/cluster/kubeone/default.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "kubeone";
-  version = "1.3.0";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "kubermatic";
     repo = "kubeone";
     rev = "v${version}";
-    sha256 = "sha256-B/ga5MpjXoLe5H/JosmrS/Wuj1elzQHPsnz/qOm7Hrg=";
+    sha256 = "sha256-Y0IlTOAfwEp8WkFpXSS02vEhCM4+juAY+Nx/e9Vv0F0=";
   };
 
   vendorSha256 = "sha256-/rhV7JHuqejCTizcjKIkaJlbRcx7AfMcGqQYo6dlg48=";

pkgs/applications/networking/cluster/kubernetes/default.nix

@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "kubernetes";
-  version = "1.22.3";
+  version = "1.22.4";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "kubernetes";
     rev = "v${version}";
-    sha256 = "sha256-yXis1nq36MO/RnYLxOYBs6xnaTf9lk+VJBzSamrHcEU=";
+    sha256 = "sha256-6ivBecOttzbX85+WCttaU5nXjaiEiKU8xRhnCPkjLXg=";
   };
 
   nativeBuildInputs = [ removeReferencesTo makeWrapper which go rsync installShellFiles ];

pkgs/applications/networking/cluster/minikube/default.nix

@@ -11,9 +11,9 @@
 
 buildGoModule rec {
   pname = "minikube";
-  version = "1.23.2";
+  version = "1.24.0";
 
-  vendorSha256 = "sha256-Q6DadAmx/8TM+MrdaKgAjn0sVrKqTYoWdsmnN77yfKA=";
+  vendorSha256 = "sha256-I23T1eWPTU9QiIVI4qi5mkaS6CkeGbOHKTHwjCnKTIM=";
 
   doCheck = false;
 
@@ -21,7 +21,7 @@ buildGoModule rec {
     owner = "kubernetes";
     repo = "minikube";
     rev = "v${version}";
-    sha256 = "sha256-PIgzGikVIno2Gd+kSjF4kLHuUKgPrPHoIJxAGblI8RQ=";
+    sha256 = "sha256-WW5VVjm7cq/3/RGiIE2nn8O+VK0RHCtKkrlboIzhqC4=";
   };
 
   nativeBuildInputs = [ installShellFiles pkg-config which ];

pkgs/applications/networking/cluster/nerdctl/default.nix

@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "nerdctl";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "containerd";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-uyLY2yH/6J0rtra0brBATadPqrNyyuCcaGfOrng9h4Y=";
+    sha256 = "sha256-Esj1LFf884m9iTJjqqGCMhbgBNSGpYAfi2stPYSNgRA=";
   };
 
-  vendorSha256 = "sha256-r7xzvntTIJocdYMQpFXunI2XV65eRG+piEEzS5N2xsY=";
+  vendorSha256 = "sha256-cfxHx4oyIfUX9bGjwZ9Hu3VieIXOB0VGHjaQWm4kYOk=";
 
   nativeBuildInputs = [ makeWrapper installShellFiles ];
 

pkgs/applications/networking/cluster/nomad-autoscaler/default.nix

@@ -3,7 +3,7 @@
 let
   package = buildGoModule rec {
     pname = "nomad-autoscaler";
-    version = "0.3.3";
+    version = "0.3.4";
 
     outputs = [
       "out"
@@ -25,10 +25,10 @@ let
       owner = "hashicorp";
       repo = "nomad-autoscaler";
       rev = "v${version}";
-      sha256 = "sha256-bN/U6aCf33B88ouQwTGG8CqARzWmIvXNr5JPr3l8cVI=";
+      sha256 = "sha256-SmlcQH+K/axl6Gj+bX0Quk6K/usP0c1hWnIdFjS1dn8=";
     };
 
-    vendorSha256 = "sha256-Ls8gkfLyxfQD8krvxjAPnZhf1r1s2MhtQfMMfp8hJII=";
+    vendorSha256 = "sha256-tO8vi9jBV6rVcGk/OoaXzpnQi4yPdozYZZwAMFCz2+c=";
 
     subPackages = [ "." ];
 

pkgs/applications/networking/cluster/terragrunt/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.35.5";
+  version = "0.35.13";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-VUB1zZwRZ+TUFDcq/lBB9eAeM7d5zWhFy7nxzH5S6oc=";
+    sha256 = "sha256-B+HdxnTm/LfGvabQiKhZVRIaMpg4zgCVYP8MkKiiSok=";
   };
 
-  vendorSha256 = "sha256-y84EFmoJS4SeA5YFIVFU0iWa5NnjU5yvOj7OFE+jGN0=";
+  vendorSha256 = "sha256-tNgEepKqwiqXhmoRCIEg7VJw7Y0TGt+R+6dZzd8aECg=";
 
   doCheck = false;
 

pkgs/applications/networking/dnscontrol/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dnscontrol";
-  version = "3.12.0";
+  version = "3.13.0";
 
   src = fetchFromGitHub {
     owner = "StackExchange";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-g3Yb0LAa9Ukp32p0OoXxjmw9RQwyVpi0KXQBIpKunbU=";
+    sha256 = "sha256-XBpdNQHG90rJWGfXpJgXsj5AR2VhK/3+1U7Zl8XDlsw=";
   };
 
-  vendorSha256 = "sha256-RBe9XzvdgE5XWBTUhvAokElNwARgwVhkMwPmdKUroC0=";
+  vendorSha256 = "sha256-Ob4ZPtP14TsNOnGVfR5lFAKpJsjoJDKmiE++DqY32QA=";
 
   subPackages = [ "." ];
 

pkgs/applications/networking/hydroxide/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "hydroxide";
-  version = "0.2.20";
+  version = "0.2.21";
 
   src = fetchFromGitHub {
     owner = "emersion";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-VTUpiuSsI795XDSxJJvLQlVNPLiekHyKcCazRBky9nU=";
+    sha256 = "sha256-fF+pQnqAWBktc4NdQFTHeB/sEg5bPTxXtdL1x5JuXU8=";
   };
 
-  vendorSha256 = "sha256-AuZnHpJ1Xel/L9dG3ATdXnoTeUxtieah/ea+0svw3oA=";
+  vendorSha256 = "sha256-M5QlhF2Cj1jn5NNiKj1Roh9+sNCWxQEb4vbtsDfapWY=";
 
   doCheck = false;
 

pkgs/applications/science/logic/logisim-evolution/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "logisim-evolution";
-  version = "3.7.1";
+  version = "3.7.2";
 
   src = fetchurl {
     url = "https://github.com/logisim-evolution/logisim-evolution/releases/download/v${version}/logisim-evolution-${version}-all.jar";
-    sha256 = "04q9bzhnzpi8cgv3ly4ii88qvmlw9n09c4p1qmg8dhxqkskdqj6h";
+    sha256 = "sha256-RI+ioOHj13UAGuPzseAAy3oQBQYkja/ucjj4QMeRZhw=";
   };
 
   dontUnpack = true;

pkgs/applications/terminal-emulators/foot/default.nix

@@ -27,7 +27,7 @@
 }:
 
 let
-  version = "1.10.1";
+  version = "1.10.2";
 
   # build stimuli file for PGO build and the script to generate it
   # independently of the foot's build, so we can cache the result
@@ -99,7 +99,7 @@ stdenv.mkDerivation rec {
     owner = "dnkl";
     repo = pname;
     rev = version;
-    sha256 = "12n1v9by519fg40xvjf4v0g2phi08lcg0clz7rxs2i2xwlizz7nc";
+    sha256 = "00096c2m8pn4gpafvmg9lhyprwgnsis62bq4qmagnbb49bj5kr9v";
   };
 
   depsBuildBuild = [

pkgs/applications/video/droidcam/default.nix

@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "droidcam";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "aramg";
     repo = "droidcam";
     rev = "v${version}";
-    sha256 = "sha256-A8FHTAeDFaSDp5Bnfv5NmCC7xIFAw3IcHSD4hZp4vwU=";
+    sha256 = "sha256-3iA7GDTiCx5vHawj8ZBFAK0BIfmxEFuQrVfL7Gi6FhM=";
   };
 
   nativeBuildInputs = [

pkgs/applications/video/f1viewer/default.nix

@@ -0,0 +1,23 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "f1viewer";
+  version = "2.4.0";
+
+  src = fetchFromGitHub {
+    owner = "SoMuchForSubtlety";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "7eXRUG74l9+9nU7EmDvNcHc+2pg5+/amjqtrzT60f94=";
+  };
+
+  vendorSha256 = "4pQ8NT0mh3w7naHEHh2w6Csop0uitlWClZ95VlYaPW0=";
+
+  meta = with lib; {
+    description =
+      "A TUI to view Formula 1 footage using VLC or another media player";
+    homepage = "https://github.com/SoMuchForSubtlety/f1viewer";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ michzappa ];
+  };
+}

pkgs/applications/video/minitube/default.nix

@@ -6,10 +6,10 @@
 
 mkDerivation rec {
   pname = "minitube";
-  version = "3.9.1";
+  version = "3.9.2";
 
   src = fetchFromGitHub {
-    sha256 = "sha256-1BVHxB7WtXCAJqP+uADszdVPc+T3ctCCzfoJPCb5ZTE=";
+    sha256 = "sha256-MIzfo17eAvpWO2HNq9z+D9XiOKTRiUHvaOdxI1EK1f0=";
     rev = version;
     repo = "minitube";
     owner = "flaviotordini";

pkgs/applications/virtualization/qemu/default.nix

@@ -119,6 +119,12 @@ stdenv.mkDerivation rec {
       url = "https://gitlab.com/qemu-project/qemu/-/commit/eb94846280df3f1e2a91b6179fc05f9890b7e384.patch";
       sha256 = "sha256-p31fd47RTSw928DOMrubQQybnzDAGm23z4Yhe+hGJQ8=";
     })
+    # Fixes socket_sockaddr_to_address_unix assertion errors in some setups. Remove with next release.
+    (fetchpatch {
+      name = "fix-unix-socket-path-copy-again.patch";
+      url = "https://gitlab.com/qemu-project/qemu/-/commit/118d527f2e4baec5fe8060b22a6212468b8e4d3f.patch";
+      sha256 = "sha256-ox+JSpc0pqd3bMi5Ot7ljQyk70SX8g+BLufR06mZPps=";
+    })
   ] ++ lib.optional nixosTestRunner ./force-uid0-on-9p.patch
     ++ lib.optionals stdenv.hostPlatform.isMusl [
     ./sigrtminmax.patch

pkgs/data/icons/luna-icons/default.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "luna-icons";
-  version = "1.6";
+  version = "1.7";
 
   src = fetchFromGitHub {
     owner = "darkomarko42";
     repo = pname;
     rev = version;
-    sha256 = "1iw9wqfs8s3l5k5ngyjmvvxbsxcsya3a6h1xwl6d603swv7h1s02";
+    sha256 = "sha256-L8bkO2zGEXfwqoWZRDCm/PdBxwedkx57kduwlMoyAME=";
   };
 
   nativeBuildInputs = [

pkgs/development/compilers/julia/1.0.nix

@@ -1,6 +1,6 @@
 { lib, stdenv, fetchpatch, fetchurl, fetchzip
 # build tools
-, gfortran, m4, makeWrapper, patchelf, perl, which, python2
+, gfortran, m4, makeWrapper, patchelf, perl, which, python3
 , cmake
 # libjulia dependencies
 , libunwind, readline, utf8proc, zlib
@@ -74,7 +74,7 @@ stdenv.mkDerivation rec {
     sha256 = src_sha256;
   };
 
-  nativeBuildInputs = [ cmake curl gfortran m4 makeWrapper patchelf perl python2 which ];
+  nativeBuildInputs = [ cmake curl gfortran m4 makeWrapper patchelf perl python3 which ];
   # cmake is only used to build the bundled deps
   dontUseCmakeConfigure = true;
 

pkgs/development/compilers/julia/1.5.nix

@@ -1,6 +1,6 @@
 { lib, stdenv, fetchzip
 # build tools
-, gfortran, m4, makeWrapper, patchelf, perl, which, python2, cmake
+, gfortran, m4, makeWrapper, patchelf, perl, which, python3, cmake
 # libjulia dependencies
 , libunwind, readline, utf8proc, zlib
 # standard library dependencies
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     zlib
   ] ++ lib.optionals stdenv.isDarwin [CoreServices ApplicationServices];
 
-  nativeBuildInputs = [ curl gfortran m4 makeWrapper patchelf perl python2 which cmake ];
+  nativeBuildInputs = [ curl gfortran m4 makeWrapper patchelf perl python3 which cmake ];
 
   makeFlags =
     let

pkgs/development/compilers/kaitai-struct-compiler/default.nix

@@ -0,0 +1,36 @@
+{ lib
+, stdenv
+, fetchzip
+, openjdk8
+, makeWrapper
+}:
+
+
+stdenv.mkDerivation rec {
+  pname = "kaitai-struct-compiler";
+  version = "0.9";
+
+  src = fetchzip {
+    url = "https://github.com/kaitai-io/kaitai_struct_compiler/releases/download/${version}/kaitai-struct-compiler-${version}.zip";
+    sha256 = "sha256-2HSasigpJDuWNejNVklnpQwaA4MC030S9taF/7YvzgY=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    install -D $src/bin/kaitai-struct-compiler $out/bin/kaitai-struct-compiler
+    ln -s $out/bin/kaitai-struct-compiler $out/bin/ksc
+    cp -R $src/lib $out/lib
+    wrapProgram $out/bin/kaitai-struct-compiler --prefix PATH : ${lib.makeBinPath [ openjdk8 ] }
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/kaitai-io/kaitai_struct_compiler";
+    description =
+      "Compiler to generate binary data parsers in C++ / C# / Go / Java / JavaScript / Lua / Perl / PHP / Python / Ruby ";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ luis ];
+    platforms = platforms.unix;
+  };
+}
+

pkgs/development/libraries/amdvlk/default.nix

@@ -21,13 +21,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "amdvlk";
-  version = "2021.Q3.7";
+  version = "2021.Q4.1";
 
   src = fetchRepoProject {
     name = "${pname}-src";
     manifest = "https://github.com/GPUOpen-Drivers/AMDVLK.git";
     rev = "refs/tags/v-${version}";
-    sha256 = "sha256-0Q6c10lQSxgqOB6X6F8LyeF2aoyicmp0tZlknuZjQHE=";
+    sha256 = "sha256-yvpHLreBNhiSxnZis5+XcTOSZPRLq5K8YNJsjpYqD6s=";
   };
 
   buildInputs = [

pkgs/development/libraries/libqb/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libqb";
-  version = "2.0.3";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "ClusterLabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-a9CnqfrQUL0DdPPOJjfh9tQ0O8iRHPP3iBmy3MKvt/0=";
+    sha256 = "sha256-s6b2/bCVNzr3IBqiSAjiJ/DHCqkRwR1aA+J4uBP5mO4=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];

pkgs/development/libraries/libspng/default.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libspng";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "randy408";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0zk0w09is4g7gysax4h0f4xj5f40vm6ipc1wi98ymzban89cjjnz";
+    sha256 = "sha256-JBNFYmmd1UnoIfV6iWeDIw/kgvl8AArxfHK+TKjZ9rk=";
   };
 
   doCheck = true;

pkgs/development/libraries/libunwind/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, autoreconfHook, xz, coreutils }:
+{ stdenv, lib, fetchurl, autoreconfHook, xz, buildPackages }:
 
 stdenv.mkDerivation rec {
   pname = "libunwind";
@@ -9,7 +9,9 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-SmrsZmmR+0XQiJxErt6K1usQgHHDVU/N/2cfnJR5SXY=";
   };
 
-  postPatch = lib.optionalString stdenv.hostPlatform.isMusl ''
+  postPatch = if stdenv.cc.isClang then ''
+    substituteInPlace configure.ac --replace "-lgcc_s" ""
+  '' else lib.optionalString stdenv.hostPlatform.isMusl ''
     substituteInPlace configure.ac --replace "-lgcc_s" "-lgcc_eh"
   '';
 
@@ -19,7 +21,7 @@ stdenv.mkDerivation rec {
 
   # Without latex2man, no man pages are installed despite being
   # prebuilt in the source tarball.
-  configureFlags = [ "LATEX2MAN=${coreutils}/bin/true" ];
+  configureFlags = [ "LATEX2MAN=${buildPackages.coreutils}/bin/true" ];
 
   propagatedBuildInputs = [ xz ];
 

pkgs/development/libraries/muparserx/default.nix

@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "muparserx";
-  version = "4.0.8";
+  version = "4.0.11";
 
   src = fetchFromGitHub {
     owner = "beltoforion";
     repo = "muparserx";
     rev = "v${version}";
-    sha256 = "097pkdffv0phr0345hy06mjm5pfy259z13plsvbxvcmds80wl48v";
+    sha256 = "sha256-BWzHlz1mQYsvWa53EtO05Rb4rRHJBSRguJTHLtgqpPw=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/qgnomeplatform/default.nix

@@ -15,13 +15,13 @@
 
 mkDerivation rec {
   pname = "qgnomeplatform";
-  version = "0.8.0";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "FedoraQt";
     repo = "QGnomePlatform";
     rev = version;
-    sha256 = "C/n8i5j0UWfxhP10c4j89U+LrpPozXnam4fIPYMXZAA=";
+    sha256 = "sha256-950VEcxhJeBPSQToC8KpBx/KSneARN6Y8X7CAuFyRjo=";
   };
 
   patches = [

pkgs/development/python-modules/dbutils/default.nix

@@ -5,13 +5,13 @@
 }:
 
 buildPythonPackage rec {
-  version = "2.0.2";
+  version = "3.0.0";
   pname = "dbutils";
 
   src = fetchPypi {
     inherit version;
     pname = "DBUtils";
-    sha256 = "1cc8zyd4lapzf9ny6c2jf1vysphlhr19m8miyvw5spbyq4pxpnsf";
+    sha256 = "549d472197b3eef27e7bb2dd2246b28e880ac0ae9fdf63aadfd3b7def153db0c";
   };
 
   checkInputs = [ pytestCheckHook ];

pkgs/development/python-modules/google-cloud-spanner/default.nix

@@ -14,11 +14,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-spanner";
-  version = "3.11.1";
+  version = "3.12.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b993b4c68f11dd6fe0f66e0c437a71f9bed8d77f6bf1ddc4aad422ce3b330ecb";
+    sha256 = "8f1390c3776fcfce71e1ef024d9ccde52c16d1cd728bc587c24065d6e4d21933";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/memory-allocator/default.nix

@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "memory-allocator";
-  version = "0.1.0";
+  version = "0.1.2";
 
   src = fetchPypi {
     inherit version;
     pname = "memory_allocator";
-    sha256 = "sha256-UUcR71e3eAQIQpmWM+AVQxVtgHvrNjaIlHo5pURUln0=";
+    sha256 = "ddf42a2dcc678062f30c63c868335204d46a4ecdf4db0dc43ed4529f1d0ffab9";
   };
 
   propagatedBuildInputs = [ cython ];

pkgs/development/python-modules/pyathena/default.nix

@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "pyathena";
-  version = "2.3.0";
+  version = "2.3.2";
 
   src = fetchPypi {
     pname = "PyAthena";
     inherit version;
-    sha256 = "08fl653yayvqi991zvcai5ifcxwy9ip6xh0cr3lbimggjnjgwsl5";
+    sha256 = "20a473c52e76a211c427d2f711af0a04804a70fc036ab884780e42e0dc2025f7";
   };
 
   # Nearly all tests depend on a working AWS Athena instance,

pkgs/development/python-modules/pytest-snapshot/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pytest-snapshot";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "427b5ab088b25a1c8b63ce99725040664c840ff1f5a3891252723cce972897f9";
+    sha256 = "cf84c88c3e0b4ae08ae797d9ccdc32715b64dd68b2da40f575db56956ed23326";
   };
 
   nativeBuildInputs = [ setuptools-scm ];

pkgs/development/python-modules/rq/default.nix

@@ -2,14 +2,14 @@
 
 buildPythonPackage rec {
   pname = "rq";
-  version = "1.10";
+  version = "1.10.1";
   disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "rq";
     repo = "rq";
     rev = "v${version}";
-    sha256 = "16k5qz5k3v232dzv99bxxw52jr2hb5ra08b6dkhqya98wjviq8l5";
+    sha256 = "1f4fi1rvn97d2b524q45k6s10b007pr23k0mf44q7hy8q4vnjmh5";
   };
 
   # test require a running redis rerver, which is something we can't do yet

pkgs/development/python-modules/spacy-transformers/default.nix

@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "spacy-transformers";
-  version = "1.1.2";
+  version = "1.1.3";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b84c195dc21a28582579dea3f76c90222e29ee0d99b6adf38ade75646ed2746e";
+    sha256 = "f4f553d3d2a065147a8c1292b5d9adf050c0f78dd15bb05c9614341cf88c5574";
   };
 
   postPatch = ''

pkgs/development/tools/analysis/checkov/default.nix

@@ -46,13 +46,13 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.0.628";
+  version = "2.0.632";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    sha256 = "sha256-/plAzSkvcQ1pEd62/ZyFMew1c81FTIyCTynxVAPjqAE=";
+    sha256 = "sha256-SDMp+QOZy2Ml5V8RHLvmTl/3/KB8iYaW0muakE8PnhA=";
   };
 
   nativeBuildInputs = with py.pkgs; [

pkgs/development/tools/build-managers/bazel/bazel-remote/default.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "bazel-remote";
-  version = "2.2.0";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "buchgr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zRZlpZWGZpBHc5DtqxeVc4xmJDKTem54/Fx/41i57c4=";
+    sha256 = "sha256-ILD7uGVzRgFugHYkhvxy0rbWarXgGZXi/SLRSQb8nl4=";
   };
 
-  vendorSha256 = "sha256-N0UfC/M6EBbnpBpOTNkGgFEJpTA3VQ2jg9M7kxQQQc8=";
+  vendorSha256 = "sha256-XBsYSA0i0q/mp8sQh9h//pjs+TbEDc7UIdNU24/Qemo=";
 
   doCheck = false;
 

pkgs/development/tools/build-managers/bazel/buildtools/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "bazel-buildtools";
-  version = "4.2.3";
+  version = "4.2.4";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = "buildtools";
     rev = version;
-    sha256 = "sha256-FRT8t7bBE98ya5P50UJWhq02XuDGBZCNd3wBOpnDWmo=";
+    sha256 = "sha256-Tt1inAViAFaV+o2A2yquPXEv5EiC2eJgNUnr7jBYq7w=";
   };
 
   vendorSha256 = "sha256-buMkRxVLlS2LBJGaGWeR41BsmE/0vgDS8s1VcRYN0fA=";

pkgs/development/tools/konstraint/default.nix

@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "konstraint";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "plexsystems";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-lnbci3SUVp/vyArrfRF1dgv0KnqcmGIalhsZjDOhpSg=";
+    sha256 = "sha256-vt8/hYsThBoAxMglF8pjdVphmkbHXsuzaHFJhnGXdU4=";
   };
-  vendorSha256 = "sha256-hfnpZgGIEpfHjM5J93D/aljN6j5XHGknpYXWeRV4Y4Q=";
+  vendorSha256 = "sha256-3m+mN90Edb/yMgVmkokRQrDM2EdB7cb2opL0QZJ8L+U=";
 
   # Exclude go within .github folder
   excludedPackages = ".github";

pkgs/development/tools/ktlint/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ktlint";
-  version = "0.43.1";
+  version = "0.43.2";
 
   src = fetchurl {
     url = "https://github.com/pinterest/ktlint/releases/download/${version}/ktlint";
-    sha256 = "1qcalpimgsm5s3xhssrnanryra4dp2if9y4647aimydwvfhi05df";
+    sha256 = "sha256-HXTkYwN6U8xyxgFnj69nLSpbDCqWUWeSuqlZbquRD6o=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/development/tools/lazygit/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "lazygit";
-  version = "0.31.3";
+  version = "0.31.4";
 
   src = fetchFromGitHub {
     owner = "jesseduffield";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-CgWN7xfWX0aSwNAPt2UDftyD0CbQQSUY6SMlyP9TSjc=";
+    sha256 = "sha256-yze4UaSEbyHwHSyj0mM7uCzaDED+p4O3HVVlHJi/FKU=";
   };
 
   vendorSha256 = null;

pkgs/development/tools/misc/editorconfig-checker/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "editorconfig-checker";
-  version = "2.3.5";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "editorconfig-checker";
     repo = "editorconfig-checker";
     rev = version;
-    sha256 = "sha256-t1qvmTs6hOrAnq5hjU2Qjt33vdW9MuSOvWCCY82db+g=";
+    sha256 = "sha256-uP+AgQO1k9fic7r0pOKqO5lUHKEf7Pwaw2U2a6ghzz0=";
   };
 
-  vendorSha256 = "sha256-Rs7u/ZepnMNg5EZ/HWqSdO428KOkxpSbo7rl0treqUY=";
+  vendorSha256 = "sha256-SrBrYyExeDHXhezvtfGLtm8NM1eX4/8kzwUICQLZDjo=";
 
   doCheck = false;
 

pkgs/development/tools/ocaml/camlp4/default.nix

@@ -1,6 +1,6 @@
 { lib, stdenv, fetchzip, which, ocaml, ocamlbuild }:
 
-if lib.versionAtLeast ocaml.version "4.09"
+if lib.versionAtLeast ocaml.version "4.14"
 then throw "camlp4 is not available for OCaml ${ocaml.version}"
 else
 
@@ -26,6 +26,21 @@ let param = {
   "4.08" = {
      version = "4.08+1";
      sha256 = "0qplawvxwai25bi27niw2cgz2al01kcnkj8wxwhxslpi21z6pyx1"; };
+  "4.09" = {
+     version = "4.09+1";
+     sha256 = "1gr33x6xs1rs0bpyq4vzyfxd6vn47jfkg8imi81db2r0cbs0kxx1"; };
+  "4.10" = {
+     version = "4.10+1";
+     sha256 = "093bc1c28wid5li0jwglnd4p3csxw09fmbs9ffybq2z41a5mgay6"; };
+  "4.11" = {
+     version = "4.11+1";
+     sha256 = "0sn7f6im940qh0ixmx1k738xrwwdvy9g7r19bv5218jb6mh0g068"; };
+  "4.12" = {
+     version = "4.12+1";
+     sha256 = "1cfk5ppnd511vzsr9gc0grxbafmh0m3m897aij198rppzxps5kyz"; };
+  "4.13" = {
+     version = "4.13+1";
+     sha256 = "0fzxa1zdhk74mlxpin7p90flks6sp4gkc0mfclmj9zak15rii55n"; };
   }.${ocaml.meta.branch};
 in
 

pkgs/development/tools/open-policy-agent/default.nix

@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "open-policy-agent";
-  version = "0.34.0";
+  version = "0.35.0";
 
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "opa";
     rev = "v${version}";
-    sha256 = "sha256-T8eFCFzDU0GTd7n141XKT34lRXoU2LOrl0Rlh1WLsmo=";
+    sha256 = "sha256-IiYEDvTHb25xolE/IfpFgcJArxU6c89P5oNgt1T2VXA=";
   };
   vendorSha256 = null;
 

pkgs/development/tools/selenium/server/default.nix

@@ -26,7 +26,7 @@ in stdenv.mkDerivation rec {
     cp $src $out/share/lib/${pname}-${version}/${pname}-${version}.jar
     makeWrapper ${jre}/bin/java $out/bin/selenium-server \
       --add-flags "-cp $out/share/lib/${pname}-${version}/${pname}-${version}.jar:${htmlunit-driver}/share/lib/${htmlunit-driver.name}/${htmlunit-driver.name}.jar" \
-      --add-flags ${optionalString chromeSupport "-Dwebdriver.chrome.driver=${chromedriver}/bin/chromedriver"} \
+      ${optionalString chromeSupport "--add-flags -Dwebdriver.chrome.driver=${chromedriver}/bin/chromedriver"} \
       --add-flags "org.openqa.grid.selenium.GridLauncherV3"
   '';
 

pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix

@@ -1,6 +1,7 @@
 { pkgs ? import <nixpkgs> {}
 , nodejs ? pkgs.nodejs
 , yarn ? pkgs.yarn
+, allowAliases ? pkgs.config.allowAliases or true
 }:
 
 let
@@ -9,6 +10,14 @@ let
   compose = f: g: x: f (g x);
   id = x: x;
   composeAll = builtins.foldl' compose id;
+
+  # https://docs.npmjs.com/files/package.json#license
+  # TODO: support expression syntax (OR, AND, etc)
+  getLicenseFromSpdxId = licstr:
+    if licstr == "UNLICENSED" then
+      lib.licenses.unfree
+    else
+      lib.getLicenseFromSpdxId licstr;
 in rec {
   # Export yarn again to make it easier to find out which yarn was used.
   inherit yarn;
@@ -30,16 +39,7 @@ in rec {
       non-null = builtins.filter (x: x != null) parts;
     in builtins.concatStringsSep "-" non-null;
 
-  # https://docs.npmjs.com/files/package.json#license
+  inherit getLicenseFromSpdxId;
-  # TODO: support expression syntax (OR, AND, etc)
-  spdxLicense = licstr:
-    if licstr == "UNLICENSED" then
-      lib.licenses.unfree
-    else
-      lib.findFirst
-        (l: l ? spdxId && l.spdxId == licstr)
-        { shortName = licstr; }
-        (builtins.attrValues lib.licenses);
 
   # Generates the yarn.nix from the yarn.lock file
   mkYarnNix = { yarnLock, flags ? [] }:
@@ -369,7 +369,7 @@ in rec {
         description = packageJSON.description or "";
         homepage = packageJSON.homepage or "";
         version = packageJSON.version or "";
-        license = if packageJSON ? license then spdxLicense packageJSON.license else "";
+        license = if packageJSON ? license then getLicenseFromSpdxId packageJSON.license else "";
       } // (attrs.meta or {});
     });
 
@@ -437,4 +437,7 @@ in rec {
 
     patchShebangs $out
   '';
+} // lib.optionalAttrs allowAliases {
+  # Aliases
+  spdxLicense = getLicenseFromSpdxId; # added 2021-12-01
 }

pkgs/misc/emulators/pcsx2/default.nix

@@ -6,6 +6,7 @@
 , glib
 , gtk3
 , harfbuzz
+, lib
 , libaio
 , libpcap
 , libpng
@@ -17,29 +18,31 @@
 , portaudio
 , SDL2
 , soundtouch
-, lib, stdenv
+, stdenv
 , udev
 , wrapGAppsHook
 , wxGTK
 , zlib
+, wayland
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "pcsx2";
-  version = "unstable-2021-10-28";
+  version = "1.7.2105";
 
   src = fetchFromGitHub {
     owner = "PCSX2";
     repo = "pcsx2";
     fetchSubmodules = true;
-    rev = "52eab493591137d830b45337e04c75ff525a31f9";
+    rev = "v${version}";
-    sha256 = "RhAo5Fob8G16jzb9MOAS43vwTkFzf5XupymN0dzeGJU=";
+    hash = "sha256-/A8u7oDIVs0Zmne0ebaXxOeIQbM9pr62KEH6FJR2umk=";
   };
 
   cmakeFlags = [
     "-DDISABLE_ADVANCE_SIMD=TRUE"
     "-DDISABLE_PCSX2_WRAPPER=TRUE"
     "-DPACKAGE_MODE=TRUE"
+    "-DWAYLAND_API=TRUE"
     "-DXDG_STD=TRUE"
   ];
 
@@ -62,13 +65,14 @@ stdenv.mkDerivation {
     SDL2
     soundtouch
     udev
+    wayland
     wxGTK
     zlib
   ];
 
   meta = with lib; {
     description = "Playstation 2 emulator";
-    longDescription= ''
+    longDescription = ''
       PCSX2 is an open-source PlayStation 2 (AKA PS2) emulator. Its purpose
       is to emulate the PS2 hardware, using a combination of MIPS CPU
       Interpreters, Recompilers and a Virtual Machine which manages hardware

pkgs/os-specific/linux/iw/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iw";
-  version = "5.9";
+  version = "5.16";
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/network/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1wp1ky1v353qqy5fnrk67apgzsap53jkr7pmghk3czpbk880ffi9";
+    sha256 = "sha256-TETkJ2L5A/kJS6WlmJmMgAqXpir9b9MeweCnmeMIZZw=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/servers/ftp/pure-ftpd/default.nix

@@ -1,28 +1,15 @@
-{ lib, stdenv, fetchurl, openssl, fetchpatch }:
+{ lib, stdenv, fetchurl, openssl, pam, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "pure-ftpd";
-  version = "1.0.49";
+  version = "1.0.50";
 
   src = fetchurl {
     url = "https://download.pureftpd.org/pub/pure-ftpd/releases/pure-ftpd-${version}.tar.gz";
-    sha256 = "19cjr262n6h560fi9nm7l1srwf93k34bp8dp1c6gh90bqxcg8yvn";
+    sha256 = "08zas1kg5pnckl28gs7q29952pjfyj8rj59bq96hscqbni7gkqmb";
   };
 
-  patches = [
+  buildInputs = [ openssl pam ];
-    (fetchpatch {
-      name = "CVE-2020-9274.patch";
-      url = "https://github.com/jedisct1/pure-ftpd/commit/8d0d42542e2cb7a56d645fbe4d0ef436e38bcefa.patch";
-      sha256 = "1yd84p6bd4rf21hg3kqpi2a02cac6dz5ag4xx3c2dl5vbzhr5a8k";
-    })
-    (fetchpatch {
-      name = "CVE-2020-9365.patch";
-      url = "https://github.com/jedisct1/pure-ftpd/commit/bf6fcd4935e95128cf22af5924cdc8fe5c0579da.patch";
-      sha256 = "003klx7j82qf92qr1dxg32v5r2bhhywplynd3xil1lbcd3s3mqhi";
-    })
-  ];
-
-  buildInputs = [ openssl ];
 
   configureFlags = [ "--with-tls" ];
 
@@ -31,6 +18,6 @@ stdenv.mkDerivation rec {
     homepage = "https://www.pureftpd.org";
     license = licenses.isc; # with some parts covered by BSD3(?)
     maintainers = [ ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }

pkgs/servers/maddy/default.nix

@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub, coreutils, installShellFiles, scdoc }:
+{ lib, buildGoModule, fetchFromGitHub, coreutils, installShellFiles, scdoc, nixosTests }:
 
 buildGoModule rec {
   pname = "maddy";
@@ -37,6 +37,8 @@ buildGoModule rec {
       --replace "/bin/kill" "${coreutils}/bin/kill"
   '';
 
+  passthru.tests.nixos = nixosTests.maddy;
+
   meta = with lib; {
     description = "Composable all-in-one mail server";
     homepage = "https://maddy.email";

pkgs/servers/mail/dovecot/default.nix

@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation rec {
   pname = "dovecot";
-  version = "2.3.17";
+  version = "2.3.17.1";
 
   nativeBuildInputs = [ perl pkg-config ];
   buildInputs =
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://dovecot.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.gz";
-    sha256 = "1y9dpn4jgzrfjibp5zrc11bdk0q843d998kxhpxkyfm2fz6i4i12";
+    sha256 = "1f525bvpjvi4rnwqjsqaqrbdii08sqmc1v8xq03m19w1vk6cqrqw";
   };
 
   enableParallelBuilding = true;

pkgs/servers/mail/dovecot/plugins/pigeonhole/default.nix

@@ -3,11 +3,11 @@ let
   dovecotMajorMinor = lib.versions.majorMinor dovecot.version;
 in stdenv.mkDerivation rec {
   pname = "dovecot-pigeonhole";
-  version = "0.5.17";
+  version = "0.5.17.1";
 
   src = fetchurl {
     url = "https://pigeonhole.dovecot.org/releases/${dovecotMajorMinor}/dovecot-${dovecotMajorMinor}-pigeonhole-${version}.tar.gz";
-    sha256 = "0j6ng173hh5iiqxdkxfb5v9djpn39gxdrv5ki7i22cf5cqwq47h3";
+    sha256 = "04j5z3y8yyci4ni9j9i7cy0zg1qj2sm9zfarmjcvs9vydpga7i1w";
   };
 
   buildInputs = [ dovecot openssl ];

pkgs/servers/minio/default.nix

@@ -15,16 +15,16 @@ let
 in
 buildGoModule rec {
   pname = "minio";
-  version = "2021-10-27T16-29-42Z";
+  version = "2021-11-24T23-19-33Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "minio";
     rev = "RELEASE.${version}";
-    sha256 = "sha256-U/1NuWyNX0OUrtysV3ShvbyxiSiYzMFNK3lmAVs6D3Y=";
+    sha256 = "sha256-cYoeCjkCLnlp5BVp3BOj7okA1yX+rDp0Rbwcn+ji+Ak=";
   };
 
-  vendorSha256 = "sha256-GLooogUglKxEk7X9UI4VZvj+mJ9LXLZEjFsxCpzm61I=";
+  vendorSha256 = "sha256-DdsLQ87tvh8gbiLh6uLCXiGmnkcE+LcLwvdgDJxXbc8=";
 
   doCheck = false;
 

pkgs/servers/monitoring/grafana/default.nix

@@ -2,7 +2,7 @@
 
 buildGo117Module rec {
   pname = "grafana";
-  version = "8.3.0";
+  version = "8.3.1";
 
   excludedPackages = "\\(alert_webhook_listener\\|clean-swagger\\|release_publisher\\|slow_proxy\\|slow_proxy_mac\\|macaron\\)";
 
@@ -10,12 +10,12 @@ buildGo117Module rec {
     rev = "v${version}";
     owner = "grafana";
     repo = "grafana";
-    sha256 = "sha256-I+jfWHkTm11qIm6CdDFOFHs/qR9pswbjAdfejkxZnrQ=";
+    sha256 = "sha256-KnTk14//uC8T6gqU6IvSQ28fL/h0THVAA6smTspZiVs=";
   };
 
   srcStatic = fetchurl {
     url = "https://dl.grafana.com/oss/release/grafana-${version}.linux-amd64.tar.gz";
-    sha256 = "sha256-o8uw9VRuK93IbZgcZmFmZ2zbgKdryGbeaPAlQr8wJXw=";
+    sha256 = "sha256-CX2F6yymmCvs6o7MtyhVrBGr9D6JSvakbWS7x3kiM5s=";
   };
 
   vendorSha256 = "sha256-aS9yz0JODZtichaIkiBJLiMjbjGY93eSYwuactbRqOY=";

pkgs/servers/plex/raw.nix

@@ -12,16 +12,16 @@
 # server, and the FHS userenv and corresponding NixOS module should
 # automatically pick up the changes.
 stdenv.mkDerivation rec {
-  version = "1.24.5.5173-8dcc73a59";
+  version = "1.25.0.5282-2edd3c44d";
   pname = "plexmediaserver";
 
   # Fetch the source
   src = if stdenv.hostPlatform.system == "aarch64-linux" then fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_arm64.deb";
-    sha256 = "0yjnqvy2maym7dmfabj0zjd1gwjnnjwqxzk7j24a1vhwyy0dmjcf";
+    sha256 = "0yjy6gdgrimd82qk7n36rqa9lc8giff4p96zzxpb0lblq5b3dxzb";
   } else fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_amd64.deb";
-    sha256 = "1k2plcqlklch2k8akj8m411i3cm0jvzj02f5x43yhjgjpmwww95z";
+    sha256 = "1jlq76h3wiaf1d91x0l6cxv44k7l47xdy86qkqvxvwnsv1kc0r86";
   };
 
   outputs = [ "out" "basedb" ];

pkgs/servers/soft-serve/default.nix

@@ -0,0 +1,33 @@
+{ lib, buildGoModule, fetchFromGitHub, makeWrapper, git }:
+
+buildGoModule rec {
+  pname = "soft-serve";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "charmbracelet";
+    repo = "soft-serve";
+    rev = "v${version}";
+    sha256 = "0z88699q34a9cbhcz12y2qs2qrspfd8yx4ay0r8jzvkgax9ylrlk";
+  };
+
+  vendorSha256 = "1g2iznfh08l23i81x7g2bhc7l8cppshzlyynxik4jshswlpv80sr";
+
+  doCheck = false;
+
+  ldflags = [ "-s" "-w" "-X=main.Version=${version}" ];
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  postInstall = ''
+    wrapProgram $out/bin/soft \
+      --prefix PATH : "${lib.makeBinPath [ git ]}"
+  '';
+
+  meta = with lib; {
+    description = "A tasty, self-hosted Git server for the command line";
+    homepage = "https://github.com/charmbracelet/soft-serve";
+    license = licenses.mit;
+    maintainers = with maintainers; [ penguwin ];
+  };
+}

pkgs/servers/tmate-ssh-server/default.nix

@@ -23,6 +23,7 @@ stdenv.mkDerivation rec {
     license     = licenses.mit;
     platforms   = platforms.unix;
     maintainers = with maintainers; [ ];
+    knownVulnerabilities = [ "CVE-2021-44513" "CVE-2021-44512" ];
   };
 }
 

pkgs/tools/admin/fits-cloudctl/default.nix

@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "fits-cloudctl";
-  version = "0.10.3";
+  version = "0.10.4";
 
   src = fetchFromGitHub {
     owner = "fi-ts";
     repo = "cloudctl";
     rev = "v${version}";
-    sha256 = "sha256-FbKULHBzx4HcOFhIRdy7DiewOQzBdac3B+N34M/Kbzk=";
+    sha256 = "sha256-D5LICE7CAwCqvaHIYfRWC8Te4W0tGhKAETmus2qa0UM=";
   };
 
   vendorSha256 = "sha256-ImKN3rNotgUkQaKzoetAEG6Q/zlfH8FTK4HTIO0xn4s=";

pkgs/tools/backup/kopia/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kopia";
-  version = "0.9.6";
+  version = "0.9.7";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-lfzlYpkAGGY7fs9PYPSg2XYgW92WV1/zh2oRz4Qw7vs=";
+    sha256 = "sha256-nHMsh+2Wpca2SJSy1XRMWwHHcdjpnb1u9JS6wM4E65Y=";
   };
 
-  vendorSha256 = "sha256-xa6B3gGgJc7E8VCfpRXlE8Jw3ylNnfynK+QEiqy2yF4=";
+  vendorSha256 = "sha256-SJKsTZMppu6eit4ssMSwJOkeaheEYUwWRDPyPjirNHM=";
 
   doCheck = false;
 

pkgs/tools/filesystems/lfs/default.nix

@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lfs";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Cf9W0LnlvMm0XZe6lvx8hQejcwyfxBC6VKltAAfRD5I=";
+    sha256 = "sha256-nRJ73j3l3xaFImhrHEGmfqESEEjVKhIwdNZNc/RqOcU=";
   };
 
-  cargoSha256 = "sha256-skP9VJuRMCyA06YjGbyNIt/DljP3fQQOIQDy6k10zGI=";
+  cargoSha256 = "sha256-iAz2s92hWkLCXoQ09mKCyI0yHvH55WaTSl+a5gz44bU=";
 
   meta = with lib; {
     description = "Get information on your mounted disks";

pkgs/tools/misc/atuin/default.nix

@@ -27,5 +27,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/ellie/atuin";
     license = licenses.mit;
     maintainers = [ maintainers.onsails ];
+    broken = stdenv.isDarwin && stdenv.isAarch64;
   };
 }

pkgs/tools/misc/bash_unit/default.nix

@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bash_unit";
-  version = "1.7.2";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "pgrange";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+hEgag5H7PaBwZSBp3D17q3TZRO2SVBe5M1Ep/jeg1w=";
+    sha256 = "sha256-QWZnzliiqUfg6kXq1VGTNczupxNCgz1gFURrB/K2b4A=";
   };
 
   installPhase = ''

pkgs/tools/misc/cloc/default.nix

@@ -8,7 +8,10 @@ stdenv.mkDerivation rec {
     owner = "AlDanial";
     repo = "cloc";
     rev = "v${version}";
-    sha256 = "sha256-tFARxNGXzWw+EN2qwBOhJEj7zwYfC9tVP0sAHqeGwcM=";
+    sha256 = if stdenv.isDarwin then
+      "1hy1hskiw02b7xaxn2qz0v7znj14l49w1anx20z6rkcps7212l5l"
+    else
+      "sha256-tFARxNGXzWw+EN2qwBOhJEj7zwYfC9tVP0sAHqeGwcM=";
   };
 
   setSourceRoot = ''
@@ -16,7 +19,12 @@ stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = (with perlPackages; [ perl AlgorithmDiff ParallelForkManager RegexpCommon ]);
+  buildInputs = with perlPackages; [
+    perl
+    AlgorithmDiff
+    ParallelForkManager
+    RegexpCommon
+  ];
 
   makeFlags = [ "prefix=" "DESTDIR=$(out)" "INSTALL=install" ];
 

pkgs/tools/misc/datefmt/default.nix

@@ -0,0 +1,23 @@
+{ lib, stdenv, fetchurl, datefmt, testVersion }:
+
+stdenv.mkDerivation rec {
+  pname = "datefmt";
+  version = "0.2.1";
+
+  src = fetchurl {
+    url = "http://cdn.jb55.com/tarballs/datefmt/datefmt-${version}.tar.gz";
+    sha256 = "5d5e765380afe39eb39d48f752aed748b57dfd843a4947b2a6d18ab9b5e68092";
+  };
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  passthru.tests.version = testVersion { package = datefmt; };
+
+  meta = with lib; {
+    homepage = "https://jb55.com/datefmt";
+    description = "A tool that formats timestamps in text streams";
+    platforms = platforms.all;
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ jb55 ];
+  };
+}

pkgs/tools/misc/macchina/default.nix

@@ -3,16 +3,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "macchina";
-  version = "5.0.2";
+  version = "5.0.5";
 
   src = fetchFromGitHub {
     owner = "Macchina-CLI";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-9T1baNmgzB3RBlFaaIQ47Yc9gJAgtS42NNEY1Tk/hBs=";
+    sha256 = "sha256-si+5LvRUIWp48vsD1WxGWl2O/2bpaBX+ArkZPbBqtME=";
   };
 
-  cargoSha256 = "sha256-A5C/B9R58p/DR6cONIRTSkmtXEOobtYHGBHxjdwagRA=";
+  cargoSha256 = "sha256-CN7PxPUkfyDGxVaf879Sp6w0UbqwL/is15xcfH2fm1w=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv Foundation ];

pkgs/tools/misc/mcfly/default.nix

@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mcfly";
-  version = "0.5.9";
+  version = "0.5.10";
 
   src = fetchFromGitHub {
     owner = "cantino";
     repo = "mcfly";
     rev = "v${version}";
-    sha256 = "0i3qjgq1b8h3bzc7rxa60kq1yc2im9m6dgzrvial086a1zk8s81r";
+    sha256 = "sha256-auIerSfEKBK47mIhfmjREJohnhCmtzruobRXaoz5fqA=";
   };
 
   postPatch = ''
@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {
     substituteInPlace mcfly.fish --replace '(which mcfly)'  '${placeholder "out"}/bin/mcfly'
   '';
 
-  cargoSha256 = "084v4fsdi25ahz068ssq29z7d5d3k3jh3s8b07irwybdsy18c629";
+  cargoSha256 = "sha256-f9kpD295syRCntwvyjZ9AeAUV61RMbfRRMgNxKAJL8g=";
 
   meta = with lib; {
     homepage = "https://github.com/cantino/mcfly";

pkgs/tools/misc/remind/default.nix

@@ -16,11 +16,11 @@ let
 in
 tcl.mkTclDerivation rec {
   pname = "remind";
-  version = "03.03.09";
+  version = "03.03.10";
 
   src = fetchurl {
     url = "https://dianne.skoll.ca/projects/remind/download/remind-${version}.tar.gz";
-    sha256 = "sha256-yQh6jGkRNkQvPoguRmd6025pCEsvO7w8W3YNO2vztvM=";
+    sha256 = "sha256-BqFt3f4+hfz4njzOI1mkrUJhR7zOqzT/TNWS+sk2XEc=";
   };
 
   propagatedBuildInputs = tclLibraries;

pkgs/tools/networking/minio-client/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "minio-client";
-  version = "2021-10-07T04-19-58Z";
+  version = "2021-11-16T20-37-36Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "mc";
     rev = "RELEASE.${version}";
-    sha256 = "sha256-FF4blsNzr2M/ZZ2epTBhFkoj6s9Iw5GGXY65mKftojk=";
+    sha256 = "sha256-nNsvHVsVyJNm5ZUU58cymeJCO7uhvVKGpgxaQWCEYvI=";
   };
 
-  vendorSha256 = "sha256-GFxB5Gxnc6m91EjF2z108J1WmggCQrUhxwEA+Sih+94=";
+  vendorSha256 = "sha256-DBRqWgqBv2x/KRATrQ2olDhhWwlSgzckWkRIqmW5+js=";
 
   subPackages = [ "." ];
 

pkgs/tools/networking/tendermint/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tendermint";
-  version = "0.34.14";
+  version = "0.35.0";
 
   src = fetchFromGitHub {
     owner = "tendermint";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-/FYkwHamJTty/h80KaNAmyNg0wCqiOAA3o2whouAOZc=";
+    sha256 = "sha256-fSDmwZNKAHXcMtNZlqJmUFkuFdZLkDbnn+ZrNtnszgU=";
   };
 
-  vendorSha256 = "sha256-9wjiL8/fhWLuGglFkS8OH026zwbrmuadB3goBqFqnvc=";
+  vendorSha256 = "sha256-DktuZ0NUyg8LbYklxde2ZZJ8/WOyBq50E9yEHtS+Hqw=";
 
   subPackages = [ "cmd/tendermint" ];
 

pkgs/tools/nix/statix/default.nix

@@ -1,4 +1,4 @@
-{ lib, rustPlatform, fetchFromGitHub, withJson ? true }:
+{ lib, rustPlatform, fetchFromGitHub, withJson ? true, stdenv }:
 
 rustPlatform.buildRustPackage rec {
   pname = "statix";
@@ -17,6 +17,9 @@ rustPlatform.buildRustPackage rec {
 
   buildFeatures = lib.optional withJson "json";
 
+  # tests are failing on darwin
+  doCheck = !stdenv.isDarwin;
+
   meta = with lib; {
     description = "Lints and suggestions for the nix programming language";
     homepage = "https://github.com/nerdypepper/statix";

pkgs/tools/security/exploitdb/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2021-12-04";
+  version = "2021-12-07";
 
   src = fetchFromGitHub {
     owner = "offensive-security";
     repo = pname;
     rev = version;
-    sha256 = "sha256-3MP6lmh/eQ1cIxiCw0Y2TtCXXQTUij5Q8FDFVWOG/IM=";
+    sha256 = "sha256-6rc3c4i1X6b6CgsJPUx/pMT6sE6jc/Sy8Ffw5mVVgEU=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/tools/security/libtpms/default.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libtpms";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "stefanberger";
     repo = "libtpms";
     rev = "v${version}";
-    sha256 = "sha256-9u5Yq9PXMADvyWZo5aFa0GNzqVsbyN25o/cYQdbrUO0=";
+    sha256 = "sha256-30P/YggrPEVpsh2qo751aW6RtrpIVe1XQWyYZm8P4yA=";
   };
 
   nativeBuildInputs = [

pkgs/tools/security/step-ca/default.nix

@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "step-ca";
-  version = "0.17.6";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "smallstep";
     repo = "certificates";
     rev = "v${version}";
-    sha256 = "sha256-hZdsxSEfb+DwnVOnnp9cT6diQWkFVPSa/T8YDsGlg3k=";
+    sha256 = "sha256-f9sp5sAWysOOoIdCiCJxTWRhyt0wfpO5p4pxW6jj0xc=";
   };
 
-  vendorSha256 = "sha256-OcnqMEotc18rX6BYs3oj8+83MRf7iJJNwjjXUQ5xfp4=";
+  vendorSha256 = "sha256-iDfPCRU91cuZsKqNOjkLGYmWf8i5FO4NmDsfD5Xqip0=";
 
   ldflags = [ "-buildid=" ];