Merge master into staging-next

2022-06-23 18:01:15 +00:00 · 2022-06-23 18:01:15 +00:00 · 4f79f81d47
commit 4f79f81d47
parent bb34355984 3d54f15c00
70 changed files with 1001 additions and 724 deletions
--- a/lib/default.nix
+++ b/lib/default.nix
@ -131,7 +131,8 @@ let
      getValues getFiles
      optionAttrSetToDocList optionAttrSetToDocList'
      scrubOptionValue literalExpression literalExample literalDocBook
-      showOption showFiles unknownModule mkOption mkPackageOption
+      showOption showOptionWithDefLocs showFiles
+      unknownModule mkOption mkPackageOption
      mdDoc literalMD;
    inherit (self.types) isType setType defaultTypeMerge defaultFunctor
      isOptionType mkOptionType;
--- a/lib/options.nix
+++ b/lib/options.nix
@ -7,6 +7,7 @@ let
    collect
    concatLists
    concatMap
+    concatMapStringsSep
    elemAt
    filter
    foldl'
@ -340,6 +341,11 @@ rec {
    in "\n- In `${def.file}'${result}"
  ) defs;

+  showOptionWithDefLocs = opt: ''
+      ${showOption opt.loc}, with values defined in:
+      ${concatMapStringsSep "\n" (defFile: "  - ${defFile}") opt.files}
+    '';
+
  unknownModule = "<unknown-file>";

 }
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -596,6 +596,12 @@
    githubId = 60479013;
    name = "Alma Cemerlic";
  };
+  alternateved = {
+    email = "alternateved@pm.me";
+    github = "alternateved";
+    githubId = 45176912;
+    name = "Tomasz Hołubowicz";
+  };
  alunduil = {
    email = "alunduil@gmail.com";
    github = "alunduil";
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@ -31,6 +31,65 @@
          <literal>stdenv.buildPlatform.canExecute stdenv.hostPlatform</literal>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The <literal>nixpkgs.hostPlatform</literal> and
+          <literal>nixpkgs.buildPlatform</literal> options have been
+          added. These cover and override the
+          <literal>nixpkgs.{system,localSystem,crossSystem}</literal>
+          options.
+        </para>
+        <itemizedlist spacing="compact">
+          <listitem>
+            <para>
+              <literal>hostPlatform</literal> is the platform or
+              <quote><literal>system</literal></quote> string of the
+              NixOS system described by the configuration.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>buildPlatform</literal> is the platform that is
+              responsible for building the NixOS configuration. It
+              defaults to the <literal>hostPlatform</literal>, for a
+              non-cross build configuration. To cross compile, set
+              <literal>buildPlatform</literal> to a different value.
+            </para>
+          </listitem>
+        </itemizedlist>
+        <para>
+          The new options convey the same information, but with fewer
+          options, and following the Nixpkgs terminology.
+        </para>
+        <para>
+          The existing options
+          <literal>nixpkgs.{system,localSystem,crossSystem}</literal>
+          have not been formally deprecated, to allow for evaluation of
+          the change and to allow for a transition period so that in
+          time the ecosystem can switch without breaking compatibility
+          with any supported NixOS release.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>nixos-generate-config</literal> now generates
+          configurations that can be built in pure mode. This is
+          achieved by setting the new
+          <literal>nixpkgs.hostPlatform</literal> option.
+        </para>
+        <para>
+          You may have to unset the <literal>system</literal> parameter
+          in <literal>lib.nixosSystem</literal>, or similarly remove
+          definitions of the
+          <literal>nixpkgs.{system,localSystem,crossSystem}</literal>
+          options.
+        </para>
+        <para>
+          Alternatively, you can remove the
+          <literal>hostPlatform</literal> line and use NixOS like you
+          would in NixOS 22.05 and earlier.
+        </para>
+      </listitem>
      <listitem>
        <para>
          PHP now defaults to PHP 8.1, updated from 8.0.
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@ -17,6 +17,33 @@ In addition to numerous new and upgraded packages, this release has the followin
  built for `stdenv.hostPlatform` (i.e. produced by `stdenv.cc`) by evaluating
  `stdenv.buildPlatform.canExecute stdenv.hostPlatform`.

+- The `nixpkgs.hostPlatform` and `nixpkgs.buildPlatform` options have been added.
+  These cover and override the `nixpkgs.{system,localSystem,crossSystem}` options.
+
+   - `hostPlatform` is the platform or "`system`" string of the NixOS system
+     described by the configuration.
+   - `buildPlatform` is the platform that is responsible for building the NixOS
+     configuration. It defaults to the `hostPlatform`, for a non-cross
+     build configuration. To cross compile, set `buildPlatform` to a different
+     value.
+
+  The new options convey the same information, but with fewer options, and
+  following the Nixpkgs terminology.
+
+  The existing options `nixpkgs.{system,localSystem,crossSystem}` have not
+  been formally deprecated, to allow for evaluation of the change and to allow
+  for a transition period so that in time the ecosystem can switch without
+  breaking compatibility with any supported NixOS release.
+
+- `nixos-generate-config` now generates configurations that can be built in pure
+  mode. This is achieved by setting the new `nixpkgs.hostPlatform` option.
+
+  You may have to unset the `system` parameter in `lib.nixosSystem`, or similarly
+  remove definitions of the `nixpkgs.{system,localSystem,crossSystem}` options.
+
+  Alternatively, you can remove the `hostPlatform` line and use NixOS like you
+  would in NixOS 22.05 and earlier.
+
 - PHP now defaults to PHP 8.1, updated from 8.0.

 - `hardware.nvidia` has a new option `open` that can be used to opt in the opensource version of NVIDIA kernel driver. Note that the driver's support for GeForce and Workstation GPUs is still alpha quality, see [NVIDIA Releases Open-Source GPU Kernel Modules](https://developer.nvidia.com/blog/nvidia-releases-open-source-gpu-kernel-modules/) for the official announcement.
--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@ -84,6 +84,15 @@ sub debug {
 }


+# nixpkgs.system
+my ($status, @systemLines) = runCommand("nix-instantiate --impure --eval --expr builtins.currentSystem");
+if ($status != 0 || join("", @systemLines) =~ /error/) {
+    die "Failed to retrieve current system type from nix.\n";
+}
+chomp(my $system = @systemLines[0]);
+push @attrs, "nixpkgs.hostPlatform = lib.mkDefault $system;";
+
+
 my $cpuinfo = read_file "/proc/cpuinfo";


--- a/nixos/modules/misc/nixpkgs.nix
+++ b/nixos/modules/misc/nixpkgs.nix
@ -55,9 +55,46 @@ let
    check = builtins.isAttrs;
  };

-  defaultPkgs = import ../../.. {
-    inherit (cfg) config overlays localSystem crossSystem;
-  };
+  hasBuildPlatform = opt.buildPlatform.highestPrio < (mkOptionDefault {}).priority;
+  hasHostPlatform = opt.hostPlatform.isDefined;
+  hasPlatform = hasHostPlatform || hasBuildPlatform;
+
+  # Context for messages
+  hostPlatformLine = optionalString hasHostPlatform "${showOptionWithDefLocs opt.hostPlatform}";
+  buildPlatformLine = optionalString hasBuildPlatform "${showOptionWithDefLocs opt.buildPlatform}";
+  platformLines = optionalString hasPlatform ''
+    Your system configuration configures nixpkgs with platform parameters:
+    ${hostPlatformLine
+    }${buildPlatformLine
+    }'';
+
+  legacyOptionsDefined =
+    optional opt.system.isDefined opt.system
+    ++ (optional (opt.localSystem.highestPrio < (mkOptionDefault {}).priority) opt.localSystem)
+    ++ (optional (opt.crossSystem.highestPrio < (mkOptionDefault {}).priority) opt.crossSystem)
+    ;
+
+  defaultPkgs =
+    if opt.hostPlatform.isDefined
+    then
+      let isCross = cfg.buildPlatform != cfg.hostPlatform;
+          systemArgs =
+            if isCross
+            then {
+              localSystem = cfg.buildPlatform;
+              crossSystem = cfg.hostPlatform;
+            }
+            else {
+              localSystem = cfg.hostPlatform;
+            };
+      in
+      import ../../.. ({
+        inherit (cfg) config overlays;
+      } // systemArgs)
+    else
+      import ../../.. {
+        inherit (cfg) config overlays localSystem crossSystem;
+      };

  finalPkgs = if opt.pkgs.isDefined then cfg.pkgs.appendOverlays cfg.overlays else defaultPkgs;

@ -157,6 +194,46 @@ in
      '';
    };

+    hostPlatform = mkOption {
+      type = types.either types.str types.attrs; # TODO utilize lib.systems.parsedPlatform
+      example = { system = "aarch64-linux"; config = "aarch64-unknown-linux-gnu"; };
+      # Make sure that the final value has all fields for sake of other modules
+      # referring to this. TODO make `lib.systems` itself use the module system.
+      apply = lib.systems.elaborate;
+      defaultText = literalExpression
+        ''(import "''${nixos}/../lib").lib.systems.examples.aarch64-multiplatform'';
+      description = ''
+        Specifies the platform where the NixOS configuration will run.
+
+        To cross-compile, set also <code>nixpkgs.buildPlatform</code>.
+
+        Ignored when <code>nixpkgs.pkgs</code> is set.
+      '';
+    };
+
+    buildPlatform = mkOption {
+      type = types.either types.str types.attrs; # TODO utilize lib.systems.parsedPlatform
+      default = cfg.hostPlatform;
+      example = { system = "x86_64-linux"; config = "x86_64-unknown-linux-gnu"; };
+      # Make sure that the final value has all fields for sake of other modules
+      # referring to this.
+      apply = lib.systems.elaborate;
+      defaultText = literalExpression
+        ''config.nixpkgs.hostPlatform'';
+      description = ''
+        Specifies the platform on which NixOS should be built.
+        By default, NixOS is built on the system where it runs, but you can
+        change where it's built. Setting this option will cause NixOS to be
+        cross-compiled.
+
+        For instance, if you're doing distributed multi-platform deployment,
+        or if you're building machines, you can set this to match your
+        development system and/or build farm.
+
+        Ignored when <code>nixpkgs.pkgs</code> is set.
+      '';
+    };
+
    localSystem = mkOption {
      type = types.attrs; # TODO utilize lib.systems.parsedPlatform
      default = { inherit (cfg) system; };
@ -176,10 +253,13 @@ in
        deployment, or when building virtual machines. See its
        description in the Nixpkgs manual for more details.

-        Ignored when <code>nixpkgs.pkgs</code> is set.
+        Ignored when <code>nixpkgs.pkgs</code> or <code>hostPlatform</code> is set.
      '';
    };

+    # TODO deprecate. "crossSystem" is a nonsense identifier, because "cross"
+    #      is a relation between at least 2 systems in the context of a
+    #      specific build step, not a single system.
    crossSystem = mkOption {
      type = types.nullOr types.attrs; # TODO utilize lib.systems.parsedPlatform
      default = null;
@ -193,7 +273,7 @@ in
        should be set as null, the default. See its description in the
        Nixpkgs manual for more details.

-        Ignored when <code>nixpkgs.pkgs</code> is set.
+        Ignored when <code>nixpkgs.pkgs</code> or <code>hostPlatform</code> is set.
      '';
    };

@ -216,8 +296,7 @@ in
        </programlisting>
        See <code>nixpkgs.localSystem</code> for more information.

-        Ignored when <code>nixpkgs.localSystem</code> is set.
-        Ignored when <code>nixpkgs.pkgs</code> is set.
+        Ignored when <code>nixpkgs.pkgs</code>, <code>nixpkgs.localSystem</code> or <code>nixpkgs.hostPlatform</code> is set.
      '';
    };
  };
@ -240,10 +319,23 @@ in
            else "nixpkgs.localSystem";
          pkgsSystem = finalPkgs.stdenv.targetPlatform.system;
        in {
-          assertion = nixosExpectedSystem == pkgsSystem;
+          assertion = !hasPlatform -> nixosExpectedSystem == pkgsSystem;
          message = "The NixOS nixpkgs.pkgs option was set to a Nixpkgs invocation that compiles to target system ${pkgsSystem} but NixOS was configured for system ${nixosExpectedSystem} via NixOS option ${nixosOption}. The NixOS system settings must match the Nixpkgs target system.";
        }
      )
+      {
+        assertion = hasPlatform -> legacyOptionsDefined == [];
+        message = ''
+          Your system configures nixpkgs with the platform parameter${optionalString hasBuildPlatform "s"}:
+          ${hostPlatformLine
+          }${buildPlatformLine
+          }
+          However, it also defines the legacy options:
+          ${concatMapStrings showOptionWithDefLocs legacyOptionsDefined}
+          For a future proof system configuration, we recommend to remove
+          the legacy definitions.
+        '';
+      }
    ];
  };

--- a/nixos/modules/misc/nixpkgs/test.nix
+++ b/nixos/modules/misc/nixpkgs/test.nix
@ -1,8 +1,63 @@
 { evalMinimalConfig, pkgs, lib, stdenv }:
+let
+  eval = mod: evalMinimalConfig {
+    imports = [ ../nixpkgs.nix mod ];
+  };
+  withHost = eval {
+    nixpkgs.hostPlatform = "aarch64-linux";
+  };
+  withHostAndBuild = eval {
+    nixpkgs.hostPlatform = "aarch64-linux";
+    nixpkgs.buildPlatform = "aarch64-darwin";
+  };
+  ambiguous = {
+    _file = "ambiguous.nix";
+    nixpkgs.hostPlatform = "aarch64-linux";
+    nixpkgs.buildPlatform = "aarch64-darwin";
+    nixpkgs.system = "x86_64-linux";
+    nixpkgs.localSystem.system = "x86_64-darwin";
+    nixpkgs.crossSystem.system = "i686-linux";
+    imports = [
+      { _file = "repeat.nix";
+        nixpkgs.hostPlatform = "aarch64-linux";
+      }
+    ];
+  };
+  getErrors = module:
+    let
+      uncheckedEval = lib.evalModules { modules = [ ../nixpkgs.nix module ]; };
+    in map (ass: ass.message) (lib.filter (ass: !ass.assertion) uncheckedEval.config.assertions);
+in
 lib.recurseIntoAttrs {
  invokeNixpkgsSimple =
-    (evalMinimalConfig ({ config, modulesPath, ... }: {
-      imports = [ (modulesPath + "/misc/nixpkgs.nix") ];
+    (eval {
      nixpkgs.system = stdenv.hostPlatform.system;
-    }))._module.args.pkgs.hello;
+    })._module.args.pkgs.hello;
+  assertions =
+    assert withHost._module.args.pkgs.stdenv.hostPlatform.system == "aarch64-linux";
+    assert withHost._module.args.pkgs.stdenv.buildPlatform.system == "aarch64-linux";
+    assert withHostAndBuild._module.args.pkgs.stdenv.hostPlatform.system == "aarch64-linux";
+    assert withHostAndBuild._module.args.pkgs.stdenv.buildPlatform.system == "aarch64-darwin";
+    assert builtins.trace (lib.head (getErrors ambiguous))
+      getErrors ambiguous ==
+        [''
+          Your system configures nixpkgs with the platform parameters:
+          nixpkgs.hostPlatform, with values defined in:
+            - repeat.nix
+            - ambiguous.nix
+          nixpkgs.buildPlatform, with values defined in:
+            - ambiguous.nix
+
+          However, it also defines the legacy options:
+          nixpkgs.system, with values defined in:
+            - ambiguous.nix
+          nixpkgs.localSystem, with values defined in:
+            - ambiguous.nix
+          nixpkgs.crossSystem, with values defined in:
+            - ambiguous.nix
+
+          For a future proof system configuration, we recommend to remove
+          the legacy definitions.
+        ''];
+    pkgs.emptyFile;
 }
--- a/nixos/modules/services/networking/tailscale.nix
+++ b/nixos/modules/services/networking/tailscale.nix
@ -6,6 +6,7 @@ let
  cfg = config.services.tailscale;
  firewallOn = config.networking.firewall.enable;
  rpfMode = config.networking.firewall.checkReversePath;
+  isNetworkd = config.networking.useNetworkd;
  rpfIsStrict = rpfMode == true || rpfMode == "strict";
 in {
  meta.maintainers = with maintainers; [ danderson mbaillie twitchyliquid64 ];
@ -69,5 +70,17 @@ in {
      # linux distros.
      stopIfChanged = false;
    };
+
+    networking.dhcpcd.denyInterfaces = [ cfg.interfaceName ];
+
+    systemd.network.networks."50-tailscale" = mkIf isNetworkd {
+      matchConfig = {
+        Name = cfg.interfaceName;
+      };
+      linkConfig = {
+        Unmanaged = true;
+        ActivationPolicy = "manual";
+      };
+    };
  };
 }
--- a/nixos/tests/kernel-generic.nix
+++ b/nixos/tests/kernel-generic.nix
@ -30,7 +30,6 @@ let
      linux_5_4_hardened
      linux_5_10_hardened
      linux_5_15_hardened
-      linux_5_17_hardened
      linux_5_18_hardened

      linux_testing;
--- a/pkgs/applications/editors/vim/default.nix
+++ b/pkgs/applications/editors/vim/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, callPackage, ncurses, gettext, pkg-config
+{ lib, stdenv, fetchurl, callPackage, ncurses, bash, gawk, gettext, pkg-config
 # default vimrc
 , vimrc ? fetchurl {
    name = "default-vimrc";
@ -18,9 +18,11 @@ stdenv.mkDerivation {
  inherit (common) version src postPatch hardeningDisable enableParallelBuilding meta;

  nativeBuildInputs = [ gettext pkg-config ];
-  buildInputs = [ ncurses ]
+  buildInputs = [ ncurses bash gawk ]
    ++ lib.optionals stdenv.hostPlatform.isDarwin [ Carbon Cocoa ];

+  strictDeps = true;
+
  configureFlags = [
    "--enable-multibyte"
    "--enable-nls"
@ -36,6 +38,13 @@ stdenv.mkDerivation {
    "vim_cv_memmove_handles_overlap=yes"
  ];

+  # which.sh is used to for vim's own shebang patching, so make it find
+  # binaries for the host platform.
+  preConfigure = ''
+    export HOST_PATH
+    substituteInPlace src/which.sh --replace '$PATH' '$HOST_PATH'
+  '';
+
  postInstall = ''
    ln -s $out/bin/vim $out/bin/vi
    mkdir -p $out/share/vim
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -191,6 +191,10 @@ self: super: {
    dependencies = with self; [ nvim-cmp ];
  });

+  cmp-nvim-tags = super.cmp-nvim-tags.overrideAttrs (old: {
+    dependencies = with self; [ nvim-cmp ];
+  });
+
  cmp-pandoc-nvim = super.cmp-pandoc-nvim.overrideAttrs (old: {
    dependencies = with self; [ nvim-cmp pandoc plenary-nvim ];
  });
@ -212,22 +216,18 @@ self: super: {
    '';
  });

-  cmp-nvim-tags = super.cmp-nvim-tags.overrideAttrs (old: {
-    dependencies = with self; [ nvim-cmp ];
-  });
-
  cmp-tmux = super.cmp-tmux.overrideAttrs (old: {
    dependencies = with self; [ nvim-cmp tmux ];
  });

-  cmp-vimwiki-tags = super.cmp-vimwiki-tags.overrideAttrs (old: {
-    dependencies = with self; [ nvim-cmp vimwiki ];
-  });
-
  cmp-vim-lsp = super.cmp-vim-lsp.overrideAttrs (old: {
    dependencies = with self; [ nvim-cmp vim-lsp ];
  });

+  cmp-vimwiki-tags = super.cmp-vimwiki-tags.overrideAttrs (old: {
+    dependencies = with self; [ nvim-cmp vimwiki ];
+  });
+
  cmp-zsh = super.cmp-zsh.overrideAttrs (old: {
    dependencies = with self; [ nvim-cmp zsh ];
  });
@ -328,15 +328,15 @@ self: super: {
    };
  });

-  diffview-nvim = super.diffview-nvim.overrideAttrs (oa: {
+  diffview-nvim = super.diffview-nvim.overrideAttrs (old: {
    dependencies = with self; [ plenary-nvim ];

    doInstallCheck = true;
    nvimRequireCheck = "diffview";
  });

-  direnv-vim = super.direnv-vim.overrideAttrs (oa: {
-    preFixup = oa.preFixup or "" + ''
+  direnv-vim = super.direnv-vim.overrideAttrs (old: {
+    preFixup = old.preFixup or "" + ''
      substituteInPlace $out/autoload/direnv.vim \
        --replace "let s:direnv_cmd = get(g:, 'direnv_cmd', 'direnv')" \
          "let s:direnv_cmd = get(g:, 'direnv_cmd', '${lib.getBin direnv}/bin/direnv')"
@ -376,7 +376,7 @@ self: super: {
      patches = [
        (substituteAll {
          src = ./patches/fruzzy/get_version.patch;
-          version = old.version;
+          inherit (old) version;
        })
      ];
      configurePhase = ''
@ -445,31 +445,10 @@ self: super: {
    dependencies = with self; [ plenary-nvim ];
  });

-  # plenary-nvim = super.toVimPlugin(luaPackages.plenary-nvim);
-
-  plenary-nvim = super.plenary-nvim.overrideAttrs (old: {
-    postPatch = ''
-      sed -Ei lua/plenary/curl.lua \
-          -e 's@(command\s*=\s*")curl(")@\1${curl}/bin/curl\2@'
-    '';
-
-    doInstallCheck = true;
-    nvimRequireCheck = "plenary";
-  });
-
  gruvbox-nvim = super.gruvbox-nvim.overrideAttrs (old: {
    dependencies = with self; [ lush-nvim ];
  });

-  jedi-vim = super.jedi-vim.overrideAttrs (old: {
-    # checking for python3 support in vim would be neat, too, but nobody else seems to care
-    buildInputs = [ python3.pkgs.jedi ];
-    meta = {
-      description = "code-completion for python using python-jedi";
-      license = lib.licenses.mit;
-    };
-  });
-
  himalaya-vim = buildVimPluginFrom2Nix {
    pname = "himalaya-vim";
    inherit (himalaya) src version;
@ -485,6 +464,15 @@ self: super: {
    '';
  };

+  jedi-vim = super.jedi-vim.overrideAttrs (old: {
+    # checking for python3 support in vim would be neat, too, but nobody else seems to care
+    buildInputs = [ python3.pkgs.jedi ];
+    meta = {
+      description = "code-completion for python using python-jedi";
+      license = lib.licenses.mit;
+    };
+  });
+
  LanguageClient-neovim =
    let
      version = "0.1.161";
@ -659,7 +647,19 @@ self: super: {
    configurePhase = "cd vim";
  });

-  parinfer-rust = parinfer-rust;
+  inherit parinfer-rust;
+
+  # plenary-nvim = super.toVimPlugin(luaPackages.plenary-nvim);
+
+  plenary-nvim = super.plenary-nvim.overrideAttrs (old: {
+    postPatch = ''
+      sed -Ei lua/plenary/curl.lua \
+          -e 's@(command\s*=\s*")curl(")@\1${curl}/bin/curl\2@'
+    '';
+
+    doInstallCheck = true;
+    nvimRequireCheck = "plenary";
+  });

  range-highlight-nvim = super.range-highlight-nvim.overrideAttrs (old: {
    dependencies = with self; [ cmd-parser-nvim ];
@ -676,7 +676,7 @@ self: super: {

  skim = buildVimPluginFrom2Nix {
    pname = "skim";
-    version = skim.version;
+    inherit (skim) version;
    src = skim.vim;
  };

@ -789,16 +789,16 @@ self: super: {
    dependencies = with self; [ sqlite-lua telescope-nvim ];
  });

-  telescope-fzf-writer-nvim = super.telescope-fzf-writer-nvim.overrideAttrs (old: {
-    dependencies = with self; [ telescope-nvim ];
-  });
-
  telescope-fzf-native-nvim = super.telescope-fzf-native-nvim.overrideAttrs (old: {
    dependencies = with self; [ telescope-nvim ];
    buildPhase = "make";
    meta.platforms = lib.platforms.all;
  });

+  telescope-fzf-writer-nvim = super.telescope-fzf-writer-nvim.overrideAttrs (old: {
+    dependencies = with self; [ telescope-nvim ];
+  });
+
  telescope-fzy-native-nvim = super.telescope-fzy-native-nvim.overrideAttrs (old: {
    dependencies = with self; [ telescope-nvim ];
    preFixup =
@ -974,7 +974,7 @@ self: super: {
            libiconv
          ];

-          cargoSha256 = "sha256-XmQTRmOO/tyA0F6FQQRxZPcVXCYZkEAiNIzU/ismjc0=";
+          cargoSha256 = "sha256-9Vr1gpggfAQlMgM/s8j6FTTYFppHql2PQ7cPtg1wNmo=";
        };
      in
      ''
@ -1103,13 +1103,13 @@ self: super: {

  vim-markdown-composer =
    let
-      vim-markdown-composer-bin = rustPlatform.buildRustPackage rec {
+      vim-markdown-composer-bin = rustPlatform.buildRustPackage {
        pname = "vim-markdown-composer-bin";
        inherit (super.vim-markdown-composer) src version;
-        cargoSha256 = "0q0i6kyihswrjrfdj4p3z54b779sdg2wz38z943ypj6dqphhcklx";
+        cargoSha256 = "sha256-Vie8vLTplhaVU4E9IohvxERfz3eBpd62m8/1Ukzk8e4=";
      };
    in
-    super.vim-markdown-composer.overrideAttrs (oldAttrs: rec {
+    super.vim-markdown-composer.overrideAttrs (old: {
      preFixup = ''
        substituteInPlace "$out"/after/ftplugin/markdown/composer.vim \
          --replace "s:plugin_root . '/target/release/markdown-composer'" \
@ -1287,9 +1287,9 @@ self: super: {
      "coc-smartf"
      "coc-snippets"
      "coc-solargraph"
+      "coc-sqlfluff"
      "coc-stylelint"
      "coc-sumneko-lua"
-      "coc-sqlfluff"
      "coc-tabnine"
      "coc-texlab"
      "coc-toml"
--- a/pkgs/applications/editors/vim/plugins/update.py
+++ b/pkgs/applications/editors/vim/plugins/update.py
@ -116,13 +116,7 @@ class VimEditor(pluginupdate.Editor):
 def main():

    global luaPlugins
-
-    # whitelist
-    luaPlugins = run_nix_expr(GET_PLUGINS_LUA) + [
-        "diffview-nvim",
-        "marks-nvim",
-        "nvim-biscuits"
-    ]
+    luaPlugins = run_nix_expr(GET_PLUGINS_LUA)

    editor = VimEditor("vim", ROOT, GET_PLUGINS)
    parser = editor.create_parser()
--- a/pkgs/applications/graphics/freecad/default.nix
+++ b/pkgs/applications/graphics/freecad/default.nix
@ -48,13 +48,13 @@

 mkDerivation rec {
  pname = "freecad";
-  version = "0.19.2";
+  version = "0.20";

  src = fetchFromGitHub {
    owner = "FreeCAD";
    repo = "FreeCAD";
    rev = version;
-    hash = "sha256-XZ+fRl3CPCIFu3nHeMTLibwwFBlG/cWpKJlI58hTAuU=";
+    hash = "sha256-Em4XVxDfvVG1Kf7q+6uHNA/VcMGLKMTv5TCh2XF/BtQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/prusa-slicer/default.nix
+++ b/pkgs/applications/misc/prusa-slicer/default.nix
@ -1,8 +1,39 @@
-{ stdenv, lib, fetchFromGitHub, cmake, copyDesktopItems, makeDesktopItem
-, pkg-config, wrapGAppsHook, boost, cereal, cgal_5, curl, dbus, eigen, expat
-, glew, glib, gmp, gtest, gtk3, hicolor-icon-theme, ilmbase, libpng, mpfr, nlopt
-, openvdb, pcre, qhull, systemd, tbb, wxGTK31-gtk3, xorg, fetchpatch
-, wxGTK31-gtk3-override ? null }:
+{ stdenv
+, lib
+, binutils
+, fetchFromGitHub
+, cmake
+, copyDesktopItems
+, makeDesktopItem
+, pkg-config
+, wrapGAppsHook
+, boost
+, cereal
+, cgal_5
+, curl
+, dbus
+, eigen
+, expat
+, glew
+, glib
+, gmp
+, gtest
+, gtk3
+, hicolor-icon-theme
+, ilmbase
+, libpng
+, mpfr
+, nlopt
+, openvdb
+, pcre
+, qhull
+, systemd
+, tbb
+, wxGTK31-gtk3
+, xorg
+, fetchpatch
+, wxGTK31-gtk3-override ? null
+}:
 let
  wxGTK31-gtk3-prusa = wxGTK31-gtk3.overrideAttrs (old: rec {
    pname = "wxwidgets-prusa3d-patched";
@ -16,7 +47,8 @@ let
    };
  });
  wxGTK31-gtk3-override' = if wxGTK31-gtk3-override == null then wxGTK31-gtk3-prusa else wxGTK31-gtk3-override;
-in stdenv.mkDerivation rec {
+in
+stdenv.mkDerivation rec {
  pname = "prusa-slicer";
  version = "2.4.2";

@ -28,6 +60,7 @@ in stdenv.mkDerivation rec {
  ];

  buildInputs = [
+    binutils
    boost
    cereal
    cgal_5
@ -58,6 +91,16 @@ in stdenv.mkDerivation rec {
      url = "https://github.com/prusa3d/PrusaSlicer/commit/76f4d6fa98bda633694b30a6e16d58665a634680.patch";
      sha256 = "1r806ycp704ckwzgrw1940hh1l6fpz0k1ww3p37jdk6mygv53nv6";
    })
+    # Fix compile error with boost 1.79. See https://github.com/prusa3d/PrusaSlicer/issues/8238
+    # Can be removed with the next version update
+    (fetchpatch {
+      url = "https://github.com/prusa3d/PrusaSlicer/commit/408e56f0390f20aaf793e0aa0c70c4d9544401d4.patch";
+      sha256 = "sha256-vzEPjLE3Yy5szawPn2Yp3i7MceWewpdnLUPVu9+H3W8=";
+    })
+    (fetchpatch {
+      url = "https://github.com/prusa3d/PrusaSlicer/commit/926ae0471800abd1e5335e251a5934570eb8f6ff.patch";
+      sha256 = "sha256-tAEgubeGGKFWY7r7p/6pmI2HXUGKi2TM1X5ILVZVT20=";
+    })
  ];

  doCheck = true;
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@ -121,7 +121,7 @@ let
    optional optionals optionalString;

  jre' = jre_minimal.override {
-    modules = [ "java.base" "java.desktop" "java.logging" ];
+    modules = [ "java.base" "java.desktop" "java.logging" "java.sql" ];
  };

  importVariant = f: import (./. + "/src-${variant}/${f}");
--- a/pkgs/applications/science/logic/isabelle/default.nix
+++ b/pkgs/applications/science/logic/isabelle/default.nix
@ -47,10 +47,15 @@ in stdenv.mkDerivation rec {
        sha256 = "0jfaqckhg388jh9b4msrpkv6wrd6xzlw18m0bngbby8k8ywalp9i";
      };

-  buildInputs = [ polyml z3 veriT vampire eprover-ho ]
-    ++ lib.optionals (!stdenv.isDarwin) [ nettools java ];
+  buildInputs = [ polyml z3 veriT vampire eprover-ho nettools ]
+    ++ lib.optionals (!stdenv.isDarwin) [ java ];

-  sourceRoot = dirname;
+  sourceRoot = "${dirname}${lib.optionalString stdenv.isDarwin ".app"}";
+
+  postUnpack = if stdenv.isDarwin then ''
+    mv $sourceRoot ${dirname}
+    sourceRoot=${dirname}
+  '' else null;

  postPatch = ''
    patchShebangs .
@ -112,6 +117,9 @@ in stdenv.mkDerivation rec {
      --replace '"$ML_HOME/" ^ (if ML_System.platform_is_windows then "sha1.dll" else "libsha1.so")' '"${sha1}/lib/libsha1.so"'

    rm -r heaps
+  '' + lib.optionalString (stdenv.hostPlatform.system == "x86_64-darwin") ''
+    substituteInPlace lib/scripts/isabelle-platform \
+      --replace 'ISABELLE_APPLE_PLATFORM64=arm64-darwin' ""
  '' + (if ! stdenv.isLinux then "" else ''
    arch=${if stdenv.hostPlatform.system == "x86_64-linux" then "x86_64-linux" else "x86-linux"}
    for f in contrib/*/$arch/{bash_process,epclextract,nunchaku,SPASS,zipperposition}; do
@ -180,7 +188,7 @@ in stdenv.mkDerivation rec {
    homepage = "https://isabelle.in.tum.de/";
    license = licenses.bsd3;
    maintainers = [ maintainers.jwiegley maintainers.jvanbruegge ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
  };
 } // {
  withComponents = f:
--- a/pkgs/applications/science/logic/z3/4.4.0.nix
+++ b/pkgs/applications/science/logic/z3/4.4.0.nix
@ -14,6 +14,8 @@ stdenv.mkDerivation rec {
  buildInputs = [ python ];
  enableParallelBuilding = true;

+  CXXFLAGS = if stdenv.isDarwin then "-std=gnu++98" else null;
+
  configurePhase = "python scripts/mk_make.py --prefix=$out && cd build";

  # z3's install phase is stupid because it tries to calculate the
--- a/pkgs/applications/version-management/meld/default.nix
+++ b/pkgs/applications/version-management/meld/default.nix
@ -1,6 +1,5 @@
 { lib
 , fetchurl
-, fetchpatch
 , gettext
 , itstool
 , python3
@ -19,32 +18,15 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "meld";
-  version = "3.21.1";
+  version = "3.21.2";

  format = "other";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "cP6Y65Ms4h1nFw47D2pzF+gT6GLemJM+pROYLpoDMgI=";
+    sha256 = "IV+odABTZ5TFllddE6nIfijxjdNyW43/mG2y4pM6cU4=";
  };

-  patches = [
-    # Pull upstream fix for meson-0.60:
-    #  https://gitlab.gnome.org/GNOME/meld/-/merge_requests/78
-    (fetchpatch {
-      name = "meson-0.60.patch";
-      url  = "https://gitlab.gnome.org/GNOME/meld/-/commit/cc7746c141d976a4779cf868774fae1fe7627a6d.patch";
-      sha256 = "sha256-4uJZyF00Z6svzrOebByZV1hutCZRkIQYC4rUxQr5fdQ=";
-    })
-
-    # Fix view not rendering with adwaita-icon-theme 42 due to removed icons.
-    # https://gitlab.gnome.org/GNOME/meld/-/merge_requests/83
-    (fetchpatch {
-      url  = "https://gitlab.gnome.org/GNOME/meld/-/commit/f850cdf3eaf0f08abea003d5fae118a5e92a3d61.patch";
-      sha256 = "PaK8Rpv79UwMUligm9pIY16JW/dm7eVXntAwTV4hnbE=";
-    })
-  ];
-
  nativeBuildInputs = [
    meson
    ninja
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@ -154,7 +154,10 @@ stdenv.mkDerivation ({

  hardeningDisable = [ "format" "pie" ];

-  outputs = if langJava || langGo then ["out" "man" "info"]
+  # When targetting darwin, libgcc_ext.10.{4,5}.dylib are created as
+  # MH_DYLIB_STUB files, which install_name_tool can't change, so we
+  # get a cycle between $out and $lib.
+  outputs = if langJava || langGo || targetPlatform.isDarwin then ["out" "man" "info"]
    else [ "out" "lib" "man" "info" ];
  setOutputFlags = false;
  NIX_NO_SELF_RPATH = true;
@ -328,7 +331,6 @@ stdenv.mkDerivation ({
    maintainers = with lib.maintainers; [ veprbl ];

    platforms = lib.platforms.unix;
-    badPlatforms = lib.platforms.darwin;
  };
 }

--- a/pkgs/development/compilers/gcc/common/pre-configure.nix
+++ b/pkgs/development/compilers/gcc/common/pre-configure.nix
@ -6,14 +6,16 @@
 , langGo }:

 assert langJava -> lib.versionOlder version "7";
-assert langAda -> gnatboot != null;
-
-lib.optionalString (hostPlatform.isSunOS && hostPlatform.is64bit) ''
+assert langAda -> gnatboot != null; let
+  needsLib
+    =  (lib.versionOlder version "7" && (langJava || langGo))
+    || (lib.versions.major version == "4" && lib.versions.minor version == "9" && targetPlatform.isDarwin);
+in lib.optionalString (hostPlatform.isSunOS && hostPlatform.is64bit) ''
  export NIX_LDFLAGS=`echo $NIX_LDFLAGS | sed -e s~$prefix/lib~$prefix/lib/amd64~g`
  export LDFLAGS_FOR_TARGET="-Wl,-rpath,$prefix/lib/amd64 $LDFLAGS_FOR_TARGET"
  export CXXFLAGS_FOR_TARGET="-Wl,-rpath,$prefix/lib/amd64 $CXXFLAGS_FOR_TARGET"
  export CFLAGS_FOR_TARGET="-Wl,-rpath,$prefix/lib/amd64 $CFLAGS_FOR_TARGET"
-'' + lib.optionalString (lib.versionOlder version "7" && (langJava || langGo)) ''
+'' + lib.optionalString needsLib ''
  export lib=$out;
 '' + lib.optionalString langAda ''
  export PATH=${gnatboot}/bin:$PATH
--- a/pkgs/development/compilers/llvm/14/compiler-rt/armv7l.patch
+++ b/pkgs/development/compilers/llvm/14/compiler-rt/armv7l.patch
@ -1,32 +0,0 @@
-diff -ur compiler-rt-10.0.0.src/cmake/builtin-config-ix.cmake compiler-rt-10.0.0.src-patched/cmake/builtin-config-ix.cmake
--- compiler-rt-10.0.0.src/cmake/builtin-config-ix.cmake	2020-03-24 00:01:02.000000000 +0900
-+++ compiler-rt-10.0.0.src-patched/cmake/builtin-config-ix.cmake	2020-05-10 03:42:00.883450706 +0900
-@@ -24,7 +24,7 @@
- 
- 
- set(ARM64 aarch64)
-set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k)
-+set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k armv7l)
- set(HEXAGON hexagon)
- set(X86 i386)
- set(X86_64 x86_64)
-diff -ur compiler-rt-10.0.0.src/lib/builtins/CMakeLists.txt compiler-rt-10.0.0.src-patched/lib/builtins/CMakeLists.txt
--- compiler-rt-10.0.0.src/lib/builtins/CMakeLists.txt	2020-03-24 00:01:02.000000000 +0900
-+++ compiler-rt-10.0.0.src-patched/lib/builtins/CMakeLists.txt	2020-05-10 03:44:49.468579650 +0900
-@@ -474,6 +474,7 @@
- set(armv7_SOURCES ${arm_SOURCES})
- set(armv7s_SOURCES ${arm_SOURCES})
- set(armv7k_SOURCES ${arm_SOURCES})
-+set(armv7l_SOURCES ${arm_SOURCES})
- set(arm64_SOURCES ${aarch64_SOURCES})
- 
- # macho_embedded archs
-@@ -595,7 +596,7 @@
-   foreach (arch ${BUILTIN_SUPPORTED_ARCH})
-     if (CAN_TARGET_${arch})
-       # For ARM archs, exclude any VFP builtins if VFP is not supported
-      if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7m|armv7em)$")
-+      if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7l|armv7m|armv7em)$")
-         string(REPLACE ";" " " _TARGET_${arch}_CFLAGS "${TARGET_${arch}_CFLAGS}")
-         check_compile_definition(__VFP_FP__ "${CMAKE_C_FLAGS} ${_TARGET_${arch}_CFLAGS}" COMPILER_RT_HAS_${arch}_VFP)
-         if(NOT COMPILER_RT_HAS_${arch}_VFP)
--- a/pkgs/development/compilers/llvm/14/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/14/compiler-rt/default.nix
@ -73,8 +73,7 @@ stdenv.mkDerivation {
    # extra `/`.
    ./normalize-var.patch
  ] # Prevent a compilation error on darwin
-    ++ lib.optional stdenv.hostPlatform.isDarwin ./darwin-targetconditionals.patch
-    ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
+    ++ lib.optional stdenv.hostPlatform.isDarwin ./darwin-targetconditionals.patch;

  # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
  # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
--- a/pkgs/development/interpreters/wasmtime/default.nix
+++ b/pkgs/development/interpreters/wasmtime/default.nix
@ -1,42 +1,34 @@
-{ rustPlatform, fetchFromGitHub, lib, stdenv, v8 }:
+{ rustPlatform, fetchFromGitHub, lib }:

 rustPlatform.buildRustPackage rec {
  pname = "wasmtime";
-  version = "0.37.0";
+  version = "0.38.0";

  src = fetchFromGitHub {
    owner = "bytecodealliance";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-ZUr1v94If8ER4lTHLwuP+F3xfXU7IW4ZEztBA2TPvVg=";
+    sha256 = "sha256-q+6w22MbI3HRpmkybZXXWbkK7jbd6lyxodC3EpSovRI=";
    fetchSubmodules = true;
  };

-  cargoSha256 = "sha256-X+KDeWavFTBaxbSPlIiyuiBC7wg1/5C/NXp+VEY8Mk8=";
-
-  # This environment variable is required so that when wasmtime tries
-  # to run tests by using the rusty_v8 crate, it does not try to
-  # download a static v8 build from the Internet, what would break
-  # build hermetism.
-  RUSTY_V8_ARCHIVE = lib.optionalString stdenv.isLinux "${v8}/lib/libv8.a";
+  cargoSha256 = "sha256-uuhGb0/RDz1/3O8WYiyGIUQFh0WZWJgujqtvH+hgbdA=";

  doCheck = true;
  checkFlags = [
    "--skip=cli_tests::run_cwasm"
-    "--skip=commands::compile::test::test_successful_compile"
    "--skip=commands::compile::test::test_aarch64_flags_compile"
-    "--skip=commands::compile::test::test_unsupported_flags_compile"
+    "--skip=commands::compile::test::test_successful_compile"
    "--skip=commands::compile::test::test_x64_flags_compile"
    "--skip=commands::compile::test::test_x64_presets_compile"
    "--skip=traps::parse_dwarf_info"
  ];

  meta = with lib; {
-    broken = stdenv.isDarwin;
    description = "Standalone JIT-style runtime for WebAssembly, using Cranelift";
    homepage = "https://github.com/bytecodealliance/wasmtime";
    license = licenses.asl20;
-    maintainers = [ maintainers.matthewbauer ];
+    maintainers = with maintainers; [ ereslibre matthewbauer ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/development/libraries/amdvlk/default.nix
+++ b/pkgs/development/libraries/amdvlk/default.nix
@ -22,13 +22,13 @@ let

 in stdenv.mkDerivation rec {
  pname = "amdvlk";
-  version = "2022.Q2.2";
+  version = "2022.Q2.3";

  src = fetchRepoProject {
    name = "${pname}-src";
    manifest = "https://github.com/GPUOpen-Drivers/AMDVLK.git";
    rev = "refs/tags/v-${version}";
-    sha256 = "4LV6g2snT1usY+Ic9Hb/IwXAJQ97I9DigZCah6mwewA=";
+    sha256 = "Yd2juNdSP8TdSX9j/iXsC2xrIRzDEuXJbms91AqwjEc=";
  };

  buildInputs = [
--- a/pkgs/development/libraries/libzip/default.nix
+++ b/pkgs/development/libraries/libzip/default.nix
@ -32,6 +32,10 @@ stdenv.mkDerivation rec {
    ++ lib.optionals withOpenssl [ openssl ]
    ++ lib.optionals withZstd [ zstd ];

+  # Don't build the regression tests because they don't build with
+  # pkgsStatic and are not executed anyway.
+  cmakeFlags = [ "-DBUILD_REGRESS=0" ];
+
  preCheck = ''
    # regress/runtest is a generated file
    patchShebangs regress
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@ -2,6 +2,7 @@
 , lib
 , buildPackages
 , fetchFromGitLab
+, fetchpatch
 , removeReferencesTo
 , python3
 , meson
@ -69,7 +70,7 @@ let

  self = stdenv.mkDerivation rec {
    pname = "pipewire";
-    version = "0.3.51";
+    version = "0.3.52";

    outputs = [
      "out"
@ -87,7 +88,7 @@ let
      owner = "pipewire";
      repo = "pipewire";
      rev = version;
-      sha256 = "sha256-k5OdKgkQUaelvrGS4KtO0MtSJg6cF2Nf8RrsR8Kf+C8=";
+      sha256 = "sha256-JWmO36+OF2O9sLB+Z0znwm3TH+O+pEv3cXnuwP6Wy1E=";
    };

    patches = [
@ -103,6 +104,12 @@ let
      ./0090-pipewire-config-template-paths.patch
      # Place SPA data files in lib output to avoid dependency cycles
      ./0095-spa-data-dir.patch
+      # Remove 44.1KHz from allowed rates (multiple regressions reported)
+      # To be removed when 0.3.53 is released
+      (fetchpatch {
+        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/16a7c274989f47b0c0d8ba192a30316b545bd26a.patch";
+        sha256 = "sha256-VZ7ChjcR/PGfmH2DmLxfIhd3mj9668l9zLO4k2KBoqg=";
+      })
    ];

    nativeBuildInputs = [
@ -164,6 +171,7 @@ let
      "-Dbluez5-backend-hfp-native=${mesonEnableFeature nativeHfpSupport}"
      "-Dbluez5-backend-ofono=${mesonEnableFeature ofonoSupport}"
      "-Dbluez5-backend-hsphfpd=${mesonEnableFeature hsphfpdSupport}"
+      "-Dbluez5-codec-lc3plus=disabled"
      "-Dsysconfdir=/etc"
      "-Dpipewire_confdata_dir=${placeholder "lib"}/share/pipewire"
      "-Draop=${mesonEnableFeature raopSupport}"
--- a/pkgs/development/python-modules/diff-cover/default.nix
+++ b/pkgs/development/python-modules/diff-cover/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "diff-cover";
-  version = "6.5.0";
+  version = "6.5.1";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -26,7 +26,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "diff_cover";
    inherit version;
-    hash = "sha256-N2O0/C75EGO6crUCFGUiJLLQqfMVRNVQRZb1xKhHzXs=";
+    hash = "sha256-jDuxOBLpZnvIP4x2BkAlEenC/nnWeG8SlSLnlpPuCWs=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@ -32,14 +32,14 @@ with py.pkgs;

 buildPythonApplication rec {
  pname = "checkov";
-  version = "2.0.1226";
+  version = "2.1.4";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "bridgecrewio";
    repo = pname;
    rev = version;
-    hash = "sha256-hAHIrf1oZMPpciKTUiM+EuP4TDtb0lYI7hlZXWkIyV4=";
+    hash = "sha256-J8CpNeON2qOaU/U7LbIOaQ/DJ/7Q+kLzzw+jD1QLkik=";
  };

  nativeBuildInputs = with py.pkgs; [
--- a/pkgs/development/tools/analysis/radare2/default.nix
+++ b/pkgs/development/tools/analysis/radare2/default.nix
@ -31,8 +31,8 @@ let
  arm64 = fetchFromGitHub {
    owner = "radareorg";
    repo = "vector35-arch-arm64";
-    rev = "3c5eaba46dab72ecb7d5f5b865a13fdeee95b464";
-    sha256 = "sha256-alcGEi+D8CptXzfznnuxQKCvU2mbzn2sQge5jSqLVpg=";
+    rev = "9ab2b0bedde459dc86e079718333de4a63bbbacb";
+    sha256 = "sha256-2KLtjgCqHzBBlo9ImZ8WJ1bsWy/kdJCjCFxlLE+HxoI=";
  };
  armv7 = fetchFromGitHub {
    owner = "radareorg";
@ -44,13 +44,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "radare2";
-  version = "5.7.0";
+  version = "5.7.2";

  src = fetchFromGitHub {
    owner = "radare";
    repo = "radare2";
    rev = version;
-    sha256 = "sha256-tCFi1m3xyQlG+8FijjQh8PMwg6CIfIxvLkd5xCIZHHo=";
+    sha256 = "sha256-TZeW+9buJvCOudHsLTMITFpRUlmNpo71efc3xswJoPw=";
  };

  preBuild = ''
--- a/pkgs/development/tools/continuous-integration/github-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/github-runner/default.nix
@ -46,13 +46,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "github-runner";
-  version = "2.293.0";
+  version = "2.294.0";

  src = fetchFromGitHub {
    owner = "actions";
    repo = "runner";
    rev = "v${version}";
-    hash = "sha256-5XAlKCtIvHzaJCPVO0WsrUGKnYUNR+roqzJ+jrcBfVM=";
+    hash = "sha256-2MOvqVlUZBmCt24EYSVjXWKR+fB2Mys70L/1/7jtwQQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/tools/packer/default.nix
+++ b/pkgs/development/tools/packer/default.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "packer";
-  version = "1.8.1";
+  version = "1.8.2";

  src = fetchFromGitHub {
    owner = "hashicorp";
    repo = "packer";
    rev = "v${version}";
-    sha256 = "sha256-NqXmeBQrDnCGruJTZjAryxCmEdm1CZMPhW6JhZB0log=";
+    sha256 = "sha256-SaQGUVXtAI/FdqRZc4AjDkeEl9lE5i/wKsHKNGLpx8Y=";
  };

-  vendorSha256 = "sha256-Wit5DWTjVrxLLWpfOo/6JrSxqeZvC4Vjv+cW19wNHyw=";
+  vendorSha256 = "sha256-0GE5chSTonJFT7xomfa9a9QsnFpTFX7proo9joaDrOU=";

  subPackages = [ "." ];

--- a/pkgs/tools/package-management/cargo-about/default.nix
+++ b/pkgs/tools/package-management/cargo-about/default.nix
--- a/pkgs/tools/package-management/cargo-about/zstd-pkg-config.patch
+++ b/pkgs/tools/package-management/cargo-about/zstd-pkg-config.patch
--- a/pkgs/tools/package-management/cargo-audit/default.nix
+++ b/pkgs/tools/package-management/cargo-audit/default.nix
--- a/pkgs/tools/package-management/cargo-deb/default.nix
+++ b/pkgs/tools/package-management/cargo-deb/default.nix
--- a/pkgs/tools/package-management/cargo-deps/default.nix
+++ b/pkgs/tools/package-management/cargo-deps/default.nix
--- a/pkgs/tools/package-management/cargo-download/Cargo.nix
+++ b/pkgs/tools/package-management/cargo-download/Cargo.nix
--- a/pkgs/tools/package-management/cargo-download/crates-io.nix
+++ b/pkgs/tools/package-management/cargo-download/crates-io.nix
--- a/pkgs/tools/package-management/cargo-download/default.nix
+++ b/pkgs/tools/package-management/cargo-download/default.nix
--- a/pkgs/tools/package-management/cargo-edit/default.nix
+++ b/pkgs/tools/package-management/cargo-edit/default.nix
--- a/pkgs/development/tools/rust/cargo-flamegraph/default.nix
+++ b/pkgs/development/tools/rust/cargo-flamegraph/default.nix
--- a/pkgs/tools/package-management/cargo-graph/default.nix
+++ b/pkgs/tools/package-management/cargo-graph/default.nix
--- a/pkgs/tools/package-management/cargo-kcov/default.nix
+++ b/pkgs/tools/package-management/cargo-kcov/default.nix
--- a/pkgs/tools/package-management/cargo-license/default.nix
+++ b/pkgs/tools/package-management/cargo-license/default.nix
--- a/pkgs/tools/package-management/cargo-outdated/default.nix
+++ b/pkgs/tools/package-management/cargo-outdated/default.nix
--- a/pkgs/tools/package-management/cargo-release/default.nix
+++ b/pkgs/tools/package-management/cargo-release/default.nix
--- a/pkgs/tools/package-management/cargo-update/default.nix
+++ b/pkgs/tools/package-management/cargo-update/default.nix
--- a/pkgs/development/tools/rust/cargo-web/default.nix
+++ b/pkgs/development/tools/rust/cargo-web/default.nix
--- a/pkgs/os-specific/linux/bpftrace/default.nix
+++ b/pkgs/os-specific/linux/bpftrace/default.nix
@ -62,8 +62,18 @@ stdenv.mkDerivation rec {

  # nuke the example/reference output .txt files, for the included tools,
  # stuffed inside $out. we don't need them at all.
+  # (see "Allow skipping examples" for a potential option
+  #  https://github.com/iovisor/bpftrace/pull/2256)
+  #
+  # Pull BPF scripts into $PATH (next to their bcc program equivalents), but do
+  # not move them to keep `${pkgs.bpftrace}/share/bpftrace/tools/...` working.
+  # (remove `chmod` once a new release "Add executable permission to tools"
+  #  https://github.com/iovisor/bpftrace/commit/77e524e6d276216ed6a6e1984cf204418db07c78)
  postInstall = ''
    rm -rf $out/share/bpftrace/tools/doc
+
+    ln -s $out/share/bpftrace/tools/*.bt $out/bin/
+    chmod +x $out/bin/*.bt
  '';

  outputs = [ "out" "man" ];
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@ -2,71 +2,61 @@
    "4.14": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-4.14.283-hardened1.patch",
-            "sha256": "07827a7wigdp2wml770gc0mmzmcmqf9mnry9xbsxpkgbs91ng6lp",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.283-hardened1/linux-hardened-4.14.283-hardened1.patch"
+            "name": "linux-hardened-4.14.284-hardened1.patch",
+            "sha256": "0hj6hmkv3ikgps0jrwl5jgg9pdw6mxi3iblr20r4yp8anxcrvaws",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.284-hardened1/linux-hardened-4.14.284-hardened1.patch"
        },
-        "sha256": "191gybhnck4mh9yjzwgv1crrbxjc90p12bcif721rbs6xzszmxzh",
-        "version": "4.14.283"
+        "sha256": "1f7bidisa6b4ff0mgn66h1nmf94j5mcx4wnkwnd9f49im6hcqllq",
+        "version": "4.14.284"
    },
    "4.19": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-4.19.247-hardened1.patch",
-            "sha256": "1m7289bljbki2wiy6458v13l8wvslqgqhajcp735j50psi6jr6dp",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.247-hardened1/linux-hardened-4.19.247-hardened1.patch"
+            "name": "linux-hardened-4.19.248-hardened1.patch",
+            "sha256": "09bnw0f8rd5hf4k4w4n4sb3ggsw48nkxsrnxd9b8vn6jyqhv9n3s",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.248-hardened1/linux-hardened-4.19.248-hardened1.patch"
        },
-        "sha256": "136gmsmvgb2nid4by2ld003w06lsr7hgn9ajx0wfziag7pfnjsv2",
-        "version": "4.19.247"
+        "sha256": "0cdflfk6l13slw1cawpkhpjzbbnffcbyffrh29p9jg73pdqx23y4",
+        "version": "4.19.248"
    },
    "5.10": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-5.10.122-hardened1.patch",
-            "sha256": "1mb10f3kfncgpwlygvnlvjy3cjlgjzbc5lp73wgjz1nzqjfdjrlp",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.122-hardened1/linux-hardened-5.10.122-hardened1.patch"
+            "name": "linux-hardened-5.10.124-hardened1.patch",
+            "sha256": "1fjwi5al5i0qb7a7viljb755ylqj3m5qp10835a3q91ad6zkjjnf",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.124-hardened1/linux-hardened-5.10.124-hardened1.patch"
        },
-        "sha256": "0h0gfi3p1dd4p8xxklrl8sc3rv4xd08q7nv0i4m166w8188v62wj",
-        "version": "5.10.122"
+        "sha256": "0yz3yw02b6b1sq800r46x5b3dagswb6z4clrfq485c4669sb2ipc",
+        "version": "5.10.124"
    },
    "5.15": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-5.15.47-hardened1.patch",
-            "sha256": "0bpzk0l4kcfhqinh3rpl6wv70lhw9c304zgw2qbw0fa76mqfwgs8",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.47-hardened1/linux-hardened-5.15.47-hardened1.patch"
+            "name": "linux-hardened-5.15.49-hardened1.patch",
+            "sha256": "0p14bhqk0a4xzr11cc6gqc0ncc1a3cmvwyvisbsp7b74ax9w5qbm",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.49-hardened1/linux-hardened-5.15.49-hardened1.patch"
        },
-        "sha256": "1700js21yimx8rz4bsglszry564l2ycmmcr36rdqspzbmlx5w8wb",
-        "version": "5.15.47"
-    },
-    "5.17": {
-        "patch": {
-            "extra": "-hardened1",
-            "name": "linux-hardened-5.17.15-hardened1.patch",
-            "sha256": "053zgg464rb8ca92hkzxqbffapmj0zs296af354b7jkgfpb5xzr1",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.17.15-hardened1/linux-hardened-5.17.15-hardened1.patch"
-        },
-        "sha256": "0a5n1lb43nhnhwjwclkk3dqp2nxsx5ny7zfl8idvzshf94m9472a",
-        "version": "5.17.15"
+        "sha256": "1p2r02h2z0j34hpkp3kr4741pr15ii72b94zllravx27pa9phj9j",
+        "version": "5.15.49"
    },
    "5.18": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-5.18.3-hardened1.patch",
-            "sha256": "1kfnknpw2g39j7gqy6mqjmkaxkmdigx617rz2vpqvjxddfv59764",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.18.3-hardened1/linux-hardened-5.18.3-hardened1.patch"
+            "name": "linux-hardened-5.18.6-hardened1.patch",
+            "sha256": "0y0s50z4qrkcd0s7rlsk8nw1xibwy2i5vigm6526ch77d61g231m",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.18.6-hardened1/linux-hardened-5.18.6-hardened1.patch"
        },
-        "sha256": "1sngy576db1zl2284kd0j8ds4biln0q98wnywirzsg3c0w2v8367",
-        "version": "5.18.3"
+        "sha256": "0y1l2cgn8rak1050fn65a9xnapqyfq2dv8bijl150y44g6g2l72f",
+        "version": "5.18.6"
    },
    "5.4": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-5.4.198-hardened1.patch",
-            "sha256": "0srx8kfapa8ahbqajwd8dir49l4rs0ijz3k3nrgvb2jjlrg1m4dd",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.198-hardened1/linux-hardened-5.4.198-hardened1.patch"
+            "name": "linux-hardened-5.4.200-hardened1.patch",
+            "sha256": "1mpcvgri079v8js8y2angwmksyk07vhyi2b5b24bxxdbm1s5a58s",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.200-hardened1/linux-hardened-5.4.200-hardened1.patch"
        },
-        "sha256": "0wvscr5wia2xdiqfxxdwl8kxf1s085qdj5h4423mraj7dh6l0ihh",
-        "version": "5.4.198"
+        "sha256": "1f15al9g4cd17fm43im5rqqrbz1cqhz2hq5ycpqvwa02pydprsga",
+        "version": "5.4.200"
    }
 }
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "4.14.283";
+  version = "4.14.284";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "191gybhnck4mh9yjzwgv1crrbxjc90p12bcif721rbs6xzszmxzh";
+    sha256 = "1f7bidisa6b4ff0mgn66h1nmf94j5mcx4wnkwnd9f49im6hcqllq";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "4.19.247";
+  version = "4.19.248";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "136gmsmvgb2nid4by2ld003w06lsr7hgn9ajx0wfziag7pfnjsv2";
+    sha256 = "0cdflfk6l13slw1cawpkhpjzbbnffcbyffrh29p9jg73pdqx23y4";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@ -1,12 +1,12 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:

 buildLinux (args // rec {
-  version = "4.9.318";
+  version = "4.9.319";
  extraMeta.branch = "4.9";
  extraMeta.broken = stdenv.isAarch64;

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "09czsc0ynyw068yczs9qx4cliqmrh5hvz93c77lhh014wn02pba4";
+    sha256 = "11242bn95k51knm9da7xk7r10vk7iji06wix1cq4g5nzldrfp9sp";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "5.10.122";
+  version = "5.10.124";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0h0gfi3p1dd4p8xxklrl8sc3rv4xd08q7nv0i4m166w8188v62wj";
+    sha256 = "0yz3yw02b6b1sq800r46x5b3dagswb6z4clrfq485c4669sb2ipc";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "5.15.47";
+  version = "5.15.49";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1700js21yimx8rz4bsglszry564l2ycmmcr36rdqspzbmlx5w8wb";
+    sha256 = "1p2r02h2z0j34hpkp3kr4741pr15ii72b94zllravx27pa9phj9j";
  };
 } // (args.argsOverride or { }))
--- a/pkgs/os-specific/linux/kernel/linux-5.17.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.17.nix
@ -1,18 +0,0 @@
-{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, modDirVersionArg ? null, ... } @ args:
-
-with lib;
-
-buildLinux (args // rec {
-  version = "5.17.15";
-
-  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
-
-  # branchVersion needs to be x.y
-  extraMeta.branch = versions.majorMinor version;
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0a5n1lb43nhnhwjwclkk3dqp2nxsx5ny7zfl8idvzshf94m9472a";
-  };
-} // (args.argsOverride or { }))
--- a/pkgs/os-specific/linux/kernel/linux-5.18.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.18.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "5.18.4";
+  version = "5.18.6";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1pcjjiwal8jr07n5bzg6clcmm20gvmvqgxl8k46npibrdx3r6wab";
+    sha256 = "0y1l2cgn8rak1050fn65a9xnapqyfq2dv8bijl150y44g6g2l72f";
  };
 } // (args.argsOverride or { }))
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "5.4.198";
+  version = "5.4.200";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0wvscr5wia2xdiqfxxdwl8kxf1s085qdj5h4423mraj7dh6l0ihh";
+    sha256 = "1f15al9g4cd17fm43im5rqqrbz1cqhz2hq5ycpqvwa02pydprsga";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
    url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "18777";
-    sha256 = "0ycg799pdi3rarkdgrrxcfjl15n8i24d9zc54xhg79wpgxcv39n3";
+    rev = "18798";
+    sha256 = "04mxzf8k3g65yw73da9fgk27hraf69239m5757fsr5a6pj88z6lb";
  }
 , ...
 }:
--- a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
@ -17,6 +17,7 @@
    extraMeta = {
      branch = "master";
      maintainers = with lib.maintainers; [ davidak Madouura ];
+      broken = true;
    };
  } // argsOverride;

--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@ -16,7 +16,7 @@
 , enablePython ? true

 # for determining the latest compatible linuxPackages
-, linuxPackages_5_17 ? pkgs.linuxKernel.packages.linux_5_17
+, linuxPackages_5_15 ? pkgs.linuxKernel.packages.linux_5_15
 }:

 let
@ -217,7 +217,7 @@ in {
  zfsStable = common {
    # check the release notes for compatible kernels
    kernelCompatible = kernel.kernelOlder "5.18";
-    latestCompatibleLinuxPackages = linuxPackages_5_17;
+    latestCompatibleLinuxPackages = linuxPackages_5_15;

    # this package should point to the latest release.
    version = "2.1.4";
@ -228,7 +228,7 @@ in {
  zfsUnstable = common {
    # check the release notes for compatible kernels
    kernelCompatible = kernel.kernelOlder "5.18";
-    latestCompatibleLinuxPackages = linuxPackages_5_17;
+    latestCompatibleLinuxPackages = linuxPackages_5_15;

    # this package should point to a version / git revision compatible with the latest kernel release
    # IMPORTANT: Always use a tagged release candidate or commits from the
--- a/pkgs/tools/misc/qjoypad/default.nix
+++ b/pkgs/tools/misc/qjoypad/default.nix
@ -1,21 +1,19 @@
-{ lib, stdenv, fetchurl, pkg-config, libX11, libXtst, qt4 }:
-stdenv.mkDerivation rec {
+{ lib, mkDerivation, fetchFromGitHub, pkg-config, cmake, libX11, libXtst, qtbase, qttools, qtx11extras }:
+mkDerivation rec {
  pname = "qjoypad";
-  version = "4.1.0";
-  src = fetchurl {
-    url = "mirror://sourceforge/qjoypad/qjoypad-${version}.tar.gz";
-    sha256 = "1jlm7i26nfp185xrl41kz5z6fgvyj51bjpz48cg27xx64y40iamm";
+  version = "4.3.1";
+
+  src = fetchFromGitHub {
+    owner = "panzi";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256:1w26ddxb1xirb7qjf7kv9llxzjhbhcb7warnxbx41qhbni46g26y";
  };
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ libX11 libXtst qt4 ];
-  NIX_LDFLAGS = "-lX11";
-  patchPhase = ''
-    cd src
-    substituteInPlace config --replace /bin/bash ${stdenv.shell}
-    mkdir -p $out
-    export NIX_LDFLAGS="$NIX_LDFLAGS -rpath ${libX11}/lib"
-  '';
-  meta = {
+
+  nativeBuildInputs = [ pkg-config cmake ];
+  buildInputs = [ libX11 libXtst qtbase qttools qtx11extras ];
+
+  meta = with lib; {
    description = "A program that lets you use gaming devices anywhere";
    longDescription = ''
      A simple Linux/QT program that lets you use your gaming devices
@ -33,9 +31,9 @@ stdenv.mkDerivation rec {
      of gaming devices in Linux, and makes the Linux gaming
      experience just a little bit nicer.
    '';
-    homepage = "http://qjoypad.sourceforge.net";
+    homepage = "https://github.com/panzi/qjoypad/";
    license = lib.licenses.gpl2;
-    maintainers = with lib.maintainers; [ astsmtl ];
-    platforms = with lib.platforms; linux;
+    maintainers = with maintainers; [ astsmtl ];
+    platforms = with platforms; linux;
  };
 }
--- a/pkgs/tools/networking/networkmanager/default.nix
+++ b/pkgs/tools/networking/networkmanager/default.nix
@ -119,6 +119,22 @@ stdenv.mkDerivation rec {
    # Meson does not support using different directories during build and
    # for installation like Autotools did with flags passed to make install.
    ./fix-install-paths.patch
+
+    (fetchpatch {
+      # Prevent downgrade to plain network on Enhanced Open profiles
+      url = "https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/commit/b7946e50acc0d20d31b0c1098fdadc2f105ba799.patch";
+      hash = "sha256-CdZiubfqhJQ5w4+s9O8C5WI9Ls/paONzDX4rX6yEmS0=";
+    })
+    (fetchpatch {
+      # Treat OWE BSSIDs as valid candidates for open profiles
+      url = "https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/commit/dd80cdcc1bd5e2535b8e4a1d1d0c62f1d3328a7c.patch";
+      hash = "sha256-QMZvWN3g8K+UH6y05+RkCmF+gHHU4pB+UXfU770AUis=";
+    })
+    (fetchpatch {
+      # Allow distinguishing pure OWE networks from those with transition mode enabled
+      url = "https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/commit/13ea8d2e7dddd8279c82230594cea533ca349dd3.patch";
+      hash = "sha256-BiINGzX/Zp8pwdbMiDScrZvrHtH7coXkZm1HScFuFWA=";
+    })
  ];

  buildInputs = [
--- a/pkgs/tools/security/fail2ban/default.nix
+++ b/pkgs/tools/security/fail2ban/default.nix
@ -27,6 +27,12 @@ python3.pkgs.buildPythonApplication rec {
      url = "https://github.com/fail2ban/fail2ban/commit/5ac303df8a171f748330d4c645ccbf1c2c7f3497.patch";
      sha256 = "sha256-aozQJHwPcJTe/D/PLQzBk1YH3OAP6Qm7wO7cai5CVYI=";
    })
+    # fix use of MutableMapping with Python >= 3.10
+    # https://github.com/fail2ban/fail2ban/issues/3142
+    (fetchpatch {
+      url = "https://github.com/fail2ban/fail2ban/commit/294ec73f629d0e29cece3a1eb5dd60b6fccea41f.patch";
+      sha256 = "sha256-Eimm4xjBDYNn5QdTyMqGgT5EXsZdd/txxcWJojXlsFE=";
+    })
  ];

  preConfigure = ''
--- a/pkgs/tools/system/smartmontools/default.nix
+++ b/pkgs/tools/system/smartmontools/default.nix
@ -10,22 +10,22 @@
 }:

 let
-  dbrev = "5171";
-  drivedbBranch = "RELEASE_7_2_DRIVEDB";
+  dbrev = "5388";
+  drivedbBranch = "RELEASE_7_3_DRIVEDB";
  driverdb = fetchurl {
    url = "https://sourceforge.net/p/smartmontools/code/${dbrev}/tree/branches/${drivedbBranch}/smartmontools/drivedb.h?format=raw";
-    sha256 = "0vncr98xagbcfsxgfgxsip2qrl9q3y8va19qhv6yknlwbdfap4mn";
+    sha256 = "sha256-0dtLev4JjeHsS259+qOgg19rz4yjkeX4D3ooUgS4RTI=";
    name = "smartmontools-drivedb.h";
  };

 in
 stdenv.mkDerivation rec {
  pname = "smartmontools";
-  version = "7.2";
+  version = "7.3";

  src = fetchurl {
    url = "mirror://sourceforge/smartmontools/${pname}-${version}.tar.gz";
-    sha256 = "1mlc25sd5rgj5xmzcllci47inmfdw7cp185fday6hc9rwqkqmnaw";
+    sha256 = "sha256-pUT4gI0MWM+w50JMoYQcuFipdJIrA11QXU5MJIvjois=";
  };

  patches = [
--- a/pkgs/tools/text/mdbook/default.nix
+++ b/pkgs/tools/text/mdbook/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "mdbook";
-  version = "0.4.17";
+  version = "0.4.18";

  src = fetchFromGitHub {
    owner = "rust-lang";
    repo = "mdBook";
    rev = "v${version}";
-    sha256 = "sha256-08ccRiOBXYqueKfyi/Ry39O2xOXUKishgqhn6RdbvUE=";
+    sha256 = "sha256-lsryNrgjOGdugOhtkNbnYEreF0X1ywLVaFmKUXDf884=";
  };

-  cargoSha256 = "sha256-vXUjKpCGlHlBvXLtmGkFtHRxxZakiEzuNzReFGEl6dw=";
+  cargoSha256 = "sha256-l95nbp9PEgO97D1M/R9IB3Xfog6+DkZwyVY2DEl5mG4=";

  buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];

--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -9820,7 +9820,7 @@ with pkgs;

  qjournalctl = libsForQt5.callPackage ../applications/system/qjournalctl { };

-  qjoypad = callPackage ../tools/misc/qjoypad { };
+  qjoypad = libsForQt5.callPackage ../tools/misc/qjoypad { };

  qmk = callPackage ../tools/misc/qmk { };

@ -12830,6 +12830,9 @@ with pkgs;
    isl = if !stdenv.isDarwin then isl_0_11 else null;

    cloog = if !stdenv.isDarwin then cloog_0_18_0 else null;
+
+    # Build fails on Darwin with clang
+    stdenv = if stdenv.isDarwin then gccStdenv else stdenv;
  }));

  gcc6 = lowPrio (wrapCC (callPackage ../development/compilers/gcc/6 {
@ -13860,11 +13863,11 @@ with pkgs;
  buildRustCrateHelpers = callPackage ../build-support/rust/build-rust-crate/helpers.nix { };
  cratesIO = callPackage ../build-support/rust/crates-io.nix { };

-  cargo-web = callPackage ../development/tools/cargo-web {
+  cargo-web = callPackage ../development/tools/rust/cargo-web {
    inherit (darwin.apple_sdk.frameworks) CoreServices Security;
  };

-  cargo-flamegraph = callPackage ../development/tools/cargo-flamegraph {
+  cargo-flamegraph = callPackage ../development/tools/rust/cargo-flamegraph {
    inherit (darwin.apple_sdk.frameworks) Security;
    inherit (linuxPackages) perf;
  };
@ -13873,9 +13876,9 @@ with pkgs;

  defaultCrateOverrides = callPackage ../build-support/rust/default-crate-overrides.nix { };

-  cargo-about = callPackage ../tools/package-management/cargo-about { };
+  cargo-about = callPackage ../development/tools/rust/cargo-about { };
  cargo-all-features = callPackage ../development/tools/rust/cargo-all-features { };
-  cargo-audit = callPackage ../tools/package-management/cargo-audit {
+  cargo-audit = callPackage ../development/tools/rust/cargo-audit {
    inherit (darwin.apple_sdk.frameworks) Security;
  };
  cargo-bisect-rustc = callPackage ../development/tools/rust/cargo-bisect-rustc {
@ -13889,29 +13892,29 @@ with pkgs;
  cargo-deadlinks = callPackage ../development/tools/rust/cargo-deadlinks {
    inherit (darwin.apple_sdk.frameworks) Security;
  };
-  cargo-deb = callPackage ../tools/package-management/cargo-deb {
+  cargo-deb = callPackage ../development/tools/rust/cargo-deb {
    inherit (darwin.apple_sdk.frameworks) Security;
  };
-  cargo-deps = callPackage ../tools/package-management/cargo-deps { };
-  cargo-download = callPackage ../tools/package-management/cargo-download { };
-  cargo-edit = callPackage ../tools/package-management/cargo-edit {
+  cargo-deps = callPackage ../development/tools/rust/cargo-deps { };
+  cargo-download = callPackage ../development/tools/rust/cargo-download { };
+  cargo-edit = callPackage ../development/tools/rust/cargo-edit {
    inherit (darwin.apple_sdk.frameworks) Security;
  };
-  cargo-kcov = callPackage ../tools/package-management/cargo-kcov { };
-  cargo-graph = callPackage ../tools/package-management/cargo-graph { };
-  cargo-license = callPackage ../tools/package-management/cargo-license { };
+  cargo-kcov = callPackage ../development/tools/rust/cargo-kcov { };
+  cargo-graph = callPackage ../development/tools/rust/cargo-graph { };
+  cargo-license = callPackage ../development/tools/rust/cargo-license { };
  cargo-llvm-lines = callPackage ../development/tools/rust/cargo-llvm-lines { };
-  cargo-outdated = callPackage ../tools/package-management/cargo-outdated {
+  cargo-outdated = callPackage ../development/tools/rust/cargo-outdated {
    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
  };
-  cargo-release = callPackage ../tools/package-management/cargo-release {
+  cargo-release = callPackage ../development/tools/rust/cargo-release {
    inherit (darwin.apple_sdk.frameworks) Security;
  };
  cargo-rr = callPackage ../development/tools/rust/cargo-rr { };
  cargo-tarpaulin = callPackage ../development/tools/analysis/cargo-tarpaulin {
    inherit (darwin.apple_sdk.frameworks) Security;
  };
-  cargo-update = callPackage ../tools/package-management/cargo-update {
+  cargo-update = callPackage ../development/tools/rust/cargo-update {
    inherit (darwin.apple_sdk.frameworks) Security;
  };

@ -23481,8 +23484,6 @@ with pkgs;
  linux_5_10_hardened = linuxKernel.kernels.linux_5_10_hardened;
  linuxPackages_5_15_hardened = linuxKernel.packages.linux_5_15_hardened;
  linux_5_15_hardened = linuxKernel.kernels.linux_5_15_hardened;
-  linuxPackages_5_17_hardened = linuxKernel.packages.linux_5_17_hardened;
-  linux_5_17_hardened = linuxKernel.kernels.linux_5_17_hardened;
  linuxPackages_5_18_hardened = linuxKernel.packages.linux_5_18_hardened;
  linux_5_18_hardened = linuxKernel.kernels.linux_5_18_hardened;

@ -33663,7 +33664,7 @@ with pkgs;
  z3 = z3_4_8;
  z3_4_4_0 = callPackage ../applications/science/logic/z3/4.4.0.nix {
    python = python2;
-    stdenv = gcc49Stdenv;
+    stdenv = if stdenv.isDarwin then stdenv else gcc49Stdenv;
  };
  z3-tptp = callPackage ../applications/science/logic/z3/tptp.nix {};

--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@ -162,12 +162,7 @@ in {

    linux_5_16 = throw "linux 5.16 was removed because it has reached its end of life upstream";

-    linux_5_17 = callPackage ../os-specific/linux/kernel/linux-5.17.nix {
-      kernelPatches = [
-        kernelPatches.bridge_stp_helper
-        kernelPatches.request_key_helper
-      ];
-    };
+    linux_5_17 = throw "linux 5.17 was removed because it has reached its end of life upstream";

    linux_5_18 = callPackage ../os-specific/linux/kernel/linux-5.18.nix {
      kernelPatches = [
@ -189,7 +184,7 @@ in {
       else testing;

    linux_testing_bcachefs = callPackage ../os-specific/linux/kernel/linux-testing-bcachefs.nix rec {
-      kernel = linux_5_17;
+      kernel = linux_5_18;
      kernelPatches = kernel.kernelPatches;
   };

@ -243,7 +238,6 @@ in {
    linux_5_4_hardened = hardenedKernelFor kernels.linux_5_4 { };
    linux_5_10_hardened = hardenedKernelFor kernels.linux_5_10 { };
    linux_5_15_hardened = hardenedKernelFor kernels.linux_5_15 { };
-    linux_5_17_hardened = hardenedKernelFor kernels.linux_5_17 { };
    linux_5_18_hardened = hardenedKernelFor kernels.linux_5_18 { };

  }));
@ -517,7 +511,7 @@ in {
    linux_5_10 = recurseIntoAttrs (packagesFor kernels.linux_5_10);
    linux_5_15 = recurseIntoAttrs (packagesFor kernels.linux_5_15);
    linux_5_16 = throw "linux 5.16 was removed because it reached its end of life upstream"; # Added 2022-04-23
-    linux_5_17 = recurseIntoAttrs (packagesFor kernels.linux_5_17);
+    linux_5_17 = throw "linux 5.17 was removed because it reached its end of life upstream"; # Added 2022-06-23
    linux_5_18 = recurseIntoAttrs (packagesFor kernels.linux_5_18);
  };

@ -557,7 +551,6 @@ in {
    });
    linux_5_10_hardened = recurseIntoAttrs (hardenedPackagesFor kernels.linux_5_10 { });
    linux_5_15_hardened = recurseIntoAttrs (hardenedPackagesFor kernels.linux_5_15 { });
-    linux_5_17_hardened = recurseIntoAttrs (hardenedPackagesFor kernels.linux_5_17 { });
    linux_5_18_hardened = recurseIntoAttrs (hardenedPackagesFor kernels.linux_5_18 { });

    linux_zen = recurseIntoAttrs (packagesFor kernels.linux_zen);