Merge master into staging-next

2021-08-18 18:01:03 +00:00 · 2021-08-18 18:01:03 +00:00 · 57cedea2a2
commit 57cedea2a2
parent 90d220f41f 34142f1d9a
43 changed files with 1227 additions and 1001 deletions
--- a/lib/default.nix
+++ b/lib/default.nix
@ -115,7 +115,7 @@ let
      mergeModules' mergeOptionDecls evalOptionValue mergeDefinitions
      pushDownProperties dischargeProperties filterOverrides
      sortProperties fixupOptionType mkIf mkAssert mkMerge mkOverride
-      mkOptionDefault mkDefault mkForce mkVMOverride
+      mkOptionDefault mkDefault mkImageMediaOverride mkForce mkVMOverride
      mkFixStrictness mkOrder mkBefore mkAfter mkAliasDefinitions
      mkAliasAndWrapDefinitions fixMergeModules mkRemovedOptionModule
      mkRenamedOptionModule mkMergedOptionModule mkChangedOptionModule
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@ -186,6 +186,90 @@
  <section xml:id="sec-release-21.11-incompatibilities">
    <title>Backward Incompatibilities</title>
    <itemizedlist>
+      <listitem>
+        <para>
+          The <literal>paperless</literal> module and package have been
+          removed. All users should migrate to the successor
+          <literal>paperless-ng</literal> instead. The Paperless project
+          <link xlink:href="https://github.com/the-paperless-project/paperless/commit/9b0063c9731f7c5f65b1852cb8caff97f5e40ba4">has
+          been archived</link> and advises all users to use
+          <literal>paperless-ng</literal> instead.
+        </para>
+        <para>
+          Users can use the <literal>services.paperless-ng</literal>
+          module as a replacement while noting the following
+          incompatibilities:
+        </para>
+        <itemizedlist spacing="compact">
+          <listitem>
+            <para>
+              <literal>services.paperless.ocrLanguages</literal> has no
+              replacement. Users should migrate to
+              <link xlink:href="options.html#opt-services.paperless-ng.extraConfig"><literal>services.paperless-ng.extraConfig</literal></link>
+              instead:
+            </para>
+          </listitem>
+        </itemizedlist>
+        <programlisting language="bash">
+{
+  services.paperless-ng.extraConfig = {
+    # Provide languages as ISO 639-2 codes
+    # separated by a plus (+) sign.
+    # https://en.wikipedia.org/wiki/List_of_ISO_639-2_codes
+    PAPERLESS_OCR_LANGUAGE = &quot;deu+eng+jpn&quot;; # German &amp; English &amp; Japanse
+  };
+}
+</programlisting>
+        <itemizedlist>
+          <listitem>
+            <para>
+              If you previously specified
+              <literal>PAPERLESS_CONSUME_MAIL_*</literal> settings in
+              <literal>services.paperless.extraConfig</literal> you
+              should remove those options now. You now
+              <emphasis>must</emphasis> define those settings in the
+              admin interface of paperless-ng.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              Option <literal>services.paperless.manage</literal> no
+              longer exists. Use the script at
+              <literal>${services.paperless-ng.dataDir}/paperless-ng-manage</literal>
+              instead. Note that this script only exists after the
+              <literal>paperless-ng</literal> service has been started
+              at least once.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              After switching to the new system configuration you should
+              run the Django management command to reindex your
+              documents and optionally create a user, if you don’t have
+              one already.
+            </para>
+            <para>
+              To do so, enter the data directory (the value of
+              <literal>services.paperless-ng.dataDir</literal>,
+              <literal>/var/lib/paperless</literal> by default), switch
+              to the paperless user and execute the management command
+              like below:
+            </para>
+            <programlisting>
+$ cd /var/lib/paperless
+$ su paperless -s /bin/sh
+$ ./paperless-ng-manage document_index reindex
+# if not already done create a user account, paperless-ng requires a login
+$ ./paperless-ng-manage createsuperuser
+Username (leave blank to use 'paperless'): my-user-name
+Email address: me@example.com
+Password: **********
+Password (again): **********
+Superuser created successfully.
+</programlisting>
+          </listitem>
+        </itemizedlist>
+      </listitem>
      <listitem>
        <para>
          The <literal>staticjinja</literal> package has been upgraded
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@ -58,6 +58,53 @@ subsonic-compatible api. Available as [navidrome](#opt-services.navidrome.enable

 ## Backward Incompatibilities {#sec-release-21.11-incompatibilities}

+- The `paperless` module and package have been removed. All users should migrate to the
+  successor `paperless-ng` instead. The Paperless project [has been
+  archived](https://github.com/the-paperless-project/paperless/commit/9b0063c9731f7c5f65b1852cb8caff97f5e40ba4)
+  and advises all users to use `paperless-ng` instead.
+
+  Users can use the `services.paperless-ng` module as a replacement while noting the following incompatibilities:
+    - `services.paperless.ocrLanguages` has no replacement. Users should migrate to [`services.paperless-ng.extraConfig`](options.html#opt-services.paperless-ng.extraConfig) instead:
+     ```nix
+     {
+       services.paperless-ng.extraConfig = {
+         # Provide languages as ISO 639-2 codes
+         # separated by a plus (+) sign.
+         # https://en.wikipedia.org/wiki/List_of_ISO_639-2_codes
+         PAPERLESS_OCR_LANGUAGE = "deu+eng+jpn"; # German & English & Japanse
+       };
+     }
+     ```
+
+    - If you previously specified `PAPERLESS_CONSUME_MAIL_*` settings in
+      `services.paperless.extraConfig` you should remove those options now. You
+      now *must* define those settings in the admin interface of paperless-ng.
+
+    - Option `services.paperless.manage` no longer exists.
+      Use the script at `${services.paperless-ng.dataDir}/paperless-ng-manage` instead.
+      Note that this script only exists after the `paperless-ng` service has been
+      started at least once.
+
+    - After switching to the new system configuration you should run the Django
+      management command to reindex your documents and optionally create a user,
+      if you don't have one already.
+
+      To do so, enter the data directory (the value of
+      `services.paperless-ng.dataDir`, `/var/lib/paperless` by default), switch
+      to the paperless user and execute the management command like below:
+      ```
+      $ cd /var/lib/paperless
+      $ su paperless -s /bin/sh
+      $ ./paperless-ng-manage document_index reindex
+      # if not already done create a user account, paperless-ng requires a login
+      $ ./paperless-ng-manage createsuperuser
+      Username (leave blank to use 'paperless'): my-user-name
+      Email address: me@example.com
+      Password: **********
+      Password (again): **********
+      Superuser created successfully.
+      ```
+
 - The `staticjinja` package has been upgraded from 1.0.4 to 3.0.1

 - The `erigon` ethereum node has moved to a new database format in `2021-05-04`, and requires a full resync
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -551,7 +551,7 @@
  ./services/misc/ombi.nix
  ./services/misc/osrm.nix
  ./services/misc/packagekit.nix
-  ./services/misc/paperless.nix
+  ./services/misc/paperless-ng.nix
  ./services/misc/parsoid.nix
  ./services/misc/plex.nix
  ./services/misc/plikd.nix
--- a/nixos/modules/services/misc/paperless-ng.nix
+++ b/nixos/modules/services/misc/paperless-ng.nix
@ -0,0 +1,304 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+let
+  cfg = config.services.paperless-ng;
+
+  defaultUser = "paperless";
+
+  env = {
+    PAPERLESS_DATA_DIR = cfg.dataDir;
+    PAPERLESS_MEDIA_ROOT = cfg.mediaDir;
+    PAPERLESS_CONSUMPTION_DIR = cfg.consumptionDir;
+    GUNICORN_CMD_ARGS = "--bind=${cfg.address}:${toString cfg.port}";
+  } // lib.mapAttrs (_: toString) cfg.extraConfig;
+
+  manage = let
+    setupEnv = lib.concatStringsSep "\n" (mapAttrsToList (name: val: "export ${name}=\"${val}\"") env);
+  in pkgs.writeShellScript "manage" ''
+    ${setupEnv}
+    exec ${cfg.package}/bin/paperless-ng "$@"
+  '';
+
+  # Secure the services
+  defaultServiceConfig = {
+    TemporaryFileSystem = "/:ro";
+    BindReadOnlyPaths = [
+      "/nix/store"
+      "-/etc/resolv.conf"
+      "-/etc/nsswitch.conf"
+      "-/etc/hosts"
+      "-/etc/localtime"
+    ];
+    BindPaths = [
+      cfg.consumptionDir
+      cfg.dataDir
+      cfg.mediaDir
+    ];
+    CapabilityBoundingSet = "";
+    # ProtectClock adds DeviceAllow=char-rtc r
+    DeviceAllow = "";
+    LockPersonality = true;
+    MemoryDenyWriteExecute = true;
+    NoNewPrivileges = true;
+    PrivateDevices = true;
+    PrivateMounts = true;
+    # Needs to connect to redis
+    # PrivateNetwork = true;
+    PrivateTmp = true;
+    PrivateUsers = true;
+    ProcSubset = "pid";
+    ProtectClock = true;
+    # Breaks if the home dir of the user is in /home
+    # Also does not add much value in combination with the TemporaryFileSystem.
+    # ProtectHome = true;
+    ProtectHostname = true;
+    # Would re-mount paths ignored by temporary root
+    #ProtectSystem = "strict";
+    ProtectControlGroups = true;
+    ProtectKernelLogs = true;
+    ProtectKernelModules = true;
+    ProtectKernelTunables = true;
+    ProtectProc = "invisible";
+    RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+    RestrictNamespaces = true;
+    RestrictRealtime = true;
+    RestrictSUIDSGID = true;
+    SystemCallArchitectures = "native";
+    SystemCallFilter = [ "@system-service" "~@privileged @resources @setuid @keyring" ];
+    # Does not work well with the temporary root
+    #UMask = "0066";
+  };
+in
+{
+  meta.maintainers = with maintainers; [ earvstedt Flakebi ];
+
+  imports = [
+    (mkRemovedOptionModule [ "services" "paperless"] ''
+      The paperless module has been removed as the upstream project died.
+      Users should migrate to the paperless-ng module (services.paperless-ng).
+      More information can be found in the NixOS 21.11 release notes.
+    '')
+  ];
+
+  options.services.paperless-ng = {
+    enable = mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Enable Paperless-ng.
+
+        When started, the Paperless database is automatically created if it doesn't
+        exist and updated if the Paperless package has changed.
+        Both tasks are achieved by running a Django migration.
+
+        A script to manage the Paperless instance (by wrapping Django's manage.py) is linked to
+        <literal>''${dataDir}/paperless-ng-manage</literal>.
+      '';
+    };
+
+    dataDir = mkOption {
+      type = types.str;
+      default = "/var/lib/paperless";
+      description = "Directory to store the Paperless data.";
+    };
+
+    mediaDir = mkOption {
+      type = types.str;
+      default = "${cfg.dataDir}/media";
+      defaultText = "\${dataDir}/consume";
+      description = "Directory to store the Paperless documents.";
+    };
+
+    consumptionDir = mkOption {
+      type = types.str;
+      default = "${cfg.dataDir}/consume";
+      defaultText = "\${dataDir}/consume";
+      description = "Directory from which new documents are imported.";
+    };
+
+    consumptionDirIsPublic = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Whether all users can write to the consumption dir.";
+    };
+
+    passwordFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/run/keys/paperless-ng-password";
+      description = ''
+        A file containing the superuser password.
+
+        A superuser is required to access the web interface.
+        If unset, you can create a superuser manually by running
+        <literal>''${dataDir}/paperless-ng-manage createsuperuser</literal>.
+
+        The default superuser name is <literal>admin</literal>. To change it, set
+        option <option>extraConfig.PAPERLESS_ADMIN_USER</option>.
+        WARNING: When changing the superuser name after the initial setup, the old superuser
+        will continue to exist.
+
+        To disable login for the web interface, set the following:
+        <literal>extraConfig.PAPERLESS_AUTO_LOGIN_USERNAME = "admin";</literal>.
+        WARNING: Only use this on a trusted system without internet access to Paperless.
+      '';
+    };
+
+    address = mkOption {
+      type = types.str;
+      default = "localhost";
+      description = "Web interface address.";
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 28981;
+      description = "Web interface port.";
+    };
+
+    extraConfig = mkOption {
+      type = types.attrs;
+      default = {};
+      description = ''
+        Extra paperless-ng config options.
+
+        See <link xlink:href="https://paperless-ng.readthedocs.io/en/latest/configuration.html">the documentation</link>
+        for available options.
+      '';
+      example = literalExample ''
+        {
+          PAPERLESS_OCR_LANGUAGE = "deu+eng";
+        }
+      '';
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = defaultUser;
+      description = "User under which Paperless runs.";
+    };
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.paperless-ng;
+      defaultText = "pkgs.paperless-ng";
+      description = "The Paperless package to use.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # Enable redis if no special url is set
+    services.redis.enable = mkIf (!hasAttr "PAPERLESS_REDIS" env) true;
+
+    systemd.tmpfiles.rules = [
+      "d '${cfg.dataDir}' - ${cfg.user} ${config.users.users.${cfg.user}.group} - -"
+      "d '${cfg.mediaDir}' - ${cfg.user} ${config.users.users.${cfg.user}.group} - -"
+      (if cfg.consumptionDirIsPublic then
+        "d '${cfg.consumptionDir}' 777 - - - -"
+      else
+        "d '${cfg.consumptionDir}' - ${cfg.user} ${config.users.users.${cfg.user}.group} - -"
+      )
+    ];
+
+    systemd.services.paperless-ng-server = {
+      description = "Paperless document server";
+      serviceConfig = defaultServiceConfig // {
+        User = cfg.user;
+        ExecStart = "${cfg.package}/bin/paperless-ng qcluster";
+        Restart = "on-failure";
+      };
+      environment = env;
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "paperless-ng-consumer.service" "paperless-ng-web.service" ];
+
+      preStart = ''
+        ln -sf ${manage} ${cfg.dataDir}/paperless-ng-manage
+
+        # Auto-migrate on first run or if the package has changed
+        versionFile="${cfg.dataDir}/src-version"
+        if [[ $(cat "$versionFile" 2>/dev/null) != ${cfg.package} ]]; then
+          ${cfg.package}/bin/paperless-ng migrate
+          echo ${cfg.package} > "$versionFile"
+        fi
+      ''
+      + optionalString (cfg.passwordFile != null) ''
+        export PAPERLESS_ADMIN_USER="''${PAPERLESS_ADMIN_USER:-admin}"
+        export PAPERLESS_ADMIN_PASSWORD=$(cat "${cfg.dataDir}/superuser-password")
+        superuserState="$PAPERLESS_ADMIN_USER:$PAPERLESS_ADMIN_PASSWORD"
+        superuserStateFile="${cfg.dataDir}/superuser-state"
+
+        if [[ $(cat "$superuserStateFile" 2>/dev/null) != $superuserState ]]; then
+          ${cfg.package}/bin/paperless-ng manage_superuser
+          echo "$superuserState" > "$superuserStateFile"
+        fi
+      '';
+    };
+
+    # Password copying can't be implemented as a privileged preStart script
+    # in 'paperless-ng-server' because 'defaultServiceConfig' limits the filesystem
+    # paths accessible by the service.
+    systemd.services.paperless-ng-copy-password = mkIf (cfg.passwordFile != null) {
+      requiredBy = [ "paperless-ng-server.service" ];
+      before = [ "paperless-ng-server.service" ];
+      serviceConfig = {
+        ExecStart = ''
+          ${pkgs.coreutils}/bin/install --mode 600 --owner '${cfg.user}' --compare \
+            '${cfg.passwordFile}' '${cfg.dataDir}/superuser-password'
+        '';
+        Type = "oneshot";
+      };
+    };
+
+    systemd.services.paperless-ng-consumer = {
+      description = "Paperless document consumer";
+      serviceConfig = defaultServiceConfig // {
+        User = cfg.user;
+        ExecStart = "${cfg.package}/bin/paperless-ng document_consumer";
+        Restart = "on-failure";
+      };
+      environment = env;
+      # Bind to `paperless-ng-server` so that the consumer never runs
+      # during migrations
+      bindsTo = [ "paperless-ng-server.service" ];
+      after = [ "paperless-ng-server.service" ];
+    };
+
+    systemd.services.paperless-ng-web = {
+      description = "Paperless web server";
+      serviceConfig = defaultServiceConfig // {
+        User = cfg.user;
+        ExecStart = ''
+          ${pkgs.python3Packages.gunicorn}/bin/gunicorn \
+            -c ${cfg.package}/lib/paperless-ng/gunicorn.conf.py paperless.asgi:application
+        '';
+        Restart = "on-failure";
+
+        AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+        CapabilityBoundingSet = "CAP_NET_BIND_SERVICE";
+        # gunicorn needs setuid
+        SystemCallFilter = defaultServiceConfig.SystemCallFilter ++ [ "@setuid" ];
+      };
+      environment = env // {
+        PATH = mkForce cfg.package.path;
+        PYTHONPATH = "${cfg.package.pythonPath}:${cfg.package}/lib/paperless-ng/src";
+      };
+      # Bind to `paperless-ng-server` so that the web server never runs
+      # during migrations
+      bindsTo = [ "paperless-ng-server.service" ];
+      after = [ "paperless-ng-server.service" ];
+    };
+
+    users = optionalAttrs (cfg.user == defaultUser) {
+      users.${defaultUser} = {
+        group = defaultUser;
+        uid = config.ids.uids.paperless;
+        home = cfg.dataDir;
+      };
+
+      groups.${defaultUser} = {
+        gid = config.ids.gids.paperless;
+      };
+    };
+  };
+}
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@ -1,183 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-with lib;
-let
-  cfg = config.services.paperless;
-
-  defaultUser = "paperless";
-
-  manage = cfg.package.withConfig {
-    config = {
-      PAPERLESS_CONSUMPTION_DIR = cfg.consumptionDir;
-      PAPERLESS_INLINE_DOC = "true";
-      PAPERLESS_DISABLE_LOGIN = "true";
-    } // cfg.extraConfig;
-    inherit (cfg) dataDir ocrLanguages;
-    paperlessPkg = cfg.package;
-  };
-in
-{
-  options.services.paperless = {
-    enable = mkOption {
-      type = lib.types.bool;
-      default = false;
-      description = ''
-        Enable Paperless.
-
-        When started, the Paperless database is automatically created if it doesn't
-        exist and updated if the Paperless package has changed.
-        Both tasks are achieved by running a Django migration.
-      '';
-    };
-
-    dataDir = mkOption {
-      type = types.str;
-      default = "/var/lib/paperless";
-      description = "Directory to store the Paperless data.";
-    };
-
-    consumptionDir = mkOption {
-      type = types.str;
-      default = "${cfg.dataDir}/consume";
-      defaultText = "\${dataDir}/consume";
-      description = "Directory from which new documents are imported.";
-    };
-
-    consumptionDirIsPublic = mkOption {
-      type = types.bool;
-      default = false;
-      description = "Whether all users can write to the consumption dir.";
-    };
-
-    ocrLanguages = mkOption {
-      type = with types; nullOr (listOf str);
-      default = null;
-      description = ''
-        Languages available for OCR via Tesseract, specified as
-        <literal>ISO 639-2/T</literal> language codes.
-        If unset, defaults to all available languages.
-      '';
-      example = [ "eng" "spa" "jpn" ];
-    };
-
-    address = mkOption {
-      type = types.str;
-      default = "localhost";
-      description = "Server listening address.";
-    };
-
-    port = mkOption {
-      type = types.port;
-      default = 28981;
-      description = "Server port to listen on.";
-    };
-
-    extraConfig = mkOption {
-      type = types.attrs;
-      default = {};
-      description = ''
-        Extra paperless config options.
-
-        The config values are evaluated as double-quoted Bash string literals.
-
-        See <literal>paperless-src/paperless.conf.example</literal> for available options.
-
-        To enable user authentication, set <literal>PAPERLESS_DISABLE_LOGIN = "false"</literal>
-        and run the shell command <literal>$dataDir/paperless-manage createsuperuser</literal>.
-
-        To define secret options without storing them in /nix/store, use the following pattern:
-        <literal>PAPERLESS_PASSPHRASE = "$(&lt; /etc/my_passphrase_file)"</literal>
-      '';
-      example = literalExample ''
-        {
-          PAPERLESS_OCR_LANGUAGE = "deu";
-        }
-      '';
-    };
-
-    user = mkOption {
-      type = types.str;
-      default = defaultUser;
-      description = "User under which Paperless runs.";
-    };
-
-    package = mkOption {
-      type = types.package;
-      default = pkgs.paperless;
-      defaultText = "pkgs.paperless";
-      description = "The Paperless package to use.";
-    };
-
-    manage = mkOption {
-      type = types.package;
-      readOnly = true;
-      default = manage;
-      description = ''
-        A script to manage the Paperless instance.
-        It wraps Django's manage.py and is also available at
-        <literal>$dataDir/manage-paperless</literal>
-      '';
-    };
-  };
-
-  config = mkIf cfg.enable {
-
-    systemd.tmpfiles.rules = [
-      "d '${cfg.dataDir}' - ${cfg.user} ${config.users.users.${cfg.user}.group} - -"
-    ] ++ (optional cfg.consumptionDirIsPublic
-      "d '${cfg.consumptionDir}' 777 - - - -"
-      # If the consumption dir is not created here, it's automatically created by
-      # 'manage' with the default permissions.
-    );
-
-    systemd.services.paperless-consumer = {
-      description = "Paperless document consumer";
-      serviceConfig = {
-        User = cfg.user;
-        ExecStart = "${manage} document_consumer";
-        Restart = "always";
-      };
-      after = [ "systemd-tmpfiles-setup.service" ];
-      wantedBy = [ "multi-user.target" ];
-      preStart = ''
-        if [[ $(readlink ${cfg.dataDir}/paperless-manage) != ${manage} ]]; then
-          ln -sf ${manage} ${cfg.dataDir}/paperless-manage
-        fi
-
-        ${manage.setupEnv}
-        # Auto-migrate on first run or if the package has changed
-        versionFile="$PAPERLESS_DBDIR/src-version"
-        if [[ $(cat "$versionFile" 2>/dev/null) != ${cfg.package} ]]; then
-          python $paperlessSrc/manage.py migrate
-          echo ${cfg.package} > "$versionFile"
-        fi
-      '';
-    };
-
-    systemd.services.paperless-server = {
-      description = "Paperless document server";
-      serviceConfig = {
-        User = cfg.user;
-        ExecStart = "${manage} runserver --noreload ${cfg.address}:${toString cfg.port}";
-        Restart = "always";
-      };
-      # Bind to `paperless-consumer` so that the server never runs
-      # during migrations
-      bindsTo = [ "paperless-consumer.service" ];
-      after = [ "paperless-consumer.service" ];
-      wantedBy = [ "multi-user.target" ];
-    };
-
-    users = optionalAttrs (cfg.user == defaultUser) {
-      users.${defaultUser} = {
-        group = defaultUser;
-        uid = config.ids.uids.paperless;
-        home = cfg.dataDir;
-      };
-
-      groups.${defaultUser} = {
-        gid = config.ids.gids.paperless;
-      };
-    };
-  };
-}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -336,7 +336,7 @@ in
  pam-oath-login = handleTest ./pam-oath-login.nix {};
  pam-u2f = handleTest ./pam-u2f.nix {};
  pantheon = handleTest ./pantheon.nix {};
-  paperless = handleTest ./paperless.nix {};
+  paperless-ng = handleTest ./paperless-ng.nix {};
  pdns-recursor = handleTest ./pdns-recursor.nix {};
  peerflix = handleTest ./peerflix.nix {};
  pgjwt = handleTest ./pgjwt.nix {};
--- a/nixos/tests/paperless-ng.nix
+++ b/nixos/tests/paperless-ng.nix
@ -0,0 +1,36 @@
+import ./make-test-python.nix ({ lib, ... }: {
+  name = "paperless-ng";
+  meta.maintainers = with lib.maintainers; [ earvstedt Flakebi ];
+
+  nodes.machine = { pkgs, ... }: {
+    environment.systemPackages = with pkgs; [ imagemagick jq ];
+    services.paperless-ng = {
+      enable = true;
+      passwordFile = builtins.toFile "password" "admin";
+    };
+    virtualisation.memorySize = 1024;
+  };
+
+  testScript = ''
+    machine.wait_for_unit("paperless-ng-consumer.service")
+
+    with subtest("Create test doc"):
+        machine.succeed(
+            "convert -size 400x40 xc:white -font 'DejaVu-Sans' -pointsize 20 -fill black "
+            "-annotate +5+20 'hello world 16-10-2005' /var/lib/paperless/consume/doc.png"
+        )
+
+    with subtest("Web interface gets ready"):
+        machine.wait_for_unit("paperless-ng-web.service")
+        # Wait until server accepts connections
+        machine.wait_until_succeeds("curl -fs localhost:28981")
+
+    with subtest("Document is consumed"):
+        machine.wait_until_succeeds(
+            "(($(curl -u admin:admin -fs localhost:28981/api/documents/ | jq .count) == 1))"
+        )
+        assert "2005-10-16" in machine.succeed(
+            "curl -u admin:admin -fs localhost:28981/api/documents/ | jq '.results | .[0] | .created'"
+        )
+  '';
+})
--- a/nixos/tests/paperless.nix
+++ b/nixos/tests/paperless.nix
@ -1,36 +0,0 @@
-import ./make-test-python.nix ({ lib, ... } : {
-  name = "paperless";
-  meta = with lib.maintainers; {
-    maintainers = [ earvstedt ];
-  };
-
-  machine = { pkgs, ... }: {
-    environment.systemPackages = with pkgs; [ imagemagick jq ];
-    services.paperless = {
-      enable = true;
-      ocrLanguages = [ "eng" ];
-    };
-  };
-
-  testScript = ''
-    machine.wait_for_unit("paperless-consumer.service")
-
-    # Create test doc
-    machine.succeed(
-        "convert -size 400x40 xc:white -font 'DejaVu-Sans' -pointsize 20 -fill black -annotate +5+20 'hello world 16-10-2005' /var/lib/paperless/consume/doc.png"
-    )
-
-    with subtest("Service gets ready"):
-        machine.wait_for_unit("paperless-server.service")
-        # Wait until server accepts connections
-        machine.wait_until_succeeds("curl -fs localhost:28981")
-
-    with subtest("Test document is consumed"):
-        machine.wait_until_succeeds(
-            "(($(curl -fs localhost:28981/api/documents/ | jq .count) == 1))"
-        )
-        assert "2005-10-16" in machine.succeed(
-            "curl -fs localhost:28981/api/documents/ | jq '.results | .[0] | .created'"
-        )
-  '';
-})
--- a/pkgs/applications/graphics/cloudcompare/default.nix
+++ b/pkgs/applications/graphics/cloudcompare/default.nix
@ -1,6 +1,7 @@
 { lib
 , mkDerivation
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , dxflib
 , eigen
@ -18,7 +19,7 @@

 mkDerivation rec {
  pname = "cloudcompare";
-  version = "2.11.2";
+  version = "2.11.2"; # Remove below patch with the next version bump.

  src = fetchFromGitHub {
    owner = "CloudCompare";
@ -33,6 +34,15 @@ mkDerivation rec {
    fetchSubmodules = true;
  };

+  patches = [
+    # TODO: Remove with next CloudCompare release (see https://github.com/CloudCompare/CloudCompare/pull/1478)
+    (fetchpatch {
+      name = "CloudCompare-fix-for-PDAL-2.3.0.patch";
+      url = "https://github.com/CloudCompare/CloudCompare/commit/f3038dcdeb0491c4a653c2ee6fb017326eb676a3.patch";
+      sha256 = "0ca5ry987mcgsdawz5yd4xhbsdb5k44qws30srxymzx2djvamwli";
+    })
+  ];
+
  nativeBuildInputs = [
    cmake
    eigen # header-only
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -7,10 +7,10 @@ in
 rec {
  firefox = common rec {
    pname = "firefox";
-    version = "91.0";
+    version = "91.0.1";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "a02486a3996570e0cc815e92c98890bca1d27ce0018c2ee3d4bff9a6e54dbc8f5926fea8b5864f208e15389d631685b2add1e4e9e51146e40224d16d5c02f730";
+      sha512 = "9388789bfe3dca596542b082d0eca7b1a6d1bbbf69eb97cc445f563d1a5ff0c9b530f3be02ee290805e311b0fcb392a4f5341e9f256d9764a787b43b232bdf67";
    };

    meta = {
@ -32,10 +32,10 @@ rec {

  firefox-esr-91 = common rec {
    pname = "firefox-esr";
-    version = "91.0esr";
+    version = "91.0.1esr";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "e518e1536094a1da44eb45b3b0f3adc1b5532f17da2dbcc994715419ec4fcec40574fdf633349a8e5de6382942f5706757a35f1b96b11de4754855b9cf7946ae";
+      sha512 = "79703b3ec615d10957350719b2c034df10fd47d140c3557cd7de665ef4430973b97c1906d5408ddaf8855c1424e87eb9b1b568322ad8fbdb956fca219a865d66";
    };

    meta = {
@ -57,10 +57,10 @@ rec {

  firefox-esr-78 = common rec {
    pname = "firefox-esr";
-    version = "78.12.0esr";
+    version = "78.13.0esr";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "646eb803e0d0e541773e3111708c7eaa85e784e4bae6e4a77dcecdc617ee29e2e349c9ef16ae7e663311734dd7491aebd904359124dda62672dbc18bfb608f0a";
+      sha512 = "78a5dc8713ab879ebfc3b8fd7a8219844d06f0d897342fdf9a11471633d98e148ff85cf10e561899df4910b94a33b57709b64788df4621a8c0b83eb9a7102cef";
    };

    meta = {
--- a/pkgs/applications/networking/cluster/stern/default.nix
+++ b/pkgs/applications/networking/cluster/stern/default.nix
@ -4,16 +4,16 @@ let isCrossBuild = stdenv.hostPlatform != stdenv.buildPlatform;
 in
 buildGoModule rec {
  pname = "stern";
-  version = "1.19.0";
+  version = "1.20.0";

  src = fetchFromGitHub {
    owner = "stern";
    repo = "stern";
    rev = "v${version}";
-    sha256 = "sha256-jgmURvc1did3YgtqWlAzFbWxc3jHHylOfCVOLeAC7V8=";
+    sha256 = "sha256-y8FkQBZHg4LYC8CmwQSg2oZjIrlY30tL/OkfnT+XsMM=";
  };

-  vendorSha256 = "sha256-p8WoFDwABXcO54WKP5bszoht2JdjHlRJjbG8cMyNo6A=";
+  vendorSha256 = "sha256-217OKXT072hpq4a6JEev4rSR8uUoPdDbOR7KUkhpM9E=";

  subPackages = [ "." ];

--- a/pkgs/applications/office/paperless-ng/default.nix
+++ b/pkgs/applications/office/paperless-ng/default.nix
@ -0,0 +1,197 @@
+{ lib
+, fetchurl
+, nixosTests
+, python3
+, ghostscript
+, imagemagick
+, jbig2enc
+, ocrmypdf
+, optipng
+, pngquant
+, qpdf
+, tesseract4
+, unpaper
+, liberation_ttf
+}:
+
+let
+  py = python3.override {
+    packageOverrides = self: super: {
+      django = super.django_3;
+      django-picklefield = super.django-picklefield.overrideAttrs (oldAttrs: {
+        # Checks do not pass with django 3
+        doInstallCheck = false;
+      });
+      # Avoid warning in django-q versions > 1.3.4
+      # https://github.com/jonaswinkler/paperless-ng/issues/857
+      # https://github.com/Koed00/django-q/issues/526
+      django-q = super.django-q.overridePythonAttrs (oldAttrs: rec {
+        version = "1.3.4";
+        src = super.fetchPypi {
+          inherit (oldAttrs) pname;
+          inherit version;
+          sha256 = "Uj1U3PG2YVLBtlj5FPAO07UYo0MqnezUiYc4yo274Q8=";
+        };
+      });
+    };
+  };
+
+  path = lib.makeBinPath [ ghostscript imagemagick jbig2enc optipng pngquant qpdf tesseract4 unpaper ];
+in
+py.pkgs.pythonPackages.buildPythonApplication rec {
+  pname = "paperless-ng";
+  version = "1.4.5";
+
+  src = fetchurl {
+    url = "https://github.com/jonaswinkler/paperless-ng/releases/download/ng-${version}/${pname}-${version}.tar.xz";
+    sha256 = "2PJb8j3oimlfiJ3gqjK6uTemzFdtAP2Mlm5RH09bx/E=";
+  };
+
+  format = "other";
+
+  # Make bind address configurable
+  # Fix tests with Pillow 8.3.1: https://github.com/jonaswinkler/paperless-ng/pull/1183
+  prePatch = ''
+    substituteInPlace gunicorn.conf.py --replace "bind = '0.0.0.0:8000'" ""
+    substituteInPlace src/paperless_tesseract/parsers.py --replace "return x" "return round(x)"
+  '';
+
+  propagatedBuildInputs = with py.pkgs.pythonPackages; [
+    aioredis
+    arrow
+    asgiref
+    async-timeout
+    attrs
+    autobahn
+    automat
+    blessed
+    certifi
+    cffi
+    channels-redis
+    channels
+    chardet
+    click
+    coloredlogs
+    concurrent-log-handler
+    constantly
+    cryptography
+    daphne
+    dateparser
+    django-cors-headers
+    django_extensions
+    django-filter
+    django-picklefield
+    django-q
+    django
+    djangorestframework
+    filelock
+    fuzzywuzzy
+    gunicorn
+    h11
+    hiredis
+    httptools
+    humanfriendly
+    hyperlink
+    idna
+    imap-tools
+    img2pdf
+    incremental
+    inotify-simple
+    inotifyrecursive
+    joblib
+    langdetect
+    lxml
+    msgpack
+    numpy
+    ocrmypdf
+    pathvalidate
+    pdfminer
+    pikepdf
+    pillow
+    pluggy
+    portalocker
+    psycopg2
+    pyasn1-modules
+    pyasn1
+    pycparser
+    pyopenssl
+    python-dateutil
+    python-dotenv
+    python-gnupg
+    python-Levenshtein
+    python_magic
+    pytz
+    pyyaml
+    redis
+    regex
+    reportlab
+    requests
+    scikit-learn
+    scipy
+    service-identity
+    six
+    sortedcontainers
+    sqlparse
+    threadpoolctl
+    tika
+    tqdm
+    twisted.extras.tls
+    txaio
+    tzlocal
+    urllib3
+    uvicorn
+    uvloop
+    watchdog
+    watchgod
+    wcwidth
+    websockets
+    whitenoise
+    whoosh
+    zope_interface
+  ];
+
+  doCheck = true;
+  checkInputs = with py.pkgs.pythonPackages; [
+    pytest
+    pytest-cov
+    pytest-django
+    pytest-env
+    pytest-sugar
+    pytest-xdist
+    factory_boy
+  ];
+
+  # The tests require:
+  # - PATH with runtime binaries
+  # - A temporary HOME directory for gnupg
+  # - XDG_DATA_DIRS with test-specific fonts
+  checkPhase = ''
+    pushd src
+    PATH="${path}:$PATH" HOME=$(mktemp -d) XDG_DATA_DIRS="${liberation_ttf}/share:$XDG_DATA_DIRS" pytest
+    popd
+  '';
+
+  installPhase = ''
+    mkdir -p $out/lib
+    cp -r . $out/lib/paperless-ng
+    chmod +x $out/lib/paperless-ng/src/manage.py
+    makeWrapper $out/lib/paperless-ng/src/manage.py $out/bin/paperless-ng \
+      --prefix PYTHONPATH : "$PYTHONPATH" \
+      --prefix PATH : "${path}"
+  '';
+
+  passthru = {
+    # PYTHONPATH of all dependencies used by the package
+    pythonPath = python3.pkgs.makePythonPath propagatedBuildInputs;
+    inherit path;
+
+    tests = { inherit (nixosTests) paperless-ng; };
+  };
+
+  meta = with lib; {
+    description = "A supercharged version of paperless: scan, index, and archive all of your physical documents";
+    homepage = "https://paperless-ng.readthedocs.io/en/latest/";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ earvstedt Flakebi ];
+  };
+}
--- a/pkgs/applications/office/paperless/default.nix
+++ b/pkgs/applications/office/paperless/default.nix
@ -1,168 +0,0 @@
-{ stdenv
-, lib
-, fetchFromGitHub
-, makeWrapper
-, callPackage
-
-, python3
-, imagemagick
-, ghostscript
-, optipng
-, tesseract
-, unpaper
-}:
-
-## Usage
-
-# ${paperless}/bin/paperless wraps manage.py
-
-# ${paperless}/share/paperless/setup-env.sh can be sourced from a
-# shell script to setup a Paperless environment
-
-# paperless.withConfig is a convenience function to setup a
-# configured Paperless instance. (See ./withConfig.nix)
-
-# For WSGI with gunicorn, use a shell script like this:
-# let
-#   pythonEnv = paperless.python.withPackages (ps: paperless.runtimePackages ++ [ ps.gunicorn ]);
-# in
-#   writers.writeBash "run-gunicorn" ''
-#     source ${paperless}/share/paperless/setup-env.sh
-#     PYTHONPATH=$paperlessSrc ${pythonEnv}/bin/gunicorn paperless.wsgi
-#   ''
-
-let
-  paperless = stdenv.mkDerivation rec {
-    pname = "paperless";
-    version = "2.7.0";
-
-    src = fetchFromGitHub {
-      owner = "the-paperless-project";
-      repo = "paperless";
-      rev = version;
-      sha256 = "0pkmyky1crjnsg7r0gfk0fadisfsgzlsq6afpz16wx4hp6yvkkf7";
-    };
-
-    nativeBuildInputs = [ makeWrapper ];
-
-    doCheck = true;
-    dontInstall = true;
-
-    pythonEnv      = python.withPackages (_: runtimePackages);
-    pythonCheckEnv = python.withPackages (_: (runtimePackages ++ checkPackages));
-
-    unpackPhase = ''
-      srcDir=$out/share/paperless
-      mkdir -p $srcDir
-      cp -r --no-preserve=mode $src/src/* $src/LICENSE $srcDir
-    '';
-
-    postPatch = ''
-      # django-cors-headers 3.x requires a scheme for allowed hosts
-      substituteInPlace $out/share/paperless/paperless/settings.py \
-        --replace "localhost:8080" "http://localhost:8080"
-    '';
-
-    buildPhase = let
-      # Paperless has explicit runtime checks that expect these binaries to be in PATH
-      extraBin = lib.makeBinPath [ imagemagick ghostscript optipng tesseract unpaper ];
-    in ''
-      ${python.interpreter} -m compileall $srcDir
-
-      makeWrapper $pythonEnv/bin/python $out/bin/paperless \
-        --set PATH ${extraBin} --add-flags $out/share/paperless/manage.py
-
-      # A shell snippet that can be sourced to setup a paperless env
-      cat > $out/share/paperless/setup-env.sh <<EOF
-      export PATH="$pythonEnv/bin:${extraBin}''${PATH:+:}$PATH"
-      export paperlessSrc=$out/share/paperless
-      EOF
-    '';
-
-    checkPhase = ''
-      source $out/share/paperless/setup-env.sh
-      tmpDir=$(realpath testsTmp)
-      mkdir $tmpDir
-      export HOME=$tmpDir
-      export PAPERLESS_MEDIADIR=$tmpDir
-      cd $paperlessSrc
-      # Prevent tests from writing to the derivation output
-      chmod -R -w $out
-      # Disable cache to silence a pytest warning ("could not create cache")
-      $pythonCheckEnv/bin/pytest -p no:cacheprovider
-    '';
-
-    passthru = {
-      withConfig = callPackage ./withConfig.nix {};
-      inherit python runtimePackages checkPackages tesseract;
-    };
-
-    meta = with lib; {
-      description = "Scan, index, and archive all of your paper documents";
-      homepage = "https://github.com/the-paperless-project/paperless";
-      license = licenses.gpl3;
-      maintainers = [ maintainers.earvstedt ];
-    };
-  };
-
-  python = python3.override {
-    packageOverrides = self: super: let
-      customPkgs = import ./python-modules super fetchFromGitHub; in
-    {
-      pyocr = pyocrWithUserTesseract super;
-
-      # Paperless is incompatible with factory_boy >= 3
-      factory_boy = customPkgs.factory_boy_2_12_0;
-
-      # These are pre-release versions, hence they are private to this pkg
-      django-filter = self.callPackage ./python-modules/django-filter.nix {};
-      django-crispy-forms = self.callPackage ./python-modules/django-crispy-forms.nix {};
-    };
-  };
-
-  runtimePackages = with python.pkgs; [
-    dateparser
-    python-dateutil
-    django
-    django-cors-headers
-    django-crispy-forms
-    django-filter
-    django_extensions
-    djangoql
-    djangorestframework
-    factory_boy
-    filemagic
-    fuzzywuzzy
-    langdetect
-    pdftotext
-    pillow
-    psycopg2
-    pyocr
-    python-dotenv
-    python-gnupg
-    pytz
-    termcolor
-  ] ++ (lib.optional stdenv.isLinux inotify-simple);
-
-  checkPackages = with python.pkgs; [
-    pytest
-    pytest-django
-    pytest-env
-    pytest-xdist
-  ];
-
-  pyocrWithUserTesseract = pyPkgs:
-    let
-      pyocr = pyPkgs.pyocr.override { inherit tesseract; };
-    in
-      if pyocr.outPath == pyPkgs.pyocr.outPath then
-        pyocr
-      else
-        # The user has provided a custom tesseract derivation that might be
-        # missing some languages that are required for PyOCR's tests. Disable them to
-        # avoid build errors.
-        pyocr.overridePythonAttrs (attrs: {
-          doCheck = false;
-        });
-in
-  paperless
--- a/pkgs/applications/office/paperless/python-modules/default.nix
+++ b/pkgs/applications/office/paperless/python-modules/default.nix
@ -1,11 +0,0 @@
-pyPkgs: fetchFromGitHub:
-{
-  factory_boy_2_12_0 = pyPkgs.factory_boy.overridePythonAttrs (old: rec {
-    version = "2.12.0";
-    src = pyPkgs.fetchPypi {
-      inherit (old) pname;
-      inherit version;
-      sha256 = "0w53hjgag6ad5i2vmrys8ysk54agsqvgbjy9lg8g0d8pi9h8vx7s";
-    };
-  });
-}
--- a/pkgs/applications/office/paperless/python-modules/django-crispy-forms.nix
+++ b/pkgs/applications/office/paperless/python-modules/django-crispy-forms.nix
@ -1,39 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, pytestCheckHook
-, pytest-django
-, django
-}:
-
-buildPythonPackage rec {
-  pname = "django-crispy-forms";
-  version = "1.10.0";
-
-  src = fetchFromGitHub {
-    owner = "django-crispy-forms";
-    repo = "django-crispy-forms";
-    rev = version;
-    sha256 = "0y6kskfxgckb9npcgwx4zrs5n9px159zh9zhinhxi3i7wlriqpf5";
-  };
-
-  # For reasons unknown, the source dir must contain a dash
-  # for the tests to run successfully
-  postUnpack = ''
-    mv $sourceRoot source-
-    export sourceRoot=source-
-  '';
-
-  checkInputs = [ django pytest-django pytestCheckHook ];
-
-  preCheck = ''
-    export DJANGO_SETTINGS_MODULE=crispy_forms.tests.test_settings
-  '';
-
-  meta = with lib; {
-    description = "The best way to have DRY Django forms";
-    homepage = "https://github.com/maraujop/django-crispy-forms";
-    license = licenses.mit;
-    maintainers = with maintainers; [ earvstedt ];
-  };
-}
--- a/pkgs/applications/office/paperless/python-modules/django-filter.nix
+++ b/pkgs/applications/office/paperless/python-modules/django-filter.nix
@ -1,26 +0,0 @@
-{ lib, buildPythonPackage, python, pythonOlder, fetchFromGitHub
-, django, django-crispy-forms, djangorestframework, mock, pytz }:
-
-buildPythonPackage rec {
-  pname = "django-filter";
-  version = "2.1.0-pre";
-  disabled = pythonOlder "3.4";
-
-  src = fetchFromGitHub {
-    owner = "carltongibson";
-    repo = pname;
-    rev = "24adad8c48bc9e7c7539b6510ffde4ce4effdc29";
-    sha256 = "0hv4w95jnlzp9vdximl6bb27fyi75001jhvsbs0ikkd8amq8iaj7";
-  };
-
-  checkInputs = [ django django-crispy-forms djangorestframework mock pytz ];
-
-  checkPhase = "${python.interpreter} runtests.py";
-
-  meta = with lib; {
-    description = "A reusable Django application for allowing users to filter querysets dynamically.";
-    homepage = "https://github.com/carltongibson/django-filter";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ earvstedt ];
-  };
-}
--- a/pkgs/applications/office/paperless/withConfig.nix
+++ b/pkgs/applications/office/paperless/withConfig.nix
@ -1,68 +0,0 @@
-{ paperless, lib, writers }:
-
-## Usage
-#
-# nix-build --out-link ./paperless -E '
-# (import <nixpkgs> {}).paperless.withConfig {
-#   dataDir = /tmp/paperless-data;
-#   config = {
-#     PAPERLESS_DISABLE_LOGIN = "true";
-#   };
-# }'
-#
-# Setup DB
-# ./paperless migrate
-#
-# Consume documents in ${dataDir}/consume
-# ./paperless document_consumer --oneshot
-#
-# Start web interface
-# ./paperless runserver --noreload localhost:8000
-
-{ config ? {}, dataDir ? null, ocrLanguages ? null
-, paperlessPkg ? paperless, extraCmds ? "" }:
-with lib;
-let
-  paperless = if ocrLanguages == null then
-    paperlessPkg
-  else
-    (paperlessPkg.override {
-      tesseract = paperlessPkg.tesseract.override {
-        enableLanguages = ocrLanguages;
-      };
-    }).overrideDerivation (_: {
-      # `ocrLanguages` might be missing some languages required by the tests.
-      doCheck = false;
-    });
-
-  envVars = (optionalAttrs (dataDir != null) {
-    PAPERLESS_CONSUMPTION_DIR = "${dataDir}/consume";
-    PAPERLESS_MEDIADIR = "${dataDir}/media";
-    PAPERLESS_STATICDIR = "${dataDir}/static";
-    PAPERLESS_DBDIR = dataDir;
-  }) // config;
-
-  envVarDefs = mapAttrsToList (n: v: ''export ${n}="${toString v}"'') envVars;
-  setupEnvVars = builtins.concatStringsSep "\n" envVarDefs;
-
-  setupEnv = ''
-    source ${paperless}/share/paperless/setup-env.sh
-    ${setupEnvVars}
-    ${optionalString (dataDir != null) ''
-      mkdir -p "$PAPERLESS_CONSUMPTION_DIR" \
-               "$PAPERLESS_MEDIADIR" \
-               "$PAPERLESS_STATICDIR" \
-               "$PAPERLESS_DBDIR"
-    ''}
-  '';
-
-  runPaperless = writers.writeBash "paperless" ''
-    set -e
-    ${setupEnv}
-    ${extraCmds}
-    exec python $paperlessSrc/manage.py "$@"
-  '';
-in
-  runPaperless // {
-    inherit paperless setupEnv;
-  }
--- a/pkgs/applications/virtualization/singularity/default.nix
+++ b/pkgs/applications/virtualization/singularity/default.nix
@ -15,11 +15,11 @@ with lib;

 buildGoPackage rec {
  pname = "singularity";
-  version = "3.8.0";
+  version = "3.8.1";

  src = fetchurl {
    url = "https://github.com/hpcng/singularity/releases/download/v${version}/singularity-${version}.tar.gz";
-    sha256 = "sha256-6WCLDgqMgFIYu+eV6RdkhIN7L3/LleVGm4U7OAmiQS4=";
+    sha256 = "sha256-Jkg2b7x+j8up0y+PGH6hSTVsX5CDpXgm1kE1n6hBXZo=";
  };

  goPackagePath = "github.com/sylabs/singularity";
--- a/pkgs/development/libraries/netcdf/default.nix
+++ b/pkgs/development/libraries/netcdf/default.nix
@ -1,4 +1,5 @@
 { lib, stdenv
+, fetchpatch
 , fetchurl
 , hdf5
 , m4
@ -11,13 +12,25 @@ let
  mpi = hdf5.mpi;
 in stdenv.mkDerivation rec {
  pname = "netcdf";
-  version = "4.7.4";
+  version = "4.8.0"; # Remove patch mentioned below on upgrade

  src = fetchurl {
    url = "https://www.unidata.ucar.edu/downloads/netcdf/ftp/${pname}-c-${version}.tar.gz";
-    sha256 = "1a2fpp15a2rl1m50gcvvzd9y6bavl6vjf9zzf63sz5gdmq06yiqf";
+    sha256 = "1mfn8qi4k0b8pyar3wa8v0npj69c7rhgfdlppdwmq5jqk88kb5k7";
  };

+  patches = [
+    # Fixes:
+    #     *** Checking vlen of compound file...Sorry! Unexpected result, tst_h_atts3.c, line: 289
+    #     FAIL tst_h_atts3 (exit status: 2)
+    # TODO: Remove with next netcdf release (see https://github.com/Unidata/netcdf-c/pull/1980)
+    (fetchpatch {
+      name = "netcdf-Fix-tst_h_atts3-for-hdf5-1.12.patch";
+      url = "https://github.com/Unidata/netcdf-c/commit/9fc8ae62a8564e095ff17f4612874581db0e4db5.patch";
+      sha256 = "128kxz5jikq32x5qjmi0xdngi0k336rf6bvbcppvlk5gibg5nk7v";
+    })
+  ];
+
  postPatch = ''
    patchShebangs .

--- a/pkgs/development/libraries/pdal/default.nix
+++ b/pkgs/development/libraries/pdal/default.nix
@ -20,13 +20,13 @@

 stdenv.mkDerivation rec {
  pname = "pdal";
-  version = "2.2.0";
+  version = "2.3.0";

  src = fetchFromGitHub {
    owner = "PDAL";
    repo = "PDAL";
    rev = version;
-    sha256 = "1i7nbfvv60jjlf3iq7a7xci4dycmg2wrd35dqvjwl6hpfynpb6wz";
+    sha256 = "sha256-DKIraCyp8fcgnVp5dFrtQ4Wq96cQGC9SiAPLS6htUZc=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/qrcodegen/default.nix
+++ b/pkgs/development/libraries/qrcodegen/default.nix
@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub }:
 stdenv.mkDerivation rec {
  pname = "qrcodegen";
-  version = "1.6.0";
+  version = "1.7.0";

  src = fetchFromGitHub {
    owner = "nayuki";
    repo = "QR-Code-generator";
    rev = "v${version}";
-    sha256 = "0iq9sv9na0vg996aqrxrjn9rrbiyy7sc9vslw945p3ky22pw3lql";
+    sha256 = "sha256-WH6O3YE/+NNznzl52TXZYL+6O25GmKSnaFqDDhRl4As=";
  };

  preBuild = "cd c";
--- a/pkgs/development/libraries/sentencepiece/default.nix
+++ b/pkgs/development/libraries/sentencepiece/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "sentencepiece";
-  version = "0.1.95";
+  version = "0.1.96";

  src = fetchFromGitHub {
    owner = "google";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0mv7vgsvd7hjssidxy7fjfmwqy68vjcia8pajji11q2fkfp3cg67";
+    sha256 = "sha256-jo8XlQJsnWpeeezDjNNhh6T473XMqe8fsApUr82Y3BU=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/python-modules/django-ipware/default.nix
+++ b/pkgs/development/python-modules/django-ipware/default.nix
@ -2,7 +2,7 @@

 buildPythonPackage rec {
  pname = "django-ipware";
-  version = "3.0.2";
+  version = "3.0.7";

  meta = {
    description = "A Django application to retrieve user's IP address";
@ -12,7 +12,7 @@ buildPythonPackage rec {

  src = fetchPypi {
    inherit pname version;
-    sha256 = "c7df8e1410a8e5d6b1fbae58728402ea59950f043c3582e033e866f0f0cf5e94";
+    sha256 = "753f8214a16ccaac54ea977349a96e37b582a28a54065e00c1c46d530862c85e";
  };

  propagatedBuildInputs = [ django ];
--- a/pkgs/development/python-modules/dpkt/default.nix
+++ b/pkgs/development/python-modules/dpkt/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "dpkt";
-  version = "1.9.6";
+  version = "1.9.7.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "b5737010fd420d142e02ed04fa616edd1fc05e414980baef594f72287c875eef";
+    sha256 = "74899d557ec4e337db29cecc80548b23a1205384d30ee407397cfb9ab178e3d4";
  };

  meta = with lib; {
--- a/pkgs/development/python-modules/geoalchemy2/default.nix
+++ b/pkgs/development/python-modules/geoalchemy2/default.nix
@ -9,11 +9,11 @@

 buildPythonPackage rec {
  pname = "GeoAlchemy2";
-  version = "0.9.0";
+  version = "0.9.3";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "c32023bc2fb8fbb136f00a0e9c2feba21f3e1040af0f619c888661f6ee72dd28";
+    sha256 = "56f969cf4ad6629ebcde73e807f7dac0a9375c79991b4f93efab191f37737a00";
  };

  nativeBuildInputs = [ setuptools-scm ];
--- a/pkgs/development/python-modules/hcloud/default.nix
+++ b/pkgs/development/python-modules/hcloud/default.nix
@ -13,12 +13,12 @@

 buildPythonPackage rec {
  pname = "hcloud";
-  version = "1.13.0";
+  version = "1.16.0";
  disabled = isPy27;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0f84nwr3ddzivlnswwmhvm3lgq9fy3n7nryy93xqpk5nxcd1ybpn";
+    sha256 = "c8b94557d93bcfe437f20a8176693ea4f54358b74986cc19d94ebc23f48e40cc";
  };

  propagatedBuildInputs = [ future requests python-dateutil ];
--- a/pkgs/development/python-modules/hvplot/default.nix
+++ b/pkgs/development/python-modules/hvplot/default.nix
@ -18,11 +18,11 @@

 buildPythonPackage rec {
  pname = "hvplot";
-  version = "0.7.2";
+  version = "0.7.3";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "f0dcfcb5e46ae3c29a646c341435986e332ef38af1057bf7b76abadff0bbaca4";
+    sha256 = "74b269c6e118dd6f7d2a4039e91f16a193638f4119b4358dc6dbd58a2e71e432";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/icecream/default.nix
+++ b/pkgs/development/python-modules/icecream/default.nix
@ -4,11 +4,11 @@

 buildPythonPackage rec {
  pname = "icecream";
-  version = "2.1.0";
+  version = "2.1.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "c2e7b74c1c12caa2cfde050f2e636493ee77a9fb4a494b5593418ab359924a24";
+    sha256 = "47e00e3f4e8477996e7dc420b6fa8ba53f8ced17de65320fedb5b15997b76589";
  };

  propagatedBuildInputs = [ asttokens colorama executing pygments ];
--- a/pkgs/development/python-modules/inotifyrecursive/default.nix
+++ b/pkgs/development/python-modules/inotifyrecursive/default.nix
@ -0,0 +1,28 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, inotify-simple
+}:
+
+buildPythonPackage rec {
+  pname = "inotifyrecursive";
+  version = "0.3.5";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "osRQsxdpPkU4QW+Q6x14WFBtr+a4uIUDe9LdmuLa+h4=";
+  };
+
+  propagatedBuildInputs = [ inotify-simple ];
+
+  # No tests included
+  doCheck = false;
+  pythonImportsCheck = [ pname ];
+
+  meta = with lib; {
+    description = "Simple recursive inotify watches for Python";
+    homepage = "https://github.com/letorbi/inotifyrecursive";
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ Flakebi ];
+  };
+}
--- a/pkgs/development/python-modules/ipyvuetify/default.nix
+++ b/pkgs/development/python-modules/ipyvuetify/default.nix
@ -7,12 +7,12 @@

 buildPythonPackage rec {
  pname = "ipyvuetify";
-  version = "1.7.0";
+  version = "1.8.1";

  # GitHub version tries to run npm (Node JS)
  src = fetchPypi {
    inherit pname version;
-    sha256 = "ea951e3819fcfe8a2ba0a0fe8a51f07b01dca7986eaf57f1840b3c71848cc7c3";
+    sha256 = "2d17367ce7da45a2622107d55c8b4c5475aace99ed5d95e5d7d3f93aa4c0c566";
  };

  propagatedBuildInputs = [ ipyvue ];
--- a/pkgs/development/python-modules/pyfronius/default.nix
+++ b/pkgs/development/python-modules/pyfronius/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "pyfronius";
-  version = "0.5.3";
+  version = "0.6.0";
  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "nielstron";
    repo = pname;
-    rev = version;
-    sha256 = "sha256-AtCpraIYNrEkTygtLMivrXfKCKVKIIUCDo3GYFpg8fk=";
+    rev = "release-${version}";
+    sha256 = "sha256-z7sIDT6dxgLWcnpZ4NOp5Bz5C9xduwQJ3xmDfTyI+Gs=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/tika/default.nix
+++ b/pkgs/development/python-modules/tika/default.nix
@ -0,0 +1,29 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pyyaml
+, requests
+}:
+
+buildPythonPackage rec {
+  pname = "tika";
+  version = "1.24";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "wsUPQFYi90UxhBEE+ehcF1Ea7eEd6OU4XqsaKaMfGRs=";
+  };
+
+  propagatedBuildInputs = [ pyyaml requests ];
+
+  # Requires network
+  doCheck = false;
+  pythonImportsCheck = [ pname ];
+
+  meta = with lib; {
+    description = "A Python binding to the Apache Tika™ REST services";
+    homepage = "https://github.com/chrismattmann/tika-python";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ Flakebi ];
+  };
+}
--- a/pkgs/development/tools/symfony-cli/default.nix
+++ b/pkgs/development/tools/symfony-cli/default.nix
@ -2,11 +2,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "symfony-cli";
-  version = "4.25.4";
+  version = "4.25.5";

  src = fetchurl {
    url = "https://github.com/symfony/cli/releases/download/v${version}/symfony_linux_amd64.gz";
-    sha256 = "94ade97d79e6949022ac45e4f8f9c025a9e3efa54a1a891a086a24eb9a9765a7";
+    sha256 = "sha256-DMyW2lKuoFVEguCQQ6efXrzvujL5H7PcgI0go98M0xI=";
  };

  dontBuild = true;
--- a/pkgs/development/tools/tracy/default.nix
+++ b/pkgs/development/tools/tracy/default.nix
@ -4,13 +4,13 @@ let
  disableLTO = stdenv.cc.isClang && stdenv.isDarwin;  # workaround issue #19098
 in stdenv.mkDerivation rec {
  pname = "tracy";
-  version = "0.7.7";
+  version = "0.7.8";

  src = fetchFromGitHub {
    owner = "wolfpld";
    repo = "tracy";
    rev = "v${version}";
-    sha256 = "sha256-jp+Geqk39ZPoe2KzUJJ0w5hvCnyUlHGwVKn73lJJt94=";
+    sha256 = "sha256-hOeanY170vvn5W68cCDRUFApia/PW3ymPIgdWx3gwVw=";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/games/osu-lazer/default.nix
+++ b/pkgs/games/osu-lazer/default.nix
@ -16,13 +16,13 @@ let

 in stdenv.mkDerivation rec {
  pname = "osu-lazer";
-  version = "2021.720.0";
+  version = "2021.815.0";

  src = fetchFromGitHub {
    owner = "ppy";
    repo = "osu";
    rev = version;
-    sha256 = "I7UkbyH2i218d5RCq4al9Gr1C0MX339jFOeyKrKQ3b0=";
+    sha256 = "z5z/BKi9W4i7fbDmzKUscyNByDwe4nJXyUED8SROCrg=";
  };

  nativeBuildInputs = [
--- a/pkgs/games/osu-lazer/deps.nix
+++ b/pkgs/games/osu-lazer/deps.nix
@ -57,24 +57,25 @@
  (fetchNuGet { name = "Humanizer.Core.zh-CN"; version = "2.11.10"; sha256 = "01dy5kf6ai8id77px92ji4kcxjc8haj39ivv55xy1afcg3qiy7mh"; })
  (fetchNuGet { name = "Humanizer.Core.zh-Hans"; version = "2.11.10"; sha256 = "16gcxgw2g6gck3nc2hxzlkbsg7wkfaqsjl87kasibxxh47zdqqv2"; })
  (fetchNuGet { name = "Humanizer.Core.zh-Hant"; version = "2.11.10"; sha256 = "1rjg2xvkwjjw3c7z9mdjjvbnl9lcvvhh4fr7l61rla2ynzdk46cj"; })
-  (fetchNuGet { name = "JetBrains.Annotations"; version = "2021.1.0"; sha256 = "07pnhxxlgx8spmwmakz37nmbvgyb6yjrbrhad5rrn6y767z5r1gb"; })
-  (fetchNuGet { name = "ManagedBass"; version = "2.0.4"; sha256 = "13hwd0yany4j52abbaaqsgq8lag2w9vjxxsj4qfbgwp4qs39x003"; })
-  (fetchNuGet { name = "ManagedBass.Fx"; version = "2.0.1"; sha256 = "1rbjpgpm0ri7l2gqdy691rsv3visna2nbxawgvhdqljw068r8a8d"; })
+  (fetchNuGet { name = "JetBrains.Annotations"; version = "2021.2.0"; sha256 = "0krvmg2h5ibh6mzs9yn7c8cdxgvr5hm7l884i49hlhnc1aiy5m1n"; })
+  (fetchNuGet { name = "ManagedBass"; version = "3.0.0"; sha256 = "1yh1s36w465z8gcj4xs6q048g63z7m3nyfy1vvw1lgh7k6hqqgma"; })
+  (fetchNuGet { name = "ManagedBass.Fx"; version = "3.0.0"; sha256 = "0sck1wmjlcy8q941bamk1i0k4yrklyilsgg6c832xdh96sdc049s"; })
+  (fetchNuGet { name = "ManagedBass.Mix"; version = "3.0.0"; sha256 = "0brnm0ry96b81hgffbaj52s53bsn9c8cx4q24j0whsvmcqqxhs4v"; })
  (fetchNuGet { name = "managed-midi"; version = "1.9.14"; sha256 = "025jh146zy98699y4civ7nxlkx312lwkl4sr8pha626q7q1kg89h"; })
  (fetchNuGet { name = "Markdig"; version = "0.25.0"; sha256 = "1f7iqkaphfyf6szjrp0633rj44wynqgiqyivbja5djyxjy4csfyy"; })
-  (fetchNuGet { name = "MessagePack"; version = "2.2.85"; sha256 = "1y0h8bd0drnlsqf1bvrdiv9j1892zqf1rmyclfjzs49klpf0xphk"; })
-  (fetchNuGet { name = "MessagePack.Annotations"; version = "2.2.85"; sha256 = "00wajml6iy3wid8mixh3jmm6dapfjbccwq95m8qciika4pyd4lq9"; })
+  (fetchNuGet { name = "MessagePack"; version = "2.3.75"; sha256 = "0mcpxym6g47lyfalnr27mmavmgmd46k6f9g7id8cn1anbbvd4xv1"; })
+  (fetchNuGet { name = "MessagePack.Annotations"; version = "2.3.75"; sha256 = "06a1ys161gvw1sr771w909gwd1y4dizdvldknkhy8484drj90prd"; })
  (fetchNuGet { name = "Microsoft.AspNetCore.App.Runtime.linux-x64"; version = "5.0.5"; sha256 = "026m19pddhkx5idwpi6mp1yl9yfcfgm2qjp1jh54mdja1d7ng0vk"; })
-  (fetchNuGet { name = "Microsoft.AspNetCore.Connections.Abstractions"; version = "5.0.7"; sha256 = "119wk2aqnas2sfyawv0wkg20ygk1cr15lycvvnw2x42kwgcimmks"; })
-  (fetchNuGet { name = "Microsoft.AspNetCore.Http.Connections.Client"; version = "5.0.7"; sha256 = "0jdpqmjv9w29ih13nprzvf2m6cjrg69x0kwyi3d7b371rvz7m66l"; })
-  (fetchNuGet { name = "Microsoft.AspNetCore.Http.Connections.Common"; version = "5.0.7"; sha256 = "1h6bw9hs92xp505c9x0jn1mx1i86r3s6xs7yyycx905grwisga39"; })
-  (fetchNuGet { name = "Microsoft.AspNetCore.Http.Features"; version = "5.0.7"; sha256 = "1v89zxk15c7gswq10cbsf2yr974inpbk5npw2v6qj8vcs66qqwq3"; })
-  (fetchNuGet { name = "Microsoft.AspNetCore.SignalR.Client"; version = "5.0.7"; sha256 = "13mqsa5nks9fcxv6kxm9j75mxafs3h5pikv35a56h7d9z8wdazsr"; })
-  (fetchNuGet { name = "Microsoft.AspNetCore.SignalR.Client.Core"; version = "5.0.7"; sha256 = "033q9ijbbkh3crby96c62azyi61m0c7byiz89xbrdvagpj6ydqn5"; })
-  (fetchNuGet { name = "Microsoft.AspNetCore.SignalR.Common"; version = "5.0.7"; sha256 = "0s04flgfrljv3r8kxplc569mp3gsqd4nwda0h3yly3rqzwmbrnwp"; })
-  (fetchNuGet { name = "Microsoft.AspNetCore.SignalR.Protocols.Json"; version = "5.0.7"; sha256 = "0nb3v6hhhlndagczac255v2iyjs40jfi9gnb0933zh01wqrgkrv7"; })
-  (fetchNuGet { name = "Microsoft.AspNetCore.SignalR.Protocols.MessagePack"; version = "5.0.7"; sha256 = "06clfalw2xn7rfw53y8kiwcf2j3902iz0pl9fn2q4czhfwfp23ld"; })
-  (fetchNuGet { name = "Microsoft.AspNetCore.SignalR.Protocols.NewtonsoftJson"; version = "5.0.7"; sha256 = "1m2likbhq8mxv33yw5zl2ybgc11ksjzqi7nhjrnx1bc12amb3nw4"; })
+  (fetchNuGet { name = "Microsoft.AspNetCore.Connections.Abstractions"; version = "5.0.8"; sha256 = "13k0p0k1gqk12hnxj4l5yjbyv8y51ggkybrqjjr3yf3411vyy4q2"; })
+  (fetchNuGet { name = "Microsoft.AspNetCore.Http.Connections.Client"; version = "5.0.8"; sha256 = "0rladdnd7g8gh7hj5gbrcp3dlspngad4xhgk0qmpzhlc3qr4snf2"; })
+  (fetchNuGet { name = "Microsoft.AspNetCore.Http.Connections.Common"; version = "5.0.8"; sha256 = "03d2ydy7zap5hri7k1f30d1i9jaqj0nijwgp2z6b36gwqck9rys7"; })
+  (fetchNuGet { name = "Microsoft.AspNetCore.Http.Features"; version = "5.0.8"; sha256 = "1amyhi7m2g3al3ams5fdzqk9xablw14vfpvn819mym1ml1y6lbb7"; })
+  (fetchNuGet { name = "Microsoft.AspNetCore.SignalR.Client"; version = "5.0.8"; sha256 = "0a25gzp6p5ii0p4g9n1vlsc085bvy7m02cdpyb2zxl10iggzqj57"; })
+  (fetchNuGet { name = "Microsoft.AspNetCore.SignalR.Client.Core"; version = "5.0.8"; sha256 = "09yaqai0ld25p27nndw9bg7p0vm11y4jc00xcl3vh0jb0lqhkznf"; })
+  (fetchNuGet { name = "Microsoft.AspNetCore.SignalR.Common"; version = "5.0.8"; sha256 = "0j1wa67n22gbwswn8457m3cl6jw099wn84qxj9qsrsylv4md58n6"; })
+  (fetchNuGet { name = "Microsoft.AspNetCore.SignalR.Protocols.Json"; version = "5.0.8"; sha256 = "1nms7rs157njhh0lvkhk4hv5i6ds54jx5fw5iy2jwa7qajic1yjv"; })
+  (fetchNuGet { name = "Microsoft.AspNetCore.SignalR.Protocols.MessagePack"; version = "5.0.8"; sha256 = "02rbz3wlfq8bnd4h7d0pd2f9lvpcyjf7ak73wbl8y0fi19xda07i"; })
+  (fetchNuGet { name = "Microsoft.AspNetCore.SignalR.Protocols.NewtonsoftJson"; version = "5.0.8"; sha256 = "1qwn1263jxc90mbapfkr4a1238q76clv2c38n0w3ybdxy3md8n34"; })
  (fetchNuGet { name = "Microsoft.Bcl.AsyncInterfaces"; version = "1.0.0"; sha256 = "00dx5armvkqjxvkldz3invdlck9nj7w21dlsr2aqp1rqbyrbsbbh"; })
  (fetchNuGet { name = "Microsoft.Bcl.AsyncInterfaces"; version = "1.1.0"; sha256 = "1dq5yw7cy6s42193yl4iqscfw5vzkjkgv0zyy32scr4jza6ni1a1"; })
  (fetchNuGet { name = "Microsoft.Bcl.AsyncInterfaces"; version = "5.0.0"; sha256 = "0cp5jbax2mf6xr3dqiljzlwi05fv6n9a35z337s92jcljiq674kf"; })
@ -109,7 +110,7 @@
  (fetchNuGet { name = "Microsoft.Extensions.Configuration.Abstractions"; version = "5.0.0"; sha256 = "0fqxkc9pjxkqylsdf26s9q21ciyk56h1w33pz3v1v4wcv8yv1v6k"; })
  (fetchNuGet { name = "Microsoft.Extensions.Configuration.Binder"; version = "2.2.0"; sha256 = "10qyjdkymdmag3r807kvbnwag4j3nz65i4cwikbd77jjvz92ya3j"; })
  (fetchNuGet { name = "Microsoft.Extensions.DependencyInjection"; version = "2.2.0"; sha256 = "0lvv45rvq1xbf47lz818rjydc776zk8mf7svpzh1dml4qwlx9zck"; })
-  (fetchNuGet { name = "Microsoft.Extensions.DependencyInjection"; version = "5.0.1"; sha256 = "06xig49mwyp3b2dvdx98j079ncg6p4c9x8yj4pzs6ppmi3jgaaqk"; })
+  (fetchNuGet { name = "Microsoft.Extensions.DependencyInjection"; version = "5.0.2"; sha256 = "0db6d1b076nfqfn5mhy63l3gkfn5kr29hwcrx81ldr7y062r1b9y"; })
  (fetchNuGet { name = "Microsoft.Extensions.DependencyInjection.Abstractions"; version = "2.2.0"; sha256 = "1jyzfdr9651h3x6pxwhpfbb9mysfh8f8z1jvy4g117h9790r9zx5"; })
  (fetchNuGet { name = "Microsoft.Extensions.DependencyInjection.Abstractions"; version = "5.0.0"; sha256 = "17cz6s80va0ch0a6nqa1wbbbp3p8sqxb96lj4qcw67ivkp2yxiyj"; })
  (fetchNuGet { name = "Microsoft.Extensions.DependencyModel"; version = "2.1.0"; sha256 = "0dl4qhjgifm6v3jsfzvzkvddyic77ggp9fq49ah661v45gk6ilgd"; })
@ -117,7 +118,7 @@
  (fetchNuGet { name = "Microsoft.Extensions.Logging"; version = "5.0.0"; sha256 = "1qa1l18q2jh9azya8gv1p8anzcdirjzd9dxxisb4911i9m1648i3"; })
  (fetchNuGet { name = "Microsoft.Extensions.Logging.Abstractions"; version = "2.2.0"; sha256 = "02w7hp6jicr7cl5p456k2cmrjvvhm6spg5kxnlncw3b72358m5wl"; })
  (fetchNuGet { name = "Microsoft.Extensions.Logging.Abstractions"; version = "5.0.0"; sha256 = "1yza38675dbv1qqnnhqm23alv2bbaqxp0pb7zinjmw8j2mr5r6wc"; })
-  (fetchNuGet { name = "Microsoft.Extensions.ObjectPool"; version = "5.0.7"; sha256 = "047wv490fjizknyhbmxwbbh9fns13pq2inpc9idxq42n2zj3zbij"; })
+  (fetchNuGet { name = "Microsoft.Extensions.ObjectPool"; version = "5.0.8"; sha256 = "06hfa4crnmf72rw1znqw2fmknshsjnvaa3xgmw4kswd3y622ljxg"; })
  (fetchNuGet { name = "Microsoft.Extensions.Options"; version = "2.2.0"; sha256 = "1b20yh03fg4nmmi3vlf6gf13vrdkmklshfzl3ijygcs4c2hly6v0"; })
  (fetchNuGet { name = "Microsoft.Extensions.Options"; version = "5.0.0"; sha256 = "1rdmgpg770x8qwaaa6ryc27zh93p697fcyvn5vkxp0wimlhqkbay"; })
  (fetchNuGet { name = "Microsoft.Extensions.Primitives"; version = "2.2.0"; sha256 = "0znah6arbcqari49ymigg3wiy2hgdifz8zsq8vdc3ynnf45r7h0c"; })
@ -155,12 +156,13 @@
  (fetchNuGet { name = "NUnit"; version = "3.13.2"; sha256 = "00bkjgarkwbj497da9d7lajala1ns67h1kx53w4bapwkf32jlcvn"; })
  (fetchNuGet { name = "OpenTabletDriver"; version = "0.5.3.1"; sha256 = "16xw8w943x9gvnnpbryahff5azzy8n26j2igyqgv88m352jd9rb8"; })
  (fetchNuGet { name = "OpenTabletDriver.Plugin"; version = "0.5.3.1"; sha256 = "17dxsvcz9g8kzydk5xlfz9kfxl62x9wi20609rh76wjd881bg1br"; })
-  (fetchNuGet { name = "ppy.LocalisationAnalyser"; version = "2021.716.0"; sha256 = "0w45af0mlh4bkjxxhk5p4kb6z0na8fmm6xz10dfzs3b4i61h5x3z"; })
-  (fetchNuGet { name = "ppy.osu.Framework"; version = "2021.714.0"; sha256 = "175i0hcbl01xy633zvij8185nj4g7ja1rsv2lmfz8qdykqj6g9kl"; })
-  (fetchNuGet { name = "ppy.osu.Framework.NativeLibs"; version = "2021.115.0"; sha256 = "00cxrnc78wb8l7d4x7m39g73y85kbgnsnx3qdvv0a9p77lf7lx7z"; })
-  (fetchNuGet { name = "ppy.osu.Game.Resources"; version = "2021.706.0"; sha256 = "1yacqy8h93vph3faf4y0iwhlnlmbny3zj57cm2bh04z2gk0l17am"; })
-  (fetchNuGet { name = "ppy.osuTK.NS20"; version = "1.0.173"; sha256 = "11rrxakrgq5lriv09qlz26189nyc9lh0fjidn5h70labyp2gpa4y"; })
-  (fetchNuGet { name = "ppy.SDL2-CS"; version = "1.0.238-alpha"; sha256 = "1n7pa7gy1hcgsfm3jix334qr6v229n1yymq58njj802l3k5g7980"; })
+  (fetchNuGet { name = "ppy.LocalisationAnalyser"; version = "2021.725.0"; sha256 = "00nvk8kw94v0iq5k7y810sa235lqdjlggq7f00c64c3d1zam4203"; })
+  (fetchNuGet { name = "ppy.ManagedBass"; version = "3.1.3-alpha"; sha256 = "0qdrklalp42pbyb30vpr7c0kwjablsja0s6xplxxkpfd14y8mzk4"; })
+  (fetchNuGet { name = "ppy.osu.Framework"; version = "2021.813.0"; sha256 = "1zwx2jq6r1xcp72f484nhicmf472pad84p2hxwhli7xczq0n0fbc"; })
+  (fetchNuGet { name = "ppy.osu.Framework.NativeLibs"; version = "2021.805.0"; sha256 = "004c053s6p7339bfw68lvlyk9jkbw6djkf2d72dz8wam546k8dcl"; })
+  (fetchNuGet { name = "ppy.osu.Game.Resources"; version = "2021.813.0"; sha256 = "1g7f15khni624024c87cx0hihpd4syl1vss8nyrxqmkqqlif6da1"; })
+  (fetchNuGet { name = "ppy.osuTK.NS20"; version = "1.0.177"; sha256 = "0l5if7phd0pvnsvqlbzaz5bizxb6w2i412wyc0wfcrl3p6pm4y7m"; })
+  (fetchNuGet { name = "ppy.SDL2-CS"; version = "1.0.367-alpha"; sha256 = "0mg45c81wzxdr7v4kygmvgipgs1s24v3bkyn64c0xl1vb015l2bx"; })
  (fetchNuGet { name = "ppy.squirrel.windows"; version = "1.9.0.5"; sha256 = "0nmhrg3q6izapfpwdslq80fqkvjj12ad9r94pd0nr2xx1zw0x1zl"; })
  (fetchNuGet { name = "Realm"; version = "10.3.0"; sha256 = "12zmp43cf2kilzq1yi9x2hy1jdh51c0kbnddw5s960k1kvyx2s2v"; })
  (fetchNuGet { name = "Realm.Fody"; version = "10.3.0"; sha256 = "0mhjkahi2ldxcizv08i70mrpwgrvljxdjlr81x3dmwgpxxfji18d"; })
@ -185,7 +187,7 @@
  (fetchNuGet { name = "runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "160p68l2c7cqmyqjwxydcvgw7lvl1cr0znkw8fp24d1by9mqc8p3"; })
  (fetchNuGet { name = "runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "15zrc8fgd8zx28hdghcj5f5i34wf3l6bq5177075m2bc2j34jrqy"; })
  (fetchNuGet { name = "runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "1p4dgxax6p7rlgj4q73k73rslcnz4wdcv8q2flg1s8ygwcm58ld5"; })
-  (fetchNuGet { name = "Sentry"; version = "3.6.0"; sha256 = "1yjz3m8chg796izrdd9vlxvka60rmv6cmsxpnrv9llmsss2mqssz"; })
+  (fetchNuGet { name = "Sentry"; version = "3.8.3"; sha256 = "0ymr3f36illxk2949nfyd91anw46n19wd1rl1id4l6yql9fl6b30"; })
  (fetchNuGet { name = "SharpCompress"; version = "0.17.1"; sha256 = "1ffiacghbcnr3fkgvdcad7b1nky54nhmmn2sm43sks9zm8grvva4"; })
  (fetchNuGet { name = "SharpCompress"; version = "0.28.3"; sha256 = "1svymm2vyg3815p3sbwjdk563mz0a4ag1sr30pm0ki01brqpaaas"; })
  (fetchNuGet { name = "SharpFNT"; version = "2.0.0"; sha256 = "1bgacgh9hbck0qvji6frbb50sdiqfdng2fvvfgfw8b9qaql91mx0"; })
--- a/pkgs/os-specific/linux/pcm/default.nix
+++ b/pkgs/os-specific/linux/pcm/default.nix
@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub }:

 stdenv.mkDerivation rec {
-  version = "202101";
+  version = "202107";
  pname = "pcm";

  src = fetchFromGitHub {
    owner = "opcm";
    repo = "pcm";
    rev = version;
-    sha256 = "sha256-xiC9XDuFcAzD2lVuzBWUvHy1Z1shEXM2KPFabKvgh1Y=";
+    sha256 = "sha256-2fN+jS6+BpodjjN+TV67uiNgZ0eblWjzbyU3CDp9ee0=";
  };

  installPhase = ''
--- a/pkgs/tools/text/hottext/default.nix
+++ b/pkgs/tools/text/hottext/default.nix
@ -55,11 +55,11 @@ let

 in stdenv.mkDerivation rec {
  pname = "hottext";
-  version = "1.3";
+  version = "1.4";

  src = fetchurl {
    url = "https://git.sr.ht/~ehmry/hottext/archive/v${version}.tar.gz";
-    sha256 = "sha256-iz7Z2x0/yi/E6gGFkYgq/yZDOxrZGwQmumPoO9kckLQ=";
+    sha256 = "sha256-hIUofi81zowSMbt1lUsxCnVzfJGN3FEiTtN8CEFpwzY=";
  };

  nativeBuildInputs = [ nim ];
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -567,6 +567,7 @@ mapAliases ({
  owncloudclient = owncloud-client;  # added 2016-08
  ocz-ssd-guru = throw "ocz-ssd-guru has been removed due to there being no source available"; # added 2021-07-12
  p11_kit = p11-kit; # added 2018-02-25
+  paperless = paperless-ng; # added 2021-06-06
  parity = openethereum; # added 2020-08-01
  parquet-cpp = arrow-cpp; # added 2018-09-08
  pass-otp = pass.withExtensions (ext: [ext.pass-otp]); # added 2018-05-04
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -7332,10 +7332,12 @@ with pkgs;

  netatalk = callPackage ../tools/filesystems/netatalk { };

-  netcdf = callPackage ../development/libraries/netcdf { };
+  netcdf = callPackage ../development/libraries/netcdf {
+    hdf5 = hdf5.override { usev110Api = true; };
+  };

  netcdf-mpi = appendToName "mpi" (netcdf.override {
-    hdf5 = hdf5-mpi;
+    hdf5 = hdf5-mpi.override { usev110Api = true; };
  });

  netcdfcxx4 = callPackage ../development/libraries/netcdf-cxx4 { };
@ -7893,7 +7895,7 @@ with pkgs;

  pamtester = callPackage ../tools/security/pamtester { };

-  paperless = callPackage ../applications/office/paperless { };
+  paperless-ng = callPackage ../applications/office/paperless-ng { };

  paperwork = callPackage ../applications/office/paperwork/paperwork-gtk.nix { };

--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -3585,6 +3585,8 @@ in {

  inotify-simple = callPackage ../development/python-modules/inotify-simple { };

+  inotifyrecursive = callPackage ../development/python-modules/inotifyrecursive { };
+
  inquirer = callPackage ../development/python-modules/inquirer { };

  intake = callPackage ../development/python-modules/intake { };
@ -8746,6 +8748,8 @@ in {

  tifffile = callPackage ../development/python-modules/tifffile { };

+  tika = callPackage ../development/python-modules/tika { };
+
  tiledb = callPackage ../development/python-modules/tiledb {
    inherit (pkgs) tiledb;
  };