Merge master into staging-next

2021-08-05 00:01:21 +00:00 · 2021-08-05 00:01:21 +00:00 · 7fac04f59c
commit 7fac04f59c
parent 2e929613b4 5416a5bb13
48 changed files with 1257 additions and 517 deletions
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@ -799,6 +799,15 @@
          this up.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          Zfs: <literal>latestCompatibleLinuxPackages</literal> is now
+          exported on the zfs package. One can use
+          <literal>boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;</literal>
+          to always track the latest compatible kernel with a given
+          version of zfs.
+        </para>
+      </listitem>
    </itemizedlist>
  </section>
 </section>
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@ -204,3 +204,5 @@ pt-services.clipcat.enable).
 - The [networking.wireless.iwd](options.html#opt-networking.wireless.iwd.enable) module has a new [networking.wireless.iwd.settings](options.html#opt-networking.wireless.iwd.settings) option.

 - The [services.syncoid.enable](options.html#opt-services.syncoid.enable) module now properly drops ZFS permissions after usage. Before it delegated permissions to whole pools instead of datasets and didn't clean up after execution. You can manually look this up for your pools by running `zfs allow your-pool-name` and use `zfs unallow syncoid your-pool-name` to clean this up.
+
+- Zfs: `latestCompatibleLinuxPackages` is now exported on the zfs package. One can use `boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;` to always track the latest compatible kernel with a given version of zfs.
--- a/nixos/modules/misc/documentation.nix
+++ b/nixos/modules/misc/documentation.nix
@ -258,8 +258,7 @@ in

      environment.systemPackages = []
        ++ optional cfg.man.enable manual.manpages
-        ++ optionals cfg.doc.enable ([ manual.manualHTML nixos-help ]
-           ++ optionals config.services.xserver.enable [ pkgs.nixos-icons ]);
+        ++ optionals cfg.doc.enable [ manual.manualHTML nixos-help ];

      services.getty.helpLine = mkIf cfg.doc.enable (
          "\nRun 'nixos-help' for the NixOS manual."
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -536,6 +536,7 @@
  ./services/misc/mwlib.nix
  ./services/misc/mx-puppet-discord.nix
  ./services/misc/n8n.nix
+  ./services/misc/nitter.nix
  ./services/misc/nix-daemon.nix
  ./services/misc/nix-gc.nix
  ./services/misc/nix-optimise.nix
--- a/nixos/modules/services/audio/hqplayerd.nix
+++ b/nixos/modules/services/audio/hqplayerd.nix
@ -56,22 +56,6 @@ in
          Open TCP port 8088 in the firewall for the server.
        '';
      };
-
-      user = mkOption {
-        type = types.str;
-        default = "hqplayer";
-        description = ''
-          User account under which hqplayerd runs.
-        '';
-      };
-
-      group = mkOption {
-        type = types.str;
-        default = "hqplayer";
-        description = ''
-          Group account under which hqplayerd runs.
-        '';
-      };
    };
  };

@ -100,68 +84,44 @@ in

    systemd = {
      tmpfiles.rules = [
-        "d ${configDir}      0755 ${cfg.user} ${cfg.group} - -"
-        "d ${stateDir}       0755 ${cfg.user} ${cfg.group} - -"
-        "d ${stateDir}/home  0755 ${cfg.user} ${cfg.group} - -"
+        "d ${configDir}      0755 hqplayer hqplayer - -"
+        "d ${stateDir}       0755 hqplayer hqplayer - -"
+        "d ${stateDir}/home  0755 hqplayer hqplayer - -"
      ];

+      packages = [ pkg ];
+
      services.hqplayerd = {
-        description = "HQPlayer daemon";
        wantedBy = [ "multi-user.target" ];
-        requires = [ "network-online.target" "sound.target" "systemd-udev-settle.service" ];
-        after = [ "network-online.target" "sound.target" "systemd-udev-settle.service" "local-fs.target" "remote-fs.target" "systemd-tmpfiles-setup.service" ];
+        after = [ "systemd-tmpfiles-setup.service" ];

        environment.HOME = "${stateDir}/home";

        unitConfig.ConditionPathExists = [ configDir stateDir ];

-        preStart =
-          let
-            blankCfg = pkgs.writeText "hqplayerd.xml" ''
-              <?xml version="1.0" encoding="utf-8"?>
-              <xml>
-              </xml>
-            '';
-          in
-          ''
-            cp -r "${pkg}/var/lib/hqplayer/web" "${stateDir}"
-            chmod -R u+wX "${stateDir}/web"
+        preStart = ''
+          cp -r "${pkg}/var/lib/hqplayer/web" "${stateDir}"
+          chmod -R u+wX "${stateDir}/web"

-            if [ ! -f "${configDir}/hqplayerd.xml" ]; then
-              echo "creating blank config file"
-              install -m 0644 "${blankCfg}" "${configDir}/hqplayerd.xml"
-            fi
-          '' + optionalString (cfg.auth.username != null && cfg.auth.password != null) ''
-            ${pkg}/bin/hqplayerd -s ${cfg.auth.username} ${cfg.auth.password}
-          '';
-
-        serviceConfig = {
-          ExecStart = "${pkg}/bin/hqplayerd";
-
-          User = cfg.user;
-          Group = cfg.group;
-
-          Restart = "on-failure";
-          RestartSec = 5;
-
-          Nice = -10;
-          IOSchedulingClass = "realtime";
-          LimitMEMLOCK = "1G";
-          LimitNICE = -10;
-          LimitRTPRIO = 98;
-        };
+          if [ ! -f "${configDir}/hqplayerd.xml" ]; then
+            echo "creating initial config file"
+            install -m 0644 "${pkg}/etc/hqplayer/hqplayerd.xml" "${configDir}/hqplayerd.xml"
+          fi
+        '' + optionalString (cfg.auth.username != null && cfg.auth.password != null) ''
+          ${pkg}/bin/hqplayerd -s ${cfg.auth.username} ${cfg.auth.password}
+        '';
      };
    };

-    users.groups = mkIf (cfg.group == "hqplayer") {
+    users.groups = {
      hqplayer.gid = config.ids.gids.hqplayer;
    };

-    users.users = mkIf (cfg.user == "hqplayer") {
+    users.users = {
      hqplayer = {
        description = "hqplayer daemon user";
        extraGroups = [ "audio" ];
-        group = cfg.group;
+        group = "hqplayer";
        uid = config.ids.uids.hqplayer;
      };
    };
--- a/nixos/modules/services/misc/nitter.nix
+++ b/nixos/modules/services/misc/nitter.nix
@ -0,0 +1,326 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.nitter;
+  configFile = pkgs.writeText "nitter.conf" ''
+    ${generators.toINI {
+      # String values need to be quoted
+      mkKeyValue = generators.mkKeyValueDefault {
+        mkValueString = v:
+          if isString v then "\"" + (strings.escape ["\""] (toString v)) + "\""
+          else generators.mkValueStringDefault {} v;
+      } " = ";
+    } (lib.recursiveUpdate {
+      Server = cfg.server;
+      Cache = cfg.cache;
+      Config = cfg.config // { hmacKey = "@hmac@"; };
+      Preferences = cfg.preferences;
+    } cfg.settings)}
+  '';
+  # `hmac` is a secret used for cryptographic signing of video URLs.
+  # Generate it on first launch, then copy configuration and replace
+  # `@hmac@` with this value.
+  # We are not using sed as it would leak the value in the command line.
+  preStart = pkgs.writers.writePython3 "nitter-prestart" {} ''
+    import os
+    import secrets
+
+    state_dir = os.environ.get("STATE_DIRECTORY")
+    if not os.path.isfile(f"{state_dir}/hmac"):
+        # Generate hmac on first launch
+        hmac = secrets.token_hex(32)
+        with open(f"{state_dir}/hmac", "w") as f:
+            f.write(hmac)
+    else:
+        # Load previously generated hmac
+        with open(f"{state_dir}/hmac", "r") as f:
+            hmac = f.read()
+
+    configFile = "${configFile}"
+    with open(configFile, "r") as f_in:
+        with open(f"{state_dir}/nitter.conf", "w") as f_out:
+            f_out.write(f_in.read().replace("@hmac@", hmac))
+  '';
+in
+{
+  options = {
+    services.nitter = {
+      enable = mkEnableOption "If enabled, start Nitter.";
+
+      server = {
+        address = mkOption {
+          type =  types.str;
+          default = "0.0.0.0";
+          example = "127.0.0.1";
+          description = "The address to listen on.";
+        };
+
+        port = mkOption {
+          type = types.port;
+          default = 8080;
+          example = 8000;
+          description = "The port to listen on.";
+        };
+
+        https = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Set secure attribute on cookies. Keep it disabled to enable cookies when not using HTTPS.";
+        };
+
+        httpMaxConnections = mkOption {
+          type = types.int;
+          default = 100;
+          description = "Maximum number of HTTP connections.";
+        };
+
+        staticDir = mkOption {
+          type = types.path;
+          default = "${pkgs.nitter}/share/nitter/public";
+          defaultText = "\${pkgs.nitter}/share/nitter/public";
+          description = "Path to the static files directory.";
+        };
+
+        title = mkOption {
+          type = types.str;
+          default = "nitter";
+          description = "Title of the instance.";
+        };
+
+        hostname = mkOption {
+          type = types.str;
+          default = "localhost";
+          example = "nitter.net";
+          description = "Hostname of the instance.";
+        };
+      };
+
+      cache = {
+        listMinutes = mkOption {
+          type = types.int;
+          default = 240;
+          description = "How long to cache list info (not the tweets, so keep it high).";
+        };
+
+        rssMinutes = mkOption {
+          type = types.int;
+          default = 10;
+          description = "How long to cache RSS queries.";
+        };
+
+        redisHost = mkOption {
+          type = types.str;
+          default = "localhost";
+          description = "Redis host.";
+        };
+
+        redisPort = mkOption {
+          type = types.port;
+          default = 6379;
+          description = "Redis port.";
+        };
+
+        redisConnections = mkOption {
+          type = types.int;
+          default = 20;
+          description = "Redis connection pool size.";
+        };
+
+        redisMaxConnections = mkOption {
+          type = types.int;
+          default = 30;
+          description = ''
+            Maximum number of connections to Redis.
+
+            New connections are opened when none are available, but if the
+            pool size goes above this, they are closed when released, do not
+            worry about this unless you receive tons of requests per second.
+          '';
+        };
+      };
+
+      config = {
+        base64Media = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Use base64 encoding for proxied media URLs.";
+        };
+
+        tokenCount = mkOption {
+          type = types.int;
+          default = 10;
+          description = ''
+            Minimum amount of usable tokens.
+
+            Tokens are used to authorize API requests, but they expire after
+            ~1 hour, and have a limit of 187 requests. The limit gets reset
+            every 15 minutes, and the pool is filled up so there is always at
+            least tokenCount usable tokens. Only increase this if you receive
+            major bursts all the time.
+          '';
+        };
+      };
+
+      preferences = {
+        replaceTwitter = mkOption {
+          type = types.str;
+          default = "";
+          example = "nitter.net";
+          description = "Replace Twitter links with links to this instance (blank to disable).";
+        };
+
+        replaceYouTube = mkOption {
+          type = types.str;
+          default = "";
+          example = "piped.kavin.rocks";
+          description = "Replace YouTube links with links to this instance (blank to disable).";
+        };
+
+        replaceInstagram = mkOption {
+          type = types.str;
+          default = "";
+          description = "Replace Instagram links with links to this instance (blank to disable).";
+        };
+
+        mp4Playback = mkOption {
+          type = types.bool;
+          default = true;
+          description = "Enable MP4 video playback.";
+        };
+
+        hlsPlayback = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Enable HLS video streaming (requires JavaScript).";
+        };
+
+        proxyVideos = mkOption {
+          type = types.bool;
+          default = true;
+          description = "Proxy video streaming through the server (might be slow).";
+        };
+
+        muteVideos = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Mute videos by default.";
+        };
+
+        autoplayGifs = mkOption {
+          type = types.bool;
+          default = true;
+          description = "Autoplay GIFs.";
+        };
+
+        theme = mkOption {
+          type = types.str;
+          default = "Nitter";
+          description = "Instance theme.";
+        };
+
+        infiniteScroll = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Infinite scrolling (requires JavaScript, experimental!).";
+        };
+
+        stickyProfile = mkOption {
+          type = types.bool;
+          default = true;
+          description = "Make profile sidebar stick to top.";
+        };
+
+        bidiSupport = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Support bidirectional text (makes clicking on tweets harder).";
+        };
+
+        hideTweetStats = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Hide tweet stats (replies, retweets, likes).";
+        };
+
+        hideBanner = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Hide profile banner.";
+        };
+
+        hidePins = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Hide pinned tweets.";
+        };
+
+        hideReplies = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Hide tweet replies.";
+        };
+      };
+
+      settings = mkOption {
+        type = types.attrs;
+        default = {};
+        description = ''
+          Add settings here to override NixOS module generated settings.
+
+          Check the official repository for the available settings:
+          https://github.com/zedeus/nitter/blob/master/nitter.conf
+        '';
+      };
+
+      redisCreateLocally = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Configure local Redis server for Nitter.";
+      };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Open ports in the firewall for Nitter web interface.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !cfg.redisCreateLocally || (cfg.cache.redisHost == "localhost" && cfg.cache.redisPort == 6379);
+        message = "When services.nitter.redisCreateLocally is enabled, you need to use localhost:6379 as a cache server.";
+      }
+    ];
+
+    systemd.services.nitter = {
+        description = "Nitter (An alternative Twitter front-end)";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "syslog.target" "network.target" ];
+        serviceConfig = {
+          DynamicUser = true;
+          StateDirectory = "nitter";
+          Environment = [ "NITTER_CONF_FILE=/var/lib/nitter/nitter.conf" ];
+          # Some parts of Nitter expect `public` folder in working directory,
+          # see https://github.com/zedeus/nitter/issues/414
+          WorkingDirectory = "${pkgs.nitter}/share/nitter";
+          ExecStart = "${pkgs.nitter}/bin/nitter";
+          ExecStartPre = "${preStart}";
+          AmbientCapabilities = lib.mkIf (cfg.server.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
+          Restart = "on-failure";
+          RestartSec = "5s";
+        };
+    };
+
+    services.redis = lib.mkIf (cfg.redisCreateLocally) {
+      enable = true;
+    };
+
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.server.port ];
+    };
+  };
+}
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@ -657,6 +657,7 @@ in
        pkgs.xterm
        pkgs.xdg-utils
        xorg.xf86inputevdev.out # get evdev.4 man page
+        pkgs.nixos-icons # needed for gnome and pantheon about dialog, nixos-manual and maybe more
      ]
      ++ optional (elem "virtualbox" cfg.videoDrivers) xorg.xrefresh;

--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -301,6 +301,7 @@ in
  nginx-sandbox = handleTestOn ["x86_64-linux"] ./nginx-sandbox.nix {};
  nginx-sso = handleTest ./nginx-sso.nix {};
  nginx-variants = handleTest ./nginx-variants.nix {};
+  nitter = handleTest ./nitter.nix {};
  nix-serve = handleTest ./nix-ssh-serve.nix {};
  nix-ssh-serve = handleTest ./nix-ssh-serve.nix {};
  nixos-generate-config = handleTest ./nixos-generate-config.nix {};
--- a/nixos/tests/nitter.nix
+++ b/nixos/tests/nitter.nix
@ -0,0 +1,16 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+
+{
+  name = "nitter";
+  meta.maintainers = with pkgs.lib.maintainers; [ erdnaxe ];
+
+  nodes.machine = {
+    services.nitter.enable = true;
+  };
+
+  testScript = ''
+    machine.wait_for_unit("nitter.service")
+    machine.wait_for_open_port("8080")
+    machine.succeed("curl --fail http://localhost:8080/")
+  '';
+})
--- a/pkgs/applications/graphics/glimpse/default.nix
+++ b/pkgs/applications/graphics/glimpse/default.nix
@ -51,6 +51,7 @@
 , makeWrapper
 , autoreconfHook
 , gtk-doc
+, graphviz
 }:
 let
  python = python2.withPackages (pp: [ pp.pygtk ]);
@ -154,7 +155,8 @@ stdenv.mkDerivation rec {

  postFixup = ''
    wrapProgram $out/bin/glimpse-${lib.versions.majorMinor version} \
-      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE"
+      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
+      --prefix PATH ":" ${ lib.makeBinPath [ graphviz ] }
  '';

  passthru = rec {
--- a/pkgs/applications/misc/gollum/Gemfile
+++ b/pkgs/applications/misc/gollum/Gemfile
@ -1,2 +1,8 @@
 source 'https://rubygems.org'
 gem 'gollum'
+
+gem 'asciidoctor'
+gem 'creole'
+gem 'wikicloth'
+gem 'org-ruby'
+gem 'RedCloth'
--- a/pkgs/applications/misc/gollum/Gemfile.lock
+++ b/pkgs/applications/misc/gollum/Gemfile.lock
@ -1,9 +1,14 @@
 GEM
  remote: https://rubygems.org/
  specs:
+    RedCloth (4.3.2)
+    asciidoctor (2.0.15)
+    builder (3.2.4)
    concurrent-ruby (1.1.8)
    crass (1.0.6)
+    creole (0.5.0)
    execjs (2.7.0)
+    expression_parser (0.9.0)
    ffi (1.14.2)
    gemojione (4.3.3)
      json
@ -36,6 +41,7 @@ GEM
    gollum-rugged_adapter (1.0)
      mime-types (>= 1.15)
      rugged (~> 0.99)
+    htmlentities (4.3.4)
    json (2.5.1)
    kramdown (2.3.0)
      rexml
@ -59,6 +65,8 @@ GEM
      racc (~> 1.4)
    octicons (12.1.0)
      nokogiri (>= 1.6.3.1)
+    org-ruby (0.9.12)
+      rubypants (~> 0.2)
    racc (1.5.2)
    rack (2.2.3)
    rack-protection (2.1.0)
@ -71,6 +79,7 @@ GEM
    rss (0.2.9)
      rexml
    ruby2_keywords (0.0.4)
+    rubypants (0.7.1)
    rugged (0.99.0)
    sass (3.7.4)
      sass-listen (~> 4.0.0)
@ -105,12 +114,23 @@ GEM
      unf_ext
    unf_ext (0.0.7.7)
    useragent (0.16.10)
+    wikicloth (0.8.3)
+      builder
+      expression_parser
+      htmlentities
+      nokogiri
+      twitter-text

 PLATFORMS
  ruby

 DEPENDENCIES
+  RedCloth
+  asciidoctor
+  creole
  gollum
+  org-ruby
+  wikicloth

 BUNDLED WITH
-   2.1.4
+   2.2.20
--- a/pkgs/applications/misc/gollum/default.nix
+++ b/pkgs/applications/misc/gollum/default.nix
@ -1,5 +1,5 @@
 { lib, stdenv, bundlerEnv, ruby, makeWrapper, bundlerUpdateScript
-, git }:
+, git, docutils, perl }:

 stdenv.mkDerivation rec {
  pname = "gollum";
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
  in ''
    mkdir -p $out/bin
    makeWrapper ${env}/bin/gollum $out/bin/gollum \
-      --prefix PATH ":" ${lib.makeBinPath [ git ]}
+      --prefix PATH ":" ${lib.makeBinPath [ git docutils perl]}
    makeWrapper ${env}/bin/gollum-migrate-tags $out/bin/gollum-migrate-tags \
      --prefix PATH ":" ${lib.makeBinPath [ git ]}
  '';
--- a/pkgs/applications/misc/gollum/gemset.nix
+++ b/pkgs/applications/misc/gollum/gemset.nix
@ -1,4 +1,24 @@
 {
+  asciidoctor = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0k3lijm4dmiz977bfmpclk5glj5jwv7bidamwwwywm60ywb0n4n4";
+      type = "gem";
+    };
+    version = "2.0.15";
+  };
+  builder = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "045wzckxpwcqzrjr353cxnyaxgf0qg22jh00dcx7z38cys5g1jlr";
+      type = "gem";
+    };
+    version = "3.2.4";
+  };
  concurrent-ruby = {
    groups = ["default"];
    platforms = [];
@ -19,6 +39,16 @@
    };
    version = "1.0.6";
  };
+  creole = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "00rcscz16idp6dx0dk5yi5i0fz593i3r6anbn5bg2q07v3i025wm";
+      type = "gem";
+    };
+    version = "0.5.0";
+  };
  execjs = {
    groups = ["default"];
    platforms = [];
@ -29,6 +59,16 @@
    };
    version = "2.7.0";
  };
+  expression_parser = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1938z3wmmdabqxlh5d5c56xfg1jc6z15p7zjyhvk7364zwydnmib";
+      type = "gem";
+    };
+    version = "0.9.0";
+  };
  ffi = {
    groups = ["default"];
    platforms = [];
@ -93,6 +133,16 @@
    };
    version = "1.0";
  };
+  htmlentities = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1nkklqsn8ir8wizzlakncfv42i32wc0w9hxp00hvdlgjr7376nhj";
+      type = "gem";
+    };
+    version = "4.3.4";
+  };
  json = {
    groups = ["default"];
    platforms = [];
@ -231,6 +281,17 @@
    };
    version = "12.1.0";
  };
+  org-ruby = {
+    dependencies = ["rubypants"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0x69s7aysfiwlcpd9hkvksfyld34d8kxr62adb59vjvh8hxfrjwk";
+      type = "gem";
+    };
+    version = "0.9.12";
+  };
  racc = {
    groups = ["default"];
    platforms = [];
@ -283,6 +344,16 @@
    };
    version = "0.10.1";
  };
+  RedCloth = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0m9dv7ya9q93r8x1pg2gi15rxlbck8m178j1fz7r5v6wr1avrrqy";
+      type = "gem";
+    };
+    version = "4.3.2";
+  };
  rexml = {
    groups = ["default"];
    platforms = [];
@ -324,6 +395,16 @@
    };
    version = "0.0.4";
  };
+  rubypants = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0kv2way45d2dz3h5b7wxyw36clvlwrz7ydf6699d0za5vm56gsrh";
+      type = "gem";
+    };
+    version = "0.7.1";
+  };
  rugged = {
    groups = ["default"];
    platforms = [];
@ -484,4 +565,15 @@
    };
    version = "0.16.10";
  };
+  wikicloth = {
+    dependencies = ["builder" "expression_parser" "htmlentities" "nokogiri" "twitter-text"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0c78r1rg93mb5rcrfxl01b162ma9sh46dhjksc4c9dngg62nhbjh";
+      type = "gem";
+    };
+    version = "0.8.3";
+  };
 }
--- a/pkgs/applications/misc/gramps/default.nix
+++ b/pkgs/applications/misc/gramps/default.nix
@ -9,7 +9,7 @@
 let
  inherit (pythonPackages) python buildPythonApplication;
 in buildPythonApplication rec {
-  version = "5.1.3";
+  version = "5.1.4";
  pname = "gramps";

  nativeBuildInputs = [ wrapGAppsHook intltool gettext ];
@ -26,7 +26,7 @@ in buildPythonApplication rec {
    owner = "gramps-project";
    repo = "gramps";
    rev = "v${version}";
-    sha256 = "109dwkswz2h2328xkqk2zj736d117s9pp7rz5cc1qg2vxn1lpm93";
+    sha256 = "00358nzyw686ypqv45imc5k9frcqnhla0hpx9ynna3iy6iz5006x";
  };

  pythonPath = with pythonPackages; [ bsddb3 PyICU pygobject3 pycairo ];
--- a/pkgs/applications/networking/cluster/helmfile/default.nix
+++ b/pkgs/applications/networking/cluster/helmfile/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "helmfile";
-  version = "0.139.9";
+  version = "0.140.0";

  src = fetchFromGitHub {
    owner = "roboll";
    repo = "helmfile";
    rev = "v${version}";
-    sha256 = "sha256-MHvfDeN4r9jwnXANHTpMEQUIoAZ+uXAmDtl8wdcpjHI=";
+    sha256 = "sha256-Y1BlvUudxEZ1G893dwYU+R6k2QAYohx4+0yysYaUM0E=";
  };

  vendorSha256 = "sha256-QYI5HxEUNrZKSjk0LlbhjvxXlWCbbLup51Ht3HJDNC8=";
--- a/pkgs/applications/networking/cluster/octant/default.nix
+++ b/pkgs/applications/networking/cluster/octant/default.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "octant";
-  version = "0.22.0";
+  version = "0.23.0";

  src =
    let
@ -19,10 +19,10 @@ stdenv.mkDerivation rec {
      };
    in
    fetchsrc version {
-      x86_64-linux = "sha256-1/vyV6pUqovVpovTYFF4d75wJvtTNdrbLZyjw1lLacA=";
-      aarch64-linux = "sha256-1duNW0Edj0jrpv/RMrebtZF4ph6j3PXCJ2RFejOopGQ=";
-      x86_64-darwin = "sha256-Ur5jBPk5hA6cGg+pPf36Ijh94gWEdaWlJK3yCMBYyEU=";
-      aarch64-darwin = "sha256-RaiXW+MUihk291UWmrf6gLpyrd5stIkhyWNFEQ0daCk=";
+      x86_64-linux = "sha256-wnm4Zprlao+zbWVJNY4BsAT1fFMft7luyDaW2HfNotg=";
+      aarch64-linux = "sha256-eYvfLUelSrmdY9dbgAlPm7en88hsdCnejJGq2Gz4DN0=";
+      x86_64-darwin = "sha256-NXMQ4mbYfIK+arGWZVhQk5iAw6AZM9PAGJ9CEC/rmgA=";
+      aarch64-darwin = "sha256-WqlbiDV2CuBYr6IXQ8vaESxKNZGp9vBj683igazcmwM=";
    };

  dontConfigure = true;
--- a/pkgs/applications/networking/cluster/octant/desktop.nix
+++ b/pkgs/applications/networking/cluster/octant/desktop.nix
@ -2,7 +2,7 @@

 let
  pname = "octant-desktop";
-  version = "0.22.0";
+  version = "0.23.0";
  name = "${pname}-${version}";

  inherit (stdenv.hostPlatform) system;
@ -15,8 +15,8 @@ let
  src = fetchurl {
    url = "https://github.com/vmware-tanzu/octant/releases/download/v${version}/Octant-${version}.${suffix}";
    sha256 = {
-      x86_64-linux = "sha256-xMdNoH0UE/KLIQ0DjJfb+ZB/q2F+kyFEncrQ9YYJgE0=";
-      x86_64-darwin = "sha256-y3fmxrsQ0hCa1wuMiRGHf79kpi25qXv/idKrVT87oc0=";
+      x86_64-linux = "sha256-K4z6SVCiuqy3xkWMWpm8KM7iYVXyKcnERljMG3NEFMw=";
+      x86_64-darwin = "sha256-WYra0yw/aPW/wUGrlIn5ud3kjFTkekYEi2LWZcYO5Nw=";
    }.${system};
  };

--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -195,8 +195,8 @@ rec {
  };

  terraform_1_0 = mkTerraform {
-    version = "1.0.3";
-    sha256 = "0m7r66nw0nppra90sjhbq5d0f4q525c73q6ncmy6w37j2nixz35z";
+    version = "1.0.4";
+    sha256 = "09g0ln247scv8mj40gxhkij0li62v0rjm2bsgmvl953aj7g3dlh1";
    vendorSha256 = "07pzqvf9lwgc1fadmyam5hn7arlvzrjsplls445738jpn61854gg";
    patches = [ ./provider-path-0_15.patch ];
    passthru = { inherit plugins; };
--- a/pkgs/applications/version-management/git-and-tools/gh/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gh/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "gh";
-  version = "1.13.1";
+  version = "1.14.0";

  src = fetchFromGitHub {
    owner = "cli";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-6ur1ZIJRghkZk5tLMJUmKn+XfjVGFE0MRSQ/Uz+Eans=";
+    sha256 = "sha256-JCuJliBr1IPdwGG9T0Bx5DhtHw8tJ45mteRLxRbkyio=";
  };

-  vendorSha256 = "sha256-JJNyzMYAQT/pS1+eGYQsUpxDiwa6DP7JWhIBuTtnOiE=";
+  vendorSha256 = "sha256-6H56jf4QV+DdsiCetyhpXp6NHc86Hzo+CuqF06dL26A=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@ -31,20 +31,19 @@
 , nixosTestRunner ? false
 }:

-with lib;
 let
-  audio = optionalString alsaSupport "alsa,"
-    + optionalString pulseSupport "pa,"
-    + optionalString sdlSupport "sdl,";
+  audio = lib.optionalString alsaSupport "alsa,"
+    + lib.optionalString pulseSupport "pa,"
+    + lib.optionalString sdlSupport "sdl,";

 in

 stdenv.mkDerivation rec {
-  version = "6.0.0";
  pname = "qemu"
    + lib.optionalString xenSupport "-xen"
    + lib.optionalString hostCpuOnly "-host-cpu-only"
    + lib.optionalString nixosTestRunner "-for-vm-tests";
+  version = "6.0.0";

  src = fetchurl {
    url= "https://download.qemu.org/qemu-${version}.tar.xz";
@ -52,32 +51,32 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ python python.pkgs.sphinx pkg-config flex bison meson ninja ]
-    ++ optionals gtkSupport [ wrapGAppsHook ]
-    ++ optionals stdenv.isLinux [ autoPatchelfHook ];
-  buildInputs =
-    [ zlib glib perl pixman
-      vde2 texinfo makeWrapper lzo snappy
-      gnutls nettle curl
-    ]
-    ++ optionals ncursesSupport [ ncurses ]
-    ++ optionals stdenv.isDarwin [ CoreServices Cocoa Hypervisor rez setfile ]
-    ++ optionals seccompSupport [ libseccomp ]
-    ++ optionals numaSupport [ numactl ]
-    ++ optionals pulseSupport [ libpulseaudio ]
-    ++ optionals sdlSupport [ SDL2 SDL2_image ]
-    ++ optionals gtkSupport [ gtk3 gettext vte ]
-    ++ optionals vncSupport [ libjpeg libpng ]
-    ++ optionals smartcardSupport [ libcacard ]
-    ++ optionals spiceSupport [ spice-protocol spice ]
-    ++ optionals usbredirSupport [ usbredir ]
-    ++ optionals stdenv.isLinux [ alsa-lib libaio libcap_ng libcap attr ]
-    ++ optionals xenSupport [ xen ]
-    ++ optionals cephSupport [ ceph ]
-    ++ optionals glusterfsSupport [ glusterfs libuuid ]
-    ++ optionals openGLSupport [ mesa epoxy libdrm ]
-    ++ optionals virglSupport [ virglrenderer ]
-    ++ optionals libiscsiSupport [ libiscsi ]
-    ++ optionals smbdSupport [ samba ];
+    ++ lib.optionals gtkSupport [ wrapGAppsHook ]
+    ++ lib.optionals stdenv.isLinux [ autoPatchelfHook ];
+
+  buildInputs = [ zlib glib perl pixman
+    vde2 texinfo makeWrapper lzo snappy
+    gnutls nettle curl
+  ]
+    ++ lib.optionals ncursesSupport [ ncurses ]
+    ++ lib.optionals stdenv.isDarwin [ CoreServices Cocoa Hypervisor rez setfile ]
+    ++ lib.optionals seccompSupport [ libseccomp ]
+    ++ lib.optionals numaSupport [ numactl ]
+    ++ lib.optionals pulseSupport [ libpulseaudio ]
+    ++ lib.optionals sdlSupport [ SDL2 SDL2_image ]
+    ++ lib.optionals gtkSupport [ gtk3 gettext vte ]
+    ++ lib.optionals vncSupport [ libjpeg libpng ]
+    ++ lib.optionals smartcardSupport [ libcacard ]
+    ++ lib.optionals spiceSupport [ spice-protocol spice ]
+    ++ lib.optionals usbredirSupport [ usbredir ]
+    ++ lib.optionals stdenv.isLinux [ alsa-lib libaio libcap_ng libcap attr ]
+    ++ lib.optionals xenSupport [ xen ]
+    ++ lib.optionals cephSupport [ ceph ]
+    ++ lib.optionals glusterfsSupport [ glusterfs libuuid ]
+    ++ lib.optionals openGLSupport [ mesa epoxy libdrm ]
+    ++ lib.optionals virglSupport [ virglrenderer ]
+    ++ lib.optionals libiscsiSupport [ libiscsi ]
+    ++ lib.optionals smbdSupport [ samba ];

  dontUseMesonConfigure = true; # meson's configurePhase isn't compatible with qemu build

@ -96,8 +95,8 @@ stdenv.mkDerivation rec {
      url = "https://gitlab.com/qemu-project/qemu/-/commit/9f22893adcb02580aee5968f32baa2cd109b3ec2.patch";
      sha256 = "1vkhm9vl671y4cra60b6704339qk1h5dyyb3dfvmvpsvfyh2pm7n";
    })
-  ] ++ optional nixosTestRunner ./force-uid0-on-9p.patch
-    ++ optionals stdenv.hostPlatform.isMusl [
+  ] ++ lib.optional nixosTestRunner ./force-uid0-on-9p.patch
+    ++ lib.optionals stdenv.hostPlatform.isMusl [
    (fetchpatch {
      url = "https://raw.githubusercontent.com/alpinelinux/aports/2bb133986e8fa90e2e76d53369f03861a87a74ef/main/qemu/xattr_size_max.patch";
      sha256 = "1xfdjs1jlvs99hpf670yianb8c3qz2ars8syzyz8f2c2cp5y4bxb";
@ -149,36 +148,35 @@ stdenv.mkDerivation rec {
      --replace '$source_path/VERSION' '$source_path/QEMU_VERSION'
    substituteInPlace meson.build \
      --replace "'VERSION'" "'QEMU_VERSION'"
-  '' + optionalString stdenv.hostPlatform.isMusl ''
+  '' + lib.optionalString stdenv.hostPlatform.isMusl ''
    NIX_CFLAGS_COMPILE+=" -D_LINUX_SYSINFO_H"
  '';

-  configureFlags =
-    [ "--audio-drv-list=${audio}"
-      "--enable-docs"
-      "--enable-tools"
-      "--enable-guest-agent"
-      "--localstatedir=/var"
-      "--sysconfdir=/etc"
-    ]
-    ++ optional numaSupport "--enable-numa"
-    ++ optional seccompSupport "--enable-seccomp"
-    ++ optional smartcardSupport "--enable-smartcard"
-    ++ optional spiceSupport "--enable-spice"
-    ++ optional usbredirSupport "--enable-usb-redir"
-    ++ optional (hostCpuTargets != null) "--target-list=${lib.concatStringsSep "," hostCpuTargets}"
-    ++ optional stdenv.isDarwin "--enable-cocoa"
-    ++ optional stdenv.isDarwin "--enable-hvf"
-    ++ optional stdenv.isLinux "--enable-linux-aio"
-    ++ optional gtkSupport "--enable-gtk"
-    ++ optional xenSupport "--enable-xen"
-    ++ optional cephSupport "--enable-rbd"
-    ++ optional glusterfsSupport "--enable-glusterfs"
-    ++ optional openGLSupport "--enable-opengl"
-    ++ optional virglSupport "--enable-virglrenderer"
-    ++ optional tpmSupport "--enable-tpm"
-    ++ optional libiscsiSupport "--enable-libiscsi"
-    ++ optional smbdSupport "--smbd=${samba}/bin/smbd";
+  configureFlags = [
+    "--audio-drv-list=${audio}"
+    "--enable-docs"
+    "--enable-tools"
+    "--enable-guest-agent"
+    "--localstatedir=/var"
+    "--sysconfdir=/etc"
+  ] ++ lib.optional numaSupport "--enable-numa"
+    ++ lib.optional seccompSupport "--enable-seccomp"
+    ++ lib.optional smartcardSupport "--enable-smartcard"
+    ++ lib.optional spiceSupport "--enable-spice"
+    ++ lib.optional usbredirSupport "--enable-usb-redir"
+    ++ lib.optional (hostCpuTargets != null) "--target-list=${lib.concatStringsSep "," hostCpuTargets}"
+    ++ lib.optional stdenv.isDarwin "--enable-cocoa"
+    ++ lib.optional stdenv.isDarwin "--enable-hvf"
+    ++ lib.optional stdenv.isLinux "--enable-linux-aio"
+    ++ lib.optional gtkSupport "--enable-gtk"
+    ++ lib.optional xenSupport "--enable-xen"
+    ++ lib.optional cephSupport "--enable-rbd"
+    ++ lib.optional glusterfsSupport "--enable-glusterfs"
+    ++ lib.optional openGLSupport "--enable-opengl"
+    ++ lib.optional virglSupport "--enable-virglrenderer"
+    ++ lib.optional tpmSupport "--enable-tpm"
+    ++ lib.optional libiscsiSupport "--enable-libiscsi"
+    ++ lib.optional smbdSupport "--smbd=${samba}/bin/smbd";

  doCheck = false; # tries to access /dev
  dontWrapGApps = true;
@ -190,7 +188,7 @@ stdenv.mkDerivation rec {
    # copy qemu-ga (guest agent) to separate output
    mkdir -p $ga/bin
    cp $out/bin/qemu-ga $ga/bin/
-  '' + optionalString gtkSupport ''
+  '' + lib.optionalString gtkSupport ''
    # wrap GTK Binaries
    for f in $out/bin/qemu-system-*; do
      wrapGApp $f
--- a/pkgs/development/compilers/dictu/0001-force-sqlite-to-be-found.patch
+++ b/pkgs/development/compilers/dictu/0001-force-sqlite-to-be-found.patch
@ -0,0 +1,46 @@
+From bb4767f8fc413ca4cb42879a9a226fd26f10e094 Mon Sep 17 00:00:00 2001
+From: Lucas Ransan <lucas@ransan.tk>
+Date: Tue, 3 Aug 2021 20:39:11 +0200
+Subject: [PATCH] force sqlite to be found
+
+---
+ src/CMakeLists.txt | 16 +++++-----------
+ 1 file changed, 5 insertions(+), 11 deletions(-)
+
+diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
+index a0f3fee..58b4d0b 100644
+--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
+@@ -9,7 +9,7 @@ set(INCLUDE_DIR include/)
+ list(FILTER sources EXCLUDE REGEX "(main|linenoise|utf8).c")
+ list(FILTER headers EXCLUDE REGEX "(linenoise|utf8).h")
+ 
+-find_library(SQLITE_LIB SQLite3)
+find_package(SQLite3 REQUIRED)
+ set(THREADS)
+ 
+ if(DISABLE_HTTP)
+@@ -20,16 +20,10 @@ else()
+     list(APPEND libraries curl)
+ endif()
+ 
+-if(NOT SQLITE_LIB)
+-    set(THREADS_PREFER_PTHREAD_FLAG ON)
+-    find_package(Threads REQUIRED)
+-    set(THREADS Threads::Threads)
+-else()
+-    list(FILTER sources EXCLUDE REGEX "sqlite3.c")
+-    list(FILTER headers EXCLUDE REGEX "sqlite3.h")
+-    list(APPEND libraries ${SQLITE_LIB})
+-    add_compile_definitions(INCLUDE_SQLITE_LIB)
+-endif()
+list(FILTER sources EXCLUDE REGEX "sqlite3.c")
+list(FILTER headers EXCLUDE REGEX "sqlite3.h")
+list(APPEND libraries ${SQLite3_LIBRARIES})
+add_compile_definitions(SQLite3_INCLUDE_DIR)
+ 
+ if(WIN32)
+     # ws2_32 is required for winsock2.h to work correctly
+-- 
+2.32.0
+
--- a/pkgs/development/compilers/dictu/default.nix
+++ b/pkgs/development/compilers/dictu/default.nix
@ -0,0 +1,84 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, sqlite
+, httpSupport ? true, curl
+, cliSupport ? true
+, linenoiseSupport ? cliSupport, linenoise
+, enableLTO ? stdenv.cc.isGNU
+}:
+
+assert enableLTO -> stdenv.cc.isGNU;
+
+stdenv.mkDerivation rec {
+  pname = "dictu";
+  version = "0.19.0";
+
+  src = fetchFromGitHub {
+    owner = "dictu-lang";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "5Sfmzz4I0dhcbz14LmXx5cHELRFENunLbZmU93uSEJo=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [
+    sqlite
+  ] ++ lib.optional httpSupport curl
+  ++ lib.optional linenoiseSupport linenoise;
+
+  patches = [
+    ./0001-force-sqlite-to-be-found.patch
+  ];
+
+  postPatch = lib.optionalString (!enableLTO) ''
+    sed -i src/CMakeLists.txt \
+        -e 's/-flto/${lib.optionalString stdenv.cc.isGNU "-Wno-error=format-truncation"}/'
+  '';
+
+  cmakeFlags = [
+    "-DBUILD_CLI=${if cliSupport then "ON" else "OFF"}"
+    "-DDISABLE_HTTP=${if httpSupport then "OFF" else "ON"}"
+    "-DDISABLE_LINENOISE=${if linenoiseSupport then "OFF" else "ON"}"
+  ] ++ lib.optionals enableLTO [ # TODO: LTO with LLVM
+    "-DCMAKE_AR=${stdenv.cc.cc}/bin/gcc-ar"
+    "-DCMAKE_RANLIB=${stdenv.cc.cc}/bin/gcc-ranlib"
+  ];
+
+  doCheck = cliSupport;
+
+  preCheck = ''
+    cd ..
+    sed -i tests/runTests.du \
+        -e '/http/d'
+    sed -i tests/path/realpath.du \
+        -e 's/usr/build/g'
+    sed -i tests/path/isDir.du \
+        -e 's,/usr/bin,/build/source,' \
+        -e '/home/d'
+  '';
+
+  checkPhase = ''
+    runHook preCheck
+    ./dictu tests/runTests.du
+  '';
+
+  installPhase = ''
+    mkdir -p $out
+    cp -r /build/source/src/include $out/include
+    mkdir -p $out/lib
+    cp /build/source/build/src/libdictu_api* $out/lib
+  '' + lib.optionalString cliSupport ''
+    install -Dm755 /build/source/dictu $out/bin/dictu
+  '';
+
+  meta = with lib; {
+    description = "High-level dynamically typed, multi-paradigm, interpreted programming language";
+    homepage = "https://dictu-lang.com";
+    license = licenses.mit;
+    maintainers = with maintainers; [ luc65r ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/development/compilers/graalvm/community-edition.nix
+++ b/pkgs/development/compilers/graalvm/community-edition.nix
@ -1,288 +0,0 @@
-{ stdenv
-, lib
-, fetchurl
-, autoPatchelfHook
-, setJavaClassPath
-, makeWrapper
-# minimum dependencies
-, Foundation
-, alsa-lib
-, fontconfig
-, freetype
-, glibc
-, openssl
-, perl
-, unzip
-, xorg
-, zlib
-# runtime dependencies
-, cups
-# runtime dependencies for GTK+ Look and Feel
-, gtkSupport ? true
-, cairo
-, glib
-, gtk3
-}:
-
-let
-  platform = if stdenv.isDarwin then "darwin-amd64" else "linux-amd64";
-  runtimeDependencies = [
-    cups
-  ] ++ lib.optionals gtkSupport [
-    cairo glib gtk3
-  ];
-  runtimeLibraryPath = lib.makeLibraryPath runtimeDependencies;
-  common = javaVersion:
-    let
-      javaVersionPlatform = "${javaVersion}-${platform}";
-      graalvmXXX-ce = stdenv.mkDerivation rec {
-        pname = "graalvm${javaVersion}-ce";
-        version = "21.0.0";
-        srcs = [
-          (fetchurl {
-             sha256 = {  "8-linux-amd64"  = "18q1plrpclp02rlwn3vvv2fcyspvqv2gkzn14f0b59pnladmlv1j";
-                        "11-linux-amd64"  = "1g1xjbr693rimdy2cy6jvz4vgnbnw76wa87xcmaszka206fmpnsc";
-                         "8-darwin-amd64" = "0giv8f7ybdykadzmxjy91i6njbdx6dclyx7g6vyhwk2l1cvxi4li";
-                        "11-darwin-amd64" = "1a8gjp6fp11ms05pd62h1x1ifkkr3wv0hrxic670v90bbps9lsqf";
-                      }.${javaVersionPlatform};
-             url    = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${version}/graalvm-ce-java${javaVersionPlatform}-${version}.tar.gz";
-          })
-          (fetchurl {
-             sha256 = {  "8-linux-amd64"  = "0hpq2g9hc8b7j4d8a08kq1mnl6pl7a4kwaj0a3gka3d4m6r7cscg";
-                        "11-linux-amd64"  = "0z3hb2bf0lqzw760civ3h1wvx22a75n7baxc0l2i9h5wxas002y7";
-                         "8-darwin-amd64" = "1izbgl4hjg5jyi422xnkx006qnw163r1i1djf76q1plms40y01ph";
-                        "11-darwin-amd64" = "1d9z75gil0if74ndla9yw3xx9i2bfbcs32qa0z6wi5if66cmknb8";
-                      }.${javaVersionPlatform};
-             url    = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${version}/native-image-installable-svm-java${javaVersionPlatform}-${version}.jar";
-          })
-          (fetchurl {
-             sha256 = {  "8-linux-amd64"  = "122p8psgmzhqnjb2fy1lwghg0kw5qa8xkzgyjp682lwg4j8brz43";
-                        "11-linux-amd64"  = "1vdc90m6s013cbhmj58nb4vyxllbxirw0idlgv0iv9cyhx90hzgz";
-                         "8-darwin-amd64" = "04q0s9xsaskqn9kbhz0mgdk28j2qnxrzqfmw6jn2znr8s8jsc6yp";
-                        "11-darwin-amd64" = "1pw4xd8g5cc9bm52awmm1zxs96ijws43vws7y10wxa6a0nhv7z5f";
-                      }.${javaVersionPlatform};
-             url    = "https://github.com/oracle/truffleruby/releases/download/vm-${version}/ruby-installable-svm-java${javaVersionPlatform}-${version}.jar";
-          })
-          (fetchurl {
-             sha256 = {  "8-linux-amd64"  = "19m7n4f5jrmsfvgv903sarkcjh55l0nlnw99lvjlcafw5hqzyb91";
-                        "11-linux-amd64"  = "18ibb7l7b4hmbnvyr8j7mrs11mvlsf2j0c8rdd2s93x2114f26ba";
-                         "8-darwin-amd64" = "1zlzi00339kvg4ym2j75ypfkzn8zbwdpriqmkaz4fh28qjmc1dwq";
-                        "11-darwin-amd64" = "0x301i1fimakhi2x29ldr0fsqkb3qs0g9jsmjv27d62dpqx8kgc8";
-                      }.${javaVersionPlatform};
-             url    = "https://github.com/graalvm/graalpython/releases/download/vm-${version}/python-installable-svm-java${javaVersionPlatform}-${version}.jar";
-          })
-          (fetchurl {
-             sha256 = {  "8-linux-amd64"  = "0dlgbg6kri89r9zbk6n0ch3g8356j1g35bwjng87c2y5y0vcw0b5";
-                        "11-linux-amd64"  = "1yby65hww6zmd2g5pjwbq5pv3iv4gfv060b8fq75fjhwrisyj5gd";
-                         "8-darwin-amd64" = "1smdj491g23i3z7p5rybid18nnz8bphrqjkv0lg2ffyrpn8k6g93";
-                        "11-darwin-amd64" = "056zyn0lpd7741k1szzjwwacka0g7rn0j4ypfmav4h1245mjg8lx";
-                      }.${javaVersionPlatform};
-             url    = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${version}/wasm-installable-svm-java${javaVersionPlatform}-${version}.jar";
-          })
-        ];
-
-        buildInputs = lib.optionals stdenv.isLinux [
-          alsa-lib # libasound.so wanted by lib/libjsound.so
-          fontconfig
-          freetype
-          openssl # libssl.so wanted by languages/ruby/lib/mri/openssl.so
-          stdenv.cc.cc.lib # libstdc++.so.6
-          xorg.libX11
-          xorg.libXext
-          xorg.libXi
-          xorg.libXrender
-          xorg.libXtst
-          zlib
-        ];
-
-        # Workaround for libssl.so.10 wanted by TruffleRuby
-        # Resulting TruffleRuby cannot use `openssl` library.
-        autoPatchelfIgnoreMissingDeps = true;
-
-        nativeBuildInputs = [ unzip perl autoPatchelfHook makeWrapper ];
-
-        unpackPhase = ''
-           unpack_jar() {
-             jar=$1
-             unzip -q -o $jar -d $out
-             perl -ne 'use File::Path qw(make_path);
-                       use File::Basename qw(dirname);
-                       if (/^(.+) = (.+)$/) {
-                         make_path dirname("$ENV{out}/$1");
-                         system "ln -s $2 $ENV{out}/$1";
-                       }' $out/META-INF/symlinks
-             perl -ne 'if (/^(.+) = ([r-])([w-])([x-])([r-])([w-])([x-])([r-])([w-])([x-])$/) {
-                         my $mode = ($2 eq 'r' ? 0400 : 0) + ($3 eq 'w' ? 0200 : 0) + ($4  eq 'x' ? 0100 : 0) +
-                                    ($5 eq 'r' ? 0040 : 0) + ($6 eq 'w' ? 0020 : 0) + ($7  eq 'x' ? 0010 : 0) +
-                                    ($8 eq 'r' ? 0004 : 0) + ($9 eq 'w' ? 0002 : 0) + ($10 eq 'x' ? 0001 : 0);
-                         chmod $mode, "$ENV{out}/$1";
-                       }' $out/META-INF/permissions
-             rm -rf $out/META-INF
-           }
-
-           mkdir -p $out
-           arr=($srcs)
-
-           # The tarball on Linux has the following directory structure:
-           #
-           #   graalvm-ce-java11-20.3.0/*
-           #
-           # while on Darwin it looks like this:
-           #
-           #   graalvm-ce-java11-20.3.0/Contents/Home/*
-           #
-           # We therefor use --strip-components=1 vs 3 depending on the platform.
-           tar xf ''${arr[0]} -C $out --strip-components=${if stdenv.isLinux then "1" else "3"}
-
-           # Sanity check
-           if [ ! -d $out/bin ]; then
-              echo "The `bin` is directory missing after extracting the graalvm"
-              echo "tarball, please compare the directory structure of the"
-              echo "tarball with what happens in the unpackPhase (in particular"
-              echo "with regards to the `--strip-components` flag)."
-              exit 1
-           fi
-
-           unpack_jar ''${arr[1]}
-           unpack_jar ''${arr[2]}
-           unpack_jar ''${arr[3]}
-           unpack_jar ''${arr[4]}
-        '';
-
-        installPhase = {
-          "8-linux-amd64" = ''
-            # BUG workaround http://mail.openjdk.java.net/pipermail/graal-dev/2017-December/005141.html
-            substituteInPlace $out/jre/lib/security/java.security \
-              --replace file:/dev/random    file:/dev/./urandom \
-              --replace NativePRNGBlocking  SHA1PRNG
-
-            # provide libraries needed for static compilation
-            for f in ${glibc}/lib/* ${glibc.static}/lib/* ${zlib.static}/lib/*; do
-              ln -s $f $out/jre/lib/svm/clibraries/${platform}/$(basename $f)
-            done
-
-            # allow using external truffle-api.jar and languages not included in the distrubution
-            rm $out/jre/lib/jvmci/parentClassLoader.classpath
-          '';
-          "11-linux-amd64" = ''
-            # BUG workaround http://mail.openjdk.java.net/pipermail/graal-dev/2017-December/005141.html
-            substituteInPlace $out/conf/security/java.security \
-              --replace file:/dev/random    file:/dev/./urandom \
-              --replace NativePRNGBlocking  SHA1PRNG
-
-            # provide libraries needed for static compilation
-            for f in ${glibc}/lib/* ${glibc.static}/lib/* ${zlib.static}/lib/*; do
-              ln -s $f $out/lib/svm/clibraries/${platform}/$(basename $f)
-            done
-          '';
-          "8-darwin-amd64" = ''
-            # allow using external truffle-api.jar and languages not included in the distrubution
-            rm $out/jre/lib/jvmci/parentClassLoader.classpath
-          '';
-          "11-darwin-amd64" = ''
-            # BUG workaround http://mail.openjdk.java.net/pipermail/graal-dev/2017-December/005141.html
-            substituteInPlace $out/conf/security/java.security \
-              --replace file:/dev/random    file:/dev/./urandom \
-              --replace NativePRNGBlocking  SHA1PRNG
-          '';
-        }.${javaVersionPlatform} + ''
-          # jni.h expects jni_md.h to be in the header search path.
-          ln -s $out/include/linux/*_md.h $out/include/
-        '';
-
-        dontStrip = true;
-
-        preFixup = ''
-          # We cannot use -exec since wrapProgram is a function but not a
-          # command.
-          #
-          # jspawnhelper is executed from JVM, so it doesn't need to wrap it,
-          # and it breaks building OpenJDK (#114495).
-          for bin in $( find "$out" -executable -type f -not -path '*/languages/ruby/lib/gems/*' -not -name jspawnhelper ); do
-            if patchelf --print-interpreter "$bin" &> /dev/null || head -n 1 "$bin" | grep '^#!' -q; then
-              wrapProgram "$bin" \
-                --prefix LD_LIBRARY_PATH : "${runtimeLibraryPath}"
-            fi
-          done
-
-          # copy-paste openjdk's preFixup
-          # Set JAVA_HOME automatically.
-          mkdir -p $out/nix-support
-          cat <<EOF > $out/nix-support/setup-hook
-            if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
-          EOF
-
-          find "$out" -name libfontmanager.so -exec \
-            patchelf --add-needed libfontconfig.so {} \;
-        '';
-
-        # $out/bin/native-image needs zlib to build native executables.
-        propagatedBuildInputs = [ setJavaClassPath zlib ] ++
-          # On Darwin native-image calls clang and it
-          # tries to include <Foundation/Foundation.h>,
-          # and Interactive Ruby (irb) requires OpenSSL
-          # headers.
-          lib.optionals stdenv.hostPlatform.isDarwin [ Foundation openssl ];
-
-        doInstallCheck = true;
-        installCheckPhase = ''
-          echo ${lib.escapeShellArg ''
-                   public class HelloWorld {
-                     public static void main(String[] args) {
-                       System.out.println("Hello World");
-                     }
-                   }
-                 ''} > HelloWorld.java
-          $out/bin/javac HelloWorld.java
-
-          # run on JVM with Graal Compiler
-          $out/bin/java -XX:+UnlockExperimentalVMOptions -XX:+EnableJVMCI -XX:+UseJVMCICompiler HelloWorld | fgrep 'Hello World'
-
-          # Ahead-Of-Time compilation
-          $out/bin/native-image -H:-CheckToolchain -H:+ReportExceptionStackTraces --no-server HelloWorld
-          ./helloworld | fgrep 'Hello World'
-
-          ${lib.optionalString stdenv.isLinux ''
-            # Ahead-Of-Time compilation with --static
-            # --static flag doesn't work for darwin
-            $out/bin/native-image --no-server --static HelloWorld
-            ./helloworld | fgrep 'Hello World'
-          ''}
-
-          echo "Testing interpreted languages"
-          $out/bin/graalpython -c 'print(1 + 1)'
-          $out/bin/ruby -e 'puts(1 + 1)'
-          $out/bin/node -e 'console.log(1 + 1)'
-
-          echo '1 + 1' | $out/bin/graalpython
-
-          ${lib.optionalString stdenv.isLinux ''
-            # TODO: `irb` on MacOS gives an error saying "Could not find OpenSSL
-            # headers, install via Homebrew or MacPorts or set OPENSSL_PREFIX", even
-            # though `openssl` is in `propagatedBuildInputs`. For more details see:
-            # https://github.com/NixOS/nixpkgs/pull/105815
-            echo '1 + 1' | $out/bin/irb
-          ''}
-
-          echo '1 + 1' | $out/bin/node -i
-        ${lib.optionalString (javaVersion == "11" && stdenv.isLinux) ''
-          # Doesn't work on MacOS, we have this error: "Launching JShell execution engine threw: Operation not permitted (Bind failed)"
-          echo '1 + 1' | $out/bin/jshell
-        ''}'';
-
-        passthru.home = graalvmXXX-ce;
-
-        meta = with lib; {
-          homepage = "https://www.graalvm.org/";
-          description = "High-Performance Polyglot VM";
-          license = with licenses; [ upl gpl2Classpath bsd3 ];
-          maintainers = with maintainers; [ bandresen volth hlolli glittershark babariviere ];
-          platforms = [ "x86_64-linux" "x86_64-darwin" ];
-        };
-      };
-    in
-      graalvmXXX-ce;
-in {
-  graalvm8-ce  = common  "8";
-  graalvm11-ce = common "11";
-}
--- a/pkgs/development/compilers/graalvm/community-edition/default.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/default.nix
@ -0,0 +1,21 @@
+{ callPackage, Foundation }:
+
+let
+  mkGraal = opts: callPackage (import ./repository.nix opts) {
+    inherit Foundation;
+  };
+in {
+  inherit mkGraal;
+
+  graalvm8-ce = mkGraal rec {
+    version = "21.2.0";
+    javaVersion = "8";
+    platforms = ["x86_64-linux"];
+  };
+
+  graalvm11-ce = mkGraal rec {
+    version = "21.2.0";
+    javaVersion = "11";
+    platforms = ["x86_64-linux" "x86_64-darwin"];
+  };
+}
--- a/pkgs/development/compilers/graalvm/community-edition/repository.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/repository.nix
@ -0,0 +1,271 @@
+{ version, javaVersion, platforms }:
+
+{ stdenv, lib, fetchurl, autoPatchelfHook, setJavaClassPath, makeWrapper
+# minimum dependencies
+, Foundation, alsa-lib, fontconfig, freetype, glibc, openssl, perl, unzip, xorg
+, zlib
+# runtime dependencies
+, cups
+# runtime dependencies for GTK+ Look and Feel
+, gtkSupport ? true, cairo, glib, gtk3 }:
+
+let
+  platform = if stdenv.isDarwin then "darwin-amd64" else "linux-amd64";
+  runtimeDependencies = [ cups ]
+    ++ lib.optionals gtkSupport [ cairo glib gtk3 ];
+  runtimeLibraryPath = lib.makeLibraryPath runtimeDependencies;
+  javaVersionPlatform = "${javaVersion}-${platform}";
+  graalvmXXX-ce = stdenv.mkDerivation rec {
+    name = "graalvm${javaVersion}-ce";
+    srcs = [
+      (fetchurl {
+        sha256 = {
+          "8-linux-amd64" = "01gyxjmfp7wpcyn7x8b184fn0lp3xryfw619bqch120pzvr6z88f";
+          "11-linux-amd64" = "0w7lhvxm4nggqdcl4xrhdd3y6dqw9jhyca9adjkp508n4lqf1lxv";
+          "11-darwin-amd64" = "0dnahicdl0vhrbiml9z9nbb7k75hbsjj8rs246i1lwril12dqb7n";
+        }.${javaVersionPlatform};
+        url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${version}/graalvm-ce-java${javaVersionPlatform}-${version}.tar.gz";
+      })
+      (fetchurl {
+        sha256 = {
+          "8-linux-amd64" = "1jlvrxdlbsmlk3ia43h9m29kmmdn83h6zdlnf8qb7bm38c84nhsc";
+          "11-linux-amd64" = "1ybd7a6ii6582skr0nkxx7bccsa7gkg0yriql2h1lcz0rfzcdi3g";
+          "11-darwin-amd64" = "1jdy845vanmz05zx5b9227gb1msh9wdrz2kf3fx9z54ssd9qgdhm";
+        }.${javaVersionPlatform};
+        url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${version}/native-image-installable-svm-java${javaVersionPlatform}-${version}.jar";
+      })
+      (fetchurl {
+        sha256 = {
+          "8-linux-amd64" = "18ip0ay06q1pryqs8ja988mvk9vw475c0nfjcznnsd1zp296p6jc";
+          "11-linux-amd64" = "1jszz97mkqavxzyhx5jxhi43kqjxk9c36j5l5hy3kn8sdfmbplm4";
+          "11-darwin-amd64" = "1767ryhv2cn5anlys63ysax1p8ag79bykac1xfrjfan8yv6d8ybl";
+        }.${javaVersionPlatform};
+        url = "https://github.com/oracle/truffleruby/releases/download/vm-${version}/ruby-installable-svm-java${javaVersionPlatform}-${version}.jar";
+      })
+      (fetchurl {
+        sha256 = {
+          "8-linux-amd64" = "0il15438qnikqsxdsl7fcdg0c8zs3cbm4ry7pys7fxxr1ckd8szq";
+          "11-linux-amd64" = "07759sr8nijvqm8aqn69x9vq7lyppns7a6l6xribv43jvfmwpfkl";
+          "11-darwin-amd64" = "01l3as8dihc7xqy5sdkrpxmpzrqbcvvg84m2s6j1j8y2db1khf2s";
+        }.${javaVersionPlatform};
+        url = "https://github.com/graalvm/graalpython/releases/download/vm-${version}/python-installable-svm-java${javaVersionPlatform}-${version}.jar";
+      })
+      (fetchurl {
+        sha256 = {
+          "8-linux-amd64" = "08s36rjy5irg25b7lqx0m4v2wpywin3cqyhdrywhvq14f7zshsd5";
+          "11-linux-amd64" = "1ybjaknmbsdg8qzb986x39fq0h7fyiymdcigc7y86swk8dd916hv";
+          "11-darwin-amd64" = "02dwlb62kqr4rjjmvkhn2xk9l1p47ahg9xyyfkw7im1jwlqmqnzf";
+        }.${javaVersionPlatform};
+        url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${version}/wasm-installable-svm-java${javaVersionPlatform}-${version}.jar";
+      })
+    ];
+
+    buildInputs = lib.optionals stdenv.isLinux [
+      alsa-lib # libasound.so wanted by lib/libjsound.so
+      fontconfig
+      freetype
+      openssl # libssl.so wanted by languages/ruby/lib/mri/openssl.so
+      stdenv.cc.cc.lib # libstdc++.so.6
+      xorg.libX11
+      xorg.libXext
+      xorg.libXi
+      xorg.libXrender
+      xorg.libXtst
+      zlib
+    ];
+
+    # Workaround for libssl.so.10 wanted by TruffleRuby
+    # Resulting TruffleRuby cannot use `openssl` library.
+    autoPatchelfIgnoreMissingDeps = true;
+
+    nativeBuildInputs = [ unzip perl autoPatchelfHook makeWrapper ];
+
+    unpackPhase = ''
+      unpack_jar() {
+        jar=$1
+        unzip -q -o $jar -d $out
+        perl -ne 'use File::Path qw(make_path);
+                  use File::Basename qw(dirname);
+                  if (/^(.+) = (.+)$/) {
+                    make_path dirname("$ENV{out}/$1");
+                    system "ln -s $2 $ENV{out}/$1";
+                  }' $out/META-INF/symlinks
+        perl -ne 'if (/^(.+) = ([r-])([w-])([x-])([r-])([w-])([x-])([r-])([w-])([x-])$/) {
+                    my $mode = ($2 eq 'r' ? 0400 : 0) + ($3 eq 'w' ? 0200 : 0) + ($4  eq 'x' ? 0100 : 0) +
+                               ($5 eq 'r' ? 0040 : 0) + ($6 eq 'w' ? 0020 : 0) + ($7  eq 'x' ? 0010 : 0) +
+                               ($8 eq 'r' ? 0004 : 0) + ($9 eq 'w' ? 0002 : 0) + ($10 eq 'x' ? 0001 : 0);
+                    chmod $mode, "$ENV{out}/$1";
+                  }' $out/META-INF/permissions
+        rm -rf $out/META-INF
+      }
+
+      mkdir -p $out
+      arr=($srcs)
+
+      # The tarball on Linux has the following directory structure:
+      #
+      #   graalvm-ce-java11-20.3.0/*
+      #
+      # while on Darwin it looks like this:
+      #
+      #   graalvm-ce-java11-20.3.0/Contents/Home/*
+      #
+      # We therefor use --strip-components=1 vs 3 depending on the platform.
+      tar xf ''${arr[0]} -C $out --strip-components=${
+        if stdenv.isLinux then "1" else "3"
+      }
+
+      # Sanity check
+      if [ ! -d $out/bin ]; then
+         echo "The `bin` is directory missing after extracting the graalvm"
+         echo "tarball, please compare the directory structure of the"
+         echo "tarball with what happens in the unpackPhase (in particular"
+         echo "with regards to the `--strip-components` flag)."
+         exit 1
+      fi
+
+      unpack_jar ''${arr[1]}
+      unpack_jar ''${arr[2]}
+      unpack_jar ''${arr[3]}
+      unpack_jar ''${arr[4]}
+    '';
+
+    installPhase = {
+      "8-linux-amd64" = ''
+        # BUG workaround http://mail.openjdk.java.net/pipermail/graal-dev/2017-December/005141.html
+        substituteInPlace $out/jre/lib/security/java.security \
+          --replace file:/dev/random    file:/dev/./urandom \
+          --replace NativePRNGBlocking  SHA1PRNG
+
+        # provide libraries needed for static compilation
+        for f in ${glibc}/lib/* ${glibc.static}/lib/* ${zlib.static}/lib/*; do
+          ln -s $f $out/jre/lib/svm/clibraries/${platform}/$(basename $f)
+        done
+
+        # allow using external truffle-api.jar and languages not included in the distrubution
+        rm $out/jre/lib/jvmci/parentClassLoader.classpath
+      '';
+      "11-linux-amd64" = ''
+        # BUG workaround http://mail.openjdk.java.net/pipermail/graal-dev/2017-December/005141.html
+        substituteInPlace $out/conf/security/java.security \
+          --replace file:/dev/random    file:/dev/./urandom \
+          --replace NativePRNGBlocking  SHA1PRNG
+
+        # provide libraries needed for static compilation
+        for f in ${glibc}/lib/* ${glibc.static}/lib/* ${zlib.static}/lib/*; do
+          ln -s $f $out/lib/svm/clibraries/${platform}/$(basename $f)
+        done
+      '';
+      "11-darwin-amd64" = ''
+        # BUG workaround http://mail.openjdk.java.net/pipermail/graal-dev/2017-December/005141.html
+        substituteInPlace $out/conf/security/java.security \
+          --replace file:/dev/random    file:/dev/./urandom \
+          --replace NativePRNGBlocking  SHA1PRNG
+      '';
+    }.${javaVersionPlatform} + ''
+      # jni.h expects jni_md.h to be in the header search path.
+      ln -s $out/include/linux/*_md.h $out/include/
+    '';
+
+    dontStrip = true;
+
+    preFixup = ''
+      # We cannot use -exec since wrapProgram is a function but not a
+      # command.
+      #
+      # jspawnhelper is executed from JVM, so it doesn't need to wrap it,
+      # and it breaks building OpenJDK (#114495).
+      for bin in $( find "$out" -executable -type f -not -path '*/languages/ruby/lib/gems/*' -not -name jspawnhelper ); do
+        if patchelf --print-interpreter "$bin" &> /dev/null || head -n 1 "$bin" | grep '^#!' -q; then
+          wrapProgram "$bin" \
+            --prefix LD_LIBRARY_PATH : "${runtimeLibraryPath}"
+        fi
+      done
+
+      # copy-paste openjdk's preFixup
+      # Set JAVA_HOME automatically.
+      mkdir -p $out/nix-support
+      cat <<EOF > $out/nix-support/setup-hook
+        if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
+      EOF
+
+      find "$out" -name libfontmanager.so -exec \
+        patchelf --add-needed libfontconfig.so {} \;
+    '';
+
+    # $out/bin/native-image needs zlib to build native executables.
+    propagatedBuildInputs = [ setJavaClassPath zlib ] ++
+      # On Darwin native-image calls clang and it
+      # tries to include <Foundation/Foundation.h>,
+      # and Interactive Ruby (irb) requires OpenSSL
+      # headers.
+      lib.optionals stdenv.hostPlatform.isDarwin [ Foundation openssl ];
+
+    doInstallCheck = true;
+    installCheckPhase = ''
+        echo ${
+          lib.escapeShellArg ''
+            public class HelloWorld {
+              public static void main(String[] args) {
+                System.out.println("Hello World");
+              }
+            }
+          ''
+        } > HelloWorld.java
+        $out/bin/javac HelloWorld.java
+
+        # run on JVM with Graal Compiler
+        $out/bin/java -XX:+UnlockExperimentalVMOptions -XX:+EnableJVMCI -XX:+UseJVMCICompiler HelloWorld | fgrep 'Hello World'
+
+        # Ahead-Of-Time compilation
+        $out/bin/native-image -H:-CheckToolchain -H:+ReportExceptionStackTraces --no-server HelloWorld
+        ./helloworld | fgrep 'Hello World'
+
+        ${
+          lib.optionalString stdenv.isLinux ''
+            # Ahead-Of-Time compilation with --static
+            # --static flag doesn't work for darwin
+            $out/bin/native-image --no-server --static HelloWorld
+            ./helloworld | fgrep 'Hello World'
+          ''
+        }
+
+        echo "Testing interpreted languages"
+        $out/bin/graalpython -c 'print(1 + 1)'
+        $out/bin/ruby -e 'puts(1 + 1)'
+
+        echo '1 + 1' | $out/bin/graalpython
+
+        ${
+          lib.optionalString stdenv.isLinux ''
+            # TODO: `irb` on MacOS gives an error saying "Could not find OpenSSL
+            # headers, install via Homebrew or MacPorts or set OPENSSL_PREFIX", even
+            # though `openssl` is in `propagatedBuildInputs`. For more details see:
+            # https://github.com/NixOS/nixpkgs/pull/105815
+            echo '1 + 1' | $out/bin/irb
+          ''
+        }
+
+      ${lib.optionalString (javaVersion == "11" && stdenv.isLinux) ''
+        # Doesn't work on MacOS, we have this error: "Launching JShell execution engine threw: Operation not permitted (Bind failed)"
+        echo '1 + 1' | $out/bin/jshell
+      ''}'';
+
+    passthru.home = graalvmXXX-ce;
+
+    meta = with lib; {
+      homepage = "https://www.graalvm.org/";
+      description = "High-Performance Polyglot VM";
+      license = with licenses; [ upl gpl2Classpath bsd3 ];
+      maintainers = with maintainers; [
+        bandresen
+        volth
+        hlolli
+        glittershark
+        babariviere
+        ericdallo
+      ];
+      platforms = platforms;
+    };
+  };
+in graalvmXXX-ce
--- a/pkgs/development/interpreters/clojure/babashka.nix
+++ b/pkgs/development/interpreters/clojure/babashka.nix
@ -52,6 +52,7 @@ stdenv.mkDerivation rec {
          "--no-server"
          "--report-unsupported-elements-at-runtime"
          "--initialize-at-run-time=org.postgresql.sspi.SSPIClient"
+          "--initialize-at-run-time=org.httpkit.client.ClientSslEngineFactory\$SSLHolder"
          "--native-image-info"
          "--verbose"
          "-H:ServiceLoaderFeatureExcludeServices=javax.sound.sampled.spi.AudioFileReader"
--- a/pkgs/development/python-modules/aiowinreg/default.nix
+++ b/pkgs/development/python-modules/aiowinreg/default.nix
@ -8,13 +8,13 @@

 buildPythonPackage rec {
  pname = "aiowinreg";
-  version = "0.0.6";
+  version = "0.0.7";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0h0r9xrz1n8y75f2p21f7phqrlpsymyiipmgzr0lj591irzjmjjy";
+    sha256 = "1p88q2b6slm1sw3234r40s9jd03fqlkcx8y3iwg6ihf0z4ww14d1";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/tools/analysis/tfsec/default.nix
+++ b/pkgs/development/tools/analysis/tfsec/default.nix
@ -5,13 +5,13 @@

 buildGoPackage rec {
  pname = "tfsec";
-  version = "0.55.0";
+  version = "0.55.1";

  src = fetchFromGitHub {
    owner = "aquasecurity";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1l71r9il45svdwydvi08hnyh310j0gha11qhyqvdz14d8czf8ahn";
+    sha256 = "0s18hfy1gnnvhppvapj8n066pb0fc7w3sm0zm0mzjd58h11x0bbr";
  };

  goPackagePath = "github.com/aquasecurity/tfsec";
--- a/pkgs/development/tools/build-managers/gradle/default.nix
+++ b/pkgs/development/tools/build-managers/gradle/default.nix
@ -9,8 +9,9 @@ let
      url = "https://services.gradle.org/distributions/${name}-bin.zip";
    };
  };
-in rec {
-  gradleGen = {name, src, nativeVersion} : stdenv.mkDerivation {
+in
+rec {
+  gradleGen = { name, src, nativeVersion }: stdenv.mkDerivation {
    inherit name src nativeVersion;

    dontBuild = true;
@ -27,20 +28,21 @@ in rec {
    '';

    fixupPhase = if (!stdenv.isLinux) then ":" else
-      let arch = if stdenv.is64bit then "amd64" else "i386"; in ''
-        mkdir patching
-        pushd patching
-        jar xf $out/lib/gradle/lib/native-platform-linux-${arch}-${nativeVersion}.jar
-        patchelf --set-rpath "${stdenv.cc.cc.lib}/lib:${stdenv.cc.cc.lib}/lib64" net/rubygrapefruit/platform/linux-${arch}/libnative-platform.so
-        jar cf native-platform-linux-${arch}-${nativeVersion}.jar .
-        mv native-platform-linux-${arch}-${nativeVersion}.jar $out/lib/gradle/lib/
-        popd
+    let arch = if stdenv.is64bit then "amd64" else "i386"; in
+    ''
+      mkdir patching
+      pushd patching
+      jar xf $out/lib/gradle/lib/native-platform-linux-${arch}-${nativeVersion}.jar
+      patchelf --set-rpath "${stdenv.cc.cc.lib}/lib:${stdenv.cc.cc.lib}/lib64" net/rubygrapefruit/platform/linux-${arch}/libnative-platform.so
+      jar cf native-platform-linux-${arch}-${nativeVersion}.jar .
+      mv native-platform-linux-${arch}-${nativeVersion}.jar $out/lib/gradle/lib/
+      popd

-        # The scanner doesn't pick up the runtime dependency in the jar.
-        # Manually add a reference where it will be found.
-        mkdir $out/nix-support
-        echo ${stdenv.cc.cc} > $out/nix-support/manual-runtime-dependencies
-      '';
+      # The scanner doesn't pick up the runtime dependency in the jar.
+      # Manually add a reference where it will be found.
+      mkdir $out/nix-support
+      echo ${stdenv.cc.cc} > $out/nix-support/manual-runtime-dependencies
+    '';

    nativeBuildInputs = [ makeWrapper unzip ];
    buildInputs = [ java ];
@ -64,9 +66,9 @@ in rec {
  gradle_latest = gradle_7;

  gradle_7 = gradleGen (gradleSpec {
-    version = "7.1";
+    version = "7.1.1";
    nativeVersion = "0.22-milestone-16";
-    sha256 = "0yyqksq3zza7r9ls389ha81l3s768j7dfdqiwk3846qy4wcyxsrd";
+    sha256 = "0p9nss2xywwhjbpdcyma3d0ijvkav9hzmldpkcp447ch92cqd2xz";
  });

  gradle_6_8 = gradleGen (gradleSpec {
--- a/pkgs/development/tools/go-task/default.nix
+++ b/pkgs/development/tools/go-task/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "go-task";
-  version = "3.6.0";
+  version = "3.7.0";

  src = fetchFromGitHub {
    owner = pname;
    repo = "task";
    rev = "v${version}";
-    sha256 = "sha256-3DTjxcMxgaTMunctHaCgOX5/P85lJDRin6RpMuv9Rfg=";
+    sha256 = "sha256-EksCnhSde25hradmKaDSOfIa/QnMAlIbgbQWX6k5v+4=";
  };

-  vendorSha256 = "sha256-bsVzV2M31BA7X6aq8na7v56uGYgne4OwR5kz/utmQHI=";
+  vendorSha256 = "sha256-Y2Yuc2pcxW0M1CJfN3dezPB9cg6MvOUg5A+yFHCwntk=";

  doCheck = false;

--- a/pkgs/development/tools/treefmt/default.nix
+++ b/pkgs/development/tools/treefmt/default.nix
@ -1,16 +1,16 @@
 { lib, rustPlatform, fetchFromGitHub }:
 rustPlatform.buildRustPackage rec {
  pname = "treefmt";
-  version = "0.2.2";
+  version = "0.2.3";

  src = fetchFromGitHub {
    owner = "numtide";
    repo = "treefmt";
    rev = "v${version}";
-    sha256 = "13z7n0xg150815c77ysz4iqpk8rbgj4vmqy1y2262ryb88dwaw5n";
+    sha256 = "1j505bjdgd6lsq197frlyw26fl1621aw6z339bdp7zc3sa54z0d6";
  };

-  cargoSha256 = "1jfrmafj1b28k6xjpj0qq1jpccll0adqxhjypphxhyfsfnra8g6f";
+  cargoSha256 = "0aky94rq1gs506yhpinj759lpvlnw3q2k97gvq34svgq0n38drvk";

  meta = {
    description = "one CLI to format the code tree";
--- a/pkgs/development/web/cypress/default.nix
+++ b/pkgs/development/web/cypress/default.nix
@ -17,11 +17,11 @@

 stdenv.mkDerivation rec {
  pname = "cypress";
-  version = "8.1.0";
+  version = "8.2.0";

  src = fetchzip {
    url = "https://cdn.cypress.io/desktop/${version}/linux-x64/cypress.zip";
-    sha256 = "17cq88qrq3dshgfaycb77xbkzr9drw7fvw0xqijlxivvmnbvwi6i";
+    sha256 = "0j5acj7ghqf2pywpf4vzzvmcn4ypc4gv0pjyjd8hgzrrl3kff4dm";
  };

  # don't remove runtime deps
--- a/pkgs/development/web/nodejs/v16.nix
+++ b/pkgs/development/web/nodejs/v16.nix
@ -1,4 +1,4 @@
-{ callPackage, openssl, python3, enableNpm ? true }:
+{ callPackage, openssl, python3, fetchpatch, enableNpm ? true }:

 let
  buildNodejs = callPackage ./nodejs.nix {
@ -8,6 +8,14 @@ let
 in
  buildNodejs {
    inherit enableNpm;
-    version = "16.6.0";
-    sha256 = "1ndrqx3k5m62r7nzl5za59m33bx10541n7xbaxxz7088ifh18msw";
+    version = "16.5.0";
+    sha256 = "16dapj5pm2y1m3ldrjjlz8rq9axk85nn316iz02nk6qjs66y6drz";
+    patches = [
+      # Fix CVE-2021-22930 https://github.com/nodejs/node/pull/39423.
+      # It should be fixed by Node.js 16.6.0, but currently it fails to build on Darwin
+      (fetchpatch {
+        url = "https://github.com/nodejs/node/commit/9d950a0956bf2c3dd87bacb56807f37e16a91db4.patch";
+        sha256 = "1narhk5dqdkbndh9hg0dn5ghhgrd6gsamjqszpivmp33nl5hgsx3";
+      })
+    ];
  }
--- a/pkgs/games/factorio/versions.json
+++ b/pkgs/games/factorio/versions.json
@ -2,12 +2,12 @@
  "x86_64-linux": {
    "alpha": {
      "experimental": {
-        "name": "factorio_alpha_x64-1.1.36.tar.xz",
+        "name": "factorio_alpha_x64-1.1.37.tar.xz",
        "needsAuth": true,
-        "sha256": "1x9a2lv6zbqawqlxg8bcbx04hjy0pq40macfa4sqi8w6h14wgww8",
+        "sha256": "0aj8w38lx8bx3d894qxr416x515ijadrlcynvvqjaj1zx3acldzh",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.36/alpha/linux64",
-        "version": "1.1.36"
+        "url": "https://factorio.com/get-download/1.1.37/alpha/linux64",
+        "version": "1.1.37"
      },
      "stable": {
        "name": "factorio_alpha_x64-1.1.36.tar.xz",
@ -38,12 +38,12 @@
    },
    "headless": {
      "experimental": {
-        "name": "factorio_headless_x64-1.1.36.tar.xz",
+        "name": "factorio_headless_x64-1.1.37.tar.xz",
        "needsAuth": false,
-        "sha256": "1s8g030xp5nrlmnn21frrd8n4nd7jjmb5hbpj1vhxjrk6vpijh24",
+        "sha256": "0hawwjdaxgbrkb80vn9jk6dn0286mq35zkgg5vvv5zhi339pqwwg",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.36/headless/linux64",
-        "version": "1.1.36"
+        "url": "https://factorio.com/get-download/1.1.37/headless/linux64",
+        "version": "1.1.37"
      },
      "stable": {
        "name": "factorio_headless_x64-1.1.36.tar.xz",
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@ -14,6 +14,9 @@
 # Kernel dependencies
 , kernel ? null
 , enablePython ? true
+
+# for determining the latest compatible linuxPackages
+, linuxPackages_5_13
 }:

 with lib;
@ -28,6 +31,7 @@ let
    , extraPatches ? []
    , rev ? "zfs-${version}"
    , isUnstable ? false
+    , latestCompatibleLinuxPackages
    , kernelCompatible ? null }:

    stdenv.mkDerivation {
@ -161,7 +165,7 @@ let
      outputs = [ "out" ] ++ optionals buildUser [ "dev" ];

      passthru = {
-        inherit enableMail;
+        inherit enableMail latestCompatibleLinuxPackages;

        tests =
          if isUnstable then [
@ -196,6 +200,7 @@ in {
  zfsStable = common {
    # check the release notes for compatible kernels
    kernelCompatible = kernel.kernelAtLeast "3.10" && kernel.kernelOlder "5.14";
+    latestCompatibleLinuxPackages = linuxPackages_5_13;

    # this package should point to the latest release.
    version = "2.1.0";
@ -206,6 +211,7 @@ in {
  zfsUnstable = common {
    # check the release notes for compatible kernels
    kernelCompatible = kernel.kernelAtLeast "3.10" && kernel.kernelOlder "5.14";
+    latestCompatibleLinuxPackages = linuxPackages_5_13;

    # this package should point to a version / git revision compatible with the latest kernel release
    version = "2.1.0";
--- a/pkgs/servers/hqplayerd/default.nix
+++ b/pkgs/servers/hqplayerd/default.nix
@ -53,32 +53,37 @@ stdenv.mkDerivation rec {
    mkdir -p $out/bin
    cp ./usr/bin/hqplayerd $out/bin

+    # main configuration
+    mkdir -p $out/etc/hqplayer
+    cp ./etc/hqplayer/hqplayerd.xml $out/etc/hqplayer/
+
    # udev rules
    mkdir -p $out/etc/udev/rules.d
-    cp ./etc/udev/rules.d/50-taudio2.rules $out/etc/udev/rules.d
+    cp ./etc/udev/rules.d/50-taudio2.rules $out/etc/udev/rules.d/

    # kernel module cfgs
    mkdir -p $out/etc/modules-load.d
-    cp ./etc/modules-load.d/taudio2.conf $out/etc/modules-load.d
+    cp ./etc/modules-load.d/taudio2.conf $out/etc/modules-load.d/

    # systemd service file
    mkdir -p $out/lib/systemd/system
-    cp ./usr/lib/systemd/system/hqplayerd.service $out/lib/systemd/system
+    cp ./usr/lib/systemd/system/hqplayerd.service $out/lib/systemd/system/

    # documentation
    mkdir -p $out/share/doc/hqplayerd
-    cp ./usr/share/doc/hqplayerd/* $out/share/doc/hqplayerd
+    cp ./usr/share/doc/hqplayerd/* $out/share/doc/hqplayerd/

    # misc service support files
    mkdir -p $out/var/lib/hqplayer
-    cp -r ./var/lib/hqplayer/web $out/var/lib/hqplayer/web
+    cp -r ./var/lib/hqplayer/web $out/var/lib/hqplayer

    runHook postInstall
  '';

  postInstall = ''
    substituteInPlace $out/lib/systemd/system/hqplayerd.service \
-      --replace /usr/bin/hqplayerd $out/bin/hqplayerd
+      --replace /usr/bin/hqplayerd $out/bin/hqplayerd \
+      --replace "NetworkManager-wait-online.service" ""
  '';

  postFixup = ''
--- a/pkgs/servers/nitter/default.nix
+++ b/pkgs/servers/nitter/default.nix
@ -0,0 +1,131 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, nim
+, libsass
+}:
+
+let
+  jester = fetchFromGitHub {
+    owner = "dom96";
+    repo = "jester";
+    rev = "v0.5.0";
+    sha256 = "0m8a4ss4460jd2lcbqcbdd68jhcy35xg7qdyr95mh8rflwvmcvhk";
+  };
+  karax = fetchFromGitHub {
+    owner = "karaxnim";
+    repo = "karax";
+    rev = "1.1.2";
+    sha256 = "07ykrd21hd76vlmkqpvv5xvaxw6aaq87bky47p2420ni85a6d94j";
+  };
+  sass = fetchFromGitHub {
+    owner = "dom96";
+    repo = "sass";
+    rev = "e683aa1";
+    sha256 = "0qvly5rilsqqsyvr67pqhglm55ndc4nd6v90jwswbnigxiqf79lc";
+  };
+  regex = fetchFromGitHub {
+    owner = "nitely";
+    repo = "nim-regex";
+    rev = "2e32fdc";
+    sha256 = "1hrl40mwql7nh4wc7sdhmk8bj5728b93v5a93j49v660l0rn4qx8";
+  };
+  unicodedb = fetchFromGitHub {
+    owner = "nitely";
+    repo = "nim-unicodedb";
+    rev = "v0.9.0";
+    sha256 = "06j8d0bjbpv1iibqlmrac4qb61ggv17hvh6nv4pbccqk1rlpxhsq";
+  };
+  unicodeplus= fetchFromGitHub {
+    owner = "nitely";
+    repo = "nim-unicodeplus";
+    rev = "v0.8.0";
+    sha256 = "181wzwivfgplkqn5r4crhnaqgsza7x6fi23i86djb2dxvm7v6qxk";
+  };
+  segmentation = fetchFromGitHub {
+    owner = "nitely";
+    repo = "nim-segmentation";
+    rev = "v0.1.0";
+    sha256 = "007bkx8dwy8n340zbp6wyqfsq9bh6q5ykav1ywdlwykyp1n909bh";
+  };
+  nimcrypto = fetchFromGitHub {
+    owner = "cheatfate";
+    repo = "nimcrypto";
+    rev = "a5742a9a214ac33f91615f3862c7b099aec43b00";
+    sha256 = "0al0jsaicm8vyr63n909dq1glhvpra1n9sllmj0r7lsjsdb59wsz";
+  };
+  markdown = fetchFromGitHub {
+    owner = "soasme";
+    repo = "nim-markdown";
+    rev = "abdbe5e";
+    sha256 = "0f3c1sxvhbbds43c9l8cz69pfpf984msj1lv4pb7bzpxb5zil2wy";
+  };
+  packedjson = fetchFromGitHub {
+    owner = "Araq";
+    repo = "packedjson";
+    rev = "7198cc8";
+    sha256 = "1ay2zd88q8hvpvigsg8h0y5vc65hk3lk0d48fy9hwg4lcng19mp1";
+  };
+  supersnappy = fetchFromGitHub {
+    owner = "guzba";
+    repo = "supersnappy";
+    rev = "1.1.5";
+    sha256 = "1y26sgnszvdf5sn7j0jx2dpd4i03mvbk9i9ni9kbyrs798bjwi6z";
+  };
+  redpool = fetchFromGitHub {
+    owner = "zedeus";
+    repo = "redpool";
+    rev = "57aeb25";
+    sha256 = "0fph7qlia6fvya1zqzbgvww2hk5pd0vq1wlf9ij9jyn655mg0w3q";
+  };
+  frosty = fetchFromGitHub {
+    owner = "disruptek";
+    repo = "frosty";
+    rev = "0.3.1";
+    sha256 = "0hd6484ihjgl57gmqyp5xfq5prycb49k0313fqky600mhz71nmyz";
+  };
+  redis = fetchFromGitHub {
+    owner = "zedeus";
+    repo = "redis";
+    rev = "94bcbf1";
+    sha256 = "1p9zv4f4lqrjqa8fk98cb89b9fzlf866jc584ll9sws14904i80j";
+  };
+in stdenv.mkDerivation rec {
+  pname = "nitter";
+  version = "unstable-2021-07-18";
+
+  src = fetchFromGitHub {
+    owner = "zedeus";
+    repo = "nitter";
+    rev = "6c5cb01b294d4f6e3b438fc47683359eb0fe5057";
+    sha256 = "1dl8ndyv8m1hnydrp5xilcpp2cfbp02d5jap3y42i4nazc9ar6p4";
+  };
+
+  nativeBuildInputs = [ nim ];
+  buildInputs = [ libsass ];
+
+  buildPhase = ''
+    runHook preBuild
+    export HOME=$TMPDIR
+    nim -d:release -p:${jester} -p:${karax} -p:${sass}/src -p:${regex}/src -p:${unicodedb}/src -p:${unicodeplus}/src -p:${segmentation}/src -p:${nimcrypto} -p:${markdown}/src -p:${packedjson} -p:${supersnappy}/src -p:${redpool}/src -p:${frosty} -p:${redis}/src c src/$pname
+    nim -p:${sass}/src c --hint[Processing]:off -r tools/gencss
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -Dt $out/bin src/$pname
+    mkdir -p $out/share/nitter
+    cp -r public $out/share/nitter/public
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Alternative Twitter front-end";
+    homepage = "https://github.com/zedeus/nitter";
+    maintainers = with maintainers; [ erdnaxe ];
+    license = licenses.agpl3Only;
+    platforms = [ "x86_64-linux" ];
+  };
+}
+
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@ -1915,17 +1915,17 @@ lib.makeScope newScope (self: with self; {
  }) {};

  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xeyes = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXext, libXmu, xorgproto, libXrender, libXt }: stdenv.mkDerivation {
+  xeyes = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libxcb, libXext, libXi, libXmu, xorgproto, libXrender, libXt }: stdenv.mkDerivation {
    pname = "xeyes";
-    version = "1.1.2";
+    version = "1.2.0";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/app/xeyes-1.1.2.tar.bz2";
-      sha256 = "0lq5j7fryx1wn998jq6h3icz1h6pqrsbs3adskjzjyhn5l6yrg2p";
+      url = "mirror://xorg/individual/app/xeyes-1.2.0.tar.bz2";
+      sha256 = "1nxn443pfhddmwl59wplpjkslhlyfk307qx18nrimvvb2hipx8gq";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    nativeBuildInputs = [ pkg-config ];
-    buildInputs = [ libX11 libXext libXmu xorgproto libXrender libXt ];
+    buildInputs = [ libX11 libxcb libXext libXi libXmu xorgproto libXrender libXt ];
    meta.platforms = lib.platforms.unix;
  }) {};

@ -3312,11 +3312,11 @@ lib.makeScope newScope (self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  xwd = callPackage ({ stdenv, pkg-config, fetchurl, libxkbfile, libX11, xorgproto }: stdenv.mkDerivation {
    pname = "xwd";
-    version = "1.0.7";
+    version = "1.0.8";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/app/xwd-1.0.7.tar.bz2";
-      sha256 = "1537i8q8pgf0sjklakzfvjwrq5b246qjywrx9ll8xfg0p6w1as6d";
+      url = "mirror://xorg/individual/app/xwd-1.0.8.tar.bz2";
+      sha256 = "06q36fh55r62ms0igfxsanrn6gv8lh794q1bw9xzw51p2qs2papv";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    nativeBuildInputs = [ pkg-config ];
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@ -844,10 +844,6 @@ self: super:
    postInstall = "mkdir $out/bin";
  });

-  xwd = super.xwd.overrideAttrs (attrs: {
-    buildInputs = with self; attrs.buildInputs ++ [libXt];
-  });
-
  xrdb = super.xrdb.overrideAttrs (attrs: {
    configureFlags = [ "--with-cpp=${mcpp}/bin/mcpp" ];
  });
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@ -36,7 +36,7 @@ mirror://xorg/individual/app/xdm-1.1.12.tar.bz2
 mirror://xorg/individual/app/xdpyinfo-1.3.2.tar.bz2
 mirror://xorg/individual/app/xdriinfo-1.0.6.tar.bz2
 mirror://xorg/individual/app/xev-1.2.3.tar.bz2
-mirror://xorg/individual/app/xeyes-1.1.2.tar.bz2
+mirror://xorg/individual/app/xeyes-1.2.0.tar.bz2
 mirror://xorg/individual/app/xfd-1.1.3.tar.bz2
 mirror://xorg/individual/app/xfontsel-1.0.6.tar.bz2
 mirror://xorg/individual/app/xfs-1.2.0.tar.bz2
@ -70,7 +70,7 @@ mirror://xorg/individual/app/xsm-1.0.4.tar.bz2
 mirror://xorg/individual/app/xstdcmap-1.0.4.tar.bz2
 mirror://xorg/individual/app/xtrap-1.0.3.tar.bz2
 mirror://xorg/individual/app/xvinfo-1.1.4.tar.bz2
-mirror://xorg/individual/app/xwd-1.0.7.tar.bz2
+mirror://xorg/individual/app/xwd-1.0.8.tar.bz2
 mirror://xorg/individual/app/xwininfo-1.1.4.tar.bz2
 mirror://xorg/individual/app/xwud-1.0.5.tar.bz2
 mirror://xorg/individual/data/xbitmaps-1.1.2.tar.bz2
--- a/pkgs/tools/misc/goreleaser/default.nix
+++ b/pkgs/tools/misc/goreleaser/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "goreleaser";
-  version = "0.174.1";
+  version = "0.174.2";

  src = fetchFromGitHub {
    owner = "goreleaser";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-oHH5/w1G0xlhmnUe6/qS0++qtBdDd6dUw6JfWYAWIh8=";
+    sha256 = "sha256-o/rDqYjOI+HxThQA7cflWUhCdsb6m4XOuzI753upmio=";
  };

  vendorSha256 = "sha256-P91wi2Fqo9+Yccqoqmsx0IbjSGUpiKIh7uOsgsR9c+0=";
--- a/pkgs/tools/misc/parallel/default.nix
+++ b/pkgs/tools/misc/parallel/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "parallel";
-  version = "20210322";
+  version = "20210722";

  src = fetchurl {
    url = "mirror://gnu/parallel/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-mPcbRFojoYu06bzk83S5PmptnezfiSvo0iRZ8iS4VpQ=";
+    sha256 = "0jaa5137sjw2szvmnnslkqv1n3gg2rkkgr71j7hpp5a3q15hjf9j";
  };

  outputs = [ "out" "man" "doc" ];
--- a/pkgs/tools/security/vault/default.nix
+++ b/pkgs/tools/security/vault/default.nix
@ -1,27 +1,34 @@
-{ stdenv, lib, fetchFromGitHub, buildGoPackage, installShellFiles, nixosTests
+{ stdenv, lib, fetchFromGitHub, buildGoModule, installShellFiles, nixosTests
 , makeWrapper
 , gawk
 , glibc
 }:

-buildGoPackage rec {
+buildGoModule rec {
  pname = "vault";
-  version = "1.7.3";
+  version = "1.8.0";

  src = fetchFromGitHub {
    owner = "hashicorp";
    repo = "vault";
    rev = "v${version}";
-    sha256 = "sha256-BO4xzZrX9eVETQWjBDBfP7TlD7sO+gLgbB330A11KAI=";
+    sha256 = "sha256-jyGymAplSe8vaSwbONtpRoAondxNBcRbFZ+YyOtr7qo=";
  };

-  goPackagePath = "github.com/hashicorp/vault";
+  vendorSha256 = "11mrdf7pwf8v7bb7wamv2yhixw4x06rd0qym942kk9bwif2balfp";

  subPackages = [ "." ];

  nativeBuildInputs = [ installShellFiles makeWrapper ];

-  buildFlagsArray = [ "-tags=vault" "-ldflags=-s -w -X ${goPackagePath}/sdk/version.GitCommit=${src.rev}" ];
+  buildFlagsArray = [ "-tags=vault" ];
+
+  ldflags = [
+    "-s" "-w"
+    "-X github.com/hashicorp/vault/sdk/version.GitCommit=${src.rev}"
+    "-X github.com/hashicorp/vault/sdk/version.Version=${version}"
+    "-X github.com/hashicorp/vault/sdk/version.VersionPrerelease="
+  ];

  postInstall = ''
    echo "complete -C $out/bin/vault vault" > vault.bash
--- a/pkgs/tools/security/vault/vault-bin.nix
+++ b/pkgs/tools/security/vault/vault-bin.nix
@ -1,26 +1,26 @@
 { lib, stdenv, fetchurl, unzip, makeWrapper, gawk, glibc }:

 let
-  version = "1.7.3";
+  version = "1.8.0";

  sources = let
    base = "https://releases.hashicorp.com/vault/${version}";
  in {
    x86_64-linux = fetchurl {
      url = "${base}/vault_${version}_linux_amd64.zip";
-      sha256 = "sha256-hFMTKpO3VcCondSy8amb1K8G+BZ7gZF/EXCAg5Ax4D8=";
+      sha256 = "sha256-H+kPDE8xuu2lgENf4t+vCb+Tni+ChkB8K5ZEgIY3Jyo=";
    };
    i686-linux = fetchurl {
      url = "${base}/vault_${version}_linux_386.zip";
-      sha256 = "02wbbzffb2m7y3476l5qa5dhi0v30f3sfif0svqhhzh927kg4s5w";
+      sha256 = "19c7d7yr5nm1xgrkh46pcgwwxa6iic6is06n343qaxcj0dfg43kn";
    };
    x86_64-darwin = fetchurl {
      url = "${base}/vault_${version}_darwin_amd64.zip";
-      sha256 = "0sw56dhjbasdnlwg668swhyxrn5gy7h9gysdg96za4dhq3iimkrn";
+      sha256 = "0zql0r6gmq0yqb1cbpjgwsg6cky9y43n5gsvijp6snhnp86bicdr";
    };
    aarch64-linux = fetchurl {
      url = "${base}/vault_${version}_linux_arm64.zip";
-      sha256 = "0c2w0684adaqildwviajp6pi8vp76g4zwwgc1k2bb5mwv1h2y293";
+      sha256 = "1ajkgkanq8ijcxbb5zbn9z25r0v7qcq13ivjqr0x7ql5bxm3xfmc";
    };
  };

--- a/pkgs/tools/system/hostctl/default.nix
+++ b/pkgs/tools/system/hostctl/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "hostctl";
-  version = "1.1.0";
+  version = "1.1.1";

  src = fetchFromGitHub {
    owner = "guumaster";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-X07JvXN1mwOQE2XBfaYbqQnQ92fBSg/Erj0yUygAqmM=";
+    sha256 = "sha256-VjFjGvIoymGVVRiZUk/qoq/PTYoklp+Jz89zndX0e5A=";
  };

  vendorSha256 = "sha256-rGDWrivIdl5FTu/kNR8nAfE2+1hE4cm3uDg7oBobE9M=";
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -7407,6 +7407,8 @@ in

  ngrok-1 = callPackage ../tools/networking/ngrok-1 { };

+  nitter = callPackage ../servers/nitter { };
+
  noice = callPackage ../applications/misc/noice { };

  noip = callPackage ../tools/networking/noip { };
@ -10859,6 +10861,8 @@ in

  devpi-server = callPackage ../development/tools/devpi-server {};

+  dictu = callPackage ../development/compilers/dictu { };
+
  dotty = callPackage ../development/compilers/scala/dotty.nix { jre = jre8;};

  ecl = callPackage ../development/compilers/ecl { };
@ -11635,9 +11639,12 @@ in
    inherit (darwin) libiconv libobjc libresolv;
  }) mx jvmci8 graalvm8;

-  inherit (callPackages ../development/compilers/graalvm/community-edition.nix {
-    inherit (darwin.apple_sdk.frameworks) Foundation;
-  }) graalvm8-ce graalvm11-ce;
+  graalvmCEPackages =
+    recurseIntoAttrs (callPackage ../development/compilers/graalvm/community-edition {
+      inherit (darwin.apple_sdk.frameworks) Foundation;
+    });
+  graalvm8-ce = graalvmCEPackages.graalvm8-ce;
+  graalvm11-ce = graalvmCEPackages.graalvm11-ce;

  inherit (callPackages ../development/compilers/graalvm/enterprise-edition.nix { })
    graalvm8-ee
@ -23944,8 +23951,8 @@ in
  };

  emacsPackagesFor = emacs: import ./emacs-packages.nix {
-    inherit (lib) makeScope makeOverridable;
-    inherit emacs;
+    inherit (lib) makeScope makeOverridable dontRecurseIntoAttrs;
+    emacs' = emacs;
    pkgs' = pkgs;  # default pkgs used for bootstrapping the emacs package set
  };

--- a/pkgs/top-level/emacs-packages.nix
+++ b/pkgs/top-level/emacs-packages.nix
@ -21,7 +21,12 @@
  (package-initialize)
 */

-{ pkgs', makeScope, makeOverridable, emacs }:
+{ pkgs'
+, emacs'
+, makeScope
+, makeOverridable
+, dontRecurseIntoAttrs
+}:

 let

@ -71,7 +76,12 @@ in makeScope pkgs'.newScope (self: makeOverridable ({
  // manualPackages // { inherit manualPackages; }
  // {

-    inherit emacs;
+    # Propagate overriden scope
+    emacs = emacs'.overrideAttrs(old: {
+      passthru = old.passthru // {
+        pkgs = dontRecurseIntoAttrs self;
+      };
+    });

    trivialBuild = pkgs.callPackage ../build-support/emacs/trivial.nix {
      inherit (self) emacs;
@ -84,7 +94,7 @@ in makeScope pkgs'.newScope (self: makeOverridable ({
    emacsWithPackages = emacsWithPackages { inherit pkgs lib; } self;
    withPackages = emacsWithPackages { inherit pkgs lib; } self;

-  }// {
+  } // {

    # Package specific priority overrides goes here