Merge master into staging-next

51 files changed, 1215 insertions, 148 deletions

diff --git a/doc/languages-frameworks/rust.section.md b/doc/languages-frameworks/rust.section.md
index f2f3502550e..7959685af6d 100644
--- a/doc/languages-frameworks/rust.section.md
+++ b/doc/languages-frameworks/rust.section.md
@@ -454,7 +454,7 @@ you of the correct hash.
 * `maturinBuildHook`: use [Maturin](https://github.com/PyO3/maturin)
   to build a Python wheel. Similar to `cargoBuildHook`, the optional
   variable `buildAndTestSubdir` can be used to build a crate in a
-  Cargo workspace. Additional maturin flags can be passed through
+  Cargo workspace. Additional Maturin flags can be passed through
   `maturinBuildFlags`.
 * `cargoCheckHook`: run tests using Cargo. The build type for checks
   can be set using `cargoCheckType`. Features can be specified with
@@ -476,7 +476,7 @@ dependencies. The build itself is then performed by
 
 The following example outlines how the `tokenizers` Python package is
 built. Since the Python package is in the `source/bindings/python`
-directory of the *tokenizers* project's source archive, we use
+directory of the `tokenizers` project's source archive, we use
 `sourceRoot` to point the tooling to this directory:
 
 ```nix
@@ -758,7 +758,7 @@ with import <nixpkgs> {};
 Actually, the overrides introduced in the previous section are more
 general. A number of other parameters can be overridden:
 
-- The version of rustc used to compile the crate:
+- The version of `rustc` used to compile the crate:
 
   ```nix
   (hello {}).override { rust = pkgs.rust; };
@@ -771,7 +771,7 @@ general. A number of other parameters can be overridden:
   (hello {}).override { release = false; };
   ```
 
-- Whether to print the commands sent to rustc when building
+- Whether to print the commands sent to `rustc` when building
   (equivalent to `--verbose` in cargo:
 
   ```nix
@@ -912,11 +912,11 @@ detailed usage.
 
 Fenix is an alternative to `rustup` and can also be used as an overlay.
 
-Both Oxalica's overlay and fenix better integrate with nix and cache optimizations.
+Both oxalica's overlay and fenix better integrate with nix and cache optimizations.
 Because of this and ergonomics, either of those community projects
-should be preferred to the Mozilla's Rust overlay (nixpkgs-mozilla).
+should be preferred to the Mozilla's Rust overlay (`nixpkgs-mozilla`).
 
-### How to select a specific rustc and toolchain version {#how-to-select-a-specific-rustc-and-toolchain-version}
+### How to select a specific `rustc` and toolchain version {#how-to-select-a-specific-rustc-and-toolchain-version}
 
 You can consume the oxalica overlay and use it to grab a specific Rust toolchain version.
 Here is an example `shell.nix` showing how to grab the current stable toolchain:
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 931040ad890..a2e74aa129b 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -4201,6 +4201,12 @@
     githubId = 1713676;
     name = "Luis G. Torres";
   };
+  GKasparov = {
+    email = "mizozahr@gmail.com";
+    github = "GKasparov";
+    githubId = 60962839;
+    name = "Mazen Zahr";
+  };
   gleber = {
     email = "gleber.p@gmail.com";
     github = "gleber";
@@ -9384,6 +9390,12 @@
     githubId = 52847440;
     name = "Ryan Burns";
   };
+  r3dl3g = {
+    email = "redleg@rothfuss-web.de";
+    github = "r3dl3g";
+    githubId = 35229674;
+    name = "Armin Rothfuss";
+  };
   raboof = {
     email = "arnout@bzzt.net";
     matrix = "@raboof:matrix.org";
diff --git a/nixos/tests/owncast.nix b/nixos/tests/owncast.nix
index e54d2cc5dd4..debb34f5009 100644
--- a/nixos/tests/owncast.nix
+++ b/nixos/tests/owncast.nix
@@ -1,21 +1,42 @@
-{ system ? builtins.currentSystem, config ? { }
-, pkgs ? import ../.. { inherit system config; } }:
-
-with import (nixpkgs + "/nixos/lib/testing-python.nix") { inherit system; };
-makeTest {
+import ./make-test-python.nix ({ pkgs, ... }: {
   name = "owncast";
-  meta = with pkgs.stdenv.lib.maintainers; { maintainers = [ MayNiklas ]; };
+  meta = with pkgs.lib.maintainers; { maintainers = [ MayNiklas ]; };
 
   nodes = {
-    client = { ... }: {
-      environment.systemPackages = [ curl ];
-      services.owncast = { enable = true; };
+    client = { pkgs, ... }: with pkgs.lib; {
+      networking = {
+        dhcpcd.enable = false;
+        interfaces.eth1.ipv6.addresses = mkOverride 0 [ { address = "fd00::2"; prefixLength = 64; } ];
+        interfaces.eth1.ipv4.addresses = mkOverride 0 [ { address = "192.168.1.2"; prefixLength = 24; } ];
+      };
+    };
+    server = { pkgs, ... }: with pkgs.lib; {
+      networking = {
+        dhcpcd.enable = false;
+        useNetworkd = true;
+        useDHCP = false;
+        interfaces.eth1.ipv6.addresses = mkOverride 0 [ { address = "fd00::1"; prefixLength = 64; } ];
+        interfaces.eth1.ipv4.addresses = mkOverride 0 [ { address = "192.168.1.1"; prefixLength = 24; } ];
+
+        firewall.allowedTCPPorts = [ 8080 ];
+      };
+
+      services.owncast = {
+        enable = true;
+        listen = "0.0.0.0";
+      };
     };
   };
 
   testScript = ''
     start_all()
-    client.wait_for_unit("owncast.service")
-    client.succeed("curl localhost:8080/api/status")
+
+    client.wait_for_unit("network-online.target")
+    server.wait_for_unit("network-online.target")
+    server.wait_for_unit("owncast.service")
+    server.wait_until_succeeds("ss -ntl | grep -q 8080")
+
+    client.succeed("curl http://192.168.1.1:8080/api/status")
+    client.succeed("curl http://[fd00::1]:8080/api/status")
   '';
-}
+})
diff --git a/pkgs/applications/blockchains/btcpayserver/default.nix b/pkgs/applications/blockchains/btcpayserver/default.nix
index e2f08e5e6b4..0d9da9b3ced 100644
--- a/pkgs/applications/blockchains/btcpayserver/default.nix
+++ b/pkgs/applications/blockchains/btcpayserver/default.nix
@@ -3,13 +3,13 @@
 
 buildDotnetModule rec {
   pname = "btcpayserver";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-TAngdQz3FupoqPrqskjSQ9xSDbZV4/6+j7C4NjBFcFw=";
+    sha256 = "sha256-IBdQlVZx7Bt4y7B7FvHJihHUWO15a89hs+SGwcobDqY=";
   };
 
   projectFile = "BTCPayServer/BTCPayServer.csproj";
diff --git a/pkgs/applications/editors/eclipse/plugins.nix b/pkgs/applications/editors/eclipse/plugins.nix
index 46a9b6c477a..337479b16bc 100644
--- a/pkgs/applications/editors/eclipse/plugins.nix
+++ b/pkgs/applications/editors/eclipse/plugins.nix
@@ -639,4 +639,99 @@ rec {
     };
   };
 
+  ivyde = buildEclipsePlugin rec {
+    name = "ivyde-${version}";
+    version = "2.2.0.final-201311091524-RELEASE";
+
+    srcFeature = fetchurl {
+      url = "https://downloads.apache.org/ant/ivyde/updatesite/ivyde-${version}/features/org.apache.ivyde.feature_${version}.jar";
+      sha1 = "c8fb6c4aab32db13db0bd81c1a148032667fff31";
+    };
+
+    srcPlugin = fetchurl {
+      url = "https://downloads.apache.org/ant/ivyde/updatesite/ivyde-${version}/plugins/org.apache.ivyde.eclipse_${version}.jar";
+      sha1 = "0c80c2e228a07f18efab1c56ea026448eda70c06";
+    };
+
+    meta = with lib; {
+      homepage = "https://ant.apache.org/ivy/ivyde/index.html";
+      description = "A plugin which integrates Apache Ivy's dependency management";
+      license = licenses.asl20;
+      platforms = platforms.all;
+      maintainers = [ maintainers.r3dl3g ];
+    };
+  };
+
+  ivyderv = buildEclipsePlugin rec {
+    name = "ivyderv-${version}";
+    version = "2.2.0.final-201311091524-RELEASE";
+
+    srcFeature = fetchurl {
+      url = "https://downloads.apache.org/ant/ivyde/updatesite/ivyde-${version}/features/org.apache.ivyde.eclipse.resolvevisualizer.feature_${version}.jar";
+      sha1 = "fb1941eaa2c0de54259de01b0da6d5a6b4a2cab1";
+    };
+
+    srcPlugin = fetchurl {
+      url = "https://downloads.apache.org/ant/ivyde/updatesite/ivyde-${version}/plugins/org.apache.ivyde.eclipse.resolvevisualizer_${version}.jar";
+      sha1 = "225e0c8ccb010d622c159560638578c2fc51a67e";
+    };
+
+    meta = with lib; {
+      homepage = "https://ant.apache.org/ivy/ivyde/index.html";
+      description = "A graph viewer of the resolved dependencies.";
+      longDescription = ''
+        Apache IvyDE Resolve Visualizer is an optional dependency of Apache IvyDE since
+        it requires additional plugins to be installed (Zest).
+      '';
+      license = licenses.asl20;
+      platforms = platforms.all;
+      maintainers = [ maintainers.r3dl3g ];
+    };
+  };
+
+  ivy = buildEclipsePlugin rec {
+    name = "ivy-${version}";
+    version = "2.5.0.final_20191020104435";
+
+    srcFeature = fetchurl {
+      url = "https://downloads.apache.org/ant/ivyde/updatesite/ivy-${version}/features/org.apache.ivy.eclipse.ant.feature_${version}.jar";
+      sha256 = "de6134171a0edf569bb9b4c3a91639d469f196e86804d218adfdd60a5d7fa133";
+    };
+
+    srcPlugin = fetchurl {
+      url = "https://downloads.apache.org/ant/ivyde/updatesite/ivy-${version}/plugins/org.apache.ivy.eclipse.ant_${version}.jar";
+      sha256 = "9e8ea20480cf73d0f0f3fb032d263c7536b24fd2eef71beb7d62af4e065f9ab5";
+    };
+
+    meta = with lib; {
+      homepage = "https://ant.apache.org/ivy/index.html";
+      description = "A popular dependency manager focusing on flexibility and simplicity";
+      license = licenses.asl20;
+      platforms = platforms.all;
+      maintainers = [ maintainers.r3dl3g ];
+    };
+  };
+
+  ivyant = buildEclipsePlugin rec {
+    name = "ivyant-${version}";
+    version = "2.5.0.final_20191020104435";
+
+    srcFeature = fetchurl {
+      url = "https://downloads.apache.org/ant/ivyde/updatesite/ivy-${version}/features/org.apache.ivy.eclipse.ant.feature_${version}.jar";
+      sha256 = "de6134171a0edf569bb9b4c3a91639d469f196e86804d218adfdd60a5d7fa133";
+    };
+
+    srcPlugin = fetchurl {
+      url = "https://downloads.apache.org/ant/ivyde/updatesite/ivy-${version}/plugins/org.apache.ivy.eclipse.ant_${version}.jar";
+      sha256 = "9e8ea20480cf73d0f0f3fb032d263c7536b24fd2eef71beb7d62af4e065f9ab5";
+    };
+
+    meta = with lib; {
+      homepage = "https://ant.apache.org/ivy/ivyde/index.html";
+      description = "Ant Tasks integrated into Eclipse's Ant runtime";
+      license = licenses.asl20;
+      platforms = platforms.all;
+      maintainers = [ maintainers.r3dl3g ];
+    };
+  };
 }
diff --git a/pkgs/applications/misc/azuredatastudio/default.nix b/pkgs/applications/misc/azuredatastudio/default.nix
index fca1ad12fd1..f7e39396602 100644
--- a/pkgs/applications/misc/azuredatastudio/default.nix
+++ b/pkgs/applications/misc/azuredatastudio/default.nix
@@ -1,9 +1,12 @@
 { stdenv
 , lib
 , fetchurl
+, copyDesktopItems
+, makeDesktopItem
 , makeWrapper
 , libuuid
 , libunwind
+, libxkbcommon
 , icu
 , openssl
 , zlib
@@ -13,23 +16,69 @@
 , gnutar
 , atomEnv
 , libkrb5
+, libdrm
+, mesa
+, xorg
 }:
 
 # from justinwoo/azuredatastudio-nix
 # https://github.com/justinwoo/azuredatastudio-nix/blob/537c48aa3981cd1a82d5d6e508ab7e7393b3d7c8/default.nix
 
+let
+  desktopItem = makeDesktopItem {
+    name = "azuredatastudio";
+    desktopName = "Azure Data Studio";
+    comment = "Data Management Tool that enables you to work with SQL Server, Azure SQL DB and SQL DW from Windows, macOS and Linux.";
+    genericName = "Text Editor";
+    exec = "azuredatastudio --no-sandbox --unity-launch %F";
+    icon = "azuredatastudio";
+    startupNotify = "true";
+    categories = "Utility;TextEditor;Development;IDE;";
+    mimeType = "text/plain;inode/directory;application/x-azuredatastudio-workspace;";
+    extraEntries = ''
+      StartupWMClass=azuredatastudio
+      Actions=new-empty-window;
+      Keywords=azuredatastudio;
+
+      [Desktop Action new-empty-window]
+      Name=New Empty Window
+      Exec=azuredatastudio --no-sandbox --new-window %F
+      Icon=azuredatastudio
+    '';
+  };
+
+  urlHandlerDesktopItem = makeDesktopItem {
+    name = "azuredatastudio-url-handler";
+    desktopName = "Azure Data Studio - URL Handler";
+    comment = "Azure Data Studio";
+    genericName = "Text Editor";
+    exec = "azuredatastudio --no-sandbox --open-url %U";
+    icon = "azuredatastudio";
+    startupNotify = "true";
+    categories = "Utility;TextEditor;Development;IDE;";
+    mimeType = "x-scheme-handler/azuredatastudio;";
+    extraEntries = ''
+      NoDisplay=true
+      Keywords=azuredatastudio;
+    '';
+  };
+in
 stdenv.mkDerivation rec {
 
   pname = "azuredatastudio";
-  version = "1.17.1";
+  version = "1.33.0";
+
+  desktopItems = [ desktopItem urlHandlerDesktopItem ];
 
   src = fetchurl {
-    url = "https://azuredatastudiobuilds.blob.core.windows.net/releases/${version}/azuredatastudio-linux-${version}.tar.gz";
-    sha256 = "0px9n9vyjvyddca4x7d0zindd0dim7350vkjg5dd0506fm8dc38k";
+    name = "${pname}-${version}.tar.gz";
+    url = "https://azuredatastudio-update.azurewebsites.net/${version}/linux-x64/stable";
+    sha256 = "0593xs44ryfyxy0hc31hdbj706q16h58jb0qyfyncn7ngybm3423";
   };
 
   nativeBuildInputs = [
     makeWrapper
+    copyDesktopItems
   ];
 
   buildInputs = [
@@ -38,7 +87,14 @@ stdenv.mkDerivation rec {
     at-spi2-atk
   ];
 
-  dontInstall = true;
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/pixmaps
+    cp ${targetPath}/resources/app/resources/linux/code.png $out/share/pixmaps/azuredatastudio.png
+
+    runHook postInstall
+  '';
 
   # change this to azuredatastudio-insiders for insiders releases
   edition = "azuredatastudio";
@@ -60,7 +116,7 @@ stdenv.mkDerivation rec {
   ];
 
   # this will most likely need to be updated when azuredatastudio's version changes
-  sqltoolsservicePath = "${targetPath}/resources/app/extensions/mssql/sqltoolsservice/Linux/2.0.0-release.56";
+  sqltoolsservicePath = "${targetPath}/resources/app/extensions/mssql/sqltoolsservice/Linux/3.0.0-release.139";
 
   rpath = lib.concatStringsSep ":" [
     atomEnv.libPath
@@ -71,6 +127,10 @@ stdenv.mkDerivation rec {
         at-spi2-atk
         stdenv.cc.cc.lib
         libkrb5
+        libdrm
+        libxkbcommon
+        mesa
+        xorg.libxshmfence
       ]
     )
     targetPath
@@ -111,5 +171,6 @@ stdenv.mkDerivation rec {
     description = "A data management tool that enables working with SQL Server, Azure SQL DB and SQL DW";
     homepage = "https://docs.microsoft.com/en-us/sql/azure-data-studio/download-azure-data-studio";
     license = lib.licenses.unfreeRedistributable;
+    platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/applications/misc/snapmaker-luban/default.nix b/pkgs/applications/misc/snapmaker-luban/default.nix
new file mode 100644
index 00000000000..84ad34637f5
--- /dev/null
+++ b/pkgs/applications/misc/snapmaker-luban/default.nix
@@ -0,0 +1,88 @@
+{ lib, stdenv, autoPatchelfHook, makeDesktopItem, copyDesktopItems, wrapGAppsHook, fetchurl
+, alsa-lib, at-spi2-atk, at-spi2-core, atk, cairo, cups
+, gtk3, nss, glib, dbus, nspr, gdk-pixbuf
+, libX11, libXScrnSaver, libXcomposite, libXcursor, libXdamage, libXext
+, libXfixes, libXi, libXrandr, libXrender, libXtst, libxcb, pango
+, gcc-unwrapped, udev
+}:
+
+stdenv.mkDerivation rec {
+  pname = "snapmaker-luban";
+  version = "4.0.3";
+
+  src = fetchurl {
+    url = "https://github.com/Snapmaker/Luban/releases/download/v${version}/snapmaker-luban-${version}-linux-x64.tar.gz";
+    sha256 = "13qk7ssfawjaa5p4mnml4ndzzsqs26qpi76hc9qaipi74ss3jih4";
+  };
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    wrapGAppsHook
+    copyDesktopItems
+  ];
+
+  buildInputs = [
+    alsa-lib
+    at-spi2-atk
+    at-spi2-core
+    cairo
+    cups
+    gcc-unwrapped
+    gtk3
+    libXdamage
+    libX11
+    libXScrnSaver
+    libXtst
+    libxcb
+    nspr
+    nss
+  ];
+
+  libPath = lib.makeLibraryPath [
+    stdenv.cc.cc alsa-lib atk at-spi2-atk at-spi2-core cairo cups
+    gdk-pixbuf glib gtk3 libX11 libXcomposite
+    libXcursor libXdamage libXext libXfixes libXi libXrandr libXrender
+    libXtst nspr nss libxcb pango libXScrnSaver udev
+  ];
+
+  dontWrapGApps = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{bin,opt,share/pixmaps}/
+    mv * $out/opt/
+
+    patchelf --set-interpreter ${stdenv.cc.bintools.dynamicLinker} \
+      $out/opt/snapmaker-luban
+
+    wrapProgram $out/opt/snapmaker-luban \
+      "''${gappsWrapperArgs[@]}" \
+      --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}/" \
+      --prefix LD_LIBRARY_PATH : ${libPath}:$out/snapmaker-luban
+
+    ln -s $out/opt/snapmaker-luban $out/bin/snapmaker-luban
+    ln -s $out/opt/resources/app/app/resources/images/snap-luban-logo-64x64.png $out/share/pixmaps/snapmaker-luban.png
+
+    runHook postInstall
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = pname;
+      exec = "snapmaker-luban";
+      icon = "snapmaker-luban";
+      desktopName = "Snapmaker Luban";
+      genericName = meta.description;
+      categories = "Office;Printing;";
+    })
+  ];
+
+  meta = with lib; {
+    description = "Snapmaker Luban is an easy-to-use 3-in-1 software tailor-made for Snapmaker machines";
+    homepage = "https://github.com/Snapmaker/Luban";
+    license = licenses.gpl3;
+    maintainers = [ maintainers.simonkampe ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/applications/networking/cisco-packet-tracer/7.nix b/pkgs/applications/networking/cisco-packet-tracer/7.nix
new file mode 100644
index 00000000000..33f35ba12af
--- /dev/null
+++ b/pkgs/applications/networking/cisco-packet-tracer/7.nix
@@ -0,0 +1,90 @@
+{ stdenv
+, lib
+, buildFHSUserEnvBubblewrap
+, callPackage
+, copyDesktopItems
+, dpkg
+, lndir
+, makeDesktopItem
+, makeWrapper
+, requireFile
+}:
+
+let
+  version = "7.3.1";
+
+  ptFiles = stdenv.mkDerivation {
+    name = "PacketTracer7drv";
+    inherit version;
+
+    dontUnpack = true;
+    src = requireFile {
+      name = "PacketTracer_${builtins.replaceStrings ["."] [""] version}_amd64.deb";
+      sha256 = "c39802d15dd61d00ba27fb8c116da45fd8562ab4b49996555ad66b88deace27f";
+      url = "https://www.netacad.com";
+    };
+
+    nativeBuildInputs = [ dpkg makeWrapper ];
+
+    installPhase = ''
+      dpkg-deb -x $src $out
+      makeWrapper "$out/opt/pt/bin/PacketTracer7" "$out/bin/packettracer7" \
+          --prefix LD_LIBRARY_PATH : "$out/opt/pt/bin"
+    '';
+  };
+
+  desktopItem = makeDesktopItem {
+    name = "cisco-pt7.desktop";
+    desktopName = "Cisco Packet Tracer 7";
+    icon = "${ptFiles}/opt/pt/art/app.png";
+    exec = "packettracer7 %f";
+    mimeType = "application/x-pkt;application/x-pka;application/x-pkz;";
+  };
+
+  fhs = buildFHSUserEnvBubblewrap {
+    name = "packettracer7";
+    runScript = "${ptFiles}/bin/packettracer7";
+
+    targetPkgs = pkgs: with pkgs; [
+      alsa-lib
+      dbus
+      expat
+      fontconfig
+      glib
+      libglvnd
+      libpulseaudio
+      libudev0-shim
+      libxkbcommon
+      libxml2
+      libxslt
+      nspr
+      nss
+      xorg.libICE
+      xorg.libSM
+      xorg.libX11
+      xorg.libXScrnSaver
+    ];
+  };
+in stdenv.mkDerivation {
+  pname = "ciscoPacketTracer7";
+  inherit version;
+
+  dontUnpack = true;
+
+  installPhase = ''
+    mkdir $out
+    ${lndir}/bin/lndir -silent ${fhs} $out
+  '';
+
+  desktopItems = [ desktopItem ];
+
+  nativeBuildInputs = [ copyDesktopItems ];
+
+  meta = with lib; {
+    description = "Network simulation tool from Cisco";
+    homepage = "https://www.netacad.com/courses/packet-tracer";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ lucasew ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/applications/networking/cisco-packet-tracer/8.nix b/pkgs/applications/networking/cisco-packet-tracer/8.nix
new file mode 100644
index 00000000000..c823dcbb1d3
--- /dev/null
+++ b/pkgs/applications/networking/cisco-packet-tracer/8.nix
@@ -0,0 +1,131 @@
+{ stdenv
+, lib
+, alsa-lib
+, autoPatchelfHook
+, buildFHSUserEnvBubblewrap
+, callPackage
+, copyDesktopItems
+, dbus
+, dpkg
+, expat
+, fontconfig
+, glib
+, libdrm
+, libglvnd
+, libpulseaudio
+, libudev0-shim
+, libxkbcommon
+, libxml2
+, libxslt
+, lndir
+, makeDesktopItem
+, makeWrapper
+, nspr
+, nss
+, requireFile
+, xorg
+}:
+
+let
+  version = "8.0.1";
+
+  ptFiles = stdenv.mkDerivation {
+    name = "PacketTracer8Drv";
+    inherit version;
+
+    dontUnpack = true;
+    src = requireFile {
+      name = "CiscoPacketTracer_${builtins.replaceStrings ["."] [""] version}_Ubuntu_64bit.deb";
+      sha256 = "77a25351b016faed7c78959819c16c7013caa89c6b1872cb888cd96edd259140";
+      url = "https://www.netacad.com";
+    };
+
+    nativeBuildInputs = [
+      alsa-lib
+      autoPatchelfHook
+      dbus
+      dpkg
+      expat
+      fontconfig
+      glib
+      libdrm
+      libglvnd
+      libpulseaudio
+      libudev0-shim
+      libxkbcommon
+      libxml2
+      libxslt
+      makeWrapper
+      nspr
+      nss
+    ] ++ (with xorg; [
+      libICE
+      libSM
+      libX11
+      libxcb
+      libXcomposite
+      libXcursor
+      libXdamage
+      libXext
+      libXfixes
+      libXi
+      libXrandr
+      libXrender
+      libXScrnSaver
+      xcbutilimage
+      xcbutilkeysyms
+      xcbutilrenderutil
+      xcbutilwm
+    ]);
+
+    installPhase = ''
+      dpkg-deb -x $src $out
+      chmod 755 "$out"
+      makeWrapper "$out/opt/pt/bin/PacketTracer" "$out/bin/packettracer" \
+        --prefix LD_LIBRARY_PATH : "$out/opt/pt/bin"
+
+      # Keep source archive cached, to avoid re-downloading
+      ln -s $src $out/usr/share/
+    '';
+  };
+
+  desktopItem = makeDesktopItem {
+    name = "cisco-pt8.desktop";
+    desktopName = "Cisco Packet Tracer 8";
+    icon = "${ptFiles}/opt/pt/art/app.png";
+    exec = "packettracer8 %f";
+    mimeType = "application/x-pkt;application/x-pka;application/x-pkz;";
+  };
+
+  fhs = buildFHSUserEnvBubblewrap {
+    name = "packettracer8";
+    runScript = "${ptFiles}/bin/packettracer";
+    targetPkgs = pkgs: [ libudev0-shim ];
+
+    extraInstallCommands = ''
+      mkdir -p "$out/share/applications"
+      cp "${desktopItem}"/share/applications/* "$out/share/applications/"
+    '';
+  };
+in stdenv.mkDerivation {
+  pname = "ciscoPacketTracer8";
+  inherit version;
+
+  dontUnpack = true;
+
+  installPhase = ''
+    mkdir $out
+    ${lndir}/bin/lndir -silent ${fhs} $out
+  '';
+
+  desktopItems = [ desktopItem ];
+  nativeBuildInputs = [ copyDesktopItems ];
+
+  meta = with lib; {
+    description = "Network simulation tool from Cisco";
+    homepage = "https://www.netacad.com/courses/packet-tracer";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ lucasew ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/applications/networking/instant-messengers/jami/client-gnome.nix b/pkgs/applications/networking/instant-messengers/jami/client-gnome.nix
index 019ffb468d2..8cb748f5405 100644
--- a/pkgs/applications/networking/instant-messengers/jami/client-gnome.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/client-gnome.nix
@@ -39,6 +39,10 @@ stdenv.mkDerivation {
   dontWrapGApps = true;
   preFixup = ''
     qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
+    # Users that set CLUTTER_BACKEND=wayland in their default environment will
+    # encounter a segfault due to:
+    # https://git.jami.net/savoirfairelinux/jami-client-gnome/-/issues/1100 .
+    qtWrapperArgs+=("--unset" "CLUTTER_BACKEND")
   '';
 
   buildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/jami/daemon.nix b/pkgs/applications/networking/instant-messengers/jami/daemon.nix
index 456ca85ed12..2fe6d7191e7 100644
--- a/pkgs/applications/networking/instant-messengers/jami/daemon.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/daemon.nix
@@ -49,6 +49,10 @@ let
         ++ lib.optionals stdenv.isLinux (readLinesToList ./config/ffmpeg_args_linux)
         ++ lib.optionals (stdenv.isx86_32 || stdenv.isx86_64) (readLinesToList ./config/ffmpeg_args_x86);
       outputs = [ "out" "doc" ];
+      meta = old.meta // {
+        # undefined reference to `ff_nlmeans_init_aarch64'
+        broken = stdenv.isAarch64;
+      };
     });
 
   pjsip-jami = pjsip.overrideAttrs (old:
diff --git a/pkgs/applications/networking/zerobin/default.nix b/pkgs/applications/networking/zerobin/default.nix
index 16a52d67045..56d5274751f 100644
--- a/pkgs/applications/networking/zerobin/default.nix
+++ b/pkgs/applications/networking/zerobin/default.nix
@@ -40,7 +40,7 @@ python3Packages.buildPythonApplication rec {
     # relax version constraints of some dependencies
     substituteInPlace setup.cfg \
       --replace "clize==4.1.1" "clize" \
-      --replace "bleach==3.1.5" "bleach>=3.1.5,<4" \
+      --replace "bleach==3.1.5" "bleach>=3.1.5,<5" \
       --replace "bottle==0.12.18" "bottle>=0.12.18,<1" \
       --replace "Paste==3.4.3" "Paste>=3.4.3,<4"
   '';
diff --git a/pkgs/applications/science/medicine/xmedcon/default.nix b/pkgs/applications/science/medicine/xmedcon/default.nix
index e4a5f22891e..3c2bec86a7a 100644
--- a/pkgs/applications/science/medicine/xmedcon/default.nix
+++ b/pkgs/applications/science/medicine/xmedcon/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xmedcon";
-  version = "0.21.0";
+  version = "0.21.2";
 
   src = fetchurl {
     url = "https://prdownloads.sourceforge.net/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "0yfnbrcil5i76z1wbg308pb1mnjbcxy6nih46qpqs038v1lhh4q8";
+    sha256 = "0svff8rc3j2p47snaq1hx9mv4ydmxawpb0hf3d165g1ccjwvmm6m";
   };
 
   buildInputs = [
@@ -31,6 +31,6 @@ stdenv.mkDerivation rec {
     homepage = "https://xmedcon.sourceforge.io/Main/HomePage";
     license = licenses.lgpl2Plus;
     maintainers = with maintainers; [ arianvp flokli ];
-    platforms = with platforms; [ darwin linux ];
+    platforms = platforms.darwin ++ platforms.linux;
   };
 }
diff --git a/pkgs/applications/virtualization/crun/default.nix b/pkgs/applications/virtualization/crun/default.nix
index c91bf3d142a..2f09c3a29c7 100644
--- a/pkgs/applications/virtualization/crun/default.nix
+++ b/pkgs/applications/virtualization/crun/default.nix
@@ -37,13 +37,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "crun";
-  version = "1.2";
+  version = "1.3";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = version;
-    sha256 = "sha256-7YDU7H4dVT6qI+Gt3bkm7vqHlU0Fr7ZhF4SWcA+RhYw=";
+    sha256 = "sha256-c0jXhqYdEpt4De1Z6VNwyrv0KJcf039Wp3ye0oTW0Qc=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/window-managers/picom/picom-next.nix b/pkgs/applications/window-managers/picom/picom-next.nix
new file mode 100644
index 00000000000..67b510396f7
--- /dev/null
+++ b/pkgs/applications/window-managers/picom/picom-next.nix
@@ -0,0 +1,13 @@
+{ picom, lib, fetchFromGitHub }:
+
+picom.overrideAttrs (oldAttrs: rec {
+  pname = "picom-next";
+  version = "unstable-2021-10-31";
+  src = fetchFromGitHub {
+    owner = "yshui";
+    repo = "picom";
+    rev = "fade045eadf171d2c732820d6ebde7d1943a1397";
+    sha256 = "fPiLZ63+Bw5VCxVNqj9i5had2YLa+jFMMf85MYdqvHU=";
+  };
+  meta.maintainers = with lib.maintainers; oldAttrs.meta.maintainers ++ [ GKasparov ];
+})
diff --git a/pkgs/data/misc/v2ray-domain-list-community/default.nix b/pkgs/data/misc/v2ray-domain-list-community/default.nix
new file mode 100644
index 00000000000..bff703563d4
--- /dev/null
+++ b/pkgs/data/misc/v2ray-domain-list-community/default.nix
@@ -0,0 +1,35 @@
+{ stdenv, buildGoModule, fetchFromGitHub, lib }:
+
+let
+  generator = buildGoModule rec {
+    pname = "v2ray-domain-list-community";
+    version = "20211103073737";
+    src = fetchFromGitHub {
+      owner = "v2fly";
+      repo = "domain-list-community";
+      rev = version;
+      sha256 = "sha256-NYgEXbow16w+XMRjbQG1cIn/BjPbbcj+uzb4kcVR6eI=";
+    };
+    vendorSha256 = "sha256-JuLU9v1ukVfAEtz07tGk66st1+sO4SBz83BlK3IPQwU=";
+    meta = with lib; {
+      description = "community managed domain list";
+      homepage = "https://github.com/v2fly/domain-list-community";
+      license = licenses.mit;
+      maintainers = with maintainers; [ nickcao ];
+    };
+  };
+in
+stdenv.mkDerivation {
+  inherit (generator) pname version src meta;
+  buildPhase = ''
+    runHook preBuild
+    ${generator}/bin/domain-list-community -datapath $src/data --exportlists=category-ads-all,tld-cn,cn,tld-\!cn,geolocation-\!cn,apple,icloud
+    runHook postBuild
+  '';
+  installPhase = ''
+    runHook preInstall
+    install -Dm644 dlc.dat $out/share/v2ray/geosite.dat
+    runHook postInstall
+  '';
+  passthru.generator = generator;
+}
diff --git a/pkgs/development/coq-modules/coqeal/default.nix b/pkgs/development/coq-modules/coqeal/default.nix
index e9ce81c30a9..3921104cb54 100644
--- a/pkgs/development/coq-modules/coqeal/default.nix
+++ b/pkgs/development/coq-modules/coqeal/default.nix
@@ -10,12 +10,13 @@ with lib;
 
   inherit version;
   defaultVersion = with versions; switch [ coq.version mathcomp.version ]  [
-      { cases = [ (isGe "8.10") (isGe "1.12.0") ]; out = "1.0.6"; }
+      { cases = [ (isGe "8.10") (isGe "1.12.0") ]; out = "1.1.0"; }
       { cases = [ (isGe "8.10") (range "1.11.0" "1.12.0") ]; out = "1.0.5"; }
       { cases = [ (isGe "8.7") "1.11.0" ]; out = "1.0.4"; }
       { cases = [ (isGe "8.7") "1.10.0" ]; out = "1.0.3"; }
     ] null;
 
+  release."1.1.0".sha256 = "1vyhfna5frkkq2fl1fkg2mwzpg09k3sbzxxpyp14fjay81xajrxr";
   release."1.0.6".sha256 = "0lqkyfj4qbq8wr3yk8qgn7mclw582n3fjl9l19yp8cnchspzywx0";
   release."1.0.5".sha256 = "0cmvky8glb5z2dy3q62aln6qbav4lrf2q1589f6h1gn5bgjrbzkm";
   release."1.0.4".sha256 = "1g5m26lr2lwxh6ld2gykailhay4d0ayql4bfh0aiwqpmmczmxipk";
diff --git a/pkgs/development/libraries/arrow-cpp/default.nix b/pkgs/development/libraries/arrow-cpp/default.nix
index db9e5be6f2e..fbf84f34ca5 100644
--- a/pkgs/development/libraries/arrow-cpp/default.nix
+++ b/pkgs/development/libraries/arrow-cpp/default.nix
@@ -1,8 +1,39 @@
-{ stdenv, lib, fetchurl, fetchFromGitHub, fixDarwinDylibNames
-, autoconf, boost, brotli, cmake, flatbuffers, gflags, glog, gtest, jemalloc
-, lz4, perl, python3, rapidjson, re2, snappy, thrift, tzdata , utf8proc, which
-, zlib, zstd
+{ stdenv
+, lib
+, fetchurl
+, fetchFromGitHub
+, fixDarwinDylibNames
+, autoconf
+, aws-sdk-cpp
+, boost
+, brotli
+, c-ares
+, cmake
+, flatbuffers
+, gflags
+, glog
+, grpc
+, gtest
+, jemalloc
+, libnsl
+, lz4
+, minio
+, openssl
+, perl
+, protobuf
+, python3
+, rapidjson
+, re2
+, snappy
+, thrift
+, tzdata
+, utf8proc
+, which
+, zlib
+, zstd
 , enableShared ? !stdenv.hostPlatform.isStatic
+, enableFlight ? !stdenv.isDarwin # libnsl is not supported on darwin
+, enableS3 ? true
 }:
 
 let
@@ -20,7 +51,8 @@ let
     hash = "sha256-GmOAS8gGhzDI0WzORMkWHRRUl/XBwmNen2d3VefZxxc=";
   };
 
-in stdenv.mkDerivation rec {
+in
+stdenv.mkDerivation rec {
   pname = "arrow-cpp";
   version = "6.0.0";
 
@@ -78,7 +110,12 @@ in stdenv.mkDerivation rec {
   ] ++ lib.optionals enableShared [
     python3.pkgs.python
     python3.pkgs.numpy
-  ];
+  ] ++ lib.optionals enableFlight [
+    grpc
+    libnsl
+    openssl
+    protobuf
+  ] ++ lib.optionals enableS3 [ aws-sdk-cpp openssl ];
 
   preConfigure = ''
     patchShebangs build-support/
@@ -113,40 +150,53 @@ in stdenv.mkDerivation rec {
     # Parquet options:
     "-DARROW_PARQUET=ON"
     "-DPARQUET_BUILD_EXECUTABLES=ON"
+    "-DARROW_FLIGHT=${if enableFlight then "ON" else "OFF"}"
+    "-DARROW_S3=${if enableS3 then "ON" else "OFF"}"
   ] ++ lib.optionals (!enableShared) [
     "-DARROW_TEST_LINKAGE=static"
   ] ++ lib.optionals stdenv.isDarwin [
     "-DCMAKE_SKIP_BUILD_RPATH=OFF" # needed for tests
     "-DCMAKE_INSTALL_RPATH=@loader_path/../lib" # needed for tools executables
-  ] ++ lib.optional (!stdenv.isx86_64) "-DARROW_USE_SIMD=OFF";
+  ] ++ lib.optional (!stdenv.isx86_64) "-DARROW_USE_SIMD=OFF"
+  ++ lib.optional enableS3 "-DAWSSDK_CORE_HEADER_FILE=${aws-sdk-cpp}/include/aws/core/Aws.h";
 
   doInstallCheck = true;
-  ARROW_TEST_DATA =
-    if doInstallCheck then "${arrow-testing}/data" else null;
-  PARQUET_TEST_DATA =
-    if doInstallCheck then "${parquet-testing}/data" else null;
+  ARROW_TEST_DATA = lib.optionalString doInstallCheck "${arrow-testing}/data";
+  PARQUET_TEST_DATA = lib.optionalString doInstallCheck "${parquet-testing}/data";
   GTEST_FILTER =
-    if doInstallCheck then let
+    let
       # Upstream Issue: https://issues.apache.org/jira/browse/ARROW-11398
       filteredTests = lib.optionals stdenv.hostPlatform.isAarch64 [
         "TestFilterKernelWithNumeric/3.CompareArrayAndFilterRandomNumeric"
         "TestFilterKernelWithNumeric/7.CompareArrayAndFilterRandomNumeric"
         "TestCompareKernel.PrimitiveRandomTests"
+      ] ++ lib.optionals enableS3 [
+        "S3RegionResolutionTest.PublicBucket"
+        "S3RegionResolutionTest.RestrictedBucket"
+        "S3RegionResolutionTest.NonExistentBucket"
+        "S3OptionsTest.FromUri"
+        "TestMinioServer.Connect"
       ];
-    in "-${builtins.concatStringsSep ":" filteredTests}" else null;
-  installCheckInputs = [ perl which ];
+    in
+    lib.optionalString doInstallCheck "-${builtins.concatStringsSep ":" filteredTests}";
+  installCheckInputs = [ perl which ] ++ lib.optional enableS3 minio;
   installCheckPhase =
-  let
-    excludedTests = lib.optionals stdenv.isDarwin [
-      # Some plasma tests need to be patched to use a shorter AF_UNIX socket
-      # path on Darwin. See https://github.com/NixOS/nix/pull/1085
-      "plasma-external-store-tests"
-      "plasma-client-tests"
-    ];
-  in ''
-    ctest -L unittest -V \
-      --exclude-regex '^(${builtins.concatStringsSep "|" excludedTests})$'
-  '';
+    let
+      excludedTests = lib.optionals stdenv.isDarwin [
+        # Some plasma tests need to be patched to use a shorter AF_UNIX socket
+        # path on Darwin. See https://github.com/NixOS/nix/pull/1085
+        "plasma-external-store-tests"
+        "plasma-client-tests"
+      ];
+    in
+    ''
+      runHook preInstallCheck
+
+      ctest -L unittest -V \
+        --exclude-regex '^(${builtins.concatStringsSep "|" excludedTests})$'
+
+      runHook postInstallCheck
+    '';
 
   meta = with lib; {
     description = "A cross-language development platform for in-memory data";
diff --git a/pkgs/development/libraries/google-cloud-cpp/default.nix b/pkgs/development/libraries/google-cloud-cpp/default.nix
index 9a5b0cbc772..870e919357e 100644
--- a/pkgs/development/libraries/google-cloud-cpp/default.nix
+++ b/pkgs/development/libraries/google-cloud-cpp/default.nix
@@ -6,8 +6,8 @@
 , cmake
 , crc32c
 , curl
-, grpc
 , gbenchmark
+, grpc
 , gtest
 , ninja
 , nlohmann_json
@@ -15,6 +15,7 @@
 , protobuf
   # default list of APIs: https://github.com/googleapis/google-cloud-cpp/blob/v1.32.1/CMakeLists.txt#L173
 , apis ? [ "*" ]
+, staticOnly ? stdenv.hostPlatform.isStatic
 }:
 let
   googleapisRev = "ed739492993c4a99629b6430affdd6c0fb59d435";
@@ -24,6 +25,7 @@ let
     rev = googleapisRev;
     hash = "sha256:1xrnh77vb8hxmf1ywqsifzd39kylhbdyah0b0b9bm7nw0mnahssl";
   };
+  excludedTests = builtins.fromTOML (builtins.readFile ./skipped_tests.toml);
 in
 stdenv.mkDerivation rec {
   pname = "google-cloud-cpp";
@@ -45,6 +47,13 @@ stdenv.mkDerivation rec {
     cmake
     ninja
     pkg-config
+  ] ++ lib.optionals (!doInstallCheck) [
+    # enable these dependencies when doInstallCheck failse because we're
+    # unconditionally building tests and benchmarks
+    #
+    # when doInstallCheck is true, these deps are added to installCheckInputs
+    gbenchmark
+    gtest
   ];
 
   buildInputs = [
@@ -53,14 +62,57 @@ stdenv.mkDerivation rec {
     crc32c
     curl
     grpc
-    gbenchmark
-    gtest
     nlohmann_json
     protobuf
   ];
 
+  doInstallCheck = true;
+
+  preInstallCheck =
+    let
+      # These paths are added to (DY)LD_LIBRARY_PATH because they contain
+      # testing-only shared libraries that do not need to be installed, but
+      # need to be loadable by the test executables.
+      #
+      # Setting (DY)LD_LIBRARY_PATH is only necessary when building shared libraries.
+      additionalLibraryPaths = [
+        "$PWD/google/cloud/bigtable"
+        "$PWD/google/cloud/bigtable/benchmarks"
+        "$PWD/google/cloud/pubsub"
+        "$PWD/google/cloud/spanner"
+        "$PWD/google/cloud/spanner/benchmarks"
+        "$PWD/google/cloud/storage"
+        "$PWD/google/cloud/storage/benchmarks"
+        "$PWD/google/cloud/testing_util"
+      ];
+      ldLibraryPathName = "${lib.optionalString stdenv.isDarwin "DY"}LD_LIBRARY_PATH";
+    in
+    lib.optionalString doInstallCheck (
+      lib.optionalString (!staticOnly) ''
+        export ${ldLibraryPathName}=${lib.concatStringsSep ":" additionalLibraryPaths}
+      '' + ''
+        export GTEST_FILTER="-${lib.concatStringsSep ":" excludedTests.cases}"
+      ''
+    );
+
+  installCheckPhase = lib.optionalString doInstallCheck ''
+    runHook preInstallCheck
+
+    # disable tests that contact the internet
+    ctest --exclude-regex '^(${lib.concatStringsSep "|" excludedTests.whole})'
+
+    runHook postInstallCheck
+  '';
+
+  installCheckInputs = lib.optionals doInstallCheck [
+    gbenchmark
+    gtest
+  ];
+
   cmakeFlags = [
-    "-DBUILD_SHARED_LIBS:BOOL=ON"
+    "-DBUILD_SHARED_LIBS:BOOL=${if staticOnly then "OFF" else "ON"}"
+    # unconditionally build tests to catch linker errors as early as possible
+    # this adds a good chunk of time to the build
     "-DBUILD_TESTING:BOOL=ON"
     "-DGOOGLE_CLOUD_CPP_ENABLE_EXAMPLES:BOOL=OFF"
   ] ++ lib.optionals (apis != [ "*" ]) [
diff --git a/pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml b/pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml
new file mode 100644
index 00000000000..c2fb2a24483
--- /dev/null
+++ b/pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml
@@ -0,0 +1,112 @@
+whole = [
+  "bigquery_bigquery_read_integration_test",
+  "bigtable_admin_backup_integration_test",
+  "bigtable_admin_iam_policy_integration_test",
+  "bigtable_admin_integration_test",
+  "bigtable_apply_read_latency_benchmark",
+  "bigtable_data_async_future_integration_test",
+  "bigtable_data_integration_test",
+  "bigtable_endurance_benchmark",
+  "bigtable_filters_integration_test",
+  "bigtable_mutation_batcher_throughput_benchmark",
+  "bigtable_mutations_integration_test",
+  "bigtable_read_sync_vs_async_benchmark",
+  "bigtable_scan_throughput_benchmark",
+  "bigtable_table_sample_rows_integration_test",
+  "iam_iam_credentials_integration_test",
+  "iam_iam_integration_test",
+  "pubsub_endurance",
+  "pubsub_schema_admin_integration_test",
+  "pubsub_subscriber_integration_test",
+  "pubsub_subscription_admin_integration_test",
+  "pubsub_throughput",
+  "pubsub_topic_admin_integration_test",
+  "spanner_admin_backup_extra_integration_test",
+  "spanner_admin_database_admin_integration_test",
+  "spanner_admin_instance_admin_integration_test",
+  "spanner_backup_extra_integration_test",
+  "spanner_client_integration_test",
+  "spanner_client_stress_test",
+  "spanner_data_types_integration_test",
+  "spanner_database_admin_integration_test",
+  "spanner_instance_admin_integration_test",
+  "spanner_multiple_rows_cpu_benchmark",
+  "spanner_rpc_failure_threshold_integration_test",
+  "spanner_session_pool_integration_test",
+  "spanner_single_row_throughput_benchmark",
+  "storage_aggregate_download_throughput_benchmark",
+  "storage_aggregate_upload_throughput_benchmark",
+  "storage_alternative_endpoint_integration_test",
+  "storage_auto_finalize_integration_test",
+  "storage_bucket_integration_test",
+  "storage_create_client_integration_test",
+  "storage_create_dataset",
+  "storage_curl_download_request_integration_test",
+  "storage_curl_request_integration_test",
+  "storage_curl_resumable_upload_session_integration_test",
+  "storage_curl_sign_blob_integration_test",
+  "storage_grpc_integration_test",
+  "storage_key_file_integration_test",
+  "storage_minimal_iam_credentials_rest_integration_test",
+  "storage_object_basic_crud_integration_test",
+  "storage_object_checksum_integration_test",
+  "storage_object_compose_many_integration_test",
+  "storage_object_file_integration_test",
+  "storage_object_hash_integration_test",
+  "storage_object_insert_integration_test",
+  "storage_object_insert_preconditions_integration_test",
+  "storage_object_integration_test",
+  "storage_object_list_objects_versions_integration_test",
+  "storage_object_media_integration_test",
+  "storage_object_parallel_upload_integration_test",
+  "storage_object_plenty_clients_serially_integration_test",
+  "storage_object_plenty_clients_simultaneously_integration_test",
+  "storage_object_read_headers_integration_test",
+  "storage_object_read_preconditions_integration_test",
+  "storage_object_read_range_integration_test",
+  "storage_object_read_stream_integration_test",
+  "storage_object_resumable_parallel_upload_integration_test",
+  "storage_object_resumable_write_integration_test",
+  "storage_object_rewrite_integration_test",
+  "storage_object_write_preconditions_integration_test",
+  "storage_object_write_stream_integration_test",
+  "storage_object_write_streambuf_integration_test",
+  "storage_service_account_integration_test",
+  "storage_signed_url_integration_test",
+  "storage_small_reads_integration_test",
+  "storage_storage_file_transfer_benchmark",
+  "storage_storage_parallel_uploads_benchmark",
+  "storage_storage_throughput_vs_cpu_benchmark",
+  "storage_thread_integration_test",
+  "storage_throughput_experiment_test",
+  "storage_tracing_integration_test",
+  "storage_unified_credentials_integration_test",
+  "common_grpc_utils_internal_grpc_impersonate_service_account_integration_test"
+]
+cases = [
+  "BackupExtraIntegrationTest.CreateBackupWithExpiredVersionTime",
+  "BackupExtraIntegrationTest.BackupWithExpiredVersionTime",
+  "BackupExtraIntegrationTest.BackupWithFutureVersionTime",
+  "BackupExtraIntegrationTest.CreateBackupWithFutureVersionTime",
+  "DatabaseAdminClientTest.CreateWithEncryptionKey",
+  "DatabaseAdminClientTest.CreateWithNonexistentEncryptionKey",
+  "DatabaseAdminClientTest.DatabaseBasicCRUD",
+  "DatabaseAdminClientTest.VersionRetentionPeriodCreate",
+  "DatabaseAdminClientTest.VersionRetentionPeriodCreateFailure",
+  "DatabaseAdminClientTest.VersionRetentionPeriodUpdate",
+  "DatabaseAdminClientTest.VersionRetentionPeriodUpdateFailure",
+  "InstanceAdminClientTest.InstanceConfig",
+  "InstanceAdminClientTest.InstanceIam",
+  "InstanceAdminClientTest.InstanceReadOperations",
+  "LoggingIntegrationTest.ListMonitoredResourceDescriptors",
+  "LoggingIntegrationTest.WriteLogEntries",
+  "ObjectFileMultiThreadedTest.Download",
+  "SubscriberIntegrationTest.FireAndForget",
+  "SubscriberIntegrationTest.PublishOrdered",
+  "SubscriberIntegrationTest.PublishPullAck",
+  "SubscriberIntegrationTest.RawStub",
+  "SubscriberIntegrationTest.ReportNotFound",
+  "SubscriberIntegrationTest.StreamingSubscriptionBatchSource",
+  "SubscriptionAdminIntegrationTest.SubscriptionCRUD",
+  "TopicAdminIntegrationTest.TopicCRUD"
+]
diff --git a/pkgs/development/libraries/openssl/3.0/nix-ssl-cert-file.patch b/pkgs/development/libraries/openssl/3.0/nix-ssl-cert-file.patch
new file mode 100644
index 00000000000..e7090f49db6
--- /dev/null
+++ b/pkgs/development/libraries/openssl/3.0/nix-ssl-cert-file.patch
@@ -0,0 +1,15 @@
+diff --git a/crypto/x509/by_file.c b/crypto/x509/by_file.c
+index 37d73ca84c..e328896234 100644
+--- a/crypto/x509/by_file.c
++++ b/crypto/x509/by_file.c
+@@ -54,7 +54,9 @@ static int by_file_ctrl_ex(X509_LOOKUP *ctx, int cmd, const char *argp,
+     switch (cmd) {
+     case X509_L_FILE_LOAD:
+         if (argl == X509_FILETYPE_DEFAULT) {
+-            file = ossl_safe_getenv(X509_get_default_cert_file_env());
++            file = ossl_safe_getenv("NIX_SSL_CERT_FILE");
++            if (!file)
++                file = ossl_safe_getenv(X509_get_default_cert_file_env());
+             if (file)
+                 ok = (X509_load_cert_crl_file_ex(ctx, file, X509_FILETYPE_PEM,
+                                                  libctx, propq) != 0);
diff --git a/pkgs/development/libraries/openssl/3.0/openssl-disable-kernel-detection.patch b/pkgs/development/libraries/openssl/3.0/openssl-disable-kernel-detection.patch
new file mode 100644
index 00000000000..baf162e88d0
--- /dev/null
+++ b/pkgs/development/libraries/openssl/3.0/openssl-disable-kernel-detection.patch
@@ -0,0 +1,22 @@
+diff --git a/Configure b/Configure
+index f0ad787bc4..a48d2008c6 100755
+--- a/Configure
++++ b/Configure
+@@ -1688,17 +1688,6 @@ unless ($disabled{devcryptoeng}) {
+ unless ($disabled{ktls}) {
+     $config{ktls}="";
+     if ($target =~ m/^linux/) {
+-        my $usr = "/usr/$config{cross_compile_prefix}";
+-        chop($usr);
+-        if ($config{cross_compile_prefix} eq "") {
+-            $usr = "/usr";
+-        }
+-        my $minver = (4 << 16) + (13 << 8) + 0;
+-        my @verstr = split(" ",`cat $usr/include/linux/version.h | grep LINUX_VERSION_CODE`);
+-
+-        if ($verstr[2] < $minver) {
+-            disable('too-old-kernel', 'ktls');
+-        }
+     } elsif ($target =~ m/^BSD/) {
+         my $cc = $config{CROSS_COMPILE}.$config{CC};
+         system("printf '#include <sys/types.h>\n#include <sys/ktls.h>' | $cc -E - >/dev/null 2>&1");
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index ca44788a289..ca2e240dd86 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -198,11 +198,33 @@ in {
       ./1.1/nix-ssl-cert-file.patch
 
       (if stdenv.hostPlatform.isDarwin
-       then ./1.1/use-etc-ssl-certs-darwin.patch
-       else ./1.1/use-etc-ssl-certs.patch)
+       then ./use-etc-ssl-certs-darwin.patch
+       else ./use-etc-ssl-certs.patch)
     ] ++ lib.optionals (stdenv.isDarwin) [
       ./1.1/macos-yosemite-compat.patch
     ];
     withDocs = true;
   };
+
+  openssl_3_0 = common {
+    version = "3.0.0";
+    sha256 = "sha256-We7fy0bCUhTJvTftYHgpe03wHQEiZ/6enu4x9hvHBTY=";
+    patches = [
+      ./3.0/nix-ssl-cert-file.patch
+
+      # openssl will only compile in KTLS if the current kernel supports it.
+      # This patch disables build-time detection.
+      ./3.0/openssl-disable-kernel-detection.patch
+
+      (if stdenv.hostPlatform.isDarwin
+       then ./use-etc-ssl-certs-darwin.patch
+       else ./use-etc-ssl-certs.patch)
+    ];
+
+    withDocs = true;
+
+    extraMeta = with lib; {
+      license = licenses.asl20;
+    };
+  };
 }
diff --git a/pkgs/development/libraries/openssl/1.1/use-etc-ssl-certs-darwin.patch b/pkgs/development/libraries/openssl/use-etc-ssl-certs-darwin.patch
index 2c98ccfa7ed..2c98ccfa7ed 100644
--- a/pkgs/development/libraries/openssl/1.1/use-etc-ssl-certs-darwin.patch
+++ b/pkgs/development/libraries/openssl/use-etc-ssl-certs-darwin.patch
diff --git a/pkgs/development/libraries/openssl/1.1/use-etc-ssl-certs.patch b/pkgs/development/libraries/openssl/use-etc-ssl-certs.patch
index 67d199681f9..67d199681f9 100644
--- a/pkgs/development/libraries/openssl/1.1/use-etc-ssl-certs.patch
+++ b/pkgs/development/libraries/openssl/use-etc-ssl-certs.patch
diff --git a/pkgs/development/python-modules/tern/default.nix b/pkgs/development/python-modules/tern/default.nix
index 64e1951bf44..2517c49ce2d 100644
--- a/pkgs/development/python-modules/tern/default.nix
+++ b/pkgs/development/python-modules/tern/default.nix
@@ -12,6 +12,7 @@
 , GitPython
 , prettytable
 , idna
+, packageurl-python
 }:
 
 buildPythonPackage rec {
@@ -42,6 +43,7 @@ buildPythonPackage rec {
     GitPython
     prettytable
     idna
+    packageurl-python
   ];
 
   # No tests
diff --git a/pkgs/development/tools/misc/netcoredbg/default.nix b/pkgs/development/tools/misc/netcoredbg/default.nix
new file mode 100644
index 00000000000..1907eb8b363
--- /dev/null
+++ b/pkgs/development/tools/misc/netcoredbg/default.nix
@@ -0,0 +1,78 @@
+{ lib, clangStdenv, stdenvNoCC, cmake, fetchFromGitHub, dotnetCorePackages, buildDotnetModule }:
+let
+  pname = "netcoredbg";
+  version = "1.2.0-825";
+
+  # according to CMakeLists.txt, this should be 3.1 even when building for .NET 5
+  coreclr-version = "3.1.19";
+  coreclr-src = fetchFromGitHub {
+    owner = "dotnet";
+    repo = "coreclr";
+    rev = "v${coreclr-version}";
+    sha256 = "o1KafmXqNjX9axr6sSxPKrfUX0e+b/4ANiVQt4T2ybw=";
+  };
+
+  dotnet-sdk = dotnetCorePackages.sdk_5_0;
+
+  src = fetchFromGitHub {
+    owner = "Samsung";
+    repo = pname;
+    rev = version;
+    sha256 = "JQhDI1+bVbOIFNkXixZnFB/5+dzqCbInR0zJvykcFCg=";
+  };
+
+  unmanaged = clangStdenv.mkDerivation rec {
+    inherit src pname version;
+
+    nativeBuildInputs = [ cmake ];
+
+    # Building the "unmanaged part" still involves compiling C# code.
+    preBuild = ''
+      export HOME=$(mktemp -d)
+      export DOTNET_CLI_TELEMETRY_OPTOUT=1
+      export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1
+    '';
+
+    hardeningDisable = [ "strictoverflow" ];
+
+    preConfigure = ''
+      dotnetVersion="$(${dotnet-sdk}/bin/dotnet --list-runtimes | grep -Po '^Microsoft.NETCore.App \K.*?(?= )')"
+      cmakeFlagsArray+=(
+        "-DDBGSHIM_RUNTIME_DIR=${dotnet-sdk}/shared/Microsoft.NETCore.App/$dotnetVersion"
+      )
+    '';
+
+    cmakeFlags = [
+      "-DCORECLR_DIR=${coreclr-src}"
+      "-DDOTNET_DIR=${dotnet-sdk}"
+      "-DBUILD_MANAGED=0"
+    ];
+  };
+
+  managed = buildDotnetModule {
+    inherit pname version src dotnet-sdk;
+
+    projectFile = "src/managed/ManagedPart.csproj";
+    nugetDeps = ./deps.nix;
+
+    executables = [ ];
+  };
+in
+stdenvNoCC.mkDerivation {
+  inherit pname version;
+
+  buildCommand = ''
+    mkdir -p $out/share/netcoredbg $out/bin
+    cp ${unmanaged}/* $out/share/netcoredbg
+    cp ${managed}/lib/netcoredbg/* $out/share/netcoredbg
+    ln -s $out/share/netcoredbg/netcoredbg $out/bin/netcoredbg
+  '';
+
+  meta = with lib; {
+    description = "Managed code debugger with MI interface for CoreCLR";
+    homepage = "https://github.com/Samsung/netcoredbg";
+    license = licenses.mit;
+    platforms = platforms.unix;
+    maintainers = [ maintainers.leo60228 ];
+  };
+}
diff --git a/pkgs/development/tools/misc/netcoredbg/deps.nix b/pkgs/development/tools/misc/netcoredbg/deps.nix
new file mode 100644
index 00000000000..cbcef4c1720
--- /dev/null
+++ b/pkgs/development/tools/misc/netcoredbg/deps.nix
@@ -0,0 +1,84 @@
+{ fetchNuGet }: [
+  (fetchNuGet { name = "Microsoft.CodeAnalysis.Analyzers"; version = "1.1.0"; sha256 = "08r667hj2259wbim1p3al5qxkshydykmb7nd9ygbjlg4mmydkapc"; })
+  (fetchNuGet { name = "Microsoft.CodeAnalysis.Common"; version = "2.3.0"; sha256 = "1p29v4499qpyh7k7fv1li2y3c688zg95ic8gq9if1nqmjciz5w7p"; })
+  (fetchNuGet { name = "Microsoft.CodeAnalysis.CSharp"; version = "2.3.0"; sha256 = "1g893rqc8hmd59hdigq0fwm3w261i7cm1h2wciqp7406f0gz67x5"; })
+  (fetchNuGet { name = "Microsoft.CodeAnalysis.CSharp.Scripting"; version = "2.3.0"; sha256 = "121dhnfjd5jzm410dk79s8xk5jvd09xa0w5q3lbpqc7bs4wxmq4p"; })
+  (fetchNuGet { name = "Microsoft.CodeAnalysis.Scripting.Common"; version = "2.3.0"; sha256 = "11f11kvgrdgs86ykz4104jx1iw78v6af48hpdrhmr7y7h5334ziq"; })
+  (fetchNuGet { name = "Microsoft.CSharp"; version = "4.4.0"; sha256 = "1niyzqqfyhvh4zpxn8bcyyldynqlw0rfr1apwry4b3yrdnjh1hhh"; })
+  (fetchNuGet { name = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
+  (fetchNuGet { name = "Microsoft.NETCore.Targets"; version = "1.1.0"; sha256 = "193xwf33fbm0ni3idxzbr5fdq3i2dlfgihsac9jj7whj0gd902nh"; })
+  (fetchNuGet { name = "NETStandard.Library"; version = "2.0.3"; sha256 = "1fn9fxppfcg4jgypp2pmrpr6awl3qz1xmnri0cygpkwvyx27df1y"; })
+  (fetchNuGet { name = "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "16rnxzpk5dpbbl1x354yrlsbvwylrq456xzpsha1n9y3glnhyx9d"; })
+  (fetchNuGet { name = "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0hkg03sgm2wyq8nqk6dbm9jh5vcq57ry42lkqdmfklrw89lsmr59"; })
+  (fetchNuGet { name = "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0c2p354hjx58xhhz7wv6div8xpi90sc6ibdm40qin21bvi7ymcaa"; })
+  (fetchNuGet { name = "runtime.native.System"; version = "4.3.0"; sha256 = "15hgf6zaq9b8br2wi1i3x0zvmk410nlmsmva9p0bbg73v6hml5k4"; })
+  (fetchNuGet { name = "runtime.native.System.IO.Compression"; version = "4.3.0"; sha256 = "1vvivbqsk6y4hzcid27pqpm5bsi6sc50hvqwbcx8aap5ifrxfs8d"; })
+  (fetchNuGet { name = "runtime.native.System.Net.Http"; version = "4.3.0"; sha256 = "1n6rgz5132lcibbch1qlf0g9jk60r0kqv087hxc0lisy50zpm7kk"; })
+  (fetchNuGet { name = "runtime.native.System.Security.Cryptography.Apple"; version = "4.3.0"; sha256 = "1b61p6gw1m02cc1ry996fl49liiwky6181dzr873g9ds92zl326q"; })
+  (fetchNuGet { name = "runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "18pzfdlwsg2nb1jjjjzyb5qlgy6xjxzmhnfaijq5s2jw3cm3ab97"; })
+  (fetchNuGet { name = "runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0qyynf9nz5i7pc26cwhgi8j62ps27sqmf78ijcfgzab50z9g8ay3"; })
+  (fetchNuGet { name = "runtime.opensuse.42.1-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "1klrs545awhayryma6l7g2pvnp9xy4z0r1i40r80zb45q3i9nbyf"; })
+  (fetchNuGet { name = "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.Apple"; version = "4.3.0"; sha256 = "10yc8jdrwgcl44b4g93f1ds76b176bajd3zqi2faf5rvh1vy9smi"; })
+  (fetchNuGet { name = "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0zcxjv5pckplvkg0r6mw3asggm7aqzbdjimhvsasb0cgm59x09l3"; })
+  (fetchNuGet { name = "runtime.rhel.7-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0vhynn79ih7hw7cwjazn87rm9z9fj0rvxgzlab36jybgcpcgphsn"; })
+  (fetchNuGet { name = "runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "160p68l2c7cqmyqjwxydcvgw7lvl1cr0znkw8fp24d1by9mqc8p3"; })
+  (fetchNuGet { name = "runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "15zrc8fgd8zx28hdghcj5f5i34wf3l6bq5177075m2bc2j34jrqy"; })
+  (fetchNuGet { name = "runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "1p4dgxax6p7rlgj4q73k73rslcnz4wdcv8q2flg1s8ygwcm58ld5"; })
+  (fetchNuGet { name = "System.AppContext"; version = "4.3.0"; sha256 = "1649qvy3dar900z3g817h17nl8jp4ka5vcfmsr05kh0fshn7j3ya"; })
+  (fetchNuGet { name = "System.Buffers"; version = "4.3.0"; sha256 = "0fgns20ispwrfqll4q1zc1waqcmylb3zc50ys9x8zlwxh9pmd9jy"; })
+  (fetchNuGet { name = "System.Collections"; version = "4.3.0"; sha256 = "19r4y64dqyrq6k4706dnyhhw7fs24kpp3awak7whzss39dakpxk9"; })
+  (fetchNuGet { name = "System.Collections.Concurrent"; version = "4.3.0"; sha256 = "0wi10md9aq33jrkh2c24wr2n9hrpyamsdhsxdcnf43b7y86kkii8"; })
+  (fetchNuGet { name = "System.Collections.Immutable"; version = "1.3.1"; sha256 = "17615br2x5riyx8ivf1dcqwj6q3ipq1bi5hqhw54yfyxmx38ddva"; })
+  (fetchNuGet { name = "System.Console"; version = "4.3.0"; sha256 = "1flr7a9x920mr5cjsqmsy9wgnv3lvd0h1g521pdr1lkb2qycy7ay"; })
+  (fetchNuGet { name = "System.Diagnostics.Debug"; version = "4.3.0"; sha256 = "00yjlf19wjydyr6cfviaph3vsjzg3d5nvnya26i2fvfg53sknh3y"; })
+  (fetchNuGet { name = "System.Diagnostics.FileVersionInfo"; version = "4.3.0"; sha256 = "094hx249lb3vb336q7dg3v257hbxvz2jnalj695l7cg5kxzqwai7"; })
+  (fetchNuGet { name = "System.Diagnostics.StackTrace"; version = "4.3.0"; sha256 = "0ash4h9k0m7xsm0yl79r0ixrdz369h7y922wipp5gladmlbvpyjd"; })
+  (fetchNuGet { name = "System.Diagnostics.Tools"; version = "4.3.0"; sha256 = "0in3pic3s2ddyibi8cvgl102zmvp9r9mchh82ns9f0ms4basylw1"; })
+  (fetchNuGet { name = "System.Diagnostics.Tracing"; version = "4.3.0"; sha256 = "1m3bx6c2s958qligl67q7grkwfz3w53hpy7nc97mh6f7j5k168c4"; })
+  (fetchNuGet { name = "System.Dynamic.Runtime"; version = "4.3.0"; sha256 = "1d951hrvrpndk7insiag80qxjbf2y0y39y8h5hnq9612ws661glk"; })
+  (fetchNuGet { name = "System.Globalization"; version = "4.3.0"; sha256 = "1cp68vv683n6ic2zqh2s1fn4c2sd87g5hpp6l4d4nj4536jz98ki"; })
+  (fetchNuGet { name = "System.Globalization.Calendars"; version = "4.3.0"; sha256 = "1xwl230bkakzzkrggy1l1lxmm3xlhk4bq2pkv790j5lm8g887lxq"; })
+  (fetchNuGet { name = "System.IO"; version = "4.3.0"; sha256 = "05l9qdrzhm4s5dixmx68kxwif4l99ll5gqmh7rqgw554fx0agv5f"; })
+  (fetchNuGet { name = "System.IO.Compression"; version = "4.3.0"; sha256 = "084zc82yi6yllgda0zkgl2ys48sypiswbiwrv7irb3r0ai1fp4vz"; })
+  (fetchNuGet { name = "System.IO.FileSystem"; version = "4.3.0"; sha256 = "0z2dfrbra9i6y16mm9v1v6k47f0fm617vlb7s5iybjjsz6g1ilmw"; })
+  (fetchNuGet { name = "System.IO.FileSystem.Primitives"; version = "4.3.0"; sha256 = "0j6ndgglcf4brg2lz4wzsh1av1gh8xrzdsn9f0yznskhqn1xzj9c"; })
+  (fetchNuGet { name = "System.Linq"; version = "4.3.0"; sha256 = "1w0gmba695rbr80l1k2h4mrwzbzsyfl2z4klmpbsvsg5pm4a56s7"; })
+  (fetchNuGet { name = "System.Linq.Expressions"; version = "4.3.0"; sha256 = "0ky2nrcvh70rqq88m9a5yqabsl4fyd17bpr63iy2mbivjs2nyypv"; })
+  (fetchNuGet { name = "System.ObjectModel"; version = "4.3.0"; sha256 = "191p63zy5rpqx7dnrb3h7prvgixmk168fhvvkkvhlazncf8r3nc2"; })
+  (fetchNuGet { name = "System.Reflection"; version = "4.3.0"; sha256 = "0xl55k0mw8cd8ra6dxzh974nxif58s3k1rjv1vbd7gjbjr39j11m"; })
+  (fetchNuGet { name = "System.Reflection.Emit"; version = "4.3.0"; sha256 = "11f8y3qfysfcrscjpjym9msk7lsfxkk4fmz9qq95kn3jd0769f74"; })
+  (fetchNuGet { name = "System.Reflection.Emit.ILGeneration"; version = "4.3.0"; sha256 = "0w1n67glpv8241vnpz1kl14sy7zlnw414aqwj4hcx5nd86f6994q"; })
+  (fetchNuGet { name = "System.Reflection.Emit.Lightweight"; version = "4.3.0"; sha256 = "0ql7lcakycrvzgi9kxz1b3lljd990az1x6c4jsiwcacrvimpib5c"; })
+  (fetchNuGet { name = "System.Reflection.Extensions"; version = "4.3.0"; sha256 = "02bly8bdc98gs22lqsfx9xicblszr2yan7v2mmw3g7hy6miq5hwq"; })
+  (fetchNuGet { name = "System.Reflection.Metadata"; version = "1.4.2"; sha256 = "08b7b43vczlliv8k7q43jinjfrxwpljsglw7sxmc6sd7d54pd1vi"; })
+  (fetchNuGet { name = "System.Reflection.Primitives"; version = "4.3.0"; sha256 = "04xqa33bld78yv5r93a8n76shvc8wwcdgr1qvvjh959g3rc31276"; })
+  (fetchNuGet { name = "System.Reflection.TypeExtensions"; version = "4.3.0"; sha256 = "0y2ssg08d817p0vdag98vn238gyrrynjdj4181hdg780sif3ykp1"; })
+  (fetchNuGet { name = "System.Resources.ResourceManager"; version = "4.3.0"; sha256 = "0sjqlzsryb0mg4y4xzf35xi523s4is4hz9q4qgdvlvgivl7qxn49"; })
+  (fetchNuGet { name = "System.Runtime"; version = "4.3.0"; sha256 = "066ixvgbf2c929kgknshcxqj6539ax7b9m570cp8n179cpfkapz7"; })
+  (fetchNuGet { name = "System.Runtime.Extensions"; version = "4.3.0"; sha256 = "1ykp3dnhwvm48nap8q23893hagf665k0kn3cbgsqpwzbijdcgc60"; })
+  (fetchNuGet { name = "System.Runtime.Handles"; version = "4.3.0"; sha256 = "0sw2gfj2xr7sw9qjn0j3l9yw07x73lcs97p8xfc9w1x9h5g5m7i8"; })
+  (fetchNuGet { name = "System.Runtime.InteropServices"; version = "4.3.0"; sha256 = "00hywrn4g7hva1b2qri2s6rabzwgxnbpw9zfxmz28z09cpwwgh7j"; })
+  (fetchNuGet { name = "System.Runtime.Numerics"; version = "4.3.0"; sha256 = "19rav39sr5dky7afygh309qamqqmi9kcwvz3i0c5700v0c5cg61z"; })
+  (fetchNuGet { name = "System.Security.Cryptography.Algorithms"; version = "4.3.0"; sha256 = "03sq183pfl5kp7gkvq77myv7kbpdnq3y0xj7vi4q1kaw54sny0ml"; })
+  (fetchNuGet { name = "System.Security.Cryptography.Cng"; version = "4.3.0"; sha256 = "1k468aswafdgf56ab6yrn7649kfqx2wm9aslywjam1hdmk5yypmv"; })
+  (fetchNuGet { name = "System.Security.Cryptography.Csp"; version = "4.3.0"; sha256 = "1x5wcrddf2s3hb8j78cry7yalca4lb5vfnkrysagbn6r9x6xvrx1"; })
+  (fetchNuGet { name = "System.Security.Cryptography.Encoding"; version = "4.3.0"; sha256 = "1jr6w70igqn07k5zs1ph6xja97hxnb3mqbspdrff6cvssgrixs32"; })
+  (fetchNuGet { name = "System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0givpvvj8yc7gv4lhb6s1prq6p2c4147204a0wib89inqzd87gqc"; })
+  (fetchNuGet { name = "System.Security.Cryptography.Primitives"; version = "4.3.0"; sha256 = "0pyzncsv48zwly3lw4f2dayqswcfvdwq2nz0dgwmi7fj3pn64wby"; })
+  (fetchNuGet { name = "System.Security.Cryptography.X509Certificates"; version = "4.3.0"; sha256 = "0valjcz5wksbvijylxijjxb1mp38mdhv03r533vnx1q3ikzdav9h"; })
+  (fetchNuGet { name = "System.Text.Encoding"; version = "4.3.0"; sha256 = "1f04lkir4iladpp51sdgmis9dj4y8v08cka0mbmsy0frc9a4gjqr"; })
+  (fetchNuGet { name = "System.Text.Encoding.CodePages"; version = "4.3.0"; sha256 = "0lgxg1gn7pg7j0f942pfdc9q7wamzxsgq3ng248ikdasxz0iadkv"; })
+  (fetchNuGet { name = "System.Text.Encoding.Extensions"; version = "4.3.0"; sha256 = "11q1y8hh5hrp5a3kw25cb6l00v5l5dvirkz8jr3sq00h1xgcgrxy"; })
+  (fetchNuGet { name = "System.Text.RegularExpressions"; version = "4.3.0"; sha256 = "1bgq51k7fwld0njylfn7qc5fmwrk2137gdq7djqdsw347paa9c2l"; })
+  (fetchNuGet { name = "System.Threading"; version = "4.3.0"; sha256 = "0rw9wfamvhayp5zh3j7p1yfmx9b5khbf4q50d8k5rk993rskfd34"; })
+  (fetchNuGet { name = "System.Threading.Tasks"; version = "4.3.0"; sha256 = "134z3v9abw3a6jsw17xl3f6hqjpak5l682k2vz39spj4kmydg6k7"; })
+  (fetchNuGet { name = "System.Threading.Tasks.Extensions"; version = "4.3.0"; sha256 = "1xxcx2xh8jin360yjwm4x4cf5y3a2bwpn2ygkfkwkicz7zk50s2z"; })
+  (fetchNuGet { name = "System.Threading.Tasks.Parallel"; version = "4.3.0"; sha256 = "1rr3qa4hxwyj531s4nb3bwrxnxxwz617i0n9gh6x7nr7dd3ayzgh"; })
+  (fetchNuGet { name = "System.Threading.Thread"; version = "4.3.0"; sha256 = "0y2xiwdfcph7znm2ysxanrhbqqss6a3shi1z3c779pj2s523mjx4"; })
+  (fetchNuGet { name = "System.ValueTuple"; version = "4.3.0"; sha256 = "1227k7fxbxapq7dms4lvwwjdf3pr1jcsmhy2nzzhj6g6hs530hxn"; })
+  (fetchNuGet { name = "System.Xml.ReaderWriter"; version = "4.3.0"; sha256 = "0c47yllxifzmh8gq6rq6l36zzvw4kjvlszkqa9wq3fr59n0hl3s1"; })
+  (fetchNuGet { name = "System.Xml.XDocument"; version = "4.3.0"; sha256 = "08h8fm4l77n0nd4i4fk2386y809bfbwqb7ih9d7564ifcxr5ssxd"; })
+  (fetchNuGet { name = "System.Xml.XmlDocument"; version = "4.3.0"; sha256 = "0bmz1l06dihx52jxjr22dyv5mxv6pj4852lx68grjm7bivhrbfwi"; })
+  (fetchNuGet { name = "System.Xml.XPath"; version = "4.3.0"; sha256 = "1cv2m0p70774a0sd1zxc8fm8jk3i5zk2bla3riqvi8gsm0r4kpci"; })
+  (fetchNuGet { name = "System.Xml.XPath.XDocument"; version = "4.3.0"; sha256 = "1wxckyb7n1pi433xzz0qcwcbl1swpra64065mbwwi8dhdc4kiabn"; })
+]
diff --git a/pkgs/development/tools/ocaml/merlin/4.x.nix b/pkgs/development/tools/ocaml/merlin/4.x.nix
index eda2bb4960c..5554ce16350 100644
--- a/pkgs/development/tools/ocaml/merlin/4.x.nix
+++ b/pkgs/development/tools/ocaml/merlin/4.x.nix
@@ -47,6 +47,9 @@ buildDunePackage {
       dot_merlin_reader = "${dot-merlin-reader}/bin/dot-merlin-reader";
       dune = "${dune_2}/bin/dune";
     })
+    # This fixes the test-suite on macOS
+    # See https://github.com/ocaml/merlin/pull/1399
+    ./test.patch
   ];
 
   useDune2 = true;
diff --git a/pkgs/development/tools/ocaml/merlin/test.patch b/pkgs/development/tools/ocaml/merlin/test.patch
new file mode 100644
index 00000000000..0101e825b96
--- /dev/null
+++ b/pkgs/development/tools/ocaml/merlin/test.patch
@@ -0,0 +1,19 @@
+commit 282eed37f39ff216add8d53766fd59f3737eb87f
+Author: Vincent Laporte <Vincent.Laporte@gmail.com>
+Date:   Thu Nov 4 06:24:07 2021 +0100
+
+    Ignore dune stderr in tests
+
+diff --git a/tests/test-dirs/document/src-documentation.t/run.t b/tests/test-dirs/document/src-documentation.t/run.t
+index 2c9e1419..4f4c4327 100644
+--- a/tests/test-dirs/document/src-documentation.t/run.t
++++ b/tests/test-dirs/document/src-documentation.t/run.t
+@@ -42,7 +42,7 @@ documentation for the non-last defined value (in the same file) is show
+   > jq '.value'
+   " List reversal. "
+ 
+-  $ dune build --root=. ./doc.exe
++  $ dune build --root=. ./doc.exe 2> /dev/null
+   $ cat >.merlin <<EOF
+   > B _build/default/.doc.eobjs/byte
+   > S .
diff --git a/pkgs/development/tools/rust/cargo-deny/default.nix b/pkgs/development/tools/rust/cargo-deny/default.nix
index ba151a17549..02bc561b157 100644
--- a/pkgs/development/tools/rust/cargo-deny/default.nix
+++ b/pkgs/development/tools/rust/cargo-deny/default.nix
@@ -1,8 +1,11 @@
-{ stdenv
-, lib
+{ lib
 , rustPlatform
 , fetchFromGitHub
-, perl, pkg-config, openssl, Security, libiconv, curl
+, pkg-config
+, openssl
+, stdenv
+, curl
+, Security
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,17 +23,20 @@ rustPlatform.buildRustPackage rec {
 
   doCheck = false;
 
-  nativeBuildInputs = [ perl pkg-config ];
+  nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ openssl  ]
-    ++ lib.optionals stdenv.isDarwin [ Security libiconv curl ];
+  buildInputs = [ openssl ]
+    ++ lib.optionals stdenv.isDarwin [ curl Security ];
+
+  cargoBuildFlags = [ "--no-default-features" ];
+
+  cargoTestFlags = cargoBuildFlags;
 
   meta = with lib; {
     description = "Cargo plugin to generate list of all licenses for a crate";
     homepage = "https://github.com/EmbarkStudios/cargo-deny";
-    license = licenses.asl20;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [ matthiasbeyer ];
+    changelog = "https://github.com/EmbarkStudios/cargo-deny/blob/${version}/CHANGELOG.md";
+    license = with licenses; [ asl20 /* or */ mit ];
+    maintainers = with maintainers; [ figsoda matthiasbeyer ];
   };
 }
-
diff --git a/pkgs/development/tools/rust/cargo-modules/default.nix b/pkgs/development/tools/rust/cargo-modules/default.nix
index f894915c24e..5ef0168383c 100644
--- a/pkgs/development/tools/rust/cargo-modules/default.nix
+++ b/pkgs/development/tools/rust/cargo-modules/default.nix
@@ -1,22 +1,27 @@
-{ lib, rustPlatform, fetchFromGitHub }:
+{ lib, rustPlatform, fetchFromGitHub, stdenv, CoreFoundation, CoreServices }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-modules";
-  version = "0.5.0";
+  version = "0.5.6";
 
   src = fetchFromGitHub {
     owner = "regexident";
     repo = pname;
     rev = version;
-    sha256 = "0y6ag8nar85l2fh2ca41fglkzc74cv1p5szxrhk1jdqnd2qzhvjp";
+    sha256 = "sha256-bLljwxNrCmg1ZWfSninIxJIFIn2oHY8dmbHYPdwtD+M=";
   };
 
-  cargoSha256 = "0m5r36p57w4vw2g3hg12s38ay328swjb0qfl381xwb2xqx10g8kx";
+  cargoSha256 = "sha256-heyVeQwEIOA9qtyXnHY8lPo06YgIUJaWCtaht9dWLoo=";
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    CoreFoundation
+    CoreServices
+  ];
 
   meta = with lib; {
     description = "A cargo plugin for showing a tree-like overview of a crate's modules";
     homepage = "https://github.com/regexident/cargo-modules";
     license = with licenses; [ mpl20 ];
-    maintainers = with maintainers; [ rvarago ];
+    maintainers = with maintainers; [ figsoda rvarago ];
   };
 }
diff --git a/pkgs/development/tools/rust/racer/default.nix b/pkgs/development/tools/rust/racer/default.nix
index e0e22f0f504..f6717b36b20 100644
--- a/pkgs/development/tools/rust/racer/default.nix
+++ b/pkgs/development/tools/rust/racer/default.nix
@@ -1,17 +1,15 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform, makeWrapper, substituteAll, Security }:
+{ lib, rustPlatform, fetchCrate, makeWrapper, stdenv, Security }:
 
 rustPlatform.buildRustPackage rec {
   pname = "racer";
-  version = "2.1.46";
+  version = "2.1.48";
 
-  src = fetchFromGitHub {
-    owner = "racer-rust";
-    repo = "racer";
-    rev = "v${version}";
-    sha256 = "sha256-7h1w5Yyt5VN6+pYuTTbdM1Nrd8aDEhPLusxuIsdS+mQ=";
+  src = fetchCrate {
+    inherit pname version;
+    sha256 = "sha256-lat5s9+AMFI3VXiWqjLESZrtq3IwOZhlt+5BhYoonfA=";
   };
 
-  cargoSha256 = "sha256-fllhB+so6H36b+joW0l+NBtz3PefOKdj6C8qKQPuJpk=";
+  cargoSha256 = "sha256-jGsvCmrPGVzWdx7V3J4bBK+SF2o+icORmVKuwqYxdh4=";
 
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = lib.optional stdenv.isDarwin Security;
@@ -44,5 +42,7 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/racer-rust/racer";
     license = licenses.mit;
     maintainers = with maintainers; [ jagajaga ];
+    # error[E0199]: implementing the trait `Step` is not unsafe
+    broken = true;
   };
 }
diff --git a/pkgs/development/tools/selene/default.nix b/pkgs/development/tools/selene/default.nix
index 810eee56cd1..2f6e731ea33 100644
--- a/pkgs/development/tools/selene/default.nix
+++ b/pkgs/development/tools/selene/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "selene";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "kampfkarren";
     repo = pname;
     rev = version;
-    sha256 = "0c228aakwf679wyxir0jwry3khv7phlaf77w675gn1wr4fxdg5gr";
+    sha256 = "sha256-tA1exZ97N2tAagAljt+MOSGh6objOiqbZXUaBZ62Sls=";
   };
 
-  cargoSha256 = "sha256-5GODuqjVo3b1SzRgXVBIKec2tSS335EAUAmRlcpbClE=";
+  cargoSha256 = "sha256-4vCKiTWwnibNK6/S1GOYRurgm2Aq1e9o4rAmp0hqGeA=";
 
   nativeBuildInputs = lib.optional robloxSupport pkg-config;
 
diff --git a/pkgs/development/tools/skopeo/default.nix b/pkgs/development/tools/skopeo/default.nix
index 42afb791ddf..556b9c4a258 100644
--- a/pkgs/development/tools/skopeo/default.nix
+++ b/pkgs/development/tools/skopeo/default.nix
@@ -14,13 +14,13 @@
 
 buildGoModule rec {
   pname = "skopeo";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "containers";
     repo = "skopeo";
-    sha256 = "sha256-75zrOYiwlpHbEgmpJ9THYKbF4sL4Jp009/+Fw12Wvys=";
+    sha256 = "sha256-GaOfONUAN+bNSyodDbZyahMheU5fnjuAp4/94jy+9Hg=";
   };
 
   outputs = [ "out" "man" ];
diff --git a/pkgs/development/tools/sumneko-lua-language-server/default.nix b/pkgs/development/tools/sumneko-lua-language-server/default.nix
index 1290da85874..80071b1d060 100644
--- a/pkgs/development/tools/sumneko-lua-language-server/default.nix
+++ b/pkgs/development/tools/sumneko-lua-language-server/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sumneko-lua-language-server";
-  version = "2.4.5";
+  version = "2.4.7";
 
   src = fetchFromGitHub {
     owner = "sumneko";
     repo = "lua-language-server";
     rev = version;
-    sha256 = "sha256-7eTYHZDJLmYTwe0K+RJMRl4tRz9o0DeniHD5+v9f1Jw=";
+    sha256 = "sha256-lO+FUuU7uihbRLI1X9qhOvgukRGfhDeSM/JdIqr96Fk=";
     fetchSubmodules = true;
   };
 
@@ -38,6 +38,9 @@ stdenv.mkDerivation rec {
     install -m644 -t "$out"/share/lua-language-server {debugger,main}.lua
     cp -r locale meta script "$out"/share/lua-language-server
 
+    # necessary for --version to work:
+    install -m644 -t "$out"/share/lua-language-server changelog.md
+
     makeWrapper "$out"/share/lua-language-server/bin/Linux/lua-language-server \
       $out/bin/lua-language-server \
       --add-flags "-E $out/share/lua-language-server/main.lua \
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index c0f9882cc14..822ab6e0ddd 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -2,51 +2,51 @@
     "4.14": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.14.252-hardened1.patch",
-            "sha256": "1isqlqg4diz0i3f77rigvb07fs2p1v9w2h5165l0rnkb6h26i1gn",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.252-hardened1/linux-hardened-4.14.252-hardened1.patch"
+            "name": "linux-hardened-4.14.254-hardened1.patch",
+            "sha256": "1mg4zims7ckb0ddnnahk1cj73lhdh7x7xkjz4cgsvwndw0qvmhdi",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.254-hardened1/linux-hardened-4.14.254-hardened1.patch"
         },
-        "sha256": "022rw51s8fzz6wcxa9xq6h60fglfx0hq7bmqgs5dlrci6plv4fwk",
-        "version": "4.14.252"
+        "sha256": "0ihdlsg4jg9wwhhcbjjmrcchnl9pc0szh21nwmbhwnxgqcdmrnfz",
+        "version": "4.14.254"
     },
     "4.19": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.19.213-hardened1.patch",
-            "sha256": "03lk4m6sm3545s0xxx0w4sqgrsvrxqm8qg7swn05s36jj20viprm",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.213-hardened1/linux-hardened-4.19.213-hardened1.patch"
+            "name": "linux-hardened-4.19.215-hardened1.patch",
+            "sha256": "05m3x3aafwp9msmqb2h1mys54xlsq17477blhb0d3b3nyj3qv503",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.215-hardened1/linux-hardened-4.19.215-hardened1.patch"
         },
-        "sha256": "162f5y3jplql3ca5xy889mq6izjinryx2kx16zp582yvsqf8rwiq",
-        "version": "4.19.213"
+        "sha256": "1czjqa5wbsmzgl7wwqlp9qbdig45ibq11m9pcykrjaclrgwn884y",
+        "version": "4.19.215"
     },
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.75-hardened1.patch",
-            "sha256": "17gm50aislxihfnmr4vi0p0gpg13m2pbldjpi81clnx93a7rrfw2",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.75-hardened1/linux-hardened-5.10.75-hardened1.patch"
+            "name": "linux-hardened-5.10.77-hardened1.patch",
+            "sha256": "1y5rdd7irlljjsw7kdv6v8issbhab3hzywggz5igca72qiy7gcwl",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.77-hardened1/linux-hardened-5.10.77-hardened1.patch"
         },
-        "sha256": "0jrhhk89587caw54nhnwms93kq33qdm75x5f18cp61xrxxgjyaqa",
-        "version": "5.10.75"
+        "sha256": "1hwgbcfv9wfx9ka25lsqjrnzskynfgmswcyp5vk14wnxq7glxdnk",
+        "version": "5.10.77"
     },
     "5.14": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.14.14-hardened1.patch",
-            "sha256": "1hx5yal8jqnxr9c9ikvc6d0xp99kqjarj67720v9d4wvlmgsfabj",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.14.14-hardened1/linux-hardened-5.14.14-hardened1.patch"
+            "name": "linux-hardened-5.14.16-hardened1.patch",
+            "sha256": "0k9n9k25bmzn3wsqkmjc27md7vc5qwg5a79zmwfw0adwlfwlgi5y",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.14.16-hardened1/linux-hardened-5.14.16-hardened1.patch"
         },
-        "sha256": "0snh17ah49wmfmazy6x42rhvl484h657y0iq4l09a885sjb4xzsd",
-        "version": "5.14.14"
+        "sha256": "005wis2y5dhksb6n0r4p3xjldppmdnd360dhxa04rfc4z2qwn3f3",
+        "version": "5.14.16"
     },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.155-hardened1.patch",
-            "sha256": "0l8h9i6asiypgbxl90370kzfsyyc3f4vwl2r191arvrsgw863bid",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.155-hardened1/linux-hardened-5.4.155-hardened1.patch"
+            "name": "linux-hardened-5.4.157-hardened1.patch",
+            "sha256": "0651l6qambsdy7p1jry2ylf806gr66v6zrfz8lk0dndlhsgbb3dq",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.157-hardened1/linux-hardened-5.4.157-hardened1.patch"
         },
-        "sha256": "0f2hfz76rnhmv99zhbh7n1z48316ilxrxrnh4b5m3lj84y80y36c",
-        "version": "5.4.155"
+        "sha256": "0jl62j22vs59bc90mvzavv0ii9hvk436pbnrpqf3x9f8nfybngwz",
+        "version": "5.4.157"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 5fc975b8c6f..44740e74600 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.14.253";
+  version = "4.14.254";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1mgl55c8fa2ry4qp0phkdkzjhwfnkbhvi266n348kyjyqnjl234f";
+    sha256 = "0ihdlsg4jg9wwhhcbjjmrcchnl9pc0szh21nwmbhwnxgqcdmrnfz";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index afd34eaf902..d69f10a33b8 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.19.214";
+  version = "4.19.215";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0i08np4gxiks7chp6j328pdqb02apbba53mj4zvxb9v37qpxzqgz";
+    sha256 = "1czjqa5wbsmzgl7wwqlp9qbdig45ibq11m9pcykrjaclrgwn884y";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index e5672de557a..a4e3ee5f9da 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,12 +1,12 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.290";
+  version = "4.4.291";
   extraMeta.branch = "4.4";
   extraMeta.broken = stdenv.isAarch64;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1dcx58nmzkcc5nz2b5b7mgw4w7y28v3s9wd8h78czdqfa0kxrl20";
+    sha256 = "0lbbvv3ha4d8nwzjh8bdk0aqyd12w6gw0nsxsdnp8pbmnndgb9vh";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index b929e930eb0..424d3b690e6 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,12 +1,12 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.288";
+  version = "4.9.289";
   extraMeta.branch = "4.9";
   extraMeta.broken = stdenv.isAarch64;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0v5592v565bl924c23m1n7p5zddr0w7zn8m97pmikk6p7cyhjq9n";
+    sha256 = "19kz74qgw5yzfinnsvljmn2zm855lr4cxgfpn8gwljmkspyx1hm5";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
index 3376f30212a..0b7b0fd559f 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.76";
+  version = "5.10.77";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "140qkvs88b5zh6mxxzpf36z1r8bbvyh3yigripqjz1k236x0j2j8";
+    sha256 = "1hwgbcfv9wfx9ka25lsqjrnzskynfgmswcyp5vk14wnxq7glxdnk";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.14.nix b/pkgs/os-specific/linux/kernel/linux-5.14.nix
index e9d10e5d468..84a82377e06 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.14.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.14.15";
+  version = "5.14.16";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "01m4qw1z7xn3ngsbm1bvcvikqpkjjr9n8585556wkmz9d469mwvl";
+    sha256 = "005wis2y5dhksb6n0r4p3xjldppmdnd360dhxa04rfc4z2qwn3f3";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index 3c19d631438..57b6ebdc88b 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.4.156";
+  version = "5.4.157";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1zkpqfhrc5n0yiij3jzvzywgabva53c8668f1ly1pkrzcbj77zh6";
+    sha256 = "0jl62j22vs59bc90mvzavv0ii9hvk436pbnrpqf3x9f8nfybngwz";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index 85456ad49f7..19608cb5657 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "18413";
-    sha256 = "1s0nr3pnczr1ijv86307mfhmkk7xn5ah46wx6jrx857agcd73fzq";
+    rev = "18452";
+    sha256 = "0l9xnblid2nv6afp4d8g6kwlhwbw72cnqfaf2lix65bqc1ivdpl9";
   }
 , ...
 }:
diff --git a/pkgs/servers/http/nginx/mainline.nix b/pkgs/servers/http/nginx/mainline.nix
index 1b63b06f2cb..774a3cbe6de 100644
--- a/pkgs/servers/http/nginx/mainline.nix
+++ b/pkgs/servers/http/nginx/mainline.nix
@@ -1,6 +1,6 @@
-{ callPackage, ... }@args:
+{ callPackage, openssl_3_0, ... }@args:
 
-callPackage ./generic.nix args {
-  version = "1.21.3";
-  sha256 = "0nhps7igdqcpcy1r8677ar807rfclpylmz3y858a678m1np4lxql";
+callPackage ./generic.nix (args // { openssl = openssl_3_0; }) {
+  version = "1.21.4";
+  sha256 = "1ziv3xargxhxycd5hp6r3r5mww54nvvydiywcpsamg3i9r3jzxyi";
 }
diff --git a/pkgs/servers/prowlarr/default.nix b/pkgs/servers/prowlarr/default.nix
index 9cfc26925cc..8311d0aa58f 100644
--- a/pkgs/servers/prowlarr/default.nix
+++ b/pkgs/servers/prowlarr/default.nix
@@ -16,14 +16,14 @@ let
   }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   hash = {
-    x64-linux_hash = "sha256-9DoqyotXAUha2TMSgDIot5PD8ABpfZ8gsshS1ypr5SY=";
-    arm64-linux_hash = "sha256-r22c70OuevRsF8gOHZOkkhlRtoD4nsTHnXF82elQIF8=";
-    x64-osx_hash = "sha256-6jVM4iSGT7tpagocI/1nuBPVvAegfFqsCfrz2fPKCI4=";
+    x64-linux_hash = "sha256-wrBfgwzb+HI6cu9EyC70xZ5WsfkW+o+Q69jeCjoZRtI=";
+    arm64-linux_hash = "sha256-wnuLqd1T/21QyqjHbpK2w+WRyW1rd4pHqcRLFrIKHW8=";
+    x64-osx_hash = "sha256-gu+eByulCs9zLe3AXfVfcOXB49q6V7MWQ2DN2O/enfk=";
   }."${arch}-${os}_hash";
 
 in stdenv.mkDerivation rec {
   pname = "prowlarr";
-  version = "0.1.1.978";
+  version = "0.1.1.1030";
 
   src = fetchurl {
     url = "https://github.com/Prowlarr/Prowlarr/releases/download/v${version}/Prowlarr.develop.${version}.${os}-core-${arch}.tar.gz";
diff --git a/pkgs/tools/networking/connman/connman.nix b/pkgs/tools/networking/connman/connman.nix
index 311fffb4087..c92cceeabc6 100644
--- a/pkgs/tools/networking/connman/connman.nix
+++ b/pkgs/tools/networking/connman/connman.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchurl
+, fetchpatch
 , pkg-config
 , file
 , glib
@@ -61,6 +62,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-GleufOI0qjoXRKrDvlwhIdmNzpmUQO+KucxO39XtyxI=";
   };
 
+  patches = lib.optionals stdenv.hostPlatform.isMusl [
+    # Fix Musl build by avoiding a Glibc-only API.
+    (fetchpatch {
+      url = "https://git.alpinelinux.org/aports/plain/community/connman/libresolv.patch?id=e393ea84386878cbde3cccadd36a30396e357d1e";
+      sha256 = "1kg2nml7pdxc82h5hgsa3npvzdxy4d2jpz2f93pa97if868i8d43";
+    })
+  ];
+
   buildInputs = [
     glib
     dbus
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 3166571b425..440da49c2e3 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2021-11-04";
+  version = "2021-11-05";
 
   src = fetchFromGitHub {
     owner = "offensive-security";
     repo = pname;
     rev = version;
-    sha256 = "sha256-4qNQcmBq0q+FDRGtunUfngO+1jAK+fUBUHsq8E2rAy0=";
+    sha256 = "sha256-G+toeAMnP26Wzs5gPeT+YKJ8uiy/mgFwBGxDY9w0qyM=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1494d0b20d3..3b3362b861d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10243,6 +10243,8 @@ with pkgs;
 
   v2ray = callPackage ../tools/networking/v2ray { };
 
+  v2ray-domain-list-community = callPackage ../data/misc/v2ray-domain-list-community { };
+
   vacuum = callPackage ../applications/networking/instant-messengers/vacuum {};
 
   vampire = callPackage ../applications/science/logic/vampire {};
@@ -12785,7 +12787,9 @@ with pkgs;
   cargo-make = callPackage ../development/tools/rust/cargo-make {
     inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
   };
-  cargo-modules = callPackage ../development/tools/rust/cargo-modules { };
+  cargo-modules = callPackage ../development/tools/rust/cargo-modules {
+    inherit (darwin.apple_sdk.frameworks) CoreFoundation CoreServices;
+  };
   cargo-msrv = callPackage ../development/tools/rust/cargo-msrv {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
@@ -18840,7 +18844,8 @@ with pkgs;
 
   inherit (callPackages ../development/libraries/openssl { })
     openssl_1_0_2
-    openssl_1_1;
+    openssl_1_1
+    openssl_3_0;
 
   openssl-chacha = callPackage ../development/libraries/openssl/chacha.nix { };
 
@@ -24130,6 +24135,10 @@ with pkgs;
 
   clapper = callPackage ../applications/video/clapper { };
 
+  ciscoPacketTracer7 = callPackage ../applications/networking/cisco-packet-tracer/7.nix { };
+
+  ciscoPacketTracer8 = callPackage ../applications/networking/cisco-packet-tracer/8.nix { };
+
   claws-mail-gtk2 = callPackage ../applications/networking/mailreaders/claws-mail {
     inherit (xorg) libSM;
     useGtk3 = false;
@@ -27020,6 +27029,8 @@ with pkgs;
     jdk = jdk11;
   };
 
+  netcoredbg = callPackage ../development/tools/misc/netcoredbg { };
+
   ncdu = callPackage ../tools/misc/ncdu { };
 
   ncdc = callPackage ../applications/networking/p2p/ncdc { };
@@ -27972,6 +27983,8 @@ with pkgs;
 
   super-slicer-staging = (callPackage ../applications/misc/prusa-slicer/super-slicer.nix { }).staging;
 
+  snapmaker-luban = callPackage ../applications/misc/snapmaker-luban { };
+
   robustirc-bridge = callPackage ../servers/irc/robustirc-bridge { };
 
   skrooge = libsForQt5.callPackage ../applications/office/skrooge {};
@@ -29069,6 +29082,8 @@ with pkgs;
 
   picom = callPackage ../applications/window-managers/picom {};
 
+  picom-next = callPackage ../applications/window-managers/picom/picom-next.nix { };
+
   xd = callPackage ../applications/networking/p2p/xd {};
 
   xdaliclock = callPackage ../tools/misc/xdaliclock {};
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index fa94742b4e8..6129719d049 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -5804,6 +5804,20 @@ let
     };
   };
 
+  DateTimeFormatRFC3339 = buildPerlPackage rec {
+    pname = "DateTime-Format-RFC3339";
+    version = "1.2.0";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/I/IK/IKEGAMI/DateTime-Format-RFC3339-v${version}.tar.gz";
+      sha256 = "1xqdbbiksy6kapc3mv3ayjahmxxlzmb5x7rad4by1iii9hif2vhk";
+    };
+    propagatedBuildInputs = [ DateTime ];
+    meta = {
+      description = "Parse and format RFC3339 datetime strings";
+      license = lib.licenses.cc0;
+    };
+  };
+
   DateTimeSet = buildPerlModule {
     pname = "DateTime-Set";
     version = "0.3900";
@@ -24700,7 +24714,8 @@ let
       sha256 = "068nhmld1031grgi4qm7k5niwxlbn6qd08zf6g1gj4c7qfas62q1";
     };
     SKIP_SAX_INSTALL = 1;
-    buildInputs = [ AlienBuild AlienLibxml2 ];
+    buildInputs = [ AlienBuild AlienLibxml2 ]
+      ++ lib.optional stdenv.isDarwin pkgs.libiconv;
     propagatedBuildInputs = [ XMLSAX ];
   };