Merge master into staging-next

63 files changed, 878 insertions, 475 deletions

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index aa3ce8fa6c7..23b15c769ec 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -9604,6 +9604,12 @@
     githubId = 165283;
     name = "Alexey Kutepov";
   };
+  rewine = {
+    email = "lhongxu@outlook.com";
+    github = "wineee";
+    githubId = 22803888;
+    name = "Lu Hongxu";
+  };
   rgrunbla = {
     email = "remy@grunblatt.org";
     github = "rgrunbla";
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
index 2488f150248..e433029a381 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@@ -1813,6 +1813,17 @@ Superuser created successfully.
       </listitem>
       <listitem>
         <para>
+          The option
+          <literal>services.prometheus.environmentFile</literal> has
+          been removed since it was causing
+          <link xlink:href="https://github.com/NixOS/nixpkgs/issues/126083">issues</link>
+          and Prometheus now has native support for secret files, i.e.
+          <literal>basic_auth.password_file</literal> and
+          <literal>authorization.credentials_file</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           Dokuwiki now supports caddy! However
         </para>
         <itemizedlist spacing="compact">
diff --git a/nixos/doc/manual/release-notes/rl-2111.section.md b/nixos/doc/manual/release-notes/rl-2111.section.md
index 39663720eb6..7567c7d6439 100644
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@@ -510,6 +510,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - A new option `services.prometheus.enableReload` has been added which can be enabled to reload the prometheus service when its config file changes instead of restarting.
 
+- The option `services.prometheus.environmentFile` has been removed since it was causing [issues](https://github.com/NixOS/nixpkgs/issues/126083) and Prometheus now has native support for secret files, i.e. `basic_auth.password_file` and `authorization.credentials_file`.
+
 - Dokuwiki now supports caddy! However
   - the nginx option has been removed, in the new configuration, please use the `dokuwiki.webserver = "nginx"` instead.
   - The "${hostname}" option has been deprecated, please use `dokuwiki.sites = [ "${hostname}" ]` instead
diff --git a/nixos/modules/config/swap.nix b/nixos/modules/config/swap.nix
index ff2ae1da31b..9b005021086 100644
--- a/nixos/modules/config/swap.nix
+++ b/nixos/modules/config/swap.nix
@@ -47,6 +47,15 @@ let
         '';
       };
 
+      allowDiscards = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Whether to allow TRIM requests to the underlying device. This option
+          has security implications; please read the LUKS documentation before
+          activating it.
+        '';
+      };
     };
 
   };
@@ -224,7 +233,8 @@ in
                   fi
                 ''}
                 ${optionalString sw.randomEncryption.enable ''
-                  cryptsetup plainOpen -c ${sw.randomEncryption.cipher} -d ${sw.randomEncryption.source} ${optionalString (sw.discardPolicy != null) "--allow-discards"} ${sw.device} ${sw.deviceName}
+                  cryptsetup plainOpen -c ${sw.randomEncryption.cipher} -d ${sw.randomEncryption.source} \
+                    ${optionalString sw.randomEncryption.allowDiscards "--allow-discards"} ${sw.device} ${sw.deviceName}
                   mkswap ${sw.realDevice}
                 ''}
               '';
diff --git a/nixos/modules/services/monitoring/prometheus/default.nix b/nixos/modules/services/monitoring/prometheus/default.nix
index cdda6c5ce3a..f20b8dde1ab 100644
--- a/nixos/modules/services/monitoring/prometheus/default.nix
+++ b/nixos/modules/services/monitoring/prometheus/default.nix
@@ -9,13 +9,6 @@ let
 
   prometheusYmlOut = "${workingDir}/prometheus-substituted.yaml";
 
-  writeConfig = pkgs.writeShellScriptBin "write-prometheus-config" ''
-    PATH="${makeBinPath (with pkgs; [ coreutils envsubst ])}"
-    touch '${prometheusYmlOut}'
-    chmod 600 '${prometheusYmlOut}'
-    envsubst -o '${prometheusYmlOut}' -i '${prometheusYml}'
-  '';
-
   triggerReload = pkgs.writeShellScriptBin "trigger-reload-prometheus" ''
     PATH="${makeBinPath (with pkgs; [ systemd ])}"
     if systemctl -q is-active prometheus.service; then
@@ -76,8 +69,8 @@ let
     "--storage.tsdb.path=${workingDir}/data/"
     "--config.file=${
       if cfg.enableReload
-      then prometheusYmlOut
-      else "/run/prometheus/prometheus-substituted.yaml"
+      then "/etc/prometheus/prometheus.yaml"
+      else prometheusYml
     }"
     "--web.listen-address=${cfg.listenAddress}:${builtins.toString cfg.port}"
     "--alertmanager.notification-queue-capacity=${toString cfg.alertmanagerNotificationQueueCapacity}"
@@ -1561,6 +1554,8 @@ in
 
   imports = [
     (mkRenamedOptionModule [ "services" "prometheus2" ] [ "services" "prometheus" ])
+    (mkRemovedOptionModule [ "services" "prometheus" "environmentFile" ]
+      "It has been removed since it was causing issues (https://github.com/NixOS/nixpkgs/issues/126083) and Prometheus now has native support for secret files, i.e. `basic_auth.password_file` and `authorization.credentials_file`.")
   ];
 
   options.services.prometheus = {
@@ -1625,51 +1620,6 @@ in
         (<literal>switch-to-configuration</literal>) that changes the prometheus
         configuration only finishes successully when prometheus has finished
         loading the new configuration.
-
-        Note that prometheus will also get reloaded when the location of the
-        <option>environmentFile</option> changes but not when its contents
-        changes. So when you change it contents make sure to reload prometheus
-        manually or include the hash of <option>environmentFile</option> in its
-        name.
-      '';
-    };
-
-    environmentFile = mkOption {
-      type = types.nullOr types.path;
-      default = null;
-      example = "/root/prometheus.env";
-      description = ''
-        Environment file as defined in <citerefentry>
-        <refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum>
-        </citerefentry>.
-
-        Secrets may be passed to the service without adding them to the
-        world-readable Nix store, by specifying placeholder variables as
-        the option value in Nix and setting these variables accordingly in the
-        environment file.
-
-        Environment variables from this file will be interpolated into the
-        config file using envsubst with this syntax:
-        <literal>$ENVIRONMENT ''${VARIABLE}</literal>
-
-        <programlisting>
-          # Example scrape config entry handling an OAuth bearer token
-          {
-            job_name = "home_assistant";
-            metrics_path = "/api/prometheus";
-            scheme = "https";
-            bearer_token = "\''${HOME_ASSISTANT_BEARER_TOKEN}";
-            [...]
-          }
-        </programlisting>
-
-        <programlisting>
-          # Content of the environment file
-          HOME_ASSISTANT_BEARER_TOKEN=someoauthbearertoken
-        </programlisting>
-
-        Note that this file needs to be available on the host on which
-        <literal>Prometheus</literal> is running.
       '';
     };
 
@@ -1830,13 +1780,12 @@ in
       uid = config.ids.uids.prometheus;
       group = "prometheus";
     };
+    environment.etc."prometheus/prometheus.yaml" = mkIf cfg.enableReload {
+      source = prometheusYml;
+    };
     systemd.services.prometheus = {
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
-      preStart = mkIf (!cfg.enableReload) ''
-        ${lib.getBin pkgs.envsubst}/bin/envsubst -o "/run/prometheus/prometheus-substituted.yaml" \
-                                                 -i "${prometheusYml}"
-      '';
       serviceConfig = {
         ExecStart = "${cfg.package}/bin/prometheus" +
           optionalString (length cmdlineArgs != 0) (" \\\n  " +
@@ -1844,7 +1793,6 @@ in
         ExecReload = mkIf cfg.enableReload "+${reload}/bin/reload-prometheus";
         User = "prometheus";
         Restart = "always";
-        EnvironmentFile = mkIf (cfg.environmentFile != null && !cfg.enableReload) [ cfg.environmentFile ];
         RuntimeDirectory = "prometheus";
         RuntimeDirectoryMode = "0700";
         WorkingDirectory = workingDir;
@@ -1852,18 +1800,6 @@ in
         StateDirectoryMode = "0700";
       };
     };
-    systemd.services.prometheus-config-write = mkIf cfg.enableReload {
-      wantedBy = [ "prometheus.service" ];
-      before = [ "prometheus.service" ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = "prometheus";
-        StateDirectory = cfg.stateDir;
-        StateDirectoryMode = "0700";
-        EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
-        ExecStart = "${writeConfig}/bin/write-prometheus-config";
-      };
-    };
     # prometheus-config-reload will activate after prometheus. However, what we
     # don't want is that on startup it immediately reloads prometheus because
     # prometheus itself might have just started.
@@ -1873,26 +1809,19 @@ in
     # harmless message and then stay active (RemainAfterExit).
     #
     # Then, when the config file has changed, switch-to-configuration notices
-    # that this service has changed and needs to be reloaded
-    # (reloadIfChanged). The reload command then actually writes the new config
-    # and reloads prometheus.
+    # that this service has changed (restartTriggers) and needs to be reloaded
+    # (reloadIfChanged). The reload command then reloads prometheus.
     systemd.services.prometheus-config-reload = mkIf cfg.enableReload {
       wantedBy = [ "prometheus.service" ];
       after = [ "prometheus.service" ];
       reloadIfChanged = true;
+      restartTriggers = [ prometheusYml ];
       serviceConfig = {
         Type = "oneshot";
-        User = "prometheus";
-        StateDirectory = cfg.stateDir;
-        StateDirectoryMode = "0700";
-        EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
         RemainAfterExit = true;
         TimeoutSec = 60;
         ExecStart = "${pkgs.logger}/bin/logger 'prometheus-config-reload will only reload prometheus when reloaded itself.'";
-        ExecReload = [
-          "${writeConfig}/bin/write-prometheus-config"
-          "+${triggerReload}/bin/trigger-reload-prometheus"
-        ];
+        ExecReload = [ "${triggerReload}/bin/trigger-reload-prometheus" ];
       };
     };
   };
diff --git a/nixos/tests/prometheus.nix b/nixos/tests/prometheus.nix
index d102b4c0751..20f8c4459e1 100644
--- a/nixos/tests/prometheus.nix
+++ b/nixos/tests/prometheus.nix
@@ -130,14 +130,10 @@ in import ./make-test-python.nix {
 
             # This configuration just adds a new prometheus job
             # to scrape the node_exporter metrics of the s3 machine.
-            # We also use an environmentFile to test if that works correctly.
             services.prometheus = {
-              environmentFile = pkgs.writeText "prometheus-config-env-file" ''
-                JOB_NAME=s3-node_exporter
-              '';
               scrapeConfigs = [
                 {
-                  job_name = "$JOB_NAME";
+                  job_name = "s3-node_exporter";
                   static_configs = [
                     {
                       targets = [ "s3:9100" ];
@@ -232,11 +228,6 @@ in import ./make-test-python.nix {
     # Check if prometheus responds to requests:
     prometheus.wait_for_unit("prometheus.service")
 
-    # Check if prometheus' config file is correctly locked down because it could contain secrets.
-    prometheus.succeed(
-        "stat -c '%a %U' /var/lib/prometheus2/prometheus-substituted.yaml | grep '600 prometheus'"
-    )
-
     prometheus.wait_for_open_port(${toString queryPort})
     prometheus.succeed("curl -sf http://127.0.0.1:${toString queryPort}/metrics")
 
diff --git a/pkgs/applications/audio/tagutil/default.nix b/pkgs/applications/audio/tagutil/default.nix
index 903537333ff..e5076188301 100644
--- a/pkgs/applications/audio/tagutil/default.nix
+++ b/pkgs/applications/audio/tagutil/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     zlib
   ];
 
-  prePatch = ''
+  postPatch = ''
     substituteInPlace CMakeLists.txt \
       --replace "-o aslr" ""
   '';
diff --git a/pkgs/applications/misc/curaengine/stable.nix b/pkgs/applications/misc/curaengine/stable.nix
index 148553da162..3c74aaaded4 100644
--- a/pkgs/applications/misc/curaengine/stable.nix
+++ b/pkgs/applications/misc/curaengine/stable.nix
@@ -13,8 +13,6 @@ stdenv.mkDerivation {
 
   postPatch = ''
     substituteInPlace Makefile --replace "--static" ""
-  '' + lib.optionalString stdenv.isi686 ''
-    substituteInPlace Makefile --replace "-flto" ""
   '';
 
   installPhase = ''
diff --git a/pkgs/applications/misc/dunst/default.nix b/pkgs/applications/misc/dunst/default.nix
index 67753b6e371..49c43d47741 100644
--- a/pkgs/applications/misc/dunst/default.nix
+++ b/pkgs/applications/misc/dunst/default.nix
@@ -3,27 +3,20 @@
 , cairo, dbus, systemd, gdk-pixbuf, glib, libX11, libXScrnSaver
 , wayland, wayland-protocols
 , libXinerama, libnotify, pango, xorgproto, librsvg
+, testVersion, dunst
 }:
 
 stdenv.mkDerivation rec {
   pname = "dunst";
-  version = "1.7.0";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "dunst-project";
     repo = "dunst";
     rev = "v${version}";
-    sha256 = "sha256-BWbvGetXXCXbfPRY+u6gEfzBmX8PLSnI6a5vfCByiC0=";
+    sha256 = "0v15fhwzcg7zfn092sry0f4qb6dccz9bb312y9dadg745wf3n9qw";
   };
 
-  patches = [
-    (fetchpatch {
-      # fixes double free (https://github.com/dunst-project/dunst/issues/957)
-      url = "https://github.com/dunst-project/dunst/commit/dc8efbbaff0e9ba881fa187a01bfe5c033fbdcf9.patch";
-      sha256 = "sha256-xuODOFDP9Eqr3g8OtNnaMmTihhurfj2NLeZPr0TF4vY=";
-    })
-  ];
-
   nativeBuildInputs = [ perl pkg-config which systemd makeWrapper ];
 
   buildInputs = [
@@ -47,6 +40,8 @@ stdenv.mkDerivation rec {
       --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE"
   '';
 
+  passthru.tests.version = testVersion { package = dunst; };
+
   meta = with lib; {
     description = "Lightweight and customizable notification daemon";
     homepage = "https://dunst-project.org/";
diff --git a/pkgs/applications/misc/synergy/build-tests.patch b/pkgs/applications/misc/synergy/build-tests.patch
deleted file mode 100644
index ab08195e794..00000000000
--- a/pkgs/applications/misc/synergy/build-tests.patch
+++ /dev/null
@@ -1,97 +0,0 @@
-From 9c2278dad498b8e4040f30c80cf65b3a089ba218 Mon Sep 17 00:00:00 2001
-From: talyz <kim.lindberger@gmail.com>
-Date: Fri, 14 Feb 2020 16:26:36 +0100
-Subject: [PATCH] Build tests again
-
-The tests were accidentally disabled in
-688095d0a7d22704b5c3282bc68b41ceca42ab7e. Since then, the code has
-drifted slightly: the synergy lib has been renamed from synergy to
-synlib in 4263fd17177d7717b04ac6d6ec62efa2f657ed74 and the curl
-dependency was dropped in 491bb2de000245a943b8298462c4a9d8f34c9a44.
-
-This reenables the tests, targets the right lib and removes the
-obsolete test.
----
- src/CMakeLists.txt                            |  2 +
- src/test/integtests/CMakeLists.txt            |  2 +-
- .../integtests/arch/ArchInternetTests.cpp     | 37 -------------------
- src/test/unittests/CMakeLists.txt             |  2 +-
- 4 files changed, 4 insertions(+), 39 deletions(-)
- delete mode 100644 src/test/integtests/arch/ArchInternetTests.cpp
-
-diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
-index ab63a066..fee080ab 100644
---- a/src/CMakeLists.txt
-+++ b/src/CMakeLists.txt
-@@ -22,3 +22,5 @@ add_subdirectory(cmd)
- if (SYNERGY_BUILD_LEGACY_GUI)
- add_subdirectory(gui)
- endif (SYNERGY_BUILD_LEGACY_GUI)
-+
-+add_subdirectory(test)
-diff --git a/src/test/integtests/CMakeLists.txt b/src/test/integtests/CMakeLists.txt
-index f39968a3..096ba3d5 100644
---- a/src/test/integtests/CMakeLists.txt
-+++ b/src/test/integtests/CMakeLists.txt
-@@ -68,4 +68,4 @@ endif()
- 
- add_executable(integtests ${sources})
- target_link_libraries(integtests
--    arch base client common io ipc mt net platform server synergy gtest gmock ${libs} ${OPENSSL_LIBS})
-+    arch base client common io ipc mt net platform server synlib gtest gmock ${libs} ${OPENSSL_LIBS})
-diff --git a/src/test/integtests/arch/ArchInternetTests.cpp b/src/test/integtests/arch/ArchInternetTests.cpp
-deleted file mode 100644
-index 95823e9f..00000000
---- a/src/test/integtests/arch/ArchInternetTests.cpp
-+++ /dev/null
-@@ -1,37 +0,0 @@
--/*
-- * synergy -- mouse and keyboard sharing utility
-- * Copyright (C) 2014-2016 Symless Ltd.
-- *
-- * This package is free software; you can redistribute it and/or
-- * modify it under the terms of the GNU General Public License
-- * found in the file LICENSE that should have accompanied this file.
-- *
-- * This package is distributed in the hope that it will be useful,
-- * but WITHOUT ANY WARRANTY; without even the implied warranty of
-- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- * GNU General Public License for more details.
-- *
-- * You should have received a copy of the GNU General Public License
-- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
-- */
--
--#include "arch/Arch.h"
--
--#include "test/global/gtest.h"
--
--#define TEST_URL "https://symless.com/tests/?testString"
--//#define TEST_URL "http://localhost/synergy/tests/?testString"
--
--TEST(ArchInternetTests, get)
--{
--    ARCH_INTERNET internet;
--    String result = internet.get(TEST_URL);
--    ASSERT_EQ("Hello world!", result);
--}
--
--TEST(ArchInternetTests, urlEncode)
--{
--    ARCH_INTERNET internet;
--    String result = internet.urlEncode("hello=+&world");
--    ASSERT_EQ("hello%3D%2B%26world", result);
--}
-diff --git a/src/test/unittests/CMakeLists.txt b/src/test/unittests/CMakeLists.txt
-index 54131eb2..46307e90 100644
---- a/src/test/unittests/CMakeLists.txt
-+++ b/src/test/unittests/CMakeLists.txt
-@@ -68,4 +68,4 @@ endif()
- 
- add_executable(unittests ${sources})
- target_link_libraries(unittests
--    arch base client server common io net platform server synergy mt ipc gtest gmock shared ${libs} ${OPENSSL_LIBS})
-+    arch base client server common io net platform server synlib mt ipc gtest gmock shared ${libs} ${OPENSSL_LIBS})
--- 
-2.25.0
-
diff --git a/pkgs/applications/misc/synergy/default.nix b/pkgs/applications/misc/synergy/default.nix
index 8d3cc8c3096..803456dc85f 100644
--- a/pkgs/applications/misc/synergy/default.nix
+++ b/pkgs/applications/misc/synergy/default.nix
@@ -1,41 +1,90 @@
-{ stdenv, lib, fetchpatch, fetchFromGitHub, cmake, openssl, qttools
-, ApplicationServices, Carbon, Cocoa, CoreServices, ScreenSaver
-, xlibsWrapper, libX11, libXi, libXtst, libXrandr, xinput, avahi-compat
-, withGUI ? true, wrapQtAppsHook }:
+{ withGUI ? true
+, stdenv
+, lib
+, fetchpatch
+, fetchFromGitHub
+, wrapQtAppsHook
+
+, cmake
+, openssl
+, pcre
+, util-linux
+, libselinux
+, libsepol
+, pkg-config
+, gdk-pixbuf
+, libnotify
+, qttools
+, xlibsWrapper
+, libX11
+, libXi
+, libXtst
+, libXrandr
+, xinput
+, avahi-compat
+
+# macOS / darwin
+, ApplicationServices
+, Carbon
+, Cocoa
+, CoreServices
+, ScreenSaver
+}:
 
 stdenv.mkDerivation rec {
   pname = "synergy";
-  version = "1.13.1.41";
+  version = "1.14.1.32";
 
   src = fetchFromGitHub {
     owner = "symless";
     repo = "synergy-core";
     rev = "${version}-stable";
     fetchSubmodules = true;
-    sha256 = "1phg0szc9g018zxs5wbys4drzq1cdhyzajfg45l6a3fmi6qdi1kw";
+    sha256 = "123p75rm22vb3prw1igh0yii2y4bvv7r18iykfvmnr41hh4w7z2p";
   };
 
-  patches = lib.optional stdenv.isDarwin ./macos_build_fix.patch;
+  patches = [ ./macos_build_fix.patch ];
 
   postPatch = ''
     substituteInPlace src/gui/src/SslCertificate.cpp \
       --replace 'kUnixOpenSslCommand[] = "openssl";' 'kUnixOpenSslCommand[] = "${openssl}/bin/openssl";'
   '';
 
-  cmakeFlags = lib.optional (!withGUI) "-DSYNERGY_BUILD_LEGACY_GUI=OFF";
+  cmakeFlags = lib.optionals (!withGUI) [
+    "-DSYNERGY_BUILD_LEGACY_GUI=OFF"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "-DCMAKE_OSX_DEPLOYMENT_TARGET=10.09"
+  ];
+  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-Wno-inconsistent-missing-override";
 
-  nativeBuildInputs = [ cmake ] ++ lib.optional withGUI wrapQtAppsHook;
+  nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];
 
   dontWrapQtApps = true;
 
   buildInputs = [
     openssl
+    pcre
   ] ++ lib.optionals withGUI [
     qttools
   ] ++ lib.optionals stdenv.isDarwin [
-    ApplicationServices Carbon Cocoa CoreServices ScreenSaver
+    ApplicationServices
+    Carbon
+    Cocoa
+    CoreServices
+    ScreenSaver
   ] ++ lib.optionals stdenv.isLinux [
-    xlibsWrapper libX11 libXi libXtst libXrandr xinput avahi-compat
+    util-linux
+    libselinux
+    libsepol
+    xlibsWrapper
+    libX11
+    libXi
+    libXtst
+    libXrandr
+    xinput
+    avahi-compat
+    gdk-pixbuf
+    libnotify
   ];
 
   installPhase = ''
@@ -60,7 +109,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Share one mouse and keyboard between multiple computers";
-    homepage = "https://synergy-project.org/";
+    homepage = "https://symless.com/synergy";
     license = licenses.gpl2;
     maintainers = with maintainers; [ talyz ];
     platforms = platforms.all;
diff --git a/pkgs/applications/misc/synergy/macos_build_fix.patch b/pkgs/applications/misc/synergy/macos_build_fix.patch
index 50087a2c4b4..c304f3bfdd4 100644
--- a/pkgs/applications/misc/synergy/macos_build_fix.patch
+++ b/pkgs/applications/misc/synergy/macos_build_fix.patch
@@ -1,20 +1,29 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index c1e78d1d..13639ba1 100644
+index 50e712fa..d39c2ce4 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -328,14 +328,7 @@ if (${CMAKE_SYSTEM_NAME} MATCHES "Windows")
-         ${OPENSSL_ROOT}/lib/libssl.lib
-         ${OPENSSL_ROOT}/lib/libcrypto.lib
-     )
--elseif (${CMAKE_SYSTEM_NAME} MATCHES "Darwin")
--    set (OPENSSL_ROOT /usr/local/opt/openssl)
--    include_directories (BEFORE SYSTEM ${OPENSSL_ROOT}/include)
--    set (OPENSSL_LIBS
--        ${OPENSSL_ROOT}/lib/libssl.a
--        ${OPENSSL_ROOT}/lib/libcrypto.a
--    )
--elseif (${CMAKE_SYSTEM_NAME} MATCHES "Linux|.*BSD|DragonFly")
-+elseif (${CMAKE_SYSTEM_NAME} MATCHES "Linux|Darwin|.*BSD|DragonFly")
-     set (OPENSSL_LIBS ssl crypto)
- else()
-     message (FATAL_ERROR "Couldn't find OpenSSL")
+@@ -326,9 +326,6 @@ endif()
+ # Apple has to use static libraries because
+ # "Use of the Apple-provided OpenSSL libraries by apps is strongly discouraged."
+ # https://developer.apple.com/library/archive/documentation/Security/Conceptual/cryptoservices/SecureNetworkCommunicationAPIs/SecureNetworkCommunicationAPIs.html
+-if(APPLE)
+-    set(OPENSSL_USE_STATIC_LIBS TRUE)
+-endif()
+ find_package(OpenSSL REQUIRED)
+ 
+ #
+diff --git a/src/gui/src/OSXHelpers.mm b/src/gui/src/OSXHelpers.mm
+index 0c98afc1..38c190a6 100644
+--- a/src/gui/src/OSXHelpers.mm
++++ b/src/gui/src/OSXHelpers.mm
+@@ -20,10 +20,6 @@
+ #import <Foundation/Foundation.h>
+ #import <CoreData/CoreData.h>
+ #import <Cocoa/Cocoa.h>
+-#import <UserNotifications/UNNotification.h>
+-#import <UserNotifications/UNUserNotificationCenter.h>
+-#import <UserNotifications/UNNotificationContent.h>
+-#import <UserNotifications/UNNotificationTrigger.h>
+ 
+ #import <QtGlobal>
+ 
diff --git a/pkgs/applications/networking/irc/srain/default.nix b/pkgs/applications/networking/irc/srain/default.nix
new file mode 100644
index 00000000000..282506c5e0a
--- /dev/null
+++ b/pkgs/applications/networking/irc/srain/default.nix
@@ -0,0 +1,60 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, pkg-config
+, gtk3
+, libconfig
+, libsoup
+, libsecret
+, openssl
+, gettext
+, glib
+, glib-networking
+, appstream-glib
+, dbus-glib
+, python3Packages
+, meson
+, ninja
+, wrapGAppsHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "srain";
+  version = "1.3.0";
+
+  src = fetchFromGitHub {
+    owner = "SrainApp";
+    repo = "srain";
+    rev = version;
+    sha256 = "14s0h5wgvlkdylnjis2fa7m835142jzw0d0yqjnir1wqnwmq1rld";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    gettext
+    appstream-glib
+    wrapGAppsHook
+    python3Packages.sphinx
+  ];
+
+  buildInputs = [
+    gtk3
+    glib
+    glib-networking
+    dbus-glib
+    libconfig
+    libsoup
+    libsecret
+    openssl
+  ];
+
+  meta = with lib; {
+    description = "Modern IRC client written in GTK";
+    homepage = "https://srain.im";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ rewine ];
+  };
+}
diff --git a/pkgs/applications/networking/p2p/qbittorrent/default.nix b/pkgs/applications/networking/p2p/qbittorrent/default.nix
index 38e1b7cfceb..f5f5b3bde76 100644
--- a/pkgs/applications/networking/p2p/qbittorrent/default.nix
+++ b/pkgs/applications/networking/p2p/qbittorrent/default.nix
@@ -12,13 +12,13 @@ assert trackerSearch -> (python3 != null);
 with lib;
 mkDerivation rec {
   pname = "qbittorrent";
-  version = "4.3.8";
+  version = "4.3.9";
 
   src = fetchFromGitHub {
     owner = "qbittorrent";
     repo = "qBittorrent";
     rev = "release-${version}";
-    sha256 = "sha256-on5folzKuRoVlvDOpme+aWxUKUC5PnO+N3L51qwG2gY=";
+    sha256 = "sha256-pFHeozx72qVjA3cmW6GK058IIAOWmyNm1UQVCQ1v5EU=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/science/biology/obitools/obitools3.nix b/pkgs/applications/science/biology/obitools/obitools3.nix
index a7de2b4f76f..b38af2f64b5 100644
--- a/pkgs/applications/science/biology/obitools/obitools3.nix
+++ b/pkgs/applications/science/biology/obitools/obitools3.nix
@@ -9,8 +9,6 @@ python3Packages.buildPythonApplication rec {
     sha256 = "1x7a0nrr9agg1pfgq8i1j8r1p6c0jpyxsv196ylix1dd2iivmas1";
   };
 
-  disabled = python3Packages.pythonOlder "3.5";
-
   nativeBuildInputs = [ python3Packages.cython cmake ];
 
   postPatch = lib.optionalString stdenv.isAarch64 ''
diff --git a/pkgs/applications/version-management/gitlab/gitaly/default.nix b/pkgs/applications/version-management/gitlab/gitaly/default.nix
index c6f4df53774..2993d1a013f 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@@ -20,6 +20,7 @@ let
         };
       };
   };
+
   version = "14.4.1";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/v${lib.versions.major version}";
 in
diff --git a/pkgs/applications/virtualization/OVMF/default.nix b/pkgs/applications/virtualization/OVMF/default.nix
index 1d1788ba0d8..7adcd328add 100644
--- a/pkgs/applications/virtualization/OVMF/default.nix
+++ b/pkgs/applications/virtualization/OVMF/default.nix
@@ -30,10 +30,6 @@ edk2.mkDerivation projectDscPath {
 
   hardeningDisable = [ "format" "stackprotector" "pic" "fortify" ];
 
-  # Fails on i686 with:
-  # 'cc1: error: LTO support has not been enabled in this configuration'
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.isi686 [ "-fno-lto" ];
-
   buildFlags =
     lib.optionals secureBoot [ "-D SECURE_BOOT_ENABLE=TRUE" ]
     ++ lib.optionals csmSupport [ "-D CSM_ENABLE" "-D FD_SIZE_2MB" ]
diff --git a/pkgs/applications/window-managers/qtile/default.nix b/pkgs/applications/window-managers/qtile/default.nix
index 786a47d49c3..e17cbce7e2b 100644
--- a/pkgs/applications/window-managers/qtile/default.nix
+++ b/pkgs/applications/window-managers/qtile/default.nix
@@ -47,6 +47,9 @@ let
       psutil
       pyxdg
       pygobject3
+      pywayland
+      pywlroots
+      xkbcommon
     ];
 
     doCheck = false; # Requires X server #TODO this can be worked out with the existing NixOS testing infrastructure.
diff --git a/pkgs/development/libraries/amdvlk/default.nix b/pkgs/development/libraries/amdvlk/default.nix
index 9eec2be67b7..de3c2bc4a07 100644
--- a/pkgs/development/libraries/amdvlk/default.nix
+++ b/pkgs/development/libraries/amdvlk/default.nix
@@ -65,9 +65,6 @@ in stdenv.mkDerivation rec {
 
   cmakeDir = "../drivers/xgl";
 
-  # LTO is disabled in gcc for i686 as of #66528
-  cmakeFlags = lib.optionals stdenv.is32bit ["-DXGL_ENABLE_LTO=OFF"];
-
   installPhase = ''
     install -Dm755 -t $out/lib icd/amdvlk${suffix}.so
     install -Dm644 -t $out/share/vulkan/icd.d icd/amd_icd${suffix}.json
diff --git a/pkgs/development/libraries/libtorrent-rasterbar/default.nix b/pkgs/development/libraries/libtorrent-rasterbar/default.nix
index 90c14c6fdf9..c822d9dd12f 100644
--- a/pkgs/development/libraries/libtorrent-rasterbar/default.nix
+++ b/pkgs/development/libraries/libtorrent-rasterbar/default.nix
@@ -3,7 +3,7 @@
 }:
 
 let
-  version = "2.0.3";
+  version = "2.0.4";
 
   # Make sure we override python, so the correct version is chosen
   boostPython = boost.override { enablePython = true; inherit python; };
@@ -16,7 +16,7 @@ in stdenv.mkDerivation {
     owner = "arvidn";
     repo = "libtorrent";
     rev = "v${version}";
-    sha256 = "0c5g2chylhkwwssfab9gw0b7bm3raj08yzgia7j4d044lp8gflnd";
+    sha256 = "sha256-D+Euv71pquqyKGPvk76IwYKvVj+/oNtJfiLleiafthQ=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/libraries/tdlib/default.nix b/pkgs/development/libraries/tdlib/default.nix
index 25935ca71c3..efad8832a31 100644
--- a/pkgs/development/libraries/tdlib/default.nix
+++ b/pkgs/development/libraries/tdlib/default.nix
@@ -1,16 +1,15 @@
 { fetchFromGitHub, gperf, openssl, readline, zlib, cmake, lib, stdenv }:
 
 stdenv.mkDerivation rec {
-  version = "1.7.8";
   pname = "tdlib";
+  version = "1.7.9";
 
   src = fetchFromGitHub {
     owner = "tdlib";
     repo = "td";
-
-    rev = "a68d8e77efb03896f3a04fc316c47136b0bab7df";
-
-    sha256 = "0zis1mxb495lazmhax91h94nw73nyq82bhbx3f1zlxkvc8664099";
+    # https://github.com/tdlib/td/issues/1718
+    rev = "7d41d9eaa58a6e0927806283252dc9e74eda5512";
+    sha256 = "09b7srbfqi4gmg5pdi398pr0pxihw4d3cw85ycky54g862idzqs8";
   };
 
   buildInputs = [ gperf openssl readline zlib ];
diff --git a/pkgs/development/libraries/tinycbor/default.nix b/pkgs/development/libraries/tinycbor/default.nix
index 0890ab60c2b..4826c2b49c1 100644
--- a/pkgs/development/libraries/tinycbor/default.nix
+++ b/pkgs/development/libraries/tinycbor/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tinycbor";
-  version = "0.5.4";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "tinycbor";
     rev = "v${version}";
-    sha256 = "sha256-H0NTUaSOGMtbM1+EQVOsYoPP+A1FGvUM7XrbPxArR88=";
+    sha256 = "1ph1cmsh4hm6ikd3bs45mnv9zmniyrvp2rrg8qln204kr6fngfcd";
   };
 
   makeFlags = [ "prefix=$(out)" ];
diff --git a/pkgs/development/mobile/genymotion/default.nix b/pkgs/development/mobile/genymotion/default.nix
index 1aa81132c26..282324d2050 100644
--- a/pkgs/development/mobile/genymotion/default.nix
+++ b/pkgs/development/mobile/genymotion/default.nix
@@ -1,21 +1,34 @@
 { stdenv, lib, fetchurl, makeWrapper, which, zlib, libGL, glib, xorg, libxkbcommon
-, xdg-utils
+, xdg-utils, libXrender, fontconfig, freetype, systemd, libpulseaudio
 # For glewinfo
 , libXmu, libXi, libXext }:
 
 let
   packages = [
-    stdenv.cc.cc zlib glib xorg.libX11 libxkbcommon libXmu libXi libXext libGL
+    stdenv.cc.cc
+    zlib
+    glib
+    xorg.libX11
+    libxkbcommon
+    libXmu
+    libXi
+    libXext
+    libGL
+    libXrender
+    fontconfig
+    freetype
+    systemd
+    libpulseaudio
   ];
   libPath = lib.makeLibraryPath packages;
 in
 stdenv.mkDerivation rec {
   pname = "genymotion";
-  version = "2.8.0";
+  version = "3.2.1";
   src = fetchurl {
     url = "https://dl.genymotion.com/releases/genymotion-${version}/genymotion-${version}-linux_x64.bin";
     name = "genymotion-${version}-linux_x64.bin";
-    sha256 = "0lvfdlpmmsyq2i9gs4mf6a8fxkfimdr4rhyihqnfhjij3fzxz4lk";
+    sha256 = "sha256-yCczUfiMcuu9OauMDmMdtnheDBXiC9tOEu0cWAW95FM=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/node-packages/node-packages.json b/pkgs/development/node-packages/node-packages.json
index 6673ea8c3aa..4ac24a546d0 100644
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@@ -122,6 +122,7 @@
 , "git-run"
 , "git-ssb"
 , "git-standup"
+, "@gitbeaker/cli"
 , "gitmoji-cli"
 , "glob"
 , "graphql-cli"
diff --git a/pkgs/development/node-packages/node-packages.nix b/pkgs/development/node-packages/node-packages.nix
index 0bacb68f4c1..5b95896f439 100644
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@@ -2767,13 +2767,13 @@ let
         sha512 = "iT1bU56rKrKEOfODoW6fScY11qj3iaYrZ+z11T6fo5+TDm84UGkkXjLXJTE57ZJzg0/gbccHQWYv+chY7bJN8Q==";
       };
     };
-    "@fluentui/react-7.179.0" = {
+    "@fluentui/react-7.179.1" = {
       name = "_at_fluentui_slash_react";
       packageName = "@fluentui/react";
-      version = "7.179.0";
+      version = "7.179.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@fluentui/react/-/react-7.179.0.tgz";
-        sha512 = "2C3RrzBaQuq5yTVBezWA48TOOdhqTqfN2tV43w4lVUqjxi/E5vAFku2DAxxc56hZ6ehew78FZwKAZiaBrv2GiQ==";
+        url = "https://registry.npmjs.org/@fluentui/react/-/react-7.179.1.tgz";
+        sha512 = "2Hc7o5UsNpw9fsYRbLYsf9c2pR/yxqjwmiofW+TfuZvFyy60djy8gIbCVG2QtxLoY264zj6wfJcBEbPwhdHebA==";
       };
     };
     "@fluentui/react-focus-7.18.1" = {
@@ -2812,6 +2812,33 @@ let
         sha512 = "82cpyJyKRoQoRi+14ibCeGPu0CwypgtBAdBhq1WfvagpCZNKqwXbKwXllYSMG91DhmG4jt9gN8eP6lGOtozuaw==";
       };
     };
+    "@gitbeaker/core-34.5.0" = {
+      name = "_at_gitbeaker_slash_core";
+      packageName = "@gitbeaker/core";
+      version = "34.5.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@gitbeaker/core/-/core-34.5.0.tgz";
+        sha512 = "MfBwD3W79/nhmrwYyfw7R8FmVNS3CsoCulNfhySY38LT3w1GLMnDOIDTpELySTwoIWVXYT/QHdEPlGIG6nPXOg==";
+      };
+    };
+    "@gitbeaker/node-34.5.0" = {
+      name = "_at_gitbeaker_slash_node";
+      packageName = "@gitbeaker/node";
+      version = "34.5.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@gitbeaker/node/-/node-34.5.0.tgz";
+        sha512 = "klm9PI7r6OpCmkS3Q26nPnVUwTb/VfF/IdOYv02/8SguEI3gMWfmR8PNvD99nsKN7lvL6ZoHl79gMGbgr65fHg==";
+      };
+    };
+    "@gitbeaker/requester-utils-34.5.0" = {
+      name = "_at_gitbeaker_slash_requester-utils";
+      packageName = "@gitbeaker/requester-utils";
+      version = "34.5.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@gitbeaker/requester-utils/-/requester-utils-34.5.0.tgz";
+        sha512 = "fgMGE/A5sOLjuhRPRCyiwLOCBqbhlDpVjo6nooizyQcOH5K4c4EZNgGD5AQshg6U5r3xdLNCKHYFu36pbR91uQ==";
+      };
+    };
     "@google-cloud/paginator-3.0.6" = {
       name = "_at_google-cloud_slash_paginator";
       packageName = "@google-cloud/paginator";
@@ -2902,13 +2929,13 @@ let
         sha512 = "5k2SNz0W87tDcymhEMZMkd6/vs6QawDyjQXWtqkuLTBF3vxjxPD1I4dwHoxgWPIjjANhXybvulD7E+St/7s9TQ==";
       };
     };
-    "@graphql-tools/import-6.6.0" = {
+    "@graphql-tools/import-6.6.1" = {
       name = "_at_graphql-tools_slash_import";
       packageName = "@graphql-tools/import";
-      version = "6.6.0";
+      version = "6.6.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@graphql-tools/import/-/import-6.6.0.tgz";
-        sha512 = "qRuvLQQoeF3XEnz1uaH+7Xhs6TA7dUvyJi2VTzD6zLRPoqMXRxtSwoW67jlvskau31mI+7Q8yqG0P3QpdYg1Dw==";
+        url = "https://registry.npmjs.org/@graphql-tools/import/-/import-6.6.1.tgz";
+        sha512 = "i9WA6k+erJMci822o9w9DoX+uncVBK60LGGYW8mdbhX0l7wEubUpA000thJ1aarCusYh0u+ZT9qX0HyVPXu25Q==";
       };
     };
     "@graphql-tools/json-file-loader-6.2.6" = {
@@ -3019,13 +3046,13 @@ let
         sha512 = "gzkavMOgbhnwkHJYg32Adv6f+LxjbQmmbdD5Hty0+CWxvaiuJq+nU6tzb/7VSU4cwhbNLx/lGu2jbCPEW1McZQ==";
       };
     };
-    "@graphql-tools/utils-8.5.2" = {
+    "@graphql-tools/utils-8.5.3" = {
       name = "_at_graphql-tools_slash_utils";
       packageName = "@graphql-tools/utils";
-      version = "8.5.2";
+      version = "8.5.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@graphql-tools/utils/-/utils-8.5.2.tgz";
-        sha512 = "wxA51td/759nQziPYh+HxE0WbURRufrp1lwfOYMgfK4e8Aa6gCa1P1p6ERogUIm423NrIfOVau19Q/BBpHdolw==";
+        url = "https://registry.npmjs.org/@graphql-tools/utils/-/utils-8.5.3.tgz";
+        sha512 = "HDNGWFVa8QQkoQB0H1lftvaO1X5xUaUDk1zr1qDe0xN1NL0E/CrQdJ5UKLqOvH4hkqVUPxQsyOoAZFkaH6rLHg==";
       };
     };
     "@graphql-tools/wrap-7.0.8" = {
@@ -13468,6 +13495,15 @@ let
         sha512 = "1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==";
       };
     };
+    "bl-5.0.0" = {
+      name = "bl";
+      packageName = "bl";
+      version = "5.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/bl/-/bl-5.0.0.tgz";
+        sha512 = "8vxFNZ0pflFfi0WXA3WQXlj6CaMEwsmh63I1CNp0q+wWv8sD0ARx1KovSQd0l2GkwrMIOyedq0EF1FxI+RCZLQ==";
+      };
+    };
     "blake2b-2.1.3" = {
       name = "blake2b";
       packageName = "blake2b";
@@ -15548,22 +15584,22 @@ let
         sha512 = "vlNK021QdI7PNeiUh/lKkC/mNHHfV0m/Ad5JoI0TYtlBnJAslM/JIkm/tGC88bkLIwO6OQ5uV6ztS6kVAtCDlg==";
       };
     };
-    "cdk8s-1.1.26" = {
+    "cdk8s-1.1.27" = {
       name = "cdk8s";
       packageName = "cdk8s";
-      version = "1.1.26";
+      version = "1.1.27";
       src = fetchurl {
-        url = "https://registry.npmjs.org/cdk8s/-/cdk8s-1.1.26.tgz";
-        sha512 = "0WnyJcu1NKI1HMCNzdhk58UvWnQ+IRhs2G6RXi2tM/9/2g1S963TWppUbaux9tYefMqnUd9eqgSSUhCfCnm7/w==";
+        url = "https://registry.npmjs.org/cdk8s/-/cdk8s-1.1.27.tgz";
+        sha512 = "48iS6dNZGqFFdVxgLosc/SyrjTwKN/M4D3XKfuHPp++7iYarq4ygiHpKnfYVrLSjKNNzcn4abwLAZ+K17D+dPw==";
       };
     };
-    "cdk8s-plus-22-1.0.0-beta.32" = {
+    "cdk8s-plus-22-1.0.0-beta.35" = {
       name = "cdk8s-plus-22";
       packageName = "cdk8s-plus-22";
-      version = "1.0.0-beta.32";
+      version = "1.0.0-beta.35";
       src = fetchurl {
-        url = "https://registry.npmjs.org/cdk8s-plus-22/-/cdk8s-plus-22-1.0.0-beta.32.tgz";
-        sha512 = "lD44p0vA81y067XXslRk8jQKNqFT+iUCkaNXeWysI6hHEBJGhnYERLLHWlEQJmUWzea0jkNibh7azbE7LiEeow==";
+        url = "https://registry.npmjs.org/cdk8s-plus-22/-/cdk8s-plus-22-1.0.0-beta.35.tgz";
+        sha512 = "80m1VRISl2qAyzLq1Esh63vVEt/xWm62UgyJSiApvLOg8Qbc8R+xd9Ev48Vc/xBnb4TkC3jyqZKAjb+PasHYfA==";
       };
     };
     "cdktf-0.7.0" = {
@@ -16538,6 +16574,15 @@ let
         sha512 = "I/zHAwsKf9FqGoXM4WWRACob9+SNukZTd94DWF57E4toouRulbCxcUh6RKUEOQlYTHJnzkPMySvPNaaSLNfLZw==";
       };
     };
+    "cli-cursor-4.0.0" = {
+      name = "cli-cursor";
+      packageName = "cli-cursor";
+      version = "4.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/cli-cursor/-/cli-cursor-4.0.0.tgz";
+        sha512 = "VGtlMu3x/4DOtIUwEkRezxUZ2lBacNJCHash0N0WeZDBS+7Ux1dm3XWAgWYxLJFMMdOeXMHXorshEFhbMSGelg==";
+      };
+    };
     "cli-list-0.2.0" = {
       name = "cli-list";
       packageName = "cli-list";
@@ -24623,6 +24668,15 @@ let
         sha512 = "mJOZa35trBTb3IyRmo8xmKBZlxf+N7OnUl4+ZhJHs/r+0770Wh/LEACE2pqMGMe27G/4y8P2bYGk4J70IC5k1Q==";
       };
     };
+    "eslint-visitor-keys-3.1.0" = {
+      name = "eslint-visitor-keys";
+      packageName = "eslint-visitor-keys";
+      version = "3.1.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.1.0.tgz";
+        sha512 = "yWJFpu4DtjsWKkt5GeNBBuZMlNcYVs6vRCLoCVEJrTjaSB6LC98gFipNK/erM2Heg/E8mIK+hXG/pJMLK+eRZA==";
+      };
+    };
     "esmangle-1.0.1" = {
       name = "esmangle";
       packageName = "esmangle";
@@ -33463,6 +33517,15 @@ let
         sha512 = "2HvIEKRoqS62guEC+qBjpvRubdX910WCMuJTZ+I9yvqKU2/12eSL549HMwtabb4oupdj2sMP50k+XJfB/8JE6w==";
       };
     };
+    "is-interactive-2.0.0" = {
+      name = "is-interactive";
+      packageName = "is-interactive";
+      version = "2.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/is-interactive/-/is-interactive-2.0.0.tgz";
+        sha512 = "qP1vozQRI+BMOPcjFzrjXuQvdak2pHNUMZoeG2eRbiSqyvbEf/wQtEOTOX1guk6E3t36RkaqiSt8A/6YElNxLQ==";
+      };
+    };
     "is-invalid-path-0.1.0" = {
       name = "is-invalid-path";
       packageName = "is-invalid-path";
@@ -34138,6 +34201,15 @@ let
         sha512 = "knxG2q4UC3u8stRGyAVJCOdxFmv5DZiRcdlIaAQXAbSfJya+OhopNotLQrstBhququ4ZpuKbDc/8S6mgXgPFPw==";
       };
     };
+    "is-unicode-supported-1.1.0" = {
+      name = "is-unicode-supported";
+      packageName = "is-unicode-supported";
+      version = "1.1.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/is-unicode-supported/-/is-unicode-supported-1.1.0.tgz";
+        sha512 = "lDcxivp8TJpLG75/DpatAqNzOpDPSpED8XNtrpBHTdQ2InQ1PbW78jhwSxyxhhu+xbVSast2X38bwj8atwoUQA==";
+      };
+    };
     "is-url-1.2.4" = {
       name = "is-url";
       packageName = "is-url";
@@ -34174,13 +34246,13 @@ let
         sha512 = "Yd9oD7sgCycVvH8CHy5U4fLXibPwxVw2+diudYbT8ZfAiQDtW1H9WvPRR4+rtN9qOll+r+KAfO4SjO28OPpitA==";
       };
     };
-    "is-valid-domain-0.1.2" = {
+    "is-valid-domain-0.1.4" = {
       name = "is-valid-domain";
       packageName = "is-valid-domain";
-      version = "0.1.2";
+      version = "0.1.4";
       src = fetchurl {
-        url = "https://registry.npmjs.org/is-valid-domain/-/is-valid-domain-0.1.2.tgz";
-        sha512 = "vm/9Ynw80MusgfSMffjGRuMhO8hjk5MOxLoFL7nYWvWXTPCxTGQtACiCwO055UqHICG8xP6hIvRXK1iwnuU9GA==";
+        url = "https://registry.npmjs.org/is-valid-domain/-/is-valid-domain-0.1.4.tgz";
+        sha512 = "Caa6rwGze6pihA29wy3T1yNXzd53caGHvL0OfJ8RLtv0tVVzVZGlxFcQ0W8kls/uG0QUrv2B3J9xi/YB5/cfUQ==";
       };
     };
     "is-valid-glob-1.0.0" = {
@@ -35228,13 +35300,13 @@ let
         sha512 = "F7GLNdoHBAYN4eqw7c6Tv12lqGOoMazsjuXDJRubjjbbwZ0tM6a78rHhrZwE4w1XV7mIkTxKmkj4DnbSIPW8wg==";
       };
     };
-    "jsii-srcmak-0.1.390" = {
+    "jsii-srcmak-0.1.392" = {
       name = "jsii-srcmak";
       packageName = "jsii-srcmak";
-      version = "0.1.390";
+      version = "0.1.392";
       src = fetchurl {
-        url = "https://registry.npmjs.org/jsii-srcmak/-/jsii-srcmak-0.1.390.tgz";
-        sha512 = "fbpt5JRVB2ydjIj48NvcZbVu2SKYSq3pfJRIRtgAQUoretTNd357ZEWf2C6x8L7c8Zv/hq8wChQ9FtigbMXRRQ==";
+        url = "https://registry.npmjs.org/jsii-srcmak/-/jsii-srcmak-0.1.392.tgz";
+        sha512 = "HXFXdUYf2IOD6esJj3s6re3vO4Jcmn+v1mXlQFdiCqJcAiMDhJMtzq5m37toui1lG0NJy5o3yxfBInG9b9rT7A==";
       };
     };
     "json-bigint-1.0.0" = {
@@ -35525,13 +35597,13 @@ let
         sha512 = "0/4Lv6IenJV0qj2oBdgPIAmFiKKnh8qh7bmLFJ+/ZZHLjSeiL3fKKGX3UryvKPbxFbhV+JcYo9KUC19GJ/Z/4A==";
       };
     };
-    "json2jsii-0.2.40" = {
+    "json2jsii-0.2.45" = {
       name = "json2jsii";
       packageName = "json2jsii";
-      version = "0.2.40";
+      version = "0.2.45";
       src = fetchurl {
-        url = "https://registry.npmjs.org/json2jsii/-/json2jsii-0.2.40.tgz";
-        sha512 = "XtopwIXyLJWiyBydDjczRk7i51H31Nno5BnWf34zbjyAm5SUxzJ6IsqwVfuANys06tFkJYct+ghO/v52qsCAAw==";
+        url = "https://registry.npmjs.org/json2jsii/-/json2jsii-0.2.45.tgz";
+        sha512 = "1Ks3P15asuqxCNaCQlE+HQssI3FXwVVr9qXQIpA29c/VqYgibTtaZuNBQDf+3S7Htj0ufLiif8HGx7OYc1ElxQ==";
       };
     };
     "json3-3.2.6" = {
@@ -36848,6 +36920,15 @@ let
         sha512 = "+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==";
       };
     };
+    "li-1.3.0" = {
+      name = "li";
+      packageName = "li";
+      version = "1.3.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/li/-/li-1.3.0.tgz";
+        sha1 = "22c59bcaefaa9a8ef359cf759784e4bf106aea1b";
+      };
+    };
     "libnested-1.5.0" = {
       name = "libnested";
       packageName = "libnested";
@@ -38711,6 +38792,15 @@ let
         sha512 = "8XPvpAA8uyhfteu8pIvQxpJZ7SYYdpUivZpGy6sFsBuKRY/7rQGavedeB8aK+Zkyq6upMFVL/9AW6vOYzfRyLg==";
       };
     };
+    "log-symbols-5.0.0" = {
+      name = "log-symbols";
+      packageName = "log-symbols";
+      version = "5.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/log-symbols/-/log-symbols-5.0.0.tgz";
+        sha512 = "zBsSKauX7sM0kcqrf8VpMRPqcWzU6a/Wi7iEl0QlVSCiIZ4CctaLdfVdiZUn6q2/nenyt392qJqpw9FhNAwqxQ==";
+      };
+    };
     "log-update-1.0.2" = {
       name = "log-update";
       packageName = "log-update";
@@ -44934,13 +45024,13 @@ let
         sha512 = "rH3U4eLHsV+OgkOS29ULiC9JLspwMCyCIH/+BglLPXDxQs13IK8AGD+nVmkGXqGN5JefZu85YhfIi05CsOKWPw==";
       };
     };
-    "office-ui-fabric-react-7.179.0" = {
+    "office-ui-fabric-react-7.179.1" = {
       name = "office-ui-fabric-react";
       packageName = "office-ui-fabric-react";
-      version = "7.179.0";
+      version = "7.179.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/office-ui-fabric-react/-/office-ui-fabric-react-7.179.0.tgz";
-        sha512 = "P6EeDkygEDY/eUESDBLiW+Trpv9UwXgMsnhjrAz1woCL2qvkiXUi71fkO5XmVfKLo89Ixrf/4Gqi9uuEIUWILQ==";
+        url = "https://registry.npmjs.org/office-ui-fabric-react/-/office-ui-fabric-react-7.179.1.tgz";
+        sha512 = "htornECbfcBrAG9AgDVFccZfdFTEgqNiXvGq2FoNvFD4oMbgd+h2Klr4sTjXJ8yTEcweMTKvltMrG5z7/HdROA==";
       };
     };
     "omggif-1.0.10" = {
@@ -45672,6 +45762,15 @@ let
         sha512 = "5b6Y85tPxZZ7QytO+BQzysW31HJku27cRIlkbAXaNx+BdcVi+LlRFmVXzeF6a7JCwJpyw5c4b+YSVImQIrBpuQ==";
       };
     };
+    "ora-6.0.1" = {
+      name = "ora";
+      packageName = "ora";
+      version = "6.0.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/ora/-/ora-6.0.1.tgz";
+        sha512 = "TDdKkKHdWE6jo/6pIa5U5AWcSVfpNRFJ8sdRJpioGNVPLAzZzHs/N+QhUfF7ZbyoC+rnDuNTKzeDJUbAza9g4g==";
+      };
+    };
     "ordered-read-streams-1.0.1" = {
       name = "ordered-read-streams";
       packageName = "ordered-read-streams";
@@ -51352,6 +51451,15 @@ let
         sha512 = "XDxAeVmpfu1/6IjyT/gXHOl+S0vQ9owggJ30hhWKdHAsNPOcasn5o9BW0eejZqL2e4vMjhAxoW3jVHcD6mbcYw==";
       };
     };
+    "query-string-7.0.1" = {
+      name = "query-string";
+      packageName = "query-string";
+      version = "7.0.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/query-string/-/query-string-7.0.1.tgz";
+        sha512 = "uIw3iRvHnk9to1blJCG3BTc+Ro56CBowJXKmNNAm3RulvPBzWLRqKSiiDk+IplJhsydwtuNMHi8UGQFcCLVfkA==";
+      };
+    };
     "querystring-0.2.0" = {
       name = "querystring";
       packageName = "querystring";
@@ -54367,6 +54475,15 @@ let
         sha512 = "l+sSefzHpj5qimhFSE5a8nufZYAM3sBSVMAPtYkmC+4EH2anSGaEMXSD0izRQbu9nfyQ9y5JrVmp7E8oZrUjvA==";
       };
     };
+    "restore-cursor-4.0.0" = {
+      name = "restore-cursor";
+      packageName = "restore-cursor";
+      version = "4.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/restore-cursor/-/restore-cursor-4.0.0.tgz";
+        sha512 = "I9fPXU9geO9bHOt9pHHOhOkYerIMsmVaWB0rA2AI9ERh/+x/i7MV5HKBNrg+ljO5eoPVgCcnFuRjJ9uH6I/3eg==";
+      };
+    };
     "resumer-0.0.0" = {
       name = "resumer";
       packageName = "resumer";
@@ -56815,13 +56932,13 @@ let
         sha512 = "tf+h5W1IrjNm/9rKKj0JU2MDMruiopx0jjVA5zCdBtcGjfp0+c5rHw/zADLC3IeKlGHtVbHtpfzvYA0OYT+HKg==";
       };
     };
-    "slugify-1.6.1" = {
+    "slugify-1.6.2" = {
       name = "slugify";
       packageName = "slugify";
-      version = "1.6.1";
+      version = "1.6.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/slugify/-/slugify-1.6.1.tgz";
-        sha512 = "5ofqMTbetNhxlzjYYLBaZFQd6oiTuSkQlyfPEFIMwgUABlZQ0hbk5xIV9Ydd5jghWeRoO7GkiJliUvTpLOjNRA==";
+        url = "https://registry.npmjs.org/slugify/-/slugify-1.6.2.tgz";
+        sha512 = "XMtI8qD84LwCpthLMBHlIhcrj10cgA+U/Ot8G6FD6uFuWZtMfKK75JO7l81nzpFJsPlsW6LT+VKqWQJW3+6New==";
       };
     };
     "smart-buffer-4.2.0" = {
@@ -57004,13 +57121,13 @@ let
         sha512 = "tLkaY13RcO4nIRh1K2hT5iuotfTaIQw7cVIe0FUykN3SuQi0cm7ALxuyT5/CtDswOMWUzMGTibxYNx/gU7In+Q==";
       };
     };
-    "socket.io-4.3.1" = {
+    "socket.io-4.3.2" = {
       name = "socket.io";
       packageName = "socket.io";
-      version = "4.3.1";
+      version = "4.3.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/socket.io/-/socket.io-4.3.1.tgz";
-        sha512 = "HC5w5Olv2XZ0XJ4gOLGzzHEuOCfj3G0SmoW3jLHYYh34EVsIr3EkW9h6kgfW+K3TFEcmYy8JcPWe//KUkBp5jA==";
+        url = "https://registry.npmjs.org/socket.io/-/socket.io-4.3.2.tgz";
+        sha512 = "6S5tV4jcY6dbZ/lLzD6EkvNWI3s81JO6ABP/EpvOlK1NPOcIj3AS4khi6xXw6JlZCASq82HQV4SapfmVMMl2dg==";
       };
     };
     "socket.io-adapter-0.2.0" = {
@@ -58390,13 +58507,13 @@ let
         sha512 = "zZ/Q1M+9ZWlrchgh4QauD/MEUFa6eC6H6FYq6T8Of/y82JqsQBLwN6YlzbO09evE7Rx6x0oliXDCnQSjwGwQRA==";
       };
     };
-    "sscaff-1.2.119" = {
+    "sscaff-1.2.121" = {
       name = "sscaff";
       packageName = "sscaff";
-      version = "1.2.119";
+      version = "1.2.121";
       src = fetchurl {
-        url = "https://registry.npmjs.org/sscaff/-/sscaff-1.2.119.tgz";
-        sha512 = "e4jWv2GxeMShdg9tBJxv/LXwbvN83oRe/1I6wDOgtFn6kYH9PRUzYL6Jye4/ukuu+FsKWw1OTw32x4YigXPN2g==";
+        url = "https://registry.npmjs.org/sscaff/-/sscaff-1.2.121.tgz";
+        sha512 = "Cwo/cLml9cD0ltNPncb1a0Ow1zYr78aJQqu4P8Cw3KxERok+O2Byz95EI2YYZGSSwmZh7K8H+oOMfwQd4/11LA==";
       };
     };
     "ssh-config-1.1.6" = {
@@ -60424,6 +60541,15 @@ let
         sha512 = "xciy6NKCLfs4dqMD1Tdlo7v1/g0NfdA1EKsIptUQjlcVvpwHyjifAbNOF7ppFezGSMXxYE8me+l2+RlFF4lyTg==";
       };
     };
+    "sywac-1.3.0" = {
+      name = "sywac";
+      packageName = "sywac";
+      version = "1.3.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/sywac/-/sywac-1.3.0.tgz";
+        sha512 = "LDt2stNTp4bVPMgd70Jj9PWrSa4batl+bv+Ea5NLNGT7ufc4oQPtRfQ73wbddNV6RilaPqnEt6y1Wkm5FVTNEg==";
+      };
+    };
     "table-3.8.3" = {
       name = "table";
       packageName = "table";
@@ -64574,13 +64700,13 @@ let
         sha1 = "23f89069a6c62f46cf3a1d3b00169cefb90be0c6";
       };
     };
-    "usb-1.8.0" = {
+    "usb-1.9.0" = {
       name = "usb";
       packageName = "usb";
-      version = "1.8.0";
+      version = "1.9.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/usb/-/usb-1.8.0.tgz";
-        sha512 = "lA0q2tjDEAq1YUsW6nQ+asw92TtFrQ8rhMd11jAoFhK3xItZUupJ7npZDSmVOpQqQhhdFmX/YciqyywupA/wOQ==";
+        url = "https://registry.npmjs.org/usb/-/usb-1.9.0.tgz";
+        sha512 = "nybH1SzvwYkRQ5s8ko9XXyZkrcWV5VWMMv7yh5H++wALhjBFjt2XBoSJWxBUdu6U/UfceQz42inhv3/maxM8jg==";
       };
     };
     "use-3.1.1" = {
@@ -68112,6 +68238,15 @@ let
         sha1 = "c9af18876f7a175801d564fe70ad9e8317784934";
       };
     };
+    "xcase-2.0.1" = {
+      name = "xcase";
+      packageName = "xcase";
+      version = "2.0.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/xcase/-/xcase-2.0.1.tgz";
+        sha1 = "c7fa72caa0f440db78fd5673432038ac984450b9";
+      };
+    };
     "xcode-3.0.1" = {
       name = "xcode";
       packageName = "xcode";
@@ -71504,7 +71639,7 @@ in
       sources."simple-concat-1.0.1"
       sources."simple-get-2.8.1"
       sources."slash-3.0.0"
-      sources."slugify-1.6.1"
+      sources."slugify-1.6.2"
       (sources."snapdragon-0.8.2" // {
         dependencies = [
           sources."debug-2.6.9"
@@ -77185,10 +77320,10 @@ in
   cdk8s-cli = nodeEnv.buildNodePackage {
     name = "cdk8s-cli";
     packageName = "cdk8s-cli";
-    version = "1.0.23";
+    version = "1.0.25";
     src = fetchurl {
-      url = "https://registry.npmjs.org/cdk8s-cli/-/cdk8s-cli-1.0.23.tgz";
-      sha512 = "6Uc35OX0hWP1gPJAC4KT//2Kh7ajNACQH8ddBw36GvMejFQ+rnXBpw7hyNbTx0id0zxeA+IBHth/kI/mko/ZHw==";
+      url = "https://registry.npmjs.org/cdk8s-cli/-/cdk8s-cli-1.0.25.tgz";
+      sha512 = "E6HT4E8xjy9CFBEyN2jMil7zo9tRTghupgEda0ZxoT2B7TKxK6z9h2uDVXZH6iFb+ahIpGjbqoxmjKIyJyJtCA==";
     };
     dependencies = [
       sources."@jsii/check-node-1.42.0"
@@ -77203,8 +77338,8 @@ in
       sources."call-bind-1.0.2"
       sources."camelcase-6.2.0"
       sources."case-1.6.3"
-      sources."cdk8s-1.1.26"
-      sources."cdk8s-plus-22-1.0.0-beta.32"
+      sources."cdk8s-1.1.27"
+      sources."cdk8s-plus-22-1.0.0-beta.35"
       sources."chalk-4.1.2"
       sources."cliui-7.0.4"
       sources."clone-2.1.2"
@@ -77297,14 +77432,14 @@ in
           sources."yargs-16.2.0"
         ];
       })
-      (sources."jsii-srcmak-0.1.390" // {
+      (sources."jsii-srcmak-0.1.392" // {
         dependencies = [
           sources."fs-extra-9.1.0"
         ];
       })
       sources."json-schema-0.3.0"
       sources."json-schema-traverse-1.0.0"
-      sources."json2jsii-0.2.40"
+      sources."json2jsii-0.2.45"
       sources."jsonfile-6.1.0"
       sources."jsonschema-1.4.0"
       sources."locate-path-5.0.0"
@@ -77342,7 +77477,7 @@ in
       sources."snake-case-3.0.4"
       sources."sort-json-2.0.0"
       sources."spdx-license-list-6.4.0"
-      sources."sscaff-1.2.119"
+      sources."sscaff-1.2.121"
       (sources."streamroller-2.2.4" // {
         dependencies = [
           sources."date-format-2.1.0"
@@ -77431,9 +77566,9 @@ in
           sources."tslib-2.1.0"
         ];
       })
-      (sources."@graphql-tools/import-6.6.0" // {
+      (sources."@graphql-tools/import-6.6.1" // {
         dependencies = [
-          sources."@graphql-tools/utils-8.5.2"
+          sources."@graphql-tools/utils-8.5.3"
         ];
       })
       (sources."@graphql-tools/load-6.2.8" // {
@@ -77448,13 +77583,13 @@ in
       })
       (sources."@graphql-tools/mock-8.4.2" // {
         dependencies = [
-          sources."@graphql-tools/utils-8.5.2"
+          sources."@graphql-tools/utils-8.5.3"
         ];
       })
       (sources."@graphql-tools/schema-8.3.1" // {
         dependencies = [
           sources."@graphql-tools/merge-8.2.1"
-          sources."@graphql-tools/utils-8.5.2"
+          sources."@graphql-tools/utils-8.5.3"
         ];
       })
       (sources."@graphql-tools/utils-7.10.0" // {
@@ -77537,7 +77672,7 @@ in
       sources."apollo-server-caching-3.3.0"
       (sources."apollo-server-core-3.5.0" // {
         dependencies = [
-          sources."@graphql-tools/utils-8.5.2"
+          sources."@graphql-tools/utils-8.5.3"
         ];
       })
       sources."apollo-server-env-4.2.0"
@@ -77792,7 +77927,7 @@ in
       sources."is-symbol-1.0.4"
       sources."is-typed-array-1.1.8"
       sources."is-unicode-supported-0.1.0"
-      sources."is-valid-domain-0.1.2"
+      sources."is-valid-domain-0.1.4"
       sources."is-weakmap-2.0.1"
       sources."is-weakref-1.0.1"
       sources."is-weakset-2.0.1"
@@ -77984,7 +78119,7 @@ in
       sources."sort-json-2.0.0"
       sources."source-map-0.5.7"
       sources."spdx-license-list-6.4.0"
-      sources."sscaff-1.2.119"
+      sources."sscaff-1.2.121"
       (sources."stack-utils-2.0.5" // {
         dependencies = [
           sources."escape-string-regexp-2.0.0"
@@ -79901,10 +80036,10 @@ in
   coc-pyright = nodeEnv.buildNodePackage {
     name = "coc-pyright";
     packageName = "coc-pyright";
-    version = "1.1.181";
+    version = "1.1.185";
     src = fetchurl {
-      url = "https://registry.npmjs.org/coc-pyright/-/coc-pyright-1.1.181.tgz";
-      sha512 = "dtsGJiL/ul+kCNKkQ7cw0ZHJV3bw3sWEu2V2dtoDFDP8yVtIHEXbz5O8ujULwl+FkO3X4Th+Q8ZR02mqDwdapQ==";
+      url = "https://registry.npmjs.org/coc-pyright/-/coc-pyright-1.1.185.tgz";
+      sha512 = "scmrgeDh1nXAevfgiflyDLIykXJp9q1gi6uHGViO2m7Qu/L0SGTClT3Y7pA46SFXMxeKq/f8lBvUltvPzksWXg==";
     };
     dependencies = [
       sources."pyright-1.1.185"
@@ -85568,7 +85703,7 @@ in
       sources."@fluentui/date-time-utilities-7.9.1"
       sources."@fluentui/dom-utilities-1.1.2"
       sources."@fluentui/keyboard-key-0.2.17"
-      sources."@fluentui/react-7.179.0"
+      sources."@fluentui/react-7.179.1"
       sources."@fluentui/react-focus-7.18.1"
       sources."@fluentui/react-window-provider-1.0.2"
       sources."@fluentui/theme-1.7.4"
@@ -86611,7 +86746,7 @@ in
       sources."object.map-1.0.1"
       sources."object.pick-1.3.0"
       sources."object.reduce-1.0.1"
-      sources."office-ui-fabric-react-7.179.0"
+      sources."office-ui-fabric-react-7.179.1"
       sources."on-finished-2.3.0"
       sources."on-headers-1.0.2"
       sources."once-1.4.0"
@@ -87294,7 +87429,7 @@ in
           sources."eslint-visitor-keys-2.1.0"
         ];
       })
-      sources."eslint-visitor-keys-3.0.0"
+      sources."eslint-visitor-keys-3.1.0"
       sources."espree-9.0.0"
       sources."esquery-1.4.0"
       sources."esrecurse-4.3.0"
@@ -89301,7 +89436,7 @@ in
       })
       sources."sisteransi-1.0.5"
       sources."slash-3.0.0"
-      sources."slugify-1.6.1"
+      sources."slugify-1.6.2"
       sources."smart-buffer-4.2.0"
       (sources."snapdragon-0.8.2" // {
         dependencies = [
@@ -93935,6 +94070,115 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
+  "@gitbeaker/cli" = nodeEnv.buildNodePackage {
+    name = "_at_gitbeaker_slash_cli";
+    packageName = "@gitbeaker/cli";
+    version = "34.5.0";
+    src = fetchurl {
+      url = "https://registry.npmjs.org/@gitbeaker/cli/-/cli-34.5.0.tgz";
+      sha512 = "lOagLq2JwEbAnppLKWZlh1wfZv2r+FJfIvOgxtf+sy+t+CtQNIXuyPzBhzqgEKhpDDKqfSF7L9diEXVPXsISEA==";
+    };
+    dependencies = [
+      sources."@gitbeaker/core-34.5.0"
+      sources."@gitbeaker/node-34.5.0"
+      sources."@gitbeaker/requester-utils-34.5.0"
+      sources."@sindresorhus/is-4.2.0"
+      sources."@szmarczak/http-timer-4.0.6"
+      sources."@types/cacheable-request-6.0.2"
+      sources."@types/http-cache-semantics-4.0.1"
+      sources."@types/keyv-3.1.3"
+      sources."@types/node-16.11.6"
+      sources."@types/responselike-1.0.0"
+      sources."ansi-regex-6.0.1"
+      sources."ansi-styles-4.3.0"
+      sources."asynckit-0.4.0"
+      sources."base64-js-1.5.1"
+      sources."bl-5.0.0"
+      sources."buffer-6.0.3"
+      sources."cacheable-lookup-5.0.4"
+      sources."cacheable-request-7.0.2"
+      sources."call-bind-1.0.2"
+      sources."chalk-4.1.2"
+      sources."cli-cursor-4.0.0"
+      sources."cli-spinners-2.6.1"
+      sources."clone-1.0.4"
+      sources."clone-response-1.0.2"
+      sources."color-convert-2.0.1"
+      sources."color-name-1.1.4"
+      sources."combined-stream-1.0.8"
+      sources."decode-uri-component-0.2.0"
+      (sources."decompress-response-6.0.0" // {
+        dependencies = [
+          sources."mimic-response-3.1.0"
+        ];
+      })
+      sources."defaults-1.0.3"
+      sources."defer-to-connect-2.0.1"
+      sources."delay-5.0.0"
+      sources."delayed-stream-1.0.0"
+      sources."end-of-stream-1.4.4"
+      sources."filter-obj-1.1.0"
+      sources."form-data-4.0.0"
+      sources."function-bind-1.1.1"
+      sources."get-intrinsic-1.1.1"
+      sources."get-stream-5.2.0"
+      sources."got-11.8.2"
+      sources."has-1.0.3"
+      sources."has-flag-4.0.0"
+      sources."has-symbols-1.0.2"
+      sources."http-cache-semantics-4.1.0"
+      sources."http2-wrapper-1.0.3"
+      sources."ieee754-1.2.1"
+      sources."inherits-2.0.4"
+      sources."is-interactive-2.0.0"
+      sources."is-unicode-supported-1.1.0"
+      sources."json-buffer-3.0.1"
+      sources."keyv-4.0.4"
+      sources."li-1.3.0"
+      sources."log-symbols-5.0.0"
+      sources."lowercase-keys-2.0.0"
+      sources."mime-db-1.50.0"
+      sources."mime-types-2.1.33"
+      sources."mimic-fn-2.1.0"
+      sources."mimic-response-1.0.1"
+      sources."normalize-url-6.1.0"
+      sources."object-inspect-1.11.0"
+      sources."once-1.4.0"
+      sources."onetime-5.1.2"
+      sources."ora-6.0.1"
+      sources."p-cancelable-2.1.1"
+      sources."pump-3.0.0"
+      sources."qs-6.10.1"
+      sources."query-string-7.0.1"
+      sources."quick-lru-5.1.1"
+      sources."readable-stream-3.6.0"
+      sources."resolve-alpn-1.2.1"
+      sources."responselike-2.0.0"
+      sources."restore-cursor-4.0.0"
+      sources."safe-buffer-5.2.1"
+      sources."side-channel-1.0.4"
+      sources."signal-exit-3.0.5"
+      sources."split-on-first-1.1.0"
+      sources."strict-uri-encode-2.0.0"
+      sources."string_decoder-1.3.0"
+      sources."strip-ansi-7.0.1"
+      sources."supports-color-7.2.0"
+      sources."sywac-1.3.0"
+      sources."util-deprecate-1.0.2"
+      sources."wcwidth-1.0.1"
+      sources."wrappy-1.0.2"
+      sources."xcase-2.0.1"
+    ];
+    buildInputs = globalBuildInputs;
+    meta = {
+      description = "Full NodeJS CLI implementation of the GitLab API.";
+      homepage = "https://github.com/jdalrymple/gitbeaker#readme";
+      license = "MIT";
+    };
+    production = true;
+    bypassCache = true;
+    reconstructLock = true;
+  };
   gitmoji-cli = nodeEnv.buildNodePackage {
     name = "gitmoji-cli";
     packageName = "gitmoji-cli";
@@ -94371,9 +94615,9 @@ in
           sources."tslib-2.1.0"
         ];
       })
-      (sources."@graphql-tools/import-6.6.0" // {
+      (sources."@graphql-tools/import-6.6.1" // {
         dependencies = [
-          sources."@graphql-tools/utils-8.5.2"
+          sources."@graphql-tools/utils-8.5.3"
           sources."tslib-2.3.1"
         ];
       })
@@ -94401,7 +94645,7 @@ in
       (sources."@graphql-tools/schema-8.3.1" // {
         dependencies = [
           sources."@graphql-tools/merge-8.2.1"
-          sources."@graphql-tools/utils-8.5.2"
+          sources."@graphql-tools/utils-8.5.3"
           sources."tslib-2.3.1"
         ];
       })
@@ -99969,10 +100213,10 @@ in
   karma = nodeEnv.buildNodePackage {
     name = "karma";
     packageName = "karma";
-    version = "6.3.7";
+    version = "6.3.8";
     src = fetchurl {
-      url = "https://registry.npmjs.org/karma/-/karma-6.3.7.tgz";
-      sha512 = "EEkswZhOx3EFt1ELlVECeOXHONbHSGw6fkbeMxvCSkLD77X38Kb1d/Oup2Re9ep/tSoa1He3YIBf3Hp+9EsKtg==";
+      url = "https://registry.npmjs.org/karma/-/karma-6.3.8.tgz";
+      sha512 = "10wBBU9S0lBHhbCNfmmbWQaY5C1bXlKdnvzN2QKThujCI/+DKaezrI08l6bfTlpJ92VsEboq3zYKpXwK6DOi3A==";
     };
     dependencies = [
       sources."@types/component-emitter-1.2.11"
@@ -100078,7 +100322,7 @@ in
       sources."rimraf-3.0.2"
       sources."safer-buffer-2.1.2"
       sources."setprototypeof-1.1.1"
-      (sources."socket.io-4.3.1" // {
+      (sources."socket.io-4.3.2" // {
         dependencies = [
           sources."debug-4.3.2"
           sources."ms-2.1.2"
@@ -116226,10 +116470,10 @@ in
   snyk = nodeEnv.buildNodePackage {
     name = "snyk";
     packageName = "snyk";
-    version = "1.753.0";
+    version = "1.754.0";
     src = fetchurl {
-      url = "https://registry.npmjs.org/snyk/-/snyk-1.753.0.tgz";
-      sha512 = "dr9mBwP1yOK1afYvUxOIuC2CJN4qJ5fGf7oQRRQUKXmXKyzuUVl7wSouK+8yYfZJKEH9Jns1x/EvZTrK35NUSw==";
+      url = "https://registry.npmjs.org/snyk/-/snyk-1.754.0.tgz";
+      sha512 = "8wuzk1Qmni4x7KxMcnmMsW1JeXJaEruYX9VBvlq4zu5eTRdWYuWXJtWqMFtdhHcVESFomFKtdJZGa5rqLZg2Ng==";
     };
     buildInputs = globalBuildInputs;
     meta = {
@@ -116244,10 +116488,10 @@ in
   "socket.io" = nodeEnv.buildNodePackage {
     name = "socket.io";
     packageName = "socket.io";
-    version = "4.3.1";
+    version = "4.3.2";
     src = fetchurl {
-      url = "https://registry.npmjs.org/socket.io/-/socket.io-4.3.1.tgz";
-      sha512 = "HC5w5Olv2XZ0XJ4gOLGzzHEuOCfj3G0SmoW3jLHYYh34EVsIr3EkW9h6kgfW+K3TFEcmYy8JcPWe//KUkBp5jA==";
+      url = "https://registry.npmjs.org/socket.io/-/socket.io-4.3.2.tgz";
+      sha512 = "6S5tV4jcY6dbZ/lLzD6EkvNWI3s81JO6ABP/EpvOlK1NPOcIj3AS4khi6xXw6JlZCASq82HQV4SapfmVMMl2dg==";
     };
     dependencies = [
       sources."@types/component-emitter-1.2.11"
@@ -119472,7 +119716,7 @@ in
       sources."node-addon-api-4.2.0"
       sources."node-gyp-build-4.3.0"
       sources."q-1.5.1"
-      sources."usb-1.8.0"
+      sources."usb-1.9.0"
     ];
     buildInputs = globalBuildInputs;
     meta = {
diff --git a/pkgs/development/python-modules/bleak/default.nix b/pkgs/development/python-modules/bleak/default.nix
index d035e413351..d159811efbc 100644
--- a/pkgs/development/python-modules/bleak/default.nix
+++ b/pkgs/development/python-modules/bleak/default.nix
@@ -4,20 +4,18 @@
 
 buildPythonPackage rec {
   pname = "bleak";
-  version = "0.12.1";
+  version = "0.13.0";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1va9138igcgbpsnzgr90qwprmhr9h8lryqslc22jxra4r56a502a";
+    sha256 = "1vnwk36qfws9amqrdaynf63dcj2gzxm0ns1l75hrczmd5j2ic1zb";
   };
 
   postPatch = ''
-    # bleak checks BlueZ's version with a call to `bluetoothctl -v` twice
-    substituteInPlace bleak/__init__.py \
-      --replace \"bluetoothctl\" \"${bluez}/bin/bluetoothctl\"
-    substituteInPlace bleak/backends/bluezdbus/client.py \
+    # bleak checks BlueZ's version with a call to `bluetoothctl --version`
+    substituteInPlace bleak/backends/bluezdbus/__init__.py \
       --replace \"bluetoothctl\" \"${bluez}/bin/bluetoothctl\"
   '';
 
diff --git a/pkgs/development/python-modules/pygame/default.nix b/pkgs/development/python-modules/pygame/default.nix
index 7ae4c96702a..39ecf7af4a5 100644
--- a/pkgs/development/python-modules/pygame/default.nix
+++ b/pkgs/development/python-modules/pygame/default.nix
@@ -1,15 +1,17 @@
-{ stdenv, lib, substituteAll, fetchPypi, buildPythonPackage, python, pkg-config, libX11
+{ stdenv, lib, substituteAll, fetchFromGitHub, buildPythonPackage, python, pkg-config, libX11
 , SDL2, SDL2_image, SDL2_mixer, SDL2_ttf, libpng, libjpeg, portmidi, freetype, fontconfig
-, AppKit, CoreMIDI
+, AppKit
 }:
 
 buildPythonPackage rec {
   pname = "pygame";
-  version = "2.0.1";
+  version = "2.1.0";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "8b1e7b63f47aafcdd8849933b206778747ef1802bd3d526aca45ed77141e4001";
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = version;
+    sha256 = "GrfNaowlD2L5umiFwj7DgtHGBg9a4WVfe3RlMjK3ElU=";
   };
 
   patches = [
@@ -41,11 +43,11 @@ buildPythonPackage rec {
     SDL2 SDL2_image SDL2_mixer SDL2_ttf libpng libjpeg
     portmidi libX11 freetype
   ] ++ lib.optionals stdenv.isDarwin [
-    AppKit CoreMIDI
+    AppKit
   ];
 
   preConfigure = ''
-    LOCALBASE=/ ${python.interpreter} buildconfig/config.py
+    ${python.interpreter} buildconfig/config.py
   '';
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/pygame/fix-dependency-finding.patch b/pkgs/development/python-modules/pygame/fix-dependency-finding.patch
index 11b705f1b1a..a756cb8e5d6 100644
--- a/pkgs/development/python-modules/pygame/fix-dependency-finding.patch
+++ b/pkgs/development/python-modules/pygame/fix-dependency-finding.patch
@@ -1,29 +1,13 @@
 diff --git a/buildconfig/config_darwin.py b/buildconfig/config_darwin.py
-index 8d84683f..70df8f9c 100644
+index c785e183..37d5cea4 100644
 --- a/buildconfig/config_darwin.py
 +++ b/buildconfig/config_darwin.py
-@@ -56,10 +56,10 @@ class Dependency:
- class FrameworkDependency(Dependency):
-     def configure(self, incdirs, libdirs):
-         BASE_DIRS = '/', os.path.expanduser('~/'), '/System/'
--        for n in BASE_DIRS:
-+        for n in incdirs + libdirs:
-             n += 'Library/Frameworks/'
-             fmwk = n + self.libs + '.framework/Versions/Current/'
--            if os.path.isfile(fmwk + self.libs):
-+            if os.path.isfile(fmwk + self.libs + '.tbd'):
-                 print ('Framework ' + self.libs + ' found')
-                 self.found = 1
-                 self.inc_dir = fmwk + 'Headers'
-@@ -158,19 +158,8 @@ def main(sdl2=False):
+@@ -146,16 +146,8 @@ def main():
      ])
  
      print ('Hunting dependencies...')
--    incdirs = ['/usr/local/include']
--    if sdl2:
--        incdirs.append('/usr/local/include/SDL2')
--    else:
--        incdirs.append('/usr/local/include/SDL')
+-    incdirs = ['/usr/local/include', '/opt/homebrew/include']
+-    incdirs.extend(['/usr/local/include/SDL2', '/opt/homebrew/include/SDL2', '/opt/local/include/SDL2'])
 -
 -    incdirs.extend([
 -       #'/usr/X11/include',
@@ -31,17 +15,17 @@ index 8d84683f..70df8f9c 100644
 -       '/opt/local/include/freetype2/freetype']
 -    )
 -    #libdirs = ['/usr/local/lib', '/usr/X11/lib', '/opt/local/lib']
--    libdirs = ['/usr/local/lib', '/opt/local/lib']
+-    libdirs = ['/usr/local/lib', '/opt/local/lib', '/opt/homebrew/lib']
 +    incdirs = @buildinputs_include@
 +    libdirs = @buildinputs_lib@
  
      for d in DEPS:
          if isinstance(d, (list, tuple)):
 diff --git a/buildconfig/config_unix.py b/buildconfig/config_unix.py
-index f6a4ea4b..f7f5be76 100644
+index 5c50bcdc..2fd69e2d 100644
 --- a/buildconfig/config_unix.py
 +++ b/buildconfig/config_unix.py
-@@ -224,18 +224,8 @@ def main(sdl2=False):
+@@ -210,18 +210,8 @@ def main():
      if not DEPS[0].found:
          raise RuntimeError('Unable to run "sdl-config". Please make sure a development version of SDL is installed.')
  
diff --git a/pkgs/development/python-modules/pywayland/default.nix b/pkgs/development/python-modules/pywayland/default.nix
new file mode 100644
index 00000000000..faec2c20263
--- /dev/null
+++ b/pkgs/development/python-modules/pywayland/default.nix
@@ -0,0 +1,43 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, python
+, cffi
+, pkg-config
+, wayland
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "pywayland";
+  version = "0.4.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0IMNOPTmY22JCHccIVuZxDhVr41cDcKNkx8bp+5h2CU=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  propagatedNativeBuildInputs = [ cffi ];
+  buildInputs = [ wayland ];
+  propagatedBuildInputs = [ cffi ];
+  checkInputs = [ pytestCheckHook ];
+
+  postBuild = ''
+    ${python.interpreter} pywayland/ffi_build.py
+  '';
+
+  # Tests need this to create sockets
+  preCheck = ''
+    export XDG_RUNTIME_DIR="$PWD"
+  '';
+
+  pythonImportsCheck = [ "pywayland" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/flacjacket/pywayland";
+    description = "Python bindings to wayland using cffi";
+    license = licenses.ncsa;
+    maintainers = with maintainers; [ chvp ];
+  };
+}
diff --git a/pkgs/development/python-modules/pywlroots/default.nix b/pkgs/development/python-modules/pywlroots/default.nix
new file mode 100644
index 00000000000..ab7a8777a24
--- /dev/null
+++ b/pkgs/development/python-modules/pywlroots/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, python
+, cffi
+, pkg-config
+, libxkbcommon
+, libinput
+, pixman
+, udev
+, wlroots
+, wayland
+, pywayland
+, xkbcommon
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "pywlroots";
+  version = "0.14.9";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "jzHh5ubonn6pCaOp+Dnr7tA9n5DdZ28hBM+03jZZlvc=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  propagatedNativeBuildInputs = [ cffi ];
+  buildInputs = [ libinput libxkbcommon pixman udev wayland wlroots ];
+  propagatedBuildInputs = [ cffi pywayland xkbcommon ];
+  checkInputs = [ pytestCheckHook ];
+
+  postBuild = ''
+    ${python.interpreter} wlroots/ffi_build.py
+  '';
+
+  pythonImportsCheck = [ "wlroots" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/flacjacket/pywlroots";
+    description = "Python bindings to wlroots using cffi";
+    license = licenses.ncsa;
+    maintainers = with maintainers; [ chvp ];
+  };
+}
diff --git a/pkgs/development/python-modules/skytemple-files/default.nix b/pkgs/development/python-modules/skytemple-files/default.nix
index f563097d98c..7893cfb2e81 100644
--- a/pkgs/development/python-modules/skytemple-files/default.nix
+++ b/pkgs/development/python-modules/skytemple-files/default.nix
@@ -4,13 +4,13 @@
 
 buildPythonPackage rec {
   pname = "skytemple-files";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
     owner = "SkyTemple";
     repo = pname;
     rev = version;
-    sha256 = "1g3d5p6ng4zl0ib7k4gj4zy7lp30d2il2k1m92pf5gghwfjwwfca";
+    sha256 = "01j6khn60mdmz32xkpqrzwdqibmpdpi2wvwzxgdnaim9sq0fdqws";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/skytemple-rust/default.nix b/pkgs/development/python-modules/skytemple-rust/default.nix
index d98d23fada6..793e22690e4 100644
--- a/pkgs/development/python-modules/skytemple-rust/default.nix
+++ b/pkgs/development/python-modules/skytemple-rust/default.nix
@@ -2,19 +2,19 @@
 
 buildPythonPackage rec {
   pname = "skytemple-rust";
-  version = "unstable-2021-05-30"; # Contains build bug fixes, but is otherwise identical to 0.0.1.post0
+  version = "unstable-2021-08-11";
 
   src = fetchFromGitHub {
     owner = "SkyTemple";
     repo = pname;
-    rev = "cff8b2930af6d25d41331fab8c04f56a4fd75e95";
-    sha256 = "18y6wwvzyw062zlv3gcirr1hgld9d97ffyrvy0jvw8nr3b9h9x0i";
+    rev = "e306e5edc096cb3fef25585d9ca5a2817543f1cd";
+    sha256 = "0ja231gsy9i1z6jsaywawz93rnyjhldngi5i787nhnf88zrwx9ml";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    sha256 = "1ypcsf9gbq1bz29kfn7g4kg8741mxg1lfcbb14a0vfhjq4d6pnx9";
+    sha256 = "0gjvfblyv72m0nqv90m7qvbdnazsh5ind1pxwqz83vm4zjh9a873";
   };
 
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
@@ -27,6 +27,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/SkyTemple/skytemple-rust";
     description = "Binary Rust extensions for SkyTemple";
     license = licenses.mit;
-    maintainers = with maintainers; [ xfix ];
+    maintainers = with maintainers; [ xfix marius851000 ];
   };
 }
diff --git a/pkgs/development/python-modules/translatepy/default.nix b/pkgs/development/python-modules/translatepy/default.nix
index b472042dd65..986a16db702 100644
--- a/pkgs/development/python-modules/translatepy/default.nix
+++ b/pkgs/development/python-modules/translatepy/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "translatepy";
-  version = "2.1";
+  version = "2.2";
 
   src = fetchFromGitHub {
     owner = "Animenosekai";
     repo = "translate";
     rev = "v${version}";
-    sha256 = "0xj97s6zglvq2894wpq3xbjxgfkrfk2414vmcszap8h9j2zxz8gf";
+    sha256 = "rnt4nmDgQXSgzwNCcsZwbQn2bv83DFhL86kebeiSosc=";
   };
 
   propagatedBuildInputs = [
@@ -29,6 +29,7 @@ buildPythonPackage rec {
   checkInputs = [ pytestCheckHook ];
   disabledTestPaths = [
     # Requires network connection
+    "tests/test_translate.py"
     "tests/test_translators.py"
   ];
   pythonImportsCheck = [ "translatepy" ];
diff --git a/pkgs/development/python-modules/xkbcommon/default.nix b/pkgs/development/python-modules/xkbcommon/default.nix
new file mode 100644
index 00000000000..580ad392190
--- /dev/null
+++ b/pkgs/development/python-modules/xkbcommon/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, python
+, cffi
+, pkg-config
+, libxkbcommon
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "xkbcommon";
+  version = "0.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "V5LMaX5TPhk9x4ZA4MGFzDhUiC6NKPo4uTbW6Q7mdVw=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  propagatedNativeBuildInputs = [ cffi ];
+  buildInputs = [ libxkbcommon ];
+  propagatedBuildInputs = [ cffi ];
+  checkInputs = [ pytestCheckHook ];
+
+  postBuild = ''
+    ${python.interpreter} xkbcommon/ffi_build.py
+  '';
+
+  pythonImportsCheck = [ "xkbcommon" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/sde1000/python-xkbcommon";
+    description = "Python bindings for libxkbcommon using cffi";
+    license = licenses.mit;
+    maintainers = with maintainers; [ chvp ];
+  };
+}
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 9426d6c8f48..f38575880f5 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -56,15 +56,13 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.0.549";
-
-  disabled = python3.pythonOlder "3.7";
+  version = "2.0.554";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    sha256 = "sha256-nxvUxjqzBUPbOkMhdQhkdlMRGFj6vhMU3BjXpSwBb8s=";
+    sha256 = "sha256-C1uTIngtuMs7TjjtAezPxtLkH5RhmCMoetbnp25BRbU=";
   };
 
   nativeBuildInputs = with py.pkgs; [
diff --git a/pkgs/development/tools/halfempty/default.nix b/pkgs/development/tools/halfempty/default.nix
index 5b96d338f52..35fdf7702a8 100644
--- a/pkgs/development/tools/halfempty/default.nix
+++ b/pkgs/development/tools/halfempty/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, glib, util-linux, scowl }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, pkg-config, glib, util-linux, scowl }:
 
 stdenv.mkDerivation rec {
   pname = "halfempty";
@@ -16,6 +16,14 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  patches = [
+    (fetchpatch {
+      name = "fix-bash-specific-syntax.patch";
+      url = "https://github.com/googleprojectzero/halfempty/commit/ad15964d0fcaba12e5aca65c8935ebe3f37d7ea3.patch";
+      sha256 = "sha256:0hgdci0wwi5wyw8i57w0545cxjmsmswm1y6g4vhykap0y40zizav";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace test/Makefile \
       --replace '/usr/share/dict/words' '${scowl}/share/dict/words.txt'
diff --git a/pkgs/development/tools/misc/clojure-lsp/default.nix b/pkgs/development/tools/misc/clojure-lsp/default.nix
index b84cb49eb51..9128b3f190e 100644
--- a/pkgs/development/tools/misc/clojure-lsp/default.nix
+++ b/pkgs/development/tools/misc/clojure-lsp/default.nix
@@ -89,5 +89,8 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     maintainers = with maintainers; [ ericdallo babariviere ];
     platforms = graalvm11-ce.meta.platforms;
+    # Depends on datalevin that is x86_64 only
+    # https://github.com/juji-io/datalevin/blob/bb7d9328f4739cddea5d272b5cd6d6dcb5345da6/native/src/java/datalevin/ni/Lib.java#L86-L102
+    broken = !stdenv.isx86_64;
   };
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-beancount.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-beancount.json
index 77742ce40e9..efd10efd90f 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-beancount.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-beancount.json
@@ -4,6 +4,7 @@
   "date": "2021-09-07T00:09:23-04:00",
   "path": "/nix/store/adv2yl8kr4pk6430iclkppirhb5ibcqc-tree-sitter-beancount",
   "sha256": "1g2p2dnxm50l7npg2cbycwcfz9c9682bj02nrlycyjhwl4may9dn",
+  "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "leaveDotGit": false
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-c-sharp.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-c-sharp.json
index 9c5e3744605..ad7e72f61d1 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-c-sharp.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-c-sharp.json
@@ -1,9 +1,9 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-c-sharp",
-  "rev": "1b01d838cc2c0435eef59bc4ee9d0c77eea458d0",
-  "date": "2021-10-07T21:04:41+01:00",
-  "path": "/nix/store/ghx94r76acsnz4q11nhvfwf4pmslpwz8-tree-sitter-c-sharp",
-  "sha256": "03in0smvj6f12mmc744nk772myhrd5qjswfad1vvmmhd50y35ygx",
+  "rev": "69921685a7688361626600543a2beaf82b67a64d",
+  "date": "2021-11-03T12:36:17+00:00",
+  "path": "/nix/store/f4rd6avwf2flqr9yv0dvy9288qrgn2bs-tree-sitter-c-sharp",
+  "sha256": "18yzr0yvkbp5wf2slcfn04fc23jn0ray72ica0jyv92jkp5pxc03",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cpp.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cpp.json
index 9802cd93e8a..32f4a9cd64f 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cpp.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cpp.json
@@ -1,9 +1,9 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-cpp",
-  "rev": "f44509141e7e483323d2ec178f2d2e6c0fc041c1",
-  "date": "2021-10-25T11:23:25-07:00",
-  "path": "/nix/store/v6034ry75lfdwsiqydff601zla6xb7a2-tree-sitter-cpp",
-  "sha256": "0hxcpdvyyig8njga1mxp4qcnbbnr1d0aiy27vahijwbh98b081nr",
+  "rev": "e8dcc9d2b404c542fd236ea5f7208f90be8a6e89",
+  "date": "2021-10-28T08:16:36-05:00",
+  "path": "/nix/store/d08ymiv4qjs9hnc8b0yw700da47879wb-tree-sitter-cpp",
+  "sha256": "1h0q4prr8yf714abz16i2ym41sskmilmga521sxv9d75kqhyb3wl",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-haskell.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-haskell.json
index 807c09a70fe..e6bc3a78422 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-haskell.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-haskell.json
@@ -1,9 +1,9 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-haskell",
-  "rev": "bf7d643b494b7c7eed909ed7fbd8447231152cb0",
-  "date": "2021-09-09T20:07:38+02:00",
-  "path": "/nix/store/nkx9qf63nwl1ql6gl3q1fm4ykqax1isx-tree-sitter-haskell",
-  "sha256": "1wlp6kncjadhfz8y2wn90gkbqf35iidrn0y1ga360l5wyzx1mpid",
+  "rev": "6668085e7d3dc6205a3ef27e6293988cf4a10419",
+  "date": "2021-11-08T00:39:03+01:00",
+  "path": "/nix/store/srhxv4hmg6if8diww64fi9spaanfkpy2-tree-sitter-haskell",
+  "sha256": "0bw0hszac5krw52ywzdvgb9jm2s8669ym7sb6vivxihr46inwkr2",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg.json
index 04050591808..dbf88190fb3 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg.json
@@ -1,9 +1,9 @@
 {
   "url": "https://github.com/nvim-neorg/tree-sitter-norg",
-  "rev": "ff9ba2caf2c600f327370d516464d3222b9aa1f0",
-  "date": "2021-10-14T12:18:22+02:00",
-  "path": "/nix/store/4142dr4yy1jnbs7lf5kqmsn0rwyr1q7y-tree-sitter-norg",
-  "sha256": "0n74ad636p8q046sw94jxmfd640vabnzqzqjbqypyfw4fx95zwkj",
+  "rev": "995d7e0be4dc2a9655d2285405c0ef3fededf63c",
+  "date": "2021-11-05T21:28:42+01:00",
+  "path": "/nix/store/1l5dq21x6sln1gvixf20gx3pkadjad4d-tree-sitter-norg",
+  "sha256": "181y8p91hl5j7mrff0pmnx91d9vr24nvklgx12qvc0297vdp8c5v",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rst.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rst.json
index 4d3596b7c39..23506e55ede 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rst.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rst.json
@@ -1,9 +1,9 @@
 {
   "url": "https://github.com/stsewd/tree-sitter-rst",
-  "rev": "632596b1fe5816315cafa90cdf8f8000e30c93e4",
-  "date": "2021-10-01T17:00:56-05:00",
-  "path": "/nix/store/pnbw1j9ynj4zgjqxjnhq9hgqp3nxm77j-tree-sitter-rst",
-  "sha256": "1l831aw4a080qin7dkq04b28nnyxs1r8zqrbp92d7j4y2lz31dla",
+  "rev": "a5514617ae3644effa80d4696be428e4a371c01a",
+  "date": "2021-11-05T20:58:51-05:00",
+  "path": "/nix/store/is0j0cpd3i7q7liqlcrfdflabmm9rnlg-tree-sitter-rst",
+  "sha256": "1bw0yry968qz4arzckxpyz5zkw6ajyirrxyf78m9lr1zmz1vnivy",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-svelte.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-svelte.json
index d3ea25aad8f..0052b3f8e71 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-svelte.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-svelte.json
@@ -1,9 +1,9 @@
 {
   "url": "https://github.com/Himujjal/tree-sitter-svelte",
-  "rev": "c696a13a587b0595baf7998f1fb9e95c42750263",
-  "date": "2021-03-20T16:45:11+05:30",
-  "path": "/nix/store/8krdxqwpi95ljrb5jgalwgygz3aljqr8-tree-sitter-svelte",
-  "sha256": "0ckmss5gmvffm6danlsvgh6gwvrlznxsqf6i6ipkn7k5lxg1awg3",
+  "rev": "98274d94ec33e994e8354d9ddfdef58cca471294",
+  "date": "2021-10-28T16:53:33+05:30",
+  "path": "/nix/store/q3dapi6k6zdnnr0lki2ic9l6cbxdi2rq-tree-sitter-svelte",
+  "sha256": "1kav0h755sa1j9j930kjrykb17aih017mbi0a97ncjjrlc6nyak5",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typescript.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typescript.json
index 88ebe94afc1..68241bab540 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typescript.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typescript.json
@@ -1,9 +1,9 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-typescript",
-  "rev": "11f8f151327e99361c1ff6764599daeef8633615",
-  "date": "2021-10-21T09:23:26-07:00",
-  "path": "/nix/store/r7vpx7g7d1hdxzqyigmr3v9yp5cmmzsg-tree-sitter-typescript",
-  "sha256": "18gk00glysqapys883hq9v33ca9x6nzgy8lk26wa5pip3spzcsm0",
+  "rev": "cc745b774e3986aa3a7dfd6b7a0fc01ddc853bf8",
+  "date": "2021-10-29T14:55:07-07:00",
+  "path": "/nix/store/c0a2j72pfsb7zw44jqlk73vrhvkzk2db-tree-sitter-typescript",
+  "sha256": "0nc8wr04h0wz169p60x4zai37yd351qj9mim7099g1fmbd1w7hq9",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/shellharden/default.nix b/pkgs/development/tools/shellharden/default.nix
index 09c77f087d2..d444a3685c5 100644
--- a/pkgs/development/tools/shellharden/default.nix
+++ b/pkgs/development/tools/shellharden/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "shellharden";
-  version = "4.1.2";
+  version = "4.1.3";
 
   src = fetchFromGitHub {
     owner = "anordal";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1003kgnql0z158d3rzz8s3i7s7rx9hjqqvp3li8xhzrgszvkgqk4";
+    sha256 = "04pgmkaqjb1lmlwjjipcrqh9qcyjjkr39vi3h5fl9sr71c8g7dnd";
   };
 
-  cargoSha256 = "1h4wp9xs9nq90ml2km9gd0afrzri6fbgskz6d15jqykm2fw72l88";
+  cargoSha256 = "0bjqgw49msl288yfa7bl31bfa9kdy4zh1q3j0lyw4vvkv2r14pf5";
 
   postPatch = "patchShebangs moduletests/run";
 
diff --git a/pkgs/development/tools/stylua/default.nix b/pkgs/development/tools/stylua/default.nix
index 1dcb3240128..229cc9dd4d8 100644
--- a/pkgs/development/tools/stylua/default.nix
+++ b/pkgs/development/tools/stylua/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "stylua";
-  version = "0.11.0";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "johnnymorganz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-mHmLwgAyLEWfhSVy7WmJN1Z5BdA+3hoHujbKn2Q9fxI=";
+    sha256 = "sha256-+5c8baeToaT4k/2VSK/XQki0NPsWTnS6Ap3NpWvj+yI=";
   };
 
-  cargoSha256 = "sha256-1aze1U6NrL8KPK5v5NYCdyTTqoczkg32xR5V0jApQWw=";
+  cargoSha256 = "sha256-uIcP5ZNb8K5pySw0Qq46hev9VUbq8XVqmzBBGPagUfE=";
 
   cargoBuildFlags = lib.optionals lua52Support [ "--features" "lua52" ]
     ++ lib.optionals luauSupport [ "--features" "luau" ];
diff --git a/pkgs/games/ddnet/default.nix b/pkgs/games/ddnet/default.nix
index 51a242a6cfd..c639f31ae64 100644
--- a/pkgs/games/ddnet/default.nix
+++ b/pkgs/games/ddnet/default.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ddnet";
-  version = "15.5.4";
+  version = "15.6.2";
 
   src = fetchFromGitHub {
     owner = "ddnet";
     repo = pname;
     rev = version;
-    sha256 = "sha256-vJMYPaLK2CK+nbojLstXgxqIUaf7jNynpklFgtIpvGM=";
+    sha256 = "sha256-nWouBe1qptDHedrSw5KDuGYyT7Bvf3cfwMynAfQALVY=";
   };
 
   nativeBuildInputs = [ cmake ninja pkg-config ];
diff --git a/pkgs/misc/emulators/cdemu/vhba.nix b/pkgs/misc/emulators/cdemu/vhba.nix
index 1a4357b543b..6e7cb08e449 100644
--- a/pkgs/misc/emulators/cdemu/vhba.nix
+++ b/pkgs/misc/emulators/cdemu/vhba.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "vhba";
-  version = "20210418";
+  version = "20211023";
 
   src  = fetchurl {
     url = "mirror://sourceforge/cdemu/vhba-module-${version}.tar.xz";
-    sha256 = "119zgav6caialmf3hr096wkf72l9h76sqc9w5dhx26kj4yp85g8q";
+    sha256 = "sha256-YAh7qqkozvoG1WhHBv7z1IcSrP75LLMq/FB6sZrevxA=";
   };
 
   makeFlags = [ "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" "INSTALL_MOD_PATH=$(out)" ];
diff --git a/pkgs/os-specific/darwin/rewrite-tbd/default.nix b/pkgs/os-specific/darwin/rewrite-tbd/default.nix
index f41b81b3bc9..e5ef118e514 100644
--- a/pkgs/os-specific/darwin/rewrite-tbd/default.nix
+++ b/pkgs/os-specific/darwin/rewrite-tbd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, pkg-config, libyaml }:
+{ stdenv, lib, fetchFromGitHub, cmake, pkg-config, libyaml }:
 
 stdenv.mkDerivation {
   pname = "rewrite-tbd";
@@ -13,4 +13,11 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ libyaml ];
+
+  meta = with lib; {
+    homepage = "https://github.com/thefloweringash/rewrite-tbd/";
+    description = "Rewrite filepath in .tbd to Nix applicable format";
+    platforms = platforms.darwin;
+    license = licenses.mit;
+  };
 }
diff --git a/pkgs/os-specific/linux/nftables/default.nix b/pkgs/os-specific/linux/nftables/default.nix
index 73adcd78605..ebca6b2623c 100644
--- a/pkgs/os-specific/linux/nftables/default.nix
+++ b/pkgs/os-specific/linux/nftables/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "The project that aims to replace the existing {ip,ip6,arp,eb}tables framework";
     homepage = "https://netfilter.org/projects/nftables/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = platforms.linux;
     maintainers = with maintainers; [ izorkin ];
   };
diff --git a/pkgs/servers/klipper/default.nix b/pkgs/servers/klipper/default.nix
index 75d08caf3a2..051497f863c 100644
--- a/pkgs/servers/klipper/default.nix
+++ b/pkgs/servers/klipper/default.nix
@@ -15,12 +15,6 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-vUhP71vZ5XFG7MDkPFpAcCUL4kIdzHJ1hAkwqIi6ksQ=";
   };
 
-  # We have no LTO on i686 since commit 22284b0
-  postPatch = lib.optionalString stdenv.isi686 ''
-    substituteInPlace chelper/__init__.py \
-      --replace "-flto -fwhole-program " ""
-  '';
-
   sourceRoot = "source/klippy";
 
   # there is currently an attempt at moving it to Python 3, but it will remain
diff --git a/pkgs/servers/monitoring/loki/default.nix b/pkgs/servers/monitoring/loki/default.nix
index 62cd19a89c2..96879c3408b 100644
--- a/pkgs/servers/monitoring/loki/default.nix
+++ b/pkgs/servers/monitoring/loki/default.nix
@@ -8,14 +8,14 @@
 }:
 
 buildGoModule rec {
-  version = "2.4.0";
+  version = "2.4.1";
   pname = "grafana-loki";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "grafana";
     repo = "loki";
-    sha256 = "sha256-5A2DzFYLkPnBHqgMUDog0IgbdAx+U1U5npzuqJGbEHQ=";
+    sha256 = "sha256-QLHhGAeTtXe/76uMombWBORXGvfaUQMGCgkeGCnI0Ag=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/servers/monitoring/mackerel-agent/default.nix b/pkgs/servers/monitoring/mackerel-agent/default.nix
index a4d82ef8406..13036f81de6 100644
--- a/pkgs/servers/monitoring/mackerel-agent/default.nix
+++ b/pkgs/servers/monitoring/mackerel-agent/default.nix
@@ -2,20 +2,20 @@
 
 buildGoModule rec {
   pname = "mackerel-agent";
-  version = "0.72.2";
+  version = "0.72.3";
 
   src = fetchFromGitHub {
     owner = "mackerelio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-oiY3L4aBF+QhpZDTkwTmWPLoTgm+RUYCov5+gOxJqew=";
+    sha256 = "sha256-o2+5kMHDigrLXjwdkMKSujW/Lov72WmRvw7/aew3s9w=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
   checkInputs = lib.optionals (!stdenv.isDarwin) [ nettools ];
   buildInputs = lib.optionals (!stdenv.isDarwin) [ iproute2 ];
 
-  vendorSha256 = "sha256-dfBJXA1Lc4+TL1nIk4bZ4m4QEO1r29GPyGtZrE+LrZc=";
+  vendorSha256 = "sha256-h2z+R16XS3AJdG/4gZRLton1DKYrFElGXNjOaekAC0Q=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 0d6e5d9afe7..fafd5581e5a 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -3,7 +3,7 @@ let
   generic =
       # dependencies
       { stdenv, lib, fetchurl, makeWrapper
-      , glibc, zlib, readline, openssl, icu, systemd, libossp_uuid
+      , glibc, zlib, readline, openssl, icu, lz4, systemd, libossp_uuid
       , pkg-config, libxml2, tzdata
 
       # This is important to obtain a version of `libpq` that does not depend on systemd.
@@ -23,6 +23,7 @@ let
   let
     atLeast = lib.versionAtLeast version;
     icuEnabled = atLeast "10";
+    lz4Enabled = atLeast "14";
 
   in stdenv.mkDerivation rec {
     pname = "postgresql";
@@ -41,6 +42,7 @@ let
     buildInputs =
       [ zlib readline openssl libxml2 ]
       ++ lib.optionals icuEnabled [ icu ]
+      ++ lib.optionals lz4Enabled [ lz4 ]
       ++ lib.optionals enableSystemd [ systemd ]
       ++ lib.optionals gssSupport [ libkrb5 ]
       ++ lib.optionals (!stdenv.isDarwin) [ libossp_uuid ];
@@ -68,6 +70,7 @@ let
       (lib.optionalString enableSystemd "--with-systemd")
       (if stdenv.isDarwin then "--with-uuid=e2fs" else "--with-ossp-uuid")
     ] ++ lib.optionals icuEnabled [ "--with-icu" ]
+      ++ lib.optionals lz4Enabled [ "--with-lz4" ]
       ++ lib.optionals gssSupport [ "--with-gssapi" ];
 
     patches =
@@ -159,7 +162,7 @@ let
       homepage    = "https://www.postgresql.org";
       description = "A powerful, open source object-relational database system";
       license     = licenses.postgresql;
-      maintainers = with maintainers; [ thoughtpolice danbst globin marsam ];
+      maintainers = with maintainers; [ thoughtpolice danbst globin marsam ivan ];
       platforms   = platforms.unix;
       knownVulnerabilities = optional (!atLeast "9.4")
         "PostgreSQL versions older than 9.4 are not maintained anymore!";
diff --git a/pkgs/tools/admin/synapse-admin/default.nix b/pkgs/tools/admin/synapse-admin/default.nix
new file mode 100644
index 00000000000..8ca0816f9e4
--- /dev/null
+++ b/pkgs/tools/admin/synapse-admin/default.nix
@@ -0,0 +1,26 @@
+{ lib
+, stdenv
+, fetchzip
+}:
+
+stdenv.mkDerivation rec {
+  pname = "synapse-admin";
+  version = "0.8.3";
+
+  src = fetchzip {
+    url = "https://github.com/Awesome-Technologies/synapse-admin/releases/download/${version}/synapse-admin-${version}.tar.gz";
+    hash = "sha256-LAdMxzUffnykiDHvQYu9uNxK4428Q9CxQY2q02AcUco=";
+  };
+
+  installPhase = ''
+    cp -r . $out
+  '';
+
+  meta = with lib; {
+    description = "Admin UI for Synapse Homeservers";
+    homepage = "https://github.com/Awesome-Technologies/synapse-admin";
+    license = licenses.apsl20;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ mkg20001 ];
+  };
+}
diff --git a/pkgs/tools/compression/flips/default.nix b/pkgs/tools/compression/flips/default.nix
index b4a79aac212..024ff5fbe9f 100644
--- a/pkgs/tools/compression/flips/default.nix
+++ b/pkgs/tools/compression/flips/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "flips";
-  version = "unstable-2021-05-18";
+  version = "unstable-2021-10-28";
 
   src = fetchFromGitHub {
     owner = "Alcaro";
     repo = "Flips";
-    rev = "3476e5e46fc6f10df475f0cad1714358ba04c756";
-    sha256 = "0s13qrmqfmlb2vy0smpgw39vjkl8vzsmpzk52jnc9r7b4hisii39";
+    rev = "3a8733e74c9bdbb6b89da2b45913a0be3d0e1866";
+    sha256 = "1jik580mz2spik5mgh60h93ryaj5x8dffncnr1lwija0v803xld7";
   };
 
   nativeBuildInputs = [ pkg-config wrapGAppsHook ];
diff --git a/pkgs/tools/misc/timidity/default.nix b/pkgs/tools/misc/timidity/default.nix
index 368efcf9de3..42d6d5da4e0 100644
--- a/pkgs/tools/misc/timidity/default.nix
+++ b/pkgs/tools/misc/timidity/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, alsa-lib, libjack2, ncurses, pkg-config }:
+{ lib, stdenv, fetchurl, alsa-lib, libjack2, CoreAudio, ncurses, pkg-config }:
 
 stdenv.mkDerivation rec {
   pname = "timidity";
@@ -12,9 +12,24 @@ stdenv.mkDerivation rec {
   patches = [ ./timidity-iA-Oj.patch ];
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ alsa-lib libjack2 ncurses ];
-
-  configureFlags = [ "--enable-audio=oss,alsa,jack" "--enable-alsaseq" "--with-default-output=alsa" "--enable-ncurses" ];
+  buildInputs = [
+    libjack2
+    ncurses
+  ] ++ lib.optionals stdenv.isLinux [
+    alsa-lib
+  ] ++ lib.optionals stdenv.isDarwin [
+    CoreAudio
+  ];
+
+  configureFlags = [
+    "--enable-ncurses"
+  ] ++ lib.optionals stdenv.isLinux [
+    "--enable-audio=oss,alsa,jack"
+    "--enable-alsaseq"
+    "--with-default-output=alsa"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "--enable-audio=darwin,jack"
+  ];
 
   NIX_LDFLAGS = "-ljack -L${libjack2}/lib";
 
@@ -29,12 +44,14 @@ stdenv.mkDerivation rec {
     cp ${./timidity.cfg} $out/share/timidity/timidity.cfg
     tar --strip-components=1 -xf $instruments -C $out/share/timidity/
   '';
+  # This fixup step is unnecessary and fails on Darwin
+  dontRewriteSymlinks = stdenv.isDarwin;
 
   meta = with lib; {
     homepage = "https://sourceforge.net/projects/timidity/";
     license = licenses.gpl2;
     description = "A software MIDI renderer";
     maintainers = [ maintainers.marcweber ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/nix/nixos-generators/default.nix b/pkgs/tools/nix/nixos-generators/default.nix
index 01e12e9fd58..e20f36b1ef9 100644
--- a/pkgs/tools/nix/nixos-generators/default.nix
+++ b/pkgs/tools/nix/nixos-generators/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "nixos-generators";
-  version = "1.4.0";
+  version = "1.5.0";
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "nixos-generators";
     rev = version;
-    sha256 = "1kn2anp8abpi0n3p7j0yczbpy7mdhk8rv84ywyghqdvf2wjmnlnp";
+    sha256 = "sha256-Icz/2Jl3eO4JnatU1iAFiMzVAQR9IDrsiqhOIvMkCS4=";
   };
   nativeBuildInputs = [ makeWrapper ];
   installFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/tools/system/efibootmgr/default.nix b/pkgs/tools/system/efibootmgr/default.nix
index 0c678dd9c51..fd7eceede15 100644
--- a/pkgs/tools/system/efibootmgr/default.nix
+++ b/pkgs/tools/system/efibootmgr/default.nix
@@ -22,8 +22,6 @@ stdenv.mkDerivation rec {
       sha256 = "1sbijvlpv4khkix3vix9mbhzffj8lp8zpnbxm9gnzjz8yssz9p5h";
     })
   ];
-  # We have no LTO here since commit 22284b07.
-  postPatch = if stdenv.isi686 then "sed '/^CFLAGS/s/-flto//' -i Make.defaults" else null;
 
   makeFlags = [ "EFIDIR=nixos" "PKG_CONFIG=${stdenv.cc.targetPrefix}pkg-config" ];
 
diff --git a/pkgs/tools/system/efivar/default.nix b/pkgs/tools/system/efivar/default.nix
index c92b28e7f5e..ed831c5ecf6 100644
--- a/pkgs/tools/system/efivar/default.nix
+++ b/pkgs/tools/system/efivar/default.nix
@@ -39,9 +39,11 @@ stdenv.mkDerivation rec {
       sha256 = "1ajj11wwsvamfspq4naanvw08h63gr0g71q0dfbrrywrhc0jlmdw";
     })
   ];
-  # We have no LTO here since commit 22284b07.  With GCC 10 that triggers a warning.
-  postPatch = "sed '/^OPTIMIZE /s/-flto//' -i Make.defaults";
-  NIX_CFLAGS_COMPILE = "-Wno-error=stringop-truncation";
+
+  NIX_CFLAGS_COMPILE = [
+    "-Wno-error=stringop-truncation"
+    "-flto-partition=none"
+  ];
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ popt ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 468f7b8fabf..d82ce24b087 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5681,7 +5681,9 @@ with pkgs;
 
   gitleaks = callPackage ../tools/security/gitleaks { };
 
-  gitaly = callPackage ../applications/version-management/gitlab/gitaly { };
+  gitaly = callPackage ../applications/version-management/gitlab/gitaly {
+    libgit2 = libgit2_1_1; # git2go only supports v1.1.x
+  };
 
   gitstats = callPackage ../applications/version-management/gitstats { };
 
@@ -9553,6 +9555,8 @@ with pkgs;
 
   syntex = callPackage ../tools/graphics/syntex {};
 
+  synapse-admin = callPackage ../tools/admin/synapse-admin {};
+
   sl = callPackage ../tools/misc/sl { stdenv = gccStdenv; };
 
   socat = callPackage ../tools/networking/socat { };
@@ -11711,8 +11715,6 @@ with pkgs;
     reproducibleBuild = true;
     profiledCompiler = false;
 
-    enableLTO = !stdenv.isi686;
-
     libcCross = if stdenv.targetPlatform != stdenv.buildPlatform then libcCross else null;
     threadsCross = if stdenv.targetPlatform != stdenv.buildPlatform then threadsCross else null;
 
@@ -11725,8 +11727,6 @@ with pkgs;
     reproducibleBuild = true;
     profiledCompiler = false;
 
-    enableLTO = !stdenv.isi686;
-
     libcCross = if stdenv.targetPlatform != stdenv.buildPlatform then libcCross else null;
     threadsCross = if stdenv.targetPlatform != stdenv.buildPlatform then threadsCross else null;
 
@@ -11739,8 +11739,6 @@ with pkgs;
     reproducibleBuild = true;
     profiledCompiler = false;
 
-    enableLTO = !stdenv.isi686;
-
     libcCross = if stdenv.targetPlatform != stdenv.buildPlatform then libcCross else null;
     threadsCross = if stdenv.targetPlatform != stdenv.buildPlatform then threadsCross else null;
 
@@ -15309,7 +15307,9 @@ with pkgs;
 
   ttyd = callPackage ../servers/ttyd { };
 
-  turbogit = callPackage ../development/tools/turbogit { };
+  turbogit = callPackage ../development/tools/turbogit {
+    libgit2 = libgit2_1_1; # git2go only supports v1.1.x
+  };
 
   tweak = callPackage ../applications/editors/tweak { };
 
@@ -16298,6 +16298,16 @@ with pkgs;
     ];
   });
 
+  libgit2_1_1 = libgit2.overrideAttrs (oldAttrs: rec {
+    version = "1.1.1";
+    src = fetchFromGitHub {
+      owner = "libgit2";
+      repo = "libgit2";
+      rev = "v${version}";
+      sha256 = "sha256-SxceIxT0aeiiiZCeSIe6EOa+MyVpQVaiv/ZZn6fkwIc=";
+    };
+  });
+
   libgit2-glib = callPackage ../development/libraries/libgit2-glib { };
 
   libhsts = callPackage ../development/libraries/libhsts { };
@@ -21178,6 +21188,7 @@ with pkgs;
   postgresql11Packages = recurseIntoAttrs postgresql_11.pkgs;
   postgresql12Packages = recurseIntoAttrs postgresql_12.pkgs;
   postgresql13Packages = pkgs.postgresqlPackages;
+  postgresql14Packages = recurseIntoAttrs postgresql_14.pkgs;
 
   postgresql_jdbc = callPackage ../development/java-modules/postgresql_jdbc { };
 
@@ -25635,6 +25646,8 @@ with pkgs;
     withPortAudio = stdenv.isDarwin;
   };
 
+  srain = callPackage ../applications/networking/irc/srain { };
+
   super-productivity = callPackage ../applications/office/super-productivity { };
 
   wlroots = callPackage ../development/libraries/wlroots {
@@ -28168,7 +28181,6 @@ with pkgs;
   };
 
   synergy = libsForQt5.callPackage ../applications/misc/synergy {
-    stdenv = if stdenv.cc.isClang then llvmPackages_5.stdenv else stdenv;
     inherit (darwin.apple_sdk.frameworks) ApplicationServices Carbon Cocoa CoreServices ScreenSaver;
   };
 
@@ -28333,7 +28345,9 @@ with pkgs;
 
   timg = callPackage ../tools/graphics/timg { };
 
-  timidity = callPackage ../tools/misc/timidity { };
+  timidity = callPackage ../tools/misc/timidity {
+    inherit (darwin.apple_sdk.frameworks) CoreAudio;
+  };
 
   tint2 = callPackage ../applications/misc/tint2 { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ff504978471..8963ba71a9a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6419,7 +6419,7 @@ in {
   pygal = callPackage ../development/python-modules/pygal { };
 
   pygame = callPackage ../development/python-modules/pygame {
-    inherit (pkgs.darwin.apple_sdk.frameworks) AppKit CoreMIDI;
+    inherit (pkgs.darwin.apple_sdk.frameworks) AppKit;
   };
 
   pygame_sdl2 = callPackage ../development/python-modules/pygame_sdl2 { };
@@ -7820,6 +7820,8 @@ in {
 
   pywavelets = callPackage ../development/python-modules/pywavelets { };
 
+  pywayland = callPackage ../development/python-modules/pywayland { };
+
   pywbem = callPackage ../development/python-modules/pywbem {
     inherit (pkgs) libxml2;
   };
@@ -7838,6 +7840,8 @@ in {
 
   pywizlight = callPackage ../development/python-modules/pywizlight { };
 
+  pywlroots = callPackage ../development/python-modules/pywlroots { };
+
   pyxattr = callPackage ../development/python-modules/pyxattr { };
 
   pyworld = callPackage ../development/python-modules/pyworld { };
@@ -9960,6 +9964,8 @@ in {
 
   xhtml2pdf = callPackage ../development/python-modules/xhtml2pdf { };
 
+  xkbcommon = callPackage ../development/python-modules/xkbcommon { };
+
   xkcdpass = callPackage ../development/python-modules/xkcdpass { };
 
   xknx = callPackage ../development/python-modules/xknx { };