Merge staging-next into staging

28 files changed, 567 insertions, 86 deletions

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index af10c89f78a..a6f68d8d3c0 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -6286,6 +6286,12 @@
     githubId = 11810057;
     name = "Matt Snider";
   };
+  mattchrist = {
+    email = "nixpkgs-matt@christ.systems";
+    github = "mattchrist";
+    githubId = 952712;
+    name = "Matt Christ";
+  };
   matthewbauer = {
     email = "mjbauer95@gmail.com";
     github = "matthewbauer";
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index c45f3268b97..75405b17444 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -398,6 +398,7 @@
   ./services/hardware/ratbagd.nix
   ./services/hardware/sane.nix
   ./services/hardware/sane_extra_backends/brscan4.nix
+  ./services/hardware/sane_extra_backends/brscan5.nix
   ./services/hardware/sane_extra_backends/dsseries.nix
   ./services/hardware/spacenavd.nix
   ./services/hardware/tcsd.nix
diff --git a/nixos/modules/services/hardware/sane_extra_backends/brscan5.nix b/nixos/modules/services/hardware/sane_extra_backends/brscan5.nix
new file mode 100644
index 00000000000..89b5ff0e028
--- /dev/null
+++ b/nixos/modules/services/hardware/sane_extra_backends/brscan5.nix
@@ -0,0 +1,110 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.hardware.sane.brscan5;
+
+  netDeviceList = attrValues cfg.netDevices;
+
+  etcFiles = pkgs.callPackage ./brscan5_etc_files.nix { netDevices = netDeviceList; };
+
+  netDeviceOpts = { name, ... }: {
+
+    options = {
+
+      name = mkOption {
+        type = types.str;
+        description = ''
+          The friendly name you give to the network device. If undefined,
+          the name of attribute will be used.
+        '';
+
+        example = literalExample "office1";
+      };
+
+      model = mkOption {
+        type = types.str;
+        description = ''
+          The model of the network device.
+        '';
+
+        example = literalExample "ADS-1200";
+      };
+
+      ip = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        description = ''
+          The ip address of the device. If undefined, you will have to
+          provide a nodename.
+        '';
+
+        example = literalExample "192.168.1.2";
+      };
+
+      nodename = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        description = ''
+          The node name of the device. If undefined, you will have to
+          provide an ip.
+        '';
+
+        example = literalExample "BRW0080927AFBCE";
+      };
+
+    };
+
+
+    config =
+      { name = mkDefault name;
+      };
+  };
+
+in
+
+{
+  options = {
+
+    hardware.sane.brscan5.enable =
+      mkEnableOption "the Brother brscan5 sane backend";
+
+    hardware.sane.brscan5.netDevices = mkOption {
+      default = {};
+      example =
+        { office1 = { model = "MFC-7860DW"; ip = "192.168.1.2"; };
+          office2 = { model = "MFC-7860DW"; nodename = "BRW0080927AFBCE"; };
+        };
+      type = with types; attrsOf (submodule netDeviceOpts);
+      description = ''
+        The list of network devices that will be registered against the brscan5
+        sane backend.
+      '';
+    };
+  };
+
+  config = mkIf (config.hardware.sane.enable && cfg.enable) {
+
+    hardware.sane.extraBackends = [
+      pkgs.brscan5
+    ];
+
+    environment.etc."opt/brother/scanner/brscan5" =
+      { source = "${etcFiles}/etc/opt/brother/scanner/brscan5"; };
+    environment.etc."opt/brother/scanner/models" =
+      { source = "${etcFiles}/etc/opt/brother/scanner/brscan5/models"; };
+    environment.etc."sane.d/dll.d/brother5.conf".source = "${pkgs.brscan5}/etc/sane.d/dll.d/brother.conf";
+
+    assertions = [
+      { assertion = all (x: !(null != x.ip && null != x.nodename)) netDeviceList;
+        message = ''
+          When describing a network device as part of the attribute list
+          `hardware.sane.brscan5.netDevices`, only one of its `ip` or `nodename`
+          attribute should be specified, not both!
+        '';
+      }
+    ];
+
+  };
+}
diff --git a/nixos/modules/services/hardware/sane_extra_backends/brscan5_etc_files.nix b/nixos/modules/services/hardware/sane_extra_backends/brscan5_etc_files.nix
new file mode 100644
index 00000000000..432f0316a4f
--- /dev/null
+++ b/nixos/modules/services/hardware/sane_extra_backends/brscan5_etc_files.nix
@@ -0,0 +1,77 @@
+{ stdenv, lib, brscan5, netDevices ? [] }:
+
+/*
+
+Testing
+-------
+From nixpkgs repo
+
+No net devices:
+
+~~~
+nix-build -E 'let pkgs = import ./. {};
+                  brscan5-etc-files = pkgs.callPackage (import ./nixos/modules/services/hardware/sane_extra_backends/brscan5_etc_files.nix) {};
+              in brscan5-etc-files'
+~~~
+
+Two net devices:
+
+~~~
+nix-build -E 'let pkgs = import ./. {};
+                  brscan5-etc-files = pkgs.callPackage (import ./nixos/modules/services/hardware/sane_extra_backends/brscan5_etc_files.nix) {};
+              in brscan5-etc-files.override {
+                   netDevices = [
+                     {name="a"; model="ADS-1200"; nodename="BRW0080927AFBCE";}
+                     {name="b"; model="ADS-1200"; ip="192.168.1.2";}
+                   ];
+              }'
+~~~
+
+*/
+
+let
+
+  addNetDev = nd: ''
+    brsaneconfig5 -a \
+    name="${nd.name}" \
+    model="${nd.model}" \
+    ${if (lib.hasAttr "nodename" nd && nd.nodename != null) then
+      ''nodename="${nd.nodename}"'' else
+      ''ip="${nd.ip}"''}'';
+  addAllNetDev = xs: lib.concatStringsSep "\n" (map addNetDev xs);
+in
+
+stdenv.mkDerivation {
+
+  name = "brscan5-etc-files";
+  version = "1.2.6-0";
+  src = "${brscan5}/opt/brother/scanner/brscan5";
+
+  nativeBuildInputs = [ brscan5 ];
+
+  dontConfigure = true;
+
+  buildPhase = ''
+    TARGET_DIR="$out/etc/opt/brother/scanner/brscan5"
+    mkdir -p "$TARGET_DIR"
+    cp -rp "./models" "$TARGET_DIR"
+    cp -rp "./brscan5.ini" "$TARGET_DIR"
+    cp -rp "./brsanenetdevice.cfg" "$TARGET_DIR"
+
+    export NIX_REDIRECTS="/etc/opt/brother/scanner/brscan5/=$TARGET_DIR/"
+
+    printf '${addAllNetDev netDevices}\n'
+
+    ${addAllNetDev netDevices}
+  '';
+
+  dontInstall = true;
+
+  meta = with lib; {
+    description = "Brother brscan5 sane backend driver etc files";
+    homepage = "https://www.brother.com";
+    platforms = platforms.linux;
+    license = licenses.unfree;
+    maintainers = with maintainers; [ mattchrist ];
+  };
+}
diff --git a/nixos/modules/virtualisation/podman-network-socket-ghostunnel.nix b/nixos/modules/virtualisation/podman-network-socket-ghostunnel.nix
index 1f1ada7f089..a0e7e433164 100644
--- a/nixos/modules/virtualisation/podman-network-socket-ghostunnel.nix
+++ b/nixos/modules/virtualisation/podman-network-socket-ghostunnel.nix
@@ -15,9 +15,9 @@ in
     };
   };
 
-  config = {
+  config = lib.mkIf (cfg.enable && cfg.server == "ghostunnel") {
 
-    services.ghostunnel = lib.mkIf (cfg.enable && cfg.server == "ghostunnel") {
+    services.ghostunnel = {
       enable = true;
       servers."podman-socket" = {
         inherit (cfg.tls) cert key cacert;
diff --git a/nixos/tests/brscan5.nix b/nixos/tests/brscan5.nix
new file mode 100644
index 00000000000..715191b383c
--- /dev/null
+++ b/nixos/tests/brscan5.nix
@@ -0,0 +1,42 @@
+# integration tests for brscan5 sane driver
+#
+
+import ./make-test-python.nix ({ pkgs, ...} : {
+  name = "brscan5";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ mattchrist ];
+  };
+
+  machine = { pkgs, ... }:
+    {
+      nixpkgs.config.allowUnfree = true;
+      hardware.sane = {
+        enable = true;
+        brscan5 = {
+          enable = true;
+          netDevices = {
+            "a" = { model="ADS-1200"; nodename="BRW0080927AFBCE"; };
+            "b" = { model="ADS-1200"; ip="192.168.1.2"; };
+          };
+        };
+      };
+    };
+
+  testScript = ''
+    # sane loads libsane-brother5.so.1 successfully, and scanimage doesn't die
+    strace = machine.succeed('strace scanimage -L 2>&1').split("\n")
+    regexp = 'openat\(.*libsane-brother5.so.1", O_RDONLY|O_CLOEXEC\) = \d\d*$'
+    assert len([x for x in strace if re.match(regexp,x)]) > 0
+
+    # module creates a config
+    cfg = machine.succeed('cat /etc/opt/brother/scanner/brscan5/brsanenetdevice.cfg')
+    assert 'DEVICE=a , "ADS-1200" , 0x4f9:0x459 , NODENAME=BRW0080927AFBCE' in cfg
+    assert 'DEVICE=b , "ADS-1200" , 0x4f9:0x459 , IP-ADDRESS=192.168.1.2' in cfg
+
+    # scanimage lists the two network scanners
+    scanimage = machine.succeed("scanimage -L")
+    print(scanimage)
+    assert """device `brother5:net1;dev0' is a Brother b ADS-1200""" in scanimage
+    assert """device `brother5:net1;dev1' is a Brother a ADS-1200""" in scanimage
+  '';
+})
diff --git a/pkgs/applications/graphics/sane/backends/brscan5/default.nix b/pkgs/applications/graphics/sane/backends/brscan5/default.nix
new file mode 100644
index 00000000000..e42c0980a1b
--- /dev/null
+++ b/pkgs/applications/graphics/sane/backends/brscan5/default.nix
@@ -0,0 +1,98 @@
+{ stdenv, lib, fetchurl, callPackage, patchelf, makeWrapper, coreutils, libusb1, avahi-compat, glib, libredirect }:
+let
+  myPatchElf = file: with lib; ''
+    patchelf --set-interpreter \
+      ${stdenv.glibc}/lib/ld-linux${optionalString stdenv.is64bit "-x86-64"}.so.2 \
+      ${file}
+  '';
+
+in
+stdenv.mkDerivation rec {
+  pname = "brscan5";
+  version = "1.2.6-0";
+  src = {
+    "i686-linux" = fetchurl {
+      url = "https://download.brother.com/welcome/dlf104034/${pname}-${version}.i386.deb";
+      sha256 = "102q745pc0168syggd4gym51qf3m3iqld3a4skfnbkm6yky4w4s8";
+    };
+    "x86_64-linux" = fetchurl {
+      url = "https://download.brother.com/welcome/dlf104033/${pname}-${version}.amd64.deb";
+      sha256 = "1pwbzhpg5nzpw2rw936vf2cr334v8iny16y8fbb1zimgzmv427wx";
+    };
+  }."${stdenv.hostPlatform.system}";
+
+  unpackPhase = ''
+    ar x $src
+    tar xfv data.tar.xz
+  '';
+
+  nativeBuildInputs = [ makeWrapper patchelf coreutils ];
+  buildInputs = [ libusb1 avahi-compat stdenv.cc.cc glib ];
+  dontBuild = true;
+
+  postPatch = ''
+    ${myPatchElf "opt/brother/scanner/brscan5/brsaneconfig5"}
+    ${myPatchElf "opt/brother/scanner/brscan5/brscan_cnetconfig"}
+    ${myPatchElf "opt/brother/scanner/brscan5/brscan_gnetconfig"}
+
+    for a in opt/brother/scanner/brscan5/*.so.* opt/brother/scanner/brscan5/brscan_[cg]netconfig; do
+      if ! test -L $a; then
+        patchelf --set-rpath ${lib.makeLibraryPath buildInputs} $a
+      fi
+    done
+
+    # driver is hardcoded to look in /opt/brother/scanner/brscan5/models for model metadata.
+    # patch it to look in /etc/opt/brother/scanner/models instead, so nixos environment.etc can make it available
+    printf '/etc/opt/brother/scanner/models\x00' | dd of=opt/brother/scanner/brscan5/libsane-brother5.so.1.0.7 bs=1 seek=84632 conv=notrunc
+  '';
+
+  installPhase = with lib; ''
+    runHook preInstall
+    PATH_TO_BRSCAN5="opt/brother/scanner/brscan5"
+    mkdir -p $out/$PATH_TO_BRSCAN5
+    cp -rp $PATH_TO_BRSCAN5/* $out/$PATH_TO_BRSCAN5
+
+
+    pushd $out/$PATH_TO_BRSCAN5
+      ln -s libLxBsDeviceAccs.so.1.0.0 libLxBsDeviceAccs.so.1
+      ln -s libLxBsNetDevAccs.so.1.0.0 libLxBsNetDevAccs.so.1
+      ln -s libLxBsScanCoreApi.so.3.0.0 libLxBsScanCoreApi.so.3
+      ln -s libLxBsUsbDevAccs.so.1.0.0 libLxBsUsbDevAccs.so.1
+      ln -s libsane-brother5.so.1.0.7 libsane-brother5.so.1
+    popd
+
+    mkdir -p $out/lib/sane
+    for file in $out/$PATH_TO_BRSCAN5/*.so.* ; do
+      ln -s $file $out/lib/sane/
+    done
+
+    makeWrapper \
+      "$out/$PATH_TO_BRSCAN5/brsaneconfig5" \
+      "$out/bin/brsaneconfig5" \
+      --suffix-each NIX_REDIRECT ":" "/etc/opt/brother/scanner/brscan5=$out/opt/brother/scanner/brscan5 /opt/brother/scanner/brscan5=$out/opt/brother/scanner/brscan5" \
+      --set LD_PRELOAD ${libredirect}/lib/libredirect.so
+
+    mkdir -p $out/etc/sane.d/dll.d
+    echo "brother5" > $out/etc/sane.d/dll.d/brother5.conf
+
+    mkdir -p $out/etc/udev/rules.d
+    cp -p $PATH_TO_BRSCAN5/udev-rules/NN-brother-mfp-brscan5-1.0.2-2.rules \
+      $out/etc/udev/rules.d/49-brother-mfp-brscan5-1.0.2-2.rules
+
+    ETCDIR=$out/etc/opt/brother/scanner/brscan5
+    mkdir -p $ETCDIR
+    cp -rp $PATH_TO_BRSCAN5/{models,brscan5.ini,brsanenetdevice.cfg} $ETCDIR/
+
+    runHook postInstall
+  '';
+
+  dontPatchELF = true;
+
+  meta = {
+    description = "Brother brscan5 sane backend driver";
+    homepage = "https://www.brother.com";
+    platforms = [ "i686-linux" "x86_64-linux" ];
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ mattchrist ];
+  };
+}
diff --git a/pkgs/applications/networking/browsers/elinks/default.nix b/pkgs/applications/networking/browsers/elinks/default.nix
index 9a7551a6fff..df9fc3f822c 100644
--- a/pkgs/applications/networking/browsers/elinks/default.nix
+++ b/pkgs/applications/networking/browsers/elinks/default.nix
@@ -13,13 +13,13 @@ assert enablePython -> python != null;
 
 stdenv.mkDerivation rec {
   pname = "elinks";
-  version = "0.14.0";
+  version = "0.14.1";
 
   src = fetchFromGitHub {
     owner = "rkd77";
     repo = "felinks";
     rev = "v${version}";
-    sha256 = "sha256-LxJJ0yBlw9hJ/agyL9dbVe4STKdXE8rtk1mMFqe1fFI=";
+    sha256 = "sha256-D7dUVHgYGzY4FXEnOzXw0Fao3gLgfFuCl8LJdLVpcSM=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/networking/cluster/dnsname-cni/default.nix b/pkgs/applications/networking/cluster/dnsname-cni/default.nix
index 91ef8b68fb6..8f5e2889521 100644
--- a/pkgs/applications/networking/cluster/dnsname-cni/default.nix
+++ b/pkgs/applications/networking/cluster/dnsname-cni/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cni-plugin-dnsname";
-  version = "1.1.1";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "dnsname";
     rev = "v${version}";
-    sha256 = "090kpq2ppan9ayajdk5vwbvww30nphylgajn2p3441d4jg2nvsm3";
+    sha256 = "sha256-hHkQOHDso92gXFCz40iQ7j2cHTEAMsaeW8MCJV2Otqo=";
   };
 
   patches = [ ./hardcode-dnsmasq-path.patch ];
diff --git a/pkgs/applications/networking/irc/weechat/scripts/wee-slack/0001-hardcode-json-file-path.patch b/pkgs/applications/networking/irc/weechat/scripts/wee-slack/0001-hardcode-json-file-path.patch
deleted file mode 100644
index 45e620db258..00000000000
--- a/pkgs/applications/networking/irc/weechat/scripts/wee-slack/0001-hardcode-json-file-path.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From 5dd2593369645b11a9dc03e1930617d2f5dbd039 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
-Date: Wed, 11 Nov 2020 11:48:49 +0100
-Subject: [PATCH] hardcode json file path
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
----
- wee_slack.py | 8 +-------
- 1 file changed, 1 insertion(+), 7 deletions(-)
-
-diff --git a/wee_slack.py b/wee_slack.py
-index a3d779c..5942289 100644
---- a/wee_slack.py
-+++ b/wee_slack.py
-@@ -5136,13 +5136,7 @@ def create_slack_debug_buffer():
- 
- def load_emoji():
-     try:
--        weechat_dir = w.info_get('weechat_dir', '')
--        weechat_sharedir = w.info_get('weechat_sharedir', '')
--        local_weemoji, global_weemoji = ('{}/weemoji.json'.format(path)
--                for path in (weechat_dir, weechat_sharedir))
--        path = (global_weemoji if os.path.exists(global_weemoji) and
--                not os.path.exists(local_weemoji) else local_weemoji)
--        with open(path, 'r') as ef:
-+        with open('@out@/share/wee-slack/weemoji.json', 'r') as ef:
-             emojis = json.loads(ef.read())
-             if 'emoji' in emojis:
-                 print_error('The weemoji.json file is in an old format. Please update it.')
--- 
-2.29.0
-
diff --git a/pkgs/applications/networking/irc/weechat/scripts/wee-slack/default.nix b/pkgs/applications/networking/irc/weechat/scripts/wee-slack/default.nix
index 679e278c8a0..698ee80edf6 100644
--- a/pkgs/applications/networking/irc/weechat/scripts/wee-slack/default.nix
+++ b/pkgs/applications/networking/irc/weechat/scripts/wee-slack/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wee-slack";
-  version = "2.7.0";
+  version = "2.8.0";
 
   src = fetchFromGitHub {
     repo = "wee-slack";
     owner = "wee-slack";
     rev = "v${version}";
-    sha256 = "sha256-6Z/H15bKe0PKpNe9PCgc5mLOii3CILCAVon7EgzIkx8=";
+    sha256 = "0xfklr0gsc9jgxfyrrb2j756lclz9g8imcb0pk0xgyj8mhsw23zk";
   };
 
   patches = [
@@ -16,10 +16,13 @@ stdenv.mkDerivation rec {
       src = ./libpath.patch;
       env = "${buildEnv {
         name = "wee-slack-env";
-        paths = with python3Packages; [ websocket_client six ];
+        paths = with python3Packages; [
+          websocket_client
+          six
+        ];
       }}/${python3Packages.python.sitePackages}";
     })
-    ./0001-hardcode-json-file-path.patch
+    ./load_weemoji_path.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/networking/irc/weechat/scripts/wee-slack/libpath.patch b/pkgs/applications/networking/irc/weechat/scripts/wee-slack/libpath.patch
index af2dd36b41c..a6e38c16fb1 100644
--- a/pkgs/applications/networking/irc/weechat/scripts/wee-slack/libpath.patch
+++ b/pkgs/applications/networking/irc/weechat/scripts/wee-slack/libpath.patch
@@ -1,13 +1,13 @@
 diff --git a/wee_slack.py b/wee_slack.py
-index dbe6446..d1b7546 100644
+index e4716b4..f673b7c 100644
 --- a/wee_slack.py
 +++ b/wee_slack.py
-@@ -25,6 +25,8 @@ import random
- import socket
- import string
+@@ -31,6 +31,8 @@ import string
+ # See https://github.com/numpy/numpy/issues/11925
+ sys.modules["numpy"] = None
  
 +sys.path.append('@env@')
 +
- from websocket import ABNF, create_connection, WebSocketConnectionClosedException
- 
- try:
+ from websocket import (  # noqa: E402
+     ABNF,
+     create_connection,
diff --git a/pkgs/applications/networking/irc/weechat/scripts/wee-slack/load_weemoji_path.patch b/pkgs/applications/networking/irc/weechat/scripts/wee-slack/load_weemoji_path.patch
new file mode 100644
index 00000000000..1e97dc32fa6
--- /dev/null
+++ b/pkgs/applications/networking/irc/weechat/scripts/wee-slack/load_weemoji_path.patch
@@ -0,0 +1,25 @@
+diff --git a/wee_slack.py b/wee_slack.py
+index e4716b4..ffd122d 100644
+--- a/wee_slack.py
++++ b/wee_slack.py
+@@ -6092,19 +6092,7 @@ def create_slack_debug_buffer():
+ 
+ def load_emoji():
+     try:
+-        weechat_dir = w.info_get("weechat_data_dir", "") or w.info_get(
+-            "weechat_dir", ""
+-        )
+-        weechat_sharedir = w.info_get("weechat_sharedir", "")
+-        local_weemoji, global_weemoji = (
+-            "{}/weemoji.json".format(path) for path in (weechat_dir, weechat_sharedir)
+-        )
+-        path = (
+-            global_weemoji
+-            if os.path.exists(global_weemoji) and not os.path.exists(local_weemoji)
+-            else local_weemoji
+-        )
+-        with open(path, "r") as ef:
++        with open("@out@/share/wee-slack/weemoji.json", "r") as ef:
+             emojis = json.loads(ef.read())
+             if "emoji" in emojis:
+                 print_error(
diff --git a/pkgs/applications/networking/nextcloud-client/default.nix b/pkgs/applications/networking/nextcloud-client/default.nix
index 0b837c55398..db01ec014ee 100644
--- a/pkgs/applications/networking/nextcloud-client/default.nix
+++ b/pkgs/applications/networking/nextcloud-client/default.nix
@@ -20,13 +20,13 @@
 
 mkDerivation rec {
   pname = "nextcloud-client";
-  version = "3.2.1";
+  version = "3.2.2";
 
   src = fetchFromGitHub {
     owner = "nextcloud";
     repo = "desktop";
     rev = "v${version}";
-    sha256 = "sha256-I31w79GDZxSGlT6YPKSpq0aiyGnJiJBVdTyWI+DUoz4=";
+    sha256 = "sha256-UPWr5P6oEBtDK/Cuz8nZlHqKFyGEf44vbMfrphxNkMU=";
   };
 
   patches = [
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index b2b47901981..bf81d00e5ea 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -9,10 +9,22 @@
 , lib
 , stdenvNoCC
 , bintools ? null, libc ? null, coreutils ? null, shell ? stdenvNoCC.shell, gnugrep ? null
+, netbsd ? null, netbsdCross ? null
+, sharedLibraryLoader ?
+  if libc == null then
+    null
+  else if stdenvNoCC.targetPlatform.isNetBSD then
+    if libc != targetPackages.netbsdCross.headers then
+      targetPackages.netbsdCross.ld_elf_so
+    else
+      null
+  else
+    lib.getLib libc
 , nativeTools, noLibc ? false, nativeLibc, nativePrefix ? ""
 , propagateDoc ? bintools != null && bintools ? man
 , extraPackages ? [], extraBuildCommands ? ""
 , buildPackages ? {}
+, targetPackages ? {}
 , useMacosReexportHack ? false
 
 # Darwin code signing support utilities
@@ -54,19 +66,19 @@ let
   # The dynamic linker has different names on different platforms. This is a
   # shell glob that ought to match it.
   dynamicLinker =
-    /**/ if libc == null then null
-    else if targetPlatform.libc == "musl"             then "${libc_lib}/lib/ld-musl-*"
+    /**/ if sharedLibraryLoader == null then null
+    else if targetPlatform.libc == "musl"             then "${sharedLibraryLoader}/lib/ld-musl-*"
     else if (targetPlatform.libc == "bionic" && targetPlatform.is32bit) then "/system/bin/linker"
     else if (targetPlatform.libc == "bionic" && targetPlatform.is64bit) then "/system/bin/linker64"
-    else if targetPlatform.libc == "nblibc"           then "${libc_lib}/libexec/ld.elf_so"
-    else if targetPlatform.system == "i686-linux"     then "${libc_lib}/lib/ld-linux.so.2"
-    else if targetPlatform.system == "x86_64-linux"   then "${libc_lib}/lib/ld-linux-x86-64.so.2"
-    else if targetPlatform.system == "powerpc64le-linux" then "${libc_lib}/lib/ld64.so.2"
+    else if targetPlatform.libc == "nblibc"           then "${sharedLibraryLoader}/libexec/ld.elf_so"
+    else if targetPlatform.system == "i686-linux"     then "${sharedLibraryLoader}/lib/ld-linux.so.2"
+    else if targetPlatform.system == "x86_64-linux"   then "${sharedLibraryLoader}/lib/ld-linux-x86-64.so.2"
+    else if targetPlatform.system == "powerpc64le-linux" then "${sharedLibraryLoader}/lib/ld64.so.2"
     # ARM with a wildcard, which can be "" or "-armhf".
-    else if (with targetPlatform; isAarch32 && isLinux)   then "${libc_lib}/lib/ld-linux*.so.3"
-    else if targetPlatform.system == "aarch64-linux"  then "${libc_lib}/lib/ld-linux-aarch64.so.1"
-    else if targetPlatform.system == "powerpc-linux"  then "${libc_lib}/lib/ld.so.1"
-    else if targetPlatform.isMips                     then "${libc_lib}/lib/ld.so.1"
+    else if (with targetPlatform; isAarch32 && isLinux)   then "${sharedLibraryLoader}/lib/ld-linux*.so.3"
+    else if targetPlatform.system == "aarch64-linux"  then "${sharedLibraryLoader}/lib/ld-linux-aarch64.so.1"
+    else if targetPlatform.system == "powerpc-linux"  then "${sharedLibraryLoader}/lib/ld.so.1"
+    else if targetPlatform.isMips                     then "${sharedLibraryLoader}/lib/ld.so.1"
     else if targetPlatform.isDarwin                   then "/usr/lib/dyld"
     else if targetPlatform.isFreeBSD                  then "/libexec/ld-elf.so.1"
     else if lib.hasSuffix "pc-gnu" targetPlatform.config then "ld.so.1"
@@ -224,10 +236,10 @@ stdenv.mkDerivation {
     ##
     ## Dynamic linker support
     ##
-    + ''
+    + optionalString (sharedLibraryLoader != null) ''
       if [[ -z ''${dynamicLinker+x} ]]; then
         echo "Don't know the name of the dynamic linker for platform '${targetPlatform.config}', so guessing instead." >&2
-        local dynamicLinker="${libc_lib}/lib/ld*.so.?"
+        local dynamicLinker="${sharedLibraryLoader}/lib/ld*.so.?"
       fi
     ''
 
@@ -246,9 +258,9 @@ stdenv.mkDerivation {
 
         ${if targetPlatform.isDarwin then ''
           printf "export LD_DYLD_PATH=%q\n" "$dynamicLinker" >> $out/nix-support/setup-hook
-        '' else ''
-          if [ -e ${libc_lib}/lib/32/ld-linux.so.2 ]; then
-            echo ${libc_lib}/lib/32/ld-linux.so.2 > $out/nix-support/dynamic-linker-m32
+        '' else lib.optionalString (sharedLibraryLoader != null) ''
+          if [ -e ${sharedLibraryLoader}/lib/32/ld-linux.so.2 ]; then
+            echo ${sharedLibraryLoader}/lib/32/ld-linux.so.2 > $out/nix-support/dynamic-linker-m32
           fi
           touch $out/nix-support/ld-set-dynamic-linker
         ''}
diff --git a/pkgs/build-support/libredirect/libredirect.c b/pkgs/build-support/libredirect/libredirect.c
index c8d6956a6bf..dfa2978e9f4 100644
--- a/pkgs/build-support/libredirect/libredirect.c
+++ b/pkgs/build-support/libredirect/libredirect.c
@@ -9,6 +9,7 @@
 #include <limits.h>
 #include <string.h>
 #include <spawn.h>
+#include <dirent.h>
 
 #define MAX_REDIRECTS 128
 
@@ -189,9 +190,85 @@ int posix_spawnp(pid_t * pid, const char * file,
     return posix_spawnp_real(pid, rewrite(file, buf), file_actions, attrp, argv, envp);
 }
 
-int execv(const char *path, char *const argv[])
+int execv(const char * path, char * const argv[])
 {
-    int (*execv_real) (const char *path, char *const argv[]) = dlsym(RTLD_NEXT, "execv");
+    int (*execv_real) (const char * path, char * const argv[]) = dlsym(RTLD_NEXT, "execv");
     char buf[PATH_MAX];
     return execv_real(rewrite(path, buf), argv);
 }
+
+int execvp(const char * path, char * const argv[])
+{
+    int (*_execvp) (const char *, char * const argv[]) = dlsym(RTLD_NEXT, "execvp");
+    char buf[PATH_MAX];
+    return _execvp(rewrite(path, buf), argv);
+}
+
+int execve(const char * path, char * const argv[], char * const envp[])
+{
+    int (*_execve) (const char *, char * const argv[], char * const envp[]) = dlsym(RTLD_NEXT, "execve");
+    char buf[PATH_MAX];
+    return _execve(rewrite(path, buf), argv, envp);
+}
+
+DIR * opendir(const char * path)
+{
+    char buf[PATH_MAX];
+    DIR * (*_opendir) (const char*) = dlsym(RTLD_NEXT, "opendir");
+
+    return _opendir(rewrite(path, buf));
+}
+
+#define SYSTEM_CMD_MAX 512
+
+char *replace_substring(char * source, char * buf, char * replace_string, char * start_ptr, char * suffix_ptr) {
+    char head[SYSTEM_CMD_MAX] = {0};
+    strncpy(head, source, start_ptr - source);
+
+    char tail[SYSTEM_CMD_MAX] = {0};
+    if(suffix_ptr < source + strlen(source)) {
+       strcpy(tail, suffix_ptr);
+    }
+
+    sprintf(buf, "%s%s%s", head, replace_string, tail);
+    return buf;
+}
+
+char *replace_string(char * buf, char * from, char * to) {
+    int num_matches = 0;
+    char * matches[SYSTEM_CMD_MAX];
+    int from_len = strlen(from);
+    for(int i=0; i<strlen(buf); i++){
+       char *cmp_start = buf + i;
+       if(strncmp(from, cmp_start, from_len) == 0){
+          matches[num_matches] = cmp_start;
+          num_matches++;
+       }
+    }
+    int len_diff = strlen(to) - strlen(from);
+    for(int n = 0; n < num_matches; n++) {
+       char replaced[SYSTEM_CMD_MAX];
+       replace_substring(buf, replaced, to, matches[n], matches[n]+from_len);
+       strcpy(buf, replaced);
+       for(int nn = n+1; nn < num_matches; nn++) {
+          matches[nn] += len_diff;
+       }
+    }
+    return buf;
+}
+
+void rewriteSystemCall(const char * command, char * buf) {
+    strcpy(buf, command);
+    for (int n = 0; n < nrRedirects; ++n) {
+       replace_string(buf, from[n], to[n]);
+    }
+}
+
+int system(const char *command)
+{
+    int (*_system) (const char*) = dlsym(RTLD_NEXT, "system");
+
+    char newCommand[SYSTEM_CMD_MAX];
+    rewriteSystemCall(command, newCommand);
+    return _system(newCommand);
+}
diff --git a/pkgs/build-support/libredirect/test.c b/pkgs/build-support/libredirect/test.c
index b57664db3c1..722d1303771 100644
--- a/pkgs/build-support/libredirect/test.c
+++ b/pkgs/build-support/libredirect/test.c
@@ -2,6 +2,7 @@
 #include <fcntl.h>
 #include <spawn.h>
 #include <stdio.h>
+#include <stdlib.h>
 #include <unistd.h>
 
 #include <sys/stat.h>
@@ -31,6 +32,10 @@ void test_execv(void) {
     assert(execv(TESTPATH, argv) == 0);
 }
 
+void test_system(void) {
+    assert(system(TESTPATH) == 0);
+}
+
 int main(void)
 {
     FILE *testfp;
@@ -50,6 +55,7 @@ int main(void)
     assert(stat(TESTPATH, &testsb) != -1);
 
     test_spawn();
+    test_system();
     test_execv();
 
     /* If all goes well, this is never reached because test_execv() replaces
diff --git a/pkgs/desktops/cinnamon/cinnamon-translations/default.nix b/pkgs/desktops/cinnamon/cinnamon-translations/default.nix
index dafb5f4b3fe..f790c54052d 100644
--- a/pkgs/desktops/cinnamon/cinnamon-translations/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-translations/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cinnamon-translations";
-  version = "4.8.3";
+  version = "5.0.0";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    hash = "sha256-o/JFfwloXLUOy9YQzHtMCuzK7yBp/G43VS/RguxiTPY=";
+    hash = "sha256-qBLg0z0ZoS7clclKsIxMG6378Q1iv1NnhS9cz3f4cEc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/armadillo/default.nix b/pkgs/development/libraries/armadillo/default.nix
index ee557ba6067..9e81ce0c6c8 100644
--- a/pkgs/development/libraries/armadillo/default.nix
+++ b/pkgs/development/libraries/armadillo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "armadillo";
-  version = "10.5.0";
+  version = "10.5.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    sha256 = "sha256-6pkMNNxtcNfJW0NU2fOwgZveJX27Z3ljSOkeGWCCy4c=";
+    sha256 = "sha256-lq1uHLzyjz0cH/ly3ixA2t3b12gyVrrVAtPEY9L2TN8=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/typed-settings/default.nix b/pkgs/development/python-modules/typed-settings/default.nix
new file mode 100644
index 00000000000..9791c2b0468
--- /dev/null
+++ b/pkgs/development/python-modules/typed-settings/default.nix
@@ -0,0 +1,41 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptoolsBuildHook
+, attrs
+, toml
+, pytestCheckHook
+, click
+}:
+
+buildPythonPackage rec {
+  pname = "typed-settings";
+  version = "0.9.2";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "203c1c6ec73dd1eb0fecd4981b31f8e05042f0dda16443190ac9ade1113ff53d";
+  };
+
+  nativeBuildInputs = [
+    setuptoolsBuildHook
+    pytestCheckHook
+  ];
+
+  propagatedBuildInputs = [
+    attrs
+    toml
+  ];
+
+  checkInputs = [
+    click
+  ];
+
+  meta = {
+    description = "Typed settings based on attrs classes";
+    homepage = "https://gitlab.com/sscherfke/typed-settings";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fridh ];
+  };
+}
diff --git a/pkgs/development/tools/analysis/radare2/default.nix b/pkgs/development/tools/analysis/radare2/default.nix
index e59c48f91d3..0ffe937a93f 100644
--- a/pkgs/development/tools/analysis/radare2/default.nix
+++ b/pkgs/development/tools/analysis/radare2/default.nix
@@ -20,6 +20,7 @@
 , ruby
 , lua
 , capstone
+, fetchpatch
 , useX11 ? false
 , rubyBindings ? false
 , pythonBindings ? false
@@ -37,6 +38,19 @@ stdenv.mkDerivation rec {
     sha256 = "0n3k190qjhdlj10fjqijx6ismz0g7fk28i83j0480cxdqgmmlbxc";
   };
 
+  patches = [
+    # fix for CVE-2021-32613
+    (fetchpatch {
+      url = "https://github.com/radareorg/radare2/commit/5e16e2d1c9fe245e4c17005d779fde91ec0b9c05.patch";
+      sha256 = "sha256-zCFNn968buLuSqfUT5E+72qz0l1tA3fEUQIxJl2nd3I=";
+    })
+    (fetchpatch {
+      name = "CVE-2021-32613.patch";
+      url = "https://github.com/radareorg/radare2/commit/049de62730f4954ef9a642f2eeebbca30a8eccdc.patch";
+      sha256 = "sha256-s8SWGuSQ6fxDCybtjO2ZW8w7H6mr+AuzVLL6dw+XKDw=";
+    })
+  ];
+
   postInstall = ''
     install -D -m755 $src/binr/r2pm/r2pm $out/bin/r2pm
   '';
diff --git a/pkgs/development/tools/treefmt/default.nix b/pkgs/development/tools/treefmt/default.nix
index 9b426882fe5..961b9625ede 100644
--- a/pkgs/development/tools/treefmt/default.nix
+++ b/pkgs/development/tools/treefmt/default.nix
@@ -1,16 +1,16 @@
 { lib, rustPlatform, fetchFromGitHub }:
 rustPlatform.buildRustPackage rec {
   pname = "treefmt";
-  version = "0.2.0";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "numtide";
     repo = "treefmt";
     rev = "v${version}";
-    sha256 = "10mv18hsyz5kd001i6cgk0xag4yk7rhxvs09acp2s68qni1v8vx2";
+    sha256 = "13z7n0xg150815c77ysz4iqpk8rbgj4vmqy1y2262ryb88dwaw5n";
   };
 
-  cargoSha256 = "02455sk8n900j8qr79mrchk7m0gb4chhw0saa280p86vn56flvs0";
+  cargoSha256 = "1jfrmafj1b28k6xjpj0qq1jpccll0adqxhjypphxhyfsfnra8g6f";
 
   meta = {
     description = "one CLI to format the code tree";
diff --git a/pkgs/games/cbonsai/default.nix b/pkgs/games/cbonsai/default.nix
index 42e89d235df..eda9e37752e 100644
--- a/pkgs/games/cbonsai/default.nix
+++ b/pkgs/games/cbonsai/default.nix
@@ -1,14 +1,14 @@
 { stdenv, lib, fetchFromGitLab, ncurses, pkg-config, nix-update-script }:
 
 stdenv.mkDerivation rec {
-  version = "1.1.1";
+  version = "1.2.0";
   pname = "cbonsai";
 
   src = fetchFromGitLab {
     owner = "jallbrit";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-IgtBHy6JCuTTXL0GNnaRCLrmQ9QDatK15WvrBBvux6s=";
+    sha256 = "sha256-j3RNCUxNyphZy5c7ZcKwyVbcYt7l6wiB+r7P3sWPFwA=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/os-specific/bsd/netbsd/default.nix b/pkgs/os-specific/bsd/netbsd/default.nix
index 63e52a3bf3c..1d5e210f8ac 100644
--- a/pkgs/os-specific/bsd/netbsd/default.nix
+++ b/pkgs/os-specific/bsd/netbsd/default.nix
@@ -753,11 +753,11 @@ in lib.makeScopeWithSplicing
     version = "9.2";
     sha256 = "0ia9mqzdljly0vqfwflm5mzz55k7qsr4rw2bzhivky6k30vgirqa";
     meta.platforms = lib.platforms.netbsd;
-    LIBC_PIC = "${stdenv.cc.libc}/lib/libc_pic.a";
+    LIBC_PIC = "${self.libc}/lib/libc_pic.a";
     # Hack to prevent a symlink being installed here for compatibility.
     SHLINKINSTALLDIR = "/usr/libexec";
     USE_FORT = "yes";
-    makeFlags = [ "CLIBOBJ=${stdenv.cc.libc}/lib" ];
+    makeFlags = [ "BINDIR=$(out)/libexec" "CLIBOBJ=${self.libc}/lib" ];
     extraPaths = with self; [ libc.src ] ++ libc.extraPaths;
   };
 
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 50cc54f9c30..3c41ec3b887 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2021-05-26";
+  version = "2021-05-29";
 
   src = fetchFromGitHub {
     owner = "offensive-security";
     repo = pname;
     rev = version;
-    sha256 = "sha256-LYCUPIoqgU5IPtUew+orY1e2NfmefZFoWnvsZ9erohE=";
+    sha256 = "sha256-pZoK4cPQ7f2qPC0WiqF1dxwYTh+vQ1hIJ4Rf8R3MwRk=";
   };
 
   installPhase = ''
diff --git a/pkgs/tools/system/bpytop/default.nix b/pkgs/tools/system/bpytop/default.nix
index 8cb3c16bebb..9820e6ac00d 100644
--- a/pkgs/tools/system/bpytop/default.nix
+++ b/pkgs/tools/system/bpytop/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bpytop";
-  version = "1.0.65";
+  version = "1.0.66";
 
   src = fetchFromGitHub {
     owner = "aristocratos";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-sWANeoUbvnrTksqfeIRU4a5XeX7QVzT9+ZT3R5Utp+4=";
+    sha256 = "sha256-gggsZHKbEt4VSMNTkKGFLcPPt2uHRFDCkqyHYx0c9Y0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8243db18c99..69f29be2adc 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -30972,6 +30972,8 @@ in
 
   brscan4 = callPackage ../applications/graphics/sane/backends/brscan4 { };
 
+  brscan5 = callPackage ../applications/graphics/sane/backends/brscan5 { };
+
   dsseries = callPackage ../applications/graphics/sane/backends/dsseries { };
 
   sane-airscan = callPackage ../applications/graphics/sane/backends/airscan { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 1625f24c98e..5be41683de8 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8482,6 +8482,8 @@ in {
 
   typed-ast = callPackage ../development/python-modules/typed-ast { };
 
+  typed-settings = callPackage ../development/python-modules/typed-settings { };
+
   typeguard = callPackage ../development/python-modules/typeguard { };
 
   typer = callPackage ../development/python-modules/typer { };