Merge master into staging-next

19 files changed, 371 insertions, 61 deletions

diff --git a/nixos/modules/services/networking/wg-quick.nix b/nixos/modules/services/networking/wg-quick.nix
index 0b3815d0cc6..236d3f452e7 100644
--- a/nixos/modules/services/networking/wg-quick.nix
+++ b/nixos/modules/services/networking/wg-quick.nix
@@ -10,6 +10,18 @@ let
 
   interfaceOpts = { ... }: {
     options = {
+
+      configFile = mkOption {
+        example = "/secret/wg0.conf";
+        default = null;
+        type = with types; nullOr str;
+        description = ''
+          wg-quick .conf file, describing the interface.
+          This overrides any other configuration interface configuration options.
+          See wg-quick manpage for more details.
+        '';
+      };
+
       address = mkOption {
         example = [ "192.168.2.1/24" ];
         default = [];
@@ -205,7 +217,7 @@ let
   writeScriptFile = name: text: ((pkgs.writeShellScriptBin name text) + "/bin/${name}");
 
   generateUnit = name: values:
-    assert assertMsg ((values.privateKey != null) != (values.privateKeyFile != null)) "Only one of privateKey or privateKeyFile may be set";
+    assert assertMsg (values.configFile != null || ((values.privateKey != null) != (values.privateKeyFile != null))) "Only one of privateKey, configFile or privateKeyFile may be set";
     let
       preUpFile = if values.preUp != "" then writeScriptFile "preUp.sh" values.preUp else null;
       postUp =
@@ -247,7 +259,12 @@ let
           optionalString (peer.allowedIPs != []) "AllowedIPs = ${concatStringsSep "," peer.allowedIPs}\n"
         ) values.peers;
       };
-      configPath = "${configDir}/${name}.conf";
+      configPath =
+        if values.configFile != null then
+          # This uses bind-mounted private tmp folder (/tmp/systemd-private-***)
+          "/tmp/${name}.conf"
+        else
+          "${configDir}/${name}.conf";
     in
     nameValuePair "wg-quick-${name}"
       {
@@ -265,9 +282,17 @@ let
 
         script = ''
           ${optionalString (!config.boot.isContainer) "modprobe wireguard"}
+          ${optionalString (values.configFile != null) ''
+            cp ${values.configFile} ${configPath}
+          ''}
           wg-quick up ${configPath}
         '';
 
+        serviceConfig = {
+          # Used to privately store renamed copies of external config files during activation
+          PrivateTmp = true;
+        };
+
         preStop = ''
           wg-quick down ${configPath}
         '';
diff --git a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
index 2ad5d8c4654..c8c18604539 100644
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
@@ -48,9 +48,9 @@ mkYarnPackage rec {
     runHook preBuild
     export HOME=$(mktemp -d)
     pushd deps/element-desktop/
-    npx tsc
+    yarn run build:ts
     yarn run i18n
-    node ./scripts/copy-res.js
+    yarn run build:res
     popd
     rm -rf node_modules/matrix-seshat node_modules/keytar
     ${lib.optionalString useKeytar "ln -s ${keytar} node_modules/keytar"}
@@ -91,11 +91,8 @@ mkYarnPackage rec {
     runHook postInstall
   '';
 
-  # Do not attempt generating a tarball for element-web again.
-  # note: `doDist = false;` does not work.
-  distPhase = ''
-    true
-  '';
+  # Do not attempt generating a tarball for element-desktop again.
+  doDist = false;
 
   # The desktop item properties should be kept in sync with data from upstream:
   # https://github.com/vector-im/element-desktop/blob/develop/package.json
diff --git a/pkgs/applications/networking/instant-messengers/element/element-web-package.json b/pkgs/applications/networking/instant-messengers/element/element-web-package.json
new file mode 100644
index 00000000000..68aead1c0eb
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/element/element-web-package.json
@@ -0,0 +1,206 @@
+{
+  "name": "element-web",
+  "version": "1.10.13",
+  "description": "A feature-rich client for Matrix.org",
+  "author": "New Vector Ltd.",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/vector-im/element-web"
+  },
+  "license": "Apache-2.0",
+  "files": [
+    "lib",
+    "res",
+    "src",
+    "webpack.config.js",
+    "scripts",
+    "docs",
+    "release.sh",
+    "deploy",
+    "CHANGELOG.md",
+    "CONTRIBUTING.rst",
+    "LICENSE",
+    "README.md",
+    "AUTHORS.rst",
+    "package.json",
+    "contribute.json"
+  ],
+  "style": "bundle.css",
+  "scripts": {
+    "i18n": "matrix-gen-i18n",
+    "prunei18n": "matrix-prune-i18n",
+    "diff-i18n": "cp src/i18n/strings/en_EN.json src/i18n/strings/en_EN_orig.json && matrix-gen-i18n && matrix-compare-i18n-files src/i18n/strings/en_EN_orig.json src/i18n/strings/en_EN.json",
+    "clean": "rimraf lib webapp",
+    "build": "yarn clean && yarn build:genfiles && yarn build:bundle",
+    "build-stats": "yarn clean && yarn build:genfiles && yarn build:bundle-stats",
+    "build:jitsi": "node scripts/build-jitsi.js",
+    "build:res": "node scripts/copy-res.js",
+    "build:genfiles": "yarn build:res && yarn build:jitsi",
+    "build:modernizr": "modernizr -c .modernizr.json -d src/vector/modernizr.js",
+    "build:bundle": "webpack --progress --bail --mode production",
+    "build:bundle-stats": "webpack --progress --bail --mode production --json > webpack-stats.json",
+    "dist": "scripts/package.sh",
+    "start": "concurrently --kill-others-on-fail --prefix \"{time} [{name}]\" -n res,element-js \"yarn start:res\" \"yarn start:js\"",
+    "start:https": "concurrently --kill-others-on-fail --prefix \"{time} [{name}]\" -n res,element-js \"yarn start:res\" \"yarn start:js --https\"",
+    "start:res": "yarn build:jitsi && node scripts/copy-res.js -w",
+    "start:js": "webpack-dev-server --host=0.0.0.0 --output-filename=bundles/_dev_/[name].js --output-chunk-filename=bundles/_dev_/[name].js -w --mode development --disable-host-check --hot",
+    "lint": "yarn lint:types && yarn lint:js && yarn lint:style",
+    "lint:js": "eslint --max-warnings 0 src",
+    "lint:js-fix": "eslint --fix src",
+    "lint:types": "tsc --noEmit --jsx react",
+    "lint:style": "stylelint \"res/css/**/*.scss\"",
+    "test": "jest",
+    "coverage": "yarn test --coverage"
+  },
+  "dependencies": {
+    "@matrix-org/olm": "https://gitlab.matrix.org/api/v4/projects/27/packages/npm/@matrix-org/olm/-/@matrix-org/olm-3.2.8.tgz",
+    "browser-request": "^0.3.3",
+    "gfm.css": "^1.1.2",
+    "jsrsasign": "^10.2.0",
+    "katex": "^0.12.0",
+    "matrix-js-sdk": "18.0.0",
+    "matrix-react-sdk": "3.45.0",
+    "matrix-widget-api": "^0.1.0-beta.18",
+    "prop-types": "^15.7.2",
+    "react": "17.0.2",
+    "react-dom": "17.0.2",
+    "sanitize-html": "^2.3.2",
+    "ua-parser-js": "^0.7.24"
+  },
+  "devDependencies": {
+    "@babel/core": "^7.12.10",
+    "@babel/eslint-parser": "^7.12.10",
+    "@babel/eslint-plugin": "^7.12.10",
+    "@babel/plugin-proposal-class-properties": "^7.12.1",
+    "@babel/plugin-proposal-export-default-from": "^7.12.1",
+    "@babel/plugin-proposal-nullish-coalescing-operator": "^7.12.1",
+    "@babel/plugin-proposal-numeric-separator": "^7.12.7",
+    "@babel/plugin-proposal-object-rest-spread": "^7.12.1",
+    "@babel/plugin-proposal-optional-chaining": "^7.12.7",
+    "@babel/plugin-syntax-dynamic-import": "^7.8.3",
+    "@babel/plugin-transform-runtime": "^7.12.10",
+    "@babel/preset-env": "^7.12.11",
+    "@babel/preset-react": "^7.12.10",
+    "@babel/preset-typescript": "^7.12.7",
+    "@babel/register": "^7.12.10",
+    "@babel/runtime": "^7.12.5",
+    "@principalstudio/html-webpack-inject-preload": "^1.2.7",
+    "@sentry/webpack-plugin": "^1.18.1",
+    "@svgr/webpack": "^5.5.0",
+    "@types/flux": "^3.1.9",
+    "@types/jest": "^27.0.2",
+    "@types/modernizr": "^3.5.3",
+    "@types/node": "^14.14.22",
+    "@types/react": "17.0.14",
+    "@types/react-dom": "17.0.9",
+    "@types/sanitize-html": "^2.3.1",
+    "@types/ua-parser-js": "^0.7.36",
+    "@typescript-eslint/eslint-plugin": "^5.6.0",
+    "@typescript-eslint/parser": "^5.6.0",
+    "allchange": "^1.0.6",
+    "autoprefixer": "^9.8.6",
+    "babel-jest": "^26.6.3",
+    "babel-loader": "^8.2.2",
+    "chokidar": "^3.5.1",
+    "concurrently": "^5.3.0",
+    "cpx": "^1.5.0",
+    "css-loader": "^3.6.0",
+    "dotenv": "^10.0.0",
+    "eslint": "8.9.0",
+    "eslint-config-google": "^0.14.0",
+    "eslint-plugin-import": "^2.25.4",
+    "eslint-plugin-matrix-org": "^0.4.0",
+    "eslint-plugin-react": "^7.28.0",
+    "eslint-plugin-react-hooks": "^4.3.0",
+    "extract-text-webpack-plugin": "^4.0.0-beta.0",
+    "fake-indexeddb": "^3.1.2",
+    "file-loader": "^5.1.0",
+    "fs-extra": "^0.30.0",
+    "html-webpack-plugin": "^4.5.2",
+    "jest": "^26.6.3",
+    "jest-environment-jsdom-sixteen": "^1.0.3",
+    "jest-raw-loader": "^1.0.1",
+    "jest-sonar-reporter": "^2.0.0",
+    "json-loader": "^0.5.7",
+    "loader-utils": "^1.4.0",
+    "matrix-mock-request": "^1.2.3",
+    "matrix-react-test-utils": "^0.2.3",
+    "matrix-web-i18n": "^1.2.0",
+    "mini-css-extract-plugin": "^0.12.0",
+    "minimist": "^1.2.6",
+    "mkdirp": "^1.0.4",
+    "modernizr": "^3.12.0",
+    "node-fetch": "^2.6.7",
+    "optimize-css-assets-webpack-plugin": "^5.0.4",
+    "postcss-easings": "^2.0.0",
+    "postcss-hexrgba": "^2.0.1",
+    "postcss-import": "^12.0.1",
+    "postcss-loader": "^3.0.0",
+    "postcss-mixins": "^6.2.3",
+    "postcss-nested": "^4.2.3",
+    "postcss-preset-env": "^6.7.0",
+    "postcss-scss": "^2.1.1",
+    "postcss-simple-vars": "^5.0.2",
+    "postcss-strip-inline-comments": "^0.1.5",
+    "raw-loader": "^4.0.2",
+    "rimraf": "^3.0.2",
+    "shell-escape": "^0.2.0",
+    "simple-proxy-agent": "^1.1.0",
+    "string-replace-loader": "2",
+    "style-loader": "2",
+    "stylelint": "^13.9.0",
+    "stylelint-config-standard": "^20.0.0",
+    "stylelint-scss": "^3.18.0",
+    "terser-webpack-plugin": "^2.3.8",
+    "typescript": "^4.5.3",
+    "webpack": "^4.46.0",
+    "webpack-cli": "^3.3.12",
+    "webpack-dev-server": "^3.11.2",
+    "worker-loader": "^2.0.0",
+    "worklet-loader": "^2.0.0"
+  },
+  "resolutions": {
+    "@types/react": "17.0.14"
+  },
+  "jest": {
+    "testEnvironment": "jest-environment-jsdom-sixteen",
+    "testMatch": [
+      "<rootDir>/test/**/*-test.[tj]s?(x)"
+    ],
+    "setupFilesAfterEnv": [
+      "<rootDir>/node_modules/matrix-react-sdk/test/setupTests.js"
+    ],
+    "moduleNameMapper": {
+      "\\.(css|scss)$": "<rootDir>/__mocks__/cssMock.js",
+      "\\.(gif|png|ttf|woff2)$": "<rootDir>/node_modules/matrix-react-sdk/__mocks__/imageMock.js",
+      "\\.svg$": "<rootDir>/node_modules/matrix-react-sdk/__mocks__/svg.js",
+      "\\$webapp/i18n/languages.json": "<rootDir>/node_modules/matrix-react-sdk/__mocks__/languages.json",
+      "^browser-request$": "<rootDir>/node_modules/matrix-react-sdk/__mocks__/browser-request.js",
+      "^react$": "<rootDir>/node_modules/react",
+      "^react-dom$": "<rootDir>/node_modules/react-dom",
+      "^matrix-js-sdk$": "<rootDir>/node_modules/matrix-js-sdk/src",
+      "^matrix-react-sdk$": "<rootDir>/node_modules/matrix-react-sdk/src",
+      "decoderWorker\\.min\\.js": "<rootDir>/node_modules/matrix-react-sdk/__mocks__/empty.js",
+      "decoderWorker\\.min\\.wasm": "<rootDir>/node_modules/matrix-react-sdk/__mocks__/empty.js",
+      "waveWorker\\.min\\.js": "<rootDir>/node_modules/matrix-react-sdk/__mocks__/empty.js",
+      "context-filter-polyfill": "<rootDir>/node_modules/matrix-react-sdk/__mocks__/empty.js",
+      "FontManager.ts": "<rootDir>/node_modules/matrix-react-sdk/__mocks__/FontManager.js",
+      "workers/(.+)\\.worker\\.ts": "<rootDir>/node_modules/matrix-react-sdk/__mocks__/workerMock.js",
+      "^!!raw-loader!.*": "jest-raw-loader",
+      "RecorderWorklet": "<rootDir>/node_modules/matrix-react-sdk/__mocks__/empty.js"
+    },
+    "transformIgnorePatterns": [
+      "/node_modules/(?!matrix-js-sdk).+$",
+      "/node_modules/(?!matrix-react-sdk).+$"
+    ],
+    "coverageReporters": [
+      "text-summary",
+      "lcov"
+    ],
+    "testResultsProcessor": "jest-sonar-reporter"
+  },
+  "jestSonar": {
+    "reportPath": "coverage",
+    "sonar56x": true
+  }
+}
diff --git a/pkgs/applications/networking/instant-messengers/element/element-web.nix b/pkgs/applications/networking/instant-messengers/element/element-web.nix
index fae96e8e5e7..7cdfcabdce5 100644
--- a/pkgs/applications/networking/instant-messengers/element/element-web.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-web.nix
@@ -1,4 +1,15 @@
-{ lib, stdenv, fetchurl, writeText, jq, conf ? {} }:
+{ lib
+, mkYarnPackage
+, runCommand
+, fetchFromGitHub
+, fetchYarnDeps
+, writeText
+, jq
+, yarn
+, fixup_yarn_lock
+, nodejs
+, conf ? { }
+}:
 
 let
   pinData = lib.importJSON ./pin.json;
@@ -8,25 +19,61 @@ let
   };
   configOverrides = writeText "element-config-overrides.json" (builtins.toJSON (noPhoningHome // conf));
 
-in stdenv.mkDerivation rec {
+in
+mkYarnPackage rec {
   pname = "element-web";
   inherit (pinData) version;
 
-  src = fetchurl {
-    url = "https://github.com/vector-im/element-web/releases/download/v${version}/element-v${version}.tar.gz";
-    sha256 = pinData.webHash;
+  src = fetchFromGitHub {
+    owner = "vector-im";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = pinData.webSrcHash;
   };
 
+  packageJSON = ./element-web-package.json;
+  # Remove the matrix-analytics-events dependency from the matrix-react-sdk
+  # dependencies list. It doesn't seem to be necessary since we already are
+  # installing it individually, and it causes issues with the offline mode.
+  yarnLock = (runCommand "${pname}-modified-lock" {} ''
+    sed '/matrix-analytics-events "github/d' ${src}/yarn.lock > "$out"
+  '');
+  offlineCache = fetchYarnDeps {
+    inherit yarnLock;
+    sha256 = pinData.webYarnHash;
+  };
+
+  nativeBuildInputs = [ jq ];
+
+  configurePhase = ''
+    runHook preConfigure
+    ln -s $node_modules node_modules
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    export VERSION=${version}
+    yarn build:res --offline
+    yarn build:bundle --offline
+
+    runHook postBuild
+  '';
+
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/
-    cp -R . $out/
-    ${jq}/bin/jq -s '.[0] * .[1]' "config.sample.json" "${configOverrides}" > "$out/config.json"
+    cp -R webapp $out
+    echo "${version}" > "$out/version"
+    jq -s '.[0] * .[1]' "config.sample.json" "${configOverrides}" > "$out/config.json"
 
     runHook postInstall
   '';
 
+  # Do not attempt generating a tarball for element-web again.
+  doDist = false;
+
   meta = {
     description = "A glossy Matrix collaboration client for the web";
     homepage = "https://element.io/";
@@ -34,6 +81,5 @@ in stdenv.mkDerivation rec {
     maintainers = lib.teams.matrix.members;
     license = lib.licenses.asl20;
     platforms = lib.platforms.all;
-    hydraPlatforms = [];
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/element/pin.json b/pkgs/applications/networking/instant-messengers/element/pin.json
index c2bc3d8a89e..ceb4673f9a5 100644
--- a/pkgs/applications/networking/instant-messengers/element/pin.json
+++ b/pkgs/applications/networking/instant-messengers/element/pin.json
@@ -2,5 +2,6 @@
   "version": "1.10.13",
   "desktopSrcHash": "tTvpjSIipvmJIfZF1RiRtlDjsKJYHoPQ6XSqI8TGH14=",
   "desktopYarnHash": "105bphn4ga4f0n60cvrlppf8wim2c1qy09g8arraadcxymds98n6",
-  "webHash": "1zxjlzlxh2gbswa1063zbw6ahwlcnvyqkvbwj92vk873c3g8ba72"
+  "webSrcHash": "+imju7ojpjttmOeDnA2L4QdBi1zzfRBoUdMMTA4Lba0=",
+  "webYarnHash": "19b1w2mrcn3mzw40d023wx1jxvr0jacn2ryzxlh7zsyj8w0v1dv7"
 }
diff --git a/pkgs/applications/networking/instant-messengers/element/update.sh b/pkgs/applications/networking/instant-messengers/element/update.sh
index 364f63a18bb..a9c55a926ce 100755
--- a/pkgs/applications/networking/instant-messengers/element/update.sh
+++ b/pkgs/applications/networking/instant-messengers/element/update.sh
@@ -18,17 +18,29 @@ fi
 # strip leading "v"
 version="${version#v}"
 
-desktop_src="https://raw.githubusercontent.com/vector-im/element-desktop/v$version"
+# Element Web
+web_src="https://raw.githubusercontent.com/vector-im/element-web/v$version"
+web_src_hash=$(nix-prefetch-github vector-im element-web --rev v${version} | jq -r .sha256)
+wget "$web_src/package.json" -O element-web-package.json
+
+web_tmpdir=$(mktemp -d)
+trap 'rm -rf "$web_tmpdir"' EXIT
+
+pushd $web_tmpdir
+wget "$web_src/yarn.lock"
+sed -i '/matrix-analytics-events "github/d' yarn.lock
+web_yarn_hash=$(prefetch-yarn-deps yarn.lock)
+popd
 
+# Element Desktop
+desktop_src="https://raw.githubusercontent.com/vector-im/element-desktop/v$version"
 desktop_src_hash=$(nix-prefetch-github vector-im element-desktop --rev v${version} | jq -r .sha256)
-web_hash=$(nix-prefetch-url "https://github.com/vector-im/element-web/releases/download/v$version/element-v$version.tar.gz")
-
 wget "$desktop_src/package.json" -O element-desktop-package.json
 
-tmpdir=$(mktemp -d)
-trap 'rm -rf "$tmpdir"' EXIT
+desktop_tmpdir=$(mktemp -d)
+trap 'rm -rf "$desktop_tmpdir"' EXIT
 
-pushd $tmpdir
+pushd $desktop_tmpdir
 wget "$desktop_src/yarn.lock"
 desktop_yarn_hash=$(prefetch-yarn-deps yarn.lock)
 popd
@@ -38,6 +50,7 @@ cat > pin.json << EOF
   "version": "$version",
   "desktopSrcHash": "$desktop_src_hash",
   "desktopYarnHash": "$desktop_yarn_hash",
-  "webHash": "$web_hash"
+  "webSrcHash": "$web_src_hash",
+  "webYarnHash": "$web_yarn_hash"
 }
 EOF
diff --git a/pkgs/applications/office/micropad/default.nix b/pkgs/applications/office/micropad/default.nix
index a4ac00b3b6d..c6f0ae106e2 100644
--- a/pkgs/applications/office/micropad/default.nix
+++ b/pkgs/applications/office/micropad/default.nix
@@ -72,10 +72,7 @@ in
     '';
 
     # Do not attempt generating a tarball for micropad again.
-    # note: `doDist = false;` does not work.
-    distPhase = ''
-      true
-    '';
+    doDist = false;
 
     # The desktop item properties should be kept in sync with data from upstream:
     # https://github.com/MicroPad/MicroPad-Electron/blob/master/package.json
diff --git a/pkgs/desktops/xfce/core/exo/default.nix b/pkgs/desktops/xfce/core/exo/default.nix
index 7c891bd0358..27a5041eac0 100644
--- a/pkgs/desktops/xfce/core/exo/default.nix
+++ b/pkgs/desktops/xfce/core/exo/default.nix
@@ -4,9 +4,9 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "exo";
-  version = "4.16.3";
+  version = "4.16.4";
 
-  sha256 = "sha256-PG3GWpZ04sX4HrgAy2Sqcb+vdhiNk7C3YP7KpwgHj+g=";
+  sha256 = "sha256-/BKgQYmDaiptzlTTFqDm2aHykTCHm4MIvWnjxKYi6Es=";
 
   nativeBuildInputs = [
     libxslt
diff --git a/pkgs/development/python-modules/pyhiveapi/default.nix b/pkgs/development/python-modules/pyhiveapi/default.nix
index 8e8a86f5dca..36c61204796 100644
--- a/pkgs/development/python-modules/pyhiveapi/default.nix
+++ b/pkgs/development/python-modules/pyhiveapi/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pyhiveapi";
-  version = "0.5.9";
+  version = "0.5.10";
 
   format = "pyproject";
 
@@ -23,8 +23,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Pyhass";
     repo = "Pyhiveapi";
-    rev = "v${version}";
-    hash = "sha256-bJ9PI16m8JiXbhhNWtSJwwE+GRUbnSiCrcVhxnVeqQY=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-WhUZP6g9KVWIB6QYPDX1X5JQ9ymVX3wR3kzMtTEjEfs=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyvesync/default.nix b/pkgs/development/python-modules/pyvesync/default.nix
index f1421e8c980..19d8fee57ef 100644
--- a/pkgs/development/python-modules/pyvesync/default.nix
+++ b/pkgs/development/python-modules/pyvesync/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "pyvesync";
-  version = "2.0.3";
+  version = "2.0.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-/hPDCqTeqEzxfqv8B5wdDzmzzNuXYqOVHX32N/J6nmU=";
+    sha256 = "sha256-1Svz/9ZS5ynr88/We1fa+H1IGdC5ljUa4M5O8X+muX4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/database/pgweb/default.nix b/pkgs/development/tools/database/pgweb/default.nix
index de9d0847f8b..8ede5bd834d 100644
--- a/pkgs/development/tools/database/pgweb/default.nix
+++ b/pkgs/development/tools/database/pgweb/default.nix
@@ -1,17 +1,24 @@
-{ buildGoPackage, fetchFromGitHub, lib }:
+{ buildGoModule, fetchFromGitHub, lib }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "pgweb";
-  version = "0.11.7";
+  version = "0.11.11";
 
   src = fetchFromGitHub {
     owner = "sosedoff";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1df3vixxca80i040apbim80nqni94q882ykn3cglyccyl0iz59ix";
+    sha256 = "sha256-oKUmBrGxExppJ5y4fZOmMOT5XDMsyMvtE9czotdlMPM=";
   };
 
-  goPackagePath = "github.com/sosedoff/pgweb";
+  postPatch = ''
+    # Disable tests require network access.
+    rm -f pkg/client/{client,dump}_test.go
+  '';
+
+  vendorSha256 = "sha256-Svy0aZKOGL0vrT058szlpS5t7NvzcyRCHRksdmdkckI=";
+
+  ldflags = [ "-s" "-w" ];
 
   meta = with lib; {
     description = "A web-based database browser for PostgreSQL";
diff --git a/pkgs/development/tools/gox/default.nix b/pkgs/development/tools/gox/default.nix
index 4aa7a314c87..065f5bee224 100644
--- a/pkgs/development/tools/gox/default.nix
+++ b/pkgs/development/tools/gox/default.nix
@@ -1,11 +1,14 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, makeWrapper
+, go
+}:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "gox";
   version = "1.0.1";
 
-  goPackagePath = "github.com/mitchellh/gox";
-
   src = fetchFromGitHub {
     owner = "mitchellh";
     repo = "gox";
@@ -13,9 +16,21 @@ buildGoPackage rec {
     sha256 = "0mkh81hd7kn45dz7b6yhzqsg2mvg1g6pwx89jjigxrnqhyg9vrl7";
   };
 
+  vendorSha256 = null;
+
+  # This is required for wrapProgram.
+  allowGoReference = true;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  postFixup = ''
+    wrapProgram $out/bin/gox --prefix PATH : ${lib.makeBinPath [ go ]}
+  '';
+
   meta = with lib; {
     homepage = "https://github.com/mitchellh/gox";
     description = "A dead simple, no frills Go cross compile tool";
     license = licenses.mpl20;
+    maintainers = with maintainers; [ azahi ];
   };
 }
diff --git a/pkgs/development/tools/yarn/default.nix b/pkgs/development/tools/yarn/default.nix
index d934eadcdf8..b3bc6bc62b9 100644
--- a/pkgs/development/tools/yarn/default.nix
+++ b/pkgs/development/tools/yarn/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "yarn";
-  version = "1.22.18";
+  version = "1.22.19";
 
   src = fetchzip {
     url = "https://github.com/yarnpkg/yarn/releases/download/v${version}/yarn-v${version}.tar.gz";
-    sha256 = "sha256-gI4v/WPWrNa2i2oct8Ns7bpDzmDCy+c86pGKpNznhh0=";
+    sha256 = "sha256-12wUuWH+kkqxAgVYkyhIYVtexjv8DFP9kLpFLWg+h0o=";
   };
 
   buildInputs = [ nodejs ];
diff --git a/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix b/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix
index 67c9b91594b..c36ad127e80 100644
--- a/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix
+++ b/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix
@@ -359,7 +359,7 @@ in rec {
         runHook postInstall
       '';
 
-      doDist = true;
+      doDist = attrs.doDist or true;
 
       distPhase = attrs.distPhase or ''
         # pack command ignores cwd option
diff --git a/pkgs/servers/matrix-appservice-discord/default.nix b/pkgs/servers/matrix-appservice-discord/default.nix
index 95b541cdd1b..bc8b183ad8e 100644
--- a/pkgs/servers/matrix-appservice-discord/default.nix
+++ b/pkgs/servers/matrix-appservice-discord/default.nix
@@ -62,10 +62,7 @@ in mkYarnPackage rec {
   '';
 
   # don't generate the dist tarball
-  # (`doDist = false` does not work in mkYarnPackage)
-  distPhase = ''
-    true
-  '';
+  doDist = false;
 
   passthru = {
     nodeAppDir = "libexec/${pname}/deps/${pname}";
diff --git a/pkgs/tools/misc/fclones/default.nix b/pkgs/tools/misc/fclones/default.nix
index 1f7bab8cb96..e257d2ad4c8 100644
--- a/pkgs/tools/misc/fclones/default.nix
+++ b/pkgs/tools/misc/fclones/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fclones";
-  version = "0.25.0";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "pkolaczk";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-7MNVLfBH6hWoNy+UQzK6gwZuPbBPMfG660my+E6FT5Q=";
+    sha256 = "sha256-GimCHMUUjD1q5CfKXKtucIs/HLIJZnIbp+wtN+/jjhY=";
   };
 
-  cargoSha256 = "sha256-8Ur3KwGuIY8QAGNTcyTpFg2C1CBcIpZJp6EO9g8XuE8=";
+  cargoSha256 = "sha256-/qSaPvI4K9AinewMlsCp2funJrZtwvoBUQ6816NQ8zw=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     AppKit
diff --git a/pkgs/tools/misc/fluent-bit/default.nix b/pkgs/tools/misc/fluent-bit/default.nix
index ea9cad45139..ab571b98778 100644
--- a/pkgs/tools/misc/fluent-bit/default.nix
+++ b/pkgs/tools/misc/fluent-bit/default.nix
@@ -19,7 +19,13 @@ stdenv.mkDerivation rec {
   cmakeFlags = [ "-DFLB_METRICS=ON" "-DFLB_HTTP_SERVER=ON" ];
 
   # _FORTIFY_SOURCE requires compiling with optimization (-O)
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-O";
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [ "-O" ]
+    # Workaround build failure on -fno-common toolchains:
+    #   ld: /monkey/mk_tls.h:81: multiple definition of `mk_tls_server_timeout';
+    #     flb_config.c.o:include/monkey/mk_tls.h:81: first defined here
+    # TODO: drop when upstream gets a fix for it:
+    #   https://github.com/fluent/fluent-bit/issues/5537
+    ++ lib.optionals stdenv.isDarwin [ "-fcommon" ];
 
   outputs = [ "out" "dev" ];
 
diff --git a/pkgs/tools/security/sudo/default.nix b/pkgs/tools/security/sudo/default.nix
index 5385a9aba35..269bb1ccc12 100644
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sudo";
-  version = "1.9.10";
+  version = "1.9.11p1";
 
   src = fetchurl {
     url = "https://www.sudo.ws/dist/${pname}-${version}.tar.gz";
-    sha256 = "sha256-RKFGEJjnx7jmrFl0mcJPsuQ3SMDBOai0lE5X0TSaZPQ=";
+    sha256 = "sha256-64tsGmmprfS4IDC2bZnXkhTXy6UDGgvkMQOmF2sWJUs=";
   };
 
   prePatch = ''
diff --git a/pkgs/tools/text/ugrep/default.nix b/pkgs/tools/text/ugrep/default.nix
index f3e3d00aeee..38c91298581 100644
--- a/pkgs/tools/text/ugrep/default.nix
+++ b/pkgs/tools/text/ugrep/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ugrep";
-  version = "3.7.9";
+  version = "3.8.2";
 
   src = fetchFromGitHub {
     owner = "Genivia";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ZY3pihHU5FLu41vKrM/U06iZZ6D/LSuoyy2gHJJqRFY=";
+    sha256 = "sha256-Y6Ed1xPguiDPWrZCxcnJOZxvUHlS6fl2jyjaC3AmG68=";
   };
 
   buildInputs = [