Merge master into staging-next

21 files changed, 279 insertions, 90 deletions

diff --git a/pkgs/development/compilers/haxe/default.nix b/pkgs/development/compilers/haxe/default.nix
index 58451192396..73b82ff48db 100644
--- a/pkgs/development/compilers/haxe/default.nix
+++ b/pkgs/development/compilers/haxe/default.nix
@@ -1,20 +1,44 @@
-{ lib, stdenv, fetchgit, coreutils, ocamlPackages, zlib, pcre, neko }:
-
-let inherit (ocamlPackages) ocaml camlp4; in
+{ lib, stdenv, fetchFromGitHub, coreutils, ocaml-ng, zlib, pcre, neko, mbedtls }:
 
 let
-  generic = { version, sha256, prePatch }:
+  ocamlDependencies = version:
+    if lib.versionAtLeast version "4.0"
+    then with ocaml-ng.ocamlPackages; [
+      ocaml
+      findlib
+      sedlex_2
+      xml-light
+      ptmap
+      camlp5
+      sha
+      dune_2
+      luv
+      ocaml_extlib
+    ] else with ocaml-ng.ocamlPackages_4_05; [
+      ocaml
+      camlp4
+    ];
+
+  defaultPatch = ''
+    substituteInPlace extra/haxelib_src/src/haxelib/client/Main.hx \
+      --replace '"neko"' '"${neko}/bin/neko"'
+  '';
+
+  generic = { sha256, version, prePatch ? defaultPatch }:
     stdenv.mkDerivation {
       pname = "haxe";
       inherit version;
 
-      buildInputs = [ocaml zlib pcre neko camlp4];
+      buildInputs = [ zlib pcre neko ]
+        ++ lib.optional (lib.versionAtLeast version "4.1") [ mbedtls ]
+        ++ ocamlDependencies version;
 
-      src = fetchgit {
-        url = "https://github.com/HaxeFoundation/haxe.git";
-        inherit sha256;
+      src = fetchFromGitHub {
+        owner = "HaxeFoundation";
+        repo = "haxe";
+        rev = version;
         fetchSubmodules = true;
-        rev = "refs/tags/${version}";
+        inherit sha256;
       };
 
       inherit prePatch;
@@ -77,8 +101,8 @@ let
       meta = with lib; {
         description = "Programming language targeting JavaScript, Flash, NekoVM, PHP, C++";
         homepage = "https://haxe.org";
-        license = with licenses; [ gpl2 bsd2 /*?*/ ];  # -> docs/license.txt
-        maintainers = [ maintainers.marcweber ];
+        license = with licenses; [ gpl2Plus mit ]; # based on upstream opam file
+        maintainers = [ maintainers.marcweber maintainers.locallycompact ];
         platforms = platforms.linux ++ platforms.darwin;
       };
     };
@@ -89,15 +113,20 @@ in {
     sha256 = "1x9ay5a2llq46fww3k07jxx8h1vfpyxb522snc6702a050ki5vz3";
     prePatch = ''
       sed -i -e 's|"/usr/lib/haxe/std/";|"'"$out/lib/haxe/std/"'";\n&|g' main.ml
-      sed -i -e 's|"neko"|"${neko}/bin/neko"|g' extra/haxelib_src/src/tools/haxelib/Main.hx
+      substituteInPlace extra/haxelib_src/src/tools/haxelib/Main.hx \
+        --replace '"neko"' '"${neko}/bin/neko"'
     '';
   };
   haxe_3_4 = generic {
     version = "3.4.6";
     sha256 = "1myc4b8fwp0f9vky17wv45n34a583f5sjvajsc93f5gm1wanp4if";
     prePatch = ''
+      ${defaultPatch}
       sed -i -re 's!(let +prefix_path += +).*( +in)!\1"'"$out/"'"\2!' src/main.ml
-      sed -i -e 's|"neko"|"${neko}/bin/neko"|g' extra/haxelib_src/src/haxelib/client/Main.hx
     '';
   };
+  haxe_4_2 = generic {
+    version = "4.2.1";
+    sha256 = "sha256-0j6M21dh8DB1gC/bPYNJrVuDbJyqQbP+61ItO5RBUcA=";
+  };
 }
diff --git a/pkgs/development/compilers/neko/default.nix b/pkgs/development/compilers/neko/default.nix
index 8b157fb4ca0..52606781935 100644
--- a/pkgs/development/compilers/neko/default.nix
+++ b/pkgs/development/compilers/neko/default.nix
@@ -1,14 +1,16 @@
-{ lib, stdenv, fetchurl, boehmgc, zlib, sqlite, pcre, cmake, pkg-config
+{ lib, stdenv, fetchFromGitHub, boehmgc, zlib, sqlite, pcre, cmake, pkg-config
 , git, apacheHttpd, apr, aprutil, libmysqlclient, mbedtls, openssl, pkgs, gtk2, libpthreadstubs
 }:
 
 stdenv.mkDerivation rec {
   pname = "neko";
-  version = "2.2.0";
+  version = "2.3.0";
 
-  src = fetchurl {
-    url = "https://nekovm.org/media/neko-${version}-src.tar.gz";
-    sha256 = "1qv47zaa0vzhjlq5wb71627n7dbsxpc1gqpg0hsngjxnbnh1q46g";
+  src = fetchFromGitHub {
+    owner = "HaxeFoundation";
+    repo = "neko";
+    rev = "v${lib.replaceStrings [ "." ] [ "-" ] version}";
+    sha256 = "19rc59cx7qqhcqlb0znwbnwbg04c1yq6xmvrwm1xi46k3vxa957g";
   };
 
   nativeBuildInputs = [ cmake pkg-config git ];
@@ -31,8 +33,17 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A high-level dynamically typed programming language";
     homepage = "https://nekovm.org";
-    license = licenses.lgpl21;
-    maintainers = [ maintainers.marcweber ];
+    license = [
+      # list based on https://github.com/HaxeFoundation/neko/blob/v2-3-0/LICENSE
+      licenses.gpl2Plus    # nekoc, nekoml
+      licenses.lgpl21Plus  # mysql.ndll
+      licenses.bsd3        # regexp.ndll
+      licenses.zlib        # zlib.ndll
+      licenses.asl20       # mod_neko, mod_tora, mbedTLS
+      licenses.mit         # overall, other libs
+      "https://github.com/HaxeFoundation/neko/blob/v2-3-0/LICENSE#L24-L40" # boehm gc
+    ];
+    maintainers = [ maintainers.marcweber maintainers.locallycompact ];
     platforms = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/pkgs/development/ocaml-modules/git/default.nix b/pkgs/development/ocaml-modules/git/default.nix
index 0fd66226e36..b8d73178d09 100644
--- a/pkgs/development/ocaml-modules/git/default.nix
+++ b/pkgs/development/ocaml-modules/git/default.nix
@@ -8,14 +8,14 @@
 
 buildDunePackage rec {
   pname = "git";
-  version = "3.3.2";
+  version = "3.3.3";
 
   minimumOCamlVersion = "4.08";
   useDune2 = true;
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-git/releases/download/${version}/git-${version}.tbz";
-    sha256 = "01xcjggsb13n6018lp6ic0f6pglfl39qcg126h1k3da19hvpzhrv";
+    sha256 = "0j8pw9w74bfhrjsqr8zm8g7h1az94z9vg7qgc6z6649zm9yjiax3";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/asttokens/default.nix b/pkgs/development/python-modules/asttokens/default.nix
index 0f090d14aba..ecbbfa90911 100644
--- a/pkgs/development/python-modules/asttokens/default.nix
+++ b/pkgs/development/python-modules/asttokens/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchPypi, buildPythonPackage,
+{ lib, fetchPypi, fetchpatch, buildPythonPackage,
   setuptools_scm, toml, six, astroid, pytest
 }:
 
@@ -11,6 +11,16 @@ buildPythonPackage rec {
     sha256 = "0a2ixiz04aw4p0aivxh47k3fa9ql804l3y5iv5gcih9aizi5fbm4";
   };
 
+  patches = [
+    # Fixes compatibility with python 3.9, will be included in the next release
+    # after 2.0.4
+    (fetchpatch {
+      url = "https://github.com/gristlabs/asttokens/commit/d8ff80ee7d2e64c5e1daf50cc38eb99663f1b1ac.patch";
+      sha256 = "19y8n8vpzr2ijldbq5rh19sf0vz5azqqpkb9bx0ljjg98h6k7kjj";
+      excludes = [ "setup.cfg" ];
+    })
+  ];
+
   propagatedBuildInputs = [ setuptools_scm toml six astroid ];
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/boltons/default.nix b/pkgs/development/python-modules/boltons/default.nix
index f4842981c4a..0986a5dc7c4 100644
--- a/pkgs/development/python-modules/boltons/default.nix
+++ b/pkgs/development/python-modules/boltons/default.nix
@@ -1,19 +1,35 @@
-{ lib, buildPythonPackage, fetchFromGitHub, pytest }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, fetchpatch
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "boltons";
-  version = "20.2.0";
+  version = "20.2.1";
 
   # No tests in PyPi Tarball
   src = fetchFromGitHub {
     owner = "mahmoud";
     repo = "boltons";
     rev = version;
-    sha256 = "08rd6av8dp5n1vz6nybmayl1mfsmj66cskiaybfshcgix29ca803";
+    sha256 = "0vw0h0z81gfxgjfijqiza92ic0siv9xy65mklgj5d0dzr1k9waw8";
   };
 
-  checkInputs = [ pytest ];
-  checkPhase = "pytest tests";
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/mahmoud/boltons/commit/754afddf141ea26956c88c7e13fe5e7ca7942654.patch";
+      sha256 = "14kcq8pl4pmgcnlnmj1sh1yrksgym0kn0kgz2648g192svqkbpz8";
+    })
+  ];
+
+  checkInputs = [ pytestCheckHook ];
+  disabledTests = [
+    # This test is broken without this PR, which has not yet been merged
+    # https://github.com/mahmoud/boltons/pull/283
+    "test_frozendict_ior"
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/mahmoud/boltons";
diff --git a/pkgs/development/python-modules/cmarkgfm/default.nix b/pkgs/development/python-modules/cmarkgfm/default.nix
index 5b94dc78cd6..7379d6dc6c9 100644
--- a/pkgs/development/python-modules/cmarkgfm/default.nix
+++ b/pkgs/development/python-modules/cmarkgfm/default.nix
@@ -1,25 +1,29 @@
-{ lib, buildPythonPackage, fetchPypi, cffi, pytest }:
+{ lib
+, buildPythonPackage
+, cffi
+, fetchPypi
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "cmarkgfm";
-  version = "0.5.2";
+  version = "0.5.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e7d65b90645faa55c28886d01f658235af08b4c4edbf9d959518a17007dd20b4";
+    sha256 = "sha256-tqVJq6Mnq9mG1nSM8hyGN9dBx2hQ5/773vjSi/4TjjI=";
   };
 
   propagatedBuildInputs = [ cffi ];
 
-  checkInputs = [ pytest ];
+  checkInputs = [ pytestCheckHook ];
 
-  checkPhase = ''
-    py.test
-  '';
+  pythonImportsCheck = [ "cmarkgfm" ];
 
   meta = with lib; {
     description = "Minimal bindings to GitHub's fork of cmark";
     homepage = "https://github.com/jonparrott/cmarkgfm";
     license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/cupy/default.nix b/pkgs/development/python-modules/cupy/default.nix
index d4b42ac83e8..f5d262f0b8f 100644
--- a/pkgs/development/python-modules/cupy/default.nix
+++ b/pkgs/development/python-modules/cupy/default.nix
@@ -1,33 +1,35 @@
 { lib, buildPythonPackage
-, fetchPypi, isPy3k, linuxPackages
-, fastrlock, numpy, six, wheel, pytest, mock, setuptools
+, fetchPypi, isPy3k, cython
+, fastrlock, numpy, six, wheel, pytestCheckHook, mock, setuptools
 , cudatoolkit, cudnn, cutensor, nccl
+, addOpenGLRunpath
 }:
 
 buildPythonPackage rec {
   pname = "cupy";
-  version = "8.4.0";
+  version = "8.5.0";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "58d19af6b2e83388d4f0f6ca4226bae4b947920d2ca4951c2eddc8bc78abf66b";
+    sha256 = "fb3f8d3b3454beb249b9880502a45fe493c5a44efacc4c72914cbe1a5dbdf803";
   };
 
-  checkInputs = [
-    pytest
-    mock
-  ];
-
   preConfigure = ''
-      export CUDA_PATH=${cudatoolkit}
+    export CUDA_PATH=${cudatoolkit}
   '';
 
+  nativeBuildInputs = [
+    addOpenGLRunpath
+    cython
+  ];
+
+  LDFLAGS = "-L${cudatoolkit}/lib/stubs";
+
   propagatedBuildInputs = [
     cudatoolkit
     cudnn
     cutensor
-    linuxPackages.nvidia_x11
     nccl
     fastrlock
     numpy
@@ -36,8 +38,20 @@ buildPythonPackage rec {
     wheel
   ];
 
-  # In python3, test was failed...
-  doCheck = !isPy3k;
+  checkInputs = [
+    pytestCheckHook
+    mock
+  ];
+
+  # Won't work with the GPU, whose drivers won't be accessible from the build
+  # sandbox
+  doCheck = false;
+
+  postFixup = ''
+    find $out -type f \( -name '*.so' -or -name '*.so.*' \) | while read lib; do
+      addOpenGLRunpath "$lib"
+    done
+  '';
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/python-modules/iminuit/default.nix b/pkgs/development/python-modules/iminuit/default.nix
new file mode 100644
index 00000000000..5bfb66fe4c6
--- /dev/null
+++ b/pkgs/development/python-modules/iminuit/default.nix
@@ -0,0 +1,26 @@
+{ lib, buildPythonPackage, isPy3k, fetchPypi, cmake, numpy, pytestCheckHook }:
+
+buildPythonPackage rec {
+  pname = "iminuit";
+  version = "2.4.0";
+  disabled = !isPy3k;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "350c13d33f3ec5884335aea1cc11a17ae49dd8e6b2181c3f1b3c9c27e2e0b228";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  propagatedBuildInputs = [ numpy ];
+
+  dontUseCmakeConfigure = true;
+
+  checkInputs = [ pytestCheckHook ];
+
+  meta = with lib; {
+    homepage = "https://github.com/scikit-hep/iminuit";
+    description = "Python interface for the Minuit2 C++ library";
+    license = with licenses; [ mit lgpl2Only ];
+    maintainers = with maintainers; [ veprbl ];
+  };
+}
diff --git a/pkgs/development/python-modules/libagent/default.nix b/pkgs/development/python-modules/libagent/default.nix
index 47be977755c..5334513e23c 100644
--- a/pkgs/development/python-modules/libagent/default.nix
+++ b/pkgs/development/python-modules/libagent/default.nix
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Using hardware wallets as SSH/GPG agent";
     homepage = "https://github.com/romanz/trezor-agent";
-    license = licenses.gpl3;
+    license = licenses.lgpl3Only;
     maintainers = with maintainers; [ np ];
   };
 }
diff --git a/pkgs/development/python-modules/ndjson/default.nix b/pkgs/development/python-modules/ndjson/default.nix
index 715a1989b45..b69e8401eb5 100644
--- a/pkgs/development/python-modules/ndjson/default.nix
+++ b/pkgs/development/python-modules/ndjson/default.nix
@@ -16,6 +16,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/rhgrant10/ndjson";
     description = "JsonDecoder";
     platforms = platforms.unix;
+    license = licenses.gpl3Only;
     maintainers = with maintainers; [ freezeboy ];
   };
 }
diff --git a/pkgs/development/python-modules/pkutils/default.nix b/pkgs/development/python-modules/pkutils/default.nix
index d674e876b14..c383f5ff86c 100644
--- a/pkgs/development/python-modules/pkutils/default.nix
+++ b/pkgs/development/python-modules/pkutils/default.nix
@@ -1,5 +1,4 @@
 { lib
-, pythonOlder
 , buildPythonPackage
 , isPy3k
 , fetchFromGitHub
diff --git a/pkgs/development/python-modules/pykodi/default.nix b/pkgs/development/python-modules/pykodi/default.nix
new file mode 100644
index 00000000000..24450270a83
--- /dev/null
+++ b/pkgs/development/python-modules/pykodi/default.nix
@@ -0,0 +1,22 @@
+{ lib, buildPythonPackage, fetchPypi, aiohttp, jsonrpc-async, jsonrpc-websocket }:
+
+buildPythonPackage rec {
+  pname = "pykodi";
+  version = "0.2.3";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "099xyn5aql5mdim6kh4hwx0fg1a3bx73qdvwr48nz23cljmmk1m8";
+  };
+
+  propagatedBuildInputs = [ aiohttp jsonrpc-async jsonrpc-websocket ];
+
+  pythonImportsCheck = [ "pykodi" ];
+
+  meta = with lib; {
+    description = "An async python interface for Kodi over JSON-RPC";
+    homepage = "https://github.com/OnFreund/PyKodi";
+    license = licenses.mit;
+    maintainers = with maintainers; [ sephalon ];
+  };
+}
diff --git a/pkgs/development/python-modules/salmon-mail/default.nix b/pkgs/development/python-modules/salmon-mail/default.nix
index 0b8edf8bdd9..52aa8a98e1e 100644
--- a/pkgs/development/python-modules/salmon-mail/default.nix
+++ b/pkgs/development/python-modules/salmon-mail/default.nix
@@ -28,7 +28,7 @@ buildPythonPackage rec {
   meta = with lib; {
     homepage = "https://salmon-mail.readthedocs.org/";
     description = "Pythonic mail application server";
-    license = licenses.gpl3;
+    license = licenses.gpl3Only;
     maintainers = with maintainers; [ jluttine ];
   };
 }
diff --git a/pkgs/development/python-modules/semver/default.nix b/pkgs/development/python-modules/semver/default.nix
index c281a6d6b0d..cb4578671b9 100644
--- a/pkgs/development/python-modules/semver/default.nix
+++ b/pkgs/development/python-modules/semver/default.nix
@@ -1,27 +1,34 @@
 { lib
-, fetchFromGitHub
 , buildPythonPackage
+, fetchFromGitHub
+, pytest-cov
 , pytestCheckHook
-, pytestcov
 }:
 
 buildPythonPackage rec {
   pname = "semver";
-  version = "2.10.2";
+  version = "2.13.0";
 
   src = fetchFromGitHub {
     owner = "python-semver";
     repo = "python-semver";
     rev = version;
-    sha256 = "0yxjmcgk5iwp53l9z1cg0ajrj18i09ircs11ifpdrggzm8n1blf3";
+    sha256 = "sha256-IWTo/P9JRxBQlhtcH3JMJZZrwAA8EALF4dtHajWUc4w=";
   };
 
-  preCheck = "rm -rf dist"; # confuses source vs dist imports in pytest
-  checkInputs = [ pytestCheckHook pytestcov ];
+  checkInputs = [
+    pytest-cov
+    pytestCheckHook
+  ];
+
+  # Confuses source vs dist imports in pytest
+  preCheck = "rm -r dist";
+
+  pythonImportsCheck = [ "semver" ];
 
   meta = with lib; {
     description = "Python package to work with Semantic Versioning (http://semver.org/)";
-    homepage = "https://python-semver.readthedocs.io/en/latest/";
+    homepage = "https://python-semver.readthedocs.io/";
     license = licenses.bsd3;
     maintainers = with maintainers; [ np ];
   };
diff --git a/pkgs/development/python-modules/ytmusicapi/default.nix b/pkgs/development/python-modules/ytmusicapi/default.nix
index ed4a4165680..f84db4ff624 100644
--- a/pkgs/development/python-modules/ytmusicapi/default.nix
+++ b/pkgs/development/python-modules/ytmusicapi/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "ytmusicapi";
-  version = "0.14.3";
+  version = "0.15.0";
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "83251a95d5bd74116353d29dfda2d0c5055b88276a0876a313a66f8b9c691344";
+    sha256 = "sha256-pVQqoMvuuFc/1QNG5z/AspGlgIGPi9aqjZ3/3eVNhis=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/asmfmt/default.nix b/pkgs/development/tools/asmfmt/default.nix
index c93b864b70f..dca74fa76b7 100644
--- a/pkgs/development/tools/asmfmt/default.nix
+++ b/pkgs/development/tools/asmfmt/default.nix
@@ -1,12 +1,11 @@
 { buildGoPackage
 , lib
 , fetchFromGitHub
-, fetchpatch
 }:
 
 buildGoPackage rec {
   pname = "asmfmt";
-  version = "1.2.1";
+  version = "1.2.3";
 
   goPackagePath = "github.com/klauspost/asmfmt";
 
@@ -14,7 +13,7 @@ buildGoPackage rec {
     owner = "klauspost";
     repo = "asmfmt";
     rev = "v${version}";
-    sha256 = "0qwxb4yx12yl817vgbhs7acaj98lgk27dh50mb8sm9ccw1f43h9i";
+    sha256 = "0f2cgwxs2b2kpq5348h8hjkcqc40p8ajapzpcy9ia2fsmsn2a2s4";
   };
 
   goDeps = ./deps.nix;
diff --git a/pkgs/development/tools/buf/default.nix b/pkgs/development/tools/buf/default.nix
new file mode 100644
index 00000000000..fc232d55da6
--- /dev/null
+++ b/pkgs/development/tools/buf/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, protobuf
+}:
+
+buildGoModule rec {
+  pname = "buf";
+  version = "0.40.0";
+
+  src = fetchFromGitHub {
+    owner = "bufbuild";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-N6o+1cfer8rgKJ3+CL25axJSjGV/YSG1sLIHXJzsC6o=";
+  };
+
+  patches = [
+    ./skip_test_requiring_network.patch
+  ];
+
+  preCheck = ''
+    export PATH=$PATH:$GOPATH/bin
+  '';
+
+  nativeBuildInputs = [ protobuf ];
+
+  vendorSha256 = "sha256-vl+WqtpegoAvylx/lcyfJk8DAOub8U4Lx3Pe3eW4M/E=";
+
+  meta = with lib; {
+    description = "Create consistent Protobuf APIs that preserve compatibility and comply with design best-practices";
+    homepage = "https://buf.build";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ raboof ];
+  };
+}
diff --git a/pkgs/development/tools/buf/skip_test_requiring_network.patch b/pkgs/development/tools/buf/skip_test_requiring_network.patch
new file mode 100644
index 00000000000..8d3e15c17ff
--- /dev/null
+++ b/pkgs/development/tools/buf/skip_test_requiring_network.patch
@@ -0,0 +1,15 @@
+diff --git a/internal/buf/internal/buftesting/buftesting.go b/internal/buf/internal/buftesting/buftesting.go
+index dc8da0c..70ad299 100644
+--- a/internal/buf/internal/buftesting/buftesting.go
++++ b/internal/buf/internal/buftesting/buftesting.go
+@@ -100,6 +100,10 @@ func RunActualProtoc(
+ 
+ // GetGoogleapisDirPath gets the path to a clone of googleapis.
+ func GetGoogleapisDirPath(t *testing.T, buftestingDirPath string) string {
++	// Requires network access, which is not available during
++	// the nixpkgs sandboxed build
++	t.Skip()
++
+ 	googleapisDirPath := filepath.Join(buftestingDirPath, testGoogleapisDirPath)
+ 	require.NoError(
+ 		t,
diff --git a/pkgs/development/tools/electron/default.nix b/pkgs/development/tools/electron/default.nix
index 9d4c7d6e692..518eef2d1a0 100644
--- a/pkgs/development/tools/electron/default.nix
+++ b/pkgs/development/tools/electron/default.nix
@@ -86,30 +86,30 @@ rec {
     headers = "0yx8mkrm15ha977hzh7g2sc5fab9sdvlk1bk3yxignhxrqqbw885";
   };
 
-  electron_10 = mkElectron "10.4.0" {
-    x86_64-linux = "6246481577bc0bfa719e0efb3144e8d7ca53e3f20defce7b5e1be4d9feb0becb";
-    x86_64-darwin = "bc9e201643db3dae803db934fa4e180d13b707de6be1c3348ca5ed2c21d30bf4";
-    i686-linux = "aa6a9042097b964230b519c158e369a249a668cc6c7654b30ddd02ced4bad9d1";
-    armv7l-linux = "7e99a9c6aeedd7cc0b25260ac4630730629f363a09b72bd024b42837ab9777bd";
-    aarch64-linux = "ef671fe3cbb7c84e277d885ed157552602bc88d326dc95b322953c6b193f59a1";
-    headers = "1vsvna2zr7qxnk2qsdjzgkv5v2svrllbsjj08qrilly7nbksk9fg";
+  electron_10 = mkElectron "10.4.2" {
+    x86_64-linux = "3d613b413f01c8af1600be42c82941761452407e1160125eca60feec0d7dd0c0";
+    x86_64-darwin = "87b18811d165f2fd64606ae13a567b737f54bd41c7e2204a047a3532f4fa2d9c";
+    i686-linux = "297083ca9b21554ea1f729ed17c0c8b13aaea24e77194f9c1b340489fcfc0fa6";
+    armv7l-linux = "3d93ec220824cce5d99b3a7511604b89c63935bd1130fc64ce08b8436e34c096";
+    aarch64-linux = "0060e37eada91bac51945ae325ab04309438609089d31ab3f8bbfda73cc26166";
+    headers = "13cpkblkvhvd3sww8n1gw4rhva84x2fkkg81yr3n2mb0virlfgpn";
   };
 
-  electron_11 = mkElectron "11.3.0" {
-    x86_64-linux = "136794f9ecc1c6ea38fe9b85682e8fcc8c4afd559f5cd6b4059339b017279917";
-    x86_64-darwin = "7569db1d2e470b0db512735f27f99498f631da3cd86374345139f18df88789fe";
-    i686-linux = "48ab133cab380c564529ea605d4521404b9bd07d80dad6346e1756a0952081cd";
-    armv7l-linux = "5774c2995c6dcf911ece00a94ace0f37d55132da91b1fd242c69e047872ef137";
-    aarch64-linux = "fad31c6fba7aba54db19a2aaedb03b514c51dd58bf301afab5265126833feb15";
-    headers = "123g3dgsb4vp8w1bm4apbp973ppzx4i4y35lhhmqjbp51jhrm9f0";
+  electron_11 = mkElectron "11.4.1" {
+    x86_64-linux = "3efd3d3b5a9f71323320288aece65fcec89ea0331c3d6d3afc2495d3b0dc95d3";
+    x86_64-darwin = "6ff91613c51b2ebaf280eb86b826f47d62639081a0f38c2012c428a17619a163";
+    i686-linux = "513e1bc7a3e546dc0e712836886ac89c9f76bb7fb1e4b7a1f9d9cbc7347d8569";
+    armv7l-linux = "838fc96d90cfcc5e1e892287008f9d9d2dbe27f3d4cf2479e6275ecdd140fb65";
+    aarch64-linux = "a3de4208b5033a19ffa9dd8130d440909b181c0ef57cb51c8f9c8dbbb1267a26";
+    headers = "1bpsmmlxl4gk9yn5w7f8m6g8k1gmvwk0jwpqlk5islpkcy6x7107";
   };
 
-  electron_12 = mkElectron "12.0.1" {
-    x86_64-linux = "495cd0df420becbd9581b8833fa8bdefaef397fc3590d064932722d55cf5ff82";
-    x86_64-darwin = "af2adac0b5b32c95ad2b834d5521bd301983954e986048b46cdf5c739423de17";
-    i686-linux = "4a41d03ef38eda8d50dc57774f49f676398a2130783c2c9a3411e7018ef77e2b";
-    armv7l-linux = "ae06d70d34abc06c7127a468ab0956a4a26752cc313ab1b802972748e952a3a7";
-    aarch64-linux = "95716be616ab690c2e78236715fe52ae57b4213fe1c19dc08593ae1e75b8767e";
-    headers = "1gxzafzi47wrvwrzmll5zff7dzw4jk2p5pdkzgazr2yxkhw9qvca";
+  electron_12 = mkElectron "12.0.2" {
+    x86_64-linux = "fc3ff888d8cd4ada8368420c8951ed1b5ad78919bdcb688abe698d00e12a2e0a";
+    x86_64-darwin = "766ca8f8adc4535db3069665ea8983979ea79dd5ec376e1c298f858b420ec58f";
+    i686-linux = "78ab55db275b85210c6cc14ddf41607fbd5cefed93ef4d1b6b74630b0841b23c";
+    armv7l-linux = "8be8c6ea05da669d79179c5969ddee853710a1dd44f86e8f3bbe1167a2daf13c";
+    aarch64-linux = "9ef70ab9347be63555784cac99efbaff1ef2d02dcc79070d7bccd18c38de87ef";
+    headers = "07095b5rylilbmyd0syamm6fc4pngazldj5jgm7blgirdi8yzzd2";
   };
 }
diff --git a/pkgs/development/tools/rust/sqlx-cli/default.nix b/pkgs/development/tools/rust/sqlx-cli/default.nix
index c6f34a9e20d..5c4f40bbd09 100644
--- a/pkgs/development/tools/rust/sqlx-cli/default.nix
+++ b/pkgs/development/tools/rust/sqlx-cli/default.nix
@@ -1,4 +1,4 @@
-{ lib, rustPlatform, fetchFromGitHub, pkg-config, openssl }:
+{ stdenv, lib, rustPlatform, fetchFromGitHub, pkg-config, openssl, SystemConfiguration, CoreFoundation, Security }:
 
 rustPlatform.buildRustPackage rec {
   pname = "sqlx-cli";
@@ -17,7 +17,8 @@ rustPlatform.buildRustPackage rec {
   cargoBuildFlags = [ "-p sqlx-cli" ];
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ openssl ];
+  buildInputs = lib.optionals stdenv.isLinux [ openssl ]
+    ++ lib.optionals stdenv.isDarwin [ SystemConfiguration CoreFoundation Security ];
 
   meta = with lib; {
     description =
diff --git a/pkgs/development/tools/wabt/default.nix b/pkgs/development/tools/wabt/default.nix
index 27b11870a89..aaffa4f8213 100644
--- a/pkgs/development/tools/wabt/default.nix
+++ b/pkgs/development/tools/wabt/default.nix
@@ -1,20 +1,19 @@
-{ lib, stdenv, fetchpatch, fetchFromGitHub, cmake, python3, substituteAll }:
+{ lib, stdenv, fetchFromGitHub, cmake }:
 
 stdenv.mkDerivation rec {
   pname = "wabt";
-  version = "1.0.20";
+  version = "1.0.23";
 
   src = fetchFromGitHub {
     owner = "WebAssembly";
     repo = "wabt";
     rev = version;
-    sha256 = "1wwyljppxz03slvgx809g87mdrglpimz4xaici71a9mqwjpgj0l8";
+    sha256 = "1drjngcqkaahzk92jysrzv86fhj02c074xffd7kn3k6q8fxc0976";
     fetchSubmodules = true;
   };
 
   nativeBuildInputs = [ cmake ];
   cmakeFlags = [ "-DBUILD_TESTS=OFF" "-DCMAKE_PROJECT_VERSION=${version}" ];
-  buildInputs = [ python3 ];
 
   meta = with lib; {
     description = "The WebAssembly Binary Toolkit";