Merge release-21.11 into staging-next-21.11

2026-09-30 11:50:06 +00:00 · 2021-12-04 00:09:11 +00:00
parent 6cb2febbc1 2e9ef0023d
commit f7be4ba5a4
39 changed files with 339 additions and 223 deletions
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@@ -1,9 +1,5 @@
 <section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-release-21.11">
  <title>Release 21.11 (“Porcupine”, 2021/11/30)</title>
-  <para>
-    In addition to numerous new and upgraded packages, this release has
-    the following highlights:
-  </para>
  <itemizedlist spacing="compact">
    <listitem>
      <para>
@@ -14,6 +10,10 @@
  </itemizedlist>
  <section xml:id="sec-release-21.11-highlights">
    <title>Highlights</title>
+    <para>
+      In addition to numerous new and upgraded packages, this release
+      has the following highlights:
+    </para>
    <itemizedlist>
      <listitem>
        <para>
@@ -263,14 +263,14 @@
        <para>
          <link xlink:href="https://www.isc.org/kea/">Kea</link>, ISCs
          2nd generation DHCP and DDNS server suite. Available at
-          <link xlink:href="options.html#opt-services.kea">services.kea</link>.
+          <link xlink:href="options.html#opt-services.kea.dhcp4">services.kea</link>.
        </para>
      </listitem>
      <listitem>
        <para>
          <link xlink:href="https://owncast.online/">owncast</link>,
          self-hosted video live streaming solution. Available at
-          <link xlink:href="options.html#opt-services.owncast">services.owncast</link>.
+          <link xlink:href="options.html#opt-services.owncast.enable">services.owncast</link>.
        </para>
      </listitem>
      <listitem>
@@ -278,7 +278,7 @@
          <link xlink:href="https://joinpeertube.org/">PeerTube</link>,
          developed by Framasoft, is the free and decentralized
          alternative to video platforms. Available at
-          <link xlink:href="options.html#opt-services.peertube">services.peertube</link>.
+          <link xlink:href="options.html#opt-services.peertube.enable">services.peertube</link>.
        </para>
      </listitem>
      <listitem>
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@@ -1,11 +1,11 @@
 # Release 21.11 (“Porcupine”, 2021/11/30) {#sec-release-21.11}

-In addition to numerous new and upgraded packages, this release has the following highlights:
-
 - Support is planned until the end of June 2022, handing over to 22.05.

 ## Highlights {#sec-release-21.11-highlights}

+In addition to numerous new and upgraded packages, this release has the following highlights:
+
 - The default Nix version remains at 2.3.16. Nix has not been updated to version 2.4 due to regressions in non-experimental behavior. To upgrade to 2.4, use the `nixos-unstable` branch or set the `nix.package` option to either of `nixFlakes` or `nix_2_4` packages. The `nixUnstable` attribute is a pre-release of Nix 2.5. Read the [release notes](https://discourse.nixos.org/t/nix-2-4-released/15822) for more information on upcoming changes. Please help us improve Nix by providing any [breakage reports](https://github.com/NixOS/nix/issues).

 - `iptables` now uses `nf_tables` backend.
@@ -68,11 +68,11 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [Jibri](https://github.com/jitsi/jibri), a service for recording or streaming a Jitsi Meet conference. Available as [services.jibri](options.html#opt-services.jibri.enable).

- [Kea](https://www.isc.org/kea/), ISCs 2nd generation DHCP and DDNS server suite. Available at [services.kea](options.html#opt-services.kea).
+- [Kea](https://www.isc.org/kea/), ISCs 2nd generation DHCP and DDNS server suite. Available at [services.kea](options.html#opt-services.kea.dhcp4).

- [owncast](https://owncast.online/), self-hosted video live streaming solution. Available at [services.owncast](options.html#opt-services.owncast).
+- [owncast](https://owncast.online/), self-hosted video live streaming solution. Available at [services.owncast](options.html#opt-services.owncast.enable).

- [PeerTube](https://joinpeertube.org/), developed by Framasoft, is the free and decentralized alternative to video platforms. Available at [services.peertube](options.html#opt-services.peertube).
+- [PeerTube](https://joinpeertube.org/), developed by Framasoft, is the free and decentralized alternative to video platforms. Available at [services.peertube](options.html#opt-services.peertube.enable).

 - [sourcehut](https://sr.ht), a collection of tools useful for software development. Available as [services.sourcehut](options.html#opt-services.sourcehut.enable).

--- a/nixos/modules/services/monitoring/prometheus/exporters/postfix.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/postfix.nix
@@ -76,6 +76,9 @@ in
  serviceOpts = {
    serviceConfig = {
      DynamicUser = false;
+      # By default, each prometheus exporter only gets AF_INET & AF_INET6,
+      # but AF_UNIX is needed to read from the `showq`-socket.
+      RestrictAddressFamilies = [ "AF_UNIX" ];
      ExecStart = ''
        ${pkgs.prometheus-postfix-exporter}/bin/postfix_exporter \
          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
--- a/nixos/modules/services/x11/display-managers/lightdm.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm.nix
@@ -312,7 +312,7 @@ in
    };

    systemd.tmpfiles.rules = [
-      "d /run/lightdm 0711 lightdm lightdm 0"
+      "d /run/lightdm 0711 lightdm lightdm -"
      "d /var/cache/lightdm 0711 root lightdm -"
      "d /var/lib/lightdm 1770 lightdm lightdm -"
      "d /var/lib/lightdm-data 1775 lightdm lightdm -"
--- a/nixos/modules/virtualisation/waydroid.nix
+++ b/nixos/modules/virtualisation/waydroid.nix
@@ -18,7 +18,8 @@ let
    /dev/hwbinder = hidl
  '';

-in {
+in
+{

  options.virtualisation.waydroid = {
    enable = mkEnableOption "Waydroid";
@@ -36,6 +37,12 @@ in {
      (isEnabled "ASHMEM")
    ];

+    /* NOTE: we always enable this flag even if CONFIG_PSI_DEFAULT_DISABLED is not on
+      as reading the kernel config is not always possible and on kernels where it's
+      already on it will be no-op
+    */
+    boot.kernelParams = [ "psi=1" ];
+
    environment.etc."gbinder.d/waydroid.conf".source = waydroidGbinderConf;

    environment.systemPackages = with pkgs; [ waydroid ];
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -861,6 +861,9 @@ let
        wait_for_unit("prometheus-postfix-exporter.service")
        wait_for_file("/var/lib/postfix/queue/public/showq")
        wait_for_open_port(9154)
+        wait_until_succeeds(
+            "curl -sSf http://localhost:9154/metrics | grep 'postfix_up{path=\"/var/lib/postfix/queue/public/showq\"} 1'"
+        )
        succeed(
            "curl -sSf http://localhost:9154/metrics | grep 'postfix_smtpd_connects_total 0'"
        )
--- a/pkgs/applications/editors/neovim/utils.nix
+++ b/pkgs/applications/editors/neovim/utils.nix
@@ -177,7 +177,7 @@ let
    assert withPython -> throw "Python2 support has been removed from neovim, please remove withPython and extraPythonPackages.";

    wrapNeovimUnstable neovim (res // {
-      wrapperArgs = lib.escapeShellArgs res.wrapperArgs + extraMakeWrapperArgs;
+      wrapperArgs = lib.escapeShellArgs res.wrapperArgs + " " + extraMakeWrapperArgs;
      wrapRc = (configure != {});
  });
 in
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@@ -1,14 +1,14 @@
 {
-  "version": "14.4.2",
-  "repo_hash": "0zhac96b6p7p9vpj083ajfsj5a2fwkv602zxv79cjvpd924c5ws2",
-  "yarn_hash": "0l0lgcgxaira980a1y550pfsm4f2pw97gi8s5pghyfil2v2lyxyw",
+  "version": "14.5.0",
+  "repo_hash": "sha256-HKm2zxr9jHN5NvoKoR0YnEsna84oz+ax6BYmDiWrODc=",
+  "yarn_hash": "081c06ds723mv95ivpnlh3ida2ra3brrm1lzfh2pmlg5wz9vi1cs",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v14.4.2-ee",
+  "rev": "v14.5.0-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "14.4.2",
-    "GITLAB_PAGES_VERSION": "1.46.0",
-    "GITLAB_SHELL_VERSION": "13.21.1",
-    "GITLAB_WORKHORSE_VERSION": "14.4.2"
+    "GITALY_SERVER_VERSION": "14.5.0",
+    "GITLAB_PAGES_VERSION": "1.48.0",
+    "GITLAB_SHELL_VERSION": "13.22.0",
+    "GITLAB_WORKHORSE_VERSION": "14.5.0"
  }
 }
--- a/pkgs/applications/version-management/gitlab/gitaly/Gemfile
+++ b/pkgs/applications/version-management/gitlab/gitaly/Gemfile
@@ -1,6 +1,6 @@
 source 'https://rubygems.org'

-gem 'rugged', '~> 1.1'
+gem 'rugged', '~> 1.2'
 gem 'github-linguist', '~> 7.12', require: 'linguist'
 gem 'gitlab-markup', '~> 1.7.1'
 gem 'activesupport', '~> 6.1.4.1'
--- a/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
@@ -121,7 +121,7 @@ GEM
    parallel (1.19.2)
    parser (2.7.2.0)
      ast (~> 2.4.1)
-    pg_query (2.1.0)
+    pg_query (2.1.1)
      google-protobuf (>= 3.17.1)
    proc_to_ast (0.1.0)
      coderay
@@ -184,7 +184,7 @@ GEM
    rubocop-ast (0.2.0)
      parser (>= 2.7.0.1)
    ruby-progressbar (1.10.1)
-    rugged (1.1.0)
+    rugged (1.2.0)
    sanitize (4.6.6)
      crass (~> 1.0.2)
      nokogiri (>= 1.4.4)
@@ -234,7 +234,7 @@ DEPENDENCIES
  rspec
  rspec-parameterized
  rubocop (~> 0.69)
-  rugged (~> 1.1)
+  rugged (~> 1.2)
  sentry-raven (~> 3.0)
  timecop

--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@@ -4,6 +4,18 @@
 , libgit2, openssl, zlib, pcre, http-parser }:

 let
+  # git2go 32.0.5 does not support libgit2 1.2.0 or 1.3.0.
+  # It needs a specific commit in between those two releases.
+  libgit2_custom = libgit2.overrideAttrs (oldAttrs: rec {
+    version = "1.2.0";
+    src = fetchFromGitHub {
+      owner = "libgit2";
+      repo = "libgit2";
+      rev = "109b4c887ffb63962c7017a66fc4a1f48becb48e";
+      sha256 = "sha256-w029FHpOv5K49wE1OJMOlkTe+2cv+ORYqEHxs59GDBI=";
+    };
+  });
+
  rubyEnv = bundlerEnv rec {
    name = "gitaly-env";
    inherit ruby;
@@ -21,7 +33,7 @@ let
      };
  };

-  version = "14.4.2";
+  version = "14.5.0";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/v${lib.versions.major version}";
 in

@@ -33,10 +45,10 @@ buildGoModule {
    owner = "gitlab-org";
    repo = "gitaly";
    rev = "v${version}";
-    sha256 = "sha256-MzYUSoG+HjW9o2zn6Q9Pd5NfI7hZkw1xFXOXHbbxJvo=";
+    sha256 = "sha256-DbyxZKxW+S2u23+F8VQxkDXWp+L1WeISs6OEBb5DavA=";
  };

-  vendorSha256 = "sha256-9RhPQosen70E9t1iAoc2SeKs9pYMMpMqgXLekWfKNf8=";
+  vendorSha256 = "sha256-ZLd4E3+e25Hqmd6ZyF3X6BveMEg7OF0FX9IvNBWn3v0=";

  passthru = {
    inherit rubyEnv;
@@ -46,7 +58,7 @@ buildGoModule {

  tags = [ "static,system_libgit2" ];
  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ rubyEnv.wrappedRuby libgit2 openssl zlib pcre http-parser ];
+  buildInputs = [ rubyEnv.wrappedRuby libgit2_custom openssl zlib pcre http-parser ];
  doCheck = false;

  postInstall = ''
--- a/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
@@ -554,10 +554,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "12dibsqndfnckc24yryy8v467rxp7p80jx21jhm8z7swp8118jhx";
+      sha256 = "0cf1b97nznl6adkx25j2x96sq8xx2b4fpic230fx65k3vqqn8a4r";
      type = "gem";
    };
-    version = "2.1.0";
+    version = "2.1.1";
  };
  proc_to_ast = {
    dependencies = ["coderay" "parser" "unparser"];
@@ -830,10 +830,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "04aq913plcxjw71l5r62qgz3bx3466p0wvgyfqahg5n3nybmcwqy";
+      sha256 = "1v846qs2pa3wnzgz95jzbcdrgl9vyjl65qiscw4q4dvm5sb7j68i";
      type = "gem";
    };
-    version = "1.1.0";
+    version = "1.2.0";
  };
  sanitize = {
    dependencies = ["crass" "nokogiri" "nokogumbo"];
--- a/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
@@ -2,12 +2,12 @@

 buildGoModule rec {
  pname = "gitlab-shell";
-  version = "13.21.1";
+  version = "13.22.0";
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-shell";
    rev = "v${version}";
-    sha256 = "sha256-FBkxJLl58ZbqM1P4LohsozGiKg38gQwVGOV9AAjVE0M=";
+    sha256 = "sha256-jMFTNyGdegdBO+f6Pw36iuhvyzcM8rCbnfSyLSOiEjY=";
  };

  buildInputs = [ ruby ];
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@@ -5,7 +5,7 @@ in
 buildGoModule rec {
  pname = "gitlab-workhorse";

-  version = "14.4.2";
+  version = "14.5.0";

  src = fetchFromGitLab {
    owner = data.owner;
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@@ -4,7 +4,7 @@ source 'https://rubygems.org'

 gem 'rails', '~> 6.1.4.1'

-gem 'bootsnap', '~> 1.4.6'
+gem 'bootsnap', '~> 1.9.1', require: false

 # Responders respond_to and respond_with
 gem 'responders', '~> 3.0'
@@ -17,14 +17,14 @@ gem 'default_value_for', '~> 3.4.0'
 # Supported DBs
 gem 'pg', '~> 1.1'

-gem 'rugged', '~> 1.1'
+gem 'rugged', '~> 1.2'
 gem 'grape-path-helpers', '~> 1.7.0'

 gem 'faraday', '~> 1.0'
 gem 'marginalia', '~> 1.10.0'

 # Authorization
-gem 'declarative_policy', '~> 1.0.0'
+gem 'declarative_policy', '~> 1.1.0'

 # Authentication libraries
 gem 'devise', '~> 4.7.2'
@@ -38,6 +38,7 @@ gem 'omniauth-auth0', '~> 2.0.0'
 gem 'omniauth-azure-activedirectory-v2', '~> 1.0'
 gem 'omniauth-azure-oauth2', '~> 0.0.9' # Deprecated v1 version
 gem 'omniauth-cas3', '~> 1.1.4'
+gem 'omniauth-dingtalk-oauth2', '~> 1.0'
 gem 'omniauth-facebook', '~> 4.0.0'
 gem 'omniauth-github', '~> 1.4'
 gem 'omniauth-gitlab', '~> 1.0.2'
@@ -129,7 +130,7 @@ gem 'fog-local', '~> 0.6'
 gem 'fog-openstack', '~> 1.0'
 gem 'fog-rackspace', '~> 0.1.1'
 gem 'fog-aliyun', '~> 0.3'
-gem 'gitlab-fog-azure-rm', '~> 1.2.0', require: false
+gem 'gitlab-fog-azure-rm', '~> 1.2.0', require: 'fog/azurerm'

 # for Google storage
 gem 'google-api-client', '~> 0.33'
@@ -186,6 +187,7 @@ gem 'rack-timeout', '~> 0.5.1', require: 'rack/timeout/base'
 group :puma do
  gem 'puma', '~> 5.3.1', require: false
  gem 'puma_worker_killer', '~> 0.3.1', require: false
+  gem 'sd_notify', '~> 0.1.0', require: false
 end

 # State machine
@@ -290,7 +292,7 @@ gem 'autoprefixer-rails', '10.2.5.1'
 gem 'terser', '1.0.2'

 gem 'addressable', '~> 2.8'
-gem 'gemojione', '~> 3.3'
+gem 'tanuki_emoji', '~> 0.5'
 gem 'gon', '~> 6.4.0'
 gem 'request_store', '~> 1.5'
 gem 'base32', '~> 0.3.0'
@@ -341,13 +343,15 @@ group :development do
  gem 'lefthook', '~> 0.7.0', require: false
  gem 'solargraph', '~> 0.43', require: false

-  gem 'letter_opener_web', '~> 1.4.1'
+  gem 'letter_opener_web', '~> 2.0.0'

  # Better errors handler
  gem 'better_errors', '~> 2.9.0'

  # thin instead webrick
  gem 'thin', '~> 1.8.0'
+
+  gem 'sprite-factory', '~> 1.7'
 end

 group :development, :test do
@@ -372,7 +376,7 @@ group :development, :test do
  gem 'spring', '~> 2.1.0'
  gem 'spring-commands-rspec', '~> 1.0.4'

-  gem 'gitlab-styles', '~> 6.3.0', require: false
+  gem 'gitlab-styles', '~> 6.4.0', require: false

  gem 'haml_lint', '~> 0.36.0', require: false
  gem 'bundler-audit', '~> 0.7.0.1', require: false
@@ -396,7 +400,7 @@ group :development, :test do
 end

 group :development, :test, :danger do
-  gem 'gitlab-dangerfiles', '~> 2.3.0', require: false
+  gem 'gitlab-dangerfiles', '~> 2.5.0', require: false
 end

 group :development, :test, :coverage do
@@ -474,7 +478,7 @@ end
 gem 'spamcheck', '~> 0.1.0'

 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 14.3.0.pre.rc2'
+gem 'gitaly', '~> 14.4.0.pre.rc43'

 # KAS GRPC protocol definitions
 gem 'kas-grpc', '~> 0.0.2'
@@ -535,4 +539,4 @@ gem 'ipaddress', '~> 0.8.3'

 gem 'parslet', '~> 1.8'

-gem 'sd_notify'
+gem 'ipynbdiff', '0.3.7'
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@@ -141,7 +141,7 @@ GEM
      rack (>= 0.9.0)
    bindata (2.4.10)
    binding_ninja (0.2.3)
-    bootsnap (1.4.6)
+    bootsnap (1.9.1)
      msgpack (~> 1.0)
    bootstrap_form (4.2.0)
      actionpack (>= 5.0)
@@ -215,7 +215,7 @@ GEM
    css_parser (1.7.0)
      addressable
    daemons (1.3.1)
-    danger (8.3.1)
+    danger (8.4.1)
      claide (~> 1.0)
      claide-plugins (>= 0.9.2)
      colored2 (~> 3.1)
@@ -237,7 +237,7 @@ GEM
      html-pipeline
    declarative (0.0.20)
    declarative-option (0.1.0)
-    declarative_policy (1.0.0)
+    declarative_policy (1.1.0)
    default_value_for (3.4.0)
      activerecord (>= 3.2.0, < 7.0)
    deprecation_toolkit (1.5.1)
@@ -429,8 +429,6 @@ GEM
      ruby-progressbar (~> 1.4)
    fuzzyurl (0.9.0)
    gemoji (3.0.1)
-    gemojione (3.3.0)
-      json
    get_process_mem (0.2.5)
      ffi (~> 1.0)
    gettext (3.3.6)
@@ -445,7 +443,7 @@ GEM
      rails (>= 3.2.0)
    git (1.7.0)
      rchardet (~> 1.8)
-    gitaly (14.3.0.pre.rc2)
+    gitaly (14.4.0.pre.rc43)
      grpc (~> 1.0)
    github-markup (1.7.0)
    gitlab (4.16.1)
@@ -453,7 +451,7 @@ GEM
      terminal-table (~> 1.5, >= 1.5.1)
    gitlab-chronic (0.10.5)
      numerizer (~> 0.2)
-    gitlab-dangerfiles (2.3.0)
+    gitlab-dangerfiles (2.5.0)
      danger (>= 8.3.1)
      danger-gitlab (>= 8.0.0)
    gitlab-experiment (0.6.4)
@@ -485,7 +483,7 @@ GEM
      openid_connect (~> 1.2)
    gitlab-sidekiq-fetcher (0.8.0)
      sidekiq (~> 6.1)
-    gitlab-styles (6.3.0)
+    gitlab-styles (6.4.0)
      rubocop (~> 0.91, >= 0.91.1)
      rubocop-gitlab-security (~> 0.1.1)
      rubocop-performance (~> 1.9.2)
@@ -635,6 +633,9 @@ GEM
    invisible_captcha (1.1.0)
      rails (>= 4.2)
    ipaddress (0.8.3)
+    ipynbdiff (0.3.7)
+      diffy (= 3.3.0)
+      json (= 2.5.1)
    jaeger-client (1.1.0)
      opentracing (~> 0.3)
      thrift
@@ -692,10 +693,11 @@ GEM
    lefthook (0.7.5)
    letter_opener (1.7.0)
      launchy (~> 2.2)
-    letter_opener_web (1.4.1)
-      actionmailer (>= 3.2)
-      letter_opener (~> 1.0)
-      railties (>= 3.2)
+    letter_opener_web (2.0.0)
+      actionmailer (>= 5.2)
+      letter_opener (~> 1.7)
+      railties (>= 5.2)
+      rexml
    libyajl2 (1.2.0)
    license_finder (6.0.0)
      bundler
@@ -832,6 +834,8 @@ GEM
      addressable (~> 2.3)
      nokogiri (~> 1.7, >= 1.7.1)
      omniauth (~> 1.2)
+    omniauth-dingtalk-oauth2 (1.0.0)
+      omniauth-oauth2 (~> 1.7.1)
    omniauth-facebook (4.0.0)
      omniauth-oauth2 (~> 1.2)
    omniauth-github (1.4.0)
@@ -852,7 +856,7 @@ GEM
    omniauth-oauth (1.1.0)
      oauth
      omniauth (~> 1.0)
-    omniauth-oauth2 (1.7.1)
+    omniauth-oauth2 (1.7.2)
      oauth2 (~> 1.4)
      omniauth (>= 1.9, < 3)
    omniauth-oauth2-generic (0.2.2)
@@ -1122,7 +1126,7 @@ GEM
    rubyntlm (0.6.2)
    rubypants (0.2.0)
    rubyzip (2.0.0)
-    rugged (1.1.0)
+    rugged (1.2.0)
    safe_yaml (1.0.4)
    safety_net_attestation (0.4.0)
      jwt (~> 2.0)
@@ -1148,7 +1152,7 @@ GEM
      addressable (>= 2.3.5)
      faraday (> 0.8, < 2.0)
    scientist (1.6.0)
-    sd_notify (0.1.1)
+    sd_notify (0.1.0)
    securecompare (1.0.0)
    seed-fu (2.3.7)
      activerecord (>= 3.1)
@@ -1210,6 +1214,7 @@ GEM
    spring (2.1.1)
    spring-commands-rspec (1.0.4)
      spring (>= 0.9.1)
+    sprite-factory (1.7.1)
    sprockets (3.7.2)
      concurrent-ruby (~> 1.0)
      rack (> 1, < 3)
@@ -1240,6 +1245,7 @@ GEM
    sys-filesystem (1.1.9)
      ffi
    sysexits (1.2.0)
+    tanuki_emoji (0.5.0)
    temple (0.8.2)
    terminal-table (1.8.0)
      unicode-display_width (~> 1.1, >= 1.1.1)
@@ -1393,7 +1399,7 @@ DEPENDENCIES
  benchmark-ips (~> 2.3.0)
  benchmark-memory (~> 0.1)
  better_errors (~> 2.9.0)
-  bootsnap (~> 1.4.6)
+  bootsnap (~> 1.9.1)
  bootstrap_form (~> 4.2.0)
  browser (~> 4.2)
  bullet (~> 6.1.3)
@@ -1410,7 +1416,7 @@ DEPENDENCIES
  crystalball (~> 0.7.0)
  database_cleaner (~> 1.7.0)
  deckar01-task_list (= 2.3.1)
-  declarative_policy (~> 1.0.0)
+  declarative_policy (~> 1.1.0)
  default_value_for (~> 3.4.0)
  deprecation_toolkit (~> 1.5.1)
  derailed_benchmarks
@@ -1448,14 +1454,13 @@ DEPENDENCIES
  fog-rackspace (~> 0.1.1)
  fugit (~> 1.2.1)
  fuubar (~> 2.2.0)
-  gemojione (~> 3.3)
  gettext (~> 3.3)
  gettext_i18n_rails (~> 1.8.0)
  gettext_i18n_rails_js (~> 1.3)
-  gitaly (~> 14.3.0.pre.rc2)
+  gitaly (~> 14.4.0.pre.rc43)
  github-markup (~> 1.7.0)
  gitlab-chronic (~> 0.10.5)
-  gitlab-dangerfiles (~> 2.3.0)
+  gitlab-dangerfiles (~> 2.5.0)
  gitlab-experiment (~> 0.6.4)
  gitlab-fog-azure-rm (~> 1.2.0)
  gitlab-labkit (~> 0.21.1)
@@ -1465,7 +1470,7 @@ DEPENDENCIES
  gitlab-net-dns (~> 0.9.1)
  gitlab-omniauth-openid-connect (~> 0.8.0)
  gitlab-sidekiq-fetcher (= 0.8.0)
-  gitlab-styles (~> 6.3.0)
+  gitlab-styles (~> 6.4.0)
  gitlab_chronic_duration (~> 0.10.6.2)
  gitlab_omniauth-ldap (~> 2.1.1)
  gon (~> 6.4.0)
@@ -1495,6 +1500,7 @@ DEPENDENCIES
  icalendar
  invisible_captcha (~> 1.1.0)
  ipaddress (~> 0.8.3)
+  ipynbdiff (= 0.3.7)
  jira-ruby (~> 2.1.4)
  js_regex (~> 3.7)
  json (~> 2.5.1)
@@ -1506,7 +1512,7 @@ DEPENDENCIES
  kramdown (~> 2.3.1)
  kubeclient (~> 4.9.2)
  lefthook (~> 0.7.0)
-  letter_opener_web (~> 1.4.1)
+  letter_opener_web (~> 2.0.0)
  license_finder (~> 6.0)
  licensee (~> 9.14.1)
  lockbox (~> 0.6.2)
@@ -1535,6 +1541,7 @@ DEPENDENCIES
  omniauth-azure-activedirectory-v2 (~> 1.0)
  omniauth-azure-oauth2 (~> 0.0.9)
  omniauth-cas3 (~> 1.1.4)
+  omniauth-dingtalk-oauth2 (~> 1.0)
  omniauth-facebook (~> 4.0.0)
  omniauth-github (~> 1.4)
  omniauth-gitlab (~> 1.0.2)
@@ -1596,10 +1603,10 @@ DEPENDENCIES
  ruby-saml (~> 1.13.0)
  ruby_parser (~> 3.15)
  rubyzip (~> 2.0.0)
-  rugged (~> 1.1)
+  rugged (~> 1.2)
  sanitize (~> 5.2.1)
  sassc-rails (~> 2.1.0)
-  sd_notify
+  sd_notify (~> 0.1.0)
  seed-fu (~> 2.3.7)
  selenium-webdriver (~> 3.142)
  sentry-raven (~> 3.1)
@@ -1616,11 +1623,13 @@ DEPENDENCIES
  spamcheck (~> 0.1.0)
  spring (~> 2.1.0)
  spring-commands-rspec (~> 1.0.4)
+  sprite-factory (~> 1.7)
  sprockets (~> 3.7.0)
  sshkey (~> 2.0)
  stackprof (~> 0.2.15)
  state_machines-activerecord (~> 0.8.0)
  sys-filesystem (~> 1.1.6)
+  tanuki_emoji (~> 0.5)
  terser (= 1.0.2)
  test-prof (~> 1.0.7)
  test_file_finder (~> 0.1.3)
--- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
@@ -557,10 +557,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0bz62p9vc7lcrmzhiz4pf7myww086mq287cw3jjj7fyc7jhmamw0";
+      sha256 = "1ndjra3h86dq28njm2swmaw6n3vsywrycrf7i5iy9l8hrhfhv4x2";
      type = "gem";
    };
-    version = "1.4.6";
+    version = "1.9.1";
  };
  bootstrap_form = {
    dependencies = ["actionpack" "activemodel"];
@@ -931,10 +931,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "12nmycrlwr8ca2s0fx76k81gjw12iz15k1n0qanszv5d4l1ykj2l";
+      sha256 = "1f9p7sdj542cbn352qz58m4n26kamv6vbnxzpc06j0pxi50z3i0v";
      type = "gem";
    };
-    version = "8.3.1";
+    version = "8.4.1";
  };
  danger-gitlab = {
    dependencies = ["danger" "gitlab"];
@@ -1007,10 +1007,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0k2wl0jr0jq64gy7ibb1ipm2dzqil7y66vyffwx81g7sqchh7xh6";
+      sha256 = "1jri6fqpyrlnhl99mhqlqwpi6z8idb7g421rysxz40yyk8lwzx4s";
      type = "gem";
    };
-    version = "1.0.0";
+    version = "1.1.0";
  };
  default_value_for = {
    dependencies = ["activerecord"];
@@ -1838,17 +1838,6 @@
    };
    version = "3.0.1";
  };
-  gemojione = {
-    dependencies = ["json"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0ayk8r147k1s38nj18pwk76npx1p7jhi86silk800nj913pjvrhj";
-      type = "gem";
-    };
-    version = "3.3.0";
-  };
  get_process_mem = {
    dependencies = ["ffi"];
    groups = ["default" "puma" "unicorn"];
@@ -1910,10 +1899,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "197db842msm326ib8r3gqlavf5d11r4cd9jg4wjnyar3ccyr9dn7";
+      sha256 = "022amhic8rs09qmp3hy1zz5inxbxnrvg8j82bq4l2s8ml9hqfs3a";
      type = "gem";
    };
-    version = "14.3.0.pre.rc2";
+    version = "14.4.0.pre.rc43";
  };
  github-markup = {
    groups = ["default"];
@@ -1953,10 +1942,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "07ckvf7vk0494s70ql7zp3ckn8q70mhwa0143hj6bjh0bpgmgsnw";
+      sha256 = "1488s24c9fm55z2a2pbry2fjx72fzgzv0y48krgldvf0qy43l0kz";
      type = "gem";
    };
-    version = "2.3.0";
+    version = "2.5.0";
  };
  gitlab-experiment = {
    dependencies = ["activesupport" "request_store" "scientist"];
@@ -2059,10 +2048,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1vxg5j9405r5xvwnswhm2r7pg9pn6pqg675pxz6f8d3sxy5z963p";
+      sha256 = "16d90sd0x6qfkhgfjysswwrzk82zs82xs9azn9w287irpzdkvj7f";
      type = "gem";
    };
-    version = "6.3.0";
+    version = "6.4.0";
  };
  gitlab_chronic_duration = {
    dependencies = ["numerizer"];
@@ -2589,6 +2578,17 @@
    };
    version = "0.8.3";
  };
+  ipynbdiff = {
+    dependencies = ["diffy" "json"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "18337bzcwssmnyg2wf3za50z0zh2b1sh17wgaapavd1ffr24svkx";
+      type = "gem";
+    };
+    version = "0.3.7";
+  };
  jaeger-client = {
    dependencies = ["opentracing" "thrift"];
    groups = ["default"];
@@ -2826,15 +2826,15 @@
    version = "1.7.0";
  };
  letter_opener_web = {
-    dependencies = ["actionmailer" "letter_opener" "railties"];
+    dependencies = ["actionmailer" "letter_opener" "railties" "rexml"];
    groups = ["development"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0kgz2n0cyw3m8ipvijlikb6bldmzhnq451b9d7w5l74gw2fhqckg";
+      sha256 = "0vvvaz2ngaxv0s6sj25gdvp73vd8pfl8q3jharadg18p3va0m1ik";
      type = "gem";
    };
-    version = "1.4.1";
+    version = "2.0.0";
  };
  libyajl2 = {
    groups = ["default"];
@@ -3489,6 +3489,17 @@
    };
    version = "1.1.4";
  };
+  omniauth-dingtalk-oauth2 = {
+    dependencies = ["omniauth-oauth2"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1sflfy1jvn9wqpral7gcfmbys7msvykp6rlnl33r8qgnbksn54y8";
+      type = "gem";
+    };
+    version = "1.0.0";
+  };
  omniauth-facebook = {
    dependencies = ["omniauth-oauth2"];
    groups = ["default"];
@@ -3572,10 +3583,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "10fr2b58sp7l6nfdvxpbi67374hkrvsf507cvda89jjs0jacy319";
+      sha256 = "1ry65f309rnzhgdjvqybkd5i4qp9rpk1gbp4dz02h4l6bkk6ya10";
      type = "gem";
    };
-    version = "1.7.1";
+    version = "1.7.2";
  };
  omniauth-oauth2-generic = {
    dependencies = ["omniauth-oauth2"];
@@ -4778,10 +4789,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "04aq913plcxjw71l5r62qgz3bx3466p0wvgyfqahg5n3nybmcwqy";
+      sha256 = "1v846qs2pa3wnzgz95jzbcdrgl9vyjl65qiscw4q4dvm5sb7j68i";
      type = "gem";
    };
-    version = "1.1.0";
+    version = "1.2.0";
  };
  safe_yaml = {
    groups = ["default" "test"];
@@ -4881,14 +4892,14 @@
    version = "1.6.0";
  };
  sd_notify = {
-    groups = ["default"];
+    groups = ["puma"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0c9imnjbakx25r2n7widfp00s19ndzmmwax761mx5vbwm9nariyb";
+      sha256 = "0qx6hwi10s0ir46l3aq4lspkxlcs1x4cjhvdhpdxyxaicciqddi2";
      type = "gem";
    };
-    version = "0.1.1";
+    version = "0.1.0";
  };
  securecompare = {
    groups = ["default"];
@@ -5144,6 +5155,16 @@
    };
    version = "1.0.4";
  };
+  sprite-factory = {
+    groups = ["development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "18hvn14vz1v3j1gvbqjypa59hgj3c4mqbimby50k407c395551jm";
+      type = "gem";
+    };
+    version = "1.7.1";
+  };
  sprockets = {
    dependencies = ["concurrent-ruby" "rack"];
    groups = ["default" "development" "test"];
@@ -5291,6 +5312,16 @@
    };
    version = "1.2.0";
  };
+  tanuki_emoji = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1qw0qa3xz4h3izwl5qsvmg5vvfsfjhmv4mdxaw1v1w1qgp7j7gws";
+      type = "gem";
+    };
+    version = "0.5.0";
+  };
  temple = {
    groups = ["default" "development" "test"];
    platforms = [];
--- a/pkgs/applications/version-management/gitlab/update.py
+++ b/pkgs/applications/version-management/gitlab/update.py
@@ -143,7 +143,6 @@ def update_rubyenv():
        f.write(repo.get_file('Gemfile.lock', rev))
    with open(rubyenv_dir / 'Gemfile', 'w') as f:
        original = repo.get_file('Gemfile', rev)
-        original += "\ngem 'sd_notify'\n"
        f.write(re.sub(r".*mail-smtp_pool.*", "", original))

    subprocess.check_output(['bundle', 'lock'], cwd=rubyenv_dir)
--- a/pkgs/development/compilers/llvm/13/default.nix
+++ b/pkgs/development/compilers/llvm/13/default.nix
@@ -244,7 +244,12 @@ let
      inherit llvm_meta;
      stdenv = if stdenv.hostPlatform.useLLVM or false
               then overrideCC stdenv buildLlvmTools.clangNoLibcxx
-               else stdenv;
+               else (
+                 # libcxx >= 13 does not build on gcc9
+                 if stdenv.cc.isGNU && lib.versionOlder stdenv.cc.version "10"
+                 then pkgs.gcc10Stdenv
+                 else stdenv
+               );
    };

    libcxxabi = callPackage ./libcxxabi {
--- a/pkgs/development/coq-modules/equations/default.nix
+++ b/pkgs/development/coq-modules/equations/default.nix
@@ -7,7 +7,7 @@ with lib; mkCoqDerivation {
  inherit version;
  defaultVersion = switch coq.coq-version [
    { case = "8.14"; out = "1.3-8.14"; }
-    { case = "8.13"; out = "1.2.4+coq8.13"; }
+    { case = "8.13"; out = "1.3-8.13"; }
    { case = "8.12"; out = "1.2.4+coq8.12"; }
    { case = "8.11"; out = "1.2.4+coq8.11"; }
    { case = "8.10"; out = "1.2.1+coq8.10-2"; }
@@ -44,6 +44,8 @@ with lib; mkCoqDerivation {
    release."1.2.4+coq8.12".sha256    = "1n0w8is464qcq8mk2mv7amaf0khbjz5mpc9phf0rhpjm0lb22cb3";
    release."1.2.4+coq8.13".rev       = "v1.2.4-8.13";
    release."1.2.4+coq8.13".sha256    = "0i014lshsdflzw6h0qxra9d2f0q82vffxv2f29awbb9ad0p4rq4q";
+    release."1.3-8.13".rev            = "v1.3-8.13";
+    release."1.3-8.13".sha256         = "1jwjbkkkk4bwf6pz4zzz8fy5bb17aqyf4smkja59rgj9ya6nrdhg";
    release."1.3-8.14".rev            = "v1.3-8.14";
    release."1.3-8.14".sha256         = "19bj9nncd1r9g4273h5qx35gs3i4bw5z9bhjni24b413hyj55hkv";

--- a/pkgs/development/interpreters/clojure/babashka.nix
+++ b/pkgs/development/interpreters/clojure/babashka.nix
@@ -2,11 +2,11 @@

 buildGraalvmNativeImage rec {
  pname = "babashka";
-  version = "0.6.7";
+  version = "0.6.8";

  src = fetchurl {
    url = "https://github.com/babashka/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-e5Mq2fPYqsPEENVGO+gBz9K79KcKOykdDtItjcXU/DI=";
+    sha256 = "sha256-GIJXXWJZ77n2FBOLKqRSlueo63JMxo0a49dDhneO6oo=";
  };

  executable = "bb";
--- a/pkgs/development/libraries/libxc/default.nix
+++ b/pkgs/development/libraries/libxc/default.nix
@@ -20,6 +20,8 @@ stdenv.mkDerivation rec {
  cmakeFlags = [
    "-DENABLE_FORTRAN=ON"
    "-DBUILD_SHARED_LIBS=ON"
+    # needed for tests to link
+    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
    # Force compilation of higher derivatives
    "-DDISABLE_VXC=0"
    "-DDISABLE_FXC=0"
@@ -27,10 +29,6 @@ stdenv.mkDerivation rec {
    "-DDISABLE_LXC=0"
  ];

-  preCheck = ''
-    export LD_LIBRARY_PATH=$(pwd)
-  '';
-
  doCheck = true;

  meta = with lib; {
--- a/pkgs/development/python-modules/awkward/default.nix
+++ b/pkgs/development/python-modules/awkward/default.nix
@@ -11,11 +11,11 @@

 buildPythonPackage rec {
  pname = "awkward";
-  version = "1.5.1";
+  version = "1.7.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "c0357c62223fefcfc7a7565389dbd4db900623bf10eccf2bc8e87586ec59b38d";
+    sha256 = "e4e642dfe496d2acb245c90e37dc18028e25d5e936421e7371ea6ba0fde6435a";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/python-modules/flake8-polyfill/default.nix
+++ b/pkgs/development/python-modules/flake8-polyfill/default.nix
@@ -1,6 +1,12 @@
-{ lib, fetchPypi, buildPythonPackage
+{ lib
+, buildPythonPackage
+, fetchpatch
+, fetchPypi
 , flake8
-, mock, pep8, pytest }:
+, mock
+, pep8
+, pytestCheckHook
+}:

 buildPythonPackage rec {
  pname = "flake8-polyfill";
@@ -11,12 +17,6 @@ buildPythonPackage rec {
    sha256 = "1nlf1mkqw856vi6782qcglqhaacb23khk9wkcgn55npnjxshhjz4";
  };

-  postPatch = ''
-    # Failed: [pytest] section in setup.cfg files is no longer supported, change to [tool:pytest] instead.
-    substituteInPlace setup.cfg \
-      --replace pytest 'tool:pytest'
-  '';
-
  propagatedBuildInputs = [
    flake8
  ];
@@ -24,13 +24,28 @@ buildPythonPackage rec {
  checkInputs = [
    mock
    pep8
-    pytest
+    pytestCheckHook
  ];

-  checkPhase = ''
-    pytest tests
+  patches = [
+    # Skip unnecessary tests on Flake8, https://github.com/PyCQA/pep8-naming/pull/181
+    (fetchpatch {
+      name = "skip-tests.patch";
+      url = "https://github.com/PyCQA/flake8-polyfill/commit/3cf414350e82ceb835ca2edbd5d5967d33e9ff35.patch";
+      sha256 = "mElZafodq8dF3wLO/LOqwFb7eLMsPLlEjNSu5AWqets=";
+    })
+  ];
+
+  postPatch = ''
+    # Failed: [pytest] section in setup.cfg files is no longer supported, change to [tool:pytest] instead.
+    substituteInPlace setup.cfg \
+      --replace pytest 'tool:pytest'
  '';

+  pythonImportsCheck = [
+    "flake8_polyfill"
+  ];
+
  meta = with lib; {
    homepage = "https://gitlab.com/pycqa/flake8-polyfill";
    description = "Polyfill package for Flake8 plugins";
--- a/pkgs/development/python-modules/nbclient/default.nix
+++ b/pkgs/development/python-modules/nbclient/default.nix
@@ -6,25 +6,18 @@

 buildPythonPackage rec {
  pname = "nbclient";
-  version = "0.5.8";
+  version = "0.5.9";
  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-NPUsycuDGl2MzXAxU341THXcYaJEh/mYcS0Sid4yCiU=";
+    sha256 = "sha256-meRt2vrNC4YSk78kb+2FQKGErfo6p9ZB+JAx7AcHAeA=";
  };

  inherit doCheck;
  checkInputs = [ pytest xmltodict nbconvert ipywidgets ];
  propagatedBuildInputs = [ async_generator traitlets nbformat nest-asyncio jupyter-client ];

-  postFixup =  ''
-    # Remove until fixed by upstream
-    # https://github.com/jupyter/nbclient/pull/173#issuecomment-968760082
-    rm $out/bin/.jupyter-run-wrapped
-    rm $out/bin/jupyter-run
-  '';
-
  meta = with lib; {
    homepage = "https://github.com/jupyter/nbclient";
    description = "A client library for executing notebooks";
--- a/pkgs/development/python-modules/pep8-naming/default.nix
+++ b/pkgs/development/python-modules/pep8-naming/default.nix
@@ -1,5 +1,6 @@
 { lib
 , fetchPypi
+, fetchpatch
 , buildPythonPackage
 , flake8
 , flake8-polyfill
@@ -20,6 +21,15 @@ buildPythonPackage rec {
    flake8-polyfill
  ];

+  patches = [
+    # Add missing option to get passing tests, https://github.com/PyCQA/pep8-naming/pull/181
+    (fetchpatch {
+      name = "add-missing-option.patch";
+      url = "https://github.com/PyCQA/pep8-naming/commit/03b8f36f6a8bb8bc79dfa5a71ad9be2a0bf8bbf5.patch";
+      sha256 = "1YTh84Yoj0MqFZoifM362563r1GuzaF+mMmdT/ckC7I=";
+    })
+  ];
+
  checkPhase = ''
    runHook preCheck
    ${python.interpreter} run_tests.py
--- a/pkgs/development/python-modules/pylint-django/default.nix
+++ b/pkgs/development/python-modules/pylint-django/default.nix
@@ -1,16 +1,12 @@
-{ buildPythonPackage
+{ lib
+, buildPythonPackage
+, coverage
+, django
+, factory_boy
 , fetchFromGitHub
 , isPy3k
-, lib
-
-# pythonPackages
-, django
 , pylint-plugin-utils
-
-# pythonPackages for checkInputs
-, coverage
-, factory_boy
-, pytest
+, pytestCheckHook
 }:

 buildPythonPackage rec {
@@ -30,17 +26,26 @@ buildPythonPackage rec {
    pylint-plugin-utils
  ];

-  checkInputs = [ coverage factory_boy pytest ];
+  checkInputs = [
+    coverage
+    factory_boy
+    pytestCheckHook
+  ];

-  # Check command taken from scripts/test.sh
-  # Skip test external_django_tables2_noerror_meta_class:
-  # requires an unpackaged django_tables2
-  checkPhase = ''
-      python pylint_django/tests/test_func.py -v -k "not tables2"
-  '';
+  disabledTests = [
+    # Skip outdated tests and the one with a missing dependency (django_tables2)
+    "external_django_tables2_noerror_meta_class"
+    "external_factory_boy_noerror"
+    "func_noerror_foreign_key_attributes"
+    "func_noerror_foreign_key_key_cls_unbound"
+  ];
+
+  pythonImportsCheck = [
+    "pylint_django"
+  ];

  meta = with lib; {
-    description = "A Pylint plugin to analyze Django applications";
+    description = "Pylint plugin to analyze Django applications";
    homepage = "https://github.com/PyCQA/pylint-django";
    license = licenses.gpl2Plus;
    maintainers = with maintainers; [ kamadorueda ];
--- a/pkgs/development/tools/build-managers/bloop/default.nix
+++ b/pkgs/development/tools/build-managers/bloop/default.nix
@@ -3,6 +3,7 @@
 , coursier
 , autoPatchelfHook
 , installShellFiles
+, makeWrapper
 , jre
 , lib
 , zlib
@@ -10,76 +11,83 @@

 stdenv.mkDerivation rec {
  pname = "bloop";
-  version = "1.4.9";
+  version = "1.4.11";

  bloop-coursier-channel = fetchurl {
    url = "https://github.com/scalacenter/bloop/releases/download/v${version}/bloop-coursier.json";
-    sha256 = "0yh9k98c0cq9ksi3g6rb1q1qblnhcznrc5z1y9ps8cvwv2lx8ly4";
+    sha256 = "CoF/1nggjaL17SWmWDcKicfgoyqpOSZUse8f+3TgD0E=";
  };

  bloop-bash = fetchurl {
    url = "https://github.com/scalacenter/bloop/releases/download/v${version}/bash-completions";
-    sha256 = "1ldxlqv353gvhdn4yq7z506ywvnjv6fjsi8wigwhzg89876pwsys";
+    sha256 = "2mt+zUEJvQ/5ixxFLZ3Z0m7uDSj/YE9sg/uNMjamvdE=";
  };

  bloop-fish = fetchurl {
    url = "https://github.com/scalacenter/bloop/releases/download/v${version}/fish-completions";
-    sha256 = "1pa8h81l2498q8dbd83fzipr99myjwxpy8xdgzhvqzdmfv6aa4m0";
+    sha256 = "oBKlzHa1fbzhf60jfzuXvqaUb/xuoLYawigRQQOCSN0=";
  };

  bloop-zsh = fetchurl {
    url = "https://github.com/scalacenter/bloop/releases/download/v${version}/zsh-completions";
-    sha256 = "1xzg0qfkjdmzm3mvg82mc4iia8cl7b6vbl8ng4ir2xsz00zjrlsq";
+    sha256 = "WNMsPwBfd5EjeRbRtc06lCEVI2FVoLfrqL82OR0G7/c=";
  };

  bloop-coursier = stdenv.mkDerivation rec {
    name = "${pname}-coursier-${version}";

    platform = if stdenv.isLinux && stdenv.isx86_64 then "x86_64-pc-linux"
-               else if stdenv.isDarwin && stdenv.isx86_64 then "x86_64-apple-darwin"
-               else throw "unsupported platform";
+    else if stdenv.isDarwin && stdenv.isx86_64 then "x86_64-apple-darwin"
+    else throw "unsupported platform";

-    phases = [ "installPhase" ];
+    dontUnpack = true;
    installPhase = ''
+      runHook preInstall
+
      export COURSIER_CACHE=$(pwd)
      export COURSIER_JVM_CACHE=$(pwd)

      mkdir channel
      ln -s ${bloop-coursier-channel} channel/bloop.json
-      ${coursier}/bin/cs install --install-dir $out --install-platform ${platform} --default-channels=false --channel channel --only-prebuilt=true bloop
+      ${coursier}/bin/cs install --install-dir . --install-platform ${platform} --default-channels=false --channel channel --only-prebuilt=true bloop

-      # Remove binary part of the coursier launcher script to make derivation output hash stable
-      sed -i '5,$ d' $out/bloop
-   '';
+      # Only keeping the binary, we'll wrap it ourselves
+      # This guarantees the output of this fixed-output derivation doesn't have references to itself
+      install -D -m 0755 .bloop.aux $out
+
+      runHook postInstall
+    '';

    outputHashMode = "recursive";
    outputHashAlgo = "sha256";
-    outputHash = if stdenv.isLinux && stdenv.isx86_64 then "1hxyzf430g95l6qz1qlq8wvizvy6j3a7a9crb3lcxd67cpbg3x7i"
-      else if stdenv.isDarwin && stdenv.isx86_64 then "0x5yqf3i8y6s5h27yr0jkpvj6ch25ckx2802dmaxlgq6gz0fx6w2"
-      else throw "unsupported platform";
+    outputHash = if stdenv.isLinux && stdenv.isx86_64 then "0c02n779z4l7blzla5820bzfhblbp5nlizx9f8wns4miwnph357f"
+    else if stdenv.isDarwin && stdenv.isx86_64 then "1gy5k9ii86rxyv2v9if4n1clvmb1hi4ym32mp6miwgcjla10sv30"
+    else throw "unsupported platform";
  };

  dontUnpack = true;
-  nativeBuildInputs = [ autoPatchelfHook installShellFiles ];
+  nativeBuildInputs = [ autoPatchelfHook installShellFiles makeWrapper ];
  buildInputs = [ stdenv.cc.cc.lib zlib ];
  propagatedBuildInputs = [ jre ];

  installPhase = ''
+    runHook preInstall
+
    export COURSIER_CACHE=$(pwd)
    export COURSIER_JVM_CACHE=$(pwd)

-    mkdir -p $out/bin
-    cp ${bloop-coursier}/bloop $out/bloop
-    cp ${bloop-coursier}/.bloop.aux $out/.bloop.aux
-    ln -s $out/bloop $out/bin/bloop
+    install -D -m 0755 ${bloop-coursier} $out/.bloop-wrapped

-    # patch the bloop launcher so that it works when symlinked
-    sed "s|\$(dirname \"\$0\")|$out|" -i $out/bloop
+    makeWrapper $out/.bloop-wrapped $out/bin/bloop \
+      --set CS_NATIVE_LAUNCHER true \
+      --set IS_CS_INSTALLED_LAUNCHER true

    #Install completions
    installShellCompletion --name bloop --bash ${bloop-bash}
    installShellCompletion --name _bloop --zsh ${bloop-zsh}
    installShellCompletion --name bloop.fish --fish ${bloop-fish}
+
+    runHook postInstall
  '';

  meta = with lib; {
@@ -87,6 +95,6 @@ stdenv.mkDerivation rec {
    license = licenses.asl20;
    description = "A Scala build server and command-line tool to make the compile and test developer workflows fast and productive in a build-tool-agnostic way";
    platforms = [ "x86_64-linux" "x86_64-darwin" ];
-    maintainers = with maintainers; [ tomahna ];
+    maintainers = with maintainers; [ kubukoz tomahna ];
  };
 }
--- a/pkgs/development/tools/build-managers/scala-cli/default.nix
+++ b/pkgs/development/tools/build-managers/scala-cli/default.nix
@@ -1,15 +1,15 @@
 { stdenv, coreutils, lib, installShellFiles, zlib, autoPatchelfHook, fetchurl }:

 let
-  version = "0.0.8";
+  version = "0.0.9";
  assets = {
    x86_64-darwin = {
      asset = "scala-cli-x86_64-apple-darwin.gz";
-      sha256 = "14bf1zwvfq86vh00qlf8jf4sb82p9jakrmwqhnv9p0x13lq56xm5";
+      sha256 = "sha256-1KwJuapqGhMEIMwrJp2LKlpYFtl+OP9DyaMtge9ZedI=";
    };
    x86_64-linux = {
      asset = "scala-cli-x86_64-pc-linux.gz";
-      sha256 = "01dhcj6q9c87aqpz8vy1kwaa1qqq9bh43rkx2sabhnfrzj4vypjr";
+      sha256 = "sha256-IDXO+MgFlnT7VPugcQr/IGLZeD/vWFqJ0D0zVIbTtk4=";
    };
  };
 in
@@ -22,10 +22,10 @@ stdenv.mkDerivation {
    let
      asset = assets."${stdenv.hostPlatform.system}" or (throw "Unsupported platform ${stdenv.hostPlatform.system}");
    in
-      fetchurl {
-        url = "https://github.com/Virtuslab/scala-cli/releases/download/v${version}/${asset.asset}";
-        sha256 = asset.sha256;
-      };
+    fetchurl {
+      url = "https://github.com/Virtuslab/scala-cli/releases/download/v${version}/${asset.asset}";
+      sha256 = asset.sha256;
+    };

  unpackPhase = ''
    runHook preUnpack
--- a/pkgs/development/tools/rust/cargo-wipe/default.nix
+++ b/pkgs/development/tools/rust/cargo-wipe/default.nix
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-wipe";
-  version = "0.3.1";
+  version = "0.3.2";

  src = fetchFromGitHub {
    owner = "mihai-dinculescu";
    repo = "cargo-wipe";
    rev = "v${version}";
-    sha256 = "sha256-sVekfGHg2wspP5/zJzXTXupspwJr4hQBucY5+8iUjUQ=";
+    sha256 = "sha256-AlmXq2jbU8mQ23Q64a8QiKXwiWkIfr98vAoq7FLImhA=";
  };

-  cargoSha256 = "sha256-EoXgsWg1Rh7C+fIqvefkLdck4Yj3kox2ZAU3kn6nH8Q=";
+  cargoSha256 = "sha256-vsN4cM4Q9LX1ZgAA5x7PupOTh0IcjI65xzuCPjy8YOs=";

  passthru = {
    updateScript = nix-update-script {
--- a/pkgs/os-specific/linux/mxu11x0/default.nix
+++ b/pkgs/os-specific/linux/mxu11x0/default.nix
@@ -1,13 +1,15 @@
 { lib, stdenv, fetchurl, kernel }:

-stdenv.mkDerivation {
+let
+  srcs = import (./srcs.nix) { inherit fetchurl; };
+in
+stdenv.mkDerivation rec {
  pname = "mxu11x0";
-  version = "1.4-${kernel.version}";

-  src = fetchurl {
-    url = "https://www.moxa.com/Moxa/media/PDIM/S100000385/moxa-uport-1000-series-linux-3.x-and-4.x-for-uport-11x0-series-driver-v1.4.tgz";
-    sha256 = "1hz9ygabbp8pv49k1j4qcsr0v3zw9xy0bh1akqgxp5v29gbdgxjl";
-  };
+  src = if lib.versionAtLeast kernel.version "5.0" then srcs.mxu11x0_5.src else srcs.mxu11x0_4.src;
+  mxu_version = if lib.versionAtLeast kernel.version "5.0" then srcs.mxu11x0_5.version else srcs.mxu11x0_4.version;
+
+  version = mxu_version + "-${kernel.version}";

  preBuild = ''
    sed -i -e "s/\$(uname -r).*/${kernel.modDirVersion}/g" driver/mxconf
@@ -33,6 +35,8 @@ stdenv.mkDerivation {
    license = licenses.gpl2Plus;
    maintainers = with maintainers; [ uralbash ];
    platforms = platforms.linux;
-    broken = kernel.kernelAtLeast "5.4";
+    # broken due to API change in write_room() > v5.14-rc1
+    # https://github.com/torvalds/linux/commit/94cc7aeaf6c0cff0b8aeb7cb3579cee46b923560
+    broken = kernel.kernelAtLeast "5.14";
  };
 }
--- a/pkgs/os-specific/linux/mxu11x0/srcs.nix
+++ b/pkgs/os-specific/linux/mxu11x0/srcs.nix
@@ -0,0 +1,18 @@
+{ fetchurl }:
+
+{
+  mxu11x0_4 = {
+    version = "4.1";
+    src = fetchurl {
+      url = "https://www.moxa.com/getmedia/b152d8c2-b9d6-4bc7-b0f4-420633b4bc2d/moxa-uport-1100-series-linux-kernel-4.x-driver-v4.1.tgz";
+      sha256 = "sha256-sbq5M5FQjrrORtSS07PQHf+MAZArxFcUDN5wszBwbnc=";
+    };
+  };
+  mxu11x0_5 = {
+    version = "5.1";
+    src = fetchurl {
+      url = "https://www.moxa.com/getmedia/57dfa4c1-8a2a-4da6-84c1-a36944ead74d/moxa-uport-1100-series-linux-kernel-5.x-driver-v5.1.tgz";
+      sha256 = "sha256-pdFIiD5naSDdYwRz8ww8Mg8z1gDOfZ/OeO6Q5n+kjDQ=";
+    };
+  };
+}
--- a/pkgs/servers/gemini/agate/default.nix
+++ b/pkgs/servers/gemini/agate/default.nix
@@ -24,8 +24,8 @@ rustPlatform.buildRustPackage rec {
  '';

  meta = with lib; {
-    homepage = "https://proxy.vulpes.one/gemini/qwertqwefsday.eu/agate.gmi";
-    changelog = "https://proxy.vulpes.one/gemini/qwertqwefsday.eu/agate.gmi";
+    homepage = "https://github.com/mbrubeck/agate";
+    changelog = "https://github.com/mbrubeck/agate/blob/master/CHANGELOG.md";
    description = "Very simple server for the Gemini hypertext protocol";
    longDescription = ''
      Agate is a server for the Gemini network protocol, built with the Rust
--- a/pkgs/tools/inputmethods/m17n-lib/default.nix
+++ b/pkgs/tools/inputmethods/m17n-lib/default.nix
@@ -11,9 +11,11 @@ stdenv.mkDerivation rec {
  strictDeps = true;

  # reconf needed to sucesfully cross-compile
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
-
-  buildInputs = [ m17n_db ];
+  nativeBuildInputs = [
+    autoreconfHook pkg-config
+    # requires m17n-db tool at build time
+    m17n_db
+  ];

  # Fails parallel build due to missing intra-package depends:
  #   https://savannah.nongnu.org/bugs/index.php?61377
--- a/pkgs/tools/networking/globalprotect-openconnect/default.nix
+++ b/pkgs/tools/networking/globalprotect-openconnect/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub
-, qmake, qtwebsockets, qtwebengine, wrapQtAppsHook, openconnect
+, cmake, qtwebsockets, qtwebengine, wrapQtAppsHook, openconnect
 }:

 stdenv.mkDerivation rec {
@@ -9,26 +9,16 @@ stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner = "yuezk";
    repo = "GlobalProtect-openconnect";
-    rev = "c14a6ad1d2b62f8d297bc4cfbcb1dcea4d99112f";
    fetchSubmodules = true;
-    sha256 = "sha256-M3+YGdN7LuuFEP9n94YJ/UDVhti/VlX0FzYMGeYebP4=";
+    rev = "v${version}";
+    sha256 = "sha256-w2y6DOFgQ8Xpi1abibvRNpEUbBsdvwDMGqlJxQSCpVg=";
  };

-  nativeBuildInputs = [ qmake wrapQtAppsHook ];
+  nativeBuildInputs = [ cmake wrapQtAppsHook ];

  buildInputs = [ openconnect qtwebsockets qtwebengine ];

  patchPhase = ''
-    for f in GPClient/GPClient.pro \
-      GPClient/com.yuezk.qt.gpclient.desktop \
-      GPService/GPService.pro \
-      GPService/dbus/com.yuezk.qt.GPService.service \
-      GPService/systemd/gpservice.service; do
-        substituteInPlace $f \
-          --replace /usr $out \
-          --replace /etc $out/lib;
-    done;
-
    substituteInPlace GPService/gpservice.h \
      --replace /usr/local/bin/openconnect ${openconnect}/bin/openconnect;
  '';
--- a/pkgs/tools/networking/isync/default.nix
+++ b/pkgs/tools/networking/isync/default.nix
@@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "isync";
-  version = "1.4.3";
+  version = "1.4.4";

  src = fetchurl {
    url = "mirror://sourceforge/isync/${pname}-${version}.tar.gz";
-    sha256 = "024p3glj4p7fhrssw5sr55arls9zna1igxxrspxlfd6sbds21ixl";
+    sha256 = "1zq0wwvmqsl9y71546dr0aygzn9gjjfiw19hlcq87s929y4p6ckw";
  };

  nativeBuildInputs = [ pkg-config perl ];
--- a/pkgs/tools/package-management/nix-update/default.nix
+++ b/pkgs/tools/package-management/nix-update/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonApplication
 , fetchFromGitHub
-, nix
+, nix_2_4
 , nix-prefetch
 , nixpkgs-fmt
 , nixpkgs-review
@@ -19,7 +19,7 @@ buildPythonApplication rec {
  };

  makeWrapperArgs = [
-    "--prefix" "PATH" ":" (lib.makeBinPath [ nix nix-prefetch nixpkgs-fmt nixpkgs-review ])
+    "--prefix" "PATH" ":" (lib.makeBinPath [ nix_2_4 nix-prefetch nixpkgs-fmt nixpkgs-review ])
  ];

  checkPhase = ''
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5732,9 +5732,7 @@ with pkgs;

  gitleaks = callPackage ../tools/security/gitleaks { };

-  gitaly = callPackage ../applications/version-management/gitlab/gitaly {
-    libgit2 = libgit2_1_1; # git2go only supports v1.1.x
-  };
+  gitaly = callPackage ../applications/version-management/gitlab/gitaly { };

  gitstats = callPackage ../applications/version-management/gitstats { };

--- a/pkgs/top-level/splice.nix
+++ b/pkgs/top-level/splice.nix
@@ -42,7 +42,7 @@ let
        valueBuildBuild = pkgsBuildBuild.${name} or {};
        valueBuildHost = pkgsBuildHost.${name} or {};
        valueBuildTarget = pkgsBuildTarget.${name} or {};
-        valueHostHost = throw "`valueHostHost` unimplemented: pass manually rather than relying on splice.";
+        valueHostHost = pkgsHostHost.${name} or {};
        valueHostTarget = pkgsHostTarget.${name} or {};
        valueTargetTarget = pkgsTargetTarget.${name} or {};
        augmentedValue = defaultValue
@@ -53,7 +53,7 @@ let
            __spliced =
                 (lib.optionalAttrs (pkgsBuildBuild ? ${name}) { buildBuild = valueBuildBuild; })
              // (lib.optionalAttrs (pkgsBuildTarget ? ${name}) { buildTarget = valueBuildTarget; })
-              // { hostHost = valueHostHost; }
+              // (lib.optionalAttrs (pkgsHostHost ? ${name}) { hostHost = valueHostHost; })
              // (lib.optionalAttrs (pkgsTargetTarget ? ${name}) { targetTarget = valueTargetTarget;
          });
        };
@@ -81,7 +81,7 @@ let
          pkgsBuildBuild = valueBuildBuild;
          pkgsBuildHost = valueBuildHost;
          pkgsBuildTarget = valueBuildTarget;
-          pkgsHostHost = {};
+          pkgsHostHost = valueHostHost;
          pkgsHostTarget = valueHostTarget;
          pkgsTargetTarget = valueTargetTarget;
        # Don't be fancy about non-derivations. But we could have used used