Merge branch 'master' into haskell-updates

2022-07-18 23:20:31 +02:00 · 2022-07-18 23:20:31 +02:00 · a69f246abd
commit a69f246abd
parent 72a19f20ad 31997025a4
80 changed files with 1882 additions and 604 deletions
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@ -36,6 +36,7 @@ rec {
      config = parse.tripleFromSystem final.parsed;
      # Determine whether we can execute binaries built for the provided platform.
      canExecute = platform:
+        final.isAndroid == platform.isAndroid &&
        parse.isCompatible final.parsed.cpu platform.parsed.cpu
        && final.parsed.kernel == platform.parsed.kernel;
      isCompatible = _: throw "2022-05-23: isCompatible has been removed in favor of canExecute, refer to the 22.11 changelog for details";
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@ -57,23 +57,23 @@ rec {
  armv7a-android-prebuilt = {
    config = "armv7a-unknown-linux-androideabi";
    rustc.config = "armv7-linux-androideabi";
-    sdkVer = "29";
-    ndkVer = "21";
+    sdkVer = "28";
+    ndkVer = "24";
    useAndroidPrebuilt = true;
  } // platforms.armv7a-android;

  aarch64-android-prebuilt = {
    config = "aarch64-unknown-linux-android";
    rustc.config = "aarch64-linux-android";
-    sdkVer = "29";
-    ndkVer = "21";
+    sdkVer = "28";
+    ndkVer = "24";
    useAndroidPrebuilt = true;
  };

  aarch64-android = {
    config = "aarch64-unknown-linux-android";
    sdkVer = "30";
-    ndkVer = "21";
+    ndkVer = "24";
    libc = "bionic";
    useAndroidPrebuilt = false;
    useLLVM = true;
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -893,6 +893,13 @@
    githubId = 661909;
    name = "Antonio Nuno Monteiro";
  };
+  anoa = {
+    matrix = "@andrewm:amorgan.xyz";
+    email = "andrew@amorgan.xyz";
+    github = "anoadragon453";
+    githubId = 1342360;
+    name = "Andrew Morgan";
+  };
  anpryl = {
    email = "anpryl@gmail.com";
    github = "anpryl";
@ -5405,6 +5412,13 @@
    githubId = 40234257;
    name = "ilkecan bozdogan";
  };
+  ihatethefrench =  {
+    email = "michal@tar.black";
+    matrix = "@michal:tar.black";
+    github = "ihatethefrench";
+    githubId = 30374463;
+    name = "Michal S.";
+  };
  illegalprime = {
    email = "themichaeleden@gmail.com";
    github = "illegalprime";
@ -14700,4 +14714,10 @@
    github = "npatsakula";
    githubId = 23001619;
  };
+  dfithian = {
+    email = "daniel.m.fithian@gmail.com";
+    name = "Daniel Fithian";
+    github = "dfithian";
+    githubId = 8409320;
+  };
 }
--- a/nixos/modules/services/logging/heartbeat.nix
+++ b/nixos/modules/services/logging/heartbeat.nix
@ -20,6 +20,16 @@ in

      enable = mkEnableOption "heartbeat";

+      package = mkOption {
+        type = types.package;
+        default = pkgs.heartbeat;
+        defaultText = literalExpression "pkgs.heartbeat";
+        example = literalExpression "pkgs.heartbeat7";
+        description = ''
+          The heartbeat package to use.
+        '';
+      };
+
      name = mkOption {
        type = types.str;
        default = "heartbeat";
@ -67,7 +77,7 @@ in
      serviceConfig = {
        User = "nobody";
        AmbientCapabilities = "cap_net_raw";
-        ExecStart = "${pkgs.heartbeat}/bin/heartbeat -c \"${heartbeatYml}\" -path.data \"${cfg.stateDir}/data\" -path.logs \"${cfg.stateDir}/logs\"";
+        ExecStart = "${cfg.package}/bin/heartbeat -c \"${heartbeatYml}\" -path.data \"${cfg.stateDir}/data\" -path.logs \"${cfg.stateDir}/logs\"";
      };
    };
  };
--- a/nixos/modules/services/misc/jellyfin.nix
+++ b/nixos/modules/services/misc/jellyfin.nix
@ -49,7 +49,10 @@ in
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];

+      # This is mostly follows: https://github.com/jellyfin/jellyfin/blob/master/fedora/jellyfin.service
+      # Upstream also disable some hardenings when running in LXC, we do the same with the isContainer option
      serviceConfig = rec {
+        Type = "simple";
        User = cfg.user;
        Group = cfg.group;
        StateDirectory = "jellyfin";
@ -57,48 +60,50 @@ in
        CacheDirectory = "jellyfin";
        CacheDirectoryMode = "0700";
        UMask = "0077";
+        WorkingDirectory = "/var/lib/jellyfin";
        ExecStart = "${cfg.package}/bin/jellyfin --datadir '/var/lib/${StateDirectory}' --cachedir '/var/cache/${CacheDirectory}'";
        Restart = "on-failure";
+        TimeoutSec = 15;
+        SuccessExitStatus = ["0" "143"];

        # Security options:
-
        NoNewPrivileges = true;
-
-        AmbientCapabilities = "";
-        CapabilityBoundingSet = "";
-
-        # ProtectClock= adds DeviceAllow=char-rtc r
-        DeviceAllow = "";
-
-        LockPersonality = true;
-
-        PrivateTmp = true;
-        # Disabled to allow Jellyfin to access hw accel devices endpoints
-        # PrivateDevices = true;
-        PrivateUsers = true;
-
-        # Disabled as it does not allow Jellyfin to interface with CUDA devices
-        # ProtectClock = true;
-        ProtectControlGroups = true;
-        ProtectHostname = true;
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-
-        RemoveIPC = true;
-
-        RestrictNamespaces = true;
+        SystemCallArchitectures = "native";
        # AF_NETLINK needed because Jellyfin monitors the network connection
-        RestrictAddressFamilies = [ "AF_NETLINK" "AF_INET" "AF_INET6" "AF_UNIX" ];
+        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" "AF_NETLINK" ];
+        RestrictNamespaces = !config.boot.isContainer;
        RestrictRealtime = true;
        RestrictSUIDSGID = true;
+        ProtectControlGroups = !config.boot.isContainer;
+        ProtectHostname = true;
+        ProtectKernelLogs = !config.boot.isContainer;
+        ProtectKernelModules = !config.boot.isContainer;
+        ProtectKernelTunables = !config.boot.isContainer;
+        LockPersonality = true;
+        PrivateTmp = !config.boot.isContainer;
+        # needed for hardware accelaration
+        PrivateDevices = false;
+        PrivateUsers = true;
+        RemoveIPC = true;

-        SystemCallArchitectures = "native";
-        SystemCallErrorNumber = "EPERM";
        SystemCallFilter = [
-          "@system-service"
-          "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@obsolete" "~@privileged" "~@setuid"
+          "~@clock"
+          "~@aio"
+          "~@chown"
+          "~@cpu-emulation"
+          "~@debug"
+          "~@keyring"
+          "~@memlock"
+          "~@module"
+          "~@mount"
+          "~@obsolete"
+          "~@privileged"
+          "~@raw-io"
+          "~@reboot"
+          "~@setuid"
+          "~@swap"
        ];
+        SystemCallErrorNumber = "EPERM";
      };
    };

--- a/nixos/modules/services/networking/mxisd.nix
+++ b/nixos/modules/services/networking/mxisd.nix
@ -46,6 +46,15 @@ in {
        description = "The mxisd/ma1sd package to use";
      };

+      environmentFile = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          Path to an environment-file which may contain secrets to be
+          substituted via <package>envsubst</package>.
+        '';
+      };
+
      dataDir = mkOption {
        type = types.str;
        default = "/var/lib/mxisd";
@ -118,7 +127,12 @@ in {
        Type = "simple";
        User = "mxisd";
        Group = "mxisd";
-        ExecStart = "${cfg.package}/bin/${executable} -c ${configFile}";
+        EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
+        ExecStart = "${cfg.package}/bin/${executable} -c ${cfg.dataDir}/mxisd-config.yaml";
+        ExecStartPre = "${pkgs.writeShellScript "mxisd-substitute-secrets" ''
+          ${pkgs.envsubst}/bin/envsubst -o ${cfg.dataDir}/mxisd-config.yaml \
+            -i ${configFile}
+        ''}";
        WorkingDirectory = cfg.dataDir;
        Restart = "on-failure";
      };
--- a/nixos/modules/services/networking/yggdrasil.nix
+++ b/nixos/modules/services/networking/yggdrasil.nix
@ -61,10 +61,10 @@ in {
      };

      group = mkOption {
-        type = types.str;
-        default = "root";
+        type = types.nullOr types.str;
+        default = null;
        example = "wheel";
-        description = "Group to grant access to the Yggdrasil control socket.";
+        description = "Group to grant access to the Yggdrasil control socket. If <code>null</code>, only root can access the socket.";
      };

      openMulticastPort = mkOption {
@ -154,27 +154,16 @@ in {
        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
        Restart = "always";

-        Group = cfg.group;
+        DynamicUser = true;
+        StateDirectory = "yggdrasil";
        RuntimeDirectory = "yggdrasil";
        RuntimeDirectoryMode = "0750";
        BindReadOnlyPaths = lib.optional configFileProvided cfg.configFile
          ++ lib.optional cfg.persistentKeys keysPath;
+        ReadWritePaths = "/run/yggdrasil";

-        # TODO: as of yggdrasil 0.3.8 and systemd 243, yggdrasil fails
-        # to set up the network adapter when DynamicUser is set.  See
-        # github.com/yggdrasil-network/yggdrasil-go/issues/557.  The
-        # following options are implied by DynamicUser according to
-        # the systemd.exec documentation, and can be removed if the
-        # upstream issue is fixed and DynamicUser is set to true:
-        PrivateTmp = true;
-        RemoveIPC = true;
-        NoNewPrivileges = true;
-        ProtectSystem = "strict";
-        RestrictSUIDSGID = true;
-        # End of list of options implied by DynamicUser.
-
-        AmbientCapabilities = "CAP_NET_ADMIN";
-        CapabilityBoundingSet = "CAP_NET_ADMIN";
+        AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE";
+        CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE";
        MemoryDenyWriteExecute = true;
        ProtectControlGroups = true;
        ProtectHome = "tmpfs";
@ -185,7 +174,9 @@ in {
        RestrictRealtime = true;
        SystemCallArchitectures = "native";
        SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @resources";
-      };
+      } // (if (cfg.group != null) then {
+        Group = cfg.group;
+      } else {});
    };

    networking.dhcpcd.denyInterfaces = cfg.denyDhcpcdInterfaces;
--- a/nixos/modules/services/security/privacyidea.nix
+++ b/nixos/modules/services/security/privacyidea.nix
@ -51,6 +51,16 @@ let
    ${cfg.extraConfig}
  '';

+  renderValue = x:
+    if isList x then concatMapStringsSep "," (x: ''"${x}"'') x
+    else if isString x && hasInfix "," x then ''"${x}"''
+    else x;
+
+  ldapProxyConfig = pkgs.writeText "ldap-proxy.ini"
+    (generators.toINI {}
+      (flip mapAttrs cfg.ldap-proxy.settings
+        (const (mapAttrs (const renderValue)))));
+
 in

 {
@ -172,7 +182,8 @@ in
        enable = mkEnableOption "PrivacyIDEA LDAP Proxy";

        configFile = mkOption {
-          type = types.path;
+          type = types.nullOr types.path;
+          default = null;
          description = ''
            Path to PrivacyIDEA LDAP Proxy configuration (proxy.ini).
          '';
@ -189,6 +200,26 @@ in
          default = "pi-ldap-proxy";
          description = "Group account under which PrivacyIDEA LDAP proxy runs.";
        };
+
+        settings = mkOption {
+          type = with types; attrsOf (attrsOf (oneOf [ str bool int (listOf str) ]));
+          default = {};
+          description = ''
+            Attribute-set containing the settings for <package>privacyidea-ldap-proxy</package>.
+            It's possible to pass secrets using env-vars as substitutes and
+            use the option <xref linkend="opt-services.privacyidea.ldap-proxy.environmentFile" />
+            to inject them via <package>envsubst</package>.
+          '';
+        };
+
+        environmentFile = mkOption {
+          default = null;
+          type = types.nullOr types.str;
+          description = ''
+            Environment file containing secrets to be substituted into
+            <xref linkend="opt-services.privacyidea.ldap-proxy.settings" />.
+          '';
+        };
      };
    };
  };
@ -276,6 +307,18 @@ in

    (mkIf cfg.ldap-proxy.enable {

+      assertions = [
+        { assertion = let
+            xor = a: b: a && !b || !a && b;
+          in xor (cfg.ldap-proxy.settings == {}) (cfg.ldap-proxy.configFile == null);
+          message = "configFile & settings are mutually exclusive for services.privacyidea.ldap-proxy!";
+        }
+      ];
+
+      warnings = mkIf (cfg.ldap-proxy.configFile != null) [
+        "Using services.privacyidea.ldap-proxy.configFile is deprecated! Use the RFC42-style settings option instead!"
+      ];
+
      systemd.services.privacyidea-ldap-proxy = let
        ldap-proxy-env = pkgs.python3.withPackages (ps: [ ps.privacyidea-ldap-proxy ]);
      in {
@ -284,14 +327,27 @@ in
        serviceConfig = {
          User = cfg.ldap-proxy.user;
          Group = cfg.ldap-proxy.group;
-          ExecStart = ''
+          StateDirectory = "privacyidea-ldap-proxy";
+          EnvironmentFile = mkIf (cfg.ldap-proxy.environmentFile != null)
+            [ cfg.ldap-proxy.environmentFile ];
+          ExecStartPre =
+            "${pkgs.writeShellScript "substitute-secrets-ldap-proxy" ''
+              ${pkgs.envsubst}/bin/envsubst \
+                -i ${ldapProxyConfig} \
+                -o $STATE_DIRECTORY/ldap-proxy.ini
+            ''}";
+          ExecStart = let
+            configPath = if cfg.ldap-proxy.settings != {}
+              then "%S/privacyidea-ldap-proxy/ldap-proxy.ini"
+              else cfg.ldap-proxy.configFile;
+          in ''
            ${ldap-proxy-env}/bin/twistd \
              --nodaemon \
              --pidfile= \
              -u ${cfg.ldap-proxy.user} \
              -g ${cfg.ldap-proxy.group} \
              ldap-proxy \
-              -c ${cfg.ldap-proxy.configFile}
+              -c ${configPath}
          '';
          Restart = "always";
        };
--- a/nixos/modules/services/web-apps/atlassian/jira.nix
+++ b/nixos/modules/services/web-apps/atlassian/jira.nix
@ -8,21 +8,22 @@ let

  pkg = cfg.package.override (optionalAttrs cfg.sso.enable {
    enableSSO = cfg.sso.enable;
-    crowdProperties = ''
-      application.name                        ${cfg.sso.applicationName}
-      application.password                    ${cfg.sso.applicationPassword}
-      application.login.url                   ${cfg.sso.crowd}/console/
-
-      crowd.server.url                        ${cfg.sso.crowd}/services/
-      crowd.base.url                          ${cfg.sso.crowd}/
-
-      session.isauthenticated                 session.isauthenticated
-      session.tokenkey                        session.tokenkey
-      session.validationinterval              ${toString cfg.sso.validationInterval}
-      session.lastvalidation                  session.lastvalidation
-    '';
  });

+  crowdProperties = pkgs.writeText "crowd.properties" ''
+    application.name                        ${cfg.sso.applicationName}
+    application.password                    @NIXOS_JIRA_CROWD_SSO_PWD@
+    application.login.url                   ${cfg.sso.crowd}/console/
+
+    crowd.server.url                        ${cfg.sso.crowd}/services/
+    crowd.base.url                          ${cfg.sso.crowd}/
+
+    session.isauthenticated                 session.isauthenticated
+    session.tokenkey                        session.tokenkey
+    session.validationinterval              ${toString cfg.sso.validationInterval}
+    session.lastvalidation                  session.lastvalidation
+  '';
+
 in

 {
@ -112,9 +113,9 @@ in
          description = "Exact name of this JIRA instance in Crowd";
        };

-        applicationPassword = mkOption {
+        applicationPasswordFile = mkOption {
          type = types.str;
-          description = "Application password of this JIRA instance in Crowd";
+          description = "Path to the file containing the application password of this JIRA instance in Crowd";
        };

        validationInterval = mkOption {
@ -181,6 +182,7 @@ in
        JIRA_HOME = cfg.home;
        JAVA_HOME = "${cfg.jrePackage}";
        CATALINA_OPTS = concatStringsSep " " cfg.catalinaOptions;
+        JAVA_OPTS = mkIf cfg.sso.enable "-Dcrowd.properties=${cfg.home}/crowd.properties";
      };

      preStart = ''
@ -191,6 +193,14 @@ in
          -e 's,protocol="HTTP/1.1",protocol="HTTP/1.1" proxyName="${cfg.proxy.name}" proxyPort="${toString cfg.proxy.port}" scheme="${cfg.proxy.scheme}" secure="${toString cfg.proxy.secure}",' \
        '') + ''
          ${pkg}/conf/server.xml.dist > ${cfg.home}/server.xml
+
+        ${optionalString cfg.sso.enable ''
+          install -m660 ${crowdProperties} ${cfg.home}/crowd.properties
+          ${pkgs.replace-secret}/bin/replace-secret \
+            '@NIXOS_JIRA_CROWD_SSO_PWD@' \
+            ${cfg.sso.applicationPasswordFile} \
+            ${cfg.home}/crowd.properties
+        ''}
      '';

      serviceConfig = {
@ -204,4 +214,10 @@ in
      };
    };
  };
+
+  imports = [
+    (mkRemovedOptionModule [ "services" "jira" "sso" "applicationPassword" ] ''
+      Use `applicationPasswordFile` instead!
+    '')
+  ];
 }
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
@ -264,8 +264,6 @@ def main() -> None:
        if installed_version < available_version:
            print("updating systemd-boot from %s to %s" % (installed_version, available_version))
            subprocess.check_call(["@systemd@/bin/bootctl", "--path=@efiSysMountPoint@", "update"])
-        else:
-            print("leaving systemd-boot %s in place (%s is not newer)" % (installed_version, available_version))

    mkdir_p("@efiSysMountPoint@/efi/nixos")
    mkdir_p("@efiSysMountPoint@/loader/entries")
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -279,6 +279,7 @@ in {
  libresprite = handleTest ./libresprite.nix {};
  libreswan = handleTest ./libreswan.nix {};
  librewolf = handleTest ./firefox.nix { firefoxPackage = pkgs.librewolf; };
+  libuiohook = handleTest ./libuiohook.nix {};
  lidarr = handleTest ./lidarr.nix {};
  lightdm = handleTest ./lightdm.nix {};
  limesurvey = handleTest ./limesurvey.nix {};
--- a/nixos/tests/libuiohook.nix
+++ b/nixos/tests/libuiohook.nix
@ -0,0 +1,21 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
+  name = "libuiohook";
+  meta = with lib.maintainers; { maintainers = [ anoa ]; };
+
+  nodes.client = { nodes, ... }:
+      let user = nodes.client.config.users.users.alice;
+      in {
+        imports = [ ./common/user-account.nix ./common/x11.nix ];
+
+        environment.systemPackages = [ pkgs.libuiohook.test ];
+
+        test-support.displayManager.auto.user = user.name;
+      };
+
+  testScript = { nodes, ... }:
+    let user = nodes.client.config.users.users.alice;
+    in ''
+      client.wait_for_x()
+      client.succeed("su - alice -c ${pkgs.libuiohook.test}/share/uiohook_tests >&2 &")
+    '';
+})
--- a/pkgs/applications/emulators/yuzu/default.nix
+++ b/pkgs/applications/emulators/yuzu/default.nix
@ -5,23 +5,23 @@
 }:

 let
-  # Fetched from https://api.yuzu-emu.org/gamedb, last updated 2022-05-12
+  # Fetched from https://api.yuzu-emu.org/gamedb, last updated 2022-07-14
  # Please make sure to update this when updating yuzu!
  compat-list = fetchurl {
    name = "yuzu-compat-list";
-    url = "https://web.archive.org/web/20220512184801/https://api.yuzu-emu.org/gamedb";
+    url = "https://web.archive.org/web/20220714160745/https://api.yuzu-emu.org/gamedb";
    sha256 = "sha256-anOmO7NscHDsQxT03+YbJEyBkXjhcSVGgKpDwt//GHw=";
  };
 in {
  mainline = libsForQt5.callPackage ./generic.nix rec {
    pname = "yuzu-mainline";
-    version = "1088";
+    version = "1092";

    src = fetchFromGitHub {
      owner = "yuzu-emu";
      repo = "yuzu-mainline";
      rev = "mainline-0-${version}";
-      sha256 = "0kjiynv1fwc14w7382qgzayz5j9n2rnzbpbq49zgcywc4wwcxzs2";
+      sha256 = "1avcq924q0r8pfv1s0a88iyii7yixcxpb3yhlj0xg9zqnwp9r23y";
      fetchSubmodules = true;
    };

@ -30,13 +30,13 @@ in {

  early-access = libsForQt5.callPackage ./generic.nix rec {
    pname = "yuzu-ea";
-    version = "2725";
+    version = "2841";

    src = fetchFromGitHub {
      owner = "pineappleEA";
      repo = "pineapple-src";
      rev = "EA-${version}";
-      sha256 = "1nmcl9y9chr7cdvnra5zs1v42d3i801hmsjdlz3fmp15n04bcjmp";
+      sha256 = "16lrq9drv0x7gs1siq37m4zmh6d2g3vhnw9qcqajr9p0vmlpnh6l";
      fetchSubmodules = true;
    };

--- a/pkgs/applications/emulators/yuzu/update.sh
+++ b/pkgs/applications/emulators/yuzu/update.sh
@ -53,7 +53,7 @@ updateEarlyAccess() {
    OLD_EA_HASH="$(getLocalHash "yuzu-ea")"

    NEW_EA_VERSION="$(curl -s ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
-        "https://api.github.com/repos/pineappleEA/pineapple-src/releases?per_page=1" | jq -r '.[0].name' | cut -d"-" -f2 | cut -d" " -f1)"
+        "https://api.github.com/repos/pineappleEA/pineapple-src/releases?per_page=1" | jq -r '.[0].tag_name' | cut -d"-" -f2 | cut -d" " -f1)"

    if [[ "${OLD_EA_VERSION}" = "${NEW_EA_VERSION}" ]]; then
        echo "yuzu-ea is already up to date!"
--- a/pkgs/applications/gis/qgis/unwrapped-ltr.nix
+++ b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
@ -69,14 +69,14 @@ let
    six
  ];
 in mkDerivation rec {
-  version = "3.22.8";
+  version = "3.22.9";
  pname = "qgis-ltr-unwrapped";

  src = fetchFromGitHub {
    owner = "qgis";
    repo = "QGIS";
    rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "sha256-YxF7FzyNNt+bdk96g2sWWv9haqV0L6Ab96D0hV0BFrA=";
+    sha256 = "sha256-QHdcK34e7tC0AUstE8pbsBHzHXbmOd3gI2/zqsxb6X4=";
  };

  passthru = {
--- a/pkgs/applications/gis/qgis/unwrapped.nix
+++ b/pkgs/applications/gis/qgis/unwrapped.nix
@ -69,14 +69,14 @@ let
    six
  ];
 in mkDerivation rec {
-  version = "3.26.0";
+  version = "3.26.1";
  pname = "qgis-unwrapped";

  src = fetchFromGitHub {
    owner = "qgis";
    repo = "QGIS";
    rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "sha256-yHQi5ai7fdgznTf562Bj0QPE+SXg972O7+r01RY7itE=";
+    sha256 = "sha256-FjMe/5uEbmSeQrAtkKvoGh4VlPkbGMHNzlCpn27C5CQ=";
  };

  passthru = {
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@ -21,7 +21,7 @@
 }:

 let
-  version = "4.2.1";
+  version = "4.2.2";

  libsecp256k1_name =
    if stdenv.isLinux then "libsecp256k1.so.0"
@ -37,7 +37,7 @@ let
    owner = "spesmilo";
    repo = "electrum";
    rev = version;
-    sha256 = "sha256-BoikYSsQZAv8WswIr5nmBsGmjZbTXaLAbdO2QtPvc7c=";
+    sha256 = "sha256-bFceOu+3SLtD2eY+aSBEn13xJw7a3aVwX39QfAuqVSo=";

    postFetch = ''
      mv $out ./all
@ -53,7 +53,7 @@ python3.pkgs.buildPythonApplication {

  src = fetchurl {
    url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
-    sha256 = "sha256-2SxSTH9P380j2KaCbkXjgmQO7K2z81AG6PMA/EMggXA=";
+    sha256 = "sha256-ucLLfqmTKO5Qpg+PnmcdQwht7cWMWJoFjQWnDecEtVs=";
  };

  postUnpack = ''
--- a/pkgs/applications/misc/openbangla-keyboard/Cargo.lock
+++ b/pkgs/applications/misc/openbangla-keyboard/Cargo.lock
@ -0,0 +1,251 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "ahash"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8fd72866655d1904d6b0997d0b07ba561047d070fbe29de039031c641b61217"
+
+[[package]]
+name = "aho-corasick"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e37cfd5e7657ada45f742d6e99ca5788580b5c529dc78faf11ece6dc702656f"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c02a4d71819009c192cf4872265391563fd6a84c81ff2c0f2a7026ca4c1d85c"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-deque"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6455c0ca19f0d2fbf751b908d5c55c1f5cbc65e03c4225427254b46890bdde1e"
+dependencies = [
+ "cfg-if",
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07db9d94cbd326813772c968ccd25999e5f8ae22f4f8d1b11effa37ef6ce281d"
+dependencies = [
+ "autocfg",
+ "cfg-if",
+ "crossbeam-utils",
+ "memoffset",
+ "once_cell",
+ "scopeguard",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d82ee10ce34d7bc12c2122495e7593a9c41347ecdd64185af4ecf72cb1a7f83"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+]
+
+[[package]]
+name = "edit-distance"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbbaaaf38131deb9ca518a274a45bfdb8771f139517b073b16c2d3d32ae5037b"
+
+[[package]]
+name = "either"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f107b87b6afc2a64fd13cac55fe06d6c8859f12d4b14cbcdd2c67d0976781be"
+
+[[package]]
+name = "hashbrown"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e91b62f79061a0bc2e046024cb7ba44b08419ed238ecbd9adbd787434b9e8c25"
+dependencies = [
+ "ahash",
+ "autocfg",
+ "rayon",
+ "serde",
+]
+
+[[package]]
+name = "hermit-abi"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112c678d4050afce233f4f2852bb2eb519230b3cf12f33585275537d7e41578d"
+
+[[package]]
+name = "libc"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "349d5a591cd28b49e1d1037471617a32ddcda5731b99419008085f72d5a53836"
+
+[[package]]
+name = "memchr"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+
+[[package]]
+name = "memoffset"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5aa361d4faea93603064a027415f07bd8e1d5c88c9fbf68bf56a285428fd79ce"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "num_cpus"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19e64526ebdee182341572e50e9ad03965aa510cd94427a4549448f285e957a1"
+dependencies = [
+ "hermit-abi",
+ "libc",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18a6dbe30758c9f83eb00cbea4ac95966305f5a7772f3f42ebfc7fc7eddbd8e1"
+
+[[package]]
+name = "rayon"
+version = "1.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd99e5772ead8baa5215278c9b15bf92087709e9c1b2d1f97cdb5a183c933a7d"
+dependencies = [
+ "autocfg",
+ "crossbeam-deque",
+ "either",
+ "rayon-core",
+]
+
+[[package]]
+name = "rayon-core"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "258bcdb5ac6dad48491bb2992db6b7cf74878b0384908af124823d118c99683f"
+dependencies = [
+ "crossbeam-channel",
+ "crossbeam-deque",
+ "crossbeam-utils",
+ "num_cpus",
+]
+
+[[package]]
+name = "regex"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c4eb3267174b8c6c2f654116623910a0fef09c4753f8dd83db29c48a0df988b"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.6.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3f87b73ce11b1619a3c6332f45341e0047173771e8b8b73f87bfeefb7b56244"
+
+[[package]]
+name = "riti"
+version = "0.1.0"
+dependencies = [
+ "edit-distance",
+ "either",
+ "hashbrown",
+ "rayon",
+ "regex",
+ "rupantor",
+ "serde_json",
+ "stringplus",
+]
+
+[[package]]
+name = "rupantor"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04eb802986005129b0946dbb4baa420bf14cea547c5ee6b57ba081d9e85f6a4b"
+dependencies = [
+ "serde_json",
+ "stringplus",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3f6f92acf49d1b98f7a81226834412ada05458b7364277387724a237f062695"
+
+[[package]]
+name = "scopeguard"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+
+[[package]]
+name = "serde"
+version = "1.0.139"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0171ebb889e45aa68b44aee0859b3eede84c6f5f5c228e6f140c0b2a0a46cad6"
+
+[[package]]
+name = "serde_json"
+version = "1.0.82"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82c2c1fdcd807d1098552c5b9a36e425e42e9fbd7c6a37a8425f390f781f7fa7"
+dependencies = [
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "stringplus"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9057d3b491a3eee749e52560657c4d93b0badc04fb3fa8dae3c942c5c066f222"
--- a/pkgs/applications/misc/openbangla-keyboard/default.nix
+++ b/pkgs/applications/misc/openbangla-keyboard/default.nix
@ -0,0 +1,72 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, rustPlatform
+, wrapQtAppsHook
+, ibus
+, qtbase
+, zstd
+}:
+
+stdenv.mkDerivation rec {
+  pname = "openbangla-keyboard";
+  version = "2.0.0";
+
+  src = fetchFromGitHub {
+    owner = "openbangla";
+    repo = "openbangla-keyboard";
+    rev = version;
+    hash = "sha256-UoLiysaA0Wob/SLBqm36Txqb8k7bwoQ56h8ZufHR74I=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    rustPlatform.rust.cargo
+    rustPlatform.rust.rustc
+    rustPlatform.cargoSetupHook
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    ibus
+    qtbase
+    zstd
+  ];
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    postPatch = ''
+      cp ${./Cargo.lock} Cargo.lock
+    '';
+    sourceRoot = "source/${cargoRoot}";
+    sha256 = "sha256-01MWuUUirsgpoprMArRp3qxKNayPHTkYWk31nXcIC34=";
+  };
+
+  cargoRoot = "src/engine/riti";
+  postPatch = ''
+    cp ${./Cargo.lock} ${cargoRoot}/Cargo.lock
+
+    substituteInPlace CMakeLists.txt \
+      --replace "/usr" "$out"
+
+    substituteInPlace src/shared/FileSystem.cpp \
+      --replace "/usr" "$out"
+  '';
+
+  postInstall = ''
+    mkdir -p $out/bin
+    ln -s $out/share/openbangla-keyboard/openbangla-gui $out/bin/openbangla-gui
+  '';
+
+  meta = with lib; {
+    description = "An OpenSource, Unicode compliant Bengali Input Method";
+    homepage = "https://openbangla.github.io/";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ hqurve ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/networking/google-drive-ocamlfuse/default.nix
+++ b/pkgs/applications/networking/google-drive-ocamlfuse/default.nix
@ -1,5 +1,5 @@
 { lib, buildDunePackage, fetchFromGitHub
-, ocaml_extlib, ocamlfuse, gapi_ocaml, ocaml_sqlite3
+, ocaml_extlib, ocamlfuse, gapi-ocaml, ocaml_sqlite3
 , tiny_httpd
 , ounit
 }:
@ -18,7 +18,7 @@ buildDunePackage rec {
  doCheck = true;
  checkInputs = [ ounit ];

-  buildInputs = [ ocaml_extlib ocamlfuse gapi_ocaml ocaml_sqlite3 tiny_httpd ];
+  buildInputs = [ ocaml_extlib ocamlfuse gapi-ocaml ocaml_sqlite3 tiny_httpd ];

  meta = {
    inherit (src.meta) homepage;
--- a/pkgs/applications/networking/instant-messengers/gajim/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gajim/default.nix
@ -22,11 +22,11 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "gajim";
-  version = "1.4.3";
+  version = "1.4.6";

  src = fetchurl {
    url = "https://gajim.org/downloads/${lib.versions.majorMinor version}/gajim-${version}.tar.gz";
-    sha256 = "sha256:0n6v96pwgds8655877fjgsphq4rd4gb9mz7cbqp4nkd4m7kvr3xv";
+    sha256 = "sha256-iiZ2Nv6voq67+OJ26hk+3JQSKevx9ti8s6DreSAsQk8=";
  };

  buildInputs = [
--- a/pkgs/applications/networking/irc/weechat/default.nix
+++ b/pkgs/applications/networking/irc/weechat/default.nix
@ -28,14 +28,14 @@ let
  in
    assert lib.all (p: p.enabled -> ! (builtins.elem null p.buildInputs)) plugins;
    stdenv.mkDerivation rec {
-      version = "3.5";
+      version = "3.6";
      pname = "weechat";

      hardeningEnable = [ "pie" ];

      src = fetchurl {
        url = "https://weechat.org/files/src/weechat-${version}.tar.bz2";
-        sha256 = "sha256-8ZSa2dQPTiChGW00T5OASHmd0C2PatUtTu9Gr4CF4Oc=";
+        sha256 = "sha256-GkYN/Y4LQQr7GdSDu0ucXXM9wWPAqKD1txJXkOhJMDc=";
      };

      outputs = [ "out" "man" ] ++ map (p: p.name) enabledPlugins;
--- a/pkgs/applications/science/math/nauty/default.nix
+++ b/pkgs/applications/science/math/nauty/default.nix
@ -4,11 +4,11 @@
 }:
 stdenv.mkDerivation rec {
  pname = "nauty";
-  version = "2.7r3";
+  version = "2.7r4";

  src = fetchurl {
    url = "https://pallini.di.uniroma1.it/nauty${builtins.replaceStrings ["."] [""] version}.tar.gz";
-    sha256 = "sha256-TwZltxalP3oU6irjAFnyPQZM4/5MEsATQE724e4LiMI=";
+    sha256 = "sha256-uBDIWm/imfO0yfJKr5KcrH+VRsLzXCDh3Qrbx0CISKY=";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/applications/science/math/sage/sage-src.nix
+++ b/pkgs/applications/science/math/sage/sage-src.nix
@ -117,6 +117,13 @@ stdenv.mkDerivation rec {
    # 5.0 hits nixpkgs.
    # https://github.com/sphinx-doc/sphinx/pull/10372
    ./patches/docutils-0.18.1-deprecation.patch
+
+    (fetchSageDiff {
+      name = "eclib-20220621-update.patch";
+      base = "9.7.beta4";
+      rev = "9b65d73399b33043777ba628a4d318638aec6e0e";
+      sha256 = "sha256-pcb9Q9a0ROCZTyfT7TRMtgEqCom8SgrtAaZ8ATgeqVI=";
+    })
  ];

  patches = nixPatches ++ bugfixPatches ++ packageUpgradePatches;
--- a/pkgs/applications/version-management/josh/default.nix
+++ b/pkgs/applications/version-management/josh/default.nix
@ -0,0 +1,60 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, libgit2
+, openssl
+, pkg-config
+, makeWrapper
+, git
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "josh";
+  version = "22.06.22";
+
+  src = fetchFromGitHub {
+    owner = "esrlabs";
+    repo = "josh";
+    rev = "r" + version;
+    sha256 = "0511qv9zyjvv4zfz6zyi69ssbkrwa24n0ah5w9mb4gzd547as8pq";
+  };
+
+  cargoSha256 = "0zfjjyyz4pxar1mfkkj9aij4dnwqy3asdrmay1iy6ijjn1qd97n4";
+
+  nativeBuildInputs = [
+    pkg-config
+    makeWrapper
+  ];
+
+  buildInputs = [
+    libgit2
+    openssl
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.Security
+  ];
+
+  cargoBuildFlags = [
+    "-p" "josh"
+    "-p" "josh-proxy"
+    # TODO: josh-ui
+  ];
+
+  postInstall = ''
+    wrapProgram "$out/bin/josh-proxy" --prefix PATH : "${git}/bin"
+  '';
+
+  meta = {
+    description = "Just One Single History";
+    homepage = "https://josh-project.github.io/josh/";
+    downloadPage = "https://github.com/josh-project/josh";
+    changelog = "https://github.com/josh-project/josh/releases/tag/${version}";
+    license = lib.licenses.mit;
+    maintainers = [
+      lib.maintainers.sternenseemann
+      lib.maintainers.tazjin
+    ];
+    platforms = lib.platforms.all;
+  };
+}
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@ -11,7 +11,7 @@ let
    (builtins.attrNames (builtins.removeAttrs variantHashes [ "iosevka" ]));
 in stdenv.mkDerivation rec {
  pname = "${name}-bin";
-  version = "15.5.2";
+  version = "15.6.0";

  src = fetchurl {
    url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/ttc-${name}-${version}.zip";
--- a/pkgs/data/fonts/iosevka/variants.nix
+++ b/pkgs/data/fonts/iosevka/variants.nix
@ -1,95 +1,95 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  iosevka = "1f96ngb6m5ssp5hcdv5mrb28jcqx4w8hmz9igi64rrbg3flj93ix";
-  iosevka-aile = "19b9mip3bffdfiwlr0gn2qs9zymdrill4kak1pbx2y6kjlbsz7c1";
-  iosevka-curly = "0mkkxi0sb50il400bvv5rsgcf0gdbzir0br9m6syxzqwg90lakl7";
-  iosevka-curly-slab = "1qbbk2nzgwp4skiwg5cck9i6hzdsqfd88l1cypbk4l4jvvmx0gxm";
-  iosevka-etoile = "1l6f8dgk8ajbd35gbf1hdrzjrn96fh6v2wqsp3q0ncyqa210yasp";
-  iosevka-slab = "1fnp92s7f73nzy1qlfaal15hl2wgayixl26z8gpcvkzz964zgip7";
-  iosevka-ss01 = "0fchf91kmgrisb0na5yig43w8dvpqasj87ppmc12jghybn6zfz8z";
-  iosevka-ss02 = "00sn5207s75w79qxlcn153vf0k9jfpwhvn7iydnrdibjgy1wr1h4";
-  iosevka-ss03 = "0j227mq286jm7ndd4lr9v3s6wmcw3ya5mbmyc2b7n0hq0jqnbi3h";
-  iosevka-ss04 = "1za5893fmbc78jzh7l1ggp3hzm3wjxmmdanc0xg5dj95nrp878di";
-  iosevka-ss05 = "0x6z60ig01x3r95izqr2w94d8ddiqawvml6ga1r476xsv3djvl4w";
-  iosevka-ss06 = "1w4p4bqrl29v2dpbrk8cdxr1zmipa5n8d2gnyd1ay0p8mrmclfl3";
-  iosevka-ss07 = "1abk0fnz5d5rlz226s8m45ndqss4f1sn9249fdhgbph939lcfqlr";
-  iosevka-ss08 = "0ilw5013rkl1sflri40pi1h56iir1hadnmxk8a3aa2l7ysmslz44";
-  iosevka-ss09 = "1v4y06d521c8hg03vw78h1lhdpvlij3ihdpm7g1ir2mfr1wz2dj9";
-  iosevka-ss10 = "1kk7gm2xzy3i8rr149f2lydwdzkgs21hp46yminv6k0ipzfhhy28";
-  iosevka-ss11 = "10sz5gncvizvi3f8sx7m6x7g1s1459v47xnap0j8w9qjp1c8d6c7";
-  iosevka-ss12 = "12gwiq5fpx3xiv40k0i3k7c3hj15vf0vp7i1glp00yv4v6vrx8an";
-  iosevka-ss13 = "05912nq3ll7ihalzazrs2r32krknfg9gpn8i05m7xn31zakizx98";
-  iosevka-ss14 = "0lfzxqywx6vjr9vwkgmf73j1bcqjyzgg2n0dk2l523bxlq26j9ng";
-  iosevka-ss15 = "0z5vx4hjclf06rirnacd3sdxa0cv6mbgdkiayjbl7k5j3xw2sh5r";
-  iosevka-ss16 = "1lhhbdkd5dd87l2b5jmkacnx8h2pp6gwql9clj7sq006ir6a7in4";
-  iosevka-ss17 = "0000x8zsfh7kpjdcqhd9fqi9sp4hfkq3i1rmwhlxjmjwcx1rbccd";
-  iosevka-ss18 = "16chvb7fz9nn5g87nx2qxfbzqydi6aqdrr5l5hbd42zgx06rxg6b";
-  sgr-iosevka = "1pxbqg4c9s63c6yg0hfzw2pky2izgi8m4rl987k7bisqmsmw7dz5";
-  sgr-iosevka-aile = "16b44mhvd86cfzazwgrxzvlb4pl79qgcyllw07r4xis3x1gb9n4x";
-  sgr-iosevka-curly = "011rr2z0c1sdydyb4g3wb7icf6w13qagsimg6wvwq5v49ybv2p51";
-  sgr-iosevka-curly-slab = "0rvddn0fw3p454f5kpnh5lc0vgg5zg9v5658a16yqq0pyabbqm1v";
-  sgr-iosevka-etoile = "1l4ljc4g1gfn8n79783cid991rpvffw2abp0br4j0sd8fy4vd97s";
-  sgr-iosevka-fixed = "0hkfc8lpqda5vrbckcb740vyysgr7xbfns0v2gsdgj8kbvmw21bc";
-  sgr-iosevka-fixed-curly = "19r03fvhcm49nknvf52cp2hrgiaas29jm6skw2xci377adl8xvy7";
-  sgr-iosevka-fixed-curly-slab = "1smas7dhsz5qqg22hwlzwhf2wqrasj9gm28pyrwqbqri68982d8i";
-  sgr-iosevka-fixed-slab = "1qsafga9xfx6zyyhnlli6d33n9mak5a44lj4klnipm631cfax539";
-  sgr-iosevka-fixed-ss01 = "1w3683s7dgwh4njqv4726ghanfki119grszlpkd4ry5l88naw9wz";
-  sgr-iosevka-fixed-ss02 = "0lxdx1d6ynywjifarcr5ijga60d8mj4jn4av57yk0m7430qj535m";
-  sgr-iosevka-fixed-ss03 = "0wzpn8ra4y6g8gyhx62yyq2s1k7vvp0rbr5cnn810hfqjhc49dhi";
-  sgr-iosevka-fixed-ss04 = "0135yadsykcnpjcn9ldhr3pj9l6qnqnixfyn2xvvkxlmlkhizkm9";
-  sgr-iosevka-fixed-ss05 = "18vwd9sz6mlzg23dms1w79a98xsy2prkm0d6wkmyczi3pmwc11f2";
-  sgr-iosevka-fixed-ss06 = "12mwqq8js5njlddkakpsb798vc8bbiabd2kkvkkvsqmbanpic9ih";
-  sgr-iosevka-fixed-ss07 = "19r5a11n8m8k5nqlzgh4wr28gid81gxm7f28bgcz8jmjyvhrkmsq";
-  sgr-iosevka-fixed-ss08 = "0ya22ig0aawfi9k7q2hbqd7nfkhij8mj6jaqcp5fqlglgy8r437b";
-  sgr-iosevka-fixed-ss09 = "0cyvzalw9jp09kssc9p6pyfw843pbjgyhhjs311b5l8sr33add4k";
-  sgr-iosevka-fixed-ss10 = "1bvjm58jcgpjcjyhas10bp0wy5zlvqfkzwj4pzn5h4640vlv7rab";
-  sgr-iosevka-fixed-ss11 = "0zm7ncl1n910lqzrp20wp8dayl0wnaijwjzjza7y7wi8f3wi072f";
-  sgr-iosevka-fixed-ss12 = "0y3iqkx7hkry9yj7vszvqywbpnim26gdlm6a9gq57i3ilnkh3fqq";
-  sgr-iosevka-fixed-ss13 = "10snkzp4ihfd25760sf535s0z736lszx9kmr37bjs0yfk91qcd6i";
-  sgr-iosevka-fixed-ss14 = "1h4l025xzsxfhwzs19bzib6kf4asj0066ynwn6a7hjicsy2l8als";
-  sgr-iosevka-fixed-ss15 = "1jplpd42ik9lvdxl4kl1hqpz7h1m580r10p0pnnpv64zw9vqpzzc";
-  sgr-iosevka-fixed-ss16 = "0w2fgg3c0qkwpsvj4jq287wjgidpx49gnd4ijyqqwlzwyijc8v2a";
-  sgr-iosevka-fixed-ss17 = "0m8qpimcan5i2s7v8dhy8j85lzddgmlqjyjf1sfg6694d2ar0hpb";
-  sgr-iosevka-fixed-ss18 = "0hbaa84j5izsmibmnx1cwg4s37bc5iq6pib1shlk97fd7c96b3g7";
-  sgr-iosevka-slab = "1fxwc9s9ic33fn65gc565fg7h91ny9vj09lvhqpwc5v6jqky7bx8";
-  sgr-iosevka-ss01 = "1x72r1k4bz7xg92f8h5lp627dvvcw1li7iq3z511hprf08diyj6w";
-  sgr-iosevka-ss02 = "1xzysnn656j8pwsy1grfgbsdkyhizfviah9b6plkfs0crkpjfrd4";
-  sgr-iosevka-ss03 = "18d8in437sp0bc3bqb6rim97ygzsmyimnyp7m0czn8f9nyq920xc";
-  sgr-iosevka-ss04 = "1vbdqygbw3m0vk4jxd7f8qzap9cms9h0f9i7sr6cn50k998f9pnx";
-  sgr-iosevka-ss05 = "0fzkh4a6ni4mc26ss0x4bmhil0xm81p3xwhk0w0cr4qz7m5hk5b7";
-  sgr-iosevka-ss06 = "1b7zmjlgzwjnvvkh743ma3lla7jqcq6fsg526kfh0ghxzhhp4s9y";
-  sgr-iosevka-ss07 = "0l75xqx4lp5pa65s6phany5gwhswmfs3y0sck211sfzgifmlqf73";
-  sgr-iosevka-ss08 = "06zj3msqc69xlmm2sjwcr5s7ibk4qlych7fhhfzjyrawy7mvxrq9";
-  sgr-iosevka-ss09 = "11ba3rlp7mnnklznjhmhqfhy3qcnj7fn3w1wjzpqczvi71kskrff";
-  sgr-iosevka-ss10 = "04y5q4wspay4y7clrybgyrdyx43kw89zknszzd2df6bz7jpa583x";
-  sgr-iosevka-ss11 = "13igcnw8ja2xcpdyshm75qv293x050nx5r9yzxq6rxbppgv7yac2";
-  sgr-iosevka-ss12 = "0f3qnldpcavacrnj3x1av7729api33zll4x00zi1rhxd0akldrlb";
-  sgr-iosevka-ss13 = "1zy59pa7h2bchxl9gp6xvlj56a6p7jms2m49rsss8l9x5aq2gar1";
-  sgr-iosevka-ss14 = "1m66cyr8iybxa7hag65lv82q28mnx02yncklssb516gv5swd4sly";
-  sgr-iosevka-ss15 = "03n0qglqhlvg078jnj4l2ni3257g9l5zrbl7y3j051qpn3lkradg";
-  sgr-iosevka-ss16 = "0zqyxinrmfnlmkd735laz8ijb22mp1p04xhgqvgvx1npnjkz79jx";
-  sgr-iosevka-ss17 = "13dyw8im15njkml0wzqky1jp1rf4pnp8c1jhich4c6s24y0nvnkk";
-  sgr-iosevka-ss18 = "1bmh3k5g4h9qq539dh7qhpb5ai1sqrnk6yla6yr8bwpym53knysd";
-  sgr-iosevka-term = "0rzl36kz7xfg2cqr8hq8d3vqgg3wnk6ki44xxpspdfgkhyhffz5v";
-  sgr-iosevka-term-curly = "0212hs0yp8d46vc12gg3wahmxd2chscrpxcpcwi19cpii8m1jvsx";
-  sgr-iosevka-term-curly-slab = "04vyaj8ah3vj90zrd3jv2iqhgdcndqa0sn31ff4s28jzqwfg4d5q";
-  sgr-iosevka-term-slab = "0g60dz0y69wwa47x4q5kdpf2bjwjzsmr2zdnphsxwp0iari3mnls";
-  sgr-iosevka-term-ss01 = "16s7mgll7filyjjzw5cd5xmfgy7w658xxp8h6x52prcb8b1jpaxr";
-  sgr-iosevka-term-ss02 = "1vbarkid9v77qk83ymls3ppgh81kh5qch7k2zqd293dvb25p1irc";
-  sgr-iosevka-term-ss03 = "0zgy4v7i7wnbr1rgwcq8mn7128m82f25i9xmbyv3nk66ic4dn17v";
-  sgr-iosevka-term-ss04 = "1vl1w9y1xrpnpdzgcnp86gq9k7kyili1spccb6rbziw7il0sva5w";
-  sgr-iosevka-term-ss05 = "0kfbkpd1zdh8wdqh72h6q20fq6yfr0xp48bk1nk4k5y1pakibdcs";
-  sgr-iosevka-term-ss06 = "1mmc5w6div7nz8c0bfhhzxi6hm0w0qhfn4v7barkl5pw39iy7hls";
-  sgr-iosevka-term-ss07 = "16ki4n6vw9vxhwkx7mc0gid456hzznhcv8adq5ky8f78x0d1b7sa";
-  sgr-iosevka-term-ss08 = "1c3fbn01dpp684znawk0c8d0vq9ldsiybwsl9jmz3ighx1wli6d0";
-  sgr-iosevka-term-ss09 = "1ch6g56y7jfm2720cvn3v1kb7lj23db23p4frnyx32wxngfb8fc7";
-  sgr-iosevka-term-ss10 = "08pq3y4112x7s72b7clv4j0hna6v4ks75ap62g0ll6xw541s5g7k";
-  sgr-iosevka-term-ss11 = "0bivi2kd01q2007zja7cnphy6g3f369qgc4i848agpsin7dzxavh";
-  sgr-iosevka-term-ss12 = "1jfinia1kmwm6kjyx5sfbzfhb9qyjq51hjynpafrlyc2jzi4jh2w";
-  sgr-iosevka-term-ss13 = "19jg7r1jz3b39brsp8l0xklmydm015v4z3lcm8waw84g6ahpsz4d";
-  sgr-iosevka-term-ss14 = "1060bnwvc0mfkfq03m45giv7n5b9cdn7ssz8y0dkavfkxxqjf3rb";
-  sgr-iosevka-term-ss15 = "1zjl2jxsvkp31h756l95bhg7vk2vmpsrrdvr8s1blgbywf73vs0h";
-  sgr-iosevka-term-ss16 = "104myf8pvxiqjzy6ws2b8yjxddrlmnympnlgi2klbda0snvipcah";
-  sgr-iosevka-term-ss17 = "0aas4q54mhrd0vnh0ridgcb5q9m8xism9lk87kwxr6nmkyp5fabj";
-  sgr-iosevka-term-ss18 = "0z0gcvvpiyb86i5x6c1haggbb02l2jx1asa8ag17mwdaf7cp792m";
+  iosevka = "1frma5fnrfq1z06mvpy3wvp7jkww8qlji308b3pxv0nxwgjd1vyv";
+  iosevka-aile = "086ml3r09k3raxrwdmqgn7s7xga1zgrkvzxsldzwjpsw9jsax0m6";
+  iosevka-curly = "000n3wsjsk562lpydmck2c36sxd0w2wkjgz8f7dm8iw57ls9pn6g";
+  iosevka-curly-slab = "1cybjnmiwqjxj0rw3lil7n5vc6c30dg7ak0dz4g6q5klbnsw354s";
+  iosevka-etoile = "0gxhsgsxzkz34lln20aqz0rd8wvm58090f6v8z4fi5qsm0dla06s";
+  iosevka-slab = "00nd3h8vyqzlwbp45by6crzjq9rjpmj0nmmbbq17xvjgxxfhjsxr";
+  iosevka-ss01 = "1yq8bnrbw3g24xsnrwbq1vl05m4dlcpjl29h8g8irhhpbnnm44nx";
+  iosevka-ss02 = "1r40drbjxpwb7aqa24hh90nxayzj3gah110fsf8yjq5l5azg9ds8";
+  iosevka-ss03 = "1mlg9qjfdfia0vwd86gi9ygbbnamld56lpf4h6m7gr8y8v00p07i";
+  iosevka-ss04 = "0ap45s2si80gbz78q5v8qqga2ipy9dsz9hkq5dyfh8axlx1wiy7p";
+  iosevka-ss05 = "1mah12ihqwqlkmr01l5z6kasb6h6xifgd7acfypz5547ip2zy425";
+  iosevka-ss06 = "09w0hm5djjhfvy6lhbynvlq6ckd70zisv0z5y7w4jfmanif8jns3";
+  iosevka-ss07 = "17imf7021ncpl9f8nbm1c0bjz5grz1iqgvpz48vpqd56632ac6k6";
+  iosevka-ss08 = "199bf0qa76z59ad5d7fcgkiq8m4fxcia7q162zzjlxpl5bgv0665";
+  iosevka-ss09 = "0w7jcgi4vn5ix58ji5cybpbnzvdl21k1r6rxad76z97ywwqbflag";
+  iosevka-ss10 = "18vm9p6jdbyfc8q3cz8wf3sgd0xn7pzyw3qxld9d2qg83siybsmk";
+  iosevka-ss11 = "0aj1l0g3zzcr3grkj1l6s39449g60v6hvjfmb4xx4kxg7h1h5b4i";
+  iosevka-ss12 = "0zl2ffmgnlrcaj8mzfgp5x5z7iras5svdpf0zl2xcgjn15k17lkx";
+  iosevka-ss13 = "0b58jjhd17i9pc5gdcx3xj9y8bgzwxrlh21j6di4cgvgj41gh46k";
+  iosevka-ss14 = "0vlqr5s40xcc2645vsaap42cgfswi2p4hbpqbfjfzsmf41w6j6qc";
+  iosevka-ss15 = "01qgvdmy8frbasb5d39c12dxjlha6iv1dq621il0dzm0850x48ys";
+  iosevka-ss16 = "12vl98p6w73l4rfy2scn57jrvg2jxk99d2vsndri013grx488lq5";
+  iosevka-ss17 = "0336m1i7vdd86jgyfdnsw4f6pdzcd4d757gxf8pa3h6jyczcn8n1";
+  iosevka-ss18 = "07sqd4zwc85q8mh9l1bc2nbyr966b0bh9fff9rk91jrk106fijcl";
+  sgr-iosevka = "0adxnngdwz6lmp4yla8amk0840y9k6d3k1jl90z5qd3dpl0m0w7z";
+  sgr-iosevka-aile = "07470h9apwbmnai1rzx5s9jw3195gsxqv6q0z1gnf56mp94wihg1";
+  sgr-iosevka-curly = "1jii49qqlrpvzczwqi39001j0qwbrzklc96bwampn9f0la1iqcbf";
+  sgr-iosevka-curly-slab = "0bwfsimzkw4pbk6qy4nvbpwcw0h3m16qsjaqwrwfhnzy8hqc6akc";
+  sgr-iosevka-etoile = "091ikanzxmkb673wfcfdg9qm56xqv4vwd3c1ph0c5bzc2nz3il50";
+  sgr-iosevka-fixed = "1nz7x90zcbmvwldiz5zv5j22qyjgjn4ba42liki747lr930f38lm";
+  sgr-iosevka-fixed-curly = "17y7h5jwim59zybpmkv3rqdcc41dxax5145xmhyzvagblsc7qlpk";
+  sgr-iosevka-fixed-curly-slab = "1xfaszbpydi6vzif14bymv5cqlwxvvkdadba4jhy0psc7b30k095";
+  sgr-iosevka-fixed-slab = "0pbmhr3nbb777ym30qmhlp4swq0q1f5aqc6i7453fc0lhygmcg55";
+  sgr-iosevka-fixed-ss01 = "1klxs5npm5i1sxgrnkbkf1rbn1dvrdxp6mr34kjxkjxrd5flrb6m";
+  sgr-iosevka-fixed-ss02 = "0aw0yqmvahk0wagyb2k6q6jibpdlyza3q7zn2a7pi36pcnm9b2rn";
+  sgr-iosevka-fixed-ss03 = "0ssxx7a7cskd8lcfy3lnjic1qgzy087d6vk7hmhnlg52jhcfbkjm";
+  sgr-iosevka-fixed-ss04 = "0fhqzj5ksvcp1rxa8g11a0jwznhwb5xw41wpvjqy1za1qh2h6shw";
+  sgr-iosevka-fixed-ss05 = "06z42m7x565wzsf9sfxi4p4846cb3mgz7mr5h3xa528789fk1sx0";
+  sgr-iosevka-fixed-ss06 = "0hzy5bj3ac009q515ylxlc73d1qwdfqcxfq8jxla5h6cgcfipnl4";
+  sgr-iosevka-fixed-ss07 = "1051ah3q8wgdana4a9v38szd36wdy0h3c15sf1blm0cv3y0q7cv3";
+  sgr-iosevka-fixed-ss08 = "05pg3ywxg8m4c1ij8xpd43azz1671v1bsw7r3szbiqmmlq651h9w";
+  sgr-iosevka-fixed-ss09 = "0way85q2jwkhz8ixicx73s1x1hsyznr524am95igqkzwaz7c72q9";
+  sgr-iosevka-fixed-ss10 = "12b91hk7i00766gmd04dgh3c6m42bvbc25y9h049c6rfimzd9f75";
+  sgr-iosevka-fixed-ss11 = "1pn06gz3jrksg6f2glk45gj9i7jmgnh4f509fi7qqa73r3an0pl8";
+  sgr-iosevka-fixed-ss12 = "0nb7g0kbi4riczhjl1dqbzg3kwwsw1vlxnsc5p0qfh8h1rnfpg9g";
+  sgr-iosevka-fixed-ss13 = "1nj3nbp0b9a4nmskxg4vv98y7qp7gnj6rqkckvsw7bw43mxa2faq";
+  sgr-iosevka-fixed-ss14 = "1fhwx95702qyr23iwp400l16lgq12pd3ckbf5dn1hyhfmm691cvg";
+  sgr-iosevka-fixed-ss15 = "088xdxr11gdpn5j4fbf4xscq4prc1cydb23xcsmpnci6gsv4ppzg";
+  sgr-iosevka-fixed-ss16 = "1p20k188c75jisrg7bqr6fq9pra07b44vyvj10ngm38xwfgqb5lz";
+  sgr-iosevka-fixed-ss17 = "03giwk9xlnirgshbkpbkqav3l97n2fm7y3wd21g449vi7r9srimk";
+  sgr-iosevka-fixed-ss18 = "1yl501fcik0kcm20b98n9a285zv9m3yc33ngkjdgj12ssgb02lj8";
+  sgr-iosevka-slab = "0svls9wajw539bj5xziqbcp3wgc3f3hvwvz0rsicc9wgm7h47i33";
+  sgr-iosevka-ss01 = "09i5iylma19jfiqcl0svm7dz4d2agi1ylkvzvsh050ggsk57nzv6";
+  sgr-iosevka-ss02 = "1l0c7519wj46m14aq318rlhajq51hkv5sddhl8nvaqpdmrxx0zcj";
+  sgr-iosevka-ss03 = "02yz6wqaqnc0in8b6j2n02kf6lws4x16182a5djnh3nnml2jhvi6";
+  sgr-iosevka-ss04 = "0llrnx6vh6fl0fn5jjxzkq4rk91siy90pcpwin010sm3bppc0qgf";
+  sgr-iosevka-ss05 = "166y9hywcm6d1zw2szqfrlaj9qaankamcs0ff02vd7q399bkl9a2";
+  sgr-iosevka-ss06 = "0q41sikcv60nkvxqs5l3zw1dram20192dd5nr17nsd2lrbbdw1qx";
+  sgr-iosevka-ss07 = "1nxgsj6ykgh5dj3gjba2ild1y5knilm7pzi5b5qbqpal89ymk5dq";
+  sgr-iosevka-ss08 = "19bidxh3zxid6md8y0zp6ij4yxhqbyhqxfmld12pcskvp9xdv5bc";
+  sgr-iosevka-ss09 = "15w7dqb73q2v0qkh0wmlhjd3sphcq6qilb8iqz0ifg3kbsix3hd3";
+  sgr-iosevka-ss10 = "04gcwjpi313sqmdq1limfzycjyhr6p05vnr8jsabvgbxididikdi";
+  sgr-iosevka-ss11 = "1mvhrqgbppx35h2v62ykhihdkh4zw2lwz5i7fd5qdw0ysiv1006d";
+  sgr-iosevka-ss12 = "0r7qlba9mx1fibs0jrqgjzbffk1j49912zzim441n9539n6rmpvp";
+  sgr-iosevka-ss13 = "1qvn83frjhy2w16i9jnhp3874rjlf0z95n7x1kmcg89hzy3x7288";
+  sgr-iosevka-ss14 = "1yjbdgj1b03p2cwvwsh7jl0npj4a840whgn35j61fi9ap74jld8c";
+  sgr-iosevka-ss15 = "1jrixb0lw04axv2h6d92mbwgavyzpc189n72b8wf729kwi22bvww";
+  sgr-iosevka-ss16 = "1mvgl5dh9frqmqvia17zwpyyy9hwm8iayx2azm7mhjkkff0f0sd9";
+  sgr-iosevka-ss17 = "00059jzz2w9xdfcl2lws2i0lwqgn08fakn0di6clqhjig695yglc";
+  sgr-iosevka-ss18 = "03sy0az47x9sc0qxjc1wvhkmp71wqrm7q998ijxmj6mkbd3kc24v";
+  sgr-iosevka-term = "0r5ah7rxqqi4cha3r6nz6dli6z55s1g91yb1x6b2q04irvm0hzrc";
+  sgr-iosevka-term-curly = "1c9vf1kcl0yai5smzh9dldhkbwanbxji2a1j6y1sw59kn9n7aygf";
+  sgr-iosevka-term-curly-slab = "02m3fpdj9gxskap4sp43pjr4ylyvr6fpbsbl5csjl5x4rlrh71kr";
+  sgr-iosevka-term-slab = "1bnb803vcrkk05igm80v3k8b3p6ji14bsa5rjrplxq7yrjq7ybk4";
+  sgr-iosevka-term-ss01 = "1wfz766fi0xi5nb80wdlpp4j4klggz8v2aa1prl6mbvmzq4g1alk";
+  sgr-iosevka-term-ss02 = "12vcmbx597h0mfmib9wzqpc7bchbim2jyqnk835fhgrdrddb1w0j";
+  sgr-iosevka-term-ss03 = "0a4dfrah8rg5bc7x8r08n2ijr6nfxr5nwbwj7ig0snbw1rrizm4i";
+  sgr-iosevka-term-ss04 = "0ix8wn6dbqs072s3bmcjc1k8jfi4zpgjikbbdld3fgsg13gncz2p";
+  sgr-iosevka-term-ss05 = "19jjvadmffizdymy21dniz43ac1qkik5i33a4imchk64kcn7nqin";
+  sgr-iosevka-term-ss06 = "0lx61ikw9c2glr7smxyqkx68271sww47khkdy68llmw16c1dcapc";
+  sgr-iosevka-term-ss07 = "12nx451b67cc6kx6pkb9x2jyk683xvjz3m21wg7zjplskrhlfaqa";
+  sgr-iosevka-term-ss08 = "19n39wpz09kp9km9gmb16q6g4xbp288dgnlpdy4jxnway3i23drp";
+  sgr-iosevka-term-ss09 = "1j4sh9fjyxi5qa85w72bs7sin5189qis8zdr2fbl39ma7igj5l5f";
+  sgr-iosevka-term-ss10 = "02bv19gc1n73qyrdghp5nfzf2vwcvws3qnrcx7k3jpz23xf1n8s8";
+  sgr-iosevka-term-ss11 = "1a93vv86sg38ipji4cbpndcr9bfcc2n4bg0s3f19lzyqpw3pa6r9";
+  sgr-iosevka-term-ss12 = "1c3d3cxna1m7qq77fc278jja7yz84591pazc1adij28l3xl7xh1z";
+  sgr-iosevka-term-ss13 = "0ss0l4373867csgis87miymby4m1vvxs321lqq00m73x35y9xrj2";
+  sgr-iosevka-term-ss14 = "0dzg0g5p9p1p8yajdz0xnir8advs69fyj325qwh5616in9y3lv32";
+  sgr-iosevka-term-ss15 = "0rx346bjrm33n9ww9bc4czn9dda16bkxjf6h9m4bnvlgxdflgd3y";
+  sgr-iosevka-term-ss16 = "14i3f4bwnsb3haai8003pi9hsahcmxm1r1vccbrzny5vx78892py";
+  sgr-iosevka-term-ss17 = "0idfiqxj0ixrmvfa0bhl1sg6pvaivcw0csjcfxpp7d406553a70i";
+  sgr-iosevka-term-ss18 = "1732sskv5jzpdaaf4dc6xcp45r5fpxxxdq35jlnxbwng0njww3qy";
 }
--- a/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
+++ b/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
@ -1,6 +1,5 @@
-{ lib, stdenv
-, makeWrapper
-, runCommand, wrapBintoolsWith, wrapCCWith
+{ lib, stdenv, makeWrapper
+, runCommand, wrapBintoolsWith, wrapCCWith, autoPatchelfHook
 , buildAndroidndk, androidndk, targetAndroidndkPkgs
 }:

@ -11,6 +10,9 @@ let
  # N.B. The Android NDK uses slightly different LLVM-style platform triples
  # than we do. We don't just use theirs because ours are less ambiguous and
  # some builds need that clarity.
+  #
+  # FIXME:
+  # There's some dragons here. Build host and target concepts are being mixed up.
  ndkInfoFun = { config, ... }: {
    x86_64-apple-darwin = {
      double = "darwin-x86_64";
@ -21,65 +23,96 @@ let
    i686-unknown-linux-android = {
      triple = "i686-linux-android";
      arch = "x86";
-      toolchain = "x86";
-      gccVer = "4.9";
    };
    x86_64-unknown-linux-android = {
      triple = "x86_64-linux-android";
      arch = "x86_64";
-      toolchain = "x86_64";
-      gccVer = "4.9";
    };
    armv7a-unknown-linux-androideabi = {
      arch = "arm";
      triple = "arm-linux-androideabi";
-      toolchain = "arm-linux-androideabi";
-      gccVer = "4.9";
    };
    aarch64-unknown-linux-android = {
      arch = "arm64";
      triple = "aarch64-linux-android";
-      toolchain = "aarch64-linux-android";
-      gccVer = "4.9";
    };
  }.${config} or
    (throw "Android NDK doesn't support ${config}, as far as we know");

+  buildInfo = ndkInfoFun stdenv.buildPlatform;
  hostInfo = ndkInfoFun stdenv.hostPlatform;
  targetInfo = ndkInfoFun stdenv.targetPlatform;

-  prefix = lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform) (stdenv.targetPlatform.config + "-");
+  inherit (stdenv.targetPlatform) sdkVer;
+  suffixSalt = lib.replaceStrings ["-" "."] ["_" "_"] stdenv.targetPlatform.config;
+
+  # targetInfo.triple is what Google thinks the toolchain should be, this is a little
+  # different from what we use. We make it four parts to conform with the existing
+  # standard more properly.
+  targetConfig = lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform) (stdenv.targetPlatform.config);
 in

 rec {
  # Misc tools
-  binaries = runCommand "ndk-toolchain-binutils" {
-    pname = "ndk-toolchain-binutils";
+  binaries = stdenv.mkDerivation {
+    pname = "${targetConfig}-ndk-toolchain";
    inherit (androidndk) version;
-    nativeBuildInputs = [ makeWrapper ];
+    nativeBuildInputs = [ makeWrapper autoPatchelfHook ];
    propagatedBuildInputs = [ androidndk ];
    passthru = {
-      targetPrefix = prefix;
      isClang = true; # clang based cc, but bintools ld
    };
-  } ''
-    mkdir -p $out/bin
+    dontUnpack = true;
+    dontBuild = true;
+    dontStrip = true;
+    dontConfigure = true;
+    dontPatch = true;
+    autoPatchelfIgnoreMissingDeps = true;
+    installPhase = ''
+      # https://developer.android.com/ndk/guides/other_build_systems
+      mkdir -p $out
+      cp -r ${androidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${buildInfo.double} $out/toolchain
+      find $out/toolchain -type d -exec chmod 777 {} \;

-    # llvm toolchain
-    for prog in ${androidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${hostInfo.double}/bin/*; do
-      ln -s $prog $out/bin/$(basename $prog)
-      ln -s $prog $out/bin/${prefix}$(basename $prog)
-    done
+      if [ ! -d $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${sdkVer} ]; then
+        echo "NDK does not contain libraries for SDK version ${sdkVer}";
+        exit 1
+      fi

-    # bintools toolchain
-    for prog in ${androidndk}/libexec/android-sdk/ndk-bundle/toolchains/${targetInfo.toolchain}-${targetInfo.gccVer}/prebuilt/${hostInfo.double}/bin/*; do
-      prog_suffix=$(basename $prog | sed 's/${targetInfo.triple}-//')
-      ln -s $prog $out/bin/${stdenv.targetPlatform.config}-$prog_suffix
-    done
+      ln -vfs $out/toolchain/sysroot/usr/lib $out/lib
+      ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/*.so $out/lib/
+      ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/*.a $out/lib/
+      chmod +w $out/lib/*
+      ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${sdkVer}/*.so $out/lib/
+      ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${sdkVer}/*.o $out/lib/

-    # shitty googly wrappers
-    rm -f $out/bin/${stdenv.targetPlatform.config}-gcc $out/bin/${stdenv.targetPlatform.config}-g++
-  '';
+      echo "INPUT(-lc++_static)" > $out/lib/libc++.a
+
+      ln -s $out/toolchain/bin $out/bin
+      ln -s $out/toolchain/${targetInfo.triple}/bin/* $out/bin/
+      for f in $out/bin/${targetInfo.triple}-*; do
+        ln -s $f ''${f/${targetInfo.triple}-/${targetConfig}-}
+      done
+      for f in $(find $out/toolchain -type d -name ${targetInfo.triple}); do
+        ln -s $f ''${f/${targetInfo.triple}/${targetConfig}}
+      done
+
+      rm -f $out/bin/${targetConfig}-ld
+      ln -s $out/bin/lld $out/bin/${targetConfig}-ld
+
+      (cd $out/bin;
+        for tool in llvm-*; do
+          ln -sf $tool ${targetConfig}-$(echo $tool | sed 's/llvm-//')
+          ln -sf $tool $(echo $tool | sed 's/llvm-//')
+        done)
+
+      # handle last, as llvm-as is for llvm bytecode
+      ln -sf $out/bin/${targetInfo.triple}-as $out/bin/${targetConfig}-as
+      ln -sf $out/bin/${targetInfo.triple}-as $out/bin/as
+
+      patchShebangs $out/bin
+    '';
+  };

  binutils = wrapBintoolsWith {
    bintools = binaries;
@ -95,9 +128,16 @@ rec {
    libc = targetAndroidndkPkgs.libraries;
    extraBuildCommands = ''
      echo "-D__ANDROID_API__=${stdenv.targetPlatform.sdkVer}" >> $out/nix-support/cc-cflags
-      echo "-target ${stdenv.targetPlatform.config}" >> $out/nix-support/cc-cflags
-      echo "-resource-dir=$(echo ${androidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${hostInfo.double}/lib*/clang/*)" >> $out/nix-support/cc-cflags
-      echo "--gcc-toolchain=${androidndk}/libexec/android-sdk/ndk-bundle/toolchains/${targetInfo.toolchain}-${targetInfo.gccVer}/prebuilt/${hostInfo.double}" >> $out/nix-support/cc-cflags
+      # Android needs executables linked with -pie since version 5.0
+      # Use -fPIC for compilation, and link with -pie if no -shared flag used in ldflags
+      echo "-target ${targetInfo.triple} -fPIC" >> $out/nix-support/cc-cflags
+      echo "-z,noexecstack -z,relro -z,now" >> $out/nix-support/cc-ldflags
+      echo 'if [[ ! " $@ " =~ " -shared " ]]; then NIX_LDFLAGS_${suffixSalt}+=" -pie"; fi' >> $out/nix-support/add-flags.sh
+      echo "-Xclang -mnoexecstack" >> $out/nix-support/cc-cxxflags
+      if [ ${targetInfo.triple} == arm-linux-androideabi ]; then
+        # https://android.googlesource.com/platform/external/android-cmake/+/refs/heads/cmake-master-dev/android.toolchain.cmake
+        echo "--fix-cortex-a8" >> $out/nix-support/cc-ldflags
+      fi
    '';
  };

@ -107,10 +147,14 @@ rec {
  # cross-compiling packages to wrap incorrectly wrap binaries we don't include
  # anyways.
  libraries = runCommand "bionic-prebuilt" {} ''
-    mkdir -p $out
-    cp -r ${buildAndroidndk}/libexec/android-sdk/ndk-bundle/sysroot/usr/include $out/include
-    chmod +w $out/include
-    cp -r ${buildAndroidndk}/libexec/android-sdk/ndk-bundle/sysroot/usr/include/${targetInfo.triple}/* $out/include
-    ln -s ${buildAndroidndk}/libexec/android-sdk/ndk-bundle/platforms/android-${stdenv.hostPlatform.sdkVer}/arch-${hostInfo.arch}/usr/${if hostInfo.arch == "x86_64" then "lib64" else "lib"} $out/lib
+    lpath=${buildAndroidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${buildInfo.double}/sysroot/usr/lib/${targetInfo.triple}/${sdkVer}
+    if [ ! -d $lpath ]; then
+      echo "NDK does not contain libraries for SDK version ${sdkVer} <$lpath>"
+      exit 1
+    fi
+    mkdir -p $out/lib
+    cp $lpath/*.so $lpath/*.a $out/lib
+    chmod +w $out/lib/*
+    cp $lpath/* $out/lib
  '';
 }
--- a/pkgs/development/androidndk-pkgs/default.nix
+++ b/pkgs/development/androidndk-pkgs/default.nix
@ -2,36 +2,6 @@
 }:

 {
-  "18b" =
-    let
-      ndkVersion = "18.1.5063045";
-
-      buildAndroidComposition = buildPackages.buildPackages.androidenv.composeAndroidPackages {
-        includeNDK = true;
-        inherit ndkVersion;
-      };
-
-      androidComposition = androidenv.composeAndroidPackages {
-        includeNDK = true;
-        inherit ndkVersion;
-      };
-    in
-    import ./androidndk-pkgs.nix {
-      inherit lib;
-      inherit (buildPackages)
-        makeWrapper;
-      inherit (pkgs)
-        stdenv
-        runCommand wrapBintoolsWith wrapCCWith;
-      # buildPackages.foo rather than buildPackages.buildPackages.foo would work,
-      # but for splicing messing up on infinite recursion for the variants we
-      # *dont't* use. Using this workaround, but also making a test to ensure
-      # these two really are the same.
-      buildAndroidndk = buildAndroidComposition.ndk-bundle;
-      androidndk = androidComposition.ndk-bundle;
-      targetAndroidndkPkgs = targetPackages.androidndkPkgs_18b;
-    };
-
  "21" =
    let
      ndkVersion = "21.0.6113669";
@ -49,7 +19,7 @@
    import ./androidndk-pkgs.nix {
      inherit lib;
      inherit (buildPackages)
-        makeWrapper;
+        makeWrapper autoPatchelfHook;
      inherit (pkgs)
        stdenv
        runCommand wrapBintoolsWith wrapCCWith;
@ -62,4 +32,64 @@
      targetAndroidndkPkgs = targetPackages.androidndkPkgs_21;
    };

+  "23b" =
+    let
+      ndkVersion = "23.1.7779620";
+
+      buildAndroidComposition = buildPackages.buildPackages.androidenv.composeAndroidPackages {
+        includeNDK = true;
+        inherit ndkVersion;
+      };
+
+      androidComposition = androidenv.composeAndroidPackages {
+        includeNDK = true;
+        inherit ndkVersion;
+      };
+    in
+    import ./androidndk-pkgs.nix {
+      inherit lib;
+      inherit (buildPackages)
+        makeWrapper autoPatchelfHook;
+      inherit (pkgs)
+        stdenv
+        runCommand wrapBintoolsWith wrapCCWith;
+      # buildPackages.foo rather than buildPackages.buildPackages.foo would work,
+      # but for splicing messing up on infinite recursion for the variants we
+      # *dont't* use. Using this workaround, but also making a test to ensure
+      # these two really are the same.
+      buildAndroidndk = buildAndroidComposition.ndk-bundle;
+      androidndk = androidComposition.ndk-bundle;
+      targetAndroidndkPkgs = targetPackages.androidndkPkgs_23b;
+    };
+
+  "24" =
+    let
+      ndkVersion = "24.0.8215888";
+
+      buildAndroidComposition = buildPackages.buildPackages.androidenv.composeAndroidPackages {
+        includeNDK = true;
+        inherit ndkVersion;
+      };
+
+      androidComposition = androidenv.composeAndroidPackages {
+        includeNDK = true;
+        inherit ndkVersion;
+      };
+    in
+    import ./androidndk-pkgs.nix {
+      inherit lib;
+      inherit (buildPackages)
+        makeWrapper autoPatchelfHook;
+      inherit (pkgs)
+        stdenv
+        runCommand wrapBintoolsWith wrapCCWith;
+      # buildPackages.foo rather than buildPackages.buildPackages.foo would work,
+      # but for splicing messing up on infinite recursion for the variants we
+      # *dont't* use. Using this workaround, but also making a test to ensure
+      # these two really are the same.
+      buildAndroidndk = buildAndroidComposition.ndk-bundle;
+      androidndk = androidComposition.ndk-bundle;
+      targetAndroidndkPkgs = targetPackages.androidndkPkgs_24;
+    };
+
 }
--- a/pkgs/development/compilers/elm/packages/elm-json.nix
+++ b/pkgs/development/compilers/elm/packages/elm-json.nix
@ -10,11 +10,11 @@

 rustPlatform.buildRustPackage rec {
  pname = "elm-json";
-  version = "0.2.10";
+  version = "0.2.12";

  src = fetchurl {
    url = "https://github.com/zwilias/elm-json/archive/v${version}.tar.gz";
-    sha256 = "sha256:03azh7wvl60h6w7ffpvl49s7jr7bxpladcm4fzcasakg26i5a71x";
+    sha256 = "sha256:nlpxlPzWk3wwDgczuMI9T6DFY1YtQpQ1R4BhdPbzZBs=";
  };

  cargoPatches = [ ./elm-json.patch ];
@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {
    curl openssl
  ] ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];

-  cargoSha256 = "sha256:01zasrqf1va58i52s3kwdkj1rnwy80gv00xi6npfshjirj3ix07f";
+  cargoSha256 = "sha256:8SOpL8nfhYen9vza0LYpB/5fgVmBwG7vGMmFOaJskIc=";

  # Tests perform networking and therefore can't work in sandbox
  doCheck = false;
--- a/pkgs/development/compilers/elm/packages/elm-json.patch
+++ b/pkgs/development/compilers/elm/packages/elm-json.patch
@ -1,24 +1,24 @@
 diff --git a/Cargo.lock b/Cargo.lock
-index 5440d72..6e173fa 100644
+index b9bf434..58cfe81 100644
 --- a/Cargo.lock
 +++ b/Cargo.lock
-@@ -774,15 +774,6 @@ version = "0.1.2"
+@@ -685,15 +685,6 @@ version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "77af24da69f9d9341038eba93a073b1fdaaa1b788221b00a69bce9e762cb32de"
+ checksum = "28988d872ab76095a6e6ac88d99b54fd267702734fd7ffe610ca27f533ddb95a"
 
 -[[package]]
 -name = "openssl-src"
-version = "111.11.0+1.1.1h"
+-version = "111.17.0+1.1.1m"
 -source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "380fe324132bea01f45239fadfec9343adb044615f29930d039bec1ae7b9fa5b"
+-checksum = "05d6a336abd10814198f66e2a91ccd7336611f30334119ca8ce300536666fcf4"
 -dependencies = [
 - "cc",
 -]
 -
 [[package]]
 name = "openssl-sys"
- version = "0.9.58"
-@@ -792,7 +783,6 @@ dependencies = [
+ version = "0.9.72"
+@@ -703,7 +694,6 @@ dependencies = [
  "autocfg",
  "cc",
  "libc",
@ -27,17 +27,17 @@ index 5440d72..6e173fa 100644
  "vcpkg",
 ]
 diff --git a/Cargo.toml b/Cargo.toml
-index 4d319f2..6f4d0e5 100644
+index bc97f20..54d3b14 100644
 --- a/Cargo.toml
 +++ b/Cargo.toml
-@@ -21,8 +21,8 @@ colored = "2.0"
+@@ -17,8 +17,8 @@ colored = "2.0"
 dialoguer = "0.6"
 dirs = "3.0"
 fs2 = "0.4"
-isahc = { version = "0.9", features = ["static-ssl"] }
-curl = {version = "0.4", features = ["static-curl", "static-ssl", "force-system-lib-on-osx", "http2"]}
-+isahc = "0.9"
-+curl = {version = "0.4", features = ["force-system-lib-on-osx", "http2"]}
+-isahc = { version = "1.6.0", default-features = false, features = ["static-ssl", "static-curl"] }
+-curl = {version = "0.4.42", default-features = false, features = ["ssl", "static-curl", "static-ssl", "force-system-lib-on-osx"]}
+isahc = { version = "1.6.0", default-features = false }
+curl = {version = "0.4.42", default-features = false, features = ["ssl", "force-system-lib-on-osx"]}
 ctrlc = "3.1"
 console = "0.12"
- 
+ anyhow = "1.0"
--- a/pkgs/development/compilers/purescript/purescript/default.nix
+++ b/pkgs/development/compilers/purescript/purescript/default.nix
@ -18,7 +18,7 @@ let

 in stdenv.mkDerivation rec {
  pname = "purescript";
-  version = "0.15.2";
+  version = "0.15.4";

  # These hashes can be updated automatically by running the ./update.sh script.
  src =
@ -26,12 +26,12 @@ in stdenv.mkDerivation rec {
    then
    fetchurl {
      url = "https://github.com/${pname}/${pname}/releases/download/v${version}/macos.tar.gz";
-      sha256 = "06fsq9ynfvfqn3ac5jxdj81lmzd6bh84p7jz5qib31h27iy5aq4h";
+      sha256 = "0rksc6c98pp48lcavair6apjpgq3s1zz0lhkc59vbz67c8zxc26d";
    }
    else
    fetchurl {
      url = "https://github.com/${pname}/${pname}/releases/download/v${version}/linux64.tar.gz";
-      sha256 = "1p37k6briczw6gvw04idkx734ms1swgrx9sl4hi6xwvxkfp1nm0m";
+      sha256 = "13p6qsba6kmcsppc3z6vcm3v5c7jxhp10nyvxry4nmj9mkdmjaiy";
    };


@ -61,6 +61,7 @@ in stdenv.mkDerivation rec {
    description = "A strongly-typed functional programming language that compiles to JavaScript";
    homepage = "https://www.purescript.org/";
    license = licenses.bsd3;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
    maintainers = with maintainers; [ justinwoo mbbx6spp cdepillabout ];
    platforms = [ "x86_64-linux" "x86_64-darwin" ];
    mainProgram = "purs";
--- a/pkgs/development/libraries/eclib/default.nix
+++ b/pkgs/development/libraries/eclib/default.nix
@ -14,7 +14,7 @@ assert withFlint -> flint != null;

 stdenv.mkDerivation rec {
  pname = "eclib";
-  version = "20210625"; # upgrade might break the sage interface
+  version = "20220621"; # upgrade might break the sage interface
  # sage tests to run:
  # src/sage/interfaces/mwrank.py
  # src/sage/libs/eclib
@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
    # see https://github.com/JohnCremona/eclib/issues/64#issuecomment-789788561
    # for upstream's explanation of the above
    url = "https://github.com/JohnCremona/eclib/releases/download/${version}/eclib-${version}.tar.bz2";
-    sha256 = "sha256-fA3MPz/L+Q39sA8wxAYOUowlHRcgOd8VF4tpsBGI6BA=";
+    sha256 = "sha256-EfoCNhnXGuN5SxgPFES4BaevhSRzU1JvT3ARq9NMJhM=";
  };
  buildInputs = [
    pari
--- a/pkgs/development/libraries/folly/default.nix
+++ b/pkgs/development/libraries/folly/default.nix
@ -16,6 +16,7 @@
 , xz
 , zlib
 , zstd
+, jemalloc
 , follyMobile ? false
 }:

@ -50,7 +51,10 @@ stdenv.mkDerivation rec {
    libunwind
    fmt_8
    zstd
-  ];
+  ] ++ lib.optional stdenv.isLinux jemalloc;
+
+  # jemalloc headers are required in include/folly/portability/Malloc.h
+  propagatedBuildInputs = lib.optional stdenv.isLinux jemalloc;

  NIX_CFLAGS_COMPILE = [ "-DFOLLY_MOBILE=${if follyMobile then "1" else "0"}" "-fpermissive" ];
  cmakeFlags = [ "-DBUILD_SHARED_LIBS=ON" ];
--- a/pkgs/development/libraries/libuiohook/default.nix
+++ b/pkgs/development/libraries/libuiohook/default.nix
@ -0,0 +1,71 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, nixosTests
+, cmake
+, pkg-config
+, AppKit
+, ApplicationServices
+, Carbon
+, libX11
+, libxkbcommon
+, xinput
+, xorg
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libuiohook";
+  version = "1.2.2";
+
+  src = fetchFromGitHub {
+    owner = "kwhat";
+    repo = pname;
+    rev = version;
+    sha256 = "1qlz55fp4i9dd8sdwmy1m8i4i1jy1s09cpmlxzrgf7v34w72ncm7";
+  };
+
+  nativeBuildInputs = [ cmake pkg-config ];
+
+  buildInputs =
+    if stdenv.isDarwin then [ AppKit ApplicationServices Carbon ]
+    else [
+      libX11
+      libxkbcommon
+      xinput
+    ] ++
+    (with xorg; [
+      libXau
+      libXdmcp
+      libXi
+      libXinerama
+      libXt
+      libXtst
+      libXext
+      libxkbfile
+    ]);
+
+  outputs = [ "out" "test" ];
+
+  # We build the tests, but they're only installed when using the "test" output.
+  # This will produce a "uiohook_tests" binary which can be run to test the
+  # functionality of the library on the current system.
+  # Running the test binary requires a running X11 session.
+  cmakeFlags = [
+    "-DENABLE_TEST:BOOL=ON"
+  ];
+
+  postInstall = ''
+    mkdir -p $test/share
+    cp ./uiohook_tests $test/share
+  '';
+
+  meta = with lib; {
+    description = "A C library to provide global keyboard and mouse hooks from userland";
+    homepage = "https://github.com/kwhat/libuiohook";
+    license = licenses.gpl3Only;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ anoa ];
+  };
+
+  passthru.tests.libuiohook = nixosTests.libuiohook;
+}
--- a/pkgs/development/libraries/protobuf/3.20.nix
+++ b/pkgs/development/libraries/protobuf/3.20.nix
@ -0,0 +1,6 @@
+{ callPackage, abseil-cpp, ... }:
+
+callPackage ./generic-v3.nix {
+  version = "3.20.1";
+  sha256 = "sha256-pAMacD0UQetqysZHszu5slPqp0iREtDmHFv1cgcUBJA=";
+}
--- a/pkgs/development/libraries/protobuf/3.21.nix
+++ b/pkgs/development/libraries/protobuf/3.21.nix
@ -0,0 +1,6 @@
+{ callPackage, abseil-cpp, ... }:
+
+callPackage ./generic-v3-cmake.nix {
+  version = "3.21.2";
+  sha256 = "sha256-DUv07pWiZV7jNeSA2ClDOz9DY0x/hiJynxkbSTeJOSs=";
+}
--- a/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
+++ b/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
@ -0,0 +1,107 @@
+# The cmake version of this build is meant to enable both cmake and .pc being exported
+# this is important because grpc exports a .cmake file which also expects for protobuf
+# to have been exported through cmake as well.
+{ lib
+, stdenv
+, abseil-cpp
+, buildPackages
+, cmake
+, fetchFromGitHub
+, fetchpatch
+, gtest
+, zlib
+, version
+, sha256
+
+# downstream dependencies
+, python3
+
+, ...
+}:
+
+let
+  self = stdenv.mkDerivation {
+    pname = "protobuf";
+    inherit version;
+
+    src = fetchFromGitHub {
+      owner = "protocolbuffers";
+      repo = "protobuf";
+      rev = "v${version}";
+      inherit sha256;
+    };
+
+    # re-create submodule logic
+    postPatch = ''
+      rm -rf gmock
+      cp -r ${gtest.src}/googlemock third_party/gmock
+      cp -r ${gtest.src}/googletest third_party/
+      chmod -R a+w third_party/
+
+      ln -s ../googletest third_party/gmock/gtest
+      ln -s ../gmock third_party/googletest/googlemock
+      ln -s $(pwd)/third_party/googletest third_party/googletest/googletest
+    '' + lib.optionalString stdenv.isDarwin ''
+      substituteInPlace src/google/protobuf/testing/googletest.cc \
+        --replace 'tmpnam(b)' '"'$TMPDIR'/foo"'
+    '';
+
+    patches = lib.optionals (lib.versionOlder version "3.22") [
+      # fix protobuf-targets.cmake installation paths, and allow for CMAKE_INSTALL_LIBDIR to be absolute
+      # https://github.com/protocolbuffers/protobuf/pull/10090
+      (fetchpatch {
+        url = "https://github.com/protocolbuffers/protobuf/commit/a7324f88e92bc16b57f3683403b6c993bf68070b.patch";
+        sha256 = "sha256-SmwaUjOjjZulg/wgNmR/F5b8rhYA2wkKAjHIOxjcQdQ=";
+      })
+    ];
+
+    nativeBuildInputs = let
+      protobufVersion = "${lib.versions.major version}_${lib.versions.minor version}";
+    in [
+      cmake
+    ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+      # protoc of the same version must be available for build. For non-cross builds, it's able to
+      # re-use the executable generated as part of the build
+      buildPackages."protobuf${protobufVersion}"
+    ];
+
+    buildInputs = [
+      abseil-cpp
+      zlib
+    ];
+
+    # After 3.20, CMakeLists.txt can now be found at the top-level, however
+    # a stub cmake/CMakeLists.txt still exists for compatibility with previous build assumptions
+    cmakeDir = "../cmake";
+    cmakeFlags = [
+      "-Dprotobuf_ABSL_PROVIDER=package"
+      ] ++ lib.optionals (!stdenv.targetPlatform.isStatic) [
+      "-Dprotobuf_BUILD_SHARED_LIBS=ON"
+    ];
+
+    # unfortunately the shared libraries have yet to been patched by nix, thus tests will fail
+    doCheck = false;
+
+    passthru = {
+      tests = {
+        pythonProtobuf = python3.pkgs.protobuf.override(_: {
+          protobuf = self;
+        });
+      };
+    };
+
+    meta = {
+      description = "Google's data interchange format";
+      longDescription = ''
+        Protocol Buffers are a way of encoding structured data in an efficient
+        yet extensible format. Google uses Protocol Buffers for almost all of
+        its internal RPC protocols and file formats.
+      '';
+      license = lib.licenses.bsd3;
+      platforms = lib.platforms.unix;
+      homepage = "https://developers.google.com/protocol-buffers/";
+      maintainers = with lib.maintainers; [ jonringer ];
+    };
+  };
+in
+  self
--- a/pkgs/development/libraries/science/math/p4est/default.nix
+++ b/pkgs/development/libraries/science/math/p4est/default.nix
@ -1,5 +1,8 @@
-{ lib, stdenv, fetchFromGitHub
-, autoreconfHook, pkg-config
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, pkg-config
 , p4est-withMetis ? true, metis
 , p4est-sc
 }:
@ -31,9 +34,11 @@ stdenv.mkDerivation {
  postPatch = ''
    sed -i -e "s:\(^\s*ACLOCAL_AMFLAGS.*\)\s@P4EST_SC_AMFLAGS@\s*$:\1 -I ${p4est-sc}/share/aclocal:" Makefile.am
  '';
-  preConfigure = ''
+  preAutoreconf = ''
    echo "2.8.0" > .tarball-version
-    ${if mpiSupport then "unset CC" else ""}
+  '';
+  preConfigure = lib.optionalString mpiSupport ''
+    unset CC
  '';

  configureFlags = p4est-sc.configureFlags
--- a/pkgs/development/mobile/androidenv/compose-android-packages.nix
+++ b/pkgs/development/mobile/androidenv/compose-android-packages.nix
@ -3,7 +3,7 @@
 }:

 { toolsVersion ? "26.1.1"
-, platformToolsVersion ? "33.0.1"
+, platformToolsVersion ? "33.0.2"
 , buildToolsVersions ? [ "32.0.0" ]
 , includeEmulator ? false
 , emulatorVersion ? "31.3.7"
@ -11,7 +11,7 @@
 , includeSources ? false
 , includeSystemImages ? false
 , systemImageTypes ? [ "google_apis_playstore" ]
-, abiVersions ? [ "armeabi-v7a" ]
+, abiVersions ? [ "armeabi-v7a" "arm64-v8a" ]
 , cmakeVersions ? [ ]
 , includeNDK ? false
 , ndkVersion ? "24.0.8215888"
@ -181,7 +181,7 @@ rec {
  makeNdkBundle = ndkVersion:
    import ./ndk-bundle {
      inherit deployAndroidPackage os autoPatchelfHook makeWrapper pkgs pkgsHostHost lib platform-tools stdenv;
-      package = packages.ndk-bundle.${ndkVersion};
+      package = packages.ndk-bundle.${ndkVersion} or packages.ndk.${ndkVersion};
    };

  # All NDK bundles.
--- a/pkgs/development/mobile/androidenv/ndk-bundle/default.nix
+++ b/pkgs/development/mobile/androidenv/ndk-bundle/default.nix
@ -12,23 +12,22 @@ deployAndroidPackage {
  nativeBuildInputs = [ makeWrapper ]
    ++ lib.optionals stdenv.isLinux [ autoPatchelfHook ];
  autoPatchelfIgnoreMissingDeps = true;
-  buildInputs = lib.optional (os == "linux") [ pkgs.glibc pkgs.stdenv.cc.cc pkgs.python2 pkgs.ncurses5 pkgs.zlib pkgs.libcxx.out pkgs.libxml2 ];
+  buildInputs = lib.optional (os == "linux") [ pkgs.zlib ];
  patchInstructions = lib.optionalString (os == "linux") (''
    patchShebangs .

-    # Fix the shebangs of the auto-generated scripts.
-    substituteInPlace ./build/tools/make_standalone_toolchain.py \
-      --replace '#!/bin/bash' '#!${pkgs.bash}/bin/bash'
-
-  '' + lib.optionalString (builtins.compareVersions (lib.getVersion package) "21" > 0) ''
-    patch -p1 \
-      --no-backup-if-mismatch < ${./make_standalone_toolchain.py_18.patch} || true
-    wrapProgram ./build/tools/make_standalone_toolchain.py --prefix PATH : "${runtime_paths}"
-  '' + ''
-
    # TODO: allow this stuff
    rm -rf docs tests

+    # Ndk now has a prebuilt toolchains inside, the file layout has changed, we do a symlink
+    # to still support the old standalone toolchains builds.
+    if [ -d $out/libexec/android-sdk/ndk ] && [ ! -d $out/libexec/android-sdk/ndk-bundle ]; then
+        ln -sf $out/libexec/android-sdk/ndk/${package.revision} $out/libexec/android-sdk/ndk-bundle
+    else
+        echo "The ndk-bundle layout has changed. The nix expressions have to be updated!"
+        exit 1
+    fi
+
    # Patch the executables of the toolchains, but not the libraries -- they are needed for crosscompiling
    if [ -d $out/libexec/android-sdk/ndk-bundle/toolchains/renderscript/prebuilt/linux-x86_64/lib64 ]; then
        addAutoPatchelfSearchPath $out/libexec/android-sdk/ndk-bundle/toolchains/renderscript/prebuilt/linux-x86_64/lib64
--- a/pkgs/development/mobile/androidenv/ndk-bundle/make_standalone_toolchain.py_18.patch
+++ b/pkgs/development/mobile/androidenv/ndk-bundle/make_standalone_toolchain.py_18.patch
@ -1,44 +0,0 @@
-diff -Naur android-ndk-r18b/build/tools/make_standalone_toolchain.py android-ndk-r18b-new/build/tools/make_standalone_toolchain.py
--- android-ndk-r18b/build/tools/make_standalone_toolchain.py	2018-10-11 12:49:38.000000000 +0200
-+++ android-ndk-r18b-new/build/tools/make_standalone_toolchain.py	2018-11-20 21:55:52.689991420 +0100
-@@ -30,7 +30,7 @@
- import sys
- import tempfile
- import textwrap
-
-+import subprocess
- 
- THIS_DIR = os.path.realpath(os.path.dirname(__file__))
- NDK_DIR = os.path.realpath(os.path.join(THIS_DIR, '../..'))
-@@ -173,6 +173,7 @@
-                 logger().debug('Copying %s', src_file)
-                 shutil.copy2(src_file, dst_dir)
- 
-+    subprocess.check_call(["chmod", "-R", "+w", dst])
- 
- def make_clang_scripts(install_dir, triple, api, windows):
-     """Creates Clang wrapper scripts.
-@@ -365,6 +366,7 @@
-     install_headers = os.path.join(install_sysroot, 'usr/include')
-     os.makedirs(os.path.dirname(install_headers))
-     shutil.copytree(headers, install_headers)
-+    subprocess.check_call(["chmod", "-R", "+w", install_path])
- 
-     arch_headers = os.path.join(sysroot, 'usr/include', triple)
-     copy_directory_contents(arch_headers, os.path.join(install_headers))
-@@ -375,6 +377,7 @@
-             install_sysroot, 'usr/lib{}'.format(lib_suffix))
-         if os.path.exists(lib_path):
-             shutil.copytree(lib_path, lib_install)
-+            subprocess.check_call(["chmod", "-R", "+w", install_path])
- 
-     static_lib_path = os.path.join(sysroot, 'usr/lib', triple)
-     static_lib_install = os.path.join(install_sysroot, 'usr/lib')
-@@ -389,6 +392,7 @@
-         NDK_DIR, 'prebuilt', 'android-' + arch, 'gdbserver')
-     gdbserver_install = os.path.join(install_path, 'share', 'gdbserver')
-     shutil.copytree(gdbserver_path, gdbserver_install)
-+    subprocess.check_call(["chmod", "-R", "+w", install_path])
- 
-     toolchain_lib_dir = os.path.join(gcc_path, 'lib/gcc', triple)
-     dirs = os.listdir(toolchain_lib_dir)
--- a/pkgs/development/mobile/androidenv/repo.json
+++ b/pkgs/development/mobile/androidenv/repo.json
@ -1241,6 +1241,21 @@
    },
    "23": {
      "google_apis": {
+        "arm64-v8a": {
+          "archives": [
+            {
+              "os": "all",
+              "sha1": "2d1ae21b1978e202917b7c6a5f49ab8bc87c6417",
+              "size": 493891214,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis/arm64-v8a-23_r33.zip"
+            }
+          ],
+          "displayName": "Google APIs ARM 64 v8a System Image",
+          "license": "android-sdk-license",
+          "name": "system-image-23-google_apis-arm64-v8a",
+          "path": "system-images/android-23/google_apis/arm64-v8a",
+          "revision": "23-google_apis-arm64-v8a"
+        },
        "armeabi-v7a": {
          "archives": [
            {
@ -1663,43 +1678,117 @@
        }
      }
    },
-    "Tiramisu": {
+    "33": {
      "google_apis_playstore": {
        "arm64-v8a": {
          "archives": [
            {
              "os": "macosx",
-              "sha1": "2b6d4dc0af98b2b4d3ed4ac82b6d8ee0bfe38383",
-              "size": 1457296537,
-              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/arm64-v8a-Tiramisu_r02-darwin.zip"
+              "sha1": "0b850a4f317d7a6abe854a6845705c9ca4437764",
+              "size": 1492105537,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/arm64-v8a-33_r05-darwin.zip"
            },
            {
              "os": "linux",
-              "sha1": "2b6d4dc0af98b2b4d3ed4ac82b6d8ee0bfe38383",
-              "size": 1457296537,
-              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/arm64-v8a-Tiramisu_r02-linux.zip"
+              "sha1": "0b850a4f317d7a6abe854a6845705c9ca4437764",
+              "size": 1492105537,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/arm64-v8a-33_r05-linux.zip"
            }
          ],
          "displayName": "Google Play ARM 64 v8a System Image",
          "license": "android-sdk-arm-dbt-license",
-          "name": "system-image-Tiramisu-google_apis_playstore-arm64-v8a",
-          "path": "system-images/android-Tiramisu/google_apis_playstore/arm64-v8a",
-          "revision": "Tiramisu-google_apis_playstore-arm64-v8a"
+          "name": "system-image-33-google_apis_playstore-arm64-v8a",
+          "path": "system-images/android-33/google_apis_playstore/arm64-v8a",
+          "revision": "33-google_apis_playstore-arm64-v8a"
        },
        "x86_64": {
          "archives": [
            {
              "os": "all",
-              "sha1": "2d2fb4c36efa836f348d6acbfc588f9eed70934e",
-              "size": 1438511715,
-              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/x86_64-Tiramisu_r02.zip"
+              "sha1": "ed2931ebef4f7bedff8610254748d6496ce5d3c4",
+              "size": 1496628942,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/x86_64-33_r05.zip"
            }
          ],
          "displayName": "Google Play Intel x86 Atom_64 System Image",
          "license": "android-sdk-preview-license",
-          "name": "system-image-Tiramisu-google_apis_playstore-x86_64",
-          "path": "system-images/android-Tiramisu/google_apis_playstore/x86_64",
-          "revision": "Tiramisu-google_apis_playstore-x86_64"
+          "name": "system-image-33-google_apis_playstore-x86_64",
+          "path": "system-images/android-33/google_apis_playstore/x86_64",
+          "revision": "33-google_apis_playstore-x86_64"
+        }
+      }
+    },
+    "Tiramisu": {
+      "android-tv": {
+        "arm64-v8a": {
+          "archives": [
+            {
+              "os": "all",
+              "sha1": "4b70bed5ffb28162cdde7852e0597d957910270d",
+              "size": 840304267,
+              "url": "https://dl.google.com/android/repository/sys-img/android-tv/arm64-v8a-Tiramisu_r03.zip"
+            }
+          ],
+          "displayName": "Android TV ARM 64 v8a System Image",
+          "license": "android-sdk-license",
+          "name": "system-image-Tiramisu-android-tv-arm64-v8a",
+          "path": "system-images/android-Tiramisu/android-tv/arm64-v8a",
+          "revision": "Tiramisu-android-tv-arm64-v8a"
+        },
+        "x86": {
+          "archives": [
+            {
+              "os": "all",
+              "sha1": "547a24d9dec83e11486ef4ea45848d9fa99f35c2",
+              "size": 832895525,
+              "url": "https://dl.google.com/android/repository/sys-img/android-tv/x86-Tiramisu_r03.zip"
+            }
+          ],
+          "displayName": "Android TV Intel x86 Atom System Image",
+          "license": "android-sdk-license",
+          "name": "system-image-Tiramisu-android-tv-x86",
+          "path": "system-images/android-Tiramisu/android-tv/x86",
+          "revision": "Tiramisu-android-tv-x86"
+        }
+      }
+    },
+    "TiramisuPrivacySandbox": {
+      "google_apis_playstore": {
+        "arm64-v8a": {
+          "archives": [
+            {
+              "os": "macosx",
+              "sha1": "4653d7aa2dbd2629c3afc1c700284de0f7791bb2",
+              "size": 1514681298,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/arm64-v8a-TiramisuPrivacySandbox_r05-darwin.zip"
+            },
+            {
+              "os": "linux",
+              "sha1": "4653d7aa2dbd2629c3afc1c700284de0f7791bb2",
+              "size": 1514681298,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/arm64-v8a-TiramisuPrivacySandbox_r05-linux.zip"
+            }
+          ],
+          "displayName": "Google Play ARM 64 v8a System Image",
+          "license": "android-sdk-arm-dbt-license",
+          "name": "system-image-TiramisuPrivacySandbox-google_apis_playstore-arm64-v8a",
+          "path": "system-images/android-TiramisuPrivacySandbox/google_apis_playstore/arm64-v8a",
+          "revision": "TiramisuPrivacySandbox-google_apis_playstore-arm64-v8a"
+        },
+        "x86_64": {
+          "archives": [
+            {
+              "os": "all",
+              "sha1": "2a4ea6ce714155ea8ddfea26cf61ad219f32c02a",
+              "size": 1519169526,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/x86_64-TiramisuPrivacySandbox_r05.zip"
+            }
+          ],
+          "displayName": "Google Play Intel x86 Atom_64 System Image",
+          "license": "android-sdk-preview-license",
+          "name": "system-image-TiramisuPrivacySandbox-google_apis_playstore-x86_64",
+          "path": "system-images/android-TiramisuPrivacySandbox/google_apis_playstore/x86_64",
+          "revision": "TiramisuPrivacySandbox-google_apis_playstore-x86_64"
        }
      }
    }
@ -3298,32 +3387,32 @@
        "path": "build-tools/32.1.0-rc1",
        "revision": "32.1.0-rc1"
      },
-      "33.0.0-rc2": {
+      "33.0.0": {
        "archives": [
-          {
-            "os": "windows",
-            "sha1": "789aa6dfb2155b81e073108c70982f73c890a95b",
-            "size": 55466255,
-            "url": "https://dl.google.com/android/repository/830151c9e0c410f6148390f0de30bd349ba91efd.build-tools_r33-rc2-windows.zip"
-          },
          {
            "os": "linux",
-            "sha1": "013f98217b7af4f5677ab1a47e98da18ad57721c",
-            "size": 57876882,
-            "url": "https://dl.google.com/android/repository/build-tools_r33-rc2-linux.zip"
+            "sha1": "c561971600d4ce682b128b0bd5d4ab71c5f2ad35",
+            "size": 56000182,
+            "url": "https://dl.google.com/android/repository/build-tools_r33-linux.zip"
          },
          {
            "os": "macosx",
-            "sha1": "586f8f77847ba3899b7652d6514e8c6a78ab673a",
-            "size": 59910819,
-            "url": "https://dl.google.com/android/repository/f8baa248444f0a5aca1119b48e897908a3da49d5.build-tools_r33-rc2-macosx.zip"
+            "sha1": "3693851532ba9640710d2dd360d85aa5b04c5151",
+            "size": 60023096,
+            "url": "https://dl.google.com/android/repository/build-tools_r33-macosx.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "f4ef853e5e755ea5ffc50de73a9e420fc76c662e",
+            "size": 55610532,
+            "url": "https://dl.google.com/android/repository/build-tools_r33-windows.zip"
          }
        ],
-        "displayName": "Android SDK Build-Tools 33-rc2",
-        "license": "android-sdk-preview-license",
+        "displayName": "Android SDK Build-Tools 33",
+        "license": "android-sdk-license",
        "name": "build-tools",
-        "path": "build-tools/33.0.0-rc2",
-        "revision": "33.0.0-rc2"
+        "path": "build-tools/33.0.0",
+        "revision": "33.0.0"
      }
    },
    "cmake": {
@ -3625,62 +3714,116 @@
        "name": "cmdline-tools",
        "path": "cmdline-tools/6.0",
        "revision": "6.0"
-      }
-    },
-    "emulator": {
-      "31.2.9": {
+      },
+      "7.0": {
        "archives": [
          {
            "os": "linux",
-            "sha1": "164b759748b3d2ee2616da74173867b11b18f64f",
-            "size": 276337192,
-            "url": "https://dl.google.com/android/repository/emulator-linux_x64-8316981.zip"
-          },
-          {
-            "os": "windows",
-            "sha1": "2b6768485a8e6492823a9156fa43c55092afd533",
-            "size": 345298639,
-            "url": "https://dl.google.com/android/repository/emulator-windows_x64-8316981.zip"
+            "sha1": "5e7bf2dd563d34917d32f3c5920a85562a795c93",
+            "size": 114168525,
+            "url": "https://dl.google.com/android/repository/commandlinetools-linux-8512546_latest.zip"
          },
          {
            "os": "macosx",
-            "sha1": "af2d950318d8ae8cc516a1401a94f888f615aca6",
-            "size": 313877066,
-            "url": "https://dl.google.com/android/repository/emulator-darwin_x64-8316981.zip"
+            "sha1": "9a663c49dbd3709fc2b7d49db2814b383d811b4a",
+            "size": 114168511,
+            "url": "https://dl.google.com/android/repository/commandlinetools-mac-8512546_latest.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "1bdd32ac4b9fffea04f5bc341108e8b4fea6f32c",
+            "size": 114147385,
+            "url": "https://dl.google.com/android/repository/commandlinetools-win-8512546_latest.zip"
+          }
+        ],
+        "displayName": "Android SDK Command-line Tools",
+        "license": "android-sdk-license",
+        "name": "cmdline-tools",
+        "path": "cmdline-tools/7.0",
+        "revision": "7.0"
+      }
+    },
+    "emulator": {
+      "31.2.10": {
+        "archives": [
+          {
+            "os": "linux",
+            "sha1": "1f2c3ddeb2c9ac4feef5946098a0a710d08e9c6d",
+            "size": 276337904,
+            "url": "https://dl.google.com/android/repository/emulator-linux_x64-8420304.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "206491b5c4e531b2c66dc80402702b9fa1a64c2a",
+            "size": 345300871,
+            "url": "https://dl.google.com/android/repository/emulator-windows_x64-8420304.zip"
+          },
+          {
+            "os": "macosx",
+            "sha1": "677b6a00c145eb8bf4306daeb2231c8efd507177",
+            "size": 313876814,
+            "url": "https://dl.google.com/android/repository/emulator-darwin_x64-8420304.zip"
          }
        ],
        "displayName": "Android Emulator",
        "license": "android-sdk-license",
        "name": "emulator",
        "path": "emulator",
-        "revision": "31.2.9"
+        "revision": "31.2.10"
      },
-      "31.3.7": {
+      "31.3.8": {
        "archives": [
          {
            "os": "macosx",
-            "sha1": "0020b44623995a5a9a5b0d114f8fd942e9d3cbed",
-            "size": 347204784,
-            "url": "https://dl.google.com/android/repository/emulator-darwin_x64-8408431.zip"
+            "sha1": "7214e8384c97a7c9875142149d3bf9c940e9b5a0",
+            "size": 347222379,
+            "url": "https://dl.google.com/android/repository/emulator-darwin_x64-8598121.zip"
          },
          {
            "os": "linux",
-            "sha1": "46ba0c398fcd2704bee015c95e44d8f317b7b720",
-            "size": 293765376,
-            "url": "https://dl.google.com/android/repository/emulator-linux_x64-8408431.zip"
+            "sha1": "0f781977a6cc5377b64444121ff75a513841a4fa",
+            "size": 293782881,
+            "url": "https://dl.google.com/android/repository/emulator-linux_x64-8598121.zip"
          },
          {
            "os": "windows",
-            "sha1": "c09a35dd8c7eb7d8c53bf89c86019f5dbcd89b9d",
-            "size": 380137986,
-            "url": "https://dl.google.com/android/repository/emulator-windows_x64-8408431.zip"
+            "sha1": "b4f30bad4e68da41cc9bd44965259b2111a011a1",
+            "size": 380151866,
+            "url": "https://dl.google.com/android/repository/emulator-windows_x64-8598121.zip"
          }
        ],
        "displayName": "Android Emulator",
        "license": "android-sdk-preview-license",
        "name": "emulator",
        "path": "emulator",
-        "revision": "31.3.7"
+        "revision": "31.3.8"
+      },
+      "31.3.9": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "6e7b549113252728cfe0992d58e8cb1790dce9d6",
+            "size": 347241742,
+            "url": "https://dl.google.com/android/repository/emulator-darwin_x64-8700579.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "1c1a7ef65476d3de34f19455a0093cb68e8e90f7",
+            "size": 293801439,
+            "url": "https://dl.google.com/android/repository/emulator-linux_x64-8700579.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "ea834211b199a7fcf6b6758a53c4594d01b44ab9",
+            "size": 380168712,
+            "url": "https://dl.google.com/android/repository/emulator-windows_x64-8700579.zip"
+          }
+        ],
+        "displayName": "Android Emulator",
+        "license": "android-sdk-license",
+        "name": "emulator",
+        "path": "emulator",
+        "revision": "31.3.9"
      }
    },
    "extras": {
@ -4523,6 +4666,33 @@
        "path": "ndk/23.1.7779620",
        "revision": "23.1.7779620"
      },
+      "23.2.8568313": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "1fc65d8f6083f3f5cd01e0cf97c6adc10f4f076f",
+            "size": 982917530,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23c-darwin.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "e5053c126a47e84726d9f7173a04686a71f9a67a",
+            "size": 724733960,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23c-linux.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "f2c5def76a9de371f27d028864fe301ab4fe0cf8",
+            "size": 788336993,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23c-windows.zip"
+          }
+        ],
+        "displayName": "NDK (Side by side) 23.2.8568313",
+        "license": "android-sdk-license",
+        "name": "ndk",
+        "path": "ndk/23.2.8568313",
+        "revision": "23.2.8568313"
+      },
      "24.0.7856742-rc1": {
        "archives": [
          {
@ -4684,6 +4854,60 @@
        "name": "ndk",
        "path": "ndk/25.0.8221429",
        "revision": "25.0.8221429-rc2"
+      },
+      "25.0.8355429-rc3": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "224594abb41357c20cb4a9f4a732c484b2e743ba",
+            "size": 748047157,
+            "url": "https://dl.google.com/android/repository/android-ndk-r25-beta3-darwin.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "79c8db05e20edde0cbb02d2326e7b8405f7eb977",
+            "size": 510520692,
+            "url": "https://dl.google.com/android/repository/android-ndk-r25-beta3-linux.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "7d2c398045f6bbad03f6fb2f2ba419a2a48ab1e7",
+            "size": 506142216,
+            "url": "https://dl.google.com/android/repository/android-ndk-r25-beta3-windows.zip"
+          }
+        ],
+        "displayName": "NDK (Side by side) 25.0.8355429",
+        "license": "android-sdk-preview-license",
+        "name": "ndk",
+        "path": "ndk/25.0.8355429",
+        "revision": "25.0.8355429-rc3"
+      },
+      "25.0.8528842-rc4": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "d7f344ecc68518a8178d15b1b80e27bc5c69f00d",
+            "size": 716633626,
+            "url": "https://dl.google.com/android/repository/android-ndk-r25-beta4-darwin.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "d13f688fd286709f0d950c75119ec9fcad8a47ff",
+            "size": 531018178,
+            "url": "https://dl.google.com/android/repository/android-ndk-r25-beta4-linux.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "668b063c7c535c4f8be52c84acebb5779935203b",
+            "size": 464031742,
+            "url": "https://dl.google.com/android/repository/android-ndk-r25-beta4-windows.zip"
+          }
+        ],
+        "displayName": "NDK (Side by side) 25.0.8528842",
+        "license": "android-sdk-preview-license",
+        "name": "ndk",
+        "path": "ndk/25.0.8528842",
+        "revision": "25.0.8528842-rc4"
      }
    },
    "ndk-bundle": {
@ -5381,32 +5605,32 @@
      }
    },
    "platform-tools": {
-      "33.0.1": {
+      "33.0.2": {
        "archives": [
          {
            "os": "macosx",
-            "sha1": "82f7c23e9e4acf6c86991bb23cd5d9f861f7819f",
-            "size": 13131422,
-            "url": "https://dl.google.com/android/repository/platform-tools_r33.0.1-darwin.zip"
+            "sha1": "9b5661e0c18a2e5b6935e2b96bcc7be580cd6dcd",
+            "size": 13038676,
+            "url": "https://dl.google.com/android/repository/platform-tools_r33.0.2-darwin.zip"
          },
          {
            "os": "linux",
-            "sha1": "4792ee4593e8e2395ddb87a3e82d60629eb0e977",
-            "size": 7449306,
-            "url": "https://dl.google.com/android/repository/platform-tools_r33.0.1-linux.zip"
+            "sha1": "6bf4f747ad929b02378b44ce083b4502d26109c7",
+            "size": 7406632,
+            "url": "https://dl.google.com/android/repository/platform-tools_r33.0.2-linux.zip"
          },
          {
            "os": "windows",
-            "sha1": "e91ab59b5ddc5e387c5171b37c3813eaa2fa3846",
-            "size": 6331279,
-            "url": "https://dl.google.com/android/repository/platform-tools_r33.0.1-windows.zip"
+            "sha1": "2d7599f59b54f02c4ecd33d656091a3c1e55ad9c",
+            "size": 6304111,
+            "url": "https://dl.google.com/android/repository/platform-tools_r33.0.2-windows.zip"
          }
        ],
        "displayName": "Android SDK Platform-Tools",
        "license": "android-sdk-license",
        "name": "platform-tools",
        "path": "platform-tools",
-        "revision": "33.0.1"
+        "revision": "33.0.2"
      }
    },
    "platforms": {
@ -5809,6 +6033,21 @@
        "path": "platforms/android-32",
        "revision": "32"
      },
+      "33": {
+        "archives": [
+          {
+            "os": "all",
+            "sha1": "298f5800e37f3c089ab0eb58d4f6aef4058b689b",
+            "size": 67324871,
+            "url": "https://dl.google.com/android/repository/platform-33_r01.zip"
+          }
+        ],
+        "displayName": "Android SDK Platform 33",
+        "license": "android-sdk-license",
+        "name": "platforms",
+        "path": "platforms/android-33",
+        "revision": "33"
+      },
      "4": {
        "archives": [
          {
@ -5935,20 +6174,20 @@
        "path": "platforms/android-9",
        "revision": "9"
      },
-      "Tiramisu": {
+      "TiramisuPrivacySandbox": {
        "archives": [
          {
            "os": "all",
-            "sha1": "2ac79862a909392d68d8ad503c45809e725d71f6",
-            "size": 67290653,
-            "url": "https://dl.google.com/android/repository/platform-Tiramisu_r02.zip"
+            "sha1": "8dd74a564f71c8381f5230682c5da291d230cc81",
+            "size": 67918949,
+            "url": "https://dl.google.com/android/repository/platform-TiramisuPrivacySandbox_r03.zip"
          }
        ],
-        "displayName": "Android SDK Platform Tiramisu",
+        "displayName": "Android SDK Platform TiramisuPrivacySandbox",
        "license": "android-sdk-license",
        "name": "platforms",
-        "path": "platforms/android-Tiramisu",
-        "revision": "Tiramisu"
+        "path": "platforms/android-TiramisuPrivacySandbox",
+        "revision": "TiramisuPrivacySandbox"
      }
    },
    "skiaparser": {
@ -6304,6 +6543,21 @@
        "name": "sources",
        "path": "sources/android-31",
        "revision": "31"
+      },
+      "32": {
+        "archives": [
+          {
+            "os": "all",
+            "sha1": "d7195c6de611b99d7ec3565eabe2fd21268b7f98",
+            "size": 46933291,
+            "url": "https://dl.google.com/android/repository/sources-32_r01.zip"
+          }
+        ],
+        "displayName": "Sources for Android 32",
+        "license": "android-sdk-license",
+        "name": "sources",
+        "path": "sources/android-32",
+        "revision": "32"
      }
    },
    "tools": {
--- a/pkgs/development/ocaml-modules/chrome-trace/default.nix
+++ b/pkgs/development/ocaml-modules/chrome-trace/default.nix
@ -0,0 +1,20 @@
+{ lib, buildDunePackage, dune_3 }:
+
+buildDunePackage rec {
+  pname = "chrome-trace";
+  inherit (dune_3) src version;
+
+  duneVersion = "3";
+
+  dontAddPrefix = true;
+
+  preBuild = ''
+    rm -r vendor/csexp
+  '';
+
+  meta = with lib; {
+    description = "Chrome trace event generation library";
+    inherit (dune_3.meta) homepage;
+    license = licenses.mit;
+  };
+}
--- a/pkgs/development/ocaml-modules/gapi-ocaml/default.nix
+++ b/pkgs/development/ocaml-modules/gapi-ocaml/default.nix
@ -1,31 +1,29 @@
 { lib, fetchFromGitHub, buildDunePackage, ocaml
 , cryptokit, ocamlnet, ocurl, yojson
-, ounit
+, ounit2
 }:

 buildDunePackage rec {
  pname = "gapi-ocaml";
-  version = "0.4.2";
+  version = "0.4.3";

-  useDune2 = true;
-
-  minimumOCamlVersion = "4.02";
+  minimalOCamlVersion = "4.02";

  src = fetchFromGitHub {
    owner = "astrada";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-imicHOlNjPHHW/lcWRJmURafYZFe/6J3efKPJcel8J8=";
+    sha256 = "sha256-V0GB9Bd06IdcI5PDFHGVZ0Y/qi7tTs/4ITqPXUOxCLs=";
  };

  propagatedBuildInputs = [ cryptokit ocamlnet ocurl yojson ];

  doCheck = lib.versionAtLeast ocaml.version "4.04";
-  checkInputs = [ ounit ];
+  checkInputs = [ ounit2 ];

  meta = {
    description = "OCaml client for google services";
-    homepage = "http://gapi-ocaml.forge.ocamlcore.org";
+    inherit (src.meta) homepage;
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ bennofs ];
  };
--- a/pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix
+++ b/pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix
@ -12,17 +12,21 @@
 let params =
  if lib.versionAtLeast ocaml.version "4.14"
  then {
-    version = "1.11.3";
-    sha256 = "sha256-KlMFh05O04I0Xil2B+nL2hUxZw0jaDMUnI23oUwGyhs=";
+    name = "lsp";
+    version = "1.12.4";
+    sha256 = "sha256-kZuYAny8VjWdq+ipEdPSTRcGzqjNBOgXOi0dOwb52EY=";
  } else if lib.versionAtLeast ocaml.version "4.13"
  then {
+    name = "jsonrpc";
    version = "1.10.5";
    sha256 = "sha256-TeJS6t1ruWhWPvWNatrnSUWI6T17XKiosHLYizBDDcw=";
  } else if lib.versionAtLeast ocaml.version "4.12"
  then {
+    name = "jsonrpc";
    version = "1.9.0";
    sha256 = "sha256:1ac44n6g3rf84gvhcca545avgf9vpkwkkkm0s8ipshfhp4g4jikh";
  } else {
+    name = "jsonrpc";
    version = "1.4.1";
    sha256 = "1ssyazc0yrdng98cypwa9m3nzfisdzpp7hqnx684rqj8f0g3gs6f";
  }
@ -32,7 +36,7 @@ buildDunePackage rec {
  pname = "jsonrpc";
  inherit (params) version;
  src = fetchurl {
-    url = "https://github.com/ocaml/ocaml-lsp/releases/download/${version}/jsonrpc-${version}.tbz";
+    url = "https://github.com/ocaml/ocaml-lsp/releases/download/${version}/${params.name}-${version}.tbz";
    inherit (params) sha256;
  };

--- a/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix
+++ b/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix
@ -13,6 +13,7 @@
 , dyn
 , re
 , stdune
+, chrome-trace
 , dune_3
 , csexp
 , pp
@ -40,7 +41,22 @@ buildDunePackage rec {
  '';

  buildInputs =
-    if lib.versionAtLeast version "1.10.0" then
+    if lib.versionAtLeast version "1.12.0" then
+      [
+        pp
+        re
+        ppx_yojson_conv_lib
+        octavius
+        dune-build-info
+        dune-rpc
+        omd
+        cmdliner
+        ocamlformat-rpc-lib
+        dyn
+        stdune
+        chrome-trace
+      ]
+    else if lib.versionAtLeast version "1.10.0" then
      [
        pp
        re
--- a/pkgs/development/python-modules/django-sampledatahelper/default.nix
+++ b/pkgs/development/python-modules/django-sampledatahelper/default.nix
@ -1,39 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, versiontools
-, django
-, sampledata
-, nose
-, pillow
-, six
-}:
-
-buildPythonPackage rec {
-  pname = "django-sampledatahelper";
-  version = "0.5";
-
-  # no tests on PyPI
-  src = fetchFromGitHub {
-    owner = "kaleidos";
-    repo = "django-sampledatahelper";
-    rev = "8576f352ec26a3650f4386a6e1285b723f6aec23"; # no tag
-    sha256 = "1fx3ql4b9791594zkary19n20x5ra1m1n3pjaya9di1qy64csac4";
-  };
-
-  nativeBuildInputs = [ versiontools ];
-
-  propagatedBuildInputs = [ django sampledata ];
-
-  checkInputs = [ nose pillow six ];
-
-  checkPhase = ''
-    DJANGO_SETTINGS_MODULE=tests.settings NOSE_EXCLUDE=test_calling_command nosetests -v
-  '';
-
-  meta = {
-    description = "Helper class for generate sample data for django apps development";
-    homepage = "https://github.com/kaleidos/django-sampledatahelper";
-    license = lib.licenses.bsd3;
-  };
-}
--- a/pkgs/development/python-modules/optax/default.nix
+++ b/pkgs/development/python-modules/optax/default.nix
@ -1,28 +1,29 @@
 { absl-py
 , buildPythonPackage
 , chex
-, dm-haiku
 , fetchFromGitHub
 , jaxlib
 , lib
 , numpy
-, pytest-xdist
-, pytestCheckHook
-, tensorflow
-, tensorflow-datasets
+, callPackage
 }:

 buildPythonPackage rec {
  pname = "optax";
-  version = "0.1.1";
+  version = "0.1.3";

  src = fetchFromGitHub {
    owner = "deepmind";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-s/BcqzhdfWzR61MStusUPQtuT4+t8NcC5gBGiGggFqw=";
+    hash = "sha256-XAYztMBQpLBHNuNED/iodbwIMJSN/0GxdmTGQ5jD9Ws=";
  };

+  outputs = [
+    "out"
+    "testsout"
+  ];
+
  buildInputs = [ jaxlib ];

  propagatedBuildInputs = [
@ -31,24 +32,21 @@ buildPythonPackage rec {
    numpy
  ];

-  checkInputs = [
-    dm-haiku
-    pytest-xdist
-    pytestCheckHook
-    tensorflow
-    tensorflow-datasets
-  ];
+  postInstall = ''
+    mkdir $testsout
+    cp -R examples $testsout/examples
+  '';

  pythonImportsCheck = [
    "optax"
  ];

-  disabledTestPaths = [
-    # Requires `flax` which depends on `optax` creating circular dependency.
-    "optax/_src/equivalence_test.py"
-    # See https://github.com/deepmind/optax/issues/323.
-    "examples/lookahead_mnist_test.py"
-  ];
+  # check in passthru.tests.pytest to escape infinite recursion with flax
+  doCheck = false;
+
+  passthru.tests = {
+    pytest = callPackage ./tests.nix { };
+  };

  meta = with lib; {
    description = "Optax is a gradient processing and optimization library for JAX.";
--- a/pkgs/development/python-modules/optax/tests.nix
+++ b/pkgs/development/python-modules/optax/tests.nix
@ -0,0 +1,35 @@
+{ stdenv
+, buildPythonPackage
+, dm-haiku
+, pytest-xdist
+, pytestCheckHook
+, tensorflow
+, tensorflow-datasets
+, flax
+, optax
+}:
+
+buildPythonPackage rec {
+  pname = "optax-tests";
+  inherit (optax) version;
+
+  src = optax.testsout;
+
+  dontBuild = true;
+  dontInstall = true;
+
+  checkInputs = [
+    dm-haiku
+    pytest-xdist
+    pytestCheckHook
+    tensorflow
+    tensorflow-datasets
+    flax
+  ];
+
+  disabledTestPaths = [
+    # See https://github.com/deepmind/optax/issues/323
+    "examples/lookahead_mnist_test.py"
+  ];
+
+}
--- a/pkgs/development/python-modules/patool/default.nix
+++ b/pkgs/development/python-modules/patool/default.nix
@ -1,17 +1,16 @@
 { lib, buildPythonPackage, fetchFromGitHub, pytestCheckHook, p7zip,
-  unzip, cabextract, zip, zopfli, lzip, zpaq, gnutar, gnugrep, diffutils, file,
+  cabextract, zip, lzip, zpaq, gnutar, gnugrep, diffutils, file,
  gzip, bzip2, xz}:

 # unrar is unfree, as well as 7z with unrar support, not including it (patool doesn't support unar)
+# it will still use unrar if present in the path

 let
  compression-utilities = [
    p7zip
-    unzip
    gnutar
    cabextract
    zip
-    zopfli
    lzip
    zpaq
    gzip
@ -34,9 +33,9 @@ buildPythonPackage rec {
    sha256 = "0v4r77sm3yzh7y1whfwxmp01cchd82jbhvbg9zsyd2yb944imzjy";
  };

-  prePatch = ''
+  postPatch = ''
    substituteInPlace patoolib/util.py \
-      --replace "path = None" 'path = append_to_path(os.environ["PATH"], "${lib.makeBinPath compression-utilities}")'
+      --replace "path = None" 'path = os.environ["PATH"] + ":${lib.makeBinPath compression-utilities}"'
  '';

  checkInputs = [ pytestCheckHook ] ++ compression-utilities;
--- a/pkgs/development/python-modules/plotnine/default.nix
+++ b/pkgs/development/python-modules/plotnine/default.nix
@ -8,6 +8,8 @@
 , statsmodels
 , pytestCheckHook
 , geopandas
+, scikit-misc
+, adjusttext
 , mizani }:

 buildPythonPackage rec {
@ -34,8 +36,10 @@ buildPythonPackage rec {
  ];

  checkInputs = [
+    adjusttext
    geopandas
    pytestCheckHook
+    scikit-misc
  ];

  preCheck = ''
--- a/pkgs/development/python-modules/protobuf/default.nix
+++ b/pkgs/development/python-modules/protobuf/default.nix
@ -19,7 +19,12 @@ buildPythonPackage {
  doCheck = doCheck && !isPy27; # setuptools>=41.4 no longer collects correctly on python2

  propagatedBuildInputs = [ six ] ++ lib.optionals isPy27 [ google-apputils ];
-  propagatedNativeBuildInputs = [ buildPackages.protobuf ]; # For protoc.
+  propagatedNativeBuildInputs = let
+    protobufVersion = "${lib.versions.major protobuf.version}_${lib.versions.minor protobuf.version}";
+  in [
+    buildPackages."protobuf${protobufVersion}" # For protoc of the same version.
+  ];
+
  nativeBuildInputs = [ pyext ] ++ lib.optionals isPy27 [ google-apputils ];
  buildInputs = [ protobuf ];

--- a/pkgs/development/python-modules/pytest-testmon/default.nix
+++ b/pkgs/development/python-modules/pytest-testmon/default.nix
@ -8,12 +8,12 @@

 buildPythonPackage rec {
  pname = "pytest-testmon";
-  version = "1.3.3";
+  version = "1.3.4";
  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-Csg5wIm9+ZdAQYdZozlx09rMaVz3GazeS5Z/f4jRECw=";
+    sha256 = "sha256-jr+uKjtm5nFYHrZpG63VNK/wO93TQJh1x4SoTxJtlw0=";
  };

  propagatedBuildInputs = [ pytest coverage ];
--- a/pkgs/development/python-modules/scikit-misc/default.nix
+++ b/pkgs/development/python-modules/scikit-misc/default.nix
@ -0,0 +1,45 @@
+{ lib
+, fetchPypi
+, buildPythonPackage
+, cython
+, gfortran
+, pytestCheckHook
+, numpy }:
+
+buildPythonPackage rec {
+  pname = "scikit-misc";
+  version = "0.1.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-93RqA0eBEGPh7PkSHflINXhQA5U8OLW6hPY/xQjCKRE=";
+  };
+
+  postPatch = ''
+    substituteInPlace pytest.ini \
+      --replace "--cov --cov-report=xml" ""
+  '';
+
+  nativeBuildInputs = [
+    gfortran
+  ];
+
+  buildInputs = [
+    cython
+    numpy
+  ];
+
+  # Tests fail because of infinite recursion error
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "skmisc"
+  ];
+
+  meta = with lib; {
+    description = "Miscellaneous tools for scientific computing";
+    homepage = "https://github.com/has2k1/scikit-misc";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ onny ];
+  };
+}
--- a/pkgs/development/tools/ocaml/ocp-index/default.nix
+++ b/pkgs/development/tools/ocaml/ocp-index/default.nix
@ -2,7 +2,7 @@

 buildDunePackage rec {
  pname = "ocp-index";
-  version = "1.3.1";
+  version = "1.3.3";

  useDune2 = true;

@ -10,7 +10,7 @@ buildDunePackage rec {
    owner = "OCamlPro";
    repo = "ocp-index";
    rev = version;
-    sha256 = "120w72fqymjp6ibicbp31jyx9yv34mdvgkr0zdfpzvfb7lgd8rc7";
+    sha256 = "sha256-ElCXjUR85tkyBLIpIKefDouE1upzJytQnk4xoQt/cb0=";
  };

  strictDeps = true;
--- a/pkgs/development/tools/ocaml/opam2json/default.nix
+++ b/pkgs/development/tools/ocaml/opam2json/default.nix
@ -0,0 +1,25 @@
+{ lib, stdenv, fetchFromGitHub, opam-installer, ocamlPackages }:
+stdenv.mkDerivation rec {
+  pname = "opam2json";
+  version = "0.2";
+
+  src = fetchFromGitHub {
+    owner = "tweag";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "fe8bm/V/4r2iNxgbitT2sXBqDHQ0GBSnSUSBg/1aXoI=";
+  };
+
+  buildInputs = with ocamlPackages; [ yojson opam-file-format cmdliner ];
+  nativeBuildInputs = with ocamlPackages; [ ocaml findlib opam-installer ];
+
+  preInstall = ''export PREFIX="$out"'';
+
+  meta = with lib; {
+    platforms = platforms.all;
+    description = "convert opam file syntax to JSON";
+    maintainers = [ maintainers.balsoft ];
+    license = licenses.gpl3;
+    homepage = "https://github.com/tweag/opam2json";
+  };
+}
--- a/pkgs/development/tools/sshs/default.nix
+++ b/pkgs/development/tools/sshs/default.nix
@ -0,0 +1,32 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, nix-update-script
+}:
+
+buildGoModule rec {
+  pname = "sshs";
+  version = "3.2.0";
+
+  src = fetchFromGitHub {
+    owner = "quantumsheep";
+    repo = pname;
+    rev = version;
+    sha256 = "D9doNVb2sTnzM8tF8cSJbIoaIYjGurkUHEyhcE3OqQg=";
+  };
+
+  vendorSha256 = "QWFz85bOrTnPGum5atccB5hKeATlZvDAt32by+DO/Fo=";
+
+  ldflags = [ "-s" "-w" "-X github.com/quantumsheep/sshs/cmd.Version=${version}" ];
+
+  passthru.updateScript = nix-update-script {
+    attrPath = pname;
+  };
+
+  meta = with lib; {
+    description = "Terminal user interface for SSH";
+    homepage = "https://github.com/quantumsheep/sshs";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ihatethefrench ];
+  };
+}
--- a/pkgs/development/tools/zls/default.nix
+++ b/pkgs/development/tools/zls/default.nix
@ -28,5 +28,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/zigtools/zls";
    license = licenses.mit;
    maintainers = with maintainers; [ fortuneteller2k ];
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/games/sgt-puzzles/default.nix
+++ b/pkgs/games/sgt-puzzles/default.nix
@ -1,39 +1,38 @@
 { lib, stdenv, fetchurl, desktop-file-utils
-, gtk3, libX11
-, makeWrapper, pkg-config, perl, autoreconfHook, wrapGAppsHook
+, gtk3, libX11, cmake, imagemagick
+, pkg-config, perl, wrapGAppsHook
 }:

 stdenv.mkDerivation rec {
  pname = "sgt-puzzles";
-  version = "20200610.9aa7b7c";
+  version = "20220613.387d323";

  src = fetchurl {
    url = "http://www.chiark.greenend.org.uk/~sgtatham/puzzles/puzzles-${version}.tar.gz";
-    sha256 = "0rrd1c77ar91zqy4rr4xp1z7x3ywnshlac99cga4hnrgwb7vwl3f";
+    hash = "sha256-Vcm7gxC9R7vvLkgkHblvEOONGLkYSHGMRfSBktgN/oQ=";
  };

  sgt-puzzles-menu = fetchurl {
-    url = "https://raw.githubusercontent.com/Oleh-Kravchenko/portage/master/games-puzzle/sgt-puzzles/files/sgt-puzzles.menu";
+    url = "https://raw.githubusercontent.com/gentoo/gentoo/720e614d0107e86fc1e520bac17726578186843d/games-puzzle/sgt-puzzles/files/sgt-puzzles.menu";
    sha256 = "088w0x9g3j8pn725ix8ny8knhdsfgjr3hpswsh9fvfkz5vlg2xkm";
  };

-  nativeBuildInputs = [ autoreconfHook desktop-file-utils makeWrapper
-    pkg-config perl wrapGAppsHook ];
+  nativeBuildInputs = [
+    cmake
+    desktop-file-utils
+    imagemagick
+    perl
+    pkg-config
+    wrapGAppsHook
+  ];

  buildInputs = [ gtk3 libX11 ];

-  makeFlags = [ "prefix=$(out)" "gamesdir=$(out)/bin"];
-
-  preInstall = ''
-    mkdir -p "$out"/{bin,share/doc/sgtpuzzles}
-    cp gamedesc.txt LICENCE README "$out/share/doc/sgtpuzzles"
-  '';
-
  postInstall = ''
    for i in  $(basename -s $out/bin/*); do

      ln -s $out/bin/$i $out/bin/sgt-puzzle-$i
-      install -Dm644 icons/$i-48d24.png -t $out/share/icons/hicolor/48x48/apps/
+      install -Dm644 icons/$i-96d24.png -t $out/share/icons/hicolor/96x96/apps/

      # Generate/validate/install .desktop files.
      echo "[Desktop Entry]" > $i.desktop
@ -43,7 +42,7 @@ stdenv.mkDerivation rec {
        --set-key Name --set-value $i \
        --set-key Comment --set-value "${meta.description}" \
        --set-key Categories --set-value "Game;LogicGame;X-sgt-puzzles;" \
-        --set-key Icon --set-value $out/share/icons/hicolor/48x48/apps/$i-48d24 \
+        --set-key Icon --set-value $out/share/icons/hicolor/96x96/apps/$i-96d24.png \
        $i.desktop
    done

@ -57,16 +56,10 @@ stdenv.mkDerivation rec {
    install -Dm644 ${sgt-puzzles-menu} -t $out/etc/xdg/menus/applications-merged/
  '';

-  preConfigure = ''
-    perl mkfiles.pl
-    export NIX_LDFLAGS="$NIX_LDFLAGS -lX11"
-    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -Wno-error"
-    cp Makefile.gtk Makefile
-  '';
  meta = with lib; {
    description = "Simon Tatham's portable puzzle collection";
    license = licenses.mit;
-    maintainers = [ maintainers.raskin ];
+    maintainers = with maintainers; [ raskin tomfitzhenry ];
    platforms = platforms.linux;
    homepage = "https://www.chiark.greenend.org.uk/~sgtatham/puzzles/";
  };
--- a/pkgs/misc/logging/beats/6.x.nix
+++ b/pkgs/misc/logging/beats/6.x.nix
@ -26,7 +26,7 @@ let beat = package : extraArgs : buildGoPackage (rec {
      meta = with lib; {
        homepage = "https://www.elastic.co/products/beats";
        license = licenses.asl20;
-        maintainers = with maintainers; [ fadenb basvandijk ];
+        maintainers = with maintainers; [ fadenb basvandijk dfithian ];
        platforms = platforms.linux;
      };
    } // extraArgs);
--- a/pkgs/misc/logging/beats/7.x.nix
+++ b/pkgs/misc/logging/beats/7.x.nix
@ -18,7 +18,7 @@ let beat = package: extraArgs: buildGoModule (rec {
  meta = with lib; {
    homepage = "https://www.elastic.co/products/beats";
    license = licenses.asl20;
-    maintainers = with maintainers; [ fadenb basvandijk ];
+    maintainers = with maintainers; [ fadenb basvandijk dfithian ];
    platforms = platforms.linux;
  };
 } // extraArgs);
--- a/pkgs/os-specific/linux/adcli/default.nix
+++ b/pkgs/os-specific/linux/adcli/default.nix
@ -0,0 +1,68 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, fetchpatch
+, openldap
+, libkrb5
+, libxslt
+, autoreconfHook
+, pkg-config
+, cyrus_sasl
+, util-linux
+, xmlto
+, docbook_xsl
+, docbook_xml_dtd_43
+}:
+
+stdenv.mkDerivation rec {
+  pname = "adcli";
+  version = "0.9.1";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "realmd";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-Zzt4qgLiJNuSrbtDWuxJEfGL7sWSbqN301q3qXZpn9c=";
+  };
+
+  # https://bugs.gentoo.org/820224
+  # Without this it produces some weird missing symbol error in glibc
+  patches = [
+    (fetchpatch {
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/app-crypt/adcli/files/adcli-0.9.1-glibc-2.34-resolv.patch?id=01db544de893262e857685e11b33c2a74210181f";
+      sha256 = "sha256-dZ6dkzxd+0XjY/X9/2IWMan3syvCDGFHiMbxFxMHGFA=";
+    })
+  ];
+
+  postPatch = ''
+    substituteInPlace tools/Makefile.am \
+      --replace 'sbin_PROGRAMS' 'bin_PROGRAMS'
+
+    substituteInPlace doc/Makefile.am \
+        --replace 'http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl' \
+                  '${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl'
+
+    function patch_docbook(){
+      substituteInPlace $1 \
+        --replace "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd" \
+                  "${docbook_xml_dtd_43}/xml/dtd/docbook/docbookx.dtd"
+    }
+    patch_docbook doc/adcli.xml
+    patch_docbook doc/adcli-devel.xml
+    patch_docbook doc/adcli-docs.xml
+  '';
+  nativeBuildInputs = [ autoreconfHook pkg-config docbook_xsl ];
+
+  buildInputs = [ openldap libkrb5 libxslt cyrus_sasl util-linux xmlto docbook_xsl ];
+
+  configureFlags = [ "--disable-debug" ];
+
+  meta = with lib; {
+    homepage = "https://www.freedesktop.org/software/realmd/adcli/adcli.html";
+    description = "A helper library and tools for Active Directory client operations.";
+    license = licenses.lgpl21Only;
+    maintainers = with maintainers; [ SohamG ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/servers/atlassian/jira.nix
+++ b/pkgs/servers/atlassian/jira.nix
@ -3,7 +3,7 @@
 , fetchurl
 , gawk
 , enableSSO ? false
-, crowdProperties ? null
+, makeWrapper
 }:

 stdenv.mkDerivation rec {
@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-Zog0m8tsx8mDLU1rsW5zhhHgyRmi4JGWuy9DV8yp9nY=";
  };

+  nativeBuildInputs = [ makeWrapper ];
+
  buildPhase = ''
    mv conf/server.xml conf/server.xml.dist
    ln -sf /run/atlassian-jira/server.xml conf/server.xml
@ -27,10 +29,6 @@ stdenv.mkDerivation rec {
    substituteInPlace atlassian-jira/WEB-INF/classes/seraph-config.xml \
      --replace com.atlassian.jira.security.login.JiraSeraphAuthenticator \
                com.atlassian.jira.security.login.SSOSeraphAuthenticator
-  '' + lib.optionalString (crowdProperties != null) ''
-    cat <<EOF > atlassian-jira/WEB-INF/classes/crowd.properties
-    ${crowdProperties}
-    EOF
  '';

  installPhase = ''
@ -41,6 +39,6 @@ stdenv.mkDerivation rec {
    description = "Proprietary issue tracking product, also providing project management functions";
    homepage = "https://www.atlassian.com/software/jira";
    license = licenses.unfree;
-    maintainers = with maintainers; [ fpletz globin ciil megheaiulian techknowlogick ];
+    maintainers = with maintainers; [ fpletz globin ciil megheaiulian techknowlogick ma27 ];
  };
 }
--- a/pkgs/servers/endlessh-go/default.nix
+++ b/pkgs/servers/endlessh-go/default.nix
@ -5,22 +5,25 @@

 buildGoModule rec {
  pname = "endlessh-go";
-  version = "20220308.1";
+  version = "20220710";

  src = fetchFromGitHub {
    owner = "shizunge";
    repo = "endlessh-go";
    rev = version;
-    hash = "sha256-U+h/WmTVwwUIBEOiNa/EKS6HvkeoGNmP3NpeP1fcqYw=";
+    sha256 = "sha256-T8DLzHfITMLeHJtKuK4AjEzGGCIDJUPlqF2Lj56xPxY=";
  };

-  vendorSha256 = "sha256-5a/V2OQGVRIJVl/YG+lvtbLeHCy/1eiZu69zKIFqRKM=";
+  vendorSha256 = "sha256-hMCjYAqsI6h9B8iGVYQcNbKU5icalOHavvPKwOmvf/w=";

  proxyVendor = true;

+  ldflags = [ "-s" "-w" ];
+
  meta = with lib; {
    description = "An implementation of endlessh exporting Prometheus metrics";
    homepage = "https://github.com/shizunge/endlessh-go";
+    changelog = "https://github.com/shizunge/endlessh-go/releases/tag/${version}";
    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ azahi ];
  };
--- a/pkgs/servers/etcd/3.4.nix
+++ b/pkgs/servers/etcd/3.4.nix
@ -2,9 +2,9 @@

 buildGoModule rec {
  pname = "etcd";
-  version = "3.4.18";
+  version = "3.4.19";

-  vendorSha256 = null;
+  vendorSha256 = "sha256-ZONIsizxRiwZWRu4y9VzZcCpyBKoa0j3h3JqoMMPGu0=";

  doCheck = false;

@ -12,7 +12,7 @@ buildGoModule rec {
    owner = "etcd-io";
    repo = "etcd";
    rev = "v${version}";
-    sha256 = "sha256-/bXcW5g8mNFEjvfg+1loLFi8+IaWdcTE/lUPsHzEaIo=";
+    sha256 = "sha256-8X7xTZrZ/AjUgrW9XgD8B7eKFfOulj8WBjXoImAtJoM=";
  };

  buildPhase = ''
--- a/pkgs/servers/mail/rspamd/default.nix
+++ b/pkgs/servers/mail/rspamd/default.nix
@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub, cmake, perl
-, glib, luajit, openssl, pcre2, pkg-config, sqlite, ragel, icu
+, glib, luajit, openssl, pcre, pkg-config, sqlite, ragel, icu
 , hyperscan, jemalloc, blas, lapack, lua, libsodium
 , withBlas ? true
 , withHyperscan ? stdenv.isx86_64
@ -23,12 +23,14 @@ stdenv.mkDerivation rec {
  hardeningEnable = [ "pie" ];

  nativeBuildInputs = [ cmake pkg-config perl ];
-  buildInputs = [ glib openssl pcre2 sqlite ragel icu jemalloc libsodium ]
+  buildInputs = [ glib openssl pcre sqlite ragel icu jemalloc libsodium ]
    ++ lib.optional withHyperscan hyperscan
    ++ lib.optionals withBlas [ blas lapack ]
    ++ lib.optional withLuaJIT luajit ++ lib.optional (!withLuaJIT) lua;

  cmakeFlags = [
+    # pcre2 jit seems to cause crashes: https://github.com/NixOS/nixpkgs/pull/181908
+    "-DENABLE_PCRE2=OFF"
    "-DDEBIAN_BUILD=ON"
    "-DRUNDIR=/run/rspamd"
    "-DDBDIR=/var/lib/rspamd"
--- a/pkgs/servers/monitoring/prometheus/domain-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/domain-exporter.nix
@ -1,17 +1,25 @@
-{ lib, buildGoModule, fetchFromGitHub, nixosTests }:
+{ lib, buildGoModule, fetchFromGitHub, fetchpatch, nixosTests }:

 buildGoModule rec {
  pname = "domain-exporter";
-  version = "1.11.0";
+  version = "1.17.1";

  src = fetchFromGitHub {
    owner = "caarlos0";
    repo = "domain_exporter";
    rev = "v${version}";
-    sha256 = "018y0xwdn2f2shhwaa0hqm4y8xsbqwif0733qb0377wpjbj4v137";
+    hash = "sha256-18r+jUdVcv7hA9KdWkgvu2tNUIGf9f1uj2cwwMDnAs8=";
  };

-  vendorSha256 = "0s1hs8byba9y57abg386n09wfg1wcqpzs164ap0km8ap2i96bdlb";
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/caarlos0/domain_exporter/commit/32815b0956056c5c14313d0b860d1e9db754e545.patch";
+      hash = "sha256-iEYnJ4BU+MWQd0BgKmRb8RNj/lH2V/Z9uwFS2muR4Go=";
+      name = "sg_domains.patch";
+    })
+  ];
+
+  vendorSha256 = "sha256-LHs2DSLNe+E3NUXZS7TV5M53ueUbCjjNM87UPRTaCpo=";

  doCheck = false; # needs internet connection

@ -21,6 +29,6 @@ buildGoModule rec {
    homepage = "https://github.com/caarlos0/domain_exporter";
    description = "Exports the expiration time of your domains as prometheus metrics";
    license = licenses.mit;
-    maintainers = with maintainers; [ mmilata prusnak ];
+    maintainers = with maintainers; [ mmilata prusnak peterhoeg ];
  };
 }
--- a/pkgs/servers/polaris/default.nix
+++ b/pkgs/servers/polaris/default.nix
@ -38,6 +38,11 @@ rustPlatform.buildRustPackage rec {
    cp -a docs/swagger $out/share/polaris-swagger
  '';

+  preCheck = ''
+    # 'Err' value: Os { code: 24, kind: Uncategorized, message: "Too many open files" }
+    ulimit -n 4096
+  '';
+
  passthru.updateScript = ./update.sh;

  meta = with lib; {
--- a/pkgs/servers/rt/default.nix
+++ b/pkgs/servers/rt/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "rt";
-  version = "5.0.2";
+  version = "5.0.3";

  src = fetchFromGitHub {
    repo = pname;
    rev = "${pname}-${version}";
    owner = "bestpractical";
-    sha256 = "1qdvbsmdynjw2v0clnmhdmrky7w4dsiysv92n7d7jdbawnicqahn";
+    hash = "sha256-ZitlueLEbV3mGJg0aDrLa5IReJiOVaEf+JicbA9zUS4=";
  };

  patches = [
@ -120,8 +120,7 @@ stdenv.mkDerivation rec {
  ];

  preAutoreconf = ''
-    substituteInPlace configure.ac \
-      --replace "rt-3.9.EXPORTED" "rt-${version}"
+    echo rt-${version} > .tag
  '';
  preConfigure = ''
    configureFlags="$configureFlags --with-web-user=$UID"
--- a/pkgs/shells/bash/fzf-obc/default.nix
+++ b/pkgs/shells/bash/fzf-obc/default.nix
@ -0,0 +1,30 @@
+{ lib, stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "fzf-obc";
+  version = "1.3.0";
+
+  src = fetchFromGitHub {
+    owner = "rockandska";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-KIAlDpt1Udl+RLp3728utgQ9FCjZz/OyoG92MOJmgPI=";
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/share/fzf-obc/{bin,lib/fzf-obc,plugins/{kill,gradle}}
+    install -m644 bin/* $out/share/fzf-obc/bin
+    install -m644 lib/fzf-obc/* $out/share/fzf-obc/lib/fzf-obc
+    install -m644 plugins/kill/* $out/share/fzf-obc/plugins/kill
+    install -m644 plugins/gradle/* $out/share/fzf-obc/plugins/gradle
+  '';
+
+  meta = with lib; {
+    homepage = "https://fzf-obc.readthedocs.io";
+    description = "Completion script adding fzf over all know bash completion functions";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ loicreynier ];
+  };
+}
--- a/pkgs/tools/admin/gtk-vnc/default.nix
+++ b/pkgs/tools/admin/gtk-vnc/default.nix
@ -23,13 +23,13 @@

 stdenv.mkDerivation rec {
  pname = "gtk-vnc";
-  version = "1.3.0";
+  version = "1.3.1";

  outputs = [ "out" "bin" "man" "dev" ];

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "X6qlgjuMvowLC6HkVsTnDEsa5mhcn+gaQoLZjPAKIR0=";
+    sha256 = "USdjrE4FWdAVi2aCyl3Ro71jPwgvXkNJ1xWOa1+A8c4=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/misc/page/default.nix
+++ b/pkgs/tools/misc/page/default.nix
@ -2,13 +2,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "page";
-  version = "3.1.0";
+  version = "3.1.2";

  src = fetchFromGitHub {
    owner = "I60R";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-3XRtTiIqUI2j9kmsg0yeuipgHEzdJRG2abO3Ll7ukmA=";
+    sha256 = "sha256-e6GkvIojMfsIm4UxRyEvvNkZPGSmUnf9K/0ZISy8kj4=";
  };

  nativeBuildInputs = [ installShellFiles ];
@ -19,7 +19,7 @@ rustPlatform.buildRustPackage rec {
    installShellCompletion --zsh $completions_dir/_page
  '';

-  cargoSha256 = "sha256-4Z58OkCvlGXmuTeVl0me3a/YImcKwggF9tXfenQnjtA=";
+  cargoSha256 = "sha256-qyaHW4mbJXZ/iGQlIzmTo2dgPLC9JlPKBee+uAuW5PQ=";

  meta = with lib; {
    description = "Use neovim as pager";
--- a/pkgs/tools/misc/yt-dlp/default.nix
+++ b/pkgs/tools/misc/yt-dlp/default.nix
@ -20,12 +20,12 @@ buildPythonPackage rec {
  # The websites yt-dlp deals with are a very moving target. That means that
  # downloads break constantly. Because of that, updates should always be backported
  # to the latest stable release.
-  version = "2022.6.29";
+  version = "2022.07.18";

  src = fetchPypi {
    inherit pname;
    version = builtins.replaceStrings [ ".0" ] [ "." ] version;
-    sha256 = "sha256-X7+scv0DXRG8JpPl0c1pM7G8BxL3QvUIKiYXA4ELtck=";
+    sha256 = "sha256-DnuB/GrI0bfT//p5+QRMpBY3hEIlgsmjWTMF2ipp7AI=";
  };

  propagatedBuildInputs = [ brotli certifi mutagen pycryptodomex websockets ];
--- a/pkgs/tools/virtualization/linode-cli/default.nix
+++ b/pkgs/tools/virtualization/linode-cli/default.nix
@ -13,8 +13,8 @@
 let
  sha256 = "1yglnmwspdncqmy5x0zc0g43bfm4597zfmwfvs7qkalv1pprf0s3";
  # specVersion taken from: https://www.linode.com/docs/api/openapi.yaml at `info.version`.
-  specVersion = "4.129.0";
-  specSha256 = "02bf1jcqn7sp6qmkd56jgmgpfg3agbw47cd38zha6fksm2knmd32";
+  specVersion = "4.130.0";
+  specSha256 = "0qwydx6bsbi37135zmwm8vx1yzwa5gyi8bz1zsvkd64wjv79yra1";
  spec = fetchurl {
    url = "https://raw.githubusercontent.com/linode/linode-api-docs/v${specVersion}/openapi.yaml";
    sha256 = specSha256;
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -214,6 +214,8 @@ with pkgs;

  quickemu = callPackage ../development/quickemu { };

+  adcli = callPackage ../os-specific/linux/adcli { };
+
  aether = callPackage ../applications/networking/aether { };

  alda = callPackage ../development/interpreters/alda { };
@ -2652,6 +2654,8 @@ with pkgs;

  sshchecker = callPackage ../tools/security/sshchecker { };

+  sshs = callPackage ../development/tools/sshs { };
+
  titaniumenv = callPackage ../development/mobile/titaniumenv { };

  abootimg = callPackage ../development/mobile/abootimg {};
@ -2670,9 +2674,10 @@ with pkgs;
    pkgs_i686 = pkgsi686Linux;
  };

-  androidndkPkgs = androidndkPkgs_18b;
-  androidndkPkgs_18b = (callPackage ../development/androidndk-pkgs {})."18b";
+  androidndkPkgs = androidndkPkgs_21;
  androidndkPkgs_21 = (callPackage ../development/androidndk-pkgs {})."21";
+  androidndkPkgs_23b = (callPackage ../development/androidndk-pkgs {})."23b";
+  androidndkPkgs_24 = (callPackage ../development/androidndk-pkgs {})."24";

  androidsdk_9_0 = androidenv.androidPkgs_9_0.androidsdk;

@ -3405,8 +3410,6 @@ with pkgs;

  dconf = callPackage ../development/libraries/dconf { };

-  dcw-gmt = callPackage ../applications/gis/gmt/dcw.nix { };
-
  ddate = callPackage ../tools/misc/ddate { };

  ddosify = callPackage ../development/tools/ddosify { };
@ -3744,6 +3747,8 @@ with pkgs;

  fzf = callPackage ../tools/misc/fzf { };

+  fzf-obc = callPackage ../shells/bash/fzf-obc { };
+
  fzf-zsh = callPackage ../shells/zsh/fzf-zsh { };

  fzy = callPackage ../tools/misc/fzy { };
@ -3832,11 +3837,6 @@ with pkgs;
    variant = "krita";
  };

-  gmt = callPackage ../applications/gis/gmt {
-    inherit (darwin.apple_sdk.frameworks)
-      Accelerate CoreGraphics CoreVideo;
-  };
-
  gpg-tui = callPackage ../tools/security/gpg-tui {
    inherit (darwin.apple_sdk.frameworks) AppKit Foundation;
    inherit (darwin) libobjc libresolv;
@ -9184,6 +9184,8 @@ with pkgs;
  openapi-generator-cli = callPackage ../tools/networking/openapi-generator-cli { jre = pkgs.jre_headless; };
  openapi-generator-cli-unstable = callPackage ../tools/networking/openapi-generator-cli/unstable.nix { jre = pkgs.jre_headless; };

+  openbangla-keyboard = libsForQt5.callPackage ../applications/misc/openbangla-keyboard { };
+
  openboard = libsForQt5.callPackage ../applications/graphics/openboard { };

  opencc = callPackage ../tools/text/opencc { };
@ -13943,6 +13945,8 @@ with pkgs;

  opam-installer = callPackage ../development/tools/ocaml/opam/installer.nix { };

+  opam2json = callPackage ../development/tools/ocaml/opam2json { };
+
  wrapWatcom = callPackage ../development/compilers/open-watcom/wrapper.nix { };
  open-watcom-v2-unwrapped = callPackage ../development/compilers/open-watcom/v2.nix { };
  open-watcom-v2 = wrapWatcom open-watcom-v2-unwrapped { };
@ -19666,6 +19670,10 @@ with pkgs;

  libuinputplus = callPackage ../development/libraries/libuinputplus { };

+  libuiohook = callPackage ../development/libraries/libuiohook {
+    inherit (darwin.apple_sdk.frameworks) AppKit ApplicationServices Carbon;
+  };
+
  libunistring = callPackage ../development/libraries/libunistring { };

  libupnp = callPackage ../development/libraries/pupnp { };
@ -20521,6 +20529,8 @@ with pkgs;

  protobuf = protobuf3_19;

+  protobuf3_21 = callPackage ../development/libraries/protobuf/3.21.nix { };
+  protobuf3_20 = callPackage ../development/libraries/protobuf/3.20.nix { };
  protobuf3_19 = callPackage ../development/libraries/protobuf/3.19.nix { };
  protobuf3_17 = callPackage ../development/libraries/protobuf/3.17.nix { };
  protobuf3_11 = callPackage ../development/libraries/protobuf/3.11.nix { };
@ -25576,6 +25586,38 @@ with pkgs;

  zuki-themes = callPackage ../data/themes/zuki { };

+  ### APPLICATIONS / GIS
+
+  gmt = callPackage ../applications/gis/gmt {
+    inherit (darwin.apple_sdk.frameworks)
+      Accelerate CoreGraphics CoreVideo;
+  };
+
+  gshhg-gmt = callPackage ../applications/gis/gmt/gshhg.nix { };
+
+  dcw-gmt = callPackage ../applications/gis/gmt/dcw.nix { };
+
+  grass = callPackage ../applications/gis/grass { };
+
+  openorienteering-mapper = libsForQt5.callPackage ../applications/gis/openorienteering-mapper { };
+
+  qgis-ltr = callPackage ../applications/gis/qgis/ltr.nix { };
+
+  qgis = callPackage ../applications/gis/qgis { };
+
+  qmapshack = libsForQt5.callPackage ../applications/gis/qmapshack { };
+
+  saga = libsForQt5.callPackage ../applications/gis/saga {
+    inherit (darwin.apple_sdk.frameworks) Cocoa;
+  };
+
+  udig = callPackage ../applications/gis/udig { };
+
+  whitebox-tools = callPackage ../applications/gis/whitebox-tools {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
+  zombietrackergps = libsForQt5.callPackage ../applications/gis/zombietrackergps { };

  ### APPLICATIONS

@ -26939,8 +26981,6 @@ with pkgs;

  gpx-viewer = callPackage ../applications/misc/gpx-viewer { };

-  grass = callPackage ../applications/gis/grass { };
-
  grepcidr = callPackage ../applications/search/grepcidr { };

  grepm = callPackage ../applications/search/grepm { };
@ -27269,6 +27309,8 @@ with pkgs;

  jmusicbot = callPackage ../applications/audio/jmusicbot { };

+  josh = callPackage ../applications/version-management/josh { };
+
  junction = callPackage ../applications/misc/junction { };

  lemonade = callPackage ../applications/misc/lemonade { };
@ -29311,8 +29353,6 @@ with pkgs;
    vm = callPackage ../applications/audio/open-music-kontrollers/vm.nix { };
  };

-  openorienteering-mapper = libsForQt5.callPackage ../applications/gis/openorienteering-mapper { };
-
  openscad = libsForQt5.callPackage ../applications/graphics/openscad {};

  open-stage-control = callPackage ../applications/audio/open-stage-control {
@ -29703,10 +29743,6 @@ with pkgs;

  wrapQemuBinfmtP = callPackage ../applications/virtualization/qemu/binfmt-p-wrapper.nix { };

-  qgis-ltr = callPackage ../applications/gis/qgis/ltr.nix { };
-
-  qgis = callPackage ../applications/gis/qgis { };
-
  qgroundcontrol = libsForQt5.callPackage ../applications/science/robotics/qgroundcontrol { };

  qjackctl = libsForQt5.callPackage ../applications/audio/qjackctl { };
@ -29724,8 +29760,6 @@ with pkgs;

  garmindev = callPackage ../applications/misc/qlandkartegt/garmindev.nix {};

-  qmapshack = libsForQt5.callPackage ../applications/gis/qmapshack { };
-
  qmediathekview = libsForQt5.callPackage ../applications/video/qmediathekview { };

  qmplay2 = libsForQt5.callPackage ../applications/video/qmplay2 { };
@ -31149,10 +31183,6 @@ with pkgs;
    wlroots = wlroots_0_14;
  };

-  whitebox-tools = callPackage ../applications/gis/whitebox-tools {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-
  windowlab = callPackage ../applications/window-managers/windowlab { };

  windowmaker = callPackage ../applications/window-managers/windowmaker { };
@ -31588,8 +31618,6 @@ with pkgs;
    inherit (darwin.apple_sdk.frameworks) CoreServices;
  };

-  zombietrackergps = libsForQt5.callPackage ../applications/gis/zombietrackergps { };
-
  zoom-us = callPackage ../applications/networking/instant-messengers/zoom-us { };

  zotero = callPackage ../applications/office/zotero { };
@ -31881,10 +31909,6 @@ with pkgs;

  quorum = callPackage ../applications/blockchains/quorum { };

-  saga = libsForQt5.callPackage ../applications/gis/saga {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
-  };
-
  samplv1 = libsForQt5.callPackage ../applications/audio/samplv1 { };

  scaleft = callPackage ../applications/networking/scaleft { };
@ -31910,8 +31934,6 @@ with pkgs;

  drumkv1 = libsForQt5.callPackage ../applications/audio/drumkv1 { };

-  gshhg-gmt = callPackage ../applications/gis/gmt/gshhg.nix { };
-
  eureka-editor = callPackage ../applications/misc/eureka-editor { };

  eureka-ideas = callPackage ../applications/misc/eureka-ideas {
@ -32963,8 +32985,6 @@ with pkgs;

  uchess = callPackage ../games/uchess { };

-  udig = callPackage ../applications/gis/udig { };
-
  ufoai = callPackage ../games/ufoai { };

  uhexen2 = callPackage ../games/uhexen2 { };
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@ -181,6 +181,8 @@ let

    checkseum = callPackage ../development/ocaml-modules/checkseum { };

+    chrome-trace = callPackage ../development/ocaml-modules/chrome-trace { };
+
    cil = callPackage ../development/ocaml-modules/cil { };

    cmdliner_1_0 = callPackage ../development/ocaml-modules/cmdliner/1_0.nix { };
@ -549,7 +551,7 @@ let

    dypgen = callPackage ../development/ocaml-modules/dypgen { };

-    gapi_ocaml = callPackage ../development/ocaml-modules/gapi-ocaml { };
+    gapi-ocaml = callPackage ../development/ocaml-modules/gapi-ocaml { };

    gen_js_api = callPackage ../development/ocaml-modules/gen_js_api { };

--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@ -6590,10 +6590,10 @@ let

  DBIxSearchBuilder = buildPerlPackage {
    pname = "DBIx-SearchBuilder";
-    version = "1.68";
+    version = "1.71";
    src = fetchurl {
-      url = "mirror://cpan/authors/id/B/BP/BPS/DBIx-SearchBuilder-1.68.tar.gz";
-      sha256 = "be197c0f83c426996f77d22126f3103f958fc4bd1791c6962b793cc2779601f8";
+      url = "mirror://cpan/authors/id/B/BP/BPS/DBIx-SearchBuilder-1.71.tar.gz";
+      sha256 = "1ga2sjis6lg51z58il8q165klc38dmb3wj3phyxjfjg6yskdsbz4";
    };
    buildInputs = [ DBDSQLite ];
    propagatedBuildInputs = [ CacheSimpleTimedExpiry ClassAccessor ClassReturnValue Clone DBIxDBSchema Want capitalization ];
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@ -55,6 +55,7 @@ mapAliases ({
  diff_cover = diff-cover; # added 2021-07-02
  discogs_client = discogs-client; # added 2021-07-02
  djangorestframework-jwt = drf-jwt; # added 2021-07-20
+  django-sampledatahelper = throw "django-sampledatahelper was removed because it is no longer compatible to latest Django version"; # added 2022-07-18
  django_2 = throw "Django 2 has reached it's projected EOL in 2022/04 and has therefore been removed."; # added 2022-03-05
  django_appconf = django-appconf; # added 2022-03-03
  django_environ = django-environ; # added 2021-12-25
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -2471,8 +2471,6 @@ in {

  django-reversion = callPackage ../development/python-modules/django-reversion { };

-  django-sampledatahelper = callPackage ../development/python-modules/django-sampledatahelper { };
-
  django-sesame = callPackage ../development/python-modules/django-sesame { };

  django_silk = callPackage ../development/python-modules/django_silk { };
@ -9577,6 +9575,8 @@ in {

  scikit-learn-extra = callPackage ../development/python-modules/scikit-learn-extra { };

+  scikit-misc = callPackage ../development/python-modules/scikit-misc { };
+
  scikit-optimize = callPackage ../development/python-modules/scikit-optimize { };

  scikits-odes = callPackage ../development/python-modules/scikits-odes { };