Merge master into staging-next

2021-10-20 12:01:31 +00:00 · 2021-10-20 12:01:31 +00:00 · cdc8393c04
commit cdc8393c04
parent 2d8f645c79 1326545a4e
75 changed files with 1043 additions and 39590 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -12394,6 +12394,12 @@
    githubId = 452;
    name = "Yurii Rashkovskii";
  };
+  yrd = {
+    name = "Yannik Rödel";
+    email = "nix@yannik.info";
+    github = "yrd";
+    githubId = 1820447;
+  };
  ysndr = {
    email = "me@ysndr.de";
    github = "ysndr";
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@ -14,17 +14,17 @@ let
  archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "069jdwqs9z2z95mjs9nx58rp1516dyyqn5bc0vgr7xvlbis97lq0";
-    x86_64-darwin = "1bd32dkpyfgknxqn76jcwpa47rac9q14glbf5sb1rh9rfav0m1m8";
-    aarch64-linux = "1axxnys3pd2qrvj6mqpa5cih44b4dbpgi8mvn616d8d45jgdnc1r";
-    aarch64-darwin = "0bdp0k20lfwpsl1a3dz6c97s0b5bp3rhb66jwgbyyc16zrz79r1z";
-    armv7l-linux = "077w5hvc4brb56zs0w37nr4a8vlcij5z3yrv3rz16p58nnkj56hs";
+    x86_64-linux = "1yfaf9qdaf6njvj8kilmivyl0nnhdvd9hbzpf8hv3kw5rfpdvy89";
+    x86_64-darwin = "10rx5aif61xipf5lcjzkidz9dhbm5gc2wf87c2j456nixaxbx0b4";
+    aarch64-linux = "13h4ffdm9y9p3jnqcjvapykbm73bkjy5jaqwhsi293f9r7jfp9rf";
+    aarch64-darwin = "07nmrxc25rfp5ibarhg3c14ksk2ymqmsnc55hicvvhw93g2qczby";
+    armv7l-linux = "1gz1mmw2vp986l9sm7rd6hypxs70sz63sbmzyxwfqpvj973dl23q";
  }.${system};
 in
  callPackage ./generic.nix rec {
    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.61.1";
+    version = "1.61.2";
    pname = "vscode";

    executableName = "code" + lib.optionalString isInsiders "-insiders";
--- a/pkgs/applications/graphics/ipe/default.nix
+++ b/pkgs/applications/graphics/ipe/default.nix
@ -1,7 +1,9 @@
 { lib
 , mkDerivation
+, makeDesktopItem
 , fetchurl
 , pkg-config
+, copyDesktopItems
 , cairo
 , freetype
 , ghostscript
@ -26,7 +28,7 @@ mkDerivation rec {

  sourceRoot = "${pname}-${version}/src";

-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config copyDesktopItems ];

  buildInputs = [
    cairo
@ -42,19 +44,39 @@ mkDerivation rec {
    zlib
  ];

-  IPEPREFIX=placeholder "out";
-  URWFONTDIR="${texlive}/texmf-dist/fonts/type1/urw/";
+  IPEPREFIX = placeholder "out";
+  URWFONTDIR = "${texlive}/texmf-dist/fonts/type1/urw/";
  LUA_PACKAGE = "lua";

-  qtWrapperArgs = [ "--prefix PATH : ${texlive}/bin"  ];
+  qtWrapperArgs = [ "--prefix PATH : ${lib.makeBinPath [ texlive ]}" ];

  enableParallelBuilding = true;

-  # TODO: make .desktop entry
+  desktopItems = [
+    (makeDesktopItem {
+      name = pname;
+      desktopName = "Ipe";
+      genericName = "Drawing editor";
+      comment = "A drawing editor for creating figures in PDF format";
+      exec = "ipe";
+      icon = "ipe";
+      mimeType = "text/xml;application/pdf";
+      categories = "Graphics;Qt;";
+      extraDesktopEntries = {
+        StartupWMClass = "ipe";
+        StartupNotify = "true";
+      };
+    })
+  ];
+
+  postInstall = ''
+    mkdir -p $out/share/icons/hicolor/128x128/apps
+    ln -s $out/share/ipe/${version}/icons/icon_128x128.png $out/share/icons/hicolor/128x128/apps/ipe.png
+  '';

  meta = with lib; {
    description = "An editor for drawing figures";
-    homepage = "http://ipe.otfried.org";  # https not available
+    homepage = "http://ipe.otfried.org"; # https not available
    license = licenses.gpl3Plus;
    longDescription = ''
      Ipe is an extensible drawing editor for creating figures in PDF and Postscript format.
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop-yarndeps.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop-yarndeps.nix
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
@ -4,6 +4,7 @@
 , makeWrapper
 , makeDesktopItem
 , mkYarnPackage
+, fetchYarnDeps
 , electron
 , element-web
 , callPackage
@ -13,27 +14,28 @@

 , useWayland ? false
 }:
-# Notes for maintainers:
-# * versions of `element-web` and `element-desktop` should be kept in sync.
-# * the Yarn dependency expression must be updated with `./update-element-desktop.sh <git release tag>`

 let
+  pinData = (builtins.fromJSON (builtins.readFile ./pin.json));
  executableName = "element-desktop";
-  version = "1.9.2";
+  electron_exec = if stdenv.isDarwin then "${electron}/Applications/Electron.app/Contents/MacOS/Electron" else "${electron}/bin/electron";
+in
+mkYarnPackage rec {
+  pname = "element-desktop";
+  inherit (pinData) version;
+  name = "${pname}-${version}";
  src = fetchFromGitHub {
    owner = "vector-im";
    repo = "element-desktop";
    rev = "v${version}";
-    sha256 = "sha256-F1uyyBbs+U7tQzRtn+p923Z/BY8Nwxr/JTMYwsak8W8=";
+    sha256 = pinData.desktopSrcHash;
  };
-  electron_exec = if stdenv.isDarwin then "${electron}/Applications/Electron.app/Contents/MacOS/Electron" else "${electron}/bin/electron";
-in
-mkYarnPackage rec {
-  name = "element-desktop-${version}";
-  inherit version src;

  packageJSON = ./element-desktop-package.json;
-  yarnNix = ./element-desktop-yarndeps.nix;
+  offlineCache = fetchYarnDeps {
+    yarnLock = src + "/yarn.lock";
+    sha256 = pinData.desktopYarnHash;
+  };

  nativeBuildInputs = [ makeWrapper ];

@ -102,6 +104,8 @@ mkYarnPackage rec {
    '';
  };

+  passthru.updateScript = ./update.sh;
+
  meta = with lib; {
    description = "A feature-rich client for Matrix.org";
    homepage = "https://element.io/";
--- a/pkgs/applications/networking/instant-messengers/element/element-web.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-web.nix
@ -1,9 +1,7 @@
 { lib, stdenv, fetchurl, writeText, jq, conf ? {} }:

-# Note for maintainers:
-# Versions of `element-web` and `element-desktop` should be kept in sync.
-
 let
+  pinData = (builtins.fromJSON (builtins.readFile ./pin.json));
  noPhoningHome = {
    disable_guests = true; # disable automatic guest account registration at matrix.org
    piwik = false; # disable analytics
@ -12,11 +10,11 @@ let

 in stdenv.mkDerivation rec {
  pname = "element-web";
-  version = "1.9.2";
+  inherit (pinData) version;

  src = fetchurl {
    url = "https://github.com/vector-im/element-web/releases/download/v${version}/element-v${version}.tar.gz";
-    sha256 = "sha256-Qkn0vyZGvBAeOfTzxydWzjFQJwY39INAhwZNX4xsM7U=";
+    sha256 = pinData.webHash;
  };

  installPhase = ''
--- a/pkgs/applications/networking/instant-messengers/element/keytar/default.nix
+++ b/pkgs/applications/networking/instant-messengers/element/keytar/default.nix
@ -1,15 +1,18 @@
 { lib, stdenv, fetchFromGitHub, nodejs-14_x, python3, callPackage
-, fixup_yarn_lock, yarn, pkg-config, libsecret, xcbuild, Security, AppKit }:
+, fixup_yarn_lock, yarn, pkg-config, libsecret, xcbuild, Security, AppKit, fetchYarnDeps }:

-stdenv.mkDerivation rec {
+let
+  pinData = (builtins.fromJSON (builtins.readFile ./pin.json));
+
+in stdenv.mkDerivation rec {
  pname = "keytar";
-  version = "7.7.0";
+  inherit (pinData) version;

  src = fetchFromGitHub {
    owner = "atom";
    repo = "node-keytar";
    rev = "v${version}";
-    sha256 = "0ajvr4kjbyw2shb1y14c0dsghdlnq30f19hk2sbzj6n9y3xa3pmi";
+    sha256 = pinData.srcHash;
  };

  nativeBuildInputs = [ nodejs-14_x python3 yarn pkg-config ]
@ -19,7 +22,10 @@ stdenv.mkDerivation rec {

  npm_config_nodedir = nodejs-14_x;

-  yarnOfflineCache = (callPackage ./yarn.nix {}).offline_cache;
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = ./yarn.lock;
+    sha256 = pinData.yarnHash;
+  };

  buildPhase = ''
    cp ${./yarn.lock} ./yarn.lock
--- a/pkgs/applications/networking/instant-messengers/element/keytar/pin.json
+++ b/pkgs/applications/networking/instant-messengers/element/keytar/pin.json
@ -0,0 +1,5 @@
+{
+  "version": "7.7.0",
+  "srcHash": "sd6h+vDJGvmXFhOm4MDAljb4dAOMBB8W1IL7JSfJWyo=",
+  "yarnHash": "1m75hvl06mcj260hicbmv75p94h73gw5d24zpm5wxwc0q8v8wzfl"
+}
--- a/pkgs/applications/networking/instant-messengers/element/keytar/update.sh
+++ b/pkgs/applications/networking/instant-messengers/element/keytar/update.sh
@ -1,19 +1,38 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=../ -i bash -p wget yarn2nix yarn
+#!nix-shell -I nixpkgs=../../../../../../ -i bash -p wget prefetch-yarn-deps yarn

-set -euo pipefail
-
-if [ "$#" -ne 1 ] || [[ "$1" == -* ]]; then
-  echo "Regenerates the Yarn dependency lock files."
-  echo "Usage: $0 <git release tag>"
+if [ "$#" -gt 1 ] || [[ "$1" == -* ]]; then
+  echo "Regenerates packaging data for the seshat package."
+  echo "Usage: $0 [git release tag]"
  exit 1
 fi

-SRC="https://raw.githubusercontent.com/atom/node-keytar/$1"
+version="$1"
+
+set -euo pipefail
+
+if [ -z "$version" ]; then
+  version="$(wget -O- "https://api.github.com/repos/atom/node-keytar/releases?per_page=1" | jq -r '.[0].tag_name')"
+fi
+
+# strip leading "v"
+version="${version#v}"
+
+SRC="https://raw.githubusercontent.com/atom/node-keytar/v$version"

 wget "$SRC/package-lock.json"
 wget "$SRC/package.json"
 rm -f yarn.lock
 yarn import
-yarn2nix > yarn.nix
 rm -rf node_modules package.json package-lock.json
+yarn_hash=$(prefetch-yarn-deps yarn.lock)
+
+src_hash=$(nix-prefetch-github atom node-keytar --rev v${version} | jq -r .sha256)
+
+cat > pin.json << EOF
+{
+  "version": "$version",
+  "srcHash": "$src_hash",
+  "yarnHash": "$yarn_hash"
+}
+EOF
--- a/pkgs/applications/networking/instant-messengers/element/keytar/yarn.nix
+++ b/pkgs/applications/networking/instant-messengers/element/keytar/yarn.nix
--- a/pkgs/applications/networking/instant-messengers/element/pin.json
+++ b/pkgs/applications/networking/instant-messengers/element/pin.json
@ -0,0 +1,6 @@
+{
+  "version": "1.9.2",
+  "desktopSrcHash": "F1uyyBbs+U7tQzRtn+p923Z/BY8Nwxr/JTMYwsak8W8=",
+  "desktopYarnHash": "0iwbszhaxaxggymixljzjb2gqrsij67fwakxhd3yj9g1zds49ghh",
+  "webHash": "1d9kdj65yk86hx087x1p0qkm0cffaqkwgwzl74g11g264szz8ja2"
+}
--- a/pkgs/applications/networking/instant-messengers/element/seshat/default.nix
+++ b/pkgs/applications/networking/instant-messengers/element/seshat/default.nix
@ -1,14 +1,17 @@
-{ lib, stdenv, rustPlatform, fetchFromGitHub, callPackage, sqlcipher, nodejs-14_x, python3, yarn, fixup_yarn_lock, CoreServices }:
+{ lib, stdenv, rustPlatform, fetchFromGitHub, callPackage, sqlcipher, nodejs-14_x, python3, yarn, fixup_yarn_lock, CoreServices, fetchYarnDeps }:

-rustPlatform.buildRustPackage rec {
+let
+  pinData = (builtins.fromJSON (builtins.readFile ./pin.json));
+
+in rustPlatform.buildRustPackage rec {
  pname = "seshat-node";
-  version = "2.3.0";
+  inherit (pinData) version;

  src = fetchFromGitHub {
    owner = "matrix-org";
    repo = "seshat";
    rev = version;
-    sha256 = "0zigrz59mhih9asmbbh38z2fg0sii2342q6q0500qil2a0rssai7";
+    sha256 = pinData.srcHash;
  };

  sourceRoot = "source/seshat-node/native";
@ -18,7 +21,10 @@ rustPlatform.buildRustPackage rec {

  npm_config_nodedir = nodejs-14_x;

-  yarnOfflineCache = (callPackage ./yarn.nix {}).offline_cache;
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = src + "/seshat-node/yarn.lock";
+    sha256 = pinData.yarnHash;
+  };

  buildPhase = ''
    cd ..
@ -42,5 +48,5 @@ rustPlatform.buildRustPackage rec {
    cp -r . $out
  '';

-  cargoSha256 = "0habjf85mzqxwf8k15msm4cavd7ldq4zpxddkwd4inl2lkvlffqj";
+  cargoSha256 = pinData.cargoHash;
 }
--- a/pkgs/applications/networking/instant-messengers/element/seshat/pin.json
+++ b/pkgs/applications/networking/instant-messengers/element/seshat/pin.json
@ -0,0 +1,6 @@
+{
+  "version": "2.3.0",
+  "srcHash": "JyqtM1CCRgxAAdhgQYaIUYPnxEcDrlW1SjDCmsrPL34=",
+  "yarnHash": "0bym6i1f0i3bs4fncbiwzwmbxp7j14rz1v4kyvsl02qs97qw1jac",
+  "cargoHash": "sha256-EjtH96SC2kgan631+wlu9LStGKm6ljCR4x3/WpCTS0E="
+}
--- a/pkgs/applications/networking/instant-messengers/element/seshat/update.sh
+++ b/pkgs/applications/networking/instant-messengers/element/seshat/update.sh
@ -1,16 +1,49 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=../ -i bash -p wget yarn2nix
+#!nix-shell -I nixpkgs=../../../../../../ -i bash -p wget prefetch-yarn-deps yarn nix-prefetch

-set -euo pipefail
-
-if [ "$#" -ne 1 ] || [[ "$1" == -* ]]; then
-  echo "Regenerates the Yarn dependency lock files."
-  echo "Usage: $0 <git release tag>"
+if [ "$#" -gt 1 ] || [[ "$1" == -* ]]; then
+  echo "Regenerates packaging data for the seshat package."
+  echo "Usage: $0 [git release tag]"
  exit 1
 fi

-SRC="https://raw.githubusercontent.com/matrix-org/seshat/$1"
+version="$1"

+set -euo pipefail
+
+if [ -z "$version" ]; then
+  version="$(wget -O- "https://api.github.com/repos/matrix-org/seshat/tags" | jq -r '.[] | .name' | sort --version-sort | tail -1)"
+fi
+
+SRC="https://raw.githubusercontent.com/matrix-org/seshat/$version"
+
+tmpdir=$(mktemp -d)
+trap 'rm -rf "$tmpdir"' EXIT
+
+pushd $tmpdir
 wget "$SRC/seshat-node/yarn.lock"
-yarn2nix > yarn.nix
-rm yarn.lock
+yarn_hash=$(prefetch-yarn-deps yarn.lock)
+popd
+
+src_hash=$(nix-prefetch-github matrix-org seshat --rev ${version} | jq -r .sha256)
+
+cat > pin.json << EOF
+{
+  "version": "$version",
+  "srcHash": "$src_hash",
+  "yarnHash": "$yarn_hash",
+  "cargoHash": "0000000000000000000000000000000000000000000000000000"
+}
+EOF
+
+cargo_hash=$(nix-prefetch "{ sha256 }: (import ../../../../../.. {}).element-desktop.seshat.cargoDeps")
+
+cat > pin.json << EOF
+{
+  "version": "$version",
+  "srcHash": "$src_hash",
+  "yarnHash": "$yarn_hash",
+  "cargoHash": "$cargo_hash"
+}
+EOF
+
--- a/pkgs/applications/networking/instant-messengers/element/seshat/yarn.nix
+++ b/pkgs/applications/networking/instant-messengers/element/seshat/yarn.nix
--- a/pkgs/applications/networking/instant-messengers/element/update-element-desktop.sh
+++ b/pkgs/applications/networking/instant-messengers/element/update-element-desktop.sh
@ -1,17 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=../../../../../ -i bash -p wget yarn2nix nix-prefetch-git
-
-set -euo pipefail
-
-if [ "$#" -ne 1 ] || [[ "$1" == -* ]]; then
-  echo "Regenerates the Yarn dependency lock files for the element-desktop package."
-  echo "Usage: $0 <git release tag>"
-  exit 1
-fi
-
-RIOT_WEB_SRC="https://raw.githubusercontent.com/vector-im/element-desktop/$1"
-
-wget "$RIOT_WEB_SRC/package.json" -O element-desktop-package.json
-wget "$RIOT_WEB_SRC/yarn.lock" -O element-desktop-yarndeps.lock
-yarn2nix --no-patch --lockfile=element-desktop-yarndeps.lock > element-desktop-yarndeps.nix
-rm element-desktop-yarndeps.lock
--- a/pkgs/applications/networking/instant-messengers/element/update.sh
+++ b/pkgs/applications/networking/instant-messengers/element/update.sh
@ -0,0 +1,43 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -I nixpkgs=../../../../../ -i bash -p nix wget prefetch-yarn-deps nix-prefetch-github
+
+if [ "$#" -gt 1 ] || [[ "$1" == -* ]]; then
+  echo "Regenerates packaging data for the element packages."
+  echo "Usage: $0 [git release tag]"
+  exit 1
+fi
+
+version="$1"
+
+set -euo pipefail
+
+if [ -z "$version" ]; then
+  version="$(wget -O- "https://api.github.com/repos/vector-im/element-desktop/releases?per_page=1" | jq -r '.[0].tag_name')"
+fi
+
+# strip leading "v"
+version="${version#v}"
+
+desktop_src="https://raw.githubusercontent.com/vector-im/element-desktop/v$version"
+
+desktop_src_hash=$(nix-prefetch-github vector-im element-desktop --rev v${version} | jq -r .sha256)
+web_hash=$(nix-prefetch-url "https://github.com/vector-im/element-web/releases/download/v$version/element-v$version.tar.gz")
+
+wget "$desktop_src/package.json" -O element-desktop-package.json
+
+tmpdir=$(mktemp -d)
+trap 'rm -rf "$tmpdir"' EXIT
+
+pushd $tmpdir
+wget "$desktop_src/yarn.lock"
+desktop_yarn_hash=$(prefetch-yarn-deps yarn.lock)
+popd
+
+cat > pin.json << EOF
+{
+  "version": "$version",
+  "desktopSrcHash": "$desktop_src_hash",
+  "desktopYarnHash": "$desktop_yarn_hash",
+  "webHash": "$web_hash"
+}
+EOF
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@ -33,6 +33,7 @@
 , nspr
 , nss
 , pango
+, pipewire
 , systemd
 , xdg-utils
 , xorg
@ -119,6 +120,7 @@ let
      nspr
      nss
      pango
+      pipewire
      stdenv.cc.cc
      systemd
      xorg.libX11
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@ -1,6 +1,7 @@
 {
  "version": "14.3.3",
  "repo_hash": "1sh8lf6arqljzc0hmajl2r2j38ahk9hl6kikg9inw72xycrll7dk",
+  "yarn_hash": "0b6brkxg93gv4gjp1f7qlx7v7q7mb8z9vikcz98igdnhm46nl4dn",
  "owner": "gitlab-org",
  "repo": "gitlab",
  "rev": "v14.3.3-ee",
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@ -1,7 +1,7 @@
 { stdenv, lib, fetchurl, fetchpatch, fetchFromGitLab, bundlerEnv
 , ruby, tzdata, git, nettools, nixosTests, nodejs, openssl
 , gitlabEnterprise ? false, callPackage, yarn
-, fixup_yarn_lock, replace, file, cacert
+, fixup_yarn_lock, replace, file, cacert, fetchYarnDeps
 }:

 let
@ -45,7 +45,10 @@ let
    ignoreCollisions = true;
  };

-  yarnOfflineCache = (callPackage ./yarnPkgs.nix {}).offline_cache;
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = src + "/yarn.lock";
+    sha256 = data.yarn_hash;
+  };

  assets = stdenv.mkDerivation {
    pname = "gitlab-assets";
--- a/pkgs/applications/version-management/gitlab/update.py
+++ b/pkgs/applications/version-management/gitlab/update.py
@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#! nix-shell -i python3 -p bundix bundler nix-update nix nix-universal-prefetch python3 python3Packages.requests python3Packages.click python3Packages.click-log yarn2nix
+#! nix-shell -I nixpkgs=../../../.. -i python3 -p bundix bundler nix-update nix nix-universal-prefetch python3 python3Packages.requests python3Packages.click python3Packages.click-log prefetch-yarn-deps

 import click
 import click_log
@ -9,6 +9,7 @@ import logging
 import subprocess
 import json
 import pathlib
+import tempfile
 from distutils.version import LooseVersion
 from typing import Iterable

@ -42,6 +43,12 @@ class GitLabRepo:
    def get_git_hash(self, rev: str):
        return subprocess.check_output(['nix-universal-prefetch', 'fetchFromGitLab', '--owner', self.owner, '--repo', self.repo, '--rev', rev]).decode('utf-8').strip()

+    def get_yarn_hash(self, rev: str):
+        with tempfile.TemporaryDirectory() as tmp_dir:
+            with open(tmp_dir + '/yarn.lock', 'w') as f:
+                f.write(self.get_file('yarn.lock', rev))
+            return subprocess.check_output(['prefetch-yarn-deps', tmp_dir + '/yarn.lock']).decode('utf-8').strip()
+
    @staticmethod
    def rev2version(tag: str) -> str:
        """
@ -74,6 +81,7 @@ class GitLabRepo:

        return dict(version=self.rev2version(rev),
                    repo_hash=self.get_git_hash(rev),
+                    yarn_hash=self.get_yarn_hash(rev),
                    owner=self.owner,
                    repo=self.repo,
                    rev=rev,
@ -142,26 +150,6 @@ def update_rubyenv():
    subprocess.check_output(['bundix'], cwd=rubyenv_dir)


-@cli.command('update-yarnpkgs')
-def update_yarnpkgs():
-    """Update yarnPkgs"""
-
-    repo = GitLabRepo()
-    yarnpkgs_dir = pathlib.Path(__file__).parent
-
-    # load rev from data.json
-    data = _get_data_json()
-    rev = data['rev']
-
-    with open(yarnpkgs_dir / 'yarn.lock', 'w') as f:
-        f.write(repo.get_file('yarn.lock', rev))
-
-    with open(yarnpkgs_dir / 'yarnPkgs.nix', 'w') as f:
-        subprocess.run(['yarn2nix'], cwd=yarnpkgs_dir, check=True, stdout=f)
-
-    os.unlink(yarnpkgs_dir / 'yarn.lock')
-
-
@cli.command('update-gitaly')
 def update_gitaly():
    """Update gitaly"""
@ -203,7 +191,6 @@ def update_all(ctx, rev: str):
    """Update all gitlab components to the latest stable release"""
    ctx.invoke(update_data, rev=rev)
    ctx.invoke(update_rubyenv)
-    ctx.invoke(update_yarnpkgs)
    ctx.invoke(update_gitaly)
    ctx.invoke(update_gitlab_shell)
    ctx.invoke(update_gitlab_workhorse)
--- a/pkgs/applications/version-management/gitlab/yarnPkgs.nix
+++ b/pkgs/applications/version-management/gitlab/yarnPkgs.nix
--- a/pkgs/applications/window-managers/sway/default.nix
+++ b/pkgs/applications/window-managers/sway/default.nix
@ -6,6 +6,8 @@
 , nixosTests
 # Used by the NixOS module:
 , isNixOS ? false
+
+, enableXWayland ? true
 }:

 stdenv.mkDerivation rec {
@ -40,13 +42,16 @@ stdenv.mkDerivation rec {
  buildInputs = [
    wayland libxkbcommon pcre json_c dbus libevdev
    pango cairo libinput libcap pam gdk-pixbuf librsvg
-    wlroots wayland-protocols libdrm
+    wayland-protocols libdrm
+    (wlroots.override { inherit enableXWayland; })
  ];

  mesonFlags = [
    "-Ddefault-wallpaper=false"
    "-Dsd-bus-provider=libsystemd"
-  ];
+  ]
+    ++ lib.optional (!enableXWayland) "-Dxwayland=disabled"
+  ;

  passthru.tests.basic = nixosTests.sway;

--- a/pkgs/applications/window-managers/sway/wrapper.nix
+++ b/pkgs/applications/window-managers/sway/wrapper.nix
@ -6,6 +6,8 @@
 , extraOptions ? [] # E.g.: [ "--verbose" ]
 # Used by the NixOS module:
 , isNixOS ? false
+
+, enableXWayland ? true
 }:

 assert extraSessionCommands != "" -> withBaseWrapper;
@ -13,7 +15,7 @@ assert extraSessionCommands != "" -> withBaseWrapper;
 with lib;

 let
-  sway = sway-unwrapped.override { inherit isNixOS; };
+  sway = sway-unwrapped.override { inherit isNixOS enableXWayland; };
  baseWrapper = writeShellScriptBin "sway" ''
     set -o errexit
     if [ ! "$_SWAY_WRAPPER_ALREADY_EXECUTED" ]; then
--- a/pkgs/build-support/node/fetch-yarn-deps/default.nix
+++ b/pkgs/build-support/node/fetch-yarn-deps/default.nix
@ -0,0 +1,74 @@
+{ stdenv, lib, makeWrapper, coreutils, nix-prefetch-git, fetchurl, nodejs-slim, prefetch-yarn-deps, cacert, callPackage }:
+
+let
+  yarnpkg-lockfile-tar = fetchurl {
+    url = "https://registry.yarnpkg.com/@yarnpkg/lockfile/-/lockfile-1.1.0.tgz";
+    sha512 = "sha512-GpSwvyXOcOOlV70vbnzjj4fW5xW/FdUF6nQEt1ENy7m4ZCczi1+/buVUPAqmGfqznsORNFzUMjctTIp8a9tuCQ==";
+  };
+
+in {
+  prefetch-yarn-deps = stdenv.mkDerivation {
+    name = "prefetch-yarn-deps";
+
+    dontUnpack = true;
+
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ coreutils nix-prefetch-git nodejs-slim ];
+
+    buildPhase = ''
+      runHook preBuild
+
+      mkdir libexec
+      tar --strip-components=1 -xf ${yarnpkg-lockfile-tar} package/index.js
+      mv index.js libexec/yarnpkg-lockfile.js
+      cp ${./index.js} libexec/index.js
+      patchShebangs libexec/index.js
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/bin
+      cp -r libexec $out
+      makeWrapper $out/libexec/index.js $out/bin/prefetch-yarn-deps \
+        --prefix PATH : ${lib.makeBinPath [ coreutils nix-prefetch-git ]}
+
+      runHook postInstall
+    '';
+  };
+
+  fetchYarnDeps = let
+    f = {
+      name ? "offline",
+      yarnLock,
+      hash ? "",
+      sha256 ? "",
+    }: let
+      hash_ =
+        if hash != "" then { outputHashAlgo = null; outputHash = hash; }
+        else if sha256 != "" then { outputHashAlgo = "sha256"; outputHash = sha256; }
+        else throw "fetchYarnDeps requires a hash";
+    in stdenv.mkDerivation {
+      inherit name;
+
+      dontUnpack = true;
+      dontInstall = true;
+
+      nativeBuildInputs = [ prefetch-yarn-deps ];
+      GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+
+      buildPhase = ''
+        mkdir -p $out
+        (cd $out; prefetch-yarn-deps --verbose --builder ${yarnLock})
+      '';
+
+      outputHashMode = "recursive";
+      inherit (hash_) outputHashAlgo outputHash;
+    };
+
+  in lib.setFunctionArgs f (lib.functionArgs f) // {
+    tests = callPackage ./tests {};
+  };
+}
--- a/pkgs/build-support/node/fetch-yarn-deps/index.js
+++ b/pkgs/build-support/node/fetch-yarn-deps/index.js
@ -0,0 +1,169 @@
+#!/usr/bin/env node
+'use strict'
+
+const fs = require('fs')
+const crypto = require('crypto')
+const process = require('process')
+const https = require('https')
+const child_process = require('child_process')
+const path = require('path')
+const lockfile = require('./yarnpkg-lockfile.js')
+const { promisify } = require('util')
+
+const execFile = promisify(child_process.execFile)
+
+const exec = async (...args) => {
+	const res = await execFile(...args)
+	if (res.error) throw new Error(res.stderr)
+	return res
+}
+
+const downloadFileHttps = (fileName, url, expectedHash) => {
+	return new Promise((resolve, reject) => {
+		https.get(url, (res) => {
+			const file = fs.createWriteStream(fileName)
+			const hash = crypto.createHash('sha1')
+			res.pipe(file)
+			res.pipe(hash).setEncoding('hex')
+			res.on('end', () => {
+				file.close()
+				const h = hash.read()
+				if (h != expectedHash) return reject(new Error(`hash mismatch, expected ${expectedHash}, got ${h}`))
+				resolve()
+			})
+                        res.on('error', e => reject(e))
+		})
+	})
+}
+
+const downloadGit = async (fileName, url, rev) => {
+	await exec('nix-prefetch-git', [
+		'--out', fileName + '.tmp',
+		'--url', url,
+		'--rev', rev,
+		'--builder'
+	])
+
+	await exec('tar', [
+		// hopefully make it reproducible across runs and systems
+		'--owner=0', '--group=0', '--numeric-owner', '--format=gnu', '--sort=name', '--mtime=@1',
+
+		// Set u+w because tar-fs can't unpack archives with read-only dirs: https://github.com/mafintosh/tar-fs/issues/79
+		'--mode', 'u+w',
+
+		'-C', fileName + '.tmp',
+		'-cf', fileName, '.'
+	])
+
+	await exec('rm', [ '-rf', fileName + '.tmp', ])
+}
+
+const downloadPkg = (pkg, verbose) => {
+	const [ url, hash ] = pkg.resolved.split('#')
+	if (verbose) console.log('downloading ' + url)
+	if (url.startsWith('https://codeload.github.com/') && url.includes('/tar.gz/')) {
+		const fileName = path.basename(url)
+		const s = url.split('/')
+		downloadGit(fileName, `https://github.com/${s[3]}/${s[4]}.git`, s[6])
+	} else if (url.startsWith('https://')) {
+		const fileName = url
+			.replace(/https:\/\/(.)*(.com)\//g, '') // prevents having long directory names
+			.replace(/[@/%:-]/g, '_') // replace @ and : and - and % characters with underscore
+
+		return downloadFileHttps(fileName, url, hash)
+	} else if (url.startsWith('git+')) {
+		const fileName = path.basename(url)
+		return downloadGit(fileName, url.replace(/^git\+/, ''), hash)
+	} else {
+		throw new Error('don\'t know how to download "' + url + '"')
+	}
+}
+
+const performParallel = tasks => {
+	const worker = async () => {
+		while (tasks.length > 0) await tasks.shift()()
+	}
+
+	const workers = []
+	for (let i = 0; i < 4; i++) {
+		workers.push(worker())
+	}
+
+	return Promise.all(workers)
+}
+
+const prefetchYarnDeps = async (lockContents, verbose) => {
+	const lockData = lockfile.parse(lockContents)
+	const tasks = Object.values(
+		Object.entries(lockData.object)
+		.map(([key, value]) => {
+			return { key, ...value }
+		})
+		.reduce((out, pkg) => {
+			out[pkg.resolved] = pkg
+			return out
+		}, {})
+	)
+		.map(pkg => () => downloadPkg(pkg, verbose))
+
+	await performParallel(tasks)
+	await fs.promises.writeFile('yarn.lock', lockContents)
+	if (verbose) console.log('Done')
+}
+
+const showUsage = async () => {
+	process.stderr.write(`
+syntax: prefetch-yarn-deps [path to yarn.lock] [options]
+
+Options:
+  -h --help         Show this help
+  -v --verbose      Verbose output
+  --builder         Only perform the download to current directory, then exit
+`)
+	process.exit(1)
+}
+
+const main = async () => {
+	const args = process.argv.slice(2)
+	let next, lockFile, verbose, isBuilder
+	while (next = args.shift()) {
+		if (next == '--builder') {
+			isBuilder = true
+		} else if (next == '--verbose' || next == '-v') {
+			verbose = true
+		} else if (next == '--help' || next == '-h') {
+			showUsage()
+		} else if (!lockFile) {
+			lockFile = next
+		} else {
+			showUsage()
+		}
+	}
+	let lockContents
+	try {
+		lockContents = await fs.promises.readFile(lockFile || 'yarn.lock', 'utf-8')
+	} catch {
+		showUsage()
+	}
+
+	if (isBuilder) {
+		await prefetchYarnDeps(lockContents, verbose)
+	} else {
+		const { stdout: tmpDir } = await exec('mktemp', [ '-d' ])
+
+		try {
+			process.chdir(tmpDir.trim())
+			await prefetchYarnDeps(lockContents, verbose)
+			const { stdout: hash } = await exec('nix-hash', [ '--type', 'sha256', '--base32', tmpDir.trim() ])
+			console.log(hash)
+		} finally {
+			await exec('rm', [ '-rf', tmpDir.trim() ])
+		}
+	}
+}
+
+main()
+	.catch(e => {
+		console.error(e)
+		process.exit(1)
+	})
--- a/pkgs/build-support/node/fetch-yarn-deps/tests/default.nix
+++ b/pkgs/build-support/node/fetch-yarn-deps/tests/default.nix
@ -0,0 +1,16 @@
+{ invalidateFetcherByDrvHash, fetchYarnDeps, ... }:
+
+{
+  simple = invalidateFetcherByDrvHash fetchYarnDeps {
+    yarnLock = ./simple.lock;
+    sha256 = "sha256-Erdkw2E8wWT09jFNLXGkrdwKl0HuSZWnUDJUrV95vSE=";
+  };
+  gitDep = invalidateFetcherByDrvHash fetchYarnDeps {
+    yarnLock = ./git.lock;
+    sha256 = "sha256-lAqN4LpoE+jgsQO1nDtuORwcVEO7ogEV53jCu2jFJUI=";
+  };
+  githubDep = invalidateFetcherByDrvHash fetchYarnDeps {
+    yarnLock = ./github.lock;
+    sha256 = "sha256-Tsfgyjxz8x6gNmfN0xR7G/NQNoEs4svxRN/N+26vfJU=";
+  };
+}
--- a/pkgs/build-support/node/fetch-yarn-deps/tests/git.lock
+++ b/pkgs/build-support/node/fetch-yarn-deps/tests/git.lock
@ -0,0 +1,7 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+"async@git+https://github.com/caolan/async":
+  version "3.2.1"
+  resolved "git+https://github.com/caolan/async#fc9ba651341af5ab974aade6b1640e345912be83"
--- a/pkgs/build-support/node/fetch-yarn-deps/tests/github.lock
+++ b/pkgs/build-support/node/fetch-yarn-deps/tests/github.lock
@ -0,0 +1,7 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+"async@github:caolan/async":
+  version "3.2.1"
+  resolved "https://codeload.github.com/caolan/async/tar.gz/fc9ba651341af5ab974aade6b1640e345912be83"
--- a/pkgs/build-support/node/fetch-yarn-deps/tests/simple.lock
+++ b/pkgs/build-support/node/fetch-yarn-deps/tests/simple.lock
@ -0,0 +1,8 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+lit-html@1:
+  version "1.4.1"
+  resolved "https://registry.yarnpkg.com/lit-html/-/lit-html-1.4.1.tgz#0c6f3ee4ad4eb610a49831787f0478ad8e9ae5e0"
+  integrity sha512-B9btcSgPYb1q4oSOb/PrOT6Z/H+r6xuNzfH4lFli/AWhYwdtrgQkQWBbIc6mdnf6E2IL3gDXdkkqNktpU0OZQA==
--- a/pkgs/development/compilers/graalvm/community-edition/default.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/default.nix
@ -1,21 +1,18 @@
-{ callPackage, Foundation }:
+{ lib, callPackage, Foundation }:

 let
-  mkGraal = opts: callPackage (import ./repository.nix opts) {
+  mkGraal = opts: callPackage (import ./mkGraal.nix opts) {
    inherit Foundation;
  };
-in {
+in
+{
  inherit mkGraal;

-  graalvm8-ce = mkGraal rec {
-    version = "21.2.0";
-    javaVersion = "8";
-    platforms = ["x86_64-linux"];
+  graalvm11-ce = mkGraal rec {
+    version = lib.fileContents ./version;
+    javaVersion = "11";
+    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
  };

-  graalvm11-ce = mkGraal rec {
-    version = "21.2.0";
-    javaVersion = "11";
-    platforms = ["x86_64-linux" "aarch64-linux" "x86_64-darwin"];
-  };
+  # TODO: added graalvm17-ce
 }
--- a/pkgs/development/compilers/graalvm/community-edition/hashes.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/hashes.nix
@ -0,0 +1,43 @@
+# Generated by ./update.sh script
+{ javaVersionPlatform, ... }:
+[
+  {
+    sha256 = {
+      "11-linux-aarch64" = "0hsjxp6ly7jsn9k94fddcl7afc5gda66jyppcnfvslishbizqd0i";
+      "11-linux-amd64" = "1ylk5l933z813k0k1xlayiv8fa0f1gmpr66bma51532iy3mch6rs";
+      "11-darwin-amd64" = "0qpqnnmqxvxzj3mwz05acpg4n8ffqsz0sji8lbl03fgswpvgfavc";
+    }.${javaVersionPlatform} or null;
+    url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-21.3.0/graalvm-ce-java${javaVersionPlatform}-21.3.0.tar.gz";
+  }
+  {
+    sha256 = {
+      "11-linux-aarch64" = "0qlmg5fwvqsb5ab3irj2hrcd5jc94mibnlz1gvzpnq85rw1zcb6h";
+      "11-linux-amd64" = "0kvnjr55rizy53vn0ff9w27z1qh9d1vp3s7r1kdl0wyhrbhd8n49";
+      "11-darwin-amd64" = "1mg8c8hh8wmbwsisgarmp35jd0dall1fwdv49mggp74hicbc32h3";
+    }.${javaVersionPlatform} or null;
+    url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-21.3.0/native-image-installable-svm-java${javaVersionPlatform}-21.3.0.jar";
+  }
+  {
+    sha256 = {
+      "11-linux-aarch64" = "02rvwl1nng8d3qn226rjx5yq2blxs4yz009ab928qanhmb4vhv8b";
+      "11-linux-amd64" = "0zz62zr7imjaw9a3j5m66xs7c72cqb1i74ab3rnlh0dgs1mdpljg";
+      "11-darwin-amd64" = "1wiv0299b2xrc229alczmjfj1bsn90p0wdm64rr39xnyyhbqrr80";
+    }.${javaVersionPlatform} or null;
+    url = "https://github.com/oracle/truffleruby/releases/download/vm-21.3.0/ruby-installable-svm-java${javaVersionPlatform}-21.3.0.jar";
+  }
+  {
+    sha256 = {
+      "11-linux-aarch64" = "1ck4c1z98h1zn4i6xhh1hb6w2jab6n17ddykb72xxw4vig9nhlc7";
+      "11-linux-amd64" = "0gy8jj9d9msmj0i44sysiwq3j2k2w2g47fhq6y1aq47n3kmwj9kv";
+      "11-darwin-amd64" = "0agw6k3jn2jh8wyc9h8rvzlgs96qh4nlj0y8nyzsmidvwq2ahl00";
+    }.${javaVersionPlatform} or null;
+    url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-21.3.0/wasm-installable-svm-java${javaVersionPlatform}-21.3.0.jar";
+  }
+  {
+    sha256 = {
+      "11-linux-amd64" = "1l5av2v459q88zfl83877h7b3426z3d86kp6wqjvz2441brvidi0";
+      "11-darwin-amd64" = "06694n74dzsfwlli1sjdsrfbj9ngw7bhrcayvy4sgy2va5qpdjs0";
+    }.${javaVersionPlatform} or null;
+    url = "https://github.com/graalvm/graalpython/releases/download/vm-21.3.0/python-installable-svm-java${javaVersionPlatform}-21.3.0.jar";
+  }
+]
--- a/pkgs/development/compilers/graalvm/community-edition/repository.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/repository.nix
@ -24,55 +24,20 @@ let
  javaVersionPlatform = "${javaVersion}-${platform}";

  graalvmXXX-ce = stdenv.mkDerivation rec {
+    inherit version;
    name = "graalvm${javaVersion}-ce";
-    srcs = [
-      (fetchurl {
-        sha256 = {
-          "8-linux-amd64" = "01gyxjmfp7wpcyn7x8b184fn0lp3xryfw619bqch120pzvr6z88f";
-          "11-linux-aarch64" = "sha256-u9841eaHH347JHCrm5u3YGZ9RSTuKiDq368TY2otAYw=";
-          "11-linux-amd64" = "0w7lhvxm4nggqdcl4xrhdd3y6dqw9jhyca9adjkp508n4lqf1lxv";
-          "11-darwin-amd64" = "0dnahicdl0vhrbiml9z9nbb7k75hbsjj8rs246i1lwril12dqb7n";
-        }.${javaVersionPlatform};
-        url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${version}/graalvm-ce-java${javaVersionPlatform}-${version}.tar.gz";
-      })
-      (fetchurl {
-        sha256 = {
-          "8-linux-amd64" = "1jlvrxdlbsmlk3ia43h9m29kmmdn83h6zdlnf8qb7bm38c84nhsc";
-          "11-linux-aarch64" = "sha256-7W5gkhj2kON2ocrGpyH/OL/phOyHkjNDId2CtyUAEWY=";
-          "11-linux-amd64" = "1ybd7a6ii6582skr0nkxx7bccsa7gkg0yriql2h1lcz0rfzcdi3g";
-          "11-darwin-amd64" = "1jdy845vanmz05zx5b9227gb1msh9wdrz2kf3fx9z54ssd9qgdhm";
-        }.${javaVersionPlatform};
-        url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${version}/native-image-installable-svm-java${javaVersionPlatform}-${version}.jar";
-      })
-      (fetchurl {
-        sha256 = {
-          "8-linux-amd64" = "18ip0ay06q1pryqs8ja988mvk9vw475c0nfjcznnsd1zp296p6jc";
-          "11-linux-aarch64" = "sha256-i9ysgqbI52PiXofZQ5AnPSzs2TeR8An5CIYzcwhx28o=";
-          "11-linux-amd64" = "1jszz97mkqavxzyhx5jxhi43kqjxk9c36j5l5hy3kn8sdfmbplm4";
-          "11-darwin-amd64" = "1767ryhv2cn5anlys63ysax1p8ag79bykac1xfrjfan8yv6d8ybl";
-        }.${javaVersionPlatform};
-        url = "https://github.com/oracle/truffleruby/releases/download/vm-${version}/ruby-installable-svm-java${javaVersionPlatform}-${version}.jar";
-      })
-      (fetchurl {
-        sha256 = {
-          "8-linux-amd64" = "08s36rjy5irg25b7lqx0m4v2wpywin3cqyhdrywhvq14f7zshsd5";
-          "11-linux-aarch64" = "sha256-Lkc/mq1w18+PQ5McvLGyQBSOz/TMSUgwioRZ0Dtyhm4=";
-          "11-linux-amd64" = "1ybjaknmbsdg8qzb986x39fq0h7fyiymdcigc7y86swk8dd916hv";
-          "11-darwin-amd64" = "02dwlb62kqr4rjjmvkhn2xk9l1p47ahg9xyyfkw7im1jwlqmqnzf";
-        }.${javaVersionPlatform};
-        url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${version}/wasm-installable-svm-java${javaVersionPlatform}-${version}.jar";
-      })
-    ] ++ lib.optionals (platform == "amd64") [
-      # graalpython is not available on aarch64 platforms yet
-      (fetchurl {
-        sha256 = {
-          "8-linux-amd64" = "0il15438qnikqsxdsl7fcdg0c8zs3cbm4ry7pys7fxxr1ckd8szq";
-          "11-linux-amd64" = "07759sr8nijvqm8aqn69x9vq7lyppns7a6l6xribv43jvfmwpfkl";
-          "11-darwin-amd64" = "01l3as8dihc7xqy5sdkrpxmpzrqbcvvg84m2s6j1j8y2db1khf2s";
-        }.${javaVersionPlatform};
-        url = "https://github.com/graalvm/graalpython/releases/download/vm-${version}/python-installable-svm-java${javaVersionPlatform}-${version}.jar";
-      })
-    ];
+    srcs =
+      let
+        # Some platforms doesn't have all GraalVM features
+        # e.g.: GraalPython on aarch64-linux
+        # When the platform doesn't have a feature, sha256 is null on hashes.nix
+        # To update hashes.nix file, run `./update.sh <graalvm-ce-version>`
+        maybeFetchUrl = url: if url.sha256 != null then (fetchurl url) else null;
+      in
+      (lib.remove null
+        (map
+          maybeFetchUrl
+          (import ./hashes.nix { inherit javaVersionPlatform; })));

    buildInputs = lib.optionals stdenv.isLinux [
      alsa-lib # libasound.so wanted by lib/libjsound.so
@ -168,16 +133,6 @@ let
        done
      '';
    in {
-      "8-linux-amd64" = ''
-        ${nativePRNGWorkaround "$out/jre/lib/security/java.security"}
-
-        ${copyClibrariesToOut "$out/jre/lib/svm/clibraries"}
-
-        ${copyClibrariesToLib}
-
-        # allow using external truffle-api.jar and languages not included in the distrubution
-        rm $out/jre/lib/jvmci/parentClassLoader.classpath
-      '';
      "11-linux-amd64" = ''
        ${nativePRNGWorkaround "$out/conf/security/java.security"}

@ -265,37 +220,47 @@ let
        ''
      }

-      ${
-        lib.optionalString (platform == "amd64") ''
-          echo "Testing interpreted languages"
-          $out/bin/graalpython -c 'print(1 + 1)'
-          $out/bin/ruby -e 'puts(1 + 1)'
+      ${# TODO: Doesn't work on MacOS, we have this error:
+        # "Launching JShell execution engine threw: Operation not permitted (Bind failed)"
+        lib.optionalString (stdenv.isLinux) ''
+          echo "Testing Jshell"
+          echo '1 + 1' | $out/bin/jshell
+        ''
+      }

+      ${
+        lib.optionalString (platform != "linux-aarch64") ''
+          echo "Testing GraalPython"
+          $out/bin/graalpython -c 'print(1 + 1)'
          echo '1 + 1' | $out/bin/graalpython
        ''
      }

+      echo "Testing TruffleRuby"
+      $out/bin/ruby -e 'puts(1 + 1)'
+
      ${# TODO: `irb` on MacOS gives an error saying "Could not find OpenSSL
        # headers, install via Homebrew or MacPorts or set OPENSSL_PREFIX", even
        # though `openssl` is in `propagatedBuildInputs`. For more details see:
        # https://github.com/NixOS/nixpkgs/pull/105815
        # TODO: "truffleruby: an internal exception escaped out of the interpreter"
        # error on linux-aarch64
-        lib.optionalString (platform == "linux-amd64") ''
+        # TODO: "core/kernel.rb:234:in `gem_original_require':
+        # /nix/store/wlc5xalzj2ip1l83siqw8ac5fjd52ngm-graalvm11-ce/languages/llvm/native/lib:
+        # cannot read file data: Is a directory (RuntimeError)" error on linux-amd64
+        lib.optionalString false ''
          echo '1 + 1' | $out/bin/irb
        ''
      }
+      '';

-      ${# TODO: Doesn't work on MacOS, we have this error:
-        # "Launching JShell execution engine threw: Operation not permitted (Bind failed)"
-        lib.optionalString (javaVersion == "11" && stdenv.isLinux) ''
-          echo '1 + 1' | $out/bin/jshell
-        ''
-      }'';
-
-    passthru.home = graalvmXXX-ce;
+    passthru = {
+      home = graalvmXXX-ce;
+      updateScript = ./update.sh;
+    };

    meta = with lib; {
+      inherit platforms;
      homepage = "https://www.graalvm.org/";
      description = "High-Performance Polyglot VM";
      license = with licenses; [ upl gpl2Classpath bsd3 ];
@ -308,7 +273,6 @@ let
        ericdallo
        thiagokokada
      ];
-      platforms = platforms;
    };
  };
 in graalvmXXX-ce
--- a/pkgs/development/compilers/graalvm/community-edition/update.sh
+++ b/pkgs/development/compilers/graalvm/community-edition/update.sh
@ -0,0 +1,72 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -p curl -i bash coreutils nix common-updater-scripts curl jq
+
+set -eou pipefail
+
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+info() { echo "[INFO] $*"; }
+
+echo_file() { echo "$@" >> hashes.nix; }
+
+verlte() {
+    [  "$1" = "$(echo -e "$1\n$2" | sort -V | head -n1)" ]
+}
+
+readonly old_version="$(cat version)"
+
+if [[ -z "${1:-}" ]]; then
+  readonly gh_version="$(curl -s https://api.github.com/repos/graalvm/graalvm-ce-builds/releases/latest | jq --raw-output .tag_name)"
+  readonly new_version="${gh_version//vm-/}"
+else
+  readonly new_version="$1"
+fi
+
+if verlte "$new_version" "$old_version"; then
+  info "graalvm-ce $old_version is up-to-date. Exiting..."
+  exit 0
+else
+  info "graalvm-ce $old_version is out-of-date. Updating..."
+fi
+
+readonly urls=(
+  "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/graalvm-ce-java@platform@-${new_version}.tar.gz"
+  "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/native-image-installable-svm-java@platform@-${new_version}.jar"
+  "https://github.com/oracle/truffleruby/releases/download/vm-${new_version}/ruby-installable-svm-java@platform@-${new_version}.jar"
+  "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/wasm-installable-svm-java@platform@-${new_version}.jar"
+  "https://github.com/graalvm/graalpython/releases/download/vm-${new_version}/python-installable-svm-java@platform@-${new_version}.jar"
+)
+
+readonly platforms=(
+  "11-linux-aarch64"
+  "11-linux-amd64"
+  "11-darwin-amd64"
+)
+
+info "Deleting old hashes.nix file..."
+rm -f hashes.nix
+info "Generating hashes.nix file for 'graalvm-ce' $new_version. This will take a while..."
+
+echo_file "# Generated by $0 script"
+echo_file "{ javaVersionPlatform, ... }:"
+echo_file "["
+
+for url in "${urls[@]}"; do
+  echo_file "  {"
+  echo_file "    sha256 = {"
+  for platform in "${platforms[@]}"; do
+    if hash="$(nix-prefetch-url "${url//@platform@/$platform}")"; then
+      echo_file "      \"$platform\" = \"$hash\";"
+    fi
+  done
+  echo_file '    }.${javaVersionPlatform} or null;'
+  echo_file "    url = \"${url//@platform@/\$\{javaVersionPlatform\}}\";"
+  echo_file "  }"
+done
+
+echo_file "]"
+
+info "Updating 'version' file..."
+echo "$new_version" > version
+
+info "Done!"
--- a/pkgs/development/compilers/graalvm/community-edition/version
+++ b/pkgs/development/compilers/graalvm/community-edition/version
@ -0,0 +1 @@
+21.3.0
--- a/pkgs/development/libraries/aws-sdk-cpp/default.nix
+++ b/pkgs/development/libraries/aws-sdk-cpp/default.nix
@ -42,7 +42,6 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ cmake curl ];

  buildInputs = [
-    aws-crt-cpp
    curl openssl zlib
  ] ++ lib.optionals (stdenv.isDarwin &&
                        ((builtins.elem "text-to-speech" apis) ||
@ -50,14 +49,7 @@ stdenv.mkDerivation rec {
         [ CoreAudio AudioToolbox ];

  # propagation is needed for Security.framework to be available when linking
-  propagatedBuildInputs = [
-    aws-c-cal
-    aws-c-event-stream
-    aws-c-io
-    aws-c-common
-    aws-checksums
-    s2n-tls
-  ];
+  propagatedBuildInputs = [ aws-crt-cpp ];

  cmakeFlags = [
    "-DBUILD_DEPS=OFF"
--- a/pkgs/development/libraries/vapoursynth/default.nix
+++ b/pkgs/development/libraries/vapoursynth/default.nix
@ -2,21 +2,19 @@
 , runCommandCC, runCommand, vapoursynth, writeText, patchelf, buildEnv
 , zimg, libass, python3, libiconv
 , ApplicationServices
-, ocrSupport ? false, tesseract
-, imwriSupport ? true, imagemagick
 }:

 with lib;

 stdenv.mkDerivation rec {
  pname = "vapoursynth";
-  version = "R55";
+  version = "R57";

  src = fetchFromGitHub {
    owner  = "vapoursynth";
    repo   = "vapoursynth";
    rev    = version;
-    sha256 = "sha256-91lPknNX3NM3NraIcPAR478paPoYvgjgCOIcdgaR5nE=";
+    sha256 = "sha256-tPQ1SOIpFevOYzL9a8Lc5+dv2egVX1CY3km8yWVv+Sk=";
  };

  patches = [
@ -27,14 +25,7 @@ stdenv.mkDerivation rec {
  buildInputs = [
    zimg libass
    (python3.withPackages (ps: with ps; [ sphinx cython ]))
-  ] ++ optionals stdenv.isDarwin [ libiconv ApplicationServices ]
-    ++ optional ocrSupport   tesseract
-    ++ optional imwriSupport imagemagick;
-
-  configureFlags = [
-    (optionalString (!ocrSupport)   "--disable-ocr")
-    (optionalString (!imwriSupport) "--disable-imwri")
-  ];
+  ] ++ optionals stdenv.isDarwin [ libiconv ApplicationServices ];

  enableParallelBuilding = true;

@ -54,6 +45,10 @@ stdenv.mkDerivation rec {
  postInstall = ''
    wrapProgram $out/bin/vspipe \
        --prefix PYTHONPATH : $out/${python3.sitePackages}
+
+    # VapourSynth does not include any plugins by default
+    # and emits a warning when the system plugin directory does not exist.
+    mkdir $out/lib/vapoursynth
  '';

  meta = with lib; {
--- a/pkgs/development/libraries/vapoursynth/editor.nix
+++ b/pkgs/development/libraries/vapoursynth/editor.nix
@ -1,4 +1,4 @@
-{ lib, mkDerivation, fetchFromBitbucket, makeWrapper, runCommand
+{ lib, mkDerivation, fetchFromGitHub, makeWrapper, runCommand
 , python3, vapoursynth
 , qmake, qtbase, qtwebsockets
 }:
@ -6,13 +6,13 @@
 let
  unwrapped = mkDerivation rec {
    pname = "vapoursynth-editor";
-    version = "R19";
+    version = "R19-mod-4";

-    src = fetchFromBitbucket {
-      owner = "mystery_keeper";
+    src = fetchFromGitHub {
+      owner = "YomikoR";
      repo = pname;
      rev = lib.toLower version;
-      sha256 = "1zlaynkkvizf128ln50yvzz3b764f5a0yryp6993s9fkwa7djb6n";
+      sha256 = "sha256-+/9j9DJDGXbuTvE8ZXIu6wjcof39SyatS36Q6y9hLPg=";
    };

    nativeBuildInputs = [ qmake ];
@ -35,7 +35,7 @@ let

    meta = with lib; {
      description = "Cross-platform editor for VapourSynth scripts";
-      homepage = "https://bitbucket.org/mystery_keeper/vapoursynth-editor";
+      homepage = "https://github.com/YomikoR/VapourSynth-Editor";
      license = licenses.mit;
      maintainers = with maintainers; [ tadeokondrak ];
      platforms = platforms.all;
--- a/pkgs/development/libraries/wlroots/default.nix
+++ b/pkgs/development/libraries/wlroots/default.nix
@ -1,7 +1,9 @@
 { lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config, wayland-scanner
 , libGL, wayland, wayland-protocols, libinput, libxkbcommon, pixman
 , xcbutilwm, libX11, libcap, xcbutilimage, xcbutilerrors, mesa
-, libpng, ffmpeg, xcbutilrenderutil, xwayland, seatd
+, libpng, ffmpeg, xcbutilrenderutil, seatd
+
+, enableXWayland ? true, xwayland ? null
 }:

 stdenv.mkDerivation rec {
@ -25,8 +27,14 @@ stdenv.mkDerivation rec {
  buildInputs = [
    libGL wayland wayland-protocols libinput libxkbcommon pixman
    xcbutilwm libX11 libcap xcbutilimage xcbutilerrors mesa
-    libpng ffmpeg xcbutilrenderutil xwayland seatd
-  ];
+    libpng ffmpeg xcbutilrenderutil seatd
+  ]
+    ++ lib.optional enableXWayland xwayland
+  ;
+
+  mesonFlags =
+    lib.optional (!enableXWayland) "-Dxwayland=disabled"
+  ;

  postFixup = ''
    # Install ALL example programs to $examples:
--- a/pkgs/development/ocaml-modules/menhir/lib.nix
+++ b/pkgs/development/ocaml-modules/menhir/lib.nix
@ -2,14 +2,14 @@

 buildDunePackage rec {
  pname = "menhirLib";
-  version = "20210419";
+  version = "20211012";

  src = fetchFromGitLab {
    domain = "gitlab.inria.fr";
    owner = "fpottier";
    repo = "menhir";
    rev = version;
-    sha256 = "0jcbr7s3iwfr7xxfybs3h407g76yfp5yq5r9i0wg2ahvvbqh03ky";
+    sha256 = "08kf5apbv15n2kcr3qhyr3rvsf2lg25ackr3x9kfgiiqc0p3sz40";
  };

  useDune2 = true;
--- a/pkgs/development/ocaml-modules/sawja/default.nix
+++ b/pkgs/development/ocaml-modules/sawja/default.nix
@ -1,8 +1,8 @@
-{ lib, stdenv, fetchFromGitHub, which, perl, ocaml, findlib, javalib }:
+{ lib, stdenv, fetchFromGitHub, which, ocaml, findlib, javalib }:

 let
  pname = "sawja";
-  version = "1.5.8";
+  version = "1.5.10";
  webpage = "http://sawja.inria.fr/";
 in

@ -12,16 +12,20 @@ else

 stdenv.mkDerivation {

-  name = "ocaml${ocaml.version}-${pname}-${version}";
+  pname = "ocaml${ocaml.version}-${pname}";
+
+  inherit version;

  src = fetchFromGitHub {
    owner = "javalib-team";
    repo = pname;
-    rev = "v${version}";
-    sha256 = "0rawr0jav33rvagm8sxc0arc7ya1fd9w5nng3lhfk8p02f9z8wrp";
+    rev = version;
+    sha256 = "sha256:0k51rscs9mdgpg3qn4cahql5ncdvlb207m015hr8v6r1vfgn0ddq";
  };

-  buildInputs = [ which perl ocaml findlib ];
+  nativeBuildInputs = [ which ];
+
+  buildInputs = [ ocaml findlib ];

  patches = [ ./configure.sh.patch ./Makefile.config.example.patch ];

--- a/pkgs/development/python-modules/faraday-agent-parameters-types/default.nix
+++ b/pkgs/development/python-modules/faraday-agent-parameters-types/default.nix
@ -7,12 +7,12 @@

 buildPythonPackage rec {
  pname = "faraday-agent-parameters-types";
-  version = "1.0.1";
+  version = "1.0.2";

  src = fetchPypi {
    pname = "faraday_agent_parameters_types";
    inherit version;
-    sha256 = "0q2cngxgkvl74mhkibvdsvjjrdfd7flxd6a4776wmxkkn0brzw66";
+    sha256 = "sha256-zH/ZkqL+kL3J1o7dhB4WYy2tbofFZm+kxEGn5+nRgjc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/faraday-plugins/default.nix
+++ b/pkgs/development/python-modules/faraday-plugins/default.nix
@ -16,13 +16,13 @@

 buildPythonPackage rec {
  pname = "faraday-plugins";
-  version = "1.5.3";
+  version = "1.5.4";

  src = fetchFromGitHub {
    owner = "infobyte";
    repo = "faraday_plugins";
    rev = "v${version}";
-    sha256 = "0nyywpsyw7akwdah75s9mz5nz11y1hbynp08pvqifwdw49crih02";
+    sha256 = "sha256-TKT++56pc1+nZXkqMgIq5DFgF9H1+Q5Fuj4KidCdRh0=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/flux-led/default.nix
+++ b/pkgs/development/python-modules/flux-led/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "flux_led";
-  version = "0.24.9";
+  version = "0.24.12";

  disabled = pythonOlder "3.7";

@ -16,7 +16,7 @@ buildPythonPackage rec {
    owner = "Danielhiversen";
    repo = "flux_led";
    rev = version;
-    sha256 = "sha256-U2Z7fsXO5Wb4WmcOOXm+6zmk+7pLcUxz/a5/QtWwC2Y=";
+    sha256 = "sha256-vhmqfHAqbgDUvbn+dR7TuA5SFjF72/nhCL1h+GPy+9c=";
  };

  propagatedBuildInputs = [
@ -27,6 +27,11 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace '"pytest-runner>=5.2",' ""
+  '';
+
  pytestFlagsArray = [
    "tests.py"
  ];
--- a/pkgs/development/python-modules/ismartgate/default.nix
+++ b/pkgs/development/python-modules/ismartgate/default.nix
@ -17,14 +17,14 @@

 buildPythonPackage rec {
  pname = "ismartgate";
-  version = "4.0.1";
+  version = "4.0.3";
  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "bdraco";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1kxlcjnppsk8m93gfcpy3asig1frhp1k5rfqx3rszhkcxmni95m2";
+    sha256 = "sha256-s9fHvjqPHDKuT/DMGu1ETuPNlFIkp0wlv15KeTb6fX8=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/mypy-boto3-s3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3-s3/default.nix
@ -8,12 +8,12 @@

 buildPythonPackage rec {
  pname = "mypy-boto3-s3";
-  version = "1.18.64";
+  version = "1.18.65";
  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "c1640be24881b174b318888d6a0bfc7fc25d51ec9b263c60c6c5bac1e3295b70";
+    sha256 = "c5bdd595e088512df229863872fb91e825ab59ddd89653db5ccc37d666fa01d8";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/plaid-python/default.nix
+++ b/pkgs/development/python-modules/plaid-python/default.nix
@ -8,11 +8,11 @@

 buildPythonPackage rec {
  pname = "plaid-python";
-  version = "8.3.0";
+  version = "8.4.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "13gj4xb0lx2dgdkcdp7fvvql3vjr572qpa1m993z3p7n5c27j5xi";
+    sha256 = "6cad1e1b3cdb007bd913fcdec283c1523fc8995d70343b26be5cfb7ceaafd5f2";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pycares/default.nix
+++ b/pkgs/development/python-modules/pycares/default.nix
@ -8,11 +8,11 @@

 buildPythonPackage rec {
  pname = "pycares";
-  version = "4.0.0";
+  version = "4.1.2";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-0BVPxXU7CIdY++ybwTfhsku4T8DGoJclyLrCWjQjEc0=";
+    sha256 = "sha256-A0kL4Oe1GgyAc/h3vsNH7/MQA/ZPV9lRjUGdk2lFKDc=";
  };

  buildInputs = [
--- a/pkgs/development/python-modules/pydal/default.nix
+++ b/pkgs/development/python-modules/pydal/default.nix
@ -0,0 +1,42 @@
+{ buildPythonPackage
+, fetchPypi
+, python
+, lib
+}:
+
+buildPythonPackage rec {
+  pname = "pydal";
+  version = "20210626.3";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "043s52b7srqwwmj7rh783arqryilmv3m8dmmg9bn5sjgfi004jn4";
+  };
+
+  postPatch = ''
+    # this test has issues with an import statement
+    # rm tests/tags.py
+    sed -i '/from .tags import/d' tests/__init__.py
+
+    # this assertion errors without obvious reason
+    sed -i '/self.assertEqual(csv0, str(r4))/d' tests/caching.py
+
+    # some sql tests fail against sqlite engine
+    sed -i '/from .sql import/d' tests/__init__.py
+  '';
+
+  pythonImportsCheck = [ "pydal" ];
+
+  checkPhase = ''
+    runHook preCheck
+    ${python.interpreter} -m unittest tests
+    runHook postCheck
+  '';
+
+  meta = {
+    description = "A pure Python Database Abstraction Layer";
+    homepage = "https://github.com/web2py/pydal";
+    license = with lib.licenses; [ bsd3 ] ;
+    maintainers = with lib.maintainers; [ wamserma ];
+  };
+}
--- a/pkgs/development/python-modules/pyspnego/default.nix
+++ b/pkgs/development/python-modules/pyspnego/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "pyspnego";
-  version = "0.2.0";
+  version = "0.3.0";

  disabled = pythonOlder "3.7";

@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "jborean93";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-puv9aq53NbjSuN561XFou404N9pIxvvMjZMgnNx3SjM=";
+    sha256 = "sha256-jBwLll3Qtw+CGZQ5QFosZfMGFzjm1Y0rsGx3POFUds8=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/python-crontab/default.nix
+++ b/pkgs/development/python-modules/python-crontab/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "python-crontab";
-  version = "2.5.1";
+  version = "2.6.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "4bbe7e720753a132ca4ca9d4094915f40e9d9dc8a807a4564007651018ce8c31";
+    sha256 = "1e35ed7a3cdc3100545b43e196d34754e6551e7f95e4caebbe0e1c0ca41c2f1b";
  };

  checkInputs = [ pytestCheckHook ];
--- a/pkgs/development/python-modules/pywizlight/default.nix
+++ b/pkgs/development/python-modules/pywizlight/default.nix
@ -9,12 +9,12 @@

 buildPythonPackage rec {
  pname = "pywizlight";
-  version = "0.4.7";
+  version = "0.4.8";

  src = fetchFromGitHub {
    owner = "sbidy";
    repo = pname;
-    rev = version;
+    rev = "v${version}";
    sha256 = "0zagdb90bxmf06fzpljhqgsgzg36zc1yhdibacfrx8bmnx3l657h";
  };

--- a/pkgs/development/python-modules/smpplib/default.nix
+++ b/pkgs/development/python-modules/smpplib/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "smpplib";
-  version = "2.1.0";
+  version = "2.2.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0jzxlfwf0861ilh4xyd70hmkdbvdki52aalglm1bnpxkg6i3jhfz";
+    sha256 = "3d513178a35573f66faac4ef2127c4bd73307ddb463d145b17b013cf709d9ddd";
  };

  propagatedBuildInputs = [ six ];
--- a/pkgs/development/python-modules/somecomfort/default.nix
+++ b/pkgs/development/python-modules/somecomfort/default.nix
@ -7,11 +7,11 @@

 buildPythonPackage rec {
  pname = "somecomfort";
-  version = "0.7.0";
+  version = "0.8.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "f201109104a61d05624022d3d0ebf23bf487570408517cac5f3f79dbde4b225d";
+    sha256 = "56e60e4e9f76c12c0c9dd1016e9f1334be6800409e0762f5f143f9069d7292d3";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/spacy-transformers/default.nix
+++ b/pkgs/development/python-modules/spacy-transformers/default.nix
@ -12,13 +12,13 @@

 buildPythonPackage rec {
  pname = "spacy-transformers";
-  version = "1.1.0";
+  version = "1.1.1";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "17c5d821834726d3cad010d07bc9951cdf57b0a703e3727520f817286809591e";
+    sha256 = "f66c4b08c3afe2c9f01bc4a377af3c62ea9c1aa7b67ff51f62b9be73d6609e49";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/stevedore/default.nix
+++ b/pkgs/development/python-modules/stevedore/default.nix
@ -10,12 +10,12 @@

 buildPythonPackage rec {
  pname = "stevedore";
-  version = "3.4.0";
+  version = "3.5.0";
  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "18aaxj4nrki0bjgzmqxqy20m7763q1xmwishy6biicapgzdqxdar";
+    sha256 = "sha256-9AJTiH2HEuqiuw6jgwN0QWc23I7A4i9aZQksEXTEQzU=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/teslajsonpy/default.nix
+++ b/pkgs/development/python-modules/teslajsonpy/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "teslajsonpy";
-  version = "1.1.2";
+  version = "1.2.0";
  format = "pyproject";

  disabled = pythonOlder "3.6";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "zabuldon";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-i1p36qy3UF9dKzFBHaW5w0s75z/mgQ8tlYWe6qLxAKk=";
+    sha256 = "05zn923zsr3jdilhj7bl16sabxy3ziwwlz30jq1xappbf824f9sa";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/twilio/default.nix
+++ b/pkgs/development/python-modules/twilio/default.nix
@ -4,30 +4,28 @@
 , mock
 , nose
 , pyjwt
-, pysocks
+, pythonOlder
 , pytz
 , requests
-, six
 }:

 buildPythonPackage rec {
  pname = "twilio";
-  version = "7.1.0";
+  version = "7.2.0";

+  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "twilio";
    repo = "twilio-python";
    rev = version;
-    sha256 = "sha256-pagqetDQ8/1xDCxZJVTZc9T0dmFA1opd7tMDR11wlVs=";
+    sha256 = "sha256-lhRlLZ9RpOpNIPEgrO7+JO8CnqeC3gqgGqXjznsA9ls=";
  };

  propagatedBuildInputs = [
    pyjwt
-    pysocks
    pytz
    requests
-    six
  ];

  checkInputs = [
@ -35,7 +33,9 @@ buildPythonPackage rec {
    nose
  ];

-  pythonImportsCheck = [ "twilio" ];
+  pythonImportsCheck = [
+    "twilio"
+  ];

  meta = with lib; {
    description = "Twilio API client and TwiML generator";
--- a/pkgs/development/tools/analysis/radare2/default.nix
+++ b/pkgs/development/tools/analysis/radare2/default.nix
@ -31,19 +31,19 @@ let
  arm64 = fetchFromGitHub {
    owner = "radareorg";
    repo = "vector35-arch-arm64";
-    rev = "5837915960c2ce862a77c99a374abfb7d18a8534";
-    sha256 = "sha256-bs8wjOX+txB193oqIIZ7yx9pwpVhR3HAaWuDLPLG7m4=";
+    rev = "3c5eaba46dab72ecb7d5f5b865a13fdeee95b464";
+    sha256 = "sha256-alcGEi+D8CptXzfznnuxQKCvU2mbzn2sQge5jSqLVpg=";
  };
 in
 stdenv.mkDerivation rec {
  pname = "radare2";
-  version = "5.4.0";
+  version = "5.4.2";

  src = fetchFromGitHub {
    owner = "radare";
    repo = "radare2";
    rev = version;
-    sha256 = "sha256-KRHMJ0lW0OF8ejcrigp4caPsuR3iaGcglCYxJSUhGJw=";
+    sha256 = "sha256-5GvJ7J+pAL8GIZ4Tv09wdGyihfMm1bUABhmf7ozQoxc=";
  };

  preBuild = ''
--- a/pkgs/development/tools/java/sawjap/default.nix
+++ b/pkgs/development/tools/java/sawjap/default.nix
@ -0,0 +1,28 @@
+{ stdenv, ocamlPackages }:
+
+let inherit (ocamlPackages) ocaml findlib sawja; in
+
+stdenv.mkDerivation {
+
+  pname = "sawjap";
+
+  inherit (sawja) src version;
+
+  sourceRoot = "source/test";
+
+  buildInputs = [ ocaml findlib sawja ];
+
+  buildPhase = ''
+    runHook preBuild
+    mkdir -p $out/bin
+    ocamlfind opt -o $out/bin/sawjap -package sawja -linkpkg sawjap.ml
+    runHook postBuild
+  '';
+
+  dontInstall = true;
+
+  meta = sawja.meta // {
+    description = "Pretty-print .class files";
+  };
+
+}
--- a/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix
+++ b/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix
@ -68,6 +68,7 @@ in rec {
    packageJSON,
    yarnLock,
    yarnNix ? mkYarnNix { inherit yarnLock; },
+    offlineCache ? importOfflineCache yarnNix,
    yarnFlags ? defaultYarnFlags,
    pkgConfig ? {},
    preBuild ? "",
@ -75,8 +76,6 @@ in rec {
    workspaceDependencies ? [], # List of yarn packages
  }:
    let
-      offlineCache = importOfflineCache yarnNix;
-
      extraBuildInputs = (lib.flatten (builtins.map (key:
        pkgConfig.${key}.buildInputs or []
      ) (builtins.attrNames pkgConfig)));
@ -109,7 +108,12 @@ in rec {
      dontInstall = true;
      buildInputs = [ yarn nodejs git ] ++ extraBuildInputs;

-      configurePhase = ''
+      configurePhase = lib.optionalString (offlineCache ? outputHash) ''
+        if ! cmp -s ${yarnLock} ${offlineCache}/yarn.lock; then
+          echo "yarn.lock changed, you need to update the fetchYarnDeps hash"
+          exit 1
+        fi
+      '' + ''
        # Yarn writes cache directories etc to $HOME.
        export HOME=$PWD/yarn_home
      '';
@ -227,6 +231,7 @@ in rec {
    packageJSON ? src + "/package.json",
    yarnLock ? src + "/yarn.lock",
    yarnNix ? mkYarnNix { inherit yarnLock; },
+    offlineCache ? importOfflineCache yarnNix,
    yarnFlags ? defaultYarnFlags,
    yarnPreBuild ? "",
    yarnPostBuild ? "",
@ -253,7 +258,7 @@ in rec {
        preBuild = yarnPreBuild;
        postBuild = yarnPostBuild;
        workspaceDependencies = workspaceDependenciesTransitive;
-        inherit packageJSON pname version yarnLock yarnNix yarnFlags pkgConfig;
+        inherit packageJSON pname version yarnLock offlineCache yarnFlags pkgConfig;
      };

      publishBinsFor_ = unlessNull publishBinsFor [pname];
--- a/pkgs/os-specific/linux/nmon/default.nix
+++ b/pkgs/os-specific/linux/nmon/default.nix
@ -11,7 +11,13 @@ stdenv.mkDerivation rec {

  buildInputs = [ ncurses ];
  dontUnpack = true;
-  buildPhase = "cc -o nmon ${src} -g -O2 -D JFS -D GETUSER -Wall -D LARGEMEM -lncurses -lm -g -D X86";
+  buildPhase = "${stdenv.cc.targetPrefix}cc -o nmon ${src} -g -O2 -D JFS -D GETUSER -Wall -D LARGEMEM -lncurses -lm -g -D ${
+    with stdenv.targetPlatform;
+    if isx86_32 || isx86_64 then "X86"
+    else if isAarch32 || isAarch64 then "ARM"
+    else if isPower then "POWER"
+    else "UNKNOWN"
+  }";
  installPhase = ''
    mkdir -p $out/bin
    cp nmon $out/bin
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@ -27,11 +27,11 @@ let
 in
 buildPythonApplication rec {
  pname = "matrix-synapse";
-  version = "1.44.0";
+  version = "1.45.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-oH8FXHSa120/Fys21UJfAAFPehJxEbQ8Op98PYkK8dE=";
+    sha256 = "sha256-t8+sLhpjwaehe+cUi9weUZNTJAfNq/fwBZbM4SYKfnM=";
  };

  patches = [
--- a/pkgs/servers/web-apps/hedgedoc/default.nix
+++ b/pkgs/servers/web-apps/hedgedoc/default.nix
@ -6,12 +6,15 @@
 , which
 , nodejs
 , mkYarnPackage
+, fetchYarnDeps
 , python2
 , nixosTests
 , buildGoModule
 }:

 let
+  pinData = (builtins.fromJSON (builtins.readFile ./pin.json));
+
  # we need a different version than the one already available in nixpkgs
  esbuild-hedgedoc = buildGoModule rec {
    pname = "esbuild";
@ -30,19 +33,22 @@ in

 mkYarnPackage rec {
  pname = "hedgedoc";
-  version = "1.9.0";
+  inherit (pinData) version;

  src = fetchFromGitHub {
    owner  = "hedgedoc";
    repo   = "hedgedoc";
    rev    = version;
-    sha256 = "sha256-hSKQGkI1+68Zf05RhgRKZo47buyobzjhURSZ30/h0PA=";
+    sha256 = pinData.srcHash;
  };

  nativeBuildInputs = [ which makeWrapper ];
  extraBuildInputs = [ python2 esbuild-hedgedoc ];

-  yarnNix = ./yarn.nix;
+  offlineCache = fetchYarnDeps {
+    inherit yarnLock;
+    sha256 = pinData.yarnHash;
+  };

  # FIXME(@Ma27) on the bump to 1.9.0 I had to patch this file manually:
  # I replaced `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` with
@ -101,7 +107,10 @@ mkYarnPackage rec {
    runHook postDist
  '';

-  passthru.tests = { inherit (nixosTests) hedgedoc; };
+  passthru = {
+    updateScript = ./update.sh;
+    tests = { inherit (nixosTests) hedgedoc; };
+  };

  meta = with lib; {
    description = "Realtime collaborative markdown notes on all platforms";
--- a/pkgs/servers/web-apps/hedgedoc/pin.json
+++ b/pkgs/servers/web-apps/hedgedoc/pin.json
@ -0,0 +1,5 @@
+{
+  "version": "1.9.0",
+  "srcHash": "hSKQGkI1+68Zf05RhgRKZo47buyobzjhURSZ30/h0PA=",
+  "yarnHash": "0v51jmmbg8fx66ay2glby0gxw07in95igz325p42g5hjd5kankf6"
+}
--- a/pkgs/servers/web-apps/hedgedoc/update.sh
+++ b/pkgs/servers/web-apps/hedgedoc/update.sh
@ -0,0 +1,32 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -I nixpkgs=../../../../ -i bash -p nix wget prefetch-yarn-deps nix-prefetch-github
+
+if [ "$#" -gt 1 ] || [[ "$1" == -* ]]; then
+  echo "Regenerates packaging data for the element packages."
+  echo "Usage: $0 [git release tag]"
+  exit 1
+fi
+
+version="$1"
+
+set -euo pipefail
+
+if [ -z "$version" ]; then
+  version="$(wget -O- "https://api.github.com/repos/hedgedoc/hedgedoc/releases?per_page=1" | jq -r '.[0].tag_name')"
+fi
+
+src="https://raw.githubusercontent.com/hedgedoc/hedgedoc/$version"
+wget "$src/package.json" -O package.json
+wget "$src/yarn.lock" -O yarn.lock
+sed 's;midi "https://github\.com/paulrosen/MIDI\.js\.git;midi "git+https://github.com/paulrosen/MIDI.js.git;g' -i yarn.lock
+
+src_hash=$(nix-prefetch-github hedgedoc hedgedoc --rev ${version} | jq -r .sha256)
+yarn_hash=$(prefetch-yarn-deps yarn.lock)
+
+cat > pin.json << EOF
+{
+  "version": "$version",
+  "srcHash": "$src_hash",
+  "yarnHash": "$yarn_hash"
+}
+EOF
--- a/pkgs/servers/web-apps/hedgedoc/yarn.nix
+++ b/pkgs/servers/web-apps/hedgedoc/yarn.nix
--- a/pkgs/tools/graphics/pdftoipe/default.nix
+++ b/pkgs/tools/graphics/pdftoipe/default.nix
@ -0,0 +1,33 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, pkg-config
+, poppler
+}:
+
+stdenv.mkDerivation rec {
+  pname = "pdftoipe";
+  version = "7.2.24.1";
+
+  src = fetchFromGitHub {
+    owner = "otfried";
+    repo = "ipe-tools";
+    rev = "v${version}";
+    sha256 = "jlrjrjzZQo79CKMySayhCm1dqLh89wOQuXrXa2aqc0k=";
+  };
+  sourceRoot = "source/pdftoipe";
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ poppler ];
+
+  installPhase = ''
+    install -D pdftoipe $out/bin/pdftoipe
+  '';
+
+  meta = with lib; {
+    description = "A program that tries to convert arbitrary PDF documents to Ipe files";
+    homepage = "https://github.com/otfried/ipe-tools";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ yrd ];
+  };
+}
--- a/pkgs/tools/misc/hiksink/default.nix
+++ b/pkgs/tools/misc/hiksink/default.nix
@ -0,0 +1,39 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, pkg-config
+, Security
+, openssl
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "hiksink";
+  version = "1.2.0";
+
+  src = fetchFromGitHub {
+    owner = "CornerBit";
+    repo = pname;
+    rev = version;
+    sha256 = "1m8hd7qbasxyq09ycnqma2y4b9s2k54h9i2rkzsa9sksc868wxh8";
+  };
+
+  cargoSha256 = "15r6rwhyy0s5i0v9nzx3hfl5cvlb0hxnllcwfnw0bbn9km25l9r3";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+  ] ++ lib.optional stdenv.isDarwin [
+    Security
+  ];
+
+  meta = with lib; {
+    description = "Tool to convert Hikvision camera events to MQTT";
+    homepage = "https://github.com/CornerBit/HikSink";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/tools/networking/p2p/libtorrent/default.nix
+++ b/pkgs/tools/networking/p2p/libtorrent/default.nix
@ -18,6 +18,8 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ pkg-config autoreconfHook ];
  buildInputs = [ cppunit openssl libsigcxx zlib ];

+  enableParallelBuilding = true;
+
  meta = with lib; {
    homepage = "https://github.com/rakshasa/libtorrent";
    description = "A BitTorrent library written in C++ for *nix, with focus on high performance and good code";
--- a/pkgs/tools/networking/p2p/rtorrent/default.nix
+++ b/pkgs/tools/networking/p2p/rtorrent/default.nix
@ -35,6 +35,8 @@ stdenv.mkDerivation rec {

  configureFlags = [ "--with-xmlrpc-c" "--with-posix-fallocate" ];

+  enableParallelBuilding = true;
+
  postInstall = ''
    mkdir -p $out/share/man/man1 $out/share/doc/rtorrent
    mv doc/old/rtorrent.1 $out/share/man/man1/rtorrent.1
--- a/pkgs/tools/networking/termscp/default.nix
+++ b/pkgs/tools/networking/termscp/default.nix
@ -0,0 +1,46 @@
+{ lib
+, dbus
+, fetchFromGitHub
+, libssh
+, openssl
+, pkg-config
+, rustPlatform
+, Security
+, stdenv
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "termscp";
+  version = "0.7.0";
+
+  src = fetchFromGitHub {
+    owner = "veeso";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "131kij6pnw9r0p2a28g00z85dh758h4rm9ic09qmp61cq7dphkc1";
+  };
+
+  cargoSha256 = "1k2vwmfy6dczgs3bz8k4j24cc8l7l9fdh3ymp79ril4rp1v6kfp2";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    dbus
+    libssh
+    openssl
+  ] ++ lib.optional stdenv.isDarwin [
+    Security
+  ];
+
+  # Requires network access
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Terminal tool for file transfer and explorer";
+    homepage = "https://github.com/veeso/termscp";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -334,7 +334,8 @@ mapAliases ({
  google-musicmanager = throw "google-musicmanager has been removed because Google Play Music was discontinued"; # added 2021-03-07
  googleAuthenticator = google-authenticator; # added 2016-10-16
  grantlee5 = libsForQt5.grantlee;  # added 2015-12-19
-  graalvm8 = graalvm8-ce;
+  graalvm8 = throw "graalvm8-ce has been removed by upstream."; # added 2021-10-19
+  graalvm8-ce = throw "graalvm8-ce has been removed by upstream."; # added 2021-10-19
  graalvm11 = graalvm11-ce;
  gsettings_desktop_schemas = gsettings-desktop-schemas; # added 2018-02-25
  gtk_doc = gtk-doc; # added 2018-02-25
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -470,6 +470,10 @@ with pkgs;

  fetchMavenArtifact = callPackage ../build-support/fetchmavenartifact { };

+  inherit (callPackage ../build-support/node/fetch-yarn-deps { })
+    prefetch-yarn-deps
+    fetchYarnDeps;
+
  find-cursor = callPackage ../tools/X11/find-cursor { };

  flare-floss = callPackage ../tools/security/flare-floss { };
@ -3044,6 +3048,10 @@ with pkgs;

  hidrd = callPackage ../tools/misc/hidrd { };

+  hiksink = callPackage ../tools/misc/hiksink {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
  hocr-tools = with python3Packages; toPythonApplication hocr-tools;

  home-manager = callPackage ../tools/package-management/home-manager {};
@ -8324,6 +8332,8 @@ with pkgs;

  pdf2svg = callPackage ../tools/graphics/pdf2svg { };

+  pdftoipe = callPackage ../tools/graphics/pdftoipe { };
+
  fmodex = callPackage ../games/zandronum/fmod.nix { };

  pdfminer = with python3Packages; toPythonApplication pdfminer;
@ -9737,6 +9747,10 @@ with pkgs;

  telescope = callPackage ../applications/networking/browsers/telescope { };

+  termscp = callPackage ../tools/networking/termscp {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
  termius = callPackage ../applications/networking/termius { };

  termplay = callPackage ../tools/misc/termplay { };
@ -12111,7 +12125,6 @@ with pkgs;
    recurseIntoAttrs (callPackage ../development/compilers/graalvm/community-edition {
      inherit (darwin.apple_sdk.frameworks) Foundation;
    });
-  graalvm8-ce = graalvmCEPackages.graalvm8-ce;
  graalvm11-ce = graalvmCEPackages.graalvm11-ce;

  inherit (callPackages ../development/compilers/graalvm/enterprise-edition.nix { })
@ -14930,6 +14943,8 @@ with pkgs;

  sauce-connect = callPackage ../development/tools/sauce-connect { };

+  sawjap = callPackage ../development/tools/java/sawjap { };
+
  sd-local = callPackage ../development/tools/sd-local { };

  selenium-server-standalone = callPackage ../development/tools/selenium/server { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -6188,6 +6188,8 @@ in {

  pydaikin = callPackage ../development/python-modules/pydaikin { };

+  pydal = callPackage ../development/python-modules/pydal { };
+
  pydanfossair = callPackage ../development/python-modules/pydanfossair { };

  pydantic = callPackage ../development/python-modules/pydantic { };