Merge staging-next into staging

23 files changed, 176 insertions, 90 deletions

diff --git a/pkgs/applications/audio/pulseaudio-ctl/default.nix b/pkgs/applications/audio/pulseaudio-ctl/default.nix
index 843c131ea65b2..9d1d6df1da508 100644
--- a/pkgs/applications/audio/pulseaudio-ctl/default.nix
+++ b/pkgs/applications/audio/pulseaudio-ctl/default.nix
@@ -7,13 +7,13 @@ let
 
 in stdenv.mkDerivation rec {
   name = "${pname}-${version}";
-  version = "1.68";
+  version = "1.69";
 
   src = fetchFromGitHub {
     owner = "graysky2";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0wrzfanwy18wyawpg8rfvfgjh3lwngqwmfpi4ww3530rfmi84cf0";
+    sha256 = "sha256-5WRhVIQlSwWuyvkzrnNW0rdVet9ZzM47gISJpznM8mU=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/misc/coolreader/default.nix b/pkgs/applications/misc/coolreader/default.nix
index 5b310373eeef1..d043823a068a5 100644
--- a/pkgs/applications/misc/coolreader/default.nix
+++ b/pkgs/applications/misc/coolreader/default.nix
@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "coolreader";
-  version = "3.2.51";
+  version = "3.2.53";
 
   src = fetchFromGitHub {
     owner = "buggins";
     repo = pname;
     rev = "cr${version}";
-    sha256 = "sha256-rRWZHkuSNhAHwxKjpRgcNXO9vs/MDAgEuhRs8mRPjP4=";
+    sha256 = "sha256-5it70cwRV56OMZI4dny5uwxWgoF42tjcEC4g3MC548s=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/applications/networking/browsers/chromium/get-commit-message.py b/pkgs/applications/networking/browsers/chromium/get-commit-message.py
index bbadb3153ee99..1aafc6147fd91 100755
--- a/pkgs/applications/networking/browsers/chromium/get-commit-message.py
+++ b/pkgs/applications/networking/browsers/chromium/get-commit-message.py
@@ -21,15 +21,15 @@ for entry in feed.entries:
         continue
     #print(url)  # For debugging purposes
     version = re.search(r'\d+(\.\d+){3}', content).group(0)
-    fixes = re.search(r'This update includes .+ security fixes\.', content).group(0)
-    fixes = html_tags.sub('', fixes)
-    zero_days = re.search(r'Google is aware of reports that .+ in the wild\.', content)
-    if zero_days:
-        fixes += " " + zero_days.group(0)
-    cve_list = re.findall(r'CVE-[^: ]+', content)
-    cve_string = ' '.join(cve_list)
-    print('chromium: TODO -> ' + version + '\n')
-    print(url + '\n')
-    print('\n'.join(textwrap.wrap(fixes, width=72)) + '\n')
-    print("CVEs:\n" + '\n'.join(textwrap.wrap(cve_string, width=72)))
+    print('chromium: TODO -> ' + version)
+    print('\n' + url)
+    if fixes := re.search(r'This update includes .+ security fixes\.', content):
+        fixes = html_tags.sub('', fixes.group(0))
+        zero_days = re.search(r'Google is aware of reports that .+ in the wild\.', content)
+        if zero_days:
+            fixes += " " + zero_days.group(0)
+        print('\n' + '\n'.join(textwrap.wrap(fixes, width=72)))
+    if cve_list := re.findall(r'CVE-[^: ]+', content):
+        cve_string = ' '.join(cve_list)
+        print("\nCVEs:\n" + '\n'.join(textwrap.wrap(cve_string, width=72)))
     break  # We only care about the most recent stable channel update
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index 5a67aed08967f..9db51f2421030 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -1,8 +1,8 @@
 {
   "stable": {
-    "version": "89.0.4389.72",
-    "sha256": "0kxwq1m6zdsq3ns2agvk1hqkhwlv1693h41rlmvhy3nim9jhnsll",
-    "sha256bin64": "1h2dxgr660xy1rv52ck8ps6av0l5jdhj2k29lvs190ccpxaycglb",
+    "version": "89.0.4389.82",
+    "sha256": "0yg33d6zldz3j1jghhdci63fn46i10dkz3nb95jdrbv8gd018jfz",
+    "sha256bin64": "1sqzzillq38qyh85449ncz8bni93mjxb6r4z8y5h8k2w3j38jc0q",
     "deps": {
       "gn": {
         "version": "2021-01-07",
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 4124b8e111fde..84604c65579f8 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -101,8 +101,6 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  hardeningDisable = [ "stackprotector" ];
-
   preConfigure = ''
     unset CPP # intereferes with dependency calculation
     # this script isn't marked as executable b/c it's indirectly used by meson. Needed to patch its shebang
diff --git a/pkgs/build-support/ocaml/dune.nix b/pkgs/build-support/ocaml/dune.nix
index f9f59b21510f5..56fe8a60484ed 100644
--- a/pkgs/build-support/ocaml/dune.nix
+++ b/pkgs/build-support/ocaml/dune.nix
@@ -1,8 +1,8 @@
-{ lib, stdenv, ocaml, findlib, dune, dune_2 }:
+{ lib, stdenv, ocaml, findlib, dune_1, dune_2 }:
 
 { pname, version, buildInputs ? [], enableParallelBuilding ? true, ... }@args:
 
-let Dune = if args.useDune2 or false then dune_2 else dune; in
+let Dune = if args.useDune2 or false then dune_2 else dune_1; in
 
 if args ? minimumOCamlVersion &&
    ! lib.versionAtLeast ocaml.version args.minimumOCamlVersion
diff --git a/pkgs/development/libraries/pipewire/alsa-profiles-use-libdir.patch b/pkgs/development/libraries/pipewire/0040-alsa-profiles-use-libdir.patch
index c657d12f7d0c3..c657d12f7d0c3 100644
--- a/pkgs/development/libraries/pipewire/alsa-profiles-use-libdir.patch
+++ b/pkgs/development/libraries/pipewire/0040-alsa-profiles-use-libdir.patch
diff --git a/pkgs/development/libraries/pipewire/pipewire-pulse-path.patch b/pkgs/development/libraries/pipewire/0050-pipewire-pulse-path.patch
index 99782e1bb2182..4a6b21dd4312f 100644
--- a/pkgs/development/libraries/pipewire/pipewire-pulse-path.patch
+++ b/pkgs/development/libraries/pipewire/0050-pipewire-pulse-path.patch
@@ -1,19 +1,19 @@
 diff --git a/meson_options.txt b/meson_options.txt
-index 050a4c31..c481e76c 100644
+index ce364d93..a6c8af72 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -148,6 +148,9 @@ option('udev',
+@@ -152,6 +152,9 @@ option('udev',
  option('udevrulesdir',
         type : 'string',
         description : 'Directory for udev rules (defaults to /lib/udev/rules.d)')
 +option('pipewire_pulse_prefix',
 +       type : 'string',
-+       description : 'Install directory for the pipewire-pulse daemon')
++       description: 'Install directory for the pipewire-pulse daemon')
  option('systemd-user-unit-dir',
         type : 'string',
         description : 'Directory for user systemd units (defaults to /usr/lib/systemd/user)')
 diff --git a/src/daemon/systemd/user/meson.build b/src/daemon/systemd/user/meson.build
-index 46dfbbc8..0d975cec 100644
+index 0a5e5042..4a70b0b0 100644
 --- a/src/daemon/systemd/user/meson.build
 +++ b/src/daemon/systemd/user/meson.build
 @@ -9,7 +9,7 @@ install_data(
@@ -22,6 +22,6 @@ index 46dfbbc8..0d975cec 100644
  systemd_config.set('PW_BINARY', join_paths(pipewire_bindir, 'pipewire'))
 -systemd_config.set('PW_PULSE_BINARY', join_paths(pipewire_bindir, 'pipewire-pulse'))
 +systemd_config.set('PW_PULSE_BINARY', join_paths(get_option('pipewire_pulse_prefix'), 'bin/pipewire-pulse'))
+ systemd_config.set('PW_MEDIA_SESSION_BINARY', join_paths(pipewire_bindir, 'pipewire-media-session'))
  
  configure_file(input : 'pipewire.service.in',
-                output : 'pipewire.service',
diff --git a/pkgs/development/libraries/pipewire/0055-pipewire-media-session-path.patch b/pkgs/development/libraries/pipewire/0055-pipewire-media-session-path.patch
new file mode 100644
index 0000000000000..ce1085f37f7f7
--- /dev/null
+++ b/pkgs/development/libraries/pipewire/0055-pipewire-media-session-path.patch
@@ -0,0 +1,27 @@
+diff --git a/meson_options.txt b/meson_options.txt
+index a6c8af72..8e5c3d73 100644
+--- a/meson_options.txt
++++ b/meson_options.txt
+@@ -10,6 +10,9 @@ option('media-session',
+        description: 'Build and install pipewire-media-session',
+        type: 'boolean',
+        value: true)
++option('media-session-prefix',
++       description: 'Install directory for pipewire-media-session and its support files',
++       type: 'string')
+ option('man',
+        description: 'Build manpages',
+        type: 'boolean',
+diff --git a/src/daemon/systemd/user/meson.build b/src/daemon/systemd/user/meson.build
+index 4a70b0b0..84c9a19e 100644
+--- a/src/daemon/systemd/user/meson.build
++++ b/src/daemon/systemd/user/meson.build
+@@ -10,7 +10,7 @@ install_data(
+ systemd_config = configuration_data()
+ systemd_config.set('PW_BINARY', join_paths(pipewire_bindir, 'pipewire'))
+ systemd_config.set('PW_PULSE_BINARY', join_paths(get_option('pipewire_pulse_prefix'), 'bin/pipewire-pulse'))
+-systemd_config.set('PW_MEDIA_SESSION_BINARY', join_paths(pipewire_bindir, 'pipewire-media-session'))
++systemd_config.set('PW_MEDIA_SESSION_BINARY', join_paths(get_option('media-session-prefix'), 'bin/pipewire-media-session'))
+
+ configure_file(input : 'pipewire.service.in',
+                output : 'pipewire.service',
diff --git a/pkgs/development/libraries/pipewire/installed-tests-path.patch b/pkgs/development/libraries/pipewire/0070-installed-tests-path.patch
index 2a92711626bf4..2a92711626bf4 100644
--- a/pkgs/development/libraries/pipewire/installed-tests-path.patch
+++ b/pkgs/development/libraries/pipewire/0070-installed-tests-path.patch
diff --git a/pkgs/development/libraries/pipewire/pipewire-config-dir.patch b/pkgs/development/libraries/pipewire/0080-pipewire-config-dir.patch
index ad1ae93684b1b..ad1ae93684b1b 100644
--- a/pkgs/development/libraries/pipewire/pipewire-config-dir.patch
+++ b/pkgs/development/libraries/pipewire/0080-pipewire-config-dir.patch
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index fc566d91e9135..5c5578abc8df6 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -17,6 +17,7 @@
 , udev
 , libva
 , libsndfile
+, SDL2
 , vulkan-headers
 , vulkan-loader
 , ncurses
@@ -42,7 +43,7 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "0.3.21";
+    version = "0.3.23";
 
     outputs = [
       "out"
@@ -60,18 +61,20 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      hash = "sha256:2YJzPTMPIoQQeNja3F53SD4gtpdSlbD/i77hBWiQfuQ=";
+      hash = "sha256:1HMUrE1NBmrdBRMKX3LRlXaCEH3wqP2jGtW8Rp9oyQA=";
     };
 
     patches = [
       # Break up a dependency cycle between outputs.
-      ./alsa-profiles-use-libdir.patch
-      # Move installed tests into their own output.
-      ./installed-tests-path.patch
+      ./0040-alsa-profiles-use-libdir.patch
       # Change the path of the pipewire-pulse binary in the service definition.
-      ./pipewire-pulse-path.patch
+      ./0050-pipewire-pulse-path.patch
+      # Change the path of the pipewire-media-session binary in the service definition.
+      ./0055-pipewire-media-session-path.patch
+      # Move installed tests into their own output.
+      ./0070-installed-tests-path.patch
       # Add flag to specify configuration directory (different from the installation directory).
-      ./pipewire-config-dir.patch
+      ./0080-pipewire-config-dir.patch
     ];
 
     nativeBuildInputs = [
@@ -93,6 +96,7 @@ let
       vulkan-headers
       vulkan-loader
       valgrind
+      SDL2
       systemd
     ] ++ lib.optionals gstreamerSupport [ gst_all_1.gst-plugins-base gst_all_1.gstreamer ]
     ++ lib.optional ffmpegSupport ffmpeg
@@ -106,6 +110,7 @@ let
       "-Dinstalled_tests=true"
       "-Dinstalled_test_prefix=${placeholder "installedTests"}"
       "-Dpipewire_pulse_prefix=${placeholder "pulse"}"
+      "-Dmedia-session-prefix=${placeholder "mediaSession"}"
       "-Dlibjack-path=${placeholder "jack"}/lib"
       "-Dgstreamer=${mesonBool gstreamerSupport}"
       "-Dffmpeg=${mesonBool ffmpegSupport}"
@@ -122,10 +127,23 @@ let
     doCheck = true;
 
     postInstall = ''
+      pushd .
+      cd $out
+      mkdir -p $out/nix-support/etc/pipewire
+      for f in etc/pipewire/*.conf; do bin/spa-json-dump "$f" > "$out/nix-support/$f.json"; done
+
+      mkdir -p $mediaSession/nix-support/etc/pipewire/media-session.d
+      for f in etc/pipewire/media-session.d/*.conf; do bin/spa-json-dump "$f" > "$mediaSession/nix-support/$f.json"; done
+      popd
+
+      moveToOutput "etc/pipewire/media-session.d/*.conf" "$mediaSession"
+      moveToOutput "share/systemd/user/pipewire-media-session.*" "$mediaSession"
+      moveToOutput "lib/systemd/user/pipewire-media-session.*" "$mediaSession"
+      moveToOutput "bin/pipewire-media-session" "$mediaSession"
+
       moveToOutput "share/systemd/user/pipewire-pulse.*" "$pulse"
       moveToOutput "lib/systemd/user/pipewire-pulse.*" "$pulse"
       moveToOutput "bin/pipewire-pulse" "$pulse"
-      moveToOutput "bin/pipewire-media-session" "$mediaSession"
     '';
 
     passthru.tests = {
@@ -135,6 +153,17 @@ let
       test-paths = callPackage ./test-paths.nix {
         paths-out = [
           "share/alsa/alsa.conf.d/50-pipewire.conf"
+          "nix-support/etc/pipewire/client.conf.json"
+          "nix-support/etc/pipewire/client-rt.conf.json"
+          "nix-support/etc/pipewire/jack.conf.json"
+          "nix-support/etc/pipewire/pipewire.conf.json"
+          "nix-support/etc/pipewire/pipewire-pulse.conf.json"
+        ];
+        paths-out-media-session = [
+          "nix-support/etc/pipewire/media-session.d/alsa-monitor.conf.json"
+          "nix-support/etc/pipewire/media-session.d/bluez-monitor.conf.json"
+          "nix-support/etc/pipewire/media-session.d/media-session.conf.json"
+          "nix-support/etc/pipewire/media-session.d/v4l2-monitor.conf.json"
         ];
         paths-lib = [
           "lib/alsa-lib/libasound_module_pcm_pipewire.so"
diff --git a/pkgs/development/libraries/pipewire/test-paths.nix b/pkgs/development/libraries/pipewire/test-paths.nix
index 0ae6937419463..11d00e7c2ca18 100644
--- a/pkgs/development/libraries/pipewire/test-paths.nix
+++ b/pkgs/development/libraries/pipewire/test-paths.nix
@@ -14,6 +14,7 @@ let
 in runCommand "pipewire-test-paths" { } ''
   touch $out
 
+  ${check-output pipewire.mediaSession paths-out-media-session}
   ${check-output pipewire.lib paths-lib}
   ${check-output pipewire paths-out}
 
diff --git a/pkgs/development/ocaml-modules/rope/default.nix b/pkgs/development/ocaml-modules/rope/default.nix
index 481342e98c7ae..f29219e30c24b 100644
--- a/pkgs/development/ocaml-modules/rope/default.nix
+++ b/pkgs/development/ocaml-modules/rope/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, ocaml, findlib, ocamlbuild, dune, benchmark }:
+{ stdenv, lib, fetchurl, ocaml, findlib, ocamlbuild, dune_2, benchmark }:
 
 let param =
   if lib.versionAtLeast ocaml.version "4.03"
@@ -6,7 +6,7 @@ let param =
     version = "0.6.2";
     url = "https://github.com/Chris00/ocaml-rope/releases/download/${version}/rope-${version}.tbz";
     sha256 = "15cvfa0s1vjx7gjd07d3fkznilishqf4z4h2q5f20wm9ysjh2h2i";
-    buildInputs = [ dune ];
+    buildInputs = [ dune_2 ];
     extra = {
       buildPhase = "dune build -p rope";
       installPhase = ''
diff --git a/pkgs/development/tools/golangci-lint/default.nix b/pkgs/development/tools/golangci-lint/default.nix
index 49928b1a08b52..4336ba76a20fc 100644
--- a/pkgs/development/tools/golangci-lint/default.nix
+++ b/pkgs/development/tools/golangci-lint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "golangci-lint";
-  version = "1.37.1";
+  version = "1.38.0";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     rev = "v${version}";
-    sha256 = "sha256-x0VLNQeTVN9aPO06Yi1DTb8bTjq+9VemJaX1R+8s/Bg=";
+    sha256 = "sha256-hJGyK+hrP6CuSkODNsN8d2IhteKe/fXTF9GxbF7TQOk=";
   };
 
-  vendorSha256 = "sha256-uduT4RL6p6/jdT8JeTx+FY9bz0P2eUSaFNDIzi7jcqg=";
+  vendorSha256 = "sha256-zTWipGoWFndBSH8V+QxWmGv+8RoFa+OGT4BhAq/yIbE=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/ocaml/dune/default.nix b/pkgs/development/tools/ocaml/dune/1.nix
index bbdbc45270d0f..a16b3ab23f228 100644
--- a/pkgs/development/tools/ocaml/dune/default.nix
+++ b/pkgs/development/tools/ocaml/dune/1.nix
@@ -1,6 +1,7 @@
 { stdenv, lib, fetchurl, ocaml, findlib }:
 
 if !lib.versionAtLeast ocaml.version "4.02"
+|| lib.versionAtLeast ocaml.version "4.12"
 then throw "dune is not available for OCaml ${ocaml.version}"
 else
 
diff --git a/pkgs/development/tools/pactorio/default.nix b/pkgs/development/tools/pactorio/default.nix
new file mode 100644
index 0000000000000..d29e124437818
--- /dev/null
+++ b/pkgs/development/tools/pactorio/default.nix
@@ -0,0 +1,33 @@
+{ fetchFromGitHub, installShellFiles, lib, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "pactorio";
+  version = "0.5.1";
+
+  src = fetchFromGitHub {
+    owner = "figsoda";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "07h9hywz0pc29411myhxjq6pks4p6q6czbqjv7fxf3xkb1mg9grq";
+  };
+
+  cargoSha256 = "1m7bvi6i52xqvssjx5fr2dz25ny7hkmb8w8p23pczpdmpd2y0r7r";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  preFixup = ''
+    completions=($releaseDir/build/pactorio-*/out/completions)
+    installShellCompletion ''${completions[0]}/pactorio.{bash,fish}
+    installShellCompletion --zsh ''${completions[0]}/_pactorio
+  '';
+
+  GEN_COMPLETIONS = "1";
+
+  meta = with lib; {
+    description = "Mod package for factorio";
+    homepage = "https://github.com/figsoda/pactorio";
+    changelog = "https://github.com/figsoda/pactorio/blob/v${version}/CHANGELOG.md";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ figsoda ];
+  };
+}
diff --git a/pkgs/misc/vscode-extensions/ms-vsliveshare-vsliveshare/default.nix b/pkgs/misc/vscode-extensions/ms-vsliveshare-vsliveshare/default.nix
index c49f798899fed..e8e8ead9dbdef 100644
--- a/pkgs/misc/vscode-extensions/ms-vsliveshare-vsliveshare/default.nix
+++ b/pkgs/misc/vscode-extensions/ms-vsliveshare-vsliveshare/default.nix
@@ -1,9 +1,10 @@
-# Baseed on previous attempts:
+# Based on previous attempts:
 #  -  <https://github.com/msteen/nixos-vsliveshare/blob/master/pkgs/vsliveshare/default.nix>
 #  -  <https://github.com/NixOS/nixpkgs/issues/41189>
-{ lib, gccStdenv, vscode-utils, autoPatchelfHook, bash, file, makeWrapper, dotnet-sdk_3
-, curl, gcc, icu, libkrb5, libsecret, libunwind, libX11, lttng-ust, openssl, util-linux, zlib
-, desktop-file-utils, xprop
+{ lib, gccStdenv, vscode-utils
+, jq, autoPatchelfHook, bash, makeWrapper
+, dotnet-sdk_3, curl, gcc, icu, libkrb5, libsecret, libunwind, libX11, lttng-ust, openssl, util-linux, zlib
+, desktop-file-utils, xprop, xsel
 }:
 
 with lib;
@@ -37,11 +38,17 @@ in ((vscode-utils.override { stdenv = gccStdenv; }).buildVscodeMarketplaceExtens
   mktplcRef = {
     name = "vsliveshare";
     publisher = "ms-vsliveshare";
-    version = "1.0.2902";
-    sha256 = "0fx2vi0wxamcwqcgcx7wpg8hi7f1c2pibrmd2qy2whilpsv3gzmb";
+    version = "1.0.3912";
+    sha256 = "1k5yy04q85jjr7hzrv0s7x1m2251kglb038wcvvbs568vpscghi8";
   };
-}).overrideAttrs(attrs: {
-  buildInputs = attrs.buildInputs ++ libs ++ [ autoPatchelfHook bash file makeWrapper ];
+}).overrideAttrs({ nativeBuildInputs ? [], buildInputs ? [], ... }: {
+  nativeBuildInputs = nativeBuildInputs ++ [
+    bash
+    jq
+    autoPatchelfHook
+    makeWrapper
+  ];
+  buildInputs = buildInputs ++ libs;
 
   # Using a patch file won't work, because the file changes too often, causing the patch to fail on most updates.
   # Rather than patching the calls to functions, we modify the functions to return what we want,
@@ -57,32 +64,31 @@ in ((vscode-utils.override { stdenv = gccStdenv; }).buildVscodeMarketplaceExtens
 
     # Fix extension attempting to write to 'modifiedInternalSettings.json'.
     # Move this write to the tmp directory indexed by the nix store basename.
-    sed -i \
-      -E -e $'s/path\.resolve\(constants_1\.EXTENSION_ROOT_PATH, \'\.\/modifiedInternalSettings\.json\'\)/path.join\(os.tmpdir(), "'$ext_unique_id'" + "-modifiedInternalSettings.json"\)/g' \
-      out/prod/extension-prod.js
+    substituteInPlace out/prod/extension-prod.js \
+      --replace "path.resolve(constants_1.EXTENSION_ROOT_PATH, './modifiedInternalSettings.json')" \
+                "path.join(os.tmpdir(), '$ext_unique_id-modifiedInternalSettings.json')"
 
     # Fix extension attempting to write to 'vsls-agent.lock'.
     # Move this write to the tmp directory indexed by the nix store basename.
-    sed -i \
-      -E -e $'s/(Agent_1.getAgentPath\(\) \+ \'.lock\')/path.join\(os.tmpdir(), "'$ext_unique_id'" + "-vsls-agent.lock"\)/g' \
-      out/prod/extension-prod.js
-
-    # TODO: Under 'node_modules/@vsliveshare/vscode-launcher-linux' need to hardcode path to 'desktop-file-install'
-    # 'update-desktop-database' and 'xprop'. Might want to wrap the script instead.
+    substituteInPlace out/prod/extension-prod.js \
+      --replace "path + '.lock'" \
+                "__webpack_require__('path').join(__webpack_require__('os').tmpdir(), '$ext_unique_id-vsls-agent.lock')"
+
+    # Hardcode executable paths
+    echo '#!/bin/sh' >node_modules/@vsliveshare/vscode-launcher-linux/check-reqs.sh
+    substituteInPlace node_modules/@vsliveshare/vscode-launcher-linux/install.sh \
+      --replace desktop-file-install ${desktop-file-utils}/bin/desktop-file-install
+    substituteInPlace node_modules/@vsliveshare/vscode-launcher-linux/uninstall.sh \
+      --replace update-desktop-database ${desktop-file-utils}/bin/update-desktop-database
+    substituteInPlace node_modules/@vsliveshare/vscode-launcher-linux/vsls-launcher \
+      --replace /bin/bash ${bash}/bin/bash
+    substituteInPlace out/prod/extension-prod.js \
+      --replace xprop ${xprop}/bin/xprop \
+      --replace "'xsel'" "'${xsel}/bin/xsel'"
   '';
 
-  # Support for the `postInstall` hook was added only in nixos-20.03,
-  # so for backwards compatibility reasons lets not use it yet.
-  installPhase = attrs.installPhase + ''
-    # Support both the new and old directory structure of vscode extensions.
-    if [[ -d $out/ms-vsliveshare.vsliveshare ]]; then
-      cd $out/ms-vsliveshare.vsliveshare
-    elif [[ -d $out/share/vscode/extensions/ms-vsliveshare.vsliveshare ]]; then
-      cd $out/share/vscode/extensions/ms-vsliveshare.vsliveshare
-    else
-      echo "Could not find extension directory 'ms-vsliveshare.vsliveshare'." >&2
-      exit 1
-    fi
+  postInstall = ''
+    cd $out/share/vscode/extensions/ms-vsliveshare.vsliveshare
 
     bash -s <<ENDSUBSHELL
     shopt -s extglob
@@ -98,34 +104,24 @@ in ((vscode-utils.override { stdenv = gccStdenv; }).buildVscodeMarketplaceExtens
 
     # The required executables are already copied over,
     # and the other runtimes won't be used and thus are just a waste of space.
-    rm -r dotnet_modules/exes dotnet_modules/runtimes/!(linux-x64)
+    rm -r dotnet_modules/exes dotnet_modules/runtimes/!(linux-x64|unix)
 
     # Not all executables and libraries are executable, so make sure that they are.
-    find . -type f ! -executable -exec file {} + | grep -w ELF | cut -d ':' -f1 | xargs -rd'\n' chmod +x
-
-    # Not all scripts are executed by passing them to a shell, so they need to be executable as well.
-    find . -type f -name '*.sh' ! -executable -exec chmod +x {} +
+    jq <package.json '.executables.linux[]' -r | xargs chmod +x
 
     # Lock the extension downloader.
     touch install-linux.Lock externalDeps-linux.Lock
     ENDSUBSHELL
   '';
 
-  rpath = makeLibraryPath libs;
-
   postFixup = ''
     # We cannot use `wrapProgram`, because it will generate a relative path,
     # which will break when copying over the files.
     mv dotnet_modules/vsls-agent{,-wrapped}
     makeWrapper $PWD/dotnet_modules/vsls-agent{-wrapped,} \
-      --prefix LD_LIBRARY_PATH : "$rpath" \
+      --prefix LD_LIBRARY_PATH : "${makeLibraryPath libs}" \
       --set LD_PRELOAD $PWD/dotnet_modules/noop-syslog.so \
       --set DOTNET_ROOT ${dotnet-sdk_3}
-
-    for bn in check-reqs.sh install.sh uninstall.sh; do
-      wrapProgram "$PWD/node_modules/@vsliveshare/vscode-launcher-linux/$bn" \
-        --prefix PATH : "${makeBinPath [desktop-file-utils xprop]}"
-    done
   '';
 
   meta = {
diff --git a/pkgs/servers/sql/dolt/default.nix b/pkgs/servers/sql/dolt/default.nix
index 20608f796fcd0..ce57219468f1e 100644
--- a/pkgs/servers/sql/dolt/default.nix
+++ b/pkgs/servers/sql/dolt/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
     pname = "dolt";
-    version = "0.22.13";
+    version = "0.23.9";
 
     src = fetchFromGitHub {
         owner = "liquidata-inc";
         repo = "dolt";
         rev = "v${version}";
-        sha256 = "sha256-9/fpdxD3xj2hCId9koNhZLgA8SeucTue2iC/4Ues7bM=";
+        sha256 = "sha256-fVU3eOhog34fLnfNQ6mWB7yUEkinm74SgpxYXB9MV/g=";
     };
 
     modRoot = "./go";
     subPackages = [ "cmd/dolt" "cmd/git-dolt" "cmd/git-dolt-smudge" ];
-  vendorSha256 = "sha256-dDJDiCWG4+YZzTsEbhv4KzuwrkBGYUxJzknBbrWGiCE=";
+  vendorSha256 = "sha256-Poumvh7DccY8qCZ5ehFFaqEsL945BxNXFfevJvRawUA=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/backup/bup/default.nix b/pkgs/tools/backup/bup/default.nix
index 3b81295ccf2ab..3908b4984c4d6 100644
--- a/pkgs/tools/backup/bup/default.nix
+++ b/pkgs/tools/backup/bup/default.nix
@@ -31,9 +31,8 @@ stdenv.mkDerivation {
   postPatch = ''
     patchShebangs .
     substituteInPlace Makefile --replace "-Werror" ""
-    substituteInPlace Makefile --replace "./format-subst.pl" "${perl}/bin/perl ./format-subst.pl"
   '' + optionalString par2Support ''
-    substituteInPlace cmd/fsck-cmd.py --replace "['par2'" "['${par2cmdline}/bin/par2'"
+    substituteInPlace cmd/fsck-cmd.py --replace "'par2'" "'${par2cmdline}/bin/par2'"
   '';
 
   dontAddPrefix = true;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index f767f22c1f6c8..cd6418e1e8177 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -293,7 +293,7 @@ mapAliases ({
   i-score = throw "i-score has been removed: abandoned upstream."; # added 2020-11-21
   jamomacore = throw "jamomacore has been removed: abandoned upstream."; # added 2020-11-21
   jasper = throw "jasper has been removed: abandoned upstream with many vulnerabilities";
-  jbuilder = dune; # added 2018-09-09
+  jbuilder = dune_1; # added 2018-09-09
   jikes = throw "jikes was deprecated on 2019-10-07: abandoned by upstream";
   joseki = apache-jena-fuseki; # added 2016-02-28
   json_glib = json-glib; # added 2018-02-25
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 31d7eafe00607..e214627fbdc89 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2220,7 +2220,7 @@ in
 
   duf = callPackage ../tools/misc/duf { };
 
-  inherit (ocamlPackages) dune dune_2 dune-release;
+  inherit (ocamlPackages) dune_1 dune_2 dune-release;
 
   duperemove = callPackage ../tools/filesystems/duperemove { };
 
@@ -12774,6 +12774,8 @@ in
     libiberty_static = libiberty.override { staticBuild = true; };
   };
 
+  pactorio = callPackage ../development/tools/pactorio { };
+
   pahole = callPackage ../development/tools/misc/pahole {};
 
   panopticon = callPackage ../development/tools/analysis/panopticon {};
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 51dd6c257b23b..f31125ef82f5b 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -276,7 +276,7 @@ let
 
     dum = callPackage ../development/ocaml-modules/dum { };
 
-    dune = callPackage ../development/tools/ocaml/dune { };
+    dune_1 = callPackage ../development/tools/ocaml/dune/1.nix { };
 
     dune_2 =
       if lib.versionAtLeast ocaml.version "4.08"