summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--nixos/modules/config/update-users-groups.pl6
-rw-r--r--nixos/modules/config/users-groups.nix11
-rw-r--r--nixos/modules/services/networking/mosquitto.nix10
-rw-r--r--nixos/modules/system/boot/systemd.nix17
-rw-r--r--nixos/modules/system/boot/systemd/logind.nix3
-rw-r--r--nixos/tests/all-tests.nix1
-rw-r--r--nixos/tests/mosquitto.nix28
-rw-r--r--nixos/tests/user-home-mode.nix27
-rw-r--r--pkgs/applications/blockchains/sparrow/default.nix232
-rw-r--r--pkgs/applications/blockchains/sparrow/openimajgrabber.nix40
-rw-r--r--pkgs/applications/graphics/scantailor/advanced.nix10
-rw-r--r--pkgs/applications/networking/cluster/terraform-providers/providers.json198
-rw-r--r--pkgs/development/libraries/gecode/default.nix22
-rw-r--r--pkgs/development/libraries/mesa/default.nix5
-rw-r--r--pkgs/development/ocaml-modules/faraday/default.nix4
-rw-r--r--pkgs/development/ocaml-modules/hacl_x25519/default.nix4
-rw-r--r--pkgs/development/python-modules/beautifultable/default.nix16
-rw-r--r--pkgs/development/python-modules/lektor/default.nix1
-rw-r--r--pkgs/development/python-modules/pamqp/default.nix42
-rw-r--r--pkgs/development/python-modules/pytile/default.nix2
-rw-r--r--pkgs/development/python-modules/pywemo/default.nix6
-rw-r--r--pkgs/development/python-modules/ssh-mitm/default.nix4
-rw-r--r--pkgs/development/tools/analysis/checkov/default.nix4
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix2
-rw-r--r--pkgs/servers/home-assistant/default.nix5
-rw-r--r--pkgs/tools/filesystems/yandex-disk/default.nix13
-rw-r--r--pkgs/tools/networking/oonf-olsrd2/default.nix7
-rw-r--r--pkgs/top-level/all-packages.nix6
28 files changed, 567 insertions, 159 deletions
diff --git a/nixos/modules/config/update-users-groups.pl b/nixos/modules/config/update-users-groups.pl
index 26ce561013b6f..5a21cb45d52be 100644
--- a/nixos/modules/config/update-users-groups.pl
+++ b/nixos/modules/config/update-users-groups.pl
@@ -223,10 +223,10 @@ foreach my $u (@{$spec->{users}}) {
     }
 
     # Ensure home directory incl. ownership and permissions.
-    if ($u->{createHome}) {
-        make_path($u->{home}, { mode => 0700 }) if ! -e $u->{home} and ! $is_dry;
+    if ($u->{createHome} and !$is_dry) {
+        make_path($u->{home}, { mode => oct($u->{homeMode}) }) if ! -e $u->{home};
         chown $u->{uid}, $u->{gid}, $u->{home};
-        chmod 0700, $u->{home};
+        chmod oct($u->{homeMode}), $u->{home};
     }
 
     if (defined $u->{passwordFile}) {
diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix
index b0f96c754fa53..d3bdf218c3392 100644
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@@ -48,7 +48,7 @@ let
     services such as SSH, or indirectly via <command>su</command> or
     <command>sudo</command>). This should only be used for e.g. bootable
     live systems. Note: this is different from setting an empty password,
-    which ca be achieved using <option>users.users.&lt;name?&gt;.password</option>.
+    which can be achieved using <option>users.users.&lt;name?&gt;.password</option>.
 
     If set to <literal>null</literal> (default) this user will not
     be able to log in using a password (i.e. via <command>login</command>
@@ -139,6 +139,12 @@ let
         description = "The user's home directory.";
       };
 
+      homeMode = mkOption {
+        type = types.strMatching "[0-7]{1,5}";
+        default = "700";
+        description = "The user's home directory mode in numeric format. See chmod(1). The mode is only applied if <option>users.users.&lt;name&gt;.createHome</option> is true.";
+      };
+
       cryptHomeLuks = mkOption {
         type = with types; nullOr str;
         default = null;
@@ -319,6 +325,7 @@ let
           group = mkDefault "users";
           createHome = mkDefault true;
           home = mkDefault "/home/${config.name}";
+          homeMode = mkDefault "700";
           useDefaultShell = mkDefault true;
           isSystemUser = mkDefault false;
         })
@@ -430,7 +437,7 @@ let
     inherit (cfg) mutableUsers;
     users = mapAttrsToList (_: u:
       { inherit (u)
-          name uid group description home createHome isSystemUser
+          name uid group description home homeMode createHome isSystemUser
           password passwordFile hashedPassword
           autoSubUidGidRange subUidRanges subGidRanges
           initialPassword initialHashedPassword;
diff --git a/nixos/modules/services/networking/mosquitto.nix b/nixos/modules/services/networking/mosquitto.nix
index b41a2fd27be2f..256d9457d3960 100644
--- a/nixos/modules/services/networking/mosquitto.nix
+++ b/nixos/modules/services/networking/mosquitto.nix
@@ -199,6 +199,7 @@ let
     allow_anonymous = 1;
     allow_zero_length_clientid = 1;
     auto_id_prefix = 1;
+    bind_interface = 1;
     cafile = 1;
     capath = 1;
     certfile = 1;
@@ -295,7 +296,7 @@ let
   };
 
   listenerAsserts = prefix: listener:
-    assertKeysValid prefix freeformListenerKeys listener.settings
+    assertKeysValid "${prefix}.settings" freeformListenerKeys listener.settings
     ++ userAsserts prefix listener.users
     ++ imap0
       (i: v: authAsserts "${prefix}.authPlugins.${toString i}" v)
@@ -397,7 +398,7 @@ let
   };
 
   bridgeAsserts = prefix: bridge:
-    assertKeysValid prefix freeformBridgeKeys bridge.settings
+    assertKeysValid "${prefix}.settings" freeformBridgeKeys bridge.settings
     ++ [ {
       assertion = length bridge.addresses > 0;
       message = "Bridge ${prefix} needs remote broker addresses";
@@ -526,7 +527,7 @@ let
 
   globalAsserts = prefix: cfg:
     flatten [
-      (assertKeysValid prefix freeformGlobalKeys cfg.settings)
+      (assertKeysValid "${prefix}.settings" freeformGlobalKeys cfg.settings)
       (imap0 (n: l: listenerAsserts "${prefix}.listener.${toString n}" l) cfg.listeners)
       (mapAttrsToList (n: b: bridgeAsserts "${prefix}.bridge.${n}" b) cfg.bridges)
     ];
@@ -629,9 +630,10 @@ in
                ]));
         RemoveIPC = true;
         RestrictAddressFamilies = [
-          "AF_UNIX"  # for sd_notify() call
+          "AF_UNIX"
           "AF_INET"
           "AF_INET6"
+          "AF_NETLINK"
         ];
         RestrictNamespaces = true;
         RestrictRealtime = true;
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 2c9ee9fc319fc..679c5210a6b32 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -35,11 +35,11 @@ let
       "nss-lookup.target"
       "nss-user-lookup.target"
       "time-sync.target"
-    ] ++ (optionals cfg.package.withCryptsetup [
+    ] ++ optionals cfg.package.withCryptsetup [
       "cryptsetup.target"
       "cryptsetup-pre.target"
       "remote-cryptsetup.target"
-    ]) ++ [
+    ] ++ [
       "sigpwr.target"
       "timers.target"
       "paths.target"
@@ -133,20 +133,27 @@ let
 
       # Slices / containers.
       "slices.target"
+    ] ++ optionals cfg.package.withImportd [
+      "systemd-importd.service"
+    ] ++ optionals cfg.package.withMachined [
       "machine.slice"
       "machines.target"
-      "systemd-importd.service"
       "systemd-machined.service"
+    ] ++ [
       "systemd-nspawn@.service"
 
       # Misc.
       "systemd-sysctl.service"
+    ] ++ optionals cfg.package.withTimedated [
       "dbus-org.freedesktop.timedate1.service"
-      "dbus-org.freedesktop.locale1.service"
-      "dbus-org.freedesktop.hostname1.service"
       "systemd-timedated.service"
+    ] ++ optionals cfg.package.withLocaled [
+      "dbus-org.freedesktop.locale1.service"
       "systemd-localed.service"
+    ] ++ optionals cfg.package.withHostnamed [
+      "dbus-org.freedesktop.hostname1.service"
       "systemd-hostnamed.service"
+    ] ++ [
       "systemd-exit.service"
       "systemd-update-done.service"
     ] ++ cfg.additionalUpstreamSystemUnits;
diff --git a/nixos/modules/system/boot/systemd/logind.nix b/nixos/modules/system/boot/systemd/logind.nix
index c1e6cfe61d041..97ac588bce174 100644
--- a/nixos/modules/system/boot/systemd/logind.nix
+++ b/nixos/modules/system/boot/systemd/logind.nix
@@ -81,8 +81,11 @@ in
       "systemd-logind.service"
       "autovt@.service"
       "systemd-user-sessions.service"
+    ] ++ optionals config.systemd.package.withImportd [
       "dbus-org.freedesktop.import1.service"
+    ] ++ optionals config.systemd.package.withMachined [
       "dbus-org.freedesktop.machine1.service"
+    ] ++ [
       "dbus-org.freedesktop.login1.service"
       "user@.service"
       "user-runtime-dir@.service"
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 0de71030c4fbb..f4b6ee73562eb 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -580,6 +580,7 @@ in
   uptermd = handleTest ./uptermd.nix {};
   usbguard = handleTest ./usbguard.nix {};
   user-activation-scripts = handleTest ./user-activation-scripts.nix {};
+  user-home-mode = handleTest ./user-home-mode.nix {};
   uwsgi = handleTest ./uwsgi.nix {};
   v2ray = handleTest ./v2ray.nix {};
   vault = handleTest ./vault.nix {};
diff --git a/nixos/tests/mosquitto.nix b/nixos/tests/mosquitto.nix
index 36cc8e3e3d9bd..d516d3373d9f6 100644
--- a/nixos/tests/mosquitto.nix
+++ b/nixos/tests/mosquitto.nix
@@ -4,6 +4,7 @@ let
   port = 1888;
   tlsPort = 1889;
   anonPort = 1890;
+  bindTestPort = 1891;
   password = "VERY_secret";
   hashedPassword = "$7$101$/WJc4Mp+I+uYE9sR$o7z9rD1EYXHPwEP5GqQj6A7k4W1yVbePlb8TqNcuOLV9WNCiDgwHOB0JHC1WCtdkssqTBduBNUnUGd6kmZvDSw==";
   topic = "test/foo";
@@ -125,6 +126,10 @@ in {
               };
             };
           }
+          {
+            settings.bind_interface = "eth0";
+            port = bindTestPort;
+          }
         ];
       };
     };
@@ -134,6 +139,8 @@ in {
   };
 
   testScript = ''
+    import json
+
     def mosquitto_cmd(binary, user, topic, port):
         return (
             "mosquitto_{} "
@@ -162,6 +169,27 @@ in {
     start_all()
     server.wait_for_unit("mosquitto.service")
 
+    with subtest("bind_interface"):
+        addrs = dict()
+        for iface in json.loads(server.succeed("ip -json address show")):
+            for addr in iface['addr_info']:
+                # don't want to deal with multihoming here
+                assert addr['local'] not in addrs
+                addrs[addr['local']] = (iface['ifname'], addr['family'])
+
+        # mosquitto grabs *one* random address per type for bind_interface
+        (has4, has6) = (False, False)
+        for line in server.succeed("ss -HlptnO sport = ${toString bindTestPort}").splitlines():
+            items = line.split()
+            if "mosquitto" not in items[5]: continue
+            listener = items[3].rsplit(':', maxsplit=1)[0].strip('[]')
+            assert listener in addrs
+            assert addrs[listener][0] == "eth0"
+            has4 |= addrs[listener][1] == 'inet'
+            has6 |= addrs[listener][1] == 'inet6'
+        assert has4
+        assert has6
+
     with subtest("check passwords"):
         client1.succeed(publish("-m test", "password_store"))
         client1.succeed(publish("-m test", "password_file"))
diff --git a/nixos/tests/user-home-mode.nix b/nixos/tests/user-home-mode.nix
new file mode 100644
index 0000000000000..1366d102a99b3
--- /dev/null
+++ b/nixos/tests/user-home-mode.nix
@@ -0,0 +1,27 @@
+import ./make-test-python.nix ({ lib, ... }: {
+  name = "user-home-mode";
+  meta = with lib.maintainers; { maintainers = [ fbeffa ]; };
+
+  nodes.machine = {
+    users.users.alice = {
+      initialPassword = "pass1";
+      isNormalUser = true;
+    };
+    users.users.bob = {
+      initialPassword = "pass2";
+      isNormalUser = true;
+      homeMode = "750";
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("getty@tty1.service")
+    machine.wait_until_tty_matches(1, "login: ")
+    machine.send_chars("alice\n")
+    machine.wait_until_tty_matches(1, "Password: ")
+    machine.send_chars("pass1\n")
+    machine.succeed('[ "$(stat -c %a /home/alice)" == "700" ]')
+    machine.succeed('[ "$(stat -c %a /home/bob)" == "750" ]')
+  '';
+})
diff --git a/pkgs/applications/blockchains/sparrow/default.nix b/pkgs/applications/blockchains/sparrow/default.nix
new file mode 100644
index 0000000000000..662164a9f6f3d
--- /dev/null
+++ b/pkgs/applications/blockchains/sparrow/default.nix
@@ -0,0 +1,232 @@
+{ stdenv
+, lib
+, makeWrapper
+, fetchurl
+, makeDesktopItem
+, copyDesktopItems
+, autoPatchelfHook
+, openjdk17
+, gtk3
+, gsettings-desktop-schemas
+, writeScript
+, bash
+, gnugrep
+, tor
+, zlib
+, openimajgrabber
+, hwi
+, imagemagick
+}:
+
+let
+  pname = "sparrow";
+  version = "1.6.4";
+
+  src = fetchurl {
+    url = "https://github.com/sparrowwallet/${pname}/releases/download/${version}/${pname}-${version}.tar.gz";
+    sha256 = "1wdibpbhv3g6qk42ddfc5vyqkkwprczy45w5wi115qg3g1rf1in7";
+  };
+
+  launcher = writeScript "sparrow" ''
+    #! ${bash}/bin/bash
+    params=(
+      --module-path @out@/lib:@jdkModules@/modules
+      --add-opens javafx.graphics/com.sun.javafx.css=org.controlsfx.controls
+      --add-opens javafx.graphics/javafx.scene=org.controlsfx.controls
+      --add-opens javafx.controls/com.sun.javafx.scene.control.behavior=org.controlsfx.controls
+      --add-opens javafx.controls/com.sun.javafx.scene.control.inputmap=org.controlsfx.controls
+      --add-opens javafx.graphics/com.sun.javafx.scene.traversal=org.controlsfx.controls
+      --add-opens javafx.base/com.sun.javafx.event=org.controlsfx.controls
+      --add-opens javafx.controls/javafx.scene.control.cell=com.sparrowwallet.sparrow
+      --add-opens org.controlsfx.controls/impl.org.controlsfx.skin=com.sparrowwallet.sparrow
+      --add-opens org.controlsfx.controls/impl.org.controlsfx.skin=javafx.fxml
+      --add-opens javafx.graphics/com.sun.javafx.tk=centerdevice.nsmenufx
+      --add-opens javafx.graphics/com.sun.javafx.tk.quantum=centerdevice.nsmenufx
+      --add-opens javafx.graphics/com.sun.glass.ui=centerdevice.nsmenufx
+      --add-opens javafx.controls/com.sun.javafx.scene.control=centerdevice.nsmenufx
+      --add-opens javafx.graphics/com.sun.javafx.menu=centerdevice.nsmenufx
+      --add-opens javafx.graphics/com.sun.glass.ui=com.sparrowwallet.sparrow
+      --add-opens javafx.graphics/com.sun.javafx.application=com.sparrowwallet.sparrow
+      --add-opens java.base/java.net=com.sparrowwallet.sparrow
+      --add-opens java.base/java.io=com.google.gson
+      --add-reads com.sparrowwallet.merged.module=java.desktop
+      --add-reads com.sparrowwallet.merged.module=java.sql
+      --add-reads com.sparrowwallet.merged.module=com.sparrowwallet.sparrow
+      --add-reads com.sparrowwallet.merged.module=logback.classic
+      --add-reads com.sparrowwallet.merged.module=com.fasterxml.jackson.databind
+      --add-reads com.sparrowwallet.merged.module=com.fasterxml.jackson.annotation
+      --add-reads com.sparrowwallet.merged.module=com.fasterxml.jackson.core
+      --add-reads com.sparrowwallet.merged.module=co.nstant.in.cbor
+      -m com.sparrowwallet.sparrow
+    )
+
+    XDG_DATA_DIRS=${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_DATA_DIRS ${openjdk17}/bin/java ''${params[@]} $@
+  '';
+
+  torWrapper = writeScript "tor-wrapper" ''
+    #! ${bash}/bin/bash
+
+    exec ${tor}/bin/tor "$@"
+  '';
+
+  jdk-modules = stdenv.mkDerivation {
+    name = "jdk-modules";
+    nativeBuildInputs = [ openjdk17 ];
+    dontUnpack = true;
+
+    buildPhase = ''
+      # Extract the JDK's JIMAGE and generate a list of modules.
+      mkdir modules
+      pushd modules
+      jimage extract ${openjdk17}/lib/openjdk/lib/modules
+      ls | xargs -d " " -- echo > ../manifest.txt
+      popd
+    '';
+
+    installPhase = ''
+      mkdir -p $out
+      cp manifest.txt $out/
+      cp -r modules/ $out/
+    '';
+  };
+
+  sparrow-modules = stdenv.mkDerivation {
+    pname = "sparrow-modules";
+    inherit version src;
+    nativeBuildInputs = [ makeWrapper gnugrep openjdk17 autoPatchelfHook stdenv.cc.cc.lib zlib ];
+
+    buildPhase = ''
+      # Extract Sparrow's JIMAGE and generate a list of them.
+      mkdir modules
+      pushd modules
+      jimage extract ../lib/runtime/lib/modules
+
+      # Delete JDK modules
+      cat ${jdk-modules}/manifest.txt | xargs -I {} -- rm -fR {}
+
+      # Delete unneeded native libs.
+
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/freebsd-x86-64
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/freebsd-x86
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-aarch64
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-arm
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-armel
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-mips64el
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-ppc
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-ppc64le
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-s390x
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-x86
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/openbsd-x86-64
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/openbsd-x86
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/sunos-sparc
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/sunos-sparcv9
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/sunos-x86-64
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/sunos-x86
+      rm -fR com.github.sarxos.webcam.capture/com/github/sarxos/webcam/ds/buildin/lib/linux_armel
+      rm -fR com.github.sarxos.webcam.capture/com/github/sarxos/webcam/ds/buildin/lib/linux_armhf
+      rm -fR com.github.sarxos.webcam.capture/com/github/sarxos/webcam/ds/buildin/lib/linux_x86
+      rm com.github.sarxos.webcam.capture/com/github/sarxos/webcam/ds/buildin/lib/linux_x64/OpenIMAJGrabber.so
+      rm -fR com.nativelibs4java.bridj/org/bridj/lib/linux_arm32_armel
+      rm -fR com.nativelibs4java.bridj/org/bridj/lib/linux_armel
+      rm -fR com.nativelibs4java.bridj/org/bridj/lib/linux_armhf
+      rm -fR com.nativelibs4java.bridj/org/bridj/lib/linux_x86
+      rm -fR com.nativelibs4java.bridj/org/bridj/lib/sunos_x64
+      rm -fR com.nativelibs4java.bridj/org/bridj/lib/sunos_x86
+      rm -fR com.sparrowwallet.merged.module/linux-aarch64
+      rm -fR com.sparrowwallet.merged.module/linux-arm
+      rm -fR com.sparrowwallet.merged.module/linux-x86
+      rm com.sparrowwallet.sparrow/native/linux/x64/hwi
+
+      ls | xargs -d " " -- echo > ../manifest.txt
+      find . | grep "\.so$" | xargs -- chmod ugo+x
+      popd
+
+      # Replace the embedded Tor binary (which is in a Tar archive)
+      # with one from Nixpkgs.
+      cp ${torWrapper} ./tor
+      tar -cJf tor.tar.xz tor
+      cp tor.tar.xz modules/netlayer.jpms/native/linux/x64/tor.tar.xz
+    '';
+
+    installPhase = ''
+      mkdir -p $out
+      cp manifest.txt $out/
+      cp -r modules/ $out/
+      ln -s ${openimajgrabber}/lib/OpenIMAJGrabber.so $out/modules/com.github.sarxos.webcam.capture/com/github/sarxos/webcam/ds/buildin/lib/linux_x64/OpenIMAJGrabber.so
+      ln -s ${hwi}/bin/hwi $out/modules/com.sparrowwallet.sparrow/native/linux/x64/hwi
+    '';
+  };
+
+  # To use the udev rules for connected hardware wallets,
+  # add "pkgs.sparrow" to "services.udev.packages" and add user accounts to the user group "plugdev".
+  udev-rules = stdenv.mkDerivation {
+    name = "sparrow-udev";
+
+    src = let version = "2.0.2"; in
+      fetchurl {
+        url = "https://github.com/bitcoin-core/HWI/releases/download/${version}/hwi-${version}.tar.gz";
+        sha256 = "sha256-di1fRsMbwpHcBFNTCVivfxpwhUoUKLA3YTnJxKq/jHM=";
+      };
+
+    installPhase = ''
+      mkdir -p $out/etc/udev/rules.d
+      cp -a hwilib/udev/* $out/etc/udev/rules.d
+      rm $out/etc/udev/rules.d/README.md
+    '';
+  };
+in
+stdenv.mkDerivation rec {
+  inherit pname version src;
+  nativeBuildInputs = [ makeWrapper copyDesktopItems ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "Sparrow";
+      exec = pname;
+      icon = pname;
+      desktopName = "Sparrow Bitcoin Wallet";
+      genericName = "Bitcoin Wallet";
+      categories = [ "Finance" ];
+    })
+  ];
+
+  sparrow-icons = stdenv.mkDerivation {
+    inherit version src;
+    pname = "sparrow-icons";
+    nativeBuildInputs = [ imagemagick ];
+
+    installPhase = ''
+      for n in 16 24 32 48 64 96 128 256; do
+        size=$n"x"$n
+        mkdir -p $out/hicolor/$size/apps
+        convert lib/Sparrow.png -resize $size $out/hicolor/$size/apps/sparrow.png
+        done;
+    '';
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin $out
+    ln -s ${sparrow-modules}/modules $out/lib
+    install -D -m 777 ${launcher} $out/bin/sparrow
+    substituteAllInPlace $out/bin/sparrow
+    substituteInPlace $out/bin/sparrow --subst-var-by jdkModules ${jdk-modules}
+
+    mkdir -p $out/share/icons
+    ln -s ${sparrow-icons}/hicolor $out/share/icons
+
+    mkdir -p $out/etc/udev
+    ln -s ${udev-rules}/etc/udev/rules.d $out/etc/udev/rules.d
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A modern desktop Bitcoin wallet application supporting most hardware wallets and built on common standards such as PSBT, with an emphasis on transparency and usability.";
+    homepage = "https://sparrowwallet.com";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ emmanuelrosa _1000101 ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/applications/blockchains/sparrow/openimajgrabber.nix b/pkgs/applications/blockchains/sparrow/openimajgrabber.nix
new file mode 100644
index 0000000000000..0bf642d49d1ca
--- /dev/null
+++ b/pkgs/applications/blockchains/sparrow/openimajgrabber.nix
@@ -0,0 +1,40 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, libv4l
+}:
+stdenv.mkDerivation rec {
+  pname = "openimajgrabber";
+  version = "1.3.10";
+
+  src = fetchFromGitHub {
+    owner = "openimaj";
+    repo = "openimaj";
+    rev = "openimaj-${version}";
+    sha256 = "sha256-Y8707ovE7f6Fk3cJ+PtwvzNpopgH5vlF55m2Xm4hjYM=";
+  };
+
+  buildInputs = [ libv4l ];
+
+  # These build instructions come from build.sh
+  buildPhase = ''
+    pushd hardware/core-video-capture/src-native/linux
+    g++ -fPIC -g -c OpenIMAJGrabber.cpp
+    g++ -fPIC -g -c capture.cpp
+    g++ -shared -Wl,-soname,OpenIMAJGrabber.so -o OpenIMAJGrabber.so OpenIMAJGrabber.o capture.o -lv4l2 -lrt -lv4lconvert
+    popd
+  '';
+
+  installPhase = ''
+    mkdir -p $out/lib
+    cp hardware/core-video-capture/src-native/linux/OpenIMAJGrabber.so $out/lib
+  '';
+
+  meta = with lib; {
+    description = "A collection of libraries and tools for multimedia (images, text, video, audio, etc.) content analysis and content generation. This package only builds the OpenIMAJGrabber for Linux.";
+    homepage = "http://www.openimaj.org";
+    license = licenses.bsd0;
+    maintainers = with maintainers; [ emmanuelrosa _1000101 ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/graphics/scantailor/advanced.nix b/pkgs/applications/graphics/scantailor/advanced.nix
index 048b8b56fc082..11ddc7c7db3fa 100644
--- a/pkgs/applications/graphics/scantailor/advanced.nix
+++ b/pkgs/applications/graphics/scantailor/advanced.nix
@@ -4,21 +4,21 @@
 
 mkDerivation rec {
   pname = "scantailor-advanced";
-  version = "1.0.16";
+  version = "1.0.18";
 
   src = fetchFromGitHub {
-    owner = "4lex4";
+    owner = "vigri";
     repo = "scantailor-advanced";
     rev = "v${version}";
-    sha256 = "0lc9lzbpiy5hgimyhl4s4q67pb9gacpy985gl6iy8pl79zxhmcyp";
+    sha256 = "sha256-4/QSjgHvRgIduS/AXbT7osRTdOdgR7On3CbjRnGbwHU=";
   };
 
   nativeBuildInputs = [ cmake qttools ];
   buildInputs = [ libjpeg libpng libtiff boost qtbase ];
 
   meta = with lib; {
-    homepage = "https://github.com/4lex4/scantailor-advanced";
-    description = "Interactive post-processing tool for scanned pages";
+    homepage = "https://github.com/vigri/scantailor-advanced";
+    description = "Interactive post-processing tool for scanned pages (vigri's fork)";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ jfrankenau ];
     platforms = with platforms; gnu ++ linux ++ darwin;
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index d013eae755029..7e379d480936e 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -49,10 +49,10 @@
     "owner": "aliyun",
     "provider-source-address": "registry.terraform.io/aliyun/alicloud",
     "repo": "terraform-provider-alicloud",
-    "rev": "v1.167.0",
-    "sha256": "sha256-l2wCcYcAlKQTKkD+3yFi4zBkMVpq27Ygld1UjeD6IHM=",
+    "rev": "v1.168.0",
+    "sha256": "sha256-NN4dqEywcoP4tk2J6RfWqoGw+95bIEoxb4YpwPtoTZ0=",
     "vendorSha256": "sha256-qZNYfSlUkCu7FudbKF4IOgK1xWM5LqUghclOeGOxYXg=",
-    "version": "1.167.0"
+    "version": "1.168.0"
   },
   "ansible": {
     "owner": "nbering",
@@ -103,10 +103,10 @@
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/aws",
     "repo": "terraform-provider-aws",
-    "rev": "v4.14.0",
-    "sha256": "sha256-9xJVJw2kIutmmiKGvRBKS+/oyGSq0dipeCn2Gmtk1AU=",
-    "vendorSha256": "sha256-+YINrbj52ionuQbcgck6Dp2h88+LS5tXPmoVHXCAXOk=",
-    "version": "4.14.0"
+    "rev": "v4.15.1",
+    "sha256": "sha256-o8yUcjw4X+Vx49hV+0guccueWoHvpxSs+sMsbAoAw9o=",
+    "vendorSha256": "sha256-l7Fe5hhEvJ5DiZ3t79sZYIt+6eZkjjf7Npmr8p2/e/4=",
+    "version": "4.15.1"
   },
   "azuread": {
     "owner": "hashicorp",
@@ -121,10 +121,10 @@
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/azurerm",
     "repo": "terraform-provider-azurerm",
-    "rev": "v3.6.0",
-    "sha256": "sha256-brC9HZbyettgvwuFjrPxeRg/msQ1leD7F/h9aUxXAYo=",
+    "rev": "v3.7.0",
+    "sha256": "sha256-dvkR2nEtf4HvLTIoa++4PI5oNOPuJzI4obxdI4meKG4=",
     "vendorSha256": null,
-    "version": "3.6.0"
+    "version": "3.7.0"
   },
   "azurestack": {
     "owner": "hashicorp",
@@ -203,10 +203,10 @@
     "owner": "CheckPointSW",
     "provider-source-address": "registry.terraform.io/CheckPointSW/checkpoint",
     "repo": "terraform-provider-checkpoint",
-    "rev": "v1.7.0",
-    "sha256": "1msd3qjrrhl0v3m7n9ybkwxki5wpchzjswd2dcifbif4k8pcs470",
-    "vendorSha256": "0yaxgyzwja5dl4p7w8q77ash75xwsf05kq88nvmdf94lvspfnwlq",
-    "version": "1.7.0"
+    "rev": "v1.8.0",
+    "sha256": "sha256-+lcJr7C7FsvSzkfFwEfTrJedx6vMvOrTjNA+JTWBI4c=",
+    "vendorSha256": "sha256-mHLrrt6UJNfqtgjhWYDTvJcDtToHI34uoa0oyb9/XXk=",
+    "version": "1.8.0"
   },
   "ciscoasa": {
     "owner": "CiscoDevNet",
@@ -230,10 +230,10 @@
     "owner": "cloudflare",
     "provider-source-address": "registry.terraform.io/cloudflare/cloudflare",
     "repo": "terraform-provider-cloudflare",
-    "rev": "v3.14.0",
-    "sha256": "sha256-WjtAqL4gzr7NdRLf7mr6OULee35kyyZpr5crR514Mak=",
-    "vendorSha256": "sha256-xqjhSu1bUSpQ1A2Ga2IS2fdyIXcnt/nbQNXhcxVi22Q=",
-    "version": "3.14.0"
+    "rev": "v3.15.0",
+    "sha256": "sha256-y1UbirPJG9Behsr/VdILoVHIM2z9pF6iyEwXgDKbDaw=",
+    "vendorSha256": "sha256-R8B5fmjRBB2q12tzWbzOzzSOC0mNJNV1JiVjddDa11c=",
+    "version": "3.15.0"
   },
   "cloudfoundry": {
     "owner": "cloudfoundry-community",
@@ -257,10 +257,10 @@
     "owner": "cloudscale-ch",
     "provider-source-address": "registry.terraform.io/cloudscale-ch/cloudscale",
     "repo": "terraform-provider-cloudscale",
-    "rev": "v3.2.0",
-    "sha256": "1bczibhv2jr2h5mrqs41s6dlsi7i2pbrlbxv4m49q2xlq9lza4yk",
+    "rev": "v4.0.0",
+    "sha256": "sha256-Eo7zT/KiJdzo7fhAcCg6EV29ENM/XSBumAHmL9J8agU=",
     "vendorSha256": null,
-    "version": "3.2.0"
+    "version": "4.0.0"
   },
   "constellix": {
     "deleteVendor": true,
@@ -429,10 +429,10 @@
     "owner": "integrations",
     "provider-source-address": "registry.terraform.io/integrations/github",
     "repo": "terraform-provider-github",
-    "rev": "v4.24.1",
-    "sha256": "sha256-1fwHMN2HIVl+8ZL7OtP1U5ORc41e7Tm3qEpMqIgWL20=",
+    "rev": "v4.25.0",
+    "sha256": "sha256-9sZYg/gpCq2qpUhhFQjLVZLlNnYWaCz5K4/+TvCD/qk=",
     "vendorSha256": null,
-    "version": "4.24.1"
+    "version": "4.25.0"
   },
   "gitlab": {
     "owner": "gitlabhq",
@@ -448,20 +448,20 @@
     "provider-source-address": "registry.terraform.io/hashicorp/google",
     "proxyVendor": true,
     "repo": "terraform-provider-google",
-    "rev": "v4.20.0",
-    "sha256": "sha256-eZNa6V3aVtEgTZgTNgB4EUK3S6iKfk9qI7OnAQ5Mbp4=",
-    "vendorSha256": "sha256-l2OviwplP/Sg2ShaEA88pMwVTkREnLkFAzterjr2kvU=",
-    "version": "4.20.0"
+    "rev": "v4.21.0",
+    "sha256": "sha256-xintCclIhM2FqmbYoWTPGq/twkUH3M2ebc/b0SZ/hXY=",
+    "vendorSha256": "sha256-B3JiVeCzeCtsAvQiHayZY3pahN4bwizE6d99Qw2VYK8=",
+    "version": "4.21.0"
   },
   "google-beta": {
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/google-beta",
     "proxyVendor": true,
     "repo": "terraform-provider-google-beta",
-    "rev": "v4.20.0",
-    "sha256": "sha256-Dr3G7KskfL+4WNOPL3SZCKf+Lo6wP3XS1JrlC6Mv3O8=",
-    "vendorSha256": "sha256-l2OviwplP/Sg2ShaEA88pMwVTkREnLkFAzterjr2kvU=",
-    "version": "4.20.0"
+    "rev": "v4.21.0",
+    "sha256": "sha256-3oViGAFwUTBC4tMUlnjUDHdmk+sxtCeVZNbYGGwHhwU=",
+    "vendorSha256": "sha256-B3JiVeCzeCtsAvQiHayZY3pahN4bwizE6d99Qw2VYK8=",
+    "version": "4.21.0"
   },
   "googleworkspace": {
     "owner": "hashicorp",
@@ -566,10 +566,10 @@
     "owner": "IBM-Cloud",
     "provider-source-address": "registry.terraform.io/IBM-Cloud/ibm",
     "repo": "terraform-provider-ibm",
-    "rev": "v1.41.0",
-    "sha256": "sha256-5kHoTmQlEzTSjDnAJPdEN2y+DF9gB2BHJFHEYLh6h48=",
+    "rev": "v1.41.1",
+    "sha256": "sha256-eTwv7dtuFe7oEFFqnmpJMN2d/P5ow8HH1rXCE6xBEi4=",
     "vendorSha256": "sha256-8s32A0qgODZZy3rSrHnnBkQyKLBj0fcCBJ9ja9gXc5Q=",
-    "version": "1.41.0"
+    "version": "1.41.1"
   },
   "icinga2": {
     "owner": "Icinga",
@@ -593,10 +593,10 @@
     "owner": "Mongey",
     "provider-source-address": "registry.terraform.io/Mongey/kafka",
     "repo": "terraform-provider-kafka",
-    "rev": "v0.5.0",
-    "sha256": "sha256-1SZkCuAmYlfzYVpS+qrNN+vl3zrFZGUgdrrgKj0VRUE=",
-    "vendorSha256": "sha256-6wccODr/eJUh5eeDGDCuuK2pCFmvPlXWmdAUnjBHJ5E=",
-    "version": "0.5.0"
+    "rev": "v0.5.1",
+    "sha256": "sha256-bKbY2cOIORy3D9yCBqVuKUZb650sx+87d4wtUB3dPdg=",
+    "vendorSha256": "sha256-03QV6C2DEN5xwMwABwSvv5Ts6pTHQDBP2zUUqIcOtVQ=",
+    "version": "0.5.1"
   },
   "kafka-connect": {
     "owner": "Mongey",
@@ -683,10 +683,10 @@
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/local",
     "repo": "terraform-provider-local",
-    "rev": "v2.2.2",
-    "sha256": "sha256-JpTdRi9EagrnhYnlq6sl6+t4SE6i7T7YrGTsYCDync8=",
-    "vendorSha256": "sha256-Ha/MGbXwwhbVxaHbkU2xBhyNcDxLivk7vYQjfVzWOcY=",
-    "version": "2.2.2"
+    "rev": "v2.2.3",
+    "sha256": "sha256-l9XQpIMMar7ForZuBcGOmqrRuSnthIrilr4CHJ5SiaU=",
+    "vendorSha256": "sha256-5rqn9/NE7Q0VI6SRd2VFKJl4npz9Y0Qp1pEpfj9KxrQ=",
+    "version": "2.2.3"
   },
   "logicmonitor": {
     "owner": "logicmonitor",
@@ -764,10 +764,10 @@
     "owner": "NaverCloudPlatform",
     "provider-source-address": "registry.terraform.io/NaverCloudPlatform/ncloud",
     "repo": "terraform-provider-ncloud",
-    "rev": "v2.2.8",
-    "sha256": "sha256-G12/+tNSMEPCPCJH//MhRKJoRSex3mS7BZt0C2o0pF0=",
-    "vendorSha256": "sha256-ovHg4GcbMzjEi+qJBpdqhR0YUakZCdnpc10SCu8FP8I=",
-    "version": "2.2.8"
+    "rev": "v2.2.9",
+    "sha256": "sha256-D9B3IJZZOCR/kzFee3sBPEbDcAL33kIef/NAYDuJv7U=",
+    "vendorSha256": "sha256-DPK/RF63rz5AQY/LybT8I6z6vSvqrFqypslhquRrgfg=",
+    "version": "2.2.9"
   },
   "netlify": {
     "owner": "AegirHealth",
@@ -837,19 +837,19 @@
     "owner": "oracle",
     "provider-source-address": "registry.terraform.io/oracle/oci",
     "repo": "terraform-provider-oci",
-    "rev": "v4.75.0",
-    "sha256": "sha256-tcDo7yvlobHf4+0BuPdifrkA8UPhI0txRCBgToTjIcw=",
+    "rev": "v4.76.0",
+    "sha256": "sha256-sJ837jK/iYOC3dPFHoix1fiiSFMCNSqYEus9VlhXqMg=",
     "vendorSha256": null,
-    "version": "4.75.0"
+    "version": "4.76.0"
   },
   "okta": {
     "owner": "okta",
     "provider-source-address": "registry.terraform.io/okta/okta",
     "repo": "terraform-provider-okta",
-    "rev": "v3.26.0",
-    "sha256": "sha256-Mnc3JZtKNOB9VpsjXq8WiZz0+zmTmFRfOY23F186tw4=",
-    "vendorSha256": "sha256-LHiOQNFkMajqytrv387yIhAyCQCaG2Kw5OCI8Xe7u2k=",
-    "version": "3.26.0"
+    "rev": "v3.27.0",
+    "sha256": "sha256-DDNq4Yvx45ynNePg8bW8tQ6LuyvUfudxY+M88+pIXMQ=",
+    "vendorSha256": "sha256-but/2CF3OW2aefUIy5XnDvhtXYqfCkHIrS1EDQoD9jM=",
+    "version": "3.27.0"
   },
   "oktaasa": {
     "owner": "oktadeveloper",
@@ -891,10 +891,10 @@
     "owner": "opentelekomcloud",
     "provider-source-address": "registry.terraform.io/opentelekomcloud/opentelekomcloud",
     "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.29.2",
-    "sha256": "sha256-V5EGRd5/JmCDaF1fQkpwHA4DNVFKwvGnMR/AyKvgLtk=",
+    "rev": "v1.29.3",
+    "sha256": "sha256-rFaryW9yibw5whTYOb7kDF45l5NI9bdZvVQezIqudE8=",
     "vendorSha256": "sha256-FOcddb1+uG5avqYZMvzR1UXDvtDDwtxBzf7FsN6ZROM=",
-    "version": "1.29.2"
+    "version": "1.29.3"
   },
   "opsgenie": {
     "owner": "opsgenie",
@@ -927,10 +927,10 @@
     "owner": "PagerDuty",
     "provider-source-address": "registry.terraform.io/PagerDuty/pagerduty",
     "repo": "terraform-provider-pagerduty",
-    "rev": "v2.4.1",
-    "sha256": "sha256-2Ot6TxWN+t33EfT5wmkkPjj9DUrPum9whl5wimgjAp0=",
+    "rev": "v2.4.2",
+    "sha256": "sha256-xCmfykHQvQ/O+8ZGe2s5Ic4n9aZvlQ34bpnVbJDCn98=",
     "vendorSha256": null,
-    "version": "2.4.1"
+    "version": "2.4.2"
   },
   "panos": {
     "owner": "PaloAltoNetworks",
@@ -990,10 +990,10 @@
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/random",
     "repo": "terraform-provider-random",
-    "rev": "v3.1.3",
-    "sha256": "sha256-q4j3DXbLiVeSyWGywwLiJspmE08ip3zL8vabfVDWnUo=",
-    "vendorSha256": "sha256-sg89QS0ncCrBGoLvsWFlyCYwNZHNG6iadNJIHWRmhXE=",
-    "version": "3.1.3"
+    "rev": "v3.2.0",
+    "sha256": "sha256-acB1BHGxquiK137OfTe31pUGHdWp7xxlv5BINNzNLSs=",
+    "vendorSha256": "sha256-MMUit5RxsymBNX9fH8B6D2gJ/k5zaN6FCyP9N/+TV+E=",
+    "version": "3.2.0"
   },
   "rundeck": {
     "owner": "rundeck",
@@ -1026,10 +1026,10 @@
     "owner": "selectel",
     "provider-source-address": "registry.terraform.io/selectel/selectel",
     "repo": "terraform-provider-selectel",
-    "rev": "v3.8.2",
-    "sha256": "sha256-Lp2ptLuN/+/fcqeSbIMmL4dmOCoplyZeA10wAsCnYlg=",
+    "rev": "v3.8.4",
+    "sha256": "sha256-27Sdez4coJ4Enc1zTg4lr1SzlW3r6wCjciC5ID8vo0w=",
     "vendorSha256": "sha256-kmsO9jFoR/93PkOeIo0pkS/OjE+m3QbIspobAv/9+KI=",
-    "version": "3.8.2"
+    "version": "3.8.4"
   },
   "sentry": {
     "owner": "jianyuan",
@@ -1089,10 +1089,10 @@
     "owner": "spotinst",
     "provider-source-address": "registry.terraform.io/spotinst/spotinst",
     "repo": "terraform-provider-spotinst",
-    "rev": "v1.73.3",
-    "sha256": "sha256-J7hswjjyWOZrsqnhMGAyXnvrVwLRY9jGIdtwN7Dympc=",
-    "vendorSha256": "sha256-szdzI/42RExYQlHnm178RM3wlKOLax+nwgRVzonxXoI=",
-    "version": "1.73.3"
+    "rev": "v1.74.0",
+    "sha256": "sha256-wdhpkQM7J4WO4nN+0R8XfgbuusK0zDzSDy/DyOB8GcI=",
+    "vendorSha256": "sha256-OT5YuAlZNRCvwvZpCrhtKj4YiosEuHrTLQkWFYuKZrw=",
+    "version": "1.74.0"
   },
   "stackpath": {
     "owner": "stackpath",
@@ -1116,10 +1116,10 @@
     "owner": "SumoLogic",
     "provider-source-address": "registry.terraform.io/SumoLogic/sumologic",
     "repo": "terraform-provider-sumologic",
-    "rev": "v2.15.0",
-    "sha256": "sha256-VAYU1v5uCIcbeLri6tG5RIAgDP4SzZxQDtK9P5gdSPc=",
+    "rev": "v2.16.0",
+    "sha256": "sha256-27+ofT5p073s2kEk87P/Witw5x9sVKOYrlBXp6/xKxk=",
     "vendorSha256": "sha256-7DGY+L41bJJrtLwdWgu2aMCefgcmtR6tmH12foi68Kc=",
-    "version": "2.15.0"
+    "version": "2.16.0"
   },
   "template": {
     "owner": "hashicorp",
@@ -1134,10 +1134,10 @@
     "owner": "tencentcloudstack",
     "provider-source-address": "registry.terraform.io/tencentcloudstack/tencentcloud",
     "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.72.3",
-    "sha256": "sha256-NfrLaKPIAMWeRNVdWEg4wn7pFoLO1Hv3HsxFKkVewPc=",
+    "rev": "v1.72.5",
+    "sha256": "sha256-4ZnhE2Woy+CquDsqJvJMUib48eRJ9OWTrO/14NkI6iM=",
     "vendorSha256": null,
-    "version": "1.72.3"
+    "version": "1.72.5"
   },
   "tfe": {
     "owner": "hashicorp",
@@ -1170,10 +1170,10 @@
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/tls",
     "repo": "terraform-provider-tls",
-    "rev": "v3.3.0",
-    "sha256": "sha256-7A9AXZxTIltZdXXIpMpQGYKwgSdU6kRRNuvVaNtMFGw=",
-    "vendorSha256": "sha256-bj2KpPFFnev5DAND9/HyUC4kOORAvnnpSihUECcHB/8=",
-    "version": "3.3.0"
+    "rev": "v3.4.0",
+    "sha256": "sha256-14sKHnmUfDbXceH+bfSPuA1TKo6Q6kkazYwHC15D4vY=",
+    "vendorSha256": "sha256-o7QvF6Z/HCyb/EBr0m90B63AVKqxteQEBXe+OuovnYg=",
+    "version": "3.4.0"
   },
   "triton": {
     "deleteVendor": true,
@@ -1207,19 +1207,19 @@
     "owner": "cloudposse",
     "provider-source-address": "registry.terraform.io/cloudposse/utils",
     "repo": "terraform-provider-utils",
-    "rev": "0.17.23",
-    "sha256": "sha256-/m2K91I1BtzfKTO6sbYL6r0N6GGtd4Ux+GSL0Ut4GUg=",
-    "vendorSha256": "sha256-Rmv3B8Sczvohlfwu248a1pi1VmFGNCB77/IFTBKKeiM=",
-    "version": "0.17.23"
+    "rev": "0.17.24",
+    "sha256": "sha256-/pM6PuvFsmRpBz5pqOy6mVlkbq+9IRlHug/DdoKjt4U=",
+    "vendorSha256": "sha256-4/Djmg6cONkJg1wH7M4Y2mZccbwyUXEvZ2bdBYEnV9w=",
+    "version": "0.17.24"
   },
   "vault": {
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/vault",
     "repo": "terraform-provider-vault",
-    "rev": "v3.5.0",
-    "sha256": "sha256-Ap96unJFTJ8HKcIs3LYSHfTXszh1gAcZSTEWpS2W2AQ=",
-    "vendorSha256": "sha256-UvczG/31YPIxPBZhwoBC3QS+QA8PRtRqgA/0W8tcXD0=",
-    "version": "3.5.0"
+    "rev": "v3.6.0",
+    "sha256": "sha256-eeE6ThAz7RwePS65RZXbz+PUfm/KlE+f+nJWvLTCSmA=",
+    "vendorSha256": "sha256-KSGhIoUKadAuiMQkJEyYCDt7GXZ9deiV14LV4gEOpVg=",
+    "version": "3.6.0"
   },
   "vcd": {
     "owner": "vmware",
@@ -1234,10 +1234,10 @@
     "owner": "Venafi",
     "provider-source-address": "registry.terraform.io/Venafi/venafi",
     "repo": "terraform-provider-venafi",
-    "rev": "v0.15.5",
-    "sha256": "sha256-aNh9P7QqhmdywP47mddcGSDRxkwkrus14tku/xrQcz8=",
-    "vendorSha256": "sha256-SKdSjBXLX344zt0GeGBLNp8cFw+PO9ObT9jC+dHp/h8=",
-    "version": "0.15.5"
+    "rev": "v0.16.0",
+    "sha256": "sha256-oGpIa+Up1bv6tf5ibna0DEwIxrZyAefqA8LSAy57QrE=",
+    "vendorSha256": "sha256-F0lMZVMNJ/1SHX8e5v4waQPqZjan/Ll+db+dseZ+dsc=",
+    "version": "0.16.0"
   },
   "vercel": {
     "owner": "ondrejsika",
@@ -1261,10 +1261,10 @@
     "owner": "vmware",
     "provider-source-address": "registry.terraform.io/vmware/vra7",
     "repo": "terraform-provider-vra7",
-    "rev": "v3.0.4",
-    "sha256": "1w16cl27fqpzy1v6cdp61shgrmj787fdfjwhr719n57hqax4pck5",
+    "rev": "v3.0.5",
+    "sha256": "sha256-4YhaABbuG4GhWYEiGrUvf4H/8dd7wWHY08CkTWCqgr8=",
     "vendorSha256": null,
-    "version": "3.0.4"
+    "version": "3.0.5"
   },
   "vsphere": {
     "owner": "hashicorp",
@@ -1279,10 +1279,10 @@
     "owner": "vultr",
     "provider-source-address": "registry.terraform.io/vultr/vultr",
     "repo": "terraform-provider-vultr",
-    "rev": "v2.11.0",
-    "sha256": "sha256-5TtrjWQ6AXYCjOi6Qe3oJVp011s87XyU2CYnXb7hFII=",
+    "rev": "v2.11.1",
+    "sha256": "sha256-EAkFlmQFPq9pSQ591GkX7um8tcBEGIJuiLuL5d9A8Ag=",
     "vendorSha256": null,
-    "version": "2.11.0"
+    "version": "2.11.1"
   },
   "wavefront": {
     "owner": "vmware",
diff --git a/pkgs/development/libraries/gecode/default.nix b/pkgs/development/libraries/gecode/default.nix
index fc9835d85db5d..fe13c893480ca 100644
--- a/pkgs/development/libraries/gecode/default.nix
+++ b/pkgs/development/libraries/gecode/default.nix
@@ -1,4 +1,15 @@
-{ lib, stdenv, fetchFromGitHub, bison, flex, perl, gmp, mpfr, enableGist ? true, qtbase }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, bison
+, flex
+, perl
+, gmp
+, mpfr
+, qtbase
+, enableGist ? true
+}:
 
 stdenv.mkDerivation rec {
   pname = "gecode";
@@ -11,6 +22,15 @@ stdenv.mkDerivation rec {
     sha256 = "0b1cq0c810j1xr2x9y9996p894571sdxng5h74py17c6nr8c6dmk";
   };
 
+  patches = [
+    # https://github.com/Gecode/gecode/pull/74
+    (fetchpatch {
+      name = "fix-const-weights-clang.patch";
+      url = "https://github.com/Gecode/gecode/commit/c810c96b1ce5d3692e93439f76c4fa7d3daf9fbb.patch";
+      sha256 = "0270msm22q5g5sqbdh8kmrihlxnnxqrxszk9a49hdxd72736p4fc";
+    })
+  ];
+
   enableParallelBuilding = true;
   dontWrapQtApps = true;
   nativeBuildInputs = [ bison flex ];
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 1e84498d9a9e9..9b5a3e877f9a5 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -5,6 +5,7 @@
 , llvmPackages, libffi, libomxil-bellagio, libva-minimal
 , libelf, libvdpau
 , libglvnd, libunwind
+, vulkan-loader
 , galliumDrivers ? ["auto"]
 , vulkanDrivers ? ["auto"]
 , eglPlatforms ? [ "x11" ] ++ lib.optionals stdenv.isLinux [ "wayland" ]
@@ -144,7 +145,9 @@ self = stdenv.mkDerivation {
     ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal ]
     ++ lib.optionals stdenv.isDarwin [ libunwind ]
     ++ lib.optionals enableOpenCL [ libclc llvmPackages.clang llvmPackages.clang-unwrapped ]
-    ++ lib.optional withValgrind valgrind-light;
+    ++ lib.optional withValgrind valgrind-light
+    # Mesa will not build zink when gallium-drivers=auto
+    ++ lib.optional (elem "zink" galliumDrivers) vulkan-loader;
 
   depsBuildBuild = [ pkg-config ];
 
diff --git a/pkgs/development/ocaml-modules/faraday/default.nix b/pkgs/development/ocaml-modules/faraday/default.nix
index 48a6a82a738c0..92a46694f86a2 100644
--- a/pkgs/development/ocaml-modules/faraday/default.nix
+++ b/pkgs/development/ocaml-modules/faraday/default.nix
@@ -2,7 +2,7 @@
 
 buildDunePackage rec {
   pname = "faraday";
-  version = "0.7.2";
+  version = "0.8.1";
 
   useDune2 = true;
 
@@ -12,7 +12,7 @@ buildDunePackage rec {
     owner = "inhabitedtype";
     repo = pname;
     rev = version;
-    sha256 = "0gdysszzk6b6npic4nhpdnz2nbq7rma6aml0rbn113bfh0rmb36x";
+    sha256 = "sha256-eeR+nst/r2iFxCDmRS+LGr3yl/o27DcsS30YAu1GJmc=";
   };
 
   checkInputs = [ alcotest ];
diff --git a/pkgs/development/ocaml-modules/hacl_x25519/default.nix b/pkgs/development/ocaml-modules/hacl_x25519/default.nix
index 46a04a51fcab3..245b61ef1aae0 100644
--- a/pkgs/development/ocaml-modules/hacl_x25519/default.nix
+++ b/pkgs/development/ocaml-modules/hacl_x25519/default.nix
@@ -3,11 +3,11 @@
 
 buildDunePackage rec {
   pname = "hacl_x25519";
-  version = "0.2.0";
+  version = "0.2.2";
 
   src = fetchurl {
     url = "https://github.com/mirage/hacl/releases/download/v${version}/${pname}-v${version}.tbz";
-    sha256 = "0ppq56i2yhxzz38w120aynnkx10kncl86zvqip9zx0v4974k3k4x";
+    sha256 = "sha256-gWdUqOj5c50ObZjO1uULAmoo1ZIyRFxQUaZuQzLMVy0=";
   };
 
   useDune2 = true;
diff --git a/pkgs/development/python-modules/beautifultable/default.nix b/pkgs/development/python-modules/beautifultable/default.nix
index 646cfe8af9a2c..e222a8cdd9c46 100644
--- a/pkgs/development/python-modules/beautifultable/default.nix
+++ b/pkgs/development/python-modules/beautifultable/default.nix
@@ -3,17 +3,21 @@
 , fetchFromGitHub
 , wcwidth
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "beautifultable";
-  version = "1.0.1";
+  version = "1.1.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "pri22296";
     repo = pname;
     rev = "v${version}";
-    sha256 = "12ci6jy8qmbphsvzvj98466nlhclfzs0a0pmbsv3mf5bfcdwvbh7";
+    hash = "sha256-/SReCEvSwiNjBoz/3tGJ9zUNBAag4mLsHlUXwm47zCw=";
   };
 
   propagatedBuildInputs = [
@@ -24,9 +28,13 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pytestFlagsArray = [ "test.py" ];
+  pytestFlagsArray = [
+    "test.py"
+  ];
 
-  pythonImportsCheck = [ "beautifultable" ];
+  pythonImportsCheck = [
+    "beautifultable"
+  ];
 
   meta = with lib; {
     description = "Python package for printing visually appealing tables";
diff --git a/pkgs/development/python-modules/lektor/default.nix b/pkgs/development/python-modules/lektor/default.nix
index 4688b7394cc33..0c0c5c108a46a 100644
--- a/pkgs/development/python-modules/lektor/default.nix
+++ b/pkgs/development/python-modules/lektor/default.nix
@@ -62,7 +62,6 @@ buildPythonPackage rec {
   checkInputs = [
     pytest-click
     pytest-mock
-    pytest-pylint
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/pamqp/default.nix b/pkgs/development/python-modules/pamqp/default.nix
index 1785a8593102b..a367a180807d0 100644
--- a/pkgs/development/python-modules/pamqp/default.nix
+++ b/pkgs/development/python-modules/pamqp/default.nix
@@ -1,28 +1,46 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, mock
-, nose
-, pep8
-, pylint
-, mccabe
+, pythonOlder
+, fetchFromGitHub
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   version = "3.1.0";
   pname = "pamqp";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "e4f0886d72c6166637a5513626148bf5a7e818073a558980e9aaed8b4ccf30da";
+  disabled = pythonOlder "3.7";
+
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "gmr";
+    repo = "pamqp";
+    rev = version;
+    hash = "sha256-qiYfQsyYvG6pyRFDt3pyYKNNWNP88maj+VAeGD68OmY=";
   };
 
-  buildInputs = [ mock nose pep8 pylint mccabe ];
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "pamqp.base"
+    "pamqp.body"
+    "pamqp.commands"
+    "pamqp.common"
+    "pamqp.decode"
+    "pamqp.encode"
+    "pamqp.exceptions"
+    "pamqp.frame"
+    "pamqp.header"
+    "pamqp.heartbeat"
+  ];
 
   meta = with lib; {
     description = "RabbitMQ Focused AMQP low-level library";
-    homepage = "https://pypi.python.org/pypi/pamqp";
+    homepage = "https://github.com/gmr/pamqp";
     license = licenses.bsd3;
+    maintainers = with maintainers; [ dotlambda ];
   };
-
 }
diff --git a/pkgs/development/python-modules/pytile/default.nix b/pkgs/development/python-modules/pytile/default.nix
index a94201b037d47..b64418226d060 100644
--- a/pkgs/development/python-modules/pytile/default.nix
+++ b/pkgs/development/python-modules/pytile/default.nix
@@ -4,7 +4,6 @@
 , buildPythonPackage
 , fetchFromGitHub
 , poetry-core
-, pylint
 , pytest-aiohttp
 , pytest-asyncio
 , pytestCheckHook
@@ -31,7 +30,6 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     aiohttp
-    pylint
   ];
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/pywemo/default.nix b/pkgs/development/python-modules/pywemo/default.nix
index 15545acf2f63e..cd6e31a0193fa 100644
--- a/pkgs/development/python-modules/pywemo/default.nix
+++ b/pkgs/development/python-modules/pywemo/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "pywemo";
-  version = "0.8.0";
+  version = "0.8.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,8 +21,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = version;
-    hash = "sha256-bGoqhrjoRKUGPBNfmr2XP+1HL5mdRi6XoCi0BdvY9x8=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-kkZmn+rGRZGh9WmrHAmpqxTjw6MyCSWCeesJ0JGarKM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ssh-mitm/default.nix b/pkgs/development/python-modules/ssh-mitm/default.nix
index 22e30c7e1acc1..de5d9132c914d 100644
--- a/pkgs/development/python-modules/ssh-mitm/default.nix
+++ b/pkgs/development/python-modules/ssh-mitm/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "ssh-mitm";
-  version = "2.0.2";
+  version = "2.0.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = version;
-    hash = "sha256-cFahID4+PMQPG/pDAR0bU5MZAa8LsNiirxrzGi2c/EE=";
+    hash = "sha256-TU+jrPZtE9SasUudg1BujvIi3uH+WRdW2TReTFYtntc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 9b4416213f7d2..f97d277b11e54 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -32,13 +32,13 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.0.1147";
+  version = "2.0.1153";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    hash = "sha256-tk0vPkKBiGezlHEngqJBekltbpeGa2YwFnc/Ua/YMRo=";
+    hash = "sha256-9J7KvHUT6u8Dl9ElUmUgu/EC9p2gx52AB9prMFmyX2k=";
   };
 
   nativeBuildInputs = with py.pkgs; [
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 14d5e29c372a8..dad537a1564dd 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -688,7 +688,7 @@ stdenv.mkDerivation {
     # runtime; otherwise we can't and we need to reboot.
     interfaceVersion = 2;
 
-    inherit withCryptsetup util-linux kmod kbd;
+    inherit withCryptsetup withHostnamed withImportd withLocaled withMachined withTimedated util-linux kmod kbd;
 
     tests = {
       inherit (nixosTests) switchTest;
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index ff5c69b04fb8e..b23b9bc32520a 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -282,9 +282,6 @@ in python.pkgs.buildPythonApplication rec {
     respx
     stdlib-list
     tqdm
-    # required by tests/pylint
-    astroid
-    pylint
     # required by tests/auth/mfa_modules
     pyotp
   ] ++ lib.concatMap (component: getPackages component python.pkgs) [
@@ -308,6 +305,8 @@ in python.pkgs.buildPythonApplication rec {
   ];
 
   disabledTestPaths = [
+    # we don't care about code quality
+    "tests/pylint"
     # don't bulk test all components
     "tests/components"
     # pyotp since v2.4.0 complains about the short mock keys, hass pins v2.3.0
diff --git a/pkgs/tools/filesystems/yandex-disk/default.nix b/pkgs/tools/filesystems/yandex-disk/default.nix
index e837350abd6f2..4b8de7402a62c 100644
--- a/pkgs/tools/filesystems/yandex-disk/default.nix
+++ b/pkgs/tools/filesystems/yandex-disk/default.nix
@@ -4,21 +4,26 @@ let
   p = if stdenv.is64bit then {
       arch = "x86_64";
       gcclib = "${stdenv.cc.cc.lib}/lib64";
-      sha256 = "e4f579963199f05476657f0066beaa32d1261aef2203382f3919e1ed4bc4594e";
+      sha256 = "sha256-HH/pLZmDr6m/B3e6MHafDGnNWR83oR2y1ijVMR/LOF0=";
+      webarchive = "20220519080155";
     }
     else {
       arch = "i386";
       gcclib = "${stdenv.cc.cc.lib}/lib";
-      sha256 = "69113bf33ba0c57a363305b76361f2866c3b8394b173eed0f49db1f50bfe0373";
+      sha256 = "sha256-28dmdnJf+qh9r3F0quwlYXB/UqcOzcHzuzFq8vt2bf0=";
+      webarchive = "20220519080430";
     };
 in
 stdenv.mkDerivation rec {
 
   pname = "yandex-disk";
-  version = "0.1.6.1074";
+  version = "0.1.6.1080";
 
   src = fetchurl {
-    url = "https://repo.yandex.ru/yandex-disk/rpm/stable/${p.arch}/${pname}-${version}-1.fedora.${p.arch}.rpm";
+    urls = [
+      "https://repo.yandex.ru/yandex-disk/rpm/stable/${p.arch}/${pname}-${version}-1.fedora.${p.arch}.rpm"
+      "https://web.archive.org/web/${p.webarchive}/https://repo.yandex.ru/yandex-disk/rpm/stable/${p.arch}/${pname}-${version}-1.fedora.${p.arch}.rpm"
+    ];
     sha256 = p.sha256;
   };
 
diff --git a/pkgs/tools/networking/oonf-olsrd2/default.nix b/pkgs/tools/networking/oonf-olsrd2/default.nix
index c2ab89834afa9..e86bfbd1961a5 100644
--- a/pkgs/tools/networking/oonf-olsrd2/default.nix
+++ b/pkgs/tools/networking/oonf-olsrd2/default.nix
@@ -15,6 +15,13 @@ stdenv.mkDerivation rec {
     hash = "sha256-7EH2K7gaBGD95WFlG6RRhKEWJm91Xv2GOHYQjZWuzl0=";
   };
 
+  # Workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #   ld: CMakeFiles/oonf_dlep_proxy.dir/router/dlep_router_session.c.o:(.bss+0x0):
+  #     multiple definition of `LOG_DLEP_ROUTER'; CMakeFiles/oonf_dlep_proxy.dir/router/dlep_router.c.o:(.bss+0x0): first defined here
+  # Can be removed once release with https://github.com/OLSR/OONF/pull/40 is out.
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
   cmakeFlags = [
     "-DOONF_NO_WERROR=yes"
   ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e50917ea399ae..c4f7ea22b28ff 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10443,6 +10443,10 @@ with pkgs;
 
   sozu = callPackage ../servers/sozu { };
 
+  sparrow = callPackage ../applications/blockchains/sparrow {
+    openimajgrabber = callPackage ../applications/blockchains/sparrow/openimajgrabber.nix {};
+  };
+
   sparsehash = callPackage ../development/libraries/sparsehash { };
 
   spectre-meltdown-checker = callPackage ../tools/security/spectre-meltdown-checker { };
@@ -29385,7 +29389,7 @@ with pkgs;
 
   scantailor = callPackage ../applications/graphics/scantailor { };
 
-  scantailor-advanced = libsForQt514.callPackage ../applications/graphics/scantailor/advanced.nix { };
+  scantailor-advanced = libsForQt515.callPackage ../applications/graphics/scantailor/advanced.nix { };
 
   sc-im = callPackage ../applications/misc/sc-im { };