about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/builders/fetchers.chapter.md14
-rw-r--r--doc/builders/special.xml1
-rw-r--r--doc/builders/special/invalidateFetcherByDrvHash.section.md31
-rw-r--r--maintainers/maintainer-list.nix6
-rw-r--r--nixos/modules/services/web-apps/mastodon.nix35
-rw-r--r--pkgs/applications/audio/praat/default.nix4
-rw-r--r--pkgs/applications/misc/blender/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix6
-rw-r--r--pkgs/build-support/fetchgit/tests.nix10
-rw-r--r--pkgs/data/fonts/julia-mono/default.nix4
-rw-r--r--pkgs/desktops/mate/mate-screensaver/default.nix1
-rw-r--r--pkgs/development/python-modules/apprise/default.nix4
-rw-r--r--pkgs/development/python-modules/python3-gnutls/default.nix52
-rw-r--r--pkgs/development/python-modules/python3-gnutls/libgnutls-path.patch42
-rw-r--r--pkgs/development/tools/hors/default.nix4
-rw-r--r--pkgs/development/tools/rust/cargo-all-features/default.nix22
-rw-r--r--pkgs/games/anki/bin.nix8
-rw-r--r--pkgs/servers/matrix-synapse/default.nix6
-rw-r--r--pkgs/servers/monitoring/grafana-image-renderer/default.nix4
-rw-r--r--pkgs/servers/monitoring/grafana-image-renderer/package.json9
-rw-r--r--pkgs/servers/monitoring/grafana-image-renderer/yarn.lock214
-rw-r--r--pkgs/servers/monitoring/grafana-image-renderer/yarn.nix176
-rw-r--r--pkgs/tools/misc/starship/default.nix6
-rw-r--r--pkgs/tools/misc/sysz/default.nix33
-rw-r--r--pkgs/tools/networking/bitmask-vpn/default.nix168
-rw-r--r--pkgs/tools/security/cosign/default.nix8
-rw-r--r--pkgs/tools/text/hck/default.nix6
-rw-r--r--pkgs/top-level/all-packages.nix30
-rw-r--r--pkgs/top-level/python-packages.nix2
29 files changed, 750 insertions, 160 deletions
diff --git a/doc/builders/fetchers.chapter.md b/doc/builders/fetchers.chapter.md
index 30d0653448528..b1b00106b6c9c 100644
--- a/doc/builders/fetchers.chapter.md
+++ b/doc/builders/fetchers.chapter.md
@@ -1,8 +1,16 @@
 # Fetchers {#chap-pkgs-fetchers}
 
-When using Nix, you will frequently need to download source code and other files from the internet. Nixpkgs comes with a few helper functions that allow you to fetch fixed-output derivations in a structured way.
+When using Nix, you will frequently need to download source code and other files from the internet. For this purpose, Nix provides the [_fixed output derivation_](https://nixos.org/manual/nix/stable/#fixed-output-drvs) feature and Nixpkgs provides various functions that implement the actual fetching from various protocols and services.
 
-The two fetcher primitives are `fetchurl` and `fetchzip`. Both of these have two required arguments, a URL and a hash. The hash is typically `sha256`, although many more hash algorithms are supported. Nixpkgs contributors are currently recommended to use `sha256`. This hash will be used by Nix to identify your source. A typical usage of fetchurl is provided below.
+## Caveats
+
+Because fixed output derivations are _identified_ by their hash, a common mistake is to update a fetcher's URL or a version parameter, without updating the hash. **This will cause the old contents to be used.** So remember to always invalidate the hash argument.
+
+For those who develop and maintain fetcheres, a similar problem arises with changes to the implementation of a fetcher. These may cause a fixed output derivation to fail, but won't normally be caught by tests because the supposed output is already in the store or cache. For the purpose of testing, you can use a trick that is embodied by the [`invalidateFetcherByDrvHash`](#sec-pkgs-invalidateFetcherByDrvHash) function. It uses the derivation `name` to create a unique output path per fetcher implementation, defeating the caching precisely where it would be harmful.
+
+## `fetchurl` and `fetchzip` {#fetchurl}
+
+Two basic fetchers are `fetchurl` and `fetchzip`. Both of these have two required arguments, a URL and a hash. The hash is typically `sha256`, although many more hash algorithms are supported. Nixpkgs contributors are currently recommended to use `sha256`. This hash will be used by Nix to identify your source. A typical usage of fetchurl is provided below.
 
 ```nix
 { stdenv, fetchurl }:
@@ -20,7 +28,7 @@ The main difference between `fetchurl` and `fetchzip` is in how they store the c
 
 `fetchpatch` works very similarly to `fetchurl` with the same arguments expected. It expects patch files as a source and performs normalization on them before computing the checksum. For example it will remove comments or other unstable parts that are sometimes added by version control systems and can change over time.
 
-Other fetcher functions allow you to add source code directly from a VCS such as subversion or git. These are mostly straightforward nambes based on the name of the command used with the VCS system. Because they give you a working repository, they act most like `fetchzip`.
+Most other fetchers return a directory rather than a single file.
 
 ## `fetchsvn` {#fetchsvn}
 
diff --git a/doc/builders/special.xml b/doc/builders/special.xml
index 8902ce5c81329..2f84599cdd4f3 100644
--- a/doc/builders/special.xml
+++ b/doc/builders/special.xml
@@ -7,4 +7,5 @@
  </para>
  <xi:include href="special/fhs-environments.section.xml" />
  <xi:include href="special/mkshell.section.xml" />
+ <xi:include href="special/invalidateFetcherByDrvHash.section.xml" />
 </chapter>
diff --git a/doc/builders/special/invalidateFetcherByDrvHash.section.md b/doc/builders/special/invalidateFetcherByDrvHash.section.md
new file mode 100644
index 0000000000000..7c2f03a64b7b3
--- /dev/null
+++ b/doc/builders/special/invalidateFetcherByDrvHash.section.md
@@ -0,0 +1,31 @@
+
+## `invalidateFetcherByDrvHash` {#sec-pkgs-invalidateFetcherByDrvHash}
+
+Use the derivation hash to invalidate the output via name, for testing.
+
+Type: `(a@{ name, ... } -> Derivation) -> a -> Derivation`
+
+Normally, fixed output derivations can and should be cached by their output
+hash only, but for testing we want to re-fetch everytime the fetcher changes.
+
+Changes to the fetcher become apparent in the drvPath, which is a hash of
+how to fetch, rather than a fixed store path.
+By inserting this hash into the name, we can make sure to re-run the fetcher
+every time the fetcher changes.
+
+This relies on the assumption that Nix isn't clever enough to reuse its
+database of local store contents to optimize fetching.
+
+You might notice that the "salted" name derives from the normal invocation,
+not the final derivation. `invalidateFetcherByDrvHash` has to invoke the fetcher
+function twice: once to get a derivation hash, and again to produce the final
+fixed output derivation.
+
+Example:
+
+    tests.fetchgit = invalidateFetcherByDrvHash fetchgit {
+      name = "nix-source";
+      url = "https://github.com/NixOS/nix";
+      rev = "9d9dbe6ed05854e03811c361a3380e09183f4f4a";
+      sha256 = "sha256-7DszvbCNTjpzGRmpIVAWXk20P0/XTrWZ79KSOGLrUWY=";
+    };
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 3410637c69168..393be185b05a9 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -4447,6 +4447,12 @@
       fingerprint = "D618 7A03 A40A 3D56 62F5  4B46 03EF BF83 9A5F DC15";
     }];
   };
+  hleboulanger = {
+    email = "hleboulanger@protonmail.com";
+    name = "Harold Leboulanger";
+    github = "thbkrhsw";
+    githubId = 33122;
+  };
   hlolli = {
     email = "hlolli@gmail.com";
     github = "hlolli";
diff --git a/nixos/modules/services/web-apps/mastodon.nix b/nixos/modules/services/web-apps/mastodon.nix
index 5e24bd06ffdbe..5bda7d5a5dd2c 100644
--- a/nixos/modules/services/web-apps/mastodon.nix
+++ b/nixos/modules/services/web-apps/mastodon.nix
@@ -9,6 +9,13 @@ let
     RAILS_ENV = "production";
     NODE_ENV = "production";
 
+    # mastodon-web concurrency.
+    WEB_CONCURRENCY = toString cfg.webProcesses;
+    MAX_THREADS = toString cfg.webThreads;
+
+    # mastodon-streaming concurrency.
+    STREAMING_CLUSTER_NUM = toString cfg.streamingProcesses;
+
     DB_USER = cfg.database.user;
 
     REDIS_HOST = cfg.redis.host;
@@ -146,18 +153,41 @@ in {
         type = lib.types.port;
         default = 55000;
       };
+      streamingProcesses = lib.mkOption {
+        description = ''
+          Processes used by the mastodon-streaming service.
+          Defaults to the number of CPU cores minus one.
+        '';
+        type = lib.types.nullOr lib.types.int;
+        default = null;
+      };
 
       webPort = lib.mkOption {
         description = "TCP port used by the mastodon-web service.";
         type = lib.types.port;
         default = 55001;
       };
+      webProcesses = lib.mkOption {
+        description = "Processes used by the mastodon-web service.";
+        type = lib.types.int;
+        default = 2;
+      };
+      webThreads = lib.mkOption {
+        description = "Threads per process used by the mastodon-web service.";
+        type = lib.types.int;
+        default = 5;
+      };
 
       sidekiqPort = lib.mkOption {
-        description = "TCP port used by the mastodon-sidekiq service";
+        description = "TCP port used by the mastodon-sidekiq service.";
         type = lib.types.port;
         default = 55002;
       };
+      sidekiqThreads = lib.mkOption {
+        description = "Worker threads used by the mastodon-sidekiq service.";
+        type = lib.types.int;
+        default = 25;
+      };
 
       vapidPublicKeyFile = lib.mkOption {
         description = ''
@@ -524,9 +554,10 @@ in {
       wantedBy = [ "multi-user.target" ];
       environment = env // {
         PORT = toString(cfg.sidekiqPort);
+        DB_POOL = toString cfg.sidekiqThreads;
       };
       serviceConfig = {
-        ExecStart = "${cfg.package}/bin/sidekiq -c 25 -r ${cfg.package}";
+        ExecStart = "${cfg.package}/bin/sidekiq -c ${toString cfg.sidekiqThreads} -r ${cfg.package}";
         Restart = "always";
         RestartSec = 20;
         EnvironmentFile = "/var/lib/mastodon/.secrets_env";
diff --git a/pkgs/applications/audio/praat/default.nix b/pkgs/applications/audio/praat/default.nix
index 83456dcb7c8b2..b21ea2fccfd34 100644
--- a/pkgs/applications/audio/praat/default.nix
+++ b/pkgs/applications/audio/praat/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "praat";
-  version = "6.1.51";
+  version = "6.1.52";
 
   src = fetchFromGitHub {
     owner = "praat";
     repo = "praat";
     rev = "v${version}";
-    sha256 = "sha256-4goZRNKNFrfKRbGODJMhN6DyOh8U3+nWRDF1VMT7I1E=";
+    sha256 = "sha256-O/PjR2J9IMifOtCIsvo90XeRK/G29HQYt3zrn2lVjxA=";
   };
 
   configurePhase = ''
diff --git a/pkgs/applications/misc/blender/default.nix b/pkgs/applications/misc/blender/default.nix
index 59de687978301..3dfa6d9ab513d 100644
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@@ -143,6 +143,10 @@ stdenv.mkDerivation rec {
       --prefix PATH : $program_PATH \
       --prefix PYTHONPATH : "$program_PYTHONPATH" \
       --add-flags '--python-use-system-env'
+  '' + lib.optionalString stdenv.isDarwin ''
+    mkdir -p $out/Applications/Blender.app
+    ln -s $out/Blender.app $out/Applications/Blender.app
+    ln -s $out/Blender.app/Contents/MacOS $out/bin
   '';
 
   # Set RUNPATH so that libcuda and libnvrtc in /run/opengl-driver(-32)/lib can be
diff --git a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
index ac063cb1a644d..c9f7e9cc69912 100644
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@@ -88,19 +88,19 @@ let
   fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];
 
   # Upstream source
-  version = "10.5.5";
+  version = "10.5.6";
 
   lang = "en-US";
 
   srcs = {
     x86_64-linux = fetchurl {
       url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz";
-      sha256 = "0847lib2z21fgb7x5szwvprc77fhdpmp4z5d6n1sk6d40dd34spn";
+      sha256 = "1hxjixriah08c65nngjdp1blbji1vlnhqkphp8f96hy34hk4dpiw";
     };
 
     i686-linux = fetchurl {
       url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz";
-      sha256 = "0i26fb0r234nrwnvb2c9vk9yn869qghq0n4qlm1d7mr62dy6prxa";
+      sha256 = "018kwwbbn02drvdj0bjkcyhsnbx97wnmd3lxkrx0kc9dw1s4r418";
     };
   };
 in
diff --git a/pkgs/build-support/fetchgit/tests.nix b/pkgs/build-support/fetchgit/tests.nix
new file mode 100644
index 0000000000000..6805473e29685
--- /dev/null
+++ b/pkgs/build-support/fetchgit/tests.nix
@@ -0,0 +1,10 @@
+{ invalidateFetcherByDrvHash, fetchgit, ... }:
+
+{
+  simple = invalidateFetcherByDrvHash fetchgit {
+    name = "nix-source";
+    url = "https://github.com/NixOS/nix";
+    rev = "9d9dbe6ed05854e03811c361a3380e09183f4f4a";
+    sha256 = "sha256-7DszvbCNTjpzGRmpIVAWXk20P0/XTrWZ79KSOGLrUWY=";
+  };
+}
diff --git a/pkgs/data/fonts/julia-mono/default.nix b/pkgs/data/fonts/julia-mono/default.nix
index 5e1cd786534d1..a1f8f316773ec 100644
--- a/pkgs/data/fonts/julia-mono/default.nix
+++ b/pkgs/data/fonts/julia-mono/default.nix
@@ -1,13 +1,13 @@
 { lib, fetchzip }:
 
 let
-  version = "0.042";
+  version = "0.043";
 
 in
 fetchzip {
   name = "JuliaMono-ttf-${version}";
   url = "https://github.com/cormullion/juliamono/releases/download/v${version}/JuliaMono-ttf.tar.gz";
-  sha256 = "sha256-oXODkeLDT5GXO4+r1fGaRrRS/SSBhzro5XE0GOwl4mQ=";
+  sha256 = "sha256-oxQRrFhTf37OrJSbDlmzh/7xOuKrtxO7v2+j7QcsAmE=";
 
   postFetch = ''
     mkdir -p $out/share/fonts/truetype
diff --git a/pkgs/desktops/mate/mate-screensaver/default.nix b/pkgs/desktops/mate/mate-screensaver/default.nix
index b87ec4b68d089..767d0e9232f74 100644
--- a/pkgs/desktops/mate/mate-screensaver/default.nix
+++ b/pkgs/desktops/mate/mate-screensaver/default.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation rec {
     systemd
     mate.mate-desktop
     mate.mate-menus
+    mate.mate-panel
   ];
 
   configureFlags = [ "--without-console-kit" ];
diff --git a/pkgs/development/python-modules/apprise/default.nix b/pkgs/development/python-modules/apprise/default.nix
index 1aa9dc2b10271..fbcd7addb2a55 100644
--- a/pkgs/development/python-modules/apprise/default.nix
+++ b/pkgs/development/python-modules/apprise/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "apprise";
-  version = "0.9.4";
+  version = "0.9.5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Q7iZD9GG8vPxITpn87l3yGtU+L8jwvs2Qi329LHlKrI=";
+    sha256 = "sha256-vwkHA66xK4LGhdazZ0o93+cSpGwgiTCMm8IC8D4G1Y0=";
   };
 
   nativeBuildInputs = [ Babel installShellFiles ];
diff --git a/pkgs/development/python-modules/python3-gnutls/default.nix b/pkgs/development/python-modules/python3-gnutls/default.nix
new file mode 100644
index 0000000000000..cda828113971d
--- /dev/null
+++ b/pkgs/development/python-modules/python3-gnutls/default.nix
@@ -0,0 +1,52 @@
+{ lib, fetchFromGitHub, substituteAll, buildPythonPackage, isPy3k, gnutls
+, twisted, pyopenssl, service-identity }:
+
+buildPythonPackage rec {
+  pname = "python3-gnutls";
+  version = "3.1.9";
+
+  disabled = !isPy3k;
+
+  src = fetchFromGitHub {
+    owner = "AGProjects";
+    repo = "python3-gnutls";
+    rev = "324b78f7cd3d9fe58c89c7f0b2bf94199bd6a6e5"; # version not tagged
+    sha256 = "sha256-18T8bAHlNERHobsspUFvSC6ulN55nrFFb5aqNwU8T00=";
+  };
+
+  propagatedBuildInputs = [ twisted pyopenssl service-identity ];
+
+  patches = [
+    (substituteAll {
+      src = ./libgnutls-path.patch;
+      gnutlslib = "${lib.getLib gnutls}/lib";
+    })
+   ];
+
+  pythonImportsCheck = [ "gnutls" ];
+
+  meta = with lib; {
+    description = "Python wrapper for the GnuTLS library";
+    homepage = "https://github.com/AGProjects/python3-gnutls";
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ chanley ];
+    longDescription = ''
+      This package provides a high level object oriented wrapper around libgnutls,
+      as well as low level bindings to the GnuTLS types and functions via ctypes.
+      The high level wrapper hides the details of accessing the GnuTLS library via
+      ctypes behind a set of classes that encapsulate GnuTLS sessions, certificates
+      and credentials and expose them to python applications using a simple API.
+
+      The package also includes a Twisted interface that has seamless intergration
+      with Twisted, providing connectTLS and listenTLS methods on the Twisted
+      reactor once imported (the methods are automatically attached to the reactor
+      by simply importing the GnuTLS Twisted interface module).
+
+      The high level wrapper is written using the GnuTLS library bindings that are
+      made available via ctypes. This makes the wrapper very powerful and flexible
+      as it has direct access to all the GnuTLS internals and is also very easy to
+      extend without any need to write C code or recompile anything.
+
+    '';
+  };
+}
diff --git a/pkgs/development/python-modules/python3-gnutls/libgnutls-path.patch b/pkgs/development/python-modules/python3-gnutls/libgnutls-path.patch
new file mode 100644
index 0000000000000..ff9b3aa693281
--- /dev/null
+++ b/pkgs/development/python-modules/python3-gnutls/libgnutls-path.patch
@@ -0,0 +1,42 @@
+diff --git a/gnutls/library/__init__.py b/gnutls/library/__init__.py
+index c1d898a..b87bd2e 100644
+--- a/gnutls/library/__init__.py
++++ b/gnutls/library/__init__.py
+@@ -18,35 +18,19 @@ def _library_locations(abi_version):
+     system = _get_system_name()
+     if system == "darwin":
+         library_names = ["libgnutls.%d.dylib" % abi_version]
+-        dynamic_loader_env_vars = ["DYLD_LIBRARY_PATH", "LD_LIBRARY_PATH"]
+-        additional_paths = ["/usr/local/lib", "/opt/local/lib", "/sw/lib"]
+     elif system == "windows":
+         library_names = ["libgnutls-%d.dll" % abi_version]
+-        dynamic_loader_env_vars = ["PATH"]
+-        additional_paths = ["."]
+     elif system == "cygwin":
+         library_names = ["cyggnutls-%d.dll" % abi_version]
+-        dynamic_loader_env_vars = ["LD_LIBRARY_PATH"]
+-        additional_paths = ["/usr/bin"]
+     else:
+         # Debian uses libgnutls-deb0.so.28, go figure
+         library_names = [
+             "libgnutls.so.%d" % abi_version,
+             "libgnutls-deb0.so.%d" % abi_version,
+         ]
+-        dynamic_loader_env_vars = ["LD_LIBRARY_PATH"]
+-        additional_paths = ["/usr/local/lib"]
+     for library_name in library_names:
+-        for path in (
+-            path
+-            for env_var in dynamic_loader_env_vars
+-            for path in os.environ.get(env_var, "").split(":")
+-            if os.path.isdir(path)
+-        ):
+-            yield os.path.join(path, library_name)
+-        yield library_name
+-        for path in additional_paths:
+-            yield os.path.join(path, library_name)
++        path = "@gnutlslib@"
++        yield os.path.join(path, library_name)
+ 
+ 
+ def _load_library(abi_versions):
diff --git a/pkgs/development/tools/hors/default.nix b/pkgs/development/tools/hors/default.nix
index 1632d74f9145a..579a2a27922f2 100644
--- a/pkgs/development/tools/hors/default.nix
+++ b/pkgs/development/tools/hors/default.nix
@@ -1,4 +1,4 @@
-{ lib, rustPlatform, fetchFromGitHub }:
+{ lib, rustPlatform, fetchFromGitHub, stdenv, Security }:
 
 rustPlatform.buildRustPackage rec {
   pname = "hors";
@@ -13,6 +13,8 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-1PB/JvgfC6qABI+cIePqtsSlZXPqMGQIay9SCXJkV9o=";
 
+  buildInputs = lib.optional stdenv.isDarwin Security;
+
   # requires network access
   doCheck = false;
 
diff --git a/pkgs/development/tools/rust/cargo-all-features/default.nix b/pkgs/development/tools/rust/cargo-all-features/default.nix
new file mode 100644
index 0000000000000..3d36b42ebe7c8
--- /dev/null
+++ b/pkgs/development/tools/rust/cargo-all-features/default.nix
@@ -0,0 +1,22 @@
+{ lib, rustPlatform, fetchFromGitHub }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cargo-all-features";
+  version = "1.6.0";
+
+  src = fetchFromGitHub {
+    owner = "frewsxcv";
+    repo = pname;
+    rev = version;
+    sha256 = "1pdr34ygc0qmh0dyrw1qcrh1vgg9jv9lm6ypl3fgjzz7npdj1dw4";
+  };
+
+  cargoSha256 = "sha256-BsRJo55gYT8OkDUBepWq48sW7QPt5OZkm8RR9f7HqZY=";
+
+  meta = with lib; {
+    description = "A Cargo subcommand to build and test all feature flag combinations";
+    homepage = "https://github.com/frewsxcv/cargo-all-features";
+    license = with licenses; [ asl20 /* or */ mit ];
+    maintainers = with maintainers; [ figsoda ];
+  };
+}
diff --git a/pkgs/games/anki/bin.nix b/pkgs/games/anki/bin.nix
index 81de4f859683f..3d1d22f293d5f 100644
--- a/pkgs/games/anki/bin.nix
+++ b/pkgs/games/anki/bin.nix
@@ -3,16 +3,16 @@
 let
   pname = "anki-bin";
   # Update hashes for both Linux and Darwin!
-  version = "2.1.47";
+  version = "2.1.48";
 
   sources = {
     linux = fetchurl {
       url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-linux.tar.bz2";
-      sha256 = "sha256-cObvjXeDUDslfAhMOrlqyjidri6N7xLR2+LRz3hTdfg=";
+      sha256 = "sha256-1ZvC8CPnYMzCxxrko1FfmTvKiJT+7BhOdk52zLTnLGE=";
     };
     darwin = fetchurl {
       url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-mac.dmg";
-      sha256 = "sha256-TwYrI9gSabJ5icOsygtEJRymkrSgCD8jDXMtpaJXgWg=";
+      sha256 = "sha256-HXYTpOxFxjQoqjs+04diy5d+GmS69dFNEfLI/E4NCXw=";
     };
   };
 
@@ -48,8 +48,6 @@ if stdenv.isLinux then buildFHSUserEnv (appimageTools.defaultFhsEnvArgs // {
   name = "anki";
 
   runScript = writeShellScript "anki-wrapper.sh" ''
-    # Wayland support is broken, disable via ENV variable
-    export QT_QPA_PLATFORM=xcb
     exec ${unpacked}/bin/anki
   '';
 
diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index e25b6758b49b5..058a9be261c3c 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -27,11 +27,11 @@ let
 in
 buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.42.0";
+  version = "1.43.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-wJFjjm9apRqjk5eN/kIEgecHgm/XLbtwXHEpM2pmvO8=";
+    sha256 = "sha256-t3ZXtEq/sHYymta4gYfmdBzpExyxepGQ4lzvZii2Q70=";
   };
 
   patches = [
@@ -81,7 +81,7 @@ buildPythonApplication rec {
   doCheck = !stdenv.isDarwin;
 
   checkPhase = ''
-    PYTHONPATH=".:$PYTHONPATH" ${py.interpreter} -m twisted.trial tests
+    PYTHONPATH=".:$PYTHONPATH" ${py.interpreter} -m twisted.trial -j $NIX_BUILD_CORES tests
   '';
 
   passthru.tests = { inherit (nixosTests) matrix-synapse; };
diff --git a/pkgs/servers/monitoring/grafana-image-renderer/default.nix b/pkgs/servers/monitoring/grafana-image-renderer/default.nix
index a87d30d735704..e67a23f134508 100644
--- a/pkgs/servers/monitoring/grafana-image-renderer/default.nix
+++ b/pkgs/servers/monitoring/grafana-image-renderer/default.nix
@@ -10,13 +10,13 @@
 
 mkYarnPackage rec {
   pname = "grafana-image-renderer";
-  version = "3.0.0";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "grafana-image-renderer";
     rev = "v${version}";
-    sha256 = "sha256-wg+cMAMqj4JORh5LPJnNELgsJYAxVgz2YPOl87WWda4=";
+    sha256 = "sha256-PEi8jreYCafKBa8M5Mo6/g03pS1PHvmhgMpuwIlUePY=";
   };
 
   buildPhase = ''
diff --git a/pkgs/servers/monitoring/grafana-image-renderer/package.json b/pkgs/servers/monitoring/grafana-image-renderer/package.json
index c1db7f861816e..1cd26f57b9fab 100644
--- a/pkgs/servers/monitoring/grafana-image-renderer/package.json
+++ b/pkgs/servers/monitoring/grafana-image-renderer/package.json
@@ -21,7 +21,7 @@
     "@grpc/grpc-js": "^1.0",
     "@grpc/proto-loader": "^0.5.4",
     "@hapi/boom": "^9.1.0",
-    "chokidar": "^3.5.1",
+    "chokidar": "^3.5.2",
     "eslint": "^7.13.0",
     "express": "^4.16.3",
     "express-prom-bundle": "^5.1.5",
@@ -29,8 +29,9 @@
     "lodash": "^4.17.21",
     "minimist": "^1.2.0",
     "morgan": "^1.9.0",
+    "on-finished": "^2.3.0",
     "prom-client": "^11.5.3",
-    "puppeteer": "^3.3.0",
+    "puppeteer": "^10.0.0",
     "puppeteer-cluster": "^0.22.0",
     "unique-filename": "^1.1.0",
     "winston": "^3.2.1"
@@ -41,9 +42,9 @@
     "husky": "^4.3.8",
     "lint-staged": "^9.5.0",
     "pkg": "^5.1.0",
-    "prettier": "^1.19.1",
+    "prettier": "2.2.1",
     "tsc-watch": "^4.2.3",
-    "typescript": "^3.8.3"
+    "typescript": "^4.3.2"
   },
   "husky": {
     "hooks": {
diff --git a/pkgs/servers/monitoring/grafana-image-renderer/yarn.lock b/pkgs/servers/monitoring/grafana-image-renderer/yarn.lock
index 80fd4569e6913..b58c74f73eee6 100644
--- a/pkgs/servers/monitoring/grafana-image-renderer/yarn.lock
+++ b/pkgs/servers/monitoring/grafana-image-renderer/yarn.lock
@@ -291,10 +291,12 @@ acorn@^7.4.0:
   resolved "https://registry.yarnpkg.com/acorn/-/acorn-7.4.1.tgz#feaed255973d2e77555b83dbc08851a6c63520fa"
   integrity sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A==
 
-agent-base@5:
-  version "5.1.1"
-  resolved "https://registry.yarnpkg.com/agent-base/-/agent-base-5.1.1.tgz#e8fb3f242959db44d63be665db7a8e739537a32c"
-  integrity sha512-TMeqbNl2fMW0nMjTEPOwe3J/PRFP4vqeoNuQMG0HlMrtm5QxKqdvAkZ1pRBQ/ulIyDD5Yq0nJ7YbdD8ey0TO3g==
+agent-base@6:
+  version "6.0.2"
+  resolved "https://registry.yarnpkg.com/agent-base/-/agent-base-6.0.2.tgz#49fff58577cfee3f37176feab4c22e00f86d7f77"
+  integrity sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==
+  dependencies:
+    debug "4"
 
 aggregate-error@^3.0.0:
   version "3.1.0"
@@ -373,7 +375,7 @@ any-observable@^0.3.0:
   resolved "https://registry.yarnpkg.com/any-observable/-/any-observable-0.3.0.tgz#af933475e5806a67d0d7df090dd5e8bef65d119b"
   integrity sha512-/FQM1EDkTsf63Ub2C6O7GuYFDsSXUwsaZDurV0np41ocwq0jthUAYCmhBX9f+KwlaCgIuWyr/4WlUQUBfKfZog==
 
-anymatch@~3.1.1:
+anymatch@~3.1.2:
   version "3.1.2"
   resolved "https://registry.yarnpkg.com/anymatch/-/anymatch-3.1.2.tgz#c0557c096af32f106198f4f4e2a383537e378716"
   integrity sha512-P43ePfOAIupkguHUycrc4qJ9kz8ZiuOUijaETwX7THt0Y/GNK7v0aa8rY816xWjZ7rJdA5XdMcpVFTKMq+RvWg==
@@ -427,11 +429,11 @@ at-least-node@^1.0.0:
   integrity sha512-+q/t7Ekv1EDY2l6Gda6LLiX14rU9TV20Wa3ofeQmwPFZbOMo9DXrLbOjFaaclkXKWidIaopwAObQDqwWtGUjqg==
 
 axios@^0.21.1:
-  version "0.21.1"
-  resolved "https://registry.yarnpkg.com/axios/-/axios-0.21.1.tgz#22563481962f4d6bde9a76d516ef0e5d3c09b2b8"
-  integrity sha512-dKQiRHxGD9PPRIUNIWvZhPTPpl1rf/OxTYKsqKUDjBwYylTvV7SjSHJb9ratfyzM6wCdLCOYLzs73qpg5c4iGA==
+  version "0.21.4"
+  resolved "https://registry.yarnpkg.com/axios/-/axios-0.21.4.tgz#c67b90dc0568e5c1cf2b0b858c43ba28e2eda575"
+  integrity sha512-ut5vewkiu8jjGBdqpM44XxjuCjq9LAKeHVmoVfHVzy8eHgxxq8SbAVQNovDA8mVi05kP0Ea/n/UzcSHcTJQfNg==
   dependencies:
-    follow-redirects "^1.10.0"
+    follow-redirects "^1.14.0"
 
 balanced-match@^1.0.0:
   version "1.0.2"
@@ -570,20 +572,20 @@ chalk@^4.0.0, chalk@^4.1.0:
     ansi-styles "^4.1.0"
     supports-color "^7.1.0"
 
-chokidar@^3.5.1:
-  version "3.5.1"
-  resolved "https://registry.yarnpkg.com/chokidar/-/chokidar-3.5.1.tgz#ee9ce7bbebd2b79f49f304799d5468e31e14e68a"
-  integrity sha512-9+s+Od+W0VJJzawDma/gvBNQqkTiqYTWLuZoyAsivsI4AaWTCzHG06/TMjsf1cYe9Cb97UCEhjz7HvnPk2p/tw==
+chokidar@^3.5.2:
+  version "3.5.2"
+  resolved "https://registry.yarnpkg.com/chokidar/-/chokidar-3.5.2.tgz#dba3976fcadb016f66fd365021d91600d01c1e75"
+  integrity sha512-ekGhOnNVPgT77r4K/U3GDhu+FQ2S8TnK/s2KbIGXi0SZWuwkZ2QNyfWdZW+TVfn84DpEP7rLeCt2UI6bJ8GwbQ==
   dependencies:
-    anymatch "~3.1.1"
+    anymatch "~3.1.2"
     braces "~3.0.2"
-    glob-parent "~5.1.0"
+    glob-parent "~5.1.2"
     is-binary-path "~2.1.0"
     is-glob "~4.0.1"
     normalize-path "~3.0.0"
-    readdirp "~3.5.0"
+    readdirp "~3.6.0"
   optionalDependencies:
-    fsevents "~2.3.1"
+    fsevents "~2.3.2"
 
 chownr@^1.1.1:
   version "1.1.4"
@@ -771,7 +773,7 @@ debug@2.6.9:
   dependencies:
     ms "2.0.0"
 
-debug@4, debug@^4.0.1, debug@^4.1.0, debug@^4.1.1:
+debug@4, debug@4.3.1, debug@^4.0.1, debug@^4.1.1:
   version "4.3.1"
   resolved "https://registry.yarnpkg.com/debug/-/debug-4.3.1.tgz#f0d229c505e0c6d8c49ac553d1b13dc183f6b2ee"
   integrity sha512-doEwdvm4PCeK4K3RQN2ZC2BYUBaxwLARCqZmMjtF8a51J2Rb0xpVloFRnCODwqjpwnAoao4pelN8l3RJdv3gRQ==
@@ -839,6 +841,11 @@ detect-libc@^1.0.3:
   resolved "https://registry.yarnpkg.com/detect-libc/-/detect-libc-1.0.3.tgz#fa137c4bd698edf55cd5cd02ac559f91a4c4ba9b"
   integrity sha1-+hN8S9aY7fVc1c0CrFWfkaTEups=
 
+devtools-protocol@0.0.883894:
+  version "0.0.883894"
+  resolved "https://registry.yarnpkg.com/devtools-protocol/-/devtools-protocol-0.0.883894.tgz#d403f2c75cd6d71c916aee8dde9258da988a4da9"
+  integrity sha512-33idhm54QJzf3Q7QofMgCvIVSd2o9H3kQPWaKT/fhoZh+digc+WSiMhbkeG3iN79WY4Hwr9G05NpbhEVrsOYAg==
+
 dir-glob@^3.0.1:
   version "3.0.1"
   resolved "https://registry.yarnpkg.com/dir-glob/-/dir-glob-3.0.1.tgz#56dbf73d992a4a93ba1584f4534063fd2e41717f"
@@ -1124,7 +1131,7 @@ express@^4.16.3:
     utils-merge "1.0.1"
     vary "~1.1.2"
 
-extract-zip@^2.0.0:
+extract-zip@2.0.1:
   version "2.0.1"
   resolved "https://registry.yarnpkg.com/extract-zip/-/extract-zip-2.0.1.tgz#663dca56fe46df890d5f131ef4a06d22bb8ba13a"
   integrity sha512-GDhU9ntwuKyGXdZBUgTIe+vXnWj0fppUEtMDL0+idd5Sta8TGpHssn/eusA9mrPr9qNDym6SxAYZjNvCn/9RBg==
@@ -1228,6 +1235,14 @@ finalhandler@~1.1.2:
     statuses "~1.5.0"
     unpipe "~1.0.0"
 
+find-up@^4.0.0:
+  version "4.1.0"
+  resolved "https://registry.yarnpkg.com/find-up/-/find-up-4.1.0.tgz#97afe7d6cdc0bc5928584b7c8d7b16e8a9aa5d19"
+  integrity sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==
+  dependencies:
+    locate-path "^5.0.0"
+    path-exists "^4.0.0"
+
 find-up@^5.0.0:
   version "5.0.0"
   resolved "https://registry.yarnpkg.com/find-up/-/find-up-5.0.0.tgz#4c92819ecb7083561e4f4a240a86be5198f536fc"
@@ -1261,10 +1276,10 @@ fn.name@1.x.x:
   resolved "https://registry.yarnpkg.com/fn.name/-/fn.name-1.1.0.tgz#26cad8017967aea8731bc42961d04a3d5988accc"
   integrity sha512-GRnmB5gPyJpAhTQdSZTSp9uaPSvl09KoYcMQtsB9rQoOmzs9dH6ffeccH+Z+cv6P68Hu5bC6JjRh4Ah/mHSNRw==
 
-follow-redirects@^1.10.0:
-  version "1.14.0"
-  resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.14.0.tgz#f5d260f95c5f8c105894491feee5dc8993b402fe"
-  integrity sha512-0vRwd7RKQBTt+mgu87mtYeofLFZpTas2S9zY+jIeuLJMNvudIgF52nr19q40HOwH5RrhWIPuj9puybzSJiRrVg==
+follow-redirects@^1.14.0:
+  version "1.14.3"
+  resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.14.3.tgz#6ada78118d8d24caee595595accdc0ac6abd022e"
+  integrity sha512-3MkHxknWMUtb23apkgz/83fDoe+y+qr0TdgacGIA7bew+QLBo3vdgEN2xEsuXNivpFy4CyDhBBZnNZOtalmenw==
 
 forwarded@~0.1.2:
   version "0.1.2"
@@ -1309,7 +1324,7 @@ fs.realpath@^1.0.0:
   resolved "https://registry.yarnpkg.com/fs.realpath/-/fs.realpath-1.0.0.tgz#1504ad2523158caa40db4a2787cb01411994ea4f"
   integrity sha1-FQStJSMVjKpA20onh8sBQRmU6k8=
 
-fsevents@~2.3.1:
+fsevents@~2.3.2:
   version "2.3.2"
   resolved "https://registry.yarnpkg.com/fsevents/-/fsevents-2.3.2.tgz#8a526f78b8fdf4623b709e0b975c52c24c02fd1a"
   integrity sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==
@@ -1360,7 +1375,7 @@ github-from-package@0.0.0:
   resolved "https://registry.yarnpkg.com/github-from-package/-/github-from-package-0.0.0.tgz#97fb5d96bfde8973313f20e8288ef9a167fa64ce"
   integrity sha1-l/tdlr/eiXMxPyDoKI75oWf6ZM4=
 
-glob-parent@^5.0.0, glob-parent@^5.1.0, glob-parent@~5.1.0:
+glob-parent@^5.0.0, glob-parent@^5.1.0, glob-parent@~5.1.2:
   version "5.1.2"
   resolved "https://registry.yarnpkg.com/glob-parent/-/glob-parent-5.1.2.tgz#869832c58034fe68a4093c17dc15e8340d8401c4"
   integrity sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==
@@ -1480,12 +1495,12 @@ http-errors@~1.7.2:
     statuses ">= 1.5.0 < 2"
     toidentifier "1.0.0"
 
-https-proxy-agent@^4.0.0:
-  version "4.0.0"
-  resolved "https://registry.yarnpkg.com/https-proxy-agent/-/https-proxy-agent-4.0.0.tgz#702b71fb5520a132a66de1f67541d9e62154d82b"
-  integrity sha512-zoDhWrkR3of1l9QAL8/scJZyLu8j/gBkcwcaQOZh7Gyh/+uJQzGVETdgT30akuwkpL8HTRfssqI3BZuV18teDg==
+https-proxy-agent@5.0.0:
+  version "5.0.0"
+  resolved "https://registry.yarnpkg.com/https-proxy-agent/-/https-proxy-agent-5.0.0.tgz#e2a90542abb68a762e0a0850f6c9edadfd8506b2"
+  integrity sha512-EkYm5BcKUGiduxzSt3Eppko+PiNWNEpa4ySk9vTC6wDsQJW9rHSa+UhGNJoRYp7bz6Ht1eaRIa6QaJqO5rCFbA==
   dependencies:
-    agent-base "5"
+    agent-base "6"
     debug "4"
 
 husky@^4.3.8:
@@ -1845,6 +1860,13 @@ listr@^0.14.3:
     p-map "^2.0.0"
     rxjs "^6.3.3"
 
+locate-path@^5.0.0:
+  version "5.0.0"
+  resolved "https://registry.yarnpkg.com/locate-path/-/locate-path-5.0.0.tgz#1afba396afd676a6d42504d0a67a3a7eb9f62aa0"
+  integrity sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==
+  dependencies:
+    p-locate "^4.1.0"
+
 locate-path@^6.0.0:
   version "6.0.0"
   resolved "https://registry.yarnpkg.com/locate-path/-/locate-path-6.0.0.tgz#55321eb309febbc59c4801d931a72452a681d286"
@@ -1978,11 +2000,6 @@ mime@1.6.0:
   resolved "https://registry.yarnpkg.com/mime/-/mime-1.6.0.tgz#32cd9e5c64553bd58d19a568af452acff04981b1"
   integrity sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==
 
-mime@^2.0.3:
-  version "2.5.2"
-  resolved "https://registry.yarnpkg.com/mime/-/mime-2.5.2.tgz#6e3dc6cc2b9510643830e5f19d5cb753da5eeabe"
-  integrity sha512-tqkh47FzKeCPD2PUiPB6pkbMzsCasjxAfC62/Wap5qrUWcb+sFasXUC5I3gYM5iBM8v/Qpn4UK0x+j0iHyFPDg==
-
 mimic-fn@^1.0.0:
   version "1.2.0"
   resolved "https://registry.yarnpkg.com/mimic-fn/-/mimic-fn-1.2.0.tgz#820c86a39334640e99516928bd03fca88057d022"
@@ -2015,6 +2032,13 @@ mkdirp-classic@^0.5.2, mkdirp-classic@^0.5.3:
   resolved "https://registry.yarnpkg.com/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz#fa10c9115cc6d8865be221ba47ee9bed78601113"
   integrity sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==
 
+mkdirp@^0.5.1:
+  version "0.5.5"
+  resolved "https://registry.yarnpkg.com/mkdirp/-/mkdirp-0.5.5.tgz#d91cefd62d1436ca0f41620e251288d420099def"
+  integrity sha512-NKmAlESf6jMGym1++R0Ra7wvhV+wFW63FaSOFPwRahvea0gMUcGUhVeAg/0BC0wiv9ih5NYPB1Wn1UEI1/L+xQ==
+  dependencies:
+    minimist "^1.2.5"
+
 morgan@^1.9.0:
   version "1.10.0"
   resolved "https://registry.yarnpkg.com/morgan/-/morgan-1.10.0.tgz#091778abc1fc47cd3509824653dae1faab6b17d7"
@@ -2081,6 +2105,11 @@ node-cleanup@^2.1.2:
   resolved "https://registry.yarnpkg.com/node-cleanup/-/node-cleanup-2.1.2.tgz#7ac19abd297e09a7f72a71545d951b517e4dde2c"
   integrity sha1-esGavSl+Caf3KnFUXZUbUX5N3iw=
 
+node-fetch@2.6.1:
+  version "2.6.1"
+  resolved "https://registry.yarnpkg.com/node-fetch/-/node-fetch-2.6.1.tgz#045bd323631f76ed2e2b55573394416b639a0052"
+  integrity sha512-V4aYg89jEoVRxRb2fJdAg8FHvI7cEyYdVAh94HH0UIK8oJxUfkjlDQN9RbMx+bEjP7+ggMiFRprSti032Oipxw==
+
 noop-logger@^0.1.1:
   version "0.1.1"
   resolved "https://registry.yarnpkg.com/noop-logger/-/noop-logger-0.1.1.tgz#94a2b1633c4f1317553007d8966fd0e841b6a4c2"
@@ -2197,6 +2226,13 @@ p-is-promise@^3.0.0:
   resolved "https://registry.yarnpkg.com/p-is-promise/-/p-is-promise-3.0.0.tgz#58e78c7dfe2e163cf2a04ff869e7c1dba64a5971"
   integrity sha512-Wo8VsW4IRQSKVXsJCn7TomUaVtyfjVDn3nUP7kE967BQk0CwFpdbZs0X0uk5sW9mkBa9eNM7hCMaG93WUAwxYQ==
 
+p-limit@^2.2.0:
+  version "2.3.0"
+  resolved "https://registry.yarnpkg.com/p-limit/-/p-limit-2.3.0.tgz#3dd33c647a214fdfffd835933eb086da0dc21db1"
+  integrity sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==
+  dependencies:
+    p-try "^2.0.0"
+
 p-limit@^3.0.2:
   version "3.1.0"
   resolved "https://registry.yarnpkg.com/p-limit/-/p-limit-3.1.0.tgz#e1daccbe78d0d1388ca18c64fea38e3e57e3706b"
@@ -2204,6 +2240,13 @@ p-limit@^3.0.2:
   dependencies:
     yocto-queue "^0.1.0"
 
+p-locate@^4.1.0:
+  version "4.1.0"
+  resolved "https://registry.yarnpkg.com/p-locate/-/p-locate-4.1.0.tgz#a3428bb7088b3a60292f66919278b7c297ad4f07"
+  integrity sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==
+  dependencies:
+    p-limit "^2.2.0"
+
 p-locate@^5.0.0:
   version "5.0.0"
   resolved "https://registry.yarnpkg.com/p-locate/-/p-locate-5.0.0.tgz#83c8315c6785005e3bd021839411c9e110e6d834"
@@ -2223,6 +2266,11 @@ p-map@^3.0.0:
   dependencies:
     aggregate-error "^3.0.0"
 
+p-try@^2.0.0:
+  version "2.2.0"
+  resolved "https://registry.yarnpkg.com/p-try/-/p-try-2.2.0.tgz#cb2868540e313d61de58fafbe35ce9004d5540e6"
+  integrity sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==
+
 parent-module@^1.0.0:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/parent-module/-/parent-module-1.0.1.tgz#691d2709e78c79fae3a156622452d00762caaaa2"
@@ -2300,6 +2348,13 @@ picomatch@^2.0.4, picomatch@^2.2.1, picomatch@^2.2.3:
   resolved "https://registry.yarnpkg.com/picomatch/-/picomatch-2.2.3.tgz#465547f359ccc206d3c48e46a1bcb89bf7ee619d"
   integrity sha512-KpELjfwcCDUb9PeigTs2mBJzXUPzAuP2oPcA989He8Rte0+YUAjw1JVedDhuTKPkHjSYzMN3npC9luThGYEKdg==
 
+pkg-dir@4.2.0:
+  version "4.2.0"
+  resolved "https://registry.yarnpkg.com/pkg-dir/-/pkg-dir-4.2.0.tgz#f099133df7ede422e81d1d8448270eeb3e4261f3"
+  integrity sha512-HRDzbaKjC+AOWVXxAU/x54COGeIv9eb+6CkDSQoNTt4XyWoIJvuPsXizxu/Fr23EiekbtZwmh1IcIG/l/a10GQ==
+  dependencies:
+    find-up "^4.0.0"
+
 pkg-dir@^5.0.0:
   version "5.0.0"
   resolved "https://registry.yarnpkg.com/pkg-dir/-/pkg-dir-5.0.0.tgz#a02d6aebe6ba133a928f74aec20bafdfe6b8e760"
@@ -2378,17 +2433,22 @@ prelude-ls@~1.1.2:
   resolved "https://registry.yarnpkg.com/prelude-ls/-/prelude-ls-1.1.2.tgz#21932a549f5e52ffd9a827f570e04be62a97da54"
   integrity sha1-IZMqVJ9eUv/ZqCf1cOBL5iqX2lQ=
 
-prettier@^1.19.1:
-  version "1.19.1"
-  resolved "https://registry.yarnpkg.com/prettier/-/prettier-1.19.1.tgz#f7d7f5ff8a9cd872a7be4ca142095956a60797cb"
-  integrity sha512-s7PoyDv/II1ObgQunCbB9PdLmUcBZcnWOcxDh7O0N/UwDEsHyqkW+Qh28jW+mVuCdx7gLB0BotYI1Y6uI9iyew==
+prettier@2.2.1:
+  version "2.2.1"
+  resolved "https://registry.yarnpkg.com/prettier/-/prettier-2.2.1.tgz#795a1a78dd52f073da0cd42b21f9c91381923ff5"
+  integrity sha512-PqyhM2yCjg/oKkFPtTGUojv7gnZAoG80ttl45O6x2Ug/rMJw4wcc9k6aaf2hibP7BGVCCM33gZoGjyvt9mm16Q==
 
 process-nextick-args@~2.0.0:
   version "2.0.1"
   resolved "https://registry.yarnpkg.com/process-nextick-args/-/process-nextick-args-2.0.1.tgz#7820d9b16120cc55ca9ae7792680ae7dba6d7fe2"
   integrity sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==
 
-progress@^2.0.0, progress@^2.0.1, progress@^2.0.3:
+progress@2.0.1:
+  version "2.0.1"
+  resolved "https://registry.yarnpkg.com/progress/-/progress-2.0.1.tgz#c9242169342b1c29d275889c95734621b1952e31"
+  integrity sha512-OE+a6vzqazc+K6LxJrX5UPyKFvGnL5CYmq2jFGNIBWHpc4QyE49/YOumcrpQFJpfejmvRtbJzgO1zPmMCqlbBg==
+
+progress@^2.0.0, progress@^2.0.3:
   version "2.0.3"
   resolved "https://registry.yarnpkg.com/progress/-/progress-2.0.3.tgz#7e8cf8d8f5b8f239c1bc68beb4eb78567d572ef8"
   integrity sha512-7PiHtLll5LdnKIMw100I+8xJXR5gW2QwWYkT6iJva0bXitZKa/XMrSbdmg3r2Xnaidz9Qumd0VPaMrZlF9V9sA==
@@ -2427,7 +2487,7 @@ proxy-addr@~2.0.5:
     forwarded "~0.1.2"
     ipaddr.js "1.9.1"
 
-proxy-from-env@^1.0.0:
+proxy-from-env@1.1.0:
   version "1.1.0"
   resolved "https://registry.yarnpkg.com/proxy-from-env/-/proxy-from-env-1.1.0.tgz#e102f16ca355424865755d2c9e8ea4f24d58c3e2"
   integrity sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==
@@ -2459,21 +2519,23 @@ puppeteer-cluster@^0.22.0:
   dependencies:
     debug "^4.1.1"
 
-puppeteer@^3.3.0:
-  version "3.3.0"
-  resolved "https://registry.yarnpkg.com/puppeteer/-/puppeteer-3.3.0.tgz#95839af9fdc0aa4de7e5ee073a4c0adeb9e2d3d7"
-  integrity sha512-23zNqRltZ1PPoK28uRefWJ/zKb5Jhnzbbwbpcna2o5+QMn17F0khq5s1bdH3vPlyj+J36pubccR8wiNA/VE0Vw==
-  dependencies:
-    debug "^4.1.0"
-    extract-zip "^2.0.0"
-    https-proxy-agent "^4.0.0"
-    mime "^2.0.3"
-    progress "^2.0.1"
-    proxy-from-env "^1.0.0"
-    rimraf "^3.0.2"
-    tar-fs "^2.0.0"
-    unbzip2-stream "^1.3.3"
-    ws "^7.2.3"
+puppeteer@^10.0.0:
+  version "10.0.0"
+  resolved "https://registry.yarnpkg.com/puppeteer/-/puppeteer-10.0.0.tgz#1b597c956103e2d989ca17f41ba4693b20a3640c"
+  integrity sha512-AxHvCb9IWmmP3gMW+epxdj92Gglii+6Z4sb+W+zc2hTTu10HF0yg6hGXot5O74uYkVqG3lfDRLfnRpi6WOwi5A==
+  dependencies:
+    debug "4.3.1"
+    devtools-protocol "0.0.883894"
+    extract-zip "2.0.1"
+    https-proxy-agent "5.0.0"
+    node-fetch "2.6.1"
+    pkg-dir "4.2.0"
+    progress "2.0.1"
+    proxy-from-env "1.1.0"
+    rimraf "3.0.2"
+    tar-fs "2.0.0"
+    unbzip2-stream "1.3.3"
+    ws "7.4.6"
 
 qs@6.7.0:
   version "6.7.0"
@@ -2532,10 +2594,10 @@ readable-stream@^3.1.1, readable-stream@^3.4.0, readable-stream@^3.6.0:
     string_decoder "^1.1.1"
     util-deprecate "^1.0.1"
 
-readdirp@~3.5.0:
-  version "3.5.0"
-  resolved "https://registry.yarnpkg.com/readdirp/-/readdirp-3.5.0.tgz#9ba74c019b15d365278d2e91bb8c48d7b4d42c9e"
-  integrity sha512-cMhu7c/8rdhkHXWsY+osBhfSy0JikwpHK/5+imo+LpeasTF8ouErHrlYkwT0++njiyuDvc7OFY5T3ukvZ8qmFQ==
+readdirp@~3.6.0:
+  version "3.6.0"
+  resolved "https://registry.yarnpkg.com/readdirp/-/readdirp-3.6.0.tgz#74a370bd857116e245b29cc97340cd431a02a6c7"
+  integrity sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==
   dependencies:
     picomatch "^2.2.1"
 
@@ -2585,7 +2647,7 @@ reusify@^1.0.4:
   resolved "https://registry.yarnpkg.com/reusify/-/reusify-1.0.4.tgz#90da382b1e126efc02146e90845a88db12925d76"
   integrity sha512-U9nH88a3fc/ekCF1l0/UP1IosiuIjyTh7hBvXVMHYgVcfGvt897Xguj2UOLDeI5BG2m7/uwyaLVT6fbtCwTyzw==
 
-rimraf@^3.0.0, rimraf@^3.0.2:
+rimraf@3.0.2, rimraf@^3.0.0, rimraf@^3.0.2:
   version "3.0.2"
   resolved "https://registry.yarnpkg.com/rimraf/-/rimraf-3.0.2.tgz#f1a5402ba6220ad52cc1282bac1ae3aa49fd061a"
   integrity sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA==
@@ -2912,6 +2974,16 @@ table@^6.0.4:
     string-width "^4.2.0"
     strip-ansi "^6.0.0"
 
+tar-fs@2.0.0:
+  version "2.0.0"
+  resolved "https://registry.yarnpkg.com/tar-fs/-/tar-fs-2.0.0.tgz#677700fc0c8b337a78bee3623fdc235f21d7afad"
+  integrity sha512-vaY0obB6Om/fso8a8vakQBzwholQ7v5+uy+tF3Ozvxv1KNezmVQAiWtcNmMHFSFPqL3dJA8ha6gdtFbfX9mcxA==
+  dependencies:
+    chownr "^1.1.1"
+    mkdirp "^0.5.1"
+    pump "^3.0.0"
+    tar-stream "^2.0.0"
+
 tar-fs@^2.0.0:
   version "2.1.1"
   resolved "https://registry.yarnpkg.com/tar-fs/-/tar-fs-2.1.1.tgz#489a15ab85f1f0befabb370b7de4f9eb5cbe8784"
@@ -2922,7 +2994,7 @@ tar-fs@^2.0.0:
     pump "^3.0.0"
     tar-stream "^2.1.4"
 
-tar-stream@^2.1.4:
+tar-stream@^2.0.0, tar-stream@^2.1.4:
   version "2.2.0"
   resolved "https://registry.yarnpkg.com/tar-stream/-/tar-stream-2.2.0.tgz#acad84c284136b060dc3faa64474aa9aebd77287"
   integrity sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==
@@ -3037,15 +3109,15 @@ type-is@~1.6.17, type-is@~1.6.18:
     media-typer "0.3.0"
     mime-types "~2.1.24"
 
-typescript@^3.8.3:
-  version "3.9.9"
-  resolved "https://registry.yarnpkg.com/typescript/-/typescript-3.9.9.tgz#e69905c54bc0681d0518bd4d587cc6f2d0b1a674"
-  integrity sha512-kdMjTiekY+z/ubJCATUPlRDl39vXYiMV9iyeMuEuXZh2we6zz80uovNN2WlAxmmdE/Z/YQe+EbOEXB5RHEED3w==
+typescript@^4.3.2:
+  version "4.3.2"
+  resolved "https://registry.yarnpkg.com/typescript/-/typescript-4.3.2.tgz#399ab18aac45802d6f2498de5054fcbbe716a805"
+  integrity sha512-zZ4hShnmnoVnAHpVHWpTcxdv7dWP60S2FsydQLV8V5PbS3FifjWFFRiHSWpDJahly88PRyV5teTSLoq4eG7mKw==
 
-unbzip2-stream@^1.3.3:
-  version "1.4.3"
-  resolved "https://registry.yarnpkg.com/unbzip2-stream/-/unbzip2-stream-1.4.3.tgz#b0da04c4371311df771cdc215e87f2130991ace7"
-  integrity sha512-mlExGW4w71ebDJviH16lQLtZS32VKqsSfk80GCfUlwT/4/hNRFsoscrF/c++9xinkMzECL1uL9DDwXqFWkruPg==
+unbzip2-stream@1.3.3:
+  version "1.3.3"
+  resolved "https://registry.yarnpkg.com/unbzip2-stream/-/unbzip2-stream-1.3.3.tgz#d156d205e670d8d8c393e1c02ebd506422873f6a"
+  integrity sha512-fUlAF7U9Ah1Q6EieQ4x4zLNejrRvDWUYmxXUpN3uziFYCHapjWFaCAnreY9bGgxzaMCFAPPpYNng57CypwJVhg==
   dependencies:
     buffer "^5.2.1"
     through "^2.3.8"
@@ -3175,7 +3247,7 @@ wrappy@1:
   resolved "https://registry.yarnpkg.com/wrappy/-/wrappy-1.0.2.tgz#b5243d8f3ec1aa35f1364605bc0d1036e30ab69f"
   integrity sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8=
 
-ws@^7.2.3:
+ws@7.4.6:
   version "7.4.6"
   resolved "https://registry.yarnpkg.com/ws/-/ws-7.4.6.tgz#5654ca8ecdeee47c33a9a4bf6d28e2be2980377c"
   integrity sha512-YmhHDO4MzaDLB+M9ym/mDA5z0naX8j7SIlT8f8z+I0VtzsRbekxEutHSme7NPS2qE8StCYQNUnfWdXta/Yu85A==
diff --git a/pkgs/servers/monitoring/grafana-image-renderer/yarn.nix b/pkgs/servers/monitoring/grafana-image-renderer/yarn.nix
index 5cec9f36ef289..dcf5351e45bdb 100644
--- a/pkgs/servers/monitoring/grafana-image-renderer/yarn.nix
+++ b/pkgs/servers/monitoring/grafana-image-renderer/yarn.nix
@@ -354,11 +354,11 @@
       };
     }
     {
-      name = "agent_base___agent_base_5.1.1.tgz";
+      name = "agent_base___agent_base_6.0.2.tgz";
       path = fetchurl {
-        name = "agent_base___agent_base_5.1.1.tgz";
-        url  = "https://registry.yarnpkg.com/agent-base/-/agent-base-5.1.1.tgz";
-        sha1 = "e8fb3f242959db44d63be665db7a8e739537a32c";
+        name = "agent_base___agent_base_6.0.2.tgz";
+        url  = "https://registry.yarnpkg.com/agent-base/-/agent-base-6.0.2.tgz";
+        sha1 = "49fff58577cfee3f37176feab4c22e00f86d7f77";
       };
     }
     {
@@ -530,11 +530,11 @@
       };
     }
     {
-      name = "axios___axios_0.21.1.tgz";
+      name = "axios___axios_0.21.4.tgz";
       path = fetchurl {
-        name = "axios___axios_0.21.1.tgz";
-        url  = "https://registry.yarnpkg.com/axios/-/axios-0.21.1.tgz";
-        sha1 = "22563481962f4d6bde9a76d516ef0e5d3c09b2b8";
+        name = "axios___axios_0.21.4.tgz";
+        url  = "https://registry.yarnpkg.com/axios/-/axios-0.21.4.tgz";
+        sha1 = "c67b90dc0568e5c1cf2b0b858c43ba28e2eda575";
       };
     }
     {
@@ -690,11 +690,11 @@
       };
     }
     {
-      name = "chokidar___chokidar_3.5.1.tgz";
+      name = "chokidar___chokidar_3.5.2.tgz";
       path = fetchurl {
-        name = "chokidar___chokidar_3.5.1.tgz";
-        url  = "https://registry.yarnpkg.com/chokidar/-/chokidar-3.5.1.tgz";
-        sha1 = "ee9ce7bbebd2b79f49f304799d5468e31e14e68a";
+        name = "chokidar___chokidar_3.5.2.tgz";
+        url  = "https://registry.yarnpkg.com/chokidar/-/chokidar-3.5.2.tgz";
+        sha1 = "dba3976fcadb016f66fd365021d91600d01c1e75";
       };
     }
     {
@@ -1018,6 +1018,14 @@
       };
     }
     {
+      name = "devtools_protocol___devtools_protocol_0.0.883894.tgz";
+      path = fetchurl {
+        name = "devtools_protocol___devtools_protocol_0.0.883894.tgz";
+        url  = "https://registry.yarnpkg.com/devtools-protocol/-/devtools-protocol-0.0.883894.tgz";
+        sha1 = "d403f2c75cd6d71c916aee8dde9258da988a4da9";
+      };
+    }
+    {
       name = "dir_glob___dir_glob_3.0.1.tgz";
       path = fetchurl {
         name = "dir_glob___dir_glob_3.0.1.tgz";
@@ -1394,6 +1402,14 @@
       };
     }
     {
+      name = "find_up___find_up_4.1.0.tgz";
+      path = fetchurl {
+        name = "find_up___find_up_4.1.0.tgz";
+        url  = "https://registry.yarnpkg.com/find-up/-/find-up-4.1.0.tgz";
+        sha1 = "97afe7d6cdc0bc5928584b7c8d7b16e8a9aa5d19";
+      };
+    }
+    {
       name = "find_up___find_up_5.0.0.tgz";
       path = fetchurl {
         name = "find_up___find_up_5.0.0.tgz";
@@ -1434,11 +1450,11 @@
       };
     }
     {
-      name = "follow_redirects___follow_redirects_1.14.0.tgz";
+      name = "follow_redirects___follow_redirects_1.14.3.tgz";
       path = fetchurl {
-        name = "follow_redirects___follow_redirects_1.14.0.tgz";
-        url  = "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.14.0.tgz";
-        sha1 = "f5d260f95c5f8c105894491feee5dc8993b402fe";
+        name = "follow_redirects___follow_redirects_1.14.3.tgz";
+        url  = "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.14.3.tgz";
+        sha1 = "6ada78118d8d24caee595595accdc0ac6abd022e";
       };
     }
     {
@@ -1682,11 +1698,11 @@
       };
     }
     {
-      name = "https_proxy_agent___https_proxy_agent_4.0.0.tgz";
+      name = "https_proxy_agent___https_proxy_agent_5.0.0.tgz";
       path = fetchurl {
-        name = "https_proxy_agent___https_proxy_agent_4.0.0.tgz";
-        url  = "https://registry.yarnpkg.com/https-proxy-agent/-/https-proxy-agent-4.0.0.tgz";
-        sha1 = "702b71fb5520a132a66de1f67541d9e62154d82b";
+        name = "https_proxy_agent___https_proxy_agent_5.0.0.tgz";
+        url  = "https://registry.yarnpkg.com/https-proxy-agent/-/https-proxy-agent-5.0.0.tgz";
+        sha1 = "e2a90542abb68a762e0a0850f6c9edadfd8506b2";
       };
     }
     {
@@ -2122,6 +2138,14 @@
       };
     }
     {
+      name = "locate_path___locate_path_5.0.0.tgz";
+      path = fetchurl {
+        name = "locate_path___locate_path_5.0.0.tgz";
+        url  = "https://registry.yarnpkg.com/locate-path/-/locate-path-5.0.0.tgz";
+        sha1 = "1afba396afd676a6d42504d0a67a3a7eb9f62aa0";
+      };
+    }
+    {
       name = "locate_path___locate_path_6.0.0.tgz";
       path = fetchurl {
         name = "locate_path___locate_path_6.0.0.tgz";
@@ -2298,14 +2322,6 @@
       };
     }
     {
-      name = "mime___mime_2.5.2.tgz";
-      path = fetchurl {
-        name = "mime___mime_2.5.2.tgz";
-        url  = "https://registry.yarnpkg.com/mime/-/mime-2.5.2.tgz";
-        sha1 = "6e3dc6cc2b9510643830e5f19d5cb753da5eeabe";
-      };
-    }
-    {
       name = "mimic_fn___mimic_fn_1.2.0.tgz";
       path = fetchurl {
         name = "mimic_fn___mimic_fn_1.2.0.tgz";
@@ -2354,6 +2370,14 @@
       };
     }
     {
+      name = "mkdirp___mkdirp_0.5.5.tgz";
+      path = fetchurl {
+        name = "mkdirp___mkdirp_0.5.5.tgz";
+        url  = "https://registry.yarnpkg.com/mkdirp/-/mkdirp-0.5.5.tgz";
+        sha1 = "d91cefd62d1436ca0f41620e251288d420099def";
+      };
+    }
+    {
       name = "morgan___morgan_1.10.0.tgz";
       path = fetchurl {
         name = "morgan___morgan_1.10.0.tgz";
@@ -2442,6 +2466,14 @@
       };
     }
     {
+      name = "node_fetch___node_fetch_2.6.1.tgz";
+      path = fetchurl {
+        name = "node_fetch___node_fetch_2.6.1.tgz";
+        url  = "https://registry.yarnpkg.com/node-fetch/-/node-fetch-2.6.1.tgz";
+        sha1 = "045bd323631f76ed2e2b55573394416b639a0052";
+      };
+    }
+    {
       name = "noop_logger___noop_logger_0.1.1.tgz";
       path = fetchurl {
         name = "noop_logger___noop_logger_0.1.1.tgz";
@@ -2578,6 +2610,14 @@
       };
     }
     {
+      name = "p_limit___p_limit_2.3.0.tgz";
+      path = fetchurl {
+        name = "p_limit___p_limit_2.3.0.tgz";
+        url  = "https://registry.yarnpkg.com/p-limit/-/p-limit-2.3.0.tgz";
+        sha1 = "3dd33c647a214fdfffd835933eb086da0dc21db1";
+      };
+    }
+    {
       name = "p_limit___p_limit_3.1.0.tgz";
       path = fetchurl {
         name = "p_limit___p_limit_3.1.0.tgz";
@@ -2586,6 +2626,14 @@
       };
     }
     {
+      name = "p_locate___p_locate_4.1.0.tgz";
+      path = fetchurl {
+        name = "p_locate___p_locate_4.1.0.tgz";
+        url  = "https://registry.yarnpkg.com/p-locate/-/p-locate-4.1.0.tgz";
+        sha1 = "a3428bb7088b3a60292f66919278b7c297ad4f07";
+      };
+    }
+    {
       name = "p_locate___p_locate_5.0.0.tgz";
       path = fetchurl {
         name = "p_locate___p_locate_5.0.0.tgz";
@@ -2610,6 +2658,14 @@
       };
     }
     {
+      name = "p_try___p_try_2.2.0.tgz";
+      path = fetchurl {
+        name = "p_try___p_try_2.2.0.tgz";
+        url  = "https://registry.yarnpkg.com/p-try/-/p-try-2.2.0.tgz";
+        sha1 = "cb2868540e313d61de58fafbe35ce9004d5540e6";
+      };
+    }
+    {
       name = "parent_module___parent_module_1.0.1.tgz";
       path = fetchurl {
         name = "parent_module___parent_module_1.0.1.tgz";
@@ -2714,6 +2770,14 @@
       };
     }
     {
+      name = "pkg_dir___pkg_dir_4.2.0.tgz";
+      path = fetchurl {
+        name = "pkg_dir___pkg_dir_4.2.0.tgz";
+        url  = "https://registry.yarnpkg.com/pkg-dir/-/pkg-dir-4.2.0.tgz";
+        sha1 = "f099133df7ede422e81d1d8448270eeb3e4261f3";
+      };
+    }
+    {
       name = "pkg_dir___pkg_dir_5.0.0.tgz";
       path = fetchurl {
         name = "pkg_dir___pkg_dir_5.0.0.tgz";
@@ -2770,11 +2834,11 @@
       };
     }
     {
-      name = "prettier___prettier_1.19.1.tgz";
+      name = "prettier___prettier_2.2.1.tgz";
       path = fetchurl {
-        name = "prettier___prettier_1.19.1.tgz";
-        url  = "https://registry.yarnpkg.com/prettier/-/prettier-1.19.1.tgz";
-        sha1 = "f7d7f5ff8a9cd872a7be4ca142095956a60797cb";
+        name = "prettier___prettier_2.2.1.tgz";
+        url  = "https://registry.yarnpkg.com/prettier/-/prettier-2.2.1.tgz";
+        sha1 = "795a1a78dd52f073da0cd42b21f9c91381923ff5";
       };
     }
     {
@@ -2786,6 +2850,14 @@
       };
     }
     {
+      name = "progress___progress_2.0.1.tgz";
+      path = fetchurl {
+        name = "progress___progress_2.0.1.tgz";
+        url  = "https://registry.yarnpkg.com/progress/-/progress-2.0.1.tgz";
+        sha1 = "c9242169342b1c29d275889c95734621b1952e31";
+      };
+    }
+    {
       name = "progress___progress_2.0.3.tgz";
       path = fetchurl {
         name = "progress___progress_2.0.3.tgz";
@@ -2858,11 +2930,11 @@
       };
     }
     {
-      name = "puppeteer___puppeteer_3.3.0.tgz";
+      name = "puppeteer___puppeteer_10.0.0.tgz";
       path = fetchurl {
-        name = "puppeteer___puppeteer_3.3.0.tgz";
-        url  = "https://registry.yarnpkg.com/puppeteer/-/puppeteer-3.3.0.tgz";
-        sha1 = "95839af9fdc0aa4de7e5ee073a4c0adeb9e2d3d7";
+        name = "puppeteer___puppeteer_10.0.0.tgz";
+        url  = "https://registry.yarnpkg.com/puppeteer/-/puppeteer-10.0.0.tgz";
+        sha1 = "1b597c956103e2d989ca17f41ba4693b20a3640c";
       };
     }
     {
@@ -2922,11 +2994,11 @@
       };
     }
     {
-      name = "readdirp___readdirp_3.5.0.tgz";
+      name = "readdirp___readdirp_3.6.0.tgz";
       path = fetchurl {
-        name = "readdirp___readdirp_3.5.0.tgz";
-        url  = "https://registry.yarnpkg.com/readdirp/-/readdirp-3.5.0.tgz";
-        sha1 = "9ba74c019b15d365278d2e91bb8c48d7b4d42c9e";
+        name = "readdirp___readdirp_3.6.0.tgz";
+        url  = "https://registry.yarnpkg.com/readdirp/-/readdirp-3.6.0.tgz";
+        sha1 = "74a370bd857116e245b29cc97340cd431a02a6c7";
       };
     }
     {
@@ -3386,6 +3458,14 @@
       };
     }
     {
+      name = "tar_fs___tar_fs_2.0.0.tgz";
+      path = fetchurl {
+        name = "tar_fs___tar_fs_2.0.0.tgz";
+        url  = "https://registry.yarnpkg.com/tar-fs/-/tar-fs-2.0.0.tgz";
+        sha1 = "677700fc0c8b337a78bee3623fdc235f21d7afad";
+      };
+    }
+    {
       name = "tar_fs___tar_fs_2.1.1.tgz";
       path = fetchurl {
         name = "tar_fs___tar_fs_2.1.1.tgz";
@@ -3538,19 +3618,19 @@
       };
     }
     {
-      name = "typescript___typescript_3.9.9.tgz";
+      name = "typescript___typescript_4.3.2.tgz";
       path = fetchurl {
-        name = "typescript___typescript_3.9.9.tgz";
-        url  = "https://registry.yarnpkg.com/typescript/-/typescript-3.9.9.tgz";
-        sha1 = "e69905c54bc0681d0518bd4d587cc6f2d0b1a674";
+        name = "typescript___typescript_4.3.2.tgz";
+        url  = "https://registry.yarnpkg.com/typescript/-/typescript-4.3.2.tgz";
+        sha1 = "399ab18aac45802d6f2498de5054fcbbe716a805";
       };
     }
     {
-      name = "unbzip2_stream___unbzip2_stream_1.4.3.tgz";
+      name = "unbzip2_stream___unbzip2_stream_1.3.3.tgz";
       path = fetchurl {
-        name = "unbzip2_stream___unbzip2_stream_1.4.3.tgz";
-        url  = "https://registry.yarnpkg.com/unbzip2-stream/-/unbzip2-stream-1.4.3.tgz";
-        sha1 = "b0da04c4371311df771cdc215e87f2130991ace7";
+        name = "unbzip2_stream___unbzip2_stream_1.3.3.tgz";
+        url  = "https://registry.yarnpkg.com/unbzip2-stream/-/unbzip2-stream-1.3.3.tgz";
+        sha1 = "d156d205e670d8d8c393e1c02ebd506422873f6a";
       };
     }
     {
diff --git a/pkgs/tools/misc/starship/default.nix b/pkgs/tools/misc/starship/default.nix
index 7ad62ab9d2e07..5202527b8c0dc 100644
--- a/pkgs/tools/misc/starship/default.nix
+++ b/pkgs/tools/misc/starship/default.nix
@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "starship";
-  version = "0.57.0";
+  version = "0.58.0";
 
   src = fetchFromGitHub {
     owner = "starship";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-cxTBK6eZTlqEaVfWYARQk6BjNuANy39eaXC6qFs/+6k=";
+    sha256 = "sha256-s84fIpCyTF7FrJZGATjIJHt/+aknlhlz1V9s+c4f+Ig=";
   };
 
   nativeBuildInputs = [ installShellFiles ] ++ lib.optionals stdenv.isLinux [ pkg-config ];
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage rec {
     done
   '';
 
-  cargoSha256 = "sha256-TFHRDgIxqJCkcSwpdbcx8vguKU1QuTyslmAsRznxt2s=";
+  cargoSha256 = "sha256-5YOF0nXn4rdp3uxatzdvaqdAbLlHK6nq5H4+ZX/7joM=";
 
   preCheck = ''
     HOME=$TMPDIR
diff --git a/pkgs/tools/misc/sysz/default.nix b/pkgs/tools/misc/sysz/default.nix
new file mode 100644
index 0000000000000..4f5f90d04b0e1
--- /dev/null
+++ b/pkgs/tools/misc/sysz/default.nix
@@ -0,0 +1,33 @@
+{ lib, stdenvNoCC, fetchFromGitHub, makeWrapper, fzf, gawk }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "sysz";
+  version = "1.3.0";
+
+  src = fetchFromGitHub {
+    owner = "joehillen";
+    repo = pname;
+    rev = version;
+    sha256 = "HNwsYE1Cv90IDi3A5PmRv3uHANR3ya+VOGBQ3+zkBLM=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 sysz $out/libexec/sysz
+    makeWrapper $out/libexec/sysz $out/bin/sysz \
+      --prefix PATH : ${lib.makeBinPath [ fzf gawk ]}
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/joehillen/sysz";
+    description = "A fzf terminal UI for systemctl";
+    license = licenses.unlicense;
+    maintainers = with maintainers; [ hleboulanger ];
+    platforms = platforms.unix;
+    changelog = "https://github.com/joehillen/sysz/blob/${version}/CHANGELOG.md";
+  };
+}
diff --git a/pkgs/tools/networking/bitmask-vpn/default.nix b/pkgs/tools/networking/bitmask-vpn/default.nix
new file mode 100644
index 0000000000000..35f2e801f5316
--- /dev/null
+++ b/pkgs/tools/networking/bitmask-vpn/default.nix
@@ -0,0 +1,168 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, mkDerivation
+, buildGoModule
+, wrapQtAppsHook
+, python3Packages
+, pkg-config
+, openvpn
+, cmake
+, qmake
+, which
+, iproute2
+, iptables
+, procps
+, qmltermwidget
+, qtbase
+, qtdeclarative
+, qtinstaller
+, qtquickcontrols
+, qtquickcontrols2
+, qttools
+, CoreFoundation
+, Security
+, provider ? "riseup"
+}:
+let
+  version = "0.21.6";
+
+  src = fetchFromGitLab {
+    domain = "0xacab.org";
+    owner = "leap";
+    repo = "bitmask-vpn";
+    rev = version;
+    sha256 = "sha256-LMz+ZgQVFGujoLA8rlyZ3VnW/NSlPipD5KwCe+cFtnY=";
+  };
+
+  # bitmask-root is only used on GNU/Linux
+  # and may one day be replaced by pkg/helper
+  bitmask-root = mkDerivation {
+    inherit src version;
+    sourceRoot = "source/helpers";
+    pname = "bitmask-root";
+    nativeBuildInputs = [ python3Packages.wrapPython ];
+    postPatch = ''
+      substituteInPlace bitmask-root \
+        --replace 'swhich("ip")' '"${iproute2}/bin/ip"' \
+        --replace 'swhich("iptables")' '"${iptables}/bin/iptables"' \
+        --replace 'swhich("ip6tables")' '"${iptables}/bin/ip6tables"' \
+        --replace 'swhich("sysctl")' '"${procps}/bin/sysctl"' \
+        --replace /usr/sbin/openvpn ${openvpn}/bin/openvpn
+      substituteInPlace se.leap.bitmask.policy \
+        --replace /usr/sbin/bitmask-root $out/bin/bitmask-root
+    '';
+    installPhase = ''
+      runHook preInstall
+
+      install -m 755 -D -t $out/bin bitmask-root
+      install -m 444 -D -t $out/share/polkit-1/actions se.leap.bitmask.policy
+      wrapPythonPrograms
+
+      runHook postInstall
+    '';
+  };
+in
+
+buildGoModule rec {
+  inherit src version;
+  pname = "${provider}-vpn";
+  vendorSha256 = null;
+
+  postPatch = ''
+    substituteInPlace pkg/pickle/helpers.go \
+      --replace /usr/share $out/share
+
+    # Using $PROVIDER is not working,
+    # thus replacing directly into the vendor.conf
+    substituteInPlace providers/vendor.conf \
+      --replace "provider = riseup" "provider = ${provider}"
+
+    patchShebangs gui/build.sh
+    wrapPythonProgramsIn branding/scripts
+  '' + lib.optionalString stdenv.isLinux ''
+    substituteInPlace pkg/helper/linux.go \
+      --replace /usr/sbin/openvpn ${openvpn}/bin/openvpn
+    substituteInPlace pkg/vpn/launcher_linux.go \
+      --replace /usr/sbin/openvpn ${openvpn}/bin/openvpn \
+      --replace /usr/sbin/bitmask-root ${bitmask-root}/bin/bitmask-root \
+      --replace /usr/bin/lxpolkit /run/wrappers/bin/polkit-agent-helper-1 \
+      --replace '"polkit-gnome-authentication-agent-1",' '"polkit-gnome-authentication-agent-1","polkitd",'
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    python3Packages.wrapPython
+    qmake
+    qtquickcontrols
+    qtquickcontrols2
+    qttools
+    which
+    wrapQtAppsHook
+  ] ++ lib.optional (!stdenv.isLinux) qtinstaller;
+
+  buildInputs = [
+    qtbase
+    qmltermwidget
+    qtdeclarative
+  ] ++ lib.optionals stdenv.isDarwin [ CoreFoundation Security ];
+  # FIXME: building on Darwin currently fails
+  # due to missing debug symbols for Qt,
+  # this should be fixable once darwin.apple_sdk >= 10.13
+  # See https://bugreports.qt.io/browse/QTBUG-76777
+
+  # Not using buildGoModule's buildPhase:
+  # gui/build.sh will build Go modules into lib/libgoshim.a
+  buildPhase = ''
+    runHook preBuild
+
+    make gen_providers_json
+    make generate
+    # Remove timestamps in comments
+    sed -i -e '/^\/\//d' pkg/config/version/version.go
+
+    # Not using -j$NIX_BUILD_CORES because the Makefile's rules
+    # are not thread-safe: lib/libgoshim.h is used before being built.
+    make build
+
+    runHook postBuild
+  '';
+
+  postInstall = ''
+    install -m 755 -D -t $out/bin build/qt/release/${provider}-vpn
+
+    VERSION=${version} VENDOR_PATH=providers branding/scripts/generate-debian branding/templates/debian/data.json
+    (cd branding/templates/debian && ${python3Packages.python}/bin/python3 generate.py)
+    install -m 444 -D branding/templates/debian/app.desktop $out/share/applications/${provider}-vpn.desktop
+  '' + lib.optionalString stdenv.isLinux ''
+    install -m 444 -D -t $out/share/polkit-1/actions ${bitmask-root}/share/polkit-1/actions/se.leap.bitmask.policy
+  '';
+
+  # Some tests need access to the Internet:
+  # Post "https://api.black.riseup.net/3/cert": dial tcp: lookup api.black.riseup.net on [::1]:53: read udp [::1]:56553->[::1]:53: read: connection refused
+  doCheck = false;
+
+  passthru = { inherit bitmask-root; };
+
+  meta = {
+    description = "Generic VPN client by LEAP";
+    longDescription = ''
+      Bitmask, by LEAP (LEAP Encryption Access Project),
+      is an application to provide easy and secure encrypted communication
+      with a VPN (Virtual Private Network). It allows you to select from
+      a variety of trusted service provider all from one app.
+      Current providers include Riseup Networks
+      and The Calyx Institute, where the former is default.
+      The <literal>${provider}-vpn</literal> executable should appear
+      in your desktop manager's XDG menu or could be launch in a terminal
+      to get an execution log. A new icon should then appear in your systray
+      to control the VPN and configure some options.
+    '';
+    homepage = "https://bitmask.net";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ julm ];
+    # darwin requires apple_sdk >= 10.13
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/tools/security/cosign/default.nix b/pkgs/tools/security/cosign/default.nix
index 329040a4dba9d..64e64e3854bf1 100644
--- a/pkgs/tools/security/cosign/default.nix
+++ b/pkgs/tools/security/cosign/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cosign";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-KiXcAuww0dZ78ilRp7j0JX6VAbOvmfd9h+LrOjrKaJo=";
+    sha256 = "sha256-peR/TPydR4O6kGkRUpOgUCJ7xGRLbl9pYB1lAehjVK4=";
   };
 
   buildInputs =
@@ -17,13 +17,13 @@ buildGoModule rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  vendorSha256 = "sha256-yrUfSRCwoxoH2sM5KuApaIj7YF7SPXx9vTlXS+pA5CY=";
+  vendorSha256 = "sha256-DyRMQ43BJOkDtWEqmAzqICyaSyQJ9H4i69VJ4dCGF44=";
 
   excludedPackages = "\\(copasetic\\|sample\\|webhook\\)";
 
   tags = lib.optionals pivKeySupport [ "pivkey" ];
 
-  ldflags = [ "-s" "-w" "-X github.com/sigstore/cosign/cmd/cosign/cli.gitVersion=v${version}" ];
+  ldflags = [ "-s" "-w" "-X github.com/sigstore/cosign/cmd/cosign/cli.GitVersion=v${version}" ];
 
   meta = with lib; {
     homepage = "https://github.com/sigstore/cosign";
diff --git a/pkgs/tools/text/hck/default.nix b/pkgs/tools/text/hck/default.nix
index ede4746e1d0bc..c17488bf67ac6 100644
--- a/pkgs/tools/text/hck/default.nix
+++ b/pkgs/tools/text/hck/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hck";
-  version = "0.6.4";
+  version = "0.6.5";
 
   src = fetchFromGitHub {
     owner = "sstadick";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-nEWU4L1704g+0QNCOHEWDrw5U587RLv+WG6v9/5E650=";
+    sha256 = "sha256-+gBxZCBJmwe92DhfVorkfXsjpjkgm7JO/p/SHta9ly8=";
   };
 
-  cargoSha256 = "sha256-JSnikt00yOcIB6CuLUgphRS9JTMWo3MtAOya4M9E6kI=";
+  cargoSha256 = "sha256-lAKMaUrXjplh5YhMZuLhTNDQBzDPHCfFrELHicwgi6U=";
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1fa00442cdfc6..30052be30dba3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -449,10 +449,12 @@ with pkgs;
 
   fetchfossil = callPackage ../build-support/fetchfossil { };
 
-  fetchgit = callPackage ../build-support/fetchgit {
+  fetchgit = (callPackage ../build-support/fetchgit {
     git = buildPackages.gitMinimal;
     cacert = buildPackages.cacert;
     git-lfs = buildPackages.git-lfs;
+  }) // { # fetchgit is a function, so we use // instead of passthru.
+    tests = callPackages ../build-support/fetchgit/tests.nix {};
   };
 
   fetchgitLocal = callPackage ../build-support/fetchgitlocal { };
@@ -602,6 +604,15 @@ with pkgs;
 
   installShellFiles = callPackage ../build-support/install-shell-files {};
 
+  # See doc/builders/special/invalidateFetcherByDrvHash.section.md or
+  # https://nixos.org/manual/nixpkgs/unstable/#sec-pkgs-invalidateFetcherByDrvHash
+  invalidateFetcherByDrvHash = f: args:
+    let
+      drvPath = (f args).drvPath;
+      # It's safe to discard the context, because we don't access the path.
+      salt = builtins.unsafeDiscardStringContext (lib.substring 0 12 (baseNameOf drvPath));
+    in f (args // { name = "${args.name or "source"}-salted-${salt}"; });
+
   lazydocker = callPackage ../tools/misc/lazydocker { };
 
   ld-is-cc-hook = makeSetupHook { name = "ld-is-cc-hook"; }
@@ -3986,6 +3997,11 @@ with pkgs;
 
   bluetooth_battery = python3Packages.callPackage ../applications/misc/bluetooth_battery { };
 
+  calyx-vpn = libsForQt5.callPackage ../tools/networking/bitmask-vpn {
+    provider = "calyx";
+    inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
+  };
+
   code-browser-qt = libsForQt5.callPackage ../applications/editors/code-browser { withQt = true;
                                                                                 };
   code-browser-gtk = callPackage ../applications/editors/code-browser { withGtk = true;
@@ -8473,6 +8489,11 @@ with pkgs;
     stdenv = gccStdenv;
   };
 
+  riseup-vpn = libsForQt5.callPackage ../tools/networking/bitmask-vpn {
+    provider = "riseup";
+    inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
+  };
+
   rocket = libsForQt5.callPackage ../tools/graphics/rocket { };
 
   rtaudio = callPackage ../development/libraries/audio/rtaudio {
@@ -12356,6 +12377,7 @@ with pkgs;
   defaultCrateOverrides = callPackage ../build-support/rust/default-crate-overrides.nix { };
 
   cargo-about = callPackage ../tools/package-management/cargo-about { };
+  cargo-all-features = callPackage ../development/tools/rust/cargo-all-features { };
   cargo-audit = callPackage ../tools/package-management/cargo-audit {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
@@ -24890,7 +24912,9 @@ with pkgs;
     gtk = gtk3;
   };
 
-  hors = callPackage ../development/tools/hors { };
+  hors = callPackage ../development/tools/hors {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   hover = callPackage ../development/tools/hover { };
 
@@ -32070,6 +32094,8 @@ with pkgs;
 
   sumneko-lua-language-server = callPackage ../development/tools/sumneko-lua-language-server { };
 
+  sysz = callPackage  ../tools/misc/sysz { };
+
   go-swag = callPackage ../development/tools/go-swag { };
 
   go-swagger = callPackage ../development/tools/go-swagger { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 048dcf9e3bd79..05693a9a4f482 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7154,6 +7154,8 @@ in {
 
   python3-eventlib = callPackage ../development/python-modules/python3-eventlib { };
 
+  python3-gnutls = callPackage ../development/python-modules/python3-gnutls { };
+
   python3-openid = callPackage ../development/python-modules/python3-openid { };
 
   python-awair = callPackage ../development/python-modules/python-awair { };