Merge pull request #86139 from NixOS/staging-next

Staging next

35 files changed, 253 insertions, 130 deletions

diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 54f0f744c04b..8b8dbef12ab4 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -21,7 +21,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.26.1";
+  version = "2.26.2";
   svn = subversionClient.override { perlBindings = perlSupport; };
 
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "0s03ix9j1h0yychkh1l1cgpr1l9lwzn3rprl08rk8ii5ix02i0l8";
+    sha256 = "0j685w6pzkn926z5nf5r8fij4ziipvw4c9yb0wc577nzf4j16rbd";
   };
 
   outputs = [ "out" ];
@@ -335,6 +335,7 @@ stdenv.mkDerivation {
     homepage = "https://git-scm.com/";
     description = "Distributed version control system";
     license = stdenv.lib.licenses.gpl2;
+    changelog = "https://raw.githubusercontent.com/git/git/${version}/Documentation/RelNotes/${version}.txt";
 
     longDescription = ''
       Git, a popular distributed version control system designed to
diff --git a/pkgs/data/icons/arc-icon-theme/default.nix b/pkgs/data/icons/arc-icon-theme/default.nix
index a26064cdfa3b..ab80305d5285 100644
--- a/pkgs/data/icons/arc-icon-theme/default.nix
+++ b/pkgs/data/icons/arc-icon-theme/default.nix
@@ -1,20 +1,25 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, gtk3, moka-icon-theme, hicolor-icon-theme }:
+{ stdenv, fetchFromGitHub, autoreconfHook, gtk3, gnome3, moka-icon-theme, gnome-icon-theme, hicolor-icon-theme }:
 
 stdenv.mkDerivation rec {
-  name = "${package-name}-${version}";
-  package-name = "arc-icon-theme";
+  pname = "arc-icon-theme";
   version = "2016-11-22";
 
   src = fetchFromGitHub {
     owner = "horst3180";
-    repo = package-name;
+    repo = pname;
     rev = "55a575386a412544c3ed2b5617a61f842ee4ec15";
     sha256 = "1ch3hp08qri93510hypzz6m2x4xgg2h15wvnhjwh1x1s1b7jvxjd";
   };
 
-  nativeBuildInputs = [ autoreconfHook gtk3 moka-icon-theme ];
+  nativeBuildInputs = [
+    autoreconfHook
+    gtk3
+  ];
 
   propagatedBuildInputs = [
+    moka-icon-theme
+    gnome3.adwaita-icon-theme
+    gnome-icon-theme
     hicolor-icon-theme
   ];
 
diff --git a/pkgs/data/icons/elementary-xfce-icon-theme/default.nix b/pkgs/data/icons/elementary-xfce-icon-theme/default.nix
index 3aebf09554c3..3a82c3132964 100644
--- a/pkgs/data/icons/elementary-xfce-icon-theme/default.nix
+++ b/pkgs/data/icons/elementary-xfce-icon-theme/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, pkgconfig, gdk-pixbuf, optipng, librsvg, gtk3, hicolor-icon-theme }:
+{ stdenv, fetchFromGitHub, pkgconfig, gdk-pixbuf, optipng, librsvg, gtk3, pantheon, gnome3, gnome-icon-theme, hicolor-icon-theme }:
 
 stdenv.mkDerivation rec {
   pname = "elementary-xfce-icon-theme";
@@ -11,9 +11,18 @@ stdenv.mkDerivation rec {
     sha256 = "1f6qvpzxz759znishmr4b22n540y18glv41wmy91r78sa4g6x4sh";
   };
 
-  nativeBuildInputs = [ pkgconfig gdk-pixbuf librsvg optipng gtk3 ];
+  nativeBuildInputs = [
+    pkgconfig
+    gdk-pixbuf
+    librsvg
+    optipng
+    gtk3
+  ];
 
   propagatedBuildInputs = [
+    pantheon.elementary-icon-theme
+    gnome3.adwaita-icon-theme
+    gnome-icon-theme
     hicolor-icon-theme
   ];
 
diff --git a/pkgs/data/icons/faba-icon-theme/default.nix b/pkgs/data/icons/faba-icon-theme/default.nix
index e1e070c58be7..9df47f8faa7c 100644
--- a/pkgs/data/icons/faba-icon-theme/default.nix
+++ b/pkgs/data/icons/faba-icon-theme/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, meson, ninja, python3, gtk3, pantheon, hicolor-icon-theme }:
+{ stdenv, fetchFromGitHub, meson, ninja, python3, gtk3, pantheon, gnome-icon-theme, hicolor-icon-theme }:
 
 stdenv.mkDerivation rec {
   name = "${package-name}-${version}";
@@ -12,9 +12,16 @@ stdenv.mkDerivation rec {
     sha256 = "0xh6ppr73p76z60ym49b4d0liwdc96w41cc5p07d48hxjsa6qd6n";
   };
 
-  nativeBuildInputs = [ meson ninja python3 gtk3 pantheon.elementary-icon-theme ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    python3
+    gtk3
+  ];
 
   propagatedBuildInputs = [
+    pantheon.elementary-icon-theme
+    gnome-icon-theme
     hicolor-icon-theme
   ];
 
diff --git a/pkgs/data/icons/faba-mono-icons/default.nix b/pkgs/data/icons/faba-mono-icons/default.nix
index 19d58eeff6f3..e403ba753ecc 100644
--- a/pkgs/data/icons/faba-mono-icons/default.nix
+++ b/pkgs/data/icons/faba-mono-icons/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, gtk3, moka-icon-theme, hicolor-icon-theme }:
+{ stdenv, fetchFromGitHub, autoreconfHook, gtk3, moka-icon-theme, faba-icon-theme, gnome-icon-theme, hicolor-icon-theme }:
 
 stdenv.mkDerivation rec {
   pname = "faba-mono-icons";
@@ -11,15 +11,21 @@ stdenv.mkDerivation rec {
     sha256 = "0nisfl92y6hrbakp9qxi0ygayl6avkzrhwirg6854bwqjy2dvjv9";
   };
 
-  nativeBuildInputs = [ autoreconfHook gtk3 moka-icon-theme ];
+  nativeBuildInputs = [
+    autoreconfHook
+    gtk3
+  ];
 
   propagatedBuildInputs = [
+    moka-icon-theme
+    faba-icon-theme
+    gnome-icon-theme
     hicolor-icon-theme
   ];
 
   dontDropIconThemeCache = true;
 
-  postFixup = ''
+  postInstall = ''
     for theme in $out/share/icons/*; do
       gtk-update-icon-cache $theme
     done
diff --git a/pkgs/data/icons/flat-remix-icon-theme/default.nix b/pkgs/data/icons/flat-remix-icon-theme/default.nix
index 90c14ef7d057..b0b115f096f2 100644
--- a/pkgs/data/icons/flat-remix-icon-theme/default.nix
+++ b/pkgs/data/icons/flat-remix-icon-theme/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub , gtk3 }:
+{ stdenv, fetchFromGitHub , gtk3, breeze-icons, pantheon, gnome-icon-theme, hicolor-icon-theme }:
 
 stdenv.mkDerivation rec  {
   pname = "flat-remix-icon-theme";
@@ -11,14 +11,23 @@ stdenv.mkDerivation rec  {
     sha256 = "14n5wydhd5ifmsbj770s2qg2ksd3xa3m61qxydid6jq39k0lxbd8";
   };
 
-  nativeBuildInputs = [ gtk3 ];
+  nativeBuildInputs = [
+    gtk3
+  ];
+
+  propagatedBuildInputs = [
+    breeze-icons
+    pantheon.elementary-icon-theme
+    gnome-icon-theme
+    hicolor-icon-theme
+  ];
+
+  dontDropIconThemeCache = true;
 
   installPhase = ''
     mkdir -p $out/share/icons
     mv Flat-Remix* $out/share/icons/
-  '';
 
-  postFixup = ''
     for theme in $out/share/icons/*; do
       gtk-update-icon-cache $theme
     done
@@ -31,4 +40,4 @@ stdenv.mkDerivation rec  {
     platforms = platforms.linux;
     maintainers = with maintainers; [ mschneider ];
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/data/icons/hicolor-icon-theme/setup-hook.sh b/pkgs/data/icons/hicolor-icon-theme/setup-hook.sh
index f7c99418144b..0fd9bf85d831 100644
--- a/pkgs/data/icons/hicolor-icon-theme/setup-hook.sh
+++ b/pkgs/data/icons/hicolor-icon-theme/setup-hook.sh
@@ -11,3 +11,43 @@ hicolorIconThemeHook() {
 
 # I think this is meant to be a runtime dep
 addEnvHooks "${targetOffset:?}" hicolorIconThemeHook
+
+# Make symbolic links of parent icon themes that are inherited in the
+# icon themes installed by the package.
+symlinkParentIconThemes() {
+    if [ -e $out/share/icons ]; then
+        echo Symlinking parent icon themes...
+        local theme
+        local theme_name
+        local inheritance
+        local parent
+        local parent_theme
+        local dir
+        local parent_path
+        for theme in $out/share/icons/*/index.theme; do
+            theme_name="${theme%/*}"
+            theme_name="${theme_name##*/}"
+            echo "  theme: $theme_name"
+            inheritance=$(sed -rne 's,^Inherits=(.*)$,\1,p' $theme)
+            IFS=',' read -ra parent_themes <<< "$inheritance"
+            for parent_theme in "${parent_themes[@]}"; do
+                parent_path=""
+                if [ -e "$out/share/icons/$parent_theme" ]; then
+                    parent_path="$(realpath $out/share/icons/$parent_theme)"
+                else
+                    IFS=':' read -ra dirs <<< $XDG_ICON_DIRS
+                    for parent_dir in  "${dirs[@]}"; do
+                        if [ -e "$parent_dir/icons/$parent_theme/index.theme" ]; then
+                            parent_path=$(realpath "$parent_dir/icons/$parent_theme")
+                            ln -s "$parent_path" "$out/share/icons/"
+                            break
+                        fi
+                    done
+                fi
+                echo "    parent: $parent_theme	-> $parent_path"
+            done
+        done
+    fi
+}
+
+preFixupHooks+=(symlinkParentIconThemes)
diff --git a/pkgs/data/icons/iconpack-jade/default.nix b/pkgs/data/icons/iconpack-jade/default.nix
index 1b42c1af6125..1bfa8092a322 100644
--- a/pkgs/data/icons/iconpack-jade/default.nix
+++ b/pkgs/data/icons/iconpack-jade/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, gtk3, hicolor-icon-theme }:
+{ stdenv, fetchFromGitHub, gtk3, gnome-icon-theme, hicolor-icon-theme }:
 
 stdenv.mkDerivation rec {
   pname = "iconpack-jade";
@@ -13,16 +13,14 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ gtk3 ];
 
-  propagatedBuildInputs = [ hicolor-icon-theme ];
+  propagatedBuildInputs = [ gnome-icon-theme hicolor-icon-theme ];
 
   dontDropIconThemeCache = true;
 
   installPhase = ''
-     mkdir -p $out/share/icons
-     cp -a Jade* $out/share/icons
-  '';
+    mkdir -p $out/share/icons
+    cp -a Jade* $out/share/icons
 
-  postFixup = ''
     for theme in $out/share/icons/*; do
       gtk-update-icon-cache $theme
     done
diff --git a/pkgs/data/icons/iconpack-obsidian/default.nix b/pkgs/data/icons/iconpack-obsidian/default.nix
index c954af9e83dc..ae8c127381b1 100644
--- a/pkgs/data/icons/iconpack-obsidian/default.nix
+++ b/pkgs/data/icons/iconpack-obsidian/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, gtk3, hicolor-icon-theme }:
+{ stdenv, fetchFromGitHub, gtk3, gnome-icon-theme, hicolor-icon-theme }:
 
 stdenv.mkDerivation rec {
   pname = "iconpack-obsidian";
@@ -13,16 +13,15 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ gtk3 ];
 
-  propagatedBuildInputs = [ hicolor-icon-theme ];
+  propagatedBuildInputs = [ gnome-icon-theme hicolor-icon-theme ];
+  # still missing parent themes: Ambiant-MATE, Mint-X, Faenza-Dark, KFaenza
 
   dontDropIconThemeCache = true;
 
   installPhase = ''
-     mkdir -p $out/share/icons
-     mv Obsidian* $out/share/icons
-  '';
+    mkdir -p $out/share/icons
+    mv Obsidian* $out/share/icons
 
-  postFixup = ''
     for theme in $out/share/icons/*; do
       gtk-update-icon-cache $theme
     done
diff --git a/pkgs/data/icons/maia-icon-theme/default.nix b/pkgs/data/icons/maia-icon-theme/default.nix
index fbde3a428c0f..ee539981fbca 100644
--- a/pkgs/data/icons/maia-icon-theme/default.nix
+++ b/pkgs/data/icons/maia-icon-theme/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation {
 
   dontDropIconThemeCache = true;
 
-  postFixup = ''
+  postInstall = ''
     for theme in $out/share/icons/*; do
       gtk-update-icon-cache $theme
     done
diff --git a/pkgs/data/icons/moka-icon-theme/default.nix b/pkgs/data/icons/moka-icon-theme/default.nix
index 33798f7b01d8..d481f2df8d6e 100644
--- a/pkgs/data/icons/moka-icon-theme/default.nix
+++ b/pkgs/data/icons/moka-icon-theme/default.nix
@@ -11,9 +11,15 @@ stdenv.mkDerivation rec {
     sha256 = "015l02im4mha5z91dbchxf6xkp66d346bg3xskwg0rh3lglhjsrd";
   };
 
-  nativeBuildInputs = [ meson ninja gtk3 python3 faba-icon-theme ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    gtk3
+    python3
+  ];
 
   propagatedBuildInputs = [
+    faba-icon-theme
     hicolor-icon-theme
   ];
 
diff --git a/pkgs/data/icons/numix-icon-theme-circle/default.nix b/pkgs/data/icons/numix-icon-theme-circle/default.nix
index a22b97ec1e71..3c991cf1fc83 100644
--- a/pkgs/data/icons/numix-icon-theme-circle/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-circle/default.nix
@@ -13,18 +13,16 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ gtk3 ];
 
-  buildInputs = [ numix-icon-theme ];
-
-  propagatedBuildInputs = [ hicolor-icon-theme ];
+  propagatedBuildInputs = [ numix-icon-theme hicolor-icon-theme ];
 
   dontDropIconThemeCache = true;
 
   installPhase = ''
-    install -dm 755 $out/share/icons
-    cp -dr --no-preserve='ownership' Numix-Circle{,-Light} $out/share/icons/
-  '';
+    runHook preInstall
+
+    mkdir -p $out/share/icons
+    cp -a Numix-Circle{,-Light} $out/share/icons
 
-  postFixup = ''
     for panel in $out/share/icons/*/*/panel; do
       ln -sf $(realpath ${numix-icon-theme}/share/icons/Numix/16/$(readlink $panel)) $panel
     done
@@ -32,6 +30,8 @@ stdenv.mkDerivation rec {
     for theme in $out/share/icons/*; do
       gtk-update-icon-cache $theme
     done
+
+    runHook postInstall
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/data/icons/numix-icon-theme-square/default.nix b/pkgs/data/icons/numix-icon-theme-square/default.nix
index 92a3ce9091a5..9cebdc331065 100644
--- a/pkgs/data/icons/numix-icon-theme-square/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-square/default.nix
@@ -13,18 +13,16 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ gtk3 ];
 
-  buildInputs = [ numix-icon-theme ];
-
-  propagatedBuildInputs = [ hicolor-icon-theme ];
+  propagatedBuildInputs = [ numix-icon-theme hicolor-icon-theme ];
 
   dontDropIconThemeCache = true;
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/share/icons
-    cp -a Numix-Square{,-Light} $out/share/icons/
-  '';
+    cp -a Numix-Square{,-Light} $out/share/icons
 
-  postFixup = ''
     for panel in $out/share/icons/*/*/panel; do
       ln -sf $(realpath ${numix-icon-theme}/share/icons/Numix/16/$(readlink $panel)) $panel
     done
@@ -32,6 +30,8 @@ stdenv.mkDerivation rec {
     for theme in $out/share/icons/*; do
       gtk-update-icon-cache $theme
     done
+
+    runHook postInstall
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/data/icons/numix-icon-theme/default.nix b/pkgs/data/icons/numix-icon-theme/default.nix
index 46c61d861a32..56bb2f3808fb 100644
--- a/pkgs/data/icons/numix-icon-theme/default.nix
+++ b/pkgs/data/icons/numix-icon-theme/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, gtk3, hicolor-icon-theme }:
+{ stdenv, fetchFromGitHub, gtk3, gnome-icon-theme, hicolor-icon-theme }:
 
 stdenv.mkDerivation rec {
   pname = "numix-icon-theme";
@@ -13,18 +13,14 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ gtk3 ];
 
-  propagatedBuildInputs = [
-    hicolor-icon-theme
-  ];
+  propagatedBuildInputs = [ gnome-icon-theme hicolor-icon-theme ];
 
   dontDropIconThemeCache = true;
 
   installPhase = ''
     mkdir -p $out/share/icons
     cp -a Numix{,-Light} $out/share/icons/
-  '';
 
-  postFixup = ''
     for theme in $out/share/icons/*; do
       gtk-update-icon-cache $theme
     done
diff --git a/pkgs/data/icons/paper-icon-theme/default.nix b/pkgs/data/icons/paper-icon-theme/default.nix
index 1531bdf2af83..585190a7b382 100644
--- a/pkgs/data/icons/paper-icon-theme/default.nix
+++ b/pkgs/data/icons/paper-icon-theme/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, meson, ninja, gtk3, python3, hicolor-icon-theme }:
+{ stdenv, fetchFromGitHub, meson, ninja, gtk3, python3, gnome3, gnome-icon-theme, hicolor-icon-theme }:
 
 stdenv.mkDerivation rec {
   pname = "paper-icon-theme";
@@ -11,9 +11,16 @@ stdenv.mkDerivation rec {
     sha256 = "0x45zkjnmbz904df63ph06npbm3phpgck4xwyymx8r8jgrfplk6v";
   };
 
-  nativeBuildInputs = [ meson ninja gtk3 python3 ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    gtk3
+    python3
+  ];
 
   propagatedBuildInputs = [
+    gnome3.adwaita-icon-theme
+    gnome-icon-theme
     hicolor-icon-theme
   ];
 
diff --git a/pkgs/data/icons/papirus-icon-theme/default.nix b/pkgs/data/icons/papirus-icon-theme/default.nix
index d01410f28da5..b47c01d973eb 100644
--- a/pkgs/data/icons/papirus-icon-theme/default.nix
+++ b/pkgs/data/icons/papirus-icon-theme/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, gtk3, hicolor-icon-theme }:
+{ stdenv, fetchFromGitHub, gtk3, pantheon, breeze-icons, gnome-icon-theme, hicolor-icon-theme }:
 
 stdenv.mkDerivation rec {
   pname = "papirus-icon-theme";
@@ -11,18 +11,23 @@ stdenv.mkDerivation rec {
     sha256 = "0qv4340avm5s0640r8aznbfwjzvm6k64840qggyg9jfcy6223pdy";
   };
 
-  nativeBuildInputs = [ gtk3 ];
+  nativeBuildInputs = [
+    gtk3
+  ];
 
-  propagatedBuildInputs = [ hicolor-icon-theme ];
+  propagatedBuildInputs = [
+    pantheon.elementary-icon-theme
+    breeze-icons
+    gnome-icon-theme
+    hicolor-icon-theme
+  ];
 
   dontDropIconThemeCache = true;
 
   installPhase = ''
-     mkdir -p $out/share/icons
-     mv {,e}Papirus* $out/share/icons
-  '';
+    mkdir -p $out/share/icons
+    mv {,e}Papirus* $out/share/icons
 
-  postFixup = ''
     for theme in $out/share/icons/*; do
       gtk-update-icon-cache $theme
     done
diff --git a/pkgs/data/icons/papirus-maia-icon-theme/default.nix b/pkgs/data/icons/papirus-maia-icon-theme/default.nix
index a90182cc8d78..4cfe50d7836b 100644
--- a/pkgs/data/icons/papirus-maia-icon-theme/default.nix
+++ b/pkgs/data/icons/papirus-maia-icon-theme/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, gtk3 }:
+{ stdenv, fetchFromGitHub, cmake, gtk3, breeze-icons, gnome-icon-theme, papirus-icon-theme, hicolor-icon-theme }:
 
 stdenv.mkDerivation rec {
   pname = "papirus-maia-icon-theme";
@@ -16,11 +16,20 @@ stdenv.mkDerivation rec {
     gtk3
   ];
 
+  propagatedBuildInputs = [
+    breeze-icons
+    gnome-icon-theme
+    papirus-icon-theme
+    hicolor-icon-theme
+  ];
+
+  dontDropIconThemeCache = true;
+
   postPatch = ''
     substituteInPlace CMakeLists.txt --replace /usr "$out"
   '';
 
-  postFixup = ''
+  postInstall = ''
     for theme in $out/share/icons/*; do
       gtk-update-icon-cache $theme
     done
diff --git a/pkgs/data/icons/qogir-icon-theme/default.nix b/pkgs/data/icons/qogir-icon-theme/default.nix
index 641b3da883e8..fa52ad176d98 100644
--- a/pkgs/data/icons/qogir-icon-theme/default.nix
+++ b/pkgs/data/icons/qogir-icon-theme/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, gtk3 }:
+{ stdenv, fetchFromGitHub, gtk3, hicolor-icon-theme }:
 
 stdenv.mkDerivation rec {
   pname = "qogir-icon-theme";
@@ -13,6 +13,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ gtk3 ];
 
+  propagatedBuildInputs = [ hicolor-icon-theme ];
+
   dontDropIconThemeCache = true;
 
   installPhase = ''
diff --git a/pkgs/data/icons/tango-icon-theme/default.nix b/pkgs/data/icons/tango-icon-theme/default.nix
index fe749598495d..f1b59c2f5386 100644
--- a/pkgs/data/icons/tango-icon-theme/default.nix
+++ b/pkgs/data/icons/tango-icon-theme/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, intltool, pkgconfig, iconnamingutils, imagemagick, librsvg
-, gtk/*any version*/, hicolor-icon-theme
+, gtk/*any version*/, gnome-icon-theme, hicolor-icon-theme
 }:
 
 stdenv.mkDerivation rec {
@@ -14,10 +14,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ intltool iconnamingutils imagemagick librsvg ];
-
-  propagatedBuildInputs = [
-    hicolor-icon-theme
-  ];
+  propagatedBuildInputs = [ gnome-icon-theme hicolor-icon-theme ];
+  # still missing parent icon themes: cristalsvg
 
   dontDropIconThemeCache = true;
 
diff --git a/pkgs/data/icons/zafiro-icons/default.nix b/pkgs/data/icons/zafiro-icons/default.nix
index 5bd61b0866a4..a8dc4539a7dd 100644
--- a/pkgs/data/icons/zafiro-icons/default.nix
+++ b/pkgs/data/icons/zafiro-icons/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, gtk3, hicolor-icon-theme }:
+{ stdenv, fetchFromGitHub, gtk3, breeze-icons, gnome-icon-theme, numix-icon-theme, numix-icon-theme-circle, hicolor-icon-theme }:
 
 stdenv.mkDerivation rec {
   pname = "zafiro-icons";
@@ -11,10 +11,17 @@ stdenv.mkDerivation rec {
     sha256 = "05h8qm9izjbp8pnl9jpbw3y9sddhp0zmg94fm1k4d4hhdqnakqhv";
   };
 
-  nativeBuildInputs = [ gtk3 ];
+  nativeBuildInputs = [
+    gtk3
+  ];
 
   propagatedBuildInputs = [
+    breeze-icons
+    gnome-icon-theme
+    numix-icon-theme
+    numix-icon-theme-circle
     hicolor-icon-theme
+    # still missing parent icon themes: Surfn
   ];
 
   dontDropIconThemeCache = true;
diff --git a/pkgs/data/themes/yaru/default.nix b/pkgs/data/themes/yaru/default.nix
index 385f7afa3e4f..665452a91d85 100644
--- a/pkgs/data/themes/yaru/default.nix
+++ b/pkgs/data/themes/yaru/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, meson, sassc, pkg-config, glib, ninja,
-  python3, gtk3, gnome3, gtk-engine-murrine }:
+  python3, gtk3, gnome3, gtk-engine-murrine, humanity-icon-theme, hicolor-icon-theme }:
 
 stdenv.mkDerivation rec {
   pname = "yaru";
@@ -14,9 +14,12 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ meson sassc pkg-config glib ninja python3 ];
   buildInputs = [ gtk3 gnome3.gnome-themes-extra ];
+  propagatedBuildInputs = [ humanity-icon-theme hicolor-icon-theme ];
 
   propagatedUserEnvPkgs = [ gtk-engine-murrine ];
 
+  dontDropIconThemeCache = true;
+
   postPatch = "patchShebangs .";
 
   meta = with stdenv.lib; {
diff --git a/pkgs/desktops/cinnamon/mint-y-icons/default.nix b/pkgs/desktops/cinnamon/mint-y-icons/default.nix
index d4415c4bf040..a7e22dc3d033 100644
--- a/pkgs/desktops/cinnamon/mint-y-icons/default.nix
+++ b/pkgs/desktops/cinnamon/mint-y-icons/default.nix
@@ -1,6 +1,7 @@
 { fetchFromGitHub
 , stdenv
 , gnome3
+, gnome-icon-theme
 , hicolor-icon-theme
 , gtk3
 }:
@@ -16,8 +17,9 @@ stdenv.mkDerivation rec {
     sha256 = "1c2a79ylk363i982czwwqcwc7cw6dyzlqphcypqm6nll7xlafq8s";
   };
 
-  propagatedUserEnvPkgs = [
+  propagatedBuildInputs = [
     gnome3.adwaita-icon-theme
+    gnome-icon-theme
     hicolor-icon-theme
   ];
 
@@ -25,15 +27,19 @@ stdenv.mkDerivation rec {
     gtk3
   ];
 
-  postFixup =  ''
-    gtk-update-icon-cache $out/share/icons/*
-  '';
-
   dontDropIconThemeCache = true;
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out
     mv usr/share $out
+
+    for theme in $out/share/icons/*; do
+      gtk-update-icon-cache $theme
+    done
+
+    runHook postInstall
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/desktops/deepin/deepin-icon-theme/default.nix b/pkgs/desktops/deepin/deepin-icon-theme/default.nix
index 5845e77f57c7..b6eb3cce26d7 100644
--- a/pkgs/desktops/deepin/deepin-icon-theme/default.nix
+++ b/pkgs/desktops/deepin/deepin-icon-theme/default.nix
@@ -13,9 +13,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ gtk3 xcursorgen ];
 
-  buildInputs = [ papirus-icon-theme ];
-
   propagatedBuildInputs = [
+    papirus-icon-theme
     hicolor-icon-theme
   ];
 
diff --git a/pkgs/desktops/enlightenment/efl.nix b/pkgs/desktops/enlightenment/efl.nix
index 7bf280cb99b5..d3b0e43e4764 100644
--- a/pkgs/desktops/enlightenment/efl.nix
+++ b/pkgs/desktops/enlightenment/efl.nix
@@ -1,12 +1,11 @@
 { stdenv, fetchurl, meson, ninja, pkgconfig, SDL, SDL2, alsaLib,
   avahi, bullet, check, curl, dbus, doxygen, expat, fontconfig,
   freetype, fribidi, ghostscript, giflib, glib, gst_all_1, gtk3,
-  harfbuzz, ibus, jbig2dec, libGL, libdrm, libinput, libjpeg, libpng,
-  libpulseaudio, libraw, librsvg, libsndfile, libspectre, libtiff,
-  libwebp, libxkbcommon, luajit, lz4, mesa, openjpeg, openssl,
-  poppler, python27Packages, systemd, udev, utillinux, writeText,
-  xorg, zlib
-}:
+  harfbuzz, hicolor-icon-theme, ibus, jbig2dec, libGL, libdrm,
+  libinput, libjpeg, libpng, libpulseaudio, libraw, librsvg,
+  libsndfile, libspectre, libtiff, libwebp, libxkbcommon, luajit, lz4,
+  mesa, openjpeg, openssl, poppler, python27Packages, systemd, udev,
+  utillinux, writeText, xorg, zlib }:
 
 stdenv.mkDerivation rec {
   pname = "efl";
@@ -51,6 +50,7 @@ stdenv.mkDerivation rec {
     xorg.libXcursor
     xorg.xorgproto
     zlib
+    # still missing parent icon themes: Mint-X, RAVE-X, Faenza
   ];
 
   propagatedBuildInputs = [
@@ -95,6 +95,8 @@ stdenv.mkDerivation rec {
     xorg.xcbutilkeysyms
   ];
 
+  dontDropIconThemeCache = true;
+
   mesonFlags = [
     "--buildtype=release"
     "-D build-tests=false" # disable build tests, which are not working
diff --git a/pkgs/desktops/gnome-3/core/adwaita-icon-theme/default.nix b/pkgs/desktops/gnome-3/core/adwaita-icon-theme/default.nix
index 6eafa874b836..827fd1cd96a7 100644
--- a/pkgs/desktops/gnome-3/core/adwaita-icon-theme/default.nix
+++ b/pkgs/desktops/gnome-3/core/adwaita-icon-theme/default.nix
@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig intltool iconnamingutils gtk3 ];
 
+  dontDropIconThemeCache = true;
+
   # remove a tree of dirs with no files within
   postInstall = '' rm -rf "$out/locale" '';
 
diff --git a/pkgs/desktops/gnome-3/core/gnome-themes-extra/default.nix b/pkgs/desktops/gnome-3/core/gnome-themes-extra/default.nix
index 9cbac8c74277..fa2f4921fd91 100644
--- a/pkgs/desktops/gnome-3/core/gnome-themes-extra/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-themes-extra/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, intltool, gtk3, gnome3, librsvg, pkgconfig, pango, atk, gtk2
-, gdk-pixbuf }:
+, gdk-pixbuf, hicolor-icon-theme }:
 
 let
   pname = "gnome-themes-extra";
@@ -19,9 +19,12 @@ in stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkgconfig intltool ];
-  buildInputs = [ gtk3 librsvg pango atk gtk2 gdk-pixbuf gnome3.adwaita-icon-theme ];
+  buildInputs = [ gtk3 librsvg pango atk gtk2 gdk-pixbuf ];
+  propagatedBuildInputs = [ gnome3.adwaita-icon-theme hicolor-icon-theme ];
 
-  postFixup = ''
+  dontDropIconThemeCache = true;
+
+  postInstall = ''
     gtk-update-icon-cache "$out"/share/icons/HighContrast
   '';
 
diff --git a/pkgs/desktops/mate/mate-icon-theme-faenza/default.nix b/pkgs/desktops/mate/mate-icon-theme-faenza/default.nix
index 26d8f86985b9..a429e1e66e3d 100644
--- a/pkgs/desktops/mate/mate-icon-theme-faenza/default.nix
+++ b/pkgs/desktops/mate/mate-icon-theme-faenza/default.nix
@@ -11,11 +11,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook gtk3 ];
 
-  buildInputs = [ mate.mate-icon-theme ];
-
-  propagatedBuildInputs = [
-    hicolor-icon-theme
-  ];
+  propagatedBuildInputs = [ mate.mate-icon-theme hicolor-icon-theme ];
 
   dontDropIconThemeCache = true;
 
diff --git a/pkgs/desktops/xfce/art/xfce4-icon-theme.nix b/pkgs/desktops/xfce/art/xfce4-icon-theme.nix
index e614bb1db921..526b70305917 100644
--- a/pkgs/desktops/xfce/art/xfce4-icon-theme.nix
+++ b/pkgs/desktops/xfce/art/xfce4-icon-theme.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, intltool, gtk3, xfce }:
+{ stdenv, fetchurl, pkgconfig, intltool, gtk3, gnome-icon-theme, tango-icon-theme, hicolor-icon-theme, xfce }:
 
 let
   category = "art";
@@ -19,6 +19,15 @@ stdenv.mkDerivation rec {
     gtk3
   ];
 
+  buildInputs = [
+    gnome-icon-theme
+    tango-icon-theme
+    hicolor-icon-theme
+    # missing parent icon theme Industrial
+  ];
+
+  dontDropIconThemeCache = true;
+
   passthru.updateScript = xfce.updateScript {
     inherit pname version;
     attrPath = "xfce.${pname}";
diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/development/libraries/gtk/3.x.nix
index c4e6af5d62a0..a3fe432017c3 100644
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@@ -48,7 +48,7 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "gtk+3";
-  version = "3.24.17";
+  version = "3.24.18";
 
   outputs = [ "out" "dev" ] ++ optional withGtkDoc "devdoc";
   outputBin = "dev";
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/${stdenv.lib.versions.majorMinor version}/gtk+-${version}.tar.xz";
-    sha256 = "1h5snvqz8f6zgwpmq7pblvfwj5dphfckj8bv7vdz1c0w49dja47j";
+    sha256 = "1lia2ybd1661j6mvrc00iyd50gm7sy157bdzlyf4mr028rzzzspm";
   };
 
   patches = [
@@ -73,21 +73,6 @@ stdenv.mkDerivation rec {
 
     # https://gitlab.gnome.org/GNOME/gtk/merge_requests/1002
     ./patches/01-build-Fix-path-handling-in-pkgconfig.patch
-
-    # https://gitlab.gnome.org/GNOME/gtk/-/merge_requests/1634
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/79732da1ed8cb167440fb047c72cfc0d888a187b.patch";
-      sha256 = "1ynrx81dkwjfqhvg80q28qbb6jabg4x73fkbrnligzgkzimfjpx3";
-    })
-    # https://gitlab.gnome.org/GNOME/gtk/-/merge_requests/1633
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/12fc9a45efcbb546eb7de13c5c4d3183f2f5a3b8.patch";
-      sha256 = "00zrm77qk39p1hgn207az82cgvqiyp6is7dk0ssjxkc34403r78v";
-    })
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/5a52af20cba76474e631b2a7548963bcad22d66d.patch";
-      sha256 = "0sbzzwa0si1w83m5abyf312f4w445wwlms53m5hb7kdgkjbhaa3f";
-    })
   ] ++ optionals stdenv.isDarwin [
     # X11 module requires <gio/gdesktopappinfo.h> which is not installed on Darwin
     # let’s drop that dependency in similar way to how other parts of the library do it
diff --git a/pkgs/development/libraries/libva-utils/default.nix b/pkgs/development/libraries/libva-utils/default.nix
index a3c7cf05cfb0..a4de995ada85 100644
--- a/pkgs/development/libraries/libva-utils/default.nix
+++ b/pkgs/development/libraries/libva-utils/default.nix
@@ -7,10 +7,10 @@ stdenv.mkDerivation rec {
   inherit (libva) version;
 
   src = fetchFromGitHub {
-    owner  = "01org";
+    owner  = "intel";
     repo   = "libva-utils";
     rev    = version;
-    sha256 = "1yk9bg1wg4nqva3l01s6bghcvc3hb02gp62p1sy5qk0r9mn5kpik";
+    sha256 = "13a0dccphi4cpr2cx45kg4djxsssi3d1fcjrkx27b16xiayp5lx9";
   };
 
   nativeBuildInputs = [ meson ninja pkgconfig ];
@@ -26,10 +26,15 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
-    description = "VAAPI tools: Video Acceleration API";
-    homepage = "http://www.freedesktop.org/wiki/Software/vaapi";
+    description = "A collection of utilities and examples for VA-API";
+    longDescription = ''
+      libva-utils is a collection of utilities and examples to exercise VA-API
+      in accordance with the libva project.
+    '';
+    homepage = "https://github.com/intel/libva-utils";
+    changelog = "https://raw.githubusercontent.com/intel/libva-utils/${version}/NEWS";
     license = licenses.mit;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ primeos ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/libva/default.nix b/pkgs/development/libraries/libva/default.nix
index be374eaf8957..86c6a88b1ef4 100644
--- a/pkgs/development/libraries/libva/default.nix
+++ b/pkgs/development/libraries/libva/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   name = "libva-${lib.optionalString minimal "minimal-"}${version}";
-  version = "2.6.1";
+  version = "2.7.1"; # Also update the hash for libva-utils!
 
   # update libva-utils and vaapiIntel as well
   src = fetchFromGitHub {
-    owner  = "01org";
+    owner  = "intel";
     repo   = "libva";
     rev    = version;
-    sha256 = "1x34kf38p5rf52bf54ljr9f7knnbilm7kbszqnfk3lzsqrfc7r2g";
+    sha256 = "0ywasac7z3hwggj8szp83sbxi2naa0a3amblx64y7i1hyyrn0csq";
   };
 
   outputs = [ "dev" "out" ];
@@ -38,10 +38,17 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with stdenv.lib; {
-    description = "VAAPI library: Video Acceleration API";
-    homepage = "http://www.freedesktop.org/wiki/Software/vaapi";
+    description = "An implementation for VA-API (Video Acceleration API)";
+    longDescription = ''
+      VA-API is an open-source library and API specification, which provides
+      access to graphics hardware acceleration capabilities for video
+      processing. It consists of a main library (this package) and
+      driver-specific acceleration backends for each supported hardware vendor.
+    '';
+    homepage = "https://01.org/linuxmedia/vaapi";
+    changelog = "https://raw.githubusercontent.com/intel/libva/${version}/NEWS";
     license = licenses.mit;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ primeos ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index d821a6c8f512..43170f25d38b 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -155,8 +155,8 @@ in {
   };
 
   openssl_1_1 = common {
-    version = "1.1.1f";
-    sha256 = "186c6bfe6ecfba7a5b48c47f8a1673d0f3b0e5ba2e25602dd23b629975da3f35";
+    version = "1.1.1g";
+    sha256 = "0ikdcc038i7jk8h7asq5xcn8b1xc2rrbc88yfm4hqbz3y5s4gc6x";
     patches = [
       ./1.1/nix-ssl-cert-file.patch
 
diff --git a/pkgs/development/libraries/p11-kit/default.nix b/pkgs/development/libraries/p11-kit/default.nix
index a13e67464696..204de957f3df 100644
--- a/pkgs/development/libraries/p11-kit/default.nix
+++ b/pkgs/development/libraries/p11-kit/default.nix
@@ -26,14 +26,16 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--sysconfdir=/etc"
     "--localstatedir=/var"
-    "--without-trust-paths"
-  ]; # TODO: store trust anchors in a directory common to Nix and NixOS
+    "--with-trust-paths=/etc/ssl/certs/ca-certificates.crt"
+  ];
 
   enableParallelBuilding = true;
 
   doCheck = !stdenv.isDarwin;
 
-  installFlags = [ "exampledir=\${out}/etc/pkcs11" ];
+  installFlags = [
+    "exampledir=${placeholder "out"}/etc/pkcs11"
+  ];
 
   meta = with stdenv.lib; {
     description = "Library for loading and sharing PKCS#11 modules";
diff --git a/pkgs/development/python-modules/cryptography/default.nix b/pkgs/development/python-modules/cryptography/default.nix
index 9b14f4a6fc7d..ba807cc99fd5 100644
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -22,11 +22,11 @@
 
 buildPythonPackage rec {
   pname = "cryptography";
-  version = "2.9"; # Also update the hash in vectors.nix
+  version = "2.9.1"; # Also update the hash in vectors.nix
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0vlqy2pki0fh1h6l6cbb43z3g2n9fv0849dzb5gqwjv0bkpx7b0c";
+    sha256 = "13inbbc3vqv0vpfww65f8pj3isghbcrd3m63xfyd8swl9f5xc2yf";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/python-modules/cryptography/vectors.nix b/pkgs/development/python-modules/cryptography/vectors.nix
index 6fd8259d78fc..520e44cccc78 100644
--- a/pkgs/development/python-modules/cryptography/vectors.nix
+++ b/pkgs/development/python-modules/cryptography/vectors.nix
@@ -7,7 +7,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1h7dcgwrjxqk1bzkangbvlhhlgyqd7cfi894dv1cd5m2sp7csblc";
+    sha256 = "1ydkrj67jf26ys8v5qflqsnlj3hd4494ym44120dpvk7b7v037ci";
   };
 
   # No tests included