Merge staging-next-21.11 into staging-21.11

22 files changed, 291 insertions, 285 deletions

diff --git a/nixos/modules/services/web-apps/keycloak.nix b/nixos/modules/services/web-apps/keycloak.nix
index f563d27cdd9e..03dc7ed96266 100644
--- a/nixos/modules/services/web-apps/keycloak.nix
+++ b/nixos/modules/services/web-apps/keycloak.nix
@@ -691,6 +691,7 @@ in
             RemainAfterExit = true;
             User = "postgres";
             Group = "postgres";
+            LoadCredential = [ "db_password:${cfg.database.passwordFile}" ];
           };
           script = ''
             set -o errexit -o pipefail -o nounset -o errtrace
@@ -699,7 +700,8 @@ in
             create_role="$(mktemp)"
             trap 'rm -f "$create_role"' ERR EXIT
 
-            echo "CREATE ROLE keycloak WITH LOGIN PASSWORD '$(<'${cfg.database.passwordFile}')' CREATEDB" > "$create_role"
+            db_password="$(<"$CREDENTIALS_DIRECTORY/db_password")"
+            echo "CREATE ROLE keycloak WITH LOGIN PASSWORD '$db_password' CREATEDB" > "$create_role"
             psql -tAc "SELECT 1 FROM pg_roles WHERE rolname='keycloak'" | grep -q 1 || psql -tA --file="$create_role"
             psql -tAc "SELECT 1 FROM pg_database WHERE datname = 'keycloak'" | grep -q 1 || psql -tAc 'CREATE DATABASE "keycloak" OWNER "keycloak"'
           '';
@@ -715,14 +717,14 @@ in
             RemainAfterExit = true;
             User = config.services.mysql.user;
             Group = config.services.mysql.group;
+            LoadCredential = [ "db_password:${cfg.database.passwordFile}" ];
           };
           script = ''
             set -o errexit -o pipefail -o nounset -o errtrace
             shopt -s inherit_errexit
-
-            db_password="$(<'${cfg.database.passwordFile}')"
+            db_password="$(<"$CREDENTIALS_DIRECTORY/db_password")"
             ( echo "CREATE USER IF NOT EXISTS 'keycloak'@'localhost' IDENTIFIED BY '$db_password';"
-              echo "CREATE DATABASE keycloak CHARACTER SET utf8 COLLATE utf8_unicode_ci;"
+              echo "CREATE DATABASE IF NOT EXISTS keycloak CHARACTER SET utf8 COLLATE utf8_unicode_ci;"
               echo "GRANT ALL PRIVILEGES ON keycloak.* TO 'keycloak'@'localhost';"
             ) | mysql -N
           '';
diff --git a/nixos/tests/keycloak.nix b/nixos/tests/keycloak.nix
index 1be3fed6acc9..6367ed808e06 100644
--- a/nixos/tests/keycloak.nix
+++ b/nixos/tests/keycloak.nix
@@ -40,7 +40,7 @@ let
 
           environment.systemPackages = with pkgs; [
             xmlstarlet
-            libtidy
+            html-tidy
             jq
           ];
         };
diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix
index 5e8337f6b0ed..7fc805a8b112 100644
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -14,17 +14,17 @@ let
   archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "04lyih67vcf2hficvlv1r25k8k48n9x15sbqrfp1syzhy5i4zch3";
-    x86_64-darwin = "0460mh1ah9hswn8ihais5hzvz453r36ay2bb3hy3z1grfs3s5blk";
-    aarch64-linux = "1db2r4ja0srya2lw900l4mk24xva00kf7vxajcb7q0rab4cpfr3n";
-    aarch64-darwin = "04c43ibbarsqdm1wcsmsi9rnfsl3lyq638d3j0dj94xifk0v61j9";
-    armv7l-linux = "1qzi2biy5mjbxdgcakzmid68ykq6vrgj4lqmz0jk3g46r4kpnrgd";
+    x86_64-linux = "09hqcym8dj4d8r5ibdzypdmjxdw4ix24zq688vnb4kfas2jbb3hi";
+    x86_64-darwin = "1wij82gl1wqrprrfn9cfih19wr4h3bn2xapr1l2l0mkansrzsvg5";
+    aarch64-linux = "09x93i190lmxb3ygzjcmb7ag3dz7ixf07yk7zqc7ljrnn5f0b6ag";
+    aarch64-darwin = "1k7glnqy0vjx55chjpwbgwipcvzb0vx0wmvqis865pvzmr0d06a0";
+    armv7l-linux = "0vkivg1f61k8vkr0j9dm7fw2klh45xxnp07pill1gmrwxafm5bra";
   }.${system};
 in
   callPackage ./generic.nix rec {
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.65.0";
+    version = "1.65.1";
     pname = "vscode";
 
     executableName = "code" + lib.optionalString isInsiders "-insiders";
diff --git a/pkgs/applications/editors/vscode/vscodium.nix b/pkgs/applications/editors/vscode/vscodium.nix
index 39c04314af08..4fd3e89ec591 100644
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@@ -13,10 +13,10 @@ let
   archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "0a38bjkksna7q2lhcm1hgfn189jw3k8svw0jf591bpq7jvknim1v";
-    x86_64-darwin = "173rhavczm0k9qgrlz68rdvwsmy3ynq2g14shx9gipchr1i0rih5";
-    aarch64-linux = "00xkhwvxmyiyy9k1vh23sqyib584qafzs1m57xraqq3n8098jrng";
-    armv7l-linux = "0lqq54hnv4b1m47cya7196cn00jwslcsh5ykicgq0dxljrcawi0y";
+    x86_64-linux = "09zpc8c2il6x88h65kbm6z8vfnx0byzpcqqy9a1za5ilqr3dhk43";
+    x86_64-darwin = "09m2ij0phf5ni5m110z2bnmd9z50lz1qsh7w7cfawycjhwsl602z";
+    aarch64-linux = "1nsdn9mc4ahrz392w2z071sfxc5jmwhamlaid2qy899cc7sk8nqr";
+    armv7l-linux = "1ii6li6l09ccxf0gyjy3f5752kr4a8pga5w0a0ndgfa73mhlamin";
   }.${system};
 
   sourceRoot = {
@@ -31,7 +31,7 @@ in
 
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.65.0";
+    version = "1.65.1";
     pname = "vscodium";
 
     executableName = "codium";
diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix
index 5f0ada3a99af..e4415c18cd48 100644
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@@ -93,11 +93,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "brave";
-  version = "1.36.109";
+  version = "1.36.111";
 
   src = fetchurl {
     url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "KKoMpMagq5lVoRFyWNs92LdPwNIlmAjfwqxfOArIFeo=";
+    sha256 = "bXZsUqLaP43wJV3Cehgblw1G179HgGhToSL36v5QseA=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json
index 19761eab61f0..462ff47afd7c 100644
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@@ -1,14 +1,14 @@
 {
-  "version": "14.7.4",
-  "repo_hash": "0z62p2c24h7icdqar2l3nwlq7z4pan6n80ril8j1y6k03z1cs0nq",
-  "yarn_hash": "12k2r1y7kw95kfsmy0s8rbsf0vldr8c2liah0rkc7pihr19gq3w7",
+  "version": "14.8.2",
+  "repo_hash": "1pl528qxsbg75l5nny7cw8hcsd0zs50hhn0ngdrf3gjpd6y7pzcc",
+  "yarn_hash": "0dlhslkhiha4jyfzm0k8i9cgwdk12r5m67i2rznxbrkl38gk9c1x",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v14.7.4-ee",
+  "rev": "v14.8.2-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "14.7.4",
-    "GITLAB_PAGES_VERSION": "1.51.0",
-    "GITLAB_SHELL_VERSION": "13.22.2",
-    "GITLAB_WORKHORSE_VERSION": "14.7.4"
+    "GITALY_SERVER_VERSION": "14.8.2",
+    "GITLAB_PAGES_VERSION": "1.54.0",
+    "GITLAB_SHELL_VERSION": "13.23.2",
+    "GITLAB_WORKHORSE_VERSION": "14.8.2"
   }
 }
diff --git a/pkgs/applications/version-management/gitlab/default.nix b/pkgs/applications/version-management/gitlab/default.nix
index f53c693c90be..362cf4702f45 100644
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, fetchurl, fetchpatch, fetchFromGitLab, bundlerEnv
 , ruby, tzdata, git, nettools, nixosTests, nodejs, openssl
 , gitlabEnterprise ? false, callPackage, yarn
-, fixup_yarn_lock, replace, file, cacert, fetchYarnDeps
+, fixup_yarn_lock, replace, file, cacert, fetchYarnDeps, makeWrapper
 }:
 
 let
@@ -120,7 +120,7 @@ stdenv.mkDerivation {
   inherit src;
 
   buildInputs = [
-    rubyEnv rubyEnv.wrappedRuby rubyEnv.bundler tzdata git nettools
+    rubyEnv rubyEnv.wrappedRuby rubyEnv.bundler tzdata git nettools makeWrapper
   ];
 
   patches = [
@@ -174,6 +174,9 @@ stdenv.mkDerivation {
     # rake tasks to mitigate CVE-2017-0882
     # see https://about.gitlab.com/2017/03/20/gitlab-8-dot-17-dot-4-security-release/
     cp ${./reset_token.rake} $out/share/gitlab/lib/tasks/reset_token.rake
+
+    # manually patch the shebang line in generate-loose-foreign-key
+    wrapProgram $out/share/gitlab/scripts/decomposition/generate-loose-foreign-key --set ENABLE_SPRING 0 --add-flags 'runner -e test'
   '';
 
   passthru = {
diff --git a/pkgs/applications/version-management/gitlab/gitaly/Gemfile b/pkgs/applications/version-management/gitlab/gitaly/Gemfile
index 70dd9c594c98..78296dff887f 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/Gemfile
+++ b/pkgs/applications/version-management/gitlab/gitaly/Gemfile
@@ -3,7 +3,7 @@ source 'https://rubygems.org'
 gem 'rugged', '~> 1.2'
 gem 'github-linguist', '~> 7.12', require: 'linguist'
 gem 'gitlab-markup', '~> 1.7.1'
-gem 'activesupport', '~> 6.1.4.4'
+gem 'activesupport', '~> 6.1.4.6'
 gem 'rdoc', '~> 6.0'
 gem 'gitlab-gollum-lib', '~> 4.2.7.10.gitlab.2', require: false
 gem 'gitlab-gollum-rugged_adapter', '~> 0.4.4.4.gitlab.1', require: false
diff --git a/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock b/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
index fd0dea027e0d..752883d801d1 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
@@ -2,20 +2,20 @@ GEM
   remote: https://rubygems.org/
   specs:
     abstract_type (0.0.7)
-    actionpack (6.1.4.4)
-      actionview (= 6.1.4.4)
-      activesupport (= 6.1.4.4)
+    actionpack (6.1.4.6)
+      actionview (= 6.1.4.6)
+      activesupport (= 6.1.4.6)
       rack (~> 2.0, >= 2.0.9)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actionview (6.1.4.4)
-      activesupport (= 6.1.4.4)
+    actionview (6.1.4.6)
+      activesupport (= 6.1.4.6)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activesupport (6.1.4.4)
+    activesupport (6.1.4.6)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
@@ -88,7 +88,7 @@ GEM
       google-protobuf (~> 3.18)
       googleapis-common-protos-types (~> 1.0)
     grpc-tools (1.42.0)
-    i18n (1.8.11)
+    i18n (1.9.1)
       concurrent-ruby (~> 1.0)
     ice_nine (0.11.2)
     jaeger-client (1.1.0)
@@ -101,7 +101,7 @@ GEM
       reverse_markdown (~> 1.0)
       rugged (>= 0.24, < 2.0)
       thor (>= 0.19, < 2.0)
-    loofah (2.13.0)
+    loofah (2.14.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
     memoizable (0.4.2)
@@ -219,13 +219,13 @@ GEM
     with_env (1.1.0)
     xml-simple (1.1.9)
       rexml
-    zeitwerk (2.5.3)
+    zeitwerk (2.5.4)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
-  activesupport (~> 6.1.4.4)
+  activesupport (~> 6.1.4.6)
   factory_bot
   faraday (~> 1.0)
   github-linguist (~> 7.12)
diff --git a/pkgs/applications/version-management/gitlab/gitaly/default.nix b/pkgs/applications/version-management/gitlab/gitaly/default.nix
index 2e52d64f1bbc..03ce10bc7bda 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@@ -4,18 +4,6 @@
 , libgit2, openssl, zlib, pcre, http-parser }:
 
 let
-  # git2go 32.0.5 does not support libgit2 1.2.0 or 1.3.0.
-  # It needs a specific commit in between those two releases.
-  libgit2_custom = libgit2.overrideAttrs (oldAttrs: rec {
-    version = "1.2.0";
-    src = fetchFromGitHub {
-      owner = "libgit2";
-      repo = "libgit2";
-      rev = "109b4c887ffb63962c7017a66fc4a1f48becb48e";
-      sha256 = "sha256-w029FHpOv5K49wE1OJMOlkTe+2cv+ORYqEHxs59GDBI=";
-    };
-  });
-
   rubyEnv = bundlerEnv rec {
     name = "gitaly-env";
     inherit ruby;
@@ -23,7 +11,7 @@ let
     gemdir = ./.;
   };
 
-  version = "14.7.4";
+  version = "14.8.2";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/v${lib.versions.major version}";
 in
 
@@ -35,10 +23,10 @@ buildGoModule {
     owner = "gitlab-org";
     repo = "gitaly";
     rev = "v${version}";
-    sha256 = "sha256-sNSRYqGIi/PzegHYe04WUaLegPEeX79NjuqSVul21Ak=";
+    sha256 = "sha256-GgQscKxxYpvzU2M99gmvGj0HM/oD+2Ke24FRzUxv6HM=";
   };
 
-  vendorSha256 = "sha256-eapqtSstc7d3R7A/5krKV0uVr9GhGkHHMrmsBOpWAbo=";
+  vendorSha256 = "sha256-Qw9/nlo1eB5dPcldXe9doy4QA4DDVUDad3o4kbdNu34=";
 
   passthru = {
     inherit rubyEnv;
@@ -48,7 +36,7 @@ buildGoModule {
 
   tags = [ "static,system_libgit2" ];
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ rubyEnv.wrappedRuby libgit2_custom openssl zlib pcre http-parser ];
+  buildInputs = [ rubyEnv.wrappedRuby libgit2 openssl zlib pcre http-parser ];
   doCheck = false;
 
   postInstall = ''
@@ -63,7 +51,7 @@ buildGoModule {
     homepage = "https://gitlab.com/gitlab-org/gitaly";
     description = "A Git RPC service for handling all the git calls made by GitLab";
     platforms = platforms.linux;
-    maintainers = with maintainers; [ roblabla globin fpletz talyz ];
+    maintainers = with maintainers; [ roblabla globin fpletz talyz yayayayaka ];
     license = licenses.mit;
   };
 }
diff --git a/pkgs/applications/version-management/gitlab/gitaly/gemset.nix b/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
index 9539139fe4a3..c55d094db5f8 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
@@ -13,10 +13,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "171ida68hrk21cq1zz1kfl9h94a3qw5p3afviqzsirl0kx6qjyv9";
+      sha256 = "1d4nxv0p3wv4w0pf89nmxzg10balny5rwbchwsscgiminzh3mg7y";
       type = "gem";
     };
-    version = "6.1.4.4";
+    version = "6.1.4.6";
   };
   actionview = {
     dependencies = ["activesupport" "builder" "erubi" "rails-dom-testing" "rails-html-sanitizer"];
@@ -24,10 +24,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1lm2pf35p6q4ff78z175h6ihmzfg2j7ssn41374rb9iy9gpiiidm";
+      sha256 = "0cmxc80gg7pm6d9y7ah5qr4ymzks8rp51jv0a2qdq2m9p6llzlkk";
       type = "gem";
     };
-    version = "6.1.4.4";
+    version = "6.1.4.6";
   };
   activesupport = {
     dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo" "zeitwerk"];
@@ -35,10 +35,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0rvnz9lsf9mrkpji748sf51f54m027snkw6rm8flyvf7fq18rm98";
+      sha256 = "0vrz4vgqz4grr2ykwkd8zhhd0rg12z89n89zl6aff17zrdhhad35";
       type = "gem";
     };
-    version = "6.1.4.4";
+    version = "6.1.4.6";
   };
   adamantium = {
     dependencies = ["ice_nine" "memoizable"];
@@ -343,10 +343,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0vdd1kii40qhbr9n8qx71k2gskq6rkl8ygy8hw5hfj8bb5a364xf";
+      sha256 = "1nancdgq51wk3c1pkxps0rkjsfdwnkx60hzkm947m5rzsz8b2sw8";
       type = "gem";
     };
-    version = "1.8.11";
+    version = "1.9.1";
   };
   ice_nine = {
     source = {
@@ -394,10 +394,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "17rvbrqcci1579d7dpbsfmz1f9g7msk82lyh9ip5h29dkrnixcgg";
+      sha256 = "0z8bdcmw66j3dy6ivcc02yq32lx3n9bavx497llln8qy014xjm4w";
       type = "gem";
     };
-    version = "2.13.0";
+    version = "2.14.0";
   };
   memoizable = {
     dependencies = ["thread_safe"];
@@ -994,9 +994,9 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0lmg9x683gr9mkrbq9df2m0zb0650mdfxqna0bs10js44inv7znx";
+      sha256 = "09bq7j2p6mkbxnsg71s253dm2463kg51xc7bmjcxgyblqbh4ln7m";
       type = "gem";
     };
-    version = "2.5.3";
+    version = "2.5.4";
   };
 }
diff --git a/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
index 9dabd7c949be..99ad72a26644 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
@@ -2,19 +2,19 @@
 
 buildGoModule rec {
   pname = "gitlab-shell";
-  version = "13.22.2";
+  version = "13.23.2";
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${version}";
-    sha256 = "sha256-jAH/MKmCIybLXsypHehQJaKf+mK9ko5XqWoDH/XKE5w=";
+    sha256 = "sha256-aee+Tn81o1iK1Xm5et6lKUN8//lyGh3NGs96Mwg4nFc=";
   };
 
   buildInputs = [ ruby ];
 
   patches = [ ./remove-hardcoded-locations.patch ];
 
-  vendorSha256 = "sha256-cE6phpVYcZNCEk6bElEksIf4GOr/5vJPRdlGCubRafE=";
+  vendorSha256 = "sha256-RLV01CM5O0K4R8XDDcas2LjIig0S7GoyAo/S8+Vx2bY=";
 
   postInstall = ''
     cp -r "$NIX_BUILD_TOP/source"/bin/* $out/bin
@@ -26,7 +26,7 @@ buildGoModule rec {
     description = "SSH access and repository management app for GitLab";
     homepage = "http://www.gitlab.com/";
     platforms = platforms.linux;
-    maintainers = with maintainers; [ fpletz globin talyz ];
+    maintainers = with maintainers; [ fpletz globin talyz yayayayaka ];
     license = licenses.mit;
   };
 }
diff --git a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
index 236da79752c0..76273acdff25 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@@ -5,7 +5,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "14.7.4";
+  version = "14.8.2";
 
   src = fetchFromGitLab {
     owner = data.owner;
@@ -24,7 +24,7 @@ buildGoModule rec {
   meta = with lib; {
     homepage = "http://www.gitlab.com/";
     platforms = platforms.linux;
-    maintainers = with maintainers; [ fpletz globin talyz ];
+    maintainers = with maintainers; [ fpletz globin talyz yayayayaka ];
     license = licenses.mit;
   };
 }
diff --git a/pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch b/pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch
index 2026808875d0..2b5053074052 100644
--- a/pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch
+++ b/pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch
@@ -207,3 +207,13 @@ index 567c7540777..29906b1c132 100644
        end
      end
    end
+diff --git a/scripts/decomposition/generate-loose-foreign-key b/scripts/decomposition/generate-loose-foreign-key
+index 35f84c64ce1..c2fecf3404c 100755
+--- a/scripts/decomposition/generate-loose-foreign-key
++++ b/scripts/decomposition/generate-loose-foreign-key
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env -S ENABLE_SPRING=0 bin/rails runner -e test
++#!/usr/bin/env rails
+ 
+ # This is helper script to swap foreign key to loose foreign key
+ # using DB schema
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
index aab373095f79..4ae8b33569f2 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@@ -2,7 +2,7 @@
 
 source 'https://rubygems.org'
 
-gem 'rails', '~> 6.1.4.4'
+gem 'rails', '~> 6.1.4.6'
 
 gem 'bootsnap', '~> 1.9.1', require: false
 
@@ -72,7 +72,7 @@ gem 'u2f', '~> 0.2.1'
 
 # GitLab Pages
 gem 'validates_hostname', '~> 1.0.11'
-gem 'rubyzip', '~> 2.0.0', require: 'zip'
+gem 'rubyzip', '~> 2.3.2', require: 'zip'
 # GitLab Pages letsencrypt support
 gem 'acme-client', '~> 2.0', '>= 2.0.9'
 
@@ -183,7 +183,7 @@ gem 'rack', '~> 2.2.3'
 gem 'rack-timeout', '~> 0.5.1', require: 'rack/timeout/base'
 
 group :puma do
-  gem 'puma', '~> 5.5.2', require: false
+  gem 'puma', '~> 5.6.2', require: false
   gem 'puma_worker_killer', '~> 0.3.1', require: false
   gem 'sd_notify', '~> 0.1.0', require: false
 end
@@ -195,7 +195,7 @@ gem 'state_machines-activerecord', '~> 0.8.0'
 gem 'acts-as-taggable-on', '~> 9.0'
 
 # Background jobs
-gem 'sidekiq', '~> 6.3'
+gem 'sidekiq', '~> 6.4'
 gem 'sidekiq-cron', '~> 1.2'
 gem 'redis-namespace', '~> 1.8.1'
 gem 'gitlab-sidekiq-fetcher', '0.8.0', require: 'sidekiq-reliable-fetch'
@@ -295,7 +295,7 @@ gem 'gon', '~> 6.4.0'
 gem 'request_store', '~> 1.5'
 gem 'base32', '~> 0.3.0'
 
-gem 'gitlab-license', '~> 2.0'
+gem 'gitlab-license', '~> 2.1.0'
 
 # Protect against bruteforcing
 gem 'rack-attack', '~> 6.3.0'
@@ -310,7 +310,7 @@ gem 'pg_query', '~> 2.1'
 gem 'premailer-rails', '~> 1.10.3'
 
 # LabKit: Tracing and Correlation
-gem 'gitlab-labkit', '~> 0.21.3'
+gem 'gitlab-labkit', '~> 0.22.0'
 # Thrift is a dependency of gitlab-labkit, we want a version higher than 0.14.0
 # because of https://gitlab.com/gitlab-org/gitlab/-/issues/321900
 gem 'thrift', '>= 0.14.0'
@@ -396,7 +396,7 @@ group :development, :test do
 end
 
 group :development, :test, :danger do
-  gem 'gitlab-dangerfiles', '~> 2.6.1', require: false
+  gem 'gitlab-dangerfiles', '~> 2.8.0', require: false
 end
 
 group :development, :test, :coverage do
@@ -466,21 +466,14 @@ gem 'sys-filesystem', '~> 1.4.3'
 # NTP client
 gem 'net-ntp'
 
-# SSH host key support
-gem 'net-ssh', '~> 6.0'
-gem 'sshkey', '~> 2.0'
-
-# Required for ED25519 SSH host key support
-group :ed25519 do
-  gem 'ed25519', '~> 1.2'
-  gem 'bcrypt_pbkdf', '~> 1.1'
-end
+# SSH keys support
+gem 'ssh_data', '~> 1.2'
 
 # Spamcheck GRPC protocol definitions
 gem 'spamcheck', '~> 0.1.0'
 
 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 14.6.0.pre.rc1'
+gem 'gitaly', '~> 14.8.0.pre.rc1'
 
 # KAS GRPC protocol definitions
 gem 'kas-grpc', '~> 0.0.2'
@@ -496,7 +489,7 @@ gem 'flipper', '~> 0.21.0'
 gem 'flipper-active_record', '~> 0.21.0'
 gem 'flipper-active_support_cache_store', '~> 0.21.0'
 gem 'unleash', '~> 3.2.2'
-gem 'gitlab-experiment', '~> 0.6.5'
+gem 'gitlab-experiment', '~> 0.7.0'
 
 # Structured logging
 gem 'lograge', '~> 0.5'
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
index affca2e2922b..8b36d1d8e104 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@@ -4,63 +4,63 @@ GEM
     RedCloth (4.3.2)
     acme-client (2.0.9)
       faraday (>= 0.17, < 2.0.0)
-    actioncable (6.1.4.4)
-      actionpack (= 6.1.4.4)
-      activesupport (= 6.1.4.4)
+    actioncable (6.1.4.6)
+      actionpack (= 6.1.4.6)
+      activesupport (= 6.1.4.6)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
-    actionmailbox (6.1.4.4)
-      actionpack (= 6.1.4.4)
-      activejob (= 6.1.4.4)
-      activerecord (= 6.1.4.4)
-      activestorage (= 6.1.4.4)
-      activesupport (= 6.1.4.4)
+    actionmailbox (6.1.4.6)
+      actionpack (= 6.1.4.6)
+      activejob (= 6.1.4.6)
+      activerecord (= 6.1.4.6)
+      activestorage (= 6.1.4.6)
+      activesupport (= 6.1.4.6)
       mail (>= 2.7.1)
-    actionmailer (6.1.4.4)
-      actionpack (= 6.1.4.4)
-      actionview (= 6.1.4.4)
-      activejob (= 6.1.4.4)
-      activesupport (= 6.1.4.4)
+    actionmailer (6.1.4.6)
+      actionpack (= 6.1.4.6)
+      actionview (= 6.1.4.6)
+      activejob (= 6.1.4.6)
+      activesupport (= 6.1.4.6)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 2.0)
-    actionpack (6.1.4.4)
-      actionview (= 6.1.4.4)
-      activesupport (= 6.1.4.4)
+    actionpack (6.1.4.6)
+      actionview (= 6.1.4.6)
+      activesupport (= 6.1.4.6)
       rack (~> 2.0, >= 2.0.9)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actiontext (6.1.4.4)
-      actionpack (= 6.1.4.4)
-      activerecord (= 6.1.4.4)
-      activestorage (= 6.1.4.4)
-      activesupport (= 6.1.4.4)
+    actiontext (6.1.4.6)
+      actionpack (= 6.1.4.6)
+      activerecord (= 6.1.4.6)
+      activestorage (= 6.1.4.6)
+      activesupport (= 6.1.4.6)
       nokogiri (>= 1.8.5)
-    actionview (6.1.4.4)
-      activesupport (= 6.1.4.4)
+    actionview (6.1.4.6)
+      activesupport (= 6.1.4.6)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activejob (6.1.4.4)
-      activesupport (= 6.1.4.4)
+    activejob (6.1.4.6)
+      activesupport (= 6.1.4.6)
       globalid (>= 0.3.6)
-    activemodel (6.1.4.4)
-      activesupport (= 6.1.4.4)
-    activerecord (6.1.4.4)
-      activemodel (= 6.1.4.4)
-      activesupport (= 6.1.4.4)
+    activemodel (6.1.4.6)
+      activesupport (= 6.1.4.6)
+    activerecord (6.1.4.6)
+      activemodel (= 6.1.4.6)
+      activesupport (= 6.1.4.6)
     activerecord-explain-analyze (0.1.0)
       activerecord (>= 4)
       pg
-    activestorage (6.1.4.4)
-      actionpack (= 6.1.4.4)
-      activejob (= 6.1.4.4)
-      activerecord (= 6.1.4.4)
-      activesupport (= 6.1.4.4)
+    activestorage (6.1.4.6)
+      actionpack (= 6.1.4.6)
+      activejob (= 6.1.4.6)
+      activerecord (= 6.1.4.6)
+      activesupport (= 6.1.4.6)
       marcel (~> 1.0.0)
       mini_mime (>= 1.1.0)
-    activesupport (6.1.4.4)
+    activesupport (6.1.4.6)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
@@ -130,7 +130,6 @@ GEM
     base32 (0.3.2)
     batch-loader (2.0.1)
     bcrypt (3.1.16)
-    bcrypt_pbkdf (1.1.0)
     benchmark (0.1.1)
     benchmark-ips (2.3.0)
     benchmark-memory (0.1.2)
@@ -186,7 +185,7 @@ GEM
     childprocess (3.0.0)
     chunky_png (1.3.5)
     citrus (3.0.2)
-    claide (1.0.3)
+    claide (1.1.0)
     claide-plugins (0.9.2)
       cork
       nap
@@ -195,7 +194,7 @@ GEM
     colored2 (3.1.2)
     commonmarker (0.23.2)
     concurrent-ruby (1.1.9)
-    connection_pool (2.2.2)
+    connection_pool (2.2.5)
     contracts (0.11.0)
     cork (0.3.0)
       colored2 (~> 3.1)
@@ -301,7 +300,6 @@ GEM
     e2mmap (0.1.0)
     ecma-re-validator (0.3.0)
       regexp_parser (~> 2.0)
-    ed25519 (1.2.4)
     elasticsearch (6.8.2)
       elasticsearch-api (= 6.8.2)
       elasticsearch-transport (= 6.8.2)
@@ -444,7 +442,7 @@ GEM
       rails (>= 3.2.0)
     git (1.7.0)
       rchardet (~> 1.8)
-    gitaly (14.6.0.pre.rc1)
+    gitaly (14.8.0.pre.rc1)
       grpc (~> 1.0)
     github-markup (1.7.0)
     gitlab (4.16.1)
@@ -452,13 +450,12 @@ GEM
       terminal-table (~> 1.5, >= 1.5.1)
     gitlab-chronic (0.10.5)
       numerizer (~> 0.2)
-    gitlab-dangerfiles (2.6.1)
+    gitlab-dangerfiles (2.8.0)
       danger (>= 8.3.1)
       danger-gitlab (>= 8.0.0)
-    gitlab-experiment (0.6.5)
+    gitlab-experiment (0.7.0)
       activesupport (>= 3.0)
       request_store (>= 1.0)
-      scientist (~> 1.6, >= 1.6.0)
     gitlab-fog-azure-rm (1.2.0)
       azure-storage-blob (~> 2.0)
       azure-storage-common (~> 2.0)
@@ -466,15 +463,15 @@ GEM
       fog-json (~> 1.2.0)
       mime-types
       ms_rest_azure (~> 0.12.0)
-    gitlab-labkit (0.21.3)
+    gitlab-labkit (0.22.0)
       actionpack (>= 5.0.0, < 7.0.0)
       activesupport (>= 5.0.0, < 7.0.0)
       grpc (>= 1.37)
-      jaeger-client (~> 1.1)
+      jaeger-client (~> 1.1.0)
       opentracing (~> 0.4)
       pg_query (~> 2.1)
       redis (> 3.0.0, < 5.0.0)
-    gitlab-license (2.0.0)
+    gitlab-license (2.1.0)
     gitlab-license_finder (6.14.2.1)
       bundler
       rubyzip (>= 1, < 3)
@@ -626,7 +623,7 @@ GEM
       http-form_data (~> 2.2)
       http-parser (~> 1.2.0)
     http-accept (1.7.0)
-    http-cookie (1.0.3)
+    http-cookie (1.0.4)
       domain_name (~> 0.5)
     http-form_data (2.3.0)
     http-parser (1.2.3)
@@ -635,7 +632,7 @@ GEM
       mime-types (~> 3.0)
       multi_xml (>= 0.5.2)
     httpclient (2.8.3)
-    i18n (1.8.11)
+    i18n (1.9.1)
       concurrent-ruby (~> 1.0)
     i18n_data (0.8.0)
     icalendar (2.4.1)
@@ -937,7 +934,7 @@ GEM
       tty-markdown
       tty-prompt
     public_suffix (4.0.6)
-    puma (5.5.2)
+    puma (5.6.2)
       nio4r (~> 2.0)
     puma_worker_killer (0.3.1)
       get_process_mem (~> 0.2)
@@ -963,20 +960,20 @@ GEM
     rack-test (1.1.0)
       rack (>= 1.0, < 3)
     rack-timeout (0.5.2)
-    rails (6.1.4.4)
-      actioncable (= 6.1.4.4)
-      actionmailbox (= 6.1.4.4)
-      actionmailer (= 6.1.4.4)
-      actionpack (= 6.1.4.4)
-      actiontext (= 6.1.4.4)
-      actionview (= 6.1.4.4)
-      activejob (= 6.1.4.4)
-      activemodel (= 6.1.4.4)
-      activerecord (= 6.1.4.4)
-      activestorage (= 6.1.4.4)
-      activesupport (= 6.1.4.4)
+    rails (6.1.4.6)
+      actioncable (= 6.1.4.6)
+      actionmailbox (= 6.1.4.6)
+      actionmailer (= 6.1.4.6)
+      actionpack (= 6.1.4.6)
+      actiontext (= 6.1.4.6)
+      actionview (= 6.1.4.6)
+      activejob (= 6.1.4.6)
+      activemodel (= 6.1.4.6)
+      activerecord (= 6.1.4.6)
+      activestorage (= 6.1.4.6)
+      activesupport (= 6.1.4.6)
       bundler (>= 1.15.0)
-      railties (= 6.1.4.4)
+      railties (= 6.1.4.6)
       sprockets-rails (>= 2.0.0)
     rails-controller-testing (1.0.5)
       actionpack (>= 5.0.1.rc1)
@@ -990,9 +987,9 @@ GEM
     rails-i18n (6.0.0)
       i18n (>= 0.7, < 2)
       railties (>= 6.0.0, < 7)
-    railties (6.1.4.4)
-      actionpack (= 6.1.4.4)
-      activesupport (= 6.1.4.4)
+    railties (6.1.4.6)
+      actionpack (= 6.1.4.6)
+      activesupport (= 6.1.4.6)
       method_source
       rake (>= 0.13)
       thor (~> 1.0)
@@ -1024,13 +1021,13 @@ GEM
       redis-store (>= 1.2, < 2)
     redis-store (1.9.0)
       redis (>= 4, < 5)
-    regexp_parser (2.1.1)
+    regexp_parser (2.2.1)
     regexp_property_values (1.0.0)
     representable (3.0.4)
       declarative (< 0.1.0)
       declarative-option (< 0.2.0)
       uber (< 0.2.0)
-    request_store (1.5.0)
+    request_store (1.5.1)
       rack (>= 1.4)
     responders (3.0.0)
       actionpack (>= 5.0)
@@ -1127,7 +1124,7 @@ GEM
       sexp_processor (~> 4.9)
     rubyntlm (0.6.2)
     rubypants (0.2.0)
-    rubyzip (2.0.0)
+    rubyzip (2.3.2)
     rugged (1.2.0)
     safe_yaml (1.0.4)
     safety_net_attestation (0.4.0)
@@ -1140,9 +1137,8 @@ GEM
     sass-listen (4.0.0)
       rb-fsevent (~> 0.9, >= 0.9.4)
       rb-inotify (~> 0.9, >= 0.9.7)
-    sassc (2.0.1)
+    sassc (2.4.0)
       ffi (~> 1.9)
-      rake
     sassc-rails (2.1.0)
       railties (>= 4.0.0)
       sassc (>= 2.0)
@@ -1152,7 +1148,6 @@ GEM
     sawyer (0.8.2)
       addressable (>= 2.3.5)
       faraday (> 0.8, < 2.0)
-    scientist (1.6.2)
     sd_notify (0.1.0)
     securecompare (1.0.0)
     seed-fu (2.3.7)
@@ -1169,7 +1164,7 @@ GEM
     shellany (0.0.1)
     shoulda-matchers (4.0.1)
       activesupport (>= 4.2.0)
-    sidekiq (6.3.1)
+    sidekiq (6.4.0)
       connection_pool (>= 2.2.2)
       rack (~> 2.0)
       redis (>= 4.2.0)
@@ -1225,7 +1220,7 @@ GEM
       activesupport (>= 4.0)
       sprockets (>= 3.0.0)
     sqlite3 (1.3.13)
-    sshkey (2.0.0)
+    ssh_data (1.2.0)
     ssrf_filter (1.0.7)
     stackprof (0.2.15)
     state_machines (0.5.0)
@@ -1312,7 +1307,7 @@ GEM
       rugged (>= 0.27, < 1.3)
     unf (0.1.4)
       unf_ext
-    unf_ext (0.0.7.7)
+    unf_ext (0.0.8)
     unicode-display_width (1.7.0)
     unicode_utils (1.4.0)
     uniform_notifier (1.13.0)
@@ -1372,7 +1367,7 @@ GEM
       nokogiri (~> 1.8)
     yajl-ruby (1.4.1)
     yard (0.9.26)
-    zeitwerk (2.5.3)
+    zeitwerk (2.5.4)
 
 PLATFORMS
   ruby
@@ -1401,7 +1396,6 @@ DEPENDENCIES
   base32 (~> 0.3.0)
   batch-loader (~> 2.0.1)
   bcrypt (~> 3.1, >= 3.1.14)
-  bcrypt_pbkdf (~> 1.1)
   benchmark-ips (~> 2.3.0)
   benchmark-memory (~> 0.1)
   better_errors (~> 2.9.0)
@@ -1434,7 +1428,6 @@ DEPENDENCIES
   discordrb-webhooks (~> 3.4)
   doorkeeper (~> 5.5.0.rc2)
   doorkeeper-openid_connect (~> 1.7.5)
-  ed25519 (~> 1.2)
   elasticsearch-api (~> 6.8.2)
   elasticsearch-model (~> 6.1)
   elasticsearch-rails (~> 6.1)
@@ -1463,14 +1456,14 @@ DEPENDENCIES
   gettext (~> 3.3)
   gettext_i18n_rails (~> 1.8.0)
   gettext_i18n_rails_js (~> 1.3)
-  gitaly (~> 14.6.0.pre.rc1)
+  gitaly (~> 14.8.0.pre.rc1)
   github-markup (~> 1.7.0)
   gitlab-chronic (~> 0.10.5)
-  gitlab-dangerfiles (~> 2.6.1)
-  gitlab-experiment (~> 0.6.5)
+  gitlab-dangerfiles (~> 2.8.0)
+  gitlab-experiment (~> 0.7.0)
   gitlab-fog-azure-rm (~> 1.2.0)
-  gitlab-labkit (~> 0.21.3)
-  gitlab-license (~> 2.0)
+  gitlab-labkit (~> 0.22.0)
+  gitlab-license (~> 2.1.0)
   gitlab-license_finder (~> 6.0)
   gitlab-mail_room (~> 0.0.9)
   gitlab-markup (~> 1.8.0)
@@ -1534,7 +1527,6 @@ DEPENDENCIES
   multi_json (~> 1.14.1)
   net-ldap (~> 0.16.3)
   net-ntp
-  net-ssh (~> 6.0)
   nokogiri (~> 1.12)
   oauth2 (~> 1.4)
   octokit (~> 4.15)
@@ -1571,7 +1563,7 @@ DEPENDENCIES
   pry-byebug
   pry-rails (~> 0.3.9)
   pry-shell (~> 0.5.0)
-  puma (~> 5.5.2)
+  puma (~> 5.6.2)
   puma_worker_killer (~> 0.3.1)
   rack (~> 2.2.3)
   rack-attack (~> 6.3.0)
@@ -1579,7 +1571,7 @@ DEPENDENCIES
   rack-oauth2 (~> 1.16.0)
   rack-proxy (~> 0.6.0)
   rack-timeout (~> 0.5.1)
-  rails (~> 6.1.4.4)
+  rails (~> 6.1.4.6)
   rails-controller-testing
   rails-i18n (~> 6.0)
   rainbow (~> 3.0)
@@ -1607,7 +1599,7 @@ DEPENDENCIES
   ruby-progressbar (~> 1.10)
   ruby-saml (~> 1.13.0)
   ruby_parser (~> 3.15)
-  rubyzip (~> 2.0.0)
+  rubyzip (~> 2.3.2)
   rugged (~> 1.2)
   sanitize (~> 6.0)
   sassc-rails (~> 2.1.0)
@@ -1617,7 +1609,7 @@ DEPENDENCIES
   sentry-raven (~> 3.1)
   settingslogic (~> 2.0.9)
   shoulda-matchers (~> 4.0.1)
-  sidekiq (~> 6.3)
+  sidekiq (~> 6.4)
   sidekiq-cron (~> 1.2)
   simple_po_parser (~> 1.1.2)
   simplecov (~> 0.18.5)
@@ -1631,7 +1623,7 @@ DEPENDENCIES
   spring-commands-rspec (~> 1.0.4)
   sprite-factory (~> 1.7)
   sprockets (~> 3.7.0)
-  sshkey (~> 2.0)
+  ssh_data (~> 1.2)
   stackprof (~> 0.2.15)
   state_machines-activerecord (~> 0.8.0)
   sys-filesystem (~> 1.4.3)
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
index 025378dd5dbd..0a2d8394e007 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
@@ -16,10 +16,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0z3ab9n901craqd3p1yl87kawci0vfw1xlh4d0zkj7lx8hpk10sn";
+      sha256 = "0abclh3rd7s2k88bj40jn9wcmal8dcybvn5xrnl80xknmxh3zigp";
       type = "gem";
     };
-    version = "6.1.4.4";
+    version = "6.1.4.6";
   };
   actionmailbox = {
     dependencies = ["actionpack" "activejob" "activerecord" "activestorage" "activesupport" "mail"];
@@ -27,10 +27,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0q94js7ifm0a76xcwxin98bhr8nz0zqcsqi4y7j2mfwm3hq3bh0i";
+      sha256 = "0qhnkz4fs45zid30lnc77m4rw7an6pp2pdmkwkn6cczikqz5sklw";
       type = "gem";
     };
-    version = "6.1.4.4";
+    version = "6.1.4.6";
   };
   actionmailer = {
     dependencies = ["actionpack" "actionview" "activejob" "activesupport" "mail" "rails-dom-testing"];
@@ -38,10 +38,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1gncnc5xl1ff70mfnqcys2qy65201yjrkwxx0hb5hl7jlamgvz9h";
+      sha256 = "0mqcmxv28wy2jrpk9vghq7njjr03drw0ab3hw64j2d9kbpnpb8w8";
       type = "gem";
     };
-    version = "6.1.4.4";
+    version = "6.1.4.6";
   };
   actionpack = {
     dependencies = ["actionview" "activesupport" "rack" "rack-test" "rails-dom-testing" "rails-html-sanitizer"];
@@ -49,10 +49,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "171ida68hrk21cq1zz1kfl9h94a3qw5p3afviqzsirl0kx6qjyv9";
+      sha256 = "1d4nxv0p3wv4w0pf89nmxzg10balny5rwbchwsscgiminzh3mg7y";
       type = "gem";
     };
-    version = "6.1.4.4";
+    version = "6.1.4.6";
   };
   actiontext = {
     dependencies = ["actionpack" "activerecord" "activestorage" "activesupport" "nokogiri"];
@@ -60,10 +60,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1j9591z8lsp9lx3l75699prw6rgkhhlrfaj4lh5klcdffvxzkvi3";
+      sha256 = "1n2n52m5j6h370r5j18w76kgqzzkcv8x72p040l16ax40ysglq7p";
       type = "gem";
     };
-    version = "6.1.4.4";
+    version = "6.1.4.6";
   };
   actionview = {
     dependencies = ["activesupport" "builder" "erubi" "rails-dom-testing" "rails-html-sanitizer"];
@@ -71,10 +71,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1lm2pf35p6q4ff78z175h6ihmzfg2j7ssn41374rb9iy9gpiiidm";
+      sha256 = "0cmxc80gg7pm6d9y7ah5qr4ymzks8rp51jv0a2qdq2m9p6llzlkk";
       type = "gem";
     };
-    version = "6.1.4.4";
+    version = "6.1.4.6";
   };
   activejob = {
     dependencies = ["activesupport" "globalid"];
@@ -82,10 +82,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0sf0nfjcj1na4v6zaxz6hjglax99yznaymjzpk1fi7mk71qf5hx4";
+      sha256 = "02dnr16mgwp98n9q733nprfx7dn09z6pa11cfk0pivj8daad5x1l";
       type = "gem";
     };
-    version = "6.1.4.4";
+    version = "6.1.4.6";
   };
   activemodel = {
     dependencies = ["activesupport"];
@@ -93,10 +93,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0g3qdz8dw6zkgz45jd13lwfdnm7rhgczv1pssw63g9k6qj3bkxjm";
+      sha256 = "0izra8g3g1agv3mz72b0474adkj4ldszj3nwk3l0szgrln7df0lv";
       type = "gem";
     };
-    version = "6.1.4.4";
+    version = "6.1.4.6";
   };
   activerecord = {
     dependencies = ["activemodel" "activesupport"];
@@ -104,10 +104,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "090d4wl1pq06m9mibpck0m5nm8h45fwhs3fjx27297kjmnv4gzik";
+      sha256 = "15v0dwp2122yzwlw8ca0lgx5qbw8fsasbn8zzcks1mvmc9afisss";
       type = "gem";
     };
-    version = "6.1.4.4";
+    version = "6.1.4.6";
   };
   activerecord-explain-analyze = {
     dependencies = ["activerecord" "pg"];
@@ -126,10 +126,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0a6mmm1s8abv11ycqs6cq55kr6j89jpclkcnra9w2k47rl047vk4";
+      sha256 = "1kngq1555jphy5yhmz4yfigpk3ms4b65ynzy5yssrlhbmdf8r430";
       type = "gem";
     };
-    version = "6.1.4.4";
+    version = "6.1.4.6";
   };
   activesupport = {
     dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo" "zeitwerk"];
@@ -137,10 +137,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0rvnz9lsf9mrkpji748sf51f54m027snkw6rm8flyvf7fq18rm98";
+      sha256 = "0vrz4vgqz4grr2ykwkd8zhhd0rg12z89n89zl6aff17zrdhhad35";
       type = "gem";
     };
-    version = "6.1.4.4";
+    version = "6.1.4.6";
   };
   acts-as-taggable-on = {
     dependencies = ["activerecord"];
@@ -479,16 +479,6 @@
     };
     version = "3.1.16";
   };
-  bcrypt_pbkdf = {
-    groups = ["ed25519"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0ndamfaivnkhc6hy0yqyk2gkwr6f3bz6216lh74hsiiyk3axz445";
-      type = "gem";
-    };
-    version = "1.1.0";
-  };
   benchmark = {
     groups = ["default" "development"];
     platforms = [];
@@ -745,14 +735,14 @@
     version = "3.0.2";
   };
   claide = {
-    groups = ["default" "development"];
+    groups = ["danger" "default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0kasxsms24fgcdsq680nz99d5lazl9rmz1qkil2y5gbbssx89g0z";
+      sha256 = "0bpqhc0kqjp1bh9b7ffc395l9gfls0337rrhmab4v46ykl45qg3d";
       type = "gem";
     };
-    version = "1.0.3";
+    version = "1.1.0";
   };
   claide-plugins = {
     dependencies = ["cork" "nap" "open4"];
@@ -814,10 +804,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0lflx29mlznf1hn0nihkgllzbj8xp5qasn8j7h838465pi399k68";
+      sha256 = "0ffdxhgirgc86qb42yvmfj6v1v0x4lvi0pxn9zhghkff44wzra0k";
       type = "gem";
     };
-    version = "2.2.2";
+    version = "2.2.5";
   };
   contracts = {
     groups = ["default"];
@@ -1253,16 +1243,6 @@
     };
     version = "0.3.0";
   };
-  ed25519 = {
-    groups = ["ed25519"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1f5kr8za7hvla38fc0n9jiv55iq62k5bzclsa5kdb14l3r4w6qnw";
-      type = "gem";
-    };
-    version = "1.2.4";
-  };
   elasticsearch = {
     dependencies = ["elasticsearch-api" "elasticsearch-transport"];
     groups = ["default"];
@@ -1896,10 +1876,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "175whfk08jrmvssh5lgk0zgsaksbnhv6p5fg3picknrw4v05vw85";
+      sha256 = "0dl80qvyl1jbcc1iabpja3pnsrfag92h25c2r3vqn3bd0x9q4iwc";
       type = "gem";
     };
-    version = "14.6.0.pre.rc1";
+    version = "14.8.0.pre.rc1";
   };
   github-markup = {
     groups = ["default"];
@@ -1939,21 +1919,21 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0pgb0v41qn2cnzzn4fizffds07vhz9sf09bpmm0lw86x8lz6vfdq";
+      sha256 = "0xd7sgl5iwxq2mvx7ql1wpciqrnj2z1ycjxm5ddrdi4kcl9f94z4";
       type = "gem";
     };
-    version = "2.6.1";
+    version = "2.8.0";
   };
   gitlab-experiment = {
-    dependencies = ["activesupport" "request_store" "scientist"];
+    dependencies = ["activesupport" "request_store"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "064iy0pgjfvfcxynclmk70cdi10hwx7xzq1c14p68cilg569vma2";
+      sha256 = "1ph12qxhml2iq02sad7hybi5yrc5zvz2spav2ahfh3ks2fvs7cbx";
       type = "gem";
     };
-    version = "0.6.5";
+    version = "0.7.0";
   };
   gitlab-fog-azure-rm = {
     dependencies = ["azure-storage-blob" "azure-storage-common" "fog-core" "fog-json" "mime-types" "ms_rest_azure"];
@@ -1972,20 +1952,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "05fs11wpqn801dsscs845629hbgwbgs94qhig45jmalw4h9rira4";
+      sha256 = "1vs5q1lfk5i953gv2xvz6h5x6ycllr8hdzg81zsrz7hy3aygxknj";
       type = "gem";
     };
-    version = "0.21.3";
+    version = "0.22.0";
   };
   gitlab-license = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "01hddqd3167360m1h5lnrgxd0gmwhaisb9qz89rprhi5ckzyx2gz";
+      sha256 = "1ys98a5qwih4l9zllsysd48d7jl5qcw2ralav0hab3lxalmy5pwf";
       type = "gem";
     };
-    version = "2.0.0";
+    version = "2.1.0";
   };
   gitlab-license_finder = {
     dependencies = ["rubyzip" "thor" "tomlrb" "with_env" "xml-simple"];
@@ -2487,10 +2467,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "004cgs4xg5n6byjs7qld0xhsjq3n6ydfh897myr2mibvh6fjc49g";
+      sha256 = "19370bc97gsy2j4hanij246hv1ddc85hw0xjb6sj7n1ykqdlx9l9";
       type = "gem";
     };
-    version = "1.0.3";
+    version = "1.0.4";
   };
   http-form_data = {
     groups = ["default"];
@@ -2540,10 +2520,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0vdd1kii40qhbr9n8qx71k2gskq6rkl8ygy8hw5hfj8bb5a364xf";
+      sha256 = "1nancdgq51wk3c1pkxps0rkjsfdwnkx60hzkm947m5rzsz8b2sw8";
       type = "gem";
     };
-    version = "1.8.11";
+    version = "1.9.1";
   };
   i18n_data = {
     groups = ["default"];
@@ -3955,10 +3935,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1xblxnrs0c5m326v7kgr32k4m00cl2ipcf5m0qvyisrw62vd5dbn";
+      sha256 = "1np2myaxlk5iab1zarwgmp7zsjvm5j8ssg35ijv8b6dpvc3cjd56";
       type = "gem";
     };
-    version = "5.5.2";
+    version = "5.6.2";
   };
   puma_worker_killer = {
     dependencies = ["get_process_mem" "puma"];
@@ -4093,10 +4073,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10vylypjzfp6c34zx175x7ql7h27llmjdhgjxp5bn2zmrx3lac8l";
+      sha256 = "01mvxg2rmwiqcw0alfd526axg7y1knj0lhy4i2mmxa3q0v7xb8za";
       type = "gem";
     };
-    version = "6.1.4.4";
+    version = "6.1.4.6";
   };
   rails-controller-testing = {
     dependencies = ["actionpack" "actionview" "activesupport"];
@@ -4148,10 +4128,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1nmyds2www6dmqbbd5ggq31gxxb9mwxd5llzmb3iyczssk6l7lla";
+      sha256 = "1snhwpbnmsyhr297qmin8i5i631aimjca1hiazi128i1355255hb";
       type = "gem";
     };
-    version = "6.1.4.4";
+    version = "6.1.4.6";
   };
   rainbow = {
     groups = ["default" "development" "test"];
@@ -4335,10 +4315,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0vg7imjnfcqjx7kw94ccj5r78j4g190cqzi1i59sh4a0l940b9cr";
+      sha256 = "155f6cr4rrfw5bs5xd3m5kfw32qhc5fsi4nk82rhif56rc6cs0wm";
       type = "gem";
     };
-    version = "2.1.1";
+    version = "2.2.1";
   };
   regexp_property_values = {
     groups = ["default"];
@@ -4367,10 +4347,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0cx74kispmnw3ljwb239j65a2j14n8jlsygy372hrsa8mxc71hxi";
+      sha256 = "13ppgmsbrqah08j06bybd3cddv6dml79yzyjn7r8j1src78h98h7";
       type = "gem";
     };
-    version = "1.5.0";
+    version = "1.5.1";
   };
   responders = {
     dependencies = ["actionpack" "railties"];
@@ -4772,10 +4752,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1gz0ri0pa2xr7b6bf66yjc2wfvk51f4gi6yk7bklwl1nr65zc4gz";
+      sha256 = "0grps9197qyxakbpw02pda59v45lfgbgiyw48i0mq9f2bn9y6mrz";
       type = "gem";
     };
-    version = "2.0.0";
+    version = "2.3.2";
   };
   rugged = {
     groups = ["default"];
@@ -4842,15 +4822,15 @@
     version = "4.0.0";
   };
   sassc = {
-    dependencies = ["ffi" "rake"];
+    dependencies = ["ffi"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1sr4825rlwsrl7xrsm0sgalcpf5zgp4i56dbi3qxfa9lhs8r6zh4";
+      sha256 = "0gpqv48xhl8mb8qqhcifcp0pixn206a7imc07g48armklfqa4q2c";
       type = "gem";
     };
-    version = "2.0.1";
+    version = "2.4.0";
   };
   sassc-rails = {
     dependencies = ["railties" "sassc" "sprockets" "sprockets-rails" "tilt"];
@@ -4874,16 +4854,6 @@
     };
     version = "0.8.2";
   };
-  scientist = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "05xiv6kznhawbkjrz97s6lp2ld0w95x1l2s80gm8m49f273399s2";
-      type = "gem";
-    };
-    version = "1.6.2";
-  };
   sd_notify = {
     groups = ["puma"];
     platforms = [];
@@ -4994,10 +4964,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0k38cbwhcj9ncfzlgfmvq2zqfdvldln58w8s8v89m0jqlhnhsqhj";
+      sha256 = "10pllqwracvy5nmchipg359sq9pnyg08q970xpqmpc3nkmrihxlf";
       type = "gem";
     };
-    version = "6.3.1";
+    version = "6.4.0";
   };
   sidekiq-cron = {
     dependencies = ["fugit" "sidekiq"];
@@ -5200,15 +5170,15 @@
     };
     version = "1.3.13";
   };
-  sshkey = {
+  ssh_data = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "03bkn55qsng484iqwz2lmm6rkimj01vsvhwk661s3lnmpkl65lbp";
+      sha256 = "0p3vaq2fbmlphphqr0yjc5cyzzxjizq4zbxbbw3j2vpgdcmpi6bs";
       type = "gem";
     };
-    version = "2.0.0";
+    version = "1.2.0";
   };
   ssrf_filter = {
     groups = ["default"];
@@ -5645,10 +5615,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0wc47r23h063l8ysws8sy24gzh74mks81cak3lkzlrw4qkqb3sg4";
+      sha256 = "0jmbimpnpjdzz8hlrppgl9spm99qh3qzbx0b81k3gkgwba8nk3yd";
       type = "gem";
     };
-    version = "0.0.7.7";
+    version = "0.0.8";
   };
   unicode-display_width = {
     groups = ["default" "development" "test"];
@@ -5948,9 +5918,9 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0lmg9x683gr9mkrbq9df2m0zb0650mdfxqna0bs10js44inv7znx";
+      sha256 = "09bq7j2p6mkbxnsg71s253dm2463kg51xc7bmjcxgyblqbh4ln7m";
       type = "gem";
     };
-    version = "2.5.3";
+    version = "2.5.4";
   };
 }
diff --git a/pkgs/desktops/plasma-5/discover.nix b/pkgs/desktops/plasma-5/discover.nix
index e065837cd2fd..b10fab16f76e 100644
--- a/pkgs/desktops/plasma-5/discover.nix
+++ b/pkgs/desktops/plasma-5/discover.nix
@@ -1,5 +1,6 @@
 { mkDerivation
 , lib
+, fetchpatch
 , extra-cmake-modules
 , gettext
 , kdoctools
@@ -61,4 +62,13 @@ mkDerivation {
     kxmlgui
     plasma-framework
   ];
+  patches = [
+    # The following patch mitigates a cache expiration bug. Upstream requested
+    # we backport this patch to reduce load on KDE infrastructure:
+    # https://mail.kde.org/pipermail/distributions/2022-February/001140.html
+    (fetchpatch {
+      url = "https://invent.kde.org/plasma/discover/-/commit/6257e21c313e21afd80d101d24c78d66621236b1.patch";
+      sha256 = "1sss2wk0qnyk4cv475k1fjkkcd6nskz3hfy5y9nnrxpnw51xai38";
+    })
+  ];
 }
diff --git a/pkgs/development/libraries/kde-frameworks/knewstuff/default.nix b/pkgs/development/libraries/kde-frameworks/knewstuff/default.nix
index 6d170c0bb129..b50c8f9d700b 100644
--- a/pkgs/development/libraries/kde-frameworks/knewstuff/default.nix
+++ b/pkgs/development/libraries/kde-frameworks/knewstuff/default.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, fetchpatch,
+  mkDerivation, lib, fetchpatch,
   extra-cmake-modules,
   attica, karchive, kcompletion, kconfig, kcoreaddons, ki18n, kiconthemes,
   kio, kitemviews, kpackage, kservice, ktextwidgets, kwidgetsaddons, kxmlgui, qtbase,
@@ -17,5 +17,13 @@ mkDerivation {
   propagatedBuildInputs = [ attica kservice kxmlgui ];
   patches = [
     ./0001-Delay-resolving-knsrcdir.patch
+    # The following two patches mitigate a cache expiration bug. Upstream
+    # requested we backport these patches to reduce load on KDE infrastructure:
+    # https://mail.kde.org/pipermail/distributions/2022-February/001140.html
+    (fetchpatch {
+      url = "https://invent.kde.org/frameworks/knewstuff/-/commit/c8165b7a0d622e318b3353ccf257a8f229dd12c9.patch";
+      sha256 = "1b6cbxzfqnnym6gkb8vkhgffibyk560bfcvx0znsnlx03ahavdmf";
+    })
+    ./knewstuff-httpworker-cache-expiry.patch
   ];
 }
diff --git a/pkgs/development/libraries/kde-frameworks/knewstuff/knewstuff-httpworker-cache-expiry.patch b/pkgs/development/libraries/kde-frameworks/knewstuff/knewstuff-httpworker-cache-expiry.patch
new file mode 100644
index 000000000000..a2fb76645302
--- /dev/null
+++ b/pkgs/development/libraries/kde-frameworks/knewstuff/knewstuff-httpworker-cache-expiry.patch
@@ -0,0 +1,30 @@
+diff --git a/src/core/jobs/httpworker.cpp b/src/core/jobs/httpworker.cpp
+index b81edd2d..82f12e38 100644
+--- a/src/core/jobs/httpworker.cpp
++++ b/src/core/jobs/httpworker.cpp
+@@ -41,7 +41,6 @@ public:
+         return nam.get(request);
+     }
+ 
+-private:
+     QNetworkDiskCache cache;
+ };
+ 
+@@ -102,6 +101,17 @@ static void addUserAgent(QNetworkRequest &request)
+         agentHeader += QStringLiteral("-%1/%2").arg(QCoreApplication::instance()->applicationName(), QCoreApplication::instance()->applicationVersion());
+     }
+     request.setHeader(QNetworkRequest::UserAgentHeader, agentHeader);
++
++    // Assume that no cache expiration time will be longer than a week, but otherwise prefer the cache
++    // This is mildly hacky, but if we don't do this, we end up with infinite cache expirations in some
++    // cases, which of course isn't really acceptable... See ed62ee20 for a situation where that happened.
++    QNetworkCacheMetaData cacheMeta{s_httpWorkerNAM->cache.metaData(request.url())};
++    if (cacheMeta.isValid()) {
++        const QDateTime nextWeek{QDateTime::currentDateTime().addDays(7)};
++        if (cacheMeta.expirationDate().isValid() && cacheMeta.expirationDate() < nextWeek) {
++            request.setAttribute(QNetworkRequest::CacheLoadControlAttribute, QNetworkRequest::PreferCache);
++        }
++    }
+ }
+ 
+ void HTTPWorker::startRequest()
diff --git a/pkgs/tools/package-management/disnix/default.nix b/pkgs/tools/package-management/disnix/default.nix
index 0e22a24c0995..dedb57960b35 100644
--- a/pkgs/tools/package-management/disnix/default.nix
+++ b/pkgs/tools/package-management/disnix/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "disnix";
-  version = "0.10.1";
+  version = "0.10.2";
 
   src = fetchurl {
-    url = "https://github.com/svanderburg/disnix/releases/download/disnix-${version}/disnix-${version}.tar.gz";
-    sha256 = "13rjw1va7l8w7ir73xqxq4zb3ig2iwhiwxhp5dbfv0z3gnqizghq";
+    url = "https://github.com/svanderburg/disnix/releases/download/${pname}-${version}/${pname}-${version}.tar.gz";
+    sha256 = "0mc0wy8fca60w0d56cljq2cw1xigbp2dklb43fxa5xph94j3i49a";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/tools/package-management/disnix/disnixos/default.nix b/pkgs/tools/package-management/disnix/disnixos/default.nix
index 639d19782106..35541fa36ac5 100644
--- a/pkgs/tools/package-management/disnix/disnixos/default.nix
+++ b/pkgs/tools/package-management/disnix/disnixos/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "disnixos";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchurl {
-    url = "https://github.com/svanderburg/disnixos/releases/download/disnixos-${version}/disnixos-${version}.tar.gz";
-    sha256 = "1n2psq1b8bg340i2i0yf5xy2rf78fwqd3wj342wcmq09cv2v8d1b";
+    url = "https://github.com/svanderburg/disnixos/releases/download/${pname}-${version}/${pname}-${version}.tar.gz";
+    sha256 = "0zcghb9nm911bfwpzcgj4ga2cndxbzp5pmrxff711qydrwgy7sg7";
   };
 
   nativeBuildInputs = [ pkg-config ];