Merge branch 'staging-next' into staging

138 files changed, 1424 insertions, 717 deletions

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 17777b05872..7d6d7205a14 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -96,8 +96,8 @@
 /pkgs/development/ruby-modules      @alyssais
 
 # Rust
-/pkgs/development/compilers/rust @Mic92 @LnL7
-/pkgs/build-support/rust @andir
+/pkgs/development/compilers/rust @Mic92 @LnL7 @zowoq
+/pkgs/build-support/rust @andir @zowoq
 
 # Darwin-related
 /pkgs/stdenv/darwin         @NixOS/darwin-maintainers
diff --git a/.github/workflows/editorconfig.yml b/.github/workflows/editorconfig.yml
index 7f1808d35f2..d61882c5040 100644
--- a/.github/workflows/editorconfig.yml
+++ b/.github/workflows/editorconfig.yml
@@ -14,7 +14,7 @@ jobs:
     - name: Fetch editorconfig-checker
       if: env.GIT_DIFF
       env:
-        ECC_VERSION: "2.1.0"
+        ECC_VERSION: "2.2.0"
         ECC_URL: "https://github.com/editorconfig-checker/editorconfig-checker/releases/download"
       run: |
         curl -sSf -O -L -C - "$ECC_URL/$ECC_VERSION/ec-linux-amd64.tar.gz" && \
diff --git a/lib/filesystem.nix b/lib/filesystem.nix
index fc35a1a72c6..0a1275e547c 100644
--- a/lib/filesystem.nix
+++ b/lib/filesystem.nix
@@ -42,4 +42,16 @@
               type = (builtins.readDir parent).${base} or null;
           in file == /. || type == "directory";
     in go (if isDir then file else parent);
+
+
+  # listFilesRecursive: Path -> [ Path ]
+  #
+  # Given a directory, return a flattened list of all files within it recursively.
+  listFilesRecursive = dir: lib.flatten (lib.mapAttrsToList (name: type:
+    if type == "directory" then
+      lib.filesystem.listFilesRecursive (dir + "/${name}")
+    else
+      dir + "/${name}"
+  ) (builtins.readDir dir));
+
 }
diff --git a/lib/strings.nix b/lib/strings.nix
index 9fa9f023561..d81e46a1763 100644
--- a/lib/strings.nix
+++ b/lib/strings.nix
@@ -315,6 +315,16 @@ rec {
   */
   escapeNixString = s: escape ["$"] (builtins.toJSON s);
 
+  /* Turn a string into an exact regular expression
+
+     Type: string -> string
+
+     Example:
+       escapeRegex "[^a-z]*"
+       => "\\[\\^a-z]\\*"
+  */
+  escapeRegex = escape (stringToCharacters "\\[{()^$?*+|.");
+
   /* Quotes a string if it can't be used as an identifier directly.
 
      Type: string -> string
@@ -386,8 +396,6 @@ rec {
   /* Cut a string with a separator and produces a list of strings which
      were separated by this separator.
 
-     NOTE: this function is not performant and should never be used.
-
      Example:
        splitString "." "foo.bar.baz"
        => [ "foo" "bar" "baz" ]
@@ -396,26 +404,11 @@ rec {
   */
   splitString = _sep: _s:
     let
-      sep = addContextFrom _s _sep;
-      s = addContextFrom _sep _s;
-      sepLen = stringLength sep;
-      sLen = stringLength s;
-      lastSearch = sLen - sepLen;
-      startWithSep = startAt:
-        substring startAt sepLen s == sep;
-
-      recurse = index: startAt:
-        let cutUntil = i: [(substring startAt (i - startAt) s)]; in
-        if index <= lastSearch then
-          if startWithSep index then
-            let restartAt = index + sepLen; in
-            cutUntil index ++ recurse restartAt restartAt
-          else
-            recurse (index + 1) startAt
-        else
-          cutUntil sLen;
+      sep = builtins.unsafeDiscardStringContext _sep;
+      s = builtins.unsafeDiscardStringContext _s;
+      splits = builtins.filter builtins.isString (builtins.split (escapeRegex sep) s);
     in
-      recurse 0 0;
+      map (v: addContextFrom _sep (addContextFrom _s v)) splits;
 
   /* Return a string without the specified prefix, if the prefix matches.
 
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index 3a6db53c276..6175f15819a 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -154,6 +154,20 @@ runTests {
     expected = [ "2001" "db8" "0" "0042" "" "8a2e" "370" "" ];
   };
 
+  testSplitStringsRegex = {
+    expr = strings.splitString "\\[{}]()^$?*+|." "A\\[{}]()^$?*+|.B";
+    expected = [ "A" "B" ];
+  };
+
+  testSplitStringsDerivation = {
+    expr = take 3  (strings.splitString "/" (derivation {
+      name = "name";
+      builder = "builder";
+      system = "system";
+    }));
+    expected = ["" "nix" "store"];
+  };
+
   testSplitVersionSingle = {
     expr = versions.splitVersion "1";
     expected = [ "1" ];
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 8f46e575324..498fa758904 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -6003,6 +6003,12 @@
     githubId = 788953;
     name = "Matthijs Steen";
   };
+  mstrangfeld = {
+    email = "marvin@strangfeld.io";
+    github = "mstrangfeld";
+    githubId = 36842980;
+    name = "Marvin Strangfeld";
+  };
   mt-caret = {
     email = "mtakeda.enigsol@gmail.com";
     github = "mt-caret";
@@ -7419,6 +7425,12 @@
     githubId = 1387224;
     name = "Richard Szibele";
   };
+  rtburns-jpl = {
+    email = "rtburns@jpl.nasa.gov";
+    github = "rtburns-jpl";
+    githubId = 47790121;
+    name = "Ryan Burns";
+  };
   rtreffer = {
     email = "treffer+nixos@measite.de";
     github = "rtreffer";
diff --git a/nixos/doc/manual/development/running-nixos-tests-interactively.xml b/nixos/doc/manual/development/running-nixos-tests-interactively.xml
index a11a9382764..a6044d5f89e 100644
--- a/nixos/doc/manual/development/running-nixos-tests-interactively.xml
+++ b/nixos/doc/manual/development/running-nixos-tests-interactively.xml
@@ -9,7 +9,7 @@
   The test itself can be run interactively. This is particularly useful when
   developing or debugging a test:
 <screen>
-<prompt>$ </prompt>nix-build nixos/tests/login.nix -A driver
+<prompt>$ </prompt>nix-build nixos/tests/login.nix -A driverInteractive
 <prompt>$ </prompt>./result/bin/nixos-test-driver
 starting VDE switch for network 1
 <prompt>&gt;</prompt>
@@ -30,7 +30,7 @@ starting VDE switch for network 1
  <para>
   To just start and experiment with the VMs, run:
 <screen>
-<prompt>$ </prompt>nix-build nixos/tests/login.nix -A driver
+<prompt>$ </prompt>nix-build nixos/tests/login.nix -A driverInteractive
 <prompt>$ </prompt>./result/bin/nixos-run-vms
 </screen>
   The script <command>nixos-run-vms</command> starts the virtual machines
diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml
index 04086275d7c..782227de06f 100644
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@@ -643,6 +643,13 @@ systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
      In the <literal>resilio</literal> module, <xref linkend="opt-services.resilio.httpListenAddr"/> has been changed to listen to <literal>[::1]</literal> instead of <literal>0.0.0.0</literal>.
      </para>
    </listitem>
+     <listitem>
+       <para>
+         <literal>sslh</literal> has been updated to version
+           <literal>1.21</literal>. The <literal>ssl</literal> probe must be
+             renamed to <literal>tls</literal> in <xref linkend="opt-services.sslh.appendConfig"/>.
+    </para>
+  </listitem>
    <listitem>
     <para>
      Users of <link xlink:href="http://openafs.org">OpenAFS 1.6</link> must
diff --git a/nixos/lib/build-vms.nix b/nixos/lib/build-vms.nix
index b1575fc13bb..ebbb0296bef 100644
--- a/nixos/lib/build-vms.nix
+++ b/nixos/lib/build-vms.nix
@@ -18,9 +18,6 @@ rec {
 
   inherit pkgs;
 
-  qemu = pkgs.qemu_test;
-
-
   # Build a virtual network from an attribute set `{ machine1 =
   # config1; ... machineN = configN; }', where `machineX' is the
   # hostname and `configX' is a NixOS system configuration.  Each
@@ -39,7 +36,6 @@ rec {
         [ ../modules/virtualisation/qemu-vm.nix
           ../modules/testing/test-instrumentation.nix # !!! should only get added for automated test runs
           { key = "no-manual"; documentation.nixos.enable = false; }
-          { key = "qemu"; system.build.qemu = qemu; }
           { key = "nodes"; _module.args.nodes = nodes; }
         ] ++ optional minimal ../modules/testing/minimal-kernel.nix;
     };
diff --git a/nixos/lib/testing-python.nix b/nixos/lib/testing-python.nix
index 498f97336c0..302c7f78bf8 100644
--- a/nixos/lib/testing-python.nix
+++ b/nixos/lib/testing-python.nix
@@ -17,9 +17,9 @@ rec {
   inherit pkgs;
 
 
-  testDriver = let
+  mkTestDriver = let
     testDriverScript = ./test-driver/test-driver.py;
-  in stdenv.mkDerivation {
+  in qemu_pkg: stdenv.mkDerivation {
     name = "nixos-test-driver";
 
     nativeBuildInputs = [ makeWrapper ];
@@ -47,10 +47,12 @@ rec {
         # TODO: copy user script part into this file (append)
 
         wrapProgram $out/bin/nixos-test-driver \
-          --prefix PATH : "${lib.makeBinPath [ qemu_test vde2 netpbm coreutils ]}" \
+          --prefix PATH : "${lib.makeBinPath [ qemu_pkg vde2 netpbm coreutils ]}" \
       '';
   };
 
+  testDriver = mkTestDriver qemu_test;
+  testDriverInteractive = mkTestDriver qemu_kvm;
 
   # Run an automated test suite in the given virtual network.
   # `driver' is the script that runs the network.
@@ -113,7 +115,11 @@ rec {
       # Generate convenience wrappers for running the test driver
       # interactively with the specified network, and for starting the
       # VMs from the command line.
-      driver = let warn = if skipLint then lib.warn "Linting is disabled!" else lib.id; in warn (runCommand testDriverName
+      driver = testDriver:
+        let
+          warn = if skipLint then lib.warn "Linting is disabled!" else lib.id;
+        in
+        warn (runCommand testDriverName
         { buildInputs = [ makeWrapper];
           testScript = testScript';
           preferLocalBuild = true;
@@ -148,7 +154,7 @@ rec {
         meta = (drv.meta or {}) // t.meta;
       };
 
-      test = passMeta (runTests driver);
+      test = passMeta (runTests (driver testDriver));
 
       nodeNames = builtins.attrNames nodes;
       invalidNodeNames = lib.filter
@@ -165,7 +171,9 @@ rec {
         ''
       else
         test // {
-          inherit nodes driver test;
+          inherit nodes test;
+          driver = driver testDriver;
+          driverInteractive = driver testDriverInteractive;
         };
 
   runInMachine =
diff --git a/nixos/modules/config/no-x-libs.nix b/nixos/modules/config/no-x-libs.nix
index 941ab78f863..c3120c2bf30 100644
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@@ -30,11 +30,12 @@ with lib;
       cairo = super.cairo.override { x11Support = false; };
       dbus = super.dbus.override { x11Support = false; };
       networkmanager-fortisslvpn = super.networkmanager-fortisslvpn.override { withGnome = false; };
+      networkmanager-iodine = super.networkmanager-iodine.override { withGnome = false; };
       networkmanager-l2tp = super.networkmanager-l2tp.override { withGnome = false; };
       networkmanager-openconnect = super.networkmanager-openconnect.override { withGnome = false; };
       networkmanager-openvpn = super.networkmanager-openvpn.override { withGnome = false; };
+      networkmanager-sstp = super.networkmanager-vpnc.override { withGnome = false; };
       networkmanager-vpnc = super.networkmanager-vpnc.override { withGnome = false; };
-      networkmanager-iodine = super.networkmanager-iodine.override { withGnome = false; };
       gobject-introspection = super.gobject-introspection.override { x11Support = false; };
       qemu = super.qemu.override { gtkSupport = false; spiceSupport = false; sdlSupport = false; };
     }));
diff --git a/nixos/modules/installer/tools/nix-fallback-paths.nix b/nixos/modules/installer/tools/nix-fallback-paths.nix
index a15a2dbadb8..bd70bd20013 100644
--- a/nixos/modules/installer/tools/nix-fallback-paths.nix
+++ b/nixos/modules/installer/tools/nix-fallback-paths.nix
@@ -1,6 +1,6 @@
 {
-  x86_64-linux = "/nix/store/4vz8sh9ngx34ivi0bw5hlycxdhvy5hvz-nix-2.3.7";
-  i686-linux = "/nix/store/dzxkg9lpp60bjmzvagns42vqlz3yq5kx-nix-2.3.7";
-  aarch64-linux = "/nix/store/cfvf8nl8mwyw817by5y8zd3s8pnf5m9f-nix-2.3.7";
-  x86_64-darwin = "/nix/store/5ira7xgs92inqz1x8l0n1wci4r79hnd0-nix-2.3.7";
+  x86_64-linux = "/nix/store/qxayqjmlpqnmwg5yfsjjayw220ls8i2r-nix-2.3.8";
+  i686-linux = "/nix/store/5834psaay75048jp6d07liqh4j0v1swd-nix-2.3.8";
+  aarch64-linux = "/nix/store/pic90a5fxvifz05jzkd0zak21f9mjin6-nix-2.3.8";
+  x86_64-darwin = "/nix/store/cjx3f8z12wlayp5983kli2a52ipi8jz2-nix-2.3.8";
 }
diff --git a/nixos/modules/services/continuous-integration/hydra/default.nix b/nixos/modules/services/continuous-integration/hydra/default.nix
index 502a5898a5d..252ca17006d 100644
--- a/nixos/modules/services/continuous-integration/hydra/default.nix
+++ b/nixos/modules/services/continuous-integration/hydra/default.nix
@@ -37,8 +37,6 @@ let
 
   haveLocalDB = cfg.dbi == localDB;
 
-  inherit (config.system) stateVersion;
-
   hydra-package =
   let
     makeWrapperArgs = concatStringsSep " " (mapAttrsToList (key: value: "--set \"${key}\" \"${value}\"") hydraEnv);
@@ -96,7 +94,8 @@ in
 
       package = mkOption {
         type = types.package;
-        defaultText = "pkgs.hydra";
+        default = pkgs.hydra-unstable;
+        defaultText = "pkgs.hydra-unstable";
         description = "The Hydra package.";
       };
 
@@ -225,34 +224,6 @@ in
 
   config = mkIf cfg.enable {
 
-    warnings = optional (cfg.package.migration or false) ''
-      You're currently deploying an older version of Hydra which is needed to
-      make some required database changes[1]. As soon as this is done, it's recommended
-      to run `hydra-backfill-ids` and set `services.hydra.package` to `pkgs.hydra-unstable`
-      after that.
-
-      [1] https://github.com/NixOS/hydra/pull/711
-    '';
-
-    services.hydra.package = with pkgs;
-      mkDefault (
-        if pkgs ? hydra
-          then throw ''
-            The Hydra package doesn't exist anymore in `nixpkgs`! It probably exists
-            due to an overlay. To upgrade Hydra, you need to take two steps as some
-            bigger changes in the database schema were implemented recently[1]. You first
-            need to deploy `pkgs.hydra-migration`, run `hydra-backfill-ids` on the server
-            and then deploy `pkgs.hydra-unstable`.
-
-            If you want to use `pkgs.hydra` from your overlay, please set `services.hydra.package`
-            explicitly to `pkgs.hydra` and make sure you know what you're doing.
-
-            [1] https://github.com/NixOS/hydra/pull/711
-          ''
-        else if versionOlder stateVersion "20.03" then hydra-migration
-        else hydra-unstable
-      );
-
     users.groups.hydra = {
       gid = config.ids.gids.hydra;
     };
diff --git a/nixos/modules/services/misc/jellyfin.nix b/nixos/modules/services/misc/jellyfin.nix
index 0493dadea94..6a47dc3628f 100644
--- a/nixos/modules/services/misc/jellyfin.nix
+++ b/nixos/modules/services/misc/jellyfin.nix
@@ -45,6 +45,46 @@ in
         CacheDirectory = "jellyfin";
         ExecStart = "${cfg.package}/bin/jellyfin --datadir '/var/lib/${StateDirectory}' --cachedir '/var/cache/${CacheDirectory}'";
         Restart = "on-failure";
+
+        # Security options:
+
+        NoNewPrivileges = true;
+
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+
+        # ProtectClock= adds DeviceAllow=char-rtc r
+        DeviceAllow = "";
+
+        LockPersonality = true;
+
+        PrivateTmp = true;
+        PrivateDevices = true;
+        PrivateUsers = true;
+
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+
+        RemoveIPC = true;
+
+        RestrictNamespaces = true;
+        # AF_NETLINK needed because Jellyfin monitors the network connection
+        RestrictAddressFamilies = [ "AF_NETLINK" "AF_INET" "AF_INET6" ];
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+
+        SystemCallArchitectures = "native";
+        SystemCallErrorNumber = "EPERM";
+        SystemCallFilter = [
+          "@system-service"
+
+          "~@chown" "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@module"
+          "~@obsolete" "~@privileged" "~@setuid"
+        ];
       };
     };
 
diff --git a/nixos/modules/services/networking/networkmanager.nix b/nixos/modules/services/networking/networkmanager.nix
index 17c549d42c3..201a51ff70b 100644
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@@ -15,6 +15,7 @@ let
     networkmanager-openconnect
     networkmanager-openvpn
     networkmanager-vpnc
+    networkmanager-sstp
    ] ++ optional (!delegateWireless && !enableIwd) wpa_supplicant;
 
   delegateWireless = config.networking.wireless.enable == true && cfg.unmanaged != [];
@@ -386,6 +387,9 @@ in {
 
       "NetworkManager/VPN/nm-iodine-service.name".source =
         "${networkmanager-iodine}/lib/NetworkManager/VPN/nm-iodine-service.name";
+
+      "NetworkManager/VPN/nm-sstp-service.name".source =
+        "${networkmanager-sstp}/lib/NetworkManager/VPN/nm-sstp-service.name";
       }
       // optionalAttrs (cfg.appendNameservers != [] || cfg.insertNameservers != [])
          {
diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
index 5365b8b9b10..1b745931c4f 100644
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -269,6 +269,7 @@ in
       kexAlgorithms = mkOption {
         type = types.listOf types.str;
         default = [
+          "curve25519-sha256"
           "curve25519-sha256@libssh.org"
           "diffie-hellman-group-exchange-sha256"
         ];
@@ -279,7 +280,7 @@ in
           Defaults to recommended settings from both
           <link xlink:href="https://stribika.github.io/2015/01/04/secure-secure-shell.html" />
           and
-          <link xlink:href="https://wiki.mozilla.org/Security/Guidelines/OpenSSH#Modern_.28OpenSSH_6.7.2B.29" />
+          <link xlink:href="https://infosec.mozilla.org/guidelines/openssh#modern-openssh-67" />
         '';
       };
 
@@ -300,7 +301,7 @@ in
           Defaults to recommended settings from both
           <link xlink:href="https://stribika.github.io/2015/01/04/secure-secure-shell.html" />
           and
-          <link xlink:href="https://wiki.mozilla.org/Security/Guidelines/OpenSSH#Modern_.28OpenSSH_6.7.2B.29" />
+          <link xlink:href="https://infosec.mozilla.org/guidelines/openssh#modern-openssh-67" />
         '';
       };
 
@@ -321,7 +322,7 @@ in
           Defaults to recommended settings from both
           <link xlink:href="https://stribika.github.io/2015/01/04/secure-secure-shell.html" />
           and
-          <link xlink:href="https://wiki.mozilla.org/Security/Guidelines/OpenSSH#Modern_.28OpenSSH_6.7.2B.29" />
+          <link xlink:href="https://infosec.mozilla.org/guidelines/openssh#modern-openssh-67" />
         '';
       };
 
diff --git a/nixos/modules/services/networking/sslh.nix b/nixos/modules/services/networking/sslh.nix
index 0921febba66..4c2740d2019 100644
--- a/nixos/modules/services/networking/sslh.nix
+++ b/nixos/modules/services/networking/sslh.nix
@@ -31,7 +31,7 @@ let
       { name: "openvpn"; host: "localhost"; port: "1194"; probe: "builtin"; },
       { name: "xmpp"; host: "localhost"; port: "5222"; probe: "builtin"; },
       { name: "http"; host: "localhost"; port: "80"; probe: "builtin"; },
-      { name: "ssl"; host: "localhost"; port: "443"; probe: "builtin"; },
+      { name: "tls"; host: "localhost"; port: "443"; probe: "builtin"; },
       { name: "anyprot"; host: "localhost"; port: "443"; probe: "builtin"; }
     );
   '';
diff --git a/nixos/modules/testing/test-instrumentation.nix b/nixos/modules/testing/test-instrumentation.nix
index c0ec76e8a3a..e9f5eac7f5f 100644
--- a/nixos/modules/testing/test-instrumentation.nix
+++ b/nixos/modules/testing/test-instrumentation.nix
@@ -51,7 +51,10 @@ with import ../../lib/qemu-flags.nix { inherit pkgs; };
     #       we avoid defining consoles if not possible.
     # TODO: refactor such that test-instrumentation can import qemu-vm
     #       or declare virtualisation.qemu.console option in a module that's always imported
-    virtualisation = lib.optionalAttrs (options ? virtualisation.qemu.consoles) { qemu.consoles = [ qemuSerialDevice ]; };
+    virtualisation.qemu = {
+      consoles = lib.optional (options ? virtualisation.qemu.consoles) qemuSerialDevice;
+      package  = pkgs.qemu_test;
+    };
 
     boot.initrd.preDeviceCommands =
       ''
@@ -116,6 +119,10 @@ with import ../../lib/qemu-flags.nix { inherit pkgs; };
     users.users.root.initialHashedPassword = mkOverride 150 "";
 
     services.xserver.displayManager.job.logToJournal = true;
+
+    # Make sure we use the Guest Agent from the QEMU package for testing
+    # to reduce the closure size required for the tests.
+    services.qemuGuest.package = pkgs.qemu_test.ga;
   };
 
 }
diff --git a/nixos/modules/virtualisation/qemu-guest-agent.nix b/nixos/modules/virtualisation/qemu-guest-agent.nix
index 665224e35d8..6a735f451a7 100644
--- a/nixos/modules/virtualisation/qemu-guest-agent.nix
+++ b/nixos/modules/virtualisation/qemu-guest-agent.nix
@@ -12,6 +12,11 @@ in {
         default = false;
         description = "Whether to enable the qemu guest agent.";
       };
+      package = mkOption {
+        type = types.package;
+        default = pkgs.qemu.ga;
+        description = "The QEMU guest agent package.";
+      };
   };
 
   config = mkIf cfg.enable (
@@ -25,7 +30,7 @@ in {
       systemd.services.qemu-guest-agent = {
         description = "Run the QEMU Guest Agent";
         serviceConfig = {
-          ExecStart = "${pkgs.qemu.ga}/bin/qemu-ga";
+          ExecStart = "${cfg.package}/bin/qemu-ga";
           Restart = "always";
           RestartSec = 0;
         };
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index 42e43f5ee02..191d7c758c0 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -14,10 +14,11 @@ with import ../../lib/qemu-flags.nix { inherit pkgs; };
 
 let
 
-  qemu = config.system.build.qemu or pkgs.qemu_test;
 
   cfg = config.virtualisation;
 
+  qemu = cfg.qemu.package;
+
   consoles = lib.concatMapStringsSep " " (c: "console=${c}") cfg.qemu.consoles;
 
   driveOpts = { ... }: {
@@ -401,6 +402,14 @@ in
       };
 
     virtualisation.qemu = {
+      package =
+        mkOption {
+          type = types.package;
+          default = pkgs.qemu;
+          example = "pkgs.qemu_test";
+          description = "QEMU package to use.";
+        };
+
       options =
         mkOption {
           type = types.listOf types.unspecified;
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 6564a958d5b..9ffeba27a7f 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -150,7 +150,6 @@ in
   hostname = handleTest ./hostname.nix {};
   hound = handleTest ./hound.nix {};
   hydra = handleTest ./hydra {};
-  hydra-db-migration = handleTest ./hydra/db-migration.nix {};
   i3wm = handleTest ./i3wm.nix {};
   icingaweb2 = handleTest ./icingaweb2.nix {};
   iftop = handleTest ./iftop.nix {};
diff --git a/nixos/tests/hydra/db-migration.nix b/nixos/tests/hydra/db-migration.nix
deleted file mode 100644
index ca65e2e66aa..00000000000
--- a/nixos/tests/hydra/db-migration.nix
+++ /dev/null
@@ -1,92 +0,0 @@
-{ system ? builtins.currentSystem
-, pkgs ? import ../../.. { inherit system; }
-, ...
-}:
-
-let inherit (import ./common.nix { inherit system; }) baseConfig; in
-
-with import ../../lib/testing-python.nix { inherit system pkgs; };
-with pkgs.lib;
-
-{ mig = makeTest {
-    name = "hydra-db-migration";
-    meta = with pkgs.stdenv.lib.maintainers; {
-      maintainers = [ ma27 ];
-    };
-
-    nodes = {
-      original = { pkgs, lib, ... }: {
-        imports = [ baseConfig ];
-
-        # An older version of Hydra before the db change
-        # for testing purposes.
-        services.hydra.package = pkgs.hydra-migration.overrideAttrs (old: {
-          inherit (old) pname;
-          version = "2020-02-06";
-          src = pkgs.fetchFromGitHub {
-            owner = "NixOS";
-            repo = "hydra";
-            rev = "2b4f14963b16b21ebfcd6b6bfa7832842e9b2afc";
-            sha256 = "16q0cffcsfx5pqd91n9k19850c1nbh4vvbd9h8yi64ihn7v8bick";
-          };
-        });
-      };
-
-      migration_phase1 = { pkgs, lib, ... }: {
-        imports = [ baseConfig ];
-        services.hydra.package = pkgs.hydra-migration;
-      };
-
-      finished = { pkgs, lib, ... }: {
-        imports = [ baseConfig ];
-        services.hydra.package = pkgs.hydra-unstable;
-      };
-    };
-
-    testScript = { nodes, ... }: let
-      next = nodes.migration_phase1.config.system.build.toplevel;
-      finished = nodes.finished.config.system.build.toplevel;
-    in ''
-      original.start()
-      original.wait_for_unit("multi-user.target")
-      original.wait_for_unit("postgresql.service")
-      original.wait_for_unit("hydra-init.service")
-      original.require_unit_state("hydra-queue-runner.service")
-      original.require_unit_state("hydra-evaluator.service")
-      original.require_unit_state("hydra-notify.service")
-      original.succeed("hydra-create-user admin --role admin --password admin")
-      original.wait_for_open_port(3000)
-      original.succeed("create-trivial-project.sh")
-      original.wait_until_succeeds(
-          'curl -L -s http://localhost:3000/build/1 -H "Accept: application/json" |  jq .buildstatus | xargs test 0 -eq'
-      )
-
-      out = original.succeed("su -l postgres -c 'psql -d hydra <<< \"\\d+ builds\" -A'")
-      assert "jobset_id" not in out
-
-      original.succeed(
-          "${next}/bin/switch-to-configuration test >&2"
-      )
-      original.wait_for_unit("hydra-init.service")
-
-      out = original.succeed("su -l postgres -c 'psql -d hydra <<< \"\\d+ builds\" -A'")
-      assert "jobset_id|integer|||" in out
-
-      original.succeed("hydra-backfill-ids")
-
-      original.succeed(
-          "${finished}/bin/switch-to-configuration test >&2"
-      )
-      original.wait_for_unit("hydra-init.service")
-
-      out = original.succeed("su -l postgres -c 'psql -d hydra <<< \"\\d+ builds\" -A'")
-      assert "jobset_id|integer||not null|" in out
-
-      original.wait_until_succeeds(
-          'curl -L -s http://localhost:3000/build/1 -H "Accept: application/json" |  jq .buildstatus | xargs test 0 -eq'
-      )
-
-      original.shutdown()
-    '';
-  };
-}
diff --git a/nixos/tests/hydra/default.nix b/nixos/tests/hydra/default.nix
index 2336e4033d6..e91a1cd3359 100644
--- a/nixos/tests/hydra/default.nix
+++ b/nixos/tests/hydra/default.nix
@@ -11,7 +11,7 @@ let
   inherit (import ./common.nix { inherit system; }) baseConfig;
 
   hydraPkgs = {
-    inherit (pkgs) hydra-migration hydra-unstable;
+    inherit (pkgs) hydra-unstable;
   };
 
   makeHydraTest = with pkgs.lib; name: package: makeTest {
diff --git a/pkgs/applications/blockchains/bitcoin-unlimited.nix b/pkgs/applications/blockchains/bitcoin-unlimited.nix
index fe39b955a28..f8988af683d 100644
--- a/pkgs/applications/blockchains/bitcoin-unlimited.nix
+++ b/pkgs/applications/blockchains/bitcoin-unlimited.nix
@@ -7,13 +7,13 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "bitcoin" + (toString (optional (!withGui) "d")) + "-unlimited-" + version;
-  version = "1.8.0.0";
+  version = "1.9.0.1";
 
   src = fetchFromGitHub {
     owner = "bitcoinunlimited";
     repo = "bitcoinunlimited";
     rev = "BCHunlimited${version}";
-    sha256 = "01qi15li5x9fvhsmvx7ai5fz6yzqqd3r9yv7081h75jn0nxai49q";
+    sha256 = "018a22zbvjqky0whizmgxzscmna0sh2xqgyw02yjk8qj4yi0zp8c";
   };
 
   nativeBuildInputs = [ pkgconfig autoreconfHook python3 ]
diff --git a/pkgs/applications/blockchains/polkadot/default.nix b/pkgs/applications/blockchains/polkadot/default.nix
index c55d78b0176..45cecf7e9fb 100644
--- a/pkgs/applications/blockchains/polkadot/default.nix
+++ b/pkgs/applications/blockchains/polkadot/default.nix
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "polkadot";
-  version = "0.8.24";
+  version = "0.8.25";
 
   src = fetchFromGitHub {
     owner = "paritytech";
     repo = "polkadot";
     rev = "v${version}";
-    sha256 = "15q5scajxrf82k8nxysah8cs3yl2p09xzzwlkxvjkcn08r3zhig6";
+    sha256 = "1jdklmysr25rlwgx7pz0jw66j1w60h98kqghzjhr90zhynzh39lz";
   };
 
-  cargoSha256 = "0qp20g5c15qzp2n1nzwqbnn2wx6c905vh652nvkm7sb1d901iiqi";
+  cargoSha256 = "08yfafrspkd1g1mhlfwngbknkxjkyymbcga8n2rdsk7mz0hm0vgy";
 
   cargoPatches = [ ./substrate-wasm-builder-runner.patch ];
 
@@ -37,7 +37,7 @@ rustPlatform.buildRustPackage rec {
     description = "Polkadot Node Implementation";
     homepage = "https://polkadot.network";
     license = licenses.gpl3;
-    maintainers = with maintainers; [ akru andresilva ];
+    maintainers = with maintainers; [ akru andresilva RaghavSood ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/misc/calcurse/default.nix b/pkgs/applications/misc/calcurse/default.nix
index 9f55975764f..a3cad7d9f2e 100644
--- a/pkgs/applications/misc/calcurse/default.nix
+++ b/pkgs/applications/misc/calcurse/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "calcurse";
-  version = "4.6.0";
+  version = "4.7.0";
 
   src = fetchurl {
     url = "https://calcurse.org/files/${pname}-${version}.tar.gz";
-    sha256 = "0hzhdpkkn75jlymanwzl69hrrf1pw29hrchr11wlxqjpl43h62gs";
+    sha256 = "0dc4bka2l9z03bnlygsnl06l1zi2wbn29rkc02b13x2kdab7arpg";
   };
 
   buildInputs = [ ncurses gettext python3 python3Packages.wrapPython ];
diff --git a/pkgs/applications/misc/copyq/default.nix b/pkgs/applications/misc/copyq/default.nix
index 7cf89a74e10..de1dacd50c2 100644
--- a/pkgs/applications/misc/copyq/default.nix
+++ b/pkgs/applications/misc/copyq/default.nix
@@ -5,13 +5,13 @@
 
 mkDerivation rec {
   pname = "CopyQ";
-  version = "3.12.0";
+  version = "3.13.0";
 
   src  = fetchFromGitHub {
     owner = "hluk";
     repo = "CopyQ";
     rev = "v${version}";
-    sha256 = "04jidibf0b80c5vd659pz2wibmggjyyj9yz2bw7j4g84hwraksxb";
+    sha256 = "0qssyavx0dkgsyj2myqg8n7sih8niy960nyb1yknsbjm37iqraah";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/misc/kdeconnect/default.nix b/pkgs/applications/misc/kdeconnect/default.nix
index 31e919e3770..d042f011bb7 100644
--- a/pkgs/applications/misc/kdeconnect/default.nix
+++ b/pkgs/applications/misc/kdeconnect/default.nix
@@ -28,11 +28,11 @@
 
 mkDerivation rec {
   pname = "kdeconnect";
-  version = "20.08.1";
+  version = "20.08.2";
 
   src = fetchurl {
     url = "https://download.kde.org/stable/release-service/${version}/src/${pname}-kde-${version}.tar.xz";
-    sha256 = "0s76djgpx08jfmh99c7kx18mnr3w7bv4hdra120nicq89mmy7gwf";
+    sha256 = "0rzfnkgkv759d4pa16qk0sw87wqzwgkd99yzrzfy2zcq423f6hvd";
   };
 
   patches = [
diff --git a/pkgs/applications/misc/octoprint/plugins.nix b/pkgs/applications/misc/octoprint/plugins.nix
index 514ac859c77..366b3866dfd 100644
--- a/pkgs/applications/misc/octoprint/plugins.nix
+++ b/pkgs/applications/misc/octoprint/plugins.nix
@@ -13,132 +13,147 @@ self: super: let
 in {
   inherit buildPlugin;
 
-  # Deprecated alias
-  m3d-fio = self.m33-fio; # added 2016-08-13
+  abl-expert = buildPlugin rec {
+    pname = "ABL_Expert";
+    version = "0.6";
 
-  m33-fio = buildPlugin rec {
-    pname = "M33-Fio";
-    version = "1.21";
+    src = fetchgit {
+      url = "https://framagit.org/razer/Octoprint_ABL_Expert/";
+      rev = version;
+      sha256 = "0ij3rvdwya1sbymwm5swlh2j4jagb6fal945g88zrzh5xf26hzjh";
+    };
 
-    src = fetchFromGitHub {
-      owner = "donovan6000";
-      repo = "M33-Fio";
-      rev = "V${version}";
-      sha256 = "1la3611kkqn8yiwjn6cizc45ri8pnk6ckld1na4nk6mqk88jvjq7";
+    meta = with stdenv.lib; {
+      description = "Marlin auto bed leveling control, mesh correction, and z probe handling";
+      homepage = "https://framagit.org/razer/Octoprint_ABL_Expert/";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ WhittlesJr ];
     };
+  };
 
-    patches = [
-      ./m33-fio-one-library.patch
-    ];
+  bedlevelvisualizer = buildPlugin rec {
+    pname = "BedLevelVisualizer";
+    version = "0.1.15";
 
-    postPatch = ''
-      rm -rf octoprint_m33fio/static/libraries/*
-      (
-        cd 'shared library source'
-        make
-      )
-    '';
+    src = fetchFromGitHub {
+      owner = "jneilliii";
+      repo = "OctoPrint-${pname}";
+      rev = version;
+      sha256 = "1bq39fnarnpk8phxfbpx6l4n9anf358z1cgid5r89nadmn2a0cny";
+    };
+
+    propagatedBuildInputs = with super; [ numpy ];
 
     meta = with stdenv.lib; {
-      description = "OctoPrint plugin for the Micro 3D printer";
-      homepage = "https://github.com/donovan6000/M33-Fio";
-      license = licenses.gpl3;
-      maintainers = with maintainers; [ abbradar ];
+      description = "Displays 3D mesh of bed topography report";
+      homepage = "https://github.com/jneilliii/OctoPrint-BedLevelVisualizer";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ lovesegfault ];
     };
   };
 
-  mqtt = buildPlugin rec {
-    pname = "MQTT";
-    version = "0.8.6";
+  curaenginelegacy = buildPlugin rec {
+    pname = "CuraEngineLegacy";
+    version = "1.1.1";
 
     src = fetchFromGitHub {
       owner = "OctoPrint";
-      repo = "OctoPrint-MQTT";
+      repo = "OctoPrint-${pname}";
       rev = version;
-      sha256 = "0y1jnfplcy8mh3szrfbbvngl02j49cbdizglrfsry4fvqg50zjxd";
+      sha256 = "1a7pxlmj1a7blkv97sn1k390pbjcxx2860011pbjcdnli74zpvv5";
     };
 
-    propagatedBuildInputs = with super; [ paho-mqtt ];
-
     meta = with stdenv.lib; {
-      description = "Publish printer status MQTT";
-      homepage = "https://github.com/OctoPrint/OctoPrint-MQTT";
+      description = "Plugin for slicing via Cura Legacy from within OctoPrint";
+      homepage = "https://github.com/OctoPrint/OctoPrint-CuraEngineLegacy";
       license = licenses.agpl3;
-      maintainers = with maintainers; [ peterhoeg ];
+      maintainers = with maintainers; [ gebner ];
     };
   };
 
-  titlestatus = buildPlugin rec {
-    pname = "TitleStatus";
-    version = "0.0.4";
+  displaylayerprogress = buildPlugin rec {
+    pname = "OctoPrint-DisplayLayerProgress";
+    version = "1.24.0";
 
     src = fetchFromGitHub {
-      owner = "MoonshineSG";
-      repo = "OctoPrint-TitleStatus";
+      owner = "OllisGit";
+      repo = pname;
       rev = version;
-      sha256 = "1l78xrabn5hcly2mgxwi17nwgnp2s6jxi9iy4wnw8k8icv74ag7k";
+      sha256 = "1lbivg3rcjzv8zqvp8n8gcaczxdm7gvd5ihjb6jq0fgf958lv59n";
     };
 
     meta = with stdenv.lib; {
-      description = "Show printers status in window title";
-      homepage = "https://github.com/MoonshineSG/OctoPrint-TitleStatus";
+      description = "OctoPrint-Plugin that sends the current progress of a print via M117 command";
+      homepage = "https://github.com/OllisGit/OctoPrint-DisplayLayerProgress";
       license = licenses.agpl3;
-      maintainers = with maintainers; [ abbradar ];
+      maintainers = with maintainers; [ j0hax ];
     };
   };
 
-  stlviewer = buildPlugin rec {
-    pname = "STLViewer";
-    version = "0.4.2";
+  gcodeeditor = buildPlugin rec {
+    pname = "GcodeEditor";
+    version = "0.2.9";
 
     src = fetchFromGitHub {
-      owner = "jneilliii";
-      repo = "OctoPrint-STLViewer";
+      owner = "ieatacid";
+      repo = "OctoPrint-${pname}";
       rev = version;
-      sha256 = "0mkvh44fn2ch4z2avsdjwi1rp353ylmk9j5fln4x7rx8ph8y7g2b";
+      sha256 = "1yjj9lmxbzmzrn7gahw9lj7554fphalbjjp8ns0rr9py3rshwxkm";
     };
 
     meta = with stdenv.lib; {
-      description = "A simple stl viewer tab for OctoPrint";
-      homepage = "https://github.com/jneilliii/Octoprint-STLViewer";
+      description = "Edit gcode on OctoPrint";
+      homepage = "https://github.com/ieatacid/OctoPrint-GcodeEditor";
       license = licenses.agpl3;
-      maintainers = with maintainers; [ abbradar ];
+      maintainers = with maintainers; [ WhittlesJr ];
     };
   };
 
-  curaenginelegacy = buildPlugin rec {
-    pname = "CuraEngineLegacy";
-    version = "1.0.2";
+  mqtt = buildPlugin rec {
+    pname = "MQTT";
+    version = "0.8.7";
 
     src = fetchFromGitHub {
       owner = "OctoPrint";
-      repo = "OctoPrint-${pname}";
+      repo = "OctoPrint-MQTT";
       rev = version;
-      sha256 = "1cdb276wfyf3wcfj5g3migd6b6aqmkrxncrqjfcfx4j4k3xac965";
+      sha256 = "0k82h7wafbcqdvk5wjw4dp9lydwszfj1lf8vvymwbqdn7pf5h0dy";
     };
 
+    propagatedBuildInputs = with super; [ paho-mqtt ];
+
     meta = with stdenv.lib; {
-      description = "Plugin for slicing via Cura Legacy from within OctoPrint";
-      homepage = "https://github.com/OctoPrint/OctoPrint-CuraEngineLegacy";
+      description = "Publish printer status MQTT";
+      homepage = "https://github.com/OctoPrint/OctoPrint-MQTT";
       license = licenses.agpl3;
-      maintainers = with maintainers; [ gebner ];
+      maintainers = with maintainers; [ peterhoeg ];
     };
   };
 
-  touchui = buildPlugin rec {
-    pname = "TouchUI";
-    version = "0.3.14";
+  printtimegenius = buildPlugin rec {
+    pname = "PrintTimeGenius";
+    version = "2.2.6";
 
     src = fetchFromGitHub {
-      owner = "BillyBlaze";
+      owner = "eyal0";
       repo = "OctoPrint-${pname}";
       rev = version;
-      sha256 = "033b9nk3kpnmjw9nggcaxy39hcgfviykcy2cx0j6m411agvmqbzf";
+      sha256 = "04zfgd3x3lbriyzwhpqnwdcfdm19fsqgsb7l2ix5d0ssmqxwg2r6";
     };
 
+    preConfigure = ''
+      # PrintTimeGenius ships with marlin-calc binaries for multiple architectures
+      rm */analyzers/marlin-calc*
+      sed 's@"{}.{}".format(binary_base_name, machine)@"${pkgs.marlin-calc}/bin/marlin-calc"@' -i */analyzers/analyze_progress.py
+    '';
+
+    patches = [
+      ./printtimegenius-logging.patch
+    ];
+
     meta = with stdenv.lib; {
-      description = "Touch friendly interface for a small TFT module or phone for OctoPrint";
-      homepage = "https://github.com/BillyBlaze/OctoPrint-TouchUI";
+      description = "Better print time estimation for OctoPrint";
+      homepage = "https://github.com/eyal0/OctoPrint-PrintTimeGenius";
       license = licenses.agpl3;
       maintainers = with maintainers; [ gebner ];
     };
@@ -168,107 +183,98 @@ in {
     };
   };
 
-  printtimegenius = buildPlugin rec {
-    pname = "PrintTimeGenius";
-    version = "2.2.1";
+  simpleemergencystop = buildPlugin rec {
+    pname = "SimpleEmergencyStop";
+    version = "1.0.3";
 
     src = fetchFromGitHub {
-      owner = "eyal0";
+      owner = "Sebclem";
       repo = "OctoPrint-${pname}";
       rev = version;
-      sha256 = "1dr93vbpxgxw3b1q4rwam8f4dmiwr5vnfr9796g6jx8xkpfzzy1h";
+      sha256 = "0hhh5grmn32abkix1b9fr1d0pcpdi2r066iypcxdxcza9qzwjiyi";
     };
 
-    preConfigure = ''
-      # PrintTimeGenius ships with marlin-calc binaries for multiple architectures
-      rm */analyzers/marlin-calc*
-      sed 's@"{}.{}".format(binary_base_name, machine)@"${pkgs.marlin-calc}/bin/marlin-calc"@' -i */analyzers/analyze_progress.py
-    '';
-
-    patches = [
-      ./printtimegenius-logging.patch
-    ];
-
     meta = with stdenv.lib; {
-      description = "Better print time estimation for OctoPrint";
-      homepage = "https://github.com/eyal0/OctoPrint-PrintTimeGenius";
+      description = "A simple plugin that add an emergency stop buton on NavBar of OctoPrint";
+      homepage = "https://github.com/Sebclem/OctoPrint-SimpleEmergencyStop";
       license = licenses.agpl3;
-      maintainers = with maintainers; [ gebner ];
+      maintainers = with maintainers; [ WhittlesJr ];
     };
   };
 
-  abl-expert = buildPlugin rec {
-    pname = "ABL_Expert";
-    version = "2019-12-21";
+  stlviewer = buildPlugin rec {
+    pname = "STLViewer";
+    version = "0.4.2";
 
-    src = fetchgit {
-      url = "https://framagit.org/razer/Octoprint_ABL_Expert/";
-      rev = "f11fbe05088ad618bfd9d064ac3881faec223f33";
-      sha256 = "026r4prkyvwzxag5pv36455q7s3gaig37nmr2nbvhwq3d2lbi5s4";
+    src = fetchFromGitHub {
+      owner = "jneilliii";
+      repo = "OctoPrint-STLViewer";
+      rev = version;
+      sha256 = "0mkvh44fn2ch4z2avsdjwi1rp353ylmk9j5fln4x7rx8ph8y7g2b";
     };
 
     meta = with stdenv.lib; {
-      description = "Marlin auto bed leveling control, mesh correction, and z probe handling";
-      homepage = "https://framagit.org/razer/Octoprint_ABL_Expert/";
+      description = "A simple stl viewer tab for OctoPrint";
+      homepage = "https://github.com/jneilliii/Octoprint-STLViewer";
       license = licenses.agpl3;
-      maintainers = with maintainers; [ WhittlesJr ];
+      maintainers = with maintainers; [ abbradar ];
     };
   };
 
-  gcodeeditor = buildPlugin rec {
-    pname = "GcodeEditor";
-    version = "0.2.6";
+  themeify = buildPlugin rec {
+    pname = "Themeify";
+    version = "1.2.2";
 
     src = fetchFromGitHub {
-      owner = "ieatacid";
-      repo = "OctoPrint-${pname}";
-      rev = version;
-      sha256 = "0c6p78r3vd6ys3kld308pyln09zjbr9yif1ljvcx6wlml2i5l1vh";
+      owner = "Birkbjo";
+      repo = "Octoprint-${pname}";
+      rev = "v${version}";
+      sha256 = "0j1qs6kyh947npdy7pqda25fjkqinpas3sy0qyscqlxi558lhvx2";
     };
 
     meta = with stdenv.lib; {
-      description = "Edit gcode on OctoPrint";
-      homepage = "https://github.com/ieatacid/OctoPrint-GcodeEditor";
+      description = "Beautiful themes for OctoPrint";
+      homepage = "https://github.com/birkbjo/OctoPrint-Themeify";
       license = licenses.agpl3;
-      maintainers = with maintainers; [ WhittlesJr ];
+      maintainers = with maintainers; [ lovesegfault ];
     };
   };
 
-  simpleemergencystop = buildPlugin rec {
-    pname = "SimpleEmergencyStop";
-    version = "0.2.5";
+  titlestatus = buildPlugin rec {
+    pname = "TitleStatus";
+    version = "0.0.5";
 
     src = fetchFromGitHub {
-      owner = "Sebclem";
-      repo = "OctoPrint-${pname}";
+      owner = "MoonshineSG";
+      repo = "OctoPrint-TitleStatus";
       rev = version;
-      sha256 = "10wadv09wv2h96igvq3byw9hz1si82n3c7v5y0ii3j7hm2d06y8p";
+      sha256 = "10nxjrixg0i6n6x8ghc1ndshm25c97bvkcis5j9kmlkkzs36i2c6";
     };
 
     meta = with stdenv.lib; {
-      description = "A simple plugin that add an emergency stop buton on NavBar of OctoPrint";
-      homepage = "https://github.com/Sebclem/OctoPrint-SimpleEmergencyStop";
+      description = "Show printers status in window title";
+      homepage = "https://github.com/MoonshineSG/OctoPrint-TitleStatus";
       license = licenses.agpl3;
-      maintainers = with maintainers; [ WhittlesJr ];
+      maintainers = with maintainers; [ abbradar ];
     };
   };
 
-  displaylayerprogress = buildPlugin rec {
-    pname = "OctoPrint-DisplayLayerProgress";
-    version = "1.24.0";
+  touchui = buildPlugin rec {
+    pname = "TouchUI";
+    version = "0.3.16";
 
     src = fetchFromGitHub {
-      owner = "OllisGit";
-      repo = pname;
+      owner = "BillyBlaze";
+      repo = "OctoPrint-${pname}";
       rev = version;
-      sha256 = "1lbivg3rcjzv8zqvp8n8gcaczxdm7gvd5ihjb6jq0fgf958lv59n";
+      sha256 = "1jlqjirc4ygl4k7jp93l2h6b18jap3mzz8sf2g61j9w0kgv9l365";
     };
 
     meta = with stdenv.lib; {
-      description = "OctoPrint-Plugin that sends the current progress of a print via M117 command";
-      homepage = "https://github.com/OllisGit/OctoPrint-DisplayLayerProgress";
+      description = "Touch friendly interface for a small TFT module or phone for OctoPrint";
+      homepage = "https://github.com/BillyBlaze/OctoPrint-TouchUI";
       license = licenses.agpl3;
-      maintainers = with maintainers; [ j0hax ];
+      maintainers = with maintainers; [ gebner ];
     };
   };
 
@@ -293,13 +299,13 @@ in {
 
   octoprint-dashboard = buildPlugin rec {
     pname = "OctoPrint-Dashboard";
-    version = "1.15.1";
+    version = "1.15.2";
 
     src = fetchFromGitHub {
       owner = "StefanCohen";
       repo = pname;
       rev = version;
-      sha256 = "1psk069g8xdpgbzmna51dh978vrildh33dn7kbbi5y31ry5c3gx6";
+      sha256 = "0p94jwd7kagh3sixhcrqmsgbay4aaf9l1pgyi2b45jym8pvld5n4";
     };
 
     meta = with stdenv.lib; {
diff --git a/pkgs/applications/misc/polar-bookshelf/default.nix b/pkgs/applications/misc/polar-bookshelf/default.nix
index fc86b2e885d..496340e0d75 100644
--- a/pkgs/applications/misc/polar-bookshelf/default.nix
+++ b/pkgs/applications/misc/polar-bookshelf/default.nix
@@ -10,12 +10,12 @@
 
 stdenv.mkDerivation rec {
   pname = "polar-bookshelf";
-  version = "1.13.10";
+  version = "2.0.42";
 
   # fetching a .deb because there's no easy way to package this Electron app
   src = fetchurl {
-    url = "https://github.com/burtonator/polar-bookshelf/releases/download/v${version}/polar-bookshelf-${version}-amd64.deb";
-    sha256 = "1bxcyf6n2m5x1z8ic6kzskinyyc6lh6nj0bycbwc524n6ms5j99p";
+    url = "https://github.com/burtonator/polar-bookshelf/releases/download/v${version}/polar-desktop-app-${version}-amd64.deb";
+    hash = "sha256-JyO71wyE6b0iHAYs/6/WbG+OdUVUUPpJla+ZUzg0Gng=";
   };
 
   buildInputs = [
@@ -64,16 +64,15 @@ stdenv.mkDerivation rec {
     mkdir -p $out/bin
     mkdir -p $out/lib
 
-    mv opt/Polar\ Bookshelf/* $out/share/polar-bookshelf
+    mv opt/Polar/* $out/share/polar-bookshelf
     mv $out/share/polar-bookshelf/*.so $out/lib
 
     mv usr/share/* $out/share/
 
-    ln -s $out/share/polar-bookshelf/polar-bookshelf $out/bin/polar-bookshelf
+    ln -s $out/share/polar-bookshelf/polar-desktop-app $out/bin/polar-desktop-app
 
-    # Correct desktop file `Exec`
-    substituteInPlace $out/share/applications/polar-bookshelf.desktop \
-      --replace "/opt/Polar Bookshelf/polar-bookshelf" "$out/bin/polar-bookshelf"
+    substituteInPlace $out/share/applications/polar-desktop-app.desktop \
+      --replace "/opt/Polar/polar-desktop-app" "$out/bin/polar-desktop-app"
   '';
 
   preFixup = ''
diff --git a/pkgs/applications/misc/wayst/default.nix b/pkgs/applications/misc/wayst/default.nix
new file mode 100644
index 00000000000..99ee326aebf
--- /dev/null
+++ b/pkgs/applications/misc/wayst/default.nix
@@ -0,0 +1,91 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, pkgconfig
+, freetype
+, fontconfig
+, libGL
+, libX11
+, libXrandr
+, libxcb
+, libxkbcommon
+, utf8proc
+, wayland
+
+, libnotify
+, xdg_utils
+, makeDesktopItem
+}:
+
+let
+  desktopItem = makeDesktopItem {
+    desktopName = "Wayst";
+    name = "wayst";
+    exec = "wayst";
+    icon = "wayst";
+    terminal = "false";
+    categories = "System;TerminalEmulator";
+    comment = "A simple terminal emulator";
+    extraEntries = ''
+      GenericName=Terminal
+      Keywords=wayst;terminal;
+    '';
+  };
+in
+stdenv.mkDerivation rec {
+  pname = "wayst";
+  version = "unstable-2020-10-12";
+
+  src = fetchFromGitHub {
+    owner = "91861";
+    repo = pname;
+    rev = "b8c7ca00a785a748026ed1ba08bf3d19916ced18";
+    hash = "sha256-wHAU1yxukxApzhLLLctZ/AYqF7t21HQc5omPBZyxra0=";
+  };
+
+  makeFlags = [ "INSTALL_DIR=\${out}/bin" ];
+
+  nativeBuildInputs = [ pkgconfig ];
+
+  buildInputs = [
+    fontconfig
+    libX11
+    freetype
+    libGL
+    libxcb
+    libxkbcommon
+    libXrandr
+    utf8proc
+    wayland
+  ];
+
+  # This patch forces the Makefile to use utf8proc
+  # The makefile relies on ldconfig to find the utf8proc libraries
+  # which is not possible on nixpkgs
+  patches = [ ./utf8proc.patch ];
+
+  postPatch = ''
+    substituteInPlace src/settings.c \
+      --replace xdg-open ${xdg_utils}/bin/xdg-open
+    substituteInPlace src/main.c \
+      --replace notify-send ${libnotify}/bin/notify-send
+  '';
+
+  preInstall = ''
+    mkdir -p $out/bin
+  '';
+
+  postInstall = ''
+    mkdir -p $out/share/applications
+    ln -s ${desktopItem}/share/applications/* $out/share/applications
+    install -D icons/wayst.svg $out/share/icons/hicolor/scalable/apps/wayst.svg
+  '';
+
+  meta = with lib; {
+    description = "A simple terminal emulator";
+    homepage = "https://github.com/91861/wayst";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ berbiche ];
+  };
+}
diff --git a/pkgs/applications/misc/wayst/utf8proc.patch b/pkgs/applications/misc/wayst/utf8proc.patch
new file mode 100644
index 00000000000..0923c5dbe18
--- /dev/null
+++ b/pkgs/applications/misc/wayst/utf8proc.patch
@@ -0,0 +1,24 @@
+commit caa5a6bed31937f2d1b322da204e11eae57a720f
+Author: Nicolas Berbiche <nicolas@normie.dev>
+Date:   Tue Oct 20 18:14:44 2020 -0400
+
+    PATCH: use nixpkgs utf8proc
+    
+    This patch forces the Makefile to use utf8proc from `buildInputs`.
+    The Makefile relies on ldconfig to find the utf8proc libraries,
+    which is not possible with nixpkgs.
+
+diff --git a/Makefile b/Makefile
+index caccdf7..90b11ea 100644
+--- a/Makefile
++++ b/Makefile
+@@ -29,7 +29,7 @@ else
+ 	LDFLAGS = -O2 -flto
+ endif
+ 
+-ifeq ($(shell ldconfig -p | grep libutf8proc.so > /dev/null || echo fail),fail)
++ifeq (false,fail)
+ $(info libutf8proc not found. Support for language-specific combining characters and unicode normalization will be disabled.)
+ 	CFLAGS += -DNOUTF8PROC
+ else
+
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index ed5a8a71556..4341a419142 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -319,15 +319,8 @@ let
     NIX_CFLAGS_COMPILE = "-Wno-unknown-warning-option";
 
     buildPhase = let
-      # Build paralelism: on Hydra the build was frequently running into memory
-      # exhaustion, and even other users might be running into similar issues.
-      # -j is halved to avoid memory problems, and -l is slightly increased
-      # so that the build gets slight preference before others
-      # (it will often be on "critical path" and at risk of timing out)
       buildCommand = target: ''
-        ninja -C "${buildPath}"  \
-          -j$(( ($NIX_BUILD_CORES+1) / 2 )) -l$(( $NIX_BUILD_CORES+1 )) \
-          "${target}"
+        ninja -C "${buildPath}" -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES "${target}"
         (
           source chrome/installer/linux/common/installer.include
           PACKAGE=$packageName
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index 7523a6653f2..8a8bce3a194 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -1,13 +1,13 @@
 {
   "stable": {
-    "version": "86.0.4240.75",
-    "sha256": "1ddw4p9zfdzhi5hrd8x14k4w326znljzprnpfi2f917rlpnl2ynx",
-    "sha256bin64": "17isxkd80rccqim6izzl08vw4yr52qsk6djp1rmhhijzg9rsvghz"
+    "version": "86.0.4240.111",
+    "sha256": "05y7lwr89awkhvgmwkx3br9j4ap2aypg2wsc0nz8mi7kxc1dnyzj",
+    "sha256bin64": "10aqiiydw4i3jxnw8xxdgkgcqbfqc67n1fbrg40y54kg0v5dz8l6"
   },
   "beta": {
-    "version": "87.0.4280.20",
-    "sha256": "1lqdxy6pm72h8ym5ij713rp055csqn19agy3sp6wnmp3pj688ic8",
-    "sha256bin64": "0r9wk2kgn7z0jjzpppr799jp5izxvh1ig4mv12iadz4y7dl47kaw"
+    "version": "87.0.4280.27",
+    "sha256": "0w0asxj7jlsw69cssfia8km4q9cx1c2mliks2rmhf4jk0hsghasm",
+    "sha256bin64": "1lsx4mhy8nachfb8c9f3mrx5nqw2bi046dqirb4lnv7y80jjjs1k"
   },
   "dev": {
     "version": "88.0.4292.2",
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix b/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix
index 421d6bb745a..3df8fb3afdb 100644
--- a/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix
@@ -352,15 +352,8 @@ let
     NIX_CFLAGS_COMPILE = "-Wno-unknown-warning-option";
 
     buildPhase = let
-      # Build paralelism: on Hydra the build was frequently running into memory
-      # exhaustion, and even other users might be running into similar issues.
-      # -j is halved to avoid memory problems, and -l is slightly increased
-      # so that the build gets slight preference before others
-      # (it will often be on "critical path" and at risk of timing out)
       buildCommand = target: ''
-        ninja -C "${buildPath}"  \
-          -j$(( ($NIX_BUILD_CORES+1) / 2 )) -l$(( $NIX_BUILD_CORES+1 )) \
-          "${target}"
+        ninja -C "${buildPath}" -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES "${target}"
         (
           source chrome/installer/linux/common/installer.include
           PACKAGE=$packageName
diff --git a/pkgs/applications/networking/cluster/tektoncd-cli/default.nix b/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
new file mode 100644
index 00000000000..8c1eea64061
--- /dev/null
+++ b/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
@@ -0,0 +1,47 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+
+buildGoModule rec {
+  pname = "tektoncd-cli";
+  version = "0.13.0";
+
+  src = fetchFromGitHub {
+    owner = "tektoncd";
+    repo = "cli";
+    rev = "v${version}";
+    sha256 = "01kcz5pj7hl2wfcqj3kcssj1c589vqqh1r4yc0agb67rm6q7xl06";
+  };
+
+  vendorSha256 = null;
+
+  doCheck = false;
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  buildPhase = ''
+    make bin/tkn
+  '';
+
+  installPhase = ''
+    install bin/tkn -Dt $out/bin
+
+    mkdir -p "$out/share/man/man1"
+    cp docs/man/man1/* "$out/share/man/man1"
+
+    # TODO: Move to enhanced installShellCompletion when merged: PR #83630
+    $out/bin/tkn completion bash > tkn.bash
+    $out/bin/tkn completion zsh  > _tkn
+    installShellCompletion tkn.bash --zsh _tkn
+  '';
+
+  meta = with lib; {
+    description = "The Tekton Pipelines cli project provides a CLI for interacting with Tekton";
+    homepage = "https://tekton.dev";
+    longDescription = ''
+      The Tekton Pipelines cli project provides a CLI for interacting with Tekton!
+      For your convenience, it is recommended that you install the Tekton CLI, tkn, together with the core component of Tekton, Tekton Pipelines.
+    '';
+    license = licenses.asl20;
+    maintainers = with maintainers; [ jk mstrangfeld ];
+    platforms = platforms.linux ++ platforms.darwin;
+  };
+}
diff --git a/pkgs/applications/networking/cluster/terraform-providers/default.nix b/pkgs/applications/networking/cluster/terraform-providers/default.nix
index 73fc6df024e..24c6dd21cde 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@@ -149,6 +149,16 @@ let
       '';
     });
 
+    # provider was moved to the `vultr` organization, but kept the old references:
+    # https://github.com/vultr/terraform-provider-vultr/pull/67
+    # this override should be removed as soon as new version (>1.4.1) is released.
+    vultr = automated-providers.vultr.overrideAttrs (attrs: {
+      prePatch = attrs.prePatch or "" + ''
+        substituteInPlace go.mod --replace terraform-providers/terraform-provider-vultr vultr/terraform-provider-vultr
+        substituteInPlace main.go --replace terraform-providers/terraform-provider-vultr vultr/terraform-provider-vultr
+      '';
+    });
+
     # Packages that don't fit the default model
     ansible = callPackage ./ansible {};
     elasticsearch = callPackage ./elasticsearch {};
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index c49f4cd2b1b..17c158a4bb5 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1014,11 +1014,11 @@
     "version": "0.1.0"
   },
   "vultr": {
-    "owner": "terraform-providers",
+    "owner": "vultr",
     "repo": "terraform-provider-vultr",
-    "rev": "v1.3.0",
-    "sha256": "0swc2fvp83d6w0cqvyxs346c756wr48xbn8m8jqkmma5s4ab2y4k",
-    "version": "1.3.0"
+    "rev": "v1.4.1",
+    "sha256": "1jx9p4bwpa5zxig6gfk4akfsnbivvyhwcw8id2ch2ga9a67pwald",
+    "version": "1.4.1"
   },
   "wavefront": {
     "owner": "terraform-providers",
diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix
index 6153eaa145c..b73f24ed47d 100644
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@@ -157,8 +157,8 @@ in rec {
   });
 
   terraform_0_13 = pluggable (generic {
-    version = "0.13.4";
-    sha256 = "1yvcz14q82v9jq4b9knn6wgnhlhrsz2ncvxv4lh9y1avn56chsqc";
+    version = "0.13.5";
+    sha256 = "1fnydzm5h65pdy2gkq403sllx05cvpldkdzdpcy124ywljb4x9d8";
     patches = [ ./provider-path.patch ];
     passthru = { inherit plugins; };
   });
diff --git a/pkgs/applications/networking/instant-messengers/bitlbee-facebook/default.nix b/pkgs/applications/networking/instant-messengers/bitlbee-facebook/default.nix
index 07e7b74a43c..1a8110acacb 100644
--- a/pkgs/applications/networking/instant-messengers/bitlbee-facebook/default.nix
+++ b/pkgs/applications/networking/instant-messengers/bitlbee-facebook/default.nix
@@ -3,13 +3,13 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "bitlbee-facebook";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "bitlbee";
     repo = "bitlbee-facebook";
-    sha256 = "11068zhb1v55b1x0nhjc4f3p0glccxpcyk5c1630hfdzkj7vyqhn";
+    sha256 = "1yjhjhk3jzjip13lq009vlg84lm2lzwhac5jy0aq3vkcz6rp94rc";
   };
 
   nativeBuildInputs = [ autoconf automake libtool pkgconfig ];
diff --git a/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json b/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json
index 287c864d392..05f7af33243 100644
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json
@@ -2,7 +2,7 @@
   "name": "element-desktop",
   "productName": "Element",
   "main": "src/electron-main.js",
-  "version": "1.7.9",
+  "version": "1.7.10",
   "description": "A feature-rich client for Matrix.org",
   "author": "Element",
   "repository": {
diff --git a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
index 5b537b2b7bf..cb5e598c121 100644
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
@@ -8,12 +8,12 @@
 
 let
   executableName = "element-desktop";
-  version = "1.7.9";
+  version = "1.7.10";
   src = fetchFromGitHub {
     owner = "vector-im";
     repo = "riot-desktop";
     rev = "v${version}";
-    sha256 = "0hk9y6zzabfdi35fqzl9987d98a6k74fi0mzmhhvhvvpj8i1ldrn";
+    sha256 = "06ygqfhbsld4s274kakb6a5nx75jki44r8lwk3n0pi5mnkn626gl";
   };
   electron = electron_9;
 
diff --git a/pkgs/applications/networking/instant-messengers/element/element-web.nix b/pkgs/applications/networking/instant-messengers/element/element-web.nix
index 25e62423eae..a71bc086370 100644
--- a/pkgs/applications/networking/instant-messengers/element/element-web.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-web.nix
@@ -12,11 +12,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "element-web";
-  version = "1.7.9";
+  version = "1.7.10";
 
   src = fetchurl {
     url = "https://github.com/vector-im/riot-web/releases/download/v${version}/riot-v${version}.tar.gz";
-    sha256 = "00ch486npqgrwmgfd7bsi6wb9ac6dpv08n13lygn45gha37l1kx1";
+    sha256 = "1xcvydjpdp6cy5g0da5yaa49gjxsmf4hsyi2q4l3p8qvs4qajn0r";
   };
 
   installPhase = ''
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index 69b3357b7d4..5603ff13b19 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -25,7 +25,7 @@ let
       else "");
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "1.37.1"; # Please backport all updates to the stable channel.
+  version = "1.37.2"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -35,7 +35,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "0zj068wkgb0k7iq4ld0lb06vk2zlsvv5pf0csr4zkzkq0hgzx33s";
+    sha256 = "0n4g2fh1ibw6fl5vbnnchx2vafasqrq8rl9w0ch7lai665zkxsk3";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
index bc5fa0e1f12..b7aa2d845b1 100644
--- a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
@@ -7,7 +7,7 @@ let
 
   # Please keep the version x.y.0.z and do not update to x.y.76.z because the
   # source of the latter disappears much faster.
-  version = "8.64.0.81";
+  version = "8.65.0.78";
 
   rpath = stdenv.lib.makeLibraryPath [
     alsaLib
@@ -65,7 +65,7 @@ let
           "https://mirror.cs.uchicago.edu/skype/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
           "https://web.archive.org/web/https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
         ];
-        sha256 = "0p6sp45kabm97p3hp3wp087b3k42m26ji99kzhpsz3n9vzjiczjh";
+        sha256 = "04qcpz3w2clpa23axh0xx68rm792d2l029r3wy1hfzbxd51z09lh";
       }
     else
       throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}";
diff --git a/pkgs/applications/networking/mailreaders/alpine/default.nix b/pkgs/applications/networking/mailreaders/alpine/default.nix
index a85e4e4d04c..83c2f3ca7ac 100644
--- a/pkgs/applications/networking/mailreaders/alpine/default.nix
+++ b/pkgs/applications/networking/mailreaders/alpine/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "alpine";
-  version = "2.23";
+  version = "2.24";
 
   src = fetchurl {
     url = "http://alpine.x10host.com/alpine/release/src/${pname}-${version}.tar.xz";
-    sha256 = "0yqzm56lqgg8v66m09vqxjvpclli4pql5xj8zg7mynq0bhhn2fkr";
+    sha256 = "1vxw19nx10y7nx01d9i6gah2f3y5r2idbq56l13bdqi91bx9y6k5";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/radio/gqrx/default.nix b/pkgs/applications/radio/gqrx/default.nix
index 33b858799e2..413424a5b8b 100644
--- a/pkgs/applications/radio/gqrx/default.nix
+++ b/pkgs/applications/radio/gqrx/default.nix
@@ -9,13 +9,13 @@ assert pulseaudioSupport -> libpulseaudio != null;
 
 mkDerivation rec {
   pname = "gqrx";
-  version = "2.12.1";
+  version = "2.13";
 
   src = fetchFromGitHub {
     owner = "csete";
     repo = "gqrx";
     rev = "v${version}";
-    sha256 = "00alf3q6y313xpx6p7v43vqsphd2x4am4q362lw21bcy9wc4jidw";
+    sha256 = "034y8w2cwv35ibqnqb9bdgscsrcp6rr02fgscbfi3gky3n0qddcy";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/science/chemistry/openmolcas/default.nix b/pkgs/applications/science/chemistry/openmolcas/default.nix
index 0d74e784d77..8bc62da3a31 100644
--- a/pkgs/applications/science/chemistry/openmolcas/default.nix
+++ b/pkgs/applications/science/chemistry/openmolcas/default.nix
@@ -7,7 +7,7 @@
 assert blas.implementation == "openblas" && lapack.implementation == "openblas";
 
 let
-  version = "19.11";
+  version = "20.10";
   gitLabRev = "v${version}";
 
   python = python3.withPackages (ps : with ps; [ six pyparsing ]);
@@ -20,18 +20,13 @@ in stdenv.mkDerivation {
     owner = "Molcas";
     repo = "OpenMolcas";
     rev = gitLabRev;
-    sha256 = "1wwqhkyyi7pw5x1ghnp83ir17zl5jsj7phhqxapybyi3bmg0i00q";
+    sha256 = "1w8av44dx5r9yp2xhf9ypdrhappvk984wrd5pa1ww0qv6j2446ic";
   };
 
-  patches = [ (fetchpatch {
-    name = "Fix-MPI-INT-size"; # upstream patch, fixes a Fortran compiler error
-    url = "https://gitlab.com/Molcas/OpenMolcas/commit/860e3350523f05ab18e49a428febac8a4297b6e4.patch";
-    sha256 = "0h96h5ikbi5l6ky41nkxmxfhjiykkiifq7vc2s3fdy1r1siv09sb";
-  }) (fetchpatch {
-    name = "fix-cisandbox"; # upstream patch, fixes a Fortran compiler error
-    url = "https://gitlab.com/Molcas/OpenMolcas/commit/d871590c8ce4689cd94cdbbc618954c65589393d.patch";
-    sha256 = "0dgz1w2rkglnis76spai3m51qa72j4bz6ppnk5zmzrr6ql7gwpgg";
-  })];
+  patches = [
+    # Required to handle openblas multiple outputs
+    ./openblasPath.patch
+];
 
   nativeBuildInputs = [ perl cmake texlive.combined.scheme-minimal makeWrapper ];
   buildInputs = [
@@ -55,7 +50,7 @@ in stdenv.mkDerivation {
     "-DTOOLS=ON"
     "-DHDF5=ON"
     "-DFDE=ON"
-    "-DOPENBLASROOT=${openblas}"
+    "-DOPENBLASROOT=${openblas.dev}"
   ];
 
   GAROOT=globalarrays;
diff --git a/pkgs/applications/science/chemistry/openmolcas/openblasPath.patch b/pkgs/applications/science/chemistry/openmolcas/openblasPath.patch
new file mode 100644
index 00000000000..e47adcc3e9a
--- /dev/null
+++ b/pkgs/applications/science/chemistry/openmolcas/openblasPath.patch
@@ -0,0 +1,12 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 276ae4e2..db13e6e3 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -1507,7 +1507,6 @@ if (LINALG STREQUAL "OpenBLAS")
+     NAMES openblas
+     PATHS ${OPENBLASROOT}
+     PATH_SUFFIXES lib
+-    NO_DEFAULT_PATH
+   )
+ 
+   if (NOT LIBOPENBLAS)
diff --git a/pkgs/applications/science/logic/coq/default.nix b/pkgs/applications/science/logic/coq/default.nix
index 946cba41b14..9b7e007ce50 100644
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@@ -109,7 +109,7 @@ self = stdenv.mkDerivation {
   nativeBuildInputs = [ pkgconfig ]
   ++ stdenv.lib.optional (!versionAtLeast "8.6") gnumake42
   ;
-  buildInputs = [ ncurses ocamlPackages.ocaml ocamlPackages.findlib ]
+  buildInputs = [ ncurses ]
   ++ stdenv.lib.optional (!versionAtLeast "8.10") ocamlPackages.camlp5
   ++ stdenv.lib.optional (!versionAtLeast "8.12") ocamlPackages.num
   ++ stdenv.lib.optionals buildIde
@@ -117,7 +117,10 @@ self = stdenv.mkDerivation {
      then [ ocamlPackages.lablgtk3-sourceview3 glib gnome3.defaultIconTheme wrapGAppsHook ]
      else [ ocamlPackages.lablgtk ]);
 
-  propagatedBuildInputs = stdenv.lib.optional (versionAtLeast "8.12") ocamlPackages.num;
+  propagatedBuildInputs = [ ocamlPackages.ocaml ocamlPackages.findlib ]
+    ++ stdenv.lib.optional (versionAtLeast "8.12") ocamlPackages.num;
+
+  propagatedUserEnvPkgs = [ ocamlPackages.ocaml ocamlPackages.findlib ];
 
   postPatch = ''
     UNAME=$(type -tp uname)
diff --git a/pkgs/applications/version-management/git-and-tools/gitstatus/default.nix b/pkgs/applications/version-management/git-and-tools/gitstatus/default.nix
index 5b7dbc521f6..47d095b0f1c 100644
--- a/pkgs/applications/version-management/git-and-tools/gitstatus/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gitstatus/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gitstatus";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "romkatv";
     repo = "gitstatus";
     rev = "v${version}";
-    sha256 = "0zan1sa8c24hpqwj66y9srd4n15f4nk64fc5jrd4smgfgn22wph8";
+    sha256 = "03zaywncds7pjrl07rvdf3fh39gnp2zfvgsf0afqwv317sgmgpzf";
   };
 
   buildInputs = [ (callPackage ./romkatv_libgit2.nix {}) ];
diff --git a/pkgs/applications/version-management/git-and-tools/gitstatus/romkatv_libgit2.nix b/pkgs/applications/version-management/git-and-tools/gitstatus/romkatv_libgit2.nix
index 2f99c88a37b..9c74fa35752 100644
--- a/pkgs/applications/version-management/git-and-tools/gitstatus/romkatv_libgit2.nix
+++ b/pkgs/applications/version-management/git-and-tools/gitstatus/romkatv_libgit2.nix
@@ -16,7 +16,7 @@ libgit2.overrideAttrs (oldAttrs: {
   src = fetchFromGitHub {
     owner = "romkatv";
     repo = "libgit2";
-    rev = "tag-005f77dca6dbe8788e55139fa1199fc94cc04f9a";
-    sha256 = "1h5bnisk4ljdpfzlv8g41m8js9841xyjhfywc5cn8pmyv58c50il";
+    rev = "tag-82cefe2b42300224ad3c148f8b1a569757cc617a";
+    sha256 = "1vhnqynqyxizzkq1h5dfjm75f0jm5637jh0gypwqqz2yjqrscza0";
   };
 })
diff --git a/pkgs/applications/video/pitivi/default.nix b/pkgs/applications/video/pitivi/default.nix
index b1c1dd285e2..ee07a5c7cc8 100644
--- a/pkgs/applications/video/pitivi/default.nix
+++ b/pkgs/applications/video/pitivi/default.nix
@@ -147,6 +147,12 @@ in python3Packages.buildPythonApplication rec {
     mv data/org.pitivi.Pitivi-mime.xml data/org.pitivi.Pitivi-mime.xml.in
   '';
 
+  # Fixes error
+  #     Couldn’t recognize the image file format for file ".../share/pitivi/pixmaps/asset-proxied.svg"
+  # at startup, see https://github.com/NixOS/nixpkgs/issues/56943
+  # and https://github.com/NixOS/nixpkgs/issues/89691#issuecomment-714398705.
+  strictDeps = false;
+
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = "pitivi";
diff --git a/pkgs/applications/virtualization/open-vm-tools/default.nix b/pkgs/applications/virtualization/open-vm-tools/default.nix
index df9a89293f2..ce811f376bf 100644
--- a/pkgs/applications/virtualization/open-vm-tools/default.nix
+++ b/pkgs/applications/virtualization/open-vm-tools/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub, makeWrapper, autoreconfHook,
-  fuse, libmspack, openssl, pam, xercesc, icu, libdnet, procps,
+  fuse, libmspack, openssl, pam, xercesc, icu, libdnet, procps, libtirpc, rpcsvc-proto,
   libX11, libXext, libXinerama, libXi, libXrender, libXrandr, libXtst,
   pkgconfig, glib, gdk-pixbuf-xlib, gtk3, gtkmm3, iproute, dbus, systemd, which,
   withX ? true }:
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ autoreconfHook makeWrapper pkgconfig ];
-  buildInputs = [ fuse glib icu libdnet libmspack openssl pam procps xercesc ]
+  buildInputs = [ fuse glib icu libdnet libmspack libtirpc openssl pam procps rpcsvc-proto xercesc ]
       ++ lib.optionals withX [ gdk-pixbuf-xlib gtk3 gtkmm3 libX11 libXext libXinerama libXi libXrender libXrandr libXtst ];
 
   patches = [
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 535f8371153..3c867205799 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -1,17 +1,19 @@
 { stdenv, fetchurl, fetchpatch, python, zlib, pkgconfig, glib
-, ncurses, perl, pixman, vde2, alsaLib, texinfo, flex
+, perl, pixman, vde2, alsaLib, texinfo, flex
 , bison, lzo, snappy, libaio, gnutls, nettle, curl
 , makeWrapper
 , attr, libcap, libcap_ng
 , CoreServices, Cocoa, Hypervisor, rez, setfile
 , numaSupport ? stdenv.isLinux && !stdenv.isAarch32, numactl
 , seccompSupport ? stdenv.isLinux, libseccomp
-, pulseSupport ? !stdenv.isDarwin, libpulseaudio
-, sdlSupport ? !stdenv.isDarwin, SDL2
-, gtkSupport ? !stdenv.isDarwin && !xenSupport, gtk3, gettext, vte, wrapGAppsHook
-, vncSupport ? true, libjpeg, libpng
-, smartcardSupport ? true, libcacard
-, spiceSupport ? !stdenv.isDarwin, spice, spice-protocol
+, alsaSupport ? stdenv.lib.hasSuffix "linux" stdenv.hostPlatform.system && !nixosTestRunner
+, pulseSupport ? !stdenv.isDarwin && !nixosTestRunner, libpulseaudio
+, sdlSupport ? !stdenv.isDarwin && !nixosTestRunner, SDL2
+, gtkSupport ? !stdenv.isDarwin && !xenSupport && !nixosTestRunner, gtk3, gettext, vte, wrapGAppsHook
+, vncSupport ? !nixosTestRunner, libjpeg, libpng
+, smartcardSupport ? !nixosTestRunner, libcacard
+, spiceSupport ? !stdenv.isDarwin && !nixosTestRunner, spice, spice-protocol
+, ncursesSupport ? !nixosTestRunner, ncurses
 , usbredirSupport ? spiceSupport, usbredir
 , xenSupport ? false, xen
 , cephSupport ? false, ceph
@@ -29,7 +31,7 @@
 
 with stdenv.lib;
 let
-  audio = optionalString (hasSuffix "linux" stdenv.hostPlatform.system) "alsa,"
+  audio = optionalString alsaSupport "alsa,"
     + optionalString pulseSupport "pa,"
     + optionalString sdlSupport "sdl,";
 
@@ -50,10 +52,11 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ python python.pkgs.sphinx pkgconfig flex bison ]
     ++ optionals gtkSupport [ wrapGAppsHook ];
   buildInputs =
-    [ zlib glib ncurses perl pixman
+    [ zlib glib perl pixman
       vde2 texinfo makeWrapper lzo snappy
       gnutls nettle curl
     ]
+    ++ optionals ncursesSupport [ ncurses ]
     ++ optionals stdenv.isDarwin [ CoreServices Cocoa Hypervisor rez setfile ]
     ++ optionals seccompSupport [ libseccomp ]
     ++ optionals numaSupport [ numactl ]
diff --git a/pkgs/applications/window-managers/qtile/default.nix b/pkgs/applications/window-managers/qtile/default.nix
index eccf5c163a8..280ec067658 100644
--- a/pkgs/applications/window-managers/qtile/default.nix
+++ b/pkgs/applications/window-managers/qtile/default.nix
@@ -34,7 +34,18 @@ python37Packages.buildPythonApplication rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ glib libxcb cairo pango python37Packages.xcffib ];
 
-  pythonPath = with python37Packages; [ xcffib cairocffi-xcffib setuptools setuptools_scm ]; 
+  pythonPath = with python37Packages; [
+    xcffib
+    cairocffi-xcffib
+    setuptools
+    setuptools_scm
+    dateutil
+    dbus-python
+    mpd2
+    psutil
+    pyxdg
+    pygobject3
+  ];
 
   postInstall = ''
     wrapProgram $out/bin/qtile \
diff --git a/pkgs/data/fonts/jetbrains-mono/default.nix b/pkgs/data/fonts/jetbrains-mono/default.nix
index b198486327d..e3ac0a1f320 100644
--- a/pkgs/data/fonts/jetbrains-mono/default.nix
+++ b/pkgs/data/fonts/jetbrains-mono/default.nix
@@ -1,20 +1,18 @@
 { lib, fetchzip }:
 
 let
-  version = "2.002";
+  version = "2.200";
 in
 fetchzip {
   name = "JetBrainsMono-${version}";
 
   url = "https://github.com/JetBrains/JetBrainsMono/releases/download/v${version}/JetBrainsMono-${version}.zip";
 
-  sha256 = "018lhxi9m8aprls6cnpndzdg5snijwzm22m2pxxi6zcqxrcxh8vb";
+  sha256 = "16v914ph9sgdz3w56yz9f26zpj2lpxjb6ppnphxlmbllh68z1fh4";
 
   postFetch = ''
     mkdir -p $out/share/fonts
     unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
-    unzip -j $downloadedFile \*.eot -d $out/share/fonts/eot
-    unzip -j $downloadedFile \*.woff -d $out/share/fonts/woff
     unzip -j $downloadedFile \*.woff2 -d $out/share/fonts/woff2
   '';
 
diff --git a/pkgs/data/fonts/joypixels/default.nix b/pkgs/data/fonts/joypixels/default.nix
index 1b107f9cb82..c19a55400fc 100644
--- a/pkgs/data/fonts/joypixels/default.nix
+++ b/pkgs/data/fonts/joypixels/default.nix
@@ -1,24 +1,103 @@
-{ stdenv, fetchurl }:
+{ stdenv
+, fetchurl
+, config
+, acceptLicense ? config.joypixels.acceptLicense or false
+}:
+
+let
+  inherit (stdenv.hostPlatform.parsed) kernel;
+
+  systemSpecific = {
+    darwin = rec {
+      systemTag =  "nix-darwin";
+      capitalized = systemTag;
+      fontFile = "JoyPixels-SBIX.ttf";
+    };
+  }.${kernel.name} or rec {
+    systemTag = "nixos";
+    capitalized = "NixOS";
+    fontFile = "joypixels-android.ttf";
+  };
+
+  joypixels-free-license = with systemSpecific; {
+    spdxId = "LicenseRef-JoyPixels-Free-6.0";
+    fullName = "JoyPixels Free License Agreement 6.0";
+    url = "https://cdn.joypixels.com/distributions/${systemTag}/license/free-license.pdf";
+    free = false;
+  };
+
+  joypixels-license-appendix = with systemSpecific; {
+    spdxId = "LicenseRef-JoyPixels-NixOS-Appendix";
+    fullName = "JoyPixels ${capitalized} License Appendix";
+    url = "https://cdn.joypixels.com/distributions/${systemTag}/appendix/joypixels-license-appendix.pdf";
+    free = false;
+  };
+
+  throwLicense = throw ''
+    Use of the JoyPixels font requires acceptance of the license.
+      - ${joypixels-free-license.fullName} [1]
+      - ${joypixels-license-appendix.fullName} [2]
+
+    You can express acceptance by setting acceptLicense to true in your
+    configuration. Note that this is not a free license so it requires allowing
+    unfree licenses.
+
+    configuration.nix:
+      nixpkgs.config.allowUnfree = true;
+      nixpkgs.config.joypixels.acceptLicense = true;
+
+    config.nix:
+      allowUnfree = true;
+      joypixels.acceptLicense = true;
+
+    [1]: ${joypixels-free-license.url}
+    [2]: ${joypixels-license-appendix.url}
+  '';
+
+in
 
 stdenv.mkDerivation rec {
   pname = "joypixels";
   version = "6.0.0";
 
-  src = fetchurl {
-    url = "https://cdn.joypixels.com/arch-linux/font/${version}/joypixels-android.ttf";
-    sha256 = "1vxqsqs93g4jyp01r47lrpcm0fmib2n1vysx32ksmfxmprimb75s";
-  };
+  src = assert !acceptLicense -> throwLicense;
+    with systemSpecific; fetchurl {
+      name = fontFile;
+      url = "https://cdn.joypixels.com/distributions/${systemTag}/font/${version}/${fontFile}";
+      sha256 = {
+        darwin = "1s1dibgpv4lc9cwbgykgwjxxhg2rbn5g9fyd10r6apj9xhfn8cyn";
+      }.${kernel.name} or "1vxqsqs93g4jyp01r47lrpcm0fmib2n1vysx32ksmfxmprimb75s";
+    };
 
   dontUnpack = true;
 
-  installPhase = ''
-    install -Dm644 $src $out/share/fonts/truetype/joypixels.ttf
+  installPhase = with systemSpecific; ''
+    runHook preInstall
+
+    install -Dm644 $src $out/share/fonts/truetype/${fontFile}
+
+    runHook postInstall
   '';
 
   meta = with stdenv.lib; {
-    description = "Emoji as a Service (formerly EmojiOne)";
-    homepage = "https://www.joypixels.com/";
-    license = licenses.unfree;
-    maintainers = with maintainers; [ jtojnar ];
+    description = "The finest emoji you can use legally (formerly EmojiOne)";
+    longDescription = ''
+      New for 2020! JoyPixels 6.0 includes 3,342 originally crafted icon
+      designs and is 100% Unicode 13 compatible. We offer the largest selection
+      of files ranging from png, svg, iconjar, sprites, and fonts.
+    '';
+    homepage = "https://www.joypixels.com/fonts";
+    license =
+      let
+        free-license = joypixels-free-license;
+        appendix = joypixels-license-appendix;
+      in with systemSpecific; {
+        spdxId = "LicenseRef-JoyPixels-Free-6.0-with-${capitalized}-Appendix";
+        fullName = "${free-license.fullName} with ${appendix.fullName}";
+        url = free-license.url;
+        appendixUrl = appendix.url;
+        free = false;
+      };
+    maintainers = with maintainers; [ toonn jtojnar ];
   };
 }
diff --git a/pkgs/data/fonts/julia-mono/default.nix b/pkgs/data/fonts/julia-mono/default.nix
index 48569310366..8774913c83c 100644
--- a/pkgs/data/fonts/julia-mono/default.nix
+++ b/pkgs/data/fonts/julia-mono/default.nix
@@ -5,7 +5,7 @@ let
 in fetchzip {
   name = "JuliaMono-${version}";
   url = "https://github.com/cormullion/juliamono/releases/download/v${version}/JuliaMono.zip";
-  sha256 = "1v4a9qbvjlszamvqrj0g65z1nhahfmf1fzkgjwzkmsrdqn909dic";
+  sha256 = "sha256-/MVT6n842sSiuPZNYxN3q1vn6yvMvmcTEDyvAd2GikA=";
 
   postFetch = ''
     mkdir -p $out/share/fonts/truetype
diff --git a/pkgs/data/themes/numix-solarized/default.nix b/pkgs/data/themes/numix-solarized/default.nix
index ae8a1d7145e..356f7d33b26 100644
--- a/pkgs/data/themes/numix-solarized/default.nix
+++ b/pkgs/data/themes/numix-solarized/default.nix
@@ -1,33 +1,29 @@
-{ stdenv, fetchFromGitHub, python3, sass, glib, gdk-pixbuf, libxml2,
-  inkscape, optipng, gtk-engine-murrine
-}:
+{ stdenv, fetchFromGitHub, python3, sassc, glib, gdk-pixbuf, inkscape, gtk-engine-murrine }:
 
 stdenv.mkDerivation rec {
-  version = "20180913";
+  version = "20200910";
   pname = "numix-solarized-gtk-theme";
 
   src = fetchFromGitHub {
     owner = "Ferdi265";
     repo = "numix-solarized-gtk-theme";
     rev = version;
-    sha256 = "1kda0lyqi3cxh163fbj8yyi6jj6pf0y980k4s0cmyi3hkh4cqyd5";
+    sha256 = "05h1563sy6sfz76jadxsf730mav6bbjsk9xnadv49r16b8n8p9a9";
   };
 
-  nativeBuildInputs = [ python3 sass glib gdk-pixbuf libxml2 inkscape optipng ];
+  nativeBuildInputs = [ python3 sassc glib gdk-pixbuf inkscape ];
 
   propagatedUserEnvPkgs = [ gtk-engine-murrine ];
 
   postPatch = ''
     patchShebangs .
     substituteInPlace Makefile --replace '$(DESTDIR)'/usr $out
-    substituteInPlace scripts/render-assets.sh \
-      --replace /usr/bin/inkscape ${inkscape}/bin/inkscape \
-      --replace /usr/bin/optipng ${optipng}/bin/optipng
   '';
 
   buildPhase = "true";
 
   installPhase = ''
+    HOME="$NIX_BUILD_ROOT"  # shut up inkscape's warnings
     for theme in *.colors; do
       make THEME="''${theme/.colors/}" install
     done
diff --git a/pkgs/desktops/cinnamon/cinnamon-desktop/default.nix b/pkgs/desktops/cinnamon/cinnamon-desktop/default.nix
index cdb8e6a381f..71eb54ea202 100644
--- a/pkgs/desktops/cinnamon/cinnamon-desktop/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-desktop/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cinnamon-desktop";
-  version = "4.6.1";
+  version = "4.6.4";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    sha256 = "0299m41vy4kcsi74z793ligvqj8nyy3fbzh6xz89jd8l3p9kgrz8";
+    sha256 = "08z5hgc6dwdp9fczm75axwh8q9665iz4y2lxp92xp62r3k0v9fvd";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/desktops/cinnamon/cinnamon-menus/default.nix b/pkgs/desktops/cinnamon/cinnamon-menus/default.nix
index bae9615fb9f..9edc1368707 100644
--- a/pkgs/desktops/cinnamon/cinnamon-menus/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-menus/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cinnamon-menus";
-  version = "4.6.0";
+  version = "4.6.1";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    sha256 = "00jzb3fd96ydi15lrnwnjai12wvka5zlandn9xc61s8iim48lplq";
+    sha256 = "1qdaql4mknhzvl2qi1pyw4c820lqb7lg07gblh0wzfk4f7h8hddx";
   };
 
   buildInputs = [
diff --git a/pkgs/desktops/cinnamon/cinnamon-session/default.nix b/pkgs/desktops/cinnamon/cinnamon-session/default.nix
index 9e142095961..4e9c09f4d73 100644
--- a/pkgs/desktops/cinnamon/cinnamon-session/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-session/default.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cinnamon-session";
-  version = "4.6.1";
+  version = "4.6.2";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    sha256 = "13qqi3zqybz00czh0g5nqjx5iwna54cxd7mk9wkp30kj6raa4qca";
+    sha256 = "133vpgs0dqr16pvx5wyxhfcargn9wl14z0q99m2pn93hf6zycmsv";
   };
 
   patches = [
diff --git a/pkgs/development/compilers/chez/default.nix b/pkgs/development/compilers/chez/default.nix
index 864ccc5a743..550f754639e 100644
--- a/pkgs/development/compilers/chez/default.nix
+++ b/pkgs/development/compilers/chez/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "chez-scheme";
-  version = "9.5.2";
+  version = "9.5.4";
 
   src = fetchFromGitHub {
     owner  = "cisco";
     repo   = "ChezScheme";
     rev    = "refs/tags/v${version}";
-    sha256 = "1gsjmsvsj31q5l9bjvm869y7bakrvl41yq94vyqdx8zwcr1bmpjf";
+    sha256 = "065dir19cqpn0d1bk9w49wnwzn6qfrgvcqw8da2fdhkafhfcb1bj";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/interpreters/guile/default.nix b/pkgs/development/interpreters/guile/default.nix
index 68df200835f..52a3488d051 100644
--- a/pkgs/development/interpreters/guile/default.nix
+++ b/pkgs/development/interpreters/guile/default.nix
@@ -38,7 +38,13 @@
     libtool libunistring
   ];
 
-  enableParallelBuilding = true;
+  # According to Bernhard M. Wiedemann <bwiedemann suse de> on
+  # #reproducible-builds on irc.oftc.net, (2020-01-29): they had to
+  # build Guile without parallel builds to make it reproducible.
+  #
+  # re: https://issues.guix.gnu.org/issue/20272
+  # re: https://build.opensuse.org/request/show/732638
+  enableParallelBuilding = false;
 
   patches = [
     ./eai_system.patch
@@ -109,4 +115,3 @@
     '';
   };
 })
-
diff --git a/pkgs/development/libraries/CGAL/default.nix b/pkgs/development/libraries/CGAL/default.nix
index 97ddab1a32e..6824cb7f183 100644
--- a/pkgs/development/libraries/CGAL/default.nix
+++ b/pkgs/development/libraries/CGAL/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cgal";
-  version = "5.0.3";
+  version = "5.1";
 
   src = fetchFromGitHub {
     owner = "CGAL";
     repo = "releases";
     rev = "CGAL-${version}";
-    sha256 = "1p22dwrzzvbmrfjr6m3dac55nq8pp0b9afp3vz6239yp3gf2fcws";
+    sha256 = "0rcv86hn5aqna7vr9nfk4np778qjr7l3742v58w6qw0z4y6l1km0";
   };
 
   # note: optional component libCGAL_ImageIO would need zlib and opengl;
diff --git a/pkgs/development/libraries/agda/agda-categories/default.nix b/pkgs/development/libraries/agda/agda-categories/default.nix
index 13ca6c52d71..f2215b9b984 100644
--- a/pkgs/development/libraries/agda/agda-categories/default.nix
+++ b/pkgs/development/libraries/agda/agda-categories/default.nix
@@ -1,14 +1,14 @@
 { lib, mkDerivation, fetchFromGitHub, standard-library }:
 
 mkDerivation rec {
-  version = "0.1.3.1";
+  version = "0.1.4";
   pname = "agda-categories";
 
   src = fetchFromGitHub {
     owner = "agda";
     repo = "agda-categories";
     rev = "v${version}";
-    sha256 = "08mc20qaz9vp5rhi60rh8wvjkg5aby3bgwwdhfnxha1663qf1q24";
+    sha256 = "0n6y9xarqhj95i4h56klx10gy0fyckxbfwgiissfknpfq6l0m7r6";
   };
 
   buildInputs = [ standard-library ];
diff --git a/pkgs/development/libraries/agda/generic/default.nix b/pkgs/development/libraries/agda/generic/default.nix
index 1287e08bda1..08a1d8e12e0 100644
--- a/pkgs/development/libraries/agda/generic/default.nix
+++ b/pkgs/development/libraries/agda/generic/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "generic";
-  version = "0.1";
+  version = "0.1.0.1";
 
   src = fetchFromGitHub {
     repo = "Generic";
     owner = "effectfully";
     rev = "v${version}";
-    sha256 = "121121rg3daaqp91845fbyws6g28hyj1ywmh12n54r3nicb35g5q";
+    sha256 = "07l44yzx1jly20kmkmkjk8q493bn6x7i3xxpz6mhadkqlxyhmc8s";
   };
 
   buildInputs = [
@@ -17,7 +17,7 @@ mkDerivation rec {
 
   preBuild = ''
     echo "module Everything where" > Everything.agda
-	  find src -name '*.agda' | sed -e 's/src\///;s/\//./g;s/\.agda$//;s/^/import /' >> Everything.agda
+    find src -name '*.agda' | sed -e 's/src\///;s/\//./g;s/\.agda$//;s/^/import /' >> Everything.agda
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/agda/standard-library/default.nix b/pkgs/development/libraries/agda/standard-library/default.nix
index 4bff585ac3a..e43e1bad3b6 100644
--- a/pkgs/development/libraries/agda/standard-library/default.nix
+++ b/pkgs/development/libraries/agda/standard-library/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "standard-library";
-  version = "1.3";
+  version = "1.4";
 
   src = fetchFromGitHub {
     repo = "agda-stdlib";
     owner = "agda";
     rev = "v${version}";
-    sha256 = "18kl20z3bjfgx5m3nvrdj5776qmpi7jl2p12pqybsls2lf86m0d5";
+    sha256 = "1asjbisb7pfkgzqy7gf9b23z63bba8l8p1wqfd6ff5ddgqwj3dhp";
   };
 
   nativeBuildInputs = [ (ghcWithPackages (self : [ self.filemanip ])) ];
diff --git a/pkgs/development/libraries/armadillo/default.nix b/pkgs/development/libraries/armadillo/default.nix
index a4d359b985b..169777f2b42 100644
--- a/pkgs/development/libraries/armadillo/default.nix
+++ b/pkgs/development/libraries/armadillo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "armadillo";
-  version = "9.900.3";
+  version = "10.1.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    sha256 = "02pwhf3y2qq50dswjvfcijaw938d1zi1hxr17msv2x1ahlvff5fn";
+    sha256 = "15c3amyrk496v0s6r2pn8dw4v82f4ld347nbv5qdzd6injsg3qvj";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/arrow-cpp/default.nix b/pkgs/development/libraries/arrow-cpp/default.nix
index 695cd136857..1d9a528b4c6 100644
--- a/pkgs/development/libraries/arrow-cpp/default.nix
+++ b/pkgs/development/libraries/arrow-cpp/default.nix
@@ -7,25 +7,25 @@ let
   arrow-testing = fetchFromGitHub {
     owner = "apache";
     repo = "arrow-testing";
-    rev = "f552c4dcd2ae3d14048abd20919748cce5276ade";
-    sha256 = "1smaidk5k2q6xdav7qp74ak34vvwv5qyfqw0szi573awsrsrahr8";
+    rev = "860376d4e586a3ac34ec93089889da624ead6c2a";
+    sha256 = "16k3lz4ji4y3qcjhr765q14jwwlac8iqscwndwd8ll3zr0vy69b0";
   };
 
   parquet-testing = fetchFromGitHub {
     owner = "apache";
     repo = "parquet-testing";
-    rev = "bcd9ebcf9204a346df47204fe21b85c8d0498816";
-    sha256 = "0m16pqzbvxiaradq088q5ai6fwnz9srbap996397znwppvva479b";
+    rev = "d914f9d289488c7db1759d7a88a4a1b8f062c7dd";
+    sha256 = "0xj3ynck2wv6l70xnmvs13bz1jycqjrl5k4lwhhwgag338048als";
   };
 
 in stdenv.mkDerivation rec {
   pname = "arrow-cpp";
-  version = "1.0.1";
+  version = "2.0.0";
 
   src = fetchurl {
     url =
       "mirror://apache/arrow/arrow-${version}/apache-arrow-${version}.tar.gz";
-    sha256 = "0p67dni8dwqbwq96gfdq3pyk799id6dgdl9h7cpp9icsjsmad70l";
+    sha256 = "1ghzqw0rx4rxa2d7i76y3szisv0bd9cl7vzadbc41cvvhk6440xy";
   };
   sourceRoot = "apache-arrow-${version}/cpp";
 
@@ -43,26 +43,13 @@ in stdenv.mkDerivation rec {
     # ./cpp/cmake_modules/ThirdpartyToolchain.cmake
     # ./cpp/thirdparty/versions.txt
     url =
-      "https://github.com/microsoft/mimalloc/archive/v1.6.3.tar.gz";
-    sha256 = "0pia8b4acv1w8qzcpc9i1a2fasnn3rmp996k0l87p2di0lbls0w5";
+      "https://github.com/microsoft/mimalloc/archive/v1.6.4.tar.gz";
+    sha256 = "1b8av0974q70alcmaw5cwzbn6n9blnpmj721ik1qwmbbwwd6nqgs";
   };
 
   patches = [
     # patch to fix python-test
     ./darwin.patch
-    # Properly exported static targets. Remove at the next version bump.
-    (fetchpatch {
-      url = "https://github.com/apache/arrow/commit/b040600b39a4f803b704934252665f9440dd1276.patch";
-      sha256 = "1mvw29ybcsz77zprmsk41blxmrj8ywayg7ghf6xkkf98907ws8m8";
-      includes = [ "*.cmake" ];
-      stripLen = 1;
-    })
-    (fetchpatch {
-      url = "https://github.com/apache/arrow/commit/81d3f2657b17436d6d5a6af9aaf6f36c3f5e4ac9.patch";
-      sha256 = "18fmzr5f79hvx2qpyfgvvl98p4zgzfxrmrd1d2basp0w0da1ciqs";
-      includes = [ "*CMakeLists.txt" "*.cmake" "*.cmake.in" ];
-      stripLen = 1;
-    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libndctl/default.nix b/pkgs/development/libraries/libndctl/default.nix
index 7c4c49baffa..be5c75806d8 100644
--- a/pkgs/development/libraries/libndctl/default.nix
+++ b/pkgs/development/libraries/libndctl/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, autoreconfHook
 , asciidoctor, pkgconfig, xmlto, docbook_xsl, docbook_xml_dtd_45, libxslt
-, json_c, kmod, which, utillinux, systemd, keyutils
+, json_c, kmod, which, utillinux, udev, keyutils
 }:
 
 stdenv.mkDerivation rec {
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     ];
 
   buildInputs =
-    [ json_c kmod utillinux systemd keyutils
+    [ json_c kmod utillinux udev keyutils
     ];
 
   configureFlags =
diff --git a/pkgs/development/libraries/rocksdb/default.nix b/pkgs/development/libraries/rocksdb/default.nix
index 3e97c3f343f..5f023da49f3 100644
--- a/pkgs/development/libraries/rocksdb/default.nix
+++ b/pkgs/development/libraries/rocksdb/default.nix
@@ -8,6 +8,7 @@
 , snappy
 , zlib
 , zstd
+, enableJemalloc ? false, jemalloc
 , enableLite ? false
 , enableShared ? true
 }:
@@ -25,7 +26,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ninja ];
 
-  buildInputs = [ bzip2 lz4 snappy zlib zstd ];
+  buildInputs = [ bzip2 lz4 snappy zlib zstd ] ++ stdenv.lib.optional enableJemalloc jemalloc;
 
   patches = [
     # Without this change private dependencies are exported.
@@ -41,7 +42,7 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DPORTABLE=1"
-    "-DWITH_JEMALLOC=0"
+    "-DWITH_JEMALLOC=${if enableJemalloc then "1" else "0"}"
     "-DWITH_JNI=0"
     "-DWITH_BENCHMARK_TOOLS=0"
     "-DWITH_TESTS=1"
diff --git a/pkgs/development/ocaml-modules/janestreet/0.13.nix b/pkgs/development/ocaml-modules/janestreet/0.13.nix
index b92027a65a0..175651f6960 100644
--- a/pkgs/development/ocaml-modules/janestreet/0.13.nix
+++ b/pkgs/development/ocaml-modules/janestreet/0.13.nix
@@ -392,6 +392,13 @@ rec {
     propagatedBuildInputs = [ async ];
   };
 
+  async_interactive = janePackage {
+    pname = "async_interactive";
+    hash = "1ma24pi3hqzrs1k12sc0aarhf42fap8nl1h7id6k01wp6s3yqi5d";
+    meta.description = "Utilities for building simple command-line based user interfaces";
+    propagatedBuildInputs = [ async ];
+  };
+
   re2 = janePackage {
     pname = "re2";
     hash = "0hmizznlzilynn5kh6149bbpkfw2l0xi7zi1y1fxfww2ma3wpim0";
@@ -477,6 +484,20 @@ rec {
     propagatedBuildInputs = [ async expect_test_helpers_kernel ];
   };
 
+  posixat = janePackage {
+    pname = "posixat";
+    hash = "122fmd6v7fhiiivkxra539b5w3p5xkkd8mcjzvyb2msyq5zc6xa2";
+    propagatedBuildInputs = [ ppx_optcomp ppx_sexp_conv ];
+    meta.description = "Binding to the posix *at functions";
+  };
+
+  shexp = janePackage {
+    pname = "shexp";
+    hash = "0zdcyix0gdn4xmvbjzhbig63xw9jnw8ixj3ngs6g4k2vk77rs0gk";
+    propagatedBuildInputs = [ posixat spawn ];
+    meta.description = "Process library and s-expression based shell";
+  };
+
   ### Packages at version 0.11, with dependencies at version 0.12
 
   configurator = janePackage {
diff --git a/pkgs/development/ocaml-modules/mirage-crypto/default.nix b/pkgs/development/ocaml-modules/mirage-crypto/default.nix
index e178e066a38..66da69fee22 100644
--- a/pkgs/development/ocaml-modules/mirage-crypto/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-crypto/default.nix
@@ -4,11 +4,11 @@ buildDunePackage rec {
   minimumOCamlVersion = "4.08";
 
   pname = "mirage-crypto";
-  version = "0.8.5";
+  version = "0.8.6";
 
   src = fetchurl {
     url = "https://github.com/mirage/mirage-crypto/releases/download/v${version}/mirage-crypto-v${version}.tbz";
-    sha256 = "0l6q0z5ghhy0djfscb2i2xg4dpmxs4xkwh16kc473cmb4hsxsmyk";
+    sha256 = "1fghg89lpm1iks6nk1jhqcimpvb52jih0ys9bxbn2f343l0njbkq";
   };
 
   useDune2 = true;
diff --git a/pkgs/development/ocaml-modules/ocsigen-start/default.nix b/pkgs/development/ocaml-modules/ocsigen-start/default.nix
index 637c06e98dc..5939e616453 100644
--- a/pkgs/development/ocaml-modules/ocsigen-start/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-start/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, ocaml, findlib, ocsigen-toolkit, pgocaml_ppx, macaque, safepass, yojson
+{ stdenv, fetchFromGitHub, ocaml, findlib, ocsigen-toolkit, pgocaml_ppx, safepass, yojson
 , cohttp-lwt-unix
 , resource-pooling
 }:
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   '';
 
   createFindlibDestdir = true;
-  
+
   src = fetchFromGitHub {
     owner = "ocsigen";
     repo = "ocsigen-start";
diff --git a/pkgs/development/ocaml-modules/opium_kernel/default.nix b/pkgs/development/ocaml-modules/opium_kernel/default.nix
index 8388e108fef..c7bfe1e7306 100644
--- a/pkgs/development/ocaml-modules/opium_kernel/default.nix
+++ b/pkgs/development/ocaml-modules/opium_kernel/default.nix
@@ -1,6 +1,6 @@
 { lib
 , buildDunePackage
-, fetchFromGitHub
+, fetchurl
 
 , ppx_fields_conv
 , ppx_sexp_conv
@@ -8,35 +8,36 @@
 , cohttp-lwt
 , ezjsonm
 , hmap
+, sexplib
 }:
 
 buildDunePackage rec {
-	pname = "opium_kernel";
-  version = "0.17.1";
+  pname = "opium_kernel";
+  version = "0.18.0";
+
+  useDune2 = true;
 
   minimumOCamlVersion = "4.04.1";
-  
-	src = fetchFromGitHub {
-		owner = "rgrinberg";
-		repo = "opium";
-		rev = "v${version}";
-		sha256 = "03xzh0ik6k3c0yn1w1avph667vdagwclzimwwrlf9qdxnzxvcnp3";
-	};
+
+  src = fetchurl {
+    url = "https://github.com/rgrinberg/opium/releases/download/${version}/opium-${version}.tbz";
+    sha256 = "0a2y9gw55psqhqli3a5ps9mfdab8r46fnbj882r2sp366sfcy37q";
+  };
 
   doCheck = true;
 
-	buildInputs = [
+  buildInputs = [
     ppx_sexp_conv ppx_fields_conv
   ];
 
-	propagatedBuildInputs = [
-    hmap cohttp-lwt ezjsonm
+  propagatedBuildInputs = [
+    hmap cohttp-lwt ezjsonm sexplib
   ];
 
   meta = {
-		description = "Sinatra like web toolkit for OCaml based on cohttp & lwt";
+    description = "Sinatra like web toolkit for OCaml based on cohttp & lwt";
     homepage = "https://github.com/rgrinberg/opium";
-		license = lib.licenses.mit;
-		maintainers = [ lib.maintainers.pmahoney ];
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.pmahoney ];
   };
 }
diff --git a/pkgs/development/ocaml-modules/pgocaml/default.nix b/pkgs/development/ocaml-modules/pgocaml/default.nix
index 8896675f63c..d0dcb5b489f 100644
--- a/pkgs/development/ocaml-modules/pgocaml/default.nix
+++ b/pkgs/development/ocaml-modules/pgocaml/default.nix
@@ -1,22 +1,21 @@
 { lib, fetchFromGitHub, buildDunePackage
-, calendar, csv, hex, re
+, calendar, csv, hex, ppx_deriving, ppx_sexp_conv, re, rresult, sexplib
 }:
 
 buildDunePackage rec {
   pname = "pgocaml";
-  version = "4.0";
+  version = "4.2.2";
   src = fetchFromGitHub {
     owner = "darioteixeira";
     repo = "pgocaml";
-    rev = "v${version}";
-    sha256 = "1s8c5prr7jb9k76bz990m836czm6k8rv5bvp6s2zg9ra0w19w90j";
+    rev = version;
+    sha256 = "1rdypc83nap9j2ml9r6n1pzgf79gk1yffwyi6fmcrl7zmy01cg0n";
   };
 
-  minimumOCamlVersion = "4.05";
+  minimumOCamlVersion = "4.07";
+  useDune2 = true;
 
-  preConfigure = "patchShebangs src/genconfig.sh";
-
-  propagatedBuildInputs = [ calendar csv hex re ];
+  propagatedBuildInputs = [ calendar csv hex ppx_deriving ppx_sexp_conv re rresult sexplib ];
 
   meta = with lib; {
     description = "An interface to PostgreSQL databases for OCaml applications";
diff --git a/pkgs/development/ocaml-modules/pgocaml/ppx.nix b/pkgs/development/ocaml-modules/pgocaml/ppx.nix
index f8bc4a40e7f..35c19622f88 100644
--- a/pkgs/development/ocaml-modules/pgocaml/ppx.nix
+++ b/pkgs/development/ocaml-modules/pgocaml/ppx.nix
@@ -1,8 +1,8 @@
-{ buildDunePackage, pgocaml, ppx_tools, ppx_tools_versioned, rresult }:
+{ buildDunePackage, pgocaml, ppx_optcomp, ppx_tools, ppx_tools_versioned, rresult }:
 
 buildDunePackage {
   pname = "pgocaml_ppx";
-  inherit (pgocaml) src version meta;
+  inherit (pgocaml) src version useDune2 meta;
 
-  propagatedBuildInputs = [ pgocaml ppx_tools ppx_tools_versioned rresult ];
+  propagatedBuildInputs = [ pgocaml ppx_optcomp ppx_tools ppx_tools_versioned rresult ];
 }
diff --git a/pkgs/development/ocaml-modules/safepass/default.nix b/pkgs/development/ocaml-modules/safepass/default.nix
index 884bcdebba4..04c494403be 100644
--- a/pkgs/development/ocaml-modules/safepass/default.nix
+++ b/pkgs/development/ocaml-modules/safepass/default.nix
@@ -1,33 +1,21 @@
-{ stdenv, fetchurl, ocaml, findlib, ocamlbuild }:
+{ lib, fetchFromGitHub, buildDunePackage }:
 
-let param =
-  if stdenv.lib.versionAtLeast ocaml.version "4.02"
-  then {
-    version = "2.0";
-    url = "http://forge.ocamlcore.org/frs/download.php/1615/ocaml-safepass-2.0.tgz";
-    sha256 = "1zxx3wcyzhxxvm5w9c21y7hpa11h67paaaz9mfsyiqk6fs6hcvmw";
-  } else {
-    version = "1.3";
-    url = "http://forge.ocamlcore.org/frs/download.php/1432/ocaml-safepass-1.3.tgz";
-    sha256 = "0lb8xbpyc5d1zml7s7mmcr6y2ipwdp7qz73lkv9asy7dyi6cj15g";
-  };
-in
+buildDunePackage rec {
+  pname = "safepass";
+  version = "3.0";
 
-stdenv.mkDerivation {
-  name = "ocaml${ocaml.version}-safepass-${param.version}";
-  src = fetchurl {
-    inherit (param) url sha256;
+  src = fetchFromGitHub {
+    owner = "darioteixeira";
+    repo = "ocaml-safepass";
+    rev = "v${version}";
+    sha256 = "0i127gs9x23wzwa1q3dxa2j6hby07hvxdg1c98fc3j09rg6vy2bs";
   };
 
-  buildInputs = [ ocaml findlib ocamlbuild ];
-
-  createFindlibDestdir = true;
-
   meta = {
-    homepage = "http://ocaml-safepass.forge.ocamlcore.org/";
+    inherit (src.meta) homepage;
     description = "An OCaml library offering facilities for the safe storage of user passwords";
-    license = stdenv.lib.licenses.lgpl21;
-    platforms = ocaml.meta.platforms or [];
-    maintainers = with stdenv.lib.maintainers; [ vbgl ];
+    license = lib.licenses.lgpl21;
+    maintainers = with lib.maintainers; [ vbgl ];
   };
+
 }
diff --git a/pkgs/development/python-modules/baron/default.nix b/pkgs/development/python-modules/baron/default.nix
new file mode 100644
index 00000000000..8a04befc6d1
--- /dev/null
+++ b/pkgs/development/python-modules/baron/default.nix
@@ -0,0 +1,24 @@
+{ lib, fetchPypi, buildPythonPackage, rply, pytestCheckHook, isPy3k }:
+
+buildPythonPackage rec {
+  pname = "baron";
+  version = "0.9";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0fib74nkqnl1i2zzlhbbfpw3whwc4951p9x61r2xrxhwp4r9yn5h";
+  };
+
+  propagatedBuildInputs = [ rply ];
+
+  checkInputs = [ pytestCheckHook ];
+
+  doCheck = isPy3k;
+
+  meta = with lib; {
+    homepage = "https://github.com/gristlabs/asttokens";
+    description = "Abstraction on top of baron, a FST for python to make writing refactoring code a realistic task";
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ marius851000 ];
+  };
+}
diff --git a/pkgs/development/python-modules/block-io/default.nix b/pkgs/development/python-modules/block-io/default.nix
index ec1229965e0..07d6cffe56c 100644
--- a/pkgs/development/python-modules/block-io/default.nix
+++ b/pkgs/development/python-modules/block-io/default.nix
@@ -20,13 +20,16 @@ buildPythonPackage rec {
 
   preConfigure = ''
     substituteInPlace setup.py \
-      --replace "ecdsa==0.13" "ecdsa>=0.13"
+      --replace "ecdsa==0.13" "ecdsa>=0.13" \
+      --replace "base58==1.0.3" "base58>=1.0.3"
   '';
 
   # Tests needs a BlockIO API key to run properly
   # https://github.com/BlockIo/block_io-python/blob/79006bc8974544b70a2d8e9f19c759941d32648e/test.py#L18
   doCheck = false;
 
+  pythonImportsCheck = [ "block_io" ];
+
   meta = with stdenv.lib; {
     description = "Integrate Bitcoin, Dogecoin and Litecoin in your Python applications using block.io";
     homepage = "https://github.com/BlockIo/block_io-python";
diff --git a/pkgs/development/python-modules/google-api-python-client/default.nix b/pkgs/development/python-modules/google-api-python-client/default.nix
index 3ff530831b3..b2543167ad1 100644
--- a/pkgs/development/python-modules/google-api-python-client/default.nix
+++ b/pkgs/development/python-modules/google-api-python-client/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "google-api-python-client";
-  version = "1.12.3";
+  version = "1.12.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "844ef76bda585ea0ea2d5e7f8f9a0eb10d6e2eba66c4fea0210ec7843941cb1a";
+    sha256 = "1mn20wzy2001wk75br2qfx73yj8dx056f9xgkcri6w8hmbhm1f6l";
   };
 
   # No tests included in archive
diff --git a/pkgs/development/python-modules/patool/default.nix b/pkgs/development/python-modules/patool/default.nix
new file mode 100644
index 00000000000..1420597a1f3
--- /dev/null
+++ b/pkgs/development/python-modules/patool/default.nix
@@ -0,0 +1,57 @@
+{ stdenv, lib, buildPythonPackage, fetchFromGitHub, pytestCheckHook, p7zip,
+  unzip, cabextract, zip, zopfli, lzip, zpaq, gnutar, gnugrep, diffutils, file,
+  gzip, bzip2, xz}:
+
+# unrar is unfree, as well as 7z with unrar support, not including it (patool doesn't support unar)
+
+let
+  compression-utilities = [
+    p7zip
+    unzip
+    gnutar
+    cabextract
+    zip
+    zopfli
+    lzip
+    zpaq
+    gzip
+    gnugrep
+    diffutils
+    bzip2
+    file
+    xz
+  ];
+in
+buildPythonPackage rec {
+  pname = "patool";
+  version = "1.12";
+
+  #pypi doesn't have test data
+  src = fetchFromGitHub {
+    owner = "wummel";
+    repo = pname;
+    rev = "upstream/${version}";
+    sha256 = "0v4r77sm3yzh7y1whfwxmp01cchd82jbhvbg9zsyd2yb944imzjy";
+  };
+
+  prePatch = ''
+    substituteInPlace patoolib/util.py \
+      --replace "path = None" 'path = append_to_path(os.environ["PATH"], "${lib.makeBinPath compression-utilities}")'
+  '';
+
+  checkInputs = [ pytestCheckHook ] ++ compression-utilities;
+
+  disabledTests = [
+    "test_unzip"
+    "test_unzip_file"
+    "test_zip"
+    "test_zip_file"
+  ];
+
+  meta = with lib; {
+    description = "portable archive file manager";
+    homepage = "https://wummel.github.io/patool/";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ marius851000 ];
+  };
+}
diff --git a/pkgs/development/python-modules/pypblib/default.nix b/pkgs/development/python-modules/pypblib/default.nix
new file mode 100644
index 00000000000..4cf8d5fc7b6
--- /dev/null
+++ b/pkgs/development/python-modules/pypblib/default.nix
@@ -0,0 +1,20 @@
+{ lib, buildPythonPackage, fetchPypi }:
+
+buildPythonPackage rec {
+  pname = "pypblib";
+  version = "0.0.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0qlhykm9flj6cv3v0b9q40gy21yz0lnp0wxlxvb3ijkpy45r7pbi";
+  };
+
+  pythonImportsCheck = [ "pypblib" ];
+
+  meta = with lib; {
+    homepage = "https://pypi.org/project/pypblib/";
+    description = "PBLib Python3 Bindings";
+    license = licenses.mit;
+    maintainers = [ maintainers.marius851000 ];
+  };
+}
diff --git a/pkgs/development/python-modules/python-sat/default.nix b/pkgs/development/python-modules/python-sat/default.nix
new file mode 100644
index 00000000000..ea3d1bfb444
--- /dev/null
+++ b/pkgs/development/python-modules/python-sat/default.nix
@@ -0,0 +1,24 @@
+{ buildPythonPackage, fetchFromGitHub, lib, six, pypblib, pytestCheckHook }:
+
+buildPythonPackage rec {
+  pname = "python-sat";
+  version = "0.1.6.dev6";
+
+  src = fetchFromGitHub {
+    owner = "pysathq";
+    repo = "pysat";
+    rev = version;
+    sha256 = "1gckxhqkvzyw7pmwg8xzxq146jysqy0s23l5mjc3awm6swdij66y";
+  };
+
+  propagatedBuildInputs = [ six pypblib ];
+
+  checkInputs = [ pytestCheckHook ];
+
+  meta = with lib; {
+    description = "Toolkit to provide interface for various SAT (without optional dependancy py-aiger-cnf)";
+    homepage = "https://github.com/pysathq/pysat";
+    license = licenses.mit;
+    maintainers = [ maintainers.marius851000 ];
+  };
+}
diff --git a/pkgs/development/python-modules/redbaron/default.nix b/pkgs/development/python-modules/redbaron/default.nix
new file mode 100644
index 00000000000..841d6a31fb2
--- /dev/null
+++ b/pkgs/development/python-modules/redbaron/default.nix
@@ -0,0 +1,27 @@
+{ lib, fetchPypi, buildPythonPackage, baron, pytestCheckHook }:
+
+buildPythonPackage rec {
+  pname = "redbaron";
+  version = "0.9.2";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0bqkq0wn20cc3qrcd1ifq74p4m570j345bkq4axl08kbr8whfba7";
+  };
+
+  propagatedBuildInputs = [ baron ];
+
+  preCheck = ''
+    rm -rf tests/__pycache__
+    rm tests/test_bounding_box.py
+  ''; #error about fixtures
+
+  checkInputs = [ pytestCheckHook ];
+
+  meta = with lib; {
+    homepage = "https://github.com/gristlabs/asttokens";
+    description = "Abstraction on top of baron, a FST for python to make writing refactoring code a realistic task";
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ marius851000 ];
+  };
+}
diff --git a/pkgs/development/python-modules/scrapy-fake-useragent/default.nix b/pkgs/development/python-modules/scrapy-fake-useragent/default.nix
index a9199614f46..b2de4e9a993 100644
--- a/pkgs/development/python-modules/scrapy-fake-useragent/default.nix
+++ b/pkgs/development/python-modules/scrapy-fake-useragent/default.nix
@@ -19,6 +19,6 @@ buildPythonPackage rec {
   meta = with stdenv.lib; {
     description = "Random User-Agent middleware based on fake-useragent";
     homepage = "https://github.com/alecxe/scrapy-fake-useragent";
-    license = licenses.bsd3;
+    license = licenses.mit;
   };
 }
diff --git a/pkgs/development/python-modules/yamale/default.nix b/pkgs/development/python-modules/yamale/default.nix
new file mode 100644
index 00000000000..d6fb713185d
--- /dev/null
+++ b/pkgs/development/python-modules/yamale/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, isPy3k
+, pytest
+, pyyaml
+, ruamel_yaml
+}:
+
+buildPythonPackage rec {
+  pname = "yamale";
+  version = "3.0.4";
+
+  disabled = !isPy3k;
+
+  src = fetchFromGitHub {
+    owner = "23andMe";
+    repo = pname;
+    rev = version;
+    sha256 = "1xjvah4r3gpwk4zxql3c9jpllb34k175fm6iq1zvsd2vv2fwf8s2";
+  };
+
+  propagatedBuildInputs = [
+    pyyaml
+    ruamel_yaml
+  ];
+
+  checkInputs = [
+    pytest
+  ];
+
+  meta = with lib; {
+    description = "A schema and validator for YAML.";
+    homepage = "https://github.com/23andMe/Yamale";
+    license = licenses.mit;
+    maintainers = with maintainers; [ rtburns-jpl ];
+  };
+}
diff --git a/pkgs/development/tools/bazelisk/default.nix b/pkgs/development/tools/bazelisk/default.nix
index 26a0dd86670..eba096644a1 100644
--- a/pkgs/development/tools/bazelisk/default.nix
+++ b/pkgs/development/tools/bazelisk/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "bazelisk";
-  version = "1.7.2";
+  version = "1.7.3";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0psqhv2cm2xwjyivaza2s6x780q6yjn1nsjdy538zjky22dazqq4";
+    sha256 = "0l4y8z44hwd6rnhnyk6l9abrvk342w72bah9k9zz6caa5i4xz2vz";
   };
 
   vendorSha256 = "116wy1a7gmi2w8why9hszhcybfvpwp4iq62vshb25cdcma6q4mjh";
diff --git a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
index b59a4561728..3547da41f07 100644
--- a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
@@ -1,16 +1,16 @@
 { lib, buildGoPackage, fetchFromGitLab, fetchurl }:
 
 let
-  version = "13.4.1";
+  version = "13.5.0";
   # Gitlab runner embeds some docker images these are prebuilt for arm and x86_64
   docker_x86_64 = fetchurl {
     url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/helper-images/prebuilt-x86_64.tar.xz";
-    sha256 = "0yc4yfqhh51p0nz0sl2qfp48n431qgp23wn3aqq3jg4fh9578prb";
+    sha256 = "1cahv98hhwcc0czg7c86sqk0r6kw3gxnx8j6mqp1zm19aa30sabk";
   };
 
   docker_arm = fetchurl {
     url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/helper-images/prebuilt-arm.tar.xz";
-    sha256 = "1n50izz21dmd14qm6y9fsgwf5f0r9829dv79mvlqxmh1q87acm93";
+    sha256 = "1wk7xn8jap8699cpgqkpgxmd908qjxlsfjswknrha1n8y2c5bjgx";
   };
 in
 buildGoPackage rec {
@@ -30,7 +30,7 @@ buildGoPackage rec {
     owner = "gitlab-org";
     repo = "gitlab-runner";
     rev = "v${version}";
-    sha256 = "10k3xn3fapwx52s3r3pk972k1s7793cgja7g1fvm06pic8l7q05g";
+    sha256 = "0qfzdbhj68lq5pa1hvb703yx9grh3hvnnw6jb4bj4fckncd3avgm";
   };
 
   patches = [ ./fix-shell-path.patch ];
diff --git a/pkgs/development/tools/coursier/default.nix b/pkgs/development/tools/coursier/default.nix
index b3ae0328c4e..2488f79e037 100644
--- a/pkgs/development/tools/coursier/default.nix
+++ b/pkgs/development/tools/coursier/default.nix
@@ -3,16 +3,16 @@
 let
   zshCompletion = version: fetchurl {
     url = "https://raw.githubusercontent.com/coursier/coursier/v${version}/modules/cli/src/main/resources/completions/zsh";
-    sha256 = "1mn6cdmf59nkz5012wgd3gd6hpk2w4629sk8z95230ky8487dac3";
+    sha256 = "0afxzrk9w1qinfsz55jjrxydw0fcv6p722g1q955dl7f6xbab1jh";
   };
 in
 stdenv.mkDerivation rec {
   pname = "coursier";
-  version = "2.0.3";
+  version = "2.0.4";
 
   src = fetchurl {
     url = "https://github.com/coursier/coursier/releases/download/v${version}/coursier";
-    sha256 = "0jvccyiqrq1iws2q9m3vivzw08jl0p77n9qbf22hgb3zhspfdnyx";
+    sha256 = "04ajy2al9r2jyw681cwswy545ipxf747a6jyw4xmykadj0zlzkwz";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/misc/editorconfig-checker/default.nix b/pkgs/development/tools/misc/editorconfig-checker/default.nix
index 3975ad3511f..741854a507d 100644
--- a/pkgs/development/tools/misc/editorconfig-checker/default.nix
+++ b/pkgs/development/tools/misc/editorconfig-checker/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "editorconfig-checker";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "editorconfig-checker";
     repo = "editorconfig-checker";
     rev = "${version}";
-    sha256 = "09v8gqwcaay3bqbidparmg20dy0mvlrzh34591hanbrx3cwhrz3f";
+    sha256 = "18gz94h2x1z6g6r7v9cdixkbcaigd7cl08af6smlkaa89j0aki32";
   };
 
-  vendorSha256 = "132blcdw3lywxhqslkcpwwvkzl4cpbbkhb7ba8mrvfgl5kvfm1q0";
+  vendorSha256 = "1z4j8vm9mnhjhhmhlj0ycs8b1wpm7lhsfqjnk7w8gfapvj3yfk6h";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/misc/hydra/common.nix b/pkgs/development/tools/misc/hydra/common.nix
index 4e9daab9bf1..4af9fe04587 100644
--- a/pkgs/development/tools/misc/hydra/common.nix
+++ b/pkgs/development/tools/misc/hydra/common.nix
@@ -66,6 +66,7 @@ let
         TextDiff
         TextTable
         XMLSimple
+        YAML
         nix
         nix.perl-bindings
         git
diff --git a/pkgs/development/tools/misc/hydra/default.nix b/pkgs/development/tools/misc/hydra/default.nix
index a6b0383d54f..7aa1e05a88e 100644
--- a/pkgs/development/tools/misc/hydra/default.nix
+++ b/pkgs/development/tools/misc/hydra/default.nix
@@ -1,40 +1,17 @@
 { fetchFromGitHub, nixStable, callPackage, nixFlakes, nixosTests }:
 
 {
-  # Package for phase-1 of the db migration for Hydra.
-  # https://github.com/NixOS/hydra/pull/711
-  hydra-migration = callPackage ./common.nix {
-    version = "2020-02-10";
-    src = fetchFromGitHub {
-      owner = "NixOS";
-      repo = "hydra";
-      rev = "add4f610ce6f206fb44702b5a894d877b3a30e3a";
-      sha256 = "1d8hdgjx2ys0zmixi2ydmimdq7ml20h1ji4amwawcyw59kssh6l3";
-    };
-    nix = nixStable;
-    migration = true;
-
-    tests = {
-      db-migration = nixosTests.hydra-db-migration.mig;
-      basic = nixosTests.hydra.hydra-migration;
-    };
-  };
-
-  # Hydra from latest master branch. Contains breaking changes,
-  # so when having an older version, `pkgs.hydra-migration` should be deployed first.
-
   hydra-unstable = callPackage ./common.nix {
-    version = "2020-09-02";
+    version = "2020-10-20";
     src = fetchFromGitHub {
       owner = "NixOS";
       repo = "hydra";
-      rev = "e707990e2d6afab203c7ef1d769d49c564eff151";
-      sha256 = "0iilf953f6s58szzyd1hzc9b2b2yw8lhbsb8xrb08szpfz7ifwqa";
+      rev = "79d34ed7c93af2daf32cf44ee0e3e0768f13f97c";
+      sha256 = "1lql899430137l6ghnhyz0ivkayy83fdr087ck2wq3gf1jv8pccj";
     };
     nix = nixFlakes;
 
     tests = {
-      db-migration = nixosTests.hydra-db-migration.mig;
       basic = nixosTests.hydra.hydra-unstable;
     };
   };
diff --git a/pkgs/development/tools/rust/cargo-bloat/default.nix b/pkgs/development/tools/rust/cargo-bloat/default.nix
index 8374e065356..51d19f5ad6f 100644
--- a/pkgs/development/tools/rust/cargo-bloat/default.nix
+++ b/pkgs/development/tools/rust/cargo-bloat/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-bloat";
-  version = "0.9.3";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "RazrFalcon";
     repo = pname;
     rev = "v${version}";
-    sha256 = "04h9yyna47cgn2d232v2fpbgki9gg4lykpmx46ncpsq4g6azl1a9";
+    sha256 = "0bqzzh8vfqm7dpnb0fv4calnhsg9p3c5j06ycvg621p4zp4fydh2";
   };
 
-  cargoSha256 = "0lzc2nwz9lpwxv704k40d1416qnf3wy3g6ad8w8xbkfc6ydcaa4l";
+  cargoSha256 = "1323lcl8fa21pgx3jhwl4w9f8qz3jjxb5qdvib9jdzqxnnw320xs";
 
   meta = with lib; {
     description = "A tool and Cargo subcommand that helps you find out what takes most of the space in your executable";
diff --git a/pkgs/development/tools/rust/cbindgen/default.nix b/pkgs/development/tools/rust/cbindgen/default.nix
index 62b9a616644..dc04f4cb112 100644
--- a/pkgs/development/tools/rust/cbindgen/default.nix
+++ b/pkgs/development/tools/rust/cbindgen/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-cbindgen";
-  version = "0.14.4";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "eqrion";
     repo = "cbindgen";
     rev = "v${version}";
-    sha256 = "06bis9kk3r0gishzmsq5wk3vv8r78ggk4m800562q2yhnhc37lfd";
+    sha256 = "19bwllrajks286wl4zc5axgh4m9qqxdnc5024c30hyk0xnjffd0c";
   };
 
-  cargoSha256 = "0x8lxlik4n8rmlydcp0vqyiqwqm98cgwvw3h5hm2zviv8v0y8jnr";
+  cargoSha256 = "1lzzckzcgj496chbfd6lhwxcangv0krx8m5k2jwffnb9mfgac7hx";
 
   buildInputs = stdenv.lib.optional stdenv.isDarwin Security;
 
diff --git a/pkgs/development/web/nodejs/v15.nix b/pkgs/development/web/nodejs/v15.nix
new file mode 100644
index 00000000000..f115e42d0d0
--- /dev/null
+++ b/pkgs/development/web/nodejs/v15.nix
@@ -0,0 +1,13 @@
+{ callPackage, openssl, python3, enableNpm ? true }:
+
+let
+  buildNodejs = callPackage ./nodejs.nix {
+    inherit openssl;
+    python = python3;
+  };
+in
+  buildNodejs {
+    inherit enableNpm;
+    version = "15.0.1";
+    sha256 = "03xxnl7q96fmm7lalliwb9kmllz52jqrcsqn9cx9pzhwd1x97l5q";
+  }
diff --git a/pkgs/games/enyo-doom/default.nix b/pkgs/games/enyo-doom/default.nix
index ba07b50a1e7..0158dc2b531 100644
--- a/pkgs/games/enyo-doom/default.nix
+++ b/pkgs/games/enyo-doom/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "enyo-doom";
-  version = "1.06.9";
+  version = "2.0.2";
 
   src = fetchFromGitLab {
     owner = "sdcofer70";
     repo = "enyo-doom";
     rev = version;
-    sha256 = "0vx5zy47cqrqdgyx31wg56ivva0qqiyww8bp1x32ax99danymjyf";
+    sha256 = "1s1vpwrrpb9c7r2b0k1j7dlsfasfzmi6prcwql4mxwixrl7f8ms1";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/games/minecraft/default.nix b/pkgs/games/minecraft/default.nix
index 9bdf979d7dd..8052b11fb6f 100644
--- a/pkgs/games/minecraft/default.nix
+++ b/pkgs/games/minecraft/default.nix
@@ -86,11 +86,11 @@ in
 stdenv.mkDerivation rec {
   pname = "minecraft-launcher";
 
-  version = "2.1.17627";
+  version = "2.1.17785";
 
   src = fetchurl {
     url = "https://launcher.mojang.com/download/linux/x86_64/minecraft-launcher_${version}.tar.gz";
-    sha256 = "04zjjyy0psfxfibzbac9w0kkgqwfpf1qmbj5gspyvhaib7k8may0";
+    sha256 = "1r70myf6hqcnkd6v2m2r8cpj060vsjdyp4rfw6d93vwsyqi90jkc";
   };
 
   icon = fetchurl {
diff --git a/pkgs/games/portmod/default.nix b/pkgs/games/portmod/default.nix
new file mode 100644
index 00000000000..07451b8dc2a
--- /dev/null
+++ b/pkgs/games/portmod/default.nix
@@ -0,0 +1,98 @@
+{ lib, stdenv, callPackage, python3Packages, fetchFromGitLab, cacert,
+  rustPlatform, bubblewrap, git, perlPackages, imagemagick7, fetchurl, fetchzip,
+  jre, makeWrapper, tr-patcher, tes3cmd }:
+
+let
+  version = "2.0_beta9";
+
+  src = fetchFromGitLab {
+    owner = "portmod";
+    repo = "Portmod";
+    rev = "v${version}";
+    sha256 = "0a598rb0z6gsdyr4n0lc0yc583njjii07p6vxw75xsh7292vxksc";
+  };
+
+  portmod-rust = rustPlatform.buildRustPackage rec {
+    inherit src version;
+    pname = "portmod-rust";
+
+    cargoSha256 = "14p1aywwbkf2pk85sir5g9ni08zam2hid0kaz111718b006nrxh7";
+
+    nativeBuildInputs = [ python3Packages.python ];
+
+    doCheck = false;
+  };
+
+  bin-programs = [
+    bubblewrap
+    git
+    python3Packages.virtualenv
+    tr-patcher
+    tes3cmd
+    imagemagick7
+  ];
+
+in
+python3Packages.buildPythonApplication rec {
+  inherit src version;
+
+  pname = "portmod";
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  # build the rust library independantly
+  prePatch = ''
+    substituteInPlace setup.py \
+      --replace "from setuptools_rust import Binding, RustExtension" "" \
+      --replace "RustExtension(\"portmod.portmod\", binding=Binding.PyO3, strip=True)" ""
+  '';
+
+  propagatedBuildInputs = with python3Packages; [
+    setuptools_scm
+    setuptools
+    requests
+    chardet
+    colorama
+    restrictedpython
+    appdirs
+    GitPython
+    progressbar2
+    python-sat
+    redbaron
+    patool
+    packaging
+  ];
+
+  checkInputs = with python3Packages; [
+    pytestCheckHook
+  ] ++ bin-programs;
+
+  preCheck = ''
+    cp ${portmod-rust}/lib/libportmod.so portmod/portmod.so
+    export HOME=$(mktemp -d)
+  '';
+
+  # some test require network access
+  disabledTests = [
+    "test_masters_esp"
+    "test_logging"
+    "test_execute_network_permissions"
+    "test_execute_permissions_bleed"
+    "test_git"
+  ];
+
+  # for some reason, installPhase doesn't copy the compiled binary
+  postInstall = ''
+    cp ${portmod-rust}/lib/libportmod.so $out/${python3Packages.python.sitePackages}/portmod/portmod.so
+
+    makeWrapperArgs+=("--prefix" "GIT_SSL_CAINFO" ":" "${cacert}/etc/ssl/certs/ca-bundle.crt" \
+      "--prefix" "PATH" ":" "${lib.makeBinPath bin-programs }")
+  '';
+
+  meta = {
+    description = "mod manager for openMW based on portage";
+    homepage = "https://gitlab.com/portmod/portmod";
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ marius851000 ];
+  };
+}
diff --git a/pkgs/games/tes3cmd/default.nix b/pkgs/games/tes3cmd/default.nix
new file mode 100644
index 00000000000..b71f9930cad
--- /dev/null
+++ b/pkgs/games/tes3cmd/default.nix
@@ -0,0 +1,28 @@
+{ stdenv, lib, perlPackages, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "tes3cmd";
+  version = "0.40-pre-release-2";
+
+  src = fetchFromGitHub {
+    owner = "john-moonsugar";
+    repo = pname;
+    rev = "f72e9ed9dd18e8545dd0dc2a4056c250cf505790";
+    sha256 = "01zqplp8yb0xnl54963n0zkz66rf3hn2x3i255jlhdhx1c43jba7";
+  };
+
+  buildInputs = [ perlPackages.perl ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp tes3cmd $out/bin/tes3cmd
+  '';
+
+  meta = with lib; {
+    description = "A command line tool for examining and modifying plugins for the Elder Scrolls game Morrowind by Bethesda Softworks.";
+    homepage = "https://github.com/john-moonsugar/tes3cmd";
+    license = licenses.mit;
+    maintainers = [ maintainers.marius851000 ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/games/tr-patcher/default.nix b/pkgs/games/tr-patcher/default.nix
new file mode 100644
index 00000000000..68e3eb60895
--- /dev/null
+++ b/pkgs/games/tr-patcher/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, lib, fetchurl, fetchzip, jre, makeWrapper }:
+
+let
+translation-file = fetchurl {
+  url = "https://gitlab.com/bmwinger/tr-patcher/-/raw/master/lib/Translation.txt?inline=false";
+  sha256 = "136zd2s73b4n1w2n34wxi656bm448748nn3y7a64fd89ysg9n7n8";
+};
+in
+stdenv.mkDerivation rec {
+  pname = "tr-patcher";
+  version = "1.0.5";
+
+  # use the pre compiled source, as compilation is a bit complex
+  src = fetchzip {
+    url = "https://gitlab.com/bmwinger/tr-patcher/uploads/b57899980b2351c136393f02977c4fab/tr-patcher-shadow.zip";
+    sha256 = "0va7nbmlgf3p2nc0z2b9n1285y4q5rpyjr4w93rdnx38wrhinxnw";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    install -Dm644 lib/tr-patcher-all.jar $out/lib/tr-patcher.jar
+    install -Dm644 ${translation-file} $out/lib/Translation.txt
+    mkdir -p $out/bin
+    makeWrapper ${jre}/bin/java $out/bin/tr-patcher \
+    --add-flags "-jar $out/lib/tr-patcher.jar"
+  '';
+
+  meta = with lib; {
+    description = "Allow to update dependancies of the Tamriel-Data mod for morrowind";
+    homepage = "https://gitlab.com/bmwinger/tr-patcher";
+    license = licenses.gpl3;
+    maintainers = [ maintainers.marius851000 ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/misc/emulators/dolphin-emu/master.nix b/pkgs/misc/emulators/dolphin-emu/master.nix
index 3865a4a7060..8ef7b610a25 100644
--- a/pkgs/misc/emulators/dolphin-emu/master.nix
+++ b/pkgs/misc/emulators/dolphin-emu/master.nix
@@ -21,13 +21,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "dolphin-emu";
-  version = "5.0-11824";
+  version = "5.0-12716";
 
   src = fetchFromGitHub {
     owner = "dolphin-emu";
     repo = "dolphin";
-    rev = "1b97f081b8eff9012132a4124537968bdb0e03e0";
-    sha256 = "1v96hcn34040vjsw83k8p0r0nb8rrdcz80h4ngirxzm36b3l7w6m";
+    rev = "31524288e3b2450eaefff8202c6d26c4ba3f7333";
+    sha256 = "0vv3ahk6zdx2hx5diq4jkhl289wjybqcr4lwinrkfiywb83hcabg";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/misc/jackaudio/default.nix b/pkgs/misc/jackaudio/default.nix
index d5007560762..556bb6a7408 100644
--- a/pkgs/misc/jackaudio/default.nix
+++ b/pkgs/misc/jackaudio/default.nix
@@ -27,13 +27,13 @@ let
 in
 stdenv.mkDerivation rec {
   name = "${prefix}jack2-${version}";
-  version = "1.9.14";
+  version = "1.9.16";
 
   src = fetchFromGitHub {
     owner = "jackaudio";
     repo = "jack2";
     rev = "v${version}";
-    sha256 = "1prxg1l8wrxfp2mh7l4mvjvmml6816fciq1la88ylhwm1qnfvnax";
+    sha256 = "0pzgrjy5fi2nif2j442fs3j2bbshxpnmq9kzwcqz54wx1w8fzdfr";
   };
 
   nativeBuildInputs = [ pkgconfig python makeWrapper wafHook ];
diff --git a/pkgs/os-specific/linux/iputils/default.nix b/pkgs/os-specific/linux/iputils/default.nix
index e12c44888a0..3bb653ebcf7 100644
--- a/pkgs/os-specific/linux/iputils/default.nix
+++ b/pkgs/os-specific/linux/iputils/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, fetchFromGitHub
+{ stdenv, fetchFromGitHub, fetchpatch
 , meson, ninja, pkgconfig, gettext, libxslt, docbook_xsl_ns
-, libcap, systemd, libidn2
+, libcap, libidn2
 }:
 
 with stdenv.lib;
@@ -22,18 +22,27 @@ in stdenv.mkDerivation rec {
     sha256 = "1jhbcz75a4ij1myyyi110ma1d8d5hpm3scz9pyw7js6qym50xvh4";
   };
 
+  patches = [
+    # Proposed upstream patch to reduce dependency on systemd: https://github.com/iputils/iputils/pull/297
+    (fetchpatch {
+      url = "https://github.com/iputils/iputils/commit/13d6aefd57fd471ecad06e19073dcc44608dff5e.patch";
+      sha256 = "1n62zxmzp7hgz9qapbbpqv3fxqvc3qyd2a73jhp357x6by84kj49";
+    })
+  ];
+
   mesonFlags = [
     "-DBUILD_RARPD=true"
     "-DBUILD_TRACEROUTE6=true"
     "-DBUILD_TFTPD=true"
     "-DNO_SETCAP_OR_SUID=true"
     "-Dsystemdunitdir=etc/systemd/system"
+    "-DINSTALL_SYSTEMD_UNITS=true"
   ]
     # Disable idn usage w/musl (https://github.com/iputils/iputils/pull/111):
     ++ optional stdenv.hostPlatform.isMusl "-DUSE_IDN=false";
 
   nativeBuildInputs = [ meson ninja pkgconfig gettext libxslt.bin docbook_xsl_ns ];
-  buildInputs = [ libcap systemd ]
+  buildInputs = [ libcap ]
     ++ optional (!stdenv.hostPlatform.isMusl) libidn2;
 
   meta = {
diff --git a/pkgs/os-specific/linux/nvme-cli/default.nix b/pkgs/os-specific/linux/nvme-cli/default.nix
index 80a00082b81..b848a868274 100644
--- a/pkgs/os-specific/linux/nvme-cli/default.nix
+++ b/pkgs/os-specific/linux/nvme-cli/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nvme-cli";
-  version = "1.12";
+  version = "1.13";
 
   src = fetchFromGitHub {
     owner = "linux-nvme";
     repo = "nvme-cli";
     rev = "v${version}";
-    sha256 = "0ldky34sn0m5c4hgiip0fkzm465nca69bhxicpd5dg8wxhzxqrp3";
+    sha256 = "1d538kp841bjh8h8d9q7inqz56rdcwb3m78zfx8607ddykv7wcqb";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/servers/atlassian/jira.nix b/pkgs/servers/atlassian/jira.nix
index ab3746e6e0a..d3c7fb96553 100644
--- a/pkgs/servers/atlassian/jira.nix
+++ b/pkgs/servers/atlassian/jira.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "atlassian-jira";
-  version = "8.12.0";
+  version = "8.13.0";
 
   src = fetchurl {
     url = "https://product-downloads.atlassian.com/software/jira/downloads/atlassian-jira-software-${version}.tar.gz";
-    sha256 = "149yqj60b35mbvjz7jyh5a3ayh61kvwrz452s0zyb1q3pirj10xq";
+    sha256 = "06jq6x24kxwzkwjx05d4q6jyvjpbzqpjlj8arycw8z0w97k83hh9";
   };
 
   buildPhase = ''
diff --git a/pkgs/servers/mail/rspamd/default.nix b/pkgs/servers/mail/rspamd/default.nix
index 7f54b97a8e8..995dbf2e16d 100644
--- a/pkgs/servers/mail/rspamd/default.nix
+++ b/pkgs/servers/mail/rspamd/default.nix
@@ -4,19 +4,20 @@
 , withBlas ? true
 , withHyperscan ? stdenv.isx86_64
 , withLuaJIT ? stdenv.isx86_64
+, nixosTests
 }:
 
 assert withHyperscan -> stdenv.isx86_64;
 
 stdenv.mkDerivation rec {
   pname = "rspamd";
-  version = "2.5";
+  version = "2.6";
 
   src = fetchFromGitHub {
     owner = "rspamd";
     repo = "rspamd";
     rev = version;
-    sha256 = "01fhh07dddc6v7a5kq6h1z221vl0d4af43cchqkf54ycyxxxw06h";
+    sha256 = "0vwa7k2s2bkfb8w78z5izkd6ywjbzqysb0grls898y549hm8ii70";
   };
 
   nativeBuildInputs = [ cmake pkgconfig perl ];
@@ -34,6 +35,8 @@ stdenv.mkDerivation rec {
     "-DENABLE_JEMALLOC=ON"
   ] ++ lib.optional withHyperscan "-DENABLE_HYPERSCAN=ON";
 
+  passthru.tests.rspamd = nixosTests.rspamd;
+
   meta = with stdenv.lib; {
     homepage = "https://rspamd.com";
     license = licenses.asl20;
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index 48d58163e48..c29c6cdf08f 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "grafana";
-  version = "7.2.1";
+  version = "7.2.2";
 
   excludedPackages = [ "release_publisher" ];
 
@@ -10,15 +10,15 @@ buildGoModule rec {
     rev = "v${version}";
     owner = "grafana";
     repo = "grafana";
-    sha256 = "0hf5i7190qvcypr1x8j516k2q90n2fhxvaf84m5axzmyb4i4ym0r";
+    sha256 = "14i1h0v6bwb3y1xqs71dabriyd7gdgihb8wkf3gpjr4gnsywvsgm";
   };
 
   srcStatic = fetchurl {
     url = "https://dl.grafana.com/oss/release/grafana-${version}.linux-amd64.tar.gz";
-    sha256 = "15kys49c4kwzh73ar54v9q3277m4vql2pi8y3pji6jq9gpw0piwr";
+    sha256 = "03jf5wnf89a3fawdayl5x5rfyc3dsf9wm5dm1ldz9fqk31biq8ky";
   };
 
-  vendorSha256 = "1b33kibvfa1qgalqb9ngxqimcn92cy8sllsc81wc9gmz4giz9mn1";
+  vendorSha256 = "03zvhznzdbi61kd0y0ldhx2n9zh3pwg1ias1shqgqyx46c9ysdzm";
 
   postPatch = ''
     substituteInPlace pkg/cmd/grafana-server/main.go \
diff --git a/pkgs/servers/mpd/default.nix b/pkgs/servers/mpd/default.nix
index ab93f3d6e10..f7cc688dc56 100644
--- a/pkgs/servers/mpd/default.nix
+++ b/pkgs/servers/mpd/default.nix
@@ -155,7 +155,8 @@ let
 
       mesonAutoFeatures = "disabled";
 
-      outputs = [ "out" "doc" "man" ];
+      outputs = [ "out" "doc" ]
+        ++ lib.optional (builtins.elem "documentation" features_) "man";
 
       mesonFlags = [
         "-Dtest=true"
diff --git a/pkgs/shells/nushell/default.nix b/pkgs/shells/nushell/default.nix
index c3e6c5b6753..d025ed1ddcd 100644
--- a/pkgs/shells/nushell/default.nix
+++ b/pkgs/shells/nushell/default.nix
@@ -36,11 +36,6 @@ rustPlatform.buildRustPackage rec {
 
   cargoBuildFlags = lib.optional withStableFeatures "--features stable";
 
-  # Remove after https://github.com/NixOS/nixpkgs/pull/97000 lands into master
-  preConfigure = stdenv.lib.optionalString stdenv.isDarwin ''
-    unset SDKROOT
-  '';
-
   checkPhase = ''
     runHook preCheck
     echo "Running cargo test"
diff --git a/pkgs/shells/zsh/zsh-powerlevel10k/default.nix b/pkgs/shells/zsh/zsh-powerlevel10k/default.nix
index 5d81ceaba1b..39cb1f247fc 100644
--- a/pkgs/shells/zsh/zsh-powerlevel10k/default.nix
+++ b/pkgs/shells/zsh/zsh-powerlevel10k/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "powerlevel10k";
-  version = "1.12.0";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     owner = "romkatv";
     repo = "powerlevel10k";
     rev = "v${version}";
-    sha256 = "08zg4in70h3kray6lazszzy26gvil9w2cr6xmkbgjsv3k6w3k0jg";
+    sha256 = "0w5rv7z47nys3x113mdddpb2pf1d9pmz9myh4xjzrcy4hp4qv421";
   };
 
   patches = [
diff --git a/pkgs/tools/admin/google-cloud-sdk/default.nix b/pkgs/tools/admin/google-cloud-sdk/default.nix
index e13cb0842de..53cbaf1229a 100644
--- a/pkgs/tools/admin/google-cloud-sdk/default.nix
+++ b/pkgs/tools/admin/google-cloud-sdk/default.nix
@@ -21,18 +21,18 @@ let
   sources = name: system: {
     x86_64-darwin = {
       url = "${baseUrl}/${name}-darwin-x86_64.tar.gz";
-      sha256 = "0pvw0mbrx2i3v46lhjnka962gcl4ym0b9hp0xw56hpdd2abc58f6";
+      sha256 = "1lkmilj873ia8kigyfmqfjnlpi7jzq3q4m0ip3lr0a111nr3wi4m";
     };
 
     x86_64-linux = {
       url = "${baseUrl}/${name}-linux-x86_64.tar.gz";
-      sha256 = "0p5vbg5s3xsi3y7x4s3v3mxcw87x349h6bz6w7xgc141l4g08vh3";
+      sha256 = "0q20vaqr9rrzcp57jrskcmbdvqrfpr4lscki85824fdlpklc00ga";
     };
   }.${system};
 
 in stdenv.mkDerivation rec {
   pname = "google-cloud-sdk";
-  version = "314.0.0";
+  version = "315.0.0";
 
   src = fetchurl (sources "${pname}-${version}" stdenv.hostPlatform.system);
 
diff --git a/pkgs/tools/backup/bup/default.nix b/pkgs/tools/backup/bup/default.nix
index ee6ae0a2934..0765d8a08cd 100644
--- a/pkgs/tools/backup/bup/default.nix
+++ b/pkgs/tools/backup/bup/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, makeWrapper
-, perl, pandoc, python2Packages, git
+, perl, pandoc, python3Packages, git
 , par2cmdline ? null, par2Support ? true
 }:
 
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
 
   buildInputs = [
     git
-    (python2Packages.python.withPackages
+    (python3Packages.python.withPackages
       (p: with p; [ setuptools tornado ]
         ++ stdenv.lib.optionals (!stdenv.isDarwin) [ pyxattr pylibacl fuse ]))
   ];
diff --git a/pkgs/tools/backup/kopia/default.nix b/pkgs/tools/backup/kopia/default.nix
index 056f523a2ca..47d9dc1b378 100644
--- a/pkgs/tools/backup/kopia/default.nix
+++ b/pkgs/tools/backup/kopia/default.nix
@@ -27,6 +27,7 @@ buildGoModule rec {
     # make 'vendor' writable
     cp -L -r vendor tmp-vendor
     rm -rf vendor
+    chmod -R u+w tmp-vendor
     mv tmp-vendor vendor
 
     # speakeasy hardcodes /bin/stty https://github.com/bgentry/speakeasy/issues/22
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-hangul/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-hangul/default.nix
index 978ac675581..f6ceece34e1 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-hangul/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-hangul/default.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ibus-hangul";
-  version = "1.5.3";
+  version = "1.5.4";
 
   src = fetchurl {
     url = "https://github.com/choehwanjin/ibus-hangul/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "1400ba2p34vr9q285lqvjm73f6m677cgfdymmjpiwyrjgbbiqrjy";
+    sha256 = "1q6g2pnrn5gqn9jqnm3975v9hh60hc5gn9x3zbrdjgy0n3wpxwm9";
   };
 
   patches = [
diff --git a/pkgs/tools/misc/bandwidth/default.nix b/pkgs/tools/misc/bandwidth/default.nix
index 5de77aea0e0..8cd926c5c27 100644
--- a/pkgs/tools/misc/bandwidth/default.nix
+++ b/pkgs/tools/misc/bandwidth/default.nix
@@ -11,11 +11,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "bandwidth";
-  version = "1.9.3";
+  version = "1.9.4";
 
   src = fetchurl {
     url = "https://zsmith.co/archives/${pname}-${version}.tar.gz";
-    sha256 = "0zpv2qgkbak0llw47qcakhyh2z3zv4d69kasldmpdlpqryd9za84";
+    sha256 = "0x798xj3vhiwq2hal0vmf92sq4h7yalp3i6ylqwhnnpv99m2zws4";
   };
 
   buildInputs = [ nasm ];
diff --git a/pkgs/tools/misc/bat/default.nix b/pkgs/tools/misc/bat/default.nix
index e5b06521d72..b84ef63edc9 100644
--- a/pkgs/tools/misc/bat/default.nix
+++ b/pkgs/tools/misc/bat/default.nix
@@ -26,11 +26,6 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security libiconv ];
 
-  # Remove after https://github.com/NixOS/nixpkgs/pull/97000 lands into master
-  preConfigure = stdenv.lib.optionalString stdenv.isDarwin ''
-    unset SDKROOT
-  '';
-
   postInstall = ''
     installManPage $releaseDir/build/bat-*/out/assets/manual/bat.1
     installShellCompletion $releaseDir/build/bat-*/out/assets/completions/bat.{fish,zsh}
diff --git a/pkgs/tools/misc/bdf2psf/default.nix b/pkgs/tools/misc/bdf2psf/default.nix
index 966e71bb6d3..2b3445ac6c3 100644
--- a/pkgs/tools/misc/bdf2psf/default.nix
+++ b/pkgs/tools/misc/bdf2psf/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bdf2psf";
-  version = "1.196";
+  version = "1.197";
 
   src = fetchurl {
     url = "mirror://debian/pool/main/c/console-setup/bdf2psf_${version}_all.deb";
-    sha256 = "042ly91525q2qj7985qih4njhjk5ndz8jiz01v860jc38bvw595p";
+    sha256 = "023zj08rk8pmvpr8zybxn2ibrl5qsarkn8rb908mxhhlwpp12f7n";
   };
 
   nativeBuildInputs = [ dpkg ];
diff --git a/pkgs/tools/misc/broot/default.nix b/pkgs/tools/misc/broot/default.nix
index fb0868016d7..3027537dd87 100644
--- a/pkgs/tools/misc/broot/default.nix
+++ b/pkgs/tools/misc/broot/default.nix
@@ -5,7 +5,6 @@
 , makeWrapper
 , coreutils
 , libiconv
-, xcbuild
 , zlib
 , Security
 }:
@@ -24,7 +23,6 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [
     makeWrapper
     installShellFiles
-    xcbuild # The cc crate attempts to run xcbuild.
   ];
 
   buildInputs = stdenv.lib.optionals stdenv.isDarwin [
diff --git a/pkgs/tools/misc/lsd/default.nix b/pkgs/tools/misc/lsd/default.nix
index db8c40b6ffe..e38da518094 100644
--- a/pkgs/tools/misc/lsd/default.nix
+++ b/pkgs/tools/misc/lsd/default.nix
@@ -22,6 +22,10 @@ rustPlatform.buildRustPackage rec {
     installShellCompletion $releaseDir/build/lsd-*/out/{_lsd,lsd.{bash,fish}}
   '';
 
+  checkFlags = stdenv.lib.optionals stdenv.isDarwin [
+    "--skip meta::filetype::test::test_socket_type"
+  ];
+
   meta = with stdenv.lib; {
     homepage = "https://github.com/Peltoche/lsd";
     description = "The next gen ls command";
diff --git a/pkgs/tools/misc/miniserve/default.nix b/pkgs/tools/misc/miniserve/default.nix
index 71d20c015d0..a0fe350a273 100644
--- a/pkgs/tools/misc/miniserve/default.nix
+++ b/pkgs/tools/misc/miniserve/default.nix
@@ -24,11 +24,6 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [ pkg-config zlib ];
   buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
 
-  # Remove after https://github.com/NixOS/nixpkgs/pull/97000 lands into master
-  preConfigure = stdenv.lib.optionalString stdenv.isDarwin ''
-    unset SDKROOT
-  '';
-
   meta = with stdenv.lib; {
     description = "For when you really just want to serve some files over HTTP right now!";
     homepage = "https://github.com/svenstaro/miniserve";
diff --git a/pkgs/tools/misc/rpcsvc-proto/default.nix b/pkgs/tools/misc/rpcsvc-proto/default.nix
index 6406b6b20e2..12885172080 100644
--- a/pkgs/tools/misc/rpcsvc-proto/default.nix
+++ b/pkgs/tools/misc/rpcsvc-proto/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, autoreconfHook }:
+{ stdenv, lib, fetchFromGitHub, autoreconfHook, buildPackages }:
 
 stdenv.mkDerivation rec {
   pname = "rpcsvc-proto";
@@ -13,8 +13,14 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "man" ];
 
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ autoreconfHook ];
 
+  postPatch = lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+    substituteInPlace rpcsvc/Makefile.am \
+      --replace '$(top_builddir)/rpcgen/rpcgen' '${buildPackages.rpcsvc-proto}/bin/rpcgen'
+  '';
+
   meta = with stdenv.lib; {
     homepage = "https://github.com/thkukuk/rpcsvc-proto";
     description = "This package contains rpcsvc proto.x files from glibc, which are missing in libtirpc";
diff --git a/pkgs/tools/misc/vivid/default.nix b/pkgs/tools/misc/vivid/default.nix
index 70746287986..35a1d5d2d12 100644
--- a/pkgs/tools/misc/vivid/default.nix
+++ b/pkgs/tools/misc/vivid/default.nix
@@ -13,11 +13,6 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "10xddr5cccc5cmhn4kwi27h3krmgapd7bqcp4rhjlbhdhsw7qxkx";
 
-  # Remove after https://github.com/NixOS/nixpkgs/pull/97000 lands into master
-  preConfigure = stdenv.lib.optionalString stdenv.isDarwin ''
-    unset SDKROOT
-  '';
-
   meta = with stdenv.lib; {
     description = "A generator for LS_COLORS with support for multiple color themes";
     homepage = "https://github.com/sharkdp/vivid";
diff --git a/pkgs/tools/networking/cjdns/default.nix b/pkgs/tools/networking/cjdns/default.nix
index 13388d33779..438f107c27c 100644
--- a/pkgs/tools/networking/cjdns/default.nix
+++ b/pkgs/tools/networking/cjdns/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cjdns";
-  version = "20.7";
+  version = "21";
 
   src = fetchFromGitHub {
     owner = "cjdelisle";
     repo = "cjdns";
     rev = "cjdns-v${version}";
-    sha256 = "09gpqpzc00pp3cj7lyq9876p7is4bcndpdi5knqbv824vk4bj3k0";
+    sha256 = "1s9d8yrdrj2gviig05jhr0fnzazb88lih0amxfk0av786rvh7ymj";
   };
 
   buildInputs = [ which python27 nodejs ] ++
diff --git a/pkgs/tools/networking/network-manager/sstp/default.nix b/pkgs/tools/networking/network-manager/sstp/default.nix
new file mode 100644
index 00000000000..d5195cba345
--- /dev/null
+++ b/pkgs/tools/networking/network-manager/sstp/default.nix
@@ -0,0 +1,64 @@
+{ stdenv
+, autoreconfHook
+, fetchFromGitHub
+, fetchpatch
+, file
+, glib
+, gnome3
+, gtk3
+, intltool
+, libnma
+, libsecret
+, networkmanager
+, pkgconfig
+, ppp
+, sstp
+, substituteAll
+, withGnome ? true }:
+
+let
+  pname = "NetworkManager-sstp";
+  version = "unstable-2020-04-20";
+in stdenv.mkDerivation {
+  name = "${pname}${if withGnome then "-gnome" else ""}-${version}";
+
+  src = fetchFromGitHub {
+    owner = "enaess";
+    repo = "network-manager-sstp";
+    rev = "735d8ca078f933e085029f60a737e3cf1d8c29a8";
+    sha256 = "0aahfhy2ch951kzj6gnd8p8hv2s5yd5y10wrmj68djhnx2ml8cd3";
+  };
+
+  buildInputs = [ sstp networkmanager glib ppp ]
+    ++ stdenv.lib.optionals withGnome [ gtk3 libsecret libnma ];
+
+  nativeBuildInputs = [ file intltool autoreconfHook pkgconfig ];
+
+  postPatch = ''
+    sed -i 's#/sbin/pppd#${ppp}/bin/pppd#' src/nm-sstp-service.c
+    sed -i 's#/sbin/sstpc#${sstp}/bin/sstpc#' src/nm-sstp-service.c
+  '';
+
+  # glib-2.62 deprecations
+  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+
+  preConfigure = "intltoolize";
+  configureFlags = [
+    "--without-libnm-glib"
+    "--with-gnome=${if withGnome then "yes" else "no"}"
+    "--enable-absolute-paths"
+  ];
+
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+      attrPath = "networkmanager-sstp";
+    };
+  };
+
+  meta = with stdenv.lib; {
+    description = "NetworkManager's sstp plugin";
+    inherit (networkmanager.meta) maintainers platforms;
+    license = licenses.gpl2Plus;
+  };
+}
diff --git a/pkgs/tools/networking/sstp/default.nix b/pkgs/tools/networking/sstp/default.nix
index 4d05b478ab4..22ef9102ef8 100644
--- a/pkgs/tools/networking/sstp/default.nix
+++ b/pkgs/tools/networking/sstp/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sstp-client";
-  version = "1.0.12";
+  version = "1.0.13";
 
   src = fetchurl {
-    url = "mirror://sourceforge/sstp-client/sstp-client/${version}/sstp-client-${version}.tar.gz";
-    sha256 = "1zv7rx6wh9rhbyg9pg6759by8hc6n4162zrrw0y812cnaw3b8zj8";
+    url = "mirror://sourceforge/sstp-client/sstp-client/sstp-client-${version}.tar.gz";
+    sha256 = "06rjyncmgdy212xf9l9z6mfh4gdmgk7l4y841gb8lpbrl3y5h4ln";
   };
 
   patchPhase =
diff --git a/pkgs/tools/networking/vegeta/default.nix b/pkgs/tools/networking/vegeta/default.nix
index cb7cbd67743..16abe8c6033 100644
--- a/pkgs/tools/networking/vegeta/default.nix
+++ b/pkgs/tools/networking/vegeta/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "vegeta";
-  version = "12.7.0";
+  version = "12.8.4";
 
   src = fetchFromGitHub {
-    owner = "tsenart";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "1wzx9588hjzxq65fxi1zz9xpsw33qq41hpl0j2f077g4m8yxahv5";
+    owner  = "tsenart";
+    repo   = pname;
+    rev    = "v${version}";
+    sha256 = "0sw10k4g370c544dgw2c1sqdnxryld8lf6c1wnyknrm3zsfzn1hl";
   };
 
   goPackagePath = "github.com/tsenart/${pname}";
diff --git a/pkgs/tools/networking/vegeta/deps.nix b/pkgs/tools/networking/vegeta/deps.nix
index d0637dbeaef..1a06ad178ec 100644
--- a/pkgs/tools/networking/vegeta/deps.nix
+++ b/pkgs/tools/networking/vegeta/deps.nix
@@ -243,4 +243,13 @@
       sha256 = "00wzr5w8aadipgc3rkk8f11i41znskfj9ix5nhhaxyg7isrslgcj";
     };
   }
+  {
+    goPackagePath = "pgregory.net/rapid";
+    fetch = {
+      type = "git";
+      url = "https://github.com/flyingmutant/rapid";
+      rev = "v0.3.3";
+      sha256 = "04w4dmx753b2xp5z5br5wxalgkkgag8qpbxics2gdcksqgi85vg3";
+    };
+  }
 ]
diff --git a/pkgs/tools/package-management/cargo-audit/default.nix b/pkgs/tools/package-management/cargo-audit/default.nix
index acd08817780..8fd5c38ed55 100644
--- a/pkgs/tools/package-management/cargo-audit/default.nix
+++ b/pkgs/tools/package-management/cargo-audit/default.nix
@@ -1,16 +1,16 @@
 { stdenv, lib, rustPlatform, fetchFromGitHub, openssl, pkg-config, Security, libiconv }:
 rustPlatform.buildRustPackage rec {
   pname = "cargo-audit";
-  version = "0.12.0";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "RustSec";
     repo = "cargo-audit";
     rev = "v${version}";
-    sha256 = "0zby9bd64bmrkb229ic7ckn2ycf9bpwsisx2a7z0id0j4mjaca4k";
+    sha256 = "1rhwr2wp4rl2acx4is8aajxd12haph2mdarr8qiwaimsawndaxrw";
   };
 
-  cargoSha256 = "1w4618w5yj1205d7s2hq273fb35qfcd7cnxdwxn4pq8x3ahgy4kx";
+  cargoSha256 = "0m8za771b14vj5w3i906qwhcz43233fjsywlikfl0iv9n5m9k1ab";
 
   buildInputs = [ openssl libiconv ] ++ lib.optionals stdenv.isDarwin [ Security ];
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/tools/package-management/cargo-edit/default.nix b/pkgs/tools/package-management/cargo-edit/default.nix
index ef286ae6449..b81e1b00f4b 100644
--- a/pkgs/tools/package-management/cargo-edit/default.nix
+++ b/pkgs/tools/package-management/cargo-edit/default.nix
@@ -3,7 +3,6 @@
 , rustPlatform
 , fetchFromGitHub
 , pkg-config
-, xcbuild
 , openssl
 , libiconv
 , Security
@@ -23,13 +22,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "1h1sy54p7zxijydnhzvkxli90d72biv1inni17licb0vb9dihmnf";
 
-  nativeBuildInputs = [ pkg-config ] ++ lib.optionals stdenv.isDarwin [
-    # The cc crate runs xcbuild. This dependency can be removed once
-    # the following PR is merged from staging into master:
-    #
-    # https://github.com/NixOS/nixpkgs/pull/97000
-    xcbuild
-  ];
+  nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ openssl zlib ] ++ lib.optionals stdenv.isDarwin [
     libiconv
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index e843e655300..791780ae095 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -11,8 +11,9 @@ common =
   { lib, stdenv, fetchpatch, perl, curl, bzip2, sqlite, openssl ? null, xz
   , bash, coreutils, gzip, gnutar
   , pkgconfig, boehmgc, perlPackages, libsodium, brotli, boost, editline, nlohmann_json
-  , autoreconfHook, autoconf-archive, bison, flex, libxml2, libxslt, docbook5, docbook_xsl_ns
+  , autoreconfHook, autoconf-archive, bison, flex
   , jq, libarchive
+  , lowdown, mdbook
   # Used by tests
   , gmock
   , busybox-sandbox-shell
@@ -31,8 +32,8 @@ common =
       inherit name src;
       version = lib.getVersion name;
 
-      is24 = lib.versionAtLeast version "2.4pre";
-      isExactly23 = lib.versionAtLeast version "2.3" && lib.versionOlder version "2.4";
+      is30 = lib.versionAtLeast version "3.0pre";
+      isExactly30 = lib.versionAtLeast version "2.3" && lib.versionOlder version "3.0";
 
       VERSION_SUFFIX = suffix;
 
@@ -40,15 +41,20 @@ common =
 
       nativeBuildInputs =
         [ pkgconfig ]
-        ++ lib.optionals is24 [ autoreconfHook autoconf-archive bison flex libxml2 libxslt
-                                docbook5 docbook_xsl_ns jq ];
+        ++ lib.optionals is30
+          [ autoreconfHook
+            autoconf-archive
+            bison flex
+            lowdown mdbook
+            jq
+           ];
 
       buildInputs =
         [ curl openssl sqlite xz bzip2 nlohmann_json
           brotli boost editline
         ]
         ++ lib.optional (stdenv.isLinux || stdenv.isDarwin) libsodium
-        ++ lib.optionals is24 [ libarchive gmock ]
+        ++ lib.optionals is30 [ libarchive gmock ]
         ++ lib.optional withLibseccomp libseccomp
         ++ lib.optional withAWS
             ((aws-sdk-cpp.override {
@@ -87,9 +93,9 @@ common =
             patchelf --set-rpath $out/lib:${stdenv.cc.cc.lib}/lib $out/lib/libboost_thread.so.*
           ''}
         '' +
-        # For Nix-2.3, patch around an issue where the Nix configure step pulls in the
+        # For Nix 3.0, patch around an issue where the Nix configure step pulls in the
         # build system's bash and other utilities when cross-compiling
-        lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform && isExactly23) ''
+        lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform && isExactly30) ''
           mkdir tmp/
           substitute corepkgs/config.nix.in tmp/config.nix.in \
             --subst-var-by bash ${bash}/bin/bash \
@@ -162,7 +168,7 @@ common =
           # This is not cross-compile safe, don't have time to fix right now
           # but noting for future travellers.
           nativeBuildInputs =
-            [ perl pkgconfig curl nix libsodium boost autoreconfHook autoconf-archive ];
+            [ perl pkgconfig curl nix libsodium boost autoreconfHook autoconf-archive nlohmann_json ];
 
           configureFlags =
             [ "--with-dbi=${perlPackages.DBI}/${perl.libPrefix}"
@@ -182,10 +188,10 @@ in rec {
   nix = nixStable;
 
   nixStable = callPackage common (rec {
-    name = "nix-2.3.7";
+    name = "nix-2.3.8";
     src = fetchurl {
       url = "https://nixos.org/releases/nix/${name}/${name}.tar.xz";
-      sha256 = "dd8f52849414e5a878afe7e797aa4e22bab77c875d9da5a38d5f1bada704e596";
+      sha256 = "c7119823c1eabdcc9e527cc96a91f11a0b0e63f3840a02fe7573538dad2dad2a";
     };
 
     inherit storeDir stateDir confDir boehmgc;
@@ -193,13 +199,13 @@ in rec {
 
   nixUnstable = lib.lowPrio (callPackage common rec {
     name = "nix-3.0${suffix}";
-    suffix = "pre20200829_f156513";
+    suffix = "pre20201020_e0ca98c";
 
     src = fetchFromGitHub {
       owner = "NixOS";
       repo = "nix";
-      rev = "f15651303f8596bf34c67fc8d536b1e9e7843a87";
-      hash = "sha256-HqM3Z4DLdMrf+0PPZL9ysctGg+K+i3S/IHA1GsJj0Ro=";
+      rev = "e0ca98c2071b815578470e280df8fdb750c7e23b";
+      hash = "sha256-KVS/Z6FzMBOl5XCyOLwfiVoX7G2LQRa9HMGNnJRPCoo=";
     };
 
     inherit storeDir stateDir confDir boehmgc;
diff --git a/pkgs/tools/security/1password-gui/default.nix b/pkgs/tools/security/1password-gui/default.nix
index 3def4bfd21f..7d52311b398 100644
--- a/pkgs/tools/security/1password-gui/default.nix
+++ b/pkgs/tools/security/1password-gui/default.nix
@@ -13,11 +13,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "1password";
-  version = "0.8.10";
+  version = "0.9.0";
 
   src = fetchurl {
     url = "https://onepassword.s3.amazonaws.com/linux/appimage/${pname}-${version}.AppImage";
-    sha256 = "0jxq7gc1m2flv3wr055bkwhfh73c2cdpspg437dv4yvfvjqsk7mm";
+    sha256 = "109jsls4515y78zhhsxqlgms30i5rzhi60p3b9wx6y8v0iq331wp";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 40908e56a72..0504054111e 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -46,7 +46,7 @@ mapAliases ({
   arduino_core = arduino-core;  # added 2015-02-04
   arora = throw "arora has been removed."; # added 2020-09-09
   asciidocFull = asciidoc-full;  # added 2014-06-22
-  asterisk_15 = throw "Asterisk 15 is end of life and has been removed."; # added 2020-10-07
+  asterisk_15 = throw "asterisk_15: Asterisk 15 is end of life and has been removed."; # added 2020-10-07
   at_spi2_atk = at-spi2-atk; # added 2018-02-25
   at_spi2_core = at-spi2-core; # added 2018-02-25
   avldrums-lv2 = x42-avldrums; # added 2020-03-29
@@ -76,7 +76,7 @@ mapAliases ({
   cgmanager = throw "cgmanager was deprecated by lxc and therefore removed from nixpkgs."; # added 2020-06-05
   checkbashism = checkbashisms; # added 2016-08-16
   chronos = throw "chronos has been removed from nixpkgs, as it was unmaintained"; # added 2020-08-15
-  cide = throw "deprecated in 2019-09-11: abandoned by upstream";
+  cide = throw "cide was deprecated on 2019-09-11: abandoned by upstream";
   cinepaint = throw "cinepaint has been removed from nixpkgs, as it was unmaintained"; # added 2019-12-10
   cifs_utils = cifs-utils; # added 2016-08
   ckb = ckb-next; # added 2018-10-21
@@ -88,9 +88,9 @@ mapAliases ({
   conntrack_tools = conntrack-tools; # added 2018-05
   cool-old-term = cool-retro-term; # added 2015-01-31
   coprthr = throw "coprthr has been removed."; # added 2019-12-08
-  corebird = throw "deprecated 2019-10-02: See https://www.patreon.com/posts/corebirds-future-18921328. Please use Cawbird as replacement.";
-  coredumper = throw "coredumper has been removed: Abandoned by upstream."; # added 2019-11-16
-  cryptol = throw "cryptol was remove for prolonged broken build"; # added 2020-08-21
+  corebird = throw "corebird was deprecated 2019-10-02: See https://www.patreon.com/posts/corebirds-future-18921328. Please use Cawbird as replacement.";
+  coredumper = throw "coredumper has been removed: abandoned by upstream."; # added 2019-11-16
+  cryptol = throw "cryptol was removed due to prolonged broken build"; # added 2020-08-21
   cpp-gsl = microsoft_gsl; # added 2019-05-24
   cupsBjnp = cups-bjnp; # added 2016-01-02
   cups_filters = cups-filters; # added 2016-08
@@ -99,7 +99,7 @@ mapAliases ({
   d1x_rebirth = dxx-rebirth; # added 2018-04-25
   d2x_rebirth = dxx-rebirth; # added 2018-04-25
   dat = nodePackages.dat;
-  dbvisualizer = throw "dbvisualizer has been remove from nixpkgs, as it's unmaintained"; # added 2020-09-20
+  dbvisualizer = throw "dbvisualizer has been removed from nixpkgs, as it's unmaintained"; # added 2020-09-20
   dbus_daemon = dbus.daemon; # added 2018-04-25
   dbus_glib = dbus-glib; # added 2018-02-25
   dbus_libs = dbus; # added 2018-04-25
@@ -189,7 +189,7 @@ mapAliases ({
   go-pup = pup; # added 2017-12-19
   gobjectIntrospection = gobject-introspection; # added 2018-12-02
   goimports = gotools; # added 2018-09-16
-  gometalinter = throw "Abandoned by upstream. Consider switching to golangci-lint instead"; # added 2020-04-23
+  gometalinter = throw "gometalinter was abandoned by upstream. Consider switching to golangci-lint instead"; # added 2020-04-23
   google-gflags = gflags; # added 2019-07-25
   googleAuthenticator = google-authenticator; # added 2016-10-16
   grantlee5 = libsForQt5.grantlee;  # added 2015-12-19
@@ -207,7 +207,7 @@ mapAliases ({
   gutenberg = zola;  # added 2018-11-17
   heimdalFull = heimdal; # added 2018-05-01
   hepmc = hepmc2; # added 2019-08-05
-  hexen = throw "hexen (SDL port) has been removed: Abandoned by upstream."; # added 2019-12-11
+  hexen = throw "hexen (SDL port) has been removed: abandoned by upstream."; # added 2019-12-11
   hicolor_icon_theme = hicolor-icon-theme; # added 2018-02-25
   htmlTidy = html-tidy;  # added 2014-12-06
   iana_etc = iana-etc;  # added 2017-03-08
@@ -218,12 +218,12 @@ mapAliases ({
   inotifyTools = inotify-tools;
   jasper = throw "jasper has been removed: abandoned upstream with many vulnerabilities";
   jbuilder = dune; # added 2018-09-09
-  jikes = throw "deprecated in 2019-10-07: jikes was abandoned by upstream";
+  jikes = throw "jikes was deprecated on 2019-10-07: abandoned by upstream";
   joseki = apache-jena-fuseki; # added 2016-02-28
   json_glib = json-glib; # added 2018-02-25
   kdecoration-viewer = throw "kdecoration-viewer has been removed from nixpkgs, as there is no upstream activity"; # 2020-06-16
-  julia_07 = throw "deprecated in favor of julia_10 LTS"; # added 2020-09-15
-  julia_11 = throw "deprecated in favor of latest Julia version"; # added 2020-09-15
+  julia_07 = throw "julia_07 is deprecated in favor of julia_10 LTS"; # added 2020-09-15
+  julia_11 = throw "julia_11 is deprecated in favor of latest Julia version"; # added 2020-09-15
   kdiff3-qt5 = kdiff3; # added 2017-02-18
   keepass-keefox = keepass-keepassrpc; # backwards compatibility alias, added 2018-02
   keepassx-community = keepassxc; # added 2017-11
@@ -267,8 +267,8 @@ mapAliases ({
   librecad2 = librecad;  # backwards compatibility alias, added 2015-10
   libsysfs = sysfsutils; # added 2018-04-25
   libtidy = html-tidy;  # added 2014-12-21
-  libtxc_dxtn = throw "removed 2020-03-16, now integrated in Mesa";
-  libtxc_dxtn_s2tc = throw "removed 2020-03-16, now integrated in Mesa";
+  libtxc_dxtn = throw "libtxc_dxtn was removed 2020-03-16, now integrated in Mesa";
+  libtxc_dxtn_s2tc = throw "libtxc_dxtn_s2tc was removed 2020-03-16, now integrated in Mesa";
   libudev = udev; # added 2018-04-25
   libusb = libusb1; # added 2020-04-28
   libsexy = throw "libsexy has been removed from nixpkgs, as it's abandoned and no package needed it."; # 2019-12-10
@@ -320,7 +320,7 @@ mapAliases ({
   mobile_broadband_provider_info = mobile-broadband-provider-info; # added 2018-02-25
   moby = throw "moby has been removed, merged into linuxkit in 2018.  Use linuxkit instead.";
   module_init_tools = kmod; # added 2016-04-22
-  mono-zeroconf = throw "deprecated 2019-09-20: abandoned by upstream.";
+  mono-zeroconf = throw "mono-zeroconf was deprecated on 2019-09-20: abandoned by upstream.";
   mozart = mozart2-binary; # added 2019-09-23
   mozart-binary = mozart2-binary; # added 2019-09-23
   mpich2 = mpich;  # added 2018-08-06
@@ -349,7 +349,7 @@ mapAliases ({
   nmap_graphical = nmap-graphical;  # added 2017-01-19
   nologin = shadow; # added 2018-04-25
   nxproxy = nx-libs; # added 2019-02-15
-  nylas-mail-bin = throw "deprecated in 2019-09-11: abandoned by upstream";
+  nylas-mail-bin = throw "nylas-mail-bin was deprecated on 2019-09-11: abandoned by upstream";
   opencascade_oce = opencascade; # added 2018-04-25
   oblogout = throw "oblogout has been removed from nixpkgs, as it's archived upstream."; # added 2019-12-10
   opencl-icd = ocl-icd; # added 2017-01-20
@@ -431,7 +431,7 @@ mapAliases ({
   poppler_qt5 = libsForQt5.poppler;  # added 2015-12-19
   postgresql95 = postgresql_9_5;
   postgresql96 = postgresql_9_6;
-  postgresql100 = throw "deprecated 2018-10-21: use postgresql_10 instead";
+  postgresql100 = throw "postgresql100 was deprecated on 2018-10-21: use postgresql_10 instead";
   # postgresql plugins
   pgjwt = postgresqlPackages.pgjwt;
   pg_repack = postgresqlPackages.pg_repack;
@@ -453,26 +453,26 @@ mapAliases ({
   pinentry_qt5 = pinentry-qt; # added 2020-02-11
   postgis = postgresqlPackages.postgis;
   # end
-  ppl-address-book = throw "deprecated in 2019-05-02: abandoned by upstream.";
+  ppl-address-book = throw "ppl-address-book deprecated on 2019-05-02: abandoned by upstream.";
   processing3 = processing; # added 2019-08-16
   procps-ng = procps; # added 2018-06-08
   pygmentex = texlive.bin.pygmentex; # added 2019-12-15
   pyo3-pack = maturin;
   pmenu = throw "pmenu has been removed from nixpkgs, as its maintainer is no longer interested in the package."; # added 2019-12-10
   pulseaudioLight = pulseaudio; # added 2018-04-25
-  phonon-backend-gstreamer = throw "Please use libsForQt5.phonon-backend-gstreamer, as Qt4 support in this package has been removed."; # added 2019-11-22
-  phonon-backend-vlc = throw "Please use libsForQt5.phonon-backend-vlc, as Qt4 support in this package has been removed."; # added 2019-11-22
-  phonon = throw "Please use libsForQt5.phonon, as Qt4 support in this package has been removed."; # added 2019-11-22
+  phonon-backend-gstreamer = throw "phonon-backend-gstreamer: Please use libsForQt5.phonon-backend-gstreamer, as Qt4 support in this package has been removed."; # added 2019-11-22
+  phonon-backend-vlc = throw "phonon-backend-vlc: Please use libsForQt5.phonon-backend-vlc, as Qt4 support in this package has been removed."; # added 2019-11-22
+  phonon = throw "phonon: Please use libsForQt5.phonon, as Qt4 support in this package has been removed."; # added 2019-11-22
   qca-qt5 = libsForQt5.qca-qt5;  # added 2015-12-19
   quake3game = ioquake3; # added 2016-01-14
   qvim = throw "qvim has been removed."; # added 2020-08-31
   qwt6 = libsForQt5.qwt;  # added 2015-12-19
-  qtpfsgui = throw "Is now luminanceHDR"; # added 2019-06-26
+  qtpfsgui = throw "qtpfsgui is now luminanceHDR"; # added 2019-06-26
   quaternion-git = throw "quaternion-git has been removed in favor of the stable version 'quaternion'"; # added 2020-04-09
   rdf4store = throw "rdf4store has been removed from nixpkgs."; # added 2019-12-21
   rdiff_backup = rdiff-backup;  # added 2014-11-23
   rdmd = dtools;  # added 2017-08-19
-  rhc = throw "deprecated in 2019-04-09: abandoned by upstream.";
+  rhc = throw "rhc was deprecated on 2019-04-09: abandoned by upstream.";
   rng_tools = rng-tools; # added 2018-10-24
   robomongo = robo3t; #added 2017-09-28
   rocm-runtime-ext = throw "rocm-runtime-ext has been removed, since its functionality was added to rocm-runtime"; #added 2020-08-21
@@ -483,16 +483,16 @@ mapAliases ({
   qt-recordmydesktop = throw "qt-recordmydesktop has been removed from nixpkgs, as it's abandoned and uses deprecated libraries"; # added 2019-12-10
   rfkill = throw "rfkill has been removed, as it's included in util-linux"; # added 2020-08-23
   rkt = throw "rkt was archived by upstream"; # added 2020-05-16
-  ruby_2_0_0 = throw "deprecated 2018-0213: use a newer version of ruby";
-  ruby_2_1_0 = throw "deprecated 2018-0213: use a newer version of ruby";
-  ruby_2_2_9 = throw "deprecated 2018-0213: use a newer version of ruby";
-  ruby_2_3_6 = throw "deprecated 2018-0213: use a newer version of ruby";
-  ruby_2_3 = throw "deprecated 2019-09-06: use a newer version of ruby";
-  ruby_2_4_3 = throw "deprecated 2018-0213: use a newer version of ruby";
-  ruby_2_4 = throw "deprecated 2019-12: use a newer version of ruby";
-  ruby_2_5_0 = throw "deprecated 2018-0213: use a newer version of ruby";
-  rubyPackages_2_4 = throw "deprecated 2019-12: use a newer version of rubyPackages instead";
-  rubygems = throw "deprecated 2016-03-02: rubygems is now bundled with ruby";
+  ruby_2_0_0 = throw "ruby_2_0_0 was deprecated on 2018-02-13: use a newer version of ruby";
+  ruby_2_1_0 = throw "ruby_2_1_0 was deprecated on 2018-02-13: use a newer version of ruby";
+  ruby_2_2_9 = throw "ruby_2_2_9 was deprecated on 2018-02-13: use a newer version of ruby";
+  ruby_2_3_6 = throw "ruby_2_3_6 was deprecated on 2018-02-13: use a newer version of ruby";
+  ruby_2_3 = throw "ruby_2_3 was deprecated on 2019-09-06: use a newer version of ruby";
+  ruby_2_4_3 = throw "ruby_2_4_3 was deprecated on 2018-02-13: use a newer version of ruby";
+  ruby_2_4 = throw "ruby_2_4 was deprecated in 2019-12: use a newer version of ruby";
+  ruby_2_5_0 = throw "ruby_2_5_0 was deprecated on 2018-02-13: use a newer version of ruby";
+  rubyPackages_2_4 = throw "rubyPackages_2_4 was deprecated in 2019-12: use a newer version of rubyPackages instead";
+  rubygems = throw "rubygems was deprecated on 2016-03-02: rubygems is now bundled with ruby";
   rxvt_unicode-with-plugins = rxvt-unicode; # added 2020-02-02
   rxvt_unicode = rxvt-unicode-unwrapped; # added 2020-02-02
   urxvt_autocomplete_all_the_things = rxvt-unicode-plugins.autocomplete-all-the-things; # added 2020-02-02
@@ -511,12 +511,12 @@ mapAliases ({
   sam = deadpixi-sam; # added 2018-04-25
   samba3 = throw "Samba 3 is discontinued, please switch to samba4"; # added 2019-10-15
   samba3_light = throw "Samba 3 is discontinued, please switch to samba4"; # added 2019-10-15
-  sambaMaster = throw "removed 2019-09-13: outdated and no longer needed";
+  sambaMaster = throw "sambaMaster was removed in 2019-09-13: outdated and no longer needed";
   samsungUnifiedLinuxDriver = samsung-unified-linux-driver; # added 2016-01-25
   saneBackends = sane-backends; # added 2016-01-02
   saneBackendsGit = sane-backends-git; # added 2016-01-02
   saneFrontends = sane-frontends; # added 2016-01-02
-  sapic = throw "deprecated 2019-1-19: sapic is bundled with 'tamarin-prover' now";
+  sapic = throw "sapic was deprecated on 2019-1-19: sapic is bundled with 'tamarin-prover' now";
   scim = sc-im; # added 2016-01-22
   scollector = bosun; # added 2018-04-25
   sdlmame = mame; # added 2019-10-30
@@ -535,7 +535,7 @@ mapAliases ({
   smbclient = samba; # added 2018-04-25
   slim = throw "slim has been removed. Please use a different display-manager"; # added 2019-11-11
   slimThemes = throw "slimThemes has been removed because slim has been also"; # added 2019-11-11
-  sundials_3 = throw "removed 2020-02. outdated and no longer needed";
+  sundials_3 = throw "sundials_3 was removed in 2020-02. outdated and no longer needed";
 
   # added 2020-02-10
   sourceHanSansPackages = {
@@ -574,11 +574,11 @@ mapAliases ({
   sshfsFuse = sshfs-fuse; # added 2016-09
   suil-qt5 = suil; # added 2018-05-01
   surf-webkit2 = surf; # added 2017-04-02
-  sup = throw "deprecated in 2019-09-10: abandoned by upstream";
+  sup = throw "sup was deprecated on 2019-09-10: abandoned by upstream";
   swfdec = throw "swfdec has been removed as broken and unmaintained."; # added 2020-08-23
   system_config_printer = system-config-printer;  # added 2016-01-03
   systemd-cryptsetup-generator = throw "systemd-cryptsetup-generator is now included in the systemd package"; # added 2020-07-12
-  systemd_with_lvm2 = throw "obsolete, enabled by default via the lvm module"; # added 2020-07-12
+  systemd_with_lvm2 = throw "systemd_with_lvm2 is obsolete, enabled by default via the lvm module"; # added 2020-07-12
   systool = sysfsutils; # added 2018-04-25
   tahoelafs = tahoe-lafs; # added 2018-03-26
   tangogps = foxtrotgps; # added 2020-01-26
@@ -599,7 +599,7 @@ mapAliases ({
   terraform-provider-lxd = terraform-providers.lxd; # added 2020-03-16
   terraform-provider-nixos = terraform-providers.nixos; # added 2018-09-28
   tesseract_4 = tesseract4; # added 2018-12-19
-  testdisk-photorec = throw "This package was a duplicate, please use testdisk or testdisk-qt instead"; # added 2019-10-13
+  testdisk-photorec = throw "testdisk-photorec: This package was a duplicate, please use testdisk or testdisk-qt instead"; # added 2019-10-13
   tex-gyre-bonum-math = tex-gyre-math.bonum; # added 2018-04-03
   tex-gyre-pagella-math = tex-gyre-math.pagella; # added 2018-04-03
   tex-gyre-schola-math = tex-gyre-math.schola; # added 2018-04-03
@@ -629,8 +629,8 @@ mapAliases ({
   usbguard-nox = usbguard; # added 2019-09-04
   uzbl = throw "uzbl has been removed from nixpkgs, as it's unmaintained and uses insecure libraries";
   v4l_utils = v4l-utils; # added 2019-08-07
-  v8_3_16_14 = throw "removed 2019-11-01: no longer referenced by other packages";
-  valadoc = throw "deprecated 2019-10-10: valadoc was merged into vala 0.38";
+  v8_3_16_14 = throw "v8_3_16_14 was removed in 2019-11-01: no longer referenced by other packages";
+  valadoc = throw "valadoc was deprecated on 2019-10-10: valadoc was merged into vala 0.38";
   vamp = { vampSDK = vamp-plugin-sdk; }; # added 2020-03-26
   vimbWrapper = vimb; # added 2015-01
   vimprobable2 = throw "vimprobable2 has been removed from nixpkgs. It relied on webkitgtk24x that has been removed."; # added 2019-12-05
@@ -701,7 +701,7 @@ mapAliases ({
   murmur_git = pkgs.murmur;
 
   # added 2020-08-17
-  zabbix44 = throw "Zabbix 4.4 is end of life, see https://www.zabbix.com/documentation/current/manual/installation/upgrade_notes_500 for details on upgrading to Zabbix 5.0.";
+  zabbix44 = throw "zabbix44: Zabbix 4.4 is end of life, see https://www.zabbix.com/documentation/current/manual/installation/upgrade_notes_500 for details on upgrading to Zabbix 5.0.";
 
   # added 2019-09-06
   zeroc_ice = pkgs.zeroc-ice;
@@ -729,12 +729,12 @@ mapAliases ({
 
   # added 2019-04-13
   # *-polly pointed to llvmPackages_latest
-  llvm-polly = throw "clang is now built with polly-plugin by default";
-  clang-polly = throw "clang is now built with polly-plugin by default";
+  llvm-polly = throw "llvm-polly: clang is now built with polly-plugin by default";
+  clang-polly = throw "clang-polly: clang is now built with polly-plugin by default";
 
   /* Cleanup before 20.09 */
   oraclejdk8psu = throw ''
-    The *psu versions of oraclejdk aren't provided by upstream anymore and were therefore removed!
+    oraclejdk8psu: The *psu versions of oraclejdk aren't provided by upstream anymore and were therefore removed!
   '';
   oraclejre8psu = oraclejdk8psu;
   oraclejdk8psu_distro = oraclejdk8psu;
@@ -742,7 +742,7 @@ mapAliases ({
   dnscrypt-proxy = throw "dnscrypt-proxy has been removed. Please use dnscrypt-proxy2."; # added 2020-02-02
   sqldeveloper_18 = throw "sqldeveloper_18 is not maintained anymore!"; # added 2020-02-04
 
-  gcc-snapshot = throw "Marked as broken for >2 years, additionally this 'snapshot' pointed to a fairly old one from gcc7.";
+  gcc-snapshot = throw "gcc-snapshot: Marked as broken for >2 years, additionally this 'snapshot' pointed to a fairly old one from gcc7.";
 
   /* Cleanup before 21.03 */
   riot-desktop = throw "riot-desktop is now element-desktop!";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 96f0b96841f..a972a45bd0e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2342,6 +2342,8 @@ in
 
   patdiff = callPackage ../tools/misc/patdiff { };
 
+  patool = with python3Packages; toPythonApplication patool;
+
   pbpst = callPackage ../applications/misc/pbpst { };
 
   pbzx = callPackage ../tools/compression/pbzx { };
@@ -3427,6 +3429,8 @@ in
 
   wayland-utils = callPackage ../tools/wayland/wayland-utils { };
 
+  wayst = callPackage ../applications/misc/wayst { };
+
   wev = callPackage ../tools/misc/wev { };
 
   wl-clipboard = callPackage ../tools/misc/wl-clipboard { };
@@ -5104,10 +5108,13 @@ in
   nodejs-slim-14_x = callPackage ../development/web/nodejs/v14.nix {
     enableNpm = false;
   };
-
+  nodejs-15_x = callPackage ../development/web/nodejs/v15.nix { };
+  nodejs-slim-15_x = callPackage ../development/web/nodejs/v15.nix {
+    enableNpm = false;
+  };
   # Update this when adding the newest nodejs major version!
-  nodejs_latest = nodejs-14_x;
-  nodejs-slim_latest = nodejs-slim-14_x;
+  nodejs_latest = nodejs-15_x;
+  nodejs-slim_latest = nodejs-slim-15_x;
 
   nodePackages_latest = dontRecurseIntoAttrs (callPackage ../development/node-packages/default.nix {
     nodejs = pkgs.nodejs_latest;
@@ -5727,6 +5734,8 @@ in
 
   networkmanager_strongswan = callPackage ../tools/networking/network-manager/strongswan { };
 
+  networkmanager-sstp = callPackage ../tools/networking/network-manager/sstp { };
+
   networkmanagerapplet = callPackage ../tools/networking/network-manager/applet { };
 
   libnma = callPackage ../tools/networking/network-manager/libnma { };
@@ -9659,11 +9668,11 @@ in
   # So this commit doesn't remove the 1.45.2 release.
   rust_1_45 = callPackage ../development/compilers/rust/1_45.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
-    llvmPackages = llvmPackages_10;
+    llvmPackages = if stdenv.cc.isClang then llvmPackages_5 else llvmPackages_10;
   };
   rust_1_47 = callPackage ../development/compilers/rust/1_47.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
-    llvmPackages = llvmPackages_11;
+    llvmPackages = if stdenv.cc.isClang then llvmPackages_5 else llvmPackages_11;
   };
   rust = rust_1_47;
 
@@ -13037,7 +13046,7 @@ in
   hwloc = callPackage ../development/libraries/hwloc {};
 
   inherit (callPackage ../development/tools/misc/hydra { })
-    hydra-migration hydra-unstable;
+    hydra-unstable;
 
   hydra-flakes = throw ''
     Flakes support has been merged into Hydra's master. Please use
@@ -21632,7 +21641,7 @@ in
 
   k4dirstat = libsForQt5.callPackage ../applications/misc/k4dirstat { };
 
-  kdeconnect = libsForQt5.callPackage ../applications/misc/kdeconnect { };
+  kdeconnect = libsForQt512.callPackage ../applications/misc/kdeconnect { };
 
   inherit (kdeFrameworks) kdesu;
 
@@ -23635,6 +23644,8 @@ in
 
   tdesktop = qt5.callPackage ../applications/networking/instant-messengers/telegram/tdesktop { };
 
+  tektoncd-cli = callPackage ../applications/networking/cluster/tektoncd-cli { };
+
   telepathy-gabble = callPackage ../applications/networking/instant-messengers/telepathy/gabble { };
 
   telepathy-haze = callPackage ../applications/networking/instant-messengers/telepathy/haze {};
@@ -25337,6 +25348,12 @@ in
 
   openmw-tes3mp = libsForQt5.callPackage ../games/openmw/tes3mp.nix { };
 
+  portmod = callPackage ../games/portmod { };
+
+  tr-patcher = callPackage ../games/tr-patcher { };
+
+  tes3cmd = callPackage ../games/tes3cmd { };
+
   openraPackages = import ../games/openra pkgs;
 
   openra = openraPackages.engines.release;
@@ -28003,6 +28020,8 @@ in
 
   yadm = callPackage ../applications/version-management/yadm { };
 
+  yamale = with python3Packages; toPythonApplication yamale;
+
   yamdi = callPackage ../tools/video/yamdi { };
 
   yandex-disk = callPackage ../tools/filesystems/yandex-disk { };
@@ -28334,4 +28353,5 @@ in
   cagebreak = callPackage ../applications/window-managers/cagebreak/default.nix {};
 
   psftools = callPackage ../os-specific/linux/psftools {};
+
 }
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index e19d881d1e3..0c117ba47fd 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -8302,10 +8302,10 @@ let
 
   FutureAsyncAwait = buildPerlModule {
     pname = "Future-AsyncAwait";
-    version = "0.44";
+    version = "0.45";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/P/PE/PEVANS/Future-AsyncAwait-0.44.tar.gz";
-      sha256 = "131825164614ede6a49df4566e730c4cc22e3129796039b9360fa551701413fe";
+      url = "mirror://cpan/authors/id/P/PE/PEVANS/Future-AsyncAwait-0.45.tar.gz";
+      sha256 = "1aq19b21r9i4c1mxkrv0irnx16234cnzsx50178c7xif4gqkar9k";
     };
     buildInputs = [ TestRefcount ];
     propagatedBuildInputs = [ Future XSParseSublike ];
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 583f5aa5fcb..d65a37bcb2f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -774,6 +774,8 @@ in {
 
   bap = callPackage ../development/python-modules/bap { bap = pkgs.ocaml-ng.ocamlPackages_4_07.bap; };
 
+  baron = callPackage ../development/python-modules/baron { };
+
   base58 = callPackage ../development/python-modules/base58 { };
 
   baselines = callPackage ../development/python-modules/baselines { };
@@ -4364,6 +4366,8 @@ in {
 
   pathtools = callPackage ../development/python-modules/pathtools { };
 
+  patool = callPackage ../development/python-modules/patool { };
+
   patsy = callPackage ../development/python-modules/patsy { };
 
   paver = callPackage ../development/python-modules/paver { };
@@ -5259,6 +5263,8 @@ in {
 
   pyparted = callPackage ../development/python-modules/pyparted { };
 
+  pypblib = callPackage ../development/python-modules/pypblib { };
+
   pypcap = callPackage ../development/python-modules/pypcap { };
 
   pypdf2 = callPackage ../development/python-modules/pypdf2 { };
@@ -5835,6 +5841,8 @@ in {
 
   python-rtmidi = callPackage ../development/python-modules/python-rtmidi { };
 
+  python-sat = callPackage ../development/python-modules/python-sat { };
+
   python-simple-hipchat = callPackage ../development/python-modules/python-simple-hipchat { };
   python_simple_hipchat = self.python-simple-hipchat;
 
@@ -6104,6 +6112,8 @@ in {
 
   recommonmark = callPackage ../development/python-modules/recommonmark { };
 
+  redbaron = callPackage ../development/python-modules/redbaron { };
+
   redis = callPackage ../development/python-modules/redis { };
 
   rednose = callPackage ../development/python-modules/rednose { };
@@ -7687,6 +7697,8 @@ in {
 
   yahooweather = callPackage ../development/python-modules/yahooweather { };
 
+  yamale = callPackage ../development/python-modules/yamale { };
+
   yamllint = callPackage ../development/python-modules/yamllint { };
 
   yamlordereddictloader = callPackage ../development/python-modules/yamlordereddictloader { };