summary refs log tree commit diff
diff options
context:
space:
mode:
authorJörg Thalheim <Mic92@users.noreply.github.com>2022-01-19 05:53:49 +0000
committerGitHub <noreply@github.com>2022-01-19 05:53:49 +0000
commitbae5930da899a45769e61e440f1914b9bd6d3d5a (patch)
tree13e1037237570465d6938faa614840b1dc125021
parentcf1d0dd79d74320c1de10c69e0dd0966a058ae07 (diff)
parent940d182e403228c2af36a5cadc528cbea09ed11f (diff)
downloadnixpkgs-bae5930da899a45769e61e440f1914b9bd6d3d5a.tar
nixpkgs-bae5930da899a45769e61e440f1914b9bd6d3d5a.tar.gz
nixpkgs-bae5930da899a45769e61e440f1914b9bd6d3d5a.tar.bz2
nixpkgs-bae5930da899a45769e61e440f1914b9bd6d3d5a.tar.lz
nixpkgs-bae5930da899a45769e61e440f1914b9bd6d3d5a.tar.xz
nixpkgs-bae5930da899a45769e61e440f1914b9bd6d3d5a.tar.zst
nixpkgs-bae5930da899a45769e61e440f1914b9bd6d3d5a.zip
Merge branch 'master' into love-cleanup
-rw-r--r--doc/languages-frameworks/dotnet.section.md2
-rw-r--r--lib/asserts.nix22
-rw-r--r--maintainers/maintainer-list.nix37
-rw-r--r--nixos/doc/manual/from_md/release-notes/rl-2205.section.xml122
-rw-r--r--nixos/doc/manual/release-notes/rl-2205.section.md44
-rw-r--r--nixos/modules/config/malloc.nix11
-rw-r--r--nixos/modules/misc/ids.nix2
-rw-r--r--nixos/modules/module-list.nix2
-rw-r--r--nixos/modules/programs/chromium.nix8
-rw-r--r--nixos/modules/programs/tsm-client.nix8
-rw-r--r--nixos/modules/services/backup/borgbackup.nix41
-rw-r--r--nixos/modules/services/backup/tsm.nix47
-rw-r--r--nixos/modules/services/development/rstudio-server/default.nix107
-rw-r--r--nixos/modules/services/misc/ananicy.nix2
-rw-r--r--nixos/modules/services/misc/bees.nix3
-rw-r--r--nixos/modules/services/misc/heisenbridge.nix38
-rw-r--r--nixos/modules/services/misc/mbpfan.nix112
-rw-r--r--nixos/modules/services/networking/adguardhome.nix18
-rw-r--r--nixos/modules/services/networking/ddclient.nix4
-rw-r--r--nixos/modules/services/networking/mosquitto.nix2
-rw-r--r--nixos/modules/services/networking/nix-serve.nix10
-rw-r--r--nixos/modules/services/networking/ssh/sshd.nix7
-rw-r--r--nixos/modules/services/networking/syncthing.nix4
-rw-r--r--nixos/modules/services/system/cachix-agent/default.nix57
-rw-r--r--nixos/modules/services/web-apps/bookstack.nix202
-rw-r--r--nixos/modules/services/web-apps/keycloak.nix875
-rw-r--r--nixos/modules/services/web-apps/keycloak.xml18
-rw-r--r--nixos/modules/services/web-apps/mattermost.nix2
-rw-r--r--nixos/modules/services/web-apps/prosody-filer.nix10
-rw-r--r--nixos/modules/system/activation/switch-to-configuration.pl72
-rw-r--r--nixos/tests/adguardhome.nix57
-rw-r--r--nixos/tests/all-tests.nix3
-rw-r--r--nixos/tests/borgbackup.nix2
-rw-r--r--nixos/tests/btrbk.nix2
-rw-r--r--nixos/tests/google-oslogin/server.nix2
-rw-r--r--nixos/tests/rstudio-server.nix30
-rw-r--r--nixos/tests/switch-test.nix70
-rw-r--r--nixos/tests/thelounge.nix29
-rw-r--r--nixos/tests/tsm-client-gui.nix57
-rw-r--r--pkgs/applications/audio/aumix/default.nix11
-rw-r--r--pkgs/applications/audio/bespokesynth/default.nix198
-rw-r--r--pkgs/applications/audio/rhvoice/default.nix4
-rw-r--r--pkgs/applications/audio/schismtracker/default.nix4
-rw-r--r--pkgs/applications/audio/sorcer/default.nix4
-rw-r--r--pkgs/applications/audio/split2flac/default.nix4
-rw-r--r--pkgs/applications/audio/spot/default.nix6
-rw-r--r--pkgs/applications/blockchains/btcpayserver/default.nix2
-rw-r--r--pkgs/applications/blockchains/chia-plotter/default.nix4
-rw-r--r--pkgs/applications/blockchains/nbxplorer/default.nix2
-rw-r--r--pkgs/applications/blockchains/wasabibackend/default.nix2
-rw-r--r--pkgs/applications/blockchains/zcash/default.nix6
-rw-r--r--pkgs/applications/editors/cudatext/default.nix4
-rw-r--r--pkgs/applications/editors/cudatext/deps.json16
-rw-r--r--pkgs/applications/editors/netbeans/default.nix4
-rw-r--r--pkgs/applications/editors/rstudio/default.nix303
-rw-r--r--pkgs/applications/editors/tiled/default.nix4
-rw-r--r--pkgs/applications/editors/wxhexeditor/default.nix4
-rw-r--r--pkgs/applications/graphics/inkscape/default.nix8
-rw-r--r--pkgs/applications/graphics/krita/default.nix4
-rw-r--r--pkgs/applications/graphics/pinta/default.nix81
-rw-r--r--pkgs/applications/graphics/renderdoc/default.nix35
-rw-r--r--pkgs/applications/graphics/screencloud/default.nix6
-rw-r--r--pkgs/applications/misc/auto-multiple-choice/default.nix2
-rw-r--r--pkgs/applications/misc/cubiomes-viewer/default.nix70
-rw-r--r--pkgs/applications/misc/haxor-news/default.nix3
-rw-r--r--pkgs/applications/misc/minder/default.nix6
-rw-r--r--pkgs/applications/misc/ocropus/default.nix6
-rw-r--r--pkgs/applications/misc/pdfdiff/default.nix8
-rw-r--r--pkgs/applications/misc/phwmon/default.nix8
-rw-r--r--pkgs/applications/misc/pomotroid/default.nix60
-rw-r--r--pkgs/applications/misc/privacyidea/default.nix4
-rw-r--r--pkgs/applications/misc/rofi/wayland.nix31
-rw-r--r--pkgs/applications/misc/survex/default.nix4
-rw-r--r--pkgs/applications/misc/weather/default.nix6
-rw-r--r--pkgs/applications/networking/browsers/chromium/common.nix12
-rw-r--r--pkgs/applications/networking/browsers/chromium/patches/m97-ozone-wayland-fix-surface_augmenter.patch31
-rw-r--r--pkgs/applications/networking/browsers/lagrange/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/tanka/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/terraform-providers/default.nix135
-rw-r--r--pkgs/applications/networking/cluster/terraform-providers/providers.json144
-rw-r--r--pkgs/applications/networking/cluster/terraform/default.nix14
-rw-r--r--pkgs/applications/networking/cluster/terranix/default.nix6
-rw-r--r--pkgs/applications/networking/instant-messengers/element/element-desktop.nix5
-rw-r--r--pkgs/applications/networking/instant-messengers/franz/generic.nix3
-rw-r--r--pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-plugin-pack/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/torchat/default.nix8
-rw-r--r--pkgs/applications/networking/ipfs-cluster/default.nix6
-rw-r--r--pkgs/applications/networking/ipget/default.nix6
-rw-r--r--pkgs/applications/networking/mailreaders/alot/default.nix (renamed from pkgs/development/python-modules/alot/default.nix)12
-rw-r--r--pkgs/applications/networking/mailreaders/alot/notmuch.nix (renamed from pkgs/development/python-modules/notmuch/2.nix)0
-rw-r--r--pkgs/applications/networking/p2p/tribler/aiohttp-apispec.nix (renamed from pkgs/development/python-modules/aiohttp-apispec/unstable.nix)4
-rw-r--r--pkgs/applications/networking/p2p/tribler/apispec.nix (renamed from pkgs/development/python-modules/apispec/3.nix)0
-rw-r--r--pkgs/applications/networking/p2p/tribler/default.nix3
-rw-r--r--pkgs/applications/networking/p2p/twister/default.nix5
-rw-r--r--pkgs/applications/networking/ping/default.nix13
-rw-r--r--pkgs/applications/office/PageEdit/default.nix25
-rw-r--r--pkgs/applications/office/notion-app-enhanced/default.nix4
-rw-r--r--pkgs/applications/office/qownnotes/default.nix4
-rw-r--r--pkgs/applications/office/timeline/default.nix2
-rw-r--r--pkgs/applications/office/trilium/default.nix6
-rw-r--r--pkgs/applications/office/watson/default.nix3
-rw-r--r--pkgs/applications/radio/gnuradio/3.9.nix (renamed from pkgs/applications/radio/gnuradio/3.7.nix)206
-rw-r--r--pkgs/applications/radio/gnuradio/default.nix28
-rw-r--r--pkgs/applications/radio/gqrx/default.nix4
-rw-r--r--pkgs/applications/radio/soapysdr/default.nix3
-rw-r--r--pkgs/applications/science/biology/minimap2/default.nix5
-rwxr-xr-xpkgs/applications/science/biology/poretools/default.nix6
-rw-r--r--pkgs/applications/science/biology/tebreak/default.nix12
-rw-r--r--pkgs/applications/science/electronics/kicad/default.nix2
-rw-r--r--pkgs/applications/science/logic/lean/default.nix6
-rw-r--r--pkgs/applications/science/machine-learning/shogun/default.nix8
-rw-r--r--pkgs/applications/science/misc/sasview/default.nix24
-rw-r--r--pkgs/applications/science/misc/tulip/default.nix4
-rw-r--r--pkgs/applications/science/molecular-dynamics/gromacs/default.nix4
-rw-r--r--pkgs/applications/system/monitor/default.nix18
-rw-r--r--pkgs/applications/terminal-emulators/kitty/default.nix33
-rw-r--r--pkgs/applications/terminal-emulators/mlterm/default.nix4
-rw-r--r--pkgs/applications/version-management/dvc/default.nix99
-rw-r--r--pkgs/applications/version-management/dvc/dvc-daemon.patch21
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-workspace/default.nix6
-rw-r--r--pkgs/applications/version-management/gitless/default.nix4
-rw-r--r--pkgs/applications/version-management/rapidsvn/default.nix4
-rw-r--r--pkgs/applications/version-management/src/default.nix4
-rw-r--r--pkgs/applications/version-management/srcml/default.nix4
-rw-r--r--pkgs/applications/video/kodi/addons/arrow/default.nix30
-rw-r--r--pkgs/applications/video/kodi/addons/trakt-module/default.nix31
-rw-r--r--pkgs/applications/video/kodi/addons/trakt/default.nix30
-rw-r--r--pkgs/applications/video/kodi/addons/typing_extensions/default.nix25
-rw-r--r--pkgs/applications/virtualization/runc/default.nix4
-rw-r--r--pkgs/applications/window-managers/i3/lock-blur.nix3
-rw-r--r--pkgs/applications/window-managers/i3/lock-color.nix1
-rw-r--r--pkgs/applications/window-managers/tabbed/default.nix6
-rw-r--r--pkgs/applications/window-managers/wmii-hg/default.nix4
-rw-r--r--pkgs/build-support/build-dotnet-module/default.nix34
-rw-r--r--pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix2
-rw-r--r--pkgs/build-support/skaware/build-skaware-package.nix15
-rw-r--r--pkgs/data/fonts/noto-fonts/default.nix80
-rw-r--r--pkgs/data/icons/tela-circle-icon-theme/default.nix65
-rw-r--r--pkgs/data/misc/hackage/pin.json8
-rw-r--r--pkgs/data/themes/graphite/default.nix21
-rw-r--r--pkgs/data/themes/lightly-qt/default.nix42
-rw-r--r--pkgs/data/themes/mojave/default.nix48
-rw-r--r--pkgs/data/themes/nordic/default.nix47
-rw-r--r--pkgs/data/themes/sierra/default.nix61
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-camera/default.nix10
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-code/default.nix10
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-files/default.nix10
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-mail/default.nix10
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-music/default.nix6
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-screenshot/default.nix10
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-terminal/default.nix10
-rw-r--r--pkgs/desktops/pantheon/apps/switchboard/default.nix6
-rw-r--r--pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix7
-rw-r--r--pkgs/desktops/pantheon/desktop/elementary-shortcut-overlay/default.nix14
-rw-r--r--pkgs/desktops/pantheon/services/elementary-capnet-assist/default.nix14
-rw-r--r--pkgs/desktops/xfce/panel-plugins/xfce4-namebar-plugin/default.nix17
-rw-r--r--pkgs/development/compilers/hip/default.nix6
-rw-r--r--pkgs/development/compilers/intel-graphics-compiler/default.nix1
-rw-r--r--pkgs/development/compilers/vala/default.nix27
-rw-r--r--pkgs/development/compilers/vala/disable-graphviz-0.40.12.patch208
-rw-r--r--pkgs/development/compilers/zulu/default.nix8
-rw-r--r--pkgs/development/gnuradio-modules/grnet/default.nix1
-rw-r--r--pkgs/development/gnuradio-modules/limesdr/default.nix2
-rw-r--r--pkgs/development/gnuradio-modules/osmosdr/default.nix6
-rw-r--r--pkgs/development/haskell-modules/configuration-common.nix40
-rw-r--r--pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix5
-rw-r--r--pkgs/development/haskell-modules/configuration-ghc-9.2.x.nix18
-rw-r--r--pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml6
-rw-r--r--pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml5
-rw-r--r--pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml15
-rw-r--r--pkgs/development/haskell-modules/configuration-nix.nix6
-rw-r--r--pkgs/development/haskell-modules/hackage-packages.nix2253
-rw-r--r--pkgs/development/haskell-modules/patches/hnix.patch24
-rw-r--r--pkgs/development/interpreters/acl2/default.nix4
-rw-r--r--pkgs/development/interpreters/clojurescript/lumo/default.nix4
-rw-r--r--pkgs/development/interpreters/lunatic/default.nix6
-rw-r--r--pkgs/development/interpreters/php/7.4.nix4
-rw-r--r--pkgs/development/interpreters/php/8.0.nix4
-rw-r--r--pkgs/development/interpreters/wasmtime/default.nix4
-rw-r--r--pkgs/development/interpreters/yex-lang/default.nix24
-rw-r--r--pkgs/development/libraries/arrayfire/default.nix13
-rw-r--r--pkgs/development/libraries/audio/zita-alsa-pcmi/default.nix4
-rw-r--r--pkgs/development/libraries/blitz/default.nix4
-rw-r--r--pkgs/development/libraries/freenect/default.nix5
-rw-r--r--pkgs/development/libraries/highfive/default.nix6
-rw-r--r--pkgs/development/libraries/libpqxx/default.nix4
-rw-r--r--pkgs/development/libraries/nsync/default.nix29
-rw-r--r--pkgs/development/libraries/ntrack/default.nix4
-rw-r--r--pkgs/development/libraries/openbabel/2.nix4
-rw-r--r--pkgs/development/libraries/opencv/default.nix6
-rw-r--r--pkgs/development/libraries/pcmsolver/default.nix4
-rw-r--r--pkgs/development/libraries/physics/fastjet/default.nix2
-rw-r--r--pkgs/development/libraries/polkit/default.nix4
-rw-r--r--pkgs/development/libraries/ptex/default.nix4
-rw-r--r--pkgs/development/libraries/rabbitmq-java-client/default.nix4
-rw-r--r--pkgs/development/libraries/science/math/fenics/default.nix9
-rw-r--r--pkgs/development/libraries/science/math/itpp/default.nix1
-rw-r--r--pkgs/development/libraries/seasocks/default.nix4
-rw-r--r--pkgs/development/libraries/snack/default.nix6
-rw-r--r--pkgs/development/libraries/swiften/default.nix4
-rw-r--r--pkgs/development/libraries/tiledb/default.nix4
-rw-r--r--pkgs/development/libraries/uriparser/default.nix4
-rw-r--r--pkgs/development/libraries/v8/5_x.nix199
-rw-r--r--pkgs/development/libraries/v8/8_x.nix169
-rw-r--r--pkgs/development/libraries/v8/default.nix110
-rw-r--r--pkgs/development/libraries/v8/gcc_arm.patch31
-rw-r--r--pkgs/development/libraries/v8/libv8-5.4.232.patch97
-rwxr-xr-xpkgs/development/libraries/v8/update.sh49
-rw-r--r--pkgs/development/libraries/xdg-desktop-portal-wlr/default.nix4
-rw-r--r--pkgs/development/node-packages/default.nix4
-rw-r--r--pkgs/development/ocaml-modules/llvm/default.nix4
-rw-r--r--pkgs/development/ocaml-modules/pycaml/default.nix4
-rw-r--r--pkgs/development/octave-modules/miscellaneous/default.nix2
-rw-r--r--pkgs/development/python-modules/aiogithubapi/default.nix23
-rw-r--r--pkgs/development/python-modules/aiohttp-retry/default.nix43
-rw-r--r--pkgs/development/python-modules/bimmer-connected/default.nix4
-rw-r--r--pkgs/development/python-modules/build/default.nix2
-rw-r--r--pkgs/development/python-modules/cairocffi/default.nix67
-rw-r--r--pkgs/development/python-modules/cairocffi/generic.nix63
-rw-r--r--pkgs/development/python-modules/commoncode/default.nix8
-rw-r--r--pkgs/development/python-modules/cot/default.nix61
-rw-r--r--pkgs/development/python-modules/cozy/default.nix62
-rw-r--r--pkgs/development/python-modules/dataset/default.nix35
-rw-r--r--pkgs/development/python-modules/demjson/default.nix19
-rw-r--r--pkgs/development/python-modules/dictdiffer/default.nix50
-rw-r--r--pkgs/development/python-modules/doit/default.nix4
-rw-r--r--pkgs/development/python-modules/drf-jwt/default.nix4
-rw-r--r--pkgs/development/python-modules/flask-gravatar/default.nix47
-rw-r--r--pkgs/development/python-modules/flask-paranoid/default.nix40
-rw-r--r--pkgs/development/python-modules/flask-security-too/default.nix76
-rw-r--r--pkgs/development/python-modules/flatten-dict/default.nix46
-rw-r--r--pkgs/development/python-modules/flux-led/default.nix4
-rw-r--r--pkgs/development/python-modules/google-api-core/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-bigquery/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-datacatalog/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-storage/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-tasks/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-testutils/default.nix4
-rw-r--r--pkgs/development/python-modules/grandalf/default.nix32
-rw-r--r--pkgs/development/python-modules/graph-tool/default.nix (renamed from pkgs/development/python-modules/graph-tool/2.x.x.nix)0
-rw-r--r--pkgs/development/python-modules/greeclimate/default.nix4
-rw-r--r--pkgs/development/python-modules/gvm-tools/default.nix3
-rw-r--r--pkgs/development/python-modules/hangups/default.nix7
-rw-r--r--pkgs/development/python-modules/hap-python/default.nix4
-rw-r--r--pkgs/development/python-modules/httpagentparser/default.nix26
-rw-r--r--pkgs/development/python-modules/hwi/default.nix17
-rw-r--r--pkgs/development/python-modules/ics/default.nix2
-rw-r--r--pkgs/development/python-modules/identify/default.nix4
-rw-r--r--pkgs/development/python-modules/installer/default.nix35
-rw-r--r--pkgs/development/python-modules/ipython/7.16.nix69
-rw-r--r--pkgs/development/python-modules/irc/default.nix4
-rw-r--r--pkgs/development/python-modules/mailchecker/default.nix32
-rw-r--r--pkgs/development/python-modules/matrix-common/default.nix27
-rw-r--r--pkgs/development/python-modules/meshtastic/default.nix4
-rw-r--r--pkgs/development/python-modules/mitogen/default.nix12
-rw-r--r--pkgs/development/python-modules/mlflow/default.nix17
-rw-r--r--pkgs/development/python-modules/mongomock/default.nix40
-rw-r--r--pkgs/development/python-modules/nexia/default.nix13
-rw-r--r--pkgs/development/python-modules/pdm-pep517/default.nix38
-rw-r--r--pkgs/development/python-modules/pikepdf/default.nix4
-rw-r--r--pkgs/development/python-modules/pony/default.nix41
-rw-r--r--pkgs/development/python-modules/pyTelegramBotAPI/default.nix4
-rw-r--r--pkgs/development/python-modules/pyatv/default.nix4
-rw-r--r--pkgs/development/python-modules/pybotvac/default.nix4
-rw-r--r--pkgs/development/python-modules/pyhiveapi/default.nix4
-rw-r--r--pkgs/development/python-modules/pyrogram/default.nix6
-rw-r--r--pkgs/development/python-modules/pytest/5.nix95
-rw-r--r--pkgs/development/python-modules/python-benedict/default.nix75
-rw-r--r--pkgs/development/python-modules/python-engineio/default.nix4
-rw-r--r--pkgs/development/python-modules/python-fsutil/default.nix51
-rw-r--r--pkgs/development/python-modules/python-kasa/default.nix23
-rw-r--r--pkgs/development/python-modules/python-miio/default.nix4
-rw-r--r--pkgs/development/python-modules/python-socketio/default.nix4
-rw-r--r--pkgs/development/python-modules/pythonfinder/default.nix56
-rw-r--r--pkgs/development/python-modules/pywayland/default.nix4
-rw-r--r--pkgs/development/python-modules/rich/default.nix4
-rw-r--r--pkgs/development/python-modules/sagemaker/default.nix4
-rw-r--r--pkgs/development/python-modules/sasmodels/default.nix4
-rw-r--r--pkgs/development/python-modules/scmrepo/default.nix53
-rw-r--r--pkgs/development/python-modules/secretstorage/2.nix24
-rw-r--r--pkgs/development/python-modules/sense-energy/default.nix4
-rw-r--r--pkgs/development/python-modules/sentinels/default.nix36
-rw-r--r--pkgs/development/python-modules/sentry-sdk/default.nix4
-rw-r--r--pkgs/development/python-modules/shtab/default.nix55
-rw-r--r--pkgs/development/python-modules/socketio-client/default.nix39
-rw-r--r--pkgs/development/python-modules/sopel/default.nix4
-rw-r--r--pkgs/development/python-modules/spacy-loggers/default.nix34
-rw-r--r--pkgs/development/python-modules/spacy/default.nix8
-rw-r--r--pkgs/development/python-modules/speaklater3/default.nix23
-rw-r--r--pkgs/development/python-modules/surepy/default.nix3
-rw-r--r--pkgs/development/python-modules/tempest/default.nix11
-rw-r--r--pkgs/development/python-modules/teslajsonpy/default.nix4
-rw-r--r--pkgs/development/python-modules/transformers/default.nix4
-rw-r--r--pkgs/development/python-modules/treex/default.nix9
-rw-r--r--pkgs/development/python-modules/treex/relax-deps.patch16
-rw-r--r--pkgs/development/python-modules/twinkly-client/default.nix15
-rw-r--r--pkgs/development/python-modules/types-freezegun/default.nix24
-rw-r--r--pkgs/development/python-modules/types-tabulate/default.nix24
-rw-r--r--pkgs/development/python-modules/wtforms/default.nix18
-rw-r--r--pkgs/development/python-modules/yalexs/default.nix4
-rw-r--r--pkgs/development/python2-modules/Pygments/default.nix (renamed from pkgs/development/python-modules/Pygments/2_5.nix)0
-rw-r--r--pkgs/development/python2-modules/TurboCheetah/default.nix (renamed from pkgs/development/python-modules/TurboCheetah/default.nix)0
-rw-r--r--pkgs/development/python2-modules/bootstrapped-pip/default.nix (renamed from pkgs/development/python-modules/bootstrapped-pip/2.nix)0
-rw-r--r--pkgs/development/python2-modules/boto3/default.nix (renamed from pkgs/development/python-modules/boto3/1_17.nix)0
-rw-r--r--pkgs/development/python2-modules/botocore/default.nix (renamed from pkgs/development/python-modules/botocore/1_20.nix)0
-rw-r--r--pkgs/development/python2-modules/certifi/default.nix (renamed from pkgs/development/python-modules/certifi/python2.nix)0
-rw-r--r--pkgs/development/python2-modules/chardet/default.nix (renamed from pkgs/development/python-modules/chardet/2.nix)0
-rw-r--r--pkgs/development/python2-modules/cheetah/default.nix (renamed from pkgs/development/python-modules/cheetah/default.nix)0
-rw-r--r--pkgs/development/python2-modules/click/default.nix (renamed from pkgs/development/python-modules/click/7.nix)0
-rw-r--r--pkgs/development/python2-modules/configparser/default.nix (renamed from pkgs/development/python-modules/configparser/4.nix)0
-rw-r--r--pkgs/development/python2-modules/construct/default.nix (renamed from pkgs/development/python-modules/construct/2.10.54.nix)0
-rw-r--r--pkgs/development/python2-modules/contextlib2/default.nix (renamed from pkgs/development/python-modules/contextlib2/0.nix)0
-rw-r--r--pkgs/development/python2-modules/cryptography-vectors/default.nix (renamed from pkgs/development/python-modules/cryptography/vectors-3.3.nix)0
-rw-r--r--pkgs/development/python2-modules/cryptography/default.nix (renamed from pkgs/development/python-modules/cryptography/3.3.nix)0
-rw-r--r--pkgs/development/python2-modules/decorator/default.nix (renamed from pkgs/development/python-modules/decorator/4.nix)0
-rw-r--r--pkgs/development/python2-modules/enum/default.nix (renamed from pkgs/development/python-modules/enum/default.nix)0
-rw-r--r--pkgs/development/python2-modules/filelock/default.nix (renamed from pkgs/development/python-modules/filelock/3.2.nix)0
-rw-r--r--pkgs/development/python2-modules/flask/default.nix (renamed from pkgs/development/python-modules/flask/1.nix)0
-rw-r--r--pkgs/development/python2-modules/freezegun/default.nix (renamed from pkgs/development/python-modules/freezegun/0.3.nix)0
-rw-r--r--pkgs/development/python2-modules/futures/default.nix (renamed from pkgs/development/python-modules/futures/default.nix)0
-rw-r--r--pkgs/development/python2-modules/google-apputils/default.nix (renamed from pkgs/development/python-modules/google-apputils/default.nix)0
-rw-r--r--pkgs/development/python2-modules/httpretty/default.nix (renamed from pkgs/development/python-modules/httpretty/0.nix)0
-rw-r--r--pkgs/development/python2-modules/hypothesis/default.nix (renamed from pkgs/development/python-modules/hypothesis/2.nix)0
-rw-r--r--pkgs/development/python2-modules/idna/default.nix (renamed from pkgs/development/python-modules/idna/2.nix)0
-rw-r--r--pkgs/development/python2-modules/importlib-metadata/default.nix (renamed from pkgs/development/python-modules/importlib-metadata/2.nix)0
-rw-r--r--pkgs/development/python2-modules/ipaddr/default.nix (renamed from pkgs/development/python-modules/ipaddr/default.nix)0
-rw-r--r--pkgs/development/python2-modules/itsdangerous/default.nix (renamed from pkgs/development/python-modules/itsdangerous/1.nix)0
-rw-r--r--pkgs/development/python2-modules/jinja2/default.nix (renamed from pkgs/development/python-modules/jinja2/2.nix)0
-rw-r--r--pkgs/development/python2-modules/libcloud/default.nix (renamed from pkgs/development/python-modules/libcloud/2.nix)0
-rw-r--r--pkgs/development/python2-modules/lpod/default.nix (renamed from pkgs/development/python-modules/lpod/default.nix)0
-rw-r--r--pkgs/development/python2-modules/marisa/default.nix (renamed from pkgs/development/python-modules/marisa/default.nix)0
-rw-r--r--pkgs/development/python2-modules/markdown/default.nix (renamed from pkgs/development/python-modules/markdown/3_1.nix)0
-rw-r--r--pkgs/development/python2-modules/markupsafe/default.nix (renamed from pkgs/development/python-modules/markupsafe/1.nix)0
-rw-r--r--pkgs/development/python2-modules/mock/default.nix (renamed from pkgs/development/python-modules/mock/2.nix)0
-rw-r--r--pkgs/development/python2-modules/more-itertools/default.nix (renamed from pkgs/development/python-modules/more-itertools/2.7.nix)0
-rw-r--r--pkgs/development/python2-modules/mutagen/default.nix (renamed from pkgs/development/python-modules/mutagen/1.43.nix)0
-rw-r--r--pkgs/development/python2-modules/numpy/default.nix (renamed from pkgs/development/python-modules/numpy/1.16.nix)2
-rw-r--r--pkgs/development/python2-modules/numpy/numpy-distutils-C++.patch (renamed from pkgs/development/python-modules/numpy/numpy-distutils-C++_1.16.patch)0
-rw-r--r--pkgs/development/python2-modules/packaging/default.nix (renamed from pkgs/development/python-modules/packaging/2.nix)0
-rw-r--r--pkgs/development/python2-modules/pillow/default.nix (renamed from pkgs/development/python-modules/pillow/6.nix)0
-rw-r--r--pkgs/development/python2-modules/pillow/generic.nix77
-rw-r--r--pkgs/development/python2-modules/pip/default.nix (renamed from pkgs/development/python-modules/pip/20.nix)0
-rw-r--r--pkgs/development/python2-modules/pluggy/default.nix (renamed from pkgs/development/python-modules/pluggy/0.nix)0
-rw-r--r--pkgs/development/python2-modules/prettytable/default.nix (renamed from pkgs/development/python-modules/prettytable/1.nix)0
-rw-r--r--pkgs/development/python2-modules/protobuf/default.nix59
-rw-r--r--pkgs/development/python2-modules/pycairo/default.nix (renamed from pkgs/development/python-modules/pycairo/1.18.nix)0
-rw-r--r--pkgs/development/python2-modules/pygobject/default.nix (renamed from pkgs/development/python-modules/pygobject/3.36.nix)0
-rw-r--r--pkgs/development/python2-modules/pygtk/default.nix (renamed from pkgs/development/python-modules/pygtk/default.nix)0
-rw-r--r--pkgs/development/python2-modules/pyjwt/default.nix (renamed from pkgs/development/python-modules/pyjwt/1.nix)0
-rw-r--r--pkgs/development/python2-modules/pyroma/default.nix (renamed from pkgs/development/python-modules/pyroma/2.nix)0
-rw-r--r--pkgs/development/python2-modules/pysqlite/default.nix (renamed from pkgs/development/python-modules/pysqlite/default.nix)0
-rw-r--r--pkgs/development/python2-modules/pytest-runner/default.nix (renamed from pkgs/development/python-modules/pytest-runner/2.nix)0
-rw-r--r--pkgs/development/python2-modules/pytest-xdist/default.nix (renamed from pkgs/development/python-modules/pytest-xdist/1.nix)0
-rw-r--r--pkgs/development/python2-modules/pytest/default.nix (renamed from pkgs/development/python-modules/pytest/4.nix)0
-rw-r--r--pkgs/development/python2-modules/pyyaml/default.nix (renamed from pkgs/development/python-modules/pyyaml/5.nix)0
-rw-r--r--pkgs/development/python2-modules/qpid-python/default.nix (renamed from pkgs/development/python-modules/qpid-python/default.nix)0
-rw-r--r--pkgs/development/python2-modules/s3transfer/default.nix (renamed from pkgs/development/python-modules/s3transfer/0_4.nix)0
-rw-r--r--pkgs/development/python2-modules/scandir/default.nix (renamed from pkgs/development/python-modules/scandir/default.nix)0
-rw-r--r--pkgs/development/python2-modules/setuptools-scm/default.nix (renamed from pkgs/development/python-modules/setuptools-scm/2.nix)0
-rw-r--r--pkgs/development/python2-modules/setuptools/default.nix (renamed from pkgs/development/python-modules/setuptools/44.0.nix)0
-rw-r--r--pkgs/development/python2-modules/setuptools/tag-date.patch12
-rw-r--r--pkgs/development/python2-modules/sphinx/default.nix (renamed from pkgs/development/python-modules/sphinx/2.nix)0
-rw-r--r--pkgs/development/python2-modules/sphinx/python2-lexer.patch (renamed from pkgs/development/python-modules/sphinx/python2-lexer.patch)0
-rw-r--r--pkgs/development/python2-modules/sphinxcontrib-websupport/default.nix (renamed from pkgs/development/python-modules/sphinxcontrib-websupport/1_1.nix)0
-rw-r--r--pkgs/development/python2-modules/typing/default.nix (renamed from pkgs/development/python-modules/typing/default.nix)0
-rw-r--r--pkgs/development/python2-modules/urllib3/default.nix (renamed from pkgs/development/python-modules/urllib3/2.nix)0
-rw-r--r--pkgs/development/python2-modules/vcrpy/default.nix (renamed from pkgs/development/python-modules/vcrpy/3.nix)0
-rw-r--r--pkgs/development/python2-modules/werkzeug/default.nix (renamed from pkgs/development/python-modules/werkzeug/1.nix)0
-rw-r--r--pkgs/development/python2-modules/wsproto/default.nix (renamed from pkgs/development/python-modules/wsproto/0.14.nix)0
-rw-r--r--pkgs/development/python2-modules/wxPython/default.nix (renamed from pkgs/development/python-modules/wxPython/3.0.nix)0
-rw-r--r--pkgs/development/python2-modules/zipp/default.nix (renamed from pkgs/development/python-modules/zipp/1.nix)0
-rw-r--r--pkgs/development/r-modules/wrapper-rstudio.nix56
-rw-r--r--pkgs/development/tools/ammonite/default.nix6
-rw-r--r--pkgs/development/tools/analysis/checkov/default.nix5
-rw-r--r--pkgs/development/tools/analysis/oclgrind/default.nix4
-rw-r--r--pkgs/development/tools/analysis/qcachegrind/default.nix4
-rw-r--r--pkgs/development/tools/analysis/rizin/cutter.nix4
-rw-r--r--pkgs/development/tools/analysis/rizin/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/mill/default.nix4
-rw-r--r--pkgs/development/tools/continuous-integration/jenkins/default.nix4
-rw-r--r--pkgs/development/tools/cue/default.nix20
-rw-r--r--pkgs/development/tools/database/pyrseas/default.nix16
-rw-r--r--pkgs/development/tools/misc/gpuvis/default.nix7
-rw-r--r--pkgs/development/tools/misc/uncrustify/default.nix4
-rw-r--r--pkgs/development/tools/mold/default.nix1
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/default.nix1
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-org.json11
-rw-r--r--pkgs/development/tools/phantomjs2/default.nix4
-rw-r--r--pkgs/development/tools/pipenv/default.nix10
-rw-r--r--pkgs/development/tools/pur/default.nix3
-rw-r--r--pkgs/development/tools/udis86/default.nix4
-rw-r--r--pkgs/development/tools/winpdb/default.nix6
-rw-r--r--pkgs/development/web/deno/default.nix6
-rw-r--r--pkgs/games/amoeba/default.nix2
-rw-r--r--pkgs/games/among-sus/default.nix6
-rw-r--r--pkgs/games/blackshades/default.nix20
-rw-r--r--pkgs/games/crawl/default.nix2
-rw-r--r--pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix3
-rw-r--r--pkgs/games/dwarf-fortress/unfuck.nix3
-rw-r--r--pkgs/games/dwarf-fortress/wrapper/default.nix3
-rw-r--r--pkgs/games/gnubg/default.nix6
-rw-r--r--pkgs/games/heroic/default.nix2
-rw-r--r--pkgs/games/hhexen/default.nix2
-rw-r--r--pkgs/games/instead/default.nix7
-rw-r--r--pkgs/games/legendary-gl/default.nix4
-rw-r--r--pkgs/games/moon-buggy/default.nix5
-rw-r--r--pkgs/games/n2048/default.nix31
-rw-r--r--pkgs/games/nethack/default.nix6
-rw-r--r--pkgs/games/openra/common.nix6
-rw-r--r--pkgs/games/planetaryannihilation/default.nix25
-rw-r--r--pkgs/games/tennix/default.nix4
-rw-r--r--pkgs/games/tlauncher/default.nix100
-rw-r--r--pkgs/games/xconq/default.nix5
-rw-r--r--pkgs/misc/emulators/fceux/default.nix4
-rw-r--r--pkgs/misc/emulators/retrofe/default.nix4
-rw-r--r--pkgs/misc/emulators/ryujinx/default.nix8
-rw-r--r--pkgs/misc/emulators/wxmupen64plus/default.nix4
-rw-r--r--pkgs/misc/screensavers/xtrlock-pam/default.nix4
-rw-r--r--pkgs/misc/vim-plugins/overrides.nix10
-rw-r--r--pkgs/misc/vscode-extensions/default.nix46
-rw-r--r--pkgs/misc/vscode-extensions/language-packs.nix89
-rw-r--r--pkgs/misc/vscode-extensions/vscode-utils.nix4
-rw-r--r--pkgs/os-specific/linux/fbterm/default.nix28
-rw-r--r--pkgs/os-specific/linux/hostapd/default.nix40
-rw-r--r--pkgs/os-specific/linux/kernel/perf.nix3
-rw-r--r--pkgs/os-specific/linux/klibc/default.nix4
-rw-r--r--pkgs/os-specific/linux/kmod-debian-aliases/default.nix2
-rw-r--r--pkgs/os-specific/linux/libevdevc/default.nix2
-rw-r--r--pkgs/os-specific/linux/libgestures/default.nix2
-rw-r--r--pkgs/os-specific/linux/net-tools/mptcp.nix2
-rw-r--r--pkgs/os-specific/linux/pam_usb/default.nix4
-rw-r--r--pkgs/os-specific/linux/pflask/default.nix4
-rw-r--r--pkgs/os-specific/linux/pommed-light/default.nix5
-rw-r--r--pkgs/os-specific/linux/sinit/default.nix39
-rw-r--r--pkgs/os-specific/linux/smem/default.nix4
-rw-r--r--pkgs/os-specific/linux/speedometer/default.nix6
-rw-r--r--pkgs/os-specific/linux/statifier/default.nix6
-rw-r--r--pkgs/os-specific/linux/sysvinit/default.nix7
-rw-r--r--pkgs/os-specific/linux/tmon/default.nix3
-rw-r--r--pkgs/os-specific/linux/uclibc/default.nix2
-rw-r--r--pkgs/os-specific/linux/unstick/default.nix4
-rw-r--r--pkgs/os-specific/linux/wpa_supplicant/default.nix35
-rw-r--r--pkgs/os-specific/linux/x86info/default.nix4
-rw-r--r--pkgs/servers/adguardhome/default.nix3
-rw-r--r--pkgs/servers/alps/default.nix24
-rw-r--r--pkgs/servers/amqp/rabbitmq-server/default.nix4
-rw-r--r--pkgs/servers/computing/storm/default.nix8
-rw-r--r--pkgs/servers/home-assistant/component-packages.nix2
-rw-r--r--pkgs/servers/home-assistant/default.nix4
-rw-r--r--pkgs/servers/http/lighttpd/default.nix17
-rw-r--r--pkgs/servers/keycloak/default.nix4
-rw-r--r--pkgs/servers/mapserver/default.nix4
-rw-r--r--pkgs/servers/matrix-synapse/default.nix5
-rw-r--r--pkgs/servers/mattermost/default.nix6
-rw-r--r--pkgs/servers/mautrix-facebook/default.nix16
-rw-r--r--pkgs/servers/mautrix-whatsapp/default.nix6
-rw-r--r--pkgs/servers/misc/oven-media-engine/default.nix30
-rw-r--r--pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix35
-rw-r--r--pkgs/servers/nats-server/default.nix4
-rw-r--r--pkgs/servers/nats-streaming-server/default.nix4
-rw-r--r--pkgs/servers/nosql/apache-jena/binary.nix33
-rw-r--r--pkgs/servers/nosql/apache-jena/fuseki-binary.nix32
-rw-r--r--pkgs/servers/ombi/default.nix8
-rwxr-xr-xpkgs/servers/ombi/update.sh2
-rw-r--r--pkgs/servers/plex/raw.nix6
-rw-r--r--pkgs/servers/sickbeard/sickgear.nix4
-rw-r--r--pkgs/servers/sql/postgresql/ext/plv8.nix44
-rw-r--r--pkgs/servers/sql/postgresql/packages.nix4
-rw-r--r--pkgs/servers/sql/proxysql/default.nix4
-rw-r--r--pkgs/servers/tailscale/default.nix6
-rw-r--r--pkgs/servers/tvheadend/default.nix4
-rw-r--r--pkgs/servers/web-apps/lemmy/package.json40
-rw-r--r--pkgs/servers/web-apps/lemmy/pin.json10
-rw-r--r--pkgs/servers/web-apps/lemmy/server.nix5
-rw-r--r--pkgs/servers/x11/xorg/default.nix15
-rwxr-xr-xpkgs/servers/x11/xorg/generate-expr-from-tarballs.pl3
-rw-r--r--pkgs/servers/x11/xorg/tarballs.list1
-rw-r--r--pkgs/shells/zsh/zsh-git-prompt/default.nix4
-rw-r--r--pkgs/tools/X11/opentabletdriver/default.nix27
-rw-r--r--pkgs/tools/X11/opentabletdriver/deps.nix36
-rwxr-xr-xpkgs/tools/X11/opentabletdriver/update.sh2
-rw-r--r--pkgs/tools/admin/pulumi/data.nix98
-rwxr-xr-xpkgs/tools/admin/pulumi/update.sh143
-rw-r--r--pkgs/tools/audio/abcmidi/default.nix4
-rw-r--r--pkgs/tools/backup/kopia/default.nix6
-rw-r--r--pkgs/tools/backup/tsm-client/default.nix112
-rw-r--r--pkgs/tools/backup/tsm-client/test-cli.nix58
-rw-r--r--pkgs/tools/backup/zrepl/default.nix6
-rw-r--r--pkgs/tools/cd-dvd/brasero/default.nix4
-rw-r--r--pkgs/tools/filesystems/btrfs-progs/default.nix18
-rw-r--r--pkgs/tools/filesystems/fuse-overlayfs/default.nix4
-rw-r--r--pkgs/tools/filesystems/xtreemfs/default.nix4
-rw-r--r--pkgs/tools/games/opentracker/default.nix3
-rw-r--r--pkgs/tools/graphics/barcode/default.nix10
-rw-r--r--pkgs/tools/misc/csvs-to-sqlite/default.nix3
-rw-r--r--pkgs/tools/misc/diffoscope/default.nix19
-rw-r--r--pkgs/tools/misc/flameshot/default.nix22
-rw-r--r--pkgs/tools/misc/grub/trusted.nix4
-rw-r--r--pkgs/tools/misc/inav-blackbox-tools/default.nix1
-rw-r--r--pkgs/tools/misc/lsd/default.nix23
-rw-r--r--pkgs/tools/misc/nncp/default.nix4
-rw-r--r--pkgs/tools/misc/opentsdb/default.nix4
-rw-r--r--pkgs/tools/misc/pferd/default.nix4
-rw-r--r--pkgs/tools/misc/rpm-ostree/default.nix4
-rw-r--r--pkgs/tools/misc/snapper/default.nix4
-rw-r--r--pkgs/tools/misc/yle-dl/default.nix4
-rw-r--r--pkgs/tools/networking/eternal-terminal/default.nix35
-rw-r--r--pkgs/tools/networking/nss-pam-ldapd/default.nix4
-rw-r--r--pkgs/tools/networking/openvpn/default.nix6
-rw-r--r--pkgs/tools/networking/philter/default.nix4
-rw-r--r--pkgs/tools/networking/pssh/default.nix4
-rw-r--r--pkgs/tools/networking/py-wmi-client/default.nix6
-rw-r--r--pkgs/tools/networking/telepresence2/default.nix6
-rw-r--r--pkgs/tools/networking/weighttp/default.nix4
-rw-r--r--pkgs/tools/security/firefox_decrypt/default.nix45
-rwxr-xr-xpkgs/tools/security/firefox_decrypt/update.sh49
-rw-r--r--pkgs/tools/security/solo2-cli/default.nix48
-rw-r--r--pkgs/tools/security/volatility/default.nix6
-rw-r--r--pkgs/tools/system/btop/default.nix5
-rw-r--r--pkgs/tools/system/collectd/plugins.nix4
-rw-r--r--pkgs/tools/system/ps_mem/default.nix4
-rw-r--r--pkgs/tools/system/rsyslog/default.nix4
-rw-r--r--pkgs/tools/system/syslog-ng-incubator/default.nix4
-rw-r--r--pkgs/tools/system/syslog-ng/default.nix4
-rw-r--r--pkgs/tools/text/mdcat/default.nix6
-rw-r--r--pkgs/tools/text/opencc/default.nix4
-rw-r--r--pkgs/tools/text/shocco/default.nix4
-rw-r--r--pkgs/tools/text/txt2tags/default.nix6
-rw-r--r--pkgs/tools/typesetting/odpdown/default.nix8
-rw-r--r--pkgs/tools/video/vnc2flv/default.nix4
-rw-r--r--pkgs/tools/virtualization/cri-tools/default.nix4
-rw-r--r--pkgs/tools/virtualization/xe-guest-utilities/default.nix4
-rw-r--r--pkgs/top-level/aliases.nix7
-rw-r--r--pkgs/top-level/all-packages.nix247
-rw-r--r--pkgs/top-level/kodi-packages.nix7
-rw-r--r--pkgs/top-level/python-aliases.nix1
-rw-r--r--pkgs/top-level/python-packages.nix101
-rw-r--r--pkgs/top-level/python2-packages.nix144
-rw-r--r--pkgs/top-level/release.nix19
539 files changed, 8528 insertions, 4355 deletions
diff --git a/doc/languages-frameworks/dotnet.section.md b/doc/languages-frameworks/dotnet.section.md
index 88e1a0b2959..f7af28a1677 100644
--- a/doc/languages-frameworks/dotnet.section.md
+++ b/doc/languages-frameworks/dotnet.section.md
@@ -84,7 +84,7 @@ To package Dotnet applications, you can use `buildDotnetModule`. This has simila
      <ProjectReference Include="../foo/bar.fsproj" />
      <PackageReference Include="bar" Version="*" Condition=" '$(ContinuousIntegrationBuild)'=='true' "/>
   ```
-* `executables` is used to specify which executables get wrapped to `$out/bin`, relative to `$out/lib/$pname`. If this is unset, all executables generated will get installed. If you do not want to install any, set this to `[]`.
+* `executables` is used to specify which executables get wrapped to `$out/bin`, relative to `$out/lib/$pname`. If this is unset, all executables generated will get installed. If you do not want to install any, set this to `[]`. This gets done in the `preFixup` phase.
 * `runtimeDeps` is used to wrap libraries into `LD_LIBRARY_PATH`. This is how dotnet usually handles runtime dependencies.
 * `buildType` is used to change the type of build. Possible values are `Release`, `Debug`, etc. By default, this is set to `Release`.
 * `dotnet-sdk` is useful in cases where you need to change what dotnet SDK is being used.
diff --git a/lib/asserts.nix b/lib/asserts.nix
index 8a5f1fb3feb..9ae357cbc93 100644
--- a/lib/asserts.nix
+++ b/lib/asserts.nix
@@ -2,35 +2,33 @@
 
 rec {
 
-  /* Print a trace message if pred is false.
+  /* Throw if pred is false, else return pred.
      Intended to be used to augment asserts with helpful error messages.
 
      Example:
        assertMsg false "nope"
-       => false
-       stderr> trace: nope
+       stderr> error: nope
 
-       assert (assertMsg ("foo" == "bar") "foo is not bar, silly"); ""
-       stderr> trace: foo is not bar, silly
-       stderr> assert failed at …
+       assert assertMsg ("foo" == "bar") "foo is not bar, silly"; ""
+       stderr> error: foo is not bar, silly
 
      Type:
        assertMsg :: Bool -> String -> Bool
   */
   # TODO(Profpatsch): add tests that check stderr
   assertMsg = pred: msg:
-    if pred
-    then true
-    else builtins.trace msg false;
+    pred || builtins.throw msg;
 
   /* Specialized `assertMsg` for checking if val is one of the elements
      of a list. Useful for checking enums.
 
      Example:
-       let sslLibrary = "libressl"
+       let sslLibrary = "libressl";
        in assertOneOf "sslLibrary" sslLibrary [ "openssl" "bearssl" ]
-       => false
-       stderr> trace: sslLibrary must be one of "openssl", "bearssl", but is: "libressl"
+       stderr> error: sslLibrary must be one of [
+       stderr>   "openssl"
+       stderr>   "bearssl"
+       stderr> ], but is: "libressl"
 
      Type:
        assertOneOf :: String -> ComparableVal -> List ComparableVal -> Bool
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index c71741ac900..190a8146ffa 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1950,6 +1950,12 @@
     githubId = 543423;
     name = "Alex Wied";
   };
+  cfhammill = {
+    email = "cfhammill@gmail.com";
+    github = "cfhammill";
+    githubId = 7467038;
+    name = "Chris Hammill";
+  };
   cfouche = {
     email = "chaddai.fouche@gmail.com";
     github = "Chaddai";
@@ -4250,6 +4256,16 @@
     githubId = 1313787;
     name = "Gabriel Gonzalez";
   };
+  gador = {
+    email = "florian.brandes@posteo.de";
+    github = "gador";
+    githubId = 1883533;
+    name = "Florian Brandes";
+    keys = [{
+      longkeyid = "rsa4096/0xBBB3E40E53797FD9";
+      fingerprint = "0200 3EF8 8D2B CF2D 8F00  FFDC BBB3 E40E 5379 7FD9";
+    }];
+  };
   gal_bolle = {
     email = "florent.becker@ens-lyon.org";
     github = "FlorentBecker";
@@ -4449,6 +4465,16 @@
     githubId = 1621335;
     name = "Andrew Trachenko";
   };
+  gordias = {
+    name = "Gordias";
+    email = "gordias@disroot.org";
+    github = "NotGordias";
+    githubId = 94724133;
+    keys = [{
+      longkeyid = "ed25519/0x5D47284830FAA4FA";
+      fingerprint = "C006 B8A0 0618 F3B6 E0E4  2ECD 5D47 2848 30FA A4FA";
+    }];
+  };
   govanify = {
     name = "Gauvain 'GovanifY' Roussel-Tarbouriech";
     email = "gauvain@govanify.com";
@@ -8498,10 +8524,10 @@
     name = "Xinhao Luo";
   };
   newam = {
-    email = "alexmgit@protonmail.com";
+    email = "alex@thinglab.org";
     github = "newAM";
     githubId = 7845120;
-    name = "Alex M.";
+    name = "Alex Martens";
   };
   nikitavoloboev = {
     email = "nikita.voloboev@gmail.com";
@@ -9814,6 +9840,13 @@
     githubId = 1016742;
     name = "Rafael García";
   };
+  raitobezarius = {
+    email = "ryan@lahfa.xyz";
+    matrix = "@raitobezarius:matrix.org";
+    github = "RaitoBezarius";
+    githubId = 314564;
+    name = "Ryan Lahfa";
+  };
   raquelgb = {
     email = "raquel.garcia.bautista@gmail.com";
     github = "raquelgb";
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index c453d9762d1..ce45b0d7977 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -32,10 +32,14 @@
       </listitem>
       <listitem>
         <para>
-          Mattermost has been updated to version 6.2. Migrations may
-          take a while, see the
-          <link xlink:href="https://docs.mattermost.com/install/self-managed-changelog.html#release-v6.2-feature-release">upgrade
-          notes</link>.
+          Mattermost has been updated to extended support release 6.3,
+          as the previously packaged extended support release 5.37 is
+          <link xlink:href="https://docs.mattermost.com/upgrade/extended-support-release.html">reaching
+          its end of life</link>. Migrations may take a while, see the
+          <link xlink:href="https://docs.mattermost.com/install/self-managed-changelog.html#release-v6-3-extended-support-release">changelog</link>
+          and
+          <link xlink:href="https://docs.mattermost.com/upgrade/important-upgrade-notes.html">important
+          upgrade notes</link>.
         </para>
       </listitem>
     </itemizedlist>
@@ -165,6 +169,14 @@
           <link xlink:href="options.html#opt-services.timetagger.enable">services.timetagger</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://www.rstudio.com/products/rstudio/#rstudio-server">rstudio-server</link>,
+          a browser-based version of the RStudio IDE for the R
+          programming language. Available as
+          <link xlink:href="options.html#opt-services.rstudio-server.enable">services.rstudio-server</link>.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-22.05-incompatibilities">
@@ -357,6 +369,57 @@
           <literal>~/.local/share/polymc/polymc.cfg</literal>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <literal>pkgs.noto-fonts-cjk</literal> is now deprecated in
+          favor of <literal>pkgs.noto-fonts-cjk-sans</literal> and
+          <literal>pkgs.noto-fonts-cjk-serif</literal> because they each
+          have different release schedules. To maintain compatibility
+          with prior releases of Nixpkgs,
+          <literal>pkgs.noto-fonts-cjk</literal> is currently an alias
+          of <literal>pkgs.noto-fonts-cjk-sans</literal> and doesn’t
+          include serif fonts.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The interface that allows activation scripts to restart units
+          has been reworked. Restarting and reloading is now done by a
+          single file
+          <literal>/run/nixos/activation-restart-list</literal> that
+          honors <literal>restartIfChanged</literal> and
+          <literal>reloadIfChanged</literal> of the units.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>services.bookstack.cacheDir</literal> option has
+          been removed, since the cache directory is now handled by
+          systemd.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>services.bookstack.extraConfig</literal> option
+          has been replaced by
+          <literal>services.bookstack.config</literal> which implements
+          a
+          <link xlink:href="https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md">settings-style</link>
+          configuration.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>lib.assertMsg</literal> and
+          <literal>lib.assertOneOf</literal> no longer return
+          <literal>false</literal> if the passed condition is
+          <literal>false</literal>, <literal>throw</literal>ing the
+          given error message instead (which makes the resulting error
+          message less cluttered). This will not impact the behaviour of
+          code using these functions as intended, namely as top-level
+          wrapper for <literal>assert</literal> conditions.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-22.05-notable-changes">
@@ -502,6 +565,14 @@
       </listitem>
       <listitem>
         <para>
+          The <literal>services.mbpfan</literal> module was converted to
+          a
+          <link xlink:href="https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md">RFC
+          0042</link> configuration.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           A new module was added for the
           <link xlink:href="https://starship.rs/">Starship</link> shell
           prompt, providing the options
@@ -509,6 +580,49 @@
           <literal>programs.starship.settings</literal>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <literal>services.mattermost.plugins</literal> has been added
+          to allow the declarative installation of Mattermost plugins.
+          Plugins are automatically repackaged using autoPatchelf.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>zrepl</literal> package has been updated from
+          0.4.0 to 0.5:
+        </para>
+        <itemizedlist spacing="compact">
+          <listitem>
+            <para>
+              The RPC protocol version was bumped; all zrepl daemons in
+              a setup must be updated and restarted before replication
+              can resume.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              A bug involving encrypt-on-receive has been fixed. Read
+              the
+              <link xlink:href="https://zrepl.github.io/configuration/sendrecvoptions.html#job-recv-options-placeholder">zrepl
+              documentation</link> and check the output of
+              <literal>zfs get -r encryption,zrepl:placeholder PATH_TO_ROOTFS</literal>
+              on the receiver.
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
+          Renamed option
+          <literal>services.openssh.challengeResponseAuthentication</literal>
+          to
+          <literal>services.openssh.kbdInteractiveAuthentication</literal>.
+          Reason is that the old name has been deprecated upstream.
+          Using the old option name will still work, but produce a
+          warning.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
 </section>
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md
index 88ceb902bb6..25b3ada2c56 100644
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -13,8 +13,9 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - PHP 8.1 is now available
 
-- Mattermost has been updated to version 6.2. Migrations may take a while,
-  see the [upgrade notes](https://docs.mattermost.com/install/self-managed-changelog.html#release-v6.2-feature-release).
+- Mattermost has been updated to extended support release 6.3, as the previously packaged extended support release 5.37 is [reaching its end of life](https://docs.mattermost.com/upgrade/extended-support-release.html).
+  Migrations may take a while, see the [changelog](https://docs.mattermost.com/install/self-managed-changelog.html#release-v6-3-extended-support-release)
+  and [important upgrade notes](https://docs.mattermost.com/upgrade/important-upgrade-notes.html).
 
 ## New Services {#sec-release-22.05-new-services}
 
@@ -50,6 +51,10 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [timetagger](https://timetagger.app), an open source time-tracker with an intuitive user experience and powerful reporting. [services.timetagger](options.html#opt-services.timetagger.enable).
 
+- [rstudio-server](https://www.rstudio.com/products/rstudio/#rstudio-server), a browser-based version of the RStudio IDE for the R programming language. Available as [services.rstudio-server](options.html#opt-services.rstudio-server.enable).
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
 ## Backward Incompatibilities {#sec-release-22.05-incompatibilities}
 
 - `pkgs.ghc` now refers to `pkgs.targetPackages.haskellPackages.ghc`.
@@ -111,6 +116,26 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - MultiMC has been replaced with the fork PolyMC due to upstream developers being hostile to 3rd party package maintainers. PolyMC removes all MultiMC branding and is aimed at providing proper 3rd party packages like the one contained in Nixpkgs. This change affects the data folder where game instances and other save and configuration files are stored. Users with existing installations should rename `~/.local/share/multimc` to `~/.local/share/polymc`. The main config file's path has also moved from `~/.local/share/multimc/multimc.cfg` to `~/.local/share/polymc/polymc.cfg`.
 
+- `pkgs.noto-fonts-cjk` is now deprecated in favor of `pkgs.noto-fonts-cjk-sans`
+  and `pkgs.noto-fonts-cjk-serif` because they each have different release
+  schedules. To maintain compatibility with prior releases of Nixpkgs,
+  `pkgs.noto-fonts-cjk` is currently an alias of `pkgs.noto-fonts-cjk-sans` and
+  doesn't include serif fonts.
+
+- The interface that allows activation scripts to restart units has been reworked. Restarting and reloading is now done by a single file `/run/nixos/activation-restart-list` that honors `restartIfChanged` and `reloadIfChanged` of the units.
+
+- The `services.bookstack.cacheDir` option has been removed, since the
+  cache directory is now handled by systemd.
+
+- The `services.bookstack.extraConfig` option has been replaced by
+  `services.bookstack.config` which implements a
+  [settings-style](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md)
+  configuration.
+
+- `lib.assertMsg` and `lib.assertOneOf` no longer return `false` if the passed condition is `false`, `throw`ing the given error message instead (which makes the resulting error message less cluttered). This will not impact the behaviour of code using these functions as intended, namely as top-level wrapper for `assert` conditions.
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
 ## Other Notable Changes {#sec-release-22.05-notable-changes}
 
 - The option [services.redis.servers](#opt-services.redis.servers) was added
@@ -173,5 +198,20 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The `firmwareLinuxNonfree` package has been renamed to `linux-firmware`.
 
+- The `services.mbpfan` module was converted to a [RFC 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md) configuration.
+
 - A new module was added for the [Starship](https://starship.rs/) shell prompt,
   providing the options `programs.starship.enable` and `programs.starship.settings`.
+
+- `services.mattermost.plugins` has been added to allow the declarative installation of Mattermost plugins.
+  Plugins are automatically repackaged using autoPatchelf.
+
+- The `zrepl` package has been updated from 0.4.0 to 0.5:
+    * The RPC protocol version was bumped; all zrepl daemons in a setup must be updated and restarted before replication can resume.
+    * A bug involving encrypt-on-receive has been fixed.  Read the [zrepl documentation](https://zrepl.github.io/configuration/sendrecvoptions.html#job-recv-options-placeholder) and check the output of `zfs get -r encryption,zrepl:placeholder PATH_TO_ROOTFS` on the receiver.
+
+- Renamed option `services.openssh.challengeResponseAuthentication` to `services.openssh.kbdInteractiveAuthentication`.
+  Reason is that the old name has been deprecated upstream.
+  Using the old option name will still work, but produce a warning.
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/config/malloc.nix b/nixos/modules/config/malloc.nix
index 84da5643004..a3fed33afa1 100644
--- a/nixos/modules/config/malloc.nix
+++ b/nixos/modules/config/malloc.nix
@@ -22,8 +22,15 @@ let
       '';
     };
 
-    scudo = {
-      libPath = "${pkgs.llvmPackages_latest.compiler-rt}/lib/linux/libclang_rt.scudo-x86_64.so";
+    scudo = let
+      platformMap = {
+        aarch64-linux = "aarch64";
+        x86_64-linux  = "x86_64";
+      };
+
+      systemPlatform = platformMap.${pkgs.stdenv.hostPlatform.system} or (throw "scudo not supported on ${pkgs.stdenv.hostPlatform.system}");
+    in {
+      libPath = "${pkgs.llvmPackages_latest.compiler-rt}/lib/linux/libclang_rt.scudo-${systemPlatform}.so";
       description = ''
         A user-mode allocator based on LLVM Sanitizer’s CombinedAllocator,
         which aims at providing additional mitigations against heap based
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index cad3ad01857..9d620084308 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -353,6 +353,7 @@ in
       distcc = 321;
       webdav = 322;
       pipewire = 323;
+      rstudio-server = 324;
 
       # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!
 
@@ -660,6 +661,7 @@ in
       distcc = 321;
       webdav = 322;
       pipewire = 323;
+      rstudio-server = 324;
 
       # When adding a gid, make sure it doesn't match an existing
       # uid. Users and groups with the same name should have equal
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 697ed4fad72..fdf93f2e17c 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -394,6 +394,7 @@
   ./services/development/hoogle.nix
   ./services/development/jupyter/default.nix
   ./services/development/jupyterhub/default.nix
+  ./services/development/rstudio-server/default.nix
   ./services/development/lorri.nix
   ./services/display-managers/greetd.nix
   ./services/editors/emacs.nix
@@ -967,6 +968,7 @@
   ./services/security/vault.nix
   ./services/security/vaultwarden/default.nix
   ./services/security/yubikey-agent.nix
+  ./services/system/cachix-agent/default.nix
   ./services/system/cloud-init.nix
   ./services/system/dbus.nix
   ./services/system/earlyoom.nix
diff --git a/nixos/modules/programs/chromium.nix b/nixos/modules/programs/chromium.nix
index 602253a321d..8a1653318ab 100644
--- a/nixos/modules/programs/chromium.nix
+++ b/nixos/modules/programs/chromium.nix
@@ -7,6 +7,7 @@ let
 
   defaultProfile = filterAttrs (k: v: v != null) {
     HomepageLocation = cfg.homepageLocation;
+    DefaultSearchProviderEnabled = cfg.defaultSearchProviderEnabled;
     DefaultSearchProviderSearchURL = cfg.defaultSearchProviderSearchURL;
     DefaultSearchProviderSuggestURL = cfg.defaultSearchProviderSuggestURL;
     ExtensionInstallForcelist = cfg.extensions;
@@ -50,6 +51,13 @@ in
         example = "https://nixos.org";
       };
 
+      defaultSearchProviderEnabled = mkOption {
+        type = types.nullOr types.bool;
+        description = "Enable the default search provider.";
+        default = null;
+        example = true;
+      };
+
       defaultSearchProviderSearchURL = mkOption {
         type = types.nullOr types.str;
         description = "Chromium default search provider url.";
diff --git a/nixos/modules/programs/tsm-client.nix b/nixos/modules/programs/tsm-client.nix
index 65d4db7834f..28db9625387 100644
--- a/nixos/modules/programs/tsm-client.nix
+++ b/nixos/modules/programs/tsm-client.nix
@@ -7,7 +7,7 @@ let
   inherit (lib.modules) mkDefault mkIf;
   inherit (lib.options) literalExpression mkEnableOption mkOption;
   inherit (lib.strings) concatStringsSep optionalString toLower;
-  inherit (lib.types) addCheck attrsOf lines nullOr package path port str strMatching submodule;
+  inherit (lib.types) addCheck attrsOf lines nonEmptyStr nullOr package path port str strMatching submodule;
 
   # Checks if given list of strings contains unique
   # elements when compared without considering case.
@@ -35,7 +35,7 @@ let
       '';
     };
     options.server = mkOption {
-      type = strMatching ".+";
+      type = nonEmptyStr;
       example = "tsmserver.company.com";
       description = ''
         Host/domain name or IP address of the IBM TSM server.
@@ -56,7 +56,7 @@ let
       '';
     };
     options.node = mkOption {
-      type = strMatching ".+";
+      type = nonEmptyStr;
       example = "MY-TSM-NODE";
       description = ''
         Target node name on the IBM TSM server.
@@ -144,7 +144,7 @@ let
     };
     config.name = mkDefault name;
     # Client system-options file directives are explained here:
-    # https://www.ibm.com/support/knowledgecenter/SSEQVQ_8.1.8/client/c_opt_usingopts.html
+    # https://www.ibm.com/docs/en/spectrum-protect/8.1.13?topic=commands-processing-options
     config.extraConfig =
       mapAttrs (lib.trivial.const mkDefault) (
         {
diff --git a/nixos/modules/services/backup/borgbackup.nix b/nixos/modules/services/backup/borgbackup.nix
index 220c571b927..2c307a701f3 100644
--- a/nixos/modules/services/backup/borgbackup.nix
+++ b/nixos/modules/services/backup/borgbackup.nix
@@ -30,7 +30,7 @@ let
     }
     trap 'on_exit' INT TERM QUIT EXIT
 
-    archiveName="${cfg.archiveBaseName}-$(date ${cfg.dateFormat})"
+    archiveName="${if cfg.archiveBaseName == null then "" else cfg.archiveBaseName + "-"}$(date ${cfg.dateFormat})"
     archiveSuffix="${optionalString cfg.appendFailedSuffix ".failed"}"
     ${cfg.preHook}
   '' + optionalString cfg.doInit ''
@@ -60,7 +60,7 @@ let
   '' + optionalString (cfg.prune.keep != { }) ''
     borg prune $extraArgs \
       ${mkKeepArgs cfg} \
-      --prefix ${escapeShellArg cfg.prune.prefix} \
+      ${optionalString (cfg.prune.prefix != null) "--prefix ${escapeShellArg cfg.prune.prefix} \\"}
       $extraPruneArgs
     ${cfg.postPrune}
   '';
@@ -99,7 +99,18 @@ let
         BORG_REPO = cfg.repo;
         inherit (cfg) extraArgs extraInitArgs extraCreateArgs extraPruneArgs;
       } // (mkPassEnv cfg) // cfg.environment;
-      inherit (cfg) startAt;
+    };
+
+  mkBackupTimers = name: cfg:
+    nameValuePair "borgbackup-job-${name}" {
+      description = "BorgBackup job ${name} timer";
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        Persistent = cfg.persistentTimer;
+        OnCalendar = cfg.startAt;
+      };
+      # if remote-backup wait for network
+      after = optional (cfg.persistentTimer && !isLocalPath cfg.repo) "network-online.target";
     };
 
   # utility function around makeWrapper
@@ -284,7 +295,7 @@ in {
           };
 
           archiveBaseName = mkOption {
-            type = types.strMatching "[^/{}]+";
+            type = types.nullOr (types.strMatching "[^/{}]+");
             default = "${globalConfig.networking.hostName}-${name}";
             defaultText = literalExpression ''"''${config.networking.hostName}-<name>"'';
             description = ''
@@ -292,6 +303,7 @@ in {
               determined by <option>dateFormat</option>, will be appended. The full
               name can be modified at runtime (<literal>$archiveName</literal>).
               Placeholders like <literal>{hostname}</literal> must not be used.
+              Use <literal>null</literal> for no base name.
             '';
           };
 
@@ -320,6 +332,19 @@ in {
             '';
           };
 
+          persistentTimer = mkOption {
+            default = false;
+            type = types.bool;
+            example = true;
+            description = literalDocBook ''
+              Set the <literal>persistentTimer</literal> option for the
+              <citerefentry><refentrytitle>systemd.timer</refentrytitle>
+              <manvolnum>5</manvolnum></citerefentry>
+              which triggers the backup immediately if the last trigger
+              was missed (e.g. if the system was powered down).
+            '';
+          };
+
           user = mkOption {
             type = types.str;
             description = ''
@@ -471,11 +496,11 @@ in {
           };
 
           prune.prefix = mkOption {
-            type = types.str;
+            type = types.nullOr (types.str);
             description = ''
               Only consider archive names starting with this prefix for pruning.
               By default, only archives created by this job are considered.
-              Use <literal>""</literal> to consider all archives.
+              Use <literal>""</literal> or <literal>null</literal> to consider all archives.
             '';
             default = config.archiveBaseName;
             defaultText = literalExpression "archiveBaseName";
@@ -694,6 +719,10 @@ in {
         # A repo named "foo" is mapped to systemd.services.borgbackup-repo-foo
         // mapAttrs' mkRepoService repos;
 
+      # A job named "foo" is mapped to systemd.timers.borgbackup-job-foo
+      # only generate the timer if interval (startAt) is set
+      systemd.timers = mapAttrs' mkBackupTimers (filterAttrs (_: cfg: cfg.startAt != []) jobs);
+
       users = mkMerge (mapAttrsToList mkUsersConfig repos);
 
       environment.systemPackages = with pkgs; [ borgbackup ] ++ (mapAttrsToList mkBorgWrapper jobs);
diff --git a/nixos/modules/services/backup/tsm.nix b/nixos/modules/services/backup/tsm.nix
index 6c238745797..4e690ac6ecd 100644
--- a/nixos/modules/services/backup/tsm.nix
+++ b/nixos/modules/services/backup/tsm.nix
@@ -5,7 +5,7 @@ let
   inherit (lib.attrsets) hasAttr;
   inherit (lib.modules) mkDefault mkIf;
   inherit (lib.options) mkEnableOption mkOption;
-  inherit (lib.types) nullOr strMatching;
+  inherit (lib.types) nonEmptyStr nullOr;
 
   options.services.tsmBackup = {
     enable = mkEnableOption ''
@@ -15,7 +15,7 @@ let
       <option>programs.tsmClient.enable</option>
     '';
     command = mkOption {
-      type = strMatching ".+";
+      type = nonEmptyStr;
       default = "backup";
       example = "incr";
       description = ''
@@ -24,7 +24,7 @@ let
       '';
     };
     servername = mkOption {
-      type = strMatching ".+";
+      type = nonEmptyStr;
       example = "mainTsmServer";
       description = ''
         Create a systemd system service
@@ -41,7 +41,7 @@ let
       '';
     };
     autoTime = mkOption {
-      type = nullOr (strMatching ".+");
+      type = nullOr nonEmptyStr;
       default = null;
       example = "12:00";
       description = ''
@@ -87,16 +87,35 @@ in
       environment.DSM_LOG = "/var/log/tsm-backup/";
       # TSM needs a HOME dir to store certificates.
       environment.HOME = "/var/lib/tsm-backup";
-      # for exit status description see
-      # https://www.ibm.com/support/knowledgecenter/en/SSEQVQ_8.1.8/client/c_sched_rtncode.html
-      serviceConfig.SuccessExitStatus = "4 8";
-      # The `-se` option must come after the command.
-      # The `-optfile` option suppresses a `dsm.opt`-not-found warning.
-      serviceConfig.ExecStart =
-        "${cfgPrg.wrappedPackage}/bin/dsmc ${cfg.command} -se='${cfg.servername}' -optfile=/dev/null";
-      serviceConfig.LogsDirectory = "tsm-backup";
-      serviceConfig.StateDirectory = "tsm-backup";
-      serviceConfig.StateDirectoryMode = "0750";
+      serviceConfig = {
+        # for exit status description see
+        # https://www.ibm.com/docs/en/spectrum-protect/8.1.13?topic=clients-client-return-codes
+        SuccessExitStatus = "4 8";
+        # The `-se` option must come after the command.
+        # The `-optfile` option suppresses a `dsm.opt`-not-found warning.
+        ExecStart =
+          "${cfgPrg.wrappedPackage}/bin/dsmc ${cfg.command} -se='${cfg.servername}' -optfile=/dev/null";
+        LogsDirectory = "tsm-backup";
+        StateDirectory = "tsm-backup";
+        StateDirectoryMode = "0750";
+        # systemd sandboxing
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        #PrivateTmp = true;  # would break backup of {/var,}/tmp
+        #PrivateUsers = true;  # would block backup of /home/*
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = "read-only";
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "noaccess";
+        ProtectSystem = "strict";
+        RestrictNamespaces = true;
+        RestrictSUIDSGID = true;
+      };
       startAt = mkIf (cfg.autoTime!=null) cfg.autoTime;
     };
   };
diff --git a/nixos/modules/services/development/rstudio-server/default.nix b/nixos/modules/services/development/rstudio-server/default.nix
new file mode 100644
index 00000000000..cd903c7e55b
--- /dev/null
+++ b/nixos/modules/services/development/rstudio-server/default.nix
@@ -0,0 +1,107 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.services.rstudio-server;
+
+  rserver-conf = builtins.toFile "rserver.conf" ''
+    server-working-dir=${cfg.serverWorkingDir}
+    www-address=${cfg.listenAddr}
+    ${cfg.rserverExtraConfig}
+  '';
+
+  rsession-conf = builtins.toFile "rsession.conf" ''
+    ${cfg.rsessionExtraConfig}
+  '';
+
+in
+{
+  meta.maintainers = with maintainers; [ jbedo cfhammill ];
+
+  options.services.rstudio-server = {
+    enable = mkEnableOption "RStudio server";
+
+    serverWorkingDir = mkOption {
+      type = types.str;
+      default = "/var/lib/rstudio-server";
+      description = ''
+        Default working directory for server (server-working-dir in rserver.conf).
+      '';
+    };
+
+    listenAddr = mkOption {
+      type = types.str;
+      default = "127.0.0.1";
+      description = ''
+        Address to listen on (www-address in rserver.conf).
+      '';
+    };
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.rstudio-server;
+      defaultText = literalExpression "pkgs.rstudio-server";
+      example = literalExpression "pkgs.rstudioServerWrapper.override { packages = [ pkgs.rPackages.ggplot2 ]; }";
+      description = ''
+        Rstudio server package to use. Can be set to rstudioServerWrapper to provide packages.
+      '';
+    };
+
+    rserverExtraConfig = mkOption {
+      type = types.str;
+      default = "";
+      description = ''
+        Extra contents for rserver.conf.
+      '';
+    };
+
+    rsessionExtraConfig = mkOption {
+      type = types.str;
+      default = "";
+      description = ''
+        Extra contents for resssion.conf.
+      '';
+    };
+
+  };
+
+  config = mkIf cfg.enable
+    {
+      systemd.services.rstudio-server = {
+        description = "Rstudio server";
+
+        after = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        restartTriggers = [ rserver-conf rsession-conf ];
+
+        serviceConfig = {
+          Restart = "on-failure";
+          Type = "forking";
+          ExecStart = "${cfg.package}/bin/rserver";
+          StateDirectory = "rstudio-server";
+          RuntimeDirectory = "rstudio-server";
+        };
+      };
+
+      environment.etc = {
+        "rstudio/rserver.conf".source = rserver-conf;
+        "rstudio/rsession.conf".source = rsession-conf;
+        "pam.d/rstudio".source = "/etc/pam.d/login";
+      };
+      environment.systemPackages = [ cfg.package ];
+
+      users = {
+        users.rstudio-server = {
+          uid = config.ids.uids.rstudio-server;
+          description = "rstudio-server";
+          group = "rstudio-server";
+        };
+        groups.rstudio-server = {
+          gid = config.ids.gids.rstudio-server;
+        };
+      };
+
+    };
+}
diff --git a/nixos/modules/services/misc/ananicy.nix b/nixos/modules/services/misc/ananicy.nix
index f76f534fb45..191666bc362 100644
--- a/nixos/modules/services/misc/ananicy.nix
+++ b/nixos/modules/services/misc/ananicy.nix
@@ -84,7 +84,7 @@ in
       } // (if ((lib.getName cfg.package) == (lib.getName pkgs.ananicy-cpp)) then {
         # https://gitlab.com/ananicy-cpp/ananicy-cpp/-/blob/master/src/config.cpp#L12
         loglevel = mkOD "warn"; # default is info but its spammy
-        cgroup_realtime_workaround = mkOD true;
+        cgroup_realtime_workaround = mkOD config.systemd.enableUnifiedCgroupHierarchy;
       } else {
         # https://github.com/Nefelim4ag/Ananicy/blob/master/ananicy.d/ananicy.conf
         check_disks_schedulers = mkOD true;
diff --git a/nixos/modules/services/misc/bees.nix b/nixos/modules/services/misc/bees.nix
index cb97a86b859..fa00d7e4f55 100644
--- a/nixos/modules/services/misc/bees.nix
+++ b/nixos/modules/services/misc/bees.nix
@@ -21,6 +21,8 @@ let
         <para>
         This must be in a format usable by findmnt; that could be a key=value
         pair, or a bare path to a mount point.
+        Using bare paths will allow systemd to start the beesd service only
+        after mounting the associated path.
       '';
       example = "LABEL=MyBulkDataDrive";
     };
@@ -122,6 +124,7 @@ in
             StartupIOWeight = 25;
             SyslogIdentifier = "beesd"; # would otherwise be "bees-service-wrapper"
           };
+        unitConfig.RequiresMountsFor = lib.mkIf (lib.hasPrefix "/" fs.spec) fs.spec;
         wantedBy = [ "multi-user.target" ];
       })
       cfg.filesystems;
diff --git a/nixos/modules/services/misc/heisenbridge.nix b/nixos/modules/services/misc/heisenbridge.nix
index 353a2781d28..7ce8a23d9af 100644
--- a/nixos/modules/services/misc/heisenbridge.nix
+++ b/nixos/modules/services/misc/heisenbridge.nix
@@ -23,7 +23,7 @@ let
 in
 {
   options.services.heisenbridge = {
-    enable = mkEnableOption "A bouncer-style Matrix IRC bridge";
+    enable = mkEnableOption "the Matrix to IRC bridge";
 
     package = mkOption {
       type = types.package;
@@ -172,25 +172,39 @@ in
           ++ (map (lib.escapeShellArg) cfg.extraArgs)
         );
 
-        ProtectHome = true;
-        PrivateDevices = true;
-        ProtectKernelTunables = true;
-        ProtectKernelModules = true;
-        ProtectControlGroups = true;
-        StateDirectory = "heisenbridge";
-        StateDirectoryMode = "755";
+        # Hardening options
 
         User = "heisenbridge";
         Group = "heisenbridge";
+        RuntimeDirectory = "heisenbridge";
+        RuntimeDirectoryMode = "0700";
+        StateDirectory = "heisenbridge";
+        StateDirectoryMode = "0755";
 
-        CapabilityBoundingSet = [ "CAP_CHOWN" ] ++ optional (cfg.port < 1024 || cfg.identd.port < 1024) "CAP_NET_BIND_SERVICE";
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        RestrictSUIDSGID = true;
+        PrivateMounts = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectHostname = true;
+        ProtectClock = true;
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        RestrictNamespaces = true;
+        RemoveIPC = true;
+        UMask = "0077";
+
+        CapabilityBoundingSet = [ "CAP_CHOWN" ] ++ optional (cfg.port < 1024 || (cfg.identd.enable && cfg.identd.port < 1024)) "CAP_NET_BIND_SERVICE";
         AmbientCapabilities = CapabilityBoundingSet;
         NoNewPrivileges = true;
-
         LockPersonality = true;
         RestrictRealtime = true;
-        PrivateMounts = true;
-        SystemCallFilter = "~@aio @clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @raw-io @setuid @swap";
+        SystemCallFilter = ["@system-service" "~@priviledged" "@chown"];
         SystemCallArchitectures = "native";
         RestrictAddressFamilies = "AF_INET AF_INET6";
       };
diff --git a/nixos/modules/services/misc/mbpfan.nix b/nixos/modules/services/misc/mbpfan.nix
index d80b6fafc2c..d2b0f0da2ad 100644
--- a/nixos/modules/services/misc/mbpfan.nix
+++ b/nixos/modules/services/misc/mbpfan.nix
@@ -5,6 +5,8 @@ with lib;
 let
   cfg = config.services.mbpfan;
   verbose = if cfg.verbose then "v" else "";
+  settingsFormat = pkgs.formats.ini {};
+  settingsFile = settingsFormat.generate "config.conf" cfg.settings;
 
 in {
   options.services.mbpfan = {
@@ -19,54 +21,6 @@ in {
       '';
     };
 
-    minFanSpeed = mkOption {
-      type = types.int;
-      default = 2000;
-      description = ''
-        The minimum fan speed.
-      '';
-    };
-
-    maxFanSpeed = mkOption {
-      type = types.int;
-      default = 6200;
-      description = ''
-        The maximum fan speed.
-      '';
-    };
-
-    lowTemp = mkOption {
-      type = types.int;
-      default = 63;
-      description = ''
-        The low temperature.
-      '';
-    };
-
-    highTemp = mkOption {
-      type = types.int;
-      default = 66;
-      description = ''
-        The high temperature.
-      '';
-    };
-
-    maxTemp = mkOption {
-      type = types.int;
-      default = 86;
-      description = ''
-        The maximum temperature.
-      '';
-    };
-
-    pollingInterval = mkOption {
-      type = types.int;
-      default = 7;
-      description = ''
-        The polling interval.
-      '';
-    };
-
     verbose = mkOption {
       type = types.bool;
       default = false;
@@ -74,23 +28,61 @@ in {
         If true, sets the log level to verbose.
       '';
     };
+
+    settings = mkOption {
+      default = {};
+      description = "The INI configuration for Mbpfan.";
+      type = types.submodule {
+        freeformType = settingsFormat.type;
+
+        options.general.min_fan1_speed = mkOption {
+          type = types.int;
+          default = 2000;
+          description = "The minimum fan speed.";
+        };
+        options.general.max_fan1_speed = mkOption {
+          type = types.int;
+          default = 6199;
+          description = "The maximum fan speed.";
+        };
+        options.general.low_temp = mkOption {
+          type = types.int;
+          default = 55;
+          description = "The low temperature.";
+        };
+        options.general.high_temp = mkOption {
+          type = types.int;
+          default = 58;
+          description = "The high temperature.";
+        };
+        options.general.max_temp = mkOption {
+          type = types.int;
+          default = 86;
+          description = "The maximum temperature.";
+        };
+        options.general.polling_interval = mkOption {
+          type = types.int;
+          default = 1;
+          description = "The polling interval.";
+        };
+      };
+    };
   };
 
+  imports = [
+    (mkRenamedOptionModule [ "services" "mbpfan" "pollingInterval" ] [ "services" "mbpfan" "settings" "general" "polling_interval" ])
+    (mkRenamedOptionModule [ "services" "mbpfan" "maxTemp" ] [ "services" "mbpfan" "settings" "general" "max_temp" ])
+    (mkRenamedOptionModule [ "services" "mbpfan" "lowTemp" ] [ "services" "mbpfan" "settings" "general" "low_temp" ])
+    (mkRenamedOptionModule [ "services" "mbpfan" "highTemp" ] [ "services" "mbpfan" "settings" "general" "high_temp" ])
+    (mkRenamedOptionModule [ "services" "mbpfan" "minFanSpeed" ] [ "services" "mbpfan" "settings" "general" "min_fan1_speed" ])
+    (mkRenamedOptionModule [ "services" "mbpfan" "maxFanSpeed" ] [ "services" "mbpfan" "settings" "general" "max_fan1_speed" ])
+  ];
+
   config = mkIf cfg.enable {
     boot.kernelModules = [ "coretemp" "applesmc" ];
 
-    environment = {
-      etc."mbpfan.conf".text = ''
-        [general]
-        min_fan_speed = ${toString cfg.minFanSpeed}
-        max_fan_speed = ${toString cfg.maxFanSpeed}
-        low_temp = ${toString cfg.lowTemp}
-        high_temp = ${toString cfg.highTemp}
-        max_temp = ${toString cfg.maxTemp}
-        polling_interval = ${toString cfg.pollingInterval}
-      '';
-      systemPackages = [ cfg.package ];
-    };
+    environment.etc."mbpfan.conf".source = settingsFile;
+    environment.systemPackages = [ cfg.package ];
 
     systemd.services.mbpfan = {
       description = "A fan manager daemon for MacBook Pro";
diff --git a/nixos/modules/services/networking/adguardhome.nix b/nixos/modules/services/networking/adguardhome.nix
index 05713adbd83..98ddf071608 100644
--- a/nixos/modules/services/networking/adguardhome.nix
+++ b/nixos/modules/services/networking/adguardhome.nix
@@ -87,6 +87,22 @@ in {
   };
 
   config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.settings != { }
+          -> (hasAttrByPath [ "dns" "bind_host" ] cfg.settings)
+          || (hasAttrByPath [ "dns" "bind_hosts" ] cfg.settings);
+        message =
+          "AdGuard setting dns.bind_host or dns.bind_hosts needs to be configured for a minimal working configuration";
+      }
+      {
+        assertion = cfg.settings != { }
+          -> hasAttrByPath [ "dns" "bootstrap_dns" ] cfg.settings;
+        message =
+          "AdGuard setting dns.bootstrap_dns needs to be configured for a minimal working configuration";
+      }
+    ];
+
     systemd.services.adguardhome = {
       description = "AdGuard Home: Network-level blocker";
       after = [ "network.target" ];
@@ -96,7 +112,7 @@ in {
         StartLimitBurst = 10;
       };
 
-      preStart = ''
+      preStart = optionalString (cfg.settings != { }) ''
         if    [ -e "$STATE_DIRECTORY/AdGuardHome.yaml" ] \
            && [ "${toString cfg.mutableSettings}" = "1" ]; then
           # Writing directly to AdGuardHome.yaml results in empty file
diff --git a/nixos/modules/services/networking/ddclient.nix b/nixos/modules/services/networking/ddclient.nix
index 0bb8c87b38e..d025c8f8177 100644
--- a/nixos/modules/services/networking/ddclient.nix
+++ b/nixos/modules/services/networking/ddclient.nix
@@ -29,9 +29,9 @@ let
   configFile = if (cfg.configFile != null) then cfg.configFile else configFile';
 
   preStart = ''
-    install --owner ddclient -m600 ${configFile} /run/${RuntimeDirectory}/ddclient.conf
+    install ${configFile} /run/${RuntimeDirectory}/ddclient.conf
     ${lib.optionalString (cfg.configFile == null) (if (cfg.protocol == "nsupdate") then ''
-      install --owner ddclient -m600 ${cfg.passwordFile} /run/${RuntimeDirectory}/ddclient.key
+      install ${cfg.passwordFile} /run/${RuntimeDirectory}/ddclient.key
     '' else if (cfg.passwordFile != null) then ''
       password=$(printf "%q" "$(head -n 1 "${cfg.passwordFile}")")
       sed -i "s|^password=$|password=$password|" /run/${RuntimeDirectory}/ddclient.conf
diff --git a/nixos/modules/services/networking/mosquitto.nix b/nixos/modules/services/networking/mosquitto.nix
index 2d498d4dbbc..85d3ea5bd75 100644
--- a/nixos/modules/services/networking/mosquitto.nix
+++ b/nixos/modules/services/networking/mosquitto.nix
@@ -556,7 +556,7 @@ in
     systemd.services.mosquitto = {
       description = "Mosquitto MQTT Broker Daemon";
       wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
+      after = [ "network-online.target" ];
       serviceConfig = {
         Type = "notify";
         NotifyAccess = "main";
diff --git a/nixos/modules/services/networking/nix-serve.nix b/nixos/modules/services/networking/nix-serve.nix
index 390f0ddaee8..432938d59d9 100644
--- a/nixos/modules/services/networking/nix-serve.nix
+++ b/nixos/modules/services/networking/nix-serve.nix
@@ -26,6 +26,12 @@ in
         '';
       };
 
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Open ports in the firewall for nix-serve.";
+      };
+
       secretKeyFile = mkOption {
         type = types.nullOr types.str;
         default = null;
@@ -77,5 +83,9 @@ in
           "NIX_SECRET_KEY_FILE:${cfg.secretKeyFile}";
       };
     };
+
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.port ];
+    };
   };
 }
diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
index f19624aba02..7bfc7005099 100644
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -81,6 +81,7 @@ in
   imports = [
     (mkAliasOptionModule [ "services" "sshd" "enable" ] [ "services" "openssh" "enable" ])
     (mkAliasOptionModule [ "services" "openssh" "knownHosts" ] [ "programs" "ssh" "knownHosts" ])
+    (mkRenamedOptionModule [ "services" "openssh" "challengeResponseAuthentication" ] [ "services" "openssh" "kbdInteractiveAuthentication" ])
   ];
 
   ###### interface
@@ -218,11 +219,11 @@ in
         '';
       };
 
-      challengeResponseAuthentication = mkOption {
+      kbdInteractiveAuthentication = mkOption {
         type = types.bool;
         default = true;
         description = ''
-          Specifies whether challenge/response authentication is allowed.
+          Specifies whether keyboard-interactive authentication is allowed.
         '';
       };
 
@@ -534,7 +535,7 @@ in
         PermitRootLogin ${cfg.permitRootLogin}
         GatewayPorts ${cfg.gatewayPorts}
         PasswordAuthentication ${if cfg.passwordAuthentication then "yes" else "no"}
-        ChallengeResponseAuthentication ${if cfg.challengeResponseAuthentication then "yes" else "no"}
+        KbdInteractiveAuthentication ${if cfg.kbdInteractiveAuthentication then "yes" else "no"}
 
         PrintMotd no # handled by pam_motd
 
diff --git a/nixos/modules/services/networking/syncthing.nix b/nixos/modules/services/networking/syncthing.nix
index e37e324019e..3a3d4c80ecf 100644
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@@ -468,7 +468,7 @@ in {
         default = false;
         example = true;
         description = ''
-          Whether to open the default ports in the firewall: TCP 22000 for transfers
+          Whether to open the default ports in the firewall: TCP/UDP 22000 for transfers
           and UDP 21027 for discovery.
 
           If multiple users are running Syncthing on this machine, you will need
@@ -504,7 +504,7 @@ in {
 
     networking.firewall = mkIf cfg.openDefaultPorts {
       allowedTCPPorts = [ 22000 ];
-      allowedUDPPorts = [ 21027 ];
+      allowedUDPPorts = [ 21027 22000 ];
     };
 
     systemd.packages = [ pkgs.syncthing ];
diff --git a/nixos/modules/services/system/cachix-agent/default.nix b/nixos/modules/services/system/cachix-agent/default.nix
new file mode 100644
index 00000000000..496e0b90355
--- /dev/null
+++ b/nixos/modules/services/system/cachix-agent/default.nix
@@ -0,0 +1,57 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.services.cachix-agent;
+in {
+  meta.maintainers = [ lib.maintainers.domenkozar ];
+
+  options.services.cachix-agent = {
+    enable = mkEnableOption "Cachix Deploy Agent: https://docs.cachix.org/deploy/";
+
+    name = mkOption {
+      type = types.str;
+      description = "Agent name, usually same as the hostname";
+      default = config.networking.hostName;
+      defaultText = "config.networking.hostName";
+    };
+
+    profile = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = "Profile name, defaults to 'system' (NixOS).";
+    };
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.cachix;
+      defaultText = literalExpression "pkgs.cachix";
+      description = "Cachix Client package to use.";
+    };
+
+    credentialsFile = mkOption {
+      type = types.path;
+      default = "/etc/cachix-agent.token";
+      description = ''
+        Required file that needs to contain CACHIX_AGENT_TOKEN=...
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.cachix-agent = {
+      description = "Cachix Deploy Agent";
+      after = ["network-online.target"];
+      path = [ config.nix.package ];
+      wantedBy = [ "multi-user.target" ];
+      # don't restart while changing
+      reloadIfChanged = true;
+      serviceConfig = {
+        Restart = "on-failure";
+        EnvironmentFile = cfg.credentialsFile;
+        ExecStart = "${cfg.package}/bin/cachix deploy agent ${cfg.name} ${if cfg.profile != null then profile else ""}";
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/web-apps/bookstack.nix b/nixos/modules/services/web-apps/bookstack.nix
index b509e4fff45..54eaea63b6e 100644
--- a/nixos/modules/services/web-apps/bookstack.nix
+++ b/nixos/modules/services/web-apps/bookstack.nix
@@ -24,8 +24,14 @@ let
     $sudo ${pkgs.php}/bin/php artisan $*
   '';
 
+  tlsEnabled = cfg.nginx.addSSL || cfg.nginx.forceSSL || cfg.nginx.onlySSL || cfg.nginx.enableACME;
 
 in {
+  imports = [
+    (mkRemovedOptionModule [ "services" "bookstack" "extraConfig" ] "Use services.bookstack.config instead.")
+    (mkRemovedOptionModule [ "services" "bookstack" "cacheDir" ] "The cache directory is now handled automatically.")
+  ];
+
   options.services.bookstack = {
 
     enable = mkEnableOption "BookStack";
@@ -44,28 +50,38 @@ in {
 
     appKeyFile = mkOption {
       description = ''
-        A file containing the AppKey.
-        Used for encryption where needed. Can be generated with <code>head -c 32 /dev/urandom| base64</code> and must be prefixed with <literal>base64:</literal>.
+        A file containing the Laravel APP_KEY - a 32 character long,
+        base64 encoded key used for encryption where needed. Can be
+        generated with <code>head -c 32 /dev/urandom | base64</code>.
       '';
       example = "/run/keys/bookstack-appkey";
       type = types.path;
     };
 
+    hostname = lib.mkOption {
+      type = lib.types.str;
+      default = if config.networking.domain != null then
+                  config.networking.fqdn
+                else
+                  config.networking.hostName;
+      defaultText = lib.literalExpression "config.networking.fqdn";
+      example = "bookstack.example.com";
+      description = ''
+        The hostname to serve BookStack on.
+      '';
+    };
+
     appURL = mkOption {
       description = ''
         The root URL that you want to host BookStack on. All URLs in BookStack will be generated using this value.
         If you change this in the future you may need to run a command to update stored URLs in the database. Command example: <code>php artisan bookstack:update-url https://old.example.com https://new.example.com</code>
       '';
+      default = "http${lib.optionalString tlsEnabled "s"}://${cfg.hostname}";
+      defaultText = ''http''${lib.optionalString tlsEnabled "s"}://''${cfg.hostname}'';
       example = "https://example.com";
       type = types.str;
     };
 
-    cacheDir = mkOption {
-      description = "BookStack cache directory";
-      default = "/var/cache/bookstack";
-      type = types.path;
-    };
-
     dataDir = mkOption {
       description = "BookStack data directory";
       default = "/var/lib/bookstack";
@@ -202,16 +218,59 @@ in {
       '';
     };
 
-    extraConfig = mkOption {
-      type = types.nullOr types.lines;
-      default = null;
-      example = ''
-        ALLOWED_IFRAME_HOSTS="https://example.com"
-        WKHTMLTOPDF=/home/user/bins/wkhtmltopdf
+    config = mkOption {
+      type = with types;
+        attrsOf
+          (nullOr
+            (either
+              (oneOf [
+                bool
+                int
+                port
+                path
+                str
+              ])
+              (submodule {
+                options = {
+                  _secret = mkOption {
+                    type = nullOr str;
+                    description = ''
+                      The path to a file containing the value the
+                      option should be set to in the final
+                      configuration file.
+                    '';
+                  };
+                };
+              })));
+      default = {};
+      example = literalExpression ''
+        {
+          ALLOWED_IFRAME_HOSTS = "https://example.com";
+          WKHTMLTOPDF = "/home/user/bins/wkhtmltopdf";
+          AUTH_METHOD = "oidc";
+          OIDC_NAME = "MyLogin";
+          OIDC_DISPLAY_NAME_CLAIMS = "name";
+          OIDC_CLIENT_ID = "bookstack";
+          OIDC_CLIENT_SECRET = {_secret = "/run/keys/oidc_secret"};
+          OIDC_ISSUER = "https://keycloak.example.com/auth/realms/My%20Realm";
+          OIDC_ISSUER_DISCOVER = true;
+        }
       '';
       description = ''
-        Lines to be appended verbatim to the BookStack configuration.
-        Refer to <link xlink:href="https://www.bookstackapp.com/docs/"/> for details on supported values.
+        BookStack configuration options to set in the
+        <filename>.env</filename> file.
+
+        Refer to <link xlink:href="https://www.bookstackapp.com/docs/"/>
+        for details on supported values.
+
+        Settings containing secret data should be set to an attribute
+        set containing the attribute <literal>_secret</literal> - a
+        string pointing to a file containing the value the option
+        should be set to. See the example to get a better picture of
+        this: in the resulting <filename>.env</filename> file, the
+        <literal>OIDC_CLIENT_SECRET</literal> key will be set to the
+        contents of the <filename>/run/keys/oidc_secret</filename>
+        file.
       '';
     };
 
@@ -228,6 +287,30 @@ in {
       }
     ];
 
+    services.bookstack.config = {
+      APP_KEY._secret = cfg.appKeyFile;
+      APP_URL = cfg.appURL;
+      DB_HOST = db.host;
+      DB_PORT = db.port;
+      DB_DATABASE = db.name;
+      DB_USERNAME = db.user;
+      MAIL_DRIVER = mail.driver;
+      MAIL_FROM_NAME = mail.fromName;
+      MAIL_FROM = mail.from;
+      MAIL_HOST = mail.host;
+      MAIL_PORT = mail.port;
+      MAIL_USERNAME = mail.user;
+      MAIL_ENCRYPTION = mail.encryption;
+      DB_PASSWORD._secret = db.passwordFile;
+      MAIL_PASSWORD._secret = mail.passwordFile;
+      APP_SERVICES_CACHE = "/run/bookstack/cache/services.php";
+      APP_PACKAGES_CACHE = "/run/bookstack/cache/packages.php";
+      APP_CONFIG_CACHE = "/run/bookstack/cache/config.php";
+      APP_ROUTES_CACHE = "/run/bookstack/cache/routes-v7.php";
+      APP_EVENTS_CACHE = "/run/bookstack/cache/events.php";
+      SESSION_SECURE_COOKIE = tlsEnabled;
+    };
+
     environment.systemPackages = [ artisan ];
 
     services.mysql = mkIf db.createLocally {
@@ -258,24 +341,19 @@ in {
 
     services.nginx = {
       enable = mkDefault true;
-      virtualHosts.bookstack = mkMerge [ cfg.nginx {
+      recommendedTlsSettings = true;
+      recommendedOptimisation = true;
+      recommendedGzipSettings = true;
+      virtualHosts.${cfg.hostname} = mkMerge [ cfg.nginx {
         root = mkForce "${bookstack}/public";
-        extraConfig = optionalString (cfg.nginx.addSSL || cfg.nginx.forceSSL || cfg.nginx.onlySSL || cfg.nginx.enableACME) "fastcgi_param HTTPS on;";
         locations = {
           "/" = {
             index = "index.php";
-            extraConfig = ''try_files $uri $uri/ /index.php?$query_string;'';
-          };
-          "~ \.php$" = {
-            extraConfig = ''
-              try_files $uri $uri/ /index.php?$query_string;
-              include ${pkgs.nginx}/conf/fastcgi_params;
-              fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-              fastcgi_param REDIRECT_STATUS 200;
-              fastcgi_pass unix:${config.services.phpfpm.pools."bookstack".socket};
-              ${optionalString (cfg.nginx.addSSL || cfg.nginx.forceSSL || cfg.nginx.onlySSL || cfg.nginx.enableACME) "fastcgi_param HTTPS on;"}
-            '';
+            tryFiles = "$uri $uri/ /index.php?$query_string";
           };
+          "~ \.php$".extraConfig = ''
+            fastcgi_pass unix:${config.services.phpfpm.pools."bookstack".socket};
+          '';
           "~ \.(js|css|gif|png|ico|jpg|jpeg)$" = {
             extraConfig = "expires 365d;";
           };
@@ -290,50 +368,54 @@ in {
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
         Type = "oneshot";
+        RemainAfterExit = true;
         User = user;
         WorkingDirectory = "${bookstack}";
+        RuntimeDirectory = "bookstack/cache";
+        RuntimeDirectoryMode = 0700;
       };
-      script = ''
+      path = [ pkgs.replace-secret ];
+      script =
+        let
+          isSecret = v: isAttrs v && v ? _secret && isString v._secret;
+          bookstackEnvVars = lib.generators.toKeyValue {
+            mkKeyValue = lib.flip lib.generators.mkKeyValueDefault "=" {
+              mkValueString = v: with builtins;
+                if isInt         v then toString v
+                else if isString v then v
+                else if true  == v then "true"
+                else if false == v then "false"
+                else if isSecret v then v._secret
+                else throw "unsupported type ${typeOf v}: ${(lib.generators.toPretty {}) v}";
+            };
+          };
+          secretPaths = lib.mapAttrsToList (_: v: v._secret) (lib.filterAttrs (_: isSecret) cfg.config);
+          mkSecretReplacement = file: ''
+            replace-secret ${escapeShellArgs [ file file "${cfg.dataDir}/.env" ]}
+          '';
+          secretReplacements = lib.concatMapStrings mkSecretReplacement secretPaths;
+          filteredConfig = lib.converge (lib.filterAttrsRecursive (_: v: ! elem v [ {} null ])) cfg.config;
+          bookstackEnv = pkgs.writeText "bookstack.env" (bookstackEnvVars filteredConfig);
+        in ''
+        # error handling
+        set -euo pipefail
+
         # set permissions
         umask 077
+
         # create .env file
-        echo "
-        APP_KEY=base64:$(head -n1 ${cfg.appKeyFile})
-        APP_URL=${cfg.appURL}
-        DB_HOST=${db.host}
-        DB_PORT=${toString db.port}
-        DB_DATABASE=${db.name}
-        DB_USERNAME=${db.user}
-        MAIL_DRIVER=${mail.driver}
-        MAIL_FROM_NAME=\"${mail.fromName}\"
-        MAIL_FROM=${mail.from}
-        MAIL_HOST=${mail.host}
-        MAIL_PORT=${toString mail.port}
-        ${optionalString (mail.user != null) "MAIL_USERNAME=${mail.user};"}
-        ${optionalString (mail.encryption != null) "MAIL_ENCRYPTION=${mail.encryption};"}
-        ${optionalString (db.passwordFile != null) "DB_PASSWORD=$(head -n1 ${db.passwordFile})"}
-        ${optionalString (mail.passwordFile != null) "MAIL_PASSWORD=$(head -n1 ${mail.passwordFile})"}
-        APP_SERVICES_CACHE=${cfg.cacheDir}/services.php
-        APP_PACKAGES_CACHE=${cfg.cacheDir}/packages.php
-        APP_CONFIG_CACHE=${cfg.cacheDir}/config.php
-        APP_ROUTES_CACHE=${cfg.cacheDir}/routes-v7.php
-        APP_EVENTS_CACHE=${cfg.cacheDir}/events.php
-        ${optionalString (cfg.nginx.addSSL || cfg.nginx.forceSSL || cfg.nginx.onlySSL || cfg.nginx.enableACME) "SESSION_SECURE_COOKIE=true"}
-        ${toString cfg.extraConfig}
-        " > "${cfg.dataDir}/.env"
+        install -T -m 0600 -o ${user} ${bookstackEnv} "${cfg.dataDir}/.env"
+        ${secretReplacements}
+        if ! grep 'APP_KEY=base64:' "${cfg.dataDir}/.env" >/dev/null; then
+            sed -i 's/APP_KEY=/APP_KEY=base64:/' "${cfg.dataDir}/.env"
+        fi
 
         # migrate db
         ${pkgs.php}/bin/php artisan migrate --force
-
-        # clear & create caches (needed in case of update)
-        ${pkgs.php}/bin/php artisan cache:clear
-        ${pkgs.php}/bin/php artisan config:clear
-        ${pkgs.php}/bin/php artisan view:clear
       '';
     };
 
     systemd.tmpfiles.rules = [
-      "d ${cfg.cacheDir}                           0700 ${user} ${group} - -"
       "d ${cfg.dataDir}                            0710 ${user} ${group} - -"
       "d ${cfg.dataDir}/public                     0750 ${user} ${group} - -"
       "d ${cfg.dataDir}/public/uploads             0750 ${user} ${group} - -"
diff --git a/nixos/modules/services/web-apps/keycloak.nix b/nixos/modules/services/web-apps/keycloak.nix
index e08f6dcabd2..a01f0049b2c 100644
--- a/nixos/modules/services/web-apps/keycloak.nix
+++ b/nixos/modules/services/web-apps/keycloak.nix
@@ -3,280 +3,311 @@
 let
   cfg = config.services.keycloak;
   opt = options.services.keycloak;
-in
-{
-  options.services.keycloak = {
-
-    enable = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      example = true;
-      description = ''
-        Whether to enable the Keycloak identity and access management
-        server.
-      '';
-    };
 
-    bindAddress = lib.mkOption {
-      type = lib.types.str;
-      default = "\${jboss.bind.address:0.0.0.0}";
-      example = "127.0.0.1";
-      description = ''
-        On which address Keycloak should accept new connections.
+  inherit (lib) types mkOption concatStringsSep mapAttrsToList
+    escapeShellArg recursiveUpdate optionalAttrs boolToString mkOrder
+    sort filterAttrs concatMapStringsSep concatStrings mkIf
+    optionalString optionals mkDefault literalExpression hasSuffix
+    foldl' isAttrs filter attrNames elem literalDocBook
+    maintainers;
 
-        A special syntax can be used to allow command line Java system
-        properties to override the value: ''${property.name:value}
-      '';
-    };
-
-    httpPort = lib.mkOption {
-      type = lib.types.str;
-      default = "\${jboss.http.port:80}";
-      example = "8080";
-      description = ''
-        On which port Keycloak should listen for new HTTP connections.
+  inherit (builtins) match typeOf;
+in
+{
+  options.services.keycloak =
+    let
+      inherit (types) bool str nullOr attrsOf path enum anything
+        package port;
+    in
+    {
+      enable = mkOption {
+        type = bool;
+        default = false;
+        example = true;
+        description = ''
+          Whether to enable the Keycloak identity and access management
+          server.
+        '';
+      };
 
-        A special syntax can be used to allow command line Java system
-        properties to override the value: ''${property.name:value}
-      '';
-    };
+      bindAddress = mkOption {
+        type = str;
+        default = "\${jboss.bind.address:0.0.0.0}";
+        example = "127.0.0.1";
+        description = ''
+          On which address Keycloak should accept new connections.
 
-    httpsPort = lib.mkOption {
-      type = lib.types.str;
-      default = "\${jboss.https.port:443}";
-      example = "8443";
-      description = ''
-        On which port Keycloak should listen for new HTTPS connections.
+          A special syntax can be used to allow command line Java system
+          properties to override the value: ''${property.name:value}
+        '';
+      };
 
-        A special syntax can be used to allow command line Java system
-        properties to override the value: ''${property.name:value}
-      '';
-    };
+      httpPort = mkOption {
+        type = str;
+        default = "\${jboss.http.port:80}";
+        example = "8080";
+        description = ''
+          On which port Keycloak should listen for new HTTP connections.
 
-    frontendUrl = lib.mkOption {
-      type = lib.types.str;
-      apply = x: if lib.hasSuffix "/" x then x else x + "/";
-      example = "keycloak.example.com/auth";
-      description = ''
-        The public URL used as base for all frontend requests. Should
-        normally include a trailing <literal>/auth</literal>.
-
-        See <link xlink:href="https://www.keycloak.org/docs/latest/server_installation/#_hostname">the
-        Hostname section of the Keycloak server installation
-        manual</link> for more information.
-      '';
-    };
+          A special syntax can be used to allow command line Java system
+          properties to override the value: ''${property.name:value}
+        '';
+      };
 
-    forceBackendUrlToFrontendUrl = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      example = true;
-      description = ''
-        Whether Keycloak should force all requests to go through the
-        frontend URL configured in <xref
-        linkend="opt-services.keycloak.frontendUrl" />. By default,
-        Keycloak allows backend requests to instead use its local
-        hostname or IP address and may also advertise it to clients
-        through its OpenID Connect Discovery endpoint.
-
-        See <link
-        xlink:href="https://www.keycloak.org/docs/latest/server_installation/#_hostname">the
-        Hostname section of the Keycloak server installation
-        manual</link> for more information.
-      '';
-    };
+      httpsPort = mkOption {
+        type = str;
+        default = "\${jboss.https.port:443}";
+        example = "8443";
+        description = ''
+          On which port Keycloak should listen for new HTTPS connections.
 
-    sslCertificate = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
-      default = null;
-      example = "/run/keys/ssl_cert";
-      description = ''
-        The path to a PEM formatted certificate to use for TLS/SSL
-        connections.
+          A special syntax can be used to allow command line Java system
+          properties to override the value: ''${property.name:value}
+        '';
+      };
 
-        This should be a string, not a Nix path, since Nix paths are
-        copied into the world-readable Nix store.
-      '';
-    };
+      frontendUrl = mkOption {
+        type = str;
+        apply = x:
+          if x == "" || hasSuffix "/" x then
+            x
+          else
+            x + "/";
+        example = "keycloak.example.com/auth";
+        description = ''
+          The public URL used as base for all frontend requests. Should
+          normally include a trailing <literal>/auth</literal>.
 
-    sslCertificateKey = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
-      default = null;
-      example = "/run/keys/ssl_key";
-      description = ''
-        The path to a PEM formatted private key to use for TLS/SSL
-        connections.
+          See <link xlink:href="https://www.keycloak.org/docs/latest/server_installation/#_hostname">the
+          Hostname section of the Keycloak server installation
+          manual</link> for more information.
+        '';
+      };
 
-        This should be a string, not a Nix path, since Nix paths are
-        copied into the world-readable Nix store.
-      '';
-    };
+      forceBackendUrlToFrontendUrl = mkOption {
+        type = bool;
+        default = false;
+        example = true;
+        description = ''
+          Whether Keycloak should force all requests to go through the
+          frontend URL configured in <xref
+          linkend="opt-services.keycloak.frontendUrl" />. By default,
+          Keycloak allows backend requests to instead use its local
+          hostname or IP address and may also advertise it to clients
+          through its OpenID Connect Discovery endpoint.
+
+          See <link
+          xlink:href="https://www.keycloak.org/docs/latest/server_installation/#_hostname">the
+          Hostname section of the Keycloak server installation
+          manual</link> for more information.
+        '';
+      };
 
-    database = {
-      type = lib.mkOption {
-        type = lib.types.enum [ "mysql" "postgresql" ];
-        default = "postgresql";
-        example = "mysql";
+      sslCertificate = mkOption {
+        type = nullOr path;
+        default = null;
+        example = "/run/keys/ssl_cert";
         description = ''
-          The type of database Keycloak should connect to.
+          The path to a PEM formatted certificate to use for TLS/SSL
+          connections.
+
+          This should be a string, not a Nix path, since Nix paths are
+          copied into the world-readable Nix store.
         '';
       };
 
-      host = lib.mkOption {
-        type = lib.types.str;
-        default = "localhost";
+      sslCertificateKey = mkOption {
+        type = nullOr path;
+        default = null;
+        example = "/run/keys/ssl_key";
         description = ''
-          Hostname of the database to connect to.
+          The path to a PEM formatted private key to use for TLS/SSL
+          connections.
+
+          This should be a string, not a Nix path, since Nix paths are
+          copied into the world-readable Nix store.
         '';
       };
 
-      port =
-        let
-          dbPorts = {
-            postgresql = 5432;
-            mysql = 3306;
-          };
-        in
-          lib.mkOption {
-            type = lib.types.port;
+      database = {
+        type = mkOption {
+          type = enum [ "mysql" "postgresql" ];
+          default = "postgresql";
+          example = "mysql";
+          description = ''
+            The type of database Keycloak should connect to.
+          '';
+        };
+
+        host = mkOption {
+          type = str;
+          default = "localhost";
+          description = ''
+            Hostname of the database to connect to.
+          '';
+        };
+
+        port =
+          let
+            dbPorts = {
+              postgresql = 5432;
+              mysql = 3306;
+            };
+          in
+          mkOption {
+            type = port;
             default = dbPorts.${cfg.database.type};
-            defaultText = lib.literalDocBook "default port of selected database";
+            defaultText = literalDocBook "default port of selected database";
             description = ''
               Port of the database to connect to.
             '';
           };
 
-      useSSL = lib.mkOption {
-        type = lib.types.bool;
-        default = cfg.database.host != "localhost";
-        defaultText = lib.literalExpression ''config.${opt.database.host} != "localhost"'';
-        description = ''
-          Whether the database connection should be secured by SSL /
-          TLS.
-        '';
-      };
+        useSSL = mkOption {
+          type = bool;
+          default = cfg.database.host != "localhost";
+          defaultText = literalExpression ''config.${opt.database.host} != "localhost"'';
+          description = ''
+            Whether the database connection should be secured by SSL /
+            TLS.
+          '';
+        };
 
-      caCert = lib.mkOption {
-        type = lib.types.nullOr lib.types.path;
-        default = null;
-        description = ''
-          The SSL / TLS CA certificate that verifies the identity of the
-          database server.
+        caCert = mkOption {
+          type = nullOr path;
+          default = null;
+          description = ''
+            The SSL / TLS CA certificate that verifies the identity of the
+            database server.
 
-          Required when PostgreSQL is used and SSL is turned on.
+            Required when PostgreSQL is used and SSL is turned on.
 
-          For MySQL, if left at <literal>null</literal>, the default
-          Java keystore is used, which should suffice if the server
-          certificate is issued by an official CA.
-        '';
+            For MySQL, if left at <literal>null</literal>, the default
+            Java keystore is used, which should suffice if the server
+            certificate is issued by an official CA.
+          '';
+        };
+
+        createLocally = mkOption {
+          type = bool;
+          default = true;
+          description = ''
+            Whether a database should be automatically created on the
+            local host. Set this to false if you plan on provisioning a
+            local database yourself. This has no effect if
+            services.keycloak.database.host is customized.
+          '';
+        };
+
+        username = mkOption {
+          type = str;
+          default = "keycloak";
+          description = ''
+            Username to use when connecting to an external or manually
+            provisioned database; has no effect when a local database is
+            automatically provisioned.
+
+            To use this with a local database, set <xref
+            linkend="opt-services.keycloak.database.createLocally" /> to
+            <literal>false</literal> and create the database and user
+            manually. The database should be called
+            <literal>keycloak</literal>.
+          '';
+        };
+
+        passwordFile = mkOption {
+          type = path;
+          example = "/run/keys/db_password";
+          description = ''
+            File containing the database password.
+
+            This should be a string, not a Nix path, since Nix paths are
+            copied into the world-readable Nix store.
+          '';
+        };
       };
 
-      createLocally = lib.mkOption {
-        type = lib.types.bool;
-        default = true;
+      package = mkOption {
+        type = package;
+        default = pkgs.keycloak;
+        defaultText = literalExpression "pkgs.keycloak";
         description = ''
-          Whether a database should be automatically created on the
-          local host. Set this to false if you plan on provisioning a
-          local database yourself. This has no effect if
-          services.keycloak.database.host is customized.
+          Keycloak package to use.
         '';
       };
 
-      username = lib.mkOption {
-        type = lib.types.str;
-        default = "keycloak";
+      initialAdminPassword = mkOption {
+        type = str;
+        default = "changeme";
         description = ''
-          Username to use when connecting to an external or manually
-          provisioned database; has no effect when a local database is
-          automatically provisioned.
-
-          To use this with a local database, set <xref
-          linkend="opt-services.keycloak.database.createLocally" /> to
-          <literal>false</literal> and create the database and user
-          manually. The database should be called
-          <literal>keycloak</literal>.
+          Initial password set for the <literal>admin</literal>
+          user. The password is not stored safely and should be changed
+          immediately in the admin panel.
         '';
       };
 
-      passwordFile = lib.mkOption {
-        type = lib.types.path;
-        example = "/run/keys/db_password";
+      themes = mkOption {
+        type = attrsOf package;
+        default = { };
         description = ''
-          File containing the database password.
+          Additional theme packages for Keycloak. Each theme is linked into
+          subdirectory with a corresponding attribute name.
 
-          This should be a string, not a Nix path, since Nix paths are
-          copied into the world-readable Nix store.
+          Theme packages consist of several subdirectories which provide
+          different theme types: for example, <literal>account</literal>,
+          <literal>login</literal> etc. After adding a theme to this option you
+          can select it by its name in Keycloak administration console.
         '';
       };
-    };
-
-    package = lib.mkOption {
-      type = lib.types.package;
-      default = pkgs.keycloak;
-      defaultText = lib.literalExpression "pkgs.keycloak";
-      description = ''
-        Keycloak package to use.
-      '';
-    };
-
-    initialAdminPassword = lib.mkOption {
-      type = lib.types.str;
-      default = "changeme";
-      description = ''
-        Initial password set for the <literal>admin</literal>
-        user. The password is not stored safely and should be changed
-        immediately in the admin panel.
-      '';
-    };
 
-    extraConfig = lib.mkOption {
-      type = lib.types.attrs;
-      default = { };
-      example = lib.literalExpression ''
-        {
-          "subsystem=keycloak-server" = {
-            "spi=hostname" = {
-              "provider=default" = null;
-              "provider=fixed" = {
-                enabled = true;
-                properties.hostname = "keycloak.example.com";
+      extraConfig = mkOption {
+        type = attrsOf anything;
+        default = { };
+        example = literalExpression ''
+          {
+            "subsystem=keycloak-server" = {
+              "spi=hostname" = {
+                "provider=default" = null;
+                "provider=fixed" = {
+                  enabled = true;
+                  properties.hostname = "keycloak.example.com";
+                };
+                default-provider = "fixed";
               };
-              default-provider = "fixed";
             };
-          };
-        }
-      '';
-      description = ''
-        Additional Keycloak configuration options to set in
-        <literal>standalone.xml</literal>.
-
-        Options are expressed as a Nix attribute set which matches the
-        structure of the jboss-cli configuration. The configuration is
-        effectively overlayed on top of the default configuration
-        shipped with Keycloak. To remove existing nodes and undefine
-        attributes from the default configuration, set them to
-        <literal>null</literal>.
-
-        The example configuration does the equivalent of the following
-        script, which removes the hostname provider
-        <literal>default</literal>, adds the deprecated hostname
-        provider <literal>fixed</literal> and defines it the default:
-
-        <programlisting>
-        /subsystem=keycloak-server/spi=hostname/provider=default:remove()
-        /subsystem=keycloak-server/spi=hostname/provider=fixed:add(enabled = true, properties = { hostname = "keycloak.example.com" })
-        /subsystem=keycloak-server/spi=hostname:write-attribute(name=default-provider, value="fixed")
-        </programlisting>
-
-        You can discover available options by using the <link
-        xlink:href="http://docs.wildfly.org/21/Admin_Guide.html#Command_Line_Interface">jboss-cli.sh</link>
-        program and by referring to the <link
-        xlink:href="https://www.keycloak.org/docs/latest/server_installation/index.html">Keycloak
-        Server Installation and Configuration Guide</link>.
-      '';
-    };
+          }
+        '';
+        description = ''
+          Additional Keycloak configuration options to set in
+          <literal>standalone.xml</literal>.
+
+          Options are expressed as a Nix attribute set which matches the
+          structure of the jboss-cli configuration. The configuration is
+          effectively overlayed on top of the default configuration
+          shipped with Keycloak. To remove existing nodes and undefine
+          attributes from the default configuration, set them to
+          <literal>null</literal>.
+
+          The example configuration does the equivalent of the following
+          script, which removes the hostname provider
+          <literal>default</literal>, adds the deprecated hostname
+          provider <literal>fixed</literal> and defines it the default:
+
+          <programlisting>
+          /subsystem=keycloak-server/spi=hostname/provider=default:remove()
+          /subsystem=keycloak-server/spi=hostname/provider=fixed:add(enabled = true, properties = { hostname = "keycloak.example.com" })
+          /subsystem=keycloak-server/spi=hostname:write-attribute(name=default-provider, value="fixed")
+          </programlisting>
+
+          You can discover available options by using the <link
+          xlink:href="http://docs.wildfly.org/21/Admin_Guide.html#Command_Line_Interface">jboss-cli.sh</link>
+          program and by referring to the <link
+          xlink:href="https://www.keycloak.org/docs/latest/server_installation/index.html">Keycloak
+          Server Installation and Configuration Guide</link>.
+        '';
+      };
 
-  };
+    };
 
   config =
     let
@@ -285,28 +316,58 @@ in
       createLocalPostgreSQL = databaseActuallyCreateLocally && cfg.database.type == "postgresql";
       createLocalMySQL = databaseActuallyCreateLocally && cfg.database.type == "mysql";
 
-      mySqlCaKeystore = pkgs.runCommand "mysql-ca-keystore" {} ''
+      mySqlCaKeystore = pkgs.runCommand "mysql-ca-keystore" { } ''
         ${pkgs.jre}/bin/keytool -importcert -trustcacerts -alias MySQLCACert -file ${cfg.database.caCert} -keystore $out -storepass notsosecretpassword -noprompt
       '';
 
-      keycloakConfig' = builtins.foldl' lib.recursiveUpdate {
-        "interface=public".inet-address = cfg.bindAddress;
-        "socket-binding-group=standard-sockets"."socket-binding=http".port = cfg.httpPort;
-        "subsystem=keycloak-server"."spi=hostname" = {
-          "provider=default" = {
-            enabled = true;
-            properties = {
-              inherit (cfg) frontendUrl forceBackendUrlToFrontendUrl;
+      # Both theme and theme type directories need to be actual directories in one hierarchy to pass Keycloak checks.
+      themesBundle = pkgs.runCommand "keycloak-themes" { } ''
+        linkTheme() {
+          theme="$1"
+          name="$2"
+
+          mkdir "$out/$name"
+          for typeDir in "$theme"/*; do
+            if [ -d "$typeDir" ]; then
+              type="$(basename "$typeDir")"
+              mkdir "$out/$name/$type"
+              for file in "$typeDir"/*; do
+                ln -sn "$file" "$out/$name/$type/$(basename "$file")"
+              done
+            fi
+          done
+        }
+
+        mkdir -p "$out"
+        for theme in ${cfg.package}/themes/*; do
+          if [ -d "$theme" ]; then
+            linkTheme "$theme" "$(basename "$theme")"
+          fi
+        done
+
+        ${concatStringsSep "\n" (mapAttrsToList (name: theme: "linkTheme ${theme} ${escapeShellArg name}") cfg.themes)}
+      '';
+
+      keycloakConfig' = foldl' recursiveUpdate
+        {
+          "interface=public".inet-address = cfg.bindAddress;
+          "socket-binding-group=standard-sockets"."socket-binding=http".port = cfg.httpPort;
+          "subsystem=keycloak-server" = {
+            "spi=hostname"."provider=default" = {
+              enabled = true;
+              properties = {
+                inherit (cfg) frontendUrl forceBackendUrlToFrontendUrl;
+              };
             };
+            "theme=defaults".dir = toString themesBundle;
           };
-        };
-        "subsystem=datasources"."data-source=KeycloakDS" = {
-          max-pool-size = "20";
-          user-name = if databaseActuallyCreateLocally then "keycloak" else cfg.database.username;
-          password = "@db-password@";
-        };
-      } [
-        (lib.optionalAttrs (cfg.database.type == "postgresql") {
+          "subsystem=datasources"."data-source=KeycloakDS" = {
+            max-pool-size = "20";
+            user-name = if databaseActuallyCreateLocally then "keycloak" else cfg.database.username;
+            password = "@db-password@";
+          };
+        } [
+        (optionalAttrs (cfg.database.type == "postgresql") {
           "subsystem=datasources" = {
             "jdbc-driver=postgresql" = {
               driver-module-name = "org.postgresql";
@@ -314,16 +375,16 @@ in
               driver-xa-datasource-class-name = "org.postgresql.xa.PGXADataSource";
             };
             "data-source=KeycloakDS" = {
-              connection-url = "jdbc:postgresql://${cfg.database.host}:${builtins.toString cfg.database.port}/keycloak";
+              connection-url = "jdbc:postgresql://${cfg.database.host}:${toString cfg.database.port}/keycloak";
               driver-name = "postgresql";
-              "connection-properties=ssl".value = lib.boolToString cfg.database.useSSL;
-            } // (lib.optionalAttrs (cfg.database.caCert != null) {
+              "connection-properties=ssl".value = boolToString cfg.database.useSSL;
+            } // (optionalAttrs (cfg.database.caCert != null) {
               "connection-properties=sslrootcert".value = cfg.database.caCert;
               "connection-properties=sslmode".value = "verify-ca";
             });
           };
         })
-        (lib.optionalAttrs (cfg.database.type == "mysql") {
+        (optionalAttrs (cfg.database.type == "mysql") {
           "subsystem=datasources" = {
             "jdbc-driver=mysql" = {
               driver-module-name = "com.mysql";
@@ -331,28 +392,40 @@ in
               driver-class-name = "com.mysql.jdbc.Driver";
             };
             "data-source=KeycloakDS" = {
-              connection-url = "jdbc:mysql://${cfg.database.host}:${builtins.toString cfg.database.port}/keycloak";
+              connection-url = "jdbc:mysql://${cfg.database.host}:${toString cfg.database.port}/keycloak";
               driver-name = "mysql";
-              "connection-properties=useSSL".value = lib.boolToString cfg.database.useSSL;
-              "connection-properties=requireSSL".value = lib.boolToString cfg.database.useSSL;
-              "connection-properties=verifyServerCertificate".value = lib.boolToString cfg.database.useSSL;
+              "connection-properties=useSSL".value = boolToString cfg.database.useSSL;
+              "connection-properties=requireSSL".value = boolToString cfg.database.useSSL;
+              "connection-properties=verifyServerCertificate".value = boolToString cfg.database.useSSL;
               "connection-properties=characterEncoding".value = "UTF-8";
               valid-connection-checker-class-name = "org.jboss.jca.adapters.jdbc.extensions.mysql.MySQLValidConnectionChecker";
               validate-on-match = true;
               exception-sorter-class-name = "org.jboss.jca.adapters.jdbc.extensions.mysql.MySQLExceptionSorter";
-            } // (lib.optionalAttrs (cfg.database.caCert != null) {
+            } // (optionalAttrs (cfg.database.caCert != null) {
               "connection-properties=trustCertificateKeyStoreUrl".value = "file:${mySqlCaKeystore}";
               "connection-properties=trustCertificateKeyStorePassword".value = "notsosecretpassword";
             });
           };
         })
-        (lib.optionalAttrs (cfg.sslCertificate != null && cfg.sslCertificateKey != null) {
+        (optionalAttrs (cfg.sslCertificate != null && cfg.sslCertificateKey != null) {
           "socket-binding-group=standard-sockets"."socket-binding=https".port = cfg.httpsPort;
-          "core-service=management"."security-realm=UndertowRealm"."server-identity=ssl" = {
-            keystore-path = "/run/keycloak/ssl/certificate_private_key_bundle.p12";
-            keystore-password = "notsosecretpassword";
+          "subsystem=elytron" = mkOrder 900 {
+            "key-store=httpsKS" = mkOrder 900 {
+              path = "/run/keycloak/ssl/certificate_private_key_bundle.p12";
+              credential-reference.clear-text = "notsosecretpassword";
+              type = "JKS";
+            };
+            "key-manager=httpsKM" = mkOrder 901 {
+              key-store = "httpsKS";
+              credential-reference.clear-text = "notsosecretpassword";
+            };
+            "server-ssl-context=httpsSSC" = mkOrder 902 {
+              key-manager = "httpsKM";
+            };
+          };
+          "subsystem=undertow" = mkOrder 901 {
+            "server=default-server"."https-listener=https".ssl-context = "httpsSSC";
           };
-          "subsystem=undertow"."server=default-server"."https-listener=https".security-realm = "UndertowRealm";
         })
         cfg.extraConfig
       ];
@@ -441,41 +514,42 @@ in
               # with `expression` to evaluate.
               prefixExpression = string:
                 let
-                  match = (builtins.match ''"\$\{.*}"'' string);
+                  matchResult = match ''"\$\{.*}"'' string;
                 in
-                  if match != null then
-                    "expression " + string
-                  else
-                    string;
+                if matchResult != null then
+                  "expression " + string
+                else
+                  string;
 
               writeAttribute = attribute: value:
                 let
-                  type = builtins.typeOf value;
+                  type = typeOf value;
                 in
-                  if type == "set" then
-                    let
-                      names = builtins.attrNames value;
-                    in
-                      builtins.foldl' (text: name: text + (writeAttribute "${attribute}.${name}" value.${name})) "" names
-                  else if value == null then ''
-                    if (outcome == success) of ${path}:read-attribute(name="${attribute}")
-                        ${path}:undefine-attribute(name="${attribute}")
+                if type == "set" then
+                  let
+                    names = attrNames value;
+                  in
+                  foldl' (text: name: text + (writeAttribute "${attribute}.${name}" value.${name})) "" names
+                else if value == null then ''
+                  if (outcome == success) of ${path}:read-attribute(name="${attribute}")
+                      ${path}:undefine-attribute(name="${attribute}")
+                  end-if
+                ''
+                else if elem type [ "string" "path" "bool" ] then
+                  let
+                    value' = if type == "bool" then boolToString value else ''"${value}"'';
+                  in
+                  ''
+                    if (result != ${prefixExpression value'}) of ${path}:read-attribute(name="${attribute}")
+                      ${path}:write-attribute(name=${attribute}, value=${value'})
                     end-if
                   ''
-                  else if builtins.elem type [ "string" "path" "bool" ] then
-                    let
-                      value' = if type == "bool" then lib.boolToString value else ''"${value}"'';
-                    in ''
-                      if (result != ${prefixExpression value'}) of ${path}:read-attribute(name="${attribute}")
-                        ${path}:write-attribute(name=${attribute}, value=${value'})
-                      end-if
-                    ''
-                  else throw "Unsupported type '${type}' for path '${path}'!";
+                else throw "Unsupported type '${type}' for path '${path}'!";
             in
-              lib.concatStrings
-                (lib.mapAttrsToList
-                  (attribute: value: (writeAttribute attribute value))
-                  set);
+            concatStrings
+              (mapAttrsToList
+                (attribute: value: (writeAttribute attribute value))
+                set);
 
 
           /* Produces an argument list for the JBoss `add()` function,
@@ -498,98 +572,108 @@ in
             let
               makeArg = attribute: value:
                 let
-                  type = builtins.typeOf value;
+                  type = typeOf value;
                 in
-                  if type == "set" then
-                    "${attribute} = { " + (makeArgList value) + " }"
-                  else if builtins.elem type [ "string" "path" "bool" ] then
-                    "${attribute} = ${if type == "bool" then lib.boolToString value else ''"${value}"''}"
-                  else if value == null then
-                    ""
-                  else
-                    throw "Unsupported type '${type}' for attribute '${attribute}'!";
+                if type == "set" then
+                  "${attribute} = { " + (makeArgList value) + " }"
+                else if elem type [ "string" "path" "bool" ] then
+                  "${attribute} = ${if type == "bool" then boolToString value else ''"${value}"''}"
+                else if value == null then
+                  ""
+                else
+                  throw "Unsupported type '${type}' for attribute '${attribute}'!";
+
             in
-              lib.concatStringsSep ", " (lib.mapAttrsToList makeArg set);
+            concatStringsSep ", " (mapAttrsToList makeArg set);
 
 
-          /* Recurses into the `attrs` attrset, beginning at the path
-             resolved from `state.path ++ node`; if `node` is `null`,
-             starts from `state.path`. Only subattrsets that are JBoss
-             paths, i.e. follows the `key=value` format, are recursed
+          /* Recurses into the `nodeValue` attrset. Only subattrsets that
+             are JBoss paths, i.e. follows the `key=value` format, are recursed
              into - the rest are considered JBoss attributes / maps.
           */
-          recurse = state: node:
+          recurse = nodePath: nodeValue:
             let
-              path = state.path ++ (lib.optional (node != null) node);
+              nodeContent =
+                if isAttrs nodeValue && nodeValue._type or "" == "order" then
+                  nodeValue.content
+                else
+                  nodeValue;
               isPath = name:
                 let
-                  value = lib.getAttrFromPath (path ++ [ name ]) attrs;
+                  value = nodeContent.${name};
                 in
-                  if (builtins.match ".*([=]).*" name) == [ "=" ] then
-                    if builtins.isAttrs value || value == null then
-                      true
-                    else
-                      throw "Parsing path '${lib.concatStringsSep "." (path ++ [ name ])}' failed: JBoss attributes cannot contain '='!"
+                if (match ".*([=]).*" name) == [ "=" ] then
+                  if isAttrs value || value == null then
+                    true
                   else
-                    false;
-              jbossPath = "/" + (lib.concatStringsSep "/" path);
-              nodeValue = lib.getAttrFromPath path attrs;
-              children = if !builtins.isAttrs nodeValue then {} else nodeValue;
-              subPaths = builtins.filter isPath (builtins.attrNames children);
-              jbossAttrs = lib.filterAttrs (name: _: !(isPath name)) children;
-            in
-              state // {
-                text = state.text + (
-                  if nodeValue != null then ''
+                    throw "Parsing path '${concatStringsSep "." (nodePath ++ [ name ])}' failed: JBoss attributes cannot contain '='!"
+                else
+                  false;
+              jbossPath = "/" + concatStringsSep "/" nodePath;
+              children = if !isAttrs nodeContent then { } else nodeContent;
+              subPaths = filter isPath (attrNames children);
+              getPriority = name:
+                let
+                  value = children.${name};
+                in
+                if value._type or "" == "order" then value.priority else 1000;
+              orderedSubPaths = sort (a: b: getPriority a < getPriority b) subPaths;
+              jbossAttrs = filterAttrs (name: _: !(isPath name)) children;
+              text =
+                if nodeContent != null then
+                  ''
                     if (outcome != success) of ${jbossPath}:read-resource()
                         ${jbossPath}:add(${makeArgList jbossAttrs})
                     end-if
-                  '' + (writeAttributes jbossPath jbossAttrs)
-                  else ''
+                  '' + writeAttributes jbossPath jbossAttrs
+                else
+                  ''
                     if (outcome == success) of ${jbossPath}:read-resource()
                         ${jbossPath}:remove()
                     end-if
-                  '') + (builtins.foldl' recurse { text = ""; inherit path; } subPaths).text;
-              };
+                  '';
+            in
+            text + concatMapStringsSep "\n" (name: recurse (nodePath ++ [ name ]) children.${name}) orderedSubPaths;
         in
-          (recurse { text = ""; path = []; } null).text;
-
+        recurse [ ] attrs;
 
       jbossCliScript = pkgs.writeText "jboss-cli-script" (mkJbossScript keycloakConfig');
 
-      keycloakConfig = pkgs.runCommand "keycloak-config" {
-        nativeBuildInputs = [ cfg.package ];
-      } ''
-        export JBOSS_BASE_DIR="$(pwd -P)";
-        export JBOSS_MODULEPATH="${cfg.package}/modules";
-        export JBOSS_LOG_DIR="$JBOSS_BASE_DIR/log";
+      keycloakConfig = pkgs.runCommand "keycloak-config"
+        {
+          nativeBuildInputs = [ cfg.package ];
+        }
+        ''
+          export JBOSS_BASE_DIR="$(pwd -P)";
+          export JBOSS_MODULEPATH="${cfg.package}/modules";
+          export JBOSS_LOG_DIR="$JBOSS_BASE_DIR/log";
 
-        cp -r ${cfg.package}/standalone/configuration .
-        chmod -R u+rwX ./configuration
+          cp -r ${cfg.package}/standalone/configuration .
+          chmod -R u+rwX ./configuration
 
-        mkdir -p {deployments,ssl}
+          mkdir -p {deployments,ssl}
 
-        standalone.sh&
+          standalone.sh&
 
-        attempt=1
-        max_attempts=30
-        while ! jboss-cli.sh --connect ':read-attribute(name=server-state)'; do
-            if [[ "$attempt" == "$max_attempts" ]]; then
-                echo "ERROR: Could not connect to Keycloak after $attempt attempts! Failing.." >&2
-                exit 1
-            fi
-            echo "Keycloak not fully started yet, retrying.. ($attempt/$max_attempts)"
-            sleep 1
-            (( attempt++ ))
-        done
+          attempt=1
+          max_attempts=30
+          while ! jboss-cli.sh --connect ':read-attribute(name=server-state)'; do
+              if [[ "$attempt" == "$max_attempts" ]]; then
+                  echo "ERROR: Could not connect to Keycloak after $attempt attempts! Failing.." >&2
+                  exit 1
+              fi
+              echo "Keycloak not fully started yet, retrying.. ($attempt/$max_attempts)"
+              sleep 1
+              (( attempt++ ))
+          done
 
-        jboss-cli.sh --connect --file=${jbossCliScript} --echo-command
+          jboss-cli.sh --connect --file=${jbossCliScript} --echo-command
 
-        cp configuration/standalone.xml $out
-      '';
+          cp configuration/standalone.xml $out
+        '';
     in
-      lib.mkIf cfg.enable {
-
+    mkIf cfg.enable
+      {
         assertions = [
           {
             assertion = (cfg.database.useSSL && cfg.database.type == "postgresql") -> (cfg.database.caCert != null);
@@ -599,7 +683,7 @@ in
 
         environment.systemPackages = [ cfg.package ];
 
-        systemd.services.keycloakPostgreSQLInit = lib.mkIf createLocalPostgreSQL {
+        systemd.services.keycloakPostgreSQLInit = mkIf createLocalPostgreSQL {
           after = [ "postgresql.service" ];
           before = [ "keycloak.service" ];
           bindsTo = [ "postgresql.service" ];
@@ -623,7 +707,7 @@ in
           '';
         };
 
-        systemd.services.keycloakMySQLInit = lib.mkIf createLocalMySQL {
+        systemd.services.keycloakMySQLInit = mkIf createLocalMySQL {
           after = [ "mysql.service" ];
           before = [ "keycloak.service" ];
           bindsTo = [ "mysql.service" ];
@@ -650,13 +734,16 @@ in
           let
             databaseServices =
               if createLocalPostgreSQL then [
-                "keycloakPostgreSQLInit.service" "postgresql.service"
+                "keycloakPostgreSQLInit.service"
+                "postgresql.service"
               ]
               else if createLocalMySQL then [
-                "keycloakMySQLInit.service" "mysql.service"
+                "keycloakMySQLInit.service"
+                "mysql.service"
               ]
               else [ ];
-          in {
+          in
+          {
             after = databaseServices;
             bindsTo = databaseServices;
             wantedBy = [ "multi-user.target" ];
@@ -671,52 +758,16 @@ in
               JBOSS_MODULEPATH = "${cfg.package}/modules";
             };
             serviceConfig = {
-              ExecStartPre = let
-                startPreFullPrivileges = ''
-                  set -o errexit -o pipefail -o nounset -o errtrace
-                  shopt -s inherit_errexit
-
-                  umask u=rwx,g=,o=
-
-                  install -T -m 0400 -o keycloak -g keycloak '${cfg.database.passwordFile}' /run/keycloak/secrets/db_password
-                '' + lib.optionalString (cfg.sslCertificate != null && cfg.sslCertificateKey != null) ''
-                  install -T -m 0400 -o keycloak -g keycloak '${cfg.sslCertificate}' /run/keycloak/secrets/ssl_cert
-                  install -T -m 0400 -o keycloak -g keycloak '${cfg.sslCertificateKey}' /run/keycloak/secrets/ssl_key
-                '';
-                startPre = ''
-                  set -o errexit -o pipefail -o nounset -o errtrace
-                  shopt -s inherit_errexit
-
-                  umask u=rwx,g=,o=
-
-                  install -m 0600 ${cfg.package}/standalone/configuration/*.properties /run/keycloak/configuration
-                  install -T -m 0600 ${keycloakConfig} /run/keycloak/configuration/standalone.xml
-
-                  replace-secret '@db-password@' '/run/keycloak/secrets/db_password' /run/keycloak/configuration/standalone.xml
-
-                  export JAVA_OPTS=-Djboss.server.config.user.dir=/run/keycloak/configuration
-                  add-user-keycloak.sh -u admin -p '${cfg.initialAdminPassword}'
-                '' + lib.optionalString (cfg.sslCertificate != null && cfg.sslCertificateKey != null) ''
-                  pushd /run/keycloak/ssl/
-                  cat /run/keycloak/secrets/ssl_cert <(echo) \
-                      /run/keycloak/secrets/ssl_key <(echo) \
-                      /etc/ssl/certs/ca-certificates.crt \
-                      > allcerts.pem
-                  openssl pkcs12 -export -in /run/keycloak/secrets/ssl_cert -inkey /run/keycloak/secrets/ssl_key -chain \
-                                 -name "${cfg.frontendUrl}" -out certificate_private_key_bundle.p12 \
-                                 -CAfile allcerts.pem -passout pass:notsosecretpassword
-                  popd
-                '';
-              in [
-                "+${pkgs.writeShellScript "keycloak-start-pre-full-privileges" startPreFullPrivileges}"
-                "${pkgs.writeShellScript "keycloak-start-pre" startPre}"
+              LoadCredential = [
+                "db_password:${cfg.database.passwordFile}"
+              ] ++ optionals (cfg.sslCertificate != null && cfg.sslCertificateKey != null) [
+                "ssl_cert:${cfg.sslCertificate}"
+                "ssl_key:${cfg.sslCertificateKey}"
               ];
-              ExecStart = "${cfg.package}/bin/standalone.sh";
               User = "keycloak";
               Group = "keycloak";
               DynamicUser = true;
               RuntimeDirectory = map (p: "keycloak/" + p) [
-                "secrets"
                 "configuration"
                 "deployments"
                 "data"
@@ -728,13 +779,39 @@ in
               LogsDirectory = "keycloak";
               AmbientCapabilities = "CAP_NET_BIND_SERVICE";
             };
+            script = ''
+              set -o errexit -o pipefail -o nounset -o errtrace
+              shopt -s inherit_errexit
+
+              umask u=rwx,g=,o=
+
+              install -m 0600 ${cfg.package}/standalone/configuration/*.properties /run/keycloak/configuration
+              install -T -m 0600 ${keycloakConfig} /run/keycloak/configuration/standalone.xml
+
+              replace-secret '@db-password@' "$CREDENTIALS_DIRECTORY/db_password" /run/keycloak/configuration/standalone.xml
+
+              export JAVA_OPTS=-Djboss.server.config.user.dir=/run/keycloak/configuration
+              add-user-keycloak.sh -u admin -p '${cfg.initialAdminPassword}'
+            '' + optionalString (cfg.sslCertificate != null && cfg.sslCertificateKey != null) ''
+              pushd /run/keycloak/ssl/
+              cat "$CREDENTIALS_DIRECTORY/ssl_cert" <(echo) \
+                  "$CREDENTIALS_DIRECTORY/ssl_key" <(echo) \
+                  /etc/ssl/certs/ca-certificates.crt \
+                  > allcerts.pem
+              openssl pkcs12 -export -in "$CREDENTIALS_DIRECTORY/ssl_cert" -inkey "$CREDENTIALS_DIRECTORY/ssl_key" -chain \
+                             -name "${cfg.frontendUrl}" -out certificate_private_key_bundle.p12 \
+                             -CAfile allcerts.pem -passout pass:notsosecretpassword
+              popd
+            '' + ''
+              ${cfg.package}/bin/standalone.sh
+            '';
           };
 
-        services.postgresql.enable = lib.mkDefault createLocalPostgreSQL;
-        services.mysql.enable = lib.mkDefault createLocalMySQL;
-        services.mysql.package = lib.mkIf createLocalMySQL pkgs.mariadb;
+        services.postgresql.enable = mkDefault createLocalPostgreSQL;
+        services.mysql.enable = mkDefault createLocalMySQL;
+        services.mysql.package = mkIf createLocalMySQL pkgs.mariadb;
       };
 
   meta.doc = ./keycloak.xml;
-  meta.maintainers = [ lib.maintainers.talyz ];
+  meta.maintainers = [ maintainers.talyz ];
 }
diff --git a/nixos/modules/services/web-apps/keycloak.xml b/nixos/modules/services/web-apps/keycloak.xml
index 7ba656c20f1..cb706932f48 100644
--- a/nixos/modules/services/web-apps/keycloak.xml
+++ b/nixos/modules/services/web-apps/keycloak.xml
@@ -85,7 +85,12 @@
        The frontend URL is used as base for all frontend requests and
        must be configured through <xref linkend="opt-services.keycloak.frontendUrl" />.
        It should normally include a trailing <literal>/auth</literal>
-       (the default web context).
+       (the default web context). If you use a reverse proxy, you need
+       to set this option to <literal>""</literal>, so that frontend URL
+       is derived from HTTP headers. <literal>X-Forwarded-*</literal> headers
+       support also should be enabled, using <link
+       xlink:href="https://www.keycloak.org/docs/latest/server_installation/index.html#identifying-client-ip-addresses">
+       respective guidelines</link>.
      </para>
 
      <para>
@@ -131,6 +136,17 @@
      </warning>
    </section>
 
+   <section xml:id="module-services-keycloak-themes">
+     <title>Themes</title>
+     <para>
+        You can package custom themes and make them visible to Keycloak via
+        <xref linkend="opt-services.keycloak.themes" />
+        option. See the <link xlink:href="https://www.keycloak.org/docs/latest/server_development/#_themes">
+        Themes section of the Keycloak Server Development Guide</link>
+        and respective NixOS option description for more information.
+     </para>
+   </section>
+
    <section xml:id="module-services-keycloak-extra-config">
      <title>Additional configuration</title>
      <para>
diff --git a/nixos/modules/services/web-apps/mattermost.nix b/nixos/modules/services/web-apps/mattermost.nix
index 310a673f511..2901f307dc5 100644
--- a/nixos/modules/services/web-apps/mattermost.nix
+++ b/nixos/modules/services/web-apps/mattermost.nix
@@ -181,7 +181,7 @@ in
         description = ''
           Plugins to add to the configuration. Overrides any installed if non-null.
           This is a list of paths to .tar.gz files or derivations evaluating to
-          .tar.gz files. All entries will be passed to `mattermost plugin add`.
+          .tar.gz files.
         '';
       };
 
diff --git a/nixos/modules/services/web-apps/prosody-filer.nix b/nixos/modules/services/web-apps/prosody-filer.nix
index 6a52c36ab2c..a901a95fd5f 100644
--- a/nixos/modules/services/web-apps/prosody-filer.nix
+++ b/nixos/modules/services/web-apps/prosody-filer.nix
@@ -21,12 +21,10 @@ in {
 
         type = settingsFormat.type;
 
-        example = literalExample ''
-          {
-            secret = "mysecret";
-            storeDir = "/srv/http/nginx/prosody-upload";
-          }
-        '';
+        example = {
+          secret = "mysecret";
+          storeDir = "/srv/http/nginx/prosody-upload";
+        };
 
         defaultText = literalExpression ''
           {
diff --git a/nixos/modules/system/activation/switch-to-configuration.pl b/nixos/modules/system/activation/switch-to-configuration.pl
index 3fbab8b94c9..93fff889d6b 100644
--- a/nixos/modules/system/activation/switch-to-configuration.pl
+++ b/nixos/modules/system/activation/switch-to-configuration.pl
@@ -18,11 +18,13 @@ my $startListFile = "/run/nixos/start-list";
 my $restartListFile = "/run/nixos/restart-list";
 my $reloadListFile = "/run/nixos/reload-list";
 
-# Parse restart/reload requests by the activation script
+# Parse restart/reload requests by the activation script.
+# Activation scripts may write newline-separated units to this
+# file and switch-to-configuration will handle them. While
+# `stopIfChanged = true` is ignored, switch-to-configuration will
+# handle `restartIfChanged = false` and `reloadIfChanged = true`.
 my $restartByActivationFile = "/run/nixos/activation-restart-list";
-my $reloadByActivationFile = "/run/nixos/activation-reload-list";
 my $dryRestartByActivationFile = "/run/nixos/dry-activation-restart-list";
-my $dryReloadByActivationFile = "/run/nixos/dry-activation-reload-list";
 
 make_path("/run/nixos", { mode => oct(755) });
 
@@ -382,7 +384,6 @@ sub filterUnits {
 }
 
 my @unitsToStopFiltered = filterUnits(\%unitsToStop);
-my @unitsToStartFiltered = filterUnits(\%unitsToStart);
 
 
 # Show dry-run actions.
@@ -395,21 +396,39 @@ if ($action eq "dry-activate") {
     print STDERR "would activate the configuration...\n";
     system("$out/dry-activate", "$out");
 
-    $unitsToRestart{$_} = 1 foreach
-        split('\n', read_file($dryRestartByActivationFile, err_mode => 'quiet') // "");
+    # Handle the activation script requesting the restart or reload of a unit.
+    foreach (split('\n', read_file($dryRestartByActivationFile, err_mode => 'quiet') // "")) {
+        my $unit = $_;
+        my $baseUnit = $unit;
+        my $newUnitFile = "$out/etc/systemd/system/$baseUnit";
+
+        # Detect template instances.
+        if (!-e $newUnitFile && $unit =~ /^(.*)@[^\.]*\.(.*)$/) {
+          $baseUnit = "$1\@.$2";
+          $newUnitFile = "$out/etc/systemd/system/$baseUnit";
+        }
+
+        my $baseName = $baseUnit;
+        $baseName =~ s/\.[a-z]*$//;
 
-    $unitsToReload{$_} = 1 foreach
-        split('\n', read_file($dryReloadByActivationFile, err_mode => 'quiet') // "");
+        # Start units if they were not active previously
+        if (not defined $activePrev->{$unit}) {
+            $unitsToStart{$unit} = 1;
+            next;
+        }
+
+        handleModifiedUnit($unit, $baseName, $newUnitFile, $activePrev, \%unitsToRestart, \%unitsToRestart, \%unitsToReload, \%unitsToRestart, \%unitsToSkip);
+    }
+    unlink($dryRestartByActivationFile);
 
     print STDERR "would restart systemd\n" if $restartSystemd;
     print STDERR "would reload the following units: ", join(", ", sort(keys %unitsToReload)), "\n"
         if scalar(keys %unitsToReload) > 0;
     print STDERR "would restart the following units: ", join(", ", sort(keys %unitsToRestart)), "\n"
         if scalar(keys %unitsToRestart) > 0;
+    my @unitsToStartFiltered = filterUnits(\%unitsToStart);
     print STDERR "would start the following units: ", join(", ", @unitsToStartFiltered), "\n"
         if scalar @unitsToStartFiltered;
-    unlink($dryRestartByActivationFile);
-    unlink($dryReloadByActivationFile);
     exit 0;
 }
 
@@ -433,13 +452,31 @@ print STDERR "activating the configuration...\n";
 system("$out/activate", "$out") == 0 or $res = 2;
 
 # Handle the activation script requesting the restart or reload of a unit.
-# We can only restart and reload (not stop/start) because the units to be
-# stopped are already stopped before the activation script is run.
-$unitsToRestart{$_} = 1 foreach
-    split('\n', read_file($restartByActivationFile, err_mode => 'quiet') // "");
+foreach (split('\n', read_file($restartByActivationFile, err_mode => 'quiet') // "")) {
+    my $unit = $_;
+    my $baseUnit = $unit;
+    my $newUnitFile = "$out/etc/systemd/system/$baseUnit";
 
-$unitsToReload{$_} = 1 foreach
-    split('\n', read_file($reloadByActivationFile, err_mode => 'quiet') // "");
+    # Detect template instances.
+    if (!-e $newUnitFile && $unit =~ /^(.*)@[^\.]*\.(.*)$/) {
+      $baseUnit = "$1\@.$2";
+      $newUnitFile = "$out/etc/systemd/system/$baseUnit";
+    }
+
+    my $baseName = $baseUnit;
+    $baseName =~ s/\.[a-z]*$//;
+
+    # Start units if they were not active previously
+    if (not defined $activePrev->{$unit}) {
+        $unitsToStart{$unit} = 1;
+        recordUnit($startListFile, $unit);
+        next;
+    }
+
+    handleModifiedUnit($unit, $baseName, $newUnitFile, $activePrev, \%unitsToRestart, \%unitsToRestart, \%unitsToReload, \%unitsToRestart, \%unitsToSkip);
+}
+# We can remove the file now because it has been propagated to the other restart/reload files
+unlink($restartByActivationFile);
 
 # Restart systemd if necessary. Note that this is done using the
 # current version of systemd, just in case the new one has trouble
@@ -480,7 +517,6 @@ if (scalar(keys %unitsToReload) > 0) {
     print STDERR "reloading the following units: ", join(", ", sort(keys %unitsToReload)), "\n";
     system("@systemd@/bin/systemctl", "reload", "--", sort(keys %unitsToReload)) == 0 or $res = 4;
     unlink($reloadListFile);
-    unlink($reloadByActivationFile);
 }
 
 # Restart changed services (those that have to be restarted rather
@@ -489,7 +525,6 @@ if (scalar(keys %unitsToRestart) > 0) {
     print STDERR "restarting the following units: ", join(", ", sort(keys %unitsToRestart)), "\n";
     system("@systemd@/bin/systemctl", "restart", "--", sort(keys %unitsToRestart)) == 0 or $res = 4;
     unlink($restartListFile);
-    unlink($restartByActivationFile);
 }
 
 # Start all active targets, as well as changed units we stopped above.
@@ -498,6 +533,7 @@ if (scalar(keys %unitsToRestart) > 0) {
 # that are symlinks to other units.  We shouldn't start both at the
 # same time because we'll get a "Failed to add path to set" error from
 # systemd.
+my @unitsToStartFiltered = filterUnits(\%unitsToStart);
 print STDERR "starting the following units: ", join(", ", @unitsToStartFiltered), "\n"
     if scalar @unitsToStartFiltered;
 system("@systemd@/bin/systemctl", "start", "--", sort(keys %unitsToStart)) == 0 or $res = 4;
diff --git a/nixos/tests/adguardhome.nix b/nixos/tests/adguardhome.nix
new file mode 100644
index 00000000000..ddbe8ff9c11
--- /dev/null
+++ b/nixos/tests/adguardhome.nix
@@ -0,0 +1,57 @@
+import ./make-test-python.nix {
+  name = "adguardhome";
+
+  nodes = {
+    minimalConf = { ... }: {
+      services.adguardhome = { enable = true; };
+    };
+
+    declarativeConf = { ... }: {
+      services.adguardhome = {
+        enable = true;
+
+        mutableSettings = false;
+        settings = {
+          dns = {
+            bind_host = "0.0.0.0";
+            bootstrap_dns = "127.0.0.1";
+          };
+        };
+      };
+    };
+
+    mixedConf = { ... }: {
+      services.adguardhome = {
+        enable = true;
+
+        mutableSettings = true;
+        settings = {
+          dns = {
+            bind_host = "0.0.0.0";
+            bootstrap_dns = "127.0.0.1";
+          };
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    with subtest("Minimal config test"):
+        minimalConf.wait_for_unit("adguardhome.service")
+        minimalConf.wait_for_open_port(3000)
+
+    with subtest("Declarative config test, DNS will be reachable"):
+        declarativeConf.wait_for_unit("adguardhome.service")
+        declarativeConf.wait_for_open_port(53)
+        declarativeConf.wait_for_open_port(3000)
+
+    with subtest("Mixed config test, check whether merging works"):
+        mixedConf.wait_for_unit("adguardhome.service")
+        mixedConf.wait_for_open_port(53)
+        mixedConf.wait_for_open_port(3000)
+        # Test whether merging works properly, even if nothing is changed
+        mixedConf.systemctl("restart adguardhome.service")
+        mixedConf.wait_for_unit("adguardhome.service")
+        mixedConf.wait_for_open_port(3000)
+  '';
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 8d6f6d2a5f5..bbf6de7b6cf 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -23,6 +23,7 @@ in
 {
   _3proxy = handleTest ./3proxy.nix {};
   acme = handleTest ./acme.nix {};
+  adguardhome = handleTest ./adguardhome.nix {};
   aesmd = handleTest ./aesmd.nix {};
   agda = handleTest ./agda.nix {};
   airsonic = handleTest ./airsonic.nix {};
@@ -474,6 +475,7 @@ in
   taskserver = handleTest ./taskserver.nix {};
   telegraf = handleTest ./telegraf.nix {};
   teleport = handleTest ./teleport.nix {};
+  thelounge = handleTest ./thelounge.nix {};
   tiddlywiki = handleTest ./tiddlywiki.nix {};
   tigervnc = handleTest ./tigervnc.nix {};
   timezone = handleTest ./timezone.nix {};
@@ -488,6 +490,7 @@ in
   trezord = handleTest ./trezord.nix {};
   trickster = handleTest ./trickster.nix {};
   trilium-server = handleTestOn ["x86_64-linux"] ./trilium-server.nix {};
+  tsm-client-gui = handleTest ./tsm-client-gui.nix {};
   txredisapi = handleTest ./txredisapi.nix {};
   tuptime = handleTest ./tuptime.nix {};
   turbovnc-headless-server = handleTest ./turbovnc-headless-server.nix {};
diff --git a/nixos/tests/borgbackup.nix b/nixos/tests/borgbackup.nix
index cbb28689209..d3cd6c66bfe 100644
--- a/nixos/tests/borgbackup.nix
+++ b/nixos/tests/borgbackup.nix
@@ -106,7 +106,7 @@ in {
       services.openssh = {
         enable = true;
         passwordAuthentication = false;
-        challengeResponseAuthentication = false;
+        kbdInteractiveAuthentication = false;
       };
 
       services.borgbackup.repos.repo1 = {
diff --git a/nixos/tests/btrbk.nix b/nixos/tests/btrbk.nix
index 2689bb66c63..9f34f7dfbe3 100644
--- a/nixos/tests/btrbk.nix
+++ b/nixos/tests/btrbk.nix
@@ -53,7 +53,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
         services.openssh = {
           enable = true;
           passwordAuthentication = false;
-          challengeResponseAuthentication = false;
+          kbdInteractiveAuthentication = false;
         };
         services.btrbk = {
           extraPackages = [ pkgs.lz4 ];
diff --git a/nixos/tests/google-oslogin/server.nix b/nixos/tests/google-oslogin/server.nix
index fdb7141da31..a0a3144ae69 100644
--- a/nixos/tests/google-oslogin/server.nix
+++ b/nixos/tests/google-oslogin/server.nix
@@ -17,7 +17,7 @@ in {
   };
 
   services.openssh.enable = true;
-  services.openssh.challengeResponseAuthentication = false;
+  services.openssh.kbdInteractiveAuthentication = false;
   services.openssh.passwordAuthentication = false;
 
   security.googleOsLogin.enable = true;
diff --git a/nixos/tests/rstudio-server.nix b/nixos/tests/rstudio-server.nix
new file mode 100644
index 00000000000..c7ac7670fbd
--- /dev/null
+++ b/nixos/tests/rstudio-server.nix
@@ -0,0 +1,30 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+  {
+    name = "rstudio-server-test";
+    meta.maintainers = with pkgs.lib.maintainers; [ jbedo cfhammill ];
+
+    nodes.machine = { config, lib, pkgs, ... }: {
+      services.rstudio-server.enable = true;
+    };
+
+    nodes.customPackageMachine = { config, lib, pkgs, ... }: {
+      services.rstudio-server = {
+        enable = true;
+        package = pkgs.rstudioServerWrapper.override { packages = [ pkgs.rPackages.ggplot2 ]; };
+      };
+    };
+
+    users.testuser = {
+      uid = 1000;
+      group = "testgroup";
+    };
+    groups.testgroup.gid = 1000;
+
+    testScript = ''
+      machine.wait_for_unit("rstudio-server.service")
+      machine.succeed("curl -f -vvv -s http://127.0.0.1:8787")
+
+      customPackageMachine.wait_for_unit("rstudio-server.service")
+      customPackageMachine.succeed("curl -f -vvv -s http://127.0.0.1:8787")
+    '';
+  })
diff --git a/nixos/tests/switch-test.nix b/nixos/tests/switch-test.nix
index daad9134885..1c32bf6beb9 100644
--- a/nixos/tests/switch-test.nix
+++ b/nixos/tests/switch-test.nix
@@ -45,6 +45,50 @@ import ./make-test-python.nix ({ pkgs, ...} : {
           systemd.services.test.restartIfChanged = false;
         };
 
+        restart-and-reload-by-activation-script.configuration = {
+          systemd.services = rec {
+            simple-service = {
+              # No wantedBy so we can check if the activation script restart triggers them
+              serviceConfig = {
+                Type = "oneshot";
+                RemainAfterExit = true;
+                ExecStart = "${pkgs.coreutils}/bin/true";
+                ExecReload = "${pkgs.coreutils}/bin/true";
+              };
+            };
+
+            simple-restart-service = simple-service // {
+              stopIfChanged = false;
+            };
+
+            simple-reload-service = simple-service // {
+              reloadIfChanged = true;
+            };
+
+            no-restart-service = simple-service // {
+              restartIfChanged = false;
+            };
+          };
+
+          system.activationScripts.restart-and-reload-test = {
+            supportsDryActivation = true;
+            deps = [];
+            text = ''
+              if [ "$NIXOS_ACTION" = dry-activate ]; then
+                f=/run/nixos/dry-activation-restart-list
+              else
+                f=/run/nixos/activation-restart-list
+              fi
+              cat <<EOF >> "$f"
+              simple-service.service
+              simple-restart-service.service
+              simple-reload-service.service
+              no-restart-service.service
+              EOF
+            '';
+          };
+        };
+
         mount.configuration = {
           systemd.mounts = [
             {
@@ -261,6 +305,32 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_lacks(out, "as well:")
         assert_contains(out, "would start the following units: test.service\n")
 
+    with subtest("restart and reload by activation script"):
+        out = switch_to_specialisation("${machine}", "restart-and-reload-by-activation-script")
+        assert_contains(out, "stopping the following units: test.service\n")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_lacks(out, "reloading the following units:")
+        assert_lacks(out, "restarting the following units:")
+        assert_contains(out, "\nstarting the following units: no-restart-service.service, simple-reload-service.service, simple-restart-service.service, simple-service.service\n")
+        assert_lacks(out, "as well:")
+        # Switch to the same system where the example services get restarted
+        # by the activation script
+        out = switch_to_specialisation("${machine}", "restart-and-reload-by-activation-script")
+        assert_lacks(out, "stopping the following units:")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_contains(out, "reloading the following units: simple-reload-service.service\n")
+        assert_contains(out, "restarting the following units: simple-restart-service.service, simple-service.service\n")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_lacks(out, "as well:")
+        # The same, but in dry mode
+        out = switch_to_specialisation("${machine}", "restart-and-reload-by-activation-script", action="dry-activate")
+        assert_lacks(out, "would stop the following units:")
+        assert_lacks(out, "would NOT stop the following changed units:")
+        assert_contains(out, "would reload the following units: simple-reload-service.service\n")
+        assert_contains(out, "would restart the following units: simple-restart-service.service, simple-service.service\n")
+        assert_lacks(out, "\nwould start the following units:")
+        assert_lacks(out, "as well:")
+
     with subtest("mounts"):
         switch_to_specialisation("${machine}", "mount")
         out = machine.succeed("mount | grep 'on /testmount'")
diff --git a/nixos/tests/thelounge.nix b/nixos/tests/thelounge.nix
new file mode 100644
index 00000000000..e9b85685bf2
--- /dev/null
+++ b/nixos/tests/thelounge.nix
@@ -0,0 +1,29 @@
+import ./make-test-python.nix {
+  nodes = {
+    private = { config, pkgs, ... }: {
+      services.thelounge = {
+        enable = true;
+        plugins = [ pkgs.theLoungePlugins.themes.solarized ];
+      };
+    };
+
+    public = { config, pkgs, ... }: {
+      services.thelounge = {
+        enable = true;
+        public = true;
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    for machine in machines:
+      machine.wait_for_unit("thelounge.service")
+      machine.wait_for_open_port(9000)
+
+    private.wait_until_succeeds("journalctl -u thelounge.service | grep thelounge-theme-solarized")
+    private.wait_until_succeeds("journalctl -u thelounge.service | grep 'in private mode'")
+    public.wait_until_succeeds("journalctl -u thelounge.service | grep 'in public mode'")
+  '';
+}
diff --git a/nixos/tests/tsm-client-gui.nix b/nixos/tests/tsm-client-gui.nix
new file mode 100644
index 00000000000..e4bcd344a89
--- /dev/null
+++ b/nixos/tests/tsm-client-gui.nix
@@ -0,0 +1,57 @@
+# The tsm-client GUI first tries to connect to a server.
+# We can't simulate a server, so we just check if
+# it reports the correct connection failure error.
+# After that the test persuades the GUI
+# to show its main application window
+# and verifies some configuration information.
+
+import ./make-test-python.nix ({ lib, pkgs, ... }: {
+  name = "tsm-client";
+
+  enableOCR = true;
+
+  machine = { pkgs, ... }: {
+    imports = [ ./common/x11.nix ];
+    programs.tsmClient = {
+      enable = true;
+      package = pkgs.tsm-client-withGui;
+      defaultServername = "testserver";
+      servers.testserver = {
+        # 192.0.0.8 is a "dummy address" according to RFC 7600
+        server = "192.0.0.8";
+        node = "SOME-NODE";
+        passwdDir = "/tmp";
+      };
+    };
+  };
+
+  testScript = ''
+    machine.succeed("which dsmj")  # fail early if this is missing
+    machine.wait_for_x()
+    machine.execute("DSM_LOG=/tmp dsmj -optfile=/dev/null >&2 &")
+
+    # does it report the "TCP/IP connection failure" error code?
+    machine.wait_for_window("IBM Spectrum Protect")
+    machine.wait_for_text("ANS2610S")
+    machine.send_key("esc")
+
+    # it asks to continue to restore a local backupset now;
+    # "yes" (return) leads to the main application window
+    machine.wait_for_text("backupset")
+    machine.send_key("ret")
+
+    # main window: navigate to "Connection Information"
+    machine.wait_for_text("Welcome")
+    machine.send_key("alt-f")  # "File" menu
+    machine.send_key("c")  # "Connection Information"
+
+    # "Connection Information" dialog box
+    machine.wait_for_window("Connection Information")
+    machine.wait_for_text("SOME-NODE")
+    machine.wait_for_text("${pkgs.tsm-client.passthru.unwrapped.version}")
+
+    machine.shutdown()
+  '';
+
+  meta.maintainers = [ lib.maintainers.yarny ];
+})
diff --git a/pkgs/applications/audio/aumix/default.nix b/pkgs/applications/audio/aumix/default.nix
index 51dda20cc3a..2603e88fcbd 100644
--- a/pkgs/applications/audio/aumix/default.nix
+++ b/pkgs/applications/audio/aumix/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , gettext
 , ncurses
 , gtkGUI ? false
@@ -17,6 +18,16 @@ stdenv.mkDerivation rec {
     sha256 = "0a8fwyxnc5qdxff8sl2sfsbnvgh6pkij4yafiln0fxgg6bal7knj";
   };
 
+  patches = [
+    # Pull Gentoo fix for -fno-common toolchains. Upstream does not
+    # seem to have the contacts
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-sound/aumix/files/aumix-2.9.1-fno-common.patch?id=496c9ec7355f06f6d1d19be780a6981503e6df1f";
+      sha256 = "0qwylhx1hawsmx1pc7ykrjq9phksc73dq9rss6ggq15n3ggnc95y";
+    })
+  ];
+
   buildInputs = [ gettext ncurses ]
     ++ lib.optionals gtkGUI [ pkg-config gtk2 ];
 
diff --git a/pkgs/applications/audio/bespokesynth/default.nix b/pkgs/applications/audio/bespokesynth/default.nix
index e8d2ada3878..a5ef585969e 100644
--- a/pkgs/applications/audio/bespokesynth/default.nix
+++ b/pkgs/applications/audio/bespokesynth/default.nix
@@ -1,40 +1,46 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, fetchzip
-, libjack2, alsa-lib, freetype, libX11, libXrandr, libXinerama, libXext, libXcursor
-, libGL, python3, ncurses, libusb1
-, gtk3, webkitgtk, curl, xvfb-run, makeWrapper
-  # "Debug", or "Release"
-, buildType ? "Release"
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchzip
+, cmake
+, pkg-config
+, ninja
+, makeWrapper
+, libjack2
+, alsa-lib
+, alsa-tools
+, freetype
+, libusb1
+, libX11
+, libXrandr
+, libXinerama
+, libXext
+, libXcursor
+, libXScrnSaver
+, libGL
+, libxcb
+, xcbutil
+, libxkbcommon
+, xcbutilkeysyms
+, xcb-util-cursor
+, gtk3
+, webkitgtk
+, python3
+, curl
+, pcre
+, mount
+, gnome
+, Cocoa
+, WebKit
+, CoreServices
+, CoreAudioKit
+  # It is not allowed to distribute binaries with the VST2 SDK plugin without a license
+  # (the author of Bespoke has such a licence but not Nix). VST3 should work out of the box.
+  # Read more in https://github.com/NixOS/nixpkgs/issues/145607
+, enableVST2 ? false
 }:
 
 let
-  projucer = stdenv.mkDerivation rec {
-    pname = "projucer";
-    version = "5.4.7";
-
-    src = fetchFromGitHub {
-      owner = "juce-framework";
-      repo = "JUCE";
-      rev = version;
-      sha256= "0qpiqfwwpcghk7ij6w4vy9ywr3ryg7ppg77bmd7783kxg6zbhj8h";
-    };
-
-    nativeBuildInputs = [ pkg-config ];
-    buildInputs = [
-      freetype libX11 libXrandr libXinerama libXext gtk3 webkitgtk
-      libjack2 curl
-    ];
-    preBuild = ''
-      cd extras/Projucer/Builds/LinuxMakefile
-    '';
-    makeFlags = [ "CONFIG=${buildType}" ];
-    enableParallelBuilding = true;
-
-    installPhase = ''
-      mkdir -p $out/bin
-      cp -a build/Projucer $out/bin/Projucer
-    '';
-  };
-
   # equal to vst-sdk in ../oxefmsynth/default.nix
   vst-sdk = stdenv.mkDerivation rec {
     name = "vstsdk3610_11_06_2018_build_37";
@@ -50,70 +56,92 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "bespokesynth";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
-    owner = "awwbees";
+    owner = "BespokeSynth";
     repo = pname;
     rev = "v${version}";
-    sha256 = "04b2m40jszphslkd4850jcb8qwls392lwy3lc6vlj01h4izvapqk";
+    sha256 = "sha256-PN0Q6/gI1PeMaF/8EZFGJdLR8JVHQZfWunAhOIQxkHw=";
+    fetchSubmodules = true;
   };
 
-  configurePhase = ''
-    runHook preConfigure
-
-    export HOME=$(mktemp -d)
-    xvfb-run sh -e <<EOF
-      ${projucer}/bin/Projucer --set-global-search-path linux defaultJuceModulePath ${projucer.src}/modules
-      ${projucer}/bin/Projucer --resave BespokeSynth.jucer
-    EOF
-
-    runHook postConfigure
-  '';
-  CFLAGS = "-I${vst-sdk}/VST2_SDK";
-
-  nativeBuildInputs = [ xvfb-run pkg-config python3 makeWrapper ];
-
-  buildInputs = [
-    libX11 libXrandr libXinerama libXext libXcursor freetype libGL
-    ncurses libusb1
-    alsa-lib libjack2
+  cmakeBuildType = "Release";
+
+  cmakeFlags = lib.optionals enableVST2 [ "-DBESPOKE_VST2_SDK_LOCATION=${vst-sdk}/VST2_SDK" ];
+
+  nativeBuildInputs = [ python3 makeWrapper cmake pkg-config ninja ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    # List obtained in https://github.com/BespokeSynth/BespokeSynth/blob/main/azure-pipelines.yml
+    libX11
+    libXrandr
+    libXinerama
+    libXext
+    libXcursor
+    libXScrnSaver
+    curl
+    gtk3
+    webkitgtk
+    freetype
+    libGL
+    libusb1
+    alsa-lib
+    libjack2
+    gnome.zenity
+    alsa-tools
+    libxcb
+    xcbutil
+    libxkbcommon
+    xcbutilkeysyms
+    xcb-util-cursor
+    pcre
+    mount
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    Cocoa
+    WebKit
+    CoreServices
+    CoreAudioKit
   ];
 
-  preBuild = ''
-    cd Builds/LinuxMakefile
-  '';
-  makeFlags = [ "CONFIG=${buildType}" ];
-  enableParallelBuilding = true;
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/bin $out/share/bespokesynth $out/share/applications $out/share/icons/hicolor/512x512/apps
-    cp build/BespokeSynth $out/bin/
-    cp -ar ../MacOSX/build/Release/resource $out/share/bespokesynth/
-    wrapProgram $out/bin/BespokeSynth \
-      --run "cd $out/share/bespokesynth"
-
-    mkdir -p $out/share/applications/ $out/share/icons/hicolor/512x512/apps/
-    cp ../../bespoke_icon.png $out/share/icons/hicolor/512x512/apps/
-    substitute ../../BespokeSynth.desktop $out/share/applications/BespokseSynth.desktop \
-      --replace "/usr/bin/" ""
-
-    runHook postInstall
-  '';
+  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin (toString [
+    # Fails to find fp.h on its own
+    "-isystem ${CoreServices}/Library/Frameworks/CoreServices.framework/Versions/Current/Frameworks/CarbonCore.framework/Versions/Current/Headers/"
+  ]);
+
+  postInstall =
+    if stdenv.hostPlatform.isDarwin then ''
+      mkdir -p $out/{Applications,bin}
+      mv Source/BespokeSynth_artefacts/${cmakeBuildType}/BespokeSynth.app $out/Applications/
+      # Symlinking confuses the resource finding about the actual location of the binary
+      # Resources are looked up relative to the executed file's location
+      makeWrapper $out/{Applications/BespokeSynth.app/Contents/MacOS,bin}/BespokeSynth
+    '' else ''
+      # Ensure zenity is available, or it won't be able to open new files.
+      # Ensure the python used for compilation is the same as the python used at run-time.
+      # jedi is also required for auto-completion.
+      # These X11 libs get dlopen'd, they cause visual bugs when unavailable.
+      wrapProgram $out/bin/BespokeSynth \
+        --prefix PATH : '${lib.makeBinPath [
+          gnome.zenity
+          (python3.withPackages (ps: with ps; [ jedi ]))
+        ]}' \
+        --prefix LD_LIBRARY_PATH : '${lib.makeLibraryPath [
+          libXrandr
+          libXinerama
+          libXcursor
+          libXScrnSaver
+        ]}'
+    '';
 
   meta = with lib; {
-    description = "Software modular synth with controllers support, scripting and VST";
+    description =
+      "Software modular synth with controllers support, scripting and VST";
     homepage = "https://github.com/awwbees/BespokeSynth";
     license = with licenses; [
       gpl3Plus
-
-      # This package is unfree and not distributable due to the license of VST2.
-      # see #145607
-      unfree
-    ];
-    maintainers = with maintainers; [ astro ];
+    ] ++ lib.optional enableVST2 unfree;
+    maintainers = with maintainers; [ astro tobiasBora OPNA2608 ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/applications/audio/rhvoice/default.nix b/pkgs/applications/audio/rhvoice/default.nix
index af35ad829dd..ca51001dd62 100644
--- a/pkgs/applications/audio/rhvoice/default.nix
+++ b/pkgs/applications/audio/rhvoice/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, pkg-config, fetchFromGitHub, sconsPackages
-, python, glibmm, libpulseaudio, libao }:
+, glibmm, libpulseaudio, libao }:
 
 let
   version = "unstable-2018-02-10";
@@ -19,7 +19,7 @@ in stdenv.mkDerivation {
   ];
 
   buildInputs = [
-    python glibmm libpulseaudio libao
+    glibmm libpulseaudio libao
   ];
 
   # SConstruct patch
diff --git a/pkgs/applications/audio/schismtracker/default.nix b/pkgs/applications/audio/schismtracker/default.nix
index bf74dd64f92..ce55516a40d 100644
--- a/pkgs/applications/audio/schismtracker/default.nix
+++ b/pkgs/applications/audio/schismtracker/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , autoreconfHook
 , alsa-lib
-, python
+, python3
 , SDL
 }:
 
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   configureFlags = [ "--enable-dependency-tracking" ]
     ++ lib.optional stdenv.isDarwin "--disable-sdltest";
 
-  nativeBuildInputs = [ autoreconfHook python ];
+  nativeBuildInputs = [ autoreconfHook python3 ];
 
   buildInputs = [ SDL ] ++ lib.optional stdenv.isLinux alsa-lib;
 
diff --git a/pkgs/applications/audio/sorcer/default.nix b/pkgs/applications/audio/sorcer/default.nix
index 59c7d91a3e3..e5e875f6df3 100644
--- a/pkgs/applications/audio/sorcer/default.nix
+++ b/pkgs/applications/audio/sorcer/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub , boost, cairomm, cmake, libsndfile, lv2, ntk, pkg-config, python }:
+{ lib, stdenv, fetchFromGitHub , boost, cairomm, cmake, libsndfile, lv2, ntk, pkg-config }:
 
 stdenv.mkDerivation rec {
   pname = "sorcer";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ boost cairomm libsndfile lv2 ntk python ];
+  buildInputs = [ boost cairomm libsndfile lv2 ntk ];
 
   postPatch = ''
      # Fix build with lv2 1.18: https://github.com/brummer10/guitarix/commit/c0334c72
diff --git a/pkgs/applications/audio/split2flac/default.nix b/pkgs/applications/audio/split2flac/default.nix
index 92f0753fd78..5de48d1b296 100644
--- a/pkgs/applications/audio/split2flac/default.nix
+++ b/pkgs/applications/audio/split2flac/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, makeWrapper
 , shntool, cuetools
 , flac, faac, mp4v2, wavpack, mac
-, imagemagick, libiconv, enca, lame, pythonPackages, vorbis-tools
+, imagemagick, libiconv, enca, lame, mutagen, vorbis-tools
 , aacgain, mp3gain, vorbisgain
 }:
 
@@ -12,7 +12,7 @@ let
       --prefix PATH : ${lib.makeBinPath [
         shntool cuetools
         flac faac mp4v2 wavpack mac
-        imagemagick libiconv enca lame pythonPackages.mutagen vorbis-tools
+        imagemagick libiconv enca lame mutagen vorbis-tools
         aacgain mp3gain vorbisgain
       ]}
   '';
diff --git a/pkgs/applications/audio/spot/default.nix b/pkgs/applications/audio/spot/default.nix
index e17e8503694..e91cc9cc020 100644
--- a/pkgs/applications/audio/spot/default.nix
+++ b/pkgs/applications/audio/spot/default.nix
@@ -21,19 +21,19 @@
 
 stdenv.mkDerivation rec {
   pname = "spot";
-  version = "0.2.2";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "xou816";
     repo = "spot";
     rev = version;
-    hash = "sha256-g0oVhlfez9i+Vv8lt/aNftCVqdgPMDySBBeLyOv7Zl8=";
+    hash = "sha256-An9PJsuXZkvJhP67cisWxFd2dpky53EY/xcR6StgWFY=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-n10aYzkRqEe1h2WPAfARjH79Npvv+3fdX9jCtxv2a34=";
+    hash = "sha256-2qMmPIBoZS6WT06VzCmnYWaIfLzWN2HUvk7y9GKuuXg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/blockchains/btcpayserver/default.nix b/pkgs/applications/blockchains/btcpayserver/default.nix
index 691979c4de5..6cc83ffbf60 100644
--- a/pkgs/applications/blockchains/btcpayserver/default.nix
+++ b/pkgs/applications/blockchains/btcpayserver/default.nix
@@ -26,7 +26,7 @@ buildDotnetModule rec {
     makeWrapperArgs+=(--run "cd $out/lib/btcpayserver")
   '';
 
-  postInstall = ''
+  postFixup = ''
     mv $out/bin/{BTCPayServer,btcpayserver}
   '';
 
diff --git a/pkgs/applications/blockchains/chia-plotter/default.nix b/pkgs/applications/blockchains/chia-plotter/default.nix
index b576cd2373c..51ca4469bc4 100644
--- a/pkgs/applications/blockchains/chia-plotter/default.nix
+++ b/pkgs/applications/blockchains/chia-plotter/default.nix
@@ -4,7 +4,7 @@
 , libsodium
 , cmake
 , substituteAll
-, pythonPackages
+, python3Packages
 }:
 
 stdenv.mkDerivation {
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
     # prevent CMake from trying to get libraries on the Internet
     (substituteAll {
       src = ./dont_fetch_dependencies.patch;
-      pybind11_src = pythonPackages.pybind11.src;
+      pybind11_src = python3Packages.pybind11.src;
       relic_src = fetchFromGitHub {
         owner = "relic-toolkit";
         repo = "relic";
diff --git a/pkgs/applications/blockchains/nbxplorer/default.nix b/pkgs/applications/blockchains/nbxplorer/default.nix
index c4add5b67f5..be3d610d8f7 100644
--- a/pkgs/applications/blockchains/nbxplorer/default.nix
+++ b/pkgs/applications/blockchains/nbxplorer/default.nix
@@ -17,7 +17,7 @@ buildDotnetModule rec {
   dotnet-sdk = dotnetCorePackages.sdk_3_1;
   dotnet-runtime = dotnetCorePackages.aspnetcore_3_1;
 
-  postInstall = ''
+  postFixup = ''
     mv $out/bin/{NBXplorer,nbxplorer}
   '';
 
diff --git a/pkgs/applications/blockchains/wasabibackend/default.nix b/pkgs/applications/blockchains/wasabibackend/default.nix
index 1239ceaafd8..c7f594e31b4 100644
--- a/pkgs/applications/blockchains/wasabibackend/default.nix
+++ b/pkgs/applications/blockchains/wasabibackend/default.nix
@@ -36,7 +36,7 @@ buildDotnetModule rec {
     )
   '';
 
-  postInstall = ''
+  postFixup = ''
     mv $out/bin/WalletWasabi.Backend $out/bin/WasabiBackend
   '';
 
diff --git a/pkgs/applications/blockchains/zcash/default.nix b/pkgs/applications/blockchains/zcash/default.nix
index 5157ea3857e..8dc15e7c9d8 100644
--- a/pkgs/applications/blockchains/zcash/default.nix
+++ b/pkgs/applications/blockchains/zcash/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage.override { stdenv = stdenv; } rec {
   pname = "zcash";
-  version = "4.5.1";
+  version = "4.6.0-1";
 
   src = fetchFromGitHub {
     owner = "zcash";
     repo  = "zcash";
     rev = "v${version}";
-    sha256 = "0kyk3hv1y13b3vwg9kjcrpvz9v3l8lp0ikj977nykd5ms8b1rifa";
+    sha256 = "sha256-YJ5ufo+LYbOTr9SyiEzzp1pcSx6+cHSvDLBOIcx9X+4=";
   };
 
-  cargoSha256 = "1mwprsg74xv6qlxf00w7xapnkisb1aid9hkyr8r90zcwdcy8783r";
+  cargoSha256 = "sha256-m/SBHv3BNYKkSXxHnCdVng3blbHrTc/HxX/nEIa1DnM=";
 
   nativeBuildInputs = [ autoreconfHook cargo hexdump makeWrapper pkg-config ];
   buildInputs = [ boost175 libevent libsodium utf8cpp ]
diff --git a/pkgs/applications/editors/cudatext/default.nix b/pkgs/applications/editors/cudatext/default.nix
index dae533f1ebd..c4e5880f6a3 100644
--- a/pkgs/applications/editors/cudatext/default.nix
+++ b/pkgs/applications/editors/cudatext/default.nix
@@ -38,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "cudatext";
-  version = "1.152.1";
+  version = "1.153.0";
 
   src = fetchFromGitHub {
     owner = "Alexey-T";
     repo = "CudaText";
     rev = version;
-    sha256 = "sha256-rFmgf/wg6/jIObBDN+viKX3KrewVWgxs8uVF1gCY72s=";
+    sha256 = "sha256-3p5wb3buZtd1gnNoEJOclNO8xEYJBZYc86HfrkFrBWU=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/editors/cudatext/deps.json b/pkgs/applications/editors/cudatext/deps.json
index 567b53f417f..3eddccf8bbc 100644
--- a/pkgs/applications/editors/cudatext/deps.json
+++ b/pkgs/applications/editors/cudatext/deps.json
@@ -16,23 +16,23 @@
   },
   "ATSynEdit": {
     "owner": "Alexey-T",
-    "rev": "2021.12.22",
-    "sha256": "sha256-MmRJ3XDq7b9doPFfW7njSOasHej5ut0nYcJMFj+Y/Dc="
+    "rev": "2022.01.07",
+    "sha256": "sha256-KxeaTXv0qig3O2hqjJ5HG1KCN0TTQdnd3g9jBsEc0a4="
   },
   "ATSynEdit_Cmp": {
     "owner": "Alexey-T",
-    "rev": "2021.09.14",
-    "sha256": "sha256-6eC75zAtWbM1XEI9OM3iqy/a8Vj1l5WU7HGJBpmoQsA="
+    "rev": "2021.12.28",
+    "sha256": "sha256-bXTjPdn0DIVTdoi30Ws5+M+UsC7F99IphMSTpI5ia/Q="
   },
   "EControl": {
     "owner": "Alexey-T",
-    "rev": "2021.12.07",
-    "sha256": "sha256-givCklAHao26psWLI2qK246igxcAQEeIYTGH61FX6Xo="
+    "rev": "2022.01.07",
+    "sha256": "sha256-dgkyXrFs2hzuFjt9GW+WNyrLIp/i/AbRsM/MyMbatdA="
   },
   "ATSynEdit_Ex": {
     "owner": "Alexey-T",
-    "rev": "2021.12.07",
-    "sha256": "sha256-/2Fv/vrpbHSiJro11cjbziUaT4gfwa6y5aQBoYgq3OQ="
+    "rev": "2022.01.07",
+    "sha256": "sha256-7QDHf0PYGMc611qrk+a8pNJHF1v1DFMWlt5hbaU/oD8="
   },
   "Python-for-Lazarus": {
     "owner": "Alexey-T",
diff --git a/pkgs/applications/editors/netbeans/default.nix b/pkgs/applications/editors/netbeans/default.nix
index 0c40f83b67f..f7614e76ef5 100644
--- a/pkgs/applications/editors/netbeans/default.nix
+++ b/pkgs/applications/editors/netbeans/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, makeWrapper, makeDesktopItem, which, unzip, libicns, imagemagick
-, jdk, perl, python
+, jdk, perl
 }:
 
 let
@@ -58,7 +58,7 @@ stdenv.mkDerivation {
   '';
 
   nativeBuildInputs = [ makeWrapper unzip ];
-  buildInputs = [ perl python libicns imagemagick ];
+  buildInputs = [ perl libicns imagemagick ];
 
   meta = {
     description = "An integrated development environment for Java, C, C++ and PHP";
diff --git a/pkgs/applications/editors/rstudio/default.nix b/pkgs/applications/editors/rstudio/default.nix
index 62c3a93f76b..b230218e332 100644
--- a/pkgs/applications/editors/rstudio/default.nix
+++ b/pkgs/applications/editors/rstudio/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , mkDerivation
 , fetchurl
 , fetchpatch
@@ -30,6 +31,9 @@
 , nodejs
 , mkYarnModules
 , qmake
+, server ? false # build server version
+, sqlite
+, pam
 }:
 
 let
@@ -61,149 +65,166 @@ let
   panmirrorModules = mkYarnModules {
     inherit pname version;
     packageJSON = ./package.json;
-    yarnLock =  ./yarn.lock;
+    yarnLock = ./yarn.lock;
     yarnNix = ./yarndeps.nix;
   };
 
+  description = "Set of integrated tools for the R language";
 in
-mkDerivation rec {
-  inherit pname version src RSTUDIO_VERSION_MAJOR RSTUDIO_VERSION_MINOR RSTUDIO_VERSION_PATCH;
-
-  nativeBuildInputs = [
-    cmake
-    unzip
-    ant
-    jdk
-    makeWrapper
-    pandoc
-    nodejs
-    copyDesktopItems
-  ];
-
-  buildInputs = [
-    boost
-    zlib
-    openssl
-    R
-    qtbase
-    qtxmlpatterns
-    qtsensors
-    qtwebengine
-    qtwebchannel
-    libuuid
-    libyamlcpp
-    soci
-    postgresql
-  ];
-
-  cmakeFlags = [
-    "-DRSTUDIO_TARGET=Desktop"
-    "-DCMAKE_BUILD_TYPE=Release"
-    "-DQT_QMAKE_EXECUTABLE=${qmake}/bin/qmake"
-    "-DRSTUDIO_USE_SYSTEM_SOCI=ON"
-    "-DRSTUDIO_USE_SYSTEM_BOOST=ON"
-    "-DRSTUDIO_USE_SYSTEM_YAML_CPP=ON"
-    "-DPANDOC_VERSION=${pandoc.version}"
-    "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}/lib/rstudio"
-  ];
-
-  # Hack RStudio to only use the input R and provided libclang.
-  patches = [
-    ./r-location.patch
-    ./clang-location.patch
-    # postFetch doesn't work with this | error: unexpected end-of-file
-    # replacing /usr/bin/node is done in postPatch
-    # https://src.fedoraproject.org/rpms/rstudio/tree/rawhide
-    (fetchpatch {
-      name = "system-node.patch";
-      url = "https://src.fedoraproject.org/rpms/rstudio/raw/5bda2e290c9e72305582f2011040938d3e356906/f/0004-use-system-node.patch";
-      sha256 = "sha256-P1Y07RB/ceFNa749nyBUWSE41eiiZgt43zVcmahvfZM=";
-    })
-  ];
-
-  postPatch = ''
-    substituteInPlace src/cpp/core/r_util/REnvironmentPosix.cpp --replace '@R@' ${R}
-
-    substituteInPlace src/cpp/CMakeLists.txt \
-      --replace 'SOCI_LIBRARY_DIR "/usr/lib"' 'SOCI_LIBRARY_DIR "${soci}/lib"'
-
-    substituteInPlace src/gwt/build.xml \
-      --replace '/usr/bin/node' '${nodejs}/bin/node'
-
-    substituteInPlace src/cpp/core/libclang/LibClang.cpp \
-      --replace '@libclang@' ${llvmPackages.libclang.lib} \
-      --replace '@libclang.so@' ${llvmPackages.libclang.lib}/lib/libclang.so
-
-      substituteInPlace src/cpp/session/include/session/SessionConstants.hpp \
-        --replace "bin/pandoc" "${pandoc}/bin/pandoc"
-  '';
-
-  hunspellDictionaries = with lib; filter isDerivation (unique (attrValues hunspellDicts));
-  # These dicts contain identically-named dict files, so we only keep the
-  # -large versions in case of clashes
-  largeDicts = with lib; filter (d: hasInfix "-large-wordlist" d) hunspellDictionaries;
-  otherDicts = with lib; filter
-    (d: !(hasAttr "dictFileName" d &&
-      elem d.dictFileName (map (d: d.dictFileName) largeDicts)))
-    hunspellDictionaries;
-  dictionaries = largeDicts ++ otherDicts;
-
-  preConfigure = ''
-    mkdir dependencies/dictionaries
-    for dict in ${builtins.concatStringsSep " " dictionaries}; do
-      for i in "$dict/share/hunspell/"*; do
-        ln -s $i dependencies/dictionaries/
+(if server then stdenv.mkDerivation else mkDerivation)
+  (rec {
+    inherit pname version src RSTUDIO_VERSION_MAJOR RSTUDIO_VERSION_MINOR RSTUDIO_VERSION_PATCH;
+
+    nativeBuildInputs = [
+      cmake
+      unzip
+      ant
+      jdk
+      makeWrapper
+      pandoc
+      nodejs
+    ] ++ lib.optional (!server) [
+      copyDesktopItems
+    ];
+
+    buildInputs = [
+      boost
+      zlib
+      openssl
+      R
+      libuuid
+      libyamlcpp
+      soci
+      postgresql
+    ] ++ (if server then [
+      sqlite.dev
+      pam
+    ] else [
+      qtbase
+      qtxmlpatterns
+      qtsensors
+      qtwebengine
+      qtwebchannel
+    ]);
+
+    cmakeFlags = [
+      "-DRSTUDIO_TARGET=${if server then "Server" else "Desktop"}"
+      "-DCMAKE_BUILD_TYPE=Release"
+      "-DRSTUDIO_USE_SYSTEM_SOCI=ON"
+      "-DRSTUDIO_USE_SYSTEM_BOOST=ON"
+      "-DRSTUDIO_USE_SYSTEM_YAML_CPP=ON"
+      "-DPANDOC_VERSION=${pandoc.version}"
+      "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}/lib/rstudio"
+    ] ++ lib.optional (!server) [
+      "-DQT_QMAKE_EXECUTABLE=${qmake}/bin/qmake"
+    ];
+
+    # Hack RStudio to only use the input R and provided libclang.
+    patches = [
+      ./r-location.patch
+      ./clang-location.patch
+      # postFetch doesn't work with this | error: unexpected end-of-file
+      # replacing /usr/bin/node is done in postPatch
+      # https://src.fedoraproject.org/rpms/rstudio/tree/rawhide
+      (fetchpatch {
+        name = "system-node.patch";
+        url = "https://src.fedoraproject.org/rpms/rstudio/raw/5bda2e290c9e72305582f2011040938d3e356906/f/0004-use-system-node.patch";
+        sha256 = "sha256-P1Y07RB/ceFNa749nyBUWSE41eiiZgt43zVcmahvfZM=";
+      })
+    ];
+
+    postPatch = ''
+      substituteInPlace src/cpp/core/r_util/REnvironmentPosix.cpp --replace '@R@' ${R}
+
+      substituteInPlace src/cpp/CMakeLists.txt \
+        --replace 'SOCI_LIBRARY_DIR "/usr/lib"' 'SOCI_LIBRARY_DIR "${soci}/lib"'
+
+      substituteInPlace src/gwt/build.xml \
+        --replace '/usr/bin/node' '${nodejs}/bin/node'
+
+      substituteInPlace src/cpp/core/libclang/LibClang.cpp \
+        --replace '@libclang@' ${llvmPackages.libclang.lib} \
+        --replace '@libclang.so@' ${llvmPackages.libclang.lib}/lib/libclang.so
+
+        substituteInPlace src/cpp/session/include/session/SessionConstants.hpp \
+          --replace "bin/pandoc" "${pandoc}/bin/pandoc"
+    '';
+
+    hunspellDictionaries = with lib; filter isDerivation (unique (attrValues hunspellDicts));
+    # These dicts contain identically-named dict files, so we only keep the
+    # -large versions in case of clashes
+    largeDicts = with lib; filter (d: hasInfix "-large-wordlist" d) hunspellDictionaries;
+    otherDicts = with lib; filter
+      (d: !(hasAttr "dictFileName" d &&
+        elem d.dictFileName (map (d: d.dictFileName) largeDicts)))
+      hunspellDictionaries;
+    dictionaries = largeDicts ++ otherDicts;
+
+    preConfigure = ''
+      mkdir dependencies/dictionaries
+      for dict in ${builtins.concatStringsSep " " dictionaries}; do
+        for i in "$dict/share/hunspell/"*; do
+          ln -s $i dependencies/dictionaries/
+        done
       done
-    done
-
-    unzip -q ${mathJaxSrc} -d dependencies/mathjax-27
-
-    mkdir -p dependencies/pandoc/${pandoc.version}
-    cp ${pandoc}/bin/pandoc dependencies/pandoc/${pandoc.version}/pandoc
-
-    cp -r ${rsconnectSrc} dependencies/rsconnect
-    ( cd dependencies && ${R}/bin/R CMD build -d --no-build-vignettes rsconnect )
-
-    cp -r "${panmirrorModules}" src/gwt/panmirror/src/editor/node_modules
-  '';
-
-  postInstall = ''
-    mkdir -p $out/share/icons/hicolor/48x48/apps $out/bin
-    ln $out/lib/rstudio/rstudio.png $out/share/icons/hicolor/48x48/apps
-
-    for f in {diagnostics,rpostback,rstudio}; do
-      ln -s $out/lib/rstudio/bin/$f $out/bin
-    done
-
-    for f in .gitignore .Rbuildignore LICENSE README; do
-      find . -name $f -delete
-    done
-    rm -r $out/lib/rstudio/{INSTALL,COPYING,NOTICE,README.md,SOURCE,VERSION}
-    rm -r $out/lib/rstudio/bin/{pandoc/pandoc,pandoc}
-  '';
-
-  qtWrapperArgs = [
-    "--suffix PATH : ${lib.makeBinPath [ gnumake ]}"
-  ];
-
-  desktopItems = [
-    (makeDesktopItem {
-      name = "${pname}";
-      exec = "rstudio %F";
-      icon = "rstudio";
-      desktopName = "RStudio";
-      genericName = "IDE";
-      comment = meta.description;
-      categories = "Development;";
-      mimeType = "text/x-r-source;text/x-r;text/x-R;text/x-r-doc;text/x-r-sweave;text/x-r-markdown;text/x-r-html;text/x-r-presentation;application/x-r-data;application/x-r-project;text/x-r-history;text/x-r-profile;text/x-tex;text/x-markdown;text/html;text/css;text/javascript;text/x-chdr;text/x-csrc;text/x-c++hdr;text/x-c++src;";
-    })
-  ];
-
-  meta = with lib; {
-    description = "Set of integrated tools for the R language";
-    homepage = "https://www.rstudio.com/";
-    license = licenses.agpl3Only;
-    maintainers = with maintainers; [ ciil ];
-    platforms = platforms.linux;
-  };
-}
+
+      unzip -q ${mathJaxSrc} -d dependencies/mathjax-27
+
+      mkdir -p dependencies/pandoc/${pandoc.version}
+      cp ${pandoc}/bin/pandoc dependencies/pandoc/${pandoc.version}/pandoc
+
+      cp -r ${rsconnectSrc} dependencies/rsconnect
+      ( cd dependencies && ${R}/bin/R CMD build -d --no-build-vignettes rsconnect )
+
+      cp -r "${panmirrorModules}" src/gwt/panmirror/src/editor/node_modules
+    '';
+
+    postInstall = ''
+      mkdir -p $out/bin $out/share
+
+      ${lib.optionalString (!server) ''
+        mkdir -p $out/share/icons/hicolor/48x48/apps
+        ln $out/lib/rstudio/rstudio.png $out/share/icons/hicolor/48x48/apps
+      ''}
+
+      for f in {${if server
+        then "crash-handler-proxy,postback,r-ldpath,rpostback,rserver,rserver-pam,rsession,rstudio-server"
+        else "diagnostics,rpostback,rstudio"}}; do
+        ln -s $out/lib/rstudio/bin/$f $out/bin
+      done
+
+      for f in .gitignore .Rbuildignore LICENSE README; do
+        find . -name $f -delete
+      done
+      rm -r $out/lib/rstudio/{INSTALL,COPYING,NOTICE,README.md,SOURCE,VERSION}
+      rm -r $out/lib/rstudio/bin/{pandoc/pandoc,pandoc}
+    '';
+
+    meta = with lib; {
+      inherit description;
+      homepage = "https://www.rstudio.com/";
+      license = licenses.agpl3Only;
+      maintainers = with maintainers; [ ciil cfhammill ];
+      mainProgram = "rstudio" + optionalString server "-server";
+      platforms = platforms.linux;
+    };
+
+    passthru = { inherit server; };
+  } // lib.optionalAttrs (!server) {
+    qtWrapperArgs = [
+      "--suffix PATH : ${lib.makeBinPath [ gnumake ]}"
+    ];
+
+    desktopItems = [
+      (makeDesktopItem {
+        name = pname;
+        exec = "rstudio %F";
+        icon = "rstudio";
+        desktopName = "RStudio";
+        genericName = "IDE";
+        comment = description;
+        categories = "Development;";
+        mimeType = "text/x-r-source;text/x-r;text/x-R;text/x-r-doc;text/x-r-sweave;text/x-r-markdown;text/x-r-html;text/x-r-presentation;application/x-r-data;application/x-r-project;text/x-r-history;text/x-r-profile;text/x-tex;text/x-markdown;text/html;text/css;text/javascript;text/x-chdr;text/x-csrc;text/x-c++hdr;text/x-c++src;";
+      })
+    ];
+  })
diff --git a/pkgs/applications/editors/tiled/default.nix b/pkgs/applications/editors/tiled/default.nix
index 4a53d585fea..2c3ddbf80b8 100644
--- a/pkgs/applications/editors/tiled/default.nix
+++ b/pkgs/applications/editors/tiled/default.nix
@@ -1,5 +1,5 @@
 { lib, mkDerivation, fetchFromGitHub, pkg-config, qmake
-, python, qtbase, qttools }:
+, python2, qtbase, qttools }:
 
 mkDerivation rec {
   pname = "tiled";
@@ -13,7 +13,7 @@ mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config qmake ];
-  buildInputs = [ python qtbase qttools ];
+  buildInputs = [ python2 qtbase qttools ];
 
   meta = with lib; {
     description = "Free, easy to use and flexible tile map editor";
diff --git a/pkgs/applications/editors/wxhexeditor/default.nix b/pkgs/applications/editors/wxhexeditor/default.nix
index 09037b2f0c3..c769ab42631 100644
--- a/pkgs/applications/editors/wxhexeditor/default.nix
+++ b/pkgs/applications/editors/wxhexeditor/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, wxGTK, autoconf, automake, libtool, python, gettext }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, wxGTK, autoconf, automake, libtool, python2, gettext }:
 
 stdenv.mkDerivation rec {
   pname = "wxHexEditor";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "08xnhaif8syv1fa0k6lc3jm7yg2k50b02lyds8w0jyzh4xi5crqj";
   };
 
-  buildInputs = [ wxGTK autoconf automake libtool python gettext ];
+  buildInputs = [ wxGTK autoconf automake libtool python2 gettext ];
 
   preConfigure = "patchShebangs .";
 
diff --git a/pkgs/applications/graphics/inkscape/default.nix b/pkgs/applications/graphics/inkscape/default.nix
index b93a0fcaff8..d3546f60952 100644
--- a/pkgs/applications/graphics/inkscape/default.nix
+++ b/pkgs/applications/graphics/inkscape/default.nix
@@ -81,6 +81,14 @@ stdenv.mkDerivation rec {
       stripLen = 1;
       extraPrefix = "share/extensions/";
     })
+    # Remove mandatory break from end of paragraphs, added in Pango 1.49
+    # https://gitlab.com/inkscape/inkscape/-/merge_requests/3630
+    # TODO: Remove in Inkscape 1.1.2
+    (fetchpatch {
+      url = "https://gitlab.com/inkscape/inkscape/-/commit/b3dabef2245d4e4e977ee9d6776be9a134493515.patch";
+      sha256 = "YhqUlRBKL1vJ/iCM/DvdwbmPIsAHQpcgf4TPpjlnBng=";
+    })
+
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/graphics/krita/default.nix b/pkgs/applications/graphics/krita/default.nix
index e9393a2e5a8..063c5cc1551 100644
--- a/pkgs/applications/graphics/krita/default.nix
+++ b/pkgs/applications/graphics/krita/default.nix
@@ -1,7 +1,7 @@
 { callPackage, ... } @ args:
 
 callPackage ./generic.nix (args // {
-  version = "5.0.0";
+  version = "5.0.2";
   kde-channel = "stable";
-  sha256 = "sha256-hNWDPbyrP9OkGPTDdnDYKtkZQw8MbQpXuZOQdHHuzFc=";
+  sha256 = "sha256-5nUfx+tQSXekiAo3brvTmVyH2tFUSGCE6COX5l1JnL8=";
 })
diff --git a/pkgs/applications/graphics/pinta/default.nix b/pkgs/applications/graphics/pinta/default.nix
index ff112d7ce67..ed2aae72d47 100644
--- a/pkgs/applications/graphics/pinta/default.nix
+++ b/pkgs/applications/graphics/pinta/default.nix
@@ -2,23 +2,23 @@
 , buildDotnetModule
 , dotnetCorePackages
 , fetchFromGitHub
+, glibcLocales
 , gtk3
-, installShellFiles
-, librsvg
-, makeDesktopItem
+, intltool
 , wrapGAppsHook
 }:
 
 buildDotnetModule rec {
   pname = "Pinta";
-  version = "2.0.1";
+  version = "2.0.2";
 
   nativeBuildInputs = [
-    installShellFiles
+    intltool
     wrapGAppsHook
   ];
 
   runtimeDeps = [ gtk3 ];
+  buildInputs = runtimeDeps;
 
   dotnet-sdk = dotnetCorePackages.sdk_6_0;
   dotnet-runtime = dotnetCorePackages.runtime_6_0;
@@ -26,7 +26,7 @@ buildDotnetModule rec {
   # How-to update deps:
   # $ nix-build -A pinta.fetch-deps
   # $ ./result
-  # $ cp /tmp/Pinta-deps.nix ./pkgs/applications/graphics/pinta/default.nix
+  # $ cp /tmp/Pinta-deps.nix ./pkgs/applications/graphics/pinta/deps.nix
   # TODO: create update script
   nugetDeps = ./deps.nix;
 
@@ -36,52 +36,49 @@ buildDotnetModule rec {
     owner = "PintaProject";
     repo = "Pinta";
     rev = version;
-    sha256 = "sha256-iOKJPB2bI/GjeDxzG7r6ew7SGIzgrJTcRXhEYzOpC9k=";
+    sha256 = "sha256-Bvzs1beq7I1+10w9pmMePqGCz2TPDp5UK5Wa9hbKERU=";
   };
 
-  # FIXME: this should be propagated by wrapGAppsHook already, however for some
-  # reason it is not working. Maybe a bug in buildDotnetModule?
-  preInstall = ''
-    gappsWrapperArgs+=(
-      --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}"
-      --set GDK_PIXBUF_MODULE_FILE ${librsvg}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache
-    )
-  '';
-
-  postInstall = ''
-    # Rename the binary
-    mv $out/bin/Pinta $out/bin/pinta
+  # https://github.com/NixOS/nixpkgs/issues/38991
+  # bash: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
+  LOCALE_ARCHIVE = "${glibcLocales}/lib/locale/locale-archive";
 
-    # Copy desktop icons
-    for size in 16x16 22x22 24x24 32x32 96x96 scalable; do
-      mkdir -p $out/share/icons/hicolor/$size/apps
-      cp xdg/$size/* $out/share/icons/hicolor/$size/apps/
-    done
+  # Do the autoreconf/Makefile job manually
+  # TODO: use upstream build system
+  postBuild = ''
+    # Substitute translation placeholders
+    intltool-merge -x po/ xdg/pinta.appdata.xml.in xdg/pinta.appdata.xml
+    intltool-merge -d po/ xdg/pinta.desktop.in xdg/pinta.desktop
 
-    # Copy runtime icons
-    cp -r Pinta.Resources/icons/hicolor/16x16/* $out/share/icons/hicolor/16x16/
+    # Build translations
+    dotnet build Pinta \
+      -p:ContinuousIntegrationBuild=true \
+      -p:Deterministic=true \
+      -target:CompileTranslations,PublishTranslations \
+      -p:BuildTranslations=true \
+      -p:PublishDir="$NIX_BUILD_TOP/source/publish"
+  '';
 
-    # Install manpage
-    installManPage xdg/pinta.1
+  postFixup = ''
+    # Rename the binary
+    mv "$out/bin/Pinta" "$out/bin/pinta"
 
-    # Fix and copy desktop file
-    # TODO: fix this propely by using the autoreconf+pkg-config build system
-    # from upstream
-    mkdir -p $out/share/applications
-    substitute xdg/pinta.desktop.in $out/share/applications/Pinta.desktop \
-      --replace _Name Name \
-      --replace _Comment Comment \
-      --replace _GenericName GenericName \
-      --replace _X-GNOME-FullName X-GNOME-FullName \
-      --replace _Keywords Keywords
+    # Install
+    dotnet build installer/linux/install.proj \
+      -target:Install \
+      -p:ContinuousIntegrationBuild=true \
+      -p:Deterministic=true \
+      -p:SourceDir="$NIX_BUILD_TOP/source" \
+      -p:PublishDir="$NIX_BUILD_TOP/source/publish" \
+      -p:InstallPrefix="$out"
   '';
 
-  meta = {
+  meta = with lib; {
     homepage = "https://www.pinta-project.com/";
     description = "Drawing/editing program modeled after Paint.NET";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ thiagokokada ];
-    platforms = with lib.platforms; linux;
+    license = licenses.mit;
+    maintainers = with maintainers; [ thiagokokada ];
+    platforms = with platforms; linux;
     mainProgram = "pinta";
   };
 }
diff --git a/pkgs/applications/graphics/renderdoc/default.nix b/pkgs/applications/graphics/renderdoc/default.nix
index 0faed5e12ea..30731afebfe 100644
--- a/pkgs/applications/graphics/renderdoc/default.nix
+++ b/pkgs/applications/graphics/renderdoc/default.nix
@@ -1,8 +1,25 @@
-{ lib, fetchFromGitHub, cmake, pkg-config, mkDerivation
-, qtbase, qtx11extras, qtsvg, makeWrapper
-, vulkan-loader, libglvnd, xorg, python3, python3Packages
-, bison, pcre, automake, autoconf, addOpenGLRunpath
-, waylandSupport ? false, wayland
+{ lib
+, fetchFromGitHub
+, nix-update-script
+, cmake
+, pkg-config
+, mkDerivation
+, qtbase
+, qtx11extras
+, qtsvg
+, makeWrapper
+, vulkan-loader
+, libglvnd
+, xorg
+, python3
+, python3Packages
+, bison
+, pcre
+, automake
+, autoconf
+, addOpenGLRunpath
+, waylandSupport ? false
+, wayland
 }:
 let
   custom_swig = fetchFromGitHub {
@@ -15,13 +32,13 @@ let
 in
 mkDerivation rec {
   pname = "renderdoc";
-  version = "1.16";
+  version = "1.17";
 
   src = fetchFromGitHub {
     owner = "baldurk";
     repo = "renderdoc";
     rev = "v${version}";
-    sha256 = "150d1qzjs420clqr48gickiw5ymjx4md6iyjbxmxsdml0pyxpwwn";
+    sha256 = "sha256-Zr7Av49mK48B4N+Ca2vPIgKuVNP4YLVEs4EQepukSs8=";
   };
 
   buildInputs = [
@@ -64,6 +81,10 @@ mkDerivation rec {
     addOpenGLRunpath $out/lib/librenderdoc.so
   '';
 
+  passthru.updateScript = nix-update-script {
+    attrPath = pname;
+  };
+
   meta = with lib; {
     description = "A single-frame graphics debugger";
     homepage = "https://renderdoc.org/";
diff --git a/pkgs/applications/graphics/screencloud/default.nix b/pkgs/applications/graphics/screencloud/default.nix
index b7d6ecdef3d..b62ca680cbc 100644
--- a/pkgs/applications/graphics/screencloud/default.nix
+++ b/pkgs/applications/graphics/screencloud/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, qt4, quazip, qt-mobility, qxt, pythonPackages }:
+{ lib, stdenv, fetchFromGitHub, cmake, qt4, quazip, qt-mobility, qxt, python2Packages }:
 
 with lib;
 stdenv.mkDerivation rec {
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ qt4 quazip qt-mobility qxt pythonPackages.python pythonPackages.pycrypto ];
+  buildInputs = [ qt4 quazip qt-mobility qxt python2Packages.python python2Packages.pycrypto ];
 
   patchPhase = ''
     # Required to make the configure script work. Normally, screencloud's
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
   postInstall = ''
     patchShebangs $prefix/opt/screencloud/screencloud.sh
     substituteInPlace "$prefix/opt/screencloud/screencloud.sh" --replace "/opt" "$prefix/opt"
-    sed -i "2 i\export PYTHONPATH=$(toPythonPath ${pythonPackages.pycrypto}):\$PYTHONPATH" "$prefix/opt/screencloud/screencloud.sh"
+    sed -i "2 i\export PYTHONPATH=$(toPythonPath ${python2Packages.pycrypto}):\$PYTHONPATH" "$prefix/opt/screencloud/screencloud.sh"
     mkdir $prefix/bin
     mkdir $prefix/lib
     ln -s $prefix/opt/screencloud/screencloud.sh $prefix/bin/screencloud
diff --git a/pkgs/applications/misc/auto-multiple-choice/default.nix b/pkgs/applications/misc/auto-multiple-choice/default.nix
index 3f8edac97b6..174d6e22ccb 100644
--- a/pkgs/applications/misc/auto-multiple-choice/default.nix
+++ b/pkgs/applications/misc/auto-multiple-choice/default.nix
@@ -82,7 +82,7 @@ stdenv.mkDerivation rec {
       XMLWriter
     ]}:"$out/share/perl5 \
     --prefix XDG_DATA_DIRS : "$out/share" \
-    --set TEXINPUTS ":.:$out/share/texmf/tex/latex/AMC"
+    --set TEXINPUTS ":.:$out/tex/latex"
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubiomes-viewer/default.nix b/pkgs/applications/misc/cubiomes-viewer/default.nix
new file mode 100644
index 00000000000..f8f7fb8491c
--- /dev/null
+++ b/pkgs/applications/misc/cubiomes-viewer/default.nix
@@ -0,0 +1,70 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, qtbase
+, qmake
+, wrapQtAppsHook
+, copyDesktopItems
+, makeDesktopItem
+}:
+
+stdenv.mkDerivation rec {
+  pname = "cubiomes-viewer";
+  version = "1.12.1";
+
+  src = fetchFromGitHub {
+    owner = "Cubitect";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-F0c6gMQKu35iBNRw+wpoxSUOhRUbPRKIXSNDDNZsfPE=";
+    fetchSubmodules = true;
+  };
+
+  buildInputs = [
+    qtbase
+  ];
+
+  nativeBuildInputs = [
+    qmake
+    wrapQtAppsHook
+    copyDesktopItems
+  ];
+
+  desktopItems = [ (makeDesktopItem {
+    name = pname;
+    desktopName = "Cubiomes Viewer";
+    exec = pname;
+    icon = pname;
+    categories = "Game";
+    comment = meta.description;
+  }) ];
+
+  preBuild = ''
+    # QMAKE_PRE_LINK is not executed (I dont know why)
+    make -C ./cubiomes libcubiomes CFLAGS="-DSTRUCT_CONFIG_OVERRIDE=1" all
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp cubiomes-viewer $out/bin
+
+    mkdir -p $out/share/pixmaps
+    cp icons/map.png $out/share/pixmaps/cubiomes-viewer.png
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/Cubitect/cubiomes-viewer";
+    description = "A graphical Minecraft seed finder and map viewer";
+    longDescription = ''
+      Cubiomes Viewer provides a graphical interface for the efficient and flexible seed-finding
+      utilities provided by cubiomes and a map viewer for the Minecraft biomes and structure generation.
+    '';
+    platforms = platforms.all;
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ hqurve ];
+  };
+}
diff --git a/pkgs/applications/misc/haxor-news/default.nix b/pkgs/applications/misc/haxor-news/default.nix
index 43c2eb24224..c93d31f6630 100644
--- a/pkgs/applications/misc/haxor-news/default.nix
+++ b/pkgs/applications/misc/haxor-news/default.nix
@@ -15,7 +15,8 @@ let
           sha256 = "09h1153wgr5x2ny7ds0w2m81n3bb9j8hjb8sjfnrg506r01clkyx";
         };
       });
-      click = self.callPackage ../../../development/python-modules/click/7.nix { };
+      # Use click 7
+      click = self.callPackage ../../../development/python2-modules/click/default.nix { };
     };
   };
 in
diff --git a/pkgs/applications/misc/minder/default.nix b/pkgs/applications/misc/minder/default.nix
index 63840b3f0b2..3cf85f94dbb 100644
--- a/pkgs/applications/misc/minder/default.nix
+++ b/pkgs/applications/misc/minder/default.nix
@@ -15,6 +15,7 @@
 , gtk3
 , gtksourceview4
 , hicolor-icon-theme # for setup-hook
+, json-glib
 , libarchive
 , libgee
 , libhandy
@@ -24,13 +25,13 @@
 
 stdenv.mkDerivation rec {
   pname = "minder";
-  version = "1.13.1";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "phase1geo";
     repo = pname;
     rev = version;
-    sha256 = "07mq595c1vxwsnwkr2zdci0r06yhs75ph2db09mc63k5fjvi8rya";
+    sha256 = "sha256-0x+MMVa9/jOVp9n9JFM1MGndh9H9MzmmHepcez4aT+Q=";
   };
 
   nativeBuildInputs = [
@@ -51,6 +52,7 @@ stdenv.mkDerivation rec {
     gtk3
     gtksourceview4
     hicolor-icon-theme
+    json-glib
     libarchive
     libgee
     libhandy
diff --git a/pkgs/applications/misc/ocropus/default.nix b/pkgs/applications/misc/ocropus/default.nix
index 507399c012b..41c6cdee41c 100644
--- a/pkgs/applications/misc/ocropus/default.nix
+++ b/pkgs/applications/misc/ocropus/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, fetchurl, pythonPackages, curl }:
+{ lib, fetchFromGitHub, fetchurl, python2Packages, curl }:
 
 let
   getmodel = name: sha256: {
@@ -17,7 +17,7 @@ let
   ];
 
 in
-pythonPackages.buildPythonApplication rec {
+python2Packages.buildPythonApplication rec {
   pname = "ocropus";
   version = "1.3.3";
 
@@ -28,7 +28,7 @@ pythonPackages.buildPythonApplication rec {
     owner = "tmbdev";
   };
 
-  propagatedBuildInputs = with pythonPackages; [ curl numpy scipy pillow
+  propagatedBuildInputs = with python2Packages; [ curl numpy scipy pillow
     matplotlib beautifulsoup4 pygtk lxml ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/misc/pdfdiff/default.nix b/pkgs/applications/misc/pdfdiff/default.nix
index 65ee6a65593..20a95338497 100644
--- a/pkgs/applications/misc/pdfdiff/default.nix
+++ b/pkgs/applications/misc/pdfdiff/default.nix
@@ -1,6 +1,6 @@
-{ lib, pythonPackages, fetchurl, xpdf }:
+{ lib, python2Packages, fetchurl, xpdf }:
 let
-  py = pythonPackages;
+  py = python2Packages;
 in
 py.buildPythonApplication rec {
   name = "pdfdiff-${version}";
@@ -11,7 +11,7 @@ py.buildPythonApplication rec {
     sha256 = "0zxwjjbklz87wkbhkmsvhc7xmv5php7m2a9vm6ydhmhlxsybf836";
   };
 
-  buildInputs = [  pythonPackages.wrapPython ];
+  buildInputs = [  python2Packages.wrapPython ];
 
   dontConfigure = true;
   dontBuild = true;
@@ -29,7 +29,7 @@ py.buildPythonApplication rec {
     cp pdfdiff.py $out/bin/pdfdiff
     chmod +x $out/bin/pdfdiff
 
-    substituteInPlace $out/bin/pdfdiff --replace "#!/usr/bin/python" "#!${pythonPackages.python.interpreter}"
+    substituteInPlace $out/bin/pdfdiff --replace "#!/usr/bin/python" "#!${python2Packages.python.interpreter}"
     '';
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/phwmon/default.nix b/pkgs/applications/misc/phwmon/default.nix
index 717c5c3feb1..22d94006ddc 100644
--- a/pkgs/applications/misc/phwmon/default.nix
+++ b/pkgs/applications/misc/phwmon/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitLab, pythonPackages }:
+{ lib, stdenv, fetchFromGitLab, python2Packages }:
 
 stdenv.mkDerivation {
   pname = "phwmon";
@@ -11,11 +11,11 @@ stdenv.mkDerivation {
     sha256 = "1hqmsq66y8bqkpvszw84jyk8haxq3cjnz105hlkmp7786vfmkisq";
   };
 
-  nativeBuildInputs = [ pythonPackages.wrapPython ];
+  nativeBuildInputs = [ python2Packages.wrapPython ];
 
-  buildInputs = [ pythonPackages.pygtk pythonPackages.psutil ];
+  buildInputs = [ python2Packages.pygtk python2Packages.psutil ];
 
-  pythonPath = [ pythonPackages.pygtk pythonPackages.psutil ];
+  pythonPath = [ python2Packages.pygtk python2Packages.psutil ];
 
   patchPhase = ''
     substituteInPlace install.sh --replace "/usr/local" "$out"
diff --git a/pkgs/applications/misc/pomotroid/default.nix b/pkgs/applications/misc/pomotroid/default.nix
new file mode 100644
index 00000000000..dfe76aa92f4
--- /dev/null
+++ b/pkgs/applications/misc/pomotroid/default.nix
@@ -0,0 +1,60 @@
+{ stdenv, lib, fetchurl, makeWrapper, makeDesktopItem, copyDesktopItems, electron }:
+
+let
+  version = "0.13.0";
+  appIcon = fetchurl {
+    url = "https://raw.githubusercontent.com/Splode/pomotroid/v${version}/static/icon.png";
+    sha256 = "sha256-BEPoOBErw5ZCeK4rtdxdwZZLimbpglu1Cu++4xzuVUs=";
+  };
+
+in stdenv.mkDerivation rec {
+  pname = "pomotroid";
+  inherit version;
+
+  src = fetchurl {
+    url = "https://github.com/Splode/pomotroid/releases/download/v${version}/${pname}-${version}-linux.tar.gz";
+    sha256 = "sha256-AwpVnvwWQd/cgmZvtr5NprnLyeXz6ym4Fywc808tcSc=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+    copyDesktopItems
+  ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = pname;
+      exec = "pomotroid";
+      icon = "pomotroid";
+      comment = meta.description;
+      desktopName = "Pomotroid";
+      genericName = "Pomodoro Application";
+    })
+  ];
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/opt/pomotroid $out/share/pomotroid $out/share/pixmaps
+
+    cp -r ./ $out/opt/pomotroid
+    mv $out/opt/pomotroid/{locales,resources} $out/share/pomotroid
+    cp ${appIcon} $out/share/pixmaps/pomotroid.png
+
+    makeWrapper ${electron}/bin/electron $out/bin/pomotroid \
+      --add-flags $out/share/pomotroid/resources/app.asar
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Simple and visually-pleasing Pomodoro timer";
+    homepage = "https://splode.github.io/pomotroid";
+    license = licenses.mit;
+    maintainers = with maintainers; [ wolfangaukang ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/applications/misc/privacyidea/default.nix b/pkgs/applications/misc/privacyidea/default.nix
index 912cb9b94b1..2a3a1a47410 100644
--- a/pkgs/applications/misc/privacyidea/default.nix
+++ b/pkgs/applications/misc/privacyidea/default.nix
@@ -20,8 +20,8 @@ let
           sha256 = "ae2f05671588762dd83a21d8b18c51fe355e86783e24594995ff8d7380dffe38";
         };
       });
-      werkzeug = self.callPackage ../../../development/python-modules/werkzeug/1.nix { };
-      flask = self.callPackage ../../../development/python-modules/flask/1.nix { };
+      werkzeug = self.callPackage ../../../development/python2-modules/werkzeug { };
+      flask = self.callPackage ../../../development/python2-modules/flask { };
       sqlsoup = super.sqlsoup.overrideAttrs ({ meta ? {}, ... }: {
         meta = meta // { broken = false; };
       });
diff --git a/pkgs/applications/misc/rofi/wayland.nix b/pkgs/applications/misc/rofi/wayland.nix
new file mode 100644
index 00000000000..c2c2da37b4e
--- /dev/null
+++ b/pkgs/applications/misc/rofi/wayland.nix
@@ -0,0 +1,31 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, rofi-unwrapped
+, wayland-protocols
+, wayland
+}:
+
+rofi-unwrapped.overrideAttrs (oldAttrs: rec {
+  pname = "rofi-wayland-unwrapped";
+  version = "1.7.2+wayland1";
+
+  src = fetchFromGitHub {
+    owner = "lbonn";
+    repo = "rofi";
+    rev = version;
+    fetchSubmodules = true;
+    sha256 = "sha256-INFYHOVjBNj8ks4UjKnxLW8mL7h1c8ySFPS/rUxOWwo=";
+  };
+
+  nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [ wayland-protocols ];
+  buildInputs = oldAttrs.buildInputs ++ [ wayland ];
+
+  meta = with lib; {
+    description = "Window switcher, run dialog and dmenu replacement for Wayland";
+    homepage = "https://github.com/lbonn/rofi";
+    license = licenses.mit;
+    maintainers = with maintainers; [ bew ];
+    platforms = with platforms; linux;
+  };
+})
diff --git a/pkgs/applications/misc/survex/default.nix b/pkgs/applications/misc/survex/default.nix
index 27723096588..f8f8b5b553c 100644
--- a/pkgs/applications/misc/survex/default.nix
+++ b/pkgs/applications/misc/survex/default.nix
@@ -9,7 +9,7 @@
 , proj_7
 , perl532
 , unscii
-, python
+, python2
 , libGL
 , libGLU
 , xlibsWrapper
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   pname = "survex";
   version = "1.2.44";
 
-  nativeBuildInputs = [ docbook5 docbook2x autoreconfHook pkg-config perlenv python ];
+  nativeBuildInputs = [ docbook5 docbook2x autoreconfHook pkg-config perlenv python2 ];
 
   buildInputs = [
     libGL libGLU ffmpeg proj_7
diff --git a/pkgs/applications/misc/weather/default.nix b/pkgs/applications/misc/weather/default.nix
index 12edfe280be..4c5c5e3a840 100644
--- a/pkgs/applications/misc/weather/default.nix
+++ b/pkgs/applications/misc/weather/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pythonPackages, installShellFiles }:
+{ lib, stdenv, fetchurl, python2Packages, installShellFiles }:
 
 stdenv.mkDerivation rec {
   version = "2.4.2";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     installShellFiles
-    pythonPackages.wrapPython
+    python2Packages.wrapPython
   ];
 
   dontConfigure = true;
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   # Upstream doesn't provide a setup.py or alike, so we follow:
   # http://fungi.yuggoth.org/weather/doc/install.rst#id3
   installPhase = ''
-    site_packages=$out/${pythonPackages.python.sitePackages}
+    site_packages=$out/${python2Packages.python.sitePackages}
     install -Dt $out/bin -m 755 weather
     install -Dt $site_packages weather.py
     install -Dt $out/share/weather-util \
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index b4fdf61d166..d9385ceb042 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -161,13 +161,23 @@ let
       ./patches/no-build-timestamps.patch
       # For bundling Widevine (DRM), might be replaceable via bundle_widevine_cdm=true in gnFlags:
       ./patches/widevine-79.patch
-    ] ++ lib.optionals (versionRange "98" "99") [
+    ] ++ lib.optionals (versionRange "97" "98") [
       # A critical Ozone/Wayland fix:
+      # (Note: The patch for surface_augmenter.cc doesn't apply on M97 so we extract that part.)
+      (fetchpatch {
+        # [linux/wayland] Fixed terminate caused by binding to wrong version.
+        url = "https://github.com/chromium/chromium/commit/dd4c3ddadbb9869f59cee201a38e9ca3b9154f4d.patch";
+        excludes = [ "ui/ozone/platform/wayland/host/surface_augmenter.cc" ];
+        sha256 = "sha256-lp4kxPNAkafdE9NfD3ittTCpomRpX9Hqhtt9GFf4Ntw=";
+      })
+      ./patches/m97-ozone-wayland-fix-surface_augmenter.patch
+    ] ++ lib.optionals (versionRange "98" "99") [
       (githubPatch {
         # [linux/wayland] Fixed terminate caused by binding to wrong version.
         commit = "dd4c3ddadbb9869f59cee201a38e9ca3b9154f4d";
         sha256 = "sha256-FH7lBQTruMzkBT2XQ+kgADmJA0AxJfaV/gvtoqfQ4a4=";
       })
+    ] ++ lib.optionals (versionRange "97" "99") [
       (githubPatch {
         # [linux/wayland] Fixed terminate caused by binding to wrong version. (fixup)
         commit = "a84b79daa8897b822336b8f348ef4daaae07af37";
diff --git a/pkgs/applications/networking/browsers/chromium/patches/m97-ozone-wayland-fix-surface_augmenter.patch b/pkgs/applications/networking/browsers/chromium/patches/m97-ozone-wayland-fix-surface_augmenter.patch
new file mode 100644
index 00000000000..e63000fabc1
--- /dev/null
+++ b/pkgs/applications/networking/browsers/chromium/patches/m97-ozone-wayland-fix-surface_augmenter.patch
@@ -0,0 +1,31 @@
+diff --git a/ui/ozone/platform/wayland/host/surface_augmenter.cc b/ui/ozone/platform/wayland/host/surface_augmenter.cc
+index d971d15e71426..6e5408398bcea 100644
+--- a/ui/ozone/platform/wayland/host/surface_augmenter.cc
++++ b/ui/ozone/platform/wayland/host/surface_augmenter.cc
+@@ -13,7 +13,8 @@
+ namespace ui {
+ 
+ namespace {
+-constexpr uint32_t kMaxSurfaceAugmenterVersion = 1;
++constexpr uint32_t kMinVersion = 1;
++constexpr uint32_t kMaxVersion = 1;
+ }
+ 
+ // static
+@@ -27,11 +28,13 @@ void SurfaceAugmenter::Instantiate(WaylandConnection* connection,
+                                    uint32_t version) {
+   DCHECK_EQ(interface, kInterfaceName);
+ 
+-  if (connection->surface_augmenter_)
++  if (connection->surface_augmenter_ ||
++      !wl::CanBind(interface, version, kMinVersion, kMaxVersion)) {
+     return;
++  }
+ 
+-  auto augmenter = wl::Bind<surface_augmenter>(
+-      registry, name, std::min(version, kMaxSurfaceAugmenterVersion));
++  auto augmenter = wl::Bind<surface_augmenter>(registry, name,
++                                               std::min(version, kMaxVersion));
+   if (!augmenter) {
+     LOG(ERROR) << "Failed to bind surface_augmenter";
+     return;
diff --git a/pkgs/applications/networking/browsers/lagrange/default.nix b/pkgs/applications/networking/browsers/lagrange/default.nix
index c80ce2d71ca..866119fde14 100644
--- a/pkgs/applications/networking/browsers/lagrange/default.nix
+++ b/pkgs/applications/networking/browsers/lagrange/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lagrange";
-  version = "1.9.5";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "skyjake";
     repo = "lagrange";
     rev = "v${version}";
-    sha256 = "sha256-jvknhGTvb2Qw2587TmCJxES2DSv+9+BfMk2IOyqqLt8=";
+    sha256 = "sha256-5K2Fm7CkzVcHM3JC1rgh/vCyXfVTTY47nZFzqgQcoSs";
     fetchSubmodules = true;
   };
 
@@ -38,8 +38,6 @@ stdenv.mkDerivation rec {
   buildInputs = [ fribidi harfbuzz libunistring libwebp mpg123 openssl pcre SDL2 zlib ]
     ++ lib.optional stdenv.isDarwin AppKit;
 
-  hardeningDisable = lib.optional (!stdenv.cc.isClang) "format";
-
   installPhase = lib.optionalString stdenv.isDarwin ''
     mkdir -p $out/Applications
     mv Lagrange.app $out/Applications
diff --git a/pkgs/applications/networking/cluster/tanka/default.nix b/pkgs/applications/networking/cluster/tanka/default.nix
index e1ea0a690c9..8bdbf63a9ff 100644
--- a/pkgs/applications/networking/cluster/tanka/default.nix
+++ b/pkgs/applications/networking/cluster/tanka/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tanka";
-  version = "0.17.3";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Khu6ovtcXkqqt3W4OoJ09INgv80tw/6uDcJS+jt3y0Y=";
+    sha256 = "sha256-SMPStxqzoeooBoqUJdFK6Zg3dzbNHrB/tv8iwa8GdbM=";
   };
 
-  vendorSha256 = "sha256-vpm2y/CxRNWkz6+AOMmmZH5AjRQWAa6WD5Fnx5lqJYw=";
+  vendorSha256 = "sha256-pqwdxFFcATfxGmz6quIH8OL4U2DZKmuVyOLEct2nBlE=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/networking/cluster/terraform-providers/default.nix b/pkgs/applications/networking/cluster/terraform-providers/default.nix
index 67b7cc9cd7d..109951dfdd1 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@@ -7,82 +7,97 @@
 , cdrtools # libvirt
 }:
 let
-  list = lib.importJSON ./providers.json;
-
-  buildWithGoModule = data:
+  # Our generic constructor to build new providers.
+  #
+  # Is designed to combine with the terraform.withPlugins implementation.
+  mkProvider =
+    { owner
+    , repo
+    , rev
+    , version
+    , sha256
+    , vendorSha256 ? throw "vendorSha256 missing: please use `buildGoModule`" /* added 2022/01 */
+    , deleteVendor ? false
+    , proxyVendor ? false
+    , provider-source-address
+    }@attrs:
     buildGoModule {
-      pname = data.repo;
-      inherit (data) vendorSha256 version;
+      pname = repo;
+      inherit vendorSha256 version deleteVendor proxyVendor;
       subPackages = [ "." ];
       doCheck = false;
       # https://github.com/hashicorp/terraform-provider-scaffolding/blob/a8ac8375a7082befe55b71c8cbb048493dd220c2/.goreleaser.yml
       # goreleaser (used for builds distributed via terraform registry) requires that CGO is disabled
       CGO_ENABLED = 0;
-      ldflags = [ "-s" "-w" "-X main.version=${data.version}" "-X main.commit=${data.rev}" ];
+      ldflags = [ "-s" "-w" "-X main.version=${version}" "-X main.commit=${rev}" ];
       src = fetchFromGitHub {
-        inherit (data) owner repo rev sha256;
+        inherit owner repo rev sha256;
       };
-      deleteVendor = data.deleteVendor or false;
-      proxyVendor = data.proxyVendor or false;
 
       # Terraform allow checking the provider versions, but this breaks
       # if the versions are not provided via file paths.
-      postBuild = "mv $NIX_BUILD_TOP/go/bin/${data.repo}{,_v${data.version}}";
-      passthru = data;
+      postBuild = "mv $NIX_BUILD_TOP/go/bin/${repo}{,_v${version}}";
+      passthru = attrs;
     };
 
-  # Our generic constructor to build new providers
-  mkProvider = attrs:
-    (if (lib.hasAttr "vendorSha256" attrs) then buildWithGoModule else throw /* added 2022/01 */ "vendorSha256 missing: please use `buildGoModule`")
-      attrs;
+  list = lib.importJSON ./providers.json;
 
   # These providers are managed with the ./update-all script
   automated-providers = lib.mapAttrs (_: attrs: mkProvider attrs) list;
 
   # These are the providers that don't fall in line with the default model
-  special-providers = let archived = throw "the provider has been archived by upstream"; in {
-    # Packages that don't fit the default model
-    gandi = callPackage ./gandi { };
-    # mkisofs needed to create ISOs holding cloud-init data,
-    # and wrapped to terraform via deecb4c1aab780047d79978c636eeb879dd68630
-    libvirt = automated-providers.libvirt.overrideAttrs (_: { propagatedBuildInputs = [ cdrtools ]; });
-    teleport = callPackage ./teleport { };
-    vpsadmin = callPackage ./vpsadmin { };
-  } // (lib.optionalAttrs (config.allowAliases or false) {
-    arukas = archived; # added 2022/01
-    bitbucket = archived; # added 2022/01
-    chef = archived; # added 2022/01
-    cherryservers = archived; # added 2022/01
-    clc = archived; # added 2022/01
-    cloudstack = throw "removed from nixpkgs"; # added 2022/01
-    cobbler = archived; # added 2022/01
-    cohesity = archived; # added 2022/01
-    dyn = archived; # added 2022/01
-    genymotion = archived; # added 2022/01
-    hedvig = archived; # added 2022/01
-    ignition = archived; # added 2022/01
-    incapsula = archived; # added 2022/01
-    influxdb = archived; # added 2022/01
-    jdcloud = archived; # added 2022/01
-    kubernetes-alpha = throw "This has been merged as beta into the kubernetes provider. See https://www.hashicorp.com/blog/beta-support-for-crds-in-the-terraform-provider-for-kubernetes for details";
-    librato = archived; # added 2022/01
-    logentries = archived; # added 2022/01
-    metalcloud = archived; # added 2022/01
-    mysql = archived; # added 2022/01
-    nixos = archived; # added 2022/01
-    oneandone = archived; # added 2022/01
-    packet = archived; # added 2022/01
-    profitbricks = archived; # added 2022/01
-    pureport = archived; # added 2022/01
-    rancher = archived; # added 2022/01
-    rightscale = archived; # added 2022/01
-    runscope = archived; # added 2022/01
-    segment = throw "removed from nixpkgs"; # added 2022/01
-    softlayer = archived; # added 2022/01
-    telefonicaopencloud = archived; # added 2022/01
-    terraform = archived; # added 2022/01
-    ultradns = archived; # added 2022/01
-    vthunder = throw "provider was renamed to thunder"; # added 2022/01
-  });
+  special-providers =
+    {
+      # Packages that don't fit the default model
+      gandi = callPackage ./gandi { };
+      # mkisofs needed to create ISOs holding cloud-init data,
+      # and wrapped to terraform via deecb4c1aab780047d79978c636eeb879dd68630
+      libvirt = automated-providers.libvirt.overrideAttrs (_: { propagatedBuildInputs = [ cdrtools ]; });
+      teleport = callPackage ./teleport { };
+      vpsadmin = callPackage ./vpsadmin { };
+    };
+
+  # Put all the providers we not longer support in this list.
+  removed-providers =
+    let
+      archived = date: throw "the provider has been archived by upstream on ${date}";
+      removed = date: throw "removed from nixpkgs on ${date}";
+    in
+    lib.optionalAttrs (config.allowAliases or false) {
+      arukas = archived "2022/01";
+      bitbucket = archived "2022/01";
+      chef = archived "2022/01";
+      cherryservers = archived "2022/01";
+      clc = archived "2022/01";
+      cloudstack = removed "2022/01";
+      cobbler = archived "2022/01";
+      cohesity = archived "2022/01";
+      dyn = archived "2022/01";
+      genymotion = archived "2022/01";
+      hedvig = archived "2022/01";
+      ignition = archived "2022/01";
+      incapsula = archived "2022/01";
+      influxdb = archived "2022/01";
+      jdcloud = archived "2022/01";
+      kubernetes-alpha = throw "This has been merged as beta into the kubernetes provider. See https://www.hashicorp.com/blog/beta-support-for-crds-in-the-terraform-provider-for-kubernetes for details";
+      librato = archived "2022/01";
+      logentries = archived "2022/01";
+      metalcloud = archived "2022/01";
+      mysql = archived "2022/01";
+      nixos = archived "2022/01";
+      oneandone = archived "2022/01";
+      packet = archived "2022/01";
+      profitbricks = archived "2022/01";
+      pureport = archived "2022/01";
+      rancher = archived "2022/01";
+      rightscale = archived "2022/01";
+      runscope = archived "2022/01";
+      segment = removed "2022/01";
+      softlayer = archived "2022/01";
+      telefonicaopencloud = archived "2022/01";
+      terraform = archived "2022/01";
+      ultradns = archived "2022/01";
+      vthunder = throw "provider was renamed to thunder on 2022/01";
+    };
 in
-automated-providers // special-providers // { inherit mkProvider; }
+automated-providers // special-providers // removed-providers // { inherit mkProvider; }
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 55b285a1b28..a9e0e1afa49 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -21,10 +21,10 @@
     "owner": "aiven",
     "provider-source-address": "registry.terraform.io/aiven/aiven",
     "repo": "terraform-provider-aiven",
-    "rev": "v2.4.0",
-    "sha256": "0m43d2iaa9kywzvlgcnsya1ma9k570j9q8cq9l6ldpc8565fqq0i",
-    "vendorSha256": "1lpfnpg4sivy8vilkxamdn1hyn6k61lxsfcq67afxsq8pcy6q44v",
-    "version": "2.4.0"
+    "rev": "v2.5.0",
+    "sha256": "1x37bnykn28hmb80qi530zgk6jfqpk97nswrm0hdw8x5vac4v63a",
+    "vendorSha256": "0ldk06dj72551b6djsq7vil0hzfsp3ixwh3ikqb40shsdq10iplx",
+    "version": "2.5.0"
   },
   "akamai": {
     "owner": "akamai",
@@ -40,10 +40,10 @@
     "owner": "aliyun",
     "provider-source-address": "registry.terraform.io/aliyun/alicloud",
     "repo": "terraform-provider-alicloud",
-    "rev": "v1.151.0",
-    "sha256": "0pdvbq9kfq7vwkfk75fjy6jaiq5bfkjmvr3z07712b76z29m10bz",
+    "rev": "v1.152.0",
+    "sha256": "1childp3dkdi6raya1865inkky2qx1jav95yq9c57gz20zs27x8a",
     "vendorSha256": "18chs2723i2cxhhm649mz52pp6wrfqzxgk12zxq9idrhicchqnzg",
-    "version": "1.151.0"
+    "version": "1.152.0"
   },
   "ansible": {
     "owner": "nbering",
@@ -94,28 +94,28 @@
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/aws",
     "repo": "terraform-provider-aws",
-    "rev": "v3.71.0",
-    "sha256": "0jr9mk6gvimh8picpcc47pcan323k4rml438743ma53g8jhcvn2a",
-    "vendorSha256": "02ax2717xci8qia3k7q19yknazn67idb64hf5mwahfnx1fjmdc22",
-    "version": "3.71.0"
+    "rev": "v3.72.0",
+    "sha256": "0xkwqh7akc7rf047w6by4368n2bpn4lijk9j6j3wsgbaffw0xjlb",
+    "vendorSha256": "0apvp3vb3qx2l6698x4ai3spz40l6mb3z8gn45ms2vlxcwp2wf7y",
+    "version": "3.72.0"
   },
   "azuread": {
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/azuread",
     "repo": "terraform-provider-azuread",
-    "rev": "v2.14.0",
-    "sha256": "0sjpwhywc165gkxd1ybkwi1aww4xivry82wh0mbh4bgs607mn8lg",
+    "rev": "v2.15.0",
+    "sha256": "1gjx91svfg25x0hlx6mfam40615x278b9vxsy5p88s3dl6xs3hdv",
     "vendorSha256": null,
-    "version": "2.14.0"
+    "version": "2.15.0"
   },
   "azurerm": {
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/azurerm",
     "repo": "terraform-provider-azurerm",
-    "rev": "v2.91.0",
-    "sha256": "0db23ch46wi5mjmwibp7n98y0j3cl06mq2pzmvw1scbzvgh0gcqp",
+    "rev": "v2.92.0",
+    "sha256": "0p4vxda4n7895xp7aqg4zqddynjn7hnzsc8am83y8hf9hbfaji8q",
     "vendorSha256": null,
-    "version": "2.91.0"
+    "version": "2.92.0"
   },
   "azurestack": {
     "owner": "hashicorp",
@@ -185,10 +185,10 @@
     "owner": "cloudflare",
     "provider-source-address": "registry.terraform.io/cloudflare/cloudflare",
     "repo": "terraform-provider-cloudflare",
-    "rev": "v3.6.0",
-    "sha256": "1adpzk9vjllr18dq8kggxfabm3ax59m55ls98mkqh8lmgq96bh7d",
-    "vendorSha256": "1rdgjb1gfz5fs6s3c15nj92rm8ifb23n25wpxl16mz4aifkjgqam",
-    "version": "3.6.0"
+    "rev": "v3.7.0",
+    "sha256": "1d1wljk033b9j5sx01xjv5jmclw79f2f21s8zsix036mmzvaiswb",
+    "vendorSha256": "1g3fyxrdqa4ds6n9pcw2mvi8nfiz4dna57ssvggfwic4jl89q7zm",
+    "version": "3.7.0"
   },
   "cloudfoundry": {
     "owner": "cloudfoundry-community",
@@ -266,10 +266,10 @@
     "owner": "digitalocean",
     "provider-source-address": "registry.terraform.io/digitalocean/digitalocean",
     "repo": "terraform-provider-digitalocean",
-    "rev": "v2.16.0",
-    "sha256": "0l67yd7l0s36lwp1hm44d77i7d5019j0ddjzf22aw8cv9xd5fhxw",
+    "rev": "v2.17.0",
+    "sha256": "0in6xg4kgqy1izi8zapdi0f6dsni3i27fxh1l4sqp5kwh3vgpn0d",
     "vendorSha256": null,
-    "version": "2.16.0"
+    "version": "2.17.0"
   },
   "dme": {
     "owner": "DNSMadeEasy",
@@ -347,10 +347,10 @@
     "owner": "fastly",
     "provider-source-address": "registry.terraform.io/fastly/fastly",
     "repo": "terraform-provider-fastly",
-    "rev": "v0.39.0",
-    "sha256": "0sjjcz2z7qr1dmm6zzyi382cas4k5vdg0q7yxlpcqxqqrql636k8",
+    "rev": "v0.40.0",
+    "sha256": "11gf1xmj0qgn3hfw4hviqnfc23rrfd3qxz82idff4f1i7c5kym1i",
     "vendorSha256": null,
-    "version": "0.39.0"
+    "version": "0.40.0"
   },
   "flexibleengine": {
     "owner": "FlexibleEngineCloud",
@@ -393,29 +393,29 @@
     "provider-source-address": "registry.terraform.io/hashicorp/google",
     "proxyVendor": true,
     "repo": "terraform-provider-google",
-    "rev": "v4.5.0",
-    "sha256": "173aqwrzqdb3y57wiq1dbgb74ksr063qqq1k178n4wrab4s1h3px",
+    "rev": "v4.6.0",
+    "sha256": "0vi0crc4i5myzw17knvb3zz0yjpg7v1qvp9rjrb0q6v89nafr30c",
     "vendorSha256": "17rlq86zl83cav8pinr8am3wkmva4slab2izmxddhiw3na60a4la",
-    "version": "4.5.0"
+    "version": "4.6.0"
   },
   "google-beta": {
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/google-beta",
     "proxyVendor": true,
     "repo": "terraform-provider-google-beta",
-    "rev": "v4.5.0",
-    "sha256": "17z2jy8b9gk0id8q0318a6k60fhcqps0p36s7d7kkqmr44shgzs4",
+    "rev": "v4.6.0",
+    "sha256": "0kbdpyln8yy3128g43y134v5li9k5a6mb2fwa0jl8zffmhfc209k",
     "vendorSha256": "17rlq86zl83cav8pinr8am3wkmva4slab2izmxddhiw3na60a4la",
-    "version": "4.5.0"
+    "version": "4.6.0"
   },
   "grafana": {
     "owner": "grafana",
     "provider-source-address": "registry.terraform.io/grafana/grafana",
     "repo": "terraform-provider-grafana",
-    "rev": "v1.17.0",
-    "sha256": "10mj1dvz7q3w250hvi3k4rj2x0mn592gw2xcy1j98x5ll6kx4ynd",
-    "vendorSha256": "1bhygkkgd3j971cg6wha57cyh4ggbkaihw6sn6p9jvdi1k1f63lw",
-    "version": "1.17.0"
+    "rev": "v1.18.0",
+    "sha256": "1qvhdshaiy1v7557nkh869k1wmz604pv2gchv98vrm3cp7zj83zn",
+    "vendorSha256": "1rgvil2kw38kbgbgcjy8mbkahj6zm91s187x41vd4x7ypc5kgbkn",
+    "version": "1.18.0"
   },
   "gridscale": {
     "owner": "gridscale",
@@ -466,10 +466,10 @@
     "owner": "huaweicloud",
     "provider-source-address": "registry.terraform.io/huaweicloud/huaweicloud",
     "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.32.0",
-    "sha256": "1k5d4a488mrba6cvpcbhd9hqhhb977yi89p32wlfx266mf11w2yw",
+    "rev": "v1.32.1",
+    "sha256": "05rm1cmpbmavza1pyqjzrd316v6r68427cjhqy6bngb749nc1als",
     "vendorSha256": null,
-    "version": "1.32.0"
+    "version": "1.32.1"
   },
   "huaweicloudstack": {
     "owner": "huaweicloud",
@@ -493,10 +493,10 @@
     "owner": "IBM-Cloud",
     "provider-source-address": "registry.terraform.io/IBM-Cloud/ibm",
     "repo": "terraform-provider-ibm",
-    "rev": "v1.37.1",
-    "sha256": "1m9038ylv44xhgws0jrqdynj7kd97x9jgk1npqblbfv86fccwqxc",
-    "vendorSha256": "1a8zy023j3mcy3bswyrmllkgv61wiyxa1f7bfj8mxx3701rsb4ji",
-    "version": "1.37.1"
+    "rev": "v1.38.0",
+    "sha256": "0cbyq74fy3y7ia8lywr8amwcjq53bn3psymyl5cnwqx8y97avx5w",
+    "vendorSha256": "0cgl87pij4amn77ksbrzl0qlf6a5ga29b64cnasq8lq03lbmqzw4",
+    "version": "1.38.0"
   },
   "icinga2": {
     "owner": "Icinga",
@@ -674,10 +674,10 @@
     "owner": "mongodb",
     "provider-source-address": "registry.terraform.io/mongodb/mongodbatlas",
     "repo": "terraform-provider-mongodbatlas",
-    "rev": "v1.1.1",
-    "sha256": "0ifrpamajmrqa3fmsg4qyag1i7ghrswbhl0ixj8hgw7kzbzslsyd",
-    "vendorSha256": "1xrpgrzk5hr7qc5zm7nq5ljhc4sgzbsaxfszc8dlpc5y49j5q0ip",
-    "version": "1.1.1"
+    "rev": "v1.2.0",
+    "sha256": "08v1byvy7c2wdlbinjxb01vbzvsqfc73nc3cacp40n69z8wl70bi",
+    "vendorSha256": "19q835m219i85bq7mm5gafpw4q2y4lhbas2ppbfn3hkky15mvwks",
+    "version": "1.2.0"
   },
   "ncloud": {
     "owner": "NaverCloudPlatform",
@@ -701,10 +701,10 @@
     "owner": "newrelic",
     "provider-source-address": "registry.terraform.io/newrelic/newrelic",
     "repo": "terraform-provider-newrelic",
-    "rev": "v2.34.1",
-    "sha256": "1j7r6cac1ajp8f6h2492dnz7ihkxbdi8js535dv04kiah79r49d5",
-    "vendorSha256": "0qbrrh5qdbcnzmf69jilcd9qql526w9mf4ix8y8bi94w7m0nwxap",
-    "version": "2.34.1"
+    "rev": "v2.35.0",
+    "sha256": "0pwy3vsj332v82n3is6xaw4mgvv968ffr8n41s1r7j39r8bpl77f",
+    "vendorSha256": "13xqrdv0xnza0yxdgk155x4vq8lai9jrjvnfp153jb5p5hfnzwmp",
+    "version": "2.35.0"
   },
   "nomad": {
     "owner": "hashicorp",
@@ -757,19 +757,19 @@
     "owner": "terraform-providers",
     "provider-source-address": "registry.terraform.io/hashicorp/oci",
     "repo": "terraform-provider-oci",
-    "rev": "v4.58.0",
-    "sha256": "0cxzy9sj4n7yz7zbqhpkr92h7gqqfx7qxpr0a1jgh9a087j3752c",
+    "rev": "v4.59.0",
+    "sha256": "12i4j95g08c887xxplc90hcxwsrpwcn5qjyy5inazr21vqscjx2h",
     "vendorSha256": null,
-    "version": "4.58.0"
+    "version": "4.59.0"
   },
   "okta": {
     "owner": "okta",
     "provider-source-address": "registry.terraform.io/okta/okta",
     "repo": "terraform-provider-okta",
-    "rev": "v3.20.2",
-    "sha256": "0qlm99m4dljnczsypn4gmw9n4vvxkfazi21hvkbkgy2v3wmhsms9",
-    "vendorSha256": "0fyxm6wff5pz5g3rjnia23npar9qbwcv01pa3rsskxkl8jc3v13j",
-    "version": "3.20.2"
+    "rev": "v3.20.3",
+    "sha256": "0m9y0dagav1pw8cz6pv9zkhag59f9bbn8b6zi1h3lcgvmzf303wv",
+    "vendorSha256": "156nyjga5q5mgwiq6aynp199i0hn5mvckj2h7j3pfzc1yz8ri5cc",
+    "version": "3.20.3"
   },
   "oktaasa": {
     "owner": "oktadeveloper",
@@ -857,10 +857,10 @@
     "owner": "PaloAltoNetworks",
     "provider-source-address": "registry.terraform.io/PaloAltoNetworks/panos",
     "repo": "terraform-provider-panos",
-    "rev": "v1.9.1",
-    "sha256": "05jsap80dcgmncxa8xbx1hnrbpi9bxjz2k9jnfnws1pmbjxl94hf",
+    "rev": "v1.9.2",
+    "sha256": "03585rm434lcp6xk58185i78iv5fjd18z7nrdnbhxxy94yhhf335",
     "vendorSha256": null,
-    "version": "1.9.1"
+    "version": "1.9.2"
   },
   "pass": {
     "owner": "camptocamp",
@@ -1001,10 +1001,10 @@
     "owner": "spotinst",
     "provider-source-address": "registry.terraform.io/spotinst/spotinst",
     "repo": "terraform-provider-spotinst",
-    "rev": "v1.64.2",
-    "sha256": "0h47ik93lhb9mjg3ai9n76ya918h1mk3fyp70yr26rwc3rihvjm6",
-    "vendorSha256": "1lv305kamb3xnw3a2q45ndn7a88ifnh8j8ngv7awc41028j539w4",
-    "version": "1.64.2"
+    "rev": "v1.65.0",
+    "sha256": "1gk4v6lxa4k8za6c1zxrrrc6qw3ymsk46w97qhfri6y7vrc3vxh0",
+    "vendorSha256": "0xhzj8lmrh0mcpbxa7xkzhhgl3jfk6mz5adia0jgflgrx4wjaf38",
+    "version": "1.65.0"
   },
   "stackpath": {
     "owner": "stackpath",
@@ -1046,10 +1046,10 @@
     "owner": "tencentcloudstack",
     "provider-source-address": "registry.terraform.io/tencentcloudstack/tencentcloud",
     "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.60.26",
-    "sha256": "1diwiyfswmgqm1iizj228s2ysrnx4z3lqlq82a7gp0z9p8rzd0vs",
+    "rev": "v1.61.1",
+    "sha256": "1v6b8ldg6pkphqy5aphdhig1q3iizzfrj611k39lyk1q3q914yf4",
     "vendorSha256": null,
-    "version": "1.60.26"
+    "version": "1.61.1"
   },
   "tfe": {
     "owner": "hashicorp",
@@ -1128,10 +1128,10 @@
     "owner": "vmware",
     "provider-source-address": "registry.terraform.io/vmware/vcd",
     "repo": "terraform-provider-vcd",
-    "rev": "v3.5.0",
-    "sha256": "1sdcjizg0gip55042p0599wvjicibyx9kiymxq45af14yhnwqyv5",
+    "rev": "v3.5.1",
+    "sha256": "1fwkbsgnxn0jl84nji57grasdsbw0ydd7vzcllpv7r1z3jpa545q",
     "vendorSha256": "0bzp6807l4hspk1c1pmgnzk0axk0nir3v0lqmw9xvkij4c5rnz9s",
-    "version": "3.5.0"
+    "version": "3.5.1"
   },
   "venafi": {
     "deleteVendor": true,
diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix
index 573cb83ccce..8c71e5e6df6 100644
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@@ -160,20 +160,6 @@ rec {
   # Constructor for other terraform versions
   mkTerraform = attrs: pluggable (generic attrs);
 
-  terraform_0_12 = mkTerraform {
-    version = "0.12.31";
-    sha256 = "03p698xdbk5gj0f9v8v1fpd74zng3948dyy4f2hv7zgks9hid7fg";
-    patches = [
-      ./provider-path.patch
-      (fetchpatch {
-        name = "fix-mac-mojave-crashes.patch";
-        url = "https://github.com/hashicorp/terraform/commit/cd65b28da051174a13ac76e54b7bb95d3051255c.patch";
-        sha256 = "1k70kk4hli72x8gza6fy3vpckdm3sf881w61fmssrah3hgmfmbrs";
-      })
-    ];
-    passthru = { inherit plugins; };
-  };
-
   terraform_0_13 = mkTerraform {
     version = "0.13.7";
     sha256 = "1cahnmp66dk21g7ga6454yfhaqrxff7hpwpdgc87cswyq823fgjn";
diff --git a/pkgs/applications/networking/cluster/terranix/default.nix b/pkgs/applications/networking/cluster/terranix/default.nix
index a8541336b3d..98ce3c474ff 100644
--- a/pkgs/applications/networking/cluster/terranix/default.nix
+++ b/pkgs/applications/networking/cluster/terranix/default.nix
@@ -2,20 +2,20 @@
 
 stdenv.mkDerivation rec {
   pname = "terranix";
-  version = "2.5.0";
+  version = "2.5.3";
 
   src = fetchFromGitHub {
     owner = "mrVanDalo";
     repo = "terranix";
     rev = version;
-    sha256 = "sha256-HDiyJGgyDUoLnpL8N+wDm3cM/vEfYYc/p4N1kKH/kLk=";
+    sha256 = "sha256-Jhq0pkyF1KWJ6HgeWLoRfIxo7QHvOwwXzsIxZQgQtK4=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/{bin,core,modules,lib}
-    mv bin core modules lib $out/
+    mv bin core modules lib share $out/
 
     wrapProgram $out/bin/terranix-doc-json \
       --prefix PATH : ${lib.makeBinPath [ jq nix ]}
diff --git a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
index bce13052e5a..1a0c25c606b 100644
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
@@ -7,6 +7,7 @@
 , fetchYarnDeps
 , electron
 , element-web
+, sqlcipher
 , callPackage
 , Security
 , AppKit
@@ -78,7 +79,9 @@ mkYarnPackage rec {
     ln -s "${desktopItem}/share/applications" "$out/share/applications"
 
     # executable wrapper
+    # LD_PRELOAD workaround for sqlcipher not found: https://github.com/matrix-org/seshat/issues/102
     makeWrapper '${electron_exec}' "$out/bin/${executableName}" \
+      --set LD_PRELOAD ${sqlcipher}/lib/libsqlcipher.so \
       --add-flags "$out/share/element/electron${lib.optionalString useWayland " --enable-features=UseOzonePlatform --ozone-platform=wayland"}"
   '';
 
@@ -94,7 +97,7 @@ mkYarnPackage rec {
     name = "element-desktop";
     exec = "${executableName} %u";
     icon = "element";
-    desktopName = "Element (Riot)";
+    desktopName = "Element";
     genericName = "Matrix Client";
     comment = meta.description;
     categories = "Network;InstantMessaging;Chat;";
diff --git a/pkgs/applications/networking/instant-messengers/franz/generic.nix b/pkgs/applications/networking/instant-messengers/franz/generic.nix
index d63318ecfaf..4496af4a1df 100644
--- a/pkgs/applications/networking/instant-messengers/franz/generic.nix
+++ b/pkgs/applications/networking/instant-messengers/franz/generic.nix
@@ -24,6 +24,7 @@
 , libnotify
 , xdg-utils
 , mesa
+, libappindicator-gtk3
 }:
 
 # Helper function for building a derivation for Franz and forks.
@@ -68,7 +69,7 @@ stdenv.mkDerivation rec {
     expat
     stdenv.cc.cc
   ];
-  runtimeDependencies = [ stdenv.cc.cc.lib (lib.getLib udev) libnotify ];
+  runtimeDependencies = [ stdenv.cc.cc.lib (lib.getLib udev) libnotify libappindicator-gtk3 ];
 
   unpackPhase = "dpkg-deb -x $src .";
 
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-plugin-pack/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-plugin-pack/default.nix
index ef9ce5bca74..f393a17c1bc 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-plugin-pack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-plugin-pack/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pidgin, intltool, python } :
+{ lib, stdenv, fetchurl, pidgin, intltool, python2 } :
 
 stdenv.mkDerivation rec {
   pname = "purple-plugin-pack";
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "0g5hmy7fwgjq59j52h9yps28jsjjrfkd4r18gyx6hfd3g3kzbg1b";
   };
 
-  buildInputs = [ pidgin intltool python ];
+  buildInputs = [ pidgin intltool python2 ];
 
   meta = with lib; {
     homepage = "https://bitbucket.org/rekkanoryo/purple-plugin-pack";
diff --git a/pkgs/applications/networking/instant-messengers/torchat/default.nix b/pkgs/applications/networking/instant-messengers/torchat/default.nix
index 8fece541272..3278d68cd0b 100644
--- a/pkgs/applications/networking/instant-messengers/torchat/default.nix
+++ b/pkgs/applications/networking/instant-messengers/torchat/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, python, unzip, wxPython, wrapPython, tor }:
+{ lib, stdenv, fetchFromGitHub, python2, unzip, tor }:
 
 stdenv.mkDerivation rec {
   pname = "torchat";
@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ unzip ];
-  buildInputs = [ python wxPython wrapPython ];
-  pythonPath = [ wxPython ];
+  buildInputs = with python2.pkgs; [ python wxPython wrapPython ];
+  pythonPath = with python2.pkgs; [ wxPython ];
 
   preConfigure = "cd torchat/src; rm portable.txt";
 
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
 
     mkdir -p $out/lib/torchat
     cp -rf * $out/lib/torchat
-    makeWrapper ${python}/bin/python $out/bin/torchat \
+    makeWrapper ${python2}/bin/python $out/bin/torchat \
         --set PYTHONPATH $out/lib/torchat:$program_PYTHONPATH \
         --run "cd $out/lib/torchat" \
         --add-flags "-O $out/lib/torchat/torchat.py"
diff --git a/pkgs/applications/networking/ipfs-cluster/default.nix b/pkgs/applications/networking/ipfs-cluster/default.nix
index a7627feb94d..d66efa86a7f 100644
--- a/pkgs/applications/networking/ipfs-cluster/default.nix
+++ b/pkgs/applications/networking/ipfs-cluster/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "ipfs-cluster";
-  version = "0.14.1";
+  version = "0.14.4";
 
-  vendorSha256 = "sha256-vDNWYgWlM3kJqlHW/6Bj6P+t6M61TvOVRJwDN2p0mi4=";
+  vendorSha256 = "sha256-4j6aPs17YNXyPIRr5NshAPYIfNM08GlYV13jnGtJzQc=";
 
   src = fetchFromGitHub {
     owner = "ipfs";
     repo = "ipfs-cluster";
     rev = "v${version}";
-    sha256 = "sha256-GELCd12LhA4CBe9DRRBu4r+AwCksaRVIWcSAJScvnbk=";
+    sha256 = "sha256-82t3sHMKZiV6sYnW72N94qfRZ/aMkavj+hiAyg5viHQ=";
   };
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/ipget/default.nix b/pkgs/applications/networking/ipget/default.nix
index 19cc4445b32..a8888b8e295 100644
--- a/pkgs/applications/networking/ipget/default.nix
+++ b/pkgs/applications/networking/ipget/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "ipget";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "ipfs";
     repo = "ipget";
     rev = "v${version}";
-    sha256 = "sha256-YD05HIVr99b8VmEJgzY2ClNv31I98d0NbfCk3XcB+xk=";
+    sha256 = "sha256-qRPke8/CUmGX6v+8qv9JQCUC8T9pjwRRyGmBWvatsJ0=";
   };
 
-  vendorSha256 = "sha256-bymHVWskCt7bf02CveMXl1VhZYhRSEH7xIoESh31iGg=";
+  vendorSha256 = "sha256-La9V5B+UDaOswh/R8ad4xsnCF5ewtF7G+uiqnarM4Mg=";
 
   postPatch = ''
     # main module (github.com/ipfs/ipget) does not contain package github.com/ipfs/ipget/sharness/dependencies
diff --git a/pkgs/development/python-modules/alot/default.nix b/pkgs/applications/networking/mailreaders/alot/default.nix
index 6aa09f70ba3..6de601348c3 100644
--- a/pkgs/development/python-modules/alot/default.nix
+++ b/pkgs/applications/networking/mailreaders/alot/default.nix
@@ -1,9 +1,13 @@
-{ lib, buildPythonPackage, python, fetchFromGitHub, isPy3k, pytestCheckHook
-, notmuch2, urwid, urwidtrees, twisted, python_magic, configobj, mock, file, gpgme
-, service-identity, gnupg, sphinx, gawk, procps, future , withManpage ? false
+{ lib, python3, fetchFromGitHub, file, gnupg, gawk, notmuch, procps, withManpage ? false
 }:
 
-buildPythonPackage rec {
+with python3.pkgs;
+
+let
+  notmuch2 = callPackage ./notmuch.nix {
+    inherit notmuch;
+  };
+in buildPythonApplication rec {
   pname = "alot";
   version = "0.10";
   outputs = [ "out" ] ++ lib.optional withManpage "man";
diff --git a/pkgs/development/python-modules/notmuch/2.nix b/pkgs/applications/networking/mailreaders/alot/notmuch.nix
index bd195b52d44..bd195b52d44 100644
--- a/pkgs/development/python-modules/notmuch/2.nix
+++ b/pkgs/applications/networking/mailreaders/alot/notmuch.nix
diff --git a/pkgs/development/python-modules/aiohttp-apispec/unstable.nix b/pkgs/applications/networking/p2p/tribler/aiohttp-apispec.nix
index 73a28de7b40..4e1f5ee6ca7 100644
--- a/pkgs/development/python-modules/aiohttp-apispec/unstable.nix
+++ b/pkgs/applications/networking/p2p/tribler/aiohttp-apispec.nix
@@ -3,8 +3,8 @@
 }:
 
 let
-  apispec3 = callPackage ../apispec/3.nix {};
-  jinja2 = callPackage ../jinja2/2.nix {};
+  apispec3 = callPackage ./apispec.nix {};
+  jinja2 = callPackage ../../../../development/python2-modules/jinja2 {};
 in
 buildPythonPackage rec {
   pname = "aiohttp-apispec";
diff --git a/pkgs/development/python-modules/apispec/3.nix b/pkgs/applications/networking/p2p/tribler/apispec.nix
index e60a440df3f..e60a440df3f 100644
--- a/pkgs/development/python-modules/apispec/3.nix
+++ b/pkgs/applications/networking/p2p/tribler/apispec.nix
diff --git a/pkgs/applications/networking/p2p/tribler/default.nix b/pkgs/applications/networking/p2p/tribler/default.nix
index 774aea642d4..6a8f93a2938 100644
--- a/pkgs/applications/networking/p2p/tribler/default.nix
+++ b/pkgs/applications/networking/p2p/tribler/default.nix
@@ -6,8 +6,7 @@ let
   libtorrent = (python3.pkgs.toPythonModule (
     libtorrent-rasterbar-1_2_x.override { python = python3; })).python;
 
-  aiohttp-apispec = python3.pkgs.callPackage 
-    ../../../../development/python-modules/aiohttp-apispec/unstable.nix { };
+  aiohttp-apispec = python3.pkgs.callPackage ./aiohttp-apispec.nix { };
 in
 stdenv.mkDerivation rec {
   pname = "tribler";
diff --git a/pkgs/applications/networking/p2p/twister/default.nix b/pkgs/applications/networking/p2p/twister/default.nix
index 1d05cafef83..9c708b79588 100644
--- a/pkgs/applications/networking/p2p/twister/default.nix
+++ b/pkgs/applications/networking/p2p/twister/default.nix
@@ -13,7 +13,10 @@ let
     };
   };
 
-  boostPython = boost.override { enablePython = true; };
+  boostPython = boost.override {
+    enablePython = true;
+    python = python2;
+  };
 
 in stdenv.mkDerivation rec {
   pname = "twister";
diff --git a/pkgs/applications/networking/ping/default.nix b/pkgs/applications/networking/ping/default.nix
index 8b8748d70ff..6074b1a51cc 100644
--- a/pkgs/applications/networking/ping/default.nix
+++ b/pkgs/applications/networking/ping/default.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , nix-update-script
 , meson
@@ -14,7 +15,6 @@
 , libsoup
 , libgee
 , wrapGAppsHook
-, vala_0_40
 }:
 
 stdenv.mkDerivation rec {
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     meson
     ninja
-    vala_0_40
+    vala
     pkg-config
     python3
     wrapGAppsHook
@@ -65,5 +65,12 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     license = licenses.gpl3;
     mainProgram = "com.github.jeremyvaartjes.ping";
+    # Does not build with vala 0.48 or later
+    # ../src/Application.vala:696.46-696.57: error: Assignment: Cannot convert from
+    # `GLib.HashTable<weak string,weak string>' to `GLib.HashTable<string,string>?'
+    #                     HashTable<string,string> tempDataList = Soup.Form.decode(testObjs[id].data);
+    #                                              ^^^^^^^^^^^^
+    # Upstream has no activity since 28 Dec 2020
+    broken = true;
   };
 }
diff --git a/pkgs/applications/office/PageEdit/default.nix b/pkgs/applications/office/PageEdit/default.nix
new file mode 100644
index 00000000000..f313bdcded6
--- /dev/null
+++ b/pkgs/applications/office/PageEdit/default.nix
@@ -0,0 +1,25 @@
+{ lib, mkDerivation, fetchFromGitHub, cmake, qtsvg, qtwebengine, qttranslations }:
+
+mkDerivation rec {
+  pname = "PageEdit";
+  version = "1.7.0";
+
+  src = fetchFromGitHub {
+    owner = "Sigil-Ebook";
+    repo = pname;
+    rev = version;
+    hash = "sha256-/t08ZS2iYWIDkco0nhACBQs1X+X77SJ/g+ow7KemfRY=";
+  };
+
+  nativeBuildInputs = [ cmake qttranslations ];
+  propagatedBuildInputs = [ qtsvg qtwebengine ];
+  cmakeFlags = "-DINSTALL_BUNDLED_DICTS=0";
+
+  meta = with lib; {
+    description = "ePub XHTML Visual Editor";
+    homepage = "https://sigil-ebook.com/pageedit/";
+    license = licenses.gpl3Plus;
+    maintainers = [ maintainers.pasqui23 ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/applications/office/notion-app-enhanced/default.nix b/pkgs/applications/office/notion-app-enhanced/default.nix
index d588580a8db..84635f42ee4 100644
--- a/pkgs/applications/office/notion-app-enhanced/default.nix
+++ b/pkgs/applications/office/notion-app-enhanced/default.nix
@@ -1,12 +1,12 @@
 { appimageTools, lib, fetchurl }:
 let
   pname = "notion-app-enhanced";
-  version = "2.0.16-5";
+  version = "2.0.18-1";
   name = "${pname}-v${version}";
 
   src = fetchurl {
     url = "https://github.com/notion-enhancer/notion-repackaged/releases/download/v${version}/Notion-Enhanced-${version}.AppImage";
-    sha256 = "1v733b4clc9sjgb72fasmbqiyz26d09f3kmvd1nqshwp5d14dajz";
+    sha256 = "sha256-SqeMnoMzxxaViJ3NPccj3kyMc1xvXWULM6hQIDZySWY=";
   };
 
   appimageContents = appimageTools.extract { inherit name src; };
diff --git a/pkgs/applications/office/qownnotes/default.nix b/pkgs/applications/office/qownnotes/default.nix
index f5bc6d0d14f..830c1c42555 100644
--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@@ -5,13 +5,13 @@
 
 mkDerivation rec {
   pname = "qownnotes";
-  version = "21.12.8";
+  version = "22.1.7";
 
   src = fetchurl {
     url = "https://download.tuxfamily.org/${pname}/src/${pname}-${version}.tar.xz";
     # Fetch the checksum of current version with curl:
     # curl https://download.tuxfamily.org/qownnotes/src/qownnotes-<version>.tar.xz.sha256
-    sha256 = "sha256-iVcGJz4lxyn303ACYBUVm9cOYjVrETpyUapjAieMpqE=";
+    sha256 = "7ac13816e47e23e8469f47b6d48a29f7e98416de0fa9ef77eb3da63b191829f3";
   };
 
   nativeBuildInputs = [ qmake qttools ];
diff --git a/pkgs/applications/office/timeline/default.nix b/pkgs/applications/office/timeline/default.nix
index f4f83ce8e7a..52677716247 100644
--- a/pkgs/applications/office/timeline/default.nix
+++ b/pkgs/applications/office/timeline/default.nix
@@ -18,7 +18,7 @@ python3.pkgs.buildPythonApplication rec {
   nativeBuildInputs = [ python3.pkgs.wrapPython copyDesktopItems ];
 
   pythonPath = with python3.pkgs; [
-    wxPython_4_0 # not compatible with wxPython_4_1. reported upstream https://github.com/wxWidgets/Phoenix/issues/1956
+    wxPython_4_1
     humblewx
     icalendar
     markdown
diff --git a/pkgs/applications/office/trilium/default.nix b/pkgs/applications/office/trilium/default.nix
index fc4605911dd..39bb5d1bf14 100644
--- a/pkgs/applications/office/trilium/default.nix
+++ b/pkgs/applications/office/trilium/default.nix
@@ -19,16 +19,16 @@ let
     maintainers = with maintainers; [ fliegendewurst ];
   };
 
-  version = "0.49.4";
+  version = "0.49.5";
 
   desktopSource = {
     url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-${version}.tar.xz";
-    sha256 = "078w7jjkn8af3i0y0s236ky54h08b2wgzcaiakqiqx4gxdpf6jrq";
+    sha256 = "0bis0xkpcr8rvhm9364v0np5cnvkscv2fgl90f455lcwy7kk9m12";
   };
 
   serverSource = {
     url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-server-${version}.tar.xz";
-    sha256 = "0hygdxb97373z5cn3s4wr66wc41w7a55kxjyb8alck1fl9l6agn1";
+    sha256 = "1wv9xz1asjadz1jzgpaxf6lzbj5azgsq0qpawp3y257h488r1z9k";
   };
 
 in {
diff --git a/pkgs/applications/office/watson/default.nix b/pkgs/applications/office/watson/default.nix
index 7584debc20f..cf4fa359749 100644
--- a/pkgs/applications/office/watson/default.nix
+++ b/pkgs/applications/office/watson/default.nix
@@ -10,7 +10,8 @@ let
   # Workaround the issue by providing click 7 explicitly.
   python = python3.override {
     packageOverrides = self: super: {
-      click = self.callPackage ../../../development/python-modules/click/7.nix { };
+      # Use click 7
+      click = self.callPackage ../../../development/python2-modules/click/default.nix { };
     };
   };
 in with python.pkgs; buildPythonApplication rec {
diff --git a/pkgs/applications/radio/gnuradio/3.7.nix b/pkgs/applications/radio/gnuradio/3.9.nix
index 372300895ca..784ab7bd0fc 100644
--- a/pkgs/applications/radio/gnuradio/3.7.nix
+++ b/pkgs/applications/radio/gnuradio/3.9.nix
@@ -7,7 +7,6 @@
 , pkg-config
 , volk
 , cppunit
-, swig
 , orc
 , boost
 , log4cpp
@@ -21,33 +20,39 @@
 , libjack2
 , CoreAudio
 , uhd
-, comedilib
-, libusb1
 , SDL
 , gsl
+, soapysdr
+, libsodium
+, libsndfile
+, libunwind
+, thrift
 , cppzmq
 , zeromq
+# Needed only if qt-gui is disabled, from some reason
+, icu
 # GUI related
-, gtk2
+, gtk3
 , pango
+, gobject-introspection
 , cairo
-, qt4
-, qwt6_qt4
+, qt5
+, libsForQt5
 # Features available to override, the list of them is in featuresInfo. They
-# are all turned on by default
+# are all turned on by default.
 , features ? {}
 # If one wishes to use a different src or name for a very custom build
 , overrideSrc ? {}
 , pname ? "gnuradio"
 , versionAttr ? {
-  major = "3.7";
-  minor = "14";
+  major = "3.9";
+  minor = "5";
   patch = "0";
 }
 }:
 
 let
-  sourceSha256 = "BiUDibXV/5cEYmAAaIxT4WTxF/ni4MJumF5oJ/vuOyc=";
+  sourceSha256 = "sha256-TWCXLoS+ImKNd2zkxMks4FXsQMvGKgcW5/MW8S1Y1TY=";
   featuresInfo = {
     # Needed always
     basic = {
@@ -56,27 +61,30 @@ let
         pkg-config
         orc
       ];
-      runtime = [ boost log4cpp mpir ];
-      pythonNative = with python.pkgs; [ Mako six ];
-    };
-    volk = {
-      cmakeEnableFlag = "VOLK";
       runtime = [
         volk
+        boost
+        log4cpp
+        mpir
+      ]
+        # when gr-qtgui is disabled, icu needs to be included, otherwise
+        # building with boost 1.7x fails
+        ++ lib.optionals (!(hasFeature "gr-qtgui")) [ icu ];
+      pythonNative = with python.pkgs; [
+        Mako
+        six
       ];
     };
     doxygen = {
       native = [ doxygen ];
       cmakeEnableFlag = "DOXYGEN";
     };
-    sphinx = {
-      pythonNative = with python.pkgs; [ sphinx ];
-      cmakeEnableFlag = "SPHINX";
+    man-pages = {
+      cmakeEnableFlag = "MANPAGES";
     };
     python-support = {
       pythonRuntime = [ python.pkgs.six ];
       native = [
-        swig
         python
       ];
       cmakeEnableFlag = "PYTHON";
@@ -85,31 +93,44 @@ let
       native = [ cppunit ];
       cmakeEnableFlag = "TESTING";
     };
+    post-install = {
+      cmakeEnableFlag = "POSTINSTALL";
+    };
     gnuradio-runtime = {
       cmakeEnableFlag = "GNURADIO_RUNTIME";
+      pythonRuntime = [
+        python.pkgs.pybind11
+      ];
     };
     gr-ctrlport = {
-      cmakeEnableFlag = "GR_CTRLPORT";
-      native = [
-        swig
+      runtime = [
+        libunwind
+        thrift
       ];
+      pythonRuntime = with python.pkgs; [
+        python.pkgs.thrift
+        # For gr-perf-monitorx
+        matplotlib
+        networkx
+      ];
+      cmakeEnableFlag = "GR_CTRLPORT";
     };
     gnuradio-companion = {
       pythonRuntime = with python.pkgs; [
         pyyaml
-        cheetah
-        lxml
-        pygtk
+        Mako
         numpy
-        # propagated by pygtk, but since wrapping is done externally, it help
-        # the wrapper if it's here
-        pycairo
-        pygobject2
+        pygobject3
+      ];
+      native = [
+        python.pkgs.pytest
       ];
       runtime = [
-        gtk2
+        gtk3
         pango
+        gobject-introspection
         cairo
+        libsndfile
       ];
       cmakeEnableFlag = "GRC";
     };
@@ -126,6 +147,10 @@ let
     gr-filter = {
       runtime = [ fftwFloat ];
       cmakeEnableFlag = "GR_FILTER";
+      pythonRuntime = with python.pkgs; [
+        scipy
+        pyqtgraph
+      ];
     };
     gr-analog = {
       cmakeEnableFlag = "GR_ANALOG";
@@ -136,9 +161,6 @@ let
     gr-dtv = {
       cmakeEnableFlag = "GR_DTV";
     };
-    gr-atsc = {
-      cmakeEnableFlag = "GR_ATSC";
-    };
     gr-audio = {
       runtime = []
         ++ lib.optionals stdenv.isLinux [ alsa-lib libjack2 ]
@@ -146,33 +168,46 @@ let
       ;
       cmakeEnableFlag = "GR_AUDIO";
     };
-    gr-comedi = {
-      runtime = [ comedilib ];
-      cmakeEnableFlag = "GR_COMEDI";
-    };
     gr-channels = {
       cmakeEnableFlag = "GR_CHANNELS";
     };
-    gr-noaa = {
-      cmakeEnableFlag = "GR_NOAA";
-    };
-    gr-pager = {
-      cmakeEnableFlag = "GR_PAGER";
-    };
     gr-qtgui = {
-      runtime = [ qt4 qwt6_qt4 ];
-      pythonRuntime = [ python.pkgs.pyqt4 ];
+      runtime = [ qt5.qtbase libsForQt5.qwt ];
+      pythonRuntime = [ python.pkgs.pyqt5 ];
       cmakeEnableFlag = "GR_QTGUI";
     };
     gr-trellis = {
       cmakeEnableFlag = "GR_TRELLIS";
     };
     gr-uhd = {
-      runtime = [ uhd ];
+      runtime = [
+        uhd
+      ];
       cmakeEnableFlag = "GR_UHD";
     };
+    gr-uhd-rfnoc = {
+      runtime = [
+        uhd
+      ];
+      cmakeEnableFlag = "UHD_RFNOC";
+    };
     gr-utils = {
       cmakeEnableFlag = "GR_UTILS";
+      pythonRuntime = with python.pkgs; [
+        # For gr_plot
+        matplotlib
+      ];
+    };
+    gr-modtool = {
+      pythonRuntime = with python.pkgs; [
+        setuptools
+        click
+        click-plugins
+      ];
+      cmakeEnableFlag = "GR_MODTOOL";
+    };
+    gr-blocktool = {
+      cmakeEnableFlag = "GR_BLOCKTOOL";
     };
     gr-video-sdl = {
       runtime = [ SDL ];
@@ -182,27 +217,28 @@ let
       runtime = [ codec2 gsm ];
       cmakeEnableFlag = "GR_VOCODER";
     };
-    gr-fcd = {
-      runtime = [ libusb1 ];
-      cmakeEnableFlag = "GR_FCD";
-    };
     gr-wavelet = {
       cmakeEnableFlag = "GR_WAVELET";
-      runtime = [ gsl ];
+      runtime = [ gsl libsodium ];
     };
     gr-zeromq = {
       runtime = [ cppzmq zeromq ];
       cmakeEnableFlag = "GR_ZEROMQ";
     };
-    gr-wxgui = {
-      pythonRuntime = with python.pkgs; [ numpy wxPython ];
-      cmakeEnableFlag = "GR_WXGUI";
+    gr-network = {
+      cmakeEnableFlag = "GR_NETWORK";
+    };
+    gr-soapy = {
+      cmakeEnableFlag = "GR_SOAPY";
+      runtime = [
+        soapysdr
+      ];
     };
   };
   shared = (import ./shared.nix {
     inherit
-      lib
       stdenv
+      lib
       python
       removeReferencesTo
       featuresInfo
@@ -212,8 +248,8 @@ let
       overrideSrc
       fetchFromGitHub
     ;
-    qt = qt4;
-    gtk = gtk2;
+    qt = qt5;
+    gtk = gtk3;
   });
   inherit (shared) hasFeature; # function
 in
@@ -225,57 +261,33 @@ stdenv.mkDerivation rec {
     src
     nativeBuildInputs
     buildInputs
+    cmakeFlags
     disallowedReferences
-    postInstall
+    stripDebugList
     doCheck
     dontWrapPythonPrograms
+    dontWrapQtApps
     meta
   ;
-
+  patches = [
+    # Not accepted upstream, see https://github.com/gnuradio/gnuradio/pull/5227
+    ./modtool-newmod-permissions.patch
+  ];
   passthru = shared.passthru // {
     # Deps that are potentially overriden and are used inside GR plugins - the same version must
     inherit boost volk;
   } // lib.optionalAttrs (hasFeature "gr-uhd") {
     inherit uhd;
+  } // lib.optionalAttrs (hasFeature "gr-qtgui") {
+    inherit (libsForQt5) qwt;
   };
-  cmakeFlags = shared.cmakeFlags
-    # From some reason, if these are not set, libcodec2 and gsm are
-    # not detected properly (slightly different then what's in
-    # ./default.nix).
-    ++ lib.optionals (hasFeature "gr-vocoder") [
-      "-DLIBCODEC2_LIBRARIES=${codec2}/lib/libcodec2.so"
-      "-DLIBCODEC2_INCLUDE_DIR=${codec2}/include"
-      "-DLIBGSM_LIBRARIES=${gsm}/lib/libgsm.so"
-      "-DLIBGSM_INCLUDE_DIR=${gsm}/include/gsm"
-    ]
-    ++ lib.optionals (hasFeature "volk" && volk != null) [
-      "-DENABLE_INTERNAL_VOLK=OFF"
-    ]
-  ;
-  stripDebugList = shared.stripDebugList
-    # gr-fcd feature was dropped in 3.8
-    ++ lib.optionals (hasFeature "gr-fcd") [ "share/gnuradio/examples/fcd" ]
-  ;
-  preConfigure = ""
-    # wxgui and pygtk are not looked up properly, so we force them to be
-    # detected as found, if they are requested by the `features` attrset.
-    + lib.optionalString (hasFeature "gr-wxgui") ''
-      sed -i 's/.*wx\.version.*/set(WX_FOUND TRUE)/g' gr-wxgui/CMakeLists.txt
-    ''
-    + lib.optionalString (hasFeature "gnuradio-companion") ''
-      sed -i 's/.*pygtk_version.*/set(PYGTK_FOUND TRUE)/g' grc/CMakeLists.txt
+
+  postInstall = shared.postInstall
+    # This is the only python reference worth removing, if needed.
+    + lib.optionalString (!hasFeature "python-support") ''
+      ${removeReferencesTo}/bin/remove-references-to -t ${python} $out/lib/cmake/gnuradio/GnuradioConfig.cmake
+      ${removeReferencesTo}/bin/remove-references-to -t ${python} $(readlink -f $out/lib/libgnuradio-runtime.so)
+      ${removeReferencesTo}/bin/remove-references-to -t ${python.pkgs.pybind11} $out/lib/cmake/gnuradio/gnuradio-runtimeTargets.cmake
     ''
   ;
-  patches = [
-    # Don't install python referencing files if python support is disabled.
-    # See: https://github.com/gnuradio/gnuradio/pull/3856
-    (fetchpatch {
-      url = "https://github.com/gnuradio/gnuradio/commit/acef55433d15c231661fa44751f9a2d90a4baa4b.diff";
-      sha256 = "2CEX44Ll8frfLXTIWjdDhKl7aXcjiAWsezVdwrynelE=";
-    })
-    (fetchpatch {
-      url = "https://github.com/gnuradio/gnuradio/commit/a2681edcfaabcb1ecf878ae861161b6a6bf8459d.diff";
-      sha256 = "2Pitgu8accs16B5X5+/q51hr+IY9DMsA15f56gAtBs8=";
-    })
-  ];
 }
diff --git a/pkgs/applications/radio/gnuradio/default.nix b/pkgs/applications/radio/gnuradio/default.nix
index 784ab7bd0fc..3e1366547ee 100644
--- a/pkgs/applications/radio/gnuradio/default.nix
+++ b/pkgs/applications/radio/gnuradio/default.nix
@@ -9,7 +9,7 @@
 , cppunit
 , orc
 , boost
-, log4cpp
+, spdlog
 , mpir
 , doxygen
 , python
@@ -18,6 +18,8 @@
 , fftwFloat
 , alsa-lib
 , libjack2
+, libiio
+, libad9361
 , CoreAudio
 , uhd
 , SDL
@@ -45,14 +47,14 @@
 , overrideSrc ? {}
 , pname ? "gnuradio"
 , versionAttr ? {
-  major = "3.9";
-  minor = "5";
+  major = "3.10";
+  minor = "0";
   patch = "0";
 }
 }:
 
 let
-  sourceSha256 = "sha256-TWCXLoS+ImKNd2zkxMks4FXsQMvGKgcW5/MW8S1Y1TY=";
+  sourceSha256 = "sha256-1K8nlNiirks3MJ+9cH9bkILVFtu5OxhKkNhetGqojn4=";
   featuresInfo = {
     # Needed always
     basic = {
@@ -64,7 +66,7 @@ let
       runtime = [
         volk
         boost
-        log4cpp
+        spdlog
         mpir
       ]
         # when gr-qtgui is disabled, icu needs to be included, otherwise
@@ -171,6 +173,22 @@ let
     gr-channels = {
       cmakeEnableFlag = "GR_CHANNELS";
     };
+    gr-pdu = {
+      cmakeEnableFlag = "GR_PDU";
+      runtime = [
+        libiio
+        libad9361
+      ];
+    };
+    gr-iio = {
+      cmakeEnableFlag = "GR_IIO";
+      runtime = [
+        libiio
+      ];
+    };
+    common-precompiled-headers = {
+      cmakeEnableFlag = "COMMON_PCH";
+    };
     gr-qtgui = {
       runtime = [ qt5.qtbase libsForQt5.qwt ];
       pythonRuntime = [ python.pkgs.pyqt5 ];
diff --git a/pkgs/applications/radio/gqrx/default.nix b/pkgs/applications/radio/gqrx/default.nix
index 514fac80d18..6678b933d87 100644
--- a/pkgs/applications/radio/gqrx/default.nix
+++ b/pkgs/applications/radio/gqrx/default.nix
@@ -24,13 +24,13 @@ assert !(pulseaudioSupport && portaudioSupport);
 
 gnuradio3_8Minimal.pkgs.mkDerivation rec {
   pname = "gqrx";
-  version = "2.15.2";
+  version = "2.15.4";
 
   src = fetchFromGitHub {
     owner = "gqrx-sdr";
     repo = "gqrx";
     rev = "v${version}";
-    sha256 = "sha256-LWuSJbzQKHoCbkyRQ7KqUxFXzA99kuafPibH8Xx7mXs=";
+    sha256 = "sha256-iQlrnkc1EMR8sUUAHh+7RfS/05unrcDm/kJ/Q4Vst2Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/radio/soapysdr/default.nix b/pkgs/applications/radio/soapysdr/default.nix
index efd438adf63..79dcab19acb 100644
--- a/pkgs/applications/radio/soapysdr/default.nix
+++ b/pkgs/applications/radio/soapysdr/default.nix
@@ -2,7 +2,8 @@
 , fetchFromGitHub, cmake
 , libusb-compat-0_1, pkg-config
 , usePython ? false
-, python, ncurses, swig2
+, python ? null
+, ncurses, swig2
 , extraPackages ? []
 } :
 
diff --git a/pkgs/applications/science/biology/minimap2/default.nix b/pkgs/applications/science/biology/minimap2/default.nix
index 062cdd56c7c..bba8a02b76e 100644
--- a/pkgs/applications/science/biology/minimap2/default.nix
+++ b/pkgs/applications/science/biology/minimap2/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "minimap2";
-  version = "2.23";
+  version = "2.24";
 
   src = fetchFromGitHub {
     repo = pname;
     owner = "lh3";
     rev = "v${version}";
-    sha256 = "sha256-oNVpSINcXO2eKzOCr/Fl8tSMguRxzmlDNu7hLZeopoQ=";
+    sha256 = "sha256-sEp7/Y5ifV9LTqrkhlkfykTJYMMuc+VtF7PvmIpBxUw=";
   };
 
   buildInputs = [ zlib ];
@@ -25,6 +25,7 @@ stdenv.mkDerivation rec {
     homepage = "https://lh3.github.io/minimap2";
     license = licenses.mit;
     platforms = platforms.all;
+    badPlatforms = platforms.aarch64;
     maintainers = [ maintainers.arcadio ];
   };
 }
diff --git a/pkgs/applications/science/biology/poretools/default.nix b/pkgs/applications/science/biology/poretools/default.nix
index b2cefefb5cb..efbedf9a121 100755
--- a/pkgs/applications/science/biology/poretools/default.nix
+++ b/pkgs/applications/science/biology/poretools/default.nix
@@ -1,6 +1,6 @@
-{ lib, pythonPackages, fetchFromGitHub }:
+{ lib, python2Packages, fetchFromGitHub }:
 
-pythonPackages.buildPythonPackage rec {
+python2Packages.buildPythonPackage rec {
   pname = "poretools";
   version = "unstable-2016-07-10";
 
@@ -11,7 +11,7 @@ pythonPackages.buildPythonPackage rec {
     sha256 = "0bglj833wxpp3cq430p1d3xp085ls221js2y90w7ir2x5ay8l7am";
   };
 
-  propagatedBuildInputs = [pythonPackages.h5py pythonPackages.matplotlib pythonPackages.seaborn pythonPackages.pandas];
+  propagatedBuildInputs = [python2Packages.h5py python2Packages.matplotlib python2Packages.seaborn python2Packages.pandas];
 
   meta = {
     description = "a toolkit for working with nanopore sequencing data from Oxford Nanopore";
diff --git a/pkgs/applications/science/biology/tebreak/default.nix b/pkgs/applications/science/biology/tebreak/default.nix
index cb606a6b346..e56d91dc2cd 100644
--- a/pkgs/applications/science/biology/tebreak/default.nix
+++ b/pkgs/applications/science/biology/tebreak/default.nix
@@ -1,7 +1,7 @@
-{ lib, fetchFromGitHub, last, exonerate, minia, python3Packages, bwa
-, samtools, findutils, python }:
+{ lib, fetchFromGitHub, last, exonerate, minia, python3, bwa
+, samtools, findutils }:
 
-python3Packages.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "tebreak";
   version = "1.1";
 
@@ -12,8 +12,8 @@ python3Packages.buildPythonApplication rec {
     sha256 = "13mgh775d8hkl340923lfwwm4r5ps70girn8d6wgfxzwzxylz8iz";
   };
 
-  nativeBuildInputs = [ findutils python3Packages.cython ];
-  propagatedBuildInputs = with python3Packages; [
+  nativeBuildInputs = [ findutils python3.pkgs.cython ];
+  propagatedBuildInputs = with python3.pkgs; [
     pysam
     scipy
     bx-python
@@ -35,7 +35,7 @@ python3Packages.buildPythonApplication rec {
   checkPhase = ''
     $out/bin/tebreak -b test/data/example.ins.bam  -r test/data/Homo_sapiens_chr4_50000000-60000000_assembly19.fasta -p 4 --pickle test/example.pickle --detail_out test/example.tebreak.detail.out -i lib/teref.human.fa
     pushd test
-    ${python.interpreter} checktest.py
+    ${python3.interpreter} checktest.py
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/science/electronics/kicad/default.nix b/pkgs/applications/science/electronics/kicad/default.nix
index 44a538370da..95e88ff1407 100644
--- a/pkgs/applications/science/electronics/kicad/default.nix
+++ b/pkgs/applications/science/electronics/kicad/default.nix
@@ -22,7 +22,7 @@
 , sanitizeAddress ? false
 , sanitizeThreads ? false
 , with3d ? true
-, withI18n ? false
+, withI18n ? true
 , withPCM ? true # Plugin and Content Manager
 , srcs ? { }
 }:
diff --git a/pkgs/applications/science/logic/lean/default.nix b/pkgs/applications/science/logic/lean/default.nix
index 78c2a56dc16..c9ba47eca14 100644
--- a/pkgs/applications/science/logic/lean/default.nix
+++ b/pkgs/applications/science/logic/lean/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "lean";
-  version = "3.37.0";
+  version = "3.38.0";
 
   src = fetchFromGitHub {
     owner  = "leanprover-community";
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     # from. this is then used to check whether an olean file should be
     # rebuilt. don't use a tag as rev because this will get replaced into
     # src/githash.h.in in preConfigure.
-    rev    = "e69ab934262eb6f141344fdaec98ede68a9102b6";
-    sha256 = "19sigzbrdl90jqk7lvl3q8j6n4nnidzwp9zzmzgq3zxxgywa2ghp";
+    rev    = "a8cf8a0c9ea19a633baeb3aa7e8d706b86c2c0f9";
+    sha256 = "14dam91pnn266fgii5c2j5p9p2i31bghx0s2h3qnnqyvxi4s5isx";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/science/machine-learning/shogun/default.nix b/pkgs/applications/science/machine-learning/shogun/default.nix
index 911d0043ed2..3cb018b9a5d 100644
--- a/pkgs/applications/science/machine-learning/shogun/default.nix
+++ b/pkgs/applications/science/machine-learning/shogun/default.nix
@@ -6,7 +6,7 @@
   # build
 , cmake
 , ctags
-, pythonPackages
+, python2Packages
 , swig
   # math
 , eigen
@@ -36,7 +36,7 @@
 , withSvmLight ? false
 }:
 
-assert pythonSupport -> pythonPackages != null;
+assert pythonSupport -> python2Packages != null;
 assert opencvSupport -> opencv != null;
 
 assert (!blas.isILP64) && (!lapack.isILP64);
@@ -101,7 +101,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional (!withSvmLight) ./svmlight-scrubber.patch;
 
   nativeBuildInputs = [ cmake swig ctags ]
-    ++ (with pythonPackages; [ python jinja2 ply ]);
+    ++ (with python2Packages; [ python jinja2 ply ]);
 
   buildInputs = [
     eigen
@@ -121,7 +121,7 @@ stdenv.mkDerivation rec {
     nlopt
     lp_solve
     colpack
-  ] ++ lib.optionals pythonSupport (with pythonPackages; [ python numpy ])
+  ] ++ lib.optionals pythonSupport (with python2Packages; [ python numpy ])
     ++ lib.optional opencvSupport opencv;
 
   cmakeFlags = let
diff --git a/pkgs/applications/science/misc/sasview/default.nix b/pkgs/applications/science/misc/sasview/default.nix
index bbbe80eb656..d12f9454ce7 100644
--- a/pkgs/applications/science/misc/sasview/default.nix
+++ b/pkgs/applications/science/misc/sasview/default.nix
@@ -1,25 +1,25 @@
-{ lib, fetchFromGitHub, gcc, python }:
+{ lib, fetchFromGitHub, gcc, python2 }:
 
 let
   xhtml2pdf = import ./xhtml2pdf.nix {
     inherit lib;
-    fetchPypi = python.pkgs.fetchPypi;
-    buildPythonPackage = python.pkgs.buildPythonPackage;
-    html5lib = python.pkgs.html5lib;
-    httplib2 = python.pkgs.httplib2;
-    nose = python.pkgs.nose;
-    pillow = python.pkgs.pillow;
-    pypdf2 = python.pkgs.pypdf2;
-    reportlab = python.pkgs.reportlab;
+    fetchPypi = python2.pkgs.fetchPypi;
+    buildPythonPackage = python2.pkgs.buildPythonPackage;
+    html5lib = python2.pkgs.html5lib;
+    httplib2 = python2.pkgs.httplib2;
+    nose = python2.pkgs.nose;
+    pillow = python2.pkgs.pillow;
+    pypdf2 = python2.pkgs.pypdf2;
+    reportlab = python2.pkgs.reportlab;
   };
 
 in
 
-python.pkgs.buildPythonApplication rec {
+python2.pkgs.buildPythonApplication rec {
   pname = "sasview";
   version = "4.2.0";
 
-  checkInputs = with python.pkgs; [
+  checkInputs = with python2.pkgs; [
     pytest
     unittest-xml-reporting
   ];
@@ -35,7 +35,7 @@ python.pkgs.buildPythonApplication rec {
     HOME=$(mktemp -d) py.test
   '';
 
-  propagatedBuildInputs = with python.pkgs; [
+  propagatedBuildInputs = with python2.pkgs; [
     bumps
     gcc
     h5py
diff --git a/pkgs/applications/science/misc/tulip/default.nix b/pkgs/applications/science/misc/tulip/default.nix
index 62d638717f8..1dfd47a3d38 100644
--- a/pkgs/applications/science/misc/tulip/default.nix
+++ b/pkgs/applications/science/misc/tulip/default.nix
@@ -1,5 +1,5 @@
 { fetchurl, lib, stdenv, libxml2, freetype, libGLU, libGL, glew, qt4
-, cmake, makeWrapper, libjpeg, python }:
+, cmake, makeWrapper, libjpeg, python2 }:
 
 let version = "5.2.1"; in
 stdenv.mkDerivation rec {
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0bqmqy6sri87a8xv5xf7ffaq5zin4hiaa13g0l64b84i7yckfwky";
   };
 
-  buildInputs = [ libxml2 freetype glew libGLU libGL qt4 libjpeg python ];
+  buildInputs = [ libxml2 freetype glew libGLU libGL qt4 libjpeg python2 ];
 
   nativeBuildInputs = [ cmake makeWrapper ];
 
diff --git a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
index f30e94f03d8..dd4bb6ef142 100644
--- a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
+++ b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
@@ -19,11 +19,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "gromacs";
-  version = "2021.4";
+  version = "2021.5";
 
   src = fetchurl {
     url = "ftp://ftp.gromacs.org/pub/gromacs/gromacs-${version}.tar.gz";
-    sha256 = "07ds8abxq0k7vfpjvxb8in3fhb6lz0pbdzbmlidyzaw37qz8lw6b";
+    sha256 = "1dh9l2gcv61h1r6qsg8vr3k1xp8jgd27czzg24kzf4k823k3z9pb";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/system/monitor/default.nix b/pkgs/applications/system/monitor/default.nix
index 6b535e5ad41..653d727525e 100644
--- a/pkgs/applications/system/monitor/default.nix
+++ b/pkgs/applications/system/monitor/default.nix
@@ -18,17 +18,20 @@
 , sassc
 , udisks2
 , wrapGAppsHook
+, libX11
+, libXext
+, libXNVCtrl
 }:
 
 stdenv.mkDerivation rec {
   pname = "monitor";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "stsdc";
     repo = "monitor";
     rev = version;
-    sha256 = "sha256-xWhhjn7zk/juXx50wLG2TpB5aqU+588kWBBquWrVJbM=";
+    sha256 = "1fv98yz9393ddp0k96bwbgccy6x9dmmg8g1pjd3xs6m4c1bnvfc7";
     fetchSubmodules = true;
   };
 
@@ -53,8 +56,19 @@ stdenv.mkDerivation rec {
     libwnck
     sassc
     udisks2
+    libX11
+    libXext
+    libXNVCtrl
   ];
 
+  # Force link against Xext, otherwise build fails with:
+  # ld: /nix/store/...-libXNVCtrl-495.46/lib/libXNVCtrl.a(NVCtrl.o): undefined reference to symbol 'XextAddDisplay'
+  # ld: /nix/store/...-libXext-1.3.4/lib/libXext.so.6: error adding symbols: DSO missing from command line
+  # https://github.com/stsdc/monitor/issues/292
+  NIX_LDFLAGS = "-lXext";
+
+  mesonFlags = [ "-Dindicator-wingpanel=enabled" ];
+
   postPatch = ''
     chmod +x meson/post_install.py
     patchShebangs meson/post_install.py
diff --git a/pkgs/applications/terminal-emulators/kitty/default.nix b/pkgs/applications/terminal-emulators/kitty/default.nix
index 4cd8f72b790..d79ce43bdff 100644
--- a/pkgs/applications/terminal-emulators/kitty/default.nix
+++ b/pkgs/applications/terminal-emulators/kitty/default.nix
@@ -3,8 +3,10 @@
   libstartup_notification, libGL, libX11, libXrandr, libXinerama, libXcursor,
   libxkbcommon, libXi, libXext, wayland-protocols, wayland,
   lcms2,
+  librsync,
   installShellFiles,
   dbus,
+  darwin,
   Cocoa,
   CoreGraphics,
   Foundation,
@@ -21,20 +23,21 @@
 with python3Packages;
 buildPythonApplication rec {
   pname = "kitty";
-  version = "0.23.1";
+  version = "0.24.1";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "kovidgoyal";
     repo = "kitty";
     rev = "v${version}";
-    sha256 = "sha256-2RwDU6EOJWF0u2ikJFg9U2yqSXergDkJH3h2i+QJ7G4=";
+    sha256 = "sha256-WPkyub7CwNXRksUmqiZeznnSqEPFpyHTeFLQ+D4Fb5c=";
   };
 
   buildInputs = [
     harfbuzz
     ncurses
     lcms2
+    librsync
   ] ++ lib.optionals stdenv.isDarwin [
     Cocoa
     CoreGraphics
@@ -45,6 +48,8 @@ buildPythonApplication rec {
     libpng
     python3
     zlib
+  ] ++ lib.optionals (stdenv.isDarwin && (builtins.hasAttr "UserNotifications" darwin.apple_sdk.frameworks)) [
+    darwin.apple_sdk.frameworks.UserNotifications
   ] ++ lib.optionals stdenv.isLinux [
     fontconfig libunistring libcanberra libX11
     libXrandr libXinerama libXcursor libxkbcommon libXi libXext
@@ -67,26 +72,31 @@ buildPythonApplication rec {
 
   propagatedBuildInputs = lib.optional stdenv.isLinux libGL;
 
-  outputs = [ "out" "terminfo" ];
+  outputs = [ "out" "terminfo" "shell_integration" ];
 
   # Causes build failure due to warning
   hardeningDisable = lib.optional stdenv.cc.isClang "strictoverflow";
 
   dontConfigure = true;
 
-  buildPhase = ''
+  buildPhase = let
+    commonOptions = ''
+      --update-check-interval=0 \
+      --shell-integration=enabled\ no-rc
+    '';
+  in ''
     runHook preBuild
     ${if stdenv.isDarwin then ''
       ${python.interpreter} setup.py kitty.app \
-      --update-check-interval=0 \
-      --disable-link-time-optimization
+      --disable-link-time-optimization \
+      ${commonOptions}
       make man
     '' else ''
       ${python.interpreter} setup.py linux-package \
-      --update-check-interval=0 \
       --egl-library='${lib.getLib libGL}/lib/libEGL.so.1' \
       --startup-notification-library='${libstartup_notification}/lib/libstartup-notification-1.so' \
-      --canberra-library='${libcanberra}/lib/libcanberra.so'
+      --canberra-library='${libcanberra}/lib/libcanberra.so' \
+      ${commonOptions}
     ''}
     runHook postBuild
   '';
@@ -125,10 +135,7 @@ buildPythonApplication rec {
       --bash <("$out/bin/kitty" + complete setup bash) \
       --fish <("$out/bin/kitty" + complete setup fish) \
       --zsh  <("$out/bin/kitty" + complete setup zsh)
-    runHook postInstall
-  '';
 
-  postInstall = ''
     terminfo_src=${if stdenv.isDarwin then
       ''"$out/Applications/kitty.app/Contents/Resources/terminfo"''
       else
@@ -139,6 +146,10 @@ buildPythonApplication rec {
 
     mkdir -p $out/nix-support
     echo "$terminfo" >> $out/nix-support/propagated-user-env-packages
+
+    cp -r 'shell-integration' "$shell_integration"
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/terminal-emulators/mlterm/default.nix b/pkgs/applications/terminal-emulators/mlterm/default.nix
index b9f7d4ef677..48c4f6f2c4d 100644
--- a/pkgs/applications/terminal-emulators/mlterm/default.nix
+++ b/pkgs/applications/terminal-emulators/mlterm/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mlterm";
-  version = "3.9.1";
+  version = "3.9.2";
 
   src = fetchFromGitHub {
     owner = "arakiken";
     repo = pname;
     rev = "rel-${lib.replaceStrings [ "." ] [ "_" ] version}"; # 3.9.1 -> rel-3_9_1
-    sha256 = "1hh196kz2n3asv8r8r2bdk5b2w93zq7rw4880ciiq1554h0ib7fj";
+    sha256 = "sha256-DvGR3rDegInpnLp3H+rXNXktCGhpjsBBPTRMwodeTro=";
   };
 
   nativeBuildInputs = [ pkg-config autoconf wrapGAppsHook ];
diff --git a/pkgs/applications/version-management/dvc/default.nix b/pkgs/applications/version-management/dvc/default.nix
index ac1659cccf8..a886f6b332c 100644
--- a/pkgs/applications/version-management/dvc/default.nix
+++ b/pkgs/applications/version-management/dvc/default.nix
@@ -1,5 +1,5 @@
 { lib
-, python3Packages
+, python3
 , fetchFromGitHub
 , enableGoogle ? false
 , enableAWS ? false
@@ -7,59 +7,88 @@
 , enableSSH ? false
 }:
 
-with python3Packages;
-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "dvc";
-  version = "0.24.3";
+  version = "2.9.3";
+  format = "setuptools";
 
-  # PyPi only has wheel
   src = fetchFromGitHub {
     owner = "iterative";
-    repo = "dvc";
+    repo = pname;
     rev = version;
-    sha256 = "1wqq4i23hppilp20fx5a5nj93xwf3wwwr2f8aasvn6jkv2l22vpl";
+    hash = "sha256-nRlgo7Wjs7RgTUxoMYQh5YEsqiJtdWH2ex79rhXagAQ=";
   };
 
-  propagatedBuildInputs = [
-    ply
-    configparser
-    zc_lockfile
-    future
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools-scm
+    setuptools-scm-git-archive
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    appdirs
+    aiohttp-retry
     colorama
     configobj
-    networkx
-    pyyaml
-    GitPython
-    setuptools
+    configobj
+    dictdiffer
+    diskcache
+    distro
+    dpath
+    flatten-dict
+    flufl_lock
+    funcy
+    grandalf
     nanotime
-    pyasn1
-    schema
-    jsonpath_rw
+    networkx
+    pathspec
+    ply
+    psutil
+    pydot
+    pygtrie
+    pyparsing
+    python-benedict
     requests
-    grandalf
-    asciimatics
-    distro
-    appdirs
-  ]
-  ++ lib.optional enableGoogle google-cloud-storage
-  ++ lib.optional enableAWS boto3
-  ++ lib.optional enableAzure azure-storage-blob
-  ++ lib.optional enableSSH paramiko;
-
-  # tests require access to real cloud services
-  # nix build tests have to be isolated and run locally
-  doCheck = false;
+    rich
+    ruamel-yaml
+    scmrepo
+    shortuuid
+    shtab
+    tabulate
+    toml
+    tqdm
+    typing-extensions
+    voluptuous
+    zc_lockfile
+  ] ++ lib.optional enableGoogle [
+    google-cloud-storage
+  ] ++ lib.optional enableAWS [
+    boto3
+  ] ++ lib.optional enableAzure [
+    azure-storage-blob
+  ] ++ lib.optional enableSSH [
+    paramiko
+  ] ++ lib.optionals (pythonOlder "3.8") [
+    importlib-metadata
+  ] ++ lib.optionals (pythonOlder "3.9") [
+    importlib-resources
+  ];
 
   patches = [ ./dvc-daemon.patch ];
 
   postPatch = ''
-    substituteInPlace dvc/daemon.py --subst-var-by dvc "$out/bin/dcv"
+    substituteInPlace setup.cfg \
+      --replace "grandalf==0.6" "grandalf>=0.6"
+    substituteInPlace dvc/daemon.py \
+      --subst-var-by dvc "$out/bin/dcv"
   '';
 
+  # Tests require access to real cloud services
+  doCheck = false;
+
   meta = with lib; {
     description = "Version Control System for Machine Learning Projects";
-    license = licenses.asl20;
     homepage = "https://dvc.org";
-    maintainers = with maintainers; [ cmcdragonkai ];
+    license = licenses.asl20;
+    maintainers = with maintainers; [ cmcdragonkai fab ];
   };
 }
diff --git a/pkgs/applications/version-management/dvc/dvc-daemon.patch b/pkgs/applications/version-management/dvc/dvc-daemon.patch
index 5c2d363b17f..2263ce118dd 100644
--- a/pkgs/applications/version-management/dvc/dvc-daemon.patch
+++ b/pkgs/applications/version-management/dvc/dvc-daemon.patch
@@ -1,21 +1,18 @@
 diff --git a/dvc/daemon.py b/dvc/daemon.py
-index 1d67a37..7ce6fde 100644
+index 9854a0e1..fefdd613 100644
 --- a/dvc/daemon.py
 +++ b/dvc/daemon.py
-@@ -67,14 +67,8 @@ def daemon(args):
-     Args:
-         args (list): list of arguments to append to `dvc daemon` command.
-     """
--    cmd = [sys.executable]
--    if not is_binary():
--        cmd += ['-m', 'dvc']
--    cmd += ['daemon', '-q'] + args
+@@ -103,11 +103,8 @@ def daemon(args):
+         logger.debug("skipping launching a new daemon.")
+         return
+ 
+-    cmd = ["daemon", "-q"] + args
 -
 -    env = fix_env()
 -    file_path = os.path.abspath(inspect.stack()[0][1])
--    env['PYTHONPATH'] = os.path.dirname(os.path.dirname(file_path))
+-    env["PYTHONPATH"] = os.path.dirname(os.path.dirname(file_path))
 +    cmd = [ "@dvc@" , "daemon", "-q"] + args
 +    env = None
+     env[DVC_DAEMON] = "1"
  
-     logger.debug("Trying to spawn '{}' with env '{}'".format(cmd, env))
- 
+     _spawn(cmd, env)
diff --git a/pkgs/applications/version-management/git-and-tools/git-workspace/default.nix b/pkgs/applications/version-management/git-and-tools/git-workspace/default.nix
index b0279f004c2..7783c28927c 100644
--- a/pkgs/applications/version-management/git-and-tools/git-workspace/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-workspace/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-workspace";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "orf";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-//EyGhuE8rMRL03TtECIi0X51/p/GvTqvr2FRQEIqFA=";
+    sha256 = "sha256-uP1sex4Hx57ZsqVG4b3809FzFB10Un48+vbwaWZ7HSg=";
   };
 
-  cargoSha256 = "sha256-X0jRwDUVzS1s2tG6N2RDaFqwUUAT+mPMEft11VkJy5A=";
+  cargoSha256 = "sha256-mkrC8uzfNpL0MQUMjcNaJf5c1wSdlBVg8AMgc/zxM6A=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ]
diff --git a/pkgs/applications/version-management/gitless/default.nix b/pkgs/applications/version-management/gitless/default.nix
index 310158e3eea..ed8cd551fca 100644
--- a/pkgs/applications/version-management/gitless/default.nix
+++ b/pkgs/applications/version-management/gitless/default.nix
@@ -6,10 +6,10 @@ buildPythonApplication rec {
   version = "0.8.8";
 
   src = fetchFromGitHub {
-    owner = "sdg-mit";
+    owner = "gitless-vcs";
     repo = "gitless";
     rev = "v${version}";
-    sha256 = "1q6y38f8ap6q1livvfy0pfnjr0l8b68hyhc9r5v87fmdyl7y7y8g";
+    sha256 = "sha256-xo5EWtP2aN8YzP8ro3bnxZwUGUp0PHD0g8hk+Y+gExE=";
   };
 
   propagatedBuildInputs = with pythonPackages; [ sh pygit2 clint ];
diff --git a/pkgs/applications/version-management/rapidsvn/default.nix b/pkgs/applications/version-management/rapidsvn/default.nix
index 33eba79732d..60d011b653d 100644
--- a/pkgs/applications/version-management/rapidsvn/default.nix
+++ b/pkgs/applications/version-management/rapidsvn/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, wxGTK, subversion, apr, aprutil, python }:
+{ lib, stdenv, fetchurl, wxGTK, subversion, apr, aprutil, python2 }:
 
 stdenv.mkDerivation rec {
   pname = "rapidsvn";
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1bmcqjc12k5w0z40k7fkk8iysqv4fw33i80gvcmbakby3d4d4i4p";
   };
 
-  buildInputs = [ wxGTK subversion apr aprutil python ];
+  buildInputs = [ wxGTK subversion apr aprutil python2 ];
 
   configureFlags = [ "--with-svn-include=${subversion.dev}/include"
     "--with-svn-lib=${subversion.out}/lib" ];
diff --git a/pkgs/applications/version-management/src/default.nix b/pkgs/applications/version-management/src/default.nix
index cddcd3d8aa2..1735449e3fd 100644
--- a/pkgs/applications/version-management/src/default.nix
+++ b/pkgs/applications/version-management/src/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, python, rcs, git, makeWrapper }:
+{ lib, stdenv, fetchurl, python2, rcs, git, makeWrapper }:
 
 stdenv.mkDerivation rec {
   pname = "src";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ python rcs git ];
+  buildInputs = [ python2 rcs git ];
 
   preConfigure = ''
     patchShebangs .
diff --git a/pkgs/applications/version-management/srcml/default.nix b/pkgs/applications/version-management/srcml/default.nix
index 11dbfc299a4..60260ee4de3 100644
--- a/pkgs/applications/version-management/srcml/default.nix
+++ b/pkgs/applications/version-management/srcml/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, cmake, libxml2, libxslt, boost, libarchive, python, antlr2,
+{ lib, stdenv, fetchurl, cmake, libxml2, libxslt, boost, libarchive, python2, antlr2,
   curl
 }:
 
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ cmake antlr2 ];
-  buildInputs = [ libxml2 libxslt boost libarchive python curl ];
+  buildInputs = [ libxml2 libxslt boost libarchive python2 curl ];
 
   meta = {
     description = "Infrastructure for exploration, analysis, and manipulation of source code";
diff --git a/pkgs/applications/video/kodi/addons/arrow/default.nix b/pkgs/applications/video/kodi/addons/arrow/default.nix
new file mode 100644
index 00000000000..bca61e902eb
--- /dev/null
+++ b/pkgs/applications/video/kodi/addons/arrow/default.nix
@@ -0,0 +1,30 @@
+{ lib, buildKodiAddon, fetchzip, addonUpdateScript, dateutil, typing_extensions }:
+buildKodiAddon rec {
+  pname = "arrow";
+  namespace = "script.module.arrow";
+  version = "1.0.3.1";
+
+  src = fetchzip {
+    url = "https://mirrors.kodi.tv/addons/matrix/${namespace}/${namespace}-${version}.zip";
+    sha256 = "0xa16sb2hls59l4gsg1xwb1qbkhcvbykq02l05n5rcm0alg80l3l";
+  };
+
+  propagatedBuildInputs = [
+    dateutil
+    typing_extensions
+  ];
+
+  passthru = {
+    pythonPath = "lib";
+    updateScript = addonUpdateScript {
+      attrPath = "kodi.packages.arrow";
+    };
+  };
+
+  meta = with lib; {
+    homepage = "https://github.com/razzeee/script.module.arrow";
+    description = "Better dates & times for Python";
+    license = licenses.asl20;
+    maintainers = teams.kodi.members;
+  };
+}
diff --git a/pkgs/applications/video/kodi/addons/trakt-module/default.nix b/pkgs/applications/video/kodi/addons/trakt-module/default.nix
new file mode 100644
index 00000000000..ad7610e0f02
--- /dev/null
+++ b/pkgs/applications/video/kodi/addons/trakt-module/default.nix
@@ -0,0 +1,31 @@
+{ lib, buildKodiAddon, fetchzip, addonUpdateScript, requests, six, arrow }:
+buildKodiAddon rec {
+  pname = "trakt-module";
+  namespace = "script.module.trakt";
+  version = "4.4.0+matrix.1";
+
+  src = fetchzip {
+    url = "https://mirrors.kodi.tv/addons/matrix/${namespace}/${namespace}-${version}.zip";
+    sha256 = "19kjhrykx92sy67cajxjckzdwgq47ipwml0bx9vmdr9d191h14p8";
+  };
+
+  propagatedBuildInputs = [
+    requests
+    six
+    arrow
+  ];
+
+  passthru = {
+    pythonPath = "lib";
+    updateScript = addonUpdateScript {
+      attrPath = "kodi.packages.trakt-module";
+    };
+  };
+
+  meta = with lib; {
+    homepage = "https://github.com/Razzeee/script.module.trakt";
+    description = "Python trakt.py library packed for Kodi";
+    license = licenses.mit;
+    maintainers = teams.kodi.members;
+  };
+}
diff --git a/pkgs/applications/video/kodi/addons/trakt/default.nix b/pkgs/applications/video/kodi/addons/trakt/default.nix
new file mode 100644
index 00000000000..f2a662616cc
--- /dev/null
+++ b/pkgs/applications/video/kodi/addons/trakt/default.nix
@@ -0,0 +1,30 @@
+{ lib, buildKodiAddon, fetchzip, addonUpdateScript, trakt-module, dateutil }:
+buildKodiAddon rec {
+  pname = "trakt";
+  namespace = "script.trakt";
+  version = "3.5.0";
+
+  src = fetchzip {
+    url = "https://mirrors.kodi.tv/addons/matrix/${namespace}/${namespace}-${version}.zip";
+    sha256 = "07fb0wjcr8ggidswrjs1r1hzi6grykiyi855bgm7pjzzk95kl99v";
+  };
+
+  propagatedBuildInputs = [
+    dateutil
+    trakt-module
+  ];
+
+  passthru = {
+    pythonPath = "lib";
+    updateScript = addonUpdateScript {
+      attrPath = "kodi.packages.trakt";
+    };
+  };
+
+  meta = with lib; {
+    homepage = "https://kodi.wiki/view/Add-on:Trakt";
+    description = "Trakt.tv movie and TV show scrobbler for Kodi";
+    license = licenses.gpl2Only;
+    maintainers = teams.kodi.members;
+  };
+}
diff --git a/pkgs/applications/video/kodi/addons/typing_extensions/default.nix b/pkgs/applications/video/kodi/addons/typing_extensions/default.nix
new file mode 100644
index 00000000000..0fddddfb1b6
--- /dev/null
+++ b/pkgs/applications/video/kodi/addons/typing_extensions/default.nix
@@ -0,0 +1,25 @@
+{ lib, buildKodiAddon, fetchzip, addonUpdateScript }:
+buildKodiAddon rec {
+  pname = "typing_extensions";
+  namespace = "script.module.typing_extensions";
+  version = "3.7.4.3";
+
+  src = fetchzip {
+    url = "https://mirrors.kodi.tv/addons/matrix/${namespace}/${namespace}-${version}.zip";
+    sha256 = "0p28hchj05hmccs6b2836kh4vqdqnl169409f2845d0nw9y4wkqq";
+  };
+
+  passthru = {
+    pythonPath = "lib";
+    updateScript = addonUpdateScript {
+      attrPath = "kodi.packages.typing_extensions";
+    };
+  };
+
+  meta = with lib; {
+    homepage = "https://github.com/python/typing/tree/master/typing_extensions";
+    description = "Python typing extensions";
+    license = licenses.psfl;
+    maintainers = teams.kodi.members;
+  };
+}
diff --git a/pkgs/applications/virtualization/runc/default.nix b/pkgs/applications/virtualization/runc/default.nix
index 79a21075f03..0dd3da4b37c 100644
--- a/pkgs/applications/virtualization/runc/default.nix
+++ b/pkgs/applications/virtualization/runc/default.nix
@@ -16,13 +16,13 @@
 
 buildGoModule rec {
   pname = "runc";
-  version = "1.0.3";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "opencontainers";
     repo = "runc";
     rev = "v${version}";
-    sha256 = "sha256-Tl/JKbIpao+FCjngPzaVkxse50zo3XQ9Mg/AdkblMcI=";
+    sha256 = "sha256-svLxxfiRDLWkdRuHXaDyH5Ta6qmptI8z+s41iZKgbWM=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/applications/window-managers/i3/lock-blur.nix b/pkgs/applications/window-managers/i3/lock-blur.nix
index a536a44d452..4018a34b571 100644
--- a/pkgs/applications/window-managers/i3/lock-blur.nix
+++ b/pkgs/applications/window-managers/i3/lock-blur.nix
@@ -1,4 +1,4 @@
-{ i3lock-color, lib, fetchFromGitHub }:
+{ i3lock-color, lib, stdenv, fetchFromGitHub }:
 
 i3lock-color.overrideAttrs (oldAttrs : rec {
   pname = "i3lock-blur";
@@ -17,5 +17,6 @@ i3lock-color.overrideAttrs (oldAttrs : rec {
     license = licenses.bsd3;
     maintainers = with maintainers; [ dan4ik605743 ];
     platforms = platforms.all;
+    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/i3lock-blur.x86_64-darwin
   };
 })
diff --git a/pkgs/applications/window-managers/i3/lock-color.nix b/pkgs/applications/window-managers/i3/lock-color.nix
index 63a49953115..7f08891385b 100644
--- a/pkgs/applications/window-managers/i3/lock-color.nix
+++ b/pkgs/applications/window-managers/i3/lock-color.nix
@@ -56,5 +56,6 @@ stdenv.mkDerivation rec {
     license = licenses.bsd3;
 
     platforms = platforms.all;
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/applications/window-managers/tabbed/default.nix b/pkgs/applications/window-managers/tabbed/default.nix
index 7366ff19695..67097ca151a 100644
--- a/pkgs/applications/window-managers/tabbed/default.nix
+++ b/pkgs/applications/window-managers/tabbed/default.nix
@@ -18,9 +18,9 @@ stdenv.mkDerivation {
 
   buildInputs = [ xorgproto libX11 libXft ];
 
-  makeFlags = [
-    "PREFIX=$(out)"
-  ];
+  makeFlags = [ "CC:=$(CC)" ];
+
+  installFlags = [ "PREFIX=$(out)" ];
 
   meta = with lib; {
     homepage = "https://tools.suckless.org/tabbed";
diff --git a/pkgs/applications/window-managers/wmii-hg/default.nix b/pkgs/applications/window-managers/wmii-hg/default.nix
index d0c35ab7cbb..6759e15ee83 100644
--- a/pkgs/applications/window-managers/wmii-hg/default.nix
+++ b/pkgs/applications/window-managers/wmii-hg/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, unzip, pkg-config, libixp_hg, txt2tags, dash, python, which
+{ lib, stdenv, fetchurl, unzip, pkg-config, libixp_hg, txt2tags, dash, python2, which
 , libX11 , libXrender, libXext, libXinerama, libXrandr, libXft }:
 
 stdenv.mkDerivation rec {
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [ pkg-config unzip ];
-  buildInputs = [ libixp_hg txt2tags dash python which
+  buildInputs = [ libixp_hg txt2tags dash python2 which
                   libX11 libXrender libXext libXinerama libXrandr libXft ];
 
   # For some reason including mercurial in buildInputs did not help
diff --git a/pkgs/build-support/build-dotnet-module/default.nix b/pkgs/build-support/build-dotnet-module/default.nix
index 0a5b17a4a36..49a61f4e5d6 100644
--- a/pkgs/build-support/build-dotnet-module/default.nix
+++ b/pkgs/build-support/build-dotnet-module/default.nix
@@ -224,7 +224,7 @@ let
           "''${dotnetInstallFlags[@]}"  \
           "''${dotnetFlags[@]}"
       done
-    '' + (lib.optionalString packNupkg ''
+    '' + lib.optionalString packNupkg ''
       for project in ''${projectFile[@]}; do
         dotnet pack "$project" \
           -p:ContinuousIntegrationBuild=true \
@@ -235,16 +235,24 @@ let
           "''${dotnetPackFlags[@]}"  \
           "''${dotnetFlags[@]}"
       done
-    '') + (if executables != null then ''
-      for executable in $executables; do
+    '' + ''
+      runHook postInstall
+    '';
+
+    preFixup = ''
+      _wrapDotnetProgram() {
+        makeWrapper "$1" "$out/bin/$(basename "$executable")" \
+          --set DOTNET_ROOT "${dotnet-runtime}" \
+          --suffix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeDeps}" \
+          "''${gappsWrapperArgs[@]}" \
+          "''${makeWrapperArgs[@]}"
+      }
+    '' + (if executables != null then ''
+      for executable in ''${executables[@]}; do
         execPath="$out/lib/${args.pname}/$executable"
 
         if [[ -f "$execPath" && -x "$execPath" ]]; then
-          makeWrapper "$execPath" "$out/bin/$(basename "$executable")" \
-            --set DOTNET_ROOT "${dotnet-runtime}" \
-            --suffix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeDeps}" \
-            "''${gappsWrapperArgs[@]}" \
-            "''${makeWrapperArgs[@]}"
+          _wrapDotnetProgram $execPath
         else
           echo "Specified binary \"$executable\" is either not an executable, or does not exist!"
           exit 1
@@ -253,16 +261,10 @@ let
     '' else ''
       for executable in $out/lib/${args.pname}/*; do
         if [[ -f "$executable" && -x "$executable" && "$executable" != *"dll"* ]]; then
-          makeWrapper "$executable" "$out/bin/$(basename "$executable")" \
-            --set DOTNET_ROOT "${dotnet-runtime}" \
-            --suffix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeDeps}" \
-            "''${gappsWrapperArgs[@]}" \
-            "''${makeWrapperArgs[@]}"
+          _wrapDotnetProgram $executable
         fi
       done
-    '') + ''
-      runHook postInstall
-    '';
+    '');
   });
 in
   package
diff --git a/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix b/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
index ae7151c31c3..e44519a0404 100644
--- a/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
+++ b/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
@@ -71,7 +71,7 @@ let
       "pki"
     ];
   in concatStringsSep "\n  "
-  (map (file: "--ro-bind-try /etc/${file} /etc/${file}") files);
+  (map (file: "--ro-bind-try $(${coreutils}/bin/readlink -f /etc/${file}) /etc/${file}") files);
 
   # Create this on the fly instead of linking from /nix
   # The container might have to modify it and re-run ldconfig if there are
diff --git a/pkgs/build-support/skaware/build-skaware-package.nix b/pkgs/build-support/skaware/build-skaware-package.nix
index 50d83f2ffff..cd651965407 100644
--- a/pkgs/build-support/skaware/build-skaware-package.nix
+++ b/pkgs/build-support/skaware/build-skaware-package.nix
@@ -21,9 +21,9 @@
   # : lines
 , postInstall
   # : list Maintainer
-, maintainers ? []
+, maintainers ? [ ]
   # : passtrhu arguments (e.g. tests)
-, passthru ? {}
+, passthru ? { }
 
 }:
 
@@ -54,7 +54,8 @@ let
     "CONTRIBUTING"
   ];
 
-in stdenv.mkDerivation {
+in
+stdenv.mkDerivation {
   inherit pname version;
 
   src = fetchurl {
@@ -73,8 +74,8 @@ in stdenv.mkDerivation {
     # This might not hold for e.g. BSD.
     "--with-sysdep-devurandom=yes"
     (if stdenv.isDarwin
-      then "--disable-shared"
-      else "--enable-shared")
+    then "--disable-shared"
+    else "--enable-shared")
   ]
     # On darwin, the target triplet from -dumpmachine includes version number,
     # but skarnet.org software uses the triplet to test binary compatibility.
@@ -82,10 +83,12 @@ in stdenv.mkDerivation {
     # binary built on a different version of darwin.
     # http://www.skarnet.org/cgi-bin/archive.cgi?1:mss:623:heiodchokfjdkonfhdph
     ++ (lib.optional stdenv.isDarwin
-         "--build=${stdenv.hostPlatform.system}");
+    "--build=${stdenv.hostPlatform.system}");
 
   inherit postConfigure;
 
+  makeFlags = lib.optional stdenv.cc.isClang [ "AR=${stdenv.cc.targetPrefix}ar" "RANLIB=${stdenv.cc.targetPrefix}ranlib" ];
+
   # TODO(Profpatsch): ensure that there is always a $doc output!
   postInstall = ''
     echo "Cleaning & moving common files"
diff --git a/pkgs/data/fonts/noto-fonts/default.nix b/pkgs/data/fonts/noto-fonts/default.nix
index d6b4488daf0..11f911aeb47 100644
--- a/pkgs/data/fonts/noto-fonts/default.nix
+++ b/pkgs/data/fonts/noto-fonts/default.nix
@@ -3,7 +3,6 @@
 , lib
 , fetchFromGitHub
 , fetchurl
-, fetchzip
 , cairo
 , python3
 , pkg-config
@@ -61,6 +60,42 @@ let
         maintainers = with maintainers; [ mathnerd314 emily ];
       };
     };
+
+  mkNotoCJK = { typeface, version, rev, sha256 }:
+    stdenvNoCC.mkDerivation {
+      pname = "noto-fonts-cjk-${lib.toLower typeface}";
+      inherit version;
+
+      src = fetchFromGitHub {
+        owner = "googlefonts";
+        repo = "noto-cjk";
+        inherit rev sha256;
+      };
+
+      installPhase = ''
+        install -m444 -Dt $out/share/fonts/opentype/noto-cjk ${typeface}/Variable/OTC/*.otf.ttc
+      '';
+
+      meta = with lib; {
+        description = "Beautiful and free fonts for CJK languages";
+        homepage = "https://www.google.com/get/noto/help/cjk/";
+        longDescription = ''
+          Noto ${typeface} CJK is a ${lib.toLower typeface} typeface designed as
+          an intermediate style between the modern and traditional. It is
+          intended to be a multi-purpose digital font for user interface
+          designs, digital content, reading on laptops, mobile devices, and
+          electronic books. Noto ${typeface} CJK comprehensively covers
+          Simplified Chinese, Traditional Chinese, Japanese, and Korean in a
+          unified font family. It supports regional variants of ideographic
+          characters for each of the four languages. In addition, it supports
+          Japanese kana, vertical forms, and variant characters (itaiji); it
+          supports Korean hangeul — both contemporary and archaic.
+        '';
+        license = licenses.ofl;
+        platforms = platforms.all;
+        maintainers = with maintainers; [ mathnerd314 emily ];
+      };
+    };
 in
 
 {
@@ -74,39 +109,18 @@ in
     weights = "{Black,Condensed,Extra,Medium,Semi,Thin}*";
   };
 
-  noto-fonts-cjk = let zip = fetchzip {
-    url = let rev = "be6c059ac1587e556e2412b27f5155c8eb3ddbe6"; in
-      "https://raw.githubusercontent.com/googlefonts/noto-cjk/${rev}/NotoSansCJK.ttc.zip";
-    # __MACOSX...
-    stripRoot = false;
-    sha256 = "0ik4z2b15i0pghskgfm3adzb0h35fr4gyzvz3bq49hhkhn9h85vi";
-  }; in stdenvNoCC.mkDerivation {
-    pname = "noto-fonts-cjk";
-    version = "2.001";
-
-    buildCommand = ''
-      install -m444 -Dt $out/share/fonts/opentype/noto-cjk ${zip}/*.ttc
-    '';
+  noto-fonts-cjk-sans = mkNotoCJK {
+    typeface = "Sans";
+    version = "2.004";
+    rev = "9f7f3c38eab63e1d1fddd8d50937fe4f1eacdb1d";
+    sha256 = "sha256-BX4tcDcz+RGka8mtced1k3BopUJQ14t1BtAVqTjyPik=";
+  };
 
-    meta = with lib; {
-      description = "Beautiful and free fonts for CJK languages";
-      homepage = "https://www.google.com/get/noto/help/cjk/";
-      longDescription =
-      ''
-        Noto Sans CJK is a sans serif typeface designed as an intermediate style
-        between the modern and traditional. It is intended to be a multi-purpose
-        digital font for user interface designs, digital content, reading on laptops,
-        mobile devices, and electronic books. Noto Sans CJK comprehensively covers
-        Simplified Chinese, Traditional Chinese, Japanese, and Korean in a unified font
-        family. It supports regional variants of ideographic characters for each of the
-        four languages. In addition, it supports Japanese kana, vertical forms, and
-        variant characters (itaiji); it supports Korean hangeul — both contemporary and
-        archaic.
-      '';
-      license = licenses.ofl;
-      platforms = platforms.all;
-      maintainers = with maintainers; [ mathnerd314 emily ];
-    };
+  noto-fonts-cjk-serif = mkNotoCJK {
+    typeface = "Serif";
+    version = "2.000";
+    rev = "9f7f3c38eab63e1d1fddd8d50937fe4f1eacdb1d";
+    sha256 = "sha256-BX4tcDcz+RGka8mtced1k3BopUJQ14t1BtAVqTjyPik=";
   };
 
   noto-fonts-emoji = let
diff --git a/pkgs/data/icons/tela-circle-icon-theme/default.nix b/pkgs/data/icons/tela-circle-icon-theme/default.nix
new file mode 100644
index 00000000000..3ed389569bd
--- /dev/null
+++ b/pkgs/data/icons/tela-circle-icon-theme/default.nix
@@ -0,0 +1,65 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, gtk3
+, hicolor-icon-theme
+, jdupes
+, allColorVariants ? false
+, circularFolder ? false
+, colorVariants ? [] # default is standard
+}:
+
+let
+  pname = "tela-circle-icon-theme";
+in
+lib.checkListOfEnum "${pname}: color variants" [ "standard" "black" "blue" "brown" "green" "grey" "orange" "pink" "purple" "red" "yellow" "manjaro" "ubuntu" ] colorVariants
+
+stdenvNoCC.mkDerivation rec {
+  inherit pname;
+  version = "unstable-2021-12-24";
+
+  src = fetchFromGitHub {
+    owner = "vinceliuice";
+    repo = pname;
+    rev = "aa1f1446b6dbc6acfe3ee247e6841369c68e1495";
+    sha256 = "03f79h6kv5vbf92fhpi1wivzvcrfvvdvkhbmy805x4b4wl7qynki";
+  };
+
+  nativeBuildInputs = [
+    gtk3
+    jdupes
+  ];
+
+  propagatedBuildInputs = [
+    hicolor-icon-theme
+  ];
+
+  dontDropIconThemeCache = true;
+
+  # These fixup steps are slow and unnecessary for this package.
+  # Package may installs almost 400 000 small files.
+  dontPatchELF = true;
+  dontRewriteSymlinks = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    patchShebangs install.sh
+
+    ./install.sh -d $out/share/icons \
+      ${lib.optionalString circularFolder "-c"} \
+      ${if allColorVariants then "-a" else builtins.toString colorVariants}
+
+    jdupes -L -r $out/share/icons
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Flat and colorful personality icon theme";
+    homepage = "https://github.com/vinceliuice/Tela-circle-icon-theme";
+    license = licenses.gpl3Only;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ romildo ];
+  };
+}
diff --git a/pkgs/data/misc/hackage/pin.json b/pkgs/data/misc/hackage/pin.json
index 22308a5cf06..489570b0820 100644
--- a/pkgs/data/misc/hackage/pin.json
+++ b/pkgs/data/misc/hackage/pin.json
@@ -1,6 +1,6 @@
 {
-  "commit": "52e5aa39956d0d5a8158320897630fed86ec2ed3",
-  "url": "https://github.com/commercialhaskell/all-cabal-hashes/archive/52e5aa39956d0d5a8158320897630fed86ec2ed3.tar.gz",
-  "sha256": "1yx7v3hscyp1jar0kfsc5pmj8i552j5milqzsair67cl8jf37vwz",
-  "msg": "Update from Hackage at 2022-01-05T00:50:25Z"
+  "commit": "0b85617478c8c03b4db538b5dc1774f9fa5bf41c",
+  "url": "https://github.com/commercialhaskell/all-cabal-hashes/archive/0b85617478c8c03b4db538b5dc1774f9fa5bf41c.tar.gz",
+  "sha256": "1r2w0cysn4x8hzw0989p9cmqvyqkjs4phy8iisphczw30s02zc27",
+  "msg": "Update from Hackage at 2022-01-14T12:47:41Z"
 }
diff --git a/pkgs/data/themes/graphite/default.nix b/pkgs/data/themes/graphite/default.nix
index 42d4c5c7534..7f3ee33c039 100644
--- a/pkgs/data/themes/graphite/default.nix
+++ b/pkgs/data/themes/graphite/default.nix
@@ -15,28 +15,21 @@
 let
   pname = "graphite-gtk-theme";
 
-  throwIfNotSubList = name: given: valid:
-    let
-      unexpected = lib.subtractLists valid given;
-    in
-      lib.throwIfNot (unexpected == [])
-        "${name}: ${builtins.concatStringsSep ", " (builtins.map builtins.toString unexpected)} unexpected; valid ones: ${builtins.concatStringsSep ", " (builtins.map builtins.toString valid)}";
-
 in
-throwIfNotSubList "${pname}: theme variants" themeVariants [ "default" "purple" "pink" "red" "orange" "yellow" "green" "teal" "blue" "all" ]
-throwIfNotSubList "${pname}: color variants" colorVariants [ "standard" "light" "dark" ]
-throwIfNotSubList "${pname}: size variants" sizeVariants [ "standard" "compact" ]
-throwIfNotSubList "${pname}: tweaks" tweaks [ "nord" "black" "midblack" "rimless" "normal" ]
+lib.checkListOfEnum "${pname}: theme variants" [ "default" "purple" "pink" "red" "orange" "yellow" "green" "teal" "blue" "all" ] themeVariants
+lib.checkListOfEnum "${pname}: color variants" [ "standard" "light" "dark" ] colorVariants
+lib.checkListOfEnum "${pname}: size variants" [ "standard" "compact" ] sizeVariants
+lib.checkListOfEnum "${pname}: tweaks" [ "nord" "black" "midblack" "rimless" "normal" ] tweaks
 
 stdenvNoCC.mkDerivation {
   inherit pname;
-  version = "unstable-2022-01-04";
+  version = "unstable-2022-01-07";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
-    rev = "947cac4966377d8f5b5a4e2966ec2b9a6041d205";
-    sha256 = "11pl8hzk4fwniqdib0ffvjilpspr1n5pg1gw39kal13wxh4sdg28";
+    rev = "78e5421fee63b4c2a2a3d2e321538367b01a24ec";
+    sha256 = "1vfvv1gfbr9yr9mz0kb7c7ij6pxcryni1fjs87gn4hpyzns431wk";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/data/themes/lightly-qt/default.nix b/pkgs/data/themes/lightly-qt/default.nix
new file mode 100644
index 00000000000..7b653d95242
--- /dev/null
+++ b/pkgs/data/themes/lightly-qt/default.nix
@@ -0,0 +1,42 @@
+{ mkDerivation
+, lib
+, fetchFromGitHub
+, cmake
+, extra-cmake-modules
+, kdecoration
+, plasma-workspace
+, qtbase
+, qt5
+}:
+
+mkDerivation rec {
+  pname = "lightly-qt";
+  version = "0.4.1";
+
+  src = fetchFromGitHub {
+    owner = "Luwx";
+    repo = "Lightly";
+    rev = "v${version}";
+    sha256 = "0qkjzgjplgwczhk6959iah4ilvazpprv7yb809jy75kkp1jw8mwk";
+  };
+
+  buildInputs = [
+    kdecoration
+    plasma-workspace
+    qtbase
+    qt5.qtx11extras
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+  ];
+
+  meta = with lib; {
+    description = "A fork of breeze theme style that aims to be visually modern and minimalistic";
+    homepage = "https://github.com/Luwx/Lightly";
+    license = licenses.gpl2Plus;
+    maintainers = [ maintainers.pwoelfel ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/data/themes/mojave/default.nix b/pkgs/data/themes/mojave/default.nix
index bf2014344a6..56d7dfcf375 100644
--- a/pkgs/data/themes/mojave/default.nix
+++ b/pkgs/data/themes/mojave/default.nix
@@ -10,24 +10,42 @@
 , optipng
 , sassc
 , which
+, buttonSizeVariants ? [] # default to standard
+, buttonVariants ? [] # default to all
+, colorVariants ? [] # default to all
+, opacityVariants ? [] # default to all
+, themeVariants ? [] # default to MacOS blue
+, wallpapers ? false
 }:
 
-stdenv.mkDerivation rec {
+let
   pname = "mojave-gtk-theme";
-  version = "2021-07-20";
+in
+lib.checkListOfEnum "${pname}: button size variants" [ "standard" "small" ] buttonSizeVariants
+lib.checkListOfEnum "${pname}: button variants" [ "standard" "alt" ] buttonVariants
+lib.checkListOfEnum "${pname}: color variants" [ "light" "dark" ] colorVariants
+lib.checkListOfEnum "${pname}: opacity variants" [ "standard" "solid" ] opacityVariants
+lib.checkListOfEnum "${pname}: theme variants" [ "default" "blue" "purple" "pink" "red" "orange" "yellow" "green" "grey" "all" ] themeVariants
+
+stdenv.mkDerivation rec {
+  inherit pname;
+  version = "unstable-2021-12-20";
 
   srcs = [
     (fetchFromGitHub {
       owner = "vinceliuice";
       repo = pname;
-      rev = version;
-      sha256 = "08j70kmjhvh06c3ahcracarrfq4vpy0zsp6zkcivbw4nf3bzp2zc";
+      rev = "c148646ccab382f7a2d5fdc421fc32d843cb4172";
+      sha256 = "sha256-h4MSSh8cu9M81bM+WJSyl1SQ7CVth1DvjIVOUJXqpxs";
     })
+  ]
+  ++
+  lib.optional wallpapers
     (fetchurl {
       url = "https://github.com/vinceliuice/Mojave-gtk-theme/raw/11741a99d96953daf9c27e44c94ae50a7247c0ed/macOS_Mojave_Wallpapers.tar.xz";
       sha256 = "18zzkwm1kqzsdaj8swf0xby1n65gxnyslpw4lnxcx1rphip0rwf7";
     })
-  ];
+  ;
 
   sourceRoot = "source";
 
@@ -76,9 +94,23 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     runHook preInstall
-    name= ./install.sh --theme all --dest $out/share/themes
-    install -D -t $out/share/wallpapers ../"macOS Mojave Wallpapers"/*
-    jdupes -l -r $out/share
+
+    name= ./install.sh \
+      ${lib.optionalString (buttonSizeVariants != []) "--small " + builtins.toString buttonSizeVariants} \
+      ${lib.optionalString (buttonVariants != []) "--alt " + builtins.toString buttonVariants} \
+      ${lib.optionalString (colorVariants != []) "--color " + builtins.toString colorVariants} \
+      ${lib.optionalString (opacityVariants != []) "--opacity " + builtins.toString opacityVariants} \
+      ${lib.optionalString (themeVariants != []) "--theme " + builtins.toString themeVariants} \
+      --dest $out/share/themes
+
+    ${lib.optionalString wallpapers ''
+      install -D -t $out/share/wallpapers ../"macOS Mojave Wallpapers"/*
+    ''}
+
+    # Replace duplicate files with hardlinks to the first file in each
+    # set of duplicates, reducing the installed size in about 53%
+    jdupes -L -r $out/share
+
     runHook postInstall
   '';
 
diff --git a/pkgs/data/themes/nordic/default.nix b/pkgs/data/themes/nordic/default.nix
index 8d41ce5e38d..a2a518d3f0a 100644
--- a/pkgs/data/themes/nordic/default.nix
+++ b/pkgs/data/themes/nordic/default.nix
@@ -1,77 +1,84 @@
-{ lib, stdenv, fetchFromGitHub, gtk-engine-murrine }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, gtk-engine-murrine
+, jdupes
+}:
 
 stdenv.mkDerivation rec {
   pname = "nordic";
-  version = "2.1.0";
+  version = "unstable-2022-01-08";
 
   srcs = [
     (fetchFromGitHub {
       owner = "EliverLara";
       repo = pname;
-      rev = "0112af91943b8819f7a1af9a508cda7fe3d74051";
-      sha256 = "sha256-ccOA5/jXTx20495NpTgVu7DvsjfTEULqL3IyJ+Pd/ug";
+      rev = "85086324c2a8fa7ca538b85ad0681e03733b2c86";
+      sha256 = "sha256-p1nr71iJZm+2123WF67NkunBX2dR4ruK2Afqd7XdeGc=";
       name = "Nordic";
     })
 
     (fetchFromGitHub {
       owner = "EliverLara";
       repo = pname;
-      rev = "b30d2c844cc6ef5d020308f1c02791de45b607a7";
-      sha256 = "sha256-g5yCCFXzipZLmUat+1r6QWHB7DWQvMKhMexHPV/DJHM";
+      rev = "46c9e6665963ccb54938d7730e520bd8c52f4307";
+      sha256 = "sha256-uFnNLshyKOvzaij7tEKb0fw0j3/GGfzznAf/aaKx7XI=";
       name = "Nordic-standard-buttons";
     })
 
     (fetchFromGitHub {
       owner = "EliverLara";
       repo = pname;
-      rev = "6d38d6af363528f42619f663e3ecd4c08dfd2411";
-      sha256 = "sha256-jaRiSE6yfTltzZ2vr8w4d+YtSz7REOcL7vOOhQvIMlQ";
+      rev = "da5c930386427fce65ea185f164709c8a20e362f";
+      sha256 = "sha256-Ee9ymuMWs2ZgU+8FVLaviGtHMT4Sz5NWLaEGln2Z4V0=";
       name = "Nordic-darker";
     })
 
     (fetchFromGitHub {
       owner = "EliverLara";
       repo = pname;
-      rev = "4142817c14c27b371d42796445bedc84dc94672c";
-      sha256 = "sha256-FAb1+EREcwYrfSxAl6LrPaJtkHMt67NV3bG87g1cFT4";
+      rev = "fd85fb2712ac1192e35c92149b75bfc3c440b1c7";
+      sha256 = "sha256-6WUQBeNq7EKNkYcCt/fUYloue90gxfp8bDYawkQQ6ss=";
       name = "Nordic-darker-standard-buttons";
     })
 
     (fetchFromGitHub {
       owner = "EliverLara";
       repo = pname;
-      rev = "2a91d6f3db70412b0a80ed33546fbe93075627d8";
-      sha256 = "sha256-Su+amS7moc2IDONNvqw3bjL6Q0WLJWzHu6WvfcVDcDY";
+      rev = "259e30ce13566214c7594b038dd2c240648a07a0";
+      sha256 = "sha256-F6hC6XbT9yJl6SW9qJNlwmmBcvOrOS5yPCQALZFhgbM=";
       name = "Nordic-bluish-accent";
     })
 
     (fetchFromGitHub {
       owner = "EliverLara";
       repo = pname;
-      rev = "3ebd334f97d638fdc888b16d69851e3ee31131f2";
-      sha256 = "sha256-h0IXtWcdDvAEVi/1cLZF4Vacdl6VAY+5uo0LGPNe0bg";
+      rev = "2a27051d87558dfa595fb94eff34241d3a1b8c30";
+      sha256 = "sha256-JIld6GVtr1tz02Do2Ft92qtza6iGrPapasd6jmMFG6k=";
       name = "Nordic-bluish-accent-standard-buttons";
     })
 
     (fetchFromGitHub {
       owner = "EliverLara";
       repo = "${pname}-polar";
-      rev = "803926882f8178c72b433466a377aaa33c5b372a";
-      sha256 = "sha256-G7Vu03PoFOEU9uxb5JiHR4Tr8qk47fPo7Gg7Vt9Zzns";
+      rev = "0bea76aed39bb2a2669278b8403c4129aa47be0f";
+      sha256 = "sha256-OXmz6uHXh1zl93sgv5WEwARkEUCr4PRh0/mJyMLXpnk=";
       name = "Nordic-Polar";
     })
 
     (fetchFromGitHub {
       owner = "EliverLara";
       repo = "${pname}-polar";
-      rev = "988cb8a16ece3901b8b0e7a5b86503400491cb1e";
-      sha256 = "sha256-Zx1mrzJm5o4wQwOR8ZU2OEcjD3/6UXwLrBYpMtCkQbg";
+      rev = "8fe52b6c276a7e548e87a558db6734cf9f003b06";
+      sha256 = "sha256-/IxlBvMLAK+mGRyaa7bTv/oZS24nSNeE5GsyJIeN6UU=";
       name = "Nordic-Polar-standard-buttons";
     })
   ];
 
   sourceRoot = ".";
 
+  nativeBuildInputs = [ jdupes ];
+
   propagatedUserEnvPkgs = [ gtk-engine-murrine ];
 
   installPhase = ''
@@ -101,6 +108,10 @@ stdenv.mkDerivation rec {
     mv -v $out/share/themes/Nordic/kde/sddm/* $out/share/sddm/themes/Nordic/
     rm -rf $out/share/themes/Nordic/kde
 
+    # Replace duplicate files with hardlinks to the first file in each
+    # set of duplicates, reducing the installed size in about 65%
+    jdupes -L -r $out/share
+
     runHook postInstall
   '';
 
diff --git a/pkgs/data/themes/sierra/default.nix b/pkgs/data/themes/sierra/default.nix
index d3fbb5fe788..e87f6466141 100644
--- a/pkgs/data/themes/sierra/default.nix
+++ b/pkgs/data/themes/sierra/default.nix
@@ -1,26 +1,67 @@
-{ lib, stdenv, fetchFromGitHub, libxml2, gdk-pixbuf, librsvg, gtk-engine-murrine }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, gdk-pixbuf
+, gtk-engine-murrine
+, jdupes
+, librsvg
+, libxml2
+, buttonVariants ? [] # default to all
+, colorVariants ? [] # default to all
+, opacityVariants ? [] # default to all
+, sizeVariants ? [] # default to all
+}:
 
-stdenv.mkDerivation rec {
+let
   pname = "sierra-gtk-theme";
-  version = "2019-12-16";
+in
+lib.checkListOfEnum "${pname}: button variants" [ "standard" "alt" ] buttonVariants
+lib.checkListOfEnum "${pname}: color variants" [ "light" "dark" ] colorVariants
+lib.checkListOfEnum "${pname}: opacity variants" [ "standard" "solid" ] opacityVariants
+lib.checkListOfEnum "${pname}: size variants" [ "standard" "compact" ] sizeVariants
+
+stdenv.mkDerivation {
+  inherit pname;
+  version = "unstable-2021-05-24";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
-    rev = version;
-    sha256 = "14hlz8kbrjypyd6wyrwmnj2wm9w3kc8y00ms35ard7x8lmhs56hr";
+    rev = "05899001c4fc2fec87c4d222cb3997c414e0affd";
+    sha256 = "174l5mryc34ma1r42pk6572c6i9hmzr9vj1a6w06nqz5qcfm1hds";
   };
 
-  nativeBuildInputs = [ libxml2 ];
+  nativeBuildInputs = [
+    jdupes
+    libxml2
+  ];
 
-  buildInputs = [ gdk-pixbuf librsvg ];
+  buildInputs = [
+    gdk-pixbuf
+    librsvg
+  ];
 
-  propagatedUserEnvPkgs = [ gtk-engine-murrine ];
+  propagatedUserEnvPkgs = [
+    gtk-engine-murrine
+  ];
 
   installPhase = ''
-    patchShebangs .
+    runHook preInstall
+
+    patchShebangs install.sh
+
     mkdir -p $out/share/themes
-    name= ./install.sh --dest $out/share/themes
+    name= ./install.sh --dest $out/share/themes \
+      ${lib.optionalString (buttonVariants != []) "--alt " + builtins.toString buttonVariants} \
+      ${lib.optionalString (colorVariants != []) "--color " + builtins.toString colorVariants} \
+      ${lib.optionalString (opacityVariants != []) "--opacity " + builtins.toString opacityVariants} \
+      ${lib.optionalString (sizeVariants != []) "--flat " + builtins.toString sizeVariants}
+
+    # Replace duplicate files with hardlinks to the first file in each
+    # set of duplicates, reducing the installed size in about 79%
+    jdupes -L -r $out/share
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/desktops/pantheon/apps/elementary-camera/default.nix b/pkgs/desktops/pantheon/apps/elementary-camera/default.nix
index 932b54e82b6..7135795914d 100644
--- a/pkgs/desktops/pantheon/apps/elementary-camera/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-camera/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , pkg-config
 , meson
@@ -34,6 +35,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-xIv+mOlZV58XD0Z6Vc2wA1EQUxT5BaQ0zhYc9v+ne1w=";
   };
 
+  patches = [
+    # Fix build with meson 0.61
+    # https://github.com/elementary/camera/pull/216
+    (fetchpatch {
+      url = "https://github.com/elementary/camera/commit/ead143b7e3246c5fa9bb37c95d491fb07cea9e04.patch";
+      sha256 = "sha256-2zGigUi6DpjJx8SEvAE3Q3jrm7MggOvLc72lAPMPvs4=";
+    })
+  ];
+
   nativeBuildInputs = [
     appstream
     desktop-file-utils
diff --git a/pkgs/desktops/pantheon/apps/elementary-code/default.nix b/pkgs/desktops/pantheon/apps/elementary-code/default.nix
index f83839f6c92..5007e297267 100644
--- a/pkgs/desktops/pantheon/apps/elementary-code/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-code/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , pkg-config
 , meson
@@ -38,6 +39,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-AXmMcPj2hf33G5v3TUg+eZwaKOdVlRvoVXglMJFHRjw=";
   };
 
+  patches = [
+    # Fix build with meson 0.61
+    # https://github.com/elementary/code/pull/1165
+    (fetchpatch {
+      url = "https://github.com/elementary/code/commit/a2607cce3a6b1bb62d02456456d3cbc3c6530bb0.patch";
+      sha256 = "sha256-VKR83IOUYsQhBRlU9JUTlMJtXWv/AyG4wDsjMU2vmU8=";
+    })
+  ];
+
   passthru = {
     updateScript = nix-update-script {
       attrPath = "pantheon.${pname}";
diff --git a/pkgs/desktops/pantheon/apps/elementary-files/default.nix b/pkgs/desktops/pantheon/apps/elementary-files/default.nix
index 21e25bad945..4b829321c37 100644
--- a/pkgs/desktops/pantheon/apps/elementary-files/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-files/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , pkg-config
 , meson
@@ -43,6 +44,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-5TSzV8MQG81aCCR8yiCPhKJaLrp/fwf4mjP32KkcbbY=";
   };
 
+  patches = [
+    # Fix build with meson 0.61
+    # https://github.com/elementary/files/pull/1973
+    (fetchpatch {
+      url = "https://github.com/elementary/files/commit/28428fbda905ece59d3427a3a40e986fdf71a916.patch";
+      sha256 = "sha256-GZTHAH9scQWrBqdrDI14cj57f61HD8o79zFcPCXjKmc=";
+    })
+  ];
+
   nativeBuildInputs = [
     desktop-file-utils
     gettext
diff --git a/pkgs/desktops/pantheon/apps/elementary-mail/default.nix b/pkgs/desktops/pantheon/apps/elementary-mail/default.nix
index 90058633e90..58be49ab4be 100644
--- a/pkgs/desktops/pantheon/apps/elementary-mail/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-mail/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , pkg-config
 , meson
@@ -34,6 +35,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-wOu9jvvwG53vzcNa38nk4eREZWW7Cin8el4qApQ8gI8=";
   };
 
+  patches = [
+    # Fix build with meson 0.61
+    # https://github.com/elementary/mail/pull/751
+    (fetchpatch {
+      url = "https://github.com/elementary/mail/commit/bbadc56529276d8e0ff98e9df7d9bb1bf8fc5783.patch";
+      sha256 = "sha256-lJEnX5/G6e8PdKy1XGlwFIoCeSy6SR5p68tS4noj+44=";
+    })
+  ];
+
   nativeBuildInputs = [
     appstream
     desktop-file-utils
diff --git a/pkgs/desktops/pantheon/apps/elementary-music/default.nix b/pkgs/desktops/pantheon/apps/elementary-music/default.nix
index bee11ed055b..cceeeabf15f 100644
--- a/pkgs/desktops/pantheon/apps/elementary-music/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-music/default.nix
@@ -50,6 +50,12 @@ stdenv.mkDerivation rec {
       url = "https://github.com/elementary/music/commit/aea97103d59afd213467403a48788e476e47c4c3.patch";
       sha256 = "1ayj8l6lb19hhl9bhsdfbq7jgchfmpjx0qkljnld90czcksn95yx";
     })
+    # Fix build with meson 0.61
+    # https://github.com/elementary/music/pull/674
+    (fetchpatch {
+      url = "https://github.com/elementary/music/commit/fb3d840049c1e2e0bf8fdddea378a2db647dd096.patch";
+      sha256 = "sha256-tQZv7hZExLqbkGXahZxDfg7bkgwCKYbDholC2zuwlNw=";
+    })
   ];
 
   passthru = {
diff --git a/pkgs/desktops/pantheon/apps/elementary-screenshot/default.nix b/pkgs/desktops/pantheon/apps/elementary-screenshot/default.nix
index 176c2919be0..9e65a562875 100644
--- a/pkgs/desktops/pantheon/apps/elementary-screenshot/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-screenshot/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , pkg-config
 , meson
@@ -28,6 +29,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-n+L08C/W5YnHZ5P3F1NGUYE2SH94sc4+kr1x+wXZ+cw=";
   };
 
+  patches = [
+    # Fix build with meson 0.61
+    # https://github.com/elementary/screenshot/pull/241
+    (fetchpatch {
+      url = "https://github.com/elementary/screenshot/commit/80a5d942e813dd098e1ef0f6629b81d2ccef05ae.patch";
+      sha256 = "sha256-jOQuzUJvsjqytplLcW9BeIxzi9+/k2GFa4hHVZ3+wts=";
+    })
+  ];
+
   nativeBuildInputs = [
     desktop-file-utils
     meson
diff --git a/pkgs/desktops/pantheon/apps/elementary-terminal/default.nix b/pkgs/desktops/pantheon/apps/elementary-terminal/default.nix
index 4840f69e7cb..f3402299ff7 100644
--- a/pkgs/desktops/pantheon/apps/elementary-terminal/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-terminal/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , pkg-config
 , meson
@@ -32,6 +33,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-4q7YQ4LxuiM/TRae1cc3ncmw7QwE1soC2Sh+GZ+Gpq0=";
   };
 
+  patches = [
+    # Fix build with meson 0.61
+    # https://github.com/elementary/terminal/pull/649
+    (fetchpatch {
+      url = "https://github.com/elementary/terminal/commit/15e3ace08cb25e53941249fa1ee680a1e2f871b4.patch";
+      sha256 = "sha256-XVs+kq5qbX5KlxtkqxwJnatNYNeJiVLBec7sLjQsUxg=";
+    })
+  ];
+
   nativeBuildInputs = [
     appstream
     desktop-file-utils
diff --git a/pkgs/desktops/pantheon/apps/switchboard/default.nix b/pkgs/desktops/pantheon/apps/switchboard/default.nix
index c8e6f11f111..50a3317d6e0 100644
--- a/pkgs/desktops/pantheon/apps/switchboard/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard/default.nix
@@ -60,6 +60,12 @@ stdenv.mkDerivation rec {
       url = "https://github.com/elementary/switchboard/commit/8d6b5f4cbbaf134880252afbf1e25d70033e6402.patch";
       sha256 = "0gwq3wwj45jrnlhsmxfclbjw6xjr8kf6pp3a84vbnrazw76lg5nc";
     })
+    # Fix build with meson 0.61
+    # https://github.com/elementary/switchboard/pull/226
+    (fetchpatch {
+      url = "https://github.com/elementary/switchboard/commit/ecf2a6c42122946cc84150f6927ef69c1f67c909.patch";
+      sha256 = "sha256-J62tMeDfOpliBLHMSa3uBGTc0RBNzC6eDjDBDYySL+0=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix b/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix
index 25bce374c23..72df609c5a4 100644
--- a/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix
+++ b/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , linkFarm
 , substituteAll
@@ -90,6 +91,12 @@ stdenv.mkDerivation rec {
       src = ./hardcode-fallback-background.patch;
       default_wallpaper = "${nixos-artwork.wallpapers.simple-dark-gray.gnomeFilePath}";
     })
+    # Fix build with meson 0.61
+    # https://github.com/elementary/greeter/pull/590
+    (fetchpatch {
+      url = "https://github.com/elementary/greeter/commit/a4b25244058fce794a9f13f6b22a8ff7735ebde9.patch";
+      sha256 = "sha256-qPXhdvmYG8YMDU/CjbEkfZ0glgRzxnu0TsOPtvWHxLY=";
+    })
   ];
 
   preFixup = ''
diff --git a/pkgs/desktops/pantheon/desktop/elementary-shortcut-overlay/default.nix b/pkgs/desktops/pantheon/desktop/elementary-shortcut-overlay/default.nix
index fbde187ce6d..1d4a1cb7414 100644
--- a/pkgs/desktops/pantheon/desktop/elementary-shortcut-overlay/default.nix
+++ b/pkgs/desktops/pantheon/desktop/elementary-shortcut-overlay/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , pkg-config
 , meson
@@ -21,15 +22,22 @@ stdenv.mkDerivation rec {
   pname = "elementary-shortcut-overlay";
   version = "1.2.1";
 
-  repoName = "shortcut-overlay";
-
   src = fetchFromGitHub {
     owner = "elementary";
-    repo = repoName;
+    repo = "shortcut-overlay";
     rev = version;
     sha256 = "sha256-qmqzGCM3cVM6y80pzjm5CCyG6BO6XlKZiODAAEnwVrM=";
   };
 
+  patches = [
+    # Fix build with meson 0.61
+    # https://github.com/elementary/shortcut-overlay/pull/113
+    (fetchpatch {
+      url = "https://github.com/elementary/shortcut-overlay/commit/130f78eb4b7770586ea98ba0a5fdbbf5bb116f3f.patch";
+      sha256 = "sha256-XXWq9CEv3Z2B8ogcFQAJZCfy19XxNHs3c8NToE2m/aA=";
+    })
+  ];
+
   nativeBuildInputs = [
     desktop-file-utils
     libxml2
diff --git a/pkgs/desktops/pantheon/services/elementary-capnet-assist/default.nix b/pkgs/desktops/pantheon/services/elementary-capnet-assist/default.nix
index ed9919b0b03..588061b22e1 100644
--- a/pkgs/desktops/pantheon/services/elementary-capnet-assist/default.nix
+++ b/pkgs/desktops/pantheon/services/elementary-capnet-assist/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , pkg-config
 , meson
@@ -21,15 +22,22 @@ stdenv.mkDerivation rec {
   pname = "elementary-capnet-assist";
   version = "2.4.0";
 
-  repoName = "capnet-assist";
-
   src = fetchFromGitHub {
     owner = "elementary";
-    repo = repoName;
+    repo = "capnet-assist";
     rev = version;
     sha256 = "sha256-UdkS+w61c8z2TCJyG7YsDb0n0b2LOpFyaHzMbdCJsZI=";
   };
 
+  patches = [
+    # Fix build with meson 0.61
+    # https://github.com/elementary/capnet-assist/pull/76
+    (fetchpatch {
+      url = "https://github.com/elementary/capnet-assist/commit/0e77bf8023ba1b35e3a5badb72c246cabf6552b9.patch";
+      sha256 = "sha256-B/KEs/TCxR+i3uQSRtWxTi2+cu0n6QLcfKCbMCvSsvs=";
+    })
+  ];
+
   nativeBuildInputs = [
     desktop-file-utils
     meson
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-namebar-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-namebar-plugin/default.nix
index 3f749c85b24..ec64a60fb54 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-namebar-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-namebar-plugin/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, pkg-config, fetchFromGitHub, python3, vala_0_40
+{ lib, stdenv, pkg-config, fetchFromGitHub, python3, vala
 , gtk3, libwnck, libxfce4util, xfce4-panel, wafHook, xfce }:
 
 stdenv.mkDerivation rec {
@@ -12,13 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-aKrJzf9rwCyXAJsRIXdBzmJBASuXD5I5kZrp+atx4FA=";
   };
 
-  # Does not build with vala 0.48 or later
-  # Upstream has no activity for a while
-  # libxfce4panel-2.0.vapi:92.3-92.41: error: overriding method `Xfce.PanelPlugin.remote_event' is incompatible
-  # with base method `bool Xfce.PanelPluginProvider.remote_event (string, GLib.Value, uint)': too few parameters.
-  #               public virtual signal bool remote_event (string name, GLib.Value value);
-  #               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-  nativeBuildInputs = [ pkg-config vala_0_40 wafHook python3 ];
+  nativeBuildInputs = [ pkg-config vala wafHook python3 ];
   buildInputs = [ gtk3 libwnck libxfce4util xfce4-panel ];
 
   postPatch = ''
@@ -39,5 +33,12 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     platforms = platforms.linux;
     maintainers = with maintainers; [ volth ] ++ teams.xfce.members;
+    # Does not build with vala 0.48 or later
+    # libxfce4panel-2.0.vapi:92.3-92.41: error: overriding method `Xfce.PanelPlugin.remote_event' is incompatible
+    # with base method `bool Xfce.PanelPluginProvider.remote_event (string, GLib.Value, uint)': too few parameters.
+    #               public virtual signal bool remote_event (string name, GLib.Value value);
+    #               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+    # Upstream has no activity since 20 May 2020
+    broken = true;
   };
 }
diff --git a/pkgs/development/compilers/hip/default.nix b/pkgs/development/compilers/hip/default.nix
index 68c6ea39cf7..62d8f65ff8f 100644
--- a/pkgs/development/compilers/hip/default.nix
+++ b/pkgs/development/compilers/hip/default.nix
@@ -16,7 +16,7 @@
 , makeWrapper
 , numactl
 , perl
-, python
+, python2
 , rocclr
 , rocm-comgr
 , rocm-device-libs
@@ -56,7 +56,7 @@ let
       substituteInPlace bin/hip_embed_pch.sh \
         --replace '$LLVM_DIR/bin/' ""
 
-      sed 's,#!/usr/bin/python,#!${python}/bin/python,' -i hip_prof_gen.py
+      sed 's,#!/usr/bin/python,#!${python2}/bin/python,' -i hip_prof_gen.py
 
       sed -e 's,$ROCM_AGENT_ENUM = "''${ROCM_PATH}/bin/rocm_agent_enumerator";,$ROCM_AGENT_ENUM = "${rocminfo}/bin/rocm_agent_enumerator";,' \
           -e 's,^\($DEVICE_LIB_PATH=\).*$,\1"${rocm-device-libs}/amdgcn/bitcode";,' \
@@ -111,7 +111,7 @@ stdenv.mkDerivation rec {
     sha256 = "WvOuQu/EN81Kwcoc3ZtGlhb996edQJ3OWFsmPuqeNXE=";
   };
 
-  nativeBuildInputs = [ cmake python makeWrapper perl ];
+  nativeBuildInputs = [ cmake python2 makeWrapper perl ];
   buildInputs = [ libxml2 numactl libglvnd libX11 ];
   propagatedBuildInputs = [
     clang
diff --git a/pkgs/development/compilers/intel-graphics-compiler/default.nix b/pkgs/development/compilers/intel-graphics-compiler/default.nix
index 85332a94645..176affd047c 100644
--- a/pkgs/development/compilers/intel-graphics-compiler/default.nix
+++ b/pkgs/development/compilers/intel-graphics-compiler/default.nix
@@ -77,5 +77,6 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     platforms = platforms.all;
     maintainers = with maintainers; [ gloaming ];
+    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/intel-graphics-compiler.x86_64-darwin
   };
 }
diff --git a/pkgs/development/compilers/vala/default.nix b/pkgs/development/compilers/vala/default.nix
index daa9bf49b65..9a1365d0c96 100644
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@@ -15,19 +15,7 @@ let
     # header file isn't available at all, but that patch (./gvc-compat.patch)
     # can be shared between all versions of Vala so far.
     graphvizPatch =
-      let
-        fp = { commit, sha256 }: fetchpatch {
-          url = "https://github.com/openembedded/openembedded-core/raw/${commit}/meta/recipes-devtools/vala/vala/disable-graphviz.patch";
-          inherit sha256;
-        };
-
-      in {
-
-        # NOTE: the openembedded-core project doesn't have a patch for 0.40.12
-        # We've fixed the single merge conflict in the following patch.
-        #     0.40.12: https://github.com/openembedded/openembedded-core/raw/8553c52f174af4c8c433c543f806f5ed5c1ec48c/meta/recipes-devtools/vala/vala/disable-graphviz.patch
-        "0.40" = ./disable-graphviz-0.40.12.patch;
-
+      {
         "0.48" = ./disable-graphviz-0.46.1.patch;
 
         "0.52" = ./disable-graphviz-0.46.1.patch;
@@ -98,19 +86,14 @@ let
   });
 
 in rec {
-  vala_0_40 = generic {
-    version = "0.40.25";
-    sha256 = "1pxpack8rrmywlf47v440hc6rv3vi8q9c6niwqnwikxvb2pwf3w7";
-  };
-
   vala_0_48 = generic {
-    version = "0.48.21";
-    sha256 = "sha256-MFRVrrdo1u2bAYNgtVGC5IsW2xvBY6TluBQg+Y0h2Zg=";
+    version = "0.48.22";
+    sha256 = "sha256-27NHjEvjZvCTFkrGHNOu29zz5EQE2eNkFK4VEk525os=";
   };
 
   vala_0_52 = generic {
-    version = "0.52.9";
-    sha256 = "sha256-HpMH2B4hHxniUB6P5PtN0Z+5J8SEtV/873FOjFFdAHk=";
+    version = "0.52.10";
+    sha256 = "sha256-nCAb+BLZh04hveU/jZwU9lF0ixqBRB/1ySkSJESQEAg=";
   };
 
   vala_0_54 = generic {
diff --git a/pkgs/development/compilers/vala/disable-graphviz-0.40.12.patch b/pkgs/development/compilers/vala/disable-graphviz-0.40.12.patch
deleted file mode 100644
index fdc1eabf513..00000000000
--- a/pkgs/development/compilers/vala/disable-graphviz-0.40.12.patch
+++ /dev/null
@@ -1,208 +0,0 @@
-diff --git i/configure.ac w/configure.ac
-index 694ffd200..915062053 100644
---- i/configure.ac
-+++ w/configure.ac
-@@ -112,34 +112,38 @@ PKG_CHECK_MODULES(GMODULE, gmodule-2.0 >= $GLIB_REQUIRED)
- AC_SUBST(GMODULE_CFLAGS)
- AC_SUBST(GMODULE_LIBS)
- 
--PKG_CHECK_MODULES(LIBGVC, libgvc >= $LIBGVC_REQUIRED)
--AC_MSG_CHECKING([for CGRAPH])
--cgraph_tmp_LIBADD="$LIBADD"
--cgraph_tmp_CFLAGS="$CFLAGS"
--LIBADD="$LIBADD $LIBGVC_LIBS"
--CFLAGS="$CFLAGS $LIBGVC_CFLAGS"
--AC_RUN_IFELSE(
--	[AC_LANG_SOURCE([
--		#include <gvc.h>
--
--		int main(void) {
--			#ifdef WITH_CGRAPH
--				return 0;
--			#else
--				return -1;
--			#endif
--		}
--	])], [
--		AC_MSG_RESULT([yes])
--		VALAFLAGS="$VALAFLAGS -D WITH_CGRAPH"
--		have_cgraph=yes
--	], [
--		AC_MSG_RESULT([no])
--		have_cgraph=no
--	]
--)
--LIBADD="$cgraph_tmp_LIBADD"
--CFLAGS="$cgraph_tmp_CFLAGS"
-+AC_ARG_ENABLE(graphviz, AS_HELP_STRING([--disable-graphviz], [Disable graphviz usage for valadoc]), enable_graphviz=$enableval, enable_graphviz=yes)
-+if test x$enable_graphviz = xyes; then
-+	PKG_CHECK_MODULES(LIBGVC, libgvc >= $LIBGVC_REQUIRED)
-+	AC_MSG_CHECKING([for CGRAPH])
-+	VALAFLAGS="$VALAFLAGS -D HAVE_GRAPHVIZ"
-+	cgraph_tmp_LIBADD="$LIBADD"
-+	cgraph_tmp_CFLAGS="$CFLAGS"
-+	LIBADD="$LIBADD $LIBGVC_LIBS"
-+	CFLAGS="$CFLAGS $LIBGVC_CFLAGS"
-+	AC_RUN_IFELSE(
-+		[AC_LANG_SOURCE([
-+			#include <gvc.h>
-+			int main(void) {
-+				#ifdef WITH_CGRAPH
-+					return 0;
-+				#else
-+					return -1;
-+				#endif
-+			}
-+		])], [
-+			AC_MSG_RESULT([yes])
-+			VALAFLAGS="$VALAFLAGS -D WITH_CGRAPH"
-+			have_cgraph=yes
-+		], [
-+			AC_MSG_RESULT([no])
-+			have_cgraph=no
-+		]
-+	)
-+	LIBADD="$cgraph_tmp_LIBADD"
-+	CFLAGS="$cgraph_tmp_CFLAGS"
-+fi
-+AM_CONDITIONAL(ENABLE_GRAPHVIZ, test x$enable_graphviz = xyes)
- AM_CONDITIONAL(HAVE_CGRAPH, test "$have_cgraph" = "yes")
- 
- AC_PATH_PROG([XSLTPROC], [xsltproc], :)
-diff --git i/libvaladoc/Makefile.am w/libvaladoc/Makefile.am
-index f3f790e76..3c5dc4c80 100644
---- i/libvaladoc/Makefile.am
-+++ w/libvaladoc/Makefile.am
-@@ -128,10 +128,6 @@ libvaladoc_la_VALASOURCES = \
- 	content/tablerow.vala \
- 	content/taglet.vala \
- 	content/text.vala \
--	charts/chart.vala \
--	charts/chartfactory.vala \
--	charts/hierarchychart.vala \
--	charts/simplechartfactory.vala \
- 	parser/manyrule.vala \
- 	parser/oneofrule.vala \
- 	parser/optionalrule.vala \
-@@ -158,13 +154,24 @@ libvaladoc_la_VALASOURCES = \
- 	highlighter/codetoken.vala \
- 	highlighter/highlighter.vala \
- 	html/basicdoclet.vala \
--	html/htmlchartfactory.vala \
- 	html/linkhelper.vala \
- 	html/cssclassresolver.vala \
- 	html/htmlmarkupwriter.vala \
- 	html/htmlrenderer.vala \
- 	$(NULL)
- 
-+if ENABLE_GRAPHVIZ
-+libvaladoc_la_VALASOURCES += \
-+	charts/chart.vala \
-+	charts/chartfactory.vala \
-+	charts/hierarchychart.vala \
-+	charts/simplechartfactory.vala \
-+	html/htmlchartfactory.vala \
-+	$(NULL)
-+
-+LIBGVC_PKG = --vapidir $(top_srcdir)/vapi --pkg libgvc
-+endif
-+
- libvaladoc@PACKAGE_SUFFIX@_la_SOURCES = \
- 	libvaladoc.vala.stamp \
- 	$(libvaladoc_la_VALASOURCES:.vala=.c) \
-@@ -184,11 +191,11 @@ libvaladoc.vala.stamp: $(libvaladoc_la_VALASOURCES)
- 		--library valadoc \
- 		--vapi valadoc@PACKAGE_SUFFIX@.vapi \
- 		--vapidir $(top_srcdir)/vapi --pkg gmodule-2.0 \
--		--vapidir $(top_srcdir)/vapi --pkg libgvc \
- 		--vapidir $(top_srcdir)/gee --pkg gee \
- 		--vapidir $(top_srcdir)/vala --pkg vala \
- 		--vapidir $(top_srcdir)/ccode --pkg ccode \
- 		--vapidir $(top_srcdir)/codegen --pkg codegen \
-+		$(LIBGVC_PKG) \
- 		--pkg config \
- 		$(filter %.vala %.c,$^)
- 	touch $@
-@@ -217,6 +224,9 @@ nodist_pkgconfig_DATA = valadoc@PACKAGE_SUFFIX@.pc
- 
- valadoc@PACKAGE_SUFFIX@.pc: valadoc.pc
- 	cp $< $@
-+if !ENABLE_GRAPHVIZ
-+	sed -i "s/libgvc //g" $@
-+endif
- 
- vapidir = $(datadir)/vala/vapi
- dist_vapi_DATA = valadoc@PACKAGE_SUFFIX@.vapi
-@@ -224,6 +234,9 @@ nodist_vapi_DATA = valadoc@PACKAGE_SUFFIX@.deps
- 
- valadoc@PACKAGE_SUFFIX@.deps: valadoc.deps
- 	cp $< $@
-+if !ENABLE_GRAPHVIZ
-+	sed -i "s/libgvc//g" $@
-+endif
- 
- EXTRA_DIST = \
- 	$(libvaladoc_la_VALASOURCES) \
-diff --git i/libvaladoc/html/basicdoclet.vala w/libvaladoc/html/basicdoclet.vala
-index 192e488cd..ec0960222 100644
---- i/libvaladoc/html/basicdoclet.vala
-+++ w/libvaladoc/html/basicdoclet.vala
-@@ -46,7 +46,11 @@ public abstract class Valadoc.Html.BasicDoclet : Api.Visitor, Doclet {
- 	protected HtmlRenderer _renderer;
- 	protected Html.MarkupWriter writer;
- 	protected Html.CssClassResolver cssresolver;
-+#if HAVE_GRAPHVIZ
- 	protected Charts.Factory image_factory;
-+#else
-+	protected void* image_factory;
-+#endif
- 	protected ErrorReporter reporter;
- 	protected string package_list_link = "../index.html";
- 
-@@ -120,7 +124,9 @@ public abstract class Valadoc.Html.BasicDoclet : Api.Visitor, Doclet {
- 		this.linker = new LinkHelper ();
- 
- 		_renderer = new HtmlRenderer (settings, this.linker, this.cssresolver);
-+#if HAVE_GRAPHVIZ
- 		this.image_factory = new SimpleChartFactory (settings, linker);
-+#endif
- 	}
- 
- 
-@@ -1026,6 +1032,7 @@ public abstract class Valadoc.Html.BasicDoclet : Api.Visitor, Doclet {
- 	}
- 
- 	protected void write_image_block (Api.Node element) {
-+#if HAVE_GRAPHVIZ
- 		if (element is Class || element is Interface || element is Struct) {
- 			unowned string format = (settings.use_svg_images ? "svg" : "png");
- 			var chart = new Charts.Hierarchy (image_factory, element);
-@@ -1045,6 +1052,7 @@ public abstract class Valadoc.Html.BasicDoclet : Api.Visitor, Doclet {
- 									   this.get_img_path_html (element, format)});
- 			writer.add_usemap (chart);
- 		}
-+#endif
- 	}
- 
- 	public void write_namespace_content (Namespace node, Api.Node? parent) {
-diff --git i/libvaladoc/html/htmlmarkupwriter.vala w/libvaladoc/html/htmlmarkupwriter.vala
-index dcc4dad76..cf9c860b8 100644
---- i/libvaladoc/html/htmlmarkupwriter.vala
-+++ w/libvaladoc/html/htmlmarkupwriter.vala
-@@ -51,12 +51,16 @@ public class Valadoc.Html.MarkupWriter : Valadoc.MarkupWriter {
- 		}
- 	}
- 
-+#if HAVE_GRAPHVIZ
- 	public MarkupWriter add_usemap (Charts.Chart chart) {
- 		string? buf = (string?) chart.write_buffer ("cmapx");
- 		if (buf != null) {
- 			raw_text ("\n");
- 			raw_text ((!) buf);
- 		}
-+#else
-+	public MarkupWriter add_usemap (void* chart) {
-+#endif
- 
- 		return this;
- 	}
diff --git a/pkgs/development/compilers/zulu/default.nix b/pkgs/development/compilers/zulu/default.nix
index dee1a452760..662d997d882 100644
--- a/pkgs/development/compilers/zulu/default.nix
+++ b/pkgs/development/compilers/zulu/default.nix
@@ -22,11 +22,11 @@
 }:
 
 let
-  version = "11.50.19";
-  openjdk = "11.0.12";
+  version = "11.52.13";
+  openjdk = "11.0.13";
 
-  sha256_linux = "b8e8a63b79bc312aa90f3558edbea59e71495ef1a9c340e38900dd28a1c579f3";
-  sha256_darwin = "9bc6874932f7f88d0a48220d3200449ddf7dc5c0e82af2df2738bc13d21b0e4e";
+  sha256_linux = "77a126669b26b3a89e0117b0f28cddfcd24fcd7699b2c1d35f921487148b9a9f";
+  sha256_darwin = "a96f9f859350f977319ebb5c2a999c182ab6b99b24c60e19d97c54367868a63e";
 
   platform = if stdenv.isDarwin then "macosx" else "linux";
   hash = if stdenv.isDarwin then sha256_darwin else sha256_linux;
diff --git a/pkgs/development/gnuradio-modules/grnet/default.nix b/pkgs/development/gnuradio-modules/grnet/default.nix
index 568e63a77b8..6e8b72a6565 100644
--- a/pkgs/development/gnuradio-modules/grnet/default.nix
+++ b/pkgs/development/gnuradio-modules/grnet/default.nix
@@ -52,6 +52,7 @@ mkDerivation {
   pname = "gr-grnet";
   version = version.name;
   inherit src;
+  disabledForGRafter = "3.10";
 
   buildInputs = [
     boost
diff --git a/pkgs/development/gnuradio-modules/limesdr/default.nix b/pkgs/development/gnuradio-modules/limesdr/default.nix
index f26e4695a10..48bbc68c80a 100644
--- a/pkgs/development/gnuradio-modules/limesdr/default.nix
+++ b/pkgs/development/gnuradio-modules/limesdr/default.nix
@@ -20,7 +20,6 @@ let
   version = {
     "3.7" = "2.0.0";
     "3.8" = "3.0.1";
-    "3.9" = null;
   }.${gnuradio.versionAttr.major};
   src = fetchFromGitHub {
     owner = "myriadrf";
@@ -29,7 +28,6 @@ let
     sha256 = {
       "3.7" = "0ldqvfwl0gil89l9s31fjf9d7ki0dk572i8vna336igfaz348ypq";
       "3.8" = "ffs+8TU0yr6IW1xZJ/abQ1CQWGZM+zYqPRJxy3ZvM9U=";
-      "3.9" = null;
     }.${gnuradio.versionAttr.major};
   };
 in mkDerivation {
diff --git a/pkgs/development/gnuradio-modules/osmosdr/default.nix b/pkgs/development/gnuradio-modules/osmosdr/default.nix
index ebb34afee10..326a2b9d9bd 100644
--- a/pkgs/development/gnuradio-modules/osmosdr/default.nix
+++ b/pkgs/development/gnuradio-modules/osmosdr/default.nix
@@ -24,16 +24,14 @@
 let
   version = {
     "3.7" = "0.1.5";
-    "3.8" = "0.2.2";
-    "3.9" = null;
+    "3.8" = "0.2.3";
   }.${gnuradio.versionAttr.major};
   src = fetchgit {
     url = "git://git.osmocom.org/gr-osmosdr";
     rev = "v${version}";
     sha256 = {
       "3.7" = "0bf9bnc1c3c4yqqqgmg3nhygj6rcfmyk6pybi27f7461d2cw1drv";
-      "3.8" = "HT6xlN6cJAnvF+s1g2I1uENhBJJizdADlLXeSD0rEqs=";
-      "3.9" = null;
+      "3.8" = "sha256-ZfI8MshhZOdJ1U5FlnZKXsg2Rsvb6oKg943ZVYd/IWo=";
     }.${gnuradio.versionAttr.major};
   };
 in mkDerivation {
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index f5dcc06cc17..1b765bee00b 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -181,7 +181,8 @@ self: super: {
   # base bound
   digit = doJailbreak super.digit;
 
-  hnix = generateOptparseApplicativeCompletion "hnix"
+  # hnix.patch needed until the next release is bumped
+  hnix = appendPatch ./patches/hnix.patch (generateOptparseApplicativeCompletion "hnix"
     (overrideCabal (drv: {
       # 2020-06-05: HACK: does not pass own build suite - `dontCheck`
       doCheck = false;
@@ -189,7 +190,7 @@ self: super: {
       # needs newer version of relude and semialign than stackage has
       relude = self.relude_1_0_0_1;
       semialign = self.semialign_1_2_0_1;
-    }));
+    })));
 
   # Fails for non-obvious reasons while attempting to use doctest.
   focuslist = dontCheck super.focuslist;
@@ -1185,7 +1186,6 @@ self: super: {
   # The test suite depends on an impure cabal-install installation in
   # $HOME, which we don't have in our build sandbox.
   cabal-install-parsers = dontCheck super.cabal-install-parsers;
-  cabal-install-parsers_0_4_2 = dontCheck super.cabal-install-parsers_0_4_2;
 
   # 2021-08-18: Erroneously  claims that it needs a newer HStringTemplate (>= 0.8.8) than stackage.
   gitit = doJailbreak super.gitit;
@@ -1522,7 +1522,10 @@ self: super: {
   # Upstream issue: https://github.com/haskell-servant/servant-swagger/issues/129
   servant-swagger = dontCheck super.servant-swagger;
 
-  hercules-ci-agent = generateOptparseApplicativeCompletion "hercules-ci-agent" super.hercules-ci-agent;
+  # substituteInPlace: https://github.com/hercules-ci/hercules-ci-agent/issues/363
+  hercules-ci-agent = overrideCabal { preConfigure = ''
+    substituteInPlace hercules-ci-agent/Hercules/Agent/Cachix/Init.hs --replace "Cachix.Client.Env" "Cachix.Client.Version"
+  ''; } (generateOptparseApplicativeCompletion "hercules-ci-agent" super.hercules-ci-agent);
 
   hercules-ci-cli = pkgs.lib.pipe super.hercules-ci-cli [
     unmarkBroken
@@ -1862,29 +1865,22 @@ self: super: {
   # 2021-05-09: Restrictive bound on hspec-golden. Dep removed in newer versions.
   tomland = assert super.tomland.version == "1.3.2.0"; doJailbreak super.tomland;
 
-  # 2021-05-09 haskell-ci pins ShellCheck 0.7.1
-  # https://github.com/haskell-CI/haskell-ci/issues/507
-  # 2021-09-05 haskell-ci needs Cabal 3.4,
-  # cabal-install-parsers uses Cabal 3.6 since 0.4.3
-  haskell-ci = super.haskell-ci.override {
-    ShellCheck = self.ShellCheck_0_7_1;
-    cabal-install-parsers = self.cabal-install-parsers_0_4_2;
-  };
+  # 2022-01-16 haskell-ci needs Cabal 3.6,
+  haskell-ci = super.haskell-ci.overrideScope (self: super: {
+    attoparsec = self.attoparsec_0_14_4;
+    Cabal = self.Cabal_3_6_2_0;
+  });
 
-  # Build haskell-ci from git repository, including some useful fixes,
-  # e. g. required for generating the workflows for the cabal2nix repository
-  haskell-ci-unstable = (overrideSrc rec {
-    version = "0.13.20211116-${builtins.substring 0 7 src.rev}";
+  # Build haskell-ci from git repository
+  haskell-ci-unstable = overrideSrc rec {
+    version = "0.14.1-${builtins.substring 0 7 src.rev}";
     src = pkgs.fetchFromGitHub {
       owner = "haskell-CI";
       repo = "haskell-ci";
-      rev = "b61df11e7f6010ce09920c231321ab1545a990b5";
-      sha256 = "0v6mqpavz5v161milq6a3x9gzap0pgksd3h4rwi2s3f9b15sczcy";
+      rev = "8311a999b8e8be3aa31f65f314def256aa2d5535";
+      sha256 = "169jaqm4xs2almmvqsk567wayxs0g6kn0l5877c03hzr3d9ykrav";
     };
-  } super.haskell-ci).overrideScope (self: super: {
-    attoparsec = self.attoparsec_0_14_3;
-    Cabal = self.Cabal_3_6_2_0;
-  });
+  } self.haskell-ci;
 
   Frames-streamly = super.Frames-streamly.override {
     relude = super.relude_1_0_0_1;
diff --git a/pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix b/pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix
index ec551565930..ac0364e0c76 100644
--- a/pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix
@@ -49,11 +49,6 @@ self: super: {
   # cabal-install-parsers is written for Cabal 3.6
   cabal-install-parsers = super.cabal-install-parsers.override { Cabal = super.Cabal_3_6_2_0; };
 
-  # older version of cabal-install-parsers for reverse dependencies that use Cabal 3.4
-  cabal-install-parsers_0_4_2 = super.cabal-install-parsers_0_4_2.override {
-    Cabal = self.Cabal_3_4_1_0;
-  };
-
   # Jailbreak to fix the build.
   base-noprelude = doJailbreak super.base-noprelude;
   system-fileio = doJailbreak super.system-fileio;
diff --git a/pkgs/development/haskell-modules/configuration-ghc-9.2.x.nix b/pkgs/development/haskell-modules/configuration-ghc-9.2.x.nix
index 1082f792e83..1a0589ce740 100644
--- a/pkgs/development/haskell-modules/configuration-ghc-9.2.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-9.2.x.nix
@@ -83,7 +83,7 @@ self: super: {
   # Jailbreaks & Version Updates
   assoc = doJailbreak super.assoc;
   async = doJailbreak super.async;
-  attoparsec = super.attoparsec_0_14_3;
+  attoparsec = super.attoparsec_0_14_4;
   base64-bytestring = doJailbreak super.base64-bytestring;
   base-compat = self.base-compat_0_12_1;
   base-compat-batteries = self.base-compat-batteries_0_12_1;
@@ -102,23 +102,23 @@ self: super: {
   genvalidity-hspec = self.genvalidity-hspec_1_0_0_0;
   ghc-byteorder = doJailbreak super.ghc-byteorder;
   ghc-exactprint = overrideCabal (drv: {
-    # HACK: ghc-exactprint 1.3.0 is not buildable for GHC < 9.2,
+    # HACK: ghc-exactprint 1.4.1 is not buildable for GHC < 9.2,
     # but hackage2nix evaluates the cabal file with GHC 8.10.*,
     # causing the build-depends to be skipped. Since the dependency
     # list hasn't changed much since 0.6.4, we can just reuse the
     # normal expression.
-    inherit (self.ghc-exactprint_1_3_0) src version;
+    inherit (self.ghc-exactprint_1_4_1) src version;
     revision = null; editedCabalFile = null;
     libraryHaskellDepends = [
       self.fail
       self.ordered-containers
     ] ++ drv.libraryHaskellDepends or [];
   }) super.ghc-exactprint;
-  ghc-lib = self.ghc-lib_9_2_1_20211101;
-  ghc-lib-parser = self.ghc-lib-parser_9_2_1_20211101;
+  ghc-lib = self.ghc-lib_9_2_1_20220109;
+  ghc-lib-parser = self.ghc-lib-parser_9_2_1_20220109;
   ghc-lib-parser-ex = self.ghc-lib-parser-ex_9_2_0_1;
   hackage-security = doJailbreak super.hackage-security;
-  hashable = super.hashable_1_4_0_1;
+  hashable = super.hashable_1_4_0_2;
   hashable-time = doJailbreak super.hashable-time_0_3;
   hedgehog = doJailbreak super.hedgehog;
   HTTP = overrideCabal (drv: { postPatch = "sed -i -e 's,! Socket,!Socket,' Network/TCP.hs"; }) (doJailbreak super.HTTP);
@@ -131,13 +131,13 @@ self: super: {
   ormolu = self.ormolu_0_4_0_0;
   OneTuple = super.OneTuple_0_3_1;
   parallel = doJailbreak super.parallel;
-  path = doJailbreak super.path_0_9_1;
+  path = doJailbreak super.path_0_9_2;
   polyparse = overrideCabal (drv: { postPatch = "sed -i -e 's, <0.11, <0.12,' polyparse.cabal"; }) (doJailbreak super.polyparse);
   primitive = doJailbreak super.primitive;
   quickcheck-instances = super.quickcheck-instances_0_3_27;
   regex-posix = doJailbreak super.regex-posix;
   resolv = doJailbreak super.resolv;
-  retrie = doDistribute self.retrie_1_2_0_0;
+  retrie = doDistribute self.retrie_1_2_0_1;
   semialign = super.semialign_1_2_0_1;
   singleton-bool = doJailbreak super.singleton-bool;
   scientific = doJailbreak super.scientific;
@@ -234,7 +234,7 @@ self: super: {
         sha256 = "0hpp3iw7m7w2abr8vb86gdz3x6c8lj119zxln933k90ia7bmk8jc";
       };
     } (super.hlint_3_3_6.overrideScope (self: super: {
-      ghc-lib-parser = self.ghc-lib-parser_9_2_1_20211101;
+      ghc-lib-parser = self.ghc-lib-parser_9_2_1_20220109;
       ghc-lib-parser-ex = self.ghc-lib-parser-ex_9_2_0_1;
     }))
   );
diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml
index 0919e167505..dc3670fa2c5 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml
@@ -455,6 +455,7 @@ broken-packages:
   - brick-dropdownmenu
   - bricks-internal
   - brillig
+  - broadcast-chan-tests
   - broccoli
   - brok
   - broker-haskell
@@ -571,6 +572,7 @@ broken-packages:
   - capnp
   - capped-list
   - capri
+  - captcha-core
   - caramia
   - carbonara
   - cardano-coin-selection
@@ -3881,6 +3883,7 @@ broken-packages:
   - pretty-ncols
   - prettyprinter-vty
   - prim-array
+  - primecount
   - primes-type
   - prim-instances
   - PrimitiveArray-Pretty
@@ -4452,6 +4455,8 @@ broken-packages:
   - show-prettyprint
   - Shpadoinkle-backend-pardiff
   - Shpadoinkle-backend-snabbdom
+  - Shpadoinkle-backend-static
+  - Shpadoinkle-html
   - Shpadoinkle-isreal
   - Shpadoinkle-streaming
   - Shpadoinkle-template
@@ -4852,6 +4857,7 @@ broken-packages:
   - tagsoup-selection
   - tai
   - tai64
+  - tailwind
   - takahashi
   - Takusen
   - takusen-oracle
diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
index cdb939f1e2b..4477e2f190a 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
@@ -158,8 +158,6 @@ extra-packages:
   - resolv == 0.1.1.2                   # required to build cabal-install-3.0.0.0 with pre ghc-8.8.x
   - sbv == 7.13                         # required for pkgs.petrinizer
   - crackNum < 3.0                      # 2021-05-21: 3.0 removed the lib which sbv 7.13 uses
-  - ShellCheck == 0.7.1                 # 2021-05-09: haskell-ci 0.12.1 pins this version
-  - cabal-install-parsers == 0.4.2      # 2021-09-04: needed haskell-ci by until it upgrades to Cabal >= 3.6
   - ghc-api-compat == 8.6               # 2021-09-07: preserve for GHC 8.8.4
   - ghc-lib == 9.0.*                    # 2021-11-05: Need one GHC 9.0.2 compatible version
   - ghc-lib-parser == 9.0.*             # 2021-11-05: Need one GHC 9.0.2 compatible version
@@ -623,3 +621,6 @@ dont-distribute-packages:
   - webkitgtk3
   - webkitgtk3-javascriptcore
   - websnap
+
+  # glade relies on system libglade which is deprecated
+  - glade
diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml
index 1f42d38134d..fa48b18c71d 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml
@@ -618,6 +618,8 @@ dont-distribute-packages:
  - bricks-parsec
  - bricks-rendering
  - bricks-syntax
+ - broadcast-chan-conduit
+ - broadcast-chan-pipes
  - bronyradiogermany-streaming
  - brotli-conduit
  - brotli-streams
@@ -659,6 +661,8 @@ dont-distribute-packages:
  - canteven-http
  - cao
  - cap
+ - captcha-2captcha
+ - captcha-capmonster
  - car-pool
  - carboncopy
  - cartel
@@ -827,6 +831,8 @@ dont-distribute-packages:
  - copilot-language
  - copilot-libraries
  - copilot-theorem
+ - core-webserver-servant
+ - core-webserver-warp
  - coroutine-enumerator
  - coroutine-iteratee
  - couch-simple
@@ -1186,7 +1192,7 @@ dont-distribute-packages:
  - funnyprint
  - funsat
  - fused-effects-squeal
- - futhark_0_21_2
+ - futhark_0_21_4
  - fwgl-glfw
  - fwgl-javascript
  - fxpak
@@ -1652,6 +1658,7 @@ dont-distribute-packages:
  - hsfacter
  - hslogstash
  - hspec-expectations-pretty
+ - hspec-expectations-pretty-diff_0_7_2_6
  - hspec-pg-transact
  - hspec-setup
  - hspec-shouldbe
@@ -1810,6 +1817,7 @@ dont-distribute-packages:
  - ivy-web
  - iyql
  - j2hs
+ - jacinda
  - jail
  - java-bridge-extras
  - java-character
@@ -1890,6 +1898,7 @@ dont-distribute-packages:
  - knead-arithmetic
  - knit-haskell
  - knots
+ - koji-tool
  - korfu
  - ks-test
  - kurita
@@ -2161,6 +2170,7 @@ dont-distribute-packages:
  - mprover
  - mps
  - mptcp
+ - mptcpanalyzer
  - msgpack-aeson
  - msgpack-idl
  - msgpack-rpc
@@ -2295,7 +2305,7 @@ dont-distribute-packages:
  - pairing
  - panda
  - pandoc-japanese-filters
- - pandoc_2_16_2
+ - pandoc_2_17
  - papa
  - papa-base
  - papa-base-implement
@@ -2443,6 +2453,7 @@ dont-distribute-packages:
  - proto3-suite
  - protobuf-native
  - protocol-buffers-descriptor-fork
+ - psql
  - puffytools
  - pugs-compat
  - pugs-hsregex
diff --git a/pkgs/development/haskell-modules/configuration-nix.nix b/pkgs/development/haskell-modules/configuration-nix.nix
index 86a60fd9097..4198cf11c22 100644
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -818,6 +818,12 @@ self: super: builtins.intersectAttrs super {
     platforms = pkgs.lib.platforms.x86;
   } super.geomancy;
 
+  hlint = overrideCabal (drv: {
+    postInstall = ''
+      install -Dm644 data/hlint.1 -t "$out/share/man/man1"
+    '' + drv.postInstall or "";
+  }) super.hlint;
+
   hls-brittany-plugin = overrideCabal (drv: {
     testToolDepends = [ pkgs.git ];
     preCheck = ''
diff --git a/pkgs/development/haskell-modules/hackage-packages.nix b/pkgs/development/haskell-modules/hackage-packages.nix
index b94e9d070b8..10f2f447a06 100644
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
@@ -2818,6 +2818,8 @@ self: {
        pname = "Cabal";
        version = "3.6.2.0";
        sha256 = "0hmw2wkypd42qyyfi6rhbsxmymbxg9rrw683yg39627vlw33v44y";
+       revision = "1";
+       editedCabalFile = "1s79dmxxzyczldakjcwg7jqxhhfw724fwbjh7s656cynxnalq85f";
        setupHaskellDepends = [ mtl parsec ];
        libraryHaskellDepends = [
          array base binary bytestring containers deepseq directory filepath
@@ -10824,8 +10826,8 @@ self: {
        pname = "HsOpenSSL";
        version = "0.11.7.2";
        sha256 = "0ysdfl8ck3nzhx597fa13dqf31jq5gzwajlak6r91jajks9w0dl5";
-       revision = "1";
-       editedCabalFile = "1lccw8x48xxmw1cpd260fdr9mxqr39f4b623i78027l0m93dw38b";
+       revision = "2";
+       editedCabalFile = "1wqk9mnzxwphiza6lwg526nvr6mzbwv0l22kwbsd2r9vv1gix1rk";
        setupHaskellDepends = [ base Cabal ];
        libraryHaskellDepends = [ base bytestring network time ];
        librarySystemDepends = [ openssl ];
@@ -11221,6 +11223,25 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "IPv6Addr_2_0_4" = callPackage
+    ({ mkDerivation, aeson, attoparsec, base, HUnit, iproute, network
+     , network-info, random, test-framework, test-framework-hunit, text
+     }:
+     mkDerivation {
+       pname = "IPv6Addr";
+       version = "2.0.4";
+       sha256 = "1d20cfnxvahcnr8iq71ymyykfl6cgxzl5i6vmdl7ill2bj07xy08";
+       libraryHaskellDepends = [
+         aeson attoparsec base iproute network network-info random text
+       ];
+       testHaskellDepends = [
+         base HUnit test-framework test-framework-hunit text
+       ];
+       description = "Library to deal with IPv6 address text representations";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "IPv6DB" = callPackage
     ({ mkDerivation, aeson, attoparsec, base, bytestring, fast-logger
      , hedis, hspec, http-client, http-types, IPv6Addr, mtl
@@ -18339,34 +18360,6 @@ self: {
        broken = true;
      }) {};
 
-  "ShellCheck_0_7_1" = callPackage
-    ({ mkDerivation, aeson, array, base, bytestring, containers
-     , deepseq, Diff, directory, filepath, mtl, parsec, process
-     , QuickCheck, regex-tdfa
-     }:
-     mkDerivation {
-       pname = "ShellCheck";
-       version = "0.7.1";
-       sha256 = "06m4wh891nah3y0br4wh3adpsb16zawkb2ijgf1vcz61fznj6ps1";
-       isLibrary = true;
-       isExecutable = true;
-       libraryHaskellDepends = [
-         aeson array base bytestring containers deepseq Diff directory
-         filepath mtl parsec process QuickCheck regex-tdfa
-       ];
-       executableHaskellDepends = [
-         aeson array base bytestring containers deepseq Diff directory
-         filepath mtl parsec QuickCheck regex-tdfa
-       ];
-       testHaskellDepends = [
-         aeson array base bytestring containers deepseq Diff directory
-         filepath mtl parsec QuickCheck regex-tdfa
-       ];
-       description = "Shell script analysis tool";
-       license = lib.licenses.gpl3Only;
-       hydraPlatforms = lib.platforms.none;
-     }) {};
-
   "ShellCheck" = callPackage
     ({ mkDerivation, aeson, array, base, bytestring, containers
      , deepseq, Diff, directory, filepath, mtl, parsec, process
@@ -18588,6 +18581,8 @@ self: {
        libraryHaskellDepends = [ base compactable Shpadoinkle text ];
        description = "A backend for rendering Shpadoinkle as Text";
        license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+       broken = true;
      }) {};
 
   "Shpadoinkle-console" = callPackage
@@ -18704,6 +18699,8 @@ self: {
        ];
        description = "A typed, template generated Html DSL, and helpers";
        license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+       broken = true;
      }) {};
 
   "Shpadoinkle-isreal" = callPackage
@@ -33855,15 +33852,15 @@ self: {
        license = lib.licenses.asl20;
      }) {};
 
-  "ascii_1_1_1_0" = callPackage
+  "ascii_1_1_1_2" = callPackage
     ({ mkDerivation, ascii-case, ascii-char, ascii-group
      , ascii-predicates, ascii-superset, ascii-th, base, bytestring
      , text
      }:
      mkDerivation {
        pname = "ascii";
-       version = "1.1.1.0";
-       sha256 = "11a2hwjz439damkjcx3ybbwjnvhdrhwxw78203vgydym4v1k2hrn";
+       version = "1.1.1.2";
+       sha256 = "0wyr8s678dz2f45aiaish7xagdpnzn9rdx56zd4cs0aib0w71gl6";
        libraryHaskellDepends = [
          ascii-case ascii-char ascii-group ascii-predicates ascii-superset
          ascii-th base bytestring text
@@ -33901,6 +33898,19 @@ self: {
        license = lib.licenses.asl20;
      }) {};
 
+  "ascii-case_1_0_0_10" = callPackage
+    ({ mkDerivation, ascii-char, base, hashable }:
+     mkDerivation {
+       pname = "ascii-case";
+       version = "1.0.0.10";
+       sha256 = "1vncwrngvqlzacs8084s7xvbj02zpq5irciwmv8cxh8pwjk2vhpw";
+       libraryHaskellDepends = [ ascii-char base hashable ];
+       testHaskellDepends = [ ascii-char base ];
+       description = "ASCII letter case";
+       license = lib.licenses.asl20;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "ascii-char" = callPackage
     ({ mkDerivation, base, hashable }:
      mkDerivation {
@@ -33913,6 +33923,19 @@ self: {
        license = lib.licenses.asl20;
      }) {};
 
+  "ascii-char_1_0_0_14" = callPackage
+    ({ mkDerivation, base, hashable }:
+     mkDerivation {
+       pname = "ascii-char";
+       version = "1.0.0.14";
+       sha256 = "0mdmcxp5bd89akh6z7kdyhl679pbm58rww0mhzj6y41sj4g7j4m4";
+       libraryHaskellDepends = [ base hashable ];
+       testHaskellDepends = [ base ];
+       description = "A Char type representing an ASCII character";
+       license = lib.licenses.asl20;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "ascii-cows" = callPackage
     ({ mkDerivation, base, random-extras, random-fu, text }:
      mkDerivation {
@@ -33952,6 +33975,19 @@ self: {
        license = lib.licenses.asl20;
      }) {};
 
+  "ascii-group_1_0_0_10" = callPackage
+    ({ mkDerivation, ascii-char, base, hashable }:
+     mkDerivation {
+       pname = "ascii-group";
+       version = "1.0.0.10";
+       sha256 = "0swkv40jlcix8qs62zszkbsvw0k833l6rmrx21jzxvfi41pycd5r";
+       libraryHaskellDepends = [ ascii-char base hashable ];
+       testHaskellDepends = [ ascii-char base ];
+       description = "ASCII character groups";
+       license = lib.licenses.asl20;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "ascii-holidays" = callPackage
     ({ mkDerivation, base, random, random-shuffle, terminfo, time }:
      mkDerivation {
@@ -33979,6 +34015,19 @@ self: {
        license = lib.licenses.asl20;
      }) {};
 
+  "ascii-predicates_1_0_0_8" = callPackage
+    ({ mkDerivation, ascii-char, base }:
+     mkDerivation {
+       pname = "ascii-predicates";
+       version = "1.0.0.8";
+       sha256 = "1pl1pw6z1yc2r21v70qrm1wfnbzyq8cl0z3xn0268w1qx4qlnpng";
+       libraryHaskellDepends = [ ascii-char base ];
+       testHaskellDepends = [ ascii-char base ];
+       description = "Various categorizations of ASCII characters";
+       license = lib.licenses.asl20;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "ascii-progress" = callPackage
     ({ mkDerivation, async, base, concurrent-output, data-default
      , hspec, QuickCheck, time
@@ -34037,6 +34086,21 @@ self: {
        license = lib.licenses.asl20;
      }) {};
 
+  "ascii-superset_1_0_1_10" = callPackage
+    ({ mkDerivation, ascii-char, base, bytestring, hashable, text }:
+     mkDerivation {
+       pname = "ascii-superset";
+       version = "1.0.1.10";
+       sha256 = "1filq9yr5lmwmn6m5ax0hpnyxlk160qbw2ikvjk4rs6078xwjwl9";
+       libraryHaskellDepends = [
+         ascii-char base bytestring hashable text
+       ];
+       testHaskellDepends = [ ascii-char base text ];
+       description = "Representing ASCII with refined supersets";
+       license = lib.licenses.asl20;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "ascii-table" = callPackage
     ({ mkDerivation, aeson, base, containers, dlist, hashable, text
      , unordered-containers, vector, wl-pprint-extras
@@ -34072,6 +34136,25 @@ self: {
        license = lib.licenses.asl20;
      }) {};
 
+  "ascii-th_1_0_0_8" = callPackage
+    ({ mkDerivation, ascii-char, ascii-superset, base, bytestring
+     , template-haskell, text
+     }:
+     mkDerivation {
+       pname = "ascii-th";
+       version = "1.0.0.8";
+       sha256 = "1685msxir8di3blnaykj036b640z8jsmlzvj1vwr86wf92g9gbdz";
+       libraryHaskellDepends = [
+         ascii-char ascii-superset base template-haskell
+       ];
+       testHaskellDepends = [
+         ascii-char ascii-superset base bytestring text
+       ];
+       description = "Template Haskell support for ASCII";
+       license = lib.licenses.asl20;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "ascii-vector-avc" = callPackage
     ({ mkDerivation, attoparsec, base, binary, bytestring, deepseq
      , deepseq-generics, HUnit, split, zlib
@@ -35220,8 +35303,8 @@ self: {
     ({ mkDerivation, base, stm }:
      mkDerivation {
        pname = "atomic-modify";
-       version = "0.1.0.2";
-       sha256 = "0j4zhr02bmkpar80vzxxj91qyz97wi7kia79q20a1y3sqbmx2sk5";
+       version = "0.1.0.3";
+       sha256 = "1kz3sbr4sh2c405plf0d4078j47kmvw0gwsw53vyvsyxwhm9db3z";
        libraryHaskellDepends = [ base stm ];
        description = "A typeclass for mutable references that have an atomic modify operation";
        license = lib.licenses.asl20;
@@ -35603,19 +35686,17 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
-  "attoparsec_0_14_3" = callPackage
+  "attoparsec_0_14_4" = callPackage
     ({ mkDerivation, array, base, bytestring, case-insensitive
-     , containers, criterion, deepseq, directory, filepath, ghc-prim
-     , http-types, parsec, QuickCheck, quickcheck-unicode, scientific
-     , tasty, tasty-quickcheck, text, transformers, unordered-containers
-     , vector
+     , containers, deepseq, directory, filepath, ghc-prim, http-types
+     , parsec, QuickCheck, quickcheck-unicode, scientific, tasty
+     , tasty-bench, tasty-quickcheck, text, transformers
+     , unordered-containers, vector
      }:
      mkDerivation {
        pname = "attoparsec";
-       version = "0.14.3";
-       sha256 = "1j7sy24d7kf9qb99cr36zchb4gsj3gcy4yflawxqnng31lqdxjal";
-       revision = "1";
-       editedCabalFile = "1i3dwcq8970d7i7via7y0384hv7xqlajjlr9dlwlx1f29bx98pdn";
+       version = "0.14.4";
+       sha256 = "0v4yjz4qi8bwhbyavqxlhsfb1iv07v10gxi64khmsmi4hvjpycrz";
        libraryHaskellDepends = [
          array base bytestring containers deepseq ghc-prim scientific text
          transformers
@@ -35625,10 +35706,11 @@ self: {
          scientific tasty tasty-quickcheck text transformers vector
        ];
        benchmarkHaskellDepends = [
-         array base bytestring case-insensitive containers criterion deepseq
-         directory filepath ghc-prim http-types parsec scientific text
+         array base bytestring case-insensitive containers deepseq directory
+         filepath ghc-prim http-types parsec scientific tasty-bench text
          transformers unordered-containers vector
        ];
+       doHaddock = false;
        description = "Fast combinator parsing for bytestrings and text";
        license = lib.licenses.bsd3;
        hydraPlatforms = lib.platforms.none;
@@ -36432,6 +36514,21 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
+  "autoexporter_2_0_0_1" = callPackage
+    ({ mkDerivation, base, Cabal, directory, filepath }:
+     mkDerivation {
+       pname = "autoexporter";
+       version = "2.0.0.1";
+       sha256 = "1sdpfqd8ypi1d8bkxj695midhgi9ynahknwlc72gh718ah26xc18";
+       isLibrary = true;
+       isExecutable = true;
+       libraryHaskellDepends = [ base Cabal directory filepath ];
+       executableHaskellDepends = [ base Cabal directory filepath ];
+       description = "Automatically re-export modules";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "autom" = callPackage
     ({ mkDerivation, base, bytestring, colour, ghc-prim, gloss
      , JuicyPixels, random, vector
@@ -38631,6 +38728,23 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "barbies_2_0_3_1" = callPackage
+    ({ mkDerivation, base, distributive, QuickCheck, tasty, tasty-hunit
+     , tasty-quickcheck, transformers
+     }:
+     mkDerivation {
+       pname = "barbies";
+       version = "2.0.3.1";
+       sha256 = "0gfzb52k3py1qnr2b6gshdg7c9aj1j9y2xsdhz86n01ybv81yg51";
+       libraryHaskellDepends = [ base distributive transformers ];
+       testHaskellDepends = [
+         base distributive QuickCheck tasty tasty-hunit tasty-quickcheck
+       ];
+       description = "Classes for working with types that can change clothes";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "barbies-layered" = callPackage
     ({ mkDerivation, barbies, base, doctest, doctest-discover, hspec
      , hspec-discover, transformers
@@ -39425,6 +39539,8 @@ self: {
        pname = "basement-cd";
        version = "0.0.12.1";
        sha256 = "18w1rzn6p3a25y075rr1lmln74mfiv9dzgf01mipwjqfsirki15b";
+       revision = "1";
+       editedCabalFile = "12z794dzdyjkc9l55yw5c7y3knplsrkz1ndhn9bi87a8vn7kwvcq";
        libraryHaskellDepends = [ base ghc-prim ];
        description = "Foundation scrap box of array & string";
        license = lib.licenses.bsd3;
@@ -41675,6 +41791,25 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
+  "binary-parser_0_5_7_1" = callPackage
+    ({ mkDerivation, base, bytestring, mtl, QuickCheck
+     , quickcheck-instances, rerebase, tasty, tasty-hunit
+     , tasty-quickcheck, text, transformers
+     }:
+     mkDerivation {
+       pname = "binary-parser";
+       version = "0.5.7.1";
+       sha256 = "1k3rc1szwahc5w2lxddnjpd4zkfi2hmcq398sixf2qx44f2kk6vp";
+       libraryHaskellDepends = [ base bytestring mtl text transformers ];
+       testHaskellDepends = [
+         QuickCheck quickcheck-instances rerebase tasty tasty-hunit
+         tasty-quickcheck
+       ];
+       description = "A highly-efficient but limited parser API specialised for bytestrings";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "binary-parsers" = callPackage
     ({ mkDerivation, attoparsec, base, binary, bytestring
      , bytestring-lexing, case-insensitive, criterion, deepseq
@@ -43232,18 +43367,18 @@ self: {
   "bisc" = callPackage
     ({ mkDerivation, base, bytestring, configurator, data-default
      , directory, exceptions, filepath, leveldb-haskell, mtl
-     , optparse-applicative, selda, selda-sqlite, text
+     , optparse-applicative, resourcet, selda, selda-sqlite, text, unix
      }:
      mkDerivation {
        pname = "bisc";
-       version = "0.4.0.0";
-       sha256 = "1x0i3yjgfnhw5nsx2fr150anf199z29g630xv58315xz6a526js0";
+       version = "0.4.1.0";
+       sha256 = "06jb8kikpdc9fz5ndy8qmqv1zmvxjg130wvsh23hhp8a01n4pxca";
        isLibrary = false;
        isExecutable = true;
        executableHaskellDepends = [
          base bytestring configurator data-default directory exceptions
-         filepath leveldb-haskell mtl optparse-applicative selda
-         selda-sqlite text
+         filepath leveldb-haskell mtl optparse-applicative resourcet selda
+         selda-sqlite text unix
        ];
        description = "A small tool that clears cookies (and more)";
        license = lib.licenses.gpl3Only;
@@ -47114,7 +47249,7 @@ self: {
        license = lib.licenses.agpl3Only;
      }) {};
 
-  "brittany_0_14_0_0" = callPackage
+  "brittany_0_14_0_2" = callPackage
     ({ mkDerivation, aeson, base, butcher, bytestring, cmdargs
      , containers, czipwith, data-tree-print, deepseq, directory, extra
      , filepath, ghc, ghc-boot, ghc-boot-th, ghc-exactprint, hspec
@@ -47123,8 +47258,8 @@ self: {
      }:
      mkDerivation {
        pname = "brittany";
-       version = "0.14.0.0";
-       sha256 = "10xphm9szdflwqkfbhz9pngiq0sn5jmysa015dhqc3prhz4qha2b";
+       version = "0.14.0.2";
+       sha256 = "03jnjmp4hy0g22h0jq5md60iz5y94fzhdjx849s89mvb28pdfd1n";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -47166,16 +47301,29 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "broadcast-chan_0_2_1_2" = callPackage
+    ({ mkDerivation, async, base, criterion, deepseq, stm, transformers
+     , unliftio-core
+     }:
+     mkDerivation {
+       pname = "broadcast-chan";
+       version = "0.2.1.2";
+       sha256 = "1zsrafz3q9l8np8wafmrbi8ilwwsgnzkc8jfjkjfgs4kq65yglqw";
+       libraryHaskellDepends = [ base transformers unliftio-core ];
+       benchmarkHaskellDepends = [ async base criterion deepseq stm ];
+       description = "Closable, fair, single-wakeup channel type that avoids 0 reader space leaks";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "broadcast-chan-conduit" = callPackage
     ({ mkDerivation, base, broadcast-chan, broadcast-chan-tests
      , conduit, containers, resourcet, transformers, unliftio-core
      }:
      mkDerivation {
        pname = "broadcast-chan-conduit";
-       version = "0.2.1.1";
-       sha256 = "0w0f4skprhnm1x4vzchkgjgjljzqizpb678251jgj65jsg1mnyfc";
-       revision = "1";
-       editedCabalFile = "0pk09frf24jg2id13l1nx47wwvf2z4qjqv17y7ji036iwp9xk6nw";
+       version = "0.2.1.2";
+       sha256 = "0mwd82arm50zwz559qzxi70ia9d4h5kjwdvhk09jf966hd0knnmm";
        libraryHaskellDepends = [
          base broadcast-chan conduit resourcet transformers unliftio-core
        ];
@@ -47184,6 +47332,7 @@ self: {
        ];
        description = "Conduit-based parallel streaming code for broadcast-chan";
        license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "broadcast-chan-pipes" = callPackage
@@ -47192,16 +47341,15 @@ self: {
      }:
      mkDerivation {
        pname = "broadcast-chan-pipes";
-       version = "0.2.1";
-       sha256 = "0yifpd97cihagflmh0xs0wcl541k89hick4h9hh8zrah72g71fqr";
-       revision = "1";
-       editedCabalFile = "0zz05sc0ny5czzyw71c1fdzlfawjwhznbr8z683bf83821ra5fcv";
+       version = "0.2.1.1";
+       sha256 = "06nghcddlcnc97p3464fsgcfvjlsnxv7i7khzws3g3myl8hrd89c";
        libraryHaskellDepends = [ base broadcast-chan pipes pipes-safe ];
        testHaskellDepends = [
          base broadcast-chan-tests containers foldl pipes pipes-safe
        ];
        description = "Pipes-based parallel streaming code for broadcast-chan";
        license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "broadcast-chan-tests" = callPackage
@@ -47212,10 +47360,10 @@ self: {
      }:
      mkDerivation {
        pname = "broadcast-chan-tests";
-       version = "0.2.1.1";
-       sha256 = "0qx8j9sfky5qvrxrn4is9sja4qh6jh7jahq3zkyyq3a54jkwc8d3";
-       revision = "4";
-       editedCabalFile = "04hgr1ik1z9v317x8rw6amxqrmc94g6cghzxghddszqismz44gaq";
+       version = "0.2.1.2";
+       sha256 = "08qjvhdx2pwgj5kcl5fmg5qdlzbdchxjihmqch4sgv48kcga06nv";
+       revision = "1";
+       editedCabalFile = "1x2bmnkybh627yf22ackvqh3xfhdxv88ijsl8ryg8qhr6qm51jfj";
        libraryHaskellDepends = [
          async base broadcast-chan clock containers optparse-applicative
          paramtree stm tagged tasty tasty-golden tasty-hunit tasty-travis
@@ -47226,6 +47374,8 @@ self: {
        ];
        description = "Helpers for generating tests for broadcast-chan";
        license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+       broken = true;
      }) {};
 
   "broccoli" = callPackage
@@ -48194,6 +48344,27 @@ self: {
        license = lib.licenses.isc;
      }) {};
 
+  "burrito_2_0_1_0" = callPackage
+    ({ mkDerivation, base, bytestring, containers, hspec, parsec
+     , QuickCheck, template-haskell, text, transformers
+     }:
+     mkDerivation {
+       pname = "burrito";
+       version = "2.0.1.0";
+       sha256 = "1b8c4sdk60sj20rrrhra4hx0f1y1injih4xcg4q19fgaf04chr91";
+       libraryHaskellDepends = [
+         base bytestring containers parsec template-haskell text
+         transformers
+       ];
+       testHaskellDepends = [
+         base bytestring containers hspec parsec QuickCheck template-haskell
+         text transformers
+       ];
+       description = "Parse and render URI templates";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "burst-detection" = callPackage
     ({ mkDerivation, base, criterion, deepseq }:
      mkDerivation {
@@ -50338,35 +50509,6 @@ self: {
        broken = true;
      }) {};
 
-  "cabal-install-parsers_0_4_2" = callPackage
-    ({ mkDerivation, aeson, ansi-terminal, base, base16-bytestring
-     , binary, binary-instances, bytestring, Cabal, containers
-     , criterion, cryptohash-sha256, deepseq, directory, filepath, lukko
-     , network-uri, parsec, pretty, tar, tasty, tasty-golden
-     , tasty-hunit, text, time, transformers, tree-diff
-     }:
-     mkDerivation {
-       pname = "cabal-install-parsers";
-       version = "0.4.2";
-       sha256 = "08ny95sryii4nzyy8b2zf15vk329y84gbvpy7302hnjxanc6awx5";
-       libraryHaskellDepends = [
-         aeson base base16-bytestring binary binary-instances bytestring
-         Cabal containers cryptohash-sha256 deepseq directory filepath lukko
-         network-uri parsec pretty tar text time transformers
-       ];
-       testHaskellDepends = [
-         ansi-terminal base base16-bytestring bytestring Cabal containers
-         directory filepath pretty tar tasty tasty-golden tasty-hunit
-         tree-diff
-       ];
-       benchmarkHaskellDepends = [
-         base bytestring Cabal containers criterion directory filepath
-       ];
-       description = "Utilities to work with cabal-install files";
-       license = "GPL-2.0-or-later AND BSD-3-Clause";
-       hydraPlatforms = lib.platforms.none;
-     }) {};
-
   "cabal-install-parsers" = callPackage
     ({ mkDerivation, aeson, ansi-terminal, base, base16-bytestring
      , binary, binary-instances, bytestring, Cabal, containers
@@ -50538,6 +50680,8 @@ self: {
        pname = "cabal-plan";
        version = "0.7.2.1";
        sha256 = "0n45bakzf1r1nyvs76fmrj0cf74knqnpyb2i82baxia0falbp48r";
+       revision = "1";
+       editedCabalFile = "1pb8r65f279m9ps67mkkcbcpbprbj7pd12b9m2s64l8fgn9in422";
        configureFlags = [ "-fexe" ];
        isLibrary = true;
        isExecutable = true;
@@ -51223,35 +51367,39 @@ self: {
      }) {};
 
   "cachix" = callPackage
-    ({ mkDerivation, async, base, base64-bytestring, bytestring
+    ({ mkDerivation, aeson, async, base, base64-bytestring, bytestring
      , cachix-api, concurrent-extra, conduit, conduit-extra, containers
      , cookie, cryptonite, dhall, directory, ed25519, filepath, fsnotify
      , hercules-ci-cnix-store, here, hspec, hspec-discover, http-client
-     , http-client-tls, http-conduit, http-types, lzma-conduit
-     , megaparsec, memory, mmorph, netrc, nix, optparse-applicative
-     , process, protolude, resourcet, retry, safe-exceptions, servant
-     , servant-auth, servant-auth-client, servant-client
-     , servant-client-core, servant-conduit, stm, temporary, text, unix
-     , uri-bytestring, vector, versions
+     , http-client-tls, http-conduit, http-types, inline-c-cpp, katip
+     , lzma-conduit, megaparsec, memory, mmorph, netrc, nix
+     , optparse-applicative, pretty-terminal, process, protolude
+     , resourcet, retry, safe-exceptions, servant, servant-auth
+     , servant-auth-client, servant-client, servant-client-core
+     , servant-conduit, stm, stm-conduit, systemd, temporary, text, time
+     , unix, unordered-containers, uri-bytestring, uuid, vector
+     , versions, websockets, wuss
      }:
      mkDerivation {
        pname = "cachix";
-       version = "0.6.1";
-       sha256 = "0fgm7035ahlgl3vbk0lqf3l07wagsykmw9z0pkzqqcwh1wlv1np7";
+       version = "0.7.0";
+       sha256 = "10yyzk26hmx4xqv4zc83a5m69bj88fd6v2fs76nfbqc2kcpiis6k";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
-         async base base64-bytestring bytestring cachix-api concurrent-extra
-         conduit conduit-extra containers cookie cryptonite dhall directory
-         ed25519 filepath fsnotify hercules-ci-cnix-store here http-client
-         http-client-tls http-conduit http-types lzma-conduit megaparsec
-         memory mmorph netrc optparse-applicative process protolude
-         resourcet retry safe-exceptions servant servant-auth
-         servant-auth-client servant-client servant-client-core
-         servant-conduit stm text unix uri-bytestring vector versions
+         aeson async base base64-bytestring bytestring cachix-api
+         concurrent-extra conduit conduit-extra containers cookie cryptonite
+         dhall directory ed25519 filepath fsnotify hercules-ci-cnix-store
+         here http-client http-client-tls http-conduit http-types
+         inline-c-cpp katip lzma-conduit megaparsec memory mmorph netrc
+         optparse-applicative pretty-terminal process protolude resourcet
+         retry safe-exceptions servant servant-auth servant-auth-client
+         servant-client servant-client-core servant-conduit stm stm-conduit
+         systemd temporary text time unix unordered-containers
+         uri-bytestring uuid vector versions websockets wuss
        ];
        libraryPkgconfigDepends = [ nix ];
-       executableHaskellDepends = [ base cachix-api ];
+       executableHaskellDepends = [ base cachix-api safe-exceptions ];
        executableToolDepends = [ hspec-discover ];
        testHaskellDepends = [
          base cachix-api directory here hspec protolude servant-auth-client
@@ -51263,24 +51411,24 @@ self: {
      }) {inherit (pkgs) nix;};
 
   "cachix-api" = callPackage
-    ({ mkDerivation, aeson, base, base16-bytestring, bytestring
+    ({ mkDerivation, aeson, async, base, base16-bytestring, bytestring
      , conduit, cookie, cryptonite, deepseq, exceptions, hspec
      , hspec-discover, http-api-data, http-media, jose, lens, memory
      , nix-narinfo, protolude, resourcet, servant, servant-auth
      , servant-auth-swagger, servant-client, servant-swagger
      , servant-swagger-ui-core, string-conv, swagger2, text, time
-     , transformers
+     , transformers, unordered-containers, uuid, websockets
      }:
      mkDerivation {
        pname = "cachix-api";
-       version = "0.6.0";
-       sha256 = "0q6kl5lb05c1m62yqj0d8vimlghhrc3avl3bz5wjp70azs28jcd3";
+       version = "0.7.0";
+       sha256 = "0l9bvzpf0g3rnr417gvxq0lgbmi3pn3cr9ap2m7sbwvikal8wlxg";
        libraryHaskellDepends = [
-         aeson base base16-bytestring bytestring conduit cookie cryptonite
-         deepseq exceptions http-api-data http-media jose lens memory
-         nix-narinfo protolude resourcet servant servant-auth
+         aeson async base base16-bytestring bytestring conduit cookie
+         cryptonite deepseq exceptions http-api-data http-media jose lens
+         memory nix-narinfo protolude resourcet servant servant-auth
          servant-auth-swagger servant-client string-conv swagger2 text time
-         transformers
+         transformers unordered-containers uuid websockets
        ];
        testHaskellDepends = [
          aeson base base16-bytestring bytestring conduit cookie cryptonite
@@ -51329,8 +51477,8 @@ self: {
      }:
      mkDerivation {
        pname = "caerbannog";
-       version = "0.6.0.5";
-       sha256 = "048d46g7xnqbkb061hs3ix8rzpp1mwww9iznpgrrkvimafb0r0m0";
+       version = "1.0.0.0";
+       sha256 = "1sfk4kh7jk762dqfp4c0hq9jqmp1r0x0727vp0cp48wsp9yn4d8f";
        libraryHaskellDepends = [ base binary bytestring ];
        testHaskellDepends = [
          base binary bytestring hspec QuickCheck random
@@ -51928,8 +52076,8 @@ self: {
      }:
      mkDerivation {
        pname = "candid";
-       version = "0.3";
-       sha256 = "0zq29zddkkwvlyz9qmxl942ml53m6jawl4m5rkb2510glbkcvr5x";
+       version = "0.3.1";
+       sha256 = "0swz07qn3829dpr850973baj1ki5pizlh90gy4xrp1d9bsvwy4sq";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -52343,6 +52491,75 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "captcha-2captcha" = callPackage
+    ({ mkDerivation, aeson, base, bytestring, captcha-core
+     , data-default, errors, extra, http-client, lens, lens-aeson, mtl
+     , o-clock, string-conversions, string-interpolate, tasty
+     , tasty-hunit, text, unliftio, wreq
+     }:
+     mkDerivation {
+       pname = "captcha-2captcha";
+       version = "0.1.0.0";
+       sha256 = "19r7977vkbyd6if9bvh9m2vv2wmhynly6qzsq7ndckn4yw4xc5wx";
+       libraryHaskellDepends = [
+         aeson base bytestring captcha-core errors extra http-client lens
+         lens-aeson mtl o-clock string-conversions string-interpolate text
+         unliftio wreq
+       ];
+       testHaskellDepends = [
+         aeson base bytestring captcha-core data-default errors extra
+         http-client lens lens-aeson mtl o-clock string-conversions
+         string-interpolate tasty tasty-hunit text unliftio wreq
+       ];
+       description = "A package for integrating a variety of captcha solving services";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
+  "captcha-capmonster" = callPackage
+    ({ mkDerivation, aeson, aeson-qq, base, bytestring, captcha-core
+     , data-default, errors, extra, http-client, lens, lens-aeson, mtl
+     , o-clock, string-conversions, string-interpolate, tasty
+     , tasty-hunit, text, unliftio, wreq
+     }:
+     mkDerivation {
+       pname = "captcha-capmonster";
+       version = "0.1.0.0";
+       sha256 = "0ps7dwbkafi92a408c0fcc15vjp8b2gf400ijbx4vz5vm0s9dzvl";
+       libraryHaskellDepends = [
+         aeson aeson-qq base bytestring captcha-core errors extra
+         http-client lens lens-aeson mtl o-clock string-interpolate text
+         unliftio wreq
+       ];
+       testHaskellDepends = [
+         aeson aeson-qq base bytestring captcha-core data-default errors
+         extra http-client lens lens-aeson mtl o-clock string-conversions
+         string-interpolate tasty tasty-hunit text unliftio wreq
+       ];
+       description = "A package for integrating a variety of captcha solving services";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
+  "captcha-core" = callPackage
+    ({ mkDerivation, aeson, base, bytestring, cookie
+     , data-default-extra, lens, mtl, o-clock, string-conversions, text
+     , unliftio, wreq
+     }:
+     mkDerivation {
+       pname = "captcha-core";
+       version = "0.1.0.0";
+       sha256 = "08bvgmxj7rs0gz8rnidrxmw7p9ahw40p07k3gs3vk5h275dnqsk7";
+       libraryHaskellDepends = [
+         aeson base bytestring cookie data-default-extra lens mtl o-clock
+         string-conversions text unliftio wreq
+       ];
+       description = "A package for integrating a variety of captcha solving services";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+       broken = true;
+     }) {};
+
   "car-pool" = callPackage
     ({ mkDerivation, base, blaze-html, containers, digestive-functors
      , digestive-functors-blaze, digestive-functors-happstack
@@ -52950,8 +53167,8 @@ self: {
      }:
      mkDerivation {
        pname = "casr-logbook";
-       version = "0.6.6";
-       sha256 = "0nq6jkaxw68dn4m9pqa717w0k1kbvqz00ji4sjal3r2imykpwrfa";
+       version = "0.6.9";
+       sha256 = "0ga60asv7i5jdmvbv25s9h7b23p4f4aasmksh6swbxz5fzky7g7g";
        libraryHaskellDepends = [
          base containers digit lens lucid text time
        ];
@@ -55304,10 +55521,8 @@ self: {
      }:
      mkDerivation {
        pname = "chell";
-       version = "0.5";
-       sha256 = "1i845isfbk0yq852am9bqmxfpfkpnlha8nfidffsv4gw2p8gg6fg";
-       revision = "1";
-       editedCabalFile = "1q93wrw03ix4cmnkz3lzkixcvvizw6i2ia2zifdfak1dvxnblxk0";
+       version = "0.5.0.1";
+       sha256 = "10zpnalrz4riyqbk2bwsdml4b23x3mrn0cg4hmssffsa50yq93gs";
        libraryHaskellDepends = [
          ansi-terminal base bytestring options patience random
          template-haskell text transformers
@@ -55320,8 +55535,8 @@ self: {
     ({ mkDerivation, base, chell, HUnit }:
      mkDerivation {
        pname = "chell-hunit";
-       version = "0.3";
-       sha256 = "18p9rhs81b43jb95dqg650h3cajsw45w7cgsavkm18h0qhrz41kb";
+       version = "0.3.0.1";
+       sha256 = "01dv6lv4bj1m0sk7v90w5jnlyvir2v969sw8hrif2h3hy9f3pc9v";
        libraryHaskellDepends = [ base chell HUnit ];
        description = "HUnit support for the Chell testing library";
        license = lib.licenses.mit;
@@ -55331,8 +55546,8 @@ self: {
     ({ mkDerivation, base, chell, QuickCheck, random }:
      mkDerivation {
        pname = "chell-quickcheck";
-       version = "0.2.5.2";
-       sha256 = "0n8c57n88r2bx0bh8nabsz07m42rh23ahs3hgyzf8gr76l08zq03";
+       version = "0.2.5.3";
+       sha256 = "1bm2gva5g9y71z2kbnl4dinplvlbisnjqhlcvgf6a9ir7y4r5c0x";
        libraryHaskellDepends = [ base chell QuickCheck random ];
        description = "QuickCheck support for the Chell testing library";
        license = lib.licenses.mit;
@@ -55926,6 +56141,8 @@ self: {
        pname = "chs-cabal";
        version = "0.1.1.1";
        sha256 = "0fvf26394rpn9g4f3rp13bq8rrhzs9d95k7nbcpayzml2j9rsv3l";
+       revision = "1";
+       editedCabalFile = "13c4sc83kl6wvx39b1i09mjgsnn4l7ffcynnhsnn9v5y3nzw3j78";
        libraryHaskellDepends = [ base Cabal chs-deps ];
        description = "Cabal with c2hs dependencies";
        license = lib.licenses.bsd3;
@@ -56143,8 +56360,8 @@ self: {
      }:
      mkDerivation {
        pname = "cimple";
-       version = "0.0.8";
-       sha256 = "08mm6v0a52l7wq4kaj4zs9wyvnf7g0qmhxvbdbbrcqgxm8a9mc9v";
+       version = "0.0.11";
+       sha256 = "1n7633c6w4n4996i3k9v60yhpiddd8b7600c7hpam2axm9cqb19i";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -56555,7 +56772,7 @@ self: {
        license = lib.licenses.bsd2;
      }) {};
 
-  "citeproc_0_6" = callPackage
+  "citeproc_0_6_0_1" = callPackage
     ({ mkDerivation, aeson, attoparsec, base, bytestring
      , case-insensitive, containers, data-default, Diff, directory
      , file-embed, filepath, mtl, pandoc-types, pretty, safe, scientific
@@ -56564,8 +56781,8 @@ self: {
      }:
      mkDerivation {
        pname = "citeproc";
-       version = "0.6";
-       sha256 = "1dx61f8y32b5w84d2fzaxfgdj2gyr0wyqhh6jl2jf2lfn5cbhll3";
+       version = "0.6.0.1";
+       sha256 = "015ansq3a710s0hzs2157fx12bc4f1hy45l4dbi6j477sy800bqc";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -57741,8 +57958,19 @@ self: {
     ({ mkDerivation, base }:
      mkDerivation {
        pname = "cli-arguments";
-       version = "0.3.1.0";
-       sha256 = "14zgzsps25xr47a2l888xrzg3d09zfdz62g6d3liawhmf1kiwbkp";
+       version = "0.6.0.0";
+       sha256 = "0vg5xmdg84bv6bab03iv9zj0i1vkp9xlfjbm1rpzjjhpihp8v5sg";
+       libraryHaskellDepends = [ base ];
+       description = "A library to process command line arguments in some more convenient way";
+       license = lib.licenses.mit;
+     }) {};
+
+  "cli-arguments-strict" = callPackage
+    ({ mkDerivation, base }:
+     mkDerivation {
+       pname = "cli-arguments-strict";
+       version = "0.1.0.0";
+       sha256 = "06m6b5jcc00n4xaqz27f4f3vyb13ic8vnqf3nazhr2dnx0xjfad3";
        libraryHaskellDepends = [ base ];
        description = "A library to process command line arguments in some more convenient way";
        license = lib.licenses.mit;
@@ -60948,6 +61176,28 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "commonmark-extensions_0_2_3" = callPackage
+    ({ mkDerivation, base, commonmark, containers, emojis, filepath
+     , network-uri, parsec, tasty, tasty-bench, tasty-hunit, text
+     , transformers
+     }:
+     mkDerivation {
+       pname = "commonmark-extensions";
+       version = "0.2.3";
+       sha256 = "02zq9ma58yngabz1rw0alaq9s8lsfmxjn8m3dfjxavvq2pl3748f";
+       libraryHaskellDepends = [
+         base commonmark containers emojis filepath network-uri parsec text
+         transformers
+       ];
+       testHaskellDepends = [
+         base commonmark parsec tasty tasty-hunit text
+       ];
+       benchmarkHaskellDepends = [ base commonmark tasty-bench text ];
+       description = "Pure Haskell commonmark parser";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "commonmark-pandoc" = callPackage
     ({ mkDerivation, base, commonmark, commonmark-extensions
      , pandoc-types, text
@@ -61246,12 +61496,27 @@ self: {
      }) {};
 
   "compactable" = callPackage
-    ({ mkDerivation, base, containers, transformers, vector }:
+    ({ mkDerivation, aeson, base, base-compat, bifunctors, containers
+     , contravariant, data-default-class, deepseq, genvalidity
+     , genvalidity-sydtest, hashable, keys, lens, QuickCheck
+     , semigroupoids, sydtest, sydtest-discover, these, transformers
+     , transformers-compat, unordered-containers, vector
+     , vector-instances
+     }:
      mkDerivation {
        pname = "compactable";
-       version = "0.1.2.4";
-       sha256 = "13lynjbwr78jy3j0zx6g2rk8qvyzkgw1smriqm6sslp3nn0v1g4r";
-       libraryHaskellDepends = [ base containers transformers vector ];
+       version = "0.2.0.0";
+       sha256 = "0ngcrmb9yihwn5dm6dcfkclgk31m92qa14rk99i2g6hbdmd6w747";
+       libraryHaskellDepends = [
+         aeson base base-compat bifunctors containers contravariant
+         data-default-class deepseq hashable keys lens QuickCheck
+         semigroupoids these transformers transformers-compat
+         unordered-containers vector vector-instances
+       ];
+       testHaskellDepends = [
+         base containers genvalidity genvalidity-sydtest QuickCheck sydtest
+         sydtest-discover these vector
+       ];
        description = "A typeclass for structures which can be catMaybed, filtered, and partitioned";
        license = lib.licenses.bsd3;
      }) {};
@@ -65604,8 +65869,8 @@ self: {
      }:
      mkDerivation {
        pname = "copilot";
-       version = "3.6";
-       sha256 = "0h43slh084wj7kwn2rdn0s63pqzy930h6z2vk38kn6yqic8d9s9y";
+       version = "3.7";
+       sha256 = "1s39w0vqk2pdd9b3kxvjzi6r300x4mxz6rbkpdjzccagnk08xzay";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -65624,8 +65889,8 @@ self: {
      }:
      mkDerivation {
        pname = "copilot-c99";
-       version = "3.6";
-       sha256 = "18p7pijx2f7bw61bzfs5994xpkygghf7hvwpklhp72jkshjdjj1m";
+       version = "3.7";
+       sha256 = "0k30n2w6sw76fdm42vrn28jrz23w3sydkmmh3lmbd42kipp01h7b";
        libraryHaskellDepends = [
          base containers copilot-core directory filepath language-c99
          language-c99-simple language-c99-util mtl pretty
@@ -65658,10 +65923,8 @@ self: {
      }:
      mkDerivation {
        pname = "copilot-core";
-       version = "3.6";
-       sha256 = "00v8la4q15qj27wyqcbsv0h7m5k5ln98y4zkdzpng3z5gw4mpkm9";
-       revision = "2";
-       editedCabalFile = "0yrrrksyhn7xq0hrp5shlrs0mf725dwzaskd5f13v143k8yx6c7c";
+       version = "3.7";
+       sha256 = "0mf6mim94ryixdbwwdr39bvc704fwi0pdj3zkdl4csnj3gv4mr40";
        libraryHaskellDepends = [ base dlist mtl pretty ];
        testHaskellDepends = [
          base HUnit pretty QuickCheck test-framework test-framework-hunit
@@ -65679,8 +65942,8 @@ self: {
      }:
      mkDerivation {
        pname = "copilot-language";
-       version = "3.6";
-       sha256 = "0b1cl4v5w54nx007mmnsx49hh3zxjm55ninlzkd78balnyah8nlk";
+       version = "3.7";
+       sha256 = "1p1l7ciyvwgghnshf7apjwarf9w2wsyqflib5xghq9y1dhmz0xg4";
        libraryHaskellDepends = [
          array base containers copilot-core copilot-theorem data-reify mtl
        ];
@@ -65695,8 +65958,8 @@ self: {
      }:
      mkDerivation {
        pname = "copilot-libraries";
-       version = "3.6";
-       sha256 = "0s6y1is91nbvlrb9fdp9xhaq9wx3j5pm67gjrlajiik4029a2dxd";
+       version = "3.7";
+       sha256 = "1lqi3ml5vw0qjki4rmb1kk6q6yapc24zwvmsccnlik5llnrhb7lv";
        libraryHaskellDepends = [
          array base containers copilot-language data-reify mtl parsec
        ];
@@ -65730,8 +65993,8 @@ self: {
      }:
      mkDerivation {
        pname = "copilot-theorem";
-       version = "3.6";
-       sha256 = "17l8xq4zd9jfih5p21l6xkahdgrfbmpy8wxc38w88w98qmz5ix59";
+       version = "3.7";
+       sha256 = "1h587747s52gx03qspnhx5jbkrrxhg618mibbwfcxpk7w7bdayv1";
        libraryHaskellDepends = [
          ansi-terminal base bimap bv-sized containers copilot-core
          data-default directory filepath libBF mtl panic parameterized-utils
@@ -65940,8 +66203,8 @@ self: {
      }:
      mkDerivation {
        pname = "core-telemetry";
-       version = "0.1.7.3";
-       sha256 = "05l6s3bw1gp36wx052c5q3mvzzmfdv922851kmr6ax79m5fxdsd9";
+       version = "0.1.8.1";
+       sha256 = "024npp0cm5f3v1h70iw03hv2lj0r2ylsp7w2pm1iv6zr8j63k1iy";
        libraryHaskellDepends = [
          async base bytestring chronologique core-data core-program
          core-text exceptions http-streams io-streams locators mtl random
@@ -65985,6 +66248,42 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "core-webserver-servant" = callPackage
+    ({ mkDerivation, base, core-program, core-telemetry
+     , core-webserver-warp, mtl, safe-exceptions, servant
+     , servant-server, vault, wai
+     }:
+     mkDerivation {
+       pname = "core-webserver-servant";
+       version = "0.1.0.0";
+       sha256 = "1d888qpm9g867czdhyv65302badpwg275xran5n3mapfjvk1zbqd";
+       libraryHaskellDepends = [
+         base core-program core-telemetry core-webserver-warp mtl
+         safe-exceptions servant servant-server vault wai
+       ];
+       description = "Interoperability with Servant";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
+  "core-webserver-warp" = callPackage
+    ({ mkDerivation, async, base, bytestring, core-data, core-program
+     , core-telemetry, core-text, http-types, http2, mtl
+     , safe-exceptions, vault, wai, warp
+     }:
+     mkDerivation {
+       pname = "core-webserver-warp";
+       version = "0.1.1.0";
+       sha256 = "0yfd2037bq6vljixkhrk2v2mlywj2br16pf5dpz2vahjpk0079yj";
+       libraryHaskellDepends = [
+         async base bytestring core-data core-program core-telemetry
+         core-text http-types http2 mtl safe-exceptions vault wai warp
+       ];
+       description = "Interoperability with Wai/Warp";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "corebot-bliki" = callPackage
     ({ mkDerivation, aeson, base, blaze-builder, bytestring, containers
      , directory, filepath, filestore, http-types, monads-tf, pandoc
@@ -67413,6 +67712,8 @@ self: {
        pname = "criterion";
        version = "1.5.12.0";
        sha256 = "0wrb48byp906f9wc9ii2mi2b2k008ycbi8ffrrj86plhp5rpvzz5";
+       revision = "1";
+       editedCabalFile = "154jscaip9y081mvf70vcwqw0acynfb9hwxgqwmzqq9q6d8b1wfw";
        isLibrary = true;
        isExecutable = true;
        enableSeparateDataOutput = true;
@@ -68461,8 +68762,8 @@ self: {
        pname = "cryptonite-cd";
        version = "0.29.1";
        sha256 = "053zfjxwnpaiw0kkky0fdbdqqyarygqnvmlm4vziqqrlkm4nba0c";
-       revision = "1";
-       editedCabalFile = "1y97mmslygswj5aydkvlj5vvf5xzkjxxjrblp3h9mx6wr9k63iyi";
+       revision = "3";
+       editedCabalFile = "1j7ch1h7irlk8lx0zjk41f4j0fmn3x96zf5355m669dwivan3m7s";
        libraryHaskellDepends = [
          base basement-cd bytestring deepseq ghc-prim integer-gmp memory-cd
        ];
@@ -69978,12 +70279,12 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
-  "d10_1_0_0_1" = callPackage
+  "d10_1_0_0_2" = callPackage
     ({ mkDerivation, base, hedgehog, template-haskell }:
      mkDerivation {
        pname = "d10";
-       version = "1.0.0.1";
-       sha256 = "0jaql1ql1pm0s6xd0mmi0gadx7z0ms62q46rxy4ida8k4v76r7cl";
+       version = "1.0.0.2";
+       sha256 = "10jc4sa986r194py1gg90mixvb2h4d1m12zwi6y5hffmrc910qva";
        libraryHaskellDepends = [ base template-haskell ];
        testHaskellDepends = [ base hedgehog template-haskell ];
        description = "Digits 0-9";
@@ -74325,6 +74626,29 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
+  "deferred-folds_0_9_18" = callPackage
+    ({ mkDerivation, base, bytestring, containers, foldl, hashable
+     , primitive, QuickCheck, quickcheck-instances, rerebase, tasty
+     , tasty-hunit, tasty-quickcheck, text, transformers
+     , unordered-containers, vector
+     }:
+     mkDerivation {
+       pname = "deferred-folds";
+       version = "0.9.18";
+       sha256 = "15yd5wqkksainhwwiq8vlf49ih2789wz9njv7050s5mr20b2rqy1";
+       libraryHaskellDepends = [
+         base bytestring containers foldl hashable primitive text
+         transformers unordered-containers vector
+       ];
+       testHaskellDepends = [
+         QuickCheck quickcheck-instances rerebase tasty tasty-hunit
+         tasty-quickcheck
+       ];
+       description = "Abstractions over deferred folds";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "definitive-base" = callPackage
     ({ mkDerivation, array, base, bytestring, containers, deepseq
      , ghc-prim, GLURaw, OpenGL, OpenGLRaw, primitive, vector
@@ -75465,6 +75789,22 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
+  "derulo_2_0_0_1" = callPackage
+    ({ mkDerivation, base, HUnit }:
+     mkDerivation {
+       pname = "derulo";
+       version = "2.0.0.1";
+       sha256 = "15lq7yv69i7azz2vxbx29k9csz62pp3a01qk8sng6yrq734qw8dx";
+       isLibrary = true;
+       isExecutable = true;
+       libraryHaskellDepends = [ base ];
+       executableHaskellDepends = [ base ];
+       testHaskellDepends = [ base HUnit ];
+       description = "Parse and render JSON simply";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "describe" = callPackage
     ({ mkDerivation, base, bytestring, cereal, fixed-vector, lens
      , mmorph, monad-control, mtl, profunctors, QuickCheck
@@ -76956,8 +77296,8 @@ self: {
        pname = "diagrams-contrib";
        version = "1.4.4";
        sha256 = "043jpr7lqg708lzmv6cqys7312lfdwnf8ijcnpl4jkbvcwl87c1m";
-       revision = "4";
-       editedCabalFile = "1hsi63kig21mb71qa4kf27h4g99xxqwlfqzl9jpca451sadlk7mp";
+       revision = "5";
+       editedCabalFile = "0qfsfrg9igmma9k68qdlkbgnla09w9y1a55kzxk49sfvfzvkilz5";
        libraryHaskellDepends = [
          base circle-packing colour containers cubicbezier data-default
          data-default-class diagrams-core diagrams-lib diagrams-solve
@@ -77110,6 +77450,8 @@ self: {
        pname = "diagrams-lib";
        version = "1.4.5.1";
        sha256 = "1hkxp549i99s45qk8zmhjvz1xyyv3i0ffl8155bifkic6fd8y2gz";
+       revision = "1";
+       editedCabalFile = "0yqpasggmdkzg2n67a6m20rbhzcgchnfhs66m95lnp5n9vl7v8mn";
        libraryHaskellDepends = [
          active adjunctions array base bytestring cereal colour containers
          data-default-class diagrams-core diagrams-solve directory
@@ -77309,8 +77651,8 @@ self: {
        pname = "diagrams-svg";
        version = "1.4.3.1";
        sha256 = "002lgmq78c6rsvds9bgm6m4w8j6qpg260mc52hf97wj6m050l237";
-       revision = "1";
-       editedCabalFile = "0534kgm9r70s5yhfjy4pkqy1f2aflg0acfp2g23xjfzr9kwq9v7m";
+       revision = "2";
+       editedCabalFile = "056nfj2srbhh68jc5al8hffcfrqlr89173pjf6bhpmnzxhwlv55k";
        libraryHaskellDepends = [
          base base64-bytestring bytestring colour containers diagrams-core
          diagrams-lib filepath hashable JuicyPixels lens monoid-extras mtl
@@ -78711,20 +79053,21 @@ self: {
   "discord-haskell" = callPackage
     ({ mkDerivation, aeson, async, base, base64-bytestring, bytestring
      , containers, data-default, emoji, http-client, iso8601-time
-     , JuicyPixels, MonadRandom, mtl, req, safe-exceptions, text, time
-     , unliftio, unordered-containers, vector, websockets, wuss
+     , JuicyPixels, MonadRandom, mtl, req, safe-exceptions, scientific
+     , text, time, unliftio, unordered-containers, vector, websockets
+     , wuss
      }:
      mkDerivation {
        pname = "discord-haskell";
-       version = "1.10.0";
-       sha256 = "1im1yjlnk8b8fcwyhlza1iggmry5r96sdibq2whcsyxqnpg24fr0";
+       version = "1.11.0";
+       sha256 = "10vak5aar5fx25ani676pi870mnnvzrn6n1b1akhdyags1hrsghm";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
          aeson async base base64-bytestring bytestring containers
          data-default emoji http-client iso8601-time JuicyPixels MonadRandom
-         mtl req safe-exceptions text time unliftio unordered-containers
-         vector websockets wuss
+         mtl req safe-exceptions scientific text time unliftio
+         unordered-containers vector websockets wuss
        ];
        executableHaskellDepends = [ base text unliftio ];
        description = "Write bots for Discord in Haskell";
@@ -84098,8 +84441,8 @@ self: {
        pname = "ed25519";
        version = "0.0.5.0";
        sha256 = "0v8msqvgzimhs7p5ri25hrb1ni2wvisl5rmdxy89fc59py79b9fq";
-       revision = "3";
-       editedCabalFile = "1yidh86ymzwmp2b449pwim6vvfcs1qgkkncbixw1zmb7wj6v167v";
+       revision = "4";
+       editedCabalFile = "1jr8v3kw69fdchnynflq3gz1bwx4jm5jpl7c00bnflrhkdrfbndn";
        libraryHaskellDepends = [ base bytestring ghc-prim ];
        testHaskellDepends = [
          base bytestring directory doctest filepath hlint QuickCheck
@@ -88034,8 +88377,8 @@ self: {
        pname = "errors";
        version = "2.3.0";
        sha256 = "0x8znwn31qcx6kqx99wp7bc86kckfb39ncz3zxvj1s07kxlfawk7";
-       revision = "1";
-       editedCabalFile = "08y607nwnw12vlbmwcppv1ydw726x8p3kwwx4rgaiss906hgnzrp";
+       revision = "2";
+       editedCabalFile = "1x1bhmkx7zxwdfassc9ypl9d319p6f14rv6d3mjgvac7nxfbq245";
        libraryHaskellDepends = [
          base exceptions safe text transformers transformers-compat
        ];
@@ -88987,6 +89330,8 @@ self: {
        pname = "evdev";
        version = "2.1.0";
        sha256 = "1gzf9hpsi2dmcgsifq5z91ing9b5k56mm2hx9wbsa180pmq30lj3";
+       revision = "1";
+       editedCabalFile = "0c930gd1a9pwlr4p9r9d9nizr90g06l836rai5b83z5sa0s3p01n";
        libraryHaskellDepends = [
          base bytestring containers extra filepath-bytestring monad-loops
          rawfilepath time unix
@@ -89005,17 +89350,16 @@ self: {
 
   "evdev-streamly" = callPackage
     ({ mkDerivation, base, bytestring, containers, evdev, extra
-     , posix-paths, rawfilepath, streamly, streamly-fsnotify, unix
+     , filepath-bytestring, rawfilepath, streamly, streamly-fsnotify
+     , unix
      }:
      mkDerivation {
        pname = "evdev-streamly";
-       version = "0.0.1.0";
-       sha256 = "1bzmxkg5y7w6v5l6q5vzhr19j5vwbx4p4qxdq72f7f714ihn8nyp";
-       revision = "1";
-       editedCabalFile = "02xnb49zwr39ziq2xrwnnddzxr1ppwig441i3074g1w0ng5cf2gj";
+       version = "0.0.2.0";
+       sha256 = "0vrkg3d1171lsr71k3vrcf9vbl18mdnvpi02sxvzjp2zbv3gs7v6";
        libraryHaskellDepends = [
-         base bytestring containers evdev extra posix-paths rawfilepath
-         streamly streamly-fsnotify unix
+         base bytestring containers evdev extra filepath-bytestring
+         rawfilepath streamly streamly-fsnotify unix
        ];
        description = "Bridge for working with evdev and streamly";
        license = lib.licenses.bsd3;
@@ -90781,16 +91125,16 @@ self: {
 
   "exploring-interpreters" = callPackage
     ({ mkDerivation, aeson, attoparsec, base, bytestring, containers
-     , fgl, http-types, mtl, network, readline, scientific, text
-     , transformers
+     , exceptions, fgl, haskeline, http-types, mtl, network, scientific
+     , text, transformers
      }:
      mkDerivation {
        pname = "exploring-interpreters";
-       version = "1.0.0.0";
-       sha256 = "11anvk0m8ihl2pgf3wmlw97hc886wg2rngvw86zwyd5hzg0chi66";
+       version = "1.3.0.0";
+       sha256 = "12a2z2z5c8kaqn7mks28ppazmkfvxn9lah6argmjqsd5ahwsxazs";
        libraryHaskellDepends = [
-         aeson attoparsec base bytestring containers fgl http-types mtl
-         network readline scientific text transformers
+         aeson attoparsec base bytestring containers exceptions fgl
+         haskeline http-types mtl network scientific text transformers
        ];
        description = "A generic exploring interpreter for exploratory programming";
        license = lib.licenses.bsd3;
@@ -96348,6 +96692,19 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
+  "flow_2_0_0_0" = callPackage
+    ({ mkDerivation, base, HUnit }:
+     mkDerivation {
+       pname = "flow";
+       version = "2.0.0.0";
+       sha256 = "03zhamnwni9y0div9lwdmw5nl63m6ykjppxhyhl95zknc0dml1vj";
+       libraryHaskellDepends = [ base ];
+       testHaskellDepends = [ base HUnit ];
+       description = "Write more understandable Haskell";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "flow-er" = callPackage
     ({ mkDerivation, base, doctest, flow, QuickCheck }:
      mkDerivation {
@@ -97741,19 +98098,13 @@ self: {
      }) {};
 
   "formatn" = callPackage
-    ({ mkDerivation, attoparsec, base, containers, doctest, foldl
-     , generic-lens, numhask, scientific, tdigest, text, transformers
-     }:
+    ({ mkDerivation, base, containers, text }:
      mkDerivation {
        pname = "formatn";
-       version = "0.0.1";
-       sha256 = "0rw1xli4df72wxylf211jhm0v2y842rfn8nalrp04yzklvyrri84";
-       libraryHaskellDepends = [
-         attoparsec base containers foldl generic-lens numhask scientific
-         tdigest text transformers
-       ];
-       testHaskellDepends = [ base doctest numhask ];
-       description = "Number text formatting";
+       version = "0.1.0";
+       sha256 = "1svixdvwzxmf5n6vx3pgx065z2gkabk563pp38bmp5z4mxvf67d9";
+       libraryHaskellDepends = [ base containers text ];
+       description = "Formatting of doubles";
        license = lib.licenses.bsd3;
        hydraPlatforms = lib.platforms.none;
        broken = true;
@@ -98001,8 +98352,8 @@ self: {
      }:
      mkDerivation {
        pname = "fortran-vars";
-       version = "0.1.0";
-       sha256 = "1j1k4paca1g6w38kd7fl1h4vzf6rb8ypdfilhkn2fk5llxkkw226";
+       version = "0.3.0";
+       sha256 = "0095ifc9psi2mv348qw7538rl1ld2drfq5pcsbdyxrhklm12h5ji";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -98183,25 +98534,23 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
-  "fourmolu_0_4_0_0" = callPackage
-    ({ mkDerivation, aeson, ansi-terminal, base, bytestring, Cabal
-     , containers, Diff, directory, dlist, exceptions, filepath
+  "fourmolu_0_5_0_0" = callPackage
+    ({ mkDerivation, aeson, ansi-terminal, array, base, bytestring
+     , Cabal, containers, Diff, directory, dlist, exceptions, filepath
      , ghc-lib-parser, gitrev, hspec, hspec-discover, HsYAML
      , HsYAML-aeson, mtl, optparse-applicative, path, path-io, syb
      , temporary, text
      }:
      mkDerivation {
        pname = "fourmolu";
-       version = "0.4.0.0";
-       sha256 = "1mq0h6nsl7ssfwh6zqhyja7w212vn8msmlm5iwwimca279hzwywb";
-       revision = "1";
-       editedCabalFile = "03bwhqj547brmgk191gy3k9xayi6fqqk2f5sbz3ail1bk7b73xnq";
+       version = "0.5.0.0";
+       sha256 = "0rw2mkhlzcbczhmn93sffmnwsbmn3j0y6np3wn5f72166vjfr02i";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
-         aeson ansi-terminal base bytestring Cabal containers Diff directory
-         dlist exceptions filepath ghc-lib-parser HsYAML HsYAML-aeson mtl
-         syb text
+         aeson ansi-terminal array base bytestring Cabal containers Diff
+         directory dlist exceptions filepath ghc-lib-parser HsYAML
+         HsYAML-aeson mtl syb text
        ];
        executableHaskellDepends = [
          base directory filepath ghc-lib-parser gitrev optparse-applicative
@@ -98515,8 +98864,8 @@ self: {
      }:
      mkDerivation {
        pname = "franz";
-       version = "0.5.2";
-       sha256 = "0mah7ghfzgg41iazvwpxzr6gc0afw30hsp6v3vg1vadnsp96nfnl";
+       version = "0.5.3";
+       sha256 = "034fz3k07l5sf9hd9c56646df9d570dv7lcdwlsf68a7hrd0icqb";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -98556,33 +98905,35 @@ self: {
 
   "freckle-app" = callPackage
     ({ mkDerivation, aeson, ansi-terminal, base, bytestring
-     , case-insensitive, conduit, data-default, datadog, directory
-     , doctest, ekg-core, errors, exceptions, fast-logger, filepath
-     , Glob, hspec, hspec-core, hspec-expectations-lifted
-     , hspec-junit-formatter, http-client, http-conduit
-     , http-link-header, http-types, immortal, iproute, lens, lens-aeson
-     , load-env, monad-control, monad-logger, MonadRandom, mtl, network
-     , network-uri, persistent, persistent-postgresql, postgresql-simple
-     , primitive, process, resource-pool, retry, rio, template-haskell
+     , case-insensitive, conduit, containers, data-default, datadog
+     , directory, doctest, ekg-core, errors, exceptions, fast-logger
+     , filepath, Glob, hashable, hspec, hspec-core
+     , hspec-expectations-lifted, hspec-junit-formatter, http-client
+     , http-conduit, http-link-header, http-types, immortal, iproute
+     , lens, lens-aeson, load-env, monad-control, monad-logger
+     , MonadRandom, mtl, network, network-uri, persistent
+     , persistent-postgresql, postgresql-simple, primitive, process
+     , resource-pool, retry, rio, safe, semigroupoids, template-haskell
      , temporary, text, time, transformers, transformers-base, unliftio
-     , unliftio-core, unordered-containers, wai, wai-extra, yaml, yesod
-     , yesod-core
+     , unliftio-core, unordered-containers, vector, wai, wai-extra, yaml
+     , yesod, yesod-core
      }:
      mkDerivation {
        pname = "freckle-app";
-       version = "1.0.2.2";
-       sha256 = "1n7fp40v8zac1b9gmq07c6d5lnbjh64ma0ykh35v87kd3jdrf9rk";
+       version = "1.0.2.3";
+       sha256 = "05khvp1gr3ngrcfz4ly9zjmxp8pdiyjmmbrc4pv2rrlpgmnj1zfk";
        libraryHaskellDepends = [
          aeson ansi-terminal base bytestring case-insensitive conduit
-         data-default datadog doctest ekg-core errors exceptions fast-logger
-         filepath Glob hspec hspec-core hspec-expectations-lifted
-         hspec-junit-formatter http-client http-conduit http-link-header
-         http-types immortal iproute lens load-env monad-control
-         monad-logger MonadRandom mtl network network-uri persistent
-         persistent-postgresql postgresql-simple primitive process
-         resource-pool retry rio template-haskell text time transformers
-         transformers-base unliftio unliftio-core unordered-containers wai
-         wai-extra yaml yesod yesod-core
+         containers data-default datadog doctest ekg-core errors exceptions
+         fast-logger filepath Glob hashable hspec hspec-core
+         hspec-expectations-lifted hspec-junit-formatter http-client
+         http-conduit http-link-header http-types immortal iproute lens
+         load-env monad-control monad-logger MonadRandom mtl network
+         network-uri persistent persistent-postgresql postgresql-simple
+         primitive process resource-pool retry rio safe semigroupoids
+         template-haskell text time transformers transformers-base unliftio
+         unliftio-core unordered-containers vector wai wai-extra yaml yesod
+         yesod-core
        ];
        testHaskellDepends = [
          aeson base bytestring directory hspec http-types lens lens-aeson
@@ -99100,6 +99451,32 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "freer-simple_1_2_1_2" = callPackage
+    ({ mkDerivation, base, criterion, extensible-effects, free, mtl
+     , natural-transformation, QuickCheck, tasty, tasty-hunit
+     , tasty-quickcheck, template-haskell, transformers-base
+     }:
+     mkDerivation {
+       pname = "freer-simple";
+       version = "1.2.1.2";
+       sha256 = "11ypffdkpaxc03hlik6ymilhnk41fy7m92zzwqjma97g614vn0lw";
+       isLibrary = true;
+       isExecutable = true;
+       libraryHaskellDepends = [
+         base natural-transformation template-haskell transformers-base
+       ];
+       executableHaskellDepends = [ base ];
+       testHaskellDepends = [
+         base QuickCheck tasty tasty-hunit tasty-quickcheck
+       ];
+       benchmarkHaskellDepends = [
+         base criterion extensible-effects free mtl
+       ];
+       description = "A friendly effect system for Haskell";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "freer-simple-catching" = callPackage
     ({ mkDerivation, base, freer-simple, hspec }:
      mkDerivation {
@@ -100417,8 +100794,8 @@ self: {
        pname = "functor-infix";
        version = "0.0.5";
        sha256 = "0rifm1p5zq2711vak2lyxzz2xs03saym3m3695wpf3zy38safbpn";
-       revision = "1";
-       editedCabalFile = "0nvk9hff0vd3s7q67pb4my5vfz1y954y0l8vlbbmdx9i20r1m8nf";
+       revision = "2";
+       editedCabalFile = "0ypnjnxwz4dpdhajqk8y67lrcwjgyc4lh1i3d3zjxmgr3zbym8d2";
        libraryHaskellDepends = [ base template-haskell ];
        description = "Infix operators for mapping over compositions of functors. Lots of them.";
        license = lib.licenses.mit;
@@ -100892,7 +101269,7 @@ self: {
        license = lib.licenses.isc;
      }) {};
 
-  "futhark_0_21_2" = callPackage
+  "futhark_0_21_4" = callPackage
     ({ mkDerivation, aeson, alex, ansi-terminal, array, base
      , base16-bytestring, binary, blaze-html, bmp, bytestring
      , bytestring-to-vector, cmark-gfm, containers, cryptohash-md5
@@ -100907,8 +101284,8 @@ self: {
      }:
      mkDerivation {
        pname = "futhark";
-       version = "0.21.2";
-       sha256 = "09cvyqkhwnp5h759j0rggp2i6n48hkb7ck8284d8ahkq3lh47isg";
+       version = "0.21.4";
+       sha256 = "0ij7sc9zq3l8i100kf7acwvrmqnq3f6x78wv5a7r8mfmb8bs51b3";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -105811,7 +106188,7 @@ self: {
        hydraPlatforms = lib.platforms.none;
      }) {};
 
-  "ghc-lib_9_2_1_20211101" = callPackage
+  "ghc-lib_9_2_1_20220109" = callPackage
     ({ mkDerivation, alex, array, base, binary, bytestring, containers
      , deepseq, directory, exceptions, filepath, ghc-lib-parser
      , ghc-prim, happy, hpc, parsec, pretty, process, rts, time
@@ -105819,8 +106196,8 @@ self: {
      }:
      mkDerivation {
        pname = "ghc-lib";
-       version = "9.2.1.20211101";
-       sha256 = "10rzvj7m6m664szxjaf3mk1v42lb4imwkrvpqn26x7p3jd7ywph0";
+       version = "9.2.1.20220109";
+       sha256 = "0858r81w2al9h9q53z4paqkf3fvxraf3ghvb4ga4kilxiq5rp8z6";
        enableSeparateDataOutput = true;
        libraryHaskellDepends = [
          array base binary bytestring containers deepseq directory
@@ -105873,15 +106250,15 @@ self: {
        hydraPlatforms = lib.platforms.none;
      }) {};
 
-  "ghc-lib-parser_9_2_1_20211101" = callPackage
+  "ghc-lib-parser_9_2_1_20220109" = callPackage
     ({ mkDerivation, alex, array, base, binary, bytestring, containers
      , deepseq, directory, exceptions, filepath, ghc-prim, happy, parsec
      , pretty, process, time, transformers, unix
      }:
      mkDerivation {
        pname = "ghc-lib-parser";
-       version = "9.2.1.20211101";
-       sha256 = "0dxhpczlpppdsmn1cnz2minpkvlz27njzv7xcbqgfgl0bvp5wx0n";
+       version = "9.2.1.20220109";
+       sha256 = "0scm320w19lm40y2i1858h24704s9hvci37pxmlraxa0virjhcx6";
        enableSeparateDataOutput = true;
        libraryHaskellDepends = [
          array base binary bytestring containers deepseq directory
@@ -106430,21 +106807,20 @@ self: {
      }) {};
 
   "ghc-tags-core" = callPackage
-    ({ mkDerivation, attoparsec, base, bytestring, cpphs, criterion
-     , deepseq, directory, filepath, filepath-bytestring, ghc, lattices
-     , mtl, pipes, pipes-attoparsec, pipes-bytestring, QuickCheck
+    ({ mkDerivation, attoparsec, base, bytestring, criterion, deepseq
+     , directory, filepath, filepath-bytestring, ghc, lattices, mtl
+     , pipes, pipes-attoparsec, pipes-bytestring, QuickCheck
      , quickcheck-instances, tasty, tasty-golden, tasty-quickcheck, text
      , transformers
      }:
      mkDerivation {
        pname = "ghc-tags-core";
-       version = "0.3.0.0";
-       sha256 = "035k7akyhhn5jf2231ahplgggymc8h8k2kxia6i22v9cv976zgna";
+       version = "0.3.1.0";
+       sha256 = "052ylgf0sjwmkf1p1lzsisk9j1dgwpjgw1n81bnfhvlvarhncavq";
        libraryHaskellDepends = [
          attoparsec base bytestring directory filepath-bytestring ghc mtl
          pipes pipes-attoparsec pipes-bytestring text transformers
        ];
-       libraryToolDepends = [ cpphs ];
        testHaskellDepends = [
          attoparsec base bytestring directory filepath filepath-bytestring
          lattices mtl pipes QuickCheck quickcheck-instances tasty
@@ -106468,8 +106844,8 @@ self: {
      }:
      mkDerivation {
        pname = "ghc-tags-plugin";
-       version = "0.3.0.0";
-       sha256 = "1d39jnz79vlxqqg2bw3cj1djii3bkmayqs4sm2a6bs5xzsplc5w3";
+       version = "0.4.0.0";
+       sha256 = "078l3m6sl60ilqj25zd9sqjjpss348ylsbz8l7bvhf45n91gx6yn";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -106486,8 +106862,8 @@ self: {
     ({ mkDerivation, base, ghc, transformers }:
      mkDerivation {
        pname = "ghc-tcplugin-api";
-       version = "0.7.0.0";
-       sha256 = "0lnvfahphrkvg4r0r5imxqjj0a5bb5cpcx85svw4g4y9p13i94jh";
+       version = "0.7.1.0";
+       sha256 = "02qmqmhlcfn53hs7wl92r65r6dcg01fdrwqn4capjlxs1bdsfpbr";
        libraryHaskellDepends = [ base ghc transformers ];
        description = "An API for type-checker plugins";
        license = lib.licenses.bsd3;
@@ -106601,6 +106977,8 @@ self: {
        pname = "ghc-typelits-natnormalise";
        version = "0.7.6";
        sha256 = "09d70iw58m5g6yi8k2b52f1g0pfdqm5fzhs8rd7fgrgmi70np9bx";
+       revision = "1";
+       editedCabalFile = "1b587pryjkbvgayqwm8cn7ljmcyd4jikrxxkgm6zq1v9qhi7xy22";
        libraryHaskellDepends = [
          base containers ghc ghc-tcplugins-extra integer-gmp transformers
        ];
@@ -110335,6 +110713,30 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
+  "github-release_2_0_0_0" = callPackage
+    ({ mkDerivation, aeson, base, burrito, bytestring, http-client
+     , http-client-tls, http-types, mime-types, optparse-generic, text
+     , unordered-containers
+     }:
+     mkDerivation {
+       pname = "github-release";
+       version = "2.0.0.0";
+       sha256 = "03bvbqpaa3xp9rnmg8a95qs9j7chng1xsk53f30520m1cfyyikgq";
+       isLibrary = true;
+       isExecutable = true;
+       libraryHaskellDepends = [
+         aeson base burrito bytestring http-client http-client-tls
+         http-types mime-types optparse-generic text unordered-containers
+       ];
+       executableHaskellDepends = [
+         aeson base burrito bytestring http-client http-client-tls
+         http-types mime-types optparse-generic text unordered-containers
+       ];
+       description = "Upload files to GitHub releases";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "github-rest" = callPackage
     ({ mkDerivation, aeson, aeson-qq, base, bytestring, http-client
      , http-client-tls, http-types, jwt, mtl, scientific, tasty
@@ -119428,8 +119830,8 @@ self: {
        pname = "hackage-security";
        version = "0.6.0.1";
        sha256 = "05rgz31cmp52137j4jk0074z8lfgk8mrf2x56bzw28asmxrv8qli";
-       revision = "8";
-       editedCabalFile = "1xpzcdpfz0agbv75sadsylq6r8pq7zr0pyzbzrz0nz130yixsv5f";
+       revision = "9";
+       editedCabalFile = "14g1zr05qcvrn5ghhjmk6pz9h2ypa84bgqddxm0sk0qxbzpnxmqi";
        libraryHaskellDepends = [
          base base16-bytestring base64-bytestring bytestring Cabal
          containers cryptohash-sha256 directory ed25519 filepath ghc-prim
@@ -123150,7 +123552,7 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
-  "hashable_1_4_0_1" = callPackage
+  "hashable_1_4_0_2" = callPackage
     ({ mkDerivation, base, base-orphans, bytestring, containers
      , deepseq, ghc-prim, HUnit, integer-gmp, QuickCheck, random
      , test-framework, test-framework-hunit, test-framework-quickcheck2
@@ -123158,10 +123560,8 @@ self: {
      }:
      mkDerivation {
        pname = "hashable";
-       version = "1.4.0.1";
-       sha256 = "04v61w87hvm6lg9a7p5mz177iab3rvb86pzcclcdw0w314dsxpaw";
-       revision = "1";
-       editedCabalFile = "1rcvw4fjm3v29phg0q54x8358c4qvg1y8cwy6lqzmg1kvhd9qp63";
+       version = "1.4.0.2";
+       sha256 = "003nlhi8wzlsikfwi0q6ma3b38wizvazci6dbq3lr4bd6pfnwq43";
        libraryHaskellDepends = [
          base base-orphans bytestring containers deepseq ghc-prim
          integer-gmp text
@@ -123996,8 +124396,8 @@ self: {
      }:
      mkDerivation {
        pname = "haskell-ci";
-       version = "0.12.1";
-       sha256 = "0bdb3x2kk5nqm6ly2ycdpx6xw7pspgg67x73cjscqj6pxcx1wjzf";
+       version = "0.14";
+       sha256 = "1vaxbby4sfrzzr0bzw6dv3kb9f6k3i4w16xfxvm3h2jazrw56122";
        isLibrary = false;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -126793,8 +127193,8 @@ self: {
      }:
      mkDerivation {
        pname = "haskoin-store";
-       version = "0.64.10";
-       sha256 = "16dslrdkl4dw7ywjf181mr8vnrjwz9yrc03jr80c704vc0034ymj";
+       version = "0.64.16";
+       sha256 = "13dbx5szx87zhb5xq007lbpisr94593sf3a144a5052pbghcyj4s";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -126841,8 +127241,8 @@ self: {
      }:
      mkDerivation {
        pname = "haskoin-store-data";
-       version = "0.64.10";
-       sha256 = "01nlxy8s37nizvliq6167aaiqy4nl7an3qnhka0pnzawlvn6hdhk";
+       version = "0.64.16";
+       sha256 = "01fgnbvwhxz4829ksv01165bvnhqyd3djjqm96819jp5r1ifzjin";
        libraryHaskellDepends = [
          aeson base binary bytes bytestring cereal containers data-default
          deepseq hashable haskoin-core http-client http-types lens mtl
@@ -128116,8 +128516,8 @@ self: {
      }:
      mkDerivation {
        pname = "hasql-th";
-       version = "0.4.0.10";
-       sha256 = "1s339xkqdz1hcd8i183lzf565radl95zqq0y7h2r2ayz3rh36485";
+       version = "0.4.0.11";
+       sha256 = "1dkx0r874qzn2kb8wimr1n75vmx70jx5ddi8088dlw5cxhj2v950";
        libraryHaskellDepends = [
          base bytestring containers contravariant foldl hasql
          postgresql-syntax template-haskell template-haskell-compat-v0208
@@ -133572,18 +133972,18 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
-  "hie-bios_0_8_0" = callPackage
+  "hie-bios_0_8_1" = callPackage
     ({ mkDerivation, aeson, base, base16-bytestring, bytestring
      , conduit, conduit-extra, containers, cryptohash-sha1, deepseq
      , directory, exceptions, extra, file-embed, filepath, ghc, hslogger
-     , hspec-expectations, optparse-applicative, process, tasty
-     , tasty-expected-failure, tasty-hunit, temporary, text, time
-     , transformers, unix-compat, unordered-containers, vector, yaml
+     , optparse-applicative, process, tasty, tasty-expected-failure
+     , tasty-hunit, temporary, text, time, transformers, unix-compat
+     , unordered-containers, vector, yaml
      }:
      mkDerivation {
        pname = "hie-bios";
-       version = "0.8.0";
-       sha256 = "1apy7zdafrw96f7sbhhq62hlk4blcsi4kc4kq59wcm2yvj134rvv";
+       version = "0.8.1";
+       sha256 = "1rd0aasab8z8ilwyzngvs99wbb861hlmc8bmmnnfgd742xldxs2q";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -133596,7 +133996,7 @@ self: {
          base directory filepath ghc optparse-applicative
        ];
        testHaskellDepends = [
-         aeson base directory extra filepath ghc hspec-expectations tasty
+         aeson base directory extra filepath ghc tasty
          tasty-expected-failure tasty-hunit temporary text
          unordered-containers yaml
        ];
@@ -137559,8 +137959,8 @@ self: {
      }:
      mkDerivation {
        pname = "hnix";
-       version = "0.14.0.5";
-       sha256 = "1h2m9vrgss4mg25dyfwhb93h1c60nrkw122b7hnpiff5lm1jy89f";
+       version = "0.14.0.7";
+       sha256 = "1irwfq4gx5rzryqp8hh2cwf3c4cz9pmilbc2qhb3h609bfn5rwlq";
        isLibrary = true;
        isExecutable = true;
        enableSeparateDataOutput = true;
@@ -140154,8 +140554,8 @@ self: {
      }:
      mkDerivation {
        pname = "hpqtypes-extras";
-       version = "1.14.0.0";
-       sha256 = "143ghr188d9kp0cz421pr87sdvf2nzabp76b3py716xmrz9jckq5";
+       version = "1.14.1.0";
+       sha256 = "17ixli3w1ixa7hspvcgggyslpxgprl40vjjavi81c44crj7w4m4q";
        libraryHaskellDepends = [
          base base16-bytestring bytestring containers cryptohash exceptions
          extra fields-json hpqtypes lifted-base log-base monad-control mtl
@@ -140674,21 +141074,21 @@ self: {
        license = lib.licenses.bsd3;
      }) {inherit (pkgs) ruby;};
 
-  "hruby_0_4_0_0" = callPackage
+  "hruby_0_5_0_0" = callPackage
     ({ mkDerivation, aeson, attoparsec, base, bytestring, Cabal
      , process, QuickCheck, ruby, scientific, stm, text
      , unordered-containers, vector
      }:
      mkDerivation {
        pname = "hruby";
-       version = "0.4.0.0";
-       sha256 = "0qd3mfc8mr5b0vmvfqnmjrba5abvwb4vn6mjlm0mhlgigmh685f9";
+       version = "0.5.0.0";
+       sha256 = "10ldq23lgp3jcxpdm9b1dryjf4sprsjlc4qs1lnjb9cmfcafrqj4";
        setupHaskellDepends = [ base Cabal process ];
        libraryHaskellDepends = [
          aeson attoparsec base bytestring scientific stm text
          unordered-containers vector
        ];
-       librarySystemDepends = [ ruby ];
+       libraryPkgconfigDepends = [ ruby ];
        testHaskellDepends = [
          aeson attoparsec base QuickCheck text vector
        ];
@@ -141412,8 +141812,8 @@ self: {
      }:
      mkDerivation {
        pname = "hs-opentelemetry-sdk";
-       version = "0.0.3.0";
-       sha256 = "0z9fwppsgyrw56r4fcb0ds06rvn2vskmc3l7fhkdb47j71fill58";
+       version = "0.0.3.1";
+       sha256 = "0z4j2jih8076xic39kil0w0p6vcjbpcmpbfiskx2i7ycm2cg4gs2";
        libraryHaskellDepends = [
          async base bytestring hs-opentelemetry-api
          hs-opentelemetry-exporter-otlp hs-opentelemetry-propagator-w3c
@@ -141733,6 +142133,26 @@ self: {
        broken = true;
      }) {};
 
+  "hs-tags_0_1_5_3" = callPackage
+    ({ mkDerivation, base, Cabal, containers, directory, filepath, ghc
+     , ghc-paths, mtl, process, strict
+     }:
+     mkDerivation {
+       pname = "hs-tags";
+       version = "0.1.5.3";
+       sha256 = "17h1jgi7nr6p93zhsqxx6gx1yjwv0gahz84pw14gnsr79v3q9z1f";
+       isLibrary = false;
+       isExecutable = true;
+       executableHaskellDepends = [
+         base Cabal containers directory filepath ghc ghc-paths mtl process
+         strict
+       ];
+       description = "Create tag files (ctags and etags) for Haskell code";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+       broken = true;
+     }) {};
+
   "hs-term-emulator" = callPackage
     ({ mkDerivation, ansi-terminal, attoparsec, base, bytestring
      , containers, criterion, hspec, hspec-discover, lens, text, vector
@@ -144765,6 +145185,23 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
+  "hspec-expectations-pretty-diff_0_7_2_6" = callPackage
+    ({ mkDerivation, aeson, ansi-terminal, base, Diff, hscolour, hspec
+     , HUnit, nicify-lib, text, unicode-show
+     }:
+     mkDerivation {
+       pname = "hspec-expectations-pretty-diff";
+       version = "0.7.2.6";
+       sha256 = "0wksgvdj50yc3p4bg3wmacf2w75v7p8nlq1g33z5amrwllig6m49";
+       libraryHaskellDepends = [
+         ansi-terminal base Diff hscolour HUnit nicify-lib text unicode-show
+       ];
+       testHaskellDepends = [ aeson base hspec HUnit text ];
+       description = "Catchy combinators for HUnit";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "hspec-experimental" = callPackage
     ({ mkDerivation, base, hspec, hspec-meta, HUnit, QuickCheck }:
      mkDerivation {
@@ -148923,28 +149360,30 @@ self: {
   "hup" = callPackage
     ({ mkDerivation, base, bytestring, cmdargs, directory, filepath
      , hspec, hspec-core, hspec-wai, http-client, http-client-tls
-     , http-types, mtl, QuickCheck, shelly, simple, split, tagsoup, tar
-     , temporary, text, transformers, wai, wai-extra, zlib
+     , http-types, lifted-base, mtl, network, QuickCheck, scotty, shelly
+     , split, tagsoup, tar, temporary, text, transformers, vector, wai
+     , wai-extra, warp, zlib
      }:
      mkDerivation {
        pname = "hup";
-       version = "0.3.0.2";
-       sha256 = "05xgbdzy3jg9qpxrxrfb6mjydw80wa65gkjcpqj2ckmk0vd6hmhr";
+       version = "0.3.0.3";
+       sha256 = "0igs4w546zqpav40c3v99lfi8gix70ssx97b0dnq6fw6c02kacq9";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
          base bytestring directory filepath http-client http-client-tls
-         http-types mtl split tar zlib
+         http-types mtl split tar text zlib
        ];
        executableHaskellDepends = [
-         base bytestring cmdargs directory mtl shelly tagsoup text
-         transformers
+         base bytestring cmdargs directory lifted-base mtl shelly tagsoup
+         text transformers
        ];
        testHaskellDepends = [
          base bytestring filepath hspec hspec-core hspec-wai http-client
-         http-types QuickCheck simple temporary transformers wai wai-extra
+         http-types mtl network QuickCheck scotty temporary text
+         transformers vector wai wai-extra warp
        ];
-       description = "Upload packages or documentation to a hackage server";
+       description = "Upload packages and/or documentation to a hackage server";
        license = lib.licenses.bsd2;
        hydraPlatforms = lib.platforms.none;
        broken = true;
@@ -149894,6 +150333,31 @@ self: {
        license = lib.licenses.mit;
      }) {inherit (pkgs) rdkafka;};
 
+  "hw-kafka-client_5_0_0" = callPackage
+    ({ mkDerivation, base, bifunctors, bytestring, c2hs, containers
+     , either, hspec, hspec-discover, monad-loops, rdkafka, text
+     , transformers, unix
+     }:
+     mkDerivation {
+       pname = "hw-kafka-client";
+       version = "5.0.0";
+       sha256 = "1w0c80pn43xg4rrmwwq37yya96fil124sdly9djjnxm1g0brwjz6";
+       isLibrary = true;
+       isExecutable = true;
+       libraryHaskellDepends = [
+         base bifunctors bytestring containers text transformers unix
+       ];
+       librarySystemDepends = [ rdkafka ];
+       libraryToolDepends = [ c2hs ];
+       testHaskellDepends = [
+         base bifunctors bytestring containers either hspec monad-loops text
+       ];
+       testToolDepends = [ hspec-discover ];
+       description = "Kafka bindings for Haskell";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {inherit (pkgs) rdkafka;};
+
   "hw-kafka-conduit" = callPackage
     ({ mkDerivation, base, bifunctors, bytestring, conduit
      , conduit-extra, containers, exceptions, extra, hspec
@@ -153814,12 +154278,16 @@ self: {
      }) {};
 
   "include-env" = callPackage
-    ({ mkDerivation, base, template-haskell }:
+    ({ mkDerivation, base, containers, template-haskell
+     , th-lift-instances
+     }:
      mkDerivation {
        pname = "include-env";
-       version = "0.4.0.0";
-       sha256 = "0swq7fzij24wmqid0zb7hz6v4q8nm3qvd741wd183lidrkisgpf0";
-       libraryHaskellDepends = [ base template-haskell ];
+       version = "0.5.0.0";
+       sha256 = "1jcq2hnak3mwxxpqp81gh8adm97czip0fb7h92k6n8sxrbvf4b1c";
+       libraryHaskellDepends = [
+         base containers template-haskell th-lift-instances
+       ];
        description = "Include the value of an environment variable at compile time";
        license = lib.licenses.bsd3;
      }) {};
@@ -155868,8 +156336,8 @@ self: {
      }:
      mkDerivation {
        pname = "interval-algebra";
-       version = "1.1.2";
-       sha256 = "0cnzlsmqg6snvggq7fh2c6hmjaijxqz8ng0lnzfyz8p3lk4p42zi";
+       version = "1.2.0";
+       sha256 = "1n9db9p3v7da1d3j21lrm46s2py0m1rdfjpvilx43n7yd6630i81";
        libraryHaskellDepends = [
          base containers foldl QuickCheck safe time witherable
        ];
@@ -156615,6 +157083,20 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "ip6addr_1_0_3" = callPackage
+    ({ mkDerivation, base, cmdargs, IPv6Addr, text }:
+     mkDerivation {
+       pname = "ip6addr";
+       version = "1.0.3";
+       sha256 = "16dbvrsbg7l4z31faxm1pxps0plg89d4ny2mxsgwyq8r351irmwc";
+       isLibrary = false;
+       isExecutable = true;
+       executableHaskellDepends = [ base cmdargs IPv6Addr text ];
+       description = "Commandline tool to deal with IPv6 address text representations";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "ipa" = callPackage
     ({ mkDerivation, attoparsec, base, hspec, template-haskell, text
      , unicode-transforms
@@ -156869,6 +157351,28 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "ipynb_0_2" = callPackage
+    ({ mkDerivation, aeson, base, base64-bytestring, bytestring
+     , containers, directory, filepath, microlens, microlens-aeson
+     , tasty, tasty-hunit, text, unordered-containers
+     }:
+     mkDerivation {
+       pname = "ipynb";
+       version = "0.2";
+       sha256 = "1iwia4sxg40m4d290gys72wabqmkqx24ywsaranwzk2wx5s3sx4s";
+       libraryHaskellDepends = [
+         aeson base base64-bytestring bytestring containers text
+         unordered-containers
+       ];
+       testHaskellDepends = [
+         aeson base bytestring directory filepath microlens microlens-aeson
+         tasty tasty-hunit text
+       ];
+       description = "Data structure for working with Jupyter notebooks (ipynb)";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "ipython-kernel" = callPackage
     ({ mkDerivation, aeson, base, binary, bytestring, containers
      , cryptonite, directory, filepath, memory, parsec, process
@@ -157280,6 +157784,19 @@ self: {
        license = lib.licenses.asl20;
      }) {};
 
+  "isbn_1_1_0_3" = callPackage
+    ({ mkDerivation, base, hspec, QuickCheck, text }:
+     mkDerivation {
+       pname = "isbn";
+       version = "1.1.0.3";
+       sha256 = "16srdvsjsiqzcm0hb3rhwry1vr170fz85g84wk6nyk1glbva4bga";
+       libraryHaskellDepends = [ base text ];
+       testHaskellDepends = [ base hspec QuickCheck text ];
+       description = "ISBN Validation and Manipulation";
+       license = lib.licenses.asl20;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "isdicom" = callPackage
     ({ mkDerivation, base, directory, doctest, filepath, QuickCheck
      , template-haskell
@@ -157495,8 +158012,8 @@ self: {
     ({ mkDerivation, base, bytestring, text }:
      mkDerivation {
        pname = "isocline";
-       version = "1.0.6";
-       sha256 = "0yxnylxmim43a4gc8hnz32gv3p1mzfx5v0j0pn2frn3xhjx9mxhn";
+       version = "1.0.7";
+       sha256 = "0pcvi7rq6v32q6zqcl7fh7ncbjd2qirhb4z380x2d57qal5lk1lv";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [ base bytestring text ];
@@ -158392,6 +158909,33 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "jacinda" = callPackage
+    ({ mkDerivation, alex, array, base, bytestring, containers, happy
+     , microlens, microlens-mtl, mtl, optparse-applicative
+     , prettyprinter, recursion, regex-rure, tasty, tasty-hunit, text
+     , transformers, vector
+     }:
+     mkDerivation {
+       pname = "jacinda";
+       version = "0.2.0.0";
+       sha256 = "17kayg0xlfm0a037kg2h0hyrjnzwaxkkjmf08pid8vqaq14x0p1g";
+       isLibrary = false;
+       isExecutable = true;
+       libraryHaskellDepends = [
+         array base bytestring containers microlens microlens-mtl mtl
+         prettyprinter recursion regex-rure text transformers vector
+       ];
+       libraryToolDepends = [ alex happy ];
+       executableHaskellDepends = [
+         base bytestring optparse-applicative
+       ];
+       testHaskellDepends = [ base bytestring tasty tasty-hunit ];
+       doHaddock = false;
+       description = "Functional, expression-oriented data processing language";
+       license = lib.licenses.agpl3Only;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "jack" = callPackage
     ({ mkDerivation, array, base, bytestring, enumset, event-list
      , explicit-exception, libjack2, midi, non-negative, semigroups
@@ -160130,6 +160674,26 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
+  "json-feed_2_0_0_0" = callPackage
+    ({ mkDerivation, aeson, base, bytestring, filepath, hspec
+     , mime-types, network-uri, tagsoup, text, time
+     }:
+     mkDerivation {
+       pname = "json-feed";
+       version = "2.0.0.0";
+       sha256 = "1d2xjyi5b6v5sq0g4aayirfjj4l7lskwv28w6601dxwz7yrsp234";
+       libraryHaskellDepends = [
+         aeson base bytestring mime-types network-uri tagsoup text time
+       ];
+       testHaskellDepends = [
+         aeson base bytestring filepath hspec mime-types network-uri tagsoup
+         text time
+       ];
+       description = "JSON Feed";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "json-fu" = callPackage
     ({ mkDerivation, aeson, attoparsec, base, bytestring, containers
      , hashable, hspec, mtl, syb, text, time, unordered-containers
@@ -160280,7 +160844,7 @@ self: {
        license = lib.licenses.mit;
        hydraPlatforms = lib.platforms.none;
        broken = true;
-     }) {inherit (pkgs) python;};
+     }) {python = null;};
 
   "json-qq" = callPackage
     ({ mkDerivation, base, haskell-src-meta, parsec, template-haskell
@@ -160871,6 +161435,28 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "jsonpath_0_2_1_0" = callPackage
+    ({ mkDerivation, aeson, aeson-casing, attoparsec, base, bytestring
+     , file-embed, hspec, hspec-attoparsec, hspec-discover, text
+     , unordered-containers, vector
+     }:
+     mkDerivation {
+       pname = "jsonpath";
+       version = "0.2.1.0";
+       sha256 = "1d9h6j0xzrpxc56wym9b0sdanpw1v2rcx1sdm49h6iriwwmckb10";
+       libraryHaskellDepends = [
+         aeson attoparsec base text unordered-containers vector
+       ];
+       testHaskellDepends = [
+         aeson aeson-casing attoparsec base bytestring file-embed hspec
+         hspec-attoparsec text unordered-containers vector
+       ];
+       testToolDepends = [ hspec-discover ];
+       description = "Library to parse and execute JSONPath";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "jsonresume" = callPackage
     ({ mkDerivation, aeson, base, bytestring, old-locale, text, time
      , unordered-containers
@@ -163889,6 +164475,28 @@ self: {
        broken = true;
      }) {};
 
+  "koji-tool" = callPackage
+    ({ mkDerivation, base, directory, extra, filepath, format-numbers
+     , Glob, http-directory, koji, pretty-simple, rpm-nvr, simple-cmd
+     , simple-cmd-args, text, time, xdg-userdirs
+     }:
+     mkDerivation {
+       pname = "koji-tool";
+       version = "0.6.1";
+       sha256 = "1l2w0dcy4fcv865z27661j7jmfy3blf8q321mv18dn44f3wr0xax";
+       isLibrary = false;
+       isExecutable = true;
+       executableHaskellDepends = [
+         base directory extra filepath format-numbers Glob http-directory
+         koji pretty-simple rpm-nvr simple-cmd simple-cmd-args text time
+         xdg-userdirs
+       ];
+       testHaskellDepends = [ base simple-cmd ];
+       description = "Koji CLI tool for querying tasks and installing builds";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "kontra-config" = callPackage
     ({ mkDerivation, base, bytestring, data-default, exceptions, text
      , transformers-base, unjson, utf8-string, yaml
@@ -164530,6 +165138,19 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
+  "lackey_2_0_0_0" = callPackage
+    ({ mkDerivation, base, hspec, servant, servant-foreign, text }:
+     mkDerivation {
+       pname = "lackey";
+       version = "2.0.0.0";
+       sha256 = "06ad35nmppblqb7400563l5qk3zna6l3kasp5ng0iacgmqzmvcrv";
+       libraryHaskellDepends = [ base servant-foreign text ];
+       testHaskellDepends = [ base hspec servant servant-foreign text ];
+       description = "Generate Ruby clients from Servant APIs";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "lacroix" = callPackage
     ({ mkDerivation, base }:
      mkDerivation {
@@ -167593,8 +168214,8 @@ self: {
      }:
      mkDerivation {
        pname = "lazy-async";
-       version = "1.0.0.0";
-       sha256 = "0kk8pzwm04z4jljl38gd0n03nkxw3mxg8rg93ka0rvnibfwm8dda";
+       version = "1.0.0.1";
+       sha256 = "1nw24hfpw0wd099lxjsi1iqssbb7yw6isilkv4a68agv2q1ranvk";
        libraryHaskellDepends = [
          base exceptions lifted-async monad-control rank2classes stm
          transformers transformers-base
@@ -172703,6 +173324,18 @@ self: {
        license = lib.licenses.isc;
      }) {};
 
+  "list-singleton_2_0_0_0" = callPackage
+    ({ mkDerivation, base }:
+     mkDerivation {
+       pname = "list-singleton";
+       version = "2.0.0.0";
+       sha256 = "1mv2567as9vsnrqp23dzb7rlvcmid484rk94nrrfl8za97i1s4c0";
+       libraryHaskellDepends = [ base ];
+       description = "Easily and clearly create lists with only one element in them";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "list-t" = callPackage
     ({ mkDerivation, base, base-prelude, foldl, HTF, logict, mmorph
      , monad-control, mtl, mtl-prelude, semigroups, transformers
@@ -173982,12 +174615,25 @@ self: {
        license = lib.licenses.asl20;
      }) {};
 
+  "loc_0_1_3_16" = callPackage
+    ({ mkDerivation, base, containers, doctest, hedgehog }:
+     mkDerivation {
+       pname = "loc";
+       version = "0.1.3.16";
+       sha256 = "0bizqfczhc5higdzrrhinr5q3s971a3klfl3gpffnq9gyzd16nrq";
+       libraryHaskellDepends = [ base containers ];
+       testHaskellDepends = [ base containers doctest hedgehog ];
+       description = "Types representing line and column positions and ranges in text files";
+       license = lib.licenses.asl20;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "loc-test" = callPackage
     ({ mkDerivation, base, containers, hedgehog, loc }:
      mkDerivation {
        pname = "loc-test";
-       version = "0.1.3.8";
-       sha256 = "0jg6p0lfd5xgrwbmlskj5f1x8l5b0b3dqh460ds2nii8isccgvcq";
+       version = "0.1.3.10";
+       sha256 = "0mppiz4nv86mfdk43w83jx3wn8c6w7g9k3m3jhgmwlgqpcpdrryd";
        libraryHaskellDepends = [ base containers hedgehog loc ];
        description = "Test-related utilities related to the /loc/ package";
        license = lib.licenses.asl20;
@@ -176226,12 +176872,12 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
-  "lucid-alpine_0_1_0_4" = callPackage
+  "lucid-alpine_0_1_0_5" = callPackage
     ({ mkDerivation, base, lucid, text }:
      mkDerivation {
        pname = "lucid-alpine";
-       version = "0.1.0.4";
-       sha256 = "1pr2fg5r43jvgh694lhqbmwl1dida9ymgw161j16dcj66jx8fjk6";
+       version = "0.1.0.5";
+       sha256 = "1prcr3rfpg3saybfjmfik9xznj0knvfxy5dwllkq6s5szi2bqyaz";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [ base lucid text ];
@@ -176309,12 +176955,12 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
-  "lucid-htmx_0_1_0_3" = callPackage
+  "lucid-htmx_0_1_0_4" = callPackage
     ({ mkDerivation, base, lucid, servant, text }:
      mkDerivation {
        pname = "lucid-htmx";
-       version = "0.1.0.3";
-       sha256 = "1fgb4gika5f3bbba2as4bkg6m8nn2w25k17m45b389rwmhyg6syj";
+       version = "0.1.0.4";
+       sha256 = "0rq25ixsyvnp3zh3wsfmijlyv4dg94d1k1bhhwq8y624v819yg8r";
        libraryHaskellDepends = [ base lucid servant text ];
        testHaskellDepends = [ base lucid servant text ];
        description = "Use htmx in your lucid templates";
@@ -179836,22 +180482,22 @@ self: {
   "matrix-client" = callPackage
     ({ mkDerivation, aeson, aeson-casing, aeson-pretty, base, base64
      , bytestring, containers, exceptions, hashable, hspec, http-client
-     , http-client-tls, http-types, retry, SHA, text, time
+     , http-client-tls, http-types, profunctors, retry, SHA, text, time
      , unordered-containers
      }:
      mkDerivation {
        pname = "matrix-client";
-       version = "0.1.2.0";
-       sha256 = "18n5il56p3hr6iax2d1m0b7vximc0z4jzj0dav0rhv3yrwy8p5w2";
+       version = "0.1.3.0";
+       sha256 = "14vsz507l93zdddr3k6rwvqwpwdmsansv5ryq87k58v04fyfmvz6";
        libraryHaskellDepends = [
          aeson aeson-casing base base64 bytestring containers exceptions
-         hashable http-client http-client-tls http-types retry SHA text time
-         unordered-containers
+         hashable http-client http-client-tls http-types profunctors retry
+         SHA text time unordered-containers
        ];
        testHaskellDepends = [
          aeson aeson-casing aeson-pretty base base64 bytestring containers
          exceptions hashable hspec http-client http-client-tls http-types
-         retry SHA text time unordered-containers
+         profunctors retry SHA text time unordered-containers
        ];
        description = "A matrix client library";
        license = lib.licenses.asl20;
@@ -181536,6 +182182,8 @@ self: {
        pname = "memory-cd";
        version = "0.16.0.1";
        sha256 = "05dkgkms159k4mk4l1ngcnxqs2hbnzmh9zv3gks0cx7wba6qyrf1";
+       revision = "1";
+       editedCabalFile = "1kja8j32h1ff6vkn3smj88k4gzgi0il8kv47cm8hwgn0v0cjjy9f";
        libraryHaskellDepends = [
          base basement-cd bytestring deepseq ghc-prim
        ];
@@ -184106,8 +184754,8 @@ self: {
      }:
      mkDerivation {
        pname = "mit-3qvpPyAi6mH";
-       version = "6";
-       sha256 = "1bwnpf7jvbc8z7aipw0fvkgjq1mmwn1xmm6vaaipf3ami10gpfn5";
+       version = "7";
+       sha256 = "1asr82fnqpb936kfj8fnilas76l5r5ndylvzf1van2z57sxjx9ba";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -187327,20 +187975,24 @@ self: {
      }) {};
 
   "monoid-statistics" = callPackage
-    ({ mkDerivation, base, math-functions, QuickCheck, tasty
-     , tasty-quickcheck, vector, vector-th-unbox
+    ({ mkDerivation, base, criterion, doctest, exceptions
+     , math-functions, mwc-random, QuickCheck, tasty
+     , tasty-expected-failure, tasty-hunit, tasty-quickcheck, vector
+     , vector-th-unbox
      }:
      mkDerivation {
        pname = "monoid-statistics";
-       version = "1.0.1.0";
-       sha256 = "1krgyvshvw28ld89hb1qpjx8jiz40a8yq2q3zglrir4vfch5cyx9";
-       revision = "1";
-       editedCabalFile = "14p36fz2yssx92imqggv5xrsnqqhhh3xj2ba96v47fm2dglgfsrv";
+       version = "1.1.0";
+       sha256 = "12q86bh057pn040wdr39wlq066mcffpgsx71jy5h8rj02qi4b78f";
        libraryHaskellDepends = [
-         base math-functions vector vector-th-unbox
+         base exceptions math-functions vector vector-th-unbox
        ];
        testHaskellDepends = [
-         base math-functions QuickCheck tasty tasty-quickcheck
+         base doctest math-functions QuickCheck tasty tasty-expected-failure
+         tasty-hunit tasty-quickcheck
+       ];
+       benchmarkHaskellDepends = [
+         base criterion math-functions mwc-random vector
        ];
        description = "Monoids for calculation of statistics of sample";
        license = lib.licenses.bsd3;
@@ -187586,8 +188238,8 @@ self: {
        pname = "months";
        version = "0.2";
        sha256 = "054dag7806850hdii7s5rxg8gx2spdp33pnx4s4ckni9ayvspija";
-       revision = "3";
-       editedCabalFile = "1j57vvb2vs0jd5jsq2dh0q5wpvxibwn43dwkg1l3ysl46k5sv58i";
+       revision = "4";
+       editedCabalFile = "1prni51r2kca7cff4jshas87bxvfmqkp9r5yhkmapphxc9w8vanb";
        libraryHaskellDepends = [
          aeson attoparsec base base-compat deepseq hashable intervals
          QuickCheck text time-compat
@@ -188909,6 +189561,52 @@ self: {
        broken = true;
      }) {};
 
+  "mptcpanalyzer" = callPackage
+    ({ mkDerivation, aeson, aeson-extra, aeson-pretty, ansi-terminal
+     , base, bytestring, Cabal, cereal, Chart, Chart-cairo, containers
+     , directory, filepath, foldl, formatting, Frames, ghci-dap
+     , hashable, haskeline, haskell-dap, haskell-debug-adapter, hspec
+     , HUnit, ip, lens, mptcp, mptcp-pm, mtl, network
+     , optparse-applicative, pipes, pipes-parse, pipes-safe, polysemy
+     , polysemy-log, polysemy-log-co, polysemy-plugin, process
+     , QuickCheck, readable, template-haskell, temporary, text, time
+     , transformers, unix, utf8-string, vector, vinyl, wide-word
+     }:
+     mkDerivation {
+       pname = "mptcpanalyzer";
+       version = "0.0.2.0";
+       sha256 = "0x13kbh693h27adxwna4v4swvcma0k9r7inh156rzd4jqbv1faz3";
+       isLibrary = true;
+       isExecutable = true;
+       libraryHaskellDepends = [
+         aeson aeson-extra aeson-pretty ansi-terminal base bytestring Cabal
+         cereal Chart Chart-cairo containers directory filepath foldl
+         formatting Frames ghci-dap hashable haskeline haskell-dap
+         haskell-debug-adapter ip lens mptcp mptcp-pm mtl network
+         optparse-applicative pipes pipes-parse pipes-safe polysemy
+         polysemy-log polysemy-log-co polysemy-plugin process readable
+         template-haskell temporary text time transformers unix utf8-string
+         vector vinyl wide-word
+       ];
+       executableHaskellDepends = [
+         aeson aeson-extra aeson-pretty ansi-terminal base bytestring Cabal
+         cereal Chart Chart-cairo containers directory filepath foldl
+         formatting Frames ghci-dap hashable haskeline haskell-dap
+         haskell-debug-adapter ip lens mptcp mptcp-pm mtl network
+         optparse-applicative pipes pipes-parse pipes-safe polysemy
+         polysemy-log polysemy-log-co polysemy-plugin process readable
+         template-haskell temporary text time transformers unix utf8-string
+         vector vinyl wide-word
+       ];
+       testHaskellDepends = [
+         base Cabal Frames hspec HUnit ip mptcp polysemy polysemy-log
+         polysemy-log-co QuickCheck
+       ];
+       description = "A Multipath TCP analyzer";
+       license = lib.licenses.gpl3Only;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "mpvguihs" = callPackage
     ({ mkDerivation, base, directory, filepath, gtk, mtl, process
      , template-haskell, unix
@@ -189046,8 +189744,8 @@ self: {
      }:
      mkDerivation {
        pname = "ms-tds";
-       version = "0.4.0.1";
-       sha256 = "1yjvbn6a50wvcibvi5na6x1d7864zyspqhljvr0dpcfrz3s2yc31";
+       version = "0.4.0.2";
+       sha256 = "0lkvl74ckxsdxwvrm45z5gk2ax65yfpd00j86w8iax4askz76vxc";
        libraryHaskellDepends = [
          array base binary bytestring crypto-random data-default-class mtl
          network template-haskell text time tls uuid-types x509-store
@@ -189259,8 +189957,8 @@ self: {
      }:
      mkDerivation {
        pname = "mssql-simple";
-       version = "0.6.0.2";
-       sha256 = "1glp86kbimsjh1hlmdivp12qzvcy6c5yyx5ynvrwibwnxj5g968v";
+       version = "0.6.0.3";
+       sha256 = "0pgc5p018xc7pmn4mrmgwrh9zy3cxk2gkpqnw2lhnw7h0akhq5im";
        libraryHaskellDepends = [
          base binary bytestring hostname ms-tds mtl network template-haskell
          text time tls uuid-types
@@ -189548,8 +190246,8 @@ self: {
      }:
      mkDerivation {
        pname = "mu-graphql";
-       version = "0.5.0.2";
-       sha256 = "0kr8gqi34zgg8vj5x0c0mx3xjkhjr4ynparplysga7qzzj58a7f3";
+       version = "0.5.0.3";
+       sha256 = "1ahi51sslxlmv4yi6518bn3i4ks7hpc8327r6lz0l6d4q192k1nq";
        isLibrary = true;
        isExecutable = true;
        enableSeparateDataOutput = true;
@@ -189574,19 +190272,17 @@ self: {
      , http2-client, http2-client-grpc, http2-grpc-types, mu-grpc-common
      , mu-optics, mu-protobuf, mu-rpc, mu-schema, optics-core, sop-core
      , stm, stm-chans, stm-conduit, template-haskell, text
-     , th-abstraction, tracing
+     , th-abstraction, tracing-control
      }:
      mkDerivation {
        pname = "mu-grpc-client";
-       version = "0.4.0.1";
-       sha256 = "030b8ajbplb1w5llzm8vn8jpwa7v4kw0y8zli8xagc50k19wp75v";
-       revision = "2";
-       editedCabalFile = "1zs17a684mww8ppgams79xbr019mlr27bxnnhvyhq3k5y1lwz7dh";
+       version = "0.4.0.2";
+       sha256 = "19y39ixf2d97wfm6x3sl99kwfxsd57mf2s2rqp4s80v3rs8b41iw";
        libraryHaskellDepends = [
          async avro base bytestring conduit http2 http2-client
          http2-client-grpc http2-grpc-types mu-grpc-common mu-optics
          mu-protobuf mu-rpc mu-schema optics-core sop-core stm stm-chans
-         stm-conduit template-haskell text th-abstraction tracing
+         stm-conduit template-haskell text th-abstraction tracing-control
        ];
        description = "gRPC clients from Mu definitions";
        license = lib.licenses.asl20;
@@ -192633,13 +193329,13 @@ self: {
      }) {};
 
   "nat-optics" = callPackage
-    ({ mkDerivation, base, hedgehog, optics-core, text }:
+    ({ mkDerivation, base, optics-core, text }:
      mkDerivation {
        pname = "nat-optics";
-       version = "1.0.0.1";
-       sha256 = "1ba5lnb70gdaa9hwfcg2r0x76h2mxknn49rwplmbgcyxyh79x4jl";
+       version = "1.0.0.2";
+       sha256 = "12m6267dirzykj4d0rjqq5h3n2zrnp7ixavryvbgqdvrnk6y2ik4";
        libraryHaskellDepends = [ base optics-core text ];
-       testHaskellDepends = [ base hedgehog optics-core text ];
+       testHaskellDepends = [ base optics-core text ];
        description = "Refinement types for natural numbers with an optics interface";
        license = lib.licenses.mit;
        hydraPlatforms = lib.platforms.none;
@@ -193443,7 +194139,7 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
-  "net-mqtt_0_8_1_0" = callPackage
+  "net-mqtt_0_8_2_0" = callPackage
     ({ mkDerivation, async, attoparsec, attoparsec-binary, base, binary
      , bytestring, checkers, conduit, conduit-extra, connection
      , containers, deepseq, HUnit, network-conduit-tls, network-uri
@@ -193452,8 +194148,8 @@ self: {
      }:
      mkDerivation {
        pname = "net-mqtt";
-       version = "0.8.1.0";
-       sha256 = "1cy17mv8ld3aifh1nr5sggm4x08h58vaa6q1s7nd7nhnkj1icajk";
+       version = "0.8.2.0";
+       sha256 = "0krh8imyjls1incrsz8pnn3zww0yxygy3hy15r55gbs80x5w7j13";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -204102,19 +204798,19 @@ self: {
        maintainers = with lib.maintainers; [ peti ];
      }) {};
 
-  "pandoc_2_16_2" = callPackage
+  "pandoc_2_17" = callPackage
     ({ mkDerivation, aeson, aeson-pretty, array, attoparsec, base
      , base64-bytestring, binary, blaze-html, blaze-markup, bytestring
      , case-insensitive, citeproc, commonmark, commonmark-extensions
      , commonmark-pandoc, connection, containers, data-default, deepseq
      , Diff, directory, doclayout, doctemplates, emojis, exceptions
-     , file-embed, filepath, Glob, haddock-library, hslua
+     , file-embed, filepath, Glob, haddock-library, hslua, hslua-aeson
      , hslua-marshalling, hslua-module-path, hslua-module-system
      , hslua-module-text, hslua-module-version, http-client
      , http-client-tls, http-types, ipynb, jira-wiki-markup, JuicyPixels
-     , lpeg, mtl, network, network-uri, pandoc-types, parsec, pretty
-     , pretty-show, process, QuickCheck, random, safe, scientific, SHA
-     , skylighting, skylighting-core, split, syb, tagsoup, tasty
+     , lpeg, mtl, network, network-uri, pandoc-lua-marshal, pandoc-types
+     , parsec, pretty, pretty-show, process, random, safe, scientific
+     , SHA, skylighting, skylighting-core, split, syb, tagsoup, tasty
      , tasty-bench, tasty-golden, tasty-hunit, tasty-lua
      , tasty-quickcheck, temporary, texmath, text, text-conversions
      , time, unicode-collation, unicode-transforms, unix, xml
@@ -204122,10 +204818,8 @@ self: {
      }:
      mkDerivation {
        pname = "pandoc";
-       version = "2.16.2";
-       sha256 = "0pnw4v5i20bi9j3gg0i9wlikk2fhj34x5vhh23zhj8v4p72r3wkj";
-       revision = "1";
-       editedCabalFile = "013i4hsgfdq38zsxq4c3l80hqxrqccy41h1ihyakamb8m3p3pq8q";
+       version = "2.17";
+       sha256 = "0wbq4mzvjzyl9nzfagbjljv11khajzv030sr51n5wfxf8rm463y6";
        configureFlags = [ "-fhttps" "-f-trypandoc" ];
        isLibrary = true;
        isExecutable = true;
@@ -204136,20 +204830,20 @@ self: {
          commonmark commonmark-extensions commonmark-pandoc connection
          containers data-default deepseq directory doclayout doctemplates
          emojis exceptions file-embed filepath Glob haddock-library hslua
-         hslua-marshalling hslua-module-path hslua-module-system
+         hslua-aeson hslua-marshalling hslua-module-path hslua-module-system
          hslua-module-text hslua-module-version http-client http-client-tls
          http-types ipynb jira-wiki-markup JuicyPixels lpeg mtl network
-         network-uri pandoc-types parsec pretty pretty-show process random
-         safe scientific SHA skylighting skylighting-core split syb tagsoup
-         temporary texmath text text-conversions time unicode-collation
-         unicode-transforms unix xml xml-conduit yaml zip-archive zlib
+         network-uri pandoc-lua-marshal pandoc-types parsec pretty
+         pretty-show process random safe scientific SHA skylighting
+         skylighting-core split syb tagsoup temporary texmath text
+         text-conversions time unicode-collation unicode-transforms unix xml
+         xml-conduit yaml zip-archive zlib
        ];
        executableHaskellDepends = [ base ];
        testHaskellDepends = [
          base bytestring containers Diff directory doctemplates exceptions
-         filepath Glob hslua mtl pandoc-types process QuickCheck tasty
-         tasty-golden tasty-hunit tasty-lua tasty-quickcheck text time xml
-         zip-archive
+         filepath Glob hslua mtl pandoc-types process tasty tasty-golden
+         tasty-hunit tasty-lua tasty-quickcheck text time xml zip-archive
        ];
        benchmarkHaskellDepends = [
          base bytestring deepseq mtl tasty-bench text
@@ -204472,8 +205166,8 @@ self: {
      }:
      mkDerivation {
        pname = "pandoc-lua-marshal";
-       version = "0.1.3";
-       sha256 = "0x4r0w2gavphc5f6yr4szb31blsvw3hdyackwza8dmzag952nc9k";
+       version = "0.1.3.1";
+       sha256 = "04q433gpqkydyy2gx6jhyvv7lahx186b1d90clkggach1x0rg8ii";
        libraryHaskellDepends = [
          base bytestring containers exceptions hslua hslua-marshalling lua
          pandoc-types safe text
@@ -204608,8 +205302,8 @@ self: {
        pname = "pandoc-plot";
        version = "1.3.0";
        sha256 = "0d33cbw0ygsdwh718q7q5gw2s6565dbrjwi3rz0qdf78q14wiayi";
-       revision = "1";
-       editedCabalFile = "1l4rxi23i8ngfrv6vk94l0j0cfczwxchp2bwh1l894b4dfhkq1ks";
+       revision = "2";
+       editedCabalFile = "14q1l5m29736f9zybh3sba74mxvs73lbr4hqvmdyzfz369r41rmv";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -204786,8 +205480,8 @@ self: {
     ({ mkDerivation }:
      mkDerivation {
        pname = "pandora";
-       version = "0.4.9";
-       sha256 = "0z02q7bxrrij4vls3gpxg34z47y2ijapjwagw6aw8dpsn75hj798";
+       version = "0.5.0";
+       sha256 = "144k1cqb4gkwyh3w01cwsax58n9w3h1giggdb8b0dw64pnhsq8zd";
        description = "A box of patterns and paradigms";
        license = lib.licenses.mit;
      }) {};
@@ -206546,14 +207240,15 @@ self: {
 
   "parsley-core" = callPackage
     ({ mkDerivation, array, base, bytestring, containers, cpphs
-     , deepseq, dependent-map, dependent-sum, ghc-prim, hashable, mtl
-     , pretty-terminal, tasty, tasty-hunit, tasty-quickcheck
-     , template-haskell, text, th-test-utils, unordered-containers
+     , deepseq, dependent-map, dependent-sum, gauge, ghc-prim, hashable
+     , mtl, pretty-terminal, QuickCheck, tasty, tasty-hunit
+     , tasty-quickcheck, template-haskell, text, th-test-utils
+     , unordered-containers
      }:
      mkDerivation {
        pname = "parsley-core";
-       version = "2.0.0.0";
-       sha256 = "1v46wpi80fdjpdgr6jcrhljxjrmf1gf7cxmi3y0sdlininr4273i";
+       version = "2.1.0.0";
+       sha256 = "0vr4qlgkwsh92a8fv4fj48l9625xd80mkkmihwf20zln6svcsbfs";
        libraryHaskellDepends = [
          array base bytestring containers dependent-map dependent-sum
          ghc-prim hashable mtl pretty-terminal template-haskell text
@@ -206564,6 +207259,9 @@ self: {
          base containers deepseq tasty tasty-hunit tasty-quickcheck
          template-haskell th-test-utils
        ];
+       benchmarkHaskellDepends = [
+         base containers deepseq gauge QuickCheck
+       ];
        description = "A fast parser combinator library backed by Typed Template Haskell";
        license = lib.licenses.bsd3;
        hydraPlatforms = lib.platforms.none;
@@ -206729,12 +207427,25 @@ self: {
        license = lib.licenses.asl20;
      }) {};
 
+  "partial-semigroup_0_5_1_14" = callPackage
+    ({ mkDerivation, base, doctest, hedgehog }:
+     mkDerivation {
+       pname = "partial-semigroup";
+       version = "0.5.1.14";
+       sha256 = "11xbdv24jy54wniappiqp6j27nm3wjgrbc8zmjkbfwdgb7fzlrws";
+       libraryHaskellDepends = [ base ];
+       testHaskellDepends = [ base doctest hedgehog ];
+       description = "A partial binary associative operator";
+       license = lib.licenses.asl20;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "partial-semigroup-hedgehog" = callPackage
     ({ mkDerivation, base, hedgehog, partial-semigroup }:
      mkDerivation {
        pname = "partial-semigroup-hedgehog";
-       version = "0.6.0.8";
-       sha256 = "0gldqqrfc87x1ff33qgan3pp62siqgal3imkf81b9rynws0saxh7";
+       version = "0.6.0.10";
+       sha256 = "1i40ndpk6dwq56fd83za46wn1fyzm46hnx06s29h4pz1ilfrk1xx";
        libraryHaskellDepends = [ base hedgehog partial-semigroup ];
        description = "Property testing for partial semigroups using Hedgehog";
        license = lib.licenses.asl20;
@@ -207072,7 +207783,7 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
-  "patch_0_0_5_1" = callPackage
+  "patch_0_0_5_2" = callPackage
     ({ mkDerivation, base, constraints-extras, containers
      , dependent-map, dependent-sum, directory, filemanip, filepath
      , hedgehog, hlint, HUnit, lens, monoidal-containers, semialign
@@ -207080,8 +207791,8 @@ self: {
      }:
      mkDerivation {
        pname = "patch";
-       version = "0.0.5.1";
-       sha256 = "073q0kxjkjyv7cvxmxksln91s0dqki07by9fbg4ls1lh5mwyn3vk";
+       version = "0.0.5.2";
+       sha256 = "1l1rd5xybp0a9lvk89i64a4vr82vsha8fkcpwd6hwv2klsxbrwf6";
        libraryHaskellDepends = [
          base constraints-extras containers dependent-map dependent-sum lens
          monoidal-containers semialign semigroupoids these transformers
@@ -210982,8 +211693,8 @@ self: {
      }:
      mkDerivation {
        pname = "phonetic-languages-simplified-generalized-properties-array";
-       version = "0.8.2.0";
-       sha256 = "0mlzmsal1phg2r7mwdgxbc55ybziqys6avzkv7pw3il1vy7kyzyx";
+       version = "0.8.3.0";
+       sha256 = "0vsvj3958czr812jwgkqgnq9jnr79pf1bh1pip49xahp2b35j7ml";
        libraryHaskellDepends = [
          base phonetic-languages-phonetics-basics
          phonetic-languages-rhythmicity phonetic-languages-simplified-base
@@ -211099,8 +211810,8 @@ self: {
     ({ mkDerivation, base, mmsyn2-array, mmsyn5 }:
      mkDerivation {
        pname = "phonetic-languages-ukrainian-array";
-       version = "0.8.0.0";
-       sha256 = "12hpqlcwccv2c25fxyxq5vdnmzwqykcvmp8rj118hc3yssc2ygj8";
+       version = "0.8.2.0";
+       sha256 = "14p2fr80qw8svqb5bdhm2lcbwrciad7vx2lswvz1h8g62wd03py7";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [ base mmsyn2-array mmsyn5 ];
@@ -211146,8 +211857,8 @@ self: {
      }:
      mkDerivation {
        pname = "photoname";
-       version = "5.0";
-       sha256 = "0g17jbnrgl2crgd04sy9s8d1g8da7p8wxq7hgnlg9h4n40yjxbd8";
+       version = "5.1";
+       sha256 = "0ihw0pjiqwfny8nqbdglg13dch622m2agp2y328n7fqar79xx6dv";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -212606,6 +213317,8 @@ self: {
        pname = "pipes-lzma";
        version = "0.2.0.0";
        sha256 = "1b1xnjq1bvp14rl0lvzfxkckvwsihmq0j61wbmx1k0vqjy2b350m";
+       revision = "1";
+       editedCabalFile = "1i501pqamv0sjrp2ngppvy1wy6gr7xk89hzpfmvnj02ja2m49z41";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [ base bytestring exceptions lzma pipes ];
@@ -218045,8 +218758,8 @@ self: {
      }:
      mkDerivation {
        pname = "powerdns";
-       version = "0.2.0";
-       sha256 = "0ddrgvpvss342zmnyd0svj7424k8gynd7bwb2i0r10zw1l4kai26";
+       version = "0.2.1";
+       sha256 = "09amgmzyypjilz6armsvyjjxj8frx48aq3nq8vjkp30j2xs7a7a4";
        libraryHaskellDepends = [
          aeson base base64-bytestring bytestring case-insensitive containers
          deepseq servant servant-client servant-client-core text time
@@ -219360,6 +220073,8 @@ self: {
        pname = "prettyprinter-graphviz";
        version = "1.1.0.0";
        sha256 = "1lqf296jr2jfg86apn729payq2rkk95pdidl7n62xx4bniax7fvm";
+       revision = "1";
+       editedCabalFile = "1q8mp6rzb9l6jm8bc902si99ns2nw3vzimqvzwhxbkxf4ljdzqwq";
        libraryHaskellDepends = [ base graphviz prettyprinter text ];
        description = "A prettyprinter backend for graphviz";
        license = lib.licenses.bsd3;
@@ -219371,6 +220086,8 @@ self: {
        pname = "prettyprinter-lucid";
        version = "0.1.0.1";
        sha256 = "0m8dbxzs22zbahpr6r1frlfqyw581wyg92vswm3gi2qqpj406djh";
+       revision = "1";
+       editedCabalFile = "02vqw79j1pj9f1z2gl08jny75lfdm29jw2g6kqg23x5sayzh1f89";
        libraryHaskellDepends = [ base lucid prettyprinter text ];
        description = "A prettyprinter backend for lucid";
        license = lib.licenses.bsd3;
@@ -219538,6 +220255,24 @@ self: {
        license = lib.licenses.gpl3Only;
      }) {};
 
+  "primecount" = callPackage
+    ({ mkDerivation, base, primecount, silently, tasty, tasty-bench
+     , tasty-hunit
+     }:
+     mkDerivation {
+       pname = "primecount";
+       version = "0.1.0.0";
+       sha256 = "16ls5fb8z0mpnggs9c1sjksgzpj558gdp9fk3wrv55z41pch53r0";
+       libraryHaskellDepends = [ base ];
+       librarySystemDepends = [ primecount ];
+       testHaskellDepends = [ base silently tasty tasty-hunit ];
+       benchmarkHaskellDepends = [ base tasty-bench ];
+       description = "Bindings to the primecount library";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+       broken = true;
+     }) {inherit (pkgs) primecount;};
+
   "primes" = callPackage
     ({ mkDerivation, base }:
      mkDerivation {
@@ -219629,8 +220364,8 @@ self: {
     ({ mkDerivation, base, primitive }:
      mkDerivation {
        pname = "primitive-checked";
-       version = "0.7.0.0";
-       sha256 = "1h4gsririgjw8p72dz2p91yq8mxr37qca8rshmxmkmmds8yv6w1s";
+       version = "0.7.2.0";
+       sha256 = "1swb10hd18w2xnxiwnscsv4fxmvrql3aw7fll5qlqi2hczbkd4lf";
        libraryHaskellDepends = [ base primitive ];
        description = "primitive functions with bounds-checking";
        license = lib.licenses.bsd3;
@@ -219699,7 +220434,7 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
-  "primitive-extras_0_10_1_3" = callPackage
+  "primitive-extras_0_10_1_4" = callPackage
     ({ mkDerivation, base, bytestring, cereal, deferred-folds, focus
      , foldl, list-t, primitive, primitive-unlifted, profunctors
      , QuickCheck, quickcheck-instances, rerebase, tasty, tasty-hunit
@@ -219707,8 +220442,8 @@ self: {
      }:
      mkDerivation {
        pname = "primitive-extras";
-       version = "0.10.1.3";
-       sha256 = "03i65knf4fkhai1668k5vlpa7z8jdvwy9kay4i4qr2l013qx29yf";
+       version = "0.10.1.4";
+       sha256 = "00x8jwmkijc110idviz6i4q25dfxnjv4gcdkhsyrldrg8g1bn90f";
        libraryHaskellDepends = [
          base bytestring cereal deferred-folds focus foldl list-t primitive
          primitive-unlifted profunctors vector
@@ -221147,6 +221882,24 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "prometheus_2_2_3" = callPackage
+    ({ mkDerivation, atomic-primops, base, bytestring, containers
+     , http-client, http-client-tls, http-types, network-uri, text
+     , transformers, wai, warp
+     }:
+     mkDerivation {
+       pname = "prometheus";
+       version = "2.2.3";
+       sha256 = "1ggav326fpkrvg39a5rxg2ysg6mb16zzdv4yw0753fyk61v2g4pz";
+       libraryHaskellDepends = [
+         atomic-primops base bytestring containers http-client
+         http-client-tls http-types network-uri text transformers wai warp
+       ];
+       description = "Prometheus Haskell Client";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "prometheus-client" = callPackage
     ({ mkDerivation, atomic-primops, base, bytestring, clock
      , containers, criterion, deepseq, doctest, exceptions, hspec, mtl
@@ -222367,6 +223120,32 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
+  "psql" = callPackage
+    ({ mkDerivation, base, bytestring, cgroup-rts-threads, concurrency
+     , containers, cryptonite, exceptions, hspec, massiv, megaparsec
+     , mtl, postgresql-libpq, semigroupoids, simpoole, sop-core
+     , template-haskell, text, unordered-containers, vector
+     }:
+     mkDerivation {
+       pname = "psql";
+       version = "0.0.0";
+       sha256 = "15f0404yvs6bixzb0wbcp9nnn07wf0vq0dgaxr1pkch4gy8n79ij";
+       revision = "1";
+       editedCabalFile = "0pfi16q3kv0kxwamggk3jsvy5mmgc7g6qawzxwmz14n8mg61885w";
+       libraryHaskellDepends = [
+         base bytestring concurrency containers cryptonite exceptions
+         megaparsec mtl postgresql-libpq semigroupoids simpoole
+         template-haskell text vector
+       ];
+       testHaskellDepends = [
+         base bytestring cgroup-rts-threads exceptions hspec massiv mtl
+         postgresql-libpq semigroupoids sop-core unordered-containers vector
+       ];
+       description = "PostgreSQL client";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "psql-helpers" = callPackage
     ({ mkDerivation, base, postgresql-simple }:
      mkDerivation {
@@ -223742,7 +224521,7 @@ self: {
        license = lib.licenses.mit;
        hydraPlatforms = lib.platforms.none;
        broken = true;
-     }) {inherit (pkgs) python;};
+     }) {python = null;};
 
   "pyfi" = callPackage
     ({ mkDerivation, aeson, base, bytestring, containers, pureMD5
@@ -223760,7 +224539,7 @@ self: {
        license = lib.licenses.mit;
        hydraPlatforms = lib.platforms.none;
        broken = true;
-     }) {inherit (pkgs) python;};
+     }) {python = null;};
 
   "python-pickle" = callPackage
     ({ mkDerivation, attoparsec, base, bytestring, cereal, cmdargs
@@ -226432,6 +227211,20 @@ self: {
        license = lib.licenses.isc;
      }) {};
 
+  "rampart_2_0_0_0" = callPackage
+    ({ mkDerivation, base, criterion, hspec }:
+     mkDerivation {
+       pname = "rampart";
+       version = "2.0.0.0";
+       sha256 = "1hmn6dm5x2n9mn31lwa3dg77plahqmfj0h6s2h3v5y09d7s2fjhv";
+       libraryHaskellDepends = [ base ];
+       testHaskellDepends = [ base hspec ];
+       benchmarkHaskellDepends = [ base criterion ];
+       description = "Determine how intervals relate to each other";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "ramus" = callPackage
     ({ mkDerivation, base, criterion, hspec, QuickCheck, quickcheck-io
      }:
@@ -227335,6 +228128,28 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
+  "ratel_2_0_0_0" = callPackage
+    ({ mkDerivation, aeson, base, bytestring, case-insensitive
+     , containers, filepath, hspec, http-client, http-client-tls
+     , http-types, uuid
+     }:
+     mkDerivation {
+       pname = "ratel";
+       version = "2.0.0.0";
+       sha256 = "02pkc0mkzxvv07kzwsrxp1hlgb5gypxc7phsv85k9kr6vvkh58jf";
+       libraryHaskellDepends = [
+         aeson base bytestring case-insensitive containers http-client
+         http-client-tls http-types uuid
+       ];
+       testHaskellDepends = [
+         aeson base bytestring case-insensitive containers filepath hspec
+         http-client http-client-tls http-types uuid
+       ];
+       description = "Notify Honeybadger about exceptions";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "ratel-wai" = callPackage
     ({ mkDerivation, base, bytestring, case-insensitive, containers
      , http-client, ratel, wai
@@ -227350,6 +228165,22 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
+  "ratel-wai_2_0_0_0" = callPackage
+    ({ mkDerivation, base, bytestring, case-insensitive, containers
+     , http-client, ratel, wai
+     }:
+     mkDerivation {
+       pname = "ratel-wai";
+       version = "2.0.0.0";
+       sha256 = "1z95ydab4q8r3lmsin3ghzqcnfliw2km7sdldzm6crvgvpj90l73";
+       libraryHaskellDepends = [
+         base bytestring case-insensitive containers http-client ratel wai
+       ];
+       description = "Notify Honeybadger about exceptions via a WAI middleware";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "ratelimiter" = callPackage
     ({ mkDerivation, base, containers, extra, mtl, time, timespan
      , vector
@@ -231084,14 +231915,14 @@ self: {
      }:
      mkDerivation {
        pname = "regex-rure";
-       version = "0.1.0.0";
-       sha256 = "0fji4j0nhq47s956ahxq7rh1a50q6y65b5m9rdcn3mjahqmirkal";
+       version = "0.1.0.2";
+       sha256 = "1nqly1c2pg7c44jaajl3kj8hibybm5w8ly4ndyfgmrs60d2kzhyw";
        libraryHaskellDepends = [ base bytestring ];
        librarySystemDepends = [ rure ];
        libraryToolDepends = [ c2hs ];
        testHaskellDepends = [ base bytestring tasty tasty-hunit ];
        description = "Bindings to Rust's regex library";
-       license = lib.licenses.gpl3Only;
+       license = lib.licenses.agpl3Only;
        hydraPlatforms = lib.platforms.none;
        broken = true;
      }) {rure = null;};
@@ -231554,8 +232385,8 @@ self: {
     ({ mkDerivation, base, vector }:
      mkDerivation {
        pname = "regression-simple";
-       version = "0.1";
-       sha256 = "0f74xwyrnz39cl24kazvk8rd3px2l2ycx6a5jaqlab6wiwi5xclq";
+       version = "0.1.1";
+       sha256 = "18gq05xrkkxg2zrnkx9z7n91g8lagz6j3cfw7mqik7dyc2m1w675";
        libraryHaskellDepends = [ base vector ];
        description = "Simple linear and quadratic regression";
        license = lib.licenses.bsd3;
@@ -231743,7 +232574,7 @@ self: {
        maintainers = with lib.maintainers; [ sternenseemann ];
      }) {};
 
-  "rel8_1_2_1_0" = callPackage
+  "rel8_1_2_2_0" = callPackage
     ({ mkDerivation, aeson, base, bifunctors, bytestring
      , case-insensitive, comonad, containers, contravariant, hasql
      , hasql-transaction, hedgehog, mmorph, opaleye, pretty
@@ -231753,8 +232584,8 @@ self: {
      }:
      mkDerivation {
        pname = "rel8";
-       version = "1.2.1.0";
-       sha256 = "0f4rnyr90f989ww4hh8h65fhnj16ir144qsin9abc767fxnb7wis";
+       version = "1.2.2.0";
+       sha256 = "1jbss5liyz8r747yzva1ciadacd63lida1gzrw9g7075hsawfwjf";
        libraryHaskellDepends = [
          aeson base bifunctors bytestring case-insensitive comonad
          contravariant hasql opaleye pretty product-profunctors profunctors
@@ -233423,8 +234254,8 @@ self: {
        pname = "resolv";
        version = "0.1.2.0";
        sha256 = "0wa6wsh6i52q4ah2z0hgzlks325kigch4yniz0y15nw4skxbm8l1";
-       revision = "3";
-       editedCabalFile = "0af5dsdyn04i76d012xhhfkkml10bqzl6q2yivkhf8rlvh1fiii5";
+       revision = "4";
+       editedCabalFile = "1d3dsbvrwynnbdj32fswiwh90h28p31h6fsfpq5zh85rd29yp210";
        libraryHaskellDepends = [
          base base16-bytestring binary bytestring containers
        ];
@@ -236552,13 +237383,15 @@ self: {
 
   "rounded-hw" = callPackage
     ({ mkDerivation, array, base, Cabal, deepseq, doctest, fp-ieee
-     , gauge, hspec, long-double, primitive, QuickCheck, random, tagged
-     , vector
+     , hspec, long-double, primitive, QuickCheck, random, tagged
+     , tasty-bench, vector
      }:
      mkDerivation {
        pname = "rounded-hw";
-       version = "0.2.0";
-       sha256 = "01393ps7i83ncxlj9yi6jhngr26py6sdafq67mbhigrclyax6ysi";
+       version = "0.3.0";
+       sha256 = "15y6yz101mnfkc2ff4w6wnqc5r6ykipd7jh0pbg9rjm67jmyr4b5";
+       revision = "1";
+       editedCabalFile = "139hr8a1qyfkdcpxn9pwmi9c7v4q3g86bjrx654nc0q7v87q4afh";
        setupHaskellDepends = [ base Cabal ];
        libraryHaskellDepends = [
          array base deepseq fp-ieee long-double primitive tagged vector
@@ -236568,7 +237401,7 @@ self: {
          QuickCheck random vector
        ];
        benchmarkHaskellDepends = [
-         array base deepseq fp-ieee gauge primitive vector
+         array base deepseq fp-ieee primitive tasty-bench vector
        ];
        description = "Directed rounding for built-in floating types";
        license = lib.licenses.bsd3;
@@ -238601,6 +239434,19 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
+  "salve_2_0_0_0" = callPackage
+    ({ mkDerivation, base, HUnit }:
+     mkDerivation {
+       pname = "salve";
+       version = "2.0.0.0";
+       sha256 = "0ddja5py6wjxvlc9340v0z9qh7b59vfp81hz882nfq0c0d2bdna5";
+       libraryHaskellDepends = [ base ];
+       testHaskellDepends = [ base HUnit ];
+       description = "Semantic version numbers and constraints";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "salvia" = callPackage
     ({ mkDerivation, base, bytestring, containers, directory, fclabels
      , MaybeT-transformers, monads-fd, network, old-locale, process
@@ -240002,6 +240848,29 @@ self: {
        hydraPlatforms = lib.platforms.none;
      }) {};
 
+  "scheduling" = callPackage
+    ({ mkDerivation, aeson, base, bimap, bytestring, containers, gogol
+     , gogol-sheets, lens, mime-mail, mtl, optparse-generic, random, sbv
+     , servant, text, time
+     }:
+     mkDerivation {
+       pname = "scheduling";
+       version = "0.1.0.0";
+       sha256 = "14kl43l624b9wl7igj52vxjgw42mdkx1n7f2i6ng638y2wfc0xzl";
+       isLibrary = true;
+       isExecutable = true;
+       libraryHaskellDepends = [
+         aeson base bimap bytestring containers gogol gogol-sheets lens
+         mime-mail mtl optparse-generic random sbv servant text time
+       ];
+       executableHaskellDepends = [
+         aeson base bimap bytestring containers gogol gogol-sheets lens
+         mime-mail mtl optparse-generic random sbv servant text time
+       ];
+       description = "An interview scheduler using constraint satisfaction and Google Sheets";
+       license = lib.licenses.bsd3;
+     }) {};
+
   "schedyield" = callPackage
     ({ mkDerivation, base }:
      mkDerivation {
@@ -241168,6 +242037,28 @@ self: {
        license = lib.licenses.bsd3;
      }) {inherit (pkgs) SDL2;};
 
+  "sdl2_2_5_3_1" = callPackage
+    ({ mkDerivation, base, bytestring, deepseq, exceptions, linear
+     , SDL2, StateVar, text, transformers, vector, weigh
+     }:
+     mkDerivation {
+       pname = "sdl2";
+       version = "2.5.3.1";
+       sha256 = "1lnscy9vc3h9fhh65iq60kma79q4pkb00r8lqx8i3ax2v53yl626";
+       isLibrary = true;
+       isExecutable = true;
+       enableSeparateDataOutput = true;
+       libraryHaskellDepends = [
+         base bytestring exceptions linear StateVar text transformers vector
+       ];
+       librarySystemDepends = [ SDL2 ];
+       libraryPkgconfigDepends = [ SDL2 ];
+       testHaskellDepends = [ base deepseq linear vector weigh ];
+       description = "Both high- and low-level bindings to the SDL library (version 2.0.6+).";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {inherit (pkgs) SDL2;};
+
   "sdl2-cairo" = callPackage
     ({ mkDerivation, base, cairo, linear, sdl2 }:
      mkDerivation {
@@ -242536,6 +243427,26 @@ self: {
        license = lib.licenses.bsd2;
      }) {};
 
+  "semigroupoids_5_3_7" = callPackage
+    ({ mkDerivation, base, base-orphans, bifunctors, comonad
+     , containers, contravariant, distributive, hashable, tagged
+     , template-haskell, transformers, transformers-compat
+     , unordered-containers
+     }:
+     mkDerivation {
+       pname = "semigroupoids";
+       version = "5.3.7";
+       sha256 = "169pjrm7lxjxrqj5q1iyl288bx5nj8n0pf2ri1cclxccqnvcsibd";
+       libraryHaskellDepends = [
+         base base-orphans bifunctors comonad containers contravariant
+         distributive hashable tagged template-haskell transformers
+         transformers-compat unordered-containers
+       ];
+       description = "Semigroupoids: Category sans id";
+       license = lib.licenses.bsd2;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "semigroupoids-do" = callPackage
     ({ mkDerivation, base, semigroupoids }:
      mkDerivation {
@@ -244403,8 +245314,8 @@ self: {
     ({ mkDerivation, base, bytestring, http-media, servant, text }:
      mkDerivation {
        pname = "servant-fiat-content";
-       version = "1.0.0";
-       sha256 = "1108npqddwsbplxzf65hq0w3aqnyfrk8lcdffkszwx3g8s8xblg7";
+       version = "1.0.1";
+       sha256 = "1vkmwllgy9s8kd72yg8ipvqyp1w2fi3mbf98ylwjzjsvm9vbgysx";
        libraryHaskellDepends = [
          base bytestring http-media servant text
        ];
@@ -248398,14 +249309,14 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
-  "shikensu_0_4_0" = callPackage
+  "shikensu_0_4_1" = callPackage
     ({ mkDerivation, aeson, base, bytestring, directory, filepath, flow
      , Glob, tasty, tasty-hunit, text, unordered-containers
      }:
      mkDerivation {
        pname = "shikensu";
-       version = "0.4.0";
-       sha256 = "0ln51nw01k776lv8bxg1pp8cpnchhr4aj12llxvh4zzi4asxj2x6";
+       version = "0.4.1";
+       sha256 = "0qf0rc0sxhj6x03g9mdxhnk8dk8n0jpi6061ky0cqhvivn4fd9hy";
        libraryHaskellDepends = [
          aeson base bytestring directory filepath flow Glob text
          unordered-containers
@@ -250419,48 +251330,51 @@ self: {
      }) {};
 
   "simplexmq" = callPackage
-    ({ mkDerivation, ansi-terminal, asn1-encoding, asn1-types, async
-     , attoparsec, base, base64-bytestring, bytestring, composition
-     , constraints, containers, cryptonite, cryptostore, direct-sqlite
-     , directory, file-embed, filepath, generic-random, hspec
-     , hspec-core, http-types, HUnit, ini, iso8601-time, memory, mtl
-     , network, network-transport, optparse-applicative, QuickCheck
-     , random, simple-logger, sqlite-simple, stm, template-haskell, text
-     , time, timeit, transformers, unliftio, unliftio-core, websockets
-     , x509
+    ({ mkDerivation, aeson, ansi-terminal, asn1-encoding, asn1-types
+     , async, attoparsec, base, base64-bytestring, bytestring
+     , composition, constraints, containers, cryptonite, cryptostore
+     , data-default, direct-sqlite, directory, file-embed, filepath
+     , generic-random, hspec, hspec-core, http-types, HUnit, ini
+     , iso8601-time, memory, mtl, network, network-transport
+     , optparse-applicative, process, QuickCheck, random, simple-logger
+     , sqlite-simple, stm, template-haskell, text, time, timeit, tls
+     , transformers, unliftio, unliftio-core, websockets, x509
+     , x509-store, x509-validation
      }:
      mkDerivation {
        pname = "simplexmq";
-       version = "0.5.0";
-       sha256 = "0wmhqmrxzgb4zvxmcsv49lzmvgqrqljivzcjfp4s04j87968x79j";
+       version = "1.0.0";
+       sha256 = "0ldri2kp1hadsx9kbypkkijijak1c6zy2h5apj6kgnh7f9a851pm";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
-         ansi-terminal asn1-encoding asn1-types async attoparsec base
+         aeson ansi-terminal asn1-encoding asn1-types async attoparsec base
          base64-bytestring bytestring composition constraints containers
-         cryptonite direct-sqlite directory file-embed filepath
-         generic-random http-types iso8601-time memory mtl network
-         network-transport QuickCheck random simple-logger sqlite-simple stm
-         template-haskell text time transformers unliftio unliftio-core
-         websockets x509
+         cryptonite cryptostore data-default direct-sqlite directory
+         file-embed filepath generic-random http-types iso8601-time memory
+         mtl network network-transport QuickCheck random simple-logger
+         sqlite-simple stm template-haskell text time tls transformers
+         unliftio unliftio-core websockets x509 x509-store x509-validation
        ];
        executableHaskellDepends = [
-         ansi-terminal asn1-encoding asn1-types async attoparsec base
+         aeson ansi-terminal asn1-encoding asn1-types async attoparsec base
          base64-bytestring bytestring composition constraints containers
-         cryptonite cryptostore direct-sqlite directory file-embed filepath
-         generic-random http-types ini iso8601-time memory mtl network
-         network-transport optparse-applicative QuickCheck random
-         simple-logger sqlite-simple stm template-haskell text time
-         transformers unliftio unliftio-core websockets x509
+         cryptonite cryptostore data-default direct-sqlite directory
+         file-embed filepath generic-random http-types ini iso8601-time
+         memory mtl network network-transport optparse-applicative process
+         QuickCheck random simple-logger sqlite-simple stm template-haskell
+         text time tls transformers unliftio unliftio-core websockets x509
+         x509-store x509-validation
        ];
        testHaskellDepends = [
-         ansi-terminal asn1-encoding asn1-types async attoparsec base
+         aeson ansi-terminal asn1-encoding asn1-types async attoparsec base
          base64-bytestring bytestring composition constraints containers
-         cryptonite direct-sqlite directory file-embed filepath
-         generic-random hspec hspec-core http-types HUnit iso8601-time
-         memory mtl network network-transport QuickCheck random
-         simple-logger sqlite-simple stm template-haskell text time timeit
-         transformers unliftio unliftio-core websockets x509
+         cryptonite cryptostore data-default direct-sqlite directory
+         file-embed filepath generic-random hspec hspec-core http-types
+         HUnit iso8601-time memory mtl network network-transport QuickCheck
+         random simple-logger sqlite-simple stm template-haskell text time
+         timeit tls transformers unliftio unliftio-core websockets x509
+         x509-store x509-validation
        ];
        description = "SimpleXMQ message broker";
        license = lib.licenses.agpl3Only;
@@ -250489,8 +251403,8 @@ self: {
      }:
      mkDerivation {
        pname = "simpoole";
-       version = "0.3.0";
-       sha256 = "188c6r5vzi7bdyk8qgi5z2zxw7cjacf7fa986y7r1v89q0advr8v";
+       version = "0.4.0";
+       sha256 = "12gvmgjngbl8inf0w5nfngbpk3l2shsc4gi3hxk9m5l85ngz2y16";
        libraryHaskellDepends = [
          base concurrency containers exceptions mtl time
        ];
@@ -257898,6 +258812,8 @@ self: {
        pname = "stack";
        version = "2.7.3";
        sha256 = "0i2v5i6bg90n6i4clcaww8m8702d3y5z8r03xdizdisjhf0zijj7";
+       revision = "1";
+       editedCabalFile = "0j99hh3lf886qvf86xwgv9a0ps9vp40z2s3xnl4lr4mgn9f0lrvb";
        configureFlags = [
          "-fdisable-git-info" "-fhide-dependency-versions"
          "-fsupported-build"
@@ -258019,8 +258935,8 @@ self: {
      }:
      mkDerivation {
        pname = "stack-clean-old";
-       version = "0.4.4";
-       sha256 = "1z2lvvpzlaxwxxbb30xyr62sm483bqiknxwmzdnfb0ri7qf31kfr";
+       version = "0.4.5";
+       sha256 = "04qc3z7xgs8p814lnpwyqgwza7i6wz9mkmzzk0ggq6mv32zzz7kb";
        isLibrary = false;
        isExecutable = true;
        executableHaskellDepends = [
@@ -259326,6 +260242,33 @@ self: {
        license = lib.licenses.bsd2;
      }) {};
 
+  "statistics_0_16_0_1" = callPackage
+    ({ mkDerivation, aeson, async, base, binary, data-default-class
+     , deepseq, dense-linear-algebra, erf, ieee754, math-functions
+     , monad-par, mwc-random, primitive, QuickCheck, random, tasty
+     , tasty-expected-failure, tasty-hunit, tasty-quickcheck, vector
+     , vector-algorithms, vector-binary-instances, vector-th-unbox
+     }:
+     mkDerivation {
+       pname = "statistics";
+       version = "0.16.0.1";
+       sha256 = "16ynj3bj8j70w4iq4xsrz7h140cp0jff0fv1iybsjl3lr83hdvk0";
+       libraryHaskellDepends = [
+         aeson async base binary data-default-class deepseq
+         dense-linear-algebra math-functions monad-par mwc-random primitive
+         random vector vector-algorithms vector-binary-instances
+         vector-th-unbox
+       ];
+       testHaskellDepends = [
+         aeson base binary dense-linear-algebra erf ieee754 math-functions
+         primitive QuickCheck tasty tasty-expected-failure tasty-hunit
+         tasty-quickcheck vector vector-algorithms
+       ];
+       description = "A library of statistical types, data, and functions";
+       license = lib.licenses.bsd2;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "statistics-dirichlet" = callPackage
     ({ mkDerivation, base, deepseq, hmatrix-special
      , nonlinear-optimization, vector
@@ -261450,6 +262393,8 @@ self: {
        pname = "streamly";
        version = "0.8.1.1";
        sha256 = "13m415pcyyzipm5nsf9l8lcan3dn2ck666rq014y46zd66l5ahb9";
+       revision = "1";
+       editedCabalFile = "0y9pq53jd2wf7xb5i51pa6vm728sza405dx37j8rqnqxxbm5sq7y";
        libraryHaskellDepends = [
          atomic-primops base containers deepseq directory exceptions
          filepath fusion-plugin-types ghc-prim heaps lockfree-queue
@@ -261675,8 +262620,8 @@ self: {
      }:
      mkDerivation {
        pname = "streamly-lz4";
-       version = "0.1.0";
-       sha256 = "0jp6px6m85rji0wpq0xfp2cv63jidvqmb1x1z33q95xfh6v73yng";
+       version = "0.1.1";
+       sha256 = "1ac7lby73pylzyg84nr155sfkcjj2p9kaj0v99va3kx4r6j4jr81";
        libraryHaskellDepends = [
          base exceptions fusion-plugin-types streamly
        ];
@@ -261710,19 +262655,19 @@ self: {
      }) {};
 
   "streamly-process" = callPackage
-    ({ mkDerivation, base, directory, exceptions, fusion-plugin, hspec
-     , process, QuickCheck, streamly, tasty-bench, unix
+    ({ mkDerivation, base, directory, exceptions, hspec, process
+     , QuickCheck, streamly, tasty-bench, unix
      }:
      mkDerivation {
        pname = "streamly-process";
-       version = "0.1.0";
-       sha256 = "066ldbphb230cc21jvsmmqlnjli6cwqpphs7vjb88q62lbl8yf6p";
+       version = "0.2.0";
+       sha256 = "0ryf0hbqdpzlips3hyrhb310ha3h8fbna4rd8lqzj67dya66rd3r";
        libraryHaskellDepends = [ base exceptions process streamly unix ];
        testHaskellDepends = [
          base directory exceptions hspec process QuickCheck streamly
        ];
        benchmarkHaskellDepends = [
-         base directory fusion-plugin process streamly tasty-bench
+         base directory process streamly tasty-bench
        ];
        description = "Use OS processes as stream transformation functions";
        license = lib.licenses.asl20;
@@ -262055,6 +263000,8 @@ self: {
        pname = "strict-tuple";
        version = "0.1.4";
        sha256 = "06fyf58kl3c5xpfdd5h7368ggbfadm5n67h3kqajrsgh3yl84hrq";
+       revision = "1";
+       editedCabalFile = "127byff30qm6vfnpdb2jfhag6dfv8zz306hkdnlkryx4gf5aab86";
        libraryHaskellDepends = [ base bifunctors deepseq hashable ];
        testHaskellDepends = [ base ];
        description = "Strict tuples";
@@ -262566,6 +263513,18 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
+  "stripe-concepts_1_0_3_1" = callPackage
+    ({ mkDerivation, base, bytestring, text }:
+     mkDerivation {
+       pname = "stripe-concepts";
+       version = "1.0.3.1";
+       sha256 = "1mi538f8nm90mygrcv6w90bxf0d0lc4qxkbrq19j35l9r1xlm5bk";
+       libraryHaskellDepends = [ base bytestring text ];
+       description = "Types for the Stripe API";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "stripe-core" = callPackage
     ({ mkDerivation, aeson, base, bytestring, mtl, text, time
      , transformers, unordered-containers
@@ -262697,18 +263656,20 @@ self: {
      }) {};
 
   "stripe-signature" = callPackage
-    ({ mkDerivation, base, base16-bytestring, bytestring, cryptonite
-     , memory, stripe-concepts, text
+    ({ mkDerivation, base, base16-bytestring, bytestring
+     , cryptohash-sha256, stripe-concepts, text
      }:
      mkDerivation {
        pname = "stripe-signature";
-       version = "1.0.0.10";
-       sha256 = "04b5z6hnm000fii4qiczm4xpr41v55fgcj07yh35iwh4gwgc7c4h";
+       version = "1.0.0.14";
+       sha256 = "0r982h1vd06yd1kyhyqf3s982a34amlnfzwykg3cs6pscpqbg7mz";
        libraryHaskellDepends = [
-         base base16-bytestring bytestring cryptonite memory stripe-concepts
+         base base16-bytestring bytestring cryptohash-sha256 stripe-concepts
          text
        ];
-       testHaskellDepends = [ base bytestring text ];
+       testHaskellDepends = [
+         base base16-bytestring bytestring stripe-concepts text
+       ];
        description = "Verification of Stripe webhook signatures";
        license = lib.licenses.mit;
        hydraPlatforms = lib.platforms.none;
@@ -262758,8 +263719,8 @@ self: {
      }:
      mkDerivation {
        pname = "stripeapi";
-       version = "2.0.0.1";
-       sha256 = "1kqmdw0f9cppbvirizmyfcsc26iczwrn6hrhmi9y6fhhxiy4wd1z";
+       version = "2.0.1.0";
+       sha256 = "16jiqhkl6ww1rk0n3bp26p30x536akyaaww75bwz0rwzxkr8rjsh";
        libraryHaskellDepends = [
          aeson base bytestring ghc-prim http-client http-conduit http-types
          mtl scientific text time transformers unordered-containers vector
@@ -262801,6 +263762,24 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
+  "strive_6_0_0_1" = callPackage
+    ({ mkDerivation, aeson, base, bytestring, data-default, gpolyline
+     , http-client, http-client-tls, http-types, template-haskell, text
+     , time, transformers
+     }:
+     mkDerivation {
+       pname = "strive";
+       version = "6.0.0.1";
+       sha256 = "1vhszra49nfqx3lfyc378krxx8gf3cs2s6vb602fzlbjbm54i9mh";
+       libraryHaskellDepends = [
+         aeson base bytestring data-default gpolyline http-client
+         http-client-tls http-types template-haskell text time transformers
+       ];
+       description = "A client for the Strava V3 API";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "strong-path" = callPackage
     ({ mkDerivation, base, exceptions, filepath, hspec, path, tasty
      , tasty-discover, tasty-hspec, tasty-quickcheck, template-haskell
@@ -263529,8 +264508,8 @@ self: {
     ({ mkDerivation, base }:
      mkDerivation {
        pname = "successors";
-       version = "0.1.0.2";
-       sha256 = "0q6sfxxzc0ws1iky79iyx7sf7l3jqdwxz9ngsi11km1bp7rd8ycw";
+       version = "0.1.0.3";
+       sha256 = "15pydjb9f7ycjclv5qq0ll8iaf8vpb6241ja858vkkfpz4rsciyv";
        libraryHaskellDepends = [ base ];
        description = "An applicative functor to manage successors";
        license = lib.licenses.mit;
@@ -264267,8 +265246,8 @@ self: {
        pname = "svg-builder";
        version = "0.1.1";
        sha256 = "1k420f497lzkymmxin88ql6ib8dziic43avykv31yq65rgrf7l2g";
-       revision = "4";
-       editedCabalFile = "1731ryf1bymy0s4hg109f2g7wn6mm9b52y2r4gw2d59170lxzv8f";
+       revision = "5";
+       editedCabalFile = "0cnv8rx410mprjvdmzz8j9lmd05wb87zk9bcpjhyymz4qhcbqpl2";
        libraryHaskellDepends = [
          base blaze-builder bytestring hashable text unordered-containers
        ];
@@ -267626,6 +268605,35 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
+  "tailwind" = callPackage
+    ({ mkDerivation, aeson, async, base, bytestring, containers
+     , data-default, deriving-aeson, directory, filepath, filepattern
+     , lens, monad-logger, mtl, neat-interpolation, optparse-applicative
+     , parser-combinators, profunctors, relude, safe-exceptions
+     , temporary, text, time, unliftio, which, with-utf8
+     }:
+     mkDerivation {
+       pname = "tailwind";
+       version = "0.1.0.0";
+       sha256 = "1wvmygaf8dmy9h0wzxb3623rpdmzvhzr879yc4sm94bzd42y8cy6";
+       isLibrary = true;
+       isExecutable = true;
+       libraryHaskellDepends = [
+         aeson async base bytestring containers data-default deriving-aeson
+         directory filepath filepattern lens monad-logger mtl
+         neat-interpolation profunctors relude safe-exceptions temporary
+         text time unliftio which with-utf8
+       ];
+       executableHaskellDepends = [
+         base data-default filepath filepattern lens monad-logger
+         optparse-applicative parser-combinators relude with-utf8
+       ];
+       description = "Tailwind wrapped in Haskell";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+       broken = true;
+     }) {};
+
   "tak" = callPackage
     ({ mkDerivation, base, bytestring, hashable, hslogger, HUnit
      , matrix, network, parsec, random-shuffle, safe
@@ -268432,6 +269440,29 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
+  "tasty-golden_2_3_5" = callPackage
+    ({ mkDerivation, async, base, bytestring, containers, deepseq
+     , directory, filepath, mtl, optparse-applicative, tagged, tasty
+     , tasty-hunit, temporary, text, typed-process
+     }:
+     mkDerivation {
+       pname = "tasty-golden";
+       version = "2.3.5";
+       sha256 = "03klnxn9rcv0l7fl4w8q6s59fzl1328j1wzwi1za4gb0l90vadwb";
+       isLibrary = true;
+       isExecutable = true;
+       libraryHaskellDepends = [
+         async base bytestring containers deepseq directory filepath mtl
+         optparse-applicative tagged tasty temporary text typed-process
+       ];
+       testHaskellDepends = [
+         base directory filepath tasty tasty-hunit temporary typed-process
+       ];
+       description = "Golden tests support for tasty";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "tasty-grading-system" = callPackage
     ({ mkDerivation, aeson, base, containers, directory, filepath
      , generic-deriving, mtl, stm, tagged, tasty, tasty-hunit, text
@@ -270670,6 +271701,8 @@ self: {
        pname = "termbox";
        version = "0.3.0";
        sha256 = "1vi2ssylwvc6xqnhpnvc9q9c70glbf6s63rmyblc53g4qra2wkah";
+       revision = "1";
+       editedCabalFile = "1d0sv2ycizpy0fsn0v4n2bbziyr56y2md8qnqmr0bx1rkriz67li";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [ base ];
@@ -270683,6 +271716,8 @@ self: {
        pname = "termbox-banana";
        version = "0.3.0";
        sha256 = "07nn1jff33zb80vhzkw48fik5d5w7j7q982ihpsbb6gbqp5azx5s";
+       revision = "1";
+       editedCabalFile = "0k62lbwigk97shxlx5c34d2k81ndims9nc36rlcv34s0iig0lh7d";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [ base reactive-banana termbox ];
@@ -271326,8 +272361,8 @@ self: {
      }:
      mkDerivation {
        pname = "test-lib";
-       version = "0.3";
-       sha256 = "15b3gsy03z3hqc0d2b7hjk3l79ykkcdhb5mrz453p8s4bgd8l6av";
+       version = "0.4";
+       sha256 = "0jp0k27vvdz4lfrdi7874j7gnnn051kvqfn1k3zg1ap4m9jzyb45";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -271767,6 +272802,29 @@ self: {
        license = lib.licenses.gpl2Only;
      }) {};
 
+  "texmath_0_12_4" = callPackage
+    ({ mkDerivation, base, bytestring, containers, directory, filepath
+     , mtl, pandoc-types, parsec, process, split, syb, temporary, text
+     , utf8-string, xml
+     }:
+     mkDerivation {
+       pname = "texmath";
+       version = "0.12.4";
+       sha256 = "1k7hh75jzgysh7b7jkvy4w07dbkvm5fcc5hkkixz6xzrp2fvnws3";
+       isLibrary = true;
+       isExecutable = true;
+       libraryHaskellDepends = [
+         base containers mtl pandoc-types parsec split syb text xml
+       ];
+       testHaskellDepends = [
+         base bytestring directory filepath process temporary text
+         utf8-string xml
+       ];
+       description = "Conversion between math formats";
+       license = lib.licenses.gpl2Only;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "texrunner" = callPackage
     ({ mkDerivation, attoparsec, base, bytestring, directory, filepath
      , HUnit, io-streams, lens, mtl, process, semigroups, temporary
@@ -272545,7 +273603,7 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
-  "text-show_3_9_5" = callPackage
+  "text-show_3_9_6" = callPackage
     ({ mkDerivation, array, base, base-compat-batteries, base-orphans
      , bifunctors, bytestring, bytestring-builder, containers, criterion
      , deepseq, deriving-compat, generic-deriving, ghc-boot-th, ghc-prim
@@ -272555,8 +273613,8 @@ self: {
      }:
      mkDerivation {
        pname = "text-show";
-       version = "3.9.5";
-       sha256 = "03gp01wim236xdznxi5naq42lz9whdb2ms8xj01g39l54i83n22q";
+       version = "3.9.6";
+       sha256 = "1wcnwfshsscwy96jg709m2vrprcy4hi65n7f65a45q9rr81jiriw";
        libraryHaskellDepends = [
          array base base-compat-batteries bifunctors bytestring
          bytestring-builder containers generic-deriving ghc-boot-th ghc-prim
@@ -275500,8 +276558,8 @@ self: {
        pname = "timer-wheel";
        version = "0.3.0";
        sha256 = "16v663mcsj0h17x4jriq50dps3m3f8wqcsm19kl48vrs7f4mp07s";
-       revision = "1";
-       editedCabalFile = "03wprm88wl6smfcq6dfr62l4igi8lfg6wkk65rsmyzxxkjzhc6f1";
+       revision = "2";
+       editedCabalFile = "0kfckbmcf9c8538i38r40agrc31mgk771hfnm54sgslnam1idiym";
        libraryHaskellDepends = [ atomic-primops base psqueues vector ];
        testHaskellDepends = [ base ];
        description = "A timer wheel";
@@ -275700,8 +276758,8 @@ self: {
      }:
      mkDerivation {
        pname = "timezone-olson-th";
-       version = "0.1.0.10";
-       sha256 = "0lks0mgshcsq36aminfbrz524mgn5q02lwln8lli1l54d8bn4x8n";
+       version = "0.1.0.11";
+       sha256 = "0lpsmjy99l1yqz23dqb31cx08wg19bd4qzfmsqzz7hfmz0dgjqsj";
        libraryHaskellDepends = [
          base template-haskell time timezone-olson timezone-series
        ];
@@ -278311,6 +279369,8 @@ self: {
        pname = "transformers-compat";
        version = "0.7.1";
        sha256 = "102hydcqn7yjskzp586fvsw39dp3fi34fkskc7ykqkf16haqc2xc";
+       revision = "1";
+       editedCabalFile = "03xi4gxwvim33xkv289g6wz9dpz43zd91s5j2ini7bhcg40gagl7";
        libraryHaskellDepends = [ base ghc-prim transformers ];
        description = "A small compatibility shim for the transformers library";
        license = lib.licenses.bsd3;
@@ -280461,16 +281521,16 @@ self: {
 
   "twain" = callPackage
     ({ mkDerivation, aeson, base, bytestring, case-insensitive, cookie
-     , either, http-types, text, time, transformers, wai, wai-extra
-     , warp
+     , either, exceptions, http-types, http2, text, time, transformers
+     , vault, wai, wai-extra
      }:
      mkDerivation {
        pname = "twain";
-       version = "1.0.0.0";
-       sha256 = "0brxvqddnhxs4q5hm9g8fzkznk3xjagivy0glfiqrx24p4k8s9yb";
+       version = "2.0.1.0";
+       sha256 = "0wal0qr3bacy7phgbvi2sif5q490jk8mhw675lpl2ch8dmmf769p";
        libraryHaskellDepends = [
-         aeson base bytestring case-insensitive cookie either http-types
-         text time transformers wai wai-extra warp
+         aeson base bytestring case-insensitive cookie either exceptions
+         http-types http2 text time transformers vault wai wai-extra
        ];
        description = "Tiny web application framework for WAI";
        license = lib.licenses.bsd3;
@@ -281631,6 +282691,8 @@ self: {
        pname = "type-map";
        version = "0.1.6.0";
        sha256 = "0zakl5bdzwng1r0x384w066zhwgwcf24s6jsm6d4zsx7xmngzmr5";
+       revision = "1";
+       editedCabalFile = "184jzydzkm8qa3wbfzx173yjhydss9fnki0g81dp4yij90lr1qf9";
        libraryHaskellDepends = [ base containers ghc-prim vector ];
        testHaskellDepends = [
          base HUnit test-framework test-framework-hunit
@@ -281639,6 +282701,23 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
+  "type-map_0_1_7_0" = callPackage
+    ({ mkDerivation, base, containers, ghc-prim, HUnit, test-framework
+     , test-framework-hunit, vector
+     }:
+     mkDerivation {
+       pname = "type-map";
+       version = "0.1.7.0";
+       sha256 = "0612y1n2ydnb5sw411a1xnjmp03qhjl3iv9pnwdj59l17bcmqq21";
+       libraryHaskellDepends = [ base containers ghc-prim vector ];
+       testHaskellDepends = [
+         base HUnit test-framework test-framework-hunit
+       ];
+       description = "Type-indexed maps";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "type-natural" = callPackage
     ({ mkDerivation, base, constraints, equational-reasoning, ghc
      , ghc-typelits-knownnat, ghc-typelits-natnormalise
@@ -283794,6 +284873,8 @@ self: {
        pname = "unicode-data";
        version = "0.3.0";
        sha256 = "0pwjjsk0gjkn73ghj10s603p84xr7h2kfg351c9grzngrcv9giq8";
+       revision = "1";
+       editedCabalFile = "1invxbc1f635rywnkcpap9s93z08mbdfi3rzi7882lssf1wy0i85";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [ base ];
@@ -283932,6 +285013,8 @@ self: {
        pname = "unicode-transforms";
        version = "0.4.0";
        sha256 = "0m234yhjizl28xm8y08bdhrbni666r7q2z71a8s64lynqk4lzq5k";
+       revision = "1";
+       editedCabalFile = "18k7z25byg9x05rydbcgjfvhz9qdv6yxjvxac58kxw8pfj8xlcap";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -284539,8 +285622,8 @@ self: {
      }:
      mkDerivation {
        pname = "units";
-       version = "2.4.1.4";
-       sha256 = "1r6innb99d6ljbbbrl2q9i4l6j4cb96mmv0k56q9l2xckwlsfz32";
+       version = "2.4.1.5";
+       sha256 = "09ssrid1an2nv6j9skb787i3hqiz5hgz020q13552w55m0smw4c9";
        libraryHaskellDepends = [
          base containers deepseq lens linear mtl multimap singletons syb
          template-haskell th-desugar units-parser vector-space
@@ -284959,6 +286042,18 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "unix-compat_0_5_4" = callPackage
+    ({ mkDerivation, base, unix }:
+     mkDerivation {
+       pname = "unix-compat";
+       version = "0.5.4";
+       sha256 = "1cd4lh2c16h7y5hzrcn5l9vir8aq2wcizwksppnagklsdsfmf942";
+       libraryHaskellDepends = [ base unix ];
+       description = "Portable POSIX-compatibility layer";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "unix-fcntl" = callPackage
     ({ mkDerivation, base, foreign-var }:
      mkDerivation {
@@ -289298,8 +290393,8 @@ self: {
      }:
      mkDerivation {
        pname = "verset";
-       version = "0.0.1.6";
-       sha256 = "1fk53vd2mh6ngrj4v2322fzdx0k0cj0zc2w1xpwkvyy3584l8af8";
+       version = "0.0.1.7";
+       sha256 = "12bbadznnp4pksy1yb7lw4zniksnaz7ipmfyji0ak6b0bqfh74s2";
        libraryHaskellDepends = [
          base bytestring containers extra mtl safe text time uuid
        ];
@@ -290054,8 +291149,8 @@ self: {
      }:
      mkDerivation {
        pname = "vivid";
-       version = "0.5.1.0";
-       sha256 = "06skwy5k4sgmh7m20m5v3g82kvm6sxq2sxmg039s45pvkbfp1c32";
+       version = "0.5.2.0";
+       sha256 = "1p4x6q2ks259xzigj31f8bz3562k07dzj77a9bnhl934sl85hz6q";
        libraryHaskellDepends = [
          base binary bytestring cereal containers directory filepath
          hashable MonadRandom mtl network process random random-shuffle
@@ -290963,6 +292058,17 @@ self: {
        hydraPlatforms = lib.platforms.none;
      }) {};
 
+  "wai-env" = callPackage
+    ({ mkDerivation, base, data-default, vault, wai }:
+     mkDerivation {
+       pname = "wai-env";
+       version = "1.0.0.0";
+       sha256 = "03hnp38qgi2qqkzpds7ac2arvsjvpbfdkwwfcl5c6f6zjdwzq97y";
+       libraryHaskellDepends = [ base data-default vault wai ];
+       description = "WAI middleware to parameterize requests with environment";
+       license = lib.licenses.bsd3;
+     }) {};
+
   "wai-eventsource" = callPackage
     ({ mkDerivation, wai }:
      mkDerivation {
@@ -292760,15 +293866,13 @@ self: {
   "warc" = callPackage
     ({ mkDerivation, attoparsec, base, bytestring, errors, exceptions
      , filepath, free, hashable, lens, mmorph, optparse-applicative
-     , pipes, pipes-attoparsec, pipes-bytestring, pipes-zlib, text, time
+     , pipes, pipes-attoparsec, pipes-bytestring, text, time
      , transformers, unordered-containers
      }:
      mkDerivation {
        pname = "warc";
-       version = "1.0.4";
-       sha256 = "1mxfm8kdvm0l1lnzma4n9mriz94ypckxqcz1f34fa3n1j3ckc45b";
-       revision = "6";
-       editedCabalFile = "0s563lg70ks3s6plvwi79glq6vkrh7n769fh6l6b4pvj7vp604cj";
+       version = "1.0.5";
+       sha256 = "1s01x0w37gsh4kkv1jq54i0yf7mxk6m6jr6djwql8dz8nqrny8j7";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -292778,8 +293882,8 @@ self: {
        ];
        executableHaskellDepends = [
          attoparsec base bytestring errors exceptions filepath free lens
-         optparse-applicative pipes pipes-attoparsec pipes-bytestring
-         pipes-zlib text time transformers
+         optparse-applicative pipes pipes-attoparsec pipes-bytestring text
+         time transformers
        ];
        description = "A parser for the Web Archive (WARC) format";
        license = lib.licenses.bsd3;
@@ -294014,6 +295118,41 @@ self: {
        broken = true;
      }) {};
 
+  "webgear-core" = callPackage
+    ({ mkDerivation, arrows, base, bytestring, case-insensitive
+     , filepath, http-api-data, http-media, http-types, jose, mime-types
+     , network, safe-exceptions, tagged, template-haskell, text
+     , unordered-containers, wai
+     }:
+     mkDerivation {
+       pname = "webgear-core";
+       version = "1.0.1";
+       sha256 = "06yg14x40j7jg5gy875f2g4fplnh08678qy3naqapd8ysvw52rmb";
+       libraryHaskellDepends = [
+         arrows base bytestring case-insensitive filepath http-api-data
+         http-media http-types jose mime-types network safe-exceptions
+         tagged template-haskell text unordered-containers wai
+       ];
+       description = "Composable, type-safe library to build HTTP APIs";
+       license = lib.licenses.mpl20;
+     }) {};
+
+  "webgear-openapi" = callPackage
+    ({ mkDerivation, arrows, base, http-media, http-types
+     , insert-ordered-containers, lens, openapi3, text, webgear-core
+     }:
+     mkDerivation {
+       pname = "webgear-openapi";
+       version = "1.0.1";
+       sha256 = "0fxj5bhsqxkjizyl0wcwbs5ai05lksf3cwzz2535lb4rh90ndx3b";
+       libraryHaskellDepends = [
+         arrows base http-media http-types insert-ordered-containers lens
+         openapi3 text webgear-core
+       ];
+       description = "Composable, type-safe library to build HTTP API servers";
+       license = lib.licenses.mpl20;
+     }) {};
+
   "webgear-server" = callPackage
     ({ mkDerivation, aeson, base, base64-bytestring, bytestring
      , bytestring-conversion, case-insensitive, http-api-data
@@ -294040,6 +295179,32 @@ self: {
        license = lib.licenses.mpl20;
      }) {};
 
+  "webgear-server_1_0_1" = callPackage
+    ({ mkDerivation, aeson, arrows, base, base64-bytestring, bytestring
+     , bytestring-conversion, http-api-data, http-media, http-types
+     , jose, monad-time, mtl, QuickCheck, quickcheck-instances, tasty
+     , tasty-hunit, tasty-quickcheck, text, unordered-containers, wai
+     , webgear-core
+     }:
+     mkDerivation {
+       pname = "webgear-server";
+       version = "1.0.1";
+       sha256 = "0v27iq4jqbxyn66pzi7sz0qapd4a0k1iifvj2ng488jl2j852xa2";
+       libraryHaskellDepends = [
+         aeson arrows base base64-bytestring bytestring
+         bytestring-conversion http-api-data http-media http-types jose
+         monad-time mtl text unordered-containers wai webgear-core
+       ];
+       testHaskellDepends = [
+         base base64-bytestring bytestring http-types QuickCheck
+         quickcheck-instances tasty tasty-hunit tasty-quickcheck text wai
+         webgear-core
+       ];
+       description = "Composable, type-safe library to build HTTP API servers";
+       license = lib.licenses.mpl20;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "webidl" = callPackage
     ({ mkDerivation, base, bytestring, HSFFIG, LEXER, parsec, pretty
      , utf8-env, utf8-string
@@ -295141,8 +296306,8 @@ self: {
        pname = "windns";
        version = "0.1.0.1";
        sha256 = "016d1cf51jqvhbzlf5kbizv4l4dymradac1420rl47q2k5faczq8";
-       revision = "3";
-       editedCabalFile = "10jidn34rmv0amhw3c24pkl64q5xl3c6l9yqwcvqdn0vkbd0bf2v";
+       revision = "4";
+       editedCabalFile = "17wzjaj16q4bm8kz2mcs02naj6v89lnbwjfgmrf81c9dw873l9px";
        libraryHaskellDepends = [ base bytestring deepseq ];
        librarySystemDepends = [ dnsapi ];
        description = "Domain Name Service (DNS) lookup via the <windns.h>/dnsapi.dll standard library";
@@ -295332,6 +296497,26 @@ self: {
        maintainers = with lib.maintainers; [ maralorn ];
      }) {};
 
+  "witch_1_0_0_1" = callPackage
+    ({ mkDerivation, base, bytestring, containers, HUnit
+     , template-haskell, text, time
+     }:
+     mkDerivation {
+       pname = "witch";
+       version = "1.0.0.1";
+       sha256 = "010agcfcmyjmcz6wl7wrwd6w7y60d4163vlvrp1b2h8w86z87jlm";
+       libraryHaskellDepends = [
+         base bytestring containers template-haskell text time
+       ];
+       testHaskellDepends = [
+         base bytestring containers HUnit template-haskell text time
+       ];
+       description = "Convert values from one type into another";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+       maintainers = with lib.maintainers; [ maralorn ];
+     }) {};
+
   "with-index" = callPackage
     ({ mkDerivation, base }:
      mkDerivation {
@@ -295660,6 +296845,18 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "wl-pprint-text_1_2_0_2" = callPackage
+    ({ mkDerivation, base, base-compat, text }:
+     mkDerivation {
+       pname = "wl-pprint-text";
+       version = "1.2.0.2";
+       sha256 = "0axivwh7bxmljxpfnccs66knxzrqck07byxmp2j737xbb26pf5cj";
+       libraryHaskellDepends = [ base base-compat text ];
+       description = "A Wadler/Leijen Pretty Printer for Text values";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "wlc-hs" = callPackage
     ({ mkDerivation, base, c2hs, containers, data-default, lens, pretty
      , process, transformers, wlc, xkbcommon
@@ -296031,8 +297228,8 @@ self: {
      }:
      mkDerivation {
        pname = "wordlist";
-       version = "0.1.0.4";
-       sha256 = "0v2xnm4iqk8wh3l05vkmfblwk49q54awp2qr1cwszgxfzaz4n9zb";
+       version = "0.1.0.5";
+       sha256 = "11h52dykc23ks3wn3apnp81jm091igqy8dkgs7apk8yh141vdfak";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [ base optparse-applicative text ];
@@ -297117,6 +298314,21 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
+  "wuss_2_0_0_1" = callPackage
+    ({ mkDerivation, base, bytestring, connection, network, websockets
+     }:
+     mkDerivation {
+       pname = "wuss";
+       version = "2.0.0.1";
+       sha256 = "17s6wilzyzsdc174a3an12pkq20cy7x2pfrn4jmdp30f468r47fb";
+       libraryHaskellDepends = [
+         base bytestring connection network websockets
+       ];
+       description = "Secure WebSocket (WSS) clients";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "wx" = callPackage
     ({ mkDerivation, base, stm, time, wxcore }:
      mkDerivation {
@@ -298344,6 +299556,27 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "xml-hamlet_0_5_0_2" = callPackage
+    ({ mkDerivation, base, containers, hspec, HUnit, parsec
+     , shakespeare, template-haskell, text, xml-conduit
+     }:
+     mkDerivation {
+       pname = "xml-hamlet";
+       version = "0.5.0.2";
+       sha256 = "109fck1626d74s00ssjffg837584wf7dxpswkil37wqqfy94mw2z";
+       libraryHaskellDepends = [
+         base containers parsec shakespeare template-haskell text
+         xml-conduit
+       ];
+       testHaskellDepends = [
+         base containers hspec HUnit parsec shakespeare template-haskell
+         text xml-conduit
+       ];
+       description = "Hamlet-style quasiquoter for XML content";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "xml-helpers" = callPackage
     ({ mkDerivation, base, xml }:
      mkDerivation {
diff --git a/pkgs/development/haskell-modules/patches/hnix.patch b/pkgs/development/haskell-modules/patches/hnix.patch
new file mode 100644
index 00000000000..25373db15ac
--- /dev/null
+++ b/pkgs/development/haskell-modules/patches/hnix.patch
@@ -0,0 +1,24 @@
+From 06b12ab8a733d4de2a39060ba29c06e4ec1c1187 Mon Sep 17 00:00:00 2001
+From: Anton Latukha <anton.latukha@gmail.com>
+Date: Sun, 16 Jan 2022 18:16:50 +0200
+Subject: [PATCH] fix aeson <2 support
+
+---
+ src/Nix/Json.hs | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/Nix/Json.hs b/src/Nix/Json.hs
+index 3fe05269..329899e4 100644
+--- a/src/Nix/Json.hs
++++ b/src/Nix/Json.hs
+@@ -9,6 +9,8 @@ import qualified Data.Text.Lazy.Encoding       as TL
+ #if MIN_VERSION_aeson(2,0,0)
+ import qualified Data.Aeson.Key                as AKM
+ import qualified Data.Aeson.KeyMap             as AKM
++#else
++import           Nix.Expr.Types
+ #endif
+ import qualified Data.Vector                   as V
+ import           Nix.Atoms
+-- 
+2.34.1
diff --git a/pkgs/development/interpreters/acl2/default.nix b/pkgs/development/interpreters/acl2/default.nix
index a1b59b8bf69..51b1cfa1141 100644
--- a/pkgs/development/interpreters/acl2/default.nix
+++ b/pkgs/development/interpreters/acl2/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, callPackage, fetchFromGitHub, runCommandLocal, makeWrapper, substituteAll
 , sbcl, bash, which, perl, hostname
-, openssl, glucose, minisat, abc-verifier, z3, python
+, openssl, glucose, minisat, abc-verifier, z3, python2
 , certifyBooks ? true
 } @ args:
 
@@ -48,7 +48,7 @@ in stdenv.mkDerivation rec {
     which perl hostname makeWrapper
     # Some of the books require one or more of these external tools:
     openssl.out glucose minisat abc-verifier libipasir
-    z3 (python.withPackages (ps: [ ps.z3 ]))
+    z3 (python2.withPackages (ps: [ ps.z3 ]))
   ];
 
   # NOTE: Parallel building can be memory-intensive depending on the number of
diff --git a/pkgs/development/interpreters/clojurescript/lumo/default.nix b/pkgs/development/interpreters/clojurescript/lumo/default.nix
index 7bd3913260d..d8fa630c30d 100644
--- a/pkgs/development/interpreters/clojurescript/lumo/default.nix
+++ b/pkgs/development/interpreters/clojurescript/lumo/default.nix
@@ -8,7 +8,7 @@
 , unzip
 , nodePackages
 , xcbuild
-, python
+, python2
 , openssl
 , pkgs
 , fetchgit
@@ -154,7 +154,7 @@ stdenv.mkDerivation {
     nodejs
     clojure
     jre
-    python
+    python2
     openssl
     gnutar
     nodePackages."lumo-build-deps-../interpreters/clojurescript/lumo"
diff --git a/pkgs/development/interpreters/lunatic/default.nix b/pkgs/development/interpreters/lunatic/default.nix
index cf4339c69ac..bf53e71a221 100644
--- a/pkgs/development/interpreters/lunatic/default.nix
+++ b/pkgs/development/interpreters/lunatic/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lunatic";
-  version = "0.7.0";
+  version = "0.7.4";
 
   src = fetchFromGitHub {
     owner = "lunatic-solutions";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+4014p+4QJ7nytFHHszAOYQHXLYXqR+Cip+vHxsH9l8=";
+    sha256 = "sha256-RX8JarGpY6dhPGpvOX1FuUjirEPff0wGqLkGFxOa+bc=";
   };
 
-  cargoSha256 = "sha256-RnaAiumTP4cW2eHUbnwyPdgJQLK65gqDI/NP2SOrO4E=";
+  cargoSha256 = "sha256-UvrDqxaZSgUJ/a6abigTuiUOfw+C7UolBApt5kVR+yo=";
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/development/interpreters/php/7.4.nix b/pkgs/development/interpreters/php/7.4.nix
index 1cc63d7b58a..316b37f2e09 100644
--- a/pkgs/development/interpreters/php/7.4.nix
+++ b/pkgs/development/interpreters/php/7.4.nix
@@ -2,8 +2,8 @@
 
 let
   base = callPackage ./generic.nix (_args // {
-    version = "7.4.26";
-    sha256 = "0k803j5wf4jv72px0zqz2z2hxyk2w3jr6xyczy568dx4z2l8i2yn";
+    version = "7.4.27";
+    sha256 = "184aaef313fbf28c9987f6aa07b655cd1b0eae9e7e17061775a3e7d880185563";
   });
 
 in
diff --git a/pkgs/development/interpreters/php/8.0.nix b/pkgs/development/interpreters/php/8.0.nix
index 8cf7d4ebc8d..b34f5974ff4 100644
--- a/pkgs/development/interpreters/php/8.0.nix
+++ b/pkgs/development/interpreters/php/8.0.nix
@@ -2,8 +2,8 @@
 
 let
   base = callPackage ./generic.nix (_args // {
-    version = "8.0.13";
-    sha256 = "0djqh650clz4fy1zifazf0jq383znksydx23f1s48prrlixrshf2";
+    version = "8.0.14";
+    sha256 = "0jydl388mpysrrxa7h9sxf3fpp38mmygg9ryq8j7rb8p93giyf5v";
   });
 
 in
diff --git a/pkgs/development/interpreters/wasmtime/default.nix b/pkgs/development/interpreters/wasmtime/default.nix
index 675a7cdd6bc..6022245cac7 100644
--- a/pkgs/development/interpreters/wasmtime/default.nix
+++ b/pkgs/development/interpreters/wasmtime/default.nix
@@ -1,4 +1,4 @@
-{ rustPlatform, fetchFromGitHub, lib, python, cmake, llvmPackages, clang, stdenv, darwin }:
+{ rustPlatform, fetchFromGitHub, lib, python2, cmake, llvmPackages, clang, stdenv, darwin }:
 
 rustPlatform.buildRustPackage rec {
   pname = "wasmtime";
@@ -14,7 +14,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "1wlig9gls7s1k1swxwhl82vfga30bady8286livxc4y2zp0vb18w";
 
-  nativeBuildInputs = [ python cmake clang ];
+  nativeBuildInputs = [ python2 cmake clang ];
   buildInputs = [ llvmPackages.libclang ] ++
    lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
   LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
diff --git a/pkgs/development/interpreters/yex-lang/default.nix b/pkgs/development/interpreters/yex-lang/default.nix
new file mode 100644
index 00000000000..738b73d8e4c
--- /dev/null
+++ b/pkgs/development/interpreters/yex-lang/default.nix
@@ -0,0 +1,24 @@
+{ lib, stdenv, rustPlatform, fetchFromGitHub }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "yex-lang";
+  version = "unstable-2021-12-25";
+
+  src = fetchFromGitHub {
+    owner = "nonamescm";
+    repo = "yex-lang";
+    rev = "a97def1431b73b8693700f530ec023f1776eaf83";
+    hash = "sha256-CEzJtlEVMvMnRyUKdko1UDTluv8Fc88tfOpKGIFMnRw=";
+  };
+
+  cargoSha256 = "sha256-mHMenqcdt9Yjm/6H1Ywf637Sv8ddq6a4Eu2/A/jX9gQ=";
+
+  meta = with lib; {
+    homepage = "https://github.com/nonamesc/yex-lang";
+    description = "A cool functional scripting language written in rust";
+    license = licenses.mit;
+    maintainers = with maintainers; [ AndersonTorres ];
+    platforms = platforms.unix;
+    broken = stdenv.isAarch64 && stdenv.isLinux;
+  };
+}
diff --git a/pkgs/development/libraries/arrayfire/default.nix b/pkgs/development/libraries/arrayfire/default.nix
index a66db480017..bc0da2ddea2 100644
--- a/pkgs/development/libraries/arrayfire/default.nix
+++ b/pkgs/development/libraries/arrayfire/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchFromGitHub, cmake, pkg-config
+{ lib, stdenv, fetchFromGitHub, cmake, pkg-config
 , opencl-clhpp, ocl-icd, fftw, fftwFloat
 , blas, lapack, boost, mesa, libGLU, libGL
 , freeimage, python3, clfft, clblas
@@ -8,11 +8,14 @@
 
 stdenv.mkDerivation rec {
   pname = "arrayfire";
-  version = "3.6.4";
+  version = "3.7.3";
 
-  src = fetchurl {
-    url = "http://arrayfire.com/arrayfire_source/arrayfire-full-${version}.tar.bz2";
-    sha256 = "1fin7a9rliyqic3z83agkpb8zlq663q6gdxsnm156cs8s7f7rc9h";
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0gcbg6b6gs38xhks5pp0vkcqs89zl7rh9982jqlzsd0h724qddw0";
+    fetchSubmodules = true;
   };
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/audio/zita-alsa-pcmi/default.nix b/pkgs/development/libraries/audio/zita-alsa-pcmi/default.nix
index afecd561b72..3a1118c0d81 100644
--- a/pkgs/development/libraries/audio/zita-alsa-pcmi/default.nix
+++ b/pkgs/development/libraries/audio/zita-alsa-pcmi/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "zita-alsa-pcmi";
-  version = "0.3.2";
+  version = "0.4.0";
   src = fetchurl {
     url = "http://kokkinizita.linuxaudio.org/linuxaudio/downloads/${pname}-${version}.tar.bz2";
-    sha256 = "12d7vdg74yh21w69qi0wg57iz4876j94qbiq09bvscih6xz9y78s";
+    sha256 = "sha256-vYyfNg37VB+2DkinE7rx4i1BssdMGaD+ny005y9Q8cU=";
   };
 
   buildInputs = [ alsa-lib ];
diff --git a/pkgs/development/libraries/blitz/default.nix b/pkgs/development/libraries/blitz/default.nix
index c4a983d879c..2b5e5a4addc 100644
--- a/pkgs/development/libraries/blitz/default.nix
+++ b/pkgs/development/libraries/blitz/default.nix
@@ -4,7 +4,7 @@
 , pkg-config
 , gfortran
 , texinfo
-, python
+, python2
 , boost
   # Select SIMD alignment width (in bytes) for vectorization.
 , simdWidth ? 1
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     sha256 = "0nq84vwvvbq7m0my6h835ijfw53bxdp42qjc6kjhk436888qy9rh";
   };
 
-  nativeBuildInputs = [ pkg-config python texinfo ];
+  nativeBuildInputs = [ pkg-config python2 texinfo ];
   buildInputs = [ gfortran texinfo boost ];
 
   configureFlags =
diff --git a/pkgs/development/libraries/freenect/default.nix b/pkgs/development/libraries/freenect/default.nix
index 0e96a346f41..59b16138404 100644
--- a/pkgs/development/libraries/freenect/default.nix
+++ b/pkgs/development/libraries/freenect/default.nix
@@ -18,6 +18,11 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkg-config ];
 
+  # see https://aur.archlinux.org/cgit/aur.git/commit/PKGBUILD?h=libfreenect&id=0d17db49ba64bcb9e3a4eed61cf55c9a5ceb97f1
+  patchPhase = lib.concatMapStrings (x: ''
+    substituteInPlace ${x} --replace "{GLUT_LIBRARY}" "{GLUT_LIBRARIES}"
+  '') [ "examples/CMakeLists.txt" "wrappers/cpp/CMakeLists.txt" ];
+
   meta = {
     description = "Drivers and libraries for the Xbox Kinect device on Windows, Linux, and macOS";
     homepage = "http://openkinect.org";
diff --git a/pkgs/development/libraries/highfive/default.nix b/pkgs/development/libraries/highfive/default.nix
index 015147d70bc..1a8ea5c1ae5 100644
--- a/pkgs/development/libraries/highfive/default.nix
+++ b/pkgs/development/libraries/highfive/default.nix
@@ -12,13 +12,13 @@ assert mpiSupport -> mpi != null;
 
 stdenv.mkDerivation rec {
   pname = "highfive";
-  version = "2.2";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "BlueBrain";
     repo = "HighFive";
-    rev = "4c70d818ed18231563fe49ff197d1c41054be592";
-    sha256 = "02xy3c2ix3nw8109aw75ixj651knzc5rjqwqrxximm4hzwx09frk";
+    rev = "v${version}";
+    sha256 = "qaIThJGdoLgs82h+W4BKQEu1yy1bB8bZFiuxI7IxInw=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/libpqxx/default.nix b/pkgs/development/libraries/libpqxx/default.nix
index e95adbd6294..d7eba4c8739 100644
--- a/pkgs/development/libraries/libpqxx/default.nix
+++ b/pkgs/development/libraries/libpqxx/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libpqxx";
-  version = "7.6.0";
+  version = "7.7.0";
 
   src = fetchFromGitHub {
     owner = "jtv";
     repo = pname;
     rev = version;
-    sha256 = "sha256-shcGJebjXJ3ORvcdINJFLiuW7ySqe6HyPUQioeUG/wM=";
+    sha256 = "sha256-O30czHwEDXz5xY4o3MWhmEK06OKTKMQCy0M6qwSEpy8=";
   };
 
   nativeBuildInputs = [ gnused python3 ];
diff --git a/pkgs/development/libraries/nsync/default.nix b/pkgs/development/libraries/nsync/default.nix
new file mode 100644
index 00000000000..a00893c1573
--- /dev/null
+++ b/pkgs/development/libraries/nsync/default.nix
@@ -0,0 +1,29 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+}:
+
+stdenv.mkDerivation rec {
+  pname = "nsync";
+  version = "1.24.0";
+
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-jQJtlBDR6efBe1tFOUOZ6awaMTT33qM/GbvbwiWTZxw=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = {
+    homepage = "https://github.com/google/nsync";
+    description = "C library that exports various synchronization primitives";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ puffnfresh ];
+    # On macOS we get an error for some reason:
+    # > mkdir: cannot create directory 'build': File exists
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/development/libraries/ntrack/default.nix b/pkgs/development/libraries/ntrack/default.nix
index eef6bbdd580..033b9d8c619 100644
--- a/pkgs/development/libraries/ntrack/default.nix
+++ b/pkgs/development/libraries/ntrack/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, qt4, pkg-config, libnl, python }:
+{ lib, stdenv, fetchurl, qt4, pkg-config, libnl, python2 }:
 
 stdenv.mkDerivation rec {
   pname = "ntrack";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libnl qt4 ];
 
-  nativeBuildInputs = [ pkg-config python ];
+  nativeBuildInputs = [ pkg-config python2 ];
 
   # error: ISO C does not support '__FUNCTION__' predefined identifier [-Werror=pedantic]
   NIX_CFLAGS_COMPILE = "-Wno-error";
diff --git a/pkgs/development/libraries/openbabel/2.nix b/pkgs/development/libraries/openbabel/2.nix
index 4f2f31d614c..627d5bbe297 100644
--- a/pkgs/development/libraries/openbabel/2.nix
+++ b/pkgs/development/libraries/openbabel/2.nix
@@ -1,4 +1,4 @@
-{stdenv, lib, fetchFromGitHub, fetchpatch, cmake, zlib, libxml2, eigen, python, cairo, pcre, pkg-config }:
+{stdenv, lib, fetchFromGitHub, fetchpatch, cmake, zlib, libxml2, eigen, python2, cairo, pcre, pkg-config }:
 
 stdenv.mkDerivation rec {
   pname = "openbabel";
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  buildInputs = [ zlib libxml2 eigen python cairo pcre ];
+  buildInputs = [ zlib libxml2 eigen python2 cairo pcre ];
 
   nativeBuildInputs = [ cmake pkg-config ];
 
diff --git a/pkgs/development/libraries/opencv/default.nix b/pkgs/development/libraries/opencv/default.nix
index ed2f700dc82..34dcd240838 100644
--- a/pkgs/development/libraries/opencv/default.nix
+++ b/pkgs/development/libraries/opencv/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, cmake, pkg-config, unzip
 , zlib
-, enablePython ? false, pythonPackages
+, enablePython ? false, python2Packages
 , enableGtk2 ? false, gtk2
 , enableJPEG ? true, libjpeg
 , enablePNG ? true, libpng
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
 
   buildInputs =
        [ zlib ]
-    ++ lib.optional enablePython pythonPackages.python
+    ++ lib.optional enablePython python2Packages.python
     ++ lib.optional enableGtk2 gtk2
     ++ lib.optional enableJPEG libjpeg
     ++ lib.optional enablePNG libpng
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.isDarwin [ Cocoa QTKit ]
     ;
 
-  propagatedBuildInputs = lib.optional enablePython pythonPackages.numpy;
+  propagatedBuildInputs = lib.optional enablePython python2Packages.numpy;
 
   nativeBuildInputs = [ cmake pkg-config unzip ];
 
diff --git a/pkgs/development/libraries/pcmsolver/default.nix b/pkgs/development/libraries/pcmsolver/default.nix
index 8cd4b318cc5..dd94a4a088c 100644
--- a/pkgs/development/libraries/pcmsolver/default.nix
+++ b/pkgs/development/libraries/pcmsolver/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, perl, gfortran, python
+{ lib, stdenv, fetchFromGitHub, cmake, perl, gfortran, python2
 , boost, eigen, zlib
 } :
 
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     cmake
     gfortran
     perl
-    python
+    python2
   ];
 
   buildInputs = [
diff --git a/pkgs/development/libraries/physics/fastjet/default.nix b/pkgs/development/libraries/physics/fastjet/default.nix
index 65fb04b707a..5c3bc936e8c 100644
--- a/pkgs/development/libraries/physics/fastjet/default.nix
+++ b/pkgs/development/libraries/physics/fastjet/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , fetchurl
-, python
+, python ? null
 , withPython ? false
 }:
 
diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix
index bd731e7b051..dcc077e3dd8 100644
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@@ -25,6 +25,8 @@
 , elogind
 # needed until gobject-introspection does cross-compile (https://github.com/NixOS/nixpkgs/pull/88222)
 , withIntrospection ? (stdenv.buildPlatform == stdenv.hostPlatform)
+# cross build fails on polkit-1-scan (https://github.com/NixOS/nixpkgs/pull/152704)
+, withGtkDoc ? (stdenv.buildPlatform == stdenv.hostPlatform)
 # A few tests currently fail on musl (polkitunixusertest, polkitunixgrouptest, polkitidentitytest segfault).
 # Not yet investigated; it may be due to the "Make netgroup support optional"
 # patch not updating the tests correctly yet, or doing something wrong,
@@ -119,7 +121,7 @@ stdenv.mkDerivation rec {
     "-Dos_type=redhat" # only affects PAM includes
     "-Dintrospection=${lib.boolToString withIntrospection}"
     "-Dtests=${lib.boolToString doCheck}"
-    "-Dgtk_doc=${lib.boolToString true}"
+    "-Dgtk_doc=${lib.boolToString withGtkDoc}"
     "-Dman=true"
   ] ++ lib.optionals stdenv.isLinux [
     "-Dsession_tracking=${if useSystemd then "libsystemd-login" else "libelogind"}"
diff --git a/pkgs/development/libraries/ptex/default.nix b/pkgs/development/libraries/ptex/default.nix
index d0bdb95fecc..561c9cf93c2 100644
--- a/pkgs/development/libraries/ptex/default.nix
+++ b/pkgs/development/libraries/ptex/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, zlib, python, cmake, pkg-config }:
+{ lib, stdenv, fetchFromGitHub, zlib, python2, cmake, pkg-config }:
 
 stdenv.mkDerivation rec
 {
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec
   outputs = [ "bin" "dev" "out" "lib" ];
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ zlib python pkg-config ];
+  buildInputs = [ zlib python2 pkg-config ];
 
   # Can be removed in the next release
   # https://github.com/wdas/ptex/pull/42
diff --git a/pkgs/development/libraries/rabbitmq-java-client/default.nix b/pkgs/development/libraries/rabbitmq-java-client/default.nix
index 96e4a42ad09..7cd3a086cdb 100644
--- a/pkgs/development/libraries/rabbitmq-java-client/default.nix
+++ b/pkgs/development/libraries/rabbitmq-java-client/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, lib, stdenv, ant, jdk, jre, python, makeWrapper }:
+{ fetchurl, lib, stdenv, ant, jdk, jre, python2, makeWrapper }:
 
 stdenv.mkDerivation rec {
   pname = "rabbitmq-java-client";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ ant jdk python ];
+  buildInputs = [ ant jdk python2 ];
 
   buildPhase = "ant dist";
 
diff --git a/pkgs/development/libraries/science/math/fenics/default.nix b/pkgs/development/libraries/science/math/fenics/default.nix
index e80607ab955..b65ab0bf63d 100644
--- a/pkgs/development/libraries/science/math/fenics/default.nix
+++ b/pkgs/development/libraries/science/math/fenics/default.nix
@@ -30,6 +30,15 @@
 let
   version = "2019.1.0";
 
+  # TODO: test with newer pytest
+  pytest = pythonPackages.callPackage
+    ../../../../python2-modules/pytest {
+      # hypothesis tests require pytest that causes dependency cycle
+      hypothesis = pythonPackages.hypothesis.override {
+        doCheck = false;
+      };
+    };
+
   dijitso = pythonPackages.buildPythonPackage {
     pname = "dijitso";
     inherit version;
diff --git a/pkgs/development/libraries/science/math/itpp/default.nix b/pkgs/development/libraries/science/math/itpp/default.nix
index 88560e0cd98..d7a0dcfe06a 100644
--- a/pkgs/development/libraries/science/math/itpp/default.nix
+++ b/pkgs/development/libraries/science/math/itpp/default.nix
@@ -49,5 +49,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3;
     platforms = platforms.unix;
     maintainers = with maintainers; [ andrew-d ];
+    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/itpp.x86_64-darwin
   };
 }
diff --git a/pkgs/development/libraries/seasocks/default.nix b/pkgs/development/libraries/seasocks/default.nix
index 8c5b4e87d9b..fd53db0dcf9 100644
--- a/pkgs/development/libraries/seasocks/default.nix
+++ b/pkgs/development/libraries/seasocks/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, python, zlib }:
+{ lib, stdenv, fetchFromGitHub, cmake, python3, zlib }:
 
 stdenv.mkDerivation rec {
   pname = "seasocks";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ zlib python ];
+  buildInputs = [ zlib python3 ];
 
   meta = with lib; {
     homepage = "https://github.com/mattgodbolt/seasocks";
diff --git a/pkgs/development/libraries/snack/default.nix b/pkgs/development/libraries/snack/default.nix
index 8c97d0224c6..1c876cf3636 100644
--- a/pkgs/development/libraries/snack/default.nix
+++ b/pkgs/development/libraries/snack/default.nix
@@ -1,6 +1,6 @@
-# alsa-lib vorbis-tools python can be made optional
+# alsa-lib vorbis-tools python2 can be made optional
 
-{ lib, stdenv, fetchurl, python, tcl, tk, vorbis-tools, pkg-config, xlibsWrapper }:
+{ lib, stdenv, fetchurl, python2, tcl, tk, vorbis-tools, pkg-config, xlibsWrapper }:
 
 stdenv.mkDerivation rec {
   pname = "snack";
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   postUnpack = ''sourceRoot="$sourceRoot/unix"'';
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ python tcl tk vorbis-tools xlibsWrapper ];
+  buildInputs = [ python2 tcl tk vorbis-tools xlibsWrapper ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/development/libraries/swiften/default.nix b/pkgs/development/libraries/swiften/default.nix
index 2325c043d01..ef30c5916ea 100644
--- a/pkgs/development/libraries/swiften/default.nix
+++ b/pkgs/development/libraries/swiften/default.nix
@@ -1,6 +1,6 @@
 { stdenv
 , lib
-, python
+, python2
 , libidn
 , lua
 , miniupnpc
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    python
+    python2
     libidn
     lua
     miniupnpc
diff --git a/pkgs/development/libraries/tiledb/default.nix b/pkgs/development/libraries/tiledb/default.nix
index 6bc0d3ef753..19ebadd895f 100644
--- a/pkgs/development/libraries/tiledb/default.nix
+++ b/pkgs/development/libraries/tiledb/default.nix
@@ -13,7 +13,7 @@
 , libpqxx
 , clang-tools
 , catch2
-, python
+, python3
 , gtest
 , doxygen
 , fixDarwinDylibNames
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     clang-tools
     cmake
-    python
+    python3
     doxygen
   ] ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
diff --git a/pkgs/development/libraries/uriparser/default.nix b/pkgs/development/libraries/uriparser/default.nix
index 0c48c6500c5..28eea052517 100644
--- a/pkgs/development/libraries/uriparser/default.nix
+++ b/pkgs/development/libraries/uriparser/default.nix
@@ -14,10 +14,10 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DURIPARSER_BUILD_DOCS=OFF"
-  ];
+  ] ++ lib.optional (!doCheck) "-DURIPARSER_BUILD_TESTS=OFF";
 
   checkInputs = [ gtest ];
-  doCheck = stdenv.targetPlatform.system == stdenv.hostPlatform.system;
+  doCheck = stdenv.buildPlatform == stdenv.hostPlatform;
 
   meta = with lib; {
     homepage = "https://uriparser.github.io/";
diff --git a/pkgs/development/libraries/v8/5_x.nix b/pkgs/development/libraries/v8/5_x.nix
deleted file mode 100644
index 441a5559b52..00000000000
--- a/pkgs/development/libraries/v8/5_x.nix
+++ /dev/null
@@ -1,199 +0,0 @@
-{ stdenv, lib, fetchgit, fetchFromGitHub, gyp, readline, python, which, icu
-, patchelf, coreutils, xcbuild
-, doCheck ? false
-, static ? false
-}:
-
-assert readline != null;
-
-let
-  arch = if stdenv.isx86_64 then "x64"
-            else if stdenv.isi686 then "ia32"
-            else if stdenv.isAarch64 then "arm64"
-            else if stdenv.isAarch32 then "arm"
-            else throw "Unknown architecture for v8";
-  git_url = "https://chromium.googlesource.com";
-  clangFlag = if stdenv.isDarwin then "1" else "0";
-  sharedFlag = if static then "static_library" else "shared_library";
-
-  deps = {
-    build = fetchgit {
-      url = "${git_url}/chromium/src/build.git";
-      rev = "2c67d4d74b6b3673228fab191918500a582ef3b0";
-      sha256 = "0jc7hci5yh792pw0ahjfxrk5xzllnlrv9llmwlgcgn2x8x6bn34q";
-    };
-    "tools/gyp" = fetchgit {
-      url = "${git_url}/external/gyp.git";
-      rev = "e7079f0e0e14108ab0dba58728ff219637458563";
-      sha256 = "0yd1ds13z0r9d2sb67f9i1gjn1zgzwyfv96qqqp6pn5pcfbialg6";
-    };
-    "third_party/icu" = fetchgit {
-      url = "${git_url}/chromium/deps/icu.git";
-      rev = "b5ecbb29a26532f72ef482569b223d5a51fd50bf";
-      sha256 = "0ld47wdnk8grcba221z67l3pnphv9zwifk4y44f5b946w3iwmpns";
-    };
-    buildtools = fetchgit {
-      url = "${git_url}/chromium/buildtools.git";
-      rev = "60f7f9a8b421ebf9a46041dfa2ff11c0fe59c582";
-      sha256 = "0i10bw7yhslklqwcx5krs3k05sicb73cpwd0mkaz96yxsvmkvjq0";
-    };
-    "base/trace_event/common" = fetchgit {
-      url = "${git_url}/chromium/src/base/trace_event/common.git";
-      rev = "315bf1e2d45be7d53346c31cfcc37424a32c30c8";
-      sha256 = "1pp2ygvp20j6g4868hrmiw0j704kdvsi9d9wx2gbk7w79rc36695";
-    };
-    "platform/inspector_protocol" = fetchgit {
-      url = "${git_url}/chromium/src/third_party/WebKit/Source/platform/inspector_protocol.git";
-      rev = "f49542089820a34a9a6e33264e09b73779407512";
-      sha256 = "1lwpass3p4rpp2kjmxxxpkqyv4lznxhf4i0yy7mmrd7jkpc7kn8k";
-    };
-    "tools/mb" = fetchgit {
-      url = "${git_url}/chromium/src/tools/mb.git";
-      rev = "0c4dc43c454f26936ddf3074ab8e9a41e3dc03a3";
-      sha256 = "0f96qphbmwn1pprv0a6xf68p01s1jzx2sz6pmadqbrs1dgh1xwnk";
-    };
-    "tools/swarming_client" = fetchgit {
-      url = "${git_url}/external/swarming.client.git";
-      rev = "7f63a272f7d9785ce41b6d10bb3106c49a968e57";
-      sha256 = "1pmb8bq4qifjf2dzz8c4jdwhlvwgrl9ycjaalcyh1sbh4lx3yvv2";
-    };
-    "testing/gtest" = fetchgit {
-      url = "${git_url}/external/github.com/google/googletest.git";
-      rev = "6f8a66431cb592dad629028a50b3dd418a408c87";
-      sha256 = "0bdba2lr6pg15bla9600zg0r0vm4lnrx0wqz84p376wfdxra24vw";
-    };
-    "testing/gmock" = fetchgit {
-      url = "${git_url}/external/googlemock.git";
-      rev = "0421b6f358139f02e102c9c332ce19a33faf75be";
-      sha256 = "1xiky4v98maxs8fg1avcd56y0alv3hw8qyrlpd899zgzbq2k10pp";
-    };
-    "test/benchmarks/data" = fetchgit {
-      url = "${git_url}/v8/deps/third_party/benchmarks.git";
-      rev = "05d7188267b4560491ff9155c5ee13e207ecd65f";
-      sha256 = "0ad2ay14bn67d61ks4dmzadfnhkj9bw28r4yjdjjyzck7qbnzchl";
-    };
-    "test/mozilla/data" = fetchgit {
-      url = "${git_url}/v8/deps/third_party/mozilla-tests.git";
-      rev = "f6c578a10ea707b1a8ab0b88943fe5115ce2b9be";
-      sha256 = "0rfdan76yfawqxbwwb35aa57b723j3z9fx5a2w16nls02yk2kqyn";
-    };
-    "test/simdjs/data" = fetchgit {
-      url = "${git_url}/external/github.com/tc39/ecmascript_simd.git";
-      rev = "baf493985cb9ea7cdbd0d68704860a8156de9556";
-      sha256 = "178r0k40a58c1187gfzqz2i6as34l8cliy1g1x870wyy0qcvlq2q";
-    };
-    "test/test262/data" = fetchgit {
-      url = "${git_url}/external/github.com/tc39/test262.git";
-      rev = "88bc7fe7586f161201c5f14f55c9c489f82b1b67";
-      sha256 = "0gc7fmaqrgwb6rl02jnrm3synpwzzg0dfqy3zm386r1qcisl93xs";
-    };
-    "test/test262/harness" = fetchgit {
-      url = "${git_url}/external/github.com/test262-utils/test262-harness-py.git";
-      rev = "cbd968f54f7a95c6556d53ba852292a4c49d11d8";
-      sha256 = "094c3600a4wh1m3fvvlivn290kik1pzzvwabq77lk8bh4jkkv7ki";
-    };
-    "tools/clang" = fetchgit {
-      url = "${git_url}/chromium/src/tools/clang.git";
-      rev = "496622ab4aaa5be7e5a9b80617013cb02f45dc87";
-      sha256 = "1gkhk2bzpxwzkirzcqfixxpprbr8mn6rk00krm25daarm3smydmf";
-    };
-  };
-
-in
-
-stdenv.mkDerivation rec {
-  pname = "v8";
-  version = "5.4.232";
-
-  inherit doCheck;
-
-  src = fetchFromGitHub {
-    owner = "v8";
-    repo = "v8";
-    rev = version;
-    sha256 = "1nqxbkz75m8xrjih0sj3f3iqvif4192vxdaxzy8r787rihjwg9nx";
-  };
-
-  postUnpack = ''
-    ${lib.concatStringsSep "\n" (
-      lib.mapAttrsToList (n: v: ''
-        mkdir -p $sourceRoot/${n}
-        cp -r ${v}/* $sourceRoot/${n}
-      '') deps)}
-  '';
-
-  # Patch based off of:
-  # https://github.com/cowboyd/libv8/tree/v5.1.281.67.0/patches
-  patches = lib.optional (!doCheck) ./libv8-5.4.232.patch;
-
-  postPatch = ''
-    sed -i 's,#!/usr/bin/env python,#!${python}/bin/python,' gypfiles/gyp_v8
-    sed -i 's,/bin/echo,${coreutils}/bin/echo,' gypfiles/standalone.gypi
-    sed -i '/CR_CLANG_REVISION/ d' gypfiles/standalone.gypi
-    sed -i 's/-Wno-format-pedantic//g' gypfiles/standalone.gypi
-  '';
-
-  configurePhase = ''
-    PYTHONPATH="tools/generate_shim_headers:$PYTHONPATH" \
-    PYTHONPATH="$(toPythonPath ${gyp}):$PYTHONPATH" \
-      gypfiles/gyp_v8 \
-        -f make \
-        --generator-output="out" \
-        -Dflock_index=0 \
-        -Dclang=${clangFlag} \
-        -Dv8_enable_i18n_support=1 \
-        -Duse_system_icu=1 \
-        -Dcomponent=${sharedFlag} \
-        -Dconsole=readline \
-        -Dv8_target_arch=${arch} \
-        -Dv8_use_external_startup_data=0
-  '';
-
-  nativeBuildInputs = [ which ];
-  buildInputs = [ readline python icu ]
-    ++ lib.optional stdenv.isDarwin xcbuild
-    ++ lib.optional stdenv.isLinux patchelf;
-
-  NIX_CFLAGS_COMPILE = "-Wno-error=strict-overflow -Wno-error=unused-function -Wno-error=attributes"
-    + lib.optionalString stdenv.cc.isClang " -Wno-error=unused-lambda-capture";
-
-  buildFlags = [
-    "LINK=c++"
-    "-C out"
-    "builddir=$(CURDIR)/Release"
-    "BUILDTYPE=Release"
-  ];
-
-  enableParallelBuilding = true;
-
-  dontUpdateAutotoolsGnuConfigScripts = if stdenv.isAarch64 then true else null;
-
-  # the `libv8_libplatform` target is _only_ built as a static library,
-  # and is expected to be statically linked in when needed.
-  # see the following link for further commentary:
-  # https://github.com/cowboyd/therubyracer/issues/391
-  installPhase = ''
-    install -vD out/Release/d8 "$out/bin/d8"
-    install -vD out/Release/mksnapshot "$out/bin/mksnapshot"
-    ${if static then ""
-    else if stdenv.isDarwin then ''
-    install -vD out/Release/libv8.dylib "$out/lib/libv8.dylib"
-    install_name_tool -change /usr/local/lib/libv8.dylib $out/lib/libv8.dylib -change /usr/lib/libgcc_s.1.dylib ${stdenv.cc.cc.lib}/lib/libgcc_s.1.dylib $out/bin/d8
-    install_name_tool -id $out/lib/libv8.dylib -change /usr/lib/libgcc_s.1.dylib ${stdenv.cc.cc.lib}/lib/libgcc_s.1.dylib $out/lib/libv8.dylib
-    '' else ''
-    install -vD out/Release/lib.target/libv8.so "$out/lib/libv8.so"
-    ''}
-    mkdir -p "$out/include"
-    cp -vr include/*.h "$out/include"
-    cp -vr include/libplatform "$out/include"
-    mkdir -p "$out/lib"
-    cp -v  out/Release/*.a "$out/lib"
-  '';
-
-  meta = with lib; {
-    description = "Google's open source JavaScript engine";
-    maintainers = with maintainers; [ cstrahan proglodyte ];
-    platforms = platforms.linux ++ platforms.darwin;
-    license = licenses.bsd3;
-  };
-}
diff --git a/pkgs/development/libraries/v8/8_x.nix b/pkgs/development/libraries/v8/8_x.nix
new file mode 100644
index 00000000000..5d95a0716ef
--- /dev/null
+++ b/pkgs/development/libraries/v8/8_x.nix
@@ -0,0 +1,169 @@
+{ stdenv, lib, fetchgit, fetchFromGitHub
+, gn, ninja, python3, glib, pkg-config, icu
+, xcbuild, darwin
+, fetchpatch
+}:
+
+# Use update.sh to update all checksums.
+
+let
+  version = "8.8.278.14";
+  v8Src = fetchgit {
+    url = "https://chromium.googlesource.com/v8/v8";
+    rev = version;
+    sha256 = "0w6zldyas9w6p394876ssn3pnr5rjzjy1a5dcsmdkfj51m4rlg8m";
+  };
+
+  git_url = "https://chromium.googlesource.com";
+
+  # This data is from the DEPS file in the root of a V8 checkout.
+  deps = {
+    "base/trace_event/common" = fetchgit {
+      url    = "${git_url}/chromium/src/base/trace_event/common.git";
+      rev    = "eb94f1c7aa96207f469008f29989a43feb2718f8";
+      sha256 = "14gym38ncc9cysknv3jrql7jvcpjxf2d1dh4m8jgqb967jyzy5cj";
+    };
+    "build" = fetchgit {
+      url    = "${git_url}/chromium/src/build.git";
+      rev    = "2101eff1ac4bfd25f2dfa71ad632a600a38c1ed9";
+      sha256 = "0i3xcwzi4pkv4xpgjkbmcpj5h6mji80zqskkx0jx3sx0ji63fylz";
+    };
+    "third_party/googletest/src" = fetchgit {
+      url    = "${git_url}/external/github.com/google/googletest.git";
+      rev    = "4fe018038f87675c083d0cfb6a6b57c274fb1753";
+      sha256 = "1ilm9dmnm2v4y6l1wyfsajsbqv56j29ldfbpd0ykg4q90gpxz201";
+    };
+    "third_party/icu" = fetchgit {
+      url    = "${git_url}/chromium/deps/icu.git";
+      rev    = "c2a4cae149aae7fd30c4cbe3cf1b30df03b386f1";
+      sha256 = "0lgzxf7hmfsgqazs74v5li9ifg8r0jx5m3gxh1mnw33vpwp7qqf4";
+    };
+    "third_party/zlib" = fetchgit {
+      url    = "${git_url}/chromium/src/third_party/zlib.git";
+      rev    = "e84c9a3fd75fdc39055b7ae27d6ec508e50bd39e";
+      sha256 = "03z30djnb3srhd0nvlxvx58sjqm2bvxk7j3vp4fk6h7a0sa2bdpi";
+    };
+    "third_party/jinja2" = fetchgit {
+      url    = "${git_url}/chromium/src/third_party/jinja2.git";
+      rev    = "a82a4944a7f2496639f34a89c9923be5908b80aa";
+      sha256 = "02mkjwkrzhrg16zx97z792l0faz7gc8vga8w10r5y94p98jymnyz";
+    };
+    "third_party/markupsafe" = fetchgit {
+      url    = "${git_url}/chromium/src/third_party/markupsafe.git";
+      rev    = "0944e71f4b2cb9a871bcbe353f95e889b64a611a";
+      sha256 = "052ij8i7nkqchbvzv6ykj929hvfxjbzq7az2l01r0l2gfazhvdb9";
+    };
+  };
+
+  # See `gn_version` in DEPS.
+  gnSrc = fetchgit {
+    url = "https://gn.googlesource.com/gn";
+    rev = "53d92014bf94c3893886470a1c7c1289f8818db0";
+    sha256 = "1xcm07qjk6m2czi150fiqqxql067i832adck6zxrishm70c9jbr9";
+  };
+
+  myGn = gn.overrideAttrs (oldAttrs: {
+    version = "for-v8";
+    src = gnSrc;
+  });
+
+in
+
+stdenv.mkDerivation rec {
+  pname = "v8";
+  inherit version;
+
+  doCheck = true;
+
+  patches = [
+    ./darwin.patch
+  ];
+
+  src = v8Src;
+
+  postUnpack = ''
+    ${lib.concatStringsSep "\n" (
+      lib.mapAttrsToList (n: v: ''
+        mkdir -p $sourceRoot/${n}
+        cp -r ${v}/* $sourceRoot/${n}
+      '') deps)}
+    chmod u+w -R .
+  '';
+
+  postPatch = ''
+    ${lib.optionalString stdenv.isAarch64 ''
+      substituteInPlace build/toolchain/linux/BUILD.gn \
+        --replace 'toolprefix = "aarch64-linux-gnu-"' 'toolprefix = ""'
+    ''}
+    ${lib.optionalString stdenv.isDarwin ''
+      substituteInPlace build/config/compiler/compiler.gni \
+        --replace 'strip_absolute_paths_from_debug_symbols = true' \
+                  'strip_absolute_paths_from_debug_symbols = false'
+      substituteInPlace build/config/compiler/BUILD.gn \
+        --replace 'current_toolchain == host_toolchain || !use_xcode_clang' \
+                  'false'
+    ''}
+    echo 'checkout_google_benchmark = false' > build/config/gclient_args.gni
+  '';
+
+  gnFlags = [
+    "use_custom_libcxx=false"
+    "is_clang=${lib.boolToString stdenv.cc.isClang}"
+    "use_sysroot=false"
+    # "use_system_icu=true"
+    "clang_use_chrome_plugins=false"
+    "is_component_build=false"
+    "v8_use_external_startup_data=false"
+    "v8_monolithic=true"
+    "is_debug=true"
+    "is_official_build=false"
+    "treat_warnings_as_errors=false"
+    "v8_enable_i18n_support=true"
+    "use_gold=false"
+    # ''custom_toolchain="//build/toolchain/linux/unbundle:default"''
+    ''host_toolchain="//build/toolchain/linux/unbundle:default"''
+    ''v8_snapshot_toolchain="//build/toolchain/linux/unbundle:default"''
+  ] ++ lib.optional stdenv.cc.isClang ''clang_base_path="${stdenv.cc}"'';
+
+  NIX_CFLAGS_COMPILE = "-O2";
+  FORCE_MAC_SDK_MIN = stdenv.targetPlatform.sdkVer or "10.12";
+
+  nativeBuildInputs = [
+    myGn
+    ninja
+    pkg-config
+    python3
+  ] ++ lib.optionals stdenv.isDarwin [
+    xcbuild
+    darwin.DarwinTools
+    python3.pkgs.setuptools
+  ];
+  buildInputs = [ glib icu ];
+
+  ninjaFlags = [ ":d8" "v8_monolith" ];
+
+  enableParallelBuilding = true;
+
+  installPhase = ''
+    install -D d8 $out/bin/d8
+    install -D -m644 obj/libv8_monolith.a $out/lib/libv8.a
+    install -D -m644 icudtl.dat $out/share/v8/icudtl.dat
+    cp -r ../../include $out
+
+    mkdir -p $out/lib/pkgconfig
+    cat > $out/lib/pkgconfig/v8.pc << EOF
+    Name: v8
+    Description: V8 JavaScript Engine
+    Version: ${version}
+    Libs: -L$out/lib -lv8 -pthread
+    Cflags: -I$out/include
+    EOF
+  '';
+
+  meta = with lib; {
+    description = "Google's open source JavaScript engine";
+    maintainers = with maintainers; [ cstrahan proglodyte matthewbauer ];
+    platforms = platforms.unix;
+    license = licenses.bsd3;
+  };
+}
diff --git a/pkgs/development/libraries/v8/default.nix b/pkgs/development/libraries/v8/default.nix
index 7c463aa0122..1d2911c1313 100644
--- a/pkgs/development/libraries/v8/default.nix
+++ b/pkgs/development/libraries/v8/default.nix
@@ -1,75 +1,85 @@
 { stdenv, lib, fetchgit, fetchFromGitHub
-, gn, ninja, python, pythonPackages, glib, pkg-config, icu
+, gn, ninja, python3, glib, pkg-config, icu
 , xcbuild, darwin
 , fetchpatch
 }:
 
+# Use update.sh to update all checksums.
+
 let
+  version = "9.7.106.18";
+  v8Src = fetchgit {
+    url = "https://chromium.googlesource.com/v8/v8";
+    rev = version;
+    sha256 = "0cb3w733w1xn6zq9dsr43nx6llcg9hrmb2dkxairarj9c0igpzyh";
+  };
+
   git_url = "https://chromium.googlesource.com";
 
-  # This data is from the DEPS file in the root of a V8 checkout
+  # This data is from the DEPS file in the root of a V8 checkout.
   deps = {
     "base/trace_event/common" = fetchgit {
       url    = "${git_url}/chromium/src/base/trace_event/common.git";
-      rev    = "dab187b372fc17e51f5b9fad8201813d0aed5129";
-      sha256 = "0dmpj9hj4xv3xb0fl1kb9hm4bhpbs2s5csx3z8cgjd5vwvhdzig4";
+      rev    = "7f36dbc19d31e2aad895c60261ca8f726442bfbb";
+      sha256 = "01b2fhbxznqbakxv42ivrzg6w8l7i9yrd9nf72d6p5xx9dm993j4";
     };
-    build = fetchgit {
+    "build" = fetchgit {
       url    = "${git_url}/chromium/src/build.git";
-      rev    = "26e9d485d01d6e0eb9dadd21df767a63494c8fea";
-      sha256 = "1jjvsgj0cs97d26i3ba531ic1f9gqan8x7z4aya8yl8jx02l342q";
+      rev    = "cf325916d58a194a935c26a56fcf6b525d1e2bf4";
+      sha256 = "1ix4h1cpx9bvgln8590xh7lllhsd9w1hd5k9l1gx5yxxrmywd3s4";
     };
     "third_party/googletest/src" = fetchgit {
       url    = "${git_url}/external/github.com/google/googletest.git";
-      rev    = "e3f0319d89f4cbf32993de595d984183b1a9fc57";
-      sha256 = "18xz71l2xjrqsc0q317whgw4xi1i5db24zcj7v04f5g6r1hyf1a5";
+      rev    = "16f637fbf4ffc3f7a01fa4eceb7906634565242f";
+      sha256 = "11012k3c3mxzdwcw2iparr9lrckafpyhqzclsj26hmfbgbdi0rrh";
     };
     "third_party/icu" = fetchgit {
       url    = "${git_url}/chromium/deps/icu.git";
-      rev    = "f2223961702f00a8833874b0560d615a2cc42738";
-      sha256 = "0z5p53kbrjfkjn0i12dpk55cp8976j2zk7a4wk88423s2c5w87zl";
+      rev    = "eedbaf76e49d28465d9119b10c30b82906e606ff";
+      sha256 = "0mppvx7wf9zlqjsfaa1cf06brh1fjb6nmiib0lhbb9hd55mqjdjj";
+    };
+    "third_party/zlib" = fetchgit {
+      url    = "${git_url}/chromium/src/third_party/zlib.git";
+      rev    = "6da1d53b97c89b07e47714d88cab61f1ce003c68";
+      sha256 = "0v7ylmbwfwv6w6wp29qdf77kjjnfr2xzin08n0v1yvbhs01h5ppy";
     };
     "third_party/jinja2" = fetchgit {
       url    = "${git_url}/chromium/src/third_party/jinja2.git";
-      rev    = "b41863e42637544c2941b574c7877d3e1f663e25";
-      sha256 = "1qgilclkav67m6cl2xq2kmzkswrkrb2axc2z8mw58fnch4j1jf1r";
+      rev    = "ee69aa00ee8536f61db6a451f3858745cf587de6";
+      sha256 = "1fsnd5h0gisfp8bdsfd81kk5v4mkqf8z368c7qlm1qcwc4ri4x7a";
     };
     "third_party/markupsafe" = fetchgit {
       url    = "${git_url}/chromium/src/third_party/markupsafe.git";
-      rev    = "8f45f5cfa0009d2a70589bcda0349b8cb2b72783";
-      sha256 = "168ppjmicfdh4i1l0l25s86mdbrz9fgxmiq1rx33x79mph41scfz";
-    };
-    "third_party/zlib" = fetchgit {
-      url    = "${git_url}/chromium/src/third_party/zlib.git";
-      rev    = "156be8c52f80cde343088b4a69a80579101b6e67";
-      sha256 = "0hxbkkzmlv714fjq2jlp5dd2jc339xyh6gkjx1sz3srwv33mlk92";
+      rev    = "1b882ef6372b58bfd55a3285f37ed801be9137cd";
+      sha256 = "1jnjidbh03lhfaawimkjxbprmsgz4snr0jl06630dyd41zkdw5kr";
     };
   };
 
+  # See `gn_version` in DEPS.
+  gnSrc = fetchgit {
+    url = "https://gn.googlesource.com/gn";
+    rev = "8926696a4186279489cc2b8d768533e61bba73d7";
+    sha256 = "1084lnyb0a1khbgjvak05fcx6jy973wqvsf77n0alxjys18sg2yk";
+  };
+
+  myGn = gn.overrideAttrs (oldAttrs: {
+    version = "for-v8";
+    src = gnSrc;
+  });
+
 in
 
 stdenv.mkDerivation rec {
   pname = "v8";
-  version = "8.4.255";
+  inherit version;
 
   doCheck = true;
 
   patches = [
-    # Remove unrecognized clang debug flags
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/saiarcot895/chromium-ubuntu-build/663dbfc492fd2f8ba28d9af40fb3b1327e6aa56e/debian/patches/revert-Xclang-instcombine-lower-dbg-declare.patch";
-      sha256 = "07qp4bjgbwbdrzqslvl2bgbzr3v97b9isbp0539x3lc8cy3h02g1";
-    })
     ./darwin.patch
-    ./gcc_arm.patch  # Fix building zlib with gcc on aarch64, from https://gist.github.com/Adenilson/d973b6fd96c7709d33ddf08cf1dcb149
   ];
 
-  src = fetchFromGitHub {
-    owner = "v8";
-    repo = "v8";
-    rev = version;
-    sha256 = "07ymw4kqbz7kv311gpk5bs5q90wj73n2q7jkyfhqk4hvhs1q5bw7";
-  };
+  src = v8Src;
 
   postUnpack = ''
     ${lib.concatStringsSep "\n" (
@@ -80,16 +90,20 @@ stdenv.mkDerivation rec {
     chmod u+w -R .
   '';
 
-  postPatch = lib.optionalString stdenv.isAarch64 ''
-    substituteInPlace build/toolchain/linux/BUILD.gn \
-      --replace 'toolprefix = "aarch64-linux-gnu-"' 'toolprefix = ""'
-  '' + lib.optionalString stdenv.isDarwin ''
-    substituteInPlace build/config/compiler/compiler.gni \
-      --replace 'strip_absolute_paths_from_debug_symbols = true' \
-                'strip_absolute_paths_from_debug_symbols = false'
-    substituteInPlace build/config/compiler/BUILD.gn \
-      --replace 'current_toolchain == host_toolchain || !use_xcode_clang' \
-                'false'
+  postPatch = ''
+    ${lib.optionalString stdenv.isAarch64 ''
+      substituteInPlace build/toolchain/linux/BUILD.gn \
+        --replace 'toolprefix = "aarch64-linux-gnu-"' 'toolprefix = ""'
+    ''}
+    ${lib.optionalString stdenv.isDarwin ''
+      substituteInPlace build/config/compiler/compiler.gni \
+        --replace 'strip_absolute_paths_from_debug_symbols = true' \
+                  'strip_absolute_paths_from_debug_symbols = false'
+      substituteInPlace build/config/compiler/BUILD.gn \
+        --replace 'current_toolchain == host_toolchain || !use_xcode_clang' \
+                  'false'
+    ''}
+    touch build/config/gclient_args.gni
   '';
 
   gnFlags = [
@@ -106,7 +120,6 @@ stdenv.mkDerivation rec {
     "treat_warnings_as_errors=false"
     "v8_enable_i18n_support=true"
     "use_gold=false"
-    "init_stack_vars=false"
     # ''custom_toolchain="//build/toolchain/linux/unbundle:default"''
     ''host_toolchain="//build/toolchain/linux/unbundle:default"''
     ''v8_snapshot_toolchain="//build/toolchain/linux/unbundle:default"''
@@ -116,14 +129,14 @@ stdenv.mkDerivation rec {
   FORCE_MAC_SDK_MIN = stdenv.targetPlatform.sdkVer or "10.12";
 
   nativeBuildInputs = [
-    gn
+    myGn
     ninja
     pkg-config
-    python
+    python3
   ] ++ lib.optionals stdenv.isDarwin [
     xcbuild
     darwin.DarwinTools
-    pythonPackages.setuptools
+    python3.pkgs.setuptools
   ];
   buildInputs = [ glib icu ];
 
@@ -133,7 +146,8 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     install -D d8 $out/bin/d8
-    install -D obj/libv8_monolith.a $out/lib/libv8.a
+    install -D -m644 obj/libv8_monolith.a $out/lib/libv8.a
+    install -D -m644 icudtl.dat $out/share/v8/icudtl.dat
     cp -r ../../include $out
 
     mkdir -p $out/lib/pkgconfig
diff --git a/pkgs/development/libraries/v8/gcc_arm.patch b/pkgs/development/libraries/v8/gcc_arm.patch
deleted file mode 100644
index 09579561fd8..00000000000
--- a/pkgs/development/libraries/v8/gcc_arm.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-diff --git a/third_party/zlib/contrib/optimizations/insert_string.h b/third_party/zlib/contrib/optimizations/insert_string.h
-index 1826601..d123305 100644
---- a/third_party/zlib/contrib/optimizations/insert_string.h
-+++ b/third_party/zlib/contrib/optimizations/insert_string.h
-@@ -26,15 +26,23 @@
-   #define _cpu_crc32_u32 _mm_crc32_u32
- 
- #elif defined(CRC32_ARMV8_CRC32)
--  #if defined(__clang__)
-+  #if defined(__GNUC__) || defined(__clang__)
-     #undef TARGET_CPU_WITH_CRC
--    #define __crc32cw __builtin_arm_crc32cw
-+    #if defined(__clang__)
-+      #define __crc32cw __builtin_arm_crc32cw
-+    #elif defined(__GNUC__)
-+      #define __crc32cw __builtin_aarch64_crc32cw
-+    #endif
-   #endif
- 
-   #define _cpu_crc32_u32 __crc32cw
- 
-   #if defined(__aarch64__)
--    #define TARGET_CPU_WITH_CRC __attribute__((target("crc")))
-+    #if defined(__clang__)
-+      #define TARGET_CPU_WITH_CRC __attribute__((target("crc")))
-+    #elif defined(__GNUC__)
-+      #define TARGET_CPU_WITH_CRC __attribute__((target("+crc")))
-+    #endif
-   #else  // !defined(__aarch64__)
-     #define TARGET_CPU_WITH_CRC __attribute__((target("armv8-a,crc")))
-   #endif  // defined(__aarch64__)
diff --git a/pkgs/development/libraries/v8/libv8-5.4.232.patch b/pkgs/development/libraries/v8/libv8-5.4.232.patch
deleted file mode 100644
index 16c227cfe38..00000000000
--- a/pkgs/development/libraries/v8/libv8-5.4.232.patch
+++ /dev/null
@@ -1,97 +0,0 @@
-From c9f42d1314c6026efcfcc01824f4e2fdfd05ebcf Mon Sep 17 00:00:00 2001
-From: Ben Sklaroff <bsklaroff@gmail.com>
-Date: Sat, 23 Jul 2016 18:16:55 -0400
-Subject: [PATCH] libv8-5.4.232
-
----
- Makefile                 |  5 +----
- gypfiles/all.gyp         | 32 --------------------------------
- gypfiles/standalone.gypi |  5 ++++-
- 3 files changed, 5 insertions(+), 37 deletions(-)
-
-diff --git a/Makefile b/Makefile
-index 5ea5c58..d1b2d73 100644
---- a/Makefile
-+++ b/Makefile
-@@ -261,11 +261,8 @@ GYPFILES = third_party/icu/icu.gypi third_party/icu/icu.gyp \
- 	   gypfiles/shim_headers.gypi gypfiles/features.gypi \
-            gypfiles/standalone.gypi \
- 	   gypfiles/toolchain.gypi gypfiles/all.gyp gypfiles/mac/asan.gyp \
--	   test/cctest/cctest.gyp test/fuzzer/fuzzer.gyp \
--	   test/unittests/unittests.gyp src/v8.gyp \
--	   tools/parser-shell.gyp testing/gmock.gyp testing/gtest.gyp \
- 	   buildtools/third_party/libc++abi/libc++abi.gyp \
--	   buildtools/third_party/libc++/libc++.gyp samples/samples.gyp \
-+	   buildtools/third_party/libc++/libc++.gyp \
- 	   src/third_party/vtune/v8vtune.gyp src/d8.gyp
- 
- # If vtunejit=on, the v8vtune.gyp will be appended.
-diff --git a/gypfiles/all.gyp b/gypfiles/all.gyp
-index ff1bea4..96820a0 100644
---- a/gypfiles/all.gyp
-+++ b/gypfiles/all.gyp
-@@ -16,38 +16,6 @@
-             '../tools/parser-shell.gyp:parser-shell',
-           ],
-         }],
--        # These items don't compile for Android on Mac.
--        ['host_os!="mac" or OS!="android"', {
--          'dependencies': [
--            '../samples/samples.gyp:*',
--            '../test/cctest/cctest.gyp:*',
--            '../test/fuzzer/fuzzer.gyp:*',
--            '../test/unittests/unittests.gyp:*',
--            ],
--        }],
--        ['test_isolation_mode != "noop"', {
--          'dependencies': [
--            '../test/bot_default.gyp:*',
--            '../test/benchmarks/benchmarks.gyp:*',
--            '../test/default.gyp:*',
--            '../test/ignition.gyp:*',
--            '../test/intl/intl.gyp:*',
--            '../test/message/message.gyp:*',
--            '../test/mjsunit/mjsunit.gyp:*',
--            '../test/mozilla/mozilla.gyp:*',
--            '../test/optimize_for_size.gyp:*',
--            '../test/perf.gyp:*',
--            '../test/preparser/preparser.gyp:*',
--            '../test/simdjs/simdjs.gyp:*',
--            '../test/test262/test262.gyp:*',
--            '../test/webkit/webkit.gyp:*',
--            '../tools/check-static-initializers.gyp:*',
--            '../tools/gcmole/run_gcmole.gyp:*',
--            '../tools/jsfunfuzz/jsfunfuzz.gyp:*',
--            '../tools/run-deopt-fuzzer.gyp:*',
--            '../tools/run-valgrind.gyp:*',
--          ],
--        }],
-       ]
-     }
-   ]
-diff --git a/gypfiles/standalone.gypi b/gypfiles/standalone.gypi
-index 89f06a0..a43976d 100644
---- a/gypfiles/standalone.gypi
-+++ b/gypfiles/standalone.gypi
-@@ -506,6 +506,9 @@
-       }],  # fastbuild!=0
-     ],
-     'target_conditions': [
-+      ['_type=="static_library"', {
-+        'standalone_static_library': 1,
-+      }],
-       ['v8_code == 0', {
-         'defines!': [
-           'DEBUG',
-@@ -770,7 +773,7 @@
-           [ 'visibility=="hidden" and v8_enable_backtrace==0', {
-             'cflags': [ '-fvisibility=hidden' ],
-           }],
--          [ 'component=="shared_library"', {
-+          [ 'component=="shared_library" or component=="static_library" and (v8_target_arch=="x64" or v8_target_arch=="arm64" or v8_target_arch=="arm")', {
-             'cflags': [ '-fPIC', ],
-           }],
-           [ 'clang==0 and coverage==1', {
--- 
-2.9.0
-
diff --git a/pkgs/development/libraries/v8/update.sh b/pkgs/development/libraries/v8/update.sh
index f046bb8e688..c3fbab6faf1 100755
--- a/pkgs/development/libraries/v8/update.sh
+++ b/pkgs/development/libraries/v8/update.sh
@@ -1,29 +1,45 @@
 #!/usr/bin/env nix-shell
-#! nix-shell -i bash -p curl -p nix-prefetch-git
+#! nix-shell -i bash -p curl -p nix-prefetch-git -p jq
 VERSION_OVERVIEW=https://omahaproxy.appspot.com/all?os=linux
-TARGET_CHANNEL=beta
-FILE_PATH=6_x.nix
+TARGET_CHANNEL=stable
 
 set -eo pipefail
 
-v8_version=$(curl -s "$VERSION_OVERVIEW" | awk -F "," "\$2 ~ /${TARGET_CHANNEL}/ { print \$11 }")
+if [ -n "$1" ]; then
+  v8_version="$1"
+  shift
+else
+  v8_version=$(curl -s "$VERSION_OVERVIEW" | awk -F "," "\$2 ~ /${TARGET_CHANNEL}/ { print \$11 }")
+fi
+
+if [ -n "$1" ]; then
+  file_path="$1"
+else
+  file_path=default.nix
+fi
 
 echo "Using V8 version --> $v8_version"
-sed -e "s#\\(version = \\)\"[0-9\.]*\"#\1\"$v8_version\"#" -i ${FILE_PATH}
 
-sha256=$(nix-prefetch-git --no-deepClone https://github.com/v8/v8.git "refs/tags/${v8_version}" \
-    | sed -ne '/sha256/ { s#.*: "\(.*\)".*#\1#; p }')
-sed -e "/repo = \"v8\"/ { n;n; s#\".*\"#\"${sha256}\"# }" -i ${FILE_PATH}
+prefetched=$(nix-prefetch-git --no-deepClone https://chromium.googlesource.com/v8/v8 "refs/tags/${v8_version}")
+
+path=$(echo "$prefetched" | jq -r .path)
+sha256=$(echo "$prefetched" | jq -r .sha256)
+sed -e "s#\\(version = \\)\"[0-9\.]*\"#\1\"$v8_version\"#" -i ${file_path}
+sed -e "/v8Src = fetchgit/ { n; n; n; s/\".*\"/\"${sha256}\"/  }" -i ${file_path}
+
+deps="$path/DEPS"
 
-deps="$(mktemp)"
+echo "$deps"
 
-curl -s -o "$deps" "https://raw.githubusercontent.com/v8/v8/${v8_version}/DEPS"
-echo $deps
+echo "Processing gn"
+gn_rev=$(sed -ne "s/.*'gn_version': 'git_revision:\([^']*\).*/\1/p" < "$deps")
+gn_sha256=$(nix-prefetch-git --no-deepClone https://gn.googlesource.com/gn "$gn_rev" 2>/dev/null | jq -r .sha256)
+sed -e "/gnSrc = fetchgit/ { n; n; s/\".*\"/\"${gn_rev}\"/; n; s/\".*\"/\"${gn_sha256}\"/  }" -i ${file_path}
 
-sed -ne '/= fetchgit {/ { s/.*"\(.*\)".*/\1/; p }' < ${FILE_PATH} | while read dep; do
+sed -ne '/" = fetchgit {/ { s/.*"\(.*\)".*/\1/; p }' < ${file_path} | while read dep; do
     echo "Processing dependency --> $dep"
     escaped_dep=$(echo "$dep" | sed -e 's#/#\\/#g')
-    dep_rev=$(sed -ne "/\"v8\/${escaped_dep}\":/ { n; s#.*+ \"##; s#\".*##;  p }" "$deps")
+    dep_rev=$(sed -ne "/'${escaped_dep}':/ { n; s#.*+ '##; s#'.*##;  p }" "$deps")
 
     if [ "$dep_rev" = "" ]; then
         echo "Failed to resolve dependency $dep, not listed in DEPS file"
@@ -31,8 +47,8 @@ sed -ne '/= fetchgit {/ { s/.*"\(.*\)".*/\1/; p }' < ${FILE_PATH} | while read d
         exit 2
     fi
 
-    repo_url=$(sed -ne "/\"${escaped_dep}\" = fetchgit/ { n; s/.*\"\(.*\)\".*/\1/; s#\${git_url}#https://chromium.googlesource.com#; p }"  ${FILE_PATH})
-    sha256=$(nix-prefetch-git --no-deepClone "$repo_url" "$dep_rev" 2>/dev/null | sed -ne '/sha256/ { s#.*: "\(.*\)".*#\1#; p }')
+    repo_url=$(sed -ne "/\"${escaped_dep}\" = fetchgit/ { n; s/.*\"\(.*\)\".*/\1/; s#\${git_url}#https://chromium.googlesource.com#; p }"  ${file_path})
+    sha256=$(nix-prefetch-git --no-deepClone "$repo_url" "$dep_rev" 2>/dev/null | jq -r .sha256)
 
     if [ "$sha256" = "" ]; then
         echo "Failed to get sha256 via nix-prefetch-git $repo_url $dep_rev"
@@ -40,8 +56,7 @@ sed -ne '/= fetchgit {/ { s/.*"\(.*\)".*/\1/; p }' < ${FILE_PATH} | while read d
         exit 2
     fi
 
-    sed -e "/\"${escaped_dep}\" = fetchgit/ { n; n; s/\".*\"/\"${dep_rev}\"/; n; s/\".*\"/\"${sha256}\"/  }" -i ${FILE_PATH}
+    sed -e "/\"${escaped_dep}\" = fetchgit/ { n; n; s/\".*\"/\"${dep_rev}\"/; n; s/\".*\"/\"${sha256}\"/  }" -i ${file_path}
 done
 
-rm -f "$deps"
 echo done.
diff --git a/pkgs/development/libraries/xdg-desktop-portal-wlr/default.nix b/pkgs/development/libraries/xdg-desktop-portal-wlr/default.nix
index 4f842e5de18..a8450b414e5 100644
--- a/pkgs/development/libraries/xdg-desktop-portal-wlr/default.nix
+++ b/pkgs/development/libraries/xdg-desktop-portal-wlr/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xdg-desktop-portal-wlr";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "emersion";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256:13fbzh8bjnhk4xs8j9bpc01q3hy27zpbf0gkk1fnh3hm5pnyfyiv";
+    sha256 = "sha256-weePlNcLmZ3R0IDQ95p0wQvsKTYp+sVlTENJtF8Z78Y=";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config wayland-protocols makeWrapper ];
diff --git a/pkgs/development/node-packages/default.nix b/pkgs/development/node-packages/default.nix
index 7f40453a6f7..fd9bb4dd674 100644
--- a/pkgs/development/node-packages/default.nix
+++ b/pkgs/development/node-packages/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, nodejs, stdenv, applyPatches, fetchFromGitHub, fetchpatch, fetchurl }:
+{ pkgs, nodejs, stdenv, applyPatches, fetchFromGitHub, fetchpatch, fetchurl, nixosTests }:
 
 let
   inherit (pkgs) lib;
@@ -442,6 +442,8 @@ let
         echo /var/lib/thelounge > $out/lib/node_modules/thelounge/.thelounge_home
         patch -d $out/lib/node_modules/thelounge -p1 < ${./thelounge-packages-path.patch}
       '';
+      passthru.tests = { inherit (nixosTests) thelounge; };
+      meta = super.thelounge.meta // { maintainers = with lib.maintainers; [ winter ]; };
     };
 
     yaml-language-server = super.yaml-language-server.override {
diff --git a/pkgs/development/ocaml-modules/llvm/default.nix b/pkgs/development/ocaml-modules/llvm/default.nix
index 3357b99cebf..264d95f39f6 100644
--- a/pkgs/development/ocaml-modules/llvm/default.nix
+++ b/pkgs/development/ocaml-modules/llvm/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, python, cmake, libllvm, ocaml, findlib, ctypes }:
+{ stdenv, lib, python2, cmake, libllvm, ocaml, findlib, ctypes }:
 
 let version = lib.getVersion libllvm; in
 
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
   inherit (libllvm) src;
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ python ocaml findlib ctypes ];
+  buildInputs = [ python2 ocaml findlib ctypes ];
   propagatedBuildInputs = [ libllvm ];
 
   cmakeFlags = [
diff --git a/pkgs/development/ocaml-modules/pycaml/default.nix b/pkgs/development/ocaml-modules/pycaml/default.nix
index bee8a6106ea..c19b40eb9af 100644
--- a/pkgs/development/ocaml-modules/pycaml/default.nix
+++ b/pkgs/development/ocaml-modules/pycaml/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, ocaml, findlib, ncurses, python, ocaml_make }:
+{ lib, stdenv, fetchurl, ocaml, findlib, ncurses, python2, ocaml_make }:
 
 # This is the original pycaml version with patches from debian.
 
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   sourceRoot = "pycaml";
   patches = [ "../debian/patches/*.patch" ];
 
-  buildInputs = [ ncurses ocaml findlib python ocaml_make ];
+  buildInputs = [ ncurses ocaml findlib python2 ocaml_make ];
   createFindlibDestdir = true;
 
   # the Makefile is not shipped with an install target, hence we do it ourselves.
diff --git a/pkgs/development/octave-modules/miscellaneous/default.nix b/pkgs/development/octave-modules/miscellaneous/default.nix
index 74c3879aa9e..db2f45a5ac3 100644
--- a/pkgs/development/octave-modules/miscellaneous/default.nix
+++ b/pkgs/development/octave-modules/miscellaneous/default.nix
@@ -2,7 +2,6 @@
 , lib
 , fetchurl
 # Build-time dependencies
-, mlterm
 , ncurses # >= 5
 , units
 }:
@@ -17,7 +16,6 @@ buildOctavePackage rec {
   };
 
   buildInputs = [
-    mlterm
     ncurses
   ];
 
diff --git a/pkgs/development/python-modules/aiogithubapi/default.nix b/pkgs/development/python-modules/aiogithubapi/default.nix
index 9249df059bf..92e87e1ab1a 100644
--- a/pkgs/development/python-modules/aiogithubapi/default.nix
+++ b/pkgs/development/python-modules/aiogithubapi/default.nix
@@ -12,7 +12,8 @@
 
 buildPythonPackage rec {
   pname = "aiogithubapi";
-  version = "21.11.0";
+  version = "22.1.0";
+  format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
@@ -20,16 +21,9 @@ buildPythonPackage rec {
     owner = "ludeeus";
     repo = pname;
     rev = version;
-    sha256 = "sha256-sxWgLd+oQv9qNOpyAYXsBcqGbo/ugNXzGF5nbdcNLFw=";
+    sha256 = "sha256-rzZtf3xrbNg9VaOAOM6ux1A9S1WqUKBMKxWfHDo7/VM=";
   };
 
-  postPatch = ''
-    # Upstream is releasing with the help of a CI to PyPI, GitHub releases
-    # are not in their focus
-    substituteInPlace setup.py \
-      --replace 'version="main",' 'version="${version}",'
-  '';
-
   propagatedBuildInputs = [
     aiohttp
     async-timeout
@@ -42,7 +36,16 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "aiogithubapi" ];
+  postPatch = ''
+    # Upstream is releasing with the help of a CI to PyPI, GitHub releases
+    # are not in their focus
+    substituteInPlace setup.py \
+      --replace 'version="main",' 'version="${version}",'
+  '';
+
+  pythonImportsCheck = [
+    "aiogithubapi"
+  ];
 
   meta = with lib; {
     description = "Python client for the GitHub API";
diff --git a/pkgs/development/python-modules/aiohttp-retry/default.nix b/pkgs/development/python-modules/aiohttp-retry/default.nix
new file mode 100644
index 00000000000..3cd0fe09842
--- /dev/null
+++ b/pkgs/development/python-modules/aiohttp-retry/default.nix
@@ -0,0 +1,43 @@
+{ lib
+, aiohttp
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, pytest-aiohttp
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "aiohttp-retry";
+  version = "2.5.6";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "inyutin";
+    repo = "aiohttp_retry";
+    rev = "v${version}";
+    hash = "sha256-jyt4YPn3gSgR1YfHYLs+5VCsjAk9Ij+2m5Kzy51CnLk=";
+  };
+
+  propagatedBuildInputs = [
+    aiohttp
+  ];
+
+  checkInputs = [
+    pytest-aiohttp
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "aiohttp_retry"
+  ];
+
+  meta = with lib; {
+    description = "Retry client for aiohttp";
+    homepage = "https://github.com/inyutin/aiohttp_retry";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/bimmer-connected/default.nix b/pkgs/development/python-modules/bimmer-connected/default.nix
index 004b7d4e3e0..0f6334d2792 100644
--- a/pkgs/development/python-modules/bimmer-connected/default.nix
+++ b/pkgs/development/python-modules/bimmer-connected/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "bimmer-connected";
-  version = "0.8.7";
+  version = "0.8.10";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "bimmerconnected";
     repo = "bimmer_connected";
     rev = version;
-    hash = "sha256-nLZdaV341mULXIngkEqiLQeg4G2NDFGNg/AUozgJe74=";
+    hash = "sha256-xt21mcXcucUhJlqwDLrAHvQLg9++uc/cX5Sy+Sppsbo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/build/default.nix b/pkgs/development/python-modules/build/default.nix
index ba8d15909f2..f1f7f0e81bd 100644
--- a/pkgs/development/python-modules/build/default.nix
+++ b/pkgs/development/python-modules/build/default.nix
@@ -54,6 +54,8 @@ buildPythonPackage rec {
   pytestFlagsArray = [
     "-n"
     "$NIX_BUILD_CORES"
+    "-W"
+    "ignore::DeprecationWarning"
   ];
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/cairocffi/default.nix b/pkgs/development/python-modules/cairocffi/default.nix
index 8e26517ba21..cc4e19d6beb 100644
--- a/pkgs/development/python-modules/cairocffi/default.nix
+++ b/pkgs/development/python-modules/cairocffi/default.nix
@@ -12,16 +12,67 @@
 , cairo
 , cffi
 , numpy
-, withXcffib ? false, xcffib
+, withXcffib ? false
+, xcffib
 , python
 , glib
 , gdk-pixbuf
-}@args:
+}:
+
+buildPythonPackage rec {
+  pname = "cairocffi";
+  version = "1.3.0";
 
-import ./generic.nix ({
-  version = "1.2.0";
-  sha256 = "sha256-mpebUAxkyBef7ChvM36P5kTsovLNBYYM4LYtJfIuoUA=";
-  dlopen_patch = ./dlopen-paths.patch;
   disabled = pythonOlder "3.5";
-  inherit withXcffib;
-} // args)
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-EIo6fLCeIDvdhQHZuq2R14bSBFYb1x6TZOizSJfEe5E=";
+  };
+
+  LC_ALL = "en_US.UTF-8";
+
+  # checkPhase require at least one 'normal' font and one 'monospace',
+  # otherwise glyph tests fails
+  FONTCONFIG_FILE = makeFontsConf {
+    fontDirectories = [ freefont_ttf ];
+  };
+
+  propagatedBuildInputs = [ cairo cffi ] ++ lib.optional withXcffib xcffib;
+  propagatedNativeBuildInputs = [ cffi ];
+
+  # pytestCheckHook does not work
+  checkInputs = [ numpy pytest glibcLocales ];
+
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace "pytest-runner" "" \
+      --replace "pytest-cov" "" \
+      --replace "pytest-flake8" "" \
+      --replace "pytest-isort" "" \
+      --replace "--flake8 --isort" ""
+  '';
+
+  checkPhase = ''
+    py.test $out/${python.sitePackages}
+  '';
+
+  patches = [
+    # OSError: dlopen() failed to load a library: gdk-pixbuf-2.0 / gdk-pixbuf-2.0-0
+    (substituteAll {
+      src = ./dlopen-paths.patch;
+      ext = stdenv.hostPlatform.extensions.sharedLibrary;
+      cairo = cairo.out;
+      glib = glib.out;
+      gdk_pixbuf = gdk-pixbuf.out;
+    })
+    ./fix_test_scaled_font.patch
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/SimonSapin/cairocffi";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ SuperSandro2000 ];
+    description = "cffi-based cairo bindings for Python";
+  };
+}
diff --git a/pkgs/development/python-modules/cairocffi/generic.nix b/pkgs/development/python-modules/cairocffi/generic.nix
deleted file mode 100644
index 004cf8ae784..00000000000
--- a/pkgs/development/python-modules/cairocffi/generic.nix
+++ /dev/null
@@ -1,63 +0,0 @@
-{ version
-, sha256
-, dlopen_patch
-, disabled ? false
-, ...
-}@args:
-
-with args;
-
-buildPythonPackage rec {
-  pname = "cairocffi";
-  inherit version disabled;
-
-  src = fetchPypi {
-    inherit pname version sha256;
-  };
-
-  LC_ALL = "en_US.UTF-8";
-
-  # checkPhase require at least one 'normal' font and one 'monospace',
-  # otherwise glyph tests fails
-  FONTCONFIG_FILE = makeFontsConf {
-    fontDirectories = [ freefont_ttf ];
-  };
-
-  propagatedBuildInputs = [ cairo cffi ] ++ lib.optional withXcffib xcffib;
-  propagatedNativeBuildInputs = [ cffi ];
-
-  # pytestCheckHook does not work
-  checkInputs = [ numpy pytest glibcLocales ];
-
-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "pytest-runner" "" \
-      --replace "pytest-cov" "" \
-      --replace "pytest-flake8" "" \
-      --replace "pytest-isort" "" \
-      --replace "--flake8 --isort" ""
-  '';
-
-  checkPhase = ''
-    py.test $out/${python.sitePackages}
-  '';
-
-  patches = [
-    # OSError: dlopen() failed to load a library: gdk-pixbuf-2.0 / gdk-pixbuf-2.0-0
-    (substituteAll {
-      src = dlopen_patch;
-      ext = stdenv.hostPlatform.extensions.sharedLibrary;
-      cairo = cairo.out;
-      glib = glib.out;
-      gdk_pixbuf = gdk-pixbuf.out;
-    })
-    ./fix_test_scaled_font.patch
-  ];
-
-  meta = with lib; {
-    homepage = "https://github.com/SimonSapin/cairocffi";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [];
-    description = "cffi-based cairo bindings for Python";
-  };
-}
diff --git a/pkgs/development/python-modules/commoncode/default.nix b/pkgs/development/python-modules/commoncode/default.nix
index 14224522131..7a2416728c8 100644
--- a/pkgs/development/python-modules/commoncode/default.nix
+++ b/pkgs/development/python-modules/commoncode/default.nix
@@ -8,6 +8,7 @@
 , intbitset
 , pytest-xdist
 , pytestCheckHook
+, pythonAtLeast
 , pythonOlder
 , requests
 , saneyaml
@@ -19,6 +20,7 @@
 buildPythonPackage rec {
   pname = "commoncode";
   version = "30.0.0";
+  format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
@@ -49,12 +51,18 @@ buildPythonPackage rec {
     pytestCheckHook
     pytest-xdist
   ];
+
   disabledTests = lib.optionals stdenv.isDarwin [
     # expected result is tailored towards the quirks of upstream's
     # CI environment on darwin
     "test_searchable_paths"
   ];
 
+  disabledTestPaths = lib.optionals (pythonAtLeast "3.10") [
+    # https://github.com/nexB/commoncode/issues/36
+    "src/commoncode/fetch.py"
+  ];
+
   pythonImportsCheck = [
     "commoncode"
   ];
diff --git a/pkgs/development/python-modules/cot/default.nix b/pkgs/development/python-modules/cot/default.nix
index 607057b73f2..20ccfd6e0a9 100644
--- a/pkgs/development/python-modules/cot/default.nix
+++ b/pkgs/development/python-modules/cot/default.nix
@@ -1,27 +1,57 @@
-{ lib, stdenv, buildPythonPackage, fetchPypi, pythonOlder, isPy3k
-, colorlog, pyvmomi, requests, verboselogs
-, psutil, pyopenssl, setuptools
-, mock, pytest-mock, pytestCheckHook, qemu
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, colorlog
+, pyvmomi
+, requests
+, verboselogs
+, pyopenssl
+, setuptools
+, mock
+, pytest-mock
+, pytestCheckHook
+, qemu
 }:
 
 buildPythonPackage rec {
   pname = "cot";
   version = "2.2.1";
-  disabled = !isPy3k;
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f4b3553415f90daac656f89d3e82e79b3d751793239bb173a683b4cc0ceb2635";
+    hash = "sha256-9LNVNBX5DarGVvidPoLnmz11F5Mjm7FzpoO0zAzrJjU=";
   };
 
-  propagatedBuildInputs = [ colorlog pyvmomi requests verboselogs pyopenssl setuptools ]
-  ++ lib.optional (pythonOlder "3.3") psutil;
+  propagatedBuildInputs = [
+    colorlog
+    pyvmomi
+    requests
+    verboselogs
+    pyopenssl
+    setuptools
+  ];
 
-  checkInputs = [ mock pytestCheckHook pytest-mock qemu ];
+  checkInputs = [
+    mock
+    pytestCheckHook
+    pytest-mock
+    qemu
+  ];
+
+  prePatch = ''
+    # argparse is part of the standardlib
+    substituteInPlace setup.py \
+      --replace "'argparse'," ""
+  '';
 
-  # Many tests require network access and/or ovftool (https://code.vmware.com/web/tool/ovf)
-  # try enabling these tests with ovftool once/if it is added to nixpkgs
   disabledTests = [
+    # Many tests require network access and/or ovftool (https://code.vmware.com/web/tool/ovf)
+    # try enabling these tests with ovftool once/if it is added to nixpkgs
     "HelperGenericTest"
     "TestCOTAddDisk"
     "TestCOTAddFile"
@@ -34,14 +64,15 @@ buildPythonPackage rec {
     "TestQCOW2"
     "TestRAW"
     "TestVMDKConversion"
+    # CLI test fails with AssertionError
+    "test_help"
   ] ++ lib.optionals stdenv.isDarwin [
     "test_serial_fixup_invalid_host"
   ];
 
-  # argparse is part of the standardlib
-  prePatch = ''
-    substituteInPlace setup.py --replace "'argparse'," ""
-  '';
+  pythonImportsCheck = [
+    "COT"
+  ];
 
   meta = with lib; {
     description = "Common OVF Tool";
diff --git a/pkgs/development/python-modules/cozy/default.nix b/pkgs/development/python-modules/cozy/default.nix
deleted file mode 100644
index f7e0af08266..00000000000
--- a/pkgs/development/python-modules/cozy/default.nix
+++ /dev/null
@@ -1,62 +0,0 @@
-{ buildPythonPackage
-, isPy3k
-, fetchFromGitHub
-, lib
-, z3
-, ply
-, igraph
-, oset
-, ordered-set
-, dictionaries
-, setuptools
-}:
-
-buildPythonPackage {
-  pname = "cozy";
-  version = "2.0a1";
-  disabled = !isPy3k;
-
-  propagatedBuildInputs = [
-    setuptools
-    z3
-    ply
-    igraph
-    oset
-    ordered-set
-    dictionaries
-  ];
-
-  src = fetchFromGitHub {
-    owner = "CozySynthesizer";
-    repo = "cozy";
-    rev = "f553e9b";
-    sha256 = "1jhr5gzihj8dkg0yc5dmi081v2isxharl0ph7v2grqj0bwqzl40j";
-  };
-
-  # - yoink the Z3 dependency name, because our Z3 package doesn't provide it.
-  # - remove "dictionaries" version bound
-  # - patch igraph package name
-  postPatch = ''
-    sed -i -e '/z3-solver/d' \
-           -e 's/^dictionaries.*$/dictionaries/' \
-           -e 's/python-igraph/igraph/' \
-            requirements.txt
-  '';
-
-  # Tests are not correctly set up in the source tree.
-  doCheck = false;
-  pythonImportsCheck = [ "cozy" ];
-
-  # There is some first-time-run codegen that we will force to happen.
-  postInstall = ''
-    $out/bin/cozy --help
-  '';
-
-
-  meta = with lib; {
-    description = "The collection synthesizer";
-    homepage = "https://cozy.uwplse.org/";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ MostAwesomeDude ];
-  };
-}
diff --git a/pkgs/development/python-modules/dataset/default.nix b/pkgs/development/python-modules/dataset/default.nix
new file mode 100644
index 00000000000..38de0218dec
--- /dev/null
+++ b/pkgs/development/python-modules/dataset/default.nix
@@ -0,0 +1,35 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, sqlalchemy
+, alembic
+, banal
+}:
+
+buildPythonPackage rec {
+  pname = "dataset";
+  version = "1.5.2";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-TDZ6fAqFxOdI79o07uMAw/zD8HbHXDKQt0mnoFM1yEc=";
+  };
+
+  propagatedBuildInputs = [
+    sqlalchemy alembic banal
+  ];
+
+  # checks attempt to import nonexistent module 'test.test' and fail
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "dataset"
+  ];
+
+  meta = with lib; {
+    description = "Toolkit for Python-based database access";
+    homepage = "https://dataset.readthedocs.io";
+    license = licenses.mit;
+    maintainers = [ maintainers.xfnw ];
+  };
+}
diff --git a/pkgs/development/python-modules/demjson/default.nix b/pkgs/development/python-modules/demjson/default.nix
index 25e2692af3b..a25ecd74b5d 100644
--- a/pkgs/development/python-modules/demjson/default.nix
+++ b/pkgs/development/python-modules/demjson/default.nix
@@ -1,25 +1,34 @@
-{ lib, python, buildPythonPackage, fetchPypi, isPy3k }:
+{ lib
+, python
+, buildPythonPackage
+, fetchPypi
+, isPy3k
+}:
 
 buildPythonPackage rec {
   pname = "demjson";
   version = "2.2.4";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "0ygbddpnvp5lby6mr5kz60la3hkvwwzv3wwb3z0w9ngxl0w21pii";
   };
 
-  checkPhase = lib.optionalString isPy3k ''
-    ${python.interpreter} -m lib2to3 -w test/test_demjson.py
-  '' + ''
+  doCheck = !(isPy3k);
+
+  checkPhase = ''
     ${python.interpreter} test/test_demjson.py
   '';
 
+  pythonImportsCheck = [
+    "demjson"
+  ];
+
   meta = with lib; {
     description = "Encoder/decoder and lint/validator for JSON (JavaScript Object Notation)";
     homepage = "https://github.com/dmeranda/demjson";
     license = licenses.lgpl3Plus;
     maintainers = with maintainers; [ bjornfor ];
-    platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/python-modules/dictdiffer/default.nix b/pkgs/development/python-modules/dictdiffer/default.nix
new file mode 100644
index 00000000000..5e043e55f85
--- /dev/null
+++ b/pkgs/development/python-modules/dictdiffer/default.nix
@@ -0,0 +1,50 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "dictdiffer";
+  version = "0.9.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "inveniosoftware";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-lQyPs3lQWtsvNPuvvwJUTDzrFaOX5uwGuRHe3yWUheU=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "'pytest-runner>=2.7'," ""
+    substituteInPlace pytest.ini \
+      --replace ' --isort --pydocstyle --pycodestyle --doctest-glob="*.rst" --doctest-modules --cov=dictdiffer --cov-report=term-missing' ""
+  '';
+
+  pythonImportsCheck = [
+    "dictdiffer"
+  ];
+
+  meta = with lib; {
+    description = "Module to diff and patch dictionaries";
+    homepage = "https://github.com/inveniosoftware/dictdiffer";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/doit/default.nix b/pkgs/development/python-modules/doit/default.nix
index 4ceb8e71f64..500fe056616 100644
--- a/pkgs/development/python-modules/doit/default.nix
+++ b/pkgs/development/python-modules/doit/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "doit";
-  version = "0.33.1";
+  version = "0.34.0";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "37c3b35c2151647b968b2af24481112b2f813c30f695366db0639d529190a143";
+    sha256 = "sha256-jvHeEFy8qTnHPoNt/4bIEskijhHthwL2lVt6CGyqwC0=";
   };
 
   propagatedBuildInputs = [ cloudpickle ]
diff --git a/pkgs/development/python-modules/drf-jwt/default.nix b/pkgs/development/python-modules/drf-jwt/default.nix
index 2cf125c8df3..1b2292b46b7 100644
--- a/pkgs/development/python-modules/drf-jwt/default.nix
+++ b/pkgs/development/python-modules/drf-jwt/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "drf-jwt";
-  version = "1.19.1";
+  version = "1.19.2";
 
   src = fetchFromGitHub {
     owner = "Styria-Digital";
     repo = "django-rest-framework-jwt";
     rev = version;
-    sha256 = "sha256-++8rFXVsA5WMTt+aC4di3Rpa0BAW285/qM087i9uQ0g=";
+    hash = "sha256-bbkk78uYTG+JTzY3AyOmEVtVSgout/TETfr5N5fUto4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/flask-gravatar/default.nix b/pkgs/development/python-modules/flask-gravatar/default.nix
new file mode 100644
index 00000000000..c0bbf7d0146
--- /dev/null
+++ b/pkgs/development/python-modules/flask-gravatar/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, flask
+, pytestCheckHook
+, pygments
+}:
+
+buildPythonPackage rec {
+  pname = "flask-gravatar";
+  version = "0.5.0";
+
+  src = fetchPypi {
+    pname = "Flask-Gravatar";
+    inherit version;
+    sha256 = "YGZfMcLGEokdto/4Aek+06CIHGyOw0arxk0qmSP1YuE=";
+  };
+
+  postPatch = ''
+    sed -i setup.py \
+     -e "s|tests_require=tests_require,||g" \
+     -e "s|extras_require=extras_require,||g" \
+     -e "s|setup_requires=setup_requires,||g"
+    # pep8 is deprecated and cov not needed
+    substituteInPlace pytest.ini \
+     --replace "--pep8" "" \
+     --replace "--cov=flask_gravatar --cov-report=term-missing" ""
+  '';
+
+  propagatedBuildInputs = [
+    flask
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+    pygments
+  ];
+
+  pythonImportsCheck = [ "flask_gravatar" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/zzzsochi/Flask-Gravatar";
+    description = "Small and simple integration of gravatar into flask";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ gador ];
+  };
+}
diff --git a/pkgs/development/python-modules/flask-paranoid/default.nix b/pkgs/development/python-modules/flask-paranoid/default.nix
new file mode 100644
index 00000000000..787b34a93b3
--- /dev/null
+++ b/pkgs/development/python-modules/flask-paranoid/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, flask
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "flask-paranoid";
+  version = "0.2";
+
+  src = fetchFromGitHub {
+    owner = "miguelgrinberg";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0WWc/ktAOuTk4A75xI1jCj/aef2+1TjLKBA9+PRfJO0=";
+  };
+
+  postPatch = ''
+    # tests have a typo in one of the assertions
+    substituteInPlace tests/test_paranoid.py --replace "01-Jan-1970" "01 Jan 1970"
+  '';
+
+  propagatedBuildInputs = [
+    flask
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "flask_paranoid" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/miguelgrinberg/flask-paranoid/";
+    description = "Simple user session protection";
+    license = licenses.mit;
+    maintainers = with maintainers; [ gador ];
+  };
+}
diff --git a/pkgs/development/python-modules/flask-security-too/default.nix b/pkgs/development/python-modules/flask-security-too/default.nix
new file mode 100644
index 00000000000..ddf5aa05c49
--- /dev/null
+++ b/pkgs/development/python-modules/flask-security-too/default.nix
@@ -0,0 +1,76 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, flask
+, blinker
+, setuptools
+, itsdangerous
+, flask_principal
+, passlib
+, email_validator
+, flask_wtf
+, flask_login
+, pytestCheckHook
+, flask_mail
+, sqlalchemy
+, flask_sqlalchemy
+, flask-mongoengine
+, peewee
+, pony
+, zxcvbn
+, mongoengine
+, cryptography
+, pyqrcode
+, phonenumbers
+, bleach
+, mongomock
+}:
+
+buildPythonPackage rec {
+  pname = "flask-security-too";
+  version = "4.1.2";
+
+  src = fetchPypi {
+    pname = "Flask-Security-Too";
+    inherit version;
+    sha256 = "16ws5n08vm7wsa2f7lrkxvc7jl3ah1xfylhhyzb4vvqmlk7x9hw8";
+  };
+
+  propagatedBuildInputs = [
+    flask
+    flask_login
+    flask_principal
+    flask_wtf
+    email_validator
+    itsdangerous
+    passlib
+    blinker
+    setuptools
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+    flask_mail
+    sqlalchemy
+    flask_sqlalchemy
+    flask-mongoengine
+    peewee
+    pony
+    zxcvbn
+    mongoengine
+    cryptography
+    pyqrcode
+    phonenumbers
+    bleach
+    mongomock
+  ];
+
+  pythonImportsCheck = [ "flask_security" ];
+
+  meta = with lib; {
+    homepage = "https://pypi.org/project/Flask-Security-Too/";
+    description = "Simple security for Flask apps (fork)";
+    license = licenses.mit;
+    maintainers = with maintainers; [ gador ];
+  };
+}
diff --git a/pkgs/development/python-modules/flatten-dict/default.nix b/pkgs/development/python-modules/flatten-dict/default.nix
new file mode 100644
index 00000000000..e7bda9378b1
--- /dev/null
+++ b/pkgs/development/python-modules/flatten-dict/default.nix
@@ -0,0 +1,46 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, pytestCheckHook
+, pythonOlder
+, six
+}:
+
+buildPythonPackage rec {
+  pname = "flatten-dict";
+  version = "0.4.2";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "ianlini";
+    repo = pname;
+    rev = version;
+    hash = "sha256-uHenKoD4eLm9sMREVuV0BB/oUgh4NMiuj+IWd0hlxNQ=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    six
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "flatten_dict"
+  ];
+
+  meta = with lib; {
+    description = "Module for flattening and unflattening dict-like objects";
+    homepage = "https://github.com/ianlini/flatten-dict";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/flux-led/default.nix b/pkgs/development/python-modules/flux-led/default.nix
index a8fa6b46cdd..5e4ec4290fe 100644
--- a/pkgs/development/python-modules/flux-led/default.nix
+++ b/pkgs/development/python-modules/flux-led/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "flux-led";
-  version = "0.28.3";
+  version = "0.28.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "flux_led";
     rev = version;
-    sha256 = "sha256-IkH5cCJbBUekABUcRyJl00tZgx+WqipEVsK8/ks2KDk=";
+    sha256 = "sha256-mD6pTrUAzApJamqqcLzzQI2JDKy3PAn5TtQz5/aPFXg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-api-core/default.nix b/pkgs/development/python-modules/google-api-core/default.nix
index 9d548b685ef..d6dedff38e7 100644
--- a/pkgs/development/python-modules/google-api-core/default.nix
+++ b/pkgs/development/python-modules/google-api-core/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "google-api-core";
-  version = "2.2.2";
+  version = "2.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "97349cc18c2bb2415f64f1353a80273a289a61294ce3eb2f7ce682d251bdd997";
+    sha256 = "sha256-uoeHt8YWMs0DQPCV4cA2vvlCayWU8Qr7KQujEa6Msss=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-bigquery/default.nix b/pkgs/development/python-modules/google-cloud-bigquery/default.nix
index d8cd4d3b580..96a10e1a222 100644
--- a/pkgs/development/python-modules/google-cloud-bigquery/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigquery/default.nix
@@ -18,12 +18,12 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigquery";
-  version = "2.31.0";
+  version = "2.32.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ff66d7d1f64795a855784706c3baa52d18fa0cd1cc4f0a150cf74268abb53ac0";
+    sha256 = "sha256-84Y6xCk/CkWF5ERh2CuR+SOXIe8z/JV11AG02n3BJ70=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-datacatalog/default.nix b/pkgs/development/python-modules/google-cloud-datacatalog/default.nix
index 0e0d5982c6e..bf9e8552aec 100644
--- a/pkgs/development/python-modules/google-cloud-datacatalog/default.nix
+++ b/pkgs/development/python-modules/google-cloud-datacatalog/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-datacatalog";
-  version = "3.6.1";
+  version = "3.6.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "136fb153740d4154d8c9ef306284f7f899399de45eef2c9027ca3e56249c4e2d";
+    sha256 = "sha256-9oixM+4HxHn0G3j8Hpg1iB5gM+7xyD5GBbWpEzzjdrE=";
   };
 
   propagatedBuildInputs = [ libcst google-api-core grpc-google-iam-v1 proto-plus ];
diff --git a/pkgs/development/python-modules/google-cloud-storage/default.nix b/pkgs/development/python-modules/google-cloud-storage/default.nix
index f74944a45e2..e3423ac48d6 100644
--- a/pkgs/development/python-modules/google-cloud-storage/default.nix
+++ b/pkgs/development/python-modules/google-cloud-storage/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-storage";
-  version = "1.44.0";
+  version = "2.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "29edbfeedd157d853049302bf5d104055c6f0cb7ef283537da3ce3f730073001";
+    sha256 = "sha256-pXoVrq0PnfvUOB8b/b6L+JgYpL11urhGyvzvstuEbEc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-tasks/default.nix b/pkgs/development/python-modules/google-cloud-tasks/default.nix
index e055d462b1f..c1b58c0e1c2 100644
--- a/pkgs/development/python-modules/google-cloud-tasks/default.nix
+++ b/pkgs/development/python-modules/google-cloud-tasks/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-tasks";
-  version = "2.7.1";
+  version = "2.7.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2fd2222901a7d8ba65f28f9019cb41f5d4c952d012f020bdde105527a3f5ae43";
+    sha256 = "sha256-h/lmrrT8fu1YLDYF6s856EAB8+k7CMFfIMGZPDxC7Ys=";
   };
 
   propagatedBuildInputs = [ google-api-core grpc-google-iam-v1 libcst proto-plus ];
diff --git a/pkgs/development/python-modules/google-cloud-testutils/default.nix b/pkgs/development/python-modules/google-cloud-testutils/default.nix
index 54af78da3eb..d4551b4954a 100644
--- a/pkgs/development/python-modules/google-cloud-testutils/default.nix
+++ b/pkgs/development/python-modules/google-cloud-testutils/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-testutils";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7a755c1247e32e92bd6df4fa2240dab185b29da9777ab3b946c3b3d9f1abf5d3";
+    sha256 = "sha256-X85NRgGZt7+OpL4poOyS+UWec4fuABiTxEYyFpkUpqs=";
   };
 
   propagatedBuildInputs = [ click google-auth six ];
diff --git a/pkgs/development/python-modules/grandalf/default.nix b/pkgs/development/python-modules/grandalf/default.nix
index 6056d215d22..c4e7eb4d744 100644
--- a/pkgs/development/python-modules/grandalf/default.nix
+++ b/pkgs/development/python-modules/grandalf/default.nix
@@ -3,20 +3,22 @@
 , fetchFromGitHub
 , pyparsing
 , future
-, pytest
-, pytest-runner
+, pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "grandalf";
-  version = "0.6";
+  version = "0.7";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
-  # fetch from github to acquire tests
   src = fetchFromGitHub {
     owner = "bdcht";
-    repo = "grandalf";
+    repo = pname;
     rev = "v${version}";
-    sha256 = "1f1l288sqna0bca7dwwvyw7wzg9b2613g6vc0g0vfngm7k75b2jg";
+    hash = "sha256-j2SvpQvDMfwoj2PAQSxzEIyIzzJ61Eb9wgetKyni6A4=";
   };
 
   propagatedBuildInputs = [
@@ -24,18 +26,22 @@ buildPythonPackage rec {
     future
   ];
 
-  checkInputs = [ pytest pytest-runner ];
+  checkInputs = [
+    pytestCheckHook
+  ];
 
-  patches = [ ./no-setup-requires-pytestrunner.patch ];
+  patches = [
+    ./no-setup-requires-pytestrunner.patch
+  ];
 
-  checkPhase = ''
-    pytest tests
-  '';
+  pythonImportsCheck = [
+    "grandalf"
+  ];
 
   meta = with lib; {
-    description = "A python package made for experimentations with graphs and drawing algorithms";
+    description = "Module for experimentations with graphs and drawing algorithms";
     homepage = "https://github.com/bdcht/grandalf";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     maintainers = with maintainers; [ cmcdragonkai ];
   };
 }
diff --git a/pkgs/development/python-modules/graph-tool/2.x.x.nix b/pkgs/development/python-modules/graph-tool/default.nix
index c8725dfd116..c8725dfd116 100644
--- a/pkgs/development/python-modules/graph-tool/2.x.x.nix
+++ b/pkgs/development/python-modules/graph-tool/default.nix
diff --git a/pkgs/development/python-modules/greeclimate/default.nix b/pkgs/development/python-modules/greeclimate/default.nix
index 5f72411e9e8..5a17b4679e1 100644
--- a/pkgs/development/python-modules/greeclimate/default.nix
+++ b/pkgs/development/python-modules/greeclimate/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "greeclimate";
-  version = "1.0.1";
+  version = "1.0.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "cmroche";
     repo = "greeclimate";
     rev = "v${version}";
-    hash = "sha256-O9SaEveZntb7VWL5k1WjTDK9fXhTWFIsVh5v7NKASnQ=";
+    hash = "sha256-Y8IgqrU8zzV020qwyyb57Tp2j7laQ3JsCOCYBuf8vsQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/gvm-tools/default.nix b/pkgs/development/python-modules/gvm-tools/default.nix
index 17fb02fd10d..8de737eeedd 100644
--- a/pkgs/development/python-modules/gvm-tools/default.nix
+++ b/pkgs/development/python-modules/gvm-tools/default.nix
@@ -4,6 +4,7 @@
 , poetry-core
 , pytestCheckHook
 , python-gvm
+, pythonAtLeast
 , pythonOlder
 }:
 
@@ -36,6 +37,8 @@ buildPythonPackage rec {
   disabledTests = [
     # Don't test sending
     "SendTargetTestCase"
+  ] ++ lib.optionals (pythonAtLeast "3.10") [
+    "HelpFormattingParserTestCase"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/hangups/default.nix b/pkgs/development/python-modules/hangups/default.nix
index 1832803388f..3b5e0a218b7 100644
--- a/pkgs/development/python-modules/hangups/default.nix
+++ b/pkgs/development/python-modules/hangups/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "hangups";
-  version = "0.4.15";
+  version = "0.4.17";
 
   disabled = pythonOlder "3.6";
 
@@ -26,13 +26,12 @@ buildPythonPackage rec {
     owner = "tdryer";
     repo = "hangups";
     rev = "v${version}";
-    sha256 = "sha256-47OvfFK92AtX6KiYnvro2B17RfQWyzgsgvOfl5T3Kag=";
+    hash = "sha256-8kNWcRAip9LkmazDUVeDjGWhy/TWzT01c959LA5hb1Q=";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "protobuf>=3.1.0,<3.17" "protobuf" \
-      --replace "async-timeout>=2,<4" "async-timeout" \
+      --replace "protobuf>=3.1.0,<3.20" "protobuf" \
       --replace "MechanicalSoup>=0.6.0,<0.13" "MechanicalSoup"
   '';
 
diff --git a/pkgs/development/python-modules/hap-python/default.nix b/pkgs/development/python-modules/hap-python/default.nix
index c58e50bee86..63a2e941f0f 100644
--- a/pkgs/development/python-modules/hap-python/default.nix
+++ b/pkgs/development/python-modules/hap-python/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "hap-python";
-  version = "4.3.0";
+  version = "4.4.0";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "ikalchev";
     repo = "HAP-python";
     rev = "v${version}";
-    sha256 = "sha256-G4KL6iMeVn/tmvFtFL8vyqHGNfqk6j8iG4tDK9VpCyM=";
+    sha256 = "sha256-dSiI2W4U4FYwMRBInpxb/wkQLKxPzLHIkLPNgiZEhUA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/httpagentparser/default.nix b/pkgs/development/python-modules/httpagentparser/default.nix
new file mode 100644
index 00000000000..e0c9dd09bcb
--- /dev/null
+++ b/pkgs/development/python-modules/httpagentparser/default.nix
@@ -0,0 +1,26 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "httpagentparser";
+  version = "1.9.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "73Y9MZk912GCWs7myLNL4yuVzxZ10cc8PNNfnlKDGyY=";
+  };
+
+  # PyPi version does not include test directory
+  doCheck = false;
+
+  pythonImportsCheck = [ "httpagentparser" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/shon/httpagentparser";
+    description = "Extracts OS Browser etc information from http user agent string";
+    license = licenses.mit;
+    maintainers = with maintainers; [ gador ];
+  };
+}
diff --git a/pkgs/development/python-modules/hwi/default.nix b/pkgs/development/python-modules/hwi/default.nix
index d4d091c36f8..1bd1e6650c8 100644
--- a/pkgs/development/python-modules/hwi/default.nix
+++ b/pkgs/development/python-modules/hwi/default.nix
@@ -8,11 +8,15 @@
 , mnemonic
 , pyaes
 , typing-extensions
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "hwi";
   version = "2.0.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "bitcoin-core";
@@ -34,18 +38,21 @@ buildPythonPackage rec {
   # make compatible with libusb1 2.x
   postPatch = ''
     substituteInPlace setup.py \
-      --replace 'libusb1>=1.7,<2.0' 'libusb1>=1.7'
+      --replace 'libusb1>=1.7,<2.0' 'libusb1>=1.7' \
+      --replace "'python_requires': '>=3.6,<3.10'," "'python_requires': '>=3.6,<4',"
   '';
 
   # tests require to clone quite a few firmwares
   doCheck = false;
 
-  pythonImportsCheck = [ "hwilib" ];
+  pythonImportsCheck = [
+    "hwilib"
+  ];
 
-  meta = {
+  meta = with lib; {
     description = "Bitcoin Hardware Wallet Interface";
     homepage = "https://github.com/bitcoin-core/hwi";
-    license = with lib.licenses; [ mit ];
-    maintainers = with lib.maintainers; [ prusnak ];
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ prusnak ];
   };
 }
diff --git a/pkgs/development/python-modules/ics/default.nix b/pkgs/development/python-modules/ics/default.nix
index ed87f3678b1..34a36642976 100644
--- a/pkgs/development/python-modules/ics/default.nix
+++ b/pkgs/development/python-modules/ics/default.nix
@@ -40,6 +40,8 @@ buildPythonPackage rec {
   disabledTests = [
     # Failure seems to be related to arrow > 1.0
     "test_event"
+    # Broke with TatSu 5.7:
+    "test_many_lines"
   ];
 
   pythonImportsCheck = [ "ics" ];
diff --git a/pkgs/development/python-modules/identify/default.nix b/pkgs/development/python-modules/identify/default.nix
index a5da612467c..79d141c6a8b 100644
--- a/pkgs/development/python-modules/identify/default.nix
+++ b/pkgs/development/python-modules/identify/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "identify";
-  version = "2.4.3";
+  version = "2.4.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "pre-commit";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-r7Ta/OumYdm+brM6UgAPTWvxODpex1Mg0Arq94tPdnM=";
+    sha256 = "sha256-G819m1mMtk5v1paMf9vdK/m/gbq08NNHM1bfW7jb+JA=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/installer/default.nix b/pkgs/development/python-modules/installer/default.nix
new file mode 100644
index 00000000000..a19f27a0a75
--- /dev/null
+++ b/pkgs/development/python-modules/installer/default.nix
@@ -0,0 +1,35 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, pytestCheckHook
+, flit-core
+, mock
+}:
+
+buildPythonPackage rec {
+  pname = "installer";
+  version = "0.3.0";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "pradyunsg";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-AxAQgDhRFkb0HB7ttDb+pHuHzwnNDX6UOm9rswzIwmI=";
+  };
+
+  nativeBuildInputs = [ flit-core ];
+
+  checkInputs = [
+    pytestCheckHook
+    mock
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/pradyunsg/installer";
+    description = "A low-level library for installing a Python package from a wheel distribution.";
+    license = licenses.mit;
+    maintainers = with maintainers; [ cpcloud fridh ];
+  };
+}
diff --git a/pkgs/development/python-modules/ipython/7.16.nix b/pkgs/development/python-modules/ipython/7.16.nix
deleted file mode 100644
index 1f62cc9bc18..00000000000
--- a/pkgs/development/python-modules/ipython/7.16.nix
+++ /dev/null
@@ -1,69 +0,0 @@
-{ lib
-, stdenv
-, buildPythonPackage
-, fetchPypi
-, pythonOlder
-# Build dependencies
-, glibcLocales
-# Test dependencies
-, nose
-, pygments
-# Runtime dependencies
-, jedi
-, decorator
-, pickleshare
-, traitlets
-, prompt-toolkit
-, pexpect
-, appnope
-, backcall
-}:
-
-buildPythonPackage rec {
-  pname = "ipython";
-  version = "7.16.1";
-  disabled = pythonOlder "3.6";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "9f4fcb31d3b2c533333893b9172264e4821c1ac91839500f31bd43f2c59b3ccf";
-  };
-
-  prePatch = lib.optionalString stdenv.isDarwin ''
-    substituteInPlace setup.py --replace "'gnureadline'" " "
-  '';
-
-  buildInputs = [ glibcLocales ];
-
-  checkInputs = [ nose pygments ];
-
-  propagatedBuildInputs = [
-    jedi
-    decorator
-    pickleshare
-    traitlets
-    prompt-toolkit
-    pygments
-    pexpect
-    backcall
-  ] ++ lib.optionals stdenv.isDarwin [appnope];
-
-  LC_ALL="en_US.UTF-8";
-
-  doCheck = false; # Circular dependency with ipykernel
-
-  checkPhase = ''
-    nosetests
-  '';
-
-  pythonImportsCheck = [
-    "IPython"
-  ];
-
-  meta = with lib; {
-    description = "IPython: Productive Interactive Computing";
-    homepage = "http://ipython.org/";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ bjornfor fridh ];
-  };
-}
diff --git a/pkgs/development/python-modules/irc/default.nix b/pkgs/development/python-modules/irc/default.nix
index 423ec4ecf29..15747d3f70d 100644
--- a/pkgs/development/python-modules/irc/default.nix
+++ b/pkgs/development/python-modules/irc/default.nix
@@ -5,13 +5,13 @@
 
 buildPythonPackage rec {
   pname = "irc";
-  version = "19.0.1";
+  version = "20.0.0";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "99fd5d1fa1d054dee4fbb81e0d5193dc1e8200db751d5da9a97850a62162b9ab";
+    sha256 = "59acb8d69d61a0cbd290e77e6ff10a8c7f2201fb8c7b7d5a195b5883d0c40b0a";
   };
 
   doCheck = false;
diff --git a/pkgs/development/python-modules/mailchecker/default.nix b/pkgs/development/python-modules/mailchecker/default.nix
new file mode 100644
index 00000000000..ce47d6b3a2d
--- /dev/null
+++ b/pkgs/development/python-modules/mailchecker/default.nix
@@ -0,0 +1,32 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "mailchecker";
+  version = "4.1.8";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-RLZunjRX7lljKQl+sJ/py8bTR/YZsDewTJao9IBuLbE=";
+  };
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "MailChecker"
+  ];
+
+  meta = with lib; {
+    description = "Module for temporary (disposable/throwaway) email detection";
+    homepage = "https://github.com/FGRibreau/mailchecker";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/matrix-common/default.nix b/pkgs/development/python-modules/matrix-common/default.nix
new file mode 100644
index 00000000000..44d37b988a7
--- /dev/null
+++ b/pkgs/development/python-modules/matrix-common/default.nix
@@ -0,0 +1,27 @@
+{ stdenv
+, lib
+, buildPythonPackage
+, fetchPypi
+, attrs
+}:
+
+buildPythonPackage rec {
+  pname = "matrix_common";
+  version = "1.0.0";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-ZmiKRoJ8hv1USuJBDzV2U1uIFt2lRxmT+iAOqOShJK4=";
+  };
+
+  propagatedBuildInputs = [ attrs ];
+  pythonImportsCheck = [ "matrix_common" ];
+
+  meta = with lib; {
+    description = "Common utilities for Synapse, Sydent and Sygnal";
+    homepage = "https://github.com/matrix-org/matrix-python-common";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ sumnerevans ];
+  };
+}
diff --git a/pkgs/development/python-modules/meshtastic/default.nix b/pkgs/development/python-modules/meshtastic/default.nix
index 93b82f195ce..d146d7d6456 100644
--- a/pkgs/development/python-modules/meshtastic/default.nix
+++ b/pkgs/development/python-modules/meshtastic/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "meshtastic";
-  version = "1.2.54";
+  version = "1.2.57";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "meshtastic";
     repo = "Meshtastic-python";
     rev = version;
-    sha256 = "sha256-YTE0lcsPBvcTdeYRrADQjs5b8inO7+nSw2YW2xalo74=";
+    sha256 = "sha256-olh8DUYg3s72ll1+p+0QapdKR2+aaSvgSUrZuGFif1s=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mitogen/default.nix b/pkgs/development/python-modules/mitogen/default.nix
index 789d68c7f93..d99bdec4b0d 100644
--- a/pkgs/development/python-modules/mitogen/default.nix
+++ b/pkgs/development/python-modules/mitogen/default.nix
@@ -1,23 +1,29 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "mitogen";
-  version = "0.3.0";
+  version = "0.3.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "mitogen-hq";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-SotxlsJDIeFd4BN9C7afyyybET5ST2yaoWVEyT/lr48=";
+    sha256 = "sha256-ACd1z9h9RLu6Kho59L2YkXkLtBEywYbO+drUvoZaVlg=";
   };
 
   # Tests require network access and Docker support
   doCheck = false;
 
-  pythonImportsCheck = [ "mitogen" ];
+  pythonImportsCheck = [
+    "mitogen"
+  ];
 
   meta = with lib; {
     description = "Python Library for writing distributed self-replicating programs";
diff --git a/pkgs/development/python-modules/mlflow/default.nix b/pkgs/development/python-modules/mlflow/default.nix
index 8039bdb1547..658470ec72b 100644
--- a/pkgs/development/python-modules/mlflow/default.nix
+++ b/pkgs/development/python-modules/mlflow/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, isPy27
+{ lib, buildPythonPackage, fetchPypi, isPy27, fetchpatch
 , alembic
 , click
 , cloudpickle
@@ -20,6 +20,8 @@
 , sqlalchemy
 , gorilla
 , gunicorn
+, prometheus-flask-exporter
+, importlib-metadata
 }:
 
 buildPythonPackage rec {
@@ -58,6 +60,17 @@ buildPythonPackage rec {
     sqlalchemy
     gorilla
     gunicorn
+    prometheus-flask-exporter
+    importlib-metadata
+  ];
+
+  patches = [
+    # Relex alembic version, https://github.com/mlflow/mlflow/pull/5245
+    (fetchpatch {
+      name = "relax-alembic-version.patch";
+      url = "https://github.com/mlflow/mlflow/commit/945eb4b67f315c0b2c4018b1df006fde910f115f.patch";
+      sha256 = "sha256-jETVEPzlNe0PvFZVOi1SwgJELfx/KCeq6REL3vl+YT0=";
+    })
   ];
 
   meta = with lib; {
@@ -65,7 +78,5 @@ buildPythonPackage rec {
     description = "Open source platform for the machine learning lifecycle";
     license = licenses.asl20;
     maintainers = with maintainers; [ tbenst ];
-    # missing prometheus-flask-exporter, not packaged in nixpkgs
-    broken = true; # 2020-08-15
   };
 }
diff --git a/pkgs/development/python-modules/mongomock/default.nix b/pkgs/development/python-modules/mongomock/default.nix
new file mode 100644
index 00000000000..0f2f305c97c
--- /dev/null
+++ b/pkgs/development/python-modules/mongomock/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pbr
+, sentinels
+, six
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "mongomock";
+  version = "3.23.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1pdh4pj5n6dsaqy98q40wig5y6imfs1p043cgkaaw8f2hxy5x56r";
+  };
+
+  nativeBuildInputs = [
+    pbr
+  ];
+
+  propagatedBuildInputs = [
+    sentinels
+    six
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "mongomock" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/mongomock/mongomock";
+    description = "Fake pymongo stub for testing simple MongoDB-dependent code";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ gador ];
+  };
+}
diff --git a/pkgs/development/python-modules/nexia/default.nix b/pkgs/development/python-modules/nexia/default.nix
index 5bb8b15f683..79c48e57f2b 100644
--- a/pkgs/development/python-modules/nexia/default.nix
+++ b/pkgs/development/python-modules/nexia/default.nix
@@ -9,14 +9,16 @@
 
 buildPythonPackage rec {
   pname = "nexia";
-  version = "0.9.12";
+  version = "0.9.13";
+  format = "setuptools";
+
   disabled = pythonOlder "3.5";
 
   src = fetchFromGitHub {
     owner = "bdraco";
     repo = pname;
     rev = version;
-    sha256 = "sha256-YZHAWRTYquUm3Ymi/3mSQqxYZuoxsH5Q/LZOPDftEzU=";
+    sha256 = "sha256-0VG8tSwbVTIIsQYAEwzQfXLTDy4df/nS/rbHjYo7xf0=";
   };
 
   propagatedBuildInputs = [
@@ -29,10 +31,13 @@ buildPythonPackage rec {
   ];
 
   postPatch = ''
-    substituteInPlace setup.py --replace '"pytest-runner",' ""
+    substituteInPlace setup.py \
+      --replace '"pytest-runner",' ""
   '';
 
-  pythonImportsCheck = [ "nexia" ];
+  pythonImportsCheck = [
+    "nexia"
+  ];
 
   meta = with lib; {
     description = "Python module for Nexia thermostats";
diff --git a/pkgs/development/python-modules/pdm-pep517/default.nix b/pkgs/development/python-modules/pdm-pep517/default.nix
new file mode 100644
index 00000000000..11d677e1100
--- /dev/null
+++ b/pkgs/development/python-modules/pdm-pep517/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchPypi
+, git
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "pdm-pep517";
+  version = "0.9.4";
+  format = "pyproject";
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-2o2FuuvS5PW7uhxl3EGBP75CZ3dcyjPoug1k0irl51c=";
+  };
+
+  preCheck = ''
+    HOME=$TMPDIR
+
+    git config --global user.name nobody
+    git config --global user.email nobody@example.com
+  '';
+
+  checkInputs = [
+    pytestCheckHook
+    git
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/pdm-project/pdm-pep517";
+    description = "Yet another PEP 517 backend.";
+    license = licenses.mit;
+    maintainers = with maintainers; [ cpcloud ];
+  };
+}
diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index 6f0f733c472..f52467f3e59 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage rec {
   pname = "pikepdf";
-  version = "4.3.0";
+  version = "4.3.1";
   disabled = ! isPy3k;
 
   src = fetchFromGitHub {
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     extraPostFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-9dSJ6+rZd49rFSQExYnFBGQGZ8MnFM+z/0Iz/nYkW4E=";
+    hash = "sha256-u/NDDJGCcctWL3ivxtU+8CSlQH+5qkmXUcF4RkQOiPI=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/pony/default.nix b/pkgs/development/python-modules/pony/default.nix
index 03330c4cfec..27c35abe573 100644
--- a/pkgs/development/python-modules/pony/default.nix
+++ b/pkgs/development/python-modules/pony/default.nix
@@ -1,25 +1,42 @@
-{ lib, python, buildPythonPackage, fetchPypi }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+}:
 
 buildPythonPackage rec {
   pname = "pony";
-  version = "0.7.14";
+  version = "0.7.15rc1";
+  format = "setuptools";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "2f01e84e79ea7a14040225cb6c079bb266e7ba147346356c266490b18c77ce82";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "ponyorm";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-EoMpVvPCwxJbNPoeF73djcaQ4lY9jRx5nJYR2A2LXoQ=";
   };
 
-  doCheck = true;
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # Tests are outdated
+    "test_exception_msg"
+    "test_method"
+  ];
 
-  # stripping the tests
-  postInstall = ''
-    rm -rf $out/${python.sitePackages}/pony/orm/tests
-  '';
+  pythonImportsCheck = [
+    "pony"
+  ];
 
   meta = with lib; {
-    description = "Pony is a Python ORM with beautiful query syntax";
+    description = "Library for advanced object-relational mapping";
     homepage = "https://ponyorm.org/";
-    maintainers = with maintainers; [ d-goldin xvapx ];
     license = licenses.asl20;
+    maintainers = with maintainers; [ d-goldin xvapx ];
   };
 }
diff --git a/pkgs/development/python-modules/pyTelegramBotAPI/default.nix b/pkgs/development/python-modules/pyTelegramBotAPI/default.nix
index 38077ec3e02..f55c869a7a2 100644
--- a/pkgs/development/python-modules/pyTelegramBotAPI/default.nix
+++ b/pkgs/development/python-modules/pyTelegramBotAPI/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pyTelegramBotAPI";
-  version = "4.2.1";
+  version = "4.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9a407fd58a406a53ae44ae8ff5f2edb4396be67bca3436523f791642d8561de3";
+    sha256 = "a0405d1c6c60e6603594e9319c28d31b97abe49afe9af21d230f5072a1d38976";
   };
 
   propagatedBuildInputs = [ aiohttp requests ];
diff --git a/pkgs/development/python-modules/pyatv/default.nix b/pkgs/development/python-modules/pyatv/default.nix
index 36bf117122b..9f1bd008108 100644
--- a/pkgs/development/python-modules/pyatv/default.nix
+++ b/pkgs/development/python-modules/pyatv/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "pyatv";
-  version = "0.9.7";
+  version = "0.9.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "postlund";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1ikv9m1348sjv31gch5w0sj97jlr4yjxbqfyds7alxxcm5hrhai4";
+    sha256 = "1ns1ys3mwi1s1b8zxcr7xgr1rfnlxwdn2fp680yi09x4d9nmnvqp";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pybotvac/default.nix b/pkgs/development/python-modules/pybotvac/default.nix
index 7bf5296eb36..dff1374087a 100644
--- a/pkgs/development/python-modules/pybotvac/default.nix
+++ b/pkgs/development/python-modules/pybotvac/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "pybotvac";
-  version = "0.0.22";
+  version = "0.0.23";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-hl8UmoVUbbHCSpCWdUTxoIlop5di+rUmGUQI9UWq3ik=";
+    sha256 = "54b4fe565c10000c54d5644d081e2de1f850daefbac39cea74cea649b47bfb12";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyhiveapi/default.nix b/pkgs/development/python-modules/pyhiveapi/default.nix
index f62d8bd1305..fb0b22cd444 100644
--- a/pkgs/development/python-modules/pyhiveapi/default.nix
+++ b/pkgs/development/python-modules/pyhiveapi/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "pyhiveapi";
-  version = "0.4.3";
+  version = "0.4.6";
 
   format = "pyproject";
 
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "Pyhass";
     repo = "Pyhiveapi";
     rev = "v${version}";
-    sha256 = "sha256-SCMASYBOdq9nko5RSQ5BEbRLjOB4FlgwOKwdDggiOv8=";
+    hash = "sha256-muUVZYBUloKRnAx7H8ry72eg85GzmnpTG8M/MfKcnGM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyrogram/default.nix b/pkgs/development/python-modules/pyrogram/default.nix
index da15590e5da..3a86e42f7a6 100644
--- a/pkgs/development/python-modules/pyrogram/default.nix
+++ b/pkgs/development/python-modules/pyrogram/default.nix
@@ -5,26 +5,28 @@
 , pyaes
 , pysocks
 , async-lru
+, tgcrypto
 , pytestCheckHook
 , pytest-asyncio
 }:
 
 buildPythonPackage rec {
   pname = "pyrogram";
-  version = "1.3.1";
+  version = "1.3.5";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     pname = "Pyrogram";
     inherit version;
-    sha256 = "e883c001ebf2d0f5ce6805063470c92436c493eb15547923e5d437e2c13f66cd";
+    hash = "sha256-51/to8ZCyK6cYWQCGWcQ07rGDR29awfxcUNnSF5vIKE=";
   };
 
   propagatedBuildInputs = [
     pyaes
     pysocks
     async-lru
+    tgcrypto
   ];
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/pytest/5.nix b/pkgs/development/python-modules/pytest/5.nix
deleted file mode 100644
index ee04e3be429..00000000000
--- a/pkgs/development/python-modules/pytest/5.nix
+++ /dev/null
@@ -1,95 +0,0 @@
-{ lib, buildPythonPackage, pythonOlder, fetchPypi, isPy3k, isPyPy
-, atomicwrites
-, attrs
-, hypothesis
-, more-itertools
-, packaging
-, pathlib2
-, pluggy
-, py
-, pygments
-, setuptools
-, setuptools-scm
-, six
-, toml
-, wcwidth
-, writeText
-}:
-
-buildPythonPackage rec {
-  version = "5.4.3";
-  pname = "pytest";
-
-  disabled = !isPy3k;
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1n67lk8iwlsmfdm8663k8l7isllg1xd3n9p1yla7885szhdk6ybr";
-  };
-
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "pluggy>=0.12,<1.0" "pluggy>=0.12,<2.0"
-  '';
-
-  checkInputs = [ hypothesis pygments ];
-  nativeBuildInputs = [ setuptools-scm ];
-  propagatedBuildInputs = [
-    atomicwrites
-    attrs
-    more-itertools
-    packaging
-    pluggy
-    py
-    setuptools
-    six
-    toml
-    wcwidth
-  ] ++ lib.optionals (pythonOlder "3.6") [ pathlib2 ];
-
-  doCheck = !isPyPy; # https://github.com/pytest-dev/pytest/issues/3460
-
-  preCheck = ''
-    # don't test bash builtins
-    rm testing/test_argcomplete.py
-  '';
-
-  # Ignored file https://github.com/pytest-dev/pytest/pull/5605#issuecomment-522243929
-  checkPhase = ''
-    runHook preCheck
-    $out/bin/py.test -x testing/ -k "not test_collect_pyargs_with_testpaths" --ignore=testing/test_junitxml.py
-    runHook postCheck
-  '';
-
-  # Remove .pytest_cache when using py.test in a Nix build
-  setupHook = writeText "pytest-hook" ''
-    pytestcachePhase() {
-        find $out -name .pytest_cache -type d -exec rm -rf {} +
-    }
-    preDistPhases+=" pytestcachePhase"
-
-    # pytest generates it's own bytecode files to improve assertion messages.
-    # These files similar to cpython's bytecode files but are never laoded
-    # by python interpreter directly. We remove them for a few reasons:
-    # - files are non-deterministic: https://github.com/NixOS/nixpkgs/issues/139292
-    #   (file headers are generatedt by pytest directly and contain timestamps)
-    # - files are not needed after tests are finished
-    pytestRemoveBytecodePhase () {
-        # suffix is defined at:
-        #    https://github.com/pytest-dev/pytest/blob/5.4.3/src/_pytest/assertion/rewrite.py#L42-L45
-        find $out -name "*-pytest-*.py[co]" -delete
-    }
-    preDistPhases+=" pytestRemoveBytecodePhase"
-  '';
-
-  pythonImportsCheck = [
-    "pytest"
-  ];
-
-  meta = with lib; {
-    homepage = "https://docs.pytest.org";
-    description = "Framework for writing tests";
-    maintainers = with maintainers; [ domenkozar lovek323 madjar lsix ];
-    license = licenses.mit;
-  };
-}
diff --git a/pkgs/development/python-modules/python-benedict/default.nix b/pkgs/development/python-modules/python-benedict/default.nix
new file mode 100644
index 00000000000..9cf5ffc63ab
--- /dev/null
+++ b/pkgs/development/python-modules/python-benedict/default.nix
@@ -0,0 +1,75 @@
+{ lib
+, aiohttp
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+
+, mailchecker
+, phonenumbers
+, python-dateutil
+, python-fsutil
+, python-slugify
+, pyyaml
+, ftfy
+, requests
+, six
+, toml
+, xmltodict
+}:
+
+buildPythonPackage rec {
+  pname = "python-benedict";
+  version = "0.24.3";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fabiocaccamo";
+    repo = pname;
+    rev = version;
+    hash = "sha256-06n8MNoGQRSrBK2XeEBBoQ2NIXWf0qXPVBeP9ERMEj0=";
+  };
+
+  propagatedBuildInputs = [
+    mailchecker
+    phonenumbers
+    python-dateutil
+    python-fsutil
+    python-slugify
+    pyyaml
+    ftfy
+    requests
+    six
+    toml
+    xmltodict
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # Tests require network access
+    "test_from_base64_with_valid_url_valid_content"
+    "test_from_json_with_valid_url_valid_content"
+    "test_from_pickle_with_valid_url_valid_content"
+    "test_from_plist_with_valid_url_valid_content"
+    "test_from_query_string_with_valid_url_valid_content"
+    "test_from_toml_with_valid_url_valid_content"
+    "test_from_xml_with_valid_url_valid_content"
+    "test_from_yaml_with_valid_url_valid_content"
+  ];
+
+  pythonImportsCheck = [
+    "benedict"
+  ];
+
+  meta = with lib; {
+    description = "Module with keylist/keypath support";
+    homepage = "https://github.com/fabiocaccamo/python-benedict";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/python-engineio/default.nix b/pkgs/development/python-modules/python-engineio/default.nix
index baf385bb7d7..da929638757 100644
--- a/pkgs/development/python-modules/python-engineio/default.nix
+++ b/pkgs/development/python-modules/python-engineio/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "python-engineio";
-  version = "4.3.0";
+  version = "4.3.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "miguelgrinberg";
     repo = "python-engineio";
     rev = "v${version}";
-    sha256 = "sha256-ohNRtceh0bHBlnGSFUckG5KzoLY8Q1jvpFee7T78Vto=";
+    sha256 = "sha256-8595zivZmff0agFiQd5Qyd/T3BDxYcsb4RjA5AWXVNM=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/python-fsutil/default.nix b/pkgs/development/python-modules/python-fsutil/default.nix
new file mode 100644
index 00000000000..17dbd579e84
--- /dev/null
+++ b/pkgs/development/python-modules/python-fsutil/default.nix
@@ -0,0 +1,51 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+, requests
+}:
+
+buildPythonPackage rec {
+  pname = "python-fsutil";
+  version = "0.5.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fabiocaccamo";
+    repo = pname;
+    rev = version;
+    hash = "sha256-zWthL7iwdVzdihX2YA4G//B18iwe1gRT0GM2KNP01kQ=";
+  };
+
+  propagatedBuildInputs = [
+    requests
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [
+    "tests/test.py"
+  ];
+
+  disabledTests = [
+    # Tests require network access
+    "test_download_file"
+    "test_read_file_from_url"
+  ];
+
+  pythonImportsCheck = [
+    "fsutil"
+  ];
+
+  meta = with lib; {
+    description = "Module with file-system utilities";
+    homepage = "https://github.com/fabiocaccamo/python-fsutil";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/python-kasa/default.nix b/pkgs/development/python-modules/python-kasa/default.nix
index 10ff6ddf621..17c3cb07be3 100644
--- a/pkgs/development/python-modules/python-kasa/default.nix
+++ b/pkgs/development/python-modules/python-kasa/default.nix
@@ -2,7 +2,6 @@
 , asyncclick
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , importlib-metadata
 , poetry-core
 , pytest-asyncio
@@ -14,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "python-kasa";
-  version = "0.4.0";
+  version = "0.4.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -23,7 +22,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "08blmz5kg826l08pf6yrvl8gc8iz3hfb6wsfqih606dal08kdhdi";
+    sha256 = "sha256-4e9jpUDorZlKCYwWtqrba61zbkJl57oWUhEpFcaS9ak=";
   };
 
   nativeBuildInputs = [
@@ -42,26 +41,14 @@ buildPythonPackage rec {
     voluptuous
   ];
 
-  patches = [
-    # Switch to poetry-core, https://github.com/python-kasa/python-kasa/pull/226
-    (fetchpatch {
-      name = "switch-to-poetry-core.patch";
-      url = "https://github.com/python-kasa/python-kasa/commit/05c2a4a7dedbd60038e177b4d3f5ac5798544d11.patch";
-      sha256 = "0cla11yqx88wj2s50s3xxxhv4nz4h3wd9pi12v79778hzdlg58rr";
-    })
-  ];
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'asyncclick = "^7"' 'asyncclick = "*"'
-  '';
-
   disabledTestPaths = [
     # Skip the examples tests
     "kasa/tests/test_readme_examples.py"
   ];
 
-  pythonImportsCheck = [ "kasa" ];
+  pythonImportsCheck = [
+    "kasa"
+  ];
 
   meta = with lib; {
     description = "Python API for TP-Link Kasa Smarthome products";
diff --git a/pkgs/development/python-modules/python-miio/default.nix b/pkgs/development/python-modules/python-miio/default.nix
index 6cd16a9decf..24c51af4fb2 100644
--- a/pkgs/development/python-modules/python-miio/default.nix
+++ b/pkgs/development/python-modules/python-miio/default.nix
@@ -24,13 +24,13 @@
 
 buildPythonPackage rec {
   pname = "python-miio";
-  version = "0.5.9.1";
+  version = "0.5.9.2";
   disabled = pythonOlder "3.6.5";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-fWLN1mGSoB+H6YSwTYpx1fuXfkrHBgdRkhzDLbmMBcg=";
+    sha256 = "sha256-AFwarRhFknfwTSvSDGoWE+/mv1KUD2XnWK/xCBqrN4o=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/python-socketio/default.nix b/pkgs/development/python-modules/python-socketio/default.nix
index 635f9cd13da..0484a75eaea 100644
--- a/pkgs/development/python-modules/python-socketio/default.nix
+++ b/pkgs/development/python-modules/python-socketio/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "python-socketio";
-  version = "5.5.0";
+  version = "5.5.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "miguelgrinberg";
     repo = "python-socketio";
     rev = "v${version}";
-    sha256 = "sha256-K5rs3UEGN1BvWDDfJE9/dPDLsZ4EGSsEf6PXodvc2Bg=";
+    sha256 = "sha256-mtXGSd7Y+frT22EL3QmiBNatwc6IrJqGBRfsQlD8LLk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pythonfinder/default.nix b/pkgs/development/python-modules/pythonfinder/default.nix
new file mode 100644
index 00000000000..bf9cb69721c
--- /dev/null
+++ b/pkgs/development/python-modules/pythonfinder/default.nix
@@ -0,0 +1,56 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, pytestCheckHook
+, attrs
+, cached-property
+, click
+, six
+, packaging
+, pytest-cov
+, pytest-timeout
+}:
+
+buildPythonPackage rec {
+  pname = "pythonfinder";
+  version = "1.2.9";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "sarugaku";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-tPMqVKbYwBRvb8/GyYNxO8lwJLcUUQyRoCoF5tg6rxs=";
+  };
+
+  propagatedBuildInputs = [
+    attrs
+    cached-property
+    click
+    six
+    packaging
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+    pytest-cov
+    pytest-timeout
+  ];
+
+  pytestFlagsArray = [ "--no-cov" ];
+
+  # these tests invoke git in a subprocess and
+  # for some reason git can't be found even if included in checkInputs
+  disabledTests = [
+    "test_shims_are_kept"
+    "test_shims_are_removed"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/sarugaku/pythonfinder";
+    description = "Cross Platform Search Tool for Finding Pythons";
+    license = licenses.mit;
+    maintainers = with maintainers; [ cpcloud ];
+  };
+}
diff --git a/pkgs/development/python-modules/pywayland/default.nix b/pkgs/development/python-modules/pywayland/default.nix
index faec2c20263..b1c9c434d80 100644
--- a/pkgs/development/python-modules/pywayland/default.nix
+++ b/pkgs/development/python-modules/pywayland/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "pywayland";
-  version = "0.4.7";
+  version = "0.4.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0IMNOPTmY22JCHccIVuZxDhVr41cDcKNkx8bp+5h2CU=";
+    sha256 = "abby4o9LmiRZwNkPhYfFOWgRtxU8e5CURQnutz6cWjQ=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/python-modules/rich/default.nix b/pkgs/development/python-modules/rich/default.nix
index ca739759826..f6194970adb 100644
--- a/pkgs/development/python-modules/rich/default.nix
+++ b/pkgs/development/python-modules/rich/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "rich";
-  version = "10.16.2";
+  version = "11.0.0";
   format = "pyproject";
   disabled = pythonOlder "3.6";
 
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "willmcgugan";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-SVenprbWq+ucQPAM1e9sNVYWbGAeo7qdEBy+cvqAMK8=";
+    sha256 = "0vkwar22rv1j6a3kqj3c016j0vnnha0kwi79fkd90ib1n501m7rn";
   };
 
   nativeBuildInputs = [ poetry-core ];
diff --git a/pkgs/development/python-modules/sagemaker/default.nix b/pkgs/development/python-modules/sagemaker/default.nix
index adc86b7c041..c42510e0729 100644
--- a/pkgs/development/python-modules/sagemaker/default.nix
+++ b/pkgs/development/python-modules/sagemaker/default.nix
@@ -16,11 +16,11 @@
 
 buildPythonPackage rec {
   pname = "sagemaker";
-  version = "2.70.0";
+  version = "2.72.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1bc0b783befa4d07dd9c43da1d1d0f3a0e66767ce8aa2af0c376cfa47c12689a";
+    sha256 = "7bc62eb713d6b2e72bf4b5635e2b1d18790f08ebd80cc9f380b5ba3a5000e727";
   };
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/sasmodels/default.nix b/pkgs/development/python-modules/sasmodels/default.nix
index 0e9b563f0f7..f7d0e62ff15 100644
--- a/pkgs/development/python-modules/sasmodels/default.nix
+++ b/pkgs/development/python-modules/sasmodels/default.nix
@@ -1,7 +1,7 @@
 { lib
 , fetchFromGitHub
 , buildPythonPackage
-, pytest_5
+, pytest
 , numpy
 , scipy
 , matplotlib
@@ -24,7 +24,7 @@ buildPythonPackage rec {
   buildInputs = [ opencl-headers ];
   # Note: the 1.0.5 release should be compatible with pytest6, so this can
   # be set back to 'pytest' at that point
-  checkInputs = [ pytest_5 ];
+  checkInputs = [ pytest ];
   propagatedBuildInputs = [ docutils matplotlib numpy scipy pyopencl ];
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/scmrepo/default.nix b/pkgs/development/python-modules/scmrepo/default.nix
new file mode 100644
index 00000000000..f4a024a46e9
--- /dev/null
+++ b/pkgs/development/python-modules/scmrepo/default.nix
@@ -0,0 +1,53 @@
+{ lib
+, asyncssh
+, buildPythonPackage
+, dulwich
+, fetchFromGitHub
+, fsspec
+, funcy
+, GitPython
+, pathspec
+, pygit2
+, pygtrie
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "scmrepo";
+  version = "0.0.7";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "iterative";
+    repo = pname;
+    rev = version;
+    hash = "sha256-tZsogqcfAqpSo9yOz4z0mgY9SVU1epPmcBuyLJsHLfY=";
+  };
+
+  propagatedBuildInputs = [
+    asyncssh
+    dulwich
+    fsspec
+    funcy
+    GitPython
+    pathspec
+    pygit2
+    pygtrie
+  ];
+
+  # Requires a running Docker instance
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "scmrepo"
+  ];
+
+  meta = with lib; {
+    description = "SCM wrapper and fsspec filesystem";
+    homepage = "https://github.com/iterative/scmrepo";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/secretstorage/2.nix b/pkgs/development/python-modules/secretstorage/2.nix
deleted file mode 100644
index 378be5be313..00000000000
--- a/pkgs/development/python-modules/secretstorage/2.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{ lib, fetchPypi, buildPythonPackage, cryptography, dbus-python }:
-
-buildPythonPackage rec {
-  pname = "secretstorage";
-  version = "2.3.1";
-
-  src = fetchPypi {
-    pname = "SecretStorage";
-    inherit version;
-    sha256 = "1di9gx4m27brs6ar774m64s017iz742mnmw39kvfc8skfs3mrxis";
-  };
-
-  propagatedBuildInputs = [ cryptography dbus-python ];
-
-  # Needs a D-Bus Sesison
-  doCheck = false;
-
-  meta = with lib; {
-    homepage = "https://github.com/mitya57/secretstorage";
-    description = "Python bindings to FreeDesktop.org Secret Service API";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ orivej ];
-  };
-}
diff --git a/pkgs/development/python-modules/sense-energy/default.nix b/pkgs/development/python-modules/sense-energy/default.nix
index 8d73407c980..6b7061712ae 100644
--- a/pkgs/development/python-modules/sense-energy/default.nix
+++ b/pkgs/development/python-modules/sense-energy/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "sense-energy";
-  version = "0.9.3";
+  version = "0.9.4";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "scottbonline";
     repo = "sense";
     rev = version;
-    sha256 = "sha256-LUM7SP03U3mRxCTjgxPRXh/ZLz15R04zBWOxLKnan98=";
+    hash = "sha256-X+sGfcEodxWkBmDamJkrZVsjyKkuqzsZ5BJFwOgL63M=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sentinels/default.nix b/pkgs/development/python-modules/sentinels/default.nix
new file mode 100644
index 00000000000..17c2c94a30f
--- /dev/null
+++ b/pkgs/development/python-modules/sentinels/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchPypi
+, setuptools
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "sentinels";
+  version = "1.0.0";
+
+  disabled = pythonOlder "3.5";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1cglkxph47pki4db4kjx5g4ikxp2milqdlcjgqwmx4p1gx6p1q3v";
+  };
+
+  propagatedBuildInputs = [
+    setuptools
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "sentinels" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/vmalloc/sentinels/";
+    description = "Various objects to denote special meanings in python";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ gador ];
+  };
+}
diff --git a/pkgs/development/python-modules/sentry-sdk/default.nix b/pkgs/development/python-modules/sentry-sdk/default.nix
index 0d06fa96563..a59ec10be03 100644
--- a/pkgs/development/python-modules/sentry-sdk/default.nix
+++ b/pkgs/development/python-modules/sentry-sdk/default.nix
@@ -40,14 +40,14 @@
 
 buildPythonPackage rec {
   pname = "sentry-sdk";
-  version = "1.5.1";
+  version = "1.5.2";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-python";
     rev = version;
-    sha256 = "sha256-vQ5zeAscPMQH3L+Ogj50IZZp2pBoYaxHzvcXakaoC4k=";
+    sha256 = "086kzvrpy1c7kiwjrdyr4i4a8dp4vncsc8dk6hp8c7bwswfffa3d";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/shtab/default.nix b/pkgs/development/python-modules/shtab/default.nix
new file mode 100644
index 00000000000..efac8148a72
--- /dev/null
+++ b/pkgs/development/python-modules/shtab/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytest-timeout
+, pytestCheckHook
+, pythonOlder
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "shtab";
+  version = "1.5.3";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "iterative";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-Wuc4m3VdOGEcevYXUpbL4gTvyW9t13pj57zPYdqx0UY=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  checkInputs = [
+    pytest-timeout
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace " --cov=shtab --cov-report=term-missing --cov-report=xml" ""
+  '';
+
+  disabledTests = [
+    # bash tests are failing
+    "bash"
+  ];
+
+  pythonImportsCheck = [
+    "shtab"
+  ];
+
+  meta = with lib; {
+    description = "Module for shell tab completion of Python CLI applications";
+    homepage = "https://docs.iterative.ai/shtab/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/socketio-client/default.nix b/pkgs/development/python-modules/socketio-client/default.nix
new file mode 100644
index 00000000000..2842e375173
--- /dev/null
+++ b/pkgs/development/python-modules/socketio-client/default.nix
@@ -0,0 +1,39 @@
+{ lib
+, buildPythonPackage
+, requests
+, six
+, websocket-client
+, fetchFromGitHub
+}:
+
+buildPythonPackage rec {
+  pname = "socketio-client";
+  version = "0.7.2";
+
+  src = fetchFromGitHub {
+    owner = "invisibleroads";
+    repo = "socketio-client";
+    rev = version;
+    sha256 = "sha256-71sjiGJDDYElPGUNCH1HaVdvgMt8KeD/kXVDpF615ho=";
+  };
+
+  propagatedBuildInputs = [
+    six
+    websocket-client
+    requests
+  ];
+
+  # Perform networking tests.
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "socketIO_client"
+  ];
+
+  meta = with lib; {
+    description = "A socket.io client library for protocol 1.x";
+    homepage = "https://github.com/invisibleroads/socketIO-client";
+    license = licenses.mit;
+    maintainers = with maintainers; [ raitobezarius ];
+  };
+}
diff --git a/pkgs/development/python-modules/sopel/default.nix b/pkgs/development/python-modules/sopel/default.nix
index 743bd4d83c8..bc39bb998e8 100644
--- a/pkgs/development/python-modules/sopel/default.nix
+++ b/pkgs/development/python-modules/sopel/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage rec {
   pname = "sopel";
-  version = "7.1.6";
+  version = "7.1.7";
   disabled = isPyPy;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ebd3b2aa9230835f8a68ea7f5a10324ddf35d70d89a9c92c8cba81c558565efb";
+    sha256 = "4eb12e9753162e4c19a1bfdd42aea9eb7f5f15e316a6609b925350792fb454fd";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/spacy-loggers/default.nix b/pkgs/development/python-modules/spacy-loggers/default.nix
new file mode 100644
index 00000000000..7e4d572e181
--- /dev/null
+++ b/pkgs/development/python-modules/spacy-loggers/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, callPackage
+, fetchPypi
+, buildPythonPackage
+, wandb
+, wasabi
+}:
+
+buildPythonPackage rec {
+  pname = "spacy-loggers";
+  version = "1.0.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-F9DiSbLmxlRsSfxlYaCmhfkajtvySlsrd1nq1EPHRlQ=";
+  };
+
+  propagatedBuildInputs = [
+    wandb
+    wasabi
+  ];
+
+  pythonImportsCheck = [ "spacy_loggers" ];
+
+  # skipping the checks, becaus it requires a cycle dependency to spacy as well.
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Logging utilities for spaCy";
+    homepage = "https://github.com/explosion/spacy-loggers";
+    license = licenses.mit;
+    maintainers = with maintainers; [ stunkymonkey ];
+  };
+}
diff --git a/pkgs/development/python-modules/spacy/default.nix b/pkgs/development/python-modules/spacy/default.nix
index 0d095cfef07..05561e995a5 100644
--- a/pkgs/development/python-modules/spacy/default.nix
+++ b/pkgs/development/python-modules/spacy/default.nix
@@ -25,17 +25,19 @@
 , python
 , tqdm
 , typing-extensions
+, spacy-loggers
+, langcodes
 }:
 
 buildPythonPackage rec {
   pname = "spacy";
-  version = "3.2.0";
+  version = "3.2.1";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "68e54b2a14ce74eeecea9bfb0b9bdadf8a4a8157765dbefa7e50d25a1bf0f2f3";
+    sha256 = "sha256-9uusURYndAqMorEXuR71UVyPCy+xF6aevgHQEN1PxTw=";
   };
 
   propagatedBuildInputs = [
@@ -58,6 +60,8 @@ buildPythonPackage rec {
     tqdm
     typer
     wasabi
+    spacy-loggers
+    langcodes
   ] ++ lib.optional (pythonOlder "3.8") typing-extensions;
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/speaklater3/default.nix b/pkgs/development/python-modules/speaklater3/default.nix
new file mode 100644
index 00000000000..60c4c99fd3a
--- /dev/null
+++ b/pkgs/development/python-modules/speaklater3/default.nix
@@ -0,0 +1,23 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "speaklater3";
+  version = "1.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "ySYdS2taMEZyMS0esImb4Cj6yRdgGQqA/szTHTo7UEI=";
+  };
+
+  pythonImportsCheck = [ "speaklater" ];
+
+  meta = with lib; {
+    description = "Implements a lazy string for python useful for use with gettext";
+    homepage = "https://github.com/mitsuhiko/speaklater";
+    license = licenses.bsd0;
+    maintainers = with maintainers; [ gador ];
+  };
+}
diff --git a/pkgs/development/python-modules/surepy/default.nix b/pkgs/development/python-modules/surepy/default.nix
index 9759443228d..13c8107c9ae 100644
--- a/pkgs/development/python-modules/surepy/default.nix
+++ b/pkgs/development/python-modules/surepy/default.nix
@@ -33,7 +33,8 @@ buildPythonPackage rec {
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace 'aiohttp = {extras = ["speedups"], version = "^3.7.4"}' 'aiohttp = {extras = ["speedups"], version = ">=3.7.4"}' \
-      --replace 'async-timeout = "^3.0.1"' 'async-timeout = ">=3.0.1"'
+      --replace 'async-timeout = "^3.0.1"' 'async-timeout = ">=3.0.1"' \
+      --replace 'rich = "^10.1.0"' 'rich = ">=10.1.0"'
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/tempest/default.nix b/pkgs/development/python-modules/tempest/default.nix
index 5fa1ad4c539..39f7a82cd9e 100644
--- a/pkgs/development/python-modules/tempest/default.nix
+++ b/pkgs/development/python-modules/tempest/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonApplication
 , fetchPypi
+, fetchpatch
 , pbr
 , cliff
 , jsonschema
@@ -20,7 +21,6 @@
 , prettytable
 , urllib3
 , debtcollector
-, unittest2
 , hacking
 , oslotest
 , bash
@@ -36,6 +36,14 @@ buildPythonApplication rec {
     sha256 = "0521d3042360c0fb469b16f99174a9abddbae8a2d2a81268cfc664f1ccfdd0f9";
   };
 
+  patches = [
+    # remove need for unittest2
+    (fetchpatch {
+      url = "https://github.com/openstack/tempest/commit/cd3745c27b7d8fcdaffc72b965a3d803d9ee12c2.patch";
+      sha256 = "sha256-UwUmyFZokH66Xqfsj982MBHb0w7x6v4SAtXlqA5dpnk=";
+    })
+  ];
+
   propagatedBuildInputs = [
     pbr
     cliff
@@ -56,7 +64,6 @@ buildPythonApplication rec {
     prettytable
     urllib3
     debtcollector
-    unittest2
   ];
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/teslajsonpy/default.nix b/pkgs/development/python-modules/teslajsonpy/default.nix
index 19e42e917dd..d1e07df211d 100644
--- a/pkgs/development/python-modules/teslajsonpy/default.nix
+++ b/pkgs/development/python-modules/teslajsonpy/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "teslajsonpy";
-  version = "1.4.2";
+  version = "1.5.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "zabuldon";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-oablQoumBiqDk7bz1BUpUWddxExoqOofrZzX7y618Hw=";
+    sha256 = "sha256-5ZGj3ZS+KGtnlphyUF1xb9e2XuHa4qbOWWtyzZwP1RM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/transformers/default.nix b/pkgs/development/python-modules/transformers/default.nix
index 5479a0b1225..917aef54b6b 100644
--- a/pkgs/development/python-modules/transformers/default.nix
+++ b/pkgs/development/python-modules/transformers/default.nix
@@ -19,13 +19,13 @@
 
 buildPythonPackage rec {
   pname = "transformers";
-  version = "4.12.5";
+  version = "4.15.0";
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = pname;
     rev = "v${version}";
-    sha256 = "07v72fyhm1s3bzg2kvaff15d7d8na39nlqpf5gyxaqvp3hglc3qy";
+    sha256 = "05qwrs040sqxk5fi44rjx0s5ba4897iw8l7yk8f1xzv314df05fg";
   };
 
   nativeBuildInputs = [ packaging ];
diff --git a/pkgs/development/python-modules/treex/default.nix b/pkgs/development/python-modules/treex/default.nix
index bdea03896cb..4e8c1431cc1 100644
--- a/pkgs/development/python-modules/treex/default.nix
+++ b/pkgs/development/python-modules/treex/default.nix
@@ -27,9 +27,12 @@ buildPythonPackage rec {
     sha256 = "1hl3wj71c7cp7jzkhyjy7xgs2vc8c89icq0bgfr49y4pwv69n43m";
   };
 
-  patches = [
-    ./relax-deps.patch
-  ];
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'rich = "^10.7.0"' 'rich = ">=10.7.0"' \
+      --replace 'PyYAML = "^5.4.1"' 'PyYAML = ">=5.4.1"' \
+      --replace 'optax = "^0.0.9"' 'optax = ">=0.0.9"'
+  '';
 
   nativeBuildInputs = [
     poetry-core
diff --git a/pkgs/development/python-modules/treex/relax-deps.patch b/pkgs/development/python-modules/treex/relax-deps.patch
deleted file mode 100644
index 347098a4a6d..00000000000
--- a/pkgs/development/python-modules/treex/relax-deps.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/pyproject.toml b/pyproject.toml
-index f0ff8a0..56787ca 100644
---- a/pyproject.toml
-+++ b/pyproject.toml
-@@ -16,9 +16,9 @@ secondary = true
- [tool.poetry.dependencies]
- python = "^3.7"
- flax = "^0.3.4"
--PyYAML = "^5.4.1"
-+PyYAML = ">=5.4.1"
- rich = "^10.7.0"
--optax = "^0.0.9"
-+optax = ">=0.0.9"
- einops = "^0.3.2"
- treeo = "^0.0.9"
- # treeo = { path = "../treeo", develop = true }
diff --git a/pkgs/development/python-modules/twinkly-client/default.nix b/pkgs/development/python-modules/twinkly-client/default.nix
index fc856430da9..77eb17b9fcd 100644
--- a/pkgs/development/python-modules/twinkly-client/default.nix
+++ b/pkgs/development/python-modules/twinkly-client/default.nix
@@ -7,19 +7,26 @@
 
 buildPythonPackage rec {
   pname = "twinkly-client";
-  version = "0.0.2";
+  version = "0.0.3";
+  format = "setuptools";
+
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "16jbm4ya4yk2nfswza1kpgks70rmy5lpsv9dv3hdjdnr1j44hr3i";
+    sha256 = "sha256-F/N6yMOvLHIfXvPyR7z3P/Rlh79OvCbvEiNwClLSLl8=";
   };
 
-  propagatedBuildInputs = [ aiohttp ];
+  propagatedBuildInputs = [
+    aiohttp
+  ];
 
   # Project has no tests
   doCheck = false;
-  pythonImportsCheck = [ "twinkly_client" ];
+
+  pythonImportsCheck = [
+    "twinkly_client"
+  ];
 
   meta = with lib; {
     description = "Python module to communicate with Twinkly LED strings";
diff --git a/pkgs/development/python-modules/types-freezegun/default.nix b/pkgs/development/python-modules/types-freezegun/default.nix
new file mode 100644
index 00000000000..89672d26e8b
--- /dev/null
+++ b/pkgs/development/python-modules/types-freezegun/default.nix
@@ -0,0 +1,24 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "types-freezegun";
+  version = "1.1.6";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0kxiv0yjbbvp1zx694ir149b26kjzvb6600fh397v32b8jvs8w2w";
+  };
+
+  # Module doesn't have tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Typing stubs for freezegun";
+    homepage = "https://github.com/python/typeshed";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ jpetrucciani ];
+  };
+}
diff --git a/pkgs/development/python-modules/types-tabulate/default.nix b/pkgs/development/python-modules/types-tabulate/default.nix
new file mode 100644
index 00000000000..504ca4f8eb8
--- /dev/null
+++ b/pkgs/development/python-modules/types-tabulate/default.nix
@@ -0,0 +1,24 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "types-tabulate";
+  version = "0.8.5";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-A/KDvzhOoSG3tqWK+zj03vl/MHBPyhOg2mhpNrDzkqw=";
+  };
+
+  # Module doesn't have tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Typing stubs for tabulate";
+    homepage = "https://github.com/python/typeshed";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ jpetrucciani ];
+  };
+}
diff --git a/pkgs/development/python-modules/wtforms/default.nix b/pkgs/development/python-modules/wtforms/default.nix
index 96440c438bc..48764d509fe 100644
--- a/pkgs/development/python-modules/wtforms/default.nix
+++ b/pkgs/development/python-modules/wtforms/default.nix
@@ -2,21 +2,29 @@
 , buildPythonPackage
 , fetchPypi
 , markupsafe
+, Babel
+, pytestCheckHook
+, email_validator
 }:
 
 buildPythonPackage rec {
-  version = "2.3.3";
+  version = "3.0.1";
   pname = "WTForms";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "81195de0ac94fbc8368abbaf9197b88c4f3ffd6c2719b5bf5fc9da744f3d829c";
+    sha256 = "1g654ghavds387hqxmhg9s8x222x89wbq1ggzxbsyn6x2axindbb";
   };
 
-  propagatedBuildInputs = [ markupsafe ];
+  propagatedBuildInputs = [ markupsafe Babel ];
 
-  # Django tests are broken "django.core.exceptions.AppRegistryNotReady: Apps aren't loaded yet."
-  doCheck = false;
+
+  checkInputs = [
+    pytestCheckHook
+    email_validator
+  ];
+
+  pythonImportsCheck = [ "wtforms" ];
 
   meta = with lib; {
     description = "A flexible forms validation and rendering library for Python";
diff --git a/pkgs/development/python-modules/yalexs/default.nix b/pkgs/development/python-modules/yalexs/default.nix
index 057e2bdb31d..d83b031fe4c 100644
--- a/pkgs/development/python-modules/yalexs/default.nix
+++ b/pkgs/development/python-modules/yalexs/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "yalexs";
-  version = "1.1.17";
+  version = "1.1.19";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "bdraco";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-kCLL+0ZiraTW7swgdfS9vkLcr/s6lTccFQbC02rdNDY=";
+    sha256 = "sha256-i6UFsSY2DQ4jB316fy5cZ+2C93TTmvyB4Caxj3syPdo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/Pygments/2_5.nix b/pkgs/development/python2-modules/Pygments/default.nix
index aa59c370d2e..aa59c370d2e 100644
--- a/pkgs/development/python-modules/Pygments/2_5.nix
+++ b/pkgs/development/python2-modules/Pygments/default.nix
diff --git a/pkgs/development/python-modules/TurboCheetah/default.nix b/pkgs/development/python2-modules/TurboCheetah/default.nix
index 717b2b5f278..717b2b5f278 100644
--- a/pkgs/development/python-modules/TurboCheetah/default.nix
+++ b/pkgs/development/python2-modules/TurboCheetah/default.nix
diff --git a/pkgs/development/python-modules/bootstrapped-pip/2.nix b/pkgs/development/python2-modules/bootstrapped-pip/default.nix
index 2fc8b8b8d4b..2fc8b8b8d4b 100644
--- a/pkgs/development/python-modules/bootstrapped-pip/2.nix
+++ b/pkgs/development/python2-modules/bootstrapped-pip/default.nix
diff --git a/pkgs/development/python-modules/boto3/1_17.nix b/pkgs/development/python2-modules/boto3/default.nix
index c8b8210f650..c8b8210f650 100644
--- a/pkgs/development/python-modules/boto3/1_17.nix
+++ b/pkgs/development/python2-modules/boto3/default.nix
diff --git a/pkgs/development/python-modules/botocore/1_20.nix b/pkgs/development/python2-modules/botocore/default.nix
index d05c2decf49..d05c2decf49 100644
--- a/pkgs/development/python-modules/botocore/1_20.nix
+++ b/pkgs/development/python2-modules/botocore/default.nix
diff --git a/pkgs/development/python-modules/certifi/python2.nix b/pkgs/development/python2-modules/certifi/default.nix
index 529d5b1fb99..529d5b1fb99 100644
--- a/pkgs/development/python-modules/certifi/python2.nix
+++ b/pkgs/development/python2-modules/certifi/default.nix
diff --git a/pkgs/development/python-modules/chardet/2.nix b/pkgs/development/python2-modules/chardet/default.nix
index 5f6fe0a672a..5f6fe0a672a 100644
--- a/pkgs/development/python-modules/chardet/2.nix
+++ b/pkgs/development/python2-modules/chardet/default.nix
diff --git a/pkgs/development/python-modules/cheetah/default.nix b/pkgs/development/python2-modules/cheetah/default.nix
index 1cee46fa725..1cee46fa725 100644
--- a/pkgs/development/python-modules/cheetah/default.nix
+++ b/pkgs/development/python2-modules/cheetah/default.nix
diff --git a/pkgs/development/python-modules/click/7.nix b/pkgs/development/python2-modules/click/default.nix
index fcbd4d0981a..fcbd4d0981a 100644
--- a/pkgs/development/python-modules/click/7.nix
+++ b/pkgs/development/python2-modules/click/default.nix
diff --git a/pkgs/development/python-modules/configparser/4.nix b/pkgs/development/python2-modules/configparser/default.nix
index 0f3b6e0b491..0f3b6e0b491 100644
--- a/pkgs/development/python-modules/configparser/4.nix
+++ b/pkgs/development/python2-modules/configparser/default.nix
diff --git a/pkgs/development/python-modules/construct/2.10.54.nix b/pkgs/development/python2-modules/construct/default.nix
index 5bbbd150145..5bbbd150145 100644
--- a/pkgs/development/python-modules/construct/2.10.54.nix
+++ b/pkgs/development/python2-modules/construct/default.nix
diff --git a/pkgs/development/python-modules/contextlib2/0.nix b/pkgs/development/python2-modules/contextlib2/default.nix
index 38d9fb696e2..38d9fb696e2 100644
--- a/pkgs/development/python-modules/contextlib2/0.nix
+++ b/pkgs/development/python2-modules/contextlib2/default.nix
diff --git a/pkgs/development/python-modules/cryptography/vectors-3.3.nix b/pkgs/development/python2-modules/cryptography-vectors/default.nix
index f9b7c525237..f9b7c525237 100644
--- a/pkgs/development/python-modules/cryptography/vectors-3.3.nix
+++ b/pkgs/development/python2-modules/cryptography-vectors/default.nix
diff --git a/pkgs/development/python-modules/cryptography/3.3.nix b/pkgs/development/python2-modules/cryptography/default.nix
index 357bb35dacf..357bb35dacf 100644
--- a/pkgs/development/python-modules/cryptography/3.3.nix
+++ b/pkgs/development/python2-modules/cryptography/default.nix
diff --git a/pkgs/development/python-modules/decorator/4.nix b/pkgs/development/python2-modules/decorator/default.nix
index 8e8fd28f0b5..8e8fd28f0b5 100644
--- a/pkgs/development/python-modules/decorator/4.nix
+++ b/pkgs/development/python2-modules/decorator/default.nix
diff --git a/pkgs/development/python-modules/enum/default.nix b/pkgs/development/python2-modules/enum/default.nix
index db827601d5d..db827601d5d 100644
--- a/pkgs/development/python-modules/enum/default.nix
+++ b/pkgs/development/python2-modules/enum/default.nix
diff --git a/pkgs/development/python-modules/filelock/3.2.nix b/pkgs/development/python2-modules/filelock/default.nix
index 401fdf582ff..401fdf582ff 100644
--- a/pkgs/development/python-modules/filelock/3.2.nix
+++ b/pkgs/development/python2-modules/filelock/default.nix
diff --git a/pkgs/development/python-modules/flask/1.nix b/pkgs/development/python2-modules/flask/default.nix
index 27f436c3c53..27f436c3c53 100644
--- a/pkgs/development/python-modules/flask/1.nix
+++ b/pkgs/development/python2-modules/flask/default.nix
diff --git a/pkgs/development/python-modules/freezegun/0.3.nix b/pkgs/development/python2-modules/freezegun/default.nix
index 7f77616f2a4..7f77616f2a4 100644
--- a/pkgs/development/python-modules/freezegun/0.3.nix
+++ b/pkgs/development/python2-modules/freezegun/default.nix
diff --git a/pkgs/development/python-modules/futures/default.nix b/pkgs/development/python2-modules/futures/default.nix
index bc19a31927a..bc19a31927a 100644
--- a/pkgs/development/python-modules/futures/default.nix
+++ b/pkgs/development/python2-modules/futures/default.nix
diff --git a/pkgs/development/python-modules/google-apputils/default.nix b/pkgs/development/python2-modules/google-apputils/default.nix
index 225adf348d1..225adf348d1 100644
--- a/pkgs/development/python-modules/google-apputils/default.nix
+++ b/pkgs/development/python2-modules/google-apputils/default.nix
diff --git a/pkgs/development/python-modules/httpretty/0.nix b/pkgs/development/python2-modules/httpretty/default.nix
index 92ed5c6616e..92ed5c6616e 100644
--- a/pkgs/development/python-modules/httpretty/0.nix
+++ b/pkgs/development/python2-modules/httpretty/default.nix
diff --git a/pkgs/development/python-modules/hypothesis/2.nix b/pkgs/development/python2-modules/hypothesis/default.nix
index 47bc8860bc5..47bc8860bc5 100644
--- a/pkgs/development/python-modules/hypothesis/2.nix
+++ b/pkgs/development/python2-modules/hypothesis/default.nix
diff --git a/pkgs/development/python-modules/idna/2.nix b/pkgs/development/python2-modules/idna/default.nix
index 9a1c1dc271f..9a1c1dc271f 100644
--- a/pkgs/development/python-modules/idna/2.nix
+++ b/pkgs/development/python2-modules/idna/default.nix
diff --git a/pkgs/development/python-modules/importlib-metadata/2.nix b/pkgs/development/python2-modules/importlib-metadata/default.nix
index f50b2c07c1d..f50b2c07c1d 100644
--- a/pkgs/development/python-modules/importlib-metadata/2.nix
+++ b/pkgs/development/python2-modules/importlib-metadata/default.nix
diff --git a/pkgs/development/python-modules/ipaddr/default.nix b/pkgs/development/python2-modules/ipaddr/default.nix
index b29ee917928..b29ee917928 100644
--- a/pkgs/development/python-modules/ipaddr/default.nix
+++ b/pkgs/development/python2-modules/ipaddr/default.nix
diff --git a/pkgs/development/python-modules/itsdangerous/1.nix b/pkgs/development/python2-modules/itsdangerous/default.nix
index d1669a1ed5b..d1669a1ed5b 100644
--- a/pkgs/development/python-modules/itsdangerous/1.nix
+++ b/pkgs/development/python2-modules/itsdangerous/default.nix
diff --git a/pkgs/development/python-modules/jinja2/2.nix b/pkgs/development/python2-modules/jinja2/default.nix
index 02127a50df7..02127a50df7 100644
--- a/pkgs/development/python-modules/jinja2/2.nix
+++ b/pkgs/development/python2-modules/jinja2/default.nix
diff --git a/pkgs/development/python-modules/libcloud/2.nix b/pkgs/development/python2-modules/libcloud/default.nix
index 504e7753a97..504e7753a97 100644
--- a/pkgs/development/python-modules/libcloud/2.nix
+++ b/pkgs/development/python2-modules/libcloud/default.nix
diff --git a/pkgs/development/python-modules/lpod/default.nix b/pkgs/development/python2-modules/lpod/default.nix
index 9c719d234f8..9c719d234f8 100644
--- a/pkgs/development/python-modules/lpod/default.nix
+++ b/pkgs/development/python2-modules/lpod/default.nix
diff --git a/pkgs/development/python-modules/marisa/default.nix b/pkgs/development/python2-modules/marisa/default.nix
index 93a4ccb959f..93a4ccb959f 100644
--- a/pkgs/development/python-modules/marisa/default.nix
+++ b/pkgs/development/python2-modules/marisa/default.nix
diff --git a/pkgs/development/python-modules/markdown/3_1.nix b/pkgs/development/python2-modules/markdown/default.nix
index 13ed2f1744a..13ed2f1744a 100644
--- a/pkgs/development/python-modules/markdown/3_1.nix
+++ b/pkgs/development/python2-modules/markdown/default.nix
diff --git a/pkgs/development/python-modules/markupsafe/1.nix b/pkgs/development/python2-modules/markupsafe/default.nix
index ae0878c7a97..ae0878c7a97 100644
--- a/pkgs/development/python-modules/markupsafe/1.nix
+++ b/pkgs/development/python2-modules/markupsafe/default.nix
diff --git a/pkgs/development/python-modules/mock/2.nix b/pkgs/development/python2-modules/mock/default.nix
index 190297b41a2..190297b41a2 100644
--- a/pkgs/development/python-modules/mock/2.nix
+++ b/pkgs/development/python2-modules/mock/default.nix
diff --git a/pkgs/development/python-modules/more-itertools/2.7.nix b/pkgs/development/python2-modules/more-itertools/default.nix
index f9a6ac732e2..f9a6ac732e2 100644
--- a/pkgs/development/python-modules/more-itertools/2.7.nix
+++ b/pkgs/development/python2-modules/more-itertools/default.nix
diff --git a/pkgs/development/python-modules/mutagen/1.43.nix b/pkgs/development/python2-modules/mutagen/default.nix
index 7f2e9f452b4..7f2e9f452b4 100644
--- a/pkgs/development/python-modules/mutagen/1.43.nix
+++ b/pkgs/development/python2-modules/mutagen/default.nix
diff --git a/pkgs/development/python-modules/numpy/1.16.nix b/pkgs/development/python2-modules/numpy/default.nix
index 1ab958a15f0..b1d71bd66f3 100644
--- a/pkgs/development/python-modules/numpy/1.16.nix
+++ b/pkgs/development/python2-modules/numpy/default.nix
@@ -54,7 +54,7 @@ in buildPythonPackage rec {
     # We patch cpython/distutils to fix https://bugs.python.org/issue1222585
     # Patching of numpy.distutils is needed to prevent it from undoing the
     # patch to distutils.
-    ./numpy-distutils-C++_1.16.patch
+    ./numpy-distutils-C++.patch
   ];
 
   preConfigure = ''
diff --git a/pkgs/development/python-modules/numpy/numpy-distutils-C++_1.16.patch b/pkgs/development/python2-modules/numpy/numpy-distutils-C++.patch
index b2626ea26e5..b2626ea26e5 100644
--- a/pkgs/development/python-modules/numpy/numpy-distutils-C++_1.16.patch
+++ b/pkgs/development/python2-modules/numpy/numpy-distutils-C++.patch
diff --git a/pkgs/development/python-modules/packaging/2.nix b/pkgs/development/python2-modules/packaging/default.nix
index 0f9e61859a1..0f9e61859a1 100644
--- a/pkgs/development/python-modules/packaging/2.nix
+++ b/pkgs/development/python2-modules/packaging/default.nix
diff --git a/pkgs/development/python-modules/pillow/6.nix b/pkgs/development/python2-modules/pillow/default.nix
index 61242c894a8..61242c894a8 100644
--- a/pkgs/development/python-modules/pillow/6.nix
+++ b/pkgs/development/python2-modules/pillow/default.nix
diff --git a/pkgs/development/python2-modules/pillow/generic.nix b/pkgs/development/python2-modules/pillow/generic.nix
new file mode 100644
index 00000000000..3e33f1a8aa0
--- /dev/null
+++ b/pkgs/development/python2-modules/pillow/generic.nix
@@ -0,0 +1,77 @@
+{ pname
+, version
+, disabled
+, src
+, meta
+, ...
+}@args:
+
+with args;
+
+buildPythonPackage rec {
+  inherit pname version src meta;
+
+  # Disable imagefont tests, because they don't work well with infinality:
+  # https://github.com/python-pillow/Pillow/issues/1259
+  postPatch = ''
+    rm Tests/test_imagefont.py
+  '';
+
+  # Disable darwin tests which require executables: `iconutil` and `screencapture`
+  disabledTests = lib.optionals stdenv.isDarwin [
+    "test_grab"
+    "test_grabclipboard"
+    "test_save"
+
+    # pillow-simd
+    "test_roundtrip"
+    "test_basic"
+  ] ++ lib.optionals (lib.versions.major version == "6") [
+    # RuntimeError: Error setting from dictionary
+    "test_custom_metadata"
+  ];
+
+  propagatedBuildInputs = [ olefile ]
+    ++ lib.optionals (lib.versionAtLeast version "8.2.0") [ defusedxml ];
+
+  checkInputs = [ pytestCheckHook pyroma numpy ];
+
+  buildInputs = [ freetype libjpeg openjpeg libimagequant zlib libtiff libwebp tcl lcms2 ]
+    ++ lib.optionals (lib.versionAtLeast version "7.1.0") [ libxcb ]
+    ++ lib.optionals (isPyPy) [ tk libX11 ];
+
+  # NOTE: we use LCMS_ROOT as WEBP root since there is not other setting for webp.
+  # NOTE: The Pillow install script will, by default, add paths like /usr/lib
+  # and /usr/include to the search paths. This can break things when building
+  # on a non-NixOS system that has some libraries installed that are not
+  # installed in Nix (for example, Arch Linux has jpeg2000 but Nix doesn't
+  # build Pillow with this support). We patch the `disable_platform_guessing`
+  # setting here, instead of passing the `--disable-platform-guessing`
+  # command-line option, since the command-line option doesn't work when we run
+  # tests.
+  preConfigure = let
+    libinclude' = pkg: ''"${pkg.out}/lib", "${pkg.out}/include"'';
+    libinclude = pkg: ''"${pkg.out}/lib", "${pkg.dev}/include"'';
+  in ''
+    sed -i "setup.py" \
+        -e 's|^FREETYPE_ROOT =.*$|FREETYPE_ROOT = ${libinclude freetype}|g ;
+            s|^JPEG_ROOT =.*$|JPEG_ROOT = ${libinclude libjpeg}|g ;
+            s|^JPEG2K_ROOT =.*$|JPEG2K_ROOT = ${libinclude openjpeg}|g ;
+            s|^IMAGEQUANT_ROOT =.*$|IMAGEQUANT_ROOT = ${libinclude' libimagequant}|g ;
+            s|^ZLIB_ROOT =.*$|ZLIB_ROOT = ${libinclude zlib}|g ;
+            s|^LCMS_ROOT =.*$|LCMS_ROOT = ${libinclude lcms2}|g ;
+            s|^TIFF_ROOT =.*$|TIFF_ROOT = ${libinclude libtiff}|g ;
+            s|^TCL_ROOT=.*$|TCL_ROOT = ${libinclude' tcl}|g ;
+            s|self\.disable_platform_guessing = None|self.disable_platform_guessing = True|g ;'
+    export LDFLAGS="$LDFLAGS -L${libwebp}/lib"
+    export CFLAGS="$CFLAGS -I${libwebp}/include"
+  '' + lib.optionalString (lib.versionAtLeast version "7.1.0") ''
+    export LDFLAGS="$LDFLAGS -L${libxcb}/lib"
+    export CFLAGS="$CFLAGS -I${libxcb.dev}/include"
+  '' + lib.optionalString stdenv.isDarwin ''
+    # Remove impurities
+    substituteInPlace setup.py \
+      --replace '"/Library/Frameworks",' "" \
+      --replace '"/System/Library/Frameworks"' ""
+  '';
+}
diff --git a/pkgs/development/python-modules/pip/20.nix b/pkgs/development/python2-modules/pip/default.nix
index e3666d6a796..e3666d6a796 100644
--- a/pkgs/development/python-modules/pip/20.nix
+++ b/pkgs/development/python2-modules/pip/default.nix
diff --git a/pkgs/development/python-modules/pluggy/0.nix b/pkgs/development/python2-modules/pluggy/default.nix
index 30fa2e1945b..30fa2e1945b 100644
--- a/pkgs/development/python-modules/pluggy/0.nix
+++ b/pkgs/development/python2-modules/pluggy/default.nix
diff --git a/pkgs/development/python-modules/prettytable/1.nix b/pkgs/development/python2-modules/prettytable/default.nix
index 8191e9b5f57..8191e9b5f57 100644
--- a/pkgs/development/python-modules/prettytable/1.nix
+++ b/pkgs/development/python2-modules/prettytable/default.nix
diff --git a/pkgs/development/python2-modules/protobuf/default.nix b/pkgs/development/python2-modules/protobuf/default.nix
new file mode 100644
index 00000000000..30e9fbf9ea7
--- /dev/null
+++ b/pkgs/development/python2-modules/protobuf/default.nix
@@ -0,0 +1,59 @@
+{ buildPackages
+, lib
+, fetchpatch
+, python
+, buildPythonPackage
+, isPy37
+, protobuf
+, google-apputils ? null
+, six
+, pyext
+, isPy27
+, disabled
+, doCheck ? true
+}:
+
+buildPythonPackage {
+  inherit (protobuf) pname src version;
+  inherit disabled;
+  doCheck = doCheck && !isPy27; # setuptools>=41.4 no longer collects correctly on python2
+
+  propagatedBuildInputs = [ six ] ++ lib.optionals isPy27 [ google-apputils ];
+  propagatedNativeBuildInputs = [ buildPackages.protobuf ]; # For protoc.
+  nativeBuildInputs = [ pyext ] ++ lib.optionals isPy27 [ google-apputils ];
+  buildInputs = [ protobuf ];
+
+  patches = lib.optional (isPy37 && (lib.versionOlder protobuf.version "3.6.1.2"))
+    # Python 3.7 compatibility (not needed for protobuf >= 3.6.1.2)
+    (fetchpatch {
+      url = "https://github.com/protocolbuffers/protobuf/commit/0a59054c30e4f0ba10f10acfc1d7f3814c63e1a7.patch";
+      sha256 = "09hw22y3423v8bbmc9xm07znwdxfbya6rp78d4zqw6fisdvjkqf1";
+      stripLen = 1;
+    })
+  ;
+
+  prePatch = ''
+    while [ ! -d python ]; do
+      cd *
+    done
+    cd python
+  '';
+
+  setupPyGlobalFlags = lib.optional (lib.versionAtLeast protobuf.version "2.6.0")
+    "--cpp_implementation";
+
+  pythonImportsCheck = [
+    "google.protobuf"
+  ] ++ lib.optionals (lib.versionAtLeast protobuf.version "2.6.0") [
+    "google.protobuf.internal._api_implementation" # Verify that --cpp_implementation worked
+  ];
+
+  meta = with lib; {
+    description = "Protocol Buffers are Google's data interchange format";
+    homepage = "https://developers.google.com/protocol-buffers/";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ knedlsepp ];
+  };
+
+  passthru.protobuf = protobuf;
+}
diff --git a/pkgs/development/python-modules/pycairo/1.18.nix b/pkgs/development/python2-modules/pycairo/default.nix
index 9da4da1479c..9da4da1479c 100644
--- a/pkgs/development/python-modules/pycairo/1.18.nix
+++ b/pkgs/development/python2-modules/pycairo/default.nix
diff --git a/pkgs/development/python-modules/pygobject/3.36.nix b/pkgs/development/python2-modules/pygobject/default.nix
index ce9410eaf8b..ce9410eaf8b 100644
--- a/pkgs/development/python-modules/pygobject/3.36.nix
+++ b/pkgs/development/python2-modules/pygobject/default.nix
diff --git a/pkgs/development/python-modules/pygtk/default.nix b/pkgs/development/python2-modules/pygtk/default.nix
index 938b55630c0..938b55630c0 100644
--- a/pkgs/development/python-modules/pygtk/default.nix
+++ b/pkgs/development/python2-modules/pygtk/default.nix
diff --git a/pkgs/development/python-modules/pyjwt/1.nix b/pkgs/development/python2-modules/pyjwt/default.nix
index 9978302d1cc..9978302d1cc 100644
--- a/pkgs/development/python-modules/pyjwt/1.nix
+++ b/pkgs/development/python2-modules/pyjwt/default.nix
diff --git a/pkgs/development/python-modules/pyroma/2.nix b/pkgs/development/python2-modules/pyroma/default.nix
index 9fee5ec56c0..9fee5ec56c0 100644
--- a/pkgs/development/python-modules/pyroma/2.nix
+++ b/pkgs/development/python2-modules/pyroma/default.nix
diff --git a/pkgs/development/python-modules/pysqlite/default.nix b/pkgs/development/python2-modules/pysqlite/default.nix
index 09cc312223a..09cc312223a 100644
--- a/pkgs/development/python-modules/pysqlite/default.nix
+++ b/pkgs/development/python2-modules/pysqlite/default.nix
diff --git a/pkgs/development/python-modules/pytest-runner/2.nix b/pkgs/development/python2-modules/pytest-runner/default.nix
index bea83146c37..bea83146c37 100644
--- a/pkgs/development/python-modules/pytest-runner/2.nix
+++ b/pkgs/development/python2-modules/pytest-runner/default.nix
diff --git a/pkgs/development/python-modules/pytest-xdist/1.nix b/pkgs/development/python2-modules/pytest-xdist/default.nix
index 466d86f50f7..466d86f50f7 100644
--- a/pkgs/development/python-modules/pytest-xdist/1.nix
+++ b/pkgs/development/python2-modules/pytest-xdist/default.nix
diff --git a/pkgs/development/python-modules/pytest/4.nix b/pkgs/development/python2-modules/pytest/default.nix
index 0a0ae571ba0..0a0ae571ba0 100644
--- a/pkgs/development/python-modules/pytest/4.nix
+++ b/pkgs/development/python2-modules/pytest/default.nix
diff --git a/pkgs/development/python-modules/pyyaml/5.nix b/pkgs/development/python2-modules/pyyaml/default.nix
index 3edfae90e66..3edfae90e66 100644
--- a/pkgs/development/python-modules/pyyaml/5.nix
+++ b/pkgs/development/python2-modules/pyyaml/default.nix
diff --git a/pkgs/development/python-modules/qpid-python/default.nix b/pkgs/development/python2-modules/qpid-python/default.nix
index e22b3215e81..e22b3215e81 100644
--- a/pkgs/development/python-modules/qpid-python/default.nix
+++ b/pkgs/development/python2-modules/qpid-python/default.nix
diff --git a/pkgs/development/python-modules/s3transfer/0_4.nix b/pkgs/development/python2-modules/s3transfer/default.nix
index 8cfd324f00a..8cfd324f00a 100644
--- a/pkgs/development/python-modules/s3transfer/0_4.nix
+++ b/pkgs/development/python2-modules/s3transfer/default.nix
diff --git a/pkgs/development/python-modules/scandir/default.nix b/pkgs/development/python2-modules/scandir/default.nix
index f92b1f5a6ed..f92b1f5a6ed 100644
--- a/pkgs/development/python-modules/scandir/default.nix
+++ b/pkgs/development/python2-modules/scandir/default.nix
diff --git a/pkgs/development/python-modules/setuptools-scm/2.nix b/pkgs/development/python2-modules/setuptools-scm/default.nix
index 4cf6f16fedf..4cf6f16fedf 100644
--- a/pkgs/development/python-modules/setuptools-scm/2.nix
+++ b/pkgs/development/python2-modules/setuptools-scm/default.nix
diff --git a/pkgs/development/python-modules/setuptools/44.0.nix b/pkgs/development/python2-modules/setuptools/default.nix
index ca70a106151..ca70a106151 100644
--- a/pkgs/development/python-modules/setuptools/44.0.nix
+++ b/pkgs/development/python2-modules/setuptools/default.nix
diff --git a/pkgs/development/python2-modules/setuptools/tag-date.patch b/pkgs/development/python2-modules/setuptools/tag-date.patch
new file mode 100644
index 00000000000..441177a5d17
--- /dev/null
+++ b/pkgs/development/python2-modules/setuptools/tag-date.patch
@@ -0,0 +1,12 @@
+diff --git a/setup.cfg b/setup.cfg
+index f23714b6..8aaeb330 100644
+--- a/setup.cfg
++++ b/setup.cfg
+@@ -1,6 +1,6 @@
+ [egg_info]
+ tag_build = .post
+-tag_date = 1
++tag_date = 0
+
+ [aliases]
+ clean_egg_info = egg_info -Db ''
diff --git a/pkgs/development/python-modules/sphinx/2.nix b/pkgs/development/python2-modules/sphinx/default.nix
index 0424b9b4c39..0424b9b4c39 100644
--- a/pkgs/development/python-modules/sphinx/2.nix
+++ b/pkgs/development/python2-modules/sphinx/default.nix
diff --git a/pkgs/development/python-modules/sphinx/python2-lexer.patch b/pkgs/development/python2-modules/sphinx/python2-lexer.patch
index cf4a243315a..cf4a243315a 100644
--- a/pkgs/development/python-modules/sphinx/python2-lexer.patch
+++ b/pkgs/development/python2-modules/sphinx/python2-lexer.patch
diff --git a/pkgs/development/python-modules/sphinxcontrib-websupport/1_1.nix b/pkgs/development/python2-modules/sphinxcontrib-websupport/default.nix
index b1bdf6a0dff..b1bdf6a0dff 100644
--- a/pkgs/development/python-modules/sphinxcontrib-websupport/1_1.nix
+++ b/pkgs/development/python2-modules/sphinxcontrib-websupport/default.nix
diff --git a/pkgs/development/python-modules/typing/default.nix b/pkgs/development/python2-modules/typing/default.nix
index b3dcea20323..b3dcea20323 100644
--- a/pkgs/development/python-modules/typing/default.nix
+++ b/pkgs/development/python2-modules/typing/default.nix
diff --git a/pkgs/development/python-modules/urllib3/2.nix b/pkgs/development/python2-modules/urllib3/default.nix
index a52e68eac5e..a52e68eac5e 100644
--- a/pkgs/development/python-modules/urllib3/2.nix
+++ b/pkgs/development/python2-modules/urllib3/default.nix
diff --git a/pkgs/development/python-modules/vcrpy/3.nix b/pkgs/development/python2-modules/vcrpy/default.nix
index ddd4015aad1..ddd4015aad1 100644
--- a/pkgs/development/python-modules/vcrpy/3.nix
+++ b/pkgs/development/python2-modules/vcrpy/default.nix
diff --git a/pkgs/development/python-modules/werkzeug/1.nix b/pkgs/development/python2-modules/werkzeug/default.nix
index c03cc6935d2..c03cc6935d2 100644
--- a/pkgs/development/python-modules/werkzeug/1.nix
+++ b/pkgs/development/python2-modules/werkzeug/default.nix
diff --git a/pkgs/development/python-modules/wsproto/0.14.nix b/pkgs/development/python2-modules/wsproto/default.nix
index a8488d8c4ab..a8488d8c4ab 100644
--- a/pkgs/development/python-modules/wsproto/0.14.nix
+++ b/pkgs/development/python2-modules/wsproto/default.nix
diff --git a/pkgs/development/python-modules/wxPython/3.0.nix b/pkgs/development/python2-modules/wxPython/default.nix
index 6649c5f6931..6649c5f6931 100644
--- a/pkgs/development/python-modules/wxPython/3.0.nix
+++ b/pkgs/development/python2-modules/wxPython/default.nix
diff --git a/pkgs/development/python-modules/zipp/1.nix b/pkgs/development/python2-modules/zipp/default.nix
index 82f100aaa0d..82f100aaa0d 100644
--- a/pkgs/development/python-modules/zipp/1.nix
+++ b/pkgs/development/python2-modules/zipp/default.nix
diff --git a/pkgs/development/r-modules/wrapper-rstudio.nix b/pkgs/development/r-modules/wrapper-rstudio.nix
index 5eeac8fed30..b20b61d6c58 100644
--- a/pkgs/development/r-modules/wrapper-rstudio.nix
+++ b/pkgs/development/r-modules/wrapper-rstudio.nix
@@ -1,16 +1,23 @@
-{ lib, runCommand, R, rstudio, wrapQtAppsHook, recommendedPackages, packages, qtbase }:
+{ lib
+, runCommand
+, R
+, rstudio
+, makeWrapper
+, wrapQtAppsHook
+, recommendedPackages
+, packages
+, fontconfig
+}:
 
-let
-  qtVersion = with lib.versions; "${major qtbase.version}.${minor qtbase.version}";
-in
-runCommand (rstudio.name + "-wrapper") {
+runCommand (rstudio.name + "-wrapper")
+{
   preferLocalBuild = true;
   allowSubstitutes = false;
 
-  nativeBuildInputs = [wrapQtAppsHook];
+  nativeBuildInputs = [ (if rstudio.server then makeWrapper else wrapQtAppsHook) ];
   dontWrapQtApps = true;
 
-  buildInputs = [R rstudio] ++ recommendedPackages ++ packages;
+  buildInputs = [ R rstudio ] ++ recommendedPackages ++ packages;
 
   # rWrapper points R to a specific set of packages by using a wrapper
   # (as in https://nixos.org/nixpkgs/manual/#r-packages) which sets
@@ -22,14 +29,27 @@ runCommand (rstudio.name + "-wrapper") {
   # uses R_PROFILE_USER to load this code at startup in RStudio.
   fixLibsR = "fix_libs.R";
 }
-''
-mkdir $out
-ln -s ${rstudio}/share $out
-echo "# Autogenerated by wrapper-rstudio.nix from R_LIBS_SITE" > $out/$fixLibsR
-echo -n ".libPaths(c(.libPaths(), \"" >> $out/$fixLibsR
-echo -n $R_LIBS_SITE | sed -e 's/:/", "/g' >> $out/$fixLibsR
-echo -n "\"))" >> $out/$fixLibsR
-echo >> $out/$fixLibsR
-makeQtWrapper ${rstudio}/bin/rstudio $out/bin/rstudio \
-  --set R_PROFILE_USER $out/$fixLibsR
-''
+  (
+    ''
+      mkdir -p $out/bin
+      ln -s ${rstudio}/share $out
+      echo "# Autogenerated by wrapper-rstudio.nix from R_LIBS_SITE" > $out/$fixLibsR
+      echo -n ".libPaths(c(.libPaths(), \"" >> $out/$fixLibsR
+      echo -n $R_LIBS_SITE | sed -e 's/:/", "/g' >> $out/$fixLibsR
+      echo -n "\"))" >> $out/$fixLibsR
+      echo >> $out/$fixLibsR
+    '' +
+    (if
+      rstudio.server then ''
+      makeWrapper ${rstudio}/bin/rsession $out/bin/rsession \
+        --set R_PROFILE_USER $out/$fixLibsR --set FONTCONFIG_FILE ${fontconfig.out}/etc/fonts/fonts.conf
+
+      makeWrapper ${rstudio}/bin/rserver $out/bin/rserver \
+        --add-flags --rsession-path=$out/bin/rsession
+    ''
+    else
+      ''
+        makeQtWrapper ${rstudio}/bin/rstudio $out/bin/rstudio \
+          --set R_PROFILE_USER $out/$fixLibsR
+      '')
+  )
diff --git a/pkgs/development/tools/ammonite/default.nix b/pkgs/development/tools/ammonite/default.nix
index 13b0e8d2570..784a8723336 100644
--- a/pkgs/development/tools/ammonite/default.nix
+++ b/pkgs/development/tools/ammonite/default.nix
@@ -9,7 +9,7 @@ let
   common = { scalaVersion, sha256 }:
     stdenv.mkDerivation rec {
       pname = "ammonite";
-      version = "2.5.0";
+      version = "2.5.1";
 
       src = fetchurl {
         url =
@@ -83,10 +83,10 @@ let
 in {
   ammonite_2_12 = common {
     scalaVersion = "2.12";
-    sha256 = "sha256-JTW1xb+eCb0yhzrA1ntmalP88JoUo+KrjOBvs+cuE/A=";
+    sha256 = "sha256-XV+SPZD7IirLJDqwn/eV8/Wf8m3dSSW0DF3IcBPcixA=";
   };
   ammonite_2_13 = common {
     scalaVersion = "2.13";
-    sha256 = "sha256-l5kGPP8tuYi16t6u8ZeAY54yqAWJZR5UuopSGQ69v9Y=";
+    sha256 = "sha256-rq8SLtj0rb35vcvPsCzhDGR93EjHoU6KAhEjs2WIA6o=";
   };
 }
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 3ddde0c282f..1a4b2967187 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -22,13 +22,13 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.0.712";
+  version = "2.0.727";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    hash = "sha256-iUplSd4/OcJtfby2bn7b6GwCbXnBMqUSuLjkkh+7W9Y=";
+    hash = "sha256-hegbkmM8ZN6zO2iANGRr2QRW3ErdtwYaTo618uELev0=";
   };
 
   nativeBuildInputs = with py.pkgs; [
@@ -81,6 +81,7 @@ buildPythonApplication rec {
 
   postPatch = ''
     substituteInPlace setup.py \
+      --replace "cyclonedx-python-lib>=0.11.0,<1.0.0" "cyclonedx-python-lib>=0.11.0" \
       --replace "jsonschema==3.0.2" "jsonschema>=3.0.2"
   '';
 
diff --git a/pkgs/development/tools/analysis/oclgrind/default.nix b/pkgs/development/tools/analysis/oclgrind/default.nix
index 72154e909b6..edad1f0dd9e 100644
--- a/pkgs/development/tools/analysis/oclgrind/default.nix
+++ b/pkgs/development/tools/analysis/oclgrind/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, llvmPackages, readline, python }:
+{ lib, stdenv, fetchFromGitHub, cmake, llvmPackages, readline, python2 }:
 
 stdenv.mkDerivation rec {
   pname = "oclgrind";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ llvmPackages.llvm llvmPackages.clang-unwrapped readline python ];
+  buildInputs = [ llvmPackages.llvm llvmPackages.clang-unwrapped readline python2 ];
 
   cmakeFlags = [
     "-DCLANG_ROOT=${llvmPackages.clang-unwrapped}"
diff --git a/pkgs/development/tools/analysis/qcachegrind/default.nix b/pkgs/development/tools/analysis/qcachegrind/default.nix
index 1f7c6641b1c..6b238fb9266 100644
--- a/pkgs/development/tools/analysis/qcachegrind/default.nix
+++ b/pkgs/development/tools/analysis/qcachegrind/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, qmake, qtbase, perl, python, php, kcachegrind, wrapQtAppsHook }:
+{ lib, stdenv, qmake, qtbase, perl, python2, php, kcachegrind, wrapQtAppsHook }:
 
 let
   name = lib.replaceStrings ["kcachegrind"] ["qcachegrind"] kcachegrind.name;
@@ -8,7 +8,7 @@ in stdenv.mkDerivation {
 
   src = kcachegrind.src;
 
-  buildInputs = [ qtbase perl python php ];
+  buildInputs = [ qtbase perl python2 php ];
 
   nativeBuildInputs = [ qmake wrapQtAppsHook ];
 
diff --git a/pkgs/development/tools/analysis/rizin/cutter.nix b/pkgs/development/tools/analysis/rizin/cutter.nix
index 698f9e8231d..a6ac4fbce12 100644
--- a/pkgs/development/tools/analysis/rizin/cutter.nix
+++ b/pkgs/development/tools/analysis/rizin/cutter.nix
@@ -11,13 +11,13 @@
 
 mkDerivation rec {
   pname = "cutter";
-  version = "2.0.4";
+  version = "2.0.5";
 
   src = fetchFromGitHub {
     owner = "rizinorg";
     repo = "cutter";
     rev = "v${version}";
-    sha256 = "sha256-Z5mqLkeA7AZnvKdpdRzaYfNMsGUI7i7wPTXVyIRYwxI=";
+    sha256 = "sha256-ljws9S7ZxZK/Ou8jgGSoR++vtzFTEBywHMhCC/UOLEs=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/tools/analysis/rizin/default.nix b/pkgs/development/tools/analysis/rizin/default.nix
index c316ef970f8..c4cdf85a7d8 100644
--- a/pkgs/development/tools/analysis/rizin/default.nix
+++ b/pkgs/development/tools/analysis/rizin/default.nix
@@ -23,11 +23,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rizin";
-  version = "0.3.2";
+  version = "0.3.4";
 
   src = fetchurl {
     url = "https://github.com/rizinorg/rizin/releases/download/v${version}/rizin-src-v${version}.tar.xz";
-    sha256 = "sha256-T65gm1tfRD7dZSL8qZKMTAbQ65Lx/ecidFc9T1b7cig=";
+    sha256 = "sha256-7qSbOWOHwJ0ZcFqrAqYXzbFWgvymfxAf8rJ+75SnEOk=";
   };
 
   mesonFlags = [
diff --git a/pkgs/development/tools/build-managers/mill/default.nix b/pkgs/development/tools/build-managers/mill/default.nix
index b012522c83e..49d454d8686 100644
--- a/pkgs/development/tools/build-managers/mill/default.nix
+++ b/pkgs/development/tools/build-managers/mill/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mill";
-  version = "0.9.12";
+  version = "0.10.0";
 
   src = fetchurl {
     url = "https://github.com/com-lihaoyi/mill/releases/download/${version}/${version}-assembly";
-    sha256 = "sha256-ct4SsIs6ErWl2XbxfqX3FTOU9K9tTKo8YWu1QT83iTI=";
+    sha256 = "sha256:1acm1z24cw2yzykwwjfrcf66mi16xvsrnrrhrsd9yqrajqab707n";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/continuous-integration/jenkins/default.nix b/pkgs/development/tools/continuous-integration/jenkins/default.nix
index 65132b72391..5823b5dac05 100644
--- a/pkgs/development/tools/continuous-integration/jenkins/default.nix
+++ b/pkgs/development/tools/continuous-integration/jenkins/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "jenkins";
-  version = "2.319.1";
+  version = "2.319.2";
 
   src = fetchurl {
     url = "http://mirrors.jenkins.io/war-stable/${version}/jenkins.war";
-    sha256 = "0qm562v7jwc9mjpbn1f808kg97axy1mraq3s5h679niffn588jvy";
+    sha256 = "0lx5fng98l9qci5jqwav8dmcnp7k7glfg0ccwqi0xqk90jqqs302";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/cue/default.nix b/pkgs/development/tools/cue/default.nix
index f177ced3092..9119dbce158 100644
--- a/pkgs/development/tools/cue/default.nix
+++ b/pkgs/development/tools/cue/default.nix
@@ -1,18 +1,19 @@
-{ buildGoModule, fetchgit, lib }:
+{ buildGoModule, fetchFromGitHub, lib }:
 
 buildGoModule rec {
   pname = "cue";
-  version = "0.4.0";
+  version = "0.4.1";
 
-  src = fetchgit {
-    url = "https://cue.googlesource.com/cue";
+  src = fetchFromGitHub {
+    owner = "cue-lang";
+    repo = "cue";
     rev = "v${version}";
-    sha256 = "sha256-rcGEl+CMFyxZKsOKhVimhv5/ONo3xS6FjgKModZGR2o=";
+    sha256 = "1q1mkqb6fk515g556yn8ks3gqrimfbadprmbv5rill1lpipq5xbj";
   };
 
-  vendorSha256 = "sha256-eSKVlBgnHR1R0j1lNwtFoIgRuj8GqoMbvuBl/N1SanY=";
+  vendorSha256 = "12p77a97lbff6qhncs5qx13k3wmf9hrr09mhh12isw5s0p0n53xm";
 
-  doCheck = false;
+  checkPhase = "go test ./...";
 
   subPackages = [ "cmd/cue" ];
 
@@ -20,6 +21,11 @@ buildGoModule rec {
     "-s" "-w" "-X cuelang.org/go/cmd/cue/cmd.version=${version}"
   ];
 
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/cue eval - <<<'a: "all good"' > /dev/null
+  '';
+
   meta = {
     description = "A data constraint language which aims to simplify tasks involving defining and using data";
     homepage = "https://cuelang.org/";
diff --git a/pkgs/development/tools/database/pyrseas/default.nix b/pkgs/development/tools/database/pyrseas/default.nix
index 930078b2dc7..220554f95d9 100644
--- a/pkgs/development/tools/database/pyrseas/default.nix
+++ b/pkgs/development/tools/database/pyrseas/default.nix
@@ -1,7 +1,7 @@
-{ lib, pythonPackages, fetchFromGitHub }:
+{ lib, python2Packages, fetchFromGitHub }:
 
 let
-  pgdbconn = pythonPackages.buildPythonPackage rec {
+  pgdbconn = python2Packages.buildPythonPackage rec {
     pname = "pgdbconn";
     version = "0.8.0";
     src = fetchFromGitHub {
@@ -13,13 +13,13 @@ let
     # The tests are impure (they try to access a PostgreSQL server)
     doCheck = false;
     propagatedBuildInputs = [
-      pythonPackages.psycopg2
-      pythonPackages.pytest
+      python2Packages.psycopg2
+      python2Packages.pytest
     ];
   };
 in
 
-pythonPackages.buildPythonApplication {
+python2Packages.buildPythonApplication {
   pname = "pyrseas";
   version = "0.8.0";
   src = fetchFromGitHub {
@@ -31,9 +31,9 @@ pythonPackages.buildPythonApplication {
   # The tests are impure (they try to access a PostgreSQL server)
   doCheck = false;
   propagatedBuildInputs = [
-    pythonPackages.psycopg2
-    pythonPackages.pytest
-    pythonPackages.pyyaml
+    python2Packages.psycopg2
+    python2Packages.pytest
+    python2Packages.pyyaml
     pgdbconn
   ];
   meta = {
diff --git a/pkgs/development/tools/misc/gpuvis/default.nix b/pkgs/development/tools/misc/gpuvis/default.nix
index 5e0f54b2fee..83c04495f8c 100644
--- a/pkgs/development/tools/misc/gpuvis/default.nix
+++ b/pkgs/development/tools/misc/gpuvis/default.nix
@@ -12,17 +12,16 @@
 
 stdenv.mkDerivation rec {
   pname = "gpuvis";
-  version = "20210220";
+  version = "20211204";
 
   src = fetchFromGitHub {
     owner = "mikesart";
     repo = pname;
-    rev = "216f7d810e182a89fd96ab9fad2a5c2b1e425ea9";
-    sha256 = "15pj7gy0irlp849a85z68n184jksjri0xhihgh56rs15kq333mwz";
+    rev = "7f47419470687c7ecbdf086b81f5bafdb05d1bef";
+    sha256 = "sha256-29Bv+y0zWzn7QtpsjRV6hr19bCeyVJusPcYiAIEIluk=";
   };
 
   # patch dlopen path for gtk3
-  # python2 is wrongly added in the meson file, upstream PR: https://github.com/mikesart/gpuvis/pull/62
   postPatch = ''
     substituteInPlace src/hook_gtk3.h \
       --replace "libgtk-3.so" "${lib.getLib gtk3}/lib/libgtk-3.so"
diff --git a/pkgs/development/tools/misc/uncrustify/default.nix b/pkgs/development/tools/misc/uncrustify/default.nix
index 759c83e81c8..64d299db155 100644
--- a/pkgs/development/tools/misc/uncrustify/default.nix
+++ b/pkgs/development/tools/misc/uncrustify/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, python }:
+{ lib, stdenv, fetchFromGitHub, cmake, python2 }:
 
 stdenv.mkDerivation rec {
   name = "${product}-${version}";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ZVC5tsn2m1uB7EPNJFPLWLZpLSk4WrFOgJvy1KFYqBY=";
   };
 
-  nativeBuildInputs = [ cmake python ];
+  nativeBuildInputs = [ cmake python2 ];
 
   meta = with lib; {
     description = "Source code beautifier for C, C++, C#, ObjectiveC, D, Java, Pawn and VALA";
diff --git a/pkgs/development/tools/mold/default.nix b/pkgs/development/tools/mold/default.nix
index c275777c12b..d0f33d750c2 100644
--- a/pkgs/development/tools/mold/default.nix
+++ b/pkgs/development/tools/mold/default.nix
@@ -23,6 +23,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ zlib openssl ];
   nativeBuildInputs = [ autoPatchelfHook cmake xxHash ];
 
+  enableParallelBuilding = true;
   dontUseCmakeConfigure = true;
   EXTRA_LDFLAGS = "-fuse-ld=${llvmPackages_latest.lld}/bin/ld.lld";
   LTO = 1;
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/default.nix b/pkgs/development/tools/parsing/tree-sitter/grammars/default.nix
index 6995c41cc91..e8039b1bd94 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/default.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/default.nix
@@ -56,6 +56,7 @@
   tree-sitter-norg = lib.importJSON ./tree-sitter-norg.json;
   tree-sitter-ocaml = lib.importJSON ./tree-sitter-ocaml.json;
   tree-sitter-perl = lib.importJSON ./tree-sitter-perl.json;
+  tree-sitter-org = lib.importJSON ./tree-sitter-org.json;
   tree-sitter-php = lib.importJSON ./tree-sitter-php.json;
   tree-sitter-pioasm = lib.importJSON ./tree-sitter-pioasm.json;
   tree-sitter-prisma = lib.importJSON ./tree-sitter-prisma.json;
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-org.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-org.json
new file mode 100644
index 00000000000..038a4f51eec
--- /dev/null
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-org.json
@@ -0,0 +1,11 @@
+{
+  "url": "https://github.com/milisims/tree-sitter-org",
+  "rev": "39a377f5072ee9f79884e227dc49d42c2eba67d8",
+  "date": "2021-11-01T23:43:23-04:00",
+  "path": "/nix/store/cgsn53p4gp1ahq2zl38jz51xal60dckf-tree-sitter-org",
+  "sha256": "0vfnph4xxvkalzk3rgvzi6ckqkjg31ddzgh4mwbk7qwsacbq9rss",
+  "fetchLFS": false,
+  "fetchSubmodules": false,
+  "deepClone": false,
+  "leaveDotGit": false
+}
diff --git a/pkgs/development/tools/phantomjs2/default.nix b/pkgs/development/tools/phantomjs2/default.nix
index 448e7dd4406..d9e4ec1fb19 100644
--- a/pkgs/development/tools/phantomjs2/default.nix
+++ b/pkgs/development/tools/phantomjs2/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, fetchpatch
 , bison, flex, fontconfig, freetype, gperf, icu, openssl, libjpeg
-, libpng, perl, python, ruby, sqlite, qtwebkit, qmake, qtbase
+, libpng, perl, python2, ruby, sqlite, qtwebkit, qmake, qtbase
 , darwin, writeScriptBin, cups, makeWrapper
 }:
 
@@ -28,7 +28,7 @@ in stdenv.mkDerivation rec {
   nativeBuildInputs = [ qmake ];
   buildInputs = [
     bison flex fontconfig freetype gperf icu openssl
-    libjpeg libpng perl python ruby sqlite qtwebkit qtbase
+    libjpeg libpng perl python2 ruby sqlite qtwebkit qtbase
     makeWrapper
   ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
     AGL ApplicationServices AppKit Cocoa OpenGL
diff --git a/pkgs/development/tools/pipenv/default.nix b/pkgs/development/tools/pipenv/default.nix
index 1c09bb502a2..9d2d9b3962c 100644
--- a/pkgs/development/tools/pipenv/default.nix
+++ b/pkgs/development/tools/pipenv/default.nix
@@ -1,5 +1,6 @@
 { lib
 , python3
+, installShellFiles
 }:
 
 with python3.pkgs;
@@ -27,6 +28,8 @@ in buildPythonApplication rec {
 
   LC_ALL = "en_US.UTF-8";
 
+  nativeBuildInputs = [ installShellFiles ];
+
   postPatch = ''
     # pipenv invokes python in a subprocess to create a virtualenv
     # and to call setup.py.
@@ -38,6 +41,13 @@ in buildPythonApplication rec {
 
   propagatedBuildInputs = runtimeDeps python3.pkgs;
 
+  postInstall = ''
+    installShellCompletion --cmd pipenv \
+      --bash <(_PIPENV_COMPLETE=bash_source $out/bin/pipenv) \
+      --zsh <(_PIPENV_COMPLETE=zsh_source $out/bin/pipenv) \
+      --fish <(_PIPENV_COMPLETE=fish_source $out/bin/pipenv)
+  '';
+
   doCheck = true;
   checkPhase = ''
     export HOME=$(mktemp -d)
diff --git a/pkgs/development/tools/pur/default.nix b/pkgs/development/tools/pur/default.nix
index dc37e3fa20f..359f3519acd 100644
--- a/pkgs/development/tools/pur/default.nix
+++ b/pkgs/development/tools/pur/default.nix
@@ -7,7 +7,8 @@ let
   py = python3.override {
     packageOverrides = self: super: {
       # newest version doesn't support click >8.0 https://github.com/alanhamlett/pip-update-requirements/issues/38
-      click = self.callPackage ../../../development/python-modules/click/7.nix { };
+      # Use click 7
+      click = self.callPackage ../../../development/python2-modules/click/default.nix { };
     };
   };
   inherit (py.pkgs) buildPythonApplication click pytestCheckHook;
diff --git a/pkgs/development/tools/udis86/default.nix b/pkgs/development/tools/udis86/default.nix
index 1885d1a4322..dd4ad058c8d 100644
--- a/pkgs/development/tools/udis86/default.nix
+++ b/pkgs/development/tools/udis86/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, python }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, python2 }:
 
 stdenv.mkDerivation rec {
   pname = "udis86";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0c60zwimim6jrm4saw36s38w5sg5v8n9mr58pkqmjrlf7q9g6am1";
   };
 
-  nativeBuildInputs = [ autoreconfHook python ];
+  nativeBuildInputs = [ autoreconfHook python2 ];
 
   configureFlags = [
     "--enable-shared"
diff --git a/pkgs/development/tools/winpdb/default.nix b/pkgs/development/tools/winpdb/default.nix
index 352dc83f9ab..58fef12cd6e 100644
--- a/pkgs/development/tools/winpdb/default.nix
+++ b/pkgs/development/tools/winpdb/default.nix
@@ -1,6 +1,6 @@
-{ lib, fetchurl, pythonPackages, makeDesktopItem }:
+{ lib, fetchurl, python2Packages, makeDesktopItem }:
 
-pythonPackages.buildPythonApplication rec {
+python2Packages.buildPythonApplication rec {
   pname = "winpdb";
   version = "1.4.8";
   namePrefix = "";
@@ -10,7 +10,7 @@ pythonPackages.buildPythonApplication rec {
     sha256 = "0vkpd24r40j928vc04c721innv0168sbllg97v4zw10adm24d8fs";
   };
 
-  propagatedBuildInputs = [ pythonPackages.wxPython ];
+  propagatedBuildInputs = [ python2Packages.wxPython ];
 
   desktopItem = makeDesktopItem {
     name = "winpdb";
diff --git a/pkgs/development/web/deno/default.nix b/pkgs/development/web/deno/default.nix
index 32507f0d5a3..a0c724c1d35 100644
--- a/pkgs/development/web/deno/default.nix
+++ b/pkgs/development/web/deno/default.nix
@@ -17,15 +17,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "deno";
-  version = "1.17.2";
+  version = "1.17.3";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-i8BfLnZnkHBPyNy4vUUA9J1f757KCjJ/DsWLPMVxsEg=";
+    sha256 = "sha256-S4Dt6SrSE/TLGhjAkTrIdvNR71A6ykxSxq72aiyWUX8=";
   };
-  cargoSha256 = "sha256-bYRBIdB9/F9OgFxC2LZ24HJWQRLeji978Z2cpH18lY8=";
+  cargoSha256 = "1ph392jxkln2ihq3x4hhjb1k3fsd2g54m37qgqkza4abvmc7adns";
 
   # Install completions post-install
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/games/amoeba/default.nix b/pkgs/games/amoeba/default.nix
index 61f5a5bf824..0e21a9a1b9e 100644
--- a/pkgs/games/amoeba/default.nix
+++ b/pkgs/games/amoeba/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, amoeba-data, alsa-lib, expat, freetype, gtk2, libvorbis, libGLU, xorg, pkg-config }:
 
 stdenv.mkDerivation rec {
-  name = "amoeba-${version}-${debver}";
+  pname = "amoeba";
   version = "1.1";
   debver = "29.1";
 
diff --git a/pkgs/games/among-sus/default.nix b/pkgs/games/among-sus/default.nix
index 454c7d181f9..be9ecc7adf5 100644
--- a/pkgs/games/among-sus/default.nix
+++ b/pkgs/games/among-sus/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "among-sus-unstable";
-  version = "2020-10-29";
+  version = "2021-05-19";
 
   src = fetchFromSourcehut {
     owner = "~martijnbraam";
     repo = "among-sus";
-    rev = "1f4c8d800d025d36ac66826937161be3252fbc57";
-    sha256 = "19jq7ygh9l11dl1h6702bg57m04y35nqd6yqx1rgp1kxwhp45xyh";
+    rev = "554e60bf52e3fa931661b9414189a92bb8f69d78";
+    sha256 = "0j1158nczhvy5i1ykvzvhlv4ndhibgng0dq1lw2bmi8q6k1q1s0w";
   };
 
   patchPhase = ''
diff --git a/pkgs/games/blackshades/default.nix b/pkgs/games/blackshades/default.nix
index bd29c7b616c..76f22e98d9e 100644
--- a/pkgs/games/blackshades/default.nix
+++ b/pkgs/games/blackshades/default.nix
@@ -1,29 +1,27 @@
 { lib, stdenv, fetchFromSourcehut
-, SDL, stb, libGLU, libGL, openal, libvorbis, freealut }:
+, zig, glfw, libGLU, libGL, openal, libsndfile }:
 
 stdenv.mkDerivation rec {
   pname = "blackshades";
-  version = "1.3.1";
+  version = "2.4.7";
 
   src = fetchFromSourcehut {
     owner = "~cnx";
     repo = pname;
     rev = version;
-    sha256 = "0yzp74ynkcp6hh5m4zmvrgx5gwm186hq7p3m7qkww54qdyijb3rv";
+    fetchSubmodules = true;
+    sha256 = "sha256-hvJwWUUmGeb7MQgKe79cPS2ckPZ9z0Yc5S9IiwuXPD8=";
   };
 
-  buildInputs = [ SDL stb libGLU libGL openal libvorbis freealut ];
+  nativeBuildInputs = [ zig ];
+  buildInputs = [ glfw libGLU libGL openal libsndfile ];
 
-  postPatch = ''
-    sed -i -e s,Data/,$out/share/$pname/,g \
-      -e s,Data:,$out/share/$pname/,g \
-      src/*.cpp
+  preBuild = ''
+    export HOME=$TMPDIR
   '';
 
   installPhase = ''
-    mkdir -p $out/bin $out/share
-    cp build/blackshades $out/bin
-    cp -R Data $out/share/$pname
+    zig build -Drelease-fast -Dcpu=baseline --prefix $out install
   '';
 
   meta = {
diff --git a/pkgs/games/crawl/default.nix b/pkgs/games/crawl/default.nix
index 02e34e5f749..e5eea7ece62 100644
--- a/pkgs/games/crawl/default.nix
+++ b/pkgs/games/crawl/default.nix
@@ -7,7 +7,7 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "crawl-${version}${lib.optionalString tileMode "-tiles"}";
+  pname = "crawl${lib.optionalString tileMode "-tiles"}";
   version = "0.27.1";
 
   src = fetchFromGitHub {
diff --git a/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix b/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix
index 93f51df1819..316d1308eb7 100644
--- a/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix
+++ b/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix
@@ -9,7 +9,8 @@ let
 in
 
 stdenv.mkDerivation {
-  name = "dwarf-therapist-${dwarf-therapist.version}";
+  pname = "dwarf-therapist";
+  version = dwarf-therapist.version;
 
   wrapper = substituteAll {
     src = ./dwarf-therapist.in;
diff --git a/pkgs/games/dwarf-fortress/unfuck.nix b/pkgs/games/dwarf-fortress/unfuck.nix
index 5b25cf4ff40..27b54667f0b 100644
--- a/pkgs/games/dwarf-fortress/unfuck.nix
+++ b/pkgs/games/dwarf-fortress/unfuck.nix
@@ -72,7 +72,8 @@ let
 in
 
 stdenv.mkDerivation {
-  name = "dwarf_fortress_unfuck-${release.unfuckRelease}";
+  pname = "dwarf_fortress_unfuck";
+  version = release.unfuckRelease;
 
   src = fetchFromGitHub {
     owner = "svenstaro";
diff --git a/pkgs/games/dwarf-fortress/wrapper/default.nix b/pkgs/games/dwarf-fortress/wrapper/default.nix
index ce989b98ffb..3d1c3ead060 100644
--- a/pkgs/games/dwarf-fortress/wrapper/default.nix
+++ b/pkgs/games/dwarf-fortress/wrapper/default.nix
@@ -92,7 +92,8 @@ let
 in
 
 stdenv.mkDerivation {
-  name = "dwarf-fortress-${dwarf-fortress.dfVersion}";
+  pname = "dwarf-fortress";
+  version = dwarf-fortress.dfVersion;
 
   dfInit = substituteAll {
     name = "dwarf-fortress-init";
diff --git a/pkgs/games/gnubg/default.nix b/pkgs/games/gnubg/default.nix
index 7402049a9d8..6f50869e6c6 100644
--- a/pkgs/games/gnubg/default.nix
+++ b/pkgs/games/gnubg/default.nix
@@ -1,8 +1,8 @@
 { lib, stdenv, fetchurl, pkg-config, glib, python3, gtk2, readline }:
 
-let version = "1.06.002"; in
-stdenv.mkDerivation {
-  name = "gnubg-"+version;
+stdenv.mkDerivation rec {
+  pname = "gnubg";
+  version = "1.06.002";
 
   src = fetchurl {
     url = "http://gnubg.org/media/sources/gnubg-release-${version}-sources.tar.gz";
diff --git a/pkgs/games/heroic/default.nix b/pkgs/games/heroic/default.nix
index a877eed6213..bcbe2a6c653 100644
--- a/pkgs/games/heroic/default.nix
+++ b/pkgs/games/heroic/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchurl, appimageTools, python, gsettings-desktop-schemas, gtk3 }:
+{ lib, fetchurl, appimageTools, gsettings-desktop-schemas, gtk3 }:
 
 let
   pname = "heroic";
diff --git a/pkgs/games/hhexen/default.nix b/pkgs/games/hhexen/default.nix
index 0306c54ef4e..19a0b783efd 100644
--- a/pkgs/games/hhexen/default.nix
+++ b/pkgs/games/hhexen/default.nix
@@ -1,7 +1,7 @@
 { lib, fetchurl, SDL, stdenv }:
 
 stdenv.mkDerivation rec {
-  name = "hhexen";
+  pname = "hhexen";
   version = "1.6.3";
   src = fetchurl {
     url = "mirror://sourceforge/hhexen/hhexen-${version}-src.tgz";
diff --git a/pkgs/games/instead/default.nix b/pkgs/games/instead/default.nix
index 5c35219c19b..cafdd2b84f0 100644
--- a/pkgs/games/instead/default.nix
+++ b/pkgs/games/instead/default.nix
@@ -1,8 +1,6 @@
 { lib, stdenv, fetchurl, SDL2, SDL2_ttf, SDL2_image, SDL2_mixer, pkg-config, lua, zlib, unzip }:
 
 let
-  version = "3.3.2";
-
   # I took several games at random from https://instead.syscall.ru/games/
   games = [
     (fetchurl {
@@ -28,8 +26,9 @@ let
   ];
 in
 
-stdenv.mkDerivation {
-  name = "instead-" + version;
+stdenv.mkDerivation rec {
+  pname = "instead";
+  version = "3.3.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/instead/instead/${version}/instead_${version}.tar.gz";
diff --git a/pkgs/games/legendary-gl/default.nix b/pkgs/games/legendary-gl/default.nix
index cbdfbc22891..fe3761f12d3 100644
--- a/pkgs/games/legendary-gl/default.nix
+++ b/pkgs/games/legendary-gl/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonApplication rec {
   pname = "legendary-gl"; # Name in pypi
-  version = "0.20.18";
+  version = "0.20.24";
 
   src = fetchFromGitHub {
     owner = "derrod";
     repo = "legendary";
     rev = version;
-    sha256 = "0d31c8grvcw7y3sh2x90cxhj612k6f491w2r12j1q33d2v9sqm4j";
+    sha256 = "sha256-4VN/2FoAXTaumPsplV9wgdUSQsFitC1hqWveAW/yt58=";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/pkgs/games/moon-buggy/default.nix b/pkgs/games/moon-buggy/default.nix
index b623d7bd539..12eb6b24a80 100644
--- a/pkgs/games/moon-buggy/default.nix
+++ b/pkgs/games/moon-buggy/default.nix
@@ -1,16 +1,15 @@
 {lib, stdenv, fetchurl, ncurses}:
 
 stdenv.mkDerivation rec {
-  baseName = "moon-buggy";
+  pname = "moon-buggy";
   version = "1.0.51";
-  name = "${baseName}-${version}";
 
   buildInputs = [
     ncurses
   ];
 
   src = fetchurl {
-    url = "http://m.seehuhn.de/programs/${name}.tar.gz";
+    url = "http://m.seehuhn.de/programs/moon-buggy-${version}.tar.gz";
     sha256 = "0gyjwlpx0sd728dwwi7pwks4zfdy9rm1w1xbhwg6zip4r9nc2b9m";
   };
 
diff --git a/pkgs/games/n2048/default.nix b/pkgs/games/n2048/default.nix
index b3d06a51fd3..ec3a4e2bbee 100644
--- a/pkgs/games/n2048/default.nix
+++ b/pkgs/games/n2048/default.nix
@@ -1,35 +1,26 @@
-{lib, stdenv, fetchurl, ncurses}:
-let
-  s =
-  rec {
-    baseName = "n2048";
-    version = "0.1";
-    name = "${baseName}-${version}";
-    url = "http://www.dettus.net/n2048/${baseName}_v${version}.tar.gz";
+{ lib, stdenv, fetchurl, ncurses }:
+
+stdenv.mkDerivation rec {
+  pname = "n2048";
+  version = "0.1";
+  src = fetchurl {
+    url = "http://www.dettus.net/n2048/n2048_v${version}.tar.gz";
     sha256 = "184z2rr0rnj4p740qb4mzqr6kgd76ynb5gw9bj8hrfshcxdcg1kk";
   };
   buildInputs = [
     ncurses
   ];
-in
-stdenv.mkDerivation {
-  inherit (s) name version;
-  inherit buildInputs;
-  src = fetchurl {
-    inherit (s) url sha256;
-  };
   makeFlags = [
     "DESTDIR=$(out)"
   ];
   preInstall = ''
     mkdir -p "$out"/{share/man,bin}
   '';
-  meta = {
-    inherit (s) version;
+  meta = with lib; {
     description = "Console implementation of 2048 game";
-    license = lib.licenses.bsd2;
-    maintainers = [lib.maintainers.raskin];
-    platforms = lib.platforms.linux;
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ raskin ];
+    platforms = platforms.linux;
     homepage = "http://www.dettus.net/n2048/";
   };
 }
diff --git a/pkgs/games/nethack/default.nix b/pkgs/games/nethack/default.nix
index f9939f063c8..2b29bddad93 100644
--- a/pkgs/games/nethack/default.nix
+++ b/pkgs/games/nethack/default.nix
@@ -20,9 +20,9 @@ let
 
 in stdenv.mkDerivation rec {
   version = "3.6.6";
-  name = if x11Mode then "nethack-x11-${version}"
-         else if qtMode then "nethack-qt-${version}"
-         else "nethack-${version}";
+  pname = if x11Mode then "nethack-x11"
+         else if qtMode then "nethack-qt"
+         else "nethack";
 
   src = fetchurl {
     url = "https://nethack.org/download/${version}/nethack-${lib.replaceStrings ["."] [""] version}-src.tgz";
diff --git a/pkgs/games/openra/common.nix b/pkgs/games/openra/common.nix
index 41c903e1011..01bd44ee244 100644
--- a/pkgs/games/openra/common.nix
+++ b/pkgs/games/openra/common.nix
@@ -2,7 +2,7 @@
     and out-of-tree mod packages (mod.nix).
 */
 { lib, makeSetupHook, curl, unzip, dos2unix, pkg-config, makeWrapper
-, lua, mono, dotnetPackages, python
+, lua, mono, dotnetPackages, python2
 , libGL, freetype, openal, SDL2
 , zenity
 }:
@@ -10,7 +10,7 @@
 with lib;
 
 let
-  path = makeBinPath ([ mono python ] ++ optional (zenity != null) zenity);
+  path = makeBinPath ([ mono python2 ] ++ optional (zenity != null) zenity);
   rpath = makeLibraryPath [ lua freetype openal SDL2 ];
   mkdirp = makeSetupHook { } ./mkdirp.sh;
 
@@ -66,7 +66,7 @@ in {
       makeWrapper
       mkdirp
       mono
-      python
+      python2
     ];
 
     makeFlags = [ "prefix=$(out)" ];
diff --git a/pkgs/games/planetaryannihilation/default.nix b/pkgs/games/planetaryannihilation/default.nix
index c29af6d810f..2debd15f814 100644
--- a/pkgs/games/planetaryannihilation/default.nix
+++ b/pkgs/games/planetaryannihilation/default.nix
@@ -1,26 +1,15 @@
 { lib, stdenv, config, fetchurl, patchelf, makeWrapper, gtk2, glib, udev, alsa-lib, atk
-, nspr, fontconfig, cairo, pango, nss, freetype, gnome2, gdk-pixbuf, curl, systemd, xorg }:
+, nspr, fontconfig, cairo, pango, nss, freetype, gnome2, gdk-pixbuf, curl, systemd, xorg, requireFile }:
 
-# TODO: use dynamic attributes once Nix 1.7 is out
-assert ((config.planetary_annihilation or null).url or null) != null;
-assert ((config.planetary_annihilation or null).sha256 or null) != null;
+stdenv.mkDerivation rec {
+  pname = "planetary-annihalation";
+  version = "62857";
 
-/* to setup:
- $ cat ~/.config/nixpkgs/config.nix
- {
-  planetary_annihilation = {
-    url = "file:///home/user/PA_Linux_62857.tar.bz2";
+  src = requireFile {
+    message = "This file has to be downloaded manually via nix-prefetch-url.";
+    name = "PA_Linux_${version}.tar.bz2";
     sha256 = "0imi3k5144dsn3ka9khx3dj76klkw46ga7m6rddqjk4yslwabh3k";
   };
-}
-*/
-
-stdenv.mkDerivation {
-  name = "planetary-annihalation";
-
-  src = fetchurl {
-    inherit (config.planetary_annihilation) url sha256;
-  };
 
   nativeBuildInputs = [ patchelf makeWrapper ];
 
diff --git a/pkgs/games/tennix/default.nix b/pkgs/games/tennix/default.nix
index f81ddb7edf9..809ed7a146d 100644
--- a/pkgs/games/tennix/default.nix
+++ b/pkgs/games/tennix/default.nix
@@ -1,4 +1,4 @@
-{lib, stdenv, fetchurl, SDL, SDL_mixer, SDL_image, SDL_ttf, SDL_net, python } :
+{lib, stdenv, fetchurl, SDL, SDL_mixer, SDL_image, SDL_ttf, SDL_net, python2 } :
 
 stdenv.mkDerivation rec {
   pname = "tennix";
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "0np5kw1y7i0z0dsqx4r2nvmq86qj8hv3mmgavm3hxraqnds5z8cm";
   };
 
-  buildInputs = [ python SDL SDL_mixer SDL_image SDL_ttf SDL_net ];
+  buildInputs = [ python2 SDL SDL_mixer SDL_image SDL_ttf SDL_net ];
 
   patches = [ ./fix_FTBFS.patch ];
 
diff --git a/pkgs/games/tlauncher/default.nix b/pkgs/games/tlauncher/default.nix
deleted file mode 100644
index 48cfac1f582..00000000000
--- a/pkgs/games/tlauncher/default.nix
+++ /dev/null
@@ -1,100 +0,0 @@
-{ lib
-, stdenv
-, openjdk8
-, buildFHSUserEnv
-, fetchzip
-, fetchurl
-, copyDesktopItems
-, makeDesktopItem
-}:
-let
-  version = "2.839";
-  src = stdenv.mkDerivation {
-    pname = "tlauncher";
-    inherit version;
-    src = fetchzip {
-      name = "tlauncher.zip";
-      url = "https://dl2.tlauncher.org/f.php?f=files%2FTLauncher-${version}.zip";
-      sha256 = "sha256-KphpNuTucpuJhXspKxqDyYQN6vbpY0XCB3GAd5YCGbc=";
-      stripRoot = false;
-    };
-    installPhase = ''
-      cp $src/*.jar $out
-    '';
-  };
-  fhs = buildFHSUserEnv {
-    name = "tlauncher";
-    runScript = ''
-      ${openjdk8}/bin/java -jar "${src}" "$@"
-    '';
-    targetPkgs = pkgs: with pkgs; [
-      alsa-lib
-      cpio
-      cups
-      file
-      fontconfig
-      freetype
-      giflib
-      glib
-      gnome2.GConf
-      gnome2.gnome_vfs
-      gtk2
-      libjpeg
-      libGL
-      openjdk8-bootstrap
-      perl
-      which
-      xorg.libICE
-      xorg.libX11
-      xorg.libXcursor
-      xorg.libXext
-      xorg.libXi
-      xorg.libXinerama
-      xorg.libXrandr
-      xorg.xrandr
-      xorg.libXrender
-      xorg.libXt
-      xorg.libXtst
-      xorg.libXtst
-      xorg.libXxf86vm
-      zip
-      zlib
-    ];
-  };
-  desktopItem = makeDesktopItem {
-    name = "tlauncher";
-    exec = "tlauncher";
-    icon = fetchurl {
-      url = "https://styles.redditmedia.com/t5_2o8oax/styles/communityIcon_gu5r5v8eaiq51.png";
-      sha256 = "sha256-ma8zxaUxdAw5VYfOK8i8s1kjwMgs80Eomq43Cb0HZWw=";
-    };
-    comment = "Minecraft launcher";
-    desktopName = "TLauncher";
-    categories = "Game;";
-  };
-in stdenv.mkDerivation {
-  pname = "tlauncher-wrapper";
-  inherit version;
-
-  dontUnpack = true;
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir $out/{bin,share/applications} -p
-    install ${fhs}/bin/tlauncher $out/bin
-
-    runHook postInstall
-  '';
-
-  nativeBuildInputs = [ copyDesktopItems ];
-  desktopItems = [ desktopItem ];
-
-  meta = with lib; {
-    description = "Minecraft launcher that already deal with forge, optifine and mods";
-    homepage = "https://tlauncher.org/";
-    maintainers = with maintainers; [ lucasew ];
-    license = licenses.unfree;
-    platforms = openjdk8.meta.platforms;
-  };
-}
diff --git a/pkgs/games/xconq/default.nix b/pkgs/games/xconq/default.nix
index 8f4366fbcb8..10a959a676b 100644
--- a/pkgs/games/xconq/default.nix
+++ b/pkgs/games/xconq/default.nix
@@ -2,12 +2,11 @@
 , libXext, fontconfig, makeWrapper }:
 
 stdenv.mkDerivation rec {
-  name = "${baseName}-${version}";
-  baseName = "xconq";
+  pname = "xconq";
   version = "7.5.0-0pre.0.20050612";
 
   src = fetchurl {
-    url = "mirror://sourceforge/project/${baseName}/${baseName}/${name}/${name}.tar.gz";
+    url = "mirror://sourceforge/project/xconq/xconq/xconq-${version}/xconq-${version}.tar.gz";
     sha256 = "1za78yx57mgwcmmi33wx3533yz1x093dnqis8q2qmqivxav51lca";
   };
 
diff --git a/pkgs/misc/emulators/fceux/default.nix b/pkgs/misc/emulators/fceux/default.nix
index c2ff8ebdada..3552a4a8d04 100644
--- a/pkgs/misc/emulators/fceux/default.nix
+++ b/pkgs/misc/emulators/fceux/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fceux";
-  version = "2.6.0";
+  version = "2.6.1";
 
   src = fetchFromGitHub {
     owner = "TASEmulators";
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "sha256-FNcybq0EFN0tWgWxzwEJQMpsnpvdRxDYnIWDXW2fXkw=";
+    sha256 = "sha256-LlGM6sOjcpyHApUvSr5etKIqwDoheuiW53DSHs19W6Q=";
   };
 
   nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];
diff --git a/pkgs/misc/emulators/retrofe/default.nix b/pkgs/misc/emulators/retrofe/default.nix
index 558b5ca6337..dc1a23f33b3 100644
--- a/pkgs/misc/emulators/retrofe/default.nix
+++ b/pkgs/misc/emulators/retrofe/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchhg, cmake, glib, gst_all_1, makeWrapper, pkg-config
-, python, SDL2, SDL2_image, SDL2_mixer, SDL2_ttf, sqlite, zlib, runtimeShell
+, python2, SDL2, SDL2_image, SDL2_mixer, SDL2_ttf, sqlite, zlib, runtimeShell
 }:
 
 stdenv.mkDerivation {
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
     sha256 = "0cvsg07ff0fdqh5zgiv2fs7s6c98hn150kpxmpw5fn6jilaszwkm";
   };
 
-  nativeBuildInputs = [ cmake makeWrapper pkg-config python ];
+  nativeBuildInputs = [ cmake makeWrapper pkg-config python2 ];
 
   buildInputs = [
     glib gst_all_1.gstreamer SDL2 SDL2_image SDL2_mixer SDL2_ttf sqlite zlib
diff --git a/pkgs/misc/emulators/ryujinx/default.nix b/pkgs/misc/emulators/ryujinx/default.nix
index 86716ed5d53..49a1c190b54 100644
--- a/pkgs/misc/emulators/ryujinx/default.nix
+++ b/pkgs/misc/emulators/ryujinx/default.nix
@@ -1,7 +1,7 @@
 { lib, buildDotnetModule, fetchFromGitHub, makeDesktopItem, copyDesktopItems
 , libX11, libgdiplus, ffmpeg
 , SDL2_mixer, openal, libsoundio, sndio, pulseaudio
-, gtk3, gobject-introspection, gdk-pixbuf, wrapGAppsHook
+, gtk3, gdk-pixbuf, wrapGAppsHook
 }:
 
 buildDotnetModule rec {
@@ -27,7 +27,10 @@ buildDotnetModule rec {
   nativeBuildInputs = [
     copyDesktopItems
     wrapGAppsHook
-    gobject-introspection
+  ];
+
+  buildInputs = [
+    gtk3
     gdk-pixbuf
   ];
 
@@ -78,6 +81,7 @@ buildDotnetModule rec {
     changelog = "https://github.com/Ryujinx/Ryujinx/wiki/Changelog";
     maintainers = [ maintainers.ivar ];
     platforms = [ "x86_64-linux" ];
+    mainProgram = "Ryujinx";
   };
   passthru.updateScript = ./updater.sh;
 }
diff --git a/pkgs/misc/emulators/wxmupen64plus/default.nix b/pkgs/misc/emulators/wxmupen64plus/default.nix
index 3b24584f7e6..c09a83b92ea 100644
--- a/pkgs/misc/emulators/wxmupen64plus/default.nix
+++ b/pkgs/misc/emulators/wxmupen64plus/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, python, wxGTK29, mupen64plus, SDL, libX11, libGLU, libGL
+{ lib, stdenv, fetchurl, python2, wxGTK29, mupen64plus, SDL, libX11, libGLU, libGL
 , wafHook }:
 
 stdenv.mkDerivation rec {
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ wafHook ];
-  buildInputs = [ python wxGTK29 SDL libX11 libGLU libGL ];
+  buildInputs = [ python2 wxGTK29 SDL libX11 libGLU libGL ];
 
   preConfigure = ''
     tar xf ${mupen64plus.src}
diff --git a/pkgs/misc/screensavers/xtrlock-pam/default.nix b/pkgs/misc/screensavers/xtrlock-pam/default.nix
index 6908429e21b..ffb9d0da857 100644
--- a/pkgs/misc/screensavers/xtrlock-pam/default.nix
+++ b/pkgs/misc/screensavers/xtrlock-pam/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchgit, python, pkg-config, xlibsWrapper, pam }:
+{ lib, stdenv, fetchgit, python2, pkg-config, xlibsWrapper, pam }:
 
 stdenv.mkDerivation {
   pname = "xtrlock-pam";
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ python xlibsWrapper pam ];
+  buildInputs = [ python2 xlibsWrapper pam ];
 
   configurePhase = ''
     substituteInPlace .config/options.py --replace /usr/include/security/pam_appl.h ${pam}/include/security/pam_appl.h
diff --git a/pkgs/misc/vim-plugins/overrides.nix b/pkgs/misc/vim-plugins/overrides.nix
index 1f210717c0b..b8ab2f43312 100644
--- a/pkgs/misc/vim-plugins/overrides.nix
+++ b/pkgs/misc/vim-plugins/overrides.nix
@@ -10,7 +10,7 @@
 , substituteAll
 
   # Language dependencies
-, python
+, python2
 , python3
 , rustPlatform
 
@@ -184,7 +184,7 @@ self: super: {
   });
 
   ctrlp-cmatcher = super.ctrlp-cmatcher.overrideAttrs (old: {
-    buildInputs = [ python ];
+    buildInputs = [ python2 ];
     buildPhase = ''
       patchShebangs .
       ./install.sh
@@ -862,7 +862,7 @@ self: super: {
   vim-isort = super.vim-isort.overrideAttrs (old: {
     postPatch = ''
       substituteInPlace ftplugin/python_vimisort.vim \
-        --replace 'import vim' 'import vim; import sys; sys.path.append("${python.pkgs.isort}/${python.sitePackages}")'
+        --replace 'import vim' 'import vim; import sys; sys.path.append("${python2.pkgs.isort}/${python2.sitePackages}")'
     '';
   });
 
@@ -871,7 +871,7 @@ self: super: {
       vim-markdown-composer-bin = rustPlatform.buildRustPackage rec {
         pname = "vim-markdown-composer-bin";
         inherit (super.vim-markdown-composer) src version;
-        cargoSha256 = "1cvnjsw5dd02wrm1q5xi8b033rsn44f7fkmw5j7lhskv5j286zrh";
+        cargoSha256 = "03d7kap6vha1jmyfrjqaja5439x6mhnvjjbz3rmxb3x4dpppbpj1";
       };
     in
     super.vim-markdown-composer.overrideAttrs (oldAttrs: rec {
@@ -916,7 +916,7 @@ self: super: {
   });
 
   vim-wakatime = super.vim-wakatime.overrideAttrs (old: {
-    buildInputs = [ python ];
+    buildInputs = [ python2 ];
   });
 
   vim-xdebug = super.vim-xdebug.overrideAttrs (old: {
diff --git a/pkgs/misc/vscode-extensions/default.nix b/pkgs/misc/vscode-extensions/default.nix
index 954af1706fe..abcd9308bec 100644
--- a/pkgs/misc/vscode-extensions/default.nix
+++ b/pkgs/misc/vscode-extensions/default.nix
@@ -367,6 +367,22 @@ let
 
       chenglou92.rescript-vscode = callPackage ./rescript { };
 
+      christian-kohler.path-intellisense = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "path-intellisense";
+          publisher = "christian-kohler";
+          version = "2.6.1";
+          sha256 = "sha256-ol98g3pliBlyEQ+n7cR4O04J/0QB9U8+fvf+FC0j0Fc=";
+        };
+        meta = with lib; {
+          description = "Visual Studio Code plugin that autocompletes filenames";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=christian-kohler.path-intellisense";
+          homepage = "https://github.com/ChristianKohler/PathIntellisense";
+          license = licenses.mit;
+          maintainers = with maintainers; [ imgabe ];
+        };
+      };
+
       cmschuetz12.wal = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "wal";
@@ -1064,6 +1080,22 @@ let
         };
       };
 
+      jdinhlife.gruvbox = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "gruvbox";
+          publisher = "jdinhlife";
+          version = "1.5.1";
+          sha256 = "sha256-0ghB0E+Wa9W2bNFFiH2Q3pUJ9HV5+JfKohX4cRyevC8=";
+        };
+        meta = with lib; {
+          description = "Gruvbox Theme";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=jdinhlife.gruvbox";
+          homepage = "https://github.com/jdinhify/vscode-theme-gruvbox";
+          license = licenses.mit;
+          maintainers = with maintainers; [ imgabe ];
+        };
+      };
+
       jnoortheen.nix-ide = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "nix-ide";
@@ -1250,6 +1282,8 @@ let
         };
       };
 
+      ms-ceintl = callPackage ./language-packs.nix {}; # non-English language packs
+
       ms-dotnettools.csharp = callPackage ./ms-dotnettools-csharp { };
 
       ms-kubernetes-tools.vscode-kubernetes-tools = buildVscodeMarketplaceExtension {
@@ -1472,8 +1506,8 @@ let
         mktplcRef = {
           name = "metals";
           publisher = "scalameta";
-          version = "1.11.0";
-          sha256 = "0a4agm0g16cxhvhvsmbsvvicfsjr53330rsab5xdi7gcpx9a1dff";
+          version = "1.12.0";
+          sha256 = "13zwjnrmkrs3wxh8c9nz9zxxs3p6lkj41q30v4a1md5pscfa1s44";
         };
         meta = {
           license = lib.licenses.asl20;
@@ -1574,8 +1608,8 @@ let
         mktplcRef = {
           publisher = "stkb";
           name = "rewrap";
-          version = "1.15.4";
-          sha256 = "sha256-yuXyClvhGsonvddYHDMkLSvwEsD21vOeE54Gs9BRpeg=";
+          version = "1.16.0";
+          sha256 = "sha256-351zYmMupAv/8fQ+lOc0pYzy/wsE3JqTuxfKD+AdBAc=";
         };
         meta = with lib; {
           changelog = "https://github.com/stkb/Rewrap/blob/master/CHANGELOG.md";
@@ -1591,8 +1625,8 @@ let
         mktplcRef = {
           name = "code-spell-checker";
           publisher = "streetsidesoftware";
-          version = "2.0.14";
-          sha256 = "sha256-mwcssQvaztrnUuSoo8AWK3FXT4qKmPTRCGVYkAjgfXg=";
+          version = "2.1.4";
+          sha256 = "sha256-V8ug/EtDczjiofuL7HhpN1B+qbedpnvIlXnwiXJzD/g=";
         };
         meta = with lib; {
           changelog = "https://marketplace.visualstudio.com/items/streetsidesoftware.code-spell-checker/changelog";
diff --git a/pkgs/misc/vscode-extensions/language-packs.nix b/pkgs/misc/vscode-extensions/language-packs.nix
new file mode 100644
index 00000000000..f97727d6c2c
--- /dev/null
+++ b/pkgs/misc/vscode-extensions/language-packs.nix
@@ -0,0 +1,89 @@
+{ lib, vscode-utils }:
+
+with vscode-utils;
+
+let
+
+  buildVscodeLanguagePack = { language, sha256 }:
+    buildVscodeMarketplaceExtension {
+      mktplcRef = {
+        name = "vscode-language-pack-${language}";
+        publisher = "MS-CEINTL";
+        version = "1.64.3";
+        inherit sha256;
+      };
+      meta = {
+        license = lib.licenses.mit;
+      };
+    };
+
+in
+
+# See list of core language packs at https://github.com/Microsoft/vscode-loc
+{
+  # French
+  vscode-language-pack-fr = buildVscodeLanguagePack {
+    language = "fr";
+    sha256 = "sha256-6ynT1sbMgKO8iZReQ6KxFpR1VL3Nuo58MvXCtp+67vA=";
+  };
+  # Italian
+  vscode-language-pack-it = buildVscodeLanguagePack {
+    language = "it";
+    sha256 = "sha256-5aNFpzNMZAZJH3n0rJevke9P6AW0au5i8+r4PXsb9Rg=";
+  };
+  # German
+  vscode-language-pack-de = buildVscodeLanguagePack {
+    language = "de";
+    sha256 = "sha256-oEaWtsgktHKw52lnZTESkpzC/TTY8LO4yX11IgtMG5U=";
+  };
+  # Spanish
+  vscode-language-pack-es = buildVscodeLanguagePack {
+    language = "es";
+    sha256 = "sha256-utLWbved3WCCk3XzqedbYzmyaKfbMrAmR0btT09GlxA=";
+  };
+  # Russian
+  vscode-language-pack-ru = buildVscodeLanguagePack {
+    language = "ru";
+    sha256 = "sha256-0Wr2ICOiaaj4jZ555bxUJcmXO/yWDyn0UmdvxUF3WSQ=";
+  };
+  # Chinese (Simplified)
+  vscode-language-pack-zh-hans = buildVscodeLanguagePack {
+    language = "zh-hans";
+    sha256 = "sha256-irTSQcVXf/V3MuZwfx4tFcvBk+xhbFZTnb7IG28s/p4=";
+  };
+  # Chinese (Traditional)
+  vscode-language-pack-zh-hant = buildVscodeLanguagePack {
+    language = "zh-hant";
+    sha256 = "sha256-3IA/VTTTEqS6jrDYv50GnLXOTSC1XAMvqOVfOuvIdIs=";
+  };
+  # Japanese
+  vscode-language-pack-ja = buildVscodeLanguagePack {
+    language = "ja";
+    sha256 = "sha256-rxod70ddrppEYYzukksVY1dTXR8osLFAsIPr1fSFZDg=";
+  };
+  # Korean
+  vscode-language-pack-ko = buildVscodeLanguagePack {
+    language = "ko";
+    sha256 = "sha256-QYFaxJz1PqKKIiLosLQ8Tu3JNXzpxLFqgIHjjRLwjA4=";
+  };
+  # Czech
+  vscode-language-pack-cs = buildVscodeLanguagePack {
+    language = "cs";
+    sha256 = "sha256-eMk+syy2h+Xb3k6QB8PqYaF4I1ydaY6eRsvOXmelh9Q=";
+  };
+  # Portuguese (Brazil)
+  vscode-language-pack-pt-br = buildVscodeLanguagePack {
+    language = "pt-BR";
+    sha256 = "sha256-7Trz38KBl4sD7608MvTs02pUsdD05oHEj3Sp1LvtI7I=";
+  };
+  # Turkish
+  vscode-language-pack-tr = buildVscodeLanguagePack {
+    language = "tr";
+    sha256 = "sha256-T4CTpbve3vrNdW4VDfHDg8U8cQEtuxPV5LvNdtKrqzA";
+  };
+  # Pseudo Language
+  vscode-language-pack-qps-ploc = buildVscodeLanguagePack {
+    language = "qps-ploc";
+    sha256 = "sha256-rPvCr3uQPfM8vwKoV7Un5aiMZClhf6TvG1PEe3xYNI0=";
+  };
+}
diff --git a/pkgs/misc/vscode-extensions/vscode-utils.nix b/pkgs/misc/vscode-extensions/vscode-utils.nix
index da3630f97c4..49b730361af 100644
--- a/pkgs/misc/vscode-extensions/vscode-utils.nix
+++ b/pkgs/misc/vscode-extensions/vscode-utils.nix
@@ -16,7 +16,7 @@ let
     '',
     dontPatchELF ? true,
     dontStrip ? true,
-    buildInputs ? [],
+    nativeBuildInputs ? [],
     ...
   }:
   stdenv.mkDerivation ((removeAttrs a [ "vscodeExtUniqueId" ]) // {
@@ -28,7 +28,7 @@ let
 
     installPrefix = "share/vscode/extensions/${vscodeExtUniqueId}";
 
-    buildInputs = [ unzip ] ++ buildInputs;
+    nativeBuildInputs = [ unzip ] ++ nativeBuildInputs;
 
     installPhase = ''
 
diff --git a/pkgs/os-specific/linux/fbterm/default.nix b/pkgs/os-specific/linux/fbterm/default.nix
index ecf1b5e2b31..cbea00ae184 100644
--- a/pkgs/os-specific/linux/fbterm/default.nix
+++ b/pkgs/os-specific/linux/fbterm/default.nix
@@ -1,24 +1,17 @@
 { stdenv, lib, fetchurl, gpm, freetype, fontconfig, pkg-config, ncurses, libx86 }:
-let
-  s = # Generated upstream information
-    {
-      version = "1.7.0";
-      pname = "fbterm";
-      hash = "0pciv5by989vzvjxsv1jsv4bdp4m8j0nfbl29jm5fwi12w4603vj";
-      url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/fbterm/fbterm-1.7.0.tar.gz";
-      sha256 = "0pciv5by989vzvjxsv1jsv4bdp4m8j0nfbl29jm5fwi12w4603vj";
-    };
-  buildInputs = [ gpm freetype fontconfig ncurses ]
-    ++ lib.optional stdenv.hostPlatform.isx86 libx86;
-in
-stdenv.mkDerivation {
-  inherit (s) pname version;
+
+stdenv.mkDerivation rec {
+  version = "1.7.0";
+  pname = "fbterm";
+
   src = fetchurl {
-    inherit (s) url sha256;
+    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/fbterm/fbterm-${version}.tar.gz";
+    sha256 = "0pciv5by989vzvjxsv1jsv4bdp4m8j0nfbl29jm5fwi12w4603vj";
   };
 
   nativeBuildInputs = [ pkg-config ncurses ];
-  inherit buildInputs;
+  buildInputs = [ gpm freetype fontconfig ncurses ]
+    ++ lib.optional stdenv.hostPlatform.isx86 libx86;
 
   preConfigure = ''
     sed -e '/ifdef SYS_signalfd/atypedef long long loff_t;' -i src/fbterm.cpp
@@ -51,10 +44,9 @@ stdenv.mkDerivation {
   ];
 
   meta = with lib; {
-    inherit (s) version;
     description = "Framebuffer terminal emulator";
     homepage = "https://code.google.com/archive/p/fbterm/";
-    maintainers = [ maintainers.raskin ];
+    maintainers = with maintainers; [ raskin ];
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/hostapd/default.nix b/pkgs/os-specific/linux/hostapd/default.nix
index 268e178aad0..8124da489ae 100644
--- a/pkgs/os-specific/linux/hostapd/default.nix
+++ b/pkgs/os-specific/linux/hostapd/default.nix
@@ -1,12 +1,12 @@
-{ lib, stdenv, fetchurl, fetchpatch, pkg-config, libnl, openssl, sqlite ? null }:
+{ lib, stdenv, fetchurl, pkg-config, libnl, openssl, sqlite ? null }:
 
 stdenv.mkDerivation rec {
   pname = "hostapd";
-  version = "2.9";
+  version = "2.10";
 
   src = fetchurl {
     url = "https://w1.fi/releases/${pname}-${version}.tar.gz";
-    sha256 = "1mrbvg4v7vm7mknf0n29mf88k3s4a4qj6r4d51wq8hmjj1m7s7c8";
+    sha256 = "sha256-IG58eZtnhXLC49EgMCOHhLxKn4IyOwFWtMlGbxSYkV0=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -16,38 +16,8 @@ stdenv.mkDerivation rec {
     (fetchurl {
       # Note: fetchurl seems to be unhappy with openwrt git
       # server's URLs containing semicolons. Using the github mirror instead.
-      url = "https://raw.githubusercontent.com/openwrt/openwrt/master/package/network/services/hostapd/patches/300-noscan.patch";
-      sha256 = "04wg4yjc19wmwk6gia067z99gzzk9jacnwxh5wyia7k5wg71yj5k";
-    })
-    # AP mode PMF disconnection protection bypass (CVE.2019-16275), can be removed >= 2.10
-    # https://w1.fi/security/2019-7/
-    (fetchurl {
-      name = "CVE-2019-16275.patch";
-      url = "https://w1.fi/security/2019-7/0001-AP-Silently-ignore-management-frame-from-unexpected-.patch";
-      sha256 = "15xjyy7crb557wxpx898b5lnyblxghlij0xby5lmj9hpwwss34dz";
-    })
-    # Fixes for UPnP SUBSCRIBE misbehavior in hostapd WPS AP (CVE-2020-12695), can be removed >= 2.10
-    # https://w1.fi/security/2020-1/
-    (fetchurl {
-      name = "CVE-2020-12695_0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch";
-      url = "https://w1.fi/security/2020-1/0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch";
-      sha256 = "1mrbhicqb34jlw1nid5hk2vnjbvfhvp7r5iblaj4l6vgc6fmp6id";
-    })
-    (fetchurl {
-      name = "CVE-2020-12695_0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch";
-      url = "https://w1.fi/security/2020-1/0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch";
-      sha256 = "1pk08b06b24is50bis3rr56xjd3b5kxdcdk8bx39n9vna9db7zj9";
-    })
-    (fetchurl {
-      name = "CVE-2020-12695_0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch";
-      url = "https://w1.fi/security/2020-1/0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch";
-      sha256 = "12npqp2skgrj934wwkqicgqksma0fxz09di29n1b5fm5i4njl8d8";
-    })
-    # In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c.
-    (fetchpatch {
-      name = "CVE-2021-30004.patch";
-      url = "https://w1.fi/cgit/hostap/patch/?id=a0541334a6394f8237a4393b7372693cd7e96f15";
-      sha256 = "1gbhlz41x1ar1hppnb76pqxj6vimiypy7c4kq6h658637s4am3xg";
+      url = "https://raw.githubusercontent.com/openwrt/openwrt/eefed841b05c3cd4c65a78b50ce0934d879e6acf/package/network/services/hostapd/patches/300-noscan.patch";
+      sha256 = "08p5frxhpq1rp2nczkscapwwl8g9nc4fazhjpxic5bcbssc3sb00";
     })
   ];
 
diff --git a/pkgs/os-specific/linux/kernel/perf.nix b/pkgs/os-specific/linux/kernel/perf.nix
index 045f80ce9ac..6d1763a0d0f 100644
--- a/pkgs/os-specific/linux/kernel/perf.nix
+++ b/pkgs/os-specific/linux/kernel/perf.nix
@@ -12,7 +12,8 @@ with lib;
 assert versionAtLeast kernel.version "3.12";
 
 stdenv.mkDerivation {
-  name = "perf-linux-${kernel.version}";
+  pname = "perf-linux";
+  version = kernel.version;
 
   inherit (kernel) src;
 
diff --git a/pkgs/os-specific/linux/klibc/default.nix b/pkgs/os-specific/linux/klibc/default.nix
index 522a74dea01..6efcb01cc53 100644
--- a/pkgs/os-specific/linux/klibc/default.nix
+++ b/pkgs/os-specific/linux/klibc/default.nix
@@ -9,11 +9,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "klibc";
-  version = "2.0.9";
+  version = "2.0.10";
 
   src = fetchurl {
     url = "mirror://kernel/linux/libs/klibc/2.0/klibc-${version}.tar.xz";
-    sha256 = "sha256-bcynCJEzINJjCfBbDCv2gHG/EbPa3MTmx9kjg3/CPuE=";
+    sha256 = "sha256-ZidT2oiJ50TfwNtutAIcM3fufvjtZtfVd2X4yeJZOc0=";
   };
 
   patches = [ ./no-reinstall-kernel-headers.patch ];
diff --git a/pkgs/os-specific/linux/kmod-debian-aliases/default.nix b/pkgs/os-specific/linux/kmod-debian-aliases/default.nix
index 23d323f84b8..15f7251f996 100644
--- a/pkgs/os-specific/linux/kmod-debian-aliases/default.nix
+++ b/pkgs/os-specific/linux/kmod-debian-aliases/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, lib }:
 
 stdenv.mkDerivation rec {
-  name = "kmod-debian-aliases-${version}.conf";
+  pname = "kmod-debian-aliases.conf";
   version = "22-1.1";
 
   src = fetchurl {
diff --git a/pkgs/os-specific/linux/libevdevc/default.nix b/pkgs/os-specific/linux/libevdevc/default.nix
index 2417ef6da9d..4998ee3e6b5 100644
--- a/pkgs/os-specific/linux/libevdevc/default.nix
+++ b/pkgs/os-specific/linux/libevdevc/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, coreutils, pkg-config, glib, jsoncpp }:
 
 stdenv.mkDerivation rec {
-  name = "libevdevc";
+  pname = "libevdevc";
   version = "2.0.1";
   src = fetchFromGitHub {
     owner = "hugegreenbug";
diff --git a/pkgs/os-specific/linux/libgestures/default.nix b/pkgs/os-specific/linux/libgestures/default.nix
index bface8118be..1454c0c78a5 100644
--- a/pkgs/os-specific/linux/libgestures/default.nix
+++ b/pkgs/os-specific/linux/libgestures/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, glib, jsoncpp }:
 
 stdenv.mkDerivation rec {
-  name = "libgestures-${version}";
+  pname = "libgestures";
   version = "2.0.1";
   src = fetchFromGitHub {
     owner = "hugegreenbug";
diff --git a/pkgs/os-specific/linux/net-tools/mptcp.nix b/pkgs/os-specific/linux/net-tools/mptcp.nix
index 577b7c25311..b4ce59a7c68 100644
--- a/pkgs/os-specific/linux/net-tools/mptcp.nix
+++ b/pkgs/os-specific/linux/net-tools/mptcp.nix
@@ -1,7 +1,7 @@
 { lib, nettools, fetchFromGitHub  }:
 
 nettools.overrideAttrs(oa: rec {
-  name = "net-tools-mptcp";
+  pname = "net-tools-mptcp";
   version = "0.95";
 
   src = fetchFromGitHub {
diff --git a/pkgs/os-specific/linux/pam_usb/default.nix b/pkgs/os-specific/linux/pam_usb/default.nix
index 8411c4fdbfa..0091accd57a 100644
--- a/pkgs/os-specific/linux/pam_usb/default.nix
+++ b/pkgs/os-specific/linux/pam_usb/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, makeWrapper, dbus, libxml2, pam, pkg-config, pmount, pythonPackages, writeScript, runtimeShell }:
+{ lib, stdenv, fetchurl, makeWrapper, dbus, libxml2, pam, pkg-config, pmount, python2Packages, writeScript, runtimeShell }:
 
 let
 
@@ -29,7 +29,7 @@ let
 
   pmountBin = useSetUID pmount "/bin/pmount";
   pumountBin = useSetUID pmount "/bin/pumount";
-  inherit (pythonPackages) python dbus-python;
+  inherit (python2Packages) python dbus-python;
 in
 
 stdenv.mkDerivation rec {
diff --git a/pkgs/os-specific/linux/pflask/default.nix b/pkgs/os-specific/linux/pflask/default.nix
index 92294b58e42..ba525c1a387 100644
--- a/pkgs/os-specific/linux/pflask/default.nix
+++ b/pkgs/os-specific/linux/pflask/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, python, wafHook }:
+{ lib, stdenv, fetchFromGitHub, python2, wafHook }:
 
 stdenv.mkDerivation rec {
   pname = "pflask";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ wafHook ];
-  buildInputs = [ python ];
+  buildInputs = [ python2 ];
 
   meta = {
     description = "Lightweight process containers for Linux";
diff --git a/pkgs/os-specific/linux/pommed-light/default.nix b/pkgs/os-specific/linux/pommed-light/default.nix
index 0797656f653..e86658ccb0a 100644
--- a/pkgs/os-specific/linux/pommed-light/default.nix
+++ b/pkgs/os-specific/linux/pommed-light/default.nix
@@ -10,13 +10,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  pkgname = "pommed-light";
+  pname = "pommed-light";
   version = "1.51lw";
-  name = "${pkgname}-${version}";
 
   src = fetchFromGitHub {
     owner = "bytbox";
-    repo = pkgname;
+    repo = "pommed-light";
     rev = "v${version}";
     sha256 = "18fvdwwhcl6s4bpf2f2i389s71c8k4g0yb81am9rdddqmzaw27iy";
   };
diff --git a/pkgs/os-specific/linux/sinit/default.nix b/pkgs/os-specific/linux/sinit/default.nix
index f88eca9b487..a412461bfd5 100644
--- a/pkgs/os-specific/linux/sinit/default.nix
+++ b/pkgs/os-specific/linux/sinit/default.nix
@@ -1,36 +1,29 @@
-{lib, stdenv, fetchgit, rcinit ? null, rcshutdown ? null, rcreboot ? null}:
-let
-  s = # Generated upstream information
-  rec {
-    baseName="sinit";
-    version="1.1";
-    name="${baseName}-${version}";
-    url="https://git.suckless.org/sinit/";
-    sha256="sha256-VtXkgixgElKKOT26uKN9feXDVjjtSgTWvcgk5o5MLmw=";
+{ lib, stdenv, fetchgit, rcinit ? null, rcshutdown ? null, rcreboot ? null }:
+
+stdenv.mkDerivation rec {
+  pname = "sinit";
+  version = "1.1";
+
+  src = fetchgit {
+    url = "https://git.suckless.org/sinit/";
+    sha256 = "sha256-VtXkgixgElKKOT26uKN9feXDVjjtSgTWvcgk5o5MLmw=";
     rev = "refs/tags/v${version}";
   };
   buildInputs = [
     (lib.getOutput "static" stdenv.cc.libc)
   ];
-in
-stdenv.mkDerivation {
-  inherit (s) name version;
-  inherit buildInputs;
-  src = fetchgit {
-    inherit (s) url sha256 rev;
-  };
-  makeFlags = ["PREFIX=$(out)"];
+  makeFlags = [ "PREFIX=$(out)" ];
   preConfigure = ""
     + (lib.optionalString (rcinit != null) ''sed -re 's@(rcinitcmd[^"]*")[^"]*"@\1${rcinit}"@' -i config.def.h; '')
     + (lib.optionalString (rcshutdown != null) ''sed -re 's@(rc(reboot|poweroff)cmd[^"]*")[^"]*"@\1${rcshutdown}"@' -i config.def.h; '')
     + (lib.optionalString (rcreboot != null) ''sed -re 's@(rc(reboot)cmd[^"]*")[^"]*"@\1${rcreboot}"@' -i config.def.h; '')
-    ;
-  meta = {
-    inherit (s) version;
+  ;
+
+  meta = with lib; {
     description = "A very minimal Linux init implementation from suckless.org";
-    license = lib.licenses.mit ;
-    maintainers = [lib.maintainers.raskin];
-    platforms = lib.platforms.linux;
+    license = licenses.mit;
+    maintainers = with maintainers; [ raskin ];
+    platforms = platforms.linux;
     homepage = "https://tools.suckless.org/sinit";
     downloadPage = "https://git.suckless.org/sinit";
   };
diff --git a/pkgs/os-specific/linux/smem/default.nix b/pkgs/os-specific/linux/smem/default.nix
index cace3e22ae7..b2636382aec 100644
--- a/pkgs/os-specific/linux/smem/default.nix
+++ b/pkgs/os-specific/linux/smem/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, python }:
+{ lib, stdenv, fetchurl, python2 }:
 
 stdenv.mkDerivation rec {
   pname = "smem";
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "19ibv1byxf2b68186ysrgrhy5shkc5mc69abark1h18yigp3j34m";
   };
 
-  buildInputs = [ python ];
+  buildInputs = [ python2 ];
 
   makeFlags = [ "smemcap" ];
 
diff --git a/pkgs/os-specific/linux/speedometer/default.nix b/pkgs/os-specific/linux/speedometer/default.nix
index 2801334688b..2802fddf8ce 100644
--- a/pkgs/os-specific/linux/speedometer/default.nix
+++ b/pkgs/os-specific/linux/speedometer/default.nix
@@ -1,6 +1,6 @@
-{ lib, fetchurl, pythonPackages }:
+{ lib, fetchurl, python2Packages }:
 
-pythonPackages.buildPythonApplication rec {
+python2Packages.buildPythonApplication rec {
   pname = "speedometer";
   version = "2.8";
 
@@ -9,7 +9,7 @@ pythonPackages.buildPythonApplication rec {
     sha256 = "060bikv3gwr203jbdmvawsfhc0yq0bg1m42dk8czx1nqvwvgv6fm";
   };
 
-  propagatedBuildInputs = [ pythonPackages.urwid ];
+  propagatedBuildInputs = [ python2Packages.urwid ];
 
   postPatch = ''
     sed -i "/'entry_points': {/d" setup.py
diff --git a/pkgs/os-specific/linux/statifier/default.nix b/pkgs/os-specific/linux/statifier/default.nix
index 5afb399fc16..eefd95d1153 100644
--- a/pkgs/os-specific/linux/statifier/default.nix
+++ b/pkgs/os-specific/linux/statifier/default.nix
@@ -1,8 +1,8 @@
 { lib, multiStdenv, fetchurl }:
 
-let version = "1.7.4"; in
-multiStdenv.mkDerivation {
-  name = "statifier-${version}";
+multiStdenv.mkDerivation rec {
+  pname = "statifier";
+  version = "1.7.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/statifier/statifier-${version}.tar.gz";
diff --git a/pkgs/os-specific/linux/sysvinit/default.nix b/pkgs/os-specific/linux/sysvinit/default.nix
index 5f4f6069bcc..091584a93cf 100644
--- a/pkgs/os-specific/linux/sysvinit/default.nix
+++ b/pkgs/os-specific/linux/sysvinit/default.nix
@@ -1,9 +1,8 @@
 { lib, stdenv, fetchurl, withoutInitTools ? false }:
 
-let version = "3.01"; in
-
-stdenv.mkDerivation {
-  name = (if withoutInitTools then "sysvtools" else "sysvinit") + "-" + version;
+stdenv.mkDerivation rec {
+  pname = if withoutInitTools then "sysvtools" else "sysvinit";
+  version = "3.01";
 
   src = fetchurl {
     url = "mirror://savannah/sysvinit/sysvinit-${version}.tar.xz";
diff --git a/pkgs/os-specific/linux/tmon/default.nix b/pkgs/os-specific/linux/tmon/default.nix
index 5a14d3d2ee3..3a2697e0a71 100644
--- a/pkgs/os-specific/linux/tmon/default.nix
+++ b/pkgs/os-specific/linux/tmon/default.nix
@@ -1,7 +1,8 @@
 { lib, stdenv, kernel, ncurses }:
 
 stdenv.mkDerivation {
-  name = "tmon-${kernel.version}";
+  pname = "tmon";
+  version = kernel.version;
 
   inherit (kernel) src;
 
diff --git a/pkgs/os-specific/linux/uclibc/default.nix b/pkgs/os-specific/linux/uclibc/default.nix
index a0b748be214..1d4166e4083 100644
--- a/pkgs/os-specific/linux/uclibc/default.nix
+++ b/pkgs/os-specific/linux/uclibc/default.nix
@@ -54,7 +54,7 @@ let
 in
 
 stdenv.mkDerivation {
-  name = "uclibc-ng-${version}";
+  pname = "uclibc-ng";
   inherit version;
 
   src = fetchurl {
diff --git a/pkgs/os-specific/linux/unstick/default.nix b/pkgs/os-specific/linux/unstick/default.nix
index 7d839f8acdb..7856456a3c3 100644
--- a/pkgs/os-specific/linux/unstick/default.nix
+++ b/pkgs/os-specific/linux/unstick/default.nix
@@ -1,12 +1,12 @@
 { stdenv, lib, fetchFromGitHub, meson, ninja, pkg-config, libseccomp }:
 
 stdenv.mkDerivation rec {
-  name = "unstick";
+  pname = "unstick";
   version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "kwohlfahrt";
-    repo = name;
+    repo = "unstick";
     rev = "effee9aa242ca12dc94cc6e96bc073f4cc9e8657";
     sha256 = "08la3jmmzlf4pm48bf9zx4cqj9gbqalpqy0s57bh5vfsdk74nnhv";
   };
diff --git a/pkgs/os-specific/linux/wpa_supplicant/default.nix b/pkgs/os-specific/linux/wpa_supplicant/default.nix
index 656fa477768..e48dce4f313 100644
--- a/pkgs/os-specific/linux/wpa_supplicant/default.nix
+++ b/pkgs/os-specific/linux/wpa_supplicant/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, openssl, pkg-config, libnl
+{ lib, stdenv, fetchurl, openssl, pkg-config, libnl
 , nixosTests
 , withDbus ? true, dbus
 , withReadline ? true, readline
@@ -8,45 +8,16 @@
 
 with lib;
 stdenv.mkDerivation rec {
-  version = "2.9";
+  version = "2.10";
 
   pname = "wpa_supplicant";
 
   src = fetchurl {
     url = "https://w1.fi/releases/${pname}-${version}.tar.gz";
-    sha256 = "05qzak1mssnxcgdrafifxh9w86a4ha69qabkg4bsigk499xyxggw";
+    sha256 = "sha256-IN965RVLODA1X4q0JpEjqHr/3qWf50/pKSqR0Nfhey8=";
   };
 
   patches = [
-    (fetchurl {
-      name = "CVE-2019-16275.patch";
-      url = "https://w1.fi/security/2019-7/0001-AP-Silently-ignore-management-frame-from-unexpected-.patch";
-      sha256 = "15xjyy7crb557wxpx898b5lnyblxghlij0xby5lmj9hpwwss34dz";
-    })
-    (fetchpatch {
-      # Expose OWE key management capability over DBus, remove >= 2.10
-      name = "dbus-Export-OWE-capability-and-OWE-BSS-key_mgmt.patch";
-      url = "https://w1.fi/cgit/hostap/patch/?id=7800725afb27397f7d6033d4969e2aeb61af4737";
-      sha256 = "0c1la7inf4m5y9gzdjjdnhpkx32pm8vi6m5knih8p77q4mbrdgg8";
-    })
-    # P2P: Fix copying of secondary device types for P2P group client (https://w1.fi/security/2020-2/)
-    (fetchurl {
-      name = "CVE-2021-0326.patch";
-      url = "https://w1.fi/security/2020-2/0001-P2P-Fix-copying-of-secondary-device-types-for-P2P-gr.patch";
-      sha256 = "19f4hx0p547mdx8y8arb3vclwyy4w9c8a6a40ryj7q33730mrmn4";
-    })
-    # P2P: Fix a corner case in peer addition based on PD Request (https://w1.fi/security/2021-1/)
-    (fetchurl {
-      name = "CVE-2021-27803.patch";
-      url = "https://w1.fi/security/2021-1/0001-P2P-Fix-a-corner-case-in-peer-addition-based-on-PD-R.patch";
-      sha256 = "04cnds7hmbqc44jasabjvrdnh66i5hwvk2h2m5z94pmgbzncyh3z";
-    })
-    # In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c.
-    (fetchpatch {
-      name = "CVE-2021-30004.patch";
-      url = "https://w1.fi/cgit/hostap/patch/?id=a0541334a6394f8237a4393b7372693cd7e96f15";
-      sha256 = "1gbhlz41x1ar1hppnb76pqxj6vimiypy7c4kq6h658637s4am3xg";
-    })
   ] ++ lib.optionals readOnlyModeSSIDs [
     # Allow read-only networks
     ./0001-Implement-read-only-mode-for-ssids.patch
diff --git a/pkgs/os-specific/linux/x86info/default.nix b/pkgs/os-specific/linux/x86info/default.nix
index dbda35670f6..e842b59651e 100644
--- a/pkgs/os-specific/linux/x86info/default.nix
+++ b/pkgs/os-specific/linux/x86info/default.nix
@@ -1,4 +1,4 @@
-{lib, stdenv, fetchurl, pciutils, python}:
+{lib, stdenv, fetchurl, pciutils, python2}:
 
 stdenv.mkDerivation rec {
   version = "1.30";
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     sed -i 's/-Werror -Wall//' Makefile
   '';
 
-  buildInputs = [ pciutils python ];
+  buildInputs = [ pciutils python2 ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/servers/adguardhome/default.nix b/pkgs/servers/adguardhome/default.nix
index 9940decc0bc..dcf397ed4b2 100644
--- a/pkgs/servers/adguardhome/default.nix
+++ b/pkgs/servers/adguardhome/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchzip }:
+{ lib, stdenv, fetchurl, fetchzip, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "adguardhome";
@@ -12,6 +12,7 @@ stdenv.mkDerivation rec {
 
   passthru = {
     updateScript = ./update.sh;
+    tests.adguardhome = nixosTests.adguardhome;
   };
 
   meta = with lib; {
diff --git a/pkgs/servers/alps/default.nix b/pkgs/servers/alps/default.nix
new file mode 100644
index 00000000000..f367dc59401
--- /dev/null
+++ b/pkgs/servers/alps/default.nix
@@ -0,0 +1,24 @@
+{ lib, buildGoModule, fetchFromSourcehut }:
+
+buildGoModule rec {
+  pname = "alps";
+  version = "2021-09-29";
+
+  src = fetchFromSourcehut {
+    owner = "~migadu";
+    repo = "alps";
+    rev = "d4c35f3c3157bece8e50fd95f2ee1081be30d7ae";
+    sha256 = "sha256-xKfRLdfeD7lWdmC0iiq4dOIv2SmzbKH7HcAISCJgdug=";
+  };
+
+  vendorSha256 = "sha256-8fmbv5uPRfzUqsYU95YzsnuFkq4cwj+LN2X3W/yBHyA=";
+
+  proxyVendor = true;
+
+  meta = with lib; {
+    description = "A simple and extensible webmail.";
+    homepage = "https://git.sr.ht/~migadu/alps";
+    license = licenses.mit;
+    maintainers = with maintainers; [ gordias ];
+  };
+}
diff --git a/pkgs/servers/amqp/rabbitmq-server/default.nix b/pkgs/servers/amqp/rabbitmq-server/default.nix
index a8b837c8b3e..a5b36ad5c4a 100644
--- a/pkgs/servers/amqp/rabbitmq-server/default.nix
+++ b/pkgs/servers/amqp/rabbitmq-server/default.nix
@@ -3,7 +3,7 @@
 , fetchurl
 , erlang
 , elixir
-, python
+, python2
 , libxml2
 , libxslt
 , xmlto
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ unzip xmlto docbook_xml_dtd_45 docbook_xsl zip rsync ];
-  buildInputs = [ erlang elixir python libxml2 libxslt glibcLocales ]
+  buildInputs = [ erlang elixir python2 libxml2 libxslt glibcLocales ]
     ++ lib.optionals stdenv.isDarwin [ AppKit Carbon Cocoa ];
 
   outputs = [ "out" "man" "doc" ];
diff --git a/pkgs/servers/computing/storm/default.nix b/pkgs/servers/computing/storm/default.nix
index 146db2ea5de..cf6427c860c 100644
--- a/pkgs/servers/computing/storm/default.nix
+++ b/pkgs/servers/computing/storm/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, zip, unzip
-, jdk, python
+, jdk, python2
 , confFile ? ""
 , extraLibraryPaths ? []
 , extraJars ? []
@@ -30,11 +30,11 @@ stdenv.mkDerivation rec {
   fixupPhase = ''
     # Fix python reference
     sed -i \
-      -e '19iPYTHON=${python}/bin/python' \
-      -e 's|#!/usr/bin/.*python|#!${python}/bin/python|' \
+      -e '19iPYTHON=${python2}/bin/python' \
+      -e 's|#!/usr/bin/.*python|#!${python2}/bin/python|' \
       $out/bin/storm
     sed -i \
-      -e 's|#!/usr/bin/.*python|#!${python}/bin/python|' \
+      -e 's|#!/usr/bin/.*python|#!${python2}/bin/python|' \
       -e "s|STORM_CONF_DIR = .*|STORM_CONF_DIR = os.getenv('STORM_CONF_DIR','$out/conf')|" \
       -e 's|STORM_LOG4J2_CONF_DIR =.*|STORM_LOG4J2_CONF_DIR = os.path.join(STORM_CONF_DIR, "log4j2")|' \
         $out/bin/storm.py
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index aab639140e5..8888fba7b74 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2021.12.9";
+  version = "2021.12.10";
   components = {
     "abode" = ps: with ps; [ abodepy ];
     "accuweather" = ps: with ps; [ accuweather ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 1cf23984adb..0cb5e13fbd2 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -177,7 +177,7 @@ let
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2021.12.9";
+  hassVersion = "2021.12.10";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -194,7 +194,7 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = version;
-    hash = "sha256:17lh16c9kklx4q416ns12qjh1hc0g79y56kdkj1pvybblg0a07lm";
+    hash = "sha256:0nyddcjy4diq5bakpb76frax44i0jraj2vvpfxrj50h9l5pdwsaf";
   };
 
   # leave this in, so users don't have to constantly update their downstream patch handling
diff --git a/pkgs/servers/http/lighttpd/default.nix b/pkgs/servers/http/lighttpd/default.nix
index 4f98e3c7dab..356b21d354f 100644
--- a/pkgs/servers/http/lighttpd/default.nix
+++ b/pkgs/servers/http/lighttpd/default.nix
@@ -9,21 +9,34 @@
 , enableWebDAV ? false, sqlite, libuuid
 , enableExtendedAttrs ? false, attr
 , perl
+, fetchpatch
 }:
 
 stdenv.mkDerivation rec {
   pname = "lighttpd";
-  version = "1.4.59";
+  version = "1.4.63";
 
   src = fetchurl {
     url = "https://download.lighttpd.net/lighttpd/releases-${lib.versions.majorMinor version}.x/${pname}-${version}.tar.xz";
-    sha256 = "sha256-+5U9snPa7wjttuICVWyuij0H7tYIHJa9mQPblX0QhNU=";
+    sha256 = "1fgasvif13gvzz4rf5mjpy28cbw9fs4ymhx18494mxgb080pzvra";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2022-22707.patch";
+      url = "https://github.com/lighttpd/lighttpd1.4/commit/8c62a890e23f5853b1a562b03fe3e1bccc6e7664.patch";
+      sha256 = "0zm2khgllsd1ivh9m7sisfsyrdfz45zsmiwl963wf0gn8m100gzk";
+    })
+  ];
+
   postPatch = ''
     patchShebangs tests
     # Linux sandbox has an empty hostname and not /etc/hosts, which fails some tests
     sed -ire '/[$]self->{HOSTNAME} *=/i     if(length($name)==0) { $name = "127.0.0.1" }' tests/LightyTest.pm
+    # it's difficult to prevent this test from trying to use /var/tmp (which
+    # the sandbox doesn't have) so until libredirect has support for mkstemp
+    # calls it's easiest to disable it
+    sed -i '/test_mod_ssi/d' src/t/test_mod.c
   '';
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
diff --git a/pkgs/servers/keycloak/default.nix b/pkgs/servers/keycloak/default.nix
index ef168272fe7..9d8a2b31bf1 100644
--- a/pkgs/servers/keycloak/default.nix
+++ b/pkgs/servers/keycloak/default.nix
@@ -18,11 +18,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname   = "keycloak";
-  version = "15.1.0";
+  version = "16.1.0";
 
   src = fetchzip {
     url    = "https://github.com/keycloak/keycloak/releases/download/${version}/keycloak-${version}.zip";
-    sha256 = "0s8nvp1ca30569k1a7glbn2zvvchz35s2r8d08fbs5zjngnz3276";
+    sha256 = "sha256-QVFu3f+mwafoNUttLEVMdoZHMJjjH/TpZAGV7ZvIvh0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/mapserver/default.nix b/pkgs/servers/mapserver/default.nix
index 4735264f0a9..f8b0d8196fa 100644
--- a/pkgs/servers/mapserver/default.nix
+++ b/pkgs/servers/mapserver/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, cmake, pkg-config
 , cairo, curl, fcgi, freetype, fribidi, gdal, geos, giflib, harfbuzz
 , libjpeg, libpng, librsvg, libxml2, postgresql, proj, protobufc, zlib
-, withPython ? true, swig, python
+, withPython ? true, swig, python2
 }:
 
 stdenv.mkDerivation rec {
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     proj
     protobufc
     zlib
-  ] ++ lib.optional withPython python;
+  ] ++ lib.optional withPython python2;
 
   cmakeFlags = [
     "-DWITH_KML=ON"
diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index dbb6fbc84f5..e8a887fa93c 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -11,11 +11,11 @@ in
 with python3.pkgs;
 buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.49.2";
+  version = "1.50.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7b795ecfc36e3f57eb7cffbc5ef9da1745b777536416c31509b3e6220c39ca4d";
+    sha256 = "sha256-fdO+HJ1+fk+s65jLkPDiG+Ei89x5Fbkh9BUUFQ3NJ3M=";
   };
 
   buildInputs = [ openssl ];
@@ -31,6 +31,7 @@ buildPythonApplication rec {
     jinja2
     jsonschema
     lxml
+    matrix-common
     msgpack
     netaddr
     phonenumbers
diff --git a/pkgs/servers/mattermost/default.nix b/pkgs/servers/mattermost/default.nix
index fc8a299d251..2630bb4d56a 100644
--- a/pkgs/servers/mattermost/default.nix
+++ b/pkgs/servers/mattermost/default.nix
@@ -10,7 +10,7 @@
 , storePathAsBuildHash ? false }:
 
 let
-  version = "6.2.1";
+  version = "6.3.0";
 
   goPackagePath = "github.com/mattermost/mattermost-server";
 
@@ -22,7 +22,7 @@ let
       owner = "mattermost";
       repo = "mattermost-server";
       rev = "v${version}";
-      sha256 = "WjBsbW7aEI+MX2I1LrEJh8JgNQ4Do7PpeshXgaQAk1s=";
+      sha256 = "y3VTDl01UrMpgoN06lf98C+uTu2N9u0EAWYADPpOI3w=";
     };
 
     ldflags = [
@@ -65,7 +65,7 @@ let
 
     src = fetchurl {
       url = "https://releases.mattermost.com/${version}/mattermost-${version}-linux-amd64.tar.gz";
-      sha256 = "pV/MwMCK8vMzASXuM1+ePcarIgrcNAkFLEdmPya911E=";
+      sha256 = "PqinkPC7J6Ng1fjTrcAa6ZqiyB2JKkGRdvJ6h2wNS5w=";
     };
 
     installPhase = ''
diff --git a/pkgs/servers/mautrix-facebook/default.nix b/pkgs/servers/mautrix-facebook/default.nix
index b3fdef8698b..33df669aaac 100644
--- a/pkgs/servers/mautrix-facebook/default.nix
+++ b/pkgs/servers/mautrix-facebook/default.nix
@@ -7,13 +7,13 @@
 
 python3.pkgs.buildPythonPackage rec {
   pname = "mautrix-facebook";
-  version = "0.3.2";
+  version = "2022-01-10";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "facebook";
-    rev = "v${version}";
-    sha256 = "1n7gshm2nir6vgjkj36lq9m2bclkgy0y236xi8zvdlvfcb2m596f";
+    rev = "eebfbe49fc699806e1d71becf261ba0995c91f60";
+    hash = "sha256-zfsuoPySIRAAmsSL0NUUVH7k+xV7rZOHOkIvBQdVe0A=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
@@ -30,9 +30,13 @@ python3.pkgs.buildPythonPackage rec {
     ruamel-yaml
     unpaddedbase64
     yarl
+    zstandard
   ] ++ lib.optional enableSystemd systemd;
 
-  doCheck = false;
+  postPatch = ''
+    # Drop version limiting so that every dependency update doesn't break this package.
+    sed -i -e 's/,<.*//' requirements.txt
+  '';
 
   postInstall = ''
     mkdir -p $out/bin
@@ -44,6 +48,10 @@ python3.pkgs.buildPythonPackage rec {
     chmod +x $out/bin/mautrix-facebook
   '';
 
+  checkPhase = ''
+    $out/bin/mautrix-facebook --help
+  '';
+
   meta = with lib; {
     homepage = "https://github.com/mautrix/facebook";
     description = "A Matrix-Facebook Messenger puppeting bridge";
diff --git a/pkgs/servers/mautrix-whatsapp/default.nix b/pkgs/servers/mautrix-whatsapp/default.nix
index d0d11f0937d..7579db1c090 100644
--- a/pkgs/servers/mautrix-whatsapp/default.nix
+++ b/pkgs/servers/mautrix-whatsapp/default.nix
@@ -2,18 +2,18 @@
 
 buildGo117Module rec {
   pname = "mautrix-whatsapp";
-  version = "0.2.2";
+  version = "0.2.3";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "whatsapp";
     rev = "v${version}";
-    sha256 = "sha256-W+5DtCp7P/0azfusv+Nt3G9VcWKPUxVJmNwSfPjxjbw=";
+    sha256 = "sha256-vMRmxu1TNCw5c+PuSdAPdMJpZGLdcCTzpTNz/AFrWi8=";
   };
 
   buildInputs = [ olm ];
 
-  vendorSha256 = "sha256-maGnlnxyhrvW0NkHmHWEvNge5c/HxLDm8NuWR6zcdYg=";
+  vendorSha256 = "sha256-bvbZ7Tnd6s6zr9trN4egR/9KV5cU09mQI+U1UxyYzlE=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/misc/oven-media-engine/default.nix b/pkgs/servers/misc/oven-media-engine/default.nix
index 6a63292301b..bc047f6552a 100644
--- a/pkgs/servers/misc/oven-media-engine/default.nix
+++ b/pkgs/servers/misc/oven-media-engine/default.nix
@@ -2,57 +2,37 @@
 , fetchFromGitHub
 , fetchpatch
 , srt
-, ffmpeg_3_4
 , bc
 , pkg-config
 , perl
-, openssl
+, openssl_3_0
 , zlib
 , ffmpeg
 , libvpx
 , libopus
+, libuuid
 , srtp
 , jemalloc
 , pcre2
 }:
 
-let
-  ffmpeg = ffmpeg_3_4.overrideAttrs (super: {
-    pname = "${super.pname}-ovenmediaengine";
-    src = fetchFromGitHub {
-      owner = "Airensoft";
-      repo = "FFmpeg";
-      rev = "142b4bb64b64e337f80066e6af935a68627fedae";  # on branch ome/3.4
-      sha256 = "0fla3940q3z0c0ik2xzkbvdfvrdg06ban7wi6y94y8mcipszpp11";
-    };
-  });
-in
 stdenv.mkDerivation rec {
   pname = "oven-media-engine";
-  version = "0.10.9-hotfix";
+  version = "0.12.9";
 
   src = fetchFromGitHub {
     owner = "AirenSoft";
     repo = "OvenMediaEngine";
     rev = "v${version}";
-    sha256 = "1fhria0vwqsgmsglv5gn858li33vfy2dwy1f1qdd2jwikskb53am";
+    sha256 = "0d3ymw747frl40w5d6r33lf1s72v7fiv742yjr1m6la2phb9h834";
   };
 
-  patches = [
-    (fetchpatch {
-      # Needed to fix compilation under GCC 10.
-      url = "https://github.com/AirenSoft/OvenMediaEngine/commit/ad83e1d2226445d649e4b7e0c75106e31af4940d.patch";
-      sha256 = "1zk1rgi1wsjl6gdx3hdmgxlgindv6a3lsnkwcgi87ga9abw4vafw";
-      stripLen = 1;
-    })
-  ];
-
   sourceRoot = "source/src";
   makeFlags = "release CONFIG_LIBRARY_PATHS= CONFIG_PKG_PATHS= GLOBAL_CC=$(CC) GLOBAL_CXX=$(CXX) GLOBAL_LD=$(CXX) SHELL=${stdenv.shell}";
   enableParallelBuilding = true;
 
   nativeBuildInputs = [ bc pkg-config perl ];
-  buildInputs = [ openssl srt zlib ffmpeg libvpx libopus srtp jemalloc pcre2 ];
+  buildInputs = [ openssl_3_0 srt zlib ffmpeg libvpx libopus srtp jemalloc pcre2 libuuid ];
 
   preBuild = ''
     patchShebangs core/colorg++
diff --git a/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix b/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix
index eba2347333a..ed6afbcd252 100644
--- a/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix
+++ b/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix
@@ -1,27 +1,32 @@
-{ lib, stdenv, fetchFromGitHub, file, openssl, makeWrapper, which, curl, fetchpatch }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, file
+, openssl
+, makeWrapper
+, which
+, curl
+}:
 
 stdenv.mkDerivation rec {
   pname = "check_ssl_cert";
-  version = "1.80.0";
+  version = "2.19.0";
 
   src = fetchFromGitHub {
     owner = "matteocorti";
     repo = "check_ssl_cert";
     rev = "v${version}";
-    sha256 = "1jkwii45hynil1jail9gmz4bak066rdi8zfcczicjsa6npbz50w4";
+    sha256 = "sha256-HNvchmP975k971EYpDFCqxx8w1Oq/IIEy+r1il0PjmQ=";
   };
 
-  patches = [
-    # https://github.com/matteocorti/check_ssl_cert/pull/114
-    (fetchpatch {
-      url = "https://github.com/matteocorti/check_ssl_cert/commit/2b7aad583d507a70605dd44d918739a65b267bfd.patch";
-      sha256 = "1jk872jgm6k3qc1ks1h3v6p804spjlnxcj2wc8v0hkmwfwiwd2k4";
-    })
+  nativeBuildInputs = [
+    makeWrapper
   ];
 
-  nativeBuildInputs = [ makeWrapper ];
-
-  makeFlags = [ "DESTDIR=$(out)/bin" "MANDIR=$(out)/share/man" ];
+  makeFlags = [
+    "DESTDIR=$(out)/bin"
+    "MANDIR=$(out)/share/man"
+  ];
 
   postInstall = ''
     wrapProgram $out/bin/check_ssl_cert \
@@ -29,8 +34,10 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = "A Nagios plugin to check the CA and validity of an X.509 certificate";
-    license = licenses.gpl3;
+    description = "Nagios plugin to check the CA and validity of an X.509 certificate";
+    homepage = "https://github.com/matteocorti/check_ssl_cert";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/servers/nats-server/default.nix b/pkgs/servers/nats-server/default.nix
index 01f3710ff2b..226294e5f42 100644
--- a/pkgs/servers/nats-server/default.nix
+++ b/pkgs/servers/nats-server/default.nix
@@ -4,7 +4,7 @@ with lib;
 
 buildGoPackage rec {
   pname   = "nats-server";
-  version = "2.6.3";
+  version = "2.7.0";
 
   goPackagePath = "github.com/nats-io/${pname}";
 
@@ -12,7 +12,7 @@ buildGoPackage rec {
     rev    = "v${version}";
     owner  = "nats-io";
     repo   = pname;
-    sha256 = "sha256-7srDyTsIyac4AYwTFpDji4Czg6rRK9evb4W25CqQgGk=";
+    sha256 = "sha256-LQ817nZrFkF1zdj2m2SQK58BqDbUPSnncSWR+Woi+Ao=";
   };
 
   meta = {
diff --git a/pkgs/servers/nats-streaming-server/default.nix b/pkgs/servers/nats-streaming-server/default.nix
index 3de95b4f113..4d6fdbda636 100644
--- a/pkgs/servers/nats-streaming-server/default.nix
+++ b/pkgs/servers/nats-streaming-server/default.nix
@@ -4,14 +4,14 @@ with lib;
 
 buildGoPackage rec {
   pname   = "nats-streaming-server";
-  version = "0.22.1";
+  version = "0.23.0";
   goPackagePath = "github.com/nats-io/${pname}";
 
   src = fetchFromGitHub {
     rev    = "v${version}";
     owner  = "nats-io";
     repo   = pname;
-    sha256 = "sha256-VdYyui0fyoNf1q3M1xTg/UMlxIFABqAbqQaD0bLpKCY=";
+    sha256 = "sha256-Uol1A4+0V4dUQ7Qw0qRUWHzFBugVDYSulDGTJZ4a+ts=";
   };
 
   meta = {
diff --git a/pkgs/servers/nosql/apache-jena/binary.nix b/pkgs/servers/nosql/apache-jena/binary.nix
index 099920b2841..32bc4449e12 100644
--- a/pkgs/servers/nosql/apache-jena/binary.nix
+++ b/pkgs/servers/nosql/apache-jena/binary.nix
@@ -1,38 +1,27 @@
-{lib, stdenv, fetchurl, java, makeWrapper}:
-let
-  s = # Generated upstream information
-  rec {
-    baseName="apache-jena";
-    version = "4.3.2";
-    name="${baseName}-${version}";
-    url="https://dlcdn.apache.org/jena/binaries/apache-jena-${version}.tar.gz";
+{ lib, stdenv, fetchurl, java, makeWrapper }:
+
+stdenv.mkDerivation rec {
+  pname = "apache-jena";
+  version = "4.3.2";
+  src = fetchurl {
+    url = "https://dlcdn.apache.org/jena/binaries/apache-jena-${version}.tar.gz";
     sha256 = "sha256-+GNxf79RkmHUXI99e3BZIyboiEj8TiVfVtlgQADku+Y=";
   };
   buildInputs = [
     makeWrapper
   ];
-in
-stdenv.mkDerivation {
-  inherit (s) name version;
-  inherit buildInputs;
-  src = fetchurl {
-    inherit (s) url sha256;
-  };
   installPhase = ''
     cp -r . "$out"
     for i in "$out"/bin/*; do
       wrapProgram "$i" --prefix "PATH" : "${java}/bin/"
     done
   '';
-  meta = {
-    inherit (s) version;
+  meta = with lib; {
     description = "RDF database";
-    license = lib.licenses.asl20;
-    maintainers = [lib.maintainers.raskin];
-    platforms = lib.platforms.linux;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ raskin ];
+    platforms = platforms.linux;
     homepage = "https://jena.apache.org";
     downloadPage = "https://archive.apache.org/dist/jena/binaries/";
-    updateWalker = true;
-    downloadURLRegexp = "apache-jena-.*[.]tar[.]gz\$";
   };
 }
diff --git a/pkgs/servers/nosql/apache-jena/fuseki-binary.nix b/pkgs/servers/nosql/apache-jena/fuseki-binary.nix
index 65a9dff3417..d7c53bc7aa8 100644
--- a/pkgs/servers/nosql/apache-jena/fuseki-binary.nix
+++ b/pkgs/servers/nosql/apache-jena/fuseki-binary.nix
@@ -1,23 +1,15 @@
-{lib, stdenv, fetchurl, java, makeWrapper}:
-let
-  s = # Generated upstream information
-  rec {
-    baseName="apache-jena-fuseki";
-    version = "4.3.1";
-    name="${baseName}-${version}";
-    url="https://dlcdn.apache.org/jena/binaries/apache-jena-fuseki-${version}.tar.gz";
+{ lib, stdenv, fetchurl, java, makeWrapper }:
+
+stdenv.mkDerivation rec {
+  pname = "apache-jena-fuseki";
+  version = "4.3.1";
+  src = fetchurl {
+    url = "https://dlcdn.apache.org/jena/binaries/apache-jena-fuseki-${version}.tar.gz";
     sha256 = "1r0vfa7d55lzw22yfx46mxxmz8x8pkr666vggqw2m1rzzj52z9nx";
   };
   buildInputs = [
     makeWrapper
   ];
-in
-stdenv.mkDerivation {
-  inherit (s) name version;
-  inherit buildInputs;
-  src = fetchurl {
-    inherit (s) url sha256;
-  };
   installPhase = ''
     cp -r . "$out"
     chmod +x $out/fuseki
@@ -29,14 +21,12 @@ stdenv.mkDerivation {
         ;
     done
   '';
-  meta = {
-    inherit (s) version;
+  meta = with lib; {
     description = "SPARQL server";
-    license = lib.licenses.asl20;
-    maintainers = [lib.maintainers.raskin];
-    platforms = lib.platforms.linux;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ raskin ];
+    platforms = platforms.linux;
     homepage = "https://jena.apache.org";
     downloadPage = "https://archive.apache.org/dist/jena/binaries/";
-    downloadURLRegexp = "apache-jena-fuseki-.*[.]tar[.]gz\$";
   };
 }
diff --git a/pkgs/servers/ombi/default.nix b/pkgs/servers/ombi/default.nix
index 0be7a3f0097..1e63b44450e 100644
--- a/pkgs/servers/ombi/default.nix
+++ b/pkgs/servers/ombi/default.nix
@@ -10,14 +10,14 @@ let
     "Unsupported system: ${stdenv.hostPlatform.system}");
 
   hash = {
-    x64-linux_hash = "sha256-4kvcBRMMH4AnTKSES5Cpst/omTRXVRq1V1y/z5njKJI=";
-    arm64-linux_hash = "sha256-NLsf0ldvlKSrHJyAXv5Ar2zIetoga6iZPOGTxFOqoQQ=";
-    x64-osx_hash = "sha256-tjvGuShz/fv3qUknFVKJ+tE/bVtIyPZ7dr4JfTEcDJY=";
+    x64-linux_hash = "sha256-BLtoT6UHsur+jFp4KBlE10/Z/V6RDy0k16H10IC98WQ=";
+    arm64-linux_hash = "sha256-s8EV/VqiUXWRTNxacx4sy6r+TIAqkqhESAYYa9s0uAQ=";
+    x64-osx_hash = "sha256-woXFYmX+499NTtWmmGBpZ12PxTUazJ8klA6IPQIDjLE=";
   }."${arch}-${os}_hash";
 
 in stdenv.mkDerivation rec {
   pname = "ombi";
-  version = "4.0.1468";
+  version = "4.3.3";
 
   sourceRoot = ".";
 
diff --git a/pkgs/servers/ombi/update.sh b/pkgs/servers/ombi/update.sh
index 1503edde998..a549a9f1731 100755
--- a/pkgs/servers/ombi/update.sh
+++ b/pkgs/servers/ombi/update.sh
@@ -15,7 +15,7 @@ updateHash()
 
     url="https://github.com/Ombi-app/Ombi/releases/download/v$version/$os-$arch.tar.gz"
     hash=$(nix-prefetch-url --type sha256 $url)
-    sriHash="$(nix to-sri --type sha256 $hash)"
+    sriHash="$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $hash)"
 
     sed -i "s|$hashKey = \"[a-zA-Z0-9\/+-=]*\";|$hashKey = \"$sriHash\";|g" "$dirname/default.nix"
 }
diff --git a/pkgs/servers/plex/raw.nix b/pkgs/servers/plex/raw.nix
index 980e6457711..b2a1b78e854 100644
--- a/pkgs/servers/plex/raw.nix
+++ b/pkgs/servers/plex/raw.nix
@@ -12,16 +12,16 @@
 # server, and the FHS userenv and corresponding NixOS module should
 # automatically pick up the changes.
 stdenv.mkDerivation rec {
-  version = "1.25.2.5319-c43dc0277";
+  version = "1.25.3.5409-f11334058";
   pname = "plexmediaserver";
 
   # Fetch the source
   src = if stdenv.hostPlatform.system == "aarch64-linux" then fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_arm64.deb";
-    sha256 = "09kkkyli5fygyvlzqd46jzi0y4jp0a24d92ayvfm95gm3fcxl73x";
+    hash = "sha256-Q0768UxZXSuUm26Ro2XIrw8qoQEWCU23P7EBtbiIa0c=";
   } else fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_amd64.deb";
-    sha256 = "17whd724sjblqxz6d79jb6hrqvkgg5mbh3bh1lr9b8sswa3pxb07";
+    hash = "sha256-TaOvXVeo385vqtv/dYvmQQx8c1K/EMw4MTDucg511Cs=";
   };
 
   outputs = [ "out" "basedb" ];
diff --git a/pkgs/servers/sickbeard/sickgear.nix b/pkgs/servers/sickbeard/sickgear.nix
index d55888066a0..df2e9fe03ab 100644
--- a/pkgs/servers/sickbeard/sickgear.nix
+++ b/pkgs/servers/sickbeard/sickgear.nix
@@ -4,13 +4,13 @@ let
   pythonEnv = python3.withPackages(ps: with ps; [ cheetah3 ]);
 in stdenv.mkDerivation rec {
   pname = "sickgear";
-  version = "0.25.11";
+  version = "0.25.24";
 
   src = fetchFromGitHub {
     owner = "SickGear";
     repo = "SickGear";
     rev = "release_${version}";
-    sha256 = "sha256-0/Ez10IWvh84G//1vCZMLiu4+Y2+XcVLw9Gm9X+DY0s=";
+    sha256 = "sha256-x6v7CKJkN6gt9askpp/W0CVCKvRaHLBXbagtC+rVNVc=";
   };
 
   dontBuild = true;
diff --git a/pkgs/servers/sql/postgresql/ext/plv8.nix b/pkgs/servers/sql/postgresql/ext/plv8.nix
index 6f5411340e4..eaf9c389e92 100644
--- a/pkgs/servers/sql/postgresql/ext/plv8.nix
+++ b/pkgs/servers/sql/postgresql/ext/plv8.nix
@@ -1,6 +1,8 @@
-{ lib, stdenv, fetchFromGitHub, v8, perl, postgresql }:
+{ lib, stdenv, fetchFromGitHub, v8, perl, postgresql
+# For test
+, runCommand, coreutils, gnugrep }:
 
-stdenv.mkDerivation rec {
+let self = stdenv.mkDerivation rec {
   pname = "plv8";
   version = "3.0.0";
 
@@ -29,6 +31,8 @@ stdenv.mkDerivation rec {
   ];
 
   preConfigure = ''
+    # We build V8 as a monolith, so this is unnecessary.
+    substituteInPlace Makefile.shared --replace "-lv8_libplatform" ""
     patchShebangs ./generate_upgrade.sh
     substituteInPlace generate_upgrade.sh \
       --replace " 2.3.10)" " 2.3.10 2.3.11 2.3.12 2.3.13 2.3.14 2.3.15)"
@@ -42,10 +46,36 @@ stdenv.mkDerivation rec {
     rmdir "$out/nix/store"/* "$out/nix/store" "$out/nix"
   '';
 
-  # Without this, PostgreSQL will crash at runtime.
-  # The flags are only included in Makefile, not Makefile.shared.
-  # https://github.com/plv8/plv8/pull/469
-  NIX_CFLAGS_COMPILE = "-DJSONB_DIRECT_CONVERSION -DV8_COMPRESS_POINTERS=1 -DV8_31BIT_SMIS_ON_64BIT_ARCH=1";
+  NIX_CFLAGS_COMPILE = [
+    # V8 depends on C++14.
+    "-std=c++14"
+    # Without this, PostgreSQL will crash at runtime.
+    # The flags are only included in Makefile, not Makefile.shared.
+    # https://github.com/plv8/plv8/pull/469
+    "-DJSONB_DIRECT_CONVERSION" "-DV8_COMPRESS_POINTERS=1" "-DV8_31BIT_SMIS_ON_64BIT_ARCH=1"
+  ];
+
+  passthru.tests.smoke = runCommand "${pname}-test" {} ''
+    export PATH=${lib.makeBinPath [ (postgresql.withPackages (_: [self])) coreutils gnugrep ]}
+    db="$PWD/testdb"
+    initdb "$db"
+    postgres -k "$db" -D "$db" &
+    pid="$!"
+
+    for i in $(seq 1 100); do
+      if psql -h "$db" -d postgres -c "" 2>/dev/null; then
+        break
+      elif ! kill -0 "$pid"; then
+        exit 1
+      else
+        sleep 0.1
+      fi
+    done
+
+    psql -h "$db" -d postgres -c 'CREATE EXTENSION plv8; DO $$ plv8.elog(NOTICE, plv8.version); $$ LANGUAGE plv8;' 2> "$out"
+    grep -q "${version}" "$out"
+    kill -0 "$pid"
+  '';
 
   meta = with lib; {
     description = "V8 Engine Javascript Procedural Language add-on for PostgreSQL";
@@ -54,4 +84,4 @@ stdenv.mkDerivation rec {
     platforms = [ "x86_64-linux" ];
     license = licenses.postgresql;
   };
-}
+}; in self
diff --git a/pkgs/servers/sql/postgresql/packages.nix b/pkgs/servers/sql/postgresql/packages.nix
index e751ae621f3..f3df8a99ca2 100644
--- a/pkgs/servers/sql/postgresql/packages.nix
+++ b/pkgs/servers/sql/postgresql/packages.nix
@@ -26,7 +26,9 @@ self: super: {
 
     plr = super.callPackage ./ext/plr.nix { };
 
-    plv8 = super.callPackage ./ext/plv8.nix { };
+    plv8 = super.callPackage ./ext/plv8.nix {
+      v8 = self.v8_8_x;
+    };
 
     pgjwt = super.callPackage ./ext/pgjwt.nix { };
 
diff --git a/pkgs/servers/sql/proxysql/default.nix b/pkgs/servers/sql/proxysql/default.nix
index 078ebfb7b6e..142dfe29fa2 100644
--- a/pkgs/servers/sql/proxysql/default.nix
+++ b/pkgs/servers/sql/proxysql/default.nix
@@ -25,7 +25,7 @@
 , pcre
 , perl
 , prometheus-cpp
-, python
+, python2
 , re2
 , zlib
 }:
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
     cmake
     libtool
     perl
-    python
+    python2
   ];
 
   buildInputs = [
diff --git a/pkgs/servers/tailscale/default.nix b/pkgs/servers/tailscale/default.nix
index 28eabf543d7..2149f772436 100644
--- a/pkgs/servers/tailscale/default.nix
+++ b/pkgs/servers/tailscale/default.nix
@@ -2,20 +2,20 @@
 
 buildGoModule rec {
   pname = "tailscale";
-  version = "1.18.2";
+  version = "1.20.1";
 
   src = fetchFromGitHub {
     owner = "tailscale";
     repo = "tailscale";
     rev = "v${version}";
-    sha256 = "sha256-8leFG2gYXw+orN/2NfjTvgRqSZSdso7OHIgECEJrO9k=";
+    sha256 = "sha256-n+94ipR1w63NS2tzMsJWY4oxeTBEWrp8e2gF+CTpvrI=";
   };
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ makeWrapper ];
 
   CGO_ENABLED = 0;
 
-  vendorSha256 = "sha256-ulgTwnuisnkQf0WLQhZ70MwuOpZuroh7ShxBGyv0d0k=";
+  vendorSha256 = "sha256-ZbOxC8J843B8BMS/ZgfSZqU1YCUoWhPqbABzWZy3DMI=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/tvheadend/default.nix b/pkgs/servers/tvheadend/default.nix
index 6c853b1ccc8..64e8d423d91 100644
--- a/pkgs/servers/tvheadend/default.nix
+++ b/pkgs/servers/tvheadend/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, cmake, makeWrapper, pkg-config
-, avahi, dbus, gettext, git, gnutar, gzip, bzip2, ffmpeg_4, libiconv, openssl, python
+, avahi, dbus, gettext, git, gnutar, gzip, bzip2, ffmpeg_4, libiconv, openssl, python2
 , v4l-utils, which, zlib }:
 
 let
@@ -29,7 +29,7 @@ in stdenv.mkDerivation {
   };
 
   buildInputs = [
-    avahi dbus gettext git gnutar gzip bzip2 ffmpeg_4 libiconv openssl python
+    avahi dbus gettext git gnutar gzip bzip2 ffmpeg_4 libiconv openssl python2
     which zlib
   ];
 
diff --git a/pkgs/servers/web-apps/lemmy/package.json b/pkgs/servers/web-apps/lemmy/package.json
index 5007b55d481..bb7dc863d5b 100644
--- a/pkgs/servers/web-apps/lemmy/package.json
+++ b/pkgs/servers/web-apps/lemmy/package.json
@@ -1,7 +1,7 @@
 {
   "name": "lemmy-ui",
   "description": "An isomorphic UI for lemmy",
-  "version": "0.14.0",
+  "version": "0.15.1",
   "author": "Dessalines <tyhou13@gmx.com>",
   "license": "AGPL-3.0",
   "scripts": {
@@ -17,13 +17,14 @@
   },
   "repository": "https://github.com/LemmyNet/lemmy-ui",
   "dependencies": {
-    "@typescript-eslint/parser": "^5.4.0",
+    "@typescript-eslint/parser": "^5.6.0",
     "autosize": "^5.0.1",
     "check-password-strength": "^2.0.3",
-    "choices.js": "^9.0.1",
+    "choices.js": "^10.0.0",
+    "classnames": "^2.3.1",
     "emoji-short-name": "^1.0.0",
     "express": "~4.17.1",
-    "i18next": "^21.5.0",
+    "i18next": "^21.5.4",
     "inferno": "^7.4.11",
     "inferno-create-element": "^7.4.11",
     "inferno-helmet": "^5.2.1",
@@ -39,46 +40,45 @@
     "markdown-it-sub": "^1.0.0",
     "markdown-it-sup": "^1.0.0",
     "moment": "^2.29.1",
-    "reconnecting-websocket": "^4.4.0",
     "register-service-worker": "^1.7.2",
     "rxjs": "^7.4.0",
+    "sass": "^1.47.0",
     "serialize-javascript": "^6.0.0",
     "tippy.js": "^6.3.7",
     "toastify-js": "^1.11.2",
     "tributejs": "^5.1.3",
-    "ws": "^8.2.3"
+    "websocket-ts": "^1.1.1"
   },
   "devDependencies": {
     "@babel/core": "^7.16.0",
-    "@babel/plugin-transform-runtime": "^7.16.0",
+    "@babel/plugin-transform-runtime": "^7.16.4",
     "@babel/plugin-transform-typescript": "^7.16.1",
-    "@babel/preset-env": "7.16.0",
+    "@babel/preset-env": "7.16.8",
     "@babel/preset-typescript": "^7.16.0",
     "@babel/runtime": "^7.16.3",
     "@types/autosize": "^4.0.0",
     "@types/express": "^4.17.13",
-    "@types/node": "^16.11.7",
+    "@types/node": "^17.0.8",
     "@types/node-fetch": "^2.5.11",
     "@types/serialize-javascript": "^5.0.1",
-    "@typescript-eslint/eslint-plugin": "^5.4.0",
+    "@typescript-eslint/eslint-plugin": "^5.6.0",
     "babel-loader": "^8.2.3",
     "babel-plugin-inferno": "^6.3.0",
     "bootstrap": "^5.1.3",
     "bootswatch": "^5.1.3",
     "clean-webpack-plugin": "^4.0.0",
-    "copy-webpack-plugin": "^9.1.0",
+    "copy-webpack-plugin": "^10.0.0",
     "css-loader": "^6.5.1",
-    "eslint": "^8.2.0",
+    "eslint": "^8.4.0",
     "eslint-plugin-prettier": "^4.0.0",
     "husky": "^7.0.4",
     "import-sort-style-module": "^6.0.0",
     "iso-639-1": "^2.1.10",
-    "lemmy-js-client": "0.14.0-rc.1",
-    "lint-staged": "^11.2.6",
-    "mini-css-extract-plugin": "^2.4.4",
+    "lemmy-js-client": "0.15.0",
+    "lint-staged": "^12.1.2",
+    "mini-css-extract-plugin": "^2.4.5",
     "node-fetch": "^2.6.1",
-    "node-sass": "^6.0.1",
-    "prettier": "^2.4.1",
+    "prettier": "^2.5.1",
     "prettier-plugin-import-sort": "^0.0.7",
     "prettier-plugin-organize-imports": "^2.3.4",
     "prettier-plugin-packagejson": "^2.2.15",
@@ -88,10 +88,10 @@
     "sortpack": "^2.2.0",
     "style-loader": "^3.3.1",
     "terser": "^5.10.0",
-    "typescript": "^4.4.4",
-    "webpack": "5.64.1",
+    "typescript": "^4.5.2",
+    "webpack": "5.66.0",
     "webpack-cli": "^4.9.1",
-    "webpack-dev-server": "4.5.0",
+    "webpack-dev-server": "4.7.3",
     "webpack-node-externals": "^3.0.0"
   },
   "engines": {
diff --git a/pkgs/servers/web-apps/lemmy/pin.json b/pkgs/servers/web-apps/lemmy/pin.json
index 399fa68c8d8..9a588b54da9 100644
--- a/pkgs/servers/web-apps/lemmy/pin.json
+++ b/pkgs/servers/web-apps/lemmy/pin.json
@@ -1,7 +1,7 @@
 {
-  "version": "0.14.0",
-  "serverSha256": "sha256-rrLOWoy4GkVtfIPpyR0Zwvnqq39CoZRDaVPNSpeJpkA=",
-  "serverCargoSha256": "sha256-6HrsMwzcmNw8udsCdvn8zgIWN0N3Vvsn9bFk+5tBOds=",
-  "uiSha256": "sha256-e+ajyUc2P5eK1dH7qQsC9BmZgT3NCGLbbzbUE3i2rXY=",
-  "uiYarnDepsSha256": "sha256-g3jCc98ftFyvZGD2bESY1eIsLZyQxZpDxgHdRGu78vs="
+  "version": "0.15.1",
+  "serverSha256": "sha256-HHr9mG0AuI/86+EjODE/GT9lhl5DeNkzQ4k077b7ICU=",
+  "serverCargoSha256": "sha256-ErMNsyHfBiYZA4gjaxPHO+fQseUVIKy/928oGqw+Adg=",
+  "uiSha256": "sha256-Al6Q1xXkjqIb2v2S4JbmlQAAFCKwzkAW924uolC0tu8=",
+  "uiYarnDepsSha256": "sha256-Zadp74ZHmbxCHxpDAYOa6Ot2kWujIj8ZzrSaIEsYgMY="
 }
diff --git a/pkgs/servers/web-apps/lemmy/server.nix b/pkgs/servers/web-apps/lemmy/server.nix
index 558cbb9ee70..b58851f9903 100644
--- a/pkgs/servers/web-apps/lemmy/server.nix
+++ b/pkgs/servers/web-apps/lemmy/server.nix
@@ -6,6 +6,7 @@
 , postgresql
 , libiconv
 , Security
+, protobuf
 }:
 let
   pinData = lib.importJSON ./pin.json;
@@ -34,6 +35,10 @@ rustPlatform.buildRustPackage rec {
   OPENSSL_LIB_DIR = "${openssl.out}/lib";
   OPENSSL_INCLUDE_DIR = "${openssl.dev}/include";
 
+  PROTOC = "${protobuf}/bin/protoc";
+  PROTOC_INCLUDE = "${protobuf}/include";
+  nativeBuildInputs = [ protobuf ];
+
   passthru.updateScript = ./update.sh;
 
   meta = with lib; {
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 085048ae68d..932372d2b3d 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -1345,6 +1345,21 @@ lib.makeScope newScope (self: with self; {
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
+  libxcvt = callPackage ({ stdenv, pkg-config, fetchurl, meson, ninja }: stdenv.mkDerivation {
+    pname = "libxcvt";
+    version = "0.1.1";
+    builder = ./builder.sh;
+    src = fetchurl {
+      url = "mirror://xorg/individual/lib/libxcvt-0.1.1.tar.xz";
+      sha256 = "0acc7vrj5kfb19zvyl7f29rnsvx383dvwc19k70r8prm1lccxsr7";
+    };
+    hardeningDisable = [ "bindnow" "relro" ];
+    nativeBuildInputs = [ pkg-config meson ninja ];
+    buildInputs = [ ];
+    meta.platforms = lib.platforms.unix;
+  }) {};
+
+  # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libxkbfile = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11 }: stdenv.mkDerivation {
     pname = "libxkbfile";
     version = "1.1.0";
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 62873ceda48..bd81f7fa513 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -23,7 +23,7 @@ my %pcMap;
 my %extraAttrs;
 
 
-my @missingPCs = ("fontconfig", "libdrm", "libXaw", "zlib", "perl", "python3", "mkfontscale", "bdftopcf", "libxslt", "openssl", "gperf", "m4", "libinput", "libevdev", "mtdev", "xorgproto", "cairo", "gettext" );
+my @missingPCs = ("fontconfig", "libdrm", "libXaw", "zlib", "perl", "python3", "mkfontscale", "bdftopcf", "libxslt", "openssl", "gperf", "m4", "libinput", "libevdev", "mtdev", "xorgproto", "cairo", "gettext", "meson", "ninja" );
 $pcMap{$_} = $_ foreach @missingPCs;
 $pcMap{"freetype2"} = "freetype";
 $pcMap{"libpng12"} = "libpng";
@@ -229,6 +229,7 @@ while (<>) {
 
     push @nativeRequires, "gettext" if $file =~ /USE_GETTEXT/;
     push @requires, "libxslt" if $pkg =~ /libxcb/;
+    push @nativeRequires, "meson", "ninja" if $pkg =~ /libxcvt/;
     push @nativeRequires, "m4" if $pkg =~ /xcbutil/;
     push @requires, "gperf", "xorgproto" if $pkg =~ /xcbutil/;
 
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 75503b3a739..96a5ac712f4 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -181,6 +181,7 @@ mirror://xorg/individual/lib/libXaw3d-1.6.3.tar.bz2
 mirror://xorg/individual/lib/libxcb-1.14.tar.xz
 mirror://xorg/individual/lib/libXcomposite-0.4.5.tar.bz2
 mirror://xorg/individual/lib/libXcursor-1.2.0.tar.bz2
+mirror://xorg/individual/lib/libxcvt-0.1.1.tar.xz
 mirror://xorg/individual/lib/libXdamage-1.1.5.tar.bz2
 mirror://xorg/individual/lib/libXdmcp-1.1.3.tar.bz2
 mirror://xorg/individual/lib/libXext-1.3.4.tar.bz2
diff --git a/pkgs/shells/zsh/zsh-git-prompt/default.nix b/pkgs/shells/zsh/zsh-git-prompt/default.nix
index 7fb2d786193..6af5fe7cc66 100644
--- a/pkgs/shells/zsh/zsh-git-prompt/default.nix
+++ b/pkgs/shells/zsh/zsh-git-prompt/default.nix
@@ -25,7 +25,7 @@
 # installed.
 #
 { fetchFromGitHub
-, python
+, python2
 , git
 , lib
 , haskellPackages
@@ -45,7 +45,7 @@ haskellPackages.callPackage
      prePatch = ''
         substituteInPlace zshrc.sh                       \
           --replace ':-"python"' ':-"haskell"'           \
-          --replace 'python '    '${python.interpreter} ' \
+          --replace 'python '    '${python2.interpreter} ' \
           --replace 'git '       '${git}/bin/git '
      '';
      preCompileBuildDriver = "cd src";
diff --git a/pkgs/tools/X11/opentabletdriver/default.nix b/pkgs/tools/X11/opentabletdriver/default.nix
index 3d7183c786b..7cfec7aaffc 100644
--- a/pkgs/tools/X11/opentabletdriver/default.nix
+++ b/pkgs/tools/X11/opentabletdriver/default.nix
@@ -19,13 +19,13 @@
 
 buildDotnetModule rec {
   pname = "OpenTabletDriver";
-  version = "0.5.3.3";
+  version = "0.6.0.2";
 
   src = fetchFromGitHub {
     owner = "OpenTabletDriver";
     repo = "OpenTabletDriver";
     rev = "v${version}";
-    sha256 = "sha256-k4SoOMKAwHeYSQ80M8Af1DiiDSZIi3gS7lGr2ZrXrEI=";
+    sha256 = "sha256-qPlya5f12Cc1yAK8dliWelA7drAoeeIkFXOD+aDeToo=";
   };
 
   debPkg = fetchurl {
@@ -33,10 +33,10 @@ buildDotnetModule rec {
     sha256 = "sha256-LJqH3+JckPF7S/1uBE2X81jxWg0MF9ff92Ei8WPEA2w=";
   };
 
-  dotnet-sdk = dotnetCorePackages.sdk_5_0;
-  dotnet-runtime = dotnetCorePackages.runtime_5_0;
+  dotnet-sdk = dotnetCorePackages.sdk_6_0;
+  dotnet-runtime = dotnetCorePackages.runtime_6_0;
 
-  dotnetInstallFlags = [ "--framework=net5" ];
+  dotnetInstallFlags = [ "--framework=net6.0" ];
 
   projectFile = [ "OpenTabletDriver.Console" "OpenTabletDriver.Daemon" "OpenTabletDriver.UX.Gtk" ];
   nugetDeps = ./deps.nix;
@@ -62,19 +62,30 @@ buildDotnetModule rec {
   doCheck = true;
   testProjectFile = "OpenTabletDriver.Tests/OpenTabletDriver.Tests.csproj";
 
-  # Require networking
   disabledTests = [
+    # Require networking
     "OpenTabletDriver.Tests.PluginRepositoryTest.ExpandRepositoryTarballFork"
     "OpenTabletDriver.Tests.PluginRepositoryTest.ExpandRepositoryTarball"
+    # Require networking & unused in Linux build
+    "OpenTabletDriver.Tests.UpdaterTests.UpdaterBase_ProperlyChecks_Version_Async"
+    "OpenTabletDriver.Tests.UpdaterTests.Updater_PreventsUpdate_WhenAlreadyUpToDate_Async"
+    "OpenTabletDriver.Tests.UpdaterTests.Updater_AllowsReupdate_WhenInstallFailed_Async"
+    "OpenTabletDriver.Tests.UpdaterTests.Updater_HasUpdateReturnsFalse_During_UpdateInstall_Async"
+    "OpenTabletDriver.Tests.UpdaterTests.Updater_HasUpdateReturnsFalse_After_UpdateInstall_Async"
+    "OpenTabletDriver.Tests.UpdaterTests.Updater_Prevents_ConcurrentAndConsecutive_Updates_Async"
+    "OpenTabletDriver.Tests.UpdaterTests.Updater_ProperlyBackups_BinAndAppDataDirectory_Async"
+    # Intended only to be run in continuous integration, unnecessary for functionality
+    "OpenTabletDriver.Tests.ConfigurationTest.Configurations_DeviceIdentifier_IsNotConflicting"
+    # Depends on processor load
+    "OpenTabletDriver.Tests.TimerTests.TimerAccuracy"
   ];
 
-  postInstall = ''
+  postFixup = ''
     # Give a more "*nix" name to the binaries
     mv $out/bin/OpenTabletDriver.Console $out/bin/otd
     mv $out/bin/OpenTabletDriver.Daemon $out/bin/otd-daemon
     mv $out/bin/OpenTabletDriver.UX.Gtk $out/bin/otd-gui
 
-    cp -r ./OpenTabletDriver/Configurations $out/lib/${pname}
     install -Dm644 $src/OpenTabletDriver.UX/Assets/otd.png -t $out/share/pixmaps
 
     # TODO: Ideally this should be build from OpenTabletDriver/OpenTabletDriver-udev instead
diff --git a/pkgs/tools/X11/opentabletdriver/deps.nix b/pkgs/tools/X11/opentabletdriver/deps.nix
index f1fc303d8cf..1cfb58299a2 100644
--- a/pkgs/tools/X11/opentabletdriver/deps.nix
+++ b/pkgs/tools/X11/opentabletdriver/deps.nix
@@ -1,7 +1,8 @@
 { fetchNuGet }: [
   (fetchNuGet { pname = "AtkSharp"; version = "3.24.24.34"; sha256 = "1jn1vgi9xm0jp7769k6sbdi8d273kigjrsh93i6s4c03hqxv7cqs"; })
   (fetchNuGet { pname = "CairoSharp"; version = "3.24.24.34"; sha256 = "0pydn1k0cam1gclg9sc1sbnmbyzh28qlc5qanyxcylwghink3kgz"; })
-  (fetchNuGet { pname = "coverlet.collector"; version = "3.0.3"; sha256 = "1igcqqr2kh6w9qx0h89y6c2zg4g2h7g8kc2lv5pz3xk6nd8iv7pw"; })
+  (fetchNuGet { pname = "Castle.Core"; version = "4.4.0"; sha256 = "0rpcbmyhckvlvp6vbzpj03c1gqz56ixc6f15vgmxmyf1g40c24pf"; })
+  (fetchNuGet { pname = "coverlet.collector"; version = "3.0.2"; sha256 = "1xf6z6izmsl4g8w3z1wbp4pa8f8qsf6sil4mf1c9fb22hq8c5hkg"; })
   (fetchNuGet { pname = "Eto.Forms"; version = "2.5.10"; sha256 = "1d71wglk4ixfqfbm6sxmj753x5iwbar8i9zzjy3bh64fy1dn8lz7"; })
   (fetchNuGet { pname = "Eto.Forms"; version = "2.5.11"; sha256 = "0h86jc19wy3ssj7pb34w1h02v92mg29gdipszwjs3y15piy66z3s"; })
   (fetchNuGet { pname = "Eto.Platform.Gtk"; version = "2.5.11"; sha256 = "1s9njz7l9zghrbzli7lbiav5ss3glqf17npj07f3jldd933nb95j"; })
@@ -12,29 +13,33 @@
   (fetchNuGet { pname = "HidSharpCore"; version = "1.2.1.1"; sha256 = "1zkndglmz0s8rblfhnqcvv90rkq2i7lf4bc380g7z8h1avf2ikll"; })
   (fetchNuGet { pname = "MessagePack"; version = "2.1.194"; sha256 = "1v2gyd9sd6hppfhlzngmzzhnpr39b95rwrqq0r9zzp480b6vzaj0"; })
   (fetchNuGet { pname = "MessagePack.Annotations"; version = "2.1.194"; sha256 = "1jkhq3hiy4brvzsywl4p4jb9jrnzs3vmgr3s8fxpb1dzafadw8b0"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Ref"; version = "5.0.0"; sha256 = "0d7sjr89zwq0wxirf8la05hfalv9nhvlczg1c7a508k8aw79jvfg"; })
   (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "1.1.1"; sha256 = "0a1ahssqds2ympr7s4xcxv5y8jgxs7ahd6ah6fbgglj4rki1f1vw"; })
-  (fetchNuGet { pname = "Microsoft.CodeCoverage"; version = "16.9.1"; sha256 = "18isx8w4kwnlk6hq5ay8i4lgzwhx0zg9brayfdk2lakagvv6yyaf"; })
+  (fetchNuGet { pname = "Microsoft.CodeCoverage"; version = "16.9.4"; sha256 = "11wiyy3ykgk1sa9amy3lgcsg2v7d1sz59ggw647vx8ibpjxijjpp"; })
   (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.0.1"; sha256 = "0zxc0apx1gcx361jlq8smc9pfdgmyjh6hpka8dypc9w23nlsh6yj"; })
   (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.4.1"; sha256 = "0z6d1i6xcf0c00z6rs75rgw4ncs9q2m8amasf6mmbf40fm02ry7g"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection"; version = "6.0.0-rc.1.21451.13"; sha256 = "0r6945jq7c2f1wjifq514zvngicndjqfnsjya6hqw0yzah0jr56c"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection.Abstractions"; version = "6.0.0-rc.1.21451.13"; sha256 = "11dg16x6g0gssb143qpghxz1s41himvhr7yhjwxs9hacx4ij2dm1"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Ref"; version = "5.0.0"; sha256 = "1p62khf9zk23lh91lvz7plv3g1nzmm3b5szqrcm6mb8w3sjk03wi"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.0.1"; sha256 = "01al6cfxp68dscl15z7rxfw9zvhm64dncsw09a1vmdkacsa2v6lr"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.1"; sha256 = "164wycgng4mi9zqi2pnsf1pq6gccbqvw6ib916mqizgjmd8f44pj"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "3.0.0"; sha256 = "1bk8r4r3ihmi6322jmcag14jmw11mjqys202azqjzglcx59pxh51"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.0.1"; sha256 = "0ppdkwy6s9p7x9jix3v4402wb171cdiibq7js7i13nxpdky7074p"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.1.0"; sha256 = "193xwf33fbm0ni3idxzbr5fdq3i2dlfgihsac9jj7whj0gd902nh"; })
-  (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "16.9.1"; sha256 = "1761mvkp5mwhw150fvazdhh4ybvxpvx05g9znf8n1fqx832wxrw5"; })
-  (fetchNuGet { pname = "Microsoft.TestPlatform.ObjectModel"; version = "16.9.1"; sha256 = "1igpx7ldxqx9fkrbhakd2bybc0dgpvj86zr30vpfj31ncm6lp4id"; })
-  (fetchNuGet { pname = "Microsoft.TestPlatform.TestHost"; version = "16.9.1"; sha256 = "1frx5r7l0jd3j6my4s2qas13fkljgfn87a84xk8l7sisafpfsvzp"; })
+  (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "16.9.4"; sha256 = "1jdx05zmrqj1s7xfgn3wgy10qb5cl1n1jcj5kz43zvkw1amc7ra4"; })
+  (fetchNuGet { pname = "Microsoft.TestPlatform.ObjectModel"; version = "16.9.4"; sha256 = "1jizkbrnm4pv60zch29ki7gj8m7j5whk141x9cwx4kwsd6cfzwi6"; })
+  (fetchNuGet { pname = "Microsoft.TestPlatform.TestHost"; version = "16.9.4"; sha256 = "14110qzmypr72ywvx3npq7mf4n0gvdr4536v91z1xbapms65am6x"; })
   (fetchNuGet { pname = "Microsoft.VisualStudio.Threading"; version = "16.7.56"; sha256 = "13x0xrsjxd86clf9cjjwmpzlyp8pkrf13riya7igs8zy93zw2qap"; })
   (fetchNuGet { pname = "Microsoft.VisualStudio.Threading.Analyzers"; version = "16.7.56"; sha256 = "04v9df0k7bsc0rzgkw4mnvi43pdrh42vk6xdcwn9m6im33m0nnz2"; })
   (fetchNuGet { pname = "Microsoft.VisualStudio.Validation"; version = "15.5.31"; sha256 = "1ah99rn922qa0sd2k3h64m324f2r32pw8cn4cfihgvwx4qdrpmgw"; })
   (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.3.0"; sha256 = "0j0c1wj4ndj21zsgivsc24whiya605603kxrbiw6wkfdync464wq"; })
   (fetchNuGet { pname = "Microsoft.Win32.Registry"; version = "4.6.0"; sha256 = "0i4y782yrqqyx85pg597m20gm0v126w0j9ddk5z7xb3crx4z9f2s"; })
-  (fetchNuGet { pname = "MSTest.TestAdapter"; version = "2.1.2"; sha256 = "1390nyc0sf5c4j75cq58bzqjcw77sp2lmpllmm5sp8ysi0fjyfs5"; })
-  (fetchNuGet { pname = "MSTest.TestFramework"; version = "2.1.2"; sha256 = "1617q2accpa8fwy9n1snmjxyx2fz3phks62mdi45cl65kdin0x4z"; })
+  (fetchNuGet { pname = "Moq"; version = "4.16.1"; sha256 = "1m2gwbx0gsy84rl9c3hgdaw9gz8d08ffg19nwg0idsdqmmiq887l"; })
   (fetchNuGet { pname = "Nerdbank.Streams"; version = "2.6.77"; sha256 = "13dnfwxa8syx7vfjmd5pcrqz31k0q8y3mmh6yz6bmljhjri65q5c"; })
   (fetchNuGet { pname = "NETStandard.Library"; version = "1.6.1"; sha256 = "1z70wvsx2d847a2cjfii7b83pjfs34q05gb037fdjikv5kbagml8"; })
   (fetchNuGet { pname = "Newtonsoft.Json"; version = "12.0.2"; sha256 = "0w2fbji1smd2y7x25qqibf1qrznmv4s6s0jvrbvr6alb7mfyqvh5"; })
+  (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.1"; sha256 = "0fijg0w6iwap8gvzyjnndds0q4b8anwxxvik7y8vgq97dram4srb"; })
   (fetchNuGet { pname = "Newtonsoft.Json"; version = "9.0.1"; sha256 = "0mcy0i7pnfpqm4pcaiyzzji4g0c8i3a5gjz28rrr28110np8304r"; })
   (fetchNuGet { pname = "NuGet.Frameworks"; version = "5.0.0"; sha256 = "18ijvmj13cwjdrrm52c8fpq021531zaz4mj4b4zapxaqzzxf2qjr"; })
   (fetchNuGet { pname = "Octokit"; version = "0.50.0"; sha256 = "1ignj5i6a1c19qqrw00wlr9fdjmwrxkxz7gdxj0x653w84gbv7qq"; })
@@ -74,18 +79,23 @@
   (fetchNuGet { pname = "System.Collections"; version = "4.3.0"; sha256 = "19r4y64dqyrq6k4706dnyhhw7fs24kpp3awak7whzss39dakpxk9"; })
   (fetchNuGet { pname = "System.Collections.Concurrent"; version = "4.3.0"; sha256 = "0wi10md9aq33jrkh2c24wr2n9hrpyamsdhsxdcnf43b7y86kkii8"; })
   (fetchNuGet { pname = "System.Collections.Immutable"; version = "1.7.1"; sha256 = "1nh4nlxfc7lbnbl86wwk1a3jwl6myz5j6hvgh5sp4krim9901hsq"; })
+  (fetchNuGet { pname = "System.Collections.NonGeneric"; version = "4.3.0"; sha256 = "07q3k0hf3mrcjzwj8fwk6gv3n51cb513w4mgkfxzm3i37sc9kz7k"; })
+  (fetchNuGet { pname = "System.Collections.Specialized"; version = "4.3.0"; sha256 = "1sdwkma4f6j85m3dpb53v9vcgd0zyc9jb33f8g63byvijcj39n20"; })
   (fetchNuGet { pname = "System.CommandLine"; version = "2.0.0-beta1.20253.1"; sha256 = "16saf1fm9q80bb624fkqz0ksrwpnbw9617d7xg3jib7a2wgagm2r"; })
+  (fetchNuGet { pname = "System.ComponentModel"; version = "4.3.0"; sha256 = "0986b10ww3nshy30x9sjyzm0jx339dkjxjj3401r3q0f6fx2wkcb"; })
   (fetchNuGet { pname = "System.ComponentModel.Annotations"; version = "4.7.0"; sha256 = "06x1m46ddxj0ng28d7gry9gjkqdg2kp89jyf480g5gznyybbs49z"; })
+  (fetchNuGet { pname = "System.ComponentModel.Primitives"; version = "4.3.0"; sha256 = "1svfmcmgs0w0z9xdw2f2ps05rdxmkxxhf0l17xk9l1l8xfahkqr0"; })
+  (fetchNuGet { pname = "System.ComponentModel.TypeConverter"; version = "4.3.0"; sha256 = "17ng0p7v3nbrg3kycz10aqrrlw4lz9hzhws09pfh8gkwicyy481x"; })
   (fetchNuGet { pname = "System.Console"; version = "4.3.0"; sha256 = "1flr7a9x920mr5cjsqmsy9wgnv3lvd0h1g521pdr1lkb2qycy7ay"; })
   (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.0.11"; sha256 = "0gmjghrqmlgzxivd2xl50ncbglb7ljzb66rlx8ws6dv8jm0d5siz"; })
   (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.3.0"; sha256 = "00yjlf19wjydyr6cfviaph3vsjzg3d5nvnya26i2fvfg53sknh3y"; })
   (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "4.3.0"; sha256 = "0z6m3pbiy0qw6rn3n209rrzf9x1k4002zh90vwcrsym09ipm2liq"; })
-  (fetchNuGet { pname = "System.Diagnostics.TextWriterTraceListener"; version = "4.3.0"; sha256 = "09db74f36wkwg30f7v7zhz1yhkyrnl5v6bdwljq1jdfgzcfch7c3"; })
   (fetchNuGet { pname = "System.Diagnostics.Tools"; version = "4.0.1"; sha256 = "19cknvg07yhakcvpxg3cxa0bwadplin6kyxd8mpjjpwnp56nl85x"; })
   (fetchNuGet { pname = "System.Diagnostics.Tools"; version = "4.3.0"; sha256 = "0in3pic3s2ddyibi8cvgl102zmvp9r9mchh82ns9f0ms4basylw1"; })
   (fetchNuGet { pname = "System.Diagnostics.TraceSource"; version = "4.3.0"; sha256 = "1kyw4d7dpjczhw6634nrmg7yyyzq72k75x38y0l0nwhigdlp1766"; })
   (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.3.0"; sha256 = "1m3bx6c2s958qligl67q7grkwfz3w53hpy7nc97mh6f7j5k168c4"; })
   (fetchNuGet { pname = "System.Dynamic.Runtime"; version = "4.0.11"; sha256 = "1pla2dx8gkidf7xkciig6nifdsb494axjvzvann8g2lp3dbqasm9"; })
+  (fetchNuGet { pname = "System.Dynamic.Runtime"; version = "4.3.0"; sha256 = "1d951hrvrpndk7insiag80qxjbf2y0y39y8h5hnq9612ws661glk"; })
   (fetchNuGet { pname = "System.Globalization"; version = "4.0.11"; sha256 = "070c5jbas2v7smm660zaf1gh0489xanjqymkvafcs4f8cdrs1d5d"; })
   (fetchNuGet { pname = "System.Globalization"; version = "4.3.0"; sha256 = "1cp68vv683n6ic2zqh2s1fn4c2sd87g5hpp6l4d4nj4536jz98ki"; })
   (fetchNuGet { pname = "System.Globalization.Calendars"; version = "4.3.0"; sha256 = "1xwl230bkakzzkrggy1l1lxmm3xlhk4bq2pkv790j5lm8g887lxq"; })
@@ -135,6 +145,7 @@
   (fetchNuGet { pname = "System.Runtime"; version = "4.3.0"; sha256 = "066ixvgbf2c929kgknshcxqj6539ax7b9m570cp8n179cpfkapz7"; })
   (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "4.5.2"; sha256 = "1vz4275fjij8inf31np78hw50al8nqkngk04p3xv5n4fcmf1grgi"; })
   (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "4.7.1"; sha256 = "119br3pd85lq8zcgh4f60jzmv1g976q1kdgi3hvqdlhfbw6siz2j"; })
+  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "6.0.0-rc.1.21451.13"; sha256 = "0v5bc80p35jj5b5xdgsn5r1v4w68gqz0sahi214rprrrlr3sl206"; })
   (fetchNuGet { pname = "System.Runtime.Extensions"; version = "4.1.0"; sha256 = "0rw4rm4vsm3h3szxp9iijc3ksyviwsv6f63dng3vhqyg4vjdkc2z"; })
   (fetchNuGet { pname = "System.Runtime.Extensions"; version = "4.3.0"; sha256 = "1ykp3dnhwvm48nap8q23893hagf665k0kn3cbgsqpwzbijdcgc60"; })
   (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.0.1"; sha256 = "1g0zrdi5508v49pfm3iii2hn6nm00bgvfpjq1zxknfjrxxa20r4g"; })
@@ -172,5 +183,14 @@
   (fetchNuGet { pname = "System.Xml.ReaderWriter"; version = "4.3.0"; sha256 = "0c47yllxifzmh8gq6rq6l36zzvw4kjvlszkqa9wq3fr59n0hl3s1"; })
   (fetchNuGet { pname = "System.Xml.XDocument"; version = "4.0.11"; sha256 = "0n4lvpqzy9kc7qy1a4acwwd7b7pnvygv895az5640idl2y9zbz18"; })
   (fetchNuGet { pname = "System.Xml.XDocument"; version = "4.3.0"; sha256 = "08h8fm4l77n0nd4i4fk2386y809bfbwqb7ih9d7564ifcxr5ssxd"; })
+  (fetchNuGet { pname = "System.Xml.XmlDocument"; version = "4.3.0"; sha256 = "0bmz1l06dihx52jxjr22dyv5mxv6pj4852lx68grjm7bivhrbfwi"; })
   (fetchNuGet { pname = "WaylandNET"; version = "0.2.0"; sha256 = "1qjpvra08vdqdw4j1gamz6451x5sd5r1j86lsvrl8akq4nymfr8k"; })
+  (fetchNuGet { pname = "xunit"; version = "2.4.1"; sha256 = "0xf3kaywpg15flqaqfgywqyychzk15kz0kz34j21rcv78q9ywq20"; })
+  (fetchNuGet { pname = "xunit.abstractions"; version = "2.0.3"; sha256 = "00wl8qksgkxld76fgir3ycc5rjqv1sqds6x8yx40927q5py74gfh"; })
+  (fetchNuGet { pname = "xunit.analyzers"; version = "0.10.0"; sha256 = "15n02q3akyqbvkp8nq75a8rd66d4ax0rx8fhdcn8j78pi235jm7j"; })
+  (fetchNuGet { pname = "xunit.assert"; version = "2.4.1"; sha256 = "1imynzh80wxq2rp9sc4gxs4x1nriil88f72ilhj5q0m44qqmqpc6"; })
+  (fetchNuGet { pname = "xunit.core"; version = "2.4.1"; sha256 = "1nnb3j4kzmycaw1g76ii4rfqkvg6l8gqh18falwp8g28h802019a"; })
+  (fetchNuGet { pname = "xunit.extensibility.core"; version = "2.4.1"; sha256 = "103qsijmnip2pnbhciqyk2jyhdm6snindg5z2s57kqf5pcx9a050"; })
+  (fetchNuGet { pname = "xunit.extensibility.execution"; version = "2.4.1"; sha256 = "1pbilxh1gp2ywm5idfl0klhl4gb16j86ib4x83p8raql1dv88qia"; })
+  (fetchNuGet { pname = "xunit.runner.visualstudio"; version = "2.4.3"; sha256 = "0j1d0rbcm7pp6dypi61sjxp8l22sv261252z55b243l39jgv2rp3"; })
 ]
diff --git a/pkgs/tools/X11/opentabletdriver/update.sh b/pkgs/tools/X11/opentabletdriver/update.sh
index 20820eb69d2..1524a995016 100755
--- a/pkgs/tools/X11/opentabletdriver/update.sh
+++ b/pkgs/tools/X11/opentabletdriver/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl gnused jq common-updater-scripts nuget-to-nix dotnet-sdk_5
+#!nix-shell -i bash -p curl gnused jq common-updater-scripts nuget-to-nix dotnet-sdk_6 dotnet-sdk_5
 set -eo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
diff --git a/pkgs/tools/admin/pulumi/data.nix b/pkgs/tools/admin/pulumi/data.nix
index 988bd3ec2bb..9bb3ef46d92 100644
--- a/pkgs/tools/admin/pulumi/data.nix
+++ b/pkgs/tools/admin/pulumi/data.nix
@@ -1,24 +1,24 @@
 # DO NOT EDIT! This file is generated automatically by update.sh
 { }:
 {
-  version = "3.21.0";
+  version = "3.22.1";
   pulumiPkgs = {
     x86_64-linux = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.21.0-linux-x64.tar.gz";
-        sha256 = "110ab7i3ynkjhbk10q150p7301prffk4xqma79rk28cxxvxf4kk3";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.22.1-linux-x64.tar.gz";
+        sha256 = "0yxjlkvyxap4c7ny5x0ch0j4d5360qapb670f6im7vnaqhc00by0";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v2.4.0-linux-amd64.tar.gz";
         sha256 = "02k3ars9i8pfby3070rnnldfcb5hbh32kd5xnbmgd0202yg5y3pd";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.33.1-linux-amd64.tar.gz";
-        sha256 = "13i6jmy2nyv80d0ab29yw489qwnf7i0yjrns1d124gijdd30zh0l";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.34.0-linux-amd64.tar.gz";
+        sha256 = "0c61m2q7944a29dkcqcv5fv9jn2bz8mdfhnd33z8qaybhw2804rd";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.32.0-linux-amd64.tar.gz";
-        sha256 = "1g0v7vqrf5237vv0ki74j6zb18zas8i3ii5w9fvy4mg9x4k37d4k";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.33.0-linux-amd64.tar.gz";
+        sha256 = "0k5bpg6lmhj3cxsg43dkyw9jlwyllwwdhml3brkyfgb307cypl9b";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v4.2.0-linux-amd64.tar.gz";
@@ -45,12 +45,12 @@
         sha256 = "0hnardid0kbzy65dmn7vz8ddy5hq78nf2871zz6srf2hfyiv7qa4";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v6.6.0-linux-amd64.tar.gz";
-        sha256 = "0s9k26yw4lw8rlaz0zcim234bz4sz94x3y4sjh56sn3cd80zcp8i";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v6.7.0-linux-amd64.tar.gz";
+        sha256 = "074ihk1c3g580grbipy0acryjsmaz8n65siyc7yz4gcgcwqwb5mj";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.9.0-linux-amd64.tar.gz";
-        sha256 = "1zvxqxvdi0szsy3bgyhqbwxbcrgq5zpqcawfq80h55g5bvvmjwk7";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.9.1-linux-amd64.tar.gz";
+        sha256 = "0ffbsnpgr6wz9xj5yq6m55xj4mqji7hir6dylyjcpdkrxnigyiss";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.4.0-linux-amd64.tar.gz";
@@ -61,8 +61,8 @@
         sha256 = "0qv3a4d6hnpga7lli7xnbwiig56h080hxrxjr8jbqsy9ymsqb39a";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.12.2-linux-amd64.tar.gz";
-        sha256 = "0lhxz3420ghjkny7r3gqfcf84mxm2j86npiwgg2lkgmsb2kmafj7";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.14.0-linux-amd64.tar.gz";
+        sha256 = "02xgkwfsfkqv38cjyc62rlsldbdd5j801gmlh9pf3qjdjj5d1fl3";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v3.7.1-linux-amd64.tar.gz";
@@ -103,20 +103,20 @@
     ];
     x86_64-darwin = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.21.0-darwin-x64.tar.gz";
-        sha256 = "0pd6jlrw2cc4g33kkl2dfqks5xicmc2bnbrf0cd2ymx9mdnkdaq8";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.22.1-darwin-x64.tar.gz";
+        sha256 = "0b68pfrd83x02rs2saybxycpkirjciilp4a94ps3788y1plinyih";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v2.4.0-darwin-amd64.tar.gz";
         sha256 = "02s2lyd8rlz86rjraxk5g3g55qhih38kmvq0k2gwkdb2d11npf6r";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.33.1-darwin-amd64.tar.gz";
-        sha256 = "1nkg7ybi8n60ypw69w0psap1k3m7pdk4z4vyfciv7lv3qc30nlfa";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.34.0-darwin-amd64.tar.gz";
+        sha256 = "1a26schi28ci0zbm85yx4hlhwlwx0j0kk6d6nk9x1zldc3qzhw4y";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.32.0-darwin-amd64.tar.gz";
-        sha256 = "1nabijlwgp6jfhs9pjv5h4bg5s4nwiaqqa315q30ykna8dd7nl5r";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.33.0-darwin-amd64.tar.gz";
+        sha256 = "04sblbjnxvxhxvzvsgjm83p6qahswwb2mvlylfpgq74ay86l6hki";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v4.2.0-darwin-amd64.tar.gz";
@@ -143,12 +143,12 @@
         sha256 = "1m5lh59h7nck1flzxs9m4n0ag0klk3jmnpf7hc509vffxs89xnjq";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v6.6.0-darwin-amd64.tar.gz";
-        sha256 = "12527gic3sf6ch1773yrwi1g5pp1iyc50q6nhdwwc7vq3sf1ngx9";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v6.7.0-darwin-amd64.tar.gz";
+        sha256 = "046j20xl3ibfyqkcra242a5rpix14n4w3h9w9x618fbznk24bcxb";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.9.0-darwin-amd64.tar.gz";
-        sha256 = "0y5c4ifi4jr7nb33c35axmfwyq0c5si28mq0dvwppq0ffz0lifgk";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.9.1-darwin-amd64.tar.gz";
+        sha256 = "100rqkz0g1w0fhvgvgys9r6a7bqphzizn28lg7pbbkrwjh7s0bxq";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.4.0-darwin-amd64.tar.gz";
@@ -159,8 +159,8 @@
         sha256 = "1xminhpv7b4nnvfdy5ahlcfrkan1fsmn0sp6gzkp5y4kkjd4a6vy";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.12.2-darwin-amd64.tar.gz";
-        sha256 = "113xcf5zg7h90r4w50ss3yjivn3vlq4icff76abhphi5m99b50f5";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.14.0-darwin-amd64.tar.gz";
+        sha256 = "1dpr4h35zby8say0kcvin5y5k4yryx06p3qcx16zrlsjaz6lj84k";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v3.7.1-darwin-amd64.tar.gz";
@@ -201,20 +201,20 @@
     ];
     aarch64-linux = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.21.0-linux-arm64.tar.gz";
-        sha256 = "0484hpbf25kfxac72r74h5rfp5r59hlkhzqib9vma3l1cz9icmyx";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.22.1-linux-arm64.tar.gz";
+        sha256 = "0551zp5n77jzh8k3jbqq75zj734faryxxdd2fvw881cxf95v39aj";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v2.4.0-linux-arm64.tar.gz";
         sha256 = "0rlbcxympplq1gwikxalz3c686kpy2vrsc2phfnm45vvrkl22k8j";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.33.1-linux-arm64.tar.gz";
-        sha256 = "00gps0dmidkvbxcljwwxlrh6i9ci4lzgnycc4f2vibm2yfx38d4y";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.34.0-linux-arm64.tar.gz";
+        sha256 = "0639dl0hj2l33mc4vqbcyywpkfn30fikmiw10zjikcdg1jxzj4nd";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.32.0-linux-arm64.tar.gz";
-        sha256 = "0zg7g4m9rvm24njn90m9ppfprzl08cmm0min0p467h617pyxlii2";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.33.0-linux-arm64.tar.gz";
+        sha256 = "15lxfilkgh9ansy9n2yv693fms3x718lrxz0g2nxi32hz9hq0ysl";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v4.2.0-linux-arm64.tar.gz";
@@ -241,12 +241,12 @@
         sha256 = "111pia2f5xwkwaqs6p90ri29l5b3ivmahsa1bji4fwyyjyp22h4r";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v6.6.0-linux-arm64.tar.gz";
-        sha256 = "0s07gqviacygag8k4q8zbwwp127zsk0kiiqpz4y0gc95pg872bi1";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v6.7.0-linux-arm64.tar.gz";
+        sha256 = "0r53qwf1w68bnqii20b44q1xlgxggsisnlr46463nxm0jb0wwyn9";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.9.0-linux-arm64.tar.gz";
-        sha256 = "1c2g5kzyi0vcah1inpa3a974kcsgdlw0a6gyiij23ryaa5vppk1l";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.9.1-linux-arm64.tar.gz";
+        sha256 = "1zr9vcr6qiql90bysapmrlafl7xmlv49bgp197w4w2290i5q7f6n";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.4.0-linux-arm64.tar.gz";
@@ -257,8 +257,8 @@
         sha256 = "14xqlgy0wy223hg9wp1rc4hbj1pvxrqnzxzv901dqjf5434n6aa0";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.12.2-linux-arm64.tar.gz";
-        sha256 = "02hd6bkhvg27pnn0ph6vb0ns90m8kllfiv1xglsr9yxib25g3bci";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.14.0-linux-arm64.tar.gz";
+        sha256 = "12lnh8hk02w1n28v6i46kxxpkzw1j9zp84ha5p6bnarza6g4wxnk";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v3.7.1-linux-arm64.tar.gz";
@@ -296,20 +296,20 @@
     ];
     aarch64-darwin = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.21.0-darwin-arm64.tar.gz";
-        sha256 = "01446r5q9a684k0z5b6d2a7gdjszy2816v09jdxkc54cg37fhmlz";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.22.1-darwin-arm64.tar.gz";
+        sha256 = "00jzqrnw6khbw5hsaqwi73hx9h3yxdhy2n3jn3h76az27wfjkhkz";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v2.4.0-darwin-arm64.tar.gz";
         sha256 = "116f1psg3wdl81apxlhgz6w1ykhlqxwqk6ahp82mca1h2qc7bg0h";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.33.1-darwin-arm64.tar.gz";
-        sha256 = "0b67z5ikmplnjcb3gghcmzkdj8sgv6kd0b1a4f9dbv22dds6qbih";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.34.0-darwin-arm64.tar.gz";
+        sha256 = "1rzds5wrq51mzs7sgzwna016qcay3dzp5ys25cxmr47025kyv84p";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.32.0-darwin-arm64.tar.gz";
-        sha256 = "12rx7cma3mi8a6w09qzz138dns93y5rdgm5l9z422vjynhs0jpm4";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.33.0-darwin-arm64.tar.gz";
+        sha256 = "1lqmjkqqq3rlsixv2kam50d5m95c81mn23y3dblbkh8d6qpwkfdp";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v4.2.0-darwin-arm64.tar.gz";
@@ -336,12 +336,12 @@
         sha256 = "12bzicm43l7yvh02v5fx3z8v46l9i7a9f677735xi5rjbmd2an4c";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v6.6.0-darwin-arm64.tar.gz";
-        sha256 = "1hswpbzzp18gzz8ggmyfs5ccbhnnk0w9064mvrbpj29baa1brhim";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v6.7.0-darwin-arm64.tar.gz";
+        sha256 = "1w5nhmc6bzfw0ihv5mwn316sj7w27psknnyffqm1pyw6drp0z58v";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.9.0-darwin-arm64.tar.gz";
-        sha256 = "1znrkq3ch28xdgy6vbx91rb2s2nvm12ihpq945x76swya6z7dvcn";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.9.1-darwin-arm64.tar.gz";
+        sha256 = "13w91xxma00zi7llk0hnqi10m90a5b2zhb08j6l0dn7x5a33dqay";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.4.0-darwin-arm64.tar.gz";
@@ -352,8 +352,8 @@
         sha256 = "0n0303423gkwi3b6dwzaqmzsbn2rh4vki6n54mmgd44a3cxbhkak";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.12.2-darwin-arm64.tar.gz";
-        sha256 = "11mhabl8sk4q85hvg41l5s82hkw8rccjiw748wsl43wb3qmx66zx";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.14.0-darwin-arm64.tar.gz";
+        sha256 = "1rq2wxw0kch7xrk0sr1l6fyz1sslyvk44l3jilzbm7mgi0d77w23";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v3.7.1-darwin-arm64.tar.gz";
diff --git a/pkgs/tools/admin/pulumi/update.sh b/pkgs/tools/admin/pulumi/update.sh
index 9a185646a7c..c2b0818e5b9 100755
--- a/pkgs/tools/admin/pulumi/update.sh
+++ b/pkgs/tools/admin/pulumi/update.sh
@@ -1,86 +1,117 @@
-#!/usr/bin/env bash
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p gh
+# shellcheck shell=bash
 # Bash 3 compatible for Darwin
 
-# For getting the latest version of plugins automatically
-API_URL="https://api.github.com/repos/pulumi"
+if [ -z "${GITHUB_TOKEN}" ]; then
+  echo >&2 "usage: GITHUB_TOKEN=… ./update.sh"
+  exit 1
+fi
 
 # Version of Pulumi from
 # https://www.pulumi.com/docs/get-started/install/versions/
-VERSION="3.21.0"
+VERSION="3.22.1"
 
 # An array of plugin names. The respective repository inside Pulumi's
 # Github organization is called pulumi-$name by convention.
 
+declare -a pulumi_repos
 pulumi_repos=(
-    "auth0"
-    "aws"
-    "azure"
-    "cloudflare"
-    "consul"
-    "datadog"
-    "digitalocean"
-    "docker"
-    "equinix-metal"
-    "gcp"
-    "github"
-    "gitlab"
-    "hcloud"
-    "kubernetes"
-    "linode"
-    "mailgun"
-    "mysql"
-    "openstack"
-    "packet"
-    "postgresql"
-    "random"
-    "vault"
-    "vsphere"
+  "auth0"
+  "aws"
+  "azure"
+  "cloudflare"
+  "consul"
+  "datadog"
+  "digitalocean"
+  "docker"
+  "equinix-metal"
+  "gcp"
+  "github"
+  "gitlab"
+  "hcloud"
+  "kubernetes"
+  "linode"
+  "mailgun"
+  "mysql"
+  "openstack"
+  "packet"
+  "postgresql"
+  "random"
+  "vault"
+  "vsphere"
 )
 
 # Contains latest release ${VERSION} from
 # https://github.com/pulumi/pulumi-${NAME}/releases
 
-# Dynamically builds the plugin array, using the API for getting the
+# Dynamically builds the plugin array, using the GitHub API for getting the
 # latest version.
+plugin_num=1
 plugins=()
 for key in "${pulumi_repos[@]}"; do
-    repo="pulumi-${key}"
-    plugins+=("${key}=$(curl -s ${API_URL}/${repo}/releases/latest | jq -M -r .tag_name | sed 's/v//g')")
-    sleep 1
+  plugin="${key}=$(gh api "repos/pulumi/pulumi-${key}/releases/latest" --jq '.tag_name | sub("^v"; "")')"
+  printf "%20s: %s of %s\r" "${plugin}" "${plugin_num}" "${#pulumi_repos[@]}"
+  plugins+=("${plugin}")
+  sleep 1
+  ((++plugin_num))
 done
+printf "\n"
 
 function genMainSrc() {
-    local url="https://get.pulumi.com/releases/sdk/pulumi-v${VERSION}-${1}-${2}.tar.gz"
-    local sha256
-    sha256=$(nix-prefetch-url "$url")
-    echo "      {"
-    echo "        url = \"${url}\";"
-    echo "        sha256 = \"$sha256\";"
-    echo "      }"
+  local url="https://get.pulumi.com/releases/sdk/pulumi-v${VERSION}-${1}-${2}.tar.gz"
+  local sha256
+  sha256=$(nix-prefetch-url "$url")
+  echo "      {"
+  echo "        url = \"${url}\";"
+  echo "        sha256 = \"$sha256\";"
+  echo "      }"
+}
+
+function genSrc() {
+  local url="${1}"
+  local plug="${2}"
+  local tmpdir="${3}"
+
+  local sha256
+  sha256=$(nix-prefetch-url "$url")
+
+  {
+    if [ -n "$sha256" ]; then # file exists
+      echo "      {"
+      echo "        url = \"${url}\";"
+      echo "        sha256 = \"$sha256\";"
+      echo "      }"
+    else
+      echo "      # pulumi-resource-${plug} skipped (does not exist on remote)"
+    fi
+  } > "${tmpdir}/${plug}.nix"
 }
 
 function genSrcs() {
-    for plugVers in "${plugins[@]}"; do
-        local plug=${plugVers%=*}
-        local version=${plugVers#*=}
-        # url as defined here
-        # https://github.com/pulumi/pulumi/blob/06d4dde8898b2a0de2c3c7ff8e45f97495b89d82/pkg/workspace/plugins.go#L197
-        local url="https://api.pulumi.com/releases/plugins/pulumi-resource-${plug}-v${version}-${1}-${2}.tar.gz"
-        local sha256
-        sha256=$(nix-prefetch-url "$url")
-        if [ "$sha256" ]; then  # file exists
-            echo "      {"
-            echo "        url = \"${url}\";"
-            echo "        sha256 = \"$sha256\";"
-            echo "      }"
-        else
-            echo "      # pulumi-resource-${plug} skipped (does not exist on remote)"
-        fi
-    done
+  local tmpdir
+  tmpdir="$(mktemp -d)"
+
+  local i=0
+
+  for plugVers in "${plugins[@]}"; do
+    local plug=${plugVers%=*}
+    local version=${plugVers#*=}
+    # url as defined here
+    # https://github.com/pulumi/pulumi/blob/06d4dde8898b2a0de2c3c7ff8e45f97495b89d82/pkg/workspace/plugins.go#L197
+    local url="https://api.pulumi.com/releases/plugins/pulumi-resource-${plug}-v${version}-${1}-${2}.tar.gz"
+    genSrc "${url}" "${plug}" "${tmpdir}" &
+    ((++i))
+  done
+
+  wait
+
+  find "${tmpdir}" -name '*.nix' -print0 | sort -z | xargs -r0 cat
+  rm -r "${tmpdir}"
 }
 
 {
-  cat <<EOF
+  cat << EOF
 # DO NOT EDIT! This file is generated automatically by update.sh
 { }:
 {
diff --git a/pkgs/tools/audio/abcmidi/default.nix b/pkgs/tools/audio/abcmidi/default.nix
index 48b4e88b0ae..d9c34c3fef7 100644
--- a/pkgs/tools/audio/abcmidi/default.nix
+++ b/pkgs/tools/audio/abcmidi/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "abcMIDI";
-  version = "2021.12.12";
+  version = "2022.01.13";
 
   src = fetchzip {
     url = "https://ifdo.ca/~seymour/runabc/${pname}-${version}.zip";
-    hash = "sha256-34yRMa68x93u8/fGTzflh1L/Lf7ULPXsDaC7GUy+i8g=";
+    hash = "sha256-jXXUdPAmU6JcnqWBnzc9tfjEyLSdYxZZJh4w4iSCD1w=";
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/backup/kopia/default.nix b/pkgs/tools/backup/kopia/default.nix
index a878bcf6c04..2b7a9b0faa9 100644
--- a/pkgs/tools/backup/kopia/default.nix
+++ b/pkgs/tools/backup/kopia/default.nix
@@ -2,16 +2,16 @@
 
 buildGo117Module rec {
   pname = "kopia";
-  version = "0.9.8";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-7Bvgtp6egZqpTv4Ac+OUkhKzTZhRRMwpdvwOCBA6Dso=";
+    sha256 = "sha256-445E+RiYlfDNOuw51Wdsavb52RjL3FkcrN9EeKmJ+Q8=";
   };
 
-  vendorSha256 = "sha256-/dCRM61Zl5YbIb0mKhcyLU15nQhR31QAaq+5TwRK4pM=";
+  vendorSha256 = "sha256-wq/9MUCeJBZjrg0SXgHYMyXodqIF3KLRHQmvi7gbv5M=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/backup/tsm-client/default.nix b/pkgs/tools/backup/tsm-client/default.nix
index e298751faca..c684b34ec4e 100644
--- a/pkgs/tools/backup/tsm-client/default.nix
+++ b/pkgs/tools/backup/tsm-client/default.nix
@@ -1,15 +1,20 @@
 { lib
+, callPackage
+, nixosTests
 , stdenv
+, fetchurl
 , autoPatchelfHook
+, rpmextract
+, openssl
+, zlib
+, lvm2  # LVM image backup and restore functions (optional)
+, acl  # EXT2/EXT3/XFS ACL support (optional)
+, gnugrep
+, procps
+, jdk8  # Java GUI (needed for `enableGui`)
 , buildEnv
-, fetchurl
 , makeWrapper
-, procps
-, zlib
-# optional packages that enable certain features
-, acl ? null  # EXT2/EXT3/XFS ACL support
-, jdk8 ? null  # Java GUI
-, lvm2 ? null  # LVM image backup and restore functions
+, enableGui ? false  # enables Java GUI `dsmj`
 # path to `dsm.sys` configuration files
 , dsmSysCli ? "/etc/tsm-client/cli.dsm.sys"
 , dsmSysApi ? "/etc/tsm-client/api.dsm.sys"
@@ -18,7 +23,7 @@
 
 # For an explanation of optional packages
 # (features provided by them, version limits), see
-# https://www-01.ibm.com/support/docview.wss?uid=swg21052223#Version%208.1
+# https://www.ibm.com/support/pages/node/660813#Version%208.1
 
 
 # IBM Tivoli Storage Manager Client uses a system-wide
@@ -40,22 +45,33 @@
 # point to this derivations `/dsmi_dir` directory symlink.
 # Other environment variables might be necessary,
 # depending on local configuration or usage; see:
-# https://www.ibm.com/support/knowledgecenter/en/SSEQVQ_8.1.8/client/c_cfg_sapiunix.html
-
-
-# The newest version of TSM client should be discoverable
-# by going the the `downloadPage` (see `meta` below),
-# there to "Client Latest Downloads",
-# "IBM Spectrum Protect Client Downloads and READMEs",
-# then to "Linux x86_64 Ubuntu client" (as of 2019-07-15).
+# https://www.ibm.com/docs/en/spectrum-protect/8.1.13?topic=solaris-set-api-environment-variables
+
+
+# The newest version of TSM client should be discoverable by
+# going to the `downloadPage` (see `meta` below).
+# Find the "Backup-archive client" table on that page.
+# Look for "Download Documents" of the latest release.
+# Here, two links must be checked:
+# * "IBM Spectrum Protect Client ... Downloads and READMEs":
+#   In the table at the page's bottom,
+#   check the date of the "Linux x86_64 client"
+# * "IBM Spectrum Protect BA client ... interim fix downloads"
+# Look for the "Linux x86_64 client" rows
+# in the table # at the bottom of each page.
+# Follow the "HTTPS" link of the row with the latest date stamp.
+# In the directory listing to show up, pick the big `.tar` file.
+#
+# (as of 2021-12-18)
 
 
 let
 
   meta = {
-    homepage = "https://www.ibm.com/us-en/marketplace/data-protection-and-recovery";
-    downloadPage = "https://www-01.ibm.com/support/docview.wss?uid=swg21239415";
+    homepage = "https://www.ibm.com/products/data-protection-and-recovery";
+    downloadPage = "https://www.ibm.com/support/pages/ibm-spectrum-protect-downloads-latest-fix-packs-and-interim-fixes";
     platforms = [ "x86_64-linux" ];
+    mainProgram = "dsmc";
     license = lib.licenses.unfree;
     maintainers = [ lib.maintainers.yarny ];
     description = "IBM Spectrum Protect (Tivoli Storage Manager) CLI and API";
@@ -74,34 +90,53 @@ let
     '';
   };
 
+  passthru.tests = {
+    test-cli = callPackage ./test-cli.nix {};
+    test-gui = nixosTests.tsm-client-gui;
+  };
+
+  mkSrcUrl = version:
+    let
+      major = lib.versions.major version;
+      minor = lib.versions.minor version;
+      patch = lib.versions.patch version;
+      fixup = lib.lists.elemAt (lib.versions.splitVersion version) 3;
+    in
+      "https://public.dhe.ibm.com/storage/tivoli-storage-management/${if fixup=="0" then "maintenance" else "patches"}/client/v${major}r${minor}/Linux/LinuxX86/BA/v${major}${minor}${patch}/${version}-TIV-TSMBAC-LinuxX86.tar";
+
   unwrapped = stdenv.mkDerivation rec {
     name = "tsm-client-${version}-unwrapped";
-    version = "8.1.8.0";
+    version = "8.1.13.3";
     src = fetchurl {
-      url = "ftp://public.dhe.ibm.com/storage/tivoli-storage-management/maintenance/client/v8r1/Linux/LinuxX86_DEB/BA/v818/${version}-TIV-TSMBAC-LinuxX86_DEB.tar";
-      sha256 = "0c1d0jm0i7qjd314nhj2vj8fs7sncm1x2n4d6dg4049jniyvjhpk";
+      url = mkSrcUrl version;
+      sha256 = "1dwczf236drdaf4jcfzz5154vdwvxf5zraxhrhiddl6n80hnvbcd";
     };
-    inherit meta;
+    inherit meta passthru;
 
     nativeBuildInputs = [
       autoPatchelfHook
+      rpmextract
     ];
     buildInputs = [
+      openssl
       stdenv.cc.cc
       zlib
     ];
     runtimeDependencies = [
-      lvm2
+      (lib.attrsets.getLib lvm2)
     ];
     sourceRoot = ".";
 
     postUnpack = ''
-      for debfile in *.deb
-      do
-        ar -x "$debfile"
-        tar --xz --extract --file=data.tar.xz
-        rm data.tar.xz
-      done
+      rpmextract TIVsm-API64.x86_64.rpm
+      rpmextract TIVsm-APIcit.x86_64.rpm
+      rpmextract TIVsm-BA.x86_64.rpm
+      rpmextract TIVsm-BAcit.x86_64.rpm
+      rpmextract TIVsm-BAhdw.x86_64.rpm
+      rpmextract TIVsm-JBB.x86_64.rpm
+      # use globbing so that version updates don't break the build:
+      rpmextract gskcrypt64-*.linux.x86_64.rpm
+      rpmextract gskssl64-*.linux.x86_64.rpm
     '';
 
     installPhase = ''
@@ -113,7 +148,7 @@ let
 
     # Fix relative symlinks after `/usr` was moved up one level
     preFixup = ''
-      for link in $out/lib/* $out/bin/*
+      for link in $out/lib{,64}/* $out/bin/*
       do
         target=$(readlink "$link")
         if [ "$(cut -b -6 <<< "$target")" != "../../" ]
@@ -126,14 +161,19 @@ let
     '';
   };
 
+  binPath = lib.makeBinPath ([ acl gnugrep procps ]
+    ++ lib.optional enableGui jdk8);
+
 in
 
 buildEnv {
   name = "tsm-client-${unwrapped.version}";
-  inherit meta;
-  passthru = { inherit unwrapped; };
+  meta = meta // lib.attrsets.optionalAttrs enableGui {
+    mainProgram = "dsmj";
+  };
+  passthru = passthru // { inherit unwrapped; };
   paths = [ unwrapped ];
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   pathsToLink = [
     "/"
     "/bin"
@@ -144,7 +184,7 @@ buildEnv {
   #   to the so-called "installation directories"
   # * Add symlinks to the "installation directories"
   #   that point to the `dsm.sys` configuration files
-  # * Drop the Java GUI executable unless `jdk` is present
+  # * Drop the Java GUI executable unless `enableGui` is set
   # * Create wrappers for the command-line interface to
   #   prepare `PATH` and `DSM_DIR` environment variables
   postBuild = ''
@@ -152,13 +192,13 @@ buildEnv {
     ln --symbolic --no-target-directory opt/tivoli/tsm/client/api/bin64 $out/dsmi_dir
     ln --symbolic --no-target-directory "${dsmSysCli}" $out/dsm_dir/dsm.sys
     ln --symbolic --no-target-directory "${dsmSysApi}" $out/dsmi_dir/dsm.sys
-    ${lib.optionalString (jdk8==null) "rm $out/bin/dsmj"}
+    ${lib.optionalString (!enableGui) "rm $out/bin/dsmj"}
     for bin in $out/bin/*
     do
       target=$(readlink "$bin")
       rm "$bin"
       makeWrapper "$target" "$bin" \
-        --prefix PATH : "$out/dsm_dir:${lib.strings.makeBinPath [ procps acl jdk8 ]}" \
+        --prefix PATH : "$out/dsm_dir:${binPath}" \
         --set DSM_DIR $out/dsm_dir
     done
   '';
diff --git a/pkgs/tools/backup/tsm-client/test-cli.nix b/pkgs/tools/backup/tsm-client/test-cli.nix
new file mode 100644
index 00000000000..0858083c9f9
--- /dev/null
+++ b/pkgs/tools/backup/tsm-client/test-cli.nix
@@ -0,0 +1,58 @@
+{ lib
+, writeText
+, runCommand
+, tsm-client
+}:
+
+# Let the client try to connect to a server.
+# We can't simulate a server, so there's no more to test.
+
+let
+
+  # 192.0.0.8 is a "dummy address" according to RFC 7600
+  dsmSysCli = writeText "cli.dsm.sys" ''
+    defaultserver  testserver
+    server  testserver
+      commmethod  v6tcpip
+      tcpserveraddress  192.0.0.8
+      nodename  ARBITRARYNODENAME
+  '';
+
+  tsm-client_ = tsm-client.override { inherit dsmSysCli; };
+
+  env.nativeBuildInputs = [ tsm-client_ ];
+
+  versionString =
+    let
+      inherit (tsm-client_.passthru.unwrapped) version;
+      major = lib.versions.major version;
+      minor = lib.versions.minor version;
+      patch = lib.versions.patch version;
+      fixup = lib.lists.elemAt (lib.versions.splitVersion version) 3;
+    in
+      "Client Version ${major}, Release ${minor}, Level ${patch}.${fixup}";
+
+in
+
+runCommand "${tsm-client.name}-test-cli" env ''
+  set -o nounset
+  set -o pipefail
+
+  export DSM_LOG=$(mktemp -d ./dsm_log.XXXXXXXXXXX)
+
+  { dsmc -optfile=/dev/null || true; } | tee dsmc-stdout
+
+  # does it report the correct version?
+  grep --fixed-strings '${versionString}' dsmc-stdout
+
+  # does it use the provided dsm.sys config file?
+  # if it does, it states the node's name
+  grep ARBITRARYNODENAME dsmc-stdout
+
+  # does it try (and fail) to connect to the server?
+  # if it does, it reports the "TCP/IP connection failure" error code
+  grep ANS1017E dsmc-stdout
+  grep ANS1017E $DSM_LOG/dsmerror.log
+
+  touch $out
+''
diff --git a/pkgs/tools/backup/zrepl/default.nix b/pkgs/tools/backup/zrepl/default.nix
index 59dbfc0be72..999dd6ccb6e 100644
--- a/pkgs/tools/backup/zrepl/default.nix
+++ b/pkgs/tools/backup/zrepl/default.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
   pname = "zrepl";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "zrepl";
     repo = "zrepl";
     rev = "v${version}";
-    sha256 = "5Bp8XGCjibDJgeAjW98rcABuddI+CV4Fh3hFJaKKwbo=";
+    sha256 = "4q/wwlF11HPDS2lTXUizJ3RFQ9sX5qNnWZUKAgnvDiE=";
   };
 
-  vendorSha256 = "MwmYiK2z7ZK5kKBZV7K6kCZRSd7v5Sgjoih1eeOh6go=";
+  vendorSha256 = "xToq9pKAxxknh4kE8S3uUg5ySPMbJkLftkMhofNxotc=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/tools/cd-dvd/brasero/default.nix b/pkgs/tools/cd-dvd/brasero/default.nix
index 2107d4ed082..decd4352ad4 100644
--- a/pkgs/tools/cd-dvd/brasero/default.nix
+++ b/pkgs/tools/cd-dvd/brasero/default.nix
@@ -4,7 +4,7 @@
 
 let
   major = "3.12";
-  minor = "2";
+  minor = "3";
   binpath = lib.makeBinPath [ dvdauthor vcdimager ];
 
 in stdenv.mkDerivation rec {
@@ -13,7 +13,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/brasero/${major}/${pname}-${version}.tar.xz";
-    sha256 = "0h90y674j26rvjahb8cc0w79zx477rb6zaqcj26wzvq8kmpic8k8";
+    hash = "sha256-h3SerjOhQSB9GwC+IzttgEWYLtMkntS5ja4fOpdf6hU=";
   };
 
   nativeBuildInputs = [ pkg-config itstool intltool wrapGAppsHook ];
diff --git a/pkgs/tools/filesystems/btrfs-progs/default.nix b/pkgs/tools/filesystems/btrfs-progs/default.nix
index bdd26041d33..9ad343f60a8 100644
--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -1,14 +1,16 @@
-{ lib, stdenv, fetchurl, pkg-config, attr, acl, zlib, libuuid, e2fsprogs, lzo
-, asciidoc, xmlto, docbook_xml_dtd_45, docbook_xsl, libxslt, zstd, python3
+{ lib, stdenv, fetchurl
+, asciidoc, docbook_xml_dtd_45, docbook_xsl, libxslt, pkg-config, python3, xmlto
+, zstd
+, acl, attr, e2fsprogs, libuuid, lzo, systemd, zlib
 }:
 
 stdenv.mkDerivation rec {
   pname = "btrfs-progs";
-  version = "5.14.1";
+  version = "5.16";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    sha256 = "sha256-1UqTRlRcpG3xKOPMt31gwJfZDJO34xSZAjbijPr4xVs=";
+    sha256 = "0cqqlcq9bywfi3cpg5ivxiv7p9v6z1r6k4nnmin24mj1kp8krarq";
   };
 
   nativeBuildInputs = [
@@ -16,7 +18,7 @@ stdenv.mkDerivation rec {
     python3 python3.pkgs.setuptools
   ];
 
-  buildInputs = [ attr acl zlib libuuid e2fsprogs lzo zstd python3 ];
+  buildInputs = [ acl attr e2fsprogs libuuid lzo python3 systemd zlib zstd ];
 
   # for python cross-compiling
   _PYTHON_HOST_PLATFORM = stdenv.hostPlatform.config;
@@ -31,10 +33,14 @@ stdenv.mkDerivation rec {
 
   configureFlags = lib.optional stdenv.hostPlatform.isMusl "--disable-backtrace";
 
+  makeFlags = [ "udevruledir=$(out)/lib/udev/rules.d" ];
+
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "Utilities for the btrfs filesystem";
     homepage = "https://btrfs.wiki.kernel.org/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     maintainers = with maintainers; [ raskin ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/tools/filesystems/fuse-overlayfs/default.nix b/pkgs/tools/filesystems/fuse-overlayfs/default.nix
index 28109560ac2..7a7f442878c 100644
--- a/pkgs/tools/filesystems/fuse-overlayfs/default.nix
+++ b/pkgs/tools/filesystems/fuse-overlayfs/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fuse-overlayfs";
-  version = "1.8";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-VqtBJ8HRyhjwKVoRu6+EArZMVbzXkaK89yV56MzRUJo=";
+    sha256 = "sha256-0vmcn3AOASjN61QzxxGYpPMWlukanh8+vbZQcFpU/vs=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/tools/filesystems/xtreemfs/default.nix b/pkgs/tools/filesystems/xtreemfs/default.nix
index 9c49c4677d2..5825f8b25ee 100644
--- a/pkgs/tools/filesystems/xtreemfs/default.nix
+++ b/pkgs/tools/filesystems/xtreemfs/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, boost, fuse, openssl, cmake, attr, jdk, ant, which, file, python
+{ stdenv, boost, fuse, openssl, cmake, attr, jdk, ant, which, file, python2
 , lib, valgrind, makeWrapper, fetchFromGitHub, fetchpatch }:
 
 stdenv.mkDerivation {
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
   version = "1.5.1.81";
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ which attr python ];
+  buildInputs = [ which attr python2 ];
 
   patches = [
     (fetchpatch {
diff --git a/pkgs/tools/games/opentracker/default.nix b/pkgs/tools/games/opentracker/default.nix
index a66d6f4aef5..6386d5daaf0 100644
--- a/pkgs/tools/games/opentracker/default.nix
+++ b/pkgs/tools/games/opentracker/default.nix
@@ -41,6 +41,7 @@ buildDotnetModule rec {
   buildInputs = [
     stdenv.cc.cc.lib
     fontconfig
+    gtk3
   ];
 
   runtimeDeps = [
@@ -58,5 +59,7 @@ buildDotnetModule rec {
     homepage = "https://github.com/trippsc2/OpenTracker";
     license = licenses.mit;
     maintainers = [ maintainers.ivar ];
+    mainProgram = "OpenTracker";
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/graphics/barcode/default.nix b/pkgs/tools/graphics/barcode/default.nix
index 2906304a6d2..e77e8fae0c2 100644
--- a/pkgs/tools/graphics/barcode/default.nix
+++ b/pkgs/tools/graphics/barcode/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchurl, fetchpatch }:
 
 stdenv.mkDerivation rec {
   version = "0.99";
@@ -7,6 +7,14 @@ stdenv.mkDerivation rec {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
     sha256 = "1indapql5fjz0bysyc88cmc54y8phqrbi7c76p71fgjp45jcyzp8";
   };
+  patches = [
+    # Pull upstream patch for -fno-common toolchains.
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "http://git.savannah.gnu.org/cgit/barcode.git/patch/?id=4654f68706a459c9602d9932b56a56e8930f7d53";
+      sha256 = "15kclzcwlh0ymr7m48vc0m8z98q0wf4xbfcky4g1y8yvvpvvrfgc";
+    })
+  ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/misc/csvs-to-sqlite/default.nix b/pkgs/tools/misc/csvs-to-sqlite/default.nix
index b351b6e4efb..1deae6b3f83 100644
--- a/pkgs/tools/misc/csvs-to-sqlite/default.nix
+++ b/pkgs/tools/misc/csvs-to-sqlite/default.nix
@@ -7,7 +7,8 @@ let
   # Workaround the issue by providing click 7 explicitly.
   python = python3.override {
     packageOverrides = self: super: {
-      click = self.callPackage ../../../development/python-modules/click/7.nix { };
+      # Use click 7
+      click = self.callPackage ../../../development/python2-modules/click/default.nix { };
     };
   };
 in with python.pkgs; buildPythonApplication rec {
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index 8e10a847628..87dffed4b78 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -4,16 +4,18 @@
 , gzip, hdf5, imagemagick, jdk, libarchive, libcaca, llvm, lz4, mono, ocaml, oggvideotools, openssh, openssl, pdftk, pgpdump, poppler_utils, procyon, qemu, R
 , radare2, sng, sqlite, squashfsTools, tcpdump, ubootTools, odt2txt, unzip, wabt, xmlbeans, xxd, xz, zip, zstd
 , enableBloat ? false
+# updater only
+, writeScript
 }:
 
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python3Packages.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "197";
+  version = "200";
 
   src = fetchurl {
     url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    sha256 = "sha256-EKTknFa6gGqd1kpy/k1Vh1Zya+XvBMlU5G6Rg2p66es=";
+    sha256 = "sha256-x6qAVEtvGmW0L4L/K+YKAp9jc9zz0Orrsl3qBkPYnW0=";
   };
 
   outputs = [ "out" "man" ];
@@ -91,6 +93,19 @@ python3Packages.buildPythonApplication rec {
     "tests/comparators/test_macho.py"
   ];
 
+   passthru = {
+    updateScript = writeScript "update-diffoscope" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p curl pcre common-updater-scripts
+
+      set -eu -o pipefail
+
+      # Expect the text in format of "Latest release: 198 (31 Dec 2021)"'.
+      newVersion="$(curl -s https://diffoscope.org/ | pcregrep -o1 'Latest release: ([0-9]+)')"
+      update-source-version ${pname} "$newVersion"
+    '';
+   };
+
   meta = with lib; {
     description = "Perform in-depth comparison of files, archives, and directories";
     longDescription = ''
diff --git a/pkgs/tools/misc/flameshot/default.nix b/pkgs/tools/misc/flameshot/default.nix
index 1c0fd19ad2a..82cf7a3b78f 100644
--- a/pkgs/tools/misc/flameshot/default.nix
+++ b/pkgs/tools/misc/flameshot/default.nix
@@ -1,7 +1,6 @@
 { mkDerivation
 , lib
 , fetchFromGitHub
-, fetchpatch
 , qtbase
 , cmake
 , qttools
@@ -11,32 +10,15 @@
 
 mkDerivation rec {
   pname = "flameshot";
-  version = "0.10.2";
+  version = "11.0.0";
 
   src = fetchFromGitHub {
     owner = "flameshot-org";
     repo = "flameshot";
     rev = "v${version}";
-    sha256 = "sha256-rZUiaS32C77tFJmEkw/9MGbVTVscb6LOCyWaWO5FyR4=";
+    sha256 = "sha256-SlnEXW3Uhdgl0icwYyYsKQOcYkAtHpAvL6LMXBF2gWM=";
   };
 
-  patches = [
-    # Use absolute install path for `Exec=` in the desktop file.
-    # This is required since KWin relies on absolute paths in `Exec=` to find a process'
-    # corresponding desktop file and check if it's allowed to take screenshot.
-    # Should be removed when the next release comes out.
-    (fetchpatch {
-      url = "https://github.com/flameshot-org/flameshot/commit/1031980ed1e62d24d7f719998b7951d48801e3fa.patch";
-      sha256 = "sha256-o8Zz/bBvitXMDFt5rAfubiUPOx+EQ+ITgrfnFM3dFjE=";
-    })
-    # Fix autostart write path.
-    # Should be removed when the next release comes out.
-    (fetchpatch {
-      url = "https://github.com/flameshot-org/flameshot/commit/7977cbb52c2d785abd0d85d9df5991e8f7cae441.patch";
-      sha256 = "sha256-wWa9Y+4flBiggOMuX7KQyL+q3f2cALGeQBGusX2x6sk=";
-    })
-  ];
-
   passthru = {
     updateScript = nix-update-script {
       attrPath = pname;
diff --git a/pkgs/tools/misc/grub/trusted.nix b/pkgs/tools/misc/grub/trusted.nix
index edb94891fbe..13f3c42faa4 100644
--- a/pkgs/tools/misc/grub/trusted.nix
+++ b/pkgs/tools/misc/grub/trusted.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchgit, fetchpatch, autogen, flex, bison, python, autoconf, automake
+{ lib, stdenv, fetchurl, fetchgit, fetchpatch, autogen, flex, bison, python2, autoconf, automake
 , gettext, ncurses, libusb-compat-0_1, freetype, qemu, lvm2
 , for_HP_laptop ? false
 }:
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
           sha256 = "0yrfwx67gpg9gij5raq0cfbx3jj769lkg3diqgb7i9n86hgcdh4k";
         };
 
-  nativeBuildInputs = [ autogen flex bison python autoconf automake ];
+  nativeBuildInputs = [ autogen flex bison python2 autoconf automake ];
   buildInputs = [ ncurses libusb-compat-0_1 freetype gettext lvm2 ]
     ++ optional doCheck qemu;
 
diff --git a/pkgs/tools/misc/inav-blackbox-tools/default.nix b/pkgs/tools/misc/inav-blackbox-tools/default.nix
index 5f2fb65f9f3..43524f6a3fe 100644
--- a/pkgs/tools/misc/inav-blackbox-tools/default.nix
+++ b/pkgs/tools/misc/inav-blackbox-tools/default.nix
@@ -30,5 +30,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ expipiplus1 ];
     platforms = platforms.all;
+    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/inav-blackbox-tools.x86_64-darwin
   };
 }
diff --git a/pkgs/tools/misc/lsd/default.nix b/pkgs/tools/misc/lsd/default.nix
index c0d1c278bfd..d72fad1a666 100644
--- a/pkgs/tools/misc/lsd/default.nix
+++ b/pkgs/tools/misc/lsd/default.nix
@@ -2,20 +2,22 @@
 , fetchFromGitHub
 , rustPlatform
 , installShellFiles
+, testVersion
+, lsd
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "lsd";
-  version = "0.20.1";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "Peltoche";
     repo = pname;
     rev = version;
-    sha256 = "sha256-r/Rllu+tgKqz+vkxA8BSN+3V0lUUd6dEATfickQp4+s=";
+    sha256 = "sha256-4pa8yJjUTO5MUDuljfU9Vo2ZjbsIwWJsJj6VVNfN25A=";
   };
 
-  cargoSha256 = "sha256-O8P29eYlHgmmAADZ/DgTBmj0ZOa+4u/Oee+TMF+/4Ro=";
+  cargoSha256 = "sha256-P0HJVp2ReJuLSZrArw/EAfLFDOZqswI0nD1SCHwegoE=";
 
   nativeBuildInputs = [ installShellFiles ];
   postInstall = ''
@@ -25,18 +27,9 @@ rustPlatform.buildRustPackage rec {
   # Found argument '--test-threads' which wasn't expected, or isn't valid in this context
   doCheck = false;
 
-  doInstallCheck = true;
-  installCheckPhase = ''
-    runHook preInstallCheck
-
-    testFile=$(mktemp /tmp/lsd-test.XXXX)
-    echo 'abc' > $testFile
-    $out/bin/lsd --classic --blocks "size,name" -l $testFile | grep "4 B $testFile"
-    $out/bin/lsd --version | grep "${version}"
-    rm $testFile
-
-    runHook postInstallCheck
-  '';
+  passthru.tests.version = testVersion {
+    package = lsd;
+  };
 
   meta = with lib; {
     homepage = "https://github.com/Peltoche/lsd";
diff --git a/pkgs/tools/misc/nncp/default.nix b/pkgs/tools/misc/nncp/default.nix
index 8470837278b..9024ddb6439 100644
--- a/pkgs/tools/misc/nncp/default.nix
+++ b/pkgs/tools/misc/nncp/default.nix
@@ -3,12 +3,12 @@
 
 stdenv.mkDerivation rec {
   pname = "nncp";
-  version = "8.0.2";
+  version = "8.1.0";
   outputs = [ "out" "doc" "info" ];
 
   src = fetchurl {
     url = "http://www.nncpgo.org/download/${pname}-${version}.tar.xz";
-    sha256 = "sha256-hMb7bAdk3xFcUe5CTu9LnIR3VSJDUKbMSE86s8d5udM=";
+    sha256 = "sha256-d3U233dedtZrBWRdb0QElNOd/L1+Ut4CWvkZo5TPU+w=";
   };
 
   nativeBuildInputs = [ go redo-apenwarr ];
diff --git a/pkgs/tools/misc/opentsdb/default.nix b/pkgs/tools/misc/opentsdb/default.nix
index bc7baa55fec..bffcd5e1dca 100644
--- a/pkgs/tools/misc/opentsdb/default.nix
+++ b/pkgs/tools/misc/opentsdb/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, autoconf, automake, curl, fetchurl, fetchpatch, jdk8, makeWrapper, nettools
-, python, git
+, python2, git
 }:
 
 let jdk = jdk8; jre = jdk8.jre; in
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ autoconf automake curl jdk nettools python git ];
+  buildInputs = [ autoconf automake curl jdk nettools python2 git ];
 
   preConfigure = ''
     patchShebangs ./build-aux/
diff --git a/pkgs/tools/misc/pferd/default.nix b/pkgs/tools/misc/pferd/default.nix
index 5c88ea2349f..76df2a68827 100644
--- a/pkgs/tools/misc/pferd/default.nix
+++ b/pkgs/tools/misc/pferd/default.nix
@@ -5,14 +5,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pferd";
-  version = "3.2.0";
+  version = "3.3.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "Garmelon";
     repo = "PFERD";
     rev = "v${version}";
-    sha256 = "0r75a128r8ghrccc1flmpxblfrab5kg6fypzrlfmv2aqhkqg1brb";
+    sha256 = "162s966kmpngmp0h55x185qxsy96q2kxz2dd8w0zyh0n2hbap3lh";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/tools/misc/rpm-ostree/default.nix b/pkgs/tools/misc/rpm-ostree/default.nix
index bfc2ce2c0e9..4dd19a7f397 100644
--- a/pkgs/tools/misc/rpm-ostree/default.nix
+++ b/pkgs/tools/misc/rpm-ostree/default.nix
@@ -29,7 +29,7 @@
 , bubblewrap
 , pcre
 , check
-, python
+, python2
 , json_c
 , zchunk
 , libmodulemd
@@ -82,7 +82,7 @@ stdenv.mkDerivation rec {
     librepo
     pcre
     check
-    python
+    python2
 
     # libdnf # vendored unstable branch
     # required by vendored libdnf
diff --git a/pkgs/tools/misc/snapper/default.nix b/pkgs/tools/misc/snapper/default.nix
index 37361abf2b2..80d9e191c8a 100644
--- a/pkgs/tools/misc/snapper/default.nix
+++ b/pkgs/tools/misc/snapper/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub
 , autoreconfHook, pkg-config, docbook_xsl, libxslt, docbook_xml_dtd_45
 , acl, attr, boost, btrfs-progs, dbus, diffutils, e2fsprogs, libxml2
-, lvm2, pam, python, util-linux, json_c, nixosTests
+, lvm2, pam, python2, util-linux, json_c, nixosTests
 , ncurses }:
 
 stdenv.mkDerivation rec {
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   ];
   buildInputs = [
     acl attr boost btrfs-progs dbus diffutils e2fsprogs libxml2
-    lvm2 pam python util-linux json_c ncurses
+    lvm2 pam python2 util-linux json_c ncurses
   ];
 
   passthru.tests.snapper = nixosTests.snapper;
diff --git a/pkgs/tools/misc/yle-dl/default.nix b/pkgs/tools/misc/yle-dl/default.nix
index 31d5712e5b3..9f974c6751b 100644
--- a/pkgs/tools/misc/yle-dl/default.nix
+++ b/pkgs/tools/misc/yle-dl/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "yle-dl";
-  version = "20210917";
+  version = "20211213";
 
   src = fetchFromGitHub {
     owner = "aajanki";
     repo = "yle-dl";
     rev = version;
-    sha256 = "sha256-l8Wv15DLWRvJ+I6KeTNbIjp+S5EgoqhLOWd0wEyXckk=";
+    sha256 = "sha256-U7ydZ6nSVtMv9mxNSWT/IICwbjK3PCBKxfqjrQ9jwW0=";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/tools/networking/eternal-terminal/default.nix b/pkgs/tools/networking/eternal-terminal/default.nix
index 7724d2d89fd..96a999e2779 100644
--- a/pkgs/tools/networking/eternal-terminal/default.nix
+++ b/pkgs/tools/networking/eternal-terminal/default.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , cmake
 , gflags
@@ -10,32 +11,46 @@
 
 stdenv.mkDerivation rec {
   pname = "eternal-terminal";
-  version = "6.1.9";
+  version = "6.1.11";
 
   src = fetchFromGitHub {
     owner = "MisterTea";
     repo = "EternalTerminal";
     rev = "et-v${version}";
-    sha256 = "0kpabxpy779ppkaqaigq0x34ymz1jcwpsa78rm6nr55mdap2xxv6";
+    hash = "sha256-cCZbG0CD5V/FTj1BuVr083EJ+BCgIcKHomNtpJb3lOo=";
   };
 
-  cmakeFlags= [
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    gflags
+    libsodium
+    openssl
+    protobuf
+    zlib
+  ];
+
+  cmakeFlags = [
     "-DDISABLE_VCPKG=TRUE"
     "-DDISABLE_SENTRY=TRUE"
     "-DDISABLE_CRASH_LOG=TRUE"
   ];
 
-  CXXFLAGS = lib.optional stdenv.cc.isClang "-std=c++17";
-  LDFLAGS = lib.optional stdenv.cc.isClang "-lc++fs";
+  CXXFLAGS = lib.optional stdenv.cc.isClang [
+    "-std=c++17"
+  ];
 
-  nativeBuildInputs = [ cmake ];
-  buildInputs = [ gflags openssl zlib libsodium protobuf ];
+  LDFLAGS = lib.optional stdenv.cc.isClang [
+    "-lc++fs"
+  ];
 
   meta = with lib; {
     description = "Remote shell that automatically reconnects without interrupting the session";
-    license = licenses.asl20;
     homepage = "https://eternalterminal.dev/";
-    platforms = platforms.linux ++ platforms.darwin;
+    license = licenses.asl20;
     maintainers = with maintainers; [ dezgeg pingiun ];
+    platforms = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/pkgs/tools/networking/nss-pam-ldapd/default.nix b/pkgs/tools/networking/nss-pam-ldapd/default.nix
index e112b8c1df1..3c6eff4d601 100644
--- a/pkgs/tools/networking/nss-pam-ldapd/default.nix
+++ b/pkgs/tools/networking/nss-pam-ldapd/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl
 , pkg-config, makeWrapper, autoreconfHook
-, openldap, python, pam
+, openldap, python2, pam
 }:
 
 stdenv.mkDerivation rec {
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config makeWrapper autoreconfHook ];
-  buildInputs = [ openldap pam python ];
+  buildInputs = [ openldap pam python2 ];
 
   preConfigure = ''
     substituteInPlace Makefile.in --replace "install-data-local: " "# install-data-local: "
diff --git a/pkgs/tools/networking/openvpn/default.nix b/pkgs/tools/networking/openvpn/default.nix
index 46375b60fe4..e2805f0ccf0 100644
--- a/pkgs/tools/networking/openvpn/default.nix
+++ b/pkgs/tools/networking/openvpn/default.nix
@@ -24,7 +24,7 @@ let
 
   generic = { version, sha256 }:
     let
-      withIpRoute = stdenv.isLinux && (versionOlder version "2.5");
+      withIpRoute = stdenv.isLinux && (versionOlder version "2.5.4");
     in
     stdenv.mkDerivation
       rec {
@@ -83,7 +83,7 @@ in
   };
 
   openvpn = generic {
-    version = "2.5.2";
-    sha256 = "sha256-sSdDg2kB82Xvr4KrJJOWfhshwh60POmo2hACoXycHcg=";
+    version = "2.5.5";
+    sha256 = "sha256-EZvWn6AhCDj2zaonNpbcc476IA9FTb4R6237dd+2ADs=";
   };
 }
diff --git a/pkgs/tools/networking/philter/default.nix b/pkgs/tools/networking/philter/default.nix
index 60bd2f8cc7e..dc447f3a86b 100644
--- a/pkgs/tools/networking/philter/default.nix
+++ b/pkgs/tools/networking/philter/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, python }:
+{ lib, stdenv, fetchurl, python2 }:
 
 stdenv.mkDerivation rec {
   pname = "philter";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     mkdir -p "$out"/{bin,share/philter}
     cp .philterrc "$out"/share/philter/philterrc
-    sed -i 's@/usr/local/bin@${python}/bin@' src/philter.py
+    sed -i 's@/usr/local/bin@${python2}/bin@' src/philter.py
     cp src/philter.py "$out"/bin/philter
     chmod +x "$out"/bin/philter
   '';
diff --git a/pkgs/tools/networking/pssh/default.nix b/pkgs/tools/networking/pssh/default.nix
index a17701644c8..1d7d006f537 100644
--- a/pkgs/tools/networking/pssh/default.nix
+++ b/pkgs/tools/networking/pssh/default.nix
@@ -1,6 +1,6 @@
-{ lib, fetchFromGitHub, pythonPackages, openssh, rsync }:
+{ lib, fetchFromGitHub, python2Packages, openssh, rsync }:
 
-pythonPackages.buildPythonApplication rec {
+python2Packages.buildPythonApplication rec {
   pname = "pssh";
   version = "2.3.1";
 
diff --git a/pkgs/tools/networking/py-wmi-client/default.nix b/pkgs/tools/networking/py-wmi-client/default.nix
index 7a277400289..8f5958193db 100644
--- a/pkgs/tools/networking/py-wmi-client/default.nix
+++ b/pkgs/tools/networking/py-wmi-client/default.nix
@@ -1,6 +1,6 @@
-{ lib, pythonPackages, fetchFromGitHub }:
+{ lib, python2Packages, fetchFromGitHub }:
 
-pythonPackages.buildPythonApplication rec {
+python2Packages.buildPythonApplication rec {
   pname = "py-wmi-client";
   version = "unstable-20160601";
 
@@ -11,7 +11,7 @@ pythonPackages.buildPythonApplication rec {
     sha256 = "1kd12gi1knqv477f1shzqr0h349s5336vzp3fpfp3xl0b502ld8d";
   };
 
-  propagatedBuildInputs = with pythonPackages; [ impacket natsort pyasn1 pycrypto ];
+  propagatedBuildInputs = with python2Packages; [ impacket natsort pyasn1 pycrypto ];
 
   # no tests
   doCheck = false;
diff --git a/pkgs/tools/networking/telepresence2/default.nix b/pkgs/tools/networking/telepresence2/default.nix
index 9a2e1b4bbc7..7b61dcf746c 100644
--- a/pkgs/tools/networking/telepresence2/default.nix
+++ b/pkgs/tools/networking/telepresence2/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "telepresence2";
-  version = "2.4.6";
+  version = "2.4.9";
 
   src = fetchFromGitHub {
     owner = "telepresenceio";
     repo = "telepresence";
     rev = "v${version}";
-    sha256 = "09w7yk7jk5m6clq3drbgdr61w60b21jmfd635brfahms8pykmmzl";
+    sha256 = "sha256-cGG357Z0OI+aXGHWJaOPkkKUm1KcsYBvhHxNlIYlL+0=";
   };
 
   # The Helm chart is go:embed'ed as a tarball in the binary.
@@ -21,7 +21,7 @@ buildGoModule rec {
     go run ./build-aux/package_embedded_chart/main.go ${src.rev}
   '';
 
-  vendorSha256 = "0przkcqaf56a0sgan2xxqfpbs9nbmq4brwdv1qnag7i9myzvixxb";
+  vendorSha256 = "sha256-DzAxqSiWag9mOgPznjhMCQJhtJZo7hsezhwJBidsvJQ=";
 
   ldflags = [
     "-s" "-w" "-X=github.com/telepresenceio/telepresence/v2/pkg/version.Version=${src.rev}"
diff --git a/pkgs/tools/networking/weighttp/default.nix b/pkgs/tools/networking/weighttp/default.nix
index 7c3d23c0d17..7a26ffdeb43 100644
--- a/pkgs/tools/networking/weighttp/default.nix
+++ b/pkgs/tools/networking/weighttp/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchgit, python, libev, wafHook }:
+{ lib, stdenv, fetchgit, python2, libev, wafHook }:
 
 stdenv.mkDerivation rec {
   pname = "weighttp";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ wafHook ];
 
-  buildInputs = [ python libev ];
+  buildInputs = [ python2 libev ];
 
   meta = with lib; {
     description = "Lightweight and simple webserver benchmarking tool";
diff --git a/pkgs/tools/security/firefox_decrypt/default.nix b/pkgs/tools/security/firefox_decrypt/default.nix
new file mode 100644
index 00000000000..3ca0774e22e
--- /dev/null
+++ b/pkgs/tools/security/firefox_decrypt/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, fetchFromGitHub
+, stdenvNoCC
+, nss
+, wrapPython
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "firefox_decrypt";
+  version = "unstable-2021-12-29";
+
+  src = fetchFromGitHub {
+    owner = "unode";
+    repo = pname;
+    rev = "a3daadc09603a6cf8c4b7e49a59776340bc885e7";
+    sha256 = "0g219zqbdnhh9j09d9a0b81vr6j44zzk13ckl5fzkr10gqndiscc";
+  };
+
+  nativeBuildInputs = [ wrapPython ];
+
+  buildInputs = [ nss ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm 0755 firefox_decrypt.py "$out/bin/firefox_decrypt"
+
+    runHook postInstall
+  '';
+
+  makeWrapperArgs = [ "--prefix" "LD_LIBRARY_PATH" ":" (lib.makeLibraryPath [ nss ]) ];
+
+  postFixup = ''
+    wrapPythonPrograms
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = with lib; {
+    homepage = "https://github.com/unode/firefox_decrypt";
+    description = "A tool to extract passwords from profiles of Mozilla Firefox and derivates";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ schnusch ];
+  };
+}
diff --git a/pkgs/tools/security/firefox_decrypt/update.sh b/pkgs/tools/security/firefox_decrypt/update.sh
new file mode 100755
index 00000000000..a56807f0ba0
--- /dev/null
+++ b/pkgs/tools/security/firefox_decrypt/update.sh
@@ -0,0 +1,49 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p common-updater-scripts git jq nix nix-prefetch-git
+git_url='https://github.com/unode/firefox_decrypt.git'
+git_branch='master'
+git_dir='/var/tmp/firefox_decrypt.git'
+nix_file="$(dirname "${BASH_SOURCE[0]}")/default.nix"
+pkg='firefox_decrypt'
+
+set -euo pipefail
+
+info() {
+    if [ -t 2 ]; then
+        set -- '\033[32m%s\033[39m\n' "$@"
+    else
+        set -- '%s\n' "$@"
+    fi
+    printf "$@" >&2
+}
+
+old_rev=$(nix-instantiate --eval --strict --json -A "$pkg.src.rev" | jq -r)
+old_version=$(nix-instantiate --eval --strict --json -A "$pkg.version" | jq -r)
+today=$(LANG=C date -u +'%Y-%m-%d')
+
+info "fetching $git_url..."
+if [ ! -d "$git_dir" ]; then
+    git init --initial-branch="$git_branch" "$git_dir"
+    git -C "$git_dir" remote add origin "$git_url"
+fi
+git -C "$git_dir" fetch origin "$git_branch"
+
+# use latest commit before today, we should not call the version *today*
+# because there might still be commits coming
+# use the day of the latest commit we picked as version
+new_rev=$(git -C "$git_dir" log -n 1 --format='format:%H' --before="${today}T00:00:00Z" "origin/$git_branch")
+new_version="unstable-$(git -C "$git_dir" log -n 1 --format='format:%cs' "$new_rev")"
+info "latest commit before $today: $new_rev"
+
+if [ "$new_rev" = "$old_rev" ]; then
+    info "$pkg is up-to-date."
+    exit
+fi
+
+new_sha256=$(nix-prefetch-git --rev "$new_rev" "$git_dir" | jq -r .sha256)
+update-source-version "$pkg" \
+    "$new_version" \
+    "$new_sha256" \
+    --rev="$new_rev"
+git add "$nix_file"
+git commit --verbose --message "$pkg: $old_version -> $new_version"
diff --git a/pkgs/tools/security/solo2-cli/default.nix b/pkgs/tools/security/solo2-cli/default.nix
new file mode 100644
index 00000000000..e3518799504
--- /dev/null
+++ b/pkgs/tools/security/solo2-cli/default.nix
@@ -0,0 +1,48 @@
+{ lib
+, stdenv
+, rustPlatform
+, fetchFromGitHub
+, installShellFiles
+, pkg-config
+, pcsclite
+, udev
+, PCSC
+, IOKit
+, CoreFoundation
+, AppKit
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "solo2-cli";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "solokeys";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-3GIK0boxGD4Xa5OskP1535zCQyhMQ/oXbgThRivJzww=";
+  };
+
+  cargoSha256 = "sha256-MYxVegXUVeZ4AzDz+Si5TtTjUDEPTO0Nh008rgLtsLw=";
+
+  nativeBuildInputs = [ installShellFiles pkg-config ];
+
+  buildInputs = [ ]
+    ++ lib.optionals stdenv.isLinux [ pcsclite udev ]
+    ++ lib.optionals stdenv.isDarwin [ PCSC IOKit CoreFoundation AppKit ];
+
+  postInstall = ''
+    installShellCompletion target/*/release/solo2.{bash,fish,zsh}
+  '';
+
+  doCheck = true;
+
+  buildFeatures = [ "cli" ];
+
+  meta = with lib; {
+    description = "A CLI tool for managing SoloKeys' Solo2 USB security keys.";
+    homepage = "https://github.com/solokeys/solo2-cli";
+    license = with licenses; [ asl20 mit ]; # either at your option
+    maintainers = with maintainers; [ lukegb ];
+  };
+}
diff --git a/pkgs/tools/security/volatility/default.nix b/pkgs/tools/security/volatility/default.nix
index 4abbbd2d1d1..9c73f8a0019 100644
--- a/pkgs/tools/security/volatility/default.nix
+++ b/pkgs/tools/security/volatility/default.nix
@@ -1,6 +1,6 @@
-{ lib, fetchFromGitHub, pythonPackages }:
+{ lib, fetchFromGitHub, python2Packages }:
 
-pythonPackages.buildPythonApplication rec {
+python2Packages.buildPythonApplication rec {
   pname = "volatility";
   version = "2.6.1";
 
@@ -13,7 +13,7 @@ pythonPackages.buildPythonApplication rec {
 
   doCheck = false;
 
-  propagatedBuildInputs = with pythonPackages; [ pycrypto distorm3 pillow ];
+  propagatedBuildInputs = with python2Packages; [ pycrypto distorm3 pillow ];
 
   meta = with lib; {
     homepage = "https://www.volatilityfoundation.org/";
diff --git a/pkgs/tools/system/btop/default.nix b/pkgs/tools/system/btop/default.nix
index 50ea70ae48d..7002976e3d0 100644
--- a/pkgs/tools/system/btop/default.nix
+++ b/pkgs/tools/system/btop/default.nix
@@ -8,13 +8,14 @@
 
 stdenv.mkDerivation rec {
   pname = "btop";
-  version = "1.1.4";
+  version = "1.2.0";
+  hash = "qNm0mzPPh6jYIJX1W+macIDiGyWT+0jk7O0jCmvV/S4=";
 
   src = fetchFromGitHub {
     owner = "aristocratos";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1q8rp34fjbg9abbw5v6l5h9cmvzqq05cmkgavh8qd5xyimsx3xyh";
+    sha256 = hash;
   };
 
   hardeningDisable = lib.optionals (stdenv.isAarch64 && stdenv.isDarwin) [ "stackprotector" ];
diff --git a/pkgs/tools/system/collectd/plugins.nix b/pkgs/tools/system/collectd/plugins.nix
index 6438a545a48..de8948db6c9 100644
--- a/pkgs/tools/system/collectd/plugins.nix
+++ b/pkgs/tools/system/collectd/plugins.nix
@@ -31,7 +31,7 @@
 , perl
 , postgresql
 , protobufc
-, python
+, python2
 , rabbitmq-c
 , rdkafka
 , riemann_c_client
@@ -102,7 +102,7 @@ let
     pinba.buildInputs = [ protobufc ];
     ping.buildInputs = [ liboping ];
     postgresql.buildInputs = [ postgresql ];
-    python.buildInputs = [ python ];
+    python.buildInputs = [ python2 ];
     redis.buildInputs = [ hiredis ];
     rrdcached.buildInputs = [ rrdtool libxml2 ];
     rrdtool.buildInputs = [ rrdtool libxml2 ];
diff --git a/pkgs/tools/system/ps_mem/default.nix b/pkgs/tools/system/ps_mem/default.nix
index 1752aba240f..073a0921f98 100644
--- a/pkgs/tools/system/ps_mem/default.nix
+++ b/pkgs/tools/system/ps_mem/default.nix
@@ -1,9 +1,9 @@
-{ lib, pythonPackages, fetchFromGitHub }:
+{ lib, python2Packages, fetchFromGitHub }:
 
 let
   version = "3.13";
   pname = "ps_mem";
-in pythonPackages.buildPythonApplication {
+in python2Packages.buildPythonApplication {
   name = "${pname}-${version}";
 
   src = fetchFromGitHub {
diff --git a/pkgs/tools/system/rsyslog/default.nix b/pkgs/tools/system/rsyslog/default.nix
index acf56b1558f..d27985edbc4 100644
--- a/pkgs/tools/system/rsyslog/default.nix
+++ b/pkgs/tools/system/rsyslog/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, autoreconfHook, libestr, json_c, zlib, pythonPackages, fastJson
+{ lib, stdenv, fetchurl, pkg-config, autoreconfHook, libestr, json_c, zlib, docutils, fastJson
 , libkrb5 ? null, systemd ? null, jemalloc ? null, libmysqlclient ? null, postgresql ? null
 , libdbi ? null, net-snmp ? null, libuuid ? null, curl ? null, gnutls ? null
 , libgcrypt ? null, liblognorm ? null, openssl ? null, librelp ? null, libksi ? null
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config autoreconfHook ];
   buildInputs = [
-    fastJson libestr json_c zlib pythonPackages.docutils libkrb5 jemalloc
+    fastJson libestr json_c zlib docutils libkrb5 jemalloc
     postgresql libdbi net-snmp libuuid curl gnutls libgcrypt liblognorm openssl
     librelp libksi liblogging libnet hadoop rdkafka libmongo-client czmq
     rabbitmq-c hiredis mongoc libmaxminddb
diff --git a/pkgs/tools/system/syslog-ng-incubator/default.nix b/pkgs/tools/system/syslog-ng-incubator/default.nix
index 0f8db091d61..affb4bca6ce 100644
--- a/pkgs/tools/system/syslog-ng-incubator/default.nix
+++ b/pkgs/tools/system/syslog-ng-incubator/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, glib, syslogng
-, eventlog, perl, python, bison, protobufc, libivykis, libcap, czmq
+, eventlog, perl, python2, bison, protobufc, libivykis, libcap, czmq
 }:
 
 stdenv.mkDerivation rec {
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config autoreconfHook bison ];
 
   buildInputs = [
-    glib syslogng eventlog perl python protobufc libivykis libcap czmq
+    glib syslogng eventlog perl python2 protobufc libivykis libcap czmq
   ];
 
   configureFlags = [
diff --git a/pkgs/tools/system/syslog-ng/default.nix b/pkgs/tools/system/syslog-ng/default.nix
index 51f8cd94da1..d0a22203aa9 100644
--- a/pkgs/tools/system/syslog-ng/default.nix
+++ b/pkgs/tools/system/syslog-ng/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, openssl, libcap, curl, which
-, eventlog, pkg-config, glib, python, systemd, perl
+, eventlog, pkg-config, glib, python2, systemd, perl
 , riemann_c_client, protobufc, pcre, libnet
 , json_c, libuuid, libivykis, mongoc, rabbitmq-c
 , libesmtp
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     eventlog
     glib
     perl
-    python
+    python2
     systemd
     riemann_c_client
     protobufc
diff --git a/pkgs/tools/text/mdcat/default.nix b/pkgs/tools/text/mdcat/default.nix
index 6cdd90f2be3..fdf05fe2001 100644
--- a/pkgs/tools/text/mdcat/default.nix
+++ b/pkgs/tools/text/mdcat/default.nix
@@ -12,20 +12,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdcat";
-  version = "0.25.0";
+  version = "0.25.1";
 
   src = fetchFromGitHub {
     owner = "lunaryorn";
     repo = pname;
     rev = "mdcat-${version}";
-    sha256 = "sha256-wrtvVFOSqpNBWLRGPL+08WBS4ltQyZwRE3/dqqT6IXg=";
+    sha256 = "sha256-deG2VjyjFs0LFeTXfPYy3zzjj0rpVjxE0DhkpD5PzSQ=";
   };
 
   nativeBuildInputs = [ pkg-config asciidoctor installShellFiles ];
   buildInputs = [ openssl ]
     ++ lib.optional stdenv.isDarwin Security;
 
-  cargoSha256 = "sha256-9I6/lt5VXfZp2/W6EoXtagcNj2kfxB5ZT2GkWgsUyM8=";
+  cargoSha256 = "sha256-bPGSdXooBZMye3yj00f3rWIiW4wfg2B4meH44hpkXTY=";
 
   checkInputs = [ ansi2html ];
   # Skip tests that use the network and that include files.
diff --git a/pkgs/tools/text/opencc/default.nix b/pkgs/tools/text/opencc/default.nix
index cbb055323a6..5ad14295e87 100644
--- a/pkgs/tools/text/opencc/default.nix
+++ b/pkgs/tools/text/opencc/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, python }:
+{ lib, stdenv, fetchFromGitHub, cmake, python2 }:
 
 stdenv.mkDerivation rec {
   pname = "opencc";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-q/y4tRov/BYCAiE4i7fT6ysTerxxOHMZUWT2Jlo/0rI=";
   };
 
-  nativeBuildInputs = [ cmake python ];
+  nativeBuildInputs = [ cmake python2 ];
 
   # let intermediate tools find intermediate library
   preBuild = lib.optionalString stdenv.isLinux ''
diff --git a/pkgs/tools/text/shocco/default.nix b/pkgs/tools/text/shocco/default.nix
index 11d8194bb70..1359db98978 100644
--- a/pkgs/tools/text/shocco/default.nix
+++ b/pkgs/tools/text/shocco/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, perlPackages, pythonPackages }:
+{ lib, stdenv, fetchFromGitHub, perlPackages, python3 }:
 
 stdenv.mkDerivation rec {
   pname = "shocco";
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     substituteInPlace configure --replace PATH= NIRVANA=
   '';
 
-  buildInputs = [ perlPackages.TextMarkdown pythonPackages.pygments ];
+  buildInputs = [ perlPackages.TextMarkdown python3.pkgs.pygments ];
 
   meta = with lib; {
     description = "A quick-and-dirty, literate-programming-style documentation generator for / in POSIX shell";
diff --git a/pkgs/tools/text/txt2tags/default.nix b/pkgs/tools/text/txt2tags/default.nix
index eb299caade9..9f237066d7c 100644
--- a/pkgs/tools/text/txt2tags/default.nix
+++ b/pkgs/tools/text/txt2tags/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, python }:
+{ lib, stdenv, fetchurl, python2 }:
 
 stdenv.mkDerivation rec {
   version = "2.6";
@@ -7,13 +7,13 @@ stdenv.mkDerivation rec {
   dontBuild = true;
 
   # Python script, needs the interpreter
-  propagatedBuildInputs = [ python ];
+  propagatedBuildInputs = [ python2 ];
 
   installPhase = ''
     mkdir -p "$out/bin"
     mkdir -p "$out/share/doc"
     mkdir -p "$out/share/man/man1/"
-    sed '1s|/usr/bin/env python|${python}/bin/python|' < txt2tags > "$out/bin/txt2tags"
+    sed '1s|/usr/bin/env python|${python2}/bin/python|' < txt2tags > "$out/bin/txt2tags"
     chmod +x "$out/bin/txt2tags"
     gzip - < doc/manpage.man > "$out/share/man/man1/txt2tags.1.gz"
     cp doc/userguide.pdf "$out/share/doc"
diff --git a/pkgs/tools/typesetting/odpdown/default.nix b/pkgs/tools/typesetting/odpdown/default.nix
index 85dcece956f..252167fcea9 100644
--- a/pkgs/tools/typesetting/odpdown/default.nix
+++ b/pkgs/tools/typesetting/odpdown/default.nix
@@ -1,6 +1,6 @@
-{ lib, fetchFromGitHub, pythonPackages, libreoffice }:
+{ lib, fetchFromGitHub, python2Packages, libreoffice }:
 
-pythonPackages.buildPythonApplication rec {
+python2Packages.buildPythonApplication rec {
 
   pname = "odpdown";
   version = "0.4.1";
@@ -12,9 +12,9 @@ pythonPackages.buildPythonApplication rec {
     sha256 = "r2qbgD9PAalbypt+vjp2YcYggUGPQMEG2FDxMtohqG4=";
   };
 
-  propagatedBuildInputs = with pythonPackages; [ libreoffice lpod lxml mistune pillow pygments ];
+  propagatedBuildInputs = with python2Packages; [ libreoffice lpod lxml mistune pillow pygments ];
 
-  checkInputs = with pythonPackages; [
+  checkInputs = with python2Packages; [
     nose
   ];
 
diff --git a/pkgs/tools/video/vnc2flv/default.nix b/pkgs/tools/video/vnc2flv/default.nix
index fdaf2ee2746..f32078f0b8a 100644
--- a/pkgs/tools/video/vnc2flv/default.nix
+++ b/pkgs/tools/video/vnc2flv/default.nix
@@ -1,6 +1,6 @@
-{ lib, fetchurl, pythonPackages }:
+{ lib, fetchurl, python2Packages }:
 
-pythonPackages.buildPythonApplication rec {
+python2Packages.buildPythonApplication rec {
   pname = "vnc2flv";
   version = "20100207";
 
diff --git a/pkgs/tools/virtualization/cri-tools/default.nix b/pkgs/tools/virtualization/cri-tools/default.nix
index 16a7ecffa04..846e2ee2794 100644
--- a/pkgs/tools/virtualization/cri-tools/default.nix
+++ b/pkgs/tools/virtualization/cri-tools/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "cri-tools";
-  version = "1.22.0";
+  version = "1.23.0";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+36lGLpNnTQnwwmXoVNPt3RMcnE46AdXOpghvhP0Bq0=";
+    sha256 = "sha256-b65GY08vykVp/PUBmBXKIfykyPEJRgGjgu7zBoXx3K0=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/tools/virtualization/xe-guest-utilities/default.nix b/pkgs/tools/virtualization/xe-guest-utilities/default.nix
index ab3c9b1e71c..2497cc6a9df 100644
--- a/pkgs/tools/virtualization/xe-guest-utilities/default.nix
+++ b/pkgs/tools/virtualization/xe-guest-utilities/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, bzip2, lzo, zlib, xz, bash, python, gnutar, gnused, gnugrep, which }:
+{ lib, stdenv, fetchurl, bzip2, lzo, zlib, xz, bash, python2, gnutar, gnused, gnugrep, which }:
 
 stdenv.mkDerivation (rec {
   pname = "xe-guest-utilities";
@@ -14,7 +14,7 @@ stdenv.mkDerivation (rec {
     url = "https://sources.archlinux.org/other/community/xe-guest-utilities/xe-guest-utilities_${version}-1120.tar.gz";
     sha256 = "f9593cd9588188f80253e736f48d8dd94c5b517abb18316085f86acffab48794";
   };
-  buildInputs = [ bzip2 gnutar gnused python lzo zlib xz stdenv gnugrep which ];
+  buildInputs = [ bzip2 gnutar gnused python2 lzo zlib xz stdenv gnugrep which ];
   patches = [ ./ip-address.patch ];
   postPatch = ''
     tar xf "$NIX_BUILD_TOP/$name/xenstore-sources.tar.bz2"
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 2a34d4e5353..4a102733f05 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -346,6 +346,7 @@ mapAliases ({
   gnuradio-limesdr = gnuradio3_7.pkgs.limesdr; # added 2019-05-27, changed 2020-10-16
   gnuradio-rds = gnuradio3_7.pkgs.rds; # added 2019-05-27, changed 2020-10-16
   gnuradio-osmosdr = gnuradio3_7.pkgs.osmosdr; # added 2019-05-27, changed 2020-10-16
+  gnuradio3_7 = throw "gnuradio3_7 has been removed because it required Python 2"; # added 2022-01-16
   gr-nacl = gnuradio3_7.pkgs.nacl; # added 2019-05-27, changed 2020-10-16
   gr-gsm = gnuradio3_7.pkgs.gsm; # added 2019-05-27, changed 2020-10-16
   gr-ais = gnuradio3_7.pkgs.ais; # added 2019-05-27, changed 2020-10-16
@@ -660,6 +661,7 @@ mapAliases ({
   nologin = shadow; # added 2018-04-25
   nordic-polar = throw "nordic-polar was removed on 2021-05-27, now integrated in nordic"; # added 2021-05-27
   nottetris2 = throw "nottetris2 was removed because it is unmaintained by upstream and broken"; # added 2022-01-15
+  noto-fonts-cjk = noto-fonts-cjk-sans; # added 2021-12-16
   now-cli = throw "now-cli has been replaced with nodePackages.vercel"; # added 2021-08-05
   nxproxy = nx-libs; # added 2019-02-15
   nylas-mail-bin = throw "nylas-mail-bin was deprecated on 2019-09-11: abandoned by upstream";
@@ -785,6 +787,7 @@ mapAliases ({
   pgtap = postgresqlPackages.pgtap;
   plv8 = postgresqlPackages.plv8;
   timescaledb = postgresqlPackages.timescaledb;
+  tlauncher = throw "tlauncher has been removed because there questionable practices and legality concerns";
   tsearch_extras = postgresqlPackages.tsearch_extras;
   cstore_fdw = postgresqlPackages.cstore_fdw;
   pg_hll = postgresqlPackages.pg_hll;
@@ -821,8 +824,11 @@ mapAliases ({
   pyrex095 = throw "pyrex has been removed from nixpkgs as the project is still stuck on python2."; # added 2022-01-12
   pyrex096 = throw "pyrex has been removed from nixpkgs as the project is still stuck on python2."; # added 2022-01-12
   pyrit = throw "pyrit has been removed from nixpkgs as the project is still stuck on python2."; # added 2022-01-01
+  python = python2; # added 2022-01-11
   python2nix = throw "python2nix has been removed as it is outdated. Use e.g. nixpkgs-pytools instead."; # added 2021-03-08
   python-swiftclient = swiftclient; # added 2021-09-09
+  pythonFull = python2Full; # added 2022-01-11
+  pythonPackages = python.pkgs; # added 2022-01-11
   quagga = throw "quagga is no longer maintained upstream"; # added 2021-04-22
   qca-qt5 = libsForQt5.qca-qt5;  # added 2015-12-19
   qcsxcad = libsForQt5.qcsxcad;  # added 2020-11-05
@@ -998,6 +1004,7 @@ mapAliases ({
   telepathy_salut = telepathy-salut; # added 2018-02-25
   telnet = inetutils; # added 2018-05-15
   terminus = throw "terminus has been removed, it was unmaintained in nixpkgs"; # added 2021-08-21
+  terraform_0_12 = throw "terraform_0_12 has been removed from nixpkgs on 2021/01";
   terraform_1_0_0 = throw "terraform_1_0_0 has been renamed to terraform_1"; # added 2021-06-15
   terraform_1_0 = throw "terraform_1_0 has been renamed to terraform_1"; # added 2021-12-08
   terraform-provider-ibm = terraform-providers.ibm; # added 2018-09-28
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index edd149b0f96..811b8ea71d2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3488,6 +3488,8 @@ with pkgs;
 
   nrsc5 = callPackage ../applications/misc/nrsc5 { };
 
+  nsync = callPackage ../development/libraries/nsync { };
+
   nwipe = callPackage ../tools/security/nwipe { };
 
   nx2elf = callPackage ../tools/compression/nx2elf { };
@@ -4660,7 +4662,7 @@ with pkgs;
   diffutils = callPackage ../tools/text/diffutils { };
 
   dir2opus = callPackage ../tools/audio/dir2opus {
-    inherit (pythonPackages) mutagen python wrapPython;
+    inherit (python2Packages) mutagen python wrapPython;
   };
 
   dirdiff = callPackage ../tools/text/dirdiff {
@@ -4889,6 +4891,10 @@ with pkgs;
 
   s-tar = callPackage ../tools/archivers/s-tar {};
 
+  solo2-cli = callPackage ../tools/security/solo2-cli {
+    inherit (darwin.apple_sdk.frameworks) PCSC IOKit CoreFoundation AppKit;
+  };
+
   sonota = callPackage ../tools/misc/sonota { };
 
   sonobuoy = callPackage ../applications/networking/cluster/sonobuoy { };
@@ -4921,8 +4927,8 @@ with pkgs;
 
   timeline = callPackage ../applications/office/timeline { };
 
-  tsm-client = callPackage ../tools/backup/tsm-client { jdk8 = null; };
-  tsm-client-withGui = callPackage ../tools/backup/tsm-client { };
+  tsm-client = callPackage ../tools/backup/tsm-client { };
+  tsm-client-withGui = callPackage ../tools/backup/tsm-client { enableGui = true; };
 
   tracker = callPackage ../development/libraries/tracker { };
 
@@ -8520,6 +8526,8 @@ with pkgs;
 
   page = callPackage ../tools/misc/page { };
 
+  PageEdit = libsForQt5.callPackage ../applications/office/PageEdit { };
+
   pagmo2 = callPackage ../development/libraries/pagmo2 { };
 
   pakcs = callPackage ../development/compilers/pakcs { };
@@ -10690,7 +10698,7 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) OpenCL;
   };
 
-  wakatime = pythonPackages.callPackage ../tools/misc/wakatime { };
+  wakatime = python2Packages.callPackage ../tools/misc/wakatime { };
 
   weather = callPackage ../applications/misc/weather { };
 
@@ -13243,7 +13251,6 @@ with pkgs;
   vala-lint = callPackage ../development/tools/vala-lint { };
 
   inherit (callPackage ../development/compilers/vala { })
-    vala_0_40
     vala_0_48
     vala_0_52
     vala_0_54
@@ -13643,7 +13650,6 @@ with pkgs;
   # Python interpreters. All standard library modules are included except for tkinter, which is
   # available as `pythonPackages.tkinter` and can be used as any other Python package.
   # When switching these sets, please update docs at ../../doc/languages-frameworks/python.md
-  python = python2;
   python2 = python27;
   python3 = python39;
   pypy = pypy2;
@@ -13652,11 +13658,6 @@ with pkgs;
 
   # Python interpreter that is build with all modules, including tkinter.
   # These are for compatibility and should not be used inside Nixpkgs.
-  pythonFull = python.override {
-    self = pythonFull;
-    pythonAttr = "pythonFull";
-    x11Support = true;
-  };
   python2Full = python2.override {
     self = python2Full;
     pythonAttr = "python2Full";
@@ -13693,7 +13694,6 @@ with pkgs;
   };
 
   # pythonPackages further below, but assigned here because they need to be in sync
-  pythonPackages = python.pkgs;
   python2Packages = python2.pkgs;
   python3Packages = python3.pkgs;
 
@@ -13871,6 +13871,7 @@ with pkgs;
 
   wasm3 = callPackage ../development/interpreters/wasm3 { };
 
+  yex-lang = callPackage ../development/interpreters/yex-lang { };
 
   ### DEVELOPMENT / MISC
 
@@ -14428,6 +14429,8 @@ with pkgs;
 
   ctodo = callPackage ../applications/misc/ctodo { };
 
+  cubiomes-viewer = libsForQt5.callPackage ../applications/misc/cubiomes-viewer { };
+
   ctmg = callPackage ../tools/security/ctmg { };
 
   cmake_2_8 = callPackage ../development/tools/build-managers/cmake/2.8.nix { };
@@ -17258,7 +17261,9 @@ with pkgs;
     llvmPackages = llvmPackages_11;
   };
 
-  isso = callPackage ../servers/isso { };
+  isso = callPackage ../servers/isso {
+    nodejs = nodejs-14_x;
+  };
 
   itk4 = callPackage ../development/libraries/itk/4.x.nix {
     inherit (darwin.apple_sdk.frameworks) Cocoa;
@@ -19110,7 +19115,9 @@ with pkgs;
 
   openbabel2 = callPackage ../development/libraries/openbabel/2.nix { };
 
-  openbabel3 = callPackage ../development/libraries/openbabel { };
+  openbabel3 = callPackage ../development/libraries/openbabel {
+    python = python3;
+  };
 
   opencascade = callPackage ../development/libraries/opencascade {
     inherit (darwin.apple_sdk.frameworks) OpenCL Cocoa;
@@ -20179,17 +20186,9 @@ with pkgs;
     gnutls = gnutls;
   });
 
-  v8_5_x = callPackage ../development/libraries/v8/5_x.nix ({
-    inherit (python2Packages) python gyp;
-    icu = icu58; # v8-5.4.232 fails against icu4c-59.1
-  } // lib.optionalAttrs stdenv.isLinux {
-    # doesn't build with gcc7
-    stdenv = gcc6Stdenv;
-  });
+  v8 = callPackage ../development/libraries/v8 { };
 
-  v8 = callPackage ../development/libraries/v8 {
-    inherit (python2Packages) python;
-  };
+  v8_8_x = callPackage ../development/libraries/v8/8_x.nix { };
 
   vaapiIntel = callPackage ../development/libraries/vaapi-intel { };
 
@@ -20746,6 +20745,8 @@ with pkgs;
     packages = [];
   };
 
+  rstudioServerWrapper = rstudioWrapper.override { rstudio = rstudio-server; };
+
   rPackages = dontRecurseIntoAttrs (callPackage ../development/r-modules {
     overrides = (config.rPackageOverrides or (_: {})) pkgs;
   });
@@ -20760,6 +20761,8 @@ with pkgs;
 
   alerta-server = callPackage ../servers/monitoring/alerta { };
 
+  alps = callPackage ../servers/alps {};
+
   apacheHttpd_2_4 = callPackage ../servers/http/apache-httpd/2.4.nix { };
   apacheHttpd = apacheHttpd_2_4;
 
@@ -21679,7 +21682,7 @@ with pkgs;
 
   qpid-cpp = callPackage ../servers/amqp/qpid-cpp {
     boost = boost155;
-    inherit (pythonPackages) buildPythonPackage qpid-python;
+    inherit (python2Packages) buildPythonPackage qpid-python;
   };
 
   qremotecontrol-server = callPackage ../servers/misc/qremotecontrol-server { };
@@ -23600,6 +23603,8 @@ with pkgs;
 
   libre-franklin = callPackage ../data/fonts/libre-franklin { };
 
+  lightly-qt = libsForQt5.callPackage ../data/themes/lightly-qt { };
+
   line-awesome = callPackage ../data/fonts/line-awesome { };
 
   linux-manual = callPackage ../data/documentation/linux-manual { };
@@ -23719,7 +23724,12 @@ with pkgs;
   nordzy-cursor-theme = callPackage ../data/icons/nordzy-cursor-theme { };
 
   inherit (callPackages ../data/fonts/noto-fonts {})
-    noto-fonts noto-fonts-cjk noto-fonts-emoji noto-fonts-emoji-blob-bin noto-fonts-extra;
+    noto-fonts
+    noto-fonts-cjk-sans
+    noto-fonts-cjk-serif
+    noto-fonts-emoji
+    noto-fonts-emoji-blob-bin
+    noto-fonts-extra;
 
   nuclear = callPackage ../applications/audio/nuclear { };
 
@@ -24009,6 +24019,8 @@ with pkgs;
 
   theano = callPackage ../data/fonts/theano { };
 
+  tela-circle-icon-theme = callPackage ../data/icons/tela-circle-icon-theme { };
+
   tela-icon-theme = callPackage ../data/icons/tela-icon-theme { };
 
   template-glib = callPackage ../development/libraries/template-glib { };
@@ -24217,7 +24229,7 @@ with pkgs;
 
   alock = callPackage ../misc/screensavers/alock { };
 
-  inherit (python3Packages) alot;
+  alot = callPackage ../applications/networking/mailreaders/alot { };
 
   alpine = callPackage ../applications/networking/mailreaders/alpine {
     tcl = tcl-8_5;
@@ -24434,7 +24446,13 @@ with pkgs;
 
   berry = callPackage ../applications/window-managers/berry { };
 
-  bespokesynth = callPackage ../applications/audio/bespokesynth { };
+  bespokesynth = callPackage ../applications/audio/bespokesynth {
+    inherit (darwin.apple_sdk.frameworks) Cocoa WebKit CoreServices CoreAudioKit;
+  };
+
+  bespokesynth-with-vst2 = bespokesynth.override {
+    enableVST2 = true;
+  };
 
   bevelbar = callPackage ../applications/window-managers/bevelbar { };
 
@@ -25352,19 +25370,20 @@ with pkgs;
       };
     };
   };
-  gnuradio3_8 = callPackage ../applications/radio/gnuradio/wrapper.nix {
-    unwrapped = callPackage ../applications/radio/gnuradio/3.8.nix {
+  gnuradio3_9 = callPackage ../applications/radio/gnuradio/wrapper.nix {
+    unwrapped = callPackage ../applications/radio/gnuradio/3.9.nix {
       inherit (darwin.apple_sdk.frameworks) CoreAudio;
       python = python3;
     };
   };
-  gnuradio3_8Packages = lib.recurseIntoAttrs gnuradio3_8.pkgs;
-  # A build without gui components and other utilites not needed if gnuradio is
-  # used as a c++ library.
-  gnuradio3_8Minimal = gnuradio3_8.override {
+  gnuradio3_9Packages = lib.recurseIntoAttrs gnuradio.pkgs;
+  # A build without gui components and other utilites not needed for end user
+  # libraries
+  gnuradio3_9Minimal = gnuradio.override {
     doWrap = false;
-    unwrapped = gnuradio3_8.unwrapped.override {
+    unwrapped = gnuradio.unwrapped.override {
       volk = volk.override {
+        # So it will not reference python
         enableModTool = false;
       };
       features = {
@@ -25374,6 +25393,7 @@ with pkgs;
         gr-qtgui = false;
         gr-utils = false;
         gr-modtool = false;
+        gr-blocktool = false;
         sphinx = false;
         doxygen = false;
         # Doesn't make it reference python eventually, but makes reverse
@@ -25382,31 +25402,33 @@ with pkgs;
       };
     };
   };
-  gnuradio3_7 = callPackage ../applications/radio/gnuradio/wrapper.nix {
-    unwrapped = callPackage ../applications/radio/gnuradio/3.7.nix {
+  gnuradio3_8 = callPackage ../applications/radio/gnuradio/wrapper.nix {
+    unwrapped = callPackage ../applications/radio/gnuradio/3.8.nix {
       inherit (darwin.apple_sdk.frameworks) CoreAudio;
-      python = python2;
-      # Incompatible with uhd4+
-      uhd = uhd3_5;
+      python = python3;
     };
   };
-  gnuradio3_7Packages = lib.recurseIntoAttrs gnuradio3_7.pkgs;
+  gnuradio3_8Packages = lib.recurseIntoAttrs gnuradio3_8.pkgs;
   # A build without gui components and other utilites not needed if gnuradio is
   # used as a c++ library.
-  gnuradio3_7Minimal = gnuradio3_7.override {
+  gnuradio3_8Minimal = gnuradio3_8.override {
     doWrap = false;
-    unwrapped = gnuradio3_7.unwrapped.override {
+    unwrapped = gnuradio3_8.unwrapped.override {
       volk = volk.override {
         enableModTool = false;
       };
       features = {
         gnuradio-companion = false;
         python-support = false;
+        examples = false;
         gr-qtgui = false;
         gr-utils = false;
+        gr-modtool = false;
         sphinx = false;
         doxygen = false;
-        gr-wxgui = false;
+        # Doesn't make it reference python eventually, but makes reverse
+        # depdendencies require python to use cmake files of GR.
+        gr-ctrlport = false;
       };
     };
   };
@@ -25589,6 +25611,8 @@ with pkgs;
     desktopName = "Firefox DevEdition";
   };
 
+  firefox_decrypt = python3Packages.callPackage ../tools/security/firefox_decrypt { };
+
   flac = callPackage ../applications/audio/flac { };
 
   redoflacs = callPackage ../applications/audio/redoflacs { };
@@ -27174,7 +27198,9 @@ with pkgs;
     ocamlPackages = ocaml-ng.ocamlPackages_4_01_0;
   };
 
-  monitor = callPackage ../applications/system/monitor { };
+  monitor = callPackage ../applications/system/monitor {
+    libXNVCtrl = linuxPackages.nvidia_x11.settings.libXNVCtrl;
+  };
 
   moolticute = libsForQt5.callPackage ../applications/misc/moolticute { };
 
@@ -28029,6 +28055,10 @@ with pkgs;
 
   polymake = callPackage ../applications/science/math/polymake { };
 
+  pomotroid = callPackage ../applications/misc/pomotroid {
+    electron = electron_9;
+  };
+
   pond = callPackage ../applications/networking/instant-messengers/pond { };
 
   ponymix = callPackage ../applications/audio/ponymix { };
@@ -28345,6 +28375,10 @@ with pkgs;
 
   rofi-unwrapped = callPackage ../applications/misc/rofi { };
   rofi = callPackage ../applications/misc/rofi/wrapper.nix { };
+  rofi-wayland-unwrapped = callPackage ../applications/misc/rofi/wayland.nix { };
+  rofi-wayland = callPackage ../applications/misc/rofi/wrapper.nix {
+    rofi-unwrapped = rofi-wayland-unwrapped;
+  };
 
   rofi-pass = callPackage ../tools/security/pass/rofi-pass.nix { };
 
@@ -28366,6 +28400,8 @@ with pkgs;
     jdk = jdk8;
   };
 
+  rstudio-server = rstudio.override { server = true; };
+
   rsync = callPackage ../applications/networking/sync/rsync (config.rsync or {});
   rrsync = callPackage ../applications/networking/sync/rsync/rrsync.nix {};
 
@@ -28489,7 +28525,9 @@ with pkgs;
 
   spideroak = callPackage ../applications/networking/spideroak { };
 
-  split2flac = callPackage ../applications/audio/split2flac { };
+  split2flac = callPackage ../applications/audio/split2flac {
+    inherit (python3.pkgs) mutagen;
+  };
 
   spotify-qt = libsForQt5.callPackage ../applications/audio/spotify-qt { };
 
@@ -29001,9 +29039,7 @@ with pkgs;
 
   topydo = callPackage ../applications/misc/topydo {};
 
-  torchat = callPackage ../applications/networking/instant-messengers/torchat {
-    inherit (pythonPackages) wrapPython wxPython;
-  };
+  torchat = callPackage ../applications/networking/instant-messengers/torchat { };
 
   torrential = callPackage ../applications/networking/p2p/torrential { };
 
@@ -30232,6 +30268,22 @@ with pkgs;
 
   drumkv1 = libsForQt5.callPackage ../applications/audio/drumkv1 { };
 
+  gshhg-gmt = callPackage ../applications/gis/gmt/gshhg.nix { };
+
+  eureka-editor = callPackage ../applications/misc/eureka-editor { };
+
+  eureka-ideas = callPackage ../applications/misc/eureka-ideas {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
+  fava = callPackage ../applications/office/fava {};
+
+  nux = callPackage ../tools/misc/nux { };
+
+  tts = callPackage ../tools/audio/tts { };
+
+  fslint = callPackage ../applications/misc/fslint { };
+
   ### GAMES
 
   _1oom = callPackage ../games/1oom { };
@@ -30254,7 +30306,7 @@ with pkgs;
 
   blockattack = callPackage ../games/blockattack { } ;
 
-  colobot = callPackage ../games/colobot {};
+  colobot = callPackage ../games/colobot { };
 
   doom-bcc = callPackage ../games/zdoom/bcc-git.nix { };
 
@@ -30349,7 +30401,7 @@ with pkgs;
   amoeba = callPackage ../games/amoeba { };
   amoeba-data = callPackage ../games/amoeba/data.nix { };
 
-  andyetitmoves = callPackage ../games/andyetitmoves {};
+  andyetitmoves = callPackage ../games/andyetitmoves { };
 
   angband = callPackage ../games/angband { };
 
@@ -30362,7 +30414,7 @@ with pkgs;
 
   armagetronad-dedicated = callPackage ../games/armagetronad { dedicatedServer = true; };
 
-  arena = callPackage ../games/arena {};
+  arena = callPackage ../games/arena { };
 
   arx-libertatis = libsForQt5.callPackage ../games/arx-libertatis { };
 
@@ -30376,17 +30428,17 @@ with pkgs;
 
   astromenace = callPackage ../games/astromenace { };
 
-  atanks = callPackage ../games/atanks {};
+  atanks = callPackage ../games/atanks { };
 
-  azimuth = callPackage ../games/azimuth {};
+  azimuth = callPackage ../games/azimuth { };
 
   ballAndPaddle = callPackage ../games/ball-and-paddle {
     guile = guile_1_8;
   };
 
-  banner = callPackage ../games/banner {};
+  banner = callPackage ../games/banner { };
 
-  bastet = callPackage ../games/bastet {};
+  bastet = callPackage ../games/bastet { };
 
   black-hole-solver = callPackage ../games/black-hole-solver {
     inherit (perlPackages) PathTiny;
@@ -30471,12 +30523,12 @@ with pkgs;
   inherit (import ../games/crossfire pkgs)
     crossfire-server crossfire-arch crossfire-maps crossfire-client;
 
-  crrcsim = callPackage ../games/crrcsim {};
+  crrcsim = callPackage ../games/crrcsim { };
 
   curseofwar = callPackage ../games/curseofwar { SDL = null; };
   curseofwar-sdl = callPackage ../games/curseofwar { ncurses = null; };
 
-  cutemaze = libsForQt5.callPackage ../games/cutemaze {};
+  cutemaze = libsForQt5.callPackage ../games/cutemaze { };
 
   cuyo = callPackage ../games/cuyo { };
 
@@ -30491,7 +30543,7 @@ with pkgs;
     };
   };
 
-  dhewm3 = callPackage ../games/dhewm3 {};
+  dhewm3 = callPackage ../games/dhewm3 { };
 
   domination = callPackage ../games/domination { };
 
@@ -30539,12 +30591,6 @@ with pkgs;
 
   eternity = callPackage ../games/eternity-engine { };
 
-  eureka-editor = callPackage ../applications/misc/eureka-editor { };
-
-  eureka-ideas = callPackage ../applications/misc/eureka-ideas {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-
   extremetuxracer = callPackage ../games/extremetuxracer {
     libpng = libpng12;
   };
@@ -30573,13 +30619,11 @@ with pkgs;
 
   factorio-utils = callPackage ../games/factorio/utils.nix { };
 
-  fairymax = callPackage ../games/fairymax {};
-
-  fava = callPackage ../applications/office/fava {};
+  fairymax = callPackage ../games/fairymax { };
 
-  fheroes2 = callPackage ../games/fheroes2 {};
+  fheroes2 = callPackage ../games/fheroes2 { };
 
-  fish-fillets-ng = callPackage ../games/fish-fillets-ng {};
+  fish-fillets-ng = callPackage ../games/fish-fillets-ng { };
 
   fishfight = callPackage ../games/fishfight {
     inherit (xorg) libX11 libXi;
@@ -30625,8 +30669,6 @@ with pkgs;
     };
   };
 
-  fslint = callPackage ../applications/misc/fslint {};
-
   galaxis = callPackage ../games/galaxis { };
 
   gambatte = callPackage ../games/gambatte { };
@@ -30645,9 +30687,9 @@ with pkgs;
 
   gemrb = callPackage ../games/gemrb { };
 
-  gimx = callPackage ../games/gimx {};
+  gimx = callPackage ../games/gimx { };
 
-  gl117 = callPackage ../games/gl-117 {};
+  gl117 = callPackage ../games/gl-117 { };
 
   globulation2 = callPackage ../games/globulation {
     boost = boost155;
@@ -30673,13 +30715,11 @@ with pkgs;
 
   gnushogi = callPackage ../games/gnushogi { };
 
-  gogui = callPackage ../games/gogui {};
-
-  gscrabble = python3Packages.callPackage ../games/gscrabble {};
+  gogui = callPackage ../games/gogui { };
 
-  gshogi = python3Packages.callPackage ../games/gshogi {};
+  gscrabble = python3Packages.callPackage ../games/gscrabble { };
 
-  gshhg-gmt = callPackage ../applications/gis/gmt/gshhg.nix { };
+  gshogi = python3Packages.callPackage ../games/gshogi { };
 
   qtads = qt5.callPackage ../games/qtads { };
 
@@ -30693,7 +30733,7 @@ with pkgs;
 
   gtypist = callPackage ../games/gtypist { };
 
-  gweled = callPackage ../games/gweled {};
+  gweled = callPackage ../games/gweled { };
 
   gzdoom = callPackage ../games/gzdoom { };
 
@@ -30739,7 +30779,7 @@ with pkgs;
     enableGPU = false;
   };
 
-  klavaro = callPackage ../games/klavaro {};
+  klavaro = callPackage ../games/klavaro { };
 
   kobodeluxe = callPackage ../games/kobodeluxe { };
 
@@ -30761,7 +30801,7 @@ with pkgs;
 
   liberation-circuit = callPackage ../games/liberation-circuit { };
 
-  lincity = callPackage ../games/lincity {};
+  lincity = callPackage ../games/lincity { };
 
   lincity_ng = callPackage ../games/lincity/ng.nix {
     # https://github.com/lincity-ng/lincity-ng/issues/25
@@ -30775,7 +30815,7 @@ with pkgs;
   liquidwar5 = callPackage ../games/liquidwar/5.nix {
   };
 
-  lugaru = callPackage ../games/lugaru {};
+  lugaru = callPackage ../games/lugaru { };
 
   macopix = callPackage ../games/macopix {
     gtk = gtk2;
@@ -30787,7 +30827,7 @@ with pkgs;
 
   mars = callPackage ../games/mars { };
 
-  megaglest = callPackage ../games/megaglest {};
+  megaglest = callPackage ../games/megaglest { };
 
   methane = callPackage ../games/methane { };
 
@@ -30810,7 +30850,7 @@ with pkgs;
   minecraftServers = import ../games/minecraft-servers { inherit callPackage lib javaPackages; };
   minecraft-server = minecraftServers.vanilla; # backwards compatibility
 
-  moon-buggy = callPackage ../games/moon-buggy {};
+  moon-buggy = callPackage ../games/moon-buggy { };
 
   inherit (callPackages ../games/minetest {
     inherit (darwin) libiconv;
@@ -30856,8 +30896,6 @@ with pkgs;
 
   nexuiz = callPackage ../games/nexuiz { };
 
-  nux = callPackage ../tools/misc/nux { };
-
   ninvaders = callPackage ../games/ninvaders { };
 
   njam = callPackage ../games/njam { };
@@ -30892,8 +30930,6 @@ with pkgs;
 
   portmod = callPackage ../games/portmod { };
 
-  tlauncher = callPackage ../games/tlauncher {};
-
   tr-patcher = callPackage ../games/tr-patcher { };
 
   tes3cmd = callPackage ../games/tes3cmd { };
@@ -30920,8 +30956,8 @@ with pkgs;
       static = true;
     };
   };
-  openttd-grfcodec = callPackage ../games/openttd/grfcodec.nix {};
-  openttd-nml = callPackage ../games/openttd/nml.nix {};
+  openttd-grfcodec = callPackage ../games/openttd/grfcodec.nix { };
+  openttd-nml = callPackage ../games/openttd/nml.nix { };
 
   opentyrian = callPackage ../games/opentyrian { };
 
@@ -30943,7 +30979,7 @@ with pkgs;
 
   pinball = callPackage ../games/pinball { };
 
-  pingus = callPackage ../games/pingus {};
+  pingus = callPackage ../games/pingus { };
 
   pioneer = callPackage ../games/pioneer { };
 
@@ -30987,7 +31023,7 @@ with pkgs;
   ioquake3 = callPackage ../games/quake3/ioquake { };
   quake3e = callPackage ../games/quake3/quake3e { };
 
-  quantumminigolf = callPackage ../games/quantumminigolf {};
+  quantumminigolf = callPackage ../games/quantumminigolf { };
 
   r2mod_cli = callPackage ../games/r2mod_cli { };
 
@@ -31036,7 +31072,7 @@ with pkgs;
     openjdk = openjdk8;
   };
 
-  sauerbraten = callPackage ../games/sauerbraten {};
+  sauerbraten = callPackage ../games/sauerbraten { };
 
   scid = callPackage ../games/scid {
     tcl = tcl-8_5;
@@ -31109,7 +31145,7 @@ with pkgs;
 
   ssl-cert-check = callPackage ../tools/admin/ssl-cert-check { };
 
-  stardust = callPackage ../games/stardust {};
+  stardust = callPackage ../games/stardust { };
 
   starspace = callPackage ../applications/science/machine-learning/starspace { };
 
@@ -31211,8 +31247,6 @@ with pkgs;
 
   tremulous = callPackage ../games/tremulous { };
 
-  tts = callPackage ../tools/audio/tts { };
-
   tumiki-fighters = callPackage ../games/tumiki-fighters { };
 
   tuxpaint = callPackage ../games/tuxpaint { };
@@ -31353,8 +31387,8 @@ with pkgs;
 
 
   xpilot-ng = callPackage ../games/xpilot { };
-  bloodspilot-server = callPackage ../games/xpilot/bloodspilot-server.nix {};
-  bloodspilot-client = callPackage ../games/xpilot/bloodspilot-client.nix {};
+  bloodspilot-server = callPackage ../games/xpilot/bloodspilot-server.nix { };
+  bloodspilot-client = callPackage ../games/xpilot/bloodspilot-client.nix { };
 
   xskat = callPackage ../games/xskat { };
 
@@ -31403,6 +31437,10 @@ with pkgs;
 
   _0verkill = callPackage ../games/0verkill { };
 
+  hhexen = callPackage ../games/hhexen { };
+
+  wyvern = callPackage ../games/wyvern { };
+
   ### DESKTOP ENVIRONMENTS
 
   cdesktopenv = callPackage ../desktops/cdesktopenv { };
@@ -31432,8 +31470,6 @@ with pkgs;
 
   gnome-tour = callPackage ../desktops/gnome/core/gnome-tour { };
 
-  hhexen = callPackage ../games/hhexen { };
-
   hsetroot = callPackage ../tools/X11/hsetroot { };
 
   imwheel = callPackage ../tools/X11/imwheel { };
@@ -31677,7 +31713,7 @@ with pkgs;
     useMpi = true;
   });
 
-  neuron-full = neuron-mpi.override { inherit python; };
+  neuron-full = neuron-mpi.override { python = python2; };
 
   mrbayes = callPackage ../applications/science/biology/mrbayes { };
 
@@ -33180,7 +33216,7 @@ with pkgs;
 
   nix-script = callPackage ../tools/nix/nix-script {};
 
-  nix-template-rpm = callPackage ../build-support/templaterpm { inherit (pythonPackages) python toposort; };
+  nix-template-rpm = callPackage ../build-support/templaterpm { inherit (python2Packages) python toposort; };
 
   nix-top = callPackage ../tools/package-management/nix-top { };
 
@@ -33231,7 +33267,7 @@ with pkgs;
   disnix = callPackage ../tools/package-management/disnix { };
 
   dysnomia = callPackage ../tools/package-management/disnix/dysnomia (config.disnix or {
-    inherit (pythonPackages) supervisor;
+    inherit (python2Packages) supervisor;
   });
 
   dydisnix = callPackage ../tools/package-management/disnix/dydisnix { };
@@ -33562,7 +33598,6 @@ with pkgs;
     buildGoModule = buildGo117Module;
   })
     mkTerraform
-    terraform_0_12
     terraform_0_13
     terraform_0_14
     terraform_0_15
@@ -33822,8 +33857,6 @@ with pkgs;
     wxGTK = wxGTK30;
   };
 
-  wyvern = callPackage ../games/wyvern { };
-
   x11idle = callPackage ../tools/misc/x11idle {};
 
   x11docker = callPackage ../applications/virtualization/x11docker { };
diff --git a/pkgs/top-level/kodi-packages.nix b/pkgs/top-level/kodi-packages.nix
index 2c2c5d5fb7e..d86c9c6778e 100644
--- a/pkgs/top-level/kodi-packages.nix
+++ b/pkgs/top-level/kodi-packages.nix
@@ -164,4 +164,11 @@ let self = rec {
 
   xbmcswift2 = callPackage ../applications/video/kodi/addons/xbmcswift2 { };
 
+  typing_extensions = callPackage ../applications/video/kodi/addons/typing_extensions { };
+
+  arrow = callPackage ../applications/video/kodi/addons/arrow { };
+
+  trakt-module = callPackage ../applications/video/kodi/addons/trakt-module { };
+
+  trakt = callPackage ../applications/video/kodi/addons/trakt { };
 }; in self
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index aaa2f96f62b..e8416f91109 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -38,6 +38,7 @@ mapAliases ({
   bugseverywhere = throw "bugseverywhere has been removed: Abandoned by upstream."; # added 2019-11-27
   class-registry = phx-class-registry; # added 2021-10-05
   ConfigArgParse = configargparse; # added 2021-03-18
+  cozy = throw "cozy was removed because it was not actually https://pypi.org/project/Cozy/."; # added 2022-01-14
   dateutil = python-dateutil; # added 2021-07-03
   detox = throw "detox is no longer maintained, and was broken since may 2019"; # added 2020-07-04
   dftfit = throw "dftfit dependency lammps-cython no longer builds"; # added 2021-07-04
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 06aac66fd85..c0918e7c962 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -22,10 +22,7 @@ let
 
   namePrefix = python.libPrefix + "-";
 
-  bootstrapped-pip = if isPy3k then
-    callPackage ../development/python-modules/bootstrapped-pip { }
-  else
-    callPackage ../development/python-modules/bootstrapped-pip/2.nix { };
+  bootstrapped-pip = callPackage ../development/python-modules/bootstrapped-pip { };
 
   # Derivations built with `buildPythonPackage` can already be overriden with `override`, `overrideAttrs`, and `overrideDerivation`.
   # This function introduces `overridePythonAttrs` and it overrides the call to `buildPythonPackage`.
@@ -143,11 +140,6 @@ in {
   # it should not override the version of pytest that is used for say
   # Python 2. This is an ugly hack that is needed now because the hook
   # propagates the package.
-  pytestCheckHook_5 = if isPy3k then
-    self.pytestCheckHook.override { pytest = self.pytest_5; }
-  else
-    self.pytestCheckHook;
-
   pytestCheckHook_6_1 = if isPy3k then
     self.pytestCheckHook.override { pytest = self.pytest_6_1; }
   else
@@ -318,6 +310,8 @@ in {
 
   aiohttp-remotes = callPackage ../development/python-modules/aiohttp-remotes { };
 
+  aiohttp-retry = callPackage ../development/python-modules/aiohttp-retry { };
+
   aiohttp-socks = callPackage ../development/python-modules/aiohttp-socks { };
 
   aiohttp-swagger = callPackage ../development/python-modules/aiohttp-swagger { };
@@ -458,8 +452,6 @@ in {
 
   allure-pytest = callPackage ../development/python-modules/allure-pytest { };
 
-  alot = callPackage ../development/python-modules/alot { };
-
   alpha-vantage = callPackage ../development/python-modules/alpha-vantage { };
 
   altair = callPackage ../development/python-modules/altair { };
@@ -1833,8 +1825,6 @@ in {
 
   coveralls = callPackage ../development/python-modules/coveralls { };
 
-  cozy = callPackage ../development/python-modules/cozy { };
-
   cppe = callPackage ../development/python-modules/cppe {
     cppe = pkgs.cppe;
   };
@@ -2002,6 +1992,8 @@ in {
 
   datamodeldict = callPackage ../development/python-modules/datamodeldict { };
 
+  dataset = callPackage ../development/python-modules/dataset { };
+
   datasets = callPackage ../development/python-modules/datasets { };
 
   datasette = callPackage ../development/python-modules/datasette { };
@@ -2128,6 +2120,8 @@ in {
 
   dict2xml = callPackage ../development/python-modules/dict2xml { };
 
+  dictdiffer = callPackage ../development/python-modules/dictdiffer { };
+
   dictionaries = callPackage ../development/python-modules/dictionaries { };
 
   dictpath = callPackage ../development/python-modules/dictpath { };
@@ -2752,14 +2746,14 @@ in {
 
   fastjet = toPythonModule (pkgs.fastjet.override {
     withPython = true;
-    inherit python;
+    inherit (self) python;
   });
 
   fastjsonschema = callPackage ../development/python-modules/fastjsonschema { };
 
   fastnlo_toolkit = toPythonModule (pkgs.fastnlo_toolkit.override {
     withPython = true;
-    inherit python;
+    inherit (self) python;
   });
 
   fastnumbers = callPackage ../development/python-modules/fastnumbers { };
@@ -2791,7 +2785,6 @@ in {
   feedparser = callPackage ../development/python-modules/feedparser { };
 
   fenics = callPackage ../development/libraries/science/math/fenics {
-    pytest = self.pytest_4;
     hdf5 = pkgs.hdf5_1_10;
   };
 
@@ -2895,6 +2888,8 @@ in {
 
   flask_elastic = callPackage ../development/python-modules/flask-elastic { };
 
+  flask-gravatar = callPackage ../development/python-modules/flask-gravatar { };
+
   flask-httpauth = callPackage ../development/python-modules/flask-httpauth { };
 
   flask-jwt-extended = callPackage ../development/python-modules/flask-jwt-extended { };
@@ -2915,6 +2910,8 @@ in {
 
   flask-paginate = callPackage ../development/python-modules/flask-paginate { };
 
+  flask-paranoid = callPackage ../development/python-modules/flask-paranoid { };
+
   flask_principal = callPackage ../development/python-modules/flask-principal { };
 
   flask-pymongo = callPackage ../development/python-modules/Flask-PyMongo { };
@@ -2933,6 +2930,8 @@ in {
 
   flask-session = callPackage ../development/python-modules/flask-session { };
 
+  flask-security-too = callPackage ../development/python-modules/flask-security-too { };
+
   flask-silk = callPackage ../development/python-modules/flask-silk { };
 
   flask-socketio = callPackage ../development/python-modules/flask-socketio { };
@@ -2959,6 +2958,8 @@ in {
     inherit (pkgs) flatbuffers;
   };
 
+  flatten-dict = callPackage ../development/python-modules/flatten-dict { };
+
   flax = callPackage ../development/python-modules/flax { };
 
   flexmock = callPackage ../development/python-modules/flexmock { };
@@ -3471,7 +3472,7 @@ in {
 
   graphql-subscription-manager = callPackage ../development/python-modules/graphql-subscription-manager { };
 
-  graph-tool = callPackage ../development/python-modules/graph-tool/2.x.x.nix { };
+  graph-tool = callPackage ../development/python-modules/graph-tool { };
 
   graphtage = callPackage ../development/python-modules/graphtage { };
 
@@ -3736,6 +3737,8 @@ in {
 
   httmock = callPackage ../development/python-modules/httmock { };
 
+  httpagentparser = callPackage ../development/python-modules/httpagentparser { };
+
   httpauth = callPackage ../development/python-modules/httpauth { };
 
   httpbin = callPackage ../development/python-modules/httpbin { };
@@ -3958,6 +3961,8 @@ in {
 
   insegel = callPackage ../development/python-modules/insegel { };
 
+  installer = callPackage ../development/python-modules/installer { };
+
   intake = callPackage ../development/python-modules/intake { };
 
   intake-parquet = callPackage ../development/python-modules/intake-parquet { };
@@ -4008,10 +4013,7 @@ in {
 
   ipython_genutils = callPackage ../development/python-modules/ipython_genutils { };
 
-  ipython = if isPy36 then
-    callPackage ../development/python-modules/ipython/7.16.nix { }
-  else
-    callPackage ../development/python-modules/ipython { };
+  ipython = callPackage ../development/python-modules/ipython { };
 
   ipyvue = callPackage ../development/python-modules/ipyvue { };
 
@@ -4776,6 +4778,8 @@ in {
 
   mailcap-fix = callPackage ../development/python-modules/mailcap-fix { };
 
+  mailchecker = callPackage ../development/python-modules/mailchecker { };
+
   mailchimp = callPackage ../development/python-modules/mailchimp { };
 
   mailman = callPackage ../servers/mail/mailman { };
@@ -4873,6 +4877,8 @@ in {
 
   matrix-client = callPackage ../development/python-modules/matrix-client { };
 
+  matrix-common = callPackage ../development/python-modules/matrix-common { };
+
   matrix-nio = callPackage ../development/python-modules/matrix-nio { };
 
   mattermostdriver = callPackage ../development/python-modules/mattermostdriver { };
@@ -5066,6 +5072,8 @@ in {
 
   mohawk = callPackage ../development/python-modules/mohawk { };
 
+  mongomock = callPackage ../development/python-modules/mongomock { };
+
   mongodict = callPackage ../development/python-modules/mongodict { };
 
   mongoengine = callPackage ../development/python-modules/mongoengine { };
@@ -5443,10 +5451,6 @@ in {
     inherit (pkgs) notmuch;
   };
 
-  notmuch2 = callPackage ../development/python-modules/notmuch/2.nix {
-    inherit (pkgs) notmuch;
-  };
-
   nototools = callPackage ../data/fonts/noto-fonts/tools.nix { };
 
   notus-scanner = callPackage ../development/python-modules/notus-scanner { };
@@ -5851,6 +5855,8 @@ in {
 
   pdfx = callPackage ../development/python-modules/pdfx { };
 
+  pdm-pep517 = callPackage ../development/python-modules/pdm-pep517 { };
+
   pdoc3 = callPackage ../development/python-modules/pdoc3 { };
 
   pebble = callPackage ../development/python-modules/pebble { };
@@ -6110,6 +6116,8 @@ in {
 
   python-tado = callPackage ../development/python-modules/python-tado { };
 
+  pythonfinder = callPackage ../development/python-modules/pythonfinder { };
+
   pyutil = callPackage ../development/python-modules/pyutil { };
 
   pkutils = callPackage ../development/python-modules/pkutils { };
@@ -7560,22 +7568,6 @@ in {
 
   pytest = self.pytest_6;
 
-  pytest_4 = callPackage
-    ../development/python-modules/pytest/4.nix {
-      # hypothesis tests require pytest that causes dependency cycle
-      hypothesis = self.hypothesis.override {
-        doCheck = false;
-      };
-    };
-
-  pytest_5 = callPackage
-    ../development/python-modules/pytest/5.nix {
-      # hypothesis tests require pytest that causes dependency cycle
-      hypothesis = self.hypothesis.override {
-        doCheck = false;
-      };
-    };
-
   pytest_6 =
     callPackage ../development/python-modules/pytest {
       # hypothesis tests require pytest that causes dependency cycle
@@ -7818,6 +7810,8 @@ in {
 
   python-baseconv = callPackage ../development/python-modules/python-baseconv { };
 
+  python-benedict = callPackage ../development/python-modules/python-benedict { };
+
   python-bidi = callPackage ../development/python-modules/python-bidi { };
 
   python-binance = callPackage ../development/python-modules/python-binance { };
@@ -7852,6 +7846,8 @@ in {
 
   python-editor = callPackage ../development/python-modules/python-editor { };
 
+  python-fsutil = callPackage ../development/python-modules/python-fsutil { };
+
   pythonefl = callPackage ../development/python-modules/python-efl { };
 
   pythonegardia = callPackage ../development/python-modules/pythonegardia { };
@@ -8783,6 +8779,8 @@ in {
 
   scipy = callPackage ../development/python-modules/scipy { };
 
+  scmrepo = callPackage ../development/python-modules/scmrepo { };
+
   scour = callPackage ../development/python-modules/scour { };
 
   scp = callPackage ../development/python-modules/scp { };
@@ -8853,6 +8851,8 @@ in {
 
   sentinel = callPackage ../development/python-modules/sentinel { };
 
+  sentinels = callPackage ../development/python-modules/sentinels { };
+
   sentry-sdk = callPackage ../development/python-modules/sentry-sdk { };
 
   sepaxml = callPackage ../development/python-modules/sepaxml { };
@@ -8930,6 +8930,8 @@ in {
 
   showit = callPackage ../development/python-modules/showit { };
 
+  shtab = callPackage ../development/python-modules/shtab { };
+
   shutilwhich = callPackage ../development/python-modules/shutilwhich { };
 
   sievelib = callPackage ../development/python-modules/sievelib { };
@@ -9094,6 +9096,8 @@ in {
     usePython = true;
   });
 
+  socketio-client = callPackage ../development/python-modules/socketio-client { };
+
   socialscan = callPackage ../development/python-modules/socialscan { };
 
   socid-extractor =  callPackage ../development/python-modules/socid-extractor { };
@@ -9144,6 +9148,8 @@ in {
 
   spacy-legacy = callPackage ../development/python-modules/spacy/legacy.nix { };
 
+  spacy-loggers = callPackage ../development/python-modules/spacy-loggers { };
+
   spacy_models = callPackage ../development/python-modules/spacy/models.nix { };
 
   spacy-pkuseg = callPackage ../development/python-modules/spacy-pkuseg { };
@@ -9164,6 +9170,8 @@ in {
 
   speaklater = callPackage ../development/python-modules/speaklater { };
 
+  speaklater3 = callPackage ../development/python-modules/speaklater3 { };
+
   spectral-cube = callPackage ../development/python-modules/spectral-cube { };
 
   speedtest-cli = callPackage ../development/python-modules/speedtest-cli { };
@@ -9943,6 +9951,8 @@ in {
 
   types-decorator = callPackage ../development/python-modules/types-decorator { };
 
+  types-freezegun = callPackage ../development/python-modules/types-freezegun { };
+
   types-futures = callPackage ../development/python-modules/types-futures { };
 
   types-protobuf = callPackage ../development/python-modules/types-protobuf { };
@@ -9953,6 +9963,8 @@ in {
 
   types-setuptools = callPackage ../development/python-modules/types-setuptools { };
 
+  types-tabulate = callPackage ../development/python-modules/types-tabulate { };
+
   types-toml = callPackage ../development/python-modules/types-toml { };
 
   types-typed-ast = callPackage ../development/python-modules/types-typed-ast { };
@@ -10341,8 +10353,6 @@ in {
 
   werkzeug = callPackage ../development/python-modules/werkzeug { };
 
-  werkzeug1 = callPackage ../development/python-modules/werkzeug/1.nix { };
-
   west = callPackage ../development/python-modules/west { };
 
   wfuzz = callPackage ../development/python-modules/wfuzz { };
@@ -10413,10 +10423,7 @@ in {
 
   wsnsimpy = callPackage ../development/python-modules/wsnsimpy { };
 
-  wsproto = if (pythonAtLeast "3.6") then
-    callPackage ../development/python-modules/wsproto { }
-  else
-    callPackage ../development/python-modules/wsproto/0.14.nix { };
+  wsproto = callPackage ../development/python-modules/wsproto { };
 
   wtforms = callPackage ../development/python-modules/wtforms { };
 
diff --git a/pkgs/top-level/python2-packages.nix b/pkgs/top-level/python2-packages.nix
index b7d9d4e95a4..4a15b64da09 100644
--- a/pkgs/top-level/python2-packages.nix
+++ b/pkgs/top-level/python2-packages.nix
@@ -6,125 +6,135 @@ self: super:
 
 with self; with super; {
 
-  boto3 = callPackage ../development/python-modules/boto3/1_17.nix {};
+  bootstrapped-pip = callPackage ../development/python2-modules/bootstrapped-pip { };
 
-  botocore = callPackage ../development/python-modules/botocore/1_20.nix {};
+  boto3 = callPackage ../development/python2-modules/boto3 {};
 
-  certifi = callPackage ../development/python-modules/certifi/python2.nix { };
+  botocore = callPackage ../development/python2-modules/botocore {};
 
-  chardet = callPackage ../development/python-modules/chardet/2.nix { };
+  certifi = callPackage ../development/python2-modules/certifi { };
 
-  cheetah = callPackage ../development/python-modules/cheetah { };
+  chardet = callPackage ../development/python2-modules/chardet { };
 
-  click = callPackage ../development/python-modules/click/7.nix { };
+  cheetah = callPackage ../development/python2-modules/cheetah { };
 
-  configparser = callPackage ../development/python-modules/configparser/4.nix { };
+  click = callPackage ../development/python2-modules/click { };
 
-  construct = callPackage ../development/python-modules/construct/2.10.54.nix { };
+  configparser = callPackage ../development/python2-modules/configparser { };
 
-  contextlib2 = callPackage ../development/python-modules/contextlib2/0.nix { };
+  construct = callPackage ../development/python2-modules/construct { };
 
-  cryptography = callPackage ../development/python-modules/cryptography/3.3.nix { };
+  contextlib2 = callPackage ../development/python2-modules/contextlib2 { };
 
-  cryptography_vectors = callPackage ../development/python-modules/cryptography/vectors-3.3.nix { };
+  cryptography = callPackage ../development/python2-modules/cryptography { };
 
-  decorator = callPackage ../development/python-modules/decorator/4.nix { };
+  cryptography_vectors = callPackage ../development/python2-modules/cryptography-vectors { };
 
-  enum = callPackage ../development/python-modules/enum { };
+  decorator = callPackage ../development/python2-modules/decorator { };
 
-  filelock =  callPackage ../development/python-modules/filelock/3.2.nix { };
+  enum = callPackage ../development/python2-modules/enum { };
 
-  flask = callPackage ../development/python-modules/flask/1.nix { };
+  filelock =  callPackage ../development/python2-modules/filelock { };
 
-  freezegun = callPackage ../development/python-modules/freezegun/0.3.nix { };
+  flask = callPackage ../development/python2-modules/flask { };
 
-  futures = callPackage ../development/python-modules/futures { };
+  freezegun = callPackage ../development/python2-modules/freezegun { };
 
-  google-apputils = callPackage ../development/python-modules/google-apputils { };
+  futures = callPackage ../development/python2-modules/futures { };
 
-  httpretty = callPackage ../development/python-modules/httpretty/0.nix { };
+  google-apputils = callPackage ../development/python2-modules/google-apputils { };
 
-  hypothesis = callPackage ../development/python-modules/hypothesis/2.nix { };
+  httpretty = callPackage ../development/python2-modules/httpretty { };
 
-  idna = callPackage ../development/python-modules/idna/2.nix { };
+  hypothesis = callPackage ../development/python2-modules/hypothesis { };
 
-  importlib-metadata = callPackage ../development/python-modules/importlib-metadata/2.nix { };
+  idna = callPackage ../development/python2-modules/idna { };
 
-  ipaddr = callPackage ../development/python-modules/ipaddr { };
+  importlib-metadata = callPackage ../development/python2-modules/importlib-metadata { };
 
-  itsdangerous = callPackage ../development/python-modules/itsdangerous/1.nix { };
+  ipaddr = callPackage ../development/python2-modules/ipaddr { };
 
-  jinja2 = callPackage ../development/python-modules/jinja2/2.nix { };
+  itsdangerous = callPackage ../development/python2-modules/itsdangerous { };
 
-  libcloud = callPackage ../development/python-modules/libcloud/2.nix { };
+  jinja2 = callPackage ../development/python2-modules/jinja2 { };
 
-  lpod = callPackage ../development/python-modules/lpod { };
+  libcloud = callPackage ../development/python2-modules/libcloud { };
 
-  marisa = callPackage ../development/python-modules/marisa {
+  lpod = callPackage ../development/python2-modules/lpod { };
+
+  marisa = callPackage ../development/python2-modules/marisa {
     inherit (pkgs) marisa;
   };
 
-  markdown = callPackage ../development/python-modules/markdown/3_1.nix { };
+  markdown = callPackage ../development/python2-modules/markdown { };
 
-  markupsafe = callPackage ../development/python-modules/markupsafe/1.nix { };
+  markupsafe = callPackage ../development/python2-modules/markupsafe { };
 
-  mock = callPackage ../development/python-modules/mock/2.nix { };
+  mock = callPackage ../development/python2-modules/mock { };
 
-  more-itertools = callPackage ../development/python-modules/more-itertools/2.7.nix { };
+  more-itertools = callPackage ../development/python2-modules/more-itertools { };
 
-  mutagen = callPackage ../development/python-modules/mutagen/1.43.nix { };
+  mutagen = callPackage ../development/python2-modules/mutagen { };
 
-  numpy = callPackage ../development/python-modules/numpy/1.16.nix { };
+  numpy = callPackage ../development/python2-modules/numpy { };
 
-  packaging = callPackage ../development/python-modules/packaging/2.nix { };
+  packaging = callPackage ../development/python2-modules/packaging { };
 
-  pillow = callPackage ../development/python-modules/pillow/6.nix {
+  pillow = callPackage ../development/python2-modules/pillow {
     inherit (pkgs) freetype libjpeg zlib libtiff libwebp tcl lcms2 tk;
     inherit (pkgs.xorg) libX11;
   };
 
-  pip = callPackage ../development/python-modules/pip/20.nix { };
+  pip = callPackage ../development/python2-modules/pip { };
 
-  pluggy = callPackage ../development/python-modules/pluggy/0.nix { };
+  pluggy = callPackage ../development/python2-modules/pluggy { };
 
-  prettytable = callPackage ../development/python-modules/prettytable/1.nix { };
+  prettytable = callPackage ../development/python2-modules/prettytable { };
 
-  protobuf = callPackage ../development/python-modules/protobuf {
+  protobuf = callPackage ../development/python2-modules/protobuf {
     disabled = isPyPy;
     protobuf = pkgs.protobuf3_17; # last version compatible with Python 2
   };
 
-  pycairo = callPackage ../development/python-modules/pycairo/1.18.nix {
+  pycairo = callPackage ../development/python2-modules/pycairo {
     inherit (pkgs.buildPackages) meson;
   };
 
-  pygments = callPackage ../development/python-modules/Pygments/2_5.nix { };
+  pygments = callPackage ../development/python2-modules/Pygments { };
 
-  pygobject3 = callPackage ../development/python-modules/pygobject/3.36.nix {
+  pygobject3 = callPackage ../development/python2-modules/pygobject {
     inherit (pkgs) meson;
   };
 
-  pygtk = callPackage ../development/python-modules/pygtk { };
+  pygtk = callPackage ../development/python2-modules/pygtk { };
 
   pyGtkGlade = self.pygtk.override {
     inherit (pkgs.gnome2) libglade;
   };
 
-  pyjwt = callPackage ../development/python-modules/pyjwt/1.nix { };
+  pyjwt = callPackage ../development/python2-modules/pyjwt { };
 
-  pyroma = callPackage ../development/python-modules/pyroma/2.nix { };
+  pyroma = callPackage ../development/python2-modules/pyroma { };
 
-  pysqlite = callPackage ../development/python-modules/pysqlite { };
+  pysqlite = callPackage ../development/python2-modules/pysqlite { };
 
   pytest = pytest_4;
 
-  pytest-runner = callPackage ../development/python-modules/pytest-runner/2.nix { };
+  pytest_4 = callPackage
+    ../development/python2-modules/pytest {
+      # hypothesis tests require pytest that causes dependency cycle
+      hypothesis = self.hypothesis.override {
+        doCheck = false;
+      };
+    };
+
+  pytest-runner = callPackage ../development/python2-modules/pytest-runner { };
 
-  pytest-xdist = callPackage ../development/python-modules/pytest-xdist/1.nix { };
+  pytest-xdist = callPackage ../development/python2-modules/pytest-xdist { };
 
-  pyyaml = callPackage ../development/python-modules/pyyaml/5.nix { };
+  pyyaml = callPackage ../development/python2-modules/pyyaml { };
 
-  qpid-python = callPackage ../development/python-modules/qpid-python { };
+  qpid-python = callPackage ../development/python2-modules/qpid-python { };
 
   recoll = disabled super.recoll;
 
@@ -132,42 +142,40 @@ with self; with super; {
 
   rpm = disabled super.rpm;
 
-  s3transfer = callPackage ../development/python-modules/s3transfer/0_4.nix { };
+  s3transfer = callPackage ../development/python2-modules/s3transfer { };
 
-  scandir = callPackage ../development/python-modules/scandir { };
+  scandir = callPackage ../development/python2-modules/scandir { };
 
   sequoia = disabled super.sequoia;
 
-  setuptools = callPackage ../development/python-modules/setuptools/44.0.nix { };
+  setuptools = callPackage ../development/python2-modules/setuptools { };
+
+  setuptools-scm = callPackage ../development/python2-modules/setuptools-scm { };
 
-  setuptools-scm = callPackage ../development/python-modules/setuptools-scm/2.nix { };
+  sphinxcontrib-websupport = callPackage ../development/python2-modules/sphinxcontrib-websupport { };
 
-  sphinxcontrib-websupport = callPackage ../development/python-modules/sphinxcontrib-websupport/1_1.nix { };
+  sphinx = callPackage ../development/python2-modules/sphinx { };
 
-  sphinx = callPackage ../development/python-modules/sphinx/2.nix { };
+  TurboCheetah = callPackage ../development/python2-modules/TurboCheetah { };
 
-  TurboCheetah = callPackage ../development/python-modules/TurboCheetah { };
+  typing = callPackage ../development/python2-modules/typing { };
 
-  typing = callPackage ../development/python-modules/typing { };
+  urllib3 = callPackage ../development/python2-modules/urllib3 { };
 
-  urllib3 = callPackage ../development/python-modules/urllib3/2.nix { };
+  werkzeug = callPackage ../development/python2-modules/werkzeug { };
 
-  werkzeug = callPackage ../development/python-modules/werkzeug/1.nix { };
+  wsproto = callPackage ../development/python2-modules/wsproto { };
 
-  wxPython30 = callPackage ../development/python-modules/wxPython/3.0.nix {
+  wxPython30 = callPackage ../development/python2-modules/wxPython {
     wxGTK = pkgs.wxGTK30;
   };
 
   wxPython = self.wxPython30;
 
-  vcrpy = callPackage ../development/python-modules/vcrpy/3.nix { };
-
-  yenc = callPackage ../development/python-modules/yenc { };
-
-  yt = callPackage ../development/python-modules/yt { };
+  vcrpy = callPackage ../development/python2-modules/vcrpy { };
 
   zeek = disabled super.zeek;
 
-  zipp = callPackage ../development/python-modules/zipp/1.nix { };
+  zipp = callPackage ../development/python2-modules/zipp { };
 
 }
diff --git a/pkgs/top-level/release.nix b/pkgs/top-level/release.nix
index 13526349dfc..5980d88b01f 100644
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -25,7 +25,10 @@ let
 
   systemsWithAnySupport = supportedSystems ++ limitedSupportedSystems;
 
-  supportDarwin = builtins.elem "x86_64-darwin" systemsWithAnySupport;
+  supportDarwin = lib.genAttrs [
+    "x86_64"
+    "aarch64"
+  ] (arch: builtins.elem "${arch}-darwin" systemsWithAnySupport);
 
   jobs =
     { tarball = import ./make-tarball.nix { inherit pkgs nixpkgs officialRelease supportedSystems; };
@@ -36,7 +39,7 @@ let
       lib-tests = import ../../lib/tests/release.nix { inherit pkgs; };
       pkgs-lib-tests = import ../pkgs-lib/tests { inherit pkgs; };
 
-      darwin-tested = if supportDarwin then pkgs.releaseTools.aggregate
+      darwin-tested = if supportDarwin.x86_64 then pkgs.releaseTools.aggregate
         { name = "nixpkgs-darwin-${jobs.tarball.version}";
           meta.description = "Release-critical builds for the Nixpkgs darwin channel";
           constituents =
@@ -54,7 +57,7 @@ let
               jobs.openssl.x86_64-darwin
               jobs.pandoc.x86_64-darwin
               jobs.postgresql.x86_64-darwin
-              jobs.python.x86_64-darwin
+              jobs.python2.x86_64-darwin
               jobs.python3.x86_64-darwin
               jobs.ruby.x86_64-darwin
               jobs.rustc.x86_64-darwin
@@ -99,7 +102,7 @@ let
               jobs.go.x86_64-linux
               jobs.linux.x86_64-linux
               jobs.pandoc.x86_64-linux
-              jobs.python.x86_64-linux
+              jobs.python2.x86_64-linux
               jobs.python3.x86_64-linux
               # Needed by contributors to test PRs (by inclusion of the PR template)
               jobs.nixpkgs-review.x86_64-linux
@@ -130,11 +133,11 @@ let
               */
             ]
             ++ lib.collect lib.isDerivation jobs.stdenvBootstrapTools
-            ++ lib.optionals supportDarwin [
+            ++ lib.optionals supportDarwin.x86_64 [
               jobs.stdenv.x86_64-darwin
               jobs.cargo.x86_64-darwin
               jobs.go.x86_64-darwin
-              jobs.python.x86_64-darwin
+              jobs.python2.x86_64-darwin
               jobs.python3.x86_64-darwin
               jobs.nixpkgs-review.x86_64-darwin
               jobs.nix-info.x86_64-darwin
@@ -171,7 +174,7 @@ let
               dist test;
           })
         # darwin is special in this
-        // optionalAttrs supportDarwin {
+        // optionalAttrs supportDarwin.x86_64 {
           x86_64-darwin =
             let
               bootstrap = import ../stdenv/darwin/make-bootstrap-tools.nix { system = "x86_64-darwin"; };
@@ -181,7 +184,7 @@ let
               # Test a full stdenv bootstrap from the bootstrap tools definition
               inherit (bootstrap.test-pkgs) stdenv;
             };
-
+        } // optionalAttrs supportDarwin.aarch64 {
           # Cross compiled bootstrap tools
           aarch64-darwin =
             let