summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--.github/workflows/pending-clear.yml35
-rw-r--r--.github/workflows/pending-set.yml34
-rw-r--r--lib/tests/release.nix1
-rw-r--r--maintainers/maintainer-list.nix12
-rw-r--r--nixos/doc/manual/release-notes/rl-2009.xml2
-rw-r--r--nixos/modules/misc/locate.nix2
-rw-r--r--nixos/modules/module-list.nix1
-rw-r--r--nixos/modules/services/desktops/espanso.nix25
-rw-r--r--nixos/modules/services/development/jupyterhub/default.nix2
-rw-r--r--nixos/modules/services/misc/octoprint.nix4
-rw-r--r--nixos/modules/services/misc/sssd.nix4
-rw-r--r--nixos/modules/services/networking/wpa_supplicant.nix3
-rw-r--r--nixos/modules/services/web-apps/sogo.nix1
-rw-r--r--nixos/modules/system/boot/stage-1.nix12
-rw-r--r--nixos/modules/tasks/network-interfaces.nix1
-rw-r--r--nixos/tests/all-tests.nix1
-rw-r--r--nixos/tests/os-prober.nix33
-rw-r--r--nixos/tests/sssd.nix17
-rw-r--r--nixos/tests/systemd-networkd-ipv6-prefix-delegation.nix8
-rw-r--r--pkgs/applications/audio/helm/default.nix25
-rw-r--r--pkgs/applications/audio/picard/default.nix4
-rw-r--r--pkgs/applications/editors/android-studio/default.nix6
-rw-r--r--pkgs/applications/editors/nano/default.nix4
-rw-r--r--pkgs/applications/editors/setzer/default.nix4
-rw-r--r--pkgs/applications/editors/viw/default.nix30
-rw-r--r--pkgs/applications/graphics/opentoonz/default.nix51
-rw-r--r--pkgs/applications/graphics/opentoonz/libtiff.nix21
-rw-r--r--pkgs/applications/graphics/opentoonz/source.nix16
-rw-r--r--pkgs/applications/misc/bemenu/default.nix4
-rw-r--r--pkgs/applications/misc/blender/default.nix4
-rw-r--r--pkgs/applications/misc/cheat/default.nix4
-rw-r--r--pkgs/applications/misc/lutris/fhsenv.nix2
-rw-r--r--pkgs/applications/misc/navi/default.nix6
-rw-r--r--pkgs/applications/misc/simplenote/default.nix4
-rw-r--r--pkgs/applications/misc/systembus-notify/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/firefox/common.nix3
-rw-r--r--pkgs/applications/networking/cluster/terragrunt/default.nix6
-rw-r--r--pkgs/applications/networking/instant-messengers/nheko/default.nix5
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/default.nix5
-rw-r--r--pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix4
-rw-r--r--pkgs/applications/networking/irc/weechat/scripts/default.nix2
-rw-r--r--pkgs/applications/networking/irc/weechat/scripts/weechat-notify-send/default.nix31
-rw-r--r--pkgs/applications/networking/mailreaders/notmuch-bower/default.nix4
-rw-r--r--pkgs/applications/office/softmaker/freeoffice.nix20
-rw-r--r--pkgs/applications/office/softmaker/softmaker_office.nix21
-rw-r--r--pkgs/applications/radio/inspectrum/default.nix11
-rw-r--r--pkgs/applications/science/math/mathematica/l10ns.nix6
-rw-r--r--pkgs/applications/version-management/fossil/default.nix4
-rw-r--r--pkgs/applications/virtualization/docker-slim/default.nix4
-rw-r--r--pkgs/applications/virtualization/podman/default.nix4
-rw-r--r--pkgs/applications/window-managers/i3/lock-fancy-rapid.nix32
-rw-r--r--pkgs/data/fonts/iosevka/bin.nix4
-rw-r--r--pkgs/data/fonts/recursive/default.nix4
-rw-r--r--pkgs/desktops/deepin/dde-api/default.nix4
-rw-r--r--pkgs/development/compilers/aspectj/default.nix11
-rw-r--r--pkgs/development/compilers/copper/default.nix32
-rw-r--r--pkgs/development/compilers/kotlin/default.nix4
-rw-r--r--pkgs/development/compilers/llvm/11/bintools.nix29
-rw-r--r--pkgs/development/compilers/llvm/11/clang/default.nix117
-rw-r--r--pkgs/development/compilers/llvm/11/clang/purity.patch28
-rw-r--r--pkgs/development/compilers/llvm/11/compiler-rt-armv7l.patch32
-rw-r--r--pkgs/development/compilers/llvm/11/compiler-rt-codesign.patch33
-rw-r--r--pkgs/development/compilers/llvm/11/compiler-rt.nix85
-rw-r--r--pkgs/development/compilers/llvm/11/default.nix195
-rw-r--r--pkgs/development/compilers/llvm/11/libc++/default.nix52
-rw-r--r--pkgs/development/compilers/llvm/11/libc++abi.nix67
-rw-r--r--pkgs/development/compilers/llvm/11/libcxxabi-no-threads.patch12
-rw-r--r--pkgs/development/compilers/llvm/11/libcxxabi-wasm.patch16
-rw-r--r--pkgs/development/compilers/llvm/11/libunwind.nix14
-rw-r--r--pkgs/development/compilers/llvm/11/lld.nix33
-rw-r--r--pkgs/development/compilers/llvm/11/lldb-procfs.patch31
-rw-r--r--pkgs/development/compilers/llvm/11/lldb.nix101
-rw-r--r--pkgs/development/compilers/llvm/11/llvm-outputs.patch26
-rw-r--r--pkgs/development/compilers/llvm/11/llvm.nix187
-rw-r--r--pkgs/development/compilers/llvm/11/openmp.nix26
-rw-r--r--pkgs/development/compilers/llvm/11/sanitizers-nongnu.patch412
-rw-r--r--pkgs/development/haskell-modules/configuration-common.nix3
-rw-r--r--pkgs/development/interpreters/chibi/default.nix4
-rw-r--r--pkgs/development/interpreters/perl/default.nix16
-rw-r--r--pkgs/development/interpreters/perl/setup-hook-cross.sh2
-rw-r--r--pkgs/development/interpreters/rakudo/default.nix4
-rw-r--r--pkgs/development/interpreters/rakudo/moarvm.nix4
-rw-r--r--pkgs/development/interpreters/rakudo/nqp.nix4
-rw-r--r--pkgs/development/interpreters/red/default.nix8
-rw-r--r--pkgs/development/libraries/assimp/default.nix2
-rw-r--r--pkgs/development/libraries/libappindicator/default.nix28
-rw-r--r--pkgs/development/libraries/libgdiplus/default.nix2
-rw-r--r--pkgs/development/libraries/librseq/default.nix15
-rw-r--r--pkgs/development/libraries/libvmaf/default.nix8
-rw-r--r--pkgs/development/libraries/muparserx/default.nix42
-rw-r--r--pkgs/development/libraries/pcre2/default.nix3
-rw-r--r--pkgs/development/libraries/qt-5/modules/qtdeclarative.nix10
-rw-r--r--pkgs/development/libraries/qt-5/modules/qtwebengine.nix13
-rw-r--r--pkgs/development/libraries/sope/default.nix4
-rw-r--r--pkgs/development/libraries/vid-stab/default.nix27
-rw-r--r--pkgs/development/libraries/wxsqlite3/default.nix4
-rw-r--r--pkgs/development/libraries/yder/default.nix4
-rw-r--r--pkgs/development/ocaml-modules/mirage-crypto/default.nix4
-rw-r--r--pkgs/development/perl-modules/generic/default.nix2
-rw-r--r--pkgs/development/python-modules/multitasking/default.nix25
-rw-r--r--pkgs/development/python-modules/pylatexenc/default.nix6
-rw-r--r--pkgs/development/python-modules/qiskit-aer/default.nix34
-rw-r--r--pkgs/development/python-modules/qiskit-aer/remove-conan-install.patch63
-rw-r--r--pkgs/development/python-modules/qiskit-aqua/default.nix24
-rw-r--r--pkgs/development/python-modules/qiskit-ibmq-provider/default.nix5
-rw-r--r--pkgs/development/python-modules/qiskit-ignis/default.nix18
-rw-r--r--pkgs/development/python-modules/qiskit-terra/default.nix24
-rw-r--r--pkgs/development/python-modules/qiskit/default.nix21
-rw-r--r--pkgs/development/python-modules/retworkx/default.nix77
-rw-r--r--pkgs/development/python-modules/urwid/default.nix7
-rw-r--r--pkgs/development/python-modules/yfinance/default.nix36
-rw-r--r--pkgs/development/tools/alloy/default.nix2
-rw-r--r--pkgs/development/tools/analysis/flow/default.nix4
-rw-r--r--pkgs/development/tools/continuous-integration/fly/default.nix6
-rw-r--r--pkgs/development/tools/ginkgo/default.nix22
-rw-r--r--pkgs/development/tools/gopls/default.nix2
-rwxr-xr-xpkgs/development/tools/haskell/haskell-language-server/update.sh2
-rw-r--r--pkgs/development/tools/misc/terraform-ls/default.nix4
-rw-r--r--pkgs/development/tools/misc/terraformer/default.nix24
-rw-r--r--pkgs/development/tools/open-policy-agent/default.nix4
-rw-r--r--pkgs/development/tools/rust/rust-analyzer/default.nix6
-rw-r--r--pkgs/development/tools/skaffold/default.nix4
-rw-r--r--pkgs/development/tools/vagrant/0004-Support-system-installed-plugins.patch10
-rw-r--r--pkgs/development/tools/vagrant/default.nix11
-rw-r--r--pkgs/development/tools/vagrant/gemset.nix44
-rw-r--r--pkgs/development/tools/vagrant/use-system-bundler-version.patch10
-rw-r--r--pkgs/games/katago/default.nix32
-rw-r--r--pkgs/games/osu-lazer/default.nix4
-rw-r--r--pkgs/games/osu-lazer/deps.nix36
-rw-r--r--pkgs/games/papermc/default.nix29
-rw-r--r--pkgs/games/shattered-pixel-dungeon/default.nix4
-rw-r--r--pkgs/games/xcowsay/default.nix40
-rw-r--r--pkgs/misc/ghostscript/default.nix5
-rw-r--r--pkgs/os-specific/linux/kernel/hardened/patches.json22
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.8.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-testing.nix4
-rw-r--r--pkgs/os-specific/linux/rfkill/default.nix20
-rw-r--r--pkgs/servers/etcd/3.4.nix11
-rw-r--r--pkgs/servers/http/nginx/mainline.nix4
-rw-r--r--pkgs/servers/http/nginx/modules.nix139
-rw-r--r--pkgs/servers/jackett/default.nix44
-rw-r--r--pkgs/servers/jellyfin/default.nix2
-rw-r--r--pkgs/servers/radarr/default.nix2
-rw-r--r--pkgs/servers/sonarr/default.nix2
-rw-r--r--pkgs/servers/web-apps/sogo/default.nix13
-rw-r--r--pkgs/shells/elvish/default.nix4
-rw-r--r--pkgs/shells/rssh/default.nix97
-rw-r--r--pkgs/shells/rssh/fix-config-path.patch12
-rw-r--r--pkgs/shells/zsh/oh-my-zsh/default.nix6
-rw-r--r--pkgs/tools/admin/eksctl/default.nix6
-rw-r--r--pkgs/tools/backup/bup/default.nix4
-rw-r--r--pkgs/tools/bluetooth/blueberry/default.nix8
-rw-r--r--pkgs/tools/filesystems/avfs/default.nix4
-rw-r--r--pkgs/tools/filesystems/bashmount/default.nix4
-rw-r--r--pkgs/tools/misc/chezmoi/default.nix6
-rw-r--r--pkgs/tools/misc/colorpicker/default.nix27
-rw-r--r--pkgs/tools/misc/debianutils/default.nix4
-rw-r--r--pkgs/tools/misc/fluent-bit/default.nix4
-rw-r--r--pkgs/tools/misc/topgrade/default.nix6
-rw-r--r--pkgs/tools/networking/chrony/default.nix4
-rw-r--r--pkgs/tools/networking/oneshot/default.nix6
-rw-r--r--pkgs/tools/networking/vpn-slice/default.nix25
-rw-r--r--pkgs/tools/security/vault/default.nix4
-rw-r--r--pkgs/tools/security/vault/vault-bin.nix12
-rw-r--r--pkgs/tools/system/bpytop/default.nix4
-rw-r--r--pkgs/tools/system/fio/default.nix4
-rw-r--r--pkgs/tools/text/ugrep/default.nix4
-rw-r--r--pkgs/tools/text/vale/default.nix4
-rw-r--r--pkgs/top-level/aliases.nix2
-rw-r--r--pkgs/top-level/all-packages.nix54
-rw-r--r--pkgs/top-level/make-tarball.nix1
-rw-r--r--pkgs/top-level/metrics.nix1
-rw-r--r--pkgs/top-level/perl-packages.nix17
-rw-r--r--pkgs/top-level/python-packages.nix7
174 files changed, 2889 insertions, 681 deletions
diff --git a/.github/workflows/pending-clear.yml b/.github/workflows/pending-clear.yml
new file mode 100644
index 00000000000..e9eb9395bc4
--- /dev/null
+++ b/.github/workflows/pending-clear.yml
@@ -0,0 +1,35 @@
+name: "clear pending status"
+
+on:
+  check_suite:
+    types: [ completed ]
+
+jobs:
+  action:
+    runs-on: ubuntu-latest
+    steps:
+    - name: clear pending status
+      if: github.repository_owner == 'NixOS' && github.event.check_suite.app.name == 'OfBorg'
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        GSU_VERSION: "0.5.0"
+        GSU_HASH: "49df54dc0ed5eaa037400b66be8114bd62fa0af51ed36565f6203dc312711cc6"
+        GSU_URL: "https://github.com/cloudposse/github-status-updater/releases/download"
+      run: |
+        curl -sSf -O -L -C - \
+        "$GSU_URL/$GSU_VERSION/github-status-updater_linux_amd64" && \
+        if [ "$(shasum -a 256 github-status-updater_linux_amd64 | cut -c1-64)" != "$GSU_HASH" ]; then
+          echo "checksum mismatch"
+          exit 1
+        fi
+        chmod +x github-status-updater_linux_amd64 && \
+        ./github-status-updater_linux_amd64 \
+          -action update_state \
+          -token "$GITHUB_TOKEN" \
+          -owner NixOS \
+          -repo nixpkgs \
+          -state success \
+          -context "Wait for ofborg" \
+          -description " " \
+          -url " " \
+          -ref "${{ github.event.check_suite.head_sha }}"
diff --git a/.github/workflows/pending-set.yml b/.github/workflows/pending-set.yml
new file mode 100644
index 00000000000..36104706b6f
--- /dev/null
+++ b/.github/workflows/pending-set.yml
@@ -0,0 +1,34 @@
+name: "set pending status"
+
+on:
+  pull_request_target:
+
+jobs:
+  action:
+    runs-on: ubuntu-latest
+    steps:
+    - name: set pending status
+      if: github.repository_owner == 'NixOS'
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        GSU_VERSION: "0.5.0"
+        GSU_HASH: "49df54dc0ed5eaa037400b66be8114bd62fa0af51ed36565f6203dc312711cc6"
+        GSU_URL: "https://github.com/cloudposse/github-status-updater/releases/download"
+      run: |
+        curl -sSf -O -L -C - \
+        "$GSU_URL/$GSU_VERSION/github-status-updater_linux_amd64" && \
+        if [ "$(shasum -a 256 github-status-updater_linux_amd64 | cut -c1-64)" != "$GSU_HASH" ]; then
+          echo "checksum mismatch"
+          exit 1
+        fi
+        chmod +x github-status-updater_linux_amd64 && \
+        ./github-status-updater_linux_amd64 \
+          -action update_state \
+          -token "$GITHUB_TOKEN" \
+          -owner NixOS \
+          -repo nixpkgs \
+          -state failure \
+          -context "Wait for ofborg" \
+          -description "This failed status will be cleared when ofborg finishes eval." \
+          -url " " \
+          -ref "${{ github.event.pull_request.head.sha }}"
diff --git a/lib/tests/release.nix b/lib/tests/release.nix
index eebee1b49bc..800d8a65c14 100644
--- a/lib/tests/release.nix
+++ b/lib/tests/release.nix
@@ -17,7 +17,6 @@ pkgs.runCommandNoCC "nixpkgs-lib-tests" {
     export TEST_ROOT=$(pwd)/test-tmp
     export NIX_BUILD_HOOK=
     export NIX_CONF_DIR=$TEST_ROOT/etc
-    export NIX_DB_DIR=$TEST_ROOT/db
     export NIX_LOCALSTATE_DIR=$TEST_ROOT/var
     export NIX_LOG_DIR=$TEST_ROOT/var/log/nix
     export NIX_STATE_DIR=$TEST_ROOT/var/nix
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index efdc0fc7bc7..da063d95e06 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3733,6 +3733,12 @@
     }];
     name = "Jiri Daněk";
   };
+  jdbaldry = {
+    email = "jack.baldry@grafana.com";
+    github = "jdbaldry";
+    githubId = 4599384;
+    name = "Jack Baldry";
+  };
   jdehaas = {
     email = "qqlq@nullptr.club";
     github = "jeroendehaas";
@@ -6743,6 +6749,12 @@
     githubId = 37715;
     name = "Brian McKenna";
   };
+  purcell = {
+    email = "steve@sanityinc.com";
+    github = "purcell";
+    githubId =	5636;
+    name = "Steve Purcell";
+  };
   puzzlewolf = {
     email = "nixos@nora.pink";
     github = "puzzlewolf";
diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml
index b958aab07c5..166aec25512 100644
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@@ -970,6 +970,8 @@ services.transmission.settings.rpc-bind-address = "0.0.0.0";
    </listitem>
    <listitem>
     <para>
+     Nginx module <literal>nginxModules.fastcgi-cache-purge</literal> renamed to official name <literal>nginxModules.cache-purge</literal>.
+     Nginx module <literal>nginxModules.ngx_aws_auth</literal> renamed to official name <literal>nginxModules.aws-auth</literal>.
       The packages <package>perl</package>, <package>rsync</package> and <package>strace</package> were removed from <option>systemPackages</option>. If you need them, install them again with <code><xref linkend="opt-environment.systemPackages"/> = with pkgs; [ perl rsync strace ];</code> in your <filename>configuration.nix</filename>.
     </para>
    </listitem>
diff --git a/nixos/modules/misc/locate.nix b/nixos/modules/misc/locate.nix
index dc668796c78..92aa3be0a36 100644
--- a/nixos/modules/misc/locate.nix
+++ b/nixos/modules/misc/locate.nix
@@ -127,7 +127,7 @@ in {
       { LOCATE_PATH = cfg.output;
       };
 
-    warnings = optional (isMLocate && cfg.localuser != null) "mlocate does not support searching as user other than root"
+    warnings = optional (isMLocate && cfg.localuser != null) "mlocate does not support the services.locate.localuser option; updatedb will run as root. (Silence with services.locate.localuser = null.)"
             ++ optional (isFindutils && cfg.pruneNames != []) "findutils locate does not support pruning by directory component"
             ++ optional (isFindutils && cfg.pruneBindMounts) "findutils locate does not support skipping bind mounts";
 
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index aee1fdb368d..df68b8ceb04 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -300,6 +300,7 @@
   ./services/desktops/dleyna-renderer.nix
   ./services/desktops/dleyna-server.nix
   ./services/desktops/pantheon/files.nix
+  ./services/desktops/espanso.nix
   ./services/desktops/flatpak.nix
   ./services/desktops/geoclue2.nix
   ./services/desktops/gsignond.nix
diff --git a/nixos/modules/services/desktops/espanso.nix b/nixos/modules/services/desktops/espanso.nix
new file mode 100644
index 00000000000..cd2eadf8816
--- /dev/null
+++ b/nixos/modules/services/desktops/espanso.nix
@@ -0,0 +1,25 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let cfg = config.services.espanso;
+in {
+  meta = { maintainers = with lib.maintainers; [ numkem ]; };
+
+  options = {
+    services.espanso = { enable = options.mkEnableOption "Espanso"; };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.user.services.espanso = {
+      description = "Espanso daemon";
+      path = with pkgs; [ espanso libnotify xclip ];
+      serviceConfig = {
+        ExecStart = "${pkgs.espanso}/bin/espanso daemon";
+        Restart = "on-failure";
+      };
+      wantedBy = [ "default.target" ];
+    };
+
+    environment.systemPackages = [ pkgs.espanso ];
+  };
+}
diff --git a/nixos/modules/services/development/jupyterhub/default.nix b/nixos/modules/services/development/jupyterhub/default.nix
index be6aaed93ac..f1dcab68b00 100644
--- a/nixos/modules/services/development/jupyterhub/default.nix
+++ b/nixos/modules/services/development/jupyterhub/default.nix
@@ -15,7 +15,7 @@ let
   jupyterhubConfig = pkgs.writeText "jupyterhub_config.py" ''
     c.JupyterHub.bind_url = "http://${cfg.host}:${toString cfg.port}"
 
-    c.JupyterHub.authentication_class = "${cfg.authentication}"
+    c.JupyterHub.authenticator_class = "${cfg.authentication}"
     c.JupyterHub.spawner_class = "${cfg.spawner}"
 
     c.SystemdSpawner.default_url = '/lab'
diff --git a/nixos/modules/services/misc/octoprint.nix b/nixos/modules/services/misc/octoprint.nix
index 7a71d2c8c6a..e2fbd3b401c 100644
--- a/nixos/modules/services/misc/octoprint.nix
+++ b/nixos/modules/services/misc/octoprint.nix
@@ -68,8 +68,8 @@ in
       plugins = mkOption {
         default = plugins: [];
         defaultText = "plugins: []";
-        example = literalExample "plugins: [ m3d-fio ]";
-        description = "Additional plugins.";
+        example = literalExample "plugins: with plugins; [ m33-fio stlviewer ]";
+        description = "Additional plugins to be used. Available plugins are passed through the plugins input.";
       };
 
       extraConfig = mkOption {
diff --git a/nixos/modules/services/misc/sssd.nix b/nixos/modules/services/misc/sssd.nix
index 3da99a3b38c..386281e2b7c 100644
--- a/nixos/modules/services/misc/sssd.nix
+++ b/nixos/modules/services/misc/sssd.nix
@@ -69,7 +69,7 @@ in {
         mode = "0400";
       };
 
-      system.nssModules = pkgs.sssd;
+      system.nssModules = [ pkgs.sssd ];
       system.nssDatabases = {
         group = [ "sss" ];
         passwd = [ "sss" ];
@@ -92,4 +92,6 @@ in {
     services.openssh.authorizedKeysCommand = "/etc/ssh/authorized_keys_command";
     services.openssh.authorizedKeysCommandUser = "nobody";
   })];
+
+  meta.maintainers = with maintainers; [ bbigras ];
 }
diff --git a/nixos/modules/services/networking/wpa_supplicant.nix b/nixos/modules/services/networking/wpa_supplicant.nix
index 08a17d20ed7..39513987903 100644
--- a/nixos/modules/services/networking/wpa_supplicant.nix
+++ b/nixos/modules/services/networking/wpa_supplicant.nix
@@ -233,6 +233,9 @@ in {
       path = [ pkgs.wpa_supplicant ];
 
       script = ''
+        if [ -f /etc/wpa_supplicant.conf -a "/etc/wpa_supplicant.conf" != "${configFile}" ]
+        then echo >&2 "<3>/etc/wpa_supplicant.conf present but ignored. Generated ${configFile} is used instead."
+        fi
         iface_args="-s -u -D${cfg.driver} -c ${configFile}"
         ${if ifaces == [] then ''
           for i in $(cd /sys/class/net && echo *); do
diff --git a/nixos/modules/services/web-apps/sogo.nix b/nixos/modules/services/web-apps/sogo.nix
index 5f30124dd68..4610bb96cb5 100644
--- a/nixos/modules/services/web-apps/sogo.nix
+++ b/nixos/modules/services/web-apps/sogo.nix
@@ -77,7 +77,6 @@ in {
         // Paths
         WOSendMail = "/run/wrappers/bin/sendmail";
         SOGoMailSpoolPath = "/var/lib/sogo/spool";
-        SOGoZipPath = "${pkgs.zip}/bin/zip";
         // Enable CSRF protection
         SOGoXSRFValidationEnabled = YES;
         // Remove dates from log (jornald does that)
diff --git a/nixos/modules/system/boot/stage-1.nix b/nixos/modules/system/boot/stage-1.nix
index ec5eadf69c3..36af5de4c90 100644
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@@ -36,7 +36,7 @@ let
     set -euo pipefail
 
     declare -A seen
-    declare -a left
+    left=()
 
     patchelf="${pkgs.buildPackages.patchelf}/bin/patchelf"
 
@@ -48,7 +48,7 @@ let
       done
     }
 
-    add_needed $1
+    add_needed "$1"
 
     while [ ''${#left[@]} -ne 0 ]; do
       next=''${left[0]}
@@ -87,7 +87,9 @@ let
   # copy what we need.  Instead of using statically linked binaries,
   # we just copy what we need from Glibc and use patchelf to make it
   # work.
-  extraUtils = pkgs.runCommandCC "extra-utils"
+  extraUtils = let
+    # Use lvm2 without udev support, which is the same lvm2 we already have in the closure anyways
+    lvm2 = pkgs.lvm2.override { udev = null; }; in pkgs.runCommandCC "extra-utils"
     { nativeBuildInputs = [pkgs.buildPackages.nukeReferences];
       allowedReferences = [ "out" ]; # prevent accidents like glibc being included in the initrd
     }
@@ -111,8 +113,8 @@ let
       copy_bin_and_libs ${pkgs.utillinux}/sbin/blkid
 
       # Copy dmsetup and lvm.
-      copy_bin_and_libs ${getBin pkgs.lvm2}/bin/dmsetup
-      copy_bin_and_libs ${getBin pkgs.lvm2}/bin/lvm
+      copy_bin_and_libs ${getBin lvm2}/bin/dmsetup
+      copy_bin_and_libs ${getBin lvm2}/bin/lvm
 
       # Add RAID mdadm tool.
       copy_bin_and_libs ${pkgs.mdadm}/sbin/mdadm
diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix
index 565868724ad..af98123d477 100644
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@@ -1129,7 +1129,6 @@ in
       ++ optionals config.networking.wireless.enable [
         pkgs.wirelesstools # FIXME: obsolete?
         pkgs.iw
-        pkgs.rfkill
       ]
       ++ bridgeStp;
 
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 7b8e1b2b56d..66fa435da71 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -321,6 +321,7 @@ in
   spike = handleTest ./spike.nix {};
   sonarr = handleTest ./sonarr.nix {};
   sslh = handleTest ./sslh.nix {};
+  sssd = handleTestOn ["x86_64-linux"] ./sssd.nix {};
   strongswan-swanctl = handleTest ./strongswan-swanctl.nix {};
   sudo = handleTest ./sudo.nix {};
   switchTest = handleTest ./switch-test.nix {};
diff --git a/nixos/tests/os-prober.nix b/nixos/tests/os-prober.nix
index 6a38f5ca531..be0235a4175 100644
--- a/nixos/tests/os-prober.nix
+++ b/nixos/tests/os-prober.nix
@@ -1,4 +1,4 @@
-import ./make-test.nix ({pkgs, lib, ...}:
+import ./make-test-python.nix ({pkgs, lib, ...}:
 let
   # A filesystem image with a (presumably) bootable debian
   debianImage = pkgs.vmTools.diskImageFuns.debian9i386 {
@@ -34,9 +34,6 @@ let
     '';
   };
 
-  # options to add the disk to the test vm
-  QEMU_OPTS = "-drive index=2,file=${debianImage}/disk-image.qcow2,read-only,if=virtio";
-
   # a part of the configuration of the test vm
   simpleConfig = {
     boot.loader.grub = {
@@ -71,7 +68,7 @@ in {
   machine = { config, pkgs, ... }: (simpleConfig // {
       imports = [ ../modules/profiles/installation-device.nix
                   ../modules/profiles/base.nix ];
-      virtualisation.memorySize = 1024;
+      virtualisation.memorySize = 1300;
       # The test cannot access the network, so any packages
       # nixos-rebuild needs must be included in the VM.
       system.extraDependencies = with pkgs;
@@ -99,22 +96,28 @@ in {
 
   testScript = ''
     # hack to add the secondary disk
-    $machine->{startCommand} = "QEMU_OPTS=\"\$QEMU_OPTS \"${lib.escapeShellArg QEMU_OPTS} ".$machine->{startCommand};
+    os.environ[
+        "QEMU_OPTS"
+    ] = "-drive index=2,file=${debianImage}/disk-image.qcow2,read-only,if=virtio"
 
-    $machine->start;
-    $machine->succeed("udevadm settle");
-    $machine->waitForUnit("multi-user.target");
+    machine.start()
+    machine.succeed("udevadm settle")
+    machine.wait_for_unit("multi-user.target")
+    print(machine.succeed("lsblk"))
 
     # check that os-prober works standalone
-    $machine->succeed("${pkgs.os-prober}/bin/os-prober | grep /dev/vdb1");
+    machine.succeed(
+        "${pkgs.os-prober}/bin/os-prober | grep /dev/vdb1"
+    )
 
     # rebuild and test that debian is available in the grub menu
-    $machine->succeed("nixos-generate-config");
-    $machine->copyFileFromHost(
+    machine.succeed("nixos-generate-config")
+    machine.copy_from_host(
         "${configFile}",
-        "/etc/nixos/configuration.nix");
-    $machine->succeed("nixos-rebuild boot >&2");
+        "/etc/nixos/configuration.nix",
+    )
+    machine.succeed("nixos-rebuild boot >&2")
 
-    $machine->succeed("egrep 'menuentry.*debian' /boot/grub/grub.cfg");
+    machine.succeed("egrep 'menuentry.*debian' /boot/grub/grub.cfg")
   '';
 })
diff --git a/nixos/tests/sssd.nix b/nixos/tests/sssd.nix
new file mode 100644
index 00000000000..4c6ca86c74c
--- /dev/null
+++ b/nixos/tests/sssd.nix
@@ -0,0 +1,17 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+
+{
+  name = "sssd";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ bbigras ];
+  };
+  machine = { pkgs, ... }: {
+    services.sssd.enable = true;
+  };
+
+  testScript = ''
+      start_all()
+      machine.wait_for_unit("multi-user.target")
+      machine.wait_for_unit("sssd.service")
+    '';
+})
diff --git a/nixos/tests/systemd-networkd-ipv6-prefix-delegation.nix b/nixos/tests/systemd-networkd-ipv6-prefix-delegation.nix
index 99cd341eec1..99395fe3023 100644
--- a/nixos/tests/systemd-networkd-ipv6-prefix-delegation.nix
+++ b/nixos/tests/systemd-networkd-ipv6-prefix-delegation.nix
@@ -31,7 +31,7 @@ import ./make-test-python.nix ({pkgs, ...}: {
         firewall.enable = false;
         interfaces.eth1.ipv4.addresses = lib.mkForce []; # no need for legacy IP
         interfaces.eth1.ipv6.addresses = lib.mkForce [
-          { address = "2001:DB8::"; prefixLength = 64; }
+          { address = "2001:DB8::1"; prefixLength = 64; }
         ];
       };
 
@@ -260,7 +260,7 @@ import ./make-test-python.nix ({pkgs, ...}: {
     client.wait_until_succeeds("ping -6 -c 1 FD42::1")
 
     # the global IP of the ISP router should still not be a reachable
-    router.fail("ping -6 -c 1 2001:DB8::")
+    router.fail("ping -6 -c 1 2001:DB8::1")
 
     # Once we have internal connectivity boot up the ISP
     isp.start()
@@ -273,11 +273,11 @@ import ./make-test-python.nix ({pkgs, ...}: {
 
     # wait until the uplink interface has a good status
     router.wait_for_unit("network-online.target")
-    router.wait_until_succeeds("ping -6 -c1 2001:DB8::")
+    router.wait_until_succeeds("ping -6 -c1 2001:DB8::1")
 
     # shortly after that the client should have received it's global IPv6
     # address and thus be able to ping the ISP
-    client.wait_until_succeeds("ping -6 -c1 2001:DB8::")
+    client.wait_until_succeeds("ping -6 -c1 2001:DB8::1")
 
     # verify that we got a globally scoped address in eth1 from the
     # documentation prefix
diff --git a/pkgs/applications/audio/helm/default.nix b/pkgs/applications/audio/helm/default.nix
index 8459967a363..145ba68b08b 100644
--- a/pkgs/applications/audio/helm/default.nix
+++ b/pkgs/applications/audio/helm/default.nix
@@ -1,5 +1,16 @@
-{ stdenv, fetchFromGitHub , xorg, freetype, alsaLib, curl, libjack2
-, lv2, pkgconfig, libGLU, libGL }:
+{ stdenv
+, fetchFromGitHub
+, fetchpatch
+, xorg
+, freetype
+, alsaLib
+, curl
+, libjack2
+, lv2
+, pkgconfig
+, libGLU
+, libGL
+}:
 
   stdenv.mkDerivation {
   version = "0.9.0";
@@ -20,7 +31,15 @@
 
   CXXFLAGS = "-DHAVE_LROUND";
 
-  patchPhase = ''
+  patches = [
+    # gcc9 compatibility https://github.com/mtytel/helm/pull/233
+    (fetchpatch {
+      url = "https://github.com/mtytel/helm/commit/cb611a80bd5a36d31bfc31212ebbf79aa86c6f08.patch";
+      sha256 = "1i2289srcfz17c3zzab6f51aznzdj62kk53l4afr32bkjh9s4ixk";
+    })
+  ];
+
+  prePatch = ''
     sed -i 's|usr/||g' Makefile
   '';
 
diff --git a/pkgs/applications/audio/picard/default.nix b/pkgs/applications/audio/picard/default.nix
index 276fe75dd9f..2aeae1f1890 100644
--- a/pkgs/applications/audio/picard/default.nix
+++ b/pkgs/applications/audio/picard/default.nix
@@ -12,13 +12,13 @@ let
   ;
 in pythonPackages.buildPythonApplication rec {
   pname = "picard";
-  version = "2.4.1";
+  version = "2.4.2";
 
   src = fetchFromGitHub {
     owner = "metabrainz";
     repo = pname;
     rev = "release-${version}";
-    sha256 = "0s4jmcg1n6ayxf7x0amq67rgn6y127h98s2k4fcna6n9477krrwf";
+    sha256 = "0sbccsisk9w0gnblvhg7wk1c5ydppldjbvaa0zhl3yrid5a363ah";
   };
 
   nativeBuildInputs = [ gettext qt5.wrapQtAppsHook qt5.qtbase ]
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index c622a1fcead..3a0bef24ab7 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -19,9 +19,9 @@ let
     sha256Hash = "11lkwcbzdl86cyz4lci65cx9z5jjhrc4z40maqx2r5hw1xka9290";
   };
   latestVersion = { # canary & dev
-    version = "4.2.0.5"; # "Android Studio 4.2 Canary 5"
-    build = "201.6682321";
-    sha256Hash = "076q6d7kmi0wcsqak7n6ggp1qns4xj1134xcpdzb92qk3dmg3wrh";
+    version = "4.2.0.7"; # "Android Studio 4.2 Canary 7"
+    build = "201.6720134";
+    sha256Hash = "1c9s6rd0z596qr7hbil5rl3fqby7c8h7ma52d1qj5rxra73k77nz";
   };
 in {
   # Attributes are named by their corresponding release channels
diff --git a/pkgs/applications/editors/nano/default.nix b/pkgs/applications/editors/nano/default.nix
index 13a0e797adc..244649f8663 100644
--- a/pkgs/applications/editors/nano/default.nix
+++ b/pkgs/applications/editors/nano/default.nix
@@ -20,11 +20,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "nano";
-  version = "5.0";
+  version = "5.2";
 
   src = fetchurl {
     url = "mirror://gnu/nano/${pname}-${version}.tar.xz";
-    sha256 = "0dmagj4p1llb1a2w0iwdrqbd9cgp0bda4s18vwh6y1ndd6z983bw";
+    sha256 = "1qd7pn9g5dgzbfg4fb3nqxqgi2iqq0g6x33x8d1mx6mfw51xmhij";
   };
 
   nativeBuildInputs = [ texinfo ] ++ optional enableNls gettext;
diff --git a/pkgs/applications/editors/setzer/default.nix b/pkgs/applications/editors/setzer/default.nix
index 5a0ef754db1..0b1dd8fcb9f 100644
--- a/pkgs/applications/editors/setzer/default.nix
+++ b/pkgs/applications/editors/setzer/default.nix
@@ -17,13 +17,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "setzer";
-  version = "0.2.8";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "cvfosammmm";
     repo = "Setzer";
     rev = "v${version}";
-    sha256 = "1llxxjj038nd2p857bjdyyhzskn56826qi259v47vaqlv9hkifil";
+    sha256 = "0gx5fnyi932lswkhdvxfqs0wxx7hz690cbnpv4m3ysydi96mxwiv";
   };
 
   format = "other";
diff --git a/pkgs/applications/editors/viw/default.nix b/pkgs/applications/editors/viw/default.nix
new file mode 100644
index 00000000000..4025bf252b3
--- /dev/null
+++ b/pkgs/applications/editors/viw/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, fetchFromGitHub, ncurses }:
+
+stdenv.mkDerivation rec {
+  pname = "viw";
+  version = "unstable-20171029";
+
+  src = fetchFromGitHub {
+    owner = "lpan";
+    repo = pname;
+    rev = "2cf317f6d82a6fa58f284074400297b6dc0f44c2";
+    sha256 = "0bnkh57v01zay6ggk0rbddaf75i48h8z06xsv33wfbjldclaljp1";
+  };
+
+  buildInputs = [ ncurses ];
+
+  makeFlags = [ "CC=cc" ];
+  checkFlags = [ "test-command" "test-buffer" "test-state" ];
+
+  installPhase = ''
+    install -Dm 755 -t $out/bin viw
+    install -Dm 644 -t $out/share/doc/${pname} README.md
+  '';
+
+  meta = with stdenv.lib; {
+    description = "VI Worsened, a fun and light clone of VI";
+    homepage = "https://github.com/lpan/viw";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ AndersonTorres ];
+  };
+}
diff --git a/pkgs/applications/graphics/opentoonz/default.nix b/pkgs/applications/graphics/opentoonz/default.nix
new file mode 100644
index 00000000000..68830699699
--- /dev/null
+++ b/pkgs/applications/graphics/opentoonz/default.nix
@@ -0,0 +1,51 @@
+{ boost, cmake, fetchFromGitHub, freeglut, freetype, glew, libjpeg, libmypaint
+, libpng, libtiff, libusb1, lz4, lzma, lzo, openblas, pkgconfig, qtbase
+, qtmultimedia, qtscript, stdenv, superlu, wrapQtAppsHook, }:
+let source = import ./source.nix { inherit fetchFromGitHub; };
+in stdenv.mkDerivation rec {
+  inherit (source) src;
+
+  pname = "opentoonz";
+  version = source.versions.opentoonz;
+
+  nativeBuildInputs = [ cmake pkgconfig wrapQtAppsHook ];
+
+  buildInputs = [
+    boost
+    freeglut
+    freetype
+    glew
+    libjpeg
+    libmypaint
+    libpng
+    libtiff
+    libusb1
+    lz4
+    lzma
+    lzo
+    openblas
+    qtbase
+    qtmultimedia
+    qtscript
+    superlu
+  ];
+
+  postUnpack = "sourceRoot=$sourceRoot/toonz";
+
+  cmakeDir = "../sources";
+  cmakeFlags = [
+    "-DTIFF_INCLUDE_DIR=${libtiff.dev}/include"
+    "-DTIFF_LIBRARY=${libtiff.out}/lib/libtiff.so"
+  ];
+
+  postInstall = ''
+    sed -i '/cp -r .*stuff/a\    chmod -R u+w $HOME/.config/OpenToonz/stuff' $out/bin/opentoonz
+  '';
+
+  meta = {
+    description = "Full-featured 2D animation creation software";
+    homepage = "https://opentoonz.github.io/";
+    license = stdenv.lib.licenses.bsd3;
+    maintainers = with stdenv.lib.maintainers; [ chkno ];
+  };
+}
diff --git a/pkgs/applications/graphics/opentoonz/libtiff.nix b/pkgs/applications/graphics/opentoonz/libtiff.nix
new file mode 100644
index 00000000000..6663c47553e
--- /dev/null
+++ b/pkgs/applications/graphics/opentoonz/libtiff.nix
@@ -0,0 +1,21 @@
+# Per https://github.com/opentoonz/opentoonz/blob/master/doc/how_to_build_linux.md ,
+# opentoonz requires its own modified version of libtiff.  We still build it as
+# a separate package
+#  1. For visibility for tools like vulnix, and
+#  2. To avoid a diamond-dependency problem with qt linking the normal libtiff
+#     and opentoonz linking qt and this modified libtiff, we build a qt against
+#     this modified libtiff as well.
+
+{ fetchFromGitHub, libtiff }:
+let source = import ./source.nix { inherit fetchFromGitHub; };
+in libtiff.overrideAttrs (old: {
+  inherit (source) src;
+  version = source.versions.libtiff + "-opentoonz";
+  postUnpack = (old.postUnpack or "") + ''
+    sourceRoot="$sourceRoot/thirdparty/tiff-${source.versions.libtiff}"
+  '';
+  # opentoonz uses internal libtiff headers
+  postInstall = (old.postInstall or "") + ''
+    cp libtiff/{tif_config,tif_dir,tiffiop}.h $dev/include
+  '';
+})
diff --git a/pkgs/applications/graphics/opentoonz/source.nix b/pkgs/applications/graphics/opentoonz/source.nix
new file mode 100644
index 00000000000..7378d2f5f96
--- /dev/null
+++ b/pkgs/applications/graphics/opentoonz/source.nix
@@ -0,0 +1,16 @@
+# opentoonz's source archive contains both opentoonz's source and a modified
+# version of libtiff that opentoonz requires.
+
+{ fetchFromGitHub, }: rec {
+  versions = {
+    opentoonz = "1.4.0";
+    libtiff = "4.0.3";
+  };
+
+  src = fetchFromGitHub {
+    owner = "opentoonz";
+    repo = "opentoonz";
+    rev = "v${versions.opentoonz}";
+    sha256 = "0vgclx2yydsm5i2smff3fj8m750nhf35wfhva37kywgws01s189b";
+  };
+}
diff --git a/pkgs/applications/misc/bemenu/default.nix b/pkgs/applications/misc/bemenu/default.nix
index 8b17ecea3cb..43362b0394e 100644
--- a/pkgs/applications/misc/bemenu/default.nix
+++ b/pkgs/applications/misc/bemenu/default.nix
@@ -11,13 +11,13 @@ assert x11Support -> xlibs != null && xorg != null;
 
 stdenv.mkDerivation rec {
   pname = "bemenu";
-  version = "0.4.1";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "Cloudef";
     repo = pname;
     rev = version;
-    sha256 = "1fjcs9d3533ay3nz79cx3c0lmy2chgragr2lhsy0xl2ckr0iins0";
+    sha256 = "1ifq5bk7782b9m6bl111x33fn38rpppdrww7hfavqia9a9gi2sl5";
   };
 
   nativeBuildInputs = [ pkgconfig pcre ];
diff --git a/pkgs/applications/misc/blender/default.nix b/pkgs/applications/misc/blender/default.nix
index 2e6981490ce..2190307fbb5 100644
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@@ -17,11 +17,11 @@ let python = python3Packages.python; in
 
 stdenv.mkDerivation rec {
   pname = "blender";
-  version = "2.83.4";
+  version = "2.83.5";
 
   src = fetchurl {
     url = "https://download.blender.org/source/${pname}-${version}.tar.xz";
-    sha256 = "1y4phkzrxy17kpjbg0jbz1236nw8w8p006x1crbqmvwz8wd3dm46";
+    sha256 = "0xyawly00a59hfdb6b7va84k5fhcv2mxnzd77vs22bzi9y7sap43";
   };
 
   patches = lib.optional stdenv.isDarwin ./darwin.patch;
diff --git a/pkgs/applications/misc/cheat/default.nix b/pkgs/applications/misc/cheat/default.nix
index 6fa8e0cf7bd..e3ffdef44d0 100644
--- a/pkgs/applications/misc/cheat/default.nix
+++ b/pkgs/applications/misc/cheat/default.nix
@@ -3,13 +3,13 @@
 
 buildGoModule rec {
   pname = "cheat";
-  version = "4.0.3";
+  version = "4.0.4";
 
   src = fetchFromGitHub {
     owner = "cheat";
     repo = "cheat";
     rev = version;
-    sha256 = "1bzlbd8lvagpipyv553icv17bafhaydscrrlly8jz7kfi4d9xvkk";
+    sha256 = "0cracw6pja3d7z6ip6lbmpvfxlxcnh3fbgh5ba8c87bhfz99idqn";
   };
 
   subPackages = [ "cmd/cheat" ];
diff --git a/pkgs/applications/misc/lutris/fhsenv.nix b/pkgs/applications/misc/lutris/fhsenv.nix
index 6fad8b23d33..2b656775ab5 100644
--- a/pkgs/applications/misc/lutris/fhsenv.nix
+++ b/pkgs/applications/misc/lutris/fhsenv.nix
@@ -97,7 +97,7 @@ in buildFHSUserEnv {
     libcap libtiff libva libgphoto2 libxslt libsndfile giflib zlib glib
     alsaLib zziplib bash dbus keyutils zip cabextract freetype unzip coreutils
     readline gcc SDL SDL2 curl graphite2 gtk2 gtk3 udev ncurses wayland libglvnd
-    vulkan-loader xdg_utils sqlite gnutls p11-kit libbsd
+    vulkan-loader xdg_utils sqlite gnutls p11-kit libbsd harfbuzz
 
     # PCSX2 // TODO: "libgobject-2.0.so.0: wrong ELF class: ELFCLASS64"
 
diff --git a/pkgs/applications/misc/navi/default.nix b/pkgs/applications/misc/navi/default.nix
index e403ccea0da..548d49422b5 100644
--- a/pkgs/applications/misc/navi/default.nix
+++ b/pkgs/applications/misc/navi/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "navi";
-  version = "2.7.1";
+  version = "2.8.0";
 
   src = fetchFromGitHub {
     owner = "denisidoro";
     repo = "navi";
     rev = "v${version}";
-    sha256 = "12p9l41k7isaapr0xbsm7brkjrv7i8826y029i12psz92nsynk29";
+    sha256 = "0w63yx4c60r05nfswv61jw3l3zbl5n1s396a6f4ayn52fb6rxwg1";
   };
 
-  cargoSha256 = "11dc3gc7fyikbbgacmljhysr2sl7lmq6w3bsfcf2cqny39r25yp0";
+  cargoSha256 = "06xpk04nxkm7h4nn235x8a4gi0qhscj8kkl2f9gqphlfmm56kjfn";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/applications/misc/simplenote/default.nix b/pkgs/applications/misc/simplenote/default.nix
index 8839dc38a53..05cf15b8acc 100644
--- a/pkgs/applications/misc/simplenote/default.nix
+++ b/pkgs/applications/misc/simplenote/default.nix
@@ -17,10 +17,10 @@ let
 
   pname = "simplenote";
 
-  version = "1.21.0";
+  version = "1.21.1";
 
   sha256 = {
-    x86_64-linux = "073dg4agqgimsgs3ia7g0pjv4vxkh24bj7vpmssiysdxhm4li1j1";
+    x86_64-linux = "00qx82d17yrrg2mxwhm40av0mpf5hy14j338i5ijhwp79yc8fk8x";
   }.${system} or throwSystem;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/misc/systembus-notify/default.nix b/pkgs/applications/misc/systembus-notify/default.nix
index 28c1be4219d..374adc6c89b 100644
--- a/pkgs/applications/misc/systembus-notify/default.nix
+++ b/pkgs/applications/misc/systembus-notify/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "systembus-notify";
-  version = "1.0";
+  version = "1.1";
 
   src = fetchFromGitHub {
     owner = "rfjakob";
     repo = "systembus-notify";
     rev = "v${version}";
-    sha256 = "11zq84qfmbyl51d3r6294l2bjhlgwa9bx7d263g9fkqrwsg0si0y";
+    sha256 = "1pdn45rfpwhrf20hs87qmk2j8sr7ab8161f81019wnypnb1q2fsv";
   };
 
   buildInputs = [ systemd ];
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 4ecdec77ddb..2fc15a42a8b 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -108,7 +108,7 @@ stdenv.mkDerivation ({
     dbus dbus-glib pango freetype fontconfig xorg.libXi xorg.libXcursor
     xorg.libX11 xorg.libXrender xorg.libXft xorg.libXt file
     libnotify xorg.pixman yasm libGLU libGL
-    xorg.libXScrnSaver xorg.xorgproto
+    xorg.xorgproto
     xorg.libXext unzip makeWrapper
     libevent libstartup_notification /* cairo */
     libpng jemalloc glib
@@ -277,6 +277,7 @@ stdenv.mkDerivation ({
     patchelf --set-rpath "${lib.getLib libnotify
       }/lib:$(patchelf --print-rpath "$out"/lib/${binaryName}*/libxul.so)" \
         "$out"/lib/${binaryName}*/libxul.so
+    patchelf --add-needed ${xorg.libXScrnSaver.out}/lib/libXss.so $out/lib/${binaryName}/${binaryName}
   '';
 
   doInstallCheck = true;
diff --git a/pkgs/applications/networking/cluster/terragrunt/default.nix b/pkgs/applications/networking/cluster/terragrunt/default.nix
index be5d47eb0e0..14744f188b0 100644
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.23.32";
+  version = "0.23.33";
 
    src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1pa3k0hjdb5bj0bp4aj3lfcgz98l3wd9kfa12rn9zzbcmp087kih";
+    sha256 = "0fsyvmdg2llnzy0yzmiihnb865ccq2sn6d3i935dflppnjyp01p4";
   };
 
-  vendorSha256 = "1xn7c6y32vpanqvf1sfpw6bs73dbjniavjbf00j0vx83bfyklsr4";
+  vendorSha256 = "05p72l724qqf61dn0frahf4awvkkcw8cpl6nhwlacd1jw8c14fjl";
 
   doCheck = false;
 
diff --git a/pkgs/applications/networking/instant-messengers/nheko/default.nix b/pkgs/applications/networking/instant-messengers/nheko/default.nix
index 5d9963956ed..2f5316c9fe2 100644
--- a/pkgs/applications/networking/instant-messengers/nheko/default.nix
+++ b/pkgs/applications/networking/instant-messengers/nheko/default.nix
@@ -54,11 +54,6 @@ mkDerivation rec {
     qtquickcontrols2
     qtgraphicaleffects
   ] ++ lib.optional stdenv.isDarwin qtmacextras;
-  # Quick and dirty fix to https://github.com/NixOS/nixpkgs/issues/94952
-  # and/or: https://github.com/NixOS/nixpkgs/issues/94905
-  cmakeFlags = [
-    "-DCMAKE_OSX_ARCHITECTURES="
-  ];
 
   meta = with stdenv.lib; {
     description = "Desktop client for the Matrix protocol";
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index abd187b57c7..69a95b3459b 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -2,7 +2,9 @@
 , gnome2, gtk3, atk, at-spi2-atk, cairo, pango, gdk-pixbuf, glib, freetype, fontconfig
 , dbus, libX11, xorg, libXi, libXcursor, libXdamage, libXrandr, libXcomposite
 , libXext, libXfixes, libXrender, libXtst, libXScrnSaver, nss, nspr, alsaLib
-, cups, expat, systemd, libnotify, libuuid, at-spi2-core, libappindicator-gtk3
+, cups, expat, libuuid, at-spi2-core, libappindicator-gtk3
+# Runtime dependencies:
+, systemd, libnotify, libdbusmenu
 # Unfortunately this also overwrites the UI language (not just the spell
 # checking language!):
 , hunspellDicts, spellcheckerLanguage ? null # E.g. "de_DE"
@@ -81,6 +83,7 @@ in stdenv.mkDerivation rec {
   runtimeDependencies = [
     (lib.getLib systemd)
     libnotify
+    libdbusmenu
   ];
 
   unpackPhase = "dpkg-deb -x $src .";
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
index 014e22bc512..7e932d74abc 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@@ -1,4 +1,4 @@
-{ mkDerivation, lib, fetchurl, fetchsvn, stdenv
+{ mkDerivation, lib, fetchurl, fetchsvn
 , pkgconfig, cmake, ninja, python3, wrapGAppsHook, wrapQtAppsHook
 , qtbase, qtimageformats, gtk3, libsForQt5, enchant2, lz4, xxHash
 , dee, ffmpeg, openalSoft, minizip, libopus, alsaLib, libpulseaudio, range-v3
@@ -63,8 +63,6 @@ mkDerivation rec {
     "-DDESKTOP_APP_DISABLE_WEBRTC_INTEGRATION=ON"
     #"-DDESKTOP_APP_SPECIAL_TARGET=\"\"" # TODO: Error when set to "": Bad special target '""'
     "-DTDESKTOP_LAUNCHER_BASENAME=telegramdesktop" # Note: This is the default
-  ] ++ optionals stdenv.isLinux [ # TODO: Remove workaround once #94905 is resolved:
-    "-DCMAKE_OSX_ARCHITECTURES="
   ];
 
   # Note: The following packages could be packaged system-wide, but it's
diff --git a/pkgs/applications/networking/irc/weechat/scripts/default.nix b/pkgs/applications/networking/irc/weechat/scripts/default.nix
index 0880a32af92..6d228688607 100644
--- a/pkgs/applications/networking/irc/weechat/scripts/default.nix
+++ b/pkgs/applications/networking/irc/weechat/scripts/default.nix
@@ -7,6 +7,8 @@
 
   weechat-matrix = python3Packages.callPackage ./weechat-matrix { };
 
+  weechat-notify-send = python3Packages.callPackage ./weechat-notify-send { };
+
   wee-slack = callPackage ./wee-slack { };
 
   weechat-autosort = callPackage ./weechat-autosort { };
diff --git a/pkgs/applications/networking/irc/weechat/scripts/weechat-notify-send/default.nix b/pkgs/applications/networking/irc/weechat/scripts/weechat-notify-send/default.nix
new file mode 100644
index 00000000000..d219aa481cd
--- /dev/null
+++ b/pkgs/applications/networking/irc/weechat/scripts/weechat-notify-send/default.nix
@@ -0,0 +1,31 @@
+{ stdenv, fetchFromGitHub, libnotify }:
+
+stdenv.mkDerivation rec {
+  pname = "weechat-notify-send";
+  version = "0.9";
+
+  src = fetchFromGitHub {
+    owner = "s3rvac";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1693b7axm9ls5p7hm6kq6avddsisi491khr5irvswr5lpizvys6a";
+  };
+
+  passthru.scripts = [ "notify_send.py" ];
+
+  dontBuild = true;
+  doCheck = false;
+
+  installPhase = ''
+    install -D notify_send.py $out/share/notify_send.py
+    substituteInPlace $out/share/notify_send.py \
+      --replace "'notify-send'" "'${libnotify}/bin/notify-send'"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A WeeChat script that sends highlight and message notifications through notify-send";
+    homepage = "https://github.com/s3rvac/weechat-notify-srnd";
+    license = licenses.mit;
+    maintainers = with maintainers; [ tobim ];
+  };
+}
diff --git a/pkgs/applications/networking/mailreaders/notmuch-bower/default.nix b/pkgs/applications/networking/mailreaders/notmuch-bower/default.nix
index 0b2a76cc00f..214f4311e69 100644
--- a/pkgs/applications/networking/mailreaders/notmuch-bower/default.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch-bower/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "notmuch-bower";
-  version = "0.11";
+  version = "0.12";
 
   src = fetchFromGitHub {
     owner = "wangp";
     repo = "bower";
     rev = version;
-    sha256 = "0vhac8yjnhb1gz60jfzg27spyn96c1rr849gc6vjym5xamw7zp0v";
+    sha256 = "0hvvlbvad6h73iiyn9xshlj073p2ddchgh0pyizh9gi8niir4fn5";
   };
 
   nativeBuildInputs = [ gawk mercury pandoc ];
diff --git a/pkgs/applications/office/softmaker/freeoffice.nix b/pkgs/applications/office/softmaker/freeoffice.nix
index d9f901ff463..634a696a73e 100644
--- a/pkgs/applications/office/softmaker/freeoffice.nix
+++ b/pkgs/applications/office/softmaker/freeoffice.nix
@@ -1,14 +1,26 @@
-{ callPackage, fetchurl, ... } @ args:
+{ callPackage
+, fetchurl
 
-callPackage ./generic.nix (args // rec {
-  pname = "freeoffice";
+  # This is a bit unusual, but makes version and hash easily
+  # overridable. This is useful when the upstream archive was replaced
+  # and nixpkgs is not in sync yet.
+, officeVersion ? {
   version = "976";
   edition = "2018";
+  sha256 = "13yh4lyqakbdqf4r8vw8imy5gwpfva697iqfd85qmp3wimqvzskl";
+}
+
+, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  inherit (officeVersion) version edition;
+
+  pname = "freeoffice";
   suiteName = "FreeOffice";
 
   src = fetchurl {
+    inherit (officeVersion) sha256;
     url = "https://www.softmaker.net/down/softmaker-freeoffice-${version}-amd64.tgz";
-    sha256 = "13yh4lyqakbdqf4r8vw8imy5gwpfva697iqfd85qmp3wimqvzskl";
   };
 
   archive = "freeoffice${edition}.tar.lzma";
diff --git a/pkgs/applications/office/softmaker/softmaker_office.nix b/pkgs/applications/office/softmaker/softmaker_office.nix
index 39a6c9288b4..6aaa8c6745a 100644
--- a/pkgs/applications/office/softmaker/softmaker_office.nix
+++ b/pkgs/applications/office/softmaker/softmaker_office.nix
@@ -1,14 +1,27 @@
-{ callPackage, fetchurl, ... } @ args:
+{ callPackage
+, fetchurl
+
+  # This is a bit unusual, but makes version and hash easily
+  # overridable. This is useful when people have an older version of
+  # Softmaker Office or when the upstream archive was replaced and
+  # nixpkgs is not in sync yet.
+, officeVersion ? {
+  version = "1018";
+  edition = "2021";
+  sha256 = "1g9mcn0z7s3xw7d5bcjxbnamh6knzndcysahydskfcds6czdxg0c";
+}
+
+, ... } @ args:
 
 callPackage ./generic.nix (args // rec {
+  inherit (officeVersion) version edition;
+
   pname = "softmaker-office";
-  version = "1016";
-  edition = "2021";
   suiteName = "SoftMaker Office";
 
   src = fetchurl {
+    inherit (officeVersion) sha256;
     url = "https://www.softmaker.net/down/softmaker-office-${edition}-${version}-amd64.tgz";
-    sha256 = "0s8kzpc6w2cjkfqmhb2p1pkmkiq9vk9gnc7z2992kijaf9bwk3qz";
   };
 
   archive = "office${edition}.tar.lzma";
diff --git a/pkgs/applications/radio/inspectrum/default.nix b/pkgs/applications/radio/inspectrum/default.nix
index a205cec714d..f55c78ea26b 100644
--- a/pkgs/applications/radio/inspectrum/default.nix
+++ b/pkgs/applications/radio/inspectrum/default.nix
@@ -8,20 +8,21 @@
 , gnuradio
 , liquid-dsp
 , qtbase
+, wrapQtAppsHook
 }:
 
-mkDerivation {
+mkDerivation rec {
   pname = "inspectrum";
-  version = "unstable-2017-05-31";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "miek";
     repo = "inspectrum";
-    rev = "a89d1337efb31673ccb6a6681bb89c21894c76f7";
-    sha256 = "1fvnr8gca25i6s9mg9b2hyqs0zzr4jicw13mimc9dhrgxklrr1yv";
+    rev = "v${version}";
+    sha256 = "1a517y7s1xi66y5kjrpjay450pad9nc228pa8801mxq1c7m1lamm";
   };
 
-  nativeBuildInputs = [ cmake pkgconfig ];
+  nativeBuildInputs = [ cmake pkgconfig wrapQtAppsHook ];
   buildInputs = [
     fftwFloat
     boost
diff --git a/pkgs/applications/science/math/mathematica/l10ns.nix b/pkgs/applications/science/math/mathematica/l10ns.nix
index c75c91be059..8ec6ac5048d 100644
--- a/pkgs/applications/science/math/mathematica/l10ns.nix
+++ b/pkgs/applications/science/math/mathematica/l10ns.nix
@@ -8,6 +8,12 @@ let allVersions = with lib; flip map
   # N.B. Versions in this list should be ordered from newest to oldest.
   [
     {
+      version = "12.1.1";
+      lang = "en";
+      language = "English";
+      sha256 = "02mk8gmv8idnakva1nc7r7mx8ld02lk7jgsj1zbn962aps3bhixd";
+    }
+    {
       version = "12.1.0";
       lang = "en";
       language = "English";
diff --git a/pkgs/applications/version-management/fossil/default.nix b/pkgs/applications/version-management/fossil/default.nix
index d23728a060f..b34220c2635 100644
--- a/pkgs/applications/version-management/fossil/default.nix
+++ b/pkgs/applications/version-management/fossil/default.nix
@@ -5,7 +5,7 @@
 
 stdenv.mkDerivation rec {
   pname = "fossil";
-  version = "2.11.1";
+  version = "2.12.1";
 
   src = fetchurl {
     urls =
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
         "https://www.fossil-scm.org/index.html/uv/fossil-src-${version}.tar.gz"
       ];
     name = "${pname}-${version}.tar.gz";
-    sha256 = "1sxq1hn87fdikhbg9y3v4sjy4gxaifnx4dig8nx6xwd5mm7z74dk";
+    sha256 = "00v6gmn2wpfms5jzf103hkm5s8i3bfs5mzacmznlhdzdrzzjc8w2";
   };
 
   buildInputs = [ zlib openssl readline sqlite which ed ]
diff --git a/pkgs/applications/virtualization/docker-slim/default.nix b/pkgs/applications/virtualization/docker-slim/default.nix
index c68c0d47e39..058f6fd8ccc 100644
--- a/pkgs/applications/virtualization/docker-slim/default.nix
+++ b/pkgs/applications/virtualization/docker-slim/default.nix
@@ -6,7 +6,7 @@
 
 buildGoPackage rec {
   pname = "docker-slim";
-  version = "1.31.0";
+  version = "1.32.0";
 
   goPackagePath = "github.com/docker-slim/docker-slim";
 
@@ -14,7 +14,7 @@ buildGoPackage rec {
     owner = "docker-slim";
     repo = "docker-slim";
     rev = version;
-    sha256 = "0kj97kwyjs9hksaas0zic4m7w8b17c1d7c8vhiq2862w97ngxrsk";
+    sha256 = "0pd2v7df176ca923c4nw9ns5gz442jkb0jhzqjl53rwfwz1vxy9h";
   };
 
   subPackages = [ "cmd/docker-slim" "cmd/docker-slim-sensor" ];
diff --git a/pkgs/applications/virtualization/podman/default.nix b/pkgs/applications/virtualization/podman/default.nix
index b6656ea50bd..7d214b4abd3 100644
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@@ -16,13 +16,13 @@
 
 buildGoModule rec {
   pname = "podman";
-  version = "2.0.4";
+  version = "2.0.5";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman";
     rev = "v${version}";
-    sha256 = "0rnli16nh5m3a8jjkkm1k4f896yk1k1rg48rjiajqhfrr98qwr0f";
+    sha256 = "0db0q52va9w8aprzx08xnv6y84l4x4lc113sd97hjgjnhknp8d3m";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/applications/window-managers/i3/lock-fancy-rapid.nix b/pkgs/applications/window-managers/i3/lock-fancy-rapid.nix
new file mode 100644
index 00000000000..f6e24d979a4
--- /dev/null
+++ b/pkgs/applications/window-managers/i3/lock-fancy-rapid.nix
@@ -0,0 +1,32 @@
+{ stdenv, fetchFromGitHub, xorg, i3lock }:
+
+stdenv.mkDerivation rec {
+  pname = "i3lock-fancy-rapid";
+  version = "2019-10-09";
+  src = fetchFromGitHub {
+    owner = "yvbbrjdr";
+    repo = "i3lock-fancy-rapid";
+    rev = "c67f09bc8a48798c7c820d7d4749240b10865ce0";
+    sha256 = "0jhvlj6v6wx70239pgkjxd42z1s2bzfg886ra6n1rzsdclf4rkc6";
+  };
+
+  buildInputs = [ xorg.libX11 ];
+  propagatedBuildInputs = [ i3lock ];
+
+  postPatch = ''
+    substituteInPlace i3lock-fancy-rapid.c \
+      --replace '"i3lock"' '"${i3lock}/bin/i3lock"'
+  '';
+
+  installPhase = ''
+    install -D i3lock-fancy-rapid $out/bin/i3lock-fancy-rapid
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A faster implementation of i3lock-fancy";
+    homepage = "https://github.com/yvbbrjdr/i3lock-fancy-rapid";
+    maintainers = with maintainers; [ nickhu ];
+    license = licenses.bsd3;
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/data/fonts/iosevka/bin.nix b/pkgs/data/fonts/iosevka/bin.nix
index ee1bd74faf5..0f88aa05e4c 100644
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchzip }:
 
 let
-  version = "3.4.1";
+  version = "3.4.6";
 in fetchzip {
   name = "iosevka-bin-${version}";
 
@@ -12,7 +12,7 @@ in fetchzip {
     unzip -j $downloadedFile \*.ttc -d $out/share/fonts/truetype
   '';
 
-  sha256 = "0qqzgfplib6jdn1fra7fwx25jkzlw21brj45q8gn3gxvndvqabvd";
+  sha256 = "1nab49gkpxahwvvw39xcc32q425qkccr7ffmz87jbcdv71qy7pp9";
 
   meta = with stdenv.lib; {
     homepage = "https://be5invis.github.io/Iosevka/";
diff --git a/pkgs/data/fonts/recursive/default.nix b/pkgs/data/fonts/recursive/default.nix
index 7f3b9562e89..441a51033b6 100644
--- a/pkgs/data/fonts/recursive/default.nix
+++ b/pkgs/data/fonts/recursive/default.nix
@@ -1,7 +1,7 @@
 { lib, fetchzip }:
 
 let
-  version = "1.057";
+  version = "1.059";
 in
 fetchzip {
   name = "recursive-${version}";
@@ -15,7 +15,7 @@ fetchzip {
     unzip -j $downloadedFile \*.woff2 -d $out/share/fonts/woff2
   '';
 
-  sha256 = "0qsqldnhgl93h1izminjajjymvyxsw91ngdbxlhgbqvadg77325y";
+  sha256 = "0dlv8nrcqdn5vn3s918in5ph6kx6rg607kgp66p6ibpbg2s8ljy7";
 
   meta = with lib; {
     homepage = "https://recursive.design/";
diff --git a/pkgs/desktops/deepin/dde-api/default.nix b/pkgs/desktops/deepin/dde-api/default.nix
index 95e38a86416..a84fc9c2e02 100644
--- a/pkgs/desktops/deepin/dde-api/default.nix
+++ b/pkgs/desktops/deepin/dde-api/default.nix
@@ -20,7 +20,7 @@
 , librsvg
 , poppler
 , pulseaudio
-, rfkill
+, utillinux
 , xcur2png
 }:
 
@@ -49,7 +49,7 @@ buildGoPackage rec {
     blur-effect # run (is it really needed?)
     coreutils   # run (is it really needed?)
     fontconfig  # run (is it really needed?)
-    rfkill      # run
+    utillinux   # run
     xcur2png    # run
     grub2       # run (is it really needed?)
   ];
diff --git a/pkgs/development/compilers/aspectj/default.nix b/pkgs/development/compilers/aspectj/default.nix
index 94dc813d78a..8fd47e937c8 100644
--- a/pkgs/development/compilers/aspectj/default.nix
+++ b/pkgs/development/compilers/aspectj/default.nix
@@ -1,12 +1,15 @@
 {stdenv, fetchurl, jre}:
 
 stdenv.mkDerivation rec {
-  name = "aspectj-1.5.2";
+  pname = "aspectj";
+  version = "1.9.6";
   builder = ./builder.sh;
 
-  src = fetchurl {
-    url = "http://archive.eclipse.org/tools/aspectj/${name}.jar";
-    sha256 = "1b3mx248dc1xka1vgsl0jj4sm0nfjsqdcj9r9036mvixj1zj3nmh";
+  src = let
+    versionSnakeCase = builtins.replaceStrings ["."] ["_"] version;
+  in fetchurl {
+    url = "https://github.com/eclipse/org.aspectj/releases/download/V${versionSnakeCase}/aspectj-${version}.jar";
+    sha256 = "02jh66l3vw57k9a4dxlga3qh3487r36gyi6k2z2mmqxbpqajslja";
   };
 
   inherit jre;
diff --git a/pkgs/development/compilers/copper/default.nix b/pkgs/development/compilers/copper/default.nix
new file mode 100644
index 00000000000..4d24c78f25f
--- /dev/null
+++ b/pkgs/development/compilers/copper/default.nix
@@ -0,0 +1,32 @@
+{ stdenv
+, fetchurl
+, libffi
+}:
+stdenv.mkDerivation rec {
+  pname = "copper";
+  version = "4.4";
+  src = fetchurl {
+    url = "https://tibleiz.net/download/copper-${version}-src.tar.gz";
+    sha256 = "1nf0bw143rjhd019yms3k6k531rahl8anidwh6bif0gm7cngfwfw";
+  };
+  buildInputs = [
+    libffi
+  ];
+  postPatch = ''
+    substituteInPlace Makefile --replace "-s scripts/" "scripts/"
+    patchShebangs .
+  '';
+  buildPhase = ''
+    make BACKEND=elf64 boot-elf64
+    make BACKEND=elf64 COPPER=stage3/copper-elf64 copper-elf64
+  '';
+  installPhase = ''
+    make BACKEND=elf64 install prefix=$out
+  '';
+  meta = with stdenv.lib; {
+    description = "Simple imperative language, statically typed with type inference and genericity.";
+    homepage = "https://tibleiz.net/copper/";
+    license = licenses.bsd2;
+    platforms = platforms.x86_64;
+  };
+}
diff --git a/pkgs/development/compilers/kotlin/default.nix b/pkgs/development/compilers/kotlin/default.nix
index 4e2810fa893..88c07fb07ca 100644
--- a/pkgs/development/compilers/kotlin/default.nix
+++ b/pkgs/development/compilers/kotlin/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl, makeWrapper, jre, unzip }:
 
 let
-  version = "1.3.72";
+  version = "1.4.0";
 in stdenv.mkDerivation {
   inherit version;
   pname = "kotlin";
 
   src = fetchurl {
     url = "https://github.com/JetBrains/kotlin/releases/download/v${version}/kotlin-compiler-${version}.zip";
-    sha256 = "0v6c4vjiflwbjjc1lmiyzrilxwbqcz5ll6ls40zhw70zk23xpl6c";
+    sha256 = "0qgiabpkisqjm9iryidrynqy452vzmpgaw54rd9blr9w7g8r20sr";
   };
 
   propagatedBuildInputs = [ jre ] ;
diff --git a/pkgs/development/compilers/llvm/11/bintools.nix b/pkgs/development/compilers/llvm/11/bintools.nix
new file mode 100644
index 00000000000..53f7941e336
--- /dev/null
+++ b/pkgs/development/compilers/llvm/11/bintools.nix
@@ -0,0 +1,29 @@
+{ runCommand, stdenv, llvm, lld, version }:
+
+let
+  prefix =
+    if stdenv.hostPlatform != stdenv.targetPlatform
+    then "${stdenv.targetPlatform.config}-"
+    else "";
+in runCommand "llvm-binutils-${version}" { preferLocalBuild = true; } ''
+   mkdir -p $out/bin
+   for prog in ${lld}/bin/*; do
+     ln -s $prog $out/bin/${prefix}$(basename $prog)
+   done
+   for prog in ${llvm}/bin/*; do
+     ln -sf $prog $out/bin/${prefix}$(basename $prog)
+   done
+
+   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ar
+   ln -s ${llvm}/bin/llvm-as $out/bin/${prefix}as
+   ln -s ${llvm}/bin/llvm-dwp $out/bin/${prefix}dwp
+   ln -s ${llvm}/bin/llvm-nm $out/bin/${prefix}nm
+   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}objcopy
+   ln -s ${llvm}/bin/llvm-objdump $out/bin/${prefix}objdump
+   ln -s ${llvm}/bin/llvm-ranlib $out/bin/${prefix}ranlib
+   ln -s ${llvm}/bin/llvm-readelf $out/bin/${prefix}readelf
+   ln -s ${llvm}/bin/llvm-size $out/bin/${prefix}size
+   ln -s ${llvm}/bin/llvm-strip $out/bin/${prefix}strip
+
+   ln -s ${lld}/bin/lld $out/bin/${prefix}ld
+''
diff --git a/pkgs/development/compilers/llvm/11/clang/default.nix b/pkgs/development/compilers/llvm/11/clang/default.nix
new file mode 100644
index 00000000000..08f9339dc8e
--- /dev/null
+++ b/pkgs/development/compilers/llvm/11/clang/default.nix
@@ -0,0 +1,117 @@
+{ stdenv, fetch, cmake, libxml2, llvm, version, clang-tools-extra_src, python3, lld
+, fixDarwinDylibNames
+, enableManpages ? false
+}:
+
+let
+  self = stdenv.mkDerivation ({
+    pname = "clang";
+    inherit version;
+
+    src = fetch "clang" "18rv5nxk04fgk4ziix7z4s2cargdpqgvqrk3lnp3wvd6yb5g5p98";
+
+    unpackPhase = ''
+      unpackFile $src
+      mv clang-${version}* clang
+      sourceRoot=$PWD/clang
+      unpackFile ${clang-tools-extra_src}
+      mv clang-tools-extra-* $sourceRoot/tools/extra
+    '';
+
+    nativeBuildInputs = [ cmake python3 lld ]
+      ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx;
+
+    buildInputs = [ libxml2 llvm ]
+      ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
+
+    cmakeFlags = [
+      "-DCMAKE_CXX_FLAGS=-std=c++14"
+      "-DCLANGD_BUILD_XPC=OFF"
+    ] ++ stdenv.lib.optionals enableManpages [
+      "-DCLANG_INCLUDE_DOCS=ON"
+      "-DLLVM_ENABLE_SPHINX=ON"
+      "-DSPHINX_OUTPUT_MAN=ON"
+      "-DSPHINX_OUTPUT_HTML=OFF"
+      "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
+    ];
+
+    patches = [
+      ./purity.patch
+      # https://reviews.llvm.org/D51899
+    ];
+
+    postPatch = ''
+      sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' \
+             -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' \
+             lib/Driver/ToolChains/*.cpp
+
+      # Patch for standalone doc building
+      sed -i '1s,^,find_package(Sphinx REQUIRED)\n,' docs/CMakeLists.txt
+    '' + stdenv.lib.optionalString stdenv.hostPlatform.isMusl ''
+      sed -i -e 's/lgcc_s/lgcc_eh/' lib/Driver/ToolChains/*.cpp
+    '' + stdenv.lib.optionalString stdenv.hostPlatform.isDarwin ''
+      substituteInPlace tools/extra/clangd/CMakeLists.txt \
+        --replace "NOT HAVE_CXX_ATOMICS64_WITHOUT_LIB" FALSE
+    '';
+
+    outputs = [ "out" "lib" "python" ];
+
+    # Clang expects to find LLVMgold in its own prefix
+    postInstall = ''
+      if [ -e ${llvm}/lib/LLVMgold.so ]; then
+        ln -sv ${llvm}/lib/LLVMgold.so $out/lib
+      fi
+
+      ln -sv $out/bin/clang $out/bin/cpp
+
+      # Move libclang to 'lib' output
+      moveToOutput "lib/libclang.*" "$lib"
+      moveToOutput "lib/libclang-cpp.*" "$lib"
+      substituteInPlace $out/lib/cmake/clang/ClangTargets-release.cmake \
+          --replace "\''${_IMPORT_PREFIX}/lib/libclang." "$lib/lib/libclang." \
+          --replace "\''${_IMPORT_PREFIX}/lib/libclang-cpp." "$lib/lib/libclang-cpp."
+
+      mkdir -p $python/bin $python/share/clang/
+      mv $out/bin/{git-clang-format,scan-view} $python/bin
+      if [ -e $out/bin/set-xcode-analyzer ]; then
+        mv $out/bin/set-xcode-analyzer $python/bin
+      fi
+      mv $out/share/clang/*.py $python/share/clang
+      rm $out/bin/c-index-test
+    '';
+
+    enableParallelBuilding = true;
+
+    passthru = {
+      isClang = true;
+      inherit llvm;
+    } // stdenv.lib.optionalAttrs (stdenv.targetPlatform.isLinux || (stdenv.cc.isGNU && stdenv.cc.cc ? gcc)) {
+      gcc = if stdenv.cc.isGNU then stdenv.cc.cc else stdenv.cc.cc.gcc;
+    };
+
+    meta = {
+      description = "A c, c++, objective-c, and objective-c++ frontend for the llvm compiler";
+      homepage    = "https://llvm.org/";
+      license     = stdenv.lib.licenses.ncsa;
+      platforms   = stdenv.lib.platforms.all;
+    };
+  } // stdenv.lib.optionalAttrs enableManpages {
+    pname = "clang-manpages";
+
+    buildPhase = ''
+      make docs-clang-man
+    '';
+
+    installPhase = ''
+      mkdir -p $out/share/man/man1
+      # Manually install clang manpage
+      cp docs/man/*.1 $out/share/man/man1/
+    '';
+
+    outputs = [ "out" ];
+
+    doCheck = false;
+
+    meta.description = "man page for Clang ${version}";
+  });
+in self
diff --git a/pkgs/development/compilers/llvm/11/clang/purity.patch b/pkgs/development/compilers/llvm/11/clang/purity.patch
new file mode 100644
index 00000000000..deb230a36c5
--- /dev/null
+++ b/pkgs/development/compilers/llvm/11/clang/purity.patch
@@ -0,0 +1,28 @@
+From 4add81bba40dcec62c4ea4481be8e35ac53e89d8 Mon Sep 17 00:00:00 2001
+From: Will Dietz <w@wdtz.org>
+Date: Thu, 18 May 2017 11:56:12 -0500
+Subject: [PATCH] "purity" patch for 5.0
+
+---
+ lib/Driver/ToolChains/Gnu.cpp | 7 -------
+ 1 file changed, 7 deletions(-)
+
+diff --git a/lib/Driver/ToolChains/Gnu.cpp b/lib/Driver/ToolChains/Gnu.cpp
+index fe3c0191bb..c6a482bece 100644
+--- a/lib/Driver/ToolChains/Gnu.cpp
++++ b/lib/Driver/ToolChains/Gnu.cpp
+@@ -487,12 +487,6 @@ void tools::gnutools::Linker::ConstructJob(Compilation &C, const JobAction &JA,
+   if (!IsStatic) {
+     if (Args.hasArg(options::OPT_rdynamic))
+       CmdArgs.push_back("-export-dynamic");
+-
+-    if (!Args.hasArg(options::OPT_shared) && !IsStaticPIE) {
+-      CmdArgs.push_back("-dynamic-linker");
+-      CmdArgs.push_back(Args.MakeArgString(Twine(D.DyldPrefix) +
+-                                           ToolChain.getDynamicLinker(Args)));
+-    }
+   }
+ 
+   CmdArgs.push_back("-o");
+-- 
+2.11.0
diff --git a/pkgs/development/compilers/llvm/11/compiler-rt-armv7l.patch b/pkgs/development/compilers/llvm/11/compiler-rt-armv7l.patch
new file mode 100644
index 00000000000..120cfe6feb2
--- /dev/null
+++ b/pkgs/development/compilers/llvm/11/compiler-rt-armv7l.patch
@@ -0,0 +1,32 @@
+diff -ur compiler-rt-10.0.0.src/cmake/builtin-config-ix.cmake compiler-rt-10.0.0.src-patched/cmake/builtin-config-ix.cmake
+--- compiler-rt-10.0.0.src/cmake/builtin-config-ix.cmake	2020-03-24 00:01:02.000000000 +0900
++++ compiler-rt-10.0.0.src-patched/cmake/builtin-config-ix.cmake	2020-05-10 03:42:00.883450706 +0900
+@@ -24,7 +24,7 @@
+ 
+ 
+ set(ARM64 aarch64)
+-set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k)
++set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k armv7l)
+ set(HEXAGON hexagon)
+ set(X86 i386)
+ set(X86_64 x86_64)
+diff -ur compiler-rt-10.0.0.src/lib/builtins/CMakeLists.txt compiler-rt-10.0.0.src-patched/lib/builtins/CMakeLists.txt
+--- compiler-rt-10.0.0.src/lib/builtins/CMakeLists.txt	2020-03-24 00:01:02.000000000 +0900
++++ compiler-rt-10.0.0.src-patched/lib/builtins/CMakeLists.txt	2020-05-10 03:44:49.468579650 +0900
+@@ -474,6 +474,7 @@
+ set(armv7_SOURCES ${arm_SOURCES})
+ set(armv7s_SOURCES ${arm_SOURCES})
+ set(armv7k_SOURCES ${arm_SOURCES})
++set(armv7l_SOURCES ${arm_SOURCES})
+ set(arm64_SOURCES ${aarch64_SOURCES})
+ 
+ # macho_embedded archs
+@@ -595,7 +596,7 @@
+   foreach (arch ${BUILTIN_SUPPORTED_ARCH})
+     if (CAN_TARGET_${arch})
+       # For ARM archs, exclude any VFP builtins if VFP is not supported
+-      if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7m|armv7em)$")
++      if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7l|armv7m|armv7em)$")
+         string(REPLACE ";" " " _TARGET_${arch}_CFLAGS "${TARGET_${arch}_CFLAGS}")
+         check_compile_definition(__VFP_FP__ "${CMAKE_C_FLAGS} ${_TARGET_${arch}_CFLAGS}" COMPILER_RT_HAS_${arch}_VFP)
+         if(NOT COMPILER_RT_HAS_${arch}_VFP)
diff --git a/pkgs/development/compilers/llvm/11/compiler-rt-codesign.patch b/pkgs/development/compilers/llvm/11/compiler-rt-codesign.patch
new file mode 100644
index 00000000000..3cc12b94b20
--- /dev/null
+++ b/pkgs/development/compilers/llvm/11/compiler-rt-codesign.patch
@@ -0,0 +1,33 @@
+From 3dec5f3475a26aeb4678627795c4b67c6b7b4785 Mon Sep 17 00:00:00 2001
+From: Will Dietz <w@wdtz.org>
+Date: Tue, 19 Sep 2017 13:13:06 -0500
+Subject: [PATCH] remove codesign use on Apple, disable ios sim testing that
+ needs it
+
+---
+ cmake/Modules/AddCompilerRT.cmake |  8 ------
+ test/asan/CMakeLists.txt          | 52 ---------------------------------------
+ test/tsan/CMakeLists.txt          | 47 -----------------------------------
+ 3 files changed, 107 deletions(-)
+
+diff --git a/cmake/Modules/AddCompilerRT.cmake b/cmake/Modules/AddCompilerRT.cmake
+index bc5fb9ff7..b64eb4246 100644
+--- a/cmake/Modules/AddCompilerRT.cmake
++++ b/cmake/Modules/AddCompilerRT.cmake
+@@ -210,14 +210,6 @@ function(add_compiler_rt_runtime name type)
+         set_target_properties(${libname} PROPERTIES IMPORT_PREFIX "")
+         set_target_properties(${libname} PROPERTIES IMPORT_SUFFIX ".lib")
+       endif()
+-      if(APPLE)
+-        # Ad-hoc sign the dylibs
+-        add_custom_command(TARGET ${libname}
+-          POST_BUILD  
+-          COMMAND codesign --sign - $<TARGET_FILE:${libname}>
+-          WORKING_DIRECTORY ${COMPILER_RT_LIBRARY_OUTPUT_DIR}
+-        )
+-      endif()
+     endif()
+     install(TARGETS ${libname}
+       ARCHIVE DESTINATION ${COMPILER_RT_LIBRARY_INSTALL_DIR}
+2.14.1
+
diff --git a/pkgs/development/compilers/llvm/11/compiler-rt.nix b/pkgs/development/compilers/llvm/11/compiler-rt.nix
new file mode 100644
index 00000000000..133db365942
--- /dev/null
+++ b/pkgs/development/compilers/llvm/11/compiler-rt.nix
@@ -0,0 +1,85 @@
+{ stdenv, version, fetch, cmake, python3, llvm, libcxxabi }:
+
+let
+
+  useLLVM = stdenv.hostPlatform.useLLVM or false;
+  bareMetal = stdenv.hostPlatform.parsed.kernel.name == "none";
+  inherit (stdenv.hostPlatform) isMusl;
+
+in
+
+stdenv.mkDerivation rec {
+  pname = "compiler-rt";
+  inherit version;
+  src = fetch pname "0qfgap6acxffm01hzk38pmzq8ac3isk90531dz0qf7fd5015jvvg";
+
+  nativeBuildInputs = [ cmake python3 llvm ];
+  buildInputs = stdenv.lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
+
+  NIX_CFLAGS_COMPILE = [
+    "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0"
+  ];
+
+  cmakeFlags = [
+    "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
+    "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
+    "-DCMAKE_ASM_COMPILER_TARGET=${stdenv.hostPlatform.config}"
+  ] ++ stdenv.lib.optionals (useLLVM || bareMetal || isMusl) [
+    "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
+    "-DCOMPILER_RT_BUILD_XRAY=OFF"
+    "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
+    "-DCOMPILER_RT_BUILD_PROFILE=OFF"
+  ] ++ stdenv.lib.optionals (useLLVM || bareMetal) [
+    "-DCMAKE_C_COMPILER_WORKS=ON"
+    "-DCMAKE_CXX_COMPILER_WORKS=ON"
+    "-DCOMPILER_RT_BAREMETAL_BUILD=ON"
+    "-DCMAKE_SIZEOF_VOID_P=${toString (stdenv.hostPlatform.parsed.cpu.bits / 8)}"
+  ] ++ stdenv.lib.optionals (useLLVM) [
+    "-DCOMPILER_RT_BUILD_BUILTINS=ON"
+    "-DCMAKE_C_FLAGS=-nodefaultlibs"
+    #https://stackoverflow.com/questions/53633705/cmake-the-c-compiler-is-not-able-to-compile-a-simple-test-program
+    "-DCMAKE_TRY_COMPILE_TARGET_TYPE=STATIC_LIBRARY"
+  ] ++ stdenv.lib.optionals (bareMetal) [
+    "-DCOMPILER_RT_OS_DIR=baremetal"
+  ];
+
+  outputs = [ "out" "dev" ];
+
+  patches = [
+    ./compiler-rt-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
+  ]# ++ stdenv.lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
+    ++ stdenv.lib.optional stdenv.hostPlatform.isAarch32 ./compiler-rt-armv7l.patch;
+
+
+  # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
+  # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
+  # can build this. If we didn't do it, basically the entire nixpkgs on Darwin would have an unfree dependency and we'd
+  # get no binary cache for the entire platform. If you really find yourself wanting the TSAN, make this controllable by
+  # a flag and turn the flag off during the stdenv build.
+  postPatch = stdenv.lib.optionalString (!stdenv.isDarwin) ''
+    substituteInPlace cmake/builtin-config-ix.cmake \
+      --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
+  '' + stdenv.lib.optionalString stdenv.isDarwin ''
+    substituteInPlace cmake/config-ix.cmake \
+      --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
+  '' + stdenv.lib.optionalString (useLLVM) ''
+    substituteInPlace lib/builtins/int_util.c \
+      --replace "#include <stdlib.h>" ""
+    substituteInPlace lib/builtins/clear_cache.c \
+      --replace "#include <assert.h>" ""
+    substituteInPlace lib/builtins/cpu_model.c \
+      --replace "#include <assert.h>" ""
+  '';
+
+  # Hack around weird upsream RPATH bug
+  postInstall = stdenv.lib.optionalString (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isWasm) ''
+    ln -s "$out/lib"/*/* "$out/lib"
+  '' + stdenv.lib.optionalString (useLLVM) ''
+    ln -s $out/lib/*/clang_rt.crtbegin-*.o $out/lib/crtbegin.o
+    ln -s $out/lib/*/clang_rt.crtend-*.o $out/lib/crtend.o
+    ln -s $out/lib/*/clang_rt.crtbegin_shared-*.o $out/lib/crtbeginS.o
+    ln -s $out/lib/*/clang_rt.crtend_shared-*.o $out/lib/crtendS.o
+  '';
+
+  enableParallelBuilding = true;
+}
diff --git a/pkgs/development/compilers/llvm/11/default.nix b/pkgs/development/compilers/llvm/11/default.nix
new file mode 100644
index 00000000000..cbb3df9f687
--- /dev/null
+++ b/pkgs/development/compilers/llvm/11/default.nix
@@ -0,0 +1,195 @@
+{ lowPrio, newScope, pkgs, stdenv, cmake
+, libxml2, python3, isl, fetchurl, overrideCC, wrapCCWith, wrapBintoolsWith
+, buildLlvmTools # tools, but from the previous stage, for cross
+, targetLlvmLibraries # libraries, but from the next stage, for cross
+}:
+
+let
+  release_version = "11.0.0";
+  candidate = "rc2";
+  version = "${release_version}${candidate}"; # differentiating these (variables) is important for RCs
+  targetConfig = stdenv.targetPlatform.config;
+
+  fetch = name: sha256: fetchurl {
+    url = "https://github.com/llvm/llvm-project/releases/download/llvmorg-${release_version}-${candidate}/${name}-${version}.src.tar.xz";
+    inherit sha256;
+  };
+
+  clang-tools-extra_src = fetch "clang-tools-extra" "0bg2a9nmkdbj5qfd0vvqj8bgchcx1yzmylxxgvh8y5hhj4fz13fs";
+
+  tools = stdenv.lib.makeExtensible (tools: let
+    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
+    mkExtraBuildCommands = cc: ''
+      rsrc="$out/resource-root"
+      mkdir "$rsrc"
+      ln -s "${cc}/lib/clang/${release_version}/include" "$rsrc"
+      ln -s "${targetLlvmLibraries.compiler-rt.out}/lib" "$rsrc/lib"
+      echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
+    '' + stdenv.lib.optionalString (stdenv.targetPlatform.isLinux && tools.clang-unwrapped ? gcc && !(stdenv.targetPlatform.useLLVM or false)) ''
+      echo "--gcc-toolchain=${tools.clang-unwrapped.gcc}" >> $out/nix-support/cc-cflags
+    '';
+  in {
+
+    llvm = callPackage ./llvm.nix { };
+
+    clang-unwrapped = callPackage ./clang {
+      inherit (tools) lld;
+      inherit clang-tools-extra_src;
+    };
+
+    # disabled until recommonmark supports sphinx 3
+    #Llvm-manpages = lowPrio (tools.llvm.override {
+    #  enableManpages = true;
+    #  python3 = pkgs.python3;  # don't use python-boot
+    #});
+
+    clang-manpages = lowPrio (tools.clang-unwrapped.override {
+      enableManpages = true;
+      python3 = pkgs.python3;  # don't use python-boot
+    });
+
+    # disabled until recommonmark supports sphinx 3
+    # lldb-manpages = lowPrio (tools.lldb.override {
+    #   enableManpages = true;
+    #   python3 = pkgs.python3;  # don't use python-boot
+    # });
+
+    libclang = tools.clang-unwrapped.lib;
+
+    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+
+    libstdcxxClang = wrapCCWith rec {
+      cc = tools.clang-unwrapped;
+      libcxx = null; # libstdcxx is smuggled in with clang.gcc
+      extraPackages = [
+        targetLlvmLibraries.compiler-rt
+      ];
+      extraBuildCommands = mkExtraBuildCommands cc;
+    };
+
+    libcxxClang = wrapCCWith rec {
+      cc = tools.clang-unwrapped;
+      libcxx = targetLlvmLibraries.libcxx;
+      extraPackages = [
+        targetLlvmLibraries.libcxxabi
+        targetLlvmLibraries.compiler-rt
+      ];
+      extraBuildCommands = mkExtraBuildCommands cc;
+    };
+
+    lld = callPackage ./lld.nix {};
+
+    lldb = callPackage ./lldb.nix {};
+
+    # Below, is the LLVM bootstrapping logic. It handles building a
+    # fully LLVM toolchain from scratch. No GCC toolchain should be
+    # pulled in. As a consequence, it is very quick to build different
+    # targets provided by LLVM and we can also build for what GCC
+    # doesn’t support like LLVM. Probably we should move to some other
+    # file.
+
+    bintools = callPackage ./bintools.nix {};
+
+    lldClang = wrapCCWith rec {
+      cc = tools.clang-unwrapped;
+      libcxx = targetLlvmLibraries.libcxx;
+      bintools = wrapBintoolsWith {
+        inherit (tools) bintools;
+      };
+      extraPackages = [
+        targetLlvmLibraries.libcxxabi
+        targetLlvmLibraries.compiler-rt
+      ] ++ stdenv.lib.optionals (!stdenv.targetPlatform.isWasm) [
+        targetLlvmLibraries.libunwind
+      ];
+      extraBuildCommands = ''
+        echo "-rtlib=compiler-rt -Wno-unused-command-line-argument" >> $out/nix-support/cc-cflags
+        echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
+      '' + stdenv.lib.optionalString (!stdenv.targetPlatform.isWasm) ''
+        echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
+      '' + stdenv.lib.optionalString stdenv.targetPlatform.isWasm ''
+        echo "-fno-exceptions" >> $out/nix-support/cc-cflags
+      '' + mkExtraBuildCommands cc;
+    };
+
+    lldClangNoLibcxx = wrapCCWith rec {
+      cc = tools.clang-unwrapped;
+      libcxx = null;
+      bintools = wrapBintoolsWith {
+        inherit (tools) bintools;
+      };
+      extraPackages = [
+        targetLlvmLibraries.compiler-rt
+      ];
+      extraBuildCommands = ''
+        echo "-rtlib=compiler-rt" >> $out/nix-support/cc-cflags
+        echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
+        echo "-nostdlib++" >> $out/nix-support/cc-cflags
+      '' + mkExtraBuildCommands cc;
+    };
+
+    lldClangNoLibc = wrapCCWith rec {
+      cc = tools.clang-unwrapped;
+      libcxx = null;
+      bintools = wrapBintoolsWith {
+        inherit (tools) bintools;
+        libc = null;
+      };
+      extraPackages = [
+        targetLlvmLibraries.compiler-rt
+      ];
+      extraBuildCommands = ''
+        echo "-rtlib=compiler-rt" >> $out/nix-support/cc-cflags
+        echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
+      '' + mkExtraBuildCommands cc;
+    };
+
+    lldClangNoCompilerRt = wrapCCWith {
+      cc = tools.clang-unwrapped;
+      libcxx = null;
+      bintools = wrapBintoolsWith {
+        inherit (tools) bintools;
+        libc = null;
+      };
+      extraPackages = [ ];
+      extraBuildCommands = ''
+        echo "-nostartfiles" >> $out/nix-support/cc-cflags
+      '';
+    };
+
+  });
+
+  libraries = stdenv.lib.makeExtensible (libraries: let
+    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
+  in {
+
+    compiler-rt = callPackage ./compiler-rt.nix ({} //
+      (stdenv.lib.optionalAttrs (stdenv.hostPlatform.useLLVM or false) {
+        stdenv = overrideCC stdenv buildLlvmTools.lldClangNoCompilerRt;
+      }));
+
+    stdenv = overrideCC stdenv buildLlvmTools.clang;
+
+    libcxxStdenv = overrideCC stdenv buildLlvmTools.libcxxClang;
+
+    libcxx = callPackage ./libc++ ({} //
+      (stdenv.lib.optionalAttrs (stdenv.hostPlatform.useLLVM or false) {
+        stdenv = overrideCC stdenv buildLlvmTools.lldClangNoLibcxx;
+      }));
+
+    libcxxabi = callPackage ./libc++abi.nix ({} //
+      (stdenv.lib.optionalAttrs (stdenv.hostPlatform.useLLVM or false) {
+        stdenv = overrideCC stdenv buildLlvmTools.lldClangNoLibcxx;
+        libunwind = libraries.libunwind;
+      }));
+
+    openmp = callPackage ./openmp.nix {};
+
+    libunwind = callPackage ./libunwind.nix ({} //
+      (stdenv.lib.optionalAttrs (stdenv.hostPlatform.useLLVM or false) {
+        stdenv = overrideCC stdenv buildLlvmTools.lldClangNoLibcxx;
+      }));
+
+  });
+
+in { inherit tools libraries; } // libraries // tools
diff --git a/pkgs/development/compilers/llvm/11/libc++/default.nix b/pkgs/development/compilers/llvm/11/libc++/default.nix
new file mode 100644
index 00000000000..a2ea7e29918
--- /dev/null
+++ b/pkgs/development/compilers/llvm/11/libc++/default.nix
@@ -0,0 +1,52 @@
+{ lib, stdenv, fetch, cmake, python3, libcxxabi, fixDarwinDylibNames, version
+, enableShared ? true }:
+
+stdenv.mkDerivation {
+  pname = "libc++";
+  inherit version;
+
+  src = fetch "libcxx" "0aaci7iblfczv1jb22zjrwzxcrcx6x7klvjivmxm2zni0n2x3bd4";
+
+  postUnpack = ''
+    unpackFile ${libcxxabi.src}
+    export LIBCXXABI_INCLUDE_DIR="$PWD/$(ls -d libcxxabi-${version}*)/include"
+  '';
+
+  patches = stdenv.lib.optional stdenv.hostPlatform.isMusl ../../libcxx-0001-musl-hacks.patch;
+
+  preConfigure = ''
+    # Get headers from the cxxabi source so we can see private headers not installed by the cxxabi package
+    cmakeFlagsArray=($cmakeFlagsArray -DLIBCXX_CXX_ABI_INCLUDE_PATHS="$LIBCXXABI_INCLUDE_DIR")
+  '' + lib.optionalString stdenv.hostPlatform.isMusl ''
+    patchShebangs utils/cat_files.py
+  '';
+  nativeBuildInputs = [ cmake ]
+    ++ stdenv.lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) python3;
+
+  buildInputs = [ libcxxabi ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
+
+  cmakeFlags = [
+    "-DLIBCXX_LIBCXXABI_LIB_PATH=${libcxxabi}/lib"
+    "-DLIBCXX_LIBCPPABI_VERSION=2"
+    "-DLIBCXX_CXX_ABI=libcxxabi"
+  ] ++ stdenv.lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
+    ++ stdenv.lib.optional (stdenv.hostPlatform.useLLVM or false) "-DLIBCXX_USE_COMPILER_RT=ON"
+    ++ stdenv.lib.optional stdenv.hostPlatform.isWasm [
+      "-DLIBCXX_ENABLE_THREADS=OFF"
+      "-DLIBCXX_ENABLE_FILESYSTEM=OFF"
+      "-DLIBCXX_ENABLE_EXCEPTIONS=OFF"
+    ] ++ stdenv.lib.optional (!enableShared) "-DLIBCXX_ENABLE_SHARED=OFF";
+
+  enableParallelBuilding = true;
+
+  passthru = {
+    isLLVM = true;
+  };
+
+  meta = {
+    homepage = "https://libcxx.llvm.org/";
+    description = "A new implementation of the C++ standard library, targeting C++11";
+    license = with stdenv.lib.licenses; [ ncsa mit ];
+    platforms = stdenv.lib.platforms.all;
+  };
+}
diff --git a/pkgs/development/compilers/llvm/11/libc++abi.nix b/pkgs/development/compilers/llvm/11/libc++abi.nix
new file mode 100644
index 00000000000..bf7b3fd001d
--- /dev/null
+++ b/pkgs/development/compilers/llvm/11/libc++abi.nix
@@ -0,0 +1,67 @@
+{ stdenv, cmake, fetch, libcxx, libunwind, llvm, version
+, enableShared ? true }:
+
+stdenv.mkDerivation {
+  pname = "libc++abi";
+  inherit version;
+
+  src = fetch "libcxxabi" "04gqdzs13sw7f7a06h5zm5917d9f1k79l4rcm096grgvf0r7lnqx";
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = stdenv.lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD && !stdenv.hostPlatform.isWasm) libunwind;
+
+  cmakeFlags = stdenv.lib.optionals (stdenv.hostPlatform.useLLVM or false) [
+    "-DLLVM_ENABLE_LIBCXX=ON"
+    "-DLIBCXXABI_USE_LLVM_UNWINDER=ON"
+  ] ++ stdenv.lib.optionals stdenv.hostPlatform.isWasm [
+    "-DLIBCXXABI_ENABLE_THREADS=OFF"
+    "-DLIBCXXABI_ENABLE_EXCEPTIONS=OFF"
+  ] ++ stdenv.lib.optionals (!enableShared) [
+    "-DLIBCXXABI_ENABLE_SHARED=OFF"
+  ];
+
+  patches = [ ./libcxxabi-no-threads.patch ];
+
+  postUnpack = ''
+    unpackFile ${libcxx.src}
+    unpackFile ${llvm.src}
+    cmakeFlags+=" -DLLVM_PATH=$PWD/$(ls -d llvm-*) -DLIBCXXABI_LIBCXX_PATH=$PWD/$(ls -d libcxx-*)"
+  '' + stdenv.lib.optionalString stdenv.isDarwin ''
+    export TRIPLE=x86_64-apple-darwin
+  '' + stdenv.lib.optionalString stdenv.hostPlatform.isMusl ''
+    patch -p1 -d $(ls -d libcxx-*) -i ${../libcxx-0001-musl-hacks.patch}
+  '' + stdenv.lib.optionalString stdenv.hostPlatform.isWasm ''
+    patch -p1 -d $(ls -d llvm-*) -i ${./libcxxabi-wasm.patch}
+  '';
+
+  installPhase = if stdenv.isDarwin
+    then ''
+      for file in lib/*.dylib; do
+        # this should be done in CMake, but having trouble figuring out
+        # the magic combination of necessary CMake variables
+        # if you fancy a try, take a look at
+        # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
+        install_name_tool -id $out/$file $file
+      done
+      make install
+      install -d 755 $out/include
+      install -m 644 ../include/*.h $out/include
+    ''
+    else ''
+      install -d -m 755 $out/include $out/lib
+      install -m 644 lib/libc++abi.a $out/lib
+      install -m 644 ../include/cxxabi.h $out/include
+    '' + stdenv.lib.optionalString enableShared ''
+      install -m 644 lib/libc++abi.so.1.0 $out/lib
+      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so
+      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so.1
+    '';
+
+  meta = {
+    homepage = "https://libcxxabi.llvm.org/";
+    description = "A new implementation of low level support for a standard C++ library";
+    license = with stdenv.lib.licenses; [ ncsa mit ];
+    maintainers = with stdenv.lib.maintainers; [ vlstill ];
+    platforms = stdenv.lib.platforms.all;
+  };
+}
diff --git a/pkgs/development/compilers/llvm/11/libcxxabi-no-threads.patch b/pkgs/development/compilers/llvm/11/libcxxabi-no-threads.patch
new file mode 100644
index 00000000000..787f3e16500
--- /dev/null
+++ b/pkgs/development/compilers/llvm/11/libcxxabi-no-threads.patch
@@ -0,0 +1,12 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 4138acf..41b4763 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -362,6 +362,7 @@ if (NOT LIBCXXABI_ENABLE_THREADS)
+                         " is also set to ON.")
+   endif()
+   add_definitions(-D_LIBCXXABI_HAS_NO_THREADS)
++  add_definitions(-D_LIBCPP_HAS_NO_THREADS)
+ endif()
+ 
+ if (LIBCXXABI_HAS_EXTERNAL_THREAD_API)
diff --git a/pkgs/development/compilers/llvm/11/libcxxabi-wasm.patch b/pkgs/development/compilers/llvm/11/libcxxabi-wasm.patch
new file mode 100644
index 00000000000..4ebfe46aa81
--- /dev/null
+++ b/pkgs/development/compilers/llvm/11/libcxxabi-wasm.patch
@@ -0,0 +1,16 @@
+diff --git a/cmake/modules/HandleLLVMOptions.cmake b/cmake/modules/HandleLLVMOptions.cmake
+index 15497d405e0..33f7f18193a 100644
+--- a/cmake/modules/HandleLLVMOptions.cmake
++++ b/cmake/modules/HandleLLVMOptions.cmake
+@@ -127,7 +127,10 @@ else(WIN32)
+       set(LLVM_HAVE_LINK_VERSION_SCRIPT 1)
+     endif()
+   else(FUCHSIA OR UNIX)
+-    MESSAGE(SEND_ERROR "Unable to determine platform")
++    if(${CMAKE_SYSTEM_NAME} MATCHES "Wasi")
++    else()
++      MESSAGE(SEND_ERROR "Unable to determine platform")
++    endif()
+   endif(FUCHSIA OR UNIX)
+ endif(WIN32)
+ 
diff --git a/pkgs/development/compilers/llvm/11/libunwind.nix b/pkgs/development/compilers/llvm/11/libunwind.nix
new file mode 100644
index 00000000000..03b58ca8d1d
--- /dev/null
+++ b/pkgs/development/compilers/llvm/11/libunwind.nix
@@ -0,0 +1,14 @@
+{ stdenv, version, fetch, cmake, fetchpatch, enableShared ? true }:
+
+stdenv.mkDerivation rec {
+  pname = "libunwind";
+  inherit version;
+
+  src = fetch pname "1ch4a2yp821lgzxh9898f7nw2fnkrn3wh25sqg05hlks45znv30y";
+
+  nativeBuildInputs = [ cmake ];
+
+  enableParallelBuilding = true;
+
+  cmakeFlags = stdenv.lib.optional (!enableShared) "-DLIBUNWIND_ENABLE_SHARED=OFF";
+}
diff --git a/pkgs/development/compilers/llvm/11/lld.nix b/pkgs/development/compilers/llvm/11/lld.nix
new file mode 100644
index 00000000000..74d18a444fc
--- /dev/null
+++ b/pkgs/development/compilers/llvm/11/lld.nix
@@ -0,0 +1,33 @@
+{ stdenv
+, fetch
+, cmake
+, libxml2
+, llvm
+, version
+}:
+
+stdenv.mkDerivation rec {
+  pname = "lld";
+  inherit version;
+
+  src = fetch pname "0lqz5cfids0rrl02p0qq5s18p8ikaa9r5gwa2yvj3bismdhvmar8";
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ llvm libxml2 ];
+
+  outputs = [ "out" "dev" ];
+
+  enableParallelBuilding = true;
+
+  postInstall = ''
+    moveToOutput include "$dev"
+    moveToOutput lib "$dev"
+  '';
+
+  meta = {
+    description = "The LLVM Linker";
+    homepage    = "https://lld.llvm.org/";
+    license     = stdenv.lib.licenses.ncsa;
+    platforms   = stdenv.lib.platforms.all;
+  };
+}
diff --git a/pkgs/development/compilers/llvm/11/lldb-procfs.patch b/pkgs/development/compilers/llvm/11/lldb-procfs.patch
new file mode 100644
index 00000000000..b075dbaeee0
--- /dev/null
+++ b/pkgs/development/compilers/llvm/11/lldb-procfs.patch
@@ -0,0 +1,31 @@
+--- a/source/Plugins/Process/Linux/Procfs.h
++++ b/source/Plugins/Process/Linux/Procfs.h
+@@ -11,21 +11,12 @@
+ // sys/procfs.h on Android/Linux for all supported architectures.
+ 
+ #include <sys/ptrace.h>
++#include <asm/ptrace.h>
+ 
+-#ifdef __ANDROID__
+-#if defined(__arm64__) || defined(__aarch64__)
+-typedef unsigned long elf_greg_t;
+-typedef elf_greg_t
+-    elf_gregset_t[(sizeof(struct user_pt_regs) / sizeof(elf_greg_t))];
+-typedef struct user_fpsimd_state elf_fpregset_t;
+-#ifndef NT_FPREGSET
+-#define NT_FPREGSET NT_PRFPREG
+-#endif // NT_FPREGSET
+-#elif defined(__mips__)
+-#ifndef NT_FPREGSET
+-#define NT_FPREGSET NT_PRFPREG
+-#endif // NT_FPREGSET
+-#endif
+-#else // __ANDROID__
++#if !defined(__GLIBC__) && defined(__powerpc__)
++#define pt_regs musl_pt_regs
++#include <sys/procfs.h>
++#undef pt_regs
++#else
+ #include <sys/procfs.h>
+-#endif // __ANDROID__
++#endif
diff --git a/pkgs/development/compilers/llvm/11/lldb.nix b/pkgs/development/compilers/llvm/11/lldb.nix
new file mode 100644
index 00000000000..c0b7f267f75
--- /dev/null
+++ b/pkgs/development/compilers/llvm/11/lldb.nix
@@ -0,0 +1,101 @@
+{ stdenv
+, fetch
+, cmake
+, zlib
+, ncurses
+, swig
+, which
+, libedit
+, libxml2
+, llvm
+, clang-unwrapped
+, python3
+, version
+, darwin
+, lit
+, enableManpages ? false
+}:
+
+stdenv.mkDerivation (rec {
+  pname = "lldb";
+  inherit version;
+
+  src = fetch pname "0hb582kvhxp3kcckz7imrihs0kszdaz09z22xfymyi4vgmcy62q3";
+
+  patches = [ ./lldb-procfs.patch ];
+
+  nativeBuildInputs = [ cmake python3 which swig lit ]
+    ++ stdenv.lib.optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
+
+  buildInputs = [
+    ncurses
+    zlib
+    libedit
+    libxml2
+    llvm
+  ]
+  ++ stdenv.lib.optionals stdenv.isDarwin [
+    darwin.libobjc
+    darwin.apple_sdk.libs.xpc
+    darwin.apple_sdk.frameworks.Foundation
+    darwin.bootstrap_cmds
+    darwin.apple_sdk.frameworks.Carbon
+    darwin.apple_sdk.frameworks.Cocoa
+  ];
+
+  CXXFLAGS = "-fno-rtti";
+  hardeningDisable = [ "format" ];
+
+  cmakeFlags = [
+    "-DLLDB_CODESIGN_IDENTITY=" # codesigning makes nondeterministic
+    "-DClang_DIR=${clang-unwrapped}/lib/cmake"
+    "-DLLVM_EXTERNAL_LIT=${lit}/bin/lit"
+  ] ++ stdenv.lib.optionals stdenv.isDarwin [
+    "-DLLDB_USE_SYSTEM_DEBUGSERVER=ON"
+  ] ++ stdenv.lib.optionals enableManpages [
+    "-DLLVM_ENABLE_SPHINX=ON"
+    "-DSPHINX_OUTPUT_MAN=ON"
+    "-DSPHINX_OUTPUT_HTML=OFF"
+  ]
+;
+
+  enableParallelBuilding = true;
+
+  postInstall = ''
+    # Editor support
+    # vscode:
+    install -D ../tools/lldb-vscode/package.json $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/package.json
+    mkdir -p $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/bin
+    ln -s $out/bin/lldb-vscode $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A next-generation high-performance debugger";
+    homepage = "https://lldb.llvm.org";
+    license = licenses.ncsa;
+    platforms = platforms.all;
+  };
+} // stdenv.lib.optionalAttrs enableManpages {
+  pname = "lldb-manpages";
+
+  buildPhase = ''
+    make docs-lldb-man
+  '';
+
+  propagatedBuildInputs = [];
+
+  installPhase = ''
+    # manually install lldb man page
+    mkdir -p $out/share/man/man1
+    install docs/man/lldb.1 -t $out/share/man/man1/
+  '';
+
+  postPatch = null;
+  postInstall = null;
+
+  outputs = [ "out" ];
+
+  doCheck = false;
+
+  meta.description = "man pages for LLDB ${version}";
+})
diff --git a/pkgs/development/compilers/llvm/11/llvm-outputs.patch b/pkgs/development/compilers/llvm/11/llvm-outputs.patch
new file mode 100644
index 00000000000..40096fa3497
--- /dev/null
+++ b/pkgs/development/compilers/llvm/11/llvm-outputs.patch
@@ -0,0 +1,26 @@
+diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
+index 94d426b..37f7794 100644
+--- a/tools/llvm-config/llvm-config.cpp
++++ b/tools/llvm-config/llvm-config.cpp
+@@ -333,6 +333,21 @@ int main(int argc, char **argv) {
+     ActiveIncludeOption = "-I" + ActiveIncludeDir;
+   }
+ 
++  /// Nix-specific multiple-output handling: override ActiveLibDir if --link-shared
++  if (!IsInDevelopmentTree) {
++    bool WantShared = true;
++    for (int i = 1; i < argc; ++i) {
++      StringRef Arg = argv[i];
++      if (Arg == "--link-shared")
++        WantShared = true;
++      else if (Arg == "--link-static")
++        WantShared = false; // the last one wins
++    }
++
++    if (WantShared)
++      ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
++  }
++
+   /// We only use `shared library` mode in cases where the static library form
+   /// of the components provided are not available; note however that this is
+   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/pkgs/development/compilers/llvm/11/llvm.nix b/pkgs/development/compilers/llvm/11/llvm.nix
new file mode 100644
index 00000000000..9cd0da4f4f9
--- /dev/null
+++ b/pkgs/development/compilers/llvm/11/llvm.nix
@@ -0,0 +1,187 @@
+{ stdenv
+, fetch
+, cmake
+, python3
+, libffi
+, libbfd
+, libpfm
+, libxml2
+, ncurses
+, version
+, release_version
+, zlib
+, buildPackages
+, debugVersion ? false
+, enableManpages ? false
+, enableSharedLibraries ? true
+, enablePFM ? !(stdenv.isDarwin
+  || stdenv.isAarch64 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
+  || stdenv.isAarch32 # broken for the armv7l builder
+)
+, enablePolly ? false
+}:
+
+let
+  inherit (stdenv.lib) optional optionals optionalString;
+
+  # Used when creating a version-suffixed symlink of libLLVM.dylib
+  shortVersion = with stdenv.lib;
+    concatStringsSep "." (take 1 (splitString "." release_version));
+
+in stdenv.mkDerivation (rec {
+  pname = "llvm";
+  inherit version;
+
+  src = fetch pname "151c7nphn18dcw04yxyp6qdj8w19psb8nigf26djf7rhpi1fn0sh";
+  polly_src = fetch "polly" "0caxfpaxhf38nam4gkb9xqlrw20v29cm8jf95ykkbngqw64rmgij";
+
+  unpackPhase = ''
+    unpackFile $src
+    mv llvm-${version}* llvm
+    sourceRoot=$PWD/llvm
+  '' + optionalString enablePolly ''
+    unpackFile $polly_src
+    mv polly-* $sourceRoot/tools/polly
+  '';
+
+  outputs = [ "out" "python" ]
+    ++ optional enableSharedLibraries "lib";
+
+  nativeBuildInputs = [ cmake python3 ]
+    ++ optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
+
+  buildInputs = [ libxml2 libffi ]
+    ++ optional enablePFM libpfm; # exegesis
+
+  propagatedBuildInputs = [ ncurses zlib ];
+
+  postPatch = optionalString stdenv.isDarwin ''
+    substituteInPlace cmake/modules/AddLLVM.cmake \
+      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
+      --replace 'set(_install_rpath "@loader_path/../lib''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
+  ''
+  # Patch llvm-config to return correct library path based on --link-{shared,static}.
+  + optionalString (enableSharedLibraries) ''
+    substitute '${./llvm-outputs.patch}' ./llvm-outputs.patch --subst-var lib
+    patch -p1 < ./llvm-outputs.patch
+  '' + ''
+    # FileSystem permissions tests fail with various special bits
+    substituteInPlace unittests/Support/CMakeLists.txt \
+      --replace "Path.cpp" ""
+    rm unittests/Support/Path.cpp
+  '' + optionalString stdenv.hostPlatform.isMusl ''
+    patch -p1 -i ${../TLI-musl.patch}
+    substituteInPlace unittests/Support/CMakeLists.txt \
+      --replace "add_subdirectory(DynamicLibrary)" ""
+    rm unittests/Support/DynamicLibrary/DynamicLibraryTest.cpp
+    # valgrind unhappy with musl or glibc, but fails w/musl only
+    rm test/CodeGen/AArch64/wineh4.mir
+  '' + optionalString stdenv.hostPlatform.isAarch32 ''
+    # skip failing X86 test cases on 32-bit ARM
+    rm test/DebugInfo/X86/convert-debugloc.ll
+    rm test/DebugInfo/X86/convert-inlined.ll
+    rm test/DebugInfo/X86/convert-linked.ll
+    rm test/tools/dsymutil/X86/op-convert.test
+  '' + optionalString (stdenv.hostPlatform.system == "armv6l-linux") ''
+    # Seems to require certain floating point hardware (NEON?)
+    rm test/ExecutionEngine/frem.ll
+  '' + ''
+    patchShebangs test/BugPoint/compile-custom.ll.py
+  '';
+
+  # hacky fix: created binaries need to be run before installation
+  preBuild = ''
+    mkdir -p $out/
+    ln -sv $PWD/lib $out
+  '';
+
+  cmakeFlags = with stdenv; [
+    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
+    "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
+    "-DLLVM_BUILD_TESTS=ON"
+    "-DLLVM_ENABLE_FFI=ON"
+    "-DLLVM_ENABLE_RTTI=ON"
+    "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
+    "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
+    "-DLLVM_ENABLE_DUMP=ON"
+  ] ++ optionals enableSharedLibraries [
+    "-DLLVM_LINK_LLVM_DYLIB=ON"
+  ] ++ optionals enableManpages [
+    "-DLLVM_BUILD_DOCS=ON"
+    "-DLLVM_ENABLE_SPHINX=ON"
+    "-DSPHINX_OUTPUT_MAN=ON"
+    "-DSPHINX_OUTPUT_HTML=OFF"
+    "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
+  ] ++ optionals (!isDarwin) [
+    "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
+  ] ++ optionals isDarwin [
+    "-DLLVM_ENABLE_LIBCXX=ON"
+    "-DCAN_TARGET_i386=false"
+  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "-DCMAKE_CROSSCOMPILING=True"
+    "-DLLVM_TABLEGEN=${buildPackages.llvm_10}/bin/llvm-tblgen"
+  ];
+
+  postBuild = ''
+    rm -fR $out
+  '';
+
+  preCheck = ''
+    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib
+  '';
+
+  postInstall = ''
+    mkdir -p $python/share
+    mv $out/share/opt-viewer $python/share/opt-viewer
+  ''
+  + optionalString enableSharedLibraries ''
+    moveToOutput "lib/libLLVM-*" "$lib"
+    moveToOutput "lib/libLLVM${stdenv.hostPlatform.extensions.sharedLibrary}" "$lib"
+  ''
+  + optionalString (enableSharedLibraries && (!stdenv.isDarwin)) ''
+    substituteInPlace "$out/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
+      --replace "\''${_IMPORT_PREFIX}/lib/libLLVM-" "$lib/lib/libLLVM-"
+  ''
+  + optionalString (stdenv.isDarwin && enableSharedLibraries) ''
+    substituteInPlace "$out/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
+      --replace "\''${_IMPORT_PREFIX}/lib/libLLVM.dylib" "$lib/lib/libLLVM.dylib"
+    ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
+    ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
+  '';
+
+  doCheck = stdenv.isLinux && (!stdenv.isx86_32);
+
+  checkTarget = "check-all";
+
+  enableParallelBuilding = true;
+
+  requiredSystemFeatures = [ "big-parallel" ];
+  meta = {
+    description = "Collection of modular and reusable compiler and toolchain technologies";
+    homepage    = "https://llvm.org/";
+    license     = stdenv.lib.licenses.ncsa;
+    maintainers = with stdenv.lib.maintainers; [ lovek323 raskin dtzWill ];
+    platforms   = stdenv.lib.platforms.all;
+  };
+} // stdenv.lib.optionalAttrs enableManpages {
+  pname = "llvm-manpages";
+
+  buildPhase = ''
+    make docs-llvm-man
+  '';
+
+  propagatedBuildInputs = [];
+
+  installPhase = ''
+    make -C docs install
+  '';
+
+  postPatch = null;
+  postInstall = null;
+
+  outputs = [ "out" ];
+
+  doCheck = false;
+
+  meta.description = "man pages for LLVM ${version}";
+})
diff --git a/pkgs/development/compilers/llvm/11/openmp.nix b/pkgs/development/compilers/llvm/11/openmp.nix
new file mode 100644
index 00000000000..f4f9bbf2292
--- /dev/null
+++ b/pkgs/development/compilers/llvm/11/openmp.nix
@@ -0,0 +1,26 @@
+{ stdenv
+, fetch
+, cmake
+, llvm
+, perl
+, version
+}:
+
+stdenv.mkDerivation rec {
+  pname = "openmp";
+  inherit version;
+
+  src = fetch pname "1025dwn68iw664df831zbkxy8bxilvjkbc6mw4nhv6p5ff7dcw7f";
+
+  nativeBuildInputs = [ cmake perl ];
+  buildInputs = [ llvm ];
+
+  enableParallelBuilding = true;
+
+  meta = {
+    description = "Components required to build an executable OpenMP program";
+    homepage    = "https://openmp.llvm.org/";
+    license     = stdenv.lib.licenses.mit;
+    platforms   = stdenv.lib.platforms.all;
+  };
+}
diff --git a/pkgs/development/compilers/llvm/11/sanitizers-nongnu.patch b/pkgs/development/compilers/llvm/11/sanitizers-nongnu.patch
new file mode 100644
index 00000000000..1f2ac97818e
--- /dev/null
+++ b/pkgs/development/compilers/llvm/11/sanitizers-nongnu.patch
@@ -0,0 +1,412 @@
+From f7a253f8f85d0f49df6b73996737a3e84ac64236 Mon Sep 17 00:00:00 2001
+From: Will Dietz <w@wdtz.org>
+Date: Mon, 24 Sep 2018 11:17:25 -0500
+Subject: [PATCH] Ported to 7.0, taken from gentoo-musl project.
+
+------
+Ported to compiler-rt-sanitizers-5.0.0. Taken from
+
+https://gist.githubusercontent.com/pwaller/2337f3290f12634cad3e3730cff0a6c1/raw/83c87a8585e2f9662494db5662e5361beb093c26/nongnu.patch
+Signed-off-by: Jory A. Pratt <anarchy@gentoo.org>
+
+Taken from gentoo-musl project, with a few additional minor fixes.
+---
+ lib/asan/asan_linux.cc                        |  4 +-
+ lib/interception/interception_linux.cc        |  2 +-
+ lib/interception/interception_linux.h         |  2 +-
+ lib/msan/msan_linux.cc                        |  2 +-
+ lib/sanitizer_common/sanitizer_allocator.cc   |  2 +-
+ .../sanitizer_common_interceptors_ioctl.inc   |  4 +-
+ .../sanitizer_common_syscalls.inc             |  2 +-
+ lib/sanitizer_common/sanitizer_linux.cc       |  8 +++-
+ .../sanitizer_linux_libcdep.cc                | 10 ++---
+ lib/sanitizer_common/sanitizer_platform.h     |  6 +++
+ .../sanitizer_platform_interceptors.h         |  4 +-
+ .../sanitizer_platform_limits_posix.cc        | 37 +++++++++++--------
+ lib/tsan/rtl/tsan_platform_linux.cc           |  2 +-
+ 13 files changed, 51 insertions(+), 34 deletions(-)
+
+diff --git a/lib/asan/asan_linux.cc b/lib/asan/asan_linux.cc
+index 625f32d40..73cf77aca 100644
+--- a/lib/asan/asan_linux.cc
++++ b/lib/asan/asan_linux.cc
+@@ -46,7 +46,7 @@
+ #include <link.h>
+ #endif
+ 
+-#if SANITIZER_ANDROID || SANITIZER_FREEBSD || SANITIZER_SOLARIS
++#if SANITIZER_ANDROID || SANITIZER_FREEBSD || SANITIZER_SOLARIS || SANITIZER_NONGNU
+ #include <ucontext.h>
+ extern "C" void* _DYNAMIC;
+ #elif SANITIZER_NETBSD
+@@ -139,7 +139,7 @@ void AsanApplyToGlobals(globals_op_fptr op, const void *needle) {
+   UNIMPLEMENTED();
+ }
+ 
+-#if SANITIZER_ANDROID
++#if SANITIZER_ANDROID || SANITIZER_NONGNU
+ // FIXME: should we do anything for Android?
+ void AsanCheckDynamicRTPrereqs() {}
+ void AsanCheckIncompatibleRT() {}
+diff --git a/lib/interception/interception_linux.cc b/lib/interception/interception_linux.cc
+index 26bfcd8f6..529b234f7 100644
+--- a/lib/interception/interception_linux.cc
++++ b/lib/interception/interception_linux.cc
+@@ -43,7 +43,7 @@ bool GetRealFunctionAddress(const char *func_name, uptr *func_addr,
+ }
+ 
+ // Android and Solaris do not have dlvsym
+-#if !SANITIZER_ANDROID && !SANITIZER_SOLARIS && !SANITIZER_OPENBSD
++#if !SANITIZER_ANDROID && !SANITIZER_SOLARIS && !SANITIZER_OPENBSD && !SANITIZER_NONGNU
+ void *GetFuncAddrVer(const char *func_name, const char *ver) {
+   return dlvsym(RTLD_NEXT, func_name, ver);
+ }
+diff --git a/lib/interception/interception_linux.h b/lib/interception/interception_linux.h
+index 942c25609..24a4d5080 100644
+--- a/lib/interception/interception_linux.h
++++ b/lib/interception/interception_linux.h
+@@ -36,7 +36,7 @@ void *GetFuncAddrVer(const char *func_name, const char *ver);
+       (::__interception::uptr) & WRAP(func))
+ 
+ // Android,  Solaris and OpenBSD do not have dlvsym
+-#if !SANITIZER_ANDROID && !SANITIZER_SOLARIS && !SANITIZER_OPENBSD
++#if !SANITIZER_ANDROID && !SANITIZER_SOLARIS && !SANITIZER_OPENBSD && !SANITIZER_NONGNU
+ #define INTERCEPT_FUNCTION_VER_LINUX_OR_FREEBSD(func, symver) \
+   (::__interception::real_##func = (func##_f)(                \
+        unsigned long)::__interception::GetFuncAddrVer(#func, symver))
+diff --git a/lib/msan/msan_linux.cc b/lib/msan/msan_linux.cc
+index 385a650c4..6e30a8ce9 100644
+--- a/lib/msan/msan_linux.cc
++++ b/lib/msan/msan_linux.cc
+@@ -13,7 +13,7 @@
+ //===----------------------------------------------------------------------===//
+ 
+ #include "sanitizer_common/sanitizer_platform.h"
+-#if SANITIZER_FREEBSD || SANITIZER_LINUX || SANITIZER_NETBSD
++#if SANITIZER_FREEBSD || (SANITIZER_LINUX && !SANITIZER_NONGNU) || SANITIZER_NETBSD
+ 
+ #include "msan.h"
+ #include "msan_report.h"
+diff --git a/lib/sanitizer_common/sanitizer_allocator.cc b/lib/sanitizer_common/sanitizer_allocator.cc
+index 6bfd5e5ee..048f6154f 100644
+--- a/lib/sanitizer_common/sanitizer_allocator.cc
++++ b/lib/sanitizer_common/sanitizer_allocator.cc
+@@ -27,7 +27,7 @@ const char *SecondaryAllocatorName = "LargeMmapAllocator";
+ 
+ // ThreadSanitizer for Go uses libc malloc/free.
+ #if SANITIZER_GO || defined(SANITIZER_USE_MALLOC)
+-# if SANITIZER_LINUX && !SANITIZER_ANDROID
++# if SANITIZER_LINUX && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+ extern "C" void *__libc_malloc(uptr size);
+ #  if !SANITIZER_GO
+ extern "C" void *__libc_memalign(uptr alignment, uptr size);
+diff --git a/lib/sanitizer_common/sanitizer_common_interceptors_ioctl.inc b/lib/sanitizer_common/sanitizer_common_interceptors_ioctl.inc
+index 2d633c173..b6eb23116 100644
+--- a/lib/sanitizer_common/sanitizer_common_interceptors_ioctl.inc
++++ b/lib/sanitizer_common/sanitizer_common_interceptors_ioctl.inc
+@@ -104,7 +104,7 @@ static void ioctl_table_fill() {
+   _(SIOCGETVIFCNT, WRITE, struct_sioc_vif_req_sz);
+ #endif
+ 
+-#if SANITIZER_LINUX
++#if SANITIZER_LINUX && !SANITIZER_NONGNU
+   // Conflicting request ids.
+   // _(CDROMAUDIOBUFSIZ, NONE, 0);
+   // _(SNDCTL_TMR_CONTINUE, NONE, 0);
+@@ -365,7 +365,7 @@ static void ioctl_table_fill() {
+   _(VT_WAITACTIVE, NONE, 0);
+ #endif
+ 
+-#if SANITIZER_LINUX && !SANITIZER_ANDROID
++#if SANITIZER_LINUX && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+   // _(SIOCDEVPLIP, WRITE, struct_ifreq_sz); // the same as EQL_ENSLAVE
+   _(CYGETDEFTHRESH, WRITE, sizeof(int));
+   _(CYGETDEFTIMEOUT, WRITE, sizeof(int));
+diff --git a/lib/sanitizer_common/sanitizer_common_syscalls.inc b/lib/sanitizer_common/sanitizer_common_syscalls.inc
+index 469c8eb7e..24f87867d 100644
+--- a/lib/sanitizer_common/sanitizer_common_syscalls.inc
++++ b/lib/sanitizer_common/sanitizer_common_syscalls.inc
+@@ -2038,7 +2038,7 @@ POST_SYSCALL(setrlimit)(long res, long resource, void *rlim) {
+   }
+ }
+ 
+-#if !SANITIZER_ANDROID
++#if !SANITIZER_ANDROID && !SANITIZER_NONGNU
+ PRE_SYSCALL(prlimit64)(long pid, long resource, const void *new_rlim,
+                        void *old_rlim) {
+   if (new_rlim) PRE_READ(new_rlim, struct_rlimit64_sz);
+diff --git a/lib/sanitizer_common/sanitizer_linux.cc b/lib/sanitizer_common/sanitizer_linux.cc
+index 96d6c1eff..9e2b7fb9d 100644
+--- a/lib/sanitizer_common/sanitizer_linux.cc
++++ b/lib/sanitizer_common/sanitizer_linux.cc
+@@ -541,13 +541,13 @@ const char *GetEnv(const char *name) {
+ #endif
+ }
+ 
+-#if !SANITIZER_FREEBSD && !SANITIZER_NETBSD && !SANITIZER_OPENBSD
++#if !SANITIZER_FREEBSD && !SANITIZER_NETBSD && !SANITIZER_OPENBSD && !SANITIZER_NONGNU
+ extern "C" {
+ SANITIZER_WEAK_ATTRIBUTE extern void *__libc_stack_end;
+ }
+ #endif
+ 
+-#if !SANITIZER_GO && !SANITIZER_FREEBSD && !SANITIZER_NETBSD &&                \
++#if (!SANITIZER_GO || SANITIZER_NONGNU) && !SANITIZER_FREEBSD && !SANITIZER_NETBSD &&                \
+     !SANITIZER_OPENBSD
+ static void ReadNullSepFileToArray(const char *path, char ***arr,
+                                    int arr_size) {
+@@ -590,6 +590,10 @@ static void GetArgsAndEnv(char ***argv, char ***envp) {
+ #elif SANITIZER_NETBSD
+   *argv = __ps_strings->ps_argvstr;
+   *envp = __ps_strings->ps_envstr;
++#elif SANITIZER_NONGNU
++    static const int kMaxArgv = 2000, kMaxEnvp = 2000;
++    ReadNullSepFileToArray("/proc/self/cmdline", argv, kMaxArgv);
++    ReadNullSepFileToArray("/proc/self/environ", envp, kMaxEnvp);
+ #else // SANITIZER_FREEBSD
+ #if !SANITIZER_GO
+   if (&__libc_stack_end) {
+diff --git a/lib/sanitizer_common/sanitizer_linux_libcdep.cc b/lib/sanitizer_common/sanitizer_linux_libcdep.cc
+index 4962ff832..438f94dbe 100644
+--- a/lib/sanitizer_common/sanitizer_linux_libcdep.cc
++++ b/lib/sanitizer_common/sanitizer_linux_libcdep.cc
+@@ -179,7 +179,7 @@ __attribute__((unused)) static bool GetLibcVersion(int *major, int *minor,
+ }
+ 
+ #if !SANITIZER_FREEBSD && !SANITIZER_ANDROID && !SANITIZER_GO &&               \
+-    !SANITIZER_NETBSD && !SANITIZER_OPENBSD && !SANITIZER_SOLARIS
++    !SANITIZER_NETBSD && !SANITIZER_OPENBSD && !SANITIZER_SOLARIS && !SANITIZER_NONGNU
+ static uptr g_tls_size;
+ 
+ #ifdef __i386__
+@@ -261,7 +261,7 @@ void InitTlsSize() { }
+ #if (defined(__x86_64__) || defined(__i386__) || defined(__mips__) ||          \
+      defined(__aarch64__) || defined(__powerpc64__) || defined(__s390__) ||    \
+      defined(__arm__)) &&                                                      \
+-    SANITIZER_LINUX && !SANITIZER_ANDROID
++    SANITIZER_LINUX && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+ // sizeof(struct pthread) from glibc.
+ static atomic_uintptr_t thread_descriptor_size;
+ 
+@@ -426,7 +426,7 @@ int GetSizeFromHdr(struct dl_phdr_info *info, size_t size, void *data) {
+ 
+ #if !SANITIZER_GO
+ static void GetTls(uptr *addr, uptr *size) {
+-#if SANITIZER_LINUX && !SANITIZER_ANDROID
++#if SANITIZER_LINUX && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+ # if defined(__x86_64__) || defined(__i386__) || defined(__s390__)
+   *addr = ThreadSelf();
+   *size = GetTlsSize();
+@@ -470,7 +470,7 @@ static void GetTls(uptr *addr, uptr *size) {
+ #elif SANITIZER_OPENBSD
+   *addr = 0;
+   *size = 0;
+-#elif SANITIZER_ANDROID
++#elif SANITIZER_ANDROID || SANITIZER_NONGNU
+   *addr = 0;
+   *size = 0;
+ #elif SANITIZER_SOLARIS
+@@ -486,7 +486,7 @@ static void GetTls(uptr *addr, uptr *size) {
+ #if !SANITIZER_GO
+ uptr GetTlsSize() {
+ #if SANITIZER_FREEBSD || SANITIZER_ANDROID || SANITIZER_NETBSD ||              \
+-    SANITIZER_OPENBSD || SANITIZER_SOLARIS
++    SANITIZER_OPENBSD || SANITIZER_SOLARIS || SANITIZER_NONGNU
+   uptr addr, size;
+   GetTls(&addr, &size);
+   return size;
+diff --git a/lib/sanitizer_common/sanitizer_platform.h b/lib/sanitizer_common/sanitizer_platform.h
+index d81e25580..e10680ac8 100644
+--- a/lib/sanitizer_common/sanitizer_platform.h
++++ b/lib/sanitizer_common/sanitizer_platform.h
+@@ -208,6 +208,12 @@
+ # define SANITIZER_SOLARIS32 0
+ #endif
+ 
++#if defined(__linux__) && !defined(__GLIBC__)
++# define SANITIZER_NONGNU 1
++#else
++# define SANITIZER_NONGNU 0
++#endif
++
+ #if defined(__myriad2__)
+ # define SANITIZER_MYRIAD2 1
+ #else
+diff --git a/lib/sanitizer_common/sanitizer_platform_interceptors.h b/lib/sanitizer_common/sanitizer_platform_interceptors.h
+index f95539a73..6c53b3415 100644
+--- a/lib/sanitizer_common/sanitizer_platform_interceptors.h
++++ b/lib/sanitizer_common/sanitizer_platform_interceptors.h
+@@ -39,7 +39,7 @@
+ # include "sanitizer_platform_limits_solaris.h"
+ #endif
+ 
+-#if SANITIZER_LINUX && !SANITIZER_ANDROID
++#if SANITIZER_LINUX && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+ # define SI_LINUX_NOT_ANDROID 1
+ #else
+ # define SI_LINUX_NOT_ANDROID 0
+@@ -322,7 +322,7 @@
+ #define SANITIZER_INTERCEPT_ETHER_R (SI_FREEBSD || SI_LINUX_NOT_ANDROID)
+ #define SANITIZER_INTERCEPT_SHMCTL          \
+   (SI_NETBSD || SI_OPENBSD || SI_SOLARIS || \
+-  ((SI_FREEBSD || SI_LINUX_NOT_ANDROID) && \
++  ((SI_FREEBSD || SI_LINUX_NOT_ANDROID || SANITIZER_NONGNU) && \
+     SANITIZER_WORDSIZE == 64))  // NOLINT
+ #define SANITIZER_INTERCEPT_RANDOM_R SI_LINUX_NOT_ANDROID
+ #define SANITIZER_INTERCEPT_PTHREAD_ATTR_GET SI_POSIX
+diff --git a/lib/sanitizer_common/sanitizer_platform_limits_posix.cc b/lib/sanitizer_common/sanitizer_platform_limits_posix.cc
+index 54da635d7..2f6ff69c3 100644
+--- a/lib/sanitizer_common/sanitizer_platform_limits_posix.cc
++++ b/lib/sanitizer_common/sanitizer_platform_limits_posix.cc
+@@ -14,6 +14,9 @@
+ 
+ #include "sanitizer_platform.h"
+ 
++// Workaround musl <--> linux conflicting definition of 'struct sysinfo'
++#define _LINUX_SYSINFO_H
++
+ #if SANITIZER_LINUX || SANITIZER_FREEBSD || SANITIZER_MAC
+ // Tests in this file assume that off_t-dependent data structures match the
+ // libc ABI. For example, struct dirent here is what readdir() function (as
+@@ -138,12 +141,14 @@ typedef struct user_fpregs elf_fpregset_t;
+ 
+ #if SANITIZER_LINUX && !SANITIZER_ANDROID
+ #include <glob.h>
+-#include <obstack.h>
++#  if !SANITIZER_NONGNU
++#    include <obstack.h>
++#  endif
+ #include <mqueue.h>
+-#include <net/if_ppp.h>
+-#include <netax25/ax25.h>
+-#include <netipx/ipx.h>
+-#include <netrom/netrom.h>
++#include <linux/if_ppp.h>
++#include <linux/ax25.h>
++#include <linux/ipx.h>
++#include <linux/netrom.h>
+ #if HAVE_RPC_XDR_H
+ # include <rpc/xdr.h>
+ #elif HAVE_TIRPC_RPC_XDR_H
+@@ -251,7 +256,7 @@ namespace __sanitizer {
+   unsigned struct_itimerspec_sz = sizeof(struct itimerspec);
+ #endif // SANITIZER_LINUX || SANITIZER_FREEBSD
+ 
+-#if SANITIZER_LINUX && !SANITIZER_ANDROID
++#if SANITIZER_LINUX && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+   // Use pre-computed size of struct ustat to avoid <sys/ustat.h> which
+   // has been removed from glibc 2.28.
+ #if defined(__aarch64__) || defined(__s390x__) || defined (__mips64) \
+@@ -322,7 +327,7 @@ unsigned struct_ElfW_Phdr_sz = sizeof(ElfW(Phdr));
+ unsigned struct_ElfW_Phdr_sz = sizeof(Elf_Phdr);
+ #endif
+ 
+-#if (SANITIZER_LINUX || SANITIZER_FREEBSD) && !SANITIZER_ANDROID
++#if (SANITIZER_LINUX || SANITIZER_FREEBSD) && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+   int glob_nomatch = GLOB_NOMATCH;
+   int glob_altdirfunc = GLOB_ALTDIRFUNC;
+ #endif
+@@ -416,7 +421,7 @@ unsigned struct_ElfW_Phdr_sz = sizeof(Elf_Phdr);
+   unsigned struct_termios_sz = sizeof(struct termios);
+   unsigned struct_winsize_sz = sizeof(struct winsize);
+ 
+-#if SANITIZER_LINUX
++#if SANITIZER_LINUX && !SANITIZER_NONGNU
+   unsigned struct_arpreq_sz = sizeof(struct arpreq);
+   unsigned struct_cdrom_msf_sz = sizeof(struct cdrom_msf);
+   unsigned struct_cdrom_multisession_sz = sizeof(struct cdrom_multisession);
+@@ -466,7 +471,7 @@ unsigned struct_ElfW_Phdr_sz = sizeof(Elf_Phdr);
+   unsigned struct_vt_mode_sz = sizeof(struct vt_mode);
+ #endif // SANITIZER_LINUX || SANITIZER_FREEBSD
+ 
+-#if SANITIZER_LINUX && !SANITIZER_ANDROID
++#if SANITIZER_LINUX && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+   unsigned struct_ax25_parms_struct_sz = sizeof(struct ax25_parms_struct);
+   unsigned struct_cyclades_monitor_sz = sizeof(struct cyclades_monitor);
+ #if EV_VERSION > (0x010000)
+@@ -834,7 +839,7 @@ unsigned struct_ElfW_Phdr_sz = sizeof(Elf_Phdr);
+   unsigned IOCTL_VT_WAITACTIVE = VT_WAITACTIVE;
+ #endif // SANITIZER_LINUX || SANITIZER_FREEBSD
+ 
+-#if SANITIZER_LINUX && !SANITIZER_ANDROID
++#if SANITIZER_LINUX && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+   unsigned IOCTL_CYGETDEFTHRESH = CYGETDEFTHRESH;
+   unsigned IOCTL_CYGETDEFTIMEOUT = CYGETDEFTIMEOUT;
+   unsigned IOCTL_CYGETMON = CYGETMON;
+@@ -989,7 +994,7 @@ CHECK_SIZE_AND_OFFSET(dl_phdr_info, dlpi_phdr);
+ CHECK_SIZE_AND_OFFSET(dl_phdr_info, dlpi_phnum);
+ #endif // SANITIZER_LINUX || SANITIZER_FREEBSD
+ 
+-#if (SANITIZER_LINUX || SANITIZER_FREEBSD) && !SANITIZER_ANDROID
++#if (SANITIZER_LINUX || SANITIZER_FREEBSD) && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+ CHECK_TYPE_SIZE(glob_t);
+ CHECK_SIZE_AND_OFFSET(glob_t, gl_pathc);
+ CHECK_SIZE_AND_OFFSET(glob_t, gl_pathv);
+@@ -1023,6 +1028,7 @@ CHECK_TYPE_SIZE(iovec);
+ CHECK_SIZE_AND_OFFSET(iovec, iov_base);
+ CHECK_SIZE_AND_OFFSET(iovec, iov_len);
+ 
++#if !SANITIZER_NONGNU
+ CHECK_TYPE_SIZE(msghdr);
+ CHECK_SIZE_AND_OFFSET(msghdr, msg_name);
+ CHECK_SIZE_AND_OFFSET(msghdr, msg_namelen);
+@@ -1036,6 +1042,7 @@ CHECK_TYPE_SIZE(cmsghdr);
+ CHECK_SIZE_AND_OFFSET(cmsghdr, cmsg_len);
+ CHECK_SIZE_AND_OFFSET(cmsghdr, cmsg_level);
+ CHECK_SIZE_AND_OFFSET(cmsghdr, cmsg_type);
++#endif
+ 
+ #ifndef __GLIBC_PREREQ
+ #define __GLIBC_PREREQ(x, y) 0
+@@ -1145,7 +1152,7 @@ CHECK_SIZE_AND_OFFSET(mntent, mnt_passno);
+ 
+ CHECK_TYPE_SIZE(ether_addr);
+ 
+-#if (SANITIZER_LINUX || SANITIZER_FREEBSD) && !SANITIZER_ANDROID
++#if (SANITIZER_LINUX || SANITIZER_FREEBSD) && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+ CHECK_TYPE_SIZE(ipc_perm);
+ # if SANITIZER_FREEBSD
+ CHECK_SIZE_AND_OFFSET(ipc_perm, key);
+@@ -1206,7 +1213,7 @@ CHECK_SIZE_AND_OFFSET(ifaddrs, ifa_dstaddr);
+ CHECK_SIZE_AND_OFFSET(ifaddrs, ifa_data);
+ #endif
+ 
+-#if SANITIZER_LINUX
++#if SANITIZER_LINUX && !SANITIZER_NONGNU
+ COMPILER_CHECK(sizeof(__sanitizer_mallinfo) == sizeof(struct mallinfo));
+ #endif
+ 
+@@ -1256,7 +1263,7 @@ COMPILER_CHECK(__sanitizer_XDR_DECODE == XDR_DECODE);
+ COMPILER_CHECK(__sanitizer_XDR_FREE == XDR_FREE);
+ #endif
+ 
+-#if SANITIZER_LINUX && !SANITIZER_ANDROID
++#if SANITIZER_LINUX && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+ COMPILER_CHECK(sizeof(__sanitizer_FILE) <= sizeof(FILE));
+ CHECK_SIZE_AND_OFFSET(FILE, _flags);
+ CHECK_SIZE_AND_OFFSET(FILE, _IO_read_ptr);
+@@ -1275,7 +1282,7 @@ CHECK_SIZE_AND_OFFSET(FILE, _chain);
+ CHECK_SIZE_AND_OFFSET(FILE, _fileno);
+ #endif
+ 
+-#if SANITIZER_LINUX && !SANITIZER_ANDROID
++#if SANITIZER_LINUX && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+ COMPILER_CHECK(sizeof(__sanitizer__obstack_chunk) <= sizeof(_obstack_chunk));
+ CHECK_SIZE_AND_OFFSET(_obstack_chunk, limit);
+ CHECK_SIZE_AND_OFFSET(_obstack_chunk, prev);
+diff --git a/lib/tsan/rtl/tsan_platform_linux.cc b/lib/tsan/rtl/tsan_platform_linux.cc
+index de989b780..51a97b554 100644
+--- a/lib/tsan/rtl/tsan_platform_linux.cc
++++ b/lib/tsan/rtl/tsan_platform_linux.cc
+@@ -294,7 +294,7 @@ void InitializePlatform() {
+ // This is required to properly "close" the fds, because we do not see internal
+ // closes within glibc. The code is a pure hack.
+ int ExtractResolvFDs(void *state, int *fds, int nfd) {
+-#if SANITIZER_LINUX && !SANITIZER_ANDROID
++#if SANITIZER_LINUX && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+   int cnt = 0;
+   struct __res_state *statp = (struct __res_state*)state;
+   for (int i = 0; i < MAXNS && cnt < nfd; i++) {
+-- 
+2.19.0
+
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index 54c4e7c5465..131ad6ede3e 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -972,6 +972,9 @@ self: super: {
     # Generate shell completions
     generateOptparseApplicativeCompletion "purs" dontHaddockPurescript;
 
+  # Generate shell completion for spago
+  spago = generateOptparseApplicativeCompletion "spago" super.spago;
+
   # 2020-06-05: HACK: Package can not pass test suite,
   # Upstream Report: https://github.com/kcsongor/generic-lens/issues/83
   generic-lens = dontCheck super.generic-lens;
diff --git a/pkgs/development/interpreters/chibi/default.nix b/pkgs/development/interpreters/chibi/default.nix
index 08db1b077a3..7bf4c0fd52d 100644
--- a/pkgs/development/interpreters/chibi/default.nix
+++ b/pkgs/development/interpreters/chibi/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, makeWrapper }:
 let
-  version = "0.9";
+  version = "0.9.1";
   name = "chibi-scheme-${version}";
 in
 stdenv.mkDerivation {
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
     owner = "ashinn";
     repo = "chibi-scheme";
     rev = version;
-    sha256 = "1lnap41gl9vg82h557f4rlr69jgmd2gh0iqs6cxm77d39kv1scb8";
+    sha256 = "0nd63i924ifh39cba1hd4sbi6vh1cb73v97nrn4bf8rrjh3k8pdi";
   };
 
   buildInputs = [ makeWrapper ];
diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index 27ccb6f22c6..8f539d23392 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -28,7 +28,7 @@ let
 
     # TODO: Add a "dev" output containing the header files.
     outputs = [ "out" "man" "devdoc" ] ++
-      optional crossCompiling "dev";
+      optional crossCompiling "mini";
     setOutputFlags = false;
 
     disallowedReferences = [ stdenv.cc ];
@@ -144,13 +144,13 @@ let
           --replace "$man" /no-such-path
       '' + optionalString crossCompiling
       ''
-        mkdir -p $dev/lib/perl5/cross_perl/${version}
+        mkdir -p $mini/lib/perl5/cross_perl/${version}
         for dir in cnf/{stub,cpan}; do
-          cp -r $dir/* $dev/lib/perl5/cross_perl/${version}
+          cp -r $dir/* $mini/lib/perl5/cross_perl/${version}
         done
 
-        mkdir -p $dev/bin
-        install -m755 miniperl $dev/bin/perl
+        mkdir -p $mini/bin
+        install -m755 miniperl $mini/bin/perl
 
         export runtimeArch="$(ls $out/lib/perl5/site_perl/${version})"
         # wrapProgram should use a runtime-native SHELL by default, but
@@ -161,9 +161,9 @@ let
         # miniperl can't load the native modules there. However, it can
         # (and sometimes needs to) load and run some of the pure perl
         # code there, so we add it anyway. When needed, stubs can be put
-        # into $dev/lib/perl5/cross_perl/${version}.
-        wrapProgram $dev/bin/perl --prefix PERL5LIB : \
-          "$dev/lib/perl5/cross_perl/${version}:$out/lib/perl5/${version}:$out/lib/perl5/${version}/$runtimeArch"
+        # into $mini/lib/perl5/cross_perl/${version}.
+        wrapProgram $mini/bin/perl --prefix PERL5LIB : \
+          "$mini/lib/perl5/cross_perl/${version}:$out/lib/perl5/${version}:$out/lib/perl5/${version}/$runtimeArch"
       ''; # */
 
     meta = {
diff --git a/pkgs/development/interpreters/perl/setup-hook-cross.sh b/pkgs/development/interpreters/perl/setup-hook-cross.sh
index 95aae0b2670..a7aad6f2453 100644
--- a/pkgs/development/interpreters/perl/setup-hook-cross.sh
+++ b/pkgs/development/interpreters/perl/setup-hook-cross.sh
@@ -9,4 +9,4 @@ addPerlLibPath () {
     addToSearchPath PERL5LIB $1/lib/perl5/site_perl/@version@/@runtimeArch@
 }
 
-addEnvHooks "$targetOffset" addPerlLibPath
+addEnvHooks "$hostOffset" addPerlLibPath
diff --git a/pkgs/development/interpreters/rakudo/default.nix b/pkgs/development/interpreters/rakudo/default.nix
index a1185fcae37..fb33743dc9a 100644
--- a/pkgs/development/interpreters/rakudo/default.nix
+++ b/pkgs/development/interpreters/rakudo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rakudo";
-  version = "2020.07";
+  version = "2020.08.1";
 
   src = fetchurl {
     url    = "https://www.rakudo.org/dl/rakudo/rakudo-${version}.tar.gz";
-    sha256 = "1f6ay09k4n7dbcvvla45yg1lfb7vk2ssymmll2xiagjb77hlsqir";
+    sha256 = "1jwlqppm2g6ivzpipkcyihsxzsii3qyx1f35n7wj5dsf99b3hkfm";
   };
 
   buildInputs = [ icu zlib gmp perl ];
diff --git a/pkgs/development/interpreters/rakudo/moarvm.nix b/pkgs/development/interpreters/rakudo/moarvm.nix
index f0a800764b7..702fccd7b6b 100644
--- a/pkgs/development/interpreters/rakudo/moarvm.nix
+++ b/pkgs/development/interpreters/rakudo/moarvm.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "moarvm";
-  version = "2020.07";
+  version = "2020.08";
 
   src = fetchurl {
     url = "https://www.moarvm.org/releases/MoarVM-${version}.tar.gz";
-    sha256 = "1kzp76vqvny8gpp0b4xg1hg4vih4gmic4w1lddc9gqz03dx8hj6s";
+    sha256 = "1gq7z4z5lnkai01721waawkkal82sdmyra05nnbfb1986mq5xpiy";
    };
 
   buildInputs = [ perl ] ++ stdenv.lib.optionals stdenv.isDarwin [ CoreServices ApplicationServices ];
diff --git a/pkgs/development/interpreters/rakudo/nqp.nix b/pkgs/development/interpreters/rakudo/nqp.nix
index bf6a9ccc61b..93b42d2b8e1 100644
--- a/pkgs/development/interpreters/rakudo/nqp.nix
+++ b/pkgs/development/interpreters/rakudo/nqp.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nqp";
-  version = "2020.07";
+  version = "2020.08.1";
 
   src = fetchurl {
     url    = "https://github.com/perl6/nqp/releases/download/${version}/nqp-${version}.tar.gz";
-    sha256 = "0kian8xsyj51m120nh68c9q359l7iipkddph3r8yzvn41zql3y8v";
+    sha256 = "0pxmg22dx6rhfgrxq4gbwqf6d2nahw6iprjvrg8brkbcbyj3ryhd";
   };
 
   buildInputs = [ perl ];
diff --git a/pkgs/development/interpreters/red/default.nix b/pkgs/development/interpreters/red/default.nix
index e1460ec51a2..554dc81bffb 100644
--- a/pkgs/development/interpreters/red/default.nix
+++ b/pkgs/development/interpreters/red/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "red";
-  version = "0.6.3";
+  version = "0.6.4";
   src = fetchFromGitHub {
-    rev = "6a43c767fa2e85d668b83f749158a18e62c30f70";
+    rev = "755eb943ccea9e78c2cab0f20b313a52404355cb";
     owner = "red";
     repo = "red";
-    sha256 = "1zh6xc728bs7r4v5jz1jjrdk0xd838xsxmvy9gfg75a3zffm0slr";
+    sha256 = "sha256:045rrg9666zczgrwyyyglivzdzja103s52b0fzj7hqmr1fz68q37";
   };
 
   rebol = fetchurl {
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     ${r2} -qw red.r tests/hello.red
 
     # Compiling the Red console...
-    ${r2} -qw red.r -r environment/console/console.red
+    ${r2} -qw red.r -r environment/console/CLI/console.red
 
     # Generating docs...
     cd docs
diff --git a/pkgs/development/libraries/assimp/default.nix b/pkgs/development/libraries/assimp/default.nix
index a6f27f4476b..c1972aa1ca8 100644
--- a/pkgs/development/libraries/assimp/default.nix
+++ b/pkgs/development/libraries/assimp/default.nix
@@ -18,6 +18,6 @@ stdenv.mkDerivation rec {
     homepage = "http://assimp.sourceforge.net/";
     license = licenses.bsd3;
     maintainers = with maintainers; [ ehmry ];
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/pkgs/development/libraries/libappindicator/default.nix b/pkgs/development/libraries/libappindicator/default.nix
index dc0542c2126..7a7ad22756c 100644
--- a/pkgs/development/libraries/libappindicator/default.nix
+++ b/pkgs/development/libraries/libappindicator/default.nix
@@ -1,11 +1,11 @@
 # TODO: Resolve the issues with the Mono bindings.
 
-{ stdenv, fetchurl, fetchpatch, lib
+{ stdenv, fetchgit, lib
 , pkgconfig, autoreconfHook
 , glib, dbus-glib, gtkVersion ? "3"
 , gtk2 ? null, libindicator-gtk2 ? null, libdbusmenu-gtk2 ? null
 , gtk3 ? null, libindicator-gtk3 ? null, libdbusmenu-gtk3 ? null
-, vala, gobject-introspection
+, gtk-doc, vala, gobject-introspection
 , monoSupport ? false, mono ? null, gtk-sharp-2_0 ? null
  }:
 
@@ -15,18 +15,17 @@ with lib;
 stdenv.mkDerivation rec {
   name = let postfix = if gtkVersion == "2" && monoSupport then "sharp" else "gtk${gtkVersion}";
           in "libappindicator-${postfix}-${version}";
-  version = "${versionMajor}.${versionMinor}";
-  versionMajor = "12.10";
-  versionMinor = "0";
+  version = "12.10.1+20.10.20200706.1";
 
   outputs = [ "out" "dev" ];
 
-  src = fetchurl {
-    url = "${meta.homepage}/${versionMajor}/${version}/+download/libappindicator-${version}.tar.gz";
-    sha256 = "17xlqd60v0zllrxp8bgq3k5a1jkj0svkqn8rzllcyjh8k0gpr46m";
+  src = fetchgit {
+    url = "https://git.launchpad.net/ubuntu/+source/libappindicator";
+    rev = "fe25e53bc7e39cd59ad6b3270cd7a6a9c78c4f44";
+    sha256 = "0xjvbl4gn7ra2fs6gn2g9s787kzb5cg9hv79iqsz949rxh4iw32d";
   };
 
-  nativeBuildInputs = [ pkgconfig autoreconfHook vala gobject-introspection ];
+  nativeBuildInputs = [ pkgconfig autoreconfHook vala gobject-introspection gtk-doc ];
 
   propagatedBuildInputs =
     if gtkVersion == "2"
@@ -39,14 +38,9 @@ stdenv.mkDerivation rec {
     then [ libindicator-gtk2 ] ++ optionals monoSupport [ mono gtk-sharp-2_0 ]
     else [ libindicator-gtk3 ]);
 
-  patches = [
-    # Remove python2 from libappindicator.
-    (fetchpatch {
-      name = "no-python.patch";
-      url = "https://src.fedoraproject.org/rpms/libappindicator/raw/8508f7a52437679fd95a79b4630373f08315f189/f/nopython.patch";
-      sha256 = "18b1xzvwsbhhfpbzf5zragij4g79pa04y1dk6v5ci1wsjvii725s";
-    })
-  ];
+  preAutoreconf = ''
+    gtkdocize
+  '';
 
   configureFlags = [
     "CFLAGS=-Wno-error"
diff --git a/pkgs/development/libraries/libgdiplus/default.nix b/pkgs/development/libraries/libgdiplus/default.nix
index 1ff02a8709d..70043d1132d 100644
--- a/pkgs/development/libraries/libgdiplus/default.nix
+++ b/pkgs/development/libraries/libgdiplus/default.nix
@@ -23,6 +23,8 @@ stdenv.mkDerivation rec {
 
   configureFlags = stdenv.lib.optional stdenv.cc.isClang "--host=${stdenv.hostPlatform.system}";
 
+  enableParallelBuilding = true;
+
   buildInputs =
     [ glib cairo fontconfig libtiff giflib
       libjpeg libpng libXrender libexif
diff --git a/pkgs/development/libraries/librseq/default.nix b/pkgs/development/libraries/librseq/default.nix
index d4619ba4320..4fd8bb7e33a 100644
--- a/pkgs/development/libraries/librseq/default.nix
+++ b/pkgs/development/libraries/librseq/default.nix
@@ -4,22 +4,29 @@
 
 stdenv.mkDerivation rec {
   pname = "librseq";
-  version = "0.1.0pre54_${builtins.substring 0 7 src.rev}";
+  version = "0.1.0pre70_${builtins.substring 0 7 src.rev}";
 
   src = fetchFromGitHub {
     owner  = "compudj";
     repo   = "librseq";
-    rev    = "152600188dd214a0b2c6a8c66380e50c6ad27154";
-    sha256 = "0mivjmgdkgrr6z2gz3k6q6wgnvyvw9xzy65f6ipvqva68sxhk0mx";
+    rev    = "d1cdec98d476b16ca5e2d9d7eabcf9f1c97e6111";
+    sha256 = "0vgillrxc1knq591gjj99x2ws6q1xpm5dmfrhsxisngfpcnjr10v";
   };
 
-  outputs = [ "out" "dev" ];
+  outputs = [ "out" "dev" "man" ];
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ linuxHeaders ];
 
+  installTargets = [ "install" "install-man" ];
+
+  doCheck = true;
   separateDebugInfo = true;
   enableParallelBuilding = true;
 
+  patchPhase = ''
+    patchShebangs tests
+  '';
+
   # The share/ subdir only contains a doc/ with a README.md that just describes
   # how to compile the library, which clearly isn't very useful! So just get
   # rid of it anyway.
diff --git a/pkgs/development/libraries/libvmaf/default.nix b/pkgs/development/libraries/libvmaf/default.nix
index 6c2b61cf113..9f7e84558f7 100644
--- a/pkgs/development/libraries/libvmaf/default.nix
+++ b/pkgs/development/libraries/libvmaf/default.nix
@@ -1,19 +1,19 @@
-{ stdenv, fetchFromGitHub, meson, ninja }:
+{ stdenv, fetchFromGitHub, meson, ninja, nasm }:
 
 stdenv.mkDerivation rec {
   pname = "libvmaf";
-  version = "1.5.2";
+  version = "1.5.3";
 
   src = fetchFromGitHub {
     owner = "netflix";
     repo = "vmaf";
     rev = "v${version}";
-    sha256 = "18w0z3w90fdbzsqaa4diwvq0xmvg0aiw4hi3aaa4pq0zgnb8g3mk";
+    sha256 = "0x3l3g0hgrrjh3ygmxr1pd3rd5589s07c7id35nvj76ch5b7gy63";
   };
 
   sourceRoot = "source/libvmaf";
 
-  nativeBuildInputs = [ meson ninja ];
+  nativeBuildInputs = [ meson ninja nasm ];
   outputs = [ "out" "dev" ];
   doCheck = true;
 
diff --git a/pkgs/development/libraries/muparserx/default.nix b/pkgs/development/libraries/muparserx/default.nix
new file mode 100644
index 00000000000..2c5bde316b4
--- /dev/null
+++ b/pkgs/development/libraries/muparserx/default.nix
@@ -0,0 +1,42 @@
+{ stdenv
+, fetchFromGitHub
+, cmake
+}:
+
+stdenv.mkDerivation rec {
+  pname = "muparserx";
+  version = "4.0.8";
+
+  src = fetchFromGitHub {
+    owner = "beltoforion";
+    repo = "muparserx";
+    rev = "v${version}";
+    sha256 = "097pkdffv0phr0345hy06mjm5pfy259z13plsvbxvcmds80wl48v";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  cmakeFlags = [
+    "-DCMAKE_BUILD_TYPE=Release"
+  ];
+
+  doCheck = true;
+  checkPhase = ''
+    echo "***Muparserx self-test***"
+    echo "quit" | ./example > test_result.log
+    cat test_result.log
+    if grep -Fqi "failed" test_result.log; then
+      echo ">=1 muparserx tests failed"
+      exit 1
+    else
+      echo -e "\nmuparserx tests succeeded"
+    fi
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A C++ Library for Parsing Expressions with Strings, Complex Numbers, Vectors, Matrices and more.";
+    homepage = "https://beltoforion.de/en/muparserx/";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ drewrisinger ];
+  };
+}
diff --git a/pkgs/development/libraries/pcre2/default.nix b/pkgs/development/libraries/pcre2/default.nix
index d39b91355b9..b127eb0a31e 100644
--- a/pkgs/development/libraries/pcre2/default.nix
+++ b/pkgs/development/libraries/pcre2/default.nix
@@ -11,8 +11,7 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--enable-pcre2-16"
     "--enable-pcre2-32"
-    "--enable-jit"
-  ];
+  ] ++ stdenv.lib.optional (!stdenv.hostPlatform.isRiscV) "--enable-jit";
 
   outputs = [ "bin" "dev" "out" "doc" "man" "devdoc" ];
 
diff --git a/pkgs/development/libraries/qt-5/modules/qtdeclarative.nix b/pkgs/development/libraries/qt-5/modules/qtdeclarative.nix
index c22857a6dc6..b611282294c 100644
--- a/pkgs/development/libraries/qt-5/modules/qtdeclarative.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtdeclarative.nix
@@ -1,4 +1,4 @@
-{ qtModule, lib, fetchpatch, python3, qtbase, qtsvg }:
+{ qtModule, lib, python3, qtbase, qtsvg }:
 
 with lib;
 
@@ -23,12 +23,4 @@ qtModule {
     "bin/qmlscene"
     "bin/qmltestrunner"
   ];
-  patches =
-    # https://mail.kde.org/pipermail/kde-distro-packagers/2020-June/000419.html
-    lib.optional (lib.versionAtLeast qtbase.version "5.14.2")
-      (fetchpatch {
-        url = "https://codereview.qt-project.org/gitweb?p=qt/qtdeclarative.git;a=patch;h=3e47ac319b0f53c43cc02a8356c2dec4f0daeef4";
-        sha256 = "0wvncg7047q73nm0svc6kb14sigwk7sc53r4778kn033aj0qqszj";
-        name = "qtdeclarative-QQuickItemView-fix-max-extent.patch";
-      });
 }
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
index 9bf2a233bc9..049b0349a4f 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
@@ -15,7 +15,7 @@
 , gn
 , cups, darwin, openbsm, runCommand, xcbuild, writeScriptBin
 , ffmpeg_3 ? null
-, lib, stdenv
+, lib, stdenv, fetchpatch
 }:
 
 with stdenv.lib;
@@ -38,6 +38,17 @@ qtModule {
   # which cannot be set at the same time as -Wformat-security
   hardeningDisable = [ "format" ];
 
+  patches = [
+    # Fix build with bison-3.7: https://code.qt.io/cgit/qt/qtwebengine-chromium.git/commit/?id=1a53f599
+    (fetchpatch {
+      name = "qtwebengine-bison-3.7-build.patch";
+      url = "https://code.qt.io/cgit/qt/qtwebengine-chromium.git/patch/?id=1a53f599";
+      sha256 = "1nqpyn5fq37q7i9nasag6i14lnz0d7sld5ikqhlm8qwq9d7gbmjy";
+      stripLen = 1;
+      extraPrefix = "src/3rdparty/";
+    })
+  ];
+
   postPatch =
     # Patch Chromium build tools
     ''
diff --git a/pkgs/development/libraries/sope/default.nix b/pkgs/development/libraries/sope/default.nix
index 9d0b3bf76b3..2c73ff24df2 100644
--- a/pkgs/development/libraries/sope/default.nix
+++ b/pkgs/development/libraries/sope/default.nix
@@ -1,13 +1,13 @@
 { gnustep, lib, fetchFromGitHub , libxml2, openssl_1_1
 , openldap, mysql, libmysqlclient, postgresql }: with lib; gnustep.stdenv.mkDerivation rec {
   pname = "sope";
-  version = "4.3.2";
+  version = "5.0.0";
 
   src = fetchFromGitHub {
     owner = "inverse-inc";
     repo = pname;
     rev = "SOPE-${version}";
-    sha256 = "0ny1ihx38gd25w8f3dfybyswvyjfljvb2fhfmkajgg6hhjrkfar2";
+    sha256 = "sha256-7NM9wcyHDSVmjjqu489Ff3iJgl9VM+UBF3XYWoiHHTg=";
   };
 
   nativeBuildInputs = [ gnustep.make ];
diff --git a/pkgs/development/libraries/vid-stab/default.nix b/pkgs/development/libraries/vid-stab/default.nix
index e22396f8aa3..2921719e755 100644
--- a/pkgs/development/libraries/vid-stab/default.nix
+++ b/pkgs/development/libraries/vid-stab/default.nix
@@ -1,22 +1,25 @@
-{ stdenv, fetchurl, cmake }:
+{ stdenv, fetchFromGitHub, cmake, openmp }:
 
 stdenv.mkDerivation rec {
-  pname = "vid-stab";
-  version = "0.98b";
-  
-  src = fetchurl {
-    url = "https://github.com/georgmartius/vid.stab/archive/release-${version}.tar.gz";
-    sha256 = "09fh6xbd1f5xp3il3dpvr87skmnp2mm2hfmg4s9rvj4y8zvhn3sk";
+  pname = "vid.stab";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "georgmartius";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0a3frpm2kdbx7vszhg64p3alisag73bcspl7fp3a2f1kgq7rbh38";
   };
 
   nativeBuildInputs = [ cmake ];
-  
+
+  buildInputs = stdenv.lib.optionals stdenv.cc.isClang [ openmp ];
+
   meta = with stdenv.lib; {
     description = "Video stabilization library";
-    homepage    = "http://public.hronopik.de/vid.stab/";
-    license     = licenses.gpl2;
+    homepage = "http://public.hronopik.de/vid.stab/";
+    license = licenses.gpl2Plus;
     maintainers = with maintainers; [ codyopel ];
-    platforms   = platforms.all;
+    platforms = platforms.all;
   };
 }
-
diff --git a/pkgs/development/libraries/wxsqlite3/default.nix b/pkgs/development/libraries/wxsqlite3/default.nix
index 9bea7f5e848..9d80e5de449 100644
--- a/pkgs/development/libraries/wxsqlite3/default.nix
+++ b/pkgs/development/libraries/wxsqlite3/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wxsqlite3";
-  version = "4.5.1";
+  version = "4.6.0";
 
   src = fetchFromGitHub {
     owner = "utelle";
     repo = "wxsqlite3";
     rev = "v${version}";
-    sha256 = "0090f7r3blks18vifkna4l890fwaya58ajh9qblbw9065zj5hrm3";
+    sha256 = "0snsysfrr5h66mybls8r8k781v732dlfn4jdnmk348jgvny275fj";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/development/libraries/yder/default.nix b/pkgs/development/libraries/yder/default.nix
index 11eda01a76a..b6f60ede98c 100644
--- a/pkgs/development/libraries/yder/default.nix
+++ b/pkgs/development/libraries/yder/default.nix
@@ -4,13 +4,13 @@
 assert withSystemd -> systemd != null;
 stdenv.mkDerivation rec {
   pname = "yder";
-  version = "1.4.10";
+  version = "1.4.11";
 
   src = fetchFromGitHub {
     owner = "babelouest";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1m1aw4im1vvddkl7mknq0h0nj0x2zpql3r17lxhw4mmib05zbdgj";
+    sha256 = "0gm6l9y4jkxbq6vskdv1ivlq795ic28nhiyq21mzk3mx6j8klwip";
   };
 
   patches = [
diff --git a/pkgs/development/ocaml-modules/mirage-crypto/default.nix b/pkgs/development/ocaml-modules/mirage-crypto/default.nix
index e85fa5bef24..71c044a8cc1 100644
--- a/pkgs/development/ocaml-modules/mirage-crypto/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-crypto/default.nix
@@ -4,11 +4,11 @@ buildDunePackage rec {
   minimumOCamlVersion = "4.08";
 
   pname = "mirage-crypto";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchurl {
     url = "https://github.com/mirage/mirage-crypto/releases/download/v${version}/mirage-crypto-v${version}.tbz";
-    sha256 = "08rmhjrk046nnhbdk16vg7w7ink4bj6yq9dsjcky5psn982aqiwi";
+    sha256 = "1w09wllls4rp1abq0awffxf69dn0xciy6hsqz413ing5r151wjxr";
   };
 
   useDune2 = true;
diff --git a/pkgs/development/perl-modules/generic/default.nix b/pkgs/development/perl-modules/generic/default.nix
index 79c7919a354..c7b57eae906 100644
--- a/pkgs/development/perl-modules/generic/default.nix
+++ b/pkgs/development/perl-modules/generic/default.nix
@@ -42,7 +42,7 @@ toPerlModule(stdenv.mkDerivation (
     version = lib.getVersion attrs;                     # TODO: phase-out `attrs.name`
     builder = ./builder.sh;
     buildInputs = buildInputs ++ [ perl ];
-    nativeBuildInputs = nativeBuildInputs ++ [ (perl.dev or perl) ];
+    nativeBuildInputs = nativeBuildInputs ++ [ (perl.mini or perl) ];
     fullperl = buildPerl;
   }
 ))
diff --git a/pkgs/development/python-modules/multitasking/default.nix b/pkgs/development/python-modules/multitasking/default.nix
new file mode 100644
index 00000000000..8ea4d633f66
--- /dev/null
+++ b/pkgs/development/python-modules/multitasking/default.nix
@@ -0,0 +1,25 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "multitasking";
+  version = "0.0.9";
+
+  # GitHub source releases aren't tagged
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "b59d99f709d2e17d60ccaa2be09771b6e9ed9391c63f083c0701e724f624d2e0";
+  };
+
+  doCheck = false;  # No tests included
+  pythonImportsCheck = [ "multitasking" ];
+
+  meta = with lib; {
+    description = "Non-blocking Python methods using decorators";
+    homepage = "https://github.com/ranaroussi/multitasking";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ drewrisinger ];
+  };
+}
diff --git a/pkgs/development/python-modules/pylatexenc/default.nix b/pkgs/development/python-modules/pylatexenc/default.nix
index 02a0f875836..6b56a42246f 100644
--- a/pkgs/development/python-modules/pylatexenc/default.nix
+++ b/pkgs/development/python-modules/pylatexenc/default.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "pylatexenc";
-  version = "2.4";
+  version = "2.7";
 
   src = fetchFromGitHub {
     owner = "phfaist";
     repo = "pylatexenc";
     rev = "v${version}";
-    sha256 = "0i4frypbv90mjir8bkp03cwkvwhgvc9p3fw6q2jz1dn7fw94v2rv";
+    sha256 = "1hpcwbknfah3mky2m4asw15b9qdvv4k5ni0js764n1jpi83m1zgk";
   };
 
   pythonImportsCheck = [ "pylatexenc" ];
@@ -26,4 +26,4 @@ buildPythonPackage rec {
     license = licenses.mit;
     maintainers = with maintainers; [ drewrisinger ];
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/development/python-modules/qiskit-aer/default.nix b/pkgs/development/python-modules/qiskit-aer/default.nix
index 3f0439efc7a..8e73e942be9 100644
--- a/pkgs/development/python-modules/qiskit-aer/default.nix
+++ b/pkgs/development/python-modules/qiskit-aer/default.nix
@@ -6,6 +6,9 @@
 , cmake
 , cvxpy
 , cython
+, muparserx
+, ninja
+, nlohmann_json
 , numpy
 , openblas
 , pybind11
@@ -19,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "qiskit-aer";
-  version = "0.5.2";
+  version = "0.6.1";
 
   disabled = pythonOlder "3.5";
 
@@ -27,18 +30,20 @@ buildPythonPackage rec {
     owner = "Qiskit";
     repo = "qiskit-aer";
     rev = version;
-    fetchSubmodules = true; # fetch muparserx and other required libraries
-    sha256 = "0vw6b69h8pvzxhaz3k8sg9ac792gz3kklfv0izs6ra83y1dfwhjz";
+    sha256 = "1fnv11diis0as8zcc57mamz0gbjd6vj7nw3arxzvwa77ja803sr4";
   };
 
   nativeBuildInputs = [
     cmake
+    ninja
     scikit-build
   ];
 
   buildInputs = [
     openblas
     spdlog
+    nlohmann_json
+    muparserx
   ];
 
   propagatedBuildInputs = [
@@ -48,10 +53,10 @@ buildPythonPackage rec {
     pybind11
   ];
 
-  postPatch = ''
-    # remove dependency on PyPi cmake package, which isn't in Nixpkgs
-    substituteInPlace setup.py --replace "'cmake!=3.17,!=3.17.0'" ""
-  '';
+  patches = [
+    # TODO: remove in favor of qiskit-aer PR #877 patch once accepted/stable
+    ./remove-conan-install.patch
+  ];
 
   dontUseCmakeConfigure = true;
 
@@ -60,11 +65,6 @@ buildPythonPackage rec {
     "-DAER_THRUST_BACKEND=OMP"
   ];
 
-  # Needed to find qiskit.providers.aer modules in cython. This exists in GitHub, don't know why it isn't copied by default
-  postFixup = ''
-    touch $out/${python.sitePackages}/qiskit/__init__.pxd
-  '';
-
   # *** Testing ***
 
   pythonImportsCheck = [
@@ -77,11 +77,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
   dontUseSetuptoolsCheck = true;  # Otherwise runs tests twice
-  disabledTests = [
-    # broken with cvxpy >= 1.1.0, see https://github.com/Qiskit/qiskit-aer/issues/779.
-    # TODO: Remove once resolved, probably next qiskit-aer version
-    "test_clifford"
-  ];
 
   preCheck = ''
     # Tests include a compiled "circuit" which is auto-built in $HOME
@@ -100,11 +95,8 @@ buildPythonPackage rec {
     description = "High performance simulators for Qiskit";
     homepage = "https://qiskit.org/aer";
     downloadPage = "https://github.com/QISKit/qiskit-aer/releases";
+    changelog = "https://qiskit.org/documentation/release_notes.html";
     license = licenses.asl20;
     maintainers = with maintainers; [ drewrisinger ];
-    # Doesn't build on aarch64 (libmuparserx issue).
-    # Can fix by building muparserx from source (https://github.com/beltoforion/muparserx)
-    # or in future updates (e.g. Raspberry Pi enabled via https://github.com/Qiskit/qiskit-aer/pull/651 & https://github.com/Qiskit/qiskit-aer/pull/660)
-    platforms = platforms.x86_64;
   };
 }
diff --git a/pkgs/development/python-modules/qiskit-aer/remove-conan-install.patch b/pkgs/development/python-modules/qiskit-aer/remove-conan-install.patch
new file mode 100644
index 00000000000..1c5ae87b082
--- /dev/null
+++ b/pkgs/development/python-modules/qiskit-aer/remove-conan-install.patch
@@ -0,0 +1,63 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index efeacfc..77bd6bd 100755
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -121,7 +121,11 @@ endif()
+ # Looking for external libraries
+ #
+ 
+-setup_conan()
++find_package(muparserx REQUIRED)
++find_package(nlohmann_json REQUIRED)
++find_package(spdlog REQUIRED)
++# for tests only
++find_package(catch2)
+ 
+ # If we do not set them with a space CMake fails afterwards if nothing is set for this vars!
+ set(AER_LINKER_FLAGS " ")
+@@ -269,16 +273,16 @@ endif()
+ set(AER_LIBRARIES
+ 	${AER_LIBRARIES}
+ 	${BLAS_LIBRARIES}
+-	CONAN_PKG::nlohmann_json
++	nlohmann_json
+ 	Threads::Threads
+-	CONAN_PKG::spdlog
++	spdlog
+ 	${DL_LIB}
+ 	${THRUST_DEPENDANT_LIBS})
+ 
+ set(AER_COMPILER_DEFINITIONS ${AER_COMPILER_DEFINITIONS} ${CONAN_DEFINES})
+ # Cython build is only enabled if building through scikit-build.
+ if(SKBUILD) # Terra Addon build
+-	set(AER_LIBRARIES ${AER_LIBRARIES} CONAN_PKG::muparserx)
++	set(AER_LIBRARIES ${AER_LIBRARIES} muparserx)
+ 	add_subdirectory(qiskit/providers/aer/pulse/qutip_extra_lite/cy)
+ 	add_subdirectory(qiskit/providers/aer/backends/wrappers)
+ 	add_subdirectory(src/open_pulse)
+diff --git a/setup.py b/setup.py
+index fd71e9f..1561cc4 100644
+--- a/setup.py
++++ b/setup.py
+@@ -11,12 +11,6 @@ import inspect
+ 
+ PACKAGE_NAME = os.getenv('QISKIT_AER_PACKAGE_NAME', 'qiskit-aer')
+ 
+-try:
+-    from conans import client
+-except ImportError:
+-    subprocess.call([sys.executable, '-m', 'pip', 'install', 'conan'])
+-    from conans import client
+-
+ try:
+     from skbuild import setup
+ except ImportError:
+@@ -46,8 +40,6 @@ common_requirements = [
+ 
+ setup_requirements = common_requirements + [
+     'scikit-build',
+-    'cmake!=3.17,!=3.17.0',
+-    'conan>=1.22.2'
+ ]
+ 
+ requirements = common_requirements + ['qiskit-terra>=0.12.0']
diff --git a/pkgs/development/python-modules/qiskit-aqua/default.nix b/pkgs/development/python-modules/qiskit-aqua/default.nix
index fe90ee63e00..c90f9ddf2e2 100644
--- a/pkgs/development/python-modules/qiskit-aqua/default.nix
+++ b/pkgs/development/python-modules/qiskit-aqua/default.nix
@@ -2,6 +2,7 @@
 , pythonOlder
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 # , cplex
 , cvxpy
 , dlx
@@ -16,6 +17,7 @@
 , qiskit-terra
 , quandl
 , scikitlearn
+, yfinance
   # Check Inputs
 , ddt
 , pytestCheckHook
@@ -24,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "qiskit-aqua";
-  version = "0.7.3";
+  version = "0.7.5";
 
   disabled = pythonOlder "3.5";
 
@@ -33,9 +35,18 @@ buildPythonPackage rec {
     owner = "Qiskit";
     repo = "qiskit-aqua";
     rev = version;
-    sha256 = "04zcnrc0vi6dfjahp1019h2ngdgi7l7jvfs9aw0y306nd9g6qgjc";
+    sha256 = "19sdv7lnc4b1c86rd1dv7pjpi8cmrpzbv7nav0fb899ki8ldqdwq";
   };
 
+  # TODO: remove in next release
+  patches = [
+    (fetchpatch {
+      name = "qiskit-aqua-fix-test-issue-1214.patch";
+      url = "https://github.com/Qiskit/qiskit-aqua/commit/284a4323192ac85787b22cbe5f344996fae16f7d.patch";
+      sha256 = "0zl8hqa2fq9ng793x4dhh0ny67nnbjcd8l1cdsaaab4ca1y0xcfr";
+    })
+  ];
+
   # Optional packages: pyscf (see below NOTE) & pytorch. Can install via pip/nix if needed.
   propagatedBuildInputs = [
     # cplex
@@ -51,6 +62,7 @@ buildPythonPackage rec {
     qiskit-ignis
     quandl
     scikitlearn
+    yfinance
   ];
 
   # *** NOTE ***
@@ -105,8 +117,9 @@ buildPythonPackage rec {
     # Disabled due to missing pyscf
     "test_validate" # test/chemistry/test_inputparser.py
 
-    "test_binary" # in SklearnSVM, seems to have trouble with eigenvectors converging
-    "test_pauli_expect_single"  # fails for unknown reason, 3e-3 out of tolerance
+    # Online tests
+    "test_exchangedata"
+    "test_yahoo"
 
     # Disabling slow tests > 10 seconds
     "TestVQE"
@@ -119,7 +132,6 @@ buildPythonPackage rec {
     "TestQGAN"
     "test_evaluate_qasm_mode"
     "test_measurement_error_mitigation_auto_refresh"
-    "test_exchangedata"
     "test_wikipedia"
     "test_shor_factoring_1__15___qasm_simulator____3__5__"
     "test_readme_sample"
@@ -138,11 +150,13 @@ buildPythonPackage rec {
     "test_oh"
     "test_confidence_intervals_00001"
     "test_eoh"
+    "test_qasm_5"
   ];
 
   meta = with lib; {
     description = "An extensible library of quantum computing algorithms";
     homepage = "https://github.com/QISKit/qiskit-aqua";
+    changelog = "https://qiskit.org/documentation/release_notes.html";
     license = licenses.asl20;
     maintainers = with maintainers; [ drewrisinger ];
   };
diff --git a/pkgs/development/python-modules/qiskit-ibmq-provider/default.nix b/pkgs/development/python-modules/qiskit-ibmq-provider/default.nix
index 02cdb8397cb..eaf10fd6082 100644
--- a/pkgs/development/python-modules/qiskit-ibmq-provider/default.nix
+++ b/pkgs/development/python-modules/qiskit-ibmq-provider/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "qiskit-ibmq-provider";
-  version = "0.7.2";
+  version = "0.8.0";
 
   disabled = pythonOlder "3.6";
 
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     owner = "Qiskit";
     repo = pname;
     rev = version;
-    sha256 = "11h1ca4v11pajzn1cxqhim1hfziqzj27xzakwln13g8zmiqx3csp";
+    sha256 = "0rrpwr4a82j69j5ibl2g0nw8wbpg201cfz6f234k2v6pj500x9nl";
   };
 
   propagatedBuildInputs = [
@@ -85,6 +85,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Qiskit provider for accessing the quantum devices and simulators at IBMQ";
     homepage = "https://github.com/Qiskit/qiskit-ibmq-provider";
+    changelog = "https://qiskit.org/documentation/release_notes.html";
     license = licenses.asl20;
     maintainers = with maintainers; [ drewrisinger ];
   };
diff --git a/pkgs/development/python-modules/qiskit-ignis/default.nix b/pkgs/development/python-modules/qiskit-ignis/default.nix
index bfd2bffbf47..d40afe43f9e 100644
--- a/pkgs/development/python-modules/qiskit-ignis/default.nix
+++ b/pkgs/development/python-modules/qiskit-ignis/default.nix
@@ -9,14 +9,15 @@
 , scikitlearn
 , scipy
   # Check Inputs
-, ddt
 , pytestCheckHook
+, ddt
+, pyfakefs
 , qiskit-aer
 }:
 
 buildPythonPackage rec {
   pname = "qiskit-ignis";
-  version = "0.3.3";
+  version = "0.4.0";
 
   disabled = pythonOlder "3.6";
 
@@ -25,7 +26,7 @@ buildPythonPackage rec {
     owner = "Qiskit";
     repo = "qiskit-ignis";
     rev = version;
-    sha256 = "0sy9qpw0jqirsk9y61j5kr18jrw1wa812n7y98fjj6w668rrv560";
+    sha256 = "07mxhaknkp121xm6mgrpcrbj9qw6j924ra3k0s6vr8qgvfcxvh0y";
   };
 
   propagatedBuildInputs = [
@@ -41,18 +42,21 @@ buildPythonPackage rec {
   dontUseSetuptoolsCheck = true;
   preCheck = "export HOME=$TMPDIR";
   checkInputs = [
-    ddt
     pytestCheckHook
+    ddt
+    pyfakefs
     qiskit-aer
   ];
-  # Test is in test/verification/test_entanglemet.py. test fails due to out-of-date calls & bad logic with this file since qiskit-ignis#328
-  # see qiskit-ignis#386 for all issues. Should be able to re-enable in future.
-  disabledTests = [ "TestEntanglement" ];
+  disabledTests = [
+    "test_tensored_meas_cal_on_circuit" # Flaky test, occasionally returns result outside bounds
+    "test_qv_fitter"  # execution hangs, ran for several minutes
+  ];
 
   meta = with lib; {
     description = "Qiskit tools for quantum hardware verification, noise characterization, and error correction";
     homepage = "https://qiskit.org/ignis";
     downloadPage = "https://github.com/QISKit/qiskit-ignis/releases";
+    changelog = "https://qiskit.org/documentation/release_notes.html";
     license = licenses.asl20;
     maintainers = with maintainers; [ drewrisinger ];
   };
diff --git a/pkgs/development/python-modules/qiskit-terra/default.nix b/pkgs/development/python-modules/qiskit-terra/default.nix
index c1c0dd92837..aad0370c3d7 100644
--- a/pkgs/development/python-modules/qiskit-terra/default.nix
+++ b/pkgs/development/python-modules/qiskit-terra/default.nix
@@ -8,12 +8,11 @@
 , fastjsonschema
 , jsonschema
 , numpy
-, marshmallow
-, marshmallow-polyfield
 , networkx
 , ply
 , psutil
 , python-constraint
+, python-dateutil
 , retworkx
 , scipy
 , sympy
@@ -36,7 +35,7 @@
 
 buildPythonPackage rec {
   pname = "qiskit-terra";
-  version = "0.14.2";
+  version = "0.15.1";
 
   disabled = pythonOlder "3.5";
 
@@ -44,7 +43,7 @@ buildPythonPackage rec {
     owner = "Qiskit";
     repo = pname;
     rev = version;
-    sha256 = "0p5wapjvy81pnks100xbb23kbs2wyys9ykyc8z4968wl487lq4g5";
+    sha256 = "1p7y36gj3675dmp05nwi0m9nc7h0bwyimir3ncf9wbkx3crrh99c";
   };
 
   nativeBuildInputs = [ cython ];
@@ -54,13 +53,12 @@ buildPythonPackage rec {
     fastjsonschema
     jsonschema
     numpy
-    marshmallow
-    marshmallow-polyfield
     matplotlib
     networkx
     ply
     psutil
     python-constraint
+    python-dateutil
     retworkx
     scipy
     sympy
@@ -74,10 +72,6 @@ buildPythonPackage rec {
     seaborn
   ];
 
-  postPatch = ''
-    # Fix relative imports in tests
-    touch test/python/dagcircuit/__init__.py
-  '';
 
   # *** Tests ***
   checkInputs = [
@@ -94,9 +88,6 @@ buildPythonPackage rec {
     "qiskit.transpiler.passes.routing.cython.stochastic_swap.swap_trial"
   ];
 
-  disabledTests = [
-    "test_random_clifford_valid"  # random test, fails at least once when testing locally.
-  ];
   pytestFlagsArray = [
     "--ignore=test/randomized/test_transpiler_equivalence.py" # collection requires qiskit-aer, which would cause circular dependency
   ];
@@ -106,9 +97,9 @@ buildPythonPackage rec {
   preCheck = ''
     export PACKAGEDIR=$out/${python.sitePackages}
     echo "Moving Qiskit test files to package directory"
-    cp -r $TMP/source/test $PACKAGEDIR
-    cp -r $TMP/source/examples $PACKAGEDIR
-    cp -r $TMP/source/qiskit/schemas/examples $PACKAGEDIR/qiskit/schemas/
+    cp -r $TMP/$sourceRoot/test $PACKAGEDIR
+    cp -r $TMP/$sourceRoot/examples $PACKAGEDIR
+    cp -r $TMP/$sourceRoot/qiskit/schemas/examples $PACKAGEDIR/qiskit/schemas/
 
     # run pytest from Nix's $out path
     pushd $PACKAGEDIR
@@ -127,6 +118,7 @@ buildPythonPackage rec {
     '';
     homepage = "https://qiskit.org/terra";
     downloadPage = "https://github.com/QISKit/qiskit-terra/releases";
+    changelog = "https://qiskit.org/documentation/release_notes.html";
     license = licenses.asl20;
     maintainers = with maintainers; [ drewrisinger ];
   };
diff --git a/pkgs/development/python-modules/qiskit/default.nix b/pkgs/development/python-modules/qiskit/default.nix
index 81468da30fb..46fcf498597 100644
--- a/pkgs/development/python-modules/qiskit/default.nix
+++ b/pkgs/development/python-modules/qiskit/default.nix
@@ -15,7 +15,7 @@
 buildPythonPackage rec {
   pname = "qiskit";
   # NOTE: This version denotes a specific set of subpackages. See https://qiskit.org/documentation/release_notes.html#version-history
-  version = "0.19.6";
+  version = "0.20.0";
 
   disabled = pythonOlder "3.5";
 
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "Qiskit";
     repo = "qiskit";
     rev = version;
-    sha256 = "0liby6ffgrla6wr4k742qkg8m80im372p6hmr4gkz47nmc76zy1i";
+    sha256 = "1r23pjnql49gczf4k4m6ir5rr95gqdxjrks60p8a93d243mxx3c9";
   };
 
   propagatedBuildInputs = [
@@ -36,14 +36,21 @@ buildPythonPackage rec {
 
   checkInputs = [ pytestCheckHook ];
   dontUseSetuptoolsCheck = true;
-  # following doesn't work b/c they are distributed across different nix sitePackages dirs. Tested with pytest though.
-  pythonImportsCheck = [ "qiskit" "qiskit.circuit" "qiskit.ignis" "qiskit.providers.aer" "qiskit.aqua" ];
 
-  meta = {
+  pythonImportsCheck = [
+    "qiskit"
+    "qiskit.aqua"
+    "qiskit.circuit"
+    "qiskit.ignis"
+    "qiskit.providers.aer"
+  ];
+
+  meta = with lib; {
     description = "Software for developing quantum computing programs";
     homepage = "https://qiskit.org";
     downloadPage = "https://github.com/QISKit/qiskit/releases";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ drewrisinger pandaman ];
+    changelog = "https://qiskit.org/documentation/release_notes.html";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ drewrisinger pandaman ];
   };
 }
diff --git a/pkgs/development/python-modules/retworkx/default.nix b/pkgs/development/python-modules/retworkx/default.nix
index 309f3532cfc..49e4b1c2fc3 100644
--- a/pkgs/development/python-modules/retworkx/default.nix
+++ b/pkgs/development/python-modules/retworkx/default.nix
@@ -1,53 +1,60 @@
 { lib
-, buildPythonPackage
-, pythonOlder
-, pythonAtLeast
+, rustPlatform
 , python
+, fetchpatch
 , fetchFromGitHub
-, fetchPypi
+, pipInstallHook
+, maturin
+, pip
   # Check inputs
 , pytestCheckHook
+, numpy
 }:
-let
-  rx-version = "0.3.4";
 
-  wheel-hashes = {
-    "3.7" = { python = "cp37"; sha256 = "1hfrdj8svkfdraa299gcj18a601l4zn646fkgq7m56brpagssf9l"; };
-    "3.8" = { python = "cp38"; sha256 = "0jm10ywaqr0b456pcp01pb7035nawlndfi998jv8p1a2f5xwjgiq"; };
-  };
-  lookup = set: key: default: if (builtins.hasAttr key set) then (builtins.getAttr key set) else default;
-  wheel-args = lookup
-    wheel-hashes
-    python.pythonVersion
-    (throw "retworkx python version & hash not included. Override attribute `wheel-args` with version & hash at https://pypi.org/project/retworkx");
+rustPlatform.buildRustPackage rec {
+  pname = "retworkx";
+  version = "0.4.0";
 
-  github-source = fetchFromGitHub {
+  src = fetchFromGitHub {
     owner = "Qiskit";
     repo = "retworkx";
-    rev = rx-version;
-    sha256 = "0cd3x64y49q9a3jrkiknlfkiccxkxgl624x5pqk7gm34s1lnzl8h";
+    rev = version;
+    sha256 = "1xqp6d39apkjvd0ad9vw81cp2iqzhpagfa4p171xqm3bwfn2imdc";
   };
-in
-buildPythonPackage rec {
-  pname = "retworkx";
-  version = rx-version;
-  format = "wheel";
 
-  disabled = pythonOlder "3.5" || pythonAtLeast "3.9"; # compiled versions only included for 3.5 <= py <= 3.8
+  cargoSha256 = "0bma0l14jv5qhcsxck7vw3ak1w3c8v84cq4hii86i4iqk523zns5";
+  cargoPatches = [
+      ( fetchpatch {
+        name = "retworkx-cargo-lock.patch";
+        url = "https://github.com/Qiskit/retworkx/commit/a02fd33d357a92dbe9530696a6d85aa59fe8a5b9.patch";
+        sha256 = "0gvxr1nqp9ll4skfks4p4d964pshal25kb1nbfzhpyipnzddizr5";
+      } )
+  ];
 
-  src = fetchPypi {
-    inherit pname version format;
-    inherit (wheel-args) python sha256;
-    abi = if pythonOlder "3.8" then "${wheel-args.python}m" else wheel-args.python;
-    platform = "manylinux2010_x86_64"; # i686, aarch64, and ppc64 also available, restricting to x86 for simplicity
-  };
+  propagatedBuildInputs = [ python ];
+
+  nativeBuildInputs = [ pipInstallHook maturin pip ];
 
-  pythonImportsCheck = [ "retworkx" ];
+  # Need to check AFTER python wheel is installed (b/c using Rust Build, not buildPythonPackage)
+  doCheck = false;
+  doInstallCheck = true;
+
+  buildPhase = ''
+    runHook preBuild
+    maturin build --release --manylinux off --strip --interpreter ${python.interpreter}
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    install -Dm644 -t dist target/wheels/*.whl
+    pipInstallPhase
+  '';
 
-  checkInputs = [ pytestCheckHook ];
+  installCheckInputs = [ pytestCheckHook numpy ];
   preCheck = ''
-    pushd $(mktemp -d)
-    cp -r ${github-source}/$sourceRoot/tests .
+    export TESTDIR=$(mktemp -d)
+    cp -r $TMP/$sourceRoot/tests $TESTDIR
+    pushd $TESTDIR
   '';
   postCheck = "popd";
 
@@ -55,8 +62,8 @@ buildPythonPackage rec {
     description = "A python graph library implemented in Rust.";
     homepage = "https://retworkx.readthedocs.io/en/latest/index.html";
     downloadPage = "https://github.com/Qiskit/retworkx/releases";
+    changelog = "https://github.com/Qiskit/retworkx/releases/tag/${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ drewrisinger ];
-    platforms = platforms.x86_64;
   };
 }
diff --git a/pkgs/development/python-modules/urwid/default.nix b/pkgs/development/python-modules/urwid/default.nix
index 236b3a2e16f..36fe4b51495 100644
--- a/pkgs/development/python-modules/urwid/default.nix
+++ b/pkgs/development/python-modules/urwid/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchPypi, isPy27, glibcLocales }:
+{ stdenv, buildPythonPackage, fetchPypi, isPy3k, isPy27, glibcLocales }:
 
 buildPythonPackage rec {
   pname = "urwid";
@@ -14,6 +14,11 @@ buildPythonPackage rec {
   LC_ALL = "en_US.UTF-8";
   checkInputs = [ glibcLocales ];
 
+  # tests which assert on strings don't decode results correctly
+  doCheck = isPy3k;
+
+  pythonImportsCheck = [ "urwid" ];
+
   meta = with stdenv.lib; {
     description = "A full-featured console (xterm et al.) user interface library";
     homepage = "http://excess.org/urwid";
diff --git a/pkgs/development/python-modules/yfinance/default.nix b/pkgs/development/python-modules/yfinance/default.nix
new file mode 100644
index 00000000000..55068d3d5e6
--- /dev/null
+++ b/pkgs/development/python-modules/yfinance/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, multitasking
+, numpy
+, pandas
+, requests
+}:
+
+buildPythonPackage rec {
+  pname = "yfinance";
+  version = "0.1.54";
+
+  # GitHub source releases aren't tagged
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "cee223cbd31e14955869f7978bcf83776d644345c7dea31ba5d41c309bfb0d3d";
+  };
+
+  propagatedBuildInputs = [
+    multitasking
+    numpy
+    pandas
+    requests
+  ];
+
+  doCheck = false;  # Tests require internet access
+  pythonImportsCheck = [ "yfinance" ];
+
+  meta = with lib; {
+    description = "Yahoo! Finance market data downloader (+faster Pandas Datareader)";
+    homepage = "https://aroussi.com/post/python-yahoo-finance";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ drewrisinger ];
+  };
+}
diff --git a/pkgs/development/tools/alloy/default.nix b/pkgs/development/tools/alloy/default.nix
index ed91df066c3..44a6d7329ba 100644
--- a/pkgs/development/tools/alloy/default.nix
+++ b/pkgs/development/tools/alloy/default.nix
@@ -44,7 +44,7 @@ let generic = { major, version, src }:
       homepage = "http://alloytools.org/";
       downloadPage = "http://alloytools.org/download.html";
       license = licenses.mit;
-      platforms = platforms.linux;
+      platforms = platforms.unix;
       maintainers = with maintainers; [ notbandali ];
     };
   };
diff --git a/pkgs/development/tools/analysis/flow/default.nix b/pkgs/development/tools/analysis/flow/default.nix
index 60a7499c72d..a9ea826e2f6 100644
--- a/pkgs/development/tools/analysis/flow/default.nix
+++ b/pkgs/development/tools/analysis/flow/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flow";
-  version = "0.131.0";
+  version = "0.132.0";
 
   src = fetchFromGitHub {
     owner  = "facebook";
     repo   = "flow";
     rev    = "refs/tags/v${version}";
-    sha256 = "13a7gfsnfyssyi3b48s0d9k34rim493rarxd2rdyxyr4ir7jnb1p";
+    sha256 = "1080kf2zxhbgz1zhm54w3hqbbvwpfllapcq4pgwahfyvf6zb86d7";
   };
 
   installPhase = ''
diff --git a/pkgs/development/tools/continuous-integration/fly/default.nix b/pkgs/development/tools/continuous-integration/fly/default.nix
index 55a4434658f..34d30e08c50 100644
--- a/pkgs/development/tools/continuous-integration/fly/default.nix
+++ b/pkgs/development/tools/continuous-integration/fly/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "fly";
-  version = "6.4.1";
+  version = "6.5.0";
 
   src = fetchFromGitHub {
     owner = "concourse";
     repo = "concourse";
     rev = "v${version}";
-    sha256 = "16si1qm835yyvk2f0kwn9wnk8vpy5q4whgws1s2p6jr7dswg43h8";
+    sha256 = "0x8q1l56h24mmq01j3hib2qg0g44z82mxhmmljy8yv5s2iir0sfh";
   };
 
-  vendorSha256 = "0nv9q3j9cja8c6d7ac8fzb8zf82zz1z77f8cxvn3vxjki7fhlavm";
+  vendorSha256 = "1fxbxkg7disndlmb065abnfn7sn79qclkcbizmrq49f064w1ijr4";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/ginkgo/default.nix b/pkgs/development/tools/ginkgo/default.nix
new file mode 100644
index 00000000000..d3907718e9d
--- /dev/null
+++ b/pkgs/development/tools/ginkgo/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "ginkgo";
+  version = "1.14.0";
+
+  src = fetchFromGitHub {
+    owner = "onsi";
+    repo = "ginkgo";
+    rev = "v${version}";
+    sha256 = "0nwvz0pqk2jqscq88fhppad4flrr8avkxfgbci4xklbar4g8i32v";
+  };
+  vendorSha256 = "072amyw1ir18v9vk268j2y7dhw3lfwvxzvzsdqhnp50rxsa911bx";
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "BDD Testing Framework for Go";
+    homepage = "https://github.com/onsi/ginkgo";
+    license = licenses.mit;
+    maintainers = with maintainers; [ saschagrunert ];
+  };
+}
diff --git a/pkgs/development/tools/gopls/default.nix b/pkgs/development/tools/gopls/default.nix
index 85aab26e415..4ce65518a85 100644
--- a/pkgs/development/tools/gopls/default.nix
+++ b/pkgs/development/tools/gopls/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, go, buildGoModule, fetchgit }:
+{ stdenv, buildGoModule, fetchgit }:
 
 buildGoModule rec {
   pname = "gopls";
diff --git a/pkgs/development/tools/haskell/haskell-language-server/update.sh b/pkgs/development/tools/haskell/haskell-language-server/update.sh
index 498859843c4..002ccab4011 100755
--- a/pkgs/development/tools/haskell/haskell-language-server/update.sh
+++ b/pkgs/development/tools/haskell/haskell-language-server/update.sh
@@ -26,7 +26,7 @@ ghcide_old_version="$(sed -En 's/.*\bversion = "(.*?)".*/\1/p' "$ghcide_derivati
 # This is the revision of ghcide used by hls on GitHub.
 ghcide_new_version=$(curl --silent "https://api.github.com/repos/haskell/haskell-language-server/contents/ghcide" | jq '.sha' --raw-output)
 
-echo "Updating haskell-language-server from old version $ghcide_old_version to new version $ghcide_new_version."
+echo "Updating haskell-language-server's ghcide from old version $ghcide_old_version to new version $ghcide_new_version."
 echo "Running cabal2nix and outputting to ${ghcide_derivation_file}..."
 
 cabal2nix --revision "$ghcide_new_version" "https://github.com/wz1000/ghcide" > "$ghcide_derivation_file"
diff --git a/pkgs/development/tools/misc/terraform-ls/default.nix b/pkgs/development/tools/misc/terraform-ls/default.nix
index fe928bd3933..714416f9685 100644
--- a/pkgs/development/tools/misc/terraform-ls/default.nix
+++ b/pkgs/development/tools/misc/terraform-ls/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "terraform-ls";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0bb6bpdjp9yzbxvc6mz22lawn41ay0frdpgbd7zrm8nkvspc0rl7";
+    sha256 = "0yhpxb9dkwi6rlabr0sd5rk15q0bin6yhww171jrzlnfl036l0sl";
   };
 
   goPackagePath = "github.com/hashicorp/terraform-ls";
diff --git a/pkgs/development/tools/misc/terraformer/default.nix b/pkgs/development/tools/misc/terraformer/default.nix
new file mode 100644
index 00000000000..6ff0dd77aae
--- /dev/null
+++ b/pkgs/development/tools/misc/terraformer/default.nix
@@ -0,0 +1,24 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "terraformer";
+  version = "0.8.8";
+
+  src = fetchFromGitHub {
+    owner = "GoogleCloudPlatform";
+    repo = pname;
+    rev = version;
+    sha256 = "1lzf30vpa0blbkz4ngnhrn3hpbqflqd4sni4bly9yqh4fnc44nvi";
+  };
+
+  vendorSha256 = "087448wkaw6jxv9d26hck4w3vdh06vcgywna6ydkqvxr0hp011b6";
+
+  subPackages = [ "." ];
+
+  meta = with lib; {
+    description = "CLI tool to generate terraform files from existing infrastructure (reverse Terraform). Infrastructure to Code";
+    homepage = "https://github.com/GoogleCloudPlatform/terraformer";
+    license = licenses.asl20;
+    maintainers = [ maintainers.marsam ];
+  };
+}
diff --git a/pkgs/development/tools/open-policy-agent/default.nix b/pkgs/development/tools/open-policy-agent/default.nix
index c91727d6f11..d31a7e3ab60 100644
--- a/pkgs/development/tools/open-policy-agent/default.nix
+++ b/pkgs/development/tools/open-policy-agent/default.nix
@@ -2,14 +2,14 @@
 
 buildGoPackage rec {
   pname = "open-policy-agent";
-  version = "0.22.0";
+  version = "0.23.2";
 
   goPackagePath = "github.com/open-policy-agent/opa";
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "opa";
     rev = "v${version}";
-    sha256 = "1kndiiqf6b4j8zhv0ypjr9dfjgck25qiqa2bb0pmpm3j9460zzjs";
+    sha256 = "18hpanfrzg6xnq1g0yws6g0lw4y191pnrqphccv13j6kqk3k10ps";
   };
   goDeps = ./deps.nix;
 
diff --git a/pkgs/development/tools/rust/rust-analyzer/default.nix b/pkgs/development/tools/rust/rust-analyzer/default.nix
index 515ff94ac7a..c9c87991a8a 100644
--- a/pkgs/development/tools/rust/rust-analyzer/default.nix
+++ b/pkgs/development/tools/rust/rust-analyzer/default.nix
@@ -2,10 +2,10 @@
 
 {
   rust-analyzer-unwrapped = callPackage ./generic.nix rec {
-    rev = "2020-08-17";
+    rev = "2020-08-24";
     version = "unstable-${rev}";
-    sha256 = "1lkqhaygl6wak3hypmn3zb2h0v4n082xbpaywmzqr53vhw678sp0";
-    cargoSha256 = "00a2fxq1kwybng3gp33lkad4c7wrz0gypigxkalqkyy4nbg3qil4";
+    sha256 = "11q5shrq55krgpj7rjfqw84131j5g55zyrwww3cxcbr8ndi3xdnf";
+    cargoSha256 = "15kjcgxmigm0lwbp8p0kdxax86ldjqq9q8ysj6khfhqd0173184n";
   };
 
   rust-analyzer = callPackage ./wrapper.nix {} {
diff --git a/pkgs/development/tools/skaffold/default.nix b/pkgs/development/tools/skaffold/default.nix
index 032f64bc348..a100988aead 100644
--- a/pkgs/development/tools/skaffold/default.nix
+++ b/pkgs/development/tools/skaffold/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "skaffold";
-  version = "1.13.1";
+  version = "1.13.2";
 
   goPackagePath = "github.com/GoogleContainerTools/skaffold";
   subPackages = ["cmd/skaffold"];
@@ -19,7 +19,7 @@ buildGoPackage rec {
     owner = "GoogleContainerTools";
     repo = "skaffold";
     rev = "v${version}";
-    sha256 = "1v6napcpx8k45s8w55lbxahfc1p0qlvl597zgb4dzyg9w67fwnqk";
+    sha256 = "0xicf4bf52fnnwaimxrxv16x15lcmw12a5rrl0xjm4p059jnvy54";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/development/tools/vagrant/0004-Support-system-installed-plugins.patch b/pkgs/development/tools/vagrant/0004-Support-system-installed-plugins.patch
index f87ff5135b3..fa6555c594e 100644
--- a/pkgs/development/tools/vagrant/0004-Support-system-installed-plugins.patch
+++ b/pkgs/development/tools/vagrant/0004-Support-system-installed-plugins.patch
@@ -1,7 +1,7 @@
 From: Antonio Terceiro <terceiro@debian.org>
 Date: Wed, 27 May 2015 09:36:17 -0300
 Subject: Support system-installed plugins
-Source: https://salsa.debian.org/ruby-team/vagrant/blob/cb672c6dc0c63f6552c5ec4d6d7d22929d353503/debian/patches/0004-Support-system-installed-plugins.patch
+Source: https://salsa.debian.org/ruby-team/vagrant/-/blob/9d86f222/debian/patches/0004-Support-system-installed-plugins.patch
 
 Plugins must be installed as regular Ruby libraries, and they must
 contain /usr/share/vagrant-plugins/plugins.d/$PLUGINNAME.json with the
@@ -22,7 +22,7 @@ following content:
  2 files changed, 23 insertions(+), 3 deletions(-)
 
 diff --git a/lib/vagrant/plugin/manager.rb b/lib/vagrant/plugin/manager.rb
-index 567347d..d9d76a0 100644
+index 9058e68..2772131 100644
 --- a/lib/vagrant/plugin/manager.rb
 +++ b/lib/vagrant/plugin/manager.rb
 @@ -18,7 +18,7 @@ module Vagrant
@@ -80,7 +80,7 @@ index c6872d4..935d431 100644
        end
  
        # Add a plugin that is installed to the state file.
-@@ -107,6 +123,14 @@ module Vagrant
+@@ -107,6 +123,10 @@ module Vagrant
            f.close
            FileUtils.mv(f.path, @path)
          end
@@ -88,10 +88,6 @@ index c6872d4..935d431 100644
 +        # Ignore permission denied against system-installed plugins; regular
 +        # users are not supposed to write there.
 +        raise unless @system
-+      rescue Errno::EROFS
-+        # Ignore read-only filesystem against system-installed plugins; regular
-+        # users are not supposed to write there.
-+        raise unless @system
        end
  
        protected
diff --git a/pkgs/development/tools/vagrant/default.nix b/pkgs/development/tools/vagrant/default.nix
index 338e8f68d35..4e2930f97a2 100644
--- a/pkgs/development/tools/vagrant/default.nix
+++ b/pkgs/development/tools/vagrant/default.nix
@@ -5,9 +5,9 @@
 let
   # NOTE: bumping the version and updating the hash is insufficient;
   # you must use bundix to generate a new gemset.nix in the Vagrant source.
-  version = "2.2.9";
+  version = "2.2.10";
   url = "https://github.com/hashicorp/vagrant/archive/v${version}.tar.gz";
-  sha256 = "0fbickjjliaw3cpkh3pl9bp56b2gcqn87c5ag67amc450ah43rdq";
+  sha256 = "07wlj4m79m9li3za1jkk4imdhqwpca86qz3c0h706s0w8cmv4bbj";
 
   deps = bundlerEnv rec {
     name = "${pname}-${version}";
@@ -54,13 +54,6 @@ in buildRubyGem rec {
     ./unofficial-installation-nowarn.patch
     ./use-system-bundler-version.patch
     ./0004-Support-system-installed-plugins.patch
-
-    # fix deprecation warning on ruby 2.6.5.
-    # See also https://github.com/hashicorp/vagrant/pull/11307
-    (fetchpatch {
-      url = "https://github.com/hashicorp/vagrant/commit/d18ed567aaa5da23c9e91ab87f360e7bf6760f13.patch";
-      sha256 = "0f61qj41rc3fdggmnha4jrqg4pzmfiriwpsz4fcgf7c0bx6qha7q";
-    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/tools/vagrant/gemset.nix b/pkgs/development/tools/vagrant/gemset.nix
index 00838c6e0c5..3c22b74efed 100644
--- a/pkgs/development/tools/vagrant/gemset.nix
+++ b/pkgs/development/tools/vagrant/gemset.nix
@@ -24,20 +24,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ic028k8xgm2dds9mqnvwwx3ibaz32j8455zxr9f4bcnviyahya5";
+      sha256 = "08hd3d2lfi19cns4d6wkq51scasn17l83fgbzbjjk3dqccz4rg3j";
       type = "gem";
     };
-    version = "3.0.0";
+    version = "4.0.0";
   };
   concurrent-ruby = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "094387x4yasb797mv07cs3g6f08y56virc2rjcpb1k79rzaj3nhl";
+      sha256 = "1vnxrbhi7cq3p4y2v9iwd10v1c7l15is4var14hwnb2jip4fyjzz";
       type = "gem";
     };
-    version = "1.1.6";
+    version = "1.1.7";
   };
   domain_name = {
     dependencies = ["unf"];
@@ -149,21 +149,21 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10nq1xjqvkhngiygji831qx9bryjwws95r4vrnlq9142bzkg670s";
+      sha256 = "153sx77p16vawrs4qpkv7qlzf9v5fks4g7xqcj1dwk40i6g7rfzk";
       type = "gem";
     };
-    version = "1.8.3";
+    version = "1.8.5";
   };
   listen = {
-    dependencies = ["rb-fsevent" "rb-inotify" "ruby_dep"];
+    dependencies = ["rb-fsevent" "rb-inotify"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "01v5mrnfqm6sgm8xn2v5swxsn1wlmq7rzh2i48d4jzjsc7qvb6mx";
+      sha256 = "1w923wmdi3gyiky0asqdw5dnh3gcjs2xyn82ajvjfjwh6sn0clgi";
       type = "gem";
     };
-    version = "3.1.5";
+    version = "3.2.1";
   };
   little-plugger = {
     groups = ["default"];
@@ -191,10 +191,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "06j6iaj89h9jhkx1x3hlswqrfnqds8br05xb1qra69dpvbdmjcwn";
+      sha256 = "0pkmhcxi8lp74bq5gz9lxrvaiv5w0745kk7s4bw2b1x07qqri0n9";
+      type = "gem";
+    };
+    version = "2.3.0";
+  };
+  mime = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0nskys7brz2bylhxiknl0z9i19w3wb1knf0h93in6mjq70jdw5cr";
       type = "gem";
     };
-    version = "2.2.2";
+    version = "0.4.4";
   };
   mime-types = {
     dependencies = ["mime-types-data"];
@@ -222,10 +232,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0xy54mjf7xg41l8qrg1bqri75agdqmxap9z466fjismc1rn2jwfr";
+      sha256 = "0pb1g1y3dsiahavspyzkdy39j4q377009f6ix0bh1ag4nqw43l0z";
       type = "gem";
     };
-    version = "1.14.1";
+    version = "1.15.0";
   };
   net-scp = {
     dependencies = ["net-ssh"];
@@ -244,20 +254,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "04674g4n6mryjajlcd82af8g8k95la4b1bj712dh71hw1c9vhw1y";
+      sha256 = "185vsybznqgqbb4i2qnxvf1gam8lb634nqcrq7r3i2zy1g6xd8mi";
       type = "gem";
     };
-    version = "2.1.2";
+    version = "3.0.0";
   };
   net-ssh = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "101wd2px9lady54aqmkibvy4j62zk32w0rjz4vnigyg974fsga40";
+      sha256 = "0jp3jgcn8cij407xx9ldb5h9c6jv13jc4cf6kk2idclz43ww21c9";
       type = "gem";
     };
-    version = "5.2.0";
+    version = "6.1.0";
   };
   netrc = {
     groups = ["default"];
diff --git a/pkgs/development/tools/vagrant/use-system-bundler-version.patch b/pkgs/development/tools/vagrant/use-system-bundler-version.patch
index c386acf4a1c..8262220140a 100644
--- a/pkgs/development/tools/vagrant/use-system-bundler-version.patch
+++ b/pkgs/development/tools/vagrant/use-system-bundler-version.patch
@@ -1,8 +1,8 @@
-diff --git i/lib/vagrant/bundler.rb w/lib/vagrant/bundler.rb
-index 301e40e37..e361ab510 100644
---- i/lib/vagrant/bundler.rb
-+++ w/lib/vagrant/bundler.rb
-@@ -217,7 +217,7 @@ module Vagrant
+diff --git a/lib/vagrant/bundler.rb b/lib/vagrant/bundler.rb
+index 336ac1e05..1bfd84c0d 100644
+--- a/lib/vagrant/bundler.rb
++++ b/lib/vagrant/bundler.rb
+@@ -470,7 +470,7 @@ module Vagrant
        source_list = {}
        system_plugins = plugins.map do |plugin_name, plugin_info|
          plugin_name if plugin_info["system"]
diff --git a/pkgs/games/katago/default.nix b/pkgs/games/katago/default.nix
index 492ccbb63ab..c0fe7d28225 100644
--- a/pkgs/games/katago/default.nix
+++ b/pkgs/games/katago/default.nix
@@ -13,17 +13,25 @@
 , opencl-headers ? null
 , ocl-icd ? null
 , gperftools ? null
+, eigen ? null
+, gpuEnabled ? true
+, useAVX2 ? false
 , cudaSupport ? false
 , useTcmalloc ? true}:
 
+assert !gpuEnabled -> (
+  eigen != null &&
+  !cudaSupport);
+
 assert cudaSupport -> (
   libGL_driver != null &&
   cudatoolkit != null &&
   cudnn != null);
 
 assert !cudaSupport -> (
-  opencl-headers != null &&
-  ocl-icd != null);
+  !gpuEnabled || (
+    opencl-headers != null &&
+    ocl-icd != null));
 
 assert useTcmalloc -> (
   gperftools != null);
@@ -35,13 +43,13 @@ let
 
 in env.mkDerivation rec {
   pname = "katago";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "lightvector";
     repo = "katago";
-    rev = "${version}";
-    sha256 = "0ajdjdmlzwh7zwk5v0k9zzjawgkf7w30pzqp5bhcsdqz4svvyll2";
+    rev = "v${version}";
+    sha256 = "1r84ws2rj7j8085v1cqffy9rg65rzrhk6z8jbxivqxsmsgs2zs48";
   };
 
   nativeBuildInputs = [
@@ -52,10 +60,12 @@ in env.mkDerivation rec {
   buildInputs = [
     libzip
     boost
-  ] ++ lib.optionals cudaSupport [
+  ] ++ lib.optionals (!gpuEnabled) [
+    eigen
+  ] ++ lib.optionals (gpuEnabled && cudaSupport) [
     cudnn
     libGL_driver
-  ] ++ lib.optionals (!cudaSupport) [
+  ] ++ lib.optionals (gpuEnabled && !cudaSupport) [
     opencl-headers
     ocl-icd
   ] ++ lib.optionals useTcmalloc [
@@ -64,9 +74,13 @@ in env.mkDerivation rec {
 
   cmakeFlags = [
     "-DNO_GIT_REVISION=ON"
-  ] ++ lib.optionals cudaSupport [
+  ] ++ lib.optionals (!gpuEnabled) [
+    "-DUSE_BACKEND=EIGEN"
+  ] ++ lib.optionals useAVX2 [
+    "-DUSE_AVX2=ON"
+  ] ++ lib.optionals (gpuEnabled && cudaSupport) [
     "-DUSE_BACKEND=CUDA"
-  ] ++ lib.optionals (!cudaSupport) [
+  ] ++ lib.optionals (gpuEnabled && !cudaSupport) [
     "-DUSE_BACKEND=OPENCL"
   ] ++ lib.optionals useTcmalloc [
     "-DUSE_TCMALLOC=ON"
diff --git a/pkgs/games/osu-lazer/default.nix b/pkgs/games/osu-lazer/default.nix
index 59e044b482b..074c24389a1 100644
--- a/pkgs/games/osu-lazer/default.nix
+++ b/pkgs/games/osu-lazer/default.nix
@@ -13,13 +13,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "osu-lazer";
-  version = "2020.806.0";
+  version = "2020.820.0";
 
   src = fetchFromGitHub {
     owner = "ppy";
     repo = "osu";
     rev = version;
-    sha256 = "BelmqcDnrGH84fTs6M0krwWz6SHn2hOm7y+PNEOOOZM=";
+    sha256 = "0vszw0f5x0syshn8bnsbskxvknwpgbnm31kxwh1mfdr7pnxvw922";
   };
 
   patches = [ ./bypass-tamper-detection.patch ];
diff --git a/pkgs/games/osu-lazer/deps.nix b/pkgs/games/osu-lazer/deps.nix
index c29035e5724..53f933d143b 100644
--- a/pkgs/games/osu-lazer/deps.nix
+++ b/pkgs/games/osu-lazer/deps.nix
@@ -281,8 +281,8 @@
   })
   (fetchNuGet {
     name = "Markdig";
-    version = "0.20.0";
-    sha256 = "19qhvyj59i8zcxblpl4vqabb55y5xrk3iipmb656mid1b1m4jfkn";
+    version = "0.21.1";
+    sha256 = "119v22rvg51ifg54r1ndf2bw7hv1lf5wn3cd04ccg8d7r8c0yhbk";
   })
   (fetchNuGet {
     name = "Microsoft.Bcl.AsyncInterfaces";
@@ -306,23 +306,23 @@
   })
   (fetchNuGet {
     name = "Microsoft.CodeAnalysis.BannedApiAnalyzers";
-    version = "3.0.0";
-    sha256 = "19zfz84c1860na8qpkzv6va6d7dh1md9wkrb7c6x3brhjnj859hk";
+    version = "3.3.0";
+    sha256 = "04z03ir9sal5h9ha97isbh660jijslb8zfiaa48w2r2l6pabz5kd";
   })
   (fetchNuGet {
     name = "Microsoft.CodeAnalysis.Common";
-    version = "3.6.0";
-    sha256 = "0i8x90700jr30j580mpawj6d90fngrb2zpkjjbn7f8r2p1mz75y7";
+    version = "3.7.0";
+    sha256 = "0882492nx6x68b0pkh3q5xaawz0b2l5x35r40722ignyjnvjydph";
   })
   (fetchNuGet {
     name = "Microsoft.CodeAnalysis.CSharp";
-    version = "3.6.0";
-    sha256 = "0c44qp7lfpja6cq5nk7851qrswm2z1k2pnvsw43j9ybf10a27jrn";
+    version = "3.7.0";
+    sha256 = "0adw6rcag8wxydzyiyhls2mxaqkay5qlz25z1fxrlv5qnchqn0n5";
   })
   (fetchNuGet {
     name = "Microsoft.CodeAnalysis.CSharp.Workspaces";
-    version = "3.6.0";
-    sha256 = "1zc9328invqqpisdljw5vpm1kk416prfczakakw1vwkv9r54sd73";
+    version = "3.7.0";
+    sha256 = "15rlz65wbky0yq7b9s8xwk68dgrhgsk4rj88q9pyjxbm5938vrav";
   })
   (fetchNuGet {
     name = "Microsoft.CodeAnalysis.FxCopAnalyzers";
@@ -336,13 +336,13 @@
   })
   (fetchNuGet {
     name = "Microsoft.CodeAnalysis.Workspaces.Common";
-    version = "3.6.0";
-    sha256 = "176faadh1k9xcc8cc2qpkka9j1n426fdff1ax5ikmz2hbrspmigz";
+    version = "3.7.0";
+    sha256 = "00nm453w4n6kjsicmz5izvkf1ki9rp3xnc9n3y7a9b1g5sxg36fs";
   })
   (fetchNuGet {
     name = "Microsoft.CodeAnalysis.Workspaces.MSBuild";
-    version = "3.6.0";
-    sha256 = "0hxs9x5gpi7yvqf46bxh9niipb0jif7ak5baxw5l920787vysdhc";
+    version = "3.7.0";
+    sha256 = "1sh8s7b16j06p3gmzsgwd8690vagah4908bpa3gyz2fxgfnj46ax";
   })
   (fetchNuGet {
     name = "Microsoft.CodeQuality.Analyzers";
@@ -586,8 +586,8 @@
   })
   (fetchNuGet {
     name = "ppy.osu.Framework";
-    version = "2020.806.0";
-    sha256 = "1d4aprz81xbhk5addl1n7jwj8xxny51s6nvpn37alld0x6n7k8nv";
+    version = "2020.819.0";
+    sha256 = "1ghbbwpjjl0dp6gs1638v880hr7wwrn2jklqwbbckpx8g57bnq2m";
   })
   (fetchNuGet {
     name = "ppy.osu.Framework.NativeLibs";
@@ -596,8 +596,8 @@
   })
   (fetchNuGet {
     name = "ppy.osu.Game.Resources";
-    version = "2020.731.0";
-    sha256 = "1q58c627p0yz6b2y4c1hrrr4l9hii418y1vk6hv24x1csdsf3x8p";
+    version = "2020.812.0";
+    sha256 = "0fsg47bsffvk16clwwwav4yly1ykn09pyap46dvdmsxhjrzkvzb7";
   })
   (fetchNuGet {
     name = "ppy.osuTK.NS20";
diff --git a/pkgs/games/papermc/default.nix b/pkgs/games/papermc/default.nix
index 9695a350058..c5f7dc37925 100644
--- a/pkgs/games/papermc/default.nix
+++ b/pkgs/games/papermc/default.nix
@@ -1,10 +1,10 @@
-{ stdenv, fetchurl, jre }:
+{ stdenv, fetchurl, bash, jre }:
 let
-  mcVersion = "1.15.2";
-  buildNum = "161";
+  mcVersion = "1.16.2";
+  buildNum = "141";
   jar = fetchurl {
     url = "https://papermc.io/api/v1/paper/${mcVersion}/${buildNum}/download";
-    sha256 = "1jngj5djs1fjdj25wg9iszw0dsp56f386j8ydms7x4ky8s8kxyms";
+    sha256 = "1qhhnaysw9r73fpvj9qcmjah722a6a4s6g4cblna56n1hpz4lw1s";
   };
 in stdenv.mkDerivation {
   pname = "papermc";
@@ -13,22 +13,23 @@ in stdenv.mkDerivation {
   preferLocalBuild = true;
 
   dontUnpack = true;
-  installPhase = ''
-    mkdir -p $out/bin
-    cp ${jar} $out/papermc.jar
-    cat > $out/bin/minecraft-server << EOF
-    #!/bin/sh
-    exec ${jre}/bin/java \$@ -jar $out/papermc.jar nogui
-    EOF
-    chmod +x $out/bin/minecraft-server
+  dontConfigure = true;
+
+  buildPhase = ''
+    cat > minecraft-server << EOF
+    #!${bash}/bin/sh
+    exec ${jre}/bin/java \$@ -jar $out/share/papermc/papermc.jar nogui
   '';
 
-  phases = "installPhase";
+  installPhase = ''
+    install -Dm444 ${jar} $out/share/papermc/papermc.jar
+    install -Dm555 -t $out/bin minecraft-server
+  '';
 
   meta = {
     description = "High-performance Minecraft Server";
     homepage    = "https://papermc.io/";
-    license     = stdenv.lib.licenses.gpl3;
+    license     = stdenv.lib.licenses.gpl3Only;
     platforms   = stdenv.lib.platforms.unix;
     maintainers = with stdenv.lib.maintainers; [ aaronjanse ];
   };
diff --git a/pkgs/games/shattered-pixel-dungeon/default.nix b/pkgs/games/shattered-pixel-dungeon/default.nix
index 76f6ecfb81a..6626e4df8a2 100644
--- a/pkgs/games/shattered-pixel-dungeon/default.nix
+++ b/pkgs/games/shattered-pixel-dungeon/default.nix
@@ -10,13 +10,13 @@
 
 let
   pname = "shattered-pixel-dungeon";
-  version = "0.8.2";
+  version = "0.8.2b";
 
   src = fetchFromGitHub {
     owner = "00-Evan";
     repo = "shattered-pixel-dungeon";
     rev = "v${version}";
-    sha256 = "1ra697237vnpx8nsy7dzk958vlyf6jpx1k5dpbr8ybg6vgc3kqx3";
+    sha256 = "02ksxm7iknxfc7l8dl2pr1kyhfmi7vkchz0lh46w3p5mqf82psfb";
   };
 
   postPatch = ''
diff --git a/pkgs/games/xcowsay/default.nix b/pkgs/games/xcowsay/default.nix
new file mode 100644
index 00000000000..dd95bf1e5a1
--- /dev/null
+++ b/pkgs/games/xcowsay/default.nix
@@ -0,0 +1,40 @@
+{ stdenv, fetchurl, makeWrapper, pkg-config
+, dbus, dbus-glib, gtk3, gdk-pixbuf, librsvg
+, fortune
+}:
+
+stdenv.mkDerivation rec {
+  pname = "xcowsay";
+  version = "1.5";
+
+  src = fetchurl {
+    url = "http://www.nickg.me.uk/files/xcowsay-${version}.tar.gz";
+    sha256 = "0pyaa062z1ag26dhkm1yzp2hivnlmhlpqn5xg7mx9r1m652mm91y";
+  };
+
+  buildInputs = [
+    dbus
+    dbus-glib
+    gtk3
+    gdk-pixbuf # loading cow images
+    librsvg # dreaming SVG images
+  ];
+  nativeBuildInputs = [ makeWrapper pkg-config ];
+
+  configureFlags = [ "--enable-dbus" ];
+
+  postInstall = ''
+    for tool in xcowdream xcowsay xcowthink xcowfortune; do
+      wrapProgram $out/bin/$tool \
+        --prefix PATH : $out/bin:${fortune}/bin
+    done
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "http://www.doof.me.uk/xcowsay";
+    description =
+      "A program based on cowsay that displays a cute cow and message on your desktop";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ das_j ];
+  };
+}
diff --git a/pkgs/misc/ghostscript/default.nix b/pkgs/misc/ghostscript/default.nix
index eca15faf1ad..d3d06d98cb1 100644
--- a/pkgs/misc/ghostscript/default.nix
+++ b/pkgs/misc/ghostscript/default.nix
@@ -45,6 +45,11 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
+    (fetchpatch {
+      name = "CVE-2020-15900.patch";
+      url = "https://github.com/ArtifexSoftware/ghostpdl/commit/5d499272b95a6b890a1397e11d20937de000d31b.patch";
+      sha256 = "1nnnrn8q33x7nc8227ygc60f3mj4bjzrhj40sxp6dah58rb5x5jz";
+    })
     ./urw-font-files.patch
     ./doc-no-ref.diff
     # rebased version of upstream http://git.ghostscript.com/?p=ghostpdl.git;a=patch;h=1b4c3669a20c,
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 36277dd74cd..824eb1a6966 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -1,22 +1,22 @@
 {
     "4.14": {
-        "name": "linux-hardened-4.14.193.a.patch",
-        "sha256": "0hxr4v6ph29p0916dh894aknna5qxszcpz5xrci81xla3i50vy9v",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.193.a/linux-hardened-4.14.193.a.patch"
+        "name": "linux-hardened-4.14.194.a.patch",
+        "sha256": "07z3lr3mbm6c95d7fra2qp071n1c45f9241cl19zs63g00avi11p",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.194.a/linux-hardened-4.14.194.a.patch"
     },
     "4.19": {
-        "name": "linux-hardened-4.19.140.a.patch",
-        "sha256": "03y0kp89wka9bjw44y2jqralnwi7rjxbgm7wym1ad5yqd4q29l4d",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.140.a/linux-hardened-4.19.140.a.patch"
+        "name": "linux-hardened-4.19.141.a.patch",
+        "sha256": "0yiqkkp17pf9r6nakpnqhvmf8awpzp5n27cmh15ril7vn1y71sxw",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.141.a/linux-hardened-4.19.141.a.patch"
     },
     "5.4": {
-        "name": "linux-hardened-5.4.59.a.patch",
+        "name": "linux-hardened-5.4.60.a.patch",
         "sha256": "138kms73rlj5zmsb2ivjzz1jr5aa8y8pmwzx02c7j1qk08v82823",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.59.a/linux-hardened-5.4.59.a.patch"
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.60.a/linux-hardened-5.4.60.a.patch"
     },
     "5.7": {
-        "name": "linux-hardened-5.7.16.a.patch",
-        "sha256": "1fiyd6qsf8r84p05cxhwma7zwi81xyn9pl6yci93n583z8n1k2sw",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.7.16.a/linux-hardened-5.7.16.a.patch"
+        "name": "linux-hardened-5.7.17.a.patch",
+        "sha256": "181b473y0hkw076hsndw6nfynr2yhcaypj48iqnk25hzcj40nnaz",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.7.17.a/linux-hardened-5.7.17.a.patch"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-5.8.nix b/pkgs/os-specific/linux/kernel/linux-5.8.nix
index a7b929740d2..44ce98ce65e 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.8.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.8.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.8";
+  version = "5.8.3";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1xgibkwb1yfl6qdlbxyagai0qc1pk5ark7giz1512hh6ma353xz7";
+    sha256 = "0y8prifvkywqsx5lk80bh31m505vinmicpvdrirgg0c9scg7x8lf";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 6cd63e0be6b..cf2ca99f6f5 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.9-rc1";
+  version = "5.9-rc2";
   extraMeta.branch = "5.9";
 
   # modDirVersion needs to be x.y.z, will always add .0
@@ -11,7 +11,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "08x6s4wydbrr4rqq3zfxq6qmnha4ikn7m9rmdqd42hmxl2ynqxla";
+    sha256 = "0mdh6gsd305kcgfqzyfgl5m886asjm5030ahg63gyias3ywzn5wd";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/os-specific/linux/rfkill/default.nix b/pkgs/os-specific/linux/rfkill/default.nix
deleted file mode 100644
index 10d46a84821..00000000000
--- a/pkgs/os-specific/linux/rfkill/default.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{ stdenv, fetchurl }:
-
-stdenv.mkDerivation rec {
-  name = "rfkill-0.5";
-
-  src = fetchurl {
-    url = "mirror://kernel/software/network/rfkill/${name}.tar.bz2";
-    sha256 = "01zs7p9kd92pxgcgwl5w46h3iyx4acfg6m1j5fgnflsaa350q5iy";
-  };
-
-  makeFlags = [ "PREFIX=$(out)" ];
-
-  meta = with stdenv.lib; {
-    homepage = "http://wireless.kernel.org/en/users/Documentation/rfkill";
-    description = "A tool to query, enable and disable wireless devices";
-    platforms = platforms.linux;
-    maintainers = [ maintainers.eelco ];
-    license = licenses.isc;
-  };
-}
diff --git a/pkgs/servers/etcd/3.4.nix b/pkgs/servers/etcd/3.4.nix
index db7bb5c939b..be52b1bf1a5 100644
--- a/pkgs/servers/etcd/3.4.nix
+++ b/pkgs/servers/etcd/3.4.nix
@@ -2,21 +2,18 @@
 
 buildGoModule rec {
   pname = "etcd";
-  version = "3.4.10";
+  version = "3.4.13";
 
-  #vendorSha256 = null; revert to `null` for > 3.4.10
-
-  vendorSha256 = "1fhrycl8m8ddb7mwasbyfiwrl4d9lfdk7zd3mxb7ahkipdp2c94z";
+  deleteVendor = true;
+  vendorSha256 = "0jlnh4789xa2dhbyp33k9r278kc588ykggamnnfqivb27s2646bc";
 
   doCheck = false;
 
-  deleteVendor = true;
-
   src = fetchFromGitHub {
     owner = "etcd-io";
     repo = "etcd";
     rev = "v${version}";
-    sha256 = "07kzgh2rm7kzprlpnay6fq8lziiyhiqyikf1qjx8gjjsdsjy180f";
+    sha256 = "0bvky593241i60qf6793sxzsxwfl3f56cgscnva9f2jfhk157wmy";
   };
 
   buildPhase = ''
diff --git a/pkgs/servers/http/nginx/mainline.nix b/pkgs/servers/http/nginx/mainline.nix
index c67606785e5..de74a72e788 100644
--- a/pkgs/servers/http/nginx/mainline.nix
+++ b/pkgs/servers/http/nginx/mainline.nix
@@ -1,6 +1,6 @@
 { callPackage, ... }@args:
 
 callPackage ./generic.nix args {
-  version = "1.19.0";
-  sha256 = "1j1n3rlvan6l9j3vw8axbbdm96w7s0x6ygmgqvbplzfd3wbid9j4";
+  version = "1.19.2";
+  sha256 = "0wr4ss4gld7x717m4j3a6l6f7ijblrrd55y563lkwhvr7sqpn7vw";
 }
diff --git a/pkgs/servers/http/nginx/modules.nix b/pkgs/servers/http/nginx/modules.nix
index 9fcb3305f0a..983e0f41ee9 100644
--- a/pkgs/servers/http/nginx/modules.nix
+++ b/pkgs/servers/http/nginx/modules.nix
@@ -4,10 +4,11 @@ let
 
   http_proxy_connect_module_generic = patchName: rec {
     src = fetchFromGitHub {
+      name = "http_proxy_connect_module_generic";
       owner = "chobits";
       repo = "ngx_http_proxy_connect_module";
-      rev = "002f8f9ef15562dc3691b977134518ad216d7a90";
-      sha256 = "163wg0xb7w5mwh6wrfarzcgaf6c7gb5qydgpi2wk35k551f7286s";
+      rev = "96ae4e06381f821218f368ad0ba964f87cbe0266";
+      sha256 = "1nc7z31i7x9dzp67kzgvs34hs6ps749y26wcpi3wf5mm63i803rh";
     };
 
     patches = [
@@ -18,12 +19,26 @@ let
 in
 
 {
+  fastcgi-cache-purge = throw "fastcgi-cache-purge was renamed to cache-purge";
+  ngx_aws_auth = throw "fastcgi-cache-purge was renamed to aws-auth";
+
+  aws-auth = {
+    src = fetchFromGitHub {
+      name = "aws-auth";
+      owner = "anomalizer";
+      repo = "ngx_aws_auth";
+      rev = "2.1.1";
+      sha256 = "10z67g40w7wpd13fwxyknkbg3p6hn61i4v8xw6lh27br29v1y6h9";
+    };
+  };
+
   brotli = {
     src = let gitsrc = pkgs.fetchFromGitHub {
+      name = "brotli";
       owner = "google";
       repo = "ngx_brotli";
-      rev = "e505dce68acc190cc5a1e780a3b0275e39f160ca";
-      sha256 = "00j48lffki62y1nmjyy81iklw5nlyzvrjy3z04qch4fp3p57hwla";
+      rev = "25f86f0bac1101b6512135eac5f93c49c63609e3";
+      sha256 = "02hfvfa6milj40qc2ikpb9f95sxqvxk4hly3x74kqhysbdi06hhv";
     }; in pkgs.runCommandNoCC "ngx_brotli-src" {} ''
       cp -a ${gitsrc} $out
       substituteInPlace $out/filter/config \
@@ -32,8 +47,19 @@ in
     inputs = [ pkgs.brotli ];
   };
 
+  cache-purge = {
+    src = fetchFromGitHub {
+      name = "cache-purge";
+      owner  = "nginx-modules";
+      repo   = "ngx_cache_purge";
+      rev    = "2.5.1";
+      sha256 = "0va4jz36mxj76nmq05n3fgnpdad30cslg7c10vnlhdmmic9vqncd";
+    };
+  };
+
   coolkit = {
     src = fetchFromGitHub {
+      name = "coolkit";
       owner  = "FRiCKLE";
       repo   = "ngx_coolkit";
       rev    = "0.2";
@@ -43,6 +69,7 @@ in
 
   dav = {
     src = fetchFromGitHub {
+      name = "dav";
       owner = "arut";
       repo = "nginx-dav-ext-module";
       rev = "v3.0.0";
@@ -53,24 +80,27 @@ in
 
   develkit = {
     src = fetchFromGitHub {
-      owner = "simpl";
+      name = "develkit";
+      owner = "vision5";
       repo = "ngx_devel_kit";
-      rev = "v0.3.1rc1";
-      sha256 = "00vqvpx67qra2hr85hkvj1dha4h7x7v9sblw7w1df11nq1gzsdbb";
+      rev = "v0.3.1";
+      sha256 = "1c5zfpvm0hrd9lp8rasmw79dnr2aabh0i6y11wzb783bp8m3p2sq";
     };
   };
 
   echo = {
     src = fetchFromGitHub {
+      name = "echo";
       owner = "openresty";
       repo = "echo-nginx-module";
-      rev = "v0.61";
-      sha256 = "0brjhhphi94ms4gia7za0mfx0png4jbhvq6j0nzjwp537iyiy23k";
+      rev = "v0.62";
+      sha256 = "0kr1y094yw1a9fyrf4w73ikq18w5ys463wza9n7yfl77xdwirnvl";
     };
   };
 
   fancyindex = {
     src = fetchFromGitHub {
+      name = "fancyindex";
       owner = "aperezdc";
       repo = "ngx-fancyindex";
       rev = "v0.4.4";
@@ -78,17 +108,9 @@ in
     };
   };
 
-  fastcgi-cache-purge = {
-    src = fetchFromGitHub {
-      owner  = "nginx-modules";
-      repo   = "ngx_cache_purge";
-      rev    = "2.5";
-      sha256 = "1f4kxagzvz10vqbcjwi57wink6xw3s1h7wlrrlrlpkmhfbf9704y";
-    };
-  };
-
   fluentd = {
     src = fetchFromGitHub {
+      name = "fluentd";
       owner = "fluent";
       repo = "nginx-fluentd-module";
       rev = "8af234043059c857be27879bc547c141eafd5c13";
@@ -96,12 +118,17 @@ in
     };
   };
 
-  http_proxy_connect_module_v16 = http_proxy_connect_module_generic "proxy_connect_rewrite_101504" // {
-    supports = with lib.versions; version: major version == "1" && minor version == "16";
+  http_proxy_connect_module_v18 = http_proxy_connect_module_generic "proxy_connect_rewrite_1018" // {
+    supports = with lib.versions; version: major version == "1" && minor version == "18";
+  };
+
+  http_proxy_connect_module_v19 = http_proxy_connect_module_generic "proxy_connect_rewrite_1018" // {
+    supports = with lib.versions; version: major version == "1" && minor version == "19";
   };
 
   ipscrub = {
     src = fetchFromGitHub {
+      name = "ipscrub";
       owner = "masonicboom";
       repo = "ipscrub";
       rev = "v1.0.1";
@@ -112,6 +139,7 @@ in
 
   limit-speed = {
     src = fetchFromGitHub {
+      name = "limit-speed";
       owner = "yaoweibin";
       repo = "nginx_limit_speed_module";
       rev = "f77ad4a56fbb134878e75827b40cf801990ed936";
@@ -121,6 +149,7 @@ in
 
   live ={
     src = fetchFromGitHub {
+      name = "live";
       owner = "arut";
       repo = "nginx-live-module";
       rev = "5e4a1e3a718e65e5206c24eba00d42b0d1c4b7dd";
@@ -130,6 +159,7 @@ in
 
   lua = {
     src = fetchFromGitHub {
+      name = "lua";
       owner = "openresty";
       repo = "lua-nginx-module";
       rev = "v0.10.15";
@@ -145,6 +175,7 @@ in
 
   lua-upstream = {
     src = fetchFromGitHub {
+      name = "lua-upstream";
       owner = "openresty";
       repo = "lua-upstream-nginx-module";
       rev = "v0.07";
@@ -164,16 +195,18 @@ in
 
   modsecurity-nginx = {
     src = fetchFromGitHub {
+      name = "modsecurity-nginx";
       owner = "SpiderLabs";
       repo = "ModSecurity-nginx";
-      rev = "v1.0.0";
-      sha256 = "0zzpdqhbdqqy8kjkszv0mrq6136ah9v3zwr1jbh312j8izmzdyi7";
+      rev = "v1.0.1";
+      sha256 = "0cbb3g3g4v6q5zc6an212ia5kjjad62bidnkm8b70i4qv1615pzf";
     };
     inputs = [ pkgs.curl pkgs.geoip pkgs.libmodsecurity pkgs.libxml2 pkgs.lmdb pkgs.yajl ];
   };
 
   moreheaders = {
     src = fetchFromGitHub {
+      name = "moreheaders";
       owner = "openresty";
       repo = "headers-more-nginx-module";
       rev = "v0.33";
@@ -183,6 +216,7 @@ in
 
   mpeg-ts ={
     src = fetchFromGitHub {
+      name = "mpeg-ts";
       owner = "arut";
       repo = "nginx-ts-module";
       rev = "v0.1.1";
@@ -192,29 +226,22 @@ in
 
   naxsi ={
     src = fetchFromGitHub {
+      name = "naxsi";
       owner = "nbs-system";
       repo = "naxsi";
-      rev = "0.56";
-      sha256 = "12kn6wbl8xqc19fi05ffprqps4pplg4a6i1cf01xc0d6brx1fg8v";
+      rev = "07a056ccd36bc3c5c40dc17991db226cb8cf6241";
+      sha256 = "1kdqy7by6ha2pl9lkkjxh4qrwcsrj2alm8fl129831h5y5xy8qx2";
     } + "/naxsi_src";
   };
 
-  ngx_aws_auth = {
-    src = fetchFromGitHub {
-      owner = "anomalizer";
-      repo = "ngx_aws_auth";
-      rev = "2.1.1";
-      sha256 = "10z67g40w7wpd13fwxyknkbg3p6hn61i4v8xw6lh27br29v1y6h9";
-    };
-  };
-
   opentracing = {
     src =
       let src' = fetchFromGitHub {
+        name = "opentracing";
         owner = "opentracing-contrib";
         repo = "nginx-opentracing";
-        rev = "v0.7.0";
-        sha256 = "16jzxhhsyfjaxb50jy5py9ppscidfx1shvc29ihldp0zs6d8khma";
+        rev = "v0.9.0";
+        sha256 = "02rf1909grbhvs9mjxrv7pwgbf7b8rpjw7j8rpwxag2rgvlsic3g";
       };
       in "${src'}/opentracing";
     inputs = [ pkgs.opentracing-cpp ];
@@ -225,6 +252,7 @@ in
       version = pkgs.psol.version;
 
       moduleSrc = fetchFromGitHub {
+        name   = "pagespeed";
         owner  = "pagespeed";
         repo   = "ngx_pagespeed";
         rev    = "v${version}-stable";
@@ -253,16 +281,18 @@ in
 
   pam = {
     src = fetchFromGitHub {
+      name = "pam";
       owner = "stogh";
       repo = "ngx_http_auth_pam_module";
-      rev = "v1.5.1";
-      sha256 = "031q006bcv10dzxi3mzamqiyg14p48v0bzd5mrwz073pbf0ba2fl";
+      rev = "v1.5.2";
+      sha256 = "06nydxk82rc9yrw4408nakb197flxh4z1yv935crg65fn9706rl7";
     };
     inputs = [ pkgs.pam ];
   };
 
   pinba = {
     src = fetchFromGitHub {
+      name = "pinba";
       owner = "tony2001";
       repo = "ngx_http_pinba_module";
       rev = "28131255d4797a7e2f82a6a35cf9fc03c4678fe6";
@@ -272,15 +302,17 @@ in
 
   push-stream ={
     src = fetchFromGitHub {
+      name = "push-stream";
       owner = "wandenberg";
       repo = "nginx-push-stream-module";
-      rev = "0.5.4";
-      sha256 = "0izn7lqrp2zfl738aqa9i8c5lba97wkhcnqg8qbw3ipp5cysb2hr";
+      rev = "1cdc01521ed44dc614ebb5c0d19141cf047e1f90";
+      sha256 = "0ijka32b37dl07k2jl48db5a32ix43jaczrpjih84cvq8yph0jjr";
     };
   };
 
   rtmp ={
     src = fetchFromGitHub {
+      name = "rtmp";
       owner = "arut";
       repo = "nginx-rtmp-module";
       rev = "v1.2.1";
@@ -290,6 +322,7 @@ in
 
   set-misc = {
     src = fetchFromGitHub {
+      name = "set-misc";
       owner = "openresty";
       repo = "set-misc-nginx-module";
       rev = "v0.32";
@@ -299,15 +332,17 @@ in
 
   shibboleth = {
     src = fetchFromGitHub {
+      name = "shibboleth";
       owner = "nginx-shib";
       repo = "nginx-http-shibboleth";
-      rev = "48b70d87bf7796d7813813a837e52b3a86e6f6f4";
-      sha256 = "0k8xcln5sf0m4r0m550dkhl07zhncp285dpysk6r4v6vqzqmhzdc";
+      rev = "5eadab80b2f5940d8873398bca000d93d3f0cf27";
+      sha256 = "1l0h3ic9mfsci89d0k5q3igkfpzq052ia25xj5hc8fq388yrhpap";
     };
   };
 
   sla = {
     src = fetchFromGitHub {
+      name = "sla";
       owner = "goldenclone";
       repo = "nginx-sla";
       rev = "7778f0125974befbc83751d0e1cadb2dcea57601";
@@ -317,6 +352,7 @@ in
 
   slowfs-cache = {
     src = fetchFromGitHub {
+      name = "slowfs-cache";
       owner  = "FRiCKLE";
       repo   = "ngx_slowfs_cache";
       rev    = "1.10";
@@ -326,6 +362,7 @@ in
 
   sorted-querystring = {
     src = fetchFromGitHub {
+      name = "sorted-querystring";
       owner = "wandenberg";
       repo = "nginx-sorted-querystring-module";
       rev = "0.3";
@@ -335,7 +372,8 @@ in
 
   statsd = {
     src = fetchFromGitHub {
-      owner = "apcera";
+      name = "statsd";
+      owner = "harvesthq";
       repo = "nginx-statsd";
       rev = "b970e40467a624ba710c9a5106879a0554413d15";
       sha256 = "1x8j4i1i2ahrr7qvz03vkldgdjdxi6mx75mzkfizfcc8smr4salr";
@@ -344,6 +382,7 @@ in
 
   stream-sts = {
     src = fetchFromGitHub {
+      name = "stream-sts";
       owner = "vozlt";
       repo = "nginx-module-stream-sts";
       rev = "v0.1.1";
@@ -353,6 +392,7 @@ in
 
   sts = {
     src = fetchFromGitHub {
+      name = "sts";
       owner = "vozlt";
       repo = "nginx-module-sts";
       rev = "v0.1.1";
@@ -362,15 +402,17 @@ in
 
   subsFilter = {
     src = fetchFromGitHub {
+      name = "subsFilter";
       owner = "yaoweibin";
       repo = "ngx_http_substitutions_filter_module";
-      rev = "bc58cb11844bc42735bbaef7085ea86ace46d05b";
-      sha256 = "1q5hr3sqys4f365gzjci549rn9ylhgj4xb29ril04zr5vkhzlnar";
+      rev = "b8a71eacc7f986ba091282ab8b1bbbc6ae1807e0";
+      sha256 = "027jxzx66q9a6ycn47imjh40xmnqr0z423lz0ds3w4rf1c2x130f";
     };
   };
 
   sysguard = {
     src = fetchFromGitHub {
+      name = "sysguard";
       owner = "vozlt";
       repo = "nginx-module-sysguard";
       rev = "e512897f5aba4f79ccaeeebb51138f1704a58608";
@@ -380,15 +422,17 @@ in
 
   upstream-check = {
     src = fetchFromGitHub {
+      name = "upstream-check";
       owner = "yaoweibin";
       repo = "nginx_upstream_check_module";
-      rev = "007f76f7adbcbd6abd9352502af1a4ae463def85";
-      sha256 = "1qcg7c9rcl70wr1qf188shnn9s2f7cxnlw05s6scbvlgnf6ik6in";
+      rev = "e538034b6ad7992080d2403d6d3da56e4f7ac01e";
+      sha256 = "06y7k04072xzqyqyb08m0vaaizkp4rfwm0q7i735imbzw2rxb74l";
     };
   };
 
   upstream-tarantool = {
     src = fetchFromGitHub {
+      name = "upstream-tarantool";
       owner = "tarantool";
       repo = "nginx_upstream_module";
       rev = "v2.7.1";
@@ -399,6 +443,7 @@ in
 
   url = {
     src = fetchFromGitHub {
+      name = "url";
       owner = "vozlt";
       repo = "nginx-module-url";
       rev = "9299816ca6bc395625c3683fbd2aa7b916bfe91e";
@@ -408,6 +453,7 @@ in
 
   video-thumbextractor = {
     src = fetchFromGitHub {
+      name = "video-thumbextractor";
       owner = "wandenberg";
       repo = "nginx-video-thumbextractor-module";
       rev = "0.9.0";
@@ -418,6 +464,7 @@ in
 
   vts = {
     src = fetchFromGitHub {
+      name = "vts";
       owner = "vozlt";
       repo = "nginx-module-vts";
       rev = "v0.1.18";
diff --git a/pkgs/servers/jackett/default.nix b/pkgs/servers/jackett/default.nix
index aaa762836bd..0306fb4dfab 100644
--- a/pkgs/servers/jackett/default.nix
+++ b/pkgs/servers/jackett/default.nix
@@ -1,46 +1,30 @@
-{ lib, stdenv, fetchurl, makeWrapper, curl, icu60, openssl, zlib }:
+{ lib, stdenv, fetchurl, mono, makeWrapper, curl, icu60, openssl, zlib }:
 
 stdenv.mkDerivation rec {
   pname = "jackett";
-  version = "0.16.175";
+  version = "0.16.998";
 
-  src = {
-    x86_64-linux = fetchurl {
-      url = "https://github.com/Jackett/Jackett/releases/download/v${version}/Jackett.Binaries.LinuxAMDx64.tar.gz";
-      sha512 = "269n84qc8sfrmnidgrjywanbqr65mhkmk24dlqfi17pi0l27wi4fc4qmnjj683xwprz5hqjsmkqf963pbx4k3jaz0rp0jnizan91wij";
-    };
-    aarch64-linux = fetchurl {
-      url = "https://github.com/Jackett/Jackett/releases/download/v${version}/Jackett.Binaries.LinuxARM64.tar.gz";
-      sha512 = "0dmyhprd2vi2z9q5g79psqgsc3w0zdac4s6k20rngi8jxm5jgphzrzcic4rgdijyryap99my619k447w701a08vh9sfcfk0fjg9pgwb";
-    };
-  }."${stdenv.targetPlatform.system}" or (throw "Missing hash for host system: ${stdenv.targetPlatform.system}");
+  src = fetchurl {
+    url = "https://github.com/Jackett/Jackett/releases/download/v${version}/Jackett.Binaries.Mono.tar.gz";
+    sha256 = "16f8ipw4sbdxwv79zjhr5ihd3m6biyhj1gj7cqpjr34ad7zqna3c";
+  };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
-    mkdir -p $out/{bin,opt/${pname}-${version}}
-    cp -r * $out/opt/${pname}-${version}
-
-    makeWrapper "$out/opt/${pname}-${version}/jackett" $out/bin/Jackett \
-      --prefix LD_LIBRARY_PATH ':' "${curl.out}/lib:${icu60.out}/lib:${openssl.out}/lib:${zlib.out}/lib"
-  '';
+    mkdir -p $out/{bin,share/${pname}-${version}}
+    cp -r * $out/share/${pname}-${version}
 
-  preFixup = let
-    libPath = lib.makeLibraryPath [
-      stdenv.cc.cc.lib  # libstdc++.so.6
-    ];
-  in ''
-    patchelf \
-      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      --set-rpath "${libPath}" \
-      $out/opt/${pname}-${version}/jackett
+    makeWrapper "${mono}/bin/mono" $out/bin/Jackett \
+      --add-flags "$out/share/${pname}-${version}/JackettConsole.exe" \
+      --prefix LD_LIBRARY_PATH : ${stdenv.lib.makeLibraryPath [ curl icu60 openssl zlib ]}
   '';
 
   meta = with stdenv.lib; {
     description = "API Support for your favorite torrent trackers.";
     homepage = "https://github.com/Jackett/Jackett/";
     license = licenses.gpl2;
-    maintainers = with maintainers; [ edwtjo nyanloutre ];
-    platforms = [ "x86_64-linux" "aarch64-linux" ];
+    maintainers = with maintainers; [ edwtjo nyanloutre purcell ];
+    platforms = platforms.all;
   };
 }
diff --git a/pkgs/servers/jellyfin/default.nix b/pkgs/servers/jellyfin/default.nix
index 5ae355ab8b2..3e0533fc9bd 100644
--- a/pkgs/servers/jellyfin/default.nix
+++ b/pkgs/servers/jellyfin/default.nix
@@ -56,6 +56,6 @@ in stdenv.mkDerivation rec {
     description = "The Free Software Media System";
     homepage = "https://jellyfin.org/";
     license = licenses.gpl2;
-    maintainers = with maintainers; [ nyanloutre minijackson ];
+    maintainers = with maintainers; [ nyanloutre minijackson purcell ];
   };
 }
diff --git a/pkgs/servers/radarr/default.nix b/pkgs/servers/radarr/default.nix
index a76c45c1959..e39e0bf7647 100644
--- a/pkgs/servers/radarr/default.nix
+++ b/pkgs/servers/radarr/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     description = "A Usenet/BitTorrent movie downloader";
     homepage = "https://radarr.video/";
     license = licenses.gpl3;
-    maintainers = with maintainers; [ edwtjo ];
+    maintainers = with maintainers; [ edwtjo purcell ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/servers/sonarr/default.nix b/pkgs/servers/sonarr/default.nix
index d18e9fb7f58..a1c854b7723 100644
--- a/pkgs/servers/sonarr/default.nix
+++ b/pkgs/servers/sonarr/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     description = "Smart PVR for newsgroup and bittorrent users";
     homepage = "https://sonarr.tv/";
     license = stdenv.lib.licenses.gpl3;
-    maintainers = [ stdenv.lib.maintainers.fadenb ];
+    maintainers = with stdenv.lib.maintainers; [ fadenb purcell ];
     platforms = stdenv.lib.platforms.all;
   };
 }
diff --git a/pkgs/servers/web-apps/sogo/default.nix b/pkgs/servers/web-apps/sogo/default.nix
index 3e78b5d9d43..1ec512ba0ca 100644
--- a/pkgs/servers/web-apps/sogo/default.nix
+++ b/pkgs/servers/web-apps/sogo/default.nix
@@ -1,24 +1,25 @@
 { gnustep, lib, fetchFromGitHub, fetchpatch, makeWrapper, python2, lndir
-, openssl_1_1, openldap, sope, libmemcached, curl }: with lib; gnustep.stdenv.mkDerivation rec {
+, openssl_1_1, openldap, sope, libmemcached, curl, libsodium, libzip, pkgconfig }:
+with lib; gnustep.stdenv.mkDerivation rec {
   pname = "SOGo";
-  version = "4.3.2";
+  version = "5.0.0";
 
   src = fetchFromGitHub {
     owner = "inverse-inc";
     repo = pname;
     rev = "SOGo-${version}";
-    sha256 = "1xxad23a8zy6w850x5nrrf54db0x73lc9drmc5kpfk870fk2lmr0";
+    sha256 = "sha256-SEyyHekUCSkb5rOh7Ty8AhtT4S9KicTRbo9iWhijdGE=";
   };
 
   nativeBuildInputs = [ gnustep.make makeWrapper python2 ];
-  buildInputs = [ gnustep.base sope openssl_1_1 libmemcached (curl.override { openssl = openssl_1_1; }) ]
+  buildInputs = [ gnustep.base sope openssl_1_1 libmemcached (curl.override { openssl = openssl_1_1; }) libsodium libzip pkgconfig ]
     ++ optional (openldap != null) openldap;
 
   patches = [
     # TODO: take a closer look at other patches in https://sources.debian.org/patches/sogo/ and https://github.com/Skrupellos/sogo-patches
     (fetchpatch {
-      url = "https://sources.debian.org/data/main/s/sogo/4.3.0-1/debian/patches/0005-Remove-build-date.patch";
-      sha256 = "0lrh3bkfj3r0brahfkyb0g7zx7r2jjd5cxzjl43nqla0fs09wsh8";
+      url = "https://salsa.debian.org/debian/sogo/-/raw/120ac6390602c811908c7fcb212a79acbc7f7f28/debian/patches/0005-Remove-build-date.patch";
+      sha256 = "151i8504kwdlcirgd0pbif7cxnb1q6jsp5j7dbh9p6zw2xgwkp25";
     })
   ];
 
diff --git a/pkgs/shells/elvish/default.nix b/pkgs/shells/elvish/default.nix
index 64dd3cd70c7..2cb45f33f7b 100644
--- a/pkgs/shells/elvish/default.nix
+++ b/pkgs/shells/elvish/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "elvish";
-  version = "0.14.0";
+  version = "0.14.1";
 
   excludedPackages = [ "website" ];
 
@@ -12,7 +12,7 @@ buildGoModule rec {
     owner = "elves";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1jsxhnm82pjzwvcjq7vrlldyjnv5j6c83a13dj6zphlqq99z68l4";
+    sha256 = "05wp3cx4s2cjf60yncdpmycs5h4z1dlin56dmljmfwz4z099079b";
   };
 
   vendorSha256 = "1f971n17h9bc0qcgs9ipiaw0x9807mz761fqm605br4ch1kp0897";
diff --git a/pkgs/shells/rssh/default.nix b/pkgs/shells/rssh/default.nix
deleted file mode 100644
index b2bec51a95e..00000000000
--- a/pkgs/shells/rssh/default.nix
+++ /dev/null
@@ -1,97 +0,0 @@
-# CAVEATS:
-# - Have only tested this with rsync, scp, and sftp. cvs support should work, but chroot integration is unlikely to function without further work
-# - It is compiled without rdist support because rdist is ludicrously ancient (and not already in nixpkgs)
-
-{ stdenv, fetchurl, openssh, rsync, cvs }:
-
-stdenv.mkDerivation rec {
-  pname = "rssh";
-  version = "2.3.4";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/rssh/rssh/${version}/${pname}-${version}.tar.gz";
-    sha256 = "f30c6a760918a0ed39cf9e49a49a76cb309d7ef1c25a66e77a41e2b1d0b40cd9";
-  };
-
-  patches = [
-    ./fix-config-path.patch
-
-    # Patches from AUR
-    (fetchurl {
-      url = "https://aur.archlinux.org/cgit/aur.git/plain/0001-fail-logging.patch?h=rssh";
-      name = "0001-fail-logging.patch";
-      sha256 = "d30f2f4fdb1b57f94773f5b0968a4da3356b14a040efe69ec1e976c615035c65";
-    })
-    (fetchurl {
-      url = "https://aur.archlinux.org/cgit/aur.git/plain/0002-info-to-debug.patch?h=rssh";
-      name = "0002-info-to-debug.patch";
-      sha256 = "86f6ecf34f62415b0d6204d4cbebc47322dc2ec71732d06aa27758e35d688fcd";
-    })
-    (fetchurl {
-      url = "https://aur.archlinux.org/cgit/aur.git/plain/0003-man-page-spelling.patch?h=rssh";
-      name = "0003-man-page-spelling.patch";
-      sha256 = "455b3bbccddf1493999d00c2cd46e62930ef4fd8211e0b7d3a89d8010d6a5431";
-    })
-    (fetchurl {
-      url = "https://aur.archlinux.org/cgit/aur.git/plain/0004-mkchroot.patch?h=rssh";
-      name = "0004-mkchroot.patch";
-      sha256 = "f7fd8723d2aa94e64e037c13c2f263a52104af680ab52bfcaea73dfa836457c2";
-    })
-    (fetchurl {
-      url = "https://aur.archlinux.org/cgit/aur.git/plain/0005-mkchroot-arch.patch?h=rssh";
-      name = "0005-mkchroot-arch.patch";
-      sha256 = "ac8894c4087a063ae8267d2fdfcde69c2fe6b67a8ff5917e4518b8f73f08ba3f";
-    })
-    (fetchurl {
-      url = "https://aur.archlinux.org/cgit/aur.git/plain/0006-mkchroot-symlink.patch?h=rssh";
-      name = "0006-mkchroot-symlink.patch";
-      sha256 = "bce98728cb9b55c92182d4901c5f9adf49376a07c5603514b0004e3d1c85e9c7";
-    })
-    (fetchurl {
-      url = "https://aur.archlinux.org/cgit/aur.git/plain/0007-destdir.patch?h=rssh";
-      name = "0007-destdir.patch";
-      sha256 = "7fa03644f81dc37d77cc7e2cad994f17f91b2b8a49b1a74e41030a4ac764385e";
-    })
-    (fetchurl {
-      url = "https://aur.archlinux.org/cgit/aur.git/plain/0008-rsync-protocol.patch?h=rssh";
-      name = "0008-rsync-protocol.patch";
-      sha256 = "0c772afe9088eeded129ead86775ef18e58c318bbc58fc3e2585e7ff09cc5e91";
-    })
-  ];
-
-  # Run this after to avoid conflict with patches above
-  postPatch = ''
-    sed -i '/chmod u+s/d' Makefile.in
-  '';
-
-
-  buildInputs = [ openssh rsync cvs ];
-
-  configureFlags = [
-    "--with-sftp-server=${openssh}/libexec/sftp-server"
-    "--with-scp=${openssh}/bin/scp"
-    "--with-rsync=${rsync}/bin/rsync"
-    "--with-cvs=${cvs}/bin/cvs"
-  ];
-
-
-  meta = with stdenv.lib; {
-    description = "A restricted shell for use with OpenSSH, allowing only scp and/or sftp";
-    longDescription = ''
-      rssh also includes support for rsync and cvs. For example, if you have a server which you only want to allow users to copy files off of via scp, without providing shell access, you can use rssh to do that.
-    '';
-    homepage = "http://www.pizzashack.org/rssh/";
-    license = licenses.bsd2;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ arobyn ];
-    knownVulnerabilities = [
-      "CVE-2019-1000018"
-      "CVE-2019-3463"
-      "CVE-2019-3464"
-    ];
-  };
-
-  passthru = {
-    shellPath = "/bin/rssh";
-  };
-}
diff --git a/pkgs/shells/rssh/fix-config-path.patch b/pkgs/shells/rssh/fix-config-path.patch
deleted file mode 100644
index eecffb376ab..00000000000
--- a/pkgs/shells/rssh/fix-config-path.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -Naur rssh-2.3.4/Makefile.in rssh-2.3.4-fixed/Makefile.in
---- rssh-2.3.4/Makefile.in	2012-11-27 11:19:34.000000000 +1100
-+++ rssh-2.3.4-fixed/Makefile.in	2015-11-11 21:13:58.516651742 +1100
-@@ -186,7 +186,7 @@
- sysconfdir = @sysconfdir@
- target_alias = @target_alias@
- AUTOMAKE_OPTIONS = nostdinc
--ourdefs = -DPATH_RSSH_CONFIG=\"@sysconfdir@/rssh.conf\" -DPATH_CHROOT_HELPER=\"@libexecdir@/rssh_chroot_helper\"
-+ourdefs = -DPATH_RSSH_CONFIG=\"/etc/rssh.conf\" -DPATH_CHROOT_HELPER=\"@libexecdir@/rssh_chroot_helper\"
- ourflags = @defcflags@ @static@ 
- AM_CFLAGS = $(ourflags)
- nodist_rssh_SOURCES = main.c pathnames.h config.h
diff --git a/pkgs/shells/zsh/oh-my-zsh/default.nix b/pkgs/shells/zsh/oh-my-zsh/default.nix
index 8fc189fbf15..2fce32e018e 100644
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@@ -4,13 +4,13 @@
 { stdenv, fetchgit }:
 
 stdenv.mkDerivation rec {
-  version = "2020-08-20";
+  version = "2020-08-24";
   pname = "oh-my-zsh";
-  rev = "03b6a72576cb0f0b53abde25d409e8026d5c4ee9";
+  rev = "cfb86cd08d3b24fd4b59d0d35b3af1f589c891fa";
 
   src = fetchgit { inherit rev;
     url = "https://github.com/ohmyzsh/ohmyzsh";
-    sha256 = "0bm043r3pffbv74drrv2xa66rsadrrsayscwwnfgp24svdmx7a6z";
+    sha256 = "0af37smv0bqw37bng2halzgszf8y3m2sxahdff54m16asm0py2cr";
   };
 
   pathsToLink = [ "/share/oh-my-zsh" ];
diff --git a/pkgs/tools/admin/eksctl/default.nix b/pkgs/tools/admin/eksctl/default.nix
index 27ea33b6035..7c240aa4131 100644
--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.25.0";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    sha256 = "1p3dzzbf840csqlgxyykmyg13z0nkzy4nkqq9y8jlpdm745vcryv";
+    sha256 = "1av5w32ia68j2xrw4m16mzm9jn6xlap93kwi8iqw0s6wgihzadds";
   };
 
-  vendorSha256 = "1msid4857wsh4qp1f7nyrmpzjv3sklh49cl7a9c1a3qr9m99w4yb";
+  vendorSha256 = "13sc4yrzgx2sm98whibfy2kjia3yy9cdvibvhbvg2lz2spprjb9v";
 
   doCheck = false;
 
diff --git a/pkgs/tools/backup/bup/default.nix b/pkgs/tools/backup/bup/default.nix
index 57ab854a33c..ee6ae0a2934 100644
--- a/pkgs/tools/backup/bup/default.nix
+++ b/pkgs/tools/backup/bup/default.nix
@@ -5,7 +5,7 @@
 
 assert par2Support -> par2cmdline != null;
 
-let version = "0.30.1"; in
+let version = "0.31"; in
 
 with stdenv.lib;
 
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     repo = "bup";
     owner = "bup";
     rev = version;
-    sha256 = "0z9rpmmi6mbm48ynd6izr0f8l3cklfyar6gjy0c8z9zal1ac9r55";
+    sha256 = "03kmmdlgg0p5z39bhckkf91mmq55wghb93ghqvv9f9gaby1diw4z";
   };
 
   buildInputs = [
diff --git a/pkgs/tools/bluetooth/blueberry/default.nix b/pkgs/tools/bluetooth/blueberry/default.nix
index 4b7692d49d6..16563c38099 100644
--- a/pkgs/tools/bluetooth/blueberry/default.nix
+++ b/pkgs/tools/bluetooth/blueberry/default.nix
@@ -8,7 +8,7 @@
 , intltool
 , pavucontrol
 , python3Packages
-, rfkill
+, utillinux
 , wrapGAppsHook
 }:
 
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     cinnamon.xapps
     gnome3.gnome-bluetooth
     python3Packages.python
-    rfkill
+    utillinux
   ];
 
   pythonPath = with python3Packages; [
@@ -68,8 +68,8 @@ stdenv.mkDerivation rec {
       --replace /usr/lib/blueberry $out/lib/blueberry \
       --replace /usr/share $out/share
     substituteInPlace $out/lib/blueberry/rfkillMagic.py \
-      --replace /usr/bin/rfkill ${rfkill}/bin/rfkill \
-      --replace /usr/sbin/rfkill ${rfkill}/bin/rfkill \
+      --replace /usr/bin/rfkill ${utillinux}/bin/rfkill \
+      --replace /usr/sbin/rfkill ${utillinux}/bin/rfkill \
       --replace /usr/lib/blueberry $out/lib/blueberry
     substituteInPlace $out/share/applications/blueberry.desktop \
       --replace Exec=blueberry Exec=$out/bin/blueberry
diff --git a/pkgs/tools/filesystems/avfs/default.nix b/pkgs/tools/filesystems/avfs/default.nix
index eaf9ac634a1..edfcaa0d8f8 100644
--- a/pkgs/tools/filesystems/avfs/default.nix
+++ b/pkgs/tools/filesystems/avfs/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "avfs";
-  version = "1.1.2";
+  version = "1.1.3";
   src = fetchurl {
     url = "mirror://sourceforge/avf/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "035b6y49nzgswf5n70aph8pm48sbv9nqwlnp3wwbq892c39kk4xn";
+    sha256 = "1psh8k7g7rb0gn7aygbjv86kxyi9xq07barxksa99nnmq3lc2kjg";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/filesystems/bashmount/default.nix b/pkgs/tools/filesystems/bashmount/default.nix
index 206e68ce1c2..70a4c1419c8 100644
--- a/pkgs/tools/filesystems/bashmount/default.nix
+++ b/pkgs/tools/filesystems/bashmount/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bashmount";
-  version = "4.3.0";
+  version = "4.3.1";
 
   src = fetchFromGitHub {
     owner = "jamielinux";
     repo = "bashmount";
     rev = version;
-    sha256 = "1idjyl5dr8a72w3lg15qx03wgc5mj2ga2v2jkyb8v9gi5ahl03mn";
+    sha256 = "0pqjaib0qiwjq0ral5yjz4iq8hpaj9mqkhlihgfz0xigcn9lxwpf";
   };
 
   installPhase = ''
diff --git a/pkgs/tools/misc/chezmoi/default.nix b/pkgs/tools/misc/chezmoi/default.nix
index a87aa33ab11..d7b7646afec 100644
--- a/pkgs/tools/misc/chezmoi/default.nix
+++ b/pkgs/tools/misc/chezmoi/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "chezmoi";
-  version = "1.8.4";
+  version = "1.8.5";
 
   src = fetchFromGitHub {
     owner = "twpayne";
     repo = "chezmoi";
     rev = "v${version}";
-    sha256 = "0m8ik01y1lag3mgg3g4rxvzndh86b972hv2702dqs28l5zy5h3mv";
+    sha256 = "16sv1kbd66rllnnl851y3x54wkl0p7g0qsblprvfr9715svk1835";
   };
 
-  vendorSha256 = "18s60k7y64z12lx9lgj13fl1jh0aiqinwxrsz751d2iqhgdi2jja";
+  vendorSha256 = "1i9d672mzmb97s26n0v01m70g4viyl9pdk25haxr6ny4rab2wbi7";
 
   doCheck = false;
 
diff --git a/pkgs/tools/misc/colorpicker/default.nix b/pkgs/tools/misc/colorpicker/default.nix
new file mode 100644
index 00000000000..3de5d33617c
--- /dev/null
+++ b/pkgs/tools/misc/colorpicker/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchFromGitHub, pkg-config, gtk2 }:
+
+stdenv.mkDerivation rec {
+  pname = "colorpicker";
+  version = "git-2018-01-14";
+
+  src = fetchFromGitHub {
+    owner = "Ancurio";
+    repo  = "colorpicker";
+    rev   = "287676947e6e3b5b0cee784aeb1638cf22f0ce17";
+    sha256 = "1kj1dpb79llrfpszraaz6r7ci114zqi5rmqxwsvq2dnnpjxyi29r";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ gtk2 ];
+
+  installPhase = ''
+    install -Dt $out/bin colorpicker
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Click on a pixel on your screen and print its color value in RGB";
+    homepage = "https://github.com/Ancurio/colorpicker";
+    maintainers = with maintainers; [ jb55 ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/tools/misc/debianutils/default.nix b/pkgs/tools/misc/debianutils/default.nix
index 930f1f59a8a..141df333222 100644
--- a/pkgs/tools/misc/debianutils/default.nix
+++ b/pkgs/tools/misc/debianutils/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "debianutils";
-  version = "4.11";
+  version = "4.11.1";
 
   src = fetchurl {
     url = "mirror://debian/pool/main/d/${pname}/${pname}_${version}.tar.xz";
-    sha256 = "0lbizfnf3qwsiz2ggia6ff7sjjj8gwhys8bm6wixdc4n0qlycp5v";
+    sha256 = "0g4qmzb2ff0rqszzpsal465hcslnpdl4nhghv59qvhamkkqnks4b";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/fluent-bit/default.nix b/pkgs/tools/misc/fluent-bit/default.nix
index 28c005b7abb..2f49d0e57eb 100644
--- a/pkgs/tools/misc/fluent-bit/default.nix
+++ b/pkgs/tools/misc/fluent-bit/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fluent-bit";
-  version = "1.5.3";
+  version = "1.5.4";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     rev = "v${version}";
-    sha256 = "153c7hafmzwxa24h923irfhzaqqd8wbr2aaab6l3hjhgx5q8s5bf";
+    sha256 = "0w96f86i2jlzjk2plf8jbdw4q748khbhhjkbzfb8dkq2lhc9i80h";
   };
 
   nativeBuildInputs = [ cmake flex bison ];
diff --git a/pkgs/tools/misc/topgrade/default.nix b/pkgs/tools/misc/topgrade/default.nix
index 578d2ba42e5..f009de0a6fc 100644
--- a/pkgs/tools/misc/topgrade/default.nix
+++ b/pkgs/tools/misc/topgrade/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "topgrade";
-  version = "5.4.0";
+  version = "5.5.0";
 
   src = fetchFromGitHub {
     owner = "r-darwish";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1v57dqkrh67cmj1ish650z8yk737hm1qynqr5yv0vlna86gwhrhs";
+    sha256 = "1adx029cq30g0qnrvdq2di8bpadzdxrpbsqchxfsda8zg6cprh1j";
   };
 
-  cargoSha256 = "00vxrv8lbdwwbdbaqb4rq0w3bc8n9qwk9zgb1j656lyswib7g1d3";
+  cargoSha256 = "0jpjn6sb8bkwnq7np487hb8bkm6rv84mihmqwy3ymgdzlqcng6sk";
 
   buildInputs = lib.optional stdenv.isDarwin Foundation;
 
diff --git a/pkgs/tools/networking/chrony/default.nix b/pkgs/tools/networking/chrony/default.nix
index 0a8ae10eb13..6c8254c797b 100644
--- a/pkgs/tools/networking/chrony/default.nix
+++ b/pkgs/tools/networking/chrony/default.nix
@@ -5,11 +5,11 @@ assert stdenv.isLinux -> libcap != null;
 
 stdenv.mkDerivation rec {
   pname = "chrony";
-  version = "3.5";
+  version = "3.5.1";
 
   src = fetchurl {
     url = "https://download.tuxfamily.org/chrony/${pname}-${version}.tar.gz";
-    sha256 = "1d9r2dhslll4kzdmxrj0qfgwq1b30d4l3s5cwr8yr93029dpj0jf";
+    sha256 = "19ywl8a3lb2id7lcna5hp2g4pjnfwdc9ihr0fk6i9m45vdq2za0v";
   };
 
   patches = [
diff --git a/pkgs/tools/networking/oneshot/default.nix b/pkgs/tools/networking/oneshot/default.nix
index e9772b193d3..f02370ab69d 100644
--- a/pkgs/tools/networking/oneshot/default.nix
+++ b/pkgs/tools/networking/oneshot/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "oneshot";
-  version = "1.1.3";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "raphaelreyna";
     repo = "oneshot";
     rev = "v${version}";
-    sha256 = "14s5cl1g0rgqj7fj699xgz2kmkzym1zpckhv3h33ypsn4dq7gjh2";
+    sha256 = "11xmvqj7md970rjhkg1zj2w6yqpw6cj83aw37a82sfdn90kyhg9d";
   };
 
-  vendorSha256 = "0v53dsj0w959pmvk6v1i7rwlfd2y0vrghxlwkgidw0sf775qpgvy";
+  vendorSha256 = "1cxr96yrrmz37r542mc5376jll9lqjqm18k8761h9jqfbzmh9rkp";
 
   doCheck = false;
 
diff --git a/pkgs/tools/networking/vpn-slice/default.nix b/pkgs/tools/networking/vpn-slice/default.nix
new file mode 100644
index 00000000000..9511c214c08
--- /dev/null
+++ b/pkgs/tools/networking/vpn-slice/default.nix
@@ -0,0 +1,25 @@
+{ lib, buildPythonApplication, python3Packages, fetchFromGitHub }:
+
+buildPythonApplication rec {
+  pname = "vpn-slice";
+  version = "0.14";
+
+  src = fetchFromGitHub {
+    owner = "dlenski";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1z2mdl3arzl95zrj4ir57f762gcimmmq5nk91j679cshxz4snxyr";
+  };
+
+  propagatedBuildInputs = with python3Packages; [ setproctitle dnspython ];
+
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = "https://github.com/dlenski/vpn-slice";
+    description =
+      "vpnc-script replacement for easy and secure split-tunnel VPN setup";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ jdbaldry ];
+  };
+}
diff --git a/pkgs/tools/security/vault/default.nix b/pkgs/tools/security/vault/default.nix
index 50a7844356f..a9d72f33161 100644
--- a/pkgs/tools/security/vault/default.nix
+++ b/pkgs/tools/security/vault/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "vault";
-  version = "1.5.0";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "vault";
     rev = "v${version}";
-    sha256 = "1bdhcsx7hwz4kb68jrrrzlbr7k744g0pym996dq1p5rvz05j3pqc";
+    sha256 = "0a16slrg0kx7i1xwixc920lkgbbywvb6wpmkbqjvz1xx72nq9ap4";
   };
 
   goPackagePath = "github.com/hashicorp/vault";
diff --git a/pkgs/tools/security/vault/vault-bin.nix b/pkgs/tools/security/vault/vault-bin.nix
index 6b14a834330..315cd5ab077 100644
--- a/pkgs/tools/security/vault/vault-bin.nix
+++ b/pkgs/tools/security/vault/vault-bin.nix
@@ -1,30 +1,30 @@
 { stdenv, fetchurl, unzip }:
 
 let
-  version = "1.3.0";
+  version = "1.5.2";
 
   sources = let
     base = "https://releases.hashicorp.com/vault/${version}";
   in {
     x86_64-linux = fetchurl {
       url = "${base}/vault_${version}_linux_amd64.zip";
-      sha256 = "1crfj4gd1qwwa2xidd0pjffv0n6hf5hbhv6568m6zc1ig0qqm6yq";
+      sha256 = "1m9svs1ncgdwwh16xavwikq4ji9rzkb2wlr59sx61rlz0l18mknd";
     };
     i686-linux = fetchurl {
       url = "${base}/vault_${version}_linux_386.zip";
-      sha256 = "0pyf0kyvxpmx3fwfvin1r0x30r9byx9lyi81894q06xrhiwbqc0l";
+      sha256 = "0hd6gsrmjfly3075kq0rsxhgy927g1462qih0iiwphrhik7l0pwr";
     };
     x86_64-darwin = fetchurl {
       url = "${base}/vault_${version}_darwin_amd64.zip";
-      sha256 = "113vnpz9n6y7z2k9jqpfpxqxqbrmd9bhny79yaxqzkfdqw8vyv3g";
+      sha256 = "092xqjm69ljn70hn9f93qkc0ila0hgj2l14plhsza52d924qnq3l";
     };
     i686-darwin = fetchurl {
       url = "${base}/vault_${version}_darwin_386.zip";
-      sha256 = "0d191qai0bpl7cyivca26wqgycsj2dz08809z147d1vnrz321v6w";
+      sha256 = "161j15n6kfd3m5hakc0qn824kp0nwdghcm81j9vqzpq900sbg6ak";
     };
     aarch64-linux = fetchurl {
       url = "${base}/vault_${version}_linux_arm64.zip";
-      sha256 = "1bk5y3knc42mh07gnnn6p109qz908014620h1s0348wp4qfdy49w";
+      sha256 = "1f6ckfqqj9gsaizwxa7xrjgkkj3nd6m1md7smz0xnxgnc4f7g4z0";
     };
   };
 
diff --git a/pkgs/tools/system/bpytop/default.nix b/pkgs/tools/system/bpytop/default.nix
index 2751689209b..a408f44ec10 100644
--- a/pkgs/tools/system/bpytop/default.nix
+++ b/pkgs/tools/system/bpytop/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bpytop";
-  version = "1.0.13";
+  version = "1.0.21";
 
   src = fetchFromGitHub {
     owner = "aristocratos";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1mrzl5ry5janifykp58gf5g7xw7522wvpp8hgq2hpfx52z6my1bj";
+    sha256 = "10cygn4srmzk1b279hrlp4rjbldkzq7354fhm0jbmd3rp15b454p";
   };
 
   buildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/system/fio/default.nix b/pkgs/tools/system/fio/default.nix
index 80789681fc4..77a85e01473 100644
--- a/pkgs/tools/system/fio/default.nix
+++ b/pkgs/tools/system/fio/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fio";
-  version = "3.21";
+  version = "3.22";
 
   src = fetchFromGitHub {
     owner  = "axboe";
     repo   = "fio";
     rev    = "fio-${version}";
-    sha256 = "0v8bq79n2nfnrs8pw2f3a93f8k691dnfzd5qxb5srwak4y2za7hn";
+    sha256 = "16p17l1xbqqkgppvwmfaywknhk4ybafnx8hm56ffd8bls9vaqw5m";
   };
 
   buildInputs = [ python zlib ]
diff --git a/pkgs/tools/text/ugrep/default.nix b/pkgs/tools/text/ugrep/default.nix
index 3f3cbd8efcd..3e225ec3567 100644
--- a/pkgs/tools/text/ugrep/default.nix
+++ b/pkgs/tools/text/ugrep/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ugrep";
-  version = "2.5.1";
+  version = "2.5.3";
 
   src = fetchFromGitHub {
     owner = "Genivia";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0z62rqcvcz8iy6ig7y05gn90m0pn99jc0ll9b82kdbr257kz91r1";
+    sha256 = "16ly1dz8wxnjk6kc88dl2x0ijmzw5v87fhai9fnardwfmycn7ivc";
   };
 
   buildInputs = [ boost bzip2 lz4 pcre2 xz zlib ];
diff --git a/pkgs/tools/text/vale/default.nix b/pkgs/tools/text/vale/default.nix
index 65b2678dfc0..69390b4d3d3 100644
--- a/pkgs/tools/text/vale/default.nix
+++ b/pkgs/tools/text/vale/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "vale";
-  version = "2.3.2";
+  version = "2.3.3";
 
   subPackages = [ "." ];
   outputs = [ "out" "data" ];
@@ -11,7 +11,7 @@ buildGoModule rec {
     owner  = "errata-ai";
     repo   = "vale";
     rev    = "v${version}";
-    sha256 = "0accs8ygg2h5hk8n4d5hs1fpxp9mlbzic6f4dwrygi463z7c3icc";
+    sha256 = "13b565l87nm3gpxxhw1bpjx7yqcgf5124k3wh7r149z38xyqc3wk";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 54c8948f4a5..b020d6fac55 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -467,9 +467,11 @@ mapAliases ({
   robomongo = robo3t; #added 2017-09-28
   rocm-runtime-ext = throw "rocm-runtime-ext has been removed, since its functionality was added to rocm-runtime"; #added 2020-08-21
   rssglx = rss-glx; #added 2015-03-25
+  rssh = throw "rssh has been removed from nixpkgs: no upstream releases since 2012, several known CVEs"; # added 2020-08-25
   recordmydesktop = throw "recordmydesktop has been removed from nixpkgs, as it's unmaintained and uses deprecated libraries"; # added 2019-12-10
   gtk-recordmydesktop = throw "gtk-recordmydesktop has been removed from nixpkgs, as it's unmaintained and uses deprecated libraries"; # added 2019-12-10
   qt-recordmydesktop = throw "qt-recordmydesktop has been removed from nixpkgs, as it's abandoned and uses deprecated libraries"; # added 2019-12-10
+  rfkill = throw "rfkill has been removed, as it's included in util-linux"; # added 2020-08-23
   rkt = throw "rkt was archived by upstream"; # added 2020-05-16
   ruby_2_0_0 = throw "deprecated 2018-0213: use a newer version of ruby";
   ruby_2_1_0 = throw "deprecated 2018-0213: use a newer version of ruby";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2dc62c582a2..59f05e99518 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -180,6 +180,8 @@ in
 
   colorz = callPackage ../tools/misc/colorz { };
 
+  colorpicker = callPackage ../tools/misc/colorpicker { };
+
   comedilib = callPackage ../development/libraries/comedilib {  };
 
   cpu-x = callPackage ../applications/misc/cpu-x { };
@@ -3984,7 +3986,7 @@ in
   gocryptfs = callPackage ../tools/filesystems/gocryptfs { };
 
   godot = callPackage ../development/tools/godot {};
-  
+
   godot-headless = callPackage ../development/tools/godot/headless.nix { };
 
   godot-server = callPackage ../development/tools/godot/server.nix { };
@@ -7629,6 +7631,8 @@ in
 
   vpnc = callPackage ../tools/networking/vpnc { };
 
+  vpn-slice = python3Packages.callPackage ../tools/networking/vpn-slice { };
+
   vp = callPackage ../applications/misc/vp {
     # Enable next line for console graphics. Note that
     # it requires `sixel` enabled terminals such as mlterm
@@ -8257,8 +8261,6 @@ in
 
   tcsh = callPackage ../shells/tcsh { };
 
-  rssh = callPackage ../shells/rssh { };
-
   rush = callPackage ../shells/rush { };
 
   xonsh = callPackage ../shells/xonsh { };
@@ -8412,6 +8414,7 @@ in
     };
   };
 
+  clang_11 = llvmPackages_11.clang;
   clang_10 = llvmPackages_10.clang;
   clang_9  = llvmPackages_9.clang;
   clang_8  = llvmPackages_8.clang;
@@ -8468,6 +8471,8 @@ in
     '';
   };
 
+  copper = callPackage ../development/compilers/copper {};
+
   inherit (callPackages ../development/compilers/crystal {
     inherit (llvmPackages_10) stdenv clang llvm;
   })
@@ -9226,6 +9231,7 @@ in
   lld_8 = llvmPackages_8.lld;
   lld_9 = llvmPackages_9.lld;
   lld_10 = llvmPackages_10.lld;
+  lld_11 = llvmPackages_11.lld;
 
   lldb = llvmPackages.lldb;
   lldb_5 = llvmPackages_5.lldb;
@@ -9234,10 +9240,12 @@ in
   lldb_8 = llvmPackages_8.lldb;
   lldb_9 = llvmPackages_9.lldb;
   lldb_10 = llvmPackages_10.lldb;
+  lldb_11 = llvmPackages_11.lldb;
 
   llvm = llvmPackages.llvm;
   llvm-manpages = llvmPackages.llvm-manpages;
 
+  llvm_11 = llvmPackages_11.llvm;
   llvm_10 = llvmPackages_10.llvm;
   llvm_9  = llvmPackages_9.llvm;
   llvm_8  = llvmPackages_8.llvm;
@@ -9283,6 +9291,14 @@ in
     targetLlvmLibraries = targetPackages.llvmPackages_10.libraries;
   };
 
+  llvmPackages_11 = callPackage ../development/compilers/llvm/11 ({
+    inherit (stdenvAdapters) overrideCC;
+    buildLlvmTools = buildPackages.llvmPackages_11.tools;
+    targetLlvmLibraries = targetPackages.llvmPackages_11.libraries;
+  } // stdenv.lib.optionalAttrs (stdenv.hostPlatform.isi686 && buildPackages.stdenv.cc.isGNU) {
+    stdenv = gcc7Stdenv;
+  });
+
   llvmPackages_latest = llvmPackages_10;
 
   llvmPackages_rocm = callPackage ../development/compilers/llvm/rocm { };
@@ -11450,6 +11466,8 @@ in
   terraform-lsp = callPackage ../development/tools/misc/terraform-lsp { };
   terraform-ls = callPackage ../development/tools/misc/terraform-ls { };
 
+  terraformer = callPackage ../development/tools/misc/terraformer { };
+
   texinfo413 = callPackage ../development/tools/misc/texinfo/4.13a.nix { };
   texinfo4 = texinfo413;
   texinfo5 = callPackage ../development/tools/misc/texinfo/5.2.nix { };
@@ -14299,6 +14317,8 @@ in
     inherit (darwin.stubs) setfile;
   };
 
+  muparserx = callPackage ../development/libraries/muparserx { };
+
   mutest = callPackage ../development/libraries/mutest { };
 
   mygpoclient = pythonPackages.mygpoclient;
@@ -15514,7 +15534,9 @@ in
 
   vcg = callPackage ../development/libraries/vcg { };
 
-  vid-stab = callPackage ../development/libraries/vid-stab { };
+  vid-stab = callPackage ../development/libraries/vid-stab {
+    inherit (llvmPackages) openmp;
+  };
 
   vigra = callPackage ../development/libraries/vigra { };
 
@@ -16833,7 +16855,7 @@ in
     enableMDNS = true;
     enableDomainController = true;
     enableRegedit = true;
-    enableCephFS = true;
+    enableCephFS = !pkgs.stdenv.hostPlatform.isAarch64;
     enableGlusterFS = true;
   });
 
@@ -17991,6 +18013,8 @@ in
 
   iferr = callPackage ../development/tools/iferr { };
 
+  ginkgo = callPackage ../development/tools/ginkgo { };
+
   go-bindata = callPackage ../development/tools/go-bindata { };
 
   go-bindata-assetfs = callPackage ../development/tools/go-bindata-assetfs { };
@@ -18174,8 +18198,6 @@ in
 
   regionset = callPackage ../os-specific/linux/regionset { };
 
-  rfkill = callPackage ../os-specific/linux/rfkill { };
-
   rfkill_udev = callPackage ../os-specific/linux/rfkill/udev.nix { };
 
   riscv-pk = callPackage ../misc/riscv-pk { };
@@ -20919,6 +20941,8 @@ in
 
   i3lock-fancy = callPackage ../applications/window-managers/i3/lock-fancy.nix { };
 
+  i3lock-fancy-rapid = callPackage ../applications/window-managers/i3/lock-fancy-rapid.nix { };
+
   i3lock-pixeled = callPackage ../misc/screensavers/i3lock-pixeled { };
 
   betterlockscreen = callPackage ../misc/screensavers/betterlockscreen {
@@ -22146,6 +22170,10 @@ in
 
   opentimestamps-client = python3Packages.callPackage ../tools/misc/opentimestamps-client {};
 
+  opentoonz = (qt5.overrideScope' (_: _: {
+    libtiff = callPackage ../applications/graphics/opentoonz/libtiff.nix { };
+  })).callPackage ../applications/graphics/opentoonz { };
+
   opentx = libsForQt5.callPackage ../applications/misc/opentx { };
 
   opera = callPackage ../applications/networking/browsers/opera {};
@@ -23420,6 +23448,8 @@ in
     inherit (lua52Packages) lpeg;
   };
 
+  viw = callPackage ../applications/editors/viw { };
+
   virt-viewer = callPackage ../applications/virtualization/virt-viewer { };
 
   virt-top = callPackage ../applications/virtualization/virt-top { };
@@ -24635,6 +24665,10 @@ in
     cudatoolkit = cudatoolkit_10_2;
   };
 
+  katagoCPU = katago.override {
+    gpuEnabled = false;
+  };
+
   klavaro = callPackage ../games/klavaro {};
 
   kobodeluxe = callPackage ../games/kobodeluxe { };
@@ -25144,6 +25178,8 @@ in
     tk = tk-8_5;
   };
 
+  xcowsay = callPackage ../games/xcowsay { };
+
   xjump = callPackage ../games/xjump { };
   # TODO: the corresponding nix file is missing
   # xracer = callPackage ../games/xracer { };
@@ -26495,9 +26531,7 @@ in
 
   hatari = callPackage ../misc/emulators/hatari { };
 
-  helm = callPackage ../applications/audio/helm {
-    stdenv = gcc8Stdenv;
-  };
+  helm = callPackage ../applications/audio/helm { };
 
   helmfile = callPackage ../applications/networking/cluster/helmfile { };
 
diff --git a/pkgs/top-level/make-tarball.nix b/pkgs/top-level/make-tarball.nix
index 5e307305af5..f65829e29ca 100644
--- a/pkgs/top-level/make-tarball.nix
+++ b/pkgs/top-level/make-tarball.nix
@@ -40,7 +40,6 @@ releaseTools.sourceTarball {
   checkPhase = ''
     set -o pipefail
 
-    export NIX_DB_DIR=$TMPDIR
     export NIX_STATE_DIR=$TMPDIR
     export NIX_PATH=nixpkgs=$TMPDIR/barf.nix
     opts=(--option build-users-group "")
diff --git a/pkgs/top-level/metrics.nix b/pkgs/top-level/metrics.nix
index 244b0ce7a66..2bfcb9d5d80 100644
--- a/pkgs/top-level/metrics.nix
+++ b/pkgs/top-level/metrics.nix
@@ -7,7 +7,6 @@ runCommand "nixpkgs-metrics"
     requiredSystemFeatures = [ "benchmark" ];
   }
   ''
-    export NIX_DB_DIR=$TMPDIR
     export NIX_STATE_DIR=$TMPDIR
     nix-store --init
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index d845fbde0d9..2f5fffe5f9c 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -4039,6 +4039,23 @@ let
     };
   };
 
+  CryptSodium = buildPerlPackage {
+    pname = "Crypt-Sodium";
+    version = "0.11";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/M/MG/MGREGORO/Crypt-Sodium-0.11.tar.gz";
+      sha256 = "0y3c24zv4iwnvlf9zwxambk8ddram54fm6l1m5yhbskc0nhp6z4h";
+    };
+    NIX_CFLAGS_COMPILE = "-I${pkgs.libsodium.dev}/include";
+    NIX_CFLAGS_LINK = "-L${pkgs.libsodium.out}/lib -lsodium";
+    meta = {
+      homepage = "https://metacpan.org/release/Crypt-Sodium";
+      description = "Perl bindings for libsodium (NaCL)";
+      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
+      maintainers = [ maintainers.sgo ];
+    };
+  };
+
   CryptTwofish = buildPerlPackage {
     pname = "Crypt-Twofish";
     version = "2.17";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 71caebcd68a..7863984e832 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4917,6 +4917,8 @@ in {
 
   multiprocess = callPackage ../development/python-modules/multiprocess { };
 
+  multitasking = callPackage ../development/python-modules/multitasking { };
+
   munkres = callPackage ../development/python-modules/munkres { };
 
   musicbrainzngs = callPackage ../development/python-modules/musicbrainzngs { };
@@ -5950,7 +5952,8 @@ in {
 
   readchar = callPackage ../development/python-modules/readchar { };
 
-  retworkx = callPackage ../development/python-modules/retworkx { };
+  retworkx = disabledIf (pythonOlder "3.5")
+    (toPythonModule (callPackage ../development/python-modules/retworkx { } ));
 
   rivet = disabledIf (!isPy3k) (toPythonModule (pkgs.rivet.override {
     python3 = python;
@@ -7746,6 +7749,8 @@ in {
 
   yattag = callPackage ../development/python-modules/yattag { };
 
+  yfinance = callPackage ../development/python-modules/yfinance { };
+
   xenomapper = disabledIf (!isPy3k) (callPackage ../applications/science/biology/xenomapper { });
 
   z3 = (toPythonModule (pkgs.z3.override {