summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--nixos/modules/config/users-groups.nix6
-rw-r--r--nixos/modules/installer/tools/tools.nix2
-rw-r--r--nixos/modules/programs/command-not-found/command-not-found.nix4
-rw-r--r--nixos/modules/programs/command-not-found/command-not-found.pl2
-rw-r--r--nixos/modules/system/activation/switch-to-configuration.pl2
-rw-r--r--nixos/modules/system/activation/top-level.nix3
-rw-r--r--nixos/modules/system/boot/loader/grub/grub.nix8
-rw-r--r--nixos/modules/system/etc/etc.nix2
-rw-r--r--nixos/modules/testing/service-runner.nix2
-rw-r--r--pkgs/applications/audio/mpg123/default.nix4
-rw-r--r--pkgs/applications/graphics/ImageMagick/7.0.nix16
-rw-r--r--pkgs/applications/graphics/feh/default.nix11
-rw-r--r--pkgs/applications/misc/gnome-usage/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/istioctl/default.nix6
-rw-r--r--pkgs/applications/version-management/git-and-tools/git/default.nix4
-rw-r--r--pkgs/build-support/fetchgit/default.nix2
-rw-r--r--pkgs/build-support/writers/default.nix15
-rw-r--r--pkgs/data/misc/cacert/default.nix5
-rw-r--r--pkgs/development/compilers/llvm/10/compiler-rt/armv7l.patch (renamed from pkgs/development/compilers/llvm/10/compiler-rt-armv7l.patch)0
-rw-r--r--pkgs/development/compilers/llvm/10/compiler-rt/codesign.patch (renamed from pkgs/development/compilers/llvm/10/compiler-rt-codesign.patch)0
-rw-r--r--pkgs/development/compilers/llvm/10/compiler-rt/default.nix (renamed from pkgs/development/compilers/llvm/10/compiler-rt.nix)4
-rw-r--r--pkgs/development/compilers/llvm/10/compiler-rt/find-darwin-sdk-version.patch (renamed from pkgs/development/compilers/llvm/10/find-darwin-sdk-version.patch)0
-rw-r--r--pkgs/development/compilers/llvm/10/compiler-rt/sanitizers-nongnu.patch (renamed from pkgs/development/compilers/llvm/10/sanitizers-nongnu.patch)0
-rw-r--r--pkgs/development/compilers/llvm/10/default.nix12
-rw-r--r--pkgs/development/compilers/llvm/10/libc++abi/default.nix (renamed from pkgs/development/compilers/llvm/10/libc++abi.nix)4
-rw-r--r--pkgs/development/compilers/llvm/10/libc++abi/no-threads.patch (renamed from pkgs/development/compilers/llvm/10/libcxxabi-no-threads.patch)0
-rw-r--r--pkgs/development/compilers/llvm/10/libc++abi/wasm.patch (renamed from pkgs/development/compilers/llvm/10/libcxxabi-wasm.patch)0
-rw-r--r--pkgs/development/compilers/llvm/10/libunwind/default.nix (renamed from pkgs/development/compilers/llvm/10/libunwind.nix)0
-rw-r--r--pkgs/development/compilers/llvm/10/lld/default.nix (renamed from pkgs/development/compilers/llvm/10/lld.nix)0
-rw-r--r--pkgs/development/compilers/llvm/10/lldb/default.nix (renamed from pkgs/development/compilers/llvm/10/lldb.nix)2
-rw-r--r--pkgs/development/compilers/llvm/10/lldb/procfs.patch (renamed from pkgs/development/compilers/llvm/10/lldb-procfs.patch)0
-rw-r--r--pkgs/development/compilers/llvm/10/llvm/default.nix (renamed from pkgs/development/compilers/llvm/10/llvm.nix)6
-rw-r--r--pkgs/development/compilers/llvm/10/llvm/outputs.patch (renamed from pkgs/development/compilers/llvm/10/llvm-outputs.patch)0
-rw-r--r--pkgs/development/compilers/llvm/11/compiler-rt/X86-support-extension.patch (renamed from pkgs/development/compilers/llvm/11/compiler-rt-X86-support-extension.patch)0
-rw-r--r--pkgs/development/compilers/llvm/11/compiler-rt/armv7l.patch (renamed from pkgs/development/compilers/llvm/11/compiler-rt-armv7l.patch)0
-rw-r--r--pkgs/development/compilers/llvm/11/compiler-rt/codesign.patch (renamed from pkgs/development/compilers/llvm/11/compiler-rt-codesign.patch)0
-rw-r--r--pkgs/development/compilers/llvm/11/compiler-rt/default.nix (renamed from pkgs/development/compilers/llvm/11/compiler-rt.nix)6
-rw-r--r--pkgs/development/compilers/llvm/11/compiler-rt/sanitizers-nongnu.patch (renamed from pkgs/development/compilers/llvm/11/sanitizers-nongnu.patch)0
-rw-r--r--pkgs/development/compilers/llvm/11/default.nix12
-rw-r--r--pkgs/development/compilers/llvm/11/libc++abi/default.nix (renamed from pkgs/development/compilers/llvm/11/libc++abi.nix)4
-rw-r--r--pkgs/development/compilers/llvm/11/libc++abi/no-threads.patch (renamed from pkgs/development/compilers/llvm/11/libcxxabi-no-threads.patch)0
-rw-r--r--pkgs/development/compilers/llvm/11/libc++abi/wasm.patch (renamed from pkgs/development/compilers/llvm/11/libcxxabi-wasm.patch)0
-rw-r--r--pkgs/development/compilers/llvm/11/libunwind/default.nix (renamed from pkgs/development/compilers/llvm/11/libunwind.nix)0
-rw-r--r--pkgs/development/compilers/llvm/11/lld/default.nix (renamed from pkgs/development/compilers/llvm/11/lld.nix)0
-rw-r--r--pkgs/development/compilers/llvm/11/lldb/default.nix (renamed from pkgs/development/compilers/llvm/11/lldb.nix)2
-rw-r--r--pkgs/development/compilers/llvm/11/lldb/procfs.patch (renamed from pkgs/development/compilers/llvm/11/lldb-procfs.patch)0
-rw-r--r--pkgs/development/compilers/llvm/11/llvm/default.nix (renamed from pkgs/development/compilers/llvm/11/llvm.nix)4
-rw-r--r--pkgs/development/compilers/llvm/11/llvm/outputs.patch (renamed from pkgs/development/compilers/llvm/11/llvm-outputs.patch)0
-rw-r--r--pkgs/development/compilers/llvm/5/compiler-rt/armv7l.patch (renamed from pkgs/development/compilers/llvm/5/compiler-rt-armv7l.patch)0
-rw-r--r--pkgs/development/compilers/llvm/5/compiler-rt/codesign.patch (renamed from pkgs/development/compilers/llvm/5/compiler-rt-codesign.patch)0
-rw-r--r--pkgs/development/compilers/llvm/5/compiler-rt/default.nix (renamed from pkgs/development/compilers/llvm/5/compiler-rt.nix)9
-rw-r--r--pkgs/development/compilers/llvm/5/compiler-rt/sanitizers-nongnu.patch (renamed from pkgs/development/compilers/llvm/5/sanitizers-nongnu.patch)0
-rw-r--r--pkgs/development/compilers/llvm/5/compiler-rt/sys-ustat.patch (renamed from pkgs/development/compilers/llvm/5/compiler-rt-sys-ustat.patch)0
-rw-r--r--pkgs/development/compilers/llvm/5/default.nix10
-rw-r--r--pkgs/development/compilers/llvm/5/libc++abi/default.nix (renamed from pkgs/development/compilers/llvm/5/libc++abi.nix)0
-rw-r--r--pkgs/development/compilers/llvm/5/lld/default.nix (renamed from pkgs/development/compilers/llvm/5/lld.nix)0
-rw-r--r--pkgs/development/compilers/llvm/5/lldb/default.nix (renamed from pkgs/development/compilers/llvm/5/lldb.nix)0
-rw-r--r--pkgs/development/compilers/llvm/5/llvm/default.nix (renamed from pkgs/development/compilers/llvm/5/llvm.nix)34
-rw-r--r--pkgs/development/compilers/llvm/5/llvm/fix-gcc9.patch (renamed from pkgs/development/compilers/llvm/5/fix-gcc9.patch)0
-rw-r--r--pkgs/development/compilers/llvm/5/llvm/outputs.patch (renamed from pkgs/development/compilers/llvm/5/llvm-outputs.patch)0
-rw-r--r--pkgs/development/compilers/llvm/6/compiler-rt/armv7l.patch (renamed from pkgs/development/compilers/llvm/6/compiler-rt-armv7l.patch)0
-rw-r--r--pkgs/development/compilers/llvm/6/compiler-rt/codesign.patch (renamed from pkgs/development/compilers/llvm/6/compiler-rt-codesign.patch)0
-rw-r--r--pkgs/development/compilers/llvm/6/compiler-rt/default.nix (renamed from pkgs/development/compilers/llvm/6/compiler-rt.nix)7
-rw-r--r--pkgs/development/compilers/llvm/6/compiler-rt/sanitizers-nongnu.patch (renamed from pkgs/development/compilers/llvm/6/sanitizers-nongnu.patch)0
-rw-r--r--pkgs/development/compilers/llvm/6/default.nix10
-rw-r--r--pkgs/development/compilers/llvm/6/libc++abi/default.nix (renamed from pkgs/development/compilers/llvm/6/libc++abi.nix)0
-rw-r--r--pkgs/development/compilers/llvm/6/lld/default.nix (renamed from pkgs/development/compilers/llvm/6/lld.nix)0
-rw-r--r--pkgs/development/compilers/llvm/6/lldb/default.nix (renamed from pkgs/development/compilers/llvm/6/lldb.nix)0
-rw-r--r--pkgs/development/compilers/llvm/6/llvm/default.nix (renamed from pkgs/development/compilers/llvm/6/llvm.nix)6
-rw-r--r--pkgs/development/compilers/llvm/6/llvm/outputs.patch (renamed from pkgs/development/compilers/llvm/6/llvm-outputs.patch)0
-rw-r--r--pkgs/development/compilers/llvm/7/compiler-rt/armv7l.patch (renamed from pkgs/development/compilers/llvm/7/compiler-rt-armv7l.patch)0
-rw-r--r--pkgs/development/compilers/llvm/7/compiler-rt/codesign.patch (renamed from pkgs/development/compilers/llvm/7/compiler-rt-codesign.patch)0
-rw-r--r--pkgs/development/compilers/llvm/7/compiler-rt/crtbegin-and-end.patch (renamed from pkgs/development/compilers/llvm/7/crtbegin-and-end.patch)0
-rw-r--r--pkgs/development/compilers/llvm/7/compiler-rt/default.nix (renamed from pkgs/development/compilers/llvm/7/compiler-rt.nix)7
-rw-r--r--pkgs/development/compilers/llvm/7/compiler-rt/sanitizers-nongnu.patch (renamed from pkgs/development/compilers/llvm/7/sanitizers-nongnu.patch)0
-rw-r--r--pkgs/development/compilers/llvm/7/default.nix13
-rw-r--r--pkgs/development/compilers/llvm/7/libc++abi/default.nix (renamed from pkgs/development/compilers/llvm/7/libc++abi.nix)0
-rw-r--r--pkgs/development/compilers/llvm/7/lld/default.nix (renamed from pkgs/development/compilers/llvm/7/lld.nix)0
-rw-r--r--pkgs/development/compilers/llvm/7/lldb/default.nix (renamed from pkgs/development/compilers/llvm/7/lldb.nix)0
-rw-r--r--pkgs/development/compilers/llvm/7/llvm/default.nix (renamed from pkgs/development/compilers/llvm/7/llvm.nix)6
-rw-r--r--pkgs/development/compilers/llvm/7/llvm/outputs.patch (renamed from pkgs/development/compilers/llvm/7/llvm-outputs.patch)0
-rw-r--r--pkgs/development/compilers/llvm/8/compiler-rt/armv7l.patch (renamed from pkgs/development/compilers/llvm/8/compiler-rt-armv7l.patch)0
-rw-r--r--pkgs/development/compilers/llvm/8/compiler-rt/codesign.patch (renamed from pkgs/development/compilers/llvm/8/compiler-rt-codesign.patch)0
-rw-r--r--pkgs/development/compilers/llvm/8/compiler-rt/crtbegin-and-end.patch (renamed from pkgs/development/compilers/llvm/8/crtbegin-and-end.patch)0
-rw-r--r--pkgs/development/compilers/llvm/8/compiler-rt/default.nix (renamed from pkgs/development/compilers/llvm/8/compiler-rt.nix)7
-rw-r--r--pkgs/development/compilers/llvm/8/compiler-rt/sanitizers-nongnu.patch (renamed from pkgs/development/compilers/llvm/8/sanitizers-nongnu.patch)0
-rw-r--r--pkgs/development/compilers/llvm/8/default.nix15
-rw-r--r--pkgs/development/compilers/llvm/8/libc++abi/default.nix (renamed from pkgs/development/compilers/llvm/8/libc++abi.nix)4
-rw-r--r--pkgs/development/compilers/llvm/8/libc++abi/no-threads.patch (renamed from pkgs/development/compilers/llvm/8/libcxxabi-no-threads.patch)0
-rw-r--r--pkgs/development/compilers/llvm/8/libc++abi/wasm.patch (renamed from pkgs/development/compilers/llvm/8/libcxxabi-wasm.patch)0
-rw-r--r--pkgs/development/compilers/llvm/8/libunwind/default.nix (renamed from pkgs/development/compilers/llvm/8/libunwind.nix)0
-rw-r--r--pkgs/development/compilers/llvm/8/lld/default.nix (renamed from pkgs/development/compilers/llvm/8/lld.nix)0
-rw-r--r--pkgs/development/compilers/llvm/8/lldb/default.nix (renamed from pkgs/development/compilers/llvm/8/lldb.nix)0
-rw-r--r--pkgs/development/compilers/llvm/8/llvm/default.nix (renamed from pkgs/development/compilers/llvm/8/llvm.nix)6
-rw-r--r--pkgs/development/compilers/llvm/8/llvm/outputs.patch (renamed from pkgs/development/compilers/llvm/8/llvm-outputs.patch)0
-rw-r--r--pkgs/development/compilers/llvm/9/compiler-rt/armv7l.patch (renamed from pkgs/development/compilers/llvm/9/compiler-rt-armv7l.patch)0
-rw-r--r--pkgs/development/compilers/llvm/9/compiler-rt/codesign.patch (renamed from pkgs/development/compilers/llvm/9/compiler-rt-codesign.patch)0
-rw-r--r--pkgs/development/compilers/llvm/9/compiler-rt/default.nix (renamed from pkgs/development/compilers/llvm/9/compiler-rt.nix)7
-rw-r--r--pkgs/development/compilers/llvm/9/compiler-rt/sanitizers-nongnu.patch (renamed from pkgs/development/compilers/llvm/9/sanitizers-nongnu.patch)0
-rw-r--r--pkgs/development/compilers/llvm/9/default.nix15
-rw-r--r--pkgs/development/compilers/llvm/9/libc++abi/default.nix (renamed from pkgs/development/compilers/llvm/9/libc++abi.nix)4
-rw-r--r--pkgs/development/compilers/llvm/9/libc++abi/no-threads.patch (renamed from pkgs/development/compilers/llvm/9/libcxxabi-no-threads.patch)0
-rw-r--r--pkgs/development/compilers/llvm/9/libc++abi/wasm.patch (renamed from pkgs/development/compilers/llvm/9/libcxxabi-wasm.patch)0
-rw-r--r--pkgs/development/compilers/llvm/9/libunwind/default.nix (renamed from pkgs/development/compilers/llvm/9/libunwind.nix)0
-rw-r--r--pkgs/development/compilers/llvm/9/lld/default.nix (renamed from pkgs/development/compilers/llvm/9/lld.nix)0
-rw-r--r--pkgs/development/compilers/llvm/9/lldb/default.nix (renamed from pkgs/development/compilers/llvm/9/lldb.nix)2
-rw-r--r--pkgs/development/compilers/llvm/9/lldb/procfs.patch (renamed from pkgs/development/compilers/llvm/9/lldb-procfs.patch)0
-rw-r--r--pkgs/development/compilers/llvm/9/llvm/default.nix (renamed from pkgs/development/compilers/llvm/9/llvm.nix)6
-rw-r--r--pkgs/development/compilers/llvm/9/llvm/fix-test-on-non-x86-like-others.patch (renamed from pkgs/development/compilers/llvm/9/fix-test-on-non-x86-like-others.patch)0
-rw-r--r--pkgs/development/compilers/llvm/9/llvm/outputs.patch (renamed from pkgs/development/compilers/llvm/9/llvm-outputs.patch)0
-rw-r--r--pkgs/development/compilers/llvm/common/compiler-rt/glibc.patch (renamed from pkgs/development/compilers/llvm/7/compiler-rt-glibc.patch)0
-rw-r--r--pkgs/development/compilers/llvm/rocm/default.nix4
-rw-r--r--pkgs/development/compilers/llvm/rocm/lld/default.nix (renamed from pkgs/development/compilers/llvm/rocm/lld.nix)0
-rw-r--r--pkgs/development/compilers/llvm/rocm/llvm/default.nix (renamed from pkgs/development/compilers/llvm/rocm/llvm.nix)4
-rw-r--r--pkgs/development/compilers/llvm/rocm/llvm/outputs.patch (renamed from pkgs/development/compilers/llvm/rocm/llvm-outputs.patch)0
-rw-r--r--pkgs/development/compilers/ocaml/4.10.nix4
-rw-r--r--pkgs/development/compilers/rust/1_51.nix (renamed from pkgs/development/compilers/rust/1_50.nix)26
-rw-r--r--pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh7
-rw-r--r--pkgs/development/libraries/fontconfig/default.nix3
-rw-r--r--pkgs/development/libraries/glibc/2.32-master.patch.gzbin56968 -> 58063 bytes
-rw-r--r--pkgs/development/libraries/glibc/common.nix15
-rw-r--r--pkgs/development/libraries/libaom/default.nix4
-rw-r--r--pkgs/development/libraries/libassuan/default.nix4
-rw-r--r--pkgs/development/libraries/libtheora/default.nix18
-rw-r--r--pkgs/development/libraries/libva/default.nix4
-rw-r--r--pkgs/development/libraries/libva/utils.nix4
-rw-r--r--pkgs/development/libraries/mesa/default.nix16
-rw-r--r--pkgs/development/libraries/nspr/default.nix4
-rw-r--r--pkgs/development/libraries/nss/default.nix4
-rw-r--r--pkgs/development/libraries/science/math/blis/default.nix4
-rw-r--r--pkgs/development/libraries/science/math/openblas/default.nix12
-rw-r--r--pkgs/development/python-modules/Pygments/2_5.nix4
-rw-r--r--pkgs/development/python-modules/Pygments/default.nix6
-rw-r--r--pkgs/development/python-modules/bootstrapped-pip/2.nix67
-rw-r--r--pkgs/development/python-modules/bootstrapped-pip/default.nix1
-rw-r--r--pkgs/development/python-modules/cryptography/default.nix6
-rw-r--r--pkgs/development/python-modules/cryptography/vectors.nix2
-rw-r--r--pkgs/development/python-modules/django/2.nix4
-rw-r--r--pkgs/development/python-modules/lxml/default.nix4
-rw-r--r--pkgs/development/python-modules/packaging/default.nix4
-rw-r--r--pkgs/development/python-modules/pillow/6.nix18
-rw-r--r--pkgs/development/python-modules/pillow/default.nix4
-rw-r--r--pkgs/development/python-modules/pip/20.nix44
-rw-r--r--pkgs/development/python-modules/pip/default.nix4
-rw-r--r--pkgs/development/python-modules/setuptools-rust/default.nix8
-rw-r--r--pkgs/development/python-modules/setuptools-rust/pyo3-test/default.nix6
-rw-r--r--pkgs/development/python-modules/setuptools/default.nix11
-rw-r--r--pkgs/development/python-modules/urllib3/2.nix9
-rw-r--r--pkgs/development/python-modules/urllib3/default.nix4
-rw-r--r--pkgs/development/ruby-modules/gem-config/default.nix12
-rw-r--r--pkgs/development/tools/build-managers/cmake/default.nix4
-rw-r--r--pkgs/development/tools/jbang/default.nix4
-rw-r--r--pkgs/development/tools/misc/binutils/CVE-2020-35448.patch77
-rw-r--r--pkgs/development/tools/misc/binutils/default.nix1
-rw-r--r--pkgs/development/tools/misc/elfutils/default.nix6
-rw-r--r--pkgs/development/tools/misc/icon-naming-utils/default.nix11
-rw-r--r--pkgs/development/tools/ocaml/findlib/default.nix4
-rw-r--r--pkgs/development/tools/rust/maturin/pyo3-test/default.nix4
-rw-r--r--pkgs/development/tools/rust/maturin/pyo3-test/generic.nix10
-rw-r--r--pkgs/misc/screensavers/xscreensaver/default.nix14
-rw-r--r--pkgs/os-specific/linux/apparmor/default.nix7
-rw-r--r--pkgs/os-specific/linux/bluez/default.nix10
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix3
-rw-r--r--pkgs/os-specific/linux/rdma-core/default.nix6
-rw-r--r--pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch8
-rw-r--r--pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch6
-rw-r--r--pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch12
-rw-r--r--pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch10
-rw-r--r--pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch8
-rw-r--r--pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch6
-rw-r--r--pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch12
-rw-r--r--pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch6
-rw-r--r--pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch12
-rw-r--r--pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch6
-rw-r--r--pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch10
-rw-r--r--pkgs/os-specific/linux/systemd/0012-inherit-systemd-environment-when-calling-generators.patch10
-rw-r--r--pkgs/os-specific/linux/systemd/0013-add-rootprefix-to-lookup-dir-paths.patch6
-rw-r--r--pkgs/os-specific/linux/systemd/0014-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch6
-rw-r--r--pkgs/os-specific/linux/systemd/0015-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch6
-rw-r--r--pkgs/os-specific/linux/systemd/0016-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch6
-rw-r--r--pkgs/os-specific/linux/systemd/0017-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch6
-rw-r--r--pkgs/os-specific/linux/systemd/0018-logind-seat-debus-show-CanMultiSession-again.patch6
-rw-r--r--pkgs/os-specific/linux/systemd/0019-Revert-pkg-config-prefix-is-not-really-configurable-.patch72
-rw-r--r--pkgs/os-specific/linux/systemd/0019-pkg-config-derive-prefix-from-prefix.patch33
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix8
-rw-r--r--pkgs/servers/samba/4.x.nix4
-rw-r--r--pkgs/servers/x11/xorg/default.nix18
-rw-r--r--pkgs/servers/x11/xorg/tarballs.list6
-rw-r--r--pkgs/shells/bash/4.4.nix2
-rw-r--r--pkgs/shells/bash/pgrp-pipe-4.4.patch14
-rw-r--r--pkgs/tools/backup/dar/default.nix4
-rw-r--r--pkgs/tools/backup/store-backup/default.nix8
-rw-r--r--pkgs/tools/backup/znapzend/default.nix31
-rw-r--r--pkgs/tools/filesystems/e2fsprogs/default.nix13
-rw-r--r--pkgs/tools/filesystems/file-rename/default.nix10
-rw-r--r--pkgs/tools/filesystems/ntfs-3g/default.nix22
-rw-r--r--pkgs/tools/misc/hdf5/1.10.nix50
-rw-r--r--pkgs/tools/misc/hdf5/default.nix10
-rw-r--r--pkgs/tools/misc/lbdb/default.nix37
-rw-r--r--pkgs/tools/misc/rrdtool/default.nix4
-rw-r--r--pkgs/tools/networking/networkmanager/default.nix4
-rw-r--r--pkgs/tools/networking/tgt/default.nix4
-rw-r--r--pkgs/tools/package-management/dpkg/default.nix3
-rw-r--r--pkgs/tools/package-management/nix-serve/default.nix19
-rw-r--r--pkgs/tools/package-management/nix/default.nix10
-rw-r--r--pkgs/tools/virtualization/govc/default.nix4
-rw-r--r--pkgs/tools/virtualization/nixos-container/default.nix4
-rwxr-xr-xpkgs/tools/virtualization/nixos-container/nixos-container.pl2
-rw-r--r--pkgs/top-level/all-packages.nix22
-rw-r--r--pkgs/top-level/python-packages.nix28
210 files changed, 836 insertions, 590 deletions
diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix
index 5ed1f568f49..4a2647339c5 100644
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@@ -556,10 +556,8 @@ in {
         install -m 0700 -d /root
         install -m 0755 -d /home
 
-        ${pkgs.perl}/bin/perl -w \
-          -I${pkgs.perlPackages.FileSlurp}/${pkgs.perl.libPrefix} \
-          -I${pkgs.perlPackages.JSON}/${pkgs.perl.libPrefix} \
-          ${./update-users-groups.pl} ${spec}
+        ${pkgs.perl.withPackages (p: [ p.FileSlurp p.JSON ])}/bin/perl \
+        -w ${./update-users-groups.pl} ${spec}
       '';
 
     # for backwards compatibility
diff --git a/nixos/modules/installer/tools/tools.nix b/nixos/modules/installer/tools/tools.nix
index a9e5641b05a..77c974fc22c 100644
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@@ -34,7 +34,7 @@ let
     name = "nixos-generate-config";
     src = ./nixos-generate-config.pl;
     path = lib.optionals (lib.elem "btrfs" config.boot.supportedFilesystems) [ pkgs.btrfs-progs ];
-    perl = "${pkgs.perl}/bin/perl -I${pkgs.perlPackages.FileSlurp}/${pkgs.perl.libPrefix}";
+    perl = "${pkgs.perl.withPackages (p: [ p.FileSlurp ])}/bin/perl";
     inherit (config.system.nixos-generate-config) configuration desktopConfiguration;
     xserverEnabled = config.services.xserver.enable;
   };
diff --git a/nixos/modules/programs/command-not-found/command-not-found.nix b/nixos/modules/programs/command-not-found/command-not-found.nix
index d8394bf73a2..79786584c66 100644
--- a/nixos/modules/programs/command-not-found/command-not-found.nix
+++ b/nixos/modules/programs/command-not-found/command-not-found.nix
@@ -14,10 +14,8 @@ let
     dir = "bin";
     src = ./command-not-found.pl;
     isExecutable = true;
-    inherit (pkgs) perl;
     inherit (cfg) dbPath;
-    perlFlags = concatStrings (map (path: "-I ${path}/${pkgs.perl.libPrefix} ")
-      [ pkgs.perlPackages.DBI pkgs.perlPackages.DBDSQLite pkgs.perlPackages.StringShellQuote ]);
+    perl = pkgs.perl.withPackages (p: [ p.DBDSQLite p.StringShellQuote ]);
   };
 
 in
diff --git a/nixos/modules/programs/command-not-found/command-not-found.pl b/nixos/modules/programs/command-not-found/command-not-found.pl
index 7515dd975c3..6e275bcc8be 100644
--- a/nixos/modules/programs/command-not-found/command-not-found.pl
+++ b/nixos/modules/programs/command-not-found/command-not-found.pl
@@ -1,4 +1,4 @@
-#! @perl@/bin/perl -w @perlFlags@
+#! @perl@/bin/perl -w
 
 use strict;
 use DBI;
diff --git a/nixos/modules/system/activation/switch-to-configuration.pl b/nixos/modules/system/activation/switch-to-configuration.pl
index b82d69b3bb8..8bd85465472 100644
--- a/nixos/modules/system/activation/switch-to-configuration.pl
+++ b/nixos/modules/system/activation/switch-to-configuration.pl
@@ -1,4 +1,4 @@
-#! @perl@
+#! @perl@/bin/perl
 
 use strict;
 use warnings;
diff --git a/nixos/modules/system/activation/top-level.nix b/nixos/modules/system/activation/top-level.nix
index b0f77ca3fb8..9dbca4e33f3 100644
--- a/nixos/modules/system/activation/top-level.nix
+++ b/nixos/modules/system/activation/top-level.nix
@@ -113,8 +113,7 @@ let
     configurationName = config.boot.loader.grub.configurationName;
 
     # Needed by switch-to-configuration.
-
-    perl = "${pkgs.perl}/bin/perl " + (concatMapStringsSep " " (lib: "-I${lib}/${pkgs.perl.libPrefix}") (with pkgs.perlPackages; [ FileSlurp NetDBus XMLParser XMLTwig ]));
+    perl = pkgs.perl.withPackages (p: with p; [ FileSlurp NetDBus XMLParser XMLTwig ]);
   };
 
   # Handle assertions and warnings
diff --git a/nixos/modules/system/boot/loader/grub/grub.nix b/nixos/modules/system/boot/loader/grub/grub.nix
index 289c2b19986..c6ec9acd54c 100644
--- a/nixos/modules/system/boot/loader/grub/grub.nix
+++ b/nixos/modules/system/boot/loader/grub/grub.nix
@@ -728,13 +728,17 @@ in
             utillinux = pkgs.util-linux;
             btrfsprogs = pkgs.btrfs-progs;
           };
+          perl = pkgs.perl.withPackages (p: with p; [
+            FileSlurp FileCopyRecursive
+            XMLLibXML XMLSAX XMLSAXBase
+            ListCompare JSON
+          ]);
         in pkgs.writeScript "install-grub.sh" (''
         #!${pkgs.runtimeShell}
         set -e
-        export PERL5LIB=${with pkgs.perlPackages; makePerlPath [ FileSlurp FileCopyRecursive XMLLibXML XMLSAX XMLSAXBase ListCompare JSON ]}
         ${optionalString cfg.enableCryptodisk "export GRUB_ENABLE_CRYPTODISK=y"}
       '' + flip concatMapStrings cfg.mirroredBoots (args: ''
-        ${pkgs.perl}/bin/perl ${install-grub-pl} ${grubConfig args} $@
+        ${perl}/bin/perl ${install-grub-pl} ${grubConfig args} $@
       '') + cfg.extraInstallCommands);
 
       system.build.grub = grub;
diff --git a/nixos/modules/system/etc/etc.nix b/nixos/modules/system/etc/etc.nix
index 7478e3e8071..a450f303572 100644
--- a/nixos/modules/system/etc/etc.nix
+++ b/nixos/modules/system/etc/etc.nix
@@ -154,7 +154,7 @@ in
       ''
         # Set up the statically computed bits of /etc.
         echo "setting up /etc..."
-        ${pkgs.perl}/bin/perl -I${pkgs.perlPackages.FileSlurp}/${pkgs.perl.libPrefix} ${./setup-etc.pl} ${etc}/etc
+        ${pkgs.perl.withPackages (p: [ p.FileSlurp ])}/bin/perl ${./setup-etc.pl} ${etc}/etc
       '';
 
   };
diff --git a/nixos/modules/testing/service-runner.nix b/nixos/modules/testing/service-runner.nix
index 76e9d4a68c4..9060be3cca1 100644
--- a/nixos/modules/testing/service-runner.nix
+++ b/nixos/modules/testing/service-runner.nix
@@ -6,7 +6,7 @@ let
 
   makeScript = name: service: pkgs.writeScript "${name}-runner"
     ''
-      #! ${pkgs.perl}/bin/perl -w -I${pkgs.perlPackages.FileSlurp}/${pkgs.perl.libPrefix}
+      #! ${pkgs.perl.withPackages (p: [ p.FileSlurp ])}/bin/perl -w
 
       use File::Slurp;
 
diff --git a/pkgs/applications/audio/mpg123/default.nix b/pkgs/applications/audio/mpg123/default.nix
index 5c7eb6b88cf..a3e5b3e50eb 100644
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@@ -7,11 +7,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "mpg123-1.26.4";
+  name = "mpg123-1.26.5";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/${name}.tar.bz2";
-    sha256 = "sha256-CBmRVA33pmaykEmthw8pPPoohjs2SIq01Yzqp7WEZFQ=";
+    sha256 = "sha256-UCqX4Nk1vn432YczgCHY8wG641wohPKoPVnEtSRm7wY=";
   };
 
   outputs = [ "out" "conplay" ];
diff --git a/pkgs/applications/graphics/ImageMagick/7.0.nix b/pkgs/applications/graphics/ImageMagick/7.0.nix
index 49021f5e3c3..d4a7d292322 100644
--- a/pkgs/applications/graphics/ImageMagick/7.0.nix
+++ b/pkgs/applications/graphics/ImageMagick/7.0.nix
@@ -12,27 +12,19 @@ let
     else if stdenv.hostPlatform.system == "aarch64-linux" then "aarch64"
     else if stdenv.hostPlatform.system == "powerpc64le-linux" then "ppc64le"
     else throw "ImageMagick is not supported on this platform.";
-
-  cfg = {
-    version = "7.0.11-3";
-    sha256 = "sha256-y937OxAHNTbWa96oQmTpp/ivxtPVL16hr4SvzZWugQo=";
-    patches = [];
-  };
 in
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "imagemagick";
-  inherit (cfg) version;
+  version = "7.0.11-5";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
-    rev = cfg.version;
-    inherit (cfg) sha256;
+    rev = version;
+    sha256 = "sha256-HJUC8lUHORZMHvSv1/EYM+JOsd89quFaU1Fz08AckG8=";
   };
 
-  patches = cfg.patches;
-
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
   outputMan = "out"; # it's tiny
 
diff --git a/pkgs/applications/graphics/feh/default.nix b/pkgs/applications/graphics/feh/default.nix
index fac3dbb5534..40ae0235606 100644
--- a/pkgs/applications/graphics/feh/default.nix
+++ b/pkgs/applications/graphics/feh/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, makeWrapper
 , xorg, imlib2, libjpeg, libpng
-, curl, libexif, jpegexiforient, perlPackages
+, curl, libexif, jpegexiforient, perl
 , enableAutoreload ? !stdenv.hostPlatform.isDarwin }:
 
 with lib;
@@ -31,14 +31,7 @@ stdenv.mkDerivation rec {
                                --add-flags '--theme=feh'
   '';
 
-  checkInputs = [ perlPackages.perl perlPackages.TestCommand ];
-  preCheck = ''
-    export PERL5LIB="${perlPackages.TestCommand}/${perlPackages.perl.libPrefix}"
-  '';
-  postCheck = ''
-    unset PERL5LIB
-  '';
-
+  checkInputs = lib.singleton (perl.withPackages (p: [ p.TestCommand ]));
   doCheck = true;
 
   meta = {
diff --git a/pkgs/applications/misc/gnome-usage/default.nix b/pkgs/applications/misc/gnome-usage/default.nix
index fee4ba655c3..bbd272754cd 100644
--- a/pkgs/applications/misc/gnome-usage/default.nix
+++ b/pkgs/applications/misc/gnome-usage/default.nix
@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-usage";
-  version = "3.38.0";
+  version = "3.38.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0mqs39yi2cqwkzlmmgzrszsva5hbdpws6zk4lbi4w2cjzl185mcl";
+    sha256 = "mMdm4X4VZXEfx0uaJP0u0NX618y0VRlhLdTiFHaO05M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/cluster/istioctl/default.nix b/pkgs/applications/networking/cluster/istioctl/default.nix
index 1c7a39d91bd..fdf9e97e7c9 100644
--- a/pkgs/applications/networking/cluster/istioctl/default.nix
+++ b/pkgs/applications/networking/cluster/istioctl/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "istioctl";
-  version = "1.9.1";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
     owner = "istio";
     repo = "istio";
     rev = version;
-    sha256 = "sha256-WcIcI+y8tTY0YfyuR/DUCjN1xbGpCOBWvEHBo+q2EV8=";
+    sha256 = "sha256-co/0ogI48FxrwVGwIuMqeFPFYtQF4/rv9V6b225TZc4=";
   };
-  vendorSha256 = "sha256-pSiJfQTvJ6OisdrWTH6mOcAn/wBA1OcVaGtOwBe1qvQ=";
+  vendorSha256 = "sha256-yJHYyRPl1V1WNV0nJoR3bRTTGRTQaT/tG4TSQeL5U88=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 1f7fd36e1d3..a7df1645c7a 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -24,7 +24,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.31.0";
+  version = "2.31.1";
   svn = subversionClient.override { perlBindings = perlSupport; };
 
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "0h4sg3xqa9pd2agrd7m18sqg319ls978d39qswyf30rjvg5n5wg8";
+    sha256 = "10367n5sv4nsgaxy486pbp7nscx34vjk8vrb06jm9ffm8ix42qcz";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";
diff --git a/pkgs/build-support/fetchgit/default.nix b/pkgs/build-support/fetchgit/default.nix
index df97ef1492d..3222866dc78 100644
--- a/pkgs/build-support/fetchgit/default.nix
+++ b/pkgs/build-support/fetchgit/default.nix
@@ -3,7 +3,7 @@
     inherit (lib) removeSuffix splitString last;
     base = last (splitString ":" (baseNameOf (removeSuffix "/" url)));
 
-    matched = builtins.match "(.*).git" base;
+    matched = builtins.match "(.*)\\.git" base;
 
     short = builtins.substring 0 7 rev;
 
diff --git a/pkgs/build-support/writers/default.nix b/pkgs/build-support/writers/default.nix
index f853f37fec6..47919c251af 100644
--- a/pkgs/build-support/writers/default.nix
+++ b/pkgs/build-support/writers/default.nix
@@ -257,18 +257,9 @@ rec {
   #     print "Howdy!\n" if true;
   #   ''
   writePerl = name: { libraries ? [] }:
-  let
-    perl-env = pkgs.buildEnv {
-      name = "perl-environment";
-      paths = libraries;
-      pathsToLink = [
-        "/${pkgs.perl.libPrefix}"
-      ];
-    };
-  in
-  makeScriptWriter {
-    interpreter = "${pkgs.perl}/bin/perl -I ${perl-env}/${pkgs.perl.libPrefix}";
-  } name;
+    makeScriptWriter {
+      interpreter = "${pkgs.perl.withPackages (p: libraries)}/bin/perl";
+    } name;
 
   # writePerlBin takes the same arguments as writePerl but outputs a directory (like writeScriptBin)
   writePerlBin = name:
diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix
index 9357a60a91f..17bb30a54b8 100644
--- a/pkgs/data/misc/cacert/default.nix
+++ b/pkgs/data/misc/cacert/default.nix
@@ -10,7 +10,8 @@
 with lib;
 
 let
-  version = "3.60";
+  version = "3.63";
+
   underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
 in
 
@@ -19,7 +20,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/nss-${version}.tar.gz";
-    sha256 = "hKvVV1q4dMU65RG9Rh5dCGjRobOE7kB1MVTN0dWQ/j0=";
+    sha256 = "0892xbjcaw6g4rd2rs4qa37nbda248cjrgxa4faaw0licbpjyb8q";
   };
 
   certdata2pem = fetchurl {
diff --git a/pkgs/development/compilers/llvm/10/compiler-rt-armv7l.patch b/pkgs/development/compilers/llvm/10/compiler-rt/armv7l.patch
index 120cfe6feb2..120cfe6feb2 100644
--- a/pkgs/development/compilers/llvm/10/compiler-rt-armv7l.patch
+++ b/pkgs/development/compilers/llvm/10/compiler-rt/armv7l.patch
diff --git a/pkgs/development/compilers/llvm/10/compiler-rt-codesign.patch b/pkgs/development/compilers/llvm/10/compiler-rt/codesign.patch
index 3cc12b94b20..3cc12b94b20 100644
--- a/pkgs/development/compilers/llvm/10/compiler-rt-codesign.patch
+++ b/pkgs/development/compilers/llvm/10/compiler-rt/codesign.patch
diff --git a/pkgs/development/compilers/llvm/10/compiler-rt.nix b/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
index 64d57e3e811..1d759c903fc 100644
--- a/pkgs/development/compilers/llvm/10/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
@@ -52,10 +52,10 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" ];
 
   patches = [
-    ./compiler-rt-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
+    ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
     ./find-darwin-sdk-version.patch # don't test for macOS being >= 10.15
   ]# ++ lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
-    ++ lib.optional stdenv.hostPlatform.isAarch32 ./compiler-rt-armv7l.patch;
+    ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
 
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
diff --git a/pkgs/development/compilers/llvm/10/find-darwin-sdk-version.patch b/pkgs/development/compilers/llvm/10/compiler-rt/find-darwin-sdk-version.patch
index fc16ddda76b..fc16ddda76b 100644
--- a/pkgs/development/compilers/llvm/10/find-darwin-sdk-version.patch
+++ b/pkgs/development/compilers/llvm/10/compiler-rt/find-darwin-sdk-version.patch
diff --git a/pkgs/development/compilers/llvm/10/sanitizers-nongnu.patch b/pkgs/development/compilers/llvm/10/compiler-rt/sanitizers-nongnu.patch
index 1f2ac97818e..1f2ac97818e 100644
--- a/pkgs/development/compilers/llvm/10/sanitizers-nongnu.patch
+++ b/pkgs/development/compilers/llvm/10/compiler-rt/sanitizers-nongnu.patch
diff --git a/pkgs/development/compilers/llvm/10/default.nix b/pkgs/development/compilers/llvm/10/default.nix
index 978f2895666..3fa91cd8374 100644
--- a/pkgs/development/compilers/llvm/10/default.nix
+++ b/pkgs/development/compilers/llvm/10/default.nix
@@ -29,7 +29,7 @@ let
     '';
   in {
 
-    llvm = callPackage ./llvm.nix { };
+    llvm = callPackage ./llvm { };
 
     clang-unwrapped = callPackage ./clang {
       inherit (tools) lld;
@@ -77,9 +77,9 @@ let
       extraBuildCommands = mkExtraBuildCommands cc;
     };
 
-    lld = callPackage ./lld.nix {};
+    lld = callPackage ./lld {};
 
-    lldb = callPackage ./lldb.nix {};
+    lldb = callPackage ./lldb {};
 
     # Below, is the LLVM bootstrapping logic. It handles building a
     # fully LLVM toolchain from scratch. No GCC toolchain should be
@@ -163,7 +163,7 @@ let
     callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
   in {
 
-    compiler-rt = callPackage ./compiler-rt.nix ({} //
+    compiler-rt = callPackage ./compiler-rt ({} //
       (lib.optionalAttrs (stdenv.hostPlatform.useLLVM or false) {
         stdenv = overrideCC stdenv buildLlvmTools.lldClangNoCompilerRt;
       }));
@@ -177,7 +177,7 @@ let
         stdenv = overrideCC stdenv buildLlvmTools.lldClangNoLibcxx;
       }));
 
-    libcxxabi = callPackage ./libc++abi.nix ({} //
+    libcxxabi = callPackage ./libc++abi ({} //
       (lib.optionalAttrs (stdenv.hostPlatform.useLLVM or false) {
         stdenv = overrideCC stdenv buildLlvmTools.lldClangNoLibcxx;
         libunwind = libraries.libunwind;
@@ -185,7 +185,7 @@ let
 
     openmp = callPackage ./openmp.nix {};
 
-    libunwind = callPackage ./libunwind.nix ({} //
+    libunwind = callPackage ./libunwind ({} //
       (lib.optionalAttrs (stdenv.hostPlatform.useLLVM or false) {
         stdenv = overrideCC stdenv buildLlvmTools.lldClangNoLibcxx;
       }));
diff --git a/pkgs/development/compilers/llvm/10/libc++abi.nix b/pkgs/development/compilers/llvm/10/libc++abi/default.nix
index 61f778fbc55..7541cee1a54 100644
--- a/pkgs/development/compilers/llvm/10/libc++abi.nix
+++ b/pkgs/development/compilers/llvm/10/libc++abi/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
     "-DLIBCXXABI_ENABLE_SHARED=OFF"
   ];
 
-  patches = [ ./libcxxabi-no-threads.patch ];
+  patches = [ ./no-threads.patch ];
 
   postUnpack = ''
     unpackFile ${libcxx.src}
@@ -32,7 +32,7 @@ stdenv.mkDerivation {
   '' + lib.optionalString stdenv.hostPlatform.isMusl ''
     patch -p1 -d $(ls -d libcxx-*) -i ${../libcxx-0001-musl-hacks.patch}
   '' + lib.optionalString stdenv.hostPlatform.isWasm ''
-    patch -p1 -d $(ls -d llvm-*) -i ${./libcxxabi-wasm.patch}
+    patch -p1 -d $(ls -d llvm-*) -i ${./wasm.patch}
   '';
 
   installPhase = if stdenv.isDarwin
diff --git a/pkgs/development/compilers/llvm/10/libcxxabi-no-threads.patch b/pkgs/development/compilers/llvm/10/libc++abi/no-threads.patch
index 787f3e16500..787f3e16500 100644
--- a/pkgs/development/compilers/llvm/10/libcxxabi-no-threads.patch
+++ b/pkgs/development/compilers/llvm/10/libc++abi/no-threads.patch
diff --git a/pkgs/development/compilers/llvm/10/libcxxabi-wasm.patch b/pkgs/development/compilers/llvm/10/libc++abi/wasm.patch
index 4ebfe46aa81..4ebfe46aa81 100644
--- a/pkgs/development/compilers/llvm/10/libcxxabi-wasm.patch
+++ b/pkgs/development/compilers/llvm/10/libc++abi/wasm.patch
diff --git a/pkgs/development/compilers/llvm/10/libunwind.nix b/pkgs/development/compilers/llvm/10/libunwind/default.nix
index f0f45780a22..f0f45780a22 100644
--- a/pkgs/development/compilers/llvm/10/libunwind.nix
+++ b/pkgs/development/compilers/llvm/10/libunwind/default.nix
diff --git a/pkgs/development/compilers/llvm/10/lld.nix b/pkgs/development/compilers/llvm/10/lld/default.nix
index a94c1b5b0dd..a94c1b5b0dd 100644
--- a/pkgs/development/compilers/llvm/10/lld.nix
+++ b/pkgs/development/compilers/llvm/10/lld/default.nix
diff --git a/pkgs/development/compilers/llvm/10/lldb.nix b/pkgs/development/compilers/llvm/10/lldb/default.nix
index e7dd48a23ce..7fb8ed57a01 100644
--- a/pkgs/development/compilers/llvm/10/lldb.nix
+++ b/pkgs/development/compilers/llvm/10/lldb/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation (rec {
 
   src = fetch pname "051p5b04y6z3g730rmc2n2v71lipbw7k69riww3a6sl74myfiaq7";
 
-  patches = [ ./lldb-procfs.patch ];
+  patches = [ ./procfs.patch ];
 
   nativeBuildInputs = [ cmake python3 which swig lit ]
     ++ lib.optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
diff --git a/pkgs/development/compilers/llvm/10/lldb-procfs.patch b/pkgs/development/compilers/llvm/10/lldb/procfs.patch
index b075dbaeee0..b075dbaeee0 100644
--- a/pkgs/development/compilers/llvm/10/lldb-procfs.patch
+++ b/pkgs/development/compilers/llvm/10/lldb/procfs.patch
diff --git a/pkgs/development/compilers/llvm/10/llvm.nix b/pkgs/development/compilers/llvm/10/llvm/default.nix
index e951375a833..3100eaf4db4 100644
--- a/pkgs/development/compilers/llvm/10/llvm.nix
+++ b/pkgs/development/compilers/llvm/10/llvm/default.nix
@@ -62,15 +62,15 @@ in stdenv.mkDerivation (rec {
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
   + optionalString (enableSharedLibraries) ''
-    substitute '${./llvm-outputs.patch}' ./llvm-outputs.patch --subst-var lib
-    patch -p1 < ./llvm-outputs.patch
+    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
+    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "Path.cpp" ""
     rm unittests/Support/Path.cpp
   '' + optionalString stdenv.hostPlatform.isMusl ''
-    patch -p1 -i ${../TLI-musl.patch}
+    patch -p1 -i ${../../TLI-musl.patch}
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "add_subdirectory(DynamicLibrary)" ""
     rm unittests/Support/DynamicLibrary/DynamicLibraryTest.cpp
diff --git a/pkgs/development/compilers/llvm/10/llvm-outputs.patch b/pkgs/development/compilers/llvm/10/llvm/outputs.patch
index 40096fa3497..40096fa3497 100644
--- a/pkgs/development/compilers/llvm/10/llvm-outputs.patch
+++ b/pkgs/development/compilers/llvm/10/llvm/outputs.patch
diff --git a/pkgs/development/compilers/llvm/11/compiler-rt-X86-support-extension.patch b/pkgs/development/compilers/llvm/11/compiler-rt/X86-support-extension.patch
index f6f9336ad5a..f6f9336ad5a 100644
--- a/pkgs/development/compilers/llvm/11/compiler-rt-X86-support-extension.patch
+++ b/pkgs/development/compilers/llvm/11/compiler-rt/X86-support-extension.patch
diff --git a/pkgs/development/compilers/llvm/11/compiler-rt-armv7l.patch b/pkgs/development/compilers/llvm/11/compiler-rt/armv7l.patch
index 120cfe6feb2..120cfe6feb2 100644
--- a/pkgs/development/compilers/llvm/11/compiler-rt-armv7l.patch
+++ b/pkgs/development/compilers/llvm/11/compiler-rt/armv7l.patch
diff --git a/pkgs/development/compilers/llvm/11/compiler-rt-codesign.patch b/pkgs/development/compilers/llvm/11/compiler-rt/codesign.patch
index 3cc12b94b20..3cc12b94b20 100644
--- a/pkgs/development/compilers/llvm/11/compiler-rt-codesign.patch
+++ b/pkgs/development/compilers/llvm/11/compiler-rt/codesign.patch
diff --git a/pkgs/development/compilers/llvm/11/compiler-rt.nix b/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
index 88a412f6cb4..6ab36063077 100644
--- a/pkgs/development/compilers/llvm/11/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
@@ -50,10 +50,10 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" ];
 
   patches = [
-    ./compiler-rt-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
-    ./compiler-rt-X86-support-extension.patch # Add support for i486 i586 i686 by reusing i386 config
+    ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
+    ./X86-support-extension.patch # Add support for i486 i586 i686 by reusing i386 config
   ]# ++ lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
-    ++ lib.optional stdenv.hostPlatform.isAarch32 ./compiler-rt-armv7l.patch;
+    ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
 
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
diff --git a/pkgs/development/compilers/llvm/11/sanitizers-nongnu.patch b/pkgs/development/compilers/llvm/11/compiler-rt/sanitizers-nongnu.patch
index 1f2ac97818e..1f2ac97818e 100644
--- a/pkgs/development/compilers/llvm/11/sanitizers-nongnu.patch
+++ b/pkgs/development/compilers/llvm/11/compiler-rt/sanitizers-nongnu.patch
diff --git a/pkgs/development/compilers/llvm/11/default.nix b/pkgs/development/compilers/llvm/11/default.nix
index e4d9f45c955..22209ffb647 100644
--- a/pkgs/development/compilers/llvm/11/default.nix
+++ b/pkgs/development/compilers/llvm/11/default.nix
@@ -31,7 +31,7 @@ let
     '';
   in {
 
-    llvm = callPackage ./llvm.nix { };
+    llvm = callPackage ./llvm { };
 
     clang-unwrapped = callPackage ./clang {
       inherit (tools) lld;
@@ -79,9 +79,9 @@ let
       extraBuildCommands = mkExtraBuildCommands cc;
     };
 
-    lld = callPackage ./lld.nix {};
+    lld = callPackage ./lld {};
 
-    lldb = callPackage ./lldb.nix {};
+    lldb = callPackage ./lldb {};
 
     # Below, is the LLVM bootstrapping logic. It handles building a
     # fully LLVM toolchain from scratch. No GCC toolchain should be
@@ -165,7 +165,7 @@ let
     callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
   in {
 
-    compiler-rt = callPackage ./compiler-rt.nix ({} //
+    compiler-rt = callPackage ./compiler-rt ({} //
       (lib.optionalAttrs (stdenv.hostPlatform.useLLVM or false) {
         stdenv = overrideCC stdenv buildLlvmTools.lldClangNoCompilerRt;
       }));
@@ -179,7 +179,7 @@ let
         stdenv = overrideCC stdenv buildLlvmTools.lldClangNoLibcxx;
       }));
 
-    libcxxabi = callPackage ./libc++abi.nix ({} //
+    libcxxabi = callPackage ./libc++abi ({} //
       (lib.optionalAttrs (stdenv.hostPlatform.useLLVM or false) {
         stdenv = overrideCC stdenv buildLlvmTools.lldClangNoLibcxx;
         libunwind = libraries.libunwind;
@@ -187,7 +187,7 @@ let
 
     openmp = callPackage ./openmp.nix {};
 
-    libunwind = callPackage ./libunwind.nix ({} //
+    libunwind = callPackage ./libunwind ({} //
       (lib.optionalAttrs (stdenv.hostPlatform.useLLVM or false) {
         stdenv = overrideCC stdenv buildLlvmTools.lldClangNoLibcxx;
       }));
diff --git a/pkgs/development/compilers/llvm/11/libc++abi.nix b/pkgs/development/compilers/llvm/11/libc++abi/default.nix
index d941044ca60..a95a3051415 100644
--- a/pkgs/development/compilers/llvm/11/libc++abi.nix
+++ b/pkgs/development/compilers/llvm/11/libc++abi/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
     "-DLIBCXXABI_ENABLE_SHARED=OFF"
   ];
 
-  patches = [ ./libcxxabi-no-threads.patch ];
+  patches = [ ./no-threads.patch ];
 
   postUnpack = ''
     unpackFile ${libcxx.src}
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
   '' + lib.optionalString stdenv.hostPlatform.isMusl ''
     patch -p1 -d libcxx -i ${../libcxx-0001-musl-hacks.patch}
   '' + lib.optionalString stdenv.hostPlatform.isWasm ''
-    patch -p1 -d llvm -i ${./libcxxabi-wasm.patch}
+    patch -p1 -d llvm -i ${./wasm.patch}
   '';
 
   installPhase = if stdenv.isDarwin
diff --git a/pkgs/development/compilers/llvm/11/libcxxabi-no-threads.patch b/pkgs/development/compilers/llvm/11/libc++abi/no-threads.patch
index 787f3e16500..787f3e16500 100644
--- a/pkgs/development/compilers/llvm/11/libcxxabi-no-threads.patch
+++ b/pkgs/development/compilers/llvm/11/libc++abi/no-threads.patch
diff --git a/pkgs/development/compilers/llvm/11/libcxxabi-wasm.patch b/pkgs/development/compilers/llvm/11/libc++abi/wasm.patch
index 4ebfe46aa81..4ebfe46aa81 100644
--- a/pkgs/development/compilers/llvm/11/libcxxabi-wasm.patch
+++ b/pkgs/development/compilers/llvm/11/libc++abi/wasm.patch
diff --git a/pkgs/development/compilers/llvm/11/libunwind.nix b/pkgs/development/compilers/llvm/11/libunwind/default.nix
index 0c635cabc0a..0c635cabc0a 100644
--- a/pkgs/development/compilers/llvm/11/libunwind.nix
+++ b/pkgs/development/compilers/llvm/11/libunwind/default.nix
diff --git a/pkgs/development/compilers/llvm/11/lld.nix b/pkgs/development/compilers/llvm/11/lld/default.nix
index 1a16184a6e7..1a16184a6e7 100644
--- a/pkgs/development/compilers/llvm/11/lld.nix
+++ b/pkgs/development/compilers/llvm/11/lld/default.nix
diff --git a/pkgs/development/compilers/llvm/11/lldb.nix b/pkgs/development/compilers/llvm/11/lldb/default.nix
index 2f54305736a..fc9b471ec9a 100644
--- a/pkgs/development/compilers/llvm/11/lldb.nix
+++ b/pkgs/development/compilers/llvm/11/lldb/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation (rec {
 
   src = fetch pname "1vlyg015dyng43xqb8cg2l6r9ix8klibxsajazbfnckdnh54hwxj";
 
-  patches = [ ./lldb-procfs.patch ];
+  patches = [ ./procfs.patch ];
 
   nativeBuildInputs = [ cmake python3 which swig lit ]
     ++ lib.optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
diff --git a/pkgs/development/compilers/llvm/11/lldb-procfs.patch b/pkgs/development/compilers/llvm/11/lldb/procfs.patch
index b075dbaeee0..b075dbaeee0 100644
--- a/pkgs/development/compilers/llvm/11/lldb-procfs.patch
+++ b/pkgs/development/compilers/llvm/11/lldb/procfs.patch
diff --git a/pkgs/development/compilers/llvm/11/llvm.nix b/pkgs/development/compilers/llvm/11/llvm/default.nix
index cb44643ff78..fc64451e013 100644
--- a/pkgs/development/compilers/llvm/11/llvm.nix
+++ b/pkgs/development/compilers/llvm/11/llvm/default.nix
@@ -62,8 +62,8 @@ in stdenv.mkDerivation (rec {
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
   + optionalString (enableSharedLibraries) ''
-    substitute '${./llvm-outputs.patch}' ./llvm-outputs.patch --subst-var lib
-    patch -p1 < ./llvm-outputs.patch
+    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
+    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
diff --git a/pkgs/development/compilers/llvm/11/llvm-outputs.patch b/pkgs/development/compilers/llvm/11/llvm/outputs.patch
index 40096fa3497..40096fa3497 100644
--- a/pkgs/development/compilers/llvm/11/llvm-outputs.patch
+++ b/pkgs/development/compilers/llvm/11/llvm/outputs.patch
diff --git a/pkgs/development/compilers/llvm/5/compiler-rt-armv7l.patch b/pkgs/development/compilers/llvm/5/compiler-rt/armv7l.patch
index 77bf2640c47..77bf2640c47 100644
--- a/pkgs/development/compilers/llvm/5/compiler-rt-armv7l.patch
+++ b/pkgs/development/compilers/llvm/5/compiler-rt/armv7l.patch
diff --git a/pkgs/development/compilers/llvm/5/compiler-rt-codesign.patch b/pkgs/development/compilers/llvm/5/compiler-rt/codesign.patch
index 8f4c76bca1e..8f4c76bca1e 100644
--- a/pkgs/development/compilers/llvm/5/compiler-rt-codesign.patch
+++ b/pkgs/development/compilers/llvm/5/compiler-rt/codesign.patch
diff --git a/pkgs/development/compilers/llvm/5/compiler-rt.nix b/pkgs/development/compilers/llvm/5/compiler-rt/default.nix
index 81dbe7048e6..705c5994bd1 100644
--- a/pkgs/development/compilers/llvm/5/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/5/compiler-rt/default.nix
@@ -51,11 +51,12 @@ stdenv.mkDerivation {
   outputs = [ "out" "dev" ];
 
   patches = [
-    ./compiler-rt-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
-    ../7/compiler-rt-glibc.patch
+    ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
+    # https://github.com/llvm/llvm-project/commit/947f9692440836dcb8d88b74b69dd379d85974ce
+    ../../common/compiler-rt/glibc.patch
   ] ++ lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
-    ++ lib.optional (stdenv.hostPlatform.libc == "glibc") ./compiler-rt-sys-ustat.patch
-    ++ lib.optional stdenv.hostPlatform.isAarch32 ./compiler-rt-armv7l.patch;
+    ++ lib.optional (stdenv.hostPlatform.libc == "glibc") ./sys-ustat.patch
+    ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
   # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
diff --git a/pkgs/development/compilers/llvm/5/sanitizers-nongnu.patch b/pkgs/development/compilers/llvm/5/compiler-rt/sanitizers-nongnu.patch
index c9ddfe45c89..c9ddfe45c89 100644
--- a/pkgs/development/compilers/llvm/5/sanitizers-nongnu.patch
+++ b/pkgs/development/compilers/llvm/5/compiler-rt/sanitizers-nongnu.patch
diff --git a/pkgs/development/compilers/llvm/5/compiler-rt-sys-ustat.patch b/pkgs/development/compilers/llvm/5/compiler-rt/sys-ustat.patch
index d9e9a10d860..d9e9a10d860 100644
--- a/pkgs/development/compilers/llvm/5/compiler-rt-sys-ustat.patch
+++ b/pkgs/development/compilers/llvm/5/compiler-rt/sys-ustat.patch
diff --git a/pkgs/development/compilers/llvm/5/default.nix b/pkgs/development/compilers/llvm/5/default.nix
index f03325cd427..86bba415c01 100644
--- a/pkgs/development/compilers/llvm/5/default.nix
+++ b/pkgs/development/compilers/llvm/5/default.nix
@@ -28,7 +28,7 @@ let
     '';
   in {
 
-    llvm = callPackage ./llvm.nix { };
+    llvm = callPackage ./llvm { };
 
     clang-unwrapped = callPackage ./clang {
       inherit clang-tools-extra_src;
@@ -68,16 +68,16 @@ let
       extraBuildCommands = mkExtraBuildCommands cc;
     };
 
-    lld = callPackage ./lld.nix {};
+    lld = callPackage ./lld {};
 
-    lldb = callPackage ./lldb.nix {};
+    lldb = callPackage ./lldb {};
   });
 
   libraries = lib.makeExtensible (libraries: let
     callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
   in {
 
-    compiler-rt = callPackage ./compiler-rt.nix {};
+    compiler-rt = callPackage ./compiler-rt {};
 
     stdenv = overrideCC stdenv buildLlvmTools.clang;
 
@@ -85,7 +85,7 @@ let
 
     libcxx = callPackage ./libc++ {};
 
-    libcxxabi = callPackage ./libc++abi.nix {};
+    libcxxabi = callPackage ./libc++abi {};
 
     openmp = callPackage ./openmp.nix {};
   });
diff --git a/pkgs/development/compilers/llvm/5/libc++abi.nix b/pkgs/development/compilers/llvm/5/libc++abi/default.nix
index 8fc9ef9fded..8fc9ef9fded 100644
--- a/pkgs/development/compilers/llvm/5/libc++abi.nix
+++ b/pkgs/development/compilers/llvm/5/libc++abi/default.nix
diff --git a/pkgs/development/compilers/llvm/5/lld.nix b/pkgs/development/compilers/llvm/5/lld/default.nix
index 244960cf41b..244960cf41b 100644
--- a/pkgs/development/compilers/llvm/5/lld.nix
+++ b/pkgs/development/compilers/llvm/5/lld/default.nix
diff --git a/pkgs/development/compilers/llvm/5/lldb.nix b/pkgs/development/compilers/llvm/5/lldb/default.nix
index 61a9e60391c..61a9e60391c 100644
--- a/pkgs/development/compilers/llvm/5/lldb.nix
+++ b/pkgs/development/compilers/llvm/5/lldb/default.nix
diff --git a/pkgs/development/compilers/llvm/5/llvm.nix b/pkgs/development/compilers/llvm/5/llvm/default.nix
index c91e9420435..94d2a1e5863 100644
--- a/pkgs/development/compilers/llvm/5/llvm.nix
+++ b/pkgs/development/compilers/llvm/5/llvm/default.nix
@@ -16,6 +16,8 @@
 }:
 
 let
+  inherit (lib) optional optionals optionalString;
+
   # Used when creating a versioned symlinks of libLLVM.dylib
   versionSuffixes = with lib;
     let parts = splitVersion release_version; in
@@ -35,10 +37,10 @@ stdenv.mkDerivation ({
   '';
 
   outputs = [ "out" "python" ]
-    ++ lib.optional enableSharedLibraries "lib";
+    ++ optional enableSharedLibraries "lib";
 
   nativeBuildInputs = [ cmake python3 ]
-    ++ lib.optional enableManpages python3.pkgs.sphinx;
+    ++ optional enableManpages python3.pkgs.sphinx;
 
   buildInputs = [ libxml2 libffi ];
 
@@ -58,24 +60,24 @@ stdenv.mkDerivation ({
     #  stripLen = 1;
     #})
   ];
-  postPatch = lib.optionalString stdenv.isDarwin ''
+  postPatch = optionalString stdenv.isDarwin ''
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../lib" ''${extra_libdir})' ""
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + lib.optionalString (enableSharedLibraries) ''
-    substitute '${./llvm-outputs.patch}' ./llvm-outputs.patch --subst-var lib
-    patch -p1 < ./llvm-outputs.patch
+  + optionalString (enableSharedLibraries) ''
+    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
+    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "Path.cpp" ""
     rm unittests/Support/Path.cpp
-  '' + lib.optionalString stdenv.isAarch64 ''
-    patch -p0 < ${../aarch64.patch}
-  '' + lib.optionalString stdenv.hostPlatform.isMusl ''
-    patch -p1 -i ${../TLI-musl.patch}
+  '' + optionalString stdenv.isAarch64 ''
+    patch -p0 < ${../../aarch64.patch}
+  '' + optionalString stdenv.hostPlatform.isMusl ''
+    patch -p1 -i ${../../TLI-musl.patch}
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "add_subdirectory(DynamicLibrary)" ""
     rm unittests/Support/DynamicLibrary/DynamicLibraryTest.cpp
@@ -98,18 +100,18 @@ stdenv.mkDerivation ({
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
     "-DTARGET_TRIPLE=${stdenv.hostPlatform.config}"
   ]
-  ++ lib.optional enableSharedLibraries
+  ++ optional enableSharedLibraries
     "-DLLVM_LINK_LLVM_DYLIB=ON"
-  ++ lib.optionals enableManpages [
+  ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
   ]
-  ++ lib.optional (!isDarwin)
+  ++ optional (!isDarwin)
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
-  ++ lib.optionals (isDarwin) [
+  ++ optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
   ];
@@ -126,14 +128,14 @@ stdenv.mkDerivation ({
     mkdir -p $python/share
     mv $out/share/opt-viewer $python/share/opt-viewer
   ''
-  + lib.optionalString enableSharedLibraries ''
+  + optionalString enableSharedLibraries ''
     moveToOutput "lib/libLLVM-*" "$lib"
     moveToOutput "lib/libLLVM${stdenv.hostPlatform.extensions.sharedLibrary}" "$lib"
     moveToOutput "lib/libLTO${stdenv.hostPlatform.extensions.sharedLibrary}" "$lib"
     substituteInPlace "$out/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
       --replace "\''${_IMPORT_PREFIX}/lib/libLLVM-" "$lib/lib/libLLVM-"
   ''
-  + lib.optionalString (stdenv.isDarwin && enableSharedLibraries) ''
+  + optionalString (stdenv.isDarwin && enableSharedLibraries) ''
     substituteInPlace "$out/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
       --replace "\''${_IMPORT_PREFIX}/lib/libLLVM.dylib" "$lib/lib/libLLVM.dylib" \
       --replace "\''${_IMPORT_PREFIX}/lib/libLTO.dylib" "$lib/lib/libLTO.dylib"
diff --git a/pkgs/development/compilers/llvm/5/fix-gcc9.patch b/pkgs/development/compilers/llvm/5/llvm/fix-gcc9.patch
index eaf71f1468d..eaf71f1468d 100644
--- a/pkgs/development/compilers/llvm/5/fix-gcc9.patch
+++ b/pkgs/development/compilers/llvm/5/llvm/fix-gcc9.patch
diff --git a/pkgs/development/compilers/llvm/5/llvm-outputs.patch b/pkgs/development/compilers/llvm/5/llvm/outputs.patch
index 40096fa3497..40096fa3497 100644
--- a/pkgs/development/compilers/llvm/5/llvm-outputs.patch
+++ b/pkgs/development/compilers/llvm/5/llvm/outputs.patch
diff --git a/pkgs/development/compilers/llvm/6/compiler-rt-armv7l.patch b/pkgs/development/compilers/llvm/6/compiler-rt/armv7l.patch
index ca2ed632faa..ca2ed632faa 100644
--- a/pkgs/development/compilers/llvm/6/compiler-rt-armv7l.patch
+++ b/pkgs/development/compilers/llvm/6/compiler-rt/armv7l.patch
diff --git a/pkgs/development/compilers/llvm/6/compiler-rt-codesign.patch b/pkgs/development/compilers/llvm/6/compiler-rt/codesign.patch
index 8f4c76bca1e..8f4c76bca1e 100644
--- a/pkgs/development/compilers/llvm/6/compiler-rt-codesign.patch
+++ b/pkgs/development/compilers/llvm/6/compiler-rt/codesign.patch
diff --git a/pkgs/development/compilers/llvm/6/compiler-rt.nix b/pkgs/development/compilers/llvm/6/compiler-rt/default.nix
index 11d46289afe..f0a1c7ecc34 100644
--- a/pkgs/development/compilers/llvm/6/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/6/compiler-rt/default.nix
@@ -51,10 +51,11 @@ stdenv.mkDerivation {
   outputs = [ "out" "dev" ];
 
   patches = [
-    ./compiler-rt-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
-    ../7/compiler-rt-glibc.patch
+    ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
+    # https://github.com/llvm/llvm-project/commit/947f9692440836dcb8d88b74b69dd379d85974ce
+    ../../common/compiler-rt/glibc.patch
   ] ++ lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
-    ++ lib.optional stdenv.hostPlatform.isAarch32 ./compiler-rt-armv7l.patch;
+    ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
   # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
diff --git a/pkgs/development/compilers/llvm/6/sanitizers-nongnu.patch b/pkgs/development/compilers/llvm/6/compiler-rt/sanitizers-nongnu.patch
index 6266eb1958d..6266eb1958d 100644
--- a/pkgs/development/compilers/llvm/6/sanitizers-nongnu.patch
+++ b/pkgs/development/compilers/llvm/6/compiler-rt/sanitizers-nongnu.patch
diff --git a/pkgs/development/compilers/llvm/6/default.nix b/pkgs/development/compilers/llvm/6/default.nix
index fe6984ee58b..2c4c11c89bd 100644
--- a/pkgs/development/compilers/llvm/6/default.nix
+++ b/pkgs/development/compilers/llvm/6/default.nix
@@ -28,7 +28,7 @@ let
     '';
   in {
 
-    llvm = callPackage ./llvm.nix { };
+    llvm = callPackage ./llvm { };
 
     clang-unwrapped = callPackage ./clang {
       inherit clang-tools-extra_src;
@@ -69,16 +69,16 @@ let
       extraBuildCommands = mkExtraBuildCommands cc;
     };
 
-    lld = callPackage ./lld.nix {};
+    lld = callPackage ./lld {};
 
-    lldb = callPackage ./lldb.nix {};
+    lldb = callPackage ./lldb {};
   });
 
   libraries = lib.makeExtensible (libraries: let
     callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
   in {
 
-    compiler-rt = callPackage ./compiler-rt.nix {};
+    compiler-rt = callPackage ./compiler-rt {};
 
     stdenv = overrideCC stdenv buildLlvmTools.clang;
 
@@ -86,7 +86,7 @@ let
 
     libcxx = callPackage ./libc++ {};
 
-    libcxxabi = callPackage ./libc++abi.nix {};
+    libcxxabi = callPackage ./libc++abi {};
 
     openmp = callPackage ./openmp.nix {};
   });
diff --git a/pkgs/development/compilers/llvm/6/libc++abi.nix b/pkgs/development/compilers/llvm/6/libc++abi/default.nix
index 6e99f2d287a..6e99f2d287a 100644
--- a/pkgs/development/compilers/llvm/6/libc++abi.nix
+++ b/pkgs/development/compilers/llvm/6/libc++abi/default.nix
diff --git a/pkgs/development/compilers/llvm/6/lld.nix b/pkgs/development/compilers/llvm/6/lld/default.nix
index b8038524805..b8038524805 100644
--- a/pkgs/development/compilers/llvm/6/lld.nix
+++ b/pkgs/development/compilers/llvm/6/lld/default.nix
diff --git a/pkgs/development/compilers/llvm/6/lldb.nix b/pkgs/development/compilers/llvm/6/lldb/default.nix
index 7c6f8b1bd97..7c6f8b1bd97 100644
--- a/pkgs/development/compilers/llvm/6/lldb.nix
+++ b/pkgs/development/compilers/llvm/6/lldb/default.nix
diff --git a/pkgs/development/compilers/llvm/6/llvm.nix b/pkgs/development/compilers/llvm/6/llvm/default.nix
index 7d429e3ecf3..de99691094b 100644
--- a/pkgs/development/compilers/llvm/6/llvm.nix
+++ b/pkgs/development/compilers/llvm/6/llvm/default.nix
@@ -67,15 +67,15 @@ stdenv.mkDerivation ({
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
   + optionalString (enableSharedLibraries) ''
-    substitute '${./llvm-outputs.patch}' ./llvm-outputs.patch --subst-var lib
-    patch -p1 < ./llvm-outputs.patch
+    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
+    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "Path.cpp" ""
     rm unittests/Support/Path.cpp
   '' + optionalString stdenv.hostPlatform.isMusl ''
-    patch -p1 -i ${../TLI-musl.patch}
+    patch -p1 -i ${../../TLI-musl.patch}
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "add_subdirectory(DynamicLibrary)" ""
     rm unittests/Support/DynamicLibrary/DynamicLibraryTest.cpp
diff --git a/pkgs/development/compilers/llvm/6/llvm-outputs.patch b/pkgs/development/compilers/llvm/6/llvm/outputs.patch
index 40096fa3497..40096fa3497 100644
--- a/pkgs/development/compilers/llvm/6/llvm-outputs.patch
+++ b/pkgs/development/compilers/llvm/6/llvm/outputs.patch
diff --git a/pkgs/development/compilers/llvm/7/compiler-rt-armv7l.patch b/pkgs/development/compilers/llvm/7/compiler-rt/armv7l.patch
index 89d7f1aec91..89d7f1aec91 100644
--- a/pkgs/development/compilers/llvm/7/compiler-rt-armv7l.patch
+++ b/pkgs/development/compilers/llvm/7/compiler-rt/armv7l.patch
diff --git a/pkgs/development/compilers/llvm/7/compiler-rt-codesign.patch b/pkgs/development/compilers/llvm/7/compiler-rt/codesign.patch
index 3cc12b94b20..3cc12b94b20 100644
--- a/pkgs/development/compilers/llvm/7/compiler-rt-codesign.patch
+++ b/pkgs/development/compilers/llvm/7/compiler-rt/codesign.patch
diff --git a/pkgs/development/compilers/llvm/7/crtbegin-and-end.patch b/pkgs/development/compilers/llvm/7/compiler-rt/crtbegin-and-end.patch
index e63be181f95..e63be181f95 100644
--- a/pkgs/development/compilers/llvm/7/crtbegin-and-end.patch
+++ b/pkgs/development/compilers/llvm/7/compiler-rt/crtbegin-and-end.patch
diff --git a/pkgs/development/compilers/llvm/7/compiler-rt.nix b/pkgs/development/compilers/llvm/7/compiler-rt/default.nix
index 0f91f3c5e6c..21842131599 100644
--- a/pkgs/development/compilers/llvm/7/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/7/compiler-rt/default.nix
@@ -52,12 +52,11 @@ stdenv.mkDerivation {
 
   patches = [
     # https://github.com/llvm/llvm-project/commit/947f9692440836dcb8d88b74b69dd379d85974ce
-    ./compiler-rt-glibc.patch
-
-    ./compiler-rt-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
+    ../../common/compiler-rt/glibc.patch
+    ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
   ] ++ lib.optional (useLLVM) ./crtbegin-and-end.patch
     ++ lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
-    ++ lib.optional stdenv.hostPlatform.isAarch32 ./compiler-rt-armv7l.patch;
+    ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
   # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
diff --git a/pkgs/development/compilers/llvm/7/sanitizers-nongnu.patch b/pkgs/development/compilers/llvm/7/compiler-rt/sanitizers-nongnu.patch
index 1f2ac97818e..1f2ac97818e 100644
--- a/pkgs/development/compilers/llvm/7/sanitizers-nongnu.patch
+++ b/pkgs/development/compilers/llvm/7/compiler-rt/sanitizers-nongnu.patch
diff --git a/pkgs/development/compilers/llvm/7/default.nix b/pkgs/development/compilers/llvm/7/default.nix
index 111ccbb9a38..2170177117e 100644
--- a/pkgs/development/compilers/llvm/7/default.nix
+++ b/pkgs/development/compilers/llvm/7/default.nix
@@ -28,8 +28,9 @@ let
     '';
   in {
 
-    llvm = callPackage ./llvm.nix { };
-    llvm-polly = callPackage ./llvm.nix { enablePolly = true; };
+    llvm = callPackage ./llvm { };
+
+    llvm-polly = callPackage ./llvm { enablePolly = true; };
 
     clang-unwrapped = callPackage ./clang {
       inherit (tools) lld;
@@ -75,9 +76,9 @@ let
       extraBuildCommands = mkExtraBuildCommands cc;
     };
 
-    lld = callPackage ./lld.nix {};
+    lld = callPackage ./lld {};
 
-    lldb = callPackage ./lldb.nix {};
+    lldb = callPackage ./lldb {};
 
     # Below, is the LLVM bootstrapping logic. It handles building a
     # fully LLVM toolchain from scratch. No GCC toolchain should be
@@ -159,7 +160,7 @@ let
     callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
   in {
 
-    compiler-rt = callPackage ./compiler-rt.nix {
+    compiler-rt = callPackage ./compiler-rt {
       stdenv = if stdenv.hostPlatform.useLLVM or false
                then overrideCC stdenv buildLlvmTools.lldClangNoCompilerRt
                else stdenv;
@@ -174,7 +175,7 @@ let
         stdenv = overrideCC stdenv buildLlvmTools.lldClangNoLibcxx;
       }));
 
-    libcxxabi = callPackage ./libc++abi.nix ({} //
+    libcxxabi = callPackage ./libc++abi ({} //
       (lib.optionalAttrs (stdenv.hostPlatform.useLLVM or false) {
         stdenv = overrideCC stdenv buildLlvmTools.lldClangNoLibcxx;
         libunwind = libraries.libunwind;
diff --git a/pkgs/development/compilers/llvm/7/libc++abi.nix b/pkgs/development/compilers/llvm/7/libc++abi/default.nix
index 61879be91da..61879be91da 100644
--- a/pkgs/development/compilers/llvm/7/libc++abi.nix
+++ b/pkgs/development/compilers/llvm/7/libc++abi/default.nix
diff --git a/pkgs/development/compilers/llvm/7/lld.nix b/pkgs/development/compilers/llvm/7/lld/default.nix
index f4c58abef8a..f4c58abef8a 100644
--- a/pkgs/development/compilers/llvm/7/lld.nix
+++ b/pkgs/development/compilers/llvm/7/lld/default.nix
diff --git a/pkgs/development/compilers/llvm/7/lldb.nix b/pkgs/development/compilers/llvm/7/lldb/default.nix
index 3fa5b411f63..3fa5b411f63 100644
--- a/pkgs/development/compilers/llvm/7/lldb.nix
+++ b/pkgs/development/compilers/llvm/7/lldb/default.nix
diff --git a/pkgs/development/compilers/llvm/7/llvm.nix b/pkgs/development/compilers/llvm/7/llvm/default.nix
index 2d6f0d18722..53a7301b19b 100644
--- a/pkgs/development/compilers/llvm/7/llvm.nix
+++ b/pkgs/development/compilers/llvm/7/llvm/default.nix
@@ -76,15 +76,15 @@ in stdenv.mkDerivation ({
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
   + optionalString (enableSharedLibraries) ''
-    substitute '${./llvm-outputs.patch}' ./llvm-outputs.patch --subst-var lib
-    patch -p1 < ./llvm-outputs.patch
+    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
+    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "Path.cpp" ""
     rm unittests/Support/Path.cpp
   '' + optionalString stdenv.hostPlatform.isMusl ''
-    patch -p1 -i ${../TLI-musl.patch}
+    patch -p1 -i ${../../TLI-musl.patch}
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "add_subdirectory(DynamicLibrary)" ""
     rm unittests/Support/DynamicLibrary/DynamicLibraryTest.cpp
diff --git a/pkgs/development/compilers/llvm/7/llvm-outputs.patch b/pkgs/development/compilers/llvm/7/llvm/outputs.patch
index 40096fa3497..40096fa3497 100644
--- a/pkgs/development/compilers/llvm/7/llvm-outputs.patch
+++ b/pkgs/development/compilers/llvm/7/llvm/outputs.patch
diff --git a/pkgs/development/compilers/llvm/8/compiler-rt-armv7l.patch b/pkgs/development/compilers/llvm/8/compiler-rt/armv7l.patch
index 89d7f1aec91..89d7f1aec91 100644
--- a/pkgs/development/compilers/llvm/8/compiler-rt-armv7l.patch
+++ b/pkgs/development/compilers/llvm/8/compiler-rt/armv7l.patch
diff --git a/pkgs/development/compilers/llvm/8/compiler-rt-codesign.patch b/pkgs/development/compilers/llvm/8/compiler-rt/codesign.patch
index 3cc12b94b20..3cc12b94b20 100644
--- a/pkgs/development/compilers/llvm/8/compiler-rt-codesign.patch
+++ b/pkgs/development/compilers/llvm/8/compiler-rt/codesign.patch
diff --git a/pkgs/development/compilers/llvm/8/crtbegin-and-end.patch b/pkgs/development/compilers/llvm/8/compiler-rt/crtbegin-and-end.patch
index e63be181f95..e63be181f95 100644
--- a/pkgs/development/compilers/llvm/8/crtbegin-and-end.patch
+++ b/pkgs/development/compilers/llvm/8/compiler-rt/crtbegin-and-end.patch
diff --git a/pkgs/development/compilers/llvm/8/compiler-rt.nix b/pkgs/development/compilers/llvm/8/compiler-rt/default.nix
index a9dabebb59a..3da3d59d111 100644
--- a/pkgs/development/compilers/llvm/8/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/8/compiler-rt/default.nix
@@ -51,11 +51,12 @@ stdenv.mkDerivation {
   outputs = [ "out" "dev" ];
 
   patches = [
-    ../7/compiler-rt-glibc.patch
-    ./compiler-rt-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
+    # https://github.com/llvm/llvm-project/commit/947f9692440836dcb8d88b74b69dd379d85974ce
+    ../../common/compiler-rt/glibc.patch
+    ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
   ]# ++ lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
     ++ lib.optional (useLLVM) ./crtbegin-and-end.patch
-    ++ lib.optional stdenv.hostPlatform.isAarch32 ./compiler-rt-armv7l.patch;
+    ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
   # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
diff --git a/pkgs/development/compilers/llvm/8/sanitizers-nongnu.patch b/pkgs/development/compilers/llvm/8/compiler-rt/sanitizers-nongnu.patch
index 1f2ac97818e..1f2ac97818e 100644
--- a/pkgs/development/compilers/llvm/8/sanitizers-nongnu.patch
+++ b/pkgs/development/compilers/llvm/8/compiler-rt/sanitizers-nongnu.patch
diff --git a/pkgs/development/compilers/llvm/8/default.nix b/pkgs/development/compilers/llvm/8/default.nix
index 313b97455e5..6d6d8b4f783 100644
--- a/pkgs/development/compilers/llvm/8/default.nix
+++ b/pkgs/development/compilers/llvm/8/default.nix
@@ -28,8 +28,9 @@ let
     '';
   in {
 
-    llvm = callPackage ./llvm.nix { };
-    llvm-polly = callPackage ./llvm.nix { enablePolly = true; };
+    llvm = callPackage ./llvm { };
+
+    llvm-polly = callPackage ./llvm { enablePolly = true; };
 
     clang-unwrapped = callPackage ./clang {
       inherit (tools) lld;
@@ -76,9 +77,9 @@ let
       extraBuildCommands = mkExtraBuildCommands cc;
     };
 
-    lld = callPackage ./lld.nix {};
+    lld = callPackage ./lld {};
 
-    lldb = callPackage ./lldb.nix {};
+    lldb = callPackage ./lldb {};
 
     # Below, is the LLVM bootstrapping logic. It handles building a
     # fully LLVM toolchain from scratch. No GCC toolchain should be
@@ -162,7 +163,7 @@ let
     callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
   in {
 
-    compiler-rt = callPackage ./compiler-rt.nix ({} //
+    compiler-rt = callPackage ./compiler-rt ({} //
       (lib.optionalAttrs (stdenv.hostPlatform.useLLVM or false) {
         stdenv = overrideCC stdenv buildLlvmTools.lldClangNoCompilerRt;
       }));
@@ -176,7 +177,7 @@ let
         stdenv = overrideCC stdenv buildLlvmTools.lldClangNoLibcxx;
       }));
 
-    libcxxabi = callPackage ./libc++abi.nix ({} //
+    libcxxabi = callPackage ./libc++abi ({} //
       (lib.optionalAttrs (stdenv.hostPlatform.useLLVM or false) {
         stdenv = overrideCC stdenv buildLlvmTools.lldClangNoLibcxx;
         libunwind = libraries.libunwind;
@@ -184,7 +185,7 @@ let
 
     openmp = callPackage ./openmp.nix {};
 
-    libunwind = callPackage ./libunwind.nix ({} //
+    libunwind = callPackage ./libunwind ({} //
       (lib.optionalAttrs (stdenv.hostPlatform.useLLVM or false) {
         stdenv = overrideCC stdenv buildLlvmTools.lldClangNoLibcxx;
       }));
diff --git a/pkgs/development/compilers/llvm/8/libc++abi.nix b/pkgs/development/compilers/llvm/8/libc++abi/default.nix
index 5a74981eba8..411b94e6275 100644
--- a/pkgs/development/compilers/llvm/8/libc++abi.nix
+++ b/pkgs/development/compilers/llvm/8/libc++abi/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
     "-DLIBCXXABI_ENABLE_SHARED=OFF"
   ];
 
-  patches = [ ./libcxxabi-no-threads.patch ];
+  patches = [ ./no-threads.patch ];
 
   postUnpack = ''
     unpackFile ${libcxx.src}
@@ -32,7 +32,7 @@ stdenv.mkDerivation {
   '' + lib.optionalString stdenv.hostPlatform.isMusl ''
     patch -p1 -d $(ls -d libcxx-*) -i ${../libcxx-0001-musl-hacks.patch}
   '' + lib.optionalString stdenv.hostPlatform.isWasm ''
-    patch -p1 -d $(ls -d llvm-*) -i ${./libcxxabi-wasm.patch}
+    patch -p1 -d $(ls -d llvm-*) -i ${./wasm.patch}
   '';
 
   installPhase = if stdenv.isDarwin
diff --git a/pkgs/development/compilers/llvm/8/libcxxabi-no-threads.patch b/pkgs/development/compilers/llvm/8/libc++abi/no-threads.patch
index 787f3e16500..787f3e16500 100644
--- a/pkgs/development/compilers/llvm/8/libcxxabi-no-threads.patch
+++ b/pkgs/development/compilers/llvm/8/libc++abi/no-threads.patch
diff --git a/pkgs/development/compilers/llvm/8/libcxxabi-wasm.patch b/pkgs/development/compilers/llvm/8/libc++abi/wasm.patch
index 4ebfe46aa81..4ebfe46aa81 100644
--- a/pkgs/development/compilers/llvm/8/libcxxabi-wasm.patch
+++ b/pkgs/development/compilers/llvm/8/libc++abi/wasm.patch
diff --git a/pkgs/development/compilers/llvm/8/libunwind.nix b/pkgs/development/compilers/llvm/8/libunwind/default.nix
index d1bd54fbd34..d1bd54fbd34 100644
--- a/pkgs/development/compilers/llvm/8/libunwind.nix
+++ b/pkgs/development/compilers/llvm/8/libunwind/default.nix
diff --git a/pkgs/development/compilers/llvm/8/lld.nix b/pkgs/development/compilers/llvm/8/lld/default.nix
index 8009beb7bc1..8009beb7bc1 100644
--- a/pkgs/development/compilers/llvm/8/lld.nix
+++ b/pkgs/development/compilers/llvm/8/lld/default.nix
diff --git a/pkgs/development/compilers/llvm/8/lldb.nix b/pkgs/development/compilers/llvm/8/lldb/default.nix
index 83c171d2a57..83c171d2a57 100644
--- a/pkgs/development/compilers/llvm/8/lldb.nix
+++ b/pkgs/development/compilers/llvm/8/lldb/default.nix
diff --git a/pkgs/development/compilers/llvm/8/llvm.nix b/pkgs/development/compilers/llvm/8/llvm/default.nix
index 9c2c3416aea..c0b88e7ff3e 100644
--- a/pkgs/development/compilers/llvm/8/llvm.nix
+++ b/pkgs/development/compilers/llvm/8/llvm/default.nix
@@ -71,15 +71,15 @@ in stdenv.mkDerivation ({
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
   + optionalString (enableSharedLibraries) ''
-    substitute '${./llvm-outputs.patch}' ./llvm-outputs.patch --subst-var lib
-    patch -p1 < ./llvm-outputs.patch
+    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
+    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "Path.cpp" ""
     rm unittests/Support/Path.cpp
   '' + optionalString stdenv.hostPlatform.isMusl ''
-    patch -p1 -i ${../TLI-musl.patch}
+    patch -p1 -i ${../../TLI-musl.patch}
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "add_subdirectory(DynamicLibrary)" ""
     rm unittests/Support/DynamicLibrary/DynamicLibraryTest.cpp
diff --git a/pkgs/development/compilers/llvm/8/llvm-outputs.patch b/pkgs/development/compilers/llvm/8/llvm/outputs.patch
index 40096fa3497..40096fa3497 100644
--- a/pkgs/development/compilers/llvm/8/llvm-outputs.patch
+++ b/pkgs/development/compilers/llvm/8/llvm/outputs.patch
diff --git a/pkgs/development/compilers/llvm/9/compiler-rt-armv7l.patch b/pkgs/development/compilers/llvm/9/compiler-rt/armv7l.patch
index 89d7f1aec91..89d7f1aec91 100644
--- a/pkgs/development/compilers/llvm/9/compiler-rt-armv7l.patch
+++ b/pkgs/development/compilers/llvm/9/compiler-rt/armv7l.patch
diff --git a/pkgs/development/compilers/llvm/9/compiler-rt-codesign.patch b/pkgs/development/compilers/llvm/9/compiler-rt/codesign.patch
index 3cc12b94b20..3cc12b94b20 100644
--- a/pkgs/development/compilers/llvm/9/compiler-rt-codesign.patch
+++ b/pkgs/development/compilers/llvm/9/compiler-rt/codesign.patch
diff --git a/pkgs/development/compilers/llvm/9/compiler-rt.nix b/pkgs/development/compilers/llvm/9/compiler-rt/default.nix
index 1e9aa1d5d1b..cfc8e0ea74a 100644
--- a/pkgs/development/compilers/llvm/9/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/9/compiler-rt/default.nix
@@ -51,10 +51,11 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" ];
 
   patches = [
-    ../7/compiler-rt-glibc.patch
-    ./compiler-rt-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
+    # https://github.com/llvm/llvm-project/commit/947f9692440836dcb8d88b74b69dd379d85974ce
+    ../../common/compiler-rt/glibc.patch
+    ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
   ]# ++ lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
-    ++ lib.optional stdenv.hostPlatform.isAarch32 ./compiler-rt-armv7l.patch;
+    ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
   # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
diff --git a/pkgs/development/compilers/llvm/9/sanitizers-nongnu.patch b/pkgs/development/compilers/llvm/9/compiler-rt/sanitizers-nongnu.patch
index 1f2ac97818e..1f2ac97818e 100644
--- a/pkgs/development/compilers/llvm/9/sanitizers-nongnu.patch
+++ b/pkgs/development/compilers/llvm/9/compiler-rt/sanitizers-nongnu.patch
diff --git a/pkgs/development/compilers/llvm/9/default.nix b/pkgs/development/compilers/llvm/9/default.nix
index dfb4981a5b7..1b8bdad07bb 100644
--- a/pkgs/development/compilers/llvm/9/default.nix
+++ b/pkgs/development/compilers/llvm/9/default.nix
@@ -28,8 +28,9 @@ let
     '';
   in {
 
-    llvm = callPackage ./llvm.nix { };
-    llvm-polly = callPackage ./llvm.nix { enablePolly = true; };
+    llvm = callPackage ./llvm { };
+
+    llvm-polly = callPackage ./llvm { enablePolly = true; };
 
     clang-unwrapped = callPackage ./clang {
       inherit (tools) lld;
@@ -76,9 +77,9 @@ let
       extraBuildCommands = mkExtraBuildCommands cc;
     };
 
-    lld = callPackage ./lld.nix {};
+    lld = callPackage ./lld {};
 
-    lldb = callPackage ./lldb.nix {};
+    lldb = callPackage ./lldb {};
 
     # Below, is the LLVM bootstrapping logic. It handles building a
     # fully LLVM toolchain from scratch. No GCC toolchain should be
@@ -162,7 +163,7 @@ let
     callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
   in {
 
-    compiler-rt = callPackage ./compiler-rt.nix ({} //
+    compiler-rt = callPackage ./compiler-rt ({} //
       (lib.optionalAttrs (stdenv.hostPlatform.useLLVM or false) {
         stdenv = overrideCC stdenv buildLlvmTools.lldClangNoCompilerRt;
       }));
@@ -176,7 +177,7 @@ let
         stdenv = overrideCC stdenv buildLlvmTools.lldClangNoLibcxx;
       }));
 
-    libcxxabi = callPackage ./libc++abi.nix ({} //
+    libcxxabi = callPackage ./libc++abi ({} //
       (lib.optionalAttrs (stdenv.hostPlatform.useLLVM or false) {
         stdenv = overrideCC stdenv buildLlvmTools.lldClangNoLibcxx;
         libunwind = libraries.libunwind;
@@ -184,7 +185,7 @@ let
 
     openmp = callPackage ./openmp.nix {};
 
-    libunwind = callPackage ./libunwind.nix ({} //
+    libunwind = callPackage ./libunwind ({} //
       (lib.optionalAttrs (stdenv.hostPlatform.useLLVM or false) {
         stdenv = overrideCC stdenv buildLlvmTools.lldClangNoLibcxx;
       }));
diff --git a/pkgs/development/compilers/llvm/9/libc++abi.nix b/pkgs/development/compilers/llvm/9/libc++abi/default.nix
index e8e08f84801..ceb83d252a8 100644
--- a/pkgs/development/compilers/llvm/9/libc++abi.nix
+++ b/pkgs/development/compilers/llvm/9/libc++abi/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
     "-DLIBCXXABI_ENABLE_SHARED=OFF"
   ];
 
-  patches = [ ./libcxxabi-no-threads.patch ];
+  patches = [ ./no-threads.patch ];
 
   postUnpack = ''
     unpackFile ${libcxx.src}
@@ -32,7 +32,7 @@ stdenv.mkDerivation {
   '' + lib.optionalString stdenv.hostPlatform.isMusl ''
     patch -p1 -d $(ls -d libcxx-*) -i ${../libcxx-0001-musl-hacks.patch}
   '' + lib.optionalString stdenv.hostPlatform.isWasm ''
-    patch -p1 -d $(ls -d llvm-*) -i ${./libcxxabi-wasm.patch}
+    patch -p1 -d $(ls -d llvm-*) -i ${./wasm.patch}
   '';
 
   installPhase = if stdenv.isDarwin
diff --git a/pkgs/development/compilers/llvm/9/libcxxabi-no-threads.patch b/pkgs/development/compilers/llvm/9/libc++abi/no-threads.patch
index 787f3e16500..787f3e16500 100644
--- a/pkgs/development/compilers/llvm/9/libcxxabi-no-threads.patch
+++ b/pkgs/development/compilers/llvm/9/libc++abi/no-threads.patch
diff --git a/pkgs/development/compilers/llvm/9/libcxxabi-wasm.patch b/pkgs/development/compilers/llvm/9/libc++abi/wasm.patch
index 4ebfe46aa81..4ebfe46aa81 100644
--- a/pkgs/development/compilers/llvm/9/libcxxabi-wasm.patch
+++ b/pkgs/development/compilers/llvm/9/libc++abi/wasm.patch
diff --git a/pkgs/development/compilers/llvm/9/libunwind.nix b/pkgs/development/compilers/llvm/9/libunwind/default.nix
index 4c4c85512e3..4c4c85512e3 100644
--- a/pkgs/development/compilers/llvm/9/libunwind.nix
+++ b/pkgs/development/compilers/llvm/9/libunwind/default.nix
diff --git a/pkgs/development/compilers/llvm/9/lld.nix b/pkgs/development/compilers/llvm/9/lld/default.nix
index 8b12642d2a7..8b12642d2a7 100644
--- a/pkgs/development/compilers/llvm/9/lld.nix
+++ b/pkgs/development/compilers/llvm/9/lld/default.nix
diff --git a/pkgs/development/compilers/llvm/9/lldb.nix b/pkgs/development/compilers/llvm/9/lldb/default.nix
index 8da5c0bef68..d75acf135f3 100644
--- a/pkgs/development/compilers/llvm/9/lldb.nix
+++ b/pkgs/development/compilers/llvm/9/lldb/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   src = fetch pname "02gb3fbz09kyw8n71218v5v77ip559x3gqbcp8y3w6n3jpbryywa";
 
-  patches = [ ./lldb-procfs.patch ];
+  patches = [ ./procfs.patch ];
 
   nativeBuildInputs = [ cmake python3 which swig lit ];
   buildInputs = [
diff --git a/pkgs/development/compilers/llvm/9/lldb-procfs.patch b/pkgs/development/compilers/llvm/9/lldb/procfs.patch
index b075dbaeee0..b075dbaeee0 100644
--- a/pkgs/development/compilers/llvm/9/lldb-procfs.patch
+++ b/pkgs/development/compilers/llvm/9/lldb/procfs.patch
diff --git a/pkgs/development/compilers/llvm/9/llvm.nix b/pkgs/development/compilers/llvm/9/llvm/default.nix
index 207dc242b91..b795f07d472 100644
--- a/pkgs/development/compilers/llvm/9/llvm.nix
+++ b/pkgs/development/compilers/llvm/9/llvm/default.nix
@@ -62,15 +62,15 @@ in stdenv.mkDerivation (rec {
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
   + optionalString (enableSharedLibraries) ''
-    substitute '${./llvm-outputs.patch}' ./llvm-outputs.patch --subst-var lib
-    patch -p1 < ./llvm-outputs.patch
+    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
+    patch -p1 < ./outputs.patch
   '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "Path.cpp" ""
     rm unittests/Support/Path.cpp
   '' + optionalString stdenv.hostPlatform.isMusl ''
-    patch -p1 -i ${../TLI-musl.patch}
+    patch -p1 -i ${../../TLI-musl.patch}
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "add_subdirectory(DynamicLibrary)" ""
     rm unittests/Support/DynamicLibrary/DynamicLibraryTest.cpp
diff --git a/pkgs/development/compilers/llvm/9/fix-test-on-non-x86-like-others.patch b/pkgs/development/compilers/llvm/9/llvm/fix-test-on-non-x86-like-others.patch
index e6c2f040684..e6c2f040684 100644
--- a/pkgs/development/compilers/llvm/9/fix-test-on-non-x86-like-others.patch
+++ b/pkgs/development/compilers/llvm/9/llvm/fix-test-on-non-x86-like-others.patch
diff --git a/pkgs/development/compilers/llvm/9/llvm-outputs.patch b/pkgs/development/compilers/llvm/9/llvm/outputs.patch
index 40096fa3497..40096fa3497 100644
--- a/pkgs/development/compilers/llvm/9/llvm-outputs.patch
+++ b/pkgs/development/compilers/llvm/9/llvm/outputs.patch
diff --git a/pkgs/development/compilers/llvm/7/compiler-rt-glibc.patch b/pkgs/development/compilers/llvm/common/compiler-rt/glibc.patch
index 2d211795fc8..2d211795fc8 100644
--- a/pkgs/development/compilers/llvm/7/compiler-rt-glibc.patch
+++ b/pkgs/development/compilers/llvm/common/compiler-rt/glibc.patch
diff --git a/pkgs/development/compilers/llvm/rocm/default.nix b/pkgs/development/compilers/llvm/rocm/default.nix
index 135fcd2d25a..6a11ded0529 100644
--- a/pkgs/development/compilers/llvm/rocm/default.nix
+++ b/pkgs/development/compilers/llvm/rocm/default.nix
@@ -28,12 +28,12 @@ in rec {
     src = "${src}/clang";
   };
 
-  lld = callPackage ./lld.nix {
+  lld = callPackage ./lld {
     inherit llvm version;
     src = "${src}/lld";
   };
 
-  llvm = callPackage ./llvm.nix {
+  llvm = callPackage ./llvm {
     inherit version;
     src = "${src}/llvm";
   };
diff --git a/pkgs/development/compilers/llvm/rocm/lld.nix b/pkgs/development/compilers/llvm/rocm/lld/default.nix
index a6e993bb203..a6e993bb203 100644
--- a/pkgs/development/compilers/llvm/rocm/lld.nix
+++ b/pkgs/development/compilers/llvm/rocm/lld/default.nix
diff --git a/pkgs/development/compilers/llvm/rocm/llvm.nix b/pkgs/development/compilers/llvm/rocm/llvm/default.nix
index d6fe211c475..62559bf1392 100644
--- a/pkgs/development/compilers/llvm/rocm/llvm.nix
+++ b/pkgs/development/compilers/llvm/rocm/llvm/default.nix
@@ -57,8 +57,8 @@ in stdenv.mkDerivation rec {
   ];
 
   postPatch = ''
-    substitute '${./llvm-outputs.patch}' ./llvm-outputs.patch --subst-var lib
-    patch -p1 < ./llvm-outputs.patch
+    substitute '${./outputs.patch}' ./outputs.patch --subst-var lib
+    patch -p1 < ./outputs.patch
   '';
 
   # hacky fix: created binaries need to be run before installation
diff --git a/pkgs/development/compilers/llvm/rocm/llvm-outputs.patch b/pkgs/development/compilers/llvm/rocm/llvm/outputs.patch
index 40096fa3497..40096fa3497 100644
--- a/pkgs/development/compilers/llvm/rocm/llvm-outputs.patch
+++ b/pkgs/development/compilers/llvm/rocm/llvm/outputs.patch
diff --git a/pkgs/development/compilers/ocaml/4.10.nix b/pkgs/development/compilers/ocaml/4.10.nix
index 955cc3bebe2..78051040b57 100644
--- a/pkgs/development/compilers/ocaml/4.10.nix
+++ b/pkgs/development/compilers/ocaml/4.10.nix
@@ -1,6 +1,6 @@
 import ./generic.nix {
   major_version = "4";
   minor_version = "10";
-  patch_version = "0";
-  sha256 = "1dzy7lbdapcmwn1wg8k87419khi54f8hb6n314bdv7v0gfqlswrh";
+  patch_version = "2";
+  sha256 = "sha256-locUYQeCgtXbAiB32JveJchfteN2YStE+MN9ToTwAOM=";
 }
diff --git a/pkgs/development/compilers/rust/1_50.nix b/pkgs/development/compilers/rust/1_51.nix
index 4e393a588fb..bbdf8111e15 100644
--- a/pkgs/development/compilers/rust/1_50.nix
+++ b/pkgs/development/compilers/rust/1_51.nix
@@ -19,8 +19,8 @@
 } @ args:
 
 import ./default.nix {
-  rustcVersion = "1.50.0";
-  rustcSha256 = "0pjs7j62maiyvkmhp9zrxl528g2n0fphp4rq6ap7aqdv0a6qz5wm";
+  rustcVersion = "1.51.0";
+  rustcSha256 = "0ixqkqglv3isxbvl4ldr4byrkx692wghsz3fasy1pn5kr2prnsvs";
 
   llvmSharedForBuild = pkgsBuildBuild.llvm_11.override { enableSharedLibraries = true; };
   llvmSharedForHost = pkgsBuildHost.llvm_11.override { enableSharedLibraries = true; };
@@ -33,22 +33,22 @@ import ./default.nix {
 
   # Note: the version MUST be one version prior to the version we're
   # building
-  bootstrapVersion = "1.49.0";
+  bootstrapVersion = "1.50.0";
 
   # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
   bootstrapHashes = {
-    i686-unknown-linux-gnu = "5371bfa2c8e566aa283acdfa93d24b981c789d7c040ac1ca74e76bff1c7f6598";
-    x86_64-unknown-linux-gnu = "8b14446df82f3707d69cf58fed92f18e0bff91621c62baf89288ef70e3e92981";
-    x86_64-unknown-linux-musl = "f92a5a4adcfac4206a223d089a364a8375d1b6f112f3f2efa3f6d53d08a61904";
-    arm-unknown-linux-gnueabihf = "e5d93576eef874a9b22be9aa157cac5c8cdebebde8b57f0693248d4a589df42c";
-    armv7-unknown-linux-gnueabihf = "34ba3c979b144ef27d3c71d177cc1774551edf26e79d36719c86a51d9b9e34c0";
-    aarch64-unknown-linux-gnu = "b551bd482041307fa3373a687d6d6a2c4c0931c2e0a68b8b75dc80bc5cf5f002";
-    aarch64-unknown-linux-musl = "0a43d96a508c720520328112d609916d062f866a5c35f1db8f906284035d6d98";
-    x86_64-apple-darwin = "fe3e248bc4b0ee0a2595693687ad845c8a8bda824a56c9321520bcca02433716";
-    powerpc64le-unknown-linux-gnu = "365d7721dd2521e5dad12aa73651bad2be375e798e443636d2c523cad5b54359";
+    i686-unknown-linux-gnu = "dee56dc425ed5d8e8112f26fba3060fd324c49f1261e0b7e8e29f7d9b852b09a";
+    x86_64-unknown-linux-gnu = "fa889b53918980aea2dea42bfae4e858dcb2104c6fdca6e4fe359f3a49767701";
+    x86_64-unknown-linux-musl = "867cbfb35f5dc9b43e230132ea9e7bfa98d471a9248e41b08ced2266e5ccd00f";
+    arm-unknown-linux-gnueabihf = "1b72979244450e4047ab536448d6720699e1fae0ab1c4ade114099a3037e274b";
+    armv7-unknown-linux-gnueabihf = "f1dde566c4e6ca2e1133c84170e46e566765a21894e1038e1cdc32745d7274ef";
+    aarch64-unknown-linux-gnu = "1db7a4fbddc68cd29eb9bca9fa7d0d2d9e3d59ede7ddaad66222fb4336a6bacf";
+    aarch64-unknown-linux-musl = "adcc6c76a8967bacb6687b565d3cf739e35fde066b03edb745b05b52fa8b5b36";
+    x86_64-apple-darwin = "1bf5a7ecf6468ce1bf9fe49c8083b3f648b40c16fbfb7539d106fe28eb0e792e";
+    powerpc64le-unknown-linux-gnu = "e0472589d3f9ba7ebf27f033af320e0d5cfb70222955bd8ed73ce2c9a70ae535";
   };
 
-  selectRustPackage = pkgs: pkgs.rust_1_50;
+  selectRustPackage = pkgs: pkgs.rust_1_51;
 
   rustcPatches = [
   ];
diff --git a/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh b/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
index 311590425e6..cc037744925 100644
--- a/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
@@ -31,6 +31,13 @@ setuptoolsShellHook() {
         mkdir -p "$tmp_path/@pythonSitePackages@"
         eval "@pythonInterpreter@ -m pip install -e . --prefix $tmp_path \
           --no-build-isolation >&2"
+
+        # Process pth file installed in tmp path. This allows one to
+        # actually import the editable installation. Note site.addsitedir
+        # appends, not prepends, new paths. Hence, it is not possible to override
+        # an existing installation of the package.
+        # https://github.com/pypa/setuptools/issues/2612
+        export NIX_PYTHONPATH="$tmp_path/@pythonSitePackages@:${NIX_PYTHONPATH-}"
     fi
 
     runHook postShellHook
diff --git a/pkgs/development/libraries/fontconfig/default.nix b/pkgs/development/libraries/fontconfig/default.nix
index daedaefcf9c..a7f8fa89c16 100644
--- a/pkgs/development/libraries/fontconfig/default.nix
+++ b/pkgs/development/libraries/fontconfig/default.nix
@@ -9,6 +9,7 @@
 , gperf
 , dejavu_fonts
 , autoreconfHook
+, CoreFoundation
 }:
 
 stdenv.mkDerivation rec {
@@ -73,7 +74,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     expat
-  ];
+  ] ++ lib.optional stdenv.isDarwin CoreFoundation;
 
   propagatedBuildInputs = [
     freetype
diff --git a/pkgs/development/libraries/glibc/2.32-master.patch.gz b/pkgs/development/libraries/glibc/2.32-master.patch.gz
index bd99c36d741..bcf4d13443c 100644
--- a/pkgs/development/libraries/glibc/2.32-master.patch.gz
+++ b/pkgs/development/libraries/glibc/2.32-master.patch.gz
Binary files differdiff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index b3862cc5c0b..7a83ffd36d7 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -42,7 +42,7 @@
 
 let
   version = "2.32";
-  patchSuffix = "-39";
+  patchSuffix = "-40";
   sha256 = "0di848ibffrnwq7g2dvgqrnn4xqhj3h96csn69q4da51ymafl9qn";
 in
 
@@ -59,12 +59,13 @@ stdenv.mkDerivation ({
 
   patches =
     [
-      /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git
-         and using git or something would complicate bootstrapping.
-         Fortunately it's not too big.
-          $ git checkout origin/release/2.32/master; git describe
-          glibc-2.32-39-g44b3959329
-          $ git show --reverse glibc-2.32.. | gzip -n -9 --rsyncable - > 2.32-master.patch.gz
+      /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
+          $ git fetch --all -p && git checkout origin/release/2.32/master && git describe
+          glibc-2.32-40-g778b8d3786
+          $ git show --minimal --reverse glibc-2.32.. | gzip -9n --rsyncable - > 2.32-master.patch.gz
+
+         To compare the archive contents zdiff can be used.
+          $ zdiff -u 2.32-master.patch.gz ../nixpkgs/pkgs/development/libraries/glibc/2.32-master.patch.gz
        */
       ./2.32-master.patch.gz
 
diff --git a/pkgs/development/libraries/libaom/default.nix b/pkgs/development/libraries/libaom/default.nix
index 5483909689d..62045a79ebf 100644
--- a/pkgs/development/libraries/libaom/default.nix
+++ b/pkgs/development/libraries/libaom/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "libaom";
-  version = "2.0.2";
+  version = "3.0.0";
 
   src = fetchgit {
     url = "https://aomedia.googlesource.com/aom";
     rev	= "v${version}";
-    sha256 = "0f3i983s9yvh9zc6mpy1ck5sjcg9l09lpw9v4md3mv8gbih9f0z0";
+    sha256 = "178rq1d7i9q4lg40bipkyhdrk18j9wi5k5avpa5bls0zm7g5ifsx";
   };
 
   patches = [ ./outputs.patch ];
diff --git a/pkgs/development/libraries/libassuan/default.nix b/pkgs/development/libraries/libassuan/default.nix
index a531cdff5b9..5e966d9c35b 100644
--- a/pkgs/development/libraries/libassuan/default.nix
+++ b/pkgs/development/libraries/libassuan/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libassuan";
-  version = "2.5.4";
+  version = "2.5.5";
 
   src = fetchurl {
     url = "mirror://gnupg/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "1w7vnnycq4z7gf4bk38pi4hrb8qrrzgfpz3cd7frwldxnfbfx060";
+    sha256 = "sha256-jowvzJgvnKZ9y7HZXi3HRrFzmkZovCCzo8W+Yy7bNOQ=";
   };
 
   outputs = [ "out" "dev" "info" ];
diff --git a/pkgs/development/libraries/libtheora/default.nix b/pkgs/development/libraries/libtheora/default.nix
index 1638150c263..8f0c4d818f4 100644
--- a/pkgs/development/libraries/libtheora/default.nix
+++ b/pkgs/development/libraries/libtheora/default.nix
@@ -1,4 +1,4 @@
-{lib, stdenv, fetchurl, libogg, libvorbis, pkg-config}:
+{lib, stdenv, fetchurl, libogg, libvorbis, pkg-config, autoreconfHook, fetchpatch }:
 
 stdenv.mkDerivation rec {
   name = "libtheora-1.1.1";
@@ -8,18 +8,20 @@ stdenv.mkDerivation rec {
     sha256 = "0swiaj8987n995rc7hw0asvpwhhzpjiws8kr3s6r44bqqib2k5a0";
   };
 
+  patches = [
+    # fix error in autoconf scripts
+    (fetchpatch {
+      url = "https://github.com/xiph/theora/commit/28cc6dbd9b2a141df94f60993256a5fca368fa54.diff";
+      sha256 = "16jqrq4h1b3krj609vbpzd5845cvkbh3mwmjrcdg35m490p19x9k";
+    })
+  ];
+
   outputs = [ "out" "dev" "devdoc" ];
   outputDoc = "devdoc";
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config autoreconfHook ];
   propagatedBuildInputs = [ libogg libvorbis ];
 
-  # GCC's -fforce-addr flag is not supported by clang
-  # It's just an optimization, so it's safe to simply remove it
-  postPatch = lib.optionalString stdenv.isDarwin ''
-    substituteInPlace configure --replace "-fforce-addr" ""
-  '';
-
   meta = with lib; {
     homepage = "https://www.theora.org/";
     description = "Library for Theora, a free and open video compression format";
diff --git a/pkgs/development/libraries/libva/default.nix b/pkgs/development/libraries/libva/default.nix
index d78332bf5aa..69a59326856 100644
--- a/pkgs/development/libraries/libva/default.nix
+++ b/pkgs/development/libraries/libva/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   name = "libva-${lib.optionalString minimal "minimal-"}${version}";
-  version = "2.10.0";
+  version = "2.11.0";
 
   src = fetchFromGitHub {
     owner  = "intel";
     repo   = "libva";
     rev    = version;
-    sha256 = "1xyxnxmq04s3s6135v6av1rl5z809j9vxvg7af9wvyh3dgsxrlds";
+    sha256 = "0qk30p53mnwiqh2x68vyif11vg3gyjvw8v4qihg099m41qb44hws";
   };
 
   outputs = [ "dev" "out" ];
diff --git a/pkgs/development/libraries/libva/utils.nix b/pkgs/development/libraries/libva/utils.nix
index bcd24d51953..c358ebb1a7e 100644
--- a/pkgs/development/libraries/libva/utils.nix
+++ b/pkgs/development/libraries/libva/utils.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libva-utils";
-  version = "2.10.0";
+  version = "2.11.1";
 
   src = fetchFromGitHub {
     owner  = "intel";
     repo   = "libva-utils";
     rev    = version;
-    sha256 = "14v4mw0asjgg4l0683hn87d8jai8lrmcpbfcm9z93p4mpn2sp7aw";
+    sha256 = "1arp5r0csahjbbsmdmf0dzpgwcpps9s2hlh68lgg6n5n85zkd4b5";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config ];
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index e7c87bbc2c7..397ae4227fe 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -1,8 +1,9 @@
 { stdenv, lib, fetchurl, fetchpatch, buildPackages
-, pkg-config, intltool, ninja, meson
-, file, flex, bison, expat, libdrm, xorg, wayland, wayland-protocols, openssl
+, meson, pkg-config, ninja
+, intltool, bison, flex, file, python3Packages
+, expat, libdrm, xorg, wayland, wayland-protocols, openssl
 , llvmPackages, libffi, libomxil-bellagio, libva-minimal
-, libelf, libvdpau, python3Packages
+, libelf, libvdpau
 , libglvnd
 , enableRadv ? true
 , galliumDrivers ? ["auto"]
@@ -31,7 +32,7 @@ with lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "20.3.4";
+  version = "21.0.1";
   branch  = versions.major version;
 in
 
@@ -46,7 +47,7 @@ stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "1120kf280hg4h0a2505vxf6rdw8r2ydl3cg4iwkmpx0zxj3sj8fw";
+    sha256 = "1fqj2xhhd1ary0pfg31jq6fqcnd6qgyrw1445nmz554k8n2ck7rp";
   };
 
   prePatch = "patchShebangs .";
@@ -113,7 +114,8 @@ stdenv.mkDerivation {
     "-Dva-libs-path=${placeholder "drivers"}/lib/dri"
     "-Dd3d-drivers-path=${placeholder "drivers"}/lib/d3d"
     "-Dgallium-nine=${boolToString enableGalliumNine}" # Direct3D in Wine
-    "-Dosmesa=${if enableOSMesa then "gallium" else "none"}" # used by wine
+    "-Dosmesa=${boolToString enableOSMesa}" # used by wine
+    "-Dmicrosoft-clc=disabled" # Only relevant on Windows (OpenCL 1.2 API on top of D3D12)
   ] ++ optionals stdenv.isLinux [
     "-Dglvnd=true"
   ];
@@ -130,7 +132,7 @@ stdenv.mkDerivation {
   depsBuildBuild = [ pkg-config ];
 
   nativeBuildInputs = [
-    pkg-config meson ninja
+    meson pkg-config ninja
     intltool bison flex file
     python3Packages.python python3Packages.Mako
   ] ++ lib.optionals (elem "wayland" eglPlatforms) [
diff --git a/pkgs/development/libraries/nspr/default.nix b/pkgs/development/libraries/nspr/default.nix
index 17b8b9226d5..159f343cf4d 100644
--- a/pkgs/development/libraries/nspr/default.nix
+++ b/pkgs/development/libraries/nspr/default.nix
@@ -2,7 +2,7 @@
 , CoreServices ? null
 , buildPackages }:
 
-let version = "4.29"; in
+let version = "4.30"; in
 
 stdenv.mkDerivation {
   pname = "nspr";
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://mozilla/nspr/releases/v${version}/src/nspr-${version}.tar.gz";
-    sha256 = "22286bdb8059d74632cc7c2865c139e63953ecfb33bf4362ab58827e86e92582";
+    sha256 = "0fwivizfz88625lwv1ngxirnal7w9csq1q9i7m6dr14l83wdhk4d";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index 81a51c7beae..e6e2190a1a6 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -18,7 +18,7 @@ let
   #       It will rebuild itself using the version of this package (NSS) and if
   #       an update is required do the required changes to the expression.
   #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert
-  version = "3.62";
+  version = "3.63";
   underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
 
 in stdenv.mkDerivation rec {
@@ -27,7 +27,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/${pname}-${version}.tar.gz";
-    sha256 = "0y2ld90bncjjggrn64c7g7mq9i03z6dc3r2kz978snz2xiydzml6";
+    sha256 = "0892xbjcaw6g4rd2rs4qa37nbda248cjrgxa4faaw0licbpjyb8q";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
diff --git a/pkgs/development/libraries/science/math/blis/default.nix b/pkgs/development/libraries/science/math/blis/default.nix
index eb91e0a3d22..26659ffc166 100644
--- a/pkgs/development/libraries/science/math/blis/default.nix
+++ b/pkgs/development/libraries/science/math/blis/default.nix
@@ -17,13 +17,13 @@ let
   blasIntSize = if blas64 then "64" else "32";
 in stdenv.mkDerivation rec {
   pname = "blis";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "flame";
     repo = "blis";
     rev = version;
-    sha256 = "0fp0nskydan3i7sj7qkabwc9sjh7mw73pjpgzh50qchkkcv0s3n1";
+    sha256 = "sha256-D5T/itq9zyD5TkeJ4Ae1vS4yEWU51omyJoIkKQ2NLhY=";
   };
 
   inherit blas64;
diff --git a/pkgs/development/libraries/science/math/openblas/default.nix b/pkgs/development/libraries/science/math/openblas/default.nix
index 23a82f483dc..c66e4ba44ef 100644
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, perl, which
+{ lib, stdenv, fetchFromGitHub, fetchpatch, perl, which
 # Most packages depending on openblas expect integer width to match
 # pointer width, but some expect to use 32-bit integers always
 # (for compatibility with reference BLAS).
@@ -124,6 +124,16 @@ stdenv.mkDerivation rec {
     sha256 = "14jxh0v3jfbw4mfjx4mcz4dd51lyq7pqvh9k8dg94539ypzjr2lj";
   };
 
+  # apply https://github.com/xianyi/OpenBLAS/pull/3060 to fix a crash on arm
+  # remove this when updating to 0.3.14 or newer
+  patches = [
+    (fetchpatch {
+      name = "label-get_cpu_ftr-as-volatile.patch";
+      url = "https://github.com/xianyi/OpenBLAS/commit/6fe0f1fab9d6a7f46d71d37ebb210fbf56924fbc.diff";
+      sha256 = "06gwh73k4sas1ap2fi3jvpifbjkys2vhmnbj4mzrsvj279ljsfdk";
+    })
+  ];
+
   inherit blas64;
 
   # Some hardening features are disabled due to sporadic failures in
diff --git a/pkgs/development/python-modules/Pygments/2_5.nix b/pkgs/development/python-modules/Pygments/2_5.nix
index aa59c370d2e..965e6f0ec34 100644
--- a/pkgs/development/python-modules/Pygments/2_5.nix
+++ b/pkgs/development/python-modules/Pygments/2_5.nix
@@ -3,6 +3,7 @@
 , fetchPypi
 , fetchpatch
 , docutils
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -25,8 +26,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ docutils ];
 
-  # Circular dependency with sphinx
-  doCheck = false;
+  checkInputs = [ pytestCheckHook ];
 
   meta = {
     homepage = "https://pygments.org/";
diff --git a/pkgs/development/python-modules/Pygments/default.nix b/pkgs/development/python-modules/Pygments/default.nix
index a879aef0226..48d74fddd43 100644
--- a/pkgs/development/python-modules/Pygments/default.nix
+++ b/pkgs/development/python-modules/Pygments/default.nix
@@ -2,6 +2,8 @@
 , buildPythonPackage
 , fetchPypi
 , docutils
+, pytestCheckHook
+, doCheck ? true
 }:
 
 buildPythonPackage rec {
@@ -15,8 +17,8 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ docutils ];
 
-  # Circular dependency with sphinx
-  doCheck = false;
+  inherit doCheck;
+  checkInputs = [ pytestCheckHook ];
 
   meta = {
     homepage = "https://pygments.org/";
diff --git a/pkgs/development/python-modules/bootstrapped-pip/2.nix b/pkgs/development/python-modules/bootstrapped-pip/2.nix
new file mode 100644
index 00000000000..5a6333d656a
--- /dev/null
+++ b/pkgs/development/python-modules/bootstrapped-pip/2.nix
@@ -0,0 +1,67 @@
+{ lib, stdenv, python, fetchPypi, makeWrapper, unzip, makeSetupHook
+, pipInstallHook
+, setuptoolsBuildHook
+, wheel, pip, setuptools
+, isPy27
+}:
+
+stdenv.mkDerivation rec {
+  pname = "pip";
+  inherit (pip) version;
+  name = "${python.libPrefix}-bootstrapped-${pname}-${version}";
+
+  srcs = [ wheel.src pip.src setuptools.src ];
+  sourceRoot = ".";
+
+  dontUseSetuptoolsBuild = true;
+  dontUsePipInstall = true;
+
+  # Should be propagatedNativeBuildInputs
+  propagatedBuildInputs = [
+    # Override to remove dependencies to prevent infinite recursion.
+    (pipInstallHook.override{pip=null;})
+    (setuptoolsBuildHook.override{setuptools=null; wheel=null;})
+  ];
+
+  postPatch = ''
+    mkdir -p $out/bin
+  '';
+
+  nativeBuildInputs = [ makeWrapper unzip ];
+  buildInputs = [ python ];
+
+  buildPhase = ":";
+
+  installPhase = lib.strings.optionalString (!stdenv.hostPlatform.isWindows) ''
+    export SETUPTOOLS_INSTALL_WINDOWS_SPECIFIC_FILES=0
+  '' + ''
+    # Give folders a known name
+    mv pip* pip
+    mv setuptools* setuptools
+    mv wheel* wheel
+    # Set up PYTHONPATH. The above folders need to be on PYTHONPATH
+    # $out is where we are installing to and takes precedence
+    export PYTHONPATH="$out/${python.sitePackages}:$(pwd)/pip/src:$(pwd)/setuptools:$(pwd)/setuptools/pkg_resources:$(pwd)/wheel:$PYTHONPATH"
+
+    echo "Building setuptools wheel..."
+    pushd setuptools
+    ${python.pythonForBuild.interpreter} -m pip install --no-build-isolation --no-index --prefix=$out  --ignore-installed --no-dependencies --no-cache .
+    popd
+
+    echo "Building wheel wheel..."
+    pushd wheel
+    ${python.pythonForBuild.interpreter} -m pip install --no-build-isolation --no-index --prefix=$out  --ignore-installed --no-dependencies --no-cache .
+    popd
+
+    echo "Building pip wheel..."
+    pushd pip
+    ${python.pythonForBuild.interpreter} -m pip install --no-build-isolation --no-index --prefix=$out  --ignore-installed --no-dependencies --no-cache .
+    popd
+  '';
+
+  meta = {
+    description = "Version of pip used for bootstrapping";
+    license = lib.unique (pip.meta.license ++ setuptools.meta.license ++ wheel.meta.license);
+    homepage = pip.meta.homepage;
+  };
+}
diff --git a/pkgs/development/python-modules/bootstrapped-pip/default.nix b/pkgs/development/python-modules/bootstrapped-pip/default.nix
index 5a6333d656a..42eb1cccee3 100644
--- a/pkgs/development/python-modules/bootstrapped-pip/default.nix
+++ b/pkgs/development/python-modules/bootstrapped-pip/default.nix
@@ -45,6 +45,7 @@ stdenv.mkDerivation rec {
 
     echo "Building setuptools wheel..."
     pushd setuptools
+    rm pyproject.toml
     ${python.pythonForBuild.interpreter} -m pip install --no-build-isolation --no-index --prefix=$out  --ignore-installed --no-dependencies --no-cache .
     popd
 
diff --git a/pkgs/development/python-modules/cryptography/default.nix b/pkgs/development/python-modules/cryptography/default.nix
index 32624e54c40..4671f607bba 100644
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -22,18 +22,18 @@
 
 buildPythonPackage rec {
   pname = "cryptography";
-  version = "3.4.6"; # Also update the hash in vectors.nix
+  version = "3.4.7"; # Also update the hash in vectors.nix
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "11wgsihfq72fav67c3igi0xbhbd6c5dj869byd1jkq0fbcz24cid";
+    sha256 = "04x7bhjkglxpllad10821vxddlmxdkd3gjvp35iljmnj2s0xw41x";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     sourceRoot = "${pname}-${version}/${cargoRoot}";
     name = "${pname}-${version}";
-    sha256 = "1i0sd2y4a5g1yqwcpw2ycp6p4p8sk5v7clblq756i5864j52v6w1";
+    sha256 = "1wisxmq26b8ml144m2458sgcbk8jpv419j01qmffsrfy50x9i1yw";
   };
 
   cargoRoot = "src/rust";
diff --git a/pkgs/development/python-modules/cryptography/vectors.nix b/pkgs/development/python-modules/cryptography/vectors.nix
index a807be9c3bb..0cb23d53c03 100644
--- a/pkgs/development/python-modules/cryptography/vectors.nix
+++ b/pkgs/development/python-modules/cryptography/vectors.nix
@@ -7,7 +7,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1a1d5ix5b3ajhrqaf8rm6qmd6gkaidij0jgd1vrb8q1xn1gqmy75";
+    sha256 = "1hh4j88ywil3jf62ppj1blygmdirbqz86pynd9lqfijiaym3mb57";
   };
 
   # No tests included
diff --git a/pkgs/development/python-modules/django/2.nix b/pkgs/development/python-modules/django/2.nix
index 06ec880e328..7d28d30e862 100644
--- a/pkgs/development/python-modules/django/2.nix
+++ b/pkgs/development/python-modules/django/2.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "2.2.18";
+  version = "2.2.19";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1d0b91343i9n0qz8xia1fbm4s3q8wi98nyc9a3acncm0w3sr9jf9";
+    sha256 = "0hysjf8bz4g8xrn2cdx6pmawimpyr6ag2fg3jxsnc1byr3g3bhih";
   };
 
   patches = lib.optional withGdal
diff --git a/pkgs/development/python-modules/lxml/default.nix b/pkgs/development/python-modules/lxml/default.nix
index 36b1539834d..984219b802b 100644
--- a/pkgs/development/python-modules/lxml/default.nix
+++ b/pkgs/development/python-modules/lxml/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "lxml";
-  version = "4.6.2";
+  version = "4.6.3";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "1zidx62sxh2r4fmjfjzd4f6i4yxgzkpd20nafbyr0i0wnw9da3fd";
+    sha256 = "1rhkv75qr4ij3653l97sy752gyp6f20sxfpiqp1vp08fpy47q8qn";
   };
 
   # setuptoolsBuildPhase needs dependencies to be passed through nativeBuildInputs
diff --git a/pkgs/development/python-modules/packaging/default.nix b/pkgs/development/python-modules/packaging/default.nix
index a261c8c1e26..d76b5b1723e 100644
--- a/pkgs/development/python-modules/packaging/default.nix
+++ b/pkgs/development/python-modules/packaging/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "packaging";
-  version = "20.8";
+  version = "20.9";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-eFmBhacAikcNZFJqgFnemqpEkjjygPyetrE7psQQkJM=";
+    sha256 = "sha256-WzJ6wTINyGPcpy9FFOzAhvMRhnRLhKIwN0zB/Xdv6uU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pillow/6.nix b/pkgs/development/python-modules/pillow/6.nix
index 51833edfd0b..61242c894a8 100644
--- a/pkgs/development/python-modules/pillow/6.nix
+++ b/pkgs/development/python-modules/pillow/6.nix
@@ -25,5 +25,23 @@ import ./generic.nix (rec {
     '';
     license = "http://www.pythonware.com/products/pil/license.htm";
     maintainers = with maintainers; [ goibhniu prikhi SuperSandro2000 ];
+    knownVulnerabilities = [
+      "CVE-2020-10177"
+      "CVE-2020-10378"
+      "CVE-2020-10379"
+      "CVE-2020-10994"
+      "CVE-2020-11538"
+      "CVE-2020-35653"
+      "CVE-2020-35654"
+      "CVE-2020-35655"
+      "CVE-2021-25289"
+      "CVE-2021-25290"
+      "CVE-2021-25291"
+      "CVE-2021-25292"
+      "CVE-2021-25293"
+      "CVE-2021-27921"
+      "CVE-2021-27922"
+      "CVE-2021-27923"
+    ];
   };
 } // args )
diff --git a/pkgs/development/python-modules/pillow/default.nix b/pkgs/development/python-modules/pillow/default.nix
index 02611c5a925..5fef39ebef0 100644
--- a/pkgs/development/python-modules/pillow/default.nix
+++ b/pkgs/development/python-modules/pillow/default.nix
@@ -5,13 +5,13 @@
 
 import ./generic.nix (rec {
   pname = "Pillow";
-  version = "8.1.1";
+  version = "8.1.2";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "086g7nhv52wclrwnzbzs2x3nvyzs2hfq1bvgivsrp5f7r7wiiz7n";
+    sha256 = "0i7w0fi24za3naz3k3qav6lrhf034nzdy6m9025djlj80476cz5h";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pip/20.nix b/pkgs/development/python-modules/pip/20.nix
new file mode 100644
index 00000000000..6f859d365c5
--- /dev/null
+++ b/pkgs/development/python-modules/pip/20.nix
@@ -0,0 +1,44 @@
+{ lib
+, python
+, buildPythonPackage
+, bootstrapped-pip
+, fetchFromGitHub
+, mock
+, scripttest
+, virtualenv
+, pretend
+, pytest
+, setuptools
+, wheel
+}:
+
+buildPythonPackage rec {
+  pname = "pip";
+  version = "20.3.4";
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "pypa";
+    repo = pname;
+    rev = version;
+    sha256 = "0hkhs9yc1cjdj1gn9wkycd3sy65c05q8k8rhqgsm5jbpksfssiwn";
+    name = "${pname}-${version}-source";
+  };
+
+  nativeBuildInputs = [ bootstrapped-pip ];
+
+  # pip detects that we already have bootstrapped_pip "installed", so we need
+  # to force it a little.
+  pipInstallFlags = [ "--ignore-installed" ];
+
+  checkInputs = [ mock scripttest virtualenv pretend pytest ];
+  # Pip wants pytest, but tests are not distributed
+  doCheck = false;
+
+  meta = {
+    description = "The PyPA recommended tool for installing Python packages";
+    license = with lib.licenses; [ mit ];
+    homepage = "https://pip.pypa.io/";
+    priority = 10;
+  };
+}
diff --git a/pkgs/development/python-modules/pip/default.nix b/pkgs/development/python-modules/pip/default.nix
index 6f859d365c5..f7979966703 100644
--- a/pkgs/development/python-modules/pip/default.nix
+++ b/pkgs/development/python-modules/pip/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "pip";
-  version = "20.3.4";
+  version = "21.0.1";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = pname;
     rev = version;
-    sha256 = "0hkhs9yc1cjdj1gn9wkycd3sy65c05q8k8rhqgsm5jbpksfssiwn";
+    sha256 = "sha256-Yt5xqdo735f5sQKP8GnKM201SoIi7ZP9l2gw+feUVW0=";
     name = "${pname}-${version}-source";
   };
 
diff --git a/pkgs/development/python-modules/setuptools-rust/default.nix b/pkgs/development/python-modules/setuptools-rust/default.nix
index e3d8a35186a..f7cc04c4eeb 100644
--- a/pkgs/development/python-modules/setuptools-rust/default.nix
+++ b/pkgs/development/python-modules/setuptools-rust/default.nix
@@ -2,7 +2,7 @@
 , lib
 , buildPythonPackage
 , fetchPypi
-, isPy27
+, pythonOlder
 , semantic-version
 , setuptools
 , setuptools-scm
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "setuptools-rust";
-  version = "0.11.6";
-  disabled = isPy27;
+  version = "0.12.1";
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a5b5954909cbc5d66b914ee6763f81fa2610916041c7266105a469f504a7c4ca";
+    sha256 = "647009e924f0ae439c7f3e0141a184a69ad247ecb9044c511dabde232d3d570e";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/setuptools-rust/pyo3-test/default.nix b/pkgs/development/python-modules/setuptools-rust/pyo3-test/default.nix
index 9af17aa5159..31730d6ff2d 100644
--- a/pkgs/development/python-modules/setuptools-rust/pyo3-test/default.nix
+++ b/pkgs/development/python-modules/setuptools-rust/pyo3-test/default.nix
@@ -17,5 +17,9 @@ callPackage ../../../tools/rust/maturin/pyo3-test/generic.nix {
     rust.rustc
   ]);
 
-  sourceRoot = "source/examples/word-count";
+  preConfigure = ''
+    # sourceRoot puts Cargo.lock in the wrong place due to the
+    # example setup.
+    cd examples/word-count
+  '';
 }
diff --git a/pkgs/development/python-modules/setuptools/default.nix b/pkgs/development/python-modules/setuptools/default.nix
index 12bbbb7d0e5..0e144c5b009 100644
--- a/pkgs/development/python-modules/setuptools/default.nix
+++ b/pkgs/development/python-modules/setuptools/default.nix
@@ -1,4 +1,5 @@
 { stdenv
+, fetchurl
 , buildPythonPackage
 , fetchFromGitHub
 , python
@@ -13,7 +14,12 @@
 
 let
   pname = "setuptools";
-  version = "50.3.1";
+  version = "54.2.0";
+
+  bootstrap = fetchurl {
+    url = "https://raw.githubusercontent.com/pypa/setuptools/v52.0.0/bootstrap.py";
+    sha256 = "sha256-HzhlnJvMskBfb3kVnYltdnjS63wt1GWd0RK+VQqrJQ8=";
+  };
 
   # Create an sdist of setuptools
   sdist = stdenv.mkDerivation rec {
@@ -23,7 +29,7 @@ let
       owner = "pypa";
       repo = pname;
       rev = "v${version}";
-      sha256 = "Z4KHB3Pv4wZPou/Vbp1DFDgDp47OTDfVChGP55GtIJE=";
+      sha256 = "sha256-ZHJZiwlWLHP4vf2TLwj/DYB9wjbRp0apVmmjsKCLPq0=";
       name = "${pname}-${version}-source";
     };
 
@@ -32,6 +38,7 @@ let
     ];
 
     buildPhase = ''
+      cp ${bootstrap} bootstrap.py
       ${python.pythonForBuild.interpreter} bootstrap.py
       ${python.pythonForBuild.interpreter} setup.py sdist --formats=gztar
 
diff --git a/pkgs/development/python-modules/urllib3/2.nix b/pkgs/development/python-modules/urllib3/2.nix
index a67ebd62f7e..3fc90fe5d82 100644
--- a/pkgs/development/python-modules/urllib3/2.nix
+++ b/pkgs/development/python-modules/urllib3/2.nix
@@ -4,6 +4,7 @@
 , certifi
 , cryptography
 , dateutil
+, fetchpatch
 , fetchPypi
 , idna
 , mock
@@ -26,6 +27,14 @@ buildPythonPackage rec {
     sha256 = "19188f96923873c92ccb987120ec4acaa12f0461fa9ce5d3d0772bc965a39e08";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2021-28363.patch";
+      url = "https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0.patch";
+      sha256 = "1lqhrd11p03iv14bp89rh67ynf000swmwsfvr3jpfdycdqr3ka9q";
+    })
+  ];
+
   propagatedBuildInputs = [
     brotli
     certifi
diff --git a/pkgs/development/python-modules/urllib3/default.nix b/pkgs/development/python-modules/urllib3/default.nix
index b7a3f81c723..35cb0b25564 100644
--- a/pkgs/development/python-modules/urllib3/default.nix
+++ b/pkgs/development/python-modules/urllib3/default.nix
@@ -19,11 +19,11 @@
 
 buildPythonPackage rec {
   pname = "urllib3";
-  version = "1.26.3";
+  version = "1.26.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "de3eedaad74a2683334e282005cd8d7f22f4d55fa690a2a1020a416cb0a47e73";
+    sha256 = "0dw9w9bs3hmr5dp3r3h43jyzzb1g1046ag7lj8pqf58i4kvj3c77";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/ruby-modules/gem-config/default.nix b/pkgs/development/ruby-modules/gem-config/default.nix
index 5ca2612cc6f..99c535fa338 100644
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@@ -18,7 +18,7 @@
 # (to make gems behave if necessary).
 
 { lib, fetchurl, writeScript, ruby, libkrb5, libxml2, libxslt, python, stdenv, which
-, libiconv, postgresql, v8, clang, sqlite, zlib, imagemagick
+, libiconv, postgresql, v8, clang, sqlite, zlib, imagemagick, lasem
 , pkg-config , ncurses, xapian, gpgme, util-linux, tzdata, icu, libffi
 , cmake, libssh2, openssl, libmysqlclient, darwin, git, perl, pcre, gecode_3, curl
 , msgpack, libsodium, snappy, libossp_uuid, lxc, libpcap, xorg, gtk2, buildRubyGem
@@ -345,6 +345,7 @@ in
       flex
       pkg-config
       python3
+      patchelf
     ];
 
     buildInputs = [
@@ -369,12 +370,13 @@ in
             $out/${ruby.gemPath}/extensions/*/*/mathematical-${attrs.version}/gem_make.out
     '';
 
-    # For some reason 'mathematical.so' is missing cairo and glib in its RPATH, add them explicitly here
+    # For some reason 'mathematical.so' is missing cairo, glib, and
+    # lasem in its RPATH, add them explicitly here
     postFixup = lib.optionalString stdenv.isLinux ''
       soPath="$out/${ruby.gemPath}/gems/mathematical-${attrs.version}/lib/mathematical/mathematical.so"
-      ${patchelf}/bin/patchelf \
-        --set-rpath "${lib.makeLibraryPath [ glib cairo ]}:$(${patchelf}/bin/patchelf --print-rpath "$soPath")" \
-        "$soPath"
+      rpath="$(patchelf --print-rpath "$soPath")"
+      patchelf --set-rpath "${lib.makeLibraryPath [ lasem glib cairo ]}:$rpath" "$soPath"
+      patchelf --replace-needed liblasem.so liblasem-0.4.so "$soPath"
     '';
   };
 
diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index 65e1b553875..d1460507466 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -20,12 +20,12 @@ stdenv.mkDerivation (rec {
           + lib.optionalString useNcurses "-cursesUI"
           + lib.optionalString withQt5 "-qt5UI"
           + lib.optionalString useQt4 "-qt4UI";
-  version = "3.19.6";
+  version = "3.19.7";
 
   src = fetchurl {
     url = "${meta.homepage}files/v${lib.versions.majorMinor version}/cmake-${version}.tar.gz";
     # compare with https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}-SHA-256.txt
-    sha256 = "sha256-7IerZ8RfR8QoXyBCgMXN5I4ckgz8/tFVWyf7OxodILo=";
+    sha256 = "sha256-WKFfDVagr8zDzFNxI0/Oc/zGyPnb13XYmOUQuDF1WI4=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/jbang/default.nix b/pkgs/development/tools/jbang/default.nix
index 4c35aaaae05..de3672df3d9 100644
--- a/pkgs/development/tools/jbang/default.nix
+++ b/pkgs/development/tools/jbang/default.nix
@@ -1,12 +1,12 @@
 { stdenv, lib, fetchzip, jdk, makeWrapper, coreutils, curl }:
 
 stdenv.mkDerivation rec {
-  version = "0.69.1";
+  version = "0.69.2";
   pname = "jbang";
 
   src = fetchzip {
     url = "https://github.com/jbangdev/jbang/releases/download/v${version}/${pname}-${version}.tar";
-    sha256 = "sha256-FuwivcF1SpGbLcoQshVNSWSQ7PgWC0XPCQF+i9zHb/w=";
+    sha256 = "sha256-MsVmsZOupkJWGyoTxxQavcO78X4MMuIqJXaPSbd/Tgg=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/misc/binutils/CVE-2020-35448.patch b/pkgs/development/tools/misc/binutils/CVE-2020-35448.patch
new file mode 100644
index 00000000000..2eba7b51849
--- /dev/null
+++ b/pkgs/development/tools/misc/binutils/CVE-2020-35448.patch
@@ -0,0 +1,77 @@
+From 8642dafaef21aa6747cec01df1977e9c52eb4679 Mon Sep 17 00:00:00 2001
+From: Alan Modra <amodra@gmail.com>
+Date: Fri, 4 Sep 2020 19:19:18 +0930
+Subject: [PATCH] PR26574, heap buffer overflow in
+ _bfd_elf_slurp_secondary_reloc_section
+
+A horribly fuzzed object with section headers inside the ELF header.
+Disallow that, and crazy reloc sizes.
+
+	PR 26574
+	* elfcode.h (elf_object_p): Sanity check section header offset.
+	* elf.c (_bfd_elf_slurp_secondary_reloc_section): Sanity check
+	sh_entsize.
+---
+ bfd/elf.c     | 4 +++-
+ bfd/elfcode.h | 8 ++++----
+ 3 files changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/bfd/elf.c b/bfd/elf.c
+index ac2095f787d..5a02f8dc309 100644
+--- a/bfd/elf.c
++++ b/bfd/elf.c
+@@ -12576,7 +12576,9 @@ _bfd_elf_slurp_secondary_reloc_section (bfd *      abfd,
+       Elf_Internal_Shdr * hdr = & elf_section_data (relsec)->this_hdr;
+ 
+       if (hdr->sh_type == SHT_SECONDARY_RELOC
+-	  && hdr->sh_info == (unsigned) elf_section_data (sec)->this_idx)
++	  && hdr->sh_info == (unsigned) elf_section_data (sec)->this_idx
++	  && (hdr->sh_entsize == ebd->s->sizeof_rel
++	      || hdr->sh_entsize == ebd->s->sizeof_rela))
+ 	{
+ 	  bfd_byte * native_relocs;
+ 	  bfd_byte * native_reloc;
+diff --git a/bfd/elfcode.h b/bfd/elfcode.h
+index 2ed2f135c34..606ff64fd4d 100644
+--- a/bfd/elfcode.h
++++ b/bfd/elfcode.h
+@@ -571,7 +571,7 @@ elf_object_p (bfd *abfd)
+ 
+   /* If this is a relocatable file and there is no section header
+      table, then we're hosed.  */
+-  if (i_ehdrp->e_shoff == 0 && i_ehdrp->e_type == ET_REL)
++  if (i_ehdrp->e_shoff < sizeof (x_ehdr) && i_ehdrp->e_type == ET_REL)
+     goto got_wrong_format_error;
+ 
+   /* As a simple sanity check, verify that what BFD thinks is the
+@@ -581,7 +581,7 @@ elf_object_p (bfd *abfd)
+     goto got_wrong_format_error;
+ 
+   /* Further sanity check.  */
+-  if (i_ehdrp->e_shoff == 0 && i_ehdrp->e_shnum != 0)
++  if (i_ehdrp->e_shoff < sizeof (x_ehdr) && i_ehdrp->e_shnum != 0)
+     goto got_wrong_format_error;
+ 
+   ebd = get_elf_backend_data (abfd);
+@@ -618,7 +618,7 @@ elf_object_p (bfd *abfd)
+       && ebd->elf_osabi != ELFOSABI_NONE)
+     goto got_wrong_format_error;
+ 
+-  if (i_ehdrp->e_shoff != 0)
++  if (i_ehdrp->e_shoff >= sizeof (x_ehdr))
+     {
+       file_ptr where = (file_ptr) i_ehdrp->e_shoff;
+ 
+@@ -819,7 +819,7 @@ elf_object_p (bfd *abfd)
+ 	}
+     }
+ 
+-  if (i_ehdrp->e_shstrndx != 0 && i_ehdrp->e_shoff != 0)
++  if (i_ehdrp->e_shstrndx != 0 && i_ehdrp->e_shoff >= sizeof (x_ehdr))
+     {
+       unsigned int num_sec;
+ 
+-- 
+2.27.0
+
+
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index 5022f8a7f8c..37ba3420b18 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -61,6 +61,7 @@ stdenv.mkDerivation {
     # cross-compiling.
     ./always-search-rpath.patch
 
+    ./CVE-2020-35448.patch
   ] ++ lib.optional stdenv.targetPlatform.isiOS ./support-ios.patch
     ++ # This patch was suggested by Nick Clifton to fix
        # https://sourceware.org/bugzilla/show_bug.cgi?id=16177
diff --git a/pkgs/development/tools/misc/elfutils/default.nix b/pkgs/development/tools/misc/elfutils/default.nix
index 8954ff2bc42..c1227775785 100644
--- a/pkgs/development/tools/misc/elfutils/default.nix
+++ b/pkgs/development/tools/misc/elfutils/default.nix
@@ -61,10 +61,10 @@ stdenv.mkDerivation rec {
   # We need bzip2 in NativeInputs because otherwise we can't unpack the src,
   # as the host-bzip2 will be in the path.
   nativeBuildInputs = [ m4 bison flex gettext bzip2 ]
-    ++ lib.optional stdenv.hostPlatform.isMusl [ pkg-config autoreconfHook ]
-    ++ lib.optional enableDebuginfod [ pkg-config ];
+    ++ lib.optional stdenv.hostPlatform.isMusl autoreconfHook
+    ++ lib.optional (enableDebuginfod || stdenv.hostPlatform.isMusl) pkg-config;
   buildInputs = [ zlib bzip2 xz ]
-    ++ lib.optional stdenv.hostPlatform.isMusl [
+    ++ lib.optionals stdenv.hostPlatform.isMusl [
     argp-standalone
     musl-fts
     musl-obstack
diff --git a/pkgs/development/tools/misc/icon-naming-utils/default.nix b/pkgs/development/tools/misc/icon-naming-utils/default.nix
index 8fdc448ee91..478c0a61f86 100644
--- a/pkgs/development/tools/misc/icon-naming-utils/default.nix
+++ b/pkgs/development/tools/misc/icon-naming-utils/default.nix
@@ -1,4 +1,4 @@
-{lib, stdenv, fetchurl, perlPackages, librsvg}:
+{lib, stdenv, fetchurl, perl, librsvg}:
 
 stdenv.mkDerivation rec {
   name = "icon-naming-utils-0.8.90";
@@ -8,14 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "071fj2jm5kydlz02ic5sylhmw6h2p3cgrm3gwdfabinqkqcv4jh4";
   };
 
-  buildInputs = [ librsvg ] ++ (with perlPackages; [ perl XMLSimple ]);
-
-  postInstall =
-    ''
-      # Add XML::Simple to the runtime search path.
-      substituteInPlace $out/libexec/icon-name-mapping \
-          --replace '/bin/perl' '/bin/perl -I${perlPackages.XMLSimple}/${perlPackages.perl.libPrefix}'
-    '';
+  buildInputs = [ librsvg (perl.withPackages (p: [ p.XMLSimple ])) ];
 
   meta = with lib; {
     homepage = "http://tango.freedesktop.org/Standard_Icon_Naming_Specification";
diff --git a/pkgs/development/tools/ocaml/findlib/default.nix b/pkgs/development/tools/ocaml/findlib/default.nix
index 8752b2edb66..2286c0945fc 100644
--- a/pkgs/development/tools/ocaml/findlib/default.nix
+++ b/pkgs/development/tools/ocaml/findlib/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ocaml-findlib";
-  version = "1.8.1";
+  version = "1.9.1";
 
   src = fetchurl {
     url = "http://download.camlcity.org/download/findlib-${version}.tar.gz";
-    sha256 = "00s3sfb02pnjmkax25pcnljcnhcggiliccfz69a72ic7gsjwz1cf";
+    sha256 = "sha256-K0K4vVRIjWTEvzy3BUtLN70wwdwSvUMeoeTXrYqYD+I=";
   };
 
   buildInputs = [m4 ncurses ocaml];
diff --git a/pkgs/development/tools/rust/maturin/pyo3-test/default.nix b/pkgs/development/tools/rust/maturin/pyo3-test/default.nix
index b118309b36d..7f79c8565d2 100644
--- a/pkgs/development/tools/rust/maturin/pyo3-test/default.nix
+++ b/pkgs/development/tools/rust/maturin/pyo3-test/default.nix
@@ -1,8 +1,8 @@
-{ callPackage
+{ python3
 , rustPlatform
 }:
 
-callPackage ./generic.nix {
+python3.pkgs.callPackage ./generic.nix {
   buildAndTestSubdir = "examples/word-count";
 
   nativeBuildInputs = with rustPlatform; [
diff --git a/pkgs/development/tools/rust/maturin/pyo3-test/generic.nix b/pkgs/development/tools/rust/maturin/pyo3-test/generic.nix
index f82c988fc51..41175ad8538 100644
--- a/pkgs/development/tools/rust/maturin/pyo3-test/generic.nix
+++ b/pkgs/development/tools/rust/maturin/pyo3-test/generic.nix
@@ -3,17 +3,17 @@
 
 { lib
 , fetchFromGitHub
-, python3Packages
+, python
 , rustPlatform
 
 , nativeBuildInputs
 
 , buildAndTestSubdir ? null
 , format ? "pyproject"
-, sourceRoot ? "source"
+, preConfigure ? ""
 }:
 
-python3Packages.buildPythonPackage rec {
+python.pkgs.buildPythonPackage rec {
   pname = "word-count";
   version = "0.13.2";
 
@@ -25,14 +25,14 @@ python3Packages.buildPythonPackage rec {
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src sourceRoot patches;
+    inherit src patches;
     name = "${pname}-${version}";
     hash = "sha256-//TmozgWy9zrSpMKX92XdHj4fw/T1Elfgn4YhhR7ot0=";
   };
 
   patches = [ ./Cargo.lock.patch ];
 
-  inherit buildAndTestSubdir format nativeBuildInputs sourceRoot;
+  inherit buildAndTestSubdir format nativeBuildInputs preConfigure;
 
   pythonImportsCheck = [ "word_count" ];
 
diff --git a/pkgs/misc/screensavers/xscreensaver/default.nix b/pkgs/misc/screensavers/xscreensaver/default.nix
index 5f41090d05f..29e931fe242 100644
--- a/pkgs/misc/screensavers/xscreensaver/default.nix
+++ b/pkgs/misc/screensavers/xscreensaver/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, bc, perl, perlPackages, pam, libXext, libXScrnSaver, libX11
+{ lib, stdenv, fetchurl, pkg-config, bc, perl, pam, libXext, libXScrnSaver, libX11
 , libXrandr, libXmu, libXxf86vm, libXrender, libXxf86misc, libjpeg, libGLU, libGL, gtk2
 , libxml2, libglade, intltool, xorg, makeWrapper, gle, gdk-pixbuf, gdk-pixbuf-xlib
 , forceInstallAllHacks ? false
@@ -38,11 +38,13 @@ stdenv.mkDerivation rec {
   postInstall = ''
       wrapProgram $out/bin/xscreensaver-text \
         --prefix PATH : ${lib.makeBinPath [xorg.appres]}
-      wrapProgram $out/bin/xscreensaver-getimage-file \
-        --set PERL5LIB "$out/${perlPackages.perl.libPrefix}:${with perlPackages; makePerlPath [
-              EncodeLocale HTTPDate HTTPMessage IOSocketSSL LWP LWPProtocolHttps
-              MozillaCA NetHTTP NetSSLeay TryTiny URI
-              ]}"
+
+      substituteInPlace $out/bin/xscreensaver-getimage-file \
+        --replace '${perl}' '${perl.withPackages (p: with p;
+          [ EncodeLocale HTTPDate HTTPMessage IOSocketSSL
+            LWP LWPProtocolHttps MozillaCA NetHTTP
+            NetSSLeay TryTiny URI
+          ])}'
   ''
   + lib.optionalString forceInstallAllHacks ''
     make -C hacks/glx dnalogo
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index 935b5e65b1f..bb0c0b45d6e 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -136,10 +136,9 @@ let
         wrapProgram $out/bin/$prog --prefix PYTHONPATH : "$out/lib/${python.libPrefix}/site-packages:$PYTHONPATH"
       done
 
-      substituteInPlace $out/bin/aa-notify --replace /usr/bin/notify-send ${libnotify}/bin/notify-send
-      # aa-notify checks its name and does not work named ".aa-notify-wrapped"
-      mv $out/bin/aa-notify $out/bin/aa-notify-wrapped
-      makeWrapper ${perl}/bin/perl $out/bin/aa-notify --set PERL5LIB ${libapparmor}/${perl.libPrefix} --add-flags $out/bin/aa-notify-wrapped
+      substituteInPlace $out/bin/aa-notify \
+        --replace /usr/bin/notify-send ${libnotify}/bin/notify-send \
+        --replace /usr/bin/perl "${perl}/bin/perl -I ${libapparmor}/${perl.libPrefix}"
     '';
 
     inherit doCheck;
diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
index 6cb23de50a9..96f9f23e97e 100644
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@@ -1,5 +1,6 @@
 { stdenv
 , lib
+, fetchpatch
 , fetchurl
 , alsaLib
 , dbus
@@ -44,6 +45,15 @@ in stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ] ++ lib.optional doCheck "test";
 
+  patches = [
+    # Fixes https://github.com/NixOS/nixpkgs/issues/117663
+    (fetchpatch {
+      name = "disconnect-fix.patch";
+      url = "https://github.com/bluez/bluez/commit/28ddec8d6b829e002fa268c07b71e4c564ba9e16.patch";
+      sha256 = "sha256-vzMf1i44e4JrpL7cXbn9oDr+3B+Glf7dPW3QDstEnEM=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace tools/hid2hci.rules \
       --replace /sbin/udevadm ${systemd}/bin/udevadm \
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 777a91241bb..008205f5b15 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -142,6 +142,9 @@ let
       IPV6_MROUTE_MULTIPLE_TABLES = yes;
       IPV6_PIMSM_V2               = yes;
       IPV6_FOU_TUNNEL             = whenAtLeast "4.7" module;
+      IPV6_SEG6_LWTUNNEL          = whenAtLeast "4.10" yes;
+      IPV6_SEG6_HMAC              = whenAtLeast "4.10" yes;
+      IPV6_SEG6_BPF               = whenAtLeast "4.18" yes;
       NET_CLS_BPF                 = whenAtLeast "4.4" module;
       NET_ACT_BPF                 = whenAtLeast "4.4" module;
       NET_SCHED                   = yes;
diff --git a/pkgs/os-specific/linux/rdma-core/default.nix b/pkgs/os-specific/linux/rdma-core/default.nix
index c37514eaf48..dff451a01d3 100644
--- a/pkgs/os-specific/linux/rdma-core/default.nix
+++ b/pkgs/os-specific/linux/rdma-core/default.nix
@@ -1,6 +1,5 @@
 { lib, stdenv, fetchFromGitHub, cmake, pkg-config, docutils
 , pandoc, ethtool, iproute2, libnl, udev, python3, perl
-, makeWrapper
 } :
 
 let
@@ -17,7 +16,7 @@ in stdenv.mkDerivation {
     sha256 = "sha256-2HFtj595sDmWqAewIMwKMaiSDVVWKdQA9l0QsPcw8qA=";
   };
 
-  nativeBuildInputs = [ cmake pkg-config pandoc docutils makeWrapper ];
+  nativeBuildInputs = [ cmake pkg-config pandoc docutils ];
   buildInputs = [ libnl ethtool iproute2 udev python3 perl ];
 
   cmakeFlags = [
@@ -39,7 +38,8 @@ in stdenv.mkDerivation {
   postFixup = ''
     for pls in $out/bin/{ibfindnodesusing.pl,ibidsverify.pl}; do
       echo "wrapping $pls"
-      wrapProgram $pls --prefix PERL5LIB : "$out/${perl.libPrefix}"
+      substituteInPlace $pls --replace \
+        "${perl}/bin/perl" "${perl}/bin/perl -I $out/${perl.libPrefix}"
     done
   '';
 
diff --git a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
index b3b241b570a..ac2d0018160 100644
--- a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
+++ b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
@@ -1,7 +1,7 @@
-From dd2ec741aaa7c587eb7719bbf4b305fe28168b77 Mon Sep 17 00:00:00 2001
+From 2f4a5e9c9ef1cd57662e8bd4c24e1029a00d55b5 Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Tue, 8 Jan 2013 15:46:30 +0100
-Subject: [PATCH 01/18] Start device units for uninitialised encrypted devices
+Subject: [PATCH 01/19] Start device units for uninitialised encrypted devices
 
 This is necessary because the NixOS service that initialises the
 filesystem depends on the appearance of the device unit.  Also, this
@@ -13,7 +13,7 @@ unit.  (However, this ignores the fsck unit, so it's not perfect...)
  1 file changed, 4 deletions(-)
 
 diff --git a/rules.d/99-systemd.rules.in b/rules.d/99-systemd.rules.in
-index d2f595d18e..941a7c1ba3 100644
+index 7c22eefdb7..e3a55e00b5 100644
 --- a/rules.d/99-systemd.rules.in
 +++ b/rules.d/99-systemd.rules.in
 @@ -17,10 +17,6 @@ SUBSYSTEM=="ubi", TAG+="systemd"
@@ -28,5 +28,5 @@ index d2f595d18e..941a7c1ba3 100644
  SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}!="crypto_LUKS", SYMLINK+="gpt-auto-root"
  SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}=="crypto_LUKS", SYMLINK+="gpt-auto-root-luks"
 -- 
-2.29.2
+2.30.1
 
diff --git a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
index 1f3a1b64684..f54430f764e 100644
--- a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
+++ b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
@@ -1,7 +1,7 @@
-From ab3dab997695db5346f8efbf8566ac96612f0c6e Mon Sep 17 00:00:00 2001
+From 4e96b2e074c4a4f4ce900409872ce2f86704ee5b Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Fri, 12 Apr 2013 13:16:57 +0200
-Subject: [PATCH 02/18] Don't try to unmount /nix or /nix/store
+Subject: [PATCH 02/19] Don't try to unmount /nix or /nix/store
 
 They'll still be remounted read-only.
 
@@ -38,5 +38,5 @@ index 3a72a13e1a..541320dc9d 100644
                  || path_equal(path, "/usr")
  #endif
 -- 
-2.29.2
+2.30.1
 
diff --git a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
index 56f52b9971e..37caffb97d7 100644
--- a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
+++ b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
@@ -1,7 +1,7 @@
-From 3581f8f30270e6340c671a640fe551e954715f8e Mon Sep 17 00:00:00 2001
+From 3d1b2e56a6ed6cc86a64f6f89765a2900e576402 Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Wed, 16 Apr 2014 10:59:28 +0200
-Subject: [PATCH 03/18] Fix NixOS containers
+Subject: [PATCH 03/19] Fix NixOS containers
 
 In NixOS containers, the init script is bind-mounted into the
 container, so checking early whether it exists will fail.
@@ -10,10 +10,10 @@ container, so checking early whether it exists will fail.
  1 file changed, 2 insertions(+)
 
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 0842731c18..f790853104 100644
+index 7515380fcd..14f8a82eb8 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -5319,6 +5319,7 @@ static int run(int argc, char *argv[]) {
+@@ -5323,6 +5323,7 @@ static int run(int argc, char *argv[]) {
                                  goto finish;
                          }
                  } else {
@@ -21,7 +21,7 @@ index 0842731c18..f790853104 100644
                          const char *p, *q;
  
                          if (arg_pivot_root_new)
-@@ -5333,6 +5334,7 @@ static int run(int argc, char *argv[]) {
+@@ -5337,6 +5338,7 @@ static int run(int argc, char *argv[]) {
                                  r = -EINVAL;
                                  goto finish;
                          }
@@ -30,5 +30,5 @@ index 0842731c18..f790853104 100644
  
          } else {
 -- 
-2.29.2
+2.30.1
 
diff --git a/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch b/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch
index 4d3729556d6..2f14a9d6a7e 100644
--- a/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch
+++ b/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch
@@ -1,17 +1,17 @@
-From 12b63d8c1d2ca85d9bb7ea07e8eb5e623e1b58e9 Mon Sep 17 00:00:00 2001
+From 3a721cf70e952e933ef5374006bbb11a3a0ad36a Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Thu, 1 May 2014 14:10:10 +0200
-Subject: [PATCH 04/18] Look for fsck in the right place
+Subject: [PATCH 04/19] Look for fsck in the right place
 
 ---
  src/fsck/fsck.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/fsck/fsck.c b/src/fsck/fsck.c
-index 04752fe9dc..ad0ccf91c0 100644
+index 510689f3b7..25cab5acae 100644
 --- a/src/fsck/fsck.c
 +++ b/src/fsck/fsck.c
-@@ -369,7 +369,7 @@ static int run(int argc, char *argv[]) {
+@@ -368,7 +368,7 @@ static int run(int argc, char *argv[]) {
                  } else
                          dash_c[0] = 0;
  
@@ -21,5 +21,5 @@ index 04752fe9dc..ad0ccf91c0 100644
                  cmdline[i++] = "-T";
  
 -- 
-2.29.2
+2.30.1
 
diff --git a/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch b/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
index 3e40385c3bb..0acccacd613 100644
--- a/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
+++ b/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
@@ -1,7 +1,7 @@
-From 95e4533f1eeb6e0d509f9129d0133f0b849cc3c5 Mon Sep 17 00:00:00 2001
+From 8b7f881cf22e98e907506f4c403b9e304e332bf9 Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Fri, 19 Dec 2014 14:46:17 +0100
-Subject: [PATCH 05/18] Add some NixOS-specific unit directories
+Subject: [PATCH 05/19] Add some NixOS-specific unit directories
 
 Look in `/nix/var/nix/profiles/default/lib/systemd/{system,user}` for
 units provided by packages installed into the default profile via
@@ -92,7 +92,7 @@ index 96b82170d0..bf66bd6b77 100644
  
                  if (!add)
 diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
-index f2c045511d..d38a3a0302 100644
+index b5cc8f94a5..a701cd05f8 100644
 --- a/src/core/systemd.pc.in
 +++ b/src/core/systemd.pc.in
 @@ -38,10 +38,11 @@ systemdsystemconfdir=${systemd_system_conf_dir}
@@ -110,5 +110,5 @@ index f2c045511d..d38a3a0302 100644
  
  systemd_system_generator_dir=${root_prefix}/lib/systemd/system-generators
 -- 
-2.29.2
+2.30.1
 
diff --git a/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch b/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch
index 99e68c37c20..bda27ac1762 100644
--- a/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch
+++ b/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch
@@ -1,7 +1,7 @@
-From 3aeb3a10c4a7ad387b004bf41efbd171913bcca9 Mon Sep 17 00:00:00 2001
+From 7a6529ee27028860b93bc539e8bbf3f2374d712f Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Mon, 11 May 2015 15:39:38 +0200
-Subject: [PATCH 06/18] Get rid of a useless message in user sessions
+Subject: [PATCH 06/19] Get rid of a useless message in user sessions
 
 Namely lots of variants of
 
@@ -27,5 +27,5 @@ index 45a417a090..8af3cb08d6 100644
          /* A unit we need to run is gone. Sniff. Let's stop this. */
          r = manager_add_job(u->manager, JOB_STOP, u, JOB_FAIL, NULL, &error, NULL);
 -- 
-2.29.2
+2.30.1
 
diff --git a/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch b/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
index aeb734f94df..d51e1c0f566 100644
--- a/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
+++ b/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
@@ -1,7 +1,7 @@
-From a1454e8edb7a1a87093808dc7db540232147df3d Mon Sep 17 00:00:00 2001
+From 5580303956ca7d8eb431d23c2af0030c9cc0e6e9 Mon Sep 17 00:00:00 2001
 From: Gabriel Ebner <gebner@gebner.org>
 Date: Sun, 6 Dec 2015 14:26:36 +0100
-Subject: [PATCH 07/18] hostnamed, localed, timedated: disable methods that
+Subject: [PATCH 07/19] hostnamed, localed, timedated: disable methods that
  change system settings.
 
 ---
@@ -69,7 +69,7 @@ index 736dacdee9..53e0ee935e 100644
          model = empty_to_null(model);
          variant = empty_to_null(variant);
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index 8bfcfd5cdc..a0ee03f134 100644
+index 76fe04900d..e87c4c8919 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
 @@ -646,6 +646,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
@@ -90,10 +90,10 @@ index 8bfcfd5cdc..a0ee03f134 100644
 +        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
 +            "Changing system settings via systemd is not supported on NixOS.");
 +
-         if (lrtc == c->local_rtc)
+         if (lrtc == c->local_rtc && !fix_system)
                  return sd_bus_reply_method_return(m, NULL);
  
-@@ -905,6 +912,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
+@@ -907,6 +914,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
          if (r < 0)
                  return r;
  
@@ -104,5 +104,5 @@ index 8bfcfd5cdc..a0ee03f134 100644
          if (r < 0)
                  return r;
 -- 
-2.29.2
+2.30.1
 
diff --git a/pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch b/pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch
index 0da52477bb3..2b1c02b233c 100644
--- a/pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch
+++ b/pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch
@@ -1,7 +1,7 @@
-From 27680c555713e36d16198fc5f60b0f85e0777d30 Mon Sep 17 00:00:00 2001
+From 874698425f6d68fc0d662cb17c7c29e0af3e8c25 Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <ab@fmap.me>
 Date: Thu, 7 Jul 2016 02:47:13 +0300
-Subject: [PATCH 08/18] Fix hwdb paths
+Subject: [PATCH 08/19] Fix hwdb paths
 
 Patch by vcunat.
 ---
@@ -28,5 +28,5 @@ index cb3c77ce96..7b8c80071f 100644
  _public_ int sd_hwdb_new(sd_hwdb **ret) {
          _cleanup_(sd_hwdb_unrefp) sd_hwdb *hwdb = NULL;
 -- 
-2.29.2
+2.30.1
 
diff --git a/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch b/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
index 2b05cea435c..a1e8ec963c7 100644
--- a/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+++ b/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
@@ -1,7 +1,7 @@
-From b423ce2560bd380abd80796a890454d95cd8926c Mon Sep 17 00:00:00 2001
+From 367d0dad3d1853048569e315931cb8a27e16a098 Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <ab@fmap.me>
 Date: Tue, 11 Oct 2016 13:12:08 +0300
-Subject: [PATCH 09/18] Change /usr/share/zoneinfo to /etc/zoneinfo
+Subject: [PATCH 09/19] Change /usr/share/zoneinfo to /etc/zoneinfo
 
 NixOS uses this path.
 ---
@@ -13,7 +13,7 @@ NixOS uses this path.
  5 files changed, 12 insertions(+), 12 deletions(-)
 
 diff --git a/man/localtime.xml b/man/localtime.xml
-index 73c1b8e5a3..4ab4276283 100644
+index e486474c44..5f373d0723 100644
 --- a/man/localtime.xml
 +++ b/man/localtime.xml
 @@ -20,7 +20,7 @@
@@ -79,7 +79,7 @@ index 742b43f9fc..f2cb121816 100644
          (void) mkdir_parents(etc_localtime, 0755);
          if (symlink(e, etc_localtime) < 0)
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index f790853104..74b51f4d28 100644
+index 14f8a82eb8..8632dadec6 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
 @@ -1810,8 +1810,8 @@ static int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t u
@@ -94,7 +94,7 @@ index f790853104..74b51f4d28 100644
  
  static bool etc_writable(void) {
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index a0ee03f134..9ecacad25e 100644
+index e87c4c8919..964a40ba81 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
 @@ -269,7 +269,7 @@ static int context_read_data(Context *c) {
@@ -128,5 +128,5 @@ index a0ee03f134..9ecacad25e 100644
                          return -ENOMEM;
  
 -- 
-2.29.2
+2.30.1
 
diff --git a/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch b/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch
index 1d17bc4cf77..334156495fc 100644
--- a/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch
+++ b/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch
@@ -1,7 +1,7 @@
-From aff592e0bf9a911e7f44ce07b66517c38456b627 Mon Sep 17 00:00:00 2001
+From bf285fe7e12bd22f95c14bcefbb5008888c32bfa Mon Sep 17 00:00:00 2001
 From: Imuli <i@imu.li>
 Date: Wed, 19 Oct 2016 08:46:47 -0400
-Subject: [PATCH 10/18] localectl: use /etc/X11/xkb for list-x11-*
+Subject: [PATCH 10/19] localectl: use /etc/X11/xkb for list-x11-*
 
 NixOS has an option to link the xkb data files to /etc/X11, but not to
 /usr/share/X11.
@@ -23,5 +23,5 @@ index 7d2e887660..91c5139eed 100644
                  return log_error_errno(errno, "Failed to open keyboard mapping list. %m");
  
 -- 
-2.29.2
+2.30.1
 
diff --git a/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch b/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
index 8c185c52a27..902018ee4b9 100644
--- a/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
+++ b/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
@@ -1,17 +1,17 @@
-From d410a7a6d1bb0fe730c3ef690676232bfaa49f85 Mon Sep 17 00:00:00 2001
+From 293b19c5fdbda1b4ee579a7e8ba12f024a6f34c9 Mon Sep 17 00:00:00 2001
 From: Franz Pletz <fpletz@fnordicwalking.de>
 Date: Sun, 11 Feb 2018 04:37:44 +0100
-Subject: [PATCH 11/18] build: don't create statedir and don't touch prefixdir
+Subject: [PATCH 11/19] build: don't create statedir and don't touch prefixdir
 
 ---
  meson.build | 3 ---
  1 file changed, 3 deletions(-)
 
 diff --git a/meson.build b/meson.build
-index f406d595e6..f05f579816 100644
+index 580964c3fa..f99d4f3ab5 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -3517,9 +3517,6 @@ install_data('LICENSE.GPL2',
+@@ -3518,9 +3518,6 @@ install_data('LICENSE.GPL2',
               'src/libsystemd/sd-bus/GVARIANT-SERIALIZATION',
               install_dir : docdir)
  
@@ -22,5 +22,5 @@ index f406d595e6..f05f579816 100644
  
  check_help = find_program('tools/check-help.sh')
 -- 
-2.29.2
+2.30.1
 
diff --git a/pkgs/os-specific/linux/systemd/0012-inherit-systemd-environment-when-calling-generators.patch b/pkgs/os-specific/linux/systemd/0012-inherit-systemd-environment-when-calling-generators.patch
index 00d085d8a70..05fce10e856 100644
--- a/pkgs/os-specific/linux/systemd/0012-inherit-systemd-environment-when-calling-generators.patch
+++ b/pkgs/os-specific/linux/systemd/0012-inherit-systemd-environment-when-calling-generators.patch
@@ -1,7 +1,7 @@
-From a569dc0bdb43edb79e338c897f06de2dfa81cfc7 Mon Sep 17 00:00:00 2001
+From 63777e7f690b67952bf4571f8e09e5d8e769d3c0 Mon Sep 17 00:00:00 2001
 From: Andreas Rammhold <andreas@rammhold.de>
 Date: Fri, 2 Nov 2018 21:15:42 +0100
-Subject: [PATCH 12/18] inherit systemd environment when calling generators.
+Subject: [PATCH 12/19] inherit systemd environment when calling generators.
 
 Systemd generators need access to the environment configured in
 stage-2-init.sh since it schedules fsck and mkfs executions based on
@@ -16,10 +16,10 @@ executables that are being called from managers.
  1 file changed, 8 insertions(+), 3 deletions(-)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 1f1450b97c..26b9e41d78 100644
+index 6858950107..07a599ede7 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -4111,9 +4111,14 @@ static int manager_run_generators(Manager *m) {
+@@ -4142,9 +4142,14 @@ static int manager_run_generators(Manager *m) {
          argv[4] = NULL;
  
          RUN_WITH_UMASK(0022)
@@ -38,5 +38,5 @@ index 1f1450b97c..26b9e41d78 100644
  
  finish:
 -- 
-2.29.2
+2.30.1
 
diff --git a/pkgs/os-specific/linux/systemd/0013-add-rootprefix-to-lookup-dir-paths.patch b/pkgs/os-specific/linux/systemd/0013-add-rootprefix-to-lookup-dir-paths.patch
index 51fc4cc30d7..b9bab2d387e 100644
--- a/pkgs/os-specific/linux/systemd/0013-add-rootprefix-to-lookup-dir-paths.patch
+++ b/pkgs/os-specific/linux/systemd/0013-add-rootprefix-to-lookup-dir-paths.patch
@@ -1,7 +1,7 @@
-From d36d688e32b8f2368499af091c67a7825fadf5ad Mon Sep 17 00:00:00 2001
+From 561dc3b864d96753b5dc448e6e1a80460d5f0bc4 Mon Sep 17 00:00:00 2001
 From: Andreas Rammhold <andreas@rammhold.de>
 Date: Thu, 9 May 2019 11:15:22 +0200
-Subject: [PATCH 13/18] add rootprefix to lookup dir paths
+Subject: [PATCH 13/19] add rootprefix to lookup dir paths
 
 systemd does not longer use the UDEVLIBEXEC directory as root for
 discovery default udev rules. By adding `$out/lib` to the lookup paths
@@ -34,5 +34,5 @@ index 2e60abb4f1..732ec51d36 100644
  #define CONF_PATHS(n)                           \
          CONF_PATHS_USR(n)                       \
 -- 
-2.29.2
+2.30.1
 
diff --git a/pkgs/os-specific/linux/systemd/0014-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch b/pkgs/os-specific/linux/systemd/0014-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
index 57499d1feec..c737b61e749 100644
--- a/pkgs/os-specific/linux/systemd/0014-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+++ b/pkgs/os-specific/linux/systemd/0014-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
@@ -1,7 +1,7 @@
-From c02b7eb62e46145ec5b544ebd9338c29b9b8f32c Mon Sep 17 00:00:00 2001
+From 8f619304804b02f4e9d7a340ca90359f96adc6e8 Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <ab@fmap.me>
 Date: Thu, 25 Jul 2019 20:45:55 +0300
-Subject: [PATCH 14/18] systemd-shutdown: execute scripts in
+Subject: [PATCH 14/19] systemd-shutdown: execute scripts in
  /etc/systemd/system-shutdown
 
 This is needed for NixOS to use such scripts as systemd directory is immutable.
@@ -23,5 +23,5 @@ index 0d07865542..26d974ef73 100644
          /* The log target defaults to console, but the original systemd process will pass its log target in through a
           * command line argument, which will override this default. Also, ensure we'll never log to the journal or
 -- 
-2.29.2
+2.30.1
 
diff --git a/pkgs/os-specific/linux/systemd/0015-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch b/pkgs/os-specific/linux/systemd/0015-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
index fa72b66911a..3059216f7c5 100644
--- a/pkgs/os-specific/linux/systemd/0015-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+++ b/pkgs/os-specific/linux/systemd/0015-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
@@ -1,7 +1,7 @@
-From f01b73709d68d4581ad561fbb20c59f895132a99 Mon Sep 17 00:00:00 2001
+From 577b11afe38fc185d785ca8f125f518a4eb21a00 Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <ab@fmap.me>
 Date: Thu, 25 Jul 2019 20:46:58 +0300
-Subject: [PATCH 15/18] systemd-sleep: execute scripts in
+Subject: [PATCH 15/19] systemd-sleep: execute scripts in
  /etc/systemd/system-sleep
 
 This is needed for NixOS to use such scripts as systemd directory is immutable.
@@ -22,5 +22,5 @@ index 39ab554290..880ac7ccb0 100644
          };
  
 -- 
-2.29.2
+2.30.1
 
diff --git a/pkgs/os-specific/linux/systemd/0016-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch b/pkgs/os-specific/linux/systemd/0016-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch
index 887864baec3..ad19d910e1e 100644
--- a/pkgs/os-specific/linux/systemd/0016-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch
+++ b/pkgs/os-specific/linux/systemd/0016-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch
@@ -1,7 +1,7 @@
-From 3db343c08a09a0009da049f37e3f981519eac62f Mon Sep 17 00:00:00 2001
+From ba19f629c1806ca2d2ab58154e45bce4ae4a3f0c Mon Sep 17 00:00:00 2001
 From: Florian Klink <flokli@flokli.de>
 Date: Sat, 7 Mar 2020 22:40:27 +0100
-Subject: [PATCH 16/18] kmod-static-nodes.service: Update ConditionFileNotEmpty
+Subject: [PATCH 16/19] kmod-static-nodes.service: Update ConditionFileNotEmpty
 
 On NixOS, kernel modules of the currently booted systems are located at
 /run/booted-system/kernel-modules/lib/modules/%v/, not /lib/modules/%v/.
@@ -23,5 +23,5 @@ index f4170d6a99..9a6a591bea 100644
  [Service]
  Type=oneshot
 -- 
-2.29.2
+2.30.1
 
diff --git a/pkgs/os-specific/linux/systemd/0017-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch b/pkgs/os-specific/linux/systemd/0017-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
index ad92291c258..585a0aa112e 100644
--- a/pkgs/os-specific/linux/systemd/0017-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+++ b/pkgs/os-specific/linux/systemd/0017-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
@@ -1,7 +1,7 @@
-From 6f0e9a60dcd2160bcab01366bd521630f6f5dc76 Mon Sep 17 00:00:00 2001
+From c639f311bd27c2bff62a22c34bc92613aaf77587 Mon Sep 17 00:00:00 2001
 From: Florian Klink <flokli@flokli.de>
 Date: Sun, 8 Mar 2020 01:05:54 +0100
-Subject: [PATCH 17/18] path-util.h: add placeholder for DEFAULT_PATH_NORMAL
+Subject: [PATCH 17/19] path-util.h: add placeholder for DEFAULT_PATH_NORMAL
 
 This will be the $PATH used to lookup ExecStart= etc. options, which
 systemd itself uses extensively.
@@ -29,5 +29,5 @@ index d613709f0b..5cced4c115 100644
  #if HAVE_SPLIT_USR
  #  define DEFAULT_PATH DEFAULT_PATH_SPLIT_USR
 -- 
-2.29.2
+2.30.1
 
diff --git a/pkgs/os-specific/linux/systemd/0018-logind-seat-debus-show-CanMultiSession-again.patch b/pkgs/os-specific/linux/systemd/0018-logind-seat-debus-show-CanMultiSession-again.patch
index 52a749a16b6..f634e74e663 100644
--- a/pkgs/os-specific/linux/systemd/0018-logind-seat-debus-show-CanMultiSession-again.patch
+++ b/pkgs/os-specific/linux/systemd/0018-logind-seat-debus-show-CanMultiSession-again.patch
@@ -1,7 +1,7 @@
-From 120b53a3279ba098ee8e5a346b39cb2b7ef4a106 Mon Sep 17 00:00:00 2001
+From ebb37f81c28aaa80acd9187a7d77dcb3cb3828db Mon Sep 17 00:00:00 2001
 From: Thomas Tuegel <ttuegel@mailbox.org>
 Date: Mon, 26 Oct 2020 21:21:38 +0100
-Subject: [PATCH 18/18] logind-seat-debus: show CanMultiSession again
+Subject: [PATCH 18/19] logind-seat-debus: show CanMultiSession again
 
 Fixes the "switch user" function in Plasma < 5.20.
 ---
@@ -22,5 +22,5 @@ index a60ed2d3c2..69b6271075 100644
          SD_BUS_PROPERTY("CanGraphical", "b", property_get_can_graphical, 0, SD_BUS_VTABLE_PROPERTY_EMITS_CHANGE),
          SD_BUS_PROPERTY("Sessions", "a(so)", property_get_sessions, 0, 0),
 -- 
-2.29.2
+2.30.1
 
diff --git a/pkgs/os-specific/linux/systemd/0019-Revert-pkg-config-prefix-is-not-really-configurable-.patch b/pkgs/os-specific/linux/systemd/0019-Revert-pkg-config-prefix-is-not-really-configurable-.patch
deleted file mode 100644
index 11e61959328..00000000000
--- a/pkgs/os-specific/linux/systemd/0019-Revert-pkg-config-prefix-is-not-really-configurable-.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-From cd5b1075499b8498d9c700a317ad11a3199c447a Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
-Date: Sun, 6 Dec 2020 08:34:19 +0100
-Subject: [PATCH 19/19] Revert "pkg-config: prefix is not really configurable,
- don't pretend it was"
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This reverts commit 6e65df89c348242dbd10036abc7dd5e8181cf733.
-
-Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
----
- src/core/systemd.pc.in | 12 ++++++------
- 1 file changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
-index ccb382e421..8a35e53a4a 100644
---- a/src/core/systemd.pc.in
-+++ b/src/core/systemd.pc.in
-@@ -11,7 +11,7 @@
- # considered deprecated (though there is no plan to remove them). New names
- # shall have underscores.
- 
--prefix=/usr
-+prefix=@prefix@
- root_prefix=@rootprefix_noslash@
- rootprefix=${root_prefix}
- sysconf_dir=@sysconfdir@
-@@ -26,10 +26,10 @@ systemdsystemunitdir=${systemd_system_unit_dir}
- systemd_system_preset_dir=${rootprefix}/lib/systemd/system-preset
- systemdsystempresetdir=${systemd_system_preset_dir}
- 
--systemd_user_unit_dir=/usr/lib/systemd/user
-+systemd_user_unit_dir=${prefix}/lib/systemd/user
- systemduserunitdir=${systemd_user_unit_dir}
- 
--systemd_user_preset_dir=/usr/lib/systemd/user-preset
-+systemd_user_preset_dir=${prefix}/lib/systemd/user-preset
- systemduserpresetdir=${systemd_user_preset_dir}
- 
- systemd_system_conf_dir=${sysconfdir}/systemd/system
-@@ -48,7 +48,7 @@ systemduserunitpath=${systemd_user_unit_path}
- systemd_system_generator_dir=${root_prefix}/lib/systemd/system-generators
- systemdsystemgeneratordir=${systemd_system_generator_dir}
- 
--systemd_user_generator_dir=/usr/lib/systemd/user-generators
-+systemd_user_generator_dir=${prefix}/lib/systemd/user-generators
- systemdusergeneratordir=${systemd_user_generator_dir}
- 
- systemd_system_generator_path=/run/systemd/system-generators:/etc/systemd/system-generators:/usr/local/lib/systemd/system-generators:${systemd_system_generator_dir}
-@@ -63,7 +63,7 @@ systemdsleepdir=${systemd_sleep_dir}
- systemd_shutdown_dir=${root_prefix}/lib/systemd/system-shutdown
- systemdshutdowndir=${systemd_shutdown_dir}
- 
--tmpfiles_dir=/usr/lib/tmpfiles.d
-+tmpfiles_dir=${prefix}/lib/tmpfiles.d
- tmpfilesdir=${tmpfiles_dir}
- 
- sysusers_dir=${rootprefix}/lib/sysusers.d
-@@ -78,7 +78,7 @@ binfmtdir=${binfmt_dir}
- modules_load_dir=${rootprefix}/lib/modules-load.d
- modulesloaddir=${modules_load_dir}
- 
--catalog_dir=/usr/lib/systemd/catalog
-+catalog_dir=${prefix}/lib/systemd/catalog
- catalogdir=${catalog_dir}
- 
- system_uid_max=@SYSTEM_UID_MAX@
--- 
-2.29.2
-
diff --git a/pkgs/os-specific/linux/systemd/0019-pkg-config-derive-prefix-from-prefix.patch b/pkgs/os-specific/linux/systemd/0019-pkg-config-derive-prefix-from-prefix.patch
new file mode 100644
index 00000000000..2d93cdef9a3
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0019-pkg-config-derive-prefix-from-prefix.patch
@@ -0,0 +1,33 @@
+From 5439a516995f9fd57fc91c2cdd016bb18f31aadf Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
+Date: Sun, 6 Dec 2020 08:34:19 +0100
+Subject: [PATCH 19/19] pkg-config: derive prefix from --prefix
+
+Point prefix to the one configured, instead of `/usr` `systemd` has limited
+support for making the pkgconfig prefix overridable, and interpolates those
+values later down.
+
+So we only need to patch this one value to get the correct paths.
+See systemd/systemd@bc4e6e27922a2873985ab9367d79fb099f70b505 for details.
+
+Co-Authored-By: Florian Klink <flokli@flokli.de>
+---
+ src/core/systemd.pc.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
+index a701cd05f8..85d6911bdf 100644
+--- a/src/core/systemd.pc.in
++++ b/src/core/systemd.pc.in
+@@ -11,7 +11,7 @@
+ # considered deprecated (though there is no plan to remove them). New names
+ # shall have underscores.
+ 
+-prefix=/usr
++prefix=@prefix@
+ root_prefix=@rootprefix_noslash@
+ rootprefix=${root_prefix}
+ sysconf_dir=@sysconfdir@
+-- 
+2.30.1
+
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 4f757862897..bd7c646c920 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -113,7 +113,7 @@ assert withCryptsetup ->
 let
   wantCurl = withRemote || withImportd;
 
-  version = "247.3";
+  version = "247.6";
 in
 stdenv.mkDerivation {
   inherit version pname;
@@ -124,12 +124,12 @@ stdenv.mkDerivation {
     owner = "systemd";
     repo = "systemd-stable";
     rev = "v${version}";
-    sha256 = "0zn0b74iwz3vxabqsk4yydwpgky3c5z4dl83wxbs1qi5d2dnbqa7";
+    sha256 = "sha256-7XYEq3Qw25suwjbtPzx9lVPHUu9ZY/1bADXl2wQbkJc=";
   };
 
   # If these need to be regenerated, `git am path/to/00*.patch` them into a
   # systemd worktree, rebase to the more recent systemd version, and export the
-  # patches again via `git format-patch v${version}`.
+  # patches again via `git -c format.signoff=false format-patch v${version}`.
   # Use `find . -name "*.patch" | sort` to get an up-to-date listing of all patches
   patches = [
     ./0001-Start-device-units-for-uninitialised-encrypted-devic.patch
@@ -150,7 +150,7 @@ stdenv.mkDerivation {
     ./0016-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch
     ./0017-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
     ./0018-logind-seat-debus-show-CanMultiSession-again.patch
-    ./0019-Revert-pkg-config-prefix-is-not-really-configurable-.patch
+    ./0019-pkg-config-derive-prefix-from-prefix.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index 0c422970d56..c540fb20d44 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -44,11 +44,11 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "samba";
-  version = "4.13.3";
+  version = "4.13.7";
 
   src = fetchurl {
     url = "mirror://samba/pub/samba/stable/${pname}-${version}.tar.gz";
-    sha256 = "0hb5fli4kgwg376c289mcmdqszd51vs8pzzrw7j6yr9k7za8a1f1";
+    sha256 = "1ajvr5hzl9kmrf77hb9c71zvnm8j0xgy40nqfjz4f407cw470zaf";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 47355a5dcf9..1173fc22370 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -755,11 +755,11 @@ lib.makeScope newScope (self: with self; {
   }) {};
 
   libXaw = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXext, xorgproto, libXmu, libXpm, libXt }: stdenv.mkDerivation {
-    name = "libXaw-1.0.13";
+    name = "libXaw-1.0.14";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXaw-1.0.13.tar.bz2";
-      sha256 = "1kdhxplwrn43d9jp3v54llp05kwx210lrsdvqb6944jp29rhdy4f";
+      url = "mirror://xorg/individual/lib/libXaw-1.0.14.tar.bz2";
+      sha256 = "13kg59r3086383g1dyhnwxanhp2frssh9062mrgn34nzlf7gkbkn";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkg-config ];
@@ -1002,11 +1002,11 @@ lib.makeScope newScope (self: with self; {
   }) {};
 
   libXres = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext }: stdenv.mkDerivation {
-    name = "libXres-1.2.0";
+    name = "libXres-1.2.1";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXres-1.2.0.tar.bz2";
-      sha256 = "1m0jr0lbz9ixpp9ihk68349q0i7ry2379lnfzdy4mrl86ijc2xgz";
+      url = "mirror://xorg/individual/lib/libXres-1.2.1.tar.bz2";
+      sha256 = "049b7dk6hx47161hg47ryjrm6pwsp27r5pby05b0wqb1pcggprmn";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkg-config ];
@@ -2679,11 +2679,11 @@ lib.makeScope newScope (self: with self; {
   }) {};
 
   xorgproto = callPackage ({ stdenv, pkg-config, fetchurl, libXt }: stdenv.mkDerivation {
-    name = "xorgproto-2020.1";
+    name = "xorgproto-2021.3";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/proto/xorgproto-2020.1.tar.bz2";
-      sha256 = "1llrnrkq6iprgiqakmwlv89745s9h02xsiaq0xn3fnh377qm78al";
+      url = "mirror://xorg/individual/proto/xorgproto-2021.3.tar.bz2";
+      sha256 = "0dypp7cvjf0rvwa7cn1zp7djw5ynhs1rwk9p0r1vczbwzha2nwsc";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index dcf68ef097e..61cfd4df180 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -177,7 +177,7 @@ mirror://xorg/individual/lib/libSM-1.2.3.tar.bz2
 mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2
 mirror://xorg/individual/lib/libX11-1.7.0.tar.bz2
 mirror://xorg/individual/lib/libXau-1.0.9.tar.bz2
-mirror://xorg/individual/lib/libXaw-1.0.13.tar.bz2
+mirror://xorg/individual/lib/libXaw-1.0.14.tar.bz2
 mirror://xorg/individual/lib/libXaw3d-1.6.3.tar.bz2
 mirror://xorg/individual/lib/libxcb-1.14.tar.xz
 mirror://xorg/individual/lib/libXcomposite-0.4.5.tar.bz2
@@ -198,7 +198,7 @@ mirror://xorg/individual/lib/libXpm-3.5.13.tar.bz2
 mirror://xorg/individual/lib/libXpresent-1.0.0.tar.bz2
 mirror://xorg/individual/lib/libXrandr-1.5.2.tar.bz2
 mirror://xorg/individual/lib/libXrender-0.9.10.tar.bz2
-mirror://xorg/individual/lib/libXres-1.2.0.tar.bz2
+mirror://xorg/individual/lib/libXres-1.2.1.tar.bz2
 mirror://xorg/individual/lib/libXScrnSaver-1.2.3.tar.bz2
 mirror://xorg/individual/lib/libxshmfence-1.3.tar.bz2
 mirror://xorg/individual/lib/libXTrap-1.0.1.tar.bz2
@@ -211,7 +211,7 @@ mirror://xorg/individual/lib/libXxf86misc-1.0.4.tar.bz2
 mirror://xorg/individual/lib/libXxf86vm-1.1.4.tar.bz2
 mirror://xorg/individual/lib/xtrans-1.4.0.tar.bz2
 mirror://xorg/individual/proto/xcb-proto-1.14.1.tar.xz
-mirror://xorg/individual/proto/xorgproto-2020.1.tar.bz2
+mirror://xorg/individual/proto/xorgproto-2021.3.tar.bz2
 mirror://xorg/individual/util/gccmakedep-1.0.3.tar.bz2
 mirror://xorg/individual/util/imake-1.0.8.tar.bz2
 mirror://xorg/individual/util/lndir-1.0.3.tar.bz2
diff --git a/pkgs/shells/bash/4.4.nix b/pkgs/shells/bash/4.4.nix
index bde942aff0c..b3259466ddb 100644
--- a/pkgs/shells/bash/4.4.nix
+++ b/pkgs/shells/bash/4.4.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
     -DSSH_SOURCE_BASHRC
   '';
 
-  patchFlags = [ "-p0" "-T" ];
+  patchFlags = [ "-p0" ];
 
   patches = upstreamPatches
     ++ [ ./pgrp-pipe-4.4.patch ]
diff --git a/pkgs/shells/bash/pgrp-pipe-4.4.patch b/pkgs/shells/bash/pgrp-pipe-4.4.patch
index ea3d7bdf92b..6cbdcab4b7c 100644
--- a/pkgs/shells/bash/pgrp-pipe-4.4.patch
+++ b/pkgs/shells/bash/pgrp-pipe-4.4.patch
@@ -13,17 +13,3 @@ diff -u ./configure ../bash-4.4-fixed/configure
  *qnx6*)		LOCAL_CFLAGS="-Dqnx -Dqnx6" LOCAL_LIBS="-lncurses" ;;
  *qnx*)		LOCAL_CFLAGS="-Dqnx -F -3s" LOCAL_LDFLAGS="-3s" LOCAL_LIBS="-lunix -lncurses" ;;
  powerux*)	LOCAL_LIBS="-lgen" ;;
-diff -u ./configure.ac ../bash-4.4-fixed/configure.ac
---- ./configure.ac	2016-09-07 22:56:28.000000000 +0200
-+++ ../bash-4.4-fixed/configure.ac	2016-09-07 22:56:28.000000000 +0200
-@@ -1092,9 +1092,7 @@
- solaris2*)	LOCAL_CFLAGS=-DSOLARIS ;;
- lynxos*)	LOCAL_CFLAGS=-DRECYCLES_PIDS ;;
- linux*)		LOCAL_LDFLAGS=-rdynamic		 # allow dynamic loading
--		case "`uname -r`" in
--		2.[[456789]]*|[[34]]*)	AC_DEFINE(PGRP_PIPE) ;;
--		esac ;;
-+		AC_DEFINE(PGRP_PIPE) ;;
- *qnx6*)		LOCAL_CFLAGS="-Dqnx -Dqnx6" LOCAL_LIBS="-lncurses" ;;
- *qnx*)		LOCAL_CFLAGS="-Dqnx -F -3s" LOCAL_LDFLAGS="-3s" LOCAL_LIBS="-lunix -lncurses" ;;
- powerux*)	LOCAL_LIBS="-lgen" ;;
diff --git a/pkgs/tools/backup/dar/default.nix b/pkgs/tools/backup/dar/default.nix
index 709084d5108..172f30695d5 100644
--- a/pkgs/tools/backup/dar/default.nix
+++ b/pkgs/tools/backup/dar/default.nix
@@ -8,12 +8,12 @@
 with lib;
 
 stdenv.mkDerivation rec {
-  version = "2.6.13";
+  version = "2.6.14";
   pname = "dar";
 
   src = fetchurl {
     url = "mirror://sourceforge/dar/${pname}-${version}.tar.gz";
-    sha256 = "15yhpzyzw7h7d74xxh104cnbh19639yxx0502xz85fazwpwrzsiz";
+    sha256 = "sha256-1uzKj+q2klIdANhLzy6TStJzeQndeUvdT0Dzwijad+U=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/tools/backup/store-backup/default.nix b/pkgs/tools/backup/store-backup/default.nix
index 026a3141fed..afa667ec072 100644
--- a/pkgs/tools/backup/store-backup/default.nix
+++ b/pkgs/tools/backup/store-backup/default.nix
@@ -1,4 +1,4 @@
-{lib, stdenv, which, coreutils, perl, fetchurl, perlPackages, makeWrapper, diffutils , writeScriptBin, bzip2}:
+{lib, stdenv, which, coreutils, perl, fetchurl, makeWrapper, diffutils , writeScriptBin, bzip2}:
 
 # quick usage:
 # storeBackup.pl --sourceDir /home/user --backupDir /tmp/my_backup_destination
@@ -37,12 +37,10 @@ stdenv.mkDerivation rec {
     find $out -name "*.pl" | xargs sed -i \
       -e 's@/bin/pwd@${coreutils}/bin/pwd@' \
       -e 's@/bin/sync@${coreutils}/bin/sync@' \
-      -e '1 s@/usr/bin/env perl@${perl}/bin/perl@'
+      -e '1 s@/usr/bin/env perl@${perl.withPackages (p: [ p.DBFile ])}/bin/perl@'
 
     for p in $out/bin/*
-      do wrapProgram "$p" \
-      --prefix PERL5LIB ":" "${perlPackages.DBFile}/${perlPackages.perl.libPrefix}" \
-      --prefix PATH ":" "${lib.makeBinPath [ which bzip2 ]}"
+      do wrapProgram "$p" --prefix PATH ":" "${lib.makeBinPath [ which bzip2 ]}"
     done
 
     patchShebangs $out
diff --git a/pkgs/tools/backup/znapzend/default.nix b/pkgs/tools/backup/znapzend/default.nix
index 1e4e84b445b..9c3e4fca95d 100644
--- a/pkgs/tools/backup/znapzend/default.nix
+++ b/pkgs/tools/backup/znapzend/default.nix
@@ -21,6 +21,11 @@ let
     propagatedBuildInputs = [ perlPackages.IOPipely Mojolicious-8-35 ];
   };
 
+  perl' = perl.withPackages (p:
+    [ MojoIOLoopForkCall-0-20
+      p.TAPParserSourceHandlerpgTAP
+    ]);
+
   version = "0.20.0";
   checksum = "15lb5qwksa508m9bj6d3n4rrjpakfaas9qxspg408bcqfp7pqjw3";
 in
@@ -35,7 +40,7 @@ stdenv.mkDerivation {
     sha256 = checksum;
   };
 
-  buildInputs = [ wget perl MojoIOLoopForkCall-0-20 perlPackages.TAPParserSourceHandlerpgTAP ];
+  buildInputs = [ wget perl' ];
 
   nativeBuildInputs = [ autoconf automake autoreconfHook ];
 
@@ -53,30 +58,6 @@ stdenv.mkDerivation {
     automake
   '';
 
-  postInstall = ''
-    substituteInPlace $out/bin/znapzend --replace "${perl}/bin/perl" \
-      "${perl}/bin/perl \
-      -I${Mojolicious-8-35}/${perl.libPrefix} \
-      -I${perlPackages.TAPParserSourceHandlerpgTAP}/${perl.libPrefix} \
-      -I${MojoIOLoopForkCall-0-20}/${perl.libPrefix} \
-      -I${perlPackages.IOPipely}/${perl.libPrefix} \
-      "
-    substituteInPlace $out/bin/znapzendzetup --replace "${perl}/bin/perl" \
-      "${perl}/bin/perl \
-      -I${Mojolicious-8-35}/${perl.libPrefix} \
-      -I${perlPackages.TAPParserSourceHandlerpgTAP}/${perl.libPrefix} \
-      -I${MojoIOLoopForkCall-0-20}/${perl.libPrefix} \
-      -I${perlPackages.IOPipely}/${perl.libPrefix} \
-      "
-    substituteInPlace $out/bin/znapzendztatz --replace "${perl}/bin/perl" \
-      "${perl}/bin/perl \
-      -I${Mojolicious-8-35}/${perl.libPrefix} \
-      -I${perlPackages.TAPParserSourceHandlerpgTAP}/${perl.libPrefix} \
-      -I${MojoIOLoopForkCall-0-20}/${perl.libPrefix} \
-      -I${perlPackages.IOPipely}/${perl.libPrefix} \
-      "
-  '';
-
   meta = with lib; {
     description = "High performance open source ZFS backup with mbuffer and ssh support";
     homepage    = "http://www.znapzend.org";
diff --git a/pkgs/tools/filesystems/e2fsprogs/default.nix b/pkgs/tools/filesystems/e2fsprogs/default.nix
index 154b0006663..327ddbf8d6d 100644
--- a/pkgs/tools/filesystems/e2fsprogs/default.nix
+++ b/pkgs/tools/filesystems/e2fsprogs/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "e2fsprogs";
-  version = "1.45.6";
+  version = "1.46.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-X2SsUKK2C45nxbOCuxN97Dk0QBcQPK/8OmFVRCTy1pM=";
+    sha256 = "sha256-958mtPZb3AWfyhLh7GowQMPOGlA/tw65Fb7nGQOBXNU=";
   };
 
   outputs = [ "bin" "dev" "out" "man" "info" ];
@@ -68,10 +68,13 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "http://e2fsprogs.sourceforge.net/";
     description = "Tools for creating and checking ext2/ext3/ext4 filesystems";
-    license = licenses.gpl2;
+    license = with licenses; [
+      gpl2Plus
+      lgpl2Plus # lib/ext2fs, lib/e2p
+      bsd3      # lib/uuid
+      mit       # lib/et, lib/ss
+    ];
     platforms = platforms.unix;
     maintainers = [ maintainers.eelco ];
-    # imager.c:70:2: error: unknown type name 'loff_t'; did you mean 'off_t'?
-    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/tools/filesystems/file-rename/default.nix b/pkgs/tools/filesystems/file-rename/default.nix
index 6ddf5d78863..133f446f8a9 100644
--- a/pkgs/tools/filesystems/file-rename/default.nix
+++ b/pkgs/tools/filesystems/file-rename/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, perlPackages, makeWrapper }:
+{ lib, stdenv, fetchurl, perl, perlPackages }:
 
 perlPackages.buildPerlPackage {
   pname = "File-Rename";
@@ -9,17 +9,15 @@ perlPackages.buildPerlPackage {
     sha256 = "1cf6xx2hiy1xalp35fh8g73j67r0w0g66jpcbc6971x9jbm7bvjy";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
-
   # Fix an incorrect platform test that misidentifies Darwin as Windows
   postPatch = ''
     substituteInPlace Makefile.PL \
       --replace '/win/i' '/MSWin32/'
   '';
 
-  postInstall = ''
-    wrapProgram $out/bin/rename \
-      --prefix PERL5LIB : $out/${perlPackages.perl.libPrefix}
+  postFixup = ''
+    substituteInPlace $out/bin/rename \
+      --replace "#!${perl}/bin/perl" "#!${perl}/bin/perl -I $out/${perl.libPrefix}"
   '';
 
   doCheck = !stdenv.isDarwin;
diff --git a/pkgs/tools/filesystems/ntfs-3g/default.nix b/pkgs/tools/filesystems/ntfs-3g/default.nix
index 7039584ea90..89ef27827a1 100644
--- a/pkgs/tools/filesystems/ntfs-3g/default.nix
+++ b/pkgs/tools/filesystems/ntfs-3g/default.nix
@@ -1,5 +1,7 @@
-{lib, stdenv, fetchurl, util-linux, libuuid
-, crypto ? false, libgcrypt, gnutls, pkg-config}:
+{ lib, stdenv, fetchurl, pkg-config, mount, libuuid
+, macfuse-stubs, DiskArbitration
+, crypto ? false, libgcrypt, gnutls
+}:
 
 stdenv.mkDerivation rec {
   pname = "ntfs3g";
@@ -7,8 +9,9 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" "man" "doc" ];
 
-  buildInputs = [ libuuid ] ++ lib.optionals crypto [ gnutls libgcrypt ];
-  nativeBuildInputs = lib.optional crypto pkg-config;
+  buildInputs = [ libuuid ] ++ lib.optionals crypto [ gnutls libgcrypt ]
+    ++ lib.optionals stdenv.isDarwin [ macfuse-stubs DiskArbitration ];
+  nativeBuildInputs = [ pkg-config ];
 
   src = fetchurl {
     url = "https://tuxera.com/opensource/ntfs-3g_ntfsprogs-${version}.tgz";
@@ -19,8 +22,8 @@ stdenv.mkDerivation rec {
     substituteInPlace src/Makefile.in --replace /sbin '@sbindir@'
     substituteInPlace ntfsprogs/Makefile.in --replace /sbin '@sbindir@'
     substituteInPlace libfuse-lite/mount_util.c \
-      --replace /bin/mount ${util-linux}/bin/mount \
-      --replace /bin/umount ${util-linux}/bin/umount
+      --replace /bin/mount ${mount}/bin/mount \
+      --replace /bin/umount ${mount}/bin/umount
   '';
 
   configureFlags = [
@@ -43,7 +46,10 @@ stdenv.mkDerivation rec {
     homepage = "https://www.tuxera.com/community/open-source-ntfs-3g/";
     description = "FUSE-based NTFS driver with full write support";
     maintainers = with maintainers; [ dezgeg ];
-    platforms = platforms.linux;
-    license = licenses.gpl2Plus; # and (lib)fuse-lite under LGPL2+
+    platforms = with platforms; darwin ++ linux;
+    license = with licenses; [
+      gpl2Plus # ntfs-3g itself
+      lgpl2Plus # fuse-lite
+    ];
   };
 }
diff --git a/pkgs/tools/misc/hdf5/1.10.nix b/pkgs/tools/misc/hdf5/1.10.nix
new file mode 100644
index 00000000000..1a972daf610
--- /dev/null
+++ b/pkgs/tools/misc/hdf5/1.10.nix
@@ -0,0 +1,50 @@
+{ lib, stdenv
+, fetchurl
+, removeReferencesTo
+, zlib ? null
+, enableShared ? !stdenv.hostPlatform.isStatic
+}:
+
+let inherit (lib) optional optionals; in
+
+stdenv.mkDerivation rec {
+  version = "1.10.7";
+  pname = "hdf5";
+  src = fetchurl {
+    url = "https://support.hdfgroup.org/ftp/HDF5/releases/hdf5-${lib.versions.majorMinor version}/${pname}-${version}/src/${pname}-${version}.tar.bz2";
+    sha256 = "0pm5xxry55i0h7wmvc7svzdaa90rnk7h78rrjmnlkz2ygsn8y082";
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [ removeReferencesTo ];
+
+  propagatedBuildInputs = optional (zlib != null) zlib;
+
+  configureFlags = optional enableShared "--enable-shared";
+
+  patches = [
+    ./bin-mv.patch
+  ];
+
+  postInstall = ''
+    find "$out" -type f -exec remove-references-to -t ${stdenv.cc} '{}' +
+    moveToOutput 'bin/h5cc' "''${!outputDev}"
+    moveToOutput 'bin/h5c++' "''${!outputDev}"
+    moveToOutput 'bin/h5fc' "''${!outputDev}"
+    moveToOutput 'bin/h5pcc' "''${!outputDev}"
+  '';
+
+  meta = {
+    description = "Data model, library, and file format for storing and managing data";
+    longDescription = ''
+      HDF5 supports an unlimited variety of datatypes, and is designed for flexible and efficient
+      I/O and for high volume and complex data. HDF5 is portable and is extensible, allowing
+      applications to evolve in their use of HDF5. The HDF5 Technology suite includes tools and
+      applications for managing, manipulating, viewing, and analyzing data in the HDF5 format.
+    '';
+    license = lib.licenses.bsd3; # Lawrence Berkeley National Labs BSD 3-Clause variant
+    homepage = "https://www.hdfgroup.org/HDF5/";
+    platforms = lib.platforms.unix;
+  };
+}
diff --git a/pkgs/tools/misc/hdf5/default.nix b/pkgs/tools/misc/hdf5/default.nix
index e97a6dbdd18..37ebbe630ca 100644
--- a/pkgs/tools/misc/hdf5/default.nix
+++ b/pkgs/tools/misc/hdf5/default.nix
@@ -10,6 +10,7 @@
 , enableShared ? !stdenv.hostPlatform.isStatic
 , javaSupport ? false
 , jdk
+, usev110Api ? false
 }:
 
 # cpp and mpi options are mutually exclusive
@@ -19,11 +20,11 @@ assert !cpp || !mpiSupport;
 let inherit (lib) optional optionals; in
 
 stdenv.mkDerivation rec {
-  version = "1.10.7";
+  version = "1.12.0";
   pname = "hdf5";
   src = fetchurl {
-    url = "https://support.hdfgroup.org/ftp/HDF5/releases/hdf5-1.10/${pname}-${version}/src/${pname}-${version}.tar.bz2";
-    sha256 = "0pm5xxry55i0h7wmvc7svzdaa90rnk7h78rrjmnlkz2ygsn8y082";
+    url = "https://support.hdfgroup.org/ftp/HDF5/releases/hdf5-${lib.versions.majorMinor version}/${pname}-${version}/src/${pname}-${version}.tar.bz2";
+    sha256 = "0qazfslkqbmzg495jafpvqp0khws3jkxa0z7rph9qvhacil6544p";
   };
 
   passthru = {
@@ -50,7 +51,8 @@ stdenv.mkDerivation rec {
     ++ optional (szip != null) "--with-szlib=${szip}"
     ++ optionals mpiSupport ["--enable-parallel" "CC=${mpi}/bin/mpicc"]
     ++ optional enableShared "--enable-shared"
-    ++ optional javaSupport "--enable-java";
+    ++ optional javaSupport "--enable-java"
+    ++ optional usev110Api "--with-default-api-version=v110";
 
   patches = [
     ./bin-mv.patch
diff --git a/pkgs/tools/misc/lbdb/default.nix b/pkgs/tools/misc/lbdb/default.nix
index fd8b805743a..ea4b2a9cbbc 100644
--- a/pkgs/tools/misc/lbdb/default.nix
+++ b/pkgs/tools/misc/lbdb/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, perl, perlPackages, finger_bsd, makeWrapper
+{ lib, stdenv, fetchurl, fetchpatch, perl, finger_bsd
 , abook ? null
 , gnupg ? null
 , goobook ? null
@@ -8,9 +8,8 @@
 
 let
   version = "0.48.1";
+  perl' = perl.withPackages (p: with p; [ ConvertASN1 perlldap AuthenSASL ]);
 in
-with lib;
-with perlPackages;
 stdenv.mkDerivation {
   pname = "lbdb";
   inherit version;
@@ -19,20 +18,20 @@ stdenv.mkDerivation {
     sha256 = "1gr5l2fr9qbdccga8bhsrpvz6jxigvfkdxrln9wyf2xpps5cdjxh";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ goobook perl ConvertASN1 perlldap AuthenSASL ]
-    ++ optional (!stdenv.isDarwin) finger_bsd
-    ++ optional   (abook != null) abook
-    ++ optional   (gnupg != null) gnupg
-    ++ optional (goobook != null) goobook
-    ++ optional   (khard != null) khard
-    ++ optional      (mu != null) mu;
+  buildInputs = [ goobook perl' ]
+    ++ lib.optional (!stdenv.isDarwin) finger_bsd
+    ++ lib.optional   (abook != null) abook
+    ++ lib.optional   (gnupg != null) gnupg
+    ++ lib.optional (goobook != null) goobook
+    ++ lib.optional   (khard != null) khard
+    ++ lib.optional      (mu != null) mu;
+
   configureFlags = [ ]
-    ++ optional   (abook != null) "--with-abook"
-    ++ optional   (gnupg != null) "--with-gpg"
-    ++ optional (goobook != null) "--with-goobook"
-    ++ optional   (khard != null) "--with-khard"
-    ++ optional      (mu != null) "--with-mu";
+    ++ lib.optional   (abook != null) "--with-abook"
+    ++ lib.optional   (gnupg != null) "--with-gpg"
+    ++ lib.optional (goobook != null) "--with-goobook"
+    ++ lib.optional   (khard != null) "--with-khard"
+    ++ lib.optional      (mu != null) "--with-mu";
 
   patches = [ ./add-methods-to-rc.patch
     # fix undefined exec_prefix. Remove with the next release
@@ -42,12 +41,8 @@ stdenv.mkDerivation {
       excludes = [ "debian/changelog" ];
     })
   ];
-  postFixup = "wrapProgram $out/lib/mutt_ldap_query --prefix PERL5LIB : "
-    + "${AuthenSASL}/${perl.libPrefix}"
-    + ":${ConvertASN1}/${perl.libPrefix}"
-    + ":${perlldap}/${perl.libPrefix}";
 
-  meta = {
+  meta = with lib; {
     homepage = "https://www.spinnaker.de/lbdb/";
     license = licenses.gpl2;
     platforms = platforms.all;
diff --git a/pkgs/tools/misc/rrdtool/default.nix b/pkgs/tools/misc/rrdtool/default.nix
index 225ed2e7824..2f8b9092eea 100644
--- a/pkgs/tools/misc/rrdtool/default.nix
+++ b/pkgs/tools/misc/rrdtool/default.nix
@@ -1,7 +1,7 @@
 { fetchurl, lib, stdenv, gettext, perl, pkg-config, libxml2, pango, cairo, groff
 , tcl-8_5, darwin }:
 
-stdenv.mkDerivation rec {
+perl.pkgs.toPerlModule (stdenv.mkDerivation rec {
   name = "rrdtool-1.7.2";
 
   src = fetchurl {
@@ -27,4 +27,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux ++ platforms.darwin;
     maintainers = with maintainers; [ pSub ];
   };
-}
+})
diff --git a/pkgs/tools/networking/networkmanager/default.nix b/pkgs/tools/networking/networkmanager/default.nix
index ba172a3922d..c2de2ed8adb 100644
--- a/pkgs/tools/networking/networkmanager/default.nix
+++ b/pkgs/tools/networking/networkmanager/default.nix
@@ -10,11 +10,11 @@ let
   pythonForDocs = python3.withPackages (pkgs: with pkgs; [ pygobject3 ]);
 in stdenv.mkDerivation rec {
   pname = "networkmanager";
-  version = "1.30.0";
+  version = "1.30.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/NetworkManager/${lib.versions.majorMinor version}/NetworkManager-${version}.tar.xz";
-    sha256 = "1yf3k3pcszn904lk6rdya1qhp3yxbzsbhcd9l6yfrhlbc8r15w1r";
+    sha256 = "sha256-DI6A53h3hg5KTmq0oPfNwRhuNWtlsEKnUYlxiLiJRNI=";
   };
 
   outputs = [ "out" "dev" "devdoc" "man" "doc" ];
diff --git a/pkgs/tools/networking/tgt/default.nix b/pkgs/tools/networking/tgt/default.nix
index ca40f9a7cb7..ba1f89af433 100644
--- a/pkgs/tools/networking/tgt/default.nix
+++ b/pkgs/tools/networking/tgt/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, libxslt, libaio, systemd, perl, perlPackages
+{ stdenv, lib, fetchFromGitHub, libxslt, libaio, systemd, perl
 , docbook_xsl, coreutils, lsof, rdma-core, makeWrapper, sg3_utils, util-linux
 }:
 
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     substituteInPlace $out/sbin/tgt-admin \
-      --replace "#!/usr/bin/perl" "#! ${perl}/bin/perl -I${perlPackages.ConfigGeneral}/${perl.libPrefix}"
+      --replace "#!/usr/bin/perl" "#! ${perl.withPackages (p: [ p.ConfigGeneral ])}/bin/perl"
     wrapProgram $out/sbin/tgt-admin --prefix PATH : \
       ${lib.makeBinPath [ lsof sg3_utils (placeholder "out") ]}
 
diff --git a/pkgs/tools/package-management/dpkg/default.nix b/pkgs/tools/package-management/dpkg/default.nix
index 459b9550b7c..0026dd37ca4 100644
--- a/pkgs/tools/package-management/dpkg/default.nix
+++ b/pkgs/tools/package-management/dpkg/default.nix
@@ -56,7 +56,8 @@ stdenv.mkDerivation rec {
     ''
       for i in $out/bin/*; do
         if head -n 1 $i | grep -q perl; then
-          wrapProgram $i --prefix PERL5LIB : $out/${perl.libPrefix}
+          substituteInPlace $i --replace \
+            "${perl}/bin/perl" "${perl}/bin/perl -I $out/${perl.libPrefix}"
         fi
       done
 
diff --git a/pkgs/tools/package-management/nix-serve/default.nix b/pkgs/tools/package-management/nix-serve/default.nix
index d468b2d2ade..f85adee4917 100644
--- a/pkgs/tools/package-management/nix-serve/default.nix
+++ b/pkgs/tools/package-management/nix-serve/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub,
-  bzip2, nix, perl, perlPackages,
+  bzip2, nix, perl, makeWrapper,
 }:
 
 with lib;
@@ -18,21 +18,16 @@ stdenv.mkDerivation {
     inherit rev sha256;
   };
 
-  buildInputs = [ bzip2 perl nix nix.perl-bindings ]
-    ++ (with perlPackages; [ DBI DBDSQLite Plack Starman ]);
+  nativeBuildInputs = [ makeWrapper ];
 
   dontBuild = true;
 
   installPhase = ''
-    mkdir -p $out/libexec/nix-serve
-    cp nix-serve.psgi $out/libexec/nix-serve/nix-serve.psgi
-
-    mkdir -p $out/bin
-    cat > $out/bin/nix-serve <<EOF
-    #! ${stdenv.shell}
-    PATH=${makeBinPath [ bzip2 nix ]}:\$PATH PERL5LIB=$PERL5LIB exec ${perlPackages.Starman}/bin/starman $out/libexec/nix-serve/nix-serve.psgi "\$@"
-    EOF
-    chmod +x $out/bin/nix-serve
+    install -Dm0755 nix-serve.psgi $out/libexec/nix-serve/nix-serve.psgi
+
+    makeWrapper ${perl.withPackages(p: [ p.DBDSQLite p.Plack p.Starman nix.perl-bindings ])}/bin/starman $out/bin/nix-serve \
+                --prefix PATH : "${makeBinPath [ bzip2 nix ]}" \
+                --add-flags $out/libexec/nix-serve/nix-serve.psgi
   '';
 
   meta = {
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index c54a5b28cee..2358f6e3350 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -11,7 +11,7 @@ let
 common =
   { lib, stdenv, perl, curl, bzip2, sqlite, openssl ? null, xz
   , bash, coreutils, util-linuxMinimal, gzip, gnutar
-  , pkg-config, boehmgc, perlPackages, libsodium, brotli, boost, editline, nlohmann_json
+  , pkg-config, boehmgc, libsodium, brotli, boost, editline, nlohmann_json
   , autoreconfHook, autoconf-archive, bison, flex
   , jq, libarchive, libcpuid
   , lowdown, mdbook
@@ -165,7 +165,7 @@ common =
       };
 
       passthru = {
-        perl-bindings = stdenv.mkDerivation {
+        perl-bindings = perl.pkgs.toPerlModule (stdenv.mkDerivation {
           pname = "nix-perl";
           inherit version;
 
@@ -179,14 +179,14 @@ common =
             [ perl pkg-config curl nix libsodium boost autoreconfHook autoconf-archive nlohmann_json ];
 
           configureFlags =
-            [ "--with-dbi=${perlPackages.DBI}/${perl.libPrefix}"
-              "--with-dbd-sqlite=${perlPackages.DBDSQLite}/${perl.libPrefix}"
+            [ "--with-dbi=${perl.pkgs.DBI}/${perl.libPrefix}"
+              "--with-dbd-sqlite=${perl.pkgs.DBDSQLite}/${perl.libPrefix}"
             ];
 
           preConfigure = "export NIX_STATE_DIR=$TMPDIR";
 
           preBuild = "unset NIX_INDENT_MAKE";
-        };
+        });
       };
     };
   in nix;
diff --git a/pkgs/tools/virtualization/govc/default.nix b/pkgs/tools/virtualization/govc/default.nix
index bfe11127a92..3727d1ac1da 100644
--- a/pkgs/tools/virtualization/govc/default.nix
+++ b/pkgs/tools/virtualization/govc/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "govc";
-  version = "0.24.0";
+  version = "0.24.1";
 
   goPackagePath = "github.com/vmware/govmomi";
 
@@ -12,7 +12,7 @@ buildGoPackage rec {
     rev = "v${version}";
     owner = "vmware";
     repo = "govmomi";
-    sha256 = "sha256-Urfrkeqbl0+GB2Vr2IfekiilRvGcG0vGO5MGeZcP4C8=";
+    sha256 = "sha256-D2UrYdjstOxx9EAdBtAC44khp8hRf6W3+6kzytUVnOo=";
   };
 
   meta = {
diff --git a/pkgs/tools/virtualization/nixos-container/default.nix b/pkgs/tools/virtualization/nixos-container/default.nix
index badd25b4e24..17065a2aa8b 100644
--- a/pkgs/tools/virtualization/nixos-container/default.nix
+++ b/pkgs/tools/virtualization/nixos-container/default.nix
@@ -1,11 +1,11 @@
-{ substituteAll, perlPackages, shadow, util-linux }:
+{ substituteAll, perl, shadow, util-linux }:
 
 substituteAll {
     name = "nixos-container";
     dir = "bin";
     isExecutable = true;
     src = ./nixos-container.pl;
-    perl = "${perlPackages.perl}/bin/perl -I${perlPackages.FileSlurp}/${perlPackages.perl.libPrefix}";
+    perl = perl.withPackages (p: [ p.FileSlurp ]);
     su = "${shadow.su}/bin/su";
     utillinux = util-linux;
 
diff --git a/pkgs/tools/virtualization/nixos-container/nixos-container.pl b/pkgs/tools/virtualization/nixos-container/nixos-container.pl
index b399b3d6917..d99b4cfba4a 100755
--- a/pkgs/tools/virtualization/nixos-container/nixos-container.pl
+++ b/pkgs/tools/virtualization/nixos-container/nixos-container.pl
@@ -1,4 +1,4 @@
-#! @perl@
+#! @perl@/bin/perl
 
 use strict;
 use POSIX;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 979c6d22d1b..90e490ebefa 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5340,6 +5340,8 @@ in
     szip = null;
   };
 
+  hdf5_1_10 = callPackage ../tools/misc/hdf5/1.10.nix { };
+
   hdf5-mpi = appendToName "mpi" (hdf5.override {
     szip = null;
     mpiSupport = true;
@@ -6934,7 +6936,9 @@ in
 
   nss_pam_ldapd = callPackage ../tools/networking/nss-pam-ldapd {};
 
-  ntfs3g = callPackage ../tools/filesystems/ntfs-3g { };
+  ntfs3g = callPackage ../tools/filesystems/ntfs-3g {
+    inherit (darwin.apple_sdk.frameworks) DiskArbitration;
+  };
 
   # ntfsprogs are merged into ntfs-3g
   ntfsprogs = pkgs.ntfs3g;
@@ -11177,14 +11181,14 @@ in
   rust_1_45 = callPackage ../development/compilers/rust/1_45.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
   };
-  rust_1_50 = callPackage ../development/compilers/rust/1_50.nix {
+  rust_1_51 = callPackage ../development/compilers/rust/1_51.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
   };
-  rust = rust_1_50;
+  rust = rust_1_51;
 
   rustPackages_1_45 = rust_1_45.packages.stable;
-  rustPackages_1_50 = rust_1_50.packages.stable;
-  rustPackages = rustPackages_1_50;
+  rustPackages_1_51 = rust_1_51.packages.stable;
+  rustPackages = rustPackages_1_51;
 
   inherit (rustPackages) cargo clippy rustc rustPlatform;
 
@@ -14203,7 +14207,9 @@ in
 
   cfitsio = callPackage ../development/libraries/science/astronomy/cfitsio { };
 
-  fontconfig = callPackage ../development/libraries/fontconfig { };
+  fontconfig = callPackage ../development/libraries/fontconfig {
+    inherit (darwin.apple_sdk.frameworks) CoreFoundation;
+  };
 
   folly = callPackage ../development/libraries/folly { };
 
@@ -17667,7 +17673,9 @@ in
     inherit (llvmPackages) openmp;
   };
 
-  vigra = callPackage ../development/libraries/vigra { };
+  vigra = callPackage ../development/libraries/vigra {
+    hdf5 = hdf5.override { usev110Api = true; };
+  };
 
   vlock = callPackage ../misc/screensavers/vlock { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 9010d78e57c..9c5f4a425d1 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -22,7 +22,10 @@ let
 
   namePrefix = python.libPrefix + "-";
 
-  bootstrapped-pip = callPackage ../development/python-modules/bootstrapped-pip { };
+  bootstrapped-pip = if isPy3k then
+    callPackage ../development/python-modules/bootstrapped-pip { }
+  else
+    callPackage ../development/python-modules/bootstrapped-pip/2.nix { };
 
   # Derivations built with `buildPythonPackage` can already be overriden with `override`, `overrideAttrs`, and `overrideDerivation`.
   # This function introduces `overridePythonAttrs` and it overrides the call to `buildPythonPackage`.
@@ -5162,7 +5165,10 @@ in {
 
   pint = callPackage ../development/python-modules/pint { };
 
-  pip = callPackage ../development/python-modules/pip { };
+  pip = if isPy3k then
+    callPackage ../development/python-modules/pip { }
+  else
+    callPackage ../development/python-modules/pip/20.nix { };
 
   pipdate = callPackage ../development/python-modules/pipdate { };
 
@@ -6454,18 +6460,24 @@ in {
 
   pytest_5 = callPackage
     ../development/python-modules/pytest/5.nix {
-      # hypothesis tests require pytest that causes dependency cycle
+      # hypothesis & pygments tests require pytest that causes dependency cycle
       hypothesis = self.hypothesis.override {
         doCheck = false;
       };
+      pygments = self.pygments.override {
+        doCheck = false;
+      };
     };
 
   pytest_6 =
     callPackage ../development/python-modules/pytest {
-      # hypothesis tests require pytest that causes dependency cycle
+      # hypothesis & pygments tests require pytest that causes dependency cycle
       hypothesis = self.hypothesis.override {
         doCheck = false;
       };
+      pygments = self.pygments.override {
+        doCheck = false;
+      };
     };
 
   pytest_6_1 = self.pytest_6.overridePythonAttrs (oldAttrs: rec {
@@ -8159,9 +8171,13 @@ in {
   tableaudocumentapi = callPackage ../development/python-modules/tableaudocumentapi { };
 
   tables = if isPy3k then
-    callPackage ../development/python-modules/tables { }
+    callPackage ../development/python-modules/tables {
+      hdf5 = pkgs.hdf5_1_10;
+    }
   else
-    callPackage ../development/python-modules/tables/3.5.nix { };
+    callPackage ../development/python-modules/tables/3.5.nix {
+      hdf5 = pkgs.hdf5_1_10;
+    };
 
   tablib = callPackage ../development/python-modules/tablib { };