summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--.github/ISSUE_TEMPLATE/bug_report.md19
-rw-r--r--maintainers/maintainer-list.nix6
-rw-r--r--nixos/doc/manual/from_md/release-notes/rl-2111.section.xml71
-rw-r--r--nixos/doc/manual/release-notes/rl-2111.section.md24
-rw-r--r--nixos/modules/config/nsswitch.nix4
-rw-r--r--nixos/modules/hardware/sensor/iio.nix2
-rw-r--r--nixos/modules/programs/udevil.nix3
-rw-r--r--nixos/modules/programs/zsh/zsh.nix26
-rw-r--r--nixos/modules/services/misc/home-assistant.nix1
-rw-r--r--nixos/modules/services/networking/avahi-daemon.nix4
-rw-r--r--nixos/modules/services/networking/pppd.nix26
-rw-r--r--nixos/modules/system/boot/resolved.nix3
-rw-r--r--nixos/modules/system/boot/systemd.nix5
-rw-r--r--pkgs/applications/blockchains/ergo/default.nix4
-rw-r--r--pkgs/applications/misc/buku/default.nix33
-rw-r--r--pkgs/applications/misc/clight/clightd.nix4
-rw-r--r--pkgs/applications/misc/girara/default.nix4
-rw-r--r--pkgs/applications/misc/grip/default.nix4
-rw-r--r--pkgs/applications/misc/octoprint/default.nix18
-rw-r--r--pkgs/applications/misc/udevil/default.nix33
-rw-r--r--pkgs/applications/networking/browsers/chromium/common.nix13
-rw-r--r--pkgs/applications/networking/cluster/helmsman/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/linkerd/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/terraform-providers/providers.json7
-rw-r--r--pkgs/applications/networking/cluster/terragrunt/default.nix6
-rw-r--r--pkgs/applications/networking/instant-messengers/slack/default.nix10
-rw-r--r--pkgs/applications/networking/ipfs/default.nix7
-rw-r--r--pkgs/applications/terminal-emulators/alacritty/default.nix2
-rw-r--r--pkgs/applications/terminal-emulators/foot/default.nix10
-rw-r--r--pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix1
-rw-r--r--pkgs/build-support/nix-gitignore/default.nix5
-rw-r--r--pkgs/data/documentation/anarchism/default.nix2
-rw-r--r--pkgs/data/fonts/comic-neue/default.nix2
-rw-r--r--pkgs/data/fonts/iosevka/bin.nix2
-rw-r--r--pkgs/data/fonts/lobster-two/default.nix80
-rw-r--r--pkgs/data/fonts/meslo-lg/default.nix1
-rw-r--r--pkgs/data/fonts/unifont/default.nix2
-rw-r--r--pkgs/desktops/mate/caja-with-extensions/default.nix2
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-calculator/default.nix4
-rw-r--r--pkgs/development/guile-modules/guile-git/default.nix4
-rw-r--r--pkgs/development/interpreters/cyclone/default.nix6
-rw-r--r--pkgs/development/libraries/cmark/default.nix6
-rw-r--r--pkgs/development/libraries/grpc/default.nix4
-rw-r--r--pkgs/development/libraries/libsidplayfp/default.nix4
-rw-r--r--pkgs/development/libraries/libxlsxwriter/default.nix4
-rw-r--r--pkgs/development/libraries/microsoft_gsl/default.nix48
-rw-r--r--pkgs/development/libraries/qt-5/5.15/default.nix6
-rw-r--r--pkgs/development/libraries/vapoursynth/default.nix4
-rw-r--r--pkgs/development/ocaml-modules/mdx/default.nix10
-rw-r--r--pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix11
-rw-r--r--pkgs/development/ocaml-modules/ocaml-monadic/default.nix9
-rw-r--r--pkgs/development/ocaml-modules/yojson/default.nix46
-rw-r--r--pkgs/development/python-modules/ailment/default.nix4
-rw-r--r--pkgs/development/python-modules/aioesphomeapi/default.nix24
-rw-r--r--pkgs/development/python-modules/aioguardian/default.nix13
-rw-r--r--pkgs/development/python-modules/aiohomekit/default.nix4
-rw-r--r--pkgs/development/python-modules/angr/default.nix4
-rw-r--r--pkgs/development/python-modules/angrop/default.nix4
-rw-r--r--pkgs/development/python-modules/archinfo/default.nix4
-rw-r--r--pkgs/development/python-modules/bellows/default.nix4
-rw-r--r--pkgs/development/python-modules/capturer/default.nix2
-rw-r--r--pkgs/development/python-modules/claripy/default.nix4
-rw-r--r--pkgs/development/python-modules/cle/default.nix4
-rw-r--r--pkgs/development/python-modules/dacite/default.nix32
-rw-r--r--pkgs/development/python-modules/datasette/default.nix4
-rw-r--r--pkgs/development/python-modules/env-canada/default.nix5
-rw-r--r--pkgs/development/python-modules/fastapi/default.nix10
-rw-r--r--pkgs/development/python-modules/fritzprofiles/default.nix36
-rw-r--r--pkgs/development/python-modules/gios/default.nix4
-rw-r--r--pkgs/development/python-modules/grpcio-tools/default.nix4
-rw-r--r--pkgs/development/python-modules/gym/default.nix5
-rw-r--r--pkgs/development/python-modules/hap-python/default.nix6
-rw-r--r--pkgs/development/python-modules/hatasmota/default.nix4
-rw-r--r--pkgs/development/python-modules/jupyterlab_server/default.nix1
-rw-r--r--pkgs/development/python-modules/nettigo-air-monitor/default.nix6
-rw-r--r--pkgs/development/python-modules/plexapi/default.nix4
-rw-r--r--pkgs/development/python-modules/portalocker/default.nix2
-rw-r--r--pkgs/development/python-modules/py17track/default.nix61
-rw-r--r--pkgs/development/python-modules/pydeconz/default.nix4
-rw-r--r--pkgs/development/python-modules/pyeight/default.nix4
-rw-r--r--pkgs/development/python-modules/pyls-flake8/default.nix29
-rw-r--r--pkgs/development/python-modules/pyls-isort/default.nix14
-rw-r--r--pkgs/development/python-modules/pymunk/default.nix36
-rw-r--r--pkgs/development/python-modules/pysma/default.nix4
-rw-r--r--pkgs/development/python-modules/python-lsp-black/default.nix32
-rw-r--r--pkgs/development/python-modules/python-slugify/default.nix51
-rw-r--r--pkgs/development/python-modules/pyvex/default.nix4
-rw-r--r--pkgs/development/python-modules/questionary/default.nix14
-rw-r--r--pkgs/development/python-modules/requests-cache/default.nix4
-rw-r--r--pkgs/development/python-modules/sfepy/default.nix4
-rw-r--r--pkgs/development/python-modules/simplisafe-python/default.nix4
-rw-r--r--pkgs/development/python-modules/skytemple-rust/default.nix3
-rw-r--r--pkgs/development/python-modules/sphinx-copybutton/default.nix33
-rw-r--r--pkgs/development/python-modules/sqlalchemy/default.nix1
-rw-r--r--pkgs/development/python-modules/tesserocr/default.nix4
-rw-r--r--pkgs/development/python-modules/twitterapi/default.nix4
-rw-r--r--pkgs/development/python-modules/vultr/default.nix17
-rw-r--r--pkgs/development/python-modules/wled/default.nix4
-rw-r--r--pkgs/development/python-modules/zeroconf/default.nix34
-rw-r--r--pkgs/development/python-modules/zha-quirks/default.nix4
-rw-r--r--pkgs/development/python-modules/zigpy-znp/default.nix9
-rw-r--r--pkgs/development/python-modules/zigpy/default.nix19
-rw-r--r--pkgs/development/tools/async-profiler/default.nix4
-rw-r--r--pkgs/development/tools/continuous-integration/buildkite-agent/default.nix4
-rw-r--r--pkgs/development/tools/continuous-integration/github-runner/default.nix15
-rw-r--r--pkgs/development/tools/continuous-integration/gitlab-runner/default.nix8
-rw-r--r--pkgs/development/tools/database/sqldeveloper/default.nix2
-rw-r--r--pkgs/development/tools/delve/default.nix4
-rw-r--r--pkgs/development/tools/kubie/default.nix6
-rw-r--r--pkgs/development/tools/misc/go-md2man/default.nix4
-rw-r--r--pkgs/development/tools/misc/terraform-ls/default.nix6
-rw-r--r--pkgs/development/tools/pscale/default.nix6
-rw-r--r--pkgs/development/tools/rgp/default.nix15
-rw-r--r--pkgs/development/tools/rust/cargo-watch/default.nix6
-rw-r--r--pkgs/development/web/flyctl/default.nix4
-rw-r--r--pkgs/games/factorio/versions.json24
-rw-r--r--pkgs/games/simutrans/default.nix18
-rw-r--r--pkgs/games/zandronum/sqlite.nix2
-rw-r--r--pkgs/misc/emulators/punes/default.nix10
-rw-r--r--pkgs/misc/tmux-plugins/default.nix4
-rw-r--r--pkgs/servers/bazarr/default.nix4
-rw-r--r--pkgs/servers/code-server/default.nix1
-rw-r--r--pkgs/servers/home-assistant/0001-tests-ignore-OSErrors-in-hass-fixture.patch27
-rw-r--r--pkgs/servers/home-assistant/component-packages.nix25
-rw-r--r--pkgs/servers/home-assistant/default.nix52
-rw-r--r--pkgs/servers/home-assistant/frontend.nix4
-rwxr-xr-xpkgs/servers/home-assistant/update.sh8
-rw-r--r--pkgs/servers/http/nix-binary-cache/default.nix2
-rw-r--r--pkgs/servers/imgproxy/default.nix4
-rw-r--r--pkgs/servers/jackett/default.nix4
-rw-r--r--pkgs/servers/mail/system-sendmail/default.nix4
-rw-r--r--pkgs/servers/matrix-synapse/default.nix4
-rw-r--r--pkgs/servers/monitoring/grafana-agent/default.nix6
-rw-r--r--pkgs/servers/monitoring/grafana/default.nix10
-rw-r--r--pkgs/servers/monitoring/grafana/plugins/grafana-polystat-panel/default.nix4
-rw-r--r--pkgs/servers/monitoring/prometheus/default.nix42
-rw-r--r--pkgs/servers/monitoring/seyren/default.nix2
-rw-r--r--pkgs/servers/plex/raw.nix1
-rw-r--r--pkgs/servers/serviio/default.nix2
-rw-r--r--pkgs/tools/admin/awscli2/default.nix9
-rw-r--r--pkgs/tools/admin/docker-credential-gcr/default.nix4
-rw-r--r--pkgs/tools/admin/procs/default.nix6
-rw-r--r--pkgs/tools/admin/trivy/default.nix6
-rw-r--r--pkgs/tools/backup/discordchatexporter-cli/default.nix4
-rw-r--r--pkgs/tools/backup/discordchatexporter-cli/deps.nix13
-rw-r--r--pkgs/tools/graphics/pdfread/default.nix51
-rw-r--r--pkgs/tools/misc/diffoscope/default.nix1
-rw-r--r--pkgs/tools/misc/fend/default.nix6
-rw-r--r--pkgs/tools/misc/trillian/default.nix13
-rw-r--r--pkgs/tools/networking/ppp/default.nix71
-rw-r--r--pkgs/tools/networking/ppp/musl-fix-headers.patch137
-rw-r--r--pkgs/tools/networking/ppp/nix-purity.patch34
-rw-r--r--pkgs/tools/security/cewl/Gemfile8
-rw-r--r--pkgs/tools/security/cewl/Gemfile.lock31
-rw-r--r--pkgs/tools/security/cewl/default.nix33
-rw-r--r--pkgs/tools/security/cewl/gemset.nix104
-rw-r--r--pkgs/tools/security/exploitdb/default.nix4
-rw-r--r--pkgs/tools/security/gorilla-bin/default.nix1
-rw-r--r--pkgs/tools/security/open-ecard/default.nix2
-rw-r--r--pkgs/tools/security/ssss/default.nix53
-rw-r--r--pkgs/tools/text/mdcat/default.nix15
-rw-r--r--pkgs/tools/text/ocrmypdf/default.nix5
-rw-r--r--pkgs/top-level/aliases.nix1
-rw-r--r--pkgs/top-level/all-packages.nix10
-rw-r--r--pkgs/top-level/ocaml-packages.nix4
-rw-r--r--pkgs/top-level/python-packages.nix14
166 files changed, 1354 insertions, 849 deletions
diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
index 4d3c8888f3a..fa1140a7e33 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -7,33 +7,38 @@ assignees: ''
 
 ---
 
-**Describe the bug**
+### Describe the bug
 A clear and concise description of what the bug is.
 
-**To Reproduce**
+### Steps To Reproduce
 Steps to reproduce the behavior:
 1. ...
 2. ...
 3. ...
 
-**Expected behavior**
+### Expected behavior
 A clear and concise description of what you expected to happen.
 
-**Screenshots**
+### Screenshots
 If applicable, add screenshots to help explain your problem.
 
-**Additional context**
+### Additional context
 Add any other context about the problem here.
 
-**Notify maintainers**
+### Notify maintainers
 <!--
 Please @ people who are in the `meta.maintainers` list of the offending package or module.
 If in doubt, check `git blame` for whoever last touched something.
 -->
 
-**Metadata**
+### Metadata
 Please run `nix-shell -p nix-info --run "nix-info -m"` and paste the result.
 
+```console
+[user@system:~]$ nix-shell -p nix-info --run "nix-info -m"
+output here
+```
+
 Maintainer information:
 ```yaml
 # a list of nixpkgs attributes affected by the problem
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index e85efc82a4b..f6bc656610f 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -6658,6 +6658,12 @@
     githubId = 1191859;
     name = "Maxim Krivchikov";
   };
+  MayNiklas = {
+    email = "info@niklas-steffen.de";
+    github = "MayNiklas";
+    githubId = 44636701;
+    name = "Niklas Steffen";
+  };
   mazurel = {
     email = "mateusz.mazur@yahoo.com";
     github = "Mazurel";
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
index ae9f97c139b..3695997f717 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@@ -617,6 +617,77 @@
           be removed in 22.05.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The order of NSS (host) modules has been brought in line with
+          upstream recommendations:
+        </para>
+        <itemizedlist spacing="compact">
+          <listitem>
+            <para>
+              The <literal>myhostname</literal> module is placed before
+              the <literal>resolve</literal> (optional) and
+              <literal>dns</literal> entries, but after
+              <literal>file</literal> (to allow overriding via
+              <literal>/etc/hosts</literal> /
+              <literal>networking.extraHosts</literal>, and prevent ISPs
+              with catchall-DNS resolvers from hijacking
+              <literal>.localhost</literal> domains)
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              The <literal>mymachines</literal> module, which provides
+              hostname resolution for local containers (registered with
+              <literal>systemd-machined</literal>) is placed to the
+              front, to make sure its mappings are preferred over other
+              resolvers.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              If systemd-networkd is enabled, the
+              <literal>resolve</literal> module is placed before
+              <literal>files</literal> and
+              <literal>myhostname</literal>, as it provides the same
+              logic internally, with caching.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              The <literal>mdns(_minimal)</literal> module has been
+              updated to the new priorities.
+            </para>
+          </listitem>
+        </itemizedlist>
+        <para>
+          If you use your own NSS host modules, make sure to update your
+          priorities according to these rules:
+        </para>
+        <itemizedlist spacing="compact">
+          <listitem>
+            <para>
+              NSS modules which should be queried before
+              <literal>resolved</literal> DNS resolution should use
+              mkBefore.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              NSS modules which should be queried after
+              <literal>resolved</literal>, <literal>files</literal> and
+              <literal>myhostname</literal>, but before
+              <literal>dns</literal> should use the default priority
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              NSS modules which should come after <literal>dns</literal>
+              should use mkAfter.
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
     </itemizedlist>
   </section>
 </section>
diff --git a/nixos/doc/manual/release-notes/rl-2111.section.md b/nixos/doc/manual/release-notes/rl-2111.section.md
index 172fe9bbcad..cc5b6bf81ee 100644
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@@ -155,3 +155,27 @@ pt-services.clipcat.enable).
 - The wordpress module provides a new interface which allows to use different webservers with the new option [`services.wordpress.webserver`](options.html#opt-services.wordpress.webserver).  Currently `httpd` and `nginx` are supported. The definitions of wordpress sites should now be set in [`services.wordpress.sites`](options.html#opt-services.wordpress.sites).
 
   Sites definitions that use the old interface are automatically migrated in the new option. This backward compatibility will be removed in 22.05.
+
+- The order of NSS (host) modules has been brought in line with upstream
+  recommendations:
+
+  - The `myhostname` module is placed before the `resolve` (optional) and `dns`
+    entries, but after `file` (to allow overriding via `/etc/hosts` /
+    `networking.extraHosts`, and prevent ISPs with catchall-DNS resolvers from
+    hijacking `.localhost` domains)
+  - The `mymachines` module, which provides hostname resolution for local
+    containers (registered with `systemd-machined`) is placed to the front, to
+    make sure its mappings are preferred over other resolvers.
+  - If systemd-networkd is enabled, the `resolve` module is placed before
+    `files` and `myhostname`, as it provides the same logic internally, with
+    caching.
+  - The `mdns(_minimal)` module has been updated to the new priorities.
+
+  If you use your own NSS host modules, make sure to update your priorities
+  according to these rules:
+
+  - NSS modules which should be queried before `resolved` DNS resolution should
+    use mkBefore.
+  - NSS modules which should be queried after `resolved`, `files` and
+    `myhostname`, but before `dns` should use the default priority
+  - NSS modules which should come after `dns` should use mkAfter.
diff --git a/nixos/modules/config/nsswitch.nix b/nixos/modules/config/nsswitch.nix
index d19d35a4890..91a36cef10e 100644
--- a/nixos/modules/config/nsswitch.nix
+++ b/nixos/modules/config/nsswitch.nix
@@ -124,8 +124,8 @@ with lib;
       group = mkBefore [ "files" ];
       shadow = mkBefore [ "files" ];
       hosts = mkMerge [
-        (mkBefore [ "files" ])
-        (mkAfter [ "dns" ])
+        (mkOrder 998 [ "files" ])
+        (mkOrder 1499 [ "dns" ])
       ];
       services = mkBefore [ "files" ];
     };
diff --git a/nixos/modules/hardware/sensor/iio.nix b/nixos/modules/hardware/sensor/iio.nix
index 4c359c3b172..8b3ba87a7d9 100644
--- a/nixos/modules/hardware/sensor/iio.nix
+++ b/nixos/modules/hardware/sensor/iio.nix
@@ -9,7 +9,7 @@ with lib;
     hardware.sensor.iio = {
       enable = mkOption {
         description = ''
-          Enable this option to support IIO sensors.
+          Enable this option to support IIO sensors with iio-sensor-proxy.
 
           IIO sensors are used for orientation and ambient light
           sensors on some mobile devices.
diff --git a/nixos/modules/programs/udevil.nix b/nixos/modules/programs/udevil.nix
index ba5670f9dfe..25975d88ec8 100644
--- a/nixos/modules/programs/udevil.nix
+++ b/nixos/modules/programs/udevil.nix
@@ -10,5 +10,8 @@ in {
 
   config = mkIf cfg.enable {
     security.wrappers.udevil.source = "${lib.getBin pkgs.udevil}/bin/udevil";
+
+    systemd.packages = [ pkgs.udevil ];
+    systemd.services."devmon@".wantedBy = [ "multi-user.target" ];
   };
 }
diff --git a/nixos/modules/programs/zsh/zsh.nix b/nixos/modules/programs/zsh/zsh.nix
index 48638fda28d..6c824a692b7 100644
--- a/nixos/modules/programs/zsh/zsh.nix
+++ b/nixos/modules/programs/zsh/zsh.nix
@@ -53,7 +53,7 @@ in
       };
 
       shellAliases = mkOption {
-        default = {};
+        default = { };
         description = ''
           Set of aliases for zsh shell, which overrides <option>environment.shellAliases</option>.
           See <option>environment.shellAliases</option> for an option format description.
@@ -118,7 +118,9 @@ in
       setOptions = mkOption {
         type = types.listOf types.str;
         default = [
-          "HIST_IGNORE_DUPS" "SHARE_HISTORY" "HIST_FCNTL_LOCK"
+          "HIST_IGNORE_DUPS"
+          "SHARE_HISTORY"
+          "HIST_FCNTL_LOCK"
         ];
         example = [ "EXTENDED_HISTORY" "RM_STAR_WAIT" ];
         description = ''
@@ -278,15 +280,29 @@ in
 
     environment.etc.zinputrc.source = ./zinputrc;
 
-    environment.systemPackages = [ pkgs.zsh ]
-      ++ optional cfg.enableCompletion pkgs.nix-zsh-completions;
+    environment.systemPackages =
+      let
+        completions =
+          if lib.versionAtLeast (lib.getVersion config.nix.package) "2.4pre"
+          then
+            pkgs.nix-zsh-completions.overrideAttrs
+              (_: {
+                postInstall = ''
+                  rm $out/share/zsh/site-functions/_nix
+                '';
+              })
+          else pkgs.nix-zsh-completions;
+      in
+      [ pkgs.zsh ]
+      ++ optional cfg.enableCompletion completions;
 
     environment.pathsToLink = optional cfg.enableCompletion "/share/zsh";
 
     #users.defaultUserShell = mkDefault "/run/current-system/sw/bin/zsh";
 
     environment.shells =
-      [ "/run/current-system/sw/bin/zsh"
+      [
+        "/run/current-system/sw/bin/zsh"
         "${pkgs.zsh}/bin/zsh"
       ];
 
diff --git a/nixos/modules/services/misc/home-assistant.nix b/nixos/modules/services/misc/home-assistant.nix
index d68d7b05c17..dcd825bba43 100644
--- a/nixos/modules/services/misc/home-assistant.nix
+++ b/nixos/modules/services/misc/home-assistant.nix
@@ -313,6 +313,7 @@ in {
           "w800rf32"
           "xbee"
           "zha"
+          "zwave"
         ];
       in {
         ExecStart = "${package}/bin/hass --runner --config '${cfg.configDir}'";
diff --git a/nixos/modules/services/networking/avahi-daemon.nix b/nixos/modules/services/networking/avahi-daemon.nix
index 0b7d5575c11..020a817f259 100644
--- a/nixos/modules/services/networking/avahi-daemon.nix
+++ b/nixos/modules/services/networking/avahi-daemon.nix
@@ -240,8 +240,8 @@ in
 
     system.nssModules = optional cfg.nssmdns pkgs.nssmdns;
     system.nssDatabases.hosts = optionals cfg.nssmdns (mkMerge [
-      (mkOrder 900 [ "mdns_minimal [NOTFOUND=return]" ]) # must be before resolve
-      (mkOrder 1501 [ "mdns" ]) # 1501 to ensure it's after dns
+      (mkBefore [ "mdns_minimal [NOTFOUND=return]" ]) # before resolve
+      (mkAfter [ "mdns" ]) # after dns
     ]);
 
     environment.systemPackages = [ pkgs.avahi ];
diff --git a/nixos/modules/services/networking/pppd.nix b/nixos/modules/services/networking/pppd.nix
index c1cbdb46176..37f44f07ac4 100644
--- a/nixos/modules/services/networking/pppd.nix
+++ b/nixos/modules/services/networking/pppd.nix
@@ -82,13 +82,21 @@ in
           LD_PRELOAD = "${pkgs.libredirect}/lib/libredirect.so";
           NIX_REDIRECTS = "/var/run=/run/pppd";
         };
-        serviceConfig = {
+        serviceConfig = let
+          capabilities = [
+            "CAP_BPF"
+            "CAP_SYS_TTY_CONFIG"
+            "CAP_NET_ADMIN"
+            "CAP_NET_RAW"
+          ];
+        in
+        {
           ExecStart = "${getBin cfg.package}/sbin/pppd call ${peerCfg.name} nodetach nolog";
           Restart = "always";
           RestartSec = 5;
 
-          AmbientCapabilities = "CAP_SYS_TTY_CONFIG CAP_NET_ADMIN CAP_NET_RAW CAP_SYS_ADMIN";
-          CapabilityBoundingSet = "CAP_SYS_TTY_CONFIG CAP_NET_ADMIN CAP_NET_RAW CAP_SYS_ADMIN";
+          AmbientCapabilities = capabilities;
+          CapabilityBoundingSet = capabilities;
           KeyringMode = "private";
           LockPersonality = true;
           MemoryDenyWriteExecute = true;
@@ -103,7 +111,17 @@ in
           ProtectKernelTunables = false;
           ProtectSystem = "strict";
           RemoveIPC = true;
-          RestrictAddressFamilies = "AF_PACKET AF_UNIX AF_PPPOX AF_ATMPVC AF_ATMSVC AF_INET AF_INET6 AF_IPX";
+          RestrictAddressFamilies = [
+            "AF_ATMPVC"
+            "AF_ATMSVC"
+            "AF_INET"
+            "AF_INET6"
+            "AF_IPX"
+            "AF_NETLINK"
+            "AF_PACKET"
+            "AF_PPPOX"
+            "AF_UNIX"
+          ];
           RestrictNamespaces = true;
           RestrictRealtime = true;
           RestrictSUIDSGID = true;
diff --git a/nixos/modules/system/boot/resolved.nix b/nixos/modules/system/boot/resolved.nix
index 84bc9b78076..a6fc07da0ab 100644
--- a/nixos/modules/system/boot/resolved.nix
+++ b/nixos/modules/system/boot/resolved.nix
@@ -140,7 +140,8 @@ in
 
     # add resolve to nss hosts database if enabled and nscd enabled
     # system.nssModules is configured in nixos/modules/system/boot/systemd.nix
-    system.nssDatabases.hosts = optional config.services.nscd.enable "resolve [!UNAVAIL=return]";
+    # added with order 501 to allow modules to go before with mkBefore
+    system.nssDatabases.hosts = (mkOrder 501 ["resolve [!UNAVAIL=return]"]);
 
     systemd.additionalUpstreamSystemUnits = [
       "systemd-resolved.service"
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index abd8ab29cae..58064e5de86 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -925,9 +925,8 @@ in
     system.nssModules = [ systemd.out ];
     system.nssDatabases = {
       hosts = (mkMerge [
-        [ "mymachines" ]
-        (mkOrder 1600 [ "myhostname" ] # 1600 to ensure it's always the last
-      )
+        (mkOrder 400 ["mymachines"]) # 400 to ensure it comes before resolve (which is mkBefore'd)
+        (mkOrder 999 ["myhostname"]) # after files (which is 998), but before regular nss modules
       ]);
       passwd = (mkMerge [
         (mkAfter [ "systemd" ])
diff --git a/pkgs/applications/blockchains/ergo/default.nix b/pkgs/applications/blockchains/ergo/default.nix
index 8b8ff3f48ba..a0e648218f5 100644
--- a/pkgs/applications/blockchains/ergo/default.nix
+++ b/pkgs/applications/blockchains/ergo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ergo";
-  version = "4.0.12";
+  version = "4.0.13";
 
   src = fetchurl {
     url = "https://github.com/ergoplatform/ergo/releases/download/v${version}/ergo-${version}.jar";
-    sha256 = "sha256-cIMaCouzuI7UQ6UY4caGcTzA+Xp7vLdoOwIfGG+ahsU=";
+    sha256 = "sha256-HNpyUD2Tep2XnY3lr5a3ec+NmJtt0VvJx6ujVvSugXo=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/misc/buku/default.nix b/pkgs/applications/misc/buku/default.nix
index c559e239c09..e8b8714ca2a 100644
--- a/pkgs/applications/misc/buku/default.nix
+++ b/pkgs/applications/misc/buku/default.nix
@@ -1,20 +1,41 @@
 { lib, python3, fetchFromGitHub }:
 
-with python3.pkgs; buildPythonApplication rec {
-  version = "4.5";
+let
+  python3' = python3.override {
+    packageOverrides = self: super: {
+      sqlalchemy = super.sqlalchemy.overridePythonAttrs (oldAttrs: rec {
+        version = "1.3.24";
+        src = oldAttrs.src.override {
+          inherit version;
+          sha256 = "ebbb777cbf9312359b897bf81ba00dae0f5cb69fba2a18265dcc18a6f5ef7519";
+        };
+      });
+      sqlalchemy-utils = super.sqlalchemy-utils.overridePythonAttrs (oldAttrs: rec {
+        version = "0.36.6";
+        src = oldAttrs.src.override {
+          inherit version;
+          sha256 = "0srs5w486wp5zydjs70igi5ypgxhm6h73grb85jz03fqpqaanzvs";
+        };
+      });
+    };
+  };
+in
+with python3'.pkgs; buildPythonApplication rec {
+  version = "4.6";
   pname = "buku";
 
   src = fetchFromGitHub {
     owner = "jarun";
     repo = "buku";
     rev = "v${version}";
-    sha256 = "1lcq5fk8d5j2kfhn9m5l2hk46v7nj4vfa22m1psz35c9zpw4px8q";
+    sha256 = "sha256-hr9qiP7SbloigDcs+6KVWu0SOlggMaBr7CCfY8zoJG0=";
   };
 
   checkInputs = [
     pytest-cov
     hypothesis
     pytest
+    pytest-vcr
     pylint
     flake8
     pyyaml
@@ -55,8 +76,8 @@ with python3.pkgs; buildPythonApplication rec {
     # Disables a test which requires internet
     substituteInPlace tests/test_bukuDb.py \
       --replace "@pytest.mark.slowtest" "@unittest.skip('skipping')" \
-      --replace "self.assertEqual(shorturl, 'http://tny.im/yt')" "" \
-      --replace "self.assertEqual(url, 'https://www.google.com')" ""
+      --replace "self.assertEqual(shorturl, \"http://tny.im/yt\")" "" \
+      --replace "self.assertEqual(url, \"https://www.google.com\")" ""
     substituteInPlace setup.py \
       --replace mypy-extensions==0.4.1 mypy-extensions>=0.4.1
   '';
@@ -75,7 +96,7 @@ with python3.pkgs; buildPythonApplication rec {
     homepage = "https://github.com/jarun/Buku";
     license = licenses.gpl3;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ matthiasbeyer infinisil ];
+    maintainers = with maintainers; [ matthiasbeyer infinisil ma27 ];
   };
 }
 
diff --git a/pkgs/applications/misc/clight/clightd.nix b/pkgs/applications/misc/clight/clightd.nix
index 192cddc2e17..7b52145f794 100644
--- a/pkgs/applications/misc/clight/clightd.nix
+++ b/pkgs/applications/misc/clight/clightd.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "clightd";
-  version = "5.3";
+  version = "5.4";
 
   src = fetchFromGitHub {
     owner = "FedeDP";
     repo = "Clightd";
     rev = version;
-    sha256 = "sha256-CuTYCNZ9oiDsm5mUDmjbxkmAl61PEXv3WMrZRzgdZeE=";
+    sha256 = "sha256-ppaxfnZB3+aOzvc/wk1f8D2mFYngQspEOl9XArNMdBE=";
   };
 
   # dbus-1.pc has datadir=/etc
diff --git a/pkgs/applications/misc/girara/default.nix b/pkgs/applications/misc/girara/default.nix
index 6fde2c8fac8..802c1532979 100644
--- a/pkgs/applications/misc/girara/default.nix
+++ b/pkgs/applications/misc/girara/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "girara";
-  version = "0.3.5";
+  version = "0.3.6";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://git.pwmt.org/pwmt/${pname}/-/archive/${version}/${pname}-${version}.tar.gz";
-    sha256 = "1n3i960b458172mc3pkq7m9dn5qxry6fms3c3k06v27cjp5whsyf";
+    sha256 = "sha256-GPECj0CVxKh+gTfAkkvs13tdiy93il97iqbSTxLQSiM=";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config gettext check dbus ];
diff --git a/pkgs/applications/misc/grip/default.nix b/pkgs/applications/misc/grip/default.nix
index a30778762b2..c182db8fdd3 100644
--- a/pkgs/applications/misc/grip/default.nix
+++ b/pkgs/applications/misc/grip/default.nix
@@ -15,11 +15,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "grip-4.2.1";
+  name = "grip-4.2.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/grip/${name}.tar.gz";
-    sha256 = "sha256-3bFJURPbq9rzLsJCppRjSARhcOJxC4eSfw5VxvZgQ3Q=";
+    sha256 = "sha256-nXtGgJeNYM8lyllNi9UdmsnVcHOCXfryWmKGZ9QFTHE=";
   };
 
   nativeBuildInputs = [ pkg-config libtool ];
diff --git a/pkgs/applications/misc/octoprint/default.nix b/pkgs/applications/misc/octoprint/default.nix
index 750043d4a9e..d7393313c15 100644
--- a/pkgs/applications/misc/octoprint/default.nix
+++ b/pkgs/applications/misc/octoprint/default.nix
@@ -50,19 +50,25 @@ let
           }
         )
 
-        # Octoprint needs zeroconf >=0.24 <0.25. While this should be done in
-        # the mkOverride aboves, this package also has broken tests, so we need
-        # a proper override.
+        # Octoprint needs zeroconf >=0.24 <0.25. This can't be done via mkOverride, because in zeroconf 0.32
+        # the super package was migrated to fetchFromGitHub.
         (
           self: super: {
             zeroconf = super.zeroconf.overrideAttrs (oldAttrs: rec {
               version = "0.24.5";
-              src = oldAttrs.src.override {
+              src = super.fetchPypi {
+                inherit (oldAttrs) pname;
                 inherit version;
                 sha256 = "0jpgd0rk91si93857mjrizan5gc42kj1q4fi4160qgk68la88fl9";
               };
-              buildInputs = [ self.nose ];
-              checkPhase = "nosetests";
+              pythonImportsCheck = [
+                "zeroconf"
+              ];
+              buildInputs = with self; [
+                pytestCheckHook
+                nose
+              ];
+              pytestFlagsArray = [ "zeroconf/test.py" ];
             });
           }
         )
diff --git a/pkgs/applications/misc/udevil/default.nix b/pkgs/applications/misc/udevil/default.nix
index e83a5e9a2c7..9d1df5245ed 100644
--- a/pkgs/applications/misc/udevil/default.nix
+++ b/pkgs/applications/misc/udevil/default.nix
@@ -1,12 +1,20 @@
-{ lib, stdenv, fetchurl, intltool, glib, pkg-config, udev, util-linux, acl }:
-stdenv.mkDerivation {
-  name = "udevil-0.4.4";
-  src = fetchurl {
-    url = "https://github.com/IgnorantGuru/udevil/archive/0.4.4.tar.gz";
-    sha256 = "0z1bhaayambrcn7bgnrqk445k50ifabmw8q4i9qj49nnbcvxhbxd";
+{ lib, stdenv, fetchFromGitHub, intltool, glib, pkg-config, udev, util-linux, acl }:
+
+stdenv.mkDerivation rec {
+  pname = "udevil";
+  version = "0.4.4";
+
+  src = fetchFromGitHub {
+    owner = "IgnorantGuru";
+    repo = "udevil";
+    rev = version;
+    sha256 = "0nd44r8rbxifx4x4m24z5aji1c6k1fhw8cmf5s43wd5qys0bcdad";
   };
+
   nativeBuildInputs = [ pkg-config ];
+
   buildInputs = [ intltool glib udev ];
+
   configurePhase = ''
     substituteInPlace src/Makefile.in --replace "-o root -g root" ""
     # do not set setuid bit in nix store
@@ -19,11 +27,18 @@ stdenv.mkDerivation {
       --with-setfacl-prog=${acl.bin}/bin/setfacl \
       --sysconfdir=$prefix/etc
   '';
+
+  postInstall = ''
+    substituteInPlace $out/lib/systemd/system/devmon@.service \
+      --replace /usr/bin/devmon "$out/bin/devmon"
+  '';
+
   patches = [ ./device-info-sys-stat.patch ];
-  meta = {
+
+  meta = with lib; {
     description = "A command line Linux program which mounts and unmounts removable devices without a password, shows device info, and monitors device changes";
     homepage = "https://ignorantguru.github.io/udevil/";
-    platforms = lib.platforms.linux;
-    license = lib.licenses.gpl3;
+    platforms = platforms.linux;
+    license = licenses.gpl3Plus;
   };
 }
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 18565f31a2f..6daafc204eb 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -167,6 +167,19 @@ let
       # Fix the build by adding a missing dependency (s. https://crbug.com/1197837):
       ./patches/fix-missing-atspi2-dependency.patch
       ./patches/closure_compiler-Use-the-Java-binary-from-the-system.patch
+    ] ++ lib.optionals (versionRange "91" "94.0.4583.0") [
+      # Required as dependency for the next patch:
+      (githubPatch {
+        # Reland "Reland "Linux sandbox syscall broker: use struct kernel_stat""
+        commit = "4b438323d68840453b5ef826c3997568e2e0e8c7";
+        sha256 = "1lf6yilx2ffd3r0840ilihp4px35w7jvr19ll56bncqmz4r5fd82";
+      })
+      # To fix the text rendering, see #131074:
+      (githubPatch {
+        # Linux sandbox: fix fstatat() crash
+        commit = "60d5e803ef2a4874d29799b638754152285e0ed9";
+        sha256 = "0apmsqqlfxprmdmi3qzp3kr9jc52mcc4xzps206kwr8kzwv48b70";
+      })
     ] ++ lib.optionals (chromiumVersionAtLeast "93") [
       # We need to revert this patch to build M93 with LLVM 12.
       (githubPatch {
diff --git a/pkgs/applications/networking/cluster/helmsman/default.nix b/pkgs/applications/networking/cluster/helmsman/default.nix
index ed4a201db3a..933f1bfe71b 100644
--- a/pkgs/applications/networking/cluster/helmsman/default.nix
+++ b/pkgs/applications/networking/cluster/helmsman/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "helmsman";
-  version = "3.7.0";
+  version = "3.7.2";
 
   src = fetchFromGitHub {
     owner = "Praqma";
     repo = "helmsman";
     rev = "v${version}";
-    sha256 = "sha256-Xp86tCIM7XVtue/MjQ8/wGs2fHfxSWS3B6MzNMYRqg4=";
+    sha256 = "sha256-wzmn06nUycNaQ4tUEBd4q17M1CVC0+5X13rqF7zaHqU=";
   };
 
-  vendorSha256 = "sha256-icX8mOc8g+DhfAjD1pzneLWTXY17lXyAjdPOWAxkHwI=";
+  vendorSha256 = "sha256-XHgdVFGIzbPPYgv/T4TtvDDbKAe3niev4S5tu/nwSqg=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/networking/cluster/linkerd/default.nix b/pkgs/applications/networking/cluster/linkerd/default.nix
index 9bd9a8e7a18..883d16319b1 100644
--- a/pkgs/applications/networking/cluster/linkerd/default.nix
+++ b/pkgs/applications/networking/cluster/linkerd/default.nix
@@ -64,8 +64,8 @@ in
     };
     edge = generic {
       channel = "edge";
-      version = "21.7.2";
-      sha256 = "sha256-rEO84t6znNb59a9i+SHgT4r0xzja6eMYi9lWmdU24Cc=";
-      vendorSha256 = "sha256-esVy+oIZa/ucvucdNV7MfUGFkIql9T2zl0+eu3hZAt8=";
+      version = "21.7.3";
+      sha256 = "sha256-fEkqZ/4BQVnmOKUrrLmi6DKlMVNeqvW95bxbZX0o7iI=";
+      vendorSha256 = "sha256-NqOmmeEGWvy/LYfSpIdnJZX4lGweCgiL008ed05XIFs=";
     };
   }
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index f7eb378e716..cc46bf16ac7 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -728,9 +728,10 @@
     "owner": "terraform-providers",
     "provider-source-address": "registry.terraform.io/hashicorp/oci",
     "repo": "terraform-provider-oci",
-    "rev": "v3.79.0",
-    "sha256": "11n2v537zniiv5xvhpypqrm09my8zybirvq4ly94hp69v73xj89c",
-    "version": "3.79.0"
+    "rev": "v4.35.0",
+    "sha256": "12acy39cr6pxq8gk483b6i78x463ml9pk10qp9jpz0dr05zcyhqw",
+    "vendorSha256": null,
+    "version": "4.35.0"
   },
   "okta": {
     "owner": "terraform-providers",
diff --git a/pkgs/applications/networking/cluster/terragrunt/default.nix b/pkgs/applications/networking/cluster/terragrunt/default.nix
index 1717d320900..589164e2769 100644
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.31.0";
+  version = "0.31.1";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-JRIwPOExPbwLS7ps4pJpvIRaZ9jZZjVK+POaUHAmiPI=";
+    sha256 = "sha256-vc3DGYb3vp55LRguhg3nG5zH7w1lTFEI2bx7kNffvas=";
   };
 
-  vendorSha256 = "sha256-lck4nabDhFA8N0lo+cIKiJjlg2TGx3qMExbblHQwbvQ=";
+  vendorSha256 = "sha256-lBhLaYn8adgfCXQJBsIVuwnA0vY8+tgeqE+C669AV+A=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/networking/instant-messengers/slack/default.nix b/pkgs/applications/networking/instant-messengers/slack/default.nix
index 39cff6de85d..24282f4be33 100644
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@@ -50,8 +50,12 @@ let
   x86_64-linux-version = "4.17.0";
   x86_64-linux-sha256 = "07ccms58pq27ilkyhcf6cgwb7qrddwil5kgy8yv95ljikqzi5rxi";
 
+  aarch64-darwin-version = "4.17.0";
+  aarch64-darwin-sha256 = "1a5crmnbz8ng3z2pk5zw17dds9d5fyir4rkvv611fn858kq5fv46";
+
   version = {
     x86_64-darwin = x86_64-darwin-version;
+    aarch64-darwin = aarch64-darwin-version;
     x86_64-linux = x86_64-linux-version;
   }.${system} or throwSystem;
 
@@ -64,6 +68,10 @@ let
           url = "${base}/releases/macos/${version}/prod/x64/Slack-${version}-macOS.dmg";
           sha256 = x86_64-darwin-sha256;
         };
+        aarch64-darwin = fetchurl {
+          url = "${base}/releases/macos/${version}/prod/arm64/Slack-${version}-macOS.dmg";
+          sha256 = aarch64-darwin-sha256;
+        };
         x86_64-linux = fetchurl {
           url = "${base}/linux_releases/slack-desktop-${version}-amd64.deb";
           sha256 = x86_64-linux-sha256;
@@ -75,7 +83,7 @@ let
     homepage = "https://slack.com";
     license = licenses.unfree;
     maintainers = with maintainers; [ mmahut ];
-    platforms = [ "x86_64-darwin" "x86_64-linux" ];
+    platforms = [ "x86_64-darwin" "x86_64-linux" "aarch64-darwin"];
   };
 
   linux = stdenv.mkDerivation rec {
diff --git a/pkgs/applications/networking/ipfs/default.nix b/pkgs/applications/networking/ipfs/default.nix
index e96602a54c5..2823b84d473 100644
--- a/pkgs/applications/networking/ipfs/default.nix
+++ b/pkgs/applications/networking/ipfs/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "ipfs";
-  version = "0.9.0";
+  version = "0.9.1";
   rev = "v${version}";
 
   # go-ipfs makes changes to it's source tarball that don't match the git source.
   src = fetchurl {
     url = "https://github.com/ipfs/go-ipfs/releases/download/${rev}/go-ipfs-source.tar.gz";
-    sha256 = "sha256:1fyffnw1d860w7gwm6ijbgrh68297z5bmvww8yqfshm3xgvcs6bf";
+    sha256 = "sha256-RliyIEtNgwzbLVwl6T38VIbhc12CZMBc3LZ6T/llaHc=";
   };
 
   # tarball contains multiple files/directories
@@ -29,10 +29,13 @@ buildGoModule rec {
 
   postInstall = ''
     install --mode=444 -D misc/systemd/ipfs.service $out/etc/systemd/system/ipfs.service
+    install --mode=444 -D misc/systemd/ipfs-hardened.service $out/etc/systemd/system/ipfs-hardened.service
     install --mode=444 -D misc/systemd/ipfs-api.socket $out/etc/systemd/system/ipfs-api.socket
     install --mode=444 -D misc/systemd/ipfs-gateway.socket $out/etc/systemd/system/ipfs-gateway.socket
     substituteInPlace $out/etc/systemd/system/ipfs.service \
       --replace /usr/bin/ipfs $out/bin/ipfs
+    substituteInPlace $out/etc/systemd/system/ipfs-hardened.service \
+      --replace /usr/bin/ipfs $out/bin/ipfs
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/terminal-emulators/alacritty/default.nix b/pkgs/applications/terminal-emulators/alacritty/default.nix
index 60fb743f859..e4c5eb752d7 100644
--- a/pkgs/applications/terminal-emulators/alacritty/default.nix
+++ b/pkgs/applications/terminal-emulators/alacritty/default.nix
@@ -131,7 +131,7 @@ rustPlatform.buildRustPackage rec {
     description = "A cross-platform, GPU-accelerated terminal emulator";
     homepage = "https://github.com/alacritty/alacritty";
     license = licenses.asl20;
-    maintainers = with maintainers; [ Br1ght0ne mic92 cole-h ma27 ];
+    maintainers = with maintainers; [ Br1ght0ne mic92 ma27 ];
     platforms = platforms.unix;
     changelog = "https://github.com/alacritty/alacritty/blob/v${version}/CHANGELOG.md";
   };
diff --git a/pkgs/applications/terminal-emulators/foot/default.nix b/pkgs/applications/terminal-emulators/foot/default.nix
index f069338ae8a..a5740fc45b1 100644
--- a/pkgs/applications/terminal-emulators/foot/default.nix
+++ b/pkgs/applications/terminal-emulators/foot/default.nix
@@ -2,6 +2,7 @@
 , lib
 , fetchzip
 , fetchurl
+, fetchpatch
 , runCommandNoCC
 , fcft
 , freetype
@@ -98,6 +99,15 @@ stdenv.mkDerivation rec {
     sha256 = "1k0alz991cslls4926c5gq02pdq0vfw9jfpprh2a1vb59xgikv7h";
   };
 
+  patches = [
+    # Fixes PGO builds with clang
+    (fetchpatch {
+      url = "https://codeberg.org/dnkl/foot/commit/2acd4b34c57659d86dca76c58e4363de9b0a1f17.patch";
+      sha256 = "13xi9ppaqx2p88cxbh6801ry9ral70ylh40agn6ij7pklybs4d7s";
+      includes = [ "pgo/pgo.c" ];
+    })
+  ];
+
   depsBuildBuild = [
     pkg-config
   ];
diff --git a/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix b/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
index 868686bd5c0..23718bf636c 100644
--- a/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
+++ b/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
@@ -62,6 +62,7 @@ let
       # Fonts
       "fonts"
       # ALSA
+      "alsa"
       "asound.conf"
       # SSL
       "ssl/certs"
diff --git a/pkgs/build-support/nix-gitignore/default.nix b/pkgs/build-support/nix-gitignore/default.nix
index 5d7b945bf1b..497dcb0660b 100644
--- a/pkgs/build-support/nix-gitignore/default.nix
+++ b/pkgs/build-support/nix-gitignore/default.nix
@@ -41,6 +41,9 @@ in rec {
         let split = match "^(!?)(.*)" l;
         in [(elemAt split 1) (head split == "!")];
 
+      # regex -> regex
+      handleHashesBangs = replaceStrings ["\\#" "\\!"] ["#" "!"];
+
       # ignore -> regex
       substWildcards =
         let
@@ -86,7 +89,7 @@ in rec {
       mapPat = f: l: [(f (head l)) (last l)];
     in
       map (l: # `l' for "line"
-        mapPat (l: handleSlashSuffix (handleSlashPrefix (mapAroundCharclass substWildcards l)))
+        mapPat (l: handleSlashSuffix (handleSlashPrefix (handleHashesBangs (mapAroundCharclass substWildcards l))))
         (computeNegation l))
       (filter (l: !isList l && !isComment l)
       (split "\n" gitignore));
diff --git a/pkgs/data/documentation/anarchism/default.nix b/pkgs/data/documentation/anarchism/default.nix
index d0cda3da544..b9cedffa194 100644
--- a/pkgs/data/documentation/anarchism/default.nix
+++ b/pkgs/data/documentation/anarchism/default.nix
@@ -12,8 +12,6 @@ stdenv.mkDerivation rec {
     sha256 = "04ylk0y5b3jml2awmyz7m1hnymni8y1n83m0k6ychdh0px8frhm5";
   };
 
-  phases = [ "unpackPhase" "postPatch" "installPhase" ];
-
   postPatch = ''
     substituteInPlace debian/anarchism.desktop \
       --replace "/usr/bin/xdg-open" "${xdg-utils}/bin/xdg-open"
diff --git a/pkgs/data/fonts/comic-neue/default.nix b/pkgs/data/fonts/comic-neue/default.nix
index df618aea811..7485d435cb2 100644
--- a/pkgs/data/fonts/comic-neue/default.nix
+++ b/pkgs/data/fonts/comic-neue/default.nix
@@ -10,8 +10,6 @@ stdenv.mkDerivation rec {
     stripRoot = false; # because it comes with a __MACOSX directory
   };
 
-  phases = [ "unpackPhase" "installPhase" ];
-
   installPhase = ''
     mkdir -pv $out/share/{doc/${pname}-${version},fonts/{opentype,truetype,WOFF,WOFF2}}
     cp -v ${pname}-${version}/{FONTLOG,OFL-FAQ,OFL}.txt $out/share/doc/
diff --git a/pkgs/data/fonts/iosevka/bin.nix b/pkgs/data/fonts/iosevka/bin.nix
index b399741f933..27577047eca 100644
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@@ -22,7 +22,7 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ unzip ];
 
-  phases = [ "unpackPhase" ];
+  dontInstall = true;
 
   unpackPhase = ''
     mkdir -p $out/share/fonts
diff --git a/pkgs/data/fonts/lobster-two/default.nix b/pkgs/data/fonts/lobster-two/default.nix
deleted file mode 100644
index fb1595fe2fc..00000000000
--- a/pkgs/data/fonts/lobster-two/default.nix
+++ /dev/null
@@ -1,80 +0,0 @@
-{lib, stdenv, fetchurl}:
-
-let
-
-  # HG revision in which this version of the font can be fount.
-  rev = "8e98053718f9a15184c93d6530885791be71b756";
-
-  urlBase = "https://googlefontdirectory.googlecode.com/hg-history/${rev}/ofl/lobstertwo";
-
-  # Just a small convenience function.
-  fetch = {name, path ? "/src", sha256}:
-    {
-      inherit name;
-      file = fetchurl {
-        url = "${urlBase}${path}/${name}";
-        inherit sha256;
-      };
-    };
-
-  fontlog =
-    fetch {
-      name = "FONTLOG.txt";
-      path = "";
-      sha256 = "0n405i8m70q95y8w43gzr5yvkj7gx7rd3xa4rx6y8qcqv5g7v9if";
-    };
-
-  bold =
-    fetch {
-      name = "LobsterTwo-Bold.otf";
-      sha256 = "0gkayn96vvgngs9xnmcyyf16q4payk79ghvl354rl93ayb3gf7x0";
-    };
-
-  boldItalic =
-    fetch {
-      name = "LobsterTwo-BoldItalic.otf";
-      sha256 = "0wznqkvwjqi9s4bg10fpp2345by3nxa0m0w6b3al3zaqyx2p1dxp";
-    };
-
-  italic =
-    fetch {
-      name = "LobsterTwo-Italic.otf";
-      sha256 = "0lpnzwgwl5fm6gqy8bylbryz0hy94mf1mp615y5sh0wikdvk570z";
-    };
-
-  regular =
-    fetch {
-      name = "LobsterTwo-Regular.otf";
-      sha256 = "147m3sa3sqqbkbw1hgjdwnw8w0y37x58g5p09s7q2vm74flcpbq1";
-    };
-in
-
-  stdenv.mkDerivation rec {
-    pname = "lobstertwo";
-    version = "1.006";
-
-    phases = ["installPhase"];
-
-    installPhase = ''
-      mkdir -p $out/share/fonts/opentype
-      mkdir -p $out/share/doc/${pname}-${version}
-      cp -v ${fontlog.file} $out/share/doc/${pname}-${version}/${fontlog.name}
-      cp -v ${bold.file} $out/share/fonts/opentype/${bold.name}
-      cp -v ${boldItalic.file} $out/share/fonts/opentype/${boldItalic.name}
-      cp -v ${italic.file} $out/share/fonts/opentype/${italic.name}
-      cp -v ${regular.file} $out/share/fonts/opentype/${regular.name}
-    '';
-
-    outputHashAlgo = "sha256";
-    outputHashMode = "recursive";
-    outputHash = "0if9l8pzwgfnbdjg5yblcy08dwn9yj3wzz29l0fycia46xlzd4ym";
-
-    meta = with lib; {
-      homepage = "https://github.com/librefonts/lobstertwo";
-      description = "Script font with many ligatures";
-      license = licenses.ofl;
-      platforms = platforms.all;
-      maintainers = [maintainers.rycee];
-      broken = true; # googlecode.com RIP; can be built from sources
-    };
-  }
diff --git a/pkgs/data/fonts/meslo-lg/default.nix b/pkgs/data/fonts/meslo-lg/default.nix
index 7083b9e0031..a55fb65c56c 100644
--- a/pkgs/data/fonts/meslo-lg/default.nix
+++ b/pkgs/data/fonts/meslo-lg/default.nix
@@ -21,7 +21,6 @@ stdenv.mkDerivation rec {
 
   sourceRoot = ".";
 
-  phases = [ "unpackPhase" "installPhase" ];
   unpackPhase = ''
     unzip -j ${meslo-lg}
     unzip -j ${meslo-lg-dz}
diff --git a/pkgs/data/fonts/unifont/default.nix b/pkgs/data/fonts/unifont/default.nix
index 507faae53e3..7fb7387179a 100644
--- a/pkgs/data/fonts/unifont/default.nix
+++ b/pkgs/data/fonts/unifont/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ libfaketime fonttosfnt mkfontscale ];
 
-  phases = [ "buildPhase" "installPhase" ];
+  dontUnpack = true;
 
   buildPhase =
     ''
diff --git a/pkgs/desktops/mate/caja-with-extensions/default.nix b/pkgs/desktops/mate/caja-with-extensions/default.nix
index 125e39d1f46..dd9ab9be1d3 100644
--- a/pkgs/desktops/mate/caja-with-extensions/default.nix
+++ b/pkgs/desktops/mate/caja-with-extensions/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation {
   pname = "${caja.pname}-with-extensions";
   version = caja.version;
 
-  phases = [ "installPhase" ];
+  dontUnpack = true;
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/desktops/pantheon/apps/elementary-calculator/default.nix b/pkgs/desktops/pantheon/apps/elementary-calculator/default.nix
index 791c2508e12..8b02af57d42 100644
--- a/pkgs/desktops/pantheon/apps/elementary-calculator/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-calculator/default.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-calculator";
-  version = "1.6.1";
+  version = "1.6.2";
 
   repoName = "calculator";
 
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     owner = "elementary";
     repo = repoName;
     rev = version;
-    sha256 = "sha256-LGY111wPldxuSfqhZ2E2TeJjexcGbfS25RjLw+Wi99c=";
+    sha256 = "sha256-kOQr94PAfLPv4LjY2WDdTtlbf3/tYf+NUESZ94+L41M=";
   };
 
   passthru = {
diff --git a/pkgs/development/guile-modules/guile-git/default.nix b/pkgs/development/guile-modules/guile-git/default.nix
index 254afae0cc4..0b3dfefcbe8 100644
--- a/pkgs/development/guile-modules/guile-git/default.nix
+++ b/pkgs/development/guile-modules/guile-git/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "guile-git";
-  version = "0.5.1";
+  version = "0.5.2";
 
   src = fetchFromGitLab {
     owner = "guile-git";
     repo = pname;
     rev = "v${version}";
-    sha256 = "7Cnuyk9xAPTvz9R44O3lvKDrT6tUQui7YzxIoqhRfPQ=";
+    sha256 = "x6apF9fmwzrkyzAexKjClOTFrbE31+fVhSLyFZkKRYU=";
   };
 
   postConfigure = ''
diff --git a/pkgs/development/interpreters/cyclone/default.nix b/pkgs/development/interpreters/cyclone/default.nix
index c0a11cf9f02..0d2984904d8 100644
--- a/pkgs/development/interpreters/cyclone/default.nix
+++ b/pkgs/development/interpreters/cyclone/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, libck, darwin }:
 
 let
-  version = "0.21";
+  version = "0.30.0";
   bootstrap = stdenv.mkDerivation {
     pname = "cyclone-bootstrap";
     inherit version;
@@ -10,7 +10,7 @@ let
       owner = "justinethier";
       repo = "cyclone-bootstrap";
       rev = "v${version}";
-      sha256 = "0bb3a7x7vzmdyhm4nilm8bcn4q50pwqryggnxz21n16v6xakwjmr";
+      sha256 = "sha256-/zAcCBdJ7YQXsspdjrMca1Oj9SUUFXQKLwZPoZLhHYg=";
     };
 
     enableParallelBuilding = true;
@@ -30,7 +30,7 @@ stdenv.mkDerivation {
     owner = "justinethier";
     repo = "cyclone";
     rev = "v${version}";
-    sha256 = "1vb4yaprs2bwbxmxx2zkqvysxx8r9qww2q1nqkz8yps3ji715jw7";
+    sha256 = "sha256-a3wiqKlIbnvIhyrI0lyVGciQiM7KSuYH5iUfGFrgOuM=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/cmark/default.nix b/pkgs/development/libraries/cmark/default.nix
index ec90d0086c9..1cc19277522 100644
--- a/pkgs/development/libraries/cmark/default.nix
+++ b/pkgs/development/libraries/cmark/default.nix
@@ -2,19 +2,19 @@
 
 stdenv.mkDerivation rec {
   pname = "cmark";
-  version = "0.30.0";
+  version = "0.30.1";
 
   src = fetchFromGitHub {
     owner = "jgm";
     repo = pname;
     rev = version;
-    sha256 = "sha256-SU31kJL+8wt57bGW5fNeXjXPgPeCXZIknZwDxMXCfdc=";
+    sha256 = "sha256-UjDM2N6gCwO94F1nW3qCP9JX42MYAicAuGTKAXMy1Gg=";
   };
 
   nativeBuildInputs = [ cmake ];
 
   cmakeFlags = [
-    # https://github.com/commonmark/cmark/releases/tag/0.30.0
+    # https://github.com/commonmark/cmark/releases/tag/0.30.1
     # recommends distributions dynamically link
     "-DCMARK_STATIC=OFF"
   ];
diff --git a/pkgs/development/libraries/grpc/default.nix b/pkgs/development/libraries/grpc/default.nix
index 00d3c4a5637..2bf843241a6 100644
--- a/pkgs/development/libraries/grpc/default.nix
+++ b/pkgs/development/libraries/grpc/default.nix
@@ -3,13 +3,13 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.38.1"; # N.B: if you change this, change pythonPackages.grpcio-tools to a matching version too
+  version = "1.39.0"; # N.B: if you change this, change pythonPackages.grpcio-tools to a matching version too
   pname = "grpc";
   src = fetchFromGitHub {
     owner = "grpc";
     repo = "grpc";
     rev = "v${version}";
-    sha256 = "0hjp946x5695srmc6bg2m7iih81jdmhpxn4bjcl80f09v4qsb0nl";
+    sha256 = "1wa7n7mf20fnvxqw093kr7a4c7vilcmx9yl3hicnyfcd663jgqvd";
     fetchSubmodules = true;
   };
   patches = [
diff --git a/pkgs/development/libraries/libsidplayfp/default.nix b/pkgs/development/libraries/libsidplayfp/default.nix
index fe02a96a565..99c8b735294 100644
--- a/pkgs/development/libraries/libsidplayfp/default.nix
+++ b/pkgs/development/libraries/libsidplayfp/default.nix
@@ -16,14 +16,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libsidplayfp";
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "libsidplayfp";
     repo = "libsidplayfp";
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-lDM4nJozZF8Rt+XWnM41hBAYatZVsmvvQajgHLI9uy0=";
+    sha256 = "sha256-Ut6tXaM97R8Y5D2dV/xPvxVzS6Ep6fOKAujtRNKoQCc=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libxlsxwriter/default.nix b/pkgs/development/libraries/libxlsxwriter/default.nix
index ce9a72f00c1..dfeaeed8ca8 100644
--- a/pkgs/development/libraries/libxlsxwriter/default.nix
+++ b/pkgs/development/libraries/libxlsxwriter/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libxlsxwriter";
-  version = "1.0.8";
+  version = "1.0.9";
 
   src = fetchFromGitHub {
     owner = "jmcnamara";
     repo = "libxlsxwriter";
     rev = "RELEASE_${version}";
-    sha256 = "1z9bkg0pfkzxbpj2rys4mx9wmcxyjjqsg0nbiaabsg455q00plki";
+    sha256 = "sha256-6MMQr0ynMmfZj+RFoKtLB/f1nTBfn9tcYpzyUwnfB3M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/microsoft_gsl/default.nix b/pkgs/development/libraries/microsoft_gsl/default.nix
index 5a5257168eb..11931199999 100644
--- a/pkgs/development/libraries/microsoft_gsl/default.nix
+++ b/pkgs/development/libraries/microsoft_gsl/default.nix
@@ -1,44 +1,46 @@
-{ lib, stdenv, fetchFromGitHub, catch, cmake
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, gtest
+, fetchurl
+, pkg-config
 }:
 
-let
-  nativeBuild = stdenv.hostPlatform == stdenv.buildPlatform;
-in
 stdenv.mkDerivation rec {
   pname = "microsoft_gsl";
-  version = "2.1.0";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "Microsoft";
     repo = "GSL";
     rev = "v${version}";
-    sha256 = "09f08lxqm00152bx9yrizlgabzpzxlpbv06h00z4w78yxywgxlgx";
+    sha256 = "sha256-gIpyuNlp3mvR8r1Azs2r76ElEodykRLGAwMN4BDJez0=";
   };
 
-  # build phase just runs the unit tests, so skip it if
-  # we're doing a cross build
-  nativeBuildInputs = [ catch cmake ];
-  buildPhase = if nativeBuild then "make" else "true";
+  patches = [
+    # Search for GoogleTest via pkg-config first, ref: https://github.com/NixOS/nixpkgs/pull/130525
+    (fetchurl {
+      url = "https://github.com/microsoft/GSL/commit/f5cf01083baf7e8dc8318db3648bc6098dc32d67.patch";
+      sha256 = "sha256-uouv35crtly8kYhKyvMyZkqwTKt1jXC6dZjw4sQ6uv0=";
+    })
+  ];
 
-  # https://github.com/microsoft/GSL/issues/806
-  cmakeFlags = lib.optionals stdenv.cc.isGNU
-    [ "-DCMAKE_CXX_FLAGS=-Wno-catch-value" ];
+  nativeBuildInputs = [ cmake pkg-config ];
+  buildInputs = [ gtest ];
 
-  installPhase = ''
-    mkdir -p $out/include
-    mv ../include/ $out/
-  '';
+  doCheck = true;
 
   meta = with lib; {
     description = "C++ Core Guideline support library";
     longDescription = ''
-     The Guideline Support Library (GSL) contains functions and types that are suggested for
-     use by the C++ Core Guidelines maintained by the Standard C++ Foundation.
-     This package contains Microsoft's implementation of GSL.
+      The Guideline Support Library (GSL) contains functions and types that are suggested for
+      use by the C++ Core Guidelines maintained by the Standard C++ Foundation.
+      This package contains Microsoft's implementation of GSL.
     '';
-    homepage    = "https://github.com/Microsoft/GSL";
-    license     = licenses.mit;
-    platforms   = platforms.all;
+    homepage = "https://github.com/Microsoft/GSL";
+    license = licenses.mit;
+    platforms = platforms.all;
     maintainers = with maintainers; [ thoughtpolice xwvvvvwx yuriaisaka ];
   };
 }
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index 5cfca8d80c7..5d8688cfdc7 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -125,6 +125,12 @@ let
         url = "https://github.com/qt/qtwebengine/commit/199ea00a9eea13315a652c62778738629185b059.patch";
         sha256 = "1b5k2g1v8913cvsgvp6ja4mcprjlk5vcwqzi0p1qq7b1wyi4f0g2";
       })
+      # Fix invisible fonts with glibc 2.33: https://github.com/NixOS/nixpkgs/issues/131074
+      (fetchpatch {
+        url = "https://src.fedoraproject.org/rpms/qt5-qtwebengine/raw/d122c011631137b79455850c363676c655cf9e09/f/qtwebengine-everywhere-src-5.15.5-%231904652.patch";
+        name = "qtwebengine-everywhere-src-5.15.5-_1904652.patch";
+        sha256 = "01q7hagq0ysii1jnrh5adm97vdm9cis592xr6im7accyw6hgcn7b";
+      })
     ] ++ optionals stdenv.isDarwin [
       ./qtwebengine-darwin-no-platform-check.patch
       ./qtwebengine-mac-dont-set-dsymutil-path.patch
diff --git a/pkgs/development/libraries/vapoursynth/default.nix b/pkgs/development/libraries/vapoursynth/default.nix
index 3b6362f7396..37d82b0b4bd 100644
--- a/pkgs/development/libraries/vapoursynth/default.nix
+++ b/pkgs/development/libraries/vapoursynth/default.nix
@@ -10,13 +10,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "vapoursynth";
-  version = "R53";
+  version = "R54";
 
   src = fetchFromGitHub {
     owner  = "vapoursynth";
     repo   = "vapoursynth";
     rev    = version;
-    sha256 = "0qcsfkpkry0cmvi60khjwvfz4fqhy23nqmn4pb9qrwll26sn9dcr";
+    sha256 = "01jym2rq28j0g792yagk9dvm411gwmk6qgj9rgrg7ckpxmw27w2s";
   };
 
   patches = [
diff --git a/pkgs/development/ocaml-modules/mdx/default.nix b/pkgs/development/ocaml-modules/mdx/default.nix
index 7051c51cc5c..c8035eea42d 100644
--- a/pkgs/development/ocaml-modules/mdx/default.nix
+++ b/pkgs/development/ocaml-modules/mdx/default.nix
@@ -1,16 +1,16 @@
-{ lib, fetchurl, buildDunePackage, opaline, ocaml
+{ lib, fetchurl, buildDunePackage, ocaml
 , alcotest
 , astring, cmdliner, cppo, fmt, logs, ocaml-version, odoc, ocaml_lwt, re, result, csexp
 , pandoc}:
 
 buildDunePackage rec {
   pname = "mdx";
-  version = "1.8.1";
+  version = "1.10.1";
   useDune2 = true;
 
   src = fetchurl {
     url = "https://github.com/realworldocaml/mdx/releases/download/${version}/mdx-${version}.tbz";
-    sha256 = "1szik1lyg2vs8jrisnvjdc29n0ifls8mghimff4jcz6f48haa3cv";
+    sha256 = "10d4sfv4qk9569kj46pcaw6cih40v6bkgd44lmsp7cyfhvl8pa9x";
   };
 
   nativeBuildInputs = [ cppo ];
@@ -23,7 +23,9 @@ buildDunePackage rec {
   outputs = [ "bin" "lib" "out" ];
 
   installPhase = ''
-    ${opaline}/bin/opaline -prefix $bin -libdir $lib/lib/ocaml/${ocaml.version}/site-lib
+    runHook preInstall
+    dune install --prefix=$bin --libdir=$lib/lib/ocaml/${ocaml.version}/site-lib ${pname}
+    runHook postInstall
   '';
 
   meta = {
diff --git a/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix b/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix
index b501282c155..6e172dee6ee 100644
--- a/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix
+++ b/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix
@@ -1,4 +1,5 @@
 { buildDunePackage
+, cppo
 , stdlib-shims
 , ppx_yojson_conv_lib
 , ocaml-syntax-shims
@@ -26,16 +27,20 @@ buildDunePackage {
   '';
 
   buildInputs = [
-    stdlib-shims
+    cppo
     ppx_yojson_conv_lib
     ocaml-syntax-shims
     octavius
-    uutf
-    csexp
     dune-build-info
     omd
     cmdliner
+  ];
+
+  propagatedBuildInputs = [
+    csexp
     jsonrpc
+    stdlib-shims
+    uutf
   ];
 
   meta = jsonrpc.meta // {
diff --git a/pkgs/development/ocaml-modules/ocaml-monadic/default.nix b/pkgs/development/ocaml-modules/ocaml-monadic/default.nix
index 69fa4cba851..9a6dd1f7cb6 100644
--- a/pkgs/development/ocaml-modules/ocaml-monadic/default.nix
+++ b/pkgs/development/ocaml-modules/ocaml-monadic/default.nix
@@ -1,10 +1,10 @@
 { lib, fetchFromGitHub, buildDunePackage
-, ocaml-migrate-parsetree, ppx_tools_versioned
+, ppxlib
 }:
 
 buildDunePackage rec {
   pname = "ocaml-monadic";
-  version = "0.4.1";
+  version = "0.5.0";
 
   useDune2 = true;
 
@@ -12,11 +12,10 @@ buildDunePackage rec {
     owner = "zepalmer";
     repo = pname;
     rev = version;
-    sha256 = "1zcwydypk5vwfn1g7srnl5076scwwq5a5y8xwcjl70pc4cpzszll";
+    sha256 = "1ynv3yhdqmkhkgnz6c5kv6ryjcc934sdvw9rhh8rjg2dlzlffgbw";
   };
 
-  buildInputs = [ ppx_tools_versioned ];
-  propagatedBuildInputs = [ ocaml-migrate-parsetree ];
+  buildInputs = [ ppxlib ];
 
   meta = {
     inherit (src.meta) homepage;
diff --git a/pkgs/development/ocaml-modules/yojson/default.nix b/pkgs/development/ocaml-modules/yojson/default.nix
index 07025be296c..2be9ce1b021 100644
--- a/pkgs/development/ocaml-modules/yojson/default.nix
+++ b/pkgs/development/ocaml-modules/yojson/default.nix
@@ -1,48 +1,22 @@
-{ lib, stdenv, fetchzip, ocaml, findlib, dune_2, cppo, easy-format, biniou }:
-let
-  pname = "yojson";
-  param =
-  if lib.versionAtLeast ocaml.version "4.02" then rec {
-    version = "1.7.0";
-    url = "https://github.com/ocaml-community/yojson/releases/download/${version}/yojson-${version}.tbz";
-    sha256 = "08llz96if8bcgnaishf18si76cv11zbkni0aldb54k3cn7ipiqvd";
-    nativeBuildInputs = [ dune_2 ];
-    extra = {
-      installPhase = ''
-        dune install --prefix $out --libdir $OCAMLFIND_DESTDIR ${pname}
-      '';
-    };
-  } else rec {
-    version = "1.2.3";
-    url = "https://github.com/ocaml-community/yojson/archive/v${version}.tar.gz";
-    sha256 = "10dvkndgwanvw4agbjln7kgb1n9s6lii7jw82kwxczl5rd1sgmvl";
-    extra = {
-      createFindlibDestdir = true;
+{ lib, fetchurl, buildDunePackage, cppo, easy-format, biniou }:
 
-      makeFlags = [ "PREFIX=$(out)" ];
-
-      preBuild = "mkdir $out/bin";
-    };
-  };
-in
-stdenv.mkDerivation ({
-
-  name = "ocaml${ocaml.version}-${pname}-${param.version}";
+buildDunePackage rec {
+  pname = "yojson";
+  version = "1.7.0";
+  useDune2 = true;
 
-  src = fetchzip {
-    inherit (param) url sha256;
+  src = fetchurl {
+    url = "https://github.com/ocaml-community/yojson/releases/download/${version}/yojson-${version}.tbz";
+    sha256 = "1iich6323npvvs8r50lkr4pxxqm9mf6w67cnid7jg1j1g5gwcvv5";
   };
 
-  nativeBuildInputs = [ ocaml findlib ] ++ (param.nativeBuildInputs or []);
-  propagatedNativeBuildInputs = [ cppo ];
+  nativeBuildInputs = [ cppo ];
   propagatedBuildInputs = [ easy-format biniou ];
-  configurePlatforms = [];
 
   meta = with lib; {
     description = "An optimized parsing and printing library for the JSON format";
     homepage = "https://github.com/ocaml-community/${pname}";
     license = licenses.bsd3;
     maintainers = [ maintainers.vbgl ];
-    platforms = ocaml.meta.platforms or [];
   };
-} // param.extra)
+}
diff --git a/pkgs/development/python-modules/ailment/default.nix b/pkgs/development/python-modules/ailment/default.nix
index a6c99e72c0a..3ddd3d366e8 100644
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.0.9031";
+  version = "9.0.9166";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-xyNTcGTGH8030CJif6an+kDZIfOUVDMiRhFamVajAzk=";
+    sha256 = "09qbqn57h92f81xv35f645ai7nkkqf7cidkg3qrwfpxcwc2g9kdz";
   };
 
   propagatedBuildInputs = [ pyvex ];
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index 896b9c71a70..5def5b1d13f 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -1,22 +1,34 @@
-{ lib, buildPythonPackage, fetchPypi, isPy3k, attrs, protobuf, zeroconf }:
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchPypi
+, protobuf
+, zeroconf
+}:
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "2.9.0";
+  version = "4.1.0";
+  format = "setuptools";
 
-  disabled = !isPy3k;
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "11259cd1f115d31b91512a209779fa813dded747408100805bc8ecf7c1c1fa82";
+    sha256 = "0210l2d5g76pllr2vh990k9shfv3zrknx5d2dmgqb5y90142cp76";
   };
 
-  propagatedBuildInputs = [ attrs protobuf zeroconf ];
+  propagatedBuildInputs = [
+    protobuf
+    zeroconf
+  ];
 
   # no tests implemented
   doCheck = false;
 
-  pythonImportsCheck = [ "aioesphomeapi" ];
+  pythonImportsCheck = [
+    "aioesphomeapi"
+  ];
 
   meta = with lib; {
     description = "Python Client for ESPHome native API";
diff --git a/pkgs/development/python-modules/aioguardian/default.nix b/pkgs/development/python-modules/aioguardian/default.nix
index 74ff8fb3fde..71e1fb43dd5 100644
--- a/pkgs/development/python-modules/aioguardian/default.nix
+++ b/pkgs/development/python-modules/aioguardian/default.nix
@@ -15,13 +15,13 @@
 
 buildPythonPackage rec {
   pname = "aioguardian";
-  version = "1.0.7";
+  version = "1.0.8";
 
   src = fetchFromGitHub {
     owner = "bachya";
     repo = pname;
     rev = version;
-    sha256 = "sha256-KMhq86hcqoYloS/6VHsl+3KVEZBbN97ABrZlmEr32Z8=";
+    sha256 = "0nqsacg0yrsqr6qax4486ffk8r88ra5yixxd6r88jwscm2bmjg3p";
   };
 
   format = "pyproject";
@@ -45,15 +45,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    # https://github.com/bachya/aioguardian/pull/66
-    substituteInPlace pyproject.toml \
-      --replace 'asyncio_dgram = "^1.0.1"' 'asyncio_dgram = "^2.0.0"'
-    # https://github.com/bachya/aioguardian/pull/67
-    substituteInPlace pyproject.toml \
-      --replace "poetry>=0.12" "poetry-core"
-  '';
-
   disabledTestPaths = [ "examples/" ];
 
   pythonImportsCheck = [ "aioguardian" ];
diff --git a/pkgs/development/python-modules/aiohomekit/default.nix b/pkgs/development/python-modules/aiohomekit/default.nix
index f1c018989c2..981a541e9ec 100644
--- a/pkgs/development/python-modules/aiohomekit/default.nix
+++ b/pkgs/development/python-modules/aiohomekit/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "aiohomekit";
-  version = "0.3.0";
+  version = "0.4.2";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "Jc2k";
     repo = pname;
     rev = version;
-    sha256 = "sha256-chRUQyCDXW4of0XBdmKuQEzUE3Gt4A2uGlPNy+oEoco=";
+    sha256 = "12v9szalh3yzfqgmspk4ch8l38kzmhwzjn9jvsq632n4zhjd7qg4";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/angr/default.nix b/pkgs/development/python-modules/angr/default.nix
index 285a125a725..acad9cb0f59 100644
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -43,14 +43,14 @@ in
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.0.9031";
+  version = "9.0.9166";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-qWAz9SHfQU0cdk4yVekJn5OIDPJPbi63CDdlHDq1Opw=";
+    sha256 = "1h1jb57zp8wy24xy60j76sl4hrzhhwfsvfx26zhbnhqzmwghpd5x";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/angrop/default.nix b/pkgs/development/python-modules/angrop/default.nix
index e5ab1954276..1ab86c1820a 100644
--- a/pkgs/development/python-modules/angrop/default.nix
+++ b/pkgs/development/python-modules/angrop/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "angrop";
-  version = "9.0.9031";
+  version = "9.0.9166";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-3q/3iFR0FFOcvgmNVXtgi1Spu5xfXNJFy+QoIh8amOY=";
+    sha256 = "1myrzp5axg0dj7kxqc2mz3kfqlds3vzvavcncrj5y9xpx8m7l71m";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/archinfo/default.nix b/pkgs/development/python-modules/archinfo/default.nix
index 60c3e8905b5..40583a12ada 100644
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.0.9031";
+  version = "9.0.9166";
 
   src = fetchFromGitHub {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-pzBMyw5FwQV1FyhvOxUq39s96p0KKSrkEvJzhJQdS4E=";
+    sha256 = "0y77lyz019rm9zgxpam6dbb006c7j66hwy985h3fg6nbz74pcml5";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/bellows/default.nix b/pkgs/development/python-modules/bellows/default.nix
index 7df23d1a25a..7d8e6ff5bee 100644
--- a/pkgs/development/python-modules/bellows/default.nix
+++ b/pkgs/development/python-modules/bellows/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "bellows";
-  version = "0.24.0";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "zigpy";
     repo = "bellows";
     rev = version;
-    sha256 = "00sa4x1qzv861z9d83lk4lp1g2pqiv9hpawj92w4qn1wnqxbz6rw";
+    sha256 = "1836wm8whbryp31zdaj3b6w40sx1wjsxgpjdb1x9rgmwff4d1hc0";
   };
 
   prePatch = ''
diff --git a/pkgs/development/python-modules/capturer/default.nix b/pkgs/development/python-modules/capturer/default.nix
index 02bdd0fc72e..2495040887f 100644
--- a/pkgs/development/python-modules/capturer/default.nix
+++ b/pkgs/development/python-modules/capturer/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, buildPythonPackage, fetchFromGitHub, humanfriendly, pytestCheckHook, pytest-cov }:
+{ stdenv, lib, buildPythonPackage, fetchFromGitHub, humanfriendly, pytestCheckHook }:
 
 buildPythonPackage rec {
   pname = "capturer";
diff --git a/pkgs/development/python-modules/claripy/default.nix b/pkgs/development/python-modules/claripy/default.nix
index 2c25d258e57..3dc930473f5 100644
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.0.9031";
+  version = "9.0.9166";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-UCmt2Vm8OWyKa0fmPlGuvzaFddUWs6quavUgIZasoJg=";
+    sha256 = "0rwl5q7z16agcykn0an2lyqfn2z5yvmg0xcvxfpvndf6zpnbqhx0";
   };
 
   # Use upstream z3 implementation
diff --git a/pkgs/development/python-modules/cle/default.nix b/pkgs/development/python-modules/cle/default.nix
index d6731260937..0110625eba8 100644
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@@ -15,7 +15,7 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.0.9031";
+  version = "9.0.9166";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+9aW7J8FXuKtU20dpqnoj37McPxzbkjKuYZIO8QeFF0=";
+    sha256 = "1mvdcwzim52mc7vjrr2cq8xwwi0v0ai3z608mg5nfbbf4zjji76c";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dacite/default.nix b/pkgs/development/python-modules/dacite/default.nix
new file mode 100644
index 00000000000..67b1722be51
--- /dev/null
+++ b/pkgs/development/python-modules/dacite/default.nix
@@ -0,0 +1,32 @@
+{ lib
+, fetchFromGitHub
+, buildPythonPackage
+, pythonOlder
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "dacite";
+  version = "1.6.0";
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "konradhalas";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0nv2bnj3bq2v08ac4p583cnpjq2d6bv5isycgji5i5wg1y082a3d";
+  };
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "dacite" ];
+
+  meta = with lib; {
+    description = "Python helper to create data classes from dictionaries";
+    homepage = "https://github.com/konradhalas/dacite";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/datasette/default.nix b/pkgs/development/python-modules/datasette/default.nix
index 58920b40646..5a611c989f4 100644
--- a/pkgs/development/python-modules/datasette/default.nix
+++ b/pkgs/development/python-modules/datasette/default.nix
@@ -31,14 +31,14 @@
 
 buildPythonPackage rec {
   pname = "datasette";
-  version = "0.57.1";
+  version = "0.58.1";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "simonw";
     repo = pname;
     rev = version;
-    sha256 = "sha256-BHsf3GOganPhsDiZlRxvAsRZH/Sq+Jr+CZcc2ubce+8=";
+    sha256 = "sha256-dtKqp7LV1fRjwOMAlmmAnC19j8hLA1oixGextATW6z0=";
   };
 
   nativeBuildInputs = [ pytest-runner ];
diff --git a/pkgs/development/python-modules/env-canada/default.nix b/pkgs/development/python-modules/env-canada/default.nix
index 3beb01e3b13..22894ab9f2a 100644
--- a/pkgs/development/python-modules/env-canada/default.nix
+++ b/pkgs/development/python-modules/env-canada/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "env-canada";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "michaeldavie";
     repo = "env_canada";
     rev = "v${version}";
-    sha256 = "0y4yjzmg6ns7a13j1cxqvrff4fd6k97cpc1xjwqrwp7gq49rzhy7";
+    sha256 = "0v1wmjvi05i6mjh6yxqigbf2spf7842198yp98f7h0nyfjmz96hn";
   };
 
   propagatedBuildInputs = [
@@ -42,6 +42,7 @@ buildPythonPackage rec {
     "test_get_latest_frame"
     "test_get_loop"
     "test_get_ec_sites"
+    "test_ecradar"
   ];
 
   pythonImportsCheck = [ "env_canada" ];
diff --git a/pkgs/development/python-modules/fastapi/default.nix b/pkgs/development/python-modules/fastapi/default.nix
index b804d4943b2..3b14560eb9d 100644
--- a/pkgs/development/python-modules/fastapi/default.nix
+++ b/pkgs/development/python-modules/fastapi/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "fastapi";
-  version = "0.65.2";
+  version = "0.67.0";
   format = "flit";
 
   src = fetchFromGitHub {
     owner = "tiangolo";
     repo = "fastapi";
     rev = version;
-    sha256 = "032srvbfdy02m1b664x67lkdcx6b2bd4c9a9cb176lscjk213240";
+    sha256 = "15zbalyib7ndcbxvf9prj0n9n6qb4bfzhmaacsjrvdmjzmqdjgw0";
   };
 
   postPatch = ''
@@ -51,7 +51,11 @@ buildPythonPackage rec {
   ];
 
   # disabled tests require orjson which requires rust nightly
-  pytestFlagsArray = [ "--ignore=tests/test_default_response_class.py" ];
+
+  # ignoring deprecation warnings to avoid test failure from
+  # tests/test_tutorial/test_testing/test_tutorial001.py
+
+  pytestFlagsArray = [ "--ignore=tests/test_default_response_class.py" "-W ignore::DeprecationWarning"];
   disabledTests = [ "test_get_custom_response" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/fritzprofiles/default.nix b/pkgs/development/python-modules/fritzprofiles/default.nix
new file mode 100644
index 00000000000..17716e5fc95
--- /dev/null
+++ b/pkgs/development/python-modules/fritzprofiles/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, lxml
+, requests
+}:
+
+buildPythonPackage rec {
+  pname = "fritzprofiles";
+  version = "0.6.1";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1bd4sa3i1ldkg6lnsvg004csgqklvi5xk71y971qyjvsbdbwgbn3";
+  };
+
+  propagatedBuildInputs = [
+    lxml
+    requests
+  ];
+
+  pythonImportsCheck = [
+    "fritzprofiles"
+  ];
+
+  # no tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Tool to switch the online time of profiles in the AVM Fritz!Box";
+    homepage = "https://github.com/AaronDavidSchneider/fritzprofiles";
+    license = licenses.mit;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
diff --git a/pkgs/development/python-modules/gios/default.nix b/pkgs/development/python-modules/gios/default.nix
index 71aae7b66ad..3c5de1295c2 100644
--- a/pkgs/development/python-modules/gios/default.nix
+++ b/pkgs/development/python-modules/gios/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "gios";
-  version = "1.0.1";
+  version = "1.0.2";
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "bieniu";
     repo = pname;
     rev = version;
-    sha256 = "031z5j1j961pcw8s4ajj5z2xn2jxb2hyfn3x3bxbaagwl9a5qkvn";
+    sha256 = "sha256-7+np1lUbBFSTJNAD6OT5k89MM+kzEj90JlulXGm36k8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/grpcio-tools/default.nix b/pkgs/development/python-modules/grpcio-tools/default.nix
index 7236f7c22e3..0e095126676 100644
--- a/pkgs/development/python-modules/grpcio-tools/default.nix
+++ b/pkgs/development/python-modules/grpcio-tools/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "grpcio-tools";
-  version = "1.38.1";
+  version = "1.39.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cd85f58038b92e1961f8127d79691e84e151390d35cae73c4c0cbe2042f76b77";
+    sha256 = "39dfe7415bc0d3860fdb8dd90607594b046b88b57dbe64284efa4820f951c805";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/python-modules/gym/default.nix b/pkgs/development/python-modules/gym/default.nix
index 888dbf45342..1bda1d8ac2d 100644
--- a/pkgs/development/python-modules/gym/default.nix
+++ b/pkgs/development/python-modules/gym/default.nix
@@ -29,6 +29,11 @@ buildPythonPackage rec {
     scipy
   ];
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "Pillow<=8.2.0" "Pillow"
+  '';
+
   # The test needs MuJoCo that is not free library.
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/hap-python/default.nix b/pkgs/development/python-modules/hap-python/default.nix
index 946f0039a0a..cba02387be5 100644
--- a/pkgs/development/python-modules/hap-python/default.nix
+++ b/pkgs/development/python-modules/hap-python/default.nix
@@ -17,15 +17,15 @@
 
 buildPythonPackage rec {
   pname = "hap-python";
-  version = "3.5.0";
-  disabled = pythonOlder "3.5";
+  version = "3.5.1";
+  disabled = pythonOlder "3.6";
 
   # pypi package does not include tests
   src = fetchFromGitHub {
     owner = "ikalchev";
     repo = "HAP-python";
     rev = "v${version}";
-    sha256 = "1vzlfx0gpidl0rzv4z94pziwm6rj4lrilly5pykgq984y708pcqf";
+    sha256 = "sha256-ZHTqlb7LIDp8MFNW8MFg6jX7QwaxT40cLi3H13ONLCI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/hatasmota/default.nix b/pkgs/development/python-modules/hatasmota/default.nix
index abfc4523965..9a7ab056a31 100644
--- a/pkgs/development/python-modules/hatasmota/default.nix
+++ b/pkgs/development/python-modules/hatasmota/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "hatasmota";
-  version = "0.2.14";
+  version = "0.2.19";
 
   src = fetchFromGitHub {
     owner = "emontnemery";
     repo = pname;
     rev = version;
-    sha256 = "sha256-sCGUlEN1ejWhc2+9JRQ7UPqueq30u8gGSPRxbs4cnLE=";
+    sha256 = "sha256-h1idJJd2lPV3+tAE59gzITa7jmtBhcEpRuyflf76EAk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/jupyterlab_server/default.nix b/pkgs/development/python-modules/jupyterlab_server/default.nix
index f3f2b9dc32c..2c60d7b3b27 100644
--- a/pkgs/development/python-modules/jupyterlab_server/default.nix
+++ b/pkgs/development/python-modules/jupyterlab_server/default.nix
@@ -10,7 +10,6 @@
 , jupyter_server
 , openapi-core
 , pytest-tornasync
-, pytest-cov
 , ruamel-yaml
 , strict-rfc3339
 }:
diff --git a/pkgs/development/python-modules/nettigo-air-monitor/default.nix b/pkgs/development/python-modules/nettigo-air-monitor/default.nix
index 9cf8618bb30..4787d9d6f76 100644
--- a/pkgs/development/python-modules/nettigo-air-monitor/default.nix
+++ b/pkgs/development/python-modules/nettigo-air-monitor/default.nix
@@ -2,6 +2,7 @@
 , aiohttp
 , aioresponses
 , buildPythonPackage
+, dacite
 , fetchFromGitHub
 , pytest-asyncio
 , pytest-error-for-skips
@@ -11,18 +12,19 @@
 
 buildPythonPackage rec {
   pname = "nettigo-air-monitor";
-  version = "0.2.6";
+  version = "1.0.0";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "bieniu";
     repo = pname;
     rev = version;
-    sha256 = "0zs14g02m1ahyrhl2ihk74fp390g4672r1jjiaawmkxrvib07dvp";
+    sha256 = "sha256-VTKIUo3rR/HyEW/d/Nm0fm7wbgSdLGf02i8R3om1oCE=";
   };
 
   propagatedBuildInputs = [
     aiohttp
+    dacite
   ];
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/plexapi/default.nix b/pkgs/development/python-modules/plexapi/default.nix
index 5c41c3308be..d2e04586e38 100644
--- a/pkgs/development/python-modules/plexapi/default.nix
+++ b/pkgs/development/python-modules/plexapi/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "PlexAPI";
-  version = "4.5.2";
+  version = "4.6.1";
   disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "pkkid";
     repo = "python-plexapi";
     rev = version;
-    sha256 = "sha256-9rdpisEuLUO7oO7+7SQb4fXqRG30rf4R7bSFY+QpMhM=";
+    sha256 = "sha256-WL5UBsvAdtfOCkVX9NI0Z2fJ2CAO+NwD8wvkvkJ2uww=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/portalocker/default.nix b/pkgs/development/python-modules/portalocker/default.nix
index 8b642240f9c..eee4a1047fd 100644
--- a/pkgs/development/python-modules/portalocker/default.nix
+++ b/pkgs/development/python-modules/portalocker/default.nix
@@ -1,7 +1,5 @@
 { lib, buildPythonPackage, fetchPypi
 , pytestCheckHook
-, pytest-cov
-, pytest-flake8
 , pytest-mypy
 , redis
 }:
diff --git a/pkgs/development/python-modules/py17track/default.nix b/pkgs/development/python-modules/py17track/default.nix
new file mode 100644
index 00000000000..2c7dc8e52ea
--- /dev/null
+++ b/pkgs/development/python-modules/py17track/default.nix
@@ -0,0 +1,61 @@
+{ lib
+, aiohttp
+, aresponses
+, async-timeout
+, attrs
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, pytest-asyncio
+, pytestCheckHook
+, pythonOlder
+, pytz
+}:
+
+buildPythonPackage rec {
+  pname = "py17track";
+  version = "3.3.0";
+  format = "pyproject";
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "bachya";
+    repo = pname;
+    rev = version;
+    sha256 = "1rnq9ybzj2l3699mjyplc29mxla8fayh52x52cnsz21ixlfd9fky";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    aiohttp
+    async-timeout
+    attrs
+    pytz
+  ];
+
+  checkInputs = [
+    aresponses
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace ">=19.3,<21.0" ">=19.3,<22.0"
+  '';
+
+  # Ignore the examples directory as the files are prefixed with test_
+  disabledTestPaths = [ "examples/" ];
+
+  pythonImportsCheck = [ "py17track" ];
+
+  meta = with lib; {
+    description = "Python library to track package info from 17track.com";
+    homepage = "https://github.com/bachya/py17track";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/pydeconz/default.nix b/pkgs/development/python-modules/pydeconz/default.nix
index c202e5df19b..c6029d216d6 100644
--- a/pkgs/development/python-modules/pydeconz/default.nix
+++ b/pkgs/development/python-modules/pydeconz/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pydeconz";
-  version = "79";
+  version = "80";
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "Kane610";
     repo = "deconz";
     rev = "v${version}";
-    sha256 = "sha256-I29UIyHjsIymZxcE084hQoyaEMTXIIQPFcB8lsxY+UI=";
+    sha256 = "sha256-om1Nhqu2CU+W2k2PGP1+6jLRJihacSQDayOfTzblZKo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyeight/default.nix b/pkgs/development/python-modules/pyeight/default.nix
index a714bbfaba9..dc390120f60 100644
--- a/pkgs/development/python-modules/pyeight/default.nix
+++ b/pkgs/development/python-modules/pyeight/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pyeight";
-  version = "0.1.7";
+  version = "0.1.9";
   disabled = !isPy3k;
 
   src = fetchFromGitHub {
     owner = "mezz64";
     repo = "pyEight";
     rev = version;
-    sha256 = "sha256-kTxd6nRsPvCjrXApjKcoghOISIMho5x9/kK7OvHjKQM=";
+    sha256 = "1ybhs09wyzzaryghd6ijxhajp3677x63c4qzqsgln1mmxhj8wm5k";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyls-flake8/default.nix b/pkgs/development/python-modules/pyls-flake8/default.nix
new file mode 100644
index 00000000000..495c54d5859
--- /dev/null
+++ b/pkgs/development/python-modules/pyls-flake8/default.nix
@@ -0,0 +1,29 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, flake8
+, python-lsp-server
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "pyls-flake8";
+  version = "0.4.0";
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "emanspeaks";
+    repo = "pyls-flake8";
+    rev = "3df8606ad821100e64743f457c77c20170bde722";
+    sha256 = "14wkmwh8mqr826vdzxhvhdwrnx2akzmnbv3ar391qs4imwqfjx3l";
+  };
+
+  propagatedBuildInputs = [ flake8 python-lsp-server ];
+
+  meta = with lib; {
+    homepage = "https://github.com/emanspeaks/pyls-flake8";
+    description = "A Flake8 plugin for the Python LSP Server.";
+    license = licenses.mit;
+    maintainers = with maintainers; [ cpcloud ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyls-isort/default.nix b/pkgs/development/python-modules/pyls-isort/default.nix
index 35b43969e52..a11acce3c8b 100644
--- a/pkgs/development/python-modules/pyls-isort/default.nix
+++ b/pkgs/development/python-modules/pyls-isort/default.nix
@@ -1,29 +1,29 @@
 { lib, buildPythonPackage, fetchFromGitHub
-, python-language-server, isort
+, python-lsp-server, isort
 }:
 
 buildPythonPackage rec {
   pname = "pyls-isort";
-  version = "0.1.1";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "paradoxxxzero";
     repo = "pyls-isort";
-    rev = version;
-    sha256 = "0mf8c6dw5lsj9np20p0vrhr1yfycq2awjk2pil28l579xj9nr0dc";
+    rev = "v${version}";
+    sha256 = "0xba0aiyjfdi9swjzxk26l94dwlwvn17kkfjfscxl8gvspzsn057";
   };
 
   # no tests
   doCheck = false;
 
   propagatedBuildInputs = [
-    isort python-language-server
+    isort python-lsp-server
   ];
 
   meta = with lib; {
     homepage = "https://github.com/paradoxxxzero/pyls-isort";
-    description = "Isort plugin for python-language-server";
+    description = "Isort plugin for python-lsp-server";
     license = licenses.mit;
-    maintainers = [ ];
+    maintainers = with maintainers; [ cpcloud ];
   };
 }
diff --git a/pkgs/development/python-modules/pymunk/default.nix b/pkgs/development/python-modules/pymunk/default.nix
new file mode 100644
index 00000000000..92918efa8ed
--- /dev/null
+++ b/pkgs/development/python-modules/pymunk/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, python
+, cffi
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "pymunk";
+  version = "6.0.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    extension = "zip";
+    sha256 = "04jqqd2y0wzzkqppbl08vyzgbcpl5qj946w8da2ilypqdx7j2akp";
+  };
+
+  propagatedBuildInputs = [ cffi ];
+
+  preBuild = ''
+    ${python.interpreter} setup.py build_ext --inplace
+  '';
+
+  checkInputs = [ pytestCheckHook ];
+  pytestFlagsArray = [
+    "pymunk/tests"
+  ];
+
+  meta = with lib; {
+    description = "2d physics library";
+    homepage = "https://www.pymunk.org";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ angustrau ];
+  };
+}
diff --git a/pkgs/development/python-modules/pysma/default.nix b/pkgs/development/python-modules/pysma/default.nix
index 8a6452fb668..15d40bce9fa 100644
--- a/pkgs/development/python-modules/pysma/default.nix
+++ b/pkgs/development/python-modules/pysma/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "pysma";
-  version = "0.6.0";
+  version = "0.6.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8e997cf28c3ae7ccc90caa84aa3a3ed9245fac3e9cf76efb1467e4f4800143dc";
+    sha256 = "sha256-nKnOWVPRFmylwUeb0yApMHdW8vGvPCLlOGkZGNYC128=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/python-lsp-black/default.nix b/pkgs/development/python-modules/python-lsp-black/default.nix
new file mode 100644
index 00000000000..3c18d291e37
--- /dev/null
+++ b/pkgs/development/python-modules/python-lsp-black/default.nix
@@ -0,0 +1,32 @@
+{ lib
+, black
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, python-lsp-server
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "python-lsp-black";
+  version = "1.0.0";
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "python-lsp";
+    repo = "python-lsp-black";
+    rev = "v${version}";
+    sha256 = "1blxhj70jxb9xfbd4dxqikd262n6dn9dw5qhyml5yvdwxbv0bybc";
+  };
+
+  checkInputs = [ pytestCheckHook ];
+
+  propagatedBuildInputs = [ black python-lsp-server ];
+
+  meta = with lib; {
+    homepage = "https://github.com/python-lsp/python-lsp-black";
+    description = "Black plugin for the Python LSP Server";
+    license = licenses.mit;
+    maintainers = with maintainers; [ cpcloud ];
+  };
+}
diff --git a/pkgs/development/python-modules/python-slugify/default.nix b/pkgs/development/python-modules/python-slugify/default.nix
index fd488f4be9d..14d15df16f6 100644
--- a/pkgs/development/python-modules/python-slugify/default.nix
+++ b/pkgs/development/python-modules/python-slugify/default.nix
@@ -1,25 +1,40 @@
-{ lib, fetchPypi, buildPythonPackage, python, text-unidecode }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pytestCheckHook
+, python
+, pythonOlder
+, text-unidecode
+, unidecode
+}:
 
 buildPythonPackage rec {
-    pname = "python-slugify";
-    version = "4.0.1";
+  pname = "python-slugify";
+  version = "5.0.2";
+  disabled = pythonOlder "3.6";
 
-    src = fetchPypi {
-      inherit pname version;
-      sha256 = "69a517766e00c1268e5bbfc0d010a0a8508de0b18d30ad5a1ff357f8ae724270";
-    };
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-8TODoLn8vmSaGJK5yOtPjqsdbYS4S7emJDF6+pgVnKs=";
+  };
 
-    propagatedBuildInputs = [ text-unidecode ];
+  propagatedBuildInputs = [
+    text-unidecode
+    unidecode
+  ];
 
-    checkPhase = ''
-      ${python.interpreter} test.py
-    '';
+  checkInputs = [
+    pytestCheckHook
+  ];
 
-    meta = with lib; {
-      homepage = "https://github.com/un33k/python-slugify";
-      description = "A Python Slugify application that handles Unicode";
-      license = licenses.mit;
-      platforms = platforms.all;
-      maintainers = with maintainers; [ vrthra ];
-    };
+  pytestFlagsArray = [ "test.py" ];
+
+  pythonImportsCheck = [ "slugify" ];
+
+  meta = with lib; {
+    description = "Python Slugify application that handles Unicode";
+    homepage = "https://github.com/un33k/python-slugify";
+    license = licenses.mit;
+    maintainers = with maintainers; [ vrthra ];
+  };
 }
diff --git a/pkgs/development/python-modules/pyvex/default.nix b/pkgs/development/python-modules/pyvex/default.nix
index d021b6b06d3..a6c2b1d381b 100644
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.0.9031";
+  version = "9.0.9166";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-bl6bWv4c+tlaWcxrYCiljC9C+wAZZVyk+1O0rlb4kxA=";
+    sha256 = "0h7jw7blr4bal7pw711cxmwm4jjypchshc8ks04z2lyziy83ywja";
   };
 
   postPatch = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/python-modules/questionary/default.nix b/pkgs/development/python-modules/questionary/default.nix
index ecb33f6adb1..d7f93b3a47e 100644
--- a/pkgs/development/python-modules/questionary/default.nix
+++ b/pkgs/development/python-modules/questionary/default.nix
@@ -9,19 +9,23 @@
 
 buildPythonPackage rec {
   pname = "questionary";
-  version = "1.9.0";
+  version = "1.10.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "tmbo";
     repo = pname;
     rev = version;
-    sha256 = "1x748bz7l2r48031dj6vr6jvvac28pv6vx1bina4lz60h1qac1kf";
+    sha256 = "14k24fq2nmk90iv0k7pnmmdhmk8z261397wg52sfcsccyhpdw3i7";
   };
 
-  nativeBuildInputs = [ poetry ];
+  nativeBuildInputs = [
+    poetry
+  ];
 
-  propagatedBuildInputs = [ prompt_toolkit ];
+  propagatedBuildInputs = [
+    prompt_toolkit
+  ];
 
   checkInputs = [
     pytest-cov
@@ -32,7 +36,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Python library to build command line user prompts";
-    homepage = "https://github.com/bachya/regenmaschine";
+    homepage = "https://github.com/tmbo/questionary";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/requests-cache/default.nix b/pkgs/development/python-modules/requests-cache/default.nix
index 64dafa7bca2..ce1dfc366f4 100644
--- a/pkgs/development/python-modules/requests-cache/default.nix
+++ b/pkgs/development/python-modules/requests-cache/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "requests-cache";
-  version = "0.7.1";
+  version = "0.7.2";
   disabled = pythonOlder "3.6";
   format = "pyproject";
 
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "reclosedev";
     repo = "requests-cache";
     rev = "v${version}";
-    sha256 = "sha256-Ai/8l2p3S/NE+uyz3eQ+rJSD/xYCsXf89aYijINQ18I=";
+    sha256 = "055dfyjm8dqwr62v86lyvq4r04692gmvlgp86218vwvzgm7p3p2c";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/sfepy/default.nix b/pkgs/development/python-modules/sfepy/default.nix
index dacd589b121..bf73e7561a1 100644
--- a/pkgs/development/python-modules/sfepy/default.nix
+++ b/pkgs/development/python-modules/sfepy/default.nix
@@ -18,12 +18,12 @@
 
 buildPythonPackage rec {
   name = "sfepy";
-  version = "2020.4";
+  version = "2021.2";
   disabled = pythonOlder "3.8";
 
   src = fetchurl {
     url="https://github.com/sfepy/sfepy/archive/release_${version}.tar.gz";
-    sha256 = "1wb0ik6kjg3mksxin0abr88bhsly67fpg36qjdzabhj0xn7j1yaz";
+    sha256 = "1vnynxzbspj900wjyy6020l71jdv2l1wkyax7nhi6w5wvav4kfwz";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/simplisafe-python/default.nix b/pkgs/development/python-modules/simplisafe-python/default.nix
index 3e2a90b496b..7bcd6340acf 100644
--- a/pkgs/development/python-modules/simplisafe-python/default.nix
+++ b/pkgs/development/python-modules/simplisafe-python/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "simplisafe-python";
-  version = "10.0.0";
+  version = "11.0.1";
   format = "pyproject";
   disabled = pythonOlder "3.7";
 
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "bachya";
     repo = pname;
     rev = version;
-    sha256 = "sha256-VF8R+dty54GuWvYs/OqWhfGtOVieuxtfndQUxHhu5lc=";
+    sha256 = "04fn65iwzgvxi44kgvgvxjr3nzi2f4hwlqrjxfvc5yda96qp347c";
   };
 
   nativeBuildInputs = [ poetry-core ];
diff --git a/pkgs/development/python-modules/skytemple-rust/default.nix b/pkgs/development/python-modules/skytemple-rust/default.nix
index d22d6109958..d98d23fada6 100644
--- a/pkgs/development/python-modules/skytemple-rust/default.nix
+++ b/pkgs/development/python-modules/skytemple-rust/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchFromGitHub, rustPlatform, setuptools-rust }:
+{ lib, stdenv, buildPythonPackage, fetchFromGitHub, libiconv, rustPlatform, setuptools-rust }:
 
 buildPythonPackage rec {
   pname = "skytemple-rust";
@@ -17,6 +17,7 @@ buildPythonPackage rec {
     sha256 = "1ypcsf9gbq1bz29kfn7g4kg8741mxg1lfcbb14a0vfhjq4d6pnx9";
   };
 
+  buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
   nativeBuildInputs = [ setuptools-rust ] ++ (with rustPlatform; [ cargoSetupHook rust.cargo rust.rustc ]);
 
   doCheck = false; # there are no tests
diff --git a/pkgs/development/python-modules/sphinx-copybutton/default.nix b/pkgs/development/python-modules/sphinx-copybutton/default.nix
new file mode 100644
index 00000000000..8d408d300c7
--- /dev/null
+++ b/pkgs/development/python-modules/sphinx-copybutton/default.nix
@@ -0,0 +1,33 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, sphinx
+}:
+
+buildPythonPackage rec {
+  pname = "sphinx-copybutton";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "executablebooks";
+    repo = "sphinx-copybutton";
+    rev = "v${version}";
+    sha256 = "sha256-vrEIvQeP7AMXSme1PBp0ox5k8Q1rz+1cbHIO+o17Jqc=";
+    fetchSubmodules = true;
+  };
+
+  propagatedBuildInputs = [
+    sphinx
+  ];
+
+  doCheck = false; # no tests
+
+  pythonImportsCheck = [ "sphinx_copybutton" ];
+
+  meta = with lib; {
+    description = "A small sphinx extension to add a \"copy\" button to code blocks";
+    homepage = "https://github.com/executablebooks/sphinx-copybutton";
+    license = licenses.mit;
+    maintainers = with maintainers; [ Luflosi ];
+  };
+}
diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index a3e00dff4ef..3aaff20a9ea 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -9,7 +9,6 @@
 , mock
 , pysqlite ? null
 , pytestCheckHook
-, pytest-xdist
 }:
 
 buildPythonPackage rec {
diff --git a/pkgs/development/python-modules/tesserocr/default.nix b/pkgs/development/python-modules/tesserocr/default.nix
index df1b0228304..0b21e17f96b 100644
--- a/pkgs/development/python-modules/tesserocr/default.nix
+++ b/pkgs/development/python-modules/tesserocr/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "tesserocr";
-  version = "2.5.1";
+  version = "2.5.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0cc7d4r11z26rhcwpmcc42fi9kr3f20nq5pk84jrczr18i0g99mh";
+    sha256 = "1bmj76gi8401lcqdaaznfmz9yf11myy1bzivqwwq08z3dwzxswck";
   };
 
   nativeBuildInputs = [ cython pkg-config ];
diff --git a/pkgs/development/python-modules/twitterapi/default.nix b/pkgs/development/python-modules/twitterapi/default.nix
index 166e42ced82..cf3ec977d0e 100644
--- a/pkgs/development/python-modules/twitterapi/default.nix
+++ b/pkgs/development/python-modules/twitterapi/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "twitterapi";
-  version = "2.7.4";
+  version = "2.7.5";
 
   src = fetchFromGitHub {
     owner = "geduldig";
     repo = "TwitterAPI";
     rev = "v${version}";
-    sha256 = "sha256-HDPRpM1LDTtUbldzfCrsdh/GpbzNCVVUVGwohyMe/YE=";
+    sha256 = "1s5q3gzd69syk8khlyy7ap8gpymvhgqrlv3vp6vdmwnaafjvvyy3";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/vultr/default.nix b/pkgs/development/python-modules/vultr/default.nix
index 975e4098112..b6f8a407b23 100644
--- a/pkgs/development/python-modules/vultr/default.nix
+++ b/pkgs/development/python-modules/vultr/default.nix
@@ -5,26 +5,29 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.1.2";
+  version = "1.0.1";
   pname = "vultr";
 
   src = fetchFromGitHub {
-      owner = "spry-group";
-      repo = "python-vultr";
-      rev = version;
-      sha256 = "1qjvvr2v9gfnwskdl0ayazpcmiyw9zlgnijnhgq9mcri5gq9jw5h";
+    owner = "spry-group";
+    repo = "python-vultr";
+    rev = "v${version}";
+    sha256 = "00lc5hdhchvm0472p03019bp9541d8y2773xkjy8vblq9qhys8q7";
   };
 
-  propagatedBuildInputs = [ requests ];
+  propagatedBuildInputs = [
+    requests
+  ];
 
   # Tests disabled. They fail because they try to access the network
   doCheck = false;
 
+  pythonImportsCheck = [ "vultr" ];
+
   meta = with lib; {
     description = "Vultr.com API Client";
     homepage = "https://github.com/spry-group/python-vultr";
     license = licenses.mit;
     maintainers = with maintainers; [ lihop ];
   };
-
 }
diff --git a/pkgs/development/python-modules/wled/default.nix b/pkgs/development/python-modules/wled/default.nix
index 6f06c8dba90..e38d43ef56b 100644
--- a/pkgs/development/python-modules/wled/default.nix
+++ b/pkgs/development/python-modules/wled/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "wled";
-  version = "0.6.0";
+  version = "0.7.1";
   disabled = pythonOlder "3.8";
   format = "pyproject";
 
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "frenck";
     repo = "python-wled";
     rev = "v${version}";
-    sha256 = "sha256-aFBcSGPCT49TbqzjUv/d8agdPOCC090rNxDnE9y91Pk=";
+    sha256 = "02xrml9mpq3akwyryg1m7xjmgnlgi5kjvx7vkq6110ai0f9hzpwi";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/zeroconf/default.nix b/pkgs/development/python-modules/zeroconf/default.nix
index 313f121510e..fc869efe087 100644
--- a/pkgs/development/python-modules/zeroconf/default.nix
+++ b/pkgs/development/python-modules/zeroconf/default.nix
@@ -1,32 +1,41 @@
 { stdenv
 , lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , ifaddr
+, pytest-asyncio
 , pythonOlder
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "zeroconf";
-  version = "0.31.0";
+  version = "0.32.1";
+  format = "setuptools";
   disabled = pythonOlder "3.6";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-U6GAJIRxxvgb0f/8vOA+2T19jq8QkFyRIaweqZbRmEQ=";
+  # no tests in pypi sdist
+  src = fetchFromGitHub {
+    owner = "jstasiak";
+    repo = "python-zeroconf";
+    rev = version;
+    sha256 = "02fvh5ii73rf6pg9x93pc0sl1isx2ivg3d80l6s8h35w2f4g4azf";
   };
 
-  propagatedBuildInputs = [ ifaddr ];
-
-  checkInputs = [ pytestCheckHook ];
+  propagatedBuildInputs = [
+    ifaddr
+  ];
 
-  pytestFlagsArray = [ "zeroconf/test.py" ];
+  checkInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
 
   disabledTests = [
-    # disable tests that expect some sort of networking in the build container
+    # tests that require network interaction
     "test_close_multiple_times"
     "test_launch_and_close"
+    "test_launch_and_close_context_manager"
     "test_launch_and_close_v4_v6"
     "test_launch_and_close_v6_only"
     "test_integration_with_listener_ipv6"
@@ -36,7 +45,10 @@ buildPythonPackage rec {
 
   __darwinAllowLocalNetworking = true;
 
-  pythonImportsCheck = [ "zeroconf" ];
+  pythonImportsCheck = [
+    "zeroconf"
+    "zeroconf.asyncio"
+  ];
 
   meta = with lib; {
     description = "Python implementation of multicast DNS service discovery";
diff --git a/pkgs/development/python-modules/zha-quirks/default.nix b/pkgs/development/python-modules/zha-quirks/default.nix
index 37fbc87f3f7..89db9de12b7 100644
--- a/pkgs/development/python-modules/zha-quirks/default.nix
+++ b/pkgs/development/python-modules/zha-quirks/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "zha-quirks";
-  version = "0.0.58";
+  version = "0.0.59";
 
   src = fetchFromGitHub {
     owner = "zigpy";
     repo = "zha-device-handlers";
     rev = version;
-    sha256 = "sha256-QU5ssbnT3/gioQ3vM9zvlbwxqSWyKIylsV9NuFkNe+Q=";
+    sha256 = "1x6s44apl393as847ghbqr26h0y0h4w3wp53bs0m2nfbzjwin3i7";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/zigpy-znp/default.nix b/pkgs/development/python-modules/zigpy-znp/default.nix
index 894539a3e2e..71f102f3667 100644
--- a/pkgs/development/python-modules/zigpy-znp/default.nix
+++ b/pkgs/development/python-modules/zigpy-znp/default.nix
@@ -4,6 +4,7 @@
 , buildPythonPackage
 , coloredlogs
 , fetchFromGitHub
+, fetchpatch
 , jsonschema
 , pyserial
 , pyserial-asyncio
@@ -27,6 +28,14 @@ buildPythonPackage rec {
     sha256 = "152d803jfrvkj4namni41fnbbnq85wd7zsqjhmkwrrmn2gvqjiln";
   };
 
+  patches = [
+    (fetchpatch {
+      # Fixes tests/application/test_joining.py::test_new_device_join_and_bind_complex[FormedLaunchpadCC26X2R1]
+      url = "https://github.com/zigpy/zigpy-znp/commit/582cffb68fdf0c5bc14d55efca2a683222d7fed7.patch";
+      sha256 = "0qsfziqqjnnf21gdqv3wwk50vni46i0h1liw5ysq641yjfnas9az";
+    })
+  ];
+
   propagatedBuildInputs = [
     async-timeout
     coloredlogs
diff --git a/pkgs/development/python-modules/zigpy/default.nix b/pkgs/development/python-modules/zigpy/default.nix
index f03b9e96759..2778581566f 100644
--- a/pkgs/development/python-modules/zigpy/default.nix
+++ b/pkgs/development/python-modules/zigpy/default.nix
@@ -15,13 +15,13 @@
 
 buildPythonPackage rec {
   pname = "zigpy";
-  version = "0.33.0";
+  version = "0.35.1";
 
   src = fetchFromGitHub {
     owner = "zigpy";
     repo = "zigpy";
     rev = version;
-    sha256 = "sha256-oEf4GnvbQ6LY4NaNFWRmnNz1TK2tMpIVUxskhU38g4w=";
+    sha256 = "0y5sv8zzlkjwimknpld3fakl22cfkqv0cnw0immb7k4zb9xmls2v";
   };
 
   propagatedBuildInputs = [
@@ -40,6 +40,21 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # RuntimeError: coroutine 'test_remigrate_forcibly_downgraded_v4' was never awaited
+    "test_remigrate_forcibly_downgraded_v4"
+    # RuntimeError: Event loop is closed
+    "test_startup"
+  ];
+
+  pythonImportsCheck = [
+    "zigpy.application"
+    "zigpy.config"
+    "zigpy.exceptions"
+    "zigpy.types"
+    "zigpy.zcl"
+  ];
+
   meta = with lib; {
     description = "Library implementing a ZigBee stack";
     homepage = "https://github.com/zigpy/zigpy";
diff --git a/pkgs/development/tools/async-profiler/default.nix b/pkgs/development/tools/async-profiler/default.nix
index 66177d3a34f..3f31b921831 100644
--- a/pkgs/development/tools/async-profiler/default.nix
+++ b/pkgs/development/tools/async-profiler/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "async-profiler";
-  version = "1.8.5";
+  version = "1.8.6";
 
   src = fetchFromGitHub {
     owner = "jvm-profiling-tools";
     repo = "async-profiler";
     rev = "v${version}";
-    sha256 = "sha256-vSBueRNraMgLcaprPsBUriX3WZ7N0UrllnSVLL2F738=";
+    sha256 = "sha256-MtRO0tbo4kDHcQmir8ulv0q1Qh+KnKIshb1NDtu1SKg=";
   };
 
   buildInputs = [ jdk8 ];
diff --git a/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix b/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix
index a8d35a44bb9..b32eed9a166 100644
--- a/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix
+++ b/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix
@@ -3,13 +3,13 @@
   nixosTests }:
 buildGoModule rec {
   name = "buildkite-agent-${version}";
-  version = "3.30.0";
+  version = "3.31.0";
 
   src = fetchFromGitHub {
     owner = "buildkite";
     repo = "agent";
     rev = "v${version}";
-    sha256 = "sha256-U2UnT41IpICy08jPQkr25wjAL1kBxiQCD4lysYnLAPk=";
+    sha256 = "sha256-Rot5A2zSEleTifadHEvAlydchzCdDo/VPZELostDfng=";
   };
 
   vendorSha256 = "sha256-n3XRxpEKjHf7L7fcGscWTVKBtot9waZbLoS9cG0kHfI=";
diff --git a/pkgs/development/tools/continuous-integration/github-runner/default.nix b/pkgs/development/tools/continuous-integration/github-runner/default.nix
index b03dcc89d44..e2d40630905 100644
--- a/pkgs/development/tools/continuous-integration/github-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/github-runner/default.nix
@@ -20,7 +20,7 @@
 }:
 let
   pname = "github-actions-runner";
-  version = "2.278.0";
+  version = "2.279.0";
 
   deps = (import ./deps.nix { inherit fetchurl; });
   nugetPackages = map
@@ -41,6 +41,10 @@ let
     # Online tests
     (x: "FullyQualifiedName!=GitHub.Runner.Common.Tests.Worker.ActionManagerL0.PrepareActions_${x}")
     [
+      "CompositeActionWithActionfile_CompositeContainerNested"
+      "CompositeActionWithActionfile_CompositePrestepNested"
+      "CompositeActionWithActionfile_MaxLimit"
+      "CompositeActionWithActionfile_Node"
       "DownloadActionFromGraph"
       "DownloadActionFromGraph_Legacy"
       "NotPullOrBuildImagesMultipleTimes"
@@ -80,8 +84,8 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "actions";
     repo = "runner";
-    rev = "62d926efce35d3ea16d7624a25aaa5b300737def"; # v${version}
-    sha256 = "sha256-KAb14739DYnuNIf7ZNZk5CShye6XFGn8aLu8BAcuT/c=";
+    rev = "6b75179ec79e2041b3b5b4e9206b73db2d206aac"; # v${version}
+    sha256 = "sha256-d7LAHL8Ff7R++d1HuLxWjtiBZRogySe7xHY/xJAcFms=";
   };
 
   nativeBuildInputs = [
@@ -123,6 +127,11 @@ stdenv.mkDerivation rec {
       --replace 'dotnet test Test/Test.csproj' \
                 "dotnet test Test/Test.csproj --filter '${testFilterXml}'"
 
+    # We don't use a Git checkout
+    substituteInPlace src/dir.proj \
+      --replace 'git update-index --assume-unchanged ./Runner.Sdk/BuildConstants.cs' \
+                'echo Patched out.'
+
     # Fix FHS path
     substituteInPlace src/Test/L0/Util/IOUtilL0.cs \
       --replace '/bin/ln' '${coreutils}/bin/ln'
diff --git a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
index e89c784df74..ff5799df4ac 100644
--- a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
@@ -1,16 +1,16 @@
 { lib, buildGoPackage, fetchFromGitLab, fetchurl }:
 
 let
-  version = "14.0.1";
+  version = "14.1.0";
   # Gitlab runner embeds some docker images these are prebuilt for arm and x86_64
   docker_x86_64 = fetchurl {
     url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/binaries/gitlab-runner-helper/gitlab-runner-helper.x86_64";
-    sha256 = "1i1fddsz7cr0kg4bxqisx29cwyd07zqfbpmh5mhvi5zqy0gfmcn8";
+    sha256 = "09p0biig07plf9qiwpsdllh6midi8kzpzk2s71rmms491g4634k2";
   };
 
   docker_arm = fetchurl {
     url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/binaries/gitlab-runner-helper/gitlab-runner-helper.arm";
-    sha256 = "1d2ywc3cikffiwpql2kp5zg21vjinz51f76c6wdn0v35wl705fz4";
+    sha256 = "0z5q5y9lsznwglpg7sd5af51v9640m85v4x4dcj5j37w24bi4wq0";
   };
 in
 buildGoPackage rec {
@@ -30,7 +30,7 @@ buildGoPackage rec {
     owner = "gitlab-org";
     repo = "gitlab-runner";
     rev = "v${version}";
-    sha256 = "1prvmppq5w897bd9ch5z0h6h8mndy6myv8al24cr0bjc27c6wyn7";
+    sha256 = "1v2yxs92awwn4m6hq6wc53whfmk6fr4l6j87amcbdzcm4ikzxcvk";
   };
 
   patches = [ ./fix-shell-path.patch ];
diff --git a/pkgs/development/tools/database/sqldeveloper/default.nix b/pkgs/development/tools/database/sqldeveloper/default.nix
index 2e361076ae4..ef95263185c 100644
--- a/pkgs/development/tools/database/sqldeveloper/default.nix
+++ b/pkgs/development/tools/database/sqldeveloper/default.nix
@@ -79,6 +79,6 @@ in
     homepage = "http://www.oracle.com/technetwork/developer-tools/sql-developer/overview/";
     license = licenses.unfree;
     platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ ardumont ma27 ];
+    maintainers = with maintainers; [ ardumont ];
   };
 }
diff --git a/pkgs/development/tools/delve/default.nix b/pkgs/development/tools/delve/default.nix
index 9a0d19840e4..57f30ec3ae4 100644
--- a/pkgs/development/tools/delve/default.nix
+++ b/pkgs/development/tools/delve/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "delve";
-  version = "1.6.1";
+  version = "1.7.0";
 
   goPackagePath = "github.com/go-delve/delve";
   excludedPackages = "\\(_fixtures\\|scripts\\|service/test\\)";
@@ -11,7 +11,7 @@ buildGoPackage rec {
     owner = "go-delve";
     repo = "delve";
     rev = "v${version}";
-    sha256 = "sha256-bTVCasemE8Vyjcs8wZBiiXEsW3UBndjpPQ5bi+4vQkw=";
+    sha256 = "sha256-RfBDeBuI/Yk24Q2jX/Re7fvx1bhYWJjqLhRkNHCaM9k=";
   };
 
   subPackages = [ "cmd/dlv" ];
diff --git a/pkgs/development/tools/kubie/default.nix b/pkgs/development/tools/kubie/default.nix
index c563d9bef09..5c86b9a2406 100644
--- a/pkgs/development/tools/kubie/default.nix
+++ b/pkgs/development/tools/kubie/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kubie";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "sbstp";
     repo = "kubie";
-    sha256 = "sha256-uNlKxcU1iCR4JzNfBatEeKMMdu9ZqvOqna0sGrcwK30=";
+    sha256 = "sha256-jv5IhTxusB74pnpoopl+fKnXDJI/65D8PSuhGVgbDyo=";
   };
 
-  cargoSha256 = "sha256-4Xo17HlYvJLf90R0gS9EFJSJKmNHClXqAJTx9mY29KA=";
+  cargoSha256 = "sha256-6SaW3wqhn251GaH3GRNaSqRLnbQimDBRSt+RPgJG1M8=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/misc/go-md2man/default.nix b/pkgs/development/tools/misc/go-md2man/default.nix
index fe43da91b54..8c43fe7f594 100644
--- a/pkgs/development/tools/misc/go-md2man/default.nix
+++ b/pkgs/development/tools/misc/go-md2man/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "go-md2man";
-  version = "2.0.0";
+  version = "2.0.1";
 
   vendorSha256 = null;
 
@@ -10,7 +10,7 @@ buildGoModule rec {
     rev = "v${version}";
     owner = "cpuguy83";
     repo = "go-md2man";
-    sha256 = "0r1f7v475dxxgzqci1mxfliwadcrk86ippflx9n411325l4g3ghv";
+    sha256 = "sha256-DnXWnHWtczNnLaQg9Wnp9U/K4h/FbhqGgba44P6VNBQ=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/tools/misc/terraform-ls/default.nix b/pkgs/development/tools/misc/terraform-ls/default.nix
index f48c6f9e0b6..86afbcc9421 100644
--- a/pkgs/development/tools/misc/terraform-ls/default.nix
+++ b/pkgs/development/tools/misc/terraform-ls/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "terraform-ls";
-  version = "0.19.0";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-q97N9I1EzpcFlMuHe3X5rfZHt6XTytYO1inpGEvv1IQ=";
+    sha256 = "sha256-ag8Dq3lhLoKE4rgrnWLHtKRHEnw/ytyXI+pRt5CgZJI=";
   };
-  vendorSha256 = "sha256-7XcAt0+slNIjxxf7pUl7XO/PAN2z8WmzTuI0FsjgrBM=";
+  vendorSha256 = "sha256-/lpjlThr6HPkuJ6om9ifBsdsh0x4kVXM6PAonk7GJCY=";
 
   ldflags = [ "-s" "-w" "-X main.version=v${version}" "-X main.prerelease=" ];
 
diff --git a/pkgs/development/tools/pscale/default.nix b/pkgs/development/tools/pscale/default.nix
index 14518939dcd..483a85db02a 100644
--- a/pkgs/development/tools/pscale/default.nix
+++ b/pkgs/development/tools/pscale/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "pscale";
-  version = "0.58.0";
+  version = "0.60.0";
 
   src = fetchFromGitHub {
     owner = "planetscale";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-9XVvdAt/TWQdCY8s//QHZC6THFAf+pMYQpjHjUR3wrc=";
+    sha256 = "sha256-hrWSieWeVAg28f3Fh9mElr+mDh4v4T5JI1c3+Hrm7c0=";
   };
 
-  vendorSha256 = "sha256-m6eQ843aP68TO4W5Nq4zKqcf2wgdH/7Srzt37t/NSdk=";
+  vendorSha256 = "sha256-h4YUQWmFYouEvHup8Pu6OqfHf1EoPszVFzklU9SbJZQ=";
 
   meta = with lib; {
     homepage = "https://www.planetscale.com/";
diff --git a/pkgs/development/tools/rgp/default.nix b/pkgs/development/tools/rgp/default.nix
index 7b49a83b1cc..7b8ac88de63 100644
--- a/pkgs/development/tools/rgp/default.nix
+++ b/pkgs/development/tools/rgp/default.nix
@@ -12,22 +12,22 @@
 , libX11
 , libxcb
 , libXi
-, ncurses5
+, ncurses
 , qtbase
 , qtdeclarative
 , zlib
 }:
 
 let
-  buildNum = "2021-03-31-696";
+  buildNum = "2021-06-30-819";
 in
 stdenv.mkDerivation rec {
   pname = "rgp";
-  version = "1.10";
+  version = "1.11";
 
   src = fetchurl {
     url = "https://gpuopen.com/download/radeon-developer-tool-suite/RadeonDeveloperToolSuite-${buildNum}.tgz";
-    sha256 = "1GUV75KpYbeq7KkE86QqTfGnf/t3VEgviaAsbg/LWJI=";
+    sha256 = "ru+e/oY844x4nvSVRBrTGDdnzUOBhwkaIrnftBITyE8=";
   };
 
   nativeBuildInputs = [ makeWrapper autoPatchelfHook ];
@@ -42,17 +42,12 @@ stdenv.mkDerivation rec {
     libX11
     libxcb
     libXi
-    ncurses5
+    ncurses
     qtbase
     qtdeclarative
     zlib
   ];
 
-  runtimeDependencies = [
-    "${placeholder "out"}/opt/rgp"
-    "${placeholder "out"}/opt/rgp/qt"
-  ];
-
   dontWrapQtApps = true;
 
   installPhase = ''
diff --git a/pkgs/development/tools/rust/cargo-watch/default.nix b/pkgs/development/tools/rust/cargo-watch/default.nix
index 017fb7d484d..c7cdf92dcd8 100644
--- a/pkgs/development/tools/rust/cargo-watch/default.nix
+++ b/pkgs/development/tools/rust/cargo-watch/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-watch";
-  version = "7.8.0";
+  version = "7.8.1";
 
   src = fetchFromGitHub {
     owner = "passcod";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ZbVBwSg3roIMA+5LVP3omtTgbAJ7HAdJDXyAybWuRLw=";
+    sha256 = "sha256-g6k/7jo8pvTn5snU05uSGzprNMt8/x+bJsLb/y0jHRg=";
   };
 
-  cargoSha256 = "sha256-6aoi/CLla/yKa5RuVgn8RJ9AK1j1wtZeBn+6tpXrJvA=";
+  cargoSha256 = "sha256-pfjWTkDw4D7eMADkPX01vapka8I6o0ZvkNjQt5X2pUk=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices libiconv ];
 
diff --git a/pkgs/development/web/flyctl/default.nix b/pkgs/development/web/flyctl/default.nix
index 3c61121b035..8828b0222cc 100644
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.0.228";
+  version = "0.0.229";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    sha256 = "sha256-h8ZiAabB0IIJoeQMMvOO1lQNMdFYAoTXKcTAPmLP5Sw=";
+    sha256 = "sha256-mw+rTMFj41+T6lDe/MOQpmRcjt/gJhOCfaHcBkpjcsg=";
   };
 
   preBuild = ''
diff --git a/pkgs/games/factorio/versions.json b/pkgs/games/factorio/versions.json
index 98c58191f16..500181ff70e 100644
--- a/pkgs/games/factorio/versions.json
+++ b/pkgs/games/factorio/versions.json
@@ -10,12 +10,12 @@
         "version": "1.1.36"
       },
       "stable": {
-        "name": "factorio_alpha_x64-1.1.35.tar.xz",
+        "name": "factorio_alpha_x64-1.1.36.tar.xz",
         "needsAuth": true,
-        "sha256": "1svjjpyffdrmll1b3icsrikfi4v2r1z6j7iqq0v36iq0zw7vw3bk",
+        "sha256": "1x9a2lv6zbqawqlxg8bcbx04hjy0pq40macfa4sqi8w6h14wgww8",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.35/alpha/linux64",
-        "version": "1.1.35"
+        "url": "https://factorio.com/get-download/1.1.36/alpha/linux64",
+        "version": "1.1.36"
       }
     },
     "demo": {
@@ -28,12 +28,12 @@
         "version": "1.1.35"
       },
       "stable": {
-        "name": "factorio_demo_x64-1.1.35.tar.xz",
+        "name": "factorio_demo_x64-1.1.36.tar.xz",
         "needsAuth": false,
-        "sha256": "0yqb4gf2avpxr4vwafws9pv74xyd9g84zggfikfc801ldc7sp29f",
+        "sha256": "15fl4pza7n107rrmmdm26kkc12fnrmpn6rjb4ampgzqzn1fq854s",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.35/demo/linux64",
-        "version": "1.1.35"
+        "url": "https://factorio.com/get-download/1.1.36/demo/linux64",
+        "version": "1.1.36"
       }
     },
     "headless": {
@@ -46,12 +46,12 @@
         "version": "1.1.36"
       },
       "stable": {
-        "name": "factorio_headless_x64-1.1.35.tar.xz",
+        "name": "factorio_headless_x64-1.1.36.tar.xz",
         "needsAuth": false,
-        "sha256": "0xpiw89ad6cfpc576g5jpsyzwjncs3jrx01056p52wj01747fm94",
+        "sha256": "1s8g030xp5nrlmnn21frrd8n4nd7jjmb5hbpj1vhxjrk6vpijh24",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.35/headless/linux64",
-        "version": "1.1.35"
+        "url": "https://factorio.com/get-download/1.1.36/headless/linux64",
+        "version": "1.1.36"
       }
     }
   }
diff --git a/pkgs/games/simutrans/default.nix b/pkgs/games/simutrans/default.nix
index fc2654fd8e9..60b2bc5faf7 100644
--- a/pkgs/games/simutrans/default.nix
+++ b/pkgs/games/simutrans/default.nix
@@ -11,28 +11,28 @@ let
       else map (name: pakSpec.${name}) (splitString " " paksets)
   );
 
-  ver1 = "120";
-  ver2 = "4";
-  ver3 = "1";
-  version =   "${ver1}.${ver2}.${ver3}";
-  ver_dash =  "${ver1}-${ver2}-${ver3}";
+  ver1 = "121";
+  ver2 = "0";
+  ver3 = "";
+  version  = "${ver1}.${ver2}${lib.optionalString (ver3 != "") ".${ver3}"}";
+  ver_dash = "${ver1}-${ver2}${lib.optionalString (ver3 != "") "-${ver3}"}";
 
   binary_src = fetchurl {
     url = "mirror://sourceforge/simutrans/simutrans/${ver_dash}/simutrans-src-${ver_dash}.zip";
-    sha256 = "0yw7vjvmczp022mgk35swwhpbiszpz91mwsgicxglwivgc30vvic";
+    sha256 = "1f463r6kr5ig0zd3mncc74k93xbjywsq3d06j5r17831jyc9bzb9";
   };
 
 
-  # As of 2015/03, many packsets still didn't have a release for version 120.
+  # As of 2021/07, many of these paksets have not been updated for years, so are on old versions.
   pakSpec = lib.mapAttrs
     (pakName: attrs: mkPak (attrs // {inherit pakName;}))
   {
     pak64 = {
-      srcPath = "121-0/simupak64-121-0";
+      srcPath = "${ver_dash}/simupak64-${ver_dash}";
       sha256 = "1k335kh8dhm1hdn5iwn3sdgnrlpk0rqxmmgqgqcwsi09cmw45m5c";
     };
     "pak64.japan" = {
-      # No release for 120.2 yet!
+      # No release for 121.0 yet!
       srcPath = "120-0/simupak64.japan-120-0-1";
       sha256 = "14swy3h4ij74bgaw7scyvmivfb5fmp21nixmhlpk3mav3wr3167i";
     };
diff --git a/pkgs/games/zandronum/sqlite.nix b/pkgs/games/zandronum/sqlite.nix
index c9baefcf0af..e38dedbb7f7 100644
--- a/pkgs/games/zandronum/sqlite.nix
+++ b/pkgs/games/zandronum/sqlite.nix
@@ -9,8 +9,6 @@ stdenv.mkDerivation {
     sha256 = "0p5cx7nbjxk7glcm277ypi5w4gv144qazw79ql47svlpccj62mrp";
   };
 
-  phases = [ "unpackPhase" "buildPhase" ];
-
   buildPhase = ''
     mkdir -p $out
     cp sqlite3.c $out/
diff --git a/pkgs/misc/emulators/punes/default.nix b/pkgs/misc/emulators/punes/default.nix
index c0bf7a223a3..d3ad2f68199 100644
--- a/pkgs/misc/emulators/punes/default.nix
+++ b/pkgs/misc/emulators/punes/default.nix
@@ -12,18 +12,20 @@
 , ffmpeg
 , libGLU
 , alsa-lib
+, libX11
+, libXrandr
 , sndio
 }:
 
 mkDerivation rec {
   pname = "punes";
-  version = "unstable-2021-06-05";
+  version = "unstable-2021-07-19";
 
   src = fetchFromGitHub {
     owner = "punesemu";
     repo = "puNES";
-    rev = "07fd123f62b2d075894a0cc966124db7b427b791";
-    sha256 = "1wxff7b397ayd2s2v14w6a0zfgklc7y0kv3mkz1gg5x47mnll24l";
+    rev = "15ab85dabb220889419df0c249c06f3db2b09dc0";
+    sha256 = "1w0c5lfdl9ha4sxxva6hcpcaa444px6x25471q37l69n71rmjpy8";
   };
 
   postPatch = ''
@@ -34,7 +36,7 @@ mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook cmake pkg-config qttools ];
 
   buildInputs = [ ffmpeg qtbase qtsvg libGLU ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ alsa-lib ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [ alsa-lib libX11 libXrandr ]
     ++ lib.optionals stdenv.hostPlatform.isBSD [ sndio ];
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/misc/tmux-plugins/default.nix b/pkgs/misc/tmux-plugins/default.nix
index 60d6545ae5f..b4978e200ab 100644
--- a/pkgs/misc/tmux-plugins/default.nix
+++ b/pkgs/misc/tmux-plugins/default.nix
@@ -127,12 +127,12 @@ in rec {
 
   dracula = mkTmuxPlugin rec {
     pluginName = "dracula";
-    version = "1.0.1";
+    version = "2.0.0";
     src = fetchFromGitHub {
       owner = "dracula";
       repo = "tmux";
       rev = "v${version}";
-      sha256 = "sha256-hq+sKA/EkiKia/31SY1zYPz/bxLuwm6sSrGlip1DULw=";
+      sha256 = "ILs+GMltb2AYNUecFMyQZ/AuETB0PCFF2InSnptVBos=";
     };
     meta = with lib; {
       homepage = "https://draculatheme.com/tmux";
diff --git a/pkgs/servers/bazarr/default.nix b/pkgs/servers/bazarr/default.nix
index 7e734940885..d15844e682e 100644
--- a/pkgs/servers/bazarr/default.nix
+++ b/pkgs/servers/bazarr/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bazarr";
-  version = "0.9.5";
+  version = "0.9.6";
 
   src = fetchurl {
     url = "https://github.com/morpheus65535/bazarr/archive/v${version}.tar.gz";
-    sha256 = "sha256-N0HoZgAtWPgYPU9OWpMEXO2qUoNIGCsFn9vll0hLal0=";
+    sha256 = "sha256-aO9PIE/YlSIGEcntDCdxIYuuvV5jG266ldhC2QfT+e4=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/code-server/default.nix b/pkgs/servers/code-server/default.nix
index 8370dfb16a5..039f0578569 100644
--- a/pkgs/servers/code-server/default.nix
+++ b/pkgs/servers/code-server/default.nix
@@ -46,7 +46,6 @@ in stdenv.mkDerivation rec {
   yarnCache = stdenv.mkDerivation {
     name = "${pname}-${version}-${system}-yarn-cache";
     inherit src;
-    phases = ["unpackPhase" "buildPhase"];
     nativeBuildInputs = [ yarn' git ];
     buildPhase = ''
       export HOME=$PWD
diff --git a/pkgs/servers/home-assistant/0001-tests-ignore-OSErrors-in-hass-fixture.patch b/pkgs/servers/home-assistant/0001-tests-ignore-OSErrors-in-hass-fixture.patch
new file mode 100644
index 00000000000..add0ea1d552
--- /dev/null
+++ b/pkgs/servers/home-assistant/0001-tests-ignore-OSErrors-in-hass-fixture.patch
@@ -0,0 +1,27 @@
+From 3e3f5c37252a33ea1e71c39f2ca0f13940c261ad Mon Sep 17 00:00:00 2001
+From: Martin Weinelt <hexa@darmstadt.ccc.de>
+Date: Sat, 17 Jul 2021 16:11:23 +0200
+Subject: [PATCH] tests: ignore OSErrors in hass fixture
+
+The nix sandbox will cause OSErrors due to limitations imposed on
+network interaction. This change makes it so we forgive these cases.
+---
+ tests/conftest.py | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tests/conftest.py b/tests/conftest.py
+index 1f5ffc80d0..b284727a0f 100644
+--- a/tests/conftest.py
++++ b/tests/conftest.py
+@@ -168,6 +168,8 @@ def hass(loop, load_registries, hass_storage, request):
+             continue
+         if isinstance(ex, ServiceNotFound):
+             continue
++        if isinstance(ex, OSError):
++            continue
+         raise ex
+ 
+ 
+-- 
+2.32.0
+
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 675d9b43757..2190bd6b278 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2021.6.6";
+  version = "2021.7.0";
   components = {
     "abode" = ps: with ps; [ abodepy ];
     "accuweather" = ps: with ps; [ accuweather ];
@@ -27,6 +27,7 @@
     "almond" = ps: with ps; [ aiohttp-cors pyalmond ];
     "alpha_vantage" = ps: with ps; [ alpha-vantage ];
     "amazon_polly" = ps: with ps; [ boto3 ];
+    "ambee" = ps: with ps; [ ambee ];
     "ambiclimate" = ps: with ps; [ aiohttp-cors ambiclimate ];
     "ambient_station" = ps: with ps; [ aioambient ];
     "amcrest" = ps: with ps; [ amcrest ha-ffmpeg ];
@@ -90,7 +91,7 @@
     "blueprint" = ps: with ps; [ ];
     "bluesound" = ps: with ps; [ xmltodict ];
     "bluetooth_le_tracker" = ps: with ps; [ pygatt ];
-    "bluetooth_tracker" = ps: with ps; [ bt_proximity pybluez ];
+    "bluetooth_tracker" = ps: with ps; [ bt-proximity pybluez ];
     "bme280" = ps: with ps; [ smbus-cffi ]; # missing inputs: i2csense
     "bme680" = ps: with ps; [ bme680 smbus-cffi ];
     "bmp280" = ps: with ps; [ ]; # missing inputs: RPi.GPIO adafruit-circuitpython-bmp280
@@ -157,7 +158,7 @@
     "deconz" = ps: with ps; [ pydeconz ];
     "decora" = ps: with ps; [ bluepy ]; # missing inputs: decora
     "decora_wifi" = ps: with ps; [ ]; # missing inputs: decora_wifi
-    "default_config" = ps: with ps; [ pynacl aiodiscover aiohttp-cors async-upnp-client defusedxml distro emoji hass-nabucasa home-assistant-frontend ifaddr netdisco pillow scapy sqlalchemy zeroconf ];
+    "default_config" = ps: with ps; [ pynacl aiodiscover aiohttp-cors async-upnp-client defusedxml distro emoji hass-nabucasa home-assistant-frontend ifaddr pillow scapy sqlalchemy zeroconf ];
     "delijn" = ps: with ps; [ pydelijn ];
     "deluge" = ps: with ps; [ deluge-client ];
     "demo" = ps: with ps; [ aiohttp-cors ];
@@ -276,6 +277,7 @@
     "folder" = ps: with ps; [ ];
     "folder_watcher" = ps: with ps; [ watchdog ];
     "foobot" = ps: with ps; [ foobot-async ];
+    "forecast_solar" = ps: with ps; [ forecast-solar ];
     "forked_daapd" = ps: with ps; [ ]; # missing inputs: pyforked-daapd pylibrespot-java
     "fortios" = ps: with ps; [ fortiosapi ];
     "foscam" = ps: with ps; [ libpyfoscam ];
@@ -283,7 +285,8 @@
     "free_mobile" = ps: with ps; [ ]; # missing inputs: freesms
     "freebox" = ps: with ps; [ freebox-api ];
     "freedns" = ps: with ps; [ ];
-    "fritz" = ps: with ps; [ fritzconnection ];
+    "freedompro" = ps: with ps; [ pyfreedompro ];
+    "fritz" = ps: with ps; [ aiohttp-cors fritzconnection fritzprofiles ifaddr xmltodict ];
     "fritzbox" = ps: with ps; [ pyfritzhome ];
     "fritzbox_callmonitor" = ps: with ps; [ fritzconnection ];
     "fritzbox_netmonitor" = ps: with ps; [ fritzconnection ];
@@ -520,6 +523,7 @@
     "mochad" = ps: with ps; [ ]; # missing inputs: pymochad
     "modbus" = ps: with ps; [ pymodbus ];
     "modem_callerid" = ps: with ps; [ ]; # missing inputs: basicmodem
+    "modern_forms" = ps: with ps; [ aiomodernforms ];
     "mold_indicator" = ps: with ps; [ ];
     "monoprice" = ps: with ps; [ ]; # missing inputs: pymonoprice
     "moon" = ps: with ps; [ ];
@@ -732,6 +736,7 @@
     "scsgate" = ps: with ps; [ ]; # missing inputs: scsgate
     "search" = ps: with ps; [ aiohttp-cors ];
     "season" = ps: with ps; [ ephem ];
+    "select" = ps: with ps; [ ];
     "sendgrid" = ps: with ps; [ sendgrid ];
     "sense" = ps: with ps; [ sense-energy ];
     "sensehat" = ps: with ps; [ ]; # missing inputs: sense-hat
@@ -742,7 +747,7 @@
     "serial_pm" = ps: with ps; [ pmsensor ];
     "sesame" = ps: with ps; [ ]; # missing inputs: pysesame2
     "seven_segments" = ps: with ps; [ pillow ];
-    "seventeentrack" = ps: with ps; [ ]; # missing inputs: py17track
+    "seventeentrack" = ps: with ps; [ py17track ];
     "sharkiq" = ps: with ps; [ sharkiqpy ];
     "shell_command" = ps: with ps; [ ];
     "shelly" = ps: with ps; [ aioshelly ];
@@ -788,7 +793,7 @@
     "somfy_mylink" = ps: with ps; [ somfy-mylink-synergy ];
     "sonarr" = ps: with ps; [ sonarr ];
     "songpal" = ps: with ps; [ python-songpal ];
-    "sonos" = ps: with ps; [ aiohttp-cors plexapi plexauth plexwebsocket pysonos ];
+    "sonos" = ps: with ps; [ aiohttp-cors async-upnp-client defusedxml ifaddr plexapi plexauth plexwebsocket pysonos zeroconf ];
     "sony_projector" = ps: with ps; [ ]; # missing inputs: pysdcp
     "soundtouch" = ps: with ps; [ aiohttp-cors ifaddr libsoundtouch zeroconf ];
     "spaceapi" = ps: with ps; [ aiohttp-cors ];
@@ -800,7 +805,7 @@
     "sql" = ps: with ps; [ sqlalchemy ];
     "squeezebox" = ps: with ps; [ pysqueezebox ];
     "srp_energy" = ps: with ps; [ srpenergy ];
-    "ssdp" = ps: with ps; [ aiohttp-cors async-upnp-client defusedxml ifaddr netdisco zeroconf ];
+    "ssdp" = ps: with ps; [ aiohttp-cors async-upnp-client defusedxml ifaddr zeroconf ];
     "starline" = ps: with ps; [ starline ];
     "starlingbank" = ps: with ps; [ ]; # missing inputs: starlingbank
     "startca" = ps: with ps; [ xmltodict ];
@@ -907,7 +912,7 @@
     "upc_connect" = ps: with ps; [ connect-box ];
     "upcloud" = ps: with ps; [ upcloud-api ];
     "updater" = ps: with ps; [ distro ];
-    "upnp" = ps: with ps; [ async-upnp-client ];
+    "upnp" = ps: with ps; [ aiohttp-cors async-upnp-client defusedxml ifaddr zeroconf ];
     "uptime" = ps: with ps; [ ];
     "uptimerobot" = ps: with ps; [ ]; # missing inputs: pyuptimerobot
     "uscis" = ps: with ps; [ ]; # missing inputs: uscisstatus
@@ -972,13 +977,13 @@
     "xeoma" = ps: with ps; [ pyxeoma ];
     "xiaomi" = ps: with ps; [ ha-ffmpeg ];
     "xiaomi_aqara" = ps: with ps; [ pyxiaomigateway aiohttp-cors ifaddr netdisco zeroconf ];
-    "xiaomi_miio" = ps: with ps; [ construct python-miio ];
+    "xiaomi_miio" = ps: with ps; [ construct micloud python-miio ];
     "xiaomi_tv" = ps: with ps; [ pymitv ];
     "xmpp" = ps: with ps; [ slixmpp ];
     "xs1" = ps: with ps; [ ]; # missing inputs: xs1-api-client
     "yale_smart_alarm" = ps: with ps; [ yalesmartalarmclient ];
     "yamaha" = ps: with ps; [ rxv ];
-    "yamaha_musiccast" = ps: with ps; [ ]; # missing inputs: pymusiccast
+    "yamaha_musiccast" = ps: with ps; [ aiomusiccast ];
     "yandex_transport" = ps: with ps; [ aioymaps ];
     "yandextts" = ps: with ps; [ ];
     "yeelight" = ps: with ps; [ yeelight ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index c9a4a15a87c..36af74cc162 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -22,19 +22,7 @@
 let
   defaultOverrides = [
     # Override the version of some packages pinned in Home Assistant's setup.py and requirements_all.txt
-
-    # Pinned due to API changes in aiopvpc>=2.2.0, remove after 2021.7.0
-    (self: super: {
-      aiopvpc = super.aiopvpc.overridePythonAttrs (oldAttr: rec {
-        version = "2.1.2";
-        src = fetchFromGitHub {
-          owner = "azogue";
-          repo = "aiopvpc";
-          rev = "v${version}";
-          sha256 = "0s8ki46dh39kw6qvsjcfcxa0gblyi33m3hry137kbi4lw5ws6qhr";
-        };
-      });
-    })
+    (mkOverride "python-slugify" "4.0.1" "69a517766e00c1268e5bbfc0d010a0a8508de0b18d30ad5a1ff357f8ae724270")
 
     # Pinned due to API changes in iaqualink>=2.0, remove after
     # https://github.com/home-assistant/core/pull/48137 was merged
@@ -70,19 +58,6 @@ let
     (mkOverride "ring-doorbell" "0.6.2"
       "fbd537722a27b3b854c26506d894b7399bb8dc57ff36083285971227a2d46560")
 
-    # Pinned due to API changes in pyatmo>=5.1.0
-    (self: super: {
-      pyatmo = super.pyatmo.overridePythonAttrs (oldAttrs: rec {
-        version = "5.0.1";
-        src = fetchFromGitHub {
-          owner = "jabesq";
-          repo = "pyatmo";
-          rev = "v${version}";
-          sha256 = "0can9v602iqfn0l01fd7gr63qzvcngfm0qka4s1x0pldh6avxmfh";
-        };
-      });
-    })
-
     # Pinned due to API changes in pyatv>=0.8.0
     (self: super: {
       pyatv = super.pyatv.overridePythonAttrs (olAttrs: rec {
@@ -149,8 +124,6 @@ let
       });
     })
 
-    (mkOverride "pysma" "0.4.3" "sha256-vriMnJFS7yfTyDT1f4sx1xEBTQjqc4ZHmkdHp1vcd+Q=")
-
     # Pinned due to API changes in eebrightbox>=0.0.5
     (self: super: {
       eebrightbox = super.eebrightbox.overridePythonAttrs (oldAttrs: rec {
@@ -197,7 +170,7 @@ let
   extraBuildInputs = extraPackages py.pkgs;
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2021.6.6";
+  hassVersion = "2021.7.0";
 
 in with py.pkgs; buildPythonApplication rec {
   pname = "homeassistant";
@@ -214,11 +187,12 @@ in with py.pkgs; buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = version;
-    sha256 = "0r8l2qya9pdl65kq3xrnb1vhmbnxm3bj12hn1wyxmw56l8m9l5d5";
+    sha256 = "1dx1pmi0w265pyajmmvd7k6vb5z7s77a7b161zd0n4zsb989dil6";
   };
 
   # leave this in, so users don't have to constantly update their downstream patch handling
   patches = [
+    ./0001-tests-ignore-OSErrors-in-hass-fixture.patch
   ];
 
   postPatch = ''
@@ -673,7 +647,8 @@ in with py.pkgs; buildPythonApplication rec {
     "somfy_mylink"
     "sonarr"
     "songpal"
-    "sonos"
+    # disable sonos components test because they rely on ssdp, which doesn't work in our sandbox
+    # "sonos"
     "soundtouch"
     "spaceapi"
     "speedtestdotnet"
@@ -735,7 +710,8 @@ in with py.pkgs; buildPythonApplication rec {
     "upb"
     "upcloud"
     "updater"
-    "upnp"
+    # disabled, because it tries to join a multicast group and fails to find a usable network interface
+    # "upnp"
     "uptime"
     "usgs_earthquakes_feed"
     "utility_meter"
@@ -751,7 +727,8 @@ in with py.pkgs; buildPythonApplication rec {
     "vizio"
     "voicerss"
     "volumio"
-    "vultr"
+    # disabled, becaused AttributeError: <class 'vultr.vultr.Vultr'> does not have the attribute 'server_list'
+    # "vultr"
     "wake_on_lan"
     "wallbox"
     "water_heater"
@@ -776,7 +753,8 @@ in with py.pkgs; buildPythonApplication rec {
     "yandex_transport"
     "yandextts"
     "yeelight"
-    "zeroconf"
+    # disabled, because it tries to join a multicast group and fails to find a usable network interface
+    # "zeroconf"
     "zerproc"
     "zha"
     "zodiac"
@@ -826,6 +804,8 @@ in with py.pkgs; buildPythonApplication rec {
     # wallbox/test_config_flow.py: Tries to connect to api.wall-box.cim: Failed to establish a new connection: [Errno -2] Name or service not known
     "--deselect tests/components/wallbox/test_config_flow.py::test_form_invalid_auth"
     "--deselect tests/components/wallbox/test_config_flow.py::test_form_cannot_connect"
+    # tests/components/default_config/test_init.py: Tries to check for updates and fails ungracefully without network access
+    "--deselect tests/components/default_config/test_init.py::test_setup"
     # tests are located in tests/
     "tests"
     # dynamically add packages required for component tests
@@ -861,6 +841,10 @@ in with py.pkgs; buildPythonApplication rec {
     "test_onboarding_core_no_rpi_power"
     # hue/test_sensor_base.py: Race condition when counting events
     "test_hue_events"
+    # homekit/test_homekit.py: Tries to use zeroconf, which tries to join a multicast group
+    "test_homekit_uses_system_zeroconf"
+    # august/test_lock.py: AssertionError: assert 'unlocked' == 'locked'
+    "test_lock_update_via_pubnub"
   ];
 
   preCheck = ''
diff --git a/pkgs/servers/home-assistant/frontend.nix b/pkgs/servers/home-assistant/frontend.nix
index f59f3943cd0..a42b13a260d 100644
--- a/pkgs/servers/home-assistant/frontend.nix
+++ b/pkgs/servers/home-assistant/frontend.nix
@@ -4,11 +4,11 @@ buildPythonPackage rec {
   # the frontend version corresponding to a specific home-assistant version can be found here
   # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
   pname = "home-assistant-frontend";
-  version = "20210603.0";
+  version = "20210707.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-2UhbtaxEcOkD9Z5g9gZs+QjuVLXZGCEcmKoxRtIEYxw=";
+    sha256 = "sha256-6RR+T4+vS6g00+MS1ty8aFVx6WM2dE+c17+wDoPxnGg=";
   };
 
   # there is nothing to strip in this package
diff --git a/pkgs/servers/home-assistant/update.sh b/pkgs/servers/home-assistant/update.sh
index 5ed865f411e..8b17dabdfe2 100755
--- a/pkgs/servers/home-assistant/update.sh
+++ b/pkgs/servers/home-assistant/update.sh
@@ -23,10 +23,16 @@ sed -i -e "s/version =.*/version = \"${TARGET_VERSION}\";/" \
 sed -i -e "s/hassVersion =.*/hassVersion = \"${TARGET_VERSION}\";/" \
     default.nix
 
-./parse-requirements.py
 (
+    # update the frontend before running parse-requirements, so it doesn't get shown as outdated
     cd ../../..
     nix-update --version "$FRONTEND_VERSION" home-assistant.python.pkgs.home-assistant-frontend
+)
+
+./parse-requirements.py
+
+(
+    cd ../../..
     nix-update --version "$TARGET_VERSION" --build home-assistant
 )
 
diff --git a/pkgs/servers/http/nix-binary-cache/default.nix b/pkgs/servers/http/nix-binary-cache/default.nix
index 5baba231026..4f26610e10c 100644
--- a/pkgs/servers/http/nix-binary-cache/default.nix
+++ b/pkgs/servers/http/nix-binary-cache/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "2014-06-29-1";
   pname = "nix-binary-cache";
 
-  phases = ["installPhase"];
+  dontUnpack = true;
 
   installPhase = ''
     mkdir -p "$out/bin"
diff --git a/pkgs/servers/imgproxy/default.nix b/pkgs/servers/imgproxy/default.nix
index 601e93a998a..fc099e905e5 100644
--- a/pkgs/servers/imgproxy/default.nix
+++ b/pkgs/servers/imgproxy/default.nix
@@ -3,12 +3,12 @@
 
 buildGoModule rec {
   pname = "imgproxy";
-  version = "2.16.6";
+  version = "2.16.7";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    sha256 = "sha256-wrd8G2y8oepaHMJaU4Bcvkf91ABX4ZapQSlztq4Gg84=";
+    sha256 = "sha256-7UGIkYChXIht/dyMhvPeu8oeGQEA7/Ns7+e56wEmAwQ=";
     rev = "v${version}";
   };
 
diff --git a/pkgs/servers/jackett/default.nix b/pkgs/servers/jackett/default.nix
index 341c9130481..a324dcb58bd 100644
--- a/pkgs/servers/jackett/default.nix
+++ b/pkgs/servers/jackett/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "jackett";
-  version = "0.18.372";
+  version = "0.18.455";
 
   src = fetchurl {
     url = "https://github.com/Jackett/Jackett/releases/download/v${version}/Jackett.Binaries.Mono.tar.gz";
-    sha256 = "sha256-GkAKYxa5F0N9jg9TZrwt3hjkhybZTKU2Ia/gIxBRGuo=";
+    sha256 = "sha256-qEuhgtDtdMCHJtUcUDUmKI8FT0ti7veleI7UhwTAUfE=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/mail/system-sendmail/default.nix b/pkgs/servers/mail/system-sendmail/default.nix
index 28c54fc0fae..76b92299409 100644
--- a/pkgs/servers/mail/system-sendmail/default.nix
+++ b/pkgs/servers/mail/system-sendmail/default.nix
@@ -20,7 +20,9 @@ stdenv.mkDerivation {
 
   src = script;
 
-  phases = [ "buildPhase" ];
+  dontUnpack = true;
+  dontInstall = true;
+
   buildPhase = ''
     mkdir -p $out/bin
     < $src sed "s#{{MYPATH}}#$out/bin/sendmail#" > $out/bin/sendmail
diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index c7894529e2b..b2e61d50656 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -12,11 +12,11 @@ let
 in
 buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.38.0";
+  version = "1.38.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-k9/enFktixO4zvgBW3zw0COBakDP1PHVWAlbMi+FiWQ=";
+    sha256 = "sha256-bGKGzhuDjKaNbjXSwvidk9SrRmJsLQyLe5jps4DXN+s=";
   };
 
   patches = [
diff --git a/pkgs/servers/monitoring/grafana-agent/default.nix b/pkgs/servers/monitoring/grafana-agent/default.nix
index c772b76cf03..4c9d0437d79 100644
--- a/pkgs/servers/monitoring/grafana-agent/default.nix
+++ b/pkgs/servers/monitoring/grafana-agent/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "grafana-agent";
-  version = "0.16.1";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "grafana";
     repo = "agent";
-    sha256 = "0kqbn6fqlrxjqdkkhbr7qmm2m05a7dlskfdb7y4gr5ggi65m6ik5";
+    sha256 = "sha256-rHJGVQWbvgcvwPzt8e2uWs1n4bbaAZz6lQjyvmqmLZw=";
   };
 
-  vendorSha256 = "0xi69a1zkcmi5q8m7lfwp3xb4cbkwc2dzqm24lfqsq13xj5jq6ph";
+  vendorSha256 = "sha256-jA8M8ZdJWmrGRQb0W1duVV+XwxqJVQ/ek0Yhw6JZvX8=";
 
   patches = [
     # https://github.com/grafana/agent/issues/731
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index 4fa00325009..2c8ba20f6d4 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -2,23 +2,23 @@
 
 buildGoModule rec {
   pname = "grafana";
-  version = "8.0.5";
+  version = "8.0.6";
 
-  excludedPackages = [ "release_publisher" ];
+  excludedPackages = "\\(alert_webhook_listener\\|clean-swagger\\|release_publisher\\|slow_proxy\\|slow_proxy_mac\\)";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "grafana";
     repo = "grafana";
-    sha256 = "sha256-tehqb86Mkg1dD4x34zHwLD9uV/PssslLDIs9bl28ap0=";
+    sha256 = "sha256-incw/Uv1Jeg/WAkWUgJGvdJ2OpZYfkCAvgLW/qXWXEo=";
   };
 
   srcStatic = fetchurl {
     url = "https://dl.grafana.com/oss/release/grafana-${version}.linux-amd64.tar.gz";
-    sha256 = "sha256-aVZpTQ4ERrJV3YN4U0v/tJoYkTg7vlQVe6sIIK2NE0k=";
+    sha256 = "sha256-JSpNAi9NvZpo0HzdDmdi1i+lNGLylHgctT6PPWHNhkk=";
   };
 
-  vendorSha256 = "sha256-INvFZ9hNbtpaDXuhBPaSaqBZyi7QJ18tMk+AZjJtYjg=";
+  vendorSha256 = "sha256-72i2NgulRpdBZ9dwx+0VlKDzzNnBJgEKKizrLPwzUY4=";
 
   preBuild = ''
     # The testcase makes an API call against grafana.com:
diff --git a/pkgs/servers/monitoring/grafana/plugins/grafana-polystat-panel/default.nix b/pkgs/servers/monitoring/grafana/plugins/grafana-polystat-panel/default.nix
index 85b4c7069a9..0ef21497597 100644
--- a/pkgs/servers/monitoring/grafana/plugins/grafana-polystat-panel/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-polystat-panel/default.nix
@@ -2,8 +2,8 @@
 
 grafanaPlugin rec {
   pname = "grafana-polystat-panel";
-  version = "1.2.5";
-  zipHash = "sha256-U9vNfK4ofNzwL7MVe43tGY85gI56Jt1eb7TrCkeNrOQ=";
+  version = "1.2.6";
+  zipHash = "sha256-gbMD2o8A2YYZzkpYiXNkv8Oj958RP47fL6DXj1SBYF0=";
   meta = with lib; {
     description = "Hexagonal multi-stat panel for Grafana";
     license = licenses.asl20;
diff --git a/pkgs/servers/monitoring/prometheus/default.nix b/pkgs/servers/monitoring/prometheus/default.nix
index b87817af439..f4ad8a8e7b9 100644
--- a/pkgs/servers/monitoring/prometheus/default.nix
+++ b/pkgs/servers/monitoring/prometheus/default.nix
@@ -1,4 +1,10 @@
-{ stdenv, lib, go, buildGoModule, fetchFromGitHub, mkYarnPackage, nixosTests
+{ stdenv
+, lib
+, go
+, buildGoModule
+, fetchFromGitHub
+, mkYarnPackage
+, nixosTests
 , fetchpatch
 }:
 
@@ -27,7 +33,8 @@ let
     installPhase = "mv build $out";
     distPhase = "true";
   };
-in buildGoModule rec {
+in
+buildGoModule rec {
   pname = "prometheus";
   inherit src version;
 
@@ -41,19 +48,21 @@ in buildGoModule rec {
   '';
 
   buildFlags = "-tags=builtinassets";
-  buildFlagsArray = let
-    t = "${goPackagePath}/vendor/github.com/prometheus/common/version";
-  in [
-    ''
-      -ldflags=
-         -X ${t}.Version=${version}
-         -X ${t}.Revision=unknown
-         -X ${t}.Branch=unknown
-         -X ${t}.BuildUser=nix@nixpkgs
-         -X ${t}.BuildDate=unknown
-         -X ${t}.GoVersion=${lib.getVersion go}
-    ''
-  ];
+  buildFlagsArray =
+    let
+      t = "${goPackagePath}/vendor/github.com/prometheus/common/version";
+    in
+    [
+      ''
+        -ldflags=
+           -X ${t}.Version=${version}
+           -X ${t}.Revision=unknown
+           -X ${t}.Branch=unknown
+           -X ${t}.BuildUser=nix@nixpkgs
+           -X ${t}.BuildDate=unknown
+           -X ${t}.GoVersion=${lib.getVersion go}
+      ''
+    ];
 
   # only run this in the real build, not during the vendor build
   # this should probably be fixed in buildGoModule
@@ -67,7 +76,8 @@ in buildGoModule rec {
     cp -a $src/console_libraries $src/consoles $out/etc/prometheus
   '';
 
-  doCheck = !stdenv.isDarwin; # https://hydra.nixos.org/build/130673870/nixlog/1
+  # doCheck = !stdenv.isDarwin; # https://hydra.nixos.org/build/130673870/nixlog/1
+  doCheck = false;
 
   passthru.tests = { inherit (nixosTests) prometheus; };
 
diff --git a/pkgs/servers/monitoring/seyren/default.nix b/pkgs/servers/monitoring/seyren/default.nix
index 4dd90cacb8b..a94de966e4d 100644
--- a/pkgs/servers/monitoring/seyren/default.nix
+++ b/pkgs/servers/monitoring/seyren/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1fixij04n8hgmaj8kw8i6vclwyd6n94x0n6ify73ynm6dfv8g37x";
   };
 
-  phases = ["installPhase"];
+  dontUnpack = true;
 
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ jre ];
diff --git a/pkgs/servers/plex/raw.nix b/pkgs/servers/plex/raw.nix
index feab959a2df..1d527fb203c 100644
--- a/pkgs/servers/plex/raw.nix
+++ b/pkgs/servers/plex/raw.nix
@@ -88,6 +88,7 @@ stdenv.mkDerivation rec {
       pjones
       thoughtpolice
       maxeaubrey
+      MayNiklas
     ];
     description = "Media library streaming server";
     longDescription = ''
diff --git a/pkgs/servers/serviio/default.nix b/pkgs/servers/serviio/default.nix
index f3c8fc2311c..29c223a3470 100644
--- a/pkgs/servers/serviio/default.nix
+++ b/pkgs/servers/serviio/default.nix
@@ -9,8 +9,6 @@ stdenv.mkDerivation rec {
     sha256 = "0mxpdyhjf4w83q8ssmvpxm95hw4x7lfkh48vvdablccfndh82x2i";
   };
 
-  phases = ["unpackPhase" "installPhase"];
-
   installPhase = ''
     mkdir -p $out
     cp -R config legal lib library plugins LICENCE.txt NOTICE.txt README.txt RELEASE_NOTES.txt $out
diff --git a/pkgs/tools/admin/awscli2/default.nix b/pkgs/tools/admin/awscli2/default.nix
index 1ce3cb452b8..d84c1816fec 100644
--- a/pkgs/tools/admin/awscli2/default.nix
+++ b/pkgs/tools/admin/awscli2/default.nix
@@ -1,4 +1,4 @@
-{ lib, python3, groff, less, fetchFromGitHub }:
+{ lib, python3, groff, less, fetchFromGitHub, fetchpatch }:
 let
   py = python3.override {
     packageOverrides = self: super: {
@@ -33,6 +33,13 @@ with py.pkgs; buildPythonApplication rec {
     sha256 = "sha256-LU9Tqzdi8ULZ5y3FbfSXdrip4NcxFkXRCTpVGo05LcM=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/mgorny/aws-cli/commit/85361123d2fa12eaedf912c046ffe39aebdd2bad.patch";
+      sha256 = "sha256-1Rb+/CY7ze1/DbJ6TfqHF01cfI2vixZ1dT91bmHTg/A=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace setup.py \
       --replace "awscrt==0.11.13" "awscrt" \
diff --git a/pkgs/tools/admin/docker-credential-gcr/default.nix b/pkgs/tools/admin/docker-credential-gcr/default.nix
index 48851c3784b..ee2efb206af 100644
--- a/pkgs/tools/admin/docker-credential-gcr/default.nix
+++ b/pkgs/tools/admin/docker-credential-gcr/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "docker-credential-gcr";
-  version = "2.0.4";
+  version = "2.0.5";
 
   goPackagePath = "github.com/GoogleCloudPlatform/docker-credential-gcr";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "GoogleCloudPlatform";
     repo = "docker-credential-gcr";
     rev = "v${version}";
-    sha256 = "sha256-yG8gpsD1KZBSbJnnNTXgZah/mcrOUH1O37s7AGpeHjQ=";
+    sha256 = "sha256-WrcGTXy5SMWDHJWddXUuvUvEWjOsJcoB1zBg02p5ggY=";
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/admin/procs/default.nix b/pkgs/tools/admin/procs/default.nix
index e86bfb31101..0578bb4703c 100644
--- a/pkgs/tools/admin/procs/default.nix
+++ b/pkgs/tools/admin/procs/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "procs";
-  version = "0.11.8";
+  version = "0.11.9";
 
   src = fetchFromGitHub {
     owner = "dalance";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ZeCTUoi2HAMUeyze7LdxH0mi1Dd6q8Sw6+xPAVf3HTs=";
+    sha256 = "sha256-zqRjMCyFT7knI1/zH+RF1pA/OKaDhJZLLjWJhfmqopE=";
   };
 
-  cargoSha256 = "sha256-8myay5y4PGb/8s0vPLeg9xt6xqAQxGFXJz/GiV0ABlA=";
+  cargoSha256 = "sha256-W/ZMDbHC1VsllTSxCt77n4eb8Xgfj9YNx5NG5u+D+qA=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/admin/trivy/default.nix b/pkgs/tools/admin/trivy/default.nix
index f69909d8546..50ca76f0d6d 100644
--- a/pkgs/tools/admin/trivy/default.nix
+++ b/pkgs/tools/admin/trivy/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "trivy";
-  version = "0.19.1";
+  version = "0.19.2";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-oiaH0w7TEztR1i0wBuXXr+JN37UZOQ/zObBzQQvAnZY=";
+    sha256 = "sha256-aYPG0xvuijASKXBGgB+6UyF9bmeU8l5snOoPWI8Ewh8=";
   };
 
-  vendorSha256 = "sha256-bIQSZ+QQ0CnyOQ692Wpy4nXIPDSkD3LmnjwHZRG6soY=";
+  vendorSha256 = "sha256-4FO6/1eNyxy/CH7XMUkLfRqEg2+XUXL1gKleL6o4EoM=";
 
   excludedPackages = "misc";
 
diff --git a/pkgs/tools/backup/discordchatexporter-cli/default.nix b/pkgs/tools/backup/discordchatexporter-cli/default.nix
index 76b7d1da59b..770a64b841c 100644
--- a/pkgs/tools/backup/discordchatexporter-cli/default.nix
+++ b/pkgs/tools/backup/discordchatexporter-cli/default.nix
@@ -7,13 +7,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "discordchatexporter-cli";
-  version = "2.28";
+  version = "2.29";
 
   src = fetchFromGitHub {
     owner = "tyrrrz";
     repo = "discordchatexporter";
     rev = version;
-    sha256 = "1bcq8mwjr8635g8mkgbxnszk20hnwf0zk672glrxjqga6f6fnykg";
+    sha256 = "0hbhDlGEK2rxuCByW8RaT/0vne8Z+q0ZobCkW1FBoG8=";
   };
 
   nativeBuildInputs = [ dotnet-sdk_5 dotnetPackages.Nuget cacert makeWrapper autoPatchelfHook ];
diff --git a/pkgs/tools/backup/discordchatexporter-cli/deps.nix b/pkgs/tools/backup/discordchatexporter-cli/deps.nix
index a7703f2ba2c..9849e6c6366 100644
--- a/pkgs/tools/backup/discordchatexporter-cli/deps.nix
+++ b/pkgs/tools/backup/discordchatexporter-cli/deps.nix
@@ -1,8 +1,8 @@
 { fetchNuGet }: [
   (fetchNuGet {
     name = "CliFx";
-    version = "2.0.4";
-    sha256 = "1wwpjli4y2545yi6k17mvjqy994wl3wm6nngszk87rbdwhkbncaj";
+    version = "2.0.6";
+    sha256 = "09yyjgpp52b0r3mqlvx75ld4vjp8hry7ql7r20nnvj0lach6fyh6";
   })
   (fetchNuGet {
     name = "Gress";
@@ -46,8 +46,13 @@
   })
   (fetchNuGet {
     name = "Spectre.Console";
-    version = "0.40.0";
-    sha256 = "17bb31nsvfk7m337zwqcz4v6cvayhfx51ri4yrv5i8nbp7f4rpb1";
+    version = "0.41.0";
+    sha256 = "104vyzwbbq5m75dm31xk7ilvmik8hw1cj3bc301a8w6gq8i0fpk3";
+  })
+  (fetchNuGet {
+    name = "Superpower";
+    version = "2.3.0";
+    sha256 = "0bdsc3c0d6jb0wr67siqfba0ldl0jxbwis6xr0whzqzf6m2cyahm";
   })
   (fetchNuGet {
     name = "System.Memory";
diff --git a/pkgs/tools/graphics/pdfread/default.nix b/pkgs/tools/graphics/pdfread/default.nix
deleted file mode 100644
index 8350e95188d..00000000000
--- a/pkgs/tools/graphics/pdfread/default.nix
+++ /dev/null
@@ -1,51 +0,0 @@
-{lib, stdenv, fetchurl, unzip, python, makeWrapper, ghostscript, pngnq, pillow, djvulibre
-, optipng, unrar}:
-
-stdenv.mkDerivation {
-  name = "pdfread-1.8.2";
-
-  src = fetchurl {
-    # I got it from http://www.mobileread.com/forums/showthread.php?t=21906
-    # But that needs user registration to allow downloading.
-    # This is an evolution from pdfread 1.7 in http://pdfread.sourceforge.net/
-    # Temporary place:
-    url = "http://vicerveza.homeunix.net/~viric/soft/PDFRead-1.8.2-Source-noGUI-noInstaller.zip";
-    sha256 = "0mzxpnk97f0ww5ds7h4wsval3g4lnrhv6rhspjs7cy4i41gmk8an";
-  };
-
-  nativeBuildInputs = [ makeWrapper unzip ];
-  buildInputs = [ python ];
-
-  broken = true; # Not found.
-
-  phases = "unpackPhase patchPhase installPhase";
-
-  unpackPhase = ''
-    unzip $src
-    sourceRoot=`pwd`/PDFRead/src
-  '';
-
-  patchPhase = ''
-    sed -i 's,#!/usr.*,#!${python}/bin/python,' pdfread.py
-  '';
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp pdfread.py $out/bin
-    chmod +x $out/bin/pdfread.py
-
-    LIBSUFFIX=lib/${python.libPrefix}/site-packages/
-    PYDIR=$out/$LIBSUFFIX
-    mkdir -p $PYDIR
-    cp -R *.py pylrs $PYDIR
-
-    wrapProgram $out/bin/pdfread.py --prefix PYTHONPATH : $PYTHONPATH:${pillow}/$LIBSUFFIX/PIL:$PYDIR \
-      --prefix PATH : ${lib.makeBinPath [ ghostscript pngnq djvulibre unrar optipng ]}
-  '';
-
-  meta = with lib; {
-    description = "PDF/DJVU to ebook format converter";
-    homepage = "https://www.mobileread.com/forums/showthread.php?t=21906";
-    license = licenses.mit;
-  };
-}
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index a4b2b888fae..88a9846e835 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -72,6 +72,7 @@ python3Packages.buildPythonApplication rec {
     "test_sbin_added_to_path"
     "test_diff_meta"
     "test_diff_meta2"
+    "test_obj_no_differences"
   ];
 
   meta = with lib; {
diff --git a/pkgs/tools/misc/fend/default.nix b/pkgs/tools/misc/fend/default.nix
index 93e13996f7f..4ed308643e5 100644
--- a/pkgs/tools/misc/fend/default.nix
+++ b/pkgs/tools/misc/fend/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fend";
-  version = "0.1.20";
+  version = "0.1.21";
 
   src = fetchFromGitHub {
     owner = "printfn";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-2CzpPzUylzDiP9rbjneRR6joa9UEgnDfJ4Ffa/orhkk=";
+    sha256 = "sha256-LrHZsnW96+QsXuGxWoGqIEKTE86m3tMnh4fpDPIhd1w=";
   };
 
-  cargoSha256 = "sha256-xDh7SF73Qnx/GeW43JDmF+qeljSHbWWq4unWdTmAO+c=";
+  cargoSha256 = "sha256-GZ4Yt5iQkgupJMTYIbvCPtz19985MFf8IDy3ui0M6DE=";
 
   doInstallCheck = true;
 
diff --git a/pkgs/tools/misc/trillian/default.nix b/pkgs/tools/misc/trillian/default.nix
index 8a96248e718..9959fe9375b 100644
--- a/pkgs/tools/misc/trillian/default.nix
+++ b/pkgs/tools/misc/trillian/default.nix
@@ -5,28 +5,21 @@
 
 buildGoModule rec {
   pname = "trillian";
-  version = "1.3.11";
-  vendorSha256 = "0zxp1gjzcc3z6vkpc2bchbs1shwm1b28ks0jh4gf6zxpp4361j4l";
+  version = "1.3.13";
+  vendorSha256 = "1ad0vaw0k57njzk9x233iqjbplyvw66qjk8r9j7sx87pdc6a4lpb";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1lh19wba90y91l5jj8ilzjqxgmqqqdvyn7pzrwvmzv7iiy18wcmh";
+    sha256 = "1ns394yd4js9g1psd1dkrffidyzixqvjp5lhw2x2iycrxbnm3y44";
   };
 
-  # Remove tests that require networking
-  postPatch = ''
-    rm cmd/get_tree_public_key/main_test.go
-  '';
-
   subPackages = [
     "cmd/trillian_log_server"
     "cmd/trillian_log_signer"
-    "cmd/trillian_map_server"
     "cmd/createtree"
     "cmd/deletetree"
-    "cmd/get_tree_public_key"
     "cmd/updatetree"
   ];
 
diff --git a/pkgs/tools/networking/ppp/default.nix b/pkgs/tools/networking/ppp/default.nix
index 36d156a3994..708932ac1c9 100644
--- a/pkgs/tools/networking/ppp/default.nix
+++ b/pkgs/tools/networking/ppp/default.nix
@@ -1,45 +1,37 @@
-{ lib, stdenv, fetchurl, fetchpatch, fetchFromGitHub, substituteAll, libpcap, openssl }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, substituteAll
+, libpcap
+, openssl
+}:
 
 stdenv.mkDerivation rec {
-  version = "2.4.8";
+  version = "2.4.9";
   pname = "ppp";
 
   src = fetchFromGitHub {
-    owner = "paulusmack";
-    repo = "ppp";
-    rev = "ppp-${version}";
-    sha256 = "1i88m79h6g3fzsb4yw3k8bq1grsx3hsyawm7id2vcaab0gfqzjjv";
+    owner = "ppp-project";
+    repo = pname;
+    rev = "${pname}-${version}";
+    sha256 = "sha256-8+nbqRNfKPLDx+wmuKSkv+BSeG72hKJI4dNqypqeEK4=";
   };
 
-  patches =
-    [
-      ( substituteAll {
-        src = ./nix-purity.patch;
-        inherit libpcap;
-        glibc = stdenv.cc.libc.dev or stdenv.cc.libc;
-        openssl = openssl.dev;
-      })
-      # Without nonpriv.patch, pppd --version doesn't work when not run as
-      # root.
-      ./nonpriv.patch
-      (fetchpatch {
-        name = "CVE-2015-3310.patch";
-        url = "https://github.com/paulusmack/ppp/commit/858976b1fc3107f1261aae337831959b511b83c2.patch";
-        sha256 = "0wirmcis67xjwllqhz9lsz1b7dcvl8shvz78lxgybc70j2sv7ih4";
-      })
-      (fetchurl {
-        url = "https://www.nikhef.nl/~janjust/ppp/ppp-2.4.7-eaptls-mppe-1.102.patch";
-        sha256 = "04war8l5szql53l36043hvzgfwqp3v76kj8brbz7wlf7vs2mlkia";
-      })
-      (fetchpatch {
-        name = "CVE-2020-8597.patch";
-        url = "https://github.com/paulusmack/ppp/commit/8d7970b8f3db727fe798b65f3377fe6787575426.patch";
-        sha256 = "129wnhwxmzvr3y9gzxv82jnb5y8m4yg8vkpa0xl2rwkl8anbzgkh";
-      })
-      ./musl-fix-headers.patch
-    ];
+  patches = [
+    (substituteAll {
+      src = ./nix-purity.patch;
+      glibc = stdenv.cc.libc.dev or stdenv.cc.libc;
+      openssl_dev = openssl.dev;
+      openssl_out = openssl.out;
+    })
+    # Without nonpriv.patch, pppd --version doesn't work when not run as root.
+    ./nonpriv.patch
+  ];
 
-  buildInputs = [ libpcap openssl ];
+  buildInputs = [
+    libpcap
+    openssl
+  ];
 
   postPatch = ''
     # strip is not found when cross compiling with seemingly no way to point
@@ -66,9 +58,14 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "https://ppp.samba.org/";
-    description = "Point-to-point implementation for Linux and Solaris";
-    license = with licenses; [ bsdOriginal publicDomain gpl2 lgpl2 ];
+    homepage = "https://ppp.samba.org";
+    description = "Point-to-point implementation to provide Internet connections over serial lines";
+    license = with licenses; [
+      bsdOriginal
+      publicDomain
+      gpl2
+      lgpl2
+    ];
     platforms = platforms.linux;
     maintainers = [ ];
   };
diff --git a/pkgs/tools/networking/ppp/musl-fix-headers.patch b/pkgs/tools/networking/ppp/musl-fix-headers.patch
deleted file mode 100644
index d6252a52675..00000000000
--- a/pkgs/tools/networking/ppp/musl-fix-headers.patch
+++ /dev/null
@@ -1,137 +0,0 @@
-diff --git a/include/net/ppp_defs.h b/include/net/ppp_defs.h
-index b06eda5..dafa36c 100644
---- a/include/net/ppp_defs.h
-+++ b/include/net/ppp_defs.h
-@@ -38,6 +38,8 @@
- #ifndef _PPP_DEFS_H_
- #define _PPP_DEFS_H_
- 
-+#include <sys/time.h>
-+
- /*
-  * The basic PPP frame.
-  */
-diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux
-index a74c914..7acd2cf 100644
---- a/pppd/Makefile.linux
-+++ b/pppd/Makefile.linux
-@@ -126,7 +126,7 @@ LIBS	+= -lcrypt
- endif
- 
- ifdef USE_LIBUTIL
--CFLAGS	+= -DHAVE_LOGWTMP=1
-+#CFLAGS	+= -DHAVE_LOGWTMP=1
- LIBS	+= -lutil
- endif
- 
-diff --git a/pppd/magic.h b/pppd/magic.h
-index c81213b..305aece 100644
---- a/pppd/magic.h
-+++ b/pppd/magic.h
-@@ -42,6 +42,8 @@
-  * $Id: magic.h,v 1.5 2003/06/11 23:56:26 paulus Exp $
-  */
- 
-+#include <sys/cdefs.h>
-+
- void magic_init (void);	/* Initialize the magic number generator */
- u_int32_t magic (void);	/* Returns the next magic number */
- 
-diff --git a/pppd/plugins/rp-pppoe/if.c b/pppd/plugins/rp-pppoe/if.c
-index 91e9a57..9c0fac3 100644
---- a/pppd/plugins/rp-pppoe/if.c
-+++ b/pppd/plugins/rp-pppoe/if.c
-@@ -30,10 +30,6 @@ static char const RCSID[] =
- #include <linux/if_packet.h>
- #endif
- 
--#ifdef HAVE_NET_ETHERNET_H
--#include <net/ethernet.h>
--#endif
--
- #ifdef HAVE_ASM_TYPES_H
- #include <asm/types.h>
- #endif
-diff --git a/pppd/plugins/rp-pppoe/plugin.c b/pppd/plugins/rp-pppoe/plugin.c
-index a8c2bb4..ca34d79 100644
---- a/pppd/plugins/rp-pppoe/plugin.c
-+++ b/pppd/plugins/rp-pppoe/plugin.c
-@@ -46,7 +46,6 @@ static char const RCSID[] =
- #include <unistd.h>
- #include <fcntl.h>
- #include <signal.h>
--#include <net/ethernet.h>
- #include <net/if_arp.h>
- #include <linux/ppp_defs.h>
- #include <linux/if_pppox.h>
-diff --git a/pppd/plugins/rp-pppoe/pppoe-discovery.c b/pppd/plugins/rp-pppoe/pppoe-discovery.c
-index 3d3bf4e..b5f82d3 100644
---- a/pppd/plugins/rp-pppoe/pppoe-discovery.c
-+++ b/pppd/plugins/rp-pppoe/pppoe-discovery.c
-@@ -27,10 +27,6 @@
- #include <linux/if_packet.h>
- #endif
- 
--#ifdef HAVE_NET_ETHERNET_H
--#include <net/ethernet.h>
--#endif
--
- #ifdef HAVE_ASM_TYPES_H
- #include <asm/types.h>
- #endif
-@@ -55,6 +51,8 @@ void die(int status)
- 	exit(status);
- }
- 
-+#define error(x...) fprintf(stderr, x)
-+
- /* Initialize frame types to RFC 2516 values.  Some broken peers apparently
-    use different frame types... sigh... */
- 
-diff --git a/pppd/plugins/rp-pppoe/pppoe.h b/pppd/plugins/rp-pppoe/pppoe.h
-index c4aaa6e..70aef85 100644
---- a/pppd/plugins/rp-pppoe/pppoe.h
-+++ b/pppd/plugins/rp-pppoe/pppoe.h
-@@ -88,18 +88,6 @@ typedef unsigned long UINT32_t;
- #include <linux/if_ether.h>
- #endif
- 
--#ifdef HAVE_NETINET_IF_ETHER_H
--#include <sys/types.h>
--
--#ifdef HAVE_SYS_SOCKET_H
--#include <sys/socket.h>
--#endif
--#ifndef HAVE_SYS_DLPI_H
--#include <netinet/if_ether.h>
--#endif
--#endif
--
--
- /* Ethernet frame types according to RFC 2516 */
- #define ETH_PPPOE_DISCOVERY 0x8863
- #define ETH_PPPOE_SESSION   0x8864
-diff --git a/pppd/sys-linux.c b/pppd/sys-linux.c
-index 6d71530..86d224e 100644
---- a/pppd/sys-linux.c
-+++ b/pppd/sys-linux.c
-@@ -102,19 +102,11 @@
- #define MAX_ADDR_LEN 7
- #endif
- 
--#if !defined(__GLIBC__) || __GLIBC__ >= 2
- #include <asm/types.h>		/* glibc 2 conflicts with linux/types.h */
- #include <net/if.h>
- #include <net/if_arp.h>
- #include <net/route.h>
- #include <netinet/if_ether.h>
--#else
--#include <linux/types.h>
--#include <linux/if.h>
--#include <linux/if_arp.h>
--#include <linux/route.h>
--#include <linux/if_ether.h>
--#endif
- #include <netinet/in.h>
- #include <arpa/inet.h>
- 
diff --git a/pkgs/tools/networking/ppp/nix-purity.patch b/pkgs/tools/networking/ppp/nix-purity.patch
index 975ea9db609..c3363e0ccb6 100644
--- a/pkgs/tools/networking/ppp/nix-purity.patch
+++ b/pkgs/tools/networking/ppp/nix-purity.patch
@@ -1,31 +1,33 @@
 diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux
-index 9664f70..d07e01e 100644
+index 22837c5..6f6fff5 100644
 --- a/pppd/Makefile.linux
 +++ b/pppd/Makefile.linux
-@@ -125,7 +125,7 @@ CFLAGS   += -DHAS_SHADOW
+@@ -111,8 +111,8 @@ endif
+ 
+ # EAP SRP-SHA1
+ ifdef USE_SRP
+-CFLAGS	+= -DUSE_SRP -DOPENSSL -I/usr/local/ssl/include
+-LIBS	+= -lsrp -L/usr/local/ssl/lib
++CFLAGS	+= -DUSE_SRP -DOPENSSL -I@openssl_dev@/include/openssl
++LIBS	+= -lsrp -L@openssl_out@/lib
+ NEEDCRYPTOLIB = y
+ TARGETS	+= srp-entry
+ EXTRAINSTALL = $(INSTALL) -c -m 555 srp-entry $(BINDIR)/srp-entry
+@@ -143,7 +143,7 @@ CFLAGS   += -DHAS_SHADOW
  #LIBS     += -lshadow $(LIBS)
  endif
  
--ifneq ($(wildcard $(shell $(CC) --print-sysroot)/usr/include/crypt.h),)
+-ifeq ($(shell echo '\#include <crypt.h>' | $(CC) -E - >/dev/null 2>&1 && echo yes),yes)
 +ifneq ($(wildcard @glibc@/include/crypt.h),)
  CFLAGS  += -DHAVE_CRYPT_H=1
- LIBS   += -lcrypt
+ LIBS	+= -lcrypt
  endif
-@@ -137,7 +137,7 @@ endif
+@@ -155,7 +155,7 @@ endif
  
  ifdef NEEDDES
  ifndef USE_CRYPT
 -CFLAGS   += -I$(shell $(CC) --print-sysroot)/usr/include/openssl
-+CFLAGS   += -I@openssl@/include/openssl
- LIBS     += -lcrypto
++CFLAGS   += -I@openssl_dev@/include/openssl
+ NEEDCRYPTOLIB = y
  else
  CFLAGS   += -DUSE_CRYPT=1
-@@ -188,7 +188,7 @@ LIBS        += -ldl
- endif
- 
- ifdef FILTER
--ifneq ($(wildcard /usr/include/pcap-bpf.h),)
-+ifneq ($(wildcard @libpcap@/include/pcap-bpf.h),)
- LIBS    += -lpcap
- CFLAGS  += -DPPP_FILTER
- endif
diff --git a/pkgs/tools/security/cewl/Gemfile b/pkgs/tools/security/cewl/Gemfile
new file mode 100644
index 00000000000..97d9ae757ac
--- /dev/null
+++ b/pkgs/tools/security/cewl/Gemfile
@@ -0,0 +1,8 @@
+source 'https://rubygems.org'
+gem 'mime'
+gem 'mime-types', ">=3.3.1"
+gem 'mini_exiftool'
+gem 'nokogiri'
+gem 'rexml'
+gem 'rubyzip'
+gem 'spider'
diff --git a/pkgs/tools/security/cewl/Gemfile.lock b/pkgs/tools/security/cewl/Gemfile.lock
new file mode 100644
index 00000000000..85bb2eb4b82
--- /dev/null
+++ b/pkgs/tools/security/cewl/Gemfile.lock
@@ -0,0 +1,31 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    mime (0.4.4)
+    mime-types (3.3.1)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2021.0704)
+    mini_exiftool (2.10.2)
+    mini_portile2 (2.5.3)
+    nokogiri (1.11.7)
+      mini_portile2 (~> 2.5.0)
+      racc (~> 1.4)
+    racc (1.5.2)
+    rexml (3.2.5)
+    rubyzip (2.3.2)
+    spider (0.5.4)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  mime
+  mime-types (>= 3.3.1)
+  mini_exiftool
+  nokogiri
+  rexml
+  rubyzip
+  spider
+
+BUNDLED WITH
+   2.1.4
diff --git a/pkgs/tools/security/cewl/default.nix b/pkgs/tools/security/cewl/default.nix
new file mode 100644
index 00000000000..06d983c14e3
--- /dev/null
+++ b/pkgs/tools/security/cewl/default.nix
@@ -0,0 +1,33 @@
+{ stdenv, lib, fetchFromGitHub, bundlerEnv }:
+
+let
+  rubyEnv = bundlerEnv {
+    name = "cewl-ruby-env";
+    gemdir = ./.;
+  };
+in
+stdenv.mkDerivation rec {
+  pname = "cewl";
+  version = "5.5.2";
+  src = fetchFromGitHub {
+    owner = "digininja";
+    repo = "CeWL";
+    rev = version;
+    sha256 = "sha256-5LTZUr3OMeu1NODhIgBiVqtQnUWYfZTm73q61vT3rXc=";
+  };
+
+  buildInputs = [ rubyEnv.wrappedRuby ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp *.rb $out/bin/
+    mv $out/bin/cewl.rb $out/bin/cewl
+  '';
+
+  meta = with lib; {
+    description = "Custom wordlist generator";
+    homepage = "https://digi.ninja/projects/cewl.php/";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ elohmeier ];
+  };
+}
diff --git a/pkgs/tools/security/cewl/gemset.nix b/pkgs/tools/security/cewl/gemset.nix
new file mode 100644
index 00000000000..851a6d2442d
--- /dev/null
+++ b/pkgs/tools/security/cewl/gemset.nix
@@ -0,0 +1,104 @@
+{
+  mime = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0nskys7brz2bylhxiknl0z9i19w3wb1knf0h93in6mjq70jdw5cr";
+      type = "gem";
+    };
+    version = "0.4.4";
+  };
+  mime-types = {
+    dependencies = ["mime-types-data"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1zj12l9qk62anvk9bjvandpa6vy4xslil15wl6wlivyf51z773vh";
+      type = "gem";
+    };
+    version = "3.3.1";
+  };
+  mime-types-data = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0dlxwc75iy0dj23x824cxpvpa7c8aqcpskksrmb32j6m66h5mkcy";
+      type = "gem";
+    };
+    version = "3.2021.0704";
+  };
+  mini_exiftool = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0ir4wigpm6nkd3f40wcjdqrhjx3l60w1hwcg143is1a95ypnvqhr";
+      type = "gem";
+    };
+    version = "2.10.2";
+  };
+  mini_portile2 = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1ad0mli9rc0f17zw4ibp24dbj1y39zkykijsjmnzl4gwpg5s0j6k";
+      type = "gem";
+    };
+    version = "2.5.3";
+  };
+  nokogiri = {
+    dependencies = ["mini_portile2" "racc"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1vrn31385ix5k9b0yalnlzv360isv6dincbcvi8psllnwz4sjxj9";
+      type = "gem";
+    };
+    version = "1.11.7";
+  };
+  racc = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "178k7r0xn689spviqzhvazzvxfq6fyjldxb3ywjbgipbfi4s8j1g";
+      type = "gem";
+    };
+    version = "1.5.2";
+  };
+  rexml = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "08ximcyfjy94pm1rhcx04ny1vx2sk0x4y185gzn86yfsbzwkng53";
+      type = "gem";
+    };
+    version = "3.2.5";
+  };
+  rubyzip = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0grps9197qyxakbpw02pda59v45lfgbgiyw48i0mq9f2bn9y6mrz";
+      type = "gem";
+    };
+    version = "2.3.2";
+  };
+  spider = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0fix7zhnvlfqg66bxwdpbsffbynzdnaifnxpakn07bjh3rdj75cx";
+      type = "gem";
+    };
+    version = "0.5.4";
+  };
+}
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 09309e98ce4..9509288b581 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2021-07-21";
+  version = "2021-07-22";
 
   src = fetchFromGitHub {
     owner = "offensive-security";
     repo = pname;
     rev = version;
-    sha256 = "sha256-VKjbVlSvJmp6GIyQ3DVPMl+ARRWslFIf7Oc2Qtb5ouI=";
+    sha256 = "sha256-pmi1oKam3t4iKqbisFghdVlzp1Ozmc9Nmn19JLrsams=";
   };
 
   installPhase = ''
diff --git a/pkgs/tools/security/gorilla-bin/default.nix b/pkgs/tools/security/gorilla-bin/default.nix
index 68aa7c48819..228271742c6 100644
--- a/pkgs/tools/security/gorilla-bin/default.nix
+++ b/pkgs/tools/security/gorilla-bin/default.nix
@@ -11,7 +11,6 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ patchelf makeWrapper ];
-  phases = [ "unpackPhase" "installPhase" ];
 
   unpackCmd = ''
     mkdir gorilla;
diff --git a/pkgs/tools/security/open-ecard/default.nix b/pkgs/tools/security/open-ecard/default.nix
index 5c07add9056..00ff112ba84 100644
--- a/pkgs/tools/security/open-ecard/default.nix
+++ b/pkgs/tools/security/open-ecard/default.nix
@@ -23,7 +23,7 @@ in stdenv.mkDerivation rec {
 
   src = srcs.richclient;
 
-  phases = "installPhase";
+  dontUnpack = true;
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/tools/security/ssss/default.nix b/pkgs/tools/security/ssss/default.nix
index 34407f5f5ad..61d10111120 100644
--- a/pkgs/tools/security/ssss/default.nix
+++ b/pkgs/tools/security/ssss/default.nix
@@ -1,28 +1,45 @@
-{ lib, stdenv, fetchurl, gmp }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, gmp
+, installShellFiles
+}:
 
-stdenv.mkDerivation {
-  name = "ssss-0.5";
+stdenv.mkDerivation rec {
+  pname = "ssss";
+  version = "0.5.7";
 
-  src = fetchurl {
-    url = "http://point-at-infinity.org/ssss/ssss-0.5.tar.gz";
-    sha256 = "15grn2fp1x8p92kxkwbmsx8rz16g93y9grl3hfqbh1jn21ama5jx";
+  src = fetchFromGitHub {
+    owner = "MrJoy";
+    repo = pname;
+    rev = "releases%2Fv${version}";
+    sha256 = "18r1hwch6nq6gjijavr4pvrxz2plrlrvdx8ssqhdj2vmqvlqwbvd";
   };
 
-  buildInputs = [ gmp ];
+  nativeBuildInputs = [
+    installShellFiles
+  ];
 
-  preBuild =
-    ''
-      sed -e s@/usr/@$out/@g -i Makefile
-      cp ssss.manpage.xml ssss.1
-      cp ssss.manpage.xml ssss.1.html
-      mkdir -p $out/bin $out/share/man/man1
-      echo -e 'install:\n\tcp ssss-combine ssss-split '"$out"'/bin' >>Makefile
-    '';
+  buildInputs = [
+    gmp
+  ];
 
-  meta = {
+  preBuild = ''
+    sed -e s@/usr/@$out/@g -i Makefile
+    cp ssss.manpage.xml ssss.1
+    mkdir -p $out/bin
+    echo -e 'install:\n\tcp ssss-combine ssss-split '"$out"'/bin' >>Makefile
+  '';
+
+  postInstall = ''
+    installManPage ssss.1
+  '';
+
+  meta = with lib; {
     description = "Shamir Secret Sharing Scheme";
     homepage = "http://point-at-infinity.org/ssss/";
-    platforms = lib.platforms.unix;
-    license = lib.licenses.gpl2;
+    license = licenses.gpl2Plus;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/tools/text/mdcat/default.nix b/pkgs/tools/text/mdcat/default.nix
index 93f65f45d37..67f69ecc71d 100644
--- a/pkgs/tools/text/mdcat/default.nix
+++ b/pkgs/tools/text/mdcat/default.nix
@@ -8,33 +8,24 @@
 , Security
 , ansi2html
 , installShellFiles
-, fetchpatch
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "mdcat";
-  version = "0.23.1";
+  version = "0.23.2";
 
   src = fetchFromGitHub {
     owner = "lunaryorn";
     repo = pname;
     rev = "mdcat-${version}";
-    sha256 = "sha256-aJ7rL+EKa5zWmCmekVuRmdeOwTmVo0IQ+GJ8Ga4iTI0=";
+    sha256 = "sha256-PM6bx7qzEx4He9aX4WRO7ad/f9+wzT+gPGXKwYwG8+A=";
   };
 
-  patches = [
-    # detect wezterm through TERM again which was removed in 0.23.1
-    (fetchpatch {
-      url = "https://github.com/lunaryorn/mdcat/commit/a897b223904748a47c277f7c9a07d59e7d5c916b.patch";
-      sha256 = "sha256-tSeNyrlqoGvlfQ3xMRkvqZ7HajMvPCIk7kyt/sVjmTo=";
-    })
-  ];
-
   nativeBuildInputs = [ pkg-config asciidoctor installShellFiles ];
   buildInputs = [ openssl ]
     ++ lib.optional stdenv.isDarwin Security;
 
-  cargoSha256 = "sha256-r0dJ/lDOfRzEdwySR/eEvsrO8qn4g7ZIfpekiirUp3Q=";
+  cargoSha256 = "sha256-GL9WGoyM1++QFAR+bzj0XkjaRaDCWcbcahles5amNpk=";
 
   checkInputs = [ ansi2html ];
   # Skip tests that use the network and that include files.
diff --git a/pkgs/tools/text/ocrmypdf/default.nix b/pkgs/tools/text/ocrmypdf/default.nix
index 1a60d7d013e..0dff6d76fff 100644
--- a/pkgs/tools/text/ocrmypdf/default.nix
+++ b/pkgs/tools/text/ocrmypdf/default.nix
@@ -30,14 +30,13 @@ let
 in
 buildPythonApplication rec {
   pname = "ocrmypdf";
-  version = "11.7.3";
-  disabled = ! python3Packages.isPy3k;
+  version = "12.3.0";
 
   src = fetchFromGitHub {
     owner = "jbarlow83";
     repo = "OCRmyPDF";
     rev = "v${version}";
-    sha256 = "0gs2w9kl5wwrs0hx2sivq3pdvpf3lkaifblwfbz5g31yl770blji";
+    sha256 = "122yv3p0v4fbx30zgppcznwnm7svg97gv0sa103xb6zcld68ggn2";
   };
 
   nativeBuildInputs = with python3Packages; [
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index f5cd18c1fbb..5412880b5f8 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -448,6 +448,7 @@ mapAliases ({
 
   linux-steam-integration = throw "linux-steam-integration has been removed, as the upstream project has been abandoned"; # added 2020-05-22
   loadcaffe = throw "loadcaffe has been removed, as the upstream project has been abandoned"; # added 2020-03-28
+  lobster-two = google-fonts; # added 2021-07-22
   lprof = throw "lprof has been removed as it's unmaintained upstream and broken in nixpkgs since a while ago"; # added 2021-02-15
   lttngTools = lttng-tools;  # added 2014-07-31
   lttngUst = lttng-ust;  # added 2014-07-31
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c15ef4e4414..c01d2bc0a91 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -241,6 +241,8 @@ in
 
   cereal = callPackage ../development/libraries/cereal { };
 
+  cewl = callPackage ../tools/security/cewl { };
+
   checkov = callPackage ../development/tools/analysis/checkov {};
 
   chrysalis = callPackage ../applications/misc/chrysalis { };
@@ -7941,9 +7943,7 @@ in
 
   pdfarranger = callPackage ../applications/misc/pdfarranger { };
 
-  pdfread = callPackage ../tools/graphics/pdfread {
-    inherit (pythonPackages) pillow;
-  };
+  pdfread = throw "pdfread has been remove from nixpkgs, because it is unmaintained for years and the sources are no longer available";
 
   briss = callPackage ../tools/graphics/briss { };
 
@@ -22445,8 +22445,6 @@ in
 
   lmodern = callPackage ../data/fonts/lmodern { };
 
-  lobster-two = callPackage ../data/fonts/lobster-two {};
-
   logitech-udev-rules = callPackage ../os-specific/linux/logitech-udev-rules {};
 
   # lohit-fonts.assamese lohit-fonts.bengali lohit-fonts.devanagari lohit-fonts.gujarati lohit-fonts.gurmukhi
@@ -23978,6 +23976,8 @@ in
 
   fritzing = libsForQt5.callPackage ../applications/science/electronics/fritzing { };
 
+  fritzprofiles = with python3.pkgs; toPythonApplication fritzprofiles;
+
   fsv = callPackage ../applications/misc/fsv {
     autoreconfHook = buildPackages.autoreconfHook269;
   };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 4febee5f5a8..c17ea27a9e5 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -864,9 +864,7 @@ let
 
     ocamlmod = callPackage ../development/tools/ocaml/ocamlmod { };
 
-    ocaml-monadic = callPackage ../development/ocaml-modules/ocaml-monadic {
-      ocaml-migrate-parsetree = ocaml-migrate-parsetree-2;
-    };
+    ocaml-monadic = callPackage ../development/ocaml-modules/ocaml-monadic { };
 
     ocaml_mysql = callPackage ../development/ocaml-modules/mysql { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a1bd5d816af..5cab2a4f0c7 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1770,6 +1770,8 @@ in {
 
   d2to1 = callPackage ../development/python-modules/d2to1 { };
 
+  dacite = callPackage ../development/python-modules/dacite { };
+
   daemonize = callPackage ../development/python-modules/daemonize { };
 
   daemonocle = callPackage ../development/python-modules/daemonocle { };
@@ -2734,6 +2736,8 @@ in {
 
   fritzconnection = callPackage ../development/python-modules/fritzconnection { };
 
+  fritzprofiles = callPackage ../development/python-modules/fritzprofiles { };
+
   frozendict = callPackage ../development/python-modules/frozendict { };
 
   frozenlist = callPackage ../development/python-modules/frozenlist { };
@@ -5414,6 +5418,8 @@ in {
 
   python-juicenet = callPackage ../development/python-modules/python-juicenet { };
 
+  python-lsp-black = callPackage ../development/python-modules/python-lsp-black { };
+
   python-openems = callPackage ../development/python-modules/python-openems { };
 
   python-openzwave-mqtt = callPackage ../development/python-modules/python-openzwave-mqtt { };
@@ -5690,6 +5696,8 @@ in {
 
   py-ubjson = callPackage ../development/python-modules/py-ubjson { };
 
+  py17track = callPackage ../development/python-modules/py17track { };
+
   py2bit = callPackage ../development/python-modules/py2bit { };
 
   py3buddy = toPythonModule (callPackage ../development/python-modules/py3buddy { });
@@ -6185,6 +6193,8 @@ in {
 
   pyls-black = callPackage ../development/python-modules/pyls-black { };
 
+  pyls-flake8 = callPackage ../development/python-modules/pyls-flake8 { };
+
   pyls-isort = callPackage ../development/python-modules/pyls-isort { };
 
   pyls-mypy = callPackage ../development/python-modules/pyls-mypy { };
@@ -6273,6 +6283,8 @@ in {
 
   pymumble = callPackage ../development/python-modules/pymumble { };
 
+  pymunk = callPackage ../development/python-modules/pymunk { };
+
   pymupdf = callPackage ../development/python-modules/pymupdf { };
 
   PyMVGLive = callPackage ../development/python-modules/pymvglive { };
@@ -8240,6 +8252,8 @@ in {
 
   sphinx-autobuild = callPackage ../development/python-modules/sphinx-autobuild { };
 
+  sphinx-copybutton = callPackage ../development/python-modules/sphinx-copybutton { };
+
   sphinx-jinja = callPackage ../development/python-modules/sphinx-jinja { };
 
   sphinx-markdown-parser = callPackage ../development/python-modules/sphinx-markdown-parser { };