summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--.github/CODEOWNERS1
-rw-r--r--maintainers/maintainer-list.nix24
-rw-r--r--nixos/modules/system/boot/systemd.nix2
-rw-r--r--nixos/tests/all-tests.nix1
-rw-r--r--nixos/tests/cri-o.nix19
-rw-r--r--nixos/tests/systemd.nix25
-rw-r--r--pkgs/applications/gis/gmt/dcw.nix32
-rw-r--r--pkgs/applications/gis/gmt/default.nix73
-rw-r--r--pkgs/applications/gis/gmt/gshhg.nix31
-rw-r--r--pkgs/applications/misc/systembus-notify/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/cni/plugins.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/ytalk/default.nix21
-rw-r--r--pkgs/applications/virtualization/conmon/default.nix2
-rw-r--r--pkgs/applications/virtualization/cri-o/default.nix3
-rw-r--r--pkgs/applications/virtualization/cri-o/wrapper.nix2
-rw-r--r--pkgs/applications/virtualization/crun/default.nix2
-rw-r--r--pkgs/applications/virtualization/podman/default.nix2
-rw-r--r--pkgs/applications/virtualization/runc/default.nix2
-rw-r--r--pkgs/build-support/alternatives/blas/default.nix2
-rw-r--r--pkgs/build-support/cc-wrapper/default.nix5
-rw-r--r--pkgs/build-support/cc-wrapper/fortran-hook.sh11
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-desktop/default.nix4
-rw-r--r--pkgs/development/compilers/go/1.14.nix4
-rw-r--r--pkgs/development/compilers/rust/1_45.nix4
-rw-r--r--pkgs/development/interpreters/python/cpython/2.7/CVE-2019-20907.patch24
-rw-r--r--pkgs/development/interpreters/python/cpython/2.7/default.nix3
-rw-r--r--pkgs/development/interpreters/python/cpython/default.nix11
-rw-r--r--pkgs/development/interpreters/red/default.nix8
-rw-r--r--pkgs/development/libraries/check/default.nix4
-rw-r--r--pkgs/development/libraries/ffmpeg/generic.nix1
-rw-r--r--pkgs/development/libraries/ilmbase/cross.patch35
-rw-r--r--pkgs/development/libraries/ilmbase/default.nix18
-rw-r--r--pkgs/development/libraries/imlib2/default.nix4
-rw-r--r--pkgs/development/libraries/libbytesize/default.nix4
-rw-r--r--pkgs/development/libraries/libevdev/default.nix13
-rw-r--r--pkgs/development/libraries/libinput/default.nix4
-rw-r--r--pkgs/development/libraries/libipt/default.nix4
-rw-r--r--pkgs/development/libraries/libmbim/default.nix4
-rw-r--r--pkgs/development/libraries/libqmi/default.nix4
-rw-r--r--pkgs/development/libraries/libuv/default.nix2
-rw-r--r--pkgs/development/libraries/mesa/default.nix4
-rw-r--r--pkgs/development/libraries/openexr/default.nix46
-rw-r--r--pkgs/development/libraries/qt-5/modules/qtdeclarative.nix10
-rw-r--r--pkgs/development/libraries/science/math/arpack/default.nix2
-rw-r--r--pkgs/development/libraries/x265/default.nix66
-rw-r--r--pkgs/development/ocaml-modules/dune-action-plugin/default.nix19
-rw-r--r--pkgs/development/ocaml-modules/dune-glob/default.nix19
-rw-r--r--pkgs/development/ocaml-modules/dune-private-libs/default.nix2
-rw-r--r--pkgs/development/python-modules/numpy/default.nix3
-rw-r--r--pkgs/development/python-modules/userpath/default.nix30
-rw-r--r--pkgs/development/tools/build-managers/cmake/default.nix12
-rwxr-xr-xpkgs/development/tools/build-managers/cmake/setup-hook.sh2
-rw-r--r--pkgs/development/tools/documentation/doxygen/default.nix4
-rw-r--r--pkgs/development/tools/misc/itm-tools/cargo-lock.patch321
-rw-r--r--pkgs/development/tools/misc/itm-tools/default.nix28
-rw-r--r--pkgs/development/tools/ocaml/dune/2.nix6
-rw-r--r--pkgs/development/tools/parsing/bison/default.nix4
-rw-r--r--pkgs/misc/ghostscript/default.nix5
-rw-r--r--pkgs/misc/hdt/default.nix27
-rw-r--r--pkgs/os-specific/linux/iproute/default.nix7
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.8.nix18
-rw-r--r--pkgs/os-specific/linux/systemd/cryptsetup-generator.nix34
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix32
-rw-r--r--pkgs/servers/sql/postgresql/default.nix20
-rw-r--r--pkgs/tools/compression/zstd/default.nix11
-rw-r--r--pkgs/tools/filesystems/fuse-overlayfs/default.nix2
-rw-r--r--pkgs/tools/networking/radsecproxy/default.nix4
-rw-r--r--pkgs/tools/networking/slirp4netns/default.nix2
-rw-r--r--pkgs/tools/networking/vpn-slice/default.nix25
-rw-r--r--pkgs/tools/security/gnupg/22.nix10
-rw-r--r--pkgs/tools/security/rhash/default.nix4
-rw-r--r--pkgs/top-level/aliases.nix1
-rw-r--r--pkgs/top-level/all-packages.nix37
-rw-r--r--pkgs/top-level/ocaml-packages.nix6
-rw-r--r--pkgs/top-level/python-packages.nix2
75 files changed, 1012 insertions, 234 deletions
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 29fbfa2a0bc..19b9ad57933 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -198,6 +198,7 @@
 /nixos/modules/virtualisation/containers.nix @NixOS/podman @zowoq
 /nixos/modules/virtualisation/cri-o.nix      @NixOS/podman @zowoq
 /nixos/modules/virtualisation/podman.nix     @NixOS/podman @zowoq
+/nixos/tests/cri-o.nix                       @NixOS/podman @zowoq
 /nixos/tests/podman.nix                      @NixOS/podman @zowoq
 
 # Blockchains
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 1a66e26ccad..fe06e428ff0 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3355,6 +3355,12 @@
     githubId = 131599;
     name = "Martin Weinelt";
   };
+  hh = {
+    email = "hh@m-labs.hk";
+    github = "HarryMakes";
+    githubId = 66358631;
+    name = "Harry Ho";
+  };
   hhm = {
     email = "heehooman+nixpkgs@gmail.com";
     github = "hhm0";
@@ -3727,6 +3733,12 @@
     }];
     name = "Jiri Daněk";
   };
+  jdbaldry = {
+    email = "jack.baldry@grafana.com";
+    github = "jdbaldry";
+    githubId = 4599384;
+    name = "Jack Baldry";
+  };
   jdehaas = {
     email = "qqlq@nullptr.club";
     github = "jeroendehaas";
@@ -8553,6 +8565,12 @@
     githubId = 699403;
     name = "Tomas Vestelind";
   };
+  tviti = {
+    email = "tviti@hawaii.edu";
+    github = "tviti";
+    githubId = 2251912;
+    name = "Taylor Viti";
+  };
   tvorog = {
     email = "marszaripov@gmail.com";
     github = "tvorog";
@@ -9444,4 +9462,10 @@
     github = "fzakaria";
     githubId = 605070;
   };
+  yevhenshymotiuk = {
+    name = "Yevhen Shymotiuk";
+    email = "yevhenshymotiuk@gmail.com";
+    github = "yevhenshymotiuk";
+    githubId = 44244245;
+  };
 }
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 96304ff6cec..b215392f250 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -25,7 +25,7 @@ let
       "nss-lookup.target"
       "nss-user-lookup.target"
       "time-sync.target"
-      #"cryptsetup.target"
+      "cryptsetup.target"
       "sigpwr.target"
       "timers.target"
       "paths.target"
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index fdfe2cfef29..7b8e1b2b56d 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -72,6 +72,7 @@ in
   convos = handleTest ./convos.nix {};
   corerad = handleTest ./corerad.nix {};
   couchdb = handleTest ./couchdb.nix {};
+  cri-o = handleTestOn ["x86_64-linux"] ./cri-o.nix {};
   deluge = handleTest ./deluge.nix {};
   dhparams = handleTest ./dhparams.nix {};
   dnscrypt-proxy2 = handleTestOn ["x86_64-linux"] ./dnscrypt-proxy2.nix {};
diff --git a/nixos/tests/cri-o.nix b/nixos/tests/cri-o.nix
new file mode 100644
index 00000000000..f13f1bdacb6
--- /dev/null
+++ b/nixos/tests/cri-o.nix
@@ -0,0 +1,19 @@
+# This test runs CRI-O and verifies via critest
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "cri-o";
+  maintainers = with pkgs.stdenv.lib.maintainers; teams.podman.members;
+
+  nodes = {
+    crio = {
+      virtualisation.cri-o.enable = true;
+    };
+  };
+
+  testScript = ''
+    start_all()
+    crio.wait_for_unit("crio.service")
+    crio.succeed(
+        "critest --ginkgo.focus='Runtime info' --runtime-endpoint unix:///var/run/crio/crio.sock"
+    )
+  '';
+})
diff --git a/nixos/tests/systemd.nix b/nixos/tests/systemd.nix
index a653932fb37..9d21f9158f3 100644
--- a/nixos/tests/systemd.nix
+++ b/nixos/tests/systemd.nix
@@ -4,7 +4,10 @@ import ./make-test-python.nix ({ pkgs, ... }: {
   machine = { lib, ... }: {
     imports = [ common/user-account.nix common/x11.nix ];
 
-    virtualisation.emptyDiskImages = [ 512 ];
+    virtualisation.emptyDiskImages = [ 512 512 ];
+    virtualisation.memorySize = 1024;
+
+    environment.systemPackages = [ pkgs.cryptsetup ];
 
     fileSystems = lib.mkVMOverride {
       "/test-x-initrd-mount" = {
@@ -144,5 +147,25 @@ import ./make-test-python.nix ({ pkgs, ... }: {
         assert "RuntimeWatchdogUSec=30s" in output
         assert "RebootWatchdogUSec=10m" in output
         assert "KExecWatchdogUSec=5m" in output
+
+    # Test systemd cryptsetup support
+    with subtest("systemd successfully reads /etc/crypttab and unlocks volumes"):
+        # create a luks volume and put a filesystem on it
+        machine.succeed(
+            "echo -n supersecret | cryptsetup luksFormat -q /dev/vdc -",
+            "echo -n supersecret | cryptsetup luksOpen --key-file - /dev/vdc foo",
+            "mkfs.ext3 /dev/mapper/foo",
+        )
+
+        # create a keyfile and /etc/crypttab
+        machine.succeed("echo -n supersecret > /var/lib/luks-keyfile")
+        machine.succeed("chmod 600 /var/lib/luks-keyfile")
+        machine.succeed("echo 'luks1 /dev/vdc /var/lib/luks-keyfile luks' > /etc/crypttab")
+
+        # after a reboot, systemd should unlock the volume and we should be able to mount it
+        machine.shutdown()
+        machine.succeed("systemctl status systemd-cryptsetup@luks1.service")
+        machine.succeed("mkdir -p /tmp/luks1")
+        machine.succeed("mount /dev/mapper/luks1 /tmp/luks1")
   '';
 })
diff --git a/pkgs/applications/gis/gmt/dcw.nix b/pkgs/applications/gis/gmt/dcw.nix
new file mode 100644
index 00000000000..58390e89290
--- /dev/null
+++ b/pkgs/applications/gis/gmt/dcw.nix
@@ -0,0 +1,32 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  pname = "dcw-gmt";
+  version = "1.1.4";
+  src = fetchurl {
+    url = "ftp://ftp.soest.hawaii.edu/gmt/dcw-gmt-${version}.tar.gz";
+    sha256 = "8d47402abcd7f54a0f711365cd022e4eaea7da324edac83611ca035ea443aad3";
+  };
+
+  installPhase = ''
+    mkdir -p $out/share/dcw-gmt
+    cp -rv ./* $out/share/dcw-gmt
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://www.soest.hawaii.edu/pwessel/dcw/";
+    description = "Vector basemap of the world, for use with GMT";
+    longDescription = ''
+      DCW-GMT is an enhancement to the original 1:1,000,000 scale vector basemap
+      of the world, available from the Princeton University Digital Map and
+      Geospatial Information Center. It contains more state boundaries (the
+      largest 8 countries are now represented) than the original data
+      source. Information about DCW can be found on Wikipedia
+      (https://en.wikipedia.org/wiki/Digital_Chart_of_the_World). This data is
+      for use by GMT, the Generic Mapping Tools.
+    '';
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ tviti ];
+  };
+
+}
diff --git a/pkgs/applications/gis/gmt/default.nix b/pkgs/applications/gis/gmt/default.nix
new file mode 100644
index 00000000000..8c7c7687f3d
--- /dev/null
+++ b/pkgs/applications/gis/gmt/default.nix
@@ -0,0 +1,73 @@
+{ stdenv, fetchurl, cmake, curl, Accelerate, CoreGraphics, CoreVideo
+, fftwSinglePrec, netcdf, pcre, gdal, blas, lapack, glibc, ghostscript, dcw-gmt
+, gshhg-gmt }:
+
+/* The onus is on the user to also install:
+    - ffmpeg for webm or mp4 output
+    - graphicsmagick for gif output
+*/
+
+stdenv.mkDerivation rec {
+  pname = "gmt";
+  version = "6.1.0";
+  src = fetchurl {
+    url = "https://github.com/GenericMappingTools/gmt/releases/download/${version}/gmt-${version}-src.tar.gz";
+    sha256 = "0vzxzpvbf1sqma2airsibxvqb9m4sajm7jsfr7rrv6q7924c7ijw";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ curl gdal netcdf pcre dcw-gmt gshhg-gmt ]
+    ++ (if stdenv.isDarwin then [
+      Accelerate
+      CoreGraphics
+      CoreVideo
+    ] else [
+      glibc
+      fftwSinglePrec
+      blas
+      lapack
+    ]);
+
+  propagatedBuildInputs = [ ghostscript ];
+
+  cmakeFlags = [
+    "-DGMT_DOCDIR=share/doc/gmt"
+    "-DGMT_MANDIR=share/man"
+    "-DGMT_LIBDIR=lib"
+    "-DCOPY_GSHHG:BOOL=FALSE"
+    "-DGSHHG_ROOT=${gshhg-gmt.out}/share/gshhg-gmt"
+    "-DCOPY_DCW:BOOL=FALSE"
+    "-DDCW_ROOT=${dcw-gmt.out}/share/dcw-gmt"
+    "-DGDAL_ROOT=${gdal.out}"
+    "-DNETCDF_ROOT=${netcdf.out}"
+    "-DPCRE_ROOT=${pcre.out}"
+    "-DGMT_INSTALL_TRADITIONAL_FOLDERNAMES:BOOL=FALSE"
+    "-DGMT_ENABLE_OPENMP:BOOL=TRUE"
+    "-DGMT_INSTALL_MODULE_LINKS:BOOL=FALSE"
+    "-DLICENSE_RESTRICTED=LGPL" # "GPL" and "no" also valid
+  ] ++ (with stdenv;
+    lib.optional (!isDarwin) [
+      "-DFFTW3_ROOT=${fftwSinglePrec.dev}"
+      "-DLAPACK_LIBRARY=${lapack}/lib/liblapack.so"
+      "-DBLAS_LIBRARY=${blas}/lib/libblas.so"
+    ]);
+
+  meta = with stdenv.lib; {
+    homepage = "https://www.generic-mapping-tools.org";
+    description = "Tools for manipulating geographic and cartesian data sets";
+    longDescription = ''
+      GMT is an open-source collection of command-line tools for manipulating
+      geographic and Cartesian data sets (including filtering, trend fitting,
+      gridding, projecting, etc.) and producing high-quality illustrations
+      ranging from simple x–y plots via contour maps to artificially illuminated
+      surfaces and 3D perspective views. It supports many map projections and
+      transformations and includes supporting data such as coastlines, rivers,
+      and political boundaries and optionally country polygons.
+    '';
+    platforms = [ "x86_64-linux" "x86_64-darwin" ];
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ tviti ];
+  };
+
+}
diff --git a/pkgs/applications/gis/gmt/gshhg.nix b/pkgs/applications/gis/gmt/gshhg.nix
new file mode 100644
index 00000000000..0f22f87c89b
--- /dev/null
+++ b/pkgs/applications/gis/gmt/gshhg.nix
@@ -0,0 +1,31 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  pname = "gshhg-gmt";
+  version = "2.3.7";
+  src = fetchurl {
+    url = "ftp://ftp.soest.hawaii.edu/gmt/gshhg-gmt-${version}.tar.gz";
+    sha256 = "9bb1a956fca0718c083bef842e625797535a00ce81f175df08b042c2a92cfe7f";
+  };
+
+  installPhase = ''
+    mkdir -p $out/share/gshhg-gmt
+    cp -rv ./* $out/share/gshhg-gmt
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://www.soest.hawaii.edu/pwessel/gshhg/";
+    description = "High-resolution shoreline data set, for use with GMT";
+    longDescription = ''
+      GSHHG is a high-resolution shoreline data set amalgamated from two
+      databases: Global Self-consistent Hierarchical High-resolution Shorelines
+      (GSHHS) and CIA World Data Bank II (WDBII). GSHHG contains vector
+      descriptions at five different resolutions of land outlines, lakes,
+      rivers, and political boundaries. This data is for use by GMT, the Generic
+      Mapping Tools.
+    '';
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ tviti ];
+  };
+
+}
diff --git a/pkgs/applications/misc/systembus-notify/default.nix b/pkgs/applications/misc/systembus-notify/default.nix
index 28c1be4219d..374adc6c89b 100644
--- a/pkgs/applications/misc/systembus-notify/default.nix
+++ b/pkgs/applications/misc/systembus-notify/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "systembus-notify";
-  version = "1.0";
+  version = "1.1";
 
   src = fetchFromGitHub {
     owner = "rfjakob";
     repo = "systembus-notify";
     rev = "v${version}";
-    sha256 = "11zq84qfmbyl51d3r6294l2bjhlgwa9bx7d263g9fkqrwsg0si0y";
+    sha256 = "1pdn45rfpwhrf20hs87qmk2j8sr7ab8161f81019wnypnb1q2fsv";
   };
 
   buildInputs = [ systemd ];
diff --git a/pkgs/applications/networking/cluster/cni/plugins.nix b/pkgs/applications/networking/cluster/cni/plugins.nix
index d3b2addee10..3822f453a30 100644
--- a/pkgs/applications/networking/cluster/cni/plugins.nix
+++ b/pkgs/applications/networking/cluster/cni/plugins.nix
@@ -38,7 +38,7 @@ buildGoModule rec {
     "plugins/meta/tuning"
   ];
 
-  passthru.tests.podman = nixosTests.podman;
+  passthru.tests = { inherit (nixosTests) cri-o podman; };
 
   meta = with lib; {
     description = "Some standard networking plugins, maintained by the CNI team";
diff --git a/pkgs/applications/networking/instant-messengers/ytalk/default.nix b/pkgs/applications/networking/instant-messengers/ytalk/default.nix
new file mode 100644
index 00000000000..8cb22aabc69
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/ytalk/default.nix
@@ -0,0 +1,21 @@
+{ stdenv, fetchurl, ncurses }:
+
+stdenv.mkDerivation rec {
+  pname = "ytalk";
+  version = "3.3.0";
+
+  src = fetchurl {
+    url = "ftp://ftp.ourproject.org/pub/ytalk/${pname}-${version}.tar.gz";
+    sha256 = "1d3jhnj8rgzxyxjwfa22vh45qwzjvxw1qh8fz6b7nfkj3zvk9jvf";
+  };
+
+  buildInputs = [ ncurses ];
+
+  meta = {
+    homepage    = "http://ytalk.ourproject.org";
+    description = "A terminal based talk client";
+    platforms   = stdenv.lib.platforms.unix;
+    maintainers = with stdenv.lib.maintainers; [ taeer ];
+    license     = stdenv.lib.licenses.gpl2Plus;
+  };
+}
diff --git a/pkgs/applications/virtualization/conmon/default.nix b/pkgs/applications/virtualization/conmon/default.nix
index 675d713f4b4..064500fde7f 100644
--- a/pkgs/applications/virtualization/conmon/default.nix
+++ b/pkgs/applications/virtualization/conmon/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
 
   installFlags = [ "PREFIX=$(out)" ];
 
-  passthru.tests.podman = nixosTests.podman;
+  passthru.tests = { inherit (nixosTests) cri-o podman; };
 
   meta = with stdenv.lib; {
     homepage = "https://github.com/containers/conmon";
diff --git a/pkgs/applications/virtualization/cri-o/default.nix b/pkgs/applications/virtualization/cri-o/default.nix
index 9ec34e1b54a..d0c8938e6de 100644
--- a/pkgs/applications/virtualization/cri-o/default.nix
+++ b/pkgs/applications/virtualization/cri-o/default.nix
@@ -10,6 +10,7 @@
 , libselinux
 , lvm2
 , pkg-config
+, nixosTests
 }:
 
 buildGoModule rec {
@@ -57,6 +58,8 @@ buildGoModule rec {
     installManPage docs/*.[1-9]
   '';
 
+  passthru.tests = { inherit (nixosTests) cri-o; };
+
   meta = with stdenv.lib; {
     homepage = "https://cri-o.io";
     description = ''
diff --git a/pkgs/applications/virtualization/cri-o/wrapper.nix b/pkgs/applications/virtualization/cri-o/wrapper.nix
index 1578eaf4f58..298bec6550e 100644
--- a/pkgs/applications/virtualization/cri-o/wrapper.nix
+++ b/pkgs/applications/virtualization/cri-o/wrapper.nix
@@ -27,7 +27,7 @@ let
 
 in runCommand cri-o.name {
   name = "${cri-o.pname}-wrapper-${cri-o.version}";
-  inherit (cri-o) pname version;
+  inherit (cri-o) pname version passthru;
 
   meta = builtins.removeAttrs cri-o.meta [ "outputsToInstall" ];
 
diff --git a/pkgs/applications/virtualization/crun/default.nix b/pkgs/applications/virtualization/crun/default.nix
index 4c5699419eb..5f002f5ddc8 100644
--- a/pkgs/applications/virtualization/crun/default.nix
+++ b/pkgs/applications/virtualization/crun/default.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  passthru.tests.podman = nixosTests.podman;
+  passthru.tests = { inherit (nixosTests) podman; };
 
   meta = with lib; {
     description = "A fast and lightweight fully featured OCI runtime and C library for running containers";
diff --git a/pkgs/applications/virtualization/podman/default.nix b/pkgs/applications/virtualization/podman/default.nix
index cc805aefc9f..b6656ea50bd 100644
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@@ -60,7 +60,7 @@ buildGoModule rec {
     MANDIR=$man/share/man make install.man-nobuild
   '';
 
-  passthru.tests.podman = nixosTests.podman;
+  passthru.tests = { inherit (nixosTests) podman; };
 
   meta = with stdenv.lib; {
     homepage = "https://podman.io/";
diff --git a/pkgs/applications/virtualization/runc/default.nix b/pkgs/applications/virtualization/runc/default.nix
index ecd282d6f7d..fd3d914af66 100644
--- a/pkgs/applications/virtualization/runc/default.nix
+++ b/pkgs/applications/virtualization/runc/default.nix
@@ -45,7 +45,7 @@ buildGoPackage rec {
     installManPage man/*/*.[1-9]
   '';
 
-  passthru.tests.podman = nixosTests.podman;
+  passthru.tests = { inherit (nixosTests) cri-o podman; };
 
   meta = with lib; {
     homepage = "https://github.com/opencontainers/runc";
diff --git a/pkgs/build-support/alternatives/blas/default.nix b/pkgs/build-support/alternatives/blas/default.nix
index 9e1aacfaf82..5ebbc737e11 100644
--- a/pkgs/build-support/alternatives/blas/default.nix
+++ b/pkgs/build-support/alternatives/blas/default.nix
@@ -70,7 +70,7 @@ stdenv.mkDerivation {
     exit 1
   fi
 
-  nm -an "$libblas" | cut -f3 -d' ' > symbols
+  $NM -an "$libblas" | cut -f3 -d' ' > symbols
   for symbol in ${toString blasFortranSymbols}; do
     grep -q "^$symbol_$" symbols || { echo "$symbol" was not found in "$libblas"; exit 1; }
   done
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 4f3680f2197..6ee287e287b 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -209,6 +209,7 @@ stdenv.mkDerivation {
       wrap ${targetPrefix}gfortran $wrapper $ccPath/${targetPrefix}gfortran
       ln -sv ${targetPrefix}gfortran $out/bin/${targetPrefix}g77
       ln -sv ${targetPrefix}gfortran $out/bin/${targetPrefix}f77
+      export named_fc=${targetPrefix}gfortran
     ''
 
     + optionalString cc.langJava or false ''
@@ -227,8 +228,8 @@ stdenv.mkDerivation {
 
   setupHooks = [
     ../setup-hooks/role.bash
-    ./setup-hook.sh
-  ];
+  ] ++ stdenv.lib.optional (cc.langC or true) ./setup-hook.sh
+    ++ stdenv.lib.optional (cc.langFortran or false) ./fortran-hook.sh;
 
   postFixup =
     # Ensure flags files exists, as some other programs cat them. (That these
diff --git a/pkgs/build-support/cc-wrapper/fortran-hook.sh b/pkgs/build-support/cc-wrapper/fortran-hook.sh
new file mode 100644
index 00000000000..d72f314c01c
--- /dev/null
+++ b/pkgs/build-support/cc-wrapper/fortran-hook.sh
@@ -0,0 +1,11 @@
+getTargetRole
+getTargetRoleWrapper
+
+export FC${role_post}=@named_fc@
+
+# If unset, assume the default hardening flags.
+# These are different for fortran.
+: ${NIX_HARDENING_ENABLE="stackprotector pic strictoverflow relro bindnow"}
+export NIX_HARDENING_ENABLE
+
+unset -v role_post
diff --git a/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix b/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix
index 2e89e6b9c27..e558eb66d40 100644
--- a/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-desktop";
-  version = "3.36.4";
+  version = "3.36.5";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-desktop/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1ilv49qkppbbag5728iswg1jhhqx9hbj7j8k8wccnbyaq54bsyq0";
+    sha256 = "0lxpgb199hn37vq822qg9g43pwixbki3x5lkazqa77qhjhlj98gf";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/go/1.14.nix b/pkgs/development/compilers/go/1.14.nix
index d9fc67cf46e..0bf972ff80f 100644
--- a/pkgs/development/compilers/go/1.14.nix
+++ b/pkgs/development/compilers/go/1.14.nix
@@ -31,11 +31,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.14.6";
+  version = "1.14.7";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "02acr52bxfjlr3m11576gdwn8hjv1pr2pffcis913m0m31w9vz3k";
+    sha256 = "1qrhdjdzi1knchk1wmlaqgkqhxkq2niw14b931rhqrk36m1r4hq6";
   };
 
   # perl is used for testing go vet
diff --git a/pkgs/development/compilers/rust/1_45.nix b/pkgs/development/compilers/rust/1_45.nix
index c72292679e5..1a634d3f51e 100644
--- a/pkgs/development/compilers/rust/1_45.nix
+++ b/pkgs/development/compilers/rust/1_45.nix
@@ -16,8 +16,8 @@
 } @ args:
 
 import ./default.nix {
-  rustcVersion = "1.45.0";
-  rustcSha256 = "0z6dh0yd3fcm3qh960wi4s6fa6pxz9mh77psycsqfkkx5kqra15s";
+  rustcVersion = "1.45.2";
+  rustcSha256 = "0273a1g3f59plyi1n0azf21qjzwml1yqdnj5z472crz37qggr8xp";
 
   # Note: the version MUST be one version prior to the version we're
   # building
diff --git a/pkgs/development/interpreters/python/cpython/2.7/CVE-2019-20907.patch b/pkgs/development/interpreters/python/cpython/2.7/CVE-2019-20907.patch
new file mode 100644
index 00000000000..cf67ae2b51b
--- /dev/null
+++ b/pkgs/development/interpreters/python/cpython/2.7/CVE-2019-20907.patch
@@ -0,0 +1,24 @@
+From 5a8d121a1f3ef5ad7c105ee378cc79a3eac0c7d4 Mon Sep 17 00:00:00 2001
+From: Rishi <rishi_devan@mail.com>
+Date: Wed, 15 Jul 2020 13:51:00 +0200
+Subject: [PATCH] bpo-39017: Avoid infinite loop in the tarfile module
+ (GH-21454)
+
+Avoid infinite loop when reading specially crafted TAR files using the tarfile module
+(CVE-2019-20907).
+---
+ Lib/tarfile.py                                    |   2 ++
+
+diff --git a/Lib/tarfile.py b/Lib/tarfile.py
+index e2b60532f6..6769066cab 100755
+--- a/Lib/tarfile.py
++++ b/Lib/tarfile.py
+@@ -1249,6 +1249,8 @@ class TarInfo(object):
+ 
+             length, keyword = match.groups()
+             length = int(length)
++            if length == 0:
++                raise InvalidHeaderError("invalid header")
+             value = buf[match.end(2) + 1:match.start(1) + length - 1]
+ 
+             # Normally, we could just use "utf-8" as the encoding and "strict"
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index 62aae7b2212..2cfaa69a4c8 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -90,6 +90,9 @@ let
 
       # Backport from CPython 3.8 of a good list of tests to run for PGO.
       ./profile-task.patch
+
+      # Patch is likely to go away in the next release (if there is any)
+      ./CVE-2019-20907.patch
     ] ++ optionals (x11Support && stdenv.isDarwin) [
       ./use-correct-tcl-tk-on-darwin.patch
     ] ++ optionals stdenv.isLinux [
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 4a8d4ab4bfb..b25d613eb7f 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -156,6 +156,8 @@ in with passthru; stdenv.mkDerivation {
   ];
 
   postPatch = ''
+    substituteInPlace Lib/subprocess.py \
+      --replace "'/bin/sh'" "'${bash}/bin/sh'"
   '' + optionalString (x11Support && (tix != null)) ''
     substituteInPlace "Lib/tkinter/tix.py" --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
   '';
@@ -289,6 +291,13 @@ in with passthru; stdenv.mkDerivation {
     find $out -name "*.py" | ${pythonForBuildInterpreter} -OO -m compileall -q -f -x "lib2to3" -i -
     '' + optionalString stripBytecode ''
     find $out -type d -name __pycache__ -print0 | xargs -0 -I {} rm -rf "{}"
+    '' + ''
+    # *strip* shebang from libpython gdb script - it should be dual-syntax and
+    # interpretable by whatever python the gdb in question is using, which may
+    # not even match the major version of this python. doing this after the
+    # bytecode compilations for the same reason.
+    mkdir -p $out/share/gdb
+    sed '/^#!/d' Tools/gdb/libpython.py > $out/share/gdb/libpython.py
   '';
 
   preFixup = stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
@@ -306,6 +315,8 @@ in with passthru; stdenv.mkDerivation {
     pythonForBuild buildPackages.bash
   ];
 
+  separateDebugInfo = true;
+
   inherit passthru;
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/interpreters/red/default.nix b/pkgs/development/interpreters/red/default.nix
index e1460ec51a2..554dc81bffb 100644
--- a/pkgs/development/interpreters/red/default.nix
+++ b/pkgs/development/interpreters/red/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "red";
-  version = "0.6.3";
+  version = "0.6.4";
   src = fetchFromGitHub {
-    rev = "6a43c767fa2e85d668b83f749158a18e62c30f70";
+    rev = "755eb943ccea9e78c2cab0f20b313a52404355cb";
     owner = "red";
     repo = "red";
-    sha256 = "1zh6xc728bs7r4v5jz1jjrdk0xd838xsxmvy9gfg75a3zffm0slr";
+    sha256 = "sha256:045rrg9666zczgrwyyyglivzdzja103s52b0fzj7hqmr1fz68q37";
   };
 
   rebol = fetchurl {
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     ${r2} -qw red.r tests/hello.red
 
     # Compiling the Red console...
-    ${r2} -qw red.r -r environment/console/console.red
+    ${r2} -qw red.r -r environment/console/CLI/console.red
 
     # Generating docs...
     cd docs
diff --git a/pkgs/development/libraries/check/default.nix b/pkgs/development/libraries/check/default.nix
index e98fa465e0b..be000e457c4 100644
--- a/pkgs/development/libraries/check/default.nix
+++ b/pkgs/development/libraries/check/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "check";
-  version = "0.15.0";
+  version = "0.15.2";
 
   src = fetchurl {
     url = "https://github.com/libcheck/check/releases/download/${version}/check-${version}.tar.gz";
-    sha256 = "0q5cs6rqbq8a1m9ij3dxnsjcs31mvg0b2i77g0iykqd6iz3f78mf";
+    sha256 = "02m25y9m46pb6n46s51av62kpd936lkfv3b13kfpckgvmh5lxpm8";
   };
 
   # Test can randomly fail: https://hydra.nixos.org/build/7243912
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 5b98884c1fc..d763fb51354 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -126,6 +126,7 @@ stdenv.mkDerivation rec {
     # Docs
       (ifMinVer "0.6" "--disable-doc")
     # External Libraries
+      "--enable-libass"
       "--enable-bzlib"
       "--enable-gnutls"
       (ifMinVer "1.0" "--enable-fontconfig")
diff --git a/pkgs/development/libraries/ilmbase/cross.patch b/pkgs/development/libraries/ilmbase/cross.patch
deleted file mode 100644
index 207a440a0d8..00000000000
--- a/pkgs/development/libraries/ilmbase/cross.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From: Helmut Grohne <>
-Subject: compile build tools with the build architecture compiler
-
-Patch-Source: https://github.com/openexr/openexr/issues/221
-
-Index: ilmbase-2.2.0/configure.ac
-===================================================================
---- ilmbase-2.2.0.orig/configure.ac
-+++ ilmbase-2.2.0/configure.ac
-@@ -28,6 +28,7 @@
- AC_PROG_LN_S
- AC_PROG_LIBTOOL
- AC_PROG_MAKE_SET
-+AX_PROG_CXX_FOR_BUILD
- 
- dnl
- dnl PKGCONFIG preparations
-Index: ilmbase-2.2.0/Half/Makefile.am
-===================================================================
---- ilmbase-2.2.0.orig/Half/Makefile.am
-+++ ilmbase-2.2.0/Half/Makefile.am
-@@ -17,9 +17,11 @@
- 
- CLEANFILES = eLut eLut.h toFloat toFloat.h
- 
--eLut_SOURCES = eLut.cpp
-+eLut$(EXEEXT): eLut.cpp
-+	$(CXX_FOR_BUILD) $(CXXFLAGS_FOR_BUILD) $< -o $@
- 
--toFloat_SOURCES = toFloat.cpp
-+toFloat$(EXEEXT): toFloat.cpp
-+	$(CXX_FOR_BUILD) $(CXXFLAGS_FOR_BUILD) $< -o $@
- 
- eLut.h:	eLut
- 	./eLut > eLut.h
diff --git a/pkgs/development/libraries/ilmbase/default.nix b/pkgs/development/libraries/ilmbase/default.nix
index ac78257b74a..68bd677cf77 100644
--- a/pkgs/development/libraries/ilmbase/default.nix
+++ b/pkgs/development/libraries/ilmbase/default.nix
@@ -2,7 +2,6 @@
 , lib
 , buildPackages
 , cmake
-, libtool
 , openexr
 }:
 
@@ -12,26 +11,23 @@ stdenv.mkDerivation rec {
 
   # the project no longer provides separate tarballs. We may even want to merge
   # the ilmbase package into openexr in the future.
-  src = openexr.src;
-
-  sourceRoot = "source/IlmBase";
+  inherit (openexr) src patches;
 
   outputs = [ "out" "dev" ];
 
-  nativeBuildInputs = [ cmake libtool ];
+  nativeBuildInputs = [ cmake ];
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
-  patches = [
-    ./cross.patch
-  ] ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.libc != "glibc") [
-    openexr.non_glibc_fpstate_patch # see description of this patch in `openexr`
-  ];
-
   # fails 1 out of 1 tests with
   # "lt-ImathTest: testBoxAlgo.cpp:892: void {anonymous}::boxMatrixTransform(): Assertion `b21 == b2' failed"
   # at least on i686. spooky!
   doCheck = stdenv.isx86_64;
 
+  preConfigure = ''
+    # Need to cd after patches for openexr patches to apply.
+    cd IlmBase
+  '';
+
   meta = with stdenv.lib; {
     description = " A library for 2D/3D vectors and matrices and other mathematical objects, functions and data types for computer graphics";
     homepage = "https://www.openexr.com/";
diff --git a/pkgs/development/libraries/imlib2/default.nix b/pkgs/development/libraries/imlib2/default.nix
index 36b1063531e..458b3d29d52 100644
--- a/pkgs/development/libraries/imlib2/default.nix
+++ b/pkgs/development/libraries/imlib2/default.nix
@@ -12,11 +12,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "imlib2";
-  version = "1.6.1";
+  version = "1.7.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/enlightenment/${pname}-${version}.tar.bz2";
-    sha256 = "0v8n3dswx7rxqfd0q03xwc7j2w1mv8lv18rdxv487a1xw5vklfad";
+    sha256 = "0zdk4afdrrr1539f2q15zja19j4wwfmpswzws2ffgflcnhywlxhr";
   };
 
   buildInputs = [
diff --git a/pkgs/development/libraries/libbytesize/default.nix b/pkgs/development/libraries/libbytesize/default.nix
index ec14b2a6091..c93a59d462f 100644
--- a/pkgs/development/libraries/libbytesize/default.nix
+++ b/pkgs/development/libraries/libbytesize/default.nix
@@ -4,7 +4,7 @@
 }:
 
 let
-  version = "2.3";
+  version = "2.4";
 in stdenv.mkDerivation rec {
   pname = "libbytesize";
   inherit version;
@@ -13,7 +13,7 @@ in stdenv.mkDerivation rec {
     owner = "storaged-project";
     repo = "libbytesize";
     rev = version;
-    sha256 = "1nrlmn63k0ix1yzn8v4lni5n5b4c0b6w9f33p1ig113ymmdvcc0h";
+    sha256 = "1kq0hnw2yxjdmcrwvgp0x4j1arkka23k8vp2l6nqcw9lc15x18fp";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/libevdev/default.nix b/pkgs/development/libraries/libevdev/default.nix
index c769006e0bf..fdd5e20640a 100644
--- a/pkgs/development/libraries/libevdev/default.nix
+++ b/pkgs/development/libraries/libevdev/default.nix
@@ -2,22 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libevdev";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "17pb5375njb1r05xmk0r57a2j986ihglh2n5nqcylbag4rj8mqg7";
+    sha256 = "1jvsphdrs1i54ccjcn6ll26jy42am7h28lbsvwa6pmxgqm43qq7m";
   };
 
-  patches = [
-    # Fix libevdev-python tests on aarch64
-    # https://gitlab.freedesktop.org/libevdev/libevdev/merge_requests/63
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/libevdev/libevdev/commit/66113fe84f62bab3a672a336eb10b255d2aa5ce7.patch";
-      sha256 = "gZKr/P+/OqU69IGslP8CQlcGuyzA/ulcm+nGwHdis58=";
-    })
-  ];
-
   nativeBuildInputs = [ python3 ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index cb8009011b6..576a2fec921 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -27,11 +27,11 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "libinput";
-  version = "1.15.6";
+  version = "1.16.1";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libinput/${pname}-${version}.tar.xz";
-    sha256 = "073z61dw46cyq0635a5n1mw7hw4qdgr58gbwwb3ds5v3d8hymvdf";
+    sha256 = "e6fRru3RUWi7IdF+nmKKocJ5V5Y6Qjo/6jk4pQF1hTk=";
   };
 
   outputs = [ "bin" "out" "dev" ];
diff --git a/pkgs/development/libraries/libipt/default.nix b/pkgs/development/libraries/libipt/default.nix
index cb4db488dc4..79ae927fc24 100644
--- a/pkgs/development/libraries/libipt/default.nix
+++ b/pkgs/development/libraries/libipt/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libipt";
-  version = "2.0.1";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "libipt";
     rev = "v${version}";
-    sha256 = "19y1lk5z1rf8xmr08m8zrpjkgr5as83b96xyaxwn67m2wz58mpmh";
+    sha256 = "095agnk7r2sq5yas6c1ri8fmsl55n4l5hkl6j5l397p9nxvxvrkc";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/libmbim/default.nix b/pkgs/development/libraries/libmbim/default.nix
index 0cc911fbd01..0e9a3784f38 100644
--- a/pkgs/development/libraries/libmbim/default.nix
+++ b/pkgs/development/libraries/libmbim/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libmbim";
-  version = "1.24.0";
+  version = "1.24.2";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libmbim/${pname}-${version}.tar.xz";
-    sha256 = "15hi1vq327drgi6h4dsi74lb7wg0sxd7mipa3irh5zgc7gn5qj9x";
+    sha256 = "1r41d4yddp8rgccxrkz9vg5lbrj3dr5vy71d8igrr147k44qq69j";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/development/libraries/libqmi/default.nix b/pkgs/development/libraries/libqmi/default.nix
index e577b403823..e8db7501534 100644
--- a/pkgs/development/libraries/libqmi/default.nix
+++ b/pkgs/development/libraries/libqmi/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libqmi";
-  version = "1.26.0";
+  version = "1.26.2";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libqmi/${pname}-${version}.tar.xz";
-    sha256 = "0h3fzmjlla7ib9wn4rv98bm40y2k28jcl29da4hjwyaqmvh2j13z";
+    sha256 = "00vvvfq74awg6mk0si1cdv79f6z6wqx11h47nl78a1h7zsr6fd0k";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/libuv/default.nix b/pkgs/development/libraries/libuv/default.nix
index aca345e6bbf..cf73a64f675 100644
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
       "getaddrinfo_fail" "getaddrinfo_fail_sync"
       "threadpool_multiple_event_loops" # times out on slow machines
       "get_passwd" # passed on NixOS but failed on other Linuxes
-      "tcp_writealot" # times out sometimes
+      "tcp_writealot" "udp_multicast_join" "udp_multicast_join6" # times out sometimes
     ] ++ stdenv.lib.optionals stdenv.isDarwin [
         # Sometimes: timeout (no output), failed uv_listen. Someone
         # should report these failures to libuv team. There tests should
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index ee0094b263c..f972e3f79a7 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -32,7 +32,7 @@ with stdenv.lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "20.1.4";
+  version = "20.1.5";
   branch  = versions.major version;
 in
 
@@ -47,7 +47,7 @@ stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "1zlrczmmkcy42w332rfmlicihlnrxmkrnkpb21sl98725cf2f038";
+    sha256 = "16y609zavqqhvxb55c06zwkg986qp6znvn7qjg4axw8bdqg8dhgs";
   };
 
   prePatch = "patchShebangs .";
diff --git a/pkgs/development/libraries/openexr/default.nix b/pkgs/development/libraries/openexr/default.nix
index a1f5183da90..b33b284f45c 100644
--- a/pkgs/development/libraries/openexr/default.nix
+++ b/pkgs/development/libraries/openexr/default.nix
@@ -6,51 +6,31 @@
 , ilmbase
 , fetchpatch
 , cmake
-, libtool
 }:
 
-let
-  non_glibc_fpstate_patch =
-    # Fix ilmbase/openexr using glibc-only fpstate.
-    # Found via https://git.alpinelinux.org/aports/tree/community/openexr/10-musl-_fpstate.patch?id=80d9611b7b8e406a554c6f511137e03ff26acbae,
-    # TODO Remove when https://github.com/AcademySoftwareFoundation/openexr/pull/798 is merged and available.
-    #      Remove it from `ilmbase` as well then.
-    (fetchpatch {
-      name = "ilmbase-musl-_fpstate.patch.patch";
-      url = "https://raw.githubusercontent.com/void-linux/void-packages/80bbc168faa25448bd3399f4df331b836e74b85c/srcpkgs/ilmbase/patches/musl-_fpstate.patch";
-      sha256 = "0appzbs9pd6dia5pzxmrs9ww35shlxi329ks6lchwzw4f2a81arz";
-    });
-in
-
 stdenv.mkDerivation rec {
   pname = "openexr";
-  version = "2.4.1";
+  version = "2.5.3";
+
+  outputs = [ "bin" "dev" "out" "doc" ];
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "openexr";
     rev = "v${version}";
-    sha256 = "020gyl8zv83ag6gbcchmqiyx9rh2jca7j8n52zx1gk4rck7kwc01";
+    sha256 = "xyYdRrwAYdnRZmErIK0tZspguqtrXvixO5+6nMDoOh8=";
   };
 
-  outputs = [ "bin" "dev" "out" "doc" ];
-  nativeBuildInputs = [ cmake libtool ];
-  propagatedBuildInputs = [ ilmbase zlib ];
-
-  postPatch =
-    if (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.libc != "glibc")
-      then
-        ''
-          patch -p0 < ${non_glibc_fpstate_patch}
-        ''
-      else null; # `null` avoids rebuild on glibc
-
-  enableParallelBuilding = true;
+  patches = [
+    # Fix pkg-config paths
+    (fetchpatch {
+      url = "https://github.com/AcademySoftwareFoundation/openexr/commit/6442fb71a86c09fb0a8118b6dbd93bcec4883a3c.patch";
+      sha256 = "bwD5WTKPT4DjOJDnPXIvT5hJJkH0b71Vo7qupWO9nPA=";
+    })
+  ];
 
-  passthru = {
-    # So that ilmbase (sharing the same source code) can re-use this patch.
-    inherit non_glibc_fpstate_patch;
-  };
+  nativeBuildInputs = [ cmake ];
+  propagatedBuildInputs = [ ilmbase zlib ];
 
   meta = with stdenv.lib; {
     description = "A high dynamic-range (HDR) image file format";
diff --git a/pkgs/development/libraries/qt-5/modules/qtdeclarative.nix b/pkgs/development/libraries/qt-5/modules/qtdeclarative.nix
index b611282294c..c22857a6dc6 100644
--- a/pkgs/development/libraries/qt-5/modules/qtdeclarative.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtdeclarative.nix
@@ -1,4 +1,4 @@
-{ qtModule, lib, python3, qtbase, qtsvg }:
+{ qtModule, lib, fetchpatch, python3, qtbase, qtsvg }:
 
 with lib;
 
@@ -23,4 +23,12 @@ qtModule {
     "bin/qmlscene"
     "bin/qmltestrunner"
   ];
+  patches =
+    # https://mail.kde.org/pipermail/kde-distro-packagers/2020-June/000419.html
+    lib.optional (lib.versionAtLeast qtbase.version "5.14.2")
+      (fetchpatch {
+        url = "https://codereview.qt-project.org/gitweb?p=qt/qtdeclarative.git;a=patch;h=3e47ac319b0f53c43cc02a8356c2dec4f0daeef4";
+        sha256 = "0wvncg7047q73nm0svc6kb14sigwk7sc53r4778kn033aj0qqszj";
+        name = "qtdeclarative-QQuickItemView-fix-max-extent.patch";
+      });
 }
diff --git a/pkgs/development/libraries/science/math/arpack/default.nix b/pkgs/development/libraries/science/math/arpack/default.nix
index 0829557d0f3..02d51f0c419 100644
--- a/pkgs/development/libraries/science/math/arpack/default.nix
+++ b/pkgs/development/libraries/science/math/arpack/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation {
   ];
 
   preCheck = if stdenv.isDarwin then ''
-    export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}`pwd`/lib
+    export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}`pwd`/lib:${blas}/lib:${lapack}/lib
   '' else ''
     export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}`pwd`/lib
   '' + ''
diff --git a/pkgs/development/libraries/x265/default.nix b/pkgs/development/libraries/x265/default.nix
index cfa19e5419f..ae3392aeb12 100644
--- a/pkgs/development/libraries/x265/default.nix
+++ b/pkgs/development/libraries/x265/default.nix
@@ -1,7 +1,6 @@
 { stdenv, fetchurl, fetchpatch, cmake, nasm, numactl
 , numaSupport ? stdenv.hostPlatform.isLinux && (stdenv.hostPlatform.isx86 || stdenv.hostPlatform.isAarch64)  # Enabled by default on NUMA platforms
 , debugSupport ? false # Run-time sanity checks (debugging)
-, highbitdepthSupport ? false # false=8bits per channel, true=10/12bits per channel
 , werrorSupport ? false # Warnings as errors
 , ppaSupport ? false # PPA profiling instrumentation
 , vtuneSupport ? false # Vtune profiling instrumentation
@@ -13,10 +12,17 @@
 let
   mkFlag = optSet: flag: if optSet then "-D${flag}=ON" else "-D${flag}=OFF";
   inherit (stdenv) is64bit;
-in
 
-stdenv.mkDerivation rec {
-  pname = "x265";
+  cmakeFlagsAll = [
+    "-DSTATIC_LINK_CRT=OFF"
+    (mkFlag debugSupport "CHECKED_BUILD")
+    (mkFlag ppaSupport "ENABLE_PPA")
+    (mkFlag vtuneSupport "ENABLE_VTUNE")
+    (mkFlag custatsSupport "DETAILED_CU_STATS")
+    (mkFlag unittestsSupport "ENABLE_TESTS")
+    (mkFlag werrorSupport "WARNINGS_AS_ERRORS")
+  ];
+
   version = "3.2";
 
   src = fetchurl {
@@ -27,8 +33,6 @@ stdenv.mkDerivation rec {
     sha256 = "0fqkhfhr22gzavxn60cpnj3agwdf5afivszxf3haj5k1sny7jk9n";
   };
 
-  enableParallelBuilding = true;
-
   patches = [
     # Fix build on ARM (#406)
     (fetchpatch {
@@ -37,22 +41,54 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  buildLib = has12Bit: stdenv.mkDerivation rec {
+    name = "libx265-${if has12Bit then "12" else "10"}-${version}";
+    inherit src patches;
+    enableParallelBuilding = true;
+
+    postPatch = ''
+      sed -i 's/unknown/${version}/g' source/cmake/version.cmake
+    '';
+
+    cmakeLibFlags = [
+      "-DENABLE_CLI=OFF"
+      "-DENABLE_SHARED=OFF"
+      "-DENABLE_HDR10_PLUS=ON"
+      "-DEXPORT_C_API=OFF"
+      "-DHIGH_BIT_DEPTH=ON"
+    ];
+    cmakeFlags = [(mkFlag has12Bit "MAIN12")] ++ cmakeLibFlags ++ cmakeFlagsAll;
+
+    preConfigure = ''
+      cd source
+    '';
+
+    nativeBuildInputs = [cmake nasm] ++ stdenv.lib.optional numaSupport numactl;
+  };
+
+  libx265-10 = buildLib false;
+  libx265-12 = buildLib true;
+in
+
+stdenv.mkDerivation rec {
+  pname = "x265";
+  inherit version src patches;
+
+  enableParallelBuilding = true;
+
   postPatch = ''
     sed -i 's/unknown/${version}/g' source/cmake/version.cmake
   '';
 
   cmakeFlags = [
-    (mkFlag debugSupport "CHECKED_BUILD")
-    "-DSTATIC_LINK_CRT=OFF"
-    (mkFlag (highbitdepthSupport && is64bit) "HIGH_BIT_DEPTH")
-    (mkFlag werrorSupport "WARNINGS_AS_ERRORS")
-    (mkFlag ppaSupport "ENABLE_PPA")
-    (mkFlag vtuneSupport "ENABLE_VTUNE")
-    (mkFlag custatsSupport "DETAILED_CU_STATS")
     "-DENABLE_SHARED=ON"
+    "-DHIGH_BIT_DEPTH=OFF"
+    "-DENABLE_HDR10_PLUS=OFF"
+    "-DEXTRA_LIB=${libx265-10}/lib/libx265.a;${libx265-12}/lib/libx265.a"
+    "-DLINKED_10BIT=ON"
+    "-DLINKED_12BIT=ON"
     (mkFlag cliSupport "ENABLE_CLI")
-    (mkFlag unittestsSupport "ENABLE_TESTS")
-  ];
+  ] ++ cmakeFlagsAll;
 
   preConfigure = ''
     cd source
diff --git a/pkgs/development/ocaml-modules/dune-action-plugin/default.nix b/pkgs/development/ocaml-modules/dune-action-plugin/default.nix
new file mode 100644
index 00000000000..fcb93aac799
--- /dev/null
+++ b/pkgs/development/ocaml-modules/dune-action-plugin/default.nix
@@ -0,0 +1,19 @@
+{ lib, buildDunePackage, dune_2, dune-glob, dune-private-libs }:
+
+buildDunePackage rec {
+  pname = "dune-action-plugin";
+  inherit (dune_2) src version;
+
+  useDune2 = true;
+
+  dontAddPrefix = true;
+
+  propagatedBuildInputs = [ dune-glob dune-private-libs ];
+
+  meta = with lib; {
+    inherit (dune_2.meta) homepage;
+    description = "API for writing dynamic Dune actions";
+    maintainers = [ maintainers.marsam ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/ocaml-modules/dune-glob/default.nix b/pkgs/development/ocaml-modules/dune-glob/default.nix
new file mode 100644
index 00000000000..34b79068c11
--- /dev/null
+++ b/pkgs/development/ocaml-modules/dune-glob/default.nix
@@ -0,0 +1,19 @@
+{ lib, buildDunePackage, dune_2, dune-private-libs }:
+
+buildDunePackage rec {
+  pname = "dune-glob";
+  inherit (dune_2) src version;
+
+  useDune2 = true;
+
+  dontAddPrefix = true;
+
+  propagatedBuildInputs = [ dune-private-libs ];
+
+  meta = with lib; {
+    inherit (dune_2.meta) homepage;
+    description = "Glob string matching language supported by dune";
+    maintainers = [ maintainers.marsam ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/ocaml-modules/dune-private-libs/default.nix b/pkgs/development/ocaml-modules/dune-private-libs/default.nix
index 6161bd1fe8e..9eb253f02e5 100644
--- a/pkgs/development/ocaml-modules/dune-private-libs/default.nix
+++ b/pkgs/development/ocaml-modules/dune-private-libs/default.nix
@@ -7,7 +7,7 @@ buildDunePackage rec {
 
   inherit (dune_2) src version;
 
-  minimumOCamlVersion = "4.07";
+  minimumOCamlVersion = "4.08";
 
   dontAddPrefix = true;
 
diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/default.nix
index 4501eafe7bd..98ba0b5c688 100644
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/default.nix
@@ -3,6 +3,7 @@
 , python
 , buildPythonPackage
 , gfortran
+, hypothesis
 , pytest
 , blas
 , lapack
@@ -67,6 +68,8 @@ in buildPythonPackage rec {
 
   doCheck = !isPyPy; # numpy 1.16+ hits a bug in pypy's ctypes, using either numpy or pypy HEAD fixes this (https://github.com/numpy/numpy/issues/13807)
 
+  checkInputs = [ hypothesis ];
+
   checkPhase = ''
     runHook preCheck
     pushd dist
diff --git a/pkgs/development/python-modules/userpath/default.nix b/pkgs/development/python-modules/userpath/default.nix
new file mode 100644
index 00000000000..8366a56158d
--- /dev/null
+++ b/pkgs/development/python-modules/userpath/default.nix
@@ -0,0 +1,30 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, click
+, distro
+}:
+
+buildPythonPackage rec {
+  pname = "userpath";
+  version = "1.4.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256="0mfjmvx286z1dmnrc7bm65x8gj8qrmkcyagl0vf5ywfq0bm48591";
+  };
+
+  propagatedBuildInputs = [ click distro ];
+
+  # test suite is difficult to emulate in sandbox due to shell manipulation
+  doCheck = false;
+
+  pythonImportsCheck = [ "click" "userpath" ];
+
+  meta = with lib; {
+    description = "Cross-platform tool for adding locations to the user PATH";
+    homepage = "https://github.com/ofek/userpath";
+    license = [ licenses.asl20 licenses.mit ];
+    maintainers = with maintainers; [ yevhenshymotiuk ];
+  };
+}
diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index 0b296f023ad..be9645453e3 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, pkgconfig
+{ stdenv, lib, fetchurl, pkgconfig, fetchpatch
 , bzip2, curl, expat, libarchive, xz, zlib, libuv, rhash
 , buildPackages
 # darwin attributes
@@ -19,12 +19,12 @@ stdenv.mkDerivation rec {
           + lib.optionalString useNcurses "-cursesUI"
           + lib.optionalString withQt5 "-qt5UI"
           + lib.optionalString useQt4 "-qt4UI";
-  version = "3.18.0";
+  version = "3.18.1";
 
   src = fetchurl {
     url = "${meta.homepage}files/v${lib.versions.majorMinor version}/cmake-${version}.tar.gz";
     # compare with https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}-SHA-256.txt
-    sha256 = "0aby67jn3i0rqhj6cvpm0f7idw3dl7jayaqxa9hkk9w2jk5zzd43";
+    sha256 = "0215srmc9l7ygwdpfms8yx0wbd96qgz2d58ykmdiarvysf5k7qy0";
   };
 
   patches = [
@@ -37,6 +37,12 @@ stdenv.mkDerivation rec {
     # Derived from https://github.com/libuv/libuv/commit/1a5d4f08238dd532c3718e210078de1186a5920d
     ./libuv-application-services.patch
 
+    # TODO: Remove this patch for a regression once CMake 3.18.2 is out:
+    (fetchpatch { # PCH: Avoid Apple-specific architecture flags on other platforms
+      url = "https://gitlab.kitware.com/cmake/cmake/-/commit/70ce1ad64a04a244bb1c03753da0752c61fc3a37.patch";
+      sha256 = "0jcdgv48j0dd4nlhyy3j0s3h6bcbrq2yg1mdhpgfqrb2y3p91fky";
+    })
+
   ] ++ lib.optional stdenv.isCygwin ./3.2.2-cygwin.patch;
 
   outputs = [ "out" ];
diff --git a/pkgs/development/tools/build-managers/cmake/setup-hook.sh b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
index 73f24a9a205..6ae560c5645 100755
--- a/pkgs/development/tools/build-managers/cmake/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
@@ -77,7 +77,7 @@ cmakeConfigurePhase() {
         fi
         # The argument sometimes contains garbage or variable interpolation.
         # When that is the case, let’s fall back to the derivation name.
-        if [[ -z "$shareDocName" ]] || echo "$shareDocName" | grep -q '[^a-zA-Z0-9_-+]'; then
+        if [[ -z "$shareDocName" ]] || echo "$shareDocName" | grep -q '[^a-zA-Z0-9_+-]'; then
             if [[ -n "${pname-}" ]]; then
                 shareDocName="$pname"
             else
diff --git a/pkgs/development/tools/documentation/doxygen/default.nix b/pkgs/development/tools/documentation/doxygen/default.nix
index a8e5f179916..772b654df93 100644
--- a/pkgs/development/tools/documentation/doxygen/default.nix
+++ b/pkgs/development/tools/documentation/doxygen/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
 
-  name = "doxygen-1.8.18";
+  name = "doxygen-1.8.19";
 
   src = fetchurl {
     urls = [
       "mirror://sourceforge/doxygen/${name}.src.tar.gz" # faster, with https, etc.
       "http://doxygen.nl/files/${name}.src.tar.gz"
     ];
-    sha256 = "0mh6s1ri1fs5yb27m0avnjsbcxpchgb9aaprq4bd3lj6vjg3s5qq";
+    sha256 = "1lvqfw2yzba588c5ggl8yhw7aw4xkk44mrghsd9yqlajc48x25dc";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/misc/itm-tools/cargo-lock.patch b/pkgs/development/tools/misc/itm-tools/cargo-lock.patch
new file mode 100644
index 00000000000..1559510cd9f
--- /dev/null
+++ b/pkgs/development/tools/misc/itm-tools/cargo-lock.patch
@@ -0,0 +1,321 @@
+diff --git a/Cargo.lock b/Cargo.lock
+new file mode 100644
+index 0000000..d9d39e5
+--- /dev/null
++++ b/Cargo.lock
+@@ -0,0 +1,315 @@
++# This file is automatically @generated by Cargo.
++# It is not intended for manual editing.
++[[package]]
++name = "addr2line"
++version = "0.12.2"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "602d785912f476e480434627e8732e6766b760c045bbf897d9dfaa9f4fbd399c"
++dependencies = [
++ "gimli",
++]
++
++[[package]]
++name = "adler32"
++version = "1.1.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "567b077b825e468cc974f0020d4082ee6e03132512f207ef1a02fd5d00d1f32d"
++
++[[package]]
++name = "ansi_term"
++version = "0.11.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "ee49baf6cb617b853aa8d93bf420db2383fab46d314482ca2803b40d5fde979b"
++dependencies = [
++ "winapi",
++]
++
++[[package]]
++name = "atty"
++version = "0.2.14"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
++dependencies = [
++ "hermit-abi",
++ "libc",
++ "winapi",
++]
++
++[[package]]
++name = "backtrace"
++version = "0.3.49"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "05100821de9e028f12ae3d189176b41ee198341eb8f369956407fea2f5cc666c"
++dependencies = [
++ "addr2line",
++ "cfg-if",
++ "libc",
++ "miniz_oxide",
++ "object",
++ "rustc-demangle",
++]
++
++[[package]]
++name = "bitflags"
++version = "1.2.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "cf1de2fe8c75bc145a2f577add951f8134889b4795d47466a54a5c846d691693"
++
++[[package]]
++name = "byteorder"
++version = "1.3.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "08c48aae112d48ed9f069b33538ea9e3e90aa263cfa3d1c24309612b1f7472de"
++
++[[package]]
++name = "cfg-if"
++version = "0.1.10"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
++
++[[package]]
++name = "clap"
++version = "2.33.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "bdfa80d47f954d53a35a64987ca1422f495b8d6483c0fe9f7117b36c2a792129"
++dependencies = [
++ "ansi_term",
++ "atty",
++ "bitflags",
++ "strsim",
++ "textwrap",
++ "unicode-width",
++ "vec_map",
++]
++
++[[package]]
++name = "either"
++version = "1.5.3"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "bb1f6b1ce1c140482ea30ddd3335fc0024ac7ee112895426e0a629a6c20adfe3"
++
++[[package]]
++name = "exitfailure"
++version = "0.5.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "2ff5bd832af37f366c6c194d813a11cd90ac484f124f079294f28e357ae40515"
++dependencies = [
++ "failure",
++]
++
++[[package]]
++name = "failure"
++version = "0.1.8"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "d32e9bd16cc02eae7db7ef620b392808b89f6a5e16bb3497d159c6b92a0f4f86"
++dependencies = [
++ "backtrace",
++ "failure_derive",
++]
++
++[[package]]
++name = "failure_derive"
++version = "0.1.8"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "aa4da3c766cd7a0db8242e326e9e4e081edd567072893ed320008189715366a4"
++dependencies = [
++ "proc-macro2",
++ "quote",
++ "syn",
++ "synstructure",
++]
++
++[[package]]
++name = "gimli"
++version = "0.21.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "bcc8e0c9bce37868955864dbecd2b1ab2bdf967e6f28066d65aaac620444b65c"
++
++[[package]]
++name = "hermit-abi"
++version = "0.1.15"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "3deed196b6e7f9e44a2ae8d94225d80302d81208b1bb673fd21fe634645c85a9"
++dependencies = [
++ "libc",
++]
++
++[[package]]
++name = "itm"
++version = "0.4.0"
++source = "git+https://github.com/rust-embedded/itm#5dd476d03de0738062a876fd3845900ab04833a4"
++dependencies = [
++ "byteorder",
++ "either",
++ "thiserror",
++]
++
++[[package]]
++name = "itm-tools"
++version = "0.1.0"
++dependencies = [
++ "clap",
++ "exitfailure",
++ "failure",
++ "itm",
++ "rustc-demangle",
++ "xmas-elf",
++]
++
++[[package]]
++name = "libc"
++version = "0.2.71"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "9457b06509d27052635f90d6466700c65095fdf75409b3fbdd903e988b886f49"
++
++[[package]]
++name = "miniz_oxide"
++version = "0.3.7"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "791daaae1ed6889560f8c4359194f56648355540573244a5448a83ba1ecc7435"
++dependencies = [
++ "adler32",
++]
++
++[[package]]
++name = "object"
++version = "0.20.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "1ab52be62400ca80aa00285d25253d7f7c437b7375c4de678f5405d3afe82ca5"
++
++[[package]]
++name = "proc-macro2"
++version = "1.0.18"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "beae6331a816b1f65d04c45b078fd8e6c93e8071771f41b8163255bbd8d7c8fa"
++dependencies = [
++ "unicode-xid",
++]
++
++[[package]]
++name = "quote"
++version = "1.0.7"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "aa563d17ecb180e500da1cfd2b028310ac758de548efdd203e18f283af693f37"
++dependencies = [
++ "proc-macro2",
++]
++
++[[package]]
++name = "rustc-demangle"
++version = "0.1.16"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "4c691c0e608126e00913e33f0ccf3727d5fc84573623b8d65b2df340b5201783"
++
++[[package]]
++name = "strsim"
++version = "0.8.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
++
++[[package]]
++name = "syn"
++version = "1.0.33"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "e8d5d96e8cbb005d6959f119f773bfaebb5684296108fb32600c00cde305b2cd"
++dependencies = [
++ "proc-macro2",
++ "quote",
++ "unicode-xid",
++]
++
++[[package]]
++name = "synstructure"
++version = "0.12.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "b834f2d66f734cb897113e34aaff2f1ab4719ca946f9a7358dba8f8064148701"
++dependencies = [
++ "proc-macro2",
++ "quote",
++ "syn",
++ "unicode-xid",
++]
++
++[[package]]
++name = "textwrap"
++version = "0.11.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060"
++dependencies = [
++ "unicode-width",
++]
++
++[[package]]
++name = "thiserror"
++version = "1.0.20"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "7dfdd070ccd8ccb78f4ad66bf1982dc37f620ef696c6b5028fe2ed83dd3d0d08"
++dependencies = [
++ "thiserror-impl",
++]
++
++[[package]]
++name = "thiserror-impl"
++version = "1.0.20"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "bd80fc12f73063ac132ac92aceea36734f04a1d93c1240c6944e23a3b8841793"
++dependencies = [
++ "proc-macro2",
++ "quote",
++ "syn",
++]
++
++[[package]]
++name = "unicode-width"
++version = "0.1.8"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "9337591893a19b88d8d87f2cec1e73fad5cdfd10e5a6f349f498ad6ea2ffb1e3"
++
++[[package]]
++name = "unicode-xid"
++version = "0.2.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "f7fe0bb3479651439c9112f72b6c505038574c9fbb575ed1bf3b797fa39dd564"
++
++[[package]]
++name = "vec_map"
++version = "0.8.2"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
++
++[[package]]
++name = "winapi"
++version = "0.3.9"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
++dependencies = [
++ "winapi-i686-pc-windows-gnu",
++ "winapi-x86_64-pc-windows-gnu",
++]
++
++[[package]]
++name = "winapi-i686-pc-windows-gnu"
++version = "0.4.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
++
++[[package]]
++name = "winapi-x86_64-pc-windows-gnu"
++version = "0.4.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
++
++[[package]]
++name = "xmas-elf"
++version = "0.6.2"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "22678df5df766e8d1e5d609da69f0c3132d794edf6ab5e75e7abcd2270d4cf58"
++dependencies = [
++ "zero",
++]
++
++[[package]]
++name = "zero"
++version = "0.1.2"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "5f1bc8a6b2005884962297587045002d8cfb8dcec9db332f4ca216ddc5de82c5"
diff --git a/pkgs/development/tools/misc/itm-tools/default.nix b/pkgs/development/tools/misc/itm-tools/default.nix
new file mode 100644
index 00000000000..6fb25695111
--- /dev/null
+++ b/pkgs/development/tools/misc/itm-tools/default.nix
@@ -0,0 +1,28 @@
+{ stdenv, fetchFromGitHub, rustPlatform, pkg-config }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "itm-tools";
+  version = "unstable-2019-11-15";
+
+  src = fetchFromGitHub {
+    owner = "japaric";
+    repo = pname;
+    rev = "e94155e44019d893ac8e6dab51cc282d344ab700";
+    sha256 = "19xkjym0i7y52cfhvis49c59nzvgw4906cd8bkz8ka38mbgfqgiy";
+  };
+
+  cargoPatches = [ ./cargo-lock.patch ];
+
+  cargoSha256 = "0rl2ph5igwjl7rwpwcf6afnxly5av7cd6va6wn82lxm606giyq75";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "Tools for analyzing ITM traces";
+    homepage = "https://github.com/japaric/itm-tools";
+    license = with licenses; [ asl20 mit ];
+    maintainers = with maintainers; [ hh sb0 ];
+  };
+}
\ No newline at end of file
diff --git a/pkgs/development/tools/ocaml/dune/2.nix b/pkgs/development/tools/ocaml/dune/2.nix
index d785302ebb5..eac705294f3 100644
--- a/pkgs/development/tools/ocaml/dune/2.nix
+++ b/pkgs/development/tools/ocaml/dune/2.nix
@@ -1,16 +1,16 @@
 { stdenv, fetchurl, ocaml, findlib }:
 
-if stdenv.lib.versionOlder ocaml.version "4.07"
+if stdenv.lib.versionOlder ocaml.version "4.08"
 then throw "dune is not available for OCaml ${ocaml.version}"
 else
 
 stdenv.mkDerivation rec {
   pname = "dune";
-  version = "2.6.2";
+  version = "2.7.0";
 
   src = fetchurl {
     url = "https://github.com/ocaml/dune/releases/download/${version}/dune-${version}.tbz";
-    sha256 = "1sc8ax198z42vhc3l6i04kknm9g44whifjivs19qgi3sybrw2vjg";
+    sha256 = "058wiyncczbmlfxj3cnwn5n68wkmbaf4mgjm2bkp2hffpn2wl5xl";
   };
 
   buildInputs = [ ocaml findlib ];
diff --git a/pkgs/development/tools/parsing/bison/default.nix b/pkgs/development/tools/parsing/bison/default.nix
index 357c8ea17cf..ca422f931da 100644
--- a/pkgs/development/tools/parsing/bison/default.nix
+++ b/pkgs/development/tools/parsing/bison/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bison";
-  version = "3.6.4";
+  version = "3.7.1";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "1s8kmfhg7a58vm65fc977ckp8zspy8diayrcjhs3cgrqnmjdx0w1";
+    sha256 = "04vx6sah3bnr3a5n9knw306sb3y41pjfl7k9ihbsimghkj1m5n8x";
   };
 
   nativeBuildInputs = [ m4 perl ] ++ stdenv.lib.optional stdenv.isSunOS help2man;
diff --git a/pkgs/misc/ghostscript/default.nix b/pkgs/misc/ghostscript/default.nix
index eca15faf1ad..d3d06d98cb1 100644
--- a/pkgs/misc/ghostscript/default.nix
+++ b/pkgs/misc/ghostscript/default.nix
@@ -45,6 +45,11 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
+    (fetchpatch {
+      name = "CVE-2020-15900.patch";
+      url = "https://github.com/ArtifexSoftware/ghostpdl/commit/5d499272b95a6b890a1397e11d20937de000d31b.patch";
+      sha256 = "1nnnrn8q33x7nc8227ygc60f3mj4bjzrhj40sxp6dah58rb5x5jz";
+    })
     ./urw-font-files.patch
     ./doc-no-ref.diff
     # rebased version of upstream http://git.ghostscript.com/?p=ghostpdl.git;a=patch;h=1b4c3669a20c,
diff --git a/pkgs/misc/hdt/default.nix b/pkgs/misc/hdt/default.nix
new file mode 100644
index 00000000000..8a4c7c3e6f5
--- /dev/null
+++ b/pkgs/misc/hdt/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchFromGitHub, autoreconfHook, libtool, pkgconfig, zlib, serd }:
+
+stdenv.mkDerivation rec {
+  pname = "hdt";
+  version = "1.3.3";
+
+  src = fetchFromGitHub {
+    owner = "rdfhdt";
+    repo = "hdt-cpp";
+    rev = "v${version}";
+    sha256 = "1vsq80jnix6cy78ayag7v8ajyw7h8dqyad1q6xkf2hzz3skvr34z";
+  };
+
+  buildInputs = [ zlib serd ];
+
+  nativeBuildInputs = [ autoreconfHook libtool pkgconfig ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    homepage = "http://www.rdfhdt.org/";
+    description = "Header Dictionary Triples (HDT) is a compression format for RDF data that can also be queried for Triple Patterns.";
+    license = licenses.lgpl21;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.koslambrou ];
+  };
+}
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index 3ac79464ac4..a9fcf455ee4 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -5,16 +5,19 @@
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "5.7.0";
+  version = "5.8.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "088gs56iqhdlpw1iqjwrss4zxd4zbl2wl8s2implrrdajjxcfpbj";
+    sha256 = "0vk4vickrpahdhl3zazr2qn2bf99v5549ncirjpwiy4h0a4izkfg";
   };
 
   preConfigure = ''
     # Don't try to create /var/lib/arpd:
     sed -e '/ARPDDIR/d' -i Makefile
+    # TODO: Drop temporary version fix for 5.8 (53159d81) once 5.9 is out:
+    substituteInPlace include/version.h \
+      --replace "v5.7.0-77-gb687d1067169" "5.8.0"
   '';
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/os-specific/linux/kernel/linux-5.8.nix b/pkgs/os-specific/linux/kernel/linux-5.8.nix
new file mode 100644
index 00000000000..a7b929740d2
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/linux-5.8.nix
@@ -0,0 +1,18 @@
+{ stdenv, buildPackages, fetchurl, perl, buildLinux, modDirVersionArg ? null, ... } @ args:
+
+with stdenv.lib;
+
+buildLinux (args // rec {
+  version = "5.8";
+
+  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
+  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
+
+  # branchVersion needs to be x.y
+  extraMeta.branch = versions.majorMinor version;
+
+  src = fetchurl {
+    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
+    sha256 = "1xgibkwb1yfl6qdlbxyagai0qc1pk5ark7giz1512hh6ma353xz7";
+  };
+} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/systemd/cryptsetup-generator.nix b/pkgs/os-specific/linux/systemd/cryptsetup-generator.nix
deleted file mode 100644
index 3fd8ff07f42..00000000000
--- a/pkgs/os-specific/linux/systemd/cryptsetup-generator.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ systemd, cryptsetup }:
-
-systemd.overrideAttrs (p: {
-  version = p.version;
-  name = "systemd-cryptsetup-generator-${p.version}";
-
-  buildInputs = p.buildInputs ++ [ cryptsetup ];
-  outputs = [ "out" ];
-
-  buildPhase = ''
-    ninja systemd-cryptsetup systemd-cryptsetup-generator
-  '';
-
-  # As ninja install is not used here, the rpath needs to be manually fixed.
-  # Otherwise the resulting binary doesn't properly link against systemd-shared.so
-  postFixup = ''
-    for prog in `find $out -type f -executable`; do
-      (patchelf --print-needed $prog | grep 'libsystemd-shared-.*\.so' > /dev/null) && (
-        patchelf --set-rpath `patchelf --print-rpath $prog`:"$out/lib/systemd" $prog
-      ) || true
-    done
-    # test it's OK
-    "$out"/lib/systemd/systemd-cryptsetup
-  '';
-
-  installPhase = ''
-    mkdir -p $out/lib/systemd/
-    cp systemd-cryptsetup $out/lib/systemd/systemd-cryptsetup
-    cp src/shared/*.so $out/lib/systemd/
-
-    mkdir -p $out/lib/systemd/system-generators/
-    cp systemd-cryptsetup-generator $out/lib/systemd/system-generators/systemd-cryptsetup-generator
-  '';
-})
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index a76156a985c..c0163dcafe6 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -1,5 +1,5 @@
-{ stdenv, lib, fetchFromGitHub, fetchpatch, pkgconfig, intltool, gperf, libcap
-, curl, kmod, gnupg, gnutar, xz, pam, acl, libuuid, m4, utillinux, libffi
+{ stdenv, lib, fetchFromGitHub, pkgconfig, intltool, gperf, libcap
+, curl, kmod, gnupg, gnutar, xz, pam, acl, libuuid, m4, e2fsprogs, utillinux, libffi
 , glib, kbd, libxslt, coreutils, libgcrypt, libgpgerror, libidn2, libapparmor
 , audit, lz4, bzip2, pcre2
 , linuxHeaders ? stdenv.cc.libc.linuxHeaders
@@ -9,6 +9,7 @@
 , patchelf
 , substituteAll
 , getent
+, cryptsetup, lvm2
 , buildPackages
 , perl
 , withSelinux ? false, libselinux
@@ -30,8 +31,9 @@ let gnupg-minimal = gnupg.override {
   zlib = null;
   bzip2 = null;
 };
+
 in stdenv.mkDerivation {
-  version = "245.6";
+  version = "245.7";
   pname = "systemd";
 
   # When updating, use https://github.com/systemd/systemd-stable tree, not the development one!
@@ -39,8 +41,8 @@ in stdenv.mkDerivation {
   src = fetchFromGitHub {
     owner = "systemd";
     repo = "systemd-stable";
-    rev = "aa0cb635f1f6a4d9b50ed2cca7782f3f751be933";
-    sha256 = "191f0r1g946bsqxky00z78wygsxi9pld11y2q4374bshnpsff2ll";
+    rev = "1e6233ed07f7af08550fffa7a885cac1ac67a2c3";
+    sha256 = "1hd5kc3mm7mg4i7hhi82wg4cpg4fpi2k6hzjq9sv07pkn2lw390w";
   };
 
   patches = [
@@ -89,7 +91,7 @@ in stdenv.mkDerivation {
     ];
   buildInputs =
     [ linuxHeaders libcap curl.dev kmod xz pam acl
-      /* cryptsetup */ libuuid glib libgcrypt libgpgerror libidn2
+      cryptsetup libuuid glib libgcrypt libgpgerror libidn2
       pcre2 ] ++
       stdenv.lib.optional withKexectools kexectools ++
       stdenv.lib.optional withLibseccomp libseccomp ++
@@ -176,12 +178,28 @@ in stdenv.mkDerivation {
     export LC_ALL="en_US.UTF-8";
     # FIXME: patch this in systemd properly (and send upstream).
     # already fixed in f00929ad622c978f8ad83590a15a765b4beecac9: (u)mount
-    for i in src/remount-fs/remount-fs.c src/core/mount.c src/core/swap.c src/fsck/fsck.c units/emergency.service.in units/rescue.service.in src/journal/cat.c src/shutdown/shutdown.c src/nspawn/nspawn.c src/shared/generator.c units/systemd-logind.service.in units/systemd-nspawn@.service.in; do
+    for i in \
+      src/core/mount.c \
+      src/core/swap.c \
+      src/cryptsetup/cryptsetup-generator.c \
+      src/fsck/fsck.c \
+      src/journal/cat.c \
+      src/nspawn/nspawn.c \
+      src/remount-fs/remount-fs.c \
+      src/shared/generator.c \
+      src/shutdown/shutdown.c \
+      units/emergency.service.in \
+      units/rescue.service.in \
+      units/systemd-logind.service.in \
+      units/systemd-nspawn@.service.in; \
+    do
       test -e $i
       substituteInPlace $i \
         --replace /usr/bin/getent ${getent}/bin/getent \
+        --replace /sbin/mkswap ${lib.getBin utillinux}/sbin/mkswap \
         --replace /sbin/swapon ${lib.getBin utillinux}/sbin/swapon \
         --replace /sbin/swapoff ${lib.getBin utillinux}/sbin/swapoff \
+        --replace /sbin/mke2fs ${lib.getBin e2fsprogs}/sbin/mke2fs \
         --replace /sbin/fsck ${lib.getBin utillinux}/sbin/fsck \
         --replace /bin/echo ${coreutils}/bin/echo \
         --replace /bin/cat ${coreutils}/bin/cat \
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 2b440f78e99..e759a62c2eb 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -182,41 +182,41 @@ let
 in self: {
 
   postgresql_9_5 = self.callPackage generic {
-    version = "9.5.22";
+    version = "9.5.23";
     psqlSchema = "9.5";
-    sha256 = "03v4d4nr9f86y0i1j5jmvfan5w8y4ga1mar59lhcnj3jl5q58ma8";
+    sha256 = "0rl31jc3kg2wq6hazyd297gnmx3cibjvivllbsivii2m6dzgl573";
     this = self.postgresql_9_5;
     inherit self;
   };
 
   postgresql_9_6 = self.callPackage generic {
-    version = "9.6.18";
+    version = "9.6.19";
     psqlSchema = "9.6";
-    sha256 = "16crr2a1sl97aiacqzd0bk56yl1abq6blc0c6qpx5rl5ny1c4zji";
+    sha256 = "1c2wnl5bbpjs1s1rpzvlnzsqlpb0p823zw7s38nhpgnxrja3myb1";
     this = self.postgresql_9_6;
     inherit self;
   };
 
   postgresql_10 = self.callPackage generic {
-    version = "10.13";
+    version = "10.14";
     psqlSchema = "10.0"; # should be 10, but changing it is invasive
-    sha256 = "1qal0yp7a90yzya7hl56gsmw5fvacplrdhpn7h9gnbyr1i2iyw2d";
+    sha256 = "0fxj30jvwq5pqpbj97vhlxgmn2ah59a78s9jyjr7vxyqj7sdh71q";
     this = self.postgresql_10;
     inherit self;
   };
 
   postgresql_11 = self.callPackage generic {
-    version = "11.8";
+    version = "11.9";
     psqlSchema = "11.1"; # should be 11, but changing it is invasive
-    sha256 = "1qksqyayxmnccmbapg3ajsw9pjgqva0inxjhx64rqd6ckhrg9wpa";
+    sha256 = "0db6pfphc5rp12abnkvv2l9pbl7bdyf3hhiwj8ghjwh35skqlq9m";
     this = self.postgresql_11;
     inherit self;
   };
 
   postgresql_12 = self.callPackage generic {
-    version = "12.3";
+    version = "12.4";
     psqlSchema = "12";
-    sha256 = "0hfg3n7rlz96579cj3z1dh2idl15rh3wfvn8jl31jj4h2yk69vcl";
+    sha256 = "1k06wryy8p4s1fim9qafcjlak3f58l0wqaqnrccr9x9j5jz3zsdy";
     this = self.postgresql_12;
     inherit self;
   };
diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index 9c9f91f9c19..8ce434741a5 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, fetchpatch, cmake, gnugrep
+{ stdenv, fetchFromGitHub, fetchpatch, cmake, bash, gnugrep
 , fixDarwinDylibNames
 , file
 , legacySupport ? false
@@ -18,6 +18,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ]
    ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
+  buildInputs = [ bash ];
 
   patches = [
     ./playtests-darwin.patch
@@ -29,11 +30,7 @@ stdenv.mkDerivation rec {
     # work fine, and I'm not sure how to write the condition.
     ++ stdenv.lib.optional stdenv.hostPlatform.isWindows ./mcfgthreads-no-pthread.patch;
 
-  postPatch =
-  # Patch shebangs for playTests
-  ''
-    patchShebangs programs/zstdgrep
-  '' + stdenv.lib.optionalString (!static) ''
+  postPatch = stdenv.lib.optionalString (!static) ''
     substituteInPlace build/cmake/CMakeLists.txt \
       --replace 'message(SEND_ERROR "You need to build static library to build tests")' ""
     substituteInPlace build/cmake/tests/CMakeLists.txt \
@@ -60,6 +57,8 @@ stdenv.mkDerivation rec {
   doCheck = true;
   checkPhase = ''
     runHook preCheck
+    # Patch shebangs for playTests
+    patchShebangs ../programs/zstdgrep
     ctest -R playTests # The only relatively fast test.
     runHook postCheck
   '';
diff --git a/pkgs/tools/filesystems/fuse-overlayfs/default.nix b/pkgs/tools/filesystems/fuse-overlayfs/default.nix
index ba5f4a3dd7e..11a3615a84c 100644
--- a/pkgs/tools/filesystems/fuse-overlayfs/default.nix
+++ b/pkgs/tools/filesystems/fuse-overlayfs/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ fuse3 ];
 
-  passthru.tests.podman = nixosTests.podman;
+  passthru.tests = { inherit (nixosTests) podman; };
 
   meta = with stdenv.lib; {
     description = "FUSE implementation for overlayfs";
diff --git a/pkgs/tools/networking/radsecproxy/default.nix b/pkgs/tools/networking/radsecproxy/default.nix
index ab5ff481ec7..e2a0c900c52 100644
--- a/pkgs/tools/networking/radsecproxy/default.nix
+++ b/pkgs/tools/networking/radsecproxy/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "radsecproxy";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "12pvwd7v3iswki3riycxaiiqxingg4bqnkwc5ay3j4n2kzynr1qg";
+    sha256 = "1g7q128cip1dac9jad58rd96afx4xz7x7vsiv0af8iyq2ivqvs2m";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/tools/networking/slirp4netns/default.nix b/pkgs/tools/networking/slirp4netns/default.nix
index 93367ea2679..60cb3413253 100644
--- a/pkgs/tools/networking/slirp4netns/default.nix
+++ b/pkgs/tools/networking/slirp4netns/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  passthru.tests.podman = nixosTests.podman;
+  passthru.tests = { inherit (nixosTests) podman; };
 
   meta = with stdenv.lib; {
     homepage = "https://github.com/rootless-containers/slirp4netns";
diff --git a/pkgs/tools/networking/vpn-slice/default.nix b/pkgs/tools/networking/vpn-slice/default.nix
new file mode 100644
index 00000000000..9511c214c08
--- /dev/null
+++ b/pkgs/tools/networking/vpn-slice/default.nix
@@ -0,0 +1,25 @@
+{ lib, buildPythonApplication, python3Packages, fetchFromGitHub }:
+
+buildPythonApplication rec {
+  pname = "vpn-slice";
+  version = "0.14";
+
+  src = fetchFromGitHub {
+    owner = "dlenski";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1z2mdl3arzl95zrj4ir57f762gcimmmq5nk91j679cshxz4snxyr";
+  };
+
+  propagatedBuildInputs = with python3Packages; [ setproctitle dnspython ];
+
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = "https://github.com/dlenski/vpn-slice";
+    description =
+      "vpnc-script replacement for easy and secure split-tunnel VPN setup";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ jdbaldry ];
+  };
+}
diff --git a/pkgs/tools/security/gnupg/22.nix b/pkgs/tools/security/gnupg/22.nix
index 7c095cffa31..3a99c8eb3f2 100644
--- a/pkgs/tools/security/gnupg/22.nix
+++ b/pkgs/tools/security/gnupg/22.nix
@@ -16,11 +16,11 @@ assert guiSupport -> pinentry != null && enableMinimal == false;
 stdenv.mkDerivation rec {
   pname = "gnupg";
 
-  version = "2.2.20";
+  version = "2.2.21";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${pname}-${version}.tar.bz2";
-    sha256 = "0c6a4v9p6qzhsw1pfcwc459bxpc8hma0w9z8iqb9khvligack9q4";
+    sha256 = "1v3nirp9m7yxjkkcdixibckl379pdyr3mdx8b1k379szzdw35s31";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
@@ -38,8 +38,10 @@ stdenv.mkDerivation rec {
     ./accept-subkeys-with-a-good-revocation-but-no-self-sig.patch
   ];
   postPatch = ''
-    sed -i 's,hkps://hkps.pool.sks-keyservers.net,hkps://keys.openpgp.org,g' \
-        configure doc/dirmngr.texi doc/gnupg.info-1
+    sed -i 's,hkps://hkps.pool.sks-keyservers.net,hkps://keys.openpgp.org,g' configure doc/dirmngr.texi doc/gnupg.info-1
+    # Fix broken SOURCE_DATE_EPOCH usage - remove on the next upstream update
+    sed -i 's/$SOURCE_DATE_EPOCH/''${SOURCE_DATE_EPOCH}/' doc/Makefile.am
+    sed -i 's/$SOURCE_DATE_EPOCH/''${SOURCE_DATE_EPOCH}/' doc/Makefile.in
   '' + stdenv.lib.optionalString ( stdenv.isLinux && pcsclite != null) ''
     sed -i 's,"libpcsclite\.so[^"]*","${stdenv.lib.getLib pcsclite}/lib/libpcsclite.so",g' scd/scdaemon.c
   ''; #" fix Emacs syntax highlighting :-(
diff --git a/pkgs/tools/security/rhash/default.nix b/pkgs/tools/security/rhash/default.nix
index 863b03a117c..394dd89484f 100644
--- a/pkgs/tools/security/rhash/default.nix
+++ b/pkgs/tools/security/rhash/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, which }:
 
 stdenv.mkDerivation rec {
-  version = "1.3.9";
+  version = "1.4.0";
   pname = "rhash";
 
   src = fetchFromGitHub {
     owner = "rhash";
     repo = "RHash";
     rev = "v${version}";
-    sha256 = "06i49x1l21h2q7pfnf4crbmjyg8b9ad0qs10ywyyn5sjpi0c21wq";
+    sha256 = "18zgr1bjzz8v6rckz2q2hx9f2ssbv8qfwclzpbyjaz0c1c9lqqar";
   };
 
   nativeBuildInputs = [ which ];
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index cdfc97f2652..54c8948f4a5 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -562,6 +562,7 @@ mapAliases ({
   sup = throw "deprecated in 2019-09-10: abandoned by upstream";
   swfdec = throw "swfdec has been removed as broken and unmaintained."; # added 2020-08-23
   system_config_printer = system-config-printer;  # added 2016-01-03
+  systemd-cryptsetup-generator = throw "systemd-cryptsetup-generator is now included in the systemd package"; # added 2020-07-12
   systemd_with_lvm2 = throw "obsolete, enabled by default via the lvm module"; # added 2020-07-12
   systool = sysfsutils; # added 2018-04-25
   tahoelafs = tahoe-lafs; # added 2018-03-26
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b1d2bcd3560..57b7f43be42 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1718,6 +1718,8 @@ in
 
   dconf = callPackage ../development/libraries/dconf { };
 
+  dcw-gmt = callPackage ../applications/gis/gmt/dcw.nix { };
+
   ddar = callPackage ../tools/backup/ddar { };
 
   ddate = callPackage ../tools/misc/ddate { };
@@ -2016,6 +2018,11 @@ in
     variant = "krita";
   };
 
+  gmt = callPackage ../applications/gis/gmt {
+    inherit (darwin.apple_sdk.frameworks)
+      Accelerate CoreGraphics CoreVideo;
+  };
+
   goa = callPackage ../development/tools/goa { };
 
   gohai = callPackage ../tools/system/gohai { };
@@ -4557,6 +4564,8 @@ in
 
   isync = callPackage ../tools/networking/isync { };
 
+  itm-tools = callPackage ../development/tools/misc/itm-tools { };  
+
   ix = callPackage ../tools/misc/ix { };
 
   jaaa = callPackage ../applications/audio/jaaa { };
@@ -7620,6 +7629,8 @@ in
 
   vpnc = callPackage ../tools/networking/vpnc { };
 
+  vpn-slice = python3Packages.callPackage ../tools/networking/vpn-slice { };
+
   vp = callPackage ../applications/misc/vp {
     # Enable next line for console graphics. Note that
     # it requires `sixel` enabled terminals such as mlterm
@@ -12714,6 +12725,8 @@ in
 
   haxor-news = callPackage ../applications/misc/haxor-news { };
 
+  hdt = callPackage ../misc/hdt {};
+
   herqq = libsForQt5.callPackage ../development/libraries/herqq { };
 
   heyefi = haskellPackages.heyefi;
@@ -17148,7 +17161,11 @@ in
 
   criu = callPackage ../os-specific/linux/criu { };
 
-  cryptsetup = callPackage ../os-specific/linux/cryptsetup { };
+  cryptsetup = callPackage ../os-specific/linux/cryptsetup {
+    # cryptsetup only really needs the devmapper component of cryptsetup
+    # but itself is used as a library in systemd (=udev)
+    lvm2 = lvm2.override { udev = null; };
+  };
 
   cramfsprogs = callPackage ../os-specific/linux/cramfsprogs { };
 
@@ -17493,6 +17510,14 @@ in
     ];
   };
 
+  linux_5_8 = callPackage ../os-specific/linux/kernel/linux-5.8.nix {
+    kernelPatches = [
+      kernelPatches.bridge_stp_helper
+      kernelPatches.request_key_helper
+      kernelPatches.export_kernel_fpu_functions."5.3"
+    ];
+  };
+
   linux_testing = callPackage ../os-specific/linux/kernel/linux-testing.nix {
     kernelPatches = [
       kernelPatches.bridge_stp_helper
@@ -17718,7 +17743,7 @@ in
 
   # Update this when adding the newest kernel major version!
   # And update linux_latest_for_hardened below if the patches are already available
-  linuxPackages_latest = linuxPackages_5_7;
+  linuxPackages_latest = linuxPackages_5_8;
   linux_latest = linuxPackages_latest.kernel;
 
   # Build the kernel modules for the some of the kernels.
@@ -17733,6 +17758,7 @@ in
   linuxPackages_4_19 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_4_19);
   linuxPackages_5_4 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_5_4);
   linuxPackages_5_7 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_5_7);
+  linuxPackages_5_8 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_5_8);
 
   # When adding to this list:
   # - Update linuxPackages_latest to the latest version
@@ -18225,9 +18251,6 @@ in
   };
   udev = systemd; # TODO: move to aliases.nix
 
-  # standalone cryptsetup generator for systemd
-  systemd-cryptsetup-generator = callPackage ../os-specific/linux/systemd/cryptsetup-generator.nix { };
-
   systemd-wait = callPackage ../os-specific/linux/systemd-wait { };
 
   sysvinit = callPackage ../os-specific/linux/sysvinit { };
@@ -24035,6 +24058,8 @@ in
 
   youtube-viewer = perlPackages.WWWYoutubeViewer;
 
+  ytalk = callPackage ../applications/networking/instant-messengers/ytalk { };
+
   ytcc = callPackage ../tools/networking/ytcc { };
 
   zam-plugins = callPackage ../applications/audio/zam-plugins { };
@@ -24542,6 +24567,8 @@ in
 
   gshogi = python3Packages.callPackage ../games/gshogi {};
 
+  gshhg-gmt = callPackage ../applications/gis/gmt/gshhg.nix { };
+
   qtads = qt5.callPackage ../games/qtads { };
 
   gtetrinet = callPackage ../games/gtetrinet {
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 110bc986b80..dfc2fd2fb98 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -220,16 +220,20 @@ let
     dune = callPackage ../development/tools/ocaml/dune { };
 
     dune_2 =
-      if lib.versionAtLeast ocaml.version "4.07"
+      if lib.versionAtLeast ocaml.version "4.08"
       then callPackage ../development/tools/ocaml/dune/2.nix { }
       else if lib.versionAtLeast ocaml.version "4.02"
       then pkgs.dune_2
       else throw "dune_2 is not available for OCaml ${ocaml.version}";
 
+    dune-action-plugin = callPackage ../development/ocaml-modules/dune-action-plugin { };
+
     dune-build-info = callPackage ../development/ocaml-modules/dune-build-info { };
 
     dune-configurator = callPackage ../development/ocaml-modules/dune-configurator { };
 
+    dune-glob = callPackage ../development/ocaml-modules/dune-glob { };
+
     dune-private-libs = callPackage ../development/ocaml-modules/dune-private-libs { };
 
     dune-release = callPackage ../development/tools/ocaml/dune-release {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 42046a0010a..8ca643bf6ef 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7826,6 +7826,8 @@ in {
 
   rxv     = callPackage ../development/python-modules/rxv     { };
 
+  userpath = callPackage ../development/python-modules/userpath { };
+
 });
 
 in fix' (extends overrides packages)