summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--maintainers/maintainer-list.nix6
-rw-r--r--nixos/doc/manual/release-notes/rl-2103.xml12
-rw-r--r--nixos/modules/config/ldap.nix31
-rw-r--r--nixos/modules/misc/locate.nix67
-rw-r--r--nixos/modules/module-list.nix1
-rw-r--r--nixos/modules/rename.nix1
-rw-r--r--nixos/modules/services/mail/postfix.nix2
-rw-r--r--nixos/modules/services/monitoring/prometheus/exporters.nix1
-rw-r--r--nixos/modules/services/monitoring/prometheus/exporters/py-air-control.nix62
-rw-r--r--nixos/modules/services/security/sshguard.nix6
-rw-r--r--nixos/modules/services/web-apps/frab.nix222
-rw-r--r--nixos/modules/services/web-apps/nextcloud.nix4
-rw-r--r--nixos/modules/services/web-servers/nginx/default.nix23
-rw-r--r--nixos/tests/all-tests.nix1
-rw-r--r--nixos/tests/locate.nix62
-rw-r--r--nixos/tests/prometheus-exporters.nix15
-rw-r--r--pkgs/applications/audio/clementine/default.nix1
-rw-r--r--pkgs/applications/audio/musikcube/default.nix4
-rw-r--r--pkgs/applications/blockchains/go-ethereum.nix6
-rw-r--r--pkgs/applications/blockchains/monero-gui/default.nix4
-rw-r--r--pkgs/applications/blockchains/turbo-geth.nix6
-rw-r--r--pkgs/applications/blockchains/wasabiwallet/default.nix4
-rw-r--r--pkgs/applications/editors/emacs-modes/melpa-packages.nix21
-rw-r--r--pkgs/applications/editors/emacs/generic.nix3
-rw-r--r--pkgs/applications/editors/emacs/site-start.el11
-rw-r--r--pkgs/applications/editors/rehex/default.nix46
-rw-r--r--pkgs/applications/editors/vis/default.nix4
-rw-r--r--pkgs/applications/editors/zile/default.nix10
-rw-r--r--pkgs/applications/gis/qmapshack/default.nix4
-rw-r--r--pkgs/applications/graphics/ktikz/default.nix6
-rw-r--r--pkgs/applications/graphics/mcomix3/default.nix18
-rw-r--r--pkgs/applications/misc/chrysalis/default.nix28
-rw-r--r--pkgs/applications/misc/electrum/default.nix32
-rw-r--r--pkgs/applications/misc/khal/default.nix4
-rw-r--r--pkgs/applications/misc/mucommander/default.nix11
-rw-r--r--pkgs/applications/misc/remarkable/rmapi/default.nix6
-rw-r--r--pkgs/applications/misc/rofimoji/default.nix5
-rw-r--r--pkgs/applications/networking/browsers/chromium/upstream-info.json12
-rw-r--r--pkgs/applications/networking/browsers/firefox/wrapper.nix3
-rw-r--r--pkgs/applications/networking/cluster/istioctl/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/kubernetes/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/lens/default.nix41
-rw-r--r--pkgs/applications/networking/cluster/node-problem-detector/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/octant/default.nix8
-rw-r--r--pkgs/applications/networking/cluster/terraform-providers/providers.json18
-rw-r--r--pkgs/applications/networking/flexget/default.nix6
-rw-r--r--pkgs/applications/networking/instant-messengers/nheko/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/default.nix4
-rw-r--r--pkgs/applications/networking/irc/konversation/default.nix18
-rw-r--r--pkgs/applications/networking/irc/weechat/scripts/colorize_nicks/default.nix29
-rw-r--r--pkgs/applications/networking/irc/weechat/scripts/default.nix2
-rw-r--r--pkgs/applications/networking/maestral-qt/default.nix6
-rw-r--r--pkgs/applications/networking/mailreaders/claws-mail/gtk3.nix6
-rw-r--r--pkgs/applications/networking/mailreaders/inboxer/default.nix87
-rw-r--r--pkgs/applications/networking/p2p/deluge/1/default.nix1
-rw-r--r--pkgs/applications/networking/p2p/stig/default.nix7
-rw-r--r--pkgs/applications/networking/remote/citrix-workspace/sources.nix11
-rw-r--r--pkgs/applications/office/beamerpresenter/default.nix4
-rw-r--r--pkgs/applications/office/elementary-planner/default.nix4
-rw-r--r--pkgs/applications/radio/gqrx/default.nix4
-rw-r--r--pkgs/applications/science/astronomy/siril/default.nix45
-rw-r--r--pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix22
-rw-r--r--pkgs/applications/science/logic/cedille/Fix-to-string.agda-to-compile-with-Agda-2.6.1.patch31
-rw-r--r--pkgs/applications/science/logic/cedille/default.nix8
-rw-r--r--pkgs/applications/video/bomi/default.nix118
-rw-r--r--pkgs/applications/video/go-chromecast/default.nix6
-rw-r--r--pkgs/applications/video/kodi/wrapper.nix2
-rw-r--r--pkgs/applications/video/mpv/default.nix2
-rw-r--r--pkgs/applications/video/vlc/default.nix7
-rw-r--r--pkgs/applications/video/vlc/fix-missing-includes-with-qt-5.15.patch37
-rw-r--r--pkgs/applications/virtualization/dumb-init/default.nix4
-rw-r--r--pkgs/build-support/emacs/elpa.nix11
-rw-r--r--pkgs/build-support/emacs/melpa.nix2
-rw-r--r--pkgs/build-support/emacs/wrapper.nix16
-rw-r--r--pkgs/build-support/emacs/wrapper.sh27
-rw-r--r--pkgs/build-support/fetchmavenartifact/default.nix10
-rw-r--r--pkgs/build-support/nix-gitignore/default.nix4
-rw-r--r--pkgs/build-support/setup-hooks/auto-patchelf.sh80
-rw-r--r--pkgs/build-support/setup-hooks/compress-man-pages.sh1
-rw-r--r--pkgs/build-support/setup-hooks/strip.sh2
-rw-r--r--pkgs/data/misc/cacert/default.nix60
-rw-r--r--pkgs/data/misc/cacert/fix-unicode-ca-names.patch20
-rw-r--r--pkgs/data/themes/matcha/default.nix4
-rw-r--r--pkgs/development/compilers/nim/default.nix5
-rw-r--r--pkgs/development/compilers/rgbds/default.nix4
-rw-r--r--pkgs/development/interpreters/clojurescript/lumo/deps.nix6
-rw-r--r--pkgs/development/interpreters/guile/setup-hook-2.0.sh10
-rw-r--r--pkgs/development/interpreters/guile/setup-hook-2.2.sh10
-rw-r--r--pkgs/development/libraries/SDL2_mixer/default.nix58
-rw-r--r--pkgs/development/libraries/aqbanking/sources.nix12
-rw-r--r--pkgs/development/libraries/draco/default.nix4
-rw-r--r--pkgs/development/libraries/glibc/2.32-10.patch.gzbin0 -> 24498 bytes
-rw-r--r--pkgs/development/libraries/glibc/common.nix11
-rw-r--r--pkgs/development/libraries/hwloc/default.nix4
-rw-r--r--pkgs/development/libraries/libarchive/default.nix5
-rw-r--r--pkgs/development/libraries/libff/default.nix6
-rw-r--r--pkgs/development/libraries/libgphoto2/default.nix4
-rw-r--r--pkgs/development/libraries/libinput/default.nix4
-rw-r--r--pkgs/development/libraries/libksba/default.nix4
-rw-r--r--pkgs/development/libraries/librtprocess/default.nix23
-rw-r--r--pkgs/development/libraries/libtorrent-rasterbar/1.2/default.nix15
-rw-r--r--pkgs/development/libraries/libunwind/default.nix8
-rw-r--r--pkgs/development/libraries/libva/default.nix4
-rw-r--r--pkgs/development/libraries/libva/utils.nix2
-rw-r--r--pkgs/development/libraries/mesa/default.nix4
-rw-r--r--pkgs/development/libraries/nlohmann_json/default.nix4
-rw-r--r--pkgs/development/libraries/pcre2/default.nix4
-rw-r--r--pkgs/development/libraries/physics/geant4/datasets.nix24
-rw-r--r--pkgs/development/libraries/physics/geant4/default.nix10
-rw-r--r--pkgs/development/libraries/physics/rivet/default.nix4
-rw-r--r--pkgs/development/libraries/physics/yoda/default.nix4
-rw-r--r--pkgs/development/libraries/qt-5/5.15/default.nix16
-rw-r--r--pkgs/development/libraries/qt-5/modules/qtwebkit.nix1
-rw-r--r--pkgs/development/libraries/smesh/default.nix10
-rw-r--r--pkgs/development/libraries/smpeg2/default.nix27
-rw-r--r--pkgs/development/libraries/smpeg2/hufftable-uint_max.patch (renamed from pkgs/development/libraries/smpeg2/gcc6.patch)0
-rw-r--r--pkgs/development/libraries/smpeg2/sdl2.patch22
-rw-r--r--pkgs/development/libraries/spdlog/default.nix4
-rw-r--r--pkgs/development/libraries/sqlite/default.nix4
-rw-r--r--pkgs/development/libraries/sqlite/tools.nix4
-rw-r--r--pkgs/development/libraries/tracker/default.nix8
-rw-r--r--pkgs/development/ocaml-modules/eliom/default.nix4
-rw-r--r--pkgs/development/python-modules/afdko/default.nix18
-rw-r--r--pkgs/development/python-modules/black/default.nix3
-rw-r--r--pkgs/development/python-modules/hass-nabucasa/default.nix1
-rw-r--r--pkgs/development/python-modules/maestral/default.nix13
-rw-r--r--pkgs/development/python-modules/psautohint/default.nix28
-rw-r--r--pkgs/development/python-modules/pyopenssl/default.nix25
-rw-r--r--pkgs/development/python-modules/pytorch/default.nix4
-rw-r--r--pkgs/development/python-modules/qasm2image/default.nix53
-rw-r--r--pkgs/development/python-modules/qiskit-aer/default.nix2
-rw-r--r--pkgs/development/python-modules/setuptools/default.nix2
-rw-r--r--pkgs/development/python-modules/sqlparse/default.nix22
-rw-r--r--pkgs/development/python-modules/survey/default.nix29
-rw-r--r--pkgs/development/python-modules/tldextract/default.nix11
-rw-r--r--pkgs/development/python-modules/traitlets/4.nix36
-rw-r--r--pkgs/development/python-modules/traitlets/default.nix5
-rw-r--r--pkgs/development/python-modules/vncdo/default.nix (renamed from pkgs/tools/admin/vncdo/default.nix)19
-rw-r--r--pkgs/development/python-modules/wrapio/default.nix24
-rw-r--r--pkgs/development/tools/analysis/flow/default.nix4
-rw-r--r--pkgs/development/tools/database/litecli/default.nix10
-rw-r--r--pkgs/development/tools/delve/default.nix4
-rw-r--r--pkgs/development/tools/github-commenter/default.nix14
-rw-r--r--pkgs/development/tools/github-commenter/deps.nix102
-rw-r--r--pkgs/development/tools/misc/clojure-lsp/default.nix4
-rw-r--r--pkgs/development/tools/misc/nxpmicro-mfgtools/default.nix4
-rw-r--r--pkgs/development/tools/misc/remarkable/remarkable-toolchain/default.nix21
-rw-r--r--pkgs/development/tools/misc/terraform-ls/default.nix12
-rw-r--r--pkgs/development/tools/tabnine/default.nix3
-rw-r--r--pkgs/development/tools/vultr-cli/default.nix4
-rw-r--r--pkgs/games/minecraft/default.nix6
-rw-r--r--pkgs/games/tdm/default.nix105
-rw-r--r--pkgs/os-specific/darwin/osx-cpu-temp/default.nix31
-rw-r--r--pkgs/os-specific/linux/fuse/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/export-rt-sched-migrate.patch11
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.14.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.19.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.4.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.9.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.4.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.9.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/patches.nix5
-rw-r--r--pkgs/os-specific/linux/libcap-ng/default.nix4
-rw-r--r--pkgs/os-specific/linux/libcap/default.nix12
-rw-r--r--pkgs/os-specific/linux/libcap/no-shared-lib.patch22
-rw-r--r--pkgs/os-specific/linux/procps-ng/default.nix10
-rw-r--r--pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch6
-rw-r--r--pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch10
-rw-r--r--pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch10
-rw-r--r--pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch8
-rw-r--r--pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch8
-rw-r--r--pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch8
-rw-r--r--pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch16
-rw-r--r--pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch6
-rw-r--r--pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch24
-rw-r--r--pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch6
-rw-r--r--pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch8
-rw-r--r--pkgs/os-specific/linux/systemd/0012-Install-default-configuration-into-out-share-factory.patch326
-rw-r--r--pkgs/os-specific/linux/systemd/0012-inherit-systemd-environment-when-calling-generators.patch (renamed from pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch)10
-rw-r--r--pkgs/os-specific/linux/systemd/0013-add-rootprefix-to-lookup-dir-paths.patch (renamed from pkgs/os-specific/linux/systemd/0014-add-rootprefix-to-lookup-dir-paths.patch)8
-rw-r--r--pkgs/os-specific/linux/systemd/0014-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch (renamed from pkgs/os-specific/linux/systemd/0015-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch)8
-rw-r--r--pkgs/os-specific/linux/systemd/0015-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch (renamed from pkgs/os-specific/linux/systemd/0016-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch)10
-rw-r--r--pkgs/os-specific/linux/systemd/0016-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch (renamed from pkgs/os-specific/linux/systemd/0017-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch)8
-rw-r--r--pkgs/os-specific/linux/systemd/0017-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch (renamed from pkgs/os-specific/linux/systemd/0018-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch)8
-rw-r--r--pkgs/os-specific/linux/systemd/0018-logind-seat-debus-show-CanMultiSession-again.patch (renamed from pkgs/os-specific/linux/systemd/0019-logind-seat-debus-show-CanMultiSession-again.patch)10
-rw-r--r--pkgs/os-specific/linux/systemd/0019-Revert-pkg-config-prefix-is-not-really-configurable-.patch72
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix31
-rw-r--r--pkgs/os-specific/linux/zfs/default.nix9
-rw-r--r--pkgs/servers/beanstalkd/default.nix14
-rw-r--r--pkgs/servers/consul/default.nix6
-rw-r--r--pkgs/servers/home-assistant/default.nix4
-rw-r--r--pkgs/servers/jackett/default.nix4
-rw-r--r--pkgs/servers/monitoring/grafana/default.nix8
-rw-r--r--pkgs/servers/monitoring/prometheus/promscale.nix6
-rw-r--r--pkgs/servers/nextcloud/default.nix21
-rw-r--r--pkgs/servers/pulseaudio/default.nix4
-rw-r--r--pkgs/servers/web-apps/frab/default.nix53
-rw-r--r--pkgs/servers/x11/xorg/default.nix6
-rw-r--r--pkgs/servers/x11/xorg/tarballs.list2
-rw-r--r--pkgs/tools/admin/exoscale-cli/default.nix4
-rw-r--r--pkgs/tools/archivers/xarchiver/default.nix10
-rw-r--r--pkgs/tools/audio/audiowaveform/default.nix38
-rw-r--r--pkgs/tools/filesystems/e2fsprogs/default.nix4
-rw-r--r--pkgs/tools/filesystems/lizardfs/cmake-def-spdlog-fmt-external.patch11
-rw-r--r--pkgs/tools/filesystems/lizardfs/default.nix23
-rw-r--r--pkgs/tools/graphics/gnuplot/default.nix4
-rw-r--r--pkgs/tools/misc/diffoscope/default.nix4
-rw-r--r--pkgs/tools/misc/direnv/default.nix4
-rw-r--r--pkgs/tools/misc/mcfly/default.nix7
-rw-r--r--pkgs/tools/misc/q-text-as-data/default.nix28
-rw-r--r--pkgs/tools/misc/tagref/default.nix6
-rw-r--r--pkgs/tools/misc/youtube-dl/default.nix4
-rw-r--r--pkgs/tools/networking/dnsproxy/default.nix4
-rw-r--r--pkgs/tools/networking/linkchecker/default.nix2
-rw-r--r--pkgs/tools/networking/unbound/default.nix4
-rw-r--r--pkgs/tools/security/1password-gui/default.nix4
-rw-r--r--pkgs/tools/system/bottom/default.nix6
-rw-r--r--pkgs/tools/typesetting/asciidoctor/Gemfile1
-rw-r--r--pkgs/tools/typesetting/asciidoctor/Gemfile.lock9
-rw-r--r--pkgs/tools/typesetting/asciidoctor/default.nix1
-rw-r--r--pkgs/tools/typesetting/asciidoctor/gemset.nix42
-rw-r--r--pkgs/top-level/aliases.nix4
-rw-r--r--pkgs/top-level/all-packages.nix57
-rw-r--r--pkgs/top-level/python-packages.nix32
-rw-r--r--pkgs/top-level/static.nix2
225 files changed, 1920 insertions, 1753 deletions
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index d73f02fdc8e..f894caaeffd 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2477,6 +2477,12 @@
     githubId = 984691;
     name = "Evan Danaher";
   };
+  edbentley = {
+    email = "hello@edbentley.dev";
+    github = "edbentley";
+    githubId = 15923595;
+    name = "Ed Bentley";
+  };
   edcragg = {
     email = "ed.cragg@eipi.xyz";
     github = "nuxeh";
diff --git a/nixos/doc/manual/release-notes/rl-2103.xml b/nixos/doc/manual/release-notes/rl-2103.xml
index f760398e262..374933d3012 100644
--- a/nixos/doc/manual/release-notes/rl-2103.xml
+++ b/nixos/doc/manual/release-notes/rl-2103.xml
@@ -372,6 +372,18 @@
    </listitem>
    <listitem>
     <para>
+     PulseAudio was upgraded to 14.0, with changes to the handling of default sinks.
+     See its <link xlink:href="https://www.freedesktop.org/wiki/Software/PulseAudio/Notes/14.0/">release notes</link>.
+    </para>
+
+    <para>
+     GNOME users may wish to delete their <literal>~/.config/pulse</literal> due to the changes to stream routing
+     logic. See <link xlink:href="https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/issues/832">PulseAudio bug 832</link>
+     for more information.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
      The <package>zookeeper</package> package does not provide
      <literal>zooInspector.sh</literal> anymore, as that "contrib" has
      been dropped from upstream releases.
diff --git a/nixos/modules/config/ldap.nix b/nixos/modules/config/ldap.nix
index 1a5dbcd4e26..e63f8c0d43e 100644
--- a/nixos/modules/config/ldap.nix
+++ b/nixos/modules/config/ldap.nix
@@ -59,30 +59,28 @@ in
 
     users.ldap = {
 
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = "Whether to enable authentication against an LDAP server.";
-      };
+      enable = mkEnableOption "authentication against an LDAP server";
 
       loginPam = mkOption {
         type = types.bool;
         default = true;
-        description = "Whether to include authentication against LDAP in login PAM";
+        description = "Whether to include authentication against LDAP in login PAM.";
       };
 
       nsswitch = mkOption {
         type = types.bool;
         default = true;
-        description = "Whether to include lookup against LDAP in NSS";
+        description = "Whether to include lookup against LDAP in NSS.";
       };
 
       server = mkOption {
+        type = types.str;
         example = "ldap://ldap.example.org/";
         description = "The URL of the LDAP server.";
       };
 
       base = mkOption {
+        type = types.str;
         example = "dc=example,dc=org";
         description = "The distinguished name of the search base.";
       };
@@ -129,7 +127,7 @@ in
           type = types.lines;
           description = ''
             Extra configuration options that will be added verbatim at
-            the end of the nslcd configuration file (nslcd.conf).
+            the end of the nslcd configuration file (<literal>nslcd.conf(5)</literal>).
           '' ;
         } ;
 
@@ -180,7 +178,7 @@ in
           description = ''
             Specifies the time limit (in seconds) to use when connecting
             to the directory server. This is distinct from the time limit
-            specified in <literal>users.ldap.timeLimit</literal> and affects
+            specified in <option>users.ldap.timeLimit</option> and affects
             the initial server connection only.
           '';
         };
@@ -197,7 +195,7 @@ in
             actually contact the directory server, and it is possible that
             a malformed configuration file will trigger reconnection. If
             <literal>soft</literal> is specified, then
-            <literal>nss_ldap</literal> will return immediately on server
+            <package>nss_ldap</package> will return immediately on server
             failure. All hard reconnect policies block with exponential
             backoff before retrying.
           '';
@@ -209,10 +207,10 @@ in
         type = types.lines;
         description = ''
           Extra configuration options that will be added verbatim at
-          the end of the ldap configuration file (ldap.conf).
-          If <literal>users.ldap.daemon</literal> is enabled, this
+          the end of the ldap configuration file (<literal>ldap.conf(5)</literal>).
+          If <option>users.ldap.daemon</option> is enabled, this
           configuration will not be used. In that case, use
-          <literal>users.ldap.daemon.extraConfig</literal> instead.
+          <option>users.ldap.daemon.extraConfig</option> instead.
         '' ;
       };
 
@@ -276,7 +274,12 @@ in
           } >"$conf"
           mv -fT "$conf" /run/nslcd/nslcd.conf
         '';
-        restartTriggers = [ "/run/nslcd/nslcd.conf" ];
+
+        restartTriggers = [
+          nslcdConfig
+          cfg.bind.passwordFile
+          cfg.daemon.rootpwmodpwFile
+        ];
 
         serviceConfig = {
           ExecStart = "${nslcdWrapped}/bin/nslcd";
diff --git a/nixos/modules/misc/locate.nix b/nixos/modules/misc/locate.nix
index 92aa3be0a36..426281c9412 100644
--- a/nixos/modules/misc/locate.nix
+++ b/nixos/modules/misc/locate.nix
@@ -73,7 +73,72 @@ in {
 
     pruneFS = mkOption {
       type = listOf str;
-      default = ["afs" "anon_inodefs" "auto" "autofs" "bdev" "binfmt" "binfmt_misc" "cgroup" "cifs" "coda" "configfs" "cramfs" "cpuset" "debugfs" "devfs" "devpts" "devtmpfs" "ecryptfs" "eventpollfs" "exofs" "futexfs" "ftpfs" "fuse" "fusectl" "gfs" "gfs2" "hostfs" "hugetlbfs" "inotifyfs" "iso9660" "jffs2" "lustre" "misc" "mqueue" "ncpfs" "nnpfs" "ocfs" "ocfs2" "pipefs" "proc" "ramfs" "rpc_pipefs" "securityfs" "selinuxfs" "sfs" "shfs" "smbfs" "sockfs" "spufs" "nfs" "NFS" "nfs4" "nfsd" "sshfs" "subfs" "supermount" "sysfs" "tmpfs" "ubifs" "udf" "usbfs" "vboxsf" "vperfctrfs" ];
+      default = [
+        "afs"
+        "anon_inodefs"
+        "auto"
+        "autofs"
+        "bdev"
+        "binfmt"
+        "binfmt_misc"
+        "cgroup"
+        "cifs"
+        "coda"
+        "configfs"
+        "cramfs"
+        "cpuset"
+        "debugfs"
+        "devfs"
+        "devpts"
+        "devtmpfs"
+        "ecryptfs"
+        "eventpollfs"
+        "exofs"
+        "futexfs"
+        "ftpfs"
+        "fuse"
+        "fusectl"
+        "fuse.sshfs"
+        "gfs"
+        "gfs2"
+        "hostfs"
+        "hugetlbfs"
+        "inotifyfs"
+        "iso9660"
+        "jffs2"
+        "lustre"
+        "misc"
+        "mqueue"
+        "ncpfs"
+        "nnpfs"
+        "ocfs"
+        "ocfs2"
+        "pipefs"
+        "proc"
+        "ramfs"
+        "rpc_pipefs"
+        "securityfs"
+        "selinuxfs"
+        "sfs"
+        "shfs"
+        "smbfs"
+        "sockfs"
+        "spufs"
+        "nfs"
+        "NFS"
+        "nfs4"
+        "nfsd"
+        "sshfs"
+        "subfs"
+        "supermount"
+        "sysfs"
+        "tmpfs"
+        "ubifs"
+        "udf"
+        "usbfs"
+        "vboxsf"
+        "vperfctrfs"
+      ];
       description = ''
         Which filesystem types to exclude from indexing
       '';
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 33d2bc3decc..d3f6e85327b 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -860,7 +860,6 @@
   ./services/web-apps/documize.nix
   ./services/web-apps/dokuwiki.nix
   ./services/web-apps/engelsystem.nix
-  ./services/web-apps/frab.nix
   ./services/web-apps/gerrit.nix
   ./services/web-apps/gotify-server.nix
   ./services/web-apps/grocy.nix
diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix
index a87db475e01..c6f705bb2d6 100644
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -32,6 +32,7 @@ with lib;
     (mkRemovedOptionModule ["services" "cgmanager" "enable"] "cgmanager was deprecated by lxc and therefore removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "osquery" ] "The osquery module has been removed")
     (mkRemovedOptionModule [ "services" "fourStore" ] "The fourStore module has been removed")
+    (mkRemovedOptionModule [ "services" "frab" ] "The frab module has been removed")
     (mkRemovedOptionModule [ "services" "fourStoreEndpoint" ] "The fourStoreEndpoint module has been removed")
     (mkRemovedOptionModule [ "services" "mathics" ] "The Mathics module has been removed")
     (mkRemovedOptionModule [ "programs" "way-cooler" ] ("way-cooler is abandoned by its author: " +
diff --git a/nixos/modules/services/mail/postfix.nix b/nixos/modules/services/mail/postfix.nix
index 319b3b63844..795a76f748a 100644
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@@ -52,7 +52,7 @@ let
       };
 
       type = mkOption {
-        type = types.enum [ "inet" "unix" "fifo" "pass" ];
+        type = types.enum [ "inet" "unix" "unix-dgram" "fifo" "pass" ];
         default = "unix";
         example = "inet";
         description = "The type of the service";
diff --git a/nixos/modules/services/monitoring/prometheus/exporters.nix b/nixos/modules/services/monitoring/prometheus/exporters.nix
index 995afca96ff..1f8c5aeded1 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@@ -41,6 +41,7 @@ let
     "openvpn"
     "postfix"
     "postgres"
+    "py-air-control"
     "redis"
     "rspamd"
     "rtl_433"
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/py-air-control.nix b/nixos/modules/services/monitoring/prometheus/exporters/py-air-control.nix
new file mode 100644
index 00000000000..d9a627ca2ea
--- /dev/null
+++ b/nixos/modules/services/monitoring/prometheus/exporters/py-air-control.nix
@@ -0,0 +1,62 @@
+{ config, lib, pkgs, options }:
+
+with lib;
+
+let
+  cfg = config.services.prometheus.exporters.py-air-control;
+
+  py-air-control-exporter-env = pkgs.python3.withPackages (pyPkgs: [
+      pyPkgs.py-air-control-exporter
+  ]);
+
+  workingDir = "/var/lib/${cfg.stateDir}";
+
+in
+{
+  port = 9896;
+  extraOpts = {
+    deviceHostname = mkOption {
+      type = types.str;
+      example = "192.168.1.123";
+      description = ''
+        The hostname of the air purification device from which to scrape the metrics.
+      '';
+    };
+    protocol = mkOption {
+      type = types.str;
+      default = "http";
+      description = ''
+        The protocol to use when communicating with the air purification device.
+        Available: [http, coap, plain_coap]
+      '';
+    };
+    stateDir = mkOption {
+      type = types.str;
+      default = "prometheus-py-air-control-exporter";
+      description = ''
+        Directory below <literal>/var/lib</literal> to store runtime data.
+        This directory will be created automatically using systemd's StateDirectory mechanism.
+      '';
+    };
+  };
+  serviceOpts = {
+    serviceConfig = {
+      DynamicUser = false;
+      StateDirectory = cfg.stateDir;
+      WorkingDirectory = workingDir;
+      ExecStart = ''
+        ${py-air-control-exporter-env}/bin/python -c \
+          "from py_air_control_exporter import app; app.create_app().run( \
+              debug=False, \
+              port=${toString cfg.port}, \
+              host='${cfg.listenAddress}', \
+          )"
+      '';
+      Environment = [
+        "PY_AIR_CONTROL_HOST=${cfg.deviceHostname}"
+        "PY_AIR_CONTROL_PROTOCOL=${cfg.protocol}"
+        "HOME=${workingDir}"
+      ];
+    };
+  };
+}
diff --git a/nixos/modules/services/security/sshguard.nix b/nixos/modules/services/security/sshguard.nix
index e7a9cefdef3..72de11a9254 100644
--- a/nixos/modules/services/security/sshguard.nix
+++ b/nixos/modules/services/security/sshguard.nix
@@ -119,15 +119,17 @@ in {
       # firewall rules before sshguard starts.
       preStart = optionalString config.networking.firewall.enable ''
         ${pkgs.ipset}/bin/ipset -quiet create -exist sshguard4 hash:net family inet
-        ${pkgs.ipset}/bin/ipset -quiet create -exist sshguard6 hash:net family inet6
         ${pkgs.iptables}/bin/iptables  -I INPUT -m set --match-set sshguard4 src -j DROP
+      '' + optionalString (config.networking.firewall.enable && config.networking.enableIPv6) ''
+        ${pkgs.ipset}/bin/ipset -quiet create -exist sshguard6 hash:net family inet6
         ${pkgs.iptables}/bin/ip6tables -I INPUT -m set --match-set sshguard6 src -j DROP
       '';
 
       postStop = optionalString config.networking.firewall.enable ''
         ${pkgs.iptables}/bin/iptables  -D INPUT -m set --match-set sshguard4 src -j DROP
-        ${pkgs.iptables}/bin/ip6tables -D INPUT -m set --match-set sshguard6 src -j DROP
         ${pkgs.ipset}/bin/ipset -quiet destroy sshguard4
+      '' + optionalString (config.networking.firewall.enable && config.networking.enableIPv6) ''
+        ${pkgs.iptables}/bin/ip6tables -D INPUT -m set --match-set sshguard6 src -j DROP
         ${pkgs.ipset}/bin/ipset -quiet destroy sshguard6
       '';
 
diff --git a/nixos/modules/services/web-apps/frab.nix b/nixos/modules/services/web-apps/frab.nix
deleted file mode 100644
index 1b5890d6b0c..00000000000
--- a/nixos/modules/services/web-apps/frab.nix
+++ /dev/null
@@ -1,222 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  cfg = config.services.frab;
-
-  package = pkgs.frab;
-
-  databaseConfig = builtins.toJSON { production = cfg.database; };
-
-  frabEnv = {
-    RAILS_ENV = "production";
-    RACK_ENV = "production";
-    SECRET_KEY_BASE = cfg.secretKeyBase;
-    FRAB_HOST = cfg.host;
-    FRAB_PROTOCOL = cfg.protocol;
-    FROM_EMAIL = cfg.fromEmail;
-    RAILS_SERVE_STATIC_FILES = "1";
-  } // cfg.extraEnvironment;
-
-  frab-rake = pkgs.stdenv.mkDerivation {
-    name = "frab-rake";
-    buildInputs = [ package.env pkgs.makeWrapper ];
-    phases = "installPhase fixupPhase";
-    installPhase = ''
-      mkdir -p $out/bin
-      makeWrapper ${package.env}/bin/bundle $out/bin/frab-bundle \
-          ${concatStrings (mapAttrsToList (name: value: "--set ${name} '${value}' ") frabEnv)} \
-          --set PATH '${lib.makeBinPath (with pkgs; [ nodejs file imagemagick ])}:$PATH' \
-          --set RAKEOPT '-f ${package}/share/frab/Rakefile' \
-          --run 'cd ${package}/share/frab'
-      makeWrapper $out/bin/frab-bundle $out/bin/frab-rake \
-          --add-flags "exec rake"
-     '';
-  };
-
-in
-
-{
-  options = {
-    services.frab = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Enable the frab service.
-        '';
-      };
-
-      host = mkOption {
-        type = types.str;
-        example = "frab.example.com";
-        description = ''
-          Hostname under which this frab instance can be reached.
-        '';
-      };
-
-      protocol = mkOption {
-        type = types.str;
-        default = "https";
-        example = "http";
-        description = ''
-          Either http or https, depending on how your Frab instance
-          will be exposed to the public.
-        '';
-      };
-
-      fromEmail = mkOption {
-        type = types.str;
-        default = "frab@localhost";
-        description = ''
-          Email address used by frab.
-        '';
-      };
-
-      listenAddress = mkOption {
-        type = types.str;
-        default = "localhost";
-        description = ''
-          Address or hostname frab should listen on.
-        '';
-      };
-
-      listenPort = mkOption {
-        type = types.int;
-        default = 3000;
-        description = ''
-          Port frab should listen on.
-        '';
-      };
-
-      statePath = mkOption {
-        type = types.str;
-        default = "/var/lib/frab";
-        description = ''
-          Directory where frab keeps its state.
-        '';
-      };
-
-      user = mkOption {
-        type = types.str;
-        default = "frab";
-        description = ''
-          User to run frab.
-        '';
-      };
-
-      group = mkOption {
-        type = types.str;
-        default = "frab";
-        description = ''
-          Group to run frab.
-        '';
-      };
-
-      secretKeyBase = mkOption {
-        type = types.str;
-        description = ''
-          Your secret key is used for verifying the integrity of signed cookies.
-          If you change this key, all old signed cookies will become invalid!
-
-          Make sure the secret is at least 30 characters and all random,
-          no regular words or you'll be exposed to dictionary attacks.
-        '';
-      };
-
-      database = mkOption {
-        type = types.attrs;
-        default = {
-          adapter = "sqlite3";
-          database = "/var/lib/frab/db.sqlite3";
-          pool = 5;
-          timeout = 5000;
-        };
-        example = {
-          adapter = "postgresql";
-          database = "frab";
-          host = "localhost";
-          username = "frabuser";
-          password = "supersecret";
-          encoding = "utf8";
-          pool = 5;
-        };
-        description = ''
-          Rails database configuration for Frab as Nix attribute set.
-        '';
-      };
-
-      extraEnvironment = mkOption {
-        type = types.attrs;
-        default = {};
-        example = {
-          FRAB_CURRENCY_UNIT = "€";
-          FRAB_CURRENCY_FORMAT = "%n%u";
-          EXCEPTION_EMAIL = "frab-owner@example.com";
-          SMTP_ADDRESS = "localhost";
-          SMTP_PORT = "587";
-          SMTP_DOMAIN = "localdomain";
-          SMTP_USER_NAME = "root";
-          SMTP_PASSWORD = "toor";
-          SMTP_AUTHENTICATION = "1";
-          SMTP_NOTLS = "1";
-        };
-        description = ''
-          Additional environment variables to set for frab for further
-          configuration. See the frab documentation for more information.
-        '';
-      };
-    };
-  };
-
-  config = mkIf cfg.enable {
-    environment.systemPackages = [ frab-rake ];
-
-    users.users.${cfg.user} =
-      { group = cfg.group;
-        home = "${cfg.statePath}";
-        isSystemUser = true;
-      };
-
-    users.groups.${cfg.group} = { };
-
-    systemd.tmpfiles.rules = [
-      "d '${cfg.statePath}/system/attachments' - ${cfg.user} ${cfg.group} - -"
-    ];
-
-    systemd.services.frab = {
-      after = [ "network.target" "gitlab.service" ];
-      wantedBy = [ "multi-user.target" ];
-      environment = frabEnv;
-
-      preStart = ''
-        ln -sf ${pkgs.writeText "frab-database.yml" databaseConfig} /run/frab/database.yml
-        ln -sf ${cfg.statePath}/system /run/frab/system
-
-        if ! test -e "${cfg.statePath}/db-setup-done"; then
-          ${frab-rake}/bin/frab-rake db:setup
-          touch ${cfg.statePath}/db-setup-done
-        else
-          ${frab-rake}/bin/frab-rake db:migrate
-        fi
-      '';
-
-      serviceConfig = {
-        PrivateTmp = true;
-        PrivateDevices = true;
-        Type = "simple";
-        User = cfg.user;
-        Group = cfg.group;
-        TimeoutSec = "300s";
-        Restart = "on-failure";
-        RestartSec = "10s";
-        RuntimeDirectory = "frab";
-        WorkingDirectory = "${package}/share/frab";
-        ExecStart = "${frab-rake}/bin/frab-bundle exec rails server " +
-          "--binding=${cfg.listenAddress} --port=${toString cfg.listenPort}";
-      };
-    };
-
-  };
-}
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index 53c2ab76fdf..0dad85d681a 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -391,7 +391,9 @@ in {
                 $file = "${c.dbpassFile}";
                 if (!file_exists($file)) {
                   throw new \RuntimeException(sprintf(
-                    "Cannot start Nextcloud, dbpass file %s set by NixOS doesn't exist!",
+                    "Cannot start Nextcloud, dbpass file %s set by NixOS doesn't seem to "
+                    . "exist! Please make sure that the file exists and has appropriate "
+                    . "permissions for user & group 'nextcloud'!",
                     $file
                   ));
                 }
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index e9630d379f3..62671e9d748 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -390,13 +390,24 @@ in
       };
 
       config = mkOption {
+        type = types.str;
         default = "";
-        description = "
-          Verbatim nginx.conf configuration.
-          This is mutually exclusive with the structured configuration
-          via virtualHosts and the recommendedXyzSettings configuration
-          options. See appendConfig for appending to the generated http block.
-        ";
+        description = ''
+          Verbatim <filename>nginx.conf</filename> configuration.
+          This is mutually exclusive to any other config option for
+          <filename>nginx.conf</filename> except for
+          <itemizedlist>
+          <listitem><para><xref linkend="opt-services.nginx.appendConfig" />
+          </para></listitem>
+          <listitem><para><xref linkend="opt-services.nginx.httpConfig" />
+          </para></listitem>
+          <listitem><para><xref linkend="opt-services.nginx.logError" />
+          </para></listitem>
+          </itemizedlist>
+
+          If additional verbatim config in addition to other options is needed,
+          <xref linkend="opt-services.nginx.appendConfig" /> should be used instead.
+        '';
       };
 
       appendConfig = mkOption {
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 807a4bcdd9b..de77bef2535 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -195,6 +195,7 @@ in
   lidarr = handleTest ./lidarr.nix {};
   lightdm = handleTest ./lightdm.nix {};
   limesurvey = handleTest ./limesurvey.nix {};
+  locate = handleTest ./locate.nix {};
   login = handleTest ./login.nix {};
   loki = handleTest ./loki.nix {};
   lsd = handleTest ./lsd.nix {};
diff --git a/nixos/tests/locate.nix b/nixos/tests/locate.nix
new file mode 100644
index 00000000000..8818607f955
--- /dev/null
+++ b/nixos/tests/locate.nix
@@ -0,0 +1,62 @@
+import ./make-test-python.nix ({ lib, pkgs, ... }:
+  let inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
+  in {
+    name = "locate";
+    meta.maintainers = with pkgs.stdenv.lib.maintainers; [ chkno ];
+
+    nodes = rec {
+      a = {
+        environment.systemPackages = with pkgs; [ sshfs ];
+        fileSystems = lib.mkVMOverride {
+          "/ssh" = {
+            device = "alice@b:/";
+            fsType = "fuse.sshfs";
+            options = [
+              "allow_other"
+              "IdentityFile=/privkey"
+              "noauto"
+              "StrictHostKeyChecking=no"
+              "UserKnownHostsFile=/dev/null"
+            ];
+          };
+        };
+        services.locate = {
+          enable = true;
+          interval = "*:*:0/5";
+        };
+      };
+      b = {
+        services.openssh.enable = true;
+        users.users.alice = {
+          isNormalUser = true;
+          openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
+        };
+      };
+    };
+
+    testScript = ''
+      start_all()
+
+      # Set up sshfs mount
+      a.succeed(
+          "(umask 077; cat ${snakeOilPrivateKey} > /privkey)"
+      )
+      b.succeed("touch /file-on-b-machine")
+      b.wait_for_open_port(22)
+      a.succeed("mkdir /ssh")
+      a.succeed("mount /ssh")
+
+      # Core locatedb functionality
+      a.succeed("touch /file-on-a-machine-1")
+      a.wait_for_file("/var/cache/locatedb")
+      a.wait_until_succeeds("locate file-on-a-machine-1")
+
+      # Wait for a second update to make sure we're using a locatedb from a run
+      # that began after the sshfs mount
+      a.succeed("touch /file-on-a-machine-2")
+      a.wait_until_succeeds("locate file-on-a-machine-2")
+
+      # We shouldn't be able to see files on the other machine
+      a.fail("locate file-on-b-machine")
+    '';
+  })
diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix
index 0b9957404f3..3eb4341e39c 100644
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -530,6 +530,21 @@ let
       '';
     };
 
+    py-air-control = {
+      nodeName = "py_air_control";
+      exporterConfig = {
+        enable = true;
+        deviceHostname = "127.0.0.1";
+      };
+      exporterTest = ''
+        wait_for_unit("prometheus-py-air-control-exporter.service")
+        wait_for_open_port(9896)
+        succeed(
+            "curl -sSf http://localhost:9896/metrics | grep -q 'py_air_control_sampling_error_total'"
+        )
+      '';
+    };
+
     redis = {
       exporterConfig = {
         enable = true;
diff --git a/pkgs/applications/audio/clementine/default.nix b/pkgs/applications/audio/clementine/default.nix
index 0c1690f1462..d9d1a11ce1d 100644
--- a/pkgs/applications/audio/clementine/default.nix
+++ b/pkgs/applications/audio/clementine/default.nix
@@ -10,6 +10,7 @@ let
   withCD = config.clementine.cd or true;
   withCloud = config.clementine.cloud or true;
 
+  # On the update after all 1.4rc, qt5.15 will be supported.
   version = "1.4.0rc1";
 
   src = fetchFromGitHub {
diff --git a/pkgs/applications/audio/musikcube/default.nix b/pkgs/applications/audio/musikcube/default.nix
index dc936083cae..10a3b3b8735 100644
--- a/pkgs/applications/audio/musikcube/default.nix
+++ b/pkgs/applications/audio/musikcube/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "musikcube";
-  version = "0.96.1";
+  version = "0.96.2";
 
   src = fetchFromGitHub {
     owner = "clangen";
     repo = pname;
     rev = version;
-    sha256 = "0gpyr25q6g9b8f9hi6jx3p4ijl7xrrjc78vw1fyjd59a7690d7kr";
+    sha256 = "1vvc8295yadprfqpmk9i43ghymgsqxsg8zfx3p5i86a8xrdhd9vn";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/blockchains/go-ethereum.nix b/pkgs/applications/blockchains/go-ethereum.nix
index b0f464cbfdc..24f58a6c2c3 100644
--- a/pkgs/applications/blockchains/go-ethereum.nix
+++ b/pkgs/applications/blockchains/go-ethereum.nix
@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "go-ethereum";
-  version = "1.9.24";
+  version = "1.9.25";
 
   src = fetchFromGitHub {
     owner = "ethereum";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0nrx5fwfij9wajd3lj76hh1yv4zg4q3jc76a76m22djn1njl0n5j";
+    sha256 = "0cbgqs17agwdap4g37sb2g6mhyn7qkqbjk7kwb5jvj8nbi5n3kbd";
   };
 
   runVend = true;
-  vendorSha256 = "1qbg44cryiv9kvcak6qjrbmkc9bxyk5fybj62vdkskqfjvv86068";
+  vendorSha256 = "08wgah8gxb5bscm5ca6zkfgssnmw2y2l6k9gfw7gbxyflsx74lya";
 
   doCheck = false;
 
diff --git a/pkgs/applications/blockchains/monero-gui/default.nix b/pkgs/applications/blockchains/monero-gui/default.nix
index 16f4aefe349..fb6753f79a5 100644
--- a/pkgs/applications/blockchains/monero-gui/default.nix
+++ b/pkgs/applications/blockchains/monero-gui/default.nix
@@ -27,13 +27,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "monero-gui";
-  version = "0.17.1.5";
+  version = "0.17.1.6";
 
   src = fetchFromGitHub {
     owner  = "monero-project";
     repo   = "monero-gui";
     rev    = "v${version}";
-    sha256 = "0qlcqli0wvrjfy89mbgh1hpmk60dxgn5sws93h8lhgyfwx557iw0";
+    sha256 = "0kn5wvx2psbdaqmy1cxlbf5l1mdpvh0b6hh9drah3s7nj3654a3r";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/blockchains/turbo-geth.nix b/pkgs/applications/blockchains/turbo-geth.nix
index b8aa3de44da..cf0b60ab985 100644
--- a/pkgs/applications/blockchains/turbo-geth.nix
+++ b/pkgs/applications/blockchains/turbo-geth.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "turbo-geth";
-  version = "2020.12.01";
+  version = "2020.12.02";
 
   src = fetchFromGitHub {
     owner = "ledgerwatch";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0l1qj10vhfkrk66zihz8m24pnyj8jbb65a7amvphp07r199swy2a";
+    sha256 = "0ynnpvpd84qncvzmk4hmq8mn6m14a9p3zg4svijqwlsrr39amp3q";
   };
 
-  vendorSha256 = "16vawkky612zf45d8dhipjmhrprmi28z9wdcnjy07x3bxdyfbhfr";
+  vendorSha256 = "0sk064iyaxq9ig9xv3h1p1c4994hna9bky16g3hblbnh3v7mmqar";
   runVend = true;
 
   subPackages = [
diff --git a/pkgs/applications/blockchains/wasabiwallet/default.nix b/pkgs/applications/blockchains/wasabiwallet/default.nix
index e566661d36a..4a0dbe83716 100644
--- a/pkgs/applications/blockchains/wasabiwallet/default.nix
+++ b/pkgs/applications/blockchains/wasabiwallet/default.nix
@@ -24,11 +24,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "wasabiwallet";
-  version = "1.1.12.2";
+  version = "1.1.12.3";
 
   src = fetchurl {
     url = "https://github.com/zkSNACKs/WalletWasabi/releases/download/v${version}/Wasabi-${version}.tar.gz";
-    sha256 = "0nl7n24nsy3gyzrxa6llx81pvsjqcwi0a4qdv34dpcq483aclp2r";
+    sha256 = "1x4gqmiwdp5bjq7c5hjch3srsvf73d92lswnp355l7l7cxh2hcsx";
   };
 
   dontBuild = true;
diff --git a/pkgs/applications/editors/emacs-modes/melpa-packages.nix b/pkgs/applications/editors/emacs-modes/melpa-packages.nix
index 03e9923f737..5a02c97b6d0 100644
--- a/pkgs/applications/editors/emacs-modes/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-packages.nix
@@ -252,12 +252,6 @@ let
             (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
         });
 
-        magit-stgit = super.magit-stgit.overrideAttrs (attrs: {
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
-
         magit-tbdiff = super.magit-tbdiff.overrideAttrs (attrs: {
           # searches for Git at build time
           nativeBuildInputs =
@@ -427,14 +421,26 @@ let
         initsplit = markBroken super.initsplit;
 
         # upstream issue: missing file header
+        instapaper = markBroken super.instapaper;
+
+        # upstream issue: missing file header
         jsfmt = markBroken super.jsfmt;
 
         # upstream issue: missing file header
         maxframe = markBroken super.maxframe;
 
         # upstream issue: doesn't build
+        magit-stgit = markBroken super.magit-stgit;
+
+        # upstream issue: missing file header
+        melancholy-theme = markBroken super.melancholy-theme;
+
+        # upstream issue: doesn't build
         eterm-256color = markBroken super.eterm-256color;
 
+        # upstream issue: doesn't build
+        per-buffer-theme = markBroken super.per-buffer-theme;
+
         # upstream issue: missing file header
         qiita = markBroken super.qiita;
 
@@ -442,6 +448,9 @@ let
         speech-tagger = markBroken super.speech-tagger;
 
         # upstream issue: missing file header
+        sql-presto = markBroken super.sql-presto;
+
+        # upstream issue: missing file header
         textmate = markBroken super.textmate;
 
         # upstream issue: missing file header
diff --git a/pkgs/applications/editors/emacs/generic.nix b/pkgs/applications/editors/emacs/generic.nix
index 0e09b0c20ee..a84cb41bf30 100644
--- a/pkgs/applications/editors/emacs/generic.nix
+++ b/pkgs/applications/editors/emacs/generic.nix
@@ -141,8 +141,7 @@ in stdenv.mkDerivation {
 
     siteVersionDir=`ls $out/share/emacs | grep -v site-lisp | head -n 1`
 
-    rm -rf $out/var
-    rm -rf $siteVersionDir
+    rm -r $out/share/emacs/$siteVersionDir/site-lisp
   '' + lib.optionalString withCsrc ''
     for srcdir in src lisp lwlib ; do
       dstdir=$out/share/emacs/$siteVersionDir/$srcdir
diff --git a/pkgs/applications/editors/emacs/site-start.el b/pkgs/applications/editors/emacs/site-start.el
index 2f02d6d1a86..86cad1132f6 100644
--- a/pkgs/applications/editors/emacs/site-start.el
+++ b/pkgs/applications/editors/emacs/site-start.el
@@ -22,6 +22,17 @@ least specific (the system profile)"
                              (nix--profile-paths)))))
   (setq load-path (append paths load-path)))
 
+;;; Remove wrapper site-lisp from EMACSLOADPATH so it's not propagated
+;;; to any other Emacsen that might be started as subprocesses.
+(let ((wrapper-site-lisp (getenv "emacsWithPackages_siteLisp"))
+      (env-load-path (getenv "EMACSLOADPATH")))
+  (when wrapper-site-lisp
+    (setenv "emacsWithPackages_siteLisp" nil))
+  (when (and wrapper-site-lisp env-load-path)
+    (let* ((env-list (split-string env-load-path ":"))
+           (new-env-list (delete wrapper-site-lisp env-list)))
+      (setenv "EMACSLOADPATH" (when new-env-list
+                                (mapconcat 'identity new-env-list ":"))))))
 
 ;;; Make `woman' find the man pages
 (defvar woman-manpath)
diff --git a/pkgs/applications/editors/rehex/default.nix b/pkgs/applications/editors/rehex/default.nix
new file mode 100644
index 00000000000..0fe00d08405
--- /dev/null
+++ b/pkgs/applications/editors/rehex/default.nix
@@ -0,0 +1,46 @@
+{ stdenv
+, fetchFromGitHub
+, capstone
+, jansson
+, wxGTK30
+, darwin
+, libicns
+, wxmac
+}:
+
+stdenv.mkDerivation rec {
+  pname = "rehex";
+  version = "0.3.1";
+
+  src = fetchFromGitHub {
+    owner = "solemnwarning";
+    repo = pname;
+    rev = version;
+    sha256 = "1yj9a63j7534mmz8cl1ifg2wmgkxmk6z75jd8lkmc2sfrjbick32";
+  };
+
+  patchPhase = ''
+    substituteInPlace Makefile.osx --replace 'iconutil -c icns -o $@ $(ICONSET)' \
+      'png2icns $@ $(ICONSET)/icon_16x16.png $(ICONSET)/icon_32x32.png $(ICONSET)/icon_128x128.png $(ICONSET)/icon_256x256.png $(ICONSET)/icon_512x512.png'
+  '';
+
+  nativeBuildInputs = stdenv.lib.optionals (stdenv.isDarwin) [ libicns ];
+
+  buildInputs = [ capstone jansson ]
+    ++ (stdenv.lib.optionals (!stdenv.isDarwin) [ wxGTK30 ])
+    ++ (stdenv.lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ Carbon Cocoa IOKit wxmac ]));
+
+  makeFlags = [ "prefix=$(out)" ] ++ (stdenv.lib.optionals stdenv.isDarwin [ "-f Makefile.osx" ]);
+
+  meta = with stdenv.lib; {
+    description = "Reverse Engineers' Hex Editor";
+    longDescription = ''
+      A cross-platform (Windows, Linux, Mac) hex editor for reverse
+      engineering, and everything else.
+    '';
+    homepage = "https://github.com/solemnwarning/rehex";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ markus1189 SuperSandro2000 ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/applications/editors/vis/default.nix b/pkgs/applications/editors/vis/default.nix
index 5191b916b6c..c8eb119eb07 100644
--- a/pkgs/applications/editors/vis/default.nix
+++ b/pkgs/applications/editors/vis/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "vis";
-  version  = "0.6";
+  version  = "0.7";
 
   src = fetchFromGitHub {
     rev = "v${version}";
-    sha256 = "1zjm89cn3rfq8fxpwp66khy53s6vqlmw6q103qyyvix8ydzxdmsh";
+    sha256 = "1g05ncsnk57kcqm9wsv6sz8b24kyzj8r5rfpa1wfwj8qkjzx3vji";
     repo = "vis";
     owner = "martanne";
   };
diff --git a/pkgs/applications/editors/zile/default.nix b/pkgs/applications/editors/zile/default.nix
index c7c57a9e3ef..5181c2c6767 100644
--- a/pkgs/applications/editors/zile/default.nix
+++ b/pkgs/applications/editors/zile/default.nix
@@ -1,15 +1,15 @@
-{ fetchurl, stdenv, pkgconfig, ncurses, boehmgc, perl, help2man }:
+{ fetchurl, stdenv, glib, libgee, pkg-config, ncurses, boehmgc, perl, help2man, vala }:
 
 stdenv.mkDerivation rec {
-  name = "zile-2.4.14";
+  name = "zile-2.6.0.90";
 
   src = fetchurl {
     url = "mirror://gnu/zile/${name}.tar.gz";
-    sha256 = "0x3byaddms8l3g7igx6njycqsq98wgapysdb5c7lhcnajlkp8y3s";
+    sha256 = "1bhdwnasmqhy0hi3fqmpzr8xkw5zlqjpmf1cj42h4cg3fnamp6r3";
   };
 
-  buildInputs = [ ncurses boehmgc ];
-  nativeBuildInputs = [ perl pkgconfig ]
+  buildInputs = [ glib libgee ncurses boehmgc vala ];
+  nativeBuildInputs = [ perl pkg-config ]
     # `help2man' wants to run Zile, which won't work when the
     # newly-produced binary can't be run at build-time.
     ++ stdenv.lib.optional
diff --git a/pkgs/applications/gis/qmapshack/default.nix b/pkgs/applications/gis/qmapshack/default.nix
index bc7d888e2c1..ef036fb71b0 100644
--- a/pkgs/applications/gis/qmapshack/default.nix
+++ b/pkgs/applications/gis/qmapshack/default.nix
@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "qmapshack";
-  version = "1.15.1";
+  version = "1.15.2";
 
   src = fetchFromGitHub {
     owner = "Maproom";
     repo = pname;
     rev = "V_${version}";
-    sha256 = "1q8qczp9bgk3dzdswb1x64fcn3xg339s0yx31nablb518hcb8jkr";
+    sha256 = "1l1j2axf94pdqwirwwhwy3y6k8v1aix78ifqbv6j8sv131h2j7y7";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/graphics/ktikz/default.nix b/pkgs/applications/graphics/ktikz/default.nix
index f817a332160..d0d9f100878 100644
--- a/pkgs/applications/graphics/ktikz/default.nix
+++ b/pkgs/applications/graphics/ktikz/default.nix
@@ -31,10 +31,16 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
+    # Fix version in qtikz.pro
     (fetchpatch {
       url = "https://github.com/fhackenberger/ktikz/commit/972685a406517bb85eb561f2c8e26f029eacd7db.patch";
       sha256 = "13z40rcd4m4n088v7z2ns17lnpn0z3rzp31lsamic3qdcwjwa5k8";
     })
+    # Fix missing qt5.15 QPainterPath include
+    (fetchpatch {
+      url = "https://github.com/fhackenberger/ktikz/commit/ebe4dfb72ac8a137b475ef688b9f7ac3e5c7f242.patch";
+      sha256 = "GIgPh+iUBPftHKIpZR3a0FxmLhMLuPUapF/t+bCuqMs=";
+    })
   ];
 
   nativeBuildInputs = [ pkgconfig qttools qmake wrapQtAppsHook ];
diff --git a/pkgs/applications/graphics/mcomix3/default.nix b/pkgs/applications/graphics/mcomix3/default.nix
index c9110cbea0b..24c80a6bd87 100644
--- a/pkgs/applications/graphics/mcomix3/default.nix
+++ b/pkgs/applications/graphics/mcomix3/default.nix
@@ -1,13 +1,15 @@
 { stdenv
 , lib
 , fetchFromGitHub
-, python3
 , wrapGAppsHook
+, installShellFiles
+, python3
 , gobject-introspection
 , gtk3
 , gdk-pixbuf
+
 # Recommended Dependencies:
-, unrarSupport ? false
+, unrarSupport ? false  # unfree software
 , unrar
 , p7zip
 , lhasa
@@ -18,7 +20,7 @@ python3.pkgs.buildPythonApplication rec {
   pname = "mcomix3";
   version = "unstable-2020-11-23";
 
-  # fetch from github because no official release on pypi/github and no build system
+  # no official release on pypi/github and no build system
   src = fetchFromGitHub {
     repo   = "${pname}";
     owner  = "multiSnow";
@@ -27,7 +29,7 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   buildInputs = [ gobject-introspection gtk3 gdk-pixbuf ];
-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [ wrapGAppsHook installShellFiles ];
   propagatedBuildInputs = (with python3.pkgs; [ pillow pygobject3 pycairo ]);
 
   format = "other";
@@ -55,7 +57,8 @@ python3.pkgs.buildPythonApplication rec {
 
   postInstall = ''
     rmdir $libdir/mcomix/mcomix
-    cp man/* $out/share/man/man1/
+    mv man/mcomix.1 man/${pname}.1
+    installManPage man/*
     cp -r mime/icons/* $out/share/icons/hicolor/
     cp mime/*.desktop $out/share/applications/
     cp mime/*.appdata.xml $out/share/metainfo/
@@ -63,12 +66,13 @@ python3.pkgs.buildPythonApplication rec {
     for folder in $out/share/icons/hicolor/*; do
         mkdir $folder/{apps,mimetypes}
         mv $folder/*.png $folder/mimetypes
+        cp $libdir/mcomix/images/$(basename $folder)/mcomix.png $folder/apps/${pname}.png
         cp $folder/mimetypes/application-x-cbt.png $folder/mimetypes/application-x-cbr.png
         cp $folder/mimetypes/application-x-cbt.png $folder/mimetypes/application-x-cbz.png
     done
   '';
 
-  # to prevent double wrapping
+  # prevent double wrapping
   dontWrapGApps = true;
   preFixup = ''
     makeWrapperArgs+=(
@@ -77,7 +81,7 @@ python3.pkgs.buildPythonApplication rec {
     )
   '';
 
-  # real pytests seem to be broken upstream
+  # real pytests broken upstream
   checkPhase = ''
     $out/bin/comicthumb --help > /dev/null
     $out/bin/${pname} --help > /dev/null
diff --git a/pkgs/applications/misc/chrysalis/default.nix b/pkgs/applications/misc/chrysalis/default.nix
new file mode 100644
index 00000000000..e79d989e22d
--- /dev/null
+++ b/pkgs/applications/misc/chrysalis/default.nix
@@ -0,0 +1,28 @@
+{ lib, appimageTools, fetchurl }:
+
+let
+  pname = "chrysalis";
+  version = "0.7.9";
+in appimageTools.wrapType2 rec {
+  name = "${pname}-${version}-binary";
+
+  src = fetchurl {
+    url = "https://github.com/keyboardio/${pname}/releases/download/${pname}-${version}/${pname}-${version}.AppImage";
+    sha256 = "12w4vv7dwfpvxpc8kpfas90y7yy8mb8dj2096z3vw1bli5lrn3zi";
+  };
+
+  multiPkgs = null;
+  extraPkgs = p: (appimageTools.defaultFhsEnvArgs.multiPkgs p) ++ [
+    p.glib
+  ];
+
+  extraInstallCommands = "mv $out/bin/${name} $out/bin/${pname}";
+
+  meta = with lib; {
+    description = "A graphical configurator for Kaleidoscope-powered keyboards";
+    homepage = "https://github.com/keyboardio/Chrysalis";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ aw ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/applications/misc/electrum/default.nix b/pkgs/applications/misc/electrum/default.nix
index df6c99768e8..3322fbee712 100644
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@@ -19,15 +19,7 @@
 }:
 
 let
-  version = "4.0.6";
-
-  # electrum is not compatible with dnspython 2.0.0 yet
-  # use the latest 1.x release instead
-  py = python3.override {
-    packageOverrides = self: super: {
-      dnspython = super.dnspython_1;
-    };
-  };
+  version = "4.0.7";
 
   libsecp256k1_name =
     if stdenv.isLinux then "libsecp256k1.so.0"
@@ -43,7 +35,7 @@ let
     owner = "spesmilo";
     repo = "electrum";
     rev = version;
-    sha256 = "0mdbg2sq56nv0hx0rrcbgrv1lv89nqc6cqigivgk665hhjm4v5kq";
+    sha256 = "06vcbj9p96d8v4xjlygzr74lqllb9adn8k0racajzq61ijb0imi2";
 
     extraPostFetch = ''
       mv $out ./all
@@ -52,13 +44,13 @@ let
   };
 in
 
-py.pkgs.buildPythonApplication {
+python3.pkgs.buildPythonApplication {
   pname = "electrum";
   inherit version;
 
   src = fetchurl {
     url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
-    sha256 = "0sp8p720g3rqnh52ddhaw2v4hjgpxcwbackw9qc1g9xac1q0942d";
+    sha256 = "0k5xf97ga3ixd02g1y6v84hbxd8yhvpj5iz2rhxs8wfnkfwibzh4";
   };
 
   postUnpack = ''
@@ -68,19 +60,18 @@ py.pkgs.buildPythonApplication {
 
   nativeBuildInputs = stdenv.lib.optionals enableQt [ wrapQtAppsHook ];
 
-  propagatedBuildInputs = with py.pkgs; [
+  propagatedBuildInputs = with python3.pkgs; [
     aiohttp
     aiohttp-socks
     aiorpcx
     attrs
     bitstring
+    cryptography
     dnspython
-    ecdsa
     jsonrpclib-pelix
     matplotlib
     pbkdf2
     protobuf
-    pycryptodomex
     pysocks
     qrcode
     requests
@@ -121,10 +112,15 @@ py.pkgs.buildPythonApplication {
     wrapQtApp $out/bin/electrum
   '';
 
-  checkInputs = with py.pkgs; [ pytest ];
+  checkInputs = with python3.pkgs; [ pytestCheckHook pycryptodomex ];
+
+  pytestFlagsArray = [ "electrum/tests" ];
+
+  disabledTests = [
+    "test_loop"  # test tries to bind 127.0.0.1 causing permission error
+  ];
 
-  checkPhase = ''
-    py.test electrum/tests
+  postCheck = ''
     $out/bin/electrum help >/dev/null
   '';
 
diff --git a/pkgs/applications/misc/khal/default.nix b/pkgs/applications/misc/khal/default.nix
index 257cacf69a0..3c46043256a 100644
--- a/pkgs/applications/misc/khal/default.nix
+++ b/pkgs/applications/misc/khal/default.nix
@@ -57,7 +57,9 @@ with python3.pkgs; buildPythonApplication rec {
   doCheck = !stdenv.isAarch64;
 
   checkPhase = ''
-    py.test
+    py.test -k "not test_vertical_month_abbr_fr and not test_vertical_month_unicode_weekdeays_gr \
+      and not test_event_different_timezones and not test_default_calendar and not test_birthdays \
+      and not test_birthdays_no_year"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/misc/mucommander/default.nix b/pkgs/applications/misc/mucommander/default.nix
index e598e099d06..a1e02dbe18e 100644
--- a/pkgs/applications/misc/mucommander/default.nix
+++ b/pkgs/applications/misc/mucommander/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, gradle_4_10, perl, makeWrapper, jre, gsettings-desktop-schemas }:
+{ stdenv, fetchFromGitHub, gradle_6, perl, makeWrapper, jdk11, gsettings-desktop-schemas }:
 
 let
   version = "0.9.3-3";
@@ -36,7 +36,7 @@ let
   deps = stdenv.mkDerivation {
     name = "${name}-deps";
     inherit src postPatch;
-    nativeBuildInputs = [ gradle_4_10 perl ];
+    nativeBuildInputs = [ gradle_6 perl ];
     buildPhase = ''
       export GRADLE_USER_HOME=$(mktemp -d)
       gradle --no-daemon build
@@ -54,7 +54,7 @@ let
 
 in stdenv.mkDerivation {
   inherit name src postPatch;
-  nativeBuildInputs = [ gradle_4_10 perl makeWrapper ];
+  nativeBuildInputs = [ gradle_6 perl makeWrapper ];
 
   buildPhase = ''
     export GRADLE_USER_HOME=$(mktemp -d)
@@ -73,7 +73,7 @@ in stdenv.mkDerivation {
     tar xvf build/distributions/mucommander-${version}.tar --directory=$out --strip=1
     wrapProgram $out/bin/mucommander \
       --prefix XDG_DATA_DIRS : ${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name} \
-      --set JAVA_HOME ${jre}
+      --set JAVA_HOME ${jdk11}
   '';
 
   meta = with stdenv.lib; {
@@ -81,6 +81,9 @@ in stdenv.mkDerivation {
     description = "Cross-platform file manager";
     license = licenses.gpl3;
     maintainers = with maintainers; [ volth ];
+    # build is broken on MacOS
+    # https://github.com/NixOS/nixpkgs/pull/105784
+    broken = stdenv.isDarwin;
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/applications/misc/remarkable/rmapi/default.nix b/pkgs/applications/misc/remarkable/rmapi/default.nix
index f159cd852e8..5ccf930e620 100644
--- a/pkgs/applications/misc/remarkable/rmapi/default.nix
+++ b/pkgs/applications/misc/remarkable/rmapi/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "rmapi";
-  version = "0.0.12";
+  version = "0.0.13";
 
   src = fetchFromGitHub {
     owner = "juruen";
     repo = "rmapi";
     rev = "v${version}";
-    sha256 = "049m0p4wbsl822iym8xmc938d4k90iw7wjdzcxfyy8d27hv9mp45";
+    sha256 = "0qq8x37p7yxhcp5d5xss3pv5186xgg0hd6lbkqivhy5yjsd54c7b";
   };
 
-  vendorSha256 = "077s13pcql5w2m6wzls1q06r7p501kazbwzxgfh6akwza15kb4is";
+  vendorSha256 = "1pa75rjns1kknl2gmfprdzc3f2z8dk44jkz6dmf8f3prj0z7x88c";
 
   doCheck = false;
 
diff --git a/pkgs/applications/misc/rofimoji/default.nix b/pkgs/applications/misc/rofimoji/default.nix
index b76b1d6d21e..ed97c17bfd9 100644
--- a/pkgs/applications/misc/rofimoji/default.nix
+++ b/pkgs/applications/misc/rofimoji/default.nix
@@ -33,7 +33,10 @@ buildPythonApplication rec {
 
   # The 'extractors' sub-module is used for development
   # and has additional dependencies.
-  postPatch = "rm -rf extractors";
+  postPatch = ''
+    rm -rf extractors
+    substituteInPlace setup.py --replace 'pyxdg==0.26' 'pyxdg'
+  '';
 
   meta = with lib; {
     description = "A simple emoji and character picker for rofi";
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index 15899d31e72..3b64e601eba 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -18,9 +18,9 @@
     }
   },
   "beta": {
-    "version": "88.0.4324.27",
-    "sha256": "0mciiyh3sn2zrl8g6znylc2pm9sb0wzsclgavf7mmlknri5sjblc",
-    "sha256bin64": "0qf2j1j3p94s724rwh8fydpjn88cs9yxxhjf5axvqwi7q3h35cfx",
+    "version": "88.0.4324.41",
+    "sha256": "06hnawylr7fl1zav6cyg1yfw2z04qrpnj4n3v07qx7ya6p8qyp2g",
+    "sha256bin64": "1iq4qd5x7ivypcxh47d6av45hyqdgga2s80idyhf1f51f660h2vc",
     "deps": {
       "gn": {
         "version": "2020-11-05",
@@ -31,9 +31,9 @@
     }
   },
   "dev": {
-    "version": "89.0.4343.0",
-    "sha256": "0jmc1l0lysl5zax98fjhzsfq3c1sqh3n3xscidafflx362wcfpwa",
-    "sha256bin64": "1v6xik8kf531y0g5xj0c8szjmak0qvh77kwkw7p7hqxqmnwwp06d",
+    "version": "89.0.4350.4",
+    "sha256": "1jh3r227j70imjzj0gm7cf1mv25zcdd2waa9qvim0p3g6wbdacmq",
+    "sha256bin64": "06963r7a1xc9vjlwgn0wgzqfj6mavfks20lzf49axw6izrxf8sbr",
     "deps": {
       "gn": {
         "version": "2020-11-05",
diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index 7f0b826f905..a9888c3c47b 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, makeDesktopItem, makeWrapper, lndir, config
-, replace, fetchurl, zip, unzip, jq
+, replace, fetchurl, zip, unzip, jq, xdg_utils
 
 ## various stuff that can be plugged in
 , flashplayer, hal-flash
@@ -251,6 +251,7 @@ let
             --suffix LD_LIBRARY_PATH ':' "$libs" \
             --suffix-each GTK_PATH ':' "$gtk_modules" \
             --suffix-each LD_PRELOAD ':' "$(cat $(filterExisting $(addSuffix /extra-ld-preload $plugins)))" \
+            --prefix PATH ':' "${xdg_utils}/bin" \
             --prefix-contents PATH ':' "$(filterExisting $(addSuffix /extra-bin-path $plugins))" \
             --suffix PATH ':' "$out${browser.execdir or "/bin"}" \
             --set MOZ_APP_LAUNCHER "${browserName}${nameSuffix}" \
diff --git a/pkgs/applications/networking/cluster/istioctl/default.nix b/pkgs/applications/networking/cluster/istioctl/default.nix
index ffe79381a22..5d293df9157 100644
--- a/pkgs/applications/networking/cluster/istioctl/default.nix
+++ b/pkgs/applications/networking/cluster/istioctl/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "istioctl";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "istio";
     repo = "istio";
     rev = version;
-    sha256 = "0fwc56797gmcg9pcy0jpv5lb0b6wwiqh242xn1chd4a4hp8in7h9";
+    sha256 = "1m97hszmw0hfzj3jvd1is7fa3mpqkm7jbq3ik337rb9yq1f0gasv";
   };
-  vendorSha256 = "0ing5pih2rz974dcianlb05fpgrj3y7h32awf3cp41gh448gxd24";
+  vendorSha256 = "0ividxxmil69vpvyjlgyzb2jzipmh9rpvk19kv7266d29ky3q7s6";
 
   doCheck = false;
 
diff --git a/pkgs/applications/networking/cluster/kubernetes/default.nix b/pkgs/applications/networking/cluster/kubernetes/default.nix
index cdda1487a49..d4ec9cf5ef3 100644
--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "kubernetes";
-  version = "1.19.4";
+  version = "1.19.5";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "kubernetes";
     rev = "v${version}";
-    sha256 = "05gisihrklkzsdsrrmvmqlfwfdx73jbwd5668n5wa5hp432qyvwi";
+    sha256 = "15bv620fj4x731f2z2a9dcdss18rk379kc40g49bpqsdn42jjx2z";
   };
 
   nativeBuildInputs = [ removeReferencesTo makeWrapper which go rsync installShellFiles ];
diff --git a/pkgs/applications/networking/cluster/lens/default.nix b/pkgs/applications/networking/cluster/lens/default.nix
new file mode 100644
index 00000000000..656badfe5a0
--- /dev/null
+++ b/pkgs/applications/networking/cluster/lens/default.nix
@@ -0,0 +1,41 @@
+{ lib, fetchurl, appimageTools }:
+
+let
+  pname = "lens";
+  version = "3.6.7";
+  name = "${pname}-${version}";
+
+  src = fetchurl {
+    url = "https://github.com/lensapp/lens/releases/download/v${version}/Lens-${version}.AppImage";
+    sha256 = "0var7d31ab6lq2vq6brk2dnhlnhqjp2gdqhygif567cdmcpn4vz8";
+    name="${pname}.AppImage";
+  };
+
+  appimageContents = appimageTools.extractType2 {
+    inherit name src;
+  };
+
+in appimageTools.wrapType2 {
+  inherit name src;
+
+  extraInstallCommands =
+    ''
+      mv $out/bin/${name} $out/bin/${pname}
+
+      install -m 444 -D ${appimageContents}/kontena-lens.desktop $out/share/applications/${pname}.desktop
+      install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/512x512/apps/kontena-lens.png \
+        $out/share/icons/hicolor/512x512/apps/${pname}.png
+
+      substituteInPlace $out/share/applications/${pname}.desktop \
+        --replace 'Icon=kontena-lens' 'Icon=${pname}' \
+        --replace 'Exec=AppRun' 'Exec=${pname}'
+    '';
+
+  meta = with lib; {
+    description = "The Kubernetes IDE";
+    homepage = "https://k8slens.dev/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dbirks ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/applications/networking/cluster/node-problem-detector/default.nix b/pkgs/applications/networking/cluster/node-problem-detector/default.nix
index 2f43a9ba4e5..61f0feced95 100644
--- a/pkgs/applications/networking/cluster/node-problem-detector/default.nix
+++ b/pkgs/applications/networking/cluster/node-problem-detector/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "node-problem-detector";
-  version = "0.8.4";
+  version = "0.8.5";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0iv3x29l803mch7pmnvxk1lf0mgirdhi2g17q1049d8z7w0m8dwk";
+    sha256 = "0lm691w4v2sdv5i2dkszwv6g11ig2aavlbxh40kjlmc05dz7dapv";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/applications/networking/cluster/octant/default.nix b/pkgs/applications/networking/cluster/octant/default.nix
index 9e37bb6afe2..4ccc05189c9 100644
--- a/pkgs/applications/networking/cluster/octant/default.nix
+++ b/pkgs/applications/networking/cluster/octant/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl }:
 let
-  version = "0.16.0";
+  version = "0.16.3";
 
   system = stdenv.hostPlatform.system;
   suffix = {
@@ -20,9 +20,9 @@ stdenv.mkDerivation rec {
   inherit version;
 
   src = fetchsrc {
-    x86_64-linux = "1i6i42hwxaczkfv8ldxn3wp6bslgwfkycvh88khfmapw2f5f9mhr";
-    aarch64-linux = "1ka5vscyqxckxnhnymp06yi0r2ljw42q0g62yq7qv4safljd452p";
-    x86_64-darwin = "1c50c2r2hq2fi8jcijq6vn336w96ar7b6qccv5w2240i0szsxxql";
+    x86_64-linux = "1c6v7d8i494k32b0zrjn4fn1idza95r6h99c33c5za4hi7gqvy0x";
+    aarch64-linux = "153jd4wsq8qc598w7y4d30dy20ljyhrl68cc3pig1p712l5258zs";
+    x86_64-darwin = "0y2qjdlyvhrzwg0fmxsr3jl39kd13276a7wg0ndhdjfwxvdwpxkz";
   };
 
   doBuild = false;
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index bb2a7ab582b..c015afb787d 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -70,10 +70,10 @@
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/aws",
     "repo": "terraform-provider-aws",
-    "rev": "v3.15.0",
-    "sha256": "0rxpdxg5p478sipbhq2x347gs5wrlwz4ggy9z007cbp34yhb2wka",
-    "vendorSha256": "0vapfnd4c8jb15pdjnnb97vgsvfakjvl1czccbfy0znhdk2ynz02",
-    "version": "3.15.0"
+    "rev": "v3.20.0",
+    "sha256": "18zccjkdxzcprhpv3cn3b9fbp0h81pkj0dsygfz2islclljc3x17",
+    "vendorSha256": "0lalcp3wwjbwhp1rwidpndjmilfsc7cb79diicn02a207y277gji",
+    "version": "3.20.0"
   },
   "azuread": {
     "owner": "terraform-providers",
@@ -748,11 +748,13 @@
     "version": "1.2.1"
   },
   "postgresql": {
-    "owner": "terraform-providers",
+    "owner": "cyrilgdn",
+    "provider-source-address": "registry.terraform.io/cyrilgdn/postgresql",
     "repo": "terraform-provider-postgresql",
-    "rev": "v1.7.1",
-    "sha256": "0qlz00svvbwxslp8v7bi7mx5mvnjmh2cvg33a006gh4fy5n75shy",
-    "version": "1.7.1"
+    "rev": "v1.8.1",
+    "sha256": "07qaiy3vmz179am1qrxwvrk7xpraaa8g0hf49bj54pw7nkrmaixq",
+    "vendorSha256": null,
+    "version": "1.8.1"
   },
   "powerdns": {
     "owner": "terraform-providers",
diff --git a/pkgs/applications/networking/flexget/default.nix b/pkgs/applications/networking/flexget/default.nix
index d6a253efdaa..8ef1a690441 100644
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@@ -2,11 +2,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "FlexGet";
-  version = "3.1.71";
+  version = "3.1.91";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "4c25d8733c8eb54c7d3ce60a17d8020049fb137b796e5ada9d15f41cdd0e1655";
+    sha256 = "5d6668dd9721b60738ea44c616fcdee6210f7ef52b461eb13b77091caef4a832";
   };
 
   postPatch = ''
@@ -26,6 +26,7 @@ python3Packages.buildPythonApplication rec {
     APScheduler
     beautifulsoup4
     cherrypy
+    colorama
     colorclass
     feedparser
     flask-compress
@@ -49,6 +50,7 @@ python3Packages.buildPythonApplication rec {
     rebulk
     requests
     rpyc
+    sgmllib3k
     sqlalchemy
     terminaltables
     zxcvbn
diff --git a/pkgs/applications/networking/instant-messengers/nheko/default.nix b/pkgs/applications/networking/instant-messengers/nheko/default.nix
index 2f5316c9fe2..80ffbebe9be 100644
--- a/pkgs/applications/networking/instant-messengers/nheko/default.nix
+++ b/pkgs/applications/networking/instant-messengers/nheko/default.nix
@@ -17,6 +17,7 @@
 , mtxclient
 , boost17x
 , spdlog
+, fmt
 , olm
 , pkgconfig
 , nlohmann_json
@@ -47,6 +48,7 @@ mkDerivation rec {
     boost17x
     lmdb
     spdlog
+    fmt
     cmark
     qtbase
     qtmultimedia
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index 84f09022862..05d94b2ef71 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -25,7 +25,7 @@ let
       else "");
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "1.38.2"; # Please backport all updates to the stable channel.
+  version = "1.39.2"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -35,7 +35,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "1lq830760y4kmhqd29hhgnab6lryiipb01y0c5bbl886zk3z35n4";
+    sha256 = "15lv8jpnn2cx7hmb7pn32cvq6nqvzjflf77bbnvxva5hf9zjkma9";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/irc/konversation/default.nix b/pkgs/applications/networking/irc/konversation/default.nix
index 2890deccb80..3c80ef09aaf 100644
--- a/pkgs/applications/networking/irc/konversation/default.nix
+++ b/pkgs/applications/networking/irc/konversation/default.nix
@@ -28,25 +28,15 @@
 , phonon
 }:
 
-let
+mkDerivation rec {
   pname = "konversation";
-  version = "1.7.5";
-in mkDerivation rec {
-  name = "${pname}-${version}";
+  version = "1.7.7";
 
   src = fetchurl {
-    url = "mirror://kde/stable/${pname}/${version}/src/${name}.tar.xz";
-    sha256 = "0h098yhlp36ls6pdvs2r93ig8dv4fys62m0h6wxccprb0qrpbgv0";
+    url = "mirror://kde/stable/${pname}/${version}/src/${pname}-${version}.tar.xz";
+    sha256 = "R+wWHBOFmBqLmdKMQZ6Iskgj3AG2j7FiOJSBiXTCGKc=";
   };
 
-  patches = [
-    # Delete this patch for konversation > 1.7.5
-    (fetchpatch {
-      url = "https://cgit.kde.org/konversation.git/patch/?id=4d0036617becc26a76fd021138c98aceec4c7b53";
-      sha256 = "17hdj6zyln3n93b71by26mrwbgyh4k052ck5iw1drysx5dyd5l6y";
-    })
-  ];
-
   buildInputs = [
     kbookmarks
     karchive
diff --git a/pkgs/applications/networking/irc/weechat/scripts/colorize_nicks/default.nix b/pkgs/applications/networking/irc/weechat/scripts/colorize_nicks/default.nix
new file mode 100644
index 00000000000..0b6d355797f
--- /dev/null
+++ b/pkgs/applications/networking/irc/weechat/scripts/colorize_nicks/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, lib, fetchurl, weechat }:
+
+stdenv.mkDerivation {
+  pname = "weechat-colorize_nicks";
+  version = "27";
+
+  src = fetchurl {
+    url = "https://github.com/weechat/scripts/raw/bc8a9051800779a036ba11689a277cd5f03657b2/python/colorize_nicks.py";
+    sha256 = "0hiay88vvy171jiq6ahflm0ipb7sslfxwhmmm8psv6qk19rv2sxs";
+  };
+
+  dontUnpack = true;
+
+  installPhase = ''
+    mkdir -p $out/share
+    cp $src $out/share/colorize_nicks.py
+  '';
+
+  passthru = {
+    scripts = [ "colorize_nicks.py" ];
+  };
+
+  meta = with lib; {
+    inherit (weechat.meta) platforms;
+    description = "Use the weechat nick colors in the chat area";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ qyliss ];
+  };
+}
diff --git a/pkgs/applications/networking/irc/weechat/scripts/default.nix b/pkgs/applications/networking/irc/weechat/scripts/default.nix
index 6d228688607..07e75903546 100644
--- a/pkgs/applications/networking/irc/weechat/scripts/default.nix
+++ b/pkgs/applications/networking/irc/weechat/scripts/default.nix
@@ -1,6 +1,8 @@
 { callPackage, luaPackages, python3Packages }:
 
 {
+  colorize_nicks = callPackage ./colorize_nicks { };
+
   weechat-matrix-bridge = callPackage ./weechat-matrix-bridge {
     inherit (luaPackages) cjson luaffi;
   };
diff --git a/pkgs/applications/networking/maestral-qt/default.nix b/pkgs/applications/networking/maestral-qt/default.nix
index d4cfd38c50d..41341532637 100644
--- a/pkgs/applications/networking/maestral-qt/default.nix
+++ b/pkgs/applications/networking/maestral-qt/default.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "maestral-qt";
-  version = "1.2.1";
+  version = "1.3.1";
   disabled = python3.pkgs.pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "SamSchott";
     repo = "maestral-qt";
     rev = "v${version}";
-    sha256 = "sha256-7qpVyQUbT+GChJl1TnKOONSyRDvzQ0M2z9RdN7PNl9U=";
+    sha256 = "sha256-2S2sa2/HVt3IRsE98PT2XwpONjaYENBzYW+ezBFrJYI=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
@@ -24,6 +24,8 @@ python3.pkgs.buildPythonApplication rec {
     maestral
     packaging
     pyqt5
+  ] ++ stdenv.lib.optionals (pythonOlder "3.9") [
+    importlib-resources
   ];
 
   nativeBuildInputs = [ wrapQtAppsHook ];
diff --git a/pkgs/applications/networking/mailreaders/claws-mail/gtk3.nix b/pkgs/applications/networking/mailreaders/claws-mail/gtk3.nix
index 1e1909e7109..2d93ff85b89 100644
--- a/pkgs/applications/networking/mailreaders/claws-mail/gtk3.nix
+++ b/pkgs/applications/networking/mailreaders/claws-mail/gtk3.nix
@@ -31,12 +31,12 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "claws-mail-gtk3";
-  version = "3.17.5";
+  version = "3.99.0";
 
   src = fetchgit {
     url = "git://git.claws-mail.org/claws.git";
-    rev = "c1e1902323c2b5dfe82144328b7933dc857ef343"; # this commit is "for release 3.17.5"
-    sha256 = "0cqzlzcms6alvsdsbcc06bsdi1h349b16qngn2z1p8fz16x6s6cy";
+    rev = version;
+    sha256 = "176h1swh1zx6dqyzfz470x4a1xicnv0zhy8ir47k7p23g6y17i2k";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/applications/networking/mailreaders/inboxer/default.nix b/pkgs/applications/networking/mailreaders/inboxer/default.nix
deleted file mode 100644
index 30ca6d6c7ec..00000000000
--- a/pkgs/applications/networking/mailreaders/inboxer/default.nix
+++ /dev/null
@@ -1,87 +0,0 @@
-{ stdenv, fetchurl, binutils, patchelf, makeWrapper
-, expat, xorg, gdk-pixbuf, glib, gnome2, cairo, atk, freetype, pango
-, fontconfig, dbus, nss, nspr, gtk2-x11, alsaLib, cups, libpulseaudio, udev }:
-
-stdenv.mkDerivation rec {
-  pname = "inboxer";
-  version = "1.2.3";
-
-  meta = with stdenv.lib; {
-    description = "Unofficial, free and open-source Google Inbox Desktop App";
-    homepage    = "https://denysdovhan.com/inboxer";
-    maintainers = [ maintainers.mgttlinger ];
-    license     = licenses.mit;
-    platforms   = [ "x86_64-linux" ];
-  };
-
-  src = fetchurl {
-    url = "https://github.com/denysdovhan/inboxer/releases/download/v${version}/inboxer_${version}_amd64.deb";
-    sha256 = "1ak8sr9sc0fkbrmfynxivbn9csrbyly4fhjlk7kx10aq8hk893a7";
-  };
-
-  unpackPhase = ''
-    ar p $src data.tar.xz | tar xJ
-  '';
-  nativeBuildInputs = [ patchelf makeWrapper ];
-  buildInputs = [ binutils ];
-
-  preFixup = with stdenv.lib; let
-    lpath = makeLibraryPath [
-      alsaLib
-      atk
-      cairo
-      cups
-      dbus
-      nss
-      nspr
-      freetype
-      fontconfig
-      gtk2-x11
-      xorg.libX11
-      xorg.libXcursor
-      xorg.libXdamage
-      xorg.libXi
-      xorg.libXext
-      xorg.libXfixes
-      xorg.libXrandr
-      xorg.libXrender
-      xorg.libXcomposite
-      xorg.libXtst
-      xorg.libXScrnSaver
-      xorg.libxcb
-      gdk-pixbuf
-      glib
-      pango
-      gnome2.GConf
-      expat
-      stdenv.cc.cc.lib
-      libpulseaudio
-      udev
-    ];
-  in ''
-    patchelf \
-      --set-rpath "$out/opt/Inboxer:${lpath}" \
-      $out/opt/Inboxer/libnode.so
-    patchelf \
-      --set-rpath "$out/opt/Inboxer:${lpath}" \
-      $out/opt/Inboxer/libffmpeg.so
-
-    patchelf \
-      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      --set-rpath "$out/opt/Inboxer:${lpath}" \
-      $out/opt/Inboxer/inboxer
-
-    wrapProgram $out/opt/Inboxer/inboxer --set LD_LIBRARY_PATH "${xorg.libxkbfile}/lib:${lpath}"
-  '';
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp -R usr/share opt $out/
-    # fix the path in the desktop file
-    substituteInPlace \
-      $out/share/applications/inboxer.desktop \
-      --replace /opt/ $out/opt/
-    # symlink the binary to bin/
-    ln -s $out/opt/Inboxer/inboxer $out/bin/inboxer
-  '';
-}
diff --git a/pkgs/applications/networking/p2p/deluge/1/default.nix b/pkgs/applications/networking/p2p/deluge/1/default.nix
index cafba65c788..7ab33792415 100644
--- a/pkgs/applications/networking/p2p/deluge/1/default.nix
+++ b/pkgs/applications/networking/p2p/deluge/1/default.nix
@@ -36,6 +36,7 @@ pythonPackages.buildPythonPackage rec {
     description = "Torrent client";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ domenkozar ebzzry ];
+    broken = stdenv.isDarwin;
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/applications/networking/p2p/stig/default.nix b/pkgs/applications/networking/p2p/stig/default.nix
index 276cabfa2aa..d06a4d4d418 100644
--- a/pkgs/applications/networking/p2p/stig/default.nix
+++ b/pkgs/applications/networking/p2p/stig/default.nix
@@ -1,4 +1,4 @@
-{ lib
+{ stdenv
 , fetchFromGitHub
 , python3Packages
 }:
@@ -54,9 +54,12 @@ python3Packages.buildPythonApplication rec {
     "--deselect=tests/client_test/ttypes_test.py::TestTimestamp::test_string__month_day_hour_minute_second"
     # TestScrollBarWithScrollable.test_wrapping_bug fails
     "--deselect=tests/tui_test/scroll_test.py::TestScrollBarWithScrollable::test_wrapping_bug"
+  ] ++ stdenv.lib.optionals stdenv.isDarwin [
+    "--deselect=tests/client_test/aiotransmission_test/api_torrent_test.py"
+    "--deselect=tests/client_test/aiotransmission_test/rpc_test.py"
   ];
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "TUI and CLI for the BitTorrent client Transmission";
     homepage = "https://github.com/rndusr/stig";
     license = licenses.gpl3;
diff --git a/pkgs/applications/networking/remote/citrix-workspace/sources.nix b/pkgs/applications/networking/remote/citrix-workspace/sources.nix
index bbeed5b779c..eb59f90e6dd 100644
--- a/pkgs/applications/networking/remote/citrix-workspace/sources.nix
+++ b/pkgs/applications/networking/remote/citrix-workspace/sources.nix
@@ -54,6 +54,17 @@ let
       x86hash   = "04cr2da25v8x098ccyjwa47d4krk3jpldqkyf4kk2j3hwzbqh9yx";
       x64suffix = "6";
       x86suffix = "6";
+      homepage  = "https://www.citrix.com/de-de/downloads/workspace-app/legacy-workspace-app-for-linux/workspace-app-for-linux-2010.html";
+    };
+
+    "20.12.0" = {
+      major     = "20";
+      minor     = "12";
+      patch     = "0";
+      x64hash   = "1268nriqjp27nxqqi4dvkv8r01yj3bhglxv21xd185761da2mzry";
+      x86hash   = "0f982d5y9k4hscqfmqpfs277cqw1pvp191ybvg5p8rxk12fh67vf";
+      x64suffix = "12";
+      x86suffix = "12";
       homepage  = "https://www.citrix.com/de-de/downloads/workspace-app/linux/workspace-app-for-linux-latest.html";
     };
   };
diff --git a/pkgs/applications/office/beamerpresenter/default.nix b/pkgs/applications/office/beamerpresenter/default.nix
index cd15d3723d1..d18a757f6bb 100644
--- a/pkgs/applications/office/beamerpresenter/default.nix
+++ b/pkgs/applications/office/beamerpresenter/default.nix
@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "beamerpresenter";
-  version = "0.1.2";
+  version = "0.1.3";
 
   src = fetchFromGitHub {
     owner = "stiglers-eponym";
     repo = "BeamerPresenter";
     rev = "v${version}";
-    sha256 = "12xngnhwa3haf0pdxczgvhq1j20zbsr30y2bfn9qwmlhbwklhkj2";
+    sha256 = "1nbcqrfdjcsc6czqk1v163whka4x1w883b1298aws8yi7vac4f1i";
   };
 
   nativeBuildInputs = [ qmake installShellFiles ];
diff --git a/pkgs/applications/office/elementary-planner/default.nix b/pkgs/applications/office/elementary-planner/default.nix
index 671613ddd32..acade32d744 100644
--- a/pkgs/applications/office/elementary-planner/default.nix
+++ b/pkgs/applications/office/elementary-planner/default.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-planner";
-  version = "2.5.4";
+  version = "2.5.7";
 
   src = fetchFromGitHub {
     owner = "alainm23";
     repo = "planner";
     rev = version;
-    sha256 = "0q5zmjh0d1mapgqb2a38spss280jkkc2n835kc7grzvs9jgq1k1k";
+    sha256 = "0s2f9q7i31c2splflfnaiqviwnxbsp2zvibr70xafhbhnkmzlrsk";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/radio/gqrx/default.nix b/pkgs/applications/radio/gqrx/default.nix
index d4d90a6c63c..e06d04ca53f 100644
--- a/pkgs/applications/radio/gqrx/default.nix
+++ b/pkgs/applications/radio/gqrx/default.nix
@@ -9,13 +9,13 @@ assert pulseaudioSupport -> libpulseaudio != null;
 
 mkDerivation rec {
   pname = "gqrx";
-  version = "2.14.2";
+  version = "2.14.3";
 
   src = fetchFromGitHub {
     owner = "csete";
     repo = "gqrx";
     rev = "v${version}";
-    sha256 = "15xlzfgmffq43wn74xjqc5p2m21i3lh28qqskd2jf2hhvanpcwcp";
+    sha256 = "10pmd2jqmw77gybjfzrch6qi8jil1g6nsjzabbd6gnbsq7320axj";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/science/astronomy/siril/default.nix b/pkgs/applications/science/astronomy/siril/default.nix
new file mode 100644
index 00000000000..7ae3e011973
--- /dev/null
+++ b/pkgs/applications/science/astronomy/siril/default.nix
@@ -0,0 +1,45 @@
+{ stdenv, fetchFromGitLab, fetchFromGitHub, pkg-config, meson, ninja,
+  git, criterion, wrapGAppsHook, gtk3, libconfig, gnuplot, opencv,
+  fftwFloat, cfitsio, gsl, exiv2, curl, librtprocess, ffmpeg,
+  libraw, libtiff, libpng, libjpeg, libheif, ffms
+}:
+
+stdenv.mkDerivation rec {
+  pname = "siril";
+  version = "0.99.6";
+
+  src = fetchFromGitLab {
+    owner = "free-astro";
+    repo = pname;
+    rev = version;
+    sha256 = "06vh8x45gv0gwlnqjwxglf12jmpdaxkiv5sixkqh20420wabx3ha";
+  };
+
+  nativeBuildInputs = [
+    meson ninja pkg-config git criterion wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gtk3 cfitsio gsl exiv2 gnuplot curl opencv fftwFloat librtprocess
+    libconfig libraw libtiff libpng libjpeg libheif ffms ffmpeg
+  ];
+
+  # Necessary because project uses default build dir for flatpaks/snaps
+  dontUseMesonConfigure = true;
+
+  configureScript = ''
+    ${meson}/bin/meson --buildtype release nixbld .
+  '';
+
+  postConfigure = ''
+    cd nixbld
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://www.siril.org/";
+    description = "Astronomical image processing tool";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ hjones2199 ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix b/pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix
index 06053a8f356..896a2a01084 100644
--- a/pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix
+++ b/pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix
@@ -1,28 +1,28 @@
 { stdenv, fetchFromGitHub, cmake, ninja, pkgconfig, python3Packages
 , boost, rapidjson, qtbase, qtsvg, igraph, spdlog, wrapQtAppsHook
-, llvmPackages ? null
+, fmt, graphviz, llvmPackages ? null
 }:
 
 stdenv.mkDerivation rec {
-  version = "2.0.0";
+  version = "3.1.9";
   pname = "hal-hardware-analyzer";
 
   src = fetchFromGitHub {
     owner = "emsec";
     repo = "hal";
     rev = "v${version}";
-    sha256 = "11xmqxnryksl645wmm1d69k1b5zwvxxf0admk4iblzaa3ggf7cv1";
+    sha256 = "0yvvlx0hq73x20va4csa8kyx3x4z648s6l6qqirzjpmxa1w91xc6";
   };
   # make sure bundled dependencies don't get in the way - install also otherwise
   # copies them in full to the output, bloating the package
   postPatch = ''
-    rm -rf deps/*/*
-    substituteInPlace cmake/detect_dependencies.cmake \
-      --replace 'spdlog 1.4.2 EXACT' 'spdlog 1.4.2 REQUIRED'
+    shopt -s extglob
+    rm -rf deps/!(sanitizers-cmake)/*
+    shopt -u extglob
   '';
 
   nativeBuildInputs = [ cmake ninja pkgconfig ];
-  buildInputs = [ qtbase qtsvg boost rapidjson igraph spdlog wrapQtAppsHook ]
+  buildInputs = [ qtbase qtsvg boost rapidjson igraph spdlog fmt graphviz wrapQtAppsHook ]
     ++ (with python3Packages; [ python pybind11 ])
     ++ stdenv.lib.optional stdenv.cc.isClang llvmPackages.openmp;
 
@@ -42,11 +42,11 @@ stdenv.mkDerivation rec {
   # the qt mkDerivation - the latter forcibly overrides this.
   cmakeBuildType = "MinSizeRel";
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "A comprehensive reverse engineering and manipulation framework for gate-level netlists";
     homepage = "https://github.com/emsec/hal";
-    license = stdenv.lib.licenses.mit;
-    platforms = with stdenv.lib.platforms; unix;
-    maintainers = with stdenv.lib.maintainers; [ ris ];
+    license = licenses.mit;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ ris shamilton ];
   };
 }
diff --git a/pkgs/applications/science/logic/cedille/Fix-to-string.agda-to-compile-with-Agda-2.6.1.patch b/pkgs/applications/science/logic/cedille/Fix-to-string.agda-to-compile-with-Agda-2.6.1.patch
new file mode 100644
index 00000000000..51f1478987e
--- /dev/null
+++ b/pkgs/applications/science/logic/cedille/Fix-to-string.agda-to-compile-with-Agda-2.6.1.patch
@@ -0,0 +1,31 @@
+From 563f023aba1034f4f433f412302b825b059ef5a5 Mon Sep 17 00:00:00 2001
+From: Mark Barbone <mark.l.barbone@gmail.com>
+Date: Sun, 19 Jul 2020 17:24:30 -0400
+Subject: [PATCH] Fix to-string.agda to compile with Agda 2.6.1
+
+---
+Adapted from https://github.com/cedille/cedille/pull/156.
+
+ src/to-string.agda | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/to-string.agda b/src/to-string.agda
+index 2505942..051a2da 100644
+--- a/src/to-string.agda
++++ b/src/to-string.agda
+@@ -100,9 +100,9 @@ no-parens {TK} _ _ _ = tt
+ no-parens {QUALIF} _ _ _ = tt
+ no-parens {ARG} _ _ _ = tt
+ 
+-pattern ced-ops-drop-spine = cedille-options.options.mk-options _ _ _ _ ff _ _ _ ff _
+-pattern ced-ops-conv-arr = cedille-options.options.mk-options _ _ _ _ _ _ _ _ ff _
+-pattern ced-ops-conv-abs = cedille-options.options.mk-options _ _ _ _ _ _ _ _ tt _
++pattern ced-ops-drop-spine = cedille-options.mk-options _ _ _ _ ff _ _ _ ff _
++pattern ced-ops-conv-arr = cedille-options.mk-options _ _ _ _ _ _ _ _ ff _
++pattern ced-ops-conv-abs = cedille-options.mk-options _ _ _ _ _ _ _ _ tt _
+ 
+ drop-spine : cedille-options.options → {ed : exprd} → ctxt → ⟦ ed ⟧ → ⟦ ed ⟧
+ drop-spine ops @ ced-ops-drop-spine = h
+-- 
+2.27.0
+
diff --git a/pkgs/applications/science/logic/cedille/default.nix b/pkgs/applications/science/logic/cedille/default.nix
index 2ac96df66a6..7b181790f14 100644
--- a/pkgs/applications/science/logic/cedille/default.nix
+++ b/pkgs/applications/science/logic/cedille/default.nix
@@ -10,17 +10,21 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.1.1";
+  version = "1.1.2";
   pname = "cedille";
 
   src = fetchFromGitHub {
     owner = "cedille";
     repo = "cedille";
     rev = "v${version}";
-    sha256 = "16pc72wz6kclq9yv2r8hx85mkp0s125h12snrhcjxkbl41xx2ynb";
+    sha256 = "1j745q9sd32fhcb96wjq6xvyqq1k6imppjnya6x0n99fyfnqzvg9";
     fetchSubmodules = true;
   };
 
+  patches = [
+    ./Fix-to-string.agda-to-compile-with-Agda-2.6.1.patch
+  ];
+
   nativeBuildInputs = [ alex happy ];
   buildInputs = [ Agda (ghcWithPackages (ps: [ps.ieee])) ];
 
diff --git a/pkgs/applications/video/bomi/default.nix b/pkgs/applications/video/bomi/default.nix
deleted file mode 100644
index d812ac48874..00000000000
--- a/pkgs/applications/video/bomi/default.nix
+++ /dev/null
@@ -1,118 +0,0 @@
-{ mkDerivation, config, stdenv, fetchFromGitHub
-, fetchpatch, pkgconfig, perl, python, which
-, libX11, libxcb, libGLU, libGL
-, qtbase, qtdeclarative, qtquickcontrols, qttools, qtx11extras, qmake
-, libchardet
-, ffmpeg
-
-, mpg123
-, libass
-, libdvdread
-, libdvdnav
-, icu
-, libquvi
-, alsaLib
-, libvdpau, libva
-, libbluray
-, jackSupport ? false, jack ? null
-, portaudioSupport ? false, portaudio ? null
-, pulseSupport ? config.pulseaudio or stdenv.isLinux, libpulseaudio ? null
-, cddaSupport ? false, libcdda ? null
-, youtubeSupport ? true, youtube-dl ? null
-}:
-
-with stdenv.lib;
-
-assert jackSupport -> jack != null;
-assert portaudioSupport -> portaudio != null;
-assert pulseSupport -> libpulseaudio != null;
-assert cddaSupport -> libcdda != null;
-assert youtubeSupport -> youtube-dl != null;
-
-mkDerivation rec {
-  pname = "bomi";
-  version = "0.9.11";
-
-  src = fetchFromGitHub {
-    owner = "xylosper";
-    repo = "bomi";
-    rev = "v${version}";
-    sha256 = "0a7n46gn3n5098lxxvl3s29s8jlkzss6by9074jx94ncn9cayf2h";
-  };
-
-  patches = [
-    (fetchpatch rec {
-      name = "bomi-compilation-fix.patch";
-      url = "https://svnweb.mageia.org/packages/cauldron/bomi/current/SOURCES/${name}?revision=995725&view=co&pathrev=995725";
-      sha256 = "1dwryya5ljx35dbx6ag9d3rjjazni2mfn3vwirjdijdy6yz22jm6";
-    })
-    (fetchpatch rec {
-      name = "bomi-fix-expected-unqualified-id-before-numeric-constant-unix.patch";
-      url = "https://svnweb.mageia.org/packages/cauldron/bomi/current/SOURCES/${name}?revision=995725&view=co&pathrev=995725";
-      sha256 = "0n3xsrdrggimzw30gxlnrr088ndbdjqlqr46dzmfv8zan79lv5ri";
-    })
-  ];
-
-  buildInputs = with stdenv.lib;
-                [ libX11
-                  libxcb
-                  libGLU libGL
-                  qtbase
-                  qtx11extras
-                  qtdeclarative
-                  qtquickcontrols
-                  ffmpeg
-                  libchardet
-
-                  mpg123
-                  libass
-                  libdvdread
-                  libdvdnav
-                  icu
-                  libquvi
-                  alsaLib
-                  libvdpau
-                  libva
-                  libbluray
-                ]
-                ++ optional jackSupport jack
-                ++ optional portaudioSupport portaudio
-                ++ optional pulseSupport libpulseaudio
-                ++ optional cddaSupport libcdda
-                ;
-
-  preConfigure = ''
-    patchShebangs configure
-  '';
-
-  preBuild = ''
-    patchShebangs src/mpv/waf
-    patchShebangs build-mpv
-  '';
-
-  dontWrapQtApps = true;
-  postInstall = ''
-    wrapQtApp $out/bin/bomi \
-      ${optionalString youtubeSupport "--prefix PATH ':' '${youtube-dl}/bin'"}
-  '';
-
-  dontUseQmakeConfigure = true;
-
-  configureFlags = with stdenv.lib;
-                   [ "--qmake=qmake" ]
-                   ++ optional jackSupport "--enable-jack"
-                   ++ optional portaudioSupport "--enable-portaudio"
-                   ++ optional pulseSupport "--enable-pulseaudio"
-                   ++ optional cddaSupport "--enable-cdda"
-                   ;
-
-  nativeBuildInputs = [ pkgconfig perl python which qttools qmake ];
-
-  meta = with stdenv.lib; {
-    description = "Powerful and easy-to-use multimedia player";
-    homepage = "https://bomi-player.github.io/";
-    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.abbradar ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/applications/video/go-chromecast/default.nix b/pkgs/applications/video/go-chromecast/default.nix
index 89c2eb425ce..8dd10fff89a 100644
--- a/pkgs/applications/video/go-chromecast/default.nix
+++ b/pkgs/applications/video/go-chromecast/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "go-chromecast";
-  version = "0.2.5";
+  version = "0.2.6";
 
   src = fetchFromGitHub {
     owner = "vishen";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0y1zwy1bxnjz409vdhqwykvfjhrsyy4j503v3rjrrhkcca6vfbyg";
+    sha256 = "0frvj1van1qn7hi96m0l7pzm4jf0v49xl4r4fi2lh1yqzgsgzy9f";
   };
 
-  vendorSha256 = "04mgm3afgczq0an6ys8bilxv1hgzfwvgjx21fyl82yxd573rsf5r";
+  vendorSha256 = "0vgbmgk07kqmhhmcssy1ibr2hzk07hf32kkdyj2b9jqj9sb49p49";
 
   buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version} -X main.commit=${src.rev} -X main.date=unknown" ];
 
diff --git a/pkgs/applications/video/kodi/wrapper.nix b/pkgs/applications/video/kodi/wrapper.nix
index 6a0b1cbdf73..d0a7ed5e23c 100644
--- a/pkgs/applications/video/kodi/wrapper.nix
+++ b/pkgs/applications/video/kodi/wrapper.nix
@@ -19,7 +19,7 @@ in buildEnv {
         --prefix KODI_HOME : $out/share/kodi \
         --prefix LD_LIBRARY_PATH ":" "${lib.makeLibraryPath
           (stdenv.lib.concatMap
-            (plugin: plugin.extraRuntimeDependencies) plugins)}"
+            (plugin: plugin.extraRuntimeDependencies or []) plugins)}"
     done
   '';
 
diff --git a/pkgs/applications/video/mpv/default.nix b/pkgs/applications/video/mpv/default.nix
index d7dc865c169..2b9605aa3c2 100644
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@@ -196,6 +196,8 @@ in stdenv.mkDerivation rec {
 
     cp TOOLS/mpv_identify.sh $out/bin
     cp TOOLS/umpv $out/bin
+    cp $out/share/applications/mpv.desktop $out/share/applications/umpv.desktop
+    sed -i '/Icon=/ ! s/mpv/umpv/g' $out/share/applications/umpv.desktop
   '' + optionalString stdenv.isDarwin ''
     mkdir -p $out/Applications
     cp -r build/mpv.app $out/Applications
diff --git a/pkgs/applications/video/vlc/default.nix b/pkgs/applications/video/vlc/default.nix
index 58df85332ea..1c52a89e98d 100644
--- a/pkgs/applications/video/vlc/default.nix
+++ b/pkgs/applications/video/vlc/default.nix
@@ -32,6 +32,12 @@ stdenv.mkDerivation rec {
     sha256 = "1f46h0hv7fk35zg4iczlp7ib7h2jmh8m4r5klw3g2558ib9134qq";
   };
 
+  patches = [
+    # Couldn't find an upstream version of this patch
+    # https://build.opensuse.org/package/view_file/openSUSE:Factory/vlc/fix-missing-includes-with-qt-5.15.patch?expand=1
+    ./fix-missing-includes-with-qt-5.15.patch
+  ];
+
   # VLC uses a *ton* of libraries for various pieces of functionality, many of
   # which are not included here for no other reason that nobody has mentioned
   # needing them
@@ -99,6 +105,5 @@ stdenv.mkDerivation rec {
     homepage = "http://www.videolan.org/vlc/";
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
-    broken = if qtbase != null then versionAtLeast qtbase.version "5.15" else false;
   };
 }
diff --git a/pkgs/applications/video/vlc/fix-missing-includes-with-qt-5.15.patch b/pkgs/applications/video/vlc/fix-missing-includes-with-qt-5.15.patch
new file mode 100644
index 00000000000..d980fd2f6da
--- /dev/null
+++ b/pkgs/applications/video/vlc/fix-missing-includes-with-qt-5.15.patch
@@ -0,0 +1,37 @@
+Index: vlc-3.0.8/modules/gui/qt/util/timetooltip.hpp
+===================================================================
+--- vlc-3.0.8.orig/modules/gui/qt/util/timetooltip.hpp
++++ vlc-3.0.8/modules/gui/qt/util/timetooltip.hpp
+@@ -25,6 +25,7 @@
+ #include "qt.hpp"
+ 
+ #include <QWidget>
++#include <QPainterPath>
+ 
+ class TimeTooltip : public QWidget
+ {
+Index: vlc-3.0.8/modules/gui/qt/components/playlist/views.cpp
+===================================================================
+--- vlc-3.0.8.orig/modules/gui/qt/components/playlist/views.cpp
++++ vlc-3.0.8/modules/gui/qt/components/playlist/views.cpp
+@@ -27,6 +27,7 @@
+ #include "input_manager.hpp"                      /* THEMIM */
+ 
+ #include <QPainter>
++#include <QPainterPath>
+ #include <QRect>
+ #include <QStyleOptionViewItem>
+ #include <QFontMetrics>
+Index: vlc-3.0.8/modules/gui/qt/dialogs/plugins.cpp
+===================================================================
+--- vlc-3.0.8.orig/modules/gui/qt/dialogs/plugins.cpp
++++ vlc-3.0.8/modules/gui/qt/dialogs/plugins.cpp
+@@ -53,6 +53,7 @@
+ #include <QListView>
+ #include <QListWidget>
+ #include <QPainter>
++#include <QPainterPath>
+ #include <QStyleOptionViewItem>
+ #include <QKeyEvent>
+ #include <QPushButton>
+
diff --git a/pkgs/applications/virtualization/dumb-init/default.nix b/pkgs/applications/virtualization/dumb-init/default.nix
index 5e1bc9489d3..3d4df33300e 100644
--- a/pkgs/applications/virtualization/dumb-init/default.nix
+++ b/pkgs/applications/virtualization/dumb-init/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dumb-init";
-  version = "1.2.3";
+  version = "1.2.4";
 
   src = fetchFromGitHub {
     owner = "Yelp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1ws944y8gch6h7iqvznfwlh9hnmdn36aqh9w6cbc7am8vbyq0ffa";
+    sha256 = "0v6ggfjl3q5p4hf002ygs8rryyzrg0fqy836p403fq2fgm30k0xx";
   };
 
   buildInputs = [ glibc.static ];
diff --git a/pkgs/build-support/emacs/elpa.nix b/pkgs/build-support/emacs/elpa.nix
index e6f6c23e449..214aed9c3f9 100644
--- a/pkgs/build-support/emacs/elpa.nix
+++ b/pkgs/build-support/emacs/elpa.nix
@@ -7,9 +7,18 @@ with lib;
 { pname
 , version
 , src
+, meta ? {}
 , ...
 }@args:
 
+let
+
+  defaultMeta = {
+    homepage = args.src.meta.homepage or "https://elpa.gnu.org/packages/${pname}.html";
+  };
+
+in
+
 import ./generic.nix { inherit lib stdenv emacs texinfo; } ({
 
   phases = "installPhase fixupPhase distPhase";
@@ -23,6 +32,8 @@ import ./generic.nix { inherit lib stdenv emacs texinfo; } ({
 
     runHook postInstall
   '';
+
+  meta = defaultMeta // meta;
 }
 
 // removeAttrs args [ "files" "fileSpecs"
diff --git a/pkgs/build-support/emacs/melpa.nix b/pkgs/build-support/emacs/melpa.nix
index e2ec84c75e6..d6fe3085837 100644
--- a/pkgs/build-support/emacs/melpa.nix
+++ b/pkgs/build-support/emacs/melpa.nix
@@ -23,7 +23,7 @@ with lib;
 let
 
   defaultMeta = {
-    homepage = args.src.meta.homepage or "http://melpa.org/#/${pname}";
+    homepage = args.src.meta.homepage or "https://melpa.org/#/${pname}";
   };
 
 in
diff --git a/pkgs/build-support/emacs/wrapper.nix b/pkgs/build-support/emacs/wrapper.nix
index 1f2fbd8068e..a3ab30afc63 100644
--- a/pkgs/build-support/emacs/wrapper.nix
+++ b/pkgs/build-support/emacs/wrapper.nix
@@ -155,8 +155,12 @@ runCommand
     for prog in $emacs/bin/*; do # */
       local progname=$(basename "$prog")
       rm -f "$out/bin/$progname"
-      makeWrapper "$prog" "$out/bin/$progname" \
-        --suffix EMACSLOADPATH ":" "$deps/share/emacs/site-lisp:"
+
+      substitute ${./wrapper.sh} $out/bin/$progname \
+        --subst-var-by bash ${emacs.stdenv.shell} \
+        --subst-var-by wrapperSiteLisp "$deps/share/emacs/site-lisp" \
+        --subst-var prog
+      chmod +x $out/bin/$progname
     done
 
     # Wrap MacOS app
@@ -168,8 +172,12 @@ runCommand
             $emacs/Applications/Emacs.app/Contents/PkgInfo \
             $emacs/Applications/Emacs.app/Contents/Resources \
             $out/Applications/Emacs.app/Contents
-      makeWrapper $emacs/Applications/Emacs.app/Contents/MacOS/Emacs $out/Applications/Emacs.app/Contents/MacOS/Emacs \
-        --suffix EMACSLOADPATH ":" "$deps/share/emacs/site-lisp:"
+
+      substitute ${./wrapper.sh} $out/Applications/Emacs.app/Contents/MacOS/Emacs \
+        --subst-var-by bash ${emacs.stdenv.shell} \
+        --subst-var-by wrapperSiteLisp "$emacs/Applications/Emacs.app/Contents/MacOS/Emacs" \
+        --subst-var prog
+      chmod +x $out/bin/$progname
     fi
 
     mkdir -p $out/share
diff --git a/pkgs/build-support/emacs/wrapper.sh b/pkgs/build-support/emacs/wrapper.sh
new file mode 100644
index 00000000000..96c9a8a60ea
--- /dev/null
+++ b/pkgs/build-support/emacs/wrapper.sh
@@ -0,0 +1,27 @@
+#!@bash@
+
+IFS=:
+
+newLoadPath=()
+added=
+
+if [[ -n $EMACSLOADPATH ]]
+then
+    while read -rd: entry
+    do
+        if [[ -z $entry && -z $added ]]
+        then
+            newLoadPath+=(@wrapperSiteLisp@)
+            added=1
+        fi
+        newLoadPath+=("$entry")
+    done <<< "$EMACSLOADPATH:"
+else
+    newLoadPath+=(@wrapperSiteLisp@)
+    newLoadPath+=("")
+fi
+
+export EMACSLOADPATH="${newLoadPath[*]}"
+export emacsWithPackages_siteLisp=@wrapperSiteLisp@
+
+exec @prog@ "$@"
diff --git a/pkgs/build-support/fetchmavenartifact/default.nix b/pkgs/build-support/fetchmavenartifact/default.nix
index 42ad7603a8f..42162638e72 100644
--- a/pkgs/build-support/fetchmavenartifact/default.nix
+++ b/pkgs/build-support/fetchmavenartifact/default.nix
@@ -3,10 +3,10 @@
 { fetchurl, stdenv }:
 let
   defaultRepos = [
-    "http://repo1.maven.org/maven2"
-    "http://oss.sonatype.org/content/repositories/releases"
-    "http://oss.sonatype.org/content/repositories/public"
-    "http://repo.typesafe.com/typesafe/releases"
+    "https://repo1.maven.org/maven2"
+    "https://oss.sonatype.org/content/repositories/releases"
+    "https://oss.sonatype.org/content/repositories/public"
+    "https://repo.typesafe.com/typesafe/releases"
   ];
 in
 
@@ -50,7 +50,7 @@ let
       (replaceChars ["."] ["/"] groupId)
       artifactId
       version
-      "${artifactId}-${version}-${optionalString (!isNull classifier) "-${classifier}"}.jar"
+      "${artifactId}-${version}${optionalString (!isNull classifier) "-${classifier}"}.jar"
     ];
   urls_ =
     if url != "" then [url]
diff --git a/pkgs/build-support/nix-gitignore/default.nix b/pkgs/build-support/nix-gitignore/default.nix
index fba09adc2d4..abfe67ea430 100644
--- a/pkgs/build-support/nix-gitignore/default.nix
+++ b/pkgs/build-support/nix-gitignore/default.nix
@@ -150,10 +150,10 @@ in rec {
       '');
 
   withGitignoreFile = patterns: root:
-    lib.toList patterns ++ [(root + "/.gitignore")];
+    lib.toList patterns ++ [ ".git" ] ++ [(root + "/.gitignore")];
 
   withRecursiveGitignoreFile = patterns: root:
-    lib.toList patterns ++ [(compileRecursiveGitignore root)];
+    lib.toList patterns ++ [ ".git" ] ++ [(compileRecursiveGitignore root)];
 
   # filterSource derivatives
 
diff --git a/pkgs/build-support/setup-hooks/auto-patchelf.sh b/pkgs/build-support/setup-hooks/auto-patchelf.sh
index 4f7c0c14304..49e84f84ceb 100644
--- a/pkgs/build-support/setup-hooks/auto-patchelf.sh
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.sh
@@ -1,9 +1,16 @@
 declare -a autoPatchelfLibs
+declare -Ag autoPatchelfFailedDeps
 
 gatherLibraries() {
     autoPatchelfLibs+=("$1/lib")
 }
 
+# wrapper around patchelf to raise proper error messages
+# containing the tried file name and command
+runPatchelf() {
+  patchelf "$@" || (echo "Command failed: patchelf $*" && exit 1)
+}
+
 addEnvHooks "$targetOffset" gatherLibraries
 
 isExecutable() {
@@ -23,14 +30,19 @@ isExecutable() {
 
 # We cache dependencies so that we don't need to search through all of them on
 # every consecutive call to findDependency.
-declare -a cachedDependencies
+declare -Ag autoPatchelfCachedDepsAssoc
+declare -ag autoPatchelfCachedDeps
+
 
 addToDepCache() {
-    local existing
-    for existing in "${cachedDependencies[@]}"; do
-        if [ "$existing" = "$1" ]; then return; fi
-    done
-    cachedDependencies+=("$1")
+    if [[ ${autoPatchelfCachedDepsAssoc[$1]+f} ]]; then return; fi
+
+    # store deps in an assoc. array for efficient lookups
+    # otherwise findDependency would have quadratic complexity
+    autoPatchelfCachedDepsAssoc["$1"]=""
+
+    # also store deps in normal array to maintain their order
+    autoPatchelfCachedDeps+=("$1")
 }
 
 declare -gi depCacheInitialised=0
@@ -43,9 +55,8 @@ getDepsFromSo() {
 
 populateCacheWithRecursiveDeps() {
     local so found foundso
-    for so in "${cachedDependencies[@]}"; do
+    for so in "${autoPatchelfCachedDeps[@]}"; do
         for found in $(getDepsFromSo "$so"); do
-            local libdir="${found%/*}"
             local base="${found##*/}"
             local soname="${base%.so*}"
             for foundso in "${found%/*}/$soname".so*; do
@@ -76,7 +87,7 @@ findDependency() {
         depCacheInitialised=1
     fi
 
-    for dep in "${cachedDependencies[@]}"; do
+    for dep in "${autoPatchelfCachedDeps[@]}"; do
         if [ "$filename" = "${dep##*/}" ]; then
             if [ "$(getSoArch "$dep")" = "$arch" ]; then
                 foundDependency="$dep"
@@ -101,9 +112,10 @@ findDependency() {
 autoPatchelfFile() {
     local dep rpath="" toPatch="$1"
 
-    local interpreter="$(< "$NIX_CC/nix-support/dynamic-linker")"
+    local interpreter
+    interpreter="$(< "$NIX_CC/nix-support/dynamic-linker")"
     if isExecutable "$toPatch"; then
-        patchelf --set-interpreter "$interpreter" "$toPatch"
+        runPatchelf --set-interpreter "$interpreter" "$toPatch"
         if [ -n "$runtimeDependencies" ]; then
             for dep in $runtimeDependencies; do
                 rpath="$rpath${rpath:+:}$dep/lib"
@@ -115,9 +127,10 @@ autoPatchelfFile() {
 
     # We're going to find all dependencies based on ldd output, so we need to
     # clear the RPATH first.
-    patchelf --remove-rpath "$toPatch"
+    runPatchelf --remove-rpath "$toPatch"
 
-    local missing="$(
+    local missing
+    missing="$(
         ldd "$toPatch" 2> /dev/null | \
             sed -n -e 's/^[\t ]*\([^ ]\+\) => not found.*/\1/p'
     )"
@@ -125,7 +138,6 @@ autoPatchelfFile() {
     # This ensures that we get the output of all missing dependencies instead
     # of failing at the first one, because it's more useful when working on a
     # new package where you don't yet know its dependencies.
-    local -i depNotFound=0
 
     for dep in $missing; do
         echo -n "  $dep -> " >&2
@@ -134,18 +146,13 @@ autoPatchelfFile() {
             echo "found: $foundDependency" >&2
         else
             echo "not found!" >&2
-            depNotFound=1
+            autoPatchelfFailedDeps["$dep"]="$toPatch"
         fi
     done
 
-    # This makes sure the builder fails if we didn't find a dependency, because
-    # the stdenv setup script is run with set -e. The actual error is emitted
-    # earlier in the previous loop.
-    [ $depNotFound -eq 0 -o -n "$autoPatchelfIgnoreMissingDeps" ]
-
     if [ -n "$rpath" ]; then
         echo "setting RPATH to: $rpath" >&2
-        patchelf --set-rpath "$rpath" "$toPatch"
+        runPatchelf --set-rpath "$rpath" "$toPatch"
     fi
 }
 
@@ -168,10 +175,10 @@ addAutoPatchelfSearchPath() {
         esac
     done
 
-    cachedDependencies+=(
-        $(find "$@" "${findOpts[@]}" \! -type d \
-               \( -name '*.so' -o -name '*.so.*' \))
-    )
+    for file in \
+      $(find "$@" "${findOpts[@]}" \! -type d \
+          \( -name '*.so' -o -name '*.so.*' \))
+    do addToDepCache "$file"; done
 }
 
 autoPatchelf() {
@@ -197,14 +204,9 @@ autoPatchelf() {
     echo "automatically fixing dependencies for ELF files" >&2
 
     # Add all shared objects of the current output path to the start of
-    # cachedDependencies so that it's choosen first in findDependency.
+    # autoPatchelfCachedDeps so that it's chosen first in findDependency.
     addAutoPatchelfSearchPath ${norecurse:+--no-recurse} -- "$@"
 
-    # Here we actually have a subshell, which also means that
-    # $cachedDependencies is final at this point, so whenever we want to run
-    # findDependency outside of this, the dependency cache needs to be rebuilt
-    # from scratch, so keep this in mind if you want to run findDependency
-    # outside of this function.
     while IFS= read -r -d $'\0' file; do
       isELF "$file" || continue
       segmentHeaders="$(LANG=C $READELF -l "$file")"
@@ -215,8 +217,24 @@ autoPatchelf() {
           # Skip if the executable is statically linked.
           [ -n "$(echo "$segmentHeaders" | grep "^ *INTERP\\>")" ] || continue
       fi
+      # Jump file if patchelf is unable to parse it
+      # Some programs contain binary blobs for testing,
+      # which are identified as ELF but fail to be parsed by patchelf
+      patchelf "$file" || continue
       autoPatchelfFile "$file"
     done < <(find "$@" ${norecurse:+-maxdepth 1} -type f -print0)
+
+    # fail if any dependencies were not found and
+    # autoPatchelfIgnoreMissingDeps is not set
+    local depsMissing=0
+    for failedDep in "${!autoPatchelfFailedDeps[@]}"; do
+      echo "autoPatchelfHook could not satisfy dependency $failedDep wanted by ${autoPatchelfFailedDeps[$failedDep]}"
+      depsMissing=1
+    done
+    if [[ $depsMissing == 1 && -z "$autoPatchelfIgnoreMissingDeps" ]]; then
+      echo "Add the missing dependencies to the build inputs or set autoPatchelfIgnoreMissingDeps=true"
+      exit 1
+    fi
 }
 
 # XXX: This should ultimately use fixupOutputHooks but we currently don't have
diff --git a/pkgs/build-support/setup-hooks/compress-man-pages.sh b/pkgs/build-support/setup-hooks/compress-man-pages.sh
index 82e48cd8aa7..f5af76e8168 100644
--- a/pkgs/build-support/setup-hooks/compress-man-pages.sh
+++ b/pkgs/build-support/setup-hooks/compress-man-pages.sh
@@ -21,6 +21,7 @@ compressManPages() {
 
     # Point symlinks to compressed manpages.
     find "$dir"/share/man/ -type l -a '!' -regex '.*\.\(bz2\|gz\)$' -print0 \
+        | sort -z \
         | while IFS= read -r -d $'\0' f
     do
         local target
diff --git a/pkgs/build-support/setup-hooks/strip.sh b/pkgs/build-support/setup-hooks/strip.sh
index f5fa9378fd7..a7cdfd1d276 100644
--- a/pkgs/build-support/setup-hooks/strip.sh
+++ b/pkgs/build-support/setup-hooks/strip.sh
@@ -51,7 +51,7 @@ stripDirs() {
 
     if [ -n "${dirs}" ]; then
         header "stripping (with command $cmd and flags $stripFlags) in$dirs"
-        find $dirs -type f -print0 | xargs -0 ${xargsFlags:--r} $cmd $commonStripFlags $stripFlags 2>/dev/null || true
+        find $dirs -type f -exec $cmd $commonStripFlags $stripFlags '{}' \; #
         stopNest
     fi
 }
diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix
index 34e0ec132a9..0545c0e5efa 100644
--- a/pkgs/data/misc/cacert/default.nix
+++ b/pkgs/data/misc/cacert/default.nix
@@ -1,6 +1,10 @@
 { stdenv, fetchurl, nss, python3
 , blacklist ? []
-, includeEmail ? false
+
+# Used for tests only
+, runCommand
+, cacert
+, openssl
 }:
 
 with stdenv.lib;
@@ -37,11 +41,6 @@ stdenv.mkDerivation {
     EOF
 
     cat ${certdata2pem} > certdata2pem.py
-    patch -p1 < ${./fix-unicode-ca-names.patch}
-    ${optionalString includeEmail ''
-      # Disable CAs used for mail signing
-      substituteInPlace certdata2pem.py --replace \[\'CKA_TRUST_EMAIL_PROTECTION\'\] '''
-    ''}
   '';
 
   buildPhase = ''
@@ -66,12 +65,59 @@ stdenv.mkDerivation {
   setupHook = ./setup-hook.sh;
 
   passthru.updateScript = ./update.sh;
+  passthru.tests = {
+    # Test that building this derivation with a blacklist works, and that UTF-8 is supported.
+    blacklist-utf8 = let
+      blacklistCAToFingerprint = {
+        # "blacklist" uses the CA name from the NSS bundle, but we check for presence using the SHA256 fingerprint.
+        "CFCA EV ROOT" = "5C:C3:D7:8E:4E:1D:5E:45:54:7A:04:E6:87:3E:64:F9:0C:F9:53:6D:1C:CC:2E:F8:00:F3:55:C4:C5:FD:70:FD";
+        "NetLock Arany (Class Gold) Főtanúsítvány" = "6C:61:DA:C3:A2:DE:F0:31:50:6B:E0:36:D2:A6:FE:40:19:94:FB:D1:3D:F9:C8:D4:66:59:92:74:C4:46:EC:98";
+      };
+      mapBlacklist = f: concatStringsSep "\n" (mapAttrsToList f blacklistCAToFingerprint);
+    in runCommand "verify-the-cacert-filter-output" {
+      cacert = cacert.unbundled;
+      cacertWithExcludes = (cacert.override {
+        blacklist = builtins.attrNames blacklistCAToFingerprint;
+      }).unbundled;
+
+      nativeBuildInputs = [ openssl ];
+    } ''
+      isPresent() {
+        # isPresent <unbundled-dir> <ca name> <ca sha256 fingerprint>
+        for f in $1/etc/ssl/certs/*.crt; do
+          fingerprint="$(openssl x509 -in "$f" -noout -fingerprint -sha256 | cut -f2 -d=)"
+          if [[ "x$fingerprint" == "x$3" ]]; then
+            return 0
+          fi
+        done
+        return 1
+      }
+
+      # Ensure that each certificate is in the main "cacert".
+      ${mapBlacklist (caName: caFingerprint: ''
+        isPresent "$cacert" "${caName}" "${caFingerprint}" || ({
+          echo "CA fingerprint ${caFingerprint} (${caName}) is missing from the CA bundle. Consider picking a different CA for the blacklist test." >&2
+          exit 1
+        })
+      '')}
+
+      # Ensure that each certificate is NOT in the "cacertWithExcludes".
+      ${mapBlacklist (caName: caFingerprint: ''
+        isPresent "$cacertWithExcludes" "${caName}" "${caFingerprint}" && ({
+          echo "CA fingerprint ${caFingerprint} (${caName}) is present in the cacertWithExcludes bundle." >&2
+          exit 1
+        })
+      '')}
+
+      touch $out
+    '';
+  };
 
   meta = {
     homepage = "https://curl.haxx.se/docs/caextract.html";
     description = "A bundle of X.509 certificates of public Certificate Authorities (CA)";
     platforms = platforms.all;
-    maintainers = with maintainers; [ fpletz ];
+    maintainers = with maintainers; [ andir fpletz lukegb ];
     license = licenses.mpl20;
   };
 }
diff --git a/pkgs/data/misc/cacert/fix-unicode-ca-names.patch b/pkgs/data/misc/cacert/fix-unicode-ca-names.patch
deleted file mode 100644
index 07d3629196a..00000000000
--- a/pkgs/data/misc/cacert/fix-unicode-ca-names.patch
+++ /dev/null
@@ -1,20 +0,0 @@
---- a/certdata2pem.py	2017-08-01 23:10:00.000000000 +0300
-+++ b/certdata2pem.py	2017-08-01 23:08:21.131297636 +0300
-@@ -88,7 +88,7 @@
- \# Read blacklist.
- blacklist = []
- if os.path.exists('blacklist.txt'):
--    for line in open('blacklist.txt', 'r'):
-+    for line in io.open('blacklist.txt', 'r', encoding='utf-8'):
-         line = line.strip()
-         if line.startswith('#') or len(line) == 0:
-             continue
-@@ -101,7 +101,7 @@
-     if obj['CKA_CLASS'] != 'CKO_NSS_TRUST':
-         continue
-     if obj['CKA_LABEL'] in blacklist:
--        print("Certificate %s blacklisted, ignoring." % obj['CKA_LABEL'])
-+        print("Certificate %s blacklisted, ignoring." % unicode(obj['CKA_LABEL']).encode('utf-8'))
-     elif obj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_TRUSTED_DELEGATOR':
-         trust[obj['CKA_LABEL']] = True
-     elif obj['CKA_TRUST_EMAIL_PROTECTION'] == 'CKT_NSS_TRUSTED_DELEGATOR':
diff --git a/pkgs/data/themes/matcha/default.nix b/pkgs/data/themes/matcha/default.nix
index df548052b83..75b9d0f65ed 100644
--- a/pkgs/data/themes/matcha/default.nix
+++ b/pkgs/data/themes/matcha/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "matcha-gtk-theme";
-  version = "2020-11-23";
+  version = "2020-12-07";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "115nmzwpsaq8aa0p7ghfcw79n7h9ifvh0drv3dd4lj2dk33vkpv1";
+    sha256 = "0ch05nz1hipi9fz4sx1pah61jkbjw2gz3binsqayhp76jmp344a1";
   };
 
   buildInputs = [ gdk-pixbuf librsvg ];
diff --git a/pkgs/development/compilers/nim/default.nix b/pkgs/development/compilers/nim/default.nix
index 5b6da3cbefe..27427e75d00 100644
--- a/pkgs/development/compilers/nim/default.nix
+++ b/pkgs/development/compilers/nim/default.nix
@@ -255,6 +255,11 @@ let
         ln -s $out/bin/${targetPlatform.config}-nim $out/bin/nim
 
         makeWrapper \
+          ${nim'}/bin/testament $out/bin/${targetPlatform.config}-testament \
+          $wrapperArgs
+        ln -s $out/bin/${targetPlatform.config}-testament $out/bin/testament
+
+        makeWrapper \
           ${nimble'}/bin/nimble $out/bin/${targetPlatform.config}-nimble \
           --suffix PATH : $out/bin
         ln -s $out/bin/${targetPlatform.config}-nimble $out/bin/nimble
diff --git a/pkgs/development/compilers/rgbds/default.nix b/pkgs/development/compilers/rgbds/default.nix
index 499a0a5f936..4c8a4cfd4ef 100644
--- a/pkgs/development/compilers/rgbds/default.nix
+++ b/pkgs/development/compilers/rgbds/default.nix
@@ -6,12 +6,12 @@
 
 stdenv.mkDerivation rec {
   pname = "rgbds";
-  version = "0.4.1";
+  version = "0.4.2";
   src = fetchFromGitHub {
     owner = "rednex";
     repo = "rgbds";
     rev = "v${version}";
-    sha256 = "05djzl3h18zg2z5p2a881wjbmgikzkhf67cgk00frhw4v05sq0lf";
+    sha256 = "0lygj7jzjlq4w0mkiir7ycysrd1p1akyvzrppjcchja05mi8wy9p";
   };
   nativeBuildInputs = [ bison flex pkg-config libpng ];
   installFlags = [ "PREFIX=\${out}" ];
diff --git a/pkgs/development/interpreters/clojurescript/lumo/deps.nix b/pkgs/development/interpreters/clojurescript/lumo/deps.nix
index 4f3beff3b81..50f1c4af211 100644
--- a/pkgs/development/interpreters/clojurescript/lumo/deps.nix
+++ b/pkgs/development/interpreters/clojurescript/lumo/deps.nix
@@ -4,9 +4,9 @@
 let repos = [
       "https://repo.clojars.org/"
       "https://repo1.maven.org/"
-      "http://oss.sonatype.org/content/repositories/releases/"
-      "http://oss.sonatype.org/content/repositories/public/"
-      "http://repo.typesafe.com/typesafe/releases/"
+      "https://oss.sonatype.org/content/repositories/releases/"
+      "https://oss.sonatype.org/content/repositories/public/"
+      "https://repo.typesafe.com/typesafe/releases/"
     ];
 
 in rec {
diff --git a/pkgs/development/interpreters/guile/setup-hook-2.0.sh b/pkgs/development/interpreters/guile/setup-hook-2.0.sh
index 6bb3910aaff..288f7e242f9 100644
--- a/pkgs/development/interpreters/guile/setup-hook-2.0.sh
+++ b/pkgs/development/interpreters/guile/setup-hook-2.0.sh
@@ -8,6 +8,16 @@ addGuileLibPath () {
         export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
         export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
     fi
+
+    if test -d "$1/lib/guile/2.0/ccache"
+    then
+        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.0/ccache"
+    fi
+
+    if test -d "$1/lib/guile/2.0/site-ccache"
+    then
+        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.0/site-ccache"
+    fi
 }
 
 addEnvHooks "$hostOffset" addGuileLibPath
diff --git a/pkgs/development/interpreters/guile/setup-hook-2.2.sh b/pkgs/development/interpreters/guile/setup-hook-2.2.sh
index 4b3541fcc7f..1430dbe0720 100644
--- a/pkgs/development/interpreters/guile/setup-hook-2.2.sh
+++ b/pkgs/development/interpreters/guile/setup-hook-2.2.sh
@@ -8,6 +8,16 @@ addGuileLibPath () {
         export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
         export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
     fi
+
+    if test -d "$1/lib/guile/2.2/ccache"
+    then
+        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.2/ccache"
+    fi
+
+    if test -d "$1/lib/guile/2.2/site-ccache"
+    then
+        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.2/site-ccache"
+    fi
 }
 
 addEnvHooks "$hostOffset" addGuileLibPath
diff --git a/pkgs/development/libraries/SDL2_mixer/default.nix b/pkgs/development/libraries/SDL2_mixer/default.nix
index c90c0fd08a8..af0da7dc627 100644
--- a/pkgs/development/libraries/SDL2_mixer/default.nix
+++ b/pkgs/development/libraries/SDL2_mixer/default.nix
@@ -1,7 +1,19 @@
-{ stdenv, lib, fetchurl, autoreconfHook, pkgconfig, which
-, SDL2, libogg, libvorbis, smpeg2, flac, libmodplug, opusfile, mpg123
-, CoreServices, AudioUnit, AudioToolbox
-, enableNativeMidi ? false, fluidsynth ? null }:
+{ stdenv
+, fetchurl
+, pkg-config
+, AudioToolbox
+, AudioUnit
+, CoreServices
+, SDL2
+, flac
+, fluidsynth
+, libmodplug
+, libogg
+, libvorbis
+, mpg123
+, opusfile
+, smpeg2
+}:
 
 stdenv.mkDerivation rec {
   pname = "SDL2_mixer";
@@ -12,19 +24,37 @@ stdenv.mkDerivation rec {
     sha256 = "0694vsz5bjkcdgfdra6x9fq8vpzrl8m6q96gh58df7065hw5mkxl";
   };
 
-  preAutoreconf = ''
-    aclocal
-  '';
+  nativeBuildInputs = [ pkg-config ];
 
-  nativeBuildInputs = [ autoreconfHook pkgconfig which ];
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [
+    AudioToolbox
+    AudioUnit
+    CoreServices
+  ];
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ CoreServices AudioUnit AudioToolbox ];
+  propagatedBuildInputs = [
+    SDL2
+    flac
+    fluidsynth
+    libmodplug
+    libogg
+    libvorbis
+    mpg123
+    opusfile
+    smpeg2
+  ];
 
-  propagatedBuildInputs = [ SDL2 libogg libvorbis fluidsynth smpeg2 flac libmodplug opusfile mpg123 ];
-
-  configureFlags = [ "--disable-music-ogg-shared" ]
-    ++ lib.optional enableNativeMidi "--enable-music-native-midi-gpl"
-    ++ lib.optionals stdenv.isDarwin [ "--disable-sdltest" "--disable-smpegtest" ];
+  configureFlags = [
+    "--disable-music-ogg-shared"
+    "--disable-music-flac-shared"
+    "--disable-music-mod-modplug-shared"
+    "--disable-music-mp3-mpg123-shared"
+    "--disable-music-opus-shared"
+    "--disable-music-midi-fluidsynth-shared"
+  ] ++ stdenv.lib.optionals stdenv.isDarwin [
+    "--disable-sdltest"
+    "--disable-smpegtest"
+  ];
 
   meta = with stdenv.lib; {
     description = "SDL multi-channel audio mixer library";
diff --git a/pkgs/development/libraries/aqbanking/sources.nix b/pkgs/development/libraries/aqbanking/sources.nix
index 8016053c42d..3713a257663 100644
--- a/pkgs/development/libraries/aqbanking/sources.nix
+++ b/pkgs/development/libraries/aqbanking/sources.nix
@@ -1,11 +1,11 @@
 {
-  gwenhywfar.version = "5.1.3";
-  gwenhywfar.sha256 = "0xjr9d94y46h7pfdhz5ygn01pmlm66rhiybr520h13nvjh4zid0r";
-  gwenhywfar.releaseId = "242";
+  gwenhywfar.version = "5.4.1";
+  gwenhywfar.sha256 = "16waq39mbhhjcma2ykdbqvpcw0ba3ksqqwsp55zczhg320s41zgv";
+  gwenhywfar.releaseId = "344";
   libchipcard.version = "5.0.4";
   libchipcard.sha256 = "0fj2h39ll4kiv28ch8qgzdbdbnzs8gl812qnm660bw89rynpjnnj";
   libchipcard.releaseId = "158";
-  aqbanking.version = "6.0.2";
-  aqbanking.sha256 = "0n41n3yki1wmax4i9wi485g8zqb43z1adywcixzfq9gbdjhz05hx";
-  aqbanking.releaseId = "273";
+  aqbanking.version = "6.2.5";
+  aqbanking.sha256 = "1pyny15g8y5dzzl4yg7jjnavygfzsi2g1jl7as9grqy77q70cnyg";
+  aqbanking.releaseId = "342";
 }
diff --git a/pkgs/development/libraries/draco/default.nix b/pkgs/development/libraries/draco/default.nix
index 02feba0a43e..317742f07b3 100644
--- a/pkgs/development/libraries/draco/default.nix
+++ b/pkgs/development/libraries/draco/default.nix
@@ -2,14 +2,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.4.0";
+  version = "1.4.1";
   pname = "draco";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "draco";
     rev = version;
-    sha256 = "0s65il754fpiygbg0yq2xynpbnmhiiaxghkzprjqxziyz6gi87lm";
+    sha256 = "14ln4la52x38pf8syr7i5v4vd65ya4zij8zj5kgihah03cih0qcd";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/glibc/2.32-10.patch.gz b/pkgs/development/libraries/glibc/2.32-10.patch.gz
new file mode 100644
index 00000000000..6141f08efad
--- /dev/null
+++ b/pkgs/development/libraries/glibc/2.32-10.patch.gz
Binary files differdiff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 630b6b82446..dd76745e1fe 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -42,7 +42,7 @@
 
 let
   version = "2.32";
-  patchSuffix = "";
+  patchSuffix = "-10";
   sha256 = "0di848ibffrnwq7g2dvgqrnn4xqhj3h96csn69q4da51ymafl9qn";
 in
 
@@ -59,6 +59,15 @@ stdenv.mkDerivation ({
 
   patches =
     [
+      /* No tarballs for stable upstream branch, only https://sourceware.org/git/?p=glibc.git
+         and using git or something would complicate bootstrapping.
+         Fortunately it's not too big with 2.32-10.
+          $ git checkout release/2.32/master; git describe
+          glibc-2.32-10-g0b9460d22e
+          $ git show --reverse glibc-2.32.. | gzip -n -9 --rsyncable - > 2.32-10.patch.gz
+       */
+      ./2.32-10.patch.gz
+
       /* Allow NixOS and Nix to handle the locale-archive. */
       ./nix-locale-archive.patch
 
diff --git a/pkgs/development/libraries/hwloc/default.nix b/pkgs/development/libraries/hwloc/default.nix
index fb315150e08..561a4693c1d 100644
--- a/pkgs/development/libraries/hwloc/default.nix
+++ b/pkgs/development/libraries/hwloc/default.nix
@@ -7,7 +7,7 @@ assert x11Support -> libX11 != null && cairo != null;
 with stdenv.lib;
 
 let
-  version = "2.3.0";
+  version = "2.4.0";
   versmm = versions.major version + "." + versions.minor version;
   name = "hwloc-${version}";
 
@@ -16,7 +16,7 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.open-mpi.org/software/hwloc/v${versmm}/downloads/${name}.tar.bz2";
-    sha256 = "0r4a07ag1fv48ql2g64px0wrjpxlvkh6c7mhnkv9xxkkg04zc1xn";
+    sha256 = "1s9q70mrr4igbjw4m26din81i68f4wbfpv6wdc4i2aalvd51n7rb";
   };
 
   configureFlags = [
diff --git a/pkgs/development/libraries/libarchive/default.nix b/pkgs/development/libraries/libarchive/default.nix
index 3c97ce21ce0..787745a6bda 100644
--- a/pkgs/development/libraries/libarchive/default.nix
+++ b/pkgs/development/libraries/libarchive/default.nix
@@ -12,13 +12,13 @@ assert xarSupport -> libxml2 != null;
 
 stdenv.mkDerivation rec {
   pname = "libarchive";
-  version = "3.4.3";
+  version = "3.5.0";
 
   src = fetchFromGitHub {
     owner = "libarchive";
     repo = "libarchive";
     rev = "v${version}";
-    sha256 = "1y0v03p6zyv6plr2p0pid1qfgmk8hd427spj8xa93mcdmq5yc3s0";
+    sha256 = "0dj01ayyac3q5a62rqxyskr4fjiq6iappd85zn3rx64xny5fl07d";
   };
 
   outputs = [ "out" "lib" "dev" ];
@@ -57,6 +57,7 @@ stdenv.mkDerivation rec {
       compressed with gzip, bzip2, lzma, xz, ...
     '';
     homepage = "http://libarchive.org";
+    changelog = "https://github.com/libarchive/libarchive/releases/tag/v${version}";
     license = stdenv.lib.licenses.bsd3;
     platforms = with stdenv.lib.platforms; all;
     maintainers = with stdenv.lib.maintainers; [ jcumming ];
diff --git a/pkgs/development/libraries/libff/default.nix b/pkgs/development/libraries/libff/default.nix
index 8413d5be441..874f45cae70 100644
--- a/pkgs/development/libraries/libff/default.nix
+++ b/pkgs/development/libraries/libff/default.nix
@@ -14,6 +14,12 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DWITH_PROCPS=Off" ];
 
+  # CMake is hardcoded to always build static library which causes linker
+  # failure for Haskell applications depending on haskellPackages.hevm on macOS.
+  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
+    substituteInPlace libff/CMakeLists.txt --replace "STATIC" "SHARED"
+  '';
+
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ boost gmp openssl ];
 
diff --git a/pkgs/development/libraries/libgphoto2/default.nix b/pkgs/development/libraries/libgphoto2/default.nix
index 93c98bb1f12..89bca2ee75f 100644
--- a/pkgs/development/libraries/libgphoto2/default.nix
+++ b/pkgs/development/libraries/libgphoto2/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libgphoto2";
-  version = "2.5.23";
+  version = "2.5.26";
 
   src = fetchFromGitHub {
     owner = "gphoto";
     repo = "libgphoto2";
     rev = "libgphoto2-${builtins.replaceStrings [ "." ] [ "_" ] version}-release";
-    sha256 = "1sc2ycx11khf0qzp1cqxxx1qymv6bjfbkx3vvbwz6wnbyvsigxz2";
+    sha256 = "0lnlxflj04ng9a0hm2nb2067kqs4kp9kx1z4gg395cgbfd7lx6j6";
   };
 
   patches = [];
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index 18a5dcbab65..dff2ca82955 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -27,14 +27,14 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "libinput";
-  version = "1.16.3";
+  version = "1.16.4";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "0dj2m92kh3xpnjmzp416c73hpw6ban0f6yj39chwxckdgyliak6z";
+    sha256 = "1c81429kh9av9fanxmnjw5rvsjbzcyi7d0dx0gkyq5yysmpmrppi";
   };
 
   outputs = [ "bin" "out" "dev" ];
diff --git a/pkgs/development/libraries/libksba/default.nix b/pkgs/development/libraries/libksba/default.nix
index d627bf81cba..7e14c1b533b 100644
--- a/pkgs/development/libraries/libksba/default.nix
+++ b/pkgs/development/libraries/libksba/default.nix
@@ -1,11 +1,11 @@
 { buildPackages, stdenv, fetchurl, gettext, libgpgerror }:
 
 stdenv.mkDerivation rec {
-  name = "libksba-1.4.0";
+  name = "libksba-1.5.0";
 
   src = fetchurl {
     url = "mirror://gnupg/libksba/${name}.tar.bz2";
-    sha256 = "1dj1razn35srkgadx3i30yr0q037cr0dn54m6a54vxgh3zlsirmz";
+    sha256 = "1fm0mf3wq9fmyi1rmc1vk2fafn6liiw2mgxml3g7ybbb44lz2jmf";
   };
 
   outputs = [ "out" "dev" "info" ];
diff --git a/pkgs/development/libraries/librtprocess/default.nix b/pkgs/development/libraries/librtprocess/default.nix
new file mode 100644
index 00000000000..adabbe11cb3
--- /dev/null
+++ b/pkgs/development/libraries/librtprocess/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, fetchFromGitHub, cmake }:
+
+stdenv.mkDerivation rec {
+  pname = "librtprocess";
+  version = "0.11.0";
+
+  src = fetchFromGitHub {
+    owner = "CarVac";
+    repo = pname;
+    rev = version;
+    sha256 = "1bivy3rymmmkdx5phbxq4qaq15hw633dgpks57z9ara15mh817xx";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/CarVac/librtprocess";
+    description = "Highly optimized library for processing RAW images";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ hjones2199 ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/development/libraries/libtorrent-rasterbar/1.2/default.nix b/pkgs/development/libraries/libtorrent-rasterbar/1.2/default.nix
index 91e5a54bab1..1233dcb3933 100644
--- a/pkgs/development/libraries/libtorrent-rasterbar/1.2/default.nix
+++ b/pkgs/development/libraries/libtorrent-rasterbar/1.2/default.nix
@@ -1,10 +1,10 @@
-{ stdenv, lib, fetchFromGitHub, pkgconfig, automake, autoconf
-, zlib, boost, openssl, libtool, python, libiconv, ncurses
+{ stdenv, fetchFromGitHub, pkg-config, automake, autoconf
+, zlib, boost, openssl, libtool, python, libiconv, ncurses, SystemConfiguration
 }:
 
 let
   version = "1.2.6";
-  formattedVersion = lib.replaceChars ["."] ["_"] version;
+  formattedVersion = stdenv.lib.replaceChars ["."] ["_"] version;
 
   # Make sure we override python, so the correct version is chosen
   # for the bindings, if overridden
@@ -22,8 +22,12 @@ in stdenv.mkDerivation {
   };
 
   enableParallelBuilding = true;
-  nativeBuildInputs = [ automake autoconf libtool pkgconfig ];
-  buildInputs = [ boostPython openssl zlib python libiconv ncurses ];
+
+  nativeBuildInputs = [ automake autoconf libtool pkg-config ];
+
+  buildInputs = [ boostPython openssl zlib python libiconv ncurses ]
+    ++ stdenv.lib.optionals stdenv.isDarwin [ SystemConfiguration ];
+
   preConfigure = "./autotool.sh";
 
   postInstall = ''
@@ -45,6 +49,7 @@ in stdenv.mkDerivation {
     description = "A C++ BitTorrent implementation focusing on efficiency and scalability";
     license = licenses.bsd3;
     maintainers = [ maintainers.phreedom ];
+    broken = stdenv.isDarwin;
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/libunwind/default.nix b/pkgs/development/libraries/libunwind/default.nix
index 0f0143b9c1f..3816788f929 100644
--- a/pkgs/development/libraries/libunwind/default.nix
+++ b/pkgs/development/libraries/libunwind/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, autoreconfHook, xz }:
+{ stdenv, lib, fetchurl, autoreconfHook, xz, coreutils }:
 
 stdenv.mkDerivation rec {
   pname = "libunwind";
@@ -17,7 +17,11 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook ];
 
-  outputs = [ "out" "dev" ];
+  outputs = [ "out" "dev" "devman" ];
+
+  # Without latex2man, no man pages are installed despite being
+  # prebuilt in the source tarball.
+  configureFlags = "LATEX2MAN=${coreutils}/bin/true";
 
   propagatedBuildInputs = [ xz ];
 
diff --git a/pkgs/development/libraries/libva/default.nix b/pkgs/development/libraries/libva/default.nix
index f6c8c9d0bb8..f37780f5d6d 100644
--- a/pkgs/development/libraries/libva/default.nix
+++ b/pkgs/development/libraries/libva/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   name = "libva-${lib.optionalString minimal "minimal-"}${version}";
-  version = "2.9.1"; # Also update the hash for libva-utils!
+  version = "2.10.0";
 
   src = fetchFromGitHub {
     owner  = "intel";
     repo   = "libva";
     rev    = version;
-    sha256 = "1c9rwrz30q2p47spzb9gsakwci9c5mw6i309z7p7hr2d8233ay4x";
+    sha256 = "1xyxnxmq04s3s6135v6av1rl5z809j9vxvg7af9wvyh3dgsxrlds";
   };
 
   outputs = [ "dev" "out" ];
diff --git a/pkgs/development/libraries/libva/utils.nix b/pkgs/development/libraries/libva/utils.nix
index 675d85508b5..66294848b19 100644
--- a/pkgs/development/libraries/libva/utils.nix
+++ b/pkgs/development/libraries/libva/utils.nix
@@ -4,7 +4,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libva-utils";
-  inherit (libva) version;
+  version = "2.9.1";
 
   src = fetchFromGitHub {
     owner  = "intel";
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 891e11dbadf..dc82af49030 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -31,7 +31,7 @@ with stdenv.lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "20.2.3";
+  version = "20.2.4";
   branch  = versions.major version;
 in
 
@@ -46,7 +46,7 @@ stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "0axqrqg1fas91fx30qjwhcp4yasdvk919hjds4lga7ak247286xf";
+    sha256 = "14m09bk7akj0k02lg8fhvvzbdsashlbdsgl2cw7wbqfj2mhdqwh5";
   };
 
   prePatch = "patchShebangs .";
diff --git a/pkgs/development/libraries/nlohmann_json/default.nix b/pkgs/development/libraries/nlohmann_json/default.nix
index a4e76506a22..84b86b47157 100644
--- a/pkgs/development/libraries/nlohmann_json/default.nix
+++ b/pkgs/development/libraries/nlohmann_json/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nlohmann_json";
-  version = "3.7.3";
+  version = "3.9.1";
 
   src = fetchFromGitHub {
     owner = "nlohmann";
     repo = "json";
     rev = "v${version}";
-    sha256 = "04rry1xzis71z5gj1ylcj8b4li5q18zxhcwaviwvi3hx0frzxl9w";
+    sha256 = "sha256-THordDPdH2qwk6lFTgeFmkl7iDuA/7YH71PTUe6vJCs=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/pcre2/default.nix b/pkgs/development/libraries/pcre2/default.nix
index b127eb0a31e..8f06630882c 100644
--- a/pkgs/development/libraries/pcre2/default.nix
+++ b/pkgs/development/libraries/pcre2/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "pcre2";
-  version = "10.35";
+  version = "10.36";
   src = fetchurl {
     url = "https://ftp.pcre.org/pub/pcre/${pname}-${version}.tar.bz2";
-    sha256 = "04s6kmk9qdd4rjz477h547j4bx7hfz0yalpvrm381rqc5ghaijww";
+    sha256 = "0p3699msps07p40g9426lvxa3b41rg7k2fn7qxl2jm0kh4kkkvx9";
   };
 
   configureFlags = [
diff --git a/pkgs/development/libraries/physics/geant4/datasets.nix b/pkgs/development/libraries/physics/geant4/datasets.nix
index 85ad11b79b1..42014949c0b 100644
--- a/pkgs/development/libraries/physics/geant4/datasets.nix
+++ b/pkgs/development/libraries/physics/geant4/datasets.nix
@@ -42,22 +42,22 @@ in
 
     {
       name = "G4EMLOW";
-      version = "7.9.1";
-      sha256 = "1jrw0izw732bywq1k1srs3x2z0m3y2h377kcvwbwcr0wa1p10342";
+      version = "7.13";
+      sha256 = "0scczd4ismvd4g3vfshbvwv92bzkdjz0ma7y21n6qxxy96v9cj1p";
       envvar = "LE";
     }
 
     {
       name = "G4PhotonEvaporation";
-      version = "5.5";
-      sha256 = "1mvnbs7yvkii41blks6bkqr8qhxgnj3xxvv1i3vdg2y14shxv5ar";
+      version = "5.7";
+      sha256 = "1rg7fygfxx06h98ywlci6b0b9ih74q8diygr76c3vppxdzjl47kn";
       envvar = "LEVELGAMMA";
     }
 
     {
       name = "G4RadioactiveDecay";
-      version = "5.4";
-      sha256 = "0qaark6mqzxr3lqawv6ai8z5211qihlp5x2hn86vzx8kgpd7j1r4";
+      version = "5.6";
+      sha256 = "1w8d9zzc4ss7sh1f8cxv5pmrx2b74p1y26377rw9hnlfkiy0g1iq";
       envvar = "RADIOACTIVE";
     }
 
@@ -70,8 +70,8 @@ in
 
     {
       name = "G4PARTICLEXS";
-      version = "2.1";
-      sha256 = "0h8ba8jk197npbd9lzq2qlfiklbjgqwk45m1cc6piy5vf8ri0k89";
+      version = "3.1";
+      sha256 = "1kg9y0kqn4lma7b0yjpgj7s9n317yqi54ydvq365qphnmm7ahka0";
       envvar = "PARTICLEXS";
     }
 
@@ -98,15 +98,15 @@ in
 
     {
       name = "G4ENSDFSTATE";
-      version = "2.2";
-      sha256 = "19p0sq0rmyg48j9hddqy24dn99md7ddiyq09lyj381q7cbpjfznx";
+      version = "2.3";
+      sha256 = "00wjir59rrrlk0a12vi8rsnhyya71rdi1kmark9sp487hbhcai4l";
       envvar = "ENSDFSTATE";
     }
 
     {
       name = "G4RealSurface";
-      version = "2.1.1";
-      sha256 = "0l3gs0nlp10cjlwiln3f72zfch0av2g1r8m2ny9afgvwgbwiyj4h";
+      version = "2.2";
+      sha256 = "08382y1258ifs7nap6zaaazvabg72blr0dkqgwk32lrg07hdwm4r";
       envvar = "REALSURFACE";
     }
 
diff --git a/pkgs/development/libraries/physics/geant4/default.nix b/pkgs/development/libraries/physics/geant4/default.nix
index dc809d58932..7caae2c52d3 100644
--- a/pkgs/development/libraries/physics/geant4/default.nix
+++ b/pkgs/development/libraries/physics/geant4/default.nix
@@ -48,20 +48,20 @@ let
 in
 
 stdenv.mkDerivation rec {
-  version = "10.6.3";
+  version = "10.7.0";
   pname = "geant4";
 
   src = fetchurl{
-    url = "https://geant4-data.web.cern.ch/geant4-data/releases/geant4.10.06.p03.tar.gz";
-    sha256 = "1wzv5xky1pfm7wdfdkvqcaaqlcnsrz35dc7zcrxh8l3j5rki6pqb";
+    url = "https://geant4-data.web.cern.ch/geant4-data/releases/geant4.10.07.tar.gz";
+    sha256 = "0jmdxb8z20d4l6sf2w0gk9ska48kylm38yngy3mzyvyj619a8vkp";
   };
 
   boost_python_lib = "python${builtins.replaceStrings ["."] [""] python3.pythonVersion}";
   postPatch = ''
     # Fix for boost 1.67+
     substituteInPlace environments/g4py/CMakeLists.txt \
-      --replace "find_package(Boost REQUIRED python)" \
-                "find_package(Boost REQUIRED COMPONENTS $boost_python_lib)"
+      --replace "REQUIRED python" \
+                "REQUIRED COMPONENTS $boost_python_lib"
     substituteInPlace environments/g4py/G4PythonHelpers.cmake \
       --replace "Boost::python" "Boost::$boost_python_lib"
   '';
diff --git a/pkgs/development/libraries/physics/rivet/default.nix b/pkgs/development/libraries/physics/rivet/default.nix
index abf37def8c3..f95328964bf 100644
--- a/pkgs/development/libraries/physics/rivet/default.nix
+++ b/pkgs/development/libraries/physics/rivet/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rivet";
-  version = "3.1.2";
+  version = "3.1.3";
 
   src = fetchurl {
     url = "https://www.hepforge.org/archive/rivet/Rivet-${version}.tar.bz2";
-    sha256 = "0yjpx7n6ry3pfgkf7d7v7mcc3yv7681kf8nq2b1fgspl8jbd0hf0";
+    sha256 = "08g0f84l7r6vm4n7gn36qi3bzacscpv061m9xar2572vf10wxpak";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/physics/yoda/default.nix b/pkgs/development/libraries/physics/yoda/default.nix
index 273566adc03..3a8fbbbdd52 100644
--- a/pkgs/development/libraries/physics/yoda/default.nix
+++ b/pkgs/development/libraries/physics/yoda/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "yoda";
-  version = "1.8.4";
+  version = "1.8.5";
 
   src = fetchurl {
     url = "https://www.hepforge.org/archive/yoda/YODA-${version}.tar.bz2";
-    sha256 = "03hm7hax0n5irqi0kzjag6fyr9zws9jqz95hr8afpikwkcfa894x";
+    sha256 = "1z9jmabsaddhs003zzq73fpq2absd12rnc2sa5qn45zwf62nnbjc";
   };
 
   nativeBuildInputs = with python.pkgs; [ cython makeWrapper ];
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index b4e3d681c74..b4486bf025d 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -88,11 +88,17 @@ let
       })
     ]
       ++ optional stdenv.isDarwin ./qtwebengine-darwin-no-platform-check.patch;
-    qtwebkit = [ ./qtwebkit.patch ]
-      ++ optionals stdenv.isDarwin [
-        ./qtwebkit-darwin-no-readline.patch
-        ./qtwebkit-darwin-no-qos-classes.patch
-      ];
+    qtwebkit = [
+      (fetchpatch {
+        name = "qtwebkit-bison-3.7-build.patch";
+        url = "https://github.com/qtwebkit/qtwebkit/commit/d92b11fea65364fefa700249bd3340e0cd4c5b31.patch";
+        sha256 = "0h8ymfnwgkjkwaankr3iifiscsvngqpwb91yygndx344qdiw9y0n";
+      })
+      ./qtwebkit.patch
+    ] ++ optionals stdenv.isDarwin [
+      ./qtwebkit-darwin-no-readline.patch
+      ./qtwebkit-darwin-no-qos-classes.patch
+    ];
     qttools = [ ./qttools.patch ];
   };
 
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebkit.nix b/pkgs/development/libraries/qt-5/modules/qtwebkit.nix
index b31e57f3806..3d9e72bb54f 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebkit.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebkit.nix
@@ -72,7 +72,6 @@ qtModule {
   preFixup = ''rm -rf "$(pwd)" && mkdir "$(pwd)" '';
 
   meta = {
-    broken = lib.versionAtLeast qtbase.version "5.15";
     maintainers = with stdenv.lib.maintainers; [ abbradar periklis ];
   };
 }
diff --git a/pkgs/development/libraries/smesh/default.nix b/pkgs/development/libraries/smesh/default.nix
index 529f910c35a..9a52c42c939 100644
--- a/pkgs/development/libraries/smesh/default.nix
+++ b/pkgs/development/libraries/smesh/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, ninja, opencascade }:
+{ stdenv, fetchFromGitHub, fetchpatch, cmake, ninja, opencascade }:
 
 stdenv.mkDerivation rec {
   pname = "smesh";
@@ -11,6 +11,14 @@ stdenv.mkDerivation rec {
     sha256 = "1b07j3bw3lnxk8dk3x1kkl2mbsmfwi98si84054038lflaaijzi0";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "fix-build-with-clang.patch";
+      url = "https://github.com/tpaviot/smesh/commit/e32c430f526f1637ec5973c9723acbc5be571ae3.patch";
+      sha256 = "0s4j5rb70g3jvvkgfbrxv7q52wk6yjyjiaya61gy2j64khplcjlb";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ninja ];
   buildInputs = [ opencascade ];
 
diff --git a/pkgs/development/libraries/smpeg2/default.nix b/pkgs/development/libraries/smpeg2/default.nix
index fc42ab989eb..270e418174e 100644
--- a/pkgs/development/libraries/smpeg2/default.nix
+++ b/pkgs/development/libraries/smpeg2/default.nix
@@ -1,21 +1,28 @@
-{ stdenv, darwin, fetchsvn, autoconf, automake, pkgconfig, makeWrapper, SDL2 }:
+{ stdenv
+, autoconf
+, automake
+, darwin
+, fetchsvn
+, makeWrapper
+, pkg-config
+, SDL2
+}:
 
 stdenv.mkDerivation rec {
-  name = "smpeg2-svn${version}";
-  version = "412";
+  pname = "smpeg2";
+  version = "unstable-2017-10-18";
 
   src = fetchsvn {
     url = "svn://svn.icculus.org/smpeg/trunk";
-    rev = version;
-    sha256 = "1irf2d8f150j8cx8lbb0pz1rijap536crsz0mw871xrh6wd2fd96";
+    rev = "413";
+    sha256 = "193amdwgxkb1zp7pgr72fvrdhcg3ly72qpixfxxm85rzz8g2kr77";
   };
 
   patches = [
-    ./gcc6.patch
-    ./sdl2.patch
+    ./hufftable-uint_max.patch
   ];
 
-  nativeBuildInputs = [ autoconf automake pkgconfig makeWrapper ];
+  nativeBuildInputs = [ autoconf automake makeWrapper pkg-config ];
 
   buildInputs = [ SDL2 ]
     ++ stdenv.lib.optional stdenv.isDarwin darwin.libobjc;
@@ -25,10 +32,8 @@ stdenv.mkDerivation rec {
   '';
 
   postInstall = ''
-    sed -e 's,#include "\(SDL.*.h\)",#include <SDL2/\1>,' -i $out/include/smpeg2/*.h
-
     wrapProgram $out/bin/smpeg2-config \
-      --prefix PATH ":" "${pkgconfig}/bin" \
+      --prefix PATH ":" "${pkg-config}/bin" \
       --prefix PKG_CONFIG_PATH ":" "${SDL2.dev}/lib/pkgconfig"
   '';
 
diff --git a/pkgs/development/libraries/smpeg2/gcc6.patch b/pkgs/development/libraries/smpeg2/hufftable-uint_max.patch
index 165feb4428c..165feb4428c 100644
--- a/pkgs/development/libraries/smpeg2/gcc6.patch
+++ b/pkgs/development/libraries/smpeg2/hufftable-uint_max.patch
diff --git a/pkgs/development/libraries/smpeg2/sdl2.patch b/pkgs/development/libraries/smpeg2/sdl2.patch
deleted file mode 100644
index 63bc352976e..00000000000
--- a/pkgs/development/libraries/smpeg2/sdl2.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-diff --git a/smpeg2-config.in b/smpeg2-config.in
-index 5cce954..0e61939 100644
---- a/smpeg2-config.in
-+++ b/smpeg2-config.in
-@@ -42,7 +42,7 @@ while test $# -gt 0; do
-       if test @includedir@ != /usr/include ; then
-         includes=-I@includedir@
-       fi
--      echo $includes -I@includedir@/smpeg2 `@SDL_CONFIG@ --cflags`
-+      echo $includes -I@includedir@/smpeg2 `@SDL2_CONFIG@ --cflags`
-       ;;
-     --libs)
-       if [ "`uname`" = "SunOS" ]; then
-@@ -50,7 +50,7 @@ while test $# -gt 0; do
-       else
-         libdirs="-L@libdir@ @SMPEG_RLD_FLAGS@"
-       fi
--      echo $libdirs -lsmpeg2 `@SDL_CONFIG@ --libs`
-+      echo $libdirs -lsmpeg2 `@SDL2_CONFIG@ --libs`
-       ;;
-     *)
-       echo "${usage}" 1>&2
diff --git a/pkgs/development/libraries/spdlog/default.nix b/pkgs/development/libraries/spdlog/default.nix
index 2022ec7caaa..fbe7af1825e 100644
--- a/pkgs/development/libraries/spdlog/default.nix
+++ b/pkgs/development/libraries/spdlog/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake }:
+{ stdenv, fetchFromGitHub, cmake, fmt }:
 
 let
   generic = { version, sha256 }:
@@ -14,12 +14,14 @@ let
       };
 
       nativeBuildInputs = [ cmake ];
+      buildInputs = [ fmt ];
 
       cmakeFlags = [
         "-DSPDLOG_BUILD_SHARED=ON"
         "-DSPDLOG_BUILD_EXAMPLE=OFF"
         "-DSPDLOG_BUILD_BENCH=OFF"
         "-DSPDLOG_BUILD_TESTS=ON"
+        "-DSPDLOG_FMT_EXTERNAL=ON"
       ];
 
       outputs = [ "out" "doc" ];
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 4393b631461..f0bbc93a6f1 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -10,12 +10,12 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite";
-  version = "3.33.0";
+  version = "3.34.0";
 
   # NB! Make sure to update ./tools.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2020/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    sha256 = "05dvdfaxd552gj5p7k0i72sfam7lykaw1g2pfn52jnppqx42qshh";
+    sha256 = "1vlsvlp5nvhd5pdjpmdczfsv7mml2gsalykl6x3palbxwgxbfvdz";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/libraries/sqlite/tools.nix b/pkgs/development/libraries/sqlite/tools.nix
index 3ac1f617862..0eb913adb3b 100644
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@@ -4,11 +4,11 @@ let
   archiveVersion = import ./archive-version.nix stdenv.lib;
   mkTool = { pname, makeTarget, description, homepage }: stdenv.mkDerivation rec {
     inherit pname;
-    version = "3.33.0";
+    version = "3.34.0";
 
     src = assert version == sqlite.version; fetchurl {
       url = "https://sqlite.org/2020/sqlite-src-${archiveVersion version}.zip";
-      sha256 = "1f09srlrmcab1sf8j2d89s2kvknlbxk7mbsiwpndw9mall27dgwh";
+      sha256 = "0giklai05shqalj1wwadi9hg5dx6vff8nrblqh9xxljnrq701hm5";
     };
 
     nativeBuildInputs = [ unzip ];
diff --git a/pkgs/development/libraries/tracker/default.nix b/pkgs/development/libraries/tracker/default.nix
index ee50d654795..e37db9f2533 100644
--- a/pkgs/development/libraries/tracker/default.nix
+++ b/pkgs/development/libraries/tracker/default.nix
@@ -1,5 +1,6 @@
 { stdenv
 , fetchurl
+, fetchpatch
 , gettext
 , meson
 , ninja
@@ -43,6 +44,13 @@ stdenv.mkDerivation rec {
       src = ./fix-paths.patch;
       inherit asciidoc;
     })
+
+    # Fix consistency error with sqlite 3.34
+    # https://gitlab.gnome.org/GNOME/tracker/merge_requests/353
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/tracker/commit/040e22d005985a19a0dc435a7631f91700804ce4.patch";
+      sha256 = "5OZj17XY8ZnXfMMim25HvGfFKUlsVlVHOUjZKfBKHcs=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/eliom/default.nix b/pkgs/development/ocaml-modules/eliom/default.nix
index 4734d83d55f..de2955e57c9 100644
--- a/pkgs/development/ocaml-modules/eliom/default.nix
+++ b/pkgs/development/ocaml-modules/eliom/default.nix
@@ -14,11 +14,11 @@ else
 stdenv.mkDerivation rec
 {
   pname = "eliom";
-  version = "6.12.1";
+  version = "6.12.4";
 
   src = fetchzip {
     url = "https://github.com/ocsigen/eliom/archive/${version}.tar.gz";
-    sha256 = "04c1sz113015gyhj3w7flw7l4bv0v50q6n04kk8dybcravzy2xgx";
+    sha256 = "00m6v2k4mg8705dy41934lznl6gj91i6dk7p1nkaccm51nna25kz";
   };
 
   buildInputs = [ ocaml which findlib js_of_ocaml-ocamlbuild js_of_ocaml-ppx_deriving_json opaline
diff --git a/pkgs/development/python-modules/afdko/default.nix b/pkgs/development/python-modules/afdko/default.nix
index f1e3bf0cd56..6371fa804bb 100644
--- a/pkgs/development/python-modules/afdko/default.nix
+++ b/pkgs/development/python-modules/afdko/default.nix
@@ -3,7 +3,7 @@
 , brotli, fontmath, mutatormath, booleanoperations
 , ufoprocessor, ufonormalizer, psautohint, tqdm
 , setuptools_scm
-, pytest
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -52,10 +52,18 @@ buildPythonPackage rec {
   # https://github.com/adobe-type-tools/afdko/issues/1163
   # https://github.com/adobe-type-tools/afdko/issues/1216
   doCheck = stdenv.isx86_64;
-  checkInputs = [ pytest ];
-  checkPhase = ''
-    PATH="$PATH:$out/bin" py.test
-  '';
+  checkInputs = [ pytestCheckHook ];
+  preCheck = "export PATH=$PATH:$out/bin";
+  disabledTests = [
+    # Disable slow tests, reduces test time ~25 %
+    "test_report"
+    "test_post_overflow"
+    "test_cjk"
+    "test_extrapolate"
+    "test_filename_without_dir"
+    "test_overwrite"
+    "test_options"
+  ];
 
   meta = with stdenv.lib; {
     description = "Adobe Font Development Kit for OpenType";
diff --git a/pkgs/development/python-modules/black/default.nix b/pkgs/development/python-modules/black/default.nix
index f0a25dfb0b1..3346afbb4ab 100644
--- a/pkgs/development/python-modules/black/default.nix
+++ b/pkgs/development/python-modules/black/default.nix
@@ -5,6 +5,7 @@
 , appdirs
 , attrs
 , click
+, dataclasses
 , mypy-extensions
 , pathspec
 , regex
@@ -59,7 +60,7 @@ buildPythonPackage rec {
     toml
     typed-ast
     typing-extensions
-  ];
+  ] ++ lib.optional (pythonOlder "3.7") dataclasses;
 
   meta = with lib; {
     description = "The uncompromising Python code formatter";
diff --git a/pkgs/development/python-modules/hass-nabucasa/default.nix b/pkgs/development/python-modules/hass-nabucasa/default.nix
index 1739183c3a8..074085bf8f7 100644
--- a/pkgs/development/python-modules/hass-nabucasa/default.nix
+++ b/pkgs/development/python-modules/hass-nabucasa/default.nix
@@ -15,6 +15,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     sed -i 's/"acme.*"/"acme"/' setup.py
+    sed -i 's/"attrs.*"/"attrs"/' setup.py
     sed -i 's/"cryptography.*"/"cryptography"/' setup.py
   '';
 
diff --git a/pkgs/development/python-modules/maestral/default.nix b/pkgs/development/python-modules/maestral/default.nix
index 125270ef123..cb7119860f5 100644
--- a/pkgs/development/python-modules/maestral/default.nix
+++ b/pkgs/development/python-modules/maestral/default.nix
@@ -3,20 +3,22 @@
 , fetchFromGitHub
 , pythonOlder
 , python
-, alembic, bugsnag, click, dropbox, fasteners, keyring, keyrings-alt, packaging, pathspec, Pyro5, requests, setuptools, sdnotify, sqlalchemy, watchdog
+, alembic, bugsnag, click, dropbox, fasteners, keyring, keyrings-alt, packaging, pathspec, Pyro5, requests, setuptools, sdnotify, sqlalchemy, survey, watchdog
+, importlib-metadata
+, importlib-resources
 , dbus-next
 }:
 
 buildPythonPackage rec {
   pname = "maestral";
-  version = "1.2.1";
+  version = "1.3.1";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "SamSchott";
     repo = "maestral";
     rev = "v${version}";
-    sha256 = "sha256-kh3FYBSVOU4ywrYl6ONEIbLbkSuZmexNJC9dB+JtUjM=";
+    sha256 = "sha256-SspyTdmAbbmWN3AqVp9bj/QfAKLVgU2bLiiHjZO0aCM=";
   };
 
   propagatedBuildInputs = [
@@ -34,7 +36,12 @@ buildPythonPackage rec {
     setuptools
     sdnotify
     sqlalchemy
+    survey
     watchdog
+  ] ++ stdenv.lib.optionals (pythonOlder "3.8") [
+    importlib-metadata
+  ] ++ stdenv.lib.optionals (pythonOlder "3.9") [
+    importlib-resources
   ] ++ stdenv.lib.optionals stdenv.isLinux [
     dbus-next
   ];
diff --git a/pkgs/development/python-modules/psautohint/default.nix b/pkgs/development/python-modules/psautohint/default.nix
index fb9237c8934..61828ddff00 100644
--- a/pkgs/development/python-modules/psautohint/default.nix
+++ b/pkgs/development/python-modules/psautohint/default.nix
@@ -1,7 +1,7 @@
 { lib, buildPythonPackage, fetchFromGitHub, pythonOlder
 , fonttools, lxml, fs
 , setuptools_scm
-, pytest, pytestcov, pytest_xdist, pytest-randomly
+, pytestCheckHook, pytest_5, pytestcov, pytest_xdist
 }:
 
 buildPythonPackage rec {
@@ -11,10 +11,10 @@ buildPythonPackage rec {
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
-    owner  = "adobe-type-tools";
-    repo   = pname;
+    owner = "adobe-type-tools";
+    repo = pname;
+    rev = "v${version}";
     sha256 = "1s2l54gzn11y07zaggprwif7r3ia244qijjhkbvjdx4jsgc5df8n";
-    rev    = "v${version}";
     fetchSubmodules = true; # data dir for tests
   };
 
@@ -28,8 +28,24 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ fonttools lxml fs ];
 
-  checkInputs = [ pytest pytestcov pytest_xdist pytest-randomly ];
-  checkPhase = "pytest tests";
+  checkInputs = [
+    # Override pytestCheckHook to use pytest v5, because some tests fail on pytest >= v6
+    # https://github.com/adobe-type-tools/psautohint/issues/284#issuecomment-742800965
+    # Override might be able to be removed in future, check package dependency pins (coverage.yml)
+    (pytestCheckHook.override{ pytest = pytest_5; })
+    pytestcov
+    pytest_xdist
+  ];
+  disabledTests = [
+    # Slow tests, reduces test time from ~5 mins to ~30s
+    "test_mmufo"
+    "test_flex_ufo"
+    "test_ufo"
+    "test_flex_otf"
+    "test_multi_outpath"
+    "test_mmhint"
+    "test_otf"
+  ];
 
   meta = with lib; {
     description = "Script to normalize the XML and other data inside of a UFO";
diff --git a/pkgs/development/python-modules/pyopenssl/default.nix b/pkgs/development/python-modules/pyopenssl/default.nix
index 33fd3c6e10d..d9d2b382f50 100644
--- a/pkgs/development/python-modules/pyopenssl/default.nix
+++ b/pkgs/development/python-modules/pyopenssl/default.nix
@@ -65,11 +65,11 @@ in
 
 buildPythonPackage rec {
   pname = "pyOpenSSL";
-  version = "19.1.0";
+  version = "20.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9a24494b2602aaf402be5c9e30a0b82d4a5c67528fe8fb475e3f3bc00dd69507";
+    sha256 = "1i8ab5zn9i9iq2ksizp3rd42v157kacddzz88kviqw3kpp68xw4j";
   };
 
   outputs = [ "out" "dev" ];
@@ -81,27 +81,6 @@ buildPythonPackage rec {
     runHook postCheck
   '';
 
-  patches = [
-    # 4 patches for 2020 bug
-    # https://github.com/pyca/pyopenssl/pull/828
-    (fetchpatch {
-      url = "https://github.com/pyca/pyopenssl/commit/0d2fd1a24b30077ead6960bd63b4a9893a57c101.patch";
-      sha256 = "1c27g53qrwxddyx04sxf8yvj7xgbaabla7mc1cgbfd426rncbqf3";
-    })
-    (fetchpatch {
-      url = "https://github.com/pyca/pyopenssl/commit/d08a742573c3205348a4eec9a65abaf6c16110c4.patch";
-      sha256 = "18xn8s1wpycz575ivrbsbs0qd2q48z8pdzsjzh8i60xba3f8yj2f";
-    })
-    (fetchpatch {
-      url = "https://github.com/pyca/pyopenssl/commit/60b9e10e6da7ccafaf722def630285f54510ed12.patch";
-      sha256 = "0aw8qvy8m0bhgp39lmbcrpprpg4bhpssm327hyrk476wwgajk01j";
-    })
-    (fetchpatch {
-      url = "https://github.com/pyca/pyopenssl/commit/7a37cc23fcbe43abe785cd4badd14bdc7acfb175.patch";
-      sha256 = "1c7zb568rs71rsl16p6dq7aixwlkgzfnba4vzmfvbmy3zsnaslq2";
-    })
-  ];
-
   # Seems to fail unpredictably on Darwin. See https://hydra.nixos.org/build/49877419/nixlog/1
   # for one example, but I've also seen ContextTests.test_set_verify_callback_exception fail.
   doCheck = !stdenv.isDarwin;
diff --git a/pkgs/development/python-modules/pytorch/default.nix b/pkgs/development/python-modules/pytorch/default.nix
index ff7a0e5107f..f072972937a 100644
--- a/pkgs/development/python-modules/pytorch/default.nix
+++ b/pkgs/development/python-modules/pytorch/default.nix
@@ -112,7 +112,7 @@ let
 in buildPythonPackage rec {
   pname = "pytorch";
   # Don't forget to update pytorch-bin to the same version.
-  version = "1.7.0";
+  version = "1.7.1";
 
   disabled = !isPy3k;
 
@@ -127,7 +127,7 @@ in buildPythonPackage rec {
     repo   = "pytorch";
     rev    = "v${version}";
     fetchSubmodules = true;
-    sha256 = "0hb11m5kvs4nsi5bc9ijnv6k07593p9dw40rcn33s9vspinrcjd4";
+    sha256 = "sha256-udpbSL8xnzf20A1pYYNlYjdp8ME8AVaAkMMiw53K6CU=";
   };
 
   patches = lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/python-modules/qasm2image/default.nix b/pkgs/development/python-modules/qasm2image/default.nix
deleted file mode 100644
index 962ba62f509..00000000000
--- a/pkgs/development/python-modules/qasm2image/default.nix
+++ /dev/null
@@ -1,53 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, cairocffi
-, cairosvg
-, cffi
-, qiskit
-, svgwrite
-, colorama
-, python
-, pythonOlder
-}:
-
-buildPythonPackage {
-  pname = "qasm2image";
-  version = "0.8.0";
-
-  src = fetchFromGitHub {
-    owner = "nelimee";
-    repo = "qasm2image";
-    rev = "2c01756946ba9782973359dbd7bbf6651af6bee5";
-    sha256 = "1bnkzv7wrdvrq71dmsqanb3v2hcsxh5zaglfcxm2d9zzpmvb4a2n";
-  };
-
-  disabled = pythonOlder "3.5";
-
-  propagatedBuildInputs = [
-    cairocffi
-    cairosvg
-    cffi
-    qiskit
-    svgwrite
-  ];
-
-  checkInputs = [
-    colorama
-  ];
-  checkPhase = ''
-    ${python.interpreter} tests/launch_tests.py
-  '';
-
-  LC_ALL="en_US.UTF-8";
-
-  meta = {
-    description = "A Python module to visualise quantum circuit";
-    homepage    = "https://github.com/nelimeee/qasm2image";
-    license     = lib.licenses.cecill-b;
-    maintainers = with lib.maintainers; [
-      pandaman
-    ];
-    broken = true;  # last update Oct 2018, failed tests don't error the build, and out-of-date with latest python3Packages.qiskit
-  };
-}
diff --git a/pkgs/development/python-modules/qiskit-aer/default.nix b/pkgs/development/python-modules/qiskit-aer/default.nix
index 57d89b55711..e5eb877b6b2 100644
--- a/pkgs/development/python-modules/qiskit-aer/default.nix
+++ b/pkgs/development/python-modules/qiskit-aer/default.nix
@@ -8,6 +8,7 @@
 , catch2
 , cmake
 , cython
+, fmt
 , muparserx
 , ninja
 , nlohmann_json
@@ -47,6 +48,7 @@ buildPythonPackage rec {
   buildInputs = [
     blas
     catch2
+    fmt
     muparserx
     nlohmann_json
     spdlog
diff --git a/pkgs/development/python-modules/setuptools/default.nix b/pkgs/development/python-modules/setuptools/default.nix
index f30e8dd5cdb..987c75ba5a0 100644
--- a/pkgs/development/python-modules/setuptools/default.nix
+++ b/pkgs/development/python-modules/setuptools/default.nix
@@ -38,7 +38,7 @@ let
       # Here we untar the sdist and retar it in order to control the timestamps
       # of all the files included
       tar -xzf dist/${pname}-${version}.post0.tar.gz -C dist/
-      tar -czf dist/${name} -C dist/ --mtime="@$SOURCE_DATE_EPOCH"  ${pname}-${version}.post0
+      tar -czf dist/${name} -C dist/ --mtime="@$SOURCE_DATE_EPOCH" --sort=name ${pname}-${version}.post0
     '';
 
     installPhase = ''
diff --git a/pkgs/development/python-modules/sqlparse/default.nix b/pkgs/development/python-modules/sqlparse/default.nix
index 635111b95d9..3ee59c391f8 100644
--- a/pkgs/development/python-modules/sqlparse/default.nix
+++ b/pkgs/development/python-modules/sqlparse/default.nix
@@ -1,7 +1,8 @@
-{ stdenv
+{ lib
 , buildPythonPackage
 , fetchPypi
-, pytest
+, installShellFiles
+, pytestCheckHook
 , isPy3k
 }:
 
@@ -9,20 +10,22 @@ buildPythonPackage rec {
   pname = "sqlparse";
   version = "0.4.1";
 
+  disabled = !isPy3k;
+
   src = fetchPypi {
     inherit pname version;
     sha256 = "0f91fd2e829c44362cbcfab3e9ae12e22badaa8a29ad5ff599f9ec109f0454e8";
   };
 
-  checkInputs = [ pytest ];
-  checkPhase = ''
-    py.test
-  '';
+  nativeBuildInputs = [ installShellFiles ];
 
-  # Package supports 3.x, but tests are clearly 2.x only.
-  doCheck = !isPy3k;
+  checkInputs = [ pytestCheckHook ];
 
-  meta = with stdenv.lib; {
+  postInstall = ''
+    installManPage docs/sqlformat.1
+  '';
+
+  meta = with lib; {
     description = "Non-validating SQL parser for Python";
     longDescription = ''
       Provides support for parsing, splitting and formatting SQL statements.
@@ -30,5 +33,4 @@ buildPythonPackage rec {
     homepage = "https://github.com/andialbrecht/sqlparse";
     license = licenses.bsd3;
   };
-
 }
diff --git a/pkgs/development/python-modules/survey/default.nix b/pkgs/development/python-modules/survey/default.nix
new file mode 100644
index 00000000000..1f5438140e2
--- /dev/null
+++ b/pkgs/development/python-modules/survey/default.nix
@@ -0,0 +1,29 @@
+{ stdenv
+, buildPythonPackage
+, fetchPypi
+, wrapio
+}:
+
+buildPythonPackage rec {
+  pname = "survey";
+  version = "3.1.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-R/PfXW/CnqYiOWbCxPAYwneg6j6CLvdIpITZ2eIXn+M=";
+  };
+
+  propagatedBuildInputs = [
+    wrapio
+  ];
+
+  doCheck = false;
+  pythonImportsCheck = [ "survey" ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/Exahilosys/survey";
+    description = "A simple library for creating beautiful interactive prompts";
+    license = licenses.mit;
+    maintainers = with maintainers; [ sfrijters ];
+  };
+}
diff --git a/pkgs/development/python-modules/tldextract/default.nix b/pkgs/development/python-modules/tldextract/default.nix
index 02359ce67a5..b91289e5061 100644
--- a/pkgs/development/python-modules/tldextract/default.nix
+++ b/pkgs/development/python-modules/tldextract/default.nix
@@ -1,5 +1,5 @@
 { lib, fetchPypi, buildPythonPackage, setuptools_scm
-, requests, requests-file, idna, pytest
+, requests, requests-file, idna, filelock, pytest
 , responses
 }:
 
@@ -12,14 +12,17 @@ buildPythonPackage rec {
     sha256 = "cfae9bc8bda37c3e8c7c8639711ad20e95dc85b207a256b60b0b23d7ff5540ea";
   };
 
-  propagatedBuildInputs = [ requests requests-file idna ];
+  propagatedBuildInputs = [ requests requests-file idna filelock ];
   checkInputs = [ pytest responses ];
   nativeBuildInputs = [ setuptools_scm ];
 
+  # No tests included
+  doCheck = false;
+  pythonImportsCheck = [ "tldextract" ];
+
   meta = {
     homepage = "https://github.com/john-kurkowski/tldextract";
-    description = "Accurately separate the TLD from the registered domain and subdomains of a URL, using the Public Suffix List.";
+    description = "Accurately separate the TLD from the registered domain and subdomains of a URL, using the Public Suffix List";
     license = lib.licenses.bsd3;
   };
-
 }
diff --git a/pkgs/development/python-modules/traitlets/4.nix b/pkgs/development/python-modules/traitlets/4.nix
new file mode 100644
index 00000000000..bffd7c790be
--- /dev/null
+++ b/pkgs/development/python-modules/traitlets/4.nix
@@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, glibcLocales
+, pytest
+, mock
+, ipython_genutils
+, decorator
+, enum34
+, pythonOlder
+, six
+}:
+
+buildPythonPackage rec {
+  pname = "traitlets";
+  version = "4.3.3";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "d023ee369ddd2763310e4c3eae1ff649689440d4ae59d7485eb4cfbbe3e359f7";
+  };
+
+  checkInputs = [ glibcLocales pytest mock ];
+  propagatedBuildInputs = [ ipython_genutils decorator six ] ++ lib.optional (pythonOlder "3.4") enum34;
+
+  checkPhase = ''
+    LC_ALL="en_US.UTF-8" py.test
+  '';
+
+  meta = {
+    description = "Traitlets Python config system";
+    homepage = "http://ipython.org/";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
diff --git a/pkgs/development/python-modules/traitlets/default.nix b/pkgs/development/python-modules/traitlets/default.nix
index 5d304c61f5c..3bc05897af6 100644
--- a/pkgs/development/python-modules/traitlets/default.nix
+++ b/pkgs/development/python-modules/traitlets/default.nix
@@ -1,6 +1,5 @@
 { lib
 , buildPythonPackage
-, isPy27
 , fetchPypi
 , glibcLocales
 , pytest
@@ -15,7 +14,7 @@
 buildPythonPackage rec {
   pname = "traitlets";
   version = "5.0.5";
-  disabled = isPy27;
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
@@ -23,7 +22,7 @@ buildPythonPackage rec {
   };
 
   checkInputs = [ glibcLocales pytest mock ];
-  propagatedBuildInputs = [ ipython_genutils decorator six ] ++ lib.optional (pythonOlder "3.4") enum34;
+  propagatedBuildInputs = [ ipython_genutils decorator six ];
 
   checkPhase = ''
     LC_ALL="en_US.UTF-8" py.test
diff --git a/pkgs/tools/admin/vncdo/default.nix b/pkgs/development/python-modules/vncdo/default.nix
index 5ca633a944b..ffc01906f45 100644
--- a/pkgs/tools/admin/vncdo/default.nix
+++ b/pkgs/development/python-modules/vncdo/default.nix
@@ -1,18 +1,23 @@
 { stdenv, fetchFromGitHub
-, python2Packages
+, buildPythonPackage, isPy27
+, pillow
+, twisted
+, pexpect
+, nose
+, ptyprocess
 }:
-python2Packages.buildPythonPackage {
+buildPythonPackage rec {
   pname = "vncdo";
-  version = "0.11.2";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "sibson";
     repo = "vncdotool";
-    rev = "5c03a82dcb5a3bd9e8f741f8a8d0c1ce082f2834";
-    sha256 = "0k03b09ipsz8vp362x7sx7z68mxgqw9qzvkii2f8j9vx2y79rjsh";
+    rev = "v${version}";
+    sha256 = "0h3ccr8zi7xpgn6hz43x1045x5l4bhha7py8x00g8bv6gaqlbwxn";
   };
 
-  propagatedBuildInputs = with python2Packages; [
+  propagatedBuildInputs = [
     pillow
     twisted
     pexpect
@@ -20,7 +25,7 @@ python2Packages.buildPythonPackage {
     ptyprocess
   ];
 
-  doCheck = false;
+  doCheck = !isPy27;
 
   meta = with stdenv.lib; {
     homepage = "https://github.com/sibson/vncdotool";
diff --git a/pkgs/development/python-modules/wrapio/default.nix b/pkgs/development/python-modules/wrapio/default.nix
new file mode 100644
index 00000000000..4289c202072
--- /dev/null
+++ b/pkgs/development/python-modules/wrapio/default.nix
@@ -0,0 +1,24 @@
+{ stdenv
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "wrapio";
+  version = "0.3.8";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-jGupLh+xzwil+VBtAjIG+ZYT+dy+QaZOTIfipTQeyWo";
+  };
+
+  doCheck = false;
+  pythonImportsCheck = [ "wrapio" ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/Exahilosys/wrapio";
+    description = "Handling event-based streams";
+    license = licenses.mit;
+    maintainers = with maintainers; [ sfrijters ];
+  };
+}
diff --git a/pkgs/development/tools/analysis/flow/default.nix b/pkgs/development/tools/analysis/flow/default.nix
index 23f35c2c788..2d4f58aef49 100644
--- a/pkgs/development/tools/analysis/flow/default.nix
+++ b/pkgs/development/tools/analysis/flow/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flow";
-  version = "0.138.0";
+  version = "0.139.0";
 
   src = fetchFromGitHub {
     owner  = "facebook";
     repo   = "flow";
     rev    = "refs/tags/v${version}";
-    sha256 = "08f7rihk663bwfxccl6fh6p5qn31025lhr5fmcxi3hl3jirwzb6n";
+    sha256 = "0ix98dq7g13jdfxgq0d8v2cvfnl2l2gz04j8h05sqzahbpxqv97w";
   };
 
   installPhase = ''
diff --git a/pkgs/development/tools/database/litecli/default.nix b/pkgs/development/tools/database/litecli/default.nix
index 3d24ac34b3e..163926f0e58 100644
--- a/pkgs/development/tools/database/litecli/default.nix
+++ b/pkgs/development/tools/database/litecli/default.nix
@@ -1,4 +1,4 @@
-{ lib, python3Packages }:
+{ lib, python3Packages, fetchpatch }:
 
 python3Packages.buildPythonApplication rec {
   pname = "litecli";
@@ -13,6 +13,14 @@ python3Packages.buildPythonApplication rec {
     sha256 = "FARWjtbS5zi/XQDyAVImUmArLj8xATz1jZ4jnXFdq1w=";
   };
 
+  patches = [
+    # Fix compatibility with sqlparse >= 0.4.0. Remove with the next release
+    (fetchpatch {
+      url = "https://github.com/dbcli/litecli/commit/37957e401d22f88800bbdec2c690e731f2cc13bd.patch";
+      sha256 = "1x82s2h1rzflyiahyd8pfya30rzs6yx6ij4a4s16f8iix5x35zv9";
+    })
+  ];
+
   propagatedBuildInputs = with python3Packages; [
     cli-helpers
     click
diff --git a/pkgs/development/tools/delve/default.nix b/pkgs/development/tools/delve/default.nix
index 892ee6dd329..e81a1273af8 100644
--- a/pkgs/development/tools/delve/default.nix
+++ b/pkgs/development/tools/delve/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "delve";
-  version = "1.5.0";
+  version = "1.5.1";
 
   goPackagePath = "github.com/go-delve/delve";
   excludedPackages = "\\(_fixtures\\|scripts\\|service/test\\)";
@@ -11,7 +11,7 @@ buildGoPackage rec {
     owner = "go-delve";
     repo = "delve";
     rev = "v${version}";
-    sha256 = "0m7fryclrj0qzqzcjn0xc9vl43srijyfahfkqdbm59xgpws67anp";
+    sha256 = "10zvla2jqxqibxdk3zbnsxg63i0zcwcn9npvw3bbicwd2z4vvskk";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/github-commenter/default.nix b/pkgs/development/tools/github-commenter/default.nix
index 969d7950cb9..8d25710aa2d 100644
--- a/pkgs/development/tools/github-commenter/default.nix
+++ b/pkgs/development/tools/github-commenter/default.nix
@@ -1,25 +1,25 @@
-{ lib, fetchFromGitHub, buildGoPackage }:
+{ lib, fetchFromGitHub, buildGoModule }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "github-commenter";
-  version = "0.5.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "cloudposse";
     repo = pname;
     rev = version;
-    sha256 = "0y7yw7x8gqfbkqdfrwd9lffx3rrp62nz1aa86liy2dja97dacpij";
+    sha256 = "HgiCgyig+49g275G6zZ0kGTxt1TSfFK8kt+SOf4ei74=";
   };
 
-  goPackagePath = "github.com/cloudposse/${pname}";
+  vendorSha256 = "Gw+cR5sA5MGuclcvur8olmRtK04LDP5vKJ5k7yZO3B0=";
 
-  goDeps = ./deps.nix;
+  goPackagePath = "github.com/cloudposse/${pname}";
 
   meta = with lib; {
     description = "Command line utility for creating GitHub comments on Commits, Pull Request Reviews or Issues";
     license = licenses.asl20;
     homepage = "https://github.com/cloudposse/github-commenter";
     maintainers = [ maintainers.mmahut ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/tools/github-commenter/deps.nix b/pkgs/development/tools/github-commenter/deps.nix
deleted file mode 100644
index 4b6be6c6d62..00000000000
--- a/pkgs/development/tools/github-commenter/deps.nix
+++ /dev/null
@@ -1,102 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.3.0
-[
-  {
-    goPackagePath = "github.com/Masterminds/goutils";
-    fetch = {
-      type = "git";
-      url = "https://github.com/Masterminds/goutils";
-      rev = "41ac8693c5c10a92ea1ff5ac3a7f95646f6123b0";
-      sha256 = "180px47gj936qyk5bkv5mbbgiil9abdjq6kwkf7sq70vyi9mcfiq";
-    };
-  }
-  {
-    goPackagePath = "github.com/Masterminds/semver";
-    fetch = {
-      type = "git";
-      url = "https://github.com/Masterminds/semver";
-      rev = "0fd41f6ff0825cf7efae00e706120bdd48914d93";
-      sha256 = "0jf1c03c9cibfci7qaxbk8h758gmc9i0115jdw57v5c45hklw9ah";
-    };
-  }
-  {
-    goPackagePath = "github.com/Masterminds/sprig";
-    fetch = {
-      type = "git";
-      url = "https://github.com/Masterminds/sprig";
-      rev = "7525b3376b8792ab24d07381324e4e2463e3356b";
-      sha256 = "05ia4r8b86s7pk8r3jmjq5x7pgsmp6wvcm42z8vl6vdhdr28bfrg";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/go-github";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/go-github";
-      rev = "24f172eae1a0c53c780f259d8492979900e9af2e";
-      sha256 = "1bxklfrl1wx2691qindiikkbyixd9p8pfqjn0xqi4riy5hcgz96s";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/go-querystring";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/go-querystring";
-      rev = "c8c88dbee036db4e4808d1f2ec8c2e15e11c3f80";
-      sha256 = "1yckg2052mz7ps1m68wri6kyb5n4g0vx2yf7s0xs9gdqvvscp57l";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/uuid";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/uuid";
-      rev = "c2e93f3ae59f2904160ceaab466009f965df46d6";
-      sha256 = "0zw8fvl6jqg0fmv6kmvhss0g4gkrbvgyvl2zgy5wdbdlgp4fja0h";
-    };
-  }
-  {
-    goPackagePath = "github.com/huandu/xstrings";
-    fetch = {
-      type = "git";
-      url = "https://github.com/huandu/xstrings";
-      rev = "8bbcf2f9ccb55755e748b7644164cd4bdce94c1d";
-      sha256 = "1ivvc95514z63k7cpz71l0dwlanffmsh1pijhaqmp41kfiby8rsx";
-    };
-  }
-  {
-    goPackagePath = "github.com/imdario/mergo";
-    fetch = {
-      type = "git";
-      url = "https://github.com/imdario/mergo";
-      rev = "4c317f2286be3bd0c4f1a0e622edc6398ec4656d";
-      sha256 = "0bihha1qsgfjk14yv1hwddv3d8dzxpbjlaxwwyys6lhgxz1cr9h9";
-    };
-  }
-  {
-    goPackagePath = "github.com/pkg/errors";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pkg/errors";
-      rev = "27936f6d90f9c8e1145f11ed52ffffbfdb9e0af7";
-      sha256 = "0yzmgi6g4ak4q8y7w6x0n5cbinlcn8yc3gwgzy4yck00qdn25d6y";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/crypto";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/crypto";
-      rev = "4def268fd1a49955bfb3dda92fe3db4f924f2285";
-      sha256 = "1bfsnari529gw34cz0zqk3d9mrkcj1ay35kangri8kbgll0ss5a6";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/net";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/net";
-      rev = "ca1201d0de80cfde86cb01aea620983605dfe99b";
-      sha256 = "16j9xyby1vfl4ch6wqzafxxxnxvcp8vhzknpchwabci1f2zcsn6i";
-    };
-  }
-]
diff --git a/pkgs/development/tools/misc/clojure-lsp/default.nix b/pkgs/development/tools/misc/clojure-lsp/default.nix
index 5b992df12be..75eb3e9d05c 100644
--- a/pkgs/development/tools/misc/clojure-lsp/default.nix
+++ b/pkgs/development/tools/misc/clojure-lsp/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "clojure-lsp";
-  version = "20201205T230541";
+  version = "20201207T142850";
 
   src = fetchurl {
     url = "https://github.com/snoe/clojure-lsp/releases/download/release-${version}/${pname}";
-    sha256 = "06sismbv7wrcwfgr0brw9gsdvl2plrryhxs1v08a2sd5rdf2qi3b";
+    sha256 = "0fxplldpxslm7f5xxazkl09gsj0ysppaal72hmlqbdj6rbgxlrnk";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/tools/misc/nxpmicro-mfgtools/default.nix b/pkgs/development/tools/misc/nxpmicro-mfgtools/default.nix
index 58178cde174..e9259b7156b 100644
--- a/pkgs/development/tools/misc/nxpmicro-mfgtools/default.nix
+++ b/pkgs/development/tools/misc/nxpmicro-mfgtools/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nxpmicro-mfgtools";
-  version = "1.3.191";
+  version = "1.4.43";
 
   src = fetchFromGitHub {
     owner = "NXPmicro";
     repo = "mfgtools";
     rev = "uuu_${version}";
-    sha256 = "196blmd7nf5kamvay22rvnkds2v6h7ab8lyl10dknxgy8i8siqq9";
+    sha256 = "1i1mvr6j0mc33axf6cmmsi83apr5rgq0z0sn23qav9r0izpnnh0w";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/tools/misc/remarkable/remarkable-toolchain/default.nix b/pkgs/development/tools/misc/remarkable/remarkable-toolchain/default.nix
index 412830369b9..d259721353b 100644
--- a/pkgs/development/tools/misc/remarkable/remarkable-toolchain/default.nix
+++ b/pkgs/development/tools/misc/remarkable/remarkable-toolchain/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, libarchive, python3, file }:
+{ stdenv, fetchurl, libarchive, python, file, which }:
 
 stdenv.mkDerivation rec {
   pname = "remarkable-toolchain";
@@ -6,31 +6,30 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://remarkable.engineering/oecore-x86_64-cortexa9hf-neon-toolchain-zero-gravitas-${version}.sh";
-    sha256 = "6299955721bcd9bef92a87ad3cfe4d31df8e2da95b0c4b2cdded4431aa6748b0";
+    sha256 = "1rk1r80m5d18sw6hrybj6f78s8pna0wrsa40ax6j8jzfwahgzmfb";
+    executable = true;
   };
 
   nativeBuildInputs = [
     libarchive
-    python3
+    python
     file
+    which
   ];
 
-  unpackCmd = "mkdir src; install $curSrc src/install-toolchain.sh";
-
+  dontUnpack = true;
   dontBuild = true;
 
   installPhase = ''
-    patchShebangs install-toolchain.sh
-    sed -i -e '3,9d' install-toolchain.sh # breaks PATH
-    sed -i 's|PYTHON=.*$|PYTHON=${python3}/bin/python|' install-toolchain.sh
-    ./install-toolchain.sh -D -y -d $out
+    mkdir -p $out
+    ENVCLEANED=1 $src -y -d $out
   '';
 
   meta = with stdenv.lib; {
     description = "A toolchain for cross-compiling to reMarkable tablets";
     homepage = "https://remarkable.engineering/";
     license = licenses.gpl2;
-    maintainers = [ maintainers.nickhu ];
-    platforms = platforms.x86_64;
+    maintainers = with maintainers; [ nickhu siraben ];
+    platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/development/tools/misc/terraform-ls/default.nix b/pkgs/development/tools/misc/terraform-ls/default.nix
index 4d999f32446..763cd4fcdb4 100644
--- a/pkgs/development/tools/misc/terraform-ls/default.nix
+++ b/pkgs/development/tools/misc/terraform-ls/default.nix
@@ -1,18 +1,22 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "terraform-ls";
-  version = "0.7.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1afdd1zs242nh1cync5ip1fbah34wc3gbsx3hwwiisc8yziwiq18";
+    sha256 = "XOKaNpYR31lKpA33+7WU2KYjgEx4g6gpp3IAjWtb3Zk=";
   };
+  vendorSha256 = "8NdeCD558r0tV+ZR4MvLl5CzeNj8cUGtqwvJ2ZhS7mI=";
 
   goPackagePath = "github.com/hashicorp/terraform-ls";
 
+  # tests fail in sandbox mode because of trying to download stuff from releases.hashicorp.com
+  doCheck = false;
+
   buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
 
   meta = with lib; {
diff --git a/pkgs/development/tools/tabnine/default.nix b/pkgs/development/tools/tabnine/default.nix
index 6e49bd2aafc..6c54e8f3c40 100644
--- a/pkgs/development/tools/tabnine/default.nix
+++ b/pkgs/development/tools/tabnine/default.nix
@@ -23,8 +23,7 @@ in stdenv.mkDerivation rec {
   dontUnpack = true;
 
   installPhase = ''
-    mkdir -p $out/bin
-    ln -s $src $out/bin/TabNine
+    install -Dm755 $src $out/bin/TabNine
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/tools/vultr-cli/default.nix b/pkgs/development/tools/vultr-cli/default.nix
index b3b3bd1b9f5..58ee064ad55 100644
--- a/pkgs/development/tools/vultr-cli/default.nix
+++ b/pkgs/development/tools/vultr-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "vultr-cli";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "vultr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "05qxbqq9mlq2jmyj5m9vmgw6s6a3wj06hmxj74g9lgqg8xyfglnh";
+    sha256 = "14cl0rgkk2kw0qyanlm57nbcrnsnnx02ikd6b1mrsviamb6r1lz6";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/games/minecraft/default.nix b/pkgs/games/minecraft/default.nix
index 03abcb151bc..292b43bec0a 100644
--- a/pkgs/games/minecraft/default.nix
+++ b/pkgs/games/minecraft/default.nix
@@ -88,11 +88,11 @@ in
 stdenv.mkDerivation rec {
   pname = "minecraft-launcher";
 
-  version = "2.2.741";
+  version = "2.2.909";
 
   src = fetchurl {
     url = "https://launcher.mojang.com/download/linux/x86_64/minecraft-launcher_${version}.tar.gz";
-    sha256 = "0bm78ybn91ihibxgmlpk7dl2zxy4a57k86qmb08cif3ifbflzkvw";
+    sha256 = "15x2imr8c4m2bjfs9y1l34fpvixxdf09gqls4bqb4rdvj1vhdrh2";
   };
 
   icon = fetchurl {
@@ -138,7 +138,7 @@ stdenv.mkDerivation rec {
     makeWrapper $out/opt/minecraft-launcher/minecraft-launcher $out/bin/minecraft-launcher \
       --prefix LD_LIBRARY_PATH : ${envLibPath} \
       --prefix PATH : ${stdenv.lib.makeBinPath [ jre ]} \
-      --set JAVA_HOME ${stdenv.lib.makeBinPath [ jre ]} \
+      --set JAVA_HOME ${stdenv.lib.getBin jre} \
       --run "cd /tmp" \
       "''${gappsWrapperArgs[@]}"
   '';
diff --git a/pkgs/games/tdm/default.nix b/pkgs/games/tdm/default.nix
deleted file mode 100644
index 98b7ecdc477..00000000000
--- a/pkgs/games/tdm/default.nix
+++ /dev/null
@@ -1,105 +0,0 @@
-{ stdenv, fetchurl, binutils-unwrapped, sconsPackages, gnum4, p7zip, glibc_multi, mesa
-, xorg, libGLU, libGL, openal
-, lib, makeWrapper, makeDesktopItem }:
-
-let
-  pname = "tdm";
-  version = "2.08";
-
-  desktop = makeDesktopItem {
-    desktopName = pname;
-    name = pname;
-    exec = "@out@/bin/${pname}";
-    icon = pname;
-    terminal = "false";
-    comment = "The Dark Mod - stealth FPS inspired by the Thief series";
-    type = "Application";
-    categories = "Game;";
-    genericName = pname;
-    fileValidation = false;
-  };
-in stdenv.mkDerivation {
-  name = "${pname}-${version}";
-  src = fetchurl {
-    url = "https://www.thedarkmod.com/sources/thedarkmod.${version}.src.7z";
-    sha256 = "0bmv07j6s6q3m7hnpx7cwrycjkbvlf0y9sg9migakni0jg9yz5ps";
-  };
-  nativeBuildInputs = [
-    p7zip sconsPackages.scons_3_1_2 gnum4 makeWrapper
-  ];
-  buildInputs = [
-    glibc_multi mesa.dev xorg.libX11.dev openal
-    xorg.libXext.dev xorg.libXxf86vm.dev
-    libGL libGLU
-  ];
-  unpackPhase = ''
-    7z x $src
-  '';
-
-  # I'm pretty sure there's a better way to build 2 targets than a random hook
-  preBuild = ''
-    pushd tdm_update
-    scons BUILD=release TARGET_ARCH=x64
-    install -Dm755 bin/tdm_update.linux64 $out/share/libexec/tdm_update.linux
-    popd
-  '';
-
-  # why oh why can it find ld but not strip?
-  postPatch = ''
-    sed -i 's!strip \$!${binutils-unwrapped}/bin/strip $!' SConstruct
-    # This adds math.h needed for math::floor
-    sed -i 's|#include "Util.h"|#include "Util.h"\n#include <math.h>|' tdm_update/ConsoleUpdater.cpp
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm644 ${desktop}/share/applications/${pname}.desktop $out/share/applications/${pname}.desktop
-    substituteInPlace $out/share/applications/${pname}.desktop --subst-var out
-    install -Dm755 thedarkmod.x64 $out/share/libexec/tdm
-
-    # The package doesn't install assets, these get installed by running tdm_update.linux
-    # Provide a script that runs tdm_update.linux on first launch
-    install -Dm755 <(cat <<'EOF'
-#!/bin/sh
-set -e
-DIR="$HOME/.local/share/tdm"
-mkdir -p "$DIR"
-cd "$DIR"
-exec "PKGDIR/share/libexec/tdm_update.linux" --noselfupdate
-EOF
-    ) $out/bin/tdm_update
-
-    install -Dm755 <(cat <<'EOF'
-#!/bin/sh
-set -e
-DIR="$HOME/.local/share/tdm"
-if [ ! -d "$DIR" ]; then
-  echo "Please run tdm_update to (re)download game data"
-else
-  cd "$DIR"
-  exec "PKGDIR/share/libexec/tdm"
-fi
-EOF
-    ) $out/bin/tdm
-    sed -i "s!PKGDIR!$out!g" $out/bin/tdm_update
-    sed -i "s!PKGDIR!$out!g" $out/bin/tdm
-
-    runHook postInstall
-  '';
-
-  postInstall = ''
-    wrapProgram $out/bin/tdm --suffix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libGL libGLU ]}
-  '';
-
-  enableParallelBuilding = true;
-  sconsFlags = [ "BUILD=release" "TARGET_ARCH=x64" ];
-  NIX_CFLAGS_COMPILE = "-Wno-error=format-security";
-  meta = with stdenv.lib; {
-    description = "The Dark Mod - stealth FPS inspired by the Thief series";
-    homepage = "http://www.thedarkmod.com";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ cizra ];
-    platforms = with platforms; [ "x86_64-linux" ];  # tdm also supports x86, but I don't have a x86 install at hand to test.
-  };
-}
diff --git a/pkgs/os-specific/darwin/osx-cpu-temp/default.nix b/pkgs/os-specific/darwin/osx-cpu-temp/default.nix
new file mode 100644
index 00000000000..1e8a56154f3
--- /dev/null
+++ b/pkgs/os-specific/darwin/osx-cpu-temp/default.nix
@@ -0,0 +1,31 @@
+{ stdenv, fetchFromGitHub
+, IOKit
+}:
+
+stdenv.mkDerivation rec {
+  pname = "osx-cpu-temp";
+  version = "unstable-2020-12-04";
+
+  src = fetchFromGitHub rec {
+    name = "osx-cpu-temp-source";
+    owner = "lavoiesl";
+    repo = pname;
+    rev = "6ec951be449badcb7fb84676bbc2c521e600e844";
+    sha256 = "1nlibgr55bpln6jbdf8vqcp0fj9zv9343vflb7s9w0yh33fsbg9d";
+  };
+
+  buildInputs = [ IOKit ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp osx-cpu-temp $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Outputs current CPU temperature for OSX.";
+    homepage = "https://github.com/lavoiesl/osx-cpu-temp";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ virusdave ];
+    platforms = platforms.darwin;
+  };
+}
diff --git a/pkgs/os-specific/linux/fuse/default.nix b/pkgs/os-specific/linux/fuse/default.nix
index f159a4cbf77..0ed6f54a1dc 100644
--- a/pkgs/os-specific/linux/fuse/default.nix
+++ b/pkgs/os-specific/linux/fuse/default.nix
@@ -11,7 +11,7 @@ in {
   };
 
   fuse_3 = mkFuse {
-    version = "3.10.0";
-    sha256Hash = "05ipzmlk6xci9v4sf0pap542b37aszghlchswl6s76fg6h3w4yms";
+    version = "3.10.1";
+    sha256Hash = "0bb22mac8m0z6qp0s6g4r0x4aj6gc19pfyqr6sdy4hkpwxicgmaf";
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/export-rt-sched-migrate.patch b/pkgs/os-specific/linux/kernel/export-rt-sched-migrate.patch
new file mode 100644
index 00000000000..1d8ed6f712c
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/export-rt-sched-migrate.patch
@@ -0,0 +1,11 @@
+Export linux-rt (PREEMPT_RT) specific symbols needed by ZFS.
+(Regular kernel provides them static inline in linux/preempt.h.)
+
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -1812 +1812 @@ void migrate_disable(void)
+-EXPORT_SYMBOL_GPL(migrate_disable);
++EXPORT_SYMBOL(migrate_disable);
+@@ -1843 +1843 @@ void migrate_enable(void)
+-EXPORT_SYMBOL_GPL(migrate_enable);
++EXPORT_SYMBOL(migrate_enable);
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 26694d965e7..f4404cae6f4 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.210";
+  version = "4.14.212";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "067xqi6sgf50p7s3n6y77cgf5bj5062s3bz3kqpp6f9wnk85267r";
+    sha256 = "0y8ck8pfxm8862wi4cz8qp9x9b18yl448i8m7bpbphs290nc66qf";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index 15a5e1972a6..b542fab118b 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.19.161";
+  version = "4.19.163";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0h9wskmz9wridwnicnjlcmj1112qnlvqk01bhjkxv6b8jsajjh87";
+    sha256 = "1z65iwwyx2b01fncygckmhpxirzs52qfqmv3agirn4laxgjw9viy";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 599d6863620..7e3030087ce 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.247";
+  version = "4.4.248";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1jh7vmyx55krk6y2r9v48liifs5wwkgns3gp8rs5sm4klfm36r2a";
+    sha256 = "1z1xbkm0z0v6k3scszii5hi24pn391332g0li93p3n1rnv74jap5";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 9169506536a..107fcd9268f 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.247";
+  version = "4.9.248";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1mngdbsq8pdzd0x9hif4715cc7wzc3ahgp1yrknnqk598q0fnfpp";
+    sha256 = "1kzczy0lz3lnjkhvx90dgjmzn3d3y55qxlihiclkr4y9c602d1s6";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index 8453ec0c6cb..9e3ddaa8716 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.4.81";
+  version = "5.4.83";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "09w4bpr3v9rzcvxics5wddabplwbpk1mynl45lh9csbjfpjbsw4l";
+    sha256 = "1ik14pfgynkn1sjhgyhgmxjvviq0mgvk0ygj76w8mplkpc5rgv5y";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.9.nix b/pkgs/os-specific/linux/kernel/linux-5.9.nix
index e71044b0d96..c3fef2fdcde 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.9.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.9.12";
+  version = "5.9.14";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1gfrn3sz3h4cbsf3r8f9jxja400qsmbrk8sclk4cjx1l5qcmczyr";
+    sha256 = "0jbb3rzbkh0l75zq9bnc60w55ryvrvcg7vw85fsbcwfzvi0zpz1r";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index 8ce1ac2b587..e2805c315b8 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -87,6 +87,11 @@
     };
   };
 
+  export-rt-sched-migrate = {
+    name = "export-rt-sched-migrate";
+    patch = ./export-rt-sched-migrate.patch;
+  };
+
   # patches from https://lkml.org/lkml/2019/7/15/1748
   mac_nvme_t2 = rec {
     name = "mac_nvme_t2";
diff --git a/pkgs/os-specific/linux/libcap-ng/default.nix b/pkgs/os-specific/linux/libcap-ng/default.nix
index cfcaea694e5..27f4ddcce18 100644
--- a/pkgs/os-specific/linux/libcap-ng/default.nix
+++ b/pkgs/os-specific/linux/libcap-ng/default.nix
@@ -6,11 +6,11 @@ stdenv.mkDerivation rec {
   pname = "libcap-ng";
   # When updating make sure to test that the version with
   # all of the python bindings still works
-  version = "0.7.11";
+  version = "0.8";
 
   src = fetchurl {
     url = "${meta.homepage}/${pname}-${version}.tar.gz";
-    sha256 = "1s8akhnnazk0b5c6z5i3x54rjb26p8pz2wdl1m21ml3231qmr0c5";
+    sha256 = "08cy59iassiwbmfxa5v0kb374r80290vv32f5q1mnip11av26kgi";
   };
 
   nativeBuildInputs = [ swig ];
diff --git a/pkgs/os-specific/linux/libcap/default.nix b/pkgs/os-specific/linux/libcap/default.nix
index 7931e35a844..713c4b5d13d 100644
--- a/pkgs/os-specific/linux/libcap/default.nix
+++ b/pkgs/os-specific/linux/libcap/default.nix
@@ -1,4 +1,5 @@
-{ stdenv, buildPackages, fetchurl, attr, perl, pam }:
+{ stdenv, lib, buildPackages, fetchurl, attr, perl, pam
+, static ? stdenv.targetPlatform.isStatic }:
 
 stdenv.mkDerivation rec {
   pname = "libcap";
@@ -9,7 +10,10 @@ stdenv.mkDerivation rec {
     sha256 = "1qf80lifygbnxwvqjf8jz5j24n6fqqx4ixnkbf76xs2vrmcq664j";
   };
 
-  outputs = [ "out" "dev" "lib" "man" "doc" "pam" ];
+  patches = lib.optional static ./no-shared-lib.patch;
+
+  outputs = [ "out" "dev" "lib" "man" "doc" ]
+    ++ lib.optional (pam != null) "pam";
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ perl ];
@@ -20,7 +24,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [
     "lib=lib"
-    "PAM_CAP=yes"
+    "PAM_CAP=${if pam == null then "no" else "yes"}"
     "BUILD_CC=$(CC_FOR_BUILD)"
     "CC:=$(CC)"
   ];
@@ -44,7 +48,7 @@ stdenv.mkDerivation rec {
   installFlags = [ "RAISE_SETFCAP=no" ];
 
   postInstall = ''
-    rm "$lib"/lib/*.a
+    ${lib.optionalString (!static) ''rm "$lib"/lib/*.a''}
     mkdir -p "$doc/share/doc/${pname}-${version}"
     cp License "$doc/share/doc/${pname}-${version}/"
   '' + stdenv.lib.optionalString (pam != null) ''
diff --git a/pkgs/os-specific/linux/libcap/no-shared-lib.patch b/pkgs/os-specific/linux/libcap/no-shared-lib.patch
new file mode 100644
index 00000000000..73dc7de063d
--- /dev/null
+++ b/pkgs/os-specific/linux/libcap/no-shared-lib.patch
@@ -0,0 +1,22 @@
+diff --git a/libcap/Makefile b/libcap/Makefile
+index de6a28d..7e4d8ac 100644
+--- a/libcap/Makefile
++++ b/libcap/Makefile
+@@ -22,7 +22,7 @@ MAJLIBNAME=$(LIBNAME).$(VERSION)
+ MINLIBNAME=$(MAJLIBNAME).$(MINOR)
+ GPERF_OUTPUT = _caps_output.gperf
+ 
+-all: $(MINLIBNAME) $(STACAPLIBNAME) pcs $(STAPSXLIBNAME)
++all: $(STACAPLIBNAME) pcs $(STAPSXLIBNAME)
+ 
+ pcs: libcap.pc libpsx.pc
+ 
+@@ -93,7 +93,7 @@ cap_test: cap_test.c libcap.h
+ test: cap_test
+ 	./cap_test
+ 
+-install: install-static install-shared
++install: install-static
+ 
+ install-static: install-static-cap install-static-psx
+ 
diff --git a/pkgs/os-specific/linux/procps-ng/default.nix b/pkgs/os-specific/linux/procps-ng/default.nix
index 466e66a8713..4942710f755 100644
--- a/pkgs/os-specific/linux/procps-ng/default.nix
+++ b/pkgs/os-specific/linux/procps-ng/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, ncurses, pkgconfig
+{ lib, stdenv, fetchurl, fetchpatch, ncurses, pkgconfig
 
 # `ps` with systemd support is able to properly report different
 # attributes like unit name, so we want to have it on linux.
@@ -22,6 +22,14 @@ stdenv.mkDerivation rec {
     sha256 = "1br0g93ysqhlv13i1k4lfbimsgxnpy5rgs4lxfc9rkzdbpbaqplj";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://gitlab.com/procps-ng/procps/-/commit/bb96fc42956c9ed926a1b958ab715f8b4a663dec.diff";
+      sha256 = "0fzsb6ns3fvrszyzsz28qvbmcn135ilr4nwh2z1a0vlpl2fw961z";
+      name = "sysconf-argmax-sanity.patch";
+    })
+  ];
+
   buildInputs = [ ncurses ]
     ++ lib.optional withSystemd systemd;
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
index 1f75fc63ffe..b3b241b570a 100644
--- a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
+++ b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
@@ -1,4 +1,4 @@
-From 46c8ccfeb61253cd3dff5f34013670c7e3366ef5 Mon Sep 17 00:00:00 2001
+From dd2ec741aaa7c587eb7719bbf4b305fe28168b77 Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Tue, 8 Jan 2013 15:46:30 +0100
 Subject: [PATCH 01/18] Start device units for uninitialised encrypted devices
@@ -13,7 +13,7 @@ unit.  (However, this ignores the fsck unit, so it's not perfect...)
  1 file changed, 4 deletions(-)
 
 diff --git a/rules.d/99-systemd.rules.in b/rules.d/99-systemd.rules.in
-index 1c60eec587..b2486da130 100644
+index d2f595d18e..941a7c1ba3 100644
 --- a/rules.d/99-systemd.rules.in
 +++ b/rules.d/99-systemd.rules.in
 @@ -17,10 +17,6 @@ SUBSYSTEM=="ubi", TAG+="systemd"
@@ -28,5 +28,5 @@ index 1c60eec587..b2486da130 100644
  SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}!="crypto_LUKS", SYMLINK+="gpt-auto-root"
  SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}=="crypto_LUKS", SYMLINK+="gpt-auto-root-luks"
 -- 
-2.28.0
+2.29.2
 
diff --git a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
index 7c025cbb7d7..1f3a1b64684 100644
--- a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
+++ b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
@@ -1,4 +1,4 @@
-From 139c420de62e078182eaf48b541c4b912d445fd9 Mon Sep 17 00:00:00 2001
+From ab3dab997695db5346f8efbf8566ac96612f0c6e Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Fri, 12 Apr 2013 13:16:57 +0200
 Subject: [PATCH 02/18] Don't try to unmount /nix or /nix/store
@@ -12,7 +12,7 @@ https://github.com/NixOS/nixos/issues/126
  2 files changed, 4 insertions(+)
 
 diff --git a/src/shared/fstab-util.c b/src/shared/fstab-util.c
-index 806dda8475..0220741c91 100644
+index 292b97cd69..791b8e6b7e 100644
 --- a/src/shared/fstab-util.c
 +++ b/src/shared/fstab-util.c
 @@ -40,6 +40,8 @@ bool fstab_is_extrinsic(const char *mount, const char *opts) {
@@ -25,10 +25,10 @@ index 806dda8475..0220741c91 100644
                          "/etc"))
                  return true;
 diff --git a/src/shutdown/umount.c b/src/shutdown/umount.c
-index 8a5e80eeaa..fab35ed6f3 100644
+index 3a72a13e1a..541320dc9d 100644
 --- a/src/shutdown/umount.c
 +++ b/src/shutdown/umount.c
-@@ -414,6 +414,8 @@ static int delete_dm(dev_t devnum) {
+@@ -500,6 +500,8 @@ static int delete_md(MountPoint *m) {
  
  static bool nonunmountable_path(const char *path) {
          return path_equal(path, "/")
@@ -38,5 +38,5 @@ index 8a5e80eeaa..fab35ed6f3 100644
                  || path_equal(path, "/usr")
  #endif
 -- 
-2.28.0
+2.29.2
 
diff --git a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
index 1f0b8aaf38b..56f52b9971e 100644
--- a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
+++ b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
@@ -1,4 +1,4 @@
-From a889dbe796cd72425f38dec3d2aaab44a914ac60 Mon Sep 17 00:00:00 2001
+From 3581f8f30270e6340c671a640fe551e954715f8e Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Wed, 16 Apr 2014 10:59:28 +0200
 Subject: [PATCH 03/18] Fix NixOS containers
@@ -10,10 +10,10 @@ container, so checking early whether it exists will fail.
  1 file changed, 2 insertions(+)
 
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 43712565c2..07f294c78a 100644
+index 0842731c18..f790853104 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -5122,6 +5122,7 @@ static int run(int argc, char *argv[]) {
+@@ -5319,6 +5319,7 @@ static int run(int argc, char *argv[]) {
                                  goto finish;
                          }
                  } else {
@@ -21,7 +21,7 @@ index 43712565c2..07f294c78a 100644
                          const char *p, *q;
  
                          if (arg_pivot_root_new)
-@@ -5136,6 +5137,7 @@ static int run(int argc, char *argv[]) {
+@@ -5333,6 +5334,7 @@ static int run(int argc, char *argv[]) {
                                  r = -EINVAL;
                                  goto finish;
                          }
@@ -30,5 +30,5 @@ index 43712565c2..07f294c78a 100644
  
          } else {
 -- 
-2.28.0
+2.29.2
 
diff --git a/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch b/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch
index f9e7bc9d876..4d3729556d6 100644
--- a/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch
+++ b/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch
@@ -1,4 +1,4 @@
-From 5098b1aad07356e04fcd12f2c77ea4fd17460411 Mon Sep 17 00:00:00 2001
+From 12b63d8c1d2ca85d9bb7ea07e8eb5e623e1b58e9 Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Thu, 1 May 2014 14:10:10 +0200
 Subject: [PATCH 04/18] Look for fsck in the right place
@@ -8,10 +8,10 @@ Subject: [PATCH 04/18] Look for fsck in the right place
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/fsck/fsck.c b/src/fsck/fsck.c
-index 80f7107b9d..74e48a385f 100644
+index 04752fe9dc..ad0ccf91c0 100644
 --- a/src/fsck/fsck.c
 +++ b/src/fsck/fsck.c
-@@ -370,7 +370,7 @@ static int run(int argc, char *argv[]) {
+@@ -369,7 +369,7 @@ static int run(int argc, char *argv[]) {
                  } else
                          dash_c[0] = 0;
  
@@ -21,5 +21,5 @@ index 80f7107b9d..74e48a385f 100644
                  cmdline[i++] = "-T";
  
 -- 
-2.28.0
+2.29.2
 
diff --git a/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch b/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
index 91d6fbf41d6..476ebe06e70 100644
--- a/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
+++ b/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
@@ -1,4 +1,4 @@
-From b46f1b20e990f01af4bdf3dd6fef45f5b4a5993e Mon Sep 17 00:00:00 2001
+From 6ede8baac88aba769030f5bc5f5b2070098c7428 Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Fri, 19 Dec 2014 14:46:17 +0100
 Subject: [PATCH 05/18] Add some NixOS-specific unit directories
@@ -15,7 +15,7 @@ Also, remove /usr and /lib as these don't exist on NixOS.
  2 files changed, 8 insertions(+), 17 deletions(-)
 
 diff --git a/src/basic/path-lookup.c b/src/basic/path-lookup.c
-index 52968dee34..bba2eb09b8 100644
+index 96b82170d0..b9fbed5c61 100644
 --- a/src/basic/path-lookup.c
 +++ b/src/basic/path-lookup.c
 @@ -94,17 +94,14 @@ int xdg_user_data_dir(char **ret, const char *suffix) {
@@ -102,7 +102,7 @@ index 52968dee34..bba2eb09b8 100644
  
                  if (!add)
 diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
-index 8424837824..b1c541bc52 100644
+index f2c045511d..ccb382e421 100644
 --- a/src/core/systemd.pc.in
 +++ b/src/core/systemd.pc.in
 @@ -38,10 +38,11 @@ systemdsystemconfdir=${systemd_system_conf_dir}
@@ -120,5 +120,5 @@ index 8424837824..b1c541bc52 100644
  
  systemd_system_generator_dir=${root_prefix}/lib/systemd/system-generators
 -- 
-2.28.0
+2.29.2
 
diff --git a/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch b/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch
index 8021472ea33..99e68c37c20 100644
--- a/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch
+++ b/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch
@@ -1,4 +1,4 @@
-From 4c9f9d192182f1051dba1c547e182e7c8f549b0f Mon Sep 17 00:00:00 2001
+From 3aeb3a10c4a7ad387b004bf41efbd171913bcca9 Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Mon, 11 May 2015 15:39:38 +0200
 Subject: [PATCH 06/18] Get rid of a useless message in user sessions
@@ -13,10 +13,10 @@ in containers.
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/src/core/unit.c b/src/core/unit.c
-index 1bda568560..5b44970763 100644
+index 45a417a090..8af3cb08d6 100644
 --- a/src/core/unit.c
 +++ b/src/core/unit.c
-@@ -2150,7 +2150,8 @@ static void unit_check_binds_to(Unit *u) {
+@@ -2163,7 +2163,8 @@ static void unit_check_binds_to(Unit *u) {
          }
  
          assert(other);
@@ -27,5 +27,5 @@ index 1bda568560..5b44970763 100644
          /* A unit we need to run is gone. Sniff. Let's stop this. */
          r = manager_add_job(u->manager, JOB_STOP, u, JOB_FAIL, NULL, &error, NULL);
 -- 
-2.28.0
+2.29.2
 
diff --git a/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch b/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
index 6c24821c2a0..aeb734f94df 100644
--- a/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
+++ b/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
@@ -1,4 +1,4 @@
-From 539f3af04963a6826d2b2d0ba2095af99a7a6294 Mon Sep 17 00:00:00 2001
+From a1454e8edb7a1a87093808dc7db540232147df3d Mon Sep 17 00:00:00 2001
 From: Gabriel Ebner <gebner@gebner.org>
 Date: Sun, 6 Dec 2015 14:26:36 +0100
 Subject: [PATCH 07/18] hostnamed, localed, timedated: disable methods that
@@ -11,10 +11,10 @@ Subject: [PATCH 07/18] hostnamed, localed, timedated: disable methods that
  3 files changed, 25 insertions(+)
 
 diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
-index 7f6607a527..b5a9388916 100644
+index a1794bdab1..77134731e1 100644
 --- a/src/hostname/hostnamed.c
 +++ b/src/hostname/hostnamed.c
-@@ -626,6 +626,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
+@@ -643,6 +643,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
          if (r < 0)
                  return r;
  
@@ -24,7 +24,7 @@ index 7f6607a527..b5a9388916 100644
          name = empty_to_null(name);
  
          context_read_etc_hostname(c);
-@@ -685,6 +688,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
+@@ -702,6 +705,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
          if (r < 0)
                  return r;
  
@@ -35,7 +35,7 @@ index 7f6607a527..b5a9388916 100644
  
          context_read_machine_info(c);
 diff --git a/src/locale/localed.c b/src/locale/localed.c
-index 715ce5cac7..014f7dcf6c 100644
+index 736dacdee9..53e0ee935e 100644
 --- a/src/locale/localed.c
 +++ b/src/locale/localed.c
 @@ -317,6 +317,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
@@ -69,7 +69,7 @@ index 715ce5cac7..014f7dcf6c 100644
          model = empty_to_null(model);
          variant = empty_to_null(variant);
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index c467b85477..3e78b2f575 100644
+index 8bfcfd5cdc..a0ee03f134 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
 @@ -646,6 +646,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
@@ -93,7 +93,7 @@ index c467b85477..3e78b2f575 100644
          if (lrtc == c->local_rtc)
                  return sd_bus_reply_method_return(m, NULL);
  
-@@ -917,6 +924,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
+@@ -905,6 +912,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
          if (r < 0)
                  return r;
  
@@ -104,5 +104,5 @@ index c467b85477..3e78b2f575 100644
          if (r < 0)
                  return r;
 -- 
-2.28.0
+2.29.2
 
diff --git a/pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch b/pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch
index 7b17c3bcb2b..0da52477bb3 100644
--- a/pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch
+++ b/pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch
@@ -1,4 +1,4 @@
-From 5c2a1a6d33f7cdbcb8ddcc70b91ba4c7f3c383b3 Mon Sep 17 00:00:00 2001
+From 27680c555713e36d16198fc5f60b0f85e0777d30 Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <ab@fmap.me>
 Date: Thu, 7 Jul 2016 02:47:13 +0300
 Subject: [PATCH 08/18] Fix hwdb paths
@@ -9,7 +9,7 @@ Patch by vcunat.
  1 file changed, 1 insertion(+), 6 deletions(-)
 
 diff --git a/src/libsystemd/sd-hwdb/sd-hwdb.c b/src/libsystemd/sd-hwdb/sd-hwdb.c
-index b3febdbb31..eba00a5bc7 100644
+index cb3c77ce96..7b8c80071f 100644
 --- a/src/libsystemd/sd-hwdb/sd-hwdb.c
 +++ b/src/libsystemd/sd-hwdb/sd-hwdb.c
 @@ -297,13 +297,8 @@ static int trie_search_f(sd_hwdb *hwdb, const char *search) {
@@ -28,5 +28,5 @@ index b3febdbb31..eba00a5bc7 100644
  _public_ int sd_hwdb_new(sd_hwdb **ret) {
          _cleanup_(sd_hwdb_unrefp) sd_hwdb *hwdb = NULL;
 -- 
-2.28.0
+2.29.2
 
diff --git a/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch b/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
index e0fab399feb..2b05cea435c 100644
--- a/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+++ b/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
@@ -1,4 +1,4 @@
-From a8ccba372d865429b578e72fd104a693b96101b3 Mon Sep 17 00:00:00 2001
+From b423ce2560bd380abd80796a890454d95cd8926c Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <ab@fmap.me>
 Date: Tue, 11 Oct 2016 13:12:08 +0300
 Subject: [PATCH 09/18] Change /usr/share/zoneinfo to /etc/zoneinfo
@@ -13,7 +13,7 @@ NixOS uses this path.
  5 files changed, 12 insertions(+), 12 deletions(-)
 
 diff --git a/man/localtime.xml b/man/localtime.xml
-index 0f1652ee2e..71c4f95c2e 100644
+index 73c1b8e5a3..4ab4276283 100644
 --- a/man/localtime.xml
 +++ b/man/localtime.xml
 @@ -20,7 +20,7 @@
@@ -35,10 +35,10 @@ index 0f1652ee2e..71c4f95c2e 100644
      <literal>Etc/UTC</literal>. The resulting link should lead to the
      corresponding binary
 diff --git a/src/basic/time-util.c b/src/basic/time-util.c
-index 15cc1b8851..d0abde5933 100644
+index 5318d6378d..04069dc27b 100644
 --- a/src/basic/time-util.c
 +++ b/src/basic/time-util.c
-@@ -1259,7 +1259,7 @@ int get_timezones(char ***ret) {
+@@ -1277,7 +1277,7 @@ int get_timezones(char ***ret) {
          n_allocated = 2;
          n_zones = 1;
  
@@ -47,7 +47,7 @@ index 15cc1b8851..d0abde5933 100644
          if (f) {
                  for (;;) {
                          _cleanup_free_ char *line = NULL;
-@@ -1354,7 +1354,7 @@ bool timezone_is_valid(const char *name, int log_level) {
+@@ -1372,7 +1372,7 @@ bool timezone_is_valid(const char *name, int log_level) {
          if (p - name >= PATH_MAX)
                  return false;
  
@@ -56,7 +56,7 @@ index 15cc1b8851..d0abde5933 100644
  
          fd = open(t, O_RDONLY|O_CLOEXEC);
          if (fd < 0) {
-@@ -1452,7 +1452,7 @@ int get_timezone(char **ret) {
+@@ -1470,7 +1470,7 @@ int get_timezone(char **ret) {
          if (r < 0)
                  return r; /* returns EINVAL if not a symlink */
  
@@ -66,10 +66,10 @@ index 15cc1b8851..d0abde5933 100644
                  return -EINVAL;
  
 diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
-index c9fc8dd5cd..44fc04dc88 100644
+index 742b43f9fc..f2cb121816 100644
 --- a/src/firstboot/firstboot.c
 +++ b/src/firstboot/firstboot.c
-@@ -460,7 +460,7 @@ static int process_timezone(void) {
+@@ -459,7 +459,7 @@ static int process_timezone(void) {
          if (isempty(arg_timezone))
                  return 0;
  
@@ -79,10 +79,10 @@ index c9fc8dd5cd..44fc04dc88 100644
          (void) mkdir_parents(etc_localtime, 0755);
          if (symlink(e, etc_localtime) < 0)
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 07f294c78a..cf86d1f494 100644
+index f790853104..74b51f4d28 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -1699,8 +1699,8 @@ static int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t u
+@@ -1810,8 +1810,8 @@ static int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t u
  static const char *timezone_from_path(const char *path) {
          return PATH_STARTSWITH_SET(
                          path,
@@ -94,7 +94,7 @@ index 07f294c78a..cf86d1f494 100644
  
  static bool etc_writable(void) {
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index 3e78b2f575..de5477a08f 100644
+index a0ee03f134..9ecacad25e 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
 @@ -269,7 +269,7 @@ static int context_read_data(Context *c) {
@@ -128,5 +128,5 @@ index 3e78b2f575..de5477a08f 100644
                          return -ENOMEM;
  
 -- 
-2.28.0
+2.29.2
 
diff --git a/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch b/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch
index 44ed04d9e7e..1d17bc4cf77 100644
--- a/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch
+++ b/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch
@@ -1,4 +1,4 @@
-From 84a2d35d4e75295edf7e190a94dfaf65db4973b6 Mon Sep 17 00:00:00 2001
+From aff592e0bf9a911e7f44ce07b66517c38456b627 Mon Sep 17 00:00:00 2001
 From: Imuli <i@imu.li>
 Date: Wed, 19 Oct 2016 08:46:47 -0400
 Subject: [PATCH 10/18] localectl: use /etc/X11/xkb for list-x11-*
@@ -10,7 +10,7 @@ NixOS has an option to link the xkb data files to /etc/X11, but not to
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/locale/localectl.c b/src/locale/localectl.c
-index e0664de826..c521f33a2a 100644
+index 7d2e887660..91c5139eed 100644
 --- a/src/locale/localectl.c
 +++ b/src/locale/localectl.c
 @@ -277,7 +277,7 @@ static int list_x11_keymaps(int argc, char **argv, void *userdata) {
@@ -23,5 +23,5 @@ index e0664de826..c521f33a2a 100644
                  return log_error_errno(errno, "Failed to open keyboard mapping list. %m");
  
 -- 
-2.28.0
+2.29.2
 
diff --git a/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch b/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
index e5d4f1701ba..8c185c52a27 100644
--- a/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
+++ b/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
@@ -1,4 +1,4 @@
-From 81ee9b5cd46f78de139c39e2a18f39e658c60169 Mon Sep 17 00:00:00 2001
+From d410a7a6d1bb0fe730c3ef690676232bfaa49f85 Mon Sep 17 00:00:00 2001
 From: Franz Pletz <fpletz@fnordicwalking.de>
 Date: Sun, 11 Feb 2018 04:37:44 +0100
 Subject: [PATCH 11/18] build: don't create statedir and don't touch prefixdir
@@ -8,10 +8,10 @@ Subject: [PATCH 11/18] build: don't create statedir and don't touch prefixdir
  1 file changed, 3 deletions(-)
 
 diff --git a/meson.build b/meson.build
-index ba9e7afe53..2ef9d4d770 100644
+index f406d595e6..f05f579816 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -3371,9 +3371,6 @@ install_data('LICENSE.GPL2',
+@@ -3517,9 +3517,6 @@ install_data('LICENSE.GPL2',
               'src/libsystemd/sd-bus/GVARIANT-SERIALIZATION',
               install_dir : docdir)
  
@@ -22,5 +22,5 @@ index ba9e7afe53..2ef9d4d770 100644
  
  check_help = find_program('tools/check-help.sh')
 -- 
-2.28.0
+2.29.2
 
diff --git a/pkgs/os-specific/linux/systemd/0012-Install-default-configuration-into-out-share-factory.patch b/pkgs/os-specific/linux/systemd/0012-Install-default-configuration-into-out-share-factory.patch
deleted file mode 100644
index a2d08753d4d..00000000000
--- a/pkgs/os-specific/linux/systemd/0012-Install-default-configuration-into-out-share-factory.patch
+++ /dev/null
@@ -1,326 +0,0 @@
-From 7dbe84b7c43669dccd90db8ac33c38a70e6b6914 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
-Date: Mon, 26 Feb 2018 14:25:57 +0000
-Subject: [PATCH 12/18] Install default configuration into $out/share/factory
-
-By default systemd should read all its configuration from /etc. Therefor
-we rely on -Dsysconfdir=/etc in meson as default value. Unfortunately
-this would also lead to installation of systemd's own configuration
-files to `/etc` whereas we are limited to /nix/store. To counter that
-this commit introduces two new configuration variables `factoryconfdir`
-and `factorypkgconfdir` to install systemd's own configuration into nix
-store again, while having executables looking up files in /etc.
----
- hwdb.d/meson.build             |  2 +-
- meson.build                    | 11 +++++++----
- network/meson.build            |  2 +-
- src/core/meson.build           | 10 +++++-----
- src/coredump/meson.build       |  2 +-
- src/home/meson.build           |  2 +-
- src/journal-remote/meson.build |  4 ++--
- src/journal/meson.build        |  2 +-
- src/kernel-install/meson.build |  2 +-
- src/login/meson.build          |  2 +-
- src/network/meson.build        |  2 +-
- src/pstore/meson.build         |  2 +-
- src/resolve/meson.build        |  2 +-
- src/timesync/meson.build       |  2 +-
- src/udev/meson.build           |  4 ++--
- sysctl.d/meson.build           |  2 +-
- tmpfiles.d/meson.build         |  2 +-
- units/meson.build              |  2 +-
- 18 files changed, 30 insertions(+), 27 deletions(-)
-
-diff --git a/hwdb.d/meson.build b/hwdb.d/meson.build
-index 5c77387a26..6404bc01ba 100644
---- a/hwdb.d/meson.build
-+++ b/hwdb.d/meson.build
-@@ -43,7 +43,7 @@ if conf.get('ENABLE_HWDB') == 1
-                      install_dir : udevhwdbdir)
- 
-         meson.add_install_script('sh', '-c',
--                                 mkdir_p.format(join_paths(sysconfdir, 'udev/hwdb.d')))
-+                                 mkdir_p.format(join_paths(factoryconfdir, 'udev/hwdb.d')))
- 
-         meson.add_install_script('sh', '-c',
-                                  'test -n "$DESTDIR" || @0@/systemd-hwdb update'
-diff --git a/meson.build b/meson.build
-index 2ef9d4d770..ae7acbd769 100644
---- a/meson.build
-+++ b/meson.build
-@@ -163,6 +163,9 @@ udevhwdbdir = join_paths(udevlibexecdir, 'hwdb.d')
- catalogdir = join_paths(prefixdir, 'lib/systemd/catalog')
- kernelinstalldir = join_paths(prefixdir, 'lib/kernel/install.d')
- factorydir = join_paths(datadir, 'factory')
-+factoryconfdir = join_paths(datadir, 'factory/etc')
-+factorypkgconfdir = join_paths(datadir, 'factory/etc/systemd')
-+factoryxinitrcdir = join_paths(datadir, 'factory/etc/X11/xinit/xinitrc.d')
- bootlibdir = join_paths(prefixdir, 'lib/systemd/boot/efi')
- testsdir = join_paths(prefixdir, 'lib/systemd/tests')
- systemdstatedir = join_paths(localstatedir, 'lib/systemd')
-@@ -2653,7 +2656,7 @@ if conf.get('ENABLE_BINFMT') == 1
-         meson.add_install_script('sh', '-c',
-                                  mkdir_p.format(binfmtdir))
-         meson.add_install_script('sh', '-c',
--                                 mkdir_p.format(join_paths(sysconfdir, 'binfmt.d')))
-+                                 mkdir_p.format(join_paths(factoryconfdir, 'binfmt.d')))
- endif
- 
- if conf.get('ENABLE_REPART') == 1
-@@ -2769,7 +2772,7 @@ executable(
-         install_dir : rootlibexecdir)
- 
- install_data('src/sleep/sleep.conf',
--             install_dir : pkgsysconfdir)
-+             install_dir : factorypkgconfdir)
- 
- public_programs += executable(
-         'systemd-sysctl',
-@@ -3103,7 +3106,7 @@ if conf.get('HAVE_KMOD') == 1
-         meson.add_install_script('sh', '-c',
-                                  mkdir_p.format(modulesloaddir))
-         meson.add_install_script('sh', '-c',
--                                 mkdir_p.format(join_paths(sysconfdir, 'modules-load.d')))
-+                                 mkdir_p.format(join_paths(factoryconfdir, 'modules-load.d')))
- endif
- 
- public_programs += executable(
-@@ -3354,7 +3357,7 @@ install_subdir('factory/etc',
-                install_dir : factorydir)
- 
- install_data('xorg/50-systemd-user.sh',
--             install_dir : xinitrcdir)
-+             install_dir : factoryxinitrcdir)
- install_data('modprobe.d/systemd.conf',
-              install_dir : modprobedir)
- install_data('LICENSE.GPL2',
-diff --git a/network/meson.build b/network/meson.build
-index 99a650eac3..8105a4e48d 100644
---- a/network/meson.build
-+++ b/network/meson.build
-@@ -11,7 +11,7 @@ if conf.get('ENABLE_NETWORKD') == 1
-                      install_dir : networkdir)
- 
-         meson.add_install_script('sh', '-c',
--                                 mkdir_p.format(join_paths(sysconfdir, 'systemd/network')))
-+                                 mkdir_p.format(join_paths(factoryconfdir, 'systemd/network')))
- endif
- 
- install_data('99-default.link',
-diff --git a/src/core/meson.build b/src/core/meson.build
-index fa95108523..60ee0e31c1 100644
---- a/src/core/meson.build
-+++ b/src/core/meson.build
-@@ -183,8 +183,8 @@ libcore = static_library(
- systemd_sources = files('main.c')
- 
- in_files = [['macros.systemd',   rpmmacrosdir],
--            ['system.conf',      pkgsysconfdir],
--            ['user.conf',        pkgsysconfdir],
-+            ['system.conf',      factorypkgconfdir],
-+            ['user.conf',        factorypkgconfdir],
-             ['systemd.pc',       pkgconfigdatadir],
-             ['triggers.systemd', '']]
- 
-@@ -216,6 +216,6 @@ meson.add_install_script('sh', '-c', mkdir_p.format(systemsleepdir))
- meson.add_install_script('sh', '-c', mkdir_p.format(systemgeneratordir))
- meson.add_install_script('sh', '-c', mkdir_p.format(usergeneratordir))
- 
--meson.add_install_script('sh', '-c', mkdir_p.format(join_paths(pkgsysconfdir, 'system')))
--meson.add_install_script('sh', '-c', mkdir_p.format(join_paths(pkgsysconfdir, 'user')))
--meson.add_install_script('sh', '-c', mkdir_p.format(join_paths(sysconfdir, 'xdg/systemd')))
-+meson.add_install_script('sh', '-c', mkdir_p.format(join_paths(factorypkgconfdir, 'system')))
-+meson.add_install_script('sh', '-c', mkdir_p.format(join_paths(factorypkgconfdir, 'user')))
-+meson.add_install_script('sh', '-c', mkdir_p.format(join_paths(factorypkgconfdir, 'xdg/systemd')))
-diff --git a/src/coredump/meson.build b/src/coredump/meson.build
-index 7fa5942697..34c865dfa0 100644
---- a/src/coredump/meson.build
-+++ b/src/coredump/meson.build
-@@ -15,7 +15,7 @@ coredumpctl_sources = files('coredumpctl.c')
- 
- if conf.get('ENABLE_COREDUMP') == 1
-         install_data('coredump.conf',
--                     install_dir : pkgsysconfdir)
-+                     install_dir : factorypkgconfdir)
- endif
- 
- tests += [
-diff --git a/src/home/meson.build b/src/home/meson.build
-index 797f3a3c6d..232904ab42 100644
---- a/src/home/meson.build
-+++ b/src/home/meson.build
-@@ -98,5 +98,5 @@ if conf.get('ENABLE_HOMED') == 1
-                      install_dir : polkitpolicydir)
-
-         install_data('homed.conf',
--                     install_dir : pkgsysconfdir)
-+                     install_dir : factoryconfdir)
- endif
-diff --git a/src/journal-remote/meson.build b/src/journal-remote/meson.build
-index 87b8ba6495..daff8ec967 100644
---- a/src/journal-remote/meson.build
-+++ b/src/journal-remote/meson.build
-@@ -49,7 +49,7 @@ if conf.get('ENABLE_REMOTE') ==1 and conf.get('HAVE_LIBCURL') == 1
-                 output : 'journal-upload.conf',
-                 configuration : substs)
-         install_data(journal_upload_conf,
--                     install_dir : pkgsysconfdir)
-+                     install_dir : factorypkgconfdir)
- endif
- 
- if conf.get('ENABLE_REMOTE') == 1 and conf.get('HAVE_MICROHTTPD') == 1
-@@ -58,7 +58,7 @@ if conf.get('ENABLE_REMOTE') == 1 and conf.get('HAVE_MICROHTTPD') == 1
-                 output : 'journal-remote.conf',
-                 configuration : substs)
-         install_data(journal_remote_conf,
--                     install_dir : pkgsysconfdir)
-+                     install_dir : factorypkgconfdir)
- 
-         install_data('browse.html',
-                      install_dir : join_paths(pkgdatadir, 'gatewayd'))
-diff --git a/src/journal/meson.build b/src/journal/meson.build
-index 5796f77cac..75d975c260 100644
---- a/src/journal/meson.build
-+++ b/src/journal/meson.build
-@@ -109,7 +109,7 @@ if conf.get('HAVE_QRENCODE') == 1
- endif
- 
- install_data('journald.conf',
--             install_dir : pkgsysconfdir)
-+             install_dir : factorypkgconfdir)
- 
- if get_option('create-log-dirs')
-         meson.add_install_script(
-diff --git a/src/kernel-install/meson.build b/src/kernel-install/meson.build
-index 9ae342dfba..65df666337 100644
---- a/src/kernel-install/meson.build
-+++ b/src/kernel-install/meson.build
-@@ -14,5 +14,5 @@ if want_kernel_install
- 		install_dir : kernelinstalldir)
- 
- 	meson.add_install_script('sh', '-c',
--				mkdir_p.format(join_paths(sysconfdir, 'kernel/install.d')))
-+				mkdir_p.format(join_paths(factoryconfdir, 'kernel/install.d')))
- endif
-diff --git a/src/login/meson.build b/src/login/meson.build
-index 0a7d3d5440..ff90149c1c 100644
---- a/src/login/meson.build
-+++ b/src/login/meson.build
-@@ -75,7 +75,7 @@ if conf.get('ENABLE_LOGIND') == 1
-                 output : 'logind.conf',
-                 configuration : substs)
-         install_data(logind_conf,
--                     install_dir : pkgsysconfdir)
-+                     install_dir : factorypkgconfdir)
- 
-         install_data('org.freedesktop.login1.conf',
-                      install_dir : dbuspolicydir)
-diff --git a/src/network/meson.build b/src/network/meson.build
-index b3a88d9910..be56d1e9d7 100644
---- a/src/network/meson.build
-+++ b/src/network/meson.build
-@@ -229,7 +229,7 @@ if conf.get('ENABLE_NETWORKD') == 1
-         endif
- 
-         install_data('networkd.conf',
--                     install_dir : pkgsysconfdir)
-+                     install_dir : factorypkgconfdir)
- 
-         fuzzers += [
-     [['src/network/fuzz-netdev-parser.c',
-diff --git a/src/pstore/meson.build b/src/pstore/meson.build
-index adbac24b54..e9dc88dfa2 100644
---- a/src/pstore/meson.build
-+++ b/src/pstore/meson.build
-@@ -6,5 +6,5 @@ systemd_pstore_sources = files('''
- 
- if conf.get('ENABLE_PSTORE') == 1
-         install_data('pstore.conf',
--                     install_dir : pkgsysconfdir)
-+                     install_dir : factorypkgconfdir)
- endif
-diff --git a/src/resolve/meson.build b/src/resolve/meson.build
-index 92b67b6333..ac5b9a0b0a 100644
---- a/src/resolve/meson.build
-+++ b/src/resolve/meson.build
-@@ -168,7 +168,7 @@ if conf.get('ENABLE_RESOLVE') == 1
-                 output : 'resolved.conf',
-                 configuration : substs)
-         install_data(resolved_conf,
--                     install_dir : pkgsysconfdir)
-+                     install_dir : factorypkgconfdir)
- 
-         install_data('resolv.conf',
-                      install_dir : rootlibexecdir)
-diff --git a/src/timesync/meson.build b/src/timesync/meson.build
-index e5c118c8db..19235df9ca 100644
---- a/src/timesync/meson.build
-+++ b/src/timesync/meson.build
-@@ -27,7 +27,7 @@ if conf.get('ENABLE_TIMESYNCD') == 1
-                 output : 'timesyncd.conf',
-                 configuration : substs)
-         install_data(timesyncd_conf,
--                     install_dir : pkgsysconfdir)
-+                     install_dir : factorypkgconfdir)
-         install_data('org.freedesktop.timesync1.conf',
-                      install_dir : dbuspolicydir)
-         install_data('org.freedesktop.timesync1.service',
-diff --git a/src/udev/meson.build b/src/udev/meson.build
-index aa23b07090..ad004d803a 100644
---- a/src/udev/meson.build
-+++ b/src/udev/meson.build
-@@ -186,7 +186,7 @@ foreach prog : [['ata_id/ata_id.c'],
- endforeach
- 
- install_data('udev.conf',
--             install_dir : join_paths(sysconfdir, 'udev'))
-+             install_dir : join_paths(factoryconfdir, 'udev'))
- 
- configure_file(
-         input : 'udev.pc.in',
-@@ -195,7 +195,7 @@ configure_file(
-         install_dir : pkgconfigdatadir == 'no' ? '' : pkgconfigdatadir)
- 
- meson.add_install_script('sh', '-c',
--                         mkdir_p.format(join_paths(sysconfdir, 'udev/rules.d')))
-+                         mkdir_p.format(join_paths(factoryconfdir, 'udev/rules.d')))
- 
- fuzzers += [
-         [['src/udev/net/fuzz-link-parser.c',
-diff --git a/sysctl.d/meson.build b/sysctl.d/meson.build
-index 3f072e3db7..bd9f843eba 100644
---- a/sysctl.d/meson.build
-+++ b/sysctl.d/meson.build
-@@ -27,4 +27,4 @@ foreach file : in_files
- endforeach
- 
- meson.add_install_script('sh', '-c',
--                         mkdir_p.format(join_paths(sysconfdir, 'sysctl.d')))
-+                         mkdir_p.format(join_paths(factoryconfdir, 'sysctl.d')))
-diff --git a/tmpfiles.d/meson.build b/tmpfiles.d/meson.build
-index 0a9582d8b9..3c56ca7d83 100644
---- a/tmpfiles.d/meson.build
-+++ b/tmpfiles.d/meson.build
-@@ -58,5 +58,5 @@ endforeach
- if enable_tmpfiles
-         meson.add_install_script(
-                 'sh', '-c',
--                mkdir_p.format(join_paths(sysconfdir, 'tmpfiles.d')))
-+                mkdir_p.format(join_paths(factoryconfdir, 'tmpfiles.d')))
- endif
-diff --git a/units/meson.build b/units/meson.build
-index 275daad3f4..491abd8eef 100644
---- a/units/meson.build
-+++ b/units/meson.build
-@@ -324,7 +324,7 @@ install_data('user-.slice.d/10-defaults.conf',
- 
- meson.add_install_script(meson_make_symlink,
-                          join_paths(pkgsysconfdir, 'user'),
--                         join_paths(sysconfdir, 'xdg/systemd/user'))
-+                         join_paths(factorypkgconfdir, 'xdg/systemd/user'))
- meson.add_install_script(meson_make_symlink,
-                          join_paths(dbussystemservicedir, 'org.freedesktop.systemd1.service'),
-                          join_paths(dbussessionservicedir, 'org.freedesktop.systemd1.service'))
--- 
-2.28.0
-
diff --git a/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch b/pkgs/os-specific/linux/systemd/0012-inherit-systemd-environment-when-calling-generators.patch
index 8df92b3e14f..00d085d8a70 100644
--- a/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch
+++ b/pkgs/os-specific/linux/systemd/0012-inherit-systemd-environment-when-calling-generators.patch
@@ -1,7 +1,7 @@
-From 4cbc82570aa8671d260c37df58688cc07106e4b6 Mon Sep 17 00:00:00 2001
+From a569dc0bdb43edb79e338c897f06de2dfa81cfc7 Mon Sep 17 00:00:00 2001
 From: Andreas Rammhold <andreas@rammhold.de>
 Date: Fri, 2 Nov 2018 21:15:42 +0100
-Subject: [PATCH 13/18] inherit systemd environment when calling generators.
+Subject: [PATCH 12/18] inherit systemd environment when calling generators.
 
 Systemd generators need access to the environment configured in
 stage-2-init.sh since it schedules fsck and mkfs executions based on
@@ -16,10 +16,10 @@ executables that are being called from managers.
  1 file changed, 8 insertions(+), 3 deletions(-)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 6b7908fc6c..dff265c76f 100644
+index 1f1450b97c..26b9e41d78 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -4098,9 +4098,14 @@ static int manager_run_generators(Manager *m) {
+@@ -4111,9 +4111,14 @@ static int manager_run_generators(Manager *m) {
          argv[4] = NULL;
  
          RUN_WITH_UMASK(0022)
@@ -38,5 +38,5 @@ index 6b7908fc6c..dff265c76f 100644
  
  finish:
 -- 
-2.28.0
+2.29.2
 
diff --git a/pkgs/os-specific/linux/systemd/0014-add-rootprefix-to-lookup-dir-paths.patch b/pkgs/os-specific/linux/systemd/0013-add-rootprefix-to-lookup-dir-paths.patch
index bb7a9f9474f..51fc4cc30d7 100644
--- a/pkgs/os-specific/linux/systemd/0014-add-rootprefix-to-lookup-dir-paths.patch
+++ b/pkgs/os-specific/linux/systemd/0013-add-rootprefix-to-lookup-dir-paths.patch
@@ -1,7 +1,7 @@
-From 1f39dba787e07d0a6944416ec172ee5d7cc86acd Mon Sep 17 00:00:00 2001
+From d36d688e32b8f2368499af091c67a7825fadf5ad Mon Sep 17 00:00:00 2001
 From: Andreas Rammhold <andreas@rammhold.de>
 Date: Thu, 9 May 2019 11:15:22 +0200
-Subject: [PATCH 14/18] add rootprefix to lookup dir paths
+Subject: [PATCH 13/18] add rootprefix to lookup dir paths
 
 systemd does not longer use the UDEVLIBEXEC directory as root for
 discovery default udev rules. By adding `$out/lib` to the lookup paths
@@ -12,7 +12,7 @@ files that I might have missed.
  1 file changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/src/basic/def.h b/src/basic/def.h
-index 970654a1ad..bb261040f8 100644
+index 2e60abb4f1..732ec51d36 100644
 --- a/src/basic/def.h
 +++ b/src/basic/def.h
 @@ -39,13 +39,15 @@
@@ -34,5 +34,5 @@ index 970654a1ad..bb261040f8 100644
  #define CONF_PATHS(n)                           \
          CONF_PATHS_USR(n)                       \
 -- 
-2.28.0
+2.29.2
 
diff --git a/pkgs/os-specific/linux/systemd/0015-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch b/pkgs/os-specific/linux/systemd/0014-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
index 86ab43c1908..57499d1feec 100644
--- a/pkgs/os-specific/linux/systemd/0015-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+++ b/pkgs/os-specific/linux/systemd/0014-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
@@ -1,7 +1,7 @@
-From f7c462d37063b0077345395f54377c39d1ef0590 Mon Sep 17 00:00:00 2001
+From c02b7eb62e46145ec5b544ebd9338c29b9b8f32c Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <ab@fmap.me>
 Date: Thu, 25 Jul 2019 20:45:55 +0300
-Subject: [PATCH 15/18] systemd-shutdown: execute scripts in
+Subject: [PATCH 14/18] systemd-shutdown: execute scripts in
  /etc/systemd/system-shutdown
 
 This is needed for NixOS to use such scripts as systemd directory is immutable.
@@ -10,7 +10,7 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c
-index 06c9710c6e..dadcc3117d 100644
+index 0d07865542..26d974ef73 100644
 --- a/src/shutdown/shutdown.c
 +++ b/src/shutdown/shutdown.c
 @@ -312,7 +312,7 @@ int main(int argc, char *argv[]) {
@@ -23,5 +23,5 @@ index 06c9710c6e..dadcc3117d 100644
          /* The log target defaults to console, but the original systemd process will pass its log target in through a
           * command line argument, which will override this default. Also, ensure we'll never log to the journal or
 -- 
-2.28.0
+2.29.2
 
diff --git a/pkgs/os-specific/linux/systemd/0016-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch b/pkgs/os-specific/linux/systemd/0015-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
index 8d20b3723af..fa72b66911a 100644
--- a/pkgs/os-specific/linux/systemd/0016-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+++ b/pkgs/os-specific/linux/systemd/0015-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
@@ -1,7 +1,7 @@
-From ff7cfe2d112eb166cd1937c3cc8c25491e508313 Mon Sep 17 00:00:00 2001
+From f01b73709d68d4581ad561fbb20c59f895132a99 Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <ab@fmap.me>
 Date: Thu, 25 Jul 2019 20:46:58 +0300
-Subject: [PATCH 16/18] systemd-sleep: execute scripts in
+Subject: [PATCH 15/18] systemd-sleep: execute scripts in
  /etc/systemd/system-sleep
 
 This is needed for NixOS to use such scripts as systemd directory is immutable.
@@ -10,10 +10,10 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
  1 file changed, 1 insertion(+)
 
 diff --git a/src/sleep/sleep.c b/src/sleep/sleep.c
-index 600e9c23c0..66ef1a99e1 100644
+index 39ab554290..880ac7ccb0 100644
 --- a/src/sleep/sleep.c
 +++ b/src/sleep/sleep.c
-@@ -182,6 +182,7 @@ static int execute(char **modes, char **states) {
+@@ -178,6 +178,7 @@ static int execute(char **modes, char **states) {
          };
          static const char* const dirs[] = {
                  SYSTEM_SLEEP_PATH,
@@ -22,5 +22,5 @@ index 600e9c23c0..66ef1a99e1 100644
          };
  
 -- 
-2.28.0
+2.29.2
 
diff --git a/pkgs/os-specific/linux/systemd/0017-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch b/pkgs/os-specific/linux/systemd/0016-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch
index 6dc33fd0341..887864baec3 100644
--- a/pkgs/os-specific/linux/systemd/0017-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch
+++ b/pkgs/os-specific/linux/systemd/0016-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch
@@ -1,7 +1,7 @@
-From 600ac2dd3fc15c5717fcdf8f37899fdabf97268c Mon Sep 17 00:00:00 2001
+From 3db343c08a09a0009da049f37e3f981519eac62f Mon Sep 17 00:00:00 2001
 From: Florian Klink <flokli@flokli.de>
 Date: Sat, 7 Mar 2020 22:40:27 +0100
-Subject: [PATCH 17/18] kmod-static-nodes.service: Update ConditionFileNotEmpty
+Subject: [PATCH 16/18] kmod-static-nodes.service: Update ConditionFileNotEmpty
 
 On NixOS, kernel modules of the currently booted systems are located at
 /run/booted-system/kernel-modules/lib/modules/%v/, not /lib/modules/%v/.
@@ -10,7 +10,7 @@ On NixOS, kernel modules of the currently booted systems are located at
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/units/kmod-static-nodes.service.in b/units/kmod-static-nodes.service.in
-index 0971edf9ec..87105a87b9 100644
+index f4170d6a99..9a6a591bea 100644
 --- a/units/kmod-static-nodes.service.in
 +++ b/units/kmod-static-nodes.service.in
 @@ -12,7 +12,7 @@ Description=Create list of static device nodes for the current kernel
@@ -23,5 +23,5 @@ index 0971edf9ec..87105a87b9 100644
  [Service]
  Type=oneshot
 -- 
-2.28.0
+2.29.2
 
diff --git a/pkgs/os-specific/linux/systemd/0018-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch b/pkgs/os-specific/linux/systemd/0017-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
index bf011f701ec..ad92291c258 100644
--- a/pkgs/os-specific/linux/systemd/0018-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+++ b/pkgs/os-specific/linux/systemd/0017-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
@@ -1,7 +1,7 @@
-From 42419ff4dc7a36607189f8d3765aa836d5c5eaf9 Mon Sep 17 00:00:00 2001
+From 6f0e9a60dcd2160bcab01366bd521630f6f5dc76 Mon Sep 17 00:00:00 2001
 From: Florian Klink <flokli@flokli.de>
 Date: Sun, 8 Mar 2020 01:05:54 +0100
-Subject: [PATCH 18/18] path-util.h: add placeholder for DEFAULT_PATH_NORMAL
+Subject: [PATCH 17/18] path-util.h: add placeholder for DEFAULT_PATH_NORMAL
 
 This will be the $PATH used to lookup ExecStart= etc. options, which
 systemd itself uses extensively.
@@ -10,7 +10,7 @@ systemd itself uses extensively.
  1 file changed, 3 insertions(+), 3 deletions(-)
 
 diff --git a/src/basic/path-util.h b/src/basic/path-util.h
-index 30031fca8e..d97145539a 100644
+index d613709f0b..5cced4c115 100644
 --- a/src/basic/path-util.h
 +++ b/src/basic/path-util.h
 @@ -24,11 +24,11 @@
@@ -29,5 +29,5 @@ index 30031fca8e..d97145539a 100644
  #if HAVE_SPLIT_USR
  #  define DEFAULT_PATH DEFAULT_PATH_SPLIT_USR
 -- 
-2.28.0
+2.29.2
 
diff --git a/pkgs/os-specific/linux/systemd/0019-logind-seat-debus-show-CanMultiSession-again.patch b/pkgs/os-specific/linux/systemd/0018-logind-seat-debus-show-CanMultiSession-again.patch
index 4f8cc0822d3..52a749a16b6 100644
--- a/pkgs/os-specific/linux/systemd/0019-logind-seat-debus-show-CanMultiSession-again.patch
+++ b/pkgs/os-specific/linux/systemd/0018-logind-seat-debus-show-CanMultiSession-again.patch
@@ -1,7 +1,7 @@
-From 3999d8949ddaf9296928f603661abcea13576d83 Mon Sep 17 00:00:00 2001
+From 120b53a3279ba098ee8e5a346b39cb2b7ef4a106 Mon Sep 17 00:00:00 2001
 From: Thomas Tuegel <ttuegel@mailbox.org>
 Date: Mon, 26 Oct 2020 21:21:38 +0100
-Subject: [PATCH 19/19] logind-seat-debus: show CanMultiSession again
+Subject: [PATCH 18/18] logind-seat-debus: show CanMultiSession again
 
 Fixes the "switch user" function in Plasma < 5.20.
 ---
@@ -9,10 +9,10 @@ Fixes the "switch user" function in Plasma < 5.20.
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/login/logind-seat-dbus.c b/src/login/logind-seat-dbus.c
-index a91765205c..742aeb1064 100644
+index a60ed2d3c2..69b6271075 100644
 --- a/src/login/logind-seat-dbus.c
 +++ b/src/login/logind-seat-dbus.c
-@@ -451,7 +451,7 @@ static const sd_bus_vtable seat_vtable[] = {
+@@ -450,7 +450,7 @@ static const sd_bus_vtable seat_vtable[] = {
  
          SD_BUS_PROPERTY("Id", "s", NULL, offsetof(Seat, id), SD_BUS_VTABLE_PROPERTY_CONST),
          SD_BUS_PROPERTY("ActiveSession", "(so)", property_get_active_session, 0, SD_BUS_VTABLE_PROPERTY_EMITS_CHANGE),
@@ -22,5 +22,5 @@ index a91765205c..742aeb1064 100644
          SD_BUS_PROPERTY("CanGraphical", "b", property_get_can_graphical, 0, SD_BUS_VTABLE_PROPERTY_EMITS_CHANGE),
          SD_BUS_PROPERTY("Sessions", "a(so)", property_get_sessions, 0, 0),
 -- 
-2.28.0
+2.29.2
 
diff --git a/pkgs/os-specific/linux/systemd/0019-Revert-pkg-config-prefix-is-not-really-configurable-.patch b/pkgs/os-specific/linux/systemd/0019-Revert-pkg-config-prefix-is-not-really-configurable-.patch
new file mode 100644
index 00000000000..11e61959328
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0019-Revert-pkg-config-prefix-is-not-really-configurable-.patch
@@ -0,0 +1,72 @@
+From cd5b1075499b8498d9c700a317ad11a3199c447a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
+Date: Sun, 6 Dec 2020 08:34:19 +0100
+Subject: [PATCH 19/19] Revert "pkg-config: prefix is not really configurable,
+ don't pretend it was"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This reverts commit 6e65df89c348242dbd10036abc7dd5e8181cf733.
+
+Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
+---
+ src/core/systemd.pc.in | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
+index ccb382e421..8a35e53a4a 100644
+--- a/src/core/systemd.pc.in
++++ b/src/core/systemd.pc.in
+@@ -11,7 +11,7 @@
+ # considered deprecated (though there is no plan to remove them). New names
+ # shall have underscores.
+ 
+-prefix=/usr
++prefix=@prefix@
+ root_prefix=@rootprefix_noslash@
+ rootprefix=${root_prefix}
+ sysconf_dir=@sysconfdir@
+@@ -26,10 +26,10 @@ systemdsystemunitdir=${systemd_system_unit_dir}
+ systemd_system_preset_dir=${rootprefix}/lib/systemd/system-preset
+ systemdsystempresetdir=${systemd_system_preset_dir}
+ 
+-systemd_user_unit_dir=/usr/lib/systemd/user
++systemd_user_unit_dir=${prefix}/lib/systemd/user
+ systemduserunitdir=${systemd_user_unit_dir}
+ 
+-systemd_user_preset_dir=/usr/lib/systemd/user-preset
++systemd_user_preset_dir=${prefix}/lib/systemd/user-preset
+ systemduserpresetdir=${systemd_user_preset_dir}
+ 
+ systemd_system_conf_dir=${sysconfdir}/systemd/system
+@@ -48,7 +48,7 @@ systemduserunitpath=${systemd_user_unit_path}
+ systemd_system_generator_dir=${root_prefix}/lib/systemd/system-generators
+ systemdsystemgeneratordir=${systemd_system_generator_dir}
+ 
+-systemd_user_generator_dir=/usr/lib/systemd/user-generators
++systemd_user_generator_dir=${prefix}/lib/systemd/user-generators
+ systemdusergeneratordir=${systemd_user_generator_dir}
+ 
+ systemd_system_generator_path=/run/systemd/system-generators:/etc/systemd/system-generators:/usr/local/lib/systemd/system-generators:${systemd_system_generator_dir}
+@@ -63,7 +63,7 @@ systemdsleepdir=${systemd_sleep_dir}
+ systemd_shutdown_dir=${root_prefix}/lib/systemd/system-shutdown
+ systemdshutdowndir=${systemd_shutdown_dir}
+ 
+-tmpfiles_dir=/usr/lib/tmpfiles.d
++tmpfiles_dir=${prefix}/lib/tmpfiles.d
+ tmpfilesdir=${tmpfiles_dir}
+ 
+ sysusers_dir=${rootprefix}/lib/sysusers.d
+@@ -78,7 +78,7 @@ binfmtdir=${binfmt_dir}
+ modules_load_dir=${rootprefix}/lib/modules-load.d
+ modulesloaddir=${modules_load_dir}
+ 
+-catalog_dir=/usr/lib/systemd/catalog
++catalog_dir=${prefix}/lib/systemd/catalog
+ catalogdir=${catalog_dir}
+ 
+ system_uid_max=@SYSTEM_UID_MAX@
+-- 
+2.29.2
+
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index f7a51ff9a03..f1a0f06eb58 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , buildPackages
 , ninja
 , meson
@@ -71,6 +72,7 @@
 , withMachined ? true
 , withNetworkd ? true
 , withNss ? true
+, withOomd ? false
 , withPCRE2 ? true
 , withPolkit ? true
 , withPortabled ? false
@@ -80,8 +82,8 @@
 , withTimedated ? true
 , withTimesyncd ? true
 , withUserDb ? true
-, p11-kit
 , libfido2
+, p11-kit
 
   # name argument
 , pname ? "systemd"
@@ -109,7 +111,7 @@ assert withCryptsetup ->
 let
   wantCurl = withRemote || withImportd;
 
-  version = "246.6";
+  version = "247";
 in
 stdenv.mkDerivation {
   inherit version pname;
@@ -118,14 +120,15 @@ stdenv.mkDerivation {
   # This has proven to be less error-prone than the previous systemd fork.
   src = fetchFromGitHub {
     owner = "systemd";
-    repo = "systemd-stable";
+    repo = "systemd";
     rev = "v${version}";
-    sha256 = "1yhj2jlighqqpw1xk9q52f3pncjn47ipi224k35d6syb94q2b988";
+    sha256 = "1nwsr6p65zy5jpabvjbszq5g556l1npaf2xsik4p4pvjjwnn1nx6";
   };
 
   # If these need to be regenerated, `git am path/to/00*.patch` them into a
   # systemd worktree, rebase to the more recent systemd version, and export the
   # patches again via `git format-patch v${version}`.
+  # Use `find . -name "*.patch" | sort` to get an up-to-date listing of all patches
   patches = [
     ./0001-Start-device-units-for-uninitialised-encrypted-devic.patch
     ./0002-Don-t-try-to-unmount-nix-or-nix-store.patch
@@ -138,14 +141,14 @@ stdenv.mkDerivation {
     ./0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
     ./0010-localectl-use-etc-X11-xkb-for-list-x11.patch
     ./0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
-    ./0012-Install-default-configuration-into-out-share-factory.patch
-    ./0013-inherit-systemd-environment-when-calling-generators.patch
-    ./0014-add-rootprefix-to-lookup-dir-paths.patch
-    ./0015-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
-    ./0016-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
-    ./0017-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch
-    ./0018-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
-    ./0019-logind-seat-debus-show-CanMultiSession-again.patch
+    ./0012-inherit-systemd-environment-when-calling-generators.patch
+    ./0013-add-rootprefix-to-lookup-dir-paths.patch
+    ./0014-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+    ./0015-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+    ./0016-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch
+    ./0017-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+    ./0018-logind-seat-debus-show-CanMultiSession-again.patch
+    ./0019-Revert-pkg-config-prefix-is-not-really-configurable-.patch
   ];
 
   postPatch = ''
@@ -239,6 +242,7 @@ stdenv.mkDerivation {
     "-Dhostnamed=${lib.boolToString withHostnamed}"
     "-Dmachined=${lib.boolToString withMachined}"
     "-Dnetworkd=${lib.boolToString withNetworkd}"
+    "-Doomd=${lib.boolToString withOomd}"
     "-Dpolkit=${lib.boolToString withPolkit}"
     "-Dcryptsetup=${lib.boolToString withCryptsetup}"
     "-Dportabled=${lib.boolToString withPortabled}"
@@ -259,6 +263,7 @@ stdenv.mkDerivation {
     "-Dldconfig=false"
     "-Dsmack=true"
     "-Db_pie=true"
+    "-Dinstall-sysconfdir=false"
     /*
     As of now, systemd doesn't allow runtime configuration of these values. So
     the settings in /etc/login.defs have no effect on it. Many people think this
@@ -338,7 +343,7 @@ stdenv.mkDerivation {
         --replace /bin/plymouth /run/current-system/sw/bin/plymouth # To avoid dependency
     done
 
-    for dir in tools src/resolve test src/test; do
+    for dir in tools src/resolve test src/test src/shared; do
       patchShebangs $dir
     done
 
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index a83e554b6f0..a2464aeb586 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -176,6 +176,11 @@ let
         maintainers = with maintainers; [ hmenke jcumming jonringer wizeman fpletz globin mic92 ];
       };
     };
+
+  linux-rt-patch = fetchpatch {
+    url = "https://github.com/openzfs/zfs/commit/ab4fb9b74e9d089fc9a261c4f41e19697ad6a4ca.patch";
+    sha256 = "1nrxmb4rhrkgncav6dzwm66l0700fi72qkkcs0w6pkm850srws36";
+  };
 in {
   # also check if kernel version constraints in
   # ./nixos/modules/tasks/filesystems/zfs.nix needs
@@ -188,6 +193,8 @@ in {
     version = "2.0.0";
 
     sha256 = "1kriz6pg8wj98izvjc60wp23lgcp4k3mzhpkgj74np73rzgy6v8r";
+
+    extraPatches = [ linux-rt-patch ];
   };
 
   zfsUnstable = common {
@@ -198,5 +205,7 @@ in {
     version = "2.0.0";
 
     sha256 = "1kriz6pg8wj98izvjc60wp23lgcp4k3mzhpkgj74np73rzgy6v8r";
+
+    extraPatches = [ linux-rt-patch ];
   };
 }
diff --git a/pkgs/servers/beanstalkd/default.nix b/pkgs/servers/beanstalkd/default.nix
index aa5f79ff8f1..d81feb3b72e 100644
--- a/pkgs/servers/beanstalkd/default.nix
+++ b/pkgs/servers/beanstalkd/default.nix
@@ -1,10 +1,9 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, installShellFiles }:
+
 stdenv.mkDerivation rec {
   version = "1.12";
   pname = "beanstalkd";
 
-  installPhase=''make install "PREFIX=$out"'';
-
   src = fetchurl {
     url = "https://github.com/kr/beanstalkd/archive/v${version}.tar.gz";
     sha256 = "0gw8aygysnjzzfjgfzivy5vajla9adg2zcr4h8rrdf0xyykpwfpl";
@@ -12,6 +11,14 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "fortify" ];
 
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installManPage doc/beanstalkd.1
+  '';
+
   meta = with stdenv.lib; {
     homepage = "http://kr.github.io/beanstalkd/";
     description = "A simple, fast work queue";
@@ -20,4 +27,3 @@ stdenv.mkDerivation rec {
     platforms = platforms.all;
   };
 }
-
diff --git a/pkgs/servers/consul/default.nix b/pkgs/servers/consul/default.nix
index 81cd2db7bd0..5d741cf0bba 100644
--- a/pkgs/servers/consul/default.nix
+++ b/pkgs/servers/consul/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "consul";
-  version = "1.9.0";
+  version = "1.9.1";
   rev = "v${version}";
 
   # Note: Currently only release tags are supported, because they have the Consul UI
@@ -17,7 +17,7 @@ buildGoModule rec {
     owner = "hashicorp";
     repo = pname;
     inherit rev;
-    sha256 = "06brmzj3h6my0pvi5n261180bfwgfn923702837jmkz7snpsdr9q";
+    sha256 = "06nw27crcrmz9p0hdc6g8ycq8p0kpbgf1g3i879f6h4jp4ca6zi3";
   };
 
   passthru.tests.consul = nixosTests.consul;
@@ -26,7 +26,7 @@ buildGoModule rec {
   # has a split module structure in one repo
   subPackages = ["." "connect/certgen"];
 
-  vendorSha256 = "1mc567zgymfz8iy6bg603f857c05xfna1npk2hh490dsnskkfag0";
+  vendorSha256 = "01fwbgdr4kxq4li83xxadl33ry1lkb3zhmcf2yrimfk042zabpck";
 
   doCheck = false;
 
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index bc0622e4f55..147ea06434b 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -87,8 +87,10 @@ in with py.pkgs; buildPythonApplication rec {
   postPatch = ''
     substituteInPlace setup.py \
       --replace "aiohttp==3.7.1" "aiohttp>=3.6.3" \
+      --replace "attrs==19.3.0" "attrs>=19.3.0" \
       --replace "bcrypt==3.1.7" "bcrypt>=3.1.7" \
       --replace "cryptography==3.2" "cryptography" \
+      --replace "pip>=8.0.3,<20.3" "pip" \
       --replace "requests==2.25.0" "requests>=2.24.0" \
       --replace "ruamel.yaml==0.15.100" "ruamel.yaml>=0.15.100"
     substituteInPlace tests/test_config.py --replace '"/usr"' '"/build/media"'
@@ -172,6 +174,8 @@ in with py.pkgs; buildPythonApplication rec {
     "test_device_tracker_not_home"
     # Racy https://github.com/home-assistant/core/issues/41425
     "test_cached_event_message"
+    # ValueError: count must be a positive integer (got 0)
+    "test_media_view"
   ];
 
   preCheck = ''
diff --git a/pkgs/servers/jackett/default.nix b/pkgs/servers/jackett/default.nix
index 97bac4fa92c..61a845d75f5 100644
--- a/pkgs/servers/jackett/default.nix
+++ b/pkgs/servers/jackett/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "jackett";
-  version = "0.16.2347";
+  version = "0.17.15";
 
   src = fetchurl {
     url = "https://github.com/Jackett/Jackett/releases/download/v${version}/Jackett.Binaries.Mono.tar.gz";
-    sha256 = "0xqmkcwlgic38frf1myybj34fp9qpabagxcbmbxvmjb1knw19lrm";
+    sha256 = "1pp5pnnmy8m0jvpxrldshcx71dl5g16dqvnnzaqhvs4cjhpgq8fw";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index ccd7428eefc..588113aa633 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "grafana";
-  version = "7.3.4";
+  version = "7.3.5";
 
   excludedPackages = [ "release_publisher" ];
 
@@ -10,15 +10,15 @@ buildGoModule rec {
     rev = "v${version}";
     owner = "grafana";
     repo = "grafana";
-    sha256 = "0vav3zhn4yw87z8xlcljs62xx4v3mxxvy0kgjh7w4njyqq1j3ayi";
+    sha256 = "1gxa1j7sd4xcyb2gh2ja6mwp0j4zcqwzaz25n9f9p9azhjyd2zh5";
   };
 
   srcStatic = fetchurl {
     url = "https://dl.grafana.com/oss/release/grafana-${version}.linux-amd64.tar.gz";
-    sha256 = "1fmfscfbdg2wdzf5fbad83pln4azy2y3fcghcanafkvqr2vv4hwk";
+    sha256 = "0vplzj5jrx643qp68kxg1g1gazxjrnx771dmc1703zalv28z8fq3";
   };
 
-  vendorSha256 = "0rn1zqczqa44k6g8rm9xdrd6hw5rbbvihcbzcdx758gv2lpbikxq";
+  vendorSha256 = "05brpjac54a8bxh7psy8gix9q2g36fr4z5msahp6i8wv2xfrf98b";
 
   postPatch = ''
     substituteInPlace pkg/cmd/grafana-server/main.go \
diff --git a/pkgs/servers/monitoring/prometheus/promscale.nix b/pkgs/servers/monitoring/prometheus/promscale.nix
index f8827b1f1fe..ccc096fb72c 100644
--- a/pkgs/servers/monitoring/prometheus/promscale.nix
+++ b/pkgs/servers/monitoring/prometheus/promscale.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "promscale";
-  version = "0.1.2";
+  version = "0.1.3";
 
   src = fetchFromGitHub {
     owner = "timescale";
     repo = pname;
     rev = version;
-    sha256 = "sha256-Yl61hX4YBddw0euTwheMIOy08jgS47rAU0cKyXiz9s4=";
+    sha256 = "sha256-xkVT7Kn7mW23p8oGU4AsmB66lNd4QLnhEW7J66ldFHM=";
   };
 
-  vendorSha256 = "sha256:1ilciwf08678sciwwrjalwvcs5bp7x254nxc3nhdf88cf0bp2nxi";
+  vendorSha256 = "sha256:1wfyawbdbabyp9nyhzfp632hg9rvwdyagsdqvvq6gv8bn5xfcjvh";
 
   buildFlagsArray = [ "-ldflags=-s -w -X github.com/timescale/promscale/pkg/version.Version=${version} -X github.com/timescale/promscale/pkg/version.CommitHash=${src.rev}" ];
 
diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index 6b1e7de8324..918c0419e00 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -1,7 +1,10 @@
 { stdenv, fetchurl, nixosTests }:
 
 let
-  generic = { version, sha256, insecure ? false }: stdenv.mkDerivation rec {
+  generic = {
+    version, sha256,
+    eol ? false, extraVulnerabilities ? []
+  }: stdenv.mkDerivation rec {
     pname = "nextcloud";
     inherit version;
 
@@ -23,7 +26,8 @@ let
       maintainers = with maintainers; [ schneefux bachp globin fpletz ma27 ];
       license = licenses.agpl3Plus;
       platforms = with platforms; unix;
-      knownVulnerabilities = optional insecure "Nextcloud version ${version} is EOL";
+      knownVulnerabilities = extraVulnerabilities
+        ++ (optional eol "Nextcloud version ${version} is EOL");
     };
   };
 in {
@@ -42,16 +46,19 @@ in {
   nextcloud18 = generic {
     version = "18.0.10";
     sha256 = "0kv9mdn36shr98kh27969b8xs7pgczbyjklrfskxy9mph7bbzir6";
-    insecure = true;
+    eol = true;
   };
 
   nextcloud19 = generic {
-    version = "19.0.4";
-    sha256 = "0y5fccn61qf9fxjjpqdvhmxr9w5n4dgl1d7wcl2dzjv4bmqi2ms6";
+    version = "19.0.6";
+    sha256 = "sha256-pqqIayE0OyTailtd2zeYi+G1APjv/YHqyO8jCpq7KJg=";
+    extraVulnerabilities = [
+      "Nextcloud 19 is still supported, but CVE-2020-8259 & CVE-2020-8152 are unfixed!"
+    ];
   };
 
   nextcloud20 = generic {
-    version = "20.0.1";
-    sha256 = "1z1fzz1i41k4dhdhi005l3gzkvnmmgqqz3rdr374cvk73q7bbiln";
+    version = "20.0.3";
+    sha256 = "sha256-4PZFBNM49k08Z3NX8AEs+LDtDcQuwI+Vi23E/3Dt8XU=";
   };
 }
diff --git a/pkgs/servers/pulseaudio/default.nix b/pkgs/servers/pulseaudio/default.nix
index c9e2c3aa6e5..70a964039fc 100644
--- a/pkgs/servers/pulseaudio/default.nix
+++ b/pkgs/servers/pulseaudio/default.nix
@@ -31,11 +31,11 @@
 
 stdenv.mkDerivation rec {
   name = "${if libOnly then "lib" else ""}pulseaudio-${version}";
-  version = "13.0";
+  version = "14.0";
 
   src = fetchurl {
     url = "http://freedesktop.org/software/pulseaudio/releases/pulseaudio-${version}.tar.xz";
-    sha256 = "0mw0ybrqj7hvf8lqs5gjzip464hfnixw453lr0mqzlng3b5266wn";
+    sha256 = "0qf20rgg0ysrnvg3359j56ndls07qmfn5rsy9r85bc42jdfpfd58";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/servers/web-apps/frab/default.nix b/pkgs/servers/web-apps/frab/default.nix
deleted file mode 100644
index 88e95be4619..00000000000
--- a/pkgs/servers/web-apps/frab/default.nix
+++ /dev/null
@@ -1,53 +0,0 @@
-{ stdenv, bundlerEnv, fetchFromGitHub, ruby, nodejs }:
-
-let
-  env = bundlerEnv {
-    name = "frab";
-    inherit ruby;
-    gemfile = ./Gemfile;
-    lockfile = ./Gemfile.lock;
-    gemset = ./gemset.nix;
-  };
-
-in
-
-stdenv.mkDerivation {
-  name = "frab-2016-12-28";
-
-  src = fetchFromGitHub {
-    owner = "frab";
-    repo = "frab";
-    rev = "e4bbcfd1a9db7f89f53a8702c236d9628bafb72c";
-    sha256 = "04pzmif8jxjww3fdf2zbg3k7cm49vxc9hhf4xhmvdmvywgin6fqp";
-  };
-
-  buildInputs = [ env nodejs ];
-
-  buildPhase = ''
-    cp config/database.yml.template config/database.yml
-    cp .env.development .env.production
-    bundler exec rake assets:precompile RAILS_ENV=production
-    rm .env.production
-  '';
-
-  installPhase = ''
-    mkdir -p $out/share
-    cp -r . $out/share/frab
-
-    ln -sf /run/frab/database.yml $out/share/frab/config/database.yml
-    rm -rf $out/share/frab/tmp $out/share/frab/public/system
-    ln -sf /run/frab/system $out/share/frab/public/system
-    ln -sf /tmp $out/share/frab/tmp
-  '';
-
-  passthru = {
-    inherit env ruby;
-  };
-
-  meta = with stdenv.lib; {
-    description = "Web-based conference planning and management system";
-    homepage = "https://github.com/frab/frab";
-    license = licenses.mit;
-    broken = true; # 2018-09-08; no successful hydra build since 2018-02-14
-  };
-}
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 27a2b47387f..42b2c69f688 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -2744,11 +2744,11 @@ lib.makeScope newScope (self: with self; {
   }) {};
 
   xrandr = callPackage ({ stdenv, pkgconfig, fetchurl, libX11, xorgproto, libXrandr, libXrender }: stdenv.mkDerivation {
-    name = "xrandr-1.5.0";
+    name = "xrandr-1.5.1";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/app/xrandr-1.5.0.tar.bz2";
-      sha256 = "1kaih7rmzxr1vp5a5zzjhm5x7dn9mckya088sqqw026pskhx9ky1";
+      url = "mirror://xorg/individual/app/xrandr-1.5.1.tar.xz";
+      sha256 = "0ql75s1n3dm2m3g1ilb9l6hqh15r0v709bgghpwazy3jknpnvivv";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index d4773075a25..4fc3f3304e1 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -61,7 +61,7 @@ mirror://xorg/individual/app/xmodmap-1.0.10.tar.bz2
 mirror://xorg/individual/app/xmore-1.0.3.tar.bz2
 mirror://xorg/individual/app/xpr-1.0.5.tar.bz2
 mirror://xorg/individual/app/xprop-1.2.5.tar.bz2
-mirror://xorg/individual/app/xrandr-1.5.0.tar.bz2
+mirror://xorg/individual/app/xrandr-1.5.1.tar.xz
 mirror://xorg/individual/app/xrdb-1.2.0.tar.bz2
 mirror://xorg/individual/app/xrefresh-1.0.6.tar.bz2
 mirror://xorg/individual/app/xset-1.2.4.tar.bz2
diff --git a/pkgs/tools/admin/exoscale-cli/default.nix b/pkgs/tools/admin/exoscale-cli/default.nix
index 36a1cf97a14..c2e6a4479ae 100644
--- a/pkgs/tools/admin/exoscale-cli/default.nix
+++ b/pkgs/tools/admin/exoscale-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "exoscale-cli";
-  version = "1.21.0";
+  version = "1.22.0";
 
   src = fetchFromGitHub {
     owner  = "exoscale";
     repo   = "cli";
     rev    = "v${version}";
-    sha256 = "12z5mbw7yzhyhzl6499xlhzpgysarjql4qlrpmwfpb8ij1hk8q6i";
+    sha256 = "1hxr5w8cd6f967cvhgqd3pvl8dlx2hb0pvjslzzbrs65djf8zh3k";
   };
 
   goPackagePath = "github.com/exoscale/cli";
diff --git a/pkgs/tools/archivers/xarchiver/default.nix b/pkgs/tools/archivers/xarchiver/default.nix
index fd53cd9b54b..022c05a4c6f 100644
--- a/pkgs/tools/archivers/xarchiver/default.nix
+++ b/pkgs/tools/archivers/xarchiver/default.nix
@@ -1,4 +1,5 @@
-{ stdenv, fetchFromGitHub, gtk3, pkgconfig, intltool, libxslt }:
+{ stdenv, fetchFromGitHub, gtk3, pkgconfig, intltool, libxslt, makeWrapper,
+  coreutils, zip, unzip, p7zip, unrar, gnutar, bzip2, gzip, lhasa, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   version = "0.5.4.14";
@@ -11,9 +12,14 @@ stdenv.mkDerivation rec {
     sha256 = "1iklwgykgymrwcc5p1cdbh91v0ih1m58s3w9ndl5kyd44bwlb7px";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig makeWrapper wrapGAppsHook ];
   buildInputs = [ gtk3 intltool libxslt ];
 
+  postFixup = ''
+    wrapProgram $out/bin/xarchiver \
+    --prefix PATH : ${stdenv.lib.makeBinPath [ zip unzip p7zip unrar gnutar bzip2 gzip lhasa coreutils ]}
+  '';
+
   meta = {
     description = "GTK frontend to 7z,zip,rar,tar,bzip2, gzip,arj, lha, rpm and deb (open and extract only)";
     homepage = "https://github.com/ib/xarchiver";
diff --git a/pkgs/tools/audio/audiowaveform/default.nix b/pkgs/tools/audio/audiowaveform/default.nix
new file mode 100644
index 00000000000..9d674dcfe43
--- /dev/null
+++ b/pkgs/tools/audio/audiowaveform/default.nix
@@ -0,0 +1,38 @@
+{ stdenv, fetchFromGitHub, cmake, gtest, boost, gd, libsndfile, libmad, libid3tag }:
+
+stdenv.mkDerivation rec {
+  pname = "audiowaveform";
+  version = "1.4.2";
+
+  src = fetchFromGitHub {
+    owner = "bbc";
+    repo = "audiowaveform";
+    rev = version;
+    sha256 = "0k2s2f2hgq4pnjzfkgvjwgsflihmzdq7shicfjn0z2mzw4d1bvp2";
+  };
+
+  nativeBuildInputs = [ cmake gtest ];
+
+  buildInputs = [ boost gd libsndfile libmad libid3tag ];
+
+  preConfigure = ''
+    ln -s ${gtest.src}/googletest googletest
+    ln -s ${gtest.src}/googlemock googlemock
+  '';
+
+  # One test is failing, see PR #101947
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "C++ program to generate waveform data and render waveform images from audio files";
+    longDescription = ''
+      audiowaveform is a C++ command-line application that generates waveform data from either MP3, WAV, FLAC, or Ogg Vorbis format audio files.
+      Waveform data can be used to produce a visual rendering of the audio, similar in appearance to audio editing applications.
+    '';
+    homepage = "https://github.com/bbc/audiowaveform";
+    changelog = "https://github.com/bbc/audiowaveform/blob/${version}/ChangeLog";
+    license = licenses.gpl3Plus;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ edbentley ];
+  };
+}
diff --git a/pkgs/tools/filesystems/e2fsprogs/default.nix b/pkgs/tools/filesystems/e2fsprogs/default.nix
index 469ed6fdf34..f846bf1f200 100644
--- a/pkgs/tools/filesystems/e2fsprogs/default.nix
+++ b/pkgs/tools/filesystems/e2fsprogs/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "e2fsprogs";
-  version = "1.45.5";
+  version = "1.45.6";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "1n8ffss5044j9382rlvmhyr1f6kmnfjfbv6q4jbbh8gfdwpjmrwi";
+    sha256 = "sha256-X2SsUKK2C45nxbOCuxN97Dk0QBcQPK/8OmFVRCTy1pM=";
   };
 
   outputs = [ "bin" "dev" "out" "man" "info" ];
diff --git a/pkgs/tools/filesystems/lizardfs/cmake-def-spdlog-fmt-external.patch b/pkgs/tools/filesystems/lizardfs/cmake-def-spdlog-fmt-external.patch
new file mode 100644
index 00000000000..51ffa92652e
--- /dev/null
+++ b/pkgs/tools/filesystems/lizardfs/cmake-def-spdlog-fmt-external.patch
@@ -0,0 +1,11 @@
+diff --color -ur a/CMakeLists.txt b/CMakeLists.txt
+--- a/CMakeLists.txt	2020-12-10 10:39:37.775694976 +0100
++++ b/CMakeLists.txt	2020-12-10 10:40:41.984575938 +0100
+@@ -127,6 +127,7 @@
+ add_definitions(-D__STDC_LIMIT_MACROS)
+ add_definitions(-D__STDC_CONSTANT_MACROS)
+ add_definitions(-D__STDC_FORMAT_MACROS)
++add_definitions(-DSPDLOG_FMT_EXTERNAL)
+ if(MINGW)
+   add_definitions(-DWINVER=0x0602)
+   add_definitions(-D_WIN32_WINNT=0x0602)
diff --git a/pkgs/tools/filesystems/lizardfs/default.nix b/pkgs/tools/filesystems/lizardfs/default.nix
index e2cb603ca3d..13086c067b0 100644
--- a/pkgs/tools/filesystems/lizardfs/default.nix
+++ b/pkgs/tools/filesystems/lizardfs/default.nix
@@ -16,6 +16,7 @@
 , judy
 , pam
 , spdlog
+, fmt
 , zlib # optional
 }:
 
@@ -30,13 +31,6 @@ stdenv.mkDerivation rec {
     sha256 = "0zk73wmx82ari3m2mv0zx04x1ggsdmwcwn7k6bkl5c0jnxffc4ax";
   };
 
-  nativeBuildInputs = [ cmake pkgconfig makeWrapper ];
-
-  buildInputs =
-    [ db fuse asciidoc libxml2 libxslt docbook_xml_dtd_412 docbook_xsl
-      zlib boost judy pam spdlog python2
-    ];
-
   patches = [
     # Use system-provided spdlog instead of downloading an old one (next two patches)
     (fetchpatch {
@@ -53,13 +47,26 @@ stdenv.mkDerivation rec {
       url = "https://github.com/lizardfs/lizardfs/commit/5d20c95179be09241b039050bceda3c46980c004.patch";
       sha256 = "185bfcz2rjr4cnxld2yc2nxwzz0rk4x1fl1sd25g8gr5advllmdv";
     })
+    # Add SPDLOG_FMT_EXTERNAL flag to disable spdlog from using bundled fmt
+    # Would use https://github.com/lizardfs/lizardfs/commit/31b0cd40f84ee75f99643ad19122061e3d6fb6cc.patch
+    # if it didn't failed to patch
+    ./cmake-def-spdlog-fmt-external.patch
+  ];
+
+  nativeBuildInputs = [ cmake pkgconfig makeWrapper ];
+
+  buildInputs =
+  [ db fuse asciidoc libxml2 libxslt docbook_xml_dtd_412 docbook_xsl
+    zlib boost judy pam spdlog fmt python2
   ];
+  
+  cmakeFlags = [ "-DSPDLOG_FMT_EXTERNAL=ON" ];
 
   meta = with stdenv.lib; {
     homepage = "https://lizardfs.com";
     description = "A highly reliable, scalable and efficient distributed file system";
     platforms = platforms.linux;
     license = licenses.gpl3;
-    maintainers = [ maintainers.rushmorem ];
+    maintainers = with maintainers; [ rushmorem shamilton ];
   };
 }
diff --git a/pkgs/tools/graphics/gnuplot/default.nix b/pkgs/tools/graphics/gnuplot/default.nix
index ce2a87981e7..26dec6d42c8 100644
--- a/pkgs/tools/graphics/gnuplot/default.nix
+++ b/pkgs/tools/graphics/gnuplot/default.nix
@@ -20,11 +20,11 @@ let
 in
 (if withQt then mkDerivation else stdenv.mkDerivation) rec {
   pname = "gnuplot";
-  version = "5.4.0";
+  version = "5.4.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/gnuplot/${pname}-${version}.tar.gz";
-    sha256 = "0iwwliq5a6qcawbpxk4d7l17fpkq9xxcz05kwblx37rr7bq84h7b";
+    sha256 = "03jrqs5lvxmbbz2c4g17dn2hrxqwd3hfadk9q8wbkbkyas2h8sbb";
   };
 
   nativeBuildInputs = [ makeWrapper pkgconfig texinfo ] ++ lib.optional withQt qttools;
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index 76c868f9b58..b910f3f9699 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -16,11 +16,11 @@ let
 in
 python3Packages.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "161";
+  version = "163";
 
   src = fetchurl {
     url    = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    sha256 = "sha256-Frk+aVUQhWn/TvlG4zy5+R2z92rFIwO4NPRXYkS0rN4=";
+    sha256 = "sha256-pCAOMRZ3sn1jhdT5RuIZoMR1e6GEYJYyd4mZt7+0lWE=";
   };
 
   outputs = [ "out" "man" ];
diff --git a/pkgs/tools/misc/direnv/default.nix b/pkgs/tools/misc/direnv/default.nix
index 050dcf2955f..185b97d7273 100644
--- a/pkgs/tools/misc/direnv/default.nix
+++ b/pkgs/tools/misc/direnv/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "direnv";
-  version = "2.25.0";
+  version = "2.25.1";
 
   vendorSha256 = null;
 
@@ -10,7 +10,7 @@ buildGoModule rec {
     owner = "direnv";
     repo = "direnv";
     rev = "v${version}";
-    sha256 = "00bvznswmz08s2jqpz5xxmkqggd06h6g8cwk242aaih6qajxfpsn";
+    sha256 = "0bwr7zdzjm5p6bjyzafc2n57y83f0pv2bmj99rhi8f94hhfydlsf";
   };
 
   # we have no bash at the moment for windows
diff --git a/pkgs/tools/misc/mcfly/default.nix b/pkgs/tools/misc/mcfly/default.nix
index ef353832112..68a2b877c91 100644
--- a/pkgs/tools/misc/mcfly/default.nix
+++ b/pkgs/tools/misc/mcfly/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mcfly";
-  version = "0.5.1";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "cantino";
     repo = "mcfly";
     rev = "v${version}";
-    sha256 = "1biahx4bji8kasqcxnixnpmfx3qwwibw1vdd172px3i75pbyybqn";
+    sha256 = "0a2jff72l5my00pg9lhjdmnwkqfv4hmnl0a9cfbnzsqh39lbklqy";
   };
 
   postInstall = ''
@@ -20,11 +20,12 @@ rustPlatform.buildRustPackage rec {
     install -Dm644 -t $out/share/mcfly mcfly.fish
   '';
 
-  cargoSha256 = "139pdhrqgl0ai94w2c948aal1j73qw4jxxdd4gxn4apglbnma1xz";
+  cargoSha256 = "1c8qjkpc8wi095zzmgd05721kdf1knh9la91l081mvwa3inwk6ax";
 
   meta = with stdenv.lib; {
     homepage = "https://github.com/cantino/mcfly";
     description = "An upgraded ctrl-r for Bash whose history results make sense for what you're working on right now";
+    changelog = "https://github.com/cantino/mcfly/blob/v${version}/CHANGELOG.txt";
     license = licenses.mit;
     maintainers = [ maintainers.melkor333 ];
   };
diff --git a/pkgs/tools/misc/q-text-as-data/default.nix b/pkgs/tools/misc/q-text-as-data/default.nix
index e70b8274d36..69d11ab3458 100644
--- a/pkgs/tools/misc/q-text-as-data/default.nix
+++ b/pkgs/tools/misc/q-text-as-data/default.nix
@@ -1,26 +1,32 @@
-{ stdenvNoCC, fetchFromGitHub, python2 }:
+{ lib, fetchFromGitHub, python3Packages }:
 
-stdenvNoCC.mkDerivation rec {
+python3Packages.buildPythonApplication rec {
   pname = "q-text-as-data";
-  version = "1.7.4";
+  version = "2.0.19";
 
   src = fetchFromGitHub {
     owner = "harelba";
     repo = "q";
     rev = version;
-    sha256 = "0p8rbfwwcqjyrix51v52zp9b03z4xg1fv2raf2ygqp9a4l27dca8";
+    sha256 = "18cwyfjgxxavclyd08bmb943c8bvzp1gnqp4klkq5xlgqwivr4sv";
   };
 
-  buildInputs = [ python2 ];
-  dontBuild = true;
+  propagatedBuildInputs = with python3Packages; [
+    setuptools
+    six
+  ];
 
-  installPhase = ''
-    mkdir -p $out/bin
-    cp bin/q $out/bin
-    chmod +x $out/bin/q
+  doCheck = false;
+
+  patchPhase = ''
+    # remove broken symlink
+    rm bin/qtextasdata.py
+
+    # not considered good practice pinning in install_requires
+    substituteInPlace setup.py --replace 'six==' 'six>='
   '';
 
-  meta = with stdenvNoCC.lib; {
+  meta = with lib; {
     description = "Run SQL directly on CSV or TSV files";
     longDescription = ''
       q is a command line tool that allows direct execution of SQL-like queries on CSVs/TSVs (and any other tabular text files).
diff --git a/pkgs/tools/misc/tagref/default.nix b/pkgs/tools/misc/tagref/default.nix
index 64870e07a3d..43a91eaca52 100644
--- a/pkgs/tools/misc/tagref/default.nix
+++ b/pkgs/tools/misc/tagref/default.nix
@@ -1,16 +1,16 @@
 { stdenv, lib, fetchFromGitHub, rustPlatform }:
 rustPlatform.buildRustPackage rec {
   pname = "tagref";
-  version = "1.3.3";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "stepchowfun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-3R6vhevSld9IjJMsGl5Rwv0ADMjm94NeZxvl8eYHR2Y=";
+    sha256 = "0y1c0v2zjpav1n72pgf3kpqdz6ixp2mjhcvvza4gzfp865c236nc";
   };
 
-  cargoSha256 = "sha256-pLugAT8QlgxawkR2y+LIacRh4nB59qpKLJjxc81CNDY=";
+  cargoSha256 = "06ljy213x9lhvqjysz9cjhrrg0ns07qkz27pxd8rih0mk6cck45g";
 
   meta = with lib; {
     description = "Tagref helps you refer to other locations in your codebase.";
diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix
index efa39f45096..fb57dcad9b5 100644
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@@ -18,11 +18,11 @@ buildPythonPackage rec {
   # The websites youtube-dl deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2020.12.07";
+  version = "2020.12.09";
 
   src = fetchurl {
     url = "https://yt-dl.org/downloads/${version}/${pname}-${version}.tar.gz";
-    sha256 = "0sbrwak9c0pbacg15q2wj5fcsj5k5k1sx9jm7rcjwkjdhqcjqrsi";
+    sha256 = "0qdris00jf6lb9q5qi3f5cyxya5a0sa8yqr6l204wns5px3n7iqa";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
diff --git a/pkgs/tools/networking/dnsproxy/default.nix b/pkgs/tools/networking/dnsproxy/default.nix
index b2c19e2acf9..e7c30551dc9 100644
--- a/pkgs/tools/networking/dnsproxy/default.nix
+++ b/pkgs/tools/networking/dnsproxy/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "dnsproxy";
-  version = "0.33.2";
+  version = "0.33.3";
 
   src = fetchFromGitHub {
     owner = "AdguardTeam";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0x005lgncaf1fzs27fpcpf6dcncb7wia6fka64pmjxdsq7nmh1hh";
+    sha256 = "0c7hqsb53711032svicr069gh7faacnsj2v36pj7srng266vk78p";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/tools/networking/linkchecker/default.nix b/pkgs/tools/networking/linkchecker/default.nix
index 2418d7e90cc..746a99ede59 100644
--- a/pkgs/tools/networking/linkchecker/default.nix
+++ b/pkgs/tools/networking/linkchecker/default.nix
@@ -38,7 +38,7 @@ buildPythonApplication rec {
   checkPhase = ''
     ${lib.optionalString stdenv.isDarwin ''
       # network tests fails on darwin
-      rm tests/test_network.py
+      rm tests/test_network.py tests/checker/test_http*.py tests/checker/test_content_allows_robots.py tests/checker/test_noproxy.py
     ''}
       pytest --ignore=tests/checker/{test_telnet,telnetserver}.py \
         -k 'not TestLoginUrl and not test_timeit2'
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index b6d9eb3448f..ce27f111377 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -22,11 +22,11 @@
 
 stdenv.mkDerivation rec {
   pname = "unbound";
-  version = "1.12.0";
+  version = "1.13.0";
 
   src = fetchurl {
     url = "https://unbound.net/downloads/${pname}-${version}.tar.gz";
-    sha256 = "0daqxzvknvcz7sgag3wcrxhp4a39ik93lsrfpwcl9whjg2lm74jv";
+    sha256 = "18dj7migq6379hps59793457l81s3z7dll3y0fj6qcmhjlx08m59";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
diff --git a/pkgs/tools/security/1password-gui/default.nix b/pkgs/tools/security/1password-gui/default.nix
index 777e7292fde..667a21343e6 100644
--- a/pkgs/tools/security/1password-gui/default.nix
+++ b/pkgs/tools/security/1password-gui/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "1password";
-  version = "0.9.6";
+  version = "0.9.7";
 
   src = fetchurl {
     url = "https://onepassword.s3.amazonaws.com/linux/appimage/${pname}-${version}.AppImage";
-    sha256 = "0464a5d39g20hif3dz3qr78dqb0cmxbazy0q48j9gkawhxm30c1h";
+    hash = "sha256-JaYFJL24Pgwh5CrsKjJPL8u0fx1x0beFTK+EGNT1iqA=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/system/bottom/default.nix b/pkgs/tools/system/bottom/default.nix
index 8c5e2833212..c7835c5989c 100644
--- a/pkgs/tools/system/bottom/default.nix
+++ b/pkgs/tools/system/bottom/default.nix
@@ -2,20 +2,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "bottom";
-  version = "0.5.3";
+  version = "0.5.4";
 
   src = fetchFromGitHub {
     owner = "ClementTsang";
     repo = pname;
     rev = version;
-    sha256 = "sha256-Gc2bL7KqDqab0hCCOi2rtEw+5r0bSETzTipLLdX/ipk=";
+    sha256 = "1rpwgwgl05n0s89mhyvabzvsa33ibkd1msyrwfll4wbcbsn0ish7";
   };
 
   nativeBuildInputs = [ installShellFiles ];
 
   buildInputs = stdenv.lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.IOKit;
 
-  cargoSha256 = "sha256-Bdkq3cTuziTQ7/BkvuBHbfuxRIXnz4h2OadoAGNTBc0=";
+  cargoSha256 = "0ykl66gs7k49vfjpw5i8xsbc1blmqm79vrsci2irsl5w642lbig5";
 
   doCheck = false;
 
diff --git a/pkgs/tools/typesetting/asciidoctor/Gemfile b/pkgs/tools/typesetting/asciidoctor/Gemfile
index f9329a80a81..702dabee2e0 100644
--- a/pkgs/tools/typesetting/asciidoctor/Gemfile
+++ b/pkgs/tools/typesetting/asciidoctor/Gemfile
@@ -4,6 +4,7 @@ gem 'asciidoctor-diagram'
 gem 'asciidoctor-pdf'
 gem 'asciidoctor-epub3'
 gem 'asciidoctor-mathematical'
+gem 'asciidoctor-revealjs'
 gem 'coderay'
 gem 'pygments.rb'
 gem 'rouge'
diff --git a/pkgs/tools/typesetting/asciidoctor/Gemfile.lock b/pkgs/tools/typesetting/asciidoctor/Gemfile.lock
index c928e954875..06a1716251a 100644
--- a/pkgs/tools/typesetting/asciidoctor/Gemfile.lock
+++ b/pkgs/tools/typesetting/asciidoctor/Gemfile.lock
@@ -28,6 +28,11 @@ GEM
       safe_yaml (~> 1.0.0)
       thread_safe (~> 0.3.0)
       treetop (~> 1.5.0)
+    asciidoctor-revealjs (4.0.1)
+      asciidoctor (>= 2.0.0, < 3.0.0)
+      concurrent-ruby (~> 1.0)
+      thread_safe (~> 0.3.5)
+    asciimath (2.0.1)
     coderay (1.1.2)
     concurrent-ruby (1.1.5)
     css_parser (1.7.0)
@@ -40,6 +45,9 @@ GEM
       concurrent-ruby (~> 1.0)
     mathematical (1.6.12)
       ruby-enum (~> 0.4)
+    mime-types (3.3.1)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2020.1104)
     mini_portile2 (2.4.0)
     multi_json (1.13.1)
     nokogiri (1.10.3)
@@ -88,6 +96,7 @@ DEPENDENCIES
   asciidoctor-epub3
   asciidoctor-mathematical
   asciidoctor-pdf
+  asciidoctor-revealjs
   coderay
   pygments.rb
   rouge
diff --git a/pkgs/tools/typesetting/asciidoctor/default.nix b/pkgs/tools/typesetting/asciidoctor/default.nix
index 7a01dc2ff0a..29b2b567be2 100644
--- a/pkgs/tools/typesetting/asciidoctor/default.nix
+++ b/pkgs/tools/typesetting/asciidoctor/default.nix
@@ -13,6 +13,7 @@ let
       "asciidoctor"
       "asciidoctor-pdf"
       "asciidoctor-epub3"
+      "asciidoctor-revealjs"
     ];
 
     buildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/typesetting/asciidoctor/gemset.nix b/pkgs/tools/typesetting/asciidoctor/gemset.nix
index 02700962eb2..db47fbf2285 100644
--- a/pkgs/tools/typesetting/asciidoctor/gemset.nix
+++ b/pkgs/tools/typesetting/asciidoctor/gemset.nix
@@ -84,6 +84,27 @@
     };
     version = "1.5.0.alpha.18";
   };
+  asciidoctor-revealjs = {
+    dependencies = ["asciidoctor" "concurrent-ruby" "thread_safe"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "084aq9frv4irzgd9ab3xad9i0ml9lb58w0wvg76gnwwr51plbpp4";
+      type = "gem";
+    };
+    version = "4.0.1";
+  };
+  asciimath = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1aapydwwkydbwgz07n7ma3a5jy9n3v0shy6q6j8mi4wr3crhx45a";
+      type = "gem";
+    };
+    version = "2.0.1";
+  };
   coderay = {
     groups = ["default"];
     platforms = [];
@@ -158,6 +179,27 @@
     };
     version = "1.6.12";
   };
+  mime-types = {
+    dependencies = ["mime-types-data"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1zj12l9qk62anvk9bjvandpa6vy4xslil15wl6wlivyf51z773vh";
+      type = "gem";
+    };
+    version = "3.3.1";
+  };
+  mime-types-data = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0ipjyfwn9nlvpcl8knq3jk4g5f12cflwdbaiqxcq1s7vwfwfxcag";
+      type = "gem";
+    };
+    version = "3.2020.1104";
+  };
   mini_portile2 = {
     groups = ["default"];
     platforms = [];
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 8009208739a..3d4ce4b4536 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -44,6 +44,7 @@ mapAliases ({
   aleth = throw "aleth (previously packaged as cpp_ethereum) has been removed; abandoned upstream."; # added 2020-11-30
   amazon-glacier-cmd-interface = throw "amazon-glacier-cmd-interface has been removed due to it being unmaintained."; # added 2020-10-30
   ammonite-repl = ammonite; # added 2017-05-02
+  amsn = throw "amsn has been removed due to being unmaintained."; # added 2020-12-09
   antimicro = throw "antimicro has been removed as it was broken, see antimicroX instead."; # added 2020-08-06
   arduino_core = arduino-core;  # added 2015-02-04
   arora = throw "arora has been removed."; # added 2020-09-09
@@ -62,6 +63,7 @@ mapAliases ({
   bridge_utils = bridge-utils;  # added 2015-02-20
   bro = zeek; # added 2019-09-29
   bootchart = throw "bootchart has been removed from nixpkgs, as it is without a maintainer"; # added 2019-12-10
+  bomi = throw "bomi has been removed from nixpkgs since it was broken and abandoned upstream"; # added 2020-12-10
   btrfsProgs = btrfs-progs; # added 2016-01-03
   bittorrentSync = throw "bittorrentSync has been deprecated by resilio-sync."; # added 2019-06-03
   bittorrentSync14 = throw "bittorrentSync14 has been deprecated by resilio-sync."; # added 2019-06-03
@@ -224,6 +226,7 @@ mapAliases ({
   icedtea8_web = adoptopenjdk-icedtea-web; # added 2019-08-21
   icedtea_web = adoptopenjdk-icedtea-web; # added 2019-08-21
   idea = jetbrains; # added 2017-04-03
+  inboxer = throw "inboxer has been removed as it is no longer maintained and no longer works as Google shut down the inbox service this package wrapped.";
   infiniband-diags = rdma-core; # added 2019-08-09
   inotifyTools = inotify-tools;
   jasper = throw "jasper has been removed: abandoned upstream with many vulnerabilities";
@@ -604,6 +607,7 @@ mapAliases ({
   systool = sysfsutils; # added 2018-04-25
   tahoelafs = tahoe-lafs; # added 2018-03-26
   tangogps = foxtrotgps; # added 2020-01-26
+  tdm = throw "tdm has been removed because nobody can figure out how to fix OpenAL integration. Use precompiled binary and `steam-run` instead.";
   telepathy_farstream = telepathy-farstream; # added 2018-02-25
   telepathy_gabble = telepathy-gabble; # added 2018-02-25
   telepathy_glib = telepathy-glib; # added 2018-02-25
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 816a4657a25..0c7c2919ec3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -178,6 +178,8 @@ in
 
   cereal = callPackage ../development/libraries/cereal { };
 
+  chrysalis = callPackage ../applications/misc/chrysalis { };
+
   clj-kondo = callPackage ../development/tools/clj-kondo { };
 
   cmark = callPackage ../development/libraries/cmark { };
@@ -240,6 +242,7 @@ in
 
   archiver = callPackage ../applications/misc/archiver { };
 
+  # It segfaults if it uses qt5.15
   digitalbitbox = libsForQt514.callPackage ../applications/misc/digitalbitbox { };
 
   gretl = callPackage ../applications/science/math/gretl { };
@@ -930,6 +933,8 @@ in
     inherit (darwin.apple_sdk.frameworks) Cocoa;
   };
 
+  audiowaveform = callPackage ../tools/audio/audiowaveform { };
+
   autoflake = callPackage ../development/tools/analysis/autoflake { };
 
   autospotting = callPackage ../applications/misc/autospotting { };
@@ -2930,13 +2935,14 @@ in
 
   circus = callPackage ../tools/networking/circus { };
 
-  citrix_workspace = citrix_workspace_20_10_0;
+  citrix_workspace = citrix_workspace_20_12_0;
 
   inherit (callPackage ../applications/networking/remote/citrix-workspace { })
     citrix_workspace_20_04_0
     citrix_workspace_20_06_0
     citrix_workspace_20_09_0
     citrix_workspace_20_10_0
+    citrix_workspace_20_12_0
   ;
 
   citra = libsForQt5.callPackage ../misc/emulators/citra { };
@@ -4597,7 +4603,7 @@ in
 
   hal-flash = callPackage ../os-specific/linux/hal-flash { };
 
-  hal-hardware-analyzer = libsForQt514.callPackage ../applications/science/electronics/hal-hardware-analyzer { };
+  hal-hardware-analyzer = libsForQt5.callPackage ../applications/science/electronics/hal-hardware-analyzer { };
 
   half = callPackage ../development/libraries/half { };
 
@@ -4816,8 +4822,6 @@ in
 
   inadyn = callPackage ../tools/networking/inadyn { };
 
-  inboxer = callPackage ../applications/networking/mailreaders/inboxer { };
-
   incron = callPackage ../tools/system/incron { };
 
   industrializer = callPackage ../applications/audio/industrializer { };
@@ -5997,7 +6001,7 @@ in
   inherit (callPackage ../servers/nextcloud {})
     nextcloud17 nextcloud18 nextcloud19 nextcloud20;
 
-  nextcloud-client = libsForQt514.callPackage ../applications/networking/nextcloud-client { };
+  nextcloud-client = libsForQt5.callPackage ../applications/networking/nextcloud-client { };
 
   nextcloud-news-updater = callPackage ../servers/nextcloud/news-updater.nix { };
 
@@ -6762,6 +6766,8 @@ in
 
   remarshal = callPackage ../development/tools/remarshal { };
 
+  rehex = callPackage ../applications/editors/rehex { };
+
   rig = callPackage ../tools/misc/rig {
     stdenv = gccStdenv;
   };
@@ -6818,7 +6824,7 @@ in
 
   qr-filetransfer = callPackage ../tools/networking/qr-filetransfer { };
 
-  qtikz = libsForQt514.callPackage ../applications/graphics/ktikz { };
+  qtikz = libsForQt5.callPackage ../applications/graphics/ktikz { };
 
   quickjs = callPackage ../development/interpreters/quickjs { };
 
@@ -7285,6 +7291,8 @@ in
 
   sipsak = callPackage ../tools/networking/sipsak { };
 
+  siril = callPackage ../applications/science/astronomy/siril { };
+
   sisco.lv2 = callPackage ../applications/audio/sisco.lv2 { };
 
   sit = callPackage ../applications/version-management/sit {
@@ -8348,7 +8356,7 @@ in
 
   vmtouch = callPackage ../tools/misc/vmtouch { };
 
-  vncdo = callPackage ../tools/admin/vncdo { };
+  vncdo = with python3Packages; toPythonApplication vncdo;
 
   volumeicon = callPackage ../tools/audio/volumeicon { };
 
@@ -14272,6 +14280,8 @@ in
 
   librime = callPackage ../development/libraries/librime {};
 
+  librtprocess = callPackage ../development/libraries/librtprocess { };
+
   libsamplerate = callPackage ../development/libraries/libsamplerate {
     inherit (darwin.apple_sdk.frameworks) ApplicationServices Carbon CoreServices;
   };
@@ -14638,7 +14648,9 @@ in
 
   libtomcrypt = callPackage ../development/libraries/libtomcrypt { };
 
-  libtorrentRasterbar-1_2_x = callPackage ../development/libraries/libtorrent-rasterbar/1.2 { };
+  libtorrentRasterbar-1_2_x = callPackage ../development/libraries/libtorrent-rasterbar/1.2 {
+    inherit (darwin.apple_sdk.frameworks) SystemConfiguration;
+  };
 
   libtorrentRasterbar-1_1_x = callPackage ../development/libraries/libtorrent-rasterbar/1.1 { };
 
@@ -16174,7 +16186,9 @@ in
 
   taglib-sharp = callPackage ../development/libraries/taglib-sharp { };
 
-  talloc = callPackage ../development/libraries/talloc { };
+  talloc = callPackage ../development/libraries/talloc {
+    wafHook = wafHook.override { python = python3; };
+  };
 
   tclap = callPackage ../development/libraries/tclap {};
 
@@ -17026,8 +17040,6 @@ in
   firebird = callPackage ../servers/firebird { icu = null; /*stdenv = gcc5Stdenv;*/ };
   firebirdSuper = firebird.override { icu = icu58; superServer = true; /*stdenv = gcc5Stdenv;*/ };
 
-  frab = callPackage ../servers/web-apps/frab { };
-
   freeradius = callPackage ../servers/freeradius { };
 
   freeswitch = callPackage ../servers/sip/freeswitch {
@@ -18209,6 +18221,10 @@ in
 
   openisns = callPackage ../os-specific/linux/open-isns { };
 
+  osx-cpu-temp = callPackage ../os-specific/darwin/osx-cpu-temp {
+    inherit (pkgs.darwin.apple_sdk.frameworks) IOKit;
+  };
+
   osxfuse = callPackage ../os-specific/darwin/osxfuse { };
 
   osxsnarf = callPackage ../os-specific/darwin/osxsnarf { };
@@ -18363,6 +18379,7 @@ in
       kernelPatches.bridge_stp_helper
       kernelPatches.request_key_helper
       kernelPatches.export_kernel_fpu_functions."5.3"
+      kernelPatches.export-rt-sched-migrate
     ];
   };
 
@@ -19172,6 +19189,7 @@ in
     withMachined = false;
     withNetworkd = false;
     withNss = false;
+    withOomd = false;
     withPCRE2 = false;
     withPolkit = false;
     withRemote = false;
@@ -20502,10 +20520,6 @@ in
 
   bombono = callPackage ../applications/video/bombono {};
 
-  bomi = libsForQt5.callPackage ../applications/video/bomi {
-    ffmpeg = ffmpeg_2;
-  };
-
   bonzomatic = callPackage ../applications/editors/bonzomatic { };
 
   brackets = callPackage ../applications/editors/brackets { gconf = gnome2.GConf; };
@@ -22281,14 +22295,13 @@ in
 
   kmplayer = libsForQt5.callPackage ../applications/video/kmplayer { };
 
-  # Pinned to qt5.14 due to kdewebkit (depends on qtwebkit) which is currently broken with qt5.15
-  kmymoney = libsForQt514.callPackage ../applications/office/kmymoney { };
+  kmymoney = libsForQt5.callPackage ../applications/office/kmymoney { };
 
   kodestudio = callPackage ../applications/editors/kodestudio { };
 
   kondo = callPackage ../applications/misc/kondo { };
 
-  konversation = libsForQt514.callPackage ../applications/networking/irc/konversation { };
+  konversation = libsForQt5.callPackage ../applications/networking/irc/konversation { };
 
   kotatogram-desktop = libsForQt514.callPackage ../applications/networking/instant-messengers/telegram/kotatogram-desktop { };
 
@@ -22378,6 +22391,8 @@ in
 
   legit = gitAndTools.legit;
 
+  lens = callPackage ../applications/networking/cluster/lens { };
+
   leo-editor = libsForQt5.callPackage ../applications/editors/leo-editor { };
 
   libowfat = callPackage ../development/libraries/libowfat { };
@@ -23595,7 +23610,7 @@ in
 
   qsstv = qt5.callPackage ../applications/radio/qsstv { };
 
-  qsyncthingtray = libsForQt514.callPackage ../applications/misc/qsyncthingtray { };
+  qsyncthingtray = libsForQt5.callPackage ../applications/misc/qsyncthingtray { };
 
   qstopmotion = libsForQt5.callPackage ../applications/video/qstopmotion {
     guvcview = guvcview.override {
@@ -24597,7 +24612,7 @@ in
 
   vkeybd = callPackage ../applications/audio/vkeybd {};
 
-  vlc = libsForQt514.callPackage ../applications/video/vlc {};
+  vlc = libsForQt5.callPackage ../applications/video/vlc {};
 
   vlc_qt5 = vlc;
 
@@ -28787,8 +28802,6 @@ in
     gcc-armhf-embedded = pkgsCross.armhf-embedded.buildPackages.gcc;
   };
 
-  tdm = callPackage ../games/tdm { };
-
   newlib = callPackage ../development/misc/newlib { };
   newlibCross = callPackage ../development/misc/newlib {
     stdenv = crossLibcStdenv;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 625045c1df1..421aca7033a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3649,7 +3649,24 @@ in {
 
   macropy = callPackage ../development/python-modules/macropy { };
 
-  maestral = callPackage ../development/python-modules/maestral { };
+  maestral = callPackage ../development/python-modules/maestral {
+
+    # https://github.com/SamSchott/maestral/issues/250#issuecomment-739510048
+    survey = self.survey.overridePythonAttrs (old: rec {
+      version = "2.2.1";
+      src = old.src.override {
+        inherit version;
+        sha256 = "sha256-7ubWkqk1vyaJDLMOuKwUx2Bjziyi3HqpaQq4pKp4Z+0=";
+      };
+    });
+    watchdog = self.watchdog.overridePythonAttrs (old: rec {
+      version = "0.10.3";
+      src = old.src.override {
+        inherit version;
+        sha256 = "4214e1379d128b0588021880ccaf40317ee156d4603ac388b9adcf29165e0c04";
+      };
+    });
+  };
 
   magic = callPackage ../development/python-modules/magic { };
 
@@ -6198,7 +6215,7 @@ in {
 
   pyzufall = callPackage ../development/python-modules/pyzufall { };
 
-  qasm2image = callPackage ../development/python-modules/qasm2image { };
+  qasm2image = throw "qasm2image is no longer maintained (since November 2018), and is not compatible with the latest pythonPackages.qiskit versions."; # added 2020-12-09
 
   qdarkstyle = callPackage ../development/python-modules/qdarkstyle { };
 
@@ -7123,6 +7140,8 @@ in {
 
   sure = callPackage ../development/python-modules/sure { };
 
+  survey = callPackage ../development/python-modules/survey { };
+
   suseapi = callPackage ../development/python-modules/suseapi { };
 
   svg2tikz = callPackage ../development/python-modules/svg2tikz { };
@@ -7418,7 +7437,10 @@ in {
 
   trackpy = callPackage ../development/python-modules/trackpy { };
 
-  traitlets = callPackage ../development/python-modules/traitlets { };
+  traitlets = if pythonOlder "3.7" then
+    callPackage ../development/python-modules/traitlets/4.nix { }
+  else
+    callPackage ../development/python-modules/traitlets { };
 
   traits = callPackage ../development/python-modules/traits { };
 
@@ -7700,6 +7722,8 @@ in {
 
   vmprof = callPackage ../development/python-modules/vmprof { };
 
+  vncdo = callPackage ../development/python-modules/vncdo { };
+
   vobject = callPackage ../development/python-modules/vobject { };
 
   voluptuous = callPackage ../development/python-modules/voluptuous { };
@@ -7811,6 +7835,8 @@ in {
 
   wptserve = callPackage ../development/python-modules/wptserve { };
 
+  wrapio = callPackage ../development/python-modules/wrapio { };
+
   wrapt = callPackage ../development/python-modules/wrapt { };
 
   wrf-python = callPackage ../development/python-modules/wrf-python { };
diff --git a/pkgs/top-level/static.nix b/pkgs/top-level/static.nix
index b8d0d16e97b..6720a019cbc 100644
--- a/pkgs/top-level/static.nix
+++ b/pkgs/top-level/static.nix
@@ -319,4 +319,6 @@ in {
       configureFlags = attrs.configureFlags ++ [ "--disable-shared" ];
     });
   });
+
+  libcap = super.libcap.override { pam = null; };
 }