Merge master into staging-next

70 files changed, 1146 insertions, 412 deletions

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 87b7ea57a958..f93b60a75736 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -6397,6 +6397,12 @@
     githubId = 364510;
     name = "Tobias Geerinckx-Rice";
   };
+  ndl = {
+    email = "ndl@endl.ch";
+    github = "ndl";
+    githubId = 137805;
+    name = "Alexander Tsvyashchenko";
+  };
   neeasade = {
     email = "nathanisom27@gmail.com";
     github = "neeasade";
diff --git a/nixos/doc/manual/release-notes/rl-2103.xml b/nixos/doc/manual/release-notes/rl-2103.xml
index 38bf69afa8b6..a3543aae1ea3 100644
--- a/nixos/doc/manual/release-notes/rl-2103.xml
+++ b/nixos/doc/manual/release-notes/rl-2103.xml
@@ -402,6 +402,18 @@ http://some.json-exporter.host:7979/probe?target=https://example.com/some/json/e
        SDK licenses if your project requires it. See the androidenv documentation for more details.
      </para>
    </listitem>
+   <listitem>
+     <para>
+      The Searx module has been updated with the ability to configure the
+      service declaratively and uWSGI integration.
+      The option <literal>services.searx.configFile</literal> has been renamed
+      to <xref linkend="opt-services.searx.settingsFile"/> for consistency with
+      the new <xref linkend="opt-services.searx.settings"/>. In addition, the
+      <literal>searx</literal> uid and gid reservations have been removed
+      since they were not necessary: the service is now running with a
+      dynamically allocated uid.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index cf0198d7b93d..feb9c68301d5 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -143,7 +143,7 @@ in
       nix-ssh = 104;
       dictd = 105;
       couchdb = 106;
-      searx = 107;
+      #searx = 107; # dynamically allocated as of 2020-10-27
       kippo = 108;
       jenkins = 109;
       systemd-journal-gateway = 110;
@@ -457,7 +457,7 @@ in
       #nix-ssh = 104; # unused
       dictd = 105;
       couchdb = 106;
-      searx = 107;
+      #searx = 107; # dynamically allocated as of 2020-10-27
       kippo = 108;
       jenkins = 109;
       systemd-journal-gateway = 110;
diff --git a/nixos/modules/services/networking/searx.nix b/nixos/modules/services/networking/searx.nix
index 60fb3d5d6d44..85696beeba4a 100644
--- a/nixos/modules/services/networking/searx.nix
+++ b/nixos/modules/services/networking/searx.nix
@@ -3,32 +3,133 @@
 with lib;
 
 let
-
+  runDir = "/run/searx";
   cfg = config.services.searx;
 
-  configFile = cfg.configFile;
+  hasEngines =
+    builtins.hasAttr "engines" cfg.settings &&
+    cfg.settings.engines != { };
+
+  # Script to merge NixOS settings with
+  # the default settings.yml bundled in searx.
+  mergeConfig = ''
+    cd ${runDir}
+    # find the default settings.yml
+    default=$(find '${cfg.package}/' -name settings.yml)
+
+    # write NixOS settings as JSON
+    cat <<'EOF' > settings.json
+      ${builtins.toJSON cfg.settings}
+    EOF
+
+    ${optionalString hasEngines ''
+      # extract and convert the default engines array to an object
+      ${pkgs.yq-go}/bin/yq r "$default" engines -j | \
+      ${pkgs.jq}/bin/jq 'reduce .[] as $e ({}; .[$e.name] = $e)' \
+        > engines.json
+
+      # merge and update the NixOS engines with the newly created object
+      cp settings.json temp.json
+      ${pkgs.jq}/bin/jq -s '. as [$s, $e] | $s | .engines |=
+        ($e * . | to_entries | map (.value))' \
+        temp.json engines.json > settings.json
+
+      # clean up temporary files
+      rm {engines,temp}.json
+    ''}
+
+    # merge the default and NixOS settings
+    ${pkgs.yq-go}/bin/yq m -P settings.json "$default" > settings.yml
+    rm settings.json
+
+    # substitute environment variables
+    env -0 | while IFS='=' read -r -d ''' n v; do
+      sed "s#@$n@#$v#g" -i settings.yml
+    done
+
+    # set strict permissions
+    chmod 400 settings.yml
+  '';
 
 in
 
 {
 
+  imports = [
+    (mkRenamedOptionModule
+      [ "services" "searx" "configFile" ]
+      [ "services" "searx" "settingsFile" ])
+  ];
+
   ###### interface
 
   options = {
 
     services.searx = {
 
-      enable = mkEnableOption
-        "the searx server. See https://github.com/asciimoo/searx";
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        relatedPackages = [ "searx" ];
+        description = "Whether to enable Searx, the meta search engine.";
+      };
 
-      configFile = mkOption {
+      environmentFile = mkOption {
         type = types.nullOr types.path;
         default = null;
-        description = "
-          The path of the Searx server configuration file. If no file
-          is specified, a default file is used (default config file has
-          debug mode enabled).
-        ";
+        description = ''
+          Environment file (see <literal>systemd.exec(5)</literal>
+          "EnvironmentFile=" section for the syntax) to define variables for
+          Searx. This option can be used to safely include secret keys into the
+          Searx configuration.
+        '';
+      };
+
+      settings = mkOption {
+        type = types.attrs;
+        default = { };
+        example = literalExample ''
+          { server.port = 8080;
+            server.bind_address = "0.0.0.0";
+            server.secret_key = "@SEARX_SECRET_KEY@";
+
+            engines.wolframalpha =
+              { shortcut = "wa";
+                api_key = "@WOLFRAM_API_KEY@";
+                engine = "wolframalpha_api";
+              };
+          }
+        '';
+        description = ''
+          Searx settings. These will be merged with (taking precedence over)
+          the default configuration. It's also possible to refer to
+          environment variables
+          (defined in <xref linkend="opt-services.searx.environmentFile"/>)
+          using the syntax <literal>@VARIABLE_NAME@</literal>.
+          <note>
+            <para>
+              For available settings, see the Searx
+              <link xlink:href="https://searx.github.io/searx/admin/settings.html">docs</link>.
+            </para>
+          </note>
+        '';
+      };
+
+      settingsFile = mkOption {
+        type = types.path;
+        default = "${runDir}/settings.yml";
+        description = ''
+          The path of the Searx server settings.yml file. If no file is
+          specified, a default file is used (default config file has debug mode
+          enabled). Note: setting this options overrides
+          <xref linkend="opt-services.searx.settings"/>.
+          <warning>
+            <para>
+              This file, along with any secret key it contains, will be copied
+              into the world-readable Nix store.
+            </para>
+          </warning>
+        '';
       };
 
       package = mkOption {
@@ -38,6 +139,38 @@ in
         description = "searx package to use.";
       };
 
+      runInUwsgi = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to run searx in uWSGI as a "vassal", instead of using its
+          built-in HTTP server. This is the recommended mode for public or
+          large instances, but is unecessary for LAN or local-only use.
+          <warning>
+            <para>
+              The built-in HTTP server logs all queries by default.
+            </para>
+          </warning>
+        '';
+      };
+
+      uwsgiConfig = mkOption {
+        type = types.attrs;
+        default = { http = ":8080"; };
+        example = lib.literalExample ''
+          {
+            disable-logging = true;
+            http = ":8080";                   # serve via HTTP...
+            socket = "/run/searx/searx.sock"; # ...or UNIX socket
+          }
+        '';
+        description = ''
+          Additional configuration of the uWSGI vassal running searx. It
+          should notably specify on which interfaces and ports the vassal
+          should listen.
+        '';
+      };
+
     };
 
   };
@@ -45,33 +178,66 @@ in
 
   ###### implementation
 
-  config = mkIf config.services.searx.enable {
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
 
     users.users.searx =
-      { uid = config.ids.uids.searx;
-        description = "Searx user";
-        createHome = true;
-        home = "/var/lib/searx";
+      { description = "Searx daemon user";
+        group = "searx";
+        isSystemUser = true;
       };
 
-    users.groups.searx =
-      { gid = config.ids.gids.searx;
-      };
+    users.groups.searx = { };
+
+    systemd.services.searx-init = {
+      description = "Initialise Searx settings";
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        User = "searx";
+        RuntimeDirectory = "searx";
+        RuntimeDirectoryMode = "750";
+      } // optionalAttrs (cfg.environmentFile != null)
+        { EnvironmentFile = builtins.toPath cfg.environmentFile; };
+      script = mergeConfig;
+    };
 
-    systemd.services.searx =
-      {
-        description = "Searx server, the meta search engine.";
-        after = [ "network.target" ];
-        wantedBy = [ "multi-user.target" ];
-        serviceConfig = {
-          User = "searx";
-          ExecStart = "${cfg.package}/bin/searx-run";
-        };
-      } // (optionalAttrs (configFile != null) {
-        environment.SEARX_SETTINGS_PATH = configFile;
-      });
+    systemd.services.searx = mkIf (!cfg.runInUwsgi) {
+      description = "Searx server, the meta search engine.";
+      wantedBy = [ "network.target" "multi-user.target" ];
+      requires = [ "searx-init.service" ];
+      after = [ "searx-init.service" ];
+      serviceConfig = {
+        User  = "searx";
+        Group = "searx";
+        ExecStart = "${cfg.package}/bin/searx-run";
+      } // optionalAttrs (cfg.environmentFile != null)
+        { EnvironmentFile = builtins.toPath cfg.environmentFile; };
+      environment.SEARX_SETTINGS_PATH = cfg.settingsFile;
+    };
 
-    environment.systemPackages = [ cfg.package ];
+    systemd.services.uwsgi = mkIf (cfg.runInUwsgi)
+      { requires = [ "searx-init.service" ];
+        after = [ "searx-init.service" ];
+      };
+
+    services.uwsgi = mkIf (cfg.runInUwsgi) {
+      enable = true;
+      plugins = [ "python3" ];
+
+      instance.type = "emperor";
+      instance.vassals.searx = {
+        type = "normal";
+        strict = true;
+        immediate-uid = "searx";
+        immediate-gid = "searx";
+        lazy-apps = true;
+        enable-threads = true;
+        module = "searx.webapp";
+        env = [ "SEARX_SETTINGS_PATH=${cfg.settingsFile}" ];
+        pythonPackages = self: [ cfg.package ];
+      } // cfg.uwsgiConfig;
+    };
 
   };
 
diff --git a/nixos/modules/virtualisation/ec2-amis.nix b/nixos/modules/virtualisation/ec2-amis.nix
index 3da63078a214..892af513b032 100644
--- a/nixos/modules/virtualisation/ec2-amis.nix
+++ b/nixos/modules/virtualisation/ec2-amis.nix
@@ -329,24 +329,24 @@ let self = {
   "20.03".ap-east-1.hvm-ebs = "ami-0d18fdd309cdefa86";
   "20.03".sa-east-1.hvm-ebs = "ami-09859378158ae971d";
 
-  # 20.09.1632.a6a3a368dda
-  "20.09".eu-west-1.hvm-ebs = "ami-01a79d5ce435f4db3";
-  "20.09".eu-west-2.hvm-ebs = "ami-0cbe14f32904e6331";
-  "20.09".eu-west-3.hvm-ebs = "ami-07f493412d6213de6";
-  "20.09".eu-central-1.hvm-ebs = "ami-01d4a0c2248cbfe38";
-  "20.09".eu-north-1.hvm-ebs = "ami-0003f54dd99d68e0f";
-  "20.09".us-east-1.hvm-ebs = "ami-068a62d478710462d";
-  "20.09".us-east-2.hvm-ebs = "ami-01ac677ff61399caa";
-  "20.09".us-west-1.hvm-ebs = "ami-04befdb203b4b17f6";
-  "20.09".us-west-2.hvm-ebs = "ami-0fb7bd4a43261c6b2";
-  "20.09".ca-central-1.hvm-ebs = "ami-06d5ee429f153f856";
-  "20.09".ap-southeast-1.hvm-ebs = "ami-0db0304e23c535b2a";
-  "20.09".ap-southeast-2.hvm-ebs = "ami-045983c4db7e36447";
-  "20.09".ap-northeast-1.hvm-ebs = "ami-0beb18d632cf64e5a";
-  "20.09".ap-northeast-2.hvm-ebs = "ami-0dd0316af578862db";
-  "20.09".ap-south-1.hvm-ebs = "ami-008d15ced81c88aed";
-  "20.09".ap-east-1.hvm-ebs = "ami-071f49713f86ea965";
-  "20.09".sa-east-1.hvm-ebs = "ami-05ded1ae35209b5a8";
+  # 20.09.2016.19db3e5ea27
+  "20.09".eu-west-1.hvm-ebs = "ami-0057cb7d614329fa2";
+  "20.09".eu-west-2.hvm-ebs = "ami-0d46f16e0bb0ec8fd";
+  "20.09".eu-west-3.hvm-ebs = "ami-0e8985c3ea42f87fe";
+  "20.09".eu-central-1.hvm-ebs = "ami-0eed77c38432886d2";
+  "20.09".eu-north-1.hvm-ebs = "ami-0be5bcadd632bea14";
+  "20.09".us-east-1.hvm-ebs = "ami-0a2cce52b42daccc8";
+  "20.09".us-east-2.hvm-ebs = "ami-09378bf487b07a4d8";
+  "20.09".us-west-1.hvm-ebs = "ami-09b4337b2a9e77485";
+  "20.09".us-west-2.hvm-ebs = "ami-081d3bb5fbee0a1ac";
+  "20.09".ca-central-1.hvm-ebs = "ami-020c24c6c607e7ac7";
+  "20.09".ap-southeast-1.hvm-ebs = "ami-08f648d5db009e67d";
+  "20.09".ap-southeast-2.hvm-ebs = "ami-0be390efaccbd40f9";
+  "20.09".ap-northeast-1.hvm-ebs = "ami-0c3311601cbe8f927";
+  "20.09".ap-northeast-2.hvm-ebs = "ami-0020146701f4d56cf";
+  "20.09".ap-south-1.hvm-ebs = "ami-0117e2bd876bb40d1";
+  "20.09".ap-east-1.hvm-ebs = "ami-0c42f97e5b1fda92f";
+  "20.09".sa-east-1.hvm-ebs = "ami-021637976b094959d";
 
   latest = self."20.09";
 }; in self
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index d53c6f6511e3..7d83b952f948 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -342,6 +342,7 @@ in
   sbt-extras = handleTest ./sbt-extras.nix {};
   scala = handleTest ./scala.nix {};
   sddm = handleTest ./sddm.nix {};
+  searx = handleTest ./searx.nix {};
   service-runner = handleTest ./service-runner.nix {};
   shadow = handleTest ./shadow.nix {};
   shadowsocks = handleTest ./shadowsocks {};
diff --git a/nixos/tests/searx.nix b/nixos/tests/searx.nix
new file mode 100644
index 000000000000..e5fee3466bfa
--- /dev/null
+++ b/nixos/tests/searx.nix
@@ -0,0 +1,109 @@
+import ./make-test-python.nix ({ pkgs, ...} :
+
+{
+  name = "searx";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ rnhmjoj ];
+  };
+
+  # basic setup: searx running the built-in webserver
+  nodes.base = { ... }: {
+    imports = [ ../modules/profiles/minimal.nix ];
+
+    services.searx = {
+      enable = true;
+      environmentFile = pkgs.writeText "secrets" ''
+        WOLFRAM_API_KEY  = sometoken
+        SEARX_SECRET_KEY = somesecret
+      '';
+
+      settings.server =
+        { port = "8080";
+          bind_address = "0.0.0.0";
+          secret_key = "@SEARX_SECRET_KEY@";
+        };
+      settings.engines = {
+        wolframalpha =
+          { api_key = "@WOLFRAM_API_KEY@";
+            engine = "wolframalpha_api";
+          };
+        startpage.shortcut = "start";
+      };
+    };
+
+  };
+
+  # fancy setup: run in uWSGI and use nginx as proxy
+  nodes.fancy = { ... }: {
+    imports = [ ../modules/profiles/minimal.nix ];
+
+    services.searx = {
+      enable = true;
+      runInUwsgi = true;
+      uwsgiConfig = {
+        # serve using the uwsgi protocol
+        socket = "/run/searx/uwsgi.sock";
+        chmod-socket = "660";
+
+        # use /searx as url "mountpoint"
+        mount = "/searx=searx.webapp:application";
+        module = "";
+        manage-script-name = true;
+      };
+    };
+
+    # use nginx as reverse proxy
+    services.nginx.enable = true;
+    services.nginx.virtualHosts.localhost = {
+      locations."/searx".extraConfig =
+        ''
+          include ${pkgs.nginx}/conf/uwsgi_params;
+          uwsgi_pass unix:/run/searx/uwsgi.sock;
+        '';
+      locations."/searx/static/".alias = "${pkgs.searx}/share/static/";
+    };
+
+    # allow nginx access to the searx socket
+    users.users.nginx.extraGroups = [ "searx" ];
+
+  };
+
+  testScript =
+    ''
+      base.start()
+
+      with subtest("Settings have been merged"):
+          base.wait_for_unit("searx-init")
+          base.wait_for_file("/run/searx/settings.yml")
+          output = base.succeed(
+              "${pkgs.yq-go}/bin/yq r /run/searx/settings.yml"
+              " 'engines.(name==startpage).shortcut'"
+          ).strip()
+          assert output == "start", "Settings not merged"
+
+      with subtest("Environment variables have been substituted"):
+          base.succeed("grep -q somesecret /run/searx/settings.yml")
+          base.succeed("grep -q sometoken /run/searx/settings.yml")
+          base.copy_from_vm("/run/searx/settings.yml")
+
+      with subtest("Basic setup is working"):
+          base.wait_for_open_port(8080)
+          base.wait_for_unit("searx")
+          base.succeed(
+              "${pkgs.curl}/bin/curl --fail http://localhost:8080"
+          )
+          base.shutdown()
+
+      with subtest("Nginx+uWSGI setup is working"):
+          fancy.start()
+          fancy.wait_for_open_port(80)
+          fancy.wait_for_unit("uwsgi")
+          fancy.succeed(
+              "${pkgs.curl}/bin/curl --fail http://localhost/searx >&2"
+          )
+          fancy.succeed(
+              "${pkgs.curl}/bin/curl --fail http://localhost/searx/static/js/bootstrap.min.js >&2"
+          )
+    '';
+})
+
diff --git a/pkgs/applications/blockchains/monero-gui/default.nix b/pkgs/applications/blockchains/monero-gui/default.nix
index cffbdde8f003..a34e834d4a71 100644
--- a/pkgs/applications/blockchains/monero-gui/default.nix
+++ b/pkgs/applications/blockchains/monero-gui/default.nix
@@ -8,7 +8,7 @@
 , monero, miniupnpc, unbound, readline
 , boost, libunwind, libsodium, pcsclite
 , randomx, zeromq, libgcrypt, libgpgerror
-, hidapi, rapidjson
+, hidapi, rapidjson, quirc
 , trezorSupport ? true
 ,   libusb1  ? null
 ,   protobuf ? null
@@ -28,13 +28,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "monero-gui";
-  version = "0.17.1.8";
+  version = "0.17.1.9";
 
   src = fetchFromGitHub {
     owner  = "monero-project";
     repo   = "monero-gui";
     rev    = "v${version}";
-    sha256 = "13cjrfdkr7c2ff8j2rg8hvhlc00af38vcs67wlx2109i2baq4pp3";
+    sha256 = "0143mmxk0jfb5pmjlx6v0knvf8v49kmkpjxlp6rw8lwnlf71xadn";
   };
 
   nativeBuildInputs = [
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
     monero miniupnpc unbound readline
     randomx libgcrypt libgpgerror
     boost libunwind libsodium pcsclite
-    zeromq hidapi rapidjson
+    zeromq hidapi rapidjson quirc
   ] ++ optionals trezorSupport [ libusb1 protobuf python3 ]
     ++ optionals stdenv.isDarwin [ qtmacextras ];
 
@@ -75,6 +75,10 @@ stdenv.mkDerivation rec {
     substituteInPlace CMakeLists.txt \
       --replace 'add_subdirectory(monero)' \
                 'add_subdirectory(monero EXCLUDE_FROM_ALL)'
+
+    # use nixpkgs quirc
+    substituteInPlace CMakeLists.txt \
+      --replace 'add_subdirectory(external)' ""
   '';
 
   cmakeFlags = [ "-DARCH=${arch}" ];
diff --git a/pkgs/applications/blockchains/monero/default.nix b/pkgs/applications/blockchains/monero/default.nix
index 9d1761ab4465..c9134e3ec47e 100644
--- a/pkgs/applications/blockchains/monero/default.nix
+++ b/pkgs/applications/blockchains/monero/default.nix
@@ -17,13 +17,13 @@ assert trezorSupport -> all (x: x!=null) [ libusb1 protobuf python3 ];
 
 stdenv.mkDerivation rec {
   pname = "monero";
-  version = "0.17.1.8";
+  version = "0.17.1.9";
 
   src = fetchFromGitHub {
     owner = "monero-project";
     repo = "monero";
     rev = "v${version}";
-    sha256 = "10blazbk1602slx3wrmw4jfgkdry55iclrhm5drdficc5v3h735g";
+    sha256 = "0jqss4csvkcrhrmaa3vrnyv6yiwqpbfw7037clx9xcfm4qrrfiwy";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/editors/kakoune/plugins/kak-fzf.nix b/pkgs/applications/editors/kakoune/plugins/kak-fzf.nix
index 657f4a19bbfc..8a91f829c0c9 100644
--- a/pkgs/applications/editors/kakoune/plugins/kak-fzf.nix
+++ b/pkgs/applications/editors/kakoune/plugins/kak-fzf.nix
@@ -4,12 +4,13 @@ assert stdenv.lib.asserts.assertOneOf "fzf" fzf.pname [ "fzf" "skim" ];
 
 stdenv.mkDerivation {
   name = "kak-fzf";
-  version = "2020-05-24";
+  version = "2020-07-26";
+
   src = fetchFromGitHub {
     owner = "andreyorst";
     repo = "fzf.kak";
-    rev = "b2aeb26473962ab0bf3b51ba5c81c50c1d8253d3";
-    sha256 = "0bg845i814xh4y688p2zx726rsg0pd6nb4a7qv2fckmk639f4wzc";
+    rev = "f23daa698ad95493fbd675ae153e3cac13ef34e9";
+    hash = "sha256-BfXHTJ371ThOizMI/4BAbdJoaltGSP586hz4HqX1KWA=";
   };
 
   configurePhase = ''
diff --git a/pkgs/applications/misc/buku/default.nix b/pkgs/applications/misc/buku/default.nix
index 9568c38d4344..772754ecc6d5 100644
--- a/pkgs/applications/misc/buku/default.nix
+++ b/pkgs/applications/misc/buku/default.nix
@@ -74,7 +74,7 @@ with python3.pkgs; buildPythonApplication rec {
     description = "Private cmdline bookmark manager";
     homepage = "https://github.com/jarun/Buku";
     license = licenses.gpl3;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ matthiasbeyer infinisil ];
   };
 }
diff --git a/pkgs/applications/misc/mediaelch/default.nix b/pkgs/applications/misc/mediaelch/default.nix
index 8597e92f4011..d437cfda44fa 100644
--- a/pkgs/applications/misc/mediaelch/default.nix
+++ b/pkgs/applications/misc/mediaelch/default.nix
@@ -13,13 +13,13 @@
 
 mkDerivation rec {
   pname = "mediaelch";
-  version = "2.8.2";
+  version = "2.8.4";
 
   src = fetchFromGitHub {
     owner = "Komet";
     repo = "MediaElch";
     rev = "v${version}";
-    sha256 = "0y26vfgrdym461lzmm5x3z5ai9ky09vlk3cy4sq6hwlj7mzcz0k7";
+    sha256 = "00jwmpdwbn6rgaha0iimcbwg9pwb8ilpjgxhv0p13j2c6dcisjzh";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/misc/reddsaver/default.nix b/pkgs/applications/misc/reddsaver/default.nix
new file mode 100644
index 000000000000..2a6d613ed577
--- /dev/null
+++ b/pkgs/applications/misc/reddsaver/default.nix
@@ -0,0 +1,36 @@
+{ stdenv
+, fetchFromGitHub
+, rustPlatform
+, openssl
+, pkg-config
+, Security
+}:
+
+rustPlatform.buildRustPackage rec {
+  version = "0.2.2";
+  pname = "reddsaver";
+
+  src = fetchFromGitHub {
+    owner = "manojkarthick";
+    repo = "reddsaver";
+    rev = "v${version}";
+    sha256 = "0802jz503jhyz5q6mg1fj2bvkl4nggvs8y03zddd298ymplx5dbx";
+  };
+
+  cargoSha256 = "0z8q187331j3rxj8hzym25pwrikxbd0r829v29y8w6v5n0hb47fs";
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ openssl ]
+    ++ stdenv.lib.optional stdenv.isDarwin Security;
+
+  # package does not contain tests as of v0.2.2
+  docCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "CLI tool to download saved images from Reddit";
+    homepage = "https://github.com/manojkarthick/reddsaver";
+    license = with licenses; [ mit /* or */ asl20 ];
+    maintainers = [ maintainers.manojkarthick ];
+  };
+
+}
diff --git a/pkgs/applications/networking/lieer/default.nix b/pkgs/applications/networking/lieer/default.nix
index 83d009e40e83..aee21dca6458 100644
--- a/pkgs/applications/networking/lieer/default.nix
+++ b/pkgs/applications/networking/lieer/default.nix
@@ -19,18 +19,22 @@ python3Packages.buildPythonApplication rec {
     setuptools
   ];
 
+  # no tests
+  doCheck = false;
+  pythonImportsCheck = [ "lieer" ];
+
   meta = with lib; {
-    description      = "Fast email-fetching and two-way tag synchronization between notmuch and GMail";
-    longDescription  = ''
+    description = "Fast email-fetching and two-way tag synchronization between notmuch and GMail";
+    longDescription = ''
       This program can pull email and labels (and changes to labels)
       from your GMail account and store them locally in a maildir with
       the labels synchronized with a notmuch database. The changes to
       tags in the notmuch database may be pushed back remotely to your
       GMail account.
     '';
-    homepage         = "https://lieer.gaute.vetsj.com/";
+    homepage = "https://lieer.gaute.vetsj.com/";
     repositories.git = "https://github.com/gauteh/lieer.git";
-    license          = licenses.gpl3Plus;
-    maintainers      = with maintainers; [ flokli kaiha ];
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ flokli kaiha ];
   };
 }
diff --git a/pkgs/applications/office/portfolio/default.nix b/pkgs/applications/office/portfolio/default.nix
index e9ab18f638f9..44c4a4e1f528 100644
--- a/pkgs/applications/office/portfolio/default.nix
+++ b/pkgs/applications/office/portfolio/default.nix
@@ -24,11 +24,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "PortfolioPerformance";
-  version = "0.49.3";
+  version = "0.50.0";
 
   src = fetchurl {
     url = "https://github.com/buchen/portfolio/releases/download/${version}/PortfolioPerformance-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "1j8d3bih2hs1c1a6pjqpmdlh2hbj76s00srl0f850d06jhldg3p6";
+    sha256 = "1jq4if5hx3fwag1dz38sj87av2na1kv4c36hai1gyz9w5qhjv7j8";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/math/nasc/default.nix b/pkgs/applications/science/math/nasc/default.nix
index 40406cc45889..37173f819785 100644
--- a/pkgs/applications/science/math/nasc/default.nix
+++ b/pkgs/applications/science/math/nasc/default.nix
@@ -1,6 +1,7 @@
 { lib, stdenv
 , fetchFromGitHub
 , pkgconfig
+, fetchpatch
 , python3
 , meson
 , ninja
@@ -31,6 +32,16 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  patches = [
+    # fix compilation with gcc10
+    (fetchpatch {
+      url = "https://github.com/parnold-x/libqalculate/commit/4fa8f2cceada128ef19f82407226b2c230b780d5.patch";
+      extraPrefix = "subprojects/libqalculate/";
+      stripLen = "1";
+      sha256 = "0kbff623zl0s6yx5avx068f2apwzxzvihjahja4qhlkqkhhzj9dm";
+    })
+  ];
+
   nativeBuildInputs = [
     glib # post_install.py
     gtk3 # post_install.py
diff --git a/pkgs/applications/video/gnomecast/default.nix b/pkgs/applications/video/gnomecast/default.nix
index 486159135055..bc045deb9ecb 100644
--- a/pkgs/applications/video/gnomecast/default.nix
+++ b/pkgs/applications/video/gnomecast/default.nix
@@ -20,6 +20,9 @@ buildPythonApplication rec {
     gappsWrapperArgs+=(--prefix PATH : ${lib.makeBinPath [ ffmpeg_3 ]})
   '';
 
+  # no tests
+  doCheck = false;
+
   meta = with lib; {
     description = "A native Linux GUI for Chromecasting local files";
     homepage = "https://github.com/keredson/gnomecast";
diff --git a/pkgs/build-support/fetchgit/builder.sh b/pkgs/build-support/fetchgit/builder.sh
index 6ae46469738a..0047a335c76c 100644
--- a/pkgs/build-support/fetchgit/builder.sh
+++ b/pkgs/build-support/fetchgit/builder.sh
@@ -8,6 +8,7 @@ header "exporting $url (rev $rev) into $out"
 
 $SHELL $fetcher --builder --url "$url" --out "$out" --rev "$rev" \
   ${leaveDotGit:+--leave-dotGit} \
+  ${fetchLFS:+--fetch-lfs} \
   ${deepClone:+--deepClone} \
   ${fetchSubmodules:+--fetch-submodules} \
   ${branchName:+--branch-name "$branchName"}
diff --git a/pkgs/build-support/fetchgit/default.nix b/pkgs/build-support/fetchgit/default.nix
index 0405951a9e40..5f5ded128de5 100644
--- a/pkgs/build-support/fetchgit/default.nix
+++ b/pkgs/build-support/fetchgit/default.nix
@@ -1,4 +1,4 @@
-{stdenvNoCC, git, cacert}: let
+{stdenvNoCC, git, git-lfs, cacert}: let
   urlToName = url: rev: let
     inherit (stdenvNoCC.lib) removeSuffix splitString last;
     base = last (splitString ":" (baseNameOf (removeSuffix "/" url)));
@@ -20,6 +20,7 @@ in
   # successfully. This can do things like check or transform the file.
   postFetch ? ""
 , preferLocalBuild ? true
+, fetchLFS ? false
 }:
 
 /* NOTE:
@@ -53,13 +54,15 @@ stdenvNoCC.mkDerivation {
   inherit name;
   builder = ./builder.sh;
   fetcher = ./nix-prefetch-git;  # This must be a string to ensure it's called with bash.
-  nativeBuildInputs = [git];
+
+  nativeBuildInputs = [ git ]
+    ++ stdenvNoCC.lib.optionals fetchLFS [ git-lfs ];
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
   outputHash = sha256;
 
-  inherit url rev leaveDotGit fetchSubmodules deepClone branchName postFetch;
+  inherit url rev leaveDotGit fetchLFS fetchSubmodules deepClone branchName postFetch;
 
   GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
 
diff --git a/pkgs/build-support/fetchgit/nix-prefetch-git b/pkgs/build-support/fetchgit/nix-prefetch-git
index 43f7c5acd5ad..3cb115c5e6e6 100755
--- a/pkgs/build-support/fetchgit/nix-prefetch-git
+++ b/pkgs/build-support/fetchgit/nix-prefetch-git
@@ -9,6 +9,7 @@ hashType=$NIX_HASH_ALGO
 deepClone=$NIX_PREFETCH_GIT_DEEP_CLONE
 leaveDotGit=$NIX_PREFETCH_GIT_LEAVE_DOT_GIT
 fetchSubmodules=
+fetchLFS=
 builder=
 branchName=$NIX_PREFETCH_GIT_BRANCH_NAME
 
@@ -72,6 +73,7 @@ for arg; do
             --quiet) QUIET=true;;
             --no-deepClone) deepClone=;;
             --leave-dotGit) leaveDotGit=true;;
+            --fetch-lfs) fetchLFS=true;;
             --fetch-submodules) fetchSubmodules=true;;
             --builder) builder=true;;
             -h|--help) usage; exit;;
@@ -283,6 +285,11 @@ clone_user_rev() {
     local url="$2"
     local rev="${3:-HEAD}"
 
+    if [ -n "$fetchLFS" ]; then
+        HOME=$TMPDIR
+        git lfs install
+    fi
+
     # Perform the checkout.
     case "$rev" in
         HEAD|refs/*)
diff --git a/pkgs/data/themes/marwaita-peppermint/default.nix b/pkgs/data/themes/marwaita-peppermint/default.nix
index ede6b12cf55c..70e7bdef2d4e 100644
--- a/pkgs/data/themes/marwaita-peppermint/default.nix
+++ b/pkgs/data/themes/marwaita-peppermint/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "marwaita-peppermint";
-  version = "0.5";
+  version = "0.6";
 
   src = fetchFromGitHub {
     owner = "darkomarko42";
     repo = pname;
     rev = version;
-    sha256 = "04j210nw9w4m8n49cd8y3l0qp60rn00i8wdr6kvc7lhkvqwhpnlg";
+    sha256 = "0mhkkx2qa66z4b2h5iynhy63flwdf6b2phd21r1j8kp4m08dynms";
   };
 
   buildInputs = [
diff --git a/pkgs/data/themes/marwaita-pop_os/default.nix b/pkgs/data/themes/marwaita-pop_os/default.nix
index d16a84d5709b..f71997674671 100644
--- a/pkgs/data/themes/marwaita-pop_os/default.nix
+++ b/pkgs/data/themes/marwaita-pop_os/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "marwaita-pop_os";
-  version = "0.9";
+  version = "1.1";
 
   src = fetchFromGitHub {
     owner = "darkomarko42";
     repo = pname;
     rev = version;
-    sha256 = "1fpzsch9rpq7dmg01ny7jc2vd6dks0fqxxp2rb9jcs0vx5d2fdc6";
+    sha256 = "1nwfyy3jnfsdlqgj7ig9gbawazdm76g02b0hrfsll17j5498d59y";
   };
 
   buildInputs = [
diff --git a/pkgs/data/themes/marwaita-ubuntu/default.nix b/pkgs/data/themes/marwaita-ubuntu/default.nix
index 8d32f0a3bd97..f98e112678ce 100644
--- a/pkgs/data/themes/marwaita-ubuntu/default.nix
+++ b/pkgs/data/themes/marwaita-ubuntu/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "marwaita-ubuntu";
-  version = "1.5";
+  version = "1.7";
 
   src = fetchFromGitHub {
     owner = "darkomarko42";
     repo = pname;
     rev = version;
-    sha256 = "0mld78s6gl5kfsdaqa7xs5mvfng9600pd2d9sp2b2q5axx7wjay5";
+    sha256 = "024b0817jilvi5ilq9sbwg19ql5i2x3jfgc1awk7zzv6sqii639x";
   };
 
   buildInputs = [
diff --git a/pkgs/development/haskell-modules/generic-builder.nix b/pkgs/development/haskell-modules/generic-builder.nix
index a221ce38c8a2..e135374511fb 100644
--- a/pkgs/development/haskell-modules/generic-builder.nix
+++ b/pkgs/development/haskell-modules/generic-builder.nix
@@ -33,7 +33,7 @@ in
 , profilingDetail ? "exported-functions"
 # TODO enable shared libs for cross-compiling
 , enableSharedExecutables ? false
-, enableSharedLibraries ? (ghc.enableShared or false)
+, enableSharedLibraries ? !stdenv.hostPlatform.isStatic && (ghc.enableShared or false)
 , enableDeadCodeElimination ? (!stdenv.isDarwin)  # TODO: use -dead_strip for darwin
 , enableStaticLibraries ? !(stdenv.hostPlatform.isWindows or stdenv.hostPlatform.isWasm)
 , enableHsc2hsViaAsm ? stdenv.hostPlatform.isWindows && stdenv.lib.versionAtLeast ghc.version "8.4"
diff --git a/pkgs/development/python-modules/cliff/default.nix b/pkgs/development/python-modules/cliff/default.nix
index f25170cc6ae7..1c551bfb0d90 100644
--- a/pkgs/development/python-modules/cliff/default.nix
+++ b/pkgs/development/python-modules/cliff/default.nix
@@ -7,12 +7,11 @@
 , six
 , stevedore
 , pyyaml
-, unicodecsv
 , cmd2
-, pytest
-, mock
+, pytestCheckHook
 , testtools
 , fixtures
+, which
 }:
 
 buildPythonPackage rec {
@@ -32,20 +31,21 @@ buildPythonPackage rec {
     stevedore
     pyyaml
     cmd2
-    unicodecsv
   ];
 
-  # remove version constraints
   postPatch = ''
-    sed -i '/cmd2/c\cmd2' requirements.txt
+    sed -i -e '/cmd2/c\cmd2' -e '/PrettyTable/c\PrettyTable' requirements.txt
   '';
 
-  checkInputs = [ fixtures mock pytest testtools ];
+  checkInputs = [ fixtures pytestCheckHook testtools which ];
   # add some tests
-  checkPhase = ''
-    pytest cliff/tests/test_{utils,app,command,help,lister}.py \
-      -k 'not interactive_mode'
-  '';
+  pytestFlagsArray = [
+    "cliff/tests/test_utils.py"
+    "cliff/tests/test_app.py"
+    "cliff/tests/test_command.py"
+    "cliff/tests/test_help.py"
+    "cliff/tests/test_lister.py"
+  ];
 
   meta = with lib; {
     description = "Command Line Interface Formulation Framework";
diff --git a/pkgs/development/python-modules/flatbuffers/default.nix b/pkgs/development/python-modules/flatbuffers/default.nix
index 065808dfe6ef..d06ea28b3344 100644
--- a/pkgs/development/python-modules/flatbuffers/default.nix
+++ b/pkgs/development/python-modules/flatbuffers/default.nix
@@ -8,6 +8,10 @@ buildPythonPackage rec {
 
   sourceRoot = "source/python";
 
+  # flatbuffers needs VERSION environment variable for setting the correct
+  # version, otherwise it uses the current date.
+  VERSION = "${version}";
+
   pythonImportsCheck = [ "flatbuffers" ];
 
   meta = flatbuffers.meta // {
diff --git a/pkgs/development/python-modules/geopandas/default.nix b/pkgs/development/python-modules/geopandas/default.nix
index bee22eb98bda..70963a85d41d 100644
--- a/pkgs/development/python-modules/geopandas/default.nix
+++ b/pkgs/development/python-modules/geopandas/default.nix
@@ -29,10 +29,6 @@ buildPythonPackage rec {
     })
   ];
 
-  checkInputs = [ pytestCheckHook Rtree ];
-  disabledTests = [ "web" ];
-  pytestFlagsArray = [ "geopandas" ];
-
   propagatedBuildInputs = [
     pandas
     shapely
@@ -41,6 +37,11 @@ buildPythonPackage rec {
     pyproj
   ];
 
+  doCheck = !stdenv.isDarwin;
+  checkInputs = [ pytestCheckHook Rtree ];
+  disabledTests = [ "web" ];
+  pytestFlagsArray = [ "geopandas" ];
+
   meta = with lib; {
     description = "Python geospatial data analysis framework";
     homepage = "https://geopandas.org";
diff --git a/pkgs/development/python-modules/guestfs/default.nix b/pkgs/development/python-modules/guestfs/default.nix
index fd12aab81b4a..23a2545525a3 100644
--- a/pkgs/development/python-modules/guestfs/default.nix
+++ b/pkgs/development/python-modules/guestfs/default.nix
@@ -11,6 +11,10 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ libguestfs qemu ];
 
+  # no tests
+  doCheck = false;
+  pythonImportsCheck = [ "guestfs" ];
+
   meta = with lib; {
     homepage = "https://libguestfs.org/guestfs-python.3.html";
     description = "Use libguestfs from Python";
diff --git a/pkgs/development/python-modules/gviz-api/default.nix b/pkgs/development/python-modules/gviz-api/default.nix
new file mode 100644
index 000000000000..fabc2d147fca
--- /dev/null
+++ b/pkgs/development/python-modules/gviz-api/default.nix
@@ -0,0 +1,26 @@
+{ lib, fetchPypi, buildPythonPackage
+, six
+}:
+
+buildPythonPackage rec {
+  pname = "gviz_api";
+  version = "1.9.0";
+  format = "wheel";
+
+  src = fetchPypi {
+    inherit pname version;
+    format = "wheel";
+    sha256 = "1yag559lpmwfdxpxn679a6ajifcbpgljr5n6k5b7rrj38k2xq7jg";
+  };
+
+  propagatedBuildInputs = [
+    six
+  ];
+
+  meta = with lib; {
+    description = "Python API for Google Visualization";
+    homepage = https://developers.google.com/chart/interactive/docs/dev/gviz_api_lib;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ ndl ];
+  };
+}
diff --git a/pkgs/development/python-modules/keep/default.nix b/pkgs/development/python-modules/keep/default.nix
index 52fc90a3ca90..22ae853c043c 100644
--- a/pkgs/development/python-modules/keep/default.nix
+++ b/pkgs/development/python-modules/keep/default.nix
@@ -24,6 +24,7 @@ buildPythonPackage rec {
   ];
 
   # no tests
+  doCheck = false;
   pythonImportsCheck = [ "keep" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/mulpyplexer/default.nix b/pkgs/development/python-modules/mulpyplexer/default.nix
new file mode 100644
index 000000000000..5722938a83f0
--- /dev/null
+++ b/pkgs/development/python-modules/mulpyplexer/default.nix
@@ -0,0 +1,25 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "mulpyplexer";
+  version = "0.08";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1zn5d1vyhfjp8x9z5mr9gv8m8gmi3s3jv3kqb790xzi1kqi0p4ya";
+  };
+
+  # Project has no tests
+  doCheck = false;
+  pythonImportsCheck = [ "mulpyplexer" ];
+
+  meta = with lib; {
+    description = "Multiplex interactions with lists of Python objects";
+    homepage = "https://github.com/zardus/mulpyplexer";
+    license = with licenses; [ bsd2 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/notmuch/2.nix b/pkgs/development/python-modules/notmuch/2.nix
index 171b88108708..970928e03f40 100644
--- a/pkgs/development/python-modules/notmuch/2.nix
+++ b/pkgs/development/python-modules/notmuch/2.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , buildPythonPackage
 , notmuch
 , python
@@ -13,6 +14,10 @@ buildPythonPackage {
 
   buildInputs = [ python notmuch cffi ];
 
+  # no tests
+  doCheck = false;
+  pythonImportsCheck = [ "notmuch2" ];
+
   meta = with lib; {
     description = "Pythonic bindings for the notmuch mail database using CFFI";
     homepage = "https://notmuchmail.org/";
diff --git a/pkgs/development/python-modules/notmuch/default.nix b/pkgs/development/python-modules/notmuch/default.nix
index 173f332b3146..609d4c78d5d7 100644
--- a/pkgs/development/python-modules/notmuch/default.nix
+++ b/pkgs/development/python-modules/notmuch/default.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , buildPythonPackage
 , notmuch
 , python
@@ -16,6 +17,10 @@ buildPythonPackage {
       notmuch/globals.py
   '';
 
+  # no tests
+  doCheck = false;
+  pythonImportsCheck = [ "notmuch" ];
+
   meta = with lib; {
     description = "A Python wrapper around notmuch";
     homepage = "https://notmuchmail.org/";
diff --git a/pkgs/development/python-modules/pyhaversion/default.nix b/pkgs/development/python-modules/pyhaversion/default.nix
index 1a32851e6f38..27d750a5df76 100644
--- a/pkgs/development/python-modules/pyhaversion/default.nix
+++ b/pkgs/development/python-modules/pyhaversion/default.nix
@@ -1,24 +1,16 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, isPy3k
-# propagatedBuildInputs
+, pythonOlder
 , aiohttp
 , async-timeout
 , semantic-version
-# buildInputs
 , pytestrunner
-# checkInputs
-, pytest
-, pytest-asyncio
-, aresponses
 }:
 buildPythonPackage rec {
   pname = "pyhaversion";
   version = "3.4.2";
-
-  # needs aiohttp which is py3k-only
-  disabled = !isPy3k;
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
@@ -35,15 +27,14 @@ buildPythonPackage rec {
     pytestrunner
   ];
 
-  checkInputs = [
-    pytest
-    pytest-asyncio
-    aresponses
-  ];
+  # no tests
+  doCheck = false;
+  pythonImportsCheck = [ "pyhaversion" ];
 
   meta = with lib; {
     description = "A python module to the newest version number of Home Assistant";
     homepage = "https://github.com/ludeeus/pyhaversion";
+    license = with licenses; [ mit ];
     maintainers = [ maintainers.makefu ];
   };
 }
diff --git a/pkgs/development/python-modules/pyls-spyder/default.nix b/pkgs/development/python-modules/pyls-spyder/default.nix
new file mode 100644
index 000000000000..7e1fa0606191
--- /dev/null
+++ b/pkgs/development/python-modules/pyls-spyder/default.nix
@@ -0,0 +1,24 @@
+{ lib, buildPythonPackage, fetchPypi, python-language-server }:
+
+buildPythonPackage rec {
+  pname = "pyls-spyder";
+  version = "0.3.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "07apxh12b8ybkx5izr7pg8kbg5g5wgzw7vh5iy2n8dhiqarzp7s1";
+  };
+
+  propagatedBuildInputs = [ python-language-server ];
+
+  # no tests
+  doCheck = false;
+  pythonImportsCheck = [ "pyls_spyder" ];
+
+  meta = with lib; {
+    description = "Spyder extensions for the python-language-server";
+    homepage = "https://github.com/spyder-ide/pyls-spyder";
+    license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
+  };
+}
diff --git a/pkgs/development/python-modules/python-jsonrpc-server/default.nix b/pkgs/development/python-modules/python-jsonrpc-server/default.nix
index 1f33bac68273..9879a441b3e2 100644
--- a/pkgs/development/python-modules/python-jsonrpc-server/default.nix
+++ b/pkgs/development/python-modules/python-jsonrpc-server/default.nix
@@ -1,43 +1,25 @@
-{ lib, stdenv, buildPythonPackage, fetchFromGitHub, pythonOlder
-, pytest, mock, pytestcov, coverage
+{ stdenv, lib, buildPythonPackage, fetchFromGitHub, pythonOlder
+, pytestCheckHook, mock, pytestcov, coverage
 , future, futures, ujson, isPy38
-, fetchpatch
 }:
 
 buildPythonPackage rec {
   pname = "python-jsonrpc-server";
-  version = "0.3.4";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "palantir";
     repo = "python-jsonrpc-server";
     rev = version;
-    sha256 = "027sx5pv4i9a192kr00bjjcxxprh2xyr8q5372q8ghff3xryk9dd";
+    sha256 = "0pcf50qvcxqnz3db58whqd8z89cdph19pfs1whgfm0zmwbwk0lw6";
   };
 
   postPatch = ''
     sed -i "s/version=versioneer.get_version(),/version=\"$version\",/g" setup.py
-    # https://github.com/palantir/python-jsonrpc-server/issues/36
-    sed -iEe "s!'ujson.*\$!'ujson',!" setup.py
   '';
 
   checkInputs = [
-    pytest mock pytestcov coverage
-  ];
-
-  checkPhase = ''
-    pytest
-  '';
-
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/palantir/python-jsonrpc-server/commit/0a04cc4e9d44233b1038b12d63cd3bd437c2374e.patch";
-      sha256 = "177zdnp1808r2pg189bvzab44l8i2alsgv04kmrlhhnv40h66qyg";
-    })
-    (fetchpatch {
-      url = "https://github.com/palantir/python-jsonrpc-server/commit/5af6e43d0c1fb9a6a29b96d38cfd6dbeec85d0ea.patch";
-      sha256 = "1gx7lc1jxar1ngqqfkdn21s46y1mfnjf7ky2886ydk53nkaba91m";
-    })
+    pytestCheckHook mock pytestcov coverage
   ];
 
   propagatedBuildInputs = [ future ujson ]
diff --git a/pkgs/development/python-modules/python-language-server/default.nix b/pkgs/development/python-modules/python-language-server/default.nix
index 757194d11a50..dc3b33a6f539 100644
--- a/pkgs/development/python-modules/python-language-server/default.nix
+++ b/pkgs/development/python-modules/python-language-server/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, buildPythonPackage, fetchFromGitHub, fetchpatch, pythonOlder, isPy27
+{ stdenv, lib, buildPythonPackage, fetchFromGitHub, pythonOlder, isPy27
 , backports_functools_lru_cache, configparser, futures, future, jedi, pluggy, python-jsonrpc-server, flake8
-, pytestCheckHook, mock, pytestcov, coverage, setuptools, ujson
+, pytestCheckHook, mock, pytestcov, coverage, setuptools, ujson, flaky
 , # Allow building a limited set of providers, e.g. ["pycodestyle"].
   providers ? ["*"]
   # The following packages are optional and
@@ -21,33 +21,33 @@ in
 
 buildPythonPackage rec {
   pname = "python-language-server";
-  version = "0.34.1";
+  version = "0.36.2";
 
   src = fetchFromGitHub {
     owner = "palantir";
     repo = "python-language-server";
     rev = version;
-    sha256 = "sha256-/tVzaoyUO6+7DSvnf3JxpcTY0rU+hHBu5qlru/ZTpxU=";
+    sha256 = "07x6jr4z20jxn03bxblwc8vk0ywha492cgwfhj7q97nb5cm7kx0q";
   };
 
-  patches = [
-    # https://github.com/palantir/python-language-server/pull/851
-    (fetchpatch {
-      url = "https://github.com/palantir/python-language-server/commit/f513f3297132492dd41e001d943980e6c4f40809.patch";
-      sha256 = "04c9hrb3dzlfchjk4625ipazyfcbq6qq2kj2hg3zf2xsny2jcvi5";
-    })
-  ];
+  propagatedBuildInputs = [ setuptools jedi pluggy future python-jsonrpc-server flake8 ujson ]
+    ++ stdenv.lib.optional (withProvider "autopep8") autopep8
+    ++ stdenv.lib.optional (withProvider "mccabe") mccabe
+    ++ stdenv.lib.optional (withProvider "pycodestyle") pycodestyle
+    ++ stdenv.lib.optional (withProvider "pydocstyle") pydocstyle
+    ++ stdenv.lib.optional (withProvider "pyflakes") pyflakes
+    ++ stdenv.lib.optional (withProvider "pylint") pylint
+    ++ stdenv.lib.optional (withProvider "rope") rope
+    ++ stdenv.lib.optional (withProvider "yapf") yapf
+    ++ stdenv.lib.optional isPy27 configparser
+    ++ stdenv.lib.optionals (pythonOlder "3.2") [ backports_functools_lru_cache futures ];
 
-  postPatch = ''
-    # https://github.com/palantir/python-jsonrpc-server/issues/36
-    sed -i -e 's!ujson<=!ujson>=!' setup.py
-  '';
 
   # The tests require all the providers, disable otherwise.
   doCheck = providers == ["*"];
 
   checkInputs = [
-    pytestCheckHook mock pytestcov coverage
+    pytestCheckHook mock pytestcov coverage flaky
     # rope is technically a dependency, but we don't add it by default since we
     # already have jedi, which is the preferred option
     rope
@@ -67,20 +67,9 @@ buildPythonPackage rec {
     "test_matplotlib_completions"
     "test_snippet_parsing"
     "test_numpy_hover"
+    "test_symbols"
   ] ++ stdenv.lib.optional isPy27 "test_flake8_lint";
 
-  propagatedBuildInputs = [ setuptools jedi pluggy future python-jsonrpc-server flake8 ujson ]
-    ++ stdenv.lib.optional (withProvider "autopep8") autopep8
-    ++ stdenv.lib.optional (withProvider "mccabe") mccabe
-    ++ stdenv.lib.optional (withProvider "pycodestyle") pycodestyle
-    ++ stdenv.lib.optional (withProvider "pydocstyle") pydocstyle
-    ++ stdenv.lib.optional (withProvider "pyflakes") pyflakes
-    ++ stdenv.lib.optional (withProvider "pylint") pylint
-    ++ stdenv.lib.optional (withProvider "rope") rope
-    ++ stdenv.lib.optional (withProvider "yapf") yapf
-    ++ stdenv.lib.optional isPy27 configparser
-    ++ stdenv.lib.optionals (pythonOlder "3.2") [ backports_functools_lru_cache futures ];
-
   meta = with lib; {
     homepage = "https://github.com/palantir/python-language-server";
     description = "An implementation of the Language Server Protocol for Python";
diff --git a/pkgs/development/python-modules/pytile/default.nix b/pkgs/development/python-modules/pytile/default.nix
index d2fd99f6d166..52b3d828dedf 100644
--- a/pkgs/development/python-modules/pytile/default.nix
+++ b/pkgs/development/python-modules/pytile/default.nix
@@ -43,6 +43,8 @@ buildPythonPackage rec {
   pytestFlagsArray = [ "--ignore examples/" ];
   pythonImportsCheck = [ "pytile" ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib; {
     description = " Python API for Tile Bluetooth trackers";
     longDescription = ''
diff --git a/pkgs/development/python-modules/scrapy-deltafetch/default.nix b/pkgs/development/python-modules/scrapy-deltafetch/default.nix
index 090d31e67a9a..900943a0e153 100644
--- a/pkgs/development/python-modules/scrapy-deltafetch/default.nix
+++ b/pkgs/development/python-modules/scrapy-deltafetch/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchPypi, buildPythonPackage, pytest, scrapy, bsddb3 }:
+{ stdenv, lib, fetchPypi, buildPythonPackage, scrapy, bsddb3 }:
 
 buildPythonPackage rec {
   pname = "scrapy-deltafetch";
@@ -11,7 +11,9 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ bsddb3 scrapy ];
 
-  checkInputs = [ pytest ];
+  # no tests
+  doCheck = false;
+  pythonImportsCheck = [ "scrapy_deltafetch" ];
 
   meta = with lib; {
     description = "Scrapy spider middleware to ignore requests to pages containing items seen in previous crawls";
diff --git a/pkgs/development/python-modules/scrapy-splash/default.nix b/pkgs/development/python-modules/scrapy-splash/default.nix
index 48988be2c0a7..ab00377f4a0e 100644
--- a/pkgs/development/python-modules/scrapy-splash/default.nix
+++ b/pkgs/development/python-modules/scrapy-splash/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchPypi, buildPythonPackage, pytest, hypothesis, scrapy }:
+{ stdenv, lib, fetchPypi, buildPythonPackage, scrapy, six }:
 
 buildPythonPackage rec {
   pname = "scrapy-splash";
@@ -9,7 +9,11 @@ buildPythonPackage rec {
     sha256 = "1dg7csdza2hzqskd9b9gx0v3saqsch4f0fwdp0a3p0822aqqi488";
   };
 
-  checkInputs = [ pytest hypothesis scrapy ];
+  propagatedBuildInputs = [ scrapy six ];
+
+  # no tests
+  doCheck = false;
+  pythonImportsCheck = [ "scrapy_splash" ];
 
   meta = with lib; {
     description = "Scrapy+Splash for JavaScript integration";
diff --git a/pkgs/development/python-modules/scrapy/default.nix b/pkgs/development/python-modules/scrapy/default.nix
index 1b7b75eaff4f..48bafa41dff7 100644
--- a/pkgs/development/python-modules/scrapy/default.nix
+++ b/pkgs/development/python-modules/scrapy/default.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , buildPythonPackage
 , isPy27
 , fetchPypi
@@ -79,7 +80,10 @@ buildPythonPackage rec {
     "test_retry_dns_error"
     "test_custom_asyncio_loop_enabled_true"
     "test_custom_loop_asyncio"
-  ] ++ stdenv.lib.optionals stdenv.isDarwin [ "test_xmliter_encoding" ];
+  ] ++ stdenv.lib.optionals stdenv.isDarwin [
+    "test_xmliter_encoding"
+    "test_download"
+  ];
 
   src = fetchPypi {
     inherit pname version;
@@ -92,6 +96,8 @@ buildPythonPackage rec {
     install -m 644 -D extras/scrapy_zsh_completion $out/share/zsh/site-functions/_scrapy
   '';
 
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib; {
     description = "A fast high-level web crawling and web scraping framework, used to crawl websites and extract structured data from their pages";
     homepage = "https://scrapy.org/";
diff --git a/pkgs/development/python-modules/spyder/default.nix b/pkgs/development/python-modules/spyder/default.nix
index a47a1278425d..de1b8123dd97 100644
--- a/pkgs/development/python-modules/spyder/default.nix
+++ b/pkgs/development/python-modules/spyder/default.nix
@@ -2,7 +2,7 @@
   psutil, pyflakes, rope, numpy, scipy, matplotlib, pylint, keyring, numpydoc,
   qtconsole, qtawesome, nbconvert, mccabe, pyopengl, cloudpickle, pygments,
   spyder-kernels, qtpy, pyzmq, chardet, qdarkstyle, watchdog, python-language-server
-, pyqtwebengine, atomicwrites, pyxdg, diff-match-patch
+, pyqtwebengine, atomicwrites, pyxdg, diff-match-patch, three-merge, pyls-black, pyls-spyder
 }:
 
 buildPythonPackage rec {
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     intervaltree jedi pycodestyle psutil pyflakes rope numpy scipy matplotlib pylint keyring
     numpydoc qtconsole qtawesome nbconvert mccabe pyopengl cloudpickle spyder-kernels
     pygments qtpy pyzmq chardet pyqtwebengine qdarkstyle watchdog python-language-server
-    atomicwrites pyxdg diff-match-patch
+    atomicwrites pyxdg diff-match-patch three-merge pyls-black pyls-spyder
   ];
 
   # There is no test for spyder
@@ -51,7 +51,7 @@ buildPythonPackage rec {
   postInstall = ''
     # add Python libs to env so Spyder subprocesses
     # created to run compute kernels don't fail with ImportErrors
-    wrapProgram $out/bin/spyder3 --prefix PYTHONPATH : "$PYTHONPATH"
+    wrapProgram $out/bin/spyder --prefix PYTHONPATH : "$PYTHONPATH"
 
     # Create desktop item
     mkdir -p $out/share/icons
diff --git a/pkgs/development/python-modules/stdiomask/default.nix b/pkgs/development/python-modules/stdiomask/default.nix
new file mode 100644
index 000000000000..8ef59074fc00
--- /dev/null
+++ b/pkgs/development/python-modules/stdiomask/default.nix
@@ -0,0 +1,26 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "stdiomask";
+  version = "0.0.6";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "19m3p6i7fj7nmkbsjhiha3f2l7d05j9gf9ha2pd0pqfrx9lp1r61";
+  };
+
+  # tests are not published: https://github.com/asweigart/stdiomask/issues/5
+  doCheck = false;
+  pythonImportsCheck = [ "stdiomask" ];
+
+  meta = with lib; {
+    description = "Python module for masking passwords";
+    homepage = "https://github.com/asweigart/stdiomask";
+    license = with licenses; [ gpl3Plus ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/subarulink/default.nix b/pkgs/development/python-modules/subarulink/default.nix
new file mode 100644
index 000000000000..5b6362b76a14
--- /dev/null
+++ b/pkgs/development/python-modules/subarulink/default.nix
@@ -0,0 +1,44 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, aiohttp
+, asynctest
+, stdiomask
+, cryptography
+, pytestcov
+, pytest-asyncio
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "subarulink";
+  version = "0.3.11";
+
+  src = fetchFromGitHub {
+    owner = "G-Two";
+    repo = pname;
+    rev = "subaru-v${version}";
+    sha256 = "1ink9bhph6blidnfsqwq01grhp7ghacmkd4vzgb9hnhl9l52s1jq";
+  };
+
+  propagatedBuildInputs = [ aiohttp stdiomask ];
+
+  checkInputs = [
+    asynctest
+    cryptography
+    pytest-asyncio
+    pytestcov
+    pytestCheckHook
+  ];
+
+  __darwinAllowLocalNetworking = true;
+
+  pythonImportsCheck = [ "subarulink" ];
+
+  meta = with lib; {
+    description = "Python module for interacting with STARLINK-enabled vehicle";
+    homepage = "https://github.com/G-Two/subarulink";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/swspotify/default.nix b/pkgs/development/python-modules/swspotify/default.nix
index 30f34c56c81a..321a48e72b6f 100644
--- a/pkgs/development/python-modules/swspotify/default.nix
+++ b/pkgs/development/python-modules/swspotify/default.nix
@@ -18,7 +18,8 @@ buildPythonPackage rec {
 
   preConfigure = ''
     substituteInPlace setup.py \
-      --replace 'requests>=2.24.0' 'requests~=2.23'
+      --replace 'requests>=2.24.0' 'requests~=2.23' \
+      --replace 'flask-cors==3.0.8' 'flask-cors'
   '';
 
   checkPhase = ''
@@ -27,6 +28,8 @@ buildPythonPackage rec {
 
   checkInputs = [ pytestCheckHook mock ];
 
+  pythonImportsCheck = [ "SwSpotify" ];
+
   meta = with lib; {
     homepage = "https://github.com/SwagLyrics/SwSpotify";
     description = "Library to get the currently playing song and artist from Spotify";
diff --git a/pkgs/development/python-modules/tensorboard-plugin-profile/default.nix b/pkgs/development/python-modules/tensorboard-plugin-profile/default.nix
new file mode 100644
index 000000000000..1ae1aa471be5
--- /dev/null
+++ b/pkgs/development/python-modules/tensorboard-plugin-profile/default.nix
@@ -0,0 +1,31 @@
+{ lib, fetchPypi, buildPythonPackage
+, gviz-api
+, protobuf
+, werkzeug
+}:
+
+buildPythonPackage rec {
+  pname = "tensorboard_plugin_profile";
+  version = "2.4.0";
+  format = "wheel";
+
+  src = fetchPypi {
+    inherit pname version;
+    format = "wheel";
+    python = "py3";
+    sha256 = "0z6dcjvkk3pzmmmjxi2ybawnfshz5qa3ga92kqj69ld1g9k3i9bj";
+  };
+
+  propagatedBuildInputs = [
+    gviz-api
+    protobuf
+    werkzeug
+  ];
+
+  meta = with lib; {
+    description = "Profile Tensorboard Plugin.";
+    homepage = http://tensorflow.org;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ ndl ];
+  };
+}
diff --git a/pkgs/development/python-modules/tensorboard-plugin-wit/default.nix b/pkgs/development/python-modules/tensorboard-plugin-wit/default.nix
new file mode 100644
index 000000000000..b0966ca2c7c0
--- /dev/null
+++ b/pkgs/development/python-modules/tensorboard-plugin-wit/default.nix
@@ -0,0 +1,22 @@
+{ lib, fetchPypi, buildPythonPackage
+}:
+
+buildPythonPackage rec {
+  pname = "tensorboard_plugin_wit";
+  version = "1.7.0";
+  format = "wheel";
+
+  src = fetchPypi {
+    inherit pname version;
+    format = "wheel";
+    python = "py3";
+    sha256 = "0nv855qm2fav70lndsrv810pqgg41sbmd70fk86wk18ih825yxzf";
+  };
+
+  meta = with lib; {
+    description = "What-If Tool TensorBoard plugin.";
+    homepage = http://tensorflow.org;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ ndl ];
+  };
+}
diff --git a/pkgs/development/python-modules/tensorflow-estimator/default.nix b/pkgs/development/python-modules/tensorflow-estimator/default.nix
index f18364e11165..bca75224fa3e 100644
--- a/pkgs/development/python-modules/tensorflow-estimator/default.nix
+++ b/pkgs/development/python-modules/tensorflow-estimator/default.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "tensorflow-estimator";
-  version = "2.3.0";
+  version = "2.4.0";
   format = "wheel";
 
   src = fetchPypi {
     pname = "tensorflow_estimator";
     inherit version format;
-    sha256 = "11n4sl9wfr00fv1i837b7a36ink86ggmlsgj7i06kcfc011h6pmp";
+    sha256 = "1w0pkcslm6934qqd6m5gxyjdlnb4pbl47k6s99wsh6dyvvr7nysv";
   };
 
   propagatedBuildInputs = [ mock numpy absl-py ];
diff --git a/pkgs/development/python-modules/tensorflow-tensorboard/default.nix b/pkgs/development/python-modules/tensorflow-tensorboard/default.nix
index d0cf7f28f4d6..031254205066 100644
--- a/pkgs/development/python-modules/tensorflow-tensorboard/default.nix
+++ b/pkgs/development/python-modules/tensorflow-tensorboard/default.nix
@@ -5,9 +5,10 @@
 , protobuf
 , grpcio
 , markdown
-, futures
 , absl-py
 , google-auth-oauthlib
+, tensorboard-plugin-wit
+, tensorboard-plugin-profile
 }:
 
 # tensorflow/tensorboard is built from a downloaded wheel, because
@@ -16,19 +17,16 @@
 
 buildPythonPackage rec {
   pname = "tensorflow-tensorboard";
-  version = "2.1.0";
+  version = "2.4.0";
   format = "wheel";
+  disabled = !isPy3k;
 
-  src = fetchPypi ({
+  src = fetchPypi {
     pname = "tensorboard";
     inherit version format;
-  } // (if isPy3k then {
     python = "py3";
-    sha256 = "1wpjdzhjpcdkyaahzd4bl71k4l30z5c55280ndiwj32hw70lxrp6";
-  } else {
-    python = "py2";
-    sha256 = "1f805839xa36wxb7xac9fyxzaww92vw4d50vs6g61wnlr4byp00w";
-  }));
+    sha256 = "0f17h6i398n8maam0r3rssqvdqnqbwjyf96nnhf482anm1iwdq6d";
+  };
 
   propagatedBuildInputs = [
     numpy
@@ -38,10 +36,12 @@ buildPythonPackage rec {
     grpcio
     absl-py
     google-auth-oauthlib
+    tensorboard-plugin-profile
+    tensorboard-plugin-wit
     # not declared in install_requires, but used at runtime
     # https://github.com/NixOS/nixpkgs/issues/73840
     wheel
-  ] ++ lib.optional (!isPy3k) futures;
+  ];
 
   # in the absence of a real test suite, run cli and imports
   checkPhase = ''
diff --git a/pkgs/development/python-modules/tensorflow/default.nix b/pkgs/development/python-modules/tensorflow/default.nix
index e726f927f5c0..342a87a6e8d5 100644
--- a/pkgs/development/python-modules/tensorflow/default.nix
+++ b/pkgs/development/python-modules/tensorflow/default.nix
@@ -1,24 +1,25 @@
-{ stdenv, pkgs, bazel_3, buildBazelPackage, lib, fetchFromGitHub, fetchpatch, symlinkJoin
+{ stdenv, bazel_3, buildBazelPackage, isPy3k, lib, fetchFromGitHub, symlinkJoin
 , addOpenGLRunpath
 # Python deps
-, buildPythonPackage, isPy3k, isPy27, pythonOlder, pythonAtLeast, python
+, buildPythonPackage, pythonOlder, pythonAtLeast, python
 # Python libraries
-, numpy, tensorflow-tensorboard_2, backports_weakref, mock, enum34, absl-py
-, future, setuptools, wheel, keras-preprocessing, keras-applications, google-pasta
-, functools32
+, numpy, tensorflow-tensorboard_2, absl-py
+, future, setuptools, wheel, keras-preprocessing, google-pasta
 , opt-einsum, astunparse, h5py
 , termcolor, grpcio, six, wrapt, protobuf, tensorflow-estimator_2
+, dill, flatbuffers-python, tblib, typing-extensions
 # Common deps
-, git, swig, which, binutils, glibcLocales, cython
+, git, pybind11, which, binutils, glibcLocales, cython, perl
 # Common libraries
-, jemalloc, openmpi, astor, gast, grpc, sqlite, openssl, jsoncpp, re2
-, curl, snappy, flatbuffers, icu, double-conversion, libpng, libjpeg, giflib
+, jemalloc, openmpi, gast, grpc, sqlite, boringssl, jsoncpp
+, curl, snappy, flatbuffers-core, lmdb-core, icu, double-conversion, libpng, libjpeg_turbo, giflib
 # Upsteam by default includes cuda support since tensorflow 1.15. We could do
 # that in nix as well. It would make some things easier and less confusing, but
 # it would also make the default tensorflow package unfree. See
 # https://groups.google.com/a/tensorflow.org/forum/#!topic/developers/iRCt5m4qUz0
 , cudaSupport ? false, cudatoolkit ? null, cudnn ? null, nccl ? null
 , mklSupport ? false, mkl ? null
+, tensorboardSupport ? true
 # XLA without CUDA is broken
 , xlaSupport ? cudaSupport
 # Default from ./configure script
@@ -39,7 +40,7 @@ assert ! (stdenv.isDarwin && cudaSupport);
 assert mklSupport -> mkl != null;
 
 let
-  withTensorboard = pythonOlder "3.6";
+  withTensorboard = (pythonOlder "3.6") || tensorboardSupport;
 
   cudatoolkit_joined = symlinkJoin {
     name = "${cudatoolkit.name}-merged";
@@ -65,34 +66,40 @@ let
   includes_joined = symlinkJoin {
     name = "tensorflow-deps-merged";
     paths = [
-      pkgs.protobuf
       jsoncpp
     ];
   };
 
   tfFeature = x: if x then "1" else "0";
 
-  version = "2.3.2";
+  version = "2.4.0";
   variant = if cudaSupport then "-gpu" else "";
   pname = "tensorflow${variant}";
 
   pythonEnv = python.withPackages (_:
     [ # python deps needed during wheel build time (not runtime, see the buildPythonPackage part for that)
-      numpy
+      # This list can likely be shortened, but each trial takes multiple hours so won't bother for now.
+      absl-py
+      astunparse
+      dill
+      flatbuffers-python
+      gast
+      google-pasta
+      grpcio
+      h5py
       keras-preprocessing
+      numpy
+      opt-einsum
       protobuf
-      wrapt
-      gast
-      astor
-      absl-py
-      termcolor
-      keras-applications
       setuptools
+      six
+      tblib
+      tensorflow-estimator_2
+      tensorflow-tensorboard_2
+      termcolor
+      typing-extensions
       wheel
-  ] ++ lib.optionals (!isPy3k)
-  [ future
-    functools32
-    mock
+      wrapt
   ]);
 
   bazel-build = buildBazelPackage {
@@ -103,27 +110,21 @@ let
       owner = "tensorflow";
       repo = "tensorflow";
       rev = "v${version}";
-      sha256 = "sha256-ncwIkqLDqrB33pB9/FTlBklsIJUEvnDUmyAeUfufCFs=";
+      sha256 = "0yl06aypfxrcs35828xf04mkidz1x0j89v0q5h4d2xps1cb5rv3f";
     };
 
     patches = [
-      # Fixes for NixOS jsoncpp
-      ./system-jsoncpp.patch
-
+      # Relax too strict Python packages versions dependencies.
       ./relax-dependencies.patch
-
-      # see https://github.com/tensorflow/tensorflow/issues/40688
-      (fetchpatch {
-        url = "https://github.com/tensorflow/tensorflow/commit/75ea0b31477d6ba9e990e296bbbd8ca4e7eebadf.patch";
-        sha256 = "1xp1icacig0xm0nmb05sbrf4nw4xbln9fhc308birrv8286zx7wv";
-      })
+      # Add missing `io_bazel_rules_docker` dependency.
+      ./workspace.patch
     ];
 
     # On update, it can be useful to steal the changes from gentoo
     # https://gitweb.gentoo.org/repo/gentoo.git/tree/sci-libs/tensorflow
 
     nativeBuildInputs = [
-      swig which pythonEnv
+      which pythonEnv cython perl
     ] ++ lib.optional cudaSupport addOpenGLRunpath;
 
     buildInputs = [
@@ -135,19 +136,18 @@ let
       # libs taken from system through the TF_SYS_LIBS mechanism
       grpc
       sqlite
-      openssl
+      boringssl
       jsoncpp
-      pkgs.protobuf
       curl
+      pybind11
       snappy
-      flatbuffers
+      flatbuffers-core
       icu
       double-conversion
       libpng
-      libjpeg
+      libjpeg_turbo
       giflib
-      re2
-      pkgs.lmdb
+      lmdb-core
     ] ++ lib.optionals cudaSupport [
       cudatoolkit
       cudnn
@@ -173,10 +173,17 @@ let
       # "com_github_googleapis_googleapis"
       # "com_github_googlecloudplatform_google_cloud_cpp"
       "com_github_grpc_grpc"
-      "com_google_protobuf"
-      "com_googlesource_code_re2"
+      # Multiple issues with custom protobuf.
+      # First `com_github_googleapis` fails to configure. Can be worked around by disabling `com_github_googleapis`
+      # and related functionality, but then the next error is about "dangling symbolic link", and in general
+      # looks like that's only the beginning: see
+      # https://stackoverflow.com/questions/55578884/how-to-build-tensorflow-1-13-1-with-custom-protobuf
+      # "com_google_protobuf"
+      # Fails with the error: external/org_tensorflow/tensorflow/core/profiler/utils/tf_op_utils.cc:46:49: error: no matching function for call to 're2::RE2::FullMatch(absl::lts_2020_02_25::string_view&, re2::RE2&)'
+      # "com_googlesource_code_re2"
       "curl"
       "cython"
+      "dill_archive"
       "double_conversion"
       "enum34_archive"
       "flatbuffers"
@@ -198,8 +205,9 @@ let
       "pybind11"
       "six_archive"
       "snappy"
-      "swig"
+      "tblib_archive"
       "termcolor_archive"
+      "typing_extensions_archive"
       "wrapt"
       "zlib"
     ];
@@ -224,16 +232,13 @@ let
     TF_CUDA_COMPUTE_CAPABILITIES = lib.concatStringsSep "," cudaCapabilities;
 
     postPatch = ''
+      # bazel 3.3 should work just as well as bazel 3.1
+      rm -f .bazelversion
+    '' + lib.optionalString (!withTensorboard) ''
       # Tensorboard pulls in a bunch of dependencies, some of which may
       # include security vulnerabilities. So we make it optional.
       # https://github.com/tensorflow/tensorflow/issues/20280#issuecomment-400230560
-      sed -i '/tensorboard >=/d' tensorflow/tools/pip_package/setup.py
-
-      # numpy 1.19 added in https://github.com/tensorflow/tensorflow/commit/75ea0b31477d6ba9e990e296bbbd8ca4e7eebadf.patch
-      sed -i 's/numpy >= 1.16.0, < 1.19.0/numpy >= 1.16.0/' tensorflow/tools/pip_package/setup.py
-
-      # bazel 3.3 should work just as well as bazel 3.1
-      rm -f .bazelversion
+      sed -i '/tensorboard ~=/d' tensorflow/tools/pip_package/setup.py
     '';
 
     # https://github.com/tensorflow/tensorflow/pull/39470
@@ -277,16 +282,15 @@ let
     bazelTarget = "//tensorflow/tools/pip_package:build_pip_package //tensorflow/tools/lib_package:libtensorflow";
 
     removeRulesCC = false;
+    # Without this Bazel complaints about sandbox violations.
+    dontAddBazelOpts = true;
 
     fetchAttrs = {
-      # So that checksums don't depend on these.
-      TF_SYSTEM_LIBS = null;
-
       # cudaSupport causes fetch of ncclArchive, resulting in different hashes
       sha256 = if cudaSupport then
-        "sha256-lEdPA9vhYO6vd5FgPMbFp2PkRvDBurPidYsxtJLXcbQ="
+        "0vyy1hv0jy5pqwvnc8pxb9isgnbw07c4a4d4wn61db00np114crz"
       else
-        "sha256-ZEY/bWo5M3Juw1x3CwhXYXZHD4q5LzWDlhgXnh4P95U=";
+        "0vczv5f9s4dxgwdkmf1y9b9ybh5d3y1nllqhb5q8aj9kq73izyn9";
     };
 
     buildAttrs = {
@@ -329,15 +333,13 @@ let
       license = licenses.asl20;
       maintainers = with maintainers; [ jyp abbradar ];
       platforms = with platforms; linux ++ darwin;
-      # The py2 build fails due to some issue importing protobuf. Possibly related to the fix in
-      # https://github.com/akesandgren/easybuild-easyblocks/commit/1f2e517ddfd1b00a342c6abb55aef3fd93671a2b
-      broken = !(xlaSupport -> cudaSupport) || !isPy3k;
+      broken = !(xlaSupport -> cudaSupport);
     };
   };
 
 in buildPythonPackage {
   inherit version pname;
-  disabled = isPy27;
+  disabled = !isPy3k;
 
   src = bazel-build.python;
 
@@ -354,27 +356,23 @@ in buildPythonPackage {
   # tensorflow/tools/pip_package/setup.py
   propagatedBuildInputs = [
     absl-py
-    astor
+    astunparse
+    dill
+    flatbuffers-python
     gast
     google-pasta
-    keras-applications
+    grpcio
+    h5py
     keras-preprocessing
     numpy
-    six
+    opt-einsum
     protobuf
+    six
+    tblib
     tensorflow-estimator_2
     termcolor
+    typing-extensions
     wrapt
-    grpcio
-    opt-einsum
-    astunparse
-    h5py
-  ] ++ lib.optionals (!isPy3k) [
-    mock
-    future
-    functools32
-  ] ++ lib.optionals (pythonOlder "3.4") [
-    backports_weakref enum34
   ] ++ lib.optionals withTensorboard [
     tensorflow-tensorboard_2
   ];
diff --git a/pkgs/development/python-modules/tensorflow/relax-dependencies.patch b/pkgs/development/python-modules/tensorflow/relax-dependencies.patch
index fc11a04cbdc5..b26c1e95a645 100644
--- a/pkgs/development/python-modules/tensorflow/relax-dependencies.patch
+++ b/pkgs/development/python-modules/tensorflow/relax-dependencies.patch
@@ -1,16 +1,51 @@
 diff --git a/tensorflow/tools/pip_package/setup.py b/tensorflow/tools/pip_package/setup.py
-index 594e74f40c0..bfbf010144f 100644
+index 65133afdafe..8ef6364ff7e 100644
 --- a/tensorflow/tools/pip_package/setup.py
 +++ b/tensorflow/tools/pip_package/setup.py
-@@ -54,9 +54,9 @@ _VERSION = '2.3.1'
+@@ -75,23 +75,23 @@ if '--project_name' in sys.argv:
+ # comment the versioning scheme.
+ # NOTE: Please add test only packages to `TEST_PACKAGES` below.
  REQUIRED_PACKAGES = [
-     'absl-py >= 0.7.0',
-     'astunparse == 1.6.3',
+-    'absl-py ~= 0.10',
+-    'astunparse ~= 1.6.3',
+-    'flatbuffers ~= 1.12.0',
+-    'google_pasta ~= 0.2',
+-    'h5py ~= 2.10.0',
+-    'keras_preprocessing ~= 1.1.2',
+-    'numpy ~= 1.19.2',
+-    'opt_einsum ~= 3.3.0',
++    'absl-py >= 0.10',
++    'astunparse >= 1.6.3',
++    'flatbuffers >= 1.12.0',
++    'google_pasta >= 0.2',
++    'h5py >= 2.10.0',
++    'keras_preprocessing >= 1.1.2',
++    'numpy >= 1.19.1',
++    'opt_einsum >= 3.3.0',
+     'protobuf >= 3.9.2',
+-    'six ~= 1.15.0',
+-    'termcolor ~= 1.1.0',
+-    'typing_extensions ~= 3.7.4',
+-    'wheel ~= 0.35',
+-    'wrapt ~= 1.12.1',
++    'six >= 1.15.0',
++    'termcolor >= 1.1.0',
++    'typing_extensions >= 3.7.4',
++    'wheel >= 0.34.2',
++    'wrapt >= 1.12.1',
+     # These packages needs to be pinned exactly as newer versions are
+     # incompatible with the rest of the ecosystem
 -    'gast == 0.3.3',
 +    'gast >= 0.3.3',
-     'google_pasta >= 0.1.8',
--    'h5py >= 2.10.0, < 2.11.0',
-+    'h5py >= 2.10.0',
-     'keras_preprocessing >= 1.1.1, < 1.2',
-     # TODO(mihaimaruseac): numpy 1.19.0 has ABI breakage
-     # https://github.com/numpy/numpy/pull/15355
+     # TensorFlow ecosystem packages that TF exposes API for
+     # These need to be in sync with the existing TF version
+     # They are updated during the release process
+@@ -118,7 +118,7 @@ if 'tf_nightly' in project_name:
+ # BoringSSL support.
+ # See https://github.com/tensorflow/tensorflow/issues/17882.
+ if sys.byteorder == 'little':
+-  REQUIRED_PACKAGES.append('grpcio ~= 1.32.0')
++  REQUIRED_PACKAGES.append('grpcio >= 1.31.0')
+ 
+ 
+ # Packages which are only needed for testing code.
diff --git a/pkgs/development/python-modules/tensorflow/system-jsoncpp.patch b/pkgs/development/python-modules/tensorflow/system-jsoncpp.patch
deleted file mode 100644
index ecb2d04d7eef..000000000000
--- a/pkgs/development/python-modules/tensorflow/system-jsoncpp.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff --git a/third_party/systemlibs/jsoncpp.BUILD b/third_party/systemlibs/jsoncpp.BUILD
-index 526fd0c418..646f3fdcea 100644
---- a/third_party/systemlibs/jsoncpp.BUILD
-+++ b/third_party/systemlibs/jsoncpp.BUILD
-@@ -7,6 +7,7 @@ filegroup(
- 
- HEADERS = [
-     "include/json/autolink.h",
-+    "include/json/allocator.h",
-     "include/json/config.h",
-     "include/json/features.h",
-     "include/json/forwards.h",
-@@ -23,7 +24,7 @@ genrule(
-     cmd = """
-       for i in $(OUTS); do
-         i=$${i##*/}
--        ln -sf $(INCLUDEDIR)/jsoncpp/json/$$i $(@D)/include/json/$$i
-+        ln -sf $(INCLUDEDIR)/json/$$i $(@D)/include/json/$$i
-       done
-     """,
- )
diff --git a/pkgs/development/python-modules/tensorflow/workspace.patch b/pkgs/development/python-modules/tensorflow/workspace.patch
new file mode 100644
index 000000000000..15a527815ec3
--- /dev/null
+++ b/pkgs/development/python-modules/tensorflow/workspace.patch
@@ -0,0 +1,18 @@
+diff --git a/WORKSPACE b/WORKSPACE
+index 9db1d9b80eb..c46f13f4ca4 100644
+--- a/WORKSPACE
++++ b/WORKSPACE
+@@ -12,6 +12,13 @@ http_archive(
+     ],
+ )
+ 
++http_archive(
++    name = "io_bazel_rules_docker",
++    sha256 = "1698624e878b0607052ae6131aa216d45ebb63871ec497f26c67455b34119c80",
++    strip_prefix = "rules_docker-0.15.0",
++    urls = ["https://github.com/bazelbuild/rules_docker/releases/download/v0.15.0/rules_docker-v0.15.0.tar.gz"],
++)
++
+ # Load tf_repositories() before loading dependencies for other repository so
+ # that dependencies like com_google_protobuf won't be overridden.
+ load("//tensorflow:workspace.bzl", "tf_repositories")
diff --git a/pkgs/development/python-modules/three-merge/default.nix b/pkgs/development/python-modules/three-merge/default.nix
new file mode 100644
index 000000000000..dab312c88455
--- /dev/null
+++ b/pkgs/development/python-modules/three-merge/default.nix
@@ -0,0 +1,24 @@
+{ lib, buildPythonPackage, fetchPypi, diff-match-patch }:
+
+buildPythonPackage rec {
+  pname = "three-merge";
+  version = "0.1.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0w6rv7rv1zm901wbjkmm6d3vkwyf3csja9p37bb60mar8khszxk0";
+  };
+
+  propagatedBuildInputs = [ diff-match-patch ];
+
+  dontUseSetuptoolsCheck = true;
+
+  pythonImportsCheck = [ "three_merge" ];
+
+  meta = with lib; {
+    description = "Simple library for merging two strings with respect to a base one";
+    homepage = "https://github.com/spyder-ide/three-merge";
+    license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
+  };
+}
diff --git a/pkgs/development/python-modules/worldengine/default.nix b/pkgs/development/python-modules/worldengine/default.nix
index fb7326c81d5b..51c0de77917d 100644
--- a/pkgs/development/python-modules/worldengine/default.nix
+++ b/pkgs/development/python-modules/worldengine/default.nix
@@ -3,7 +3,6 @@
 , pythonOlder
 , isPy27
 , fetchFromGitHub
-, nose
 , noise
 , numpy
 , pyplatec
@@ -11,6 +10,7 @@
 , purepng
 , h5py
 , gdal
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -47,13 +47,12 @@ buildPythonPackage rec {
       --replace 'PyPlatec==1.4.0' 'PyPlatec' \
   '';
 
-  # with python<3.5, unittest fails to discover tests because of their filenames
-  # so nose is used instead.
   doCheck = !isPy27; # google namespace clash
-  checkInputs = stdenv.lib.optional (pythonOlder "3.5") [ nose ];
-  postCheck = stdenv.lib.optionalString (pythonOlder "3.5") ''
-    nosetests tests
-  '';
+  checkInputs = [ pytestCheckHook ];
+
+  disabledTests = [
+    "TestSerialization"
+  ];
 
   meta = with lib; {
     homepage = "http://world-engine.org";
diff --git a/pkgs/development/python-modules/xdot/default.nix b/pkgs/development/python-modules/xdot/default.nix
index 75d090699a47..21b45b9c322d 100644
--- a/pkgs/development/python-modules/xdot/default.nix
+++ b/pkgs/development/python-modules/xdot/default.nix
@@ -20,7 +20,8 @@ buildPythonPackage rec {
   '';
 
   # https://github.com/NixOS/nixpkgs/pull/107872#issuecomment-752175866
-  doCheck = stdenv.isLinux;
+  # cannot import name '_gi' from partially initialized module 'gi' (most likely due to a circular import)
+  doCheck = false;
 
   meta = with lib; {
     description = "An interactive viewer for graphs written in Graphviz's dot";
diff --git a/pkgs/games/mindustry/0001-fix-include-path-for-SDL2-on-linux.patch b/pkgs/games/mindustry/0001-fix-include-path-for-SDL2-on-linux.patch
new file mode 100644
index 000000000000..d4fe7be19183
--- /dev/null
+++ b/pkgs/games/mindustry/0001-fix-include-path-for-SDL2-on-linux.patch
@@ -0,0 +1,33 @@
+From 9dbfa680db6bfd1033772dda753120fe4452e0d9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Milan=20P=C3=A4ssler?= <milan@petabyte.dev>
+Date: Fri, 8 Jan 2021 04:49:14 +0100
+Subject: [PATCH] fix include path for SDL2 on linux
+
+---
+ .../src/main/java/arc/backend/sdl/jni/SDL.java            | 8 --------
+ 1 file changed, 8 deletions(-)
+
+diff --git a/backends/backend-sdl/src/main/java/arc/backend/sdl/jni/SDL.java b/backends/backend-sdl/src/main/java/arc/backend/sdl/jni/SDL.java
+index 62d9286a..2853119d 100644
+--- a/Arc/backends/backend-sdl/src/main/java/arc/backend/sdl/jni/SDL.java
++++ b/Arc/backends/backend-sdl/src/main/java/arc/backend/sdl/jni/SDL.java
+@@ -8,16 +8,8 @@ import java.nio.*;
+ public class SDL{
+     /*JNI
+ 
+-    #ifdef __APPLE__
+-
+     #include "SDL2/SDL.h"
+ 
+-    #else
+-
+-    #include "SDL.h"
+-
+-    #endif
+-
+     */
+ 
+     static{
+-- 
+2.29.2
+
diff --git a/pkgs/games/mindustry/default.nix b/pkgs/games/mindustry/default.nix
index db2dcdf91807..6cf3941fb08a 100644
--- a/pkgs/games/mindustry/default.nix
+++ b/pkgs/games/mindustry/default.nix
@@ -1,12 +1,20 @@
 { lib, stdenv
 , makeWrapper
 , makeDesktopItem
+, copyDesktopItems
 , fetchFromGitHub
+, fetchpatch
 , gradleGen
 , jdk
 , perl
-, jre
+
+# for arc
+, SDL2
+, pkg-config
+, stb
+, ant
 , alsaLib
+, glew
 
 # Make the build version easily overridable.
 # Server and client build versions must match, and an empty build version means
@@ -25,12 +33,52 @@ let
   version = "122.1";
   buildVersion = makeBuildVersion version;
 
-  src = fetchFromGitHub {
+  Mindustry = fetchFromGitHub {
     owner = "Anuken";
     repo = "Mindustry";
     rev = "v${version}";
     sha256 = "18m4s81cfb2cr2fj61nf6spiln7cbvx25g42w6fypfikflv3qd8y";
   };
+  Arc = fetchFromGitHub {
+    owner = "Anuken";
+    repo = "Arc";
+    rev = "v${version}";
+    sha256 = "0inzyj01442da7794cpxlaab7di9gv1snc97cbffqsdxgin16i7d";
+  };
+  soloud = fetchFromGitHub {
+    owner = "Anuken";
+    repo = "soloud";
+    # this is never pinned in upstream, see https://github.com/Anuken/Arc/issues/39
+    rev = "8553049c6fb0d1eaa7f57c1793b96219c84e8ba5";
+    sha256 = "076vnjs2qxd65qq5i37gbmj5v5i04a1vw0kznq986gv9190jj531";
+  };
+
+  patches = [
+    ./0001-fix-include-path-for-SDL2-on-linux.patch
+    # upstream fix for https://github.com/Anuken/Arc/issues/40, remove on next release
+    (fetchpatch {
+      url = "https://github.com/Anuken/Arc/commit/b2f3d212c1a88a62f140f5cb04f4c86e61332d1c.patch";
+      sha256 = "1yjp4drv7lk3kinzy47g8jhb2qazr92b85vbc79vsqrs8sycskan";
+      extraPrefix = "Arc/";
+      stripLen = 1;
+    })
+    # add resolveDependencies task, remove when and if it gets added upstream in a future release
+    (fetchpatch {
+      url = "https://github.com/Anuken/Mindustry/pull/4302.patch";
+      sha256 = "0yp42sray4fxkajhpdljal0wss8jh9rvmclysw6cixsa94pw5khq";
+      extraPrefix = "Mindustry/";
+      stripLen = 1;
+    })
+  ];
+
+  unpackPhase = ''
+    cp -r ${Mindustry} Mindustry
+    cp -r ${Arc} Arc
+    chmod -R u+w -- Mindustry Arc
+    cp ${stb.src}/stb_image.h Arc/arc-core/csrc/
+    cp -r ${soloud} Arc/arc-core/csrc/soloud
+    chmod -R u+w -- Arc
+  '';
 
   desktopItem = makeDesktopItem {
     type = "Application";
@@ -40,7 +88,9 @@ let
     icon = "mindustry";
   };
 
-  postPatch = ''
+  cleanupMindustrySrc = ''
+    pushd Mindustry
+
     # Remove unbuildable iOS stuff
     sed -i '/^project(":ios"){/,/^}/d' build.gradle
     sed -i '/robo(vm|VM)/d' build.gradle
@@ -48,12 +98,11 @@ let
 
     # Pin 'SNAPSHOT' versions
     sed -i 's/com.github.anuken:packr:-SNAPSHOT/com.github.anuken:packr:034efe51781d2d8faa90370492133241bfb0283c/' build.gradle
+
+    popd
   '';
 
   preBuild = ''
-    # Arc is run at build time for sprite packing, and it needs to see
-    # the runtime libraries
-    ${stdenv.lib.optionalString stdenv.isLinux "export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:${alsaLib}/lib"}
     export GRADLE_USER_HOME=$(mktemp -d)
   '';
 
@@ -63,15 +112,17 @@ let
   # fake build to pre-download deps into fixed-output derivation
   deps = stdenv.mkDerivation {
     pname = "${pname}-deps";
-    inherit version src postPatch;
+    inherit version unpackPhase patches;
+    postPatch = cleanupMindustrySrc;
+
     nativeBuildInputs = [ gradle_6 perl ];
-    # Here we build both the server and the client so we only have to specify
-    # one hash for 'deps'. Deps can be garbage collected after the build,
-    # so this is not really an issue.
-    buildPhase = ''
-      ${preBuild}
-      gradle --no-daemon desktop:dist -Pbuildversion=${buildVersion}
-      gradle --no-daemon server:dist -Pbuildversion=${buildVersion}
+    # Here we download dependencies for both the server and the client so
+    # we only have to specify one hash for 'deps'. Deps can be garbage
+    # collected after the build, so this is not really an issue.
+    buildPhase = preBuild + ''
+      pushd Mindustry
+      gradle --no-daemon resolveDependencies
+      popd
     '';
     # perl code mavenizes pathes (com.squareup.okio/okio/1.13.0/a9283170b7305c8d92d25aff02a6ab7e45d06cbe/okio-1.13.0.jar -> com/squareup/okio/okio/1.13.0/okio-1.13.0.jar)
     installPhase = ''
@@ -81,66 +132,76 @@ let
     '';
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
-    outputHash = "0vzck6hsrvs438s3ikk66qmpak88bmqcb8inqbbjwy7x87d2qsvj";
+    outputHash = "09rwyrg2yv8r499b0dk1bzvymsf98d4j5b95bwd9s4xvrz71is3l";
   };
 
-  # Separate commands for building and installing the server and the client
-  buildClient = ''
+in
+assert stdenv.lib.assertMsg (enableClient || enableServer)
+  "mindustry: at least one of 'enableClient' and 'enableServer' must be true";
+stdenv.mkDerivation rec {
+  inherit pname version unpackPhase patches;
+
+  postPatch = ''
+    # ensure the prebuilt shared objects don't accidentally get shipped
+    rm Arc/natives/natives-desktop/libs/libarc*.so
+    rm Arc/backends/backend-sdl/libs/linux64/libsdl-arc*.so
+  '' + cleanupMindustrySrc;
+
+  buildInputs = [
+    SDL2
+    glew
+    alsaLib
+  ];
+  nativeBuildInputs = [
+    pkg-config
+    gradle_6
+    makeWrapper
+    jdk
+    ant
+    copyDesktopItems
+  ];
+
+  desktopItems = [ desktopItem ];
+
+  buildPhase = with stdenv.lib; preBuild + ''
+    # point to offline repo
+    sed -ie "s#mavenLocal()#mavenLocal(); maven { url '${deps}' }#g" Mindustry/build.gradle
+    sed -ie "s#mavenCentral()#mavenCentral(); maven { url '${deps}' }#g" Arc/build.gradle
+
+    pushd Mindustry
+  '' + optionalString enableClient ''
+    gradle --offline --no-daemon jnigenBuild -Pbuildversion=${buildVersion}
+    gradle --offline --no-daemon sdlnatives -Pdynamic -Pbuildversion=${buildVersion}
+    patchelf ../Arc/backends/backend-sdl/libs/linux64/libsdl-arc*.so \
+      --add-needed ${glew.out}/lib/libGLEW.so \
+      --add-needed ${SDL2}/lib/libSDL2.so
     gradle --offline --no-daemon desktop:dist -Pbuildversion=${buildVersion}
-  '';
-  buildServer = ''
+  '' + optionalString enableServer ''
     gradle --offline --no-daemon server:dist -Pbuildversion=${buildVersion}
   '';
-  installClient = ''
+
+  installPhase = with stdenv.lib; optionalString enableClient ''
     install -Dm644 desktop/build/libs/Mindustry.jar $out/share/mindustry.jar
     mkdir -p $out/bin
-    makeWrapper ${jre}/bin/java $out/bin/mindustry \
-      ${stdenv.lib.optionalString stdenv.isLinux "--prefix LD_LIBRARY_PATH : ${alsaLib}/lib"} \
+    makeWrapper ${jdk}/bin/java $out/bin/mindustry \
       --add-flags "-jar $out/share/mindustry.jar"
     install -Dm644 core/assets/icons/icon_64.png $out/share/icons/hicolor/64x64/apps/mindustry.png
-    install -Dm644 ${desktopItem}/share/applications/Mindustry.desktop $out/share/applications/Mindustry.desktop
-  '';
-  installServer = ''
+  '' + optionalString enableServer ''
     install -Dm644 server/build/libs/server-release.jar $out/share/mindustry-server.jar
     mkdir -p $out/bin
-    makeWrapper ${jre}/bin/java $out/bin/mindustry-server \
+    makeWrapper ${jdk}/bin/java $out/bin/mindustry-server \
       --add-flags "-jar $out/share/mindustry-server.jar"
   '';
 
-in
-assert stdenv.lib.assertMsg (enableClient || enableServer)
-  "mindustry: at least one of 'enableClient' and 'enableServer' must be true";
-stdenv.mkDerivation rec {
-  inherit pname version src postPatch;
-
-  nativeBuildInputs = [ gradle_6 makeWrapper ];
-
-  buildPhase = with stdenv.lib; ''
-    ${preBuild}
-    # point to offline repo
-    sed -ie "s#mavenLocal()#mavenLocal(); maven { url '${deps}' }#g" build.gradle
-    ${optionalString enableClient buildClient}
-    ${optionalString enableServer buildServer}
-  '';
-
-  installPhase = with stdenv.lib; ''
-    ${optionalString enableClient installClient}
-    ${optionalString enableServer installServer}
-  '';
-
   meta = with lib; {
     homepage = "https://mindustrygame.github.io/";
     downloadPage = "https://github.com/Anuken/Mindustry/releases";
     description = "A sandbox tower defense game";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ fgaz ];
-    platforms = platforms.all;
+    maintainers = with maintainers; [ fgaz petabyteboy ];
+    platforms = platforms.x86_64;
     # Hash mismatch on darwin:
     # https://github.com/NixOS/nixpkgs/pull/105590#issuecomment-737120293
-    # Problems with native libraries in aarch64:
-    # https://github.com/NixOS/nixpkgs/pull/107646
-    # https://logs.nix.ci/?key=nixos/nixpkgs.107646&attempt_id=3032c060-72e9-4a76-8186-4739544397dd
-    broken = stdenv.isDarwin ||
-             stdenv.isAarch64;
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/misc/uboot/0001-configs-rpi-allow-for-bigger-kernels.patch b/pkgs/misc/uboot/0001-configs-rpi-allow-for-bigger-kernels.patch
index ca82e82123b8..3d0324a692cc 100644
--- a/pkgs/misc/uboot/0001-configs-rpi-allow-for-bigger-kernels.patch
+++ b/pkgs/misc/uboot/0001-configs-rpi-allow-for-bigger-kernels.patch
@@ -1,30 +1,45 @@
-From 3c6b7c0922370e9d0c1705706e7c47dcd234e6c8 Mon Sep 17 00:00:00 2001
+From 3d0ce353cf62efea11aa88f814aa23bf8c04acc9 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Milan=20P=C3=A4ssler?= <milan@petabyte.dev>
-Date: Wed, 30 Dec 2020 11:49:16 +0100
+Date: Mon, 11 Jan 2021 15:13:10 +0100
 Subject: [PATCH] configs/rpi: allow for bigger kernels
 
 ---
- include/configs/rpi.h | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
+ include/configs/rpi.h | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
 
 diff --git a/include/configs/rpi.h b/include/configs/rpi.h
-index 834f1cd2..b63ee96f 100644
+index 834f1cd..10ab1e7 100644
 --- a/include/configs/rpi.h
 +++ b/include/configs/rpi.h
-@@ -163,10 +163,10 @@
-    "fdt_high=" FDT_HIGH "\0" \
-    "initrd_high=" INITRD_HIGH "\0" \
-    "kernel_addr_r=0x00080000\0" \
--   "scriptaddr=0x02400000\0" \
--   "pxefile_addr_r=0x02500000\0" \
--   "fdt_addr_r=0x02600000\0" \
--   "ramdisk_addr_r=0x02700000\0"
-+   "scriptaddr=0x02c00000\0" \
-+   "pxefile_addr_r=0x02d00000\0" \
-+   "fdt_addr_r=0x02e00000\0" \
-+   "ramdisk_addr_r=0x02f00000\0"
-
+@@ -153,20 +153,20 @@
+  * more than ~700M away from the start of the kernel image but this number can
+  * be larger OR smaller depending on e.g. the 'vmalloc=xxxM' command line
+  * parameter given to the kernel. So reserving memory from low to high
+- * satisfies this constraint again. Reserving 1M at 0x02600000-0x02700000 for
+- * the DTB leaves rest of the free RAM to the initrd starting at 0x02700000.
++ * satisfies this constraint again. Reserving 1M at 0x02e00000-0x02f00000 for
++ * the DTB leaves rest of the free RAM to the initrd starting at 0x02f00000.
+  * Even with the smallest possible CPU-GPU memory split of the CPU getting
+- * only 64M, the remaining 25M starting at 0x02700000 should allow quite
+- * large initrds before they start colliding with U-Boot.
++ * only 64M, the remaining 17M starting at 0x02f00000 should allow reasonably
++ * sized initrds before they start colliding with U-Boot.
+  */
+ #define ENV_MEM_LAYOUT_SETTINGS \
+ 	"fdt_high=" FDT_HIGH "\0" \
+ 	"initrd_high=" INITRD_HIGH "\0" \
+ 	"kernel_addr_r=0x00080000\0" \
+-	"scriptaddr=0x02400000\0" \
+-	"pxefile_addr_r=0x02500000\0" \
+-	"fdt_addr_r=0x02600000\0" \
+-	"ramdisk_addr_r=0x02700000\0"
++	"scriptaddr=0x02c00000\0" \
++	"pxefile_addr_r=0x02d00000\0" \
++	"fdt_addr_r=0x02e00000\0" \
++	"ramdisk_addr_r=0x02f00000\0"
+ 
  #if CONFIG_IS_ENABLED(CMD_MMC)
-    #define BOOT_TARGET_MMC(func) \
---
+ 	#define BOOT_TARGET_MMC(func) \
+-- 
 2.29.2
+
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index c4ecf666fcd9..e1b6da0216dc 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -424,7 +424,7 @@ let
       MODULE_SIG            = no; # r13y, generates a random key during build and bakes it in
       # Depends on MODULE_SIG and only really helps when you sign your modules
       # and enforce signatures which we don't do by default.
-      SECURITY_LOCKDOWN_LSM = no;
+      SECURITY_LOCKDOWN_LSM = option no;
     } // optionalAttrs (!stdenv.hostPlatform.isAarch32) {
 
       # Detect buffer overflows on the stack
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 6cf74a504a1a..c18d75b93f20 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.11-rc2";
+  version = "5.11-rc3";
   extraMeta.branch = "5.11";
 
   # modDirVersion needs to be x.y.z, will always add .0
@@ -11,7 +11,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "092jgmzqfpylwbwhv7j8hy5y0ai14b6wm7p7vw6pxj7alixyynq0";
+    sha256 = "15dfgvicp7s9xqaa3w8lmfffzyjsqrq1fa2gs1a8awzs5rxgsn61";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index a1a690007104..6b1568013b92 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -105,14 +105,4 @@
     name = "mac_nvme_t2";
     patch = ./mac-nvme-t2.patch;
   };
-
-  # https://lkml.org/lkml/2020/12/18/461
-  wireless_syntax_error = rec {
-    name = "wireless-syntax_error";
-    patch = fetchpatch {
-      name = name + ".patch";
-      url = "https://lkml.org/lkml/diff/2020/12/18/461/1";
-      sha256 = "11rnw9z7311crsx37sk68b71q51cni70lzf40ildqjnnn71m3q58";
-    };
-  };
 }
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 9b44d199d409..8b79e415b180 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2021.1.0";
+  version = "2021.1.1";
   components = {
     "abode" = ps: with ps; [ abodepy ];
     "accuweather" = ps: with ps; [ accuweather ];
@@ -11,7 +11,7 @@
     "actiontec" = ps: with ps; [ ];
     "adguard" = ps: with ps; [ adguardhome ];
     "ads" = ps: with ps; [ pyads ];
-    "advantage_air" = ps: with ps; [ advantage_air ];
+    "advantage_air" = ps: with ps; [ advantage-air ];
     "aftership" = ps: with ps; [ pyaftership ];
     "agent_dvr" = ps: with ps; [ ]; # missing inputs: agent-py
     "air_quality" = ps: with ps; [ ];
@@ -827,7 +827,7 @@
     "telnet" = ps: with ps; [ ];
     "temper" = ps: with ps; [ ]; # missing inputs: temperusb
     "template" = ps: with ps; [ ];
-    "tensorflow" = ps: with ps; [ numpy pillow tensorflow-build_2 ]; # missing inputs: pycocotools tf-models-official
+    "tensorflow" = ps: with ps; [ numpy pillow tensorflow ]; # missing inputs: pycocotools tf-models-official
     "tesla" = ps: with ps; [ teslajsonpy ];
     "tfiac" = ps: with ps; [ ]; # missing inputs: pytfiac
     "thermoworks_smoke" = ps: with ps; [ stringcase ]; # missing inputs: thermoworks_smoke
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 4f9698c536f2..2275f8c14b5c 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -62,7 +62,7 @@ let
   extraBuildInputs = extraPackages py.pkgs;
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2021.1.0";
+  hassVersion = "2021.1.1";
 
 in with py.pkgs; buildPythonApplication rec {
   pname = "homeassistant";
@@ -81,7 +81,7 @@ in with py.pkgs; buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = version;
-    sha256 = "14njb2j16h536xq5df4zpna874fxjcd6fqr881y6mq081f00i0r0";
+    sha256 = "1linjv1hryqsh8y1rql1i95b4lz4h8siw847gm78m1z8niacz7ss";
   };
 
   # leave this in, so users don't have to constantly update their downstream patch handling
diff --git a/pkgs/servers/web-apps/searx/default.nix b/pkgs/servers/web-apps/searx/default.nix
index b56e430d9951..41654a2f0bd9 100644
--- a/pkgs/servers/web-apps/searx/default.nix
+++ b/pkgs/servers/web-apps/searx/default.nix
@@ -1,8 +1,8 @@
-{ lib, python3Packages, fetchFromGitHub, fetchpatch }:
+{ lib, nixosTests, python3, python3Packages, fetchFromGitHub, fetchpatch }:
 
 with python3Packages;
 
-buildPythonApplication rec {
+toPythonModule (buildPythonApplication rec {
   pname = "searx";
   version = "0.17.0";
 
@@ -34,10 +34,18 @@ buildPythonApplication rec {
     rm tests/test_robot.py # A variable that is imported is commented out
   '';
 
+  postInstall = ''
+    # Create a symlink for easier access to static data
+    mkdir -p $out/share
+    ln -s ../${python3.sitePackages}/searx/static $out/share/
+  '';
+
+  passthru.tests = { inherit (nixosTests) searx; };
+
   meta = with lib; {
     homepage = "https://github.com/asciimoo/searx";
     description = "A privacy-respecting, hackable metasearch engine";
     license = licenses.agpl3Plus;
     maintainers = with maintainers; [ matejc fpletz globin danielfullmer ];
   };
-}
+})
diff --git a/pkgs/tools/admin/google-cloud-sdk/default.nix b/pkgs/tools/admin/google-cloud-sdk/default.nix
index 6d86d52ae1e5..61f41daf2423 100644
--- a/pkgs/tools/admin/google-cloud-sdk/default.nix
+++ b/pkgs/tools/admin/google-cloud-sdk/default.nix
@@ -21,18 +21,18 @@ let
   sources = name: system: {
     x86_64-darwin = {
       url = "${baseUrl}/${name}-darwin-x86_64.tar.gz";
-      sha256 = "1miqvh2b3mxrrr63q8f5i944mp3rz6685ckmnk5fml2wyc273jiv";
+      sha256 = "1rfaa4b34mijlqxi9savzjplk1z83rs1z8iyx89zbw21fyry08kb";
     };
 
     x86_64-linux = {
       url = "${baseUrl}/${name}-linux-x86_64.tar.gz";
-      sha256 = "15kfsxn6j37rsw97ixj7ixkzcby0pkgc5xj7cpqdq975ym58sgv7";
+      sha256 = "15izl7bvv7m96nyrs93b60fivr7gi2i306ryq6ynxrbq0nq43iya";
     };
   }.${system};
 
 in stdenv.mkDerivation rec {
   pname = "google-cloud-sdk";
-  version = "321.0.0";
+  version = "322.0.0";
 
   src = fetchurl (sources "${pname}-${version}" stdenv.hostPlatform.system);
 
diff --git a/pkgs/tools/misc/nagstamon/default.nix b/pkgs/tools/misc/nagstamon/default.nix
index 7f3c3ed4d560..3bd297628b2d 100644
--- a/pkgs/tools/misc/nagstamon/default.nix
+++ b/pkgs/tools/misc/nagstamon/default.nix
@@ -20,6 +20,8 @@ pythonPackages.buildPythonApplication rec {
     homepage = "https://nagstamon.ifw-dresden.de/";
     license = licenses.gpl2;
     maintainers = with maintainers; [ pSub ];
-    inherit version;
+    # fails to install with:
+    # TypeError: cannot unpack non-iterable bool object
+    broken = true;
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b90ce3922b44..8e8a7bf32070 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13361,6 +13361,10 @@ in
   glew110 = callPackage ../development/libraries/glew/1.10.nix {
     inherit (darwin.apple_sdk.frameworks) AGL OpenGL;
   };
+  glew-egl = glew.overrideAttrs (oldAttrs: {
+    pname = "glew-egl";
+    makeFlags = oldAttrs.makeFlags ++ [ "SYSTEM=linux-egl" ];
+  });
 
   glfw = glfw3;
   glfw2 = callPackage ../development/libraries/glfw/2.x.nix { };
@@ -18584,7 +18588,6 @@ in
     kernelPatches = [
       kernelPatches.bridge_stp_helper
       kernelPatches.request_key_helper
-      kernelPatches.wireless_syntax_error
     ];
   };
 
@@ -24038,6 +24041,10 @@ in
 
   recode = callPackage ../tools/text/recode { };
 
+  reddsaver = callPackage ../applications/misc/reddsaver {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
   rednotebook = python3Packages.callPackage ../applications/editors/rednotebook { };
 
   remotebox = callPackage ../applications/virtualization/remotebox { };
@@ -26156,6 +26163,7 @@ in
   megaglest = callPackage ../games/megaglest {};
 
   mindustry = callPackage ../games/mindustry { };
+  mindustry-wayland = callPackage ../games/mindustry { glew = glew-egl; };
 
   mindustry-server = callPackage ../games/mindustry {
     enableClient = false;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 2d2d53aedf2f..97cea2be45fe 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2771,6 +2771,8 @@ in {
 
   guzzle_sphinx_theme = callPackage ../development/python-modules/guzzle_sphinx_theme { };
 
+  gviz-api = callPackage ../development/python-modules/gviz-api {};
+
   gwyddion = disabledIf isPy3k (toPythonModule (pkgs.gwyddion.override {
     pythonSupport = true;
     pythonPackages = self;
@@ -4088,6 +4090,8 @@ in {
 
   mt-940 = callPackage ../development/python-modules/mt-940 { };
 
+  mulpyplexer = callPackage ../development/python-modules/mulpyplexer { };
+
   multidict = callPackage ../development/python-modules/multidict { };
 
   multi_key_dict = callPackage ../development/python-modules/multi_key_dict { };
@@ -5446,6 +5450,8 @@ in {
 
   pyls-mypy = callPackage ../development/python-modules/pyls-mypy { };
 
+  pyls-spyder = callPackage ../development/python-modules/pyls-spyder { };
+
   PyLTI = callPackage ../development/python-modules/pylti { };
 
   pymacaroons = callPackage ../development/python-modules/pymacaroons { };
@@ -7255,6 +7261,8 @@ in {
 
   statsmodels = callPackage ../development/python-modules/statsmodels { };
 
+  stdiomask = callPackage ../development/python-modules/stdiomask { };
+
   stem = callPackage ../development/python-modules/stem { };
 
   stevedore = callPackage ../development/python-modules/stevedore { };
@@ -7293,6 +7301,8 @@ in {
 
   stytra = callPackage ../development/python-modules/stytra { };
 
+  subarulink = callPackage ../development/python-modules/subarulink { };
+
   subdownloader = callPackage ../development/python-modules/subdownloader { };
 
   subliminal = callPackage ../development/python-modules/subliminal { };
@@ -7389,6 +7399,10 @@ in {
 
   tenacity = callPackage ../development/python-modules/tenacity { };
 
+  tensorboard-plugin-profile = callPackage ../development/python-modules/tensorboard-plugin-profile { };
+
+  tensorboard-plugin-wit = callPackage ../development/python-modules/tensorboard-plugin-wit {};
+
   tensorboardx = callPackage ../development/python-modules/tensorboardx { };
 
   tensorflow-bin_2 = callPackage ../development/python-modules/tensorflow/bin.nix {
@@ -7405,9 +7419,10 @@ in {
     cudatoolkit = pkgs.cudatoolkit_11_0;
     cudnn = pkgs.cudnn_cudatoolkit_11_0;
     nccl = pkgs.nccl_cudatoolkit_11;
-    openssl = pkgs.openssl_1_1;
     inherit (pkgs.darwin.apple_sdk.frameworks) Foundation Security;
-    inherit (pkgs) flatbuffers;
+    flatbuffers-core = pkgs.flatbuffers;
+    flatbuffers-python = self.flatbuffers;
+    lmdb-core = pkgs.lmdb;
   };
 
   tensorflow-build = self.tensorflow-build_2;
@@ -7495,6 +7510,8 @@ in {
 
   threadpoolctl = callPackage ../development/python-modules/threadpoolctl { };
 
+  three-merge = callPackage ../development/python-modules/three-merge { };
+
   thrift = callPackage ../development/python-modules/thrift { };
 
   thumbor = callPackage ../development/python-modules/thumbor { };
diff --git a/pkgs/top-level/static.nix b/pkgs/top-level/static.nix
index 48e4618762a6..b3fe7bf8c94f 100644
--- a/pkgs/top-level/static.nix
+++ b/pkgs/top-level/static.nix
@@ -50,15 +50,6 @@ self: super: let
     # ++ optional (super.stdenv.hostPlatform.libc == "glibc") ((flip overrideInStdenv) [ self.stdenv.glibc.static ])
   ;
 
-  # Force everything to link statically.
-  haskellStaticAdapter = self: super: {
-    mkDerivation = attrs: super.mkDerivation (attrs // {
-      enableSharedLibraries = false;
-      enableSharedExecutables = false;
-      enableStaticLibraries = true;
-    });
-  };
-
   removeUnknownConfigureFlags = f: with self.lib;
     remove "--disable-shared"
     (remove "--enable-static" f);
@@ -102,12 +93,6 @@ in {
   clangStdenv = foldl (flip id) super.clangStdenv staticAdapters;
   libcxxStdenv = foldl (flip id) super.libcxxStdenv staticAdapters;
 
-  haskell = super.haskell // {
-    packageOverrides = composeExtensions
-      (super.haskell.packageOverrides or (_: _: {}))
-      haskellStaticAdapter;
-  };
-
   zlib = super.zlib.override {
     # Don’t use new stdenv zlib because
     # it doesn’t like the --disable-shared flag