Merge master into staging-next

146 files changed, 1778 insertions, 854 deletions

diff --git a/lib/licenses.nix b/lib/licenses.nix
index 4c07797b16c2..b799a6ae8a43 100644
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@@ -276,6 +276,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) {
     fullName = "European Union Public License 1.2";
   };
 
+  fdl11 = spdx {
+    spdxId = "GFDL-1.1-only";
+    fullName = "GNU Free Documentation License v1.1 only";
+  };
+
   fdl12 = spdx {
     spdxId = "GFDL-1.2-only";
     fullName = "GNU Free Documentation License v1.2 only";
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 8260f6fb27d4..e16a7ed02f80 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5027,6 +5027,12 @@
     githubId = 223323;
     name = "Miguel de la Cruz";
   };
+  mgdm = {
+    email = "michael@mgdm.net";
+    github = "mgdm";
+    githubId = 71893;
+    name = "Michael Maclean";
+  };
   mgregoire = {
     email = "gregoire@martinache.net";
     github = "M-Gregoire";
diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml
index c7b30a198d86..ccb83f39acb2 100644
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@@ -183,6 +183,12 @@ services.mysql.initialScript = pkgs.writeText "mariadb-init.sql" ''
    </listitem>
    <listitem>
     <para>
+      <literal>vmware</literal> has been removed from the <literal>services.x11.videoDrivers</literal> defaults.
+      For VMWare guests set <literal>virtualisation.vmware.guest.enable</literal> to <literal>true</literal> which will include the appropriate drivers.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
      The initrd SSH support now uses OpenSSH rather than Dropbear to
      allow the use of Ed25519 keys and other OpenSSH-specific
      functionality. Host keys must now be in the OpenSSH format, and at
diff --git a/nixos/modules/config/i18n.nix b/nixos/modules/config/i18n.nix
index cc2ddda9d32f..feb76581a720 100644
--- a/nixos/modules/config/i18n.nix
+++ b/nixos/modules/config/i18n.nix
@@ -68,7 +68,8 @@ with lib;
   config = {
 
     environment.systemPackages =
-      optional (config.i18n.supportedLocales != []) config.i18n.glibcLocales;
+      # We increase the priority a little, so that plain glibc in systemPackages can't win.
+      optional (config.i18n.supportedLocales != []) (lib.setPrio (-1) config.i18n.glibcLocales);
 
     environment.sessionVariables =
       { LANG = config.i18n.defaultLocale;
diff --git a/nixos/modules/services/databases/redis.nix b/nixos/modules/services/databases/redis.nix
index 799c3db62166..f1777854e141 100644
--- a/nixos/modules/services/databases/redis.nix
+++ b/nixos/modules/services/databases/redis.nix
@@ -218,6 +218,7 @@ in
       description = "Redis database user";
       isSystemUser = true;
     };
+    users.groups.redis = {};
 
     environment.systemPackages = [ cfg.package ];
 
@@ -240,6 +241,7 @@ in
         StateDirectory = "redis";
         Type = "notify";
         User = "redis";
+        Group = "redis";
       };
     };
   };
diff --git a/nixos/modules/services/monitoring/prometheus/exporters.nix b/nixos/modules/services/monitoring/prometheus/exporters.nix
index f9ad1457fc85..0318acae50f7 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@@ -21,6 +21,7 @@ let
   #  `serviceOpts.script` or `serviceOpts.serviceConfig.ExecStart`
 
   exporterOpts = genAttrs [
+    "apcupsd"
     "bind"
     "blackbox"
     "collectd"
@@ -28,6 +29,8 @@ let
     "dovecot"
     "fritzbox"
     "json"
+    "keylight"
+    "lnd"
     "mail"
     "mikrotik"
     "minio"
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/apcupsd.nix b/nixos/modules/services/monitoring/prometheus/exporters/apcupsd.nix
new file mode 100644
index 000000000000..57c35a742c5f
--- /dev/null
+++ b/nixos/modules/services/monitoring/prometheus/exporters/apcupsd.nix
@@ -0,0 +1,38 @@
+{ config, lib, pkgs, options }:
+
+with lib;
+
+let
+  cfg = config.services.prometheus.exporters.apcupsd;
+in
+{
+  port = 9162;
+  extraOpts = {
+    apcupsdAddress = mkOption {
+      type = types.str;
+      default = ":3551";
+      description = ''
+        Address of the apcupsd Network Information Server (NIS).
+      '';
+    };
+
+    apcupsdNetwork = mkOption {
+      type = types.enum ["tcp" "tcp4" "tcp6"];
+      default = "tcp";
+      description = ''
+        Network of the apcupsd Network Information Server (NIS): one of "tcp", "tcp4", or "tcp6".
+      '';
+    };
+  };
+  serviceOpts = {
+    serviceConfig = {
+      ExecStart = ''
+        ${pkgs.prometheus-apcupsd-exporter}/bin/apcupsd_exporter \
+          -telemetry.addr ${cfg.listenAddress}:${toString cfg.port} \
+          -apcupsd.addr ${cfg.apcupsdAddress} \
+          -apcupsd.network ${cfg.apcupsdNetwork} \
+          ${concatStringsSep " \\\n  " cfg.extraFlags}
+      '';
+    };
+  };
+}
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/keylight.nix b/nixos/modules/services/monitoring/prometheus/exporters/keylight.nix
new file mode 100644
index 000000000000..dfa56343b871
--- /dev/null
+++ b/nixos/modules/services/monitoring/prometheus/exporters/keylight.nix
@@ -0,0 +1,19 @@
+{ config, lib, pkgs, options }:
+
+with lib;
+
+let
+  cfg = config.services.prometheus.exporters.keylight;
+in
+{
+  port = 9288;
+  serviceOpts = {
+    serviceConfig = {
+      ExecStart = ''
+        ${pkgs.prometheus-keylight-exporter}/bin/keylight_exporter \
+          -metrics.addr ${cfg.listenAddress}:${toString cfg.port} \
+          ${concatStringsSep " \\\n  " cfg.extraFlags}
+      '';
+    };
+  };
+}
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/lnd.nix b/nixos/modules/services/monitoring/prometheus/exporters/lnd.nix
new file mode 100644
index 000000000000..35f972020574
--- /dev/null
+++ b/nixos/modules/services/monitoring/prometheus/exporters/lnd.nix
@@ -0,0 +1,46 @@
+{ config, lib, pkgs, options }:
+
+with lib;
+
+let
+  cfg = config.services.prometheus.exporters.lnd;
+in
+{
+  port = 9092;
+  extraOpts = {
+    lndHost = mkOption {
+      type = types.str;
+      default = "localhost:10009";
+      description = ''
+        lnd instance gRPC address:port.
+      '';
+    };
+
+    lndTlsPath = mkOption {
+      type = types.path;
+      description = ''
+        Path to lnd TLS certificate.
+      '';
+    };
+
+    lndMacaroonDir = mkOption {
+      type = types.path;
+      description = ''
+        Path to lnd macaroons.
+      '';
+    };
+  };
+  serviceOpts.serviceConfig = {
+    ExecStart = ''
+      ${pkgs.prometheus-lnd-exporter}/bin/lndmon \
+        --prometheus.listenaddr=${cfg.listenAddress}:${toString cfg.port} \
+        --prometheus.logdir=/var/log/prometheus-lnd-exporter \
+        --lnd.host=${cfg.lndHost} \
+        --lnd.tlspath=${cfg.lndTlsPath} \
+        --lnd.macaroondir=${cfg.lndMacaroonDir} \
+        ${concatStringsSep " \\\n  " cfg.extraFlags}
+    '';
+    LogsDirectory = "prometheus-lnd-exporter";
+    ReadOnlyPaths = [ cfg.lndTlsPath cfg.lndMacaroonDir ];
+  };
+}
diff --git a/nixos/modules/services/x11/xserver.nix b/nixos/modules/services/x11/xserver.nix
index 6aec1c0753a2..400173745d3f 100644
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@@ -246,7 +246,7 @@ in
       videoDrivers = mkOption {
         type = types.listOf types.str;
         # !!! We'd like "nv" here, but it segfaults the X server.
-        default = [ "radeon" "cirrus" "vesa" "vmware" "modesetting" ];
+        default = [ "radeon" "cirrus" "vesa" "modesetting" ];
         example = [
           "ati_unfree" "amdgpu" "amdgpu-pro"
           "nv" "nvidia" "nvidiaLegacy390" "nvidiaLegacy340" "nvidiaLegacy304"
diff --git a/nixos/modules/virtualisation/lxd.nix b/nixos/modules/virtualisation/lxd.nix
index 53b89a9f55b1..3958fc2c1d7c 100644
--- a/nixos/modules/virtualisation/lxd.nix
+++ b/nixos/modules/virtualisation/lxd.nix
@@ -15,7 +15,6 @@ in
   ###### interface
 
   options = {
-
     virtualisation.lxd = {
       enable = mkOption {
         type = types.bool;
@@ -25,12 +24,18 @@ in
           containers. Users in the "lxd" group can interact with
           the daemon (e.g. to start or stop containers) using the
           <command>lxc</command> command line tool, among others.
+
+          Most of the time, you'll also want to start lxcfs, so
+          that containers can "see" the limits:
+          <code>
+            virtualisation.lxc.lxcfs.enable = true;
+          </code>
         '';
       };
 
       package = mkOption {
         type = types.package;
-        default = pkgs.lxd;
+        default = pkgs.lxd.override { nftablesSupport = config.networking.nftables.enable; };
         defaultText = "pkgs.lxd";
         description = ''
           The LXD package to use.
@@ -65,6 +70,7 @@ in
           with nixos.
         '';
       };
+
       recommendedSysctlSettings = mkOption {
         type = types.bool;
         default = false;
@@ -83,7 +89,6 @@ in
   ###### implementation
 
   config = mkIf cfg.enable {
-
     environment.systemPackages = [ cfg.package ];
 
     security.apparmor = {
@@ -115,6 +120,12 @@ in
         LimitNOFILE = "1048576";
         LimitNPROC = "infinity";
         TasksMax = "infinity";
+
+        # By default, `lxd` loads configuration files from hard-coded
+        # `/usr/share/lxc/config` - since this is a no-go for us, we have to
+        # explicitly tell it where the actual configuration files are
+        Environment = mkIf (config.virtualisation.lxc.lxcfs.enable)
+          "LXD_LXC_TEMPLATE_CONFIG=${pkgs.lxcfs}/share/lxc/config";
       };
     };
 
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 8e262d8eee7d..1bf091b361cb 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -178,6 +178,8 @@ in
   limesurvey = handleTest ./limesurvey.nix {};
   login = handleTest ./login.nix {};
   loki = handleTest ./loki.nix {};
+  lxd = handleTest ./lxd.nix {};
+  lxd-nftables = handleTest ./lxd-nftables.nix {};
   #logstash = handleTest ./logstash.nix {};
   lorri = handleTest ./lorri/default.nix {};
   magnetico = handleTest ./magnetico.nix {};
diff --git a/nixos/tests/lxd-nftables.nix b/nixos/tests/lxd-nftables.nix
new file mode 100644
index 000000000000..25517914db85
--- /dev/null
+++ b/nixos/tests/lxd-nftables.nix
@@ -0,0 +1,50 @@
+# This test makes sure that lxd stops implicitly depending on iptables when
+# user enabled nftables.
+#
+# It has been extracted from `lxd.nix` for clarity, and because switching from
+# iptables to nftables requires a full reboot, which is a bit hard inside NixOS
+# tests.
+
+import ./make-test-python.nix ({ pkgs, ...} : {
+  name = "lxd-nftables";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ patryk27 ];
+  };
+
+  machine = { lib, ... }: {
+    virtualisation = {
+      lxd.enable = true;
+    };
+
+    networking = {
+      firewall.enable = false;
+      nftables.enable = true;
+      nftables.ruleset = ''
+        table inet filter {
+          chain incoming {
+            type filter hook input priority 0;
+            policy accept;
+          }
+
+          chain forward {
+            type filter hook forward priority 0;
+            policy accept;
+          }
+
+          chain output {
+            type filter hook output priority 0;
+            policy accept;
+          }
+        }
+      '';
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("network.target")
+
+    with subtest("When nftables are enabled, lxd doesn't depend on iptables anymore"):
+        machine.succeed("lsmod | grep nf_tables")
+        machine.fail("lsmod | grep ip_tables")
+  '';
+})
diff --git a/nixos/tests/lxd.nix b/nixos/tests/lxd.nix
new file mode 100644
index 000000000000..db2d44dff557
--- /dev/null
+++ b/nixos/tests/lxd.nix
@@ -0,0 +1,135 @@
+import ./make-test-python.nix ({ pkgs, ...} :
+
+let
+  # Since we don't have access to the internet during the tests, we have to
+  # pre-fetch lxd containers beforehand.
+  #
+  # I've chosen to import Alpine Linux, because its image is turbo-tiny and,
+  # generally, sufficient for our tests.
+
+  alpine-meta = pkgs.fetchurl {
+    url = "https://uk.images.linuxcontainers.org/images/alpine/3.11/i386/default/20200608_13:00/lxd.tar.xz";
+    sha256 = "1hkvaj3rr333zmx1759njy435lps33gl4ks8zfm7m4nqvipm26a0";
+  };
+
+  alpine-rootfs = pkgs.fetchurl {
+    url = "https://uk.images.linuxcontainers.org/images/alpine/3.11/i386/default/20200608_13:00/rootfs.tar.xz";
+    sha256 = "1v82zdra4j5xwsff09qlp7h5vbsg54s0j7rdg4rynichfid3r347";
+  };
+
+  lxd-config = pkgs.writeText "config.yaml" ''
+    storage_pools:
+      - name: default
+        driver: dir
+        config:
+          source: /var/lxd-pool
+
+    networks:
+      - name: lxdbr0
+        type: bridge
+        config:
+          ipv4.address: auto
+          ipv6.address: none
+
+    profiles:
+      - name: default
+        devices:
+          eth0:
+            name: eth0
+            network: lxdbr0
+            type: nic
+          root:
+            path: /
+            pool: default
+            type: disk
+  '';
+
+in {
+  name = "lxd";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ patryk27 ];
+  };
+
+  machine = { lib, ... }: {
+    virtualisation = {
+      # Since we're testing `limits.cpu`, we've gotta have a known number of
+      # cores to lay on
+      cores = 2;
+
+      # Ditto, for `limits.memory`
+      memorySize = 512;
+
+      lxc.lxcfs.enable = true;
+      lxd.enable = true;
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("sockets.target")
+    machine.wait_for_unit("lxd.service")
+
+    # It takes additional second for lxd to settle
+    machine.sleep(1)
+
+    # lxd expects the pool's directory to already exist
+    machine.succeed("mkdir /var/lxd-pool")
+
+    machine.succeed(
+        "cat ${lxd-config} | lxd init --preseed"
+    )
+
+    machine.succeed(
+        "lxc image import ${alpine-meta} ${alpine-rootfs} --alias alpine"
+    )
+
+    with subtest("Containers can be launched and destroyed"):
+        machine.succeed("lxc launch alpine test")
+        machine.succeed("lxc exec test true")
+        machine.succeed("lxc delete -f test")
+
+    with subtest("Containers are being mounted with lxcfs inside"):
+        machine.succeed("lxc launch alpine test")
+
+        ## ---------- ##
+        ## limits.cpu ##
+
+        machine.succeed("lxc config set test limits.cpu 1")
+
+        # Since Alpine doesn't have `nproc` pre-installed, we've gotta resort
+        # to the primal methods
+        assert (
+            "1"
+            == machine.succeed("lxc exec test grep -- -c ^processor /proc/cpuinfo").strip()
+        )
+
+        machine.succeed("lxc config set test limits.cpu 2")
+
+        assert (
+            "2"
+            == machine.succeed("lxc exec test grep -- -c ^processor /proc/cpuinfo").strip()
+        )
+
+        ## ------------- ##
+        ## limits.memory ##
+
+        machine.succeed("lxc config set test limits.memory 64MB")
+
+        assert (
+            "MemTotal:          62500 kB"
+            == machine.succeed("lxc exec test grep -- MemTotal /proc/meminfo").strip()
+        )
+
+        machine.succeed("lxc config set test limits.memory 128MB")
+
+        assert (
+            "MemTotal:         125000 kB"
+            == machine.succeed("lxc exec test grep -- MemTotal /proc/meminfo").strip()
+        )
+
+        machine.succeed("lxc delete -f test")
+
+    with subtest("Unless explicitly changed, lxd leans on iptables"):
+        machine.succeed("lsmod | grep ip_tables")
+        machine.fail("lsmod | grep nf_tables")
+  '';
+})
diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix
index 4fc3668cfafb..4dbd64312224 100644
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -56,6 +56,21 @@ let
  */
 
   exporterTests = {
+     apcupsd = {
+      exporterConfig = {
+        enable = true;
+      };
+      metricProvider = {
+        services.apcupsd.enable = true;
+      };
+      exporterTest = ''
+        wait_for_unit("apcupsd.service")
+        wait_for_open_port(3551)
+        wait_for_unit("prometheus-apcupsd-exporter.service")
+        wait_for_open_port(9162)
+        succeed("curl -sSf http://localhost:9162/metrics | grep -q 'apcupsd_info'")
+      '';
+    };
 
     bind = {
       exporterConfig = {
@@ -202,6 +217,69 @@ let
       '';
     };
 
+    keylight = {
+      # A hardware device is required to properly test this exporter, so just
+      # perform a couple of basic sanity checks that the exporter is running
+      # and requires a target, but cannot reach a specified target.
+      exporterConfig = {
+        enable = true;
+      };
+      exporterTest = ''
+        wait_for_unit("prometheus-keylight-exporter.service")
+        wait_for_open_port(9288)
+        succeed(
+            "curl -sS --write-out '%{http_code}' -o /dev/null http://localhost:9288/metrics | grep -q '400'"
+        )
+        succeed(
+            "curl -sS --write-out '%{http_code}' -o /dev/null http://localhost:9288/metrics?target=nosuchdevice | grep -q '500'"
+        )
+      '';
+    };
+
+    lnd = {
+      exporterConfig = {
+        enable = true;
+        lndTlsPath = "/var/lib/lnd/tls.cert";
+        lndMacaroonDir = "/var/lib/lnd";
+      };
+      metricProvider = {
+        systemd.services.prometheus-lnd-exporter.serviceConfig.DynamicUser = false;
+        services.bitcoind.enable = true;
+        services.bitcoind.extraConfig = ''
+          rpcauth=bitcoinrpc:e8fe33f797e698ac258c16c8d7aadfbe$872bdb8f4d787367c26bcfd75e6c23c4f19d44a69f5d1ad329e5adf3f82710f7
+          bitcoind.zmqpubrawblock=tcp://127.0.0.1:28332
+          bitcoind.zmqpubrawtx=tcp://127.0.0.1:28333
+        '';
+        systemd.services.lnd = {
+          serviceConfig.ExecStart = ''
+          ${pkgs.lnd}/bin/lnd \
+            --datadir=/var/lib/lnd \
+            --tlscertpath=/var/lib/lnd/tls.cert \
+            --tlskeypath=/var/lib/lnd/tls.key \
+            --logdir=/var/log/lnd \
+            --bitcoin.active \
+            --bitcoin.mainnet \
+            --bitcoin.node=bitcoind \
+            --bitcoind.rpcuser=bitcoinrpc \
+            --bitcoind.rpcpass=hunter2 \
+            --bitcoind.zmqpubrawblock=tcp://127.0.0.1:28332 \
+            --bitcoind.zmqpubrawtx=tcp://127.0.0.1:28333 \
+            --readonlymacaroonpath=/var/lib/lnd/readonly.macaroon
+          '';
+          serviceConfig.StateDirectory = "lnd";
+          wantedBy = [ "multi-user.target" ];
+          after = [ "network.target" ];
+        };
+      };
+      exporterTest = ''
+        wait_for_unit("lnd.service")
+        wait_for_open_port(10009)
+        wait_for_unit("prometheus-lnd-exporter.service")
+        wait_for_open_port(9092)
+        succeed("curl -sSf localhost:9092/metrics | grep -q '^promhttp_metric_handler'")
+      '';
+    };
+
     mail = {
       exporterConfig = {
         enable = true;
diff --git a/pkgs/applications/audio/artyFX/default.nix b/pkgs/applications/audio/artyFX/default.nix
index 0265e0f75ecb..8cf9bec2e3df 100644
--- a/pkgs/applications/audio/artyFX/default.nix
+++ b/pkgs/applications/audio/artyFX/default.nix
@@ -2,13 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "artyFX";
-  version = "1.3";
+  # Fix build with lv2 1.18: https://github.com/openAVproductions/openAV-ArtyFX/pull/41/commits/492587461b50d140455aa3c98d915eb8673bebf0
+  version = "unstable-2020-04-28";
 
   src = fetchFromGitHub {
     owner = "openAVproductions";
     repo = "openAV-ArtyFX";
-    rev = "release-${version}";
-    sha256 = "012hcy1mxl7gs2lipfcqp5x0xv1azb9hjrwf0h59yyxnzx96h7c9";
+    rev = "492587461b50d140455aa3c98d915eb8673bebf0";
+    sha256 = "0wwg8ivnpyy0235bapjy4g0ij85zq355jwi6c1nkrac79p4z9ail";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/applications/audio/carla/default.nix b/pkgs/applications/audio/carla/default.nix
index bf297d8a83ca..357f30012880 100644
--- a/pkgs/applications/audio/carla/default.nix
+++ b/pkgs/applications/audio/carla/default.nix
@@ -15,13 +15,13 @@ assert withGtk3 -> gtk3 != null;
 
 stdenv.mkDerivation rec {
   pname = "carla";
-  version = "2.1";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "falkTX";
     repo = pname;
     rev = "v${version}";
-    sha256 = "074y40yrgl3qrdr3a5vn0scsw0qv77r5p5m6gc89zhf20ic8ajzc";
+    sha256 = "0c3y4a6cgi4bv1mg57i3qn5ia6pqjqlaylvkapj6bmpsw71ig22g";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/drumgizmo/default.nix b/pkgs/applications/audio/drumgizmo/default.nix
index 454befd55f9d..9e24c4a1c295 100644
--- a/pkgs/applications/audio/drumgizmo/default.nix
+++ b/pkgs/applications/audio/drumgizmo/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, alsaLib, expat, glib, libjack2, libXext, libX11, libpng
+{ stdenv, fetchurl, fetchpatch, alsaLib, expat, glib, libjack2, libXext, libX11, libpng
 , libpthreadstubs, libsmf, libsndfile, lv2, pkgconfig, zita-resampler
 }:
 
@@ -11,6 +11,16 @@ stdenv.mkDerivation rec {
     sha256 = "0bpbkzcr3znbwfdk79c14n5k5hh80iqlk2nc03q95vhimbadk8k7";
   };
 
+  patches = [
+    # Fix build for lv2 1.18.0
+    (fetchpatch {
+      url = "http://cgit.drumgizmo.org/plugingizmo.git/patch/?id=be64ddf9da525cd5c6757464efc966052731ba71";
+      sha256 = "17w8g78i5avssc7m8rpw64ka3rai8dff81wfzir9cpxp8s2h44qf";
+      extraPrefix = "plugin/plugingizmo/";
+      stripLen = 1;
+    })
+  ];
+
   configureFlags = [ "--enable-lv2" ];
 
   buildInputs = [
diff --git a/pkgs/applications/audio/eq10q/default.nix b/pkgs/applications/audio/eq10q/default.nix
index cc3a3c9ac1f5..c614b96f6385 100644
--- a/pkgs/applications/audio/eq10q/default.nix
+++ b/pkgs/applications/audio/eq10q/default.nix
@@ -19,6 +19,12 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  postPatch = ''
+     # Fix build with lv2 1.18: https://sourceforge.net/p/eq10q/bugs/23/
+     find . -type f -exec fgrep -q LV2UI_Descriptor {} \; \
+       -exec sed -i {} -e 's/const _\?LV2UI_Descriptor/const LV2UI_Descriptor/' \;
+   '';
+
   installFlags = [ "DESTDIR=$(out)" ];
 
   fixupPhase = ''
diff --git a/pkgs/applications/audio/faust/faust2.nix b/pkgs/applications/audio/faust/faust2.nix
index 33df1ce5d4ee..e65414b2bcab 100644
--- a/pkgs/applications/audio/faust/faust2.nix
+++ b/pkgs/applications/audio/faust/faust2.nix
@@ -20,19 +20,19 @@ with stdenv.lib.strings;
 
 let
 
-  version = "unstable-2020-03-20";
+  version = "unstable-2020-06-08";
 
   src = fetchFromGitHub {
     owner = "grame-cncm";
     repo = "faust";
-    rev = "2782088d4485f1c572755f41e7a072b41cb7148a";
-    sha256 = "1l7bi2mq10s5wm8g4cdipg8gndd478x897qv0h7nqi1s2q9nq99p";
+    rev = "f0037e289987818b65d3f6fb1ad943aaad2a2b28";
+    sha256 = "0h08902rgx7rhzpng4h1qw8i2nzv50f79vrlbzdk5d35wa4zibh4";
     fetchSubmodules = true;
   };
 
   meta = with stdenv.lib; {
     homepage = "http://faust.grame.fr/";
-    downloadPage = "https://sourceforge.net/projects/faudiostream/files/";
+    downloadPage = "https://github.com/grame-cncm/faust/";
     license = licenses.gpl2;
     platforms = platforms.linux;
     maintainers = with maintainers; [ magnetophon pmahoney ];
diff --git a/pkgs/applications/audio/faust/faust2jack.nix b/pkgs/applications/audio/faust/faust2jack.nix
index 26478b2bb2e5..370c25ecd749 100644
--- a/pkgs/applications/audio/faust/faust2jack.nix
+++ b/pkgs/applications/audio/faust/faust2jack.nix
@@ -12,7 +12,6 @@ faust.wrapWithBuildEnv {
 
   scripts = [
     "faust2jack"
-    "faust2jackinternal"
     "faust2jackconsole"
   ];
 
diff --git a/pkgs/applications/audio/guitarix/default.nix b/pkgs/applications/audio/guitarix/default.nix
index f94d27565e91..9b8475006ccf 100644
--- a/pkgs/applications/audio/guitarix/default.nix
+++ b/pkgs/applications/audio/guitarix/default.nix
@@ -1,8 +1,38 @@
-{ stdenv, fetchurl, fetchpatch, faust, gettext, intltool, pkgconfig, python2
-, avahi, bluez, boost, eigen, fftw, glib, glib-networking
-, glibmm, gsettings-desktop-schemas, gtkmm2, libjack2
-, ladspaH, libav, libsndfile, lilv, lrdf, lv2, serd, sord, sratom
-, wrapGAppsHook, zita-convolver, zita-resampler, curl, wafHook
+{ stdenv
+, fetchurl
+, avahi
+, bluez
+, boost
+, curl
+, eigen
+, fftw
+, gettext
+, glib
+, glib-networking
+, glibmm
+, gnome3
+, gsettings-desktop-schemas
+, gtk3
+, gtkmm3
+, hicolor-icon-theme
+, intltool
+, ladspaH
+, libav
+, libjack2
+, libsndfile
+, lilv
+, lrdf
+, lv2
+, pkgconfig
+, python2
+, sassc
+, serd
+, sord
+, sratom
+, wafHook
+, wrapGAppsHook
+, zita-convolver
+, zita-resampler
 , optimizationSupport ? false # Enable support for native CPU extensions
 }:
 
@@ -12,43 +42,67 @@ in
 
 stdenv.mkDerivation rec {
   pname = "guitarix";
-  version = "0.39.0";
+  version = "0.40.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/guitarix/guitarix2-${version}.tar.xz";
-    sha256 = "1nn80m1qagfhvv69za60f0w6ck87vmk77qmqarj7fbr8avwg63s9";
+    sha256 = "0q9050499hcj19hvbxb069vxh5yclawjg04vryh46lxm4sfy9g57";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://git.archlinux.org/svntogit/community.git/plain/trunk/guitarix-0.39.0-fix_faust_and_lv2_plugins.patch?id=8579b4dfe85e04303ad2d9771ed699f04ea7b7cf";
-      stripLen = 1;
-      sha256 = "0pgkhi4v4vrzjnig0ggmz207q4x5iyk2n6rjj8s5lv15fia7qzp4";
-    })
-  ];
+  # see: https://sourceforge.net/p/guitarix/bugs/105
+  patches = [ ./fix-build.patch ];
 
-  nativeBuildInputs = [ faust gettext intltool wrapGAppsHook pkgconfig python2 wafHook ];
+  nativeBuildInputs = [
+    gettext
+    hicolor-icon-theme
+    intltool
+    pkgconfig
+    python2
+    wafHook
+    wrapGAppsHook
+  ];
 
   buildInputs = [
-    avahi bluez boost eigen fftw glib glibmm glib-networking.out
-    gsettings-desktop-schemas gtkmm2 libjack2 ladspaH libav
-    libsndfile lilv lrdf lv2 serd sord sratom zita-convolver
-    zita-resampler curl
+    avahi
+    bluez
+    boost
+    curl
+    eigen
+    fftw
+    glib
+    glib-networking.out
+    glibmm
+    gnome3.adwaita-icon-theme
+    gsettings-desktop-schemas
+    gtk3
+    gtkmm3
+    ladspaH
+    libav
+    libjack2
+    libsndfile
+    lilv
+    lrdf
+    lv2
+    sassc
+    serd
+    sord
+    sratom
+    zita-convolver
+    zita-resampler
   ];
 
-  postPatch = ''
-    # Fix build with lv2 1.18: https://github.com/brummer10/guitarix/commit/c0334c72
-    find . -type f -exec fgrep -q LV2UI_Descriptor {} \; \
-      -exec sed -i {} -e 's/const struct _\?LV2UI_Descriptor/const LV2UI_Descriptor/' \;
-  '';
-
+  # this doesnt build, probably because we have the wrong faust version:
+  #       "--faust"
+  # aproved versions are 2.20.2 and 2.15.11
   wafConfigureFlags = [
+    "--no-faust"
+    "--no-font-cache-update"
     "--shared-lib"
     "--no-desktop-update"
     "--enable-nls"
     "--install-roboto-font"
     "--includeresampler"
-    "--convolver-ffmpeg"
+    "--includeconvolver"
   ] ++ optional optimizationSupport "--optimization";
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/audio/guitarix/fix-build.patch b/pkgs/applications/audio/guitarix/fix-build.patch
new file mode 100644
index 000000000000..4a0e42677765
--- /dev/null
+++ b/pkgs/applications/audio/guitarix/fix-build.patch
@@ -0,0 +1,10 @@
+--- a/src/LV2/xputty/xfilepicker.cpp
++++ b/src/LV2/xputty/xfilepicker.cpp
+@@ -191,6 +191,6 @@
+     filepicker->selected_file = NULL;
+     filepicker->path = NULL;
+     filepicker->filter = NULL;
+-    asprintf(&filepicker->path, path);
++    asprintf(&filepicker->path, "%s", path);
+     assert(filepicker->path != NULL);
+ }
diff --git a/pkgs/applications/audio/infamousPlugins/default.nix b/pkgs/applications/audio/infamousPlugins/default.nix
index 2cfe77ec291f..9ba835eb7eae 100644
--- a/pkgs/applications/audio/infamousPlugins/default.nix
+++ b/pkgs/applications/audio/infamousPlugins/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, pkgconfig, cairomm, cmake, lv2, libpthreadstubs, libXdmcp, libXft, ntk, pcre, fftwFloat, zita-resampler }:
+{ stdenv, fetchFromGitHub, fetchpatch, pkgconfig, cairomm, cmake, lv2, libpthreadstubs, libXdmcp, libXft, ntk, pcre, fftwFloat, zita-resampler }:
 
 stdenv.mkDerivation rec {
   pname = "infamousPlugins";
@@ -11,6 +11,12 @@ stdenv.mkDerivation rec {
     sha256 = "1r72agk5nxf5k0mghcc2j90z43j5d9i7rqjmf49jfyqnd443isip";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/ssj71/infamousPlugins/commit/06dd967b4736ea886dc1dc07f882cb1563961582.patch";
+      sha256 = "08xwh6px13y1gykaw103nhvjms7vgbgkcm0avh9f5d2d7aadq0l2";
+    })
+  ];
   nativeBuildInputs = [ pkgconfig cmake ];
   buildInputs = [ cairomm lv2 libpthreadstubs libXdmcp libXft ntk pcre fftwFloat zita-resampler ];
 
diff --git a/pkgs/applications/audio/ir.lv2/default.nix b/pkgs/applications/audio/ir.lv2/default.nix
index f9f58ab5ec1a..aa5eeae0a46c 100644
--- a/pkgs/applications/audio/ir.lv2/default.nix
+++ b/pkgs/applications/audio/ir.lv2/default.nix
@@ -15,6 +15,13 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [  pkgconfig ];
 
+  postPatch = ''
+     # Fix build with lv2 1.18: https://github.com/tomszilagyi/ir.lv2/pull/20
+     find . -type f -exec fgrep -q LV2UI_Descriptor {} \; \
+       -exec sed -i {} -e 's/const struct _\?LV2UI_Descriptor/const LV2UI_Descriptor/' \;
+   '';
+
+
   postBuild = "make convert4chan";
 
   installPhase = ''
diff --git a/pkgs/applications/audio/lsp-plugins/default.nix b/pkgs/applications/audio/lsp-plugins/default.nix
index ae3deccf8630..435da6440736 100644
--- a/pkgs/applications/audio/lsp-plugins/default.nix
+++ b/pkgs/applications/audio/lsp-plugins/default.nix
@@ -1,29 +1,19 @@
-{ stdenv, fetchFromGitHub, fetchpatch, pkgconfig, makeWrapper
+{ stdenv, fetchFromGitHub, pkgconfig, makeWrapper
 , libsndfile, jack2Full
 , libGLU, libGL, lv2, cairo
 , ladspaH, php }:
 
 stdenv.mkDerivation rec {
   pname = "lsp-plugins";
-  version = "1.1.19";
+  version = "1.1.22";
 
   src = fetchFromGitHub {
     owner = "sadko4u";
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "1wiph3vxhydc6mr9hn2c6crd4cx592l2zv0wrzgmpnlm1lflzpbg";
+    sha256 = "0s0i0kf5nqxxywckg03fds1w7696ly60rnlljzqvp7qfgzps1r6c";
   };
 
-  patches = [
-    # Fix build
-    # https://github.com/sadko4u/lsp-plugins/issues/104
-    (fetchpatch {
-      url = "https://github.com/sadko4u/lsp-plugins/commit/4d901135fb82fa95e668b4d55d05e405f5e620d2.patch";
-      excludes = [ "TODO.txt" ];
-      sha256 = "1s028gqvahvwm1px4xxxawrw2zrwyszb1aq93f0kspf3g7lq27f1";
-    })
-  ];
-
   nativeBuildInputs = [ pkgconfig php makeWrapper ];
   buildInputs = [ jack2Full libsndfile libGLU libGL lv2 cairo ladspaH ];
 
diff --git a/pkgs/applications/audio/monkeys-audio/default.nix b/pkgs/applications/audio/monkeys-audio/default.nix
index 58bb4d3e3274..adc8eb2087e5 100644
--- a/pkgs/applications/audio/monkeys-audio/default.nix
+++ b/pkgs/applications/audio/monkeys-audio/default.nix
@@ -12,7 +12,9 @@ stdenv.mkDerivation rec {
   };
 
   meta = with stdenv.lib; {
+    description = "Lossless audio codec";
     platforms = platforms.linux;
+    license = licenses.lgpl2;
     maintainers = [ ];
   };
 }
diff --git a/pkgs/applications/audio/mp3blaster/default.nix b/pkgs/applications/audio/mp3blaster/default.nix
index 2943a31454a6..74814a1b7ceb 100644
--- a/pkgs/applications/audio/mp3blaster/default.nix
+++ b/pkgs/applications/audio/mp3blaster/default.nix
@@ -1,13 +1,12 @@
 { stdenv, fetchFromGitHub, ncurses, libvorbis, SDL }:
-stdenv.mkDerivation rec {
-
-  version = "3.2.6";
 
+stdenv.mkDerivation rec {
   pname = "mp3blaster";
+  version = "3.2.6";
 
   src = fetchFromGitHub {
     owner = "stragulus";
-    repo = "mp3blaster";
+    repo = pname;
     rev = "v${version}";
     sha256 = "0pzwml3yhysn8vyffw9q9p9rs8gixqkmg4n715vm23ib6wxbliqs";
   };
@@ -17,14 +16,17 @@ stdenv.mkDerivation rec {
     libvorbis
   ] ++ stdenv.lib.optional stdenv.isDarwin SDL;
 
-  buildFlags = [ "CXXFLAGS=-Wno-narrowing" ];
+  NIX_CFLAGS_COMPILE = toString ([
+    "-Wno-narrowing"
+  ] ++ stdenv.lib.optionals stdenv.cc.isClang [
+    "-Wno-reserved-user-defined-literal"
+  ]);
 
   meta = with stdenv.lib; {
     description = "An audio player for the text console";
     homepage = "http://www.mp3blaster.org/";
     license = licenses.gpl2;
     maintainers = with maintainers; [ earldouglas ];
-    platforms = platforms.all;
+    platforms = with platforms; linux ++ darwin;
   };
-
 }
diff --git a/pkgs/applications/audio/rubyripper/default.nix b/pkgs/applications/audio/rubyripper/default.nix
index 82aa86f795bb..eb6de8431803 100644
--- a/pkgs/applications/audio/rubyripper/default.nix
+++ b/pkgs/applications/audio/rubyripper/default.nix
@@ -17,7 +17,9 @@ stdenv.mkDerivation rec {
       --prefix PATH : "${cdparanoia}/bin"
   '';
 
-  meta = {
-    platforms = stdenv.lib.platforms.linux;
+  meta = with stdenv.lib; {
+    description = "High quality CD audio ripper";
+    platforms = platforms.linux;
+    license = licenses.gpl3;
   };
 }
diff --git a/pkgs/applications/audio/sorcer/default.nix b/pkgs/applications/audio/sorcer/default.nix
index 7601f942868f..ad5f8fda1a99 100644
--- a/pkgs/applications/audio/sorcer/default.nix
+++ b/pkgs/applications/audio/sorcer/default.nix
@@ -14,6 +14,12 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ boost cairomm cmake libsndfile lv2 ntk python ];
 
+  postPatch = ''
+     # Fix build with lv2 1.18: https://github.com/brummer10/guitarix/commit/c0334c72
+     find . -type f -exec fgrep -q LV2UI_Descriptor {} \; \
+       -exec sed -i {} -e 's/const struct _\?LV2UI_Descriptor/const LV2UI_Descriptor/' \;
+   '';
+
   installPhase = ''
     make install
     cp -a ../presets/* "$out/lib/lv2"
diff --git a/pkgs/applications/audio/yoshimi/default.nix b/pkgs/applications/audio/yoshimi/default.nix
index f8ea58fef3ce..2b0a89bbaf5b 100644
--- a/pkgs/applications/audio/yoshimi/default.nix
+++ b/pkgs/applications/audio/yoshimi/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, alsaLib, boost, cairo, cmake, fftwSinglePrec, fltk, pcre
+{ stdenv, fetchFromGitHub , alsaLib, boost, cairo, cmake, fftwSinglePrec, fltk, pcre
 , libjack2, libsndfile, libXdmcp, readline, lv2, libGLU, libGL, minixml, pkgconfig, zlib, xorg
 }:
 
@@ -6,13 +6,15 @@ assert stdenv ? glibc;
 
 stdenv.mkDerivation  rec {
   pname = "yoshimi";
-  version = "1.7.0.1";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/yoshimi/${pname}-${version}.tar.bz2";
-    sha256 = "1pkqrrr51vlxh96vy0c0rf5ijjvymys4brsw9rv1bdp1bb8izw6c";
+  # Fix build with lv2 1.18: https://github.com/Yoshimi/yoshimi/pull/102/commits/86996cbb235f0fe138ae814a6758c2c8ba1c2a38
+  version = "unstable-2020-05-10";
+
+  src = fetchFromGitHub {
+    owner = "Yoshimi";
+    repo = pname;
+    rev = "86996cbb235f0fe138ae814a6758c2c8ba1c2a38";
+    sha256 = "0bgcc5fbgwpdjircq00wlii30pakf45yzligpbnf02a554hh4j01";
   };
-
   buildInputs = [
     alsaLib boost cairo fftwSinglePrec fltk libjack2 libsndfile libXdmcp readline lv2 libGLU libGL
     minixml zlib xorg.libpthreadstubs pcre
diff --git a/pkgs/applications/blockchains/dashpay.nix b/pkgs/applications/blockchains/dashpay.nix
index d0c3fed4350b..b88aa3af19e3 100644
--- a/pkgs/applications/blockchains/dashpay.nix
+++ b/pkgs/applications/blockchains/dashpay.nix
@@ -39,5 +39,6 @@ stdenv.mkDerivation rec {
     homepage = "https://www.dash.org";
     maintainers = with maintainers; [ AndersonTorres ];
     platforms = platforms.unix;
+    license = licenses.mit;
   };
 }
diff --git a/pkgs/applications/editors/setzer/default.nix b/pkgs/applications/editors/setzer/default.nix
new file mode 100644
index 000000000000..5a0ef754db16
--- /dev/null
+++ b/pkgs/applications/editors/setzer/default.nix
@@ -0,0 +1,60 @@
+{ lib
+, python3
+, fetchFromGitHub
+, meson
+, ninja
+, gettext
+, appstream
+, appstream-glib
+, wrapGAppsHook
+, gobject-introspection
+, gtksourceview4
+, gspell
+, poppler_gi
+, webkitgtk
+, librsvg
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "setzer";
+  version = "0.2.8";
+
+  src = fetchFromGitHub {
+    owner = "cvfosammmm";
+    repo = "Setzer";
+    rev = "v${version}";
+    sha256 = "1llxxjj038nd2p857bjdyyhzskn56826qi259v47vaqlv9hkifil";
+  };
+
+  format = "other";
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    gettext
+    appstream # for appstreamcli
+    appstream-glib
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gobject-introspection
+    gtksourceview4
+    gspell
+    poppler_gi
+    webkitgtk
+    librsvg
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pygobject3
+    pyxdg
+  ];
+
+  meta = with lib; {
+    description = "LaTeX editor written in Python with Gtk";
+    homepage = src.meta.homepage;
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/applications/graphics/ImageMagick/7.0.nix b/pkgs/applications/graphics/ImageMagick/7.0.nix
index 4472e41e9d1a..9bcf517e1d9e 100644
--- a/pkgs/applications/graphics/ImageMagick/7.0.nix
+++ b/pkgs/applications/graphics/ImageMagick/7.0.nix
@@ -13,8 +13,8 @@ let
     else throw "ImageMagick is not supported on this platform.";
 
   cfg = {
-    version = "7.0.10-14";
-    sha256 = "1qcsq5884iqis1adpfbx3cwki8v4q9wwh70fpcaqnwwmznmqfq4j";
+    version = "7.0.10-17";
+    sha256 = "15cj9qkikx13j6gfqaawi4nh09lnzg3asf5mdcswx6z6yhbf90zx";
     patches = [];
   };
 in
diff --git a/pkgs/applications/graphics/jpeg-archive/default.nix b/pkgs/applications/graphics/jpeg-archive/default.nix
index 97c15d2eec09..8beaf43c089c 100644
--- a/pkgs/applications/graphics/jpeg-archive/default.nix
+++ b/pkgs/applications/graphics/jpeg-archive/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation {
   meta = with stdenv.lib; {
     description = "Utilities for archiving photos for saving to long term storage or serving over the web";
     homepage    = "https://github.com/danielgtaylor/jpeg-archive";
-    # license = ...; # mixed?
+    license = licenses.mit;
     maintainers = [ maintainers.srghma ];
     platforms   = platforms.all;
   };
diff --git a/pkgs/applications/kde/ark/default.nix b/pkgs/applications/kde/ark/default.nix
index dbbfcf80c6b0..76cc423f5460 100644
--- a/pkgs/applications/kde/ark/default.nix
+++ b/pkgs/applications/kde/ark/default.nix
@@ -9,14 +9,14 @@
   libarchive, libzip,
 
   # Archive tools
-  lrzip,
+  p7zip, lrzip,
 
   # Unfree tools
   unfreeEnableUnrar ? false, unrar,
 }:
 
 let
-  extraTools = [ lrzip ] ++ lib.optional unfreeEnableUnrar unrar;
+  extraTools = [ p7zip lrzip ] ++ lib.optional unfreeEnableUnrar unrar;
 in
 
 mkDerivation {
diff --git a/pkgs/applications/misc/gcalcli/default.nix b/pkgs/applications/misc/gcalcli/default.nix
index d7d6ad5302d3..20aefe2ab1d6 100644
--- a/pkgs/applications/misc/gcalcli/default.nix
+++ b/pkgs/applications/misc/gcalcli/default.nix
@@ -5,13 +5,13 @@ with python3.pkgs;
 
 buildPythonApplication rec {
   pname = "gcalcli";
-  version = "4.2.1";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner  = "insanum";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "1xwrgmy2azvr99b7df92m2imj0wy4fh53bn7lvcrnghjbnh7n0l0";
+    sha256 = "0s5fhcmz3n0dwh3vkqr4aigi59q43v03ch5jhh6v75149icwr0df";
   };
 
   postPatch = lib.optionalString stdenv.isLinux ''
diff --git a/pkgs/applications/misc/gosmore/default.nix b/pkgs/applications/misc/gosmore/default.nix
index 350cb56695f9..4da6c6d07cc4 100644
--- a/pkgs/applications/misc/gosmore/default.nix
+++ b/pkgs/applications/misc/gosmore/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
 
   patches = [ ./pointer_int_comparison.patch ];
   patchFlags = [ "-p1" "--binary" ]; # patch has dos style eol
-      
+
   meta = with stdenv.lib; {
     description = "Open Street Map viewer";
     homepage = "https://sourceforge.net/projects/gosmore/";
@@ -33,5 +33,6 @@ stdenv.mkDerivation {
       raskin
     ];
     platforms = platforms.linux;
+    license = licenses.bsd2;
   };
 }
diff --git a/pkgs/applications/misc/simplenote/default.nix b/pkgs/applications/misc/simplenote/default.nix
index 46b80dc98f04..917e1965e2ea 100644
--- a/pkgs/applications/misc/simplenote/default.nix
+++ b/pkgs/applications/misc/simplenote/default.nix
@@ -16,10 +16,10 @@ let
 
   pname = "simplenote";
 
-  version = "1.16.0";
+  version = "1.17.0";
 
   sha256 = {
-    x86_64-linux = "01nk3dbyhs0p7f6b4bkrng95i29g0x7vxj0rx1qb7sm3n11yi091";
+    x86_64-linux = "14kjx4y3kvw7h8wk8mmkpx1288jscmd8bgl10bw6kcfigcwahpw3";
   }.${system} or throwSystem;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/misc/syncthingtray/default.nix b/pkgs/applications/misc/syncthingtray/default.nix
index 7af90535530e..28506c8fa883 100644
--- a/pkgs/applications/misc/syncthingtray/default.nix
+++ b/pkgs/applications/misc/syncthingtray/default.nix
@@ -20,14 +20,14 @@
 }:
 
 mkDerivation rec {
-  version = "0.10.9";
+  version = "0.10.10";
   pname = "syncthingtray";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = "syncthingtray";
     rev = "v${version}";
-    sha256 = "19kni5v9g0p4751bw2xb8dawg5yjkyk39vdy0m93448lsl8cqq04";
+    sha256 = "14nn0igcx4kd7pcna1ggz3yz9xfk1czgy87fxkmn2p91psmy2i18";
   };
 
   buildInputs = [ qtbase cpp-utilities qtutilities ]
diff --git a/pkgs/applications/networking/instant-messengers/discord/base.nix b/pkgs/applications/networking/instant-messengers/discord/base.nix
index 8f4f16673d25..653da669d386 100644
--- a/pkgs/applications/networking/instant-messengers/discord/base.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/base.nix
@@ -1,16 +1,30 @@
 { pname, version, src, binaryName, desktopName
-, stdenv, fetchurl, makeDesktopItem, wrapGAppsHook
-, alsaLib, atk, at-spi2-atk, at-spi2-core, cairo, cups, dbus, expat, fontconfig, freetype
-, gdk-pixbuf, glib, gtk3, libnotify, libX11, libXcomposite, libXcursor, libXdamage, libuuid
-, libXext, libXfixes, libXi, libXrandr, libXrender, libXtst, nspr, nss, libxcb
-, pango, systemd, libXScrnSaver, libcxx, libpulseaudio }:
+, autoPatchelfHook, fetchurl, makeDesktopItem, stdenv, wrapGAppsHook
+, alsaLib, at-spi2-atk, at-spi2-core, atk, cairo, cups, dbus, expat, fontconfig
+, freetype, gdk-pixbuf, glib, gtk3, libcxx, libdrm, libnotify, libpulseaudio, libuuid
+, libX11, libXScrnSaver, libXcomposite, libXcursor, libXdamage, libXext
+, libXfixes, libXi, libXrandr, libXrender, libXtst, libxcb
+, mesa, nspr, nss, pango, systemd
+}:
 
 let
   inherit binaryName;
 in stdenv.mkDerivation rec {
   inherit pname version src;
 
-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [
+    alsaLib
+    autoPatchelfHook
+    cups
+    libdrm
+    libX11
+    libXScrnSaver
+    libXtst
+    libxcb
+    mesa.drivers
+    nss
+    wrapGAppsHook
+  ];
 
   dontWrapGApps = true;
 
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 926ddeeb0483..bc76949e80ab 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -27,10 +27,10 @@ in {
     pname = "discord-canary";
     binaryName = "DiscordCanary";
     desktopName = "Discord Canary";
-    version = "0.0.103";
+    version = "0.0.104";
     src = fetchurl {
       url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-      sha256 = "1d95q75ak4z6wkxlgcmkl7yk20gl7zf568b0xslz42hwx032fn4z";
+      sha256 = "17np1hqqygjlbmlln0d1ba2qlbjykwj156w5dw7g4lg77kfxicfk";
     };
   };
 }.${branch}
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index 309da8f296c5..dae1513884ab 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -23,7 +23,7 @@ let
       else "");
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "1.34.1"; # Please backport all updates to the stable channel.
+  version = "1.34.2"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -33,7 +33,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "0v9mqn43vn1w6wppzydkgpbx2752bp7mmpf50wqgvrmhchnywnkj";
+    sha256 = "0l0i6v6n6iyq1zb2rlgfjnsk37kzjqgglk824vl5kp8qbq0li6b6";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/ipfs-cluster/default.nix b/pkgs/applications/networking/ipfs-cluster/default.nix
index c41912794d06..ee9e368a6590 100644
--- a/pkgs/applications/networking/ipfs-cluster/default.nix
+++ b/pkgs/applications/networking/ipfs-cluster/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "ipfs-cluster";
-  version = "0.12.1";
+  version = "0.13.0";
   rev = "v${version}";
 
-  vendorSha256 = "1n0zb3v83wsy8y3k7xbpjc2ykh1b2n6p10d5wkflhga49q7rf64h";
+  vendorSha256 = "00fkyxxi4iz16v0j33270x8qrspqpsv9j6csnikjy0klyb038pfq";
 
   src = fetchFromGitHub {
     owner = "ipfs";
     repo = "ipfs-cluster";
     inherit rev;
-    sha256 = "1jh6ynj50jd4w79widaqrgm3h3yz5h03vq0lbsx717a8d9073blh";
+    sha256 = "0jf3ngxqkgss5f1kifp5lp3kllb21jxc475ysl01ma8l3smqdvya";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/networking/msmtp/default.nix b/pkgs/applications/networking/msmtp/default.nix
index 9e990dcdf33d..e21cd5b3f0fc 100644
--- a/pkgs/applications/networking/msmtp/default.nix
+++ b/pkgs/applications/networking/msmtp/default.nix
@@ -9,11 +9,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "msmtp";
-  version = "1.8.10";
+  version = "1.8.11";
 
   src = fetchurl {
     url = "https://marlam.de/${pname}/releases/${pname}-${version}.tar.xz";
-    sha256 = "041g921rdjiv8bapp61gp4rylq8cckfkcwzyh8bs7xwxs4wpzfna";
+    sha256 = "0q0fg235qk448l1xjcwyxr7vcpzk6w57jzhjbkb0m7nffyhhypzj";
   };
 
   patches = [
diff --git a/pkgs/applications/networking/newsreaders/pan/default.nix b/pkgs/applications/networking/newsreaders/pan/default.nix
index 454e19fd8974..6dc0630d2db2 100644
--- a/pkgs/applications/networking/newsreaders/pan/default.nix
+++ b/pkgs/applications/networking/newsreaders/pan/default.nix
@@ -37,10 +37,11 @@ stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "A GTK-based Usenet newsreader good at both text and binaries";
     homepage = "http://pan.rebelbase.com/";
-    maintainers = [ stdenv.lib.maintainers.eelco ];
-    platforms = stdenv.lib.platforms.linux;
+    maintainers = [ maintainers.eelco ];
+    platforms = platforms.linux;
+    license = with licenses; [ gpl2 fdl11 ];
   };
 }
diff --git a/pkgs/applications/office/gnucash/default.nix b/pkgs/applications/office/gnucash/default.nix
index a8630381ebf2..641d400886f9 100644
--- a/pkgs/applications/office/gnucash/default.nix
+++ b/pkgs/applications/office/gnucash/default.nix
@@ -65,6 +65,7 @@ stdenv.mkDerivation rec {
       --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH:$out/share/gsettings-schemas/${pname}-${version}" \
       --prefix XDG_DATA_DIRS : "${hicolor-icon-theme}/share" \
       --prefix PERL5LIB ":" "$PERL5LIB" \
+      --set GNC_DBD_DIR ${libdbiDrivers}/lib/dbd \
       --prefix GIO_EXTRA_MODULES : "${stdenv.lib.getLib dconf}/lib/gio/modules"
   '';
 
diff --git a/pkgs/applications/radio/rtl-ais/default.nix b/pkgs/applications/radio/rtl-ais/default.nix
new file mode 100644
index 000000000000..f806f07d597d
--- /dev/null
+++ b/pkgs/applications/radio/rtl-ais/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchFromGitHub, pkgconfig, libusb1, rtl-sdr }:
+
+stdenv.mkDerivation {
+  name = "rtl-ais";
+  version = "0.8.1";
+  buildInputs = [ pkgconfig rtl-sdr libusb1 ];
+
+  src = fetchFromGitHub {
+    owner = "dgiardini";
+    repo = "rtl-ais";
+    rev = "0e85f4e5f9ce7378834c3129bc894580efc24291";
+    sha256 = "0wm4zai1vs89mf0zgz52q5w5rj8f3i3v6zg42hfb7aqabi25r3jf";
+  };
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  meta = with stdenv.lib; {
+    description = "A simple AIS tuner and generic dual-frequency FM demodulator";
+    homepage = "https://github.com/dgiardini/rtl-ais";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ mgdm ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/applications/science/logic/abc/default.nix b/pkgs/applications/science/logic/abc/default.nix
index a33cc92c7ce7..0bad0046e939 100644
--- a/pkgs/applications/science/logic/abc/default.nix
+++ b/pkgs/applications/science/logic/abc/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname   = "abc-verifier";
-  version = "2020.03.05";
+  version = "2020.04.30";
 
   src = fetchFromGitHub {
     owner  = "berkeley-abc";
     repo   = "abc";
-    rev    = "ed90ce20df9c7c4d6e1db5d3f786f9b52e06bab1";
-    sha256 = "01sw67pkrb6wzflkxbkxzwsnli3nvp0yxwp3j1ngb3c0j86ri437";
+    rev    = "fd2c9b1c19216f6b756f88b18f5ca67b759ca128";
+    sha256 = "1d18pkpsx0nlzl3a6lyfdnpk4kixjmgswy6cp5fbrkpp4rf1gahi";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/science/logic/symbiyosys/default.nix b/pkgs/applications/science/logic/symbiyosys/default.nix
index b180cf307f0f..debdc56f0353 100644
--- a/pkgs/applications/science/logic/symbiyosys/default.nix
+++ b/pkgs/applications/science/logic/symbiyosys/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation {
   pname = "symbiyosys";
-  version = "2020.03.24";
+  version = "2020.05.18";
 
   src = fetchFromGitHub {
     owner  = "YosysHQ";
     repo   = "SymbiYosys";
-    rev    = "8a62780b9df4d2584e41cdd42cab92fddcd75b31";
-    sha256 = "0ss5mrzwff2dny8kfciqbrz67m6k52yvc1shd7gk3qb99x7g7fp8";
+    rev    = "13fef4a710d0e2cf0f109ca75a94fb7253ba6838";
+    sha256 = "152nyxddiqbxvbd06cmwavvgi931v6i35zj9sh3z04m737grvb3d";
   };
 
   buildInputs = [ python3 ];
diff --git a/pkgs/applications/version-management/fossil/default.nix b/pkgs/applications/version-management/fossil/default.nix
index c7f523861c11..d23728a060f9 100644
--- a/pkgs/applications/version-management/fossil/default.nix
+++ b/pkgs/applications/version-management/fossil/default.nix
@@ -5,7 +5,7 @@
 
 stdenv.mkDerivation rec {
   pname = "fossil";
-  version = "2.11";
+  version = "2.11.1";
 
   src = fetchurl {
     urls =
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
         "https://www.fossil-scm.org/index.html/uv/fossil-src-${version}.tar.gz"
       ];
     name = "${pname}-${version}.tar.gz";
-    sha256 = "0c9nzx42wxfmym9vf1pnbdb1c7gp7a7zqky60izxsph7w2xh8nix";
+    sha256 = "1sxq1hn87fdikhbg9y3v4sjy4gxaifnx4dig8nx6xwd5mm7z74dk";
   };
 
   buildInputs = [ zlib openssl readline sqlite which ed ]
diff --git a/pkgs/applications/version-management/git-and-tools/gh/default.nix b/pkgs/applications/version-management/git-and-tools/gh/default.nix
index 300570f7efd2..36df07de465d 100644
--- a/pkgs/applications/version-management/git-and-tools/gh/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gh/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gh";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "050wqjng0l42ilaiglwm1mzrrmnk0bg9icnzq9sm88axgl4xpmdy";
+    sha256 = "0m4qgvhd4fzl83acfbpwff0sqshyfhqiy5q4i7ly8h6rdsjysdck";
   };
 
-  vendorSha256 = "0s99bjmsafnzhl3s2lcybxgsw1s4i1h3vh6p40gz4vsfhndidqrq";
+  vendorSha256 = "0zkgdb69zm662p50sk1663lcbkw0vp8ip9blqfp6539mp9b87dn7";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json
index 308a2399458b..bc342ff2b5ef 100644
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@@ -1,13 +1,13 @@
 {
-  "version": "13.0.4",
-  "repo_hash": "15pfg3ss1diqsnlf0xpx4ixlpjnvzghzjfvs6y3bv21qnjfwkp0g",
+  "version": "13.0.6",
+  "repo_hash": "0iyzx5lnkwp6m8q5p60gzsjmpf6qflvzl0vzfw37hymnxwq646zy",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v13.0.4-ee",
+  "rev": "v13.0.6-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "13.0.4",
+    "GITALY_SERVER_VERSION": "13.0.6",
     "GITLAB_PAGES_VERSION": "1.18.0",
     "GITLAB_SHELL_VERSION": "13.2.0",
-    "GITLAB_WORKHORSE_VERSION": "8.31.1"
+    "GITLAB_WORKHORSE_VERSION": "8.31.2"
   }
 }
\ No newline at end of file
diff --git a/pkgs/applications/version-management/gitlab/gitaly/default.nix b/pkgs/applications/version-management/gitlab/gitaly/default.nix
index 374bf953f786..8f51b33fbd4f 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@@ -19,14 +19,14 @@ let
       };
   };
 in buildGoPackage rec {
-  version = "13.0.4";
+  version = "13.0.6";
   pname = "gitaly";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitaly";
     rev = "v${version}";
-    sha256 = "1hnjv2q98016srvjmyjpd5fkpg68mra6qk0asl1l83z2vin2xrkm";
+    sha256 = "14vp73z9f0p3m1bjykkfzrmw9miyjxiqm79rns477xbm2dbmwa4s";
   };
 
   # Fix a check which assumes that hook files are writeable by their
diff --git a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
index f6710643f6d8..6386a9cc5aa7 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@@ -3,13 +3,13 @@
 buildGoPackage rec {
   pname = "gitlab-workhorse";
 
-  version = "8.31.1";
+  version = "8.31.2";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-workhorse";
     rev = "v${version}";
-    sha256 = "1c2y1icil98qay9d95q1rlpi0ffhll990grkkib9srsn55b2i86v";
+    sha256 = "0wvhhjfb490mjdrmc9xwr3qfh3941xn3b02c757ghrvzwv329wvg";
   };
 
   goPackagePath = "gitlab.com/gitlab-org/gitlab-workhorse";
diff --git a/pkgs/applications/video/mpv/wrapper.nix b/pkgs/applications/video/mpv/wrapper.nix
index 1658f922ab3b..ad6383046b1b 100644
--- a/pkgs/applications/video/mpv/wrapper.nix
+++ b/pkgs/applications/video/mpv/wrapper.nix
@@ -32,10 +32,10 @@ let
     # All arguments besides the input and output binaries (${mpv}/bin/mpv and
     # $out/bin/mpv). These are used by the darwin specific makeWrapper call
     # used to wrap $out/Applications/mpv.app/Contents/MacOS/mpv as well.
-    mostMakeWrapperArgs = builtins.concatStringsSep " " ([ "--argv0" "'$0'"
+    mostMakeWrapperArgs = lib.strings.escapeShellArgs ([ "--argv0" "'$0'"
       # These are always needed (TODO: Explain why)
-      "--prefix" "LUA_CPATH" "\\;" "${mpv.luaEnv}/lib/lua/${mpv.lua.luaversion}/\\?.so"
-      "--prefix" "LUA_PATH" "\\;" "${mpv.luaEnv}/share/lua/${mpv.lua.luaversion}/\\?.lua"
+      "--prefix" "LUA_CPATH" ";" "${mpv.luaEnv}/lib/lua/${mpv.lua.luaversion}/?.so"
+      "--prefix" "LUA_PATH" ";" "${mpv.luaEnv}/share/lua/${mpv.lua.luaversion}/?.lua"
     ] ++ lib.optionals mpv.vapoursynthSupport [
       "--prefix" "PYTHONPATH" ":" "${mpv.vapoursynth}/lib/${mpv.vapoursynth.python3.sitePackages}"
     ] ++ lib.optionals (binPath != "") [
@@ -52,7 +52,7 @@ let
       ) scripts
     )) ++ extraMakeWrapperArgs)
     ;
-    umpvWrapperArgs = builtins.concatStringsSep " " ([
+    umpvWrapperArgs = lib.strings.escapeShellArgs ([
       "--argv0" "'$0'"
       "--set" "MPV" "$out/bin/mpv"
     ] ++ extraUmpvWrapperArgs)
diff --git a/pkgs/applications/virtualization/qemu/utils.nix b/pkgs/applications/virtualization/qemu/utils.nix
index 430d71221797..436716e0a8c3 100644
--- a/pkgs/applications/virtualization/qemu/utils.nix
+++ b/pkgs/applications/virtualization/qemu/utils.nix
@@ -13,4 +13,6 @@ stdenv.mkDerivation rec {
     cp "${qemu}/bin/qemu-io"  "$out/bin/qemu-io"
     cp "${qemu}/bin/qemu-nbd" "$out/bin/qemu-nbd"
   '';
+
+  inherit (qemu) meta;
 }
diff --git a/pkgs/applications/virtualization/xhyve/default.nix b/pkgs/applications/virtualization/xhyve/default.nix
index 921a54b11a2e..db9a7ef82577 100644
--- a/pkgs/applications/virtualization/xhyve/default.nix
+++ b/pkgs/applications/virtualization/xhyve/default.nix
@@ -27,10 +27,11 @@ stdenv.mkDerivation rec {
     cp build/xhyve $out/bin
   '';
 
-  meta = {
+  meta = with lib; {
     description = "Lightweight Virtualization on macOS Based on bhyve";
     homepage = "https://github.com/mist64/xhyve";
-    maintainers = [ lib.maintainers.lnl7 ];
-    platforms = lib.platforms.darwin;
+    maintainers = [ maintainers.lnl7 ];
+    license = licenses.bsd2;
+    platforms = platforms.darwin;
   };
 }
diff --git a/pkgs/applications/window-managers/icewm/default.nix b/pkgs/applications/window-managers/icewm/default.nix
index b6b07d8d7278..05cca88e6195 100644
--- a/pkgs/applications/window-managers/icewm/default.nix
+++ b/pkgs/applications/window-managers/icewm/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, cmake, gettext, perl, asciidoc
 , libjpeg, libtiff, libungif, libpng, imlib, expat
-, freetype, fontconfig, pkgconfig, gdk-pixbuf
+, freetype, fontconfig, pkgconfig, gdk-pixbuf, gdk-pixbuf-xlib, glib
 , mkfontdir, libX11, libXft, libXext, libXinerama
 , libXrandr, libICE, libSM, libXpm, libXdmcp, libxcb
 , libpthreadstubs, pcre, libXdamage, libXcomposite, libXfixes
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     gettext libjpeg libtiff libungif libpng imlib expat
-    freetype fontconfig gdk-pixbuf mkfontdir libX11
+    freetype fontconfig gdk-pixbuf gdk-pixbuf-xlib glib mkfontdir libX11
     libXft libXext libXinerama libXrandr libICE libSM libXpm
     libXdmcp libxcb libpthreadstubs pcre libsndfile fribidi
     libXdamage libXcomposite libXfixes
diff --git a/pkgs/applications/window-managers/tinywm/default.nix b/pkgs/applications/window-managers/tinywm/default.nix
index 0e30857267bd..d6ff4ad51a2e 100644
--- a/pkgs/applications/window-managers/tinywm/default.nix
+++ b/pkgs/applications/window-managers/tinywm/default.nix
@@ -42,10 +42,11 @@ stdenv.mkDerivation rec {
       - Resize windows interactively with Alt+Button3 drag (right mouse button)
       - Raise windows with Alt+F1 (not high on usability I know, but I needed a
         keybinding in there somewhere)
-      - Focus windows with the mouse pointer (X does this on its own)      
+      - Focus windows with the mouse pointer (X does this on its own)
     '';
     homepage = "http://incise.org/tinywm.html";
     maintainers = with maintainers; [ AndersonTorres ];
     platforms = libX11.meta.platforms;
+    license = licenses.publicDomain;
   };
 }
diff --git a/pkgs/build-support/emacs/wrapper.nix b/pkgs/build-support/emacs/wrapper.nix
index 25f068cd3fa0..1f2fbd8068e7 100644
--- a/pkgs/build-support/emacs/wrapper.nix
+++ b/pkgs/build-support/emacs/wrapper.nix
@@ -174,7 +174,7 @@ runCommand
 
     mkdir -p $out/share
     # Link icons and desktop files into place
-    for dir in applications icons info man; do
+    for dir in applications icons info man emacs; do
       ln -s $emacs/share/$dir $out/share/$dir
     done
   ''
diff --git a/pkgs/desktops/enlightenment/efl.nix b/pkgs/desktops/enlightenment/efl.nix
index 449c16e13baf..5ac8194d74e1 100644
--- a/pkgs/desktops/enlightenment/efl.nix
+++ b/pkgs/desktops/enlightenment/efl.nix
@@ -39,6 +39,7 @@
 , luajit
 , lz4
 , mesa
+, mint-x-icons
 , openjpeg
 , openssl
 , poppler
@@ -92,7 +93,7 @@ stdenv.mkDerivation rec {
     xorg.libXcursor
     xorg.xorgproto
     zlib
-    # still missing parent icon themes: Mint-X, RAVE-X, Faenza
+    # still missing parent icon themes: RAVE-X, Faenza
   ];
 
   propagatedBuildInputs = [
@@ -107,6 +108,7 @@ stdenv.mkDerivation rec {
     fribidi
     ghostscript
     harfbuzz
+    hicolor-icon-theme # for the icon theme
     jbig2dec
     libdrm
     libinput
@@ -117,6 +119,7 @@ stdenv.mkDerivation rec {
     libwebp
     libxkbcommon
     luajit
+    mint-x-icons # Mint-X is a parent icon theme of Enlightenment-X
     openjpeg
     poppler
     utillinux
diff --git a/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix b/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
index 0d3c786690d1..4bb3f4517f0e 100644
--- a/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
+++ b/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution-data-server";
-  version = "3.36.2";
+  version = "3.36.3";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution-data-server/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0yz9fsnbnnlj2iidd81i9w7d0dhidrzqkixrnfjfdkhnxk7p9qlq";
+    sha256 = "1cix02xl473m0l7h715s68cn7bi1p4y1jkrxswcq4a0g7lblhpqz";
   };
 
   patches = [
diff --git a/pkgs/development/arduino/arduino-core/default.nix b/pkgs/development/arduino/arduino-core/default.nix
index 3512dcbd2bcf..2a7387c4378a 100644
--- a/pkgs/development/arduino/arduino-core/default.nix
+++ b/pkgs/development/arduino/arduino-core/default.nix
@@ -1,22 +1,36 @@
-{ stdenv, lib, fetchFromGitHub, fetchurl, jdk, ant
-, libusb-compat-0_1, libusb1, unzip, zlib, ncurses, readline
-, withGui ? false, gtk2 ? null, withTeensyduino ? false
+{ stdenv
+, lib
+, fetchFromGitHub
+, fetchurl
+, jdk
+, ant
+, libusb-compat-0_1
+, libusb1
+, unzip
+, zlib
+, ncurses
+, readline
+, withGui ? false
+, gtk2 ? null
+, withTeensyduino ? false
   /* Packages needed for Teensyduino */
-, upx, fontconfig, xorg, gcc
-, atk, glib, pango, gdk-pixbuf, libpng12, expat, freetype
-, cairo, udev
+, upx
+, fontconfig
+, xorg
+, gcc
+, atk
+, glib
+, pango
+, gdk-pixbuf
+, libpng12
+, expat
+, freetype
+, cairo
+, udev
 }:
 
 assert withGui -> gtk2 != null;
 assert withTeensyduino -> withGui;
-
-# TODO: Teensyduino is disabled for i686-linux due to an indefinite hang in the
-# xdotool script; the cause of this hang is not yet known.
-# TODO: There is a fair chance that Teensyduino works with arm-linux, but it
-# has not yet been tested.
-if withTeensyduino && (stdenv.hostPlatform.system != "x86_64-linux") then throw
-  "Teensyduino is only supported on x86_64-linux at this time (patches welcome)."
-else
 let
   externalDownloads = import ./downloads.nix {
     inherit fetchurl;
@@ -25,12 +39,13 @@ let
   };
   # Some .so-files are later copied from .jar-s to $HOME, so patch them beforehand
   patchelfInJars =
-       lib.optional (stdenv.hostPlatform.system == "x86_64-linux") {jar = "share/arduino/lib/jssc-2.8.0-arduino3.jar"; file = "libs/linux/libjSSC-2.8_x86_64.so";}
-    ++ lib.optional (stdenv.hostPlatform.system == "i686-linux") {jar = "share/arduino/lib/jssc-2.8.0-arduino3.jar"; file = "libs/linux/libjSSC-2.8_x86.so";}
+    lib.optional (stdenv.hostPlatform.system == "aarch64-linux") { jar = "share/arduino/lib/jssc-2.8.0-arduino4.jar"; file = "libs/linux/libjSSC-2.8_aarch64.so"; }
+    ++ lib.optional (builtins.match "armv[67]l-linux" stdenv.hostPlatform.system != null) { jar = "share/arduino/lib/jssc-2.8.0-arduino4.jar"; file = "libs/linux/libjSSC-2.8_armhf.so"; }
+    ++ lib.optional (stdenv.hostPlatform.system == "x86_64-linux") { jar = "share/arduino/lib/jssc-2.8.0-arduino4.jar"; file = "libs/linux/libjSSC-2.8_x86_64.so"; }
+    ++ lib.optional (stdenv.hostPlatform.system == "i686-linux") { jar = "share/arduino/lib/jssc-2.8.0-arduino4.jar"; file = "libs/linux/libjSSC-2.8_x86.so"; }
   ;
   # abiVersion 6 is default, but we need 5 for `avrdude_bin` executable
   ncurses5 = ncurses.override { abiVersion = "5"; };
-
   teensy_libpath = stdenv.lib.makeLibraryPath [
     atk
     cairo
@@ -54,49 +69,61 @@ let
     zlib
   ];
   teensy_architecture =
-      lib.optionalString (stdenv.hostPlatform.system == "x86_64-linux") "linux64"
-      + lib.optionalString (stdenv.hostPlatform.system == "i686-linux") "linux32"
-      + lib.optionalString (stdenv.hostPlatform.system == "arm-linux") "linuxarm";
-
-  flavor = (if withTeensyduino then "teensyduino" else "arduino")
-             + stdenv.lib.optionalString (!withGui) "-core";
+    lib.optionalString (stdenv.hostPlatform.system == "x86_64-linux") "linux64"
+    + lib.optionalString (stdenv.hostPlatform.system == "i686-linux") "linux32"
+    + lib.optionalString (stdenv.hostPlatform.system == "aarch64-linux") "linuxaarch64"
+    + lib.optionalString (builtins.match "armv[67]l-linux" stdenv.hostPlatform.system != null) "linuxarm";
+  flavor = ( if withTeensyduino then "teensyduino" else "arduino")
+    + stdenv.lib.optionalString (!withGui) "-core";
 in
 stdenv.mkDerivation rec {
-  version = "1.8.9";
+  version = "1.8.12";
   name = "${flavor}-${version}";
 
   src = fetchFromGitHub {
     owner = "arduino";
     repo = "Arduino";
     rev = version;
-    sha256 = "0kblq0bqap2zzkflrj6rmdi8dvqxa28fcwwrc3lfmbz2893ni3w4";
+    sha256 = "0lxkyvsh55biz2q20ba4qabraind5cpxznl41zfq027vl22j6kd2";
   };
 
-  teensyduino_version = "147";
+  teensyduino_version = "151";
   teensyduino_src = fetchurl {
     url = "https://www.pjrc.com/teensy/td_${teensyduino_version}/TeensyduinoInstall.${teensy_architecture}";
     sha256 =
       lib.optionalString (teensy_architecture == "linux64")
-        "09ysanip5d2f5axzd81z2l74ayng60zqhjxmxs7xa5098fff46il"
+        "0q8mw9bm2vb5vwa98gwcs6ad164i98hc1qqh2qw029yhwm599pn0"
       + lib.optionalString (teensy_architecture == "linux32")
-        "1zw3cfv2p62dwg8838vh0gd1934b18cyx7c13azvwmrpj601l0xx"
+        "1rq6sx0048ab200jy0cz5vznwxi99avidngj42rjnh7kcfas5c4m"
+      + lib.optionalString (teensy_architecture == "linuxaarch64")
+        "09k78dycn1vcpcx37c1dak8bgjv8gs34l89n9r9s0c3rqmv3pg4x"
       + lib.optionalString (teensy_architecture == "linuxarm")
-        "12421z26ksx84aldw1pq0cakh8jhs33mwafgvfij0zfgn9x0i877";
-    };
+        "19j55bq36040rpdpfxcqimda76rkbx137q15bs8nvxj13wrbl4ip";
+  };
   # Used because teensyduino requires jars be a specific size
   arduino_dist_src = fetchurl {
     url = "http://downloads.arduino.cc/arduino-${version}-${teensy_architecture}.tar.xz";
     sha256 =
       lib.optionalString (teensy_architecture == "linux64")
-        "1lv4in9j0r8s0cis4zdvbk2637vlj12w69wdxgcxcrwvkcdahkpa"
+        "128f34kkxz7ab6ir5mqyr8d1mgxig8f9jygwxy44pdnq2rk6gmh9"
       + lib.optionalString (teensy_architecture == "linux32")
-        "0zla3a6gd9prclgrbbgsmhf8ds8zb221m65x21pvz0y1cwsdvjpm"
+        "11n85lwsn1w4ysfacyw08v85s3f3zvl8j8ac7rld19yxgjslvisi"
+      + lib.optionalString (teensy_architecture == "linuxaarch64")
+        "04v2nhyjhahml6nmz23bfb63c0an4a7zxgcgxqqq442i8vd304wa"
       + lib.optionalString (teensy_architecture == "linuxarm")
-        "1w5m49wfd68zazli0lf3w4zykab8n7mzp3wnbjqfpx2vip80bqnz";
+        "1k8yjivaydm6y16mplrjyblgx7l0wjzm3mjxh5saxrjq7drswmxx";
   };
 
 
-  buildInputs = [ jdk ant libusb-compat-0_1 libusb1 unzip zlib ncurses5 readline
+  buildInputs = [
+    jdk
+    ant
+    libusb-compat-0_1
+    libusb1
+    unzip
+    zlib
+    ncurses5
+    readline
   ] ++ stdenv.lib.optionals withTeensyduino [ upx ];
   downloadSrcList = builtins.attrValues externalDownloads;
   downloadDstList = builtins.attrNames externalDownloads;
@@ -116,7 +143,8 @@ stdenv.mkDerivation rec {
 
     # Deliberately break build.xml's download statement in order to cause
     # an error if anything needed is missing from download.nix.
-    substituteInPlace build/build.xml --replace "get src" "get error"
+    substituteInPlace build/build.xml \
+      --replace 'ignoreerrors="true"' 'ignoreerrors="false"'
 
     cd ./arduino-core && ant
     cd ../build && ant
@@ -125,11 +153,11 @@ stdenv.mkDerivation rec {
 
   # This will be patched into `arduino` wrapper script
   # Java loads gtk dynamically, so we need to provide it using LD_LIBRARY_PATH
-  dynamicLibraryPath = lib.makeLibraryPath [gtk2];
-  javaPath = lib.makeBinPath [jdk];
+  dynamicLibraryPath = lib.makeLibraryPath [ gtk2 ];
+  javaPath = lib.makeBinPath [ jdk ];
 
   # Everything else will be patched into rpath
-  rpath = (lib.makeLibraryPath [zlib libusb-compat-0_1 libusb1 readline ncurses5 stdenv.cc.cc]);
+  rpath = (lib.makeLibraryPath [ zlib libusb-compat-0_1 libusb1 readline ncurses5 stdenv.cc.cc ]);
 
   installPhase = ''
     mkdir -p $out/share/arduino
@@ -192,19 +220,19 @@ stdenv.mkDerivation rec {
     done
 
     ${lib.concatMapStringsSep "\n"
-        ({jar, file}:
+      ({ jar, file }:
           ''
-              jar xvf $out/${jar} ${file}
-              patchelf --set-rpath $rpath ${file}
-              jar uvf $out/${jar} ${file}
-              rm -f ${file}
+            jar xvf $out/${jar} ${file}
+            patchelf --set-rpath $rpath ${file}
+            jar uvf $out/${jar} ${file}
+            rm -f ${file}
           ''
         )
-        patchelfInJars}
+      patchelfInJars}
 
     # avrdude_bin is linked against libtinfo.so.5
     mkdir $out/lib/
-    ln -s ${lib.makeLibraryPath [ncurses5]}/libtinfo.so.5 $out/lib/libtinfo.so.5
+    ln -s ${lib.makeLibraryPath [ ncurses5 ]}/libtinfo.so.5 $out/lib/libtinfo.so.5
 
     ${stdenv.lib.optionalString withTeensyduino ''
       # Patch the Teensy loader binary
diff --git a/pkgs/development/arduino/arduino-core/downloads.nix b/pkgs/development/arduino/arduino-core/downloads.nix
index 9c4f795d2936..f2edf64ceb6f 100644
--- a/pkgs/development/arduino/arduino-core/downloads.nix
+++ b/pkgs/development/arduino/arduino-core/downloads.nix
@@ -1,4 +1,7 @@
-{fetchurl, optionalAttrs, system}:
+{ fetchurl
+, optionalAttrs
+, system
+}:
 # This file preloads all the archives which Arduino's build/build.xml
 # would otherwise try to download itself. When updating this for a new
 # version of Arduino, check build.xml for version numbers and new
@@ -56,9 +59,9 @@
     url = "https://github.com/arduino-libraries/RobotIRremote/archive/2.0.0.zip";
     sha256 = "0j5smap74j8p3wc6k0h73b1skj4gkr7r25jbjh1j1cg052dxri86";
   };
-  "build/SpacebrewYun-1.0.1.zip" = fetchurl {
-    url = "https://github.com/arduino-libraries/SpacebrewYun/archive/1.0.1.zip";
-    sha256 = "1zs6ymlzw66bglrm0x6d3cvr52q85c8rlm525x0wags111xx3s90";
+  "build/SpacebrewYun-1.0.2.zip" = fetchurl {
+    url = "https://github.com/arduino-libraries/SpacebrewYun/archive/1.0.2.zip";
+    sha256 = "1d8smmsx12qhf2ldvmi93h48cvdyz4id5gd68cvf076wfyv6dks8";
   };
   "build/Temboo-1.2.1.zip" = fetchurl {
     url = "https://github.com/arduino-libraries/Temboo/archive/1.2.1.zip";
@@ -76,108 +79,135 @@
     url = "https://github.com/arduino-libraries/Keyboard/archive/1.0.2.zip";
     sha256 = "17yfj95r1i7fb87q4krmxmaq07b4x2xf8cjngrj5imj68wgjck53";
   };
-  "build/SD-1.2.3.zip" = fetchurl {
-    url = "https://github.com/arduino-libraries/SD/archive/1.2.3.zip";
-    sha256 = "0i5hb5hmrsrhfgxx8w7zzrfrkc751vs63vhxrj6qvwazhfcdpjw2";
+  "build/SD-1.2.4.zip" = fetchurl {
+    url = "https://github.com/arduino-libraries/SD/archive/1.2.4.zip";
+    sha256 = "123g9px9nqcrsx696wqwzjd5s4hr55nxgfz95b7ws3v007i1f3fz";
   };
-  "build/Servo-1.1.3.zip" = fetchurl {
-    url = "https://github.com/arduino-libraries/Servo/archive/1.1.3.zip";
-    sha256 = "1m019a75cdn1fg0cwlzbahmaqvg8sgzr6v1812rd7rjh8ismiah6";
+  "build/Servo-1.1.6.zip" = fetchurl {
+    url = "https://github.com/arduino-libraries/Servo/archive/1.1.6.zip";
+    sha256 = "1z9k9lxzj5d3f8h9hy86f4k5wgfr2a9zcvjh76qmpvv6clcv3js3";
   };
   "build/LiquidCrystal-1.0.7.zip" = fetchurl {
     url = "https://github.com/arduino-libraries/LiquidCrystal/archive/1.0.7.zip";
     sha256 = "1wrxrqz3n4yrj9j1a2b7pdd7a1rlyi974ra7crv5amjng8817x9n";
   };
-  "build/Adafruit_Circuit_Playground-1.8.1.zip" = fetchurl {
-    url = "https://github.com/Adafruit/Adafruit_CircuitPlayground/archive/1.8.1.zip";
-    sha256 = "1fl24px4c42f6shpb3livwsxgpj866yy285274qrj4m1zl07f18q";
+  "build/Adafruit_Circuit_Playground-1.10.4.zip" = fetchurl {
+    url = "https://github.com/adafruit/Adafruit_CircuitPlayground/archive/1.10.4.zip";
+    sha256 = "194az5pxxzs0wg4ng7w0zqrdw93qdyv02y0q2yy57dr4kwfrm6nl";
   };
-  "build/libastylej-2.05.1-4.zip" = fetchurl {
-    url = "https://downloads.arduino.cc/libastylej-2.05.1-4.zip";
-    sha256 = "0q307b85xba7izjh344kqby3qahg3f5zy18gg52sjk1lbkl9i39s";
+  "build/libastylej-2.05.1-5.zip" = fetchurl {
+    url = "https://downloads.arduino.cc/libastylej-2.05.1-5.zip";
+    sha256 = "11mlprwvqfq3nvmz6hdf1fcg02a7xi2a9qhffa1d8a4w15s2iwny";
   };
-  "build/liblistSerials-1.4.2.zip" = fetchurl {
-    url = "https://downloads.arduino.cc/liblistSerials/liblistSerials-1.4.2.zip";
-    sha256 = "1p58b421k92rbgwfgbihy0d04mby7kfssghpmjb4gk9yix09za3m";
+  "build/liblistSerials-1.4.2-2.zip" = fetchurl {
+    url = "https://downloads.arduino.cc/liblistSerials/liblistSerials-1.4.2-2.zip";
+    sha256 = "0sqzwp1lfjy452z3d4ma5c4blwsj7za72ymxf7crpq9dh9qd8f53";
   };
-  "build/shared/WiFi101-Updater-ArduinoIDE-Plugin-0.10.6.zip" = fetchurl {
-    url = "https://github.com/arduino-libraries/WiFi101-FirmwareUpdater-Plugin/releases/download/v0.10.6/WiFi101-Updater-ArduinoIDE-Plugin-0.10.6.zip";
-    sha256 = "1k23xyr5dmr60y8hb9x24wrgd4mfgvrzky621p6fvawn5xbdq8a3";
+  "build/shared/WiFi101-Updater-ArduinoIDE-Plugin-0.10.10.zip" = fetchurl {
+    url = "https://github.com/arduino-libraries/WiFi101-FirmwareUpdater-Plugin/releases/download/v0.10.10/WiFi101-Updater-ArduinoIDE-Plugin-0.10.10.zip";
+    sha256 = "0bs5qdglsfc2q5c48m6wdjpzhz4ya4askh1g8364dp6p7jmg6w0d";
+  };
+  "build/avr-1.8.2.tar.bz2" = fetchurl {
+    url = "https://downloads.arduino.cc/cores/avr-1.8.2.tar.bz2";
+    sha256 = "06zl8fwphknd0qdx87fcr1003gid1yqsazaj674mm9widqfd84v2";
   };
 }
+
 // optionalAttrs (system == "x86_64-linux") {
-  "build/arduino-builder-linux64-1.4.4.tar.bz2" = fetchurl {
-    url = "https://downloads.arduino.cc/tools/arduino-builder-linux64-1.4.4.tar.bz2";
-    sha256 = "1m5b4rc9i235ra6isqdpjj9llddb5sldkhidb8c4i14mcqbdci1n";
-  };
-  "build/linux/avr-gcc-5.4.0-atmel3.6.1-arduino2-x86_64-pc-linux-gnu.tar.bz2" = fetchurl {
-    url = "https://downloads.arduino.cc/tools/avr-gcc-5.4.0-atmel3.6.1-arduino2-x86_64-pc-linux-gnu.tar.bz2";
-    sha256 = "11ciwv9sw900wxb2fwm4i4ml4a85ylng0f595v0mf0xifc6jnhh5";
+  "build/arduino-builder-linux64-1.5.2.tar.bz2" = fetchurl {
+    url = "https://downloads.arduino.cc/tools/arduino-builder-linux64-1.5.2.tar.bz2";
+    sha256 = "0wypr9a2cbv9r0ignsr13raw09i3vfc5zvkjxp2xwb7mv35y77z3";
   };
-  "build/linux/avrdude-6.3.0-arduino14-x86_64-pc-linux-gnu.tar.bz2" = fetchurl {
-    url = "https://downloads.arduino.cc/tools/avrdude-6.3.0-arduino14-x86_64-pc-linux-gnu.tar.bz2";
-    sha256 = "1z4b6pvn1823h8mg0iph88igmcnrk2y7skr3z44dqlwk0pryi1kr";
+  "build/linux/avr-gcc-7.3.0-atmel3.6.1-arduino5-x86_64-pc-linux-gnu.tar.bz2" = fetchurl {
+    url = "https://downloads.arduino.cc/tools/avr-gcc-7.3.0-atmel3.6.1-arduino5-x86_64-pc-linux-gnu.tar.bz2";
+    sha256 = "1yq6a811dabrkcgzfi3jsys41r19qsna46kglkjbcy0rza7yvzry";
   };
-  "build/linux/arduinoOTA-1.2.1-linux_amd64.tar.bz2" = fetchurl {
-    url = "https://downloads.arduino.cc/tools/arduinoOTA-1.2.1-linux_amd64.tar.bz2";
-    sha256 = "1ya834p2cqjj8k1ad3yxcnzd4bcgrlqsqsli9brq1138ac6k30jv";
+  "build/linux/avrdude-6.3.0-arduino17-x86_64-pc-linux-gnu.tar.bz2" = fetchurl {
+    url = "https://downloads.arduino.cc/tools/avrdude-6.3.0-arduino17-x86_64-pc-linux-gnu.tar.bz2";
+    sha256 = "0gfic26af9vlcpkw8v914psn05vmq1rsrlk1fi7vzapj1a9gpkdc";
   };
-  "build/avr-1.6.23.tar.bz2" = fetchurl {
-    url = "https://downloads.arduino.cc/cores/avr-1.6.23.tar.bz2";
-    sha256 = "1al449r8hcdck7f4y295g7q388qvbn6qhk2zqdvws9kg4mzqsq8q";
+  "build/linux/arduinoOTA-1.3.0-linux_amd64.tar.bz2" = fetchurl {
+    url = "https://downloads.arduino.cc/tools/arduinoOTA-1.3.0-linux_amd64.tar.bz2";
+    sha256 = "1ylz4pfa9np0nn0w9igmmm3sr8hz3na04n7cv8ia3hzz84jfwida";
   };
 }
+
 // optionalAttrs (system == "i686-linux") {
-  "build/arduino-builder-linux32-1.4.4.tar.bz2" = fetchurl {
-    url = "https://downloads.arduino.cc/tools/arduino-builder-linux32-1.4.4.tar.bz2";
-    sha256 = "0q3i1ba7vh14616d9ligizcz89yadr0skazxbrcq3mvvjqzbifw8";
+  "build/arduino-builder-linux32-1.5.2.tar.bz2" = fetchurl {
+    url = "https://downloads.arduino.cc/tools/arduino-builder-linux32-1.5.2.tar.bz2";
+    sha256 = "1slzw8fzxkqsp2izjisjd1rxxbqkrq6n72jc4frk5z2gdm6zfa0l";
   };
-  "build/linux/avr-gcc-5.4.0-atmel3.6.1-arduino2-i686-pc-linux-gnu.tar.bz2" = fetchurl {
-    url = "https://downloads.arduino.cc/tools/avr-gcc-5.4.0-atmel3.6.1-arduino2-i686-pc-linux-gnu.tar.bz2";
-    sha256 = "13skspybzq80ndsi93s7v15900lf26n5243mbib77andyc27xy2i";
+  "build/linux/avr-gcc-7.3.0-atmel3.6.1-arduino5-i686-pc-linux-gnu.tar.bz2" = fetchurl {
+    url = "https://downloads.arduino.cc/tools/avr-gcc-7.3.0-atmel3.6.1-arduino5-i686-pc-linux-gnu.tar.bz2";
+    sha256 = "078f3rbpdrghk63mbaq73bd5p6znimp14b1wdf6nh2gdswwjgw9g";
   };
-  "build/linux/avrdude-6.3.0-arduino14-i686-pc-linux-gnu.tar.bz2" = fetchurl {
-    url = "https://downloads.arduino.cc/tools/avrdude-6.3.0-arduino14-i686-pc-linux-gnu.tar.bz2";
-    sha256 = "1jklpk1sgrmbh1r25ynps4qcs5dbg6hd54fzjx4hcdf68cw0w42g";
+  "build/linux/avrdude-6.3.0-arduino17-i686-pc-linux-gnu.tar.bz2" = fetchurl {
+    url = "https://downloads.arduino.cc/tools/avrdude-6.3.0-arduino17-i686-pc-linux-gnu.tar.bz2";
+    sha256 = "0py0jvpim0frmv0dnvzfj122ni5hg1qwshgya4a0wc5rgp0wd32w";
   };
-  "build/linux/arduinoOTA-1.2.1-linux_386.tar.bz2" = fetchurl {
-    url = "https://downloads.arduino.cc/tools/arduinoOTA-1.2.1-linux_386.tar.bz2";
-    sha256 = "1m56ps58h0fs8rr4ifc45slmrdvalc63vhldy85isv28g15zdz9g";
+  "build/linux/arduinoOTA-1.3.0-linux_386.tar.bz2" = fetchurl {
+    url = "https://downloads.arduino.cc/tools/arduinoOTA-1.3.0-linux_386.tar.bz2";
+    sha256 = "1cl79019ldsq0sc3fd4pm0vx2kqcklld7w03hdcj99y7zgb5jzry";
   };
 }
+
 // optionalAttrs (system == "x86_64-darwin") {
-  "build/arduino-builder-macosx-1.4.4.tar.bz2" = fetchurl {
-    url = "https://downloads.arduino.cc/tools/arduino-builder-macosx-1.4.4.tar.bz2";
-    sha256 = "1jp5kg32aiw062kcxlv660w38iaprifm8h3g2798izpwyfj0dmwg";
+  "build/arduino-builder-macosx-1.5.2-signed.tar.bz2" = fetchurl {
+    url = "https://downloads.arduino.cc/tools/arduino-builder-macosx-1.5.2-signed.tar.bz2";
+    sha256 = "1pa795vwly1z9h1bp5qzbx2c2pq4n6p7ab5ivhmd3q89z0ywyqgz";
+  };
+  "build/macosx/avr-gcc-7.3.0-atmel3.6.1-arduino5-x86_64-apple-darwin14-signed.tar.bz2" = fetchurl {
+    url = "https://downloads.arduino.cc/tools/avr-gcc-7.3.0-atmel3.6.1-arduino5-x86_64-apple-darwin14-signed.tar.bz2";
+    sha256 = "0lcnp525glnc2chcynnz2nllm4q6ar4n9nrjqd1jbj4m706zbv67";
+  };
+  "build/macosx/avrdude-6.3.0-arduino17-x86_64-apple-darwin12-signed.tar.bz2" = fetchurl {
+    url = "https://downloads.arduino.cc/tools/avrdude-6.3.0-arduino17-x86_64-apple-darwin12-signed.tar.bz2";
+    sha256 = "1m24dci8mjf70yrf033mp1834pbp870m8sns2jxs3iy2i4qviiki";
+  };
+  "build/linux/arduinoOTA-1.3.0-darwin_amd64-signed.tar.bz2" = fetchurl {
+    url = "https://downloads.arduino.cc/tools/arduinoOTA-1.3.0-darwin_amd64-signed.tar.bz2";
+    sha256 = "12pwfnikq3z3ji5wgjhzx1mfyaha5cym7mr63r8kfl5a85fhk8nz";
+  };
+  "build/macosx/appbundler/appbundler-1.0ea-arduino5.jar.zip" = fetchurl {
+    url = "https://downloads.arduino.cc/appbundler-1.0ea-arduino5.jar.zip";
+    sha256 = "1ims951z7ajprqms7yd8ll83c79n7krhd9ljw30yn61f6jk46x82";
+  };
+}
+
+// optionalAttrs (system == "aarch64-linux") {
+  "build/arduino-builder-linuxaarch64-1.5.2.tar.bz2" = fetchurl {
+    url = "https://downloads.arduino.cc/tools/arduino-builder-linuxaarch64-1.5.2.tar.bz2";
+    sha256 = "14k7h7anjizbs2h04phw784slpfbi6hch9skvhy5ll805dmr24ci";
   };
-  "build/macosx/avr-gcc-5.4.0-atmel3.6.1-arduino2-i386-apple-darwin11.tar.bz2" = fetchurl {
-    url = "https://downloads.arduino.cc/tools/avr-gcc-5.4.0-atmel3.6.1-arduino2-i386-apple-darwin11.tar.bz2";
-    sha256 = "1y2972b08ac59xwjqkyjmi5lf2pmzw88a6sdgci3x9rvahvh3idb";
+  "build/linux/avr-gcc-7.3.0-atmel3.6.1-arduino5-aarch64-pc-linux-gnu.tar.bz2" = fetchurl {
+    url = "https://downloads.arduino.cc/tools/avr-gcc-7.3.0-atmel3.6.1-arduino5-aarch64-pc-linux-gnu.tar.bz2";
+    sha256 = "040cspc41iv59fb2g9fzc6w5523dvqa1bavxni7s8w731ccp176x";
   };
-  "build/macosx/avrdude-6.3.0-arduino14-i386-apple-darwin11.tar.bz2" = fetchurl {
-    url = "https://downloads.arduino.cc/tools/avrdude-6.3.0-arduino14-i386-apple-darwin11.tar.bz2";
-    sha256 = "0qsa3sb3f480fm2z75fq14cqddw5hq8w8q0c2a9cw8i7aa8kkl27";
+  "build/linux/avrdude-6.3.0-arduino17-aarch64-pc-linux-gnu.tar.bz2" = fetchurl {
+    url = "https://downloads.arduino.cc/tools/avrdude-6.3.0-arduino17-aarch64-pc-linux-gnu.tar.bz2";
+    sha256 = "1z59dx2j2j4675awjzag9fswhvkn3hlz4ds5d2b7pzmca7vliybc";
   };
-  "build/macosx/appbundler/appbundler-1.0ea-arduino4.jar.zip" = fetchurl {
-    url = "https://downloads.arduino.cc/appbundler-1.0ea-arduino4.jar.zip";
-    sha256 = "1vz0g98ancfqdf7yx5m3zrxmzb3fwp18zh5lkh2nyl5xlr9m368z";
+  "build/linux/arduinoOTA-1.3.0-linux_aarch64.tar.bz2" = fetchurl {
+    url = "https://downloads.arduino.cc/tools/arduinoOTA-1.3.0-linux_aarch64.tar.bz2";
+    sha256 = "04s1is2w8xhvc7lg0lmyk0yjsnar2l2gdc6ig7lkgb7zgkrxhpl3";
   };
 }
-// optionalAttrs (system == "armv6l-linux") {
-  "build/arduino-builder-linuxarm-1.4.4.tar.bz2" = fetchurl {
-    url = "https://downloads.arduino.cc/tools/arduino-builder-linuxarm-1.4.4.tar.bz2";
-    sha256 = "03bhlhdkg1jx0d3lh9194xgaqsbank9njhlnwy8braa7pw4p58gn";
-  };
-  "build/linux/avr-gcc-5.4.0-atmel3.6.1-arduino2-armhf-pc-linux-gnu.tar.bz2" = fetchurl {
-    url = "https://downloads.arduino.cc/tools/avr-gcc-5.4.0-atmel3.6.1-arduino2-armhf-pc-linux-gnu.tar.bz2";
-    sha256 = "17z9li387mx2acgad733h7l1jnnwv09ynw4nrwlqfahqqdfgjhb7";
-  };
-  "build/linux/avrdude-6.3.0-arduino14-armhf-pc-linux-gnu.tar.bz2" = fetchurl {
-    url = "https://downloads.arduino.cc/tools/avrdude-6.3.0-arduino14-armhf-pc-linux-gnu.tar.bz2";
-    sha256 = "12amp8hqcj6gcdga7hfs22asgmgzafy8ny0rqhqs8n8d95sn586i";
-  };
-  "build/linux/arduinoOTA-1.2.1-linux_arm.tar.bz2" = fetchurl {
-    url = "https://downloads.arduino.cc/tools/arduinoOTA-1.2.1-linux_arm.tar.bz2";
-    sha256 = "1q79w1d0h2lp3jcg58qrlh3k5lak7dbsnawrzm0jj8c6spfb6m5d";
+
+// optionalAttrs (builtins.match "armv[67]l-linux" system != null) {
+  "build/arduino-builder-linuxarm-1.5.2.tar.bz2" = fetchurl {
+    url = "https://downloads.arduino.cc/tools/arduino-builder-linuxarm-1.5.2.tar.bz2";
+    sha256 = "1vs2s5px07jb2sdv83qxkf9lxmsy8j4dm7bn3vpw5dcjqd3qdyww";
+  };
+  "build/linux/avr-gcc-7.3.0-atmel3.6.1-arduino5-arm-linux-gnueabihf.tar.bz2" = fetchurl {
+    url = "https://downloads.arduino.cc/tools/avr-gcc-7.3.0-atmel3.6.1-arduino5-arm-linux-gnueabihf.tar.bz2";
+    sha256 = "0fcn0s0fdgbz3yma2gjv16s1idrzn6nhmypdw8awg0kb3i9xbb7l";
+  };
+  "build/linux/avrdude-6.3.0-arduino17-armhf-pc-linux-gnu.tar.bz2" = fetchurl {
+    url = "https://downloads.arduino.cc/tools/avrdude-6.3.0-arduino17-armhf-pc-linux-gnu.tar.bz2";
+    sha256 = "1lah9wvwvliajrrf5jw5blkjhk1sxivz26gj5s86zah3v32ni3ia";
+  };
+  "build/linux/arduinoOTA-1.3.0-linux_arm.tar.bz2" = fetchurl {
+    url = "https://downloads.arduino.cc/tools/arduinoOTA-1.3.0-linux_arm.tar.bz2";
+    sha256 = "0mm6spjlg0lhkfx5c9q27b6agjywnc1nf3mbl15yysmm15s5i20q";
   };
 }
diff --git a/pkgs/development/compilers/abcl/default.nix b/pkgs/development/compilers/abcl/default.nix
index 005e4186b152..543ba6036e4a 100644
--- a/pkgs/development/compilers/abcl/default.nix
+++ b/pkgs/development/compilers/abcl/default.nix
@@ -1,11 +1,11 @@
 {stdenv, fetchurl, ant, jre, jdk}:
 stdenv.mkDerivation rec {
   pname = "abcl";
-  version = "1.6.1";
+  version = "1.7.0";
   # or fetchFromGitHub(owner,repo,rev) or fetchgit(rev)
   src = fetchurl {
     url = "https://common-lisp.net/project/armedbear/releases/${version}/${pname}-src-${version}.tar.gz";
-    sha256 = "04myiba6g0vij2ym2dmb0156k20ki2lz13dxwp2bk9kvjn2zg88b";
+    sha256 = "0pbn5s22zygk6k0rzjc9g76220628lj1b3057gr0n4grl11p4lx5";
   };
   configurePhase = ''
     mkdir nix-tools
diff --git a/pkgs/development/compilers/go-jsonnet/default.nix b/pkgs/development/compilers/go-jsonnet/default.nix
index 6c00d5ee6ce5..d85cf1adfe78 100644
--- a/pkgs/development/compilers/go-jsonnet/default.nix
+++ b/pkgs/development/compilers/go-jsonnet/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "go-jsonnet";
-  version = "0.15.0";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "go-jsonnet";
     rev = "v${version}";
-    sha256 = "0l6cwky2xl7m8nnc9abp76bhkdcf2ldbbv3r8p30xv2yr5wd1j8i";
+    sha256 = "17606gc75wnkm64am4hmlv7m3fy2hi8rnzadp6nrgpcd6rl26m83";
   };
 
-  vendorSha256 = "1vdv0nq31mjprxzxf8x0diaigissy07vnm338h8jrk5i74x5by39";
+  vendorSha256 = "0nsm4gsbbn8myz4yfi6m7qc3iizhdambsr18iks0clkdn3mi2jn1";
 
   subPackages = [ "cmd/jsonnet" ];
 
diff --git a/pkgs/development/compilers/julia/1.3.nix b/pkgs/development/compilers/julia/1.3.nix
index b67a78b4a5ab..15694734d487 100644
--- a/pkgs/development/compilers/julia/1.3.nix
+++ b/pkgs/development/compilers/julia/1.3.nix
@@ -114,7 +114,7 @@ stdenv.mkDerivation rec {
 
   LD_LIBRARY_PATH = makeLibraryPath [
     arpack fftw fftwSinglePrec gmp libgit2 mpfr blas openlibm
-    openspecfun pcre2
+    openspecfun pcre2 lapack
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/compilers/yosys/default.nix b/pkgs/development/compilers/yosys/default.nix
index 3a54d42498ce..332824185616 100644
--- a/pkgs/development/compilers/yosys/default.nix
+++ b/pkgs/development/compilers/yosys/default.nix
@@ -1,5 +1,6 @@
 { stdenv
 , abc-verifier
+, bash
 , bison
 , fetchFromGitHub
 , flex
@@ -15,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname   = "yosys";
-  version = "2020.03.24";
+  version = "2020.06.11";
 
   src = fetchFromGitHub {
     owner  = "YosysHQ";
     repo   = "yosys";
-    rev    = "c9555c9adeba886a308c60615ac794ec20d9276e";
-    sha256 = "1fh118fv06jyfmkx6zy0w2k0rjj22m0ffyll3k5giaw8zzaf0j3a";
+    rev    = "a1785e988b2b51dac32985dd6b0afdcedc6bda1d";
+    sha256 = "0987f5vm2zb0i02c3vlw21gihky2cfj5l9b78ddzhxfiv0qfkdfp";
   };
 
   enableParallelBuilding = true;
@@ -38,6 +39,8 @@ stdenv.mkDerivation rec {
       --replace 'LD = gcc' 'LD = $(CXX)' \
       --replace 'ABCMKARGS = CC="$(CXX)" CXX="$(CXX)"' 'ABCMKARGS =' \
       --replace 'echo UNKNOWN' 'echo ${builtins.substring 0 10 src.rev}'
+    substituteInPlace ./misc/yosys-config.in \
+      --replace '/bin/bash' '${bash}/bin/bash'
     patchShebangs tests
   '';
 
diff --git a/pkgs/development/libraries/SDL2_mixer/default.nix b/pkgs/development/libraries/SDL2_mixer/default.nix
index 4fa9df617a6a..c90c0fd08a83 100644
--- a/pkgs/development/libraries/SDL2_mixer/default.nix
+++ b/pkgs/development/libraries/SDL2_mixer/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, autoreconfHook, pkgconfig, which
-, SDL2, libogg, libvorbis, smpeg2, flac, libmodplug, opusfile
+, SDL2, libogg, libvorbis, smpeg2, flac, libmodplug, opusfile, mpg123
 , CoreServices, AudioUnit, AudioToolbox
 , enableNativeMidi ? false, fluidsynth ? null }:
 
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = stdenv.lib.optionals stdenv.isDarwin [ CoreServices AudioUnit AudioToolbox ];
 
-  propagatedBuildInputs = [ SDL2 libogg libvorbis fluidsynth smpeg2 flac libmodplug opusfile ];
+  propagatedBuildInputs = [ SDL2 libogg libvorbis fluidsynth smpeg2 flac libmodplug opusfile mpg123 ];
 
   configureFlags = [ "--disable-music-ogg-shared" ]
     ++ lib.optional enableNativeMidi "--enable-music-native-midi-gpl"
diff --git a/pkgs/development/libraries/gdcm/default.nix b/pkgs/development/libraries/gdcm/default.nix
index 968ee3a09d08..745c96f57943 100644
--- a/pkgs/development/libraries/gdcm/default.nix
+++ b/pkgs/development/libraries/gdcm/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, cmake, vtk_7, darwin }:
 
 stdenv.mkDerivation rec {
-  version = "3.0.5";
+  version = "3.0.6";
   pname = "gdcm";
 
   src = fetchurl {
     url = "mirror://sourceforge/gdcm/${pname}-${version}.tar.bz2";
-    sha256 = "16d3sf81n4qhwbbx1d80jg6fhrla5paan384c4bbbqvbhm222yby";
+    sha256 = "048ycvhk143cvsf09r7vwmp4sm9ah9bh5pbbrl366m5a4sp7fr89";
   };
 
   dontUseCmakeBuildDir = true;
diff --git a/pkgs/development/libraries/gdk-pixbuf/xlib.nix b/pkgs/development/libraries/gdk-pixbuf/xlib.nix
index e5f1718f0751..53414d921288 100644
--- a/pkgs/development/libraries/gdk-pixbuf/xlib.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/xlib.nix
@@ -20,8 +20,8 @@ stdenv.mkDerivation rec {
     domain = "gitlab.gnome.org";
     owner = "Archive";
     repo = "gdk-pixbuf-xlib";
-    rev = "dc22ea36f69755007c66877284596df270532cc1";
-    sha256 = "XhBQ4wano+MtGaqF6JNKoWgYQN6eBW+b8ZCGEBGt8IM=";
+    rev = "19482794a621d542b223219940e836257d4ae2c9";
+    sha256 = "7Qv6tyjR0/iFXYHx5jPhvLLLt0Ms2nzpyWw02oXTkZc=";
   };
 
   nativeBuildInputs = [
@@ -33,12 +33,9 @@ stdenv.mkDerivation rec {
     gtk-doc
   ];
 
-  buildInputs = [
-    libX11
-  ];
-
   propagatedBuildInputs = [
     gdk-pixbuf
+    libX11
   ];
 
   mesonFlags = [
diff --git a/pkgs/development/libraries/gjs/default.nix b/pkgs/development/libraries/gjs/default.nix
index ee29c6a97a45..357bf076459a 100644
--- a/pkgs/development/libraries/gjs/default.nix
+++ b/pkgs/development/libraries/gjs/default.nix
@@ -17,6 +17,7 @@
 , dbus
 , gdk-pixbuf
 , makeWrapper
+, which
 , xvfb_run
 , nixosTests
 }:
@@ -28,11 +29,11 @@ let
   ];
 in stdenv.mkDerivation rec {
   pname = "gjs";
-  version = "1.64.2";
+  version = "1.64.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gjs/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0ywrsfmkxaw11z83dnmb9yqkn6k3c1mkxw2mv6arbwad6x6q7zqm";
+    sha256 = "1rl524rmdbpmp5xdkm8dx3znq47l7dgvh192x80zjf8wc1af35lx";
   };
 
   outputs = [ "out" "dev" "installedTests" ];
@@ -42,6 +43,7 @@ in stdenv.mkDerivation rec {
     ninja
     pkgconfig
     makeWrapper
+    which # for locale detection
     libxml2 # for xml-stripblanks
   ];
 
@@ -74,11 +76,10 @@ in stdenv.mkDerivation rec {
     ./installed-tests-path.patch
   ];
 
-  # Gio test is failing
-  # https://github.com/NixOS/nixpkgs/pull/81626#issuecomment-599325843
-  doCheck = false;
+  doCheck = true;
 
   postPatch = ''
+    patchShebangs build/choose-tests-locale.sh
     substituteInPlace installed-tests/debugger-test.sh --subst-var-by gjsConsole $out/bin/gjs-console
   '';
 
@@ -95,7 +96,15 @@ in stdenv.mkDerivation rec {
   '';
 
   postInstall = ''
+    # TODO: make the glib setup hook handle this
+    installedTestsSchemaDatadir="$installedTests/share/gsettings-schemas/${pname}-${version}"
+    mkdir -p "$installedTestsSchemaDatadir"
+    mv "$installedTests/share/glib-2.0" "$installedTestsSchemaDatadir"
+  '';
+
+  postFixup = ''
     wrapProgram "$installedTests/libexec/gjs/installed-tests/minijasmine" \
+      --prefix XDG_DATA_DIRS : "$installedTestsSchemaDatadir" \
       --prefix GI_TYPELIB_PATH : "${stdenv.lib.makeSearchPath "lib/girepository-1.0" testDeps}"
   '';
 
diff --git a/pkgs/development/libraries/gjs/installed-tests-path.patch b/pkgs/development/libraries/gjs/installed-tests-path.patch
index 11a39b2dd9a5..f9b1515b68e3 100644
--- a/pkgs/development/libraries/gjs/installed-tests-path.patch
+++ b/pkgs/development/libraries/gjs/installed-tests-path.patch
@@ -1,5 +1,5 @@
 diff --git a/installed-tests/meson.build b/installed-tests/meson.build
-index 294d20c6..1e5029e0 100644
+index 7e842025..1e5029e0 100644
 --- a/installed-tests/meson.build
 +++ b/installed-tests/meson.build
 @@ -1,7 +1,7 @@
@@ -12,6 +12,19 @@ index 294d20c6..1e5029e0 100644
  
  # Simple shell script tests #
  
+diff --git a/meson.build b/meson.build
+index 084d5396..e5d73fcd 100644
+--- a/meson.build
++++ b/meson.build
+@@ -540,7 +540,7 @@ install_data('installed-tests/extra/lsan.supp',
+     install_dir: get_option('datadir') / api_name / 'lsan')
+ 
+ if get_option('installed_tests')
+-    schemadir = abs_datadir / 'glib-2.0' / 'schemas'
++    schemadir = get_option('installed_test_prefix') / 'share' / 'glib-2.0' / 'schemas'
+     install_data('installed-tests/js/org.gnome.GjsTest.gschema.xml', install_dir: schemadir)
+     meson.add_install_script('build/compile-gschemas.py', schemadir)
+ endif
 diff --git a/meson_options.txt b/meson_options.txt
 index 66f66024..008687cb 100644
 --- a/meson_options.txt
diff --git a/pkgs/development/libraries/libmilter/darwin.patch b/pkgs/development/libraries/libmilter/darwin.patch
new file mode 100644
index 000000000000..be46662d6b38
--- /dev/null
+++ b/pkgs/development/libraries/libmilter/darwin.patch
@@ -0,0 +1,28 @@
+Fix build issues on Darwin.
+
+--- a/devtools/OS/Darwin	2014-03-05 01:59:45.000000000 +0100
++++ b/devtools/OS/Darwin	2020-05-18 14:47:57.000000000 +0200
+@@ -8,6 +8,8 @@
+ #    We look a lot more like 4.4BSD than NeXTStep or OpenStep.
+ #
+ define(`confCC', `cc -traditional-cpp -pipe ${Extra_CC_Flags}')
++define(`confCCOPTS_SO', `-fPIC')
++define(`confSOEXT', `dylib')
+ define(`confMAPDEF', `-DNEWDB -DNIS -DMAP_REGEX -DNETINFO -DAUTO_NETINFO_ALIASES -DAUTO_NETINFO_HOSTS')
+ define(`confENVDEF', `-DDARWIN')
+ define(`confLDOPTS', `${Extra_LD_Flags}')
+--- a/sendmail/sendmail.h	2020-05-18 14:51:17.000000000 +0200
++++ b/sendmail/sendmail.h	2020-05-18 14:51:00.000000000 +0200
+@@ -104,7 +104,11 @@
+ # endif /* NETX25 */
+ 
+ # if NAMED_BIND
+-#  include <arpa/nameser.h>
++#  ifdef __APPLE__
++#   include <arpa/nameser_compat.h>
++#  else
++#   include <arpa/nameser.h>
++#  endif
+ #  ifdef NOERROR
+ #   undef NOERROR		/* avoid <sys/streams.h> conflict */
+ #  endif /* NOERROR */
diff --git a/pkgs/development/libraries/libmilter/default.nix b/pkgs/development/libraries/libmilter/default.nix
index 8d677d858de8..f937d818a559 100644
--- a/pkgs/development/libraries/libmilter/default.nix
+++ b/pkgs/development/libraries/libmilter/default.nix
@@ -28,10 +28,11 @@ stdenv.mkDerivation rec {
       define(\`confLIBGRP', \`root')
       APPENDDEF(\`confENVDEF', \`-DNETINET6')
     EOF
+    export MILTER_SOVER=1
     sh Build -f ./a.m4
   '';
 
-  patches = [ ./install.patch ./sharedlib.patch ./glibc-2.30.patch ];
+  patches = [ ./install.patch ./sharedlib.patch ./glibc-2.30.patch ./darwin.patch ];
 
   nativeBuildInputs = [ m4 ];
 
diff --git a/pkgs/development/libraries/libmilter/sharedlib.patch b/pkgs/development/libraries/libmilter/sharedlib.patch
index bbc69a516ffd..1e256c59ec3e 100644
--- a/pkgs/development/libraries/libmilter/sharedlib.patch
+++ b/pkgs/development/libraries/libmilter/sharedlib.patch
@@ -16,28 +16,29 @@ diff -Nru sendmail-8.14.3.orig/devtools/M4/UNIX/milterlibrary.m4 sendmail-8.14.3
 +#
 +divert(0)dnl
 +include(confBUILDTOOLSDIR`/M4/'bldM4_TYPE_DIR`/links.m4')dnl
++define(`confSOEXT', ifdef(`confSOEXT', `confSOEXT', `so'))dnl
 +bldLIST_PUSH_ITEM(`bldC_PRODUCTS', bldCURRENT_PRODUCT)dnl
-+bldPUSH_TARGET(bldCURRENT_PRODUCT`.so' bldCURRENT_PRODUCT`.a')dnl
++bldPUSH_TARGET(bldCURRENT_PRODUCT`.'confSOEXT bldCURRENT_PRODUCT`.a')dnl
 +bldPUSH_INSTALL_TARGET(`install-'bldCURRENT_PRODUCT)dnl
 +bldPUSH_CLEAN_TARGET(bldCURRENT_PRODUCT`-clean')dnl
 +
 +include(confBUILDTOOLSDIR`/M4/'bldM4_TYPE_DIR`/defines.m4')
 +divert(bldTARGETS_SECTION)
-+bldCURRENT_PRODUCT.so: ${BEFORE} ${bldCURRENT_PRODUCT`OBJS'}
-+	${CCLINK} ${LDOPTS_SO} -o bldCURRENT_PRODUCT.so -Wl,confSONAME,bldCURRENT_PRODUCT.so.${MILTER_SOVER} ${bldCURRENT_PRODUCT`OBJS'} -lc ${LIBS}
++bldCURRENT_PRODUCT`.'confSOEXT: ${BEFORE} ${bldCURRENT_PRODUCT`OBJS'}
++	${CCLINK} ${LDOPTS_SO} -o bldCURRENT_PRODUCT.confSOEXT ifdef(`confSONAME',`-Wl,confSONAME,bldCURRENT_PRODUCT.confSOEXT.${MILTER_SOVER}') ${bldCURRENT_PRODUCT`OBJS'} -lc ${LIBS}
 +bldCURRENT_PRODUCT.a: ${BEFORE} ${bldCURRENT_PRODUCT`OBJS'}
 +	${AR} ${AROPTS} bldCURRENT_PRODUCT.a ${bldCURRENT_PRODUCT`OBJS'}
 +	${RANLIB} ${RANLIBOPTS} bldCURRENT_PRODUCT.a
 +ifdef(`bldLINK_SOURCES', `bldMAKE_SOURCE_LINKS(bldLINK_SOURCES)')
 +
-+install-`'bldCURRENT_PRODUCT: bldCURRENT_PRODUCT.so bldCURRENT_PRODUCT.a
++install-`'bldCURRENT_PRODUCT: bldCURRENT_PRODUCT.confSOEXT bldCURRENT_PRODUCT.a
 +ifdef(`bldINSTALLABLE', `	ifdef(`confMKDIR', `if [ ! -d "${DESTDIR}${bldINSTALL_DIR`'LIBDIR}" ]; then confMKDIR -p "${DESTDIR}${bldINSTALL_DIR`'LIBDIR}"; else :; fi ')
-+	${INSTALL} -c bldCURRENT_PRODUCT.so "${DESTDIR}${LIBDIR}/bldCURRENT_PRODUCT.so.${MILTER_SOVER}"
-+	${LN} ${LNOPTS} bldCURRENT_PRODUCT.so.${MILTER_SOVER} "${DESTDIR}${LIBDIR}/bldCURRENT_PRODUCT.so"
-+	${INSTALL} -c bldCURRENT_PRODUCT.a "${DESTDIR}${LIBDIR}"')
++	${INSTALL} -c bldCURRENT_PRODUCT.confSOEXT "${DESTDIR}${LIBDIR}/bldCURRENT_PRODUCT.confSOEXT.${MILTER_SOVER}"
++	${LN} ${LNOPTS} bldCURRENT_PRODUCT.confSOEXT.${MILTER_SOVER} "${DESTDIR}${LIBDIR}/bldCURRENT_PRODUCT.confSOEXT"
++	${INSTALL} -c -m 644 bldCURRENT_PRODUCT.a "${DESTDIR}${LIBDIR}"')
 +
 +bldCURRENT_PRODUCT-clean:
-+	rm -f ${OBJS} bldCURRENT_PRODUCT.so bldCURRENT_PRODUCT.a ${MANPAGES}
++	rm -f ${OBJS} bldCURRENT_PRODUCT.confSOEXT bldCURRENT_PRODUCT.a ${MANPAGES}
 +
 +divert(0)
 +COPTS+= confCCOPTS_SO
diff --git a/pkgs/development/libraries/libosinfo/default.nix b/pkgs/development/libraries/libosinfo/default.nix
index 39a3bf6b2c55..6e7512535949 100644
--- a/pkgs/development/libraries/libosinfo/default.nix
+++ b/pkgs/development/libraries/libosinfo/default.nix
@@ -23,11 +23,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libosinfo";
-  version = "1.7.1";
+  version = "1.8.0";
 
   src = fetchurl {
     url = "https://releases.pagure.org/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1s97sv24bybggjx6hgqba2qdqz3ivfpd4cmkh4zm5y59sim109mv";
+    sha256 = "1988l5rykpzvml1l7bi2hcax0gdc811vja0f92cnr7r01nz35zs9";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index d083a256cd11..4ec5518008a1 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -66,6 +66,7 @@ in stdenv.mkDerivation rec {
     "USE_SYSTEM_ZLIB=1"
     "NSS_USE_SYSTEM_SQLITE=1"
     "NATIVE_CC=${buildPackages.stdenv.cc}/bin/cc"
+  ] ++ stdenv.lib.optionals (!stdenv.isDarwin) [
     # Pass in CPU even if we're not cross compiling, because otherwise it tries to guess with
     # uname, which can be wrong if e.g. we're compiling for aarch32 on aarch64
     "OS_TEST=${cpu}"
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index 0b8759053eec..8fd83c59e56d 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -1,5 +1,6 @@
 { stdenv
 , fetchFromGitLab
+, fetchpatch
 , meson
 , ninja
 , pkgconfig
@@ -44,6 +45,13 @@ stdenv.mkDerivation rec {
     sha256 = "0g149vyaigf4gzm764fcgxxci9niw19z0af9afs4diwq5xzr1qd3";
   };
 
+  patches = [ (fetchpatch {
+    # Brought by https://gitlab.freedesktop.org/pipewire/pipewire/-/merge_requests/263,
+    # should be part of > 0.3.6
+    url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/d1162f28efd502fcb973e172867970f5cc8d7a6b.patch";
+    sha256 = "0ng34yin5726cvv0nll1b2xigyq6mj6j516l3xi0ys1i2g2fyby9";
+  })];
+
   nativeBuildInputs = [
     doxygen
     graphviz
diff --git a/pkgs/development/libraries/protozero/default.nix b/pkgs/development/libraries/protozero/default.nix
index 0bbfab62fcd8..1c8e7e99313a 100644
--- a/pkgs/development/libraries/protozero/default.nix
+++ b/pkgs/development/libraries/protozero/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "protozero";
-  version = "1.6.8";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "mapbox";
     repo = "protozero";
     rev = "v${version}";
-    sha256 = "1hfijpfylf1c71wa3mk70gjc88b6k1q7cxb87cwqdflw5q2x8ma6";
+    sha256 = "0fdihfl5j68wayjjxvpvhvnjq1anzcfnfl09f68wpzbkg3zmhblz";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/qtutilities/default.nix b/pkgs/development/libraries/qtutilities/default.nix
index 66a7b95e334f..388665f5aabd 100644
--- a/pkgs/development/libraries/qtutilities/default.nix
+++ b/pkgs/development/libraries/qtutilities/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qtutilities";
-  version = "6.0.5";
+  version = "6.0.6";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1f2nir1qb0d6r1ndpsg7vpskdw08szq82mqvbwm5bi160xkrqhjf";
+    sha256 = "0g3f18530w5f8dlzrh45k868hspga5p3m8qpz7pcg3nsdjda8cwz";
   };
 
   buildInputs = [ qtbase cpp-utilities ];
diff --git a/pkgs/development/node-packages/node-packages.json b/pkgs/development/node-packages/node-packages.json
index 76b24cf1f23d..5beb8dc7c6a1 100644
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@@ -66,6 +66,7 @@
 , "elm-oracle"
 , "emoj"
 , "emojione"
+, "escape-string-regexp"
 , "eslint"
 , "eslint_d"
 , {"fast-cli": "1.x"}
@@ -80,6 +81,7 @@
 , "gtop"
 , "gulp"
 , "gulp-cli"
+, "he"
 , "html-minifier"
 , "htmlhint"
 , "http-server"
diff --git a/pkgs/development/node-packages/node-packages.nix b/pkgs/development/node-packages/node-packages.nix
index 57913cc581b9..69045fa7d615 100644
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@@ -2623,13 +2623,13 @@ let
         sha512 = "O75k56TYvJ8WpAakWwYRN8Bgu60KrmX0z1KqFp1kNiFNkgW+JW+9EBKZ+S33PU6SLvbihqd+3drvPxKK68Ee8Q==";
       };
     };
-    "@octokit/types-4.1.9" = {
+    "@octokit/types-4.1.10" = {
       name = "_at_octokit_slash_types";
       packageName = "@octokit/types";
-      version = "4.1.9";
+      version = "4.1.10";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@octokit/types/-/types-4.1.9.tgz";
-        sha512 = "hinM/BA2c1vebN2HSR3JtVdYtrSbmvn/doUBZXXuQuh/9o60hYwitQQAGTpJu+k6pjtjURskDHQxUFvqLvYCeA==";
+        url = "https://registry.npmjs.org/@octokit/types/-/types-4.1.10.tgz";
+        sha512 = "/wbFy1cUIE5eICcg0wTKGXMlKSbaAxEr00qaBXzscLXpqhcwgXeS6P8O0pkysBhRfyjkKjJaYrvR1ExMO5eOXQ==";
       };
     };
     "@parcel/fs-1.11.0" = {
@@ -2857,13 +2857,13 @@ let
         sha512 = "lOUyRopNTKJYVEU9T6stp2irwlTDsYMmUKBOUjnMcwGveuUfIJqrCOtFLtIPPj3XJlbZy5F68l4KP9rZ8Ipang==";
       };
     };
-    "@serverless/components-2.30.13" = {
+    "@serverless/components-2.30.14" = {
       name = "_at_serverless_slash_components";
       packageName = "@serverless/components";
-      version = "2.30.13";
+      version = "2.30.14";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@serverless/components/-/components-2.30.13.tgz";
-        sha512 = "0IUJ6O7UywHpNgEFE7Ym06HhxbebTl767v/J4TMwTaftTJP5e4/ezxdJPxtZe75CdWUCCy+aaHP7VUAqqJdYVA==";
+        url = "https://registry.npmjs.org/@serverless/components/-/components-2.30.14.tgz";
+        sha512 = "sWCuALO55BhdJAPJSN4KgifRJUCkr44FE/Bhw6hpz+3vK49mfnjDF6iHdNi6wNx85BRRgXGz1z/015epwqRtnA==";
       };
     };
     "@serverless/core-1.1.2" = {
@@ -3082,13 +3082,13 @@ let
         sha512 = "IUq5bHRL0vtVKtfvd4GOccAIaLYHbcertug2UVZzk5+yY6R/CxfYsnFUTho1h4BdkfNdin2tPjE/5jRF4SKSrw==";
       };
     };
-    "@snyk/java-call-graph-builder-1.8.1" = {
+    "@snyk/java-call-graph-builder-1.10.0" = {
       name = "_at_snyk_slash_java-call-graph-builder";
       packageName = "@snyk/java-call-graph-builder";
-      version = "1.8.1";
+      version = "1.10.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@snyk/java-call-graph-builder/-/java-call-graph-builder-1.8.1.tgz";
-        sha512 = "2G96dChYYXV73G8y9U0fi45dH6ybOjUSRBTJrMnmNkHJoOp1bzz8L4p5rkRypHQqr4SBS1EdCQeRw1eWRLm+Lg==";
+        url = "https://registry.npmjs.org/@snyk/java-call-graph-builder/-/java-call-graph-builder-1.10.0.tgz";
+        sha512 = "x3vKElHJRsPjlMBRACeD6kHtki54ffahYeAm4ny5epVpxm16/OT6f6AjNjPuX8DbxcauaD7wqirtc62OPH3YqA==";
       };
     };
     "@snyk/lodash-4.17.15-patch" = {
@@ -3100,13 +3100,13 @@ let
         sha512 = "e4+t34bGyjjRnwXwI14hqye9J/nRbG9iwaqTgXWHskm5qC+iK0UrjgYdWXiHJCf3Plbpr+1rpW+4LPzZnCGMhQ==";
       };
     };
-    "@snyk/rpm-parser-1.2.0" = {
+    "@snyk/rpm-parser-2.0.0" = {
       name = "_at_snyk_slash_rpm-parser";
       packageName = "@snyk/rpm-parser";
-      version = "1.2.0";
+      version = "2.0.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@snyk/rpm-parser/-/rpm-parser-1.2.0.tgz";
-        sha512 = "9D2Vjg9LAONz9hHNPd/ORYF5Mv1Yw/uhJpJbwI3YRxKjlB3JY2UNLSVl1XWWr03hA1M+3rNAwVeOZNm3IJajgw==";
+        url = "https://registry.npmjs.org/@snyk/rpm-parser/-/rpm-parser-2.0.0.tgz";
+        sha512 = "bWjQY5Xk3TcfVpeo8M5BhhSUEdPr2P19AWW13CHPu6sFZkckLWEcjQycnBsVD6RBmxGXecJ1YNui8dq6soHoYQ==";
       };
     };
     "@snyk/ruby-semver-2.2.0" = {
@@ -3649,13 +3649,13 @@ let
         sha512 = "c3Xy026kOF7QOTn00hbIllV1dLR9hG9NkSrLQgCVs8NF6sBU+VGWjD3wLPhmh1TYAc7ugCFsvHYMN4VcBN1U1A==";
       };
     };
-    "@types/istanbul-lib-coverage-2.0.2" = {
+    "@types/istanbul-lib-coverage-2.0.3" = {
       name = "_at_types_slash_istanbul-lib-coverage";
       packageName = "@types/istanbul-lib-coverage";
-      version = "2.0.2";
+      version = "2.0.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/istanbul-lib-coverage/-/istanbul-lib-coverage-2.0.2.tgz";
-        sha512 = "rsZg7eL+Xcxsxk2XlBt9KcG8nOp9iYdKCOikY9x2RFJCyOdNj4MKPQty0e8oZr29vVAzKXr1BmR+kZauti3o1w==";
+        url = "https://registry.npmjs.org/@types/istanbul-lib-coverage/-/istanbul-lib-coverage-2.0.3.tgz";
+        sha512 = "sz7iLqvVUg1gIedBOvlkxPlc8/uVzyS5OwGz1cKjXzkl3FpL3al0crU8YGU1WoHkxn0Wxbw5tyi6hvzJKNzFsw==";
       };
     };
     "@types/istanbul-lib-report-3.0.0" = {
@@ -3694,13 +3694,13 @@ let
         sha512 = "fYMgzN+9e28R81weVN49inn/u798ruU91En1ZnGvSZzCRc5jXx9B2EDhlRaWmcO1RIxFHL8AajRXzxDuJu93+A==";
       };
     };
-    "@types/json-schema-7.0.4" = {
+    "@types/json-schema-7.0.5" = {
       name = "_at_types_slash_json-schema";
       packageName = "@types/json-schema";
-      version = "7.0.4";
+      version = "7.0.5";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.4.tgz";
-        sha512 = "8+KAKzEvSUdeo+kmqnKrqgeE+LcA0tjYWFY7RPProVYwnqDjukzO+3b6dLD56rYX5TdWejnEOLJYOIeh4CXKuA==";
+        url = "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.5.tgz";
+        sha512 = "7+2BITlgjgDhH0vvwZU/HZJVyk+2XUlvxXe8dFMedNX/aMkaOq++rMAFXc0tM7ij15QaWlbdQASBR9dihi+bDQ==";
       };
     };
     "@types/keygrip-1.0.2" = {
@@ -3793,31 +3793,31 @@ let
         sha512 = "ZvO2tAcjmMi8V/5Z3JsyofMe3hasRcaw88cto5etSVMwVQfeivGAlEYmaQgceUSVYFofVjT+ioHsATjdWcFt1w==";
       };
     };
-    "@types/node-10.17.25" = {
+    "@types/node-10.17.26" = {
       name = "_at_types_slash_node";
       packageName = "@types/node";
-      version = "10.17.25";
+      version = "10.17.26";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/node/-/node-10.17.25.tgz";
-        sha512 = "EWPw3jDB0jip4HafDkoezNOwG00TtVZ1TOe74MaxIBWgpyM60UF/LXzFVx9+8AdSYNNOPgx7TuJoRmgnhHZ/7g==";
+        url = "https://registry.npmjs.org/@types/node/-/node-10.17.26.tgz";
+        sha512 = "myMwkO2Cr82kirHY8uknNRHEVtn0wV3DTQfkrjx17jmkstDRZ24gNUdl8AHXVyVclTYI/bNjgTPTAWvWLqXqkw==";
       };
     };
-    "@types/node-13.13.11" = {
+    "@types/node-13.13.12" = {
       name = "_at_types_slash_node";
       packageName = "@types/node";
-      version = "13.13.11";
+      version = "13.13.12";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/node/-/node-13.13.11.tgz";
-        sha512 = "FX7mIFKfnGCfq10DGWNhfCNxhACEeqH5uulT6wRRA1KEt7zgLe0HdrAd9/QQkObDqp2Z0KEV3OAmNgs0lTx5tQ==";
+        url = "https://registry.npmjs.org/@types/node/-/node-13.13.12.tgz";
+        sha512 = "zWz/8NEPxoXNT9YyF2osqyA9WjssZukYpgI4UYZpOjcyqwIUqWGkcCionaEb9Ki+FULyPyvNFpg/329Kd2/pbw==";
       };
     };
-    "@types/node-14.0.12" = {
+    "@types/node-14.0.13" = {
       name = "_at_types_slash_node";
       packageName = "@types/node";
-      version = "14.0.12";
+      version = "14.0.13";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/node/-/node-14.0.12.tgz";
-        sha512 = "/sjzehvjkkpvLpYtN6/2dv5kg41otMGuHQUt9T2aiAuIfleCQRQHXXzF1eAw/qkZTj5Kcf4JSTf7EIizHocy6Q==";
+        url = "https://registry.npmjs.org/@types/node/-/node-14.0.13.tgz";
+        sha512 = "rouEWBImiRaSJsVA+ITTFM6ZxibuAlTuNOCyxVbwreu6k6+ujs7DfnU9o+PShFhET78pMBl3eH+AGSI5eOTkPA==";
       };
     };
     "@types/node-6.14.10" = {
@@ -7069,13 +7069,13 @@ let
         sha1 = "00f35b2d27ac91b1f0d3ef2084c98cf1d1f0adc3";
       };
     };
-    "aws-sdk-2.692.0" = {
+    "aws-sdk-2.693.0" = {
       name = "aws-sdk";
       packageName = "aws-sdk";
-      version = "2.692.0";
+      version = "2.693.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.692.0.tgz";
-        sha512 = "fQRbZq+urzE4VjciEr6KNY7vbzougcVg7UqbHKGcgBT7EPtSbog9C2i9YY9Yum8PRuP1GAmfvC2Vthlw6dVTGw==";
+        url = "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.693.0.tgz";
+        sha512 = "/0zy5IlE8wHrTXCxPYMSJGaqTKN1ulBBOSuWYeGxHU8pnTT6ZHpDdHlS83DHrVbsXnO/zq9prEf1nXRWlwgARw==";
       };
     };
     "aws-sign2-0.6.0" = {
@@ -9490,13 +9490,13 @@ let
         sha512 = "bsTwuIg/BZZK/vreVTYYbSWoe2F+71P7K5QGEX+pT250DZbfU1MQ5prOKpPR+LL6uWKK3KMwMCAS74QB3Um1uw==";
       };
     };
-    "caniuse-lite-1.0.30001079" = {
+    "caniuse-lite-1.0.30001081" = {
       name = "caniuse-lite";
       packageName = "caniuse-lite";
-      version = "1.0.30001079";
+      version = "1.0.30001081";
       src = fetchurl {
-        url = "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001079.tgz";
-        sha512 = "2KaYheg0iOY+CMmDuAB3DHehrXhhb4OZU4KBVGDr/YKyYAcpudaiUQ9PJ9rxrPlKEoJ3ATasQ5AN48MqpwS43Q==";
+        url = "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001081.tgz";
+        sha512 = "iZdh3lu09jsUtLE6Bp8NAbJskco4Y3UDtkR3GTCJGsbMowBU5IWDFF79sV2ws7lSqTzWyKazxam2thasHymENQ==";
       };
     };
     "capture-exit-2.0.0" = {
@@ -9697,6 +9697,15 @@ let
         sha512 = "N9oWFcegS0sFr9oh1oz2d7Npos6vNoWW9HvtCg5N1KRFpUhaAhvTv5Y58g880fZaEYSNm3qDz8SU1UrGvp+n7A==";
       };
     };
+    "chalk-4.1.0" = {
+      name = "chalk";
+      packageName = "chalk";
+      version = "4.1.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/chalk/-/chalk-4.1.0.tgz";
+        sha512 = "qwx12AxXe2Q5xQ43Ac//I6v5aXTipYrSESdOgzrN+9XjgEpyjpKuvSGaN4qE93f7TQTlerQQ8S+EQ0EyDoVL1A==";
+      };
+    };
     "chance-1.0.18" = {
       name = "chance";
       packageName = "chance";
@@ -15242,13 +15251,13 @@ let
         sha512 = "7vmuyh5+kuUyJKePhQfRQBhXV5Ce+RnaeeQArKu1EAMpL3WbgMt5WG6uQZpEVvYSSsxMXRKOewtDk9RaTKXRlA==";
       };
     };
-    "electron-to-chromium-1.3.465" = {
+    "electron-to-chromium-1.3.466" = {
       name = "electron-to-chromium";
       packageName = "electron-to-chromium";
-      version = "1.3.465";
+      version = "1.3.466";
       src = fetchurl {
-        url = "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.3.465.tgz";
-        sha512 = "K/lUeT3NLAsJ5SHRDhK3/zd0tw7OUllYD8w+fTOXm6ljCPsp2qq+vMzxpLo8u1M27ZjZAjRbsA6rirvne2nAMQ==";
+        url = "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.3.466.tgz";
+        sha512 = "eieqkoM2hCkZZRhETKyCouMziDV3l4XEKHRLuzcHG+HV+P7PeODU/z9HAmBgMQkzvHg2DoyQhfIDmmeguLZT/Q==";
       };
     };
     "elegant-spinner-1.0.1" = {
@@ -16494,6 +16503,15 @@ let
         sha512 = "YVFs6dPpZIgH665kKckDktEVvSBccSYJmoZUfhNUdv5d3Xv+Q+SKF4Xis1jolq9aBzuW1ZZhQh/m/zU/TPdDhw==";
       };
     };
+    "event-loop-spinner-2.0.0" = {
+      name = "event-loop-spinner";
+      packageName = "event-loop-spinner";
+      version = "2.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/event-loop-spinner/-/event-loop-spinner-2.0.0.tgz";
+        sha512 = "1y4j/Mhttr8ordvHkbDsGzGrlQaSYJoXD/3YKUxiOXIk7myEn9UPfybEk/lLtrcU3D4QvCNmVUxVQaPtvAIaUw==";
+      };
+    };
     "event-pubsub-4.3.0" = {
       name = "event-pubsub";
       packageName = "event-pubsub";
@@ -18429,13 +18447,13 @@ let
         sha1 = "98c23dab1175657b8c0573e8ceccd91b0ff18c84";
       };
     };
-    "fp-ts-2.6.3" = {
+    "fp-ts-2.6.5" = {
       name = "fp-ts";
       packageName = "fp-ts";
-      version = "2.6.3";
+      version = "2.6.5";
       src = fetchurl {
-        url = "https://registry.npmjs.org/fp-ts/-/fp-ts-2.6.3.tgz";
-        sha512 = "d/djF6VTApJB9DwD/yec2dlKd7h3oqiOv+6vtBnC1pKbHrhz7aEAGcKd4luraUQDJ3pt3C6W4Npd8s+l5xIquQ==";
+        url = "https://registry.npmjs.org/fp-ts/-/fp-ts-2.6.5.tgz";
+        sha512 = "lQNzOMJj98b623+UZLQ+tnN/8qtNXz/vRoR9k7L/9OlUIyYH3qVzSUVZBDXYsAd7nOWzzdQALCX1ZqcF70altQ==";
       };
     };
     "fraction.js-4.0.12" = {
@@ -20149,13 +20167,13 @@ let
         sha512 = "/tq02ayMQjrG4oDFDRLLrPk0KvJXue0nVXoItBe7uAdbNXjQUu+HYCBdAmPLQoseVzUKKMzrhq2P/sfI76ON6w==";
       };
     };
-    "graphql-type-json-0.3.1" = {
+    "graphql-type-json-0.3.2" = {
       name = "graphql-type-json";
       packageName = "graphql-type-json";
-      version = "0.3.1";
+      version = "0.3.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/graphql-type-json/-/graphql-type-json-0.3.1.tgz";
-        sha512 = "1lPkUXQ2L8o+ERLzVAuc3rzc/E6pGF+6HnjihCVTK0VzR0jCuUd92FqNxoHdfILXqOn2L6b4y47TBxiPyieUVA==";
+        url = "https://registry.npmjs.org/graphql-type-json/-/graphql-type-json-0.3.2.tgz";
+        sha512 = "J+vjof74oMlCWXSvt0DOf2APEdZOCdubEvGDUAlqH//VBYcOYsGgRW7Xzorr44LvkjiuvecWc8fChxuZZbChtg==";
       };
     };
     "graphql-upload-8.1.0" = {
@@ -30515,15 +30533,6 @@ let
         sha512 = "ibPK3iA+vaY1eEjESkQkM0BbCqFOaZMiXRTtdB0u7b4djtY6JnsjvPdUHVMg6xQt3B8fpTTWHI9A+ADjM9frzg==";
       };
     };
-    "node-alias-1.0.4" = {
-      name = "node-alias";
-      packageName = "node-alias";
-      version = "1.0.4";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/node-alias/-/node-alias-1.0.4.tgz";
-        sha1 = "1f1b916b56b9ea241c0135f97ced6940f556f292";
-      };
-    };
     "node-appc-0.2.49" = {
       name = "node-appc";
       packageName = "node-appc";
@@ -40220,13 +40229,13 @@ let
         sha512 = "3UlyogA67/9WOssJ7s4d7gqWQRWyO/LbgdBBNMhhmFDKa7eTUSW+A782CVHgyDSJZ2kNANcMWwMiOL+h3p6zQg==";
       };
     };
-    "snyk-docker-plugin-3.6.3" = {
+    "snyk-docker-plugin-3.10.0" = {
       name = "snyk-docker-plugin";
       packageName = "snyk-docker-plugin";
-      version = "3.6.3";
+      version = "3.10.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/snyk-docker-plugin/-/snyk-docker-plugin-3.6.3.tgz";
-        sha512 = "+9pQc9+tetzMiUIV42WA3LAUkrZh6hhkhURv1X4kKyo2c1C8PSbCmpvycx/irilzfmH7dqBv0RXmb4vONPBXHA==";
+        url = "https://registry.npmjs.org/snyk-docker-plugin/-/snyk-docker-plugin-3.10.0.tgz";
+        sha512 = "0OIIqBOq76wBZ/09oB+L+5CdyNXEeDAgLH92TRydEj5iuJwjddAfzWtoqeCIeh3d09DidsHBRP8mMhXKAht7Sg==";
       };
     };
     "snyk-go-parser-1.4.1" = {
@@ -40283,13 +40292,13 @@ let
         sha512 = "HHuOYEAACpUpkFgU8HT57mmxmonaJ4O3YADoSkVhnhkmJ+AowqZyJOau703dYHNrq2DvQ7qYw81H7yyxS1Nfjw==";
       };
     };
-    "snyk-mvn-plugin-2.15.2" = {
+    "snyk-mvn-plugin-2.17.0" = {
       name = "snyk-mvn-plugin";
       packageName = "snyk-mvn-plugin";
-      version = "2.15.2";
+      version = "2.17.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/snyk-mvn-plugin/-/snyk-mvn-plugin-2.15.2.tgz";
-        sha512 = "2TTRizQxfUrA9w0pjxxsvGE+FgFSgog2wwpm378jNiKAZazGgV0txVMM4CoZJMz/tbUmzaJSS8DMQe1C7wlBFQ==";
+        url = "https://registry.npmjs.org/snyk-mvn-plugin/-/snyk-mvn-plugin-2.17.0.tgz";
+        sha512 = "Yl/d7CPJ0LRgHL5dciz/MbjnmsnwAEHA3uBE7Rr5bxZRJ1/ssot9e2OC9ORLJztK86Dggd9ReFocrzD5CWT5PA==";
       };
     };
     "snyk-nodejs-lockfile-parser-1.22.0" = {
@@ -47133,13 +47142,13 @@ let
         sha1 = "c066afb582bb1cb4128d60ea92392e94d5e9dbec";
       };
     };
-    "vsce-1.76.0" = {
+    "vsce-1.76.1" = {
       name = "vsce";
       packageName = "vsce";
-      version = "1.76.0";
+      version = "1.76.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/vsce/-/vsce-1.76.0.tgz";
-        sha512 = "Agvw37yFXxOtCM5HRk7jdtCzLMvrVKWG0TJ+7NZHrQcHVe0ad79/WAvVSm8E58RSENj0dcmG/x1Ln5yRNVr9aw==";
+        url = "https://registry.npmjs.org/vsce/-/vsce-1.76.1.tgz";
+        sha512 = "WNx6JzRywxAOuhVpjmrsI0eHMK0mCA0YKD8u++7sprmhwCHsoQIBpSf0vp6kVMHBmafknr1Z6K7IC5jIjsNL9Q==";
       };
     };
     "vscode-css-languageservice-3.0.13" = {
@@ -50315,7 +50324,7 @@ in
       sources."@apollo/federation-0.16.2"
       (sources."@apollo/protobufjs-1.0.4" // {
         dependencies = [
-          sources."@types/node-10.17.25"
+          sources."@types/node-10.17.26"
         ];
       })
       sources."@apollographql/apollo-tools-0.4.8"
@@ -50467,7 +50476,7 @@ in
       sources."@types/long-4.0.1"
       sources."@types/mime-2.0.2"
       sources."@types/minimatch-3.0.3"
-      sources."@types/node-14.0.12"
+      sources."@types/node-14.0.13"
       (sources."@types/node-fetch-2.5.7" // {
         dependencies = [
           sources."form-data-3.0.0"
@@ -50999,7 +51008,7 @@ in
       sources."graphql-subscriptions-1.1.0"
       sources."graphql-tag-2.10.3"
       sources."graphql-tools-4.0.8"
-      sources."graphql-type-json-0.3.1"
+      sources."graphql-type-json-0.3.2"
       sources."graphql-upload-8.1.0"
       sources."growly-1.3.0"
       sources."har-schema-2.0.0"
@@ -52125,7 +52134,7 @@ in
     dependencies = [
       sources."@types/glob-7.1.2"
       sources."@types/minimatch-3.0.3"
-      sources."@types/node-14.0.12"
+      sources."@types/node-14.0.13"
       sources."balanced-match-1.0.0"
       sources."brace-expansion-1.1.11"
       sources."chromium-pickle-js-0.2.0"
@@ -52668,7 +52677,7 @@ in
       sources."@protobufjs/pool-1.1.0"
       sources."@protobufjs/utf8-1.1.0"
       sources."@types/long-4.0.1"
-      sources."@types/node-13.13.11"
+      sources."@types/node-13.13.12"
       sources."addr-to-ip-port-1.5.1"
       sources."airplay-js-0.2.16"
       sources."ajv-6.12.2"
@@ -53156,10 +53165,10 @@ in
   coc-git = nodeEnv.buildNodePackage {
     name = "coc-git";
     packageName = "coc-git";
-    version = "1.7.13";
+    version = "1.7.14";
     src = fetchurl {
-      url = "https://registry.npmjs.org/coc-git/-/coc-git-1.7.13.tgz";
-      sha512 = "sSONrN4MpxZmQ1+oprl9fZgTymxod9u4euEkoA4Dhb7/h5zuKeEJXfHbEoDzQIYejqq34ElFVMJHfogMOHjVhg==";
+      url = "https://registry.npmjs.org/coc-git/-/coc-git-1.7.14.tgz";
+      sha512 = "LOq7zTp2mb2omi1Pc0r1PEK2N+bwuPYpSfszm78Rsvvht9cU+o/YuC0HagG4VZ7iwuiy9VRvpNz218sMZJqm7Q==";
     };
     buildInputs = globalBuildInputs;
     meta = {
@@ -53347,7 +53356,7 @@ in
       sources."fb-watchman-2.0.1"
       sources."flatted-2.0.2"
       sources."follow-redirects-1.11.0"
-      sources."fp-ts-2.6.3"
+      sources."fp-ts-2.6.5"
       sources."fs-extra-8.1.0"
       sources."fs-minipass-1.2.7"
       sources."fs.realpath-1.0.0"
@@ -53469,7 +53478,7 @@ in
       sources."@nodelib/fs.stat-1.1.3"
       sources."@types/color-name-1.1.1"
       sources."@types/eslint-visitor-keys-1.0.0"
-      sources."@types/json-schema-7.0.4"
+      sources."@types/json-schema-7.0.5"
       sources."@typescript-eslint/experimental-utils-3.2.0"
       sources."@typescript-eslint/parser-3.2.0"
       sources."@typescript-eslint/typescript-estree-3.2.0"
@@ -53535,7 +53544,7 @@ in
       sources."callsites-3.1.0"
       sources."camelcase-2.1.1"
       sources."camelcase-keys-2.1.0"
-      sources."caniuse-lite-1.0.30001079"
+      sources."caniuse-lite-1.0.30001081"
       sources."capture-stack-trace-1.0.1"
       sources."ccount-1.0.5"
       sources."chalk-2.4.2"
@@ -53631,7 +53640,7 @@ in
       sources."domutils-1.7.0"
       sources."dot-prop-5.2.0"
       sources."duplexer3-0.1.4"
-      sources."electron-to-chromium-1.3.465"
+      sources."electron-to-chromium-1.3.466"
       sources."emoji-regex-8.0.0"
       sources."end-of-stream-1.4.4"
       sources."entities-1.1.2"
@@ -54461,10 +54470,10 @@ in
   coc-rust-analyzer = nodeEnv.buildNodePackage {
     name = "coc-rust-analyzer";
     packageName = "coc-rust-analyzer";
-    version = "0.7.2";
+    version = "0.7.3";
     src = fetchurl {
-      url = "https://registry.npmjs.org/coc-rust-analyzer/-/coc-rust-analyzer-0.7.2.tgz";
-      sha512 = "HJg4Y0gRqzxYkVZGZECjfTvC2sctBLKkvPZYIRUb/dVedsNqhO/NLA1xTdNZ0J3sU55sVOzqN2oKmwEEHNMs6A==";
+      url = "https://registry.npmjs.org/coc-rust-analyzer/-/coc-rust-analyzer-0.7.3.tgz";
+      sha512 = "VgL/6zKfm+ASlpNnCl7xY8CYMqycbK3ZEmn0ApVa+CITTkSLOBVFW5B9n53djq5HpPr9QxvGORbxYMQ0INo3kg==";
     };
     buildInputs = globalBuildInputs;
     meta = {
@@ -54497,10 +54506,10 @@ in
   coc-snippets = nodeEnv.buildNodePackage {
     name = "coc-snippets";
     packageName = "coc-snippets";
-    version = "2.1.26";
+    version = "2.1.28";
     src = fetchurl {
-      url = "https://registry.npmjs.org/coc-snippets/-/coc-snippets-2.1.26.tgz";
-      sha512 = "4/XHrxJV5kN0aCrW/Kkw6s19ORs/V26zzZzQ/jFP8BT+HWZegbqPZIP9c+xB9nwknCwa9Tovx3mzcUMq0w0KMw==";
+      url = "https://registry.npmjs.org/coc-snippets/-/coc-snippets-2.1.28.tgz";
+      sha512 = "okVbjhKbFH6iTPeTpjxhtYtBBTFy5neOQYtn1H9CrbPpjnjodWzBDq3izoXCsC4BMMyBRzOwmwmJ0eA65S6JnQ==";
     };
     buildInputs = globalBuildInputs;
     meta = {
@@ -54560,7 +54569,7 @@ in
       sources."@nodelib/fs.stat-1.1.3"
       sources."@types/glob-7.1.2"
       sources."@types/minimatch-3.0.3"
-      sources."@types/node-14.0.12"
+      sources."@types/node-14.0.13"
       sources."@types/unist-2.0.3"
       sources."@types/vfile-3.0.2"
       sources."@types/vfile-message-2.0.0"
@@ -54611,7 +54620,7 @@ in
       sources."callsites-2.0.0"
       sources."camelcase-4.1.0"
       sources."camelcase-keys-4.2.0"
-      sources."caniuse-lite-1.0.30001079"
+      sources."caniuse-lite-1.0.30001081"
       sources."ccount-1.0.5"
       sources."chalk-2.4.2"
       sources."character-entities-1.2.4"
@@ -54670,7 +54679,7 @@ in
       sources."domhandler-2.4.2"
       sources."domutils-1.7.0"
       sources."dot-prop-5.2.0"
-      sources."electron-to-chromium-1.3.465"
+      sources."electron-to-chromium-1.3.466"
       sources."emoji-regex-8.0.0"
       sources."entities-1.1.2"
       sources."error-ex-1.3.2"
@@ -55270,10 +55279,10 @@ in
       sources."@types/color-name-1.1.1"
       sources."@types/eslint-visitor-keys-1.0.0"
       sources."@types/glob-7.1.2"
-      sources."@types/json-schema-7.0.4"
+      sources."@types/json-schema-7.0.5"
       sources."@types/minimatch-3.0.3"
       sources."@types/minimist-1.2.0"
-      sources."@types/node-14.0.12"
+      sources."@types/node-14.0.13"
       sources."@types/normalize-package-data-2.4.0"
       sources."@types/unist-2.0.3"
       sources."@types/vfile-3.0.2"
@@ -56508,7 +56517,7 @@ in
       sources."@nodelib/fs.stat-1.1.3"
       sources."@types/glob-7.1.2"
       sources."@types/minimatch-3.0.3"
-      sources."@types/node-14.0.12"
+      sources."@types/node-14.0.13"
       sources."abbrev-1.1.1"
       sources."accepts-1.3.7"
       sources."ajv-6.12.2"
@@ -57120,7 +57129,7 @@ in
       sources."@types/glob-7.1.2"
       sources."@types/minimatch-3.0.3"
       sources."@types/minimist-1.2.0"
-      sources."@types/node-14.0.12"
+      sources."@types/node-14.0.13"
       sources."@types/normalize-package-data-2.4.0"
       sources."aggregate-error-3.0.1"
       sources."ansi-styles-3.2.1"
@@ -57488,7 +57497,7 @@ in
       sources."@cycle/run-3.4.0"
       sources."@cycle/time-0.10.1"
       sources."@types/cookiejar-2.1.1"
-      sources."@types/node-14.0.12"
+      sources."@types/node-14.0.13"
       sources."@types/superagent-3.8.2"
       sources."ansi-escapes-3.2.0"
       sources."ansi-regex-2.1.1"
@@ -58677,7 +58686,7 @@ in
       sources."assert-plus-1.0.0"
       sources."async-2.6.3"
       sources."asynckit-0.4.0"
-      sources."aws-sdk-2.692.0"
+      sources."aws-sdk-2.693.0"
       sources."aws-sign2-0.7.0"
       sources."aws4-1.10.0"
       sources."base64-js-1.3.1"
@@ -58859,7 +58868,7 @@ in
       sources."@types/http-cache-semantics-4.0.0"
       sources."@types/keyv-3.1.1"
       sources."@types/minimist-1.2.0"
-      sources."@types/node-14.0.12"
+      sources."@types/node-14.0.13"
       sources."@types/normalize-package-data-2.4.0"
       sources."@types/responselike-1.0.0"
       sources."@types/yoga-layout-1.9.2"
@@ -59156,6 +59165,24 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
+  escape-string-regexp = nodeEnv.buildNodePackage {
+    name = "escape-string-regexp";
+    packageName = "escape-string-regexp";
+    version = "4.0.0";
+    src = fetchurl {
+      url = "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz";
+      sha512 = "TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==";
+    };
+    buildInputs = globalBuildInputs;
+    meta = {
+      description = "Escape RegExp special characters";
+      homepage = "https://github.com/sindresorhus/escape-string-regexp#readme";
+      license = "MIT";
+    };
+    production = true;
+    bypassCache = true;
+    reconstructLock = true;
+  };
   eslint = nodeEnv.buildNodePackage {
     name = "eslint";
     packageName = "eslint";
@@ -59188,7 +59215,7 @@ in
       sources."balanced-match-1.0.0"
       sources."brace-expansion-1.1.11"
       sources."callsites-3.1.0"
-      (sources."chalk-4.0.0" // {
+      (sources."chalk-4.1.0" // {
         dependencies = [
           sources."ansi-styles-4.2.1"
           sources."color-convert-2.0.1"
@@ -59335,15 +59362,19 @@ in
   eslint_d = nodeEnv.buildNodePackage {
     name = "eslint_d";
     packageName = "eslint_d";
-    version = "8.1.1";
+    version = "9.0.0";
     src = fetchurl {
-      url = "https://registry.npmjs.org/eslint_d/-/eslint_d-8.1.1.tgz";
-      sha512 = "eYr8vOwCQynnI8b5e5R07D2JI6jCItT9QZzWKGZnqMs9lKN+z0bvn1ULCNKp0u4mz1V+lLRglIDiSGIkIDDcLw==";
+      url = "https://registry.npmjs.org/eslint_d/-/eslint_d-9.0.0.tgz";
+      sha512 = "yWXSiBvn6u4pLpGrLuebCtSQ8fJ8jUkUdfD6QqqYp7fSuY4+YW6mW1UusY/gCgfByrgU518o6DCeBmPg6HLkcw==";
     };
     dependencies = [
       sources."@babel/code-frame-7.10.1"
       sources."@babel/helper-validator-identifier-7.10.1"
-      sources."@babel/highlight-7.10.1"
+      (sources."@babel/highlight-7.10.1" // {
+        dependencies = [
+          sources."chalk-2.4.2"
+        ];
+      })
       sources."@types/color-name-1.1.1"
       sources."acorn-7.2.0"
       sources."acorn-jsx-5.2.0"
@@ -59360,7 +59391,15 @@ in
       sources."balanced-match-1.0.0"
       sources."brace-expansion-1.1.11"
       sources."callsites-3.1.0"
-      sources."chalk-2.4.2"
+      (sources."chalk-4.1.0" // {
+        dependencies = [
+          sources."ansi-styles-4.2.1"
+          sources."color-convert-2.0.1"
+          sources."color-name-1.1.4"
+          sources."has-flag-4.0.0"
+          sources."supports-color-7.1.0"
+        ];
+      })
       sources."chardet-0.7.0"
       sources."cli-cursor-3.1.0"
       sources."cli-width-2.2.1"
@@ -59368,21 +59407,17 @@ in
       sources."color-name-1.1.3"
       sources."concat-map-0.0.1"
       sources."core_d-1.0.1"
-      (sources."cross-spawn-6.0.5" // {
-        dependencies = [
-          sources."semver-5.7.1"
-        ];
-      })
+      sources."cross-spawn-7.0.3"
       sources."debug-4.2.0"
       sources."deep-is-0.1.3"
       sources."doctrine-3.0.0"
       sources."emoji-regex-8.0.0"
       sources."escape-string-regexp-1.0.5"
-      sources."eslint-6.8.0"
+      sources."eslint-7.2.0"
       sources."eslint-scope-5.1.0"
-      sources."eslint-utils-1.4.3"
+      sources."eslint-utils-2.0.0"
       sources."eslint-visitor-keys-1.2.0"
-      sources."espree-6.2.1"
+      sources."espree-7.1.0"
       sources."esprima-4.0.1"
       (sources."esquery-1.3.1" // {
         dependencies = [
@@ -59419,7 +59454,6 @@ in
           sources."color-convert-2.0.1"
           sources."color-name-1.1.4"
           sources."has-flag-4.0.0"
-          sources."strip-ansi-6.0.0"
           sources."supports-color-7.1.0"
         ];
       })
@@ -59431,7 +59465,7 @@ in
       sources."js-yaml-3.14.0"
       sources."json-schema-traverse-0.4.1"
       sources."json-stable-stringify-without-jsonify-1.0.1"
-      sources."levn-0.3.0"
+      sources."levn-0.4.1"
       sources."lodash-4.17.15"
       sources."mimic-fn-2.1.0"
       sources."minimatch-3.0.4"
@@ -59441,19 +59475,18 @@ in
       sources."mute-stream-0.0.8"
       sources."nanolru-1.0.0"
       sources."natural-compare-1.4.0"
-      sources."nice-try-1.0.5"
       sources."once-1.4.0"
       sources."onetime-5.1.0"
-      sources."optionator-0.8.3"
+      sources."optionator-0.9.1"
       sources."os-tmpdir-1.0.2"
       sources."parent-module-1.0.1"
       sources."path-is-absolute-1.0.1"
-      sources."path-key-2.0.1"
+      sources."path-key-3.1.1"
       sources."path-parse-1.0.6"
-      sources."prelude-ls-1.1.2"
+      sources."prelude-ls-1.2.1"
       sources."progress-2.0.3"
       sources."punycode-2.1.1"
-      sources."regexpp-2.0.1"
+      sources."regexpp-3.1.0"
       sources."resolve-1.17.0"
       sources."resolve-from-4.0.0"
       sources."restore-cursor-3.1.0"
@@ -59461,9 +59494,9 @@ in
       sources."run-async-2.4.1"
       sources."rxjs-6.5.5"
       sources."safer-buffer-2.1.2"
-      sources."semver-6.3.0"
-      sources."shebang-command-1.2.0"
-      sources."shebang-regex-1.0.0"
+      sources."semver-7.3.2"
+      sources."shebang-command-2.0.0"
+      sources."shebang-regex-3.0.0"
       sources."signal-exit-3.0.3"
       (sources."slice-ansi-2.1.0" // {
         dependencies = [
@@ -59471,34 +59504,28 @@ in
         ];
       })
       sources."sprintf-js-1.0.3"
-      (sources."string-width-4.2.0" // {
-        dependencies = [
-          sources."strip-ansi-6.0.0"
-        ];
-      })
-      (sources."strip-ansi-5.2.0" // {
-        dependencies = [
-          sources."ansi-regex-4.1.0"
-        ];
-      })
+      sources."string-width-4.2.0"
+      sources."strip-ansi-6.0.0"
       sources."strip-json-comments-3.1.0"
       sources."supports-color-5.5.0"
       (sources."table-5.4.6" // {
         dependencies = [
+          sources."ansi-regex-4.1.0"
           sources."emoji-regex-7.0.3"
           sources."is-fullwidth-code-point-2.0.0"
           sources."string-width-3.1.0"
+          sources."strip-ansi-5.2.0"
         ];
       })
       sources."text-table-0.2.0"
       sources."through-2.3.8"
       sources."tmp-0.0.33"
       sources."tslib-1.13.0"
-      sources."type-check-0.3.2"
+      sources."type-check-0.4.0"
       sources."type-fest-0.8.1"
       sources."uri-js-4.2.2"
       sources."v8-compile-cache-2.1.1"
-      sources."which-1.3.1"
+      sources."which-2.0.2"
       sources."word-wrap-1.2.3"
       sources."wrappy-1.0.2"
       sources."write-1.0.3"
@@ -61666,7 +61693,7 @@ in
       (sources."marked-terminal-4.1.0" // {
         dependencies = [
           sources."ansi-styles-4.2.1"
-          sources."chalk-4.0.0"
+          sources."chalk-4.1.0"
           sources."supports-color-7.1.0"
         ];
       })
@@ -62517,6 +62544,24 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
+  he = nodeEnv.buildNodePackage {
+    name = "he";
+    packageName = "he";
+    version = "1.2.0";
+    src = fetchurl {
+      url = "https://registry.npmjs.org/he/-/he-1.2.0.tgz";
+      sha512 = "F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw==";
+    };
+    buildInputs = globalBuildInputs;
+    meta = {
+      description = "A robust HTML entities encoder/decoder with full Unicode support.";
+      homepage = https://mths.be/he;
+      license = "MIT";
+    };
+    production = true;
+    bypassCache = true;
+    reconstructLock = true;
+  };
   html-minifier = nodeEnv.buildNodePackage {
     name = "html-minifier";
     packageName = "html-minifier";
@@ -63621,10 +63666,10 @@ in
   jake = nodeEnv.buildNodePackage {
     name = "jake";
     packageName = "jake";
-    version = "10.8.1";
+    version = "10.8.2";
     src = fetchurl {
-      url = "https://registry.npmjs.org/jake/-/jake-10.8.1.tgz";
-      sha512 = "eSp5h9S7UFzKdQERTyF+KuPLjDZa1Tbw8gCVUn98n4PbIkLEDGe4zl7vF4Qge9kQj06HcymnksPk8jznPZeKsA==";
+      url = "https://registry.npmjs.org/jake/-/jake-10.8.2.tgz";
+      sha512 = "eLpKyrfG3mzvGE2Du8VoPbeSkRry093+tyNjdYaBbJS9v17knImYGNXQCUV0gLxQtF82m3E8iRb/wdSQZLoq7A==";
     };
     dependencies = [
       sources."ansi-styles-3.2.1"
@@ -65813,11 +65858,11 @@ in
         ];
       })
       sources."@octokit/rest-16.43.1"
-      sources."@octokit/types-4.1.9"
+      sources."@octokit/types-4.1.10"
       sources."@types/glob-7.1.2"
       sources."@types/minimatch-3.0.3"
       sources."@types/minimist-1.2.0"
-      sources."@types/node-14.0.12"
+      sources."@types/node-14.0.13"
       sources."@types/normalize-package-data-2.4.0"
       sources."@zkochan/cmd-shim-3.1.0"
       sources."JSONStream-1.3.5"
@@ -67776,11 +67821,11 @@ in
       sources."@types/color-name-1.1.1"
       sources."@types/estree-0.0.44"
       sources."@types/graceful-fs-4.1.3"
-      sources."@types/istanbul-lib-coverage-2.0.2"
+      sources."@types/istanbul-lib-coverage-2.0.3"
       sources."@types/istanbul-lib-report-3.0.0"
       sources."@types/istanbul-reports-1.1.2"
-      sources."@types/json-schema-7.0.4"
-      sources."@types/node-14.0.12"
+      sources."@types/json-schema-7.0.5"
+      sources."@types/node-14.0.13"
       sources."@types/normalize-package-data-2.4.0"
       sources."@types/resolve-0.0.8"
       sources."@types/yargs-15.0.5"
@@ -67961,7 +68006,7 @@ in
       sources."cache-base-1.0.1"
       sources."cached-path-relative-1.0.2"
       sources."camelcase-5.3.1"
-      sources."caniuse-lite-1.0.30001079"
+      sources."caniuse-lite-1.0.30001081"
       sources."capture-exit-2.0.0"
       sources."caseless-0.12.0"
       (sources."chalk-3.0.0" // {
@@ -68083,7 +68128,7 @@ in
       sources."duplexer2-0.1.4"
       sources."duplexify-3.7.1"
       sources."ecc-jsbn-0.1.2"
-      sources."electron-to-chromium-1.3.465"
+      sources."electron-to-chromium-1.3.466"
       (sources."elliptic-6.5.2" // {
         dependencies = [
           sources."bn.js-4.11.9"
@@ -68866,7 +68911,7 @@ in
       sources."aws4-1.10.0"
       sources."bcrypt-pbkdf-1.0.2"
       sources."caseless-0.12.0"
-      sources."chalk-4.0.0"
+      sources."chalk-4.1.0"
       sources."color-convert-2.0.1"
       sources."color-name-1.1.4"
       sources."combined-stream-1.0.8"
@@ -71365,10 +71410,10 @@ in
   npm-check-updates = nodeEnv.buildNodePackage {
     name = "npm-check-updates";
     packageName = "npm-check-updates";
-    version = "6.0.1";
+    version = "7.0.1";
     src = fetchurl {
-      url = "https://registry.npmjs.org/npm-check-updates/-/npm-check-updates-6.0.1.tgz";
-      sha512 = "lzoVW35KWaBn0m1O1AVr0G9/20niK13mYftoAr09WuQszoeTdlrjCNyC0pRNiTfb5ZxubZaUAi7HdVzkEihwwA==";
+      url = "https://registry.npmjs.org/npm-check-updates/-/npm-check-updates-7.0.1.tgz";
+      sha512 = "z/i1nhxW1OJ2a8wZtm92PS+4vCZ5Y5d86pLDPJScWf8G3vTYJlxd11UqUymnaZWK2nYPMmgxnneAKnFGODDxjw==";
     };
     dependencies = [
       sources."@npmcli/ci-detect-1.2.0"
@@ -71428,7 +71473,7 @@ in
       })
       sources."camelcase-5.3.1"
       sources."caseless-0.12.0"
-      sources."chalk-4.0.0"
+      sources."chalk-4.1.0"
       sources."chownr-2.0.0"
       sources."ci-info-2.0.0"
       sources."cint-8.2.1"
@@ -71466,7 +71511,6 @@ in
       sources."env-paths-2.2.0"
       sources."err-code-1.1.2"
       sources."escape-goat-2.1.1"
-      sources."escape-string-regexp-1.0.5"
       sources."esprima-4.0.1"
       sources."extend-3.0.2"
       sources."extsprintf-1.3.0"
@@ -71488,7 +71532,6 @@ in
       sources."graceful-fs-4.2.4"
       sources."har-schema-2.0.0"
       sources."har-validator-5.1.3"
-      sources."has-ansi-2.0.0"
       sources."has-flag-4.0.0"
       sources."has-unicode-2.0.1"
       sources."has-yarn-2.1.0"
@@ -71582,13 +71625,6 @@ in
       sources."mkdirp-1.0.4"
       sources."ms-2.1.2"
       sources."nested-error-stacks-2.0.1"
-      (sources."node-alias-1.0.4" // {
-        dependencies = [
-          sources."ansi-styles-2.2.1"
-          sources."chalk-1.1.3"
-          sources."supports-color-2.0.0"
-        ];
-      })
       (sources."node-gyp-6.1.0" // {
         dependencies = [
           sources."chownr-1.1.4"
@@ -71732,7 +71768,7 @@ in
     ];
     buildInputs = globalBuildInputs;
     meta = {
-      description = "Find newer versions of dependencies than what your package.json or bower.json allows";
+      description = "Find newer versions of dependencies than what your package.json allows";
       homepage = https://github.com/raineorshine/npm-check-updates;
       license = "Apache-2.0";
     };
@@ -72185,7 +72221,7 @@ in
       sources."callsites-2.0.0"
       sources."camelcase-5.3.1"
       sources."caniuse-api-3.0.0"
-      sources."caniuse-lite-1.0.30001079"
+      sources."caniuse-lite-1.0.30001081"
       sources."caseless-0.12.0"
       sources."chalk-2.4.2"
       sources."chokidar-2.1.8"
@@ -72326,7 +72362,7 @@ in
       sources."duplexer2-0.1.4"
       sources."ecc-jsbn-0.1.2"
       sources."ee-first-1.1.1"
-      sources."electron-to-chromium-1.3.465"
+      sources."electron-to-chromium-1.3.466"
       (sources."elliptic-6.5.2" // {
         dependencies = [
           sources."bn.js-4.11.9"
@@ -73933,10 +73969,10 @@ in
   pnpm = nodeEnv.buildNodePackage {
     name = "pnpm";
     packageName = "pnpm";
-    version = "5.1.5";
+    version = "5.1.6";
     src = fetchurl {
-      url = "https://registry.npmjs.org/pnpm/-/pnpm-5.1.5.tgz";
-      sha512 = "yKNHD9xXeT1v7h4ExFDib7CWzNvHzuyUX4T+ItgWIJAnG0331WNCZHXAbcvMWazJASGb+NYWgcERCkwSWnHRcg==";
+      url = "https://registry.npmjs.org/pnpm/-/pnpm-5.1.6.tgz";
+      sha512 = "BMY+RH2ggxY27pSlO5RtGAtTUcUfFVetQZHJdZURWu9tankNO0iDuqSx4w9iBGdIm9+Gd5eQqNYylqTksu2ueA==";
     };
     buildInputs = globalBuildInputs;
     meta = {
@@ -73973,7 +74009,7 @@ in
       sources."caller-path-2.0.0"
       sources."callsites-2.0.0"
       sources."camelcase-5.3.1"
-      sources."chalk-4.0.0"
+      sources."chalk-4.1.0"
       sources."chokidar-3.4.0"
       sources."cliui-6.0.0"
       sources."color-convert-2.0.1"
@@ -74650,10 +74686,10 @@ in
       sources."@types/eslint-visitor-keys-1.0.0"
       sources."@types/estree-0.0.39"
       sources."@types/glob-7.1.2"
-      sources."@types/json-schema-7.0.4"
+      sources."@types/json-schema-7.0.5"
       sources."@types/minimatch-3.0.3"
       sources."@types/mocha-7.0.2"
-      sources."@types/node-14.0.12"
+      sources."@types/node-14.0.13"
       sources."@types/node-fetch-2.5.7"
       sources."@types/resolve-0.0.8"
       sources."@types/vscode-1.45.0"
@@ -74696,7 +74732,7 @@ in
       sources."builtin-modules-3.1.0"
       sources."callsites-3.1.0"
       sources."camelcase-5.3.1"
-      (sources."chalk-4.0.0" // {
+      (sources."chalk-4.1.0" // {
         dependencies = [
           sources."ansi-styles-4.2.1"
           sources."color-convert-2.0.1"
@@ -74999,7 +75035,7 @@ in
       sources."url-join-1.1.0"
       sources."util-deprecate-1.0.2"
       sources."v8-compile-cache-2.1.1"
-      (sources."vsce-1.76.0" // {
+      (sources."vsce-1.76.1" // {
         dependencies = [
           sources."chalk-2.4.2"
           sources."semver-5.7.1"
@@ -75339,7 +75375,7 @@ in
       sources."@protobufjs/utf8-1.1.0"
       sources."@serverless/cli-1.4.0"
       sources."@serverless/component-metrics-1.0.8"
-      (sources."@serverless/components-2.30.13" // {
+      (sources."@serverless/components-2.30.14" // {
         dependencies = [
           sources."globby-10.0.2"
           sources."semver-7.3.2"
@@ -75381,7 +75417,7 @@ in
       sources."@types/lodash-4.14.155"
       sources."@types/long-4.0.1"
       sources."@types/minimatch-3.0.3"
-      sources."@types/node-13.13.11"
+      sources."@types/node-13.13.12"
       (sources."@typescript-eslint/typescript-estree-2.34.0" // {
         dependencies = [
           sources."semver-7.3.2"
@@ -75444,7 +75480,7 @@ in
       sources."async-limiter-1.0.1"
       sources."asynckit-0.4.0"
       sources."atob-2.1.2"
-      (sources."aws-sdk-2.692.0" // {
+      (sources."aws-sdk-2.693.0" // {
         dependencies = [
           sources."buffer-4.9.2"
           sources."isarray-1.0.0"
@@ -77065,10 +77101,10 @@ in
   snyk = nodeEnv.buildNodePackage {
     name = "snyk";
     packageName = "snyk";
-    version = "1.336.0";
+    version = "1.338.0";
     src = fetchurl {
-      url = "https://registry.npmjs.org/snyk/-/snyk-1.336.0.tgz";
-      sha512 = "Dzk2xpaHZahZmjM8s3VHRPJgU1q28MAZr1TfnuRLIGDRT4eRiUdiFWdFMC6xqto7VJGJr31HYn1Di4Luv/1Bgg==";
+      url = "https://registry.npmjs.org/snyk/-/snyk-1.338.0.tgz";
+      sha512 = "kygisp/bsNVLnATEdHeb3ASQS58b8DKOju9BcVNC3OpUi0Ajjiqy5o7RdfNPfCzp9lYglLT9grIM59zJuC2sFg==";
     };
     dependencies = [
       sources."@sindresorhus/is-0.14.0"
@@ -77088,13 +77124,17 @@ in
       sources."@snyk/gemfile-1.2.0"
       sources."@snyk/graphlib-2.1.9-patch"
       sources."@snyk/inquirer-6.2.2-patch"
-      (sources."@snyk/java-call-graph-builder-1.8.1" // {
+      (sources."@snyk/java-call-graph-builder-1.10.0" // {
         dependencies = [
           sources."debug-4.2.0"
         ];
       })
       sources."@snyk/lodash-4.17.15-patch"
-      sources."@snyk/rpm-parser-1.2.0"
+      (sources."@snyk/rpm-parser-2.0.0" // {
+        dependencies = [
+          sources."event-loop-spinner-2.0.0"
+        ];
+      })
       sources."@snyk/ruby-semver-2.2.0"
       (sources."@snyk/snyk-cocoapods-plugin-2.3.0" // {
         dependencies = [
@@ -77111,7 +77151,7 @@ in
       sources."@types/debug-4.1.5"
       sources."@types/hosted-git-info-2.7.0"
       sources."@types/js-yaml-3.12.4"
-      sources."@types/node-14.0.12"
+      sources."@types/node-14.0.13"
       sources."@types/semver-5.5.0"
       sources."@types/xml2js-0.4.5"
       sources."@yarnpkg/lockfile-1.1.0"
@@ -77411,7 +77451,7 @@ in
           sources."debug-4.2.0"
         ];
       })
-      (sources."snyk-docker-plugin-3.6.3" // {
+      (sources."snyk-docker-plugin-3.10.0" // {
         dependencies = [
           sources."debug-4.2.0"
         ];
@@ -77447,7 +77487,7 @@ in
           sources."debug-4.2.0"
         ];
       })
-      (sources."snyk-mvn-plugin-2.15.2" // {
+      (sources."snyk-mvn-plugin-2.17.0" // {
         dependencies = [
           sources."@snyk/cli-interface-2.5.0"
           sources."debug-4.2.0"
@@ -78780,7 +78820,7 @@ in
       sources."async-1.5.2"
       sources."async-limiter-1.0.1"
       sources."asynckit-0.4.0"
-      (sources."aws-sdk-2.692.0" // {
+      (sources."aws-sdk-2.693.0" // {
         dependencies = [
           sources."uuid-3.3.2"
         ];
@@ -81416,7 +81456,7 @@ in
       sources."@types/debug-4.1.5"
       sources."@types/http-cache-semantics-4.0.0"
       sources."@types/keyv-3.1.1"
-      sources."@types/node-14.0.12"
+      sources."@types/node-14.0.13"
       sources."@types/responselike-1.0.0"
       sources."abbrev-1.1.1"
       sources."abstract-logging-1.0.0"
@@ -82354,7 +82394,7 @@ in
       sources."@sindresorhus/is-0.14.0"
       sources."@szmarczak/http-timer-1.1.2"
       sources."@types/color-name-1.1.1"
-      sources."@types/node-13.13.11"
+      sources."@types/node-13.13.12"
       sources."abbrev-1.1.1"
       sources."accepts-1.3.7"
       sources."after-0.8.2"
@@ -83050,7 +83090,7 @@ in
       sources."@starptech/rehype-webparser-0.10.0"
       sources."@starptech/webparser-0.10.0"
       sources."@szmarczak/http-timer-1.1.2"
-      sources."@types/node-14.0.12"
+      sources."@types/node-14.0.13"
       sources."@types/unist-2.0.3"
       sources."@types/vfile-3.0.2"
       sources."@types/vfile-message-2.0.0"
@@ -84001,7 +84041,7 @@ in
       sources."@szmarczak/http-timer-1.1.2"
       sources."@types/color-name-1.1.1"
       sources."@types/minimatch-3.0.3"
-      sources."@types/node-14.0.12"
+      sources."@types/node-14.0.13"
       sources."JSONSelect-0.2.1"
       sources."acorn-6.4.1"
       sources."acorn-jsx-5.2.0"
@@ -85961,7 +86001,7 @@ in
     dependencies = [
       sources."@types/glob-7.1.2"
       sources."@types/minimatch-3.0.3"
-      sources."@types/node-14.0.12"
+      sources."@types/node-14.0.13"
       sources."accepts-1.3.7"
       sources."ajv-6.12.2"
       sources."ajv-errors-1.0.1"
@@ -86557,7 +86597,7 @@ in
       sources."@nodelib/fs.stat-2.0.3"
       sources."@nodelib/fs.walk-1.2.4"
       sources."@npmcli/move-file-1.0.1"
-      sources."@types/json-schema-7.0.4"
+      sources."@types/json-schema-7.0.5"
       sources."aggregate-error-3.0.1"
       sources."ajv-6.12.2"
       sources."ajv-keywords-3.4.1"
@@ -86686,7 +86726,7 @@ in
       sources."@protobufjs/pool-1.1.0"
       sources."@protobufjs/utf8-1.1.0"
       sources."@types/long-4.0.1"
-      sources."@types/node-13.13.11"
+      sources."@types/node-13.13.12"
       sources."addr-to-ip-port-1.5.1"
       sources."airplay-js-0.3.0"
       sources."balanced-match-1.0.0"
@@ -87096,7 +87136,7 @@ in
       sources."@types/color-name-1.1.1"
       sources."@types/glob-7.1.2"
       sources."@types/minimatch-3.0.3"
-      sources."@types/node-14.0.12"
+      sources."@types/node-14.0.13"
       sources."@types/normalize-package-data-2.4.0"
       sources."JSONStream-1.3.5"
       sources."aggregate-error-3.0.1"
diff --git a/pkgs/development/python-modules/binwalk/default.nix b/pkgs/development/python-modules/binwalk/default.nix
index e8a20b6df47d..97c6b957a437 100644
--- a/pkgs/development/python-modules/binwalk/default.nix
+++ b/pkgs/development/python-modules/binwalk/default.nix
@@ -7,6 +7,7 @@
 , gzip
 , bzip2
 , gnutar
+, p7zip
 , cabextract
 , lzma
 , nose
@@ -28,7 +29,7 @@ buildPythonPackage {
     sha256 = "1bxgj569fzwv6jhcbl864nmlsi9x1k1r20aywjxc8b9b1zgqrlvc";
   };
 
-  propagatedBuildInputs = [ zlib xz ncompress gzip bzip2 gnutar cabextract lzma pycrypto ]
+  propagatedBuildInputs = [ zlib xz ncompress gzip bzip2 gnutar p7zip cabextract lzma pycrypto ]
   ++ stdenv.lib.optional visualizationSupport pyqtgraph;
 
   # setup.py only installs version.py during install, not test
diff --git a/pkgs/development/python-modules/gidgethub/default.nix b/pkgs/development/python-modules/gidgethub/default.nix
index 634d7c2ddc04..a9214cf49f70 100644
--- a/pkgs/development/python-modules/gidgethub/default.nix
+++ b/pkgs/development/python-modules/gidgethub/default.nix
@@ -11,22 +11,26 @@
 , tornado
 , aiohttp
 , uritemplate
+, pyjwt
 }:
 
 buildPythonPackage rec {
   pname = "gidgethub";
-  version = "3.2.0";
+  version = "4.1.1";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8f4b69063a256994d38243cc0eba4e1453017b5b8b04a173216d02d47ffc3989";
+    sha256 = "13nzc40c71kxvjxahgnc6c974xp5fpm02gqymwgfjbj2dmlzmayg";
   };
 
   nativeBuildInputs = [ setuptools pytestrunner ];
   checkInputs = [ pytest pytest-asyncio twisted treq tornado aiohttp ];
-  propagatedBuildInputs = [ uritemplate ];
+  propagatedBuildInputs = [
+    uritemplate
+    pyjwt
+  ];
 
   postPatch = ''
     substituteInPlace setup.py \
diff --git a/pkgs/development/python-modules/mautrix/default.nix b/pkgs/development/python-modules/mautrix/default.nix
index 364b62ef8676..362e34157676 100644
--- a/pkgs/development/python-modules/mautrix/default.nix
+++ b/pkgs/development/python-modules/mautrix/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "mautrix";
-  version = "0.5.1";
+  version = "0.5.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a8dcf86c3562c1c6c25247b0a1a16f95d821bc8b3805141787c0b9ed8a2b4ca9";
+    sha256 = "0csvk3y0y2r9gnfqj91fiqprgp8dxiv4n80b6myraab5s7zn1mvv";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/python-daemon/default.nix b/pkgs/development/python-modules/python-daemon/default.nix
index e33aee6c1c91..d8b501d62e5a 100644
--- a/pkgs/development/python-modules/python-daemon/default.nix
+++ b/pkgs/development/python-modules/python-daemon/default.nix
@@ -2,7 +2,7 @@
 , docutils
 , lockfile
 , mock
-, pytest
+, pytest_4
 , testscenarios
 , twine
 }:
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   nativeBuildInputs = [ twine ];
   propagatedBuildInputs = [ docutils lockfile ];
 
-  checkInputs = [ pytest mock testscenarios ];
+  checkInputs = [ pytest_4 mock testscenarios ];
   checkPhase = ''
     pytest -k 'not detaches_process_context \
                 and not standard_stream_file_descriptors'
diff --git a/pkgs/development/tools/gogetdoc/default.nix b/pkgs/development/tools/gogetdoc/default.nix
index 5d360f4572ab..6898c998ef60 100644
--- a/pkgs/development/tools/gogetdoc/default.nix
+++ b/pkgs/development/tools/gogetdoc/default.nix
@@ -10,7 +10,6 @@ buildGoModule rec {
 
   vendorSha256 = null;
 
-  goPackagePath = "github.com/zmb3/gogetdoc";
   excludedPackages = "\\(testdata\\)";
 
   src = fetchFromGitHub {
@@ -21,8 +20,6 @@ buildGoModule rec {
     sha256 = "1v74zd0x2xh10603p8raazssacv3y0x0lr9apkpsdk0bfp5jj0lr";
   };
 
-  goDeps = ./deps.nix;
-
   meta = with lib; {
     description = "Gets documentation for items in Go source code";
     homepage = "https://github.com/zmb3/gogetdoc";
@@ -30,4 +27,4 @@ buildGoModule rec {
     maintainers = with maintainers; [ kalbasit ];
     platforms = platforms.linux ++ platforms.darwin;
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/development/tools/gogetdoc/deps.nix b/pkgs/development/tools/gogetdoc/deps.nix
deleted file mode 100644
index d770057d1d78..000000000000
--- a/pkgs/development/tools/gogetdoc/deps.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-# file generated from go.mod using vgo2nix (https://github.com/adisbladis/vgo2nix)
-[
-
-  {
-    goPackagePath = "golang.org/x/tools";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/tools";
-      rev = "6adeb8aab2de";
-      sha256 = "0kylkki0ksdm12ppl37fghzbma9hmgqwph0nwngv08v4blk6li6k";
-    };
-  }
-]
diff --git a/pkgs/development/tools/ktlint/default.nix b/pkgs/development/tools/ktlint/default.nix
index 19e51fa998cf..b8a8dc75158e 100644
--- a/pkgs/development/tools/ktlint/default.nix
+++ b/pkgs/development/tools/ktlint/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ktlint";
-  version = "0.37.0";
+  version = "0.37.1";
 
   src = fetchurl {
     url = "https://github.com/shyiko/ktlint/releases/download/${version}/ktlint";
-    sha256 = "1z2hvhcrz1rj9g8749x640axrf529wk361pckwb4ihn43c19ajpf";
+    sha256 = "0i5frcy3ya1qwq0hl67gq6fgz0c8vgskgha25irsw7j2ndf4qp8i";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/packer/default.nix b/pkgs/development/tools/packer/default.nix
index 32ac95cff6a4..382fda72a4cd 100644
--- a/pkgs/development/tools/packer/default.nix
+++ b/pkgs/development/tools/packer/default.nix
@@ -1,7 +1,7 @@
 { stdenv, buildGoPackage, fetchFromGitHub }:
 buildGoPackage rec {
   pname = "packer";
-  version = "1.5.6";
+  version = "1.6.0";
 
   goPackagePath = "github.com/hashicorp/packer";
 
@@ -11,14 +11,14 @@ buildGoPackage rec {
     owner = "hashicorp";
     repo = "packer";
     rev = "v${version}";
-    sha256 = "0pwygrh6pjmx8a1jc12929x0slj7w3b8p3pzswnbk7klyhj4jkp8";
+    sha256 = "0qddljg330i7059kvij84pjzz67g6qh1w2zcmsj6rv58ix8xsfx7";
   };
 
   meta = with stdenv.lib; {
     description = "A tool for creating identical machine images for multiple platforms from a single source configuration";
     homepage    = "https://www.packer.io";
     license     = licenses.mpl20;
-    maintainers = with maintainers; [ cstrahan zimbatm ];
+    maintainers = with maintainers; [ cstrahan zimbatm ma27 ];
     platforms   = platforms.unix;
   };
 }
diff --git a/pkgs/development/tools/pipenv/default.nix b/pkgs/development/tools/pipenv/default.nix
index 4176db2940cf..5f9e122c16a9 100644
--- a/pkgs/development/tools/pipenv/default.nix
+++ b/pkgs/development/tools/pipenv/default.nix
@@ -18,11 +18,11 @@ let
 
 in buildPythonApplication rec {
   pname = "pipenv";
-  version = "2020.5.28";
+  version = "2020.6.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "072lc4nywcf9q9irvanwcz7w0sd9dcyannz208jm6glyj8a271l1";
+    sha256 = "12s7c3f3k5v1szdhklsxwisf9v3dk4mb9fh7762afpgs8mrrmm3x";
   };
 
   LC_ALL = "en_US.UTF-8";
diff --git a/pkgs/development/tools/yq-go/default.nix b/pkgs/development/tools/yq-go/default.nix
index 882199a82a93..fc6fcd234850 100644
--- a/pkgs/development/tools/yq-go/default.nix
+++ b/pkgs/development/tools/yq-go/default.nix
@@ -1,17 +1,26 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
 
 buildGoModule rec {
   pname = "yq-go";
-  version = "3.3.0";
+  version = "3.3.1";
 
   src = fetchFromGitHub {
     owner = "mikefarah";
     rev = version;
     repo = "yq";
-    sha256 = "1jll5nmskvs61031h3sizhv3scv8znrr9apyc4qlxcp4jiv7xpmp";
+    sha256 = "0fr6zwnij3r53dqdw43qfmp4nw26gv6zmj066l44fazka4fl25i6";
   };
 
-  vendorSha256 = "0rlvbyhl53x1bhwr7f7zs4swa580saak19z3d3g58srq3jyw6zlc";
+  vendorSha256 = "1bjy3qr26zndr3dhh9gd33rhm5gy779525qgzjw4a4mla0p2q6kl";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    for shell in bash fish zsh; do
+      $out/bin/yq shell-completion --variation $shell > yq.$shell
+      installShellCompletion yq.$shell
+    done
+  '';
 
   meta = with lib; {
     description = "Portable command-line YAML processor";
@@ -19,4 +28,4 @@ buildGoModule rec {
     license = [ licenses.mit ];
     maintainers = [ maintainers.lewo ];
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/development/web/deno/default.nix b/pkgs/development/web/deno/default.nix
index 629c1eeb41a1..28e438fa1e95 100644
--- a/pkgs/development/web/deno/default.nix
+++ b/pkgs/development/web/deno/default.nix
@@ -3,52 +3,34 @@
 , fetchFromGitHub
 , rust
 , rustPlatform
-, python27
 , installShellFiles
 , Security
 , CoreServices
 }:
 let
+  deps = import ./deps.nix { };
+  arch = rust.toRustTarget stdenv.hostPlatform;
+  rustyV8Lib = with deps.rustyV8Lib; fetchurl {
+    url = "https://github.com/denoland/rusty_v8/releases/download/v${version}/librusty_v8_release_${arch}.a";
+    sha256 = sha256s."${stdenv.hostPlatform.system}";
+    meta = { inherit version; };
+  };
+in
+rustPlatform.buildRustPackage rec {
   pname = "deno";
-  version = "1.0.0";
+  version = "1.0.5";
 
-  denoSrc = fetchFromGitHub {
+  src = fetchFromGitHub {
     owner = "denoland";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0k8mqy1hf9hkp60jhd0x4z814y36g51083b3r7prc69ih2523hd1";
-
+    sha256 = "1hlmgcppr01bddvp28js010hhlzyx2lm7g7lq9nrcjazfw7kd2pf";
     fetchSubmodules = true;
   };
-  cargoSha256 = "1fjl07qqvl1f20qazcqxh32xmdfh80jni7i3jzvz6vgsfw1g5cmk";
-
-  rustyV8Lib = fetchlib "rusty_v8" "0.4.2" {
-    x86_64-linux = "1ac6kv3kv087df6kdgfd7kbh24187cg9z7xhbz6rw6jjv4ci2zbi";
-    aarch64-linux = "06iyjx4p4vp2i81wdy0vxai2k18pki972ff7k0scjqrgmnav1p8k";
-    x86_64-darwin = "02hwbpsqdzb9mvfndgykvv44f1jig3w3a26l0h26hs5shsrp47jv";
-  };
-
-  arch = rust.toRustTarget stdenv.hostPlatform;
-  fetchlib = name: version: sha256: fetchurl {
-    url = "https://github.com/denoland/${name}/releases/download/v${version}/librusty_v8_release_${arch}.a";
-    sha256 = sha256."${stdenv.hostPlatform.system}";
-    meta = { inherit version; };
-  };
-in
-rustPlatform.buildRustPackage rec {
-  inherit pname version cargoSha256;
-
-  src = denoSrc;
+  cargoSha256 = "1jqaryr7np6h65a1bqr952h0vllsvd6v6v6wvivc7933dcbhdal4";
 
-  nativeBuildInputs = [
-    # chromium/V8 requires python 2.7, we're not building V8 from source
-    # but as a result rusty_v8's download script also uses python 2.7
-    # tracking issue: https://bugs.chromium.org/p/chromium/issues/detail?id=942720
-    python27
-
-    # Install completions post-install
-    installShellFiles
-  ];
+  # Install completions post-install
+  nativeBuildInputs = [ installShellFiles ];
 
   buildInputs = with stdenv.lib; [ ]
     ++ optionals stdenv.isDarwin [ Security CoreServices ];
@@ -56,16 +38,6 @@ rustPlatform.buildRustPackage rec {
   # The rusty_v8 package will try to download a `librusty_v8.a` release at build time to our read-only filesystem
   # To avoid this we pre-download the file and place it in the locations it will require it in advance
   preBuild = ''
-    # Check the rusty_v8 lib downloaded matches the Cargo.lock file
-    rusty_v8_ver="$(grep 'name = "rusty_v8"' -A 1 Cargo.lock | grep "version =" | cut -d\" -f2)"
-    if [ "${rustyV8Lib.meta.version}" != "$rusty_v8_ver" ]; then
-      printf "%s\n" >&2 \
-        "version mismatch between 'rusty_v8' in Cargo.lock and downloaded library:" \
-        "  wanted: ${rustyV8Lib.meta.version}" \
-        "  got:    $rusty_v8_ver"
-      exit 1
-    fi;
-
     _rusty_v8_setup() {
       for v in "$@"; do
         dir="target/$v/gn_out/obj"
@@ -77,40 +49,9 @@ rustPlatform.buildRustPackage rec {
     _rusty_v8_setup "debug" "release" "${arch}/release"
   '';
 
-  # Set home to existing env var TMP dir so tests that write there work correctly
-  preCheck = ''
-    export HOME="$TMPDIR"
-  '';
-
-  checkFlags = [
-    # Strace not allowed on hydra
-    "--skip benchmark_test"
-
-    # Tests that try to write to `/build/source/target/debug`
-    "--skip _017_import_redirect"
-    "--skip https_import"
-    "--skip js_unit_tests"
-    "--skip lock_write_fetch"
-
-    # Cargo test runs a deno test on the std lib with sub-benchmarking-tests,
-    # The sub-sub-tests that are failing:
-    # forAwaitFetchDenolandX10, promiseAllFetchDenolandX10is
-    # Trying to access https://deno.land/ on build's limited network access
-    "--skip std_tests"
-
-    # Fails on aarch64 machines
-    # tracking issue: https://github.com/denoland/deno/issues/5324
-    "--skip run_v8_flags"
-
-    # Skip for multiple reasons:
-    # downloads x86_64 binary on aarch64 machines
-    # tracking issue: https://github.com/denoland/deno/pull/5402
-    # downloads a binary that needs ELF patching & tries to run imediately
-    # upgrade will likely never work with nix as it tries to replace itself
-    # code: https://github.com/denoland/deno/blob/v1.0.0/cli/upgrade.rs#L211
-    "--skip upgrade_in_tmpdir"
-    "--skip upgrade_with_version_in_tmpdir"
-  ];
+  # Tests have some inconsistencies between runs with output integration tests
+  # Skipping until resolved
+  doCheck = false;
 
   # TODO: Move to enhanced installShellCompletion when merged: PR #83630
   postInstall = ''
@@ -120,8 +61,11 @@ rustPlatform.buildRustPackage rec {
     installShellCompletion deno.{bash,fish} --zsh _deno
   '';
 
+  passthru.updateScript = ./update/update.ts;
+
   meta = with stdenv.lib; {
     homepage = "https://deno.land/";
+    changelog = "${src.meta.homepage}/releases/tag/v${version}";
     description = "A secure runtime for JavaScript and TypeScript";
     longDescription = ''
       Deno aims to be a productive and secure scripting environment for the modern programmer.
diff --git a/pkgs/development/web/deno/deps.nix b/pkgs/development/web/deno/deps.nix
new file mode 100644
index 000000000000..9218e8ad97d2
--- /dev/null
+++ b/pkgs/development/web/deno/deps.nix
@@ -0,0 +1,12 @@
+# auto-generated file -- DO NOT EDIT!
+{}:
+rec {
+  rustyV8Lib = {
+    version = "0.5.0";
+    sha256s = {
+      x86_64-linux = "1jmrqf5ns2y51cxx9r88my15m6gc6wmg54xadi3kphq47n4hmdfw";
+      aarch64-linux = "14v57pxpkz1fs483rbbc8k55rc4x41dqi0k12zdrjwa5ycdam3m5";
+      x86_64-darwin = "0466px7k2zvbsswwcrr342i5ml669gf76xd8yzzypsmb7l71s6vr";
+    };
+  };
+}
diff --git a/pkgs/development/web/deno/update/common.ts b/pkgs/development/web/deno/update/common.ts
new file mode 100644
index 000000000000..71e4d638f8d7
--- /dev/null
+++ b/pkgs/development/web/deno/update/common.ts
@@ -0,0 +1,52 @@
+interface GHRelease {
+  tag_name: string;
+}
+
+const decode = (buffer: Uint8Array) => new TextDecoder("utf-8").decode(buffer);
+const run = async (command: string, args: string[]) => {
+  const cmd = Deno.run(
+    { cmd: [command, ...args], stdout: "piped", stderr: "piped" },
+  );
+  if (!(await cmd.status()).success) {
+    throw await cmd.stderrOutput().then((b) => decode(b));
+  }
+  return cmd.output().then((b) => decode(b).trimEnd());
+};
+
+// Exports
+export const versionRegExp = /\d+\.\d+\.\d+/;
+export const sha256RegExp = /[a-z0-9]{52}/;
+
+export async function commit(
+  name: string,
+  oldVer: string,
+  newVer: string,
+  files: string[],
+) {
+  await run("git", ["add", ...files]);
+  await run("git", ["commit", "-m", `${name}: ${oldVer} -> ${newVer}`]);
+}
+
+export const getExistingVersion = async (filePath: string) =>
+  read(filePath).then((s) =>
+    s.match(genValueRegExp("version", versionRegExp))?.shift() || ""
+  );
+
+export const getLatestVersion = (owner: string, repo: string) =>
+  fetch(`https://api.github.com/repos/${owner}/${repo}/releases`)
+    .then((res) => res.json())
+    .then((res: GHRelease[]) => res[0].tag_name);
+
+// The (?<=) and (?=) allow replace to only change inside
+// Match the regex passed in or empty
+export const genValueRegExp = (key: string, regex: RegExp) =>
+  new RegExp(`(?<=${key} = ")(${regex.source}|)(?=")`);
+
+export const logger = (name: string) =>
+  (...a: any) => console.log(`[${name}]`, ...a);
+
+export const nixPrefetch = (args: string[]) => run("nix-prefetch", args);
+export const nixPrefetchURL = (args: string[]) => run("nix-prefetch-url", args);
+
+export const read = Deno.readTextFile;
+export const write = Deno.writeTextFile;
diff --git a/pkgs/development/web/deno/update/deps.ts b/pkgs/development/web/deno/update/deps.ts
new file mode 100644
index 000000000000..beedeade3a86
--- /dev/null
+++ b/pkgs/development/web/deno/update/deps.ts
@@ -0,0 +1,79 @@
+import {
+  getExistingVersion,
+  genValueRegExp,
+  logger,
+  nixPrefetchURL,
+  versionRegExp,
+  write,
+} from "./common.ts";
+
+const log = logger("deps");
+
+export interface Architecture {
+  nix: string;
+  rust: string;
+}
+interface PrefetchResult {
+  arch: Architecture;
+  sha256: string;
+}
+
+const getRustyV8Version = async (
+  owner: string,
+  repo: string,
+  version: string,
+) =>
+  fetch(
+    `https://github.com/${owner}/${repo}/raw/${version}/core/Cargo.toml`,
+  )
+    .then((res) => res.text())
+    .then((txt) =>
+      txt.match(genValueRegExp("rusty_v8", versionRegExp))?.shift()
+    );
+
+const archShaTasks = (version: string, arches: Architecture[]) =>
+  arches.map(async (arch: Architecture): Promise<PrefetchResult> => {
+    log("Fetching:", arch.nix);
+    const sha256 = await nixPrefetchURL(
+      [`https://github.com/denoland/rusty_v8/releases/download/v${version}/librusty_v8_release_${arch.rust}.a`],
+    );
+    log("Done:    ", arch.nix);
+    return { arch, sha256 };
+  });
+
+const templateDeps = (version: string, deps: PrefetchResult[]) =>
+  `# auto-generated file -- DO NOT EDIT!
+{}:
+rec {
+  rustyV8Lib = {
+    version = "${version}";
+    sha256s = {
+${deps.map((d) => `      ${d.arch.nix} = "${d.sha256}";`).join("\n")}
+    };
+  };
+}
+`;
+
+export async function updateDeps(
+  filePath: string,
+  owner: string,
+  repo: string,
+  denoVersion: string,
+  arches: Architecture[],
+) {
+  log("Starting deps update");
+  // 0.0.0
+  const version = await getRustyV8Version(owner, repo, denoVersion);
+  if (typeof version !== "string") {
+    throw "no rusty_v8 version";
+  }
+  log("rusty_v8 version:", version);
+  const existingVersion = await getExistingVersion(filePath);
+  if (version === existingVersion) {
+    log("Version already matches latest, skipping...");
+    return;
+  }
+  const archShaResults = await Promise.all(archShaTasks(version, arches));
+  await write(filePath, templateDeps(version, archShaResults));
+  log("Finished deps update");
+}
diff --git a/pkgs/development/web/deno/update/src.ts b/pkgs/development/web/deno/update/src.ts
new file mode 100644
index 000000000000..fae15acd0d2c
--- /dev/null
+++ b/pkgs/development/web/deno/update/src.ts
@@ -0,0 +1,67 @@
+import {
+  genValueRegExp,
+  logger,
+  nixPrefetch,
+  read,
+  sha256RegExp,
+  versionRegExp,
+  write,
+} from "./common.ts";
+
+interface Replacer {
+  regex: RegExp;
+  value: string;
+}
+
+const log = logger("src");
+
+const prefetchSha256 = (nixpkgs: string, version: string) =>
+  nixPrefetch(["-f", nixpkgs, "deno.src", "--rev", version]);
+const prefetchCargoSha256 = (nixpkgs: string) =>
+  nixPrefetch(
+    [`{ sha256 }: (import ${nixpkgs} {}).deno.cargoDeps.overrideAttrs (_: { outputHash = sha256; })`],
+  );
+
+const replace = (str: string, replacers: Replacer[]) =>
+  replacers.reduce(
+    (str, r) => str.replace(r.regex, r.value),
+    str,
+  );
+
+const updateNix = (filePath: string, replacers: Replacer[]) =>
+  read(filePath).then((str) => write(filePath, replace(str, replacers)));
+
+const genVerReplacer = (k: string, value: string): Replacer => (
+  { regex: genValueRegExp(k, versionRegExp), value }
+);
+const genShaReplacer = (k: string, value: string): Replacer => (
+  { regex: genValueRegExp(k, sha256RegExp), value }
+);
+
+export async function updateSrc(
+  filePath: string,
+  nixpkgs: string,
+  denoVersion: string,
+) {
+  log("Starting src update");
+  const trimVersion = denoVersion.substr(1);
+  log("Fetching sha256 for:", trimVersion);
+  const sha256 = await prefetchSha256(nixpkgs, denoVersion);
+  log("sha256 to update:", sha256);
+  await updateNix(
+    filePath,
+    [
+      genVerReplacer("version", trimVersion),
+      genShaReplacer("sha256", sha256),
+      genShaReplacer("cargoSha256", ""), // Empty ready for prefetchCargoSha256
+    ],
+  );
+  log("Fetching cargoSha256 for:", sha256);
+  const cargoSha256 = await prefetchCargoSha256(nixpkgs);
+  log("cargoSha256 to update:", cargoSha256);
+  await updateNix(
+    filePath,
+    [genShaReplacer("cargoSha256", cargoSha256)],
+  );
+  log("Finished src update");
+}
diff --git a/pkgs/development/web/deno/update/update.ts b/pkgs/development/web/deno/update/update.ts
new file mode 100755
index 000000000000..ab13cee9dbe2
--- /dev/null
+++ b/pkgs/development/web/deno/update/update.ts
@@ -0,0 +1,50 @@
+#!/usr/bin/env nix-shell
+/*
+#!nix-shell -i "deno run --allow-net --allow-run --allow-read --allow-write" -p deno git nix-prefetch nix-prefetch-url
+*/
+import {
+  commit,
+  getExistingVersion,
+  getLatestVersion,
+  logger,
+} from "./common.ts";
+import { Architecture, updateDeps } from "./deps.ts";
+import { updateSrc } from "./src.ts";
+
+const log = logger("update");
+// TODO: Getting current file position to more-safely point to nixpkgs root
+const nixpkgs = Deno.cwd();
+// TODO: Read values from default.nix
+const owner = "denoland";
+const repo = "deno";
+const denoDir = `${nixpkgs}/pkgs/development/web/${repo}`;
+const src = `${denoDir}/default.nix`;
+const deps = `${denoDir}/deps.nix`;
+const architectures: Architecture[] = [
+  { nix: "x86_64-linux", rust: "x86_64-unknown-linux-gnu" },
+  { nix: "aarch64-linux", rust: "aarch64-unknown-linux-gnu" },
+  { nix: "x86_64-darwin", rust: "x86_64-apple-darwin" },
+];
+
+log("Updating deno");
+
+log("Getting latest deno version");
+const version = await getLatestVersion(owner, repo);
+const existingVersion = await getExistingVersion(src);
+const trimVersion = version.substr(1); // Strip v from v0.0.0
+log("Latest version:   ", trimVersion);
+log("Extracted version:", existingVersion);
+if (trimVersion === existingVersion) {
+  log("Version already matches latest, skipping...");
+  Deno.exit(0);
+}
+
+const tasks = [
+  updateSrc(src, nixpkgs, version),
+  updateDeps(deps, owner, repo, version, architectures),
+];
+await Promise.all(tasks);
+log("Updating deno complete");
+log("Commiting");
+await commit(repo, existingVersion, trimVersion, [src, deps]);
+log("Done");
diff --git a/pkgs/misc/emulators/wine/staging.nix b/pkgs/misc/emulators/wine/staging.nix
index 5c2469f8f44e..48ea93a97a8e 100644
--- a/pkgs/misc/emulators/wine/staging.nix
+++ b/pkgs/misc/emulators/wine/staging.nix
@@ -7,7 +7,7 @@ let patch = (callPackage ./sources.nix {}).staging;
       (mkBuildInputs wineUnstable.pkgArches pkgNames) ++ extra;
 in assert stdenv.lib.getVersion wineUnstable == patch.version;
 
-stdenv.lib.overrideDerivation wineUnstable (self: {
+(stdenv.lib.overrideDerivation wineUnstable (self: {
   buildInputs = build-inputs [ "perl" "utillinux" "autoconf" ] self.buildInputs;
 
   name = "${self.name}-staging";
@@ -21,4 +21,8 @@ stdenv.lib.overrideDerivation wineUnstable (self: {
     ./patchinstall.sh DESTDIR="$PWD/.." --all
     cd ..
   '';
-})
+})) // {
+  meta = wineUnstable.meta // {
+    description = wineUnstable.meta.description + " (with staging patches)";
+  };
+}
diff --git a/pkgs/misc/vim-plugins/overrides.nix b/pkgs/misc/vim-plugins/overrides.nix
index 73c5690b1927..d9a68b90041e 100644
--- a/pkgs/misc/vim-plugins/overrides.nix
+++ b/pkgs/misc/vim-plugins/overrides.nix
@@ -24,6 +24,7 @@
 , gomodifytags, gotags, gotools, go-motion
 , gnused, reftools, gogetdoc, golangci-lint
 , impl, iferr, gocode, gocode-gomod, go-tools
+, gopls
 
 # direnv-vim dependencies
 , direnv
@@ -593,6 +594,7 @@ self: super: {
       golint
       golangci-lint
       gomodifytags
+      gopls
       gotags
       gotools
       iferr
diff --git a/pkgs/os-specific/linux/ffado/default.nix b/pkgs/os-specific/linux/ffado/default.nix
index 5dc5086a8c61..e814091d59e2 100644
--- a/pkgs/os-specific/linux/ffado/default.nix
+++ b/pkgs/os-specific/linux/ffado/default.nix
@@ -24,11 +24,11 @@ let
 in
 mkDerivation rec {
   pname = "ffado";
-  version = "2.4.2";
+  version = "2.4.3";
 
   src = fetchurl {
     url = "http://www.ffado.org/files/libffado-${version}.tgz";
-    sha256 = "09dxy6fkfnvzk45lpr74hkqymii8a45jzlq6054f3jz65m8qvj3d";
+    sha256 = "08bygzv1k6ai0572gv66h7gfir5zxd9klfy74z2pxqp6s5hms58r";
   };
 
   prePatch = ''
diff --git a/pkgs/os-specific/linux/kernel/hardened/config.nix b/pkgs/os-specific/linux/kernel/hardened/config.nix
index 95510fe218e3..c817f1044271 100644
--- a/pkgs/os-specific/linux/kernel/hardened/config.nix
+++ b/pkgs/os-specific/linux/kernel/hardened/config.nix
@@ -40,11 +40,12 @@ assert (versionAtLeast version "4.9");
   # Perform additional validation of commonly targeted structures.
   DEBUG_CREDENTIALS     = yes;
   DEBUG_NOTIFIERS       = yes;
-  DEBUG_PI_LIST         = yes; # doesn't BUG()
+  DEBUG_PI_LIST         = whenOlder "5.2" yes; # doesn't BUG()
+  DEBUG_PLIST           = whenAtLeast "5.2" yes;
   DEBUG_SG              = yes;
   SCHED_STACK_END_CHECK = yes;
 
-  REFCOUNT_FULL = whenAtLeast "4.13" yes;
+  REFCOUNT_FULL = whenBetween "4.13" "5.5" yes;
 
   # Randomize page allocator when page_alloc.shuffle=1
   SHUFFLE_PAGE_ALLOCATOR = whenAtLeast "5.2" yes;
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index a25057043f84..2e4ea7478065 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -5,18 +5,18 @@
         "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.183.a/linux-hardened-4.14.183.a.patch"
     },
     "4.19": {
-        "name": "linux-hardened-4.19.126.a.patch",
-        "sha256": "1wr4spaqgh404w0fqpys8xwj11as86j0cfzb903c0rx6lhqfp6sf",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.126.a/linux-hardened-4.19.126.a.patch"
+        "name": "linux-hardened-4.19.127.a.patch",
+        "sha256": "00nfcs5yn2a70an3ygzzv4s3qa3hf7pni4ad70aw87vyvrqlyx3k",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.127.a/linux-hardened-4.19.127.a.patch"
     },
     "5.4": {
-        "name": "linux-hardened-5.4.44.a.patch",
+        "name": "linux-hardened-5.4.45.a.patch",
         "sha256": "0gihrcxqg3hax20xhvna4lmgsivari6wwsyqz09w34v8p1fhd5nx",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.44.a/linux-hardened-5.4.44.a.patch"
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.45.a/linux-hardened-5.4.45.a.patch"
     },
     "5.6": {
-        "name": "linux-hardened-5.6.16.a.patch",
+        "name": "linux-hardened-5.6.17.a.patch",
         "sha256": "0nci30k7xh56b6454cd0hkpvpkfqb98cqdpvjaamlnmiphz4sk1f",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.6.16.a/linux-hardened-5.6.16.a.patch"
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.6.17.a/linux-hardened-5.6.17.a.patch"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index e80b8f765748..7ee05ed47ded 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.183";
+  version = "4.14.184";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "11c0vd2pwplm8wafich4zg2mnp10vvnap987c5jh96w1avpsyra2";
+    sha256 = "0h6r06c1d7amkfglsr66ic89p0zxpmk7jkq1ylcbknmkiwkixx9g";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index 2d673ba2f91f..92281ffdd3e6 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.19.127";
+  version = "4.19.128";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0vsq5vjyh6n8acjnldfs0zny63l12fn2pssb8zbwidc8qmmqibw2";
+    sha256 = "0g31ad3wziy4xqna0yvwjcnza3jhd93syjpfvmwh0b4pkj2adar9";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 125f8f723c55..fe0406233169 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.226";
+  version = "4.4.227";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1dwvm81i62b06jsl38spfn719zrsbwq5z8viwckrpw4ma4w9k0j1";
+    sha256 = "196x57w740firg8zchypq4vq6a83ymmwn9amqrscym9zr0pcgm40";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 88809a74b7b8..5be2d7ac9bd9 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.226";
+  version = "4.9.227";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1jj5ydz5cy87z7hrv54bkyl9739lpzja8580ngjhrip5iwb8q2j6";
+    sha256 = "0pqc0wld4s4zjas95xm54mrkk00l9zkc59b6i9gq4km126s8bi1q";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index 4a88e7938666..1c5bfad41681 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.4.45";
+  version = "5.4.46";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0bpy2lb3bqmkaqxzdmssgmhbjsys7d3lyfv4x919q0596jgh6gqh";
+    sha256 = "13hvnfdcbcb9a21zizq8d90mc8maxz03zmzsj6iqsjd2y7r4y1rh";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.6.nix b/pkgs/os-specific/linux/kernel/linux-5.6.nix
index 61c960102a34..bf245442ecef 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.6.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.6.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.6.17";
+  version = "5.6.18";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "17kzalz8z6svv6nwa3dbmf7nyvpb2wwwyabj19vdwf6v05a28fn3";
+    sha256 = "0cpiyzr62sv2yz0mla7skalb04pnr4nlkpi1zfcfzyjf1gjz8h8h";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.7.nix b/pkgs/os-specific/linux/kernel/linux-5.7.nix
index 81f4d4b3553d..c7f1389f1128 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.7.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.7.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.7.1";
+  version = "5.7.2";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1vcxrrb2i4366iciw0mfahwbdrzmhrrsr7gi4vdkzznfv2niils0";
+    sha256 = "02brxm78n0kg4mh48acvjsr7mpvaqd279ycyaixaflid1s1awrb0";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/lxcfs/default.nix b/pkgs/os-specific/linux/lxcfs/default.nix
index 68d05f0be65d..4011b3885625 100644
--- a/pkgs/os-specific/linux/lxcfs/default.nix
+++ b/pkgs/os-specific/linux/lxcfs/default.nix
@@ -1,4 +1,5 @@
 { config, stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, help2man, fuse
+, utillinux, makeWrapper
 , enableDebugBuild ? config.lxcfs.enableDebugBuild or false }:
 
 with stdenv.lib;
@@ -13,7 +14,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkgconfig help2man autoreconfHook ];
-  buildInputs = [ fuse ];
+  buildInputs = [ fuse makeWrapper ];
 
   preConfigure = stdenv.lib.optionalString enableDebugBuild ''
     sed -i 's,#AM_CFLAGS += -DDEBUG,AM_CFLAGS += -DDEBUG,' Makefile.am
@@ -27,6 +28,12 @@ stdenv.mkDerivation rec {
 
   installFlags = [ "SYSTEMD_UNIT_DIR=\${out}/lib/systemd" ];
 
+  postInstall = ''
+    # `mount` hook requires access to the `mount` command from `utillinux`:
+    wrapProgram "$out/share/lxcfs/lxc.mount.hook" \
+      --prefix PATH : "${utillinux}/bin"
+  '';
+
   postFixup = ''
     # liblxcfs.so is reloaded with dlopen()
     patchelf --set-rpath "$(patchelf --print-rpath "$out/bin/lxcfs"):$out/lib" "$out/bin/lxcfs"
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index aff2e9dc0cb9..a87c6947a1a1 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,10 +2,11 @@
 # Do not edit!
 
 {
-  version = "0.110.1";
+  version = "0.111.0";
   components = {
     "abode" = ps: with ps; [ ]; # missing inputs: abodepy
     "acer_projector" = ps: with ps; [ pyserial];
+    "acmeda" = ps: with ps; [ ]; # missing inputs: aiopulse
     "actiontec" = ps: with ps; [ ];
     "adguard" = ps: with ps; [ ]; # missing inputs: adguardhome
     "ads" = ps: with ps; [ ]; # missing inputs: pyads
@@ -56,7 +57,6 @@
     "aurora" = ps: with ps; [ ];
     "aurora_abb_powerone" = ps: with ps; [ ]; # missing inputs: aurorapy
     "auth" = ps: with ps; [ aiohttp-cors];
-    "automatic" = ps: with ps; [ aiohttp-cors]; # missing inputs: aioautomatic
     "automation" = ps: with ps; [ ];
     "avea" = ps: with ps; [ ]; # missing inputs: avea
     "avion" = ps: with ps; [ ]; # missing inputs: avion
@@ -107,6 +107,7 @@
     "cast" = ps: with ps; [ PyChromecast];
     "cert_expiry" = ps: with ps; [ ];
     "channels" = ps: with ps; [ ]; # missing inputs: pychannels
+    "circuit" = ps: with ps; [ ]; # missing inputs: circuit-webhook
     "cisco_ios" = ps: with ps; [ pexpect];
     "cisco_mobility_express" = ps: with ps; [ ]; # missing inputs: ciscomobilityexpress
     "cisco_webex_teams" = ps: with ps; [ ]; # missing inputs: webexteamssdk
@@ -276,7 +277,6 @@
     "garmin_connect" = ps: with ps; [ ]; # missing inputs: garminconnect
     "gc100" = ps: with ps; [ ]; # missing inputs: python-gc100
     "gdacs" = ps: with ps; [ ]; # missing inputs: aio_georss_gdacs
-    "gearbest" = ps: with ps; [ ]; # missing inputs: gearbest_parser
     "geizhals" = ps: with ps; [ ]; # missing inputs: geizhals
     "generic" = ps: with ps; [ ];
     "generic_thermostat" = ps: with ps; [ ];
@@ -294,7 +294,7 @@
     "glances" = ps: with ps; [ ]; # missing inputs: glances_api
     "gntp" = ps: with ps; [ ]; # missing inputs: gntp
     "goalfeed" = ps: with ps; [ ]; # missing inputs: pysher
-    "gogogate2" = ps: with ps; [ ]; # missing inputs: pygogogate2
+    "gogogate2" = ps: with ps; [ ]; # missing inputs: gogogate2-api
     "google" = ps: with ps; [ google_api_python_client httplib2 oauth2client];
     "google_assistant" = ps: with ps; [ aiohttp-cors];
     "google_cloud" = ps: with ps; [ google_cloud_texttospeech];
@@ -315,6 +315,7 @@
     "growatt_server" = ps: with ps; [ ]; # missing inputs: growattServer
     "gstreamer" = ps: with ps; [ ]; # missing inputs: gstreamer-player
     "gtfs" = ps: with ps; [ ]; # missing inputs: pygtfs
+    "guardian" = ps: with ps; [ ]; # missing inputs: aioguardian
     "habitica" = ps: with ps; [ ]; # missing inputs: habitipy
     "hangouts" = ps: with ps; [ ]; # missing inputs: hangups
     "harman_kardon_avr" = ps: with ps; [ ]; # missing inputs: hkavr
@@ -372,7 +373,7 @@
     "input_number" = ps: with ps; [ ];
     "input_select" = ps: with ps; [ ];
     "input_text" = ps: with ps; [ ];
-    "insteon" = ps: with ps; [ ]; # missing inputs: insteonplm
+    "insteon" = ps: with ps; [ ]; # missing inputs: pyinsteon
     "integration" = ps: with ps; [ ];
     "intent" = ps: with ps; [ aiohttp-cors];
     "intent_script" = ps: with ps; [ ];
@@ -599,7 +600,7 @@
     "plaato" = ps: with ps; [ aiohttp-cors];
     "plant" = ps: with ps; [ ];
     "plex" = ps: with ps; [ aiohttp-cors plexapi plexauth plexwebsocket];
-    "plugwise" = ps: with ps; [ ]; # missing inputs: haanna
+    "plugwise" = ps: with ps; [ ]; # missing inputs: Plugwise_Smile
     "plum_lightpad" = ps: with ps; [ ]; # missing inputs: plumlightpad
     "pocketcasts" = ps: with ps; [ ]; # missing inputs: pocketcasts
     "point" = ps: with ps; [ aiohttp-cors]; # missing inputs: pypoint
@@ -732,7 +733,7 @@
     "soma" = ps: with ps; [ ]; # missing inputs: pysoma
     "somfy" = ps: with ps; [ aiohttp-cors]; # missing inputs: pymfy
     "somfy_mylink" = ps: with ps; [ ]; # missing inputs: somfy-mylink-synergy
-    "sonarr" = ps: with ps; [ ];
+    "sonarr" = ps: with ps; [ ]; # missing inputs: sonarr
     "songpal" = ps: with ps; [ ]; # missing inputs: python-songpal
     "sonos" = ps: with ps; [ pysonos];
     "sony_projector" = ps: with ps; [ ]; # missing inputs: pysdcp
@@ -904,9 +905,8 @@
     "worxlandroid" = ps: with ps; [ ];
     "wsdot" = ps: with ps; [ ];
     "wunderground" = ps: with ps; [ ];
-    "wunderlist" = ps: with ps; [ ]; # missing inputs: wunderpy2
-    "wwlln" = ps: with ps; [ ]; # missing inputs: aiowwlln
     "x10" = ps: with ps; [ ];
+    "xbee" = ps: with ps; [ ]; # missing inputs: xbee-helper
     "xbox_live" = ps: with ps; [ ]; # missing inputs: xboxapi
     "xeoma" = ps: with ps; [ ]; # missing inputs: pyxeoma
     "xfinity" = ps: with ps; [ ]; # missing inputs: xfinity-gateway
@@ -934,7 +934,6 @@
     "zestimate" = ps: with ps; [ xmltodict];
     "zha" = ps: with ps; [ pyserial zha-quirks zigpy-deconz]; # missing inputs: bellows zigpy-cc zigpy-xbee zigpy-zigate zigpy
     "zhong_hong" = ps: with ps; [ ]; # missing inputs: zhong_hong_hvac
-    "zigbee" = ps: with ps; [ ]; # missing inputs: xbee-helper
     "ziggo_mediabox_xl" = ps: with ps; [ ]; # missing inputs: ziggo-mediabox-xl
     "zone" = ps: with ps; [ ];
     "zoneminder" = ps: with ps; [ zm-py];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 2d6d73474558..33fbbf663102 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -67,7 +67,7 @@ let
   extraBuildInputs = extraPackages py.pkgs;
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "0.110.1";
+  hassVersion = "0.111.0";
 
 in with py.pkgs; buildPythonApplication rec {
   pname = "homeassistant";
@@ -86,7 +86,7 @@ in with py.pkgs; buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = version;
-    sha256 = "1495kl997mvk9k11lk1ahv5w0yc0185qmxwa1h51j6d0zyqwz749";
+    sha256 = "0zg7fng3cfksn4hr8vixsmj8cbag8h4dg4qi69n56hc71rnpl9kw";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/servers/home-assistant/frontend.nix b/pkgs/servers/home-assistant/frontend.nix
index 3481a2d1bd90..a2445dad324b 100644
--- a/pkgs/servers/home-assistant/frontend.nix
+++ b/pkgs/servers/home-assistant/frontend.nix
@@ -4,11 +4,11 @@ buildPythonPackage rec {
   # the frontend version corresponding to a specific home-assistant version can be found here
   # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
   pname = "home-assistant-frontend";
-  version = "20200519.1";
+  version = "20200603.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "149v56q5anzdfxf0dw1h39vdmcigx732a7abqjfb0xny5484iq8w";
+    sha256 = "1p99f5q8frk5k5lh1gjxyq539p1iv9fslpbfirh8njx3d0a85l84";
   };
 
   # no Python tests implemented
diff --git a/pkgs/servers/mail/opensmtpd/default.nix b/pkgs/servers/mail/opensmtpd/default.nix
index 0c2cd68cb1be..c489f2b14f73 100644
--- a/pkgs/servers/mail/opensmtpd/default.nix
+++ b/pkgs/servers/mail/opensmtpd/default.nix
@@ -4,14 +4,14 @@
 
 stdenv.mkDerivation rec {
   pname = "opensmtpd";
-  version = "6.7.0p1";
+  version = "6.7.1p1";
 
   nativeBuildInputs = [ autoconf automake libtool bison ];
   buildInputs = [ libasr libevent zlib libressl db pam ];
 
   src = fetchurl {
     url = "https://www.opensmtpd.org/archives/${pname}-${version}.tar.gz";
-    sha256 = "1f8bp40ywyixflg5qbnang6l210bv4vqa1k2pgm2356bp7bmsgy1";
+    sha256 = "1jh8vxfajm1mvp1v5yh6llrhjzv0n9fgab88mlwllwqynhcfjy3l";
   };
 
   patches = [
diff --git a/pkgs/servers/mail/postfix/0001-Fix-build-with-glibc-2.30.patch b/pkgs/servers/mail/postfix/0001-Fix-build-with-glibc-2.30.patch
deleted file mode 100644
index 9613b8906a00..000000000000
--- a/pkgs/servers/mail/postfix/0001-Fix-build-with-glibc-2.30.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From a6a61d0dc018101a9a8d0a664f31140d7e38db0e Mon Sep 17 00:00:00 2001
-From: Maximilian Bosch <maximilian@mbosch.me>
-Date: Fri, 17 Jan 2020 01:42:40 +0100
-Subject: [PATCH] Fix build with glibc 2.30
-
-https://bugs.launchpad.net/ubuntu/+source/postfix/+bug/1842923
----
- src/dns/dns_str_resflags.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/src/dns/dns_str_resflags.c b/src/dns/dns_str_resflags.c
-index 5f2cce5..df32345 100644
---- a/src/dns/dns_str_resflags.c
-+++ b/src/dns/dns_str_resflags.c
-@@ -60,10 +60,16 @@ static const LONG_NAME_MASK resflag_table[] = {
-     "RES_DEFNAMES", RES_DEFNAMES,
-     "RES_STAYOPEN", RES_STAYOPEN,
-     "RES_DNSRCH", RES_DNSRCH,
-+#ifdef RES_INSECURE1
-     "RES_INSECURE1", RES_INSECURE1,
-+#endif
-+#ifdef RES_INSECURE2
-     "RES_INSECURE2", RES_INSECURE2,
-+#endif
-     "RES_NOALIASES", RES_NOALIASES,
-+#ifdef RES_USE_INET6
-     "RES_USE_INET6", RES_USE_INET6,
-+#endif
- #ifdef RES_ROTATE
-     "RES_ROTATE", RES_ROTATE,
- #endif
--- 
-2.23.1
-
diff --git a/pkgs/servers/mail/postfix/default.nix b/pkgs/servers/mail/postfix/default.nix
index 0386bcf2394b..3b14fab68753 100644
--- a/pkgs/servers/mail/postfix/default.nix
+++ b/pkgs/servers/mail/postfix/default.nix
@@ -26,11 +26,11 @@ in stdenv.mkDerivation rec {
 
   pname = "postfix";
 
-  version = "3.4.10";
+  version = "3.5.2";
 
   src = fetchurl {
     url = "ftp://ftp.cs.uu.nl/mirror/postfix/postfix-release/official/${pname}-${version}.tar.gz";
-    sha256 = "0m36wn5grm4cf8nnvlgsgwsm6v09xz01n7jnx13h0yjk73y6d2lh";
+    sha256 = "1hxy9458apnzfg4n0alncsdgy5dwzn5dbn4xm46iv15xynbj9gz3";
   };
 
   nativeBuildInputs = [ makeWrapper m4 ];
@@ -48,7 +48,6 @@ in stdenv.mkDerivation rec {
     ./postfix-3.0-no-warnings.patch
     ./post-install-script.patch
     ./relative-symlinks.patch
-    ./0001-Fix-build-with-glibc-2.30.patch
   ];
 
   postPatch = stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
diff --git a/pkgs/servers/mautrix-telegram/default.nix b/pkgs/servers/mautrix-telegram/default.nix
index 2b8c418a261e..da4f77e3394c 100644
--- a/pkgs/servers/mautrix-telegram/default.nix
+++ b/pkgs/servers/mautrix-telegram/default.nix
@@ -4,12 +4,12 @@ with python3.pkgs;
 
 buildPythonPackage rec {
   pname = "mautrix-telegram";
-  version = "0.8.0";
+  version = "0.8.1";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "10r644ddprnhadv2jfb1xxp0rcqi65n3hv7dv7j9znnnykgnwvls";
+    sha256 = "1gz6d28dq3ykvr3wp85wkc05lbppdzf5j9i62pgx0blmx3jh0yrk";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/metabase/default.nix b/pkgs/servers/metabase/default.nix
index 5d50f8c9b0c8..a85e6bbf71ea 100644
--- a/pkgs/servers/metabase/default.nix
+++ b/pkgs/servers/metabase/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "metabase";
-  version = "0.35.3";
+  version = "0.35.4";
 
   src = fetchurl {
     url = "http://downloads.metabase.com/v${version}/metabase.jar";
-    sha256 = "1iax99id47a8mkdyr5wp2dwvl0d1lfh9gsamd1m0qpxw9mbvpkbq";
+    sha256 = "1mggrkd4ih8fak4nk3a8z5677nblvihjvkvgmix080cps44bcfd8";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/monitoring/prometheus/keylight-exporter.nix b/pkgs/servers/monitoring/prometheus/keylight-exporter.nix
new file mode 100644
index 000000000000..e1be2a0bddc7
--- /dev/null
+++ b/pkgs/servers/monitoring/prometheus/keylight-exporter.nix
@@ -0,0 +1,22 @@
+{ stdenv, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "keylight-exporter";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "mdlayher";
+    repo = "keylight_exporter";
+    rev = "v${version}";
+    sha256 = "141npawcnxj3sz2xqsnyf06r4x1azk3g55941i8gjr7pwcla34r7";
+  };
+
+  vendorSha256 = "0w065ls8dp687jmps4xdffcarss1wyls14dngr43g58xjw6519gb";
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/mdlayher/keylight_exporter";
+    description = "Prometheus exporter for Elgato Key Light devices.";
+    license = licenses.mit;
+    maintainers = with maintainers; [ mdlayher ];
+  };
+}
diff --git a/pkgs/servers/monitoring/prometheus/lnd-exporter.nix b/pkgs/servers/monitoring/prometheus/lnd-exporter.nix
new file mode 100644
index 000000000000..225e7c575436
--- /dev/null
+++ b/pkgs/servers/monitoring/prometheus/lnd-exporter.nix
@@ -0,0 +1,22 @@
+{ stdenv, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "lndmon-unstable";
+  version = "2020-01-09";
+
+  src = fetchFromGitHub {
+    owner = "lightninglabs";
+    repo = "lndmon";
+    sha256 = "0d4z8yv2459wsi4c91qs5an13acn73fd8s321xya5vxxiyf51q24";
+    rev = "2c7c5ce0fcb4e7eef4df60efe8a644587a309f6c";
+  };
+
+  vendorSha256 = "083h2ksnqmcr48958r5pag9a28xvljpc3prip6wn70ifp2wpjpin";
+
+  meta = with stdenv.lib; {
+    inherit (src.meta) homepage;
+    description = "Prometheus exporter for lnd (Lightning Network Daemon)";
+    license = licenses.mit;
+    maintainers = with maintainers; [ mmilata ];
+  };
+}
diff --git a/pkgs/servers/roundcube/plugins/persistent_login/default.nix b/pkgs/servers/roundcube/plugins/persistent_login/default.nix
index b66386222f76..e210c1006845 100644
--- a/pkgs/servers/roundcube/plugins/persistent_login/default.nix
+++ b/pkgs/servers/roundcube/plugins/persistent_login/default.nix
@@ -2,12 +2,12 @@
 
 roundcubePlugin rec {
   pname = "persistent_login";
-  version = "5.1.0";
+  version = "5.2.0";
 
   src = fetchFromGitHub {
     owner = "mfreiholz";
     repo = pname;
     rev = "version-${version}";
-    sha256 = "1k2jgbshwig8q5l440y59pgwbfbc0pdrjbpihba834a4pm0y6anl";
+    sha256 = "0aasc2ns318s1g8vf2hhqwsplchhrhv5cd725rnfldim1y8k0n1i";
   };
 }
diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index 9c2134e211ff..d6e521343019 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -201,12 +201,12 @@ server = stdenv.mkDerivation (common // {
     chmod +x "$out"/bin/wsrep_sst_common
     rm "$out"/bin/{mariadb-client-test,mariadb-test,mysql_client_test,mysqltest}
     rm -r "$out"/data # Don't need testing data
-    mv "$out"/OFF/suite/plugins/pam/pam_mariadb_mtr.so "$out"/share/pam/lib/security
-    mv "$out"/OFF/suite/plugins/pam/mariadb_mtr "$out"/share/pam/etc/security
-    rm -r "$out"/OFF
   '' + optionalString withStorageMroonga ''
     mv "$out"/share/{groonga,groonga-normalizer-mysql} "$out"/share/doc/mysql
   '' + optionalString (!stdenv.hostPlatform.isDarwin) ''
+    mv "$out"/OFF/suite/plugins/pam/pam_mariadb_mtr.so "$out"/share/pam/lib/security
+    mv "$out"/OFF/suite/plugins/pam/mariadb_mtr "$out"/share/pam/etc/security
+    rm -r "$out"/OFF
     sed -i 's/-mariadb/-mysql/' "$out"/bin/galera_new_cluster
   '';
 
diff --git a/pkgs/shells/nushell/default.nix b/pkgs/shells/nushell/default.nix
index ecef2fc436e5..5994e2829ed6 100644
--- a/pkgs/shells/nushell/default.nix
+++ b/pkgs/shells/nushell/default.nix
@@ -10,21 +10,20 @@
 , AppKit
 , Security
 , withStableFeatures ? true
-, withTestBinaries ? true
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "nushell";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "1g289zma19mh85xl5ffq1f3cv76piqavbhzs9m55mkg9wrhmgljd";
+    sha256 = "1s08shhg826hbpcjzlhwj0r5qqckz8rv2xjg22rz1qvsjyhkmv7r";
   };
 
-  cargoSha256 = "16a32q2la7f4628m947dwif3j3wszsy603sj29ch6l2vdab40i3p";
+  cargoSha256 = "0lz7119znpxyaj9ac1skfbx0s0dkh3hwk00g0zjn3r6k8fh9gj4d";
 
   nativeBuildInputs = [ pkg-config ]
     ++ lib.optionals (withStableFeatures && stdenv.isLinux) [ python3 ];
@@ -36,19 +35,10 @@ rustPlatform.buildRustPackage rec {
 
   cargoBuildFlags = lib.optional withStableFeatures "--features stable";
 
-  cargoTestFlags = lib.optional withTestBinaries "--features test-bins";
-
   preCheck = ''
     export HOME=$TMPDIR
   '';
 
-  checkPhase = ''
-    runHook preCheck
-    echo "Running cargo cargo test ${lib.strings.concatStringsSep " " cargoTestFlags} -- ''${checkFlags} ''${checkFlagsArray+''${checkFlagsArray[@]}}"
-    cargo test ${lib.strings.concatStringsSep " " cargoTestFlags} -- ''${checkFlags} ''${checkFlagsArray+"''${checkFlagsArray[@]}"}
-    runHook postCheck
-  '';
-
   meta = with lib; {
     description = "A modern shell written in Rust";
     homepage = "https://www.nushell.sh/";
diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index c6c5be39d09b..c06f17b6fc19 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -107,11 +107,11 @@ let
 
         You can install it anyway by whitelisting this package, using the
         following methods:
-        
-        a) To temporarily allow all insecure packages, you can use an environment variable 
-           for a single invocation of the nix tools:
-           
-           $ export NIXPKGS_ALLOW_INSECURE=1
+
+        a) To temporarily allow all insecure packages, you can use an environment
+           variable for a single invocation of the nix tools:
+
+             $ export NIXPKGS_ALLOW_INSECURE=1
 
         b) for `nixos-rebuild` you can add ‘${getName attrs}’ to
            `nixpkgs.config.permittedInsecurePackages` in the configuration.nix,
@@ -124,8 +124,8 @@ let
              }
 
         c) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
-        ‘${getName attrs}’ to `permittedInsecurePackages` in
-        ~/.config/nixpkgs/config.nix, like so:
+           ‘${getName attrs}’ to `permittedInsecurePackages` in
+           ~/.config/nixpkgs/config.nix, like so:
 
              {
                permittedInsecurePackages = [
diff --git a/pkgs/tools/admin/lxd/default.nix b/pkgs/tools/admin/lxd/default.nix
index 43cd243561b5..562149414b3d 100644
--- a/pkgs/tools/admin/lxd/default.nix
+++ b/pkgs/tools/admin/lxd/default.nix
@@ -1,13 +1,21 @@
 { stdenv, hwdata, pkgconfig, lxc, buildGoPackage, fetchurl
 , makeWrapper, acl, rsync, gnutar, xz, btrfs-progs, gzip, dnsmasq
-, squashfsTools, iproute, iptables, ebtables, libcap, libco-canonical, dqlite
-, raft-canonical, sqlite-replication, udev
+, squashfsTools, iproute, iptables, ebtables, iptables-nftables-compat, libcap
+, libco-canonical, dqlite, raft-canonical, sqlite-replication, udev
 , writeShellScriptBin, apparmor-profiles, apparmor-parser
 , criu
 , bash
 , installShellFiles
+, nftablesSupport ? false
 }:
 
+let
+  networkPkgs = if nftablesSupport then
+    [ iptables-nftables-compat ]
+  else
+    [ iptables ebtables ];
+
+in
 buildGoPackage rec {
   pname = "lxd";
   version = "4.2";
@@ -38,12 +46,14 @@ buildGoPackage rec {
     # test binaries, code generation
     rm $out/bin/{deps,macaroon-identity,generate}
 
-    wrapProgram $out/bin/lxd --prefix PATH : ${stdenv.lib.makeBinPath [
-      acl rsync gnutar xz btrfs-progs gzip dnsmasq squashfsTools iproute iptables ebtables bash criu
-      (writeShellScriptBin "apparmor_parser" ''
-        exec '${apparmor-parser}/bin/apparmor_parser' -I '${apparmor-profiles}/etc/apparmor.d' "$@"
-      '')
-    ]}
+    wrapProgram $out/bin/lxd --prefix PATH : ${stdenv.lib.makeBinPath (
+      networkPkgs
+      ++ [ acl rsync gnutar xz btrfs-progs gzip dnsmasq squashfsTools iproute bash criu ]
+      ++ [ (writeShellScriptBin "apparmor_parser" ''
+             exec '${apparmor-parser}/bin/apparmor_parser' -I '${apparmor-profiles}/etc/apparmor.d' "$@"
+           '') ]
+      )
+    }
 
     installShellCompletion --bash go/src/github.com/lxc/lxd/scripts/bash/lxd-client
   '';
diff --git a/pkgs/tools/archivers/p7zip/12-CVE-2016-9296.patch b/pkgs/tools/archivers/p7zip/12-CVE-2016-9296.patch
deleted file mode 100644
index 42245c92c0aa..000000000000
--- a/pkgs/tools/archivers/p7zip/12-CVE-2016-9296.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-From: Robert Luberda <robert@debian.org>
-Date: Sat, 19 Nov 2016 08:48:08 +0100
-Subject: Fix nullptr dereference (CVE-2016-9296)
-
-Patch taken from https://sourceforge.net/p/p7zip/bugs/185/
----
- CPP/7zip/Archive/7z/7zIn.cpp | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/CPP/7zip/Archive/7z/7zIn.cpp b/CPP/7zip/Archive/7z/7zIn.cpp
-index b0c6b98..7c6dde2 100644
---- a/CPP/7zip/Archive/7z/7zIn.cpp
-+++ b/CPP/7zip/Archive/7z/7zIn.cpp
-@@ -1097,7 +1097,8 @@ HRESULT CInArchive::ReadAndDecodePackedStreams(
-       if (CrcCalc(data, unpackSize) != folders.FolderCRCs.Vals[i])
-         ThrowIncorrect();
-   }
--  HeadersSize += folders.PackPositions[folders.NumPackStreams];
-+  if (folders.PackPositions)
-+      HeadersSize += folders.PackPositions[folders.NumPackStreams];
-   return S_OK;
- }
- 
diff --git a/pkgs/tools/archivers/p7zip/13-CVE-2017-17969.patch b/pkgs/tools/archivers/p7zip/13-CVE-2017-17969.patch
deleted file mode 100644
index a9787c4a9088..000000000000
--- a/pkgs/tools/archivers/p7zip/13-CVE-2017-17969.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From: =?utf-8?q?Antoine_Beaupr=C3=A9?= <anarcat@debian.org>
-Date: Fri, 2 Feb 2018 11:11:41 +0100
-Subject: Heap-based buffer overflow in 7zip/Compress/ShrinkDecoder.cpp
-
-Origin: vendor, https://sourceforge.net/p/p7zip/bugs/_discuss/thread/0920f369/27d7/attachment/CVE-2017-17969.patch
-Forwarded: https://sourceforge.net/p/p7zip/bugs/_discuss/thread/0920f369/#27d7
-Bug: https://sourceforge.net/p/p7zip/bugs/204/
-Bug-Debian: https://bugs.debian.org/888297
-Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-17969
-Reviewed-by: Salvatore Bonaccorso <carnil@debian.org>
-Last-Update: 2018-02-01
-Applied-Upstream: 18.00-beta
----
- CPP/7zip/Compress/ShrinkDecoder.cpp | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/CPP/7zip/Compress/ShrinkDecoder.cpp b/CPP/7zip/Compress/ShrinkDecoder.cpp
-index 80b7e67..ca37764 100644
---- a/CPP/7zip/Compress/ShrinkDecoder.cpp
-+++ b/CPP/7zip/Compress/ShrinkDecoder.cpp
-@@ -121,8 +121,13 @@ HRESULT CDecoder::CodeReal(ISequentialInStream *inStream, ISequentialOutStream *
-     {
-       _stack[i++] = _suffixes[cur];
-       cur = _parents[cur];
-+      if (cur >= kNumItems || i >= kNumItems)
-+        break;
-     }
--    
-+
-+    if (cur >= kNumItems || i >= kNumItems)
-+      break;
-+
-     _stack[i++] = (Byte)cur;
-     lastChar2 = (Byte)cur;
- 
diff --git a/pkgs/tools/archivers/p7zip/default.nix b/pkgs/tools/archivers/p7zip/default.nix
index d6ad699eaa8d..773d37f0b758 100644
--- a/pkgs/tools/archivers/p7zip/default.nix
+++ b/pkgs/tools/archivers/p7zip/default.nix
@@ -1,28 +1,17 @@
-{ stdenv, fetchurl, fetchpatch, lib, enableUnfree ? false }:
+{ stdenv, fetchFromGitHub, lib, enableUnfree ? false }:
 
 stdenv.mkDerivation rec {
   pname = "p7zip";
-  version = "16.02";
+  version = "17.01";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/p7zip/p7zip_${version}_src_all.tar.bz2";
-    sha256 = "5eb20ac0e2944f6cb9c2d51dd6c4518941c185347d4089ea89087ffdd6e2341f";
-  };
 
-  patches = [
-    ./12-CVE-2016-9296.patch
-    ./13-CVE-2017-17969.patch
-    (fetchpatch {
-      name = "3-CVE-2018-5996.patch";
-      url = "https://raw.githubusercontent.com/termux/termux-packages/master/packages/p7zip/3-CVE-2018-5996.patch";
-      sha256 = "1zivvkazmza0653i498ccp3zbpbpc7dvxl3zxwllbx41b6n589yp";
-    })
-    (fetchpatch {
-      name = "4-CVE-2018-10115.patch";
-      url = "https://raw.githubusercontent.com/termux/termux-packages/master/packages/p7zip/4-CVE-2018-10115.patch";
-      sha256 = "1cr7q8gnrk9yp6dcvxaqi1yhdbgp964nkv65ls41mw1kdfm44zn6";
-    })
-  ];
+  src = fetchFromGitHub {
+    owner  = "szcnick";
+    repo   = pname;
+    rev    = "v${version}";
+    sha256 = "0gczdmypwbfnxzb11rjrrndjkkb3jzxfby2cchn5j8ysny13mfps";
+  }
+  ;
 
   # Default makefile is full of impurities on Darwin. The patch doesn't hurt Linux so I'm leaving it unconditional
   postPatch = ''
@@ -39,14 +28,15 @@ stdenv.mkDerivation rec {
     # (see DOC/License.txt, https://fedoraproject.org/wiki/Licensing:Unrar)
     rm -r CPP/7zip/Compress/Rar*
     find . -name makefile'*' -exec sed -i '/Rar/d' {} +
+    chmod +x install.sh
   '';
 
   preConfigure = ''
     makeFlagsArray=(DEST_HOME=$out)
-    buildFlags=all3
-  '' + stdenv.lib.optionalString stdenv.isDarwin ''
-    cp makefile.macosx_llvm_64bits makefile.machine
-  '';
+      buildFlags=all3
+        '' + stdenv.lib.optionalString stdenv.isDarwin ''
+        cp makefile.macosx_llvm_64bits makefile.machine
+'';
 
   enableParallelBuilding = true;
 
@@ -55,15 +45,10 @@ stdenv.mkDerivation rec {
   NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
 
   meta = {
-    homepage = "http://p7zip.sourceforge.net/";
-    description = "A port of the 7-zip archiver";
+    homepage = "https://github.com/szcnick/p7zip";
+    description = "A new p7zip fork with additional codecs and improvements (forked from https://sourceforge.net/projects/p7zip/)";
     platforms = stdenv.lib.platforms.unix;
     maintainers = [ stdenv.lib.maintainers.raskin ];
-    knownVulnerabilities = [
-      # p7zip is abandoned, according to this thread on its forums:
-      # https://sourceforge.net/p/p7zip/discussion/383043/thread/fa143cf2/#1817
-      "p7zip is abandoned and may not receive important security fixes"
-    ];
     # RAR code is under non-free UnRAR license, but we remove it
     license = if enableUnfree then lib.licenses.unfree else lib.licenses.lgpl2Plus;
   };
diff --git a/pkgs/tools/audio/abcmidi/default.nix b/pkgs/tools/audio/abcmidi/default.nix
index 0ccfaa081c9a..1987b0a87c28 100644
--- a/pkgs/tools/audio/abcmidi/default.nix
+++ b/pkgs/tools/audio/abcmidi/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "abcMIDI";
-  version = "2020.03.25";
+  version = "2020.06.07";
 
   src = fetchzip {
     url = "https://ifdo.ca/~seymour/runabc/${pname}-${version}.zip";
-    sha256 = "0rzif8idsja8ryhx0y4zdk8lhn36h10ahfjqa8bmif0rdbyab0kv";
+    sha256 = "06jpawwm4zcss9mi2bjdbdkkfr8cw1q9cpzplq5r83z8pljqb12l";
   };
 
   # There is also a file called "makefile" which seems to be preferred by the standard build phase
diff --git a/pkgs/tools/cd-dvd/unetbootin/default.nix b/pkgs/tools/cd-dvd/unetbootin/default.nix
index d81790d66a85..ae9e6724facc 100644
--- a/pkgs/tools/cd-dvd/unetbootin/default.nix
+++ b/pkgs/tools/cd-dvd/unetbootin/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "unetbootin";
-  version = "677";
+  version = "681";
 
   src = fetchFromGitHub {
     owner  = "unetbootin";
     repo   = "unetbootin";
     rev    = version;
-    sha256 = "1mk6179r2lz2d0pvln1anvf5p4l7vfrnnnlhgyx2dlx6pfacsspy";
+    sha256 = "0ppqb7ywh4cpcjr5nw6f65dx4s8kx09gnhihnby3zjhxdf4l99fm";
   };
 
   setSourceRoot = ''
diff --git a/pkgs/tools/compression/dtrx/default.nix b/pkgs/tools/compression/dtrx/default.nix
index edca969a1e84..81a446066d97 100644
--- a/pkgs/tools/compression/dtrx/default.nix
+++ b/pkgs/tools/compression/dtrx/default.nix
@@ -1,18 +1,15 @@
 {stdenv, lib, fetchurl, pythonPackages
-, gnutar, unzip, lhasa, rpm, binutils, cpio, gzip, cabextract, unrar, unshield
+, gnutar, unzip, lhasa, rpm, binutils, cpio, gzip, p7zip, cabextract, unrar, unshield
 , bzip2, xz, lzip
-# unsafe:
-# ,p7zip
-# unzip is no longer handled by p7zip, since it's unsafe
-, unzipSupport ? true
+# unzip is handled by p7zip
+, unzipSupport ? false
 , unrarSupport ? false }:
 
 let
-  # p7zip
-  archivers = lib.makeBinPath ([ gnutar lhasa rpm binutils cpio gzip cabextract unshield ]
-                               ++ lib.optional (unzipSupport) unzip
-                               ++ lib.optional (unrarSupport) unrar
-                               ++ [ bzip2 xz lzip ]);
+  archivers = lib.makeBinPath ([ gnutar lhasa rpm binutils cpio gzip p7zip cabextract unshield ]
+  ++ lib.optional (unzipSupport) unzip
+  ++ lib.optional (unrarSupport) unrar
+  ++ [ bzip2 xz lzip ]);
 
 in pythonPackages.buildPythonApplication rec {
   pname = "dtrx";
diff --git a/pkgs/tools/misc/clex/default.nix b/pkgs/tools/misc/clex/default.nix
index 5e5bf4166ff9..7a6a78af59a9 100644
--- a/pkgs/tools/misc/clex/default.nix
+++ b/pkgs/tools/misc/clex/default.nix
@@ -24,6 +24,6 @@ stdenv.mkDerivation rec {
     '';
     homepage = "http://www.clex.sk";
     license = licenses.gpl2Plus;
-    platforms = platforms.linux;
+    platforms = with platforms; linux ++ darwin;
   };
 }
diff --git a/pkgs/tools/misc/hdf4/default.nix b/pkgs/tools/misc/hdf4/default.nix
index 8d694aa88b75..d5b8291d78ed 100644
--- a/pkgs/tools/misc/hdf4/default.nix
+++ b/pkgs/tools/misc/hdf4/default.nix
@@ -84,10 +84,11 @@ stdenv.mkDerivation rec {
     moveToOutput bin "$bin"
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Data model, library, and file format for storing and managing data";
     homepage = "https://support.hdfgroup.org/products/hdf4/";
-    maintainers = with stdenv.lib.maintainers; [ knedlsepp ];
-    platforms = stdenv.lib.platforms.unix;
+    maintainers = with maintainers; [ knedlsepp ];
+    platforms = platforms.unix;
+    license = licenses.bsdOriginal;
   };
 }
diff --git a/pkgs/tools/misc/jdupes/default.nix b/pkgs/tools/misc/jdupes/default.nix
index ae0b32d2120d..ba509d945e16 100644
--- a/pkgs/tools/misc/jdupes/default.nix
+++ b/pkgs/tools/misc/jdupes/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "jdupes";
-  version = "1.15.0";
+  version = "1.16.0";
 
   src = fetchFromGitHub {
     owner = "jbruchon";
     repo  = "jdupes";
     rev   = "v${version}";
-    sha256 = "05q2ys7ii6mqiddl9ixzqhbvk4xy5ckh3yfz26vycxiyh9cp7yls";
+    sha256 = "0z8banifsp6325j572grpghf69j92zz9cxdnvb6pqjsknc96mrf6";
     # Unicode file names lead to different checksums on HFS+ vs. other
     # filesystems because of unicode normalisation. The testdir
     # directories have such files and will be removed.
diff --git a/pkgs/tools/misc/osinfo-db-tools/default.nix b/pkgs/tools/misc/osinfo-db-tools/default.nix
index a93ec0ab573f..c0921a496cc2 100644
--- a/pkgs/tools/misc/osinfo-db-tools/default.nix
+++ b/pkgs/tools/misc/osinfo-db-tools/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "osinfo-db-tools";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchurl {
     url = "https://releases.pagure.org/libosinfo/${pname}-${version}.tar.xz";
-    sha256 = "08x8mrafphyll0d35xdc143rip3ahrz6bmzhc85nwhq7yk2vxpab";
+    sha256 = "038q3gzdbkfkhpicj0755mw1q4gbvn57pslpw8n2dp3lds9im0g9";
   };
 
   nativeBuildInputs = [ meson ninja pkgconfig gettext perl python3 ];
diff --git a/pkgs/tools/misc/phoronix-test-suite/default.nix b/pkgs/tools/misc/phoronix-test-suite/default.nix
index 0abbcd5c3a28..83e96d8f9e65 100644
--- a/pkgs/tools/misc/phoronix-test-suite/default.nix
+++ b/pkgs/tools/misc/phoronix-test-suite/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "phoronix-test-suite";
-  version = "9.6.0";
+  version = "9.6.1";
 
   src = fetchurl {
     url = "https://phoronix-test-suite.com/releases/${pname}-${version}.tar.gz";
-    sha256 = "1wgw5lwpm3ylby2llnjiq356cdb3v1jghj7xq659c722wj617i88";
+    sha256 = "1qnci0bipzq68mwfgmm7kcxjxcpfdrqf705am2jsj1mfd82y7yla";
   };
 
   buildInputs = [ php ];
diff --git a/pkgs/tools/misc/shadowenv/default.nix b/pkgs/tools/misc/shadowenv/default.nix
index 7c9352d33100..9becd52273e6 100644
--- a/pkgs/tools/misc/shadowenv/default.nix
+++ b/pkgs/tools/misc/shadowenv/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "shadowenv";
-  version = "2.0.2";
+  version = "2.0.3";
 
   src = fetchFromGitHub {
     owner = "Shopify";
     repo = pname;
     rev = version;
-    sha256 = "1x5i5km6wblqbc0fibdjdlqkamqswxwhy8p6cbfz2nvcia7fgsf1";
+    sha256 = "1h8hfyxxl4bpx8azzxj0snmzccn6xjd9vc2iyp8i2ar7aiyhf5yd";
   };
 
-  cargoSha256 = "1hrsbd6025sfgnwr7smp43yzi7w2lfyfbdxhapgizrpwbq8y7xzd";
+  cargoSha256 = "1bjkwn57vm3in8lajhm7p9fjwyqhmkrb3fyq1k7lqjvrrh9jysb2";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/misc/woeusb/default.nix b/pkgs/tools/misc/woeusb/default.nix
index 991ab6224907..4c235b4866f2 100644
--- a/pkgs/tools/misc/woeusb/default.nix
+++ b/pkgs/tools/misc/woeusb/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, autoreconfHook, makeWrapper
-, coreutils, dosfstools, findutils, gawk, gnugrep, grub2_light, ncurses, ntfs3g, parted, utillinux, wget
+, coreutils, dosfstools, findutils, gawk, gnugrep, grub2_light, ncurses, ntfs3g, parted, p7zip, utillinux, wget
 , wxGTK30 }:
 
 stdenv.mkDerivation rec {
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     # should be patched with a less useless default PATH, but for now
     # we add everything we need manually.
     wrapProgram "$out/bin/woeusb" \
-      --set PATH '${stdenv.lib.makeBinPath [ coreutils dosfstools findutils gawk gnugrep grub2_light ncurses ntfs3g parted utillinux wget ]}'
+      --set PATH '${stdenv.lib.makeBinPath [ coreutils dosfstools findutils gawk gnugrep grub2_light ncurses ntfs3g parted utillinux wget p7zip ]}'
   '';
 
   doInstallCheck = true;
diff --git a/pkgs/tools/networking/haproxy/default.nix b/pkgs/tools/networking/haproxy/default.nix
index c5aeaaa7bb43..c43edd040e7b 100644
--- a/pkgs/tools/networking/haproxy/default.nix
+++ b/pkgs/tools/networking/haproxy/default.nix
@@ -11,11 +11,11 @@ assert usePcre -> pcre != null;
 
 stdenv.mkDerivation rec {
   pname = "haproxy";
-  version = "2.1.4";
+  version = "2.1.6";
 
   src = fetchurl {
     url = "https://www.haproxy.org/download/${stdenv.lib.versions.majorMinor version}/src/${pname}-${version}.tar.gz";
-    sha256 = "1kcizs5r538chhpwqykdngxyqfi98i03akfjnii721npjvv0y0si";
+    sha256 = "1pyz4gckdn8982vpb1iiw9agwp2s5p8wc0nn1qh1ic0wq3lrnpg6";
   };
 
   buildInputs = [ openssl zlib ]
diff --git a/pkgs/tools/networking/mu/default.nix b/pkgs/tools/networking/mu/default.nix
index cf2a01b3bb27..fc693bae212d 100644
--- a/pkgs/tools/networking/mu/default.nix
+++ b/pkgs/tools/networking/mu/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mu";
-  version = "1.4.9";
+  version = "1.4.10";
 
   src = fetchFromGitHub {
     owner  = "djcb";
     repo   = "mu";
     rev    = version;
-    sha256 = "1l8c72f3yd2vypc11frsmjnkr87h1q4gb6k3armpypwv6a6zl8z4";
+    sha256 = "10vnqlpphjkkiji42sfs954l1zfgwnic7mmpr4nx6yx44z619v0y";
   };
 
   postPatch = stdenv.lib.optionalString (batchSize != null) ''
diff --git a/pkgs/tools/security/mkp224o/default.nix b/pkgs/tools/security/mkp224o/default.nix
index 5640debf124a..dc17cc602764 100644
--- a/pkgs/tools/security/mkp224o/default.nix
+++ b/pkgs/tools/security/mkp224o/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mkp224o";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "cathugger";
     repo = "mkp224o";
     rev = "v${version}";
-    sha256 = "0b7xs4gnyfhdkwl8wkb6mazas88ybnlbxck59p4n2mnlndvd8kb7";
+    sha256 = "0b2cn96wg4l8jkkqqp8l2295xlmm2jc8nrw6rdqb5g0zkpfmrxbb";
   };
 
   buildCommand =
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 03b03ff2a842..d96a16b13998 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -309,7 +309,7 @@ mapAliases ({
   msf = metasploit; # added 2018-04-25
   libmsgpack = msgpack; # added 2018-08-17
   mssys = ms-sys; # added 2015-12-13
-  mpv-with-scripts = throw "Use wrapMpv for editing the environment of mpv"; # added 2012-05-22
+  mpv-with-scripts = self.wrapMpv self.mpv-unwrapped { }; # added 2020-05-22
   multipath_tools = multipath-tools;  # added 2016-01-21
   mupen64plus1_5 = mupen64plus; # added 2016-02-12
   mysqlWorkbench = mysql-workbench; # added 2017-01-19
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8fe571976b2e..19d64cb286a0 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6559,6 +6559,8 @@ in
 
   setserial = callPackage ../tools/system/setserial { };
 
+  setzer = callPackage ../applications/editors/setzer { };
+
   seqdiag = with python3Packages; toPythonApplication seqdiag;
 
   sequoia = callPackage ../tools/security/sequoia {
@@ -16175,6 +16177,8 @@ in
   prometheus-gitlab-ci-pipelines-exporter = callPackage ../servers/monitoring/prometheus/gitlab-ci-pipelines-exporter.nix { };
   prometheus-haproxy-exporter = callPackage ../servers/monitoring/prometheus/haproxy-exporter.nix { };
   prometheus-json-exporter = callPackage ../servers/monitoring/prometheus/json-exporter.nix { };
+  prometheus-keylight-exporter = callPackage ../servers/monitoring/prometheus/keylight-exporter.nix { };
+  prometheus-lnd-exporter = callPackage ../servers/monitoring/prometheus/lnd-exporter.nix { };
   prometheus-mail-exporter = callPackage ../servers/monitoring/prometheus/mail-exporter.nix { };
   prometheus-mesos-exporter = callPackage ../servers/monitoring/prometheus/mesos-exporter.nix { };
   prometheus-mikrotik-exporter = callPackage ../servers/monitoring/prometheus/mikrotik-exporter.nix { };
@@ -21919,6 +21923,8 @@ in
 
   rtl_433 = callPackage ../applications/radio/rtl_433 { };
 
+  rtl-ais = callPackage ../applications/radio/rtl-ais { };
+
   rtl-sdr = callPackage ../applications/radio/rtl-sdr { };
 
   rtv = callPackage ../applications/misc/rtv { };
@@ -25586,7 +25592,7 @@ in
   faust1 = callPackage ../applications/audio/faust/faust1.nix { };
 
   faust2 = callPackage ../applications/audio/faust/faust2.nix {
-    llvm = llvm_9;
+    llvm = llvm_10;
   };
 
   faust2alqt = callPackage ../applications/audio/faust/faust2alqt.nix { };