about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--.github/PULL_REQUEST_TEMPLATE.md2
-rw-r--r--doc/contributing/quick-start.xml2
-rw-r--r--doc/languages-frameworks/android.section.md2
-rw-r--r--doc/languages-frameworks/ios.section.md2
-rw-r--r--doc/preface.chapter.md2
-rw-r--r--doc/release-notes.xml4
-rw-r--r--maintainers/maintainer-list.nix10
-rwxr-xr-xmaintainers/scripts/hydra-eval-failures.py2
-rw-r--r--nixos/README2
-rw-r--r--nixos/doc/manual/configuration/adding-custom-packages.xml2
-rw-r--r--nixos/doc/manual/configuration/config-syntax.xml2
-rw-r--r--nixos/doc/manual/configuration/summary.xml2
-rwxr-xr-xnixos/doc/manual/development/releases.xml2
-rw-r--r--nixos/doc/manual/development/replace-modules.xml2
-rw-r--r--nixos/doc/manual/installation/obtaining.xml4
-rw-r--r--nixos/doc/manual/release-notes/rl-1404.xml2
-rw-r--r--nixos/doc/manual/release-notes/rl-1509.xml4
-rw-r--r--nixos/doc/manual/release-notes/rl-1603.xml2
-rw-r--r--nixos/doc/manual/release-notes/rl-2009.xml6
-rw-r--r--nixos/modules/module-list.nix2
-rw-r--r--nixos/modules/programs/venus.nix2
-rw-r--r--nixos/modules/security/acme.nix8
-rw-r--r--nixos/modules/security/acme.xml247
-rw-r--r--nixos/modules/services/editors/emacs.xml2
-rw-r--r--nixos/modules/services/misc/nix-daemon.nix2
-rw-r--r--nixos/modules/services/networking/prosody.nix13
-rw-r--r--nixos/modules/virtualisation/cri-o.nix29
-rw-r--r--nixos/modules/virtualisation/oci-containers.nix (renamed from nixos/modules/virtualisation/docker-containers.nix)124
-rw-r--r--nixos/modules/virtualisation/podman.nix20
-rw-r--r--nixos/tests/all-tests.nix2
-rw-r--r--nixos/tests/chromium.nix2
-rw-r--r--nixos/tests/docker-containers.nix27
-rw-r--r--nixos/tests/ec2.nix2
-rw-r--r--nixos/tests/minio.nix2
-rw-r--r--nixos/tests/oci-containers.nix43
-rw-r--r--nixos/tests/udisks2.nix2
-rw-r--r--nixos/tests/xmpp/prosody-mysql.nix15
-rw-r--r--pkgs/applications/audio/gpodder/default.nix4
-rw-r--r--pkgs/applications/audio/orca-c/default.nix31
-rw-r--r--pkgs/applications/audio/pt2-clone/default.nix4
-rw-r--r--pkgs/applications/audio/rofi-mpd/default.nix4
-rw-r--r--pkgs/applications/audio/strawberry/default.nix4
-rw-r--r--pkgs/applications/blockchains/lnd.nix6
-rw-r--r--pkgs/applications/graphics/apitrace/default.nix45
-rw-r--r--pkgs/applications/misc/alacritty/default.nix2
-rw-r--r--pkgs/applications/misc/cherrytree/default.nix4
-rw-r--r--pkgs/applications/misc/notable/default.nix25
-rw-r--r--pkgs/applications/misc/osmium-tool/default.nix4
-rw-r--r--pkgs/applications/misc/pdfarranger/default.nix4
-rw-r--r--pkgs/applications/misc/pdfsam-basic/default.nix4
-rw-r--r--pkgs/applications/misc/pueue/default.nix6
-rw-r--r--pkgs/applications/misc/redshift/default.nix5
-rw-r--r--pkgs/applications/misc/sweethome3d/default.nix6
-rw-r--r--pkgs/applications/misc/toot/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/ephemeral/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/chronos/default.nix2
-rw-r--r--pkgs/applications/networking/cluster/helmfile/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/luigi/default.nix4
-rw-r--r--pkgs/applications/networking/feedreaders/rssguard/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/qtox/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-cli/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/vacuum/default.nix2
-rw-r--r--pkgs/applications/networking/onionshare/default.nix113
-rw-r--r--pkgs/applications/networking/onionshare/fix-paths.patch134
-rw-r--r--pkgs/applications/networking/p2p/tribler/default.nix5
-rw-r--r--pkgs/applications/networking/ssb/patchwork/default.nix4
-rw-r--r--pkgs/applications/office/aesop/default.nix4
-rw-r--r--pkgs/applications/office/elementary-planner/default.nix4
-rw-r--r--pkgs/applications/science/biology/picard-tools/default.nix4
-rw-r--r--pkgs/applications/science/logic/cryptominisat/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-trim/default.nix6
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-workspace/default.nix6
-rw-r--r--pkgs/applications/video/plex-mpv-shim/default.nix4
-rw-r--r--pkgs/applications/video/shotcut/default.nix4
-rw-r--r--pkgs/applications/video/streamlink/default.nix4
-rw-r--r--pkgs/applications/virtualization/OVMF/default.nix2
-rw-r--r--pkgs/applications/virtualization/podman/wrapper.nix26
-rw-r--r--pkgs/applications/virtualization/tini/default.nix4
-rwxr-xr-xpkgs/build-support/fetchgit/nix-prefetch-git1
-rw-r--r--pkgs/build-support/fetchurl/default.nix2
-rw-r--r--pkgs/data/icons/papirus-icon-theme/default.nix4
-rw-r--r--pkgs/desktops/deepin/deepin-anything/default.nix12
-rw-r--r--pkgs/desktops/lxqt/libqtxdg/default.nix2
-rw-r--r--pkgs/development/compilers/edk2/default.nix41
-rw-r--r--pkgs/development/compilers/kotlin/default.nix4
-rw-r--r--pkgs/development/haskell-modules/configuration-common.nix2
-rw-r--r--pkgs/development/interpreters/jelly/default.nix28
-rw-r--r--pkgs/development/interpreters/picoc/default.nix2
-rw-r--r--pkgs/development/interpreters/rakudo/zef.nix4
-rw-r--r--pkgs/development/interpreters/wasmtime/default.nix10
-rw-r--r--pkgs/development/libraries/armadillo/default.nix4
-rw-r--r--pkgs/development/libraries/audio/libbass/default.nix2
-rw-r--r--pkgs/development/libraries/aws-sdk-cpp/cmake-dirs.patch75
-rw-r--r--pkgs/development/libraries/aws-sdk-cpp/default.nix7
-rw-r--r--pkgs/development/libraries/boost/cmake-paths.patch21
-rw-r--r--pkgs/development/libraries/boost/generic.nix3
-rw-r--r--pkgs/development/libraries/boringssl/default.nix15
-rw-r--r--pkgs/development/libraries/catch2/default.nix4
-rw-r--r--pkgs/development/libraries/check/default.nix2
-rw-r--r--pkgs/development/libraries/gmp/5.1.x.nix2
-rw-r--r--pkgs/development/libraries/gmp/6.x.nix2
-rw-r--r--pkgs/development/libraries/gnutls-kdh/generic.nix2
-rw-r--r--pkgs/development/libraries/gnutls/default.nix2
-rw-r--r--pkgs/development/libraries/leatherman/default.nix4
-rw-r--r--pkgs/development/libraries/libgpg-error/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/async_find/default.nix22
-rw-r--r--pkgs/development/python-modules/autopep8/default.nix4
-rw-r--r--pkgs/development/python-modules/eggdeps/default.nix2
-rw-r--r--pkgs/development/python-modules/pyopenssl/default.nix2
-rw-r--r--pkgs/development/python-modules/python-gitlab/default.nix16
-rw-r--r--pkgs/development/python-modules/python-telegram-bot/default.nix8
-rw-r--r--pkgs/development/tools/database/dbmate/default.nix6
-rw-r--r--pkgs/development/tools/database/liquibase/default.nix4
-rw-r--r--pkgs/development/tools/git-quick-stats/default.nix4
-rw-r--r--pkgs/development/tools/misc/strace/default.nix2
-rw-r--r--pkgs/development/tools/misc/sysbench/default.nix4
-rw-r--r--pkgs/development/tools/mod/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-udeps/default.nix6
-rw-r--r--pkgs/development/tools/rust/cbindgen/default.nix6
-rw-r--r--pkgs/games/dwarf-fortress/df_permission2
-rw-r--r--pkgs/games/ezquake/default.nix4
-rw-r--r--pkgs/games/hyperrogue/default.nix4
-rw-r--r--pkgs/os-specific/linux/bcc/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-testing.nix4
-rw-r--r--pkgs/servers/caddy/v2.nix11
-rw-r--r--pkgs/servers/coturn/default.nix9
-rw-r--r--pkgs/servers/jellyfin/default.nix4
-rw-r--r--pkgs/servers/minio/default.nix12
-rw-r--r--pkgs/servers/misc/airsonic/default.nix4
-rw-r--r--pkgs/servers/monitoring/thanos/default.nix6
-rw-r--r--pkgs/servers/sql/dolt/default.nix6
-rw-r--r--pkgs/servers/traefik/default.nix6
-rw-r--r--pkgs/shells/fish/default.nix68
-rw-r--r--pkgs/shells/powershell/default.nix47
-rw-r--r--pkgs/shells/zsh/oh-my-zsh/default.nix6
-rw-r--r--pkgs/tools/admin/lego/default.nix6
-rw-r--r--pkgs/tools/admin/lxd/default.nix7
-rw-r--r--pkgs/tools/admin/salt/default.nix39
-rw-r--r--pkgs/tools/filesystems/fuseiso/default.nix65
-rw-r--r--pkgs/tools/graphics/scrot/default.nix4
-rw-r--r--pkgs/tools/misc/autorandr/default.nix4
-rw-r--r--pkgs/tools/misc/blsd/default.nix29
-rw-r--r--pkgs/tools/misc/blsd/deps.nix12
-rw-r--r--pkgs/tools/misc/chafa/default.nix4
-rw-r--r--pkgs/tools/misc/entr/default.nix4
-rw-r--r--pkgs/tools/misc/kak-lsp/default.nix6
-rw-r--r--pkgs/tools/misc/memtest86-efi/default.nix33
-rw-r--r--pkgs/tools/misc/pistol/default.nix7
-rw-r--r--pkgs/tools/misc/pspg/default.nix4
-rw-r--r--pkgs/tools/misc/silicon/default.nix6
-rw-r--r--pkgs/tools/misc/tmux/default.nix4
-rw-r--r--pkgs/tools/networking/drill/default.nix30
-rw-r--r--pkgs/tools/networking/minio-client/default.nix10
-rw-r--r--pkgs/tools/networking/tendermint/default.nix6
-rw-r--r--pkgs/tools/nix/cached-nix-shell/default.nix2
-rw-r--r--pkgs/tools/package-management/nix/default.nix2
-rw-r--r--pkgs/tools/package-management/nixops/nixops-v1_6_1.nix2
-rw-r--r--pkgs/tools/security/bitwarden_rs/default.nix6
-rw-r--r--pkgs/tools/security/bitwarden_rs/vault.nix4
-rw-r--r--pkgs/tools/system/kmon/default.nix6
-rw-r--r--pkgs/tools/text/shfmt/default.nix4
-rw-r--r--pkgs/tools/typesetting/tex/texlive/default.nix2
-rw-r--r--pkgs/tools/virtualization/linode-cli/default.nix4
-rw-r--r--pkgs/top-level/all-packages.nix12
-rw-r--r--pkgs/top-level/ocaml-packages.nix5
-rw-r--r--pkgs/top-level/perl-packages.nix13
166 files changed, 1419 insertions, 591 deletions
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index f44338078097..48b84f8c36ce 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -15,7 +15,7 @@ Reviewing guidelines: https://hydra.nixos.org/job/nixpkgs/trunk/manual/latest/do
 
 <!-- Please check what applies. Note that these are not hard requirements but merely serve as information for reviewers. -->
 
-- [ ] Tested using sandboxing ([nix.useSandbox](http://nixos.org/nixos/manual/options.html#opt-nix.useSandbox) on NixOS, or option `sandbox` in [`nix.conf`](http://nixos.org/nix/manual/#sec-conf-file) on non-NixOS linux)
+- [ ] Tested using sandboxing ([nix.useSandbox](https://nixos.org/nixos/manual/options.html#opt-nix.useSandbox) on NixOS, or option `sandbox` in [`nix.conf`](https://nixos.org/nix/manual/#sec-conf-file) on non-NixOS linux)
 - Built on platform(s)
    - [ ] NixOS
    - [ ] macOS
diff --git a/doc/contributing/quick-start.xml b/doc/contributing/quick-start.xml
index 8e4e914d4511..09d60834ec29 100644
--- a/doc/contributing/quick-start.xml
+++ b/doc/contributing/quick-start.xml
@@ -111,7 +111,7 @@
     </para>
     <para>
      The exact syntax and semantics of the Nix expression language, including the built-in function, are described in the Nix manual in the <link
-    xlink:href="http://hydra.nixos.org/job/nix/trunk/tarball/latest/download-by-type/doc/manual/#chap-writing-nix-expressions">chapter on writing Nix expressions</link>.
+    xlink:href="https://hydra.nixos.org/job/nix/trunk/tarball/latest/download-by-type/doc/manual/#chap-writing-nix-expressions">chapter on writing Nix expressions</link>.
     </para>
    </listitem>
    <listitem>
diff --git a/doc/languages-frameworks/android.section.md b/doc/languages-frameworks/android.section.md
index 6ee450eeb59f..1a8924082bfb 100644
--- a/doc/languages-frameworks/android.section.md
+++ b/doc/languages-frameworks/android.section.md
@@ -167,7 +167,7 @@ parameters that the SDK composition function (the function shown in the
 previous section) supports.
 
 This build function is particularly useful when it is desired to use
-[Hydra](http://nixos.org/hydra): the Nix-based continuous integration solution
+[Hydra](https://nixos.org/hydra): the Nix-based continuous integration solution
 to build Android apps. An Android APK gets exposed as a build product and can be
 installed on any Android device with a web browser by navigating to the build
 result page.
diff --git a/doc/languages-frameworks/ios.section.md b/doc/languages-frameworks/ios.section.md
index 5a81795c004a..768e0690b962 100644
--- a/doc/languages-frameworks/ios.section.md
+++ b/doc/languages-frameworks/ios.section.md
@@ -18,7 +18,7 @@ The primary objective of this project is to use the Nix expression language to
 specify how iOS apps can be built from source code, and to automatically spawn
 iOS simulator instances for testing.
 
-This component also makes it possible to use [Hydra](http://nixos.org/hydra),
+This component also makes it possible to use [Hydra](https://nixos.org/hydra),
 the Nix-based continuous integration server to regularly build iOS apps and to
 do wireless ad-hoc installations of enterprise IPAs on iOS devices through
 Hydra.
diff --git a/doc/preface.chapter.md b/doc/preface.chapter.md
index 7fa65ab11021..549e42de7aa0 100644
--- a/doc/preface.chapter.md
+++ b/doc/preface.chapter.md
@@ -42,7 +42,7 @@ distributed as soon as all tests for that channel pass, e.g.
 [this table](https://hydra.nixos.org/job/nixpkgs/trunk/unstable#tabs-constituents)
 shows the status of tests for the `nixpkgs` channel.
 
-The tests are conducted by a cluster called [Hydra](http://nixos.org/hydra/),
+The tests are conducted by a cluster called [Hydra](https://nixos.org/hydra/),
 which also builds binary packages from the Nix expressions in Nixpkgs for
 `x86_64-linux`, `i686-linux` and `x86_64-darwin`.
 The binaries are made available via a [binary cache](https://cache.nixos.org).
diff --git a/doc/release-notes.xml b/doc/release-notes.xml
index 7575289e7559..a15f54667290 100644
--- a/doc/release-notes.xml
+++ b/doc/release-notes.xml
@@ -286,7 +286,7 @@ export NIX_MIRRORS_sourceforge=http://osdn.dl.sourceforge.net/sourceforge/</prog
   <note>
    <para>
     This release of Nixpkgs requires <link
-xlink:href='http://nixos.org/releases/nix/nix-0.10/'>Nix 0.10</link> or higher.
+xlink:href='https://nixos.org/releases/nix/nix-0.10/'>Nix 0.10</link> or higher.
    </para>
   </note>
 
@@ -436,7 +436,7 @@ stdenv.mkDerivation {
    <listitem>
     <para>
      Distribution files have been moved to <link
-  xlink:href="http://nixos.org/" />.
+  xlink:href="https://nixos.org/" />.
     </para>
    </listitem>
    <listitem>
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index e9a472d332a1..b4552bd874f1 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -4429,6 +4429,16 @@
       fingerprint = "74F5 E5CC 19D3 B5CB 608F  6124 68FF 81E6 A785 0F49";
     }];
   };
+  lourkeur = {
+    name = "Louis Bettens";
+    email = "louis@bettens.info";
+    github = "lourkeur";
+    githubId = 15657735;
+    keys = [{
+      longkeyid = "ed25519/0xDFE1D4A017337E2A";
+      fingerprint = "5B93 9CFA E8FC 4D8F E07A  3AEA DFE1 D4A0 1733 7E2A";
+    }];
+  };
   luis = {
     email = "luis.nixos@gmail.com";
     github = "Luis-Hebendanz";
diff --git a/maintainers/scripts/hydra-eval-failures.py b/maintainers/scripts/hydra-eval-failures.py
index 6e7ec2dbc002..0f738c5427bd 100755
--- a/maintainers/scripts/hydra-eval-failures.py
+++ b/maintainers/scripts/hydra-eval-failures.py
@@ -79,7 +79,7 @@ def cli(jobset):
     and print a summary of failed builds
     """
 
-    url = "http://hydra.nixos.org/jobset/{}".format(jobset)
+    url = "https://hydra.nixos.org/jobset/{}".format(jobset)
 
     # get the last evaluation
     click.echo(click.style(
diff --git a/nixos/README b/nixos/README
index 4ecf648a9302..ce4dd1988d2d 100644
--- a/nixos/README
+++ b/nixos/README
@@ -2,4 +2,4 @@
 
 NixOS is a Linux distribution based on the purely functional package
 management system Nix.  More information can be found at
-http://nixos.org/nixos and in the manual in doc/manual.
+https://nixos.org/nixos and in the manual in doc/manual.
diff --git a/nixos/doc/manual/configuration/adding-custom-packages.xml b/nixos/doc/manual/configuration/adding-custom-packages.xml
index 182641055e4d..02cb78f47e8b 100644
--- a/nixos/doc/manual/configuration/adding-custom-packages.xml
+++ b/nixos/doc/manual/configuration/adding-custom-packages.xml
@@ -11,7 +11,7 @@
   the package to your clone, and (optionally) submit a patch or pull request to
   have it accepted into the main Nixpkgs repository. This is described in
   detail in the <link
-xlink:href="http://nixos.org/nixpkgs/manual">Nixpkgs
+xlink:href="https://nixos.org/nixpkgs/manual">Nixpkgs
   manual</link>. In short, you clone Nixpkgs:
 <screen>
 <prompt>$ </prompt>git clone https://github.com/NixOS/nixpkgs
diff --git a/nixos/doc/manual/configuration/config-syntax.xml b/nixos/doc/manual/configuration/config-syntax.xml
index 5ef498cf9ae3..5526dea247c0 100644
--- a/nixos/doc/manual/configuration/config-syntax.xml
+++ b/nixos/doc/manual/configuration/config-syntax.xml
@@ -14,7 +14,7 @@
   when managing complex systems. The syntax and semantics of the Nix language
   are fully described in the
   <link
-xlink:href="http://nixos.org/nix/manual/#chap-writing-nix-expressions">Nix
+xlink:href="https://nixos.org/nix/manual/#chap-writing-nix-expressions">Nix
   manual</link>, but here we give a short overview of the most important
   constructs useful in NixOS configuration files.
  </para>
diff --git a/nixos/doc/manual/configuration/summary.xml b/nixos/doc/manual/configuration/summary.xml
index ea980254a8fc..289face16de9 100644
--- a/nixos/doc/manual/configuration/summary.xml
+++ b/nixos/doc/manual/configuration/summary.xml
@@ -10,7 +10,7 @@
   expression language. It’s not complete. In particular, there are many other
   built-in functions. See the
   <link
-xlink:href="http://nixos.org/nix/manual/#chap-writing-nix-expressions">Nix
+xlink:href="https://nixos.org/nix/manual/#chap-writing-nix-expressions">Nix
   manual</link> for the rest.
  </para>
 
diff --git a/nixos/doc/manual/development/releases.xml b/nixos/doc/manual/development/releases.xml
index cc0ec78cc74e..8abc66dfec19 100755
--- a/nixos/doc/manual/development/releases.xml
+++ b/nixos/doc/manual/development/releases.xml
@@ -57,7 +57,7 @@
     <listitem>
      <para>
       <link xlink:href="https://github.com/NixOS/nixos-org-configurations/pull/18">
-      Make sure a channel is created at http://nixos.org/channels/. </link>
+      Make sure a channel is created at https://nixos.org/channels/. </link>
      </para>
     </listitem>
     <listitem>
diff --git a/nixos/doc/manual/development/replace-modules.xml b/nixos/doc/manual/development/replace-modules.xml
index b4a466e22942..9fc5678ca1b3 100644
--- a/nixos/doc/manual/development/replace-modules.xml
+++ b/nixos/doc/manual/development/replace-modules.xml
@@ -37,7 +37,7 @@
 
   imports =
     [ # Use postgresql service from nixos-unstable channel.
-      # sudo nix-channel --add http://nixos.org/channels/nixos-unstable nixos-unstable
+      # sudo nix-channel --add https://nixos.org/channels/nixos-unstable nixos-unstable
       &lt;nixos-unstable/nixos/modules/services/databases/postgresql.nix&gt;
     ];
 
diff --git a/nixos/doc/manual/installation/obtaining.xml b/nixos/doc/manual/installation/obtaining.xml
index 56af5c0e25a0..3b8671782ded 100644
--- a/nixos/doc/manual/installation/obtaining.xml
+++ b/nixos/doc/manual/installation/obtaining.xml
@@ -7,7 +7,7 @@
  <para>
   NixOS ISO images can be downloaded from the
   <link
-xlink:href="http://nixos.org/nixos/download.html">NixOS download
+xlink:href="https://nixos.org/nixos/download.html">NixOS download
   page</link>. There are a number of installation options. If you happen to
   have an optical drive and a spare CD, burning the image to CD and booting
   from that is probably the easiest option. Most people will need to prepare a
@@ -26,7 +26,7 @@ xlink:href="https://nixos.wiki/wiki/NixOS_Installation_Guide#Making_the_installa
     <para>
      Using virtual appliances in Open Virtualization Format (OVF) that can be
      imported into VirtualBox. These are available from the
-     <link xlink:href="http://nixos.org/nixos/download.html">NixOS download
+     <link xlink:href="https://nixos.org/nixos/download.html">NixOS download
      page</link>.
     </para>
    </listitem>
diff --git a/nixos/doc/manual/release-notes/rl-1404.xml b/nixos/doc/manual/release-notes/rl-1404.xml
index 8d8cea4303a3..56dbb74a71d5 100644
--- a/nixos/doc/manual/release-notes/rl-1404.xml
+++ b/nixos/doc/manual/release-notes/rl-1404.xml
@@ -49,7 +49,7 @@
     <para>
      Nix has been updated to 1.7
      (<link
-  xlink:href="http://nixos.org/nix/manual/#ssec-relnotes-1.7">details</link>).
+  xlink:href="https://nixos.org/nix/manual/#ssec-relnotes-1.7">details</link>).
     </para>
    </listitem>
    <listitem>
diff --git a/nixos/doc/manual/release-notes/rl-1509.xml b/nixos/doc/manual/release-notes/rl-1509.xml
index 5c4d99701785..098c8c5095b2 100644
--- a/nixos/doc/manual/release-notes/rl-1509.xml
+++ b/nixos/doc/manual/release-notes/rl-1509.xml
@@ -22,7 +22,7 @@
     in excess of 8,000 Haskell packages. Detailed instructions on how to use
     that infrastructure can be found in the
     <link
-    xlink:href="http://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure">User's
+    xlink:href="https://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure">User's
     Guide to the Haskell Infrastructure</link>. Users migrating from an earlier
     release may find helpful information below, in the list of
     backwards-incompatible changes. Furthermore, we distribute 51(!) additional
@@ -555,7 +555,7 @@ nix-env -f &quot;&lt;nixpkgs&gt;&quot; -iA haskellPackages.pandoc
      the compiler now is the <literal>haskellPackages.ghcWithPackages</literal>
      function. The
      <link
-    xlink:href="http://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure">User's
+    xlink:href="https://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure">User's
      Guide to the Haskell Infrastructure</link> provides more information about
      this subject.
     </para>
diff --git a/nixos/doc/manual/release-notes/rl-1603.xml b/nixos/doc/manual/release-notes/rl-1603.xml
index 9b512c4b1e58..6d4b28825fa9 100644
--- a/nixos/doc/manual/release-notes/rl-1603.xml
+++ b/nixos/doc/manual/release-notes/rl-1603.xml
@@ -54,7 +54,7 @@
     xlink:href="https://reproducible-builds.org/specs/source-date-epoch/">SOURCE_DATE_EPOCH</envar>
     to a deterministic value, and Nix has
     <link
-    xlink:href="http://nixos.org/nix/manual/#ssec-relnotes-1.11">gained
+    xlink:href="https://nixos.org/nix/manual/#ssec-relnotes-1.11">gained
     an option</link> to repeat a build a number of times to test determinism.
     An ongoing project, the goal of exact reproducibility is to allow binaries
     to be verified independently (e.g., a user might only trust binaries that
diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml
index 78b8eee47efe..c6a766cc045a 100644
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@@ -55,6 +55,12 @@
      The new <varname>virtualisation.containers</varname> module manages configuration shared by the CRI-O and Podman modules.
     </para>
    </listitem>
+   <listitem>
+    <para>
+      Declarative Docker containers are renamed from <varname>docker-containers</varname> to <varname>virtualisation.oci-containers.containers</varname>.
+      This is to make it possible to use <literal>podman</literal> instead of <literal>docker</literal>.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 0cd17775e516..28f536056bf1 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -984,9 +984,9 @@
   ./virtualisation/container-config.nix
   ./virtualisation/containers.nix
   ./virtualisation/nixos-containers.nix
+  ./virtualisation/oci-containers.nix
   ./virtualisation/cri-o.nix
   ./virtualisation/docker.nix
-  ./virtualisation/docker-containers.nix
   ./virtualisation/ecs-agent.nix
   ./virtualisation/libvirtd.nix
   ./virtualisation/lxc.nix
diff --git a/nixos/modules/programs/venus.nix b/nixos/modules/programs/venus.nix
index 110570ac3f06..58faf38777d0 100644
--- a/nixos/modules/programs/venus.nix
+++ b/nixos/modules/programs/venus.nix
@@ -75,7 +75,7 @@ in
       };
 
       link = mkOption {
-        default = "http://planet.nixos.org";
+        default = "https://planet.nixos.org";
         type = types.str;
         description = ''
           Link to the main page.
diff --git a/nixos/modules/security/acme.nix b/nixos/modules/security/acme.nix
index 82cd6431ad10..776ef07d716c 100644
--- a/nixos/modules/security/acme.nix
+++ b/nixos/modules/security/acme.nix
@@ -87,13 +87,13 @@ let
         default = {};
         example = literalExample ''
           {
-            "example.org" = "/srv/http/nginx";
+            "example.org" = null;
             "mydomain.org" = null;
           }
         '';
         description = ''
-          A list of extra domain names, which are included in the one certificate to be issued, with their
-          own server roots if needed.
+          A list of extra domain names, which are included in the one certificate to be issued.
+          Setting a distinct server root is deprecated and not functional in 20.03+
         '';
       };
 
@@ -250,7 +250,7 @@ in
             "example.com" = {
               webroot = "/var/www/challenges/";
               email = "foo@example.com";
-              extraDomains = { "www.example.com" = null; "foo.example.com" = "/var/www/foo/"; };
+              extraDomains = { "www.example.com" = null; "foo.example.com" = null; };
             };
             "bar.example.com" = {
               webroot = "/var/www/challenges/";
diff --git a/nixos/modules/security/acme.xml b/nixos/modules/security/acme.xml
index 2b29c1174845..f802faee9749 100644
--- a/nixos/modules/security/acme.xml
+++ b/nixos/modules/security/acme.xml
@@ -6,92 +6,249 @@
  <title>SSL/TLS Certificates with ACME</title>
  <para>
   NixOS supports automatic domain validation &amp; certificate retrieval and
-  renewal using the ACME protocol. This is currently only implemented by and
-  for Let's Encrypt. The alternative ACME client <literal>lego</literal> is
-  used under the hood.
+  renewal using the ACME protocol. Any provider can be used, but by default
+  NixOS uses Let's Encrypt. The alternative ACME client <literal>lego</literal>
+  is used under the hood.
+ </para>
+ <para>
+  Automatic cert validation and configuration for Apache and Nginx virtual
+  hosts is included in NixOS, however if you would like to generate a wildcard
+  cert or you are not using a web server you will have to configure DNS
+  based validation.
  </para>
  <section xml:id="module-security-acme-prerequisites">
   <title>Prerequisites</title>
 
   <para>
-   You need to have a running HTTP server for verification. The server must
-   have a webroot defined that can serve
+   To use the ACME module, you must accept the provider's terms of service
+   by setting <literal><xref linkend="opt-security.acme.acceptTerms" /></literal>
+   to <literal>true</literal>. The Let's Encrypt ToS can be found
+   <link xlink:href="https://letsencrypt.org/repository/">here</link>.
+  </para>
+
+  <para>
+   You must also set an email address to be used when creating accounts with
+   Let's Encrypt. You can set this for all certs with
+   <literal><xref linkend="opt-security.acme.email" /></literal>
+   and/or on a per-cert basis with
+   <literal><xref linkend="opt-security.acme.certs._name_.email" /></literal>.
+   This address is only used for registration and renewal reminders,
+   and cannot be used to administer the certificates in any way.
+  </para>
+
+  <para>
+   Alternatively, you can use a different ACME server by changing the
+   <literal><xref linkend="opt-security.acme.server" /></literal> option
+   to a provider of your choosing, or just change the server for one cert with
+   <literal><xref linkend="opt-security.acme.certs._name_.server" /></literal>.
+  </para>
+
+  <para>
+   You will need an HTTP server or DNS server for verification. For HTTP,
+   the server must have a webroot defined that can serve
    <filename>.well-known/acme-challenge</filename>. This directory must be
-   writeable by the user that will run the ACME client.
+   writeable by the user that will run the ACME client. For DNS, you must
+   set up credentials with your provider/server for use with lego.
   </para>
+ </section>
+ <section xml:id="module-security-acme-nginx">
+  <title>Using ACME certificates in Nginx</title>
 
   <para>
-   For instance, this generic snippet could be used for Nginx:
+   NixOS supports fetching ACME certificates for you by setting
+   <literal><link linkend="opt-services.nginx.virtualHosts._name_.enableACME">enableACME</link>
+   = true;</literal> in a virtualHost config. We first create self-signed
+   placeholder certificates in place of the real ACME certs. The placeholder
+   certs are overwritten when the ACME certs arrive. For
+   <literal>foo.example.com</literal> the config would look like.
+  </para>
+
 <programlisting>
-http {
-  server {
-    server_name _;
-    listen 80;
-    listen [::]:80;
-
-    location /.well-known/acme-challenge {
-      root /var/www/challenges;
-    }
+<xref linkend="opt-security.acme.acceptTerms" /> = true;
+<xref linkend="opt-security.acme.email" /> = "admin+acme@example.com";
+services.nginx = {
+  <link linkend="opt-services.nginx.enable">enable</link> = true;
+  <link linkend="opt-services.nginx.virtualHosts">virtualHosts</link> = {
+    "foo.example.com" = {
+      <link linkend="opt-services.nginx.virtualHosts._name_.forceSSL">forceSSL</link> = true;
+      <link linkend="opt-services.nginx.virtualHosts._name_.enableACME">enableACME</link> = true;
+      # All serverAliases will be added as <link linkend="opt-security.acme.certs._name_.extraDomains">extra domains</link> on the certificate.
+      <link linkend="opt-services.nginx.virtualHosts._name_.serverAliases">serverAliases</link> = [ "bar.example.com" ];
+      locations."/" = {
+        <link linkend="opt-services.nginx.virtualHosts._name_.locations._name_.root">root</link> = "/var/www";
+      };
+    };
 
-    location / {
-      return 301 https://$host$request_uri;
-    }
-  }
+    # We can also add a different vhost and reuse the same certificate
+    # but we have to append extraDomains manually.
+    <link linkend="opt-security.acme.certs._name_.extraDomains">security.acme.certs."foo.example.com".extraDomains."baz.example.com"</link> = null;
+    "baz.example.com" = {
+      <link linkend="opt-services.nginx.virtualHosts._name_.forceSSL">forceSSL</link> = true;
+      <link linkend="opt-services.nginx.virtualHosts._name_.useACMEHost">useACMEHost</link> = "foo.example.com";
+      locations."/" = {
+        <link linkend="opt-services.nginx.virtualHosts._name_.locations._name_.root">root</link> = "/var/www";
+      };
+    };
+  };
 }
 </programlisting>
+ </section>
+ <section xml:id="module-security-acme-httpd">
+  <title>Using ACME certificates in Apache/httpd</title>
+
+  <para>
+   Using ACME certificates with Apache virtual hosts is identical
+   to using them with Nginx. The attribute names are all the same, just replace
+   "nginx" with "httpd" where appropriate.
   </para>
  </section>
  <section xml:id="module-security-acme-configuring">
-  <title>Configuring</title>
+  <title>Manual configuration of HTTP-01 validation</title>
 
   <para>
-   To enable ACME certificate retrieval &amp; renewal for a certificate for
-   <literal>foo.example.com</literal>, add the following in your
-   <filename>configuration.nix</filename>:
+   First off you will need to set up a virtual host to serve the challenges.
+   This example uses a vhost called <literal>certs.example.com</literal>, with
+   the intent that you will generate certs for all your vhosts and redirect
+   everyone to HTTPS.
+  </para>
+
+<programlisting>
+<xref linkend="opt-security.acme.acceptTerms" /> = true;
+<xref linkend="opt-security.acme.email" /> = "admin+acme@example.com";
+services.nginx = {
+  <link linkend="opt-services.nginx.enable">enable</link> = true;
+  <link linkend="opt-services.nginx.virtualHosts">virtualHosts</link> = {
+    "acmechallenge.example.com" = {
+      # Catchall vhost, will redirect users to HTTPS for all vhosts
+      <link linkend="opt-services.nginx.virtualHosts._name_.serverAliases">serverAliases</link> = [ "*.example.com" ];
+      # /var/lib/acme/.challenges must be writable by the ACME user
+      # and readable by the Nginx user.
+      # By default, this is the case.
+      locations."/.well-known/acme-challenge" = {
+        <link linkend="opt-services.nginx.virtualHosts._name_.locations._name_.root">root</link> = "/var/lib/acme/.challenges";
+      };
+      locations."/" = {
+        <link linkend="opt-services.nginx.virtualHosts._name_.locations._name_.return">return</link> = "301 https://$host$request_uri";
+      };
+    };
+  };
+}
+# Alternative config for Apache
+services.httpd = {
+  <link linkend="opt-services.httpd.enable">enable = true;</link>
+  <link linkend="opt-services.httpd.virtualHosts">virtualHosts</link> = {
+    "acmechallenge.example.com" = {
+      # Catchall vhost, will redirect users to HTTPS for all vhosts
+      <link linkend="opt-services.httpd.virtualHosts._name_.serverAliases">serverAliases</link> = [ "*.example.com" ];
+      # /var/lib/acme/.challenges must be writable by the ACME user and readable by the Apache user.
+      # By default, this is the case.
+      <link linkend="opt-services.httpd.virtualHosts._name_.documentRoot">documentRoot</link> = "/var/lib/acme/.challenges";
+      <link linkend="opt-services.httpd.virtualHosts._name_.extraConfig">extraConfig</link> = ''
+        RewriteEngine On
+        RewriteCond %{HTTPS} off
+        RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge [NC]
+        RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301]
+      '';
+    };
+  };
+}
+</programlisting>
+
+  <para>
+   Now you need to configure ACME to generate a certificate.
+  </para>
+
 <programlisting>
 <xref linkend="opt-security.acme.certs"/>."foo.example.com" = {
-  <link linkend="opt-security.acme.certs._name_.webroot">webroot</link> = "/var/www/challenges";
+  <link linkend="opt-security.acme.certs._name_.webroot">webroot</link> = "/var/lib/acme/.challenges";
   <link linkend="opt-security.acme.certs._name_.email">email</link> = "foo@example.com";
+  # Since we have a wildcard vhost to handle port 80,
+  # we can generate certs for anything!
+  # Just make sure your DNS resolves them.
+  <link linkend="opt-security.acme.certs._name_.extraDomains">extraDomains</link> = [ "mail.example.com" ];
 };
 </programlisting>
-  </para>
 
   <para>
    The private key <filename>key.pem</filename> and certificate
    <filename>fullchain.pem</filename> will be put into
    <filename>/var/lib/acme/foo.example.com</filename>.
   </para>
+
   <para>
    Refer to <xref linkend="ch-options" /> for all available configuration
    options for the <link linkend="opt-security.acme.certs">security.acme</link>
    module.
   </para>
  </section>
- <section xml:id="module-security-acme-nginx">
-  <title>Using ACME certificates in Nginx</title>
+ <section xml:id="module-security-acme-config-dns">
+  <title>Configuring ACME for DNS validation</title>
 
   <para>
-   NixOS supports fetching ACME certificates for you by setting
-   <literal><link linkend="opt-services.nginx.virtualHosts._name_.enableACME">enableACME</link>
-   = true;</literal> in a virtualHost config. We first create self-signed
-   placeholder certificates in place of the real ACME certs. The placeholder
-   certs are overwritten when the ACME certs arrive. For
-   <literal>foo.example.com</literal> the config would look like.
+   This is useful if you want to generate a wildcard certificate, since
+   ACME servers will only hand out wildcard certs over DNS validation.
+   There a number of supported DNS providers and servers you can utilise,
+   see the <link xlink:href="https://go-acme.github.io/lego/dns/">lego docs</link>
+   for provider/server specific configuration values. For the sake of these
+   docs, we will provide a fully self-hosted example using bind.
   </para>
 
 <programlisting>
-services.nginx = {
-  <link linkend="opt-services.nginx.enable">enable = true;</link>
-  <link linkend="opt-services.nginx.virtualHosts">virtualHosts</link> = {
-    "foo.example.com" = {
-      <link linkend="opt-services.nginx.virtualHosts._name_.forceSSL">forceSSL</link> = true;
-      <link linkend="opt-services.nginx.virtualHosts._name_.enableACME">enableACME</link> = true;
-      locations."/" = {
-        <link linkend="opt-services.nginx.virtualHosts._name_.locations._name_.root">root</link> = "/var/www";
-      };
-    };
-  };
+services.bind = {
+  <link linkend="opt-services.bind.enable">enable</link> = true;
+  <link linkend="opt-services.bind.extraConfig">extraConfig</link> = ''
+    include "/var/lib/secrets/dnskeys.conf";
+  '';
+  <link linkend="opt-services.bind.zones">zones</link> = [
+    rec {
+      name = "example.com";
+      file = "/var/db/bind/${name}";
+      master = true;
+      extraConfig = "allow-update { key rfc2136key.example.com.; };";
+    }
+  ];
 }
+
+# Now we can configure ACME
+<xref linkend="opt-security.acme.acceptTerms" /> = true;
+<xref linkend="opt-security.acme.email" /> = "admin+acme@example.com";
+<xref linkend="opt-security.acme.certs" />."example.com" = {
+  <link linkend="opt-security.acme.certs._name_.domain">domain</link> = "*.example.com";
+  <link linkend="opt-security.acme.certs._name_.dnsProvider">dnsProvider</link> = "rfc2136";
+  <link linkend="opt-security.acme.certs._name_.credentialsFile">credentialsFile</link> = "/var/lib/secrets/certs.secret";
+  # We don't need to wait for propagation since this is a local DNS server
+  <link linkend="opt-security.acme.certs._name_.dnsPropagationCheck">dnsPropagationCheck</link> = false;
+};
 </programlisting>
+
+  <para>
+   The <filename>dnskeys.conf</filename> and <filename>certs.secret</filename>
+   must be kept secure and thus you should not keep their contents in your
+   Nix config. Instead, generate them one time with these commands:
+  </para>
+
+<programlisting>
+mkdir -p /var/lib/secrets
+tsig-keygen rfc2136key.example.com &gt; /var/lib/secrets/dnskeys.conf
+chown named:root /var/lib/secrets/dnskeys.conf
+chmod 400 /var/lib/secrets/dnskeys.conf
+
+# Copy the secret value from the dnskeys.conf, and put it in
+# RFC2136_TSIG_SECRET below
+
+cat &gt; /var/lib/secrets/certs.secret &lt;&lt; EOF
+RFC2136_NAMESERVER='127.0.0.1:53'
+RFC2136_TSIG_ALGORITHM='hmac-sha256.'
+RFC2136_TSIG_KEY='rfc2136key.example.com'
+RFC2136_TSIG_SECRET='your secret key'
+EOF
+chmod 400 /var/lib/secrets/certs.secret
+</programlisting>
+
+  <para>
+   Now you're all set to generate certs! You should monitor the first invokation
+   by running <literal>systemctl start acme-example.com.service &amp;
+   journalctl -fu acme-example.com.service</literal> and watching its log output.
+  </para>
  </section>
 </chapter>
diff --git a/nixos/modules/services/editors/emacs.xml b/nixos/modules/services/editors/emacs.xml
index 03483f69fa2f..74c60014dcea 100644
--- a/nixos/modules/services/editors/emacs.xml
+++ b/nixos/modules/services/editors/emacs.xml
@@ -294,7 +294,7 @@ https://nixos.org/nixpkgs/manual/#sec-modify-via-packageOverrides
     If you are not on NixOS or want to install this particular Emacs only for
     yourself, you can do so by adding it to your
     <filename>~/.config/nixpkgs/config.nix</filename> (see
-    <link xlink:href="http://nixos.org/nixpkgs/manual/#sec-modify-via-packageOverrides">Nixpkgs
+    <link xlink:href="https://nixos.org/nixpkgs/manual/#sec-modify-via-packageOverrides">Nixpkgs
     manual</link>):
     <example xml:id="module-services-emacs-config-nix">
      <title>Custom Emacs in <filename>~/.config/nixpkgs/config.nix</filename></title>
diff --git a/nixos/modules/services/misc/nix-daemon.nix b/nixos/modules/services/misc/nix-daemon.nix
index 0c2407e1dd2f..b28e3679d1c7 100644
--- a/nixos/modules/services/misc/nix-daemon.nix
+++ b/nixos/modules/services/misc/nix-daemon.nix
@@ -283,7 +283,7 @@ in
       trustedBinaryCaches = mkOption {
         type = types.listOf types.str;
         default = [ ];
-        example = [ "http://hydra.nixos.org/" ];
+        example = [ "https://hydra.nixos.org/" ];
         description = ''
           List of binary cache URLs that non-root users can use (in
           addition to those specified using
diff --git a/nixos/modules/services/networking/prosody.nix b/nixos/modules/services/networking/prosody.nix
index 9825613d809f..cdd341c9fb62 100644
--- a/nixos/modules/services/networking/prosody.nix
+++ b/nixos/modules/services/networking/prosody.nix
@@ -382,6 +382,11 @@ let
         default = "en";
         description = "Default room language.";
       };
+      extraConfig = mkOption {
+        type = types.lines;
+        default = "";
+        description = "Additional MUC specific configuration";
+      };
     };
   };
 
@@ -792,6 +797,8 @@ in
 
       https_ports = ${toLua cfg.httpsPorts}
 
+      ${ cfg.extraConfig }
+
       ${lib.concatMapStrings (muc: ''
         Component ${toLua muc.domain} "muc"
             modules_enabled = { "muc_mam"; ${optionalString muc.vcard_muc ''"vcard_muc";'' } }
@@ -809,8 +816,8 @@ in
             muc_room_default_change_subject = ${toLua muc.roomDefaultChangeSubject}
             muc_room_default_history_length = ${toLua muc.roomDefaultHistoryLength}
             muc_room_default_language = ${toLua muc.roomDefaultLanguage}
-
-          '') cfg.muc}
+            ${ muc.extraConfig }
+        '') cfg.muc}
 
       ${ lib.optionalString (cfg.uploadHttp != null) ''
         Component ${toLua cfg.uploadHttp.domain} "http_upload"
@@ -820,8 +827,6 @@ in
             http_upload_path = ${toLua cfg.uploadHttp.httpUploadPath}
       ''}
 
-      ${ cfg.extraConfig }
-
       ${ lib.concatStringsSep "\n" (lib.mapAttrsToList (n: v: ''
         VirtualHost "${v.domain}"
           enabled = ${boolToString v.enabled};
diff --git a/nixos/modules/virtualisation/cri-o.nix b/nixos/modules/virtualisation/cri-o.nix
index 89ba9c3c6636..2af4214302d6 100644
--- a/nixos/modules/virtualisation/cri-o.nix
+++ b/nixos/modules/virtualisation/cri-o.nix
@@ -4,6 +4,11 @@ with lib;
 
 let
   cfg = config.virtualisation.cri-o;
+
+  # Copy configuration files to avoid having the entire sources in the system closure
+  copyFile = filePath: pkgs.runCommandNoCC (builtins.unsafeDiscardStringContext (builtins.baseNameOf filePath)) {} ''
+    cp ${filePath} $out
+  '';
 in
 {
   imports = [
@@ -45,9 +50,9 @@ in
   config = mkIf cfg.enable {
     environment.systemPackages = with pkgs;
       [ cri-o cri-tools conmon iptables runc utillinux ];
-    environment.etc."crictl.yaml".text = ''
-      runtime-endpoint: unix:///var/run/crio/crio.sock
-    '';
+
+    environment.etc."crictl.yaml".source = copyFile "${pkgs.cri-o.src}/crictl.yaml";
+
     environment.etc."crio/crio.conf".text = ''
       [crio]
       storage_driver = "${cfg.storageDriver}"
@@ -66,23 +71,7 @@ in
       manage_network_ns_lifecycle = true
     '';
 
-    environment.etc."cni/net.d/20-cri-o-bridge.conf".text = ''
-      {
-        "cniVersion": "0.3.1",
-        "name": "crio-bridge",
-        "type": "bridge",
-        "bridge": "cni0",
-        "isGateway": true,
-        "ipMasq": true,
-        "ipam": {
-          "type": "host-local",
-          "subnet": "10.88.0.0/16",
-          "routes": [
-              { "dst": "0.0.0.0/0" }
-          ]
-        }
-      }
-    '';
+    environment.etc."cni/net.d/10-crio-bridge.conf".source = copyFile "${pkgs.cri-o.src}/contrib/cni/10-crio-bridge.conf";
 
     # Enable common /etc/containers configuration
     virtualisation.containers.enable = true;
diff --git a/nixos/modules/virtualisation/docker-containers.nix b/nixos/modules/virtualisation/oci-containers.nix
index 5ab990a3d7cc..a46dd65eb491 100644
--- a/nixos/modules/virtualisation/docker-containers.nix
+++ b/nixos/modules/virtualisation/oci-containers.nix
@@ -1,17 +1,20 @@
-{ config, lib, pkgs, ... }:
+{ config, options, lib, pkgs, ... }:
 
 with lib;
 let
-  cfg = config.docker-containers;
+  cfg = config.virtualisation.oci-containers;
+  proxy_env = config.networking.proxy.envVars;
 
-  dockerContainer =
+  defaultBackend = options.virtualisation.oci-containers.backend.default;
+
+  containerOptions =
     { ... }: {
 
       options = {
 
         image = mkOption {
           type = with types; str;
-          description = "Docker image to run.";
+          description = "OCI image to run.";
           example = "library/hello-world";
         };
 
@@ -58,18 +61,19 @@ let
 
         log-driver = mkOption {
           type = types.str;
-          default = "none";
+          default = "journald";
           description = ''
             Logging driver for the container.  The default of
-            <literal>"none"</literal> means that the container's logs will be
-            handled as part of the systemd unit.  Setting this to
-            <literal>"journald"</literal> will result in duplicate logging, but
-            the container's logs will be visible to the <command>docker
-            logs</command> command.
-
-            For more details and a full list of logging drivers, refer to the
-            <link xlink:href="https://docs.docker.com/engine/reference/run/#logging-drivers---log-driver">
-            Docker engine documentation</link>
+            <literal>"journald"</literal> means that the container's logs will be
+            handled as part of the systemd unit.
+
+            For more details and a full list of logging drivers, refer to respective backends documentation.
+
+            For Docker:
+            <link xlink:href="https://docs.docker.com/engine/reference/run/#logging-drivers---log-driver">Docker engine documentation</link>
+
+            For Podman:
+            Refer to the docker-run(1) man page.
           '';
         };
 
@@ -172,10 +176,10 @@ let
           description = ''
             Define which other containers this one depends on. They will be added to both After and Requires for the unit.
 
-            Use the same name as the attribute under <literal>services.docker-containers</literal>.
+            Use the same name as the attribute under <literal>virtualisation.oci-containers</literal>.
           '';
           example = literalExample ''
-            services.docker-containers = {
+            virtualisation.oci-containers = {
               node1 = {};
               node2 = {
                 dependsOn = [ "node1" ];
@@ -184,10 +188,10 @@ let
           '';
         };
 
-        extraDockerOptions = mkOption {
+        extraOptions = mkOption {
           type = with types; listOf str;
           default = [];
-          description = "Extra options for <command>docker run</command>.";
+          description = "Extra options for <command>${defaultBackend} run</command>.";
           example = literalExample ''
             ["--network=host"]
           '';
@@ -205,24 +209,31 @@ let
     };
 
   mkService = name: container: let
-    mkAfter = map (x: "docker-${x}.service") container.dependsOn;
-  in rec {
+    dependsOn = map (x: "${cfg.backend}-${x}.service") container.dependsOn;
+  in {
     wantedBy = [] ++ optional (container.autoStart) "multi-user.target";
-    after = [ "docker.service" "docker.socket" ] ++ mkAfter;
-    requires = after;
-    path = [ pkgs.docker ];
+    after = lib.optionals (cfg.backend == "docker") [ "docker.service" "docker.socket" ] ++ dependsOn;
+    requires = dependsOn;
+    environment = proxy_env;
+
+    path =
+      if cfg.backend == "docker" then [ pkgs.docker ]
+      else if cfg.backend == "podman" then [ config.virtualisation.podman.package ]
+      else throw "Unhandled backend: ${cfg.backend}";
 
     preStart = ''
-      docker rm -f ${name} || true
+      ${cfg.backend} rm -f ${name} || true
       ${optionalString (container.imageFile != null) ''
-        docker load -i ${container.imageFile}
+        ${cfg.backend} load -i ${container.imageFile}
         ''}
       '';
-    postStop = "docker rm -f ${name} || true";
-        
+    postStop = "${cfg.backend} rm -f ${name} || true";
+
     serviceConfig = {
+      StandardOutput = "null";
+      StandardError = "null";
       ExecStart = concatStringsSep " \\\n  " ([
-        "${pkgs.docker}/bin/docker run"
+        "${config.system.path}/bin/${cfg.backend} run"
         "--rm"
         "--name=${name}"
         "--log-driver=${container.log-driver}"
@@ -233,12 +244,12 @@ let
         ++ optional (container.user != null) "-u ${escapeShellArg container.user}"
         ++ map (v: "-v ${escapeShellArg v}") container.volumes
         ++ optional (container.workdir != null) "-w ${escapeShellArg container.workdir}"
-        ++ map escapeShellArg container.extraDockerOptions
+        ++ map escapeShellArg container.extraOptions
         ++ [container.image]
         ++ map escapeShellArg container.cmd
       );
 
-      ExecStop = ''${pkgs.bash}/bin/sh -c "[ $SERVICE_RESULT = success ] || docker stop ${name}"'';
+      ExecStop = ''${pkgs.bash}/bin/sh -c "[ $SERVICE_RESULT = success ] || ${cfg.backend} stop ${name}"'';
 
       ### There is no generalized way of supporting `reload` for docker
       ### containers. Some containers may respond well to SIGHUP sent to their
@@ -263,19 +274,50 @@ let
   };
 
 in {
+  imports = [
+    (
+      lib.mkChangedOptionModule
+      [ "docker-containers"  ]
+      [ "virtualisation" "oci-containers" ]
+      (oldcfg: {
+        backend = "docker";
+        containers = lib.mapAttrs (n: v: builtins.removeAttrs (v // {
+          extraOptions = v.extraDockerOptions or [];
+        }) [ "extraDockerOptions" ]) oldcfg.docker-containers;
+      })
+    )
+  ];
+
+  options.virtualisation.oci-containers = {
+
+    backend = mkOption {
+      type = types.enum [ "podman" "docker" ];
+      default =
+        # TODO: Once https://github.com/NixOS/nixpkgs/issues/77925 is resolved default to podman
+        # if versionAtLeast config.system.stateVersion "20.09" then "podman"
+        # else "docker";
+        "docker";
+      description = "The underlying Docker implementation to use.";
+    };
 
-  options.docker-containers = mkOption {
-    default = {};
-    type = types.attrsOf (types.submodule dockerContainer);
-    description = "Docker containers to run as systemd services.";
-  };
-
-  config = mkIf (cfg != {}) {
-
-    systemd.services = mapAttrs' (n: v: nameValuePair "docker-${n}" (mkService n v)) cfg;
-
-    virtualisation.docker.enable = true;
+    containers = mkOption {
+      default = {};
+      type = types.attrsOf (types.submodule containerOptions);
+      description = "OCI (Docker) containers to run as systemd services.";
+    };
 
   };
 
+  config = lib.mkIf (cfg.containers != {}) (lib.mkMerge [
+    {
+      systemd.services = mapAttrs' (n: v: nameValuePair "${cfg.backend}-${n}" (mkService n v)) cfg.containers;
+    }
+    (lib.mkIf (cfg.backend == "podman") {
+      virtualisation.podman.enable = true;
+    })
+    (lib.mkIf (cfg.backend == "docker") {
+      virtualisation.docker.enable = true;
+    })
+  ]);
+
 }
diff --git a/nixos/modules/virtualisation/podman.nix b/nixos/modules/virtualisation/podman.nix
index 1dc79272ccb6..652850bf5006 100644
--- a/nixos/modules/virtualisation/podman.nix
+++ b/nixos/modules/virtualisation/podman.nix
@@ -8,13 +8,11 @@ let
 
   # Provides a fake "docker" binary mapping to podman
   dockerCompat = pkgs.runCommandNoCC "${podmanPackage.pname}-docker-compat-${podmanPackage.version}" {
-    outputs = [ "out" "bin" "man" ];
+    outputs = [ "out" "man" ];
     inherit (podmanPackage) meta;
   } ''
-    mkdir $out
-
-    mkdir -p $bin/bin
-    ln -s ${podmanPackage.bin}/bin/podman $bin/bin/docker
+    mkdir -p $out/bin
+    ln -s ${podmanPackage}/bin/podman $out/bin/docker
 
     mkdir -p $man/share/man/man1
     for f in ${podmanPackage.man}/share/man/man1/*; do
@@ -88,11 +86,21 @@ in
       };
     };
 
+    package = lib.mkOption {
+      type = types.package;
+      default = podmanPackage;
+      internal = true;
+      description = ''
+        The final Podman package (including extra packages).
+      '';
+    };
+
+
   };
 
   config = lib.mkIf cfg.enable {
 
-    environment.systemPackages = [ podmanPackage ]
+    environment.systemPackages = [ cfg.package ]
       ++ lib.optional cfg.dockerCompat dockerCompat;
 
     environment.etc."containers/libpod.conf".text = ''
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index eff1752bbbf8..ebb0dfef15ac 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -70,7 +70,7 @@ in
   dhparams = handleTest ./dhparams.nix {};
   dnscrypt-proxy2 = handleTestOn ["x86_64-linux"] ./dnscrypt-proxy2.nix {};
   docker = handleTestOn ["x86_64-linux"] ./docker.nix {};
-  docker-containers = handleTestOn ["x86_64-linux"] ./docker-containers.nix {};
+  oci-containers = handleTestOn ["x86_64-linux"] ./oci-containers.nix {};
   docker-edge = handleTestOn ["x86_64-linux"] ./docker-edge.nix {};
   docker-preloader = handleTestOn ["x86_64-linux"] ./docker-preloader.nix {};
   docker-registry = handleTest ./docker-registry.nix {};
diff --git a/nixos/tests/chromium.nix b/nixos/tests/chromium.nix
index fc5d3a5c52fe..795b93f6f54e 100644
--- a/nixos/tests/chromium.nix
+++ b/nixos/tests/chromium.nix
@@ -37,7 +37,7 @@ mapAttrs (channel: chromiumPkg: makeTest rec {
     </head>
     <body onload="javascript:document.title='startup done'">
       <img src="file://${pkgs.fetchurl {
-        url = "http://nixos.org/logo/nixos-hex.svg";
+        url = "https://nixos.org/logo/nixos-hex.svg";
         sha256 = "07ymq6nw8kc22m7kzxjxldhiq8gzmc7f45kq2bvhbdm0w5s112s4";
       }}" />
     </body>
diff --git a/nixos/tests/docker-containers.nix b/nixos/tests/docker-containers.nix
deleted file mode 100644
index 0e318a52d9f1..000000000000
--- a/nixos/tests/docker-containers.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-# Test Docker containers as systemd units
-
-import ./make-test-python.nix ({ pkgs, lib, ... }: {
-  name = "docker-containers";
-  meta = {
-    maintainers = with lib.maintainers; [ benley mkaito ];
-  };
-
-  nodes = {
-    docker = { pkgs, ... }: {
-      virtualisation.docker.enable = true;
-
-      docker-containers.nginx = {
-        image = "nginx-container";
-        imageFile = pkgs.dockerTools.examples.nginx;
-        ports = ["8181:80"];
-      };
-    };
-  };
-
-  testScript = ''
-    start_all()
-    docker.wait_for_unit("docker-nginx.service")
-    docker.wait_for_open_port(8181)
-    docker.wait_until_succeeds("curl http://localhost:8181 | grep Hello")
-  '';
-})
diff --git a/nixos/tests/ec2.nix b/nixos/tests/ec2.nix
index 6aeeb17ba31a..5a59d65e6026 100644
--- a/nixos/tests/ec2.nix
+++ b/nixos/tests/ec2.nix
@@ -108,7 +108,7 @@ in {
     inherit image;
     sshPublicKey = snakeOilPublicKey;
 
-    # ### http://nixos.org/channels/nixos-unstable nixos
+    # ### https://nixos.org/channels/nixos-unstable nixos
     userData = ''
       { pkgs, ... }:
 
diff --git a/nixos/tests/minio.nix b/nixos/tests/minio.nix
index 3b0619742671..02d1f7aa6c20 100644
--- a/nixos/tests/minio.nix
+++ b/nixos/tests/minio.nix
@@ -44,7 +44,7 @@ in {
 
     # Create a test bucket on the server
     machine.succeed(
-        "mc config host add minio http://localhost:9000 ${accessKey} ${secretKey} S3v4"
+        "mc config host add minio http://localhost:9000 ${accessKey} ${secretKey} --api s3v4"
     )
     machine.succeed("mc mb minio/test-bucket")
     machine.succeed("${minioPythonScript}")
diff --git a/nixos/tests/oci-containers.nix b/nixos/tests/oci-containers.nix
new file mode 100644
index 000000000000..bb6c019f07c9
--- /dev/null
+++ b/nixos/tests/oci-containers.nix
@@ -0,0 +1,43 @@
+{ system ? builtins.currentSystem
+, config ? {}
+, pkgs ? import ../.. { inherit system config; }
+, lib ? pkgs.lib
+}:
+
+let
+
+  inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
+
+  mkOCITest = backend: makeTest {
+    name = "oci-containers-${backend}";
+
+    meta = {
+      maintainers = with lib.maintainers; [ adisbladis benley mkaito ];
+    };
+
+    nodes = {
+      ${backend} = { pkgs, ... }: {
+        virtualisation.oci-containers = {
+          inherit backend;
+          containers.nginx = {
+            image = "nginx-container";
+            imageFile = pkgs.dockerTools.examples.nginx;
+            ports = ["8181:80"];
+          };
+        };
+      };
+    };
+
+    testScript = ''
+      start_all()
+      ${backend}.wait_for_unit("${backend}-nginx.service")
+      ${backend}.wait_for_open_port(8181)
+      ${backend}.wait_until_succeeds("curl http://localhost:8181 | grep Hello")
+    '';
+  };
+
+in
+lib.foldl' (attrs: backend: attrs // { ${backend} = mkOCITest backend; }) {} [
+  "docker"
+  "podman"
+]
diff --git a/nixos/tests/udisks2.nix b/nixos/tests/udisks2.nix
index 64f5b6c40d20..50a023968918 100644
--- a/nixos/tests/udisks2.nix
+++ b/nixos/tests/udisks2.nix
@@ -3,7 +3,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
 let
 
   stick = pkgs.fetchurl {
-    url = "http://nixos.org/~eelco/nix/udisks-test.img.xz";
+    url = "https://nixos.org/~eelco/nix/udisks-test.img.xz";
     sha256 = "0was1xgjkjad91nipzclaz5biv3m4b2nk029ga6nk7iklwi19l8b";
   };
 
diff --git a/nixos/tests/xmpp/prosody-mysql.nix b/nixos/tests/xmpp/prosody-mysql.nix
index 0507227021b2..9a00bcabf389 100644
--- a/nixos/tests/xmpp/prosody-mysql.nix
+++ b/nixos/tests/xmpp/prosody-mysql.nix
@@ -6,6 +6,11 @@ import ../make-test-python.nix {
       environment.systemPackages = [
         (pkgs.callPackage ./xmpp-sendmessage.nix { connectTo = nodes.server.config.networking.primaryIPAddress; })
       ];
+      networking.extraHosts = ''
+        ${nodes.server.config.networking.primaryIPAddress} example.com
+        ${nodes.server.config.networking.primaryIPAddress} conference.example.com
+        ${nodes.server.config.networking.primaryIPAddress} uploads.example.com
+      '';
     };
     server = { config, pkgs, ... }: {
       nixpkgs.overlays = [
@@ -18,6 +23,8 @@ import ../make-test-python.nix {
       ];
       networking.extraHosts = ''
         ${config.networking.primaryIPAddress} example.com
+        ${config.networking.primaryIPAddress} conference.example.com
+        ${config.networking.primaryIPAddress} uploads.example.com
       '';
       networking.firewall.enable = false;
       services.prosody = {
@@ -39,6 +46,14 @@ import ../make-test-python.nix {
           domain = "example.com";
           enabled = true;
         };
+        muc = [
+          {
+            domain = "conference.example.com";
+          }
+        ];
+        uploadHttp = {
+          domain = "uploads.example.com";
+        };
       };
     };
     mysql = { config, pkgs, ... }: {
diff --git a/pkgs/applications/audio/gpodder/default.nix b/pkgs/applications/audio/gpodder/default.nix
index 1905699e516c..933c9ac02035 100644
--- a/pkgs/applications/audio/gpodder/default.nix
+++ b/pkgs/applications/audio/gpodder/default.nix
@@ -5,14 +5,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "gpodder";
-  version = "3.10.13";
+  version = "3.10.15";
   format = "other";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "1h542syaxsx1hslfzlk3fx1nbp190zjw35kigw7a1kx1jwvfwapg";
+    sha256 = "0ghbanj142n0hgydzfjmnkdgri2kswsjal3mn10c723kih4ir4yr";
   };
 
   patches = [
diff --git a/pkgs/applications/audio/orca-c/default.nix b/pkgs/applications/audio/orca-c/default.nix
new file mode 100644
index 000000000000..3a4f4b2ce2b8
--- /dev/null
+++ b/pkgs/applications/audio/orca-c/default.nix
@@ -0,0 +1,31 @@
+{ stdenv, fetchFromGitHub, ncurses, portmidi }:
+stdenv.mkDerivation {
+  pname = "orca-c";
+
+  version = "git-2020-05-01";
+
+  src = fetchFromGitHub {
+    owner = "hundredrabbits";
+    repo = "Orca-c";
+    rev = "d7a3b169c5ed0b06a9ad0fdb3057704da9a0b6ce";
+    sha256 = "101y617a295hzwr98ykvza1sycxlk29kzxn2ybjwc718r0alkbzz";
+  };
+
+  buildInputs = [ ncurses portmidi ];
+
+  patchPhase = ''
+    patchShebangs tool
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    install build/orca $out/bin/orca
+  '';
+
+  meta = with stdenv.lib; {
+    description = "An esoteric programming language designed to quickly create procedural sequencers.";
+    homepage = "https://github.com/hundredrabbits/Orca-c";
+    license = licenses.mit;
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/applications/audio/pt2-clone/default.nix b/pkgs/applications/audio/pt2-clone/default.nix
index 2f21e3ea56b6..5284c8af6824 100644
--- a/pkgs/applications/audio/pt2-clone/default.nix
+++ b/pkgs/applications/audio/pt2-clone/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pt2-clone";
-  version = "1.07";
+  version = "1.12";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "pt2-clone";
     rev = "v${version}";
-    sha256 = "0g2bp9n05ng2fvqw86pb941zamcqnfz1l066wvh5j3av1w22khi8";
+    sha256 = "1y7kv889rm3nvaigcda4bglvwm799f3gp0zrivkvrg1lrlygs89f";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/audio/rofi-mpd/default.nix b/pkgs/applications/audio/rofi-mpd/default.nix
index ef57466ec84f..8f9819bd913b 100644
--- a/pkgs/applications/audio/rofi-mpd/default.nix
+++ b/pkgs/applications/audio/rofi-mpd/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "rofi-mpd";
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "JakeStanger";
     repo = "Rofi_MPD";
     rev = "v${version}";
-    sha256 = "1b0y8706mmrxhiyz8g6znisllc35j8g7sz8gfjll9svysjmvb6lc";
+    sha256 = "0jabyn6gqh8ychn2a06xws3avz0lqdnx3qvqkavfd2xr6sp2q7lg";
   };
 
   propagatedBuildInputs = with python3Packages; [ mutagen mpd2 toml appdirs ];
diff --git a/pkgs/applications/audio/strawberry/default.nix b/pkgs/applications/audio/strawberry/default.nix
index 6c565911eb44..dce73c386707 100644
--- a/pkgs/applications/audio/strawberry/default.nix
+++ b/pkgs/applications/audio/strawberry/default.nix
@@ -35,13 +35,13 @@
 
 mkDerivation rec {
   pname = "strawberry";
-  version = "0.6.9";
+  version = "0.6.10";
 
   src = fetchFromGitHub {
     owner = "jonaski";
     repo = pname;
     rev = version;
-    sha256 = "0ssyqa14j54sja2dzhzrznbf1bbl0nc62p4jh2pd6fhinpw8y6dk";
+    sha256 = "0qf510hlxbndqzwq62mdzfclqxr3caf1a34kd770k84x8vrb4pld";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/blockchains/lnd.nix b/pkgs/applications/blockchains/lnd.nix
index 0aa087e20afc..aff38e242f81 100644
--- a/pkgs/applications/blockchains/lnd.nix
+++ b/pkgs/applications/blockchains/lnd.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "lnd";
-  version = "0.9.2-beta";
+  version = "0.10.0-beta";
 
   src = fetchFromGitHub {
     owner = "lightningnetwork";
     repo = "lnd";
     rev = "v${version}";
-    sha256 = "0gm33z89fiqv231ks2mkpsblskcsijipq8fcmip6m6jy8g06b1gb";
+    sha256 = "1amciz924s2h6qhy7w34jpv1jc25p5ayfxzvjph6hhx0bccrm88w";
   };
 
-  modSha256 = "1khxplvyaqgaddrx1nna1fw0nb1xz9bmqpxpfifif4f5nmx90gbr";
+  modSha256 = "15i4h3pkvyav9qsbfinzifram0knkylg24j6j0mxs4bnj80j4ycm";
 
   subPackages = ["cmd/lncli" "cmd/lnd"];
 
diff --git a/pkgs/applications/graphics/apitrace/default.nix b/pkgs/applications/graphics/apitrace/default.nix
index f6f9cb281a77..e6865d2d8f07 100644
--- a/pkgs/applications/graphics/apitrace/default.nix
+++ b/pkgs/applications/graphics/apitrace/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, libX11, procps, python2, libdwarf, qtbase, qtwebkit }:
+{ stdenv, fetchFromGitHub, cmake, libX11, procps, python2, libdwarf, qtbase, qtwebkit, wrapQtAppsHook, libglvnd }:
 
 stdenv.mkDerivation rec {
   pname = "apitrace";
@@ -15,7 +15,48 @@ stdenv.mkDerivation rec {
   # of games -- so it's fine to use e.g. bundled snappy.
   buildInputs = [ libX11 procps python2 libdwarf qtbase qtwebkit ];
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake wrapQtAppsHook ];
+
+  # Don't automatically wrap all binaries, I prefer to explicitly only wrap
+  # `qapitrace`.
+  dontWrapQtApps = true;
+
+  postFixup = ''
+
+    # Since https://github.com/NixOS/nixpkgs/pull/60985, we add `/run-opengl-driver[-32]`
+    # to the `RUNPATH` of dispatcher libraries `dlopen()` ing OpenGL drivers.
+    # `RUNPATH` doesn't propagate throughout the whole application, but only
+    # from the module performing the `dlopen()`.
+    # 
+    # Apitrace wraps programs by running them with `LD_PRELOAD` pointing to `.so`
+    # files in $out/lib/apitrace/wrappers.
+    # 
+    # Theses wrappers effectively wrap the `dlopen()` calls from `libglvnd`
+    # and other dispatcher libraries, and run `dlopen()`  by themselves.
+    # 
+    # As `RUNPATH` doesn't propagate through the whole library, and they're now the
+    # library doing the real `dlopen()`, they also need to have
+    # `/run-opengl-driver[-32]` added to their `RUNPATH`.
+    #
+    # To stay simple, we add paths for 32 and 64 bits unconditionally.
+    # This doesn't have an impact on closure size, and if the 32 bit drivers
+    # are not available, that folder is ignored.
+    for i in $out/lib/apitrace/wrappers/*.so
+    do
+      echo "Patching OpenGL driver path for $i"
+      patchelf --set-rpath "/run/opengl-driver/lib:/run/opengl-driver-32/lib:$(patchelf --print-rpath $i)" $i
+    done
+
+    # Theses open the OpenGL driver at runtime, but it is not listed as NEEDED libraries. They need
+    # a reference to libglvnd.
+    for i in $out/bin/eglretrace $out/bin/glretrace
+    do
+      echo "Patching RPath for $i"
+      patchelf --set-rpath "${stdenv.lib.makeLibraryPath [libglvnd]}:$(patchelf --print-rpath $i)" $i
+    done
+
+    wrapQtApp $out/bin/qapitrace
+  '';
 
   meta = with stdenv.lib; {
     homepage = "https://apitrace.github.io";
diff --git a/pkgs/applications/misc/alacritty/default.nix b/pkgs/applications/misc/alacritty/default.nix
index 19f0790fea30..3135c1f88312 100644
--- a/pkgs/applications/misc/alacritty/default.nix
+++ b/pkgs/applications/misc/alacritty/default.nix
@@ -100,7 +100,7 @@ rustPlatform.buildRustPackage rec {
   '' + (
     if stdenv.isDarwin then ''
       mkdir $out/Applications
-      cp -r target/release/osx/Alacritty.app $out/Applications/Alacritty.app
+      cp -r $releaseDir/osx/Alacritty.app $out/Applications/Alacritty.app
     '' else ''
       install -D extra/linux/Alacritty.desktop -t $out/share/applications/
       install -D extra/logo/alacritty-term.svg $out/share/icons/hicolor/scalable/apps/Alacritty.svg
diff --git a/pkgs/applications/misc/cherrytree/default.nix b/pkgs/applications/misc/cherrytree/default.nix
index 7c00add77971..d2ade055d6fd 100644
--- a/pkgs/applications/misc/cherrytree/default.nix
+++ b/pkgs/applications/misc/cherrytree/default.nix
@@ -2,13 +2,13 @@
 
 pythonPackages.buildPythonApplication rec {
   pname = "cherrytree";
-  version = "0.39.2";
+  version = "0.39.3";
 
   src = fetchFromGitHub {
     owner = "giuspen";
     repo = "cherrytree";
     rev = version;
-    sha256 = "1l6wh24bhp4yhmsfmc0r4n2n10nlilkv4cmv5sfl80i250fiw7xa";
+    sha256 = "1k9i7acpphx0if6ij2p9fkmj638ry6hcyr1rdr039a8zi8hq98gz";
 
   };
 
diff --git a/pkgs/applications/misc/notable/default.nix b/pkgs/applications/misc/notable/default.nix
index 9a00959de020..923f5fb4528e 100644
--- a/pkgs/applications/misc/notable/default.nix
+++ b/pkgs/applications/misc/notable/default.nix
@@ -3,14 +3,24 @@
 let
   pname = "notable";
   version = "1.8.4";
-in
-appimageTools.wrapType2 rec {
+  sha256 = "0rvz8zwsi62kiq89pv8n2wh9h5yb030kvdr1vf65xwqkhqcrzrby";
+
   name = "${pname}-${version}";
+
   src = fetchurl {
     url = "https://github.com/notable/notable/releases/download/v${version}/Notable-${version}.AppImage";
-    sha256 = "0rvz8zwsi62kiq89pv8n2wh9h5yb030kvdr1vf65xwqkhqcrzrby";
+    inherit sha256;
+  };
+
+  appimageContents = appimageTools.extract {
+    inherit name src;
   };
 
+in
+appimageTools.wrapType2 rec {
+
+  inherit name src;
+
   profile = ''
     export LC_ALL=C.UTF-8
     export XDG_DATA_DIRS=${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_DATA_DIRS
@@ -18,7 +28,14 @@ appimageTools.wrapType2 rec {
 
   multiPkgs = null; # no 32bit needed
   extraPkgs = p: (appimageTools.defaultFhsEnvArgs.multiPkgs p) ++ [ p.at-spi2-atk p.at-spi2-core ];
-  extraInstallCommands = "mv $out/bin/{${name},${pname}}";
+  extraInstallCommands = ''
+    mv $out/bin/{${name},${pname}}
+    install -m 444 -D ${appimageContents}/notable.desktop $out/share/applications/notable.desktop
+    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/1024x1024/apps/notable.png \
+      $out/share/icons/hicolor/1024x1024/apps/notable.png
+    substituteInPlace $out/share/applications/notable.desktop \
+      --replace 'Exec=AppRun' 'Exec=${pname}'
+  '';
 
   meta = with lib; {
     description = "The markdown-based note-taking app that doesn't suck";
diff --git a/pkgs/applications/misc/osmium-tool/default.nix b/pkgs/applications/misc/osmium-tool/default.nix
index 82144e9689f8..c0d20c14f7ce 100644
--- a/pkgs/applications/misc/osmium-tool/default.nix
+++ b/pkgs/applications/misc/osmium-tool/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "osmium-tool";
-  version = "1.11.1";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "osmcode";
     repo = "osmium-tool";
     rev = "v${version}";
-    sha256 = "199dvajik5d56nybk2061vdjyxwakngfd7frxj99wr2vsrp4aw2b";
+    sha256 = "18afn5qzdjpip176kk5pr04mj0p7dv70dbz1n36qmqnq3gyms10q";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/misc/pdfarranger/default.nix b/pkgs/applications/misc/pdfarranger/default.nix
index 58d889484d6f..4d2576aaadce 100644
--- a/pkgs/applications/misc/pdfarranger/default.nix
+++ b/pkgs/applications/misc/pdfarranger/default.nix
@@ -5,13 +5,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pdfarranger";
-  version = "1.4.2";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "jeromerobert";
     repo = pname;
     rev = version;
-    sha256 = "11q14pxyp5z4y3gabjnis3ip3xss6n94zjl42akwf27dxgxlpcjk";
+    sha256 = "0n4jw0dsqw929a34ff077kz8w89vkjkqf8dy4c356zh6gf23cdxr";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/pdfsam-basic/default.nix b/pkgs/applications/misc/pdfsam-basic/default.nix
index abf49f936845..d18923527851 100644
--- a/pkgs/applications/misc/pdfsam-basic/default.nix
+++ b/pkgs/applications/misc/pdfsam-basic/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pdfsam-basic";
-  version = "4.1.2";
+  version = "4.1.3";
 
   src = fetchurl {
     url = "https://github.com/torakiki/pdfsam/releases/download/v${version}/pdfsam_${version}-1_amd64.deb";
-    sha256 = "1k1azxz92vkb4hylk4ki0szfn47ids0lwg01zfs54yc89j0c6142";
+    sha256 = "1rhv6mf6pr9aaa8516i3b7v6h622qb1p8c4jsy3j0s5wrdry5l9l";
   };
 
   unpackPhase = ''
diff --git a/pkgs/applications/misc/pueue/default.nix b/pkgs/applications/misc/pueue/default.nix
index e90a86f225bf..0498419910f6 100644
--- a/pkgs/applications/misc/pueue/default.nix
+++ b/pkgs/applications/misc/pueue/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pueue";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "Nukesor";
     repo = pname;
     rev = "v${version}";
-    sha256 = "11x4y3ah9f7mv9jssws95sw7rd20fxwdh11mrhcb4vwk59cmqsjz";
+    sha256 = "1v3fphx71hyv7fq09slhyzchw362swzhmhn7wmbazfdrj6fjhcki";
   };
 
-  cargoSha256 = "06zv3li14sg4a8bgj38zzx576ggm32ss0djmys1g0h5a0nxaaqfx";
+  cargoSha256 = "04vi9la17pabz1spfw1fzgy4c2ifnis6am5m4ck3lhccnn6j8bd3";
 
   checkPhase = "cargo test -- --skip test_single_huge_payload";
 
diff --git a/pkgs/applications/misc/redshift/default.nix b/pkgs/applications/misc/redshift/default.nix
index 81fbcc8b4838..43393478ec4a 100644
--- a/pkgs/applications/misc/redshift/default.nix
+++ b/pkgs/applications/misc/redshift/default.nix
@@ -101,12 +101,13 @@ rec {
 
   redshift-wlr = mkRedshift {
     pname = "redshift-wlr";
-    version = "2019-04-17";
+    # upstream rebases so this is the push date
+    version = "2019-08-24";
 
     src = fetchFromGitHub {
       owner = "minus7";
       repo = "redshift";
-      rev = "eecbfedac48f827e96ad5e151de8f41f6cd3af66";
+      rev = "7da875d34854a6a34612d5ce4bd8718c32bec804";
       sha256 = "0rs9bxxrw4wscf4a8yl776a8g880m5gcm75q06yx2cn3lw2b7v22";
     };
 
diff --git a/pkgs/applications/misc/sweethome3d/default.nix b/pkgs/applications/misc/sweethome3d/default.nix
index 7f094607859c..926db03652d6 100644
--- a/pkgs/applications/misc/sweethome3d/default.nix
+++ b/pkgs/applications/misc/sweethome3d/default.nix
@@ -73,14 +73,14 @@ in {
 
   application = mkSweetHome3D rec {
     pname = stdenv.lib.toLower module + "-application";
-    version = "6.2";
+    version = "6.3";
     module = "SweetHome3D";
     description = "Design and visualize your future home";
     license = stdenv.lib.licenses.gpl2Plus;
     src = fetchsvn {
       url = "https://svn.code.sf.net/p/sweethome3d/code/tags/V_" + d2u version + "/SweetHome3D/";
-      sha256 = "0a514a1zmipykvawil46v826ivkw9c00vdkyggyl6m41giay15zf";
-      rev = "6822";
+      sha256 = "1c13g0f73jgbzmjhdm9knqq1kh3vdl04zl3xlp30g9a1n0jkr38i";
+      rev = "6896";
     };
     desktopName = "Sweet Home 3D";
     icons = {
diff --git a/pkgs/applications/misc/toot/default.nix b/pkgs/applications/misc/toot/default.nix
index 7f1c3648f245..5ce35f3292bd 100644
--- a/pkgs/applications/misc/toot/default.nix
+++ b/pkgs/applications/misc/toot/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, python3Packages }:
 
 python3Packages.buildPythonApplication rec {
-  version = "0.25.2";
+  version = "0.26.0";
   name    = "toot-${version}";
 
   src = fetchFromGitHub {
     owner  = "ihabunek";
     repo   = "toot";
     rev    = version;
-    sha256 = "0g18x8pbwhk2d3aphah6dqqbhz62k48pwx63flsnqd4brccd0jkh";
+    sha256 = "146jj83jixahgxwh12bbkfvci2wrz398h5x01kgppdy59m4pa4pl";
   };
 
   checkInputs = with python3Packages; [ pytest ];
diff --git a/pkgs/applications/networking/browsers/ephemeral/default.nix b/pkgs/applications/networking/browsers/ephemeral/default.nix
index 53d0ffb4c193..ead9555c3a6b 100644
--- a/pkgs/applications/networking/browsers/ephemeral/default.nix
+++ b/pkgs/applications/networking/browsers/ephemeral/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ephemeral";
-  version = "6.3.3";
+  version = "6.4.1";
 
   src = fetchFromGitHub {
     owner = "cassidyjames";
     repo = "ephemeral";
     rev = version;
-    sha256 = "093bqc40p4s8jc1s5rg49363x24vnwwjayvgzmi4xag28f1x6kn8";
+    sha256 = "1lzcwaczh601kwbx7fzg32nrzlg67asby7p86qy10qz86xf4g608";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/cluster/chronos/default.nix b/pkgs/applications/networking/cluster/chronos/default.nix
index e2452b2b4411..e0cc780841bf 100644
--- a/pkgs/applications/networking/cluster/chronos/default.nix
+++ b/pkgs/applications/networking/cluster/chronos/default.nix
@@ -34,6 +34,6 @@ stdenv.mkDerivation rec {
     description = "Fault tolerant job scheduler for Mesos which handles dependencies and ISO8601 based schedules";
     maintainers = with maintainers; [ offline ];
     platforms   = platforms.unix;
-    broken = true; # doesn't build http://hydra.nixos.org/build/25768319
+    broken = true; # doesn't build https://hydra.nixos.org/build/25768319
   };
 }
diff --git a/pkgs/applications/networking/cluster/helmfile/default.nix b/pkgs/applications/networking/cluster/helmfile/default.nix
index 1318ff003de3..628ae10f11b7 100644
--- a/pkgs/applications/networking/cluster/helmfile/default.nix
+++ b/pkgs/applications/networking/cluster/helmfile/default.nix
@@ -1,6 +1,6 @@
 { lib, buildGoModule, fetchFromGitHub, makeWrapper, kubernetes-helm, ... }:
 
-let version = "0.106.3"; in
+let version = "0.114.0"; in
 
 buildGoModule {
   pname = "helmfile";
@@ -10,12 +10,12 @@ buildGoModule {
     owner = "roboll";
     repo = "helmfile";
     rev = "v${version}";
-    sha256 = "0pwkkgdcj9vx6nk574iaqwn074qfpgqd1c44d3kr3xdbac89yfyf";
+    sha256 = "0486wcfizi8xljr29mznc4p11ggz4rvk5n53qvb30f7ry4ncc8n5";
   };
 
   goPackagePath = "github.com/roboll/helmfile";
 
-  modSha256 = "1yv2b44qac0rms66v0qg13wsga0di6hwxa4dh2l0b1xvaf75ysay";
+  modSha256 = "0j7w12rrnsv2h5v0bqh6sjq9anm51zs0p3nzlhwsksw9c98r9avk";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/applications/networking/cluster/luigi/default.nix b/pkgs/applications/networking/cluster/luigi/default.nix
index 010d8cf4d215..ced4c45d059d 100644
--- a/pkgs/applications/networking/cluster/luigi/default.nix
+++ b/pkgs/applications/networking/cluster/luigi/default.nix
@@ -2,11 +2,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "luigi";
-  version = "2.8.12";
+  version = "2.8.13";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "1p83mxqs7w5v27a58ps7wji5mlyfz66cpkbyrndix0pv9hdyzpxn";
+    sha256 = "0x14549iwj7r1knc0hmic9ny9hp960yjjqi4mxl78jb69gd3bhmf";
   };
 
   propagatedBuildInputs = with python3Packages; [ dateutil tornado_4 python-daemon boto3 ];
diff --git a/pkgs/applications/networking/feedreaders/rssguard/default.nix b/pkgs/applications/networking/feedreaders/rssguard/default.nix
index d0825404f017..5ee80250dde1 100644
--- a/pkgs/applications/networking/feedreaders/rssguard/default.nix
+++ b/pkgs/applications/networking/feedreaders/rssguard/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rssguard";
-  version = "3.5.9";
+  version = "3.6.0";
 
   src = fetchFromGitHub {
     owner = "martinrotter";
     repo = pname;
     rev = version;
-    sha256 = "0dvjcazvrgxfxg1gvznxj8kx569v4ivns0brq00cn2yxyd4wx43s";
+    sha256 = "0nlvhcvd3bbvd3dapqix7h29pchbd9gv5n3hmrig9yi98yv8q53r";
   };
 
   buildInputs =  [ qtwebengine qttools ];
diff --git a/pkgs/applications/networking/instant-messengers/qtox/default.nix b/pkgs/applications/networking/instant-messengers/qtox/default.nix
index e3fc384f0f08..58d6230f26ae 100644
--- a/pkgs/applications/networking/instant-messengers/qtox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/qtox/default.nix
@@ -7,7 +7,7 @@
 , AVFoundation ? null }:
 
 let
-  version = "1.16.3";
+  version = "1.17.2";
   rev = "v${version}";
 
 in mkDerivation {
@@ -17,7 +17,7 @@ in mkDerivation {
   src = fetchFromGitHub {
     owner  = "qTox";
     repo   = "qTox";
-    sha256 = "0qd4nvbrjnnfnk8ghsxq3cd1n1qf1ck5zg6ib11ij2pg03s146pa";
+    sha256 = "04pbv1zsxy8dph2v0r9xc8lcm5g6604pwnppi3la5w46ihbwxlb9";
     inherit rev;
   };
 
diff --git a/pkgs/applications/networking/instant-messengers/signal-cli/default.nix b/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
index a062d679f7fa..a4594a20caf7 100644
--- a/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "signal-cli";
-  version = "0.6.6";
+  version = "0.6.7";
 
   # Building from source would be preferred, but is much more involved.
   src = fetchurl {
     url = "https://github.com/AsamK/signal-cli/releases/download/v${version}/signal-cli-${version}.tar.gz";
-    sha256 = "1r0w9knxa2kx5my9xgmcnhq14287ixwbqxqip5ispj78d27g4zfq";
+    sha256 = "13wz2c0n89aglqjfqlma1z4jr5xnp2qlg8cqng3v9axpkkynk996";
   };
 
   buildInputs = lib.optionals stdenv.isLinux [ libmatthew_java dbus dbus_java ];
diff --git a/pkgs/applications/networking/instant-messengers/vacuum/default.nix b/pkgs/applications/networking/instant-messengers/vacuum/default.nix
index cbd32347c4e2..ed320d9679d6 100644
--- a/pkgs/applications/networking/instant-messengers/vacuum/default.nix
+++ b/pkgs/applications/networking/instant-messengers/vacuum/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
   ];
 
   # hack: needed to fix build issues in
-  # http://hydra.nixos.org/build/38322959/nixlog/1
+  # https://hydra.nixos.org/build/38322959/nixlog/1
   # should be an upstream issue but it's easy to fix
   NIX_LDFLAGS = "-lz";
 
diff --git a/pkgs/applications/networking/onionshare/default.nix b/pkgs/applications/networking/onionshare/default.nix
new file mode 100644
index 000000000000..77d08692f625
--- /dev/null
+++ b/pkgs/applications/networking/onionshare/default.nix
@@ -0,0 +1,113 @@
+{
+  lib,
+  buildPythonApplication,
+  stdenv,
+  substituteAll,
+  fetchFromGitHub,
+  isPy3k,
+  flask,
+  flask-httpauth,
+  stem,
+  pyqt5,
+  pycrypto,
+  pysocks,
+  pytest,
+  qt5,
+  requests,
+  tor,
+  obfs4,
+}:
+
+let
+  version = "2.2";
+  src = fetchFromGitHub {
+    owner = "micahflee";
+    repo = "onionshare";
+    rev = "v${version}";
+    sha256 = "0m8ygxcyp3nfzzhxs2dfnpqwh1vx0aws44lszpnnczz4fks3a5j4";
+  };
+  meta = with lib; {
+    description = "Securely and anonymously send and receive files";
+    longDescription = ''
+    OnionShare is an open source tool for securely and anonymously sending
+    and receiving files using Tor onion services. It works by starting a web
+    server directly on your computer and making it accessible as an
+    unguessable Tor web address that others can load in Tor Browser to
+    download files from you, or upload files to you. It doesn't require
+    setting up a separate server, using a third party file-sharing service,
+    or even logging into an account.
+
+    Unlike services like email, Google Drive, DropBox, WeTransfer, or nearly
+    any other way people typically send files to each other, when you use
+    OnionShare you don't give any companies access to the files that you're
+    sharing. So long as you share the unguessable web address in a secure way
+    (like pasting it in an encrypted messaging app), no one but you and the
+    person you're sharing with can access the files.
+    '';
+
+    homepage = "https://onionshare.org/";
+
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ lourkeur ];
+  };
+
+  common = buildPythonApplication {
+    pname = "onionshare-common";
+    inherit version meta src;
+
+    disable = !isPy3k;
+    propagatedBuildInputs = [
+      flask
+      flask-httpauth
+      stem
+      pyqt5
+      pycrypto
+      pysocks
+      requests
+    ];
+    buildInputs = [
+      tor
+      obfs4
+    ];
+
+    patches = [
+      (substituteAll {
+        src = ./fix-paths.patch;
+        inherit tor obfs4;
+        inherit (tor) geoip;
+      })
+    ];
+    postPatch = "substituteInPlace onionshare/common.py --subst-var-by common $out";
+
+    doCheck = false;
+  };
+in
+{
+  onionshare = stdenv.mkDerivation {
+    pname = "onionshare";
+    inherit version meta;
+
+    dontUnpack = true;
+
+    inherit common;
+    installPhase = ''
+      mkdir -p $out/bin
+      cp $common/bin/onionshare -t $out/bin
+    '';
+  };
+  onionshare-gui = stdenv.mkDerivation {
+    pname = "onionshare-gui";
+    inherit version meta;
+
+    nativeBuildInputs = [ qt5.wrapQtAppsHook ];
+
+    dontUnpack = true;
+
+    inherit common;
+    installPhase = ''
+      mkdir -p $out/bin
+      cp $common/bin/onionshare-gui -t $out/bin
+      wrapQtApp $out/bin/onionshare-gui
+    '';
+  };
+}
diff --git a/pkgs/applications/networking/onionshare/fix-paths.patch b/pkgs/applications/networking/onionshare/fix-paths.patch
new file mode 100644
index 000000000000..ddd0c75334bb
--- /dev/null
+++ b/pkgs/applications/networking/onionshare/fix-paths.patch
@@ -0,0 +1,134 @@
+diff --git a/onionshare/common.py b/onionshare/common.py
+index 3373462..7fd245b 100644
+--- a/onionshare/common.py
++++ b/onionshare/common.py
+@@ -87,66 +87,16 @@ class Common(object):
+                 ),
+                 "share",
+             )
+-            if not os.path.exists(prefix):
+-                # While running tests during stdeb bdist_deb, look 3 directories up for the share folder
+-                prefix = os.path.join(
+-                    os.path.dirname(
+-                        os.path.dirname(os.path.dirname(os.path.dirname(prefix)))
+-                    ),
+-                    "share",
+-                )
+-
+-        elif self.platform == "BSD" or self.platform == "Linux":
+-            # Assume OnionShare is installed systemwide in Linux, since we're not running in dev mode
+-            prefix = os.path.join(sys.prefix, "share/onionshare")
+-
+-        elif getattr(sys, "frozen", False):
+-            # Check if app is "frozen"
+-            # https://pythonhosted.org/PyInstaller/#run-time-information
+-            if self.platform == "Darwin":
+-                prefix = os.path.join(sys._MEIPASS, "share")
+-            elif self.platform == "Windows":
+-                prefix = os.path.join(os.path.dirname(sys.executable), "share")
++        else:
++            prefix = "@common@/share/onionshare"
+
+         return os.path.join(prefix, filename)
+
+     def get_tor_paths(self):
+-        if self.platform == "Linux":
+-            tor_path = "/usr/bin/tor"
+-            tor_geo_ip_file_path = "/usr/share/tor/geoip"
+-            tor_geo_ipv6_file_path = "/usr/share/tor/geoip6"
+-            obfs4proxy_file_path = "/usr/bin/obfs4proxy"
+-        elif self.platform == "Windows":
+-            base_path = os.path.join(
+-                os.path.dirname(os.path.dirname(self.get_resource_path(""))), "tor"
+-            )
+-            tor_path = os.path.join(os.path.join(base_path, "Tor"), "tor.exe")
+-            obfs4proxy_file_path = os.path.join(
+-                os.path.join(base_path, "Tor"), "obfs4proxy.exe"
+-            )
+-            tor_geo_ip_file_path = os.path.join(
+-                os.path.join(os.path.join(base_path, "Data"), "Tor"), "geoip"
+-            )
+-            tor_geo_ipv6_file_path = os.path.join(
+-                os.path.join(os.path.join(base_path, "Data"), "Tor"), "geoip6"
+-            )
+-        elif self.platform == "Darwin":
+-            base_path = os.path.dirname(
+-                os.path.dirname(os.path.dirname(self.get_resource_path("")))
+-            )
+-            tor_path = os.path.join(base_path, "Resources", "Tor", "tor")
+-            tor_geo_ip_file_path = os.path.join(base_path, "Resources", "Tor", "geoip")
+-            tor_geo_ipv6_file_path = os.path.join(
+-                base_path, "Resources", "Tor", "geoip6"
+-            )
+-            obfs4proxy_file_path = os.path.join(
+-                base_path, "Resources", "Tor", "obfs4proxy"
+-            )
+-        elif self.platform == "BSD":
+-            tor_path = "/usr/local/bin/tor"
+-            tor_geo_ip_file_path = "/usr/local/share/tor/geoip"
+-            tor_geo_ipv6_file_path = "/usr/local/share/tor/geoip6"
+-            obfs4proxy_file_path = "/usr/local/bin/obfs4proxy"
++        tor_path = "@tor@/bin/tor"
++        tor_geo_ip_file_path = "@geoip@/share/tor/geoip"
++        tor_geo_ipv6_file_path = "@geoip@/share/tor/geoip6"
++        obfs4proxy_file_path = "@obfs4@/bin/obfs4proxy"
+
+         return (
+             tor_path,
+diff --git a/setup.py b/setup.py
+index 9af72fc..53ca47b 100644
+--- a/setup.py
++++ b/setup.py
+@@ -70,41 +70,41 @@ classifiers = [
+ ]
+ data_files = [
+     (
+-        os.path.join(sys.prefix, "share/applications"),
++        "share/applications",
+         ["install/org.onionshare.OnionShare.desktop"],
+     ),
+     (
+-        os.path.join(sys.prefix, "share/icons/hicolor/scalable/apps"),
++        "share/icons/hicolor/scalable/apps",
+         ["install/org.onionshare.OnionShare.svg"],
+     ),
+     (
+-        os.path.join(sys.prefix, "share/metainfo"),
++        "share/metainfo",
+         ["install/org.onionshare.OnionShare.appdata.xml"],
+     ),
+-    (os.path.join(sys.prefix, "share/onionshare"), file_list("share")),
+-    (os.path.join(sys.prefix, "share/onionshare/images"), file_list("share/images")),
+-    (os.path.join(sys.prefix, "share/onionshare/locale"), file_list("share/locale")),
++    ( "share/onionshare", file_list("share")),
++    ( "share/onionshare/images", file_list("share/images")),
++    ( "share/onionshare/locale", file_list("share/locale")),
+     (
+-        os.path.join(sys.prefix, "share/onionshare/templates"),
++        "share/onionshare/templates",
+         file_list("share/templates"),
+     ),
+     (
+-        os.path.join(sys.prefix, "share/onionshare/static/css"),
++        "share/onionshare/static/css",
+         file_list("share/static/css"),
+     ),
+     (
+-        os.path.join(sys.prefix, "share/onionshare/static/img"),
++        "share/onionshare/static/img",
+         file_list("share/static/img"),
+     ),
+     (
+-        os.path.join(sys.prefix, "share/onionshare/static/js"),
++        "share/onionshare/static/js",
+         file_list("share/static/js"),
+     ),
+ ]
+ if not platform.system().endswith("BSD") and platform.system() != "DragonFly":
+     data_files.append(
+         (
+-            "/usr/share/nautilus-python/extensions/",
++            "share/nautilus-python/extensions/",
+             ["install/scripts/onionshare-nautilus.py"],
+         )
+     )
diff --git a/pkgs/applications/networking/p2p/tribler/default.nix b/pkgs/applications/networking/p2p/tribler/default.nix
index e9c5f2741432..ed1129b238ac 100644
--- a/pkgs/applications/networking/p2p/tribler/default.nix
+++ b/pkgs/applications/networking/p2p/tribler/default.nix
@@ -71,6 +71,11 @@ stdenv.mkDerivation rec {
         ${stdenv.lib.optionalString enablePlayer ''
           --prefix LD_LIBRARY_PATH : ${vlc}/lib
         ''}
+
+    mkdir -p $out/share/applications $out/share/icons $out/share/man/man1
+    cp $out/Tribler/Main/Build/Ubuntu/tribler.desktop $out/share/applications/tribler.desktop
+    cp $out/Tribler/Main/Build/Ubuntu/tribler_big.xpm $out/share/icons/tribler.xpm
+    cp $out/Tribler/Main/Build/Ubuntu/tribler.1 $out/share/man/man1/tribler.1
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/networking/ssb/patchwork/default.nix b/pkgs/applications/networking/ssb/patchwork/default.nix
index c7766889f502..db33e7e6bb21 100644
--- a/pkgs/applications/networking/ssb/patchwork/default.nix
+++ b/pkgs/applications/networking/ssb/patchwork/default.nix
@@ -2,12 +2,12 @@
 
 let
   pname = "ssb-patchwork";
-  version = "3.17.6";
+  version = "3.17.7";
   name = "Patchwork-${version}";
 
   src = fetchurl {
     url = "https://github.com/ssbc/patchwork/releases/download/v${version}/${name}.AppImage";
-    sha256 = "0bq4pi0rmfsyiiapnhkkhikg2a2jzqlna4gvk6gw7wl0r8a111cs";
+    sha256 = "1xj2aqy7daf4r3ypch6hkvk1s0jnx70qwh0p63c7rzm16vh8kb2f";
   };
 
   binary = appimageTools.wrapType2 {
diff --git a/pkgs/applications/office/aesop/default.nix b/pkgs/applications/office/aesop/default.nix
index 1e1f686ab194..4f8c115600af 100644
--- a/pkgs/applications/office/aesop/default.nix
+++ b/pkgs/applications/office/aesop/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aesop";
-  version = "1.2.4";
+  version = "1.2.5";
 
   src = fetchFromGitHub {
     owner = "lainsce";
     repo = pname;
     rev = version;
-    sha256 = "1bqykr1mwanfm55w1v9ipqcqgzj8kbjvlm4d5b2swvhng77gnf3d";
+    sha256 = "1zxyyxl959rqhyz871dyyccqga2ydybkfcpyjq4vmvdn2g9mvmb0";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/office/elementary-planner/default.nix b/pkgs/applications/office/elementary-planner/default.nix
index 3e3765ca77f6..28a470162cef 100644
--- a/pkgs/applications/office/elementary-planner/default.nix
+++ b/pkgs/applications/office/elementary-planner/default.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-planner";
-  version = "2.3.3";
+  version = "2.3.5";
 
   src = fetchFromGitHub {
     owner = "alainm23";
     repo = "planner";
     rev = version;
-    sha256 = "1jc668hg26vb1q50abm6k566v9qimgs9skkwmlgi5h37vxm3ai1x";
+    sha256 = "15d51sqb3k59jjishsw1fq5ib50jmhlk194y3nga329damfv8bmy";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/biology/picard-tools/default.nix b/pkgs/applications/science/biology/picard-tools/default.nix
index 246c98768101..5073d0f0f324 100644
--- a/pkgs/applications/science/biology/picard-tools/default.nix
+++ b/pkgs/applications/science/biology/picard-tools/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "picard-tools";
-  version = "2.22.2";
+  version = "2.22.4";
 
   src = fetchurl {
     url = "https://github.com/broadinstitute/picard/releases/download/${version}/picard.jar";
-    sha256 = "11mzz483f89pb2s8jmwhl12d0m6k41kmi4xh0i6hq69rxrqi8l4s";
+    sha256 = "0gzna5df8nk42l7mc0qbp9h73gwr1030jnw10fawjp6ql6213kdd";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/science/logic/cryptominisat/default.nix b/pkgs/applications/science/logic/cryptominisat/default.nix
index 113c6307c40b..8c1b3bd03694 100644
--- a/pkgs/applications/science/logic/cryptominisat/default.nix
+++ b/pkgs/applications/science/logic/cryptominisat/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cryptominisat";
-  version = "5.6.8";
+  version = "5.7.0";
 
   src = fetchFromGitHub {
     owner  = "msoos";
     repo   = "cryptominisat";
     rev    = version;
-    sha256 = "0csimmy1nvkfcsxjra9bm4mlcyxa3ac8zarm88zfb7640ca0d0wv";
+    sha256 = "0ny5ln8fc0irprs04qw01c9mppps8q27lkx01a549zazwhj4b5rm";
   };
 
   buildInputs = [ python3 boost ];
diff --git a/pkgs/applications/version-management/git-and-tools/git-trim/default.nix b/pkgs/applications/version-management/git-and-tools/git-trim/default.nix
index 0a3360b33b0d..d843cdc307c0 100644
--- a/pkgs/applications/version-management/git-and-tools/git-trim/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-trim/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-trim";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "foriequal0";
     repo = pname;
     rev = "v${version}";
-    sha256 = "06wni47s8yq274bh5f7bcy0sah23938kjiw5pdxnma5kwwnrccrr";
+    sha256 = "079kavm3n776wvmy25jq1g4qdvmhh3d3x1vdpb1f6pw5rkky8lyw";
   };
 
-  cargoSha256 = "06ndja8212xy4rybh1117wijsyj70w4z8h6km538a7598s49vzdk";
+  cargoSha256 = "1ii5l7z9avg0gzlaav2gnfbr8wkbp008i5rz6k6bs2sfqnpnn5k6";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/applications/version-management/git-and-tools/git-workspace/default.nix b/pkgs/applications/version-management/git-and-tools/git-workspace/default.nix
index b93163e239ad..8894c4f0f7ad 100644
--- a/pkgs/applications/version-management/git-and-tools/git-workspace/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-workspace/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-workspace";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "orf";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0pl5z0gx2ypkrgq7vj1cxj5iwj06vcd06x3b3nh0g7w7q7nl8pr4";
+    sha256 = "0n025bnisg724d9pjcindxagj1ry63sxr0pplpkh2f2qffzm78pi";
   };
 
-  cargoSha256 = "1z4cb7rcb7ldj16xxynrjh4hg872rj39rbbp0vy15kdp3ifyi466";
+  cargoSha256 = "0ikyp6pdlw2c1gr1n1snjbdmblm0fs5swx5awy36jskii99q6kr1";
 
   buildInputs = with stdenv; lib.optional isDarwin Security;
 
diff --git a/pkgs/applications/video/plex-mpv-shim/default.nix b/pkgs/applications/video/plex-mpv-shim/default.nix
index df72e200e62a..268905e3a4c0 100644
--- a/pkgs/applications/video/plex-mpv-shim/default.nix
+++ b/pkgs/applications/video/plex-mpv-shim/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonApplication rec {
   pname = "plex-mpv-shim";
-  version = "1.7.14";
+  version = "1.7.16";
 
   src = fetchFromGitHub {
     owner = "iwalton3";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1rjifqvs59w2aacfird02myqfd34qadhacj9zpy5xjz25x410zza";
+    sha256 = "1pnbdxaqnliwqfvv08gi7gdcvflg5vcbgk4g0fw75prgw54vnd9a";
   };
 
   propagatedBuildInputs = [ mpv requests python-mpv-jsonipc ];
diff --git a/pkgs/applications/video/shotcut/default.nix b/pkgs/applications/video/shotcut/default.nix
index b3c058186382..9c0435a351c8 100644
--- a/pkgs/applications/video/shotcut/default.nix
+++ b/pkgs/applications/video/shotcut/default.nix
@@ -8,13 +8,13 @@ assert stdenv.lib.versionAtLeast mlt.version "6.18.0";
 
 mkDerivation rec {
   pname = "shotcut";
-  version = "20.04.01";
+  version = "20.04.12";
 
   src = fetchFromGitHub {
     owner = "mltframework";
     repo = "shotcut";
     rev = "v${version}";
-    sha256 = "10svbhsd5q8z1k055kcfibil97qifwzn3xmnf5b9sxa7ky4bkmqr";
+    sha256 = "05yyv9192f722j8fhfjrphxadgp3crvbq4pi23ln560zh9s1m8r4";
   };
 
   patches = [ ./0001-encodedock.cpp-connect-to-VAAPI-via-DRM-not-X11.patch ];
diff --git a/pkgs/applications/video/streamlink/default.nix b/pkgs/applications/video/streamlink/default.nix
index a12d08458901..782b81cc2380 100644
--- a/pkgs/applications/video/streamlink/default.nix
+++ b/pkgs/applications/video/streamlink/default.nix
@@ -1,14 +1,14 @@
 { stdenv, pythonPackages, fetchFromGitHub, rtmpdump, ffmpeg }:
 
 pythonPackages.buildPythonApplication rec {
-  version = "1.3.1";
+  version = "1.4.1";
   pname = "streamlink";
 
   src = fetchFromGitHub {
     owner = "streamlink";
     repo = "streamlink";
     rev = version;
-    sha256 = "0scc0mzvy56b1l6iyvrzb28l8vzrxpfkn4lcwr8nnyjb7ams2xms";
+    sha256 = "1q3h48qwf7vs2wnbkwv0xnm6s65mkcyqdz7z6z3vrsmif2sb19l2";
   };
 
   checkInputs = with pythonPackages; [ pytest mock requests-mock freezegun ];
diff --git a/pkgs/applications/virtualization/OVMF/default.nix b/pkgs/applications/virtualization/OVMF/default.nix
index 310d41df36da..19ba8ced4973 100644
--- a/pkgs/applications/virtualization/OVMF/default.nix
+++ b/pkgs/applications/virtualization/OVMF/default.nix
@@ -57,6 +57,6 @@ edk2.mkDerivation projectDscPath {
     description = "Sample UEFI firmware for QEMU and KVM";
     homepage = "https://github.com/tianocore/tianocore.github.io/wiki/OVMF";
     license = stdenv.lib.licenses.bsd2;
-    platforms = ["x86_64-linux" "i686-linux" "aarch64-linux"];
+    platforms = ["x86_64-linux" "i686-linux" "aarch64-linux" "x86_64-darwin"];
   };
 }
diff --git a/pkgs/applications/virtualization/podman/wrapper.nix b/pkgs/applications/virtualization/podman/wrapper.nix
index 0b905c0c709e..99233696b3ed 100644
--- a/pkgs/applications/virtualization/podman/wrapper.nix
+++ b/pkgs/applications/virtualization/podman/wrapper.nix
@@ -28,21 +28,25 @@ let
   ] ++ extraPackages);
 
 in runCommand podman.name {
-  inherit (podman) name pname version meta outputs;
+  name = "${podman.pname}-wrapper-${podman.version}";
+  inherit (podman) pname version;
+
+  meta = builtins.removeAttrs podman.meta [ "outputsToInstall" ];
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
   nativeBuildInputs = [
     makeWrapper
   ];
 
 } ''
-  # Symlink everything but $bin from podman-unwrapped
-  ${
-    lib.concatMapStringsSep "\n"
-    (o: "ln -s ${podman.${o}} ${placeholder o}")
-    (builtins.filter (o: o != "bin")
-    podman.outputs)}
-
-  mkdir -p $bin/bin
-  ln -s ${podman-unwrapped}/share $bin/share
-  makeWrapper ${podman-unwrapped}/bin/podman $bin/bin/podman \
+  ln -s ${podman.man} $man
+
+  mkdir -p $out/bin
+  ln -s ${podman-unwrapped}/share $out/share
+  makeWrapper ${podman-unwrapped}/bin/podman $out/bin/podman \
     --prefix PATH : ${binPath}
 ''
diff --git a/pkgs/applications/virtualization/tini/default.nix b/pkgs/applications/virtualization/tini/default.nix
index e3e6bae6cfe8..db3fb1c96eb3 100644
--- a/pkgs/applications/virtualization/tini/default.nix
+++ b/pkgs/applications/virtualization/tini/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, cmake, glibc }:
 
 stdenv.mkDerivation rec {
-  version = "0.18.0";
+  version = "0.19.0";
   pname = "tini";
 
   src = fetchFromGitHub {
     owner = "krallin";
     repo = "tini";
     rev = "v${version}";
-    sha256 ="1h20i3wwlbd8x4jr2gz68hgklh0lb0jj7y5xk1wvr8y58fip1rdn";
+    sha256 ="1hnnvjydg7gi5gx6nibjjdnfipblh84qcpajc08nvr44rkzswck4";
   };
 
   patchPhase = "sed -i /tini-static/d CMakeLists.txt";
diff --git a/pkgs/build-support/fetchgit/nix-prefetch-git b/pkgs/build-support/fetchgit/nix-prefetch-git
index abba76bd1ac9..43f7c5acd5ad 100755
--- a/pkgs/build-support/fetchgit/nix-prefetch-git
+++ b/pkgs/build-support/fetchgit/nix-prefetch-git
@@ -373,6 +373,7 @@ print_results() {
   "url": "$(json_escape "$url")",
   "rev": "$(json_escape "$fullRev")",
   "date": "$(json_escape "$commitDateStrict8601")",
+  "path": "$(json_escape "$finalPath")",
   "$(json_escape "$hashType")": "$(json_escape "$hash")",
   "fetchSubmodules": $([[ -n "$fetchSubmodules" ]] && echo true || echo false),
   "deepClone": $([[ -n "$deepClone" ]] && echo true || echo false),
diff --git a/pkgs/build-support/fetchurl/default.nix b/pkgs/build-support/fetchurl/default.nix
index 7d23a3a7f8f1..a0c48468dfac 100644
--- a/pkgs/build-support/fetchurl/default.nix
+++ b/pkgs/build-support/fetchurl/default.nix
@@ -65,7 +65,7 @@ in
 , # Shell code to build a netrc file for BASIC auth
   netrcPhase ? null
 
-, # Impure env vars (http://nixos.org/nix/manual/#sec-advanced-attributes)
+, # Impure env vars (https://nixos.org/nix/manual/#sec-advanced-attributes)
   # needed for netrcPhase
   netrcImpureEnvVars ? []
 
diff --git a/pkgs/data/icons/papirus-icon-theme/default.nix b/pkgs/data/icons/papirus-icon-theme/default.nix
index b47c01d973eb..a39a87206354 100644
--- a/pkgs/data/icons/papirus-icon-theme/default.nix
+++ b/pkgs/data/icons/papirus-icon-theme/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "papirus-icon-theme";
-  version = "20200405";
+  version = "20200430";
 
   src = fetchFromGitHub {
     owner = "PapirusDevelopmentTeam";
     repo = pname;
     rev = version;
-    sha256 = "0qv4340avm5s0640r8aznbfwjzvm6k64840qggyg9jfcy6223pdy";
+    sha256 = "1dgxf3fi4x5iy504xncj1jba8cd51axkn2j1cfb220rpc6mzv25l";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/deepin/deepin-anything/default.nix b/pkgs/desktops/deepin/deepin-anything/default.nix
index 7697c23ae141..be7fe818e5c1 100644
--- a/pkgs/desktops/deepin/deepin-anything/default.nix
+++ b/pkgs/desktops/deepin/deepin-anything/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, mkDerivation, fetchFromGitHub, pkgconfig, qtbase, udisks2-qt5, utillinux,
+{ stdenv, mkDerivation, fetchFromGitHub, fetchpatch, pkgconfig, qtbase, udisks2-qt5, utillinux,
   dtkcore, deepin }:
 
 mkDerivation rec {
@@ -12,6 +12,16 @@ mkDerivation rec {
     sha256 = "1kvyffrii4b012f6ld1ih14qrn7gg5cxbdpbkac0wxb22hnz0azm";
   };
 
+  patches = [
+    # fix compilation error and add support to kernel 5.6
+    # https://github.com/linuxdeepin/deepin-anything/pull/27
+    (fetchpatch {
+      name = "linux-5.6.patch";
+      url = "https://github.com/linuxdeepin/deepin-anything/commit/764b820c2bcd7248993349b32f91043fc58ee958.patch";
+      sha256 = "1ww4xllxc2s04px6fy8wp5cyw54xaz155ry30sqz21vl8awfr36h";
+    })
+  ];
+
   outputs = [ "out" "modsrc" ];
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/lxqt/libqtxdg/default.nix b/pkgs/desktops/lxqt/libqtxdg/default.nix
index 526da0d84a4d..f5da7a4b2356 100644
--- a/pkgs/desktops/lxqt/libqtxdg/default.nix
+++ b/pkgs/desktops/lxqt/libqtxdg/default.nix
@@ -32,6 +32,8 @@ mkDerivation rec {
   preConfigure = ''
     cmakeFlagsArray+=(
       "-DQTXDGX_ICONENGINEPLUGIN_INSTALL_PATH=$out/$qtPluginPrefix/iconengines"
+      "-DCMAKE_INSTALL_INCLUDEDIR=include"
+      "-DCMAKE_INSTALL_LIBDIR=lib"
     )
   '';
 
diff --git a/pkgs/development/compilers/edk2/default.nix b/pkgs/development/compilers/edk2/default.nix
index 703ff4fa083b..8a18b6306c27 100644
--- a/pkgs/development/compilers/edk2/default.nix
+++ b/pkgs/development/compilers/edk2/default.nix
@@ -1,4 +1,17 @@
-{ stdenv, fetchgit, fetchpatch, libuuid, python3, iasl, bc }:
+{
+  stdenv,
+  clangStdenv,
+  fetchgit,
+  fetchpatch,
+  libuuid,
+  python3,
+  iasl,
+  bc,
+  clang_9,
+  llvmPackages_9,
+  overrideCC,
+  lib,
+}:
 
 let
   pythonEnv = python3.withPackages (ps: [ps.tkinter]);
@@ -12,7 +25,17 @@ else if stdenv.isAarch64 then
 else
   throw "Unsupported architecture";
 
-edk2 = stdenv.mkDerivation {
+buildStdenv = if stdenv.isDarwin then
+  overrideCC clangStdenv [ clang_9 llvmPackages_9.llvm llvmPackages_9.lld ]
+else
+  stdenv;
+
+buildType = if stdenv.isDarwin then
+    "CLANGPDB"
+  else
+    "GCC5";
+
+edk2 = buildStdenv.mkDerivation {
   pname = "edk2";
   version = "201911";
 
@@ -25,8 +48,10 @@ edk2 = stdenv.mkDerivation {
 
   buildInputs = [ libuuid pythonEnv ];
 
-  makeFlags = [ "-C BaseTools" ];
-  NIX_CFLAGS_COMPILE = "-Wno-return-type -Wno-error=stringop-truncation";
+  makeFlags = [ "-C BaseTools" ]
+    ++ lib.optional (stdenv.cc.isClang) [ "BUILD_CC=clang BUILD_CXX=clang++ BUILD_AS=clang" ];
+
+  NIX_CFLAGS_COMPILE = "-Wno-return-type" + lib.optionalString (stdenv.cc.isGNU) " -Wno-error=stringop-truncation";
 
   hardeningDisable = [ "format" "fortify" ];
 
@@ -38,15 +63,15 @@ edk2 = stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Intel EFI development kit";
     homepage = "https://sourceforge.net/projects/edk2/";
     license = licenses.bsd2;
-    platforms = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];
+    platforms = [ "x86_64-linux" "i686-linux" "aarch64-linux" "x86_64-darwin" ];
   };
 
   passthru = {
-    mkDerivation = projectDscPath: attrs: stdenv.mkDerivation ({
+    mkDerivation = projectDscPath: attrs: buildStdenv.mkDerivation ({
       inherit (edk2) src;
 
       buildInputs = [ bc pythonEnv ] ++ attrs.buildInputs or [];
@@ -65,7 +90,7 @@ edk2 = stdenv.mkDerivation {
 
       buildPhase = ''
         runHook preBuild
-        build -a ${targetArch} -b RELEASE -t GCC5 -p ${projectDscPath} -n $NIX_BUILD_CORES $buildFlags
+        build -a ${targetArch} -b RELEASE -t ${buildType} -p ${projectDscPath} -n $NIX_BUILD_CORES $buildFlags
         runHook postBuild
       '';
 
diff --git a/pkgs/development/compilers/kotlin/default.nix b/pkgs/development/compilers/kotlin/default.nix
index d4f37d4f5cce..4e2810fa893c 100644
--- a/pkgs/development/compilers/kotlin/default.nix
+++ b/pkgs/development/compilers/kotlin/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl, makeWrapper, jre, unzip }:
 
 let
-  version = "1.3.71";
+  version = "1.3.72";
 in stdenv.mkDerivation {
   inherit version;
   pname = "kotlin";
 
   src = fetchurl {
     url = "https://github.com/JetBrains/kotlin/releases/download/v${version}/kotlin-compiler-${version}.zip";
-    sha256 = "0jp7z2lys02d0wmycdlfg9c08ji4qvjaz2wzvrxjyvcwv7d7gnvs";
+    sha256 = "0v6c4vjiflwbjjc1lmiyzrilxwbqcz5ll6ls40zhw70zk23xpl6c";
   };
 
   propagatedBuildInputs = [ jre ] ;
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index b14c26c69478..8638c32262e0 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -371,7 +371,7 @@ self: super: {
   static-resources = dontCheck super.static-resources;
   strive = dontCheck super.strive;                      # fails its own hlint test with tons of warnings
   svndump = dontCheck super.svndump;
-  tar = dontCheck super.tar; #http://hydra.nixos.org/build/25088435/nixlog/2 (fails only on 32-bit)
+  tar = dontCheck super.tar; #https://hydra.nixos.org/build/25088435/nixlog/2 (fails only on 32-bit)
   th-printf = dontCheck super.th-printf;
   thumbnail-plus = dontCheck super.thumbnail-plus;
   tickle = dontCheck super.tickle;
diff --git a/pkgs/development/interpreters/jelly/default.nix b/pkgs/development/interpreters/jelly/default.nix
new file mode 100644
index 000000000000..a317f35d2a78
--- /dev/null
+++ b/pkgs/development/interpreters/jelly/default.nix
@@ -0,0 +1,28 @@
+{ lib, python3Packages, fetchFromGitHub }:
+
+python3Packages.buildPythonApplication {
+  pname = "jelly";
+  version = "0.1.31";
+
+  src = fetchFromGitHub {
+    owner = "DennisMitchell";
+    repo = "jellylanguage";
+    rev = "70c9fd93ab009c05dc396f8cc091f72b212fb188";
+    sha256 = "1rpclqagvigp5qhvgnjavvy463f1drshnc1mfxm6z7ygzs0l0yz6";
+  };
+
+  propagatedBuildInputs = [ python3Packages.sympy ];
+
+  # checks are disabled because jelly has no tests, and the default is to run
+  # the output binary with no arguments, which exits with status 1 and causes
+  # the build to fail
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A recreational programming language inspired by J";
+    homepage    = https://github.com/DennisMitchell/jellylanguage;
+    license     = licenses.mit;
+    maintainers = [ maintainers.tckmn ];
+    platforms   = platforms.all;
+  };
+}
diff --git a/pkgs/development/interpreters/picoc/default.nix b/pkgs/development/interpreters/picoc/default.nix
index 00e77033575f..f7343f6e4d60 100644
--- a/pkgs/development/interpreters/picoc/default.nix
+++ b/pkgs/development/interpreters/picoc/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   # Tests are currently broken on i686 see
-  # http://hydra.nixos.org/build/24003763/nixlog/1
+  # https://hydra.nixos.org/build/24003763/nixlog/1
   doCheck = if stdenv.isi686 then false else true;
   checkTarget = "test";
 
diff --git a/pkgs/development/interpreters/rakudo/zef.nix b/pkgs/development/interpreters/rakudo/zef.nix
index 9a8c11324a21..5c8fe16408b4 100644
--- a/pkgs/development/interpreters/rakudo/zef.nix
+++ b/pkgs/development/interpreters/rakudo/zef.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zef";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "ugexe";
     repo = "zef";
     rev = "v${version}";
-    sha256 = "1fscv8fbaa5l8dcwclmq3hvg3c59l4dvyjqb316mgnc5anxpzy2f";
+    sha256 = "02a3awnjr1mgb9275xvp3xms80vcxkq55ffi8sbjzxpwyadj5y5k";
   };
 
   buildInputs = [ rakudo makeWrapper ];
diff --git a/pkgs/development/interpreters/wasmtime/default.nix b/pkgs/development/interpreters/wasmtime/default.nix
index 79222749dc4b..67d54af7bb2a 100644
--- a/pkgs/development/interpreters/wasmtime/default.nix
+++ b/pkgs/development/interpreters/wasmtime/default.nix
@@ -2,24 +2,26 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasmtime";
-  version = "0.12.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "${pname}";
     rev = "v${version}";
-    sha256 = "08dhk5s8rv41mjqbwfqwqmp6p6p9y7qc5yc76ljjd9l7j1phl7mr";
+    sha256 = "1df99iak0psydlg9m8f8qq4zyh4wbi5l4qgsdjr2lm74ci3483xy";
     fetchSubmodules = true;
   };
 
-  cargoSha256 = "0vyxp74jlnrisk0kblsbj9d9a54wcgzbyjm7iqav1k4ns3syrnmh";
+  cargoSha256 = "170bz48jrc1k2ylfmd3bcry0xpcxx8p3rzzv9mprlfmrfpb0b28r";
 
   nativeBuildInputs = [ python cmake clang ];
   buildInputs = [ llvmPackages.libclang ] ++
    lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
   LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
 
-  doCheck = false; # https://github.com/bytecodealliance/wasmtime/issues/1197
+  # no test on darwin due to
+  # https://github.com/bytecodealliance/wasmtime/issues/1556
+  doCheck = !stdenv.isDarwin;
 
   meta = with lib; {
     description = "Standalone JIT-style runtime for WebAssembly, using Cranelift";
diff --git a/pkgs/development/libraries/armadillo/default.nix b/pkgs/development/libraries/armadillo/default.nix
index 3251b1c9e0d2..9b32d46b3b2f 100644
--- a/pkgs/development/libraries/armadillo/default.nix
+++ b/pkgs/development/libraries/armadillo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "armadillo";
-  version = "9.860.1";
+  version = "9.870.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    sha256 = "1ab5y4ll6js2w4p9dabj2dmzzc3f8dja8dqsvy40azrvny58h0qn";
+    sha256 = "0mpp1iq4ws9yhcv0bnn0czzyim7whcan34c7a052sh8w9kp5y6sl";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/audio/libbass/default.nix b/pkgs/development/libraries/audio/libbass/default.nix
index 84fa46eed273..593854bb280d 100644
--- a/pkgs/development/libraries/audio/libbass/default.nix
+++ b/pkgs/development/libraries/audio/libbass/default.nix
@@ -9,7 +9,7 @@ let
   allBass = {
     bass = {
       h = "bass.h";
-      version = "2.4.14";
+      version = "2.4.15";
       so = {
         i686_linux = "libbass.so";
         x86_64-linux = "x64/libbass.so";
diff --git a/pkgs/development/libraries/aws-sdk-cpp/cmake-dirs.patch b/pkgs/development/libraries/aws-sdk-cpp/cmake-dirs.patch
new file mode 100644
index 000000000000..6e4cad9e73cf
--- /dev/null
+++ b/pkgs/development/libraries/aws-sdk-cpp/cmake-dirs.patch
@@ -0,0 +1,75 @@
+diff --git a/cmake/AWSSDKConfig.cmake b/cmake/AWSSDKConfig.cmake
+index e87252123e..5457bd5910 100644
+--- a/cmake/AWSSDKConfig.cmake
++++ b/cmake/AWSSDKConfig.cmake
+@@ -82,6 +82,7 @@ if (AWSSDK_ROOT_DIR)
+             )
+ else()
+     find_file(AWSSDK_CORE_HEADER_FILE Aws.h
++        "/${AWSSDK_INSTALL_INCLUDEDIR}/aws/core"
+         "/usr/${AWSSDK_INSTALL_INCLUDEDIR}/aws/core"
+         "/usr/local/${AWSSDK_INSTALL_INCLUDEDIR}/aws/core"
+         "C:/Progra~1/AWSSDK/${AWSSDK_INSTALL_INCLUDEDIR}/aws/core"
+@@ -97,14 +98,18 @@ if (NOT AWSSDK_CORE_HEADER_FILE)
+     message(FATAL_ERROR "AWS SDK for C++ is missing, please install it first")
+ endif()
+ 
+-# based on core header file path, inspects the actual AWSSDK_ROOT_DIR
+-get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_CORE_HEADER_FILE}" PATH)
+-get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_ROOT_DIR}" PATH)
+-get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_ROOT_DIR}" PATH)
+-get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_ROOT_DIR}" PATH)
+-
+-if (NOT AWSSDK_ROOT_DIR)
+-    message(FATAL_ERROR "AWSSDK_ROOT_DIR is not set or can't be calculated from the path of core header file")
++if (IS_ABSOLUTE ${AWSSDK_INSTALL_LIBDIR})
++    set(AWSSDK_ROOT_DIR "")
++else()
++    # based on core header file path, inspects the actual AWSSDK_ROOT_DIR
++    get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_CORE_HEADER_FILE}" PATH)
++    get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_ROOT_DIR}" PATH)
++    get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_ROOT_DIR}" PATH)
++    get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_ROOT_DIR}" PATH)
++
++    if (NOT AWSSDK_ROOT_DIR)
++	message(FATAL_ERROR "AWSSDK_ROOT_DIR is not set or can't be calculated from the path of core header file")
++    endif()
+ endif()
+ 
+ 
+diff --git a/cmake/utilities.cmake b/cmake/utilities.cmake
+index 283a14a138..646aea1da3 100644
+--- a/cmake/utilities.cmake
++++ b/cmake/utilities.cmake
+@@ -43,7 +43,8 @@ macro(setup_install)
+                 EXPORT "${PROJECT_NAME}-targets"
+                 ARCHIVE DESTINATION ${ARCHIVE_DIRECTORY}
+                 LIBRARY DESTINATION ${LIBRARY_DIRECTORY}
+-                RUNTIME DESTINATION ${BINARY_DIRECTORY} )
++                RUNTIME DESTINATION ${BINARY_DIRECTORY}
++                INCLUDES DESTINATION ${INCLUDE_DIRECTORY} )
+ 
+         if (BUILD_SHARED_LIBS)
+             install(
+@@ -57,7 +58,8 @@ macro(setup_install)
+             install (TARGETS ${PROJECT_NAME}
+                      ARCHIVE DESTINATION ${ARCHIVE_DIRECTORY}/${SDK_INSTALL_BINARY_PREFIX}/${PLATFORM_INSTALL_QUALIFIER}/\${CMAKE_INSTALL_CONFIG_NAME}
+                      LIBRARY DESTINATION ${LIBRARY_DIRECTORY}/${SDK_INSTALL_BINARY_PREFIX}/${PLATFORM_INSTALL_QUALIFIER}/\${CMAKE_INSTALL_CONFIG_NAME}
+-                     RUNTIME DESTINATION ${BINARY_DIRECTORY}/${SDK_INSTALL_BINARY_PREFIX}/${PLATFORM_INSTALL_QUALIFIER}/\${CMAKE_INSTALL_CONFIG_NAME})
++                     RUNTIME DESTINATION ${BINARY_DIRECTORY}/${SDK_INSTALL_BINARY_PREFIX}/${PLATFORM_INSTALL_QUALIFIER}/\${CMAKE_INSTALL_CONFIG_NAME}
++                     INCLUDES DESTINATION ${INCLUDE_DIRECTORY}/${SDK_INSTALL_BINARY_PREFIX}/${PLATFORM_INSTALL_QUALIFIER}/\${CMAKE_INSTALL_CONFIG_NAME})
+         endif()
+     endif()
+ endmacro()
+diff --git a/toolchains/pkg-config.pc.in b/toolchains/pkg-config.pc.in
+index 9b519d2772..a61069225c 100644
+--- a/toolchains/pkg-config.pc.in
++++ b/toolchains/pkg-config.pc.in
+@@ -1,5 +1,5 @@
+-includedir=@CMAKE_INSTALL_PREFIX@/@INCLUDE_DIRECTORY@
+-libdir=@CMAKE_INSTALL_PREFIX@/@LIBRARY_DIRECTORY@
++includedir=@INCLUDE_DIRECTORY@
++libdir=@LIBRARY_DIRECTORY@
+ 
+ Name: @PROJECT_NAME@
+ Description: @PROJECT_DESCRIPTION@
diff --git a/pkgs/development/libraries/aws-sdk-cpp/default.nix b/pkgs/development/libraries/aws-sdk-cpp/default.nix
index f6878cd9396e..94827743bf3d 100644
--- a/pkgs/development/libraries/aws-sdk-cpp/default.nix
+++ b/pkgs/development/libraries/aws-sdk-cpp/default.nix
@@ -50,6 +50,12 @@ stdenv.mkDerivation rec {
       rm aws-cpp-sdk-core-tests/aws/auth/AWSCredentialsProviderTest.cpp
     '';
 
+  postFixupHooks = [
+    # This bodge is necessary so that the file that the generated -config.cmake file
+    # points to an existing directory.
+    ''mkdir -p $out/include''
+  ];
+
   __darwinAllowLocalNetworking = true;
 
   patches = [
@@ -57,6 +63,7 @@ stdenv.mkDerivation rec {
       url = "https://github.com/aws/aws-sdk-cpp/commit/42991ab549087c81cb630e5d3d2413e8a9cf8a97.patch";
       sha256 = "0myq5cm3lvl5r56hg0sc0zyn1clbkd9ys0wr95ghw6bhwpvfv8gr";
     })
+    ./cmake-dirs.patch
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/boost/cmake-paths.patch b/pkgs/development/libraries/boost/cmake-paths.patch
new file mode 100644
index 000000000000..b7f90148f9dc
--- /dev/null
+++ b/pkgs/development/libraries/boost/cmake-paths.patch
@@ -0,0 +1,21 @@
+diff --git a/tools/boost_install/boost-install.jam b/tools/boost_install/boost-install.jam
+index ad19f7b55..ec6bf57ff 100644
+--- a/tools/boost_install/boost-install.jam
++++ b/tools/boost_install/boost-install.jam
+@@ -587,6 +587,7 @@ rule generate-cmake-config- ( target : sources * : properties * )
+         "# Compute the include and library directories relative to this file."
+         ""
+         "get_filename_component(_BOOST_CMAKEDIR \"${CMAKE_CURRENT_LIST_DIR}/../\" ABSOLUTE)"
++        "get_filename_component(_BOOST_REAL_CMAKEDIR \"${CMAKE_CURRENT_LIST_DIR}/../\" ABSOLUTE)"
+         : true ;
+ 
+     if [ path.is-rooted $(cmakedir) ]
+@@ -607,6 +608,8 @@ rule generate-cmake-config- ( target : sources * : properties * )
+             "  unset(_BOOST_CMAKEDIR_ORIGINAL)"
+             "endif()"
+             ""
++	    "# Assume that the installer actually did know where the libs were to be installed"
++            "get_filename_component(_BOOST_CMAKEDIR \"$(cmakedir-native)\" REALPATH)"
+             : true ;
+     }
+ 
diff --git a/pkgs/development/libraries/boost/generic.nix b/pkgs/development/libraries/boost/generic.nix
index 7fe3c185c04a..6d1c20f323d3 100644
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@@ -112,7 +112,8 @@ stdenv.mkDerivation {
   ++ optional stdenv.isDarwin (
     if version == "1.55.0"
     then ./darwin-1.55-no-system-python.patch
-    else ./darwin-no-system-python.patch);
+    else ./darwin-no-system-python.patch)
+  ++ optional (versionAtLeast version "1.70") ./cmake-paths.patch;
 
   meta = {
     homepage = "http://boost.org/";
diff --git a/pkgs/development/libraries/boringssl/default.nix b/pkgs/development/libraries/boringssl/default.nix
index 67e2794c8a29..20524cf179cf 100644
--- a/pkgs/development/libraries/boringssl/default.nix
+++ b/pkgs/development/libraries/boringssl/default.nix
@@ -3,24 +3,23 @@
 # reference: https://boringssl.googlesource.com/boringssl/+/2661/BUILDING.md
 stdenv.mkDerivation {
   pname = "boringssl";
-  version = "2017-02-23";
+  version = "2019-12-04";
 
   src = fetchgit {
     url    = "https://boringssl.googlesource.com/boringssl";
-    rev    = "be2ee342d3781ddb954f91f8a7e660c6f59e87e5";
-    sha256 = "022zq7wlkhrg6al7drr3555lam3zw5bb10ylf9mznp83s854f975";
+    rev    = "243b5cc9e33979ae2afa79eaa4e4c8d59db161d4";
+    sha256 = "1ak27dln0zqy2vj4llqsb99g03sk0sg25wlp09b58cymrh3gccvl";
   };
 
-  buildInputs = [ cmake perl go ];
+  nativeBuildInputs = [ cmake perl go ];
   enableParallelBuilding = true;
-  NIX_CFLAGS_COMPILE = "-Wno-error";
 
   makeFlags = [ "GOCACHE=$(TMPDIR)/go-cache" ];
 
   installPhase = ''
-    mkdir -p $out/bin $out/include $out/lib
+    mkdir -p $bin/bin $out/include $out/lib
 
-    mv tool/bssl $out/bin
+    mv tool/bssl $bin/bin
 
     mv ssl/libssl.a           $out/lib
     mv crypto/libcrypto.a     $out/lib
@@ -29,6 +28,8 @@ stdenv.mkDerivation {
     mv ../include/openssl $out/include
   '';
 
+  outputs = [ "out" "bin" ];
+
   meta = with stdenv.lib; {
     description = "Free TLS/SSL implementation";
     homepage    = "https://boringssl.googlesource.com";
diff --git a/pkgs/development/libraries/catch2/default.nix b/pkgs/development/libraries/catch2/default.nix
index a2b65c9bbb41..960c07e29df4 100644
--- a/pkgs/development/libraries/catch2/default.nix
+++ b/pkgs/development/libraries/catch2/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "catch2";
-  version = "2.11.3";
+  version = "2.12.1";
 
   src = fetchFromGitHub {
     owner = "catchorg";
     repo = "Catch2";
     rev = "v${version}";
-    sha256="012j7fnlsdyvg6d7gwdab7yzllkv4wqb164lfg4ixahx9l9schmp";
+    sha256="163198lizcr84ify34xjj1955rcgsqhwn87dwifiwyamnggn445f";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/check/default.nix b/pkgs/development/libraries/check/default.nix
index 193bdda3445d..0a51e7e592b1 100644
--- a/pkgs/development/libraries/check/default.nix
+++ b/pkgs/development/libraries/check/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "02zkfiyklckmivrfvdsrlzvzphkdsgjrz3igncw05dv5pshhq3xx";
   };
 
-  # Test can randomly fail: http://hydra.nixos.org/build/7243912
+  # Test can randomly fail: https://hydra.nixos.org/build/7243912
   doCheck = false;
 
   buildInputs = stdenv.lib.optional stdenv.isDarwin CoreServices;
diff --git a/pkgs/development/libraries/gmp/5.1.x.nix b/pkgs/development/libraries/gmp/5.1.x.nix
index 78cfa40d1966..a027d58de396 100644
--- a/pkgs/development/libraries/gmp/5.1.x.nix
+++ b/pkgs/development/libraries/gmp/5.1.x.nix
@@ -25,7 +25,7 @@ let self = stdenv.mkDerivation rec {
     (stdenv.lib.enableFeature cxx "cxx")
     # Build a "fat binary", with routines for several sub-architectures
     # (x86), except on Solaris where some tests crash with "Memory fault".
-    # See <http://hydra.nixos.org/build/2760931>, for instance.
+    # See <https://hydra.nixos.org/build/2760931>, for instance.
     #
     # no darwin because gmp uses ASM that clang doesn't like
     (stdenv.lib.enableFeature (!stdenv.isSunOS && stdenv.hostPlatform.isx86) "fat")
diff --git a/pkgs/development/libraries/gmp/6.x.nix b/pkgs/development/libraries/gmp/6.x.nix
index cca0f8d68e14..c5fffa09bf0b 100644
--- a/pkgs/development/libraries/gmp/6.x.nix
+++ b/pkgs/development/libraries/gmp/6.x.nix
@@ -27,7 +27,7 @@ let self = stdenv.mkDerivation rec {
     (stdenv.lib.enableFeature cxx "cxx")
     # Build a "fat binary", with routines for several sub-architectures
     # (x86), except on Solaris where some tests crash with "Memory fault".
-    # See <http://hydra.nixos.org/build/2760931>, for instance.
+    # See <https://hydra.nixos.org/build/2760931>, for instance.
     #
     # no darwin because gmp uses ASM that clang doesn't like
     (stdenv.lib.enableFeature (!stdenv.isSunOS && stdenv.hostPlatform.isx86) "fat")
diff --git a/pkgs/development/libraries/gnutls-kdh/generic.nix b/pkgs/development/libraries/gnutls-kdh/generic.nix
index 90e863760e92..c6d35b682360 100644
--- a/pkgs/development/libraries/gnutls-kdh/generic.nix
+++ b/pkgs/development/libraries/gnutls-kdh/generic.nix
@@ -11,7 +11,7 @@
 assert guileBindings -> guile != null;
 let
   # XXX: Gnulib's `test-select' fails on FreeBSD:
-  # http://hydra.nixos.org/build/2962084/nixlog/1/raw .
+  # https://hydra.nixos.org/build/2962084/nixlog/1/raw .
   doCheck = !stdenv.isFreeBSD && !stdenv.isDarwin && lib.versionAtLeast version "3.4";
 in
 stdenv.mkDerivation {
diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index 4e7e19d9ff04..cffd5459b3a6 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -11,7 +11,7 @@ let
   version = "3.6.13";
 
   # XXX: Gnulib's `test-select' fails on FreeBSD:
-  # http://hydra.nixos.org/build/2962084/nixlog/1/raw .
+  # https://hydra.nixos.org/build/2962084/nixlog/1/raw .
   doCheck = !stdenv.isFreeBSD && !stdenv.isDarwin && lib.versionAtLeast version "3.4"
       && stdenv.buildPlatform == stdenv.hostPlatform;
 
diff --git a/pkgs/development/libraries/leatherman/default.nix b/pkgs/development/libraries/leatherman/default.nix
index 1fab7ee28a8a..8a34f05f6cf0 100644
--- a/pkgs/development/libraries/leatherman/default.nix
+++ b/pkgs/development/libraries/leatherman/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "leatherman";
-  version = "1.11.0";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
-    sha256 = "1kp35gnph9myqxdxzyj1871ay19nfajxglzwai1gvsnh5840xnxy";
+    sha256 = "00qigglp67a14ki4dhjxd3j540a80rkmzhysx7hra8v2rgbsqgj8";
     rev = version;
     repo = "leatherman";
     owner = "puppetlabs";
diff --git a/pkgs/development/libraries/libgpg-error/default.nix b/pkgs/development/libraries/libgpg-error/default.nix
index 0b2e7341513e..e170e4931b83 100644
--- a/pkgs/development/libraries/libgpg-error/default.nix
+++ b/pkgs/development/libraries/libgpg-error/default.nix
@@ -60,7 +60,7 @@ in stdenv.mkDerivation (rec {
     # For some reason, /bin/sh on OpenIndiana leads to this at the end of the
     # `config.status' run:
     #   ./config.status[1401]: shift: (null): bad number
-    # (See <http://hydra.nixos.org/build/2931046/nixlog/1/raw>.)
+    # (See <https://hydra.nixos.org/build/2931046/nixlog/1/raw>.)
     # Thus, re-run it with Bash.
       "${stdenv.shell} config.status";
 
diff --git a/pkgs/development/ocaml-modules/async_find/default.nix b/pkgs/development/ocaml-modules/async_find/default.nix
deleted file mode 100644
index aa797cdace35..000000000000
--- a/pkgs/development/ocaml-modules/async_find/default.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{stdenv, buildOcaml, fetchurl, async_p4, core_p4, sexplib_p4}:
-
-buildOcaml rec {
-  name = "async_find";
-  version = "111.28.00";
-
-  minimumSupportedOcamlVersion = "4.02";
-
-  src = fetchurl {
-    url = "https://github.com/janestreet/async_find/archive/${version}.tar.gz";
-    sha256 = "4e3fda72f50174f05d96a5a09323f236c041b1a685890c155822956f3deb8803";
-  };
-
-  propagatedBuildInputs = [ async_p4 core_p4 sexplib_p4 ];
-
-  meta = with stdenv.lib; {
-    homepage = "https://github.com/janestreet/async_find";
-    description = "Directory traversal with Async";
-    license = licenses.asl20;
-    maintainers = [ maintainers.ericbmerritt ];
-  };
-}
diff --git a/pkgs/development/python-modules/autopep8/default.nix b/pkgs/development/python-modules/autopep8/default.nix
index ccefe60ea089..715e4da8f44e 100644
--- a/pkgs/development/python-modules/autopep8/default.nix
+++ b/pkgs/development/python-modules/autopep8/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "autopep8";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1swr8ccm3mafcm3zpbwyn22kjs39lbqmg8w41sh7yb3gskgy2syc";
+    sha256 = "0m29ndgrcgrzi3y1fsxmdl421x6n4gn02l70hsz8486h8zzdhbqm";
   };
 
   propagatedBuildInputs = [ pycodestyle ];
diff --git a/pkgs/development/python-modules/eggdeps/default.nix b/pkgs/development/python-modules/eggdeps/default.nix
index d10c1a0be654..8c7d7679005e 100644
--- a/pkgs/development/python-modules/eggdeps/default.nix
+++ b/pkgs/development/python-modules/eggdeps/default.nix
@@ -17,7 +17,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ zope_interface zope_testing ];
 
-  # tests fail, see http://hydra.nixos.org/build/4316603/log/raw
+  # tests fail, see https://hydra.nixos.org/build/4316603/log/raw
   doCheck = false;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/pyopenssl/default.nix b/pkgs/development/python-modules/pyopenssl/default.nix
index 4305487b6564..33fd3c6e10d4 100644
--- a/pkgs/development/python-modules/pyopenssl/default.nix
+++ b/pkgs/development/python-modules/pyopenssl/default.nix
@@ -102,7 +102,7 @@ buildPythonPackage rec {
     })
   ];
 
-  # Seems to fail unpredictably on Darwin. See http://hydra.nixos.org/build/49877419/nixlog/1
+  # Seems to fail unpredictably on Darwin. See https://hydra.nixos.org/build/49877419/nixlog/1
   # for one example, but I've also seen ContextTests.test_set_verify_callback_exception fail.
   doCheck = !stdenv.isDarwin;
 
diff --git a/pkgs/development/python-modules/python-gitlab/default.nix b/pkgs/development/python-modules/python-gitlab/default.nix
index d2b1a6570b12..0c1f7c67e3df 100644
--- a/pkgs/development/python-modules/python-gitlab/default.nix
+++ b/pkgs/development/python-modules/python-gitlab/default.nix
@@ -1,22 +1,24 @@
-{ stdenv, buildPythonPackage, fetchPypi, requests, six, mock, httmock }:
+{ stdenv, buildPythonPackage, fetchPypi, requests, mock, httmock, pythonOlder }:
 
 buildPythonPackage rec {
-  pname   = "python-gitlab";
-  version = "1.15.0";
+  pname = "python-gitlab";
+  version = "2.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "45125a0ed4d0027d4317bdbd71ca02fc52b0ac160b9d2c3c5be131b4d19f867e";
+    sha256 = "4c4ea60c8303f4214522b18038df017cae35afda7474efa0b4e19c2e73bc3ae2";
   };
 
-  propagatedBuildInputs = [ requests six ];
+  propagatedBuildInputs = [ requests ];
 
   checkInputs = [ mock httmock ];
 
+  disabled = pythonOlder "3.6";
+
   meta = with stdenv.lib; {
     description = "Interact with GitLab API";
-    homepage    = "https://github.com/python-gitlab/python-gitlab";
-    license     = licenses.lgpl3;
+    homepage = "https://github.com/python-gitlab/python-gitlab";
+    license = licenses.lgpl3;
     maintainers = with maintainers; [ nyanloutre ];
   };
 }
diff --git a/pkgs/development/python-modules/python-telegram-bot/default.nix b/pkgs/development/python-modules/python-telegram-bot/default.nix
index 28541372c5e4..f36f82395685 100644
--- a/pkgs/development/python-modules/python-telegram-bot/default.nix
+++ b/pkgs/development/python-modules/python-telegram-bot/default.nix
@@ -7,11 +7,13 @@
 , urllib3
 , tornado
 , pytest
+, isPy3k
 }:
 
 buildPythonPackage rec {
   pname = "python-telegram-bot";
   version = "12.7";
+  disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
@@ -21,7 +23,11 @@ buildPythonPackage rec {
   checkInputs = [ pytest ];
   propagatedBuildInputs = [ certifi future urllib3 tornado decorator ];
 
-  pipInstallFlags = "--install-option '--with-upstream-urllib3'";
+  # --with-upstream-urllib3 is not working properly
+  postPatch = ''
+    rm -rf telegram/vendor
+  '';
+  setupPyGlobalFlags = "--with-upstream-urllib3";
 
   # tests not included with release
   doCheck = false;
diff --git a/pkgs/development/tools/database/dbmate/default.nix b/pkgs/development/tools/database/dbmate/default.nix
index 14673cb40c81..c710aeaa5167 100644
--- a/pkgs/development/tools/database/dbmate/default.nix
+++ b/pkgs/development/tools/database/dbmate/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dbmate";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "amacneil";
     repo = "dbmate";
     rev = "v${version}";
-    sha256 = "0jvizj616rsh3aw9z3bijk7ixpbnqmm3xqmdxznjzqd46avr54c3";
+    sha256 = "16grd03r41n0vj5fs7j6jk395zs2q0i878p9nh1ycicy64nzmxky";
   };
 
-  modSha256 = "12x3m5bjyx3blh5i51pd99phv73m96pmm6i3ir4vf2kms3viif9i";
+  modSha256 = "1ky6cxpmw93nrk26vyrxz8kqa7247axzaxilm6ciypxf30ad0vdq";
 
   meta = with stdenv.lib; {
     description = "Database migration tool";
diff --git a/pkgs/development/tools/database/liquibase/default.nix b/pkgs/development/tools/database/liquibase/default.nix
index d66d54ef45bb..f246a0a806df 100644
--- a/pkgs/development/tools/database/liquibase/default.nix
+++ b/pkgs/development/tools/database/liquibase/default.nix
@@ -10,11 +10,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "liquibase";
-  version = "3.8.8";
+  version = "3.8.9";
 
   src = fetchurl {
     url = "https://github.com/liquibase/liquibase/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "1pl9wgnwykvbnis0ndym0lbsj6a7lvpghrc98cw2hdnp5dglxjjl";
+    sha256 = "13qpva81y98gp84zbcx6b4wsfgpsbv18aj5ihkw6l9ndbxfcrxdl";
   };
 
   buildInputs = [ jre makeWrapper ];
diff --git a/pkgs/development/tools/git-quick-stats/default.nix b/pkgs/development/tools/git-quick-stats/default.nix
index 2681b2705ef4..1532f64c2462 100644
--- a/pkgs/development/tools/git-quick-stats/default.nix
+++ b/pkgs/development/tools/git-quick-stats/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchFromGitHub }:
 stdenv.mkDerivation rec {
   pname = "git-quick-stats";
-  version = "2.0.15";
+  version = "2.0.16";
   src = fetchFromGitHub {
     repo = "git-quick-stats";
     owner = "arzzen";
     rev = version;
-    sha256 = "1m8b0bskhpwjbs0qjp0rdzrjj613639pn92isv1cg0srj8grjcai";
+    sha256 = "03v06r6gbn8bhya1ig9wdc92hh2ip7072syxkam3sjv150ld80cn";
   };
   PREFIX = builtins.placeholder "out";
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/misc/strace/default.nix b/pkgs/development/tools/misc/strace/default.nix
index e547fef46c4c..75a960c80c50 100644
--- a/pkgs/development/tools/misc/strace/default.nix
+++ b/pkgs/development/tools/misc/strace/default.nix
@@ -14,6 +14,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = stdenv.lib.optional libunwind.supportsHost libunwind; # support -k
 
+  postPatch = "patchShebangs strace-graph";
+
   configureFlags = stdenv.lib.optional (!stdenv.hostPlatform.isx86) "--enable-mpers=check";
 
   # fails 1 out of 523 tests with
diff --git a/pkgs/development/tools/misc/sysbench/default.nix b/pkgs/development/tools/misc/sysbench/default.nix
index 10748d751595..616a1cbc3fbd 100644
--- a/pkgs/development/tools/misc/sysbench/default.nix
+++ b/pkgs/development/tools/misc/sysbench/default.nix
@@ -4,7 +4,7 @@
 
 stdenv.mkDerivation rec {
   pname = "sysbench";
-  version = "1.0.19";
+  version = "1.0.20";
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
   buildInputs = [ libmysqlclient libaio ];
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     owner = "akopytov";
     repo = pname;
     rev = version;
-    sha256 = "1zgqb9cr7ld3vw4a3jhq1mlszhcyjlpr0c8q1jcp1d27l9dcvd1w";
+    sha256 = "1sanvl2a52ff4shj62nw395zzgdgywplqvwip74ky8q7s6qjf5qy";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/tools/mod/default.nix b/pkgs/development/tools/mod/default.nix
index 3261c8af2024..5237d131af02 100644
--- a/pkgs/development/tools/mod/default.nix
+++ b/pkgs/development/tools/mod/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "mod";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "marwan-at-work";
     repo = "mod";
     rev = "v${version}";
-    sha256 = "1kcsdi9qls9kgklj96ycyrq5fsz5m2qj3ij63d2rwqjggqk0cab6";
+    sha256 = "1n0pipbq4fjban8hsxhyl5w8xrl4ai1pvgd02i1j1awmm2l3ykzl";
   };
 
-  modSha256 = "0famjypv5qg9lgzw4pz2kz70l50cn6n6nbjyk7jrzmd6bjzd0ypl";
+  modSha256 = "1nl7d00prw1663xrl1nvj1xbs7wzkbqn75i92al821pz12dybdif";
 
   subPackages = [ "cmd/mod" ];
 
diff --git a/pkgs/development/tools/rust/cargo-udeps/default.nix b/pkgs/development/tools/rust/cargo-udeps/default.nix
index ca347ca22dee..a6089ffeac2d 100644
--- a/pkgs/development/tools/rust/cargo-udeps/default.nix
+++ b/pkgs/development/tools/rust/cargo-udeps/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-udeps";
-  version = "0.1.10";
+  version = "0.1.11";
 
   src = fetchFromGitHub {
     owner = "est31";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1xmlpn4j5lhbzd9icb3nga5irfknmxfml9sn677d9z6fwfjfpa0l";
+    sha256 = "1drz0slv33p4spm52sb5lnmpb83q8l7k3cvp0zcsinbjv8glvvnv";
   };
 
-  cargoSha256 = "1si95pdhbi6pa94gh9vip95n37im6kcfsgslpnibck2157pg4la6";
+  cargoSha256 = "13ynab3s563n2xwkls7nmksis0ngx5klw9wc9bpnxgc5na9k84ll";
 
   nativeBuildInputs = [ pkgconfig ];
 
diff --git a/pkgs/development/tools/rust/cbindgen/default.nix b/pkgs/development/tools/rust/cbindgen/default.nix
index 87e8e081a931..bc0ae5d33fe2 100644
--- a/pkgs/development/tools/rust/cbindgen/default.nix
+++ b/pkgs/development/tools/rust/cbindgen/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-cbindgen";
-  version = "0.13.2";
+  version = "0.14.2";
 
   src = fetchFromGitHub {
     owner = "eqrion";
     repo = "cbindgen";
     rev = "v${version}";
-    sha256 = "100ls8p8w6jwcjh3ligly5alg8fzp21aj7b1qbndn9fm0y1nmjam";
+    sha256 = "15mk7q89rs723c7i9wwq4rrvakwh834wvrsmsnayji5k1kwaj351";
   };
 
-  cargoSha256 = "0d9sz46yzh01dx973q10xzw4k7r7ylvg82s5pkp3zpwcin8smaiw";
+  cargoSha256 = "03irndd48ck62chm4vmlcnfm98gwd86xm1ssq9glw3b3y0n6x845";
 
   buildInputs = stdenv.lib.optional stdenv.isDarwin Security;
 
diff --git a/pkgs/games/dwarf-fortress/df_permission b/pkgs/games/dwarf-fortress/df_permission
index b0121bb3fa37..dc1c0c151e0b 100644
--- a/pkgs/games/dwarf-fortress/df_permission
+++ b/pkgs/games/dwarf-fortress/df_permission
@@ -12,7 +12,7 @@ Tarn
 On Fri, Oct 29, 2010 at 6:56 AM,  <roconnor@theorem.ca> wrote:
 > I'd like to distribute a *slightly* modified version of Dwarf Fortress which
 > is needed to run it under the NixOS distribution of Linux (see
-> <http://nixos.org/>
+> <https://nixos.org/>
 >
 > Modification: The interpreter location /lib/ld-linux.so.2 in
 > lib/Dwarf_Fortress is replaced with the location of ld-linux.so.2 under the
diff --git a/pkgs/games/ezquake/default.nix b/pkgs/games/ezquake/default.nix
index 86db4a3209e8..83dadb7192cb 100644
--- a/pkgs/games/ezquake/default.nix
+++ b/pkgs/games/ezquake/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ezquake";
-  version = "3.1";
+  version = "3.2";
 
   src = fetchFromGitHub {
     owner = "ezQuake";
     repo = pname + "-source";
     rev = version;
-    sha256 = "0375jndynhkl59m80fhmq12v5g24zy16c7ly08h004cmjzqsikn4";
+    sha256 = "11kyrqpc8w393kvfz2p2h2m7k8rm4w644m86w733b8w157f2fsk0";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/games/hyperrogue/default.nix b/pkgs/games/hyperrogue/default.nix
index 24ea0e8c5c0a..1ef0fd147d87 100644
--- a/pkgs/games/hyperrogue/default.nix
+++ b/pkgs/games/hyperrogue/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hyperrogue";
-  version = "11.3f";
+  version = "11.3l";
 
   src = fetchFromGitHub {
     owner = "zenorogue";
     repo = "hyperrogue";
     rev = "v${version}";
-    sha256 = "0i6dksxx33xga4pq41qsfllqras1hzk14ffqhnk11aj5lrfg98rm";
+    sha256 = "0fniyaf9mgg99s03wbdc36zg909kshpdfk9pn8pkai0x99lghkwb";
   };
 
   CPPFLAGS = "-I${SDL.dev}/include/SDL";
diff --git a/pkgs/os-specific/linux/bcc/default.nix b/pkgs/os-specific/linux/bcc/default.nix
index 79e32a05f463..7f95ef47ee9c 100644
--- a/pkgs/os-specific/linux/bcc/default.nix
+++ b/pkgs/os-specific/linux/bcc/default.nix
@@ -5,11 +5,11 @@
 
 python.pkgs.buildPythonApplication rec {
   pname = "bcc";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchurl {
     url = "https://github.com/iovisor/bcc/releases/download/v${version}/bcc-src-with-submodule.tar.gz";
-    sha256 = "15xpwf17x2j1c1wcb84cgfs35dp5w0rjd9mllmddmdjvn303wffx";
+    sha256 = "1hw02bib06fjyw61as5pmhf0qxy0wv0nw8fff2i8a9d1zcd8xf3p";
   };
   format = "other";
 
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 05617f869174..8b5f1e58d142 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.7-rc3";
+  version = "5.7-rc4";
   extraMeta.branch = "5.7";
 
   # modDirVersion needs to be x.y.z, will always add .0
@@ -11,7 +11,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "0gq4bdzz2px85l3fa9dq3jh3lp4c9kgph4njq6yxf9g3h0ifq7c6";
+    sha256 = "1mnknjiax24iaj9n5k0s55vp6fvmb40s931qxj24v5p1lc5fznvb";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/servers/caddy/v2.nix b/pkgs/servers/caddy/v2.nix
index 35c1f497850a..599e2e8c9066 100644
--- a/pkgs/servers/caddy/v2.nix
+++ b/pkgs/servers/caddy/v2.nix
@@ -1,10 +1,8 @@
-{ stdenv, callPackage, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "caddy";
-  version = "2.0.0-rc.1";
-
-  goPackagePath = "github.com/caddyserver/caddy";
+  version = "2.0.0-rc.3";
 
   subPackages = [ "cmd/caddy" ];
 
@@ -12,9 +10,10 @@ buildGoModule rec {
     owner = "caddyserver";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0ir394nmdrqvslghqky4d2py65ff77fqsp0nmxdlsdps49szwh7h";
+    sha256 = "1jsjh8q5wsnp7j7r1rlnw0w4alihpcmpmlpqncmhik10f6v7xm3y";
   };
-  modSha256 = "0sqnw81l73gssnpd4dsl3vd10584riq0417z4dvbhjnc8b3z4xwv";
+
+  modSha256 = "0n0k0w9y2z87z6m6j3sxsgqn9sm82rdcqpdck236fxj23k4akyp6";
 
   meta = with stdenv.lib; {
     homepage = "https://caddyserver.com";
diff --git a/pkgs/servers/coturn/default.nix b/pkgs/servers/coturn/default.nix
index 51502c3fd97f..f50a5afa81e7 100644
--- a/pkgs/servers/coturn/default.nix
+++ b/pkgs/servers/coturn/default.nix
@@ -2,24 +2,19 @@
 
 stdenv.mkDerivation rec {
   pname = "coturn";
-  version = "4.5.1.1";
+  version = "4.5.1.2";
 
   src = fetchFromGitHub {
     owner = "coturn";
     repo = "coturn";
     rev = version;
-    sha256 = "12x604lgva1d3g4wvl3f66rdj6lkjk5cqr0l3xas33xgzgm13pwr";
+    sha256 = "01y65az8qyv2kjnb4fj7rgl4zq5pc2b286gfn727x3hfhksx9zp2";
   };
 
   buildInputs = [ openssl libevent ];
 
   patches = [
     ./pure-configure.patch
-    (fetchpatch {
-      name = "CVE-2020-6061+6062.patch";
-      url = "https://sources.debian.org/data/main/c/coturn/4.5.1.1-1.2/debian/patches/CVE-2020-6061+6062.patch";
-      sha256 = "0fcy1wp91bb4hlhnp96sf9bs0d9hf3pwx5f7b1r9cfvr3l5c1bk2";
-    })
   ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/servers/jellyfin/default.nix b/pkgs/servers/jellyfin/default.nix
index 932081ad22fe..35476db92152 100644
--- a/pkgs/servers/jellyfin/default.nix
+++ b/pkgs/servers/jellyfin/default.nix
@@ -18,12 +18,12 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "jellyfin";
-  version = "10.5.4";
+  version = "10.5.5";
 
   # Impossible to build anything offline with dotnet
   src = fetchurl {
     url = "https://github.com/jellyfin/jellyfin/releases/download/v${version}/jellyfin_${version}_portable.tar.gz";
-    sha256 = "0jfqkbr5n5l7k3dpmjsy0bhvy4y1s6sccwcmcx239r6dhc7x0f9y";
+    sha256 = "1s3hva1j5w74qc9wyqnmr5clk4smzfi7wvx8qrzrwy81mx7r5w27";
   };
 
   buildInputs = [
diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix
index 953cc9fb77cd..8b30d7dbbc88 100644
--- a/pkgs/servers/minio/default.nix
+++ b/pkgs/servers/minio/default.nix
@@ -1,24 +1,26 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, nixosTests }:
 
 buildGoModule rec {
   pname = "minio";
-  version = "2020-03-25T07-03-04Z";
+  version = "2020-05-01T22-19-14Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "minio";
     rev = "RELEASE.${version}";
-    sha256 = "0xdflc7pfx1misbh695x8kmqpysi5iydsarr9mwmjragf5b1kbl5";
+    sha256 = "0yyq5j82rcl8yhn2jg8sjfxii6kzbrbmxvb05yiwv7p0q42ag5rn";
   };
 
-  modSha256 = "09kbibsfa7qq55paqr7wcs4gpwk6g5pknc5fjssmd12nm2cji96k";
+  modSha256 = "1g5vwllxpiy4qlfhn3v5k6sn4g4qpbv0hpg32y1vi2q342lag116";
 
   subPackages = [ "." ];
 
   buildFlagsArray = [''-ldflags=
-    -X github.com/minio/minio/cmd.Version=${version}
+    -s -w -X github.com/minio/minio/cmd.Version=${version}
   ''];
 
+  passthru.tests.minio = nixosTests.minio;
+
   meta = with stdenv.lib; {
     homepage = "https://www.minio.io/";
     description = "An S3-compatible object storage server";
diff --git a/pkgs/servers/misc/airsonic/default.nix b/pkgs/servers/misc/airsonic/default.nix
index 2c529ef7b32b..be7480354305 100644
--- a/pkgs/servers/misc/airsonic/default.nix
+++ b/pkgs/servers/misc/airsonic/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "airsonic";
-  version = "10.5.0";
+  version = "10.6.1";
 
   src = fetchurl {
     url = "https://github.com/airsonic/airsonic/releases/download/v${version}/airsonic.war";
-    sha256 = "0nja33x3qh8zylqc7dn6x8j1wyxf7pzf9vdg9rzaq1hl6mi573jq";
+    sha256 = "0dgk9i7981wydp44zax21y48psybcsd4i68cmlp9izl8aa5gk2vb";
   };
 
   buildCommand = ''
diff --git a/pkgs/servers/monitoring/thanos/default.nix b/pkgs/servers/monitoring/thanos/default.nix
index f307032f4141..a6122b317535 100644
--- a/pkgs/servers/monitoring/thanos/default.nix
+++ b/pkgs/servers/monitoring/thanos/default.nix
@@ -1,16 +1,16 @@
 { stdenv, buildGoModule, fetchFromGitHub }:
 buildGoModule rec {
   pname = "thanos";
-  version = "0.11.0";
+  version = "0.12.2";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "thanos-io";
     repo = "thanos";
-    sha256 = "152ic9pga0wjg4r7b66hdnbsj9wrzfzbbps7wjas3rcbcv1f2i90";
+    sha256 = "10xscm9h2krha66v96v2q85fynnxfizjcc47h7yz4xhjwvb5dgz2";
   };
 
-  modSha256 = "1pdypyyy352l6wy5lr94fv8j890lh863h8zg2hxchiymrs5pgq1c";
+  modSha256 = "0c8gc4qzdazxxnabfms63df8vlf2iy6iy0jrm710x76m4vm6mrbj";
 
   subPackages = "cmd/thanos";
 
diff --git a/pkgs/servers/sql/dolt/default.nix b/pkgs/servers/sql/dolt/default.nix
index 6f7f81f23780..4015e2097ee0 100644
--- a/pkgs/servers/sql/dolt/default.nix
+++ b/pkgs/servers/sql/dolt/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
     pname = "dolt";
-    version = "0.15.2";
+    version = "0.16.3";
 
     src = fetchFromGitHub {
         owner = "liquidata-inc";
         repo = "dolt";
         rev = "v${version}";
-        sha256 = "0av21czfxpwy4y7n9x6hy6m2fliqcazjx7ww0rwm6kdwxipq1xsz";
+        sha256 = "141wv5av7hms4wa3s4md7mnb77bbyn3854d7gj7fy6f6jvzghdny";
     };
 
     modRoot = "./go";
     subPackages = [ "cmd/dolt" "cmd/git-dolt" "cmd/git-dolt-smudge" ];
-    modSha256 = "0c120gkkswg0cqvvhjkxvalr4fsjv81khwg0x0fm8fr6lipkfksn";
+    modSha256 = "1fx830dif9cq2rvigdbqbc3vmmq01ywj9b095adbrwddvay8m8si";
 
     meta = with lib; {
         description = "Relational database with version control and CLI a-la Git.";
diff --git a/pkgs/servers/traefik/default.nix b/pkgs/servers/traefik/default.nix
index 0487ed177d04..40b85fc949e1 100644
--- a/pkgs/servers/traefik/default.nix
+++ b/pkgs/servers/traefik/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "traefik";
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "containous";
     repo = "traefik";
     rev = "v${version}";
-    sha256 = "1dcazssabqxr9wv3dds3z7ks3y628qa07vgnn3hpdwxzm2b2ma92";
+    sha256 = "0byi2h1lma95l77sdj8jkidmwb12ryjqwxa0zz6vwjg07p5ps3k4";
   };
 
-  modSha256 = "0w3ssxvsmq8i6hbfmn4ig2x13i2nlqy5q1khcblf9pq5vhk202qx";
+  modSha256 = "17imp24abfgh75g8161daknzqzk2m19q9d1mij6487046lk75hqz";
   subPackages = [ "cmd/traefik" ];
 
   nativeBuildInputs = [ go-bindata ];
diff --git a/pkgs/shells/fish/default.nix b/pkgs/shells/fish/default.nix
index 0f18eb79d2d8..11d9e48008fa 100644
--- a/pkgs/shells/fish/default.nix
+++ b/pkgs/shells/fish/default.nix
@@ -16,6 +16,7 @@
 , python3
 , cmake
 
+, runCommand
 , writeText
 , nixosTests
 , useOperatingSystemEtc ? true
@@ -202,38 +203,41 @@ let
 
     passthru = {
       shellPath = "/bin/fish";
-      tests.nixos = nixosTests.fish;
+      tests = {
+        nixos = nixosTests.fish;
+
+        # Test the fish_config tool by checking the generated splash page.
+        # Since the webserver requires a port to run, it is not started.
+        fishConfig =
+          let fishScript = writeText "test.fish" ''
+            set -x __fish_bin_dir ${fish}/bin
+            echo $__fish_bin_dir
+            cp -r ${fish}/share/fish/tools/web_config/* .
+            chmod -R +w *
+
+            # if we don't set `delete=False`, the file will get cleaned up
+            # automatically (leading the test to fail because there's no
+            # tempfile to check)
+            sed -e "s@, mode='w'@, mode='w', delete=False@" -i webconfig.py
+
+            # we delete everything after the fileurl is assigned
+            sed -e '/fileurl =/q' -i webconfig.py
+            echo "print(fileurl)" >> webconfig.py
+
+            # and check whether the message appears on the page
+            cat (${python3}/bin/python ./webconfig.py \
+              | tail -n1 | sed -ne 's|.*\(/build/.*\)|\1|p' \
+            ) | grep 'a href="http://localhost.*Start the Fish Web config'
+
+            # cannot test the http server because it needs a localhost port
+          '';
+          in
+          runCommand "test-web-config" { } ''
+            HOME=$(mktemp -d)
+            ${fish}/bin/fish ${fishScript} && touch $out
+          '';
+      };
     };
   };
-
-  tests = {
-
-    # Test the fish_config tool by checking the generated splash page.
-    # Since the webserver requires a port to run, it is not started.
-    fishConfig =
-      let
-        fishScript = writeText "test.fish" ''
-          set -x __fish_bin_dir ${fish}/bin
-          echo $__fish_bin_dir
-          cp -r ${fish}/share/fish/tools/web_config/* .
-          chmod -R +w *
-          # we delete everything after the fileurl is assigned
-          sed -e '/fileurl =/q' -i webconfig.py
-          echo "print(fileurl)" >> webconfig.py
-          # and check whether the message appears on the page
-          cat (${python3}/bin/python ./webconfig.py \
-            | tail -n1 | sed -ne 's|.*\(/tmp/.*\)|\1|p' \
-          ) | grep 'a href="http://localhost.*Start the Fish Web config'
-
-          # cannot test the http server because it needs a localhost port
-        '';
-      in ''
-        HOME=$(mktemp -d)
-        ${fish}/bin/fish ${fishScript}
-      '';
-  };
-
-  # FIXME(Profpatsch) replace withTests stub
-  withTests = with lib; flip const;
 in
-withTests tests fish
+fish
diff --git a/pkgs/shells/powershell/default.nix b/pkgs/shells/powershell/default.nix
index d4c18f9f5815..a5c22d125afb 100644
--- a/pkgs/shells/powershell/default.nix
+++ b/pkgs/shells/powershell/default.nix
@@ -1,21 +1,21 @@
-{ stdenv, autoPatchelfHook, fetchzip, libunwind, libuuid, icu, curl
-, darwin, makeWrapper, less, openssl_1_0_2, pam, lttng-ust }:
+{ stdenv, lib, autoPatchelfHook, fetchzip, libunwind, libuuid, icu, curl
+, darwin, makeWrapper, less, openssl_1_1, pam, lttng-ust }:
 
 let platformString = if stdenv.isDarwin then "osx"
                      else if stdenv.isLinux then "linux"
                      else throw "unsupported platform";
-    platformSha = if stdenv.isDarwin then "0jb2xm79m3m14zk7v730ai1zvxcb5a13jbkkya0qy7332k6gn6bl"
-                     else if stdenv.isLinux then "0s0jvc9ha6fw8qy7f5n0v6zf043rawsjdlm5wvqxq1q2idz7xcw1"
+    platformSha = if stdenv.isDarwin then "0c71w6z6sc86si07i6vy4w3069jal7476wyiizyr7qjm9m22963f"
+                     else if stdenv.isLinux then "0m13y66a6w64s31qbi3j5x8jll6dfrin890jah8kyncsvlyisqg3"
                      else throw "unsupported platform";
     platformLdLibraryPath = if stdenv.isDarwin then "DYLD_FALLBACK_LIBRARY_PATH"
                      else if stdenv.isLinux then "LD_LIBRARY_PATH"
                      else throw "unsupported platform";
-                     libraries = [ libunwind libuuid icu curl openssl_1_0_2 ] ++
+                     libraries = [ libunwind libuuid icu curl openssl_1_1 ] ++
                        (if stdenv.isLinux then [ pam lttng-ust ] else [ darwin.Libsystem ]);
 in
 stdenv.mkDerivation rec {
   pname = "powershell";
-  version = "6.2.3";
+  version = "7.0.0";
 
   src = fetchzip {
     url = "https://github.com/PowerShell/PowerShell/releases/download/v${version}/powershell-${version}-${platformString}-x64.tar.gz";
@@ -26,21 +26,42 @@ stdenv.mkDerivation rec {
   buildInputs = [ less ] ++ libraries;
   nativeBuildInputs = [ autoPatchelfHook makeWrapper ];
 
-  installPhase = ''
+  installPhase =
+  let
+    ext = stdenv.hostPlatform.extensions.sharedLibrary;
+  in ''
+    pslibs=$out/share/powershell
+    mkdir -p $pslibs
+
+    cp -r * $pslibs
+
+    rm -f $pslibs/libcrypto${ext}.1.0.0
+    rm -f $pslibs/libssl${ext}.1.0.0
+
+    ls $pslibs
+  '' + lib.optionalString (!stdenv.isDarwin) ''
+    patchelf --replace-needed libcrypto${ext}.1.0.0 libcrypto${ext}.1.1 $pslibs/libmi.so
+    patchelf --replace-needed libssl${ext}.1.0.0 libssl${ext}.1.1 $pslibs/libmi.so
+  '' + ''
+
     mkdir -p $out/bin
-    mkdir -p $out/share/powershell
-    cp -r * $out/share/powershell
-    makeWrapper $out/share/powershell/pwsh $out/bin/pwsh \
+
+    makeWrapper $pslibs/pwsh $out/bin/pwsh \
       --prefix ${platformLdLibraryPath} : "${stdenv.lib.makeLibraryPath libraries}" \
       --set TERM xterm --set POWERSHELL_TELEMETRY_OPTOUT 1 --set DOTNET_CLI_TELEMETRY_OPTOUT 1
   '';
 
   dontStrip = true;
 
-  meta = with stdenv.lib; {
-    description = "Cross-platform (Windows, Linux, and macOS) automation and configuration tool/framework";
+  doInstallCheck = true;
+  installCheck = ''
+    $out/bin/pwsh --help > /dev/null
+  '';
+
+  meta = with lib; {
+    description = "Powerful cross-platform (Windows, Linux, and macOS) shell and scripting language based on .NET";
     homepage = "https://github.com/PowerShell/PowerShell";
-    maintainers = [ maintainers.yrashk ];
+    maintainers = with maintainers; [ yrashk srgom ];
     platforms = [ "x86_64-darwin" "x86_64-linux" ];
     license = with licenses; [ mit ];
   };
diff --git a/pkgs/shells/zsh/oh-my-zsh/default.nix b/pkgs/shells/zsh/oh-my-zsh/default.nix
index 6e679f16e304..fe30a6f9e9aa 100644
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@@ -4,13 +4,13 @@
 { stdenv, fetchgit }:
 
 stdenv.mkDerivation rec {
-  version = "2020-04-30";
+  version = "2020-05-01";
   pname = "oh-my-zsh";
-  rev = "06b0276675e978d80535259915fbb44011e10101";
+  rev = "173d4ca68f1ff4b04e9f3fd783244c309d848092";
 
   src = fetchgit { inherit rev;
     url = "https://github.com/ohmyzsh/ohmyzsh";
-    sha256 = "1y1c8v2akxwffrmcq8lmxvdnirqkxbxbrhcws76dlcgp2m3drvgq";
+    sha256 = "0k8w5cf5fyz69bji947i1yd7pd49bpkg82k2wlx9964lgl21bip5";
   };
 
   pathsToLink = [ "/share/oh-my-zsh" ];
diff --git a/pkgs/tools/admin/lego/default.nix b/pkgs/tools/admin/lego/default.nix
index ce250d33e946..b2d3ebfa5829 100644
--- a/pkgs/tools/admin/lego/default.nix
+++ b/pkgs/tools/admin/lego/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "lego";
-  version = "3.5.0";
+  version = "3.6.0";
 
   src = fetchFromGitHub {
     owner = "go-acme";
     repo = pname;
     rev = "v${version}";
-    sha256 = "08mh2q426gmhcaz578lw08jbxfqb7qm37cd00ap937dymi1zs9qw";
+    sha256 = "0jqq1ricy8971a27zcc6qm61cv6pjk4984dab1cgz86qzama7nil";
   };
 
-  modSha256 = "10n8pcbmzlnk63gzsjb1xnmjwxfhxsqx8ffpcbwdzq9fc5yvjiii";
+  modSha256 = "0a3d7snnchxk5n4m0v725689pwqjgwz7g94yzh9akc55nwy33sfj";
   subPackages = [ "cmd/lego" ];
 
   buildFlagsArray = [
diff --git a/pkgs/tools/admin/lxd/default.nix b/pkgs/tools/admin/lxd/default.nix
index 6051c16e91e1..11929b337635 100644
--- a/pkgs/tools/admin/lxd/default.nix
+++ b/pkgs/tools/admin/lxd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, pkgconfig, lxc, buildGoPackage, fetchurl
+{ stdenv, hwdata, pkgconfig, lxc, buildGoPackage, fetchurl
 , makeWrapper, acl, rsync, gnutar, xz, btrfs-progs, gzip, dnsmasq
 , squashfsTools, iproute, iptables, ebtables, libcap, libco-canonical, dqlite
 , raft-canonical, sqlite-replication, udev
@@ -19,6 +19,11 @@ buildGoPackage rec {
     sha256 = "0sxkyjayn7yyiy9kvbdlpkl58lwsl2rhlxnncg628f2kad2zgkdx";
   };
 
+  postPatch = ''
+    substituteInPlace shared/usbid/load.go \
+      --replace "/usr/share/misc/usb.ids" "${hwdata}/share/hwdata/usb.ids"
+  '';
+
   preBuild = ''
     # unpack vendor
     pushd go/src/github.com/lxc/lxd
diff --git a/pkgs/tools/admin/salt/default.nix b/pkgs/tools/admin/salt/default.nix
index b648cdb25124..b378f0828659 100644
--- a/pkgs/tools/admin/salt/default.nix
+++ b/pkgs/tools/admin/salt/default.nix
@@ -1,21 +1,38 @@
-{
-  stdenv, pythonPackages, openssl,
-
+{ lib
+, python3
+, openssl
   # Many Salt modules require various Python modules to be installed,
   # passing them in this array enables Salt to find them.
-  extraInputs ? []
+, extraInputs ? []
 }:
+let
+
+  py = python3.override {
+    packageOverrides = self: super: {
+      # Can be unpinned once https://github.com/saltstack/salt/issues/56007 is resolved
+      msgpack = super.msgpack.overridePythonAttrs (
+        oldAttrs: rec {
+          version = "0.6.2";
+          src = oldAttrs.src.override {
+            inherit version;
+            sha256 = "0c0q3vx0x137567msgs5dnizghnr059qi5kfqigxbz26jf2jyg7a";
+          };
+        }
+      );
+    };
+  };
 
-pythonPackages.buildPythonApplication rec {
+in
+py.pkgs.buildPythonApplication rec {
   pname = "salt";
-  version = "2019.2.0";
+  version = "3000.2";
 
-  src = pythonPackages.fetchPypi {
+  src = py.pkgs.fetchPypi {
     inherit pname version;
-    sha256 = "1kgn3lway0zwwysyzpphv05j4xgxk92dk4rv1vybr2527wmvp5an";
+    sha256 = "1n90qqhsvbf4pc4pcbya3rjfkblbccf4np4mxpghjqaa16fl4cqf";
   };
 
-  propagatedBuildInputs = with pythonPackages; [
+  propagatedBuildInputs = with py.pkgs; [
     jinja2
     markupsafe
     msgpack
@@ -24,8 +41,6 @@ pythonPackages.buildPythonApplication rec {
     pyzmq
     requests
     tornado_4
-  ] ++ stdenv.lib.optionals (!pythonPackages.isPy3k) [
-    futures
   ] ++ extraInputs;
 
   patches = [ ./fix-libcrypto-loading.patch ];
@@ -40,7 +55,7 @@ pythonPackages.buildPythonApplication rec {
   # as is it rather long.
   doCheck = false;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://saltstack.com/";
     description = "Portable, distributed, remote execution and configuration management system";
     maintainers = with maintainers; [ aneeshusa ];
diff --git a/pkgs/tools/filesystems/fuseiso/default.nix b/pkgs/tools/filesystems/fuseiso/default.nix
index 2d24cb71bbed..ded1fac65f88 100644
--- a/pkgs/tools/filesystems/fuseiso/default.nix
+++ b/pkgs/tools/filesystems/fuseiso/default.nix
@@ -1,40 +1,55 @@
-{ stdenv, fetchurl, fetchpatch, pkgconfig, fuse, zlib, glib }:
+{ stdenv, fetchurl, fetchpatch, autoreconfHook, pkgconfig, fuse, glib, zlib }:
 
-stdenv.mkDerivation {
-  name = "fuseiso-20070708";
+stdenv.mkDerivation rec {
+  pname = "fuseiso";
+  version = "20070708";
 
   src = fetchurl {
-    url = "mirror://sourceforge/project/fuseiso/fuseiso/20070708/fuseiso-20070708.tar.bz2";
+    url = "mirror://sourceforge/project/fuseiso/fuseiso/${version}/fuseiso-${version}.tar.bz2";
     sha256 = "127xql52dcdhmh7s5m9xc6q39jdlj3zhbjar1j821kb6gl3jw94b";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ fuse zlib glib ];
-
-  patches = let fetchPatchFromDebian = { patch, sha256 }:
+  patches = map (p:
     fetchpatch {
-      inherit sha256;
-      url = "https://sources.debian.net/data/main/f/fuseiso/20070708-3.2/debian/patches/${patch}";
-    };
-  in [
-    (fetchPatchFromDebian {
-      patch = "00-support_large_iso.patch";
+      inherit (p) name sha256;
+      url = "https://sources.debian.net/data/main/f/fuseiso/${version}-3.2/debian/patches/${p.name}";
+    }) [
+    {
+      name = "00-support_large_iso.patch";
       sha256 = "1lmclb1qwzz5f4wlq693g83bblwnjjl73qhgfxbsaac5hnn2shjw";
-    })
-    (fetchPatchFromDebian { # CVE-2015-8837
-      patch = "02-prevent-buffer-overflow.patch";
+    }
+    {
+      name = "01-fix_typo.patch";
+      sha256 = "14rpxp0yylzsgqv0r19l4wx1h5hvqp617gpv1yg0w48amr9drasa";
+    }
+    { # CVE-2015-8837
+      name = "02-prevent-buffer-overflow.patch";
       sha256 = "1ls2pp3mh91pdb51qz1fsd8pwhbky6988bpd156bn7wgfxqzh8ig";
-    })
-    (fetchPatchFromDebian { # CVE-2015-8836
-      patch = "03-prevent-integer-overflow.patch";
+    }
+    { # CVE-2015-8836
+      name = "03-prevent-integer-overflow.patch";
       sha256 = "100cw07fk4sa3hl7a1gk2hgz4qsxdw99y20r7wpidwwwzy463zcv";
-    })
+    }
   ];
 
-  meta = {
-    homepage = "https://sourceforge.net/projects/fuseiso";
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+
+  buildInputs = [ fuse glib zlib ];
+
+  # after autoreconfHook, glib and zlib are not found, so force link against
+  # them
+  NIX_LDFLAGS = "-lglib-2.0 -lz";
+
+  enableParallelBuilding = true;
+
+  postInstall = ''
+    install -Dm444 -t $out/share/doc/${pname} NEWS README
+  '';
+
+  meta = with stdenv.lib; {
     description = "FUSE module to mount ISO filesystem images";
-    platforms = stdenv.lib.platforms.linux;
-    license = stdenv.lib.licenses.gpl2;
+    homepage = "https://sourceforge.net/projects/fuseiso";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/graphics/scrot/default.nix b/pkgs/tools/graphics/scrot/default.nix
index 56df615e5750..f9042645be0b 100644
--- a/pkgs/tools/graphics/scrot/default.nix
+++ b/pkgs/tools/graphics/scrot/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "scrot";
-  version = "1.2";
+  version = "1.3";
 
   src = fetchFromGitHub {
     owner = "resurrecting-open-source-projects";
     repo = pname;
     rev = version;
-    sha256 = "08gkdby0ysx2mki57z81zlm7vfnq9c1gq692xw67cg5vv2p3320w";
+    sha256 = "0x70hd59ik37kqd8xqpwrz46np01jv324iz28x2s0kk36d7sblsj";
   };
 
   nativeBuildInputs = [ autoreconfHook autoconf-archive ];
diff --git a/pkgs/tools/misc/autorandr/default.nix b/pkgs/tools/misc/autorandr/default.nix
index c6f664a10086..9588d0ae9486 100644
--- a/pkgs/tools/misc/autorandr/default.nix
+++ b/pkgs/tools/misc/autorandr/default.nix
@@ -6,7 +6,7 @@
 
 let
   python = python3Packages.python;
-  version = "1.9";
+  version = "1.10";
 in
   stdenv.mkDerivation {
     pname = "autorandr";
@@ -49,7 +49,7 @@ in
       owner = "phillipberndt";
       repo = "autorandr";
       rev = version;
-      sha256 = "1bb0l7fcm5lcx9y02zdxv7pfdqf4v4gsc5br3v1x9gzjvqj64l7n";
+      sha256 = "0rcgs1n09p0p16lr5y239s0yrw7bch0x2cqwgc2dyh7rz7d9qmwn";
     };
 
     meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/blsd/default.nix b/pkgs/tools/misc/blsd/default.nix
deleted file mode 100644
index 6e6a9b7c5abd..000000000000
--- a/pkgs/tools/misc/blsd/default.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{ stdenv, buildGoPackage, fetchFromGitHub, pkgconfig, libgit2 }:
-
-buildGoPackage {
-  pname = "blsd";
-  version = "2017-07-27";
-
-  goPackagePath = "github.com/junegunn/blsd";
-
-  src = fetchFromGitHub {
-    owner = "junegunn";
-    repo = "blsd";
-    rev = "a2ac619821e502452abdeae9ebab45026893b9e8";
-    sha256 = "0b0q6i4i28cjqgxqmwxbps22gp9rcd3jz562q5wvxrwlpbzlls2h";
-  };
-
-  goDeps = ./deps.nix;
-
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ libgit2 ];
-
-  meta = with stdenv.lib; {
-    homepage = "https://github.com/junegunn/blsd";
-    description = "List directories in breadth-first order";
-    license = licenses.mit;
-    maintainers = [ maintainers.magnetophon ];
-    platforms = platforms.unix;
-    broken = true; # since 2020-02-08, libgit2 is incompatible upstream is dead.
-  };
-}
diff --git a/pkgs/tools/misc/blsd/deps.nix b/pkgs/tools/misc/blsd/deps.nix
deleted file mode 100644
index d212f213a60e..000000000000
--- a/pkgs/tools/misc/blsd/deps.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
-[
-  {
-    goPackagePath = "github.com/libgit2/git2go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/libgit2/git2go";
-      rev = "14280de4da0f392935854a7cbdd67b2a5505c3a8";
-      sha256 = "17ppd7byzir8rhdk645dmggi700scb8f401yiwx8zy81q41dk1qi";
-    };
-  }
-]
diff --git a/pkgs/tools/misc/chafa/default.nix b/pkgs/tools/misc/chafa/default.nix
index e63ad0e42af5..9e1671aec9de 100644
--- a/pkgs/tools/misc/chafa/default.nix
+++ b/pkgs/tools/misc/chafa/default.nix
@@ -2,14 +2,14 @@
 
 
 stdenv.mkDerivation rec{
-  version = "1.4.0";
+  version = "1.4.1";
   pname = "chafa";
 
   src = fetchFromGitHub {
     owner = "hpjansson";
     repo = "chafa";
     rev = version;
-    sha256 = "0vf658dd9sb2d3yh65c8nals9z0z7rykqqigmxq2h92x2ysjbg6x";
+    sha256 = "13vv2xmfh0dr949bh75448lidvzwxks6f1mjawdg1q8qwzxhzry4";
   };
 
   nativeBuildInputs = [ autoconf
diff --git a/pkgs/tools/misc/entr/default.nix b/pkgs/tools/misc/entr/default.nix
index aeb88d0c68b1..be8134a92a33 100644
--- a/pkgs/tools/misc/entr/default.nix
+++ b/pkgs/tools/misc/entr/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "entr";
-  version = "4.4";
+  version = "4.5";
 
   src = fetchurl {
     url = "http://entrproject.org/code/${pname}-${version}.tar.gz";
-    sha256 = "1x2hyc8vc5dz6k7b3291vxz36wllhinvqrb0d8zx9bv0ydj6qmjl";
+    sha256 = "08gsd99w20fdi0apppmzsh06z29ga8y89nfcizidil2hkl8b7jyn";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/misc/kak-lsp/default.nix b/pkgs/tools/misc/kak-lsp/default.nix
index 3048b4c93960..2f63eaf43806 100644
--- a/pkgs/tools/misc/kak-lsp/default.nix
+++ b/pkgs/tools/misc/kak-lsp/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kak-lsp";
-  version = "7.0.0";
+  version = "8.0.0";
 
   src = fetchFromGitHub {
     owner = "ul";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1b9v417g0z9q1sqgnms5vy740xggg4fcz0fdwbc4hfvfj6jkyaad";
+    sha256 = "0nka51szivwhlfkimjiyzj67nxh75m784c28ass6ihlfax631w9m";
   };
 
-  cargoSha256 = "1cmms8kvh24sjb0w77i1bwl09wkx3x65p49pkg1j0lipwic3apm3";
+  cargoSha256 = "174qy50m9487vv151vm8q6sby79dq3gbqjbz6h4326jwsc9wwi8c";
 
   buildInputs = lib.optional stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
 
diff --git a/pkgs/tools/misc/memtest86-efi/default.nix b/pkgs/tools/misc/memtest86-efi/default.nix
index f2adadc0840b..c33aa074404f 100644
--- a/pkgs/tools/misc/memtest86-efi/default.nix
+++ b/pkgs/tools/misc/memtest86-efi/default.nix
@@ -1,4 +1,10 @@
-{ fetchzip, lib, stdenv, mtools }:
+{ stdenv
+, lib
+, fetchzip
+, utillinux
+, jq
+, mtools
+}:
 
 stdenv.mkDerivation rec {
   pname = "memtest86-efi";
@@ -22,19 +28,28 @@ stdenv.mkDerivation rec {
     stripRoot = false;
   };
 
-  nativeBuildInputs = [ mtools ];
+  nativeBuildInputs = [
+    utillinux
+    jq
+    mtools
+  ];
 
   installPhase = ''
-    mkdir -p $out $TEMP/memtest86-files
-
     # memtest86 is distributed as a bootable USB image.  It contains the actual
     # memtest86 EFI app.
     #
-    # The following uses dd and mcopy to extract the actual EFI app from the
-    # usb image so that it can be installed directly on the hard drive.
-    dd if=$src/memtest86-usb.img of=$TEMP/ESP.img skip=2048
-    mcopy -i $TEMP/ESP.img ::/EFI/BOOT/ $TEMP/memtest86-files/
-    mv $TEMP/memtest86-files/BOOT/* $out/
+    # The following uses sfdisk to calculate the offset of the FAT EFI System
+    # Partition in the disk image, and mcopy to extract the actual EFI app from
+    # the filesystem so that it can be installed directly on the hard drive.
+    IMG=$src/memtest86-usb.img
+    ESP_OFFSET=$(sfdisk --json $IMG | jq -r '
+      # Partition type GUID identifying EFI System Partitions
+      def ESP_GUID: "C12A7328-F81F-11D2-BA4B-00A0C93EC93B";
+      .partitiontable |
+      .sectorsize * (.partitions[] | select(.type == ESP_GUID) | .start)
+    ')
+    mkdir $out
+    mcopy -vsi $IMG@@$ESP_OFFSET ::'/EFI/BOOT/*' $out/
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/misc/pistol/default.nix b/pkgs/tools/misc/pistol/default.nix
index 17e9dcbc33a1..1a244cd41039 100644
--- a/pkgs/tools/misc/pistol/default.nix
+++ b/pkgs/tools/misc/pistol/default.nix
@@ -6,16 +6,17 @@
 
 buildGoModule rec {
   pname = "pistol";
-  version = "0.0.5";
+  version = "0.1.1";
 
   src = fetchFromGitHub {
     owner = "doronbehar";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1zxvpmy6c26dhg5wpk5cgaqipw5372crkhm1vaghm8jkiw7sjwvw";
+    sha256 = "1d9c1bhidh781dis4427wramfrla4avqw9y2bmpjp81cqq3nc27d";
   };
 
-  modSha256 = "13yxcfd29ziprjsjl2ji7w5i2506hwwl3y0ycaphj2wlcd75rdxs";
+  modSha256 = "0r062nka72ah2nb2gf8dfrrj4sxadkykcqjzkp4c9vwk93mhw41k";
+  buildFlagsArray = [ "-ldflags=-s -w -X main.Version=${version}" ];
 
   subPackages = [ "cmd/pistol" ];
 
diff --git a/pkgs/tools/misc/pspg/default.nix b/pkgs/tools/misc/pspg/default.nix
index 1bd2fc259eea..1bb7f9582c42 100644
--- a/pkgs/tools/misc/pspg/default.nix
+++ b/pkgs/tools/misc/pspg/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pspg";
-  version = "2.7.1";
+  version = "3.0.7";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = pname;
     rev = version;
-    sha256 = "1fq8n5naicfv0lsyzfb52c84w40zrsks0x9rrvyyzih4vkhic4vm";
+    sha256 = "10w47hbi6y92imzh1rlwkh5bfj1pnlkfxhbi8lhmy6ggxa62xmf7";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/misc/silicon/default.nix b/pkgs/tools/misc/silicon/default.nix
index 7fc1a63c5abc..a59a14d4b901 100644
--- a/pkgs/tools/misc/silicon/default.nix
+++ b/pkgs/tools/misc/silicon/default.nix
@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "silicon";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "Aloxaf";
     repo = "silicon";
     rev = "v${version}";
-    sha256 = "0j211qrkwgll7rm15dk4fcazmxkcqk2zah0qg2s3y0k7cx65bcxy";
+    sha256 = "1avdzs3v6k4jhkadm8i8dlwg0iffqd99xqpi53smd0zgwks744l5";
   };
 
-  cargoSha256 = "1i0y3x5rmg27gxrr2lv04sqq7qyiv1bnazfy24l5zgb4akvdg3r5";
+  cargoSha256 = "0bdb4nadrms5jq3s8pby2qfky7112ynd7vd6mw720mshqklk5zyb";
 
   buildInputs = [ llvmPackages.libclang expat freetype ]
     ++ lib.optionals stdenv.isLinux [ libxcb ]
diff --git a/pkgs/tools/misc/tmux/default.nix b/pkgs/tools/misc/tmux/default.nix
index 4d17768b8dcd..12ea456b9f7e 100644
--- a/pkgs/tools/misc/tmux/default.nix
+++ b/pkgs/tools/misc/tmux/default.nix
@@ -21,7 +21,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "tmux";
-  version = "3.1a";
+  version = "3.1b";
 
   outputs = [ "out" "man" ];
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     owner = "tmux";
     repo = "tmux";
     rev = version;
-    sha256 = "1j85d5mj7zf3k17wsrm45m79ygc6dljc4as3crvp12r45k8xg9k6";
+    sha256 = "0jvyq4r691bn0wsr8i6c0q0lzss25vm9nx8sv3fhw9cs63ncq04y";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/drill/default.nix b/pkgs/tools/networking/drill/default.nix
new file mode 100644
index 000000000000..7636bd44d2db
--- /dev/null
+++ b/pkgs/tools/networking/drill/default.nix
@@ -0,0 +1,30 @@
+{ stdenv
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, openssl
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "drill";
+  version = "0.5.0";
+
+  src = fetchFromGitHub {
+    owner = "fcsonline";
+    repo = pname;
+    rev = version;
+    sha256 = "0aqd709fg0ha0lzri2p4pgraxvif7z8zcm8rx7sk6s2n605sc4gn";
+  };
+
+  cargoSha256 = "1c8vmyf388kbbs56h8b62nxgxvgy9yj9cnmvax6ycnslkcwmvld0";
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ openssl ];
+
+  meta = with stdenv.lib; {
+    description = "HTTP load testing application inspired by Ansible syntax";
+    homepage = "https://github.com/fcsonline/drill";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ filalex77 ];
+  };
+}
diff --git a/pkgs/tools/networking/minio-client/default.nix b/pkgs/tools/networking/minio-client/default.nix
index 3bd03f385646..0649eb021720 100644
--- a/pkgs/tools/networking/minio-client/default.nix
+++ b/pkgs/tools/networking/minio-client/default.nix
@@ -2,22 +2,20 @@
 
 buildGoModule rec {
   pname = "minio-client";
-  version = "2020-04-04T05-28-55Z";
+  version = "2020-04-25T00-43-23Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "mc";
     rev = "RELEASE.${version}";
-    sha256 = "09z28fq492d4l0089d1knq4zah9p2b212pkz777vznw9lzfqqip8";
+    sha256 = "0ff2fyr3787zp0lpgbph064am33py2wzjikzmxd3zwp3y0dic770";
   };
 
-  modSha256 = "0cv824ar5ifsg93sylrfjmax6zqm5073y95hqqfcc1dfp0mv2ki3";
+  modSha256 = "1bcz7jchfnglypr2md9hhqbvcbghic2yp6njdrx3m5nqhylypzfx";
 
   subPackages = [ "." ];
 
-  preBuild = ''
-    buildFlagsArray+=("-ldflags=-X github.com/minio/mc/cmd.Version=${version}")
-  '';
+  buildFlagsArray = [ "-ldflags=-s -w -X github.com/minio/mc/cmd.Version=${version}" ];
 
   meta = with stdenv.lib; {
     homepage = "https://github.com/minio/mc";
diff --git a/pkgs/tools/networking/tendermint/default.nix b/pkgs/tools/networking/tendermint/default.nix
index 2bf907380e06..90b16e37ed78 100644
--- a/pkgs/tools/networking/tendermint/default.nix
+++ b/pkgs/tools/networking/tendermint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tendermint";
-  version = "0.32.10";
+  version = "0.32.11";
 
   src = fetchFromGitHub {
     owner = "tendermint";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0rf00fqbf8xvxbxnhki93knwdp4bqjvv548ia8c0w6cryj07plyg";
+    sha256 = "17p7khfiv5aflpl4imbqp8v7gignd6v6a7g80xlnzgix5ismh84l";
   };
 
-  modSha256 = "08f03haxzpi57gaxymsbzs0nbbgnf6z4gmpal476xy3gvc0dyi3r";
+  modSha256 = "1sdjzj52gkqk51ml29hijzv64clmi38km5z7j7paf28dla2brfxq";
 
   meta = with stdenv.lib; {
     description = "Byzantine-Fault Tolerant State Machines. Or Blockchain, for short.";
diff --git a/pkgs/tools/nix/cached-nix-shell/default.nix b/pkgs/tools/nix/cached-nix-shell/default.nix
index dc69d3f030d7..03f6bc2b1171 100644
--- a/pkgs/tools/nix/cached-nix-shell/default.nix
+++ b/pkgs/tools/nix/cached-nix-shell/default.nix
@@ -34,7 +34,7 @@ in rustPlatform.buildRustPackage rec {
 
   postInstall = ''
     mkdir -p $out/lib $out/share/cached-nix-shell $out/share/man/man1 $out/var/empty
-    cp target/release/build/cached-nix-shell-*/out/trace-nix.so $out/lib
+    cp $releaseDir/build/cached-nix-shell-*/out/trace-nix.so $out/lib
     cp rcfile.sh $out/share/cached-nix-shell/rcfile.sh
     cp cached-nix-shell.1 $out/share/man/man1
   '';
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 96fd1bebdd45..baeae0ef52b9 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -177,7 +177,7 @@ in rec {
   nixStable = callPackage common (rec {
     name = "nix-2.3.4";
     src = fetchurl {
-      url = "http://nixos.org/releases/nix/${name}/${name}.tar.xz";
+      url = "https://nixos.org/releases/nix/${name}/${name}.tar.xz";
       sha256 = "1c626a0de0acc69830b1891ec4d3c96aabe673b2a9fd04cef84f2304d05ad00d";
     };
 
diff --git a/pkgs/tools/package-management/nixops/nixops-v1_6_1.nix b/pkgs/tools/package-management/nixops/nixops-v1_6_1.nix
index e6e30b26240f..dc0c733ca7b1 100644
--- a/pkgs/tools/package-management/nixops/nixops-v1_6_1.nix
+++ b/pkgs/tools/package-management/nixops/nixops-v1_6_1.nix
@@ -3,7 +3,7 @@
 callPackage ./generic.nix (rec {
   version = "1.6.1";
   src = fetchurl {
-    url = "http://nixos.org/releases/nixops/nixops-${version}/nixops-${version}.tar.bz2";
+    url = "https://nixos.org/releases/nixops/nixops-${version}/nixops-${version}.tar.bz2";
     sha256 = "0lfx5fhyg3z6725ydsk0ibg5qqzp5s0x9nbdww02k8s307axiah3";
   };
   nixopsAzurePackages = with python2Packages; [
diff --git a/pkgs/tools/security/bitwarden_rs/default.nix b/pkgs/tools/security/bitwarden_rs/default.nix
index 6accefa58a4f..6d3c4bccef9f 100644
--- a/pkgs/tools/security/bitwarden_rs/default.nix
+++ b/pkgs/tools/security/bitwarden_rs/default.nix
@@ -8,13 +8,13 @@ let
 
 in rustPlatform.buildRustPackage rec {
   pname = "bitwarden_rs";
-  version = "1.14.1";
+  version = "1.14.2";
 
   src = fetchFromGitHub {
     owner = "dani-garcia";
     repo = pname;
     rev = version;
-    sha256 = "10fi5vvckmdbjvlg6mlaqh2dsm33sbkq1z1b6gmz8qjbijc8i7gw";
+    sha256 = "0413yjbnj4k917x48h1gnj64kygbr6c1n55f23qkvj0hgbxpgssz";
   };
 
   nativeBuildInputs = [ pkgconfig ];
@@ -25,7 +25,7 @@ in rustPlatform.buildRustPackage rec {
 
   RUSTC_BOOTSTRAP = 1;
 
-  cargoSha256 = "1p8wpndj1aydhcjl15z3xhjf52a0l5rh5cy9qs6w4776crya2jjr";
+  cargoSha256 = "09747f9g7yyq9c8wbfdb3hwxii5xq23ynhba0vc01nhjpjyn0ksd";
   cargoBuildFlags = [ featuresFlag ];
 
   checkPhase = ''
diff --git a/pkgs/tools/security/bitwarden_rs/vault.nix b/pkgs/tools/security/bitwarden_rs/vault.nix
index 43d8d3a9b118..0c60ab621063 100644
--- a/pkgs/tools/security/bitwarden_rs/vault.nix
+++ b/pkgs/tools/security/bitwarden_rs/vault.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bitwarden_rs-vault";
-  version = "2.13.2";
+  version = "2.13.2b";
 
   src = fetchurl {
     url = "https://github.com/dani-garcia/bw_web_builds/releases/download/v${version}/bw_web_v${version}.tar.gz";
-    sha256 = "1000iqjr670imm1dlw9r003d8psp5sq0m0p62sjnll7wnycd805r";
+    sha256 = "1pba3d04gfnviv8r98anpv7m8r9r417s352r5fz8qzg8lr070540";
   };
 
   buildCommand = ''
diff --git a/pkgs/tools/system/kmon/default.nix b/pkgs/tools/system/kmon/default.nix
index 1a4cdb9acdfe..afb59b25059e 100644
--- a/pkgs/tools/system/kmon/default.nix
+++ b/pkgs/tools/system/kmon/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kmon";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0lpwp5fzlf037bn03x1dldw8nfa5pyqi4qsqbscwn42idvs94mhx";
+    sha256 = "1l2zdp5f9spkfx1dhxyj32791kgvc8hqjr1kk75vds4c1wgwq8gk";
   };
 
-  cargoSha256 = "1g5k6dkv0zznh8q359n7sg9wf0gcix6m36pg9ql8wi5hnlsvg1s1";
+  cargoSha256 = "08a7gr70a3rh7a52gglck16qlwngb6ap723lg3b3mxmkyigdf6i6";
 
   nativeBuildInputs = [ python3 ];
 
diff --git a/pkgs/tools/text/shfmt/default.nix b/pkgs/tools/text/shfmt/default.nix
index 71f79724b9cb..cad595079037 100644
--- a/pkgs/tools/text/shfmt/default.nix
+++ b/pkgs/tools/text/shfmt/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "shfmt";
-  version = "3.1.0";
+  version = "3.1.1";
 
   src = fetchFromGitHub {
     owner = "mvdan";
     repo = "sh";
     rev = "v${version}";
-    sha256 = "1k0bq4b4rv6wrh24jvcnpg1mfqrzqhl90zg4zibxzv3zkhjdskzh";
+    sha256 = "0zlk1jjk65jwd9cx0xarz4yg2r2h86kd5g00gcnsav6dp6rx3aw8";
   };
 
   modSha256 = "080k8d5rp8kyg0x7vjxm758b9ya9z336yd4rcqws7yhqawxiv55z";
diff --git a/pkgs/tools/typesetting/tex/texlive/default.nix b/pkgs/tools/typesetting/tex/texlive/default.nix
index 52a107118753..bb6432fc3e61 100644
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@@ -1,6 +1,6 @@
 /* TeX Live user docs
   - source: ../../../../../doc/languages-frameworks/texlive.xml
-  - current html: http://nixos.org/nixpkgs/manual/#sec-language-texlive
+  - current html: https://nixos.org/nixpkgs/manual/#sec-language-texlive
 */
 { stdenv, lib, fetchurl, runCommand, writeText, buildEnv
 , callPackage, ghostscriptX, harfbuzz, poppler_min
diff --git a/pkgs/tools/virtualization/linode-cli/default.nix b/pkgs/tools/virtualization/linode-cli/default.nix
index bcb0c545d455..c16eb003d8d4 100644
--- a/pkgs/tools/virtualization/linode-cli/default.nix
+++ b/pkgs/tools/virtualization/linode-cli/default.nix
@@ -13,8 +13,8 @@
 let
 
   spec = fetchurl {
-    url = "https://developers.linode.com/api/docs/v4/openapi.yaml";
-    sha256 = "1l2fahdcmv7sp1qkwr5nv2vls8fypvlybwylqfzhyjmn7jqkw4hq";
+    url = "https://raw.githubusercontent.com/linode/linode-api-docs/v4.63.1/openapi.yaml";
+    sha256 = "03ngzbq24zazfqmfd7xjmxixkcb9vv1jgamplsj633j7sjj708s0";
   };
 
 in
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 954b8eb60c7b..fb7de0545f31 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1270,8 +1270,6 @@ in
 
   blockdiag = with python3Packages; toPythonApplication blockdiag;
 
-  blsd = callPackage ../tools/misc/blsd { };
-
   bluez-alsa = callPackage ../tools/bluetooth/bluez-alsa { };
 
   bluez-tools = callPackage ../tools/bluetooth/bluez-tools { };
@@ -2974,6 +2972,8 @@ in
 
   driftnet = callPackage ../tools/networking/driftnet {};
 
+  drill = callPackage ../tools/networking/drill { };
+
   drone = callPackage ../development/tools/continuous-integration/drone { };
 
   drone-cli = callPackage ../development/tools/continuous-integration/drone-cli { };
@@ -9356,6 +9356,8 @@ in
 
   janet = callPackage ../development/interpreters/janet {};
 
+  jelly = callPackage ../development/interpreters/jelly {};
+
   jimtcl = callPackage ../development/interpreters/jimtcl {};
 
   jmeter = callPackage ../applications/networking/jmeter {};
@@ -21076,6 +21078,8 @@ in
 
   omxplayer = callPackage ../applications/video/omxplayer { };
 
+  inherit (python3Packages.callPackage ../applications/networking/onionshare { }) onionshare onionshare-gui;
+
   openbox = callPackage ../applications/window-managers/openbox { };
 
   openbox-menu = callPackage ../applications/misc/openbox-menu {
@@ -21108,6 +21112,8 @@ in
     inherit (pkgs) pkgconfig;
   };
 
+  orca-c = callPackage ../applications/audio/orca-c {};
+
   osm2xmap = callPackage ../applications/misc/osm2xmap {
     libyamlcpp = libyamlcpp_0_3;
   };
@@ -25946,7 +25952,7 @@ in
 
   texFunctions = callPackage ../tools/typesetting/tex/nix pkgs;
 
-  # TeX Live; see http://nixos.org/nixpkgs/manual/#sec-language-texlive
+  # TeX Live; see https://nixos.org/nixpkgs/manual/#sec-language-texlive
   texlive = recurseIntoAttrs
     (callPackage ../tools/typesetting/tex/texlive { });
 
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 9517769f7b38..44b90219606e 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -38,11 +38,6 @@ let
 
     async_extra_p4 = callPackage ../development/ocaml-modules/async_extra { };
 
-    async_find =
-      if lib.versionOlder "4.03" ocaml.version
-      then janeStreet.async_find
-      else callPackage ../development/ocaml-modules/async_find { };
-
     async_kernel_p4 = callPackage ../development/ocaml-modules/async_kernel { };
 
     async_unix_p4 = callPackage ../development/ocaml-modules/async_unix { };
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 2f933eeff1f5..daec9dacbe67 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -3224,6 +3224,19 @@ let
     };
   };
 
+  ConvertBencode = buildPerlPackage rec {
+    pname = "Convert-Bencode";
+    version = "1.03";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/O/OR/ORCLEV/${pname}-${version}.tar.gz";
+      sha256 = "0v2ywj18px67mg97xnrdq9mnlzgqvj92pr2g47g9c9b9cpw3v7r6";
+    };
+    meta = {
+      description = "Functions for converting to/from bencoded strings";
+      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
   ConvertColor = buildPerlModule {
     pname = "Convert-Color";
     version = "0.11";