about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/languages-frameworks/agda.section.md12
-rw-r--r--doc/languages-frameworks/python.section.md6
-rw-r--r--lib/attrsets.nix2
-rw-r--r--maintainers/maintainer-list.nix6
-rw-r--r--maintainers/team-list.nix14
-rw-r--r--nixos/doc/manual/release-notes/rl-2009.xml56
-rw-r--r--nixos/modules/module-list.nix2
-rw-r--r--nixos/modules/rename.nix6
-rw-r--r--nixos/modules/services/databases/mysql.nix44
-rw-r--r--nixos/modules/services/hardware/fwupd.nix35
-rw-r--r--nixos/modules/services/hardware/u2f.nix23
-rw-r--r--nixos/modules/services/networking/go-neb.nix53
-rw-r--r--nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py20
-rw-r--r--nixos/tests/all-tests.nix1
-rw-r--r--nixos/tests/go-neb.nix44
-rw-r--r--nixos/tests/systemd-boot.nix57
-rw-r--r--pkgs/applications/audio/ft2-clone/default.nix4
-rw-r--r--pkgs/applications/audio/jamulus/default.nix4
-rw-r--r--pkgs/applications/audio/munt/default.nix8
-rw-r--r--pkgs/applications/audio/spek/default.nix25
-rw-r--r--pkgs/applications/blockchains/litecoin.nix4
-rw-r--r--pkgs/applications/graphics/yeetgif/default.nix4
-rw-r--r--pkgs/applications/misc/ArchiSteamFarm/default.nix42
-rw-r--r--pkgs/applications/misc/gallery-dl/default.nix4
-rw-r--r--pkgs/applications/misc/qmapshack/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/chromium/upstream-info.nix18
-rw-r--r--pkgs/applications/networking/browsers/kristall/default.nix30
-rw-r--r--pkgs/applications/networking/cluster/nomad/default.nix4
-rw-r--r--pkgs/applications/networking/datovka/default.nix4
-rw-r--r--pkgs/applications/networking/ftp/filezilla/default.nix12
-rw-r--r--pkgs/applications/networking/instant-messengers/go-neb/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/slack/default.nix8
-rw-r--r--pkgs/applications/office/kmymoney/default.nix4
-rw-r--r--pkgs/applications/radio/cubicsdr/default.nix5
-rw-r--r--pkgs/applications/radio/limesuite/default.nix24
-rw-r--r--pkgs/applications/science/electronics/verilator/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-filter-repo/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-gone/default.nix6
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-open/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-subtrac/default.nix6
-rw-r--r--pkgs/applications/video/handbrake/default.nix4
-rw-r--r--pkgs/applications/video/mpv/wrapper.nix2
-rw-r--r--pkgs/build-support/agda/default.nix13
-rw-r--r--pkgs/build-support/rust/build-rust-crate/build-crate.nix4
-rw-r--r--pkgs/build-support/rust/build-rust-crate/configure-crate.nix22
-rw-r--r--pkgs/build-support/rust/build-rust-crate/default.nix17
-rw-r--r--pkgs/build-support/rust/build-rust-crate/test/default.nix26
-rw-r--r--pkgs/data/documentation/man-pages/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/apps/evolution/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/core/evince/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-control-center/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-desktop/default.nix4
-rw-r--r--pkgs/development/compilers/go/1.13.nix2
-rw-r--r--pkgs/development/compilers/go/1.14.nix2
-rw-r--r--pkgs/development/compilers/yosys/default.nix6
-rw-r--r--pkgs/development/libraries/gcc/libgcc/default.nix2
-rw-r--r--pkgs/development/libraries/libiio/default.nix4
-rw-r--r--pkgs/development/libraries/libraspberrypi/default.nix6
-rw-r--r--pkgs/development/libraries/libu2f-host/default.nix4
-rw-r--r--pkgs/development/libraries/nanopb/default.nix88
-rw-r--r--pkgs/development/libraries/nanopb/protoc-gen-nanopb3
-rw-r--r--pkgs/development/libraries/nanopb/test-message-with-annotations/default.nix27
-rw-r--r--pkgs/development/libraries/nanopb/test-message-with-annotations/withannotations.proto7
-rw-r--r--pkgs/development/libraries/nanopb/test-message-with-options/default.nix27
-rw-r--r--pkgs/development/libraries/nanopb/test-message-with-options/withoptions.options1
-rw-r--r--pkgs/development/libraries/nanopb/test-message-with-options/withoptions.proto5
-rw-r--r--pkgs/development/libraries/nanopb/test-simple-proto2/default.nix24
-rw-r--r--pkgs/development/libraries/nanopb/test-simple-proto2/simple.proto5
-rw-r--r--pkgs/development/libraries/nanopb/test-simple-proto3/default.nix24
-rw-r--r--pkgs/development/libraries/nanopb/test-simple-proto3/simple.proto5
-rw-r--r--pkgs/development/libraries/opendht/default.nix4
-rw-r--r--pkgs/development/libraries/swiften/build-fix.patch32
-rw-r--r--pkgs/development/libraries/swiften/default.nix9
-rw-r--r--pkgs/development/libraries/wxwidgets/3.0/default.nix14
-rw-r--r--pkgs/development/libraries/wxwidgets/3.1/default.nix12
-rw-r--r--pkgs/development/misc/rpiboot/unstable.nix6
-rw-r--r--pkgs/development/python-modules/aiohttp/default.nix4
-rw-r--r--pkgs/development/python-modules/awkward1/default.nix4
-rw-r--r--pkgs/development/python-modules/bpython/clipboard-make-which-substitutable.patch27
-rw-r--r--pkgs/development/python-modules/bpython/default.nix17
-rw-r--r--pkgs/development/python-modules/buildbot/default.nix4
-rw-r--r--pkgs/development/python-modules/buildbot/pkg.nix2
-rw-r--r--pkgs/development/python-modules/buildbot/plugins.nix10
-rw-r--r--pkgs/development/python-modules/buildbot/worker.nix2
-rw-r--r--pkgs/development/python-modules/jc/default.nix4
-rw-r--r--pkgs/development/python-modules/pycurl/default.nix3
-rw-r--r--pkgs/development/python-modules/pydantic/default.nix9
-rw-r--r--pkgs/development/python-modules/pygdbmi/default.nix6
-rw-r--r--pkgs/development/python-modules/python-engineio/default.nix1
-rw-r--r--pkgs/development/python-modules/rope/default.nix4
-rw-r--r--pkgs/development/tools/analysis/cpplint/default.nix5
-rw-r--r--pkgs/development/tools/build-managers/bmake/default.nix4
-rw-r--r--pkgs/development/tools/misc/cquery/default.nix64
-rw-r--r--pkgs/development/tools/misc/cquery/wrapper12
-rw-r--r--pkgs/development/tools/out-of-tree/default.nix6
-rw-r--r--pkgs/development/web/deno/default.nix6
-rwxr-xr-xpkgs/development/web/deno/update/update.ts2
-rw-r--r--pkgs/games/easyrpg-player/default.nix4
-rw-r--r--pkgs/games/katago/default.nix4
-rw-r--r--pkgs/games/openmw/default.nix8
-rw-r--r--pkgs/misc/drivers/hplip/default.nix6
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd/default.nix402
-rw-r--r--pkgs/os-specific/linux/firmware/raspberrypi/default.nix4
-rw-r--r--pkgs/os-specific/linux/firmware/raspberrypi/tools-dont-install-sysv-init-scripts.patch20
-rw-r--r--pkgs/os-specific/linux/firmware/raspberrypi/tools.nix8
-rw-r--r--pkgs/os-specific/linux/firmware/sof-firmware/default.nix23
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rpi.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/linux-testing.nix6
-rw-r--r--pkgs/servers/blockbook/default.nix6
-rw-r--r--pkgs/servers/dns/bind/default.nix3
-rw-r--r--pkgs/servers/mail/postfix/default.nix4
-rw-r--r--pkgs/servers/mqtt/mosquitto/default.nix4
-rw-r--r--pkgs/servers/sql/postgresql/ext/pg_ed25519.nix31
-rw-r--r--pkgs/servers/sql/postgresql/packages.nix2
-rw-r--r--pkgs/servers/web-apps/searx/default.nix3
-rw-r--r--pkgs/shells/fish/default.nix4
-rw-r--r--pkgs/tools/graphics/luxcorerender/default.nix26
-rw-r--r--pkgs/tools/misc/bdf2sfd/default.nix4
-rw-r--r--pkgs/tools/misc/fluent-bit/default.nix4
-rw-r--r--pkgs/tools/misc/graylog/default.nix4
-rw-r--r--pkgs/tools/misc/graylog/plugins.nix10
-rw-r--r--pkgs/tools/misc/ncdu/default.nix4
-rw-r--r--pkgs/tools/misc/system-config-printer/default.nix17
-rw-r--r--pkgs/tools/misc/youtube-dl/default.nix4
-rw-r--r--pkgs/tools/networking/acme-client/default.nix18
-rw-r--r--pkgs/tools/networking/memtier-benchmark/default.nix4
-rw-r--r--pkgs/tools/package-management/rpm/default.nix8
-rw-r--r--pkgs/tools/security/certstrap/default.nix4
-rw-r--r--pkgs/tools/security/chipsec/default.nix4
-rw-r--r--pkgs/tools/security/rage/default.nix14
-rw-r--r--pkgs/tools/system/di/default.nix4
-rw-r--r--pkgs/tools/virtualization/govc/default.nix4
-rw-r--r--pkgs/top-level/aliases.nix1
-rw-r--r--pkgs/top-level/all-packages.nix45
-rw-r--r--pkgs/top-level/python-packages.nix2
137 files changed, 1306 insertions, 671 deletions
diff --git a/doc/languages-frameworks/agda.section.md b/doc/languages-frameworks/agda.section.md
index 8cba6d9faa7d..72b895f5da12 100644
--- a/doc/languages-frameworks/agda.section.md
+++ b/doc/languages-frameworks/agda.section.md
@@ -67,7 +67,17 @@ A derivation can then be written using `agdaPackages.mkDerivation`. This has sim
 + `libraryName` should be the name that appears in the `*.agda-lib` file, defaulting to `pname`.
 + `libraryFile` should be the file name of the `*.agda-lib` file, defaulting to `${libraryName}.agda-lib`.
 
-The build phase for `agdaPackages.mkDerivation` simply runs `agda` on the `Everything.agda` file. If something else is needed to build the package (e.g. `make`) then the `buildPhase` should be overridden (or a `preBuild` or `configurePhase` can be used if there are steps that need to be done prior to checking the `Everything.agda` file). `agda` and the Agda libraries contained in `buildInputs` are made available during the build phase. The install phase simply copies all `.agda`, `.agdai` and `.agda-lib` files to the output directory. Again, this can be overridden.
+### Build phase
+The default build phase for `agdaPackages.mkDerivation` simply runs `agda` on the `Everything.agda` file.
+If something else is needed to build the package (e.g. `make`) then the `buildPhase` should be overridden.
+Additionally, a `preBuild` or `configurePhase` can be used if there are steps that need to be done prior to checking the `Everything.agda` file.
+`agda` and the Agda libraries contained in `buildInputs` are made available during the build phase.
+
+### Install phase
+The default install phase copies agda source files, agda interface files (`*.agdai`) and `*.agda-lib` files to the output directory.
+This can be overridden.
+
+By default, agda sources are files ending on  `.agda`, or literate agda files ending on `.lagda`, `.lagda.tex`, `.lagda.org`, `.lagda.md`, `.lagda.rst`. The list of recognised agda source extensions can be extended by setting the `extraExtensions` config variable.
 
 To add an agda package to `nixpkgs`, the derivation should be written to `pkgs/development/libraries/agda/${library-name}/` and an entry should be added to `pkgs/top-level/agda-packages.nix`. Here it is called in a scope with access to all other agda libraries, so the top line of the `default.nix` can look like:
 ```
diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 7da839ee4826..dc10483ce694 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -764,9 +764,6 @@ following are specific to `buildPythonPackage`:
 * `dontWrapPythonPrograms ? false`: Skip wrapping of Python programs.
 * `permitUserSite ? false`: Skip setting the `PYTHONNOUSERSITE` environment
   variable in wrapped programs.
-* `installFlags ? []`: A list of strings. Arguments to be passed to `pip
-  install`. To pass options to `python setup.py install`, use
-  `--install-option`. E.g., `installFlags=["--install-option='--cpp_implementation'"]`.
 * `format ? "setuptools"`: Format of the source. Valid options are
   `"setuptools"`, `"pyproject"`, `"flit"`, `"wheel"`, and `"other"`.
   `"setuptools"` is for when the source has a `setup.py` and `setuptools` is
@@ -782,6 +779,9 @@ following are specific to `buildPythonPackage`:
 * `namePrefix`: Prepends text to `${name}` parameter. In case of libraries, this
   defaults to `"python3.8-"` for Python 3.8, etc., and in case of applications
   to `""`.
+* `pipInstallFlags ? []`: A list of strings. Arguments to be passed to `pip
+  install`. To pass options to `python setup.py install`, use
+  `--install-option`. E.g., `pipInstallFlags=["--install-option='--cpp_implementation'"]`.
 * `pythonPath ? []`: List of packages to be added into `$PYTHONPATH`. Packages
   in `pythonPath` are not propagated (contrary to `propagatedBuildInputs`).
 * `preShellHook`: Hook to execute commands before `shellHook`.
diff --git a/lib/attrsets.nix b/lib/attrsets.nix
index 7d84c25de77a..82bea7af31fc 100644
--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@@ -253,7 +253,7 @@ rec {
   /* Like `mapAttrsRecursive', but it takes an additional predicate
      function that tells it whether to recursive into an attribute
      set.  If it returns false, `mapAttrsRecursiveCond' does not
-     recurse, but does apply the map function.  It is returns true, it
+     recurse, but does apply the map function.  If it returns true, it
      does recurse, and does not apply the map function.
 
      Type:
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index b75cb49467a0..f7a7ce20c708 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1157,6 +1157,12 @@
     githubId = 24417923;
     name = "Renaud";
   };
+  c00w = {
+    email = "nix@daedrum.net";
+    github = "c00w";
+    githubId = 486199;
+    name = "Colin";
+  };
   c0deaddict = {
     email = "josvanbakel@protonmail.com";
     github = "c0deaddict";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 1fed6a4d9bf7..25a4995b733e 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -34,6 +34,20 @@ with lib.maintainers; {
     scope = "Maintain Freedesktop.org packages for graphical desktop.";
   };
 
+  golang = {
+    members = [
+      c00w
+      cstrahan
+      Frostman
+      kalbasit
+      mic92
+      orivej
+      rvolosatovs
+      zowoq
+    ];
+    scope = "Maintain Golang compilers.";
+  };
+
   gnome = {
     members = [
       hedning
diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml
index f2485f7395c8..d1eecd65085c 100644
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@@ -94,6 +94,22 @@ services.mysql.initialScript = pkgs.writeText "mariadb-init.sql" ''
       When MariaDB data directory is just upgraded (not initialized), the users are not created or modified.
     </para>
    </listitem>
+   <listitem>
+    <para>
+      MySQL server is now started with additional systemd sandbox/hardening options for better security. The PrivateTmp, ProtectHome, and ProtectSystem options
+      may be problematic when MySQL is attempting to read from or write to your filesystem anywhere outside of its own state directory, for example when
+      calling <literal>LOAD DATA INFILE or SELECT * INTO OUTFILE</literal>. In this scenario a variant of the following may be required:
+        - allow MySQL to read from /home and /tmp directories when using <literal>LOAD DATA INFILE</literal>
+<programlisting>
+systemd.services.mysql.serviceConfig.ProtectHome = lib.mkForce "read-only";
+</programlisting>
+        - allow MySQL to write to custom folder <literal>/var/data</literal> when using <literal>SELECT * INTO OUTFILE</literal>, assuming the mysql user has write
+          access to <literal>/var/data</literal>
+<programlisting>
+systemd.services.mysql.serviceConfig.ReadWritePaths = [ "/var/data" ];
+</programlisting>
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 
@@ -486,7 +502,7 @@ systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
 
   <itemizedlist>
    <listitem>
-     <para>SD and ISO images are now compressed by default using <literal>zstd</literal>.</para>
+    <para>SD images are now compressed by default using <literal>zstd</literal>. The compression for ISO images has also been changed to <literal>zstd</literal>, but ISO images are still not compressed by default.</para>
    </listitem>
    <listitem>
     <para>
@@ -560,6 +576,44 @@ systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
      <link xlink:href="https://grafana.com/docs/grafana/latest/installation/upgrading/#upgrading-to-v7-0">in the Grafana documentation</link>.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     The <literal>hardware.u2f</literal> module, which was installing udev rules
+     was removed, as udev gained native support to handle FIDO security tokens.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     With this release <literal>systemd-networkd</literal> (when enabled through <xref linkend="opt-networking.useNetworkd"/>)
+     has it's netlink socket created through a <literal>systemd.socket</literal> unit. This gives us control over
+     socket buffer sizes and other parameters. For larger setups where networkd has to create a lot of (virtual)
+     devices the default buffer size (currently 128MB) is not enough.
+    </para>
+    <para>
+     On a machine with &gt;100 virtual interfaces (e.g., wireguard tunnels, VLANs, …), that all have to
+     be brought up during system startup, the receive buffer size will spike for a brief period.
+     Eventually some of the message will be dropped since there is not enough (permitted) buffer
+     space available.
+    </para>
+    <para>
+     By having <literal>systemd-networkd</literal> start with a netlink socket created by
+     <literal>systemd</literal> we can configure the <literal>ReceiveBufferSize=</literal> parameter
+     in the socket options (i.e. <literal>systemd.sockets.systemd-networkd.socketOptions.ReceiveBufferSize</literal>)
+     without recompiling <literal>systemd-networkd</literal>.
+    </para>
+    <para>
+     Since the actual memory requirements depend on hardware, timing, exact
+     configurations etc. it isn't currently possible to infer a good default
+     from within the NixOS module system. Administrators are advised to
+     monitor the logs of <literal>systemd-networkd</literal> for <literal>rtnl: kernel receive buffer
+     overrun</literal> spam and increase the memory limit as they see fit.
+    </para>
+    <para>
+     Note: Increasing the <literal>ReceiveBufferSize=</literal> doesn't allocate any memory. It just increases
+     the upper bound on the kernel side. The memory allocation depends on the amount of messages that are
+     queued on the kernel side of the netlink socket.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 </section>
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 321fec5fb517..c82c70a7b869 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -362,7 +362,6 @@
   ./services/hardware/throttled.nix
   ./services/hardware/trezord.nix
   ./services/hardware/triggerhappy.nix
-  ./services/hardware/u2f.nix
   ./services/hardware/udev.nix
   ./services/hardware/udisks2.nix
   ./services/hardware/upower.nix
@@ -624,6 +623,7 @@
   ./services/networking/gdomap.nix
   ./services/networking/git-daemon.nix
   ./services/networking/gnunet.nix
+  ./services/networking/go-neb.nix
   ./services/networking/go-shadowsocks2.nix
   ./services/networking/gogoclient.nix
   ./services/networking/gvpe.nix
diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix
index c91febdb710f..1dc7f8533176 100644
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -55,6 +55,12 @@ with lib;
       prey-bash-client is deprecated upstream
     '')
 
+    (mkRemovedOptionModule ["hardware" "u2f" ] ''
+      The U2F modules module was removed, as all it did was adding the
+      udev rules from libu2f-host to the system. Udev gained native support
+      to handle FIDO security tokens, so this isn't necessary anymore.
+    '')
+
     # Do NOT add any option renames here, see top of the file
   ];
 }
diff --git a/nixos/modules/services/databases/mysql.nix b/nixos/modules/services/databases/mysql.nix
index 51885881cf73..2e8c5b7640b2 100644
--- a/nixos/modules/services/databases/mysql.nix
+++ b/nixos/modules/services/databases/mysql.nix
@@ -334,7 +334,8 @@ in
     environment.etc."my.cnf".source = cfg.configFile;
 
     systemd.tmpfiles.rules = [
-      "d '${cfg.dataDir}' 0700 ${cfg.user} mysql -"
+      "d '${cfg.dataDir}' 0700 ${cfg.user} mysql - -"
+      "z '${cfg.dataDir}' 0700 ${cfg.user} mysql - -"
     ];
 
     systemd.services.mysql = let
@@ -357,21 +358,17 @@ in
         preStart = if isMariaDB then ''
           if ! test -e ${cfg.dataDir}/mysql; then
             ${mysql}/bin/mysql_install_db --defaults-file=/etc/my.cnf ${mysqldOptions}
-            touch /tmp/mysql_init
+            touch ${cfg.dataDir}/mysql_init
           fi
         '' else ''
           if ! test -e ${cfg.dataDir}/mysql; then
             ${mysql}/bin/mysqld --defaults-file=/etc/my.cnf ${mysqldOptions} --initialize-insecure
-            touch /tmp/mysql_init
+            touch ${cfg.dataDir}/mysql_init
           fi
         '';
 
         serviceConfig = {
-          User = cfg.user;
-          Group = "mysql";
           Type = if hasNotify then "notify" else "simple";
-          RuntimeDirectory = "mysqld";
-          RuntimeDirectoryMode = "0755";
           Restart = "on-abort";
           RestartSec = "5s";
           # The last two environment variables are used for starting Galera clusters
@@ -398,7 +395,7 @@ in
                   done
                 ''}
 
-                if [ -f /tmp/mysql_init ]
+                if [ -f ${cfg.dataDir}/mysql_init ]
                 then
                     ${concatMapStrings (database: ''
                       # Create initial databases
@@ -452,7 +449,7 @@ in
                         cat ${toString cfg.initialScript} | ${mysql}/bin/mysql -u root -N
                       ''}
 
-                    rm /tmp/mysql_init
+                    rm ${cfg.dataDir}/mysql_init
                 fi
 
                 ${optionalString (cfg.ensureDatabases != []) ''
@@ -476,6 +473,35 @@ in
               # ensureDatbases & ensureUsers depends on this script being run as root
               # when the user has secured their mysql install
               "+${setupScript}";
+          # User and group
+          User = cfg.user;
+          Group = "mysql";
+          # Runtime directory and mode
+          RuntimeDirectory = "mysqld";
+          RuntimeDirectoryMode = "0755";
+          # Access write directories
+          ReadWritePaths = [ cfg.dataDir ];
+          # Capabilities
+          CapabilityBoundingSet = "";
+          # Security
+          NoNewPrivileges = true;
+          # Sandboxing
+          ProtectSystem = "strict";
+          ProtectHome = true;
+          PrivateTmp = true;
+          PrivateDevices = true;
+          ProtectHostname = true;
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectControlGroups = true;
+          RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          PrivateMounts = true;
+          # System Call Filtering
+          SystemCallArchitectures = "native";
         };
       };
 
diff --git a/nixos/modules/services/hardware/fwupd.nix b/nixos/modules/services/hardware/fwupd.nix
index e586af25c2b1..222ac8e487eb 100644
--- a/nixos/modules/services/hardware/fwupd.nix
+++ b/nixos/modules/services/hardware/fwupd.nix
@@ -6,6 +6,23 @@ with lib;
 
 let
   cfg = config.services.fwupd;
+
+  customEtc = {
+    "fwupd/daemon.conf" = {
+      source = pkgs.writeText "daemon.conf" ''
+        [fwupd]
+        BlacklistDevices=${lib.concatStringsSep ";" cfg.blacklistDevices}
+        BlacklistPlugins=${lib.concatStringsSep ";" cfg.blacklistPlugins}
+      '';
+    };
+    "fwupd/uefi.conf" = {
+      source = pkgs.writeText "uefi.conf" ''
+        [uefi]
+        OverrideESPMountPoint=${config.boot.loader.efi.efiSysMountPoint}
+      '';
+    };
+  };
+
   originalEtc =
     let
       mkEtcFile = n: nameValuePair n { source = "${cfg.package}/etc/${n}"; };
@@ -96,22 +113,8 @@ in {
 
     environment.systemPackages = [ cfg.package ];
 
-    environment.etc = {
-      "fwupd/daemon.conf" = {
-        source = pkgs.writeText "daemon.conf" ''
-          [fwupd]
-          BlacklistDevices=${lib.concatStringsSep ";" cfg.blacklistDevices}
-          BlacklistPlugins=${lib.concatStringsSep ";" cfg.blacklistPlugins}
-        '';
-      };
-      "fwupd/uefi.conf" = {
-        source = pkgs.writeText "uefi.conf" ''
-          [uefi]
-          OverrideESPMountPoint=${config.boot.loader.efi.efiSysMountPoint}
-        '';
-      };
-
-    } // originalEtc // extraTrustedKeys // testRemote;
+    # customEtc overrides some files from the package
+    environment.etc = originalEtc // customEtc // extraTrustedKeys // testRemote;
 
     services.dbus.packages = [ cfg.package ];
 
diff --git a/nixos/modules/services/hardware/u2f.nix b/nixos/modules/services/hardware/u2f.nix
deleted file mode 100644
index bb4b2f05f890..000000000000
--- a/nixos/modules/services/hardware/u2f.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-let
-  cfg = config.hardware.u2f;
-in {
-  options = {
-    hardware.u2f = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Enable U2F hardware support.
-        '';
-      };
-    };
-  };
-
-  config = mkIf cfg.enable {
-    services.udev.packages = [ pkgs.libu2f-host ];
-  };
-}
-
diff --git a/nixos/modules/services/networking/go-neb.nix b/nixos/modules/services/networking/go-neb.nix
new file mode 100644
index 000000000000..991ae38f30a5
--- /dev/null
+++ b/nixos/modules/services/networking/go-neb.nix
@@ -0,0 +1,53 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.go-neb;
+
+  configFile = pkgs.writeText "config.yml" (builtins.toJSON cfg.config);
+in {
+  options.services.go-neb = {
+    enable = mkEnableOption "Extensible matrix bot written in Go";
+
+    bindAddress = mkOption {
+      type = types.str;
+      description = "Port (and optionally address) to listen on.";
+      default = ":4050";
+    };
+
+    baseUrl = mkOption {
+      type = types.str;
+      description = "Public-facing endpoint that can receive webhooks.";
+    };
+
+    config = mkOption {
+      type = types.uniq types.attrs;
+      description = ''
+        Your <filename>config.yaml</filename> as a Nix attribute set.
+        See <link xlink:href="https://github.com/matrix-org/go-neb/blob/master/config.sample.yaml">config.sample.yaml</link>
+        for possible options.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.go-neb = {
+      description = "Extensible matrix bot written in Go";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      environment = {
+        BASE_URL = cfg.baseUrl;
+        BIND_ADDRESS = cfg.bindAddress;
+        CONFIG_FILE = configFile;
+      };
+
+      serviceConfig = {
+        ExecStart = "${pkgs.go-neb}/bin/go-neb";
+        DynamicUser = true;
+      };
+    };
+  };
+
+  meta.maintainers = with maintainers; [ hexa maralorn ];
+}
diff --git a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
index f48a085ce57a..d8baed65c6df 100644
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
@@ -47,9 +47,9 @@ def write_loader_conf(profile, generation):
         if "@timeout@" != "":
             f.write("timeout @timeout@\n")
         if profile:
-            f.write("default nixos-%s-generation-%d\n" % (profile, generation))
+            f.write("default nixos-%s-generation-%d.conf\n".format(profile, generation))
         else:
-            f.write("default nixos-generation-%d\n" % (generation))
+            f.write("default nixos-generation-%d.conf\n".format(generation))
         if not @editor@:
             f.write("editor 0\n");
         f.write("console-mode @consoleMode@\n");
@@ -197,6 +197,22 @@ def main():
             subprocess.check_call(["@systemd@/bin/bootctl", "--path=@efiSysMountPoint@", "install"])
         else:
             subprocess.check_call(["@systemd@/bin/bootctl", "--path=@efiSysMountPoint@", "--no-variables", "install"])
+    else:
+        # Update bootloader to latest if needed
+        systemd_version = subprocess.check_output(["@systemd@/bin/bootctl", "--version"], universal_newlines=True).split()[1]
+        sdboot_status = subprocess.check_output(["@systemd@/bin/bootctl", "--path=@efiSysMountPoint@", "status"], universal_newlines=True)
+
+        # See status_binaries() in systemd bootctl.c for code which generates this
+        m = re.search("^\W+File:.*/EFI/(BOOT|systemd)/.*\.efi \(systemd-boot (\d+)\)$",
+                      sdboot_status, re.IGNORECASE | re.MULTILINE)
+        if m is None:
+            print("could not find any previously installed systemd-boot")
+        else:
+            sdboot_version = m.group(2)
+            if systemd_version > sdboot_version:
+                print("updating systemd-boot from %s to %s" % (sdboot_version, systemd_version))
+                subprocess.check_call(["@systemd@/bin/bootctl", "--path=@efiSysMountPoint@", "update"])
+
 
     mkdir_p("@efiSysMountPoint@/efi/nixos")
     mkdir_p("@efiSysMountPoint@/loader/entries")
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 1bf091b361cb..bd26fc906aaa 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -119,6 +119,7 @@ in
   installed-tests = pkgs.recurseIntoAttrs (handleTest ./installed-tests {});
   gocd-agent = handleTest ./gocd-agent.nix {};
   gocd-server = handleTest ./gocd-server.nix {};
+  go-neb = handleTest ./go-neb.nix {};
   google-oslogin = handleTest ./google-oslogin {};
   grafana = handleTest ./grafana.nix {};
   graphite = handleTest ./graphite.nix {};
diff --git a/nixos/tests/go-neb.nix b/nixos/tests/go-neb.nix
new file mode 100644
index 000000000000..d9e5db0b4a53
--- /dev/null
+++ b/nixos/tests/go-neb.nix
@@ -0,0 +1,44 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+{
+  name = "go-neb";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ hexa maralorn ];
+  };
+
+  nodes = {
+    server = {
+      services.go-neb = {
+        enable = true;
+        baseUrl = "http://localhost";
+        config = {
+          clients = [ {
+            UserId = "@test:localhost";
+            AccessToken = "changeme";
+            HomeServerUrl = "http://localhost";
+            Sync = false;
+            AutoJoinRooms = false;
+            DisplayName = "neverbeseen";
+          } ];
+          services = [ {
+            ID = "wikipedia_service";
+            Type = "wikipedia";
+            UserID = "@test:localhost";
+            Config = { };
+          } ];
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+    server.wait_for_unit("go-neb.service")
+    server.wait_until_succeeds(
+        "curl -L http://localhost:4050/services/hooks/d2lraXBlZGlhX3NlcnZpY2U"
+    )
+    server.wait_until_succeeds(
+        "journalctl -eu go-neb -o cat | grep -q service_id=wikipedia_service"
+    )
+  '';
+
+})
diff --git a/nixos/tests/systemd-boot.nix b/nixos/tests/systemd-boot.nix
index e911c3933616..eba4729d6de8 100644
--- a/nixos/tests/systemd-boot.nix
+++ b/nixos/tests/systemd-boot.nix
@@ -6,26 +6,53 @@
 with import ../lib/testing-python.nix { inherit system pkgs; };
 with pkgs.lib;
 
-makeTest {
-  name = "systemd-boot";
-  meta.maintainers = with pkgs.stdenv.lib.maintainers; [ danielfullmer ];
-
-  machine = { pkgs, lib, ... }: {
+let
+  common = {
     virtualisation.useBootLoader = true;
     virtualisation.useEFIBoot = true;
     boot.loader.systemd-boot.enable = true;
   };
+in
+{
+  basic = makeTest {
+    name = "systemd-boot";
+    meta.maintainers = with pkgs.stdenv.lib.maintainers; [ danielfullmer ];
+
+    machine = common;
+
+    testScript = ''
+      machine.start()
+      machine.wait_for_unit("multi-user.target")
 
-  testScript = ''
-    machine.start()
-    machine.wait_for_unit("multi-user.target")
+      machine.succeed("test -e /boot/loader/entries/nixos-generation-1.conf")
+
+      # Ensure we actually booted using systemd-boot
+      # Magic number is the vendor UUID used by systemd-boot.
+      machine.succeed(
+          "test -e /sys/firmware/efi/efivars/LoaderEntrySelected-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f"
+      )
+    '';
+  };
 
-    machine.succeed("test -e /boot/loader/entries/nixos-generation-1.conf")
+  update = makeTest {
+    name = "systemd-boot-update";
+    meta.maintainers = with pkgs.stdenv.lib.maintainers; [ danielfullmer ];
 
-    # Ensure we actually booted using systemd-boot.
-    # Magic number is the vendor UUID used by systemd-boot.
-    machine.succeed(
-        "test -e /sys/firmware/efi/efivars/LoaderEntrySelected-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f"
-    )
-  '';
+    machine = common;
+
+    testScript = ''
+      machine.succeed("mount -o remount,rw /boot")
+
+      # Replace version inside sd-boot with something older. See magic[] string in systemd src/boot/efi/boot.c
+      machine.succeed(
+          """
+        find /boot -iname '*.efi' -print0 | \
+        xargs -0 -I '{}' sed -i 's/#### LoaderInfo: systemd-boot .* ####/#### LoaderInfo: systemd-boot 001 ####/' '{}'
+      """
+      )
+
+      output = machine.succeed("/run/current-system/bin/switch-to-configuration boot")
+      assert "updating systemd-boot from 001 to " in output
+    '';
+  };
 }
diff --git a/pkgs/applications/audio/ft2-clone/default.nix b/pkgs/applications/audio/ft2-clone/default.nix
index c5661f3336f7..acf373fc41af 100644
--- a/pkgs/applications/audio/ft2-clone/default.nix
+++ b/pkgs/applications/audio/ft2-clone/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ft2-clone";
-  version = "1.24";
+  version = "1.25_fix";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "ft2-clone";
     rev = "v${version}";
-    sha256 = "0wb7xsc2m9f4q5zsf5ai6h6c0558lkziv30b5a8ic64wp0layr6k";
+    sha256 = "0q2mcp3xpgwilmiwzr9nnxlyg9c1kynh6cxzlyd95n520j00s6i7";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/audio/jamulus/default.nix b/pkgs/applications/audio/jamulus/default.nix
index 835e786353c5..498d980676d7 100644
--- a/pkgs/applications/audio/jamulus/default.nix
+++ b/pkgs/applications/audio/jamulus/default.nix
@@ -3,12 +3,12 @@
 
 mkDerivation rec {
   pname = "jamulus";
-  version = "3.5.5";
+  version = "3.5.6";
   src = fetchFromGitHub {
     owner = "corrados";
     repo = "jamulus";
     rev = "r${stdenv.lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "04h0nwlj71qbp7h4yn8djqchrf47jk8rab9zp9bh9pnkcyv60h27";
+    sha256 = "00vd6kffsf3vqfwaxjvln63x3n0q32f385qc51fn5iyj54410x0f";
   };
 
   nativeBuildInputs = [ pkg-config qmake ];
diff --git a/pkgs/applications/audio/munt/default.nix b/pkgs/applications/audio/munt/default.nix
index c9a1e9bea808..bf9710fb17ee 100644
--- a/pkgs/applications/audio/munt/default.nix
+++ b/pkgs/applications/audio/munt/default.nix
@@ -9,14 +9,14 @@ let
     categories = "Audio;AudioVideo;";
   };
 in mkDerivation rec {
-  version = "2.3.0";
+  version = "2.4.0";
   pname = "munt";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = with stdenv.lib.versions; "${pname}_${major version}_${minor version}_${patch version}";
-    sha256 = "0fjhshs4w942rlfksalalqshflbq83pyz1z0hcq53falh9v54cyw";
+    rev = with stdenv.lib.versions; "libmt32emu_${major version}_${minor version}_${patch version}";
+    sha256 = "0521i7js5imlsxj6n7181w5szfjikam0k4vq1d2ilkqgcwrkg6ln";
   };
 
   postInstall = ''
@@ -31,7 +31,7 @@ in mkDerivation rec {
   meta = with stdenv.lib; {
     description = "Multi-platform software synthesiser emulating Roland MT-32, CM-32L, CM-64 and LAPC-I devices";
     homepage = "http://munt.sourceforge.net/";
-    license = licenses.gpl2;
+    license = with licenses; [ lgpl21 gpl3 ];
     platforms = platforms.linux;
     maintainers = with maintainers; [ gnidorah ];
   };
diff --git a/pkgs/applications/audio/spek/default.nix b/pkgs/applications/audio/spek/default.nix
index 88b22c59ae50..d6918b192315 100644
--- a/pkgs/applications/audio/spek/default.nix
+++ b/pkgs/applications/audio/spek/default.nix
@@ -1,27 +1,28 @@
-{ stdenv, fetchzip, autoconf, automake, intltool, pkgconfig, ffmpeg, wxGTK }:
+{ stdenv, fetchFromGitHub, autoreconfHook, intltool, pkgconfig, ffmpeg, wxGTK30-gtk3, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   pname = "spek";
-  version = "0.8.3";
+  version = "unstable-2018-12-29";
 
-  src = fetchzip {
-    name = "${pname}-${version}-src";
-    url = "https://github.com/alexkay/spek/archive/v${version}.tar.gz";
-    sha256 = "0y4hlhswpqkqpsglrhg5xbfy1a6f9fvasgdf336vhwcjqsc3k2xv";
+  src = fetchFromGitHub {
+    owner = "alexkay";
+    repo = "spek";
+    rev = "f071c2956176ad53c7c8059e5c00e694ded31ded";
+    sha256 = "1l9gj9c1n92zlcjnyjyk211h83dk0idk644xnm5rs7q40p2zliy5";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ autoconf automake intltool ffmpeg wxGTK ];
+  # needed for autoreconfHook
+  AUTOPOINT="intltoolize --automake --copy";
 
-  preConfigure = ''
-    ./autogen.sh
-  '';
+  nativeBuildInputs = [ autoreconfHook intltool pkgconfig wrapGAppsHook ];
+
+  buildInputs = [ ffmpeg wxGTK30-gtk3 wxGTK30-gtk3.gtk ];
 
   meta = with stdenv.lib; {
     description = "Analyse your audio files by showing their spectrogram";
     homepage = "http://spek.cc/";
     license = licenses.gpl3;
+    maintainers = with maintainers; [ bjornfor ];
     platforms = platforms.all;
-    maintainers = [ maintainers.bjornfor ];
   };
 }
diff --git a/pkgs/applications/blockchains/litecoin.nix b/pkgs/applications/blockchains/litecoin.nix
index ec1658b595d3..22cfa3dbb91e 100644
--- a/pkgs/applications/blockchains/litecoin.nix
+++ b/pkgs/applications/blockchains/litecoin.nix
@@ -13,13 +13,13 @@ with stdenv.lib;
 mkDerivation rec {
 
   name = "litecoin" + (toString (optional (!withGui) "d")) + "-" + version;
-  version = "0.17.1";
+  version = "0.18.1";
 
   src = fetchFromGitHub {
     owner = "litecoin-project";
     repo = "litecoin";
     rev = "v${version}";
-    sha256 = "08a0ghs4aa9m3qv3ppydyshfibykdwxk07i1vcqvg0ycqisdpb7y";
+    sha256 = "11753zhyx1kmrlljc6kbjwrcb06dfcrsqvmw3iaki9a132qk6l5c";
   };
 
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
diff --git a/pkgs/applications/graphics/yeetgif/default.nix b/pkgs/applications/graphics/yeetgif/default.nix
index 157ef3753e08..3ae1b98661a6 100644
--- a/pkgs/applications/graphics/yeetgif/default.nix
+++ b/pkgs/applications/graphics/yeetgif/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "yeetgif";
-  version = "1.23.5";
+  version = "1.23.6";
 
   goPackagePath = "github.com/sgreben/yeetgif";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "sgreben";
     repo = pname;
     rev = version;
-    sha256 = "1yz4pps8g378lvmi92cnci6msjj7fprp9bxqmnsyn6lqw7s2wb47";
+    sha256 = "05z1ylsra60bb4cvr383g9im94zsph1dgicqbv5p73qgs634ckk7";
   };
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/ArchiSteamFarm/default.nix b/pkgs/applications/misc/ArchiSteamFarm/default.nix
index c165003d8f8c..6201d881a882 100644
--- a/pkgs/applications/misc/ArchiSteamFarm/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/default.nix
@@ -1,27 +1,15 @@
-{ stdenv, fetchurl, unzip, makeWrapper, autoPatchelfHook
-, zlib, lttng-ust, curl, icu, openssl }:
+{ stdenv, fetchurl, unzip, makeWrapper, dotnetCorePackages, jq }:
 
 stdenv.mkDerivation rec {
   pname = "ArchiSteamFarm";
-  version = "4.2.0.6";
-
-  src = {
-    x86_64-linux = fetchurl {
-      url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-linux-x64.zip";
-      sha256 = "05hx6q1lkbjbqhwi9xxvm7ycnsnpl1cnqzyy2yn0q4x27im399cn";
-    };
-    armv7l-linux = fetchurl {
-      url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-linux-arm.zip";
-      sha256 = "0l8irqrpl5vbjj84k4makj2ph2z6kpny7qz51zrzbgwhrlw0w4vg";
-    };
-    aarch64-linux = fetchurl {
-      url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-linux-arm64.zip";
-      sha256 = "0hg2g4i8sj3fxqfy4imz1iarby1d9f8dh59j266lbbdf2vfz2cml";
-    };
-  }.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
-
-  nativeBuildInputs = [ unzip makeWrapper autoPatchelfHook ];
-  buildInputs = [ stdenv.cc.cc zlib lttng-ust curl ];
+  version = "4.2.2.1";
+
+  src = fetchurl {
+    url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-generic.zip";
+    sha256 = "0pr9rrhi44yl99c2i12rimmc4mhbh0ma9jn17cgsh8p0kbj8sq94";
+  };
+
+  nativeBuildInputs = [ unzip makeWrapper jq ];
 
   sourceRoot = ".";
 
@@ -29,23 +17,25 @@ stdenv.mkDerivation rec {
     dist=$out/opt/asf
     mkdir -p $dist
     cp -r * $dist
-    chmod +x $dist/ArchiSteamFarm
-    makeWrapper $dist/ArchiSteamFarm $out/bin/ArchiSteamFarm \
-      --prefix LD_LIBRARY_PATH : "${stdenv.lib.makeLibraryPath [ icu openssl ] }" \
+
+    jq "del(.runtimeOptions.framework.version)" ArchiSteamFarm.runtimeconfig.json > $dist/ArchiSteamFarm.runtimeconfig.json
+
+    makeWrapper ${dotnetCorePackages.aspnetcore_3_1}/bin/dotnet $out/bin/ArchiSteamFarm \
+      --add-flags $dist/ArchiSteamFarm.dll \
       --add-flags "--path ~/.config/asf" \
       --run "mkdir -p ~/.config/asf" \
       --run "cd ~/.config/asf" \
       --run "[ -d config ] || cp --no-preserve=mode -r $dist/config ." \
       --run "[ -d logs ] || cp --no-preserve=mode -r $dist/logs ." \
       --run "[ -d plugins ] || cp --no-preserve=mode -r $dist/plugins ." \
-      --run "[ -d www ] || cp --no-preserve=mode -r $dist/www ." \
+      --run "[ -d www ] || ln -sf $dist/www ."
   '';
 
   meta = with stdenv.lib; {
     description = "Application with primary purpose of idling Steam cards from multiple accounts simultaneously";
     homepage = "https://github.com/JustArchiNET/ArchiSteamFarm";
     license = licenses.asl20;
-    platforms = [ "x86_64-linux" "armv7l-linux" "aarch64-linux" ];
+    platforms = dotnetCorePackages.aspnetcore_3_1.meta.platforms;
     maintainers = with maintainers; [ gnidorah ];
     hydraPlatforms = [];
   };
diff --git a/pkgs/applications/misc/gallery-dl/default.nix b/pkgs/applications/misc/gallery-dl/default.nix
index c73a28d0febd..6b8f6aa38cf8 100644
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@@ -2,11 +2,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "gallery_dl";
-  version = "1.14.0";
+  version = "1.14.1";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "0ckqxibyf14lgl1aj5pv79bmfanacgcc96x6mdwfp2dnbvfjk71b";
+    sha256 = "0w4zmfbsr7xdymrrmdvcc0kqz11ql8j067ghlr84faqlsnx09z74";
   };
 
   doCheck = false;
diff --git a/pkgs/applications/misc/qmapshack/default.nix b/pkgs/applications/misc/qmapshack/default.nix
index edb5a9b37889..1a8758955cef 100644
--- a/pkgs/applications/misc/qmapshack/default.nix
+++ b/pkgs/applications/misc/qmapshack/default.nix
@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "qmapshack";
-  version = "1.14.1";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "Maproom";
     repo = pname;
     rev = "V_${version}";
-    sha256 = "0hghynb4ac98fg1pwc645zriqkghxwp8mr3jhr87pa6fh0y848py";
+    sha256 = "157bssrbwcc1w58b0v60jb3wrjf2ig4z6z6crjnpvflkqj5p8vwy";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index ced9c2454b55..65dda4931422 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -1,18 +1,18 @@
 # This file is autogenerated from update.sh in the same directory.
 {
   beta = {
-    sha256 = "1di0fhhv6lljc2b50i0i8qx5y5xswgxz1bimpda790sb3b1xsdzx";
-    sha256bin64 = "1f5qwx4476l4fvbw9w2i22i080bahlf83dzzpnbny7hk831g7msw";
-    version = "84.0.4147.38";
+    sha256 = "0wsqxq8xxcafmjxsjkagysrcbr6qryiyqn6m3ysp256aam7z3d88";
+    sha256bin64 = "03jff1sdv05hbn37cw0ij0r4rils0q11lnnhxg52igg633jzwyc1";
+    version = "84.0.4147.45";
   };
   dev = {
-    sha256 = "07h3i4ab7yj05ndrqchzf3f9wr809qb3dj2gfc1653mkjmba8h07";
-    sha256bin64 = "10jdq5mr7qby0m26l5lbsqcbh9bhjdpmpbkkcvv9wm2259rwjxr5";
-    version = "85.0.4164.2";
+    sha256 = "16rmzyzjmxmhmr5yqbzqbwf5sq94iqcwlm04fkafiwcycd17nyhs";
+    sha256bin64 = "0wjmc1wdmwiq9d1f5gk4c9jkj1p116kaz9nb0hvhjf01iv07xl2m";
+    version = "85.0.4168.2";
   };
   stable = {
-    sha256 = "10vg0fmwlkzpnixhhhcwccxshqdfq7rh0ribij7wgkw42bv0bi0j";
-    sha256bin64 = "09vz7ygixs7lwlsvbby3dmc2gz0vpjwalzdh6l6apc4dngyr095k";
-    version = "83.0.4103.97";
+    sha256 = "0bvy17ymlih87n4ymnzvyn0m34ghmr1yasvy7gxv02qbw6i57lfg";
+    sha256bin64 = "00hjr5y0cczs6h2pxrigpmjiv24456948v32q7mr7x5ysr5kxpn6";
+    version = "83.0.4103.106";
   };
 }
diff --git a/pkgs/applications/networking/browsers/kristall/default.nix b/pkgs/applications/networking/browsers/kristall/default.nix
new file mode 100644
index 000000000000..34f23f452388
--- /dev/null
+++ b/pkgs/applications/networking/browsers/kristall/default.nix
@@ -0,0 +1,30 @@
+{ lib, mkDerivation, fetchFromGitHub, qtbase, qtmultimedia }:
+
+mkDerivation rec {
+  pname = "kristall";
+  version = "0.2";
+  src = fetchFromGitHub {
+    owner = "MasterQ32";
+    repo = "kristall";
+    rev = "V" + version;
+    sha256 = "08k3rg0sa91ra0nzla5rw806nnncnyvq1s7k09k5i74fvcsnpqyp";
+  };
+
+  buildInputs = [ qtbase qtmultimedia ];
+
+  qmakeFlags = [ "src/kristall.pro" ];
+
+  installPhase = ''
+    install -Dt $out/bin kristall
+    install -D Kristall.desktop $out/share/applications/net.random-projects.kristall.desktop
+  '';
+
+  meta = with lib;
+    src.meta // {
+      description =
+        "Graphical small-internet client, supports gemini, http, https, gopher, finger";
+      homepage = "https://random-projects.net/projects/kristall.gemini";
+      maintainers = with maintainers; [ ehmry ];
+      inherit (qtmultimedia.meta) platforms;
+    };
+}
diff --git a/pkgs/applications/networking/cluster/nomad/default.nix b/pkgs/applications/networking/cluster/nomad/default.nix
index da668b9589af..990679a86688 100644
--- a/pkgs/applications/networking/cluster/nomad/default.nix
+++ b/pkgs/applications/networking/cluster/nomad/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "nomad";
-  version = "0.11.1";
+  version = "0.11.3";
   rev = "v${version}";
 
   goPackagePath = "github.com/hashicorp/nomad";
@@ -12,7 +12,7 @@ buildGoPackage rec {
     owner = "hashicorp";
     repo = pname;
     inherit rev;
-    sha256 = "1pcn1bk7sqhhsrm3izqljwyrwdz6bdlplrajvjzka39l3k6f9hgc";
+    sha256 = "1p7g7x2gl77h1w7aip3xji3s530fj46gspargz4j3i6h4wkyvafb";
   };
 
   # ui:
diff --git a/pkgs/applications/networking/datovka/default.nix b/pkgs/applications/networking/datovka/default.nix
index 976541177ddb..6dc996c79754 100644
--- a/pkgs/applications/networking/datovka/default.nix
+++ b/pkgs/applications/networking/datovka/default.nix
@@ -11,11 +11,11 @@
 
 mkDerivation rec {
   pname = "datovka";
-  version = "4.15.0";
+  version = "4.15.1";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/datove_schranky/${version}/${pname}-${version}.tar.xz";
-    sha256 = "1f311qnyiay34iqpik4x492py46my89j4nnbdf6qcidnydzas8r1";
+    sha256 = "0ab1s1r6zrqxcfjnij5ar352kzyrl1m92c04nqk6hahpzzma2p3r";
   };
 
   buildInputs = [ libisds qmake qtbase qtsvg libxml2 ];
diff --git a/pkgs/applications/networking/ftp/filezilla/default.nix b/pkgs/applications/networking/ftp/filezilla/default.nix
index 96a4227b36e1..04f0296fe82e 100644
--- a/pkgs/applications/networking/ftp/filezilla/default.nix
+++ b/pkgs/applications/networking/ftp/filezilla/default.nix
@@ -10,16 +10,10 @@
 , pugixml
 , sqlite
 , tinyxml
-, wxGTK30
+, wxGTK30-gtk3
 , xdg_utils
 }:
 
-let
-  # we can drop this when wxgtk is built with gtk3 by default
-  # see: https://github.com/NixOS/nixpkgs/pull/73145
-  wxgtk' = wxGTK30.override { compat26 = false; withGtk2 = false; };
-
-in
 stdenv.mkDerivation rec {
   pname = "filezilla";
   version = "3.48.1";
@@ -52,8 +46,8 @@ stdenv.mkDerivation rec {
     pugixml
     sqlite
     tinyxml
-    wxgtk'
-    wxgtk'.gtk
+    wxGTK30-gtk3
+    wxGTK30-gtk3.gtk
     xdg_utils
   ];
 
diff --git a/pkgs/applications/networking/instant-messengers/go-neb/default.nix b/pkgs/applications/networking/instant-messengers/go-neb/default.nix
index a82e39647de0..769e5cf55159 100644
--- a/pkgs/applications/networking/instant-messengers/go-neb/default.nix
+++ b/pkgs/applications/networking/instant-messengers/go-neb/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, nixosTests }:
 
 buildGoModule {
   pname = "go-neb";
@@ -16,6 +16,8 @@ buildGoModule {
 
   vendorSha256 = "1k3980yf6zl00dkd1djwhm2f9nnffzrsbs3kq3alpw2gm0aln739";
 
+  passthru.tests.go-neb = nixosTests.go-neb;
+
   meta = with lib; {
     description = "Extensible matrix bot written in Go";
     homepage = "https://github.com/matrix-org/go-neb";
diff --git a/pkgs/applications/networking/instant-messengers/slack/default.nix b/pkgs/applications/networking/instant-messengers/slack/default.nix
index 9cf436ff18f3..ad831eb82a59 100644
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@@ -40,13 +40,13 @@ let
   throwSystem = throw "Unsupported system: ${system}";
 
   sha256 = {
-    x86_64-darwin = "0z731q00bwljlcmbjwqphyys7skqms1vg87pyi4nsvjmc7kjx7qg";
-    x86_64-linux = "0wrs0i2bqv21ivy8s88khbww28b3gsw4abbbbjc76mqma9b0bajs";
+    x86_64-darwin = "09daxnqxyccshkrmr7ysgjvgvgmlgd590ym68fz0l8n6ayfpkgw0";
+    x86_64-linux = "00ihhsgxm441nsmav7pq4n4y9s7p2r4x5dqld160658xyqi836cq";
   }.${system} or throwSystem;
 
   version = {
-    x86_64-darwin = "4.4.2";
-    x86_64-linux = "4.4.2";
+    x86_64-darwin = "4.6.0";
+    x86_64-linux = "4.4.3";
   }.${system} or throwSystem;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/office/kmymoney/default.nix b/pkgs/applications/office/kmymoney/default.nix
index 6137a4dc1ad8..e15615f78a34 100644
--- a/pkgs/applications/office/kmymoney/default.nix
+++ b/pkgs/applications/office/kmymoney/default.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "kmymoney";
-  version = "5.0.8";
+  version = "5.1.0";
 
   src = fetchurl {
     url = "mirror://kde/stable/kmymoney/${version}/src/${pname}-${version}.tar.xz";
-    sha256 = "1h6l01a08f1xgk4dfpndl7rmgbp9npm58qi760jwl2gggprwwsxc";
+    sha256 = "0l8kywq77yaf1bqgdqswrai9ws6a2l11drg0wgyi7f8js7qnif9d";
   };
 
   # Hidden dependency that wasn't included in CMakeLists.txt:
diff --git a/pkgs/applications/radio/cubicsdr/default.nix b/pkgs/applications/radio/cubicsdr/default.nix
index ef4d68af54c6..c85299606c03 100644
--- a/pkgs/applications/radio/cubicsdr/default.nix
+++ b/pkgs/applications/radio/cubicsdr/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, cmake, fftw, hamlib, libpulseaudio, libGL, libX11, liquid-dsp,
-  pkgconfig, soapysdr-with-plugins, wxGTK, enableDigitalLab ? false }:
+  pkgconfig, soapysdr-with-plugins, wxGTK31-gtk3, enableDigitalLab ? false }:
 
 stdenv.mkDerivation rec {
   pname = "cubicsdr";
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
-  buildInputs = [ fftw hamlib libpulseaudio libGL libX11 liquid-dsp soapysdr-with-plugins wxGTK ];
+
+  buildInputs = [ fftw hamlib libpulseaudio libGL libX11 liquid-dsp soapysdr-with-plugins wxGTK31-gtk3 ];
 
   cmakeFlags = [ "-DUSE_HAMLIB=ON" ]
     ++ stdenv.lib.optional enableDigitalLab "-DENABLE_DIGITAL_LAB=ON";
diff --git a/pkgs/applications/radio/limesuite/default.nix b/pkgs/applications/radio/limesuite/default.nix
index ef36eac28e42..7cadceab5611 100644
--- a/pkgs/applications/radio/limesuite/default.nix
+++ b/pkgs/applications/radio/limesuite/default.nix
@@ -1,14 +1,11 @@
 { stdenv, fetchFromGitHub, cmake
-, sqlite, wxGTK30, libusb1, soapysdr
+, sqlite, wxGTK30-gtk3, libusb1, soapysdr
 , mesa_glu, libX11, gnuplot, fltk
 } :
 
-let
-  version = "20.01.0";
-
-in stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "limesuite";
-  inherit version;
+  version = "20.01.0";
 
   src = fetchFromGitHub {
     owner = "myriadrf";
@@ -17,14 +14,16 @@ in stdenv.mkDerivation {
     sha256 = "01z4idcby2lm34bbnpbp400ski7p61jjiir6sy6dalnvsl52m7vx";
   };
 
-  enableParallelBuilding = true;
-
   nativeBuildInputs = [ cmake ];
 
+  cmakeFlags = [
+    "-DOpenGL_GL_PREFERENCE=GLVND"
+  ];
+
   buildInputs = [
     libusb1
     sqlite
-    wxGTK30
+    wxGTK30-gtk3
     fltk
     gnuplot
     libusb1
@@ -34,11 +33,8 @@ in stdenv.mkDerivation {
   ];
 
   postInstall = ''
-    mkdir -p $out/lib/udev/rules.d
-    cp ../udev-rules/64-limesuite.rules $out/lib/udev/rules.d
-
-    mkdir -p $out/share/limesuite
-    cp bin/Release/lms7suite_mcu/* $out/share/limesuite
+    install -Dm444 -t $out/lib/udev/rules.d ../udev-rules/64-limesuite.rules
+    install -Dm444 -t $out/share/limesuite bin/Release/lms7suite_mcu/*
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/science/electronics/verilator/default.nix b/pkgs/applications/science/electronics/verilator/default.nix
index 189e09f8241b..0613e22bbda0 100644
--- a/pkgs/applications/science/electronics/verilator/default.nix
+++ b/pkgs/applications/science/electronics/verilator/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "verilator";
-  version = "4.034";
+  version = "4.036";
 
   src = fetchurl {
     url    = "https://www.veripool.org/ftp/${pname}-${version}.tgz";
-    sha256 = "02xqvl9ic21jpda0xldh4ihqwl4ss8389s8fklgx5d98xq37pval";
+    sha256 = "1sy02pgq3kvk8548l57hsh08vfbqdg8dghj8mwlybdi8fdjz4z1h";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/version-management/git-and-tools/git-filter-repo/default.nix b/pkgs/applications/version-management/git-and-tools/git-filter-repo/default.nix
index 78011604cdd7..e4c57be2357c 100644
--- a/pkgs/applications/version-management/git-and-tools/git-filter-repo/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-filter-repo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "git-filter-repo";
-  version = "2.27.0";
+  version = "2.27.1";
 
   src = fetchurl {
     url = "https://github.com/newren/git-filter-repo/releases/download/v${version}/${pname}-${version}.tar.xz";
-    sha256 = "1vry0pqwi0p82m3wflr0wyf88wn75l049w18xf9f5z43xd9vpva1";
+    sha256 = "07r32n31ryflgz1ds3dz5s3ixv7li3scxwavy9mzbzdhq6bbzl28";
   };
 
   buildInputs = [ pythonPackages.python ];
diff --git a/pkgs/applications/version-management/git-and-tools/git-gone/default.nix b/pkgs/applications/version-management/git-and-tools/git-gone/default.nix
index 32350fa538db..46decaf3cc12 100644
--- a/pkgs/applications/version-management/git-and-tools/git-gone/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-gone/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-gone";
-  version = "0.3.2";
+  version = "0.3.6";
 
   src = fetchFromGitHub {
     owner = "lunaryorn";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0zc4cb1dg30np5yc4ymkr894qs2bk0r123i302md00niayk4njyd";
+    sha256 = "0wpmabd5lshsga3dhv1hix7i99f1f82rpl6kjmpi315whg11kki3";
   };
 
-  cargoSha256 = "1d892889ml7sqyxzmjipq5fvizb4abqhmmn450qm7yam9fn5q5wf";
+  cargoSha256 = "0ayqsrhy6hpi20gfryhnwl2c1na4nnmzxkp7him104cc07vsdllq";
 
   nativeBuildInputs = [ pkgconfig makeWrapper installShellFiles ];
 
diff --git a/pkgs/applications/version-management/git-and-tools/git-open/default.nix b/pkgs/applications/version-management/git-and-tools/git-open/default.nix
index 10f221b63882..f7b2120cca02 100644
--- a/pkgs/applications/version-management/git-and-tools/git-open/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-open/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "git-open";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "paulirish";
     repo = "git-open";
     rev = "v${version}";
-    sha256 = "0lprzrjsqrg83gixfaiw26achgd8l7s56jknsjss4p7y0w1fxm05";
+    sha256 = "11n46bngvca5wbdbfcxzjhjbfdbad7sgf7h9gf956cb1q8swsdm0";
   };
 
   buildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/version-management/git-and-tools/git-subtrac/default.nix b/pkgs/applications/version-management/git-and-tools/git-subtrac/default.nix
index df29eb152353..be67beef299f 100644
--- a/pkgs/applications/version-management/git-and-tools/git-subtrac/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-subtrac/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "git-subtrac";
-  version = "0.02";
+  version = "0.03";
 
   src = fetchFromGitHub {
     owner = "apenwarr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1nj950r38sxzrgw69m1xphm7a4km2g29iw2897gfx4wx57jl957k";
+    sha256 = "1ky04h18vg1yl9lykbhkmf25qslg0z2qzziy8c7afmvzvvvhm2v5";
   };
 
   vendorSha256 = "1ccwbhzwys8sl3m2rs2lp70snzsi2a0ahnnq8kn15rrlvsv5qahf";
@@ -19,4 +19,4 @@ buildGoModule rec {
     license = licenses.asl20;
     maintainers = [ maintainers.marsam ];
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/applications/video/handbrake/default.nix b/pkgs/applications/video/handbrake/default.nix
index bbbb60bdf511..b56c26dff78d 100644
--- a/pkgs/applications/video/handbrake/default.nix
+++ b/pkgs/applications/video/handbrake/default.nix
@@ -51,13 +51,13 @@ assert stdenv.isDarwin -> AudioToolbox != null
 
 stdenv.mkDerivation rec {
   pname = "handbrake";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
     owner = "HandBrake";
     repo = "HandBrake";
     rev = version;
-    sha256 = "04z3hcy7m5yvma849rlrsx2wdqmkilkl1qds9yrzr2ydpw697f85";
+    sha256 = "0bsmk37543zv3p32a7wxnh2w483am23ha2amj339q3nnb4142krn";
     extraPostFetch = ''
       echo "DATE=$(date +"%F %T %z" -r $out/NEWS.markdown)" > $out/version.txt
     '';
diff --git a/pkgs/applications/video/mpv/wrapper.nix b/pkgs/applications/video/mpv/wrapper.nix
index ad6383046b1b..5b3ad7a98311 100644
--- a/pkgs/applications/video/mpv/wrapper.nix
+++ b/pkgs/applications/video/mpv/wrapper.nix
@@ -54,7 +54,7 @@ let
     ;
     umpvWrapperArgs = lib.strings.escapeShellArgs ([
       "--argv0" "'$0'"
-      "--set" "MPV" "$out/bin/mpv"
+      "--set" "MPV" "${placeholder "out"}/bin/mpv"
     ] ++ extraUmpvWrapperArgs)
     ;
   in
diff --git a/pkgs/build-support/agda/default.nix b/pkgs/build-support/agda/default.nix
index 205aff555730..3c973e8cc0ac 100644
--- a/pkgs/build-support/agda/default.nix
+++ b/pkgs/build-support/agda/default.nix
@@ -30,6 +30,16 @@ let
 
   withPackages = arg: if builtins.isAttrs arg then withPackages' arg else withPackages' { pkgs = arg; };
 
+  extensions = [
+    "agda"
+    "agda-lib"
+    "agdai"
+    "lagda"
+    "lagda.md"
+    "lagda.org"
+    "lagda.rst"
+    "lagda.tex"
+  ];
 
   defaults =
     { pname
@@ -39,6 +49,7 @@ let
     , libraryFile ? "${libraryName}.agda-lib"
     , buildPhase ? null
     , installPhase ? null
+    , extraExtensions ? []
     , ...
     }: let
       agdaWithArgs = withPackages (builtins.filter (p: p ? isAgdaDerivation) buildInputs);
@@ -59,7 +70,7 @@ let
         installPhase = if installPhase != null then installPhase else ''
           runHook preInstall
           mkdir -p $out
-          find \( -name '*.agda' -or -name '*.agdai' -or -name '*.agda-lib' \) -exec cp -p --parents -t "$out" {} +
+          find \( ${concatMapStringsSep " -or " (p: "-name '*.${p}'") (extensions ++ extraExtensions)} \) -exec cp -p --parents -t "$out" {} +
           runHook postInstall
         '';
       };
diff --git a/pkgs/build-support/rust/build-rust-crate/build-crate.nix b/pkgs/build-support/rust/build-rust-crate/build-crate.nix
index d6d1cebb2e91..f82effdbca7c 100644
--- a/pkgs/build-support/rust/build-rust-crate/build-crate.nix
+++ b/pkgs/build-support/rust/build-rust-crate/build-crate.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, mkRustcDepArgs, rust }:
+{ lib, stdenv, mkRustcDepArgs, mkRustcFeatureArgs, rust }:
 { crateName,
   dependencies,
   crateFeatures, crateRenames, libName, release, libPath,
@@ -13,7 +13,7 @@
       ++ ["-C codegen-units=$NIX_BUILD_CORES"]
       ++ ["--remap-path-prefix=$NIX_BUILD_TOP=/" ]
       ++ [(mkRustcDepArgs dependencies crateRenames)]
-      ++ [crateFeatures]
+      ++ [(mkRustcFeatureArgs crateFeatures)]
       ++ extraRustcOpts
       ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "--target ${rust.toRustTarget stdenv.hostPlatform} -C linker=${stdenv.hostPlatform.config}-gcc"
       # since rustc 1.42 the "proc_macro" crate is part of the default crate prelude
diff --git a/pkgs/build-support/rust/build-rust-crate/configure-crate.nix b/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
index c47bc00938c1..8e2f5f7f35e0 100644
--- a/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
+++ b/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
@@ -1,5 +1,6 @@
-{ lib, stdenv, echo_colored, noisily, mkRustcDepArgs }:
-{ build
+{ lib, stdenv, echo_colored, noisily, mkRustcDepArgs, mkRustcFeatureArgs }:
+{
+  build
 , buildDependencies
 , colors
 , completeBuildDeps
@@ -30,6 +31,9 @@ let version_ = lib.splitString "-" crateVersion;
     optLevel = if release then 3 else 0;
     completeDepsDir = lib.concatStringsSep " " completeDeps;
     completeBuildDepsDir = lib.concatStringsSep " " completeBuildDeps;
+    envFeatures = lib.concatStringsSep " " (
+      map (f: lib.replaceChars ["-"] ["_"] (lib.toUpper f)) crateFeatures
+    );
 in ''
   ${echo_colored colors}
   ${noisily colors verbose}
@@ -161,14 +165,24 @@ in ''
        EXTRA_BUILD_FLAGS="$EXTRA_BUILD_FLAGS $(tr '\n' ' ' < target/link.build)"
      fi
      noisily rustc --crate-name build_script_build $BUILD --crate-type bin ${rustcOpts} \
-       ${crateFeatures} --out-dir target/build/${crateName} --emit=dep-info,link \
+       ${mkRustcFeatureArgs crateFeatures} --out-dir target/build/${crateName} --emit=dep-info,link \
        -L dependency=target/buildDeps ${buildDeps} --cap-lints allow $EXTRA_BUILD_FLAGS --color ${colors}
 
      mkdir -p target/build/${crateName}.out
      export RUST_BACKTRACE=1
      BUILD_OUT_DIR="-L $OUT_DIR"
      mkdir -p $OUT_DIR
-     target/build/${crateName}/build_script_build > target/build/${crateName}.opt
+
+     (
+       # Features should be set as environment variable for build scripts:
+       # https://doc.rust-lang.org/cargo/reference/environment-variables.html#environment-variables-cargo-sets-for-build-scripts
+       for feature in ${envFeatures}; do
+         export CARGO_FEATURE_$feature=1
+       done
+
+       target/build/${crateName}/build_script_build > target/build/${crateName}.opt
+     )
+
      set +e
      EXTRA_BUILD=$(sed -n "s/^cargo:rustc-flags=\(.*\)/\1/p" target/build/${crateName}.opt | tr '\n' ' ' | sort -u)
      EXTRA_FEATURES=$(sed -n "s/^cargo:rustc-cfg=\(.*\)/--cfg \1/p" target/build/${crateName}.opt | tr '\n' ' ')
diff --git a/pkgs/build-support/rust/build-rust-crate/default.nix b/pkgs/build-support/rust/build-rust-crate/default.nix
index d9ed26f1d94a..d559aba16165 100644
--- a/pkgs/build-support/rust/build-rust-crate/default.nix
+++ b/pkgs/build-support/rust/build-rust-crate/default.nix
@@ -45,14 +45,17 @@ let
            " --extern ${name}=${dep.lib}/lib/lib${extern}-${dep.metadata}${stdenv.hostPlatform.extensions.sharedLibrary}")
       ) dependencies;
 
+   # Create feature arguments for rustc.
+   mkRustcFeatureArgs = lib.concatMapStringsSep " " (f: ''--cfg feature=\"${f}\"'');
+
    inherit (import ./log.nix { inherit lib; }) noisily echo_colored;
 
    configureCrate = import ./configure-crate.nix {
-     inherit lib stdenv echo_colored noisily mkRustcDepArgs;
+     inherit lib stdenv echo_colored noisily mkRustcDepArgs mkRustcFeatureArgs;
    };
 
    buildCrate = import ./build-crate.nix {
-     inherit lib stdenv mkRustcDepArgs rust;
+     inherit lib stdenv mkRustcDepArgs mkRustcFeatureArgs rust;
    };
 
    installCrate = import ./install-crate.nix { inherit stdenv; };
@@ -233,8 +236,11 @@ stdenv.mkDerivation (rec {
       ++ lib.concatMap (dep: dep.completeBuildDeps ++ dep.completeDeps) buildDependencies
     );
 
-    crateFeatures = lib.optionalString (crate ? features)
-      (lib.concatMapStringsSep " " (f: ''--cfg feature=\"${f}\"'') (crate.features ++ features));
+    # Create a list of features that are enabled by the crate itself and
+    # through the features argument of buildRustCrate. Exclude features
+    # with a forward slash, since they are passed through to dependencies.
+    crateFeatures = lib.optionals (crate ? features)
+      (builtins.filter (f: !lib.hasInfix "/" f) (crate.features ++ features));
 
     libName = if crate ? libName then crate.libName else crate.crateName;
     libPath = if crate ? libPath then crate.libPath else "";
@@ -244,7 +250,8 @@ stdenv.mkDerivation (rec {
     metadata = let
       depsMetadata = lib.foldl' (str: dep: str + dep.metadata) "" (dependencies ++ buildDependencies);
       hashedMetadata = builtins.hashString "sha256"
-        (crateName + "-" + crateVersion + "___" + toString crateFeatures + "___" + depsMetadata);
+        (crateName + "-" + crateVersion + "___" + toString (mkRustcFeatureArgs crateFeatures) +
+          "___" + depsMetadata);
       in lib.substring 0 10 hashedMetadata;
 
     build = crate.build or "";
diff --git a/pkgs/build-support/rust/build-rust-crate/test/default.nix b/pkgs/build-support/rust/build-rust-crate/test/default.nix
index bdd6c86d5f07..24ddc11459ec 100644
--- a/pkgs/build-support/rust/build-rust-crate/test/default.nix
+++ b/pkgs/build-support/rust/build-rust-crate/test/default.nix
@@ -344,6 +344,32 @@ let
         buildTests = true;
         expectedTestOutputs = [ "test baz_false ... ok" ];
       };
+      buildScriptFeatureEnv = {
+        crateName = "build-script-feature-env";
+        features = [ "some-feature" "crate/another_feature" ];
+        src = symlinkJoin {
+          name = "build-script-feature-env";
+          paths = [
+            (mkFile  "src/main.rs" ''
+              #[cfg(test)]
+              #[test]
+              fn feature_not_visible() {
+                assert!(std::env::var("CARGO_FEATURE_SOME_FEATURE").is_err());
+                assert!(option_env!("CARGO_FEATURE_SOME_FEATURE").is_none());
+              }
+              fn main() {}
+            '')
+            (mkFile  "build.rs" ''
+              fn main() {
+                assert!(std::env::var("CARGO_FEATURE_SOME_FEATURE").is_ok());
+                assert!(option_env!("CARGO_FEATURE_SOME_FEATURE").is_none());
+              }
+            '')
+          ];
+        };
+        buildTests = true;
+        expectedTestOutputs = [ "test feature_not_visible ... ok" ];
+      };
       # Regression test for https://github.com/NixOS/nixpkgs/pull/88054
       # Build script output should be rewritten as valid env vars.
       buildScriptIncludeDirDeps = let
diff --git a/pkgs/data/documentation/man-pages/default.nix b/pkgs/data/documentation/man-pages/default.nix
index a9a64fb40299..5d58284cb663 100644
--- a/pkgs/data/documentation/man-pages/default.nix
+++ b/pkgs/data/documentation/man-pages/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "man-pages";
-  version = "5.06";
+  version = "5.07";
 
   src = fetchurl {
     url = "mirror://kernel/linux/docs/man-pages/${pname}-${version}.tar.xz";
-    sha256 = "0l7ypgl36jswa077qvdh1rcsvnwr64vja6cc32bab86sm41akf3h";
+    sha256 = "13b3q7c67r0wkla4pdihl1qh09k67ms2z5jgzfqgpdqqy6mgziwd";
   };
 
   makeFlags = [ "MANDIR=$(out)/share/man" ];
diff --git a/pkgs/desktops/gnome-3/apps/evolution/default.nix b/pkgs/desktops/gnome-3/apps/evolution/default.nix
index 467971b2dba4..b9ac719004aa 100644
--- a/pkgs/desktops/gnome-3/apps/evolution/default.nix
+++ b/pkgs/desktops/gnome-3/apps/evolution/default.nix
@@ -43,11 +43,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution";
-  version = "3.36.2";
+  version = "3.36.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "12ii8crp4v4bpdxrc2rkxwdxqz3qjizyfgfrmir9pcyxlg0lh2f5";
+    sha256 = "00yann3cibbsap7vh6qq08aklvydynmk6gmljkzd80kc52m6rqal";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix b/pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix
index fd7205e08fd0..eed28908bf33 100644
--- a/pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix
@@ -51,11 +51,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-boxes";
-  version = "3.36.4";
+  version = "3.36.5";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-boxes/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "16l0mq2ydmywcdya1795mcy8syg4zkmz9ws3pzjcqv5y4m7cjj03";
+    sha256 = "1khvyhgd3p41fvvknga1hdl0p1ks4kj4cwsiaw28v1sy6nzclm2c";
   };
 
   doCheck = true;
diff --git a/pkgs/desktops/gnome-3/core/evince/default.nix b/pkgs/desktops/gnome-3/core/evince/default.nix
index e268b8f8f121..d9d9f916d46d 100644
--- a/pkgs/desktops/gnome-3/core/evince/default.nix
+++ b/pkgs/desktops/gnome-3/core/evince/default.nix
@@ -43,13 +43,13 @@
 
 stdenv.mkDerivation rec {
   pname = "evince";
-  version = "3.36.3";
+  version = "3.36.5";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/evince/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1clx580n8vb6w0fhdbmcsxs07yczdgidyax1y7280rafyzvvsbmg";
+    sha256 = "0z79jl0j9xq9wgwkfr0d1w1qrdy4447y8shs407n5srr0vixc3bg";
   };
 
   postPatch = ''
diff --git a/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix b/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix
index 79d28ae8ced8..d282fec2e851 100644
--- a/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix
@@ -68,11 +68,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-control-center";
-  version = "3.36.2";
+  version = "3.36.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "05vqhj5z4w4vaphp541zxxkx6x781m371l2gqnq2vhnnqvqfz9g0";
+    sha256 = "0739qcwfwrimfrpf3gaakkf7ipwy3virs096kkhkxjmy1nbls5xw";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix b/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix
index 94de64c9ea98..22b3f17b4256 100644
--- a/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-desktop";
-  version = "3.36.2";
+  version = "3.36.3.1";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-desktop/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "12f724inw3sv289xqprvwh8r3qw89z67m74j3hyhkbp1n7f99y9q";
+    sha256 = "0zkbx5inprjpf4abqwn0bxc2d1rwbhv450cjh1wgz82ylagi3vab";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/go/1.13.nix b/pkgs/development/compilers/go/1.13.nix
index 8b013bbd6503..48e4d9bdc6c4 100644
--- a/pkgs/development/compilers/go/1.13.nix
+++ b/pkgs/development/compilers/go/1.13.nix
@@ -236,7 +236,7 @@ stdenv.mkDerivation rec {
     homepage = "http://golang.org/";
     description = "The Go Programming language";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ cstrahan orivej mic92 rvolosatovs kalbasit Frostman ];
+    maintainers = teams.golang.members;
     platforms = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/pkgs/development/compilers/go/1.14.nix b/pkgs/development/compilers/go/1.14.nix
index 9aaf85c598fc..560af19e2010 100644
--- a/pkgs/development/compilers/go/1.14.nix
+++ b/pkgs/development/compilers/go/1.14.nix
@@ -236,7 +236,7 @@ stdenv.mkDerivation rec {
     homepage = "http://golang.org/";
     description = "The Go Programming language";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ cstrahan orivej mic92 rvolosatovs kalbasit Frostman ];
+    maintainers = teams.golang.members;
     platforms = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/pkgs/development/compilers/yosys/default.nix b/pkgs/development/compilers/yosys/default.nix
index 332824185616..09e51e4c6471 100644
--- a/pkgs/development/compilers/yosys/default.nix
+++ b/pkgs/development/compilers/yosys/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname   = "yosys";
-  version = "2020.06.11";
+  version = "2020.06.16";
 
   src = fetchFromGitHub {
     owner  = "YosysHQ";
     repo   = "yosys";
-    rev    = "a1785e988b2b51dac32985dd6b0afdcedc6bda1d";
-    sha256 = "0987f5vm2zb0i02c3vlw21gihky2cfj5l9b78ddzhxfiv0qfkdfp";
+    rev    = "39ba90a8b84d740b670a9f1df5148b824d441c63";
+    sha256 = "1ncscbhyq4f07d28l32j37y5d84vyqxfx0fbzhb7nzfhplk8hh0s";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/gcc/libgcc/default.nix b/pkgs/development/libraries/gcc/libgcc/default.nix
index d638c2bb2788..f579da5f1d6c 100644
--- a/pkgs/development/libraries/gcc/libgcc/default.nix
+++ b/pkgs/development/libraries/gcc/libgcc/default.nix
@@ -63,7 +63,7 @@ stdenvNoLibs.mkDerivation rec {
       export CPP_FOR_TARGET=${stdenvNoLibs.cc}/bin/$CPP
       export LD_FOR_TARGET=${stdenvNoLibs.cc.bintools}/bin/$LD
 
-      export NIX_BUILD_CFLAGS_COMPILE+=' -DGENERATOR_FILE=1'
+      export NIX_CFLAGS_COMPILE_FOR_BUILD+=' -DGENERATOR_FILE=1'
 
       "$sourceRoot/../gcc/configure" $gccConfigureFlags
 
diff --git a/pkgs/development/libraries/libiio/default.nix b/pkgs/development/libraries/libiio/default.nix
index 03a907162b12..03324c15d8f7 100644
--- a/pkgs/development/libraries/libiio/default.nix
+++ b/pkgs/development/libraries/libiio/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libiio";
-  version = "0.19";
+  version = "0.20";
 
   src = fetchFromGitHub {
     owner  = "analogdevicesinc";
     repo   = "libiio";
     rev    = "refs/tags/v${version}";
-    sha256 = "1r67h5mayx9krh3mmzs5vz20mvwb2lw04hpbyyisygl01ndc77kq";
+    sha256 = "1929gvizkqmm9cwh3vihxxszfxvgcp5saq9q6chdk3fpdhzajc00";
   };
 
   outputs = [ "out" "lib" "dev" "python" ];
diff --git a/pkgs/development/libraries/libraspberrypi/default.nix b/pkgs/development/libraries/libraspberrypi/default.nix
index 1cd1f5e62ac1..bbe0b6145503 100644
--- a/pkgs/development/libraries/libraspberrypi/default.nix
+++ b/pkgs/development/libraries/libraspberrypi/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   name = "libraspberrypi";
-  version = "2019-10-22";
+  version = "2020-05-28";
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "userland";
-    rev = "5070cb7fc150fc98f1ed64a7739c3356970d9f76";
-    sha256 = "08yfzwn9s7lhrblcsxyag9p5lj5vk3n66b1pv3f7r3hah7qcggyq";
+    rev = "f97b1af1b3e653f9da2c1a3643479bfd469e3b74";
+    sha256 = "1r7n05rv96hqjq0rn0qzchmfqs0j7vh3p8jalgh66s6l0vms5mwy";
   };
 
   cmakeFlags = if (stdenv.targetPlatform.system == "aarch64-linux")
diff --git a/pkgs/development/libraries/libu2f-host/default.nix b/pkgs/development/libraries/libu2f-host/default.nix
index 3becd075b255..f033aa9f610f 100644
--- a/pkgs/development/libraries/libu2f-host/default.nix
+++ b/pkgs/development/libraries/libu2f-host/default.nix
@@ -14,10 +14,6 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  postInstall = ''
-    install -D -t $out/lib/udev/rules.d 70-u2f.rules
-  '';
-
   meta = with stdenv.lib; {
     homepage = "https://developers.yubico.com/libu2f-host";
     description = "A C library and command-line tool that implements the host-side of the U2F protocol";
diff --git a/pkgs/development/libraries/nanopb/default.nix b/pkgs/development/libraries/nanopb/default.nix
new file mode 100644
index 000000000000..a63d367b800d
--- /dev/null
+++ b/pkgs/development/libraries/nanopb/default.nix
@@ -0,0 +1,88 @@
+{ callPackage
+, cmake
+, fetchFromGitHub
+, lib
+, protobuf
+, python3
+, stdenv
+}:
+
+let
+  pythonRuntime = python3.withPackages(ps: [ ps.protobuf ]);
+in stdenv.mkDerivation rec {
+  pname = "nanopb";
+  version = "0.4.1";
+
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = version;
+    sha256 = "16zxk42wzn519bpxf4578qn97k0h1cnbkvqqkqvka9sl0n3lz2dp";
+  };
+
+  nativeBuildInputs = [ cmake python3 ];
+
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=ON" # generate $out/lib/libprotobuf-nanopb.so{.0,}
+    "-DBUILD_STATIC_LIBS=ON" # generate $out/lib/libprotobuf-nanopb.a
+    "-Dnanopb_PROTOC_PATH=${protobuf}/bin/protoc"
+  ];
+
+  # On a case-insensitive filesystem (such as on Darwin), CMake fails to create
+  # the build directory because of the existence of the BUILD file.
+  # TODO: This can be removed once https://github.com/nanopb/nanopb/pull/537 is merged.
+  preConfigure = "rm BUILD";
+
+  # install the generator which requires Python3 with the protobuf package. It
+  # also requires the nanopb module that's generated by CMake to be in a
+  # relative location to the generator itself so we move it out of the
+  # python.sitePackages into the shared generator folder.
+  postInstall = ''
+    mkdir -p $out/share/nanopb/generator/proto
+    cp ../generator/nanopb_generator.py $out/share/nanopb/generator/nanopb_generator.py
+    cp ../generator/proto/_utils.py $out/share/nanopb/generator/proto/_utils.py
+    cp ../generator/proto/nanopb.proto $out/share/nanopb/generator/proto/nanopb.proto
+    mv $out/${python3.sitePackages}/nanopb_pb2.py $out/share/nanopb/generator/proto
+    rm -rf $out/${python3.sitePackages}
+
+    mkdir $out/bin
+    substitute ${./protoc-gen-nanopb} $out/bin/protoc-gen-nanopb \
+      --subst-var-by python ${pythonRuntime}/bin/python \
+      --subst-var-by out $out
+    chmod +x $out/bin/protoc-gen-nanopb
+  '';
+
+  passthru.tests = {
+    simple-proto2 = callPackage ./test-simple-proto2 {};
+    simple-proto3 = callPackage ./test-simple-proto3 {};
+    message-with-annotations = callPackage ./test-message-with-annotations {};
+    message-with-options = callPackage ./test-message-with-options {};
+  };
+
+  meta = with lib; {
+    inherit (protobuf.meta) platforms;
+
+    description = "Protocol Buffers with small code size";
+    homepage = "https://jpa.kapsi.fi/nanopb/";
+    license = licenses.zlib;
+    maintainers = with maintainers; [ kalbasit ];
+
+    longDescription = ''
+      Nanopb is a small code-size Protocol Buffers implementation in ansi C. It
+      is especially suitable for use in microcontrollers, but fits any memory
+      restricted system.
+
+      - Homepage: jpa.kapsi.fi/nanopb
+      - Documentation: jpa.kapsi.fi/nanopb/docs
+      - Downloads: jpa.kapsi.fi/nanopb/download
+      - Forum: groups.google.com/forum/#!forum/nanopb
+
+      In order to use the nanopb options in your proto files, you'll need to
+      tell protoc where to find the nanopb.proto file.
+      You can do so with the --proto_path (-I) option to add the directory
+      ''${nanopb}/share/nanopb/generator/proto like so:
+
+      protoc --proto_path=. --proto_path=''${nanopb}/share/nanopb/generator/proto --plugin=protoc-gen-nanopb=''${nanopb}/bin/protoc-gen-nanopb --nanopb_out=out file.proto
+    '';
+  };
+}
diff --git a/pkgs/development/libraries/nanopb/protoc-gen-nanopb b/pkgs/development/libraries/nanopb/protoc-gen-nanopb
new file mode 100644
index 000000000000..764e6614b18a
--- /dev/null
+++ b/pkgs/development/libraries/nanopb/protoc-gen-nanopb
@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+exec @python@ @out@/share/nanopb/generator/nanopb_generator.py --protoc-plugin
diff --git a/pkgs/development/libraries/nanopb/test-message-with-annotations/default.nix b/pkgs/development/libraries/nanopb/test-message-with-annotations/default.nix
new file mode 100644
index 000000000000..618d7c521ce0
--- /dev/null
+++ b/pkgs/development/libraries/nanopb/test-message-with-annotations/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, protobuf, nanopb }:
+
+stdenv.mkDerivation {
+  name = "nanopb-test-message-with-annotations";
+  meta.timeout = 60;
+  src = ./.;
+
+  # protoc requires any .proto file to be compiled to reside within it's
+  # proto_path. By default the current directory is automatically added to the
+  # proto_path. I tried using --proto_path ${./.} ${./simple.proto} and it did
+  # not work because they end up in the store at different locations.
+  installPhase = ":";
+  buildPhase = ''
+    mkdir $out
+
+    ${protobuf}/bin/protoc --proto_path=. --proto_path=${nanopb}/share/nanopb/generator/proto --plugin=protoc-gen-nanopb=${nanopb}/bin/protoc-gen-nanopb --nanopb_out=$out withannotations.proto
+  '';
+
+  docheck = true;
+  checkphase = ''
+    grep -q WithAnnotations $out/withannotations.pb.c || (echo "error: WithAnnotations not found in $out/withannotations.pb.c"; exit 1)
+    grep -q WithAnnotations $out/withannotations.pb.h || (echo "error: WithAnnotations not found in $out/withannotations.pb.h"; exit 1)
+    grep -q "pb_byte_t uuid\[16\]" $out/withannotations.pb.h || (echo "error: uuid is not of type pb_byte_t and of size 16 in $out/withannotations.pb.h"; exit 1)
+    grep -q "FIXED_LENGTH_BYTES, uuid" $out/withannotations.pb.h || (echo "error: uuid is not of fixed lenght bytes in $out/withannotations.pb.h"; exit 1)
+    grep -q "#define WithAnnotations_size" $out/withannotations.pb.h || (echo "error: the size of WithAnnotations is not known in $out/withannotations.pb.h"; exit 1)
+  '';
+}
diff --git a/pkgs/development/libraries/nanopb/test-message-with-annotations/withannotations.proto b/pkgs/development/libraries/nanopb/test-message-with-annotations/withannotations.proto
new file mode 100644
index 000000000000..d8109e877d68
--- /dev/null
+++ b/pkgs/development/libraries/nanopb/test-message-with-annotations/withannotations.proto
@@ -0,0 +1,7 @@
+syntax = "proto3";
+
+import "nanopb.proto";
+
+message WithAnnotations {
+  bytes uuid = 1 [(nanopb).max_size = 16, (nanopb).fixed_length = true];
+}
diff --git a/pkgs/development/libraries/nanopb/test-message-with-options/default.nix b/pkgs/development/libraries/nanopb/test-message-with-options/default.nix
new file mode 100644
index 000000000000..c15b51f71977
--- /dev/null
+++ b/pkgs/development/libraries/nanopb/test-message-with-options/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, protobuf, nanopb }:
+
+stdenv.mkDerivation {
+  name = "nanopb-test-message-with-options";
+  meta.timeout = 60;
+  src = ./.;
+
+  # protoc requires any .proto file to be compiled to reside within it's
+  # proto_path. By default the current directory is automatically added to the
+  # proto_path. I tried using --proto_path ${./.} ${./simple.proto} and it did
+  # not work because they end up in the store at different locations.
+  installPhase = ":";
+  buildPhase = ''
+    mkdir $out
+
+    ${protobuf}/bin/protoc --plugin=protoc-gen-nanopb=${nanopb}/bin/protoc-gen-nanopb --nanopb_out=$out withoptions.proto
+  '';
+
+  docheck = true;
+  checkphase = ''
+    grep -q WithOptions $out/withoptions.pb.c || (echo "error: WithOptions not found in $out/withoptions.pb.c"; exit 1)
+    grep -q WithOptions $out/withoptions.pb.h || (echo "error: WithOptions not found in $out/withoptions.pb.h"; exit 1)
+    grep -q "pb_byte_t uuid\[16\]" $out/withoptions.pb.h || (echo "error: uuid is not of type pb_byte_t and of size 16 in $out/withoptions.pb.h"; exit 1)
+    grep -q "FIXED_LENGTH_BYTES, uuid" $out/withoptions.pb.h || (echo "error: uuid is not of fixed lenght bytes in $out/withoptions.pb.h"; exit 1)
+    grep -q "#define WithOptions_size" $out/withoptions.pb.h || (echo "error: the size of WithOptions is not known in $out/withoptions.pb.h"; exit 1)
+  '';
+}
diff --git a/pkgs/development/libraries/nanopb/test-message-with-options/withoptions.options b/pkgs/development/libraries/nanopb/test-message-with-options/withoptions.options
new file mode 100644
index 000000000000..ecf98a217367
--- /dev/null
+++ b/pkgs/development/libraries/nanopb/test-message-with-options/withoptions.options
@@ -0,0 +1 @@
+ WithOptions.uuid max_size:16 fixed_length:true
diff --git a/pkgs/development/libraries/nanopb/test-message-with-options/withoptions.proto b/pkgs/development/libraries/nanopb/test-message-with-options/withoptions.proto
new file mode 100644
index 000000000000..5a5da3a1c973
--- /dev/null
+++ b/pkgs/development/libraries/nanopb/test-message-with-options/withoptions.proto
@@ -0,0 +1,5 @@
+syntax = "proto3";
+
+message WithOptions {
+  bytes uuid = 1;
+}
diff --git a/pkgs/development/libraries/nanopb/test-simple-proto2/default.nix b/pkgs/development/libraries/nanopb/test-simple-proto2/default.nix
new file mode 100644
index 000000000000..a915e7785370
--- /dev/null
+++ b/pkgs/development/libraries/nanopb/test-simple-proto2/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, protobuf, nanopb }:
+
+stdenv.mkDerivation {
+  name = "nanopb-test-simple-proto2";
+  meta.timeout = 60;
+  src = ./.;
+
+  # protoc requires any .proto file to be compiled to reside within it's
+  # proto_path. By default the current directory is automatically added to the
+  # proto_path. I tried using --proto_path ${./.} ${./simple.proto} and it did
+  # not work because they end up in the store at different locations.
+  installPhase = ":";
+  buildPhase = ''
+    mkdir $out
+
+    ${protobuf}/bin/protoc --plugin=protoc-gen-nanopb=${nanopb}/bin/protoc-gen-nanopb --nanopb_out=$out simple.proto
+  '';
+
+  doCheck = true;
+  checkPhase = ''
+    grep -q SimpleMessage $out/simple.pb.c || (echo "ERROR: SimpleMessage not found in $out/simple.pb.c"; exit 1)
+    grep -q SimpleMessage $out/simple.pb.h || (echo "ERROR: SimpleMessage not found in $out/simple.pb.h"; exit 1)
+  '';
+}
diff --git a/pkgs/development/libraries/nanopb/test-simple-proto2/simple.proto b/pkgs/development/libraries/nanopb/test-simple-proto2/simple.proto
new file mode 100644
index 000000000000..b02936b1ae26
--- /dev/null
+++ b/pkgs/development/libraries/nanopb/test-simple-proto2/simple.proto
@@ -0,0 +1,5 @@
+syntax = "proto2";
+
+message SimpleMessage {
+  required int32 lucky_number = 1;
+}
diff --git a/pkgs/development/libraries/nanopb/test-simple-proto3/default.nix b/pkgs/development/libraries/nanopb/test-simple-proto3/default.nix
new file mode 100644
index 000000000000..3e2bba731b9f
--- /dev/null
+++ b/pkgs/development/libraries/nanopb/test-simple-proto3/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, protobuf, nanopb }:
+
+stdenv.mkDerivation {
+  name = "nanopb-test-simple-proto3";
+  meta.timeout = 60;
+  src = ./.;
+
+  # protoc requires any .proto file to be compiled to reside within it's
+  # proto_path. By default the current directory is automatically added to the
+  # proto_path. I tried using --proto_path ${./.} ${./simple.proto} and it did
+  # not work because they end up in the store at different locations.
+  installPhase = ":";
+  buildPhase = ''
+    mkdir $out
+
+    ${protobuf}/bin/protoc --plugin=protoc-gen-nanopb=${nanopb}/bin/protoc-gen-nanopb --nanopb_out=$out simple.proto
+  '';
+
+  doCheck = true;
+  checkPhase = ''
+    grep -q SimpleMessage $out/simple.pb.c || (echo "ERROR: SimpleMessage not found in $out/simple.pb.c"; exit 1)
+    grep -q SimpleMessage $out/simple.pb.h || (echo "ERROR: SimpleMessage not found in $out/simple.pb.h"; exit 1)
+  '';
+}
diff --git a/pkgs/development/libraries/nanopb/test-simple-proto3/simple.proto b/pkgs/development/libraries/nanopb/test-simple-proto3/simple.proto
new file mode 100644
index 000000000000..6b99cdb5daa7
--- /dev/null
+++ b/pkgs/development/libraries/nanopb/test-simple-proto3/simple.proto
@@ -0,0 +1,5 @@
+syntax = "proto3";
+
+message SimpleMessage {
+  int32 lucky_number = 1;
+}
diff --git a/pkgs/development/libraries/opendht/default.nix b/pkgs/development/libraries/opendht/default.nix
index a62138e8ccf4..c8b1205bc91b 100644
--- a/pkgs/development/libraries/opendht/default.nix
+++ b/pkgs/development/libraries/opendht/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "opendht";
-  version = "2.1.1";
+  version = "2.1.3";
 
   src = fetchFromGitHub {
     owner = "savoirfairelinux";
     repo = "opendht";
     rev = version;
-    sha256 = "10sbiwjljxi0a1q3xakmf6v02x3yf38ljvjpql70q4rqggqj9zhh";
+    sha256 = "0qz9mdkanz4vd38bdpwvcwvbpzf19i6019rmqw3k1vh5mh22ljhr";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/development/libraries/swiften/build-fix.patch b/pkgs/development/libraries/swiften/build-fix.patch
new file mode 100644
index 000000000000..01814cadfbd4
--- /dev/null
+++ b/pkgs/development/libraries/swiften/build-fix.patch
@@ -0,0 +1,32 @@
+diff -wbBur swift-4.0.2/Swift/QtUI/UserSearch/QtUserSearchWindow.h swift-4.0.2.my/Swift/QtUI/UserSearch/QtUserSearchWindow.h
+--- swift-4.0.2/Swift/QtUI/UserSearch/QtUserSearchWindow.h	2018-04-06 13:06:46.000000000 +0300
++++ swift-4.0.2.my/Swift/QtUI/UserSearch/QtUserSearchWindow.h	2019-10-08 20:52:23.171475337 +0300
+@@ -9,6 +9,7 @@
+ #include <set>
+ 
+ #include <QWizard>
++#include <QAbstractItemModel>
+ 
+ #include <Swiften/Base/Override.h>
+ 
+diff -wbBur swift-4.0.2/Swiften/Network/PlatformNATTraversalWorker.cpp swift-4.0.2.my/Swiften/Network/PlatformNATTraversalWorker.cpp
+--- swift-4.0.2/Swiften/Network/PlatformNATTraversalWorker.cpp	2018-04-06 13:06:46.000000000 +0300
++++ swift-4.0.2.my/Swiften/Network/PlatformNATTraversalWorker.cpp	2019-10-08 21:12:25.284754131 +0300
+@@ -157,7 +157,7 @@
+         miniUPnPInterface = new MiniUPnPInterface();
+         miniUPnPSupported = miniUPnPInterface->isAvailable();
+     }
+-    SWIFT_LOG(debug) << "UPnP NAT traversal supported: " << miniUPnPSupported << std::endl;
++//    SWIFT_LOG(debug) << "UPnP NAT traversal supported: " << miniUPnPSupported << std::endl;
+     if (miniUPnPSupported) {
+         return miniUPnPInterface;
+     }
+@@ -168,7 +168,7 @@
+         natPMPInterface = new NATPMPInterface();
+         natPMPSupported = natPMPInterface->isAvailable();
+     }
+-    SWIFT_LOG(debug) << "NAT-PMP NAT traversal supported: " << natPMPSupported << std::endl;
++//    SWIFT_LOG(debug) << "NAT-PMP NAT traversal supported: " << natPMPSupported << std::endl;
+     if (natPMPSupported) {
+         return natPMPInterface;
+     }
diff --git a/pkgs/development/libraries/swiften/default.nix b/pkgs/development/libraries/swiften/default.nix
index bdac55fe2ec3..19bacdd2a614 100644
--- a/pkgs/development/libraries/swiften/default.nix
+++ b/pkgs/development/libraries/swiften/default.nix
@@ -12,17 +12,21 @@ stdenv.mkDerivation rec {
     sha256 = "0w0aiszjd58ynxpacwcgf052zpmbpcym4dhci64vbfgch6wryz0w";
   };
 
-  patches = [ ./scons.patch ];
+  patches = [ ./scons.patch ./build-fix.patch ];
 
   sconsFlags = [
     "openssl=${openssl.dev}"
     "boost_includedir=${boost.dev}/include"
     "boost_libdir=${boost.out}/lib"
     "boost_bundled_enable=false"
+    "max_jobs=1"
+    "optimize=1"
+    "debug=0"
+    "swiften_dll=1"
   ];
   preInstall = ''
     installTargets="$out"
-    installFlags+=" SWIFT_INSTALLDIR=$out"
+    installFlags+=" SWIFTEN_INSTALLDIR=$out"
   '';
 
   enableParallelBuilding = true;
@@ -33,6 +37,5 @@ stdenv.mkDerivation rec {
     license     = licenses.gpl2Plus;
     platforms   = platforms.linux;
     maintainers = [ maintainers.twey ];
-    broken = true; # Broken since 2019-11-20 (https://hydra.nixos.org/build/114681755)
   };
 }
diff --git a/pkgs/development/libraries/wxwidgets/3.0/default.nix b/pkgs/development/libraries/wxwidgets/3.0/default.nix
index 8de7f99fe5fd..da29eacdc0e9 100644
--- a/pkgs/development/libraries/wxwidgets/3.0/default.nix
+++ b/pkgs/development/libraries/wxwidgets/3.0/default.nix
@@ -1,8 +1,9 @@
 { stdenv, fetchFromGitHub, fetchurl, pkgconfig
-, gtk2, gtk3, libXinerama, libSM, libXxf86vm
-, xorgproto, gstreamer, gst-plugins-base, GConf, setfile
+, libXinerama, libSM, libXxf86vm
+, gtk2, GConf ? null, gtk3
+, xorgproto, gstreamer, gst-plugins-base, setfile
 , libGLSupported ? stdenv.lib.elem stdenv.hostPlatform.system stdenv.lib.platforms.mesaPlatforms
-, withMesa ? stdenv.lib.elem stdenv.hostPlatform.system stdenv.lib.platforms.mesaPlatforms
+, withMesa ? libGLSupported
 , libGLU ? null, libGL ? null
 , compat24 ? false, compat26 ? true, unicode ? true
 , withGtk2 ? true
@@ -28,9 +29,10 @@ stdenv.mkDerivation rec {
     sha256 = "19mqglghjjqjgz4rbybn3qdgn2cz9xc511nq1pvvli9wx2k8syl1";
   };
 
-  buildInputs =
-    [ (if withGtk2 then gtk2 else gtk3) libXinerama libSM libXxf86vm xorgproto gstreamer
-      gst-plugins-base GConf ]
+  buildInputs = [
+    libXinerama libSM libXxf86vm xorgproto gstreamer gst-plugins-base
+  ] ++ optionals withGtk2 [ gtk2 GConf ]
+    ++ optional (!withGtk2) gtk3
     ++ optional withMesa libGLU
     ++ optional withWebKit webkitgtk
     ++ optionals stdenv.isDarwin [ setfile Carbon Cocoa Kernel QTKit ];
diff --git a/pkgs/development/libraries/wxwidgets/3.1/default.nix b/pkgs/development/libraries/wxwidgets/3.1/default.nix
index 99f86974cdb4..790968a88f76 100644
--- a/pkgs/development/libraries/wxwidgets/3.1/default.nix
+++ b/pkgs/development/libraries/wxwidgets/3.1/default.nix
@@ -1,6 +1,7 @@
 { stdenv, fetchFromGitHub, fetchurl, pkgconfig
-, gtk2, gtk3, libXinerama, libSM, libXxf86vm
-, xorgproto, gstreamer, gst-plugins-base, GConf, setfile
+, libXinerama, libSM, libXxf86vm
+, gtk2, GConf ? null, gtk3
+, xorgproto, gstreamer, gst-plugins-base, setfile
 , libGLSupported ? stdenv.lib.elem stdenv.hostPlatform.system stdenv.lib.platforms.mesaPlatforms
 , withMesa ? libGLSupported, libGLU ? null, libGL ? null
 , compat28 ? false, compat30 ? true, unicode ? true
@@ -27,9 +28,10 @@ stdenv.mkDerivation rec {
     sha256 = "0gfdhb7xq5vzasm7s1di39nchv42zsp0dmn4v6knzb7mgsb107wb";
   };
 
-  buildInputs =
-    [ (if withGtk2 then gtk2 else gtk3) libXinerama libSM libXxf86vm xorgproto gstreamer
-      gst-plugins-base GConf ]
+  buildInputs = [
+    libXinerama libSM libXxf86vm xorgproto gstreamer gst-plugins-base
+  ] ++ optionals withGtk2 [ gtk2 GConf ]
+    ++ optional (!withGtk2) gtk3
     ++ optional withMesa libGLU
     ++ optional withWebKit webkitgtk
     ++ optionals stdenv.isDarwin [ setfile Carbon Cocoa Kernel QTKit ];
diff --git a/pkgs/development/misc/rpiboot/unstable.nix b/pkgs/development/misc/rpiboot/unstable.nix
index 1591a1efd17a..a8f7e4795e77 100644
--- a/pkgs/development/misc/rpiboot/unstable.nix
+++ b/pkgs/development/misc/rpiboot/unstable.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, libusb1 }:
 
 let
-  version = "2018-03-27";
+  version = "2020-05-11";
   name = "rpiboot-unstable-${version}";
 in stdenv.mkDerivation {
   inherit name;
@@ -9,8 +9,8 @@ in stdenv.mkDerivation {
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "usbboot";
-    rev = "fb86716935f2e820333b037a2ff93a338ad9b695";
-    sha256 = "163g7iw7kf6ra71adx6lf1xzf3kv20bppva15ljwn54jlah5mv98";
+    rev = "c650cd747c1d0597487dcf319bf95b5ba775d78b";
+    sha256 = "17kapny79dh05vfmrniqdvz6xhpwnqnw0511ycfx4qcjh4krxh8n";
   };
 
   nativeBuildInputs = [ libusb1 ];
diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index 2f623dd0f0ef..c58944a59d72 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -3,7 +3,6 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
-, pythonAtLeast
 , attrs
 , chardet
 , multidict
@@ -14,7 +13,6 @@
 , pytestrunner
 , pytestCheckHook
 , gunicorn
-, pytest-timeout
 , async_generator
 , pytest_xdist
 , pytestcov
@@ -63,6 +61,8 @@ buildPythonPackage rec {
     "test_read_boundary_with_incomplete_chunk"
     "test_read_incomplete_chunk"
     "test_request_tracing_exception"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "test_close"
   ];
 
   # aiohttp in current folder shadows installed version
diff --git a/pkgs/development/python-modules/awkward1/default.nix b/pkgs/development/python-modules/awkward1/default.nix
index 0c2b3338690f..e3549e0a4a85 100644
--- a/pkgs/development/python-modules/awkward1/default.nix
+++ b/pkgs/development/python-modules/awkward1/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "awkward1";
-  version = "0.2.22";
+  version = "0.2.23";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c64a8ad0204743d49cf2f8775f92d9c23dd9d7eb6996a61f4a9de57a53d429f9";
+    sha256 = "d7458b499959af66e0a640e29e6b676a39cc9614cd504e5a2e8f8d0c7f546597";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/bpython/clipboard-make-which-substitutable.patch b/pkgs/development/python-modules/bpython/clipboard-make-which-substitutable.patch
new file mode 100644
index 000000000000..685d34228a1b
--- /dev/null
+++ b/pkgs/development/python-modules/bpython/clipboard-make-which-substitutable.patch
@@ -0,0 +1,27 @@
+From 6f544a5bd43446859754cb80e012af933b843db9 Mon Sep 17 00:00:00 2001
+From: Florian Klink <flokli@flokli.de>
+Date: Wed, 3 Jun 2020 22:05:34 +0200
+Subject: [PATCH] clipboard: make which substitutable
+
+This is used to detect the presence of xclip and other clipboard
+handling tools.
+---
+ bpython/clipboard.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/bpython/clipboard.py b/bpython/clipboard.py
+index aee429b..f346429 100644
+--- a/bpython/clipboard.py
++++ b/bpython/clipboard.py
+@@ -58,7 +58,7 @@ class OSXClipboard(object):
+ 
+ def command_exists(command):
+     process = subprocess.Popen(
+-        ["which", command], stderr=subprocess.STDOUT, stdout=subprocess.PIPE
++        ["@which@", command], stderr=subprocess.STDOUT, stdout=subprocess.PIPE
+     )
+     process.communicate()
+ 
+-- 
+2.26.2
+
diff --git a/pkgs/development/python-modules/bpython/default.nix b/pkgs/development/python-modules/bpython/default.nix
index 73ce843cf018..ad7322cbf661 100644
--- a/pkgs/development/python-modules/bpython/default.nix
+++ b/pkgs/development/python-modules/bpython/default.nix
@@ -1,4 +1,14 @@
-{ stdenv, buildPythonPackage, fetchPypi, pygments, greenlet, curtsies, urwid, requests, mock }:
+{ stdenv
+, buildPythonPackage
+, fetchPypi
+, curtsies
+, greenlet
+, mock
+, pygments
+, requests
+, substituteAll
+, urwid
+, which }:
 
 buildPythonPackage rec {
   pname = "bpython";
@@ -9,6 +19,11 @@ buildPythonPackage rec {
     sha256 = "1764ikgj24jjq46s50apwkydqvy5a13adb2nbszk8kbci6df0v27";
   };
 
+  patches = [ (substituteAll {
+    src = ./clipboard-make-which-substitutable.patch;
+    which = "${which}/bin/which";
+  })];
+
   propagatedBuildInputs = [ curtsies greenlet pygments requests urwid ];
 
   postInstall = ''
diff --git a/pkgs/development/python-modules/buildbot/default.nix b/pkgs/development/python-modules/buildbot/default.nix
index 2b2e703026d8..c5a12c997d9d 100644
--- a/pkgs/development/python-modules/buildbot/default.nix
+++ b/pkgs/development/python-modules/buildbot/default.nix
@@ -25,11 +25,11 @@ let
 
   package = buildPythonPackage rec {
     pname = "buildbot";
-    version = "2.8.1";
+    version = "2.8.2";
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "1nrbn8a2c56l5j0axmn9ijaviw0a6nrd34sg81r5j05mzzpb69is";
+      sha256 = "0rdrz2zkd6xaf9kb5l41xmbfzq618sz498w23irshih4c802pdv5";
     };
 
     propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/buildbot/pkg.nix b/pkgs/development/python-modules/buildbot/pkg.nix
index ebf8fb9c94e7..4bb8613afeab 100644
--- a/pkgs/development/python-modules/buildbot/pkg.nix
+++ b/pkgs/development/python-modules/buildbot/pkg.nix
@@ -6,7 +6,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "03ppmrnpyd77azylv1c673cffk6x53j9flx4i99k33bljmdy8iv4";
+    sha256 = "1yz3k6dg15q4911x8kjy396dccfgrs50mjz278l09p6zmm71llax";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/buildbot/plugins.nix b/pkgs/development/python-modules/buildbot/plugins.nix
index 302615dc469c..4c5aa374562a 100644
--- a/pkgs/development/python-modules/buildbot/plugins.nix
+++ b/pkgs/development/python-modules/buildbot/plugins.nix
@@ -7,7 +7,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "051y4z70dq0j343rb02wn3a1vkdbi8khjfib2msa80vdld3nxcyv";
+      sha256 = "19qwr0h6qavznx8rfjq6zjccyd2y7x4nc8asldvay3b44xfsr385";
     };
 
     # Remove unneccessary circular dependency on buildbot
@@ -34,7 +34,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "0chw111j2c6ybvbb09x39zg7ghjz4ysw67wbpcmzd1v5jnwbaqdi";
+      sha256 = "1wfhwmb1d32k8isk7k8525pmkfih8hlvy53zsj19l3gvjm0da9gw";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -56,7 +56,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "14v2lj65ccgmijxqrr61vpgba30q6w5vnisz78y3hbf3qpxmmd7g";
+      sha256 = "0g62v0maz3b9bmjvvjcin6ayg0f5k0n8m93zk75lagyr69g5vaka";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -78,7 +78,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "03q9am237f2r8ivqm1dfkyzm3bmns4xjn99c27ps6dw9an15f73a";
+      sha256 = "0dlq8pchgccc66gfdlssydacisia5fbwc8b4gd8f9gcbish8jmf7";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -100,7 +100,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "0wv5ghsfmhkbk96zimihcwn16rxjz1q1g5ppahb8gfrclmzhdynl";
+      sha256 = "193nni55py6yzw730yyp5va2n4313sjf6a7jmi0xs9bivvvzg5w9";
     };
 
     buildInputs = [ buildbot-pkg ];
diff --git a/pkgs/development/python-modules/buildbot/worker.nix b/pkgs/development/python-modules/buildbot/worker.nix
index 936ef661eeee..05938e43ad69 100644
--- a/pkgs/development/python-modules/buildbot/worker.nix
+++ b/pkgs/development/python-modules/buildbot/worker.nix
@@ -7,7 +7,7 @@ buildPythonPackage (rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1cba1zmm3gfw3ikax7q4vbrxnvjxlby79x5lc4fg9c3igbm0nmwj";
+    sha256 = "0p1w6ailp6xpa6ckl5prj413ilxx5s3lga5mzqxj9nn00vni8ik2";
   };
 
   propagatedBuildInputs = [ twisted future ];
diff --git a/pkgs/development/python-modules/jc/default.nix b/pkgs/development/python-modules/jc/default.nix
index e7942760b72c..e48fec89b9d7 100644
--- a/pkgs/development/python-modules/jc/default.nix
+++ b/pkgs/development/python-modules/jc/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "jc";
-  version = "1.11.2";
+  version = "1.11.6";
   disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "kellyjonbrazil";
     repo = "jc";
     rev = "v${version}";
-    sha256 = "1gsvjgypjgw5a0k85kdvbbf7q6wspmv6z76acrgnidhav8sdn4dm";
+    sha256 = "0jyygq7zmam7yriiv5j4d6mpjdi2p3p7d53bn3qwfzkh4ifsbfan";
   };
 
   propagatedBuildInputs = [ ruamel_yaml xmltodict pygments ];
diff --git a/pkgs/development/python-modules/pycurl/default.nix b/pkgs/development/python-modules/pycurl/default.nix
index 6b6aad2b2342..7531bb8f7bbc 100644
--- a/pkgs/development/python-modules/pycurl/default.nix
+++ b/pkgs/development/python-modules/pycurl/default.nix
@@ -47,7 +47,8 @@ buildPythonPackage rec {
                      and not test_libcurl_ssl_openssl" \
                  --ignore=tests/getinfo_test.py \
                  --ignore=tests/memory_mgmt_test.py \
-                 --ignore=tests/multi_memory_mgmt_test.py
+                 --ignore=tests/multi_memory_mgmt_test.py \
+                 --ignore=tests/multi_timer_test.py
   '';
 
   preConfigure = ''
diff --git a/pkgs/development/python-modules/pydantic/default.nix b/pkgs/development/python-modules/pydantic/default.nix
index ef33b6fb2bd5..371bfba2f0f9 100644
--- a/pkgs/development/python-modules/pydantic/default.nix
+++ b/pkgs/development/python-modules/pydantic/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , ujson
 , email_validator
 , typing-extensions
@@ -22,6 +23,14 @@ buildPythonPackage rec {
     sha256 = "0fwrx7p6d5vskg9ibganahiz9y9299idvdmzhjw62jy84gn1vrb4";
   };
 
+  # fix tests, remove on next version bump
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/samuelcolvin/pydantic/commit/a5b0e741e585040a0ab8b0be94dd9dc2dd3afcc7.patch";
+      sha256 = "0v91ac3dw23rm73370s2ns84vi0xqbfzpvj84zb7xdiicx8fhmf1";
+    })
+  ];
+
   propagatedBuildInputs = [
     ujson
     email_validator
diff --git a/pkgs/development/python-modules/pygdbmi/default.nix b/pkgs/development/python-modules/pygdbmi/default.nix
index 447fbdfcdc44..b3d1fb3d26df 100644
--- a/pkgs/development/python-modules/pygdbmi/default.nix
+++ b/pkgs/development/python-modules/pygdbmi/default.nix
@@ -1,4 +1,5 @@
-{ lib
+{ stdenv
+, lib
 , buildPythonPackage
 , fetchFromGitHub
 , gdb
@@ -19,6 +20,9 @@ buildPythonPackage rec {
 
   checkInputs = [ gdb ];
 
+  # tests require gcc for some reason
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
   postPatch = ''
     # tries to execute flake8,
     # which is likely to break on flake8 updates
diff --git a/pkgs/development/python-modules/python-engineio/default.nix b/pkgs/development/python-modules/python-engineio/default.nix
index 128fb8961d4d..cb3fe1a9f38d 100644
--- a/pkgs/development/python-modules/python-engineio/default.nix
+++ b/pkgs/development/python-modules/python-engineio/default.nix
@@ -47,7 +47,6 @@ buildPythonPackage rec {
     description = "Engine.IO server";
     homepage = "https://github.com/miguelgrinberg/python-engineio/";
     license = licenses.mit;
-    platforms = platforms.linux;
     maintainers = [ maintainers.mic92 ];
   };
 }
diff --git a/pkgs/development/python-modules/rope/default.nix b/pkgs/development/python-modules/rope/default.nix
index 6bcc05fb34d6..73b5e0b8c2b5 100644
--- a/pkgs/development/python-modules/rope/default.nix
+++ b/pkgs/development/python-modules/rope/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "rope";
-  version = "0.16.0";
+  version = "0.17.0";
 
   disabled = pythonAtLeast "3.8";  # 0.17 should support Python 3.8
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1zlxdrs6ww2hm41izz67h67z9dkm0rlgw8m04vygaip0q91030yj";
+    sha256 = "1qa9nqryp05ah9b4r8cy5ph31kr9cm4ak79pvzbg7p23bxqdd2k5";
   };
 
   checkInputs = [ nose ];
diff --git a/pkgs/development/tools/analysis/cpplint/default.nix b/pkgs/development/tools/analysis/cpplint/default.nix
index 577a09e8de99..61aee215031a 100644
--- a/pkgs/development/tools/analysis/cpplint/default.nix
+++ b/pkgs/development/tools/analysis/cpplint/default.nix
@@ -2,20 +2,21 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "cpplint";
-  version = "1.3.0";
+  version = "1.5.1";
 
   # Fetch from github instead of pypi, since the test cases are not in the pypi archive
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "107v7bp35kxbv9v7wl79h7115z1m4b48rhasp0cnivql1grd277i";
+    sha256 = "0k927mycj1k4l3fbxrk597bhcjl2nrpaas1imbjgk64cyq8dv7lh";
   };
 
   postPatch = ''
     patchShebangs cpplint_unittest.py
   '';
 
+  checkInputs = with python3Packages; [ pytest pytestrunner ];
   checkPhase = ''
     ./cpplint_unittest.py
   '';
diff --git a/pkgs/development/tools/build-managers/bmake/default.nix b/pkgs/development/tools/build-managers/bmake/default.nix
index 499ef7a19b31..b119b5a38105 100644
--- a/pkgs/development/tools/build-managers/bmake/default.nix
+++ b/pkgs/development/tools/build-managers/bmake/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bmake";
-  version = "20200506";
+  version = "20200606";
 
   src = fetchurl {
     url    = "http://www.crufty.net/ftp/pub/sjg/${pname}-${version}.tar.gz";
-    sha256 = "1qiq6lvlg2hqiq03slv4vzv3bn4cr3w95r3i6m5fa4hgn2dkrhqa";
+    sha256 = "00kh1g8z6808ylbfcn9afpb0xmb99k302dfdsmyx1rsn65xs58v7";
   };
 
   nativeBuildInputs = [ getopt ];
diff --git a/pkgs/development/tools/misc/cquery/default.nix b/pkgs/development/tools/misc/cquery/default.nix
deleted file mode 100644
index 33a8bf1df61d..000000000000
--- a/pkgs/development/tools/misc/cquery/default.nix
+++ /dev/null
@@ -1,64 +0,0 @@
-{ fetchFromGitHub, makeWrapper
-, cmake, llvmPackages, ncurses
-, runtimeShell }:
-
-let
-  src = fetchFromGitHub {
-    owner = "cquery-project";
-    repo = "cquery";
-    rev = "a95a6503d68a85baa25465ce147b7fc20f4a552e";
-    sha256 = "0rxbdln7dqkdw4q8rhclssgwypq16g9flkwmaabsr8knckbszxrx";
-    fetchSubmodules = true;
-  };
-
-  stdenv = llvmPackages.stdenv;
-
-in
-stdenv.mkDerivation {
-  pname = "cquery";
-  version = "2018-10-14";
-
-  inherit src;
-
-  nativeBuildInputs = [ cmake makeWrapper ];
-  buildInputs = with llvmPackages; [ clang clang-unwrapped llvm ncurses ];
-
-  cmakeFlags = [
-    "-DSYSTEM_CLANG=ON"
-    "-DCLANG_CXX=ON"
-  ];
-
-  shell = runtimeShell;
-  postFixup = ''
-    # We need to tell cquery where to find the standard library headers.
-
-    standard_library_includes="\\\"-isystem\\\", \\\"${stdenv.lib.getDev stdenv.cc.libc}/include\\\""
-    standard_library_includes+=", \\\"-isystem\\\", \\\"${llvmPackages.libcxx}/include/c++/v1\\\""
-    export standard_library_includes
-
-    wrapped=".cquery-wrapped"
-    export wrapped
-
-    mv $out/bin/cquery $out/bin/$wrapped
-    substituteAll ${./wrapper} $out/bin/cquery
-    chmod --reference=$out/bin/$wrapped $out/bin/cquery
-  '';
-
-  doInstallCheck = true;
-  installCheckPhase = ''
-    pushd ${src}
-    $out/bin/cquery --ci --test-unit
-
-    # The integration tests have to be disabled because cquery ignores `--init`
-    # if they are invoked, which means it won't find the system includes.
-    #$out/bin/cquery --ci --test-index
-  '';
-
-  meta = with stdenv.lib; {
-    description = "A c/c++ language server powered by libclang";
-    homepage    = "https://github.com/cquery-project/cquery";
-    license     = licenses.mit;
-    platforms   = platforms.linux ++ platforms.darwin;
-    maintainers = [ maintainers.tobim ];
-  };
-}
diff --git a/pkgs/development/tools/misc/cquery/wrapper b/pkgs/development/tools/misc/cquery/wrapper
deleted file mode 100644
index 8b3e57290429..000000000000
--- a/pkgs/development/tools/misc/cquery/wrapper
+++ /dev/null
@@ -1,12 +0,0 @@
-#! @shell@ -e
-
-initString="--init={\"cacheDirectory\": \"/tmp/cquery\", \"extraClangArguments\": [@standard_library_includes@"
-
-if [ "${NIX_CFLAGS_COMPILE}" != "" ]; then
-  read -a cflags_array <<< ${NIX_CFLAGS_COMPILE}
-  initString+=$(printf ', \"%s\"' "${cflags_array[@]}")
-fi
-
-initString+="]}"
-
-exec -a "$0" "@out@/bin/@wrapped@" "${initString}" "$@"
diff --git a/pkgs/development/tools/out-of-tree/default.nix b/pkgs/development/tools/out-of-tree/default.nix
index d46696a32af9..ff5a3ec1b54f 100644
--- a/pkgs/development/tools/out-of-tree/default.nix
+++ b/pkgs/development/tools/out-of-tree/default.nix
@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "out-of-tree";
-  version = "1.3.0";
+  version = "1.4.0";
 
   buildInputs = [ makeWrapper ];
 
   src = fetchgit {
     rev = "refs/tags/v${version}";
     url = "https://code.dumpstack.io/tools/${pname}.git";
-    sha256 = "02xh23nbwyyf087jqkm97jbnwpja1myaz190q5r166mpwcdpz2dn";
+    sha256 = "1rn824l3dzh3xjxsbzzj053qg1abhzjimc8l73r0n5qrl44k2qk2";
   };
 
-  vendorSha256 = "1dk0cipdgj2yyg1bc9l7nvy4y373pmqwy8xiyc0wg7pchb4h9p7s";
+  vendorSha256 = "0kg5c4h7xnwfcfshrh5n76xv98wzr73kxzr8q65iphsjimbxcpy3";
 
   postFixup = ''
     wrapProgram $out/bin/out-of-tree \
diff --git a/pkgs/development/web/deno/default.nix b/pkgs/development/web/deno/default.nix
index 28e438fa1e95..199d7f81fe0f 100644
--- a/pkgs/development/web/deno/default.nix
+++ b/pkgs/development/web/deno/default.nix
@@ -18,16 +18,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "deno";
-  version = "1.0.5";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1hlmgcppr01bddvp28js010hhlzyx2lm7g7lq9nrcjazfw7kd2pf";
+    sha256 = "11rxfnjam1kr8piiw0s4r0qg8rj4qfpppp6dixk1hhsq2iwbnzj6";
     fetchSubmodules = true;
   };
-  cargoSha256 = "1jqaryr7np6h65a1bqr952h0vllsvd6v6v6wvivc7933dcbhdal4";
+  cargoSha256 = "107i9zvlwiwad58c7lmh6zl9iwlqn1h8qk7zf7x68b6498p8nh7d";
 
   # Install completions post-install
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/development/web/deno/update/update.ts b/pkgs/development/web/deno/update/update.ts
index ab13cee9dbe2..18d451480137 100755
--- a/pkgs/development/web/deno/update/update.ts
+++ b/pkgs/development/web/deno/update/update.ts
@@ -1,6 +1,6 @@
 #!/usr/bin/env nix-shell
 /*
-#!nix-shell -i "deno run --allow-net --allow-run --allow-read --allow-write" -p deno git nix-prefetch nix-prefetch-url
+#!nix-shell -i "deno run --allow-net --allow-run --allow-read --allow-write" -p deno git nix-prefetch
 */
 import {
   commit,
diff --git a/pkgs/games/easyrpg-player/default.nix b/pkgs/games/easyrpg-player/default.nix
index 1a540c6489c6..79628d0d2ae9 100644
--- a/pkgs/games/easyrpg-player/default.nix
+++ b/pkgs/games/easyrpg-player/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "easyrpg-player";
-  version = "0.6.2";
+  version = "0.6.2.1";
 
   src = fetchFromGitHub {
     owner = "EasyRPG";
     repo = "Player";
     rev = version;
-    sha256 = "1xjisqxmx1jc1afsr55hyr0l9v20gvchllby76pygkfkgifyidyp";
+    sha256 = "19wpjvlkjmjhdv1dbph6i2da1xx479zhr532x0ili1aphw1j9hi6";
   };
 
   nativeBuildInputs = [ cmake doxygen pkgconfig ];
diff --git a/pkgs/games/katago/default.nix b/pkgs/games/katago/default.nix
index 0a9ebd9e3eb4..fd4303eb2b1d 100644
--- a/pkgs/games/katago/default.nix
+++ b/pkgs/games/katago/default.nix
@@ -35,13 +35,13 @@ let
 
 in env.mkDerivation rec {
   pname = "katago";
-  version = "1.4.2";
+  version = "1.4.4";
 
   src = fetchFromGitHub {
     owner = "lightvector";
     repo = "katago";
     rev = "v${version}";
-    sha256 = "0qdc9hgbzd175b2xkjs62dy6gyybcn9lf1mifiyhjbzjpgv192h4";
+    sha256 = "14xs2bm8sky9cdsjdahjqs82q6blzcw05f5d9r1h171dm1hcx566";
   };
 
   # To workaround CMake 3.17.0's new buggy behavior wrt CUDA Compiler testing
diff --git a/pkgs/games/openmw/default.nix b/pkgs/games/openmw/default.nix
index cae97dc42158..22f3ea8d6ad3 100644
--- a/pkgs/games/openmw/default.nix
+++ b/pkgs/games/openmw/default.nix
@@ -6,19 +6,19 @@ let
     src = fetchFromGitHub {
       owner = "OpenMW";
       repo = "osg";
-      rev = "2b4c8e37268e595b82da4b9aadd5507852569b87";
-      sha256 = "0admnllxic6dcpic0h100927yw766ab55dix002vvdx36i6994jb";
+      rev = "1556cd7966ebc1c80b6626988d2b25fb43a744cf";
+      sha256 = "0d74hijzmj82nx3jkv5qmr3pkgvplra0b8fbjx1y3vmzxamb0axd";
     };
   });
 in mkDerivationWith stdenv.mkDerivation rec {
-  version = "0.45.0";
+  version = "0.46.0";
   pname = "openmw";
 
   src = fetchFromGitHub {
     owner = "OpenMW";
     repo = "openmw";
     rev = "${pname}-${version}";
-    sha256 = "1r87zrsnza2v9brksh809zzqj6zhk5xj15qs8iq11v1bscm2a2j4";
+    sha256 = "0rm32zsmxvr6b0jjihfj543skhicbw5kg6shjx312clhlm035w2x";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/misc/drivers/hplip/default.nix b/pkgs/misc/drivers/hplip/default.nix
index 7c9eb35b9af4..2ecd163fbf24 100644
--- a/pkgs/misc/drivers/hplip/default.nix
+++ b/pkgs/misc/drivers/hplip/default.nix
@@ -14,16 +14,16 @@
 let
 
   name = "hplip-${version}";
-  version = "3.20.3";
+  version = "3.20.5";
 
   src = fetchurl {
     url = "mirror://sourceforge/hplip/${name}.tar.gz";
-    sha256 = "0sh6cg7yjc11x1cm4477iaslj9n8ksghs85hqwgfbk7m5b2pw2a1";
+    sha256 = "004bbd78487b7803cdcf2a96b00de938797227068c4de43ee7ad7d174c4e475a";
   };
 
   plugin = fetchurl {
     url = "https://developers.hp.com/sites/default/files/${name}-plugin.run";
-    sha256 = "13xyv30jqjysfk7gh0gyn7qj0pb0qvk2rlbhm85a3lw7bjycal8g";
+    sha256 = "ff3dedda3158be64b985efbf636890ddda5b271ae1f1fbd788219e1344a9c2e7";
   };
 
   hplipState = substituteAll {
diff --git a/pkgs/os-specific/linux/firmware/fwupd/default.nix b/pkgs/os-specific/linux/firmware/fwupd/default.nix
index 87a37feb1cc8..af9237d1d833 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -51,6 +51,7 @@
 , flashrom
 , tpm2-tools
 , nixosTests
+, runCommand
 }:
 
 let
@@ -83,203 +84,232 @@ let
   # Experimental
   haveFlashrom = false;
 
-in
+  runPythonCommand = name: buildCommandPython: runCommand name {
+    nativeBuildInputs = [ python3 ];
+      inherit buildCommandPython;
+  } ''
+    exec python3 -c "$buildCommandPython"
+  '';
 
-stdenv.mkDerivation rec {
-  pname = "fwupd";
-  version = "1.4.2";
+  self = stdenv.mkDerivation rec {
+    pname = "fwupd";
+    version = "1.4.4";
 
-  src = fetchurl {
-    url = "https://people.freedesktop.org/~hughsient/releases/fwupd-${version}.tar.xz";
-    sha256 = "1wch1n0z89ymfxx7ganiab4h64rdxr54rcg37n5nshw35bc3f390";
-  };
+    src = fetchurl {
+      url = "https://people.freedesktop.org/~hughsient/releases/fwupd-${version}.tar.xz";
+      sha256 = "03yn96kxs53vxcbza17y99rdhbjlybv44gkc90vaj6301grxahnp";
+    };
 
-  # libfwupd goes to lib
-  # daemon, plug-ins and libfwupdplugin go to out
-  # CLI programs go to out
-  outputs = [ "out" "lib" "dev" "devdoc" "man" "installedTests" ];
-
-  nativeBuildInputs = [
-    meson
-    ninja
-    gtk-doc
-    pkgconfig
-    gobject-introspection
-    intltool
-    shared-mime-info
-    valgrind
-    gcab
-    docbook_xml_dtd_43
-    docbook_xsl
-    help2man
-    libxslt
-    python
-    wrapGAppsHook
-    vala
-  ];
-
-  buildInputs = [
-    polkit
-    libxmlb
-    gusb
-    sqlite
-    libarchive
-    libsoup
-    elfutils
-    gnu-efi
-    libyaml
-    libgudev
-    colord
-    libjcat
-    libuuid
-    glib-networking
-    json-glib
-    umockdev
-    bash-completion
-    cairo
-    freetype
-    fontconfig
-    pango
-    tpm2-tss
-    efivar
-  ] ++ stdenv.lib.optionals haveDell [
-    libsmbios
-  ];
-
-  patches = [
-    ./fix-paths.patch
-    ./add-option-for-installation-sysconfdir.patch
-
-    # Install plug-ins and libfwupdplugin to out,
-    # they are not really part of the library.
-    ./install-fwupdplugin-to-out.patch
-
-    # Installed tests are installed to different output
-    # we also cannot have fwupd-tests.conf in $out/etc since it would form a cycle.
-    (substituteAll {
-      src = ./installed-tests-path.patch;
-      # Needs a different set of modules than po/make-images.
-      inherit installedTestsPython;
-    })
-  ];
-
-  postPatch = ''
-    patchShebangs \
-      contrib/get-version.py \
-      contrib/generate-version-script.py \
-      meson_post_install.sh \
-      po/make-images \
-      po/make-images.sh \
-      po/test-deps
-  '';
+    # libfwupd goes to lib
+    # daemon, plug-ins and libfwupdplugin go to out
+    # CLI programs go to out
+    outputs = [ "out" "lib" "dev" "devdoc" "man" "installedTests" ];
 
-  # /etc/os-release not available in sandbox
-  # doCheck = true;
-
-  preFixup = let
-    binPath = [
-      efibootmgr
-      bubblewrap
-      tpm2-tools
-    ] ++ stdenv.lib.optional haveFlashrom flashrom;
-  in ''
-    gappsWrapperArgs+=(
-      --prefix XDG_DATA_DIRS : "${shared-mime-info}/share"
-      # See programs reached with fu_common_find_program_in_path in source
-      --prefix PATH : "${stdenv.lib.makeBinPath binPath}"
-    )
-  '';
+    nativeBuildInputs = [
+      meson
+      ninja
+      gtk-doc
+      pkgconfig
+      gobject-introspection
+      intltool
+      shared-mime-info
+      valgrind
+      gcab
+      docbook_xml_dtd_43
+      docbook_xsl
+      help2man
+      libxslt
+      python
+      wrapGAppsHook
+      vala
+    ];
 
-  mesonFlags = [
-    "-Dgtkdoc=true"
-    "-Dplugin_dummy=true"
-    "-Dudevdir=lib/udev"
-    "-Dsystemd_root_prefix=${placeholder "out"}"
-    "-Dinstalled_test_prefix=${placeholder "installedTests"}"
-    "-Defi-libdir=${gnu-efi}/lib"
-    "-Defi-ldsdir=${gnu-efi}/lib"
-    "-Defi-includedir=${gnu-efi}/include/efi"
-    "--localstatedir=/var"
-    "--sysconfdir=/etc"
-    "-Dsysconfdir_install=${placeholder "out"}/etc"
-
-    # We do not want to place the daemon into lib (cyclic reference)
-    "--libexecdir=${placeholder "out"}/libexec"
-    # Our builder only adds $lib/lib to rpath but some things link
-    # against libfwupdplugin which is in $out/lib.
-    "-Dc_link_args=-Wl,-rpath,${placeholder "out"}/lib"
-  ] ++ stdenv.lib.optionals (!haveDell) [
-    "-Dplugin_dell=false"
-    "-Dplugin_synaptics=false"
-  ] ++ stdenv.lib.optionals (!haveRedfish) [
-    "-Dplugin_redfish=false"
-  ] ++ stdenv.lib.optionals haveFlashrom [
-    "-Dplugin_flashrom=true"
-  ];
-
-  FONTCONFIG_FILE = fontsConf; # Fontconfig error: Cannot load default config file
-
-  # error: “PolicyKit files are missing”
-  # https://github.com/NixOS/nixpkgs/pull/67625#issuecomment-525788428
-  PKG_CONFIG_POLKIT_GOBJECT_1_ACTIONDIR = "/run/current-system/sw/share/polkit-1/actions";
-
-  # TODO: wrapGAppsHook wraps efi capsule even though it is not elf
-  dontWrapGApps = true;
-
-  preCheck = ''
-    addToSearchPath XDG_DATA_DIRS "${shared-mime-info}/share"
-  '';
+    buildInputs = [
+      polkit
+      libxmlb
+      gusb
+      sqlite
+      libarchive
+      libsoup
+      elfutils
+      gnu-efi
+      libyaml
+      libgudev
+      colord
+      libjcat
+      libuuid
+      glib-networking
+      json-glib
+      umockdev
+      bash-completion
+      cairo
+      freetype
+      fontconfig
+      pango
+      tpm2-tss
+      efivar
+    ] ++ stdenv.lib.optionals haveDell [
+      libsmbios
+    ];
 
-  # so we need to wrap the executables manually
-  postFixup = ''
-    find -L "$out/bin" "$out/libexec" -type f -executable -print0 \
-      | while IFS= read -r -d ''' file; do
-      if [[ "$file" != *.efi ]]; then
-        echo "Wrapping program $file"
-        wrapGApp "$file"
-      fi
-    done
-  '';
+    patches = [
+      ./fix-paths.patch
+      ./add-option-for-installation-sysconfdir.patch
 
-  # /etc/fwupd/uefi.conf is created by the services.hardware.fwupd NixOS module
-  passthru = {
-    filesInstalledToEtc = [
-      "fwupd/ata.conf"
-      # "fwupd/daemon.conf" # already created by the module
-      "fwupd/redfish.conf"
-      "fwupd/remotes.d/lvfs-testing.conf"
-      "fwupd/remotes.d/lvfs.conf"
-      "fwupd/remotes.d/vendor.conf"
-      "fwupd/remotes.d/vendor-directory.conf"
-      "fwupd/thunderbolt.conf"
-      "fwupd/upower.conf"
-      # "fwupd/uefi.conf" # already created by the module
-      "pki/fwupd/GPG-KEY-Hughski-Limited"
-      "pki/fwupd/GPG-KEY-Linux-Foundation-Firmware"
-      "pki/fwupd/GPG-KEY-Linux-Vendor-Firmware-Service"
-      "pki/fwupd/LVFS-CA.pem"
-      "pki/fwupd-metadata/GPG-KEY-Linux-Foundation-Metadata"
-      "pki/fwupd-metadata/GPG-KEY-Linux-Vendor-Firmware-Service"
-      "pki/fwupd-metadata/LVFS-CA.pem"
-    ] ++ stdenv.lib.optionals haveDell [
-      "fwupd/remotes.d/dell-esrt.conf"
+      # Install plug-ins and libfwupdplugin to out,
+      # they are not really part of the library.
+      ./install-fwupdplugin-to-out.patch
+
+      # Installed tests are installed to different output
+      # we also cannot have fwupd-tests.conf in $out/etc since it would form a cycle.
+      (substituteAll {
+        src = ./installed-tests-path.patch;
+        # Needs a different set of modules than po/make-images.
+        inherit installedTestsPython;
+      })
     ];
 
-    # BlacklistPlugins key in fwupd/daemon.conf
-    defaultBlacklistedPlugins = [
-      "test"
-      "invalid"
+    postPatch = ''
+      patchShebangs \
+        contrib/get-version.py \
+        contrib/generate-version-script.py \
+        meson_post_install.sh \
+        po/make-images \
+        po/make-images.sh \
+        po/test-deps
+    '';
+
+    # /etc/os-release not available in sandbox
+    # doCheck = true;
+
+    preFixup = let
+      binPath = [
+        efibootmgr
+        bubblewrap
+        tpm2-tools
+      ] ++ stdenv.lib.optional haveFlashrom flashrom;
+    in ''
+      gappsWrapperArgs+=(
+        --prefix XDG_DATA_DIRS : "${shared-mime-info}/share"
+        # See programs reached with fu_common_find_program_in_path in source
+        --prefix PATH : "${stdenv.lib.makeBinPath binPath}"
+      )
+    '';
+
+    mesonFlags = [
+      "-Dgtkdoc=true"
+      "-Dplugin_dummy=true"
+      "-Dudevdir=lib/udev"
+      "-Dsystemd_root_prefix=${placeholder "out"}"
+      "-Dinstalled_test_prefix=${placeholder "installedTests"}"
+      "-Defi-libdir=${gnu-efi}/lib"
+      "-Defi-ldsdir=${gnu-efi}/lib"
+      "-Defi-includedir=${gnu-efi}/include/efi"
+      "--localstatedir=/var"
+      "--sysconfdir=/etc"
+      "-Dsysconfdir_install=${placeholder "out"}/etc"
+
+      # We do not want to place the daemon into lib (cyclic reference)
+      "--libexecdir=${placeholder "out"}/libexec"
+      # Our builder only adds $lib/lib to rpath but some things link
+      # against libfwupdplugin which is in $out/lib.
+      "-Dc_link_args=-Wl,-rpath,${placeholder "out"}/lib"
+    ] ++ stdenv.lib.optionals (!haveDell) [
+      "-Dplugin_dell=false"
+      "-Dplugin_synaptics=false"
+    ] ++ stdenv.lib.optionals (!haveRedfish) [
+      "-Dplugin_redfish=false"
+    ] ++ stdenv.lib.optionals haveFlashrom [
+      "-Dplugin_flashrom=true"
     ];
 
-    tests = {
-      installedTests = nixosTests.installed-tests.fwupd;
+    FONTCONFIG_FILE = fontsConf; # Fontconfig error: Cannot load default config file
+
+    # error: “PolicyKit files are missing”
+    # https://github.com/NixOS/nixpkgs/pull/67625#issuecomment-525788428
+    PKG_CONFIG_POLKIT_GOBJECT_1_ACTIONDIR = "/run/current-system/sw/share/polkit-1/actions";
+
+    # TODO: wrapGAppsHook wraps efi capsule even though it is not elf
+    dontWrapGApps = true;
+
+    preCheck = ''
+      addToSearchPath XDG_DATA_DIRS "${shared-mime-info}/share"
+    '';
+
+    # so we need to wrap the executables manually
+    postFixup = ''
+      find -L "$out/bin" "$out/libexec" -type f -executable -print0 \
+        | while IFS= read -r -d ''' file; do
+        if [[ "$file" != *.efi ]]; then
+          echo "Wrapping program $file"
+          wrapGApp "$file"
+        fi
+      done
+    '';
+
+    passthru = {
+      filesInstalledToEtc = [
+        "fwupd/ata.conf"
+        "fwupd/daemon.conf"
+        "fwupd/redfish.conf"
+        "fwupd/remotes.d/lvfs-testing.conf"
+        "fwupd/remotes.d/lvfs.conf"
+        "fwupd/remotes.d/vendor.conf"
+        "fwupd/remotes.d/vendor-directory.conf"
+        "fwupd/thunderbolt.conf"
+        "fwupd/upower.conf"
+        "fwupd/uefi.conf"
+        "pki/fwupd/GPG-KEY-Hughski-Limited"
+        "pki/fwupd/GPG-KEY-Linux-Foundation-Firmware"
+        "pki/fwupd/GPG-KEY-Linux-Vendor-Firmware-Service"
+        "pki/fwupd/LVFS-CA.pem"
+        "pki/fwupd-metadata/GPG-KEY-Linux-Foundation-Metadata"
+        "pki/fwupd-metadata/GPG-KEY-Linux-Vendor-Firmware-Service"
+        "pki/fwupd-metadata/LVFS-CA.pem"
+      ] ++ stdenv.lib.optionals haveDell [
+        "fwupd/remotes.d/dell-esrt.conf"
+      ];
+
+      # BlacklistPlugins key in fwupd/daemon.conf
+      defaultBlacklistedPlugins = [
+        "test"
+        "invalid"
+      ];
+
+      tests = let
+        listToPy = list: "[${stdenv.lib.concatMapStringsSep ", " (f: "'${f}'") list}]";
+      in {
+        installedTests = nixosTests.installed-tests.fwupd;
+
+        passthruMatches = runPythonCommand "fwupd-test-passthru-matches" ''
+          import itertools
+          import configparser
+          import os
+          import pathlib
+
+          etc = '${self}/etc'
+          package_etc = set(itertools.chain.from_iterable([[os.path.relpath(os.path.join(prefix, file), etc) for file in files] for (prefix, dirs, files) in os.walk(etc)]))
+          passthru_etc = set(${listToPy passthru.filesInstalledToEtc})
+          assert len(package_etc - passthru_etc) == 0, f'fwupd package contains the following paths in /etc that are not listed in passthru.filesInstalledToEtc: {package_etc - passthru_etc}'
+          assert len(passthru_etc - package_etc) == 0, f'fwupd package lists the following paths in passthru.filesInstalledToEtc that are not contained in /etc: {passthru_etc - package_etc}'
+
+          config = configparser.RawConfigParser()
+          config.read('${self}/etc/fwupd/daemon.conf')
+          package_blacklisted_plugins = config.get('fwupd', 'BlacklistPlugins').rstrip(';').split(';')
+          passthru_blacklisted_plugins = ${listToPy passthru.defaultBlacklistedPlugins}
+          assert package_blacklisted_plugins == passthru_blacklisted_plugins, f'Default blacklisted plug-ins in the package {package_blacklisted_plugins} do not match those listed in passthru.defaultBlacklistedPlugins {passthru_blacklisted_plugins}'
+
+          pathlib.Path(os.getenv('out')).touch()
+        '';
+      };
     };
-  };
 
-  meta = with stdenv.lib; {
-    homepage = "https://fwupd.org/";
-    maintainers = with maintainers; [ jtojnar ];
-    license = [ licenses.gpl2 ];
-    platforms = platforms.linux;
+    meta = with stdenv.lib; {
+      homepage = "https://fwupd.org/";
+      maintainers = with maintainers; [ jtojnar ];
+      license = [ licenses.gpl2 ];
+      platforms = platforms.linux;
+    };
   };
-}
+
+in self
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
index bd9c58d33c9c..77a284446366 100644
--- a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "raspberrypi-firmware";
-  version = "1.20190925";
+  version = "1.20200601";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "firmware";
     rev = version;
-    sha256 = "0xyj3f04dcfnl9hp8hakgwcb1msqh7934n0pclcmzy47xjkz7ris";
+    sha256 = "1vm038f9digwg8gdxl2bypzlip3ycjb6bl56274gh5i9abl6wjvf";
   };
 
   installPhase = ''
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi/tools-dont-install-sysv-init-scripts.patch b/pkgs/os-specific/linux/firmware/raspberrypi/tools-dont-install-sysv-init-scripts.patch
deleted file mode 100644
index e12aeeb0cdb8..000000000000
--- a/pkgs/os-specific/linux/firmware/raspberrypi/tools-dont-install-sysv-init-scripts.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-diff --git a/interface/vmcs_host/linux/vcfiled/CMakeLists.txt b/interface/vmcs_host/linux/vcfiled/CMakeLists.txt
-index aed0e83..b325676 100644
---- a/interface/vmcs_host/linux/vcfiled/CMakeLists.txt
-+++ b/interface/vmcs_host/linux/vcfiled/CMakeLists.txt
-@@ -17,15 +17,6 @@ target_link_libraries(vcfiled
- install(TARGETS vcfiled 
-         RUNTIME DESTINATION sbin)
- 
--configure_file (etc/init.d/vcfiled ${PROJECT_BINARY_DIR}/etc/init.d/vcfiled)
--
--# script to start up vcfiled at start of day
--install(PROGRAMS ${PROJECT_BINARY_DIR}/etc/init.d/vcfiled
--        DESTINATION /etc/init.d)
--# install locally to the installation directory too
--install(PROGRAMS ${PROJECT_BINARY_DIR}/etc/init.d/vcfiled
--        DESTINATION ${VMCS_INSTALL_PREFIX}/share/install)
--
- # test program for vcfiled_check library
- add_executable(vcfiled_lock_test vcfiled_lock_test.c)
- target_link_libraries(vcfiled_lock_test vcfiled_check)
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi/tools.nix b/pkgs/os-specific/linux/firmware/raspberrypi/tools.nix
index e3fa90ac388d..6c4d49e4e240 100644
--- a/pkgs/os-specific/linux/firmware/raspberrypi/tools.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi/tools.nix
@@ -2,17 +2,15 @@
 
 stdenv.mkDerivation {
   pname = "raspberrypi-tools";
-  version = "2018-10-03";
+  version = "2020-05-28";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "userland";
-    rev = "de4a7f2e3c391e2d3bc76af31864270e7802d9ac";
-    sha256 = "0w96xa98ngdk9m6wv185w8waa7wm2hkn2bhxz52zd477hchzrxlg";
+    rev = "f97b1af1b3e653f9da2c1a3643479bfd469e3b74";
+    sha256 = "1r7n05rv96hqjq0rn0qzchmfqs0j7vh3p8jalgh66s6l0vms5mwy";
   };
 
-  patches = [ ./tools-dont-install-sysv-init-scripts.patch ];
-
   nativeBuildInputs = [ cmake pkgconfig ];
 
   preConfigure = ''
diff --git a/pkgs/os-specific/linux/firmware/sof-firmware/default.nix b/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
index 73ab46b3c8a6..a9fc44e48cc8 100644
--- a/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
@@ -1,28 +1,33 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchFromGitHub }:
 
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "sof-firmware";
-  version = "1.4.2";
+  version = "1.5.1";
 
-  src = fetchurl {
-    url = "https://www.alsa-project.org/files/pub/misc/sof/${pname}-${version}.tar.bz2";
-    sha256 = "1nkh020gjm45vxd6fvmz63hj16ilff2nl5avvsklajjs6xci1sf5";
+  src = fetchFromGitHub {
+    owner = "thesofproject";
+    repo = "sof-bin";
+    rev = "ae61d2778b0a0f47461a52da0d1f191f651e0763";
+    sha256 = "0j6bpwz49skvdvian46valjw4anwlrnkq703n0snkbngmq78prba";
   };
 
   phases = [ "unpackPhase" "installPhase" ];
 
   installPhase = ''
-    rm lib/firmware/intel/{sof/LICENCE,sof-tplg/LICENCE}
-    mkdir $out
-    cp -r lib $out/lib
+    mkdir -p $out/lib/firmware/intel
+
+    sed -i 's/ROOT=.*$/ROOT=$out/g' go.sh
+    sed -i 's/VERSION=.*$/VERSION=v${version}/g' go.sh
+
+    ./go.sh
   '';
 
   meta = with stdenv.lib; {
     description = "Sound Open Firmware";
     homepage = "https://www.sofproject.org/";
     license = with licenses; [ bsd3 isc ];
-    maintainers = with maintainers; [ lblasc ];
+    maintainers = with maintainers; [ lblasc evenbrenden ];
     platforms = with platforms; linux;
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 1cec678d1534..36fb39fd1308 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -206,8 +206,8 @@ let
       B43_PHY_HT            = option yes;
       BCMA_HOST_PCI         = option yes;
       RTW88                 = whenAtLeast "5.2" module;
-      RTW88_8822BE          = whenAtLeast "5.2" yes;
-      RTW88_8822CE          = whenAtLeast "5.2" yes;
+      RTW88_8822BE          = mkMerge [ (whenBetween "5.2" "5.8" yes) (whenAtLeast "5.8" module) ];
+      RTW88_8822CE          = mkMerge [ (whenBetween "5.2" "5.8" yes) (whenAtLeast "5.8" module) ];
     };
 
     fb = {
diff --git a/pkgs/os-specific/linux/kernel/linux-rpi.nix b/pkgs/os-specific/linux/kernel/linux-rpi.nix
index 31a2cc2aa157..a3d2bfd4836c 100644
--- a/pkgs/os-specific/linux/kernel/linux-rpi.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rpi.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, buildPackages, fetchFromGitHub, perl, buildLinux, rpiVersion, ... } @ args:
 
 let
-  modDirVersion = "4.19.75";
-  tag = "1.20190925";
+  modDirVersion = "4.19.118";
+  tag = "1.20200601";
 in
 lib.overrideDerivation (buildLinux (args // {
   version = "${modDirVersion}-${tag}";
@@ -12,7 +12,7 @@ lib.overrideDerivation (buildLinux (args // {
     owner = "raspberrypi";
     repo = "linux";
     rev = "raspberrypi-kernel_${tag}-1";
-    sha256 = "0l91kb4jjxg4fcp7d2aqm1fj34ns137rys93k907mdgnarcliafs";
+    sha256 = "11jzsmnd1qry2ir9vmsv0nfdzjpgkn5yab5ylxcz406plc073anp";
   };
 
   defconfig = {
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index f2f0fac3b7dd..2a7a1fa93425 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,15 +3,15 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.7-rc6";
-  extraMeta.branch = "5.7";
+  version = "5.8-rc1";
+  extraMeta.branch = "5.1";
 
   # modDirVersion needs to be x.y.z, will always add .0
   modDirVersion = if (modDirVersionArg == null) then builtins.replaceStrings ["-"] [".0-"] version else modDirVersionArg;
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "0g04zwdxks7pa5q6shl5xl2rml1w95rxq7sqkkadj11mpk2k89w4";
+    sha256 = "1gb7g2vrgg0zz281lv1ir1r0535spc40j65p0azmdxlk24fkfxfc";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/servers/blockbook/default.nix b/pkgs/servers/blockbook/default.nix
index 627ac42efd20..4afabb858c38 100644
--- a/pkgs/servers/blockbook/default.nix
+++ b/pkgs/servers/blockbook/default.nix
@@ -14,14 +14,14 @@
 
 buildGoModule rec {
   pname = "blockbook";
-  version = "0.3.3";
-  commit = "b6961ca";
+  version = "0.3.4";
+  commit = "eb4e10a";
 
   src = fetchFromGitHub {
     owner = "trezor";
     repo = "blockbook";
     rev = "v${version}";
-    sha256 = "01nb4if2dix2h95xvqvafil325jjw2a4v1izb9mad0cjqcf8rk6n";
+    sha256 = "0da1kav5x2xcmwvdgfk1q70l1k0sqqj3njgx2xx885d40m6qbnrs";
   };
 
   vendorSha256 = "1qjlvhizl8cy06cgf4phia70bgbm4lj57z5z2gyr8aglx98bnpdn";
diff --git a/pkgs/servers/dns/bind/default.nix b/pkgs/servers/dns/bind/default.nix
index a7581ccbb119..2aae5634cc5e 100644
--- a/pkgs/servers/dns/bind/default.nix
+++ b/pkgs/servers/dns/bind/default.nix
@@ -54,7 +54,8 @@ stdenv.mkDerivation rec {
     "--without-eddsa"
     "--with-aes"
   ] ++ lib.optional stdenv.isLinux "--with-libcap=${libcap.dev}"
-    ++ lib.optional enableSeccomp "--enable-seccomp";
+    ++ lib.optional enableSeccomp "--enable-seccomp"
+    ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "BUILD_CC=$(CC_FOR_BUILD)";
 
   postInstall = ''
     moveToOutput bin/bind9-config $dev
diff --git a/pkgs/servers/mail/postfix/default.nix b/pkgs/servers/mail/postfix/default.nix
index 3b14fab68753..585a6196831b 100644
--- a/pkgs/servers/mail/postfix/default.nix
+++ b/pkgs/servers/mail/postfix/default.nix
@@ -26,11 +26,11 @@ in stdenv.mkDerivation rec {
 
   pname = "postfix";
 
-  version = "3.5.2";
+  version = "3.5.3";
 
   src = fetchurl {
     url = "ftp://ftp.cs.uu.nl/mirror/postfix/postfix-release/official/${pname}-${version}.tar.gz";
-    sha256 = "1hxy9458apnzfg4n0alncsdgy5dwzn5dbn4xm46iv15xynbj9gz3";
+    sha256 = "0xcd9pmv2p4znn6bqvka19h5h2lw90inyxrm5020acd0yaf0i0g3";
   };
 
   nativeBuildInputs = [ makeWrapper m4 ];
diff --git a/pkgs/servers/mqtt/mosquitto/default.nix b/pkgs/servers/mqtt/mosquitto/default.nix
index b52cfb09d4f1..8f632ed9b58f 100644
--- a/pkgs/servers/mqtt/mosquitto/default.nix
+++ b/pkgs/servers/mqtt/mosquitto/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mosquitto";
-  version = "1.6.8";
+  version = "1.6.10";
 
   src = fetchFromGitHub {
     owner  = "eclipse";
     repo   = "mosquitto";
     rev    = "v${version}";
-    sha256 = "1py13vg3vwwwg6jdnmq46z6rlzb84r4ggqsmsrn4yar5hrw9pa90";
+    sha256 = "0g9iywm0s08b0ax1qx4j5lixfc1m6p48lv14vlil6wns4azc3fsc";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/sql/postgresql/ext/pg_ed25519.nix b/pkgs/servers/sql/postgresql/ext/pg_ed25519.nix
new file mode 100644
index 000000000000..95d45b2663d9
--- /dev/null
+++ b/pkgs/servers/sql/postgresql/ext/pg_ed25519.nix
@@ -0,0 +1,31 @@
+{ stdenv, fetchurl, postgresql }:
+
+stdenv.mkDerivation rec {
+  pname = "pg_ed25519";
+  version = "0.2";
+
+  src = fetchurl {
+    url = "https://gitlab.com/dwagin/${pname}/-/archive/${version}/${pname}-${version}.tar.bz2";
+    sha256 = "0q46pvk1vq5w3al6i3inzlw6w7za3n7p1gd4wfbbxzvzh7qnynda";
+  };
+
+  buildInputs = [ postgresql ];
+
+  installPhase = ''
+    mkdir -p $out/bin    # For buildEnv to setup proper symlinks. See #22653
+    mkdir -p $out/{lib,share/postgresql/extension}
+
+    cp *.so      $out/lib
+    cp *.sql     $out/share/postgresql/extension
+    cp *.control $out/share/postgresql/extension
+  '';
+
+  meta = with stdenv.lib; {
+    description = "PostgreSQL extension for signing and verifying ed25519 signatures";
+    homepage = "https://gitlab.com/dwagin/pg_ed25519";
+    maintainers = [ maintainers.renzo ];
+    platforms = postgresql.meta.platforms;
+    license = licenses.mit;
+  };
+}
+
diff --git a/pkgs/servers/sql/postgresql/packages.nix b/pkgs/servers/sql/postgresql/packages.nix
index 15735a82c52e..d4dafe7ddb14 100644
--- a/pkgs/servers/sql/postgresql/packages.nix
+++ b/pkgs/servers/sql/postgresql/packages.nix
@@ -13,6 +13,8 @@ self: super: {
 
     pg_bigm = super.callPackage ./ext/pg_bigm.nix { };
 
+    pg_ed25519 = super.callPackage ./ext/pg_ed25519.nix { };
+
     pg_repack = super.callPackage ./ext/pg_repack.nix { };
 
     pg_similarity = super.callPackage ./ext/pg_similarity.nix { };
diff --git a/pkgs/servers/web-apps/searx/default.nix b/pkgs/servers/web-apps/searx/default.nix
index d0ff13917969..bcfa8a410219 100644
--- a/pkgs/servers/web-apps/searx/default.nix
+++ b/pkgs/servers/web-apps/searx/default.nix
@@ -25,7 +25,8 @@ buildPythonApplication rec {
       --replace 'pygments==2.1.3' 'pygments>=2.1,<3.0' \
       --replace 'pyopenssl==19.0.0' 'pyopenssl' \
       --replace 'python-dateutil==2.8.0' 'python-dateutil==2.8.*' \
-      --replace 'pyyaml==5.1' 'pyyaml'
+      --replace 'pyyaml==5.1' 'pyyaml' \
+      --replace 'requests[socks]==2.22.0' 'requests[socks]'
     substituteInPlace requirements-dev.txt \
       --replace 'plone.testing==5.0.0' 'plone.testing' \
       --replace 'pep8==1.7.0' 'pep8==1.7.*' \
diff --git a/pkgs/shells/fish/default.nix b/pkgs/shells/fish/default.nix
index 11d9e48008fa..420aac7607e4 100644
--- a/pkgs/shells/fish/default.nix
+++ b/pkgs/shells/fish/default.nix
@@ -125,6 +125,10 @@ let
       pcre2
     ];
 
+    cmakeFlags = [
+      "-DCMAKE_INSTALL_DOCDIR=${placeholder "out"}/share/doc/fish"
+    ];
+
     preConfigure = ''
       patchShebangs ./build_tools/git_version_gen.sh
     '';
diff --git a/pkgs/tools/graphics/luxcorerender/default.nix b/pkgs/tools/graphics/luxcorerender/default.nix
index fc8a98c19930..3afb6ebd9877 100644
--- a/pkgs/tools/graphics/luxcorerender/default.nix
+++ b/pkgs/tools/graphics/luxcorerender/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, boost165, pkgconfig, python35
+{ stdenv, fetchFromGitHub, cmake, boost165, pkgconfig, python36
 , tbb, openimageio, libjpeg, libpng, zlib, libtiff, ilmbase
 , freetype, openexr, libXdmcp, libxkbcommon, epoxy, at-spi2-core
 , dbus, doxygen, qt5, c-blosc, libGLU, gnome3, dconf, gtk3, pcre
@@ -7,28 +7,34 @@
 , withOpenCL ? true , opencl-headers, ocl-icd, opencl-clhpp
 }:
 
-let boost_static = boost165.override {
-      python = python35;
+let
+      python = python36;
+
+      boost_static = boost165.override {
+      inherit python;
       enableStatic = true;
       enablePython = true;
     };
 
+    version = "2.0";
+    sha256 = "15nn39ybsfjf3cw3xgkbarvxn4a9ymfd579ankm7yjxkw5gcif38";
+
 in stdenv.mkDerivation {
   pname = "luxcorerender";
-  version = "2.0";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "LuxCoreRender";
     repo = "LuxCore";
-    rev = "luxcorerender_v2.0";
-    sha256 = "15nn39ybsfjf3cw3xgkbarvxn4a9ymfd579ankm7yjxkw5gcif38";
+    rev = "luxcorerender_v${version}";
+    inherit sha256;
   };
 
   buildInputs =
    [ embree2 pkgconfig cmake zlib boost_static libjpeg
      libtiff libpng ilmbase freetype openexr openimageio
      tbb qt5.full c-blosc libGLU pcre bison
-     flex libX11 libpthreadstubs python35 libXdmcp libxkbcommon
+     flex libX11 libpthreadstubs python libXdmcp libxkbcommon
      epoxy at-spi2-core dbus doxygen
      # needed for GSETTINGS_SCHEMAS_PATH
      gsettings-desktop-schemas glib gtk3
@@ -43,15 +49,15 @@ in stdenv.mkDerivation {
     "-DOpenEXR_IlmThread_INCLUDE_DIR=${ilmbase.dev}/include/OpenEXR"
     "-DOpenEXR_Imath_INCLUDE_DIR=${openexr.dev}/include/OpenEXR"
     "-DOpenEXR_half_INCLUDE_DIR=${ilmbase.dev}/include"
-    "-DPYTHON_LIBRARY=${python35}/lib/libpython3.so"
-    "-DPYTHON_INCLUDE_DIR=${python35}/include/python3.5"
+    "-DPYTHON_LIBRARY=${python}/lib/libpython3.so"
+    "-DPYTHON_INCLUDE_DIR=${python}/include/python${python.pythonVersion}"
     "-DEMBREE_INCLUDE_PATH=${embree2}/include"
     "-DEMBREE_LIBRARY=${embree2}/lib/libembree.so"
     "-DBoost_PYTHON_LIBRARY_RELEASE=${boost_static}/lib/libboost_python3-mt.so"
   ] ++ stdenv.lib.optional withOpenCL
        "-DOPENCL_INCLUDE_DIR=${opencl-headers}/include";
   preConfigure = ''
-    NIX_CFLAGS_COMPILE+=" -isystem ${python35}/include/python3.5"
+    NIX_CFLAGS_COMPILE+=" -isystem ${python}/include/python${python.pythonVersion}"
     NIX_LDFLAGS+=" -lpython3"
   '';
 
diff --git a/pkgs/tools/misc/bdf2sfd/default.nix b/pkgs/tools/misc/bdf2sfd/default.nix
index 15154f73a699..ca67525bb8c4 100644
--- a/pkgs/tools/misc/bdf2sfd/default.nix
+++ b/pkgs/tools/misc/bdf2sfd/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bdf2sfd";
-  version = "1.1.1";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "fcambus";
     repo = pname;
     rev = version;
-    sha256 = "02dzvrgwpgbd0wgfnlpiv2qlwvspwl7a0qh8cg363lpnxv8akw9q";
+    sha256 = "1fhdl739a4v8296wpn2390fhlb6vlg9m1zik7mql4l9008ncd5mv";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/tools/misc/fluent-bit/default.nix b/pkgs/tools/misc/fluent-bit/default.nix
index 439979068f5a..d882c6efb5e8 100644
--- a/pkgs/tools/misc/fluent-bit/default.nix
+++ b/pkgs/tools/misc/fluent-bit/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fluent-bit";
-  version = "1.4.5";
+  version = "1.4.6";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     rev = "v${version}";
-    sha256 = "0kxbq174a5fdcdh1hvnrlk79cg7lyily7iskfxhyz9l26qana9jp";
+    sha256 = "0qxyjmgl85q7xk629l548bpzizma5n4j1r6nqbwh9j15ajvq7mq8";
   };
 
   nativeBuildInputs = [ cmake flex bison ];
diff --git a/pkgs/tools/misc/graylog/default.nix b/pkgs/tools/misc/graylog/default.nix
index 17ea28724782..8530d04b49a3 100644
--- a/pkgs/tools/misc/graylog/default.nix
+++ b/pkgs/tools/misc/graylog/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "graylog";
-  version = "3.3.0";
+  version = "3.3.1";
 
   src = fetchurl {
     url = "https://packages.graylog2.org/releases/graylog/graylog-${version}.tgz";
-    sha256 = "1ydplg2lifql5s4bh64a4lwqp1q5vrvbljhn1pnxv9vz0ab73q1k";
+    sha256 = "1jcv2dqm49vbz810ypv024r3lqgz804l06yhhwshrih61xzj7dvh";
   };
 
   dontBuild = true;
diff --git a/pkgs/tools/misc/graylog/plugins.nix b/pkgs/tools/misc/graylog/plugins.nix
index 5dbcc7479e5d..ec6c16f53131 100644
--- a/pkgs/tools/misc/graylog/plugins.nix
+++ b/pkgs/tools/misc/graylog/plugins.nix
@@ -64,10 +64,10 @@ in {
   enterprise-integrations = glPlugin rec {
     name = "graylog-enterprise-integrations-${version}";
     pluginName = "graylog-plugin-enterprise-integrations";
-    version = "3.3.0";
+    version = "3.3.1";
     src = fetchurl {
       url = "https://downloads.graylog.org/releases/graylog-enterprise-integrations/graylog-enterprise-integrations-plugins-${version}.tgz";
-      sha256 = "1480ccii3nzvm0jp1xm2iddgc789zcwbgd19201q7p3v0ph02yj8";
+      sha256 = "0la91f5hfakrp5d37q3r1z15zzya9vmwgp8gf5ifkh6fasa811ll";
     };
     installPhase = ''
       mkdir -p $out/bin
@@ -75,7 +75,7 @@ in {
       cp ${pluginName}-${version}.jar $out/bin/${pluginName}-${version}.jar
     '';
     meta = {
-      homepage = "https://docs.graylog.org/en/3.2/pages/integrations.html#enterprise";
+      homepage = "https://docs.graylog.org/en/3.3/pages/integrations.html#enterprise";
       description = "Integrations are tools that help Graylog work with external systems (unfree enterprise integrations)";
       license = stdenv.lib.licenses.unfree;
     };
@@ -96,10 +96,10 @@ in {
   integrations = glPlugin rec {
     name = "graylog-integrations-${version}";
     pluginName = "graylog-plugin-integrations";
-    version = "3.3.0";
+    version = "3.3.1";
     src = fetchurl {
       url = "https://downloads.graylog.org/releases/graylog-integrations/graylog-integrations-plugins-${version}.tgz";
-      sha256 = "08cpxviwk2p4zsgbr2h3symr88rf3fjfz1kkg4iglvdc5mqf71xx";
+      sha256 = "1k90q50p4ly9d8fj0riyb1xw0bd6f8wm2xmkr71908j2v0jaskpq";
     };
     installPhase = ''
       mkdir -p $out/bin
diff --git a/pkgs/tools/misc/ncdu/default.nix b/pkgs/tools/misc/ncdu/default.nix
index 71b7f9c6cd47..2d56ab9c09bd 100644
--- a/pkgs/tools/misc/ncdu/default.nix
+++ b/pkgs/tools/misc/ncdu/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ncdu";
-  version = "1.15";
+  version = "1.15.1";
 
   src = fetchurl {
     url = "https://dev.yorhel.nl/download/${pname}-${version}.tar.gz";
-    sha256 = "1ywpa8yg74a5xa46f0qig92xw5z5s1lmspwzcslr497brk2ksnaa";
+    sha256 = "1c1zxalm5asyhn4p1hd51h7khw17515gbqmvdz63kc8xpx6xqbdh";
   };
 
   buildInputs = [ ncurses ];
diff --git a/pkgs/tools/misc/system-config-printer/default.nix b/pkgs/tools/misc/system-config-printer/default.nix
index e9ee91de6776..8a0c881a277b 100644
--- a/pkgs/tools/misc/system-config-printer/default.nix
+++ b/pkgs/tools/misc/system-config-printer/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, udev, intltool, pkgconfig, glib, xmlto, wrapGAppsHook
+{ stdenv, fetchFromGitHub, fetchpatch, udev, intltool, pkgconfig, glib, xmlto, wrapGAppsHook
 , docbook_xml_dtd_412, docbook_xsl
 , libxml2, desktop-file-utils, libusb1, cups, gdk-pixbuf, pango, atk, libnotify
 , gobject-introspection, libsecret, packagekit
@@ -24,7 +24,20 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile.am --replace /bin/bash ${bash}/bin/bash
   '';
 
-  patches = [ ./detect_serverbindir.patch ];
+  patches = [
+    ./detect_serverbindir.patch
+
+    # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=958104
+    # (Fixes will be included in next upstream release.)
+    (fetchpatch {
+      url = "https://github.com/OpenPrinting/system-config-printer/commit/cf9903466c1a2d18a701f3b5e8c7e03483e1244d.patch";
+      sha256 = "03gpav618w50q90m2kdkgwclc7fv17m493fgjd633zfavb5kqr3n";
+    })
+    (fetchpatch {
+      url = "https://github.com/OpenPrinting/system-config-printer/commit/b9289dfe105bdb502f183f0afe7a115ecae5f2af.patch";
+      sha256 = "12w47hy3ly4phh8jcqxvdnd5sgbnbp8dnscjd7d5y2i43kxj7b23";
+    })
+  ];
 
   buildInputs = [
     glib udev libusb1 cups
diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix
index dc2d3cf8a1e8..9e28e8785732 100644
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@@ -18,11 +18,11 @@ buildPythonPackage rec {
   # The websites youtube-dl deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2020.06.06";
+  version = "2020.06.16.1";
 
   src = fetchurl {
     url = "https://yt-dl.org/downloads/${version}/${pname}-${version}.tar.gz";
-    sha256 = "1qrrr14glv0jv377n61paq55b6k58jpnwbz2sp5xfl4wnxy5hqny";
+    sha256 = "1q0080cvxpfakgbzigbnl9adnga3jz1sqig2rsiq52rarqbc01px";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
diff --git a/pkgs/tools/networking/acme-client/default.nix b/pkgs/tools/networking/acme-client/default.nix
index 06c2898248d0..00f8778cafd5 100644
--- a/pkgs/tools/networking/acme-client/default.nix
+++ b/pkgs/tools/networking/acme-client/default.nix
@@ -1,7 +1,5 @@
 { stdenv
-, fetchFromGitHub
-, autoreconfHook
-, bison
+, fetchurl
 , apple_sdk ? null
 , libbsd
 , libressl
@@ -12,22 +10,20 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "acme-client";
-  version = "0.2.5";
+  version = "1.0.1";
 
-  src = fetchFromGitHub {
-    owner = "graywolf";
-    repo = "acme-client-portable";
-    rev = "v${version}";
-    sha256 = "1d9yk87nj5gizkq26m4wqfh4xhlrn5xlfj7mfgvrpsdiwibqxrrw";
+  src = fetchurl {
+    url = "https://data.wolfsden.cz/sources/acme-client-${version}.tar.xz";
+    sha256 = "0gmdvmyw8a61w08hrxllypf7rpnqg0fxipbk3zmvsxj7m5i6iysj";
   };
 
-  nativeBuildInputs = [ autoreconfHook bison pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libbsd libressl ] ++ optional stdenv.isDarwin apple_sdk.sdk;
 
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
   meta = {
-    homepage = "https://github.com/graywolf/acme-client-portable";
+    homepage = "https://sr.ht/~graywolf/acme-client-portable/";
     description = "Secure ACME/Let's Encrypt client";
     platforms = platforms.unix;
     license = licenses.isc;
diff --git a/pkgs/tools/networking/memtier-benchmark/default.nix b/pkgs/tools/networking/memtier-benchmark/default.nix
index 3579002e4169..a45c3a2e33a1 100644
--- a/pkgs/tools/networking/memtier-benchmark/default.nix
+++ b/pkgs/tools/networking/memtier-benchmark/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "memtier-benchmark";
-  version = "1.2.17";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner  = "redislabs";
     repo   = "memtier_benchmark";
     rev    = "refs/tags/${version}";
-    sha256 = "18cka6sv3w8ffa81126nzi04if9g1wd3i3apxsgmv7xm2p8fsa39";
+    sha256 = "0m2qnnc71qpdj8w421bxn0zxz6ddvzy7b0n19jvyncnzvk1ff0sq";
   };
 
   patchPhase = ''
diff --git a/pkgs/tools/package-management/rpm/default.nix b/pkgs/tools/package-management/rpm/default.nix
index fdcf9832e667..fee282de52fc 100644
--- a/pkgs/tools/package-management/rpm/default.nix
+++ b/pkgs/tools/package-management/rpm/default.nix
@@ -1,15 +1,15 @@
-{ stdenv
+{ stdenv, lib
 , pkgconfig, autoreconfHook
 , fetchurl, cpio, zlib, bzip2, file, elfutils, libbfd, libarchive, nspr, nss, popt, db, xz, python, lua
 }:
 
 stdenv.mkDerivation rec {
   pname = "rpm";
-  version = "4.14.2.1";
+  version = "4.15.1";
 
   src = fetchurl {
-    url = "http://ftp.rpm.org/releases/rpm-4.14.x/rpm-${version}.tar.bz2";
-    sha256 = "1nmck2fq9h85fgs3zhh6w1avlw5y16cbz5khd459ry3jfd5w4f8i";
+    url = "http://ftp.rpm.org/releases/rpm-${lib.versions.majorMinor version}.x/rpm-${version}.tar.bz2";
+    sha256 = "0c6jwail90fhha3bpx70w4a2i8ycxwvnx6zwxm121l8wc3wlbvyx";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/tools/security/certstrap/default.nix b/pkgs/tools/security/certstrap/default.nix
index fb3c00e48f91..4d2e2fe7e950 100644
--- a/pkgs/tools/security/certstrap/default.nix
+++ b/pkgs/tools/security/certstrap/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "certstrap";
-  version = "1.1.1";
+  version = "1.2.0";
 
   goPackagePath = "github.com/square/certstrap";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "square";
     repo = "certstrap";
     rev = "v${version}";
-    sha256 = "0j7gi2nzykny7i0gjax9vixw72l9jcm4wnwxgm72hh1pji0ysa8n";
+    sha256 = "1ymchnn7c9g3pq7rw4lrwsd6z3wfjx90g7qgrw6r5hssl77mnscj";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/security/chipsec/default.nix b/pkgs/tools/security/chipsec/default.nix
index 387fa4d750bd..5dccf295065c 100644
--- a/pkgs/tools/security/chipsec/default.nix
+++ b/pkgs/tools/security/chipsec/default.nix
@@ -2,13 +2,13 @@
 , kernel ? null, withDriver ? false }:
 pythonPackages.buildPythonApplication rec {
   pname = "chipsec";
-  version = "1.4.9";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "chipsec";
     repo = "chipsec";
     rev = version;
-    sha256 = "1p6w8294w5z2f4jwc22mqaggv5qajvmf9iifv7fl7wdz3wsvskrk";
+    sha256 = "1rxr9i08a22m15slvlkrhnki30jixi2ds096kmmc2nqzfr9yibmb";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/rage/default.nix b/pkgs/tools/security/rage/default.nix
index cdba2f2beb01..26ae27dff6b2 100644
--- a/pkgs/tools/security/rage/default.nix
+++ b/pkgs/tools/security/rage/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, rustPlatform, fetchFromGitHub, Security }:
+{ stdenv, rustPlatform, fetchFromGitHub, installShellFiles, Security }:
 
 rustPlatform.buildRustPackage rec {
   pname = "rage";
@@ -13,8 +13,20 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "08njl8irkqkfxj54pz4sx3l9aqb40h10wxb82zza52pqd4zapgn6";
 
+  nativeBuildInputs = [ installShellFiles ];
+
   buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
 
+  postBuild = ''
+    cargo run --example generate-docs
+    cargo run --example generate-completions
+  '';
+
+  postInstall = ''
+    installManPage target/manpages/*
+    installShellCompletion target/completions/*.{bash,fish,zsh}
+  '';
+
   meta = with stdenv.lib; {
     description = "A simple, secure and modern encryption tool with small explicit keys, no config options, and UNIX-style composability";
     homepage = "https://github.com/str4d/rage";
diff --git a/pkgs/tools/system/di/default.nix b/pkgs/tools/system/di/default.nix
index 239544d20a6d..0a6ae26547bf 100644
--- a/pkgs/tools/system/di/default.nix
+++ b/pkgs/tools/system/di/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "di";
-  version = "4.47.3";
+  version = "4.48";
 
   src = fetchurl {
     url = "https://gentoo.com/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "0m4npba50sf5s61g5z3xd2r7937zwja941f2h3f081xi24c2hfck";
+    sha256 = "0crvvfsxh8ryc0j19a2x52i9zacvggm8zi6j3kzygkcwnpz4km8r";
   };
 
   makeFlags = [ "INSTALL_DIR=$(out)" ];
diff --git a/pkgs/tools/virtualization/govc/default.nix b/pkgs/tools/virtualization/govc/default.nix
index e3329ea13f11..433da1b07f27 100644
--- a/pkgs/tools/virtualization/govc/default.nix
+++ b/pkgs/tools/virtualization/govc/default.nix
@@ -2,7 +2,7 @@
   
 buildGoPackage rec {
   pname = "govc";
-  version = "0.22.1";
+  version = "0.23.0";
 
   goPackagePath = "github.com/vmware/govmomi";
 
@@ -12,7 +12,7 @@ buildGoPackage rec {
     rev = "v${version}";
     owner = "vmware";
     repo = "govmomi";
-    sha256 = "1z4am6143jrrls0023flnqgadm1z9p60w09cp1j5pnslm60vvw78";
+    sha256 = "05nb5xd90kbazdx4l9bw72729dh5hrcaqdi9wpf5ma7bz7mw9wzi";
   };
 
   meta = {
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 2212c49c715f..e502fab10d7c 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -88,6 +88,7 @@ mapAliases ({
   cpp-gsl = microsoft_gsl; # added 2019-05-24
   cupsBjnp = cups-bjnp; # added 2016-01-02
   cups_filters = cups-filters; # added 2016-08
+  cquery = throw "cquery has been removed because it is abandoned by upstream. Consider switching to clangd or ccls instead."; # added 2020-06-15
   cv = progress; # added 2015-09-06
   d1x_rebirth = dxx-rebirth; # added 2018-04-25
   d2x_rebirth = dxx-rebirth; # added 2018-04-25
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 240a2ab6d997..8465c5060030 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4684,6 +4684,8 @@ in
 
   kippo = callPackage ../servers/kippo { };
 
+  kristall = libsForQt5.callPackage ../applications/networking/browsers/kristall { };
+
   kzipmix = pkgsi686Linux.callPackage ../tools/compression/kzipmix { };
 
   ma1sd = callPackage ../servers/ma1sd { };
@@ -6401,7 +6403,9 @@ in
 
   rpiboot-unstable = callPackage ../development/misc/rpiboot/unstable.nix { };
 
-  rpm = callPackage ../tools/package-management/rpm { };
+  rpm = callPackage ../tools/package-management/rpm {
+    python = python3;
+  };
 
   rpm-ostree = callPackage ../tools/misc/rpm-ostree {
     gperf = gperf_3_0;
@@ -10274,12 +10278,6 @@ in
 
   cpplint = callPackage ../development/tools/analysis/cpplint { };
 
-  cquery = callPackage ../development/tools/misc/cquery {
-    # 7 is the default, but only on Linux, so keep this for now
-    llvmPackages = llvmPackages_7;
-  };
-
-
   ccls = callPackage ../development/tools/misc/ccls {
     llvmPackages = llvmPackages_8;
     stdenv = llvmPackages_8.stdenv;
@@ -14215,6 +14213,8 @@ in
 
   flatbuffers = callPackage ../development/libraries/flatbuffers { };
 
+  nanopb = callPackage ../development/libraries/nanopb { };
+
   gnupth = callPackage ../development/libraries/pth { };
   pth = if stdenv.hostPlatform.isMusl then npth else gnupth;
 
@@ -15149,6 +15149,9 @@ in
 
   wxGTK = wxGTK28;
 
+  wxGTK30 = wxGTK30-gtk2;
+  wxGTK31 = wxGTK31-gtk2;
+
   wxGTK28 = callPackage ../development/libraries/wxwidgets/2.8 {
     inherit (gnome2) GConf;
   };
@@ -15159,18 +15162,32 @@ in
     inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QuickTime;
   };
 
-  wxGTK30 = callPackage ../development/libraries/wxwidgets/3.0 {
+  wxGTK30-gtk2 = callPackage ../development/libraries/wxwidgets/3.0 {
+    withGtk2 = true;
     inherit (gnome2) GConf;
     inherit (darwin.stubs) setfile;
     inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit;
   };
 
-  wxGTK31 = callPackage ../development/libraries/wxwidgets/3.1 {
+  wxGTK30-gtk3 = callPackage ../development/libraries/wxwidgets/3.0 {
+    withGtk2 = false;
+    inherit (darwin.stubs) setfile;
+    inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit;
+  };
+
+  wxGTK31-gtk2 = callPackage ../development/libraries/wxwidgets/3.1 {
+    withGtk2 = true;
     inherit (gnome2) GConf;
     inherit (darwin.stubs) setfile;
     inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit;
   };
 
+  wxGTK31-gtk3 = callPackage ../development/libraries/wxwidgets/3.1 {
+    withGtk2 = false;
+    inherit (darwin.stubs) setfile;
+    inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit;
+  };
+
   wxmac = callPackage ../development/libraries/wxwidgets/3.0/mac.nix {
     inherit (darwin.apple_sdk.frameworks) AGL Cocoa Kernel;
     inherit (darwin.stubs) setfile rez derez;
@@ -19124,7 +19141,7 @@ in
 
   ctop = callPackage ../tools/system/ctop { };
 
-  cubicsdr = callPackage ../applications/radio/cubicsdr { wxGTK = wxGTK31; };
+  cubicsdr = callPackage ../applications/radio/cubicsdr { };
 
   cum = callPackage ../applications/misc/cum { };
 
@@ -22191,9 +22208,7 @@ in
 
   soxr = callPackage ../applications/misc/audio/soxr { };
 
-  spek = callPackage ../applications/audio/spek {
-    ffmpeg = ffmpeg_2;
-  };
+  spek = callPackage ../applications/audio/spek { };
 
   spotify = callPackage ../applications/audio/spotify {
     libgcrypt = libgcrypt_1_5;
@@ -23846,8 +23861,8 @@ in
 
   katagoWithCuda = katago.override {
     cudaSupport = true;
-    cudnn = cudnn_cudatoolkit_10_1;
-    cudatoolkit = cudatoolkit_10_1;
+    cudnn = cudnn_cudatoolkit_10_2;
+    cudatoolkit = cudatoolkit_10_2;
   };
 
   klavaro = callPackage ../games/klavaro {};
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b5bc5a54f7a6..5e7e70563526 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5718,7 +5718,7 @@ in {
 
   rply = callPackage ../development/python-modules/rply {};
 
-  rpm = toPythonModule (pkgs.rpm.override{inherit python;});
+  rpm = disabledIf (!isPy3k) (toPythonModule (pkgs.rpm.override{ inherit python; }));
 
   rpmfluff = callPackage ../development/python-modules/rpmfluff {};