about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/languages-frameworks/agda.section.md12
-rw-r--r--doc/languages-frameworks/python.section.md6
-rw-r--r--lib/attrsets.nix2
-rw-r--r--maintainers/maintainer-list.nix28
-rw-r--r--maintainers/scripts/luarocks-packages.csv1
-rw-r--r--maintainers/team-list.nix26
-rw-r--r--nixos/doc/manual/administration/boot-problems.xml31
-rw-r--r--nixos/doc/manual/release-notes/rl-2009.xml79
-rw-r--r--nixos/modules/config/users-groups.nix32
-rw-r--r--nixos/modules/module-list.nix3
-rw-r--r--nixos/modules/programs/hamster.nix15
-rw-r--r--nixos/modules/rename.nix6
-rw-r--r--nixos/modules/services/databases/mysql.nix44
-rw-r--r--nixos/modules/services/hardware/fwupd.nix35
-rw-r--r--nixos/modules/services/hardware/u2f.nix23
-rw-r--r--nixos/modules/services/mail/dovecot.nix35
-rw-r--r--nixos/modules/services/misc/matrix-synapse.nix1
-rw-r--r--nixos/modules/services/networking/go-neb.nix53
-rw-r--r--nixos/modules/services/security/physlock.nix1
-rw-r--r--nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py20
-rw-r--r--nixos/modules/system/boot/systemd.nix9
-rw-r--r--nixos/modules/virtualisation/qemu-vm.nix2
-rw-r--r--nixos/tests/all-tests.nix1
-rw-r--r--nixos/tests/go-neb.nix44
-rw-r--r--nixos/tests/matrix-synapse.nix4
-rw-r--r--nixos/tests/systemd-boot.nix57
-rw-r--r--pkgs/applications/audio/amarok/default.nix14
-rw-r--r--pkgs/applications/audio/asunder/default.nix4
-rw-r--r--pkgs/applications/audio/ft2-clone/default.nix4
-rw-r--r--pkgs/applications/audio/jamulus/default.nix4
-rw-r--r--pkgs/applications/audio/munt/default.nix8
-rw-r--r--pkgs/applications/audio/pt2-clone/default.nix4
-rw-r--r--pkgs/applications/audio/pulseaudio-modules-bt/default.nix6
-rw-r--r--pkgs/applications/audio/spek/default.nix25
-rw-r--r--pkgs/applications/audio/strawberry/default.nix4
-rw-r--r--pkgs/applications/blockchains/bitcoin.nix73
-rw-r--r--pkgs/applications/blockchains/ergo/default.nix4
-rw-r--r--pkgs/applications/blockchains/litecoin.nix4
-rw-r--r--pkgs/applications/blockchains/namecoin.nix4
-rw-r--r--pkgs/applications/editors/atom/default.nix8
-rw-r--r--pkgs/applications/editors/atom/env.nix3
-rw-r--r--pkgs/applications/editors/kdevelop5/kdev-python.nix4
-rw-r--r--pkgs/applications/editors/kdevelop5/kdevelop.nix4
-rw-r--r--pkgs/applications/editors/vis/default.nix4
-rw-r--r--pkgs/applications/graphics/avocode/default.nix4
-rw-r--r--pkgs/applications/graphics/feh/default.nix6
-rw-r--r--pkgs/applications/graphics/goxel/default.nix4
-rw-r--r--pkgs/applications/graphics/krop/default.nix8
-rw-r--r--pkgs/applications/graphics/yeetgif/default.nix4
-rw-r--r--pkgs/applications/misc/ArchiSteamFarm/default.nix42
-rw-r--r--pkgs/applications/misc/aminal/default.nix4
-rw-r--r--pkgs/applications/misc/gallery-dl/default.nix4
-rw-r--r--pkgs/applications/misc/hamster/default.nix62
-rw-r--r--pkgs/applications/misc/heimer/default.nix5
-rw-r--r--pkgs/applications/misc/menumaker/default.nix4
-rw-r--r--pkgs/applications/misc/opentx/default.nix4
-rw-r--r--pkgs/applications/misc/orca/default.nix4
-rw-r--r--pkgs/applications/misc/polybar/default.nix7
-rw-r--r--pkgs/applications/misc/pueue/default.nix6
-rw-r--r--pkgs/applications/misc/qmapshack/default.nix4
-rw-r--r--pkgs/applications/misc/tut/default.nix4
-rw-r--r--pkgs/applications/misc/xmrig/default.nix4
-rw-r--r--pkgs/applications/misc/xmrig/proxy.nix4
-rw-r--r--pkgs/applications/networking/browsers/chromium/upstream-info.nix18
-rw-r--r--pkgs/applications/networking/browsers/firefox/wrapper.nix4
-rw-r--r--pkgs/applications/networking/browsers/google-chrome/default.nix5
-rw-r--r--pkgs/applications/networking/browsers/kristall/default.nix30
-rw-r--r--pkgs/applications/networking/cluster/jx/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/kube-router/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/kubecfg/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/kubeless/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/minishift/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/nomad/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/qbec/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/terraform-providers/libvirt/default.nix4
-rw-r--r--pkgs/applications/networking/datovka/default.nix4
-rw-r--r--pkgs/applications/networking/dnscontrol/default.nix4
-rw-r--r--pkgs/applications/networking/ftp/filezilla/default.nix12
-rw-r--r--pkgs/applications/networking/instant-messengers/go-neb/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json4
-rw-r--r--pkgs/applications/networking/instant-messengers/riot/riot-desktop-yarndeps.nix8
-rw-r--r--pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix6
-rw-r--r--pkgs/applications/networking/instant-messengers/riot/riot-web.nix6
-rw-r--r--pkgs/applications/networking/instant-messengers/slack/default.nix8
-rw-r--r--pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/meli/default.nix50
-rw-r--r--pkgs/applications/networking/mailreaders/mutt/default.nix4
-rw-r--r--pkgs/applications/networking/remote/waypipe/default.nix4
-rw-r--r--pkgs/applications/networking/remote/wayvnc/add-missing-librt.patch20
-rw-r--r--pkgs/applications/networking/remote/wayvnc/default.nix2
-rw-r--r--pkgs/applications/networking/sniffers/wireshark/default.nix3
-rw-r--r--pkgs/applications/networking/ssb-patchwork/default.nix (renamed from pkgs/applications/networking/ssb/patchwork/default.nix)0
-rw-r--r--pkgs/applications/networking/ssb/patchwork-classic/default.nix106
-rw-r--r--pkgs/applications/networking/sync/onedrive/default.nix28
-rw-r--r--pkgs/applications/office/kmymoney/default.nix4
-rw-r--r--pkgs/applications/radio/cubicsdr/default.nix5
-rw-r--r--pkgs/applications/radio/limesuite/default.nix24
-rw-r--r--pkgs/applications/science/biology/picard-tools/default.nix4
-rw-r--r--pkgs/applications/science/electronics/eagle/eagle.nix4
-rw-r--r--pkgs/applications/science/electronics/verilator/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-filter-repo/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-gone/default.nix6
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-open/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-subtrac/default.nix6
-rw-r--r--pkgs/applications/version-management/gitkraken/default.nix4
-rw-r--r--pkgs/applications/version-management/mercurial/default.nix4
-rw-r--r--pkgs/applications/video/handbrake/default.nix4
-rw-r--r--pkgs/applications/video/mpv/default.nix9
-rw-r--r--pkgs/applications/video/mpv/scripts/simple-mpv-webui.nix33
-rw-r--r--pkgs/applications/video/mpv/wrapper.nix2
-rw-r--r--pkgs/applications/video/tartube/default.nix10
-rw-r--r--pkgs/applications/video/vlc/default.nix4
-rw-r--r--pkgs/applications/video/wf-recorder/default.nix4
-rw-r--r--pkgs/applications/virtualization/conmon/default.nix4
-rw-r--r--pkgs/applications/window-managers/herbstluftwm/default.nix4
-rw-r--r--pkgs/applications/window-managers/hikari/default.nix75
-rw-r--r--pkgs/applications/window-managers/i3/pystatus.nix40
-rw-r--r--pkgs/build-support/agda/default.nix13
-rw-r--r--pkgs/build-support/rust/build-rust-crate/build-crate.nix4
-rw-r--r--pkgs/build-support/rust/build-rust-crate/configure-crate.nix22
-rw-r--r--pkgs/build-support/rust/build-rust-crate/default.nix17
-rw-r--r--pkgs/build-support/rust/build-rust-crate/test/default.nix26
-rw-r--r--pkgs/data/documentation/man-pages/default.nix4
-rw-r--r--pkgs/data/fonts/amiri/default.nix4
-rw-r--r--pkgs/data/misc/osinfo-db/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/apps/evolution/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/core/evince/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-control-center/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-desktop/default.nix4
-rw-r--r--pkgs/development/compilers/go/1.13.nix2
-rw-r--r--pkgs/development/compilers/go/1.14.nix2
-rw-r--r--pkgs/development/compilers/intel-graphics-compiler/default.nix4
-rw-r--r--pkgs/development/compilers/mono/generic.nix2
-rw-r--r--pkgs/development/compilers/purescript/purescript/default.nix8
-rw-r--r--pkgs/development/compilers/yosys/default.nix6
-rw-r--r--pkgs/development/dhall-modules/Prelude.nix31
-rw-r--r--pkgs/development/dhall-modules/dhall-kubernetes.nix31
-rw-r--r--pkgs/development/dhall-modules/dhall-packages.nix39
-rw-r--r--pkgs/development/go-modules/generic/default.nix2
-rw-r--r--pkgs/development/guile-modules/guile-cairo/default.nix4
-rw-r--r--pkgs/development/interpreters/dhall/build-dhall-directory-package.nix25
-rw-r--r--pkgs/development/interpreters/dhall/build-dhall-github-package.nix50
-rw-r--r--pkgs/development/interpreters/janet/default.nix4
-rw-r--r--pkgs/development/libraries/apache-activemq/default.nix4
-rw-r--r--pkgs/development/libraries/audio/libmysofa/default.nix4
-rw-r--r--pkgs/development/libraries/cpp-hocon/default.nix4
-rw-r--r--pkgs/development/libraries/curlcpp/default.nix4
-rw-r--r--pkgs/development/libraries/freetds/default.nix4
-rw-r--r--pkgs/development/libraries/gcc/libgcc/default.nix2
-rw-r--r--pkgs/development/libraries/gio-sharp/default.nix4
-rw-r--r--pkgs/development/libraries/gmm/default.nix4
-rw-r--r--pkgs/development/libraries/libdap/default.nix4
-rw-r--r--pkgs/development/libraries/libfprint/default.nix4
-rw-r--r--pkgs/development/libraries/libiio/default.nix4
-rw-r--r--pkgs/development/libraries/libjcat/default.nix4
-rw-r--r--pkgs/development/libraries/liblastfm/default.nix31
-rw-r--r--pkgs/development/libraries/liblouis/default.nix4
-rw-r--r--pkgs/development/libraries/libnetfilter_queue/default.nix4
-rw-r--r--pkgs/development/libraries/libraspberrypi/default.nix6
-rw-r--r--pkgs/development/libraries/librealsense/default.nix4
-rw-r--r--pkgs/development/libraries/libsolv/default.nix4
-rw-r--r--pkgs/development/libraries/libu2f-host/default.nix4
-rw-r--r--pkgs/development/libraries/lmdb/default.nix11
-rw-r--r--pkgs/development/libraries/nanopb/default.nix88
-rw-r--r--pkgs/development/libraries/nanopb/protoc-gen-nanopb3
-rw-r--r--pkgs/development/libraries/nanopb/test-message-with-annotations/default.nix27
-rw-r--r--pkgs/development/libraries/nanopb/test-message-with-annotations/withannotations.proto7
-rw-r--r--pkgs/development/libraries/nanopb/test-message-with-options/default.nix27
-rw-r--r--pkgs/development/libraries/nanopb/test-message-with-options/withoptions.options1
-rw-r--r--pkgs/development/libraries/nanopb/test-message-with-options/withoptions.proto5
-rw-r--r--pkgs/development/libraries/nanopb/test-simple-proto2/default.nix24
-rw-r--r--pkgs/development/libraries/nanopb/test-simple-proto2/simple.proto5
-rw-r--r--pkgs/development/libraries/nanopb/test-simple-proto3/default.nix24
-rw-r--r--pkgs/development/libraries/nanopb/test-simple-proto3/simple.proto5
-rw-r--r--pkgs/development/libraries/olm/default.nix2
-rw-r--r--pkgs/development/libraries/opendht/default.nix4
-rw-r--r--pkgs/development/libraries/openmpi/default.nix4
-rw-r--r--pkgs/development/libraries/openwsman/default.nix4
-rw-r--r--pkgs/development/libraries/protobufc/1.3.nix9
-rw-r--r--pkgs/development/libraries/swiften/build-fix.patch32
-rw-r--r--pkgs/development/libraries/swiften/default.nix9
-rw-r--r--pkgs/development/libraries/tpm2-tss/default.nix40
-rw-r--r--pkgs/development/libraries/trompeloeil/default.nix4
-rw-r--r--pkgs/development/libraries/wlroots/default.nix4
-rw-r--r--pkgs/development/libraries/wxwidgets/3.0/default.nix14
-rw-r--r--pkgs/development/libraries/wxwidgets/3.1/default.nix12
-rw-r--r--pkgs/development/lua-modules/generated-packages.nix27
-rw-r--r--pkgs/development/lua-modules/overrides.nix11
-rw-r--r--pkgs/development/misc/rpiboot/unstable.nix6
-rw-r--r--pkgs/development/python-modules/aiohttp/default.nix4
-rw-r--r--pkgs/development/python-modules/av/default.nix4
-rw-r--r--pkgs/development/python-modules/awkward1/default.nix4
-rw-r--r--pkgs/development/python-modules/beancount/default.nix4
-rw-r--r--pkgs/development/python-modules/bleach/default.nix7
-rw-r--r--pkgs/development/python-modules/bpython/clipboard-make-which-substitutable.patch27
-rw-r--r--pkgs/development/python-modules/bpython/default.nix17
-rw-r--r--pkgs/development/python-modules/buildbot/default.nix4
-rw-r--r--pkgs/development/python-modules/buildbot/pkg.nix2
-rw-r--r--pkgs/development/python-modules/buildbot/plugins.nix10
-rw-r--r--pkgs/development/python-modules/buildbot/worker.nix2
-rw-r--r--pkgs/development/python-modules/jc/default.nix4
-rw-r--r--pkgs/development/python-modules/matrix-nio/default.nix6
-rw-r--r--pkgs/development/python-modules/playsound/default.nix28
-rw-r--r--pkgs/development/python-modules/pycurl/default.nix3
-rw-r--r--pkgs/development/python-modules/pydantic/default.nix9
-rw-r--r--pkgs/development/python-modules/pygdbmi/default.nix6
-rw-r--r--pkgs/development/python-modules/python-engineio/default.nix1
-rw-r--r--pkgs/development/python-modules/pythonnet/default.nix2
-rw-r--r--pkgs/development/python-modules/rope/default.nix4
-rw-r--r--pkgs/development/python-modules/spacy/default.nix8
-rw-r--r--pkgs/development/python-modules/spacy/models.json72
-rw-r--r--pkgs/development/tools/analysis/cppcheck/default.nix4
-rw-r--r--pkgs/development/tools/analysis/cpplint/default.nix5
-rw-r--r--pkgs/development/tools/analysis/tfsec/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/bazel/buildtools/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/bmake/default.nix4
-rw-r--r--pkgs/development/tools/database/liquibase/default.nix4
-rw-r--r--pkgs/development/tools/database/webdis/default.nix12
-rw-r--r--pkgs/development/tools/delve/default.nix4
-rw-r--r--pkgs/development/tools/flyway/default.nix4
-rw-r--r--pkgs/development/tools/gauge/default.nix4
-rw-r--r--pkgs/development/tools/gllvm/default.nix4
-rw-r--r--pkgs/development/tools/go-protobuf/default.nix6
-rw-r--r--pkgs/development/tools/java/visualvm/default.nix4
-rw-r--r--pkgs/development/tools/misc/cquery/default.nix64
-rw-r--r--pkgs/development/tools/misc/cquery/wrapper12
-rw-r--r--pkgs/development/tools/ocaml/js_of_ocaml/3.0.nix18
-rw-r--r--pkgs/development/tools/ocaml/js_of_ocaml/default.nix42
-rw-r--r--pkgs/development/tools/out-of-tree/default.nix6
-rw-r--r--pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix2
-rw-r--r--pkgs/development/tools/skaffold/default.nix4
-rw-r--r--pkgs/development/tools/vagrant/default.nix4
-rw-r--r--pkgs/development/tools/vagrant/gemset.nix12
-rw-r--r--pkgs/development/web/deno/default.nix6
-rwxr-xr-xpkgs/development/web/deno/update/update.ts2
-rw-r--r--pkgs/development/web/flyctl/default.nix6
-rw-r--r--pkgs/games/augustus/default.nix24
-rw-r--r--pkgs/games/easyrpg-player/default.nix4
-rw-r--r--pkgs/games/julius/default.nix24
-rw-r--r--pkgs/games/katago/default.nix4
-rw-r--r--pkgs/games/openmw/default.nix8
-rw-r--r--pkgs/games/steam/runtime.nix19
-rw-r--r--pkgs/games/wesnoth/default.nix14
-rw-r--r--pkgs/misc/drivers/hplip/default.nix19
-rw-r--r--pkgs/misc/emulators/melonDS/default.nix41
-rw-r--r--pkgs/misc/emulators/stella/default.nix4
-rw-r--r--pkgs/os-specific/linux/alsa-utils/default.nix4
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd/default.nix402
-rw-r--r--pkgs/os-specific/linux/firmware/raspberrypi/default.nix4
-rw-r--r--pkgs/os-specific/linux/firmware/raspberrypi/tools-dont-install-sysv-init-scripts.patch20
-rw-r--r--pkgs/os-specific/linux/firmware/raspberrypi/tools.nix8
-rw-r--r--pkgs/os-specific/linux/firmware/sof-firmware/default.nix23
-rw-r--r--pkgs/os-specific/linux/google-authenticator/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rpi.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/linux-testing.nix6
-rw-r--r--pkgs/os-specific/linux/microcode/intel.nix4
-rw-r--r--pkgs/os-specific/linux/nvme-cli/default.nix4
-rw-r--r--pkgs/os-specific/linux/wireguard/default.nix4
-rw-r--r--pkgs/servers/adguardhome/default.nix22
-rw-r--r--pkgs/servers/blockbook/default.nix6
-rw-r--r--pkgs/servers/consul/default.nix4
-rw-r--r--pkgs/servers/dns/bind/default.nix3
-rw-r--r--pkgs/servers/http/webhook/default.nix4
-rw-r--r--pkgs/servers/icingaweb2/default.nix4
-rw-r--r--pkgs/servers/mail/dovecot/plugins/fts_xapian/default.nix35
-rw-r--r--pkgs/servers/mail/postfix/default.nix4
-rw-r--r--pkgs/servers/matrix-synapse/default.nix7
-rw-r--r--pkgs/servers/mattermost/matterircd.nix4
-rw-r--r--pkgs/servers/monitoring/kapacitor/default.nix4
-rw-r--r--pkgs/servers/monitoring/munin/default.nix4
-rw-r--r--pkgs/servers/monitoring/prometheus/alertmanager.nix6
-rw-r--r--pkgs/servers/monitoring/prometheus/mysqld-exporter.nix4
-rw-r--r--pkgs/servers/monitoring/prometheus/node-exporter.nix4
-rw-r--r--pkgs/servers/monitoring/telegraf/default.nix4
-rw-r--r--pkgs/servers/mqtt/mosquitto/default.nix4
-rw-r--r--pkgs/servers/nats-server/default.nix4
-rw-r--r--pkgs/servers/sql/postgresql/ext/pg_ed25519.nix31
-rw-r--r--pkgs/servers/sql/postgresql/packages.nix2
-rw-r--r--pkgs/servers/web-apps/searx/default.nix3
-rw-r--r--pkgs/shells/fish/default.nix4
-rw-r--r--pkgs/shells/zsh/grml-zsh-config/default.nix4
-rw-r--r--pkgs/shells/zsh/oh-my-zsh/default.nix6
-rw-r--r--pkgs/tools/X11/ckbcomp/default.nix4
-rw-r--r--pkgs/tools/X11/xdg-utils/default.nix1
-rw-r--r--pkgs/tools/X11/xpra/default.nix4
-rw-r--r--pkgs/tools/audio/video2midi/default.nix4
-rw-r--r--pkgs/tools/backup/bacula/default.nix4
-rw-r--r--pkgs/tools/filesystems/bees/default.nix4
-rw-r--r--pkgs/tools/filesystems/convoy/default.nix4
-rw-r--r--pkgs/tools/graphics/luxcorerender/default.nix26
-rw-r--r--pkgs/tools/graphics/wkhtmltopdf/default.nix4
-rw-r--r--pkgs/tools/inputmethods/interception-tools/default.nix4
-rw-r--r--pkgs/tools/misc/bdf2sfd/default.nix4
-rw-r--r--pkgs/tools/misc/diffoscope/default.nix4
-rw-r--r--pkgs/tools/misc/fluent-bit/default.nix4
-rw-r--r--pkgs/tools/misc/geekbench/default.nix4
-rw-r--r--pkgs/tools/misc/gh-ost/default.nix4
-rw-r--r--pkgs/tools/misc/graylog/default.nix4
-rw-r--r--pkgs/tools/misc/graylog/plugins.nix10
-rw-r--r--pkgs/tools/misc/ncdu/default.nix4
-rw-r--r--pkgs/tools/misc/plantuml/default.nix4
-rw-r--r--pkgs/tools/misc/rmlint/default.nix4
-rw-r--r--pkgs/tools/misc/system-config-printer/default.nix17
-rw-r--r--pkgs/tools/misc/topgrade/default.nix6
-rw-r--r--pkgs/tools/misc/txt2man/default.nix4
-rw-r--r--pkgs/tools/misc/youtube-dl/default.nix8
-rw-r--r--pkgs/tools/networking/acme-client/default.nix18
-rw-r--r--pkgs/tools/networking/dnscrypt-proxy2/default.nix4
-rw-r--r--pkgs/tools/networking/flannel/default.nix4
-rw-r--r--pkgs/tools/networking/i2pd/default.nix4
-rw-r--r--pkgs/tools/networking/memtier-benchmark/default.nix4
-rw-r--r--pkgs/tools/networking/openfortivpn/default.nix4
-rw-r--r--pkgs/tools/package-management/rpm/default.nix8
-rw-r--r--pkgs/tools/security/bitwarden_rs/default.nix6
-rw-r--r--pkgs/tools/security/certstrap/default.nix4
-rw-r--r--pkgs/tools/security/chipsec/default.nix4
-rw-r--r--pkgs/tools/security/keycard-cli/default.nix4
-rw-r--r--pkgs/tools/security/rage/default.nix14
-rw-r--r--pkgs/tools/security/tpm2-abrmd/default.nix40
-rw-r--r--pkgs/tools/system/di/default.nix4
-rw-r--r--pkgs/tools/virtualization/govc/default.nix4
-rw-r--r--pkgs/top-level/aliases.nix3
-rw-r--r--pkgs/top-level/all-packages.nix91
-rw-r--r--pkgs/top-level/dhall-packages.nix28
-rw-r--r--pkgs/top-level/dotnet-packages.nix2
-rw-r--r--pkgs/top-level/ocaml-packages.nix10
-rw-r--r--pkgs/top-level/perl-packages.nix20
-rw-r--r--pkgs/top-level/python-packages.nix8
330 files changed, 2700 insertions, 1433 deletions
diff --git a/doc/languages-frameworks/agda.section.md b/doc/languages-frameworks/agda.section.md
index 8cba6d9faa7d..9ce046d05b6f 100644
--- a/doc/languages-frameworks/agda.section.md
+++ b/doc/languages-frameworks/agda.section.md
@@ -67,7 +67,17 @@ A derivation can then be written using `agdaPackages.mkDerivation`. This has sim
 + `libraryName` should be the name that appears in the `*.agda-lib` file, defaulting to `pname`.
 + `libraryFile` should be the file name of the `*.agda-lib` file, defaulting to `${libraryName}.agda-lib`.
 
-The build phase for `agdaPackages.mkDerivation` simply runs `agda` on the `Everything.agda` file. If something else is needed to build the package (e.g. `make`) then the `buildPhase` should be overridden (or a `preBuild` or `configurePhase` can be used if there are steps that need to be done prior to checking the `Everything.agda` file). `agda` and the Agda libraries contained in `buildInputs` are made available during the build phase. The install phase simply copies all `.agda`, `.agdai` and `.agda-lib` files to the output directory. Again, this can be overridden.
+### Building Agda packages
+The default build phase for `agdaPackages.mkDerivation` simply runs `agda` on the `Everything.agda` file.
+If something else is needed to build the package (e.g. `make`) then the `buildPhase` should be overridden.
+Additionally, a `preBuild` or `configurePhase` can be used if there are steps that need to be done prior to checking the `Everything.agda` file.
+`agda` and the Agda libraries contained in `buildInputs` are made available during the build phase.
+
+### Installing Agda packages
+The default install phase copies agda source files, agda interface files (`*.agdai`) and `*.agda-lib` files to the output directory.
+This can be overridden.
+
+By default, agda sources are files ending on  `.agda`, or literate agda files ending on `.lagda`, `.lagda.tex`, `.lagda.org`, `.lagda.md`, `.lagda.rst`. The list of recognised agda source extensions can be extended by setting the `extraExtensions` config variable.
 
 To add an agda package to `nixpkgs`, the derivation should be written to `pkgs/development/libraries/agda/${library-name}/` and an entry should be added to `pkgs/top-level/agda-packages.nix`. Here it is called in a scope with access to all other agda libraries, so the top line of the `default.nix` can look like:
 ```
diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 7da839ee4826..dc10483ce694 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -764,9 +764,6 @@ following are specific to `buildPythonPackage`:
 * `dontWrapPythonPrograms ? false`: Skip wrapping of Python programs.
 * `permitUserSite ? false`: Skip setting the `PYTHONNOUSERSITE` environment
   variable in wrapped programs.
-* `installFlags ? []`: A list of strings. Arguments to be passed to `pip
-  install`. To pass options to `python setup.py install`, use
-  `--install-option`. E.g., `installFlags=["--install-option='--cpp_implementation'"]`.
 * `format ? "setuptools"`: Format of the source. Valid options are
   `"setuptools"`, `"pyproject"`, `"flit"`, `"wheel"`, and `"other"`.
   `"setuptools"` is for when the source has a `setup.py` and `setuptools` is
@@ -782,6 +779,9 @@ following are specific to `buildPythonPackage`:
 * `namePrefix`: Prepends text to `${name}` parameter. In case of libraries, this
   defaults to `"python3.8-"` for Python 3.8, etc., and in case of applications
   to `""`.
+* `pipInstallFlags ? []`: A list of strings. Arguments to be passed to `pip
+  install`. To pass options to `python setup.py install`, use
+  `--install-option`. E.g., `pipInstallFlags=["--install-option='--cpp_implementation'"]`.
 * `pythonPath ? []`: List of packages to be added into `$PYTHONPATH`. Packages
   in `pythonPath` are not propagated (contrary to `propagatedBuildInputs`).
 * `preShellHook`: Hook to execute commands before `shellHook`.
diff --git a/lib/attrsets.nix b/lib/attrsets.nix
index 7d84c25de77a..82bea7af31fc 100644
--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@@ -253,7 +253,7 @@ rec {
   /* Like `mapAttrsRecursive', but it takes an additional predicate
      function that tells it whether to recursive into an attribute
      set.  If it returns false, `mapAttrsRecursiveCond' does not
-     recurse, but does apply the map function.  It is returns true, it
+     recurse, but does apply the map function.  If it returns true, it
      does recurse, and does not apply the map function.
 
      Type:
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index b75cb49467a0..38ed481b7c63 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1157,6 +1157,12 @@
     githubId = 24417923;
     name = "Renaud";
   };
+  c00w = {
+    email = "nix@daedrum.net";
+    github = "c00w";
+    githubId = 486199;
+    name = "Colin";
+  };
   c0deaddict = {
     email = "josvanbakel@protonmail.com";
     github = "c0deaddict";
@@ -1610,6 +1616,12 @@
     githubId = 12202789;
     name = "CrazedProgrammer";
   };
+  cript0nauta = {
+    email = "shareman1204@gmail.com";
+    github = "cript0nauta";
+    githubId = 1222362;
+    name = "Matías Lang";
+  };
   cryptix = {
     email = "cryptix@riseup.net";
     github = "cryptix";
@@ -2540,6 +2552,16 @@
     githubId = 11909469;
     name = "Fabian Geiselhart";
   };
+  fabianhauser = {
+    email = "fabian.nixos@fh2.ch";
+    github = "fabianhauser";
+    githubId = 368799;
+    name = "Fabian Hauser";
+    keys = [{
+      longkeyid = "rsa4096/0x8A52A140BEBF7D2C";
+      fingerprint = "50B7 11F4 3DFD 2018 DCE6  E8D0 8A52 A140 BEBF 7D2C";
+    }];
+  };
   fadenb = {
     email = "tristan.helmich+nixos@gmail.com";
     github = "fadenb";
@@ -3861,6 +3883,12 @@
     githubId = 11947756;
     name = "Julien Dehos";
   };
+  julm = {
+    email = "julm+nix@sourcephile.fr";
+    github = "ju1m";
+    githubId = 21160136;
+    name = "Julien Moutinho";
+  };
   jumper149 = {
     email = "felixspringer149@gmail.com";
     github = "jumper149";
diff --git a/maintainers/scripts/luarocks-packages.csv b/maintainers/scripts/luarocks-packages.csv
index 89a1c0bbbe09..8cc63963370d 100644
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@@ -18,6 +18,7 @@ dkjson,,,,,
 fifo,,,,,
 http,,,,,vcunat
 inspect,,,,,
+ldbus,,http://luarocks.org/dev,,,
 ldoc,,,,,
 lgi,,,,,
 linenoise,,,,,
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 1fed6a4d9bf7..703a6a031d6f 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -34,6 +34,20 @@ with lib.maintainers; {
     scope = "Maintain Freedesktop.org packages for graphical desktop.";
   };
 
+  golang = {
+    members = [
+      c00w
+      cstrahan
+      Frostman
+      kalbasit
+      mic92
+      orivej
+      rvolosatovs
+      zowoq
+    ];
+    scope = "Maintain Golang compilers.";
+  };
+
   gnome = {
     members = [
       hedning
@@ -43,6 +57,18 @@ with lib.maintainers; {
     scope = "Maintain GNOME desktop environment and platform.";
   };
 
+  matrix = {
+    members = [
+      ma27
+      pacien
+      fadenb
+      mguentner
+      ekleog
+      ralith
+    ];
+    scope = "Maintain the ecosystem around Matrix, a decentralized messenger.";
+  };
+
   php = {
     members = [
       aanderse
diff --git a/nixos/doc/manual/administration/boot-problems.xml b/nixos/doc/manual/administration/boot-problems.xml
index 5fa0b29e6d62..badc374ebcfd 100644
--- a/nixos/doc/manual/administration/boot-problems.xml
+++ b/nixos/doc/manual/administration/boot-problems.xml
@@ -19,9 +19,9 @@
     </term>
     <listitem>
      <para>
-      Start a root shell if something goes wrong in stage 1 of the boot process
-      (the initial ramdisk). This is disabled by default because there is no
-      authentication for the root shell.
+      Allows the user to start a root shell if something goes wrong in stage 1
+      of the boot process (the initial ramdisk). This is disabled by default
+      because there is no authentication for the root shell.
      </para>
     </listitem>
    </varlistentry>
@@ -51,6 +51,22 @@
    </varlistentry>
    <varlistentry>
     <term>
+     <literal>boot.debug1mounts</literal>
+    </term>
+    <listitem>
+     <para>
+      Like <literal>boot.debug1</literal> or
+      <literal>boot.debug1devices</literal>, but runs stage1 until all
+      filesystems that are mounted during initrd are mounted (see
+      <option><link linkend="opt-fileSystems._name__.neededForBoot">neededForBoot</link></option>
+      ). As a motivating example, this could be useful if you've forgotten to set
+      <option><link linkend="opt-fileSystems._name__.neededForBoot">neededForBoot</link></option>
+      on a file system.
+     </para>
+    </listitem>
+   </varlistentry>
+   <varlistentry>
+    <term>
      <literal>boot.trace</literal>
     </term>
     <listitem>
@@ -91,6 +107,15 @@
  </para>
 
  <para>
+  Notice that for <literal>boot.shell_on_fail</literal>,
+  <literal>boot.debug1</literal>, <literal>boot.debug1devices</literal>, and
+  <literal>boot.debug1mounts</literal>, if you did <emphasis>not</emphasis>
+  select "start the new shell as pid 1", and you <literal>exit</literal> from
+  the new shell, boot will proceed normally from the point where it failed, as
+  if you'd chosen "ignore the error and continue".
+ </para>
+
+ <para>
   If no login prompts or X11 login screens appear (e.g. due to hanging
   dependencies), you can press Alt+ArrowUp. If you’re lucky, this will start
   rescue mode (described above). (Also note that since most units have a
diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml
index f2485f7395c8..900b1103f2b1 100644
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@@ -94,6 +94,22 @@ services.mysql.initialScript = pkgs.writeText "mariadb-init.sql" ''
       When MariaDB data directory is just upgraded (not initialized), the users are not created or modified.
     </para>
    </listitem>
+   <listitem>
+    <para>
+      MySQL server is now started with additional systemd sandbox/hardening options for better security. The PrivateTmp, ProtectHome, and ProtectSystem options
+      may be problematic when MySQL is attempting to read from or write to your filesystem anywhere outside of its own state directory, for example when
+      calling <literal>LOAD DATA INFILE or SELECT * INTO OUTFILE</literal>. In this scenario a variant of the following may be required:
+        - allow MySQL to read from /home and /tmp directories when using <literal>LOAD DATA INFILE</literal>
+<programlisting>
+systemd.services.mysql.serviceConfig.ProtectHome = lib.mkForce "read-only";
+</programlisting>
+        - allow MySQL to write to custom folder <literal>/var/data</literal> when using <literal>SELECT * INTO OUTFILE</literal>, assuming the mysql user has write
+          access to <literal>/var/data</literal>
+<programlisting>
+systemd.services.mysql.serviceConfig.ReadWritePaths = [ "/var/data" ];
+</programlisting>
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 
@@ -486,7 +502,7 @@ systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
 
   <itemizedlist>
    <listitem>
-     <para>SD and ISO images are now compressed by default using <literal>zstd</literal>.</para>
+    <para>SD images are now compressed by default using <literal>zstd</literal>. The compression for ISO images has also been changed to <literal>zstd</literal>, but ISO images are still not compressed by default.</para>
    </listitem>
    <listitem>
     <para>
@@ -560,6 +576,67 @@ systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
      <link xlink:href="https://grafana.com/docs/grafana/latest/installation/upgrading/#upgrading-to-v7-0">in the Grafana documentation</link>.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     The <literal>hardware.u2f</literal> module, which was installing udev rules
+     was removed, as udev gained native support to handle FIDO security tokens.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     With this release <literal>systemd-networkd</literal> (when enabled through <xref linkend="opt-networking.useNetworkd"/>)
+     has it's netlink socket created through a <literal>systemd.socket</literal> unit. This gives us control over
+     socket buffer sizes and other parameters. For larger setups where networkd has to create a lot of (virtual)
+     devices the default buffer size (currently 128MB) is not enough.
+    </para>
+    <para>
+     On a machine with &gt;100 virtual interfaces (e.g., wireguard tunnels, VLANs, …), that all have to
+     be brought up during system startup, the receive buffer size will spike for a brief period.
+     Eventually some of the message will be dropped since there is not enough (permitted) buffer
+     space available.
+    </para>
+    <para>
+     By having <literal>systemd-networkd</literal> start with a netlink socket created by
+     <literal>systemd</literal> we can configure the <literal>ReceiveBufferSize=</literal> parameter
+     in the socket options (i.e. <literal>systemd.sockets.systemd-networkd.socketOptions.ReceiveBufferSize</literal>)
+     without recompiling <literal>systemd-networkd</literal>.
+    </para>
+    <para>
+     Since the actual memory requirements depend on hardware, timing, exact
+     configurations etc. it isn't currently possible to infer a good default
+     from within the NixOS module system. Administrators are advised to
+     monitor the logs of <literal>systemd-networkd</literal> for <literal>rtnl: kernel receive buffer
+     overrun</literal> spam and increase the memory limit as they see fit.
+    </para>
+    <para>
+     Note: Increasing the <literal>ReceiveBufferSize=</literal> doesn't allocate any memory. It just increases
+     the upper bound on the kernel side. The memory allocation depends on the amount of messages that are
+     queued on the kernel side of the netlink socket.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     Specifying <link linkend="opt-services.dovecot2.mailboxes">mailboxes</link> in the <package>dovecot2</package> module
+     as a list is deprecated and will break eval in 21.03. Instead, an attribute-set should be specified where the <literal>name</literal>
+     should be the key of the attribute.
+    </para>
+    <para>
+     This means that a configuration like this
+<programlisting>{
+  <link linkend="opt-services.dovecot2.mailboxes">services.dovecot2.mailboxes</link> = [
+    { name = "Junk";
+      auto = "create";
+    }
+  ];
+}</programlisting>
+    should now look like this:
+<programlisting>{
+  <link linkend="opt-services.dovecot2.mailboxes">services.dovecot2.mailboxes</link> = {
+    Junk.auto = "create";
+  };
+}</programlisting>
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 </section>
diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix
index 141e43fec39b..7fbbfcec7510 100644
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@@ -600,6 +600,38 @@ in {
       }
     ];
 
+    warnings =
+      builtins.filter (x: x != null) (
+        flip mapAttrsToList cfg.users (name: user:
+        # This regex matches a subset of the Modular Crypto Format (MCF)[1]
+        # informal standard. Since this depends largely on the OS or the
+        # specific implementation of crypt(3) we only support the (sane)
+        # schemes implemented by glibc and BSDs. In particular the original
+        # DES hash is excluded since, having no structure, it would validate
+        # common mistakes like typing the plaintext password.
+        #
+        # [1]: https://en.wikipedia.org/wiki/Crypt_(C)
+        let
+          sep = "\\$";
+          base64 = "[a-zA-Z0-9./]+";
+          id = "[a-z0-9-]+";
+          value = "[a-zA-Z0-9/+.-]+";
+          options = "${id}(=${value})?(,${id}=${value})*";
+          scheme  = "${id}(${sep}${options})?";
+          content = "${base64}${sep}${base64}";
+          mcf = "^${sep}${scheme}${sep}${content}$";
+        in
+        if (user.hashedPassword != null
+            && builtins.match mcf user.hashedPassword == null)
+        then
+        ''
+          The password hash of user "${name}" may be invalid. You must set a
+          valid hash or the user will be locked out of his account. Please
+          check the value of option `users.users."${name}".hashedPassword`.
+        ''
+        else null
+      ));
+
   };
 
 }
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 321fec5fb517..448d432853d3 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -126,6 +126,7 @@
   ./programs/gpaste.nix
   ./programs/gnupg.nix
   ./programs/gphoto2.nix
+  ./programs/hamster.nix
   ./programs/iftop.nix
   ./programs/iotop.nix
   ./programs/java.nix
@@ -362,7 +363,6 @@
   ./services/hardware/throttled.nix
   ./services/hardware/trezord.nix
   ./services/hardware/triggerhappy.nix
-  ./services/hardware/u2f.nix
   ./services/hardware/udev.nix
   ./services/hardware/udisks2.nix
   ./services/hardware/upower.nix
@@ -624,6 +624,7 @@
   ./services/networking/gdomap.nix
   ./services/networking/git-daemon.nix
   ./services/networking/gnunet.nix
+  ./services/networking/go-neb.nix
   ./services/networking/go-shadowsocks2.nix
   ./services/networking/gogoclient.nix
   ./services/networking/gvpe.nix
diff --git a/nixos/modules/programs/hamster.nix b/nixos/modules/programs/hamster.nix
new file mode 100644
index 000000000000..ddf26a22fb53
--- /dev/null
+++ b/nixos/modules/programs/hamster.nix
@@ -0,0 +1,15 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+  meta.maintainers = maintainers.fabianhauser;
+
+  options.programs.hamster.enable =
+    mkEnableOption "Whether to enable hamster time tracking.";
+
+  config = lib.mkIf config.programs.hamster.enable {
+    environment.systemPackages = [ pkgs.hamster ];
+    services.dbus.packages = [ pkgs.hamster ];
+  };
+}
diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix
index c91febdb710f..1dc7f8533176 100644
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -55,6 +55,12 @@ with lib;
       prey-bash-client is deprecated upstream
     '')
 
+    (mkRemovedOptionModule ["hardware" "u2f" ] ''
+      The U2F modules module was removed, as all it did was adding the
+      udev rules from libu2f-host to the system. Udev gained native support
+      to handle FIDO security tokens, so this isn't necessary anymore.
+    '')
+
     # Do NOT add any option renames here, see top of the file
   ];
 }
diff --git a/nixos/modules/services/databases/mysql.nix b/nixos/modules/services/databases/mysql.nix
index 51885881cf73..2e8c5b7640b2 100644
--- a/nixos/modules/services/databases/mysql.nix
+++ b/nixos/modules/services/databases/mysql.nix
@@ -334,7 +334,8 @@ in
     environment.etc."my.cnf".source = cfg.configFile;
 
     systemd.tmpfiles.rules = [
-      "d '${cfg.dataDir}' 0700 ${cfg.user} mysql -"
+      "d '${cfg.dataDir}' 0700 ${cfg.user} mysql - -"
+      "z '${cfg.dataDir}' 0700 ${cfg.user} mysql - -"
     ];
 
     systemd.services.mysql = let
@@ -357,21 +358,17 @@ in
         preStart = if isMariaDB then ''
           if ! test -e ${cfg.dataDir}/mysql; then
             ${mysql}/bin/mysql_install_db --defaults-file=/etc/my.cnf ${mysqldOptions}
-            touch /tmp/mysql_init
+            touch ${cfg.dataDir}/mysql_init
           fi
         '' else ''
           if ! test -e ${cfg.dataDir}/mysql; then
             ${mysql}/bin/mysqld --defaults-file=/etc/my.cnf ${mysqldOptions} --initialize-insecure
-            touch /tmp/mysql_init
+            touch ${cfg.dataDir}/mysql_init
           fi
         '';
 
         serviceConfig = {
-          User = cfg.user;
-          Group = "mysql";
           Type = if hasNotify then "notify" else "simple";
-          RuntimeDirectory = "mysqld";
-          RuntimeDirectoryMode = "0755";
           Restart = "on-abort";
           RestartSec = "5s";
           # The last two environment variables are used for starting Galera clusters
@@ -398,7 +395,7 @@ in
                   done
                 ''}
 
-                if [ -f /tmp/mysql_init ]
+                if [ -f ${cfg.dataDir}/mysql_init ]
                 then
                     ${concatMapStrings (database: ''
                       # Create initial databases
@@ -452,7 +449,7 @@ in
                         cat ${toString cfg.initialScript} | ${mysql}/bin/mysql -u root -N
                       ''}
 
-                    rm /tmp/mysql_init
+                    rm ${cfg.dataDir}/mysql_init
                 fi
 
                 ${optionalString (cfg.ensureDatabases != []) ''
@@ -476,6 +473,35 @@ in
               # ensureDatbases & ensureUsers depends on this script being run as root
               # when the user has secured their mysql install
               "+${setupScript}";
+          # User and group
+          User = cfg.user;
+          Group = "mysql";
+          # Runtime directory and mode
+          RuntimeDirectory = "mysqld";
+          RuntimeDirectoryMode = "0755";
+          # Access write directories
+          ReadWritePaths = [ cfg.dataDir ];
+          # Capabilities
+          CapabilityBoundingSet = "";
+          # Security
+          NoNewPrivileges = true;
+          # Sandboxing
+          ProtectSystem = "strict";
+          ProtectHome = true;
+          PrivateTmp = true;
+          PrivateDevices = true;
+          ProtectHostname = true;
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectControlGroups = true;
+          RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          PrivateMounts = true;
+          # System Call Filtering
+          SystemCallArchitectures = "native";
         };
       };
 
diff --git a/nixos/modules/services/hardware/fwupd.nix b/nixos/modules/services/hardware/fwupd.nix
index e586af25c2b1..222ac8e487eb 100644
--- a/nixos/modules/services/hardware/fwupd.nix
+++ b/nixos/modules/services/hardware/fwupd.nix
@@ -6,6 +6,23 @@ with lib;
 
 let
   cfg = config.services.fwupd;
+
+  customEtc = {
+    "fwupd/daemon.conf" = {
+      source = pkgs.writeText "daemon.conf" ''
+        [fwupd]
+        BlacklistDevices=${lib.concatStringsSep ";" cfg.blacklistDevices}
+        BlacklistPlugins=${lib.concatStringsSep ";" cfg.blacklistPlugins}
+      '';
+    };
+    "fwupd/uefi.conf" = {
+      source = pkgs.writeText "uefi.conf" ''
+        [uefi]
+        OverrideESPMountPoint=${config.boot.loader.efi.efiSysMountPoint}
+      '';
+    };
+  };
+
   originalEtc =
     let
       mkEtcFile = n: nameValuePair n { source = "${cfg.package}/etc/${n}"; };
@@ -96,22 +113,8 @@ in {
 
     environment.systemPackages = [ cfg.package ];
 
-    environment.etc = {
-      "fwupd/daemon.conf" = {
-        source = pkgs.writeText "daemon.conf" ''
-          [fwupd]
-          BlacklistDevices=${lib.concatStringsSep ";" cfg.blacklistDevices}
-          BlacklistPlugins=${lib.concatStringsSep ";" cfg.blacklistPlugins}
-        '';
-      };
-      "fwupd/uefi.conf" = {
-        source = pkgs.writeText "uefi.conf" ''
-          [uefi]
-          OverrideESPMountPoint=${config.boot.loader.efi.efiSysMountPoint}
-        '';
-      };
-
-    } // originalEtc // extraTrustedKeys // testRemote;
+    # customEtc overrides some files from the package
+    environment.etc = originalEtc // customEtc // extraTrustedKeys // testRemote;
 
     services.dbus.packages = [ cfg.package ];
 
diff --git a/nixos/modules/services/hardware/u2f.nix b/nixos/modules/services/hardware/u2f.nix
deleted file mode 100644
index bb4b2f05f890..000000000000
--- a/nixos/modules/services/hardware/u2f.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-let
-  cfg = config.hardware.u2f;
-in {
-  options = {
-    hardware.u2f = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Enable U2F hardware support.
-        '';
-      };
-    };
-  };
-
-  config = mkIf cfg.enable {
-    services.udev.packages = [ pkgs.libu2f-host ];
-  };
-}
-
diff --git a/nixos/modules/services/mail/dovecot.nix b/nixos/modules/services/mail/dovecot.nix
index 9fbf0c19752c..51cbcbf1cbc8 100644
--- a/nixos/modules/services/mail/dovecot.nix
+++ b/nixos/modules/services/mail/dovecot.nix
@@ -125,6 +125,8 @@ let
   mailboxConfig = mailbox: ''
     mailbox "${mailbox.name}" {
       auto = ${toString mailbox.auto}
+  '' + optionalString (mailbox.autoexpunge != null) ''
+    autoexpunge = ${mailbox.autoexpunge}
   '' + optionalString (mailbox.specialUse != null) ''
     special_use = \${toString mailbox.specialUse}
   '' + "}";
@@ -132,8 +134,9 @@ let
   mailboxes = { ... }: {
     options = {
       name = mkOption {
-        type = types.strMatching ''[^"]+'';
+        type = types.nullOr (types.strMatching ''[^"]+'');
         example = "Spam";
+        default = null;
         description = "The name of the mailbox.";
       };
       auto = mkOption {
@@ -148,6 +151,15 @@ let
         example = "Junk";
         description = "Null if no special use flag is set. Other than that every use flag mentioned in the RFC is valid.";
       };
+      autoexpunge = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = "60d";
+        description = ''
+          To automatically remove all email from the mailbox which is older than the
+          specified time.
+        '';
+      };
     };
   };
 in
@@ -323,9 +335,24 @@ in
     };
 
     mailboxes = mkOption {
-      type = types.listOf (types.submodule mailboxes);
-      default = [];
-      example = [ { name = "Spam"; specialUse = "Junk"; auto = "create"; } ];
+      type = with types; let m = submodule mailboxes; in either (listOf m) (attrsOf m);
+      default = {};
+      apply = x:
+        if isList x then warn "Declaring `services.dovecot2.mailboxes' as a list is deprecated and will break eval in 21.03!" x
+        else mapAttrsToList (name: value:
+          if value.name != null
+            then throw ''
+              When specifying dovecot2 mailboxes as attributes, declaring
+              a `name'-attribute is prohibited! The name ${value.name} should
+              be the attribute key!
+            ''
+          else value // { inherit name; }
+        ) x;
+      example = literalExample ''
+        {
+          Spam = { specialUse = "Junk"; auto = "create"; };
+        }
+      '';
       description = "Configure mailboxes and auto create or subscribe them.";
     };
 
diff --git a/nixos/modules/services/misc/matrix-synapse.nix b/nixos/modules/services/misc/matrix-synapse.nix
index 8ed4bbdd031c..e982eb16fa70 100644
--- a/nixos/modules/services/misc/matrix-synapse.nix
+++ b/nixos/modules/services/misc/matrix-synapse.nix
@@ -727,5 +727,6 @@ in {
   ];
 
   meta.doc = ./matrix-synapse.xml;
+  meta.maintainers = teams.matrix.members;
 
 }
diff --git a/nixos/modules/services/networking/go-neb.nix b/nixos/modules/services/networking/go-neb.nix
new file mode 100644
index 000000000000..991ae38f30a5
--- /dev/null
+++ b/nixos/modules/services/networking/go-neb.nix
@@ -0,0 +1,53 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.go-neb;
+
+  configFile = pkgs.writeText "config.yml" (builtins.toJSON cfg.config);
+in {
+  options.services.go-neb = {
+    enable = mkEnableOption "Extensible matrix bot written in Go";
+
+    bindAddress = mkOption {
+      type = types.str;
+      description = "Port (and optionally address) to listen on.";
+      default = ":4050";
+    };
+
+    baseUrl = mkOption {
+      type = types.str;
+      description = "Public-facing endpoint that can receive webhooks.";
+    };
+
+    config = mkOption {
+      type = types.uniq types.attrs;
+      description = ''
+        Your <filename>config.yaml</filename> as a Nix attribute set.
+        See <link xlink:href="https://github.com/matrix-org/go-neb/blob/master/config.sample.yaml">config.sample.yaml</link>
+        for possible options.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.go-neb = {
+      description = "Extensible matrix bot written in Go";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      environment = {
+        BASE_URL = cfg.baseUrl;
+        BIND_ADDRESS = cfg.bindAddress;
+        CONFIG_FILE = configFile;
+      };
+
+      serviceConfig = {
+        ExecStart = "${pkgs.go-neb}/bin/go-neb";
+        DynamicUser = true;
+      };
+    };
+  };
+
+  meta.maintainers = with maintainers; [ hexa maralorn ];
+}
diff --git a/nixos/modules/services/security/physlock.nix b/nixos/modules/services/security/physlock.nix
index 61bcd84f2e64..690eb70079d8 100644
--- a/nixos/modules/services/security/physlock.nix
+++ b/nixos/modules/services/security/physlock.nix
@@ -107,6 +107,7 @@ in
                 ++ cfg.lockOn.extraTargets;
         before   = optional cfg.lockOn.suspend   "systemd-suspend.service"
                 ++ optional cfg.lockOn.hibernate "systemd-hibernate.service"
+                ++ optional (cfg.lockOn.hibernate || cfg.lockOn.suspend) "systemd-suspend-then-hibernate.service"
                 ++ cfg.lockOn.extraTargets;
         serviceConfig = {
           Type = "forking";
diff --git a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
index f48a085ce57a..d8baed65c6df 100644
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
@@ -47,9 +47,9 @@ def write_loader_conf(profile, generation):
         if "@timeout@" != "":
             f.write("timeout @timeout@\n")
         if profile:
-            f.write("default nixos-%s-generation-%d\n" % (profile, generation))
+            f.write("default nixos-%s-generation-%d.conf\n".format(profile, generation))
         else:
-            f.write("default nixos-generation-%d\n" % (generation))
+            f.write("default nixos-generation-%d.conf\n".format(generation))
         if not @editor@:
             f.write("editor 0\n");
         f.write("console-mode @consoleMode@\n");
@@ -197,6 +197,22 @@ def main():
             subprocess.check_call(["@systemd@/bin/bootctl", "--path=@efiSysMountPoint@", "install"])
         else:
             subprocess.check_call(["@systemd@/bin/bootctl", "--path=@efiSysMountPoint@", "--no-variables", "install"])
+    else:
+        # Update bootloader to latest if needed
+        systemd_version = subprocess.check_output(["@systemd@/bin/bootctl", "--version"], universal_newlines=True).split()[1]
+        sdboot_status = subprocess.check_output(["@systemd@/bin/bootctl", "--path=@efiSysMountPoint@", "status"], universal_newlines=True)
+
+        # See status_binaries() in systemd bootctl.c for code which generates this
+        m = re.search("^\W+File:.*/EFI/(BOOT|systemd)/.*\.efi \(systemd-boot (\d+)\)$",
+                      sdboot_status, re.IGNORECASE | re.MULTILINE)
+        if m is None:
+            print("could not find any previously installed systemd-boot")
+        else:
+            sdboot_version = m.group(2)
+            if systemd_version > sdboot_version:
+                print("updating systemd-boot from %s to %s" % (sdboot_version, systemd_version))
+                subprocess.check_call(["@systemd@/bin/bootctl", "--path=@efiSysMountPoint@", "update"])
+
 
     mkdir_p("@efiSysMountPoint@/efi/nixos")
     mkdir_p("@efiSysMountPoint@/loader/entries")
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 99892a28115c..a8e51fc09014 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -826,8 +826,13 @@ in
   config = {
 
     warnings = concatLists (mapAttrsToList (name: service:
-      optional (service.serviceConfig.Type or "" == "oneshot" && service.serviceConfig.Restart or "no" != "no")
-        "Service ‘${name}.service’ with ‘Type=oneshot’ must have ‘Restart=no’") cfg.services);
+      let
+        type = service.serviceConfig.Type or "";
+        restart = service.serviceConfig.Restart or "no";
+      in optional
+      (type == "oneshot" && (restart == "always" || restart == "on-success"))
+      "Service '${name}.service' with 'Type=oneshot' cannot have 'Restart=always' or 'Restart=on-success'")
+      cfg.services);
 
     system.build.units = cfg.units;
 
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index b8d0606be7c1..be06d6feb11f 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -448,7 +448,7 @@ in
         description =
           ''
             An alternate BIOS (such as <package>qboot</package>) with which to start the VM.
-            Should containin a file named <literal>bios.bin</literal>.
+            Should contain a file named <literal>bios.bin</literal>.
             If <literal>null</literal>, QEMU's builtin SeaBIOS will be used.
           '';
       };
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 1bf091b361cb..bd26fc906aaa 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -119,6 +119,7 @@ in
   installed-tests = pkgs.recurseIntoAttrs (handleTest ./installed-tests {});
   gocd-agent = handleTest ./gocd-agent.nix {};
   gocd-server = handleTest ./gocd-server.nix {};
+  go-neb = handleTest ./go-neb.nix {};
   google-oslogin = handleTest ./google-oslogin {};
   grafana = handleTest ./grafana.nix {};
   graphite = handleTest ./graphite.nix {};
diff --git a/nixos/tests/go-neb.nix b/nixos/tests/go-neb.nix
new file mode 100644
index 000000000000..d9e5db0b4a53
--- /dev/null
+++ b/nixos/tests/go-neb.nix
@@ -0,0 +1,44 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+{
+  name = "go-neb";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ hexa maralorn ];
+  };
+
+  nodes = {
+    server = {
+      services.go-neb = {
+        enable = true;
+        baseUrl = "http://localhost";
+        config = {
+          clients = [ {
+            UserId = "@test:localhost";
+            AccessToken = "changeme";
+            HomeServerUrl = "http://localhost";
+            Sync = false;
+            AutoJoinRooms = false;
+            DisplayName = "neverbeseen";
+          } ];
+          services = [ {
+            ID = "wikipedia_service";
+            Type = "wikipedia";
+            UserID = "@test:localhost";
+            Config = { };
+          } ];
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+    server.wait_for_unit("go-neb.service")
+    server.wait_until_succeeds(
+        "curl -L http://localhost:4050/services/hooks/d2lraXBlZGlhX3NlcnZpY2U"
+    )
+    server.wait_until_succeeds(
+        "journalctl -eu go-neb -o cat | grep -q service_id=wikipedia_service"
+    )
+  '';
+
+})
diff --git a/nixos/tests/matrix-synapse.nix b/nixos/tests/matrix-synapse.nix
index f3623aa3c094..9ca808721763 100644
--- a/nixos/tests/matrix-synapse.nix
+++ b/nixos/tests/matrix-synapse.nix
@@ -29,8 +29,8 @@ import ./make-test-python.nix ({ pkgs, ... } : let
 in {
 
   name = "matrix-synapse";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ corngood ];
+  meta = with pkgs.stdenv.lib; {
+    maintainers = teams.matrix.members;
   };
 
   nodes = {
diff --git a/nixos/tests/systemd-boot.nix b/nixos/tests/systemd-boot.nix
index e911c3933616..eba4729d6de8 100644
--- a/nixos/tests/systemd-boot.nix
+++ b/nixos/tests/systemd-boot.nix
@@ -6,26 +6,53 @@
 with import ../lib/testing-python.nix { inherit system pkgs; };
 with pkgs.lib;
 
-makeTest {
-  name = "systemd-boot";
-  meta.maintainers = with pkgs.stdenv.lib.maintainers; [ danielfullmer ];
-
-  machine = { pkgs, lib, ... }: {
+let
+  common = {
     virtualisation.useBootLoader = true;
     virtualisation.useEFIBoot = true;
     boot.loader.systemd-boot.enable = true;
   };
+in
+{
+  basic = makeTest {
+    name = "systemd-boot";
+    meta.maintainers = with pkgs.stdenv.lib.maintainers; [ danielfullmer ];
+
+    machine = common;
+
+    testScript = ''
+      machine.start()
+      machine.wait_for_unit("multi-user.target")
 
-  testScript = ''
-    machine.start()
-    machine.wait_for_unit("multi-user.target")
+      machine.succeed("test -e /boot/loader/entries/nixos-generation-1.conf")
+
+      # Ensure we actually booted using systemd-boot
+      # Magic number is the vendor UUID used by systemd-boot.
+      machine.succeed(
+          "test -e /sys/firmware/efi/efivars/LoaderEntrySelected-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f"
+      )
+    '';
+  };
 
-    machine.succeed("test -e /boot/loader/entries/nixos-generation-1.conf")
+  update = makeTest {
+    name = "systemd-boot-update";
+    meta.maintainers = with pkgs.stdenv.lib.maintainers; [ danielfullmer ];
 
-    # Ensure we actually booted using systemd-boot.
-    # Magic number is the vendor UUID used by systemd-boot.
-    machine.succeed(
-        "test -e /sys/firmware/efi/efivars/LoaderEntrySelected-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f"
-    )
-  '';
+    machine = common;
+
+    testScript = ''
+      machine.succeed("mount -o remount,rw /boot")
+
+      # Replace version inside sd-boot with something older. See magic[] string in systemd src/boot/efi/boot.c
+      machine.succeed(
+          """
+        find /boot -iname '*.efi' -print0 | \
+        xargs -0 -I '{}' sed -i 's/#### LoaderInfo: systemd-boot .* ####/#### LoaderInfo: systemd-boot 001 ####/' '{}'
+      """
+      )
+
+      output = machine.succeed("/run/current-system/bin/switch-to-configuration boot")
+      assert "updating systemd-boot from 001 to " in output
+    '';
+  };
 }
diff --git a/pkgs/applications/audio/amarok/default.nix b/pkgs/applications/audio/amarok/default.nix
index 29d97d8bc8ab..063cfcaa9fae 100644
--- a/pkgs/applications/audio/amarok/default.nix
+++ b/pkgs/applications/audio/amarok/default.nix
@@ -3,21 +3,21 @@
 , qca-qt5, qjson, qtquickcontrols2, qtscript, qtwebengine
 , karchive, kcmutils, kconfig, kdnssd, kguiaddons, kinit, kirigami2, knewstuff, knotifyconfig, ktexteditor, kwindowsystem
 , fftw, phonon, plasma-framework, threadweaver
-, curl, ffmpeg_3, gdk-pixbuf, libaio, libmtp, loudmouth, lzo, lz4, mysql57, pcre, snappy, taglib, taglib_extras
+, curl, ffmpeg_3, gdk-pixbuf, libaio, liblastfm, libmtp, loudmouth, lzo, lz4, mysql57, pcre, snappy, taglib, taglib_extras
 }:
 
 mkDerivation rec {
-  pname = "amarok";
-  version = "2.9.0-20190824";
+  pname = "amarok-unstable";
+  version = "2020-06-12";
 
   src = fetchgit {
     # master has the Qt5 version as of April 2018 but a formal release has not
     # yet been made so change this back to the proper upstream when such a
     # release is out
-    url    = "git://anongit.kde.org/amarok.git";
+    url    = "https://invent.kde.org/multimedia/amarok.git";
     # url = "mirror://kde/stable/${pname}/${version}/src/${name}.tar.xz";
-    rev    = "457fbda25a85a102bfda92aa7137e7ef5e4c8b00";
-    sha256 = "1ig2mg8pqany6m2zplkrvldcv4ibxwsypnyv5igm7nz7ax82cd5j";
+    rev    = "fece39b0e81db310b6a6e08f93d83b0d498cd02b";
+    sha256 = "12casnq6w5yp2jlvnr466pjpkn0vriry8jzfq2qkjl564y0vhy9x";
   };
 
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
@@ -26,7 +26,7 @@ mkDerivation rec {
     qca-qt5 qjson qtquickcontrols2 qtscript qtwebengine
     karchive kcmutils kconfig kdnssd kguiaddons kinit kirigami2 knewstuff knotifyconfig ktexteditor kwindowsystem
     phonon plasma-framework threadweaver
-    curl fftw ffmpeg_3 gdk-pixbuf libaio libmtp loudmouth lz4 lzo mysql57.server mysql57.server.static
+    curl fftw ffmpeg_3 gdk-pixbuf libaio liblastfm libmtp loudmouth lz4 lzo mysql57.server mysql57.server.static
     pcre snappy taglib taglib_extras
   ];
 
diff --git a/pkgs/applications/audio/asunder/default.nix b/pkgs/applications/audio/asunder/default.nix
index 7d90ac36f366..998535a8eb0b 100644
--- a/pkgs/applications/audio/asunder/default.nix
+++ b/pkgs/applications/audio/asunder/default.nix
@@ -12,11 +12,11 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  version = "2.9.5";
+  version = "2.9.6";
   pname = "asunder";
   src = fetchurl {
     url = "http://littlesvr.ca/asunder/releases/${pname}-${version}.tar.bz2";
-    sha256 = "069x6az2r3wlb2hd07iz0hxpxwknw7s9h7pyhnkmzv1pw9ci3kk4";
+    sha256 = "1ycnd82lh7qy1pcbngd4b41s16j9hnm2kyfrncg4cwr3bfk7yg7a";
   };
 
   nativeBuildInputs = [ intltool makeWrapper pkgconfig ];
diff --git a/pkgs/applications/audio/ft2-clone/default.nix b/pkgs/applications/audio/ft2-clone/default.nix
index c5661f3336f7..acf373fc41af 100644
--- a/pkgs/applications/audio/ft2-clone/default.nix
+++ b/pkgs/applications/audio/ft2-clone/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ft2-clone";
-  version = "1.24";
+  version = "1.25_fix";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "ft2-clone";
     rev = "v${version}";
-    sha256 = "0wb7xsc2m9f4q5zsf5ai6h6c0558lkziv30b5a8ic64wp0layr6k";
+    sha256 = "0q2mcp3xpgwilmiwzr9nnxlyg9c1kynh6cxzlyd95n520j00s6i7";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/audio/jamulus/default.nix b/pkgs/applications/audio/jamulus/default.nix
index 835e786353c5..498d980676d7 100644
--- a/pkgs/applications/audio/jamulus/default.nix
+++ b/pkgs/applications/audio/jamulus/default.nix
@@ -3,12 +3,12 @@
 
 mkDerivation rec {
   pname = "jamulus";
-  version = "3.5.5";
+  version = "3.5.6";
   src = fetchFromGitHub {
     owner = "corrados";
     repo = "jamulus";
     rev = "r${stdenv.lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "04h0nwlj71qbp7h4yn8djqchrf47jk8rab9zp9bh9pnkcyv60h27";
+    sha256 = "00vd6kffsf3vqfwaxjvln63x3n0q32f385qc51fn5iyj54410x0f";
   };
 
   nativeBuildInputs = [ pkg-config qmake ];
diff --git a/pkgs/applications/audio/munt/default.nix b/pkgs/applications/audio/munt/default.nix
index c9a1e9bea808..bf9710fb17ee 100644
--- a/pkgs/applications/audio/munt/default.nix
+++ b/pkgs/applications/audio/munt/default.nix
@@ -9,14 +9,14 @@ let
     categories = "Audio;AudioVideo;";
   };
 in mkDerivation rec {
-  version = "2.3.0";
+  version = "2.4.0";
   pname = "munt";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = with stdenv.lib.versions; "${pname}_${major version}_${minor version}_${patch version}";
-    sha256 = "0fjhshs4w942rlfksalalqshflbq83pyz1z0hcq53falh9v54cyw";
+    rev = with stdenv.lib.versions; "libmt32emu_${major version}_${minor version}_${patch version}";
+    sha256 = "0521i7js5imlsxj6n7181w5szfjikam0k4vq1d2ilkqgcwrkg6ln";
   };
 
   postInstall = ''
@@ -31,7 +31,7 @@ in mkDerivation rec {
   meta = with stdenv.lib; {
     description = "Multi-platform software synthesiser emulating Roland MT-32, CM-32L, CM-64 and LAPC-I devices";
     homepage = "http://munt.sourceforge.net/";
-    license = licenses.gpl2;
+    license = with licenses; [ lgpl21 gpl3 ];
     platforms = platforms.linux;
     maintainers = with maintainers; [ gnidorah ];
   };
diff --git a/pkgs/applications/audio/pt2-clone/default.nix b/pkgs/applications/audio/pt2-clone/default.nix
index b72406b064dd..8121c0caeec8 100644
--- a/pkgs/applications/audio/pt2-clone/default.nix
+++ b/pkgs/applications/audio/pt2-clone/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pt2-clone";
-  version = "1.17";
+  version = "1.19";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "pt2-clone";
     rev = "v${version}";
-    sha256 = "0paagzc1c7gdnvs2wwsw2h15d0x8a7fl995qq3pi06g8kmdm85pi";
+    sha256 = "0lr8gq4immc5cx1wr5ng6ccxs9afbd2dk6i0n5np25z14dvbvk3k";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/audio/pulseaudio-modules-bt/default.nix b/pkgs/applications/audio/pulseaudio-modules-bt/default.nix
index 49cc83189359..556dd5f10619 100644
--- a/pkgs/applications/audio/pulseaudio-modules-bt/default.nix
+++ b/pkgs/applications/audio/pulseaudio-modules-bt/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , pulseaudio
 , pkgconfig
-, ffmpeg_4
+, ffmpeg
 , patchelf
 , fdk_aac
 , libtool
@@ -45,7 +45,7 @@ in stdenv.mkDerivation rec {
 
   buildInputs = [
     pulseaudio
-    ffmpeg_4
+    ffmpeg
     fdk_aac
     libtool
     ldacbt
@@ -72,7 +72,7 @@ in stdenv.mkDerivation rec {
     for so in $out/lib/pulse-${pulseaudio.version}/modules/*.so; do
       orig_rpath=$(patchelf --print-rpath "$so")
       patchelf \
-        --set-rpath "${ldacbt}/lib:${lib.getLib ffmpeg_4}/lib:$out/lib/pulse-${pulseaudio.version}/modules:$orig_rpath" \
+        --set-rpath "${ldacbt}/lib:${lib.getLib ffmpeg}/lib:$out/lib/pulse-${pulseaudio.version}/modules:$orig_rpath" \
         "$so"
     done
   '';
diff --git a/pkgs/applications/audio/spek/default.nix b/pkgs/applications/audio/spek/default.nix
index 88b22c59ae50..d6918b192315 100644
--- a/pkgs/applications/audio/spek/default.nix
+++ b/pkgs/applications/audio/spek/default.nix
@@ -1,27 +1,28 @@
-{ stdenv, fetchzip, autoconf, automake, intltool, pkgconfig, ffmpeg, wxGTK }:
+{ stdenv, fetchFromGitHub, autoreconfHook, intltool, pkgconfig, ffmpeg, wxGTK30-gtk3, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   pname = "spek";
-  version = "0.8.3";
+  version = "unstable-2018-12-29";
 
-  src = fetchzip {
-    name = "${pname}-${version}-src";
-    url = "https://github.com/alexkay/spek/archive/v${version}.tar.gz";
-    sha256 = "0y4hlhswpqkqpsglrhg5xbfy1a6f9fvasgdf336vhwcjqsc3k2xv";
+  src = fetchFromGitHub {
+    owner = "alexkay";
+    repo = "spek";
+    rev = "f071c2956176ad53c7c8059e5c00e694ded31ded";
+    sha256 = "1l9gj9c1n92zlcjnyjyk211h83dk0idk644xnm5rs7q40p2zliy5";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ autoconf automake intltool ffmpeg wxGTK ];
+  # needed for autoreconfHook
+  AUTOPOINT="intltoolize --automake --copy";
 
-  preConfigure = ''
-    ./autogen.sh
-  '';
+  nativeBuildInputs = [ autoreconfHook intltool pkgconfig wrapGAppsHook ];
+
+  buildInputs = [ ffmpeg wxGTK30-gtk3 wxGTK30-gtk3.gtk ];
 
   meta = with stdenv.lib; {
     description = "Analyse your audio files by showing their spectrogram";
     homepage = "http://spek.cc/";
     license = licenses.gpl3;
+    maintainers = with maintainers; [ bjornfor ];
     platforms = platforms.all;
-    maintainers = [ maintainers.bjornfor ];
   };
 }
diff --git a/pkgs/applications/audio/strawberry/default.nix b/pkgs/applications/audio/strawberry/default.nix
index dce73c386707..4a195b4c3456 100644
--- a/pkgs/applications/audio/strawberry/default.nix
+++ b/pkgs/applications/audio/strawberry/default.nix
@@ -35,13 +35,13 @@
 
 mkDerivation rec {
   pname = "strawberry";
-  version = "0.6.10";
+  version = "0.6.12";
 
   src = fetchFromGitHub {
     owner = "jonaski";
     repo = pname;
     rev = version;
-    sha256 = "0qf510hlxbndqzwq62mdzfclqxr3caf1a34kd770k84x8vrb4pld";
+    sha256 = "0p09xp7andfg0gvarzc979pwglr0xjj1c0cziqj0c9z7p1v0fkws";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/blockchains/bitcoin.nix b/pkgs/applications/blockchains/bitcoin.nix
index 450102da66f3..7a4386d23866 100644
--- a/pkgs/applications/blockchains/bitcoin.nix
+++ b/pkgs/applications/blockchains/bitcoin.nix
@@ -1,59 +1,74 @@
-{ stdenv, fetchurl, pkgconfig, autoreconfHook, openssl, db48, boost, zeromq, rapidcheck, hexdump
-, zlib, miniupnpc, qtbase ? null, qttools ? null, wrapQtAppsHook ? null, utillinux, python3, qrencode, libevent
-, withGui }:
+{ stdenv
+, fetchurl
+, pkgconfig
+, autoreconfHook
+, db48
+, boost
+, zeromq
+, hexdump
+, zlib
+, miniupnpc
+, qtbase ? null
+, qttools ? null
+, wrapQtAppsHook ? null
+, utillinux
+, python3
+, qrencode
+, libevent
+, withGui
+}:
 
 with stdenv.lib;
-
 let
-  version = "0.19.1";
+  version = "0.20.0";
   majorMinorVersion = versions.majorMinor version;
-
   desktop = fetchurl {
     url = "https://raw.githubusercontent.com/bitcoin-core/packaging/${majorMinorVersion}/debian/bitcoin-qt.desktop";
     sha256 = "0cpna0nxcd1dw3nnzli36nf9zj28d2g9jf5y0zl9j18lvanvniha";
   };
-
   pixmap = fetchurl {
     url = "https://raw.githubusercontent.com/bitcoin/bitcoin/v${version}/share/pixmaps/bitcoin128.png";
     sha256 = "08p7j7dg50jlj783kkgdw037klmx0spqjikaprmbkzgcb620r25d";
   };
-
-in stdenv.mkDerivation rec {
+in
+stdenv.mkDerivation rec {
   pname = if withGui then "bitcoin" else "bitcoind";
   inherit version;
 
   src = fetchurl {
-    urls = [ "https://bitcoincore.org/bin/bitcoin-core-${version}/bitcoin-${version}.tar.gz"
-             "https://bitcoin.org/bin/bitcoin-core-${version}/bitcoin-${version}.tar.gz"
-           ];
-    sha256 = "f2591d555b8e8c2e1bd780e40d53a91e165d8b3c7e0391ae2d24a0c0f23a7cc0";
+    urls = [
+      "https://bitcoincore.org/bin/bitcoin-core-${version}/bitcoin-${version}.tar.gz"
+      "https://bitcoin.org/bin/bitcoin-core-${version}/bitcoin-${version}.tar.gz"
+    ];
+    sha256 = "ec5a2358ee868d845115dc4fc3ed631ff063c57d5e0a713562d083c5c45efb28";
   };
 
   nativeBuildInputs =
     [ pkgconfig autoreconfHook ]
     ++ optional stdenv.isDarwin hexdump
     ++ optional withGui wrapQtAppsHook;
-  buildInputs = [ openssl db48 boost zlib zeromq
-                  miniupnpc libevent]
-                  ++ optionals stdenv.isLinux [ utillinux ]
-                  ++ optionals withGui [ qtbase qttools qrencode ];
+  buildInputs = [ db48 boost zlib zeromq miniupnpc libevent ]
+    ++ optionals stdenv.isLinux [ utillinux ]
+    ++ optionals withGui [ qtbase qttools qrencode ];
 
   postInstall = optional withGui ''
     install -Dm644 ${desktop} $out/share/applications/bitcoin-qt.desktop
     install -Dm644 ${pixmap} $out/share/pixmaps/bitcoin128.png
   '';
 
-  configureFlags = [ "--with-boost-libdir=${boost.out}/lib"
-                     "--disable-bench"
-                   ] ++ optionals (!doCheck) [
-                     "--disable-tests"
-                     "--disable-gui-tests"
-                   ]
-                     ++ optionals withGui [ "--with-gui=qt5"
-                                            "--with-qt-bindir=${qtbase.dev}/bin:${qttools.dev}/bin"
-                                          ];
+  configureFlags = [
+    "--with-boost-libdir=${boost.out}/lib"
+    "--disable-bench"
+  ] ++ optionals (!doCheck) [
+    "--disable-tests"
+    "--disable-gui-tests"
+  ]
+  ++ optionals withGui [
+    "--with-gui=qt5"
+    "--with-qt-bindir=${qtbase.dev}/bin:${qttools.dev}/bin"
+  ];
 
-  checkInputs = [ rapidcheck python3 ];
+  checkInputs = [ python3 ];
 
   doCheck = true;
 
@@ -67,13 +82,15 @@ in stdenv.mkDerivation rec {
 
   meta = {
     description = "Peer-to-peer electronic cash system";
-    longDescription= ''
+    longDescription = ''
       Bitcoin is a free open source peer-to-peer electronic cash system that is
       completely decentralized, without the need for a central server or trusted
       parties. Users hold the crypto keys to their own money and transact directly
       with each other, with the help of a P2P network to check for double-spending.
     '';
     homepage = "https://bitcoin.org/";
+    downloadPage = "https://bitcoincore.org/bin/bitcoin-core-${version}/";
+    changelog = "https://bitcoincore.org/en/releases/${version}/";
     maintainers = with maintainers; [ roconnor AndersonTorres ];
     license = licenses.mit;
     platforms = platforms.unix;
diff --git a/pkgs/applications/blockchains/ergo/default.nix b/pkgs/applications/blockchains/ergo/default.nix
index bae7326c2554..29990dae4049 100644
--- a/pkgs/applications/blockchains/ergo/default.nix
+++ b/pkgs/applications/blockchains/ergo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ergo";
-  version = "3.2.5";
+  version = "3.2.6";
 
   src = fetchurl {
     url = "https://github.com/ergoplatform/ergo/releases/download/v${version}/ergo-${version}.jar";
-    sha256 = "0vaq6cqz03ps0fg3rvk298jnbf8mazvmyfcj7zsf1cgw41xdjjcf";
+    sha256 = "1a38j7dy6ax9xvcjbdkiz0z33ln4rlmgrxznvqhdf11j70g1sr6x";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/blockchains/litecoin.nix b/pkgs/applications/blockchains/litecoin.nix
index ec1658b595d3..22cfa3dbb91e 100644
--- a/pkgs/applications/blockchains/litecoin.nix
+++ b/pkgs/applications/blockchains/litecoin.nix
@@ -13,13 +13,13 @@ with stdenv.lib;
 mkDerivation rec {
 
   name = "litecoin" + (toString (optional (!withGui) "d")) + "-" + version;
-  version = "0.17.1";
+  version = "0.18.1";
 
   src = fetchFromGitHub {
     owner = "litecoin-project";
     repo = "litecoin";
     rev = "v${version}";
-    sha256 = "08a0ghs4aa9m3qv3ppydyshfibykdwxk07i1vcqvg0ycqisdpb7y";
+    sha256 = "11753zhyx1kmrlljc6kbjwrcb06dfcrsqvmw3iaki9a132qk6l5c";
   };
 
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
diff --git a/pkgs/applications/blockchains/namecoin.nix b/pkgs/applications/blockchains/namecoin.nix
index 02f2249862d0..d52d87b9571c 100644
--- a/pkgs/applications/blockchains/namecoin.nix
+++ b/pkgs/applications/blockchains/namecoin.nix
@@ -3,14 +3,14 @@
 
 with stdenv.lib;
 stdenv.mkDerivation rec {
-  version = "nc0.19.1";
+  version = "nc0.20.0";
   name = "namecoin" + toString (optional (!withGui) "d") + "-" + version;
 
   src = fetchFromGitHub {
     owner = "namecoin";
     repo = "namecoin-core";
     rev = version;
-    sha256 = "13rdvngrl2w0gk7km3sd9fy8yxzgxlkcwn50ajsbrhgzl8kx4q7m";
+    sha256 = "115nlsq5g169mj4qjmkhxx1bnx740871zqyng9zbm2y4i0xf71c4";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/editors/atom/default.nix b/pkgs/applications/editors/atom/default.nix
index fbe08dbfe7b7..dec3c7955011 100644
--- a/pkgs/applications/editors/atom/default.nix
+++ b/pkgs/applications/editors/atom/default.nix
@@ -3,14 +3,14 @@
 let
   versions = {
     atom = {
-      version = "1.42.0";
-      sha256 = "1ira528nwxi30jfwyivlac3wkkqb9d2z4jhxwq5m7mnpm5yli6jy";
+      version = "1.48.0";
+      sha256 = "1693bxbylf6jhld9bdcr5pigk36wqlbj89praldpz9s96yxig9s1";
     };
 
     atom-beta = {
-      version = "1.43.0";
+      version = "1.49.0";
       beta = 0;
-      sha256 = "06if3w5hx7njmyal0012zawn8f5af1z4bjcbzj2c0gd15nlsgm95";
+      sha256 = "1fr6m4a7shdj3wpn6g4n95cqpkkg2x9srwjf7bqxv9f3d5jb1y33";
     };
   };
 
diff --git a/pkgs/applications/editors/atom/env.nix b/pkgs/applications/editors/atom/env.nix
index cf783053679a..5e3c1070ad2b 100644
--- a/pkgs/applications/editors/atom/env.nix
+++ b/pkgs/applications/editors/atom/env.nix
@@ -1,6 +1,7 @@
 { stdenv, lib, zlib, glib, alsaLib, dbus, gtk3, atk, pango, freetype, fontconfig
 , libgnome-keyring3, gdk-pixbuf, cairo, cups, expat, libgpgerror, nspr
 , gconf, nss, xorg, libcap, systemd, libnotify, libsecret, libuuid, at-spi2-atk
+, at-spi2-core
 }:
 
 let
@@ -10,7 +11,7 @@ let
     xorg.libXrender xorg.libX11 xorg.libXext xorg.libXdamage xorg.libXtst
     xorg.libXcomposite xorg.libXi xorg.libXfixes xorg.libXrandr
     xorg.libXcursor xorg.libxkbfile xorg.libXScrnSaver libcap systemd libnotify
-    xorg.libxcb libsecret libuuid at-spi2-atk
+    xorg.libxcb libsecret libuuid at-spi2-atk at-spi2-core
   ];
 
   libPathNative = lib.makeLibraryPath packages;
diff --git a/pkgs/applications/editors/kdevelop5/kdev-python.nix b/pkgs/applications/editors/kdevelop5/kdev-python.nix
index 80a5436c9556..9fb251d52957 100644
--- a/pkgs/applications/editors/kdevelop5/kdev-python.nix
+++ b/pkgs/applications/editors/kdevelop5/kdev-python.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "kdev-python";
-  version = "5.5.1";
+  version = "5.5.2";
 
   src = fetchurl {
     url = "https://github.com/KDE/${pname}/archive/v${version}.tar.gz";
-    sha256 = "0k4j2kp77sz2p8s77wmcawia81bx7vfb2nnh9lqxzdk2mmlg387c";
+    sha256 = "1qxvsz19iv5fr0nvz75b13knmsbkhkgvlvrhip8y4j66ypscs652";
   };
 
   cmakeFlags = [
diff --git a/pkgs/applications/editors/kdevelop5/kdevelop.nix b/pkgs/applications/editors/kdevelop5/kdevelop.nix
index 476819369cf1..e07e7300048a 100644
--- a/pkgs/applications/editors/kdevelop5/kdevelop.nix
+++ b/pkgs/applications/editors/kdevelop5/kdevelop.nix
@@ -10,11 +10,11 @@
 
 mkDerivation rec {
   pname = "kdevelop";
-  version = "5.5.1";
+  version = "5.5.2";
 
   src = fetchurl {
     url = "mirror://kde/stable/${pname}/${version}/src/${pname}-${version}.tar.xz";
-    sha256 = "18hxwkdbfw0qs3p19jv6d8wwwdzb9m087891i8w2bzkn21fd5pmy";
+    sha256 = "1nkl3z1n1l7ly2zvmbx2sdhx5q72wcvpwhzsz3qgw1474qd9i3i2";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/editors/vis/default.nix b/pkgs/applications/editors/vis/default.nix
index 85f78035a0f3..5191b916b6c5 100644
--- a/pkgs/applications/editors/vis/default.nix
+++ b/pkgs/applications/editors/vis/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "vis";
-  version  = "0.5";
+  version  = "0.6";
 
   src = fetchFromGitHub {
     rev = "v${version}";
-    sha256 = "1vhq6hprkgj90iwl5vl3pxs3xwc01mx8yhi6c1phzry5agqqp8jb";
+    sha256 = "1zjm89cn3rfq8fxpwp66khy53s6vqlmw6q103qyyvix8ydzxdmsh";
     repo = "vis";
     owner = "martanne";
   };
diff --git a/pkgs/applications/graphics/avocode/default.nix b/pkgs/applications/graphics/avocode/default.nix
index 098aee119e60..fa97ceb5eb2f 100644
--- a/pkgs/applications/graphics/avocode/default.nix
+++ b/pkgs/applications/graphics/avocode/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "avocode";
-  version = "4.6.4";
+  version = "4.7.0";
 
   src = fetchurl {
     url = "https://media.avocode.com/download/avocode-app/${version}/avocode-${version}-linux.zip";
-    sha256 = "1hkqv2lix58my009i61cy0vpazxqpzapfhxkw5439ndn6qk1782d";
+    sha256 = "0kn0422k4vi2qifasnkd0cjf5l6z0rmkqv6l46ygxk3qyykjnqcm";
   };
 
   libPath = stdenv.lib.makeLibraryPath (with xorg; [
diff --git a/pkgs/applications/graphics/feh/default.nix b/pkgs/applications/graphics/feh/default.nix
index cecd2a3776d3..4782d9201480 100644
--- a/pkgs/applications/graphics/feh/default.nix
+++ b/pkgs/applications/graphics/feh/default.nix
@@ -1,6 +1,7 @@
 { stdenv, fetchurl, makeWrapper
 , xorg, imlib2, libjpeg, libpng
-, curl, libexif, jpegexiforient, perlPackages }:
+, curl, libexif, jpegexiforient, perlPackages
+, enableAutoreload ? true }:
 
 with stdenv.lib;
 
@@ -21,7 +22,8 @@ stdenv.mkDerivation rec {
 
   makeFlags = [
     "PREFIX=${placeholder "out"}" "exif=1"
-  ] ++ optional stdenv.isDarwin "verscmp=0";
+  ] ++ optional stdenv.isDarwin "verscmp=0"
+    ++ optional enableAutoreload "inotify=1";
 
   installTargets = [ "install" ];
   postInstall = ''
diff --git a/pkgs/applications/graphics/goxel/default.nix b/pkgs/applications/graphics/goxel/default.nix
index 6fb5b91c2a92..40d0f4a3db8a 100644
--- a/pkgs/applications/graphics/goxel/default.nix
+++ b/pkgs/applications/graphics/goxel/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "goxel";
-  version = "0.10.5";
+  version = "0.10.6";
 
   src = fetchFromGitHub {
     owner = "guillaumechereau";
     repo = "goxel";
     rev = "v${version}";
-    sha256 = "1b63jqryq19qa81g1ml6d85f27wj1ci3h56r02cl9xn8di5p674f";
+    sha256 = "1wmxy5wfk1xrqgz0y0zcr4vkddylqc70cv4vzk117x6whjnldsm3";
   };
 
   patches = [ ./disable-imgui_ini.patch ];
diff --git a/pkgs/applications/graphics/krop/default.nix b/pkgs/applications/graphics/krop/default.nix
index 2337dfb370ef..ee4906769770 100644
--- a/pkgs/applications/graphics/krop/default.nix
+++ b/pkgs/applications/graphics/krop/default.nix
@@ -2,22 +2,24 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "krop";
-  version = "0.5.1";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "arminstraub";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0b1zqpks4vzq7sfhf7r9qrshr77f1ncj18x7d0fa3g29rxa42dcr";
+    sha256 = "1ygzc7vlwszqmsd3v1dsqp1dpsn6inx7g8gck63alvf88dbn8m3s";
   };
 
   propagatedBuildInputs = with python3Packages; [
     pyqt5
     pypdf2
     poppler-qt5
-    libsForQt5.poppler
     ghostscript
   ];
+  buildInputs = [
+    libsForQt5.poppler
+  ];
 
   nativeBuildInputs = [ qt5.wrapQtAppsHook ];
   makeWrapperArgs = [
diff --git a/pkgs/applications/graphics/yeetgif/default.nix b/pkgs/applications/graphics/yeetgif/default.nix
index 157ef3753e08..3ae1b98661a6 100644
--- a/pkgs/applications/graphics/yeetgif/default.nix
+++ b/pkgs/applications/graphics/yeetgif/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "yeetgif";
-  version = "1.23.5";
+  version = "1.23.6";
 
   goPackagePath = "github.com/sgreben/yeetgif";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "sgreben";
     repo = pname;
     rev = version;
-    sha256 = "1yz4pps8g378lvmi92cnci6msjj7fprp9bxqmnsyn6lqw7s2wb47";
+    sha256 = "05z1ylsra60bb4cvr383g9im94zsph1dgicqbv5p73qgs634ckk7";
   };
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/ArchiSteamFarm/default.nix b/pkgs/applications/misc/ArchiSteamFarm/default.nix
index c165003d8f8c..6201d881a882 100644
--- a/pkgs/applications/misc/ArchiSteamFarm/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/default.nix
@@ -1,27 +1,15 @@
-{ stdenv, fetchurl, unzip, makeWrapper, autoPatchelfHook
-, zlib, lttng-ust, curl, icu, openssl }:
+{ stdenv, fetchurl, unzip, makeWrapper, dotnetCorePackages, jq }:
 
 stdenv.mkDerivation rec {
   pname = "ArchiSteamFarm";
-  version = "4.2.0.6";
-
-  src = {
-    x86_64-linux = fetchurl {
-      url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-linux-x64.zip";
-      sha256 = "05hx6q1lkbjbqhwi9xxvm7ycnsnpl1cnqzyy2yn0q4x27im399cn";
-    };
-    armv7l-linux = fetchurl {
-      url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-linux-arm.zip";
-      sha256 = "0l8irqrpl5vbjj84k4makj2ph2z6kpny7qz51zrzbgwhrlw0w4vg";
-    };
-    aarch64-linux = fetchurl {
-      url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-linux-arm64.zip";
-      sha256 = "0hg2g4i8sj3fxqfy4imz1iarby1d9f8dh59j266lbbdf2vfz2cml";
-    };
-  }.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
-
-  nativeBuildInputs = [ unzip makeWrapper autoPatchelfHook ];
-  buildInputs = [ stdenv.cc.cc zlib lttng-ust curl ];
+  version = "4.2.2.1";
+
+  src = fetchurl {
+    url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-generic.zip";
+    sha256 = "0pr9rrhi44yl99c2i12rimmc4mhbh0ma9jn17cgsh8p0kbj8sq94";
+  };
+
+  nativeBuildInputs = [ unzip makeWrapper jq ];
 
   sourceRoot = ".";
 
@@ -29,23 +17,25 @@ stdenv.mkDerivation rec {
     dist=$out/opt/asf
     mkdir -p $dist
     cp -r * $dist
-    chmod +x $dist/ArchiSteamFarm
-    makeWrapper $dist/ArchiSteamFarm $out/bin/ArchiSteamFarm \
-      --prefix LD_LIBRARY_PATH : "${stdenv.lib.makeLibraryPath [ icu openssl ] }" \
+
+    jq "del(.runtimeOptions.framework.version)" ArchiSteamFarm.runtimeconfig.json > $dist/ArchiSteamFarm.runtimeconfig.json
+
+    makeWrapper ${dotnetCorePackages.aspnetcore_3_1}/bin/dotnet $out/bin/ArchiSteamFarm \
+      --add-flags $dist/ArchiSteamFarm.dll \
       --add-flags "--path ~/.config/asf" \
       --run "mkdir -p ~/.config/asf" \
       --run "cd ~/.config/asf" \
       --run "[ -d config ] || cp --no-preserve=mode -r $dist/config ." \
       --run "[ -d logs ] || cp --no-preserve=mode -r $dist/logs ." \
       --run "[ -d plugins ] || cp --no-preserve=mode -r $dist/plugins ." \
-      --run "[ -d www ] || cp --no-preserve=mode -r $dist/www ." \
+      --run "[ -d www ] || ln -sf $dist/www ."
   '';
 
   meta = with stdenv.lib; {
     description = "Application with primary purpose of idling Steam cards from multiple accounts simultaneously";
     homepage = "https://github.com/JustArchiNET/ArchiSteamFarm";
     license = licenses.asl20;
-    platforms = [ "x86_64-linux" "armv7l-linux" "aarch64-linux" ];
+    platforms = dotnetCorePackages.aspnetcore_3_1.meta.platforms;
     maintainers = with maintainers; [ gnidorah ];
     hydraPlatforms = [];
   };
diff --git a/pkgs/applications/misc/aminal/default.nix b/pkgs/applications/misc/aminal/default.nix
index dff6b15494bb..7f04a93d6a32 100644
--- a/pkgs/applications/misc/aminal/default.nix
+++ b/pkgs/applications/misc/aminal/default.nix
@@ -11,7 +11,7 @@
 
 buildGoPackage rec {
   pname = "aminal";
-  version = "0.8.6";
+  version = "0.9.0";
 
   goPackagePath = "github.com/liamg/aminal";
 
@@ -30,7 +30,7 @@ buildGoPackage rec {
     owner = "liamg";
     repo = "aminal";
     rev = "v${version}";
-    sha256 = "0qhjdckj2kr0vza6qssd9z8dfrsif1qxb1mal1d4wgdsy12lrmwl";
+    sha256 = "0syv9md7blnl6i19zf8s1xjx5vfz6s755fxyg2ply0qc1pwhsj8n";
   };
 
   preBuild = ''
diff --git a/pkgs/applications/misc/gallery-dl/default.nix b/pkgs/applications/misc/gallery-dl/default.nix
index c73a28d0febd..6b8f6aa38cf8 100644
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@@ -2,11 +2,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "gallery_dl";
-  version = "1.14.0";
+  version = "1.14.1";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "0ckqxibyf14lgl1aj5pv79bmfanacgcc96x6mdwfp2dnbvfjk71b";
+    sha256 = "0w4zmfbsr7xdymrrmdvcc0kqz11ql8j067ghlr84faqlsnx09z74";
   };
 
   doCheck = false;
diff --git a/pkgs/applications/misc/hamster/default.nix b/pkgs/applications/misc/hamster/default.nix
new file mode 100644
index 000000000000..57b36e00436e
--- /dev/null
+++ b/pkgs/applications/misc/hamster/default.nix
@@ -0,0 +1,62 @@
+{ stdenv, fetchFromGitHub, python3Packages, intltool, glib, itstool
+, wrapGAppsHook, gobject-introspection, pango, gdk-pixbuf, atk, wafHook }:
+
+python3Packages.buildPythonApplication rec {
+  pname = "hamster";
+  version = "3.0.2";
+
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "projecthamster";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "09ikiwc2izjvwqbbyp8knn190x5y4anwslkmb9k2h3r3jwrg2vd2";
+  };
+
+  nativeBuildInputs = [
+    python3Packages.setuptools
+    wrapGAppsHook
+    intltool
+    itstool
+    wafHook
+    glib
+    gobject-introspection
+  ];
+
+  buildInputs = [
+    pango
+    gdk-pixbuf
+    atk
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    pygobject3
+    pycairo
+    pyxdg
+    dbus-python
+  ];
+
+  # Setup hooks have trouble with strict deps.
+  # https://github.com/NixOS/nixpkgs/issues/56943
+  strictDeps = false;
+
+  dontWrapGApps = true;
+
+  # Arguments to be passed to `makeWrapper`, only used by buildPython*
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
+  postFixup = ''
+    wrapPythonProgramsIn $out/libexec "$out $pythonPath"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Time tracking application";
+    homepage = "http://projecthamster.org/";
+    license = licenses.gpl3Plus;
+    platforms = platforms.all;
+    maintainers = [ maintainers.fabianhauser ];
+  };
+}
diff --git a/pkgs/applications/misc/heimer/default.nix b/pkgs/applications/misc/heimer/default.nix
index f301122a92de..7709a42baee1 100644
--- a/pkgs/applications/misc/heimer/default.nix
+++ b/pkgs/applications/misc/heimer/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "heimer";
-  version = "1.15.1";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "juzzlin";
     repo = pname;
     rev = version;
-    sha256 = "13a9yfq7m8jhirb31i0mmigqb135r585zwqddknl090d88164fic";
+    sha256 = "1sxdi1an9x62q9vwv7r2761my4dva6nc63n9861swxjjk18hmmar";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -19,5 +19,6 @@ mkDerivation rec {
     homepage = "https://github.com/juzzlin/Heimer";
     license = licenses.gpl3;
     maintainers  = with maintainers; [ dtzWill ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/misc/menumaker/default.nix b/pkgs/applications/misc/menumaker/default.nix
index 22cf63e536c7..f76d6cb6b8a8 100644
--- a/pkgs/applications/misc/menumaker/default.nix
+++ b/pkgs/applications/misc/menumaker/default.nix
@@ -2,11 +2,11 @@
 
 pythonPackages.buildPythonApplication rec {
   pname = "menumaker";
-  version = "0.99.11";
+  version = "0.99.12";
 
   src = fetchurl {
     url = "mirror://sourceforge/menumaker/${pname}-${version}.tar.gz";
-    sha256 = "0dprndnhwm7b803zkp4pisiq06ic9iv8vr42in5is47jmvdim0wx";
+    sha256 = "034v5204bsgkzzk6zfa5ia63q95gln47f7hwf96yvad5hrhmd8z3";
   };
 
   format = "other";
diff --git a/pkgs/applications/misc/opentx/default.nix b/pkgs/applications/misc/opentx/default.nix
index f20d5ccdc4ac..a117ecc06a9c 100644
--- a/pkgs/applications/misc/opentx/default.nix
+++ b/pkgs/applications/misc/opentx/default.nix
@@ -6,13 +6,13 @@
 
 mkDerivation rec {
   pname = "opentx";
-  version = "2.3.7";
+  version = "2.3.9";
 
   src = fetchFromGitHub {
     owner = "opentx";
     repo = "opentx";
     rev = "release/${version}";
-    sha256 = "1wl3bk7s8h20dfys1hblzxc0br9zlwhcqlghgsbn81ki0xb6jmkf";
+    sha256 = "0kh3jdy1pgvns8lrncf61ayaq0hmsv41j8xv4r4rf17zyvjl0qph";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/misc/orca/default.nix b/pkgs/applications/misc/orca/default.nix
index 0ca4f11e548b..849e156b5292 100644
--- a/pkgs/applications/misc/orca/default.nix
+++ b/pkgs/applications/misc/orca/default.nix
@@ -35,13 +35,13 @@
 
 buildPythonApplication rec {
   pname = "orca";
-  version = "3.36.2";
+  version = "3.36.3";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0hxz8wlyjn6w3zqg1p56pwdj0p23d6vynzczklyc6n91dyvma06g";
+    sha256 = "1x0xrcyxlvcjlqp6wcsx5d951i500079wqs04scssjzwqggy330n";
   };
 
   patches = [
diff --git a/pkgs/applications/misc/polybar/default.nix b/pkgs/applications/misc/polybar/default.nix
index a793ee887243..c324a3f8be40 100644
--- a/pkgs/applications/misc/polybar/default.nix
+++ b/pkgs/applications/misc/polybar/default.nix
@@ -1,6 +1,7 @@
 { cairo, cmake, fetchFromGitHub, libXdmcp, libpthreadstubs, libxcb, pcre, pkgconfig
 , python3, stdenv, xcbproto, xcbutil, xcbutilcursor, xcbutilimage
 , xcbutilrenderutil, xcbutilwm, xcbutilxrm, makeWrapper
+, removeReferencesTo
 
 # optional packages-- override the variables ending in 'Support' to enable or
 # disable modules
@@ -74,6 +75,10 @@ stdenv.mkDerivation rec {
     '' else "";
 
     nativeBuildInputs = [
-      cmake pkgconfig
+      cmake pkgconfig removeReferencesTo
     ];
+
+    postFixup = ''
+        remove-references-to -t ${stdenv.cc} $out/bin/polybar
+    '';
 }
diff --git a/pkgs/applications/misc/pueue/default.nix b/pkgs/applications/misc/pueue/default.nix
index a51cd75e7990..db84f5fbb9bf 100644
--- a/pkgs/applications/misc/pueue/default.nix
+++ b/pkgs/applications/misc/pueue/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pueue";
-  version = "0.5.1";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "Nukesor";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1n85b41kvx7x7qdizdnq1p0zrkap4gkwnnvhh4pz6j9njxj8d9ir";
+    sha256 = "06jxj89ya91grrwxfs7l1ahy46y993kxsc8gpkxajc0j5ihax2al";
   };
 
-  cargoSha256 = "0hkkz74hllc5dzmgls6bgdxsdr871df2fn51sa3shv68ah0avxff";
+  cargoSha256 = "191j3lpd24ycissw0y2hv65i1cjzf24draamq3sxv7hv0sxcjw4d";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/misc/qmapshack/default.nix b/pkgs/applications/misc/qmapshack/default.nix
index edb5a9b37889..1a8758955cef 100644
--- a/pkgs/applications/misc/qmapshack/default.nix
+++ b/pkgs/applications/misc/qmapshack/default.nix
@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "qmapshack";
-  version = "1.14.1";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "Maproom";
     repo = pname;
     rev = "V_${version}";
-    sha256 = "0hghynb4ac98fg1pwc645zriqkghxwp8mr3jhr87pa6fh0y848py";
+    sha256 = "157bssrbwcc1w58b0v60jb3wrjf2ig4z6z6crjnpvflkqj5p8vwy";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/misc/tut/default.nix b/pkgs/applications/misc/tut/default.nix
index 30868a9900e7..7b9efb6bbe5d 100644
--- a/pkgs/applications/misc/tut/default.nix
+++ b/pkgs/applications/misc/tut/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "tut";
-  version = "0.0.8";
+  version = "0.0.9";
 
   goPackagePath = "github.com/RasmusLindroth/tut";
   goDeps = ./deps.nix;
@@ -11,7 +11,7 @@ buildGoPackage rec {
     owner = "RasmusLindroth";
     repo = pname;
     rev = version;
-    sha256 = "0wb5lf0zbhmg962p71bqlpyxn8f1n9fp1jh7y7fcg6w5mga8gqq3";
+    sha256 = "19y6brw1d6dlp2gnkdpbp261662h5j46rmiqg73cxhrlws0y0kfk";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/misc/xmrig/default.nix b/pkgs/applications/misc/xmrig/default.nix
index 8fb07b1ae79c..d4d93c77ed42 100644
--- a/pkgs/applications/misc/xmrig/default.nix
+++ b/pkgs/applications/misc/xmrig/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xmrig";
-  version = "5.11.2";
+  version = "5.11.3";
 
   src = fetchFromGitHub {
     owner = "xmrig";
     repo = "xmrig";
     rev = "v${version}";
-    sha256 = "1mhqa9jb4475phhqnkc7k1mwgkan7zp7y4z2c7n2x43r48ghxpfx";
+    sha256 = "019g64rp6g0b0w17bm9l4q5lh7szc6ai8r3bfmy98ngi929r4rl7";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/misc/xmrig/proxy.nix b/pkgs/applications/misc/xmrig/proxy.nix
index 524e2a99ae92..39cd50204095 100644
--- a/pkgs/applications/misc/xmrig/proxy.nix
+++ b/pkgs/applications/misc/xmrig/proxy.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xmrig-proxy";
-  version = "5.10.2";
+  version = "5.11.0";
 
   src = fetchFromGitHub {
     owner = "xmrig";
     repo = "xmrig-proxy";
     rev = "v${version}";
-    sha256 = "1mkamkqhqj7nbvaxdim1rbc3f5sw410wzly4ln73ackzlvdwn319";
+    sha256 = "0wwvsmanvcn0kbb5zqrj8786yg9rmdbink6rsnsm7ifak1iwvls9";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index ced9c2454b55..65dda4931422 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -1,18 +1,18 @@
 # This file is autogenerated from update.sh in the same directory.
 {
   beta = {
-    sha256 = "1di0fhhv6lljc2b50i0i8qx5y5xswgxz1bimpda790sb3b1xsdzx";
-    sha256bin64 = "1f5qwx4476l4fvbw9w2i22i080bahlf83dzzpnbny7hk831g7msw";
-    version = "84.0.4147.38";
+    sha256 = "0wsqxq8xxcafmjxsjkagysrcbr6qryiyqn6m3ysp256aam7z3d88";
+    sha256bin64 = "03jff1sdv05hbn37cw0ij0r4rils0q11lnnhxg52igg633jzwyc1";
+    version = "84.0.4147.45";
   };
   dev = {
-    sha256 = "07h3i4ab7yj05ndrqchzf3f9wr809qb3dj2gfc1653mkjmba8h07";
-    sha256bin64 = "10jdq5mr7qby0m26l5lbsqcbh9bhjdpmpbkkcvv9wm2259rwjxr5";
-    version = "85.0.4164.2";
+    sha256 = "16rmzyzjmxmhmr5yqbzqbwf5sq94iqcwlm04fkafiwcycd17nyhs";
+    sha256bin64 = "0wjmc1wdmwiq9d1f5gk4c9jkj1p116kaz9nb0hvhjf01iv07xl2m";
+    version = "85.0.4168.2";
   };
   stable = {
-    sha256 = "10vg0fmwlkzpnixhhhcwccxshqdfq7rh0ribij7wgkw42bv0bi0j";
-    sha256bin64 = "09vz7ygixs7lwlsvbby3dmc2gz0vpjwalzdh6l6apc4dngyr095k";
-    version = "83.0.4103.97";
+    sha256 = "0bvy17ymlih87n4ymnzvyn0m34ghmr1yasvy7gxv02qbw6i57lfg";
+    sha256bin64 = "00hjr5y0cczs6h2pxrigpmjiv24456948v32q7mr7x5ysr5kxpn6";
+    version = "83.0.4103.106";
   };
 }
diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index 52773bf291a6..7505e7e21967 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -2,7 +2,7 @@
 
 ## various stuff that can be plugged in
 , flashplayer, hal-flash
-, ffmpeg_4, xorg, libpulseaudio, libcanberra-gtk2, libglvnd
+, ffmpeg, xorg, libpulseaudio, libcanberra-gtk2, libglvnd
 , gnome3/*.gnome-shell*/
 , browserpass, chrome-gnome-shell, uget-integrator, plasma-browser-integration, bukubrow
 , tridactyl-native
@@ -66,7 +66,7 @@ let
           ++ extraNativeMessagingHosts
         );
       libs =   lib.optionals stdenv.isLinux [ udev libva ]
-            ++ lib.optional ffmpegSupport ffmpeg_4
+            ++ lib.optional ffmpegSupport ffmpeg
             ++ lib.optional gssSupport kerberos
             ++ lib.optional gdkWayland libglvnd
             ++ lib.optionals (cfg.enableQuakeLive or false)
diff --git a/pkgs/applications/networking/browsers/google-chrome/default.nix b/pkgs/applications/networking/browsers/google-chrome/default.nix
index e5cd08f7df7f..fb30bbfd2b6c 100644
--- a/pkgs/applications/networking/browsers/google-chrome/default.nix
+++ b/pkgs/applications/networking/browsers/google-chrome/default.nix
@@ -7,6 +7,9 @@
 , dbus, gtk2, gtk3, gdk-pixbuf, gcc-unwrapped, at-spi2-atk, at-spi2-core
 , kerberos, libdrm, mesa
 
+# Command line programs
+, coreutils
+
 # command line arguments which are always set e.g "--disable-gpu"
 , commandLineArgs ? ""
 
@@ -58,7 +61,7 @@ let
     liberation_ttf curl utillinux xdg_utils wget
     flac harfbuzz icu libpng opusWithCustomModes snappy speechd
     bzip2 libcap at-spi2-atk at-spi2-core
-    kerberos libdrm mesa
+    kerberos libdrm mesa coreutils
   ] ++ optional pulseSupport libpulseaudio
     ++ [ gtk ];
 
diff --git a/pkgs/applications/networking/browsers/kristall/default.nix b/pkgs/applications/networking/browsers/kristall/default.nix
new file mode 100644
index 000000000000..34f23f452388
--- /dev/null
+++ b/pkgs/applications/networking/browsers/kristall/default.nix
@@ -0,0 +1,30 @@
+{ lib, mkDerivation, fetchFromGitHub, qtbase, qtmultimedia }:
+
+mkDerivation rec {
+  pname = "kristall";
+  version = "0.2";
+  src = fetchFromGitHub {
+    owner = "MasterQ32";
+    repo = "kristall";
+    rev = "V" + version;
+    sha256 = "08k3rg0sa91ra0nzla5rw806nnncnyvq1s7k09k5i74fvcsnpqyp";
+  };
+
+  buildInputs = [ qtbase qtmultimedia ];
+
+  qmakeFlags = [ "src/kristall.pro" ];
+
+  installPhase = ''
+    install -Dt $out/bin kristall
+    install -D Kristall.desktop $out/share/applications/net.random-projects.kristall.desktop
+  '';
+
+  meta = with lib;
+    src.meta // {
+      description =
+        "Graphical small-internet client, supports gemini, http, https, gopher, finger";
+      homepage = "https://random-projects.net/projects/kristall.gemini";
+      maintainers = with maintainers; [ ehmry ];
+      inherit (qtmultimedia.meta) platforms;
+    };
+}
diff --git a/pkgs/applications/networking/cluster/jx/default.nix b/pkgs/applications/networking/cluster/jx/default.nix
index df39e5d86768..304a3c6fa289 100644
--- a/pkgs/applications/networking/cluster/jx/default.nix
+++ b/pkgs/applications/networking/cluster/jx/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "jx";
-  version = "2.1.31";
+  version = "2.1.65";
 
   src = fetchFromGitHub {
     owner = "jenkins-x";
     repo = "jx";
     rev = "v${version}";
-    sha256 = "1rbdmqi6m042jxd3hhqw821l567s9zzzgp0cvx8467yfi449qipn";
+    sha256 = "0zkp0z5qpqw44bjnl20xna7s251k7jsxccqnqkdqqrzmqjpkkwgx";
   };
 
-  vendorSha256 = "1jn636sv6ak6hngw4fpgxqm6gfay2ip6g3gafjb3m4adcc5n9f8s";
+  vendorSha256 = "0zi2n8fywzy87yfwcx7di74s8mx0468zmg6kwjln7mwhr6q23adf";
 
   subPackages = [ "cmd/jx" ];
 
diff --git a/pkgs/applications/networking/cluster/kube-router/default.nix b/pkgs/applications/networking/cluster/kube-router/default.nix
index a3cb55ce329c..cd946284fa77 100644
--- a/pkgs/applications/networking/cluster/kube-router/default.nix
+++ b/pkgs/applications/networking/cluster/kube-router/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "kube-router";
-  version = "0.3.1";
+  version = "0.4.0";
 
   goPackagePath = "github.com/cloudnativelabs/kube-router";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "cloudnativelabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "06azrghcxp6n4bvrqxpwhmg60qk4jqcrkl1lh1rardlzhl71lk1h";
+    sha256 = "1g1y3l87a4il9g2yrl1ryx8xfd4x220azxhr3rxm5l9vhnnjwswa";
   };
 
   buildFlagsArray = ''
diff --git a/pkgs/applications/networking/cluster/kubecfg/default.nix b/pkgs/applications/networking/cluster/kubecfg/default.nix
index bf4ec9492157..b8bef9ecc052 100644
--- a/pkgs/applications/networking/cluster/kubecfg/default.nix
+++ b/pkgs/applications/networking/cluster/kubecfg/default.nix
@@ -1,6 +1,6 @@
 { lib, buildGoPackage, fetchFromGitHub, ... }:
 
-let version = "0.13.1"; in
+let version = "0.16.0"; in
 
 buildGoPackage {
   pname = "kubecfg";
@@ -10,7 +10,7 @@ buildGoPackage {
     owner = "bitnami";
     repo = "kubecfg";
     rev = "v${version}";
-    sha256 = "0x2mg13p8r1sgqr1bbzh57kfymb8z392y43djgks2agc7rjnd45f";
+    sha256 = "1ipw7r9fyqbh1bjvk7ifmj3skh799ly90y4ph37r8mqk1wb92rz4";
   };
 
   goPackagePath = "github.com/bitnami/kubecfg";
diff --git a/pkgs/applications/networking/cluster/kubeless/default.nix b/pkgs/applications/networking/cluster/kubeless/default.nix
index 48540bffb536..5b1f12452469 100644
--- a/pkgs/applications/networking/cluster/kubeless/default.nix
+++ b/pkgs/applications/networking/cluster/kubeless/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "kubeless";
-  version = "1.0.4";
+  version = "1.0.6";
 
   src = fetchFromGitHub {
     owner = "kubeless";
     repo = "kubeless";
     rev = "v${version}";
-    sha256 = "1f5w6kn9rsaxx9nf6kzyjkzm3s9ycy1c8h78hb61v4x915xd3040";
+    sha256 = "1fcdyd1jf0yibfx9jc16m0vmazm2jymps92llh3vh5zqd36bxbyd";
   };
 
   goPackagePath = "github.com/kubeless/kubeless";
diff --git a/pkgs/applications/networking/cluster/minishift/default.nix b/pkgs/applications/networking/cluster/minishift/default.nix
index 0c932396e9e2..cd11bcbb431c 100644
--- a/pkgs/applications/networking/cluster/minishift/default.nix
+++ b/pkgs/applications/networking/cluster/minishift/default.nix
@@ -4,7 +4,7 @@
 }:
 
 let
-  version = "1.34.0";
+  version = "1.34.2";
 
   # Update these on version bumps according to Makefile
   centOsIsoVersion = "v1.15.0";
@@ -18,7 +18,7 @@ in buildGoPackage rec {
     owner = "minishift";
     repo = "minishift";
     rev = "v${version}";
-    sha256 = "0nc1g4lmz5ww6rjyyanp9vq4sj6fvi9zf9qjc4lpsmapddhjkdy7";
+    sha256 = "1xzjzmjs2ijg7zzw53v02lgrg1j82jd7ljcn6lprg01hhvfrwgg7";
   };
 
   nativeBuildInputs = [ pkgconfig go-bindata makeWrapper ];
diff --git a/pkgs/applications/networking/cluster/nomad/default.nix b/pkgs/applications/networking/cluster/nomad/default.nix
index da668b9589af..990679a86688 100644
--- a/pkgs/applications/networking/cluster/nomad/default.nix
+++ b/pkgs/applications/networking/cluster/nomad/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "nomad";
-  version = "0.11.1";
+  version = "0.11.3";
   rev = "v${version}";
 
   goPackagePath = "github.com/hashicorp/nomad";
@@ -12,7 +12,7 @@ buildGoPackage rec {
     owner = "hashicorp";
     repo = pname;
     inherit rev;
-    sha256 = "1pcn1bk7sqhhsrm3izqljwyrwdz6bdlplrajvjzka39l3k6f9hgc";
+    sha256 = "1p7g7x2gl77h1w7aip3xji3s530fj46gspargz4j3i6h4wkyvafb";
   };
 
   # ui:
diff --git a/pkgs/applications/networking/cluster/qbec/default.nix b/pkgs/applications/networking/cluster/qbec/default.nix
index a48016d5069c..0689fd096b3b 100644
--- a/pkgs/applications/networking/cluster/qbec/default.nix
+++ b/pkgs/applications/networking/cluster/qbec/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "qbec";
-  version = "0.11.2";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "splunk";
     repo = "qbec";
     rev = "v${version}";
-    sha256 = "1lf9srkmi7r6p3him19akzag13hj8arwlkm9mdy8a8fg1ascqbm4";
+    sha256 = "0vy1cqqyga68qjbvyhsgl281qkbsvhvmwbxc93hygsxzm9kczy4p";
   };
 
-  vendorSha256 = "1cyr621fb6hxwswz9lf75brc9qjy1n9rqjkwi6r8s3y6nhw20db6";
+  vendorSha256 = "15hbjghi2ifylg7nr85qlk0alsy97h9zj6hf5w84m76dla2bcjf3";
 
   meta = with lib; {
     description = "Configure kubernetes objects on multiple clusters using jsonnet https://qbec.io";
diff --git a/pkgs/applications/networking/cluster/terraform-providers/libvirt/default.nix b/pkgs/applications/networking/cluster/terraform-providers/libvirt/default.nix
index daffb5930903..42ed3d21066f 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/libvirt/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/libvirt/default.nix
@@ -19,7 +19,7 @@
 
 buildGoPackage rec {
   pname = "terraform-provider-libvirt";
-  version = "0.6.1";
+  version = "0.6.2";
 
   goPackagePath = "github.com/dmacvicar/terraform-provider-libvirt";
 
@@ -27,7 +27,7 @@ buildGoPackage rec {
     owner = "dmacvicar";
     repo = "terraform-provider-libvirt";
     rev = "v${version}";
-    sha256 = "1l2n97nj6g44n7bhnbjwmv36xi6754p4iq2qnpkdh39x4384a0zz";
+    sha256 = "1wkpns047ccff0clfb1108wjax1qb5v06hky0i3h2wpzysll7r7b";
   };
 
   nativeBuildInputs = [ pkgconfig makeWrapper ];
diff --git a/pkgs/applications/networking/datovka/default.nix b/pkgs/applications/networking/datovka/default.nix
index 976541177ddb..6dc996c79754 100644
--- a/pkgs/applications/networking/datovka/default.nix
+++ b/pkgs/applications/networking/datovka/default.nix
@@ -11,11 +11,11 @@
 
 mkDerivation rec {
   pname = "datovka";
-  version = "4.15.0";
+  version = "4.15.1";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/datove_schranky/${version}/${pname}-${version}.tar.xz";
-    sha256 = "1f311qnyiay34iqpik4x492py46my89j4nnbdf6qcidnydzas8r1";
+    sha256 = "0ab1s1r6zrqxcfjnij5ar352kzyrl1m92c04nqk6hahpzzma2p3r";
   };
 
   buildInputs = [ libisds qmake qtbase qtsvg libxml2 ];
diff --git a/pkgs/applications/networking/dnscontrol/default.nix b/pkgs/applications/networking/dnscontrol/default.nix
index e8500872d52c..70e107c063fb 100644
--- a/pkgs/applications/networking/dnscontrol/default.nix
+++ b/pkgs/applications/networking/dnscontrol/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "dnscontrol";
-  version = "3.0.0";
+  version = "3.2.0";
 
   goPackagePath = "github.com/StackExchange/dnscontrol";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "StackExchange";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1j8i4k7bqkqmi6dmc9fxfab49a7qigig72rlbga902lw336p6cc7";
+    sha256 = "1lrn1whmx9zkyvs505zxrsmnr5s6kpj3kjkr6rblfwdlnadkgfj7";
   };
 
   subPackages = [ "." ];
diff --git a/pkgs/applications/networking/ftp/filezilla/default.nix b/pkgs/applications/networking/ftp/filezilla/default.nix
index 96a4227b36e1..04f0296fe82e 100644
--- a/pkgs/applications/networking/ftp/filezilla/default.nix
+++ b/pkgs/applications/networking/ftp/filezilla/default.nix
@@ -10,16 +10,10 @@
 , pugixml
 , sqlite
 , tinyxml
-, wxGTK30
+, wxGTK30-gtk3
 , xdg_utils
 }:
 
-let
-  # we can drop this when wxgtk is built with gtk3 by default
-  # see: https://github.com/NixOS/nixpkgs/pull/73145
-  wxgtk' = wxGTK30.override { compat26 = false; withGtk2 = false; };
-
-in
 stdenv.mkDerivation rec {
   pname = "filezilla";
   version = "3.48.1";
@@ -52,8 +46,8 @@ stdenv.mkDerivation rec {
     pugixml
     sqlite
     tinyxml
-    wxgtk'
-    wxgtk'.gtk
+    wxGTK30-gtk3
+    wxGTK30-gtk3.gtk
     xdg_utils
   ];
 
diff --git a/pkgs/applications/networking/instant-messengers/go-neb/default.nix b/pkgs/applications/networking/instant-messengers/go-neb/default.nix
index a82e39647de0..769e5cf55159 100644
--- a/pkgs/applications/networking/instant-messengers/go-neb/default.nix
+++ b/pkgs/applications/networking/instant-messengers/go-neb/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, nixosTests }:
 
 buildGoModule {
   pname = "go-neb";
@@ -16,6 +16,8 @@ buildGoModule {
 
   vendorSha256 = "1k3980yf6zl00dkd1djwhm2f9nnffzrsbs3kq3alpw2gm0aln739";
 
+  passthru.tests.go-neb = nixosTests.go-neb;
+
   meta = with lib; {
     description = "Extensible matrix bot written in Go";
     homepage = "https://github.com/matrix-org/go-neb";
diff --git a/pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json b/pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json
index acb63ff7454f..f9a5ebdbebe3 100644
--- a/pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json
@@ -2,7 +2,7 @@
   "name": "riot-desktop",
   "productName": "Riot",
   "main": "src/electron-main.js",
-  "version": "1.6.4",
+  "version": "1.6.5",
   "description": "A feature-rich client for Matrix.org",
   "author": "New Vector Ltd.",
   "repository": {
@@ -48,7 +48,7 @@
     "find-npm-prefix": "^1.0.2",
     "fs-extra": "^8.1.0",
     "glob": "^7.1.6",
-    "matrix-js-sdk": "6.2.1",
+    "matrix-js-sdk": "6.2.2",
     "mkdirp": "^1.0.3",
     "needle": "^2.3.2",
     "node-pre-gyp": "^0.14.0",
diff --git a/pkgs/applications/networking/instant-messengers/riot/riot-desktop-yarndeps.nix b/pkgs/applications/networking/instant-messengers/riot/riot-desktop-yarndeps.nix
index e6573a508184..30e1c9464755 100644
--- a/pkgs/applications/networking/instant-messengers/riot/riot-desktop-yarndeps.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-desktop-yarndeps.nix
@@ -3154,11 +3154,11 @@
       };
     }
     {
-      name = "matrix_js_sdk___matrix_js_sdk_6.2.1.tgz";
+      name = "matrix_js_sdk___matrix_js_sdk_6.2.2.tgz";
       path = fetchurl {
-        name = "matrix_js_sdk___matrix_js_sdk_6.2.1.tgz";
-        url  = "https://registry.yarnpkg.com/matrix-js-sdk/-/matrix-js-sdk-6.2.1.tgz";
-        sha1 = "d5f76491a650c0a36fcdd078cff59f2da96edd7b";
+        name = "matrix_js_sdk___matrix_js_sdk_6.2.2.tgz";
+        url  = "https://registry.yarnpkg.com/matrix-js-sdk/-/matrix-js-sdk-6.2.2.tgz";
+        sha1 = "103d951f61945217b110962f55ae43996756f615";
       };
     }
     {
diff --git a/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix b/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix
index 64652afd7e4d..b05f64c13822 100644
--- a/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix
@@ -8,12 +8,12 @@
 
 let
   executableName = "riot-desktop";
-  version = "1.6.4";
+  version = "1.6.5";
   src = fetchFromGitHub {
     owner = "vector-im";
     repo = "riot-desktop";
     rev = "v${version}";
-    sha256 = "05z7mggsp33m7ljl4ibk9r4dccglbsc2arp4i3dknq364zdga3m2";
+    sha256 = "1snmfn98z63a8ahh5c7y7h00i8qsdq6wsnidmjjrkzcz3mchfq60";
   };
   electron = electron_7;
 
@@ -78,7 +78,7 @@ in mkYarnPackage rec {
     description = "A feature-rich client for Matrix.org";
     homepage = "https://about.riot.im/";
     license = licenses.asl20;
-    maintainers = with maintainers; [ pacien worldofpeace ma27 ];
+    maintainers = teams.matrix.members;
     inherit (electron.meta) platforms;
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/riot/riot-web.nix b/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
index 942917a46757..cc4eb4161f1b 100644
--- a/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
@@ -12,11 +12,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "riot-web";
-  version = "1.6.4";
+  version = "1.6.5";
 
   src = fetchurl {
     url = "https://github.com/vector-im/riot-web/releases/download/v${version}/riot-v${version}.tar.gz";
-    sha256 = "0n99ivpfsz48zl0nibhkmli26sks2lpd2h0iph73f2w1p7zw1ln2";
+    sha256 = "0mx7ql76cbivc0d9gzix51bc1rdp9yg9vjx05mbf5r9sxrwmihz5";
   };
 
   installPhase = ''
@@ -32,7 +32,7 @@ in stdenv.mkDerivation rec {
   meta = {
     description = "A glossy Matrix collaboration client for the web";
     homepage = "http://riot.im/";
-    maintainers = with stdenv.lib.maintainers; [ bachp pacien ma27 ];
+    maintainers = stdenv.lib.teams.matrix.members;
     license = stdenv.lib.licenses.asl20;
     platforms = stdenv.lib.platforms.all;
     hydraPlatforms = [];
diff --git a/pkgs/applications/networking/instant-messengers/slack/default.nix b/pkgs/applications/networking/instant-messengers/slack/default.nix
index 9cf436ff18f3..ad831eb82a59 100644
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@@ -40,13 +40,13 @@ let
   throwSystem = throw "Unsupported system: ${system}";
 
   sha256 = {
-    x86_64-darwin = "0z731q00bwljlcmbjwqphyys7skqms1vg87pyi4nsvjmc7kjx7qg";
-    x86_64-linux = "0wrs0i2bqv21ivy8s88khbww28b3gsw4abbbbjc76mqma9b0bajs";
+    x86_64-darwin = "09daxnqxyccshkrmr7ysgjvgvgmlgd590ym68fz0l8n6ayfpkgw0";
+    x86_64-linux = "00ihhsgxm441nsmav7pq4n4y9s7p2r4x5dqld160658xyqi836cq";
   }.${system} or throwSystem;
 
   version = {
-    x86_64-darwin = "4.4.2";
-    x86_64-linux = "4.4.2";
+    x86_64-darwin = "4.6.0";
+    x86_64-linux = "4.4.3";
   }.${system} or throwSystem;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
index 388144c4e12f..d4493355951f 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@@ -1,7 +1,7 @@
 { mkDerivation, lib, fetchurl, fetchsvn
 , pkgconfig, cmake, ninja, python3, wrapGAppsHook, wrapQtAppsHook
 , qtbase, qtimageformats, gtk3, libsForQt5, enchant2, lz4, xxHash
-, dee, ffmpeg_4, openalSoft, minizip, libopus, alsaLib, libpulseaudio, range-v3
+, dee, ffmpeg, openalSoft, minizip, libopus, alsaLib, libpulseaudio, range-v3
 , tl-expected, hunspell
 # TODO: Shouldn't be required:
 , pcre, xorg, utillinux, libselinux, libsepol, epoxy, at-spi2-core, libXtst
@@ -42,7 +42,7 @@ mkDerivation rec {
 
   buildInputs = [
     qtbase qtimageformats gtk3 libsForQt5.libdbusmenu enchant2 lz4 xxHash
-    dee ffmpeg_4 openalSoft minizip libopus alsaLib libpulseaudio range-v3
+    dee ffmpeg openalSoft minizip libopus alsaLib libpulseaudio range-v3
     tl-expected hunspell
     # TODO: Shouldn't be required:
     pcre xorg.libpthreadstubs xorg.libXdmcp utillinux libselinux libsepol epoxy at-spi2-core libXtst
diff --git a/pkgs/applications/networking/mailreaders/meli/default.nix b/pkgs/applications/networking/mailreaders/meli/default.nix
new file mode 100644
index 000000000000..719965455f9c
--- /dev/null
+++ b/pkgs/applications/networking/mailreaders/meli/default.nix
@@ -0,0 +1,50 @@
+{ stdenv
+, lib
+, fetchgit
+, rustPlatform
+, pkgconfig
+, openssl
+, dbus
+, sqlite
+, file
+, gzip
+, notmuch
+  # Build with support for notmuch backend
+, withNotmuch ? true
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "meli";
+  version = "alpha-0.5.1";
+
+  src = fetchgit {
+    url = "https://git.meli.delivery/meli/meli.git";
+    rev = version;
+    sha256 = "1y5567hdm1s2s272drxvmp6x4y1jpyl7423iz58hgqcsjm9085zv";
+  };
+
+  cargoSha256 = "040dfr09bg5z5pn68dy323hcppd599d3f6k7zxqw5f8n4whnlc9y";
+
+  cargoBuildFlags = lib.optional withNotmuch "--features=notmuch";
+
+  nativeBuildInputs = [ pkgconfig gzip ];
+
+  buildInputs = [ openssl dbus sqlite ] ++ lib.optional withNotmuch notmuch;
+
+  checkInputs = [ file ];
+
+  postInstall = ''
+    mkdir -p $out/share/man/man1
+    gzip < meli.1 > $out/share/man/man1/meli.1.gz
+    mkdir -p $out/share/man/man5
+    gzip < meli.conf.5 > $out/share/man/man5/meli.conf.5.gz
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Experimental terminal mail client aiming for configurability and extensibility with sane defaults";
+    homepage = "https://meli.delivery";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ maintainers."0x4A6F" matthiasbeyer erictapen ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/networking/mailreaders/mutt/default.nix b/pkgs/applications/networking/mailreaders/mutt/default.nix
index c188e46d0076..30b3194d590b 100644
--- a/pkgs/applications/networking/mailreaders/mutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/mutt/default.nix
@@ -27,11 +27,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "mutt";
-  version = "1.14.2";
+  version = "1.14.3";
 
   src = fetchurl {
     url = "http://ftp.mutt.org/pub/mutt/${pname}-${version}.tar.gz";
-    sha256 = "0cdcls0x6f2w99hkjz48hxhnx86w3bnyxzibchdc9yspih770bz2";
+    sha256 = "0wd4cv1c9hqymvml979g607nh3xxmlyx1ifc4r4qf39v6grnsmdi";
   };
 
   patches = optional smimeSupport (fetchpatch {
diff --git a/pkgs/applications/networking/remote/waypipe/default.nix b/pkgs/applications/networking/remote/waypipe/default.nix
index 03be60a99489..c72c7c6da8ab 100644
--- a/pkgs/applications/networking/remote/waypipe/default.nix
+++ b/pkgs/applications/networking/remote/waypipe/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitLab
 , meson, ninja, pkgconfig, scdoc
 , wayland, wayland-protocols, openssh
-, mesa, lz4, zstd, ffmpeg_4, libva
+, mesa, lz4, zstd, ffmpeg, libva
 }:
 
 stdenv.mkDerivation rec {
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     wayland wayland-protocols
     # Optional dependencies:
-    mesa lz4 zstd ffmpeg_4 libva
+    mesa lz4 zstd ffmpeg libva
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/networking/remote/wayvnc/add-missing-librt.patch b/pkgs/applications/networking/remote/wayvnc/add-missing-librt.patch
new file mode 100644
index 000000000000..e2d617bcc7ca
--- /dev/null
+++ b/pkgs/applications/networking/remote/wayvnc/add-missing-librt.patch
@@ -0,0 +1,20 @@
+diff --git a/meson.build b/meson.build
+index cc6fa03..7c2b280 100644
+--- a/meson.build
++++ b/meson.build
+@@ -24,6 +24,7 @@ add_project_arguments(c_args, language: 'c')
+ cc = meson.get_compiler('c')
+ 
+ libm = cc.find_library('m', required: false)
++librt = cc.find_library('rt', required: false)
+ 
+ pixman = dependency('pixman-1')
+ libuv = dependency('libuv')
+@@ -65,6 +66,7 @@ sources = [
+ 
+ dependencies = [
+ 	libm,
++	librt,
+ 	pixman,
+ 	libuv,
+ 	egl,
diff --git a/pkgs/applications/networking/remote/wayvnc/default.nix b/pkgs/applications/networking/remote/wayvnc/default.nix
index 865710184f93..4ca6ae952580 100644
--- a/pkgs/applications/networking/remote/wayvnc/default.nix
+++ b/pkgs/applications/networking/remote/wayvnc/default.nix
@@ -13,6 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "0aa12fkbwhzs0g2pqw1b27l33nn5dpbcvsf1z8h88kwsf9xdvb2r";
   };
 
+  patches = [ ./add-missing-librt.patch ];
+
   postPatch = ''
     substituteInPlace meson.build \
       --replace "version: '0.1.0'" "version: '${version}'"
diff --git a/pkgs/applications/networking/sniffers/wireshark/default.nix b/pkgs/applications/networking/sniffers/wireshark/default.nix
index c6dc66a0ca78..d025222b0100 100644
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@@ -31,6 +31,9 @@ in stdenv.mkDerivation {
     "-DCMAKE_INSTALL_LIBDIR=lib"
   ];
 
+  # Avoid referencing -dev paths because of debug assertions.
+  NIX_CFLAGS_COMPILE = [ "-DQT_NO_DEBUG" ];
+
   nativeBuildInputs = [
     bison cmake flex pkgconfig
   ] ++ optional withQt qt5.wrapQtAppsHook;
diff --git a/pkgs/applications/networking/ssb/patchwork/default.nix b/pkgs/applications/networking/ssb-patchwork/default.nix
index db33e7e6bb21..db33e7e6bb21 100644
--- a/pkgs/applications/networking/ssb/patchwork/default.nix
+++ b/pkgs/applications/networking/ssb-patchwork/default.nix
diff --git a/pkgs/applications/networking/ssb/patchwork-classic/default.nix b/pkgs/applications/networking/ssb/patchwork-classic/default.nix
deleted file mode 100644
index 74a02f47c3bf..000000000000
--- a/pkgs/applications/networking/ssb/patchwork-classic/default.nix
+++ /dev/null
@@ -1,106 +0,0 @@
-{ stdenv, fetchurl, lib, makeWrapper,
-  # build dependencies
-  alsaLib, atk, cairo, cups, dbus, expat, fontconfig,
-  freetype, gdk-pixbuf, glib, gnome2, nspr, nss, xorg,
-  glibc, systemd
-}:
-
-stdenv.mkDerivation {
-
-  version = "2.12.0";
-
-  pname = "patchwork-classic";
-
-  src = fetchurl {
-    url    = "https://github.com/ssbc/patchwork-classic-electron/releases/download/v2.12.0/ssb-patchwork-electron_2.12.0_linux-amd64.deb";
-    sha256 = "1rvp07cgqwv7ac319p0qwpfxd7l8f53m1rlvvig7qf7q23fnmbsj";
-  };
-
-  sourceRoot = ".";
-
-  unpackCmd = ''
-    ar p "$src" data.tar.xz | tar xJ
-  '';
-
-  dontBuild = true;
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp -R usr/share opt $out/
-
-    # fix the path in the desktop file
-    substituteInPlace \
-      $out/share/applications/ssb-patchwork-electron.desktop \
-      --replace /opt/ $out/opt/
-
-    # symlink the binary to bin/
-    ln -s $out/opt/ssb-patchwork-electron/ssb-patchwork-electron $out/bin/patchwork-classic
-  '';
-
-
-  preFixup = let
-    packages = [
-      alsaLib
-      atk
-      cairo
-      cups
-      dbus
-      expat
-      fontconfig
-      freetype
-      gdk-pixbuf
-      glib
-      gnome2.GConf
-      gnome2.gtk
-      gnome2.pango
-      nspr
-      nss
-      xorg.libX11
-      xorg.libXScrnSaver
-      xorg.libXcomposite
-      xorg.libXcursor
-      xorg.libXdamage
-      xorg.libXext
-      xorg.libXfixes
-      xorg.libXi
-      xorg.libXrandr
-      xorg.libXrender
-      xorg.libXtst
-      stdenv.cc.cc.lib
-      stdenv.cc.cc
-      glibc
-    ];
-    libPathNative = lib.makeLibraryPath packages;
-    libPath64 = lib.makeSearchPathOutput "lib" "lib64" packages;
-    libPath = "${libPathNative}:${libPath64}";
-  in ''
-    # patch executable
-    patchelf \
-      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      --set-rpath "${libPath}:$out/opt/ssb-patchwork-electron" \
-      $out/opt/ssb-patchwork-electron/ssb-patchwork-electron
-
-    # patch libnode
-    patchelf \
-      --set-rpath "${libPath}" \
-      $out/opt/ssb-patchwork-electron/libnode.so
-
-    # libffmpeg is for some reason  not executable
-    chmod a+x $out/opt/ssb-patchwork-electron/libffmpeg.so
-
-    # fix missing libudev
-    ln -s ${systemd.lib}/lib/libudev.so.1 $out/opt/ssb-patchwork-electron/libudev.so.1
-    wrapProgram $out/opt/ssb-patchwork-electron/ssb-patchwork-electron \
-      --prefix LD_LIBRARY_PATH : $out/opt/ssb-patchwork-electron
-  '';
-
-  meta = with stdenv.lib; {
-    description = "Electron wrapper for Patchwork Classic: run as a desktop app outside the browser";
-    homepage    = "https://github.com/ssbc/patchwork-classic-electron";
-    license     = licenses.gpl3;
-    maintainers = with maintainers; [ mrVanDalo ];
-    platforms   = platforms.linux;
-  };
-}
diff --git a/pkgs/applications/networking/sync/onedrive/default.nix b/pkgs/applications/networking/sync/onedrive/default.nix
index 636761d2aaff..be255a6c1465 100644
--- a/pkgs/applications/networking/sync/onedrive/default.nix
+++ b/pkgs/applications/networking/sync/onedrive/default.nix
@@ -1,21 +1,37 @@
-{ stdenv, fetchFromGitHub, dmd, pkgconfig, curl, sqlite, libnotify }:
+{ stdenv, lib, fetchFromGitHub, autoreconfHook, ldc, installShellFiles, pkgconfig
+, curl, sqlite, libnotify
+, withSystemd ? stdenv.isLinux, systemd ? null }:
 
 stdenv.mkDerivation rec {
   pname = "onedrive";
-  version = "2.3.13";
+  version = "2.4.2";
 
   src = fetchFromGitHub {
     owner = "abraunegg";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0bcsrfh1g7bdlcp0zjn6np88qzpn5frv61lzxz9b2ayxf7wyybvi";
+    sha256 = "10s33p1xzq9c5n1bxv9n7n31afxgx9i6c17w0xgxdrma75micm3a";
   };
 
-  nativeBuildInputs = [ dmd pkgconfig ];
+  nativeBuildInputs = [ autoreconfHook ldc installShellFiles pkgconfig ];
 
-  buildInputs = [ curl sqlite libnotify ];
+  buildInputs = [
+    curl sqlite libnotify
+  ] ++ lib.optional withSystemd systemd;
 
-  configureFlags = [ "--enable-notifications" ];
+  configureFlags = [
+    "--enable-notifications"
+  ] ++ lib.optionals withSystemd [
+    "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
+    "--with-systemduserunitdir=${placeholder "out"}/lib/systemd/user"
+  ];
+
+  # we could also pass --enable-completions to configure but we would then have to
+  # figure out the paths manually and pass those along.
+  postInstall = ''
+    installShellCompletion --bash --name ${pname}  contrib/completions/complete.bash
+    installShellCompletion --zsh  --name _${pname} contrib/completions/complete.zsh
+  '';
 
   meta = with stdenv.lib; {
     description = "A complete tool to interact with OneDrive on Linux";
diff --git a/pkgs/applications/office/kmymoney/default.nix b/pkgs/applications/office/kmymoney/default.nix
index 6137a4dc1ad8..e15615f78a34 100644
--- a/pkgs/applications/office/kmymoney/default.nix
+++ b/pkgs/applications/office/kmymoney/default.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "kmymoney";
-  version = "5.0.8";
+  version = "5.1.0";
 
   src = fetchurl {
     url = "mirror://kde/stable/kmymoney/${version}/src/${pname}-${version}.tar.xz";
-    sha256 = "1h6l01a08f1xgk4dfpndl7rmgbp9npm58qi760jwl2gggprwwsxc";
+    sha256 = "0l8kywq77yaf1bqgdqswrai9ws6a2l11drg0wgyi7f8js7qnif9d";
   };
 
   # Hidden dependency that wasn't included in CMakeLists.txt:
diff --git a/pkgs/applications/radio/cubicsdr/default.nix b/pkgs/applications/radio/cubicsdr/default.nix
index ef4d68af54c6..c85299606c03 100644
--- a/pkgs/applications/radio/cubicsdr/default.nix
+++ b/pkgs/applications/radio/cubicsdr/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, cmake, fftw, hamlib, libpulseaudio, libGL, libX11, liquid-dsp,
-  pkgconfig, soapysdr-with-plugins, wxGTK, enableDigitalLab ? false }:
+  pkgconfig, soapysdr-with-plugins, wxGTK31-gtk3, enableDigitalLab ? false }:
 
 stdenv.mkDerivation rec {
   pname = "cubicsdr";
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
-  buildInputs = [ fftw hamlib libpulseaudio libGL libX11 liquid-dsp soapysdr-with-plugins wxGTK ];
+
+  buildInputs = [ fftw hamlib libpulseaudio libGL libX11 liquid-dsp soapysdr-with-plugins wxGTK31-gtk3 ];
 
   cmakeFlags = [ "-DUSE_HAMLIB=ON" ]
     ++ stdenv.lib.optional enableDigitalLab "-DENABLE_DIGITAL_LAB=ON";
diff --git a/pkgs/applications/radio/limesuite/default.nix b/pkgs/applications/radio/limesuite/default.nix
index ef36eac28e42..7cadceab5611 100644
--- a/pkgs/applications/radio/limesuite/default.nix
+++ b/pkgs/applications/radio/limesuite/default.nix
@@ -1,14 +1,11 @@
 { stdenv, fetchFromGitHub, cmake
-, sqlite, wxGTK30, libusb1, soapysdr
+, sqlite, wxGTK30-gtk3, libusb1, soapysdr
 , mesa_glu, libX11, gnuplot, fltk
 } :
 
-let
-  version = "20.01.0";
-
-in stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "limesuite";
-  inherit version;
+  version = "20.01.0";
 
   src = fetchFromGitHub {
     owner = "myriadrf";
@@ -17,14 +14,16 @@ in stdenv.mkDerivation {
     sha256 = "01z4idcby2lm34bbnpbp400ski7p61jjiir6sy6dalnvsl52m7vx";
   };
 
-  enableParallelBuilding = true;
-
   nativeBuildInputs = [ cmake ];
 
+  cmakeFlags = [
+    "-DOpenGL_GL_PREFERENCE=GLVND"
+  ];
+
   buildInputs = [
     libusb1
     sqlite
-    wxGTK30
+    wxGTK30-gtk3
     fltk
     gnuplot
     libusb1
@@ -34,11 +33,8 @@ in stdenv.mkDerivation {
   ];
 
   postInstall = ''
-    mkdir -p $out/lib/udev/rules.d
-    cp ../udev-rules/64-limesuite.rules $out/lib/udev/rules.d
-
-    mkdir -p $out/share/limesuite
-    cp bin/Release/lms7suite_mcu/* $out/share/limesuite
+    install -Dm444 -t $out/lib/udev/rules.d ../udev-rules/64-limesuite.rules
+    install -Dm444 -t $out/share/limesuite bin/Release/lms7suite_mcu/*
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/science/biology/picard-tools/default.nix b/pkgs/applications/science/biology/picard-tools/default.nix
index a1616774d5d7..85d92d3af843 100644
--- a/pkgs/applications/science/biology/picard-tools/default.nix
+++ b/pkgs/applications/science/biology/picard-tools/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "picard-tools";
-  version = "2.22.9";
+  version = "2.23.0";
 
   src = fetchurl {
     url = "https://github.com/broadinstitute/picard/releases/download/${version}/picard.jar";
-    sha256 = "0qm32a58b2asiw8rnw1r6vz3bi61vfdan6wyr9f78fj4d07q7n53";
+    sha256 = "0yhgfz5jjw55ipgdb32wjdcb01xx2g9ikgvwinnfwswx50iscf5a";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/science/electronics/eagle/eagle.nix b/pkgs/applications/science/electronics/eagle/eagle.nix
index 58bdd5c722da..4cfad20e695f 100644
--- a/pkgs/applications/science/electronics/eagle/eagle.nix
+++ b/pkgs/applications/science/electronics/eagle/eagle.nix
@@ -13,11 +13,11 @@ let
   in
   mkDerivation rec {
     pname = "eagle";
-    version = "9.6.1";
+    version = "9.6.2";
 
     src = fetchurl {
       url = "https://eagle-updates.circuits.io/downloads/${builtins.replaceStrings ["."] ["_"] version}/Autodesk_EAGLE_${version}_English_Linux_64bit.tar.gz";
-      sha256 = "1iq4aahrh4g3549vbr7gka5y2h7f17n3yafzl21njc2mkqb12jdw";
+      sha256 = "18syygnskl286kn8aqfzzdsyzq59d2w19y1h1ynyxsnrvkyv71h0";
     };
 
     desktopItem = makeDesktopItem {
diff --git a/pkgs/applications/science/electronics/verilator/default.nix b/pkgs/applications/science/electronics/verilator/default.nix
index 189e09f8241b..0613e22bbda0 100644
--- a/pkgs/applications/science/electronics/verilator/default.nix
+++ b/pkgs/applications/science/electronics/verilator/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "verilator";
-  version = "4.034";
+  version = "4.036";
 
   src = fetchurl {
     url    = "https://www.veripool.org/ftp/${pname}-${version}.tgz";
-    sha256 = "02xqvl9ic21jpda0xldh4ihqwl4ss8389s8fklgx5d98xq37pval";
+    sha256 = "1sy02pgq3kvk8548l57hsh08vfbqdg8dghj8mwlybdi8fdjz4z1h";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/version-management/git-and-tools/git-filter-repo/default.nix b/pkgs/applications/version-management/git-and-tools/git-filter-repo/default.nix
index 78011604cdd7..e4c57be2357c 100644
--- a/pkgs/applications/version-management/git-and-tools/git-filter-repo/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-filter-repo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "git-filter-repo";
-  version = "2.27.0";
+  version = "2.27.1";
 
   src = fetchurl {
     url = "https://github.com/newren/git-filter-repo/releases/download/v${version}/${pname}-${version}.tar.xz";
-    sha256 = "1vry0pqwi0p82m3wflr0wyf88wn75l049w18xf9f5z43xd9vpva1";
+    sha256 = "07r32n31ryflgz1ds3dz5s3ixv7li3scxwavy9mzbzdhq6bbzl28";
   };
 
   buildInputs = [ pythonPackages.python ];
diff --git a/pkgs/applications/version-management/git-and-tools/git-gone/default.nix b/pkgs/applications/version-management/git-and-tools/git-gone/default.nix
index 32350fa538db..46decaf3cc12 100644
--- a/pkgs/applications/version-management/git-and-tools/git-gone/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-gone/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-gone";
-  version = "0.3.2";
+  version = "0.3.6";
 
   src = fetchFromGitHub {
     owner = "lunaryorn";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0zc4cb1dg30np5yc4ymkr894qs2bk0r123i302md00niayk4njyd";
+    sha256 = "0wpmabd5lshsga3dhv1hix7i99f1f82rpl6kjmpi315whg11kki3";
   };
 
-  cargoSha256 = "1d892889ml7sqyxzmjipq5fvizb4abqhmmn450qm7yam9fn5q5wf";
+  cargoSha256 = "0ayqsrhy6hpi20gfryhnwl2c1na4nnmzxkp7him104cc07vsdllq";
 
   nativeBuildInputs = [ pkgconfig makeWrapper installShellFiles ];
 
diff --git a/pkgs/applications/version-management/git-and-tools/git-open/default.nix b/pkgs/applications/version-management/git-and-tools/git-open/default.nix
index 10f221b63882..f7b2120cca02 100644
--- a/pkgs/applications/version-management/git-and-tools/git-open/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-open/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "git-open";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "paulirish";
     repo = "git-open";
     rev = "v${version}";
-    sha256 = "0lprzrjsqrg83gixfaiw26achgd8l7s56jknsjss4p7y0w1fxm05";
+    sha256 = "11n46bngvca5wbdbfcxzjhjbfdbad7sgf7h9gf956cb1q8swsdm0";
   };
 
   buildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/version-management/git-and-tools/git-subtrac/default.nix b/pkgs/applications/version-management/git-and-tools/git-subtrac/default.nix
index df29eb152353..be67beef299f 100644
--- a/pkgs/applications/version-management/git-and-tools/git-subtrac/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-subtrac/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "git-subtrac";
-  version = "0.02";
+  version = "0.03";
 
   src = fetchFromGitHub {
     owner = "apenwarr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1nj950r38sxzrgw69m1xphm7a4km2g29iw2897gfx4wx57jl957k";
+    sha256 = "1ky04h18vg1yl9lykbhkmf25qslg0z2qzziy8c7afmvzvvvhm2v5";
   };
 
   vendorSha256 = "1ccwbhzwys8sl3m2rs2lp70snzsi2a0ahnnq8kn15rrlvsv5qahf";
@@ -19,4 +19,4 @@ buildGoModule rec {
     license = licenses.asl20;
     maintainers = [ maintainers.marsam ];
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/applications/version-management/gitkraken/default.nix b/pkgs/applications/version-management/gitkraken/default.nix
index 88f8df4e2547..2afed8c099c8 100644
--- a/pkgs/applications/version-management/gitkraken/default.nix
+++ b/pkgs/applications/version-management/gitkraken/default.nix
@@ -13,11 +13,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gitkraken";
-  version = "7.0.0";
+  version = "7.0.1";
 
   src = fetchzip {
     url = "https://release.axocdn.com/linux/GitKraken-v${version}.tar.gz";
-    sha256 = "0ws1gb7fgy72s6hxkf9g16x565m58k1cdzx9ldcdghfffimz4cqx";
+    sha256 = "0vj2ggbm617fypl69ksbrbl048xp4v6wc46y4sp7hrk6lg0gw1b0";
   };
 
   dontBuild = true;
diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
index ffbd98791358..47453cb5e6fe 100644
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@@ -8,11 +8,11 @@ let
 
 in python3Packages.buildPythonApplication rec {
   pname = "mercurial";
-  version = "5.3.1";
+  version = "5.4.1";
 
   src = fetchurl {
     url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-    sha256 = "1nbjpzjrzgql4hrvslpxwbcgn885ikq6ba1yb4w6p78rw9nzkhgp";
+    sha256 = "1ilam0dz121nn4852jgkgyzyrvk3hn5cqnivy8gk1qg815mh4763";
   };
 
   format = "other";
diff --git a/pkgs/applications/video/handbrake/default.nix b/pkgs/applications/video/handbrake/default.nix
index bbbb60bdf511..b56c26dff78d 100644
--- a/pkgs/applications/video/handbrake/default.nix
+++ b/pkgs/applications/video/handbrake/default.nix
@@ -51,13 +51,13 @@ assert stdenv.isDarwin -> AudioToolbox != null
 
 stdenv.mkDerivation rec {
   pname = "handbrake";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
     owner = "HandBrake";
     repo = "HandBrake";
     rev = version;
-    sha256 = "04z3hcy7m5yvma849rlrsx2wdqmkilkl1qds9yrzr2ydpw697f85";
+    sha256 = "0bsmk37543zv3p32a7wxnh2w483am23ha2amj339q3nnb4142krn";
     extraPostFetch = ''
       echo "DATE=$(date +"%F %T %z" -r $out/NEWS.markdown)" > $out/version.txt
     '';
diff --git a/pkgs/applications/video/mpv/default.nix b/pkgs/applications/video/mpv/default.nix
index 9cb39d681401..697a468f8908 100644
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@@ -1,6 +1,6 @@
 { config, stdenv, fetchurl, fetchFromGitHub, fetchpatch
 , addOpenGLRunpath, docutils, perl, pkgconfig, python3, wafHook, which
-, ffmpeg_4, freefont_ttf, freetype, libass, libpthreadstubs, mujs
+, ffmpeg, freefont_ttf, freetype, libass, libpthreadstubs, mujs
 , nv-codec-headers, lua, libuchardet, libiconv ? null
 , CoreFoundation, Cocoa, CoreAudio, MediaPlayer
 
@@ -39,7 +39,10 @@
 , libpngSupport      ? true,           libpng        ? null
 , pulseSupport       ? config.pulseaudio or stdenv.isLinux, libpulseaudio ? null
 , rubberbandSupport  ? stdenv.isLinux, rubberband    ? null
-, sambaSupport       ? stdenv.isLinux, samba         ? null
+# NOTE: samba support should be removed on the next mpv release, see also:
+# https://github.com/NixOS/nixpkgs/pull/89145#issuecomment-636424362
+# Please remove this line on the next mpv release.
+, sambaSupport       ? false,          samba         ? null
 , screenSaverSupport ? true,           libXScrnSaver ? null
 , sdl2Support        ? true,           SDL2          ? null
 , sndioSupport       ? true,           sndio         ? null
@@ -152,7 +155,7 @@ in stdenv.mkDerivation rec {
     ++ optional swiftSupport swift;
 
   buildInputs = [
-    ffmpeg_4 freetype libass libpthreadstubs
+    ffmpeg freetype libass libpthreadstubs
     luaEnv libuchardet mujs
   ] ++ optional alsaSupport        alsaLib
     ++ optional archiveSupport     libarchive
diff --git a/pkgs/applications/video/mpv/scripts/simple-mpv-webui.nix b/pkgs/applications/video/mpv/scripts/simple-mpv-webui.nix
new file mode 100644
index 000000000000..d51434e241c9
--- /dev/null
+++ b/pkgs/applications/video/mpv/scripts/simple-mpv-webui.nix
@@ -0,0 +1,33 @@
+{ stdenv
+, fetchFromGitHub }:
+stdenv.mkDerivation rec {
+  pname = "simple-mpv-ui";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "open-dynaMIX";
+    repo = "simple-mpv-webui";
+    rev = "v${version}";
+    sha256 = "1glrnnl1slcl0ri0zs4j64lc9aa52p9ffh6av0d81fk95nm98917";
+  };
+
+  dontBuild = true;
+  installPhase = ''
+    mkdir -p $out/share/mpv/scripts
+    cp -r webui.lua webui-page $out/share/mpv/scripts/
+  '';
+  passthru.scriptName = "webui.lua";
+
+  meta = with stdenv.lib; {
+    description = "A web based user interface with controls for the mpv mediaplayer";
+    homepage = "https://github.com/open-dynaMIX/simple-mpv-webui";
+    maintainers = [ maintainers.cript0nauta ];
+    longDescription = ''
+      You can access the webui when accessing http://127.0.0.1:8080 or
+      http://[::1]:8080 in your webbrowser. By default it listens on
+      0.0.0.0:8080 and [::0]:8080
+    '';
+    license = licenses.mit;
+  };
+}
+
diff --git a/pkgs/applications/video/mpv/wrapper.nix b/pkgs/applications/video/mpv/wrapper.nix
index ad6383046b1b..5b3ad7a98311 100644
--- a/pkgs/applications/video/mpv/wrapper.nix
+++ b/pkgs/applications/video/mpv/wrapper.nix
@@ -54,7 +54,7 @@ let
     ;
     umpvWrapperArgs = lib.strings.escapeShellArgs ([
       "--argv0" "'$0'"
-      "--set" "MPV" "$out/bin/mpv"
+      "--set" "MPV" "${placeholder "out"}/bin/mpv"
     ] ++ extraUmpvWrapperArgs)
     ;
   in
diff --git a/pkgs/applications/video/tartube/default.nix b/pkgs/applications/video/tartube/default.nix
index ae222ae05a79..23ee76eb4693 100644
--- a/pkgs/applications/video/tartube/default.nix
+++ b/pkgs/applications/video/tartube/default.nix
@@ -14,13 +14,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "tartube";
-  version = "2.0.016";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "axcore";
     repo = "tartube";
     rev = "v${version}";
-    sha256 = "1y77ykihyi4v6xlsm5xldbs9lzq229l574rxz6qfvrjcbbwajfj9";
+    sha256 = "1klqjwqm29y2f6nc8gn222ykfvb5d64z1w2kifw9bq5bv0np9bda";
   };
 
   nativeBuildInputs = [
@@ -35,6 +35,8 @@ python3Packages.buildPythonApplication rec {
     pygobject3
     pyxdg
     requests
+    feedparser
+    playsound
   ];
 
   buildInputs = [
@@ -45,6 +47,10 @@ python3Packages.buildPythonApplication rec {
     pango
   ];
 
+  postPatch = ''
+    sed -i "/^\s*install_requires/s/, 'gi'\|'gi', \|'gi'//" setup.py
+  '';
+
   postInstall = ''
     mkdir -p $out/share/{man/man1,applications,pixmaps}
     cp pack/tartube.1 $out/share/man/man1
diff --git a/pkgs/applications/video/vlc/default.nix b/pkgs/applications/video/vlc/default.nix
index 3ee662f73c53..91fb36c39748 100644
--- a/pkgs/applications/video/vlc/default.nix
+++ b/pkgs/applications/video/vlc/default.nix
@@ -25,11 +25,11 @@ assert (withQt5 -> qtbase != null && qtsvg != null && qtx11extras != null && wra
 
 stdenv.mkDerivation rec {
   pname = "vlc";
-  version = "3.0.10";
+  version = "3.0.11";
 
   src = fetchurl {
     url = "http://get.videolan.org/vlc/${version}/${pname}-${version}.tar.xz";
-    sha256 = "0cackl1084hcmg4myf3kvjvd6sjxmzn0c0qkmanz6brvgzyanrm9";
+    sha256 = "06a9hfl60f6l0fs5c9ma5s8np8kscm4ala6m2pdfji9lyfna351y";
   };
 
   # VLC uses a *ton* of libraries for various pieces of functionality, many of
diff --git a/pkgs/applications/video/wf-recorder/default.nix b/pkgs/applications/video/wf-recorder/default.nix
index cb97e5b1090b..09b67149f5a9 100644
--- a/pkgs/applications/video/wf-recorder/default.nix
+++ b/pkgs/applications/video/wf-recorder/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, meson, ninja, pkg-config, wayland, scdoc
-, wayland-protocols, ffmpeg_4, x264, libpulseaudio, ocl-icd, opencl-headers
+, wayland-protocols, ffmpeg, x264, libpulseaudio, ocl-icd, opencl-headers
 }:
 
 stdenv.mkDerivation rec {
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ meson ninja pkg-config wayland scdoc ];
   buildInputs = [
-    wayland-protocols ffmpeg_4 x264 libpulseaudio ocl-icd opencl-headers
+    wayland-protocols ffmpeg x264 libpulseaudio ocl-icd opencl-headers
   ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/virtualization/conmon/default.nix b/pkgs/applications/virtualization/conmon/default.nix
index be6196855e2b..d5abb569e7b1 100644
--- a/pkgs/applications/virtualization/conmon/default.nix
+++ b/pkgs/applications/virtualization/conmon/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "conmon";
-  version = "2.0.17";
+  version = "2.0.18";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "01bicv0qr4aiahkw9cp6igk3jv1fqkbxmsp80nfvq6rxx873v0q7";
+    sha256 = "0f32g048jamfhrds68vzirx8iqizr45wf2d4bfvdsk176amrj4k0";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/applications/window-managers/herbstluftwm/default.nix b/pkgs/applications/window-managers/herbstluftwm/default.nix
index 7dc715e126cd..e547cea3c54c 100644
--- a/pkgs/applications/window-managers/herbstluftwm/default.nix
+++ b/pkgs/applications/window-managers/herbstluftwm/default.nix
@@ -8,11 +8,11 @@ assert withDoc -> asciidoc != null;
 
 stdenv.mkDerivation rec {
   pname = "herbstluftwm";
-  version = "0.8.1";
+  version = "0.8.3";
 
   src = fetchurl {
     url = "https://herbstluftwm.org/tarballs/herbstluftwm-${version}.tar.gz";
-    sha256 = "0c1lf82z6a56g8asin91cmqhzk3anw0xwc44b31bpjixadmns57y";
+    sha256 = "1qmb4pjf2f6g0dvcg11cw9njwmxblhqzd70ai8qnlgqw1iz3nkm1";
   };
 
   outputs = [
diff --git a/pkgs/applications/window-managers/hikari/default.nix b/pkgs/applications/window-managers/hikari/default.nix
new file mode 100644
index 000000000000..274c75a3c13c
--- /dev/null
+++ b/pkgs/applications/window-managers/hikari/default.nix
@@ -0,0 +1,75 @@
+{ stdenv, fetchzip,
+  pkgconfig, bmake,
+  cairo, glib, libevdev, libinput, libxkbcommon, linux-pam, pango, pixman,
+  libucl, wayland, wayland-protocols, wlroots,
+  features ? {
+    gammacontrol = true;
+    layershell   = true;
+    screencopy   = true;
+    xwayland     = true;
+  }
+}:
+
+let
+  pname = "hikari";
+  version = "2.0.2";
+in
+
+stdenv.mkDerivation {
+  inherit pname version;
+
+  src = fetchzip {
+    url = "https://hikari.acmelabs.space/releases/${pname}-${version}.tar.gz";
+    sha256 = "1a3i01936pw11hrmjmrhzzwpndl1jqjgx376m5m724wd1j9awm68";
+  };
+
+  nativeBuildInputs = [ pkgconfig bmake ];
+
+  buildInputs = [
+    cairo
+    glib
+    libevdev
+    libinput
+    libxkbcommon
+    linux-pam
+    pango
+    pixman
+    libucl
+    wayland
+    wayland-protocols
+    wlroots
+  ];
+
+  enableParallelBuilding = true;
+
+  # Must replace GNU Make by bmake
+  buildPhase = with stdenv.lib; concatStringsSep " " (
+    [ "bmake" "-j$NIX_BUILD_CORES" "PREFIX=$out" ]
+    ++ optional stdenv.isLinux "WITH_POSIX_C_SOURCE=YES"
+    ++ mapAttrsToList (feat: enabled:
+         optionalString enabled "WITH_${toUpper feat}=YES"
+       ) features
+  );
+
+  # Can't suid in nix store
+  # Run hikari as root (it will drop privileges as early as possible), or create
+  # a systemd unit to give it the necessary permissions/capabilities.
+  patchPhase = ''
+    substituteInPlace Makefile --replace '4555' '555'
+  '';
+
+  installPhase = ''
+    bmake \
+      PREFIX=$out \
+      install
+    runHook postInstall
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Stacking Wayland compositor which is actively developed on FreeBSD but also supports Linux";
+    homepage    = "https://hikari.acmelabs.space";
+    license     = licenses.bsd2;
+    platforms   = platforms.linux ++ platforms.freebsd;
+    maintainers = with maintainers; [ jpotier ];
+  };
+}
diff --git a/pkgs/applications/window-managers/i3/pystatus.nix b/pkgs/applications/window-managers/i3/pystatus.nix
index 29bda8e4e2b0..beefdaf891c6 100644
--- a/pkgs/applications/window-managers/i3/pystatus.nix
+++ b/pkgs/applications/window-managers/i3/pystatus.nix
@@ -1,31 +1,45 @@
-{ stdenv, fetchFromGitHub, libpulseaudio, python3Packages, extraLibs ? [] }:
+{ stdenv
+, fetchFromGitHub
+, libpulseaudio
+, libnotify
+, gobject-introspection
+, python3Packages
+, wrapGAppsHook
+, extraLibs ? [] }:
 
 python3Packages.buildPythonApplication rec {
   # i3pystatus moved to rolling release:
   # https://github.com/enkore/i3pystatus/issues/584
-  version = "unstable-2019-06-10";
+  version = "unstable-2020-06-12";
   pname = "i3pystatus";
 
-  src = fetchFromGitHub
-  {
+  src = fetchFromGitHub {
     owner = "enkore";
     repo = "i3pystatus";
-    rev = "56ce08d0ff8d5d64950d6b588ebede35a95e0ce2";
-    sha256 = "12938860jbcly1xwhd71jvy2dff28pwv9kqh6mab1859148bzmcg";
+    rev = "dad5eb0c5c8a2ecd20c37ade4732586c6e53f44b";
+    sha256 = "18ygvkl92yr69kxsym57k1mc90asdxpz4b943i61qr0s4fc5n4mq";
   };
 
-  propagatedBuildInputs = with python3Packages; [ keyring colour netifaces psutil basiciw ] ++
-    [ libpulseaudio ] ++ extraLibs;
+  buildInputs = [ libpulseaudio libnotify gobject-introspection ];
 
-  libpulseaudioPath = stdenv.lib.makeLibraryPath [ libpulseaudio ];
-  ldWrapperSuffix = "--suffix LD_LIBRARY_PATH : \"${libpulseaudioPath}\"";
-  # LC_TIME != C results in locale.Error: unsupported locale setting
-  makeWrapperArgs = [ "--set LC_TIME C" ldWrapperSuffix ]; # libpulseaudio.so is loaded manually
+  propagatedBuildInputs = with python3Packages; [
+    keyring colour netifaces psutil basiciw pygobject3
+  ] ++ extraLibs;
+
+  makeWrapperArgs = [
+    # LC_TIME != C results in locale.Error: unsupported locale setting
+    "--set" "LC_TIME" "C"
+    "--suffix" "LD_LIBRARY_PATH" ":" "${stdenv.lib.makeLibraryPath [ libpulseaudio ]}"
+  ];
+
+  postPatch = ''
+    makeWrapperArgs+=(--set GI_TYPELIB_PATH "$GI_TYPELIB_PATH")
+  '';
 
   postInstall = ''
     makeWrapper ${python3Packages.python.interpreter} $out/bin/${pname}-python-interpreter \
       --prefix PYTHONPATH : "$PYTHONPATH" \
-      ${ldWrapperSuffix}
+      ''${makeWrapperArgs[@]}
   '';
 
   # no tests in tarball
diff --git a/pkgs/build-support/agda/default.nix b/pkgs/build-support/agda/default.nix
index 205aff555730..3c973e8cc0ac 100644
--- a/pkgs/build-support/agda/default.nix
+++ b/pkgs/build-support/agda/default.nix
@@ -30,6 +30,16 @@ let
 
   withPackages = arg: if builtins.isAttrs arg then withPackages' arg else withPackages' { pkgs = arg; };
 
+  extensions = [
+    "agda"
+    "agda-lib"
+    "agdai"
+    "lagda"
+    "lagda.md"
+    "lagda.org"
+    "lagda.rst"
+    "lagda.tex"
+  ];
 
   defaults =
     { pname
@@ -39,6 +49,7 @@ let
     , libraryFile ? "${libraryName}.agda-lib"
     , buildPhase ? null
     , installPhase ? null
+    , extraExtensions ? []
     , ...
     }: let
       agdaWithArgs = withPackages (builtins.filter (p: p ? isAgdaDerivation) buildInputs);
@@ -59,7 +70,7 @@ let
         installPhase = if installPhase != null then installPhase else ''
           runHook preInstall
           mkdir -p $out
-          find \( -name '*.agda' -or -name '*.agdai' -or -name '*.agda-lib' \) -exec cp -p --parents -t "$out" {} +
+          find \( ${concatMapStringsSep " -or " (p: "-name '*.${p}'") (extensions ++ extraExtensions)} \) -exec cp -p --parents -t "$out" {} +
           runHook postInstall
         '';
       };
diff --git a/pkgs/build-support/rust/build-rust-crate/build-crate.nix b/pkgs/build-support/rust/build-rust-crate/build-crate.nix
index d6d1cebb2e91..f82effdbca7c 100644
--- a/pkgs/build-support/rust/build-rust-crate/build-crate.nix
+++ b/pkgs/build-support/rust/build-rust-crate/build-crate.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, mkRustcDepArgs, rust }:
+{ lib, stdenv, mkRustcDepArgs, mkRustcFeatureArgs, rust }:
 { crateName,
   dependencies,
   crateFeatures, crateRenames, libName, release, libPath,
@@ -13,7 +13,7 @@
       ++ ["-C codegen-units=$NIX_BUILD_CORES"]
       ++ ["--remap-path-prefix=$NIX_BUILD_TOP=/" ]
       ++ [(mkRustcDepArgs dependencies crateRenames)]
-      ++ [crateFeatures]
+      ++ [(mkRustcFeatureArgs crateFeatures)]
       ++ extraRustcOpts
       ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "--target ${rust.toRustTarget stdenv.hostPlatform} -C linker=${stdenv.hostPlatform.config}-gcc"
       # since rustc 1.42 the "proc_macro" crate is part of the default crate prelude
diff --git a/pkgs/build-support/rust/build-rust-crate/configure-crate.nix b/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
index c47bc00938c1..8e2f5f7f35e0 100644
--- a/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
+++ b/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
@@ -1,5 +1,6 @@
-{ lib, stdenv, echo_colored, noisily, mkRustcDepArgs }:
-{ build
+{ lib, stdenv, echo_colored, noisily, mkRustcDepArgs, mkRustcFeatureArgs }:
+{
+  build
 , buildDependencies
 , colors
 , completeBuildDeps
@@ -30,6 +31,9 @@ let version_ = lib.splitString "-" crateVersion;
     optLevel = if release then 3 else 0;
     completeDepsDir = lib.concatStringsSep " " completeDeps;
     completeBuildDepsDir = lib.concatStringsSep " " completeBuildDeps;
+    envFeatures = lib.concatStringsSep " " (
+      map (f: lib.replaceChars ["-"] ["_"] (lib.toUpper f)) crateFeatures
+    );
 in ''
   ${echo_colored colors}
   ${noisily colors verbose}
@@ -161,14 +165,24 @@ in ''
        EXTRA_BUILD_FLAGS="$EXTRA_BUILD_FLAGS $(tr '\n' ' ' < target/link.build)"
      fi
      noisily rustc --crate-name build_script_build $BUILD --crate-type bin ${rustcOpts} \
-       ${crateFeatures} --out-dir target/build/${crateName} --emit=dep-info,link \
+       ${mkRustcFeatureArgs crateFeatures} --out-dir target/build/${crateName} --emit=dep-info,link \
        -L dependency=target/buildDeps ${buildDeps} --cap-lints allow $EXTRA_BUILD_FLAGS --color ${colors}
 
      mkdir -p target/build/${crateName}.out
      export RUST_BACKTRACE=1
      BUILD_OUT_DIR="-L $OUT_DIR"
      mkdir -p $OUT_DIR
-     target/build/${crateName}/build_script_build > target/build/${crateName}.opt
+
+     (
+       # Features should be set as environment variable for build scripts:
+       # https://doc.rust-lang.org/cargo/reference/environment-variables.html#environment-variables-cargo-sets-for-build-scripts
+       for feature in ${envFeatures}; do
+         export CARGO_FEATURE_$feature=1
+       done
+
+       target/build/${crateName}/build_script_build > target/build/${crateName}.opt
+     )
+
      set +e
      EXTRA_BUILD=$(sed -n "s/^cargo:rustc-flags=\(.*\)/\1/p" target/build/${crateName}.opt | tr '\n' ' ' | sort -u)
      EXTRA_FEATURES=$(sed -n "s/^cargo:rustc-cfg=\(.*\)/--cfg \1/p" target/build/${crateName}.opt | tr '\n' ' ')
diff --git a/pkgs/build-support/rust/build-rust-crate/default.nix b/pkgs/build-support/rust/build-rust-crate/default.nix
index d9ed26f1d94a..d559aba16165 100644
--- a/pkgs/build-support/rust/build-rust-crate/default.nix
+++ b/pkgs/build-support/rust/build-rust-crate/default.nix
@@ -45,14 +45,17 @@ let
            " --extern ${name}=${dep.lib}/lib/lib${extern}-${dep.metadata}${stdenv.hostPlatform.extensions.sharedLibrary}")
       ) dependencies;
 
+   # Create feature arguments for rustc.
+   mkRustcFeatureArgs = lib.concatMapStringsSep " " (f: ''--cfg feature=\"${f}\"'');
+
    inherit (import ./log.nix { inherit lib; }) noisily echo_colored;
 
    configureCrate = import ./configure-crate.nix {
-     inherit lib stdenv echo_colored noisily mkRustcDepArgs;
+     inherit lib stdenv echo_colored noisily mkRustcDepArgs mkRustcFeatureArgs;
    };
 
    buildCrate = import ./build-crate.nix {
-     inherit lib stdenv mkRustcDepArgs rust;
+     inherit lib stdenv mkRustcDepArgs mkRustcFeatureArgs rust;
    };
 
    installCrate = import ./install-crate.nix { inherit stdenv; };
@@ -233,8 +236,11 @@ stdenv.mkDerivation (rec {
       ++ lib.concatMap (dep: dep.completeBuildDeps ++ dep.completeDeps) buildDependencies
     );
 
-    crateFeatures = lib.optionalString (crate ? features)
-      (lib.concatMapStringsSep " " (f: ''--cfg feature=\"${f}\"'') (crate.features ++ features));
+    # Create a list of features that are enabled by the crate itself and
+    # through the features argument of buildRustCrate. Exclude features
+    # with a forward slash, since they are passed through to dependencies.
+    crateFeatures = lib.optionals (crate ? features)
+      (builtins.filter (f: !lib.hasInfix "/" f) (crate.features ++ features));
 
     libName = if crate ? libName then crate.libName else crate.crateName;
     libPath = if crate ? libPath then crate.libPath else "";
@@ -244,7 +250,8 @@ stdenv.mkDerivation (rec {
     metadata = let
       depsMetadata = lib.foldl' (str: dep: str + dep.metadata) "" (dependencies ++ buildDependencies);
       hashedMetadata = builtins.hashString "sha256"
-        (crateName + "-" + crateVersion + "___" + toString crateFeatures + "___" + depsMetadata);
+        (crateName + "-" + crateVersion + "___" + toString (mkRustcFeatureArgs crateFeatures) +
+          "___" + depsMetadata);
       in lib.substring 0 10 hashedMetadata;
 
     build = crate.build or "";
diff --git a/pkgs/build-support/rust/build-rust-crate/test/default.nix b/pkgs/build-support/rust/build-rust-crate/test/default.nix
index bdd6c86d5f07..24ddc11459ec 100644
--- a/pkgs/build-support/rust/build-rust-crate/test/default.nix
+++ b/pkgs/build-support/rust/build-rust-crate/test/default.nix
@@ -344,6 +344,32 @@ let
         buildTests = true;
         expectedTestOutputs = [ "test baz_false ... ok" ];
       };
+      buildScriptFeatureEnv = {
+        crateName = "build-script-feature-env";
+        features = [ "some-feature" "crate/another_feature" ];
+        src = symlinkJoin {
+          name = "build-script-feature-env";
+          paths = [
+            (mkFile  "src/main.rs" ''
+              #[cfg(test)]
+              #[test]
+              fn feature_not_visible() {
+                assert!(std::env::var("CARGO_FEATURE_SOME_FEATURE").is_err());
+                assert!(option_env!("CARGO_FEATURE_SOME_FEATURE").is_none());
+              }
+              fn main() {}
+            '')
+            (mkFile  "build.rs" ''
+              fn main() {
+                assert!(std::env::var("CARGO_FEATURE_SOME_FEATURE").is_ok());
+                assert!(option_env!("CARGO_FEATURE_SOME_FEATURE").is_none());
+              }
+            '')
+          ];
+        };
+        buildTests = true;
+        expectedTestOutputs = [ "test feature_not_visible ... ok" ];
+      };
       # Regression test for https://github.com/NixOS/nixpkgs/pull/88054
       # Build script output should be rewritten as valid env vars.
       buildScriptIncludeDirDeps = let
diff --git a/pkgs/data/documentation/man-pages/default.nix b/pkgs/data/documentation/man-pages/default.nix
index a9a64fb40299..5d58284cb663 100644
--- a/pkgs/data/documentation/man-pages/default.nix
+++ b/pkgs/data/documentation/man-pages/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "man-pages";
-  version = "5.06";
+  version = "5.07";
 
   src = fetchurl {
     url = "mirror://kernel/linux/docs/man-pages/${pname}-${version}.tar.xz";
-    sha256 = "0l7ypgl36jswa077qvdh1rcsvnwr64vja6cc32bab86sm41akf3h";
+    sha256 = "13b3q7c67r0wkla4pdihl1qh09k67ms2z5jgzfqgpdqqy6mgziwd";
   };
 
   makeFlags = [ "MANDIR=$(out)/share/man" ];
diff --git a/pkgs/data/fonts/amiri/default.nix b/pkgs/data/fonts/amiri/default.nix
index 9ecde1939e8c..9867b84757aa 100644
--- a/pkgs/data/fonts/amiri/default.nix
+++ b/pkgs/data/fonts/amiri/default.nix
@@ -1,14 +1,14 @@
 { lib, fetchzip }:
 
 let
-  version = "0.112";
+  version = "0.113";
 
 in fetchzip rec {
   name = "Amiri-${version}";
 
   url = "https://github.com/alif-type/amiri/releases/download/${version}/${name}.zip";
 
-  sha256 = "13j8kglgca296czxjz1xvrbz6yx05s2xassiliyszndbkrhn6bkl";
+  sha256 = "0v5xm4spyww8wy6j9kpb01ixrakw7wp6jng4xnh220iy6yqcxm7v";
 
   postFetch = ''
     unzip $downloadedFile
diff --git a/pkgs/data/misc/osinfo-db/default.nix b/pkgs/data/misc/osinfo-db/default.nix
index 4460e7b40d7c..87425defb879 100644
--- a/pkgs/data/misc/osinfo-db/default.nix
+++ b/pkgs/data/misc/osinfo-db/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "osinfo-db";
-  version = "20200515";
+  version = "20200529";
 
   src = fetchurl {
     url = "https://releases.pagure.org/libosinfo/${pname}-${version}.tar.xz";
-    sha256 = "1m9idmmb1sjf24lp9lgng2m1jj09mn9fa9pnz36fdv5q0lskgscj";
+    sha256 = "0mbrf9j5wmjhc6jixvhp4jqyxixh1717lqrmzmipdg99xnzba81n";
   };
 
   nativeBuildInputs = [ osinfo-db-tools intltool libxml2 ];
diff --git a/pkgs/desktops/gnome-3/apps/evolution/default.nix b/pkgs/desktops/gnome-3/apps/evolution/default.nix
index 467971b2dba4..b9ac719004aa 100644
--- a/pkgs/desktops/gnome-3/apps/evolution/default.nix
+++ b/pkgs/desktops/gnome-3/apps/evolution/default.nix
@@ -43,11 +43,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution";
-  version = "3.36.2";
+  version = "3.36.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "12ii8crp4v4bpdxrc2rkxwdxqz3qjizyfgfrmir9pcyxlg0lh2f5";
+    sha256 = "00yann3cibbsap7vh6qq08aklvydynmk6gmljkzd80kc52m6rqal";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix b/pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix
index fd7205e08fd0..eed28908bf33 100644
--- a/pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix
@@ -51,11 +51,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-boxes";
-  version = "3.36.4";
+  version = "3.36.5";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-boxes/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "16l0mq2ydmywcdya1795mcy8syg4zkmz9ws3pzjcqv5y4m7cjj03";
+    sha256 = "1khvyhgd3p41fvvknga1hdl0p1ks4kj4cwsiaw28v1sy6nzclm2c";
   };
 
   doCheck = true;
diff --git a/pkgs/desktops/gnome-3/core/evince/default.nix b/pkgs/desktops/gnome-3/core/evince/default.nix
index e268b8f8f121..d9d9f916d46d 100644
--- a/pkgs/desktops/gnome-3/core/evince/default.nix
+++ b/pkgs/desktops/gnome-3/core/evince/default.nix
@@ -43,13 +43,13 @@
 
 stdenv.mkDerivation rec {
   pname = "evince";
-  version = "3.36.3";
+  version = "3.36.5";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/evince/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1clx580n8vb6w0fhdbmcsxs07yczdgidyax1y7280rafyzvvsbmg";
+    sha256 = "0z79jl0j9xq9wgwkfr0d1w1qrdy4447y8shs407n5srr0vixc3bg";
   };
 
   postPatch = ''
diff --git a/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix b/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix
index 79d28ae8ced8..d282fec2e851 100644
--- a/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix
@@ -68,11 +68,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-control-center";
-  version = "3.36.2";
+  version = "3.36.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "05vqhj5z4w4vaphp541zxxkx6x781m371l2gqnq2vhnnqvqfz9g0";
+    sha256 = "0739qcwfwrimfrpf3gaakkf7ipwy3virs096kkhkxjmy1nbls5xw";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix b/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix
index 94de64c9ea98..22b3f17b4256 100644
--- a/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-desktop";
-  version = "3.36.2";
+  version = "3.36.3.1";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-desktop/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "12f724inw3sv289xqprvwh8r3qw89z67m74j3hyhkbp1n7f99y9q";
+    sha256 = "0zkbx5inprjpf4abqwn0bxc2d1rwbhv450cjh1wgz82ylagi3vab";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/go/1.13.nix b/pkgs/development/compilers/go/1.13.nix
index 8b013bbd6503..48e4d9bdc6c4 100644
--- a/pkgs/development/compilers/go/1.13.nix
+++ b/pkgs/development/compilers/go/1.13.nix
@@ -236,7 +236,7 @@ stdenv.mkDerivation rec {
     homepage = "http://golang.org/";
     description = "The Go Programming language";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ cstrahan orivej mic92 rvolosatovs kalbasit Frostman ];
+    maintainers = teams.golang.members;
     platforms = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/pkgs/development/compilers/go/1.14.nix b/pkgs/development/compilers/go/1.14.nix
index 9aaf85c598fc..560af19e2010 100644
--- a/pkgs/development/compilers/go/1.14.nix
+++ b/pkgs/development/compilers/go/1.14.nix
@@ -236,7 +236,7 @@ stdenv.mkDerivation rec {
     homepage = "http://golang.org/";
     description = "The Go Programming language";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ cstrahan orivej mic92 rvolosatovs kalbasit Frostman ];
+    maintainers = teams.golang.members;
     platforms = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/pkgs/development/compilers/intel-graphics-compiler/default.nix b/pkgs/development/compilers/intel-graphics-compiler/default.nix
index e3dfa8ea324c..6374846f4407 100644
--- a/pkgs/development/compilers/intel-graphics-compiler/default.nix
+++ b/pkgs/development/compilers/intel-graphics-compiler/default.nix
@@ -24,13 +24,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "intel-graphics-compiler";
-  version = "1.0.3627";
+  version = "1.0.4062";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "intel-graphics-compiler";
     rev = "igc-${version}";
-    sha256 = "1x9fjvf7rbhil09am2v9j2jhwysdvwgshf9zidbirjgfrqn573h8";
+    sha256 = "1fr9mb7s5f0kiwxf04lqbyqbxfsvki0kwnpcy41m3p3la22mqz47";
   };
 
   nativeBuildInputs = [ clang cmake bison flex llvm python ];
diff --git a/pkgs/development/compilers/mono/generic.nix b/pkgs/development/compilers/mono/generic.nix
index f22771a35e9d..e4d99dcec955 100644
--- a/pkgs/development/compilers/mono/generic.nix
+++ b/pkgs/development/compilers/mono/generic.nix
@@ -21,8 +21,6 @@ stdenv.mkDerivation rec {
     ]
     ++ (stdenv.lib.optionals stdenv.isDarwin [ Foundation libobjc ]);
 
-  propagatedBuildInputs = [glib];
-
   configureFlags = [
     "--x-includes=${libX11.dev}/include"
     "--x-libraries=${libX11.out}/lib"
diff --git a/pkgs/development/compilers/purescript/purescript/default.nix b/pkgs/development/compilers/purescript/purescript/default.nix
index 6f61068738af..8a7fb96723a7 100644
--- a/pkgs/development/compilers/purescript/purescript/default.nix
+++ b/pkgs/development/compilers/purescript/purescript/default.nix
@@ -18,19 +18,19 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "purescript";
-  version = "0.13.6";
+  version = "0.13.8";
 
   src =
     if stdenv.isDarwin
     then
     fetchurl {
       url = "https://github.com/${pname}/${pname}/releases/download/v${version}/macos.tar.gz";
-      sha256 = "04kwjjrriyizpvhs96jgyx21ppyd1ynblk24i5825ywxlw9hja25";
+      sha256 = "058w8w24g7xbdkn5l97jfj9dcg81vkfh3w8112anj982lynk6391";
     }
     else
     fetchurl {
       url = "https://github.com/${pname}/${pname}/releases/download/v${version}/linux64.tar.gz";
-      sha256 = "012znrj32aq96qh1g2hscdvhl3flgihhimiz40agk0dykpksblns";
+      sha256 = "01xb9sl6rmg02ypdrv4n0mkzmdr5y9rajcdmg9c3j46q7z6q9mxy";
     };
 
 
@@ -59,7 +59,7 @@ in stdenv.mkDerivation rec {
     description = "A strongly-typed functional programming language that compiles to JavaScript";
     homepage = "https://www.purescript.org/";
     license = licenses.bsd3;
-    maintainers = [ maintainers.justinwoo maintainers.mbbx6spp ];
+    maintainers = with maintainers; [ justinwoo mbbx6spp cdepillabout ];
     platforms = [ "x86_64-linux" "x86_64-darwin" ];
   };
 }
diff --git a/pkgs/development/compilers/yosys/default.nix b/pkgs/development/compilers/yosys/default.nix
index 332824185616..09e51e4c6471 100644
--- a/pkgs/development/compilers/yosys/default.nix
+++ b/pkgs/development/compilers/yosys/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname   = "yosys";
-  version = "2020.06.11";
+  version = "2020.06.16";
 
   src = fetchFromGitHub {
     owner  = "YosysHQ";
     repo   = "yosys";
-    rev    = "a1785e988b2b51dac32985dd6b0afdcedc6bda1d";
-    sha256 = "0987f5vm2zb0i02c3vlw21gihky2cfj5l9b78ddzhxfiv0qfkdfp";
+    rev    = "39ba90a8b84d740b670a9f1df5148b824d441c63";
+    sha256 = "1ncscbhyq4f07d28l32j37y5d84vyqxfx0fbzhb7nzfhplk8hh0s";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/dhall-modules/Prelude.nix b/pkgs/development/dhall-modules/Prelude.nix
index c689f7156fb4..6af08edf88a7 100644
--- a/pkgs/development/dhall-modules/Prelude.nix
+++ b/pkgs/development/dhall-modules/Prelude.nix
@@ -1,26 +1,17 @@
-{ buildDhallPackage, fetchFromGitHub, lib }:
+{ buildDhallGitHubPackage, lib }:
 
 let
   makePrelude =
-    version:
-    lib.makeOverridable
-      ( { rev, sha256, file ? "package.dhall" }:
-          buildDhallPackage {
-            name = "Prelude-${version}";
-
-            code =
-              let
-                src = fetchFromGitHub {
-                  owner = "dhall-lang";
-                  repo  = "dhall-lang";
-
-                  inherit rev sha256;
-                };
-
-              in
-                "${src}/Prelude/${file}";
-          }
-      );
+    version: { rev, sha256 }:
+      buildDhallGitHubPackage {
+        name      = "Prelude-${version}";
+        owner     = "dhall-lang";
+        repo      = "dhall-lang";
+        directory = "Prelude";
+        file      = "package.dhall";
+
+        inherit rev sha256;
+      };
 
 in
   lib.mapAttrs makePrelude {
diff --git a/pkgs/development/dhall-modules/dhall-kubernetes.nix b/pkgs/development/dhall-modules/dhall-kubernetes.nix
index 23a1123eacb3..2de89d63ec37 100644
--- a/pkgs/development/dhall-modules/dhall-kubernetes.nix
+++ b/pkgs/development/dhall-modules/dhall-kubernetes.nix
@@ -1,29 +1,16 @@
-{ buildDhallPackage, fetchFromGitHub, lib }:
+{ buildDhallGitHubPackage, lib }:
 
 let
   makeDhallKubernetes =
-    version:
-    lib.makeOverridable
-      ( { rev
-        , sha256
-        , file ? "package.dhall"
-        }:
-          buildDhallPackage {
-            name = "dhall-kubernetes-${version}";
+    version: { rev, sha256 }:
+      buildDhallGitHubPackage {
+        name  = "dhall-kubernetes-${version}";
+        owner = "dhall-lang";
+        repo  = "dhall-kubernetes";
+        file  = "package.dhall";
 
-            code =
-              let
-                src = fetchFromGitHub {
-                  owner = "dhall-lang";
-                  repo  = "dhall-kubernetes";
-
-                  inherit rev sha256;
-                };
-
-              in
-                "${src}/${file}";
-          }
-      );
+        inherit rev sha256;
+      };
 
 in
   lib.mapAttrs makeDhallKubernetes {
diff --git a/pkgs/development/dhall-modules/dhall-packages.nix b/pkgs/development/dhall-modules/dhall-packages.nix
index 34ebbed68699..866b689e38a1 100644
--- a/pkgs/development/dhall-modules/dhall-packages.nix
+++ b/pkgs/development/dhall-modules/dhall-packages.nix
@@ -1,47 +1,32 @@
-{ buildDhallPackage, dhall-kubernetes, fetchFromGitHub, lib, Prelude }:
+{ buildDhallGitHubPackage, dhall-kubernetes, lib, Prelude }:
 
 let
   makeDhallPackages =
-    version:
-    lib.makeOverridable
-      ( { rev
-        , sha256
-        , dependencies
-        }:
-          buildDhallPackage {
-            name = "dhall-packages-${version}";
+    version: { rev, sha256, dependencies }:
+      buildDhallGitHubPackage {
+        name  = "dhall-packages-${version}";
+        owner = "EarnestResearch";
+        repo  = "dhall-packages";
+        file  = "package.dhall";
 
-            inherit dependencies;
-
-            code =
-              let
-                src = fetchFromGitHub {
-                  owner = "EarnestResearch";
-                  repo  = "dhall-packages";
-
-                  inherit rev sha256;
-                };
-
-              in
-                "${src}/package.dhall";
-          }
-      );
+        inherit rev sha256 dependencies;
+      };
 
 in
   lib.mapAttrs makeDhallPackages {
     "0.11.1" =
       let
-        k8s_6a47bd = dhall-kubernetes."3.0.0".override {
+        k8s_6a47bd = dhall-kubernetes.override {
           rev    = "6a47bd50c4d3984a13570ea62382a3ad4a9919a4";
           sha256 = "1azqs0x2kia3xw93rfk2mdi8izd7gy9aq6qzbip32gin7dncmfhh";
         };
 
-        k8s_4ad581 = dhall-kubernetes."3.0.0".override {
+        k8s_4ad581 = dhall-kubernetes.override {
           rev    = "4ad58156b7fdbbb6da0543d8b314df899feca077";
           sha256 = "12fm70qbhcainxia388svsay2cfg9iksc6mss0nvhgxhpypgp8r0";
         };
 
-        k8s_fee24c = dhall-kubernetes."3.0.0".override {
+        k8s_fee24c = dhall-kubernetes.override {
           rev    = "fee24c0993ba0b20190e2fdb94e386b7fb67252d";
           sha256 = "11d93z8y0jzrb8dl43gqha9z96nxxqkl7cbxpz8hw8ky9x6ggayk";
         };
diff --git a/pkgs/development/go-modules/generic/default.nix b/pkgs/development/go-modules/generic/default.nix
index 9baeefe1b2cb..0d8b382167e5 100644
--- a/pkgs/development/go-modules/generic/default.nix
+++ b/pkgs/development/go-modules/generic/default.nix
@@ -17,7 +17,7 @@
 #
 # if vendorSha256 is null, then we won't fetch any dependencies and
 # rely on the vendor folder within the source.
-, vendorSha256 ? null
+, vendorSha256
 # Whether to delete the vendor folder supplied with the source.
 , deleteVendor ? false
 
diff --git a/pkgs/development/guile-modules/guile-cairo/default.nix b/pkgs/development/guile-modules/guile-cairo/default.nix
index 99e3ddf34f17..000932cc010a 100644
--- a/pkgs/development/guile-modules/guile-cairo/default.nix
+++ b/pkgs/development/guile-modules/guile-cairo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "guile-cairo";
-  version = "1.11.0";
+  version = "1.11.1";
 
   src = fetchurl {
     url = "mirror://savannah/guile-cairo/${pname}-${version}.tar.gz";
-    sha256 = "11fn2x2973dizzw94fkz6rj9crsyzchphq5097lvbkvqpzbyidyp";
+    sha256 = "1gc642r9ndsjhhmh9bl5cbd3dwvy4dpxwhr0zpsw43y9nmz37xpl";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/development/interpreters/dhall/build-dhall-directory-package.nix b/pkgs/development/interpreters/dhall/build-dhall-directory-package.nix
new file mode 100644
index 000000000000..b4401a85d141
--- /dev/null
+++ b/pkgs/development/interpreters/dhall/build-dhall-directory-package.nix
@@ -0,0 +1,25 @@
+{ buildDhallPackage, lib }:
+
+# This is a minor variation on `buildDhallPackage` that splits the `code`
+# argument into `src` and `file` in such a way that you can easily override
+# the `file`
+#
+# This function is used by `dhall-to-nixpkgs` when given a directory
+lib.makeOverridable
+  ( { # Arguments passed through to `buildDhallPackage`
+      name
+    , dependencies ? []
+    , source ? false
+
+    , src
+    , # The file to import, relative to the root directory
+      file ? "package.dhall"
+    }:
+
+    buildDhallPackage {
+      inherit name dependencies source;
+
+      code = "${src}/${file}";
+    }
+  )
+
diff --git a/pkgs/development/interpreters/dhall/build-dhall-github-package.nix b/pkgs/development/interpreters/dhall/build-dhall-github-package.nix
new file mode 100644
index 000000000000..9289e9b656d3
--- /dev/null
+++ b/pkgs/development/interpreters/dhall/build-dhall-github-package.nix
@@ -0,0 +1,50 @@
+{ buildDhallPackage, fetchFromGitHub, lib }:
+
+# This function is used by `dhall-to-nixpkgs` when given a GitHub repository
+lib.makeOverridable
+  ( { # Arguments passed through to `buildDhallPackage`
+      name
+    , dependencies ? []
+    , source ? false
+
+    , # The directory containing the Dhall files, if other than the root of the
+      # repository
+      directory ? ""
+    , # The file to import, relative to the above directory
+      file ? "package.dhall"
+
+      # Arguments passed through to `fetchFromGitHub`
+    , owner
+    , repo
+    , rev
+      # Extra arguments passed through to `fetchFromGitHub`, such as the hash
+      # or `fetchSubmodules`
+    , ...
+    }@args:
+
+    buildDhallPackage {
+      inherit name dependencies source;
+
+      code =
+        let
+          src = fetchFromGitHub ({
+            name = "${name}-source";
+
+            inherit owner repo rev;
+          } // removeAttrs args [
+            "name"
+            "dependencies"
+            "source"
+            "directory"
+            "file"
+            "owner"
+            "repo"
+            "rev"
+          ]);
+
+          prefix = lib.optionalString (directory != "") "${directory}/";
+
+        in
+          "${src}/${prefix}${file}";
+    }
+  )
diff --git a/pkgs/development/interpreters/janet/default.nix b/pkgs/development/interpreters/janet/default.nix
index f6f4e36532ec..32312401f963 100644
--- a/pkgs/development/interpreters/janet/default.nix
+++ b/pkgs/development/interpreters/janet/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "janet";
-  version = "1.9.1";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "janet-lang";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1zdiwddnppwg5zrizy2ypd449zj4mivib76h73xhvr1syl7dk7sc";
+    sha256 = "0kx3c4v0481b4xx239w10ajwp8ngq8smxzh3m77dazd89r997n1g";
   };
 
   nativeBuildInputs = [ meson ninja ];
diff --git a/pkgs/development/libraries/apache-activemq/default.nix b/pkgs/development/libraries/apache-activemq/default.nix
index 7ea38b6472b8..c09fb8d91ee1 100644
--- a/pkgs/development/libraries/apache-activemq/default.nix
+++ b/pkgs/development/libraries/apache-activemq/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "apache-activemq";
-  version = "5.15.12";
+  version = "5.15.13";
 
   src = fetchurl {
-    sha256 = "14v117r9zqvrqr79h66r0dm9lyxq3104rcdizcnvk0syz0zbwps1";
+    sha256 = "1hzapnd0lbiid243xiaz8kv67al8griccjj4dabml62hqhrk9k96";
     url = "mirror://apache/activemq/${version}/${pname}-${version}-bin.tar.gz";
   };
 
diff --git a/pkgs/development/libraries/audio/libmysofa/default.nix b/pkgs/development/libraries/audio/libmysofa/default.nix
index df0eecfd0be9..5324fe0685d6 100644
--- a/pkgs/development/libraries/audio/libmysofa/default.nix
+++ b/pkgs/development/libraries/audio/libmysofa/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libmysofa";
-  version = "1.0";
+  version = "1.1";
 
   src = fetchFromGitHub {
     owner = "hoene";
     repo = "libmysofa";
     rev = "v${version}";
-    sha256 = "053inxfl2n6wdgvnn02kf63m92r48ch4wqix9mqf3rgcf1bfkyfa";
+    sha256 = "12jzap5fh0a1fmfy4z8z4kjjlwi0qzdb9z59ijdlyqdzwxnzkccx";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/cpp-hocon/default.nix b/pkgs/development/libraries/cpp-hocon/default.nix
index dc742a5c051a..01da4753b0e6 100644
--- a/pkgs/development/libraries/cpp-hocon/default.nix
+++ b/pkgs/development/libraries/cpp-hocon/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "cpp-hocon";
-  version = "0.2.1";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
-    sha256 = "0ar7q3rp46m01wvfa289bxnk9xma3ydc67by7i4nrpz8vamvhwc3";
+    sha256 = "1c8zy4hi0182k0vfx5l8bjq1iv7lvvw1zi4vy3429s898rx7z3d3";
     rev = version;
     repo = "cpp-hocon";
     owner = "puppetlabs";
diff --git a/pkgs/development/libraries/curlcpp/default.nix b/pkgs/development/libraries/curlcpp/default.nix
index 274a657cb1af..9f2710f42a46 100644
--- a/pkgs/development/libraries/curlcpp/default.nix
+++ b/pkgs/development/libraries/curlcpp/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "curlcpp";
-  version = "1.1";
+  version = "1.4";
 
   src = fetchFromGitHub {
     owner = "JosephP91";
     repo = "curlcpp";
     rev = version;
-    sha256 = "025qg5hym73xrvyhalv3jgbf9jqnnzkdjs3zwsgbpqx58zyd5bg5";
+    sha256 = "1zx76jcddqk4zkcdb6p7rsmkjbbjm2cj6drj0c8hdd61ms1d0f3n";
   };
 
   buildInputs = [ cmake curl ];
diff --git a/pkgs/development/libraries/freetds/default.nix b/pkgs/development/libraries/freetds/default.nix
index f244bdc7ad2b..c1b9318130c1 100644
--- a/pkgs/development/libraries/freetds/default.nix
+++ b/pkgs/development/libraries/freetds/default.nix
@@ -8,11 +8,11 @@ assert odbcSupport -> unixODBC != null;
 
 stdenv.mkDerivation rec {
   pname = "freetds";
-  version = "1.1.40";
+  version = "1.1.42";
 
   src = fetchurl {
     url    = "https://www.freetds.org/files/stable/${pname}-${version}.tar.bz2";
-    sha256 = "0wc7xxf8fzpp3pc3hpsamnykn0vjkq53qp53nyxjjcri8g0ch7wq";
+    sha256 = "02phnk88zv4f8byx954784w8mh33knsslwvj266jfyrmxz6hxxxg";
   };
 
   buildInputs = [
diff --git a/pkgs/development/libraries/gcc/libgcc/default.nix b/pkgs/development/libraries/gcc/libgcc/default.nix
index d638c2bb2788..f579da5f1d6c 100644
--- a/pkgs/development/libraries/gcc/libgcc/default.nix
+++ b/pkgs/development/libraries/gcc/libgcc/default.nix
@@ -63,7 +63,7 @@ stdenvNoLibs.mkDerivation rec {
       export CPP_FOR_TARGET=${stdenvNoLibs.cc}/bin/$CPP
       export LD_FOR_TARGET=${stdenvNoLibs.cc.bintools}/bin/$LD
 
-      export NIX_BUILD_CFLAGS_COMPILE+=' -DGENERATOR_FILE=1'
+      export NIX_CFLAGS_COMPILE_FOR_BUILD+=' -DGENERATOR_FILE=1'
 
       "$sourceRoot/../gcc/configure" $gccConfigureFlags
 
diff --git a/pkgs/development/libraries/gio-sharp/default.nix b/pkgs/development/libraries/gio-sharp/default.nix
index d7df4ab72127..a19febbfd66e 100644
--- a/pkgs/development/libraries/gio-sharp/default.nix
+++ b/pkgs/development/libraries/gio-sharp/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, autoconf, automake, which, pkgconfig, mono, gtk-sharp-2_0 }:
+{ stdenv, fetchFromGitHub, autoconf, automake, which, pkgconfig, mono, glib, gtk-sharp-2_0 }:
 
 stdenv.mkDerivation rec {
   pname = "gio-sharp";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkgconfig autoconf automake which ];
-  buildInputs = [ mono gtk-sharp-2_0 ];
+  buildInputs = [ mono glib gtk-sharp-2_0 ];
 
   dontStrip = true;
 
diff --git a/pkgs/development/libraries/gmm/default.nix b/pkgs/development/libraries/gmm/default.nix
index eb23f5c82c23..278059465ecb 100644
--- a/pkgs/development/libraries/gmm/default.nix
+++ b/pkgs/development/libraries/gmm/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gmm";
-  version = "5.3";
+  version = "5.4";
 
   src = fetchurl {
     url = "mirror://savannah/getfem/stable/${pname}-${version}.tar.gz";
-    sha256 = "0lkjd3n0298w1dli446z320sn7mqdap8h9q31nydkbw2k7b4db46";
+    sha256 = "0mhygfpsdyr0d4h3sn6g7nxn149yrlqv7r2h34yqkrpv1q4daqvi";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/libdap/default.nix b/pkgs/development/libraries/libdap/default.nix
index 27084e54a827..bc05e774cd86 100644
--- a/pkgs/development/libraries/libdap/default.nix
+++ b/pkgs/development/libraries/libdap/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, bison, libuuid, curl, libxml2, flex }:
 
 stdenv.mkDerivation rec {
-  version = "3.20.5";
+  version = "3.20.6";
   pname = "libdap";
 
   nativeBuildInputs = [ bison flex ];
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://www.opendap.org/pub/source/${pname}-${version}.tar.gz";
-    sha256 = "15jysnsmdjs7q4iafb4qzq4b76cfyvmbxgcxnqg4sr0x4bplwfnb";
+    sha256 = "0jn5bi8k2lq6mmrsw7r1r5aviyf8gb39b2iy20v4kpkj5napzk1m";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/libfprint/default.nix b/pkgs/development/libraries/libfprint/default.nix
index e2552ba713e0..7c6168c3d3e4 100644
--- a/pkgs/development/libraries/libfprint/default.nix
+++ b/pkgs/development/libraries/libfprint/default.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libfprint";
-  version = "1.90.1";
+  version = "1.90.2";
   outputs = [ "out" "devdoc" ];
 
   src = fetchFromGitLab {
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     owner = "libfprint";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0fdaak7qjr9b4482g7fhhqpyfdqpxq5kpmyzkp7f5i7qq2ynb78a";
+    sha256 = "0g890y49anqd7yfz86iyvywxgbfmfmj6813fy58m5n8jain7iy1b";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libiio/default.nix b/pkgs/development/libraries/libiio/default.nix
index 03a907162b12..03324c15d8f7 100644
--- a/pkgs/development/libraries/libiio/default.nix
+++ b/pkgs/development/libraries/libiio/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libiio";
-  version = "0.19";
+  version = "0.20";
 
   src = fetchFromGitHub {
     owner  = "analogdevicesinc";
     repo   = "libiio";
     rev    = "refs/tags/v${version}";
-    sha256 = "1r67h5mayx9krh3mmzs5vz20mvwb2lw04hpbyyisygl01ndc77kq";
+    sha256 = "1929gvizkqmm9cwh3vihxxszfxvgcp5saq9q6chdk3fpdhzajc00";
   };
 
   outputs = [ "out" "lib" "dev" "python" ];
diff --git a/pkgs/development/libraries/libjcat/default.nix b/pkgs/development/libraries/libjcat/default.nix
index 1d6f274cbb3b..bbf0db233821 100644
--- a/pkgs/development/libraries/libjcat/default.nix
+++ b/pkgs/development/libraries/libjcat/default.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libjcat";
-  version = "0.1.2";
+  version = "0.1.3";
 
   outputs = [ "bin" "out" "dev" "devdoc" "man" "installedTests" ];
 
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     owner = "hughsie";
     repo = "libjcat";
     rev = version;
-    sha256 = "0smd1i6gzpp34gv494jcnx40wm36v1s8bypqlfrf8l6q9cl77gyd";
+    sha256 = "157bi1v9qqk45rkq7lg08l7g3bxwacl4h89vnr7msjmg0hri36kc";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/liblastfm/default.nix b/pkgs/development/libraries/liblastfm/default.nix
index 762e707528a6..830e125685e7 100644
--- a/pkgs/development/libraries/liblastfm/default.nix
+++ b/pkgs/development/libraries/liblastfm/default.nix
@@ -1,27 +1,24 @@
-{ stdenv, fetchurl, pkgconfig, which, cmake
+{ stdenv, fetchFromGitHub, fetchpatch, pkgconfig, which, cmake
 , fftwSinglePrec, libsamplerate, qtbase
 , darwin }:
 
-let version = "1.1.0"; in
-
 stdenv.mkDerivation rec {
-  pname = "liblastfm";
-  inherit version;
+  pname = "liblastfm-unstable";
+  version = "2019-08-23";
 
-  # Upstream does not package git tags as tarballs. Get tarball from github.
-  src = fetchurl {
-    url = "https://github.com/lastfm/liblastfm/tarball/${version}";
-    name = "${pname}-${version}.tar.gz";
-    sha256 = "1j34xc30vg7sfszm2jx9mlz9hy7p1l929fka9wnfcpbib8gfi43x";
+  src = fetchFromGitHub {
+    owner = "lastfm";
+    repo = "liblastfm";
+    rev = "2ce2bfe1879227af8ffafddb82b218faff813db9";
+    sha256 = "1crih9xxf3rb109aqw12bjqv47z28lvlk2dpvyym5shf82nz6yd0";
   };
 
-  postPatch = ''
-    substituteInPlace CMakeLists.txt \
-      --replace 'find_package(Qt5Core QUIET)' \
-                'find_package(Qt5 REQUIRED COMPONENTS Core Network Sql Test Xml)'
-  '';
+  patches = [(fetchpatch {
+    url = "https://github.com/lastfm/liblastfm/commit/9c5d072b55f2863310e40291677e6397e9cbc3c2.patch";
+    name = "0001-Remove-deprecated-staging-server-and-fix-test-for-QT5-at-Ubuntu-19.10.patch";
+    sha256 = "04r14prydxshjgfws3pjajjmp2msszhjjs1mjh8s66yg29vq620l";
+  })];
 
-  prefixKey = "--prefix ";
   nativeBuildInputs = [ pkgconfig which cmake ];
   buildInputs = [ fftwSinglePrec libsamplerate qtbase ]
     ++ stdenv.lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.SystemConfiguration;
@@ -31,7 +28,7 @@ stdenv.mkDerivation rec {
     repositories.git = "git://github.com/lastfm/liblastfm.git";
     description = "Official LastFM library";
     platforms = platforms.unix;
-    maintainers =  [ maintainers.phreedom ];
+    maintainers = [ maintainers.phreedom ];
     license = licenses.gpl3;
   };
 }
diff --git a/pkgs/development/libraries/liblouis/default.nix b/pkgs/development/libraries/liblouis/default.nix
index 83d08dc019bf..5d0459b4f308 100644
--- a/pkgs/development/libraries/liblouis/default.nix
+++ b/pkgs/development/libraries/liblouis/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "liblouis";
-  version = "3.13.0";
+  version = "3.14.0";
 
   src = fetchFromGitHub {
     owner = "liblouis";
     repo = "liblouis";
     rev = "v${version}";
-    sha256 = "1srpafxdw4627lyv92cn8wd9zda3507qpp5s2z66bsln8jnb1mza";
+    sha256 = "0v6w8b9r994mkkbm2gqgd7k5yfmdhgbabh0j1gmn375nyvhy4qqh";
   };
 
   outputs = [ "out" "dev" "man" "info" "doc" ];
diff --git a/pkgs/development/libraries/libnetfilter_queue/default.nix b/pkgs/development/libraries/libnetfilter_queue/default.nix
index 556db28f8568..55e07c03b287 100644
--- a/pkgs/development/libraries/libnetfilter_queue/default.nix
+++ b/pkgs/development/libraries/libnetfilter_queue/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, pkgconfig, libmnl, libnfnetlink }:
 
 stdenv.mkDerivation rec {
-  version = "1.0.3";
+  version = "1.0.4";
   pname = "libnetfilter_queue";
 
   src = fetchurl {
     url = "https://www.netfilter.org/projects/libnetfilter_queue/files/${pname}-${version}.tar.bz2";
-    sha256 = "0x77m1fvbqzz5z64jz59fb6j8dvv8b9pg4fmznqwax4x6imjcncq";
+    sha256 = "0w7s6g8bikch1m4hnxdakpkwgrkw64ikb6wb4v4zvgyiywrk5yai";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/development/libraries/libraspberrypi/default.nix b/pkgs/development/libraries/libraspberrypi/default.nix
index 1cd1f5e62ac1..bbe0b6145503 100644
--- a/pkgs/development/libraries/libraspberrypi/default.nix
+++ b/pkgs/development/libraries/libraspberrypi/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   name = "libraspberrypi";
-  version = "2019-10-22";
+  version = "2020-05-28";
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "userland";
-    rev = "5070cb7fc150fc98f1ed64a7739c3356970d9f76";
-    sha256 = "08yfzwn9s7lhrblcsxyag9p5lj5vk3n66b1pv3f7r3hah7qcggyq";
+    rev = "f97b1af1b3e653f9da2c1a3643479bfd469e3b74";
+    sha256 = "1r7n05rv96hqjq0rn0qzchmfqs0j7vh3p8jalgh66s6l0vms5mwy";
   };
 
   cmakeFlags = if (stdenv.targetPlatform.system == "aarch64-linux")
diff --git a/pkgs/development/libraries/librealsense/default.nix b/pkgs/development/libraries/librealsense/default.nix
index 8fd90c60bdad..21f80f80efa0 100644
--- a/pkgs/development/libraries/librealsense/default.nix
+++ b/pkgs/development/libraries/librealsense/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "librealsense";
-  version = "2.34.0";
+  version = "2.35.2";
 
   outputs = [ "out" "dev" ];
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     owner = "IntelRealSense";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0bi7pszrryz18aqna0z73mb1hzz2vqdb0m00pf93hnwc2hba7hwm";
+    sha256 = "14vf76vlyhh7b4yjzsnqpg1x3wdhwxrf1syvgf8wyxbjwb9plw82";
   };
 
   buildInputs = [
diff --git a/pkgs/development/libraries/libsolv/default.nix b/pkgs/development/libraries/libsolv/default.nix
index 9443846acf1e..d559efd3aab5 100644
--- a/pkgs/development/libraries/libsolv/default.nix
+++ b/pkgs/development/libraries/libsolv/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, cmake, ninja, zlib, expat, rpm, db }:
 
 stdenv.mkDerivation rec {
-  version  = "0.7.13";
+  version  = "0.7.14";
   pname = "libsolv";
 
   src = fetchFromGitHub {
     owner  = "openSUSE";
     repo   = "libsolv";
     rev    = version;
-    sha256 = "1hjk7r7047i451xjgw72in62pya1h1436fvx945vxlvswl5s6iw8";
+    sha256 = "10klbgknl2njbjl4k0l50ii7afwqrl1691ar4ry3snmc8chb1z7g";
   };
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/libu2f-host/default.nix b/pkgs/development/libraries/libu2f-host/default.nix
index 3becd075b255..f033aa9f610f 100644
--- a/pkgs/development/libraries/libu2f-host/default.nix
+++ b/pkgs/development/libraries/libu2f-host/default.nix
@@ -14,10 +14,6 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  postInstall = ''
-    install -D -t $out/lib/udev/rules.d 70-u2f.rules
-  '';
-
   meta = with stdenv.lib; {
     homepage = "https://developers.yubico.com/libu2f-host";
     description = "A C library and command-line tool that implements the host-side of the U2F protocol";
diff --git a/pkgs/development/libraries/lmdb/default.nix b/pkgs/development/libraries/lmdb/default.nix
index 513e842edfa5..64f6fccefa79 100644
--- a/pkgs/development/libraries/lmdb/default.nix
+++ b/pkgs/development/libraries/lmdb/default.nix
@@ -1,14 +1,13 @@
-{ stdenv, fetchFromGitHub }:
+{ stdenv, fetchgit }:
 
 stdenv.mkDerivation rec {
   pname = "lmdb";
-  version = "0.9.24";
+  version = "0.9.25";
 
-  src = fetchFromGitHub {
-    owner = "LMDB";
-    repo = "lmdb";
+  src = fetchgit {
+    url = "https://git.openldap.org/openldap/openldap.git";
     rev = "LMDB_${version}";
-    sha256 = "088q6m8fvr12w43s461h7cvpg5hj8csaqj6n9pci150dz7bk5lxm";
+    sha256 = "0i60zlca8r6fib23gdgl4c80gxpx24772ggpvz94yr7zaai4k11w";
   };
 
   postUnpack = "sourceRoot=\${sourceRoot}/libraries/liblmdb";
diff --git a/pkgs/development/libraries/nanopb/default.nix b/pkgs/development/libraries/nanopb/default.nix
new file mode 100644
index 000000000000..a63d367b800d
--- /dev/null
+++ b/pkgs/development/libraries/nanopb/default.nix
@@ -0,0 +1,88 @@
+{ callPackage
+, cmake
+, fetchFromGitHub
+, lib
+, protobuf
+, python3
+, stdenv
+}:
+
+let
+  pythonRuntime = python3.withPackages(ps: [ ps.protobuf ]);
+in stdenv.mkDerivation rec {
+  pname = "nanopb";
+  version = "0.4.1";
+
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = version;
+    sha256 = "16zxk42wzn519bpxf4578qn97k0h1cnbkvqqkqvka9sl0n3lz2dp";
+  };
+
+  nativeBuildInputs = [ cmake python3 ];
+
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=ON" # generate $out/lib/libprotobuf-nanopb.so{.0,}
+    "-DBUILD_STATIC_LIBS=ON" # generate $out/lib/libprotobuf-nanopb.a
+    "-Dnanopb_PROTOC_PATH=${protobuf}/bin/protoc"
+  ];
+
+  # On a case-insensitive filesystem (such as on Darwin), CMake fails to create
+  # the build directory because of the existence of the BUILD file.
+  # TODO: This can be removed once https://github.com/nanopb/nanopb/pull/537 is merged.
+  preConfigure = "rm BUILD";
+
+  # install the generator which requires Python3 with the protobuf package. It
+  # also requires the nanopb module that's generated by CMake to be in a
+  # relative location to the generator itself so we move it out of the
+  # python.sitePackages into the shared generator folder.
+  postInstall = ''
+    mkdir -p $out/share/nanopb/generator/proto
+    cp ../generator/nanopb_generator.py $out/share/nanopb/generator/nanopb_generator.py
+    cp ../generator/proto/_utils.py $out/share/nanopb/generator/proto/_utils.py
+    cp ../generator/proto/nanopb.proto $out/share/nanopb/generator/proto/nanopb.proto
+    mv $out/${python3.sitePackages}/nanopb_pb2.py $out/share/nanopb/generator/proto
+    rm -rf $out/${python3.sitePackages}
+
+    mkdir $out/bin
+    substitute ${./protoc-gen-nanopb} $out/bin/protoc-gen-nanopb \
+      --subst-var-by python ${pythonRuntime}/bin/python \
+      --subst-var-by out $out
+    chmod +x $out/bin/protoc-gen-nanopb
+  '';
+
+  passthru.tests = {
+    simple-proto2 = callPackage ./test-simple-proto2 {};
+    simple-proto3 = callPackage ./test-simple-proto3 {};
+    message-with-annotations = callPackage ./test-message-with-annotations {};
+    message-with-options = callPackage ./test-message-with-options {};
+  };
+
+  meta = with lib; {
+    inherit (protobuf.meta) platforms;
+
+    description = "Protocol Buffers with small code size";
+    homepage = "https://jpa.kapsi.fi/nanopb/";
+    license = licenses.zlib;
+    maintainers = with maintainers; [ kalbasit ];
+
+    longDescription = ''
+      Nanopb is a small code-size Protocol Buffers implementation in ansi C. It
+      is especially suitable for use in microcontrollers, but fits any memory
+      restricted system.
+
+      - Homepage: jpa.kapsi.fi/nanopb
+      - Documentation: jpa.kapsi.fi/nanopb/docs
+      - Downloads: jpa.kapsi.fi/nanopb/download
+      - Forum: groups.google.com/forum/#!forum/nanopb
+
+      In order to use the nanopb options in your proto files, you'll need to
+      tell protoc where to find the nanopb.proto file.
+      You can do so with the --proto_path (-I) option to add the directory
+      ''${nanopb}/share/nanopb/generator/proto like so:
+
+      protoc --proto_path=. --proto_path=''${nanopb}/share/nanopb/generator/proto --plugin=protoc-gen-nanopb=''${nanopb}/bin/protoc-gen-nanopb --nanopb_out=out file.proto
+    '';
+  };
+}
diff --git a/pkgs/development/libraries/nanopb/protoc-gen-nanopb b/pkgs/development/libraries/nanopb/protoc-gen-nanopb
new file mode 100644
index 000000000000..764e6614b18a
--- /dev/null
+++ b/pkgs/development/libraries/nanopb/protoc-gen-nanopb
@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+exec @python@ @out@/share/nanopb/generator/nanopb_generator.py --protoc-plugin
diff --git a/pkgs/development/libraries/nanopb/test-message-with-annotations/default.nix b/pkgs/development/libraries/nanopb/test-message-with-annotations/default.nix
new file mode 100644
index 000000000000..618d7c521ce0
--- /dev/null
+++ b/pkgs/development/libraries/nanopb/test-message-with-annotations/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, protobuf, nanopb }:
+
+stdenv.mkDerivation {
+  name = "nanopb-test-message-with-annotations";
+  meta.timeout = 60;
+  src = ./.;
+
+  # protoc requires any .proto file to be compiled to reside within it's
+  # proto_path. By default the current directory is automatically added to the
+  # proto_path. I tried using --proto_path ${./.} ${./simple.proto} and it did
+  # not work because they end up in the store at different locations.
+  installPhase = ":";
+  buildPhase = ''
+    mkdir $out
+
+    ${protobuf}/bin/protoc --proto_path=. --proto_path=${nanopb}/share/nanopb/generator/proto --plugin=protoc-gen-nanopb=${nanopb}/bin/protoc-gen-nanopb --nanopb_out=$out withannotations.proto
+  '';
+
+  docheck = true;
+  checkphase = ''
+    grep -q WithAnnotations $out/withannotations.pb.c || (echo "error: WithAnnotations not found in $out/withannotations.pb.c"; exit 1)
+    grep -q WithAnnotations $out/withannotations.pb.h || (echo "error: WithAnnotations not found in $out/withannotations.pb.h"; exit 1)
+    grep -q "pb_byte_t uuid\[16\]" $out/withannotations.pb.h || (echo "error: uuid is not of type pb_byte_t and of size 16 in $out/withannotations.pb.h"; exit 1)
+    grep -q "FIXED_LENGTH_BYTES, uuid" $out/withannotations.pb.h || (echo "error: uuid is not of fixed lenght bytes in $out/withannotations.pb.h"; exit 1)
+    grep -q "#define WithAnnotations_size" $out/withannotations.pb.h || (echo "error: the size of WithAnnotations is not known in $out/withannotations.pb.h"; exit 1)
+  '';
+}
diff --git a/pkgs/development/libraries/nanopb/test-message-with-annotations/withannotations.proto b/pkgs/development/libraries/nanopb/test-message-with-annotations/withannotations.proto
new file mode 100644
index 000000000000..d8109e877d68
--- /dev/null
+++ b/pkgs/development/libraries/nanopb/test-message-with-annotations/withannotations.proto
@@ -0,0 +1,7 @@
+syntax = "proto3";
+
+import "nanopb.proto";
+
+message WithAnnotations {
+  bytes uuid = 1 [(nanopb).max_size = 16, (nanopb).fixed_length = true];
+}
diff --git a/pkgs/development/libraries/nanopb/test-message-with-options/default.nix b/pkgs/development/libraries/nanopb/test-message-with-options/default.nix
new file mode 100644
index 000000000000..c15b51f71977
--- /dev/null
+++ b/pkgs/development/libraries/nanopb/test-message-with-options/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, protobuf, nanopb }:
+
+stdenv.mkDerivation {
+  name = "nanopb-test-message-with-options";
+  meta.timeout = 60;
+  src = ./.;
+
+  # protoc requires any .proto file to be compiled to reside within it's
+  # proto_path. By default the current directory is automatically added to the
+  # proto_path. I tried using --proto_path ${./.} ${./simple.proto} and it did
+  # not work because they end up in the store at different locations.
+  installPhase = ":";
+  buildPhase = ''
+    mkdir $out
+
+    ${protobuf}/bin/protoc --plugin=protoc-gen-nanopb=${nanopb}/bin/protoc-gen-nanopb --nanopb_out=$out withoptions.proto
+  '';
+
+  docheck = true;
+  checkphase = ''
+    grep -q WithOptions $out/withoptions.pb.c || (echo "error: WithOptions not found in $out/withoptions.pb.c"; exit 1)
+    grep -q WithOptions $out/withoptions.pb.h || (echo "error: WithOptions not found in $out/withoptions.pb.h"; exit 1)
+    grep -q "pb_byte_t uuid\[16\]" $out/withoptions.pb.h || (echo "error: uuid is not of type pb_byte_t and of size 16 in $out/withoptions.pb.h"; exit 1)
+    grep -q "FIXED_LENGTH_BYTES, uuid" $out/withoptions.pb.h || (echo "error: uuid is not of fixed lenght bytes in $out/withoptions.pb.h"; exit 1)
+    grep -q "#define WithOptions_size" $out/withoptions.pb.h || (echo "error: the size of WithOptions is not known in $out/withoptions.pb.h"; exit 1)
+  '';
+}
diff --git a/pkgs/development/libraries/nanopb/test-message-with-options/withoptions.options b/pkgs/development/libraries/nanopb/test-message-with-options/withoptions.options
new file mode 100644
index 000000000000..ecf98a217367
--- /dev/null
+++ b/pkgs/development/libraries/nanopb/test-message-with-options/withoptions.options
@@ -0,0 +1 @@
+ WithOptions.uuid max_size:16 fixed_length:true
diff --git a/pkgs/development/libraries/nanopb/test-message-with-options/withoptions.proto b/pkgs/development/libraries/nanopb/test-message-with-options/withoptions.proto
new file mode 100644
index 000000000000..5a5da3a1c973
--- /dev/null
+++ b/pkgs/development/libraries/nanopb/test-message-with-options/withoptions.proto
@@ -0,0 +1,5 @@
+syntax = "proto3";
+
+message WithOptions {
+  bytes uuid = 1;
+}
diff --git a/pkgs/development/libraries/nanopb/test-simple-proto2/default.nix b/pkgs/development/libraries/nanopb/test-simple-proto2/default.nix
new file mode 100644
index 000000000000..a915e7785370
--- /dev/null
+++ b/pkgs/development/libraries/nanopb/test-simple-proto2/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, protobuf, nanopb }:
+
+stdenv.mkDerivation {
+  name = "nanopb-test-simple-proto2";
+  meta.timeout = 60;
+  src = ./.;
+
+  # protoc requires any .proto file to be compiled to reside within it's
+  # proto_path. By default the current directory is automatically added to the
+  # proto_path. I tried using --proto_path ${./.} ${./simple.proto} and it did
+  # not work because they end up in the store at different locations.
+  installPhase = ":";
+  buildPhase = ''
+    mkdir $out
+
+    ${protobuf}/bin/protoc --plugin=protoc-gen-nanopb=${nanopb}/bin/protoc-gen-nanopb --nanopb_out=$out simple.proto
+  '';
+
+  doCheck = true;
+  checkPhase = ''
+    grep -q SimpleMessage $out/simple.pb.c || (echo "ERROR: SimpleMessage not found in $out/simple.pb.c"; exit 1)
+    grep -q SimpleMessage $out/simple.pb.h || (echo "ERROR: SimpleMessage not found in $out/simple.pb.h"; exit 1)
+  '';
+}
diff --git a/pkgs/development/libraries/nanopb/test-simple-proto2/simple.proto b/pkgs/development/libraries/nanopb/test-simple-proto2/simple.proto
new file mode 100644
index 000000000000..b02936b1ae26
--- /dev/null
+++ b/pkgs/development/libraries/nanopb/test-simple-proto2/simple.proto
@@ -0,0 +1,5 @@
+syntax = "proto2";
+
+message SimpleMessage {
+  required int32 lucky_number = 1;
+}
diff --git a/pkgs/development/libraries/nanopb/test-simple-proto3/default.nix b/pkgs/development/libraries/nanopb/test-simple-proto3/default.nix
new file mode 100644
index 000000000000..3e2bba731b9f
--- /dev/null
+++ b/pkgs/development/libraries/nanopb/test-simple-proto3/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, protobuf, nanopb }:
+
+stdenv.mkDerivation {
+  name = "nanopb-test-simple-proto3";
+  meta.timeout = 60;
+  src = ./.;
+
+  # protoc requires any .proto file to be compiled to reside within it's
+  # proto_path. By default the current directory is automatically added to the
+  # proto_path. I tried using --proto_path ${./.} ${./simple.proto} and it did
+  # not work because they end up in the store at different locations.
+  installPhase = ":";
+  buildPhase = ''
+    mkdir $out
+
+    ${protobuf}/bin/protoc --plugin=protoc-gen-nanopb=${nanopb}/bin/protoc-gen-nanopb --nanopb_out=$out simple.proto
+  '';
+
+  doCheck = true;
+  checkPhase = ''
+    grep -q SimpleMessage $out/simple.pb.c || (echo "ERROR: SimpleMessage not found in $out/simple.pb.c"; exit 1)
+    grep -q SimpleMessage $out/simple.pb.h || (echo "ERROR: SimpleMessage not found in $out/simple.pb.h"; exit 1)
+  '';
+}
diff --git a/pkgs/development/libraries/nanopb/test-simple-proto3/simple.proto b/pkgs/development/libraries/nanopb/test-simple-proto3/simple.proto
new file mode 100644
index 000000000000..6b99cdb5daa7
--- /dev/null
+++ b/pkgs/development/libraries/nanopb/test-simple-proto3/simple.proto
@@ -0,0 +1,5 @@
+syntax = "proto3";
+
+message SimpleMessage {
+  int32 lucky_number = 1;
+}
diff --git a/pkgs/development/libraries/olm/default.nix b/pkgs/development/libraries/olm/default.nix
index c84e66608f2a..d5c230862333 100644
--- a/pkgs/development/libraries/olm/default.nix
+++ b/pkgs/development/libraries/olm/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Implements double cryptographic ratchet and Megolm ratchet";
     license = stdenv.lib.licenses.asl20;
-    homepage = "https://matrix.org/git/olm/about";
+    homepage = "https://gitlab.matrix.org/matrix-org/olm";
     platforms = with stdenv.lib.platforms; darwin ++ linux;
   };
 }
diff --git a/pkgs/development/libraries/opendht/default.nix b/pkgs/development/libraries/opendht/default.nix
index a62138e8ccf4..c8b1205bc91b 100644
--- a/pkgs/development/libraries/opendht/default.nix
+++ b/pkgs/development/libraries/opendht/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "opendht";
-  version = "2.1.1";
+  version = "2.1.3";
 
   src = fetchFromGitHub {
     owner = "savoirfairelinux";
     repo = "opendht";
     rev = version;
-    sha256 = "10sbiwjljxi0a1q3xakmf6v02x3yf38ljvjpql70q4rqggqj9zhh";
+    sha256 = "0qz9mdkanz4vd38bdpwvcwvbpzf19i6019rmqw3k1vh5mh22ljhr";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/development/libraries/openmpi/default.nix b/pkgs/development/libraries/openmpi/default.nix
index 38041e6b5d80..5c185f630d98 100644
--- a/pkgs/development/libraries/openmpi/default.nix
+++ b/pkgs/development/libraries/openmpi/default.nix
@@ -19,7 +19,7 @@
 assert !cudaSupport || cudatoolkit != null;
 
 let
-  version = "4.0.3";
+  version = "4.0.4";
 
   cudatoolkit_joined = symlinkJoin {
     name = "${cudatoolkit.name}-unsplit";
@@ -31,7 +31,7 @@ in stdenv.mkDerivation rec {
 
   src = with stdenv.lib.versions; fetchurl {
     url = "https://www.open-mpi.org/software/ompi/v${major version}.${minor version}/downloads/${pname}-${version}.tar.bz2";
-    sha256 = "00zxcw99gr5n693cmcmn4f6a47vx1ywna895p0x7p163v37gw0hl";
+    sha256 = "1i0slg2dxjdgw513aml1n9dsbdxn2fimi2b5712d5r9z4ar4xqj7";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/openwsman/default.nix b/pkgs/development/libraries/openwsman/default.nix
index 17df9eee84e8..a16b8356e618 100644
--- a/pkgs/development/libraries/openwsman/default.nix
+++ b/pkgs/development/libraries/openwsman/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openwsman";
-  version = "2.6.11";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner  = "Openwsman";
     repo   = "openwsman";
     rev    = "v${version}";
-    sha256 = "0s8xdxrxnh1l0v41n5cw89b89rrlqlxn1yj14sw224230y8m70ka";
+    sha256 = "19dj38jyzhhhvk863cikcwk5awzlq3337pxmsaqqm4wrcygrkfmx";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
diff --git a/pkgs/development/libraries/protobufc/1.3.nix b/pkgs/development/libraries/protobufc/1.3.nix
index 304f9d61f397..82126727282c 100644
--- a/pkgs/development/libraries/protobufc/1.3.nix
+++ b/pkgs/development/libraries/protobufc/1.3.nix
@@ -1,12 +1,11 @@
 { callPackage, fetchFromGitHub, ... } @ args:
 
-callPackage ./generic.nix (args // {
-  version = "1.3.1";
+callPackage ./generic.nix (args // rec {
+  version = "1.3.3";
   src = fetchFromGitHub {
     owner = "protobuf-c";
     repo = "protobuf-c";
-    #rev = "v${version}";
-    rev = "9412830d0680150d429d2aa170b8d7218ab49397";
-    sha256 = "175cmaj5231iqzhf5a9sxw2y3i165chk3681m1b5mp8di927q5ai";
+    rev = "v${version}";
+    sha256 = "13948amsjj9xpa4yl6amlyk3ksr96bbd4ngshh2yzflwcslhg6gv";
   };
 })
diff --git a/pkgs/development/libraries/swiften/build-fix.patch b/pkgs/development/libraries/swiften/build-fix.patch
new file mode 100644
index 000000000000..01814cadfbd4
--- /dev/null
+++ b/pkgs/development/libraries/swiften/build-fix.patch
@@ -0,0 +1,32 @@
+diff -wbBur swift-4.0.2/Swift/QtUI/UserSearch/QtUserSearchWindow.h swift-4.0.2.my/Swift/QtUI/UserSearch/QtUserSearchWindow.h
+--- swift-4.0.2/Swift/QtUI/UserSearch/QtUserSearchWindow.h	2018-04-06 13:06:46.000000000 +0300
++++ swift-4.0.2.my/Swift/QtUI/UserSearch/QtUserSearchWindow.h	2019-10-08 20:52:23.171475337 +0300
+@@ -9,6 +9,7 @@
+ #include <set>
+ 
+ #include <QWizard>
++#include <QAbstractItemModel>
+ 
+ #include <Swiften/Base/Override.h>
+ 
+diff -wbBur swift-4.0.2/Swiften/Network/PlatformNATTraversalWorker.cpp swift-4.0.2.my/Swiften/Network/PlatformNATTraversalWorker.cpp
+--- swift-4.0.2/Swiften/Network/PlatformNATTraversalWorker.cpp	2018-04-06 13:06:46.000000000 +0300
++++ swift-4.0.2.my/Swiften/Network/PlatformNATTraversalWorker.cpp	2019-10-08 21:12:25.284754131 +0300
+@@ -157,7 +157,7 @@
+         miniUPnPInterface = new MiniUPnPInterface();
+         miniUPnPSupported = miniUPnPInterface->isAvailable();
+     }
+-    SWIFT_LOG(debug) << "UPnP NAT traversal supported: " << miniUPnPSupported << std::endl;
++//    SWIFT_LOG(debug) << "UPnP NAT traversal supported: " << miniUPnPSupported << std::endl;
+     if (miniUPnPSupported) {
+         return miniUPnPInterface;
+     }
+@@ -168,7 +168,7 @@
+         natPMPInterface = new NATPMPInterface();
+         natPMPSupported = natPMPInterface->isAvailable();
+     }
+-    SWIFT_LOG(debug) << "NAT-PMP NAT traversal supported: " << natPMPSupported << std::endl;
++//    SWIFT_LOG(debug) << "NAT-PMP NAT traversal supported: " << natPMPSupported << std::endl;
+     if (natPMPSupported) {
+         return natPMPInterface;
+     }
diff --git a/pkgs/development/libraries/swiften/default.nix b/pkgs/development/libraries/swiften/default.nix
index bdac55fe2ec3..19bacdd2a614 100644
--- a/pkgs/development/libraries/swiften/default.nix
+++ b/pkgs/development/libraries/swiften/default.nix
@@ -12,17 +12,21 @@ stdenv.mkDerivation rec {
     sha256 = "0w0aiszjd58ynxpacwcgf052zpmbpcym4dhci64vbfgch6wryz0w";
   };
 
-  patches = [ ./scons.patch ];
+  patches = [ ./scons.patch ./build-fix.patch ];
 
   sconsFlags = [
     "openssl=${openssl.dev}"
     "boost_includedir=${boost.dev}/include"
     "boost_libdir=${boost.out}/lib"
     "boost_bundled_enable=false"
+    "max_jobs=1"
+    "optimize=1"
+    "debug=0"
+    "swiften_dll=1"
   ];
   preInstall = ''
     installTargets="$out"
-    installFlags+=" SWIFT_INSTALLDIR=$out"
+    installFlags+=" SWIFTEN_INSTALLDIR=$out"
   '';
 
   enableParallelBuilding = true;
@@ -33,6 +37,5 @@ stdenv.mkDerivation rec {
     license     = licenses.gpl2Plus;
     platforms   = platforms.linux;
     maintainers = [ maintainers.twey ];
-    broken = true; # Broken since 2019-11-20 (https://hydra.nixos.org/build/114681755)
   };
 }
diff --git a/pkgs/development/libraries/tpm2-tss/default.nix b/pkgs/development/libraries/tpm2-tss/default.nix
index b264c3bc6c6e..2421d3f88990 100644
--- a/pkgs/development/libraries/tpm2-tss/default.nix
+++ b/pkgs/development/libraries/tpm2-tss/default.nix
@@ -1,36 +1,32 @@
-{ stdenv, lib, fetchurl, fetchpatch
-, cmocka, doxygen, ibm-sw-tpm2, iproute, openssl, perl, pkgconfig, procps
-, uthash, which
+{ stdenv, lib, fetchFromGitHub
+, autoreconfHook, autoconf-archive, pkg-config, doxygen, perl
+, openssl, json_c, curl, libgcrypt
+, cmocka, uthash, ibm-sw-tpm2, iproute, procps, which
 }:
 
 stdenv.mkDerivation rec {
   pname = "tpm2-tss";
-  version = "2.3.2";
+  version = "2.4.1";
 
-  src = fetchurl {
-    url = "https://github.com/tpm2-software/${pname}/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "19jg09sxy3aj4dc1yv32jjv0m62cnmhjlw02jbh4d4pk2439m4l2";
+  src = fetchFromGitHub {
+    owner = "tpm2-software";
+    repo = pname;
+    rev = version;
+    sha256 = "09x5czaj4a8cyf8cxavcasx3yy1kik1s45a90c7zvxb7y1kfp9zs";
   };
 
-  patches = [
-    # Fix test failure. see https://github.com/tpm2-software/tpm2-tss/pull/1585
-    (fetchpatch {
-      url = "https://patch-diff.githubusercontent.com/raw/tpm2-software/tpm2-tss/pull/1585.patch";
-      sha256 = "0ak3l588ahzv3yx1gfa4sa6p74lsffxzkr23ppznm34wvlcci86n";
-    })
-  ];
-
   nativeBuildInputs = [
-    doxygen perl pkgconfig
-    # For unit tests and integration tests.
-    ibm-sw-tpm2 iproute procps which
+    autoreconfHook autoconf-archive pkg-config doxygen perl
   ];
-  buildInputs = [
-    openssl
-    # For unit tests and integration tests.
-    cmocka uthash
+  buildInputs = [ openssl json_c curl libgcrypt ];
+  checkInputs = [
+    cmocka uthash ibm-sw-tpm2 iproute procps which
   ];
 
+  preAutoreconf = "./bootstrap";
+
+  enableParallelBuilding = true;
+
   postPatch = "patchShebangs script";
 
   configureFlags = [
diff --git a/pkgs/development/libraries/trompeloeil/default.nix b/pkgs/development/libraries/trompeloeil/default.nix
index 782af4ab0331..625b16cc99a0 100644
--- a/pkgs/development/libraries/trompeloeil/default.nix
+++ b/pkgs/development/libraries/trompeloeil/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "trompeloeil";
-  version = "37";
+  version = "38";
 
   src = fetchFromGitHub {
     owner = "rollbear";
     repo = "trompeloeil";
     rev = "v${version}";
-    sha256 = "04f9vpzh4fc15w4ynirzs9ipm9r31dbggb2zilmk0fj4qr79am42";
+    sha256 = "068q4xx09vwjs7i89w47qzymdb4l6jqi27gx2jmd3yb6fp2k7nsb";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/wlroots/default.nix b/pkgs/development/libraries/wlroots/default.nix
index 104e0c3440aa..33db6e9d75b1 100644
--- a/pkgs/development/libraries/wlroots/default.nix
+++ b/pkgs/development/libraries/wlroots/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, meson, ninja, pkg-config, wayland
 , libGL, wayland-protocols, libinput, libxkbcommon, pixman
 , xcbutilwm, libX11, libcap, xcbutilimage, xcbutilerrors, mesa
-, libpng, ffmpeg_4
+, libpng, ffmpeg
 }:
 
 stdenv.mkDerivation rec {
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     libGL wayland-protocols libinput libxkbcommon pixman
     xcbutilwm libX11 libcap xcbutilimage xcbutilerrors mesa
-    libpng ffmpeg_4
+    libpng ffmpeg
   ];
 
   postInstall = ''
diff --git a/pkgs/development/libraries/wxwidgets/3.0/default.nix b/pkgs/development/libraries/wxwidgets/3.0/default.nix
index 8de7f99fe5fd..da29eacdc0e9 100644
--- a/pkgs/development/libraries/wxwidgets/3.0/default.nix
+++ b/pkgs/development/libraries/wxwidgets/3.0/default.nix
@@ -1,8 +1,9 @@
 { stdenv, fetchFromGitHub, fetchurl, pkgconfig
-, gtk2, gtk3, libXinerama, libSM, libXxf86vm
-, xorgproto, gstreamer, gst-plugins-base, GConf, setfile
+, libXinerama, libSM, libXxf86vm
+, gtk2, GConf ? null, gtk3
+, xorgproto, gstreamer, gst-plugins-base, setfile
 , libGLSupported ? stdenv.lib.elem stdenv.hostPlatform.system stdenv.lib.platforms.mesaPlatforms
-, withMesa ? stdenv.lib.elem stdenv.hostPlatform.system stdenv.lib.platforms.mesaPlatforms
+, withMesa ? libGLSupported
 , libGLU ? null, libGL ? null
 , compat24 ? false, compat26 ? true, unicode ? true
 , withGtk2 ? true
@@ -28,9 +29,10 @@ stdenv.mkDerivation rec {
     sha256 = "19mqglghjjqjgz4rbybn3qdgn2cz9xc511nq1pvvli9wx2k8syl1";
   };
 
-  buildInputs =
-    [ (if withGtk2 then gtk2 else gtk3) libXinerama libSM libXxf86vm xorgproto gstreamer
-      gst-plugins-base GConf ]
+  buildInputs = [
+    libXinerama libSM libXxf86vm xorgproto gstreamer gst-plugins-base
+  ] ++ optionals withGtk2 [ gtk2 GConf ]
+    ++ optional (!withGtk2) gtk3
     ++ optional withMesa libGLU
     ++ optional withWebKit webkitgtk
     ++ optionals stdenv.isDarwin [ setfile Carbon Cocoa Kernel QTKit ];
diff --git a/pkgs/development/libraries/wxwidgets/3.1/default.nix b/pkgs/development/libraries/wxwidgets/3.1/default.nix
index 99f86974cdb4..790968a88f76 100644
--- a/pkgs/development/libraries/wxwidgets/3.1/default.nix
+++ b/pkgs/development/libraries/wxwidgets/3.1/default.nix
@@ -1,6 +1,7 @@
 { stdenv, fetchFromGitHub, fetchurl, pkgconfig
-, gtk2, gtk3, libXinerama, libSM, libXxf86vm
-, xorgproto, gstreamer, gst-plugins-base, GConf, setfile
+, libXinerama, libSM, libXxf86vm
+, gtk2, GConf ? null, gtk3
+, xorgproto, gstreamer, gst-plugins-base, setfile
 , libGLSupported ? stdenv.lib.elem stdenv.hostPlatform.system stdenv.lib.platforms.mesaPlatforms
 , withMesa ? libGLSupported, libGLU ? null, libGL ? null
 , compat28 ? false, compat30 ? true, unicode ? true
@@ -27,9 +28,10 @@ stdenv.mkDerivation rec {
     sha256 = "0gfdhb7xq5vzasm7s1di39nchv42zsp0dmn4v6knzb7mgsb107wb";
   };
 
-  buildInputs =
-    [ (if withGtk2 then gtk2 else gtk3) libXinerama libSM libXxf86vm xorgproto gstreamer
-      gst-plugins-base GConf ]
+  buildInputs = [
+    libXinerama libSM libXxf86vm xorgproto gstreamer gst-plugins-base
+  ] ++ optionals withGtk2 [ gtk2 GConf ]
+    ++ optional (!withGtk2) gtk3
     ++ optional withMesa libGLU
     ++ optional withWebKit webkitgtk
     ++ optionals stdenv.isDarwin [ setfile Carbon Cocoa Kernel QTKit ];
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 2dbda51bfe8b..7eae27d85c6f 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -359,6 +359,33 @@ inspect = buildLuarocksPackage {
     license.fullName = "MIT <http://opensource.org/licenses/MIT>";
   };
 };
+ldbus = buildLuarocksPackage {
+  pname = "ldbus";
+  version = "scm-0";
+
+  knownRockspec = (fetchurl {
+    url    = "https://luarocks.org/dev/ldbus-scm-0.rockspec";
+    sha256 = "1yhkw5y8h1qf44vx31934k042cmnc7zcv2k0pv0g27wsmlxrlznx";
+  }).outPath;
+
+  src = fetchgit ( removeAttrs (builtins.fromJSON ''{
+  "url": "git://github.com/daurnimator/ldbus.git",
+  "rev": "9e176fe851006037a643610e6d8f3a8e597d4073",
+  "date": "2019-08-16T14:26:05+10:00",
+  "sha256": "06wcz4i5b7kphqbry274q3ivnsh331rxiyf7n4qk3zx2kvarq08s",
+  "fetchSubmodules": true
+}
+ '') ["date"]) ;
+
+  disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
+  propagatedBuildInputs = [ lua ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/daurnimator/ldbus";
+    description = "A Lua library to access dbus.";
+    license.fullName = "MIT/X11";
+  };
+};
 ldoc = buildLuarocksPackage {
   pname = "ldoc";
   version = "1.4.6-2";
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index 30be2c197a5d..94edbd0737b7 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -76,6 +76,17 @@ with super;
     */
   });
 
+  ldbus = super.ldbus.override({
+    extraVariables = {
+      DBUS_DIR="${pkgs.dbus.lib}";
+      DBUS_ARCH_INCDIR="${pkgs.dbus.lib}/lib/dbus-1.0/include";
+      DBUS_INCDIR="${pkgs.dbus.dev}/include/dbus-1.0";
+    };
+    buildInputs = with pkgs; [
+      dbus
+    ];
+  });
+
   ljsyscall = super.ljsyscall.override(rec {
     version = "unstable-20180515";
     # package hasn't seen any release for a long time
diff --git a/pkgs/development/misc/rpiboot/unstable.nix b/pkgs/development/misc/rpiboot/unstable.nix
index 1591a1efd17a..a8f7e4795e77 100644
--- a/pkgs/development/misc/rpiboot/unstable.nix
+++ b/pkgs/development/misc/rpiboot/unstable.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, libusb1 }:
 
 let
-  version = "2018-03-27";
+  version = "2020-05-11";
   name = "rpiboot-unstable-${version}";
 in stdenv.mkDerivation {
   inherit name;
@@ -9,8 +9,8 @@ in stdenv.mkDerivation {
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "usbboot";
-    rev = "fb86716935f2e820333b037a2ff93a338ad9b695";
-    sha256 = "163g7iw7kf6ra71adx6lf1xzf3kv20bppva15ljwn54jlah5mv98";
+    rev = "c650cd747c1d0597487dcf319bf95b5ba775d78b";
+    sha256 = "17kapny79dh05vfmrniqdvz6xhpwnqnw0511ycfx4qcjh4krxh8n";
   };
 
   nativeBuildInputs = [ libusb1 ];
diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index 2f623dd0f0ef..c58944a59d72 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -3,7 +3,6 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
-, pythonAtLeast
 , attrs
 , chardet
 , multidict
@@ -14,7 +13,6 @@
 , pytestrunner
 , pytestCheckHook
 , gunicorn
-, pytest-timeout
 , async_generator
 , pytest_xdist
 , pytestcov
@@ -63,6 +61,8 @@ buildPythonPackage rec {
     "test_read_boundary_with_incomplete_chunk"
     "test_read_incomplete_chunk"
     "test_request_tracing_exception"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "test_close"
   ];
 
   # aiohttp in current folder shadows installed version
diff --git a/pkgs/development/python-modules/av/default.nix b/pkgs/development/python-modules/av/default.nix
index 7ccc569a87e5..ca750f32dba9 100644
--- a/pkgs/development/python-modules/av/default.nix
+++ b/pkgs/development/python-modules/av/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , numpy
-, ffmpeg_4
+, ffmpeg
 , pkgconfig
 }:
 
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   checkInputs = [ numpy ];
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ ffmpeg_4 ];
+  buildInputs = [ ffmpeg ];
 
   # Tests require downloading files from internet
   doCheck = false;
diff --git a/pkgs/development/python-modules/awkward1/default.nix b/pkgs/development/python-modules/awkward1/default.nix
index 0c2b3338690f..e3549e0a4a85 100644
--- a/pkgs/development/python-modules/awkward1/default.nix
+++ b/pkgs/development/python-modules/awkward1/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "awkward1";
-  version = "0.2.22";
+  version = "0.2.23";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c64a8ad0204743d49cf2f8775f92d9c23dd9d7eb6996a61f4a9de57a53d429f9";
+    sha256 = "d7458b499959af66e0a640e29e6b676a39cc9614cd504e5a2e8f8d0c7f546597";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/beancount/default.nix b/pkgs/development/python-modules/beancount/default.nix
index 045dd14da0d8..9709037792dc 100644
--- a/pkgs/development/python-modules/beancount/default.nix
+++ b/pkgs/development/python-modules/beancount/default.nix
@@ -4,14 +4,14 @@
 , ply, python_magic, pytest, requests }:
 
 buildPythonPackage rec {
-  version = "2.2.3";
+  version = "2.3.0";
   pname = "beancount";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0pcfl2rx2ng06i4f9izdpnlnb1k0rdzsckbzzn4cn4ixfzyssm0m";
+    sha256 = "04i788glp2cslwi67dixy1pi5l0izcl078i9mrd1j1sh8f99cvcs";
   };
 
   # Tests require files not included in the PyPI archive.
diff --git a/pkgs/development/python-modules/bleach/default.nix b/pkgs/development/python-modules/bleach/default.nix
index 1b10fe166f8a..9b27ae254903 100644
--- a/pkgs/development/python-modules/bleach/default.nix
+++ b/pkgs/development/python-modules/bleach/default.nix
@@ -6,6 +6,7 @@
 , six
 , html5lib
 , setuptools
+, packaging
 }:
 
 buildPythonPackage rec {
@@ -18,11 +19,7 @@ buildPythonPackage rec {
   };
 
   checkInputs = [ pytest pytestrunner ];
-  propagatedBuildInputs = [ six html5lib setuptools ];
-
-  postPatch = ''
-    substituteInPlace setup.py --replace ",<3dev" ""
-  '';
+  propagatedBuildInputs = [ packaging six html5lib setuptools ];
 
   # Disable network tests
   checkPhase = ''
diff --git a/pkgs/development/python-modules/bpython/clipboard-make-which-substitutable.patch b/pkgs/development/python-modules/bpython/clipboard-make-which-substitutable.patch
new file mode 100644
index 000000000000..685d34228a1b
--- /dev/null
+++ b/pkgs/development/python-modules/bpython/clipboard-make-which-substitutable.patch
@@ -0,0 +1,27 @@
+From 6f544a5bd43446859754cb80e012af933b843db9 Mon Sep 17 00:00:00 2001
+From: Florian Klink <flokli@flokli.de>
+Date: Wed, 3 Jun 2020 22:05:34 +0200
+Subject: [PATCH] clipboard: make which substitutable
+
+This is used to detect the presence of xclip and other clipboard
+handling tools.
+---
+ bpython/clipboard.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/bpython/clipboard.py b/bpython/clipboard.py
+index aee429b..f346429 100644
+--- a/bpython/clipboard.py
++++ b/bpython/clipboard.py
+@@ -58,7 +58,7 @@ class OSXClipboard(object):
+ 
+ def command_exists(command):
+     process = subprocess.Popen(
+-        ["which", command], stderr=subprocess.STDOUT, stdout=subprocess.PIPE
++        ["@which@", command], stderr=subprocess.STDOUT, stdout=subprocess.PIPE
+     )
+     process.communicate()
+ 
+-- 
+2.26.2
+
diff --git a/pkgs/development/python-modules/bpython/default.nix b/pkgs/development/python-modules/bpython/default.nix
index 73ce843cf018..ad7322cbf661 100644
--- a/pkgs/development/python-modules/bpython/default.nix
+++ b/pkgs/development/python-modules/bpython/default.nix
@@ -1,4 +1,14 @@
-{ stdenv, buildPythonPackage, fetchPypi, pygments, greenlet, curtsies, urwid, requests, mock }:
+{ stdenv
+, buildPythonPackage
+, fetchPypi
+, curtsies
+, greenlet
+, mock
+, pygments
+, requests
+, substituteAll
+, urwid
+, which }:
 
 buildPythonPackage rec {
   pname = "bpython";
@@ -9,6 +19,11 @@ buildPythonPackage rec {
     sha256 = "1764ikgj24jjq46s50apwkydqvy5a13adb2nbszk8kbci6df0v27";
   };
 
+  patches = [ (substituteAll {
+    src = ./clipboard-make-which-substitutable.patch;
+    which = "${which}/bin/which";
+  })];
+
   propagatedBuildInputs = [ curtsies greenlet pygments requests urwid ];
 
   postInstall = ''
diff --git a/pkgs/development/python-modules/buildbot/default.nix b/pkgs/development/python-modules/buildbot/default.nix
index 2b2e703026d8..c5a12c997d9d 100644
--- a/pkgs/development/python-modules/buildbot/default.nix
+++ b/pkgs/development/python-modules/buildbot/default.nix
@@ -25,11 +25,11 @@ let
 
   package = buildPythonPackage rec {
     pname = "buildbot";
-    version = "2.8.1";
+    version = "2.8.2";
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "1nrbn8a2c56l5j0axmn9ijaviw0a6nrd34sg81r5j05mzzpb69is";
+      sha256 = "0rdrz2zkd6xaf9kb5l41xmbfzq618sz498w23irshih4c802pdv5";
     };
 
     propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/buildbot/pkg.nix b/pkgs/development/python-modules/buildbot/pkg.nix
index ebf8fb9c94e7..4bb8613afeab 100644
--- a/pkgs/development/python-modules/buildbot/pkg.nix
+++ b/pkgs/development/python-modules/buildbot/pkg.nix
@@ -6,7 +6,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "03ppmrnpyd77azylv1c673cffk6x53j9flx4i99k33bljmdy8iv4";
+    sha256 = "1yz3k6dg15q4911x8kjy396dccfgrs50mjz278l09p6zmm71llax";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/buildbot/plugins.nix b/pkgs/development/python-modules/buildbot/plugins.nix
index 302615dc469c..4c5aa374562a 100644
--- a/pkgs/development/python-modules/buildbot/plugins.nix
+++ b/pkgs/development/python-modules/buildbot/plugins.nix
@@ -7,7 +7,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "051y4z70dq0j343rb02wn3a1vkdbi8khjfib2msa80vdld3nxcyv";
+      sha256 = "19qwr0h6qavznx8rfjq6zjccyd2y7x4nc8asldvay3b44xfsr385";
     };
 
     # Remove unneccessary circular dependency on buildbot
@@ -34,7 +34,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "0chw111j2c6ybvbb09x39zg7ghjz4ysw67wbpcmzd1v5jnwbaqdi";
+      sha256 = "1wfhwmb1d32k8isk7k8525pmkfih8hlvy53zsj19l3gvjm0da9gw";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -56,7 +56,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "14v2lj65ccgmijxqrr61vpgba30q6w5vnisz78y3hbf3qpxmmd7g";
+      sha256 = "0g62v0maz3b9bmjvvjcin6ayg0f5k0n8m93zk75lagyr69g5vaka";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -78,7 +78,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "03q9am237f2r8ivqm1dfkyzm3bmns4xjn99c27ps6dw9an15f73a";
+      sha256 = "0dlq8pchgccc66gfdlssydacisia5fbwc8b4gd8f9gcbish8jmf7";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -100,7 +100,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "0wv5ghsfmhkbk96zimihcwn16rxjz1q1g5ppahb8gfrclmzhdynl";
+      sha256 = "193nni55py6yzw730yyp5va2n4313sjf6a7jmi0xs9bivvvzg5w9";
     };
 
     buildInputs = [ buildbot-pkg ];
diff --git a/pkgs/development/python-modules/buildbot/worker.nix b/pkgs/development/python-modules/buildbot/worker.nix
index 936ef661eeee..05938e43ad69 100644
--- a/pkgs/development/python-modules/buildbot/worker.nix
+++ b/pkgs/development/python-modules/buildbot/worker.nix
@@ -7,7 +7,7 @@ buildPythonPackage (rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1cba1zmm3gfw3ikax7q4vbrxnvjxlby79x5lc4fg9c3igbm0nmwj";
+    sha256 = "0p1w6ailp6xpa6ckl5prj413ilxx5s3lga5mzqxj9nn00vni8ik2";
   };
 
   propagatedBuildInputs = [ twisted future ];
diff --git a/pkgs/development/python-modules/jc/default.nix b/pkgs/development/python-modules/jc/default.nix
index e7942760b72c..e48fec89b9d7 100644
--- a/pkgs/development/python-modules/jc/default.nix
+++ b/pkgs/development/python-modules/jc/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "jc";
-  version = "1.11.2";
+  version = "1.11.6";
   disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "kellyjonbrazil";
     repo = "jc";
     rev = "v${version}";
-    sha256 = "1gsvjgypjgw5a0k85kdvbbf7q6wspmv6z76acrgnidhav8sdn4dm";
+    sha256 = "0jyygq7zmam7yriiv5j4d6mpjdi2p3p7d53bn3qwfzkh4ifsbfan";
   };
 
   propagatedBuildInputs = [ ruamel_yaml xmltodict pygments ];
diff --git a/pkgs/development/python-modules/matrix-nio/default.nix b/pkgs/development/python-modules/matrix-nio/default.nix
index ff4f6198aa5e..aca4bf35434b 100644
--- a/pkgs/development/python-modules/matrix-nio/default.nix
+++ b/pkgs/development/python-modules/matrix-nio/default.nix
@@ -19,14 +19,14 @@
 }:
 
 buildPythonPackage rec {
-  pname = "nio";
-  version = "0.10.0";
+  pname = "matrix-nio";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "poljar";
     repo = "matrix-nio";
     rev = version;
-    sha256 = "04ryf9lrm0820hqij46hav6mgplabnyl9dfj46iwvxasn06fh2j8";
+    sha256 = "1d4jhl2xjjp31yjs4zz2cfkvzbi2vr5bsrp07s6nhyc18azxr7ba";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/playsound/default.nix b/pkgs/development/python-modules/playsound/default.nix
new file mode 100644
index 000000000000..589a8f3db819
--- /dev/null
+++ b/pkgs/development/python-modules/playsound/default.nix
@@ -0,0 +1,28 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+}:
+
+buildPythonPackage rec {
+  pname = "playsound";
+  version = "1.2.2";
+
+  src = fetchFromGitHub {
+    owner = "TaylorSMarks";
+    repo = "playsound";
+    rev = "907f1fe73375a2156f7e0900c4b42c0a60fa1d00";
+    sha256 = "1fh3m115h0c57lj2pfhhqhmsh5awzblb7csi1xc5a6f6slhl059k";
+  };
+
+  doCheck = false;
+
+  pythonImportsCheck = [ "playsound" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/TaylorSMarks/playsound";
+    description = "Pure Python, cross platform, single function module with no dependencies for playing sounds";
+    license = licenses.mit;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ luc65r ];
+  };
+}
diff --git a/pkgs/development/python-modules/pycurl/default.nix b/pkgs/development/python-modules/pycurl/default.nix
index 6b6aad2b2342..7531bb8f7bbc 100644
--- a/pkgs/development/python-modules/pycurl/default.nix
+++ b/pkgs/development/python-modules/pycurl/default.nix
@@ -47,7 +47,8 @@ buildPythonPackage rec {
                      and not test_libcurl_ssl_openssl" \
                  --ignore=tests/getinfo_test.py \
                  --ignore=tests/memory_mgmt_test.py \
-                 --ignore=tests/multi_memory_mgmt_test.py
+                 --ignore=tests/multi_memory_mgmt_test.py \
+                 --ignore=tests/multi_timer_test.py
   '';
 
   preConfigure = ''
diff --git a/pkgs/development/python-modules/pydantic/default.nix b/pkgs/development/python-modules/pydantic/default.nix
index ef33b6fb2bd5..371bfba2f0f9 100644
--- a/pkgs/development/python-modules/pydantic/default.nix
+++ b/pkgs/development/python-modules/pydantic/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , ujson
 , email_validator
 , typing-extensions
@@ -22,6 +23,14 @@ buildPythonPackage rec {
     sha256 = "0fwrx7p6d5vskg9ibganahiz9y9299idvdmzhjw62jy84gn1vrb4";
   };
 
+  # fix tests, remove on next version bump
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/samuelcolvin/pydantic/commit/a5b0e741e585040a0ab8b0be94dd9dc2dd3afcc7.patch";
+      sha256 = "0v91ac3dw23rm73370s2ns84vi0xqbfzpvj84zb7xdiicx8fhmf1";
+    })
+  ];
+
   propagatedBuildInputs = [
     ujson
     email_validator
diff --git a/pkgs/development/python-modules/pygdbmi/default.nix b/pkgs/development/python-modules/pygdbmi/default.nix
index 447fbdfcdc44..b3d1fb3d26df 100644
--- a/pkgs/development/python-modules/pygdbmi/default.nix
+++ b/pkgs/development/python-modules/pygdbmi/default.nix
@@ -1,4 +1,5 @@
-{ lib
+{ stdenv
+, lib
 , buildPythonPackage
 , fetchFromGitHub
 , gdb
@@ -19,6 +20,9 @@ buildPythonPackage rec {
 
   checkInputs = [ gdb ];
 
+  # tests require gcc for some reason
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
   postPatch = ''
     # tries to execute flake8,
     # which is likely to break on flake8 updates
diff --git a/pkgs/development/python-modules/python-engineio/default.nix b/pkgs/development/python-modules/python-engineio/default.nix
index 128fb8961d4d..cb3fe1a9f38d 100644
--- a/pkgs/development/python-modules/python-engineio/default.nix
+++ b/pkgs/development/python-modules/python-engineio/default.nix
@@ -47,7 +47,6 @@ buildPythonPackage rec {
     description = "Engine.IO server";
     homepage = "https://github.com/miguelgrinberg/python-engineio/";
     license = licenses.mit;
-    platforms = platforms.linux;
     maintainers = [ maintainers.mic92 ];
   };
 }
diff --git a/pkgs/development/python-modules/pythonnet/default.nix b/pkgs/development/python-modules/pythonnet/default.nix
index 0027c8d32a63..82ddb8c810b0 100644
--- a/pkgs/development/python-modules/pythonnet/default.nix
+++ b/pkgs/development/python-modules/pythonnet/default.nix
@@ -9,6 +9,7 @@
 , pkgconfig
 , dotnetbuildhelpers
 , clang
+, glib
 , mono
 }:
 
@@ -63,6 +64,7 @@ buildPythonPackage rec {
   ];
 
   buildInputs = [
+    glib
     mono
     psutil # needed for memory leak tests
   ];
diff --git a/pkgs/development/python-modules/rope/default.nix b/pkgs/development/python-modules/rope/default.nix
index 6bcc05fb34d6..73b5e0b8c2b5 100644
--- a/pkgs/development/python-modules/rope/default.nix
+++ b/pkgs/development/python-modules/rope/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "rope";
-  version = "0.16.0";
+  version = "0.17.0";
 
   disabled = pythonAtLeast "3.8";  # 0.17 should support Python 3.8
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1zlxdrs6ww2hm41izz67h67z9dkm0rlgw8m04vygaip0q91030yj";
+    sha256 = "1qa9nqryp05ah9b4r8cy5ph31kr9cm4ak79pvzbg7p23bxqdd2k5";
   };
 
   checkInputs = [ nose ];
diff --git a/pkgs/development/python-modules/spacy/default.nix b/pkgs/development/python-modules/spacy/default.nix
index 6a54cc1ec715..f0a143ec30c7 100644
--- a/pkgs/development/python-modules/spacy/default.nix
+++ b/pkgs/development/python-modules/spacy/default.nix
@@ -21,11 +21,11 @@
 
 buildPythonPackage rec {
   pname = "spacy";
-  version = "2.2.4";
+  version = "2.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1fgm1zlw8mjhmk64skxs79ymhcningml13y9c9fy7rj1b1yadwzh";
+    sha256 = "0nri437dyapiq5gx8lbmjdfvqw2cnw3di13kp44rzr17bm5yh2jv";
   };
 
   propagatedBuildInputs = [
@@ -54,7 +54,7 @@ buildPythonPackage rec {
   # '';
 
   postPatch = ''
-    substituteInPlace setup.cfg --replace "thinc==7.4.0" "thinc>=7.4.0,<8"
+    substituteInPlace setup.cfg --replace "thinc==7.4.1" "thinc>=7.4.1,<8"
   '';
 
   meta = with lib; {
@@ -62,5 +62,5 @@ buildPythonPackage rec {
     homepage = "https://github.com/explosion/spaCy";
     license = licenses.mit;
     maintainers = with maintainers; [ danieldk sdll ];
-    };
+  };
 }
diff --git a/pkgs/development/python-modules/spacy/models.json b/pkgs/development/python-modules/spacy/models.json
index 1f1558b23c39..1c02b05d303e 100644
--- a/pkgs/development/python-modules/spacy/models.json
+++ b/pkgs/development/python-modules/spacy/models.json
@@ -1,108 +1,108 @@
 [{
   "pname": "de_core_news_md",
-  "version": "2.2.5",
-  "sha256": "1jkc4r0f1916k5qpmpnwawsbnrbscq250q7b1llgxi70f2xyw9gk",
+  "version": "2.3.0",
+  "sha256": "0kxir1w000r5fn1kpa38m7688xinkn2mk1m82aiwqlck3r72jdi6",
   "license": "cc-by-sa-40"
 },
 {
   "pname": "de_core_news_sm",
-  "version": "2.2.5",
-  "sha256": "10z30hirfwa692m0zp6wk60ccvqj84i5vjaiyyzd21innysb5y3g",
+  "version": "2.3.0",
+  "sha256": "00cbmrf4njg28laysapdnp4rv4lw4yw03rxkynw1ain5fwb0izl7",
   "license": "cc-by-sa-40"
 },
 {
   "pname": "el_core_news_md",
-  "version": "2.2.5",
-  "sha256": "1jjmf6rf1hjgqswhpqq2l5w7s351k4kk93c7rr85iv2754f71h36",
+  "version": "2.3.0",
+  "sha256": "170x8bzm5nf02mhkxyxjk58yk2639hsjb5b9prcc69500c0vmnp0",
   "license": "cc-by-sa-40"
 },
 {
   "pname": "el_core_news_sm",
-  "version": "2.2.5",
-  "sha256": "00h55fc27d3jfm3knyidz7a4rasiz7qs4wfs3sl0ndq815yvag0l",
+  "version": "2.3.0",
+  "sha256": "10mh3za4jvr07rawzk8ps642rp11s3smraj9xvrxflik4fqkz18b",
   "license": "cc-by-sa-40"
 },
 {
   "pname": "en_core_web_lg",
-  "version": "2.2.5",
-  "sha256": "1shd4gkshr4a92fhvrjhzn1abywnrcf548cv3dz8dhmi0wxa4klr",
+  "version": "2.3.0",
+  "sha256": "0mfa5wz31ya295jhyj489gb4qy806zmpq1zc11bvv5alv2m35if2",
   "license": "cc-by-sa-40"
 },
 {
   "pname": "en_core_web_md",
-  "version": "2.2.5",
-  "sha256": "1x32vl2a75ps2iyhysjvdygd366zs546s82yzqwj2m7jcsdszrxy",
+  "version": "2.3.0",
+  "sha256": "1ys8sqkhiap1mq6mhbkbq8bc07lvl68xngbx725xkwvirzl5gabh",
   "license": "cc-by-sa-40"
 },
 {
   "pname": "en_core_web_sm",
-  "version": "2.2.5",
-  "sha256": "1vna6zik7863hahxdgz0s80kbbfyw42h4c1k5jby9lkzr5jr1dk0",
+  "version": "2.3.0",
+  "sha256": "04icv9qf4pj53ll8vqxcjl2a723q1k00i7lifk8wx5saif28g37a",
   "license": "cc-by-sa-40"
 },
 {
   "pname": "en_vectors_web_lg",
-  "version": "2.1.0",
-  "sha256": "1sq41pr70215f2s8k35x5ni4w0i4xhbzbfg3iyxgbp1b35gizg94",
+  "version": "2.3.0",
+  "sha256": "13g012rwh0bcxx3ii5mmygqzyryah1y3zd000zhidnacc1x1g743",
   "license": "cc-by-sa-40"
 },
 {
   "pname": "es_core_news_md",
-  "version": "2.2.5",
-  "sha256": "0b50gd2mx1klr6ss0fsj58qmw2wpbawwv015pr9vq3j7jq805scl",
+  "version": "2.3.0",
+  "sha256": "0nz33bmpr3rxqbnv6vb1id8pkfsvh8ii8vqplwgb3b8772kmpzy2",
   "license": "cc-by-sa-40"
 },
 {
   "pname": "es_core_news_sm",
-  "version": "2.2.5",
-  "sha256": "19hrpxg1a5bvf9j9wlm03rkxfkgrldky7alsgl8bdwnwq3vpbgfi",
+  "version": "2.3.0",
+  "sha256": "02xqhg4m0gg5r9yibvl02zixkll6w0nsmbdhp07y5yyaqjarc90d",
   "license": "cc-by-sa-40"
 },
 {
   "pname": "fr_core_news_md",
-  "version": "2.2.5",
-  "sha256": "1y4dqbcwa7gg6z8q84n0j4my7gyia7a2z7pln71sqa78pin06r9b",
+  "version": "2.3.0",
+  "sha256": "04fk212ksac3bp9dj7dmzsdcnbqmbsgymsic6ddcv9zbfdv5d0db",
   "license": "cc-by-sa-40"
 },
 {
   "pname": "fr_core_news_sm",
-  "version": "2.2.5",
-  "sha256": "1q2kvznbylyz4frxy5rbvpm5jvm7bfin8g3dks0c1k9hhdymv35y",
+  "version": "2.3.0",
+  "sha256": "0kldww855z67qfc9maa9z1lsvdf5vj5vc8gj0x3h68kv5n1xr4h0",
   "license": "cc-by-sa-40"
 },
 {
   "pname": "it_core_news_sm",
-  "version": "2.2.5",
-  "sha256": "02r3x308s5kn62xpa2cizxfw7cyjk48zm9i6r4vhs8kycmp9z0px",
+  "version": "2.3.0",
+  "sha256": "1c3ywqa8li0j7cyvd1xqbb096y61978hd6qv7rc6cxxjdhmkrrds",
   "license": "cc-by-sa-40"
 },
 {
   "pname": "lt_core_news_sm",
-  "version": "2.2.5",
-  "sha256": "0vy0cff1fw33srqyi93vj03rnzqr8f62p1hwi565b0sb8v3n4p08",
+  "version": "2.3.0",
+  "sha256": "0r3rbqgz4897wyhz5jli30lryb45039f4rlvn4q0364cg1pm92g9",
   "license": "cc-by-sa-40"
 },
 {
   "pname": "nb_core_news_sm",
-  "version": "2.2.5",
-  "sha256": "1kdn3qwlmmd52sjrvi97aiv7xp260bka009jjal79l3qrz4czrw1",
+  "version": "2.3.0",
+  "sha256": "07b7xri2q3m7fvn9a2gjc1044a3f14231vr32hrw96h7k6vg95h7",
   "license": "mit"
 },
 {
   "pname": "nl_core_news_sm",
-  "version": "2.2.1",
-  "sha256": "0gw9a1j3v4f15cxcz7zr7dz7mqi2a3541b04q6kj74gg397li4ny",
+  "version": "2.3.0",
+  "sha256": "0alvz7pn7cj0yax8h5gp71vrdblh3mcsmyhzgiddsd44ry35nxnj",
   "license": "cc-by-sa-40"
 },
 {
   "pname": "pt_core_news_sm",
-  "version": "2.2.5",
-  "sha256": "02p617ybh6wqmq1scch9dgim44rhhj0k81sbw8nysv20pc6wb89a",
+  "version": "2.3.0",
+  "sha256": "1vcvzdg9f93x0vaafkk9l9xhpmaavfj0cf0l3p06c5kx2d76f9ph",
   "license": "cc-by-sa-40"
 },
 {
   "pname": "xx_ent_wiki_sm",
-  "version": "2.2.0",
-  "sha256": "0niwnd1mdaji92yp2dqsbmr0w420gpaybb1ppbqr1rmk6bwgyhsb",
+  "version": "2.3.0",
+  "sha256": "0x3zmmybl5kh4dn5prkfmr4q5j9bh13p40qc3rhdfi0i3jxc11pn",
   "license": "cc-by-sa-40"
 }]
diff --git a/pkgs/development/tools/analysis/cppcheck/default.nix b/pkgs/development/tools/analysis/cppcheck/default.nix
index bdd275a218b8..8e2c28336cf7 100644
--- a/pkgs/development/tools/analysis/cppcheck/default.nix
+++ b/pkgs/development/tools/analysis/cppcheck/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cppcheck";
-  version = "2.0";
+  version = "2.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "0gssnb50cndr77xva4nar4a82ii0vfqy96dlm27gb7pd6xmd6xsz";
+    sha256 = "1xx5i6z9a36h7k4ipikrk2zidk7jcjv8ryqyq2m5hnwy0gpyw9mb";
   };
 
   buildInputs = [ pcre ] ++ stdenv.lib.optionals withZ3 [ z3 ];
diff --git a/pkgs/development/tools/analysis/cpplint/default.nix b/pkgs/development/tools/analysis/cpplint/default.nix
index 577a09e8de99..61aee215031a 100644
--- a/pkgs/development/tools/analysis/cpplint/default.nix
+++ b/pkgs/development/tools/analysis/cpplint/default.nix
@@ -2,20 +2,21 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "cpplint";
-  version = "1.3.0";
+  version = "1.5.1";
 
   # Fetch from github instead of pypi, since the test cases are not in the pypi archive
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "107v7bp35kxbv9v7wl79h7115z1m4b48rhasp0cnivql1grd277i";
+    sha256 = "0k927mycj1k4l3fbxrk597bhcjl2nrpaas1imbjgk64cyq8dv7lh";
   };
 
   postPatch = ''
     patchShebangs cpplint_unittest.py
   '';
 
+  checkInputs = with python3Packages; [ pytest pytestrunner ];
   checkPhase = ''
     ./cpplint_unittest.py
   '';
diff --git a/pkgs/development/tools/analysis/tfsec/default.nix b/pkgs/development/tools/analysis/tfsec/default.nix
index 49009570e57b..251162efd8f7 100644
--- a/pkgs/development/tools/analysis/tfsec/default.nix
+++ b/pkgs/development/tools/analysis/tfsec/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "tfsec";
-  version = "0.19.0";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "liamg";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1ddyvkv0949p0b6m1rwai5r87mca5xwyjwsjq7gbyqz9h10bv7nf";
+    sha256 = "0mmh161zwrkjwpw01zcgh7hsap7lgdxhg191bajzig6vlq287jyh";
   };
 
   goPackagePath = "github.com/liamg/tfsec";
diff --git a/pkgs/development/tools/build-managers/bazel/buildtools/default.nix b/pkgs/development/tools/build-managers/bazel/buildtools/default.nix
index 0d2d1f318443..2f026c9d99c0 100644
--- a/pkgs/development/tools/build-managers/bazel/buildtools/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/buildtools/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "bazel-buildtools";
-  version = "3.2.0";
+  version = "3.2.1";
 
   goPackagePath = "github.com/bazelbuild/buildtools";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "bazelbuild";
     repo = "buildtools";
     rev = version;
-    sha256 = "0r3vc47w5vxgy5rzh75q0lng1c490ic1a1dcc0ih7dcl6i5p1p88";
+    sha256 = "1f2shjskcmn3xpgvb9skli5xaf942wgyg5ps7r905n1zc0gm8izn";
   };
 
   goDeps = ./deps.nix;
diff --git a/pkgs/development/tools/build-managers/bmake/default.nix b/pkgs/development/tools/build-managers/bmake/default.nix
index 499ef7a19b31..b119b5a38105 100644
--- a/pkgs/development/tools/build-managers/bmake/default.nix
+++ b/pkgs/development/tools/build-managers/bmake/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bmake";
-  version = "20200506";
+  version = "20200606";
 
   src = fetchurl {
     url    = "http://www.crufty.net/ftp/pub/sjg/${pname}-${version}.tar.gz";
-    sha256 = "1qiq6lvlg2hqiq03slv4vzv3bn4cr3w95r3i6m5fa4hgn2dkrhqa";
+    sha256 = "00kh1g8z6808ylbfcn9afpb0xmb99k302dfdsmyx1rsn65xs58v7";
   };
 
   nativeBuildInputs = [ getopt ];
diff --git a/pkgs/development/tools/database/liquibase/default.nix b/pkgs/development/tools/database/liquibase/default.nix
index a92c96684a48..ae993f9611e0 100644
--- a/pkgs/development/tools/database/liquibase/default.nix
+++ b/pkgs/development/tools/database/liquibase/default.nix
@@ -10,11 +10,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "liquibase";
-  version = "3.9.0";
+  version = "3.10.0";
 
   src = fetchurl {
     url = "https://github.com/liquibase/liquibase/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "0qasiggaxix3gmmvax00k83q4pd1c1b5wx8ayyplaszkgr9advb8";
+    sha256 = "1h5mcbs6mkk6cqjm8qm63rynz7611gq32v2jirl1qn71x2s7pq6y";
   };
 
   buildInputs = [ jre makeWrapper ];
diff --git a/pkgs/development/tools/database/webdis/default.nix b/pkgs/development/tools/database/webdis/default.nix
index fd705c4fc1b0..96b39e42d101 100644
--- a/pkgs/development/tools/database/webdis/default.nix
+++ b/pkgs/development/tools/database/webdis/default.nix
@@ -2,23 +2,15 @@
 
 stdenv.mkDerivation rec {
   pname = "webdis";
-  version = "0.1.9";
+  version = "0.1.10";
 
   src = fetchFromGitHub {
     owner = "nicolasff";
     repo = pname;
     rev = version;
-    sha256 = "1kglzbs1sw3w05i678qr3lv4pxia20k2a8s3pjhfcxdlnlcy23sk";
+    sha256 = "1hn4fq0asivfs56rw9ck1vc3g6h6fnwywh8v4zs2bkyn62fg9mcw";
   };
 
-  patches = [
-    # Do not use DESTDIR. See: https://github.com/nicolasff/webdis/pull/172
-    (fetchpatch {
-      url = "https://github.com/nicolasff/webdis/commit/a44a2964a59f2e583f4945eeb65cd19235059270.patch";
-      sha256 = "0i41p98gc201vpp5ppjc9gxdyb1bpimr0qrvibaf3iq3sy4jr1gb";
-    })
-  ];
-
   buildInputs = [ hiredis http-parser jansson libevent ];
 
   makeFlags = [
diff --git a/pkgs/development/tools/delve/default.nix b/pkgs/development/tools/delve/default.nix
index 33eda13b6044..b990fe10b05c 100644
--- a/pkgs/development/tools/delve/default.nix
+++ b/pkgs/development/tools/delve/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "delve";
-  version = "1.2.0";
+  version = "1.4.1";
 
   goPackagePath = "github.com/go-delve/delve";
   excludedPackages = "\\(_fixtures\\|scripts\\|service/test\\)";
@@ -11,7 +11,7 @@ buildGoPackage rec {
     owner = "go-delve";
     repo = "delve";
     rev = "v${version}";
-    sha256 = "1xz1xm0lb1arwm3w2ydq5y5xglq60fc0q46x9xndr3i9j0rm8bxh";
+    sha256 = "007bc69r26w0sv6v9mbjdnmnkahpfk5998isx81ma7cinqdhi1cj";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/flyway/default.nix b/pkgs/development/tools/flyway/default.nix
index 1349d4c009aa..adb36d8e92cb 100644
--- a/pkgs/development/tools/flyway/default.nix
+++ b/pkgs/development/tools/flyway/default.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, jre_headless, makeWrapper }:
   let
-    version = "6.4.3";
+    version = "6.4.4";
   in
     stdenv.mkDerivation {
       pname = "flyway";
       inherit version;
       src = fetchurl {
         url = "https://repo1.maven.org/maven2/org/flywaydb/flyway-commandline/${version}/flyway-commandline-${version}.tar.gz";
-        sha256 = "05gbqc3hvi7yiqf03iwyamvvhc3jmyfvv1989527psdzhxs8gw7b";
+        sha256 = "16zckqq64jv3031ssrvzw4ny98gnxhy2hsdp877i38zxqsvzdcym";
       };
       nativeBuildInputs = [ makeWrapper ];
       dontBuild = true;
diff --git a/pkgs/development/tools/gauge/default.nix b/pkgs/development/tools/gauge/default.nix
index c9df63cabb78..c9a462f1832e 100644
--- a/pkgs/development/tools/gauge/default.nix
+++ b/pkgs/development/tools/gauge/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "gauge";
-  version = "1.0.4";
+  version = "1.1.1";
 
   goPackagePath = "github.com/getgauge/gauge";
   excludedPackages = ''\(build\|man\)'';
@@ -11,7 +11,7 @@ buildGoPackage rec {
     owner = "getgauge";
     repo = "gauge";
     rev = "v${version}";
-    sha256 = "1b52kpv5561pyjvqi8xmidarqp6lcyyy4sjsl4qjx4cr7hmk8kc7";
+    sha256 = "01x4838jljhhhcwfh6zbhy3g7l7nqvypv3g0ch9n2amsf2s16s3l";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/gllvm/default.nix b/pkgs/development/tools/gllvm/default.nix
index c0c398926352..6b64a088353e 100644
--- a/pkgs/development/tools/gllvm/default.nix
+++ b/pkgs/development/tools/gllvm/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "gllvm";
-  version = "1.2.3";
+  version = "1.2.6";
 
   goPackagePath = "github.com/SRI-CSL/gllvm";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "SRI-CSL";
     repo = "gllvm";
     rev = "v${version}";
-    sha256 = "12kdgsma62nzksvw266qm3ivkbz62ma93dd25wy0p19789v4fi7s";
+    sha256 = "0qzmrprc7npc0ln6mhkjrm8fgh2n94rdylixk11p6imxyx5fj3gg";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/go-protobuf/default.nix b/pkgs/development/tools/go-protobuf/default.nix
index 43731b72a55a..62a750269209 100644
--- a/pkgs/development/tools/go-protobuf/default.nix
+++ b/pkgs/development/tools/go-protobuf/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "go-protobuf";
-  version = "1.3.2";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "protobuf";
     rev = "v${version}";
-    sha256 = "1k1wb4zr0qbwgpvz9q5ws9zhlal8hq7dmq62pwxxriksayl6hzym";
+    sha256 = "0m5z81im4nsyfgarjhppayk4hqnrwswr3nix9mj8pff8x9jvcjqw";
   };
 
-  vendorSha256 = "0sjjj9z1dhilhpc8pq4154czrb79z9cm044jvn75kxcjv6v5l2m5";
+  vendorSha256 = "04w9vhkrwb2zfqk73xmhignjyvjqmz1j93slkqp7v8jj2dhyla54";
 
   meta = with stdenv.lib; {
     homepage    = "https://github.com/golang/protobuf";
diff --git a/pkgs/development/tools/java/visualvm/default.nix b/pkgs/development/tools/java/visualvm/default.nix
index 3f33ff7c13a0..c59f6716a7b6 100644
--- a/pkgs/development/tools/java/visualvm/default.nix
+++ b/pkgs/development/tools/java/visualvm/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchzip, lib, makeWrapper, makeDesktopItem, jdk, gawk }:
 
 stdenv.mkDerivation rec {
-  version = "2.0";
+  version = "2.0.2";
   pname = "visualvm";
 
   src = fetchzip {
     url = "https://github.com/visualvm/visualvm.src/releases/download/${version}/visualvm_${builtins.replaceStrings ["."] [""]  version}.zip";
-    sha256 = "057dzf7xkb4fdv4bc2fgw7mxnxclcjmflafx3n2qw0qcdky18gzr";
+    sha256 = "19h5804izhdhdwbpyfbfqsjwmnabz2djbhkv7gvzs66jxc6q8mgx";
   };
 
   desktopItem = makeDesktopItem {
diff --git a/pkgs/development/tools/misc/cquery/default.nix b/pkgs/development/tools/misc/cquery/default.nix
deleted file mode 100644
index 33a8bf1df61d..000000000000
--- a/pkgs/development/tools/misc/cquery/default.nix
+++ /dev/null
@@ -1,64 +0,0 @@
-{ fetchFromGitHub, makeWrapper
-, cmake, llvmPackages, ncurses
-, runtimeShell }:
-
-let
-  src = fetchFromGitHub {
-    owner = "cquery-project";
-    repo = "cquery";
-    rev = "a95a6503d68a85baa25465ce147b7fc20f4a552e";
-    sha256 = "0rxbdln7dqkdw4q8rhclssgwypq16g9flkwmaabsr8knckbszxrx";
-    fetchSubmodules = true;
-  };
-
-  stdenv = llvmPackages.stdenv;
-
-in
-stdenv.mkDerivation {
-  pname = "cquery";
-  version = "2018-10-14";
-
-  inherit src;
-
-  nativeBuildInputs = [ cmake makeWrapper ];
-  buildInputs = with llvmPackages; [ clang clang-unwrapped llvm ncurses ];
-
-  cmakeFlags = [
-    "-DSYSTEM_CLANG=ON"
-    "-DCLANG_CXX=ON"
-  ];
-
-  shell = runtimeShell;
-  postFixup = ''
-    # We need to tell cquery where to find the standard library headers.
-
-    standard_library_includes="\\\"-isystem\\\", \\\"${stdenv.lib.getDev stdenv.cc.libc}/include\\\""
-    standard_library_includes+=", \\\"-isystem\\\", \\\"${llvmPackages.libcxx}/include/c++/v1\\\""
-    export standard_library_includes
-
-    wrapped=".cquery-wrapped"
-    export wrapped
-
-    mv $out/bin/cquery $out/bin/$wrapped
-    substituteAll ${./wrapper} $out/bin/cquery
-    chmod --reference=$out/bin/$wrapped $out/bin/cquery
-  '';
-
-  doInstallCheck = true;
-  installCheckPhase = ''
-    pushd ${src}
-    $out/bin/cquery --ci --test-unit
-
-    # The integration tests have to be disabled because cquery ignores `--init`
-    # if they are invoked, which means it won't find the system includes.
-    #$out/bin/cquery --ci --test-index
-  '';
-
-  meta = with stdenv.lib; {
-    description = "A c/c++ language server powered by libclang";
-    homepage    = "https://github.com/cquery-project/cquery";
-    license     = licenses.mit;
-    platforms   = platforms.linux ++ platforms.darwin;
-    maintainers = [ maintainers.tobim ];
-  };
-}
diff --git a/pkgs/development/tools/misc/cquery/wrapper b/pkgs/development/tools/misc/cquery/wrapper
deleted file mode 100644
index 8b3e57290429..000000000000
--- a/pkgs/development/tools/misc/cquery/wrapper
+++ /dev/null
@@ -1,12 +0,0 @@
-#! @shell@ -e
-
-initString="--init={\"cacheDirectory\": \"/tmp/cquery\", \"extraClangArguments\": [@standard_library_includes@"
-
-if [ "${NIX_CFLAGS_COMPILE}" != "" ]; then
-  read -a cflags_array <<< ${NIX_CFLAGS_COMPILE}
-  initString+=$(printf ', \"%s\"' "${cflags_array[@]}")
-fi
-
-initString+="]}"
-
-exec -a "$0" "@out@/bin/@wrapped@" "${initString}" "$@"
diff --git a/pkgs/development/tools/ocaml/js_of_ocaml/3.0.nix b/pkgs/development/tools/ocaml/js_of_ocaml/3.0.nix
deleted file mode 100644
index 9ca6ca67421f..000000000000
--- a/pkgs/development/tools/ocaml/js_of_ocaml/3.0.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ stdenv, ocaml, findlib, dune, js_of_ocaml-compiler
-, ocaml-migrate-parsetree, ppx_tools_versioned, uchar
-}:
-
-stdenv.mkDerivation {
-  pname = "js_of_ocaml"; 
-
-  inherit (js_of_ocaml-compiler) version src installPhase meta;
-
-  buildInputs = [ findlib ocaml-migrate-parsetree ppx_tools_versioned ];
-  nativeBuildInputs = [ ocaml findlib dune ];
-
-  postPatch = "patchShebangs lib/generate_stubs.sh";
-
-	propagatedBuildInputs = [ js_of_ocaml-compiler uchar ];
-
-	buildPhase = "dune build -p js_of_ocaml";
-}
diff --git a/pkgs/development/tools/ocaml/js_of_ocaml/default.nix b/pkgs/development/tools/ocaml/js_of_ocaml/default.nix
index 7f6426c9610d..9ca6ca67421f 100644
--- a/pkgs/development/tools/ocaml/js_of_ocaml/default.nix
+++ b/pkgs/development/tools/ocaml/js_of_ocaml/default.nix
@@ -1,40 +1,18 @@
-{ stdenv, fetchurl, ocaml, findlib, lwt, menhir, ocsigen_deriving, ppx_deriving, camlp4, ocamlbuild
-, cmdliner, tyxml, reactivedata, cppo, which, base64, uchar, yojson
+{ stdenv, ocaml, findlib, dune, js_of_ocaml-compiler
+, ocaml-migrate-parsetree, ppx_tools_versioned, uchar
 }:
 
-let version = if stdenv.lib.versionAtLeast ocaml.version "4.02"
-  then "2.8.4" else "2.7";
-in
-
 stdenv.mkDerivation {
-  pname = "js_of_ocaml";
-  inherit version;
-  src = fetchurl {
-    url = "https://github.com/ocsigen/js_of_ocaml/archive/${version}.tar.gz";
-    sha256 = {
-      "2.7" = "1dali1akyd4zmkwav0d957ynxq2jj6cc94r4xiaql7ca89ajz4jj";
-      "2.8.4" = "098ph50s9kqw6rc3qjn39zv9b5swdf4qr44afwqfkkjgjs5d7vbl";
-    }.${version};
-  };
+  pname = "js_of_ocaml"; 
+
+  inherit (js_of_ocaml-compiler) version src installPhase meta;
 
-  buildInputs = [ ocaml findlib menhir ocsigen_deriving ocamlbuild
-                 cmdliner reactivedata cppo which base64 ]
-  ++ stdenv.lib.optionals (stdenv.lib.versionAtLeast ocaml.version "4.02") [ yojson tyxml ];
-  propagatedBuildInputs = [ lwt camlp4 ppx_deriving ]
-  ++ stdenv.lib.optional (version == "2.8.4") uchar;
+  buildInputs = [ findlib ocaml-migrate-parsetree ppx_tools_versioned ];
+  nativeBuildInputs = [ ocaml findlib dune ];
 
-  patches = [ ./Makefile.conf.diff ];
+  postPatch = "patchShebangs lib/generate_stubs.sh";
 
-  createFindlibDestdir = true;
+	propagatedBuildInputs = [ js_of_ocaml-compiler uchar ];
 
-  meta = with stdenv.lib; {
-    homepage = "http://ocsigen.org/js_of_ocaml/";
-    description = "Compiler of OCaml bytecode to Javascript. It makes it possible to run Ocaml programs in a Web browser";
-    license = licenses.lgpl2;
-    platforms = ocaml.meta.platforms or [];
-    maintainers = [
-      maintainers.gal_bolle
-    ];
-    broken = versionAtLeast ocaml.version "4.05";
-  };
+	buildPhase = "dune build -p js_of_ocaml";
 }
diff --git a/pkgs/development/tools/out-of-tree/default.nix b/pkgs/development/tools/out-of-tree/default.nix
index d46696a32af9..ff5a3ec1b54f 100644
--- a/pkgs/development/tools/out-of-tree/default.nix
+++ b/pkgs/development/tools/out-of-tree/default.nix
@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "out-of-tree";
-  version = "1.3.0";
+  version = "1.4.0";
 
   buildInputs = [ makeWrapper ];
 
   src = fetchgit {
     rev = "refs/tags/v${version}";
     url = "https://code.dumpstack.io/tools/${pname}.git";
-    sha256 = "02xh23nbwyyf087jqkm97jbnwpja1myaz190q5r166mpwcdpz2dn";
+    sha256 = "1rn824l3dzh3xjxsbzzj053qg1abhzjimc8l73r0n5qrl44k2qk2";
   };
 
-  vendorSha256 = "1dk0cipdgj2yyg1bc9l7nvy4y373pmqwy8xiyc0wg7pchb4h9p7s";
+  vendorSha256 = "0kg5c4h7xnwfcfshrh5n76xv98wzr73kxzr8q65iphsjimbxcpy3";
 
   postFixup = ''
     wrapProgram $out/bin/out-of-tree \
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix b/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix
index c5ae5e191211..62f2ed6e3065 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix
@@ -24,7 +24,7 @@ self: super:
       nativeBuildInputs = old.nativeBuildInputs ++ [
         pkgs.pkgconfig
       ];
-      buildInputs = old.buildInputs ++ [ pkgs.ffmpeg_4 ];
+      buildInputs = old.buildInputs ++ [ pkgs.ffmpeg ];
     }
   );
 
diff --git a/pkgs/development/tools/skaffold/default.nix b/pkgs/development/tools/skaffold/default.nix
index 2d87c490452b..e104784fbe8f 100644
--- a/pkgs/development/tools/skaffold/default.nix
+++ b/pkgs/development/tools/skaffold/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "skaffold";
-  version = "1.10.1";
+  version = "1.11.0";
   # rev is the ${version} commit, mainly for skaffold version command output
   rev = "931a70a6334436735bfc4ff7633232dd5fc73cc1";
 
@@ -20,7 +20,7 @@ buildGoPackage rec {
     owner = "GoogleContainerTools";
     repo = "skaffold";
     rev = "v${version}";
-    sha256 = "1qi4b0304jjpv5npa5yfrrfg7yv5p838qqql3sgx4f47ysyyq0as";
+    sha256 = "035xp34m8kzb75mivgf3kw026n2h6g2a7j2mi32nxl1a794w36zi";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/development/tools/vagrant/default.nix b/pkgs/development/tools/vagrant/default.nix
index 32e205a6f8d3..338e8f68d355 100644
--- a/pkgs/development/tools/vagrant/default.nix
+++ b/pkgs/development/tools/vagrant/default.nix
@@ -5,9 +5,9 @@
 let
   # NOTE: bumping the version and updating the hash is insufficient;
   # you must use bundix to generate a new gemset.nix in the Vagrant source.
-  version = "2.2.8";
+  version = "2.2.9";
   url = "https://github.com/hashicorp/vagrant/archive/v${version}.tar.gz";
-  sha256 = "0nvxda0dyhncgcl9qs34l4rj0jbdbg65a3ii5765p4899z6gzx95";
+  sha256 = "0fbickjjliaw3cpkh3pl9bp56b2gcqn87c5ag67amc450ah43rdq";
 
   deps = bundlerEnv rec {
     name = "${pname}-${version}";
diff --git a/pkgs/development/tools/vagrant/gemset.nix b/pkgs/development/tools/vagrant/gemset.nix
index f5d70b912df5..00838c6e0c55 100644
--- a/pkgs/development/tools/vagrant/gemset.nix
+++ b/pkgs/development/tools/vagrant/gemset.nix
@@ -85,10 +85,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10lfhahnnc91v63xpvk65apn61pib086zha3z5sp1xk9acfx12h4";
+      sha256 = "12lpwaw82bb0rm9f52v1498bpba8aj2l2q359mkwbxsswhpga5af";
       type = "gem";
     };
-    version = "1.12.2";
+    version = "1.13.1";
   };
   gssapi = {
     dependencies = ["ffi"];
@@ -149,10 +149,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0jwrd1l4mxz06iyx6053lr6hz2zy7ah2k3ranfzisvych5q19kwm";
+      sha256 = "10nq1xjqvkhngiygji831qx9bryjwws95r4vrnlq9142bzkg670s";
       type = "gem";
     };
-    version = "1.8.2";
+    version = "1.8.3";
   };
   listen = {
     dependencies = ["rb-fsevent" "rb-inotify" "ruby_dep"];
@@ -212,10 +212,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zin0q26wc5p7zb7glpwary7ms60s676vcq987yv22jgm6hnlwlh";
+      sha256 = "1z75svngyhsglx0y2f9rnil2j08f9ab54b3l95bpgz67zq2if753";
       type = "gem";
     };
-    version = "3.2020.0425";
+    version = "3.2020.0512";
   };
   multi_json = {
     groups = ["default"];
diff --git a/pkgs/development/web/deno/default.nix b/pkgs/development/web/deno/default.nix
index 28e438fa1e95..199d7f81fe0f 100644
--- a/pkgs/development/web/deno/default.nix
+++ b/pkgs/development/web/deno/default.nix
@@ -18,16 +18,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "deno";
-  version = "1.0.5";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1hlmgcppr01bddvp28js010hhlzyx2lm7g7lq9nrcjazfw7kd2pf";
+    sha256 = "11rxfnjam1kr8piiw0s4r0qg8rj4qfpppp6dixk1hhsq2iwbnzj6";
     fetchSubmodules = true;
   };
-  cargoSha256 = "1jqaryr7np6h65a1bqr952h0vllsvd6v6v6wvivc7933dcbhdal4";
+  cargoSha256 = "107i9zvlwiwad58c7lmh6zl9iwlqn1h8qk7zf7x68b6498p8nh7d";
 
   # Install completions post-install
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/development/web/deno/update/update.ts b/pkgs/development/web/deno/update/update.ts
index ab13cee9dbe2..18d451480137 100755
--- a/pkgs/development/web/deno/update/update.ts
+++ b/pkgs/development/web/deno/update/update.ts
@@ -1,6 +1,6 @@
 #!/usr/bin/env nix-shell
 /*
-#!nix-shell -i "deno run --allow-net --allow-run --allow-read --allow-write" -p deno git nix-prefetch nix-prefetch-url
+#!nix-shell -i "deno run --allow-net --allow-run --allow-read --allow-write" -p deno git nix-prefetch
 */
 import {
   commit,
diff --git a/pkgs/development/web/flyctl/default.nix b/pkgs/development/web/flyctl/default.nix
index 339286015917..1a7a3d6607f4 100644
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.0.123";
+  version = "0.0.131";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    sha256 = "1gs796n2cw8kpfsqr21zqxzp8dmnhhmjfy7vnpi838566i5ql9q3";
+    sha256 = "0b9qrraydihw4wglif3rjmjlqdsgxh873023z3rgrvf7dwrhc9y0";
   };
 
   preBuild = ''
@@ -17,7 +17,7 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
-  vendorSha256 = "10wcyxzkwvbhf86dq1rh852zgdg28draay0515zp459z34vv4zna";
+  vendorSha256 = "1gxz9pp4zl8q7pmwg9z261fjrjfr658k1sn5nq1xzz51wrlzg9ag";
 
   buildFlagsArray = [ "-ldflags=-s -w -X github.com/superfly/flyctl/flyctl.Version=${version} -X github.com/superfly/flyctl/flyctl.Commit=${src.rev} -X github.com/superfly/flyctl/flyctl.BuildDate=1970-01-01T00:00:00+0000 -X github.com/superfly/flyctl/flyctl.Environment=production" ];
 
diff --git a/pkgs/games/augustus/default.nix b/pkgs/games/augustus/default.nix
new file mode 100644
index 000000000000..cabe419ef5bc
--- /dev/null
+++ b/pkgs/games/augustus/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchFromGitHub, cmake, SDL2, SDL2_mixer, libpng }:
+
+stdenv.mkDerivation rec {
+  pname = "augustus";
+  version = "1.4.1a";
+
+  src = fetchFromGitHub {
+    owner = "Keriew";
+    repo = "augustus";
+    rev = "v${version}";
+    sha256 = "1xqv8j8jh3f13fjhyf7hk1anrn799cwwsvsd75kpl9n5yh5s1j5y";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ SDL2 SDL2_mixer libpng ];
+
+  meta = with stdenv.lib; {
+    description = "An open source re-implementation of Caesar III. Fork of Julius incorporating gameplay changes";
+    homepage = "https://github.com/Keriew/augustus";
+    license = licenses.agpl3;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ Thra11 ];
+  };
+}
diff --git a/pkgs/games/easyrpg-player/default.nix b/pkgs/games/easyrpg-player/default.nix
index 1a540c6489c6..79628d0d2ae9 100644
--- a/pkgs/games/easyrpg-player/default.nix
+++ b/pkgs/games/easyrpg-player/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "easyrpg-player";
-  version = "0.6.2";
+  version = "0.6.2.1";
 
   src = fetchFromGitHub {
     owner = "EasyRPG";
     repo = "Player";
     rev = version;
-    sha256 = "1xjisqxmx1jc1afsr55hyr0l9v20gvchllby76pygkfkgifyidyp";
+    sha256 = "19wpjvlkjmjhdv1dbph6i2da1xx479zhr532x0ili1aphw1j9hi6";
   };
 
   nativeBuildInputs = [ cmake doxygen pkgconfig ];
diff --git a/pkgs/games/julius/default.nix b/pkgs/games/julius/default.nix
new file mode 100644
index 000000000000..d1dad86e1c54
--- /dev/null
+++ b/pkgs/games/julius/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchFromGitHub, cmake, SDL2, SDL2_mixer, libpng }:
+
+stdenv.mkDerivation rec {
+  pname = "julius";
+  version = "1.4.1";
+
+  src = fetchFromGitHub {
+    owner = "bvschaik";
+    repo = "julius";
+    rev = "v${version}";
+    sha256 = "12hhnhdwgz7hd3hlndbnk15pxggm1375qs0764ija4nl1gbpb110";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ SDL2 SDL2_mixer libpng ];
+
+  meta = with stdenv.lib; {
+    description = "An open source re-implementation of Caesar III";
+    homepage = "https://github.com/bvschaik/julius";
+    license = licenses.agpl3;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ Thra11 ];
+  };
+}
diff --git a/pkgs/games/katago/default.nix b/pkgs/games/katago/default.nix
index 0a9ebd9e3eb4..fd4303eb2b1d 100644
--- a/pkgs/games/katago/default.nix
+++ b/pkgs/games/katago/default.nix
@@ -35,13 +35,13 @@ let
 
 in env.mkDerivation rec {
   pname = "katago";
-  version = "1.4.2";
+  version = "1.4.4";
 
   src = fetchFromGitHub {
     owner = "lightvector";
     repo = "katago";
     rev = "v${version}";
-    sha256 = "0qdc9hgbzd175b2xkjs62dy6gyybcn9lf1mifiyhjbzjpgv192h4";
+    sha256 = "14xs2bm8sky9cdsjdahjqs82q6blzcw05f5d9r1h171dm1hcx566";
   };
 
   # To workaround CMake 3.17.0's new buggy behavior wrt CUDA Compiler testing
diff --git a/pkgs/games/openmw/default.nix b/pkgs/games/openmw/default.nix
index cae97dc42158..22f3ea8d6ad3 100644
--- a/pkgs/games/openmw/default.nix
+++ b/pkgs/games/openmw/default.nix
@@ -6,19 +6,19 @@ let
     src = fetchFromGitHub {
       owner = "OpenMW";
       repo = "osg";
-      rev = "2b4c8e37268e595b82da4b9aadd5507852569b87";
-      sha256 = "0admnllxic6dcpic0h100927yw766ab55dix002vvdx36i6994jb";
+      rev = "1556cd7966ebc1c80b6626988d2b25fb43a744cf";
+      sha256 = "0d74hijzmj82nx3jkv5qmr3pkgvplra0b8fbjx1y3vmzxamb0axd";
     };
   });
 in mkDerivationWith stdenv.mkDerivation rec {
-  version = "0.45.0";
+  version = "0.46.0";
   pname = "openmw";
 
   src = fetchFromGitHub {
     owner = "OpenMW";
     repo = "openmw";
     rev = "${pname}-${version}";
-    sha256 = "1r87zrsnza2v9brksh809zzqj6zhk5xj15qs8iq11v1bscm2a2j4";
+    sha256 = "0rm32zsmxvr6b0jjihfj543skhicbw5kg6shjx312clhlm035w2x";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/games/steam/runtime.nix b/pkgs/games/steam/runtime.nix
index 44d80c0d7948..6d81d6c775e2 100644
--- a/pkgs/games/steam/runtime.nix
+++ b/pkgs/games/steam/runtime.nix
@@ -1,4 +1,4 @@
-{ stdenv, steamArch, fetchurl, }:
+{ stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
 
@@ -6,20 +6,15 @@ stdenv.mkDerivation rec {
   # from https://repo.steampowered.com/steamrt-images-scout/snapshots/
   version = "0.20200417.0";
 
-  src =
-    if steamArch == "amd64" then fetchurl {
-      url = "https://repo.steampowered.com/steamrt-images-scout/snapshots/${version}/com.valvesoftware.SteamRuntime.Platform-amd64,i386-scout-runtime.tar.gz";
-      sha256 = "0kps8i5v23sycqm69xz389n8k831jd7ncsmlrkky7nib2q91rbvj";
-      name = "scout-runtime-${version}.tar.gz";
-    } else fetchurl {
-      url = "https://repo.steampowered.com/steamrt-images-scout/snapshots/${version}/com.valvesoftware.SteamRuntime.Platform-i386-scout-runtime.tar.gz";
-      sha256 = "03fhac1r25xf7ia2pd35wjw360v5pa9h4870yrhhygp9h7v4klzf";
-      name = "scout-runtime-i386-${version}.tar.gz";
-    };
+  src = fetchurl {
+    url = "https://repo.steampowered.com/steamrt-images-scout/snapshots/${version}/steam-runtime.tar.xz";
+    sha256 = "0d4dfl6i31i8187wj8rr9yvmrg32bx96bsgs2ya21b00czf070sy";
+    name = "scout-runtime-${version}.tar.gz";
+  };
 
   buildCommand = ''
     mkdir -p $out
-    tar -C $out -x --strip=1 -f $src files/
+    tar -C $out --strip=1 -x -f $src
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/games/wesnoth/default.nix b/pkgs/games/wesnoth/default.nix
index 20ec0a978f5b..2eb45ded7e29 100644
--- a/pkgs/games/wesnoth/default.nix
+++ b/pkgs/games/wesnoth/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, cmake, pkgconfig, SDL2, SDL2_image, SDL2_mixer, SDL2_net, SDL2_ttf
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, SDL2, SDL2_image, SDL2_mixer, SDL2_net, SDL2_ttf
 , pango, gettext, boost, libvorbis, fribidi, dbus, libpng, pcre, openssl, icu
 , Cocoa, Foundation
 , enableTools ? false
@@ -6,11 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wesnoth";
-  version = "1.14.11";
+  version = "1.14.12";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/sourceforge/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "1i8mz6gw3qar09bscczhki0g4scj8pl58v85rp0g55r4bcq41l5v";
+  src = fetchFromGitHub {
+    rev = version;
+    owner = "wesnoth";
+    repo = "wesnoth";
+    sha256 = "0xpypy0yfjmjp3apvlh51nm19p1cjhjw2p547kvmrckm7y6naaw8";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
@@ -33,7 +35,7 @@ stdenv.mkDerivation rec {
       adventures.
     '';
 
-    homepage = "http://www.wesnoth.org/";
+    homepage = "https://www.wesnoth.org/";
     license = licenses.gpl2;
     maintainers = with maintainers; [ abbradar ];
     platforms = platforms.unix;
diff --git a/pkgs/misc/drivers/hplip/default.nix b/pkgs/misc/drivers/hplip/default.nix
index 7c9eb35b9af4..98ced28b8773 100644
--- a/pkgs/misc/drivers/hplip/default.nix
+++ b/pkgs/misc/drivers/hplip/default.nix
@@ -5,7 +5,7 @@
 , net-snmp, openssl, perl, nettools
 , bash, coreutils, utillinux
 # To remove references to gcc-unwrapped
-, removeReferencesTo
+, removeReferencesTo, qt5
 , withQt5 ? true
 , withPlugin ? false
 , withStaticPPDInstall ? false
@@ -14,16 +14,16 @@
 let
 
   name = "hplip-${version}";
-  version = "3.20.3";
+  version = "3.20.5";
 
   src = fetchurl {
     url = "mirror://sourceforge/hplip/${name}.tar.gz";
-    sha256 = "0sh6cg7yjc11x1cm4477iaslj9n8ksghs85hqwgfbk7m5b2pw2a1";
+    sha256 = "004bbd78487b7803cdcf2a96b00de938797227068c4de43ee7ad7d174c4e475a";
   };
 
   plugin = fetchurl {
     url = "https://developers.hp.com/sites/default/files/${name}-plugin.run";
-    sha256 = "13xyv30jqjysfk7gh0gyn7qj0pb0qvk2rlbhm85a3lw7bjycal8g";
+    sha256 = "ff3dedda3158be64b985efbf636890ddda5b271ae1f1fbd788219e1344a9c2e7";
   };
 
   hplipState = substituteAll {
@@ -67,12 +67,15 @@ python3Packages.buildPythonApplication {
     zlib
   ];
 
-  nativeBuildInputs = [ pkgconfig removeReferencesTo ];
+  nativeBuildInputs = [
+    pkgconfig
+    removeReferencesTo
+  ] ++ stdenv.lib.optional withQt5 qt5.wrapQtAppsHook;
 
   pythonPath = with python3Packages; [
     dbus
     pillow
-    pygobject2
+    pygobject3
     reportlab
     usbutils
     sip
@@ -219,6 +222,10 @@ python3Packages.buildPythonApplication {
       --replace {,${utillinux}/bin/}logger \
       --replace {/usr,$out}/bin
     remove-references-to -t ${stdenv.cc.cc} $(readlink -f $out/lib/*.so)
+  '' + stdenv.lib.optionalString withQt5 ''
+    for f in $out/bin/hp-*;do
+      wrapQtApp $f
+    done
   '';
 
   # There are some binaries there, which reference gcc-unwrapped otherwise.
diff --git a/pkgs/misc/emulators/melonDS/default.nix b/pkgs/misc/emulators/melonDS/default.nix
new file mode 100644
index 000000000000..94fbeba0e075
--- /dev/null
+++ b/pkgs/misc/emulators/melonDS/default.nix
@@ -0,0 +1,41 @@
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, SDL2, gtk3, libpcap, wrapGAppsHook }:
+
+stdenv.mkDerivation rec {
+  pname = "melonDS";
+  version = "0.8.3";
+  ## When updating to the release after 0.8.3,
+  ##  - Uncomment:
+  ##      cmakeFlags = [ "-UUNIX_PORTABLE" ];
+  ##  - Remove the postInstall, since cmake should then take care of installing icons, .desktop file, and romlist.bin
+  ##    (see https://github.com/Arisotura/melonDS/pull/546)
+
+  src = fetchFromGitHub {
+    owner = "Arisotura";
+    repo = pname;
+    rev = version;
+    sha256 = "1lqmfwjpkdqfkns1aaxlp4yrg6i0r66mxfr4rrj7b5286k44hqwn";
+  };
+
+  enableParallelBuilding = true;
+  nativeBuildInputs = [ cmake pkgconfig wrapGAppsHook ];
+  buildInputs = [ SDL2 gtk3 libpcap ];
+
+  postInstall = ''
+    install -Dm644 -t $out/share/melonDS/ ../romlist.bin
+    install -Dm644 -t $out/share/applications/ ../flatpak/*.desktop
+
+    for i in ../icon/melon_*.png; do
+      d="''${i##*_}"
+      d="$out/share/icons/hicolor/''${d%.png}/apps"
+      install -D $i "$d/net.kuribo64.melonds.png"
+    done
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "http://melonds.kuribo64.net/";
+    description = "Work in progress Nintendo DS emulator";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ artemist benley ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/misc/emulators/stella/default.nix b/pkgs/misc/emulators/stella/default.nix
index 14189e5b3871..591b2daaf15b 100644
--- a/pkgs/misc/emulators/stella/default.nix
+++ b/pkgs/misc/emulators/stella/default.nix
@@ -4,13 +4,13 @@ with stdenv.lib;
 stdenv.mkDerivation rec {
 
   pname = "stella";
-  version = "6.1.2";
+  version = "6.2";
 
   src = fetchFromGitHub {
     owner = "stella-emu";
     repo = "stella";
     rev = version;
-    sha256 = "0m4vdgn7gqhga7hamy4djnlkfgz78gfkmg8by3mai5lw0cps7hr1";
+    sha256 = "1d97g4m686xsj6r5vy5x74ys9yk0hcpdppxh714n8hhcc9aglm19";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/alsa-utils/default.nix b/pkgs/os-specific/linux/alsa-utils/default.nix
index f05bb6a0d59c..470536db4b7b 100644
--- a/pkgs/os-specific/linux/alsa-utils/default.nix
+++ b/pkgs/os-specific/linux/alsa-utils/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "alsa-utils";
-  version = "1.2.2";
+  version = "1.2.3";
 
   src = fetchurl {
     url = "mirror://alsa/utils/${pname}-${version}.tar.bz2";
-    sha256 = "1wz460by17rmxrcydn583rd4lhj6wlvqs6x1j5pdzxn5g3app024";
+    sha256 = "1ai1z4kf91b1m3qrpwqkc1af5vm2fkdkknqv95xdwf19q94aw6gz";
   };
 
   patchPhase = ''
diff --git a/pkgs/os-specific/linux/firmware/fwupd/default.nix b/pkgs/os-specific/linux/firmware/fwupd/default.nix
index 87a37feb1cc8..af9237d1d833 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -51,6 +51,7 @@
 , flashrom
 , tpm2-tools
 , nixosTests
+, runCommand
 }:
 
 let
@@ -83,203 +84,232 @@ let
   # Experimental
   haveFlashrom = false;
 
-in
+  runPythonCommand = name: buildCommandPython: runCommand name {
+    nativeBuildInputs = [ python3 ];
+      inherit buildCommandPython;
+  } ''
+    exec python3 -c "$buildCommandPython"
+  '';
 
-stdenv.mkDerivation rec {
-  pname = "fwupd";
-  version = "1.4.2";
+  self = stdenv.mkDerivation rec {
+    pname = "fwupd";
+    version = "1.4.4";
 
-  src = fetchurl {
-    url = "https://people.freedesktop.org/~hughsient/releases/fwupd-${version}.tar.xz";
-    sha256 = "1wch1n0z89ymfxx7ganiab4h64rdxr54rcg37n5nshw35bc3f390";
-  };
+    src = fetchurl {
+      url = "https://people.freedesktop.org/~hughsient/releases/fwupd-${version}.tar.xz";
+      sha256 = "03yn96kxs53vxcbza17y99rdhbjlybv44gkc90vaj6301grxahnp";
+    };
 
-  # libfwupd goes to lib
-  # daemon, plug-ins and libfwupdplugin go to out
-  # CLI programs go to out
-  outputs = [ "out" "lib" "dev" "devdoc" "man" "installedTests" ];
-
-  nativeBuildInputs = [
-    meson
-    ninja
-    gtk-doc
-    pkgconfig
-    gobject-introspection
-    intltool
-    shared-mime-info
-    valgrind
-    gcab
-    docbook_xml_dtd_43
-    docbook_xsl
-    help2man
-    libxslt
-    python
-    wrapGAppsHook
-    vala
-  ];
-
-  buildInputs = [
-    polkit
-    libxmlb
-    gusb
-    sqlite
-    libarchive
-    libsoup
-    elfutils
-    gnu-efi
-    libyaml
-    libgudev
-    colord
-    libjcat
-    libuuid
-    glib-networking
-    json-glib
-    umockdev
-    bash-completion
-    cairo
-    freetype
-    fontconfig
-    pango
-    tpm2-tss
-    efivar
-  ] ++ stdenv.lib.optionals haveDell [
-    libsmbios
-  ];
-
-  patches = [
-    ./fix-paths.patch
-    ./add-option-for-installation-sysconfdir.patch
-
-    # Install plug-ins and libfwupdplugin to out,
-    # they are not really part of the library.
-    ./install-fwupdplugin-to-out.patch
-
-    # Installed tests are installed to different output
-    # we also cannot have fwupd-tests.conf in $out/etc since it would form a cycle.
-    (substituteAll {
-      src = ./installed-tests-path.patch;
-      # Needs a different set of modules than po/make-images.
-      inherit installedTestsPython;
-    })
-  ];
-
-  postPatch = ''
-    patchShebangs \
-      contrib/get-version.py \
-      contrib/generate-version-script.py \
-      meson_post_install.sh \
-      po/make-images \
-      po/make-images.sh \
-      po/test-deps
-  '';
+    # libfwupd goes to lib
+    # daemon, plug-ins and libfwupdplugin go to out
+    # CLI programs go to out
+    outputs = [ "out" "lib" "dev" "devdoc" "man" "installedTests" ];
 
-  # /etc/os-release not available in sandbox
-  # doCheck = true;
-
-  preFixup = let
-    binPath = [
-      efibootmgr
-      bubblewrap
-      tpm2-tools
-    ] ++ stdenv.lib.optional haveFlashrom flashrom;
-  in ''
-    gappsWrapperArgs+=(
-      --prefix XDG_DATA_DIRS : "${shared-mime-info}/share"
-      # See programs reached with fu_common_find_program_in_path in source
-      --prefix PATH : "${stdenv.lib.makeBinPath binPath}"
-    )
-  '';
+    nativeBuildInputs = [
+      meson
+      ninja
+      gtk-doc
+      pkgconfig
+      gobject-introspection
+      intltool
+      shared-mime-info
+      valgrind
+      gcab
+      docbook_xml_dtd_43
+      docbook_xsl
+      help2man
+      libxslt
+      python
+      wrapGAppsHook
+      vala
+    ];
 
-  mesonFlags = [
-    "-Dgtkdoc=true"
-    "-Dplugin_dummy=true"
-    "-Dudevdir=lib/udev"
-    "-Dsystemd_root_prefix=${placeholder "out"}"
-    "-Dinstalled_test_prefix=${placeholder "installedTests"}"
-    "-Defi-libdir=${gnu-efi}/lib"
-    "-Defi-ldsdir=${gnu-efi}/lib"
-    "-Defi-includedir=${gnu-efi}/include/efi"
-    "--localstatedir=/var"
-    "--sysconfdir=/etc"
-    "-Dsysconfdir_install=${placeholder "out"}/etc"
-
-    # We do not want to place the daemon into lib (cyclic reference)
-    "--libexecdir=${placeholder "out"}/libexec"
-    # Our builder only adds $lib/lib to rpath but some things link
-    # against libfwupdplugin which is in $out/lib.
-    "-Dc_link_args=-Wl,-rpath,${placeholder "out"}/lib"
-  ] ++ stdenv.lib.optionals (!haveDell) [
-    "-Dplugin_dell=false"
-    "-Dplugin_synaptics=false"
-  ] ++ stdenv.lib.optionals (!haveRedfish) [
-    "-Dplugin_redfish=false"
-  ] ++ stdenv.lib.optionals haveFlashrom [
-    "-Dplugin_flashrom=true"
-  ];
-
-  FONTCONFIG_FILE = fontsConf; # Fontconfig error: Cannot load default config file
-
-  # error: “PolicyKit files are missing”
-  # https://github.com/NixOS/nixpkgs/pull/67625#issuecomment-525788428
-  PKG_CONFIG_POLKIT_GOBJECT_1_ACTIONDIR = "/run/current-system/sw/share/polkit-1/actions";
-
-  # TODO: wrapGAppsHook wraps efi capsule even though it is not elf
-  dontWrapGApps = true;
-
-  preCheck = ''
-    addToSearchPath XDG_DATA_DIRS "${shared-mime-info}/share"
-  '';
+    buildInputs = [
+      polkit
+      libxmlb
+      gusb
+      sqlite
+      libarchive
+      libsoup
+      elfutils
+      gnu-efi
+      libyaml
+      libgudev
+      colord
+      libjcat
+      libuuid
+      glib-networking
+      json-glib
+      umockdev
+      bash-completion
+      cairo
+      freetype
+      fontconfig
+      pango
+      tpm2-tss
+      efivar
+    ] ++ stdenv.lib.optionals haveDell [
+      libsmbios
+    ];
 
-  # so we need to wrap the executables manually
-  postFixup = ''
-    find -L "$out/bin" "$out/libexec" -type f -executable -print0 \
-      | while IFS= read -r -d ''' file; do
-      if [[ "$file" != *.efi ]]; then
-        echo "Wrapping program $file"
-        wrapGApp "$file"
-      fi
-    done
-  '';
+    patches = [
+      ./fix-paths.patch
+      ./add-option-for-installation-sysconfdir.patch
 
-  # /etc/fwupd/uefi.conf is created by the services.hardware.fwupd NixOS module
-  passthru = {
-    filesInstalledToEtc = [
-      "fwupd/ata.conf"
-      # "fwupd/daemon.conf" # already created by the module
-      "fwupd/redfish.conf"
-      "fwupd/remotes.d/lvfs-testing.conf"
-      "fwupd/remotes.d/lvfs.conf"
-      "fwupd/remotes.d/vendor.conf"
-      "fwupd/remotes.d/vendor-directory.conf"
-      "fwupd/thunderbolt.conf"
-      "fwupd/upower.conf"
-      # "fwupd/uefi.conf" # already created by the module
-      "pki/fwupd/GPG-KEY-Hughski-Limited"
-      "pki/fwupd/GPG-KEY-Linux-Foundation-Firmware"
-      "pki/fwupd/GPG-KEY-Linux-Vendor-Firmware-Service"
-      "pki/fwupd/LVFS-CA.pem"
-      "pki/fwupd-metadata/GPG-KEY-Linux-Foundation-Metadata"
-      "pki/fwupd-metadata/GPG-KEY-Linux-Vendor-Firmware-Service"
-      "pki/fwupd-metadata/LVFS-CA.pem"
-    ] ++ stdenv.lib.optionals haveDell [
-      "fwupd/remotes.d/dell-esrt.conf"
+      # Install plug-ins and libfwupdplugin to out,
+      # they are not really part of the library.
+      ./install-fwupdplugin-to-out.patch
+
+      # Installed tests are installed to different output
+      # we also cannot have fwupd-tests.conf in $out/etc since it would form a cycle.
+      (substituteAll {
+        src = ./installed-tests-path.patch;
+        # Needs a different set of modules than po/make-images.
+        inherit installedTestsPython;
+      })
     ];
 
-    # BlacklistPlugins key in fwupd/daemon.conf
-    defaultBlacklistedPlugins = [
-      "test"
-      "invalid"
+    postPatch = ''
+      patchShebangs \
+        contrib/get-version.py \
+        contrib/generate-version-script.py \
+        meson_post_install.sh \
+        po/make-images \
+        po/make-images.sh \
+        po/test-deps
+    '';
+
+    # /etc/os-release not available in sandbox
+    # doCheck = true;
+
+    preFixup = let
+      binPath = [
+        efibootmgr
+        bubblewrap
+        tpm2-tools
+      ] ++ stdenv.lib.optional haveFlashrom flashrom;
+    in ''
+      gappsWrapperArgs+=(
+        --prefix XDG_DATA_DIRS : "${shared-mime-info}/share"
+        # See programs reached with fu_common_find_program_in_path in source
+        --prefix PATH : "${stdenv.lib.makeBinPath binPath}"
+      )
+    '';
+
+    mesonFlags = [
+      "-Dgtkdoc=true"
+      "-Dplugin_dummy=true"
+      "-Dudevdir=lib/udev"
+      "-Dsystemd_root_prefix=${placeholder "out"}"
+      "-Dinstalled_test_prefix=${placeholder "installedTests"}"
+      "-Defi-libdir=${gnu-efi}/lib"
+      "-Defi-ldsdir=${gnu-efi}/lib"
+      "-Defi-includedir=${gnu-efi}/include/efi"
+      "--localstatedir=/var"
+      "--sysconfdir=/etc"
+      "-Dsysconfdir_install=${placeholder "out"}/etc"
+
+      # We do not want to place the daemon into lib (cyclic reference)
+      "--libexecdir=${placeholder "out"}/libexec"
+      # Our builder only adds $lib/lib to rpath but some things link
+      # against libfwupdplugin which is in $out/lib.
+      "-Dc_link_args=-Wl,-rpath,${placeholder "out"}/lib"
+    ] ++ stdenv.lib.optionals (!haveDell) [
+      "-Dplugin_dell=false"
+      "-Dplugin_synaptics=false"
+    ] ++ stdenv.lib.optionals (!haveRedfish) [
+      "-Dplugin_redfish=false"
+    ] ++ stdenv.lib.optionals haveFlashrom [
+      "-Dplugin_flashrom=true"
     ];
 
-    tests = {
-      installedTests = nixosTests.installed-tests.fwupd;
+    FONTCONFIG_FILE = fontsConf; # Fontconfig error: Cannot load default config file
+
+    # error: “PolicyKit files are missing”
+    # https://github.com/NixOS/nixpkgs/pull/67625#issuecomment-525788428
+    PKG_CONFIG_POLKIT_GOBJECT_1_ACTIONDIR = "/run/current-system/sw/share/polkit-1/actions";
+
+    # TODO: wrapGAppsHook wraps efi capsule even though it is not elf
+    dontWrapGApps = true;
+
+    preCheck = ''
+      addToSearchPath XDG_DATA_DIRS "${shared-mime-info}/share"
+    '';
+
+    # so we need to wrap the executables manually
+    postFixup = ''
+      find -L "$out/bin" "$out/libexec" -type f -executable -print0 \
+        | while IFS= read -r -d ''' file; do
+        if [[ "$file" != *.efi ]]; then
+          echo "Wrapping program $file"
+          wrapGApp "$file"
+        fi
+      done
+    '';
+
+    passthru = {
+      filesInstalledToEtc = [
+        "fwupd/ata.conf"
+        "fwupd/daemon.conf"
+        "fwupd/redfish.conf"
+        "fwupd/remotes.d/lvfs-testing.conf"
+        "fwupd/remotes.d/lvfs.conf"
+        "fwupd/remotes.d/vendor.conf"
+        "fwupd/remotes.d/vendor-directory.conf"
+        "fwupd/thunderbolt.conf"
+        "fwupd/upower.conf"
+        "fwupd/uefi.conf"
+        "pki/fwupd/GPG-KEY-Hughski-Limited"
+        "pki/fwupd/GPG-KEY-Linux-Foundation-Firmware"
+        "pki/fwupd/GPG-KEY-Linux-Vendor-Firmware-Service"
+        "pki/fwupd/LVFS-CA.pem"
+        "pki/fwupd-metadata/GPG-KEY-Linux-Foundation-Metadata"
+        "pki/fwupd-metadata/GPG-KEY-Linux-Vendor-Firmware-Service"
+        "pki/fwupd-metadata/LVFS-CA.pem"
+      ] ++ stdenv.lib.optionals haveDell [
+        "fwupd/remotes.d/dell-esrt.conf"
+      ];
+
+      # BlacklistPlugins key in fwupd/daemon.conf
+      defaultBlacklistedPlugins = [
+        "test"
+        "invalid"
+      ];
+
+      tests = let
+        listToPy = list: "[${stdenv.lib.concatMapStringsSep ", " (f: "'${f}'") list}]";
+      in {
+        installedTests = nixosTests.installed-tests.fwupd;
+
+        passthruMatches = runPythonCommand "fwupd-test-passthru-matches" ''
+          import itertools
+          import configparser
+          import os
+          import pathlib
+
+          etc = '${self}/etc'
+          package_etc = set(itertools.chain.from_iterable([[os.path.relpath(os.path.join(prefix, file), etc) for file in files] for (prefix, dirs, files) in os.walk(etc)]))
+          passthru_etc = set(${listToPy passthru.filesInstalledToEtc})
+          assert len(package_etc - passthru_etc) == 0, f'fwupd package contains the following paths in /etc that are not listed in passthru.filesInstalledToEtc: {package_etc - passthru_etc}'
+          assert len(passthru_etc - package_etc) == 0, f'fwupd package lists the following paths in passthru.filesInstalledToEtc that are not contained in /etc: {passthru_etc - package_etc}'
+
+          config = configparser.RawConfigParser()
+          config.read('${self}/etc/fwupd/daemon.conf')
+          package_blacklisted_plugins = config.get('fwupd', 'BlacklistPlugins').rstrip(';').split(';')
+          passthru_blacklisted_plugins = ${listToPy passthru.defaultBlacklistedPlugins}
+          assert package_blacklisted_plugins == passthru_blacklisted_plugins, f'Default blacklisted plug-ins in the package {package_blacklisted_plugins} do not match those listed in passthru.defaultBlacklistedPlugins {passthru_blacklisted_plugins}'
+
+          pathlib.Path(os.getenv('out')).touch()
+        '';
+      };
     };
-  };
 
-  meta = with stdenv.lib; {
-    homepage = "https://fwupd.org/";
-    maintainers = with maintainers; [ jtojnar ];
-    license = [ licenses.gpl2 ];
-    platforms = platforms.linux;
+    meta = with stdenv.lib; {
+      homepage = "https://fwupd.org/";
+      maintainers = with maintainers; [ jtojnar ];
+      license = [ licenses.gpl2 ];
+      platforms = platforms.linux;
+    };
   };
-}
+
+in self
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
index bd9c58d33c9c..77a284446366 100644
--- a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "raspberrypi-firmware";
-  version = "1.20190925";
+  version = "1.20200601";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "firmware";
     rev = version;
-    sha256 = "0xyj3f04dcfnl9hp8hakgwcb1msqh7934n0pclcmzy47xjkz7ris";
+    sha256 = "1vm038f9digwg8gdxl2bypzlip3ycjb6bl56274gh5i9abl6wjvf";
   };
 
   installPhase = ''
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi/tools-dont-install-sysv-init-scripts.patch b/pkgs/os-specific/linux/firmware/raspberrypi/tools-dont-install-sysv-init-scripts.patch
deleted file mode 100644
index e12aeeb0cdb8..000000000000
--- a/pkgs/os-specific/linux/firmware/raspberrypi/tools-dont-install-sysv-init-scripts.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-diff --git a/interface/vmcs_host/linux/vcfiled/CMakeLists.txt b/interface/vmcs_host/linux/vcfiled/CMakeLists.txt
-index aed0e83..b325676 100644
---- a/interface/vmcs_host/linux/vcfiled/CMakeLists.txt
-+++ b/interface/vmcs_host/linux/vcfiled/CMakeLists.txt
-@@ -17,15 +17,6 @@ target_link_libraries(vcfiled
- install(TARGETS vcfiled 
-         RUNTIME DESTINATION sbin)
- 
--configure_file (etc/init.d/vcfiled ${PROJECT_BINARY_DIR}/etc/init.d/vcfiled)
--
--# script to start up vcfiled at start of day
--install(PROGRAMS ${PROJECT_BINARY_DIR}/etc/init.d/vcfiled
--        DESTINATION /etc/init.d)
--# install locally to the installation directory too
--install(PROGRAMS ${PROJECT_BINARY_DIR}/etc/init.d/vcfiled
--        DESTINATION ${VMCS_INSTALL_PREFIX}/share/install)
--
- # test program for vcfiled_check library
- add_executable(vcfiled_lock_test vcfiled_lock_test.c)
- target_link_libraries(vcfiled_lock_test vcfiled_check)
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi/tools.nix b/pkgs/os-specific/linux/firmware/raspberrypi/tools.nix
index e3fa90ac388d..6c4d49e4e240 100644
--- a/pkgs/os-specific/linux/firmware/raspberrypi/tools.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi/tools.nix
@@ -2,17 +2,15 @@
 
 stdenv.mkDerivation {
   pname = "raspberrypi-tools";
-  version = "2018-10-03";
+  version = "2020-05-28";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "userland";
-    rev = "de4a7f2e3c391e2d3bc76af31864270e7802d9ac";
-    sha256 = "0w96xa98ngdk9m6wv185w8waa7wm2hkn2bhxz52zd477hchzrxlg";
+    rev = "f97b1af1b3e653f9da2c1a3643479bfd469e3b74";
+    sha256 = "1r7n05rv96hqjq0rn0qzchmfqs0j7vh3p8jalgh66s6l0vms5mwy";
   };
 
-  patches = [ ./tools-dont-install-sysv-init-scripts.patch ];
-
   nativeBuildInputs = [ cmake pkgconfig ];
 
   preConfigure = ''
diff --git a/pkgs/os-specific/linux/firmware/sof-firmware/default.nix b/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
index 73ab46b3c8a6..a9fc44e48cc8 100644
--- a/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
@@ -1,28 +1,33 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchFromGitHub }:
 
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "sof-firmware";
-  version = "1.4.2";
+  version = "1.5.1";
 
-  src = fetchurl {
-    url = "https://www.alsa-project.org/files/pub/misc/sof/${pname}-${version}.tar.bz2";
-    sha256 = "1nkh020gjm45vxd6fvmz63hj16ilff2nl5avvsklajjs6xci1sf5";
+  src = fetchFromGitHub {
+    owner = "thesofproject";
+    repo = "sof-bin";
+    rev = "ae61d2778b0a0f47461a52da0d1f191f651e0763";
+    sha256 = "0j6bpwz49skvdvian46valjw4anwlrnkq703n0snkbngmq78prba";
   };
 
   phases = [ "unpackPhase" "installPhase" ];
 
   installPhase = ''
-    rm lib/firmware/intel/{sof/LICENCE,sof-tplg/LICENCE}
-    mkdir $out
-    cp -r lib $out/lib
+    mkdir -p $out/lib/firmware/intel
+
+    sed -i 's/ROOT=.*$/ROOT=$out/g' go.sh
+    sed -i 's/VERSION=.*$/VERSION=v${version}/g' go.sh
+
+    ./go.sh
   '';
 
   meta = with stdenv.lib; {
     description = "Sound Open Firmware";
     homepage = "https://www.sofproject.org/";
     license = with licenses; [ bsd3 isc ];
-    maintainers = with maintainers; [ lblasc ];
+    maintainers = with maintainers; [ lblasc evenbrenden ];
     platforms = with platforms; linux;
   };
 }
diff --git a/pkgs/os-specific/linux/google-authenticator/default.nix b/pkgs/os-specific/linux/google-authenticator/default.nix
index e04b83143507..ce90a1d432f7 100644
--- a/pkgs/os-specific/linux/google-authenticator/default.nix
+++ b/pkgs/os-specific/linux/google-authenticator/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "google-authenticator-libpam";
-  version = "1.08";
+  version = "1.09";
 
   src = fetchurl {
     url = "https://github.com/google/google-authenticator-libpam/archive/${version}.tar.gz";
-    sha256 = "1432sfgjv7xlas1saa0whnvqim2pb12g2522x3nf5a8v4qq7avbg";
+    sha256 = "0dyhgizl2jcrnfn5sxipxawqrbr6qgjh7aggw8fz3hix861pj7db";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 1cec678d1534..5a2fb8cf7aab 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -206,8 +206,8 @@ let
       B43_PHY_HT            = option yes;
       BCMA_HOST_PCI         = option yes;
       RTW88                 = whenAtLeast "5.2" module;
-      RTW88_8822BE          = whenAtLeast "5.2" yes;
-      RTW88_8822CE          = whenAtLeast "5.2" yes;
+      RTW88_8822BE          = mkMerge [ (whenBetween "5.2" "5.8" yes) (whenAtLeast "5.8" module) ];
+      RTW88_8822CE          = mkMerge [ (whenBetween "5.2" "5.8" yes) (whenAtLeast "5.8" module) ];
     };
 
     fb = {
@@ -645,6 +645,8 @@ let
 
       SYSVIPC            = yes;  # System-V IPC
 
+      AIO                = yes;  # POSIX asynchronous I/O
+
       UNIX               = yes;  # Unix domain sockets.
 
       MD                 = yes;     # Device mapper (RAID, LVM, etc.)
diff --git a/pkgs/os-specific/linux/kernel/linux-rpi.nix b/pkgs/os-specific/linux/kernel/linux-rpi.nix
index 31a2cc2aa157..a3d2bfd4836c 100644
--- a/pkgs/os-specific/linux/kernel/linux-rpi.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rpi.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, buildPackages, fetchFromGitHub, perl, buildLinux, rpiVersion, ... } @ args:
 
 let
-  modDirVersion = "4.19.75";
-  tag = "1.20190925";
+  modDirVersion = "4.19.118";
+  tag = "1.20200601";
 in
 lib.overrideDerivation (buildLinux (args // {
   version = "${modDirVersion}-${tag}";
@@ -12,7 +12,7 @@ lib.overrideDerivation (buildLinux (args // {
     owner = "raspberrypi";
     repo = "linux";
     rev = "raspberrypi-kernel_${tag}-1";
-    sha256 = "0l91kb4jjxg4fcp7d2aqm1fj34ns137rys93k907mdgnarcliafs";
+    sha256 = "11jzsmnd1qry2ir9vmsv0nfdzjpgkn5yab5ylxcz406plc073anp";
   };
 
   defconfig = {
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index f2f0fac3b7dd..2a7a1fa93425 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,15 +3,15 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.7-rc6";
-  extraMeta.branch = "5.7";
+  version = "5.8-rc1";
+  extraMeta.branch = "5.1";
 
   # modDirVersion needs to be x.y.z, will always add .0
   modDirVersion = if (modDirVersionArg == null) then builtins.replaceStrings ["-"] [".0-"] version else modDirVersionArg;
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "0g04zwdxks7pa5q6shl5xl2rml1w95rxq7sqkkadj11mpk2k89w4";
+    sha256 = "1gb7g2vrgg0zz281lv1ir1r0535spc40j65p0azmdxlk24fkfxfc";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/os-specific/linux/microcode/intel.nix b/pkgs/os-specific/linux/microcode/intel.nix
index c0201fb01fd4..475288a0b6f6 100644
--- a/pkgs/os-specific/linux/microcode/intel.nix
+++ b/pkgs/os-specific/linux/microcode/intel.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "microcode-intel";
-  version = "20200520";
+  version = "20200616";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "Intel-Linux-Processor-Microcode-Data-Files";
     rev = "microcode-${version}";
-    sha256 = "1cs4b7q9j2lw2y09rfa82aijbfmy4lddahz8qlz9gwajf2ziqns8";
+    sha256 = "13jrs8hwh7dhjjb9kncb8lk199afaxglkh1cfisl6zca1h36g563";
   };
 
   nativeBuildInputs = [ iucode-tool libarchive ];
diff --git a/pkgs/os-specific/linux/nvme-cli/default.nix b/pkgs/os-specific/linux/nvme-cli/default.nix
index c05adb33eca1..80a00082b81a 100644
--- a/pkgs/os-specific/linux/nvme-cli/default.nix
+++ b/pkgs/os-specific/linux/nvme-cli/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nvme-cli";
-  version = "1.11.2";
+  version = "1.12";
 
   src = fetchFromGitHub {
     owner = "linux-nvme";
     repo = "nvme-cli";
     rev = "v${version}";
-    sha256 = "0ngh7zffjf6ac8b22hdi4ry7hjlafih172hrbpw8j17r7c0wjy9i";
+    sha256 = "0ldky34sn0m5c4hgiip0fkzm465nca69bhxicpd5dg8wxhzxqrp3";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/os-specific/linux/wireguard/default.nix b/pkgs/os-specific/linux/wireguard/default.nix
index 4617db5e7671..6af465da4731 100644
--- a/pkgs/os-specific/linux/wireguard/default.nix
+++ b/pkgs/os-specific/linux/wireguard/default.nix
@@ -7,11 +7,11 @@ assert stdenv.lib.versionOlder kernel.version "5.6";
 
 stdenv.mkDerivation rec {
   pname = "wireguard";
-  version = "1.0.20200520";
+  version = "1.0.20200611";
 
   src = fetchzip {
     url = "https://git.zx2c4.com/wireguard-linux-compat/snapshot/wireguard-linux-compat-${version}.tar.xz";
-    sha256 = "1zggpm0zh6m30b9mchj3bg3z721k346r5m5a130inp779s4xm0sm";
+    sha256 = "0a8xsjxp8krmm2px07x9qw8nhvp5ispf4mnc6k59p0qp26qbva5d";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/servers/adguardhome/default.nix b/pkgs/servers/adguardhome/default.nix
new file mode 100644
index 000000000000..54000a81b67d
--- /dev/null
+++ b/pkgs/servers/adguardhome/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "adguardhome";
+  version = "0.101.0";
+
+  src = fetchurl {
+    url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v${version}/AdGuardHome_linux_amd64.tar.gz";
+    sha256 = "17k37hh04zhy5csl0p9g4hybfc403i38n754in1xrkzxi81r8dh5";
+  };
+
+  installPhase = ''
+    install -m755 -D ./AdGuardHome $out/bin/adguardhome
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/AdguardTeam/AdGuardHome";
+    description = "Network-wide ads & trackers blocking DNS server";
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ numkem ];
+  };
+}
diff --git a/pkgs/servers/blockbook/default.nix b/pkgs/servers/blockbook/default.nix
index 627ac42efd20..4afabb858c38 100644
--- a/pkgs/servers/blockbook/default.nix
+++ b/pkgs/servers/blockbook/default.nix
@@ -14,14 +14,14 @@
 
 buildGoModule rec {
   pname = "blockbook";
-  version = "0.3.3";
-  commit = "b6961ca";
+  version = "0.3.4";
+  commit = "eb4e10a";
 
   src = fetchFromGitHub {
     owner = "trezor";
     repo = "blockbook";
     rev = "v${version}";
-    sha256 = "01nb4if2dix2h95xvqvafil325jjw2a4v1izb9mad0cjqcf8rk6n";
+    sha256 = "0da1kav5x2xcmwvdgfk1q70l1k0sqqj3njgx2xx885d40m6qbnrs";
   };
 
   vendorSha256 = "1qjlvhizl8cy06cgf4phia70bgbm4lj57z5z2gyr8aglx98bnpdn";
diff --git a/pkgs/servers/consul/default.nix b/pkgs/servers/consul/default.nix
index a702626e1c14..d550a5cb699e 100644
--- a/pkgs/servers/consul/default.nix
+++ b/pkgs/servers/consul/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "consul";
-  version = "1.7.3";
+  version = "1.7.4";
   rev = "v${version}";
 
   # Note: Currently only release tags are supported, because they have the Consul UI
@@ -17,7 +17,7 @@ buildGoModule rec {
     owner = "hashicorp";
     repo = pname;
     inherit rev;
-    sha256 = "05p893mfdrlf5fy9ywwnqb7blw1ffidgviyyh6a3bp82wk49f8ph";
+    sha256 = "0yx0ry8gwgvw1mkz3nv4rn2pwslm0q7jxlk70gaw6386mxxmj0sk";
   };
 
   passthru.tests.consul = nixosTests.consul;
diff --git a/pkgs/servers/dns/bind/default.nix b/pkgs/servers/dns/bind/default.nix
index a7581ccbb119..2aae5634cc5e 100644
--- a/pkgs/servers/dns/bind/default.nix
+++ b/pkgs/servers/dns/bind/default.nix
@@ -54,7 +54,8 @@ stdenv.mkDerivation rec {
     "--without-eddsa"
     "--with-aes"
   ] ++ lib.optional stdenv.isLinux "--with-libcap=${libcap.dev}"
-    ++ lib.optional enableSeccomp "--enable-seccomp";
+    ++ lib.optional enableSeccomp "--enable-seccomp"
+    ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "BUILD_CC=$(CC_FOR_BUILD)";
 
   postInstall = ''
     moveToOutput bin/bind9-config $dev
diff --git a/pkgs/servers/http/webhook/default.nix b/pkgs/servers/http/webhook/default.nix
index d40adb171a63..fe428926704e 100644
--- a/pkgs/servers/http/webhook/default.nix
+++ b/pkgs/servers/http/webhook/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "webhook";
-  version = "2.6.8";
+  version = "2.7.0";
 
   goPackagePath = "github.com/adnanh/webhook";
   excludedPackages = [ "test" ];
@@ -11,7 +11,7 @@ buildGoPackage rec {
     owner = "adnanh";
     repo = "webhook";
     rev = version;
-    sha256 = "05q6nv04ml1gr4k79czg03i3ifl05xq29iapkgrl3k0a36czxlgs";
+    sha256 = "1spiqjy0z84z96arf57bn6hyvfsd6l8w6nv874mbis6vagifikci";
   };
 
   meta = with lib; {
diff --git a/pkgs/servers/icingaweb2/default.nix b/pkgs/servers/icingaweb2/default.nix
index c4aaedf4ab67..a35b54592721 100644
--- a/pkgs/servers/icingaweb2/default.nix
+++ b/pkgs/servers/icingaweb2/default.nix
@@ -1,12 +1,12 @@
 { stdenv, lib, fetchFromGitHub, makeWrapper, php }: with lib; stdenv.mkDerivation rec {
   pname = "icingaweb2";
-  version = "2.7.3";
+  version = "2.8.0";
 
   src = fetchFromGitHub {
     owner = "Icinga";
     repo = "icingaweb2";
     rev = "v${version}";
-    sha256 = "1qdsrpk6jbq9b4v4f2lfpdqs1yh3irbsm5fx02wxnnwvad05bcfv";
+    sha256 = "18q3d15w7d46g4vyq4iph5c1bbxcl8ikcdc8djrfi30wx36ziybs";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/mail/dovecot/plugins/fts_xapian/default.nix b/pkgs/servers/mail/dovecot/plugins/fts_xapian/default.nix
new file mode 100644
index 000000000000..8a0f2d4efab2
--- /dev/null
+++ b/pkgs/servers/mail/dovecot/plugins/fts_xapian/default.nix
@@ -0,0 +1,35 @@
+{ stdenv, fetchFromGitHub, autoconf, automake, pkg-config, dovecot, libtool, xapian, icu64, sqlite }:
+stdenv.mkDerivation {
+  pname = "fts-xapian";
+  version = "1.3.1";
+
+  src = fetchFromGitHub {
+    owner = "grosjo";
+    repo = "fts-xapian";
+    rev = "1.3.1";
+    sha256 = "10yl5fyfbx2ijqckx13vbmzj9mpm5pkh8qzichbdgplrzm738q43";
+  };
+
+  buildInputs = [ dovecot xapian icu64 sqlite ];
+
+  nativeBuildInputs = [ autoconf automake libtool pkg-config ];
+
+  preConfigure = ''
+    export PANDOC=false
+    autoreconf -vi
+  '';
+
+  configureFlags = [
+    "--with-dovecot=${dovecot}/lib/dovecot"
+    "--without-dovecot-install-dirs"
+    "--with-moduledir=$(out)/lib/dovecot"
+  ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/grosjo/fts-xapian";
+    description = "Dovecot FTS plugin based on Xapian";
+    license = licenses.lgpl21;
+    maintainers = with maintainers; [ julm ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/servers/mail/postfix/default.nix b/pkgs/servers/mail/postfix/default.nix
index 3b14fab68753..585a6196831b 100644
--- a/pkgs/servers/mail/postfix/default.nix
+++ b/pkgs/servers/mail/postfix/default.nix
@@ -26,11 +26,11 @@ in stdenv.mkDerivation rec {
 
   pname = "postfix";
 
-  version = "3.5.2";
+  version = "3.5.3";
 
   src = fetchurl {
     url = "ftp://ftp.cs.uu.nl/mirror/postfix/postfix-release/official/${pname}-${version}.tar.gz";
-    sha256 = "1hxy9458apnzfg4n0alncsdgy5dwzn5dbn4xm46iv15xynbj9gz3";
+    sha256 = "0xcd9pmv2p4znn6bqvka19h5h2lw90inyxrm5020acd0yaf0i0g3";
   };
 
   nativeBuildInputs = [ makeWrapper m4 ];
diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index 15df735b7072..fbcec04e5320 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -9,11 +9,11 @@ let
 in
 buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.14.0";
+  version = "1.15.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "09drdqcjvpk9s3hq5rx9yxsxq0wak5fg5gfaiqfnbnxav2c2v7kq";
+    sha256 = "1hfyqp5bzsqp002synxp9jcm9fwzw9p0gcklmycmv616x3flylkf";
   };
 
   patches = [
@@ -58,6 +58,7 @@ buildPythonApplication rec {
     unpaddedbase64
     typing-extensions
     authlib
+    pyjwt
   ] ++ lib.optional enableSystemd systemd;
 
   checkInputs = [ mock parameterized openssl ];
@@ -76,6 +77,6 @@ buildPythonApplication rec {
     homepage = "https://matrix.org";
     description = "Matrix reference homeserver";
     license = licenses.asl20;
-    maintainers = with maintainers; [ ralith roblabla ekleog pacien ma27 ];
+    maintainers = teams.matrix.members;
   };
 }
diff --git a/pkgs/servers/mattermost/matterircd.nix b/pkgs/servers/mattermost/matterircd.nix
index bb6d1584a670..d644e985db5a 100644
--- a/pkgs/servers/mattermost/matterircd.nix
+++ b/pkgs/servers/mattermost/matterircd.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "matterircd";
-  version = "0.18.2";
+  version = "0.19.4";
 
   src = fetchFromGitHub {
     owner = "42wim";
     repo = "matterircd";
     rev = "v${version}";
-    sha256 = "0g57g91v7208yynf758k9v73jdhz4fbc1v23p97rzrl97aq0rd5r";
+    sha256 = "1kwyk6gy4d4v2rzyr7vwvi8vm69rz1hdn0gkpan2kh1p63z77gbv";
   };
 
   goPackagePath = "github.com/42wim/matterircd";
diff --git a/pkgs/servers/monitoring/kapacitor/default.nix b/pkgs/servers/monitoring/kapacitor/default.nix
index 93f0531887c1..6f2e51fffd61 100644
--- a/pkgs/servers/monitoring/kapacitor/default.nix
+++ b/pkgs/servers/monitoring/kapacitor/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "kapacitor";
-  version = "1.5.4";
+  version = "1.5.5";
 
   goPackagePath = "github.com/influxdata/kapacitor";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "influxdata";
     repo = "kapacitor";
     rev = "v${version}";
-    sha256 = "1sd0gwqwa2bk81lshs8cy49mk1nh4azjkk0283rh0rkimy90l0zz";
+    sha256 = "17zk7fs6yl5hmhr3inwkafwmg2ihaicj43gdi5888dinhpa9bij1";
   };
 
   meta = with lib; {
diff --git a/pkgs/servers/monitoring/munin/default.nix b/pkgs/servers/monitoring/munin/default.nix
index ecbed520bbdc..22828e574497 100644
--- a/pkgs/servers/monitoring/munin/default.nix
+++ b/pkgs/servers/monitoring/munin/default.nix
@@ -3,14 +3,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "2.0.61";
+  version = "2.0.63";
   pname = "munin";
 
   src = fetchFromGitHub {
     owner = "munin-monitoring";
     repo = "munin";
     rev = version;
-    sha256 = "0gjbz8zdj1rdx2azgpdh64isna0l77wm42gr1jhwb5an3lf6sgxs";
+    sha256 = "0p1gzy6in15d6596b260qa0a144x8n8567cxdq0x4arw18004s3a";
   };
 
   buildInputs = [
diff --git a/pkgs/servers/monitoring/prometheus/alertmanager.nix b/pkgs/servers/monitoring/prometheus/alertmanager.nix
index 9402fa44eed2..f5c7c062c878 100644
--- a/pkgs/servers/monitoring/prometheus/alertmanager.nix
+++ b/pkgs/servers/monitoring/prometheus/alertmanager.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "alertmanager";
-  version = "0.20.0";
+  version = "0.21.0";
   rev = "v${version}";
 
   goPackagePath = "github.com/prometheus/alertmanager";
@@ -11,7 +11,7 @@ buildGoPackage rec {
     inherit rev;
     owner = "prometheus";
     repo = "alertmanager";
-    sha256 = "1bq6vbpy25k7apvs2ga3fbp1cbnv9j0y1g1khvz2qgz6a2zvhgg3";
+    sha256 = "0zrzyaqs73pz4rmj4xaj15x4n1542m0nb7jqm2j77k07j75r5w41";
   };
 
   buildFlagsArray = let t = "${goPackagePath}/vendor/github.com/prometheus/common/version"; in ''
@@ -35,7 +35,7 @@ buildGoPackage rec {
     description = "Alert dispatcher for the Prometheus monitoring system";
     homepage = "https://github.com/prometheus/alertmanager";
     license = licenses.asl20;
-    maintainers = with maintainers; [ benley fpletz globin ];
+    maintainers = with maintainers; [ benley fpletz globin Frostman ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/servers/monitoring/prometheus/mysqld-exporter.nix b/pkgs/servers/monitoring/prometheus/mysqld-exporter.nix
index 3ef947b28738..8787a39de32a 100644
--- a/pkgs/servers/monitoring/prometheus/mysqld-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/mysqld-exporter.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "mysqld_exporter";
-  version = "0.11.0";
+  version = "0.12.1";
   rev = "v${version}";
 
   goPackagePath = "github.com/prometheus/mysqld_exporter";
@@ -11,7 +11,7 @@ buildGoPackage rec {
     inherit rev;
     owner = "prometheus";
     repo = "mysqld_exporter";
-    sha256 = "1684jf96dy5bs0y0689vlcw82lqw8kw2phlnp6pq1cq56fcwdxjn";
+    sha256 = "0nzbfzx4dzs3cagdid1fqddrqimgr8x6r8gmmxglrss05c8srgs8";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/servers/monitoring/prometheus/node-exporter.nix b/pkgs/servers/monitoring/prometheus/node-exporter.nix
index ba10cfa1485a..8d5134437d98 100644
--- a/pkgs/servers/monitoring/prometheus/node-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/node-exporter.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "node_exporter";
-  version = "1.0.0";
+  version = "1.0.1";
   rev = "v${version}";
 
   goPackagePath = "github.com/prometheus/node_exporter";
@@ -11,7 +11,7 @@ buildGoPackage rec {
     inherit rev;
     owner = "prometheus";
     repo = "node_exporter";
-    sha256 = "12v7vaknvll3g1n7730miwxiwz8nbjq8y18lzljq9d9s8apcy32f";
+    sha256 = "1r0xx81r9v019fl0iv078yl21ndhb356y7s7zx171zi02k7a4p2l";
   };
 
   # FIXME: tests fail due to read-only nix store
diff --git a/pkgs/servers/monitoring/telegraf/default.nix b/pkgs/servers/monitoring/telegraf/default.nix
index adc42173f8e5..388d7fe37908 100644
--- a/pkgs/servers/monitoring/telegraf/default.nix
+++ b/pkgs/servers/monitoring/telegraf/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "telegraf";
-  version = "1.14.3";
+  version = "1.14.4";
 
   goPackagePath = "github.com/influxdata/telegraf";
 
@@ -14,7 +14,7 @@ buildGoModule rec {
     owner = "influxdata";
     repo = "telegraf";
     rev = "v${version}";
-    sha256 = "11rd54brdbxb5ari6zan7gyr0fa1m0rmwcn5a8h8dla3xprw30wp";
+    sha256 = "0kbf1r9b9xylq0akmklzy94pcljayhdjm539fwazp5c1364qmbjm";
   };
 
   vendorSha256 = "05nj99hl5f5l0a2aswy19wmbm94hd1h03r227gmn419dkzc5hpah";
diff --git a/pkgs/servers/mqtt/mosquitto/default.nix b/pkgs/servers/mqtt/mosquitto/default.nix
index b52cfb09d4f1..8f632ed9b58f 100644
--- a/pkgs/servers/mqtt/mosquitto/default.nix
+++ b/pkgs/servers/mqtt/mosquitto/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mosquitto";
-  version = "1.6.8";
+  version = "1.6.10";
 
   src = fetchFromGitHub {
     owner  = "eclipse";
     repo   = "mosquitto";
     rev    = "v${version}";
-    sha256 = "1py13vg3vwwwg6jdnmq46z6rlzb84r4ggqsmsrn4yar5hrw9pa90";
+    sha256 = "0g9iywm0s08b0ax1qx4j5lixfc1m6p48lv14vlil6wns4azc3fsc";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/nats-server/default.nix b/pkgs/servers/nats-server/default.nix
index 3685589fa70a..743fc0fa1e56 100644
--- a/pkgs/servers/nats-server/default.nix
+++ b/pkgs/servers/nats-server/default.nix
@@ -4,7 +4,7 @@ with lib;
 
 buildGoPackage rec {
   pname   = "nats-server";
-  version = "2.1.0";
+  version = "2.1.7";
 
   goPackagePath = "github.com/nats-io/${pname}";
 
@@ -12,7 +12,7 @@ buildGoPackage rec {
     rev    = "v${version}";
     owner  = "nats-io";
     repo   = pname;
-    sha256 = "1zp43v69cawbp6bpby1vx51z6nyv8gxnnl2qkhwr9zrgnhlcflnl";
+    sha256 = "08wqaqar964p9adc0ma8dqg0rf88rylk1m2mddlbbqmd6l4h6m27";
   };
 
   meta = {
diff --git a/pkgs/servers/sql/postgresql/ext/pg_ed25519.nix b/pkgs/servers/sql/postgresql/ext/pg_ed25519.nix
new file mode 100644
index 000000000000..95d45b2663d9
--- /dev/null
+++ b/pkgs/servers/sql/postgresql/ext/pg_ed25519.nix
@@ -0,0 +1,31 @@
+{ stdenv, fetchurl, postgresql }:
+
+stdenv.mkDerivation rec {
+  pname = "pg_ed25519";
+  version = "0.2";
+
+  src = fetchurl {
+    url = "https://gitlab.com/dwagin/${pname}/-/archive/${version}/${pname}-${version}.tar.bz2";
+    sha256 = "0q46pvk1vq5w3al6i3inzlw6w7za3n7p1gd4wfbbxzvzh7qnynda";
+  };
+
+  buildInputs = [ postgresql ];
+
+  installPhase = ''
+    mkdir -p $out/bin    # For buildEnv to setup proper symlinks. See #22653
+    mkdir -p $out/{lib,share/postgresql/extension}
+
+    cp *.so      $out/lib
+    cp *.sql     $out/share/postgresql/extension
+    cp *.control $out/share/postgresql/extension
+  '';
+
+  meta = with stdenv.lib; {
+    description = "PostgreSQL extension for signing and verifying ed25519 signatures";
+    homepage = "https://gitlab.com/dwagin/pg_ed25519";
+    maintainers = [ maintainers.renzo ];
+    platforms = postgresql.meta.platforms;
+    license = licenses.mit;
+  };
+}
+
diff --git a/pkgs/servers/sql/postgresql/packages.nix b/pkgs/servers/sql/postgresql/packages.nix
index 15735a82c52e..d4dafe7ddb14 100644
--- a/pkgs/servers/sql/postgresql/packages.nix
+++ b/pkgs/servers/sql/postgresql/packages.nix
@@ -13,6 +13,8 @@ self: super: {
 
     pg_bigm = super.callPackage ./ext/pg_bigm.nix { };
 
+    pg_ed25519 = super.callPackage ./ext/pg_ed25519.nix { };
+
     pg_repack = super.callPackage ./ext/pg_repack.nix { };
 
     pg_similarity = super.callPackage ./ext/pg_similarity.nix { };
diff --git a/pkgs/servers/web-apps/searx/default.nix b/pkgs/servers/web-apps/searx/default.nix
index d0ff13917969..bcfa8a410219 100644
--- a/pkgs/servers/web-apps/searx/default.nix
+++ b/pkgs/servers/web-apps/searx/default.nix
@@ -25,7 +25,8 @@ buildPythonApplication rec {
       --replace 'pygments==2.1.3' 'pygments>=2.1,<3.0' \
       --replace 'pyopenssl==19.0.0' 'pyopenssl' \
       --replace 'python-dateutil==2.8.0' 'python-dateutil==2.8.*' \
-      --replace 'pyyaml==5.1' 'pyyaml'
+      --replace 'pyyaml==5.1' 'pyyaml' \
+      --replace 'requests[socks]==2.22.0' 'requests[socks]'
     substituteInPlace requirements-dev.txt \
       --replace 'plone.testing==5.0.0' 'plone.testing' \
       --replace 'pep8==1.7.0' 'pep8==1.7.*' \
diff --git a/pkgs/shells/fish/default.nix b/pkgs/shells/fish/default.nix
index 11d9e48008fa..420aac7607e4 100644
--- a/pkgs/shells/fish/default.nix
+++ b/pkgs/shells/fish/default.nix
@@ -125,6 +125,10 @@ let
       pcre2
     ];
 
+    cmakeFlags = [
+      "-DCMAKE_INSTALL_DOCDIR=${placeholder "out"}/share/doc/fish"
+    ];
+
     preConfigure = ''
       patchShebangs ./build_tools/git_version_gen.sh
     '';
diff --git a/pkgs/shells/zsh/grml-zsh-config/default.nix b/pkgs/shells/zsh/grml-zsh-config/default.nix
index 3a34be6304b7..4a287e084449 100644
--- a/pkgs/shells/zsh/grml-zsh-config/default.nix
+++ b/pkgs/shells/zsh/grml-zsh-config/default.nix
@@ -5,13 +5,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "grml-zsh-config";
-  version = "0.16.2";
+  version = "0.17.2";
 
   src = fetchFromGitHub {
     owner = "grml";
     repo = "grml-etc-core";
     rev = "v${version}";
-    sha256 = "08a63cdjpbvgnja0637zbm8qif4qn8ydgkwcfq3145bxfh5rq8wz";
+    sha256 = "1h17xdlxhnjqirqwksi8qhx2lyajz7b0hmvb80i7313splhjp6hn";
   };
 
   buildInputs = [ zsh coreutils txt2tags procps ]
diff --git a/pkgs/shells/zsh/oh-my-zsh/default.nix b/pkgs/shells/zsh/oh-my-zsh/default.nix
index a062b346fda0..6896904ec9a4 100644
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@@ -4,13 +4,13 @@
 { stdenv, fetchgit }:
 
 stdenv.mkDerivation rec {
-  version = "2020-06-10";
+  version = "2020-06-17";
   pname = "oh-my-zsh";
-  rev = "db94f60d342ba2be7dbe3bfd86f4edb335c2a6a7";
+  rev = "d47447a5e63715ae6ab6c2f46924dc8766c8e746";
 
   src = fetchgit { inherit rev;
     url = "https://github.com/ohmyzsh/ohmyzsh";
-    sha256 = "14zvbnrnkcmqnjbw71j4jgfm7gkrgpchkfrpdw006q25gqxj0bgm";
+    sha256 = "1hfinbmwwinvqnv3ldcja8gqh9n6ll6749055vk8icdixa9jwcyl";
   };
 
   pathsToLink = [ "/share/oh-my-zsh" ];
diff --git a/pkgs/tools/X11/ckbcomp/default.nix b/pkgs/tools/X11/ckbcomp/default.nix
index dc665bf9c41b..74a6777d9491 100644
--- a/pkgs/tools/X11/ckbcomp/default.nix
+++ b/pkgs/tools/X11/ckbcomp/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ckbcomp";
-  version = "1.194";
+  version = "1.195";
 
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
     owner = "installer-team";
     repo = "console-setup";
     rev = version;
-    sha256 = "0fkabv05j5dj10mfrpjyvv7lnxl9qaqkbjhwj72r18i9i4019vgh";
+    sha256 = "0d0xagigs5k3appzz5lzxdjncvnkgz4amz6ks7imiq8kkjixvmfy";
   };
 
   buildInputs = [ perl ];
diff --git a/pkgs/tools/X11/xdg-utils/default.nix b/pkgs/tools/X11/xdg-utils/default.nix
index 64b205bada58..ccea6a2233cc 100644
--- a/pkgs/tools/X11/xdg-utils/default.nix
+++ b/pkgs/tools/X11/xdg-utils/default.nix
@@ -46,6 +46,7 @@ stdenv.mkDerivation rec {
     xset()  { ${xset}/bin/xset      "$@"; }\
     perl()  { PERL5LIB=${perlPath} ${perlPackages.perl}/bin/perl "$@"; }\
     mimetype() { ${perlPackages.FileMimeInfo}/bin/mimetype "$@"; }\
+    PATH=$PATH:'"$out"'/bin\
     &#' -i "$out"/bin/*
 
     substituteInPlace $out/bin/xdg-open \
diff --git a/pkgs/tools/X11/xpra/default.nix b/pkgs/tools/X11/xpra/default.nix
index 91a58438c17d..6fe433daf8b9 100644
--- a/pkgs/tools/X11/xpra/default.nix
+++ b/pkgs/tools/X11/xpra/default.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, fetchurl, callPackage, substituteAll, python3, pkgconfig, writeText
 , xorg, gtk3, glib, pango, cairo, gdk-pixbuf, atk
 , wrapGAppsHook, xorgserver, getopt, xauth, utillinux, which
-, ffmpeg_4, x264, libvpx, libwebp, x265
+, ffmpeg, x264, libvpx, libwebp, x265
 , libfakeXinerama
 , gst_all_1, pulseaudio, gobject-introspection
 , pam }:
@@ -60,7 +60,7 @@ in buildPythonApplication rec {
 
     pango cairo gdk-pixbuf atk.out gtk3 glib
 
-    ffmpeg_4 libvpx x264 libwebp x265
+    ffmpeg libvpx x264 libwebp x265
 
     gst_all_1.gstreamer
     gst_all_1.gst-plugins-base
diff --git a/pkgs/tools/audio/video2midi/default.nix b/pkgs/tools/audio/video2midi/default.nix
index dca8a0610da8..cf9297119e9f 100644
--- a/pkgs/tools/audio/video2midi/default.nix
+++ b/pkgs/tools/audio/video2midi/default.nix
@@ -8,7 +8,7 @@ let
   });
 in pythonPackages.buildPythonApplication rec {
   pname = "video2midi";
-  version = "0.4.0.1";
+  version = "0.4.0.2";
 
   format = "other";
 
@@ -16,7 +16,7 @@ in pythonPackages.buildPythonApplication rec {
     owner = "svsdval";
     repo = pname;
     rev = version;
-    sha256 = "1869w60kprjdikqk4iwx058zri2jg4aznzlg668w9myka4mp01r9";
+    sha256 = "174ijn8bc306529scd23szvgx1apanm2qmwk4lwmi64rhkm6dapx";
   };
 
   propagatedBuildInputs = with pythonPackages; [ opencv3_ midiutil pygame pyopengl ];
diff --git a/pkgs/tools/backup/bacula/default.nix b/pkgs/tools/backup/bacula/default.nix
index a9fd2f19b897..8bf253a7b121 100644
--- a/pkgs/tools/backup/bacula/default.nix
+++ b/pkgs/tools/backup/bacula/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, sqlite, postgresql, zlib, acl, ncurses, openssl, readline }:
 
 stdenv.mkDerivation rec {
-  name = "bacula-9.6.3";
+  name = "bacula-9.6.5";
 
   src = fetchurl {
     url    = "mirror://sourceforge/bacula/${name}.tar.gz";
-    sha256 = "02jvijwfw8nqrq61pyr5b9d5zjpmrsimkg6dq42rbd71g2k6a4zc";
+    sha256 = "0yn7qwkzix78bs811vmrn5gbywy7ggnsv72mdjz2lirqc6w3a3si";
   };
 
   buildInputs = [ postgresql sqlite zlib ncurses openssl readline ]
diff --git a/pkgs/tools/filesystems/bees/default.nix b/pkgs/tools/filesystems/bees/default.nix
index c6bb07e7b87d..e87cecbf8fd3 100644
--- a/pkgs/tools/filesystems/bees/default.nix
+++ b/pkgs/tools/filesystems/bees/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, runCommand, fetchFromGitHub, bash, btrfs-progs, coreutils, pythonPackages, utillinux }:
+{ stdenv, runCommand, fetchFromGitHub, bash, btrfs-progs, coreutils, python3Packages, utillinux }:
 
 let
 
@@ -22,7 +22,7 @@ let
     ];
 
     nativeBuildInputs = [
-      pythonPackages.markdown   # documentation build
+      python3Packages.markdown   # documentation build
     ];
 
     preBuild = ''
diff --git a/pkgs/tools/filesystems/convoy/default.nix b/pkgs/tools/filesystems/convoy/default.nix
index 77d6dca066a4..f12187be810f 100644
--- a/pkgs/tools/filesystems/convoy/default.nix
+++ b/pkgs/tools/filesystems/convoy/default.nix
@@ -3,7 +3,7 @@
 
 buildGoPackage rec {
   pname = "convoy";
-  version = "0.5.0";
+  version = "0.5.2";
 
   goPackagePath = "github.com/rancher/convoy";
 
@@ -11,7 +11,7 @@ buildGoPackage rec {
     rev = "v${version}";
     owner = "rancher";
     repo = "convoy";
-    sha256 = "0ihy0cfq7sa2wml904ajwr165hx2mas3jb1bqk3i0m4fg1lx1xw1";
+    sha256 = "09nygrxd5hril4xcfsvgjg74xxhhimznqq4sdk0f360c5ra0dbhj";
   };
 
   buildInputs = [lvm2];
diff --git a/pkgs/tools/graphics/luxcorerender/default.nix b/pkgs/tools/graphics/luxcorerender/default.nix
index fc8a98c19930..3afb6ebd9877 100644
--- a/pkgs/tools/graphics/luxcorerender/default.nix
+++ b/pkgs/tools/graphics/luxcorerender/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, boost165, pkgconfig, python35
+{ stdenv, fetchFromGitHub, cmake, boost165, pkgconfig, python36
 , tbb, openimageio, libjpeg, libpng, zlib, libtiff, ilmbase
 , freetype, openexr, libXdmcp, libxkbcommon, epoxy, at-spi2-core
 , dbus, doxygen, qt5, c-blosc, libGLU, gnome3, dconf, gtk3, pcre
@@ -7,28 +7,34 @@
 , withOpenCL ? true , opencl-headers, ocl-icd, opencl-clhpp
 }:
 
-let boost_static = boost165.override {
-      python = python35;
+let
+      python = python36;
+
+      boost_static = boost165.override {
+      inherit python;
       enableStatic = true;
       enablePython = true;
     };
 
+    version = "2.0";
+    sha256 = "15nn39ybsfjf3cw3xgkbarvxn4a9ymfd579ankm7yjxkw5gcif38";
+
 in stdenv.mkDerivation {
   pname = "luxcorerender";
-  version = "2.0";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "LuxCoreRender";
     repo = "LuxCore";
-    rev = "luxcorerender_v2.0";
-    sha256 = "15nn39ybsfjf3cw3xgkbarvxn4a9ymfd579ankm7yjxkw5gcif38";
+    rev = "luxcorerender_v${version}";
+    inherit sha256;
   };
 
   buildInputs =
    [ embree2 pkgconfig cmake zlib boost_static libjpeg
      libtiff libpng ilmbase freetype openexr openimageio
      tbb qt5.full c-blosc libGLU pcre bison
-     flex libX11 libpthreadstubs python35 libXdmcp libxkbcommon
+     flex libX11 libpthreadstubs python libXdmcp libxkbcommon
      epoxy at-spi2-core dbus doxygen
      # needed for GSETTINGS_SCHEMAS_PATH
      gsettings-desktop-schemas glib gtk3
@@ -43,15 +49,15 @@ in stdenv.mkDerivation {
     "-DOpenEXR_IlmThread_INCLUDE_DIR=${ilmbase.dev}/include/OpenEXR"
     "-DOpenEXR_Imath_INCLUDE_DIR=${openexr.dev}/include/OpenEXR"
     "-DOpenEXR_half_INCLUDE_DIR=${ilmbase.dev}/include"
-    "-DPYTHON_LIBRARY=${python35}/lib/libpython3.so"
-    "-DPYTHON_INCLUDE_DIR=${python35}/include/python3.5"
+    "-DPYTHON_LIBRARY=${python}/lib/libpython3.so"
+    "-DPYTHON_INCLUDE_DIR=${python}/include/python${python.pythonVersion}"
     "-DEMBREE_INCLUDE_PATH=${embree2}/include"
     "-DEMBREE_LIBRARY=${embree2}/lib/libembree.so"
     "-DBoost_PYTHON_LIBRARY_RELEASE=${boost_static}/lib/libboost_python3-mt.so"
   ] ++ stdenv.lib.optional withOpenCL
        "-DOPENCL_INCLUDE_DIR=${opencl-headers}/include";
   preConfigure = ''
-    NIX_CFLAGS_COMPILE+=" -isystem ${python35}/include/python3.5"
+    NIX_CFLAGS_COMPILE+=" -isystem ${python}/include/python${python.pythonVersion}"
     NIX_LDFLAGS+=" -lpython3"
   '';
 
diff --git a/pkgs/tools/graphics/wkhtmltopdf/default.nix b/pkgs/tools/graphics/wkhtmltopdf/default.nix
index ee083c3e301b..093ab9ad5c43 100644
--- a/pkgs/tools/graphics/wkhtmltopdf/default.nix
+++ b/pkgs/tools/graphics/wkhtmltopdf/default.nix
@@ -3,14 +3,14 @@
 , openssl, libX11, libXext, libXrender }:
 
 mkDerivation rec {
-  version = "0.12.5";
+  version = "0.12.6";
   pname = "wkhtmltopdf";
 
   src = fetchFromGitHub {
     owner  = "wkhtmltopdf";
     repo   = "wkhtmltopdf";
     rev    = version;
-    sha256 = "0i6b6z3f4szspbbi23qr3hv22j9bhmcj7c1jizr7y0ra43mrgws1";
+    sha256 = "0m2zy986kzcpg0g3bvvm815ap9n5ann5f6bdy7pfj6jv482bm5mg";
   };
 
   buildInputs = [
diff --git a/pkgs/tools/inputmethods/interception-tools/default.nix b/pkgs/tools/inputmethods/interception-tools/default.nix
index a6aed47d964c..39a28214fe20 100644
--- a/pkgs/tools/inputmethods/interception-tools/default.nix
+++ b/pkgs/tools/inputmethods/interception-tools/default.nix
@@ -2,14 +2,14 @@
   libevdev, udev }:
 
 let
-  version = "0.1.1";
+  version = "0.2.1";
   baseName = "interception-tools";
 in stdenv.mkDerivation {
   name = "${baseName}-${version}";
 
   src = fetchurl {
     url = "https://gitlab.com/interception/linux/tools/repository/v${version}/archive.tar.gz";
-    sha256 = "14g4pphvylqdb922va322z1pbp12ap753hcf7zf9sii1ikvif83j";
+    sha256 = "0lqz89wsf9r5xdgflincysxg4l8fpgg5z8zczhhrg9s5787srfzi";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
diff --git a/pkgs/tools/misc/bdf2sfd/default.nix b/pkgs/tools/misc/bdf2sfd/default.nix
index 15154f73a699..ca67525bb8c4 100644
--- a/pkgs/tools/misc/bdf2sfd/default.nix
+++ b/pkgs/tools/misc/bdf2sfd/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bdf2sfd";
-  version = "1.1.1";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "fcambus";
     repo = pname;
     rev = version;
-    sha256 = "02dzvrgwpgbd0wgfnlpiv2qlwvspwl7a0qh8cg363lpnxv8akw9q";
+    sha256 = "1fhdl739a4v8296wpn2390fhlb6vlg9m1zik7mql4l9008ncd5mv";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index dfd227f917ed..5e5550e0b41d 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, fetchpatch, runCommand, makeWrapper, python3Packages, docutils, help2man
 , abootimg, acl, apktool, binutils-unwrapped, build-tools, bzip2, cbfstool, cdrkit, colord, colordiff, coreutils, cpio, db, diffutils, dtc
-, e2fsprogs, file, findutils, fontforge-fonttools, ffmpeg_4, fpc, gettext, ghc, ghostscriptX, giflib, gnumeric, gnupg, gnutar
+, e2fsprogs, file, findutils, fontforge-fonttools, ffmpeg, fpc, gettext, ghc, ghostscriptX, giflib, gnumeric, gnupg, gnutar
 , gzip, hdf5, imagemagick, jdk, libarchive, libcaca, llvm, lz4, mono, openssh, openssl, pdftk, pgpdump, poppler_utils, qemu, R
 , sng, sqlite, squashfsTools, tcpdump, odt2txt, unzip, wabt, xxd, xz, zip, zstd
 , enableBloat ? false
@@ -62,7 +62,7 @@ python3Packages.buildPythonApplication rec {
     ])
     ++ lib.optionals stdenv.isLinux [ python3Packages.pyxattr acl cdrkit ]
     ++ lib.optionals enableBloat ([
-      abootimg apksigner apktool cbfstool colord ffmpeg_4 fpc ghc ghostscriptX giflib gnupg gnumeric
+      abootimg apksigner apktool cbfstool colord ffmpeg fpc ghc ghostscriptX giflib gnupg gnumeric
       hdf5 imagemagick llvm jdk mono odt2txt openssh pdftk poppler_utils qemu R tcpdump wabt
     ] ++ (with python3Packages; [ binwalk guestfs h5py ]));
 
diff --git a/pkgs/tools/misc/fluent-bit/default.nix b/pkgs/tools/misc/fluent-bit/default.nix
index 439979068f5a..d882c6efb5e8 100644
--- a/pkgs/tools/misc/fluent-bit/default.nix
+++ b/pkgs/tools/misc/fluent-bit/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fluent-bit";
-  version = "1.4.5";
+  version = "1.4.6";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     rev = "v${version}";
-    sha256 = "0kxbq174a5fdcdh1hvnrlk79cg7lyily7iskfxhyz9l26qana9jp";
+    sha256 = "0qxyjmgl85q7xk629l548bpzizma5n4j1r6nqbwh9j15ajvq7mq8";
   };
 
   nativeBuildInputs = [ cmake flex bison ];
diff --git a/pkgs/tools/misc/geekbench/default.nix b/pkgs/tools/misc/geekbench/default.nix
index 153a74f94567..9c250390e11c 100644
--- a/pkgs/tools/misc/geekbench/default.nix
+++ b/pkgs/tools/misc/geekbench/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "geekbench";
-  version = "5.1.1";
+  version = "5.2.0";
 
   src = fetchurl {
     url = "https://cdn.geekbench.com/Geekbench-${version}-Linux.tar.gz";
-    sha256 = "1wjyn3fkc2zgj0xrd73kidrg1d1wqmil278ak36wf87685w4n0b1";
+    sha256 = "1rvzll57igivhlxp058mhmcbq07q2zr52xbi1wyn85qr9ihrhx08";
   };
 
   dontConfigure = true;
diff --git a/pkgs/tools/misc/gh-ost/default.nix b/pkgs/tools/misc/gh-ost/default.nix
index d78e7f9439fd..17893ef18ae6 100644
--- a/pkgs/tools/misc/gh-ost/default.nix
+++ b/pkgs/tools/misc/gh-ost/default.nix
@@ -2,8 +2,8 @@
 
 let
   goPackagePath = "github.com/github/gh-ost";
-  version = "1.0.47";
-  sha256 = "0yyhkqis4j2cl6w2drrjxdy5j8x9zp4j89gsny6w4ql8gm5qgvvk";
+  version = "1.0.49";
+  sha256 = "0mncjhmv25wnhgjkn9gwkz2gzh0v6954w47ql7fs2iqr9al111dq";
 
 in
 buildGoPackage ({
diff --git a/pkgs/tools/misc/graylog/default.nix b/pkgs/tools/misc/graylog/default.nix
index 17ea28724782..8530d04b49a3 100644
--- a/pkgs/tools/misc/graylog/default.nix
+++ b/pkgs/tools/misc/graylog/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "graylog";
-  version = "3.3.0";
+  version = "3.3.1";
 
   src = fetchurl {
     url = "https://packages.graylog2.org/releases/graylog/graylog-${version}.tgz";
-    sha256 = "1ydplg2lifql5s4bh64a4lwqp1q5vrvbljhn1pnxv9vz0ab73q1k";
+    sha256 = "1jcv2dqm49vbz810ypv024r3lqgz804l06yhhwshrih61xzj7dvh";
   };
 
   dontBuild = true;
diff --git a/pkgs/tools/misc/graylog/plugins.nix b/pkgs/tools/misc/graylog/plugins.nix
index 5dbcc7479e5d..ec6c16f53131 100644
--- a/pkgs/tools/misc/graylog/plugins.nix
+++ b/pkgs/tools/misc/graylog/plugins.nix
@@ -64,10 +64,10 @@ in {
   enterprise-integrations = glPlugin rec {
     name = "graylog-enterprise-integrations-${version}";
     pluginName = "graylog-plugin-enterprise-integrations";
-    version = "3.3.0";
+    version = "3.3.1";
     src = fetchurl {
       url = "https://downloads.graylog.org/releases/graylog-enterprise-integrations/graylog-enterprise-integrations-plugins-${version}.tgz";
-      sha256 = "1480ccii3nzvm0jp1xm2iddgc789zcwbgd19201q7p3v0ph02yj8";
+      sha256 = "0la91f5hfakrp5d37q3r1z15zzya9vmwgp8gf5ifkh6fasa811ll";
     };
     installPhase = ''
       mkdir -p $out/bin
@@ -75,7 +75,7 @@ in {
       cp ${pluginName}-${version}.jar $out/bin/${pluginName}-${version}.jar
     '';
     meta = {
-      homepage = "https://docs.graylog.org/en/3.2/pages/integrations.html#enterprise";
+      homepage = "https://docs.graylog.org/en/3.3/pages/integrations.html#enterprise";
       description = "Integrations are tools that help Graylog work with external systems (unfree enterprise integrations)";
       license = stdenv.lib.licenses.unfree;
     };
@@ -96,10 +96,10 @@ in {
   integrations = glPlugin rec {
     name = "graylog-integrations-${version}";
     pluginName = "graylog-plugin-integrations";
-    version = "3.3.0";
+    version = "3.3.1";
     src = fetchurl {
       url = "https://downloads.graylog.org/releases/graylog-integrations/graylog-integrations-plugins-${version}.tgz";
-      sha256 = "08cpxviwk2p4zsgbr2h3symr88rf3fjfz1kkg4iglvdc5mqf71xx";
+      sha256 = "1k90q50p4ly9d8fj0riyb1xw0bd6f8wm2xmkr71908j2v0jaskpq";
     };
     installPhase = ''
       mkdir -p $out/bin
diff --git a/pkgs/tools/misc/ncdu/default.nix b/pkgs/tools/misc/ncdu/default.nix
index 71b7f9c6cd47..2d56ab9c09bd 100644
--- a/pkgs/tools/misc/ncdu/default.nix
+++ b/pkgs/tools/misc/ncdu/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ncdu";
-  version = "1.15";
+  version = "1.15.1";
 
   src = fetchurl {
     url = "https://dev.yorhel.nl/download/${pname}-${version}.tar.gz";
-    sha256 = "1ywpa8yg74a5xa46f0qig92xw5z5s1lmspwzcslr497brk2ksnaa";
+    sha256 = "1c1zxalm5asyhn4p1hd51h7khw17515gbqmvdz63kc8xpx6xqbdh";
   };
 
   buildInputs = [ ncurses ];
diff --git a/pkgs/tools/misc/plantuml/default.nix b/pkgs/tools/misc/plantuml/default.nix
index 09dba27a1efe..cb8cf1ec0a8e 100644
--- a/pkgs/tools/misc/plantuml/default.nix
+++ b/pkgs/tools/misc/plantuml/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, makeWrapper, jre, graphviz }:
 
 stdenv.mkDerivation rec {
-  version = "1.2020.10";
+  version = "1.2020.12";
   pname = "plantuml";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/plantuml/${version}/plantuml.${version}.jar";
-    sha256 = "00azasannh77ns3wpy6yrlw77pgq89frx0f4c7gk1gqiqjavsvdy";
+    sha256 = "0c0270kjw8vg8nphharap2p66yl72j5k4k3s5r9klafgp3sg4sjj";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/misc/rmlint/default.nix b/pkgs/tools/misc/rmlint/default.nix
index 4dd440850120..2ea1668409a5 100644
--- a/pkgs/tools/misc/rmlint/default.nix
+++ b/pkgs/tools/misc/rmlint/default.nix
@@ -5,13 +5,13 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "rmlint";
-  version = "2.10.0";
+  version = "2.10.1";
 
   src = fetchFromGitHub {
     owner = "sahib";
     repo = "rmlint";
     rev = "v${version}";
-    sha256 = "1r7j1bmm83p6wdw0jhvkm4sa568r534zsy45bvas7qq4433jl019";
+    sha256 = "15xfkcw1bkfyf3z8kl23k3rlv702m0h7ghqxvhniynvlwbgh6j2x";
   };
 
   CFLAGS="-I${stdenv.lib.getDev utillinux}/include";
diff --git a/pkgs/tools/misc/system-config-printer/default.nix b/pkgs/tools/misc/system-config-printer/default.nix
index e9ee91de6776..8a0c881a277b 100644
--- a/pkgs/tools/misc/system-config-printer/default.nix
+++ b/pkgs/tools/misc/system-config-printer/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, udev, intltool, pkgconfig, glib, xmlto, wrapGAppsHook
+{ stdenv, fetchFromGitHub, fetchpatch, udev, intltool, pkgconfig, glib, xmlto, wrapGAppsHook
 , docbook_xml_dtd_412, docbook_xsl
 , libxml2, desktop-file-utils, libusb1, cups, gdk-pixbuf, pango, atk, libnotify
 , gobject-introspection, libsecret, packagekit
@@ -24,7 +24,20 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile.am --replace /bin/bash ${bash}/bin/bash
   '';
 
-  patches = [ ./detect_serverbindir.patch ];
+  patches = [
+    ./detect_serverbindir.patch
+
+    # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=958104
+    # (Fixes will be included in next upstream release.)
+    (fetchpatch {
+      url = "https://github.com/OpenPrinting/system-config-printer/commit/cf9903466c1a2d18a701f3b5e8c7e03483e1244d.patch";
+      sha256 = "03gpav618w50q90m2kdkgwclc7fv17m493fgjd633zfavb5kqr3n";
+    })
+    (fetchpatch {
+      url = "https://github.com/OpenPrinting/system-config-printer/commit/b9289dfe105bdb502f183f0afe7a115ecae5f2af.patch";
+      sha256 = "12w47hy3ly4phh8jcqxvdnd5sgbnbp8dnscjd7d5y2i43kxj7b23";
+    })
+  ];
 
   buildInputs = [
     glib udev libusb1 cups
diff --git a/pkgs/tools/misc/topgrade/default.nix b/pkgs/tools/misc/topgrade/default.nix
index 529252901a4a..21e464c6d29e 100644
--- a/pkgs/tools/misc/topgrade/default.nix
+++ b/pkgs/tools/misc/topgrade/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "topgrade";
-  version = "4.5.0";
+  version = "4.7.0";
 
   src = fetchFromGitHub {
     owner = "r-darwish";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0df79vlbclv1qx4zwir728c6ggqfawxh2x1py16m5q0ga1hd799j";
+    sha256 = "1hg03mj3rd778hq1856139nwz7y5gykwvg7xhxlsiabv7gr06m2m";
   };
 
-  cargoSha256 = "0wwxh71i94h68sryckbvrr43gd19qjcs0cgcpycnimkhdcdy8nlj";
+  cargoSha256 = "14qv2157jhj7hilvqi3c00p11rzv0vvimr4d34nyspgzxz2si6sm";
 
   buildInputs = lib.optional stdenv.isDarwin Foundation;
 
diff --git a/pkgs/tools/misc/txt2man/default.nix b/pkgs/tools/misc/txt2man/default.nix
index c7d8837f8235..6013dc1c26b9 100644
--- a/pkgs/tools/misc/txt2man/default.nix
+++ b/pkgs/tools/misc/txt2man/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "txt2man";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchurl {
     url = "https://github.com/mvertes/txt2man/archive/${pname}-${version}.tar.gz";
-    sha256 = "168cj96974n2z0igin6j1ic1m45zyic7nm5ark7frq8j78rrx4zn";
+    sha256 = "06jf8hqav095db1v3njavx0rphmpmi3mgki4va6qkxjnvmdx4742";
   };
 
   preConfigure = ''
diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix
index dc2d3cf8a1e8..94f4de6e364f 100644
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@@ -1,5 +1,5 @@
 { lib, fetchurl, buildPythonPackage
-, zip, ffmpeg_4, rtmpdump, phantomjs2, atomicparsley, pycryptodome, pandoc
+, zip, ffmpeg, rtmpdump, phantomjs2, atomicparsley, pycryptodome, pandoc
 # Pandoc is required to build the package's man page. Release tarballs contain a
 # formatted man page already, though, it will still be installed. We keep the
 # manpage argument in place in case someone wants to use this derivation to
@@ -18,11 +18,11 @@ buildPythonPackage rec {
   # The websites youtube-dl deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2020.06.06";
+  version = "2020.06.16.1";
 
   src = fetchurl {
     url = "https://yt-dl.org/downloads/${version}/${pname}-${version}.tar.gz";
-    sha256 = "1qrrr14glv0jv377n61paq55b6k58jpnwbz2sp5xfl4wnxy5hqny";
+    sha256 = "1q0080cvxpfakgbzigbnl9adnga3jz1sqig2rsiq52rarqbc01px";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
@@ -36,7 +36,7 @@ buildPythonPackage rec {
   makeWrapperArgs = let
       packagesToBinPath =
         [ atomicparsley ]
-        ++ lib.optional ffmpegSupport ffmpeg_4
+        ++ lib.optional ffmpegSupport ffmpeg
         ++ lib.optional rtmpSupport rtmpdump
         ++ lib.optional phantomjsSupport phantomjs2;
     in [ ''--prefix PATH : "${lib.makeBinPath packagesToBinPath}"'' ];
diff --git a/pkgs/tools/networking/acme-client/default.nix b/pkgs/tools/networking/acme-client/default.nix
index 06c2898248d0..00f8778cafd5 100644
--- a/pkgs/tools/networking/acme-client/default.nix
+++ b/pkgs/tools/networking/acme-client/default.nix
@@ -1,7 +1,5 @@
 { stdenv
-, fetchFromGitHub
-, autoreconfHook
-, bison
+, fetchurl
 , apple_sdk ? null
 , libbsd
 , libressl
@@ -12,22 +10,20 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "acme-client";
-  version = "0.2.5";
+  version = "1.0.1";
 
-  src = fetchFromGitHub {
-    owner = "graywolf";
-    repo = "acme-client-portable";
-    rev = "v${version}";
-    sha256 = "1d9yk87nj5gizkq26m4wqfh4xhlrn5xlfj7mfgvrpsdiwibqxrrw";
+  src = fetchurl {
+    url = "https://data.wolfsden.cz/sources/acme-client-${version}.tar.xz";
+    sha256 = "0gmdvmyw8a61w08hrxllypf7rpnqg0fxipbk3zmvsxj7m5i6iysj";
   };
 
-  nativeBuildInputs = [ autoreconfHook bison pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libbsd libressl ] ++ optional stdenv.isDarwin apple_sdk.sdk;
 
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
   meta = {
-    homepage = "https://github.com/graywolf/acme-client-portable";
+    homepage = "https://sr.ht/~graywolf/acme-client-portable/";
     description = "Secure ACME/Let's Encrypt client";
     platforms = platforms.unix;
     license = licenses.isc;
diff --git a/pkgs/tools/networking/dnscrypt-proxy2/default.nix b/pkgs/tools/networking/dnscrypt-proxy2/default.nix
index 508d9ecd0f30..d5b92c17a65a 100644
--- a/pkgs/tools/networking/dnscrypt-proxy2/default.nix
+++ b/pkgs/tools/networking/dnscrypt-proxy2/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "dnscrypt-proxy2";
-  version = "2.0.43";
+  version = "2.0.44";
 
   vendorSha256 = null;
 
@@ -10,7 +10,7 @@ buildGoModule rec {
     owner = "DNSCrypt";
     repo = "dnscrypt-proxy";
     rev = version;
-    sha256 = "1c12y8h7dww72a3agb74vr5fzxzy6k8394rdbgz9knk82fdwah1c";
+    sha256 = "08bg60j5z349blj5sip1f8f793q12ix3zmqkayym5nf69s1pfm7l";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/networking/flannel/default.nix b/pkgs/tools/networking/flannel/default.nix
index a52088ed231d..7ecfb559dcc7 100644
--- a/pkgs/tools/networking/flannel/default.nix
+++ b/pkgs/tools/networking/flannel/default.nix
@@ -4,7 +4,7 @@ with lib;
 
 buildGoPackage rec {
   pname = "flannel";
-  version = "0.11.0";
+  version = "0.12.0";
   rev = "v${version}";
 
   goPackagePath = "github.com/coreos/flannel";
@@ -13,7 +13,7 @@ buildGoPackage rec {
     inherit rev;
     owner = "coreos";
     repo = "flannel";
-    sha256 = "0akxlrrsm2w51g0qd7dnsdy0hdajx98sdhxw4iknjr2kn7j3gph9";
+    sha256 = "04g7rzgyi3xs3sf5p1a9dmd08crdrz6y1b02ziv3444qk40jyswd";
   };
 
   meta = {
diff --git a/pkgs/tools/networking/i2pd/default.nix b/pkgs/tools/networking/i2pd/default.nix
index 7c6e6ada4c5a..b686ea4d04f2 100644
--- a/pkgs/tools/networking/i2pd/default.nix
+++ b/pkgs/tools/networking/i2pd/default.nix
@@ -9,13 +9,13 @@ assert upnpSupport -> miniupnpc != null;
 
 stdenv.mkDerivation rec {
   pname = "i2pd";
-  version = "2.30.0";
+  version = "2.32.1";
 
   src = fetchFromGitHub {
     owner = "PurpleI2P";
     repo = pname;
     rev = version;
-    sha256 = "1wvn8hs2ps3yzxzv05jnbm7zr1v8gv0phbx38m7l5xhqjmrpnscw";
+    sha256 = "15ng2c7i3jxmhpc2q0dl8arc72qbsq9y9paz5hgln907yy7dqx7c";
   };
 
   buildInputs = with stdenv.lib; [ boost zlib openssl ]
diff --git a/pkgs/tools/networking/memtier-benchmark/default.nix b/pkgs/tools/networking/memtier-benchmark/default.nix
index 3579002e4169..a45c3a2e33a1 100644
--- a/pkgs/tools/networking/memtier-benchmark/default.nix
+++ b/pkgs/tools/networking/memtier-benchmark/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "memtier-benchmark";
-  version = "1.2.17";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner  = "redislabs";
     repo   = "memtier_benchmark";
     rev    = "refs/tags/${version}";
-    sha256 = "18cka6sv3w8ffa81126nzi04if9g1wd3i3apxsgmv7xm2p8fsa39";
+    sha256 = "0m2qnnc71qpdj8w421bxn0zxz6ddvzy7b0n19jvyncnzvk1ff0sq";
   };
 
   patchPhase = ''
diff --git a/pkgs/tools/networking/openfortivpn/default.nix b/pkgs/tools/networking/openfortivpn/default.nix
index bd1c02f9b545..a5e46c6bc575 100644
--- a/pkgs/tools/networking/openfortivpn/default.nix
+++ b/pkgs/tools/networking/openfortivpn/default.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 let repo = "openfortivpn";
-    version = "1.14.0";
+    version = "1.14.1";
 
 in stdenv.mkDerivation {
   name = "${repo}-${version}";
@@ -12,7 +12,7 @@ in stdenv.mkDerivation {
     owner = "adrienverge";
     inherit repo;
     rev = "v${version}";
-    sha256 = "1qn48sp3ydbik7nc9x5l22gvvnr99f89jy1lvnf64bdg218kr0z7";
+    sha256 = "1r9lp19fmqx9dw33j5967ydijbnacmr80mqnhbbxyqiw4k5c10ds";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/tools/package-management/rpm/default.nix b/pkgs/tools/package-management/rpm/default.nix
index fdcf9832e667..fee282de52fc 100644
--- a/pkgs/tools/package-management/rpm/default.nix
+++ b/pkgs/tools/package-management/rpm/default.nix
@@ -1,15 +1,15 @@
-{ stdenv
+{ stdenv, lib
 , pkgconfig, autoreconfHook
 , fetchurl, cpio, zlib, bzip2, file, elfutils, libbfd, libarchive, nspr, nss, popt, db, xz, python, lua
 }:
 
 stdenv.mkDerivation rec {
   pname = "rpm";
-  version = "4.14.2.1";
+  version = "4.15.1";
 
   src = fetchurl {
-    url = "http://ftp.rpm.org/releases/rpm-4.14.x/rpm-${version}.tar.bz2";
-    sha256 = "1nmck2fq9h85fgs3zhh6w1avlw5y16cbz5khd459ry3jfd5w4f8i";
+    url = "http://ftp.rpm.org/releases/rpm-${lib.versions.majorMinor version}.x/rpm-${version}.tar.bz2";
+    sha256 = "0c6jwail90fhha3bpx70w4a2i8ycxwvnx6zwxm121l8wc3wlbvyx";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/tools/security/bitwarden_rs/default.nix b/pkgs/tools/security/bitwarden_rs/default.nix
index 158485dc982f..f2d0eb9b7d3a 100644
--- a/pkgs/tools/security/bitwarden_rs/default.nix
+++ b/pkgs/tools/security/bitwarden_rs/default.nix
@@ -8,13 +8,13 @@ let
 
 in rustPlatform.buildRustPackage rec {
   pname = "bitwarden_rs";
-  version = "1.15.0";
+  version = "1.15.1";
 
   src = fetchFromGitHub {
     owner = "dani-garcia";
     repo = pname;
     rev = version;
-    sha256 = "12mr7d0mjlh7za4nc3s7cizzbd6v0zfmd7q9s0f7pqz56vw5m21s";
+    sha256 = "1982bfprixdp8mx2hwidfvsi0zy7wmzf40m9m3cl5r7i2qydznwb";
   };
 
   nativeBuildInputs = [ pkgconfig ];
@@ -25,7 +25,7 @@ in rustPlatform.buildRustPackage rec {
 
   RUSTC_BOOTSTRAP = 1;
 
-  cargoSha256 = "0nacc8xvbkdzbyx4c17hdh03v9ykpis74pbpxkn6v95njw14wq53";
+  cargoSha256 = "08cygzgv82i10cj8lkjdah0arrdmlfcbdjwc8piwa629rr0584zf";
   cargoBuildFlags = [ featuresFlag ];
 
   checkPhase = ''
diff --git a/pkgs/tools/security/certstrap/default.nix b/pkgs/tools/security/certstrap/default.nix
index fb3c00e48f91..4d2e2fe7e950 100644
--- a/pkgs/tools/security/certstrap/default.nix
+++ b/pkgs/tools/security/certstrap/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "certstrap";
-  version = "1.1.1";
+  version = "1.2.0";
 
   goPackagePath = "github.com/square/certstrap";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "square";
     repo = "certstrap";
     rev = "v${version}";
-    sha256 = "0j7gi2nzykny7i0gjax9vixw72l9jcm4wnwxgm72hh1pji0ysa8n";
+    sha256 = "1ymchnn7c9g3pq7rw4lrwsd6z3wfjx90g7qgrw6r5hssl77mnscj";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/security/chipsec/default.nix b/pkgs/tools/security/chipsec/default.nix
index 387fa4d750bd..5dccf295065c 100644
--- a/pkgs/tools/security/chipsec/default.nix
+++ b/pkgs/tools/security/chipsec/default.nix
@@ -2,13 +2,13 @@
 , kernel ? null, withDriver ? false }:
 pythonPackages.buildPythonApplication rec {
   pname = "chipsec";
-  version = "1.4.9";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "chipsec";
     repo = "chipsec";
     rev = version;
-    sha256 = "1p6w8294w5z2f4jwc22mqaggv5qajvmf9iifv7fl7wdz3wsvskrk";
+    sha256 = "1rxr9i08a22m15slvlkrhnki30jixi2ds096kmmc2nqzfr9yibmb";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/keycard-cli/default.nix b/pkgs/tools/security/keycard-cli/default.nix
index a76c102b2bb9..73eab6c3dec9 100644
--- a/pkgs/tools/security/keycard-cli/default.nix
+++ b/pkgs/tools/security/keycard-cli/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "keycard-cli";
-  version = "0.0.12";
+  version = "0.4.0";
 
   goPackagePath = "github.com/status-im/keycard-cli";
   subPackages = [ "." ];
@@ -14,7 +14,7 @@ buildGoPackage rec {
     owner = "status-im";
     repo = pname;
     rev = version;
-    sha256 = "1jnbaq57i6i9bad1hcvd28mxfqq6v8rv806c6l74vlb79ff4v1wb";
+    sha256 = "0917vl5lw8wgvyn5l8q6xa8bqh342fibaa38syr8hmz8b09qkh38";
   };
 
   buildFlagsArray = [
diff --git a/pkgs/tools/security/rage/default.nix b/pkgs/tools/security/rage/default.nix
index cdba2f2beb01..26ae27dff6b2 100644
--- a/pkgs/tools/security/rage/default.nix
+++ b/pkgs/tools/security/rage/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, rustPlatform, fetchFromGitHub, Security }:
+{ stdenv, rustPlatform, fetchFromGitHub, installShellFiles, Security }:
 
 rustPlatform.buildRustPackage rec {
   pname = "rage";
@@ -13,8 +13,20 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "08njl8irkqkfxj54pz4sx3l9aqb40h10wxb82zza52pqd4zapgn6";
 
+  nativeBuildInputs = [ installShellFiles ];
+
   buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
 
+  postBuild = ''
+    cargo run --example generate-docs
+    cargo run --example generate-completions
+  '';
+
+  postInstall = ''
+    installManPage target/manpages/*
+    installShellCompletion target/completions/*.{bash,fish,zsh}
+  '';
+
   meta = with stdenv.lib; {
     description = "A simple, secure and modern encryption tool with small explicit keys, no config options, and UNIX-style composability";
     homepage = "https://github.com/str4d/rage";
diff --git a/pkgs/tools/security/tpm2-abrmd/default.nix b/pkgs/tools/security/tpm2-abrmd/default.nix
index fbebde2e7bf6..6fe116d7015a 100644
--- a/pkgs/tools/security/tpm2-abrmd/default.nix
+++ b/pkgs/tools/security/tpm2-abrmd/default.nix
@@ -1,24 +1,44 @@
-{ stdenv, fetchurl, lib
-, tpm2-tss, pkgconfig, glib, which, dbus, cmocka }:
+{ stdenv, lib, fetchFromGitHub
+, autoreconfHook, pkg-config, autoconf-archive, makeWrapper, which
+, tpm2-tss, glib, dbus
+, cmocka
+}:
 
 stdenv.mkDerivation rec {
   pname = "tpm2-abrmd";
-  version = "2.2.0";
+  version = "2.3.2";
 
-  src = fetchurl {
-    url = "https://github.com/tpm2-software/${pname}/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "1lbfhyyh9k54r8s1h8ca2czxv4hg0yq984kdh3vqh3990aca0x9a";
+  src = fetchFromGitHub {
+    owner = "tpm2-software";
+    repo = pname;
+    rev = version;
+    sha256 = "0jzglnlb700clcq6mjhhgvcq29a6893h888wsn9fbrh4f255sw8q";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [
-    tpm2-tss glib which dbus cmocka
-  ];
+  nativeBuildInputs = [ pkg-config makeWrapper autoreconfHook autoconf-archive which ];
+  buildInputs = [ tpm2-tss glib dbus ];
+  checkInputs = [ cmocka ];
+
+  enableParallelBuilding = true;
+
+  # Emulate the required behavior of ./bootstrap in the original
+  # package
+  preAutoreconf = ''
+    echo "${version}" > VERSION
+  '';
 
   # Unit tests are currently broken as the check phase attempts to start a dbus daemon etc.
   #configureFlags = [ "--enable-unit" ];
   doCheck = false;
 
+  # Even though tpm2-tss is in the RUNPATH, starting from 2.3.0 abrmd
+  # seems to require the path to the device TCTI (used for accessing
+  # /dev/tpm0) in it's LD_LIBRARY_PATH
+  postFixup = ''
+    wrapProgram $out/bin/tpm2-abrmd \
+      --suffix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ tpm2-tss ]}"
+  '';
+
   meta = with lib; {
     description = "TPM2 resource manager, accessible via D-Bus";
     homepage = "https://github.com/tpm2-software/tpm2-tools";
diff --git a/pkgs/tools/system/di/default.nix b/pkgs/tools/system/di/default.nix
index 239544d20a6d..0a6ae26547bf 100644
--- a/pkgs/tools/system/di/default.nix
+++ b/pkgs/tools/system/di/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "di";
-  version = "4.47.3";
+  version = "4.48";
 
   src = fetchurl {
     url = "https://gentoo.com/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "0m4npba50sf5s61g5z3xd2r7937zwja941f2h3f081xi24c2hfck";
+    sha256 = "0crvvfsxh8ryc0j19a2x52i9zacvggm8zi6j3kzygkcwnpz4km8r";
   };
 
   makeFlags = [ "INSTALL_DIR=$(out)" ];
diff --git a/pkgs/tools/virtualization/govc/default.nix b/pkgs/tools/virtualization/govc/default.nix
index e3329ea13f11..433da1b07f27 100644
--- a/pkgs/tools/virtualization/govc/default.nix
+++ b/pkgs/tools/virtualization/govc/default.nix
@@ -2,7 +2,7 @@
   
 buildGoPackage rec {
   pname = "govc";
-  version = "0.22.1";
+  version = "0.23.0";
 
   goPackagePath = "github.com/vmware/govmomi";
 
@@ -12,7 +12,7 @@ buildGoPackage rec {
     rev = "v${version}";
     owner = "vmware";
     repo = "govmomi";
-    sha256 = "1z4am6143jrrls0023flnqgadm1z9p60w09cp1j5pnslm60vvw78";
+    sha256 = "05nb5xd90kbazdx4l9bw72729dh5hrcaqdi9wpf5ma7bz7mw9wzi";
   };
 
   meta = {
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 03efd40d2714..64392f49a52e 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -88,6 +88,7 @@ mapAliases ({
   cpp-gsl = microsoft_gsl; # added 2019-05-24
   cupsBjnp = cups-bjnp; # added 2016-01-02
   cups_filters = cups-filters; # added 2016-08
+  cquery = throw "cquery has been removed because it is abandoned by upstream. Consider switching to clangd or ccls instead."; # added 2020-06-15
   cv = progress; # added 2015-09-06
   d1x_rebirth = dxx-rebirth; # added 2018-04-25
   d2x_rebirth = dxx-rebirth; # added 2018-04-25
@@ -200,7 +201,6 @@ mapAliases ({
   gupnp_igd = gupnp-igd; # added 2018-02-25
   gupnptools = gupnp-tools;  # added 2015-12-19
   gutenberg = zola;  # added 2018-11-17
-  hamster-time-traker = throw "hamster-time-tracker has been removed from nixpkgs, as it was unmaintained."; # added 2019-12-10
   heimdalFull = heimdal; # added 2018-05-01
   hepmc = hepmc2; # added 2019-08-05
   hexen = throw "hexen (SDL port) has been removed: Abandoned by upstream."; # added 2019-12-11
@@ -252,6 +252,7 @@ mapAliases ({
   libjpeg_drop = libjpeg_original; # added 2020-06-05
   libjson_rpc_cpp = libjson-rpc-cpp; # added 2017-02-28
   liblapackWithoutAtlas = lapack-reference; # added 2018-11-05
+  liblastfm = libsForQt5.liblastfm; # added 2020-06-14
   liblrdf = lrdf; # added 2018-04-25
   libqrencode = qrencode;  # added 2019-01-01
   librdf = lrdf; # added 2020-03-22
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2b75778322fe..311a9d48e68c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1968,7 +1968,7 @@ in
 
   interlock = callPackage ../servers/interlock {};
 
-  jellyfin = callPackage ../servers/jellyfin { ffmpeg = ffmpeg_4; };
+  jellyfin = callPackage ../servers/jellyfin { };
 
   jellyfin-mpv-shim = python3Packages.callPackage ../applications/video/jellyfin-mpv-shim { };
 
@@ -4684,6 +4684,8 @@ in
 
   kippo = callPackage ../servers/kippo { };
 
+  kristall = libsForQt5.callPackage ../applications/networking/browsers/kristall { };
+
   kzipmix = pkgsi686Linux.callPackage ../tools/compression/kzipmix { };
 
   ma1sd = callPackage ../servers/ma1sd { };
@@ -5869,8 +5871,6 @@ in
 
   patchage = callPackage ../applications/audio/patchage { };
 
-  patchwork-classic = callPackage ../applications/networking/ssb/patchwork-classic { };
-
   pcapfix = callPackage ../tools/networking/pcapfix { };
 
   pbzip2 = callPackage ../tools/compression/pbzip2 { };
@@ -6401,7 +6401,9 @@ in
 
   rpiboot-unstable = callPackage ../development/misc/rpiboot/unstable.nix { };
 
-  rpm = callPackage ../tools/package-management/rpm { };
+  rpm = callPackage ../tools/package-management/rpm {
+    python = python3;
+  };
 
   rpm-ostree = callPackage ../tools/misc/rpm-ostree {
     gperf = gperf_3_0;
@@ -6838,7 +6840,7 @@ in
 
   svgcleaner = callPackage ../tools/graphics/svgcleaner { };
 
-  ssb-patchwork = callPackage ../applications/networking/ssb/patchwork { };
+  ssb-patchwork = callPackage ../applications/networking/ssb-patchwork { };
 
   ssdeep = callPackage ../tools/security/ssdeep { };
 
@@ -10274,12 +10276,6 @@ in
 
   cpplint = callPackage ../development/tools/analysis/cpplint { };
 
-  cquery = callPackage ../development/tools/misc/cquery {
-    # 7 is the default, but only on Linux, so keep this for now
-    llvmPackages = llvmPackages_7;
-  };
-
-
   ccls = callPackage ../development/tools/misc/ccls {
     llvmPackages = llvmPackages_8;
     stdenv = llvmPackages_8.stdenv;
@@ -10619,6 +10615,10 @@ in
 
   jenkins-job-builder = with python3Packages; toPythonApplication jenkins-job-builder;
 
+  julius = callPackage ../games/julius { };
+
+  augustus = callPackage ../games/augustus { };
+
   kafkacat = callPackage ../development/tools/kafkacat { };
 
   kati = callPackage ../development/tools/build-managers/kati { };
@@ -11723,8 +11723,6 @@ in
   ffmpeg = ffmpeg_4;
 
   ffmpeg-full = callPackage ../development/libraries/ffmpeg-full {
-    ffmpeg = ffmpeg_4;
-
     # The following need to be fixed on Darwin
     frei0r = if stdenv.isDarwin then null else frei0r;
     game-music-emu = if stdenv.isDarwin then null else game-music-emu;
@@ -12081,7 +12079,7 @@ in
   gsettings-qt = libsForQt5.callPackage ../development/libraries/gsettings-qt { };
 
   gst_all_1 = recurseIntoAttrs(callPackage ../development/libraries/gstreamer {
-    callPackage = newScope { libav = pkgs.ffmpeg_4; };
+    callPackage = newScope { libav = pkgs.ffmpeg; };
     inherit (darwin.apple_sdk.frameworks) CoreServices;
   });
 
@@ -13082,8 +13080,6 @@ in
 
   liblastfmSF = callPackage ../development/libraries/liblastfmSF { };
 
-  liblastfm = libsForQt5.callPackage ../development/libraries/liblastfm { };
-
   liblcf = callPackage ../development/libraries/liblcf { };
 
   liblqr1 = callPackage ../development/libraries/liblqr-1 { };
@@ -13817,7 +13813,7 @@ in
     withGUI = false;
   };
 
-  mlt = callPackage ../development/libraries/mlt { ffmpeg = ffmpeg_4; };
+  mlt = callPackage ../development/libraries/mlt { };
 
   mlv-app = libsForQt5.callPackage ../applications/video/mlv-app { };
 
@@ -14217,6 +14213,8 @@ in
 
   flatbuffers = callPackage ../development/libraries/flatbuffers { };
 
+  nanopb = callPackage ../development/libraries/nanopb { };
+
   gnupth = callPackage ../development/libraries/pth { };
   pth = if stdenv.hostPlatform.isMusl then npth else gnupth;
 
@@ -14357,6 +14355,8 @@ in
 
     libktorrent = callPackage ../development/libraries/libktorrent { };
 
+    liblastfm = callPackage ../development/libraries/liblastfm { };
+
     libopenshot = callPackage ../applications/video/openshot-qt/libopenshot.nix { };
 
     libopenshot-audio = callPackage ../applications/video/openshot-qt/libopenshot-audio.nix { };
@@ -14369,9 +14369,7 @@ in
 
     kpmcore = callPackage ../development/libraries/kpmcore { };
 
-    mlt = callPackage ../development/libraries/mlt/qt-5.nix {
-      ffmpeg = ffmpeg_4;
-    };
+    mlt = callPackage ../development/libraries/mlt/qt-5.nix { };
 
     openbr = callPackage ../development/libraries/openbr { };
 
@@ -15149,6 +15147,9 @@ in
 
   wxGTK = wxGTK28;
 
+  wxGTK30 = wxGTK30-gtk2;
+  wxGTK31 = wxGTK31-gtk2;
+
   wxGTK28 = callPackage ../development/libraries/wxwidgets/2.8 {
     inherit (gnome2) GConf;
   };
@@ -15159,18 +15160,32 @@ in
     inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QuickTime;
   };
 
-  wxGTK30 = callPackage ../development/libraries/wxwidgets/3.0 {
+  wxGTK30-gtk2 = callPackage ../development/libraries/wxwidgets/3.0 {
+    withGtk2 = true;
     inherit (gnome2) GConf;
     inherit (darwin.stubs) setfile;
     inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit;
   };
 
-  wxGTK31 = callPackage ../development/libraries/wxwidgets/3.1 {
+  wxGTK30-gtk3 = callPackage ../development/libraries/wxwidgets/3.0 {
+    withGtk2 = false;
+    inherit (darwin.stubs) setfile;
+    inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit;
+  };
+
+  wxGTK31-gtk2 = callPackage ../development/libraries/wxwidgets/3.1 {
+    withGtk2 = true;
     inherit (gnome2) GConf;
     inherit (darwin.stubs) setfile;
     inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit;
   };
 
+  wxGTK31-gtk3 = callPackage ../development/libraries/wxwidgets/3.1 {
+    withGtk2 = false;
+    inherit (darwin.stubs) setfile;
+    inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit;
+  };
+
   wxmac = callPackage ../development/libraries/wxwidgets/3.0/mac.nix {
     inherit (darwin.apple_sdk.frameworks) AGL Cocoa Kernel;
     inherit (darwin.stubs) setfile rez derez;
@@ -15525,6 +15540,8 @@ in
     kerberos = libkrb5;
   };
 
+  adguardhome = callPackage ../servers/adguardhome {};
+
   apacheHttpd_2_4 = callPackage ../servers/http/apache-httpd/2.4.nix { };
   apacheHttpd = pkgs.apacheHttpd_2_4;
 
@@ -15663,6 +15680,7 @@ in
 
   dovecot = callPackage ../servers/mail/dovecot { };
   dovecot_pigeonhole = callPackage ../servers/mail/dovecot/plugins/pigeonhole { };
+  dovecot_fts_xapian = callPackage ../servers/mail/dovecot/plugins/fts_xapian { };
 
   dspam = callPackage ../servers/mail/dspam { };
 
@@ -15753,7 +15771,7 @@ in
 
   hiawatha = callPackage ../servers/http/hiawatha {};
 
-  home-assistant = callPackage ../servers/home-assistant { 
+  home-assistant = callPackage ../servers/home-assistant {
     python3 = python37;
   };
 
@@ -18855,7 +18873,6 @@ in
   bibletime = libsForQt5.callPackage ../applications/misc/bibletime { };
 
   bino3d = libsForQt5.callPackage ../applications/video/bino3d {
-    ffmpeg = ffmpeg_4;
     glew = glew110;
   };
 
@@ -19124,7 +19141,7 @@ in
 
   ctop = callPackage ../tools/system/ctop { };
 
-  cubicsdr = callPackage ../applications/radio/cubicsdr { wxGTK = wxGTK31; };
+  cubicsdr = callPackage ../applications/radio/cubicsdr { };
 
   cum = callPackage ../applications/misc/cum { };
 
@@ -20069,6 +20086,8 @@ in
 
   hakuneko = callPackage ../tools/misc/hakuneko { };
 
+  hamster = callPackage ../applications/misc/hamster { };
+
   hashit = callPackage ../tools/misc/hashit { };
 
   hactool = callPackage ../tools/compression/hactool { };
@@ -20217,6 +20236,8 @@ in
     pulseSupport = config.pulseaudio or false;
   };
 
+  hikari = callPackage ../applications/window-managers/hikari { };
+
   i3 = callPackage ../applications/window-managers/i3 {
     xcb-util-cursor = if stdenv.isDarwin then xcb-util-cursor-HEAD else xcb-util-cursor;
   };
@@ -20847,6 +20868,10 @@ in
 
   meld = callPackage ../applications/version-management/meld { };
 
+  meli = callPackage ../applications/networking/mailreaders/meli { };
+
+  melonDS = callPackage ../misc/emulators/melonDS { };
+
   meme = callPackage ../applications/graphics/meme { };
 
   mendeley = libsForQt5.callPackage ../applications/office/mendeley {
@@ -21046,6 +21071,7 @@ in
   mpvScripts = recurseIntoAttrs {
     convert = callPackage ../applications/video/mpv/scripts/convert.nix {};
     mpris = callPackage ../applications/video/mpv/scripts/mpris.nix {};
+    simple-mpv-webui = callPackage ../applications/video/mpv/scripts/simple-mpv-webui.nix {};
   };
 
   mrpeach = callPackage ../applications/audio/pd-plugins/mrpeach { };
@@ -21363,7 +21389,7 @@ in
 
   obs-linuxbrowser = callPackage ../applications/video/obs-studio/linuxbrowser.nix { };
 
-  obs-studio = libsForQt5.callPackage ../applications/video/obs-studio { ffmpeg = ffmpeg_4; };
+  obs-studio = libsForQt5.callPackage ../applications/video/obs-studio { };
 
   obs-wlrobs = callPackage ../applications/video/obs-studio/wlrobs.nix { };
 
@@ -22191,9 +22217,7 @@ in
 
   soxr = callPackage ../applications/misc/audio/soxr { };
 
-  spek = callPackage ../applications/audio/spek {
-    ffmpeg = ffmpeg_2;
-  };
+  spek = callPackage ../applications/audio/spek { };
 
   spotify = callPackage ../applications/audio/spotify {
     libgcrypt = libgcrypt_1_5;
@@ -23646,7 +23670,6 @@ in
     inherit (plasma5) oxygen;
     inherit (kdeApplications) akonadi-contacts;
     inherit (kdeFrameworks) kcalendarcore;
-    ffmpeg = ffmpeg_4;
     opencv3 = opencv3WithoutCuda;
   };
 
@@ -23846,8 +23869,8 @@ in
 
   katagoWithCuda = katago.override {
     cudaSupport = true;
-    cudnn = cudnn_cudatoolkit_10_1;
-    cudatoolkit = cudatoolkit_10_1;
+    cudnn = cudnn_cudatoolkit_10_2;
+    cudatoolkit = cudatoolkit_10_2;
   };
 
   klavaro = callPackage ../games/klavaro {};
@@ -26353,9 +26376,7 @@ in
 
   vazir-fonts = callPackage ../data/fonts/vazir-fonts { };
 
-  vbam = callPackage ../misc/emulators/vbam {
-    ffmpeg = ffmpeg_4;
-  };
+  vbam = callPackage ../misc/emulators/vbam { };
 
   vice = callPackage ../misc/emulators/vice {
     giflib = giflib_4_1;
diff --git a/pkgs/top-level/dhall-packages.nix b/pkgs/top-level/dhall-packages.nix
index 6cdd84c22799..9d4801e9dc5c 100644
--- a/pkgs/top-level/dhall-packages.nix
+++ b/pkgs/top-level/dhall-packages.nix
@@ -8,20 +8,40 @@ let
     let
       callPackage = newScope self;
 
+      prefer = version: path:
+        let
+          packages = callPackage path { };
+
+        in
+          packages."${version}".overrideAttrs (_: {
+              passthru = packages;
+            }
+          );
+
       buildDhallPackage =
         callPackage ../development/interpreters/dhall/build-dhall-package.nix { };
 
+      buildDhallGitHubPackage =
+        callPackage ../development/interpreters/dhall/build-dhall-github-package.nix { };
+
+      buildDhallDirectoryPackage =
+        callPackage ../development/interpreters/dhall/build-dhall-directory-package.nix { };
+
     in
-      { inherit buildDhallPackage;
+      { inherit
+          buildDhallPackage
+          buildDhallGitHubPackage
+          buildDhallDirectoryPackage
+        ;
 
         dhall-kubernetes =
-          callPackage ../development/dhall-modules/dhall-kubernetes.nix { };
+          prefer "3.0.0" ../development/dhall-modules/dhall-kubernetes.nix;
 
         dhall-packages =
-          callPackage ../development/dhall-modules/dhall-packages.nix { };
+          prefer "0.11.1" ../development/dhall-modules/dhall-packages.nix;
 
         Prelude =
-          callPackage ../development/dhall-modules/Prelude.nix { };
+          prefer "13.0.0" ../development/dhall-modules/Prelude.nix;
       };
 
 in
diff --git a/pkgs/top-level/dotnet-packages.nix b/pkgs/top-level/dotnet-packages.nix
index 3b58e1937b60..f14ae3133b8b 100644
--- a/pkgs/top-level/dotnet-packages.nix
+++ b/pkgs/top-level/dotnet-packages.nix
@@ -4,6 +4,7 @@
 , fetchurl
 , fetchFromGitHub
 , fetchNuGet
+, glib
 , pkgconfig
 , mono
 , fsharp
@@ -544,6 +545,7 @@ let self = dotnetPackages // overrides; dotnetPackages = with self; {
 
     buildInputs = [
       fsharp
+      glib
       dotnetPackages.FSharpCompilerService
       dotnetPackages.NewtonsoftJson
       dotnetPackages.NDeskOptions
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 602e131ad9e6..4be489c76ebb 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -401,15 +401,7 @@ let
 
     jingoo = callPackage ../development/ocaml-modules/jingoo { };
 
-    js_of_ocaml =
-    if lib.versionOlder "4.02" ocaml.version
-    then callPackage ../development/tools/ocaml/js_of_ocaml/3.0.nix { }
-    else js_of_ocaml_2;
-
-    js_of_ocaml_2 = callPackage ../development/tools/ocaml/js_of_ocaml {
-      base64 = base64_2;
-      lwt = lwt2;
-    };
+    js_of_ocaml = callPackage ../development/tools/ocaml/js_of_ocaml { };
 
     js_of_ocaml-camlp4 = callPackage ../development/tools/ocaml/js_of_ocaml/camlp4.nix {};
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index bbc5277cd648..e212da337696 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -3614,7 +3614,7 @@ let
       sha256 = "3cc7126d5841107237a9be2dc5c7fbc167cf3c4b4ce34678a8448b850757014c";
     };
     propagatedBuildInputs = [ ClassMix ];
-    perlPreHook = stdenv.lib.optionalString stdenv.isi686 "export LD=$CC"; # fix undefined reference to `__stack_chk_fail_local'
+    perlPreHook = stdenv.lib.optionalString (stdenv.isi686 || stdenv.isDarwin) "export LD=$CC";
   };
 
   CryptIDEA = buildPerlPackage {
@@ -3734,7 +3734,7 @@ let
       sha256 = "93ebdfaaefcfe9ab683f0121c85f24475d8197f0bcec46018219e4111434dde3";
     };
     propagatedBuildInputs = [ DigestSHA1 ];
-    perlPreHook = stdenv.lib.optionalString stdenv.isi686 "export LD=$CC"; # fix undefined reference to `__stack_chk_fail_local'
+    perlPreHook = stdenv.lib.optionalString (stdenv.isi686 || stdenv.isDarwin) "export LD=$CC";
   };
 
   CryptRijndael = buildPerlPackage {
@@ -13858,6 +13858,22 @@ let
     };
   };
 
+  NetIPLite = buildPerlPackage {
+    pname = "Net-IP-Lite";
+    version = "0.03";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/A/AL/ALEXKOM/Net-IP-Lite-0.03.tar.gz";
+      sha256 = "c9916e6cfaa53be275379ce4b2a550ae176ddfab50dad43b43ed43e8267802a9";
+    };
+    buildInputs = [ TestException ];
+    meta = {
+      homepage = "https://metacpan.org/pod/Net::IP::Lite";
+      description = "Perl extension for manipulating IPv4/IPv6 addresses";
+      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
+      maintainers = [ maintainers.sgo ];
+    };
+  };
+
   NetIPv4Addr = buildPerlPackage {
     pname = "Net-IPv4Addr";
     version = "0.10";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b5bc5a54f7a6..331f7292b930 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1927,7 +1927,9 @@ in {
 
   bids-validator = callPackage ../development/python-modules/bids-validator { };
 
-  binwalk = callPackage ../development/python-modules/binwalk { };
+  binwalk = callPackage ../development/python-modules/binwalk {
+    pyqtgraph = null;
+  };
 
   binwalk-full = appendToName "full" (self.binwalk.override {
     pyqtgraph = self.pyqtgraph;
@@ -3250,6 +3252,8 @@ in {
 
   plaster-pastedeploy = callPackage ../development/python-modules/plaster-pastedeploy {};
 
+  playsound = callPackage ../development/python-modules/playsound { };
+
   plexapi = callPackage ../development/python-modules/plexapi { };
 
   plexauth = callPackage ../development/python-modules/plexauth { };
@@ -5718,7 +5722,7 @@ in {
 
   rply = callPackage ../development/python-modules/rply {};
 
-  rpm = toPythonModule (pkgs.rpm.override{inherit python;});
+  rpm = disabledIf (!isPy3k) (toPythonModule (pkgs.rpm.override{ inherit python; }));
 
   rpmfluff = callPackage ../development/python-modules/rpmfluff {};