about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--lib/default.nix2
-rw-r--r--lib/deprecated.nix2
-rw-r--r--maintainers/maintainer-list.nix20
-rw-r--r--nixos/doc/manual/release-notes/rl-2009.xml20
-rw-r--r--nixos/modules/hardware/video/nvidia.nix64
-rw-r--r--nixos/modules/module-list.nix1
-rw-r--r--nixos/modules/security/doas.nix2
-rw-r--r--nixos/modules/security/pam.nix2
-rw-r--r--nixos/modules/services/backup/znapzend.nix11
-rw-r--r--nixos/modules/services/databases/postgresql.nix12
-rw-r--r--nixos/modules/services/network-filesystems/ipfs.nix3
-rw-r--r--nixos/modules/services/networking/pixiecore.nix2
-rw-r--r--nixos/modules/services/security/privacyidea.nix279
-rw-r--r--nixos/modules/services/web-servers/nginx/default.nix29
-rw-r--r--nixos/modules/services/x11/window-managers/default.nix1
-rw-r--r--nixos/modules/services/x11/window-managers/tinywm.nix25
-rw-r--r--nixos/modules/system/boot/systemd.nix55
-rw-r--r--nixos/modules/virtualisation/libvirtd.nix15
-rw-r--r--nixos/tests/all-tests.nix2
-rw-r--r--nixos/tests/installer.nix28
-rw-r--r--nixos/tests/nginx-pubhtml.nix1
-rw-r--r--nixos/tests/nginx-sandbox.nix66
-rw-r--r--nixos/tests/privacyidea.nix36
-rw-r--r--pkgs/applications/audio/gspeech/default.nix73
-rw-r--r--pkgs/applications/audio/synthv1/default.nix4
-rw-r--r--pkgs/applications/blockchains/ledger-live-desktop/default.nix4
-rw-r--r--pkgs/applications/editors/emacs-modes/emacspeak/default.nix11
-rw-r--r--pkgs/applications/editors/emacs-modes/hol_light/default.nix29
-rw-r--r--pkgs/applications/editors/emacs-modes/libgenerated.nix6
-rw-r--r--pkgs/applications/editors/emacs-modes/manual-packages.nix1
-rw-r--r--pkgs/applications/editors/lite/default.nix58
-rw-r--r--pkgs/applications/editors/vscode/generic.nix2
-rw-r--r--pkgs/applications/editors/vscode/vscode.nix6
-rw-r--r--pkgs/applications/editors/vscode/vscodium.nix6
-rw-r--r--pkgs/applications/graphics/krop/default.nix4
-rw-r--r--pkgs/applications/kde/kdegraphics-thumbnailers.nix2
-rw-r--r--pkgs/applications/misc/almanah/default.nix10
-rw-r--r--pkgs/applications/misc/cheat/default.nix6
-rw-r--r--pkgs/applications/misc/cpu-x/default.nix27
-rw-r--r--pkgs/applications/misc/lutris/chrootenv.nix3
-rw-r--r--pkgs/applications/misc/tilda/default.nix4
-rw-r--r--pkgs/applications/misc/translate-shell/default.nix4
-rw-r--r--pkgs/applications/misc/visidata/default.nix2
-rw-r--r--pkgs/applications/misc/worker/default.nix4
-rw-r--r--pkgs/applications/misc/xmrig/proxy.nix8
-rw-r--r--pkgs/applications/networking/browsers/firefox/common.nix5
-rw-r--r--pkgs/applications/networking/browsers/qutebrowser/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/cni/plugins.nix8
-rw-r--r--pkgs/applications/networking/cluster/helmsman/default.nix23
-rw-r--r--pkgs/applications/networking/cluster/minikube/default.nix8
-rw-r--r--pkgs/applications/networking/cluster/terraform/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/zoom-us/default.nix4
-rw-r--r--pkgs/applications/networking/openbazaar/client.nix57
-rw-r--r--pkgs/applications/networking/openbazaar/default.nix48
-rw-r--r--pkgs/applications/networking/znc/default.nix4
-rw-r--r--pkgs/applications/office/skrooge/default.nix4
-rw-r--r--pkgs/applications/office/zotero/default.nix4
-rw-r--r--pkgs/applications/science/electronics/verilator/default.nix4
-rw-r--r--pkgs/applications/science/math/wxmaxima/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/gh/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-machete/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/gitui/default.nix6
-rw-r--r--pkgs/applications/video/makemkv/default.nix6
-rw-r--r--pkgs/applications/virtualization/conmon/default.nix4
-rw-r--r--pkgs/applications/virtualization/cri-o/default.nix8
-rw-r--r--pkgs/applications/virtualization/gvisor/default.nix2
-rw-r--r--pkgs/applications/virtualization/podman/default.nix4
-rw-r--r--pkgs/applications/virtualization/podman/wrapper.nix2
-rw-r--r--pkgs/applications/window-managers/tinywm/default.nix51
-rw-r--r--pkgs/build-support/build-bazel-package/default.nix16
-rw-r--r--pkgs/development/compilers/gleam/default.nix6
-rw-r--r--pkgs/development/interpreters/clojure/babashka.nix8
-rw-r--r--pkgs/development/interpreters/j/default.nix9
-rw-r--r--pkgs/development/interpreters/wasmer/default.nix6
-rw-r--r--pkgs/development/libraries/cudd/cudd.patch14
-rw-r--r--pkgs/development/libraries/cudd/default.nix30
-rw-r--r--pkgs/development/libraries/libcello/default.nix12
-rw-r--r--pkgs/development/libraries/librealsense/default.nix4
-rw-r--r--pkgs/development/libraries/liburcu/default.nix4
-rw-r--r--pkgs/development/libraries/libvirt/default.nix5
-rw-r--r--pkgs/development/libraries/science/math/sympow/default.nix4
-rw-r--r--pkgs/development/libraries/sentencepiece/default.nix4
-rw-r--r--pkgs/development/libraries/webkitgtk/default.nix1
-rw-r--r--pkgs/development/ocaml-modules/fiat-p256/default.nix26
-rw-r--r--pkgs/development/ocaml-modules/hacl_x25519/default.nix23
-rw-r--r--pkgs/development/ocaml-modules/hkdf/default.nix26
-rw-r--r--pkgs/development/ocaml-modules/janestreet/re2.nix20
-rw-r--r--pkgs/development/ocaml-modules/mdx/default.nix9
-rw-r--r--pkgs/development/ocaml-modules/re2/Makefile.patch17
-rw-r--r--pkgs/development/ocaml-modules/re2/default.nix29
-rw-r--r--pkgs/development/ocaml-modules/re2/myocamlbuild.patch24
-rw-r--r--pkgs/development/ocaml-modules/tls/default.nix16
-rw-r--r--pkgs/development/ocaml-modules/wasm/default.nix6
-rw-r--r--pkgs/development/python-modules/apache-airflow/default.nix3
-rw-r--r--pkgs/development/python-modules/asdf/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-core/default.nix4
-rw-r--r--pkgs/development/python-modules/bidict/default.nix4
-rw-r--r--pkgs/development/python-modules/dict2xml/default.nix4
-rw-r--r--pkgs/development/python-modules/dm-sonnet/default.nix2
-rw-r--r--pkgs/development/python-modules/dotnetcore2/default.nix14
-rw-r--r--pkgs/development/python-modules/elasticsearch/default.nix4
-rw-r--r--pkgs/development/python-modules/flask-httpauth/default.nix4
-rw-r--r--pkgs/development/python-modules/flask-versioned/default.nix23
-rw-r--r--pkgs/development/python-modules/foolscap/default.nix4
-rw-r--r--pkgs/development/python-modules/h2/default.nix4
-rw-r--r--pkgs/development/python-modules/huey/default.nix25
-rw-r--r--pkgs/development/python-modules/intake/default.nix5
-rw-r--r--pkgs/development/python-modules/ipykernel/default.nix3
-rw-r--r--pkgs/development/python-modules/itypes/default.nix4
-rw-r--r--pkgs/development/python-modules/m3u8/default.nix4
-rw-r--r--pkgs/development/python-modules/mail-parser/default.nix10
-rw-r--r--pkgs/development/python-modules/msal/default.nix4
-rw-r--r--pkgs/development/python-modules/msgpack-numpy/default.nix2
-rw-r--r--pkgs/development/python-modules/numpy-stl/default.nix2
-rw-r--r--pkgs/development/python-modules/parse/default.nix4
-rw-r--r--pkgs/development/python-modules/pgspecial/default.nix2
-rw-r--r--pkgs/development/python-modules/phonenumbers/default.nix4
-rw-r--r--pkgs/development/python-modules/pikepdf/default.nix2
-rw-r--r--pkgs/development/python-modules/privacyidea/default.nix51
-rw-r--r--pkgs/development/python-modules/privacyidea/ldap-proxy.nix27
-rw-r--r--pkgs/development/python-modules/pydantic/default.nix4
-rw-r--r--pkgs/development/python-modules/pydocstyle/default.nix4
-rw-r--r--pkgs/development/python-modules/pygit2/default.nix4
-rw-r--r--pkgs/development/python-modules/pyhcl/default.nix4
-rw-r--r--pkgs/development/python-modules/pylatexenc/default.nix4
-rw-r--r--pkgs/development/python-modules/pylint-django/default.nix4
-rw-r--r--pkgs/development/python-modules/pymediainfo/default.nix4
-rw-r--r--pkgs/development/python-modules/pyrad/default.nix27
-rw-r--r--pkgs/development/python-modules/pysmbc/default.nix2
-rw-r--r--pkgs/development/python-modules/pysolr/default.nix4
-rw-r--r--pkgs/development/python-modules/qiskit-aer/default.nix17
-rw-r--r--pkgs/development/python-modules/qiskit-aqua/default.nix76
-rw-r--r--pkgs/development/python-modules/qiskit-ibmq-provider/default.nix4
-rw-r--r--pkgs/development/python-modules/qiskit-ignis/default.nix4
-rw-r--r--pkgs/development/python-modules/qiskit-terra/default.nix8
-rw-r--r--pkgs/development/python-modules/qiskit/default.nix4
-rw-r--r--pkgs/development/python-modules/scikitlearn/default.nix19
-rw-r--r--pkgs/development/python-modules/smpplib/default.nix29
-rw-r--r--pkgs/development/python-modules/sqlsoup/default.nix21
-rw-r--r--pkgs/development/python-modules/tensorflow-probability/default.nix2
-rw-r--r--pkgs/development/python-modules/tensorflow/1/default.nix4
-rw-r--r--pkgs/development/python-modules/tensorflow/2/default.nix4
-rw-r--r--pkgs/development/python-modules/unrpa/default.nix24
-rw-r--r--pkgs/development/tools/bazel-watcher/default.nix2
-rw-r--r--pkgs/development/tools/build-managers/bazel/bazel-remote/default.nix2
-rw-r--r--pkgs/development/tools/buildah/default.nix13
-rw-r--r--pkgs/development/tools/database/squirrel-sql/default.nix4
-rw-r--r--pkgs/development/tools/golangci-lint/default.nix6
-rw-r--r--pkgs/development/tools/kind/default.nix10
-rw-r--r--pkgs/development/tools/kind/deps.nix741
-rw-r--r--pkgs/development/tools/ocaml/ocamlformat/default.nix4
-rw-r--r--pkgs/development/tools/skopeo/default.nix9
-rw-r--r--pkgs/development/tools/vultr/default.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/hardened/patches.json20
-rwxr-xr-xpkgs/os-specific/linux/kernel/hardened/update.py9
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rpi.nix2
-rwxr-xr-xpkgs/os-specific/linux/nvidia-x11/builder.sh13
-rw-r--r--pkgs/servers/blockbook/default.nix24
-rw-r--r--pkgs/servers/blockbook/deps.nix372
-rw-r--r--pkgs/servers/http/nginx/modules.nix3
-rw-r--r--pkgs/servers/misc/airsonic/default.nix4
-rw-r--r--pkgs/servers/monitoring/sensu-go/default.nix6
-rw-r--r--pkgs/servers/monitoring/zabbix/agent.nix2
-rw-r--r--pkgs/servers/monitoring/zabbix/proxy.nix2
-rw-r--r--pkgs/servers/monitoring/zabbix/server.nix2
-rw-r--r--pkgs/servers/monitoring/zabbix/web.nix2
-rw-r--r--pkgs/servers/serviio/default.nix4
-rw-r--r--pkgs/servers/sip/freeswitch/default.nix7
-rw-r--r--pkgs/servers/tautulli/default.nix4
-rw-r--r--pkgs/shells/nushell/default.nix6
-rw-r--r--pkgs/shells/zsh/oh-my-zsh/default.nix6
-rw-r--r--pkgs/tools/X11/wpgtk/default.nix4
-rw-r--r--pkgs/tools/X11/xpra/default.nix4
-rw-r--r--pkgs/tools/admin/eksctl/default.nix6
-rw-r--r--pkgs/tools/admin/exoscale-cli/default.nix32
-rw-r--r--pkgs/tools/admin/exoscale-cli/deps.nix876
-rw-r--r--pkgs/tools/admin/lego/default.nix6
-rw-r--r--pkgs/tools/admin/procs/default.nix6
-rw-r--r--pkgs/tools/admin/salt/default.nix4
-rw-r--r--pkgs/tools/backup/monolith/default.nix6
-rw-r--r--pkgs/tools/filesystems/fuse-overlayfs/default.nix2
-rw-r--r--pkgs/tools/misc/bat/default.nix11
-rw-r--r--pkgs/tools/misc/bat/macos.patch13
-rw-r--r--pkgs/tools/misc/clipman/default.nix4
-rw-r--r--pkgs/tools/misc/ffsend/default.nix6
-rw-r--r--pkgs/tools/misc/vttest/default.nix4
-rw-r--r--pkgs/tools/networking/aria2/default.nix7
-rw-r--r--pkgs/tools/networking/urlwatch/default.nix4
-rw-r--r--pkgs/tools/nix/nixos-generators/default.nix4
-rw-r--r--pkgs/tools/package-management/home-manager/default.nix1
-rw-r--r--pkgs/tools/package-management/nix/default.nix15
-rw-r--r--pkgs/tools/system/syslog-ng/default.nix4
-rw-r--r--pkgs/tools/system/uefitool/variants.nix8
-rw-r--r--pkgs/top-level/all-packages.nix19
-rw-r--r--pkgs/top-level/ocaml-packages.nix15
-rw-r--r--pkgs/top-level/perl-packages.nix13
-rw-r--r--pkgs/top-level/python-packages.nix15
197 files changed, 2754 insertions, 1663 deletions
diff --git a/lib/default.nix b/lib/default.nix
index d00c4abec0a9..e7f59a67abbd 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -141,7 +141,7 @@ let
       mergeAttrsWithFunc mergeAttrsConcatenateValues
       mergeAttrsNoOverride mergeAttrByFunc mergeAttrsByFuncDefaults
       mergeAttrsByFuncDefaultsClean mergeAttrBy
-      fakeSri fakeSha256 fakeSha512
+      fakeHash fakeSha256 fakeSha512
       nixType imap;
     inherit (versions)
       splitVersion;
diff --git a/lib/deprecated.nix b/lib/deprecated.nix
index 8c4fe9c390c6..be0ef904c66d 100644
--- a/lib/deprecated.nix
+++ b/lib/deprecated.nix
@@ -272,7 +272,7 @@ rec {
   imap = imap1;
 
   # Fake hashes. Can be used as hash placeholders, when computing hash ahead isn't trivial
-  fakeSri = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+  fakeHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
   fakeSha256 = "0000000000000000000000000000000000000000000000000000000000000000";
   fakeSha512 = "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000";
 }
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 58ca670ad424..cc2ea541d697 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2044,6 +2044,12 @@
     githubId = 108501;
     name = "David Pflug";
   };
+  dramaturg = {
+    email = "seb@ds.ag";
+    github = "dramaturg";
+    githubId = 472846;
+    name = "Sebastian Krohn";
+  };
   drets = {
     email = "dmitryrets@gmail.com";
     github = "drets";
@@ -2482,7 +2488,7 @@
   };
   evils = {
     email = "evils.devils@protonmail.com";
-    github = "evils-devils";
+    github = "evils";
     githubId = 30512529;
     name = "Evils";
   };
@@ -4609,6 +4615,12 @@
     githubId = 2057309;
     name = "Sergey Sofeychuk";
   };
+  lynty = {
+    email = "ltdong93+nix@gmail.com";
+    github = "lynty";
+    githubId = 39707188;
+    name = "Lynn Dong";
+  };
   lyt = {
     email = "wheatdoge@gmail.com";
     name = "Tim Liou";
@@ -7130,6 +7142,12 @@
     githubId = 1505617;
     name = "Sean Lee";
   };
+  SlothOfAnarchy = {
+    email = "slothofanarchy1@gmail.com";
+    github = "SlothOfAnarchy";
+    githubId = 12828415;
+    name = "Michel Weitbrecht";
+  };
   smakarov = {
     email = "setser200018@gmail.com";
     github = "setser";
diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml
index 3673f6e0d9c9..5b1d04e4bc16 100644
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@@ -235,7 +235,16 @@ php.override {
        Be aware that backwards state migrations are not supported by Deluge.
      </para>
    </listitem>
-
+   <listitem>
+     <para>
+       Add option <literal>services.nginx.enableSandbox</literal> to starting Nginx web server with additional sandbox/hardening options.
+       By default, write access to <literal>services.nginx.stateDir</literal> is allowed. To allow writing to other folders,
+       use <literal>systemd.services.nginx.serviceConfig.ReadWritePaths</literal>
+       <programlisting>
+systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
+       </programlisting>
+     </para>
+   </listitem>
    <listitem>
     <para>
       The NixOS options <literal>nesting.clone</literal> and
@@ -335,6 +344,15 @@ php.override {
       your configuration simply remove the quotes around the numbers.
     </para>
    </listitem>
+   <listitem>
+    <para>
+      When using <literal>buildBazelPackage</literal> from Nixpkgs,
+      <literal>flat</literal> hash mode is now used for dependencies
+      instead of <literal>recursive</literal>. This is to better allow
+      using hashed mirrors where needed. As a result, these hashes
+      will have changed.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 
diff --git a/nixos/modules/hardware/video/nvidia.nix b/nixos/modules/hardware/video/nvidia.nix
index 8c3d64fceb9c..6328971492c5 100644
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@@ -52,6 +52,15 @@ in
     ];
 
   options = {
+    hardware.nvidia.powerManagement.enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Experimental power management through systemd. For more information, see
+        the NVIDIA docs, on Chapter 21. Configuring Power Management Support.
+      '';
+    };
+
     hardware.nvidia.modesetting.enable = mkOption {
       type = types.bool;
       default = false;
@@ -226,23 +235,51 @@ in
     environment.systemPackages = [ nvidia_x11.bin nvidia_x11.settings ]
       ++ filter (p: p != null) [ nvidia_x11.persistenced ];
 
+    systemd.packages = optional cfg.powerManagement.enable nvidia_x11.out;
+
+    systemd.services = let
+      baseNvidiaService = state: {
+        description = "NVIDIA system ${state} actions";
+
+        path = with pkgs; [ kbd ];
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = "${nvidia_x11.out}/bin/nvidia-sleep.sh '${state}'";
+        };
+      };
+
+      nvidiaService = sleepState: (baseNvidiaService sleepState) // {
+        before = [ "systemd-${sleepState}.service" ];
+        requiredBy = [ "systemd-${sleepState}.service" ];
+      };
+
+      services = (builtins.listToAttrs (map (t: nameValuePair "nvidia-${t}" (nvidiaService t)) ["hibernate" "suspend"]))
+        // {
+          nvidia-resume = (baseNvidiaService "resume") // {
+            after = [ "systemd-suspend.service" "systemd-hibernate.service" ];
+            requiredBy = [ "systemd-suspend.service" "systemd-hibernate.service" ];
+          };
+        };
+    in optionalAttrs cfg.powerManagement.enable services
+      // optionalAttrs nvidiaPersistencedEnabled {
+        "nvidia-persistenced" = mkIf nvidiaPersistencedEnabled {
+          description = "NVIDIA Persistence Daemon";
+          wantedBy = [ "multi-user.target" ];
+          serviceConfig = {
+            Type = "forking";
+            Restart = "always";
+            PIDFile = "/var/run/nvidia-persistenced/nvidia-persistenced.pid";
+            ExecStart = "${nvidia_x11.persistenced}/bin/nvidia-persistenced --verbose";
+            ExecStopPost = "${pkgs.coreutils}/bin/rm -rf /var/run/nvidia-persistenced";
+          };
+        };
+      };
+
     systemd.tmpfiles.rules = optional config.virtualisation.docker.enableNvidia
         "L+ /run/nvidia-docker/bin - - - - ${nvidia_x11.bin}/origBin"
       ++ optional (nvidia_x11.persistenced != null && config.virtualisation.docker.enableNvidia)
         "L+ /run/nvidia-docker/extras/bin/nvidia-persistenced - - - - ${nvidia_x11.persistenced}/origBin/nvidia-persistenced";
 
-    systemd.services."nvidia-persistenced" = mkIf nvidiaPersistencedEnabled {
-      description = "NVIDIA Persistence Daemon";
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        Type = "forking";
-        Restart = "always";
-        PIDFile = "/var/run/nvidia-persistenced/nvidia-persistenced.pid";
-        ExecStart = "${nvidia_x11.persistenced}/bin/nvidia-persistenced --verbose";
-        ExecStopPost = "${pkgs.coreutils}/bin/rm -rf /var/run/nvidia-persistenced";
-      };
-    };
-
     boot.extraModulePackages = [ nvidia_x11.bin ];
 
     # nvidia-uvm is required by CUDA applications.
@@ -250,7 +287,8 @@ in
       optionals config.services.xserver.enable [ "nvidia" "nvidia_modeset" "nvidia_drm" ];
 
     # If requested enable modesetting via kernel parameter.
-    boot.kernelParams = optional (offloadCfg.enable || cfg.modesetting.enable) "nvidia-drm.modeset=1";
+    boot.kernelParams = optional (offloadCfg.enable || cfg.modesetting.enable) "nvidia-drm.modeset=1"
+      ++ optional cfg.powerManagement.enable "nvidia.NVreg_PreserveVideoMemoryAllocations=1";
 
     # Create /dev/nvidia-uvm when the nvidia-uvm module is loaded.
     services.udev.extraRules =
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 40904ef0c175..5adbc26522cf 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -792,6 +792,7 @@
   ./services/security/nginx-sso.nix
   ./services/security/oauth2_proxy.nix
   ./services/security/oauth2_proxy_nginx.nix
+  ./services/security/privacyidea.nix
   ./services/security/physlock.nix
   ./services/security/shibboleth-sp.nix
   ./services/security/sks.nix
diff --git a/nixos/modules/security/doas.nix b/nixos/modules/security/doas.nix
index 1991a58db60d..b81f2d0c2d52 100644
--- a/nixos/modules/security/doas.nix
+++ b/nixos/modules/security/doas.nix
@@ -223,7 +223,7 @@ in
 
   config = mkIf cfg.enable {
 
-    security.doas.extraRules = [
+    security.doas.extraRules = mkOrder 600 [
       {
         groups = [ "wheel" ];
         noPass = !cfg.wheelNeedsPassword;
diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index b99316803f35..e1a94b0121ac 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -54,7 +54,7 @@ let
         description = ''
           If set, users listed in
           <filename>~/.yubico/authorized_yubikeys</filename>
-          are able to log in with the asociated Yubikey tokens.
+          are able to log in with the associated Yubikey tokens.
         '';
       };
 
diff --git a/nixos/modules/services/backup/znapzend.nix b/nixos/modules/services/backup/znapzend.nix
index 98cd647f61ac..8098617d11f3 100644
--- a/nixos/modules/services/backup/znapzend.nix
+++ b/nixos/modules/services/backup/znapzend.nix
@@ -268,7 +268,8 @@ let
 
   mkSrcAttrs = srcCfg: with srcCfg; {
     enabled = onOff enable;
-    mbuffer = with mbuffer; if enable then "${pkgs.mbuffer}/bin/mbuffer"
+    # mbuffer is not referenced by its full path to accomodate non-NixOS systems or differing mbuffer versions between source and target
+    mbuffer = with mbuffer; if enable then "mbuffer"
         + optionalString (port != null) ":${toString port}" else "off";
     mbuffer_size = mbuffer.size;
     post_znap_cmd = nullOff postsnap;
@@ -357,6 +358,12 @@ in
         default = false;
       };
 
+      features.oracleMode = mkEnableOption ''
+        Destroy snapshots one by one instead of using one long argument list.
+        If source and destination are out of sync for a long time, you may have
+        so many snapshots to destroy that the argument gets is too long and the
+        command fails.
+      '';
       features.recvu = mkEnableOption ''
         recvu feature which uses <literal>-u</literal> on the receiving end to keep the destination
         filesystem unmounted.
@@ -458,5 +465,5 @@ in
     };
   };
 
-  meta.maintainers = with maintainers; [ infinisil ];
+  meta.maintainers = with maintainers; [ infinisil SlothOfAnarchy ];
 }
diff --git a/nixos/modules/services/databases/postgresql.nix b/nixos/modules/services/databases/postgresql.nix
index 93f5c1ca5f55..982480fbd99c 100644
--- a/nixos/modules/services/databases/postgresql.nix
+++ b/nixos/modules/services/databases/postgresql.nix
@@ -17,6 +17,7 @@ let
       hba_file = '${pkgs.writeText "pg_hba.conf" cfg.authentication}'
       ident_file = '${pkgs.writeText "pg_ident.conf" cfg.identMap}'
       log_destination = 'stderr'
+      log_line_prefix = '${cfg.logLinePrefix}'
       listen_addresses = '${if cfg.enableTCPIP then "*" else "localhost"}'
       port = ${toString cfg.port}
       ${cfg.extraConfig}
@@ -186,6 +187,17 @@ in
         '';
       };
 
+      logLinePrefix = mkOption {
+        type = types.str;
+        default = "[%p] ";
+        example = "%m [%p] ";
+        description = ''
+          A printf-style string that is output at the beginning of each log line.
+          Upstream default is <literal>'%m [%p] '</literal>, i.e. it includes the timestamp. We do
+          not include the timestamp, because journal has it anyway.
+        '';
+      };
+
       extraPlugins = mkOption {
         type = types.listOf types.path;
         default = [];
diff --git a/nixos/modules/services/network-filesystems/ipfs.nix b/nixos/modules/services/network-filesystems/ipfs.nix
index 880f70ae1410..1f5c14d777d7 100644
--- a/nixos/modules/services/network-filesystems/ipfs.nix
+++ b/nixos/modules/services/network-filesystems/ipfs.nix
@@ -217,6 +217,9 @@ in {
         createHome = false;
         uid = config.ids.uids.ipfs;
         description = "IPFS daemon user";
+        packages = [
+          pkgs.ipfs-migrator
+        ];
       };
     };
 
diff --git a/nixos/modules/services/networking/pixiecore.nix b/nixos/modules/services/networking/pixiecore.nix
index 0e32f182e2a1..85aa40784af8 100644
--- a/nixos/modules/services/networking/pixiecore.nix
+++ b/nixos/modules/services/networking/pixiecore.nix
@@ -115,7 +115,7 @@ in
               if cfg.mode == "boot"
               then [ "boot" cfg.kernel ]
                    ++ optional (cfg.initrd != "") cfg.initrd
-                   ++ optional (cfg.cmdLine != "") "--cmdline=${lib.escapeShellArg cfg.cmdLine}"
+                   ++ optionals (cfg.cmdLine != "") [ "--cmdline" cfg.cmdLine ]
               else [ "api" cfg.apiServer ];
           in
             ''
diff --git a/nixos/modules/services/security/privacyidea.nix b/nixos/modules/services/security/privacyidea.nix
new file mode 100644
index 000000000000..d6abfd0e2718
--- /dev/null
+++ b/nixos/modules/services/security/privacyidea.nix
@@ -0,0 +1,279 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.privacyidea;
+
+  uwsgi = pkgs.uwsgi.override { plugins = [ "python3" ]; };
+  python = uwsgi.python3;
+  penv = python.withPackages (ps: [ ps.privacyidea ]);
+  logCfg = pkgs.writeText "privacyidea-log.cfg" ''
+    [formatters]
+    keys=detail
+
+    [handlers]
+    keys=stream
+
+    [formatter_detail]
+    class=privacyidea.lib.log.SecureFormatter
+    format=[%(asctime)s][%(process)d][%(thread)d][%(levelname)s][%(name)s:%(lineno)d] %(message)s
+
+    [handler_stream]
+    class=StreamHandler
+    level=NOTSET
+    formatter=detail
+    args=(sys.stdout,)
+
+    [loggers]
+    keys=root,privacyidea
+
+    [logger_privacyidea]
+    handlers=stream
+    qualname=privacyidea
+    level=INFO
+
+    [logger_root]
+    handlers=stream
+    level=ERROR
+  '';
+
+  piCfgFile = pkgs.writeText "privacyidea.cfg" ''
+    SUPERUSER_REALM = [ '${concatStringsSep "', '" cfg.superuserRealm}' ]
+    SQLALCHEMY_DATABASE_URI = 'postgresql:///privacyidea'
+    SECRET_KEY = '${cfg.secretKey}'
+    PI_PEPPER = '${cfg.pepper}'
+    PI_ENCFILE = '${cfg.encFile}'
+    PI_AUDIT_KEY_PRIVATE = '${cfg.auditKeyPrivate}'
+    PI_AUDIT_KEY_PUBLIC = '${cfg.auditKeyPublic}'
+    PI_LOGCONFIG = '${logCfg}'
+    ${cfg.extraConfig}
+  '';
+
+in
+
+{
+  options = {
+    services.privacyidea = {
+      enable = mkEnableOption "PrivacyIDEA";
+
+      stateDir = mkOption {
+        type = types.str;
+        default = "/var/lib/privacyidea";
+        description = ''
+          Directory where all PrivacyIDEA files will be placed by default.
+        '';
+      };
+
+      superuserRealm = mkOption {
+        type = types.listOf types.str;
+        default = [ "super" "administrators" ];
+        description = ''
+          The realm where users are allowed to login as administrators.
+        '';
+      };
+
+      secretKey = mkOption {
+        type = types.str;
+        example = "t0p s3cr3t";
+        description = ''
+          This is used to encrypt the auth_token.
+        '';
+      };
+
+      pepper = mkOption {
+        type = types.str;
+        example = "Never know...";
+        description = ''
+          This is used to encrypt the admin passwords.
+        '';
+      };
+
+      encFile = mkOption {
+        type = types.str;
+        default = "${cfg.stateDir}/enckey";
+        description = ''
+          This is used to encrypt the token data and token passwords
+        '';
+      };
+
+      auditKeyPrivate = mkOption {
+        type = types.str;
+        default = "${cfg.stateDir}/private.pem";
+        description = ''
+          Private Key for signing the audit log.
+        '';
+      };
+
+      auditKeyPublic = mkOption {
+        type = types.str;
+        default = "${cfg.stateDir}/public.pem";
+        description = ''
+          Public key for checking signatures of the audit log.
+        '';
+      };
+
+      adminPasswordFile = mkOption {
+        type = types.path;
+        description = "File containing password for the admin user";
+      };
+
+      adminEmail = mkOption {
+        type = types.str;
+        example = "admin@example.com";
+        description = "Mail address for the admin user";
+      };
+
+      extraConfig = mkOption {
+        type = types.lines;
+        default = "";
+        description = ''
+          Extra configuration options for pi.cfg.
+        '';
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "privacyidea";
+        description = "User account under which PrivacyIDEA runs.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "privacyidea";
+        description = "Group account under which PrivacyIDEA runs.";
+      };
+
+      ldap-proxy = {
+        enable = mkEnableOption "PrivacyIDEA LDAP Proxy";
+
+        configFile = mkOption {
+          type = types.path;
+          default = "";
+          description = ''
+            Path to PrivacyIDEA LDAP Proxy configuration (proxy.ini).
+          '';
+        };
+
+        user = mkOption {
+          type = types.str;
+          default = "pi-ldap-proxy";
+          description = "User account under which PrivacyIDEA LDAP proxy runs.";
+        };
+
+        group = mkOption {
+          type = types.str;
+          default = "pi-ldap-proxy";
+          description = "Group account under which PrivacyIDEA LDAP proxy runs.";
+        };
+      };
+    };
+  };
+
+  config = mkMerge [
+
+    (mkIf cfg.enable {
+
+      environment.systemPackages = [ python.pkgs.privacyidea ];
+
+      services.postgresql.enable = mkDefault true;
+
+      systemd.services.privacyidea = let
+        piuwsgi = pkgs.writeText "uwsgi.json" (builtins.toJSON {
+          uwsgi = {
+            plugins = [ "python3" ];
+            pythonpath = "${penv}/${uwsgi.python3.sitePackages}";
+            socket = "/run/privacyidea/socket";
+            uid = cfg.user;
+            gid = cfg.group;
+            chmod-socket = 770;
+            chown-socket = "${cfg.user}:nginx";
+            chdir = cfg.stateDir;
+            wsgi-file = "${penv}/etc/privacyidea/privacyideaapp.wsgi";
+            processes = 4;
+            harakiri = 60;
+            reload-mercy = 8;
+            stats = "/run/privacyidea/stats.socket";
+            max-requests = 2000;
+            limit-as = 1024;
+            reload-on-as = 512;
+            reload-on-rss = 256;
+            no-orphans = true;
+            vacuum = true;
+          };
+        });
+      in {
+        wantedBy = [ "multi-user.target" ];
+        after = [ "postgresql.service" ];
+        path = with pkgs; [ openssl ];
+        environment.PRIVACYIDEA_CONFIGFILE = piCfgFile;
+        preStart = let
+          pi-manage = "${pkgs.sudo}/bin/sudo -u privacyidea -HE ${penv}/bin/pi-manage";
+          pgsu = config.services.postgresql.superUser;
+          psql = config.services.postgresql.package;
+        in ''
+          mkdir -p ${cfg.stateDir} /run/privacyidea
+          chown ${cfg.user}:${cfg.group} -R ${cfg.stateDir} /run/privacyidea
+          if ! test -e "${cfg.stateDir}/db-created"; then
+            ${pkgs.sudo}/bin/sudo -u ${pgsu} ${psql}/bin/createuser --no-superuser --no-createdb --no-createrole ${cfg.user}
+            ${pkgs.sudo}/bin/sudo -u ${pgsu} ${psql}/bin/createdb --owner ${cfg.user} privacyidea
+            ${pi-manage} create_enckey
+            ${pi-manage} create_audit_keys
+            ${pi-manage} createdb
+            ${pi-manage} admin add admin -e ${cfg.adminEmail} -p "$(cat ${cfg.adminPasswordFile})"
+            ${pi-manage} db stamp head -d ${penv}/lib/privacyidea/migrations
+            touch "${cfg.stateDir}/db-created"
+            chmod g+r "${cfg.stateDir}/enckey" "${cfg.stateDir}/private.pem"
+          fi
+          ${pi-manage} db upgrade -d ${penv}/lib/privacyidea/migrations
+        '';
+        serviceConfig = {
+          Type = "notify";
+          ExecStart = "${uwsgi}/bin/uwsgi --json ${piuwsgi}";
+          ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+          ExecStop = "${pkgs.coreutils}/bin/kill -INT $MAINPID";
+          NotifyAccess = "main";
+          KillSignal = "SIGQUIT";
+          StandardError = "syslog";
+        };
+      };
+
+      users.users.privacyidea = mkIf (cfg.user == "privacyidea") {
+        group = cfg.group;
+      };
+
+      users.groups.privacyidea = mkIf (cfg.group == "privacyidea") {};
+    })
+
+    (mkIf cfg.ldap-proxy.enable {
+
+      systemd.services.privacyidea-ldap-proxy = let
+        ldap-proxy-env = pkgs.python2.withPackages (ps: [ ps.privacyidea-ldap-proxy ]);
+      in {
+        description = "privacyIDEA LDAP proxy";
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          User = cfg.ldap-proxy.user;
+          Group = cfg.ldap-proxy.group;
+          ExecStart = ''
+            ${ldap-proxy-env}/bin/twistd \
+              --nodaemon \
+              --pidfile= \
+              -u ${cfg.ldap-proxy.user} \
+              -g ${cfg.ldap-proxy.group} \
+              ldap-proxy \
+              -c ${cfg.ldap-proxy.configFile}
+          '';
+          Restart = "always";
+        };
+      };
+
+      users.users.pi-ldap-proxy = mkIf (cfg.ldap-proxy.user == "pi-ldap-proxy") {
+        group = cfg.ldap-proxy.group;
+      };
+
+      users.groups.pi-ldap-proxy = mkIf (cfg.ldap-proxy.group == "pi-ldap-proxy") {};
+    })
+  ];
+
+}
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 1e9cda7e4785..312d2b0a21a7 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -463,6 +463,14 @@ in
         '';
       };
 
+      enableSandbox = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Starting Nginx web server with additional sandbox/hardening options.
+        '';
+      };
+
       user = mkOption {
         type = types.str;
         default = "nginx";
@@ -710,6 +718,27 @@ in
         LogsDirectoryMode = "0750";
         # Capabilities
         AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" "CAP_SYS_RESOURCE" ];
+        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" "CAP_SYS_RESOURCE" ];
+        # Security
+        NoNewPrivileges = true;
+      } // optionalAttrs cfg.enableSandbox {
+        # Sandboxing
+        ProtectSystem = "strict";
+        ProtectHome = mkDefault true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectHostname = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+        LockPersonality = true;
+        MemoryDenyWriteExecute = !(builtins.any (mod: (mod.allowMemoryWriteExecute or false)) pkgs.nginx.modules);
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        PrivateMounts = true;
+        # System Call Filtering
+        SystemCallArchitectures = "native";
       };
     };
 
diff --git a/nixos/modules/services/x11/window-managers/default.nix b/nixos/modules/services/x11/window-managers/default.nix
index 04a9fc46628c..b815c5f16a1e 100644
--- a/nixos/modules/services/x11/window-managers/default.nix
+++ b/nixos/modules/services/x11/window-managers/default.nix
@@ -30,6 +30,7 @@ in
     ./sawfish.nix
     ./stumpwm.nix
     ./spectrwm.nix
+    ./tinywm.nix
     ./twm.nix
     ./windowmaker.nix
     ./wmii.nix
diff --git a/nixos/modules/services/x11/window-managers/tinywm.nix b/nixos/modules/services/x11/window-managers/tinywm.nix
new file mode 100644
index 000000000000..8e5d9b9170ca
--- /dev/null
+++ b/nixos/modules/services/x11/window-managers/tinywm.nix
@@ -0,0 +1,25 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.xserver.windowManager.tinywm;
+in
+{
+  ###### interface
+  options = {
+    services.xserver.windowManager.tinywm.enable = mkEnableOption "tinywm";
+  };
+
+  ###### implementation
+  config = mkIf cfg.enable {
+    services.xserver.windowManager.session = singleton {
+      name = "tinywm";
+      start = ''
+        ${pkgs.tinywm}/bin/tinywm &
+        waitPID=$!
+      '';
+    };
+    environment.systemPackages = [ pkgs.tinywm ];
+  };
+}
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index ffc5387e8102..36a25c4e6c3a 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -201,8 +201,23 @@ let
     ];
 
   makeJobScript = name: text:
-    let mkScriptName =  s: "unit-script-" + (replaceChars [ "\\" "@" ] [ "-" "_" ] (shellEscape s) );
-    in  pkgs.writeTextFile { name = mkScriptName name; executable = true; inherit text; };
+    let
+      scriptName = replaceChars [ "\\" "@" ] [ "-" "_" ] (shellEscape name);
+      out = pkgs.writeTextFile {
+        # The derivation name is different from the script file name
+        # to keep the script file name short to avoid cluttering logs.
+        name = "unit-script-${scriptName}";
+        executable = true;
+        destination = "/bin/${scriptName}";
+        text = ''
+          #!${pkgs.runtimeShell} -e
+          ${text}
+        '';
+        checkPhase = ''
+          ${pkgs.stdenv.shell} -n "$out/bin/${scriptName}"
+        '';
+      };
+    in "${out}/bin/${scriptName}";
 
   unitConfig = { config, options, ... }: {
     config = {
@@ -250,40 +265,28 @@ let
           environment.PATH = config.path;
         }
         (mkIf (config.preStart != "")
-          { serviceConfig.ExecStartPre = makeJobScript "${name}-pre-start" ''
-              #! ${pkgs.runtimeShell} -e
-              ${config.preStart}
-            '';
+          { serviceConfig.ExecStartPre =
+              makeJobScript "${name}-pre-start" config.preStart;
           })
         (mkIf (config.script != "")
-          { serviceConfig.ExecStart = makeJobScript "${name}-start" ''
-              #! ${pkgs.runtimeShell} -e
-              ${config.script}
-            '' + " " + config.scriptArgs;
+          { serviceConfig.ExecStart =
+              makeJobScript "${name}-start" config.script + " " + config.scriptArgs;
           })
         (mkIf (config.postStart != "")
-          { serviceConfig.ExecStartPost = makeJobScript "${name}-post-start" ''
-              #! ${pkgs.runtimeShell} -e
-              ${config.postStart}
-            '';
+          { serviceConfig.ExecStartPost =
+              makeJobScript "${name}-post-start" config.postStart;
           })
         (mkIf (config.reload != "")
-          { serviceConfig.ExecReload = makeJobScript "${name}-reload" ''
-              #! ${pkgs.runtimeShell} -e
-              ${config.reload}
-            '';
+          { serviceConfig.ExecReload =
+              makeJobScript "${name}-reload" config.reload;
           })
         (mkIf (config.preStop != "")
-          { serviceConfig.ExecStop = makeJobScript "${name}-pre-stop" ''
-              #! ${pkgs.runtimeShell} -e
-              ${config.preStop}
-            '';
+          { serviceConfig.ExecStop =
+              makeJobScript "${name}-pre-stop" config.preStop;
           })
         (mkIf (config.postStop != "")
-          { serviceConfig.ExecStopPost = makeJobScript "${name}-post-stop" ''
-              #! ${pkgs.runtimeShell} -e
-              ${config.postStop}
-            '';
+          { serviceConfig.ExecStopPost =
+              makeJobScript "${name}-post-stop" config.postStop;
           })
       ];
   };
diff --git a/nixos/modules/virtualisation/libvirtd.nix b/nixos/modules/virtualisation/libvirtd.nix
index 4f22099443f4..f89e5d544b22 100644
--- a/nixos/modules/virtualisation/libvirtd.nix
+++ b/nixos/modules/virtualisation/libvirtd.nix
@@ -7,10 +7,8 @@ let
   cfg = config.virtualisation.libvirtd;
   vswitch = config.virtualisation.vswitch;
   configFile = pkgs.writeText "libvirtd.conf" ''
-    unix_sock_group = "libvirtd"
-    unix_sock_rw_perms = "0770"
-    auth_unix_ro = "none"
-    auth_unix_rw = "none"
+    auth_unix_ro = "polkit"
+    auth_unix_rw = "polkit"
     ${cfg.extraConfig}
   '';
   qemuConfigFile = pkgs.writeText "qemu.conf" ''
@@ -269,5 +267,14 @@ in {
 
     systemd.sockets.libvirtd    .wantedBy = [ "sockets.target" ];
     systemd.sockets.libvirtd-tcp.wantedBy = [ "sockets.target" ];
+
+    security.polkit.extraConfig = ''
+      polkit.addRule(function(action, subject) {
+        if (action.id == "org.libvirt.unix.manage" &&
+          subject.isInGroup("libvirtd")) {
+          return polkit.Result.YES;
+        }
+      });
+    '';
   };
 }
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 5a0c9d1afae1..f3e90f9bfa70 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -225,6 +225,7 @@ in
   nginx = handleTest ./nginx.nix {};
   nginx-etag = handleTest ./nginx-etag.nix {};
   nginx-pubhtml = handleTest ./nginx-pubhtml.nix {};
+  nginx-sandbox = handleTestOn ["x86_64-linux"] ./nginx-sandbox.nix {};
   nginx-sso = handleTest ./nginx-sso.nix {};
   nix-ssh-serve = handleTest ./nix-ssh-serve.nix {};
   nixos-generate-config = handleTest ./nixos-generate-config.nix {};
@@ -260,6 +261,7 @@ in
   pppd = handleTest ./pppd.nix {};
   predictable-interface-names = handleTest ./predictable-interface-names.nix {};
   printing = handleTest ./printing.nix {};
+  privacyidea = handleTest ./privacyidea.nix {};
   prometheus = handleTest ./prometheus.nix {};
   prometheus-exporters = handleTest ./prometheus-exporters.nix {};
   prosody = handleTest ./xmpp/prosody.nix {};
diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index 8d1bfa96d03d..eef9abebf9f2 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -97,7 +97,7 @@ let
 
 
       def create_machine_named(name):
-          return create_machine({**default_flags, "name": "boot-after-install"})
+          return create_machine({**default_flags, "name": name})
 
 
       machine.start()
@@ -650,6 +650,32 @@ in {
     '';
   };
 
+  bcache = makeInstallerTest "bcache" {
+    createPartitions = ''
+      machine.succeed(
+          "flock /dev/vda parted --script /dev/vda --"
+          + " mklabel msdos"
+          + " mkpart primary ext2 1M 50MB"  # /boot
+          + " mkpart primary 50MB 512MB  "  # swap
+          + " mkpart primary 512MB 1024MB"  # Cache (typically SSD)
+          + " mkpart primary 1024MB -1s ",  # Backing device (typically HDD)
+          "modprobe bcache",
+          "udevadm settle",
+          "make-bcache -B /dev/vda4 -C /dev/vda3",
+          "echo /dev/vda3 > /sys/fs/bcache/register",
+          "echo /dev/vda4 > /sys/fs/bcache/register",
+          "udevadm settle",
+          "mkfs.ext3 -L nixos /dev/bcache0",
+          "mount LABEL=nixos /mnt",
+          "mkfs.ext3 -L boot /dev/vda1",
+          "mkdir /mnt/boot",
+          "mount LABEL=boot /mnt/boot",
+          "mkswap -f /dev/vda2 -L swap",
+          "swapon -L swap",
+      )
+    '';
+  };
+
   # Test a basic install using GRUB 1.
   grub1 = makeInstallerTest "grub1" {
     createPartitions = ''
diff --git a/nixos/tests/nginx-pubhtml.nix b/nixos/tests/nginx-pubhtml.nix
index 432913cb42d2..6e1e605628e9 100644
--- a/nixos/tests/nginx-pubhtml.nix
+++ b/nixos/tests/nginx-pubhtml.nix
@@ -2,6 +2,7 @@ import ./make-test-python.nix {
   name = "nginx-pubhtml";
 
   machine = { pkgs, ... }: {
+    systemd.services.nginx.serviceConfig.ProtectHome = "read-only";
     services.nginx.enable = true;
     services.nginx.virtualHosts.localhost = {
       locations."~ ^/\\~([a-z0-9_]+)(/.*)?$".alias = "/home/$1/public_html$2";
diff --git a/nixos/tests/nginx-sandbox.nix b/nixos/tests/nginx-sandbox.nix
new file mode 100644
index 000000000000..bc9d3ba8add7
--- /dev/null
+++ b/nixos/tests/nginx-sandbox.nix
@@ -0,0 +1,66 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "nginx-sandbox";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ izorkin ];
+  };
+
+  # This test checks the creation and reading of a file in sandbox mode. Used simple lua script.
+
+  machine = { pkgs, ... }: {
+    nixpkgs.overlays = [
+      (self: super: {
+        nginx-lua = super.nginx.override {
+          modules = [
+            pkgs.nginxModules.lua
+          ];
+        };
+      })
+    ];
+    services.nginx.enable = true;
+    services.nginx.package = pkgs.nginx-lua;
+    services.nginx.enableSandbox = true;
+    services.nginx.virtualHosts.localhost = {
+      extraConfig = ''
+        location /test1-write {
+          content_by_lua_block {
+            local create = os.execute('${pkgs.coreutils}/bin/mkdir /tmp/test1-read')
+            local create = os.execute('${pkgs.coreutils}/bin/touch /tmp/test1-read/foo.txt')
+            local echo = os.execute('${pkgs.coreutils}/bin/echo worked > /tmp/test1-read/foo.txt')
+          }
+        }
+        location /test1-read {
+          root /tmp;
+        }
+        location /test2-write {
+          content_by_lua_block {
+            local create = os.execute('${pkgs.coreutils}/bin/mkdir /var/web/test2-read')
+            local create = os.execute('${pkgs.coreutils}/bin/touch /var/web/test2-read/bar.txt')
+            local echo = os.execute('${pkgs.coreutils}/bin/echo error-worked > /var/web/test2-read/bar.txt')
+          }
+        }
+        location /test2-read {
+          root /var/web;
+        }
+      '';
+    };
+    users.users.foo.isNormalUser = true;
+  };
+
+  testScript = ''
+    machine.wait_for_unit("nginx")
+    machine.wait_for_open_port(80)
+
+    # Checking write in temporary folder
+    machine.succeed("$(curl -vvv http://localhost/test1-write)")
+    machine.succeed('test "$(curl -fvvv http://localhost/test1-read/foo.txt)" = worked')
+
+    # Checking write in protected folder. In sandbox mode for the nginx service, the folder /var/web is mounted
+    # in read-only mode.
+    machine.succeed("mkdir -p /var/web")
+    machine.succeed("chown nginx:nginx /var/web")
+    machine.succeed("$(curl -vvv http://localhost/test2-write)")
+    assert "404 Not Found" in machine.succeed(
+        "curl -vvv -s http://localhost/test2-read/bar.txt"
+    )
+  '';
+})
diff --git a/nixos/tests/privacyidea.nix b/nixos/tests/privacyidea.nix
new file mode 100644
index 000000000000..45c7cd37c241
--- /dev/null
+++ b/nixos/tests/privacyidea.nix
@@ -0,0 +1,36 @@
+# Miscellaneous small tests that don't warrant their own VM run.
+
+import ./make-test-python.nix ({ pkgs, ...} : rec {
+  name = "privacyidea";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ fpletz ];
+  };
+
+  machine = { ... }: {
+    virtualisation.cores = 2;
+    virtualisation.memorySize = 512;
+
+    services.privacyidea = {
+      enable = true;
+      secretKey = "testing";
+      pepper = "testing";
+      adminPasswordFile = pkgs.writeText "admin-password" "testing";
+      adminEmail = "root@localhost";
+    };
+    services.nginx = {
+      enable = true;
+      virtualHosts."_".locations."/".extraConfig = ''
+        uwsgi_pass unix:/run/privacyidea/socket;
+      '';
+    };
+  };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("curl --fail http://localhost | grep privacyIDEA")
+    machine.succeed(
+        "curl --fail http://localhost/auth -F username=admin -F password=testing | grep token"
+    )
+  '';
+})
diff --git a/pkgs/applications/audio/gspeech/default.nix b/pkgs/applications/audio/gspeech/default.nix
new file mode 100644
index 000000000000..f51eb338d286
--- /dev/null
+++ b/pkgs/applications/audio/gspeech/default.nix
@@ -0,0 +1,73 @@
+{ lib
+, fetchFromGitHub
+, python3
+, gtk3
+, wrapGAppsHook
+, glibcLocales
+, gobject-introspection
+, gettext
+, pango
+, gdk-pixbuf
+, librsvg
+, atk
+, libnotify
+, libappindicator-gtk3
+, gst_all_1
+, makeWrapper
+, picotts
+, sox
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "gSpeech";
+  version = "0.9.2";
+
+  src = fetchFromGitHub {
+    owner = "mothsart";
+    repo = pname;
+    rev = version;
+    sha256 = "11pvdpb9jjssp8nmlj21gs7ncgfm89kw26mfc8c2x8w2q4h92ja3";
+  };
+
+  nativeBuildInputs = [
+    wrapGAppsHook
+    gobject-introspection
+    pango
+    gdk-pixbuf
+    atk
+    gettext
+    libnotify
+    libappindicator-gtk3
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
+    makeWrapper
+  ];
+
+  buildInputs = [
+    glibcLocales
+    gtk3
+    python3
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pygobject3
+    librsvg
+  ];
+
+  postFixup = ''
+    wrapProgram $out/bin/gspeech --prefix PATH : ${lib.makeBinPath [ picotts ]}
+    wrapProgram $out/bin/gspeech-cli --prefix PATH : ${lib.makeBinPath [ picotts ]}
+  '';
+
+  strictDeps = false;
+
+  meta = with lib; {
+    description = "A minimal GUI for the Text To Speech 'Svox Pico'. Read clipboard or selected text in different languages and manage it : pause, stop, replay.";
+    homepage = "https://github.com/mothsART/gSpeech";
+    maintainers = with maintainers; [ mothsart ];
+    license = licenses.gpl3;
+    platforms = platforms.unix;
+  };
+}
+
diff --git a/pkgs/applications/audio/synthv1/default.nix b/pkgs/applications/audio/synthv1/default.nix
index 6339dad7f378..c7e936d28e50 100644
--- a/pkgs/applications/audio/synthv1/default.nix
+++ b/pkgs/applications/audio/synthv1/default.nix
@@ -2,11 +2,11 @@
 
 mkDerivation rec {
   pname = "synthv1";
-  version = "0.9.13";
+  version = "0.9.14";
 
   src = fetchurl {
     url = "mirror://sourceforge/synthv1/${pname}-${version}.tar.gz";
-    sha256 = "0bb48myvgvqcibwm68qhd4852pjr2g19rasf059a799d1hzgfq3l";
+    sha256 = "08n83krkak20924flb9azhm9hn40lyfvn29m63zs3lw3wajf0b40";
   };
 
   buildInputs = [ qtbase qttools libjack2 alsaLib liblo lv2 ];
diff --git a/pkgs/applications/blockchains/ledger-live-desktop/default.nix b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
index edc68f9d0c7a..1c76ef8df284 100644
--- a/pkgs/applications/blockchains/ledger-live-desktop/default.nix
+++ b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
@@ -2,12 +2,12 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "2.1.0";
+  version = "2.3.2";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "https://github.com/LedgerHQ/${pname}/releases/download/v${version}/${pname}-${version}-linux-x86_64.AppImage";
-    sha256 = "1ywvdqmq8asczhmvc6ai2v6di1f5q19x3ygqlinwz8d1hrj3496r";
+    sha256 = "0xd3w564zij614ajg57n1qlvz0hd9l7219qxx81ai6b02b9a5g9h";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/editors/emacs-modes/emacspeak/default.nix b/pkgs/applications/editors/emacs-modes/emacspeak/default.nix
index eb6eac1acbfd..f2ae3712cac4 100644
--- a/pkgs/applications/editors/emacs-modes/emacspeak/default.nix
+++ b/pkgs/applications/editors/emacs-modes/emacspeak/default.nix
@@ -1,10 +1,9 @@
-{ stdenv, fetchurl, makeWrapper, emacs, tcl, tclx, espeak-ng }:
+{ stdenv, fetchurl, makeWrapper, emacs, tcl, tclx, espeak-ng, lib }:
 
 stdenv.mkDerivation rec {
   pname = "emacspeak";
   version = "51.0";
 
-
   src = fetchurl {
     url = "https://github.com/tvraman/emacspeak/releases/download/${version}/${pname}-${version}.tar.bz2";
     sha256 = "09a0ywxlqa8jmc0wmvhaf7bdydnkyhy9nqfsdqcpbsgdzj6qpg90";
@@ -33,11 +32,11 @@ stdenv.mkDerivation rec {
         --add-flags '-l "${placeholder "out"}/share/emacs/site-lisp/emacspeak/lisp/emacspeak-setup.elc"'
   '';
 
-  meta = with stdenv.lib; {
+  meta = {
     homepage = "https://github.com/tvraman/emacspeak/";
     description = "Emacs extension that provides spoken output";
-    license = licenses.gpl2;
-    maintainers = [ dema ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl2;
+    maintainers = [ ];
+    platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/applications/editors/emacs-modes/hol_light/default.nix b/pkgs/applications/editors/emacs-modes/hol_light/default.nix
deleted file mode 100644
index 34b74374b230..000000000000
--- a/pkgs/applications/editors/emacs-modes/hol_light/default.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{ stdenv, fetchsvn }:
-
-stdenv.mkDerivation rec {
-  pname = "hol_light-mode";
-  version = "73";
-
-  src = fetchsvn {
-    url = "http://seanmcl-ocaml-lib.googlecode.com/svn/trunk/workshop/software/emacs";
-    rev = version;
-    sha256 = "3ca83098960439da149a47e1caff32536601559a77f04822be742a390c67feb7";
-  };
-
-  installPhase = ''
-    DEST=$out/share/emacs/site-lisp
-    mkdir -p $DEST
-    cp -a * $DEST
-  '';
-
-  meta = {
-    description = "A HOL Light mode for Emacs";
-    homepage    = "http://www.cl.cam.ac.uk/~jrh13/hol-light/";
-    license     = stdenv.lib.licenses.gpl2Plus;
-    platforms   = stdenv.lib.platforms.all;
-    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
-
-    # Fails trying to fetch dependencies in build
-    # broken = true;
-  };
-}
diff --git a/pkgs/applications/editors/emacs-modes/libgenerated.nix b/pkgs/applications/editors/emacs-modes/libgenerated.nix
index d0c8b4565f57..2ddafc4796c0 100644
--- a/pkgs/applications/editors/emacs-modes/libgenerated.nix
+++ b/pkgs/applications/editors/emacs-modes/libgenerated.nix
@@ -25,10 +25,12 @@ let
         }
       ) {};
       git = self.callPackage ({ fetchgit }:
-        fetchgit {
+        (fetchgit {
           rev = commit;
           inherit sha256 url;
-        }
+        }).overrideAttrs(_: {
+          GIT_SSL_NO_VERIFY = true;
+        })
       ) {};
       bitbucket = self.callPackage ({ fetchhg }:
         fetchhg {
diff --git a/pkgs/applications/editors/emacs-modes/manual-packages.nix b/pkgs/applications/editors/emacs-modes/manual-packages.nix
index 313a21995e03..2f0112fd9228 100644
--- a/pkgs/applications/editors/emacs-modes/manual-packages.nix
+++ b/pkgs/applications/editors/emacs-modes/manual-packages.nix
@@ -135,7 +135,6 @@
   colorThemeSolarized = callPackage ./color-theme-solarized { };
   emacsSessionManagement = callPackage ./session-management-for-emacs { };
   hsc3-mode = callPackage ./hsc3 { };
-  hol_light_mode = callPackage ./hol_light { };
   ido-ubiquitous = callPackage ./ido-ubiquitous { };
   ocaml-mode = callPackage ./ocaml { };
   prolog-mode = callPackage ./prolog { };
diff --git a/pkgs/applications/editors/lite/default.nix b/pkgs/applications/editors/lite/default.nix
new file mode 100644
index 000000000000..107be4338324
--- /dev/null
+++ b/pkgs/applications/editors/lite/default.nix
@@ -0,0 +1,58 @@
+{ stdenv
+, fetchFromGitHub
+, SDL2
+, lua52Packages
+, pkg-config
+, makeWrapper
+} :
+
+stdenv.mkDerivation rec {
+  pname = "lite";
+  version = "1.03";
+
+  src = fetchFromGitHub {
+    owner = "rxi";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1h8z4fav5ns9sm92axs3k9v6jgkqq0vg9mixza14949blr426mlj";
+  };
+
+  nativeBuildInputs = [ makeWrapper pkg-config ];
+
+  buildInputs = [ SDL2 lua52Packages.lua ];
+
+  postPatch = ''
+    # use system Lua 5.2
+    rm -rf src/lib/lua52
+    substituteInPlace src/api/api.h \
+      --replace '"lib/lua52/lua.h"' '<lua.h>' \
+      --replace '"lib/lua52/lauxlib.h"' '<lauxlib.h>' \
+      --replace '"lib/lua52/lualib.h"' '<lualib.h>'
+  '';
+
+  buildPhase = ''
+    # extracted and adapted from build.sh
+    CC=$NIX_CC/bin/cc
+    CFLAGS="-Wall -O3 -g -std=gnu11 -Isrc -DLUA_USE_POPEN $(pkg-config --cflags lua sdl2)"
+    LDFLAGS="$(pkg-config --libs lua sdl2)"
+    for f in $(find src -name "*.c"); do
+      $CC -c $CFLAGS $f -o "''${f//\//_}.o"
+    done
+    $CC *.o $LDFLAGS -o lite
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin $out/lib/${pname}
+    cp -a lite $out/lib/${pname}
+    cp -a data $out/lib/${pname}
+    makeWrapper $out/lib/${pname}/lite $out/bin/lite
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A lightweight text editor written in Lua";
+    homepage = "https://github.com/rxi/lite";
+    license = licenses.mit;
+    maintainers = with maintainers; [ filalex77 ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/applications/editors/vscode/generic.nix b/pkgs/applications/editors/vscode/generic.nix
index abd4a55c92b8..30060086fb53 100644
--- a/pkgs/applications/editors/vscode/generic.nix
+++ b/pkgs/applications/editors/vscode/generic.nix
@@ -78,8 +78,6 @@ in
         mkdir -p $out/lib/vscode $out/bin
         cp -r ./* $out/lib/vscode
 
-        substituteInPlace $out/lib/vscode/bin/${executableName} --replace '"$CLI" "$@"' '"$CLI" "--skip-getting-started" "$@"'
-
         ln -s $out/lib/vscode/bin/${executableName} $out/bin
 
         mkdir -p $out/share/applications
diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix
index 371adc36789a..5aa5881ec5a8 100644
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -11,8 +11,8 @@ let
   archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "1n083pzp2dsz6z6rcl1ldcwhd4i03sjigdfslfardhc4v5lbvmv8";
-    x86_64-darwin = "1qk3gscyskf4fwc8i09afr3wsyd1lwwycx6rf02wwh4n9py50b20";
+    x86_64-linux = "16zchjp72m6n6za4ak5kn2ax1s5pjfn7l082d6gfbb2y62isvs7q";
+    x86_64-darwin = "0w35s6nxagcnd6xcm6bp0m63agkqxffig61cr3nnmpbcgj9zc969";
   }.${system};
 in
   callPackage ./generic.nix rec {
@@ -21,7 +21,7 @@ in
 
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.44.2";
+    version = "1.45.0";
     pname = "vscode";
 
     executableName = "code" + lib.optionalString isInsiders "-insiders";
diff --git a/pkgs/applications/editors/vscode/vscodium.nix b/pkgs/applications/editors/vscode/vscodium.nix
index fe96223b65f4..531abb06daaf 100644
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@@ -11,8 +11,8 @@ let
   archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "141hwj1a2bsgzpfk354dnnmg4ak00fss3xsgqplyk949pbk6v1af";
-    x86_64-darwin = "0fi8nz1gayzw5dp6d3m7jsmij3jj4yjg5rk1s9w6falpgka76dm1";
+    x86_64-linux = "1wb4s2jw90irlawgl6539gwl0xwaxglaksmbcddbvnr6rq3ypn8n";
+    x86_64-darwin = "16c1r7knfd5pfqhnk77nanh82azkc28pwkqfcyasbdgm70k17d3p";
   }.${system};
 
   sourceRoot = {
@@ -27,7 +27,7 @@ in
 
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.44.2";
+    version = "1.45.0";
     pname = "vscodium";
 
     executableName = "codium";
diff --git a/pkgs/applications/graphics/krop/default.nix b/pkgs/applications/graphics/krop/default.nix
index 818fc63535ed..2337dfb370ef 100644
--- a/pkgs/applications/graphics/krop/default.nix
+++ b/pkgs/applications/graphics/krop/default.nix
@@ -24,6 +24,10 @@ python3Packages.buildPythonApplication rec {
    "\${qtWrapperArgs[@]}"
   ];
 
+  postInstall = ''
+    install -m666 -Dt $out/share/applications krop.desktop
+  '';
+
   # Disable checks because of interference with older Qt versions // xcb
   doCheck = false;
 
diff --git a/pkgs/applications/kde/kdegraphics-thumbnailers.nix b/pkgs/applications/kde/kdegraphics-thumbnailers.nix
index d98f2013339d..dc0b63594c45 100644
--- a/pkgs/applications/kde/kdegraphics-thumbnailers.nix
+++ b/pkgs/applications/kde/kdegraphics-thumbnailers.nix
@@ -13,7 +13,7 @@ mkDerivation {
     # Fix a bug with thumbnail.so processes hanging:
     # https://bugs.kde.org/show_bug.cgi?id=404652
     (fetchpatch {
-      url = "https://phabricator.kde.org/file/data/tnk4b6roouixzifi6vre/PHID-FILE-qkkedevt7svx7lv56ea5/D26635.diff";
+      url = "https://github.com/KDE/kdegraphics-thumbnailers/commit/3e2ea6e924d0e2a2cdd9bb435b06965117d6d34c.patch";
       sha256 = "0fq85zhymmrq8vl0y6vgh87qf4c6fhcq704p4kpkaq7y0isxj4h1";
     })
   ];
diff --git a/pkgs/applications/misc/almanah/default.nix b/pkgs/applications/misc/almanah/default.nix
index f554d36a0c6a..b7b7cfea7c1a 100644
--- a/pkgs/applications/misc/almanah/default.nix
+++ b/pkgs/applications/misc/almanah/default.nix
@@ -1,5 +1,6 @@
 { stdenv
 , fetchurl
+, fetchpatch
 , atk
 , cairo
 , desktop-file-utils
@@ -30,6 +31,15 @@ stdenv.mkDerivation rec {
     sha256 = "09rxx4s4c34d1axza6ayss33v78p44r9bpx058shllh1sf5avpcb";
   };
 
+  patches = [
+    # Fix gpgme detection
+    # https://gitlab.gnome.org/GNOME/almanah/merge_requests/7
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/almanah/commit/4b979c4145ef2fbceebb3849a70df1d0ceb1bb93.patch";
+      sha256 = "q3M+osNWz7AsDQtFju5S7P4wH3cAdzKOPKnEXTJ+k3M=";
+    })
+  ];
+
   nativeBuildInputs = [
     desktop-file-utils
     gettext
diff --git a/pkgs/applications/misc/cheat/default.nix b/pkgs/applications/misc/cheat/default.nix
index b4765c0aae32..85101a6d71bf 100644
--- a/pkgs/applications/misc/cheat/default.nix
+++ b/pkgs/applications/misc/cheat/default.nix
@@ -3,13 +3,13 @@
 
 buildGoModule rec {
   pname = "cheat";
-  version = "3.9.0";
+  version = "3.10.0";
 
   src = fetchFromGitHub {
     owner = "cheat";
     repo = "cheat";
     rev = version;
-    sha256 = "0jbqflkcfdrinx1lk45klm8ml0n4cgp43nzls1376cd3hfayby1y";
+    sha256 = "1rrhll1i5ibxdchpdifajvsm697pilf82rbq7arn4f4pw5izrhy6";
   };
 
   subPackages = [ "cmd/cheat" ];
@@ -20,7 +20,7 @@ buildGoModule rec {
     installShellCompletion scripts/cheat.{bash,fish,zsh}
   '';
 
-  modSha256 = "1is19qca5wgzya332rmpk862nnivxzgxchkllv629f5fwwdvdgmg";
+  modSha256 = "1z4za3rivc3vqv59p5yb5c9dcpmq669rzmf4z7zilbvmgm0pbgfp";
 
   meta = with stdenv.lib; {
     description = "Create and view interactive cheatsheets on the command-line";
diff --git a/pkgs/applications/misc/cpu-x/default.nix b/pkgs/applications/misc/cpu-x/default.nix
new file mode 100644
index 000000000000..c058e6d5a983
--- /dev/null
+++ b/pkgs/applications/misc/cpu-x/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, gtk3, ncurses, curl
+, json_c, libcpuid, pciutils, procps, wrapGAppsHook, nasm }:
+
+stdenv.mkDerivation rec {
+  pname = "cpu-x";
+  version = "3.2.4";
+
+  src = fetchFromGitHub {
+    owner = "X0rg";
+    repo = "CPU-X";
+    rev = "v${version}";
+    sha256 = "03y49wh9v7x6brmavj5a2clihn0z4f01pypl7m8ymarv4y3a6xkl";
+  };
+
+  nativeBuildInputs = [ cmake pkgconfig wrapGAppsHook nasm ];
+  buildInputs = [
+    gtk3 ncurses curl json_c libcpuid pciutils procps
+  ];
+
+  meta = with stdenv.lib; {
+    description = "Free software that gathers information on CPU, motherboard and more";
+    homepage = src.meta.homepage;
+    license = licenses.gpl3;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ gnidorah ];
+  };
+}
diff --git a/pkgs/applications/misc/lutris/chrootenv.nix b/pkgs/applications/misc/lutris/chrootenv.nix
index 4505432b236d..4fcbaa19a209 100644
--- a/pkgs/applications/misc/lutris/chrootenv.nix
+++ b/pkgs/applications/misc/lutris/chrootenv.nix
@@ -105,6 +105,9 @@ in buildFHSUserEnv {
     cups lcms2 mpg123 cairo unixODBC samba4 sane-backends openldap
     ocl-icd utillinux libkrb5
 
+    # Proton
+    libselinux
+
     # Winetricks
     fribidi
   ] ++ xorgDeps pkgs;
diff --git a/pkgs/applications/misc/tilda/default.nix b/pkgs/applications/misc/tilda/default.nix
index f8ae5587ff92..84d37a4f461d 100644
--- a/pkgs/applications/misc/tilda/default.nix
+++ b/pkgs/applications/misc/tilda/default.nix
@@ -7,13 +7,13 @@ with stdenv.lib;
 stdenv.mkDerivation rec {
 
   pname = "tilda";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "lanoxx";
     repo = "tilda";
     rev = "${pname}-${version}";
-    sha256 = "13djibj3s7ig13c57ywy38pxy3qfmqihii2c0g15fy2h9q8xp1gx";
+    sha256 = "1kk69sg7ph906yr5jagkjx0qfkhr5w2nyx407wl2dsjimbps44rd";
   };
 
   nativeBuildInputs = [ autoreconfHook makeWrapper pkgconfig ];
diff --git a/pkgs/applications/misc/translate-shell/default.nix b/pkgs/applications/misc/translate-shell/default.nix
index e418ee69b95b..62e66055a2f9 100644
--- a/pkgs/applications/misc/translate-shell/default.nix
+++ b/pkgs/applications/misc/translate-shell/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "translate-shell";
-  version = "0.9.6.11";
+  version = "0.9.6.12";
 
   src = fetchFromGitHub {
     owner = "soimort";
     repo = "translate-shell";
     rev = "v${version}";
-    sha256 = "137fz3ahzf65hfqcs4k7hhrmfjlhlw7wr3gfsvk88bnyqkyw44sm";
+    sha256 = "075vqnha21rhr1b61dim7dqlfwm1yffyzcaa83s36rpk9r5sddzx";
   };
 
   buildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/misc/visidata/default.nix b/pkgs/applications/misc/visidata/default.nix
index cc88cb1751ef..4cecf07f0fa3 100644
--- a/pkgs/applications/misc/visidata/default.nix
+++ b/pkgs/applications/misc/visidata/default.nix
@@ -43,7 +43,7 @@ buildPythonApplication rec {
     description = "Interactive terminal multitool for tabular data";
     license = lib.licenses.gpl3;
     maintainers = [ lib.maintainers.raskin ];
-    platforms = lib.platforms.linux;
+    platforms = with lib.platforms; linux ++ darwin;
     homepage = "http://visidata.org/";
   };
 }
diff --git a/pkgs/applications/misc/worker/default.nix b/pkgs/applications/misc/worker/default.nix
index 8b9ed8300648..9e3022457a0e 100644
--- a/pkgs/applications/misc/worker/default.nix
+++ b/pkgs/applications/misc/worker/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "worker";
-  version = "4.3.0";
+  version = "4.4.0";
 
   src = fetchurl {
     url = "http://www.boomerangsworld.de/cms/worker/downloads/${pname}-${version}.tar.gz";
-    sha256 = "0s7i1qjnh4mfjyrfvbbr1dklqi0n2nwksls21106q633wk9qdlqx";
+    sha256 = "1k2svpzq01n1h9365nhi7r2k7dmsviczxi9m6fb80ccccdz7i530";
   };
 
   buildInputs = [ libX11 ];
diff --git a/pkgs/applications/misc/xmrig/proxy.nix b/pkgs/applications/misc/xmrig/proxy.nix
index fc3070d1dcb4..82247d02c66e 100644
--- a/pkgs/applications/misc/xmrig/proxy.nix
+++ b/pkgs/applications/misc/xmrig/proxy.nix
@@ -1,20 +1,20 @@
-{ stdenv, lib, fetchFromGitHub, cmake, libuv, libmicrohttpd, libuuid, openssl
+{ stdenv, lib, fetchFromGitHub, cmake, libuv, libmicrohttpd, openssl
 , donateLevel ? 0
 }:
 
 stdenv.mkDerivation rec {
   pname = "xmrig-proxy";
-  version = "5.0.1";
+  version = "5.10.0";
 
   src = fetchFromGitHub {
     owner = "xmrig";
     repo = "xmrig-proxy";
     rev = "v${version}";
-    sha256 = "0lp11p4lf03l9x2kcpq1j19z7c1zrdvjmcfh2xyvlbw8pqx0hxkv";
+    sha256 = "1p8bxp2nv30c3j3kb0bpby86378h6m7nv2vvzw06lqsj5fqbw4g5";
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ libuv libmicrohttpd libuuid openssl ];
+  buildInputs = [ libuv libmicrohttpd openssl ];
 
   postPatch = ''
     # Link dynamically against libuuid instead of statically
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 5dc791631d8b..817d17e8fad0 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -94,6 +94,11 @@ stdenv.mkDerivation ({
 
   patches = [
     ./env_var_for_system_dir.patch
+    # Fix for NSS 3.52 (add missing CK_GCM_PARMS field)
+    (fetchpatch {
+      url = "https://hg.mozilla.org/mozilla-central/raw-rev/463069687b3d";
+      sha256 = "00yhz67flnkww3rbry0kqn6z6bm7vxfb2sgf7qikgbjcm3ysvpsm";
+    })
   ]
   ++ patches;
 
diff --git a/pkgs/applications/networking/browsers/qutebrowser/default.nix b/pkgs/applications/networking/browsers/qutebrowser/default.nix
index d75be65c1963..edb5b2759e28 100644
--- a/pkgs/applications/networking/browsers/qutebrowser/default.nix
+++ b/pkgs/applications/networking/browsers/qutebrowser/default.nix
@@ -21,12 +21,12 @@ let
 
 in mkDerivationWith python3Packages.buildPythonApplication rec {
   pname = "qutebrowser";
-  version = "1.11.0";
+  version = "1.11.1";
 
   # the release tarballs are different from the git checkout!
   src = fetchurl {
     url = "https://github.com/qutebrowser/qutebrowser/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "0b0qlki9bp9mm41lrh6rc6qqvm4nsz8da63sby3a1f2xm9b9vvg2";
+    sha256 = "0cxmmw002f5rvxzyhlhzqm2ipf64w4vspf298p6c5kpg535m8cvs";
   };
 
   # Needs tox
diff --git a/pkgs/applications/networking/cluster/cni/plugins.nix b/pkgs/applications/networking/cluster/cni/plugins.nix
index d457ddd98bfe..34eb6a8ee28d 100644
--- a/pkgs/applications/networking/cluster/cni/plugins.nix
+++ b/pkgs/applications/networking/cluster/cni/plugins.nix
@@ -2,17 +2,21 @@
 
 buildGoPackage rec {
   pname = "cni-plugins";
-  version = "0.8.5";
+  version = "0.8.6";
 
   src = fetchFromGitHub {
     owner = "containernetworking";
     repo = "plugins";
     rev = "v${version}";
-    sha256 = "17c8pvpn0dpda6ah7irr9hhd8sk7mnm32zv72nc5pxg1xvfpaipi";
+    sha256 = "0f1cqxjf26sy1c4aw6y7pyd9lrz0vknby4q5j6xj77a1pab9073m";
   };
 
   goPackagePath = "github.com/containernetworking/plugins";
 
+  buildFlagsArray = [
+    "-ldflags=-X ${goPackagePath}/pkg/utils/buildversion.BuildVersion=${version}"
+  ];
+
   subPackages = [
     "plugins/ipam/dhcp"
     "plugins/ipam/host-local"
diff --git a/pkgs/applications/networking/cluster/helmsman/default.nix b/pkgs/applications/networking/cluster/helmsman/default.nix
new file mode 100644
index 000000000000..f1d81975e1e6
--- /dev/null
+++ b/pkgs/applications/networking/cluster/helmsman/default.nix
@@ -0,0 +1,23 @@
+{ lib, buildGoModule, fetchFromGitHub, ... }:
+
+buildGoModule rec {
+  pname = "helmsman";
+  version = "3.3.0";
+
+  src = fetchFromGitHub {
+    owner = "Praqma";
+    repo = "helmsman";
+    rev = "v${version}";
+    sha256 = "0i7sg3iwxb07gjxcz6chpdcx3fqykzldmf7s1c9m02hkps910ca8";
+  };
+
+  modSha256 = "19qdrrwmjc32nw8m0zi251z32wqj2d956wgd1dkcvx1x0n4p435g";
+
+  meta = with lib; {
+    description = "Helm Charts (k8s applications) as Code tool";
+    homepage = "https://github.com/Praqma/helmsman";
+    license = licenses.mit;
+    maintainers = with maintainers; [ lynty ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/applications/networking/cluster/minikube/default.nix b/pkgs/applications/networking/cluster/minikube/default.nix
index 9c5727ec7358..830dcec95168 100644
--- a/pkgs/applications/networking/cluster/minikube/default.nix
+++ b/pkgs/applications/networking/cluster/minikube/default.nix
@@ -11,18 +11,18 @@
 
 buildGoModule rec {
   pname = "minikube";
-  version = "1.9.2";
+  version = "1.10.1";
 
   # for -ldflags
-  commit = "1b78a7b8a99ad6a3c62b8d22f57120d614d17935";
+  commit = "63ab801ac27e5742ae442ce36dff7877dcccb278";
 
-  modSha256 = "1pxs6myszgma3rzz0nhfjbnylv6m0xzlinvmlg0c4ijvkkzxg3v5";
+  modSha256 = "1g94jjwr5higg1b297zwp6grkj7if3mrdafjq9vls9y2svh11xr8";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "minikube";
     rev = "v${version}";
-    sha256 = "025v45427d885qkjjg7ig8fgrvjalnf1lajsj0cnbwbih2m69svg";
+    sha256 = "05lv6k0j0l00s2895fryp027aa40whbf1gf3fhfg0z5d3p9sbprk";
   };
 
   nativeBuildInputs = [ go-bindata installShellFiles pkg-config which ];
diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix
index 516c4e514029..ec9f02fe9e2f 100644
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@@ -118,8 +118,8 @@ in rec {
   terraform_0_11-full = terraform_0_11.full;
 
   terraform_0_12 = pluggable (generic {
-    version = "0.12.24";
-    sha256 = "1rjihp6qcaizp2nnv4z20kpmjnqcw95pq5rnhq381a3pdzr0cd0z";
+    version = "0.12.25";
+    sha256 = "0xq4327386x6isw82d4xyq70pw7xxlh4sgmqas0b2pvyz85jxdch";
     patches = [
         ./provider-path.patch
         (fetchpatch {
diff --git a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
index 360d8b4e1c9d..029ec23856ab 100644
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@@ -15,11 +15,11 @@ assert pulseaudioSupport -> libpulseaudio != null;
 let
   inherit (stdenv.lib) concatStringsSep makeBinPath optional;
 
-  version = "5.0.399860.0429";
+  version = "5.0.403652.0509";
   srcs = {
     x86_64-linux = fetchurl {
       url = "https://zoom.us/client/${version}/zoom_x86_64.tar.xz";
-      sha256 = "1jid8rs403b709scz8vpqsi1dxdmssn5426wa3d16p45blnxk16k";
+      sha256 = "00bprrfc7mmf3yg6jddqm2qr73m2zycr8hy19dxqpzld9gbvyzik";
     };
   };
 
diff --git a/pkgs/applications/networking/openbazaar/client.nix b/pkgs/applications/networking/openbazaar/client.nix
new file mode 100644
index 000000000000..5b9ddd8bab7d
--- /dev/null
+++ b/pkgs/applications/networking/openbazaar/client.nix
@@ -0,0 +1,57 @@
+{ stdenv
+, fetchurl
+, gcc-unwrapped
+, dpkg
+, bash
+, nodePackages
+, makeWrapper
+, electron_6
+}:
+
+stdenv.mkDerivation rec {
+  pname = "openbazaar-client";
+  version = "2.4.4";
+
+  src = fetchurl {
+    url = "https://github.com/OpenBazaar/openbazaar-desktop/releases/download/v${version}/openbazaar2client_${version}_amd64.deb";
+    sha256 = "146vqwc1gv5zqcz60np8v9ps44m0d2yyjzqpmd4s0pcywvvwdvn6";
+  };
+
+  dontBuild = true;
+  dontConfigure = true;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  unpackPhase = ''
+    ${dpkg}/bin/dpkg-deb -x $src .
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin $out/share/{${pname},applications,pixmaps}
+
+    cp -a usr/lib/openbazaar2client/{locales,resources} $out/share/${pname}
+    cp -a usr/share/applications/openbazaar2client.desktop $out/share/applications/${pname}.desktop
+    cp -a usr/share/pixmaps/openbazaar2client.png $out/share/pixmaps/${pname}.png
+
+    substituteInPlace $out/share/applications/${pname}.desktop \
+      --replace 'openbazaar2client' 'openbazaar-client'
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    makeWrapper ${electron_6}/bin/electron $out/bin/${pname} \
+      --add-flags $out/share/${pname}/resources/app \
+      --prefix LD_LIBRARY_PATH : "${stdenv.lib.makeLibraryPath [ gcc-unwrapped.lib ]}"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Decentralized Peer to Peer Marketplace for Bitcoin - client";
+    homepage = "https://www.openbazaar.org/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ prusnak ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/applications/networking/openbazaar/default.nix b/pkgs/applications/networking/openbazaar/default.nix
new file mode 100644
index 000000000000..6a48b2962fa8
--- /dev/null
+++ b/pkgs/applications/networking/openbazaar/default.nix
@@ -0,0 +1,48 @@
+{ stdenv
+, fetchurl
+}:
+
+stdenv.mkDerivation rec {
+  pname = "openbazaar";
+  version = "0.14.2";
+
+  suffix = {
+    i686-linux    = "linux-386";
+    x86_64-darwin = "darwin-10.6-amd64";
+    x86_64-linux  = "linux-amd64";
+  }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+
+  src = fetchurl {
+    url = "https://github.com/OpenBazaar/openbazaar-go/releases/download/v${version}/${pname}-go-${suffix}";
+    sha256 = {
+      i686-linux    = "02kl4ci2pz86qqsll7578q0acygncsyylaschjzzii34c86f1aym";
+      x86_64-darwin = "1v5m94x4x0nc6i8zlcwb36ps1zpgqgcsz81x1ghkz5c9xzszgzbp";
+      x86_64-linux  = "0m0digw66rzhwl2im88qavli9cc5vxd9pwj6ix86dcf98r93xsrp";
+    }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+  };
+
+  dontUnpack = true;
+  dontConfigure = true;
+  dontBuild = true;
+  dontStrip = true;
+  dontPatchELF = true;
+  preferLocalBuild = true;
+
+  installPhase = ''
+    install -D $src $out/bin/openbazaard
+  '';
+
+  postFixup = stdenv.lib.optionalString (!stdenv.isDarwin) ''
+    patchelf \
+      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      $out/bin/openbazaard
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Decentralized Peer to Peer Marketplace for Bitcoin - daemon";
+    homepage = "https://www.openbazaar.org/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ prusnak ];
+    platforms = [ "i686-linux" "x86_64-darwin" "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/applications/networking/znc/default.nix b/pkgs/applications/networking/znc/default.nix
index e9c3acdc11d1..fae03846b68e 100644
--- a/pkgs/applications/networking/znc/default.nix
+++ b/pkgs/applications/networking/znc/default.nix
@@ -13,11 +13,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "znc";
-  version = "1.7.5";
+  version = "1.8.0";
 
   src = fetchurl {
     url = "https://znc.in/releases/archive/${pname}-${version}.tar.gz";
-    sha256 = "08a7yb2xs85hyyz8dpzfbsfjwj2r6kcii022lj3l4rf8hl9ix558";
+    sha256 = "0m5xf60r40pgbg9lyk56dafxj2hj149pn2wf8vzsp8xgq4kv5zcl";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/applications/office/skrooge/default.nix b/pkgs/applications/office/skrooge/default.nix
index f3e6f6229969..66d028144ff2 100644
--- a/pkgs/applications/office/skrooge/default.nix
+++ b/pkgs/applications/office/skrooge/default.nix
@@ -7,11 +7,11 @@
 
 mkDerivation rec {
   pname = "skrooge";
-  version = "2.21.1";
+  version = "2.22.1";
 
   src = fetchurl {
     url = "http://download.kde.org/stable/skrooge/${pname}-${version}.tar.xz";
-    sha256 = "0lv953i7cybzbxr5gx6g4libdcjj086jf152mwrwvx1avrpjavb8";
+    sha256 = "194vwnc2fi7cgdhasxpr1gxjqqsiqadhadvv43d0lxaxys6f360h";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/office/zotero/default.nix b/pkgs/applications/office/zotero/default.nix
index 8a27dcd3c9fc..55ab22cfc06e 100644
--- a/pkgs/applications/office/zotero/default.nix
+++ b/pkgs/applications/office/zotero/default.nix
@@ -35,11 +35,11 @@
 
 stdenv.mkDerivation rec {
   pname = "zotero";
-  version = "5.0.83";
+  version = "5.0.85";
 
   src = fetchurl {
     url = "https://download.zotero.org/client/release/${version}/Zotero-${version}_linux-x86_64.tar.bz2";
-    sha256 = "1abkwxdi154hnry8nsvxbklvbsnvd7cs2as0041h2kbiz824pv31";
+    sha256 = "0zqc27kld7rm3akmrnf9ba1x2hb9838cbv6i3nkqvg81ly5gfbxs";
   };
 
   nativeBuildInputs = [ wrapGAppsHook ];
diff --git a/pkgs/applications/science/electronics/verilator/default.nix b/pkgs/applications/science/electronics/verilator/default.nix
index dd6c5a09851e..189e09f8241b 100644
--- a/pkgs/applications/science/electronics/verilator/default.nix
+++ b/pkgs/applications/science/electronics/verilator/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "verilator";
-  version = "4.032";
+  version = "4.034";
 
   src = fetchurl {
     url    = "https://www.veripool.org/ftp/${pname}-${version}.tgz";
-    sha256 = "1l3rhgw7pk59dz7dyhcl0iygn6c9rv9bv131rfzg66asxfwbfq1s";
+    sha256 = "02xqvl9ic21jpda0xldh4ihqwl4ss8389s8fklgx5d98xq37pval";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/science/math/wxmaxima/default.nix b/pkgs/applications/science/math/wxmaxima/default.nix
index 4d6e4bea34e6..a6afc95ac093 100644
--- a/pkgs/applications/science/math/wxmaxima/default.nix
+++ b/pkgs/applications/science/math/wxmaxima/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wxmaxima";
-  version = "20.02.4";
+  version = "20.04.0";
 
   src = fetchFromGitHub {
     owner = "wxMaxima-developers";
     repo = "wxmaxima";
     rev = "Version-${version}";
-    sha256 = "106a7jrjwfmymzj70nsv44fm3jbxngr8pmkaghhpwy0ln38lhf54";
+    sha256 = "0vrjxzfgmjdzm1rgl0crz4b4badl14jwh032y3xkcdvjl5j67lp3";
   };
 
   buildInputs = [ wxGTK maxima gnome3.adwaita-icon-theme ];
diff --git a/pkgs/applications/version-management/git-and-tools/gh/default.nix b/pkgs/applications/version-management/git-and-tools/gh/default.nix
index 597e0672073b..adec2a361b54 100644
--- a/pkgs/applications/version-management/git-and-tools/gh/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gh/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "gh";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "054mag8jgxkvx2f95ha10n45v4xv5lms69w76g95z18m62qhjcyl";
+    sha256 = "08fy3677yq52x40rab49ijhw4r25ls2807dbv9wpna6w07n7r8v7";
   };
 
   modSha256 = "0v33x9bnwjfg4425vralnsb4i22c0g1rcmaga9911v0i7d51k0fn";
diff --git a/pkgs/applications/version-management/git-and-tools/git-machete/default.nix b/pkgs/applications/version-management/git-and-tools/git-machete/default.nix
index 42be3f7d3547..1ca0ad27de71 100644
--- a/pkgs/applications/version-management/git-and-tools/git-machete/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-machete/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonApplication rec {
   pname = "git-machete";
-  version = "2.13.6";
+  version = "2.14.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0n07gm05676vgfh6vlym59jwwzym9xmibhr0zpf0drlx02fr47qy";
+    sha256 = "01ch4d0r3bi9nl5nknp3dyizc2rl9w46gm1ydnvqbrzhgw65lpp0";
   };
 
   nativeBuildInputs = [ installShellFiles pbr ];
diff --git a/pkgs/applications/version-management/git-and-tools/gitui/default.nix b/pkgs/applications/version-management/git-and-tools/gitui/default.nix
index aebff6a07ab6..5ed4b0d37273 100644
--- a/pkgs/applications/version-management/git-and-tools/gitui/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gitui/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gitui";
-  version = "0.2.1";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "extrawurst";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0ln959zsdn0w15kfyp5i4524hzzk23l31n9smi1md4jfj7jycbh1";
+    sha256 = "1vcdgzr71m9rlkaq5pc2vnli3hdh7vv8g3ji5ancnlk3zcqc78xy";
   };
 
-  cargoSha256 = "128g23pcccy07jcb4phlfag9ixh5fkwkaiyd7mxjh3wmhppjcx0i";
+  cargoSha256 = "04g089y6k0p36h08v6swcg1ig2kcadkidnlc0rh04znmv0bkn84d";
 
   buildInputs = stdenv.lib.optionals stdenv.isDarwin [ libiconv Security ];
 
diff --git a/pkgs/applications/video/makemkv/default.nix b/pkgs/applications/video/makemkv/default.nix
index 4816f17618b8..2364f9ec02cd 100644
--- a/pkgs/applications/video/makemkv/default.nix
+++ b/pkgs/applications/video/makemkv/default.nix
@@ -3,21 +3,21 @@
 }:
 
 let
-  version = "1.15.0";
+  version = "1.15.1";
   # Using two URLs as the first one will break as soon as a new version is released
   src_bin = fetchurl {
     urls = [
       "http://www.makemkv.com/download/makemkv-bin-${version}.tar.gz"
       "http://www.makemkv.com/download/old/makemkv-bin-${version}.tar.gz"
     ];
-    sha256 = "1zr63fqx4qcrnrbg1f97w9mp3yzzxf0dk8pw60y2d4436vanfba4";
+    sha256 = "0c9661sdlld8b1g2pk8lbn3gz7cikh9bjqss11ffkriwii1x9fw0";
   };
   src_oss = fetchurl {
     urls = [
       "http://www.makemkv.com/download/makemkv-oss-${version}.tar.gz"
       "http://www.makemkv.com/download/old/makemkv-oss-${version}.tar.gz"
     ];
-    sha256 = "01pdydll37inkq74874rqd5kk0maafnm1lqcv41jzgzjrfkky8d9";
+    sha256 = "0rm1zykqagy2g8hb7pjrc6akdsym8pgdnx66hnna161jbah3sssy";
   };
 in mkDerivation {
   pname = "makemkv";
diff --git a/pkgs/applications/virtualization/conmon/default.nix b/pkgs/applications/virtualization/conmon/default.nix
index bfe9f1d34865..36e52ff1e465 100644
--- a/pkgs/applications/virtualization/conmon/default.nix
+++ b/pkgs/applications/virtualization/conmon/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "conmon";
-  version = "2.0.15";
+  version = "2.0.16";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1fshcmnfqzbagzcrh5nxw7pi0dd60xpq47a2lzfghklqhl1h0b5i";
+    sha256 = "0z0hds95mjxm703ig2aisghvpd2l3wn6m72jnnlv8jnz2iq2nc4g";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/applications/virtualization/cri-o/default.nix b/pkgs/applications/virtualization/cri-o/default.nix
index 4c3d9ffc937c..0851f1f716be 100644
--- a/pkgs/applications/virtualization/cri-o/default.nix
+++ b/pkgs/applications/virtualization/cri-o/default.nix
@@ -1,5 +1,4 @@
-{ flavor ? ""
-, stdenv
+{ stdenv
 , btrfs-progs
 , buildGoPackage
 , fetchFromGitHub
@@ -18,7 +17,6 @@
 buildGoPackage rec {
   pname = "cri-o";
   version = "1.18.0";
-  name = "${pname}-${version}${flavor}";
 
   goPackagePath = "github.com/cri-o/cri-o";
 
@@ -54,9 +52,7 @@ buildGoPackage rec {
   '';
 
   installPhase = ''
-    install -Dm755 bin/crio $out/bin/crio${flavor}
-    install -Dm755 bin/crio-status $out/bin/crio-status${flavor}
-    install -Dm755 bin/pinns $out/bin/pinns${flavor}
+    install -Dm755 bin/* -t $out/bin
 
     for shell in bash fish zsh; do
       installShellCompletion --$shell completions/$shell/*
diff --git a/pkgs/applications/virtualization/gvisor/default.nix b/pkgs/applications/virtualization/gvisor/default.nix
index e157ca825af0..7d62b1b9fa24 100644
--- a/pkgs/applications/virtualization/gvisor/default.nix
+++ b/pkgs/applications/virtualization/gvisor/default.nix
@@ -76,7 +76,7 @@ in buildBazelPackage rec {
       rm -f "$bazelOut"/java.log "$bazelOut"/java.log.*
     '';
 
-    sha256 = "1bn7nhv5pag8fdm8l8nvgg3fzvhpy2yv9yl2slrb16lckxzha3v6";
+    sha256 = "0r11kbyp1ambgcj35gvjjmxrsrdg7b9jb9sq3kih4lik7zyljp25";
   };
 
   buildAttrs = {
diff --git a/pkgs/applications/virtualization/podman/default.nix b/pkgs/applications/virtualization/podman/default.nix
index 4a9fa0787521..d5c52a8dfe8a 100644
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@@ -14,13 +14,13 @@
 
 buildGoPackage rec {
   pname = "podman";
-  version = "1.9.1";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "libpod";
     rev = "v${version}";
-    sha256 = "0dr5vd52fnjwx3zn2nj2nlvkbvh5bg579nf3qw8swrn8i1jwxd6j";
+    sha256 = "0jvqzn1q52z6aka98d2i3dyn2i8xld7xvmi2zfxgm9g53wdgi2g2";
   };
 
   goPackagePath = "github.com/containers/libpod";
diff --git a/pkgs/applications/virtualization/podman/wrapper.nix b/pkgs/applications/virtualization/podman/wrapper.nix
index 99233696b3ed..d7fb6fa1072f 100644
--- a/pkgs/applications/virtualization/podman/wrapper.nix
+++ b/pkgs/applications/virtualization/podman/wrapper.nix
@@ -29,7 +29,7 @@ let
 
 in runCommand podman.name {
   name = "${podman.pname}-wrapper-${podman.version}";
-  inherit (podman) pname version;
+  inherit (podman) pname version passthru;
 
   meta = builtins.removeAttrs podman.meta [ "outputsToInstall" ];
 
diff --git a/pkgs/applications/window-managers/tinywm/default.nix b/pkgs/applications/window-managers/tinywm/default.nix
new file mode 100644
index 000000000000..0e30857267bd
--- /dev/null
+++ b/pkgs/applications/window-managers/tinywm/default.nix
@@ -0,0 +1,51 @@
+{ stdenv, fetchFromGitHub
+, libX11 }:
+
+stdenv.mkDerivation rec {
+  pname = "tinywm";
+  version = "2014-04-22";
+
+  src = fetchFromGitHub {
+    owner = "mackstann";
+    repo = pname;
+    rev = "9d05612f41fdb8bc359f1fd9cc930bf16315abb1";
+    sha256 = "1s7r4f2d3lk1i8h089v2vyrr02hh0y9i3ihl9kqgk9s87hqw8q5b";
+  };
+
+  buildInputs = [ libX11 ];
+
+  dontConfigure = true;
+
+  buildPhase = ''
+    ${stdenv.cc}/bin/cc -Wall -pedantic -I${libX11}/include tinywm.c -L${libX11}/lib -lX11 -o tinywm
+  '';
+
+  installPhase = ''
+    install -dm755 $out/bin $out/share/doc/${pname}-${version}
+    install -m755 tinywm -t $out/bin/
+    # The annotated source code is a piece of documentation
+    install -m644 annotated.c README -t $out/share/doc/${pname}-${version}
+  '';
+
+  meta = with stdenv.lib;{
+    description = "A tiny window manger for X11";
+    longDescription = ''
+
+      TinyWM is a tiny window manager that I created as an exercise in
+      minimalism. It is also maybe helpful in learning some of the very basics
+      of creating a window manager. It is only around 50 lines of C. There is
+      also a Python version using python-xlib.
+
+      It lets you do four basic things:
+
+      - Move windows interactively with Alt+Button1 drag (left mouse button)
+      - Resize windows interactively with Alt+Button3 drag (right mouse button)
+      - Raise windows with Alt+F1 (not high on usability I know, but I needed a
+        keybinding in there somewhere)
+      - Focus windows with the mouse pointer (X does this on its own)      
+    '';
+    homepage = "http://incise.org/tinywm.html";
+    maintainers = with maintainers; [ AndersonTorres ];
+    platforms = libX11.meta.platforms;
+  };
+}
diff --git a/pkgs/build-support/build-bazel-package/default.nix b/pkgs/build-support/build-bazel-package/default.nix
index 9a64b84f076b..31c0c8e92e56 100644
--- a/pkgs/build-support/build-bazel-package/default.nix
+++ b/pkgs/build-support/build-bazel-package/default.nix
@@ -42,9 +42,11 @@ in stdenv.mkDerivation (fBuildAttrs // {
   inherit name bazelFlags bazelBuildFlags bazelFetchFlags bazelTarget;
 
   deps = stdenv.mkDerivation (fFetchAttrs // {
-    name = "${name}-deps";
+    name = "${name}-deps.tar.gz";
     inherit bazelFlags bazelBuildFlags bazelFetchFlags bazelTarget;
 
+    impureEnvVars = lib.fetchers.proxyImpureEnvVars;
+
     nativeBuildInputs = fFetchAttrs.nativeBuildInputs or [] ++ [ bazel ];
 
     preHook = fFetchAttrs.preHook or "" + ''
@@ -120,9 +122,9 @@ in stdenv.mkDerivation (fBuildAttrs // {
         ln -sf "$new_target" "$symlink"
       done
 
-      cp -r $bazelOut/external $out
+      echo '${bazel.name}' > $bazelOut/external/.nix-bazel-version
 
-      echo '${bazel.name}' > $out/.nix-bazel-version
+      (cd $bazelOut/ && tar czf $out --sort=name --mtime='@1' --owner=0 --group=0 --numeric-owner external/)
 
       runHook postInstall
     '';
@@ -130,7 +132,6 @@ in stdenv.mkDerivation (fBuildAttrs // {
     dontFixup = true;
     allowedRequisites = [];
 
-    outputHashMode = "recursive";
     outputHashAlgo = "sha256";
     outputHash = fetchAttrs.sha256;
   });
@@ -146,14 +147,15 @@ in stdenv.mkDerivation (fBuildAttrs // {
   preConfigure = ''
     mkdir -p "$bazelOut"
 
-    test "${bazel.name}" = "$(<$deps/.nix-bazel-version)" || {
+    (cd $bazelOut && tar xfz $deps)
+
+    test "${bazel.name}" = "$(<$bazelOut/external/.nix-bazel-version)" || {
       echo "fixed output derivation was built for a different bazel version" >&2
-      echo "     got: $(<$deps/.nix-bazel-version)" >&2
+      echo "     got: $(<$bazelOut/external/.nix-bazel-version)" >&2
       echo "expected: ${bazel.name}" >&2
       exit 1
     }
 
-    cp -r $deps $bazelOut/external
     chmod -R +w $bazelOut
     find $bazelOut -type l | while read symlink; do
       ln -sf $(readlink "$symlink" | sed "s,NIX_BUILD_TOP,$NIX_BUILD_TOP,") "$symlink"
diff --git a/pkgs/development/compilers/gleam/default.nix b/pkgs/development/compilers/gleam/default.nix
index 5179142e40e1..1fa8720a400a 100644
--- a/pkgs/development/compilers/gleam/default.nix
+++ b/pkgs/development/compilers/gleam/default.nix
@@ -2,18 +2,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gleam";
-  version = "0.7.1";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "gleam-lang";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1bcxq7bgn0kf1vdw6id8s3izz6mwf3ivr8iph4miig302qm9lmmr";
+    sha256 = "05n8a7b63i9946fvbxphfh8n6ib20qnbv44ghlzcjwca9qvlx7i7";
   };
 
   buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
 
-  cargoSha256 = "17bvms65frxhw0d196qswh3jjqlriidq3xi3mfjjgfh6n17rh608";
+  cargoSha256 = "1ga5dinkmibkg53bfr6vc0i4bbgyn2y3d5qjf5bd965c1v7ba1jl";
 
   meta = with stdenv.lib; {
     description = "A statically typed language for the Erlang VM";
diff --git a/pkgs/development/interpreters/clojure/babashka.nix b/pkgs/development/interpreters/clojure/babashka.nix
index 130eabbee347..86c7938db04f 100644
--- a/pkgs/development/interpreters/clojure/babashka.nix
+++ b/pkgs/development/interpreters/clojure/babashka.nix
@@ -3,17 +3,17 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "babashka";
-  version = "0.0.89";
+  version = "0.0.94";
 
   reflectionJson = fetchurl {
     name = "reflection.json";
     url = "https://github.com/borkdude/${pname}/releases/download/v${version}/${pname}-${version}-reflection.json";
-    sha256 = "0bc5rbizd2lg7qfh733yiip8m9zqrwgjf5ca09sdibxp7nhhsjby";
+    sha256 = "103x5ih48rhhdipar66bp0s0j62fv4r3sszh8fwaivs7dvsvcvsd";
   };
 
   src = fetchurl {
     url = "https://github.com/borkdude/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "11jhqbm3svvikr9glz8wwps1267y25g3384ijw6avn267s7d7l8c";
+    sha256 = "0fin80x898qzylzq91q6mp8pgwk0sciwwa9l71mdhahqasa90sri";
   };
 
   dontUnpack = true;
@@ -79,6 +79,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/borkdude/babashka";
     license = licenses.epl10;
     platforms = graalvm8.meta.platforms;
-    maintainers = with maintainers; [ bhougland DerGuteMoritz jlesquembre ];
+    maintainers = with maintainers; [ bandresen bhougland DerGuteMoritz jlesquembre ];
   };
 }
diff --git a/pkgs/development/interpreters/j/default.nix b/pkgs/development/interpreters/j/default.nix
index c3d5221d42a7..8e6b434281eb 100644
--- a/pkgs/development/interpreters/j/default.nix
+++ b/pkgs/development/interpreters/j/default.nix
@@ -1,4 +1,6 @@
-{ stdenv, fetchFromGitHub, readline, libedit, bc }:
+{ stdenv, fetchFromGitHub, readline, libedit, bc
+, avxSupport ? false
+}:
 
 stdenv.mkDerivation rec {
   pname = "j";
@@ -19,6 +21,9 @@ stdenv.mkDerivation rec {
     if stdenv.isLinux then "linux" else
     if stdenv.isDarwin then "darwin" else
     "unknown";
+  variant = if stdenv.isx86_64 && avxSupport then "avx" else "";
+
+  j64x="j${bits}${variant}";
 
   doCheck = true;
 
@@ -34,7 +39,7 @@ stdenv.mkDerivation rec {
     patchShebangs .
     sed -i $JLIB/bin/profile.ijs -e "s@'/usr/share/j/.*'@'$out/share/j'@;"
 
-    ./build_all.sh
+    j64x="${j64x}" ./build_all.sh
 
     cp $SOURCE_DIR/bin/${platform}/j${bits}*/* "$JLIB/bin"
   '';
diff --git a/pkgs/development/interpreters/wasmer/default.nix b/pkgs/development/interpreters/wasmer/default.nix
index d3d9cf87207d..404c0731c349 100644
--- a/pkgs/development/interpreters/wasmer/default.nix
+++ b/pkgs/development/interpreters/wasmer/default.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasmer";
-  version = "0.16.2";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "wasmerio";
     repo = pname;
     rev = version;
-    sha256 = "124zq772kz9a7n3qpxgmp4awqj41l8mhhwc0y3r77i1q02i1sy7z";
+    sha256 = "05g4h0xkqd14wnmijiiwmhk6l909fjxr6a2zplrjfxk5bypdalpm";
     fetchSubmodules = true;
   };
 
-  cargoSha256 = "1qqysvcviimpm2zhzsbn8vhy91rxzaknh9hv75y38xd5ggnnh9m6";
+  cargoSha256 = "1ssmgx9fjvkq7ycyzjanqmlm5b80akllq6qyv3mj0k5fvs659wcq";
 
   nativeBuildInputs = [ cmake pkg-config ];
 
diff --git a/pkgs/development/libraries/cudd/cudd.patch b/pkgs/development/libraries/cudd/cudd.patch
new file mode 100644
index 000000000000..152fa30997f9
--- /dev/null
+++ b/pkgs/development/libraries/cudd/cudd.patch
@@ -0,0 +1,14 @@
+diff --git a/Makefile.am b/Makefile.am
+index 45f216a..39c3c82 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -3,6 +3,9 @@ ACLOCAL_AMFLAGS = -I m4
+ include_HEADERS = cudd/cudd.h
+ if DDDMP
+ include_HEADERS += dddmp/dddmp.h
++include_HEADERS += util/util.h
++include_HEADERS += config.h
++include_HEADERS += mtr/mtr.h
+ endif
+ if OBJ
+ include_HEADERS += cplusplus/cuddObj.hh
diff --git a/pkgs/development/libraries/cudd/default.nix b/pkgs/development/libraries/cudd/default.nix
new file mode 100644
index 000000000000..6749d2e94c0f
--- /dev/null
+++ b/pkgs/development/libraries/cudd/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, fetchurl, autoreconfHook }:
+
+stdenv.mkDerivation rec {
+  pname = "cudd";
+  version = "3.0.0";
+
+  src = fetchurl {
+    url = "https://davidkebo.com/source/cudd_versions/cudd-3.0.0.tar.gz";
+    sha256 = "0sgbgv7ljfr0lwwwrb9wsnav7mw7jmr3k8mygwza15icass6dsdq";
+  };
+
+  configureFlags = [
+    "--enable-dddmp"
+    "--enable-obj"
+  ];
+
+  patches = [
+    ./cudd.patch
+  ];
+
+  nativeBuildInputs = [ autoreconfHook ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://davidkebo.com/cudd";
+    description = "Binary Decision Diagram (BDD) library";
+    license = licenses.bsd3;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ chessai ];
+  };
+}
diff --git a/pkgs/development/libraries/libcello/default.nix b/pkgs/development/libraries/libcello/default.nix
index 1ef749c1740d..908c9cb15dd2 100644
--- a/pkgs/development/libraries/libcello/default.nix
+++ b/pkgs/development/libraries/libcello/default.nix
@@ -1,17 +1,21 @@
-{stdenv, fetchurl}:
+{ stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "libcello-0.9.2";
+  pname = "libcello";
+  version = "2.1.0";
 
   src = fetchurl {
-    url = "http://libcello.org/static/${name}.tar.gz";
-    sha256 = "cd82639cb9b133119fd89a77a5a505a55ea5fcc8decfc53bee0725358ec8bad0";
+    url = "http://libcello.org/static/libCello-${version}.tar.gz";
+    sha256 = "0a1b2x5ni07vd9ridnl7zv7h2s32070wsphjy94qr066b99gdb29";
   };
 
+  makeFlags = [ "PREFIX=$(out)" ];
+
   meta = {
     homepage = "http://libcello.org/";
     description = "Higher level programming in C";
     license = stdenv.lib.licenses.bsd3;
+    maintainers = [ stdenv.lib.maintainers.MostAwesomeDude ];
     platforms = stdenv.lib.platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/librealsense/default.nix b/pkgs/development/libraries/librealsense/default.nix
index a8924ca47825..8fd90c60bdad 100644
--- a/pkgs/development/libraries/librealsense/default.nix
+++ b/pkgs/development/libraries/librealsense/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "librealsense";
-  version = "2.33.1";
+  version = "2.34.0";
 
   outputs = [ "out" "dev" ];
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     owner = "IntelRealSense";
     repo = pname;
     rev = "v${version}";
-    sha256 = "04macplj3k2sdpf1wdjm6gsghak5dzfhi2pmr47qldh2sy2zz0a3";
+    sha256 = "0bi7pszrryz18aqna0z73mb1hzz2vqdb0m00pf93hnwc2hba7hwm";
   };
 
   buildInputs = [
diff --git a/pkgs/development/libraries/liburcu/default.nix b/pkgs/development/libraries/liburcu/default.nix
index 5292ec9d7e0c..6046bcf8eab3 100644
--- a/pkgs/development/libraries/liburcu/default.nix
+++ b/pkgs/development/libraries/liburcu/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl }:
 
 stdenv.mkDerivation rec {
-  version = "0.11.1";
+  version = "0.12.1";
   pname = "liburcu";
 
   src = fetchurl {
     url = "https://lttng.org/files/urcu/userspace-rcu-${version}.tar.bz2";
-    sha256 = "0l1kxgzch4m8fxiz2hc8fwg56hrvzzspp7n0svnl7i7iycdrgfcj";
+    sha256 = "03nd1gy2c3fdb6xwdrd5lr1jcjxbzffqh3z91mzbjhjn6k8fmymv";
   };
 
   checkInputs = [ perl ];
diff --git a/pkgs/development/libraries/libvirt/default.nix b/pkgs/development/libraries/libvirt/default.nix
index c1b34879eef3..3c0cc9751e3b 100644
--- a/pkgs/development/libraries/libvirt/default.nix
+++ b/pkgs/development/libraries/libvirt/default.nix
@@ -4,7 +4,7 @@
 , iproute, iptables, readline, lvm2, utillinux, systemd, libpciaccess, gettext
 , libtasn1, ebtables, libgcrypt, yajl, pmutils, libcap_ng, libapparmor
 , dnsmasq, libnl, libpcap, libxslt, xhtml1, numad, numactl, perlPackages
-, curl, libiconv, gmp, zfs, parted, bridge-utils, dmidecode
+, curl, libiconv, gmp, zfs, parted, bridge-utils, dmidecode, dbus
 , enableXen ? false, xen ? null
 , enableIscsi ? false, openiscsi
 , enableCeph ? false, ceph
@@ -36,7 +36,7 @@ in stdenv.mkDerivation rec {
   nativeBuildInputs = [ makeWrapper pkgconfig docutils ] ++ optionals (!buildFromTarball) [ autoreconfHook ];
   buildInputs = [
     libxml2 gnutls perl python2 readline gettext libtasn1 libgcrypt yajl
-    libxslt xhtml1 perlPackages.XMLXPath curl libpcap glib
+    libxslt xhtml1 perlPackages.XMLXPath curl libpcap glib dbus
   ] ++ optionals stdenv.isLinux [
     libpciaccess lvm2 utillinux systemd libnl numad zfs
     libapparmor libcap_ng numactl attr parted
@@ -74,6 +74,7 @@ in stdenv.mkDerivation rec {
     "--with-test"
     "--with-esx"
     "--with-remote"
+    "--with-polkit"
   ] ++ optionals stdenv.isLinux [
     "QEMU_BRIDGE_HELPER=/run/wrappers/bin/qemu-bridge-helper"
     "QEMU_PR_HELPER=/run/libvirt/nix-helpers/qemu-pr-helper"
diff --git a/pkgs/development/libraries/science/math/sympow/default.nix b/pkgs/development/libraries/science/math/sympow/default.nix
index e67f61599b57..ae7a7c778de0 100644
--- a/pkgs/development/libraries/science/math/sympow/default.nix
+++ b/pkgs/development/libraries/science/math/sympow/default.nix
@@ -9,7 +9,7 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "2.023.5";
+  version = "2.023.6";
   pname = "sympow";
 
   src = fetchFromGitLab {
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     owner = "forks";
     repo = "sympow";
     rev = "v${version}";
-    sha256 = "1c5a2pizgqsf3pjkf7rfj20022ym4ixhrddp8ivs2nbzxwz6qvv9";
+    sha256 = "132l0xv00ld1svvv9wh99wfra4zzjv2885h2sq0dsl98wiyvi5zl";
   };
 
   postUnpack = ''
diff --git a/pkgs/development/libraries/sentencepiece/default.nix b/pkgs/development/libraries/sentencepiece/default.nix
index 52b39ddc25bf..f6969dcdb6f0 100644
--- a/pkgs/development/libraries/sentencepiece/default.nix
+++ b/pkgs/development/libraries/sentencepiece/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sentencepiece";
-  version = "0.1.86";
+  version = "0.1.90";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0r4z5n3dx0bg1pm2kgfllyj65s7ljn2ny7i7c5bz618r7h8bax9p";
+    sha256 = "10y16qkr2ibn8synmyzgwcbkszyfys1v0dx75p3mayh02yif4dx2";
   };
 
   nativeBuildInputs = [ cmake ] ++ lib.optional withGPerfTools gperftools;
diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index 84ffd2cd8130..4d968cc325ec 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -178,7 +178,6 @@ stdenv.mkDerivation rec {
     homepage = "https://webkitgtk.org/";
     license = licenses.bsd2;
     platforms = platforms.linux;
-    hydraPlatforms = [];
     maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/development/ocaml-modules/fiat-p256/default.nix b/pkgs/development/ocaml-modules/fiat-p256/default.nix
new file mode 100644
index 000000000000..ac7e6640eeab
--- /dev/null
+++ b/pkgs/development/ocaml-modules/fiat-p256/default.nix
@@ -0,0 +1,26 @@
+{ lib, buildDunePackage, fetchurl, alcotest, asn1-combinators, benchmark
+, bigarray-compat, cstruct, eqaf, hex, ppx_deriving_yojson, rresult
+, stdlib-shims, yojson, dune-configurator }:
+
+buildDunePackage rec {
+  pname = "fiat-p256";
+  version = "0.2.1";
+
+  src = fetchurl {
+    url = "https://github.com/mirage/fiat/releases/download/v${version}/${pname}-v${version}.tbz";
+    sha256 = "0086h9qkvnqfm8acrxqbki54z619nj73x7f0d01v5vg2naznx7w9";
+  };
+
+  buildInputs = [ dune-configurator ];
+  propagatedBuildInputs = [ bigarray-compat cstruct eqaf hex ];
+  checkInputs = [ alcotest asn1-combinators benchmark
+                  ppx_deriving_yojson rresult stdlib-shims yojson ];
+  doCheck = true;
+
+  meta = with lib; {
+    description = "Primitives for Elliptic Curve Cryptography taken from Fiat";
+    homepage = "https://github.com/mirage/fiat";
+    license = licenses.mit;
+    maintainers = with maintainers; [ sternenseemann ];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/hacl_x25519/default.nix b/pkgs/development/ocaml-modules/hacl_x25519/default.nix
new file mode 100644
index 000000000000..a741f5b66819
--- /dev/null
+++ b/pkgs/development/ocaml-modules/hacl_x25519/default.nix
@@ -0,0 +1,23 @@
+{ lib, buildDunePackage, fetchurl, benchmark, cstruct
+, eqaf, hex, ppx_blob, ppx_deriving_yojson, stdlib-shims, yojson }:
+
+buildDunePackage rec {
+  pname = "hacl_x25519";
+  version = "0.1.1";
+
+  src = fetchurl {
+    url = "https://github.com/mirage/hacl/releases/download/v${version}/${pname}-v${version}.tbz";
+    sha256 = "187khbx1myh942c2v5f7wbms2hmhmgn57ik25djhnryln32c0874";
+  };
+
+  propagatedBuildInputs = [ eqaf cstruct ];
+  checkInputs = [ benchmark hex ppx_blob ppx_deriving_yojson stdlib-shims yojson ];
+  doCheck = true;
+
+  meta = with lib; {
+    description = "Primitives for Elliptic Curve Cryptography taken from Project Everest";
+    homepage = "https://github.com/mirage/hacl";
+    license = licenses.mit;
+    maintainers = with maintainers; [ sternenseemann ];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/hkdf/default.nix b/pkgs/development/ocaml-modules/hkdf/default.nix
new file mode 100644
index 000000000000..9832a5f4c41b
--- /dev/null
+++ b/pkgs/development/ocaml-modules/hkdf/default.nix
@@ -0,0 +1,26 @@
+{ lib, buildDunePackage, fetchurl, cstruct, mirage-crypto, alcotest }:
+
+buildDunePackage rec {
+  pname = "hkdf";
+  version = "1.0.4";
+
+  minimumOCamlVersion = "4.07";
+
+  src = fetchurl {
+    url = "https://github.com/hannesm/ocaml-${pname}/releases/download/v${version}/${pname}-v${version}.tbz";
+    sha256 = "0nzx6vzbc1hh6vx1ly8df4b16lgps6zjpp9mjycsnnn49bddc9mr";
+  };
+
+  useDune2 = true;
+
+  propagatedBuildInputs = [ cstruct mirage-crypto ];
+  checkInputs = [ alcotest ];
+  doCheck = true;
+
+  meta = with lib; {
+    description = "HMAC-based Extract-and-Expand Key Derivation Function (RFC 5869)";
+    homepage = "https://github.com/hannesm/ocaml-hkdf";
+    license = licenses.mit;
+    maintainers = with maintainers; [ sternenseemann ];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/janestreet/re2.nix b/pkgs/development/ocaml-modules/janestreet/re2.nix
deleted file mode 100644
index 1157c398080b..000000000000
--- a/pkgs/development/ocaml-modules/janestreet/re2.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{stdenv, buildOcamlJane,
- bin_prot, core_kernel, fieldslib, sexplib, typerep, variantslib,
- ppx_assert, ppx_bench, ppx_driver, ppx_expect, ppx_inline_test, ppx_jane,
- rsync}:
-
-buildOcamlJane {
-  name = "re2";
-  hash = "0fw5jscb1i17aw8v4l965zw20kyimhfnmf4w83wqaaxkqy3l6fqw";
-  buildInputs = [ rsync ];
-  propagatedBuildInputs =
-    [ bin_prot core_kernel fieldslib sexplib typerep variantslib
-      ppx_assert ppx_bench ppx_driver ppx_expect ppx_inline_test ppx_jane ];
-
-  meta = with stdenv.lib; {
-    homepage = "https://github.com/janestreet/re2";
-    description = "OCaml bindings for RE2";
-    maintainers = [ maintainers.maurer ];
-    license = licenses.asl20;
-  };
-}
diff --git a/pkgs/development/ocaml-modules/mdx/default.nix b/pkgs/development/ocaml-modules/mdx/default.nix
index 261374115ffa..1331c10d426b 100644
--- a/pkgs/development/ocaml-modules/mdx/default.nix
+++ b/pkgs/development/ocaml-modules/mdx/default.nix
@@ -1,19 +1,20 @@
 { lib, fetchurl, buildDunePackage, opaline, ocaml
+, alcotest
 , astring, cmdliner, cppo, fmt, logs, ocaml-migrate-parsetree, ocaml-version, ocaml_lwt, pandoc, re }:
 
 buildDunePackage rec {
   pname = "mdx";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchurl {
-    url = "https://github.com/realworldocaml/mdx/releases/download/1.5.0/mdx-1.5.0.tbz";
-    sha256 = "0g45plf4z7d178gp0bx7842fwbd3m19679yfph3s95da6mrfm3xn";
+    url = "https://github.com/realworldocaml/mdx/releases/download/${version}/mdx-${version}.tbz";
+    sha256 = "18m4ay226dwbgnwp3ia6bfcm033dvp9yby0lbddqn8ak374m2k3b";
   };
 
   nativeBuildInputs = [ cppo ];
   buildInputs = [ cmdliner ];
   propagatedBuildInputs = [ astring fmt logs ocaml-migrate-parsetree ocaml-version re ];
-  checkInputs = lib.optionals doCheck [ ocaml_lwt pandoc ];
+  checkInputs = [ alcotest ocaml_lwt pandoc ];
 
   doCheck = true;
 
diff --git a/pkgs/development/ocaml-modules/re2/Makefile.patch b/pkgs/development/ocaml-modules/re2/Makefile.patch
deleted file mode 100644
index fcb6eefe62b2..000000000000
--- a/pkgs/development/ocaml-modules/re2/Makefile.patch
+++ /dev/null
@@ -1,17 +0,0 @@
---- ./lib/Makefile	2014-11-18 08:16:19.000000000 -0800
-+++ ./lib/Makefile	2015-05-23 14:48:31.000000000 -0700
-@@ -6,12 +6,12 @@
- all: libre2_stubs.a dllre2_stubs.so
- 
- dllre2_stubs.so libre2_stubs.a: stubs.o $(LIBRE2)
--	ocamlmklib -oc re2_stubs stubs.o $(LIBRE2) -lstdc++
-+	ocamlmklib -oc re2_stubs stubs.o $(LIBRE2) -lc++
- 	rm libre2_stubs.a # ocamlmklib just includes $(LIBRE2) inside the stubs archive
- 	cp $(LIBRE2) libre2_stubs.a && ar r libre2_stubs.a stubs.o
- 
- stubs.o: stubs.cpp stubs.h util.h enum_x_macro.h
--	g++ -O2 -DPIC -fPIC -g -pipe -DCAML_NAME_SPACE -Wall -I. -I../../../include \
-+	$(CXX) -O2 -DPIC -fPIC -g -pipe -DCAML_NAME_SPACE -Wall -I. -I../../../include \
- 	-I$(RE2_HOME) -I$(ocaml-version-selected-include-path) -c stubs.cpp
- 
- #stubs.o: %.o: %.cpp %.h
diff --git a/pkgs/development/ocaml-modules/re2/default.nix b/pkgs/development/ocaml-modules/re2/default.nix
deleted file mode 100644
index 1132d97f74a5..000000000000
--- a/pkgs/development/ocaml-modules/re2/default.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{stdenv, buildOcaml, fetchurl, core_p4, pa_ounit, pa_test,
- bin_prot_p4, comparelib, sexplib_p4, rsync}:
-
-buildOcaml rec {
-  name = "re2";
-  version = "112.06.00";
-
-  minimumSupportedOcamlVersion = "4.00";
-
-  src = fetchurl {
-    url = "https://github.com/janestreet/re2/archive/${version}.tar.gz";
-    sha256 = "a538765872363fcb67f12b95c07455a0afd68f5ae9008b59bb85a996d97cc752";
-  };
-  patches = if stdenv.isDarwin
-            then [./Makefile.patch ./myocamlbuild.patch]
-            else null;
-
-  buildInputs = [ pa_ounit pa_test rsync ];
-  propagatedBuildInputs = [ core_p4 bin_prot_p4 comparelib sexplib_p4 ];
-
-  hasSharedObjects = true;
-
-  meta = with stdenv.lib; {
-    homepage = "https://github.com/janestreet/re2";
-    description = "OCaml bindings for RE2";
-    license = stdenv.lib.licenses.asl20;
-    maintainers = [ maintainers.ericbmerritt ];
-  };
-}
diff --git a/pkgs/development/ocaml-modules/re2/myocamlbuild.patch b/pkgs/development/ocaml-modules/re2/myocamlbuild.patch
deleted file mode 100644
index 46ad6fa801b8..000000000000
--- a/pkgs/development/ocaml-modules/re2/myocamlbuild.patch
+++ /dev/null
@@ -1,24 +0,0 @@
---- ./myocamlbuild.ml	2015-05-23 14:35:18.000000000 -0700
-+++ ./myocamlbuild.ml	2015-05-23 15:05:24.000000000 -0700
-@@ -626,16 +626,18 @@
-     rule "Generate lib/options.ml"
-       ~prod:"lib/options.ml"
-       ~deps:["lib/options.mlp"; "lib/enum_x_macro.h"]
--      (fun _ _ -> Cmd (S[A"gcc"; A"-E"; A"-P"; A"-x"; A"c";
-+      (fun _ _ -> Cmd (S[A"cc"; A"-E"; A"-P"; A"-x"; A"c";
-                          P"lib/options.mlp"; A"-o"; P"lib/options.ml"]));
- 
-     flag ["ocaml"; "link"; "library"; "native"] (S[A"-cclib"; A"-Llib";
-                                                    A"-cclib"; A"-lre2_stubs";
--                                                   A"-cclib"; A"-lstdc++"]);
-+                                                   A"-ccopt"; A"--stdlib=libc++";
-+                                                   A"-cclib"; A"-lc++"]);
-     flag ["ocaml"; "link"; "library"; "byte"]   (S[A"-dllib"; A"dllre2_stubs.so";
-                                                    A"-cclib"; A"-Llib";
-                                                    A"-cclib"; A"-lre2_stubs";
--                                                   A"-cclib"; A"-lstdc++"]);
-+                                                   A"-ccopt"; A"--stdlib=libc++";                                                   
-+                                                   A"-cclib"; A"-lc++"]);
-   | _ ->
-     ()
- 
diff --git a/pkgs/development/ocaml-modules/tls/default.nix b/pkgs/development/ocaml-modules/tls/default.nix
index e425e2a3b7e4..dea03f2b38a7 100644
--- a/pkgs/development/ocaml-modules/tls/default.nix
+++ b/pkgs/development/ocaml-modules/tls/default.nix
@@ -1,28 +1,30 @@
-{ stdenv, fetchurl, buildDunePackage, ppx_sexp_conv, ppx_cstruct, cstruct
+{ lib, fetchurl, buildDunePackage, ppx_sexp_conv, ppx_cstruct, cstruct
 , cstruct-sexp, sexplib, mirage-crypto, mirage-crypto-pk, mirage-crypto-rng
-, x509, domain-name, fmt, cstruct-unix, ounit2, ocaml_lwt, ptime }:
+, x509, domain-name, fmt, cstruct-unix, ounit2, ocaml_lwt, ptime
+, hacl_x25519, fiat-p256, hkdf, logs, alcotest }:
 
 buildDunePackage rec {
   minimumOCamlVersion = "4.07";
 
-  version = "0.11.1";
+  version = "0.12.0";
   pname = "tls";
 
   src = fetchurl {
     url = "https://github.com/mirleft/ocaml-tls/releases/download/v${version}/tls-v${version}.tbz";
-    sha256 = "0ms13fbaxgmpbviazlfa4hb7nmi7s22nklc7ns926b0rr1aq1069";
+    sha256 = "0fy38qmy7rcld1b4qzz4ycl1fr0v1wa7qd24125lpd6hly86fn57";
   };
 
   useDune2 = true;
 
   doCheck = true;
-  buildInputs = [ cstruct-unix ounit2 ];
+  checkInputs = [ cstruct-unix ounit2 alcotest ];
 
   propagatedBuildInputs = [ ppx_sexp_conv ppx_cstruct cstruct cstruct-sexp
                             sexplib mirage-crypto mirage-crypto-pk mirage-crypto-rng
-                            x509 domain-name fmt ocaml_lwt ptime ];
+                            x509 domain-name fmt ocaml_lwt ptime hacl_x25519 fiat-p256
+                            hkdf logs ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://github.com/mirleft/ocaml-tls";
     description = "TLS in pure OCaml";
     license = licenses.bsd2;
diff --git a/pkgs/development/ocaml-modules/wasm/default.nix b/pkgs/development/ocaml-modules/wasm/default.nix
index a76fa5eeebe0..06c84531482e 100644
--- a/pkgs/development/ocaml-modules/wasm/default.nix
+++ b/pkgs/development/ocaml-modules/wasm/default.nix
@@ -6,13 +6,13 @@ else
 
 stdenv.mkDerivation rec {
   name = "ocaml${ocaml.version}-wasm-${version}";
-  version = "1.1";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "WebAssembly";
     repo = "spec";
-    rev = "v${version}";
-    sha256 = "1jsgrjqzsdmm6f5pgd947nikj7pnxx1mqdnz16j7s62rg8x06h7d";
+    rev = "opam-${version}";
+    sha256 = "1kp72yv4k176i94np0m09g10cviqp2pnpm7jmiq6ik7fmmbknk7c";
   };
 
   buildInputs = [ ocaml findlib ocamlbuild ];
diff --git a/pkgs/development/python-modules/apache-airflow/default.nix b/pkgs/development/python-modules/apache-airflow/default.nix
index 4943a2e53f79..706648f56a31 100644
--- a/pkgs/development/python-modules/apache-airflow/default.nix
+++ b/pkgs/development/python-modules/apache-airflow/default.nix
@@ -167,6 +167,9 @@ buildPythonPackage rec {
       --replace "/bin/bash" "${stdenv.shell}"
   '';
 
+  # allow for gunicorn processes to have access to python packages
+  makeWrapperArgs = [ "--prefix PYTHONPATH : $PYTHONPATH" ];
+
   checkPhase = ''
    export HOME=$(mktemp -d)
    export AIRFLOW_HOME=$HOME
diff --git a/pkgs/development/python-modules/asdf/default.nix b/pkgs/development/python-modules/asdf/default.nix
index dd845b1d3496..f3c3615d9262 100644
--- a/pkgs/development/python-modules/asdf/default.nix
+++ b/pkgs/development/python-modules/asdf/default.nix
@@ -15,12 +15,12 @@
 
 buildPythonPackage rec {
   pname = "asdf";
-  version = "2.5.2";
+  version = "2.6.0";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0ai5l62ldaq1cqfmq3hvnzp8gp0hjjmjnck9d3cnx5r8la5ig18y";
+    sha256 = "1ym9mmxjpnnlinly1rxfqj9rlyl2fv7dxc81f30n1b8n9pwc6jb5";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/azure-core/default.nix b/pkgs/development/python-modules/azure-core/default.nix
index de3aab936c66..dc31669f7182 100644
--- a/pkgs/development/python-modules/azure-core/default.nix
+++ b/pkgs/development/python-modules/azure-core/default.nix
@@ -12,14 +12,14 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.4.0";
+  version = "1.5.0";
   pname = "azure-core";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "0vfcfpb01qsrqh9xg4xyfm153bczwjglkv59zpdvrn7x0rrdc1cc";
+    sha256 = "181iyigm11y56lf1kwv7pcdyppavpwjb1b6k3qp3jnbqaypad9mg";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/bidict/default.nix b/pkgs/development/python-modules/bidict/default.nix
index 84ff0e88b147..e29263a6b4f9 100644
--- a/pkgs/development/python-modules/bidict/default.nix
+++ b/pkgs/development/python-modules/bidict/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "bidict";
-  version = "0.18.3";
+  version = "0.19.0";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1742a25a9ef1b1ac4000683406879a3e1a6577faa02f31e482e6c84e2e3bf628";
+    sha256 = "11wiis62kcw6g3n4gdj39fx1yrlq5vz3zx3kmb6g79mliyhn2x7g";
   };
 
   nativeBuildInputs = [ setuptools_scm ];
diff --git a/pkgs/development/python-modules/dict2xml/default.nix b/pkgs/development/python-modules/dict2xml/default.nix
index 88cbee2649da..457e9d3e530b 100644
--- a/pkgs/development/python-modules/dict2xml/default.nix
+++ b/pkgs/development/python-modules/dict2xml/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "dict2xml";
-  version = "1.6.1";
+  version = "1.7.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "17wsybqq0916i1yh7bpf2cmicldn7d0y2b9mzlgs503fkcpxda5w";
+    sha256 = "0bfn8n8sb3slwx7ra8m8fbfy65k20h2qxcqfq99hwqrrkgcffihl";
   };
 
   propagatedBuildInputs = [ six ];
diff --git a/pkgs/development/python-modules/dm-sonnet/default.nix b/pkgs/development/python-modules/dm-sonnet/default.nix
index 08dbafe019e4..4205d32d4958 100644
--- a/pkgs/development/python-modules/dm-sonnet/default.nix
+++ b/pkgs/development/python-modules/dm-sonnet/default.nix
@@ -36,7 +36,7 @@ let
     bazelTarget = ":install";
 
     fetchAttrs = {
-      sha256 = "0wb2gh9ji8bgq4s9ci9x017dybxqzjhncpw33b1wjksm2yhbkvlz";
+      sha256 = "0jlgmwcanfkhkwvh4vxibpi0zyyl6xkjzcz2xqn7raympqscq81a";
     };
 
     bazelFlags = [
diff --git a/pkgs/development/python-modules/dotnetcore2/default.nix b/pkgs/development/python-modules/dotnetcore2/default.nix
index 075fce70cee4..7cc069707aad 100644
--- a/pkgs/development/python-modules/dotnetcore2/default.nix
+++ b/pkgs/development/python-modules/dotnetcore2/default.nix
@@ -15,7 +15,7 @@ buildPythonPackage rec {
     inherit pname version format;
     python = "py3";
     platform = "manylinux1_x86_64";
-    sha256 = "68182f4b704db401b2012c10ed8a19561f8d487063632f8731c2e58960ca9242";
+    sha256 = "0dxp9a73ncjylc09bjwq81fgj5ysk1yi27l8ka5f98121k1kmn6q";
   };
 
   nativeBuildInputs = [ unzip ];
@@ -35,14 +35,18 @@ buildPythonPackage rec {
     )
   ];
 
-  # prevent exposing a broken dotnet executable
-  postInstall = ''
-    rm -r $out/${python.sitePackages}/${pname}/bin
+  # remove bin, which has a broken dotnetcore installation
+  installPhase = ''
+    rm -rf dotnetcore2/bin
+    mkdir -p $out/${python.sitePackages}/
+    cp -r dotnetcore2 $out/${python.sitePackages}/
   '';
 
   # no tests, ensure it's one useful function works
   checkPhase = ''
-    ${python.interpreter} -c 'from dotnetcore2 import runtime; print(runtime.get_runtime_path())'
+    rm -r dotnetcore2 # avoid importing local directory
+    export PYTHONPATH=$out/${python.sitePackages}:$PYTHONPATH
+    ${python.interpreter} -c 'from dotnetcore2 import runtime; print(runtime.get_runtime_path()); runtime.ensure_dependencies()'
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/elasticsearch/default.nix b/pkgs/development/python-modules/elasticsearch/default.nix
index ce8c0dc77a0e..8c6d0bb543a6 100644
--- a/pkgs/development/python-modules/elasticsearch/default.nix
+++ b/pkgs/development/python-modules/elasticsearch/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage (rec {
   pname = "elasticsearch";
-  version = "7.1.0";
+  version = "7.6.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0140787216646e1eb7eb001f8146aff7071d7ca438854249787b6cc221ddd266";
+    sha256 = "1j499w9hbpyx0v83xnn1vrm45amx5lbnhlik65v5z1n0gb9v4a6j";
   };
 
   # Check is disabled because running them destroy the content of the local cluster!
diff --git a/pkgs/development/python-modules/flask-httpauth/default.nix b/pkgs/development/python-modules/flask-httpauth/default.nix
index 051b83d1c3d0..d2e6cf3e47bf 100644
--- a/pkgs/development/python-modules/flask-httpauth/default.nix
+++ b/pkgs/development/python-modules/flask-httpauth/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "Flask-HTTPAuth";
-  version = "3.3.0";
+  version = "4.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1fb1kr1iw6inkwfv160rpjx54vv1q9b90psdyyghyy1f6dhvgy3f";
+    sha256 = "1z3ad8sm24xl2lazdia92br1a2nigqwaf1lfsa77j5pz6gf2xmj7";
   };
 
   propagatedBuildInputs = [ flask ];
diff --git a/pkgs/development/python-modules/flask-versioned/default.nix b/pkgs/development/python-modules/flask-versioned/default.nix
new file mode 100644
index 000000000000..3bd5ef98b322
--- /dev/null
+++ b/pkgs/development/python-modules/flask-versioned/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, buildPythonPackage, fetchFromGitHub, flask }:
+
+buildPythonPackage rec {
+  pname = "Flask-Versioned";
+  version = "0.9.4-20101221";
+
+  src = fetchFromGitHub {
+    owner = "pilt";
+    repo = "flask-versioned";
+    rev = "38046fb53a09060de437c90a5f7370a6b94ffc31"; # no tags
+    sha256 = "1wim9hvx7lxzfg35c0nc7p34j4vw9mzisgijlz4ibgykah4g1y37";
+  };
+
+  propagatedBuildInputs = [ flask ];
+
+  meta = with stdenv.lib; {
+    description = "Flask plugin to rewrite file paths to add version info";
+    homepage = "https://github.com/pilt/flask-versioned";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ globin ];
+  };
+}
+
diff --git a/pkgs/development/python-modules/foolscap/default.nix b/pkgs/development/python-modules/foolscap/default.nix
index d1374ca71bf5..0c5a0fff79d2 100644
--- a/pkgs/development/python-modules/foolscap/default.nix
+++ b/pkgs/development/python-modules/foolscap/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "foolscap";
-  version = "0.13.2";
+  version = "20.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8498c7e9eaecb5b19be74b18d55c2086440be08de29f2bb507f9b505757467ff";
+    sha256 = "0rbw9makjmawkcxnkkngybj3n14s0dnzn9gkqqq2krcm514kmlb9";
   };
 
   propagatedBuildInputs = [ mock twisted pyopenssl service-identity ];
diff --git a/pkgs/development/python-modules/h2/default.nix b/pkgs/development/python-modules/h2/default.nix
index c267b6d47267..6d432fed0e4e 100644
--- a/pkgs/development/python-modules/h2/default.nix
+++ b/pkgs/development/python-modules/h2/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "h2";
-  version = "3.1.1";
+  version = "3.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1d1svhixk3hr78ph3nx8wi7sagx1xrvm712mmk028i2rhb92p8xq";
+    sha256 = "051gg30aca26rdxsmr9svwqm06pdz9bv21ch4n0lgi7jsvml2pw7";
   };
 
   propagatedBuildInputs = [ enum34 hpack hyperframe ];
diff --git a/pkgs/development/python-modules/huey/default.nix b/pkgs/development/python-modules/huey/default.nix
new file mode 100644
index 000000000000..28a801de71a6
--- /dev/null
+++ b/pkgs/development/python-modules/huey/default.nix
@@ -0,0 +1,25 @@
+{ lib, buildPythonPackage, fetchFromGitHub, redis }:
+
+buildPythonPackage rec {
+  pname = "huey";
+  version = "2.2.0";
+
+  src = fetchFromGitHub {
+    owner = "coleifer";
+    repo = pname;
+    rev = version;
+    sha256 = "1hgic7qrmb1kxvfgf2qqiw39nqyknf17pjvli8jfzvd9mv7cb7hh";
+  };
+
+  propagatedBuildInputs = [ redis ];
+
+  # connects to redis
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A little task queue for python";
+    homepage = "https://github.com/coleifer/huey";
+    license = licenses.mit;
+    maintainers = [ maintainers.globin ];
+  };
+}
diff --git a/pkgs/development/python-modules/intake/default.nix b/pkgs/development/python-modules/intake/default.nix
index 7c4768931a10..ca22dc4a9f97 100644
--- a/pkgs/development/python-modules/intake/default.nix
+++ b/pkgs/development/python-modules/intake/default.nix
@@ -11,6 +11,7 @@
 , numpy
 , pandas
 , panel
+, pyarrow
 , python-snappy
 , requests
 , ruamel_yaml
@@ -28,10 +29,10 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "bcb6558a9a7ccb1a3c5b7d1e3777ac8faed80894ef7826df119642430070ef7a";
+    sha256 = "0ypgf0046hln27gjcy7gjh4diblgmivkf7kxbcy1mjvwka55bdmw";
   };
 
-  checkInputs = [ pytest ];
+  checkInputs = [ pyarrow pytest ];
   propagatedBuildInputs = [
     appdirs
     dask
diff --git a/pkgs/development/python-modules/ipykernel/default.nix b/pkgs/development/python-modules/ipykernel/default.nix
index faf8d4b31b02..edf9d0863a19 100644
--- a/pkgs/development/python-modules/ipykernel/default.nix
+++ b/pkgs/development/python-modules/ipykernel/default.nix
@@ -42,6 +42,9 @@ buildPythonPackage rec {
     "test_subprocess_print"
     "test_subprocess_error"
     "test_ipython_start_kernel_no_userns"
+    
+    # https://github.com/ipython/ipykernel/issues/506
+    "test_unc_paths"    
   ] ++ lib.optionals (pythonOlder "3.8") [
     # flaky test https://github.com/ipython/ipykernel/issues/485
     "test_shutdown"
diff --git a/pkgs/development/python-modules/itypes/default.nix b/pkgs/development/python-modules/itypes/default.nix
index efbec0fb8fa2..17ba3a2183a3 100644
--- a/pkgs/development/python-modules/itypes/default.nix
+++ b/pkgs/development/python-modules/itypes/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "itypes";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     repo = pname;
     owner = "tomchristie";
     rev = version;
-    sha256 = "0zkhn16wpslkxkq77dqw5rxa28nrchcb6nd3vgnxv91p4skyfm62";
+    sha256 = "1ljhjp9pacbrv2phs58vppz1dlxix01p98kfhyclvbml6dgjcr52";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/m3u8/default.nix b/pkgs/development/python-modules/m3u8/default.nix
index 5763f3beb65d..01ff1458c0fa 100644
--- a/pkgs/development/python-modules/m3u8/default.nix
+++ b/pkgs/development/python-modules/m3u8/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "m3u8";
-  version = "0.5.4";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "globocom";
     repo = pname;
     rev = version;
-    sha256 = "1a2c7vqcysxkaffk40zg8d60l9hpjk0dw221fy9cg72i8jxq1gmm";
+    sha256 = "0cmg993icpsa1b19kljxvjwhs167bsqrs0ad4wnwsi8qq6na5d4p";
   };
 
   checkInputs = [ bottle pytest pytestcov ];
diff --git a/pkgs/development/python-modules/mail-parser/default.nix b/pkgs/development/python-modules/mail-parser/default.nix
index fe68b507ecf4..94b575f3f468 100644
--- a/pkgs/development/python-modules/mail-parser/default.nix
+++ b/pkgs/development/python-modules/mail-parser/default.nix
@@ -2,20 +2,24 @@
 
 buildPythonPackage rec {
   pname = "mail-parser";
-  version = "3.9.3";
+  version = "3.12.0";
 
   # no tests in PyPI tarball
   src = fetchFromGitHub {
     owner = "SpamScope";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0v6hgsz6yvp6csgx4y440ksqj24rdsd06vyfqcihiy3dfvp9229y";
+    sha256 = "0p851jlly6bzcs70kd1lcjwmg4scwh1icymfc0f2y6rkh4kfsdhk";
   };
 
   LC_ALL = "en_US.utf-8";
 
+  # remove version bounds
+  prePatch = ''
+    sed -i -e 's/==.*//g' requirements.txt
+  ''
   # ipaddress is part of the standard library of Python 3.3+
-  prePatch = lib.optionalString (!pythonOlder "3.3") ''
+  + lib.optionalString (!pythonOlder "3.3") ''
     substituteInPlace requirements.txt \
       --replace "ipaddress" ""
   '';
diff --git a/pkgs/development/python-modules/msal/default.nix b/pkgs/development/python-modules/msal/default.nix
index 10e62f5cc58f..705ae9b61ccb 100644
--- a/pkgs/development/python-modules/msal/default.nix
+++ b/pkgs/development/python-modules/msal/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "msal";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "16l2bmmm5pdlb61av5748mhy0lg9r965lmyn69is6mhsyr9zi38s";
+    sha256 = "0pqprfgcsns89gmlm284zcvqnlsn3a5c46n1p33kdk53gyyym66y";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/msgpack-numpy/default.nix b/pkgs/development/python-modules/msgpack-numpy/default.nix
index ef0bbaadc9b5..d646c1ed15f2 100644
--- a/pkgs/development/python-modules/msgpack-numpy/default.nix
+++ b/pkgs/development/python-modules/msgpack-numpy/default.nix
@@ -13,7 +13,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "af26f6f839b954bf072b3e47f6d954517d6b6d6956d26097331b571545d1747c";
+    sha256 = "0z3ls52iamqv6fbn1ljnd5nnnzaiakczciry5c3vym5r77wgc9mg";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/numpy-stl/default.nix b/pkgs/development/python-modules/numpy-stl/default.nix
index 2f480a85e04f..b862319d9477 100644
--- a/pkgs/development/python-modules/numpy-stl/default.nix
+++ b/pkgs/development/python-modules/numpy-stl/default.nix
@@ -6,7 +6,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "192556df794b9ef0c1333fd5f034e4a3905d63f52345a0cc1e359045670e34b6";
+    sha256 = "1dil1rklb41m3v6a0i93ymimv453whsg1m9z6g0z17jbg7gmc98r";
   };
 
   checkInputs = [ pytest pytestrunner ];
diff --git a/pkgs/development/python-modules/parse/default.nix b/pkgs/development/python-modules/parse/default.nix
index 08af6dc2720e..bb09646b6b46 100644
--- a/pkgs/development/python-modules/parse/default.nix
+++ b/pkgs/development/python-modules/parse/default.nix
@@ -3,11 +3,11 @@
 }:
 buildPythonPackage rec {
   pname = "parse";
-  version = "1.12.1";
+  version = "1.15.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a5fca7000c6588d77bc65c28f3f21bfce03b5e44daa8f9f07c17fe364990d717";
+    sha256 = "1h4m5df5grjpaf087g8ciishz5ajl28s3140s8bngppvy71f5m56";
   };
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/pgspecial/default.nix b/pkgs/development/python-modules/pgspecial/default.nix
index 0b49684f5239..61ab5532ca9d 100644
--- a/pkgs/development/python-modules/pgspecial/default.nix
+++ b/pkgs/development/python-modules/pgspecial/default.nix
@@ -6,7 +6,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f65c74a7ecfd4d6af3feb963a1bf8a612e5882731f69afd06ae66ffee13238cb";
+    sha256 = "1jrq6bhzwvz6db8ays8zff15hbk1iazs2qxrzvrnlkgxxjkp8p7n";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/phonenumbers/default.nix b/pkgs/development/python-modules/phonenumbers/default.nix
index d92f7bf59435..42621493d243 100644
--- a/pkgs/development/python-modules/phonenumbers/default.nix
+++ b/pkgs/development/python-modules/phonenumbers/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "phonenumbers";
-  version = "8.12.3";
+  version = "8.12.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a5e6615a36b3366bc1193feeb4e461b49d2b26b29ea43ca4f7dcc53f0182bbd1";
+    sha256 = "000vhxjlgvs0w3vywlgx1kq8wj0wk07ybnsdn1qwbamd06msvbb1";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index a6762349f6f9..f28ea5b24a63 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -27,7 +27,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "26a2ebb95055fc5d66fe3d451e6005abbd4d6c05ef113086983a9b8fe7ecc60f";
+    sha256 = "03y6xkkqz6rsk23304gg0mn4vgdb0mh1wi9xzrk5vz2ma2wyp8i6";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/privacyidea/default.nix b/pkgs/development/python-modules/privacyidea/default.nix
new file mode 100644
index 000000000000..84cc4530b34e
--- /dev/null
+++ b/pkgs/development/python-modules/privacyidea/default.nix
@@ -0,0 +1,51 @@
+{ lib, buildPythonPackage, fetchFromGitHub, cacert, openssl, python
+
+, cryptography, pyrad, pymysql, python-dateutil, flask-versioned, flask_script
+, defusedxml, croniter, flask_migrate, pyjwt, configobj, sqlsoup, pillow
+, python-gnupg, passlib, pyopenssl, beautifulsoup4, smpplib, flask-babel
+, ldap3, huey, pyyaml, qrcode, oauth2client, requests, lxml, cbor2, psycopg2
+
+, mock, pytest, responses, testfixtures
+}:
+
+buildPythonPackage rec {
+  pname = "privacyIDEA";
+  version = "3.3";
+
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "188ki924dig899wlih45xfsm0s7mjkya56vii26bg02h91izrb4b";
+  };
+
+  propagatedBuildInputs = [
+    cryptography pyrad pymysql python-dateutil flask-versioned flask_script
+    defusedxml croniter flask_migrate pyjwt configobj sqlsoup pillow
+    python-gnupg passlib pyopenssl beautifulsoup4 smpplib flask-babel
+    ldap3 huey pyyaml qrcode oauth2client requests lxml cbor2 psycopg2
+  ];
+
+  checkInputs = [ openssl mock pytest responses testfixtures ];
+  # issues with hardware token tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "privacyidea" ];
+
+  postPatch = ''
+    substituteInPlace privacyidea/lib/resolvers/LDAPIdResolver.py --replace \
+      "/etc/privacyidea/ldap-ca.crt" \
+      "${cacert}/etc/ssl/certs/ca-bundle.crt"
+  '';
+
+  postInstall = ''
+    rm -rf $out/${python.sitePackages}/tests
+  '';
+
+  meta = with lib; {
+    description = "Multi factor authentication system (2FA, MFA, OTP Server)";
+    license = licenses.agpl3Plus;
+    homepage = "http://www.privacyidea.org";
+    maintainers = [ maintainers.globin ];
+  };
+}
diff --git a/pkgs/development/python-modules/privacyidea/ldap-proxy.nix b/pkgs/development/python-modules/privacyidea/ldap-proxy.nix
new file mode 100644
index 000000000000..ec87186a4fdd
--- /dev/null
+++ b/pkgs/development/python-modules/privacyidea/ldap-proxy.nix
@@ -0,0 +1,27 @@
+{ lib, buildPythonPackage, fetchFromGitHub, twisted, ldaptor, configobj }:
+
+buildPythonPackage rec {
+  pname = "privacyidea-ldap-proxy";
+  version = "0.6.1";
+
+  src = fetchFromGitHub {
+    owner = "privacyidea";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1kc1n9wr1a66xd5zvl6dq78xnkqkn5574jpzashc99pvm62dr24j";
+  };
+
+  propagatedBuildInputs = [ twisted ldaptor configobj ];
+
+  # python 2 zope.interface test import path issues
+  doCheck = false;
+
+  pythonImportsCheck = [ "pi_ldapproxy" ];
+
+  meta = with lib; {
+    description = "LDAP Proxy to intercept LDAP binds and authenticate against privacyIDEA";
+    homepage = "https://github.com/privacyidea/privacyidea-ldap-proxy";
+    license = licenses.agpl3;
+    maintainers = [ maintainers.globin ];
+  };
+}
diff --git a/pkgs/development/python-modules/pydantic/default.nix b/pkgs/development/python-modules/pydantic/default.nix
index 4e0623e5cc1e..ef33b6fb2bd5 100644
--- a/pkgs/development/python-modules/pydantic/default.nix
+++ b/pkgs/development/python-modules/pydantic/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pydantic";
-  version = "1.4";
+  version = "1.5.1";
   disabled = !isPy3k;
 
   src = fetchFromGitHub {
     owner = "samuelcolvin";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1zmnwyvvrj6nb2r1wh63yb6dzqaxw8m4njzqycjdq9911c5gwg6z";
+    sha256 = "0fwrx7p6d5vskg9ibganahiz9y9299idvdmzhjw62jy84gn1vrb4";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pydocstyle/default.nix b/pkgs/development/python-modules/pydocstyle/default.nix
index eb85c690d81f..1825c690f30c 100644
--- a/pkgs/development/python-modules/pydocstyle/default.nix
+++ b/pkgs/development/python-modules/pydocstyle/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "pydocstyle";
-  version = "4.0.1";
+  version = "5.0.2";
   disabled = !isPy3k;
 
   src = fetchFromGitHub {
     owner = "PyCQA";
     repo = pname;
     rev = version;
-    sha256 = "1sr8d2fsfpam4f14v4als6g2v6s3n9h138vxlwhd6slb3ll14y4l";
+    sha256 = "03z8miyppm2xncrc9yjilwl7z5c5cpv51zha580v64p8sb2l0j7j";
   };
 
   propagatedBuildInputs = [ snowballstemmer ];
diff --git a/pkgs/development/python-modules/pygit2/default.nix b/pkgs/development/python-modules/pygit2/default.nix
index ff14c78a7b70..4e0c294de019 100644
--- a/pkgs/development/python-modules/pygit2/default.nix
+++ b/pkgs/development/python-modules/pygit2/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pygit2";
-  version = "1.1.1";
+  version = "1.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "klXVB9XYe/It/VeZeniQgBAzH8IfmoPsoSGlP2V76zw=";
+    sha256 = "11q3a0p4mvzdskla0c6ffcrddldfbh7dc4p5l6xrriwri88j356y";
   };
 
   preConfigure = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/python-modules/pyhcl/default.nix b/pkgs/development/python-modules/pyhcl/default.nix
index d3e0da07868b..62d40e368efc 100644
--- a/pkgs/development/python-modules/pyhcl/default.nix
+++ b/pkgs/development/python-modules/pyhcl/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pyhcl";
-  version = "0.4.2";
+  version = "0.4.4";
   disabled = !isPy3k;
 
   src = fetchFromGitHub {
     owner = "virtuald";
     repo = pname;
     rev = version;
-    sha256 = "01y5fn3pis43i0w0858wmrc8azfinp07a16ixglmg28gg07c0zkd";
+    sha256 = "0rcpx4vvj2c6wxp31vay7a2xa5p62kabi91vps9plj6710yz29nc";
   };
 
   # https://github.com/virtuald/pyhcl/blob/51a7524b68fe21e175e157b8af931016d7a357ad/setup.py#L64
diff --git a/pkgs/development/python-modules/pylatexenc/default.nix b/pkgs/development/python-modules/pylatexenc/default.nix
index d4f14f3be014..02a0f8758369 100644
--- a/pkgs/development/python-modules/pylatexenc/default.nix
+++ b/pkgs/development/python-modules/pylatexenc/default.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "pylatexenc";
-  version = "2.2";
+  version = "2.4";
 
   src = fetchFromGitHub {
     owner = "phfaist";
     repo = "pylatexenc";
     rev = "v${version}";
-    sha256 = "0icwd7iipz3sv4jdh9iam7h4xslvdqg16rwsmczrna3mmjbwccdk";
+    sha256 = "0i4frypbv90mjir8bkp03cwkvwhgvc9p3fw6q2jz1dn7fw94v2rv";
   };
 
   pythonImportsCheck = [ "pylatexenc" ];
diff --git a/pkgs/development/python-modules/pylint-django/default.nix b/pkgs/development/python-modules/pylint-django/default.nix
index 8530e6f8543d..af4b0177eb26 100644
--- a/pkgs/development/python-modules/pylint-django/default.nix
+++ b/pkgs/development/python-modules/pylint-django/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pylint-django";
-  version = "2.0.14";
+  version = "2.0.15";
   disabled = !isPy3k;
 
   src = fetchFromGitHub {
     owner = "PyCQA";
     repo = pname;
     rev = "v${version}";
-    sha256 = "07fkwb4phfr71dpajnq6l64phjxvljx2nf8ibs12n9gwjdvm9i52";
+    sha256 = "0wpzd3j01njxfclbhxz31s5clc7il67nhm4lz89q2aaj19c0xzsa";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pymediainfo/default.nix b/pkgs/development/python-modules/pymediainfo/default.nix
index a7bdfeea90a8..a0575bbfede7 100644
--- a/pkgs/development/python-modules/pymediainfo/default.nix
+++ b/pkgs/development/python-modules/pymediainfo/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "pymediainfo";
-  version = "4.1";
+  version = "4.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0mhpxs7vlqx8w75z93dy7nnvx89kwfdjkla03l19an15rlyqyspd";
+    sha256 = "0vg2icmsc44k1ra898rjfp912xijsn96s0zplax6w13lpzb9jb9r";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyrad/default.nix b/pkgs/development/python-modules/pyrad/default.nix
new file mode 100644
index 000000000000..31cbf77d94e0
--- /dev/null
+++ b/pkgs/development/python-modules/pyrad/default.nix
@@ -0,0 +1,27 @@
+{ buildPythonPackage, fetchFromGitHub, lib, netaddr, six, nose }:
+
+buildPythonPackage rec {
+  pname = "pyrad";
+  version = "2.3";
+
+  src = fetchFromGitHub {
+    owner = "pyradius";
+    repo = pname;
+    rev = version;
+    sha256 = "0hy7999av47s8100afbhxfjb8phbmrqcv530xlvskndby4a8w94k";
+  };
+
+  propagatedBuildInputs = [ netaddr six ];
+  checkInputs = [ nose ];
+
+  checkPhase = ''
+    nosetests -e testBind
+  '';
+
+  meta = with lib; {
+    description = "Python RADIUS Implementation";
+    homepage = "https://bitbucket.org/zzzeek/sqlsoup";
+    license = licenses.mit;
+    maintainers = [ maintainers.globin ];
+  };
+}
diff --git a/pkgs/development/python-modules/pysmbc/default.nix b/pkgs/development/python-modules/pysmbc/default.nix
index 1a4814a9db0a..e242dbe5e96e 100644
--- a/pkgs/development/python-modules/pysmbc/default.nix
+++ b/pkgs/development/python-modules/pysmbc/default.nix
@@ -9,7 +9,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit pname version;
     extension = "tar.bz2";
-    sha256 = "5ea23fdac4cd6e5d5c814a9fff84edbc3701270e6f40fcffa18a4554862b6791";
+    sha256 = "14b75f358ical7zzqh3g1qkh2dxwxn2gz7sah5f5svndqkd3z8jy";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/development/python-modules/pysolr/default.nix b/pkgs/development/python-modules/pysolr/default.nix
index 0544b84e532f..bf56d7ca56e6 100644
--- a/pkgs/development/python-modules/pysolr/default.nix
+++ b/pkgs/development/python-modules/pysolr/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pysolr";
-  version = "3.8.1";
+  version = "3.9.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "88ecb176627db6bcf9aeb94a3570bfa0363cb68be4b2a6d89a957d4a87c0a81b";
+    sha256 = "1rj5jmscvxjwcmlfi6hmkj44l4x6n3ln5p7d8d18j566hzmmzw3f";
   };
 
   nativeBuildInputs = [ setuptools_scm ];
diff --git a/pkgs/development/python-modules/qiskit-aer/default.nix b/pkgs/development/python-modules/qiskit-aer/default.nix
index 70c5ba38fea5..7c74ddab2b16 100644
--- a/pkgs/development/python-modules/qiskit-aer/default.nix
+++ b/pkgs/development/python-modules/qiskit-aer/default.nix
@@ -2,6 +2,7 @@
 , pythonOlder
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , cvxpy
 , cython
@@ -18,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "qiskit-aer";
-  version = "0.5.0";
+  version = "0.5.1";
 
   disabled = pythonOlder "3.5";
 
@@ -27,7 +28,7 @@ buildPythonPackage rec {
     repo = "qiskit-aer";
     rev = version;
     fetchSubmodules = true; # fetch muparserx and other required libraries
-    sha256 = "05lsirrdnnr5yqhwkgv08d9aib8xq4xpd6aq2pfqsi9qkii2fff1";
+    sha256 = "0pbi8ldz8f1zm7pf2n5229g6kccriq21f24q9cb7bd4j5gdky5sk";
   };
 
   nativeBuildInputs = [
@@ -47,7 +48,15 @@ buildPythonPackage rec {
     pybind11
   ];
 
-  prePatch = ''
+  patches = [
+    (fetchpatch{
+      name = "qiskit-aer-pr-727-fix-random-unitary-test.patch";
+      url = "https://github.com/Qiskit/qiskit-aer/commit/09afb3b6b0710042ab65d88e863363f2c843dcb0.patch";
+      sha256 = "0521b7i4fpc5brqs08w381g3c655f9cbn6my1740jnk7dv5lhsv9";
+    })
+  ];
+
+  postPatch = ''
     # remove dependency on PyPi cmake package, which isn't in Nixpkgs
     substituteInPlace setup.py --replace "'cmake!=3.17,!=3.17.0'" ""
   '';
@@ -81,7 +90,7 @@ buildPythonPackage rec {
     # Tests include a compiled "circuit" which is auto-built in $HOME
     export HOME=$(mktemp -d)
     # move tests b/c by default try to find (missing) cython-ized code in /build/source dir
-    cp -r test $HOME
+    cp -r $TMP/$sourceRoot/test $HOME
 
     # Add qiskit-aer compiled files to cython include search
     pushd $HOME
diff --git a/pkgs/development/python-modules/qiskit-aqua/default.nix b/pkgs/development/python-modules/qiskit-aqua/default.nix
index 9ff6404f2fcf..8037d28f82cf 100644
--- a/pkgs/development/python-modules/qiskit-aqua/default.nix
+++ b/pkgs/development/python-modules/qiskit-aqua/default.nix
@@ -2,6 +2,7 @@
 , pythonOlder
 , buildPythonPackage
 , fetchFromGitHub
+# , cplex
 , cvxopt
 , dlx
 , docplex
@@ -10,19 +11,20 @@
 , networkx
 , numpy
 , psutil
+, python
 , qiskit-ignis
 , qiskit-terra
 , quandl
 , scikitlearn
   # Check Inputs
-, parameterized
+, ddt
 , pytestCheckHook
 , qiskit-aer
 }:
 
 buildPythonPackage rec {
   pname = "qiskit-aqua";
-  version = "0.6.6";
+  version = "0.7.0";
 
   disabled = pythonOlder "3.5";
 
@@ -31,11 +33,12 @@ buildPythonPackage rec {
     owner = "Qiskit";
     repo = "qiskit-aqua";
     rev = version;
-    sha256 = "080m5nsy3ia6bcdypq5d3ijb7762yl1l9llygmxsi6si449zl2cp";
+    sha256 = "0yykw6k1rb3f2ihcp0y9pb0695mcmy29nyqlj89qs4da0503vxvh";
   };
 
   # Optional packages: pyscf (see below NOTE) & pytorch. Can install via pip/nix if needed.
   propagatedBuildInputs = [
+    # cplex
     cvxopt
     docplex
     dlx # Python Dancing Links package
@@ -57,19 +60,33 @@ buildPythonPackage rec {
   # It can also be installed at runtime from the pip wheel.
   # We disable appropriate tests below to allow building without pyscf installed
 
+  # NOTE: we remove cplex b/c we can't build pythonPackages.cplex.
+  # cplex is only distributed in manylinux1 wheel (no source), and Nix python is not manylinux1 compatible
+
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "pyscf; sys_platform == 'linux' or (python_version < '3.8' and sys_platform != 'win32')" ""
+      --replace "pyscf; sys_platform != 'win32'" "" \
+      --replace "cplex; python_version >= '3.6' and python_version < '3.8'" ""
 
     # Add ImportWarning when running qiskit.chemistry (pyscf is a chemistry package) that pyscf is not included
-    echo -e "\nimport warnings\ntry: import pyscf;\nexcept:\n    " \
+    echo -e "\nimport warnings\ntry: import pyscf;\nexcept ImportError:\n    " \
       "warnings.warn('pyscf is not supported on Nixpkgs so some qiskit features will fail." \
         "You must install it yourself via pip or add it to your environment from the Nix User Repository." \
         "See https://github.com/NixOS/nixpkgs/pull/83447 for details', ImportWarning)\n" \
       >> qiskit/chemistry/__init__.py
+
+    # Add ImportWarning when running qiskit.optimization that cplex (optimization package) is not included
+    echo -e "\nimport warnings\ntry: import cplex;\nexcept ImportError:\n    " \
+      "warnings.warn('cplex is not supported on Nixpkgs so some qiskit features will fail." \
+        "You must install it yourself via pip or add it to your environment from the Nix User Repository." \
+        "', ImportWarning)\n" \
+      >> qiskit/optimization/__init__.py
+
   '';
 
-  checkInputs = [ parameterized qiskit-aer pytestCheckHook ];
+  postInstall = "rm -rf $out/${python.sitePackages}/docs";  # Remove docs dir b/c it can cause conflicts.
+
+  checkInputs = [ ddt qiskit-aer pytestCheckHook ];
   dontUseSetuptoolsCheck = true;
   pythonImportsCheck = [
     "qiskit.aqua"
@@ -84,42 +101,35 @@ buildPythonPackage rec {
     "--ignore=test/chemistry/test_qeom_ee.py"
     "--ignore=test/chemistry/test_qeom_vqe.py"
     "--ignore=test/chemistry/test_vqe_uccsd_adapt.py"
-
-    # Following tend to be slow tests, all pass
-    "--ignore=test/aqua/test_vqc.py"
-    "--ignore=test/aqua/test_hhl.py"
-    "--ignore=test/aqua/test_qgan.py"
-    "--ignore=test/aqua/test_mcr.py"
-    "--ignore=test/aqua/test_mcu1.py"
-    "--ignore=test/aqua/test_vqe.py"
   ];
   disabledTests = [
     # Disabled due to missing pyscf
     "test_validate" # test/chemistry/test_inputparser.py
 
     # Disabling slow tests > 10 seconds
-    "test_clique_vqe"
-    "test_delta_3_qasm"
-    "test_evaluate_qasm_mode"
-    "test_evolve_1_suzuki"
-    "test_exact_cover_vqe"
-    "test_exchangedata"
-    "test_expected_value_0_statevector"
-    "test_expected_value_1_qasm"
-    "test_expected_value_2_statevector"
+    "TestVQE"
+    "TestVQC"
+    "TestQSVM"
     "test_graph_partition_vqe"
-    "test_lookup_rotation"
-    "test_mct_with_dirty_ancillae_15"
-    "test_mcrz_11"
+    "TestLookupRotation"
+    "_vqe"
+    "TestHHL"
+    "TestQGAN"
+    "test_evaluate_qasm_mode"
     "test_measurement_error_mitigation_auto_refresh"
-    "test_qgan_training"
-    "test_qsvm_multiclass"
-    "test_shor_factoring_0"
-    "test_vertex_cover_vqe"
-    "test_vqc_with_raw_feature_vector_on_wine"
-    "test_vqe_2_iqpe"
-    "test_vqe_qasm"
+    "test_exchangedata"
     "test_wikipedia"
+    "test_shor_factoring_1__15___qasm_simulator____3__5__"
+    "test_readme_sample"
+    "test_ecev"
+    "test_expected_value"
+    "test_qubo_gas_int_paper_example"
+    "test_shor_no_factors_1_5"
+    "test_shor_no_factors_2_7"
+    "test_evolve_2___suzuki___1__3_"
+    "test_delta_4"
+    "test_swaprz"
+    "test_deprecated_algo_result"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/qiskit-ibmq-provider/default.nix b/pkgs/development/python-modules/qiskit-ibmq-provider/default.nix
index ea14bef2b9e4..5f8f0d94e4ff 100644
--- a/pkgs/development/python-modules/qiskit-ibmq-provider/default.nix
+++ b/pkgs/development/python-modules/qiskit-ibmq-provider/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "qiskit-ibmq-provider";
-  version = "0.6.1";
+  version = "0.7.0";
 
   disabled = pythonOlder "3.6";
 
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     owner = "Qiskit";
     repo = pname;
     rev = version;
-    sha256 = "16c73m9gp1wcrygr6mnc0a9ps0i872bgc7v1zbqyh50kxbcrnpnz";
+    sha256 = "1n13jjx1cx5gswwk8rpxfjqyk97cwx1n2hwsabkcbi7fksw3c5jk";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/qiskit-ignis/default.nix b/pkgs/development/python-modules/qiskit-ignis/default.nix
index a421b5f84adc..79998a843257 100644
--- a/pkgs/development/python-modules/qiskit-ignis/default.nix
+++ b/pkgs/development/python-modules/qiskit-ignis/default.nix
@@ -3,6 +3,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , fetchpatch
+, python
 , numpy
 , qiskit-terra
 , scikitlearn
@@ -38,11 +39,12 @@ buildPythonPackage rec {
     scikitlearn
     scipy
   ];
+  postInstall = "rm -rf $out/${python.sitePackages}/docs";  # this dir can create conflicts
 
   # Tests
   pythonImportsCheck = [ "qiskit.ignis" ];
   dontUseSetuptoolsCheck = true;
-  preCheck = ''export HOME=$TMPDIR'';
+  preCheck = "export HOME=$TMPDIR";
   checkInputs = [
     ddt
     pytestCheckHook
diff --git a/pkgs/development/python-modules/qiskit-terra/default.nix b/pkgs/development/python-modules/qiskit-terra/default.nix
index 14497b20b0d0..78c28a282cb9 100644
--- a/pkgs/development/python-modules/qiskit-terra/default.nix
+++ b/pkgs/development/python-modules/qiskit-terra/default.nix
@@ -36,7 +36,7 @@
 
 buildPythonPackage rec {
   pname = "qiskit-terra";
-  version = "0.13.0";
+  version = "0.14.1";
 
   disabled = pythonOlder "3.5";
 
@@ -44,7 +44,7 @@ buildPythonPackage rec {
     owner = "Qiskit";
     repo = pname;
     rev = version;
-    sha256 = "03fgqmyahgmkf5dbw19n9c1v8p4kmpk50wxhhc8435cclvs26x9j";
+    sha256 = "0pd7x2jrqy7q1s38ychqw9bayjn2rvi6rq7c2c0kd160rwj1l2sc";
   };
 
   nativeBuildInputs = [ cython ];
@@ -94,10 +94,6 @@ buildPythonPackage rec {
     "qiskit.transpiler.passes.routing.cython.stochastic_swap.swap_trial"
   ];
 
-  disabledTests = [
-    "test_jupyter_jobs_pbars" # needs IBMQ provider package (qiskit-ibmq-provider), circular dependency
-  ];
-
   pytestFlagsArray = [
     "--ignore=test/randomized/test_transpiler_equivalence.py" # collection requires qiskit-aer, which would cause circular dependency
   ];
diff --git a/pkgs/development/python-modules/qiskit/default.nix b/pkgs/development/python-modules/qiskit/default.nix
index ca0988955d52..ded9c68e6fe5 100644
--- a/pkgs/development/python-modules/qiskit/default.nix
+++ b/pkgs/development/python-modules/qiskit/default.nix
@@ -15,7 +15,7 @@
 buildPythonPackage rec {
   pname = "qiskit";
   # NOTE: This version denotes a specific set of subpackages. See https://qiskit.org/documentation/release_notes.html#version-history
-  version = "0.18.2";
+  version = "0.19.1";
 
   disabled = pythonOlder "3.5";
 
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "Qiskit";
     repo = "qiskit";
     rev = version;
-    sha256 = "05pwpcps1ksqx6m6hwq90l8sbak64fsz76yv4q3jplfjf6597k6p";
+    sha256 = "0p1sahgf6qgbkvxb067mnyj6ya8nv7y57yyiiaadhjw242sjkjy5";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/scikitlearn/default.nix b/pkgs/development/python-modules/scikitlearn/default.nix
index c7519ee39624..454e631634bf 100644
--- a/pkgs/development/python-modules/scikitlearn/default.nix
+++ b/pkgs/development/python-modules/scikitlearn/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "scikit-learn";
-  version = "0.21.3";
+  version = "0.22.2.post1";
   # UnboundLocalError: local variable 'message' referenced before assignment
   disabled = stdenv.isi686;  # https://github.com/scikit-learn/scikit-learn/issues/5534
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "eb9b8ebf59eddd8b96366428238ab27d05a19e89c5516ce294abc35cea75d003";
+    sha256 = "0z81n13dxvd6qwq5lsnzw2machmxbirhdhr73v90fi55ic9qslsp";
   };
 
   buildInputs = [
@@ -41,15 +41,6 @@ buildPythonPackage rec {
   ];
   checkInputs = [ pytest ];
 
-  patches = [
-    # Fixes tests by changing threshold of a test-case that broke
-    # with numpy versions >= 1.17. This should be removed for versions > 0.21.2.
-	( fetchpatch {
-	  url = "https://github.com/scikit-learn/scikit-learn/commit/b730befc821caec5b984d9ff3aa7bc4bd7f4d9bb.patch";
-	  sha256 = "0z36m05mv6d494qwq0688rgwa7c4bbnm5s2rcjlrp29fwn3fy1bv";
-	})
-  ];
-
   LC_ALL="en_US.UTF-8";
 
   doCheck = !stdenv.isAarch64;
@@ -61,6 +52,12 @@ buildPythonPackage rec {
 
   meta = with stdenv.lib; {
     description = "A set of python modules for machine learning and data mining";
+    changelog = let
+      major = versions.major version;
+      minor = versions.minor version;
+      dashVer = replaceChars ["."] ["-"] version;
+    in
+      "https://scikit-learn.org/stable/whats_new/v${major}.${minor}.html#version-${dashVer}";
     homepage = "https://scikit-learn.org";
     license = licenses.bsd3;
     maintainers = with maintainers; [ ];
diff --git a/pkgs/development/python-modules/smpplib/default.nix b/pkgs/development/python-modules/smpplib/default.nix
new file mode 100644
index 000000000000..fe22f121efb7
--- /dev/null
+++ b/pkgs/development/python-modules/smpplib/default.nix
@@ -0,0 +1,29 @@
+{ buildPythonPackage, fetchPypi, lib, python, six, tox, mock, pytest }:
+
+buildPythonPackage rec {
+  pname = "smpplib";
+  version = "2.1.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0jzxlfwf0861ilh4xyd70hmkdbvdki52aalglm1bnpxkg6i3jhfz";
+  };
+
+  propagatedBuildInputs = [ six ];
+  checkInputs = [ tox mock pytest ];
+
+  checkPhase = ''
+    pytest
+  '';
+
+  postInstall = ''
+    rm -rf $out/${python.sitePackages}/tests
+  '';
+
+  meta = with lib; {
+    description = "SMPP library for Python";
+    homepage = "https://github.com/python-smpplib/python-smpplib";
+    license = licenses.lgpl3Plus;
+    maintainers = [ maintainers.globin ];
+  };
+}
diff --git a/pkgs/development/python-modules/sqlsoup/default.nix b/pkgs/development/python-modules/sqlsoup/default.nix
new file mode 100644
index 000000000000..a6ffd3227cd4
--- /dev/null
+++ b/pkgs/development/python-modules/sqlsoup/default.nix
@@ -0,0 +1,21 @@
+{ buildPythonPackage, fetchPypi, lib, sqlalchemy, nose }:
+
+buildPythonPackage rec {
+  pname = "sqlsoup";
+  version = "0.9.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1mj00fhxj75ac3i8xk9jmm7hvcjz9p4x2r3yndcwsgb659rvgbrg";
+  };
+
+  propagatedBuildInputs = [ sqlalchemy ];
+  checkInputs = [ nose ];
+
+  meta = with lib; {
+    description = "A one step database access tool, built on the SQLAlchemy ORM";
+    homepage = "https://bitbucket.org/zzzeek/sqlsoup";
+    license = licenses.mit;
+    maintainers = [ maintainers.globin ];
+  };
+}
diff --git a/pkgs/development/python-modules/tensorflow-probability/default.nix b/pkgs/development/python-modules/tensorflow-probability/default.nix
index 3a5ee229b432..9ae3464f3f8f 100644
--- a/pkgs/development/python-modules/tensorflow-probability/default.nix
+++ b/pkgs/development/python-modules/tensorflow-probability/default.nix
@@ -61,7 +61,7 @@ let
     bazelTarget = ":pip_pkg";
 
     fetchAttrs = {
-      sha256 = "0135nxxvkmjzpd80r1g9fdkk9h62g0xlvp32g5zgk0hkma5kq0bx";
+      sha256 = "0nmk7sbgl1ag20333v9r7l5cka6wapbskikfhi3y5a8l9f6hxkl3";
     };
 
     buildAttrs = {
diff --git a/pkgs/development/python-modules/tensorflow/1/default.nix b/pkgs/development/python-modules/tensorflow/1/default.nix
index aae812e8ebeb..7c628a0789b0 100644
--- a/pkgs/development/python-modules/tensorflow/1/default.nix
+++ b/pkgs/development/python-modules/tensorflow/1/default.nix
@@ -300,9 +300,9 @@ let
 
       # cudaSupport causes fetch of ncclArchive, resulting in different hashes
       sha256 = if cudaSupport then
-        "1qygfcvvn9vysap9nk6xccxi9mgmzyxiywz6k456f811l1v70p2c"
+        "09j57w6kc0vkfcdwr0qggy3qgrgq82kfa2jrwvvcnij4bl3wj40j"
       else
-        "0kfjanw0mfbh30vi1ms2xlg8yp429cbyfriik6yxd5cla2pncg2j";
+        "14g8z49qz7d8n1c2mcsfhr7yqpcy7mhmpm6hgmqvpgb8vm7yvwrc";
     };
 
     buildAttrs = {
diff --git a/pkgs/development/python-modules/tensorflow/2/default.nix b/pkgs/development/python-modules/tensorflow/2/default.nix
index 089d377ec241..3b4f45f3176f 100644
--- a/pkgs/development/python-modules/tensorflow/2/default.nix
+++ b/pkgs/development/python-modules/tensorflow/2/default.nix
@@ -294,9 +294,9 @@ let
 
       # cudaSupport causes fetch of ncclArchive, resulting in different hashes
       sha256 = if cudaSupport then
-        "0hg3ysy644950a34j28hrb317cz8gcbb9n84d36wdailvnlshghb"
+        "1kqk1gx5g63kb2zdj392x6mnpbrmgqghrdv597aipn7s23xzj8pd"
       else
-        "1gy4pz9kn30wb9c4a9584fibb88c3h38y3dqa99yw1lbsbyyi28c";
+        "1plpcm2ydpajsrxdvmmpfy7l0gfdir78hap72w4k7ddm6d3rm2fv";
     };
 
     buildAttrs = {
diff --git a/pkgs/development/python-modules/unrpa/default.nix b/pkgs/development/python-modules/unrpa/default.nix
new file mode 100644
index 000000000000..aad23c6fdf9f
--- /dev/null
+++ b/pkgs/development/python-modules/unrpa/default.nix
@@ -0,0 +1,24 @@
+{ lib, buildPythonPackage, fetchPypi, uncompyle6, isPy27 }:
+
+buildPythonPackage rec {
+  pname = "unrpa";
+  version = "2.3.0";
+
+  disabled = isPy27;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0yl4qdwp3in170ks98qnldqz3r2iyzil5g1775ccg98qkh95s724";
+  };
+
+  propagatedBuildInputs = [ uncompyle6 ];
+
+  pythonImportsCheck = [ "unrpa" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/Lattyware/unrpa";
+    description = "A program to extract files from the RPA archive format";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ leo60228 ];
+  };
+}
diff --git a/pkgs/development/tools/bazel-watcher/default.nix b/pkgs/development/tools/bazel-watcher/default.nix
index 9cdd72eeaaf4..2d9b99a35f86 100644
--- a/pkgs/development/tools/bazel-watcher/default.nix
+++ b/pkgs/development/tools/bazel-watcher/default.nix
@@ -60,7 +60,7 @@ buildBazelPackage rec {
       sed -e '/^FILE:@bazel_gazelle_go_repository_tools.*/d' -i $bazelOut/external/\@*.marker
     '';
 
-    sha256 = "0wj573dcirssr2cmq90b4yl57mv3gsxaj1s26afvkz1dvyxmq7sz";
+    sha256 = "0ili0123xcl0mjcrn4r1r1q9d7a8a3bbh9r3zhlshl39awfm4r2d";
   };
 
   buildAttrs = {
diff --git a/pkgs/development/tools/build-managers/bazel/bazel-remote/default.nix b/pkgs/development/tools/build-managers/bazel/bazel-remote/default.nix
index f6d112800b68..6b8269584bd2 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel-remote/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel-remote/default.nix
@@ -64,7 +64,7 @@ buildBazelPackage rec {
       sed -e '/^FILE:@bazel_gazelle_go_repository_tools.*/d' -i $bazelOut/external/\@*.marker
     '';
 
-    sha256 = "141kw2zpr612xdcrg6x9kslg4d5b3fbpzx0vgp3lqwdihfj3sc1l";
+    sha256 = "1hzb84zxav68ysdwkimaaz0b9rq95k3bgifw01m644v7idabrz50";
   };
 
   buildAttrs = {
diff --git a/pkgs/development/tools/buildah/default.nix b/pkgs/development/tools/buildah/default.nix
index 09d1e16a8b04..3aab8f24da1e 100644
--- a/pkgs/development/tools/buildah/default.nix
+++ b/pkgs/development/tools/buildah/default.nix
@@ -13,19 +13,18 @@
 
 buildGoPackage rec {
   pname = "buildah";
-  version = "1.14.8";
+  version = "1.14.9";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "buildah";
     rev = "v${version}";
-    sha256 = "187cvb3i5cwm7cwxmzpl2ca7900yb6v6b6cybyz5mnd5ccy5ff1q";
+    sha256 = "1vp59xp374wr7sbx89aikz4rv8fdg0a40v06saryxww9iqyvk8wp";
   };
 
   outputs = [ "out" "man" ];
 
   goPackagePath = "github.com/containers/buildah";
-  excludedPackages = [ "tests" ];
 
   nativeBuildInputs = [ installShellFiles pkg-config ];
   buildInputs = [ gpgme libgpgerror lvm2 btrfs-progs libselinux libseccomp ];
@@ -35,11 +34,12 @@ buildGoPackage rec {
   buildPhase = ''
     pushd go/src/${goPackagePath}
     make GIT_COMMIT="unknown"
-    install -Dm755 buildah $out/bin/buildah
-    installShellCompletion --bash contrib/completions/bash/buildah
+    make -C docs
   '';
 
-  postBuild = ''
+  installPhase = ''
+    install -Dm755 buildah $out/bin/buildah
+    installShellCompletion --bash contrib/completions/bash/buildah
     make -C docs install PREFIX="$man"
   '';
 
@@ -49,5 +49,6 @@ buildGoPackage rec {
     changelog = "https://github.com/containers/buildah/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ Profpatsch ] ++ teams.podman.members;
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/tools/database/squirrel-sql/default.nix b/pkgs/development/tools/database/squirrel-sql/default.nix
index 024615a7f65a..924a82bfd85e 100644
--- a/pkgs/development/tools/database/squirrel-sql/default.nix
+++ b/pkgs/development/tools/database/squirrel-sql/default.nix
@@ -5,14 +5,14 @@
 , drivers ? []
 }:
 let
-  version = "4.0.0";
+  version = "4.1.0";
 in stdenv.mkDerivation rec {
   pname = "squirrel-sql";
   inherit version;
 
   src = fetchurl {
     url = "mirror://sourceforge/project/squirrel-sql/1-stable/${version}-plainzip/squirrelsql-${version}-standard.zip";
-    sha256 = "06njdp2248zxm7zlcpyawx1s7j6hffp5a9mwam3cb53gsmzcz126";
+    sha256 = "0ni7cva0acrin5bkcfkiiv28sf58dzz7xsbl3y4536hmph0g68k6";
   };
 
   nativeBuildInputs = [ makeWrapper unzip ];
diff --git a/pkgs/development/tools/golangci-lint/default.nix b/pkgs/development/tools/golangci-lint/default.nix
index be5820471570..3fa326fe0d2b 100644
--- a/pkgs/development/tools/golangci-lint/default.nix
+++ b/pkgs/development/tools/golangci-lint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "golangci-lint";
-  version = "1.26.0";
+  version = "1.27.0";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     rev = "v${version}";
-    sha256 = "1xw6m4ps6yw8gnkwy8v7rrz2b8c8n72cd7vkpx481dkd36vccpkc";
+    sha256 = "1capiw8af4wmx3wpfslb30xivfyh72x5kj12f8p5pwhl6id31931";
   };
 
-  modSha256 = "0xgnimr1jydrgwhbyjaz710kx3m3505nhy5cs10p501qxbnzkjf9";
+  modSha256 = "0adsy71hl6256v40b5gb00kmqswbgfb1576m6lwak1fcfi07hf6b";
   subPackages = [ "cmd/golangci-lint" ];
 
   meta = with lib; {
diff --git a/pkgs/development/tools/kind/default.nix b/pkgs/development/tools/kind/default.nix
index c9bea6945498..77df7bee063d 100644
--- a/pkgs/development/tools/kind/default.nix
+++ b/pkgs/development/tools/kind/default.nix
@@ -1,19 +1,19 @@
-{ stdenv, buildGoPackage, fetchFromGitHub, installShellFiles }:
+{ stdenv, buildGoModule, fetchFromGitHub, installShellFiles }:
 
 with stdenv.lib;
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "kind";
-  version = "0.7.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     rev    = "v${version}";
     owner  = "kubernetes-sigs";
     repo   = "kind";
-    sha256 = "0hvb0rbi1m0d1flk15l3wws96kmmjhsy6islkhy5h7jalc4k0nx4";
+    sha256 = "0r301nqvycik8fwlghq0cymmq4rm7xp8haj39i2nynxyw8zk6zym";
   };
 
-  goDeps = ./deps.nix;
+  modSha256 = "1vfdyd4yj79f2n0w98k9h4sklxwg49ajlp1blvpslbzmpfkmcjsz";
   goPackagePath = "sigs.k8s.io/kind";
   subPackages = [ "." ];
 
diff --git a/pkgs/development/tools/kind/deps.nix b/pkgs/development/tools/kind/deps.nix
deleted file mode 100644
index 1706406c4566..000000000000
--- a/pkgs/development/tools/kind/deps.nix
+++ /dev/null
@@ -1,741 +0,0 @@
-# file generated from go.mod using vgo2nix (https://github.com/adisbladis/vgo2nix)
-[
-  {
-    goPackagePath = "github.com/BurntSushi/toml";
-    fetch = {
-      type = "git";
-      url = "https://github.com/BurntSushi/toml";
-      rev = "v0.3.1";
-      sha256 = "1fjdwwfzyzllgiwydknf1pwjvy49qxfsczqx5gz3y0izs7as99j6";
-    };
-  }
-  {
-    goPackagePath = "github.com/NYTimes/gziphandler";
-    fetch = {
-      type = "git";
-      url = "https://github.com/NYTimes/gziphandler";
-      rev = "56545f4a5d46";
-      sha256 = "1fwk9wz6vrvq72f2gq8jhvd1nvv6grqgwrjq66vjpm0726pxar72";
-    };
-  }
-  {
-    goPackagePath = "github.com/PuerkitoBio/purell";
-    fetch = {
-      type = "git";
-      url = "https://github.com/PuerkitoBio/purell";
-      rev = "v1.0.0";
-      sha256 = "1qhsy1nm96b9kb63svkvkqmmw15xg6irwcysisxdgzk64adfwqv1";
-    };
-  }
-  {
-    goPackagePath = "github.com/PuerkitoBio/urlesc";
-    fetch = {
-      type = "git";
-      url = "https://github.com/PuerkitoBio/urlesc";
-      rev = "5bd2802263f2";
-      sha256 = "15y5r3asvm7196m3nza5xvdvlc2k11p6lfs6hi917hl7r9vgi6mp";
-    };
-  }
-  {
-    goPackagePath = "github.com/alessio/shellescape";
-    fetch = {
-      type = "git";
-      url = "https://github.com/alessio/shellescape";
-      rev = "b115ca0f9053";
-      sha256 = "0z4jq94yn0jjj56bzrpdazb3pv1jg0r7z0ikq3gjaa51h423wk4z";
-    };
-  }
-  {
-    goPackagePath = "github.com/armon/consul-api";
-    fetch = {
-      type = "git";
-      url = "https://github.com/armon/consul-api";
-      rev = "eb2c6b5be1b6";
-      sha256 = "1j6fdr1sg36qy4n4xjl7brq739fpm5npq98cmvklzjc9qrx98nk9";
-    };
-  }
-  {
-    goPackagePath = "github.com/coreos/etcd";
-    fetch = {
-      type = "git";
-      url = "https://github.com/coreos/etcd";
-      rev = "v3.3.10";
-      sha256 = "1x2ii1hj8jraba8rbxz6dmc03y3sjxdnzipdvg6fywnlq1f3l3wl";
-    };
-  }
-  {
-    goPackagePath = "github.com/coreos/go-etcd";
-    fetch = {
-      type = "git";
-      url = "https://github.com/coreos/go-etcd";
-      rev = "v2.0.0";
-      sha256 = "1xb34hzaa1lkbq5vkzy9vcz6gqwj7hp6cdbvyack2bf28dwn33jj";
-    };
-  }
-  {
-    goPackagePath = "github.com/coreos/go-semver";
-    fetch = {
-      type = "git";
-      url = "https://github.com/coreos/go-semver";
-      rev = "v0.2.0";
-      sha256 = "1gghi5bnqj50hfxhqc1cxmynqmh2yk9ii7ab9gsm75y5cp94ymk0";
-    };
-  }
-  {
-    goPackagePath = "github.com/cpuguy83/go-md2man";
-    fetch = {
-      type = "git";
-      url = "https://github.com/cpuguy83/go-md2man";
-      rev = "v1.0.10";
-      sha256 = "1bqkf2bvy1dns9zd24k81mh2p1zxsx2nhq5cj8dz2vgkv1xkh60i";
-    };
-  }
-  {
-    goPackagePath = "github.com/davecgh/go-spew";
-    fetch = {
-      type = "git";
-      url = "https://github.com/davecgh/go-spew";
-      rev = "v1.1.1";
-      sha256 = "0hka6hmyvp701adzag2g26cxdj47g21x6jz4sc6jjz1mn59d474y";
-    };
-  }
-  {
-    goPackagePath = "github.com/docker/spdystream";
-    fetch = {
-      type = "git";
-      url = "https://github.com/docker/spdystream";
-      rev = "449fdfce4d96";
-      sha256 = "1412cpiis971iq1kxrirzirhj2708ispjh0x0dh879b66x8507sl";
-    };
-  }
-  {
-    goPackagePath = "github.com/elazarl/goproxy";
-    fetch = {
-      type = "git";
-      url = "https://github.com/elazarl/goproxy";
-      rev = "c4fc26588b6e";
-      sha256 = "1s3v02px61a3hmvb47rqk598z5visayxq46k3c8dcrayhhngv2fw";
-    };
-  }
-  {
-    goPackagePath = "github.com/emicklei/go-restful";
-    fetch = {
-      type = "git";
-      url = "https://github.com/emicklei/go-restful";
-      rev = "ff4f55a20633";
-      sha256 = "1v5lj5142abz3gvbygp6xghpdx4ps2lwswl8559ivaidahwnc21c";
-    };
-  }
-  {
-    goPackagePath = "github.com/evanphx/json-patch";
-    fetch = {
-      type = "git";
-      url = "https://github.com/evanphx/json-patch";
-      rev = "v4.5.0";
-      sha256 = "144mk2v9q37l1qjf8498nff4hhz96mlkl7ls7ihixbmrji4lmch4";
-    };
-  }
-  {
-    goPackagePath = "github.com/fsnotify/fsnotify";
-    fetch = {
-      type = "git";
-      url = "https://github.com/fsnotify/fsnotify";
-      rev = "v1.4.7";
-      sha256 = "07va9crci0ijlivbb7q57d2rz9h27zgn2fsm60spjsqpdbvyrx4g";
-    };
-  }
-  {
-    goPackagePath = "github.com/ghodss/yaml";
-    fetch = {
-      type = "git";
-      url = "https://github.com/ghodss/yaml";
-      rev = "73d445a93680";
-      sha256 = "0pg53ky4sy3sp9j4n7vgf1p3gw4nbckwqfldcmmi9rf13kjh0mr7";
-    };
-  }
-  {
-    goPackagePath = "github.com/go-logr/logr";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-logr/logr";
-      rev = "v0.1.0";
-      sha256 = "0fhijjhxz4n2j5i24ckzv8r9kri3v44jdyklgbqjfq0xm7izqg14";
-    };
-  }
-  {
-    goPackagePath = "github.com/go-openapi/jsonpointer";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-openapi/jsonpointer";
-      rev = "46af16f9f7b1";
-      sha256 = "0w0fphmdycjzbsm1vppdcjc9aqinkcdzcq3pxikdvdqh5p791gsc";
-    };
-  }
-  {
-    goPackagePath = "github.com/go-openapi/jsonreference";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-openapi/jsonreference";
-      rev = "13c6e3589ad9";
-      sha256 = "1fh4xcl9ijww4bdq656sx981d57w2c9zx5148jsxlsg4bsvxmwis";
-    };
-  }
-  {
-    goPackagePath = "github.com/go-openapi/spec";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-openapi/spec";
-      rev = "6aced65f8501";
-      sha256 = "0yf0nw7167yjpiqrikns5djarjpf2r07q6xnq9xb1cfsc4m7ynm4";
-    };
-  }
-  {
-    goPackagePath = "github.com/go-openapi/swag";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-openapi/swag";
-      rev = "1d0bd113de87";
-      sha256 = "0fmk42chj20679n87n6sig3czs25lavyj6w208000n6kccv1ns3c";
-    };
-  }
-  {
-    goPackagePath = "github.com/gogo/protobuf";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gogo/protobuf";
-      rev = "65acae22fc9d";
-      sha256 = "0700alky9z0g9akhrzn20wf4jr1600d0clhs32sm8chnlbvidy46";
-    };
-  }
-  {
-    goPackagePath = "github.com/golang/groupcache";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/groupcache";
-      rev = "02826c3e7903";
-      sha256 = "0w46bsllddfij66nrg8jbfjsr54birvfww8a2fj9fmgyig5syn2x";
-    };
-  }
-  {
-    goPackagePath = "github.com/golang/protobuf";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/protobuf";
-      rev = "v1.3.2";
-      sha256 = "1k1wb4zr0qbwgpvz9q5ws9zhlal8hq7dmq62pwxxriksayl6hzym";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/go-cmp";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/go-cmp";
-      rev = "v0.3.0";
-      sha256 = "1hyxx3434zshl2m9ja78gwlkg1rx9yl6diqa7dnjb31xz5x4gbjj";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/gofuzz";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/gofuzz";
-      rev = "v1.0.0";
-      sha256 = "0qz439qvccm91w0mmjz4fqgx48clxdwagkvvx89cr43q1d4iry36";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/uuid";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/uuid";
-      rev = "v1.1.1";
-      sha256 = "0hfxcf9frkb57k6q0rdkrmnfs78ms21r1qfk9fhlqga2yh5xg8zb";
-    };
-  }
-  {
-    goPackagePath = "github.com/googleapis/gnostic";
-    fetch = {
-      type = "git";
-      url = "https://github.com/googleapis/gnostic";
-      rev = "0c5108395e2d";
-      sha256 = "0jf3cp5clli88gpjf24r6wxbkvngnc1kf59d4cgjczsn2wasvsfc";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/golang-lru";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/golang-lru";
-      rev = "v0.5.1";
-      sha256 = "13f870cvk161bzjj6x41l45r5x9i1z9r2ymwmvm7768kg08zznpy";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/hcl";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/hcl";
-      rev = "v1.0.0";
-      sha256 = "0q6ml0qqs0yil76mpn4mdx4lp94id8vbv575qm60jzl1ijcl5i66";
-    };
-  }
-  {
-    goPackagePath = "github.com/hpcloud/tail";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hpcloud/tail";
-      rev = "v1.0.0";
-      sha256 = "1njpzc0pi1acg5zx9y6vj9xi6ksbsc5d387rd6904hy6rh2m6kn0";
-    };
-  }
-  {
-    goPackagePath = "github.com/inconshreveable/mousetrap";
-    fetch = {
-      type = "git";
-      url = "https://github.com/inconshreveable/mousetrap";
-      rev = "v1.0.0";
-      sha256 = "1mn0kg48xkd74brf48qf5hzp0bc6g8cf5a77w895rl3qnlpfw152";
-    };
-  }
-  {
-    goPackagePath = "github.com/json-iterator/go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/json-iterator/go";
-      rev = "v1.1.8";
-      sha256 = "1kbp9fj6fxfql0ir59zb6v68l4bpwlmk76xm8vaikw1hp6y9bcss";
-    };
-  }
-  {
-    goPackagePath = "github.com/kisielk/errcheck";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kisielk/errcheck";
-      rev = "v1.2.0";
-      sha256 = "0am6g10ipdxw84byscm7shda654882wjcbinq5c4696m6mhi2qrd";
-    };
-  }
-  {
-    goPackagePath = "github.com/kisielk/gotool";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kisielk/gotool";
-      rev = "v1.0.0";
-      sha256 = "14af2pa0ssyp8bp2mvdw184s5wcysk6akil3wzxmr05wwy951iwn";
-    };
-  }
-  {
-    goPackagePath = "github.com/kr/pretty";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kr/pretty";
-      rev = "v0.1.0";
-      sha256 = "18m4pwg2abd0j9cn5v3k2ksk9ig4vlwxmlw9rrglanziv9l967qp";
-    };
-  }
-  {
-    goPackagePath = "github.com/kr/pty";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kr/pty";
-      rev = "v1.1.1";
-      sha256 = "0383f0mb9kqjvncqrfpidsf8y6ns5zlrc91c6a74xpyxjwvzl2y6";
-    };
-  }
-  {
-    goPackagePath = "github.com/kr/text";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kr/text";
-      rev = "v0.1.0";
-      sha256 = "1gm5bsl01apvc84bw06hasawyqm4q84vx1pm32wr9jnd7a8vjgj1";
-    };
-  }
-  {
-    goPackagePath = "github.com/magiconair/properties";
-    fetch = {
-      type = "git";
-      url = "https://github.com/magiconair/properties";
-      rev = "v1.8.0";
-      sha256 = "1a10362wv8a8qwb818wygn2z48lgzch940hvpv81hv8gc747ajxn";
-    };
-  }
-  {
-    goPackagePath = "github.com/mailru/easyjson";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mailru/easyjson";
-      rev = "d5b7844b561a";
-      sha256 = "1g84l4wns28xjpn6nl1g33dcj3sfgxlkqqsa6w8fbq2kwyd50xka";
-    };
-  }
-  {
-    goPackagePath = "github.com/mattn/go-isatty";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mattn/go-isatty";
-      rev = "v0.0.11";
-      sha256 = "0h671sv7hfprja495kavazkalkx7xzaqksjh13brcnwq67ijrali";
-    };
-  }
-  {
-    goPackagePath = "github.com/mitchellh/go-homedir";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mitchellh/go-homedir";
-      rev = "v1.1.0";
-      sha256 = "0ydzkipf28hwj2bfxqmwlww47khyk6d152xax4bnyh60f4lq3nx1";
-    };
-  }
-  {
-    goPackagePath = "github.com/mitchellh/mapstructure";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mitchellh/mapstructure";
-      rev = "v1.1.2";
-      sha256 = "03bpv28jz9zhn4947saqwi328ydj7f6g6pf1m2d4m5zdh5jlfkrr";
-    };
-  }
-  {
-    goPackagePath = "github.com/modern-go/concurrent";
-    fetch = {
-      type = "git";
-      url = "https://github.com/modern-go/concurrent";
-      rev = "bacd9c7ef1dd";
-      sha256 = "0s0fxccsyb8icjmiym5k7prcqx36hvgdwl588y0491gi18k5i4zs";
-    };
-  }
-  {
-    goPackagePath = "github.com/modern-go/reflect2";
-    fetch = {
-      type = "git";
-      url = "https://github.com/modern-go/reflect2";
-      rev = "v1.0.1";
-      sha256 = "06a3sablw53n1dqqbr2f53jyksbxdmmk8axaas4yvnhyfi55k4lf";
-    };
-  }
-  {
-    goPackagePath = "github.com/munnerz/goautoneg";
-    fetch = {
-      type = "git";
-      url = "https://github.com/munnerz/goautoneg";
-      rev = "a547fc61f48d";
-      sha256 = "19khhn5xhqv1yp7d6k987gh5w5rhrjnp4p0c6fyrd8z6lzz5h9qi";
-    };
-  }
-  {
-    goPackagePath = "github.com/mxk/go-flowrate";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mxk/go-flowrate";
-      rev = "cca7078d478f";
-      sha256 = "0zqs39923ja0yypdmiqk6x8pgmfs3ms5x5sl1dqv9z6zyx2xy541";
-    };
-  }
-  {
-    goPackagePath = "github.com/onsi/ginkgo";
-    fetch = {
-      type = "git";
-      url = "https://github.com/onsi/ginkgo";
-      rev = "v1.10.1";
-      sha256 = "033a42h1wzmji57p86igg9whvsbp6nvfdsypskw738ys903n3z4d";
-    };
-  }
-  {
-    goPackagePath = "github.com/onsi/gomega";
-    fetch = {
-      type = "git";
-      url = "https://github.com/onsi/gomega";
-      rev = "v1.7.0";
-      sha256 = "09j6wq425wgzzsbwm9ckhfgl2capv3yyqbrf45qyrjwkzm49i02y";
-    };
-  }
-  {
-    goPackagePath = "github.com/pelletier/go-toml";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pelletier/go-toml";
-      rev = "v1.6.0";
-      sha256 = "0l2830pi64fg0bdsyd5afkbw0p7879pppzdqqk3c7vjrjfmi5xbq";
-    };
-  }
-  {
-    goPackagePath = "github.com/pkg/errors";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pkg/errors";
-      rev = "v0.9.0";
-      sha256 = "1hlivqlcnm9wrj0v7h43gamw7mvg6svz9sm31fx28zn4ll25ablh";
-    };
-  }
-  {
-    goPackagePath = "github.com/pmezard/go-difflib";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pmezard/go-difflib";
-      rev = "v1.0.0";
-      sha256 = "0c1cn55m4rypmscgf0rrb88pn58j3ysvc2d0432dp3c6fqg6cnzw";
-    };
-  }
-  {
-    goPackagePath = "github.com/russross/blackfriday";
-    fetch = {
-      type = "git";
-      url = "https://github.com/russross/blackfriday";
-      rev = "v1.5.2";
-      sha256 = "0jzbfzcywqcrnym4gxlz6nphmm1grg6wsl4f0r9x384rn83wkj7c";
-    };
-  }
-  {
-    goPackagePath = "github.com/spf13/afero";
-    fetch = {
-      type = "git";
-      url = "https://github.com/spf13/afero";
-      rev = "v1.1.2";
-      sha256 = "0miv4faf5ihjfifb1zv6aia6f6ik7h1s4954kcb8n6ixzhx9ck6k";
-    };
-  }
-  {
-    goPackagePath = "github.com/spf13/cast";
-    fetch = {
-      type = "git";
-      url = "https://github.com/spf13/cast";
-      rev = "v1.3.0";
-      sha256 = "0xq1ffqj8y8h7dcnm0m9lfrh0ga7pssnn2c1dnr09chqbpn4bdc5";
-    };
-  }
-  {
-    goPackagePath = "github.com/spf13/cobra";
-    fetch = {
-      type = "git";
-      url = "https://github.com/spf13/cobra";
-      rev = "v0.0.5";
-      sha256 = "0z4x8js65mhwg1gf6sa865pdxfgn45c3av9xlcc1l3xjvcnx32v2";
-    };
-  }
-  {
-    goPackagePath = "github.com/spf13/jwalterweatherman";
-    fetch = {
-      type = "git";
-      url = "https://github.com/spf13/jwalterweatherman";
-      rev = "v1.0.0";
-      sha256 = "093fmmvavv84pv4q84hav7ph3fmrq87bvspjj899q0qsx37yvdr8";
-    };
-  }
-  {
-    goPackagePath = "github.com/spf13/pflag";
-    fetch = {
-      type = "git";
-      url = "https://github.com/spf13/pflag";
-      rev = "v1.0.5";
-      sha256 = "0gpmacngd0gpslnbkzi263f5ishigzgh6pbdv9hp092rnjl4nd31";
-    };
-  }
-  {
-    goPackagePath = "github.com/spf13/viper";
-    fetch = {
-      type = "git";
-      url = "https://github.com/spf13/viper";
-      rev = "v1.3.2";
-      sha256 = "1829hvf805kda65l59r17wvid7y0vr390s23zfhf4w7vdb4wp3zh";
-    };
-  }
-  {
-    goPackagePath = "github.com/stretchr/objx";
-    fetch = {
-      type = "git";
-      url = "https://github.com/stretchr/objx";
-      rev = "v0.1.0";
-      sha256 = "19ynspzjdynbi85xw06mh8ad5j0qa1vryvxjgvbnyrr8rbm4vd8w";
-    };
-  }
-  {
-    goPackagePath = "github.com/stretchr/testify";
-    fetch = {
-      type = "git";
-      url = "https://github.com/stretchr/testify";
-      rev = "v1.4.0";
-      sha256 = "187i5g88sxfy4vxpm7dw1gwv29pa2qaq475lxrdh5livh69wqfjb";
-    };
-  }
-  {
-    goPackagePath = "github.com/ugorji/go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/ugorji/go";
-      rev = "d75b2dcb6bc8";
-      sha256 = "0di1k35gpq9bp958ywranpbskx2vdwlb38s22vl9rybm3wa5g3ps";
-    };
-  }
-  {
-    goPackagePath = "github.com/xordataexchange/crypt";
-    fetch = {
-      type = "git";
-      url = "https://github.com/xordataexchange/crypt";
-      rev = "b2862e3d0a77";
-      sha256 = "04q3856anpzl4gdfgmg7pbp9cx231nkz3ymq2xp27rnmmwhfxr8y";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/crypto";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/crypto";
-      rev = "c2843e01d9a2";
-      sha256 = "01xgxbj5r79nmisdvpq48zfy8pzaaj90bn6ngd4nf33j9ar1dp8r";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/net";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/net";
-      rev = "13f9640d40b9";
-      sha256 = "1ba2767lvklnmfvb9jkwvd4m7z6326gaiz3rgylh795g88hy34g1";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/sync";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sync";
-      rev = "1d60e4601c6f";
-      sha256 = "046jlanz2lkxq1r57x9bl6s4cvfqaic6p2xybsj8mq1120jv4rs6";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev = "86b910548bc1";
-      sha256 = "1z8l2wp27q0bd4nc46j31lc7cr6kiw52zi6ix3i121pd3rcyrw44";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/text";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/text";
-      rev = "v0.3.2";
-      sha256 = "0flv9idw0jm5nm8lx25xqanbkqgfiym6619w575p7nrdh0riqwqh";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/tools";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/tools";
-      rev = "6c7e314b6563";
-      sha256 = "1m1n6r8v6mrlh0yvlz3qxz4s7jc7nis0zf3dfl1i6hqh5xblkwnw";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/check.v1";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/check.v1";
-      rev = "788fd7840127";
-      sha256 = "0v3bim0j375z81zrpr5qv42knqs0y2qv2vkjiqi5axvb78slki1a";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/fsnotify.v1";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/fsnotify.v1";
-      rev = "v1.4.7";
-      sha256 = "07va9crci0ijlivbb7q57d2rz9h27zgn2fsm60spjsqpdbvyrx4g";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/inf.v0";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/inf.v0";
-      rev = "v0.9.1";
-      sha256 = "00k5iqjcp371fllqxncv7jkf80hn1zww92zm78cclbcn4ybigkng";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/tomb.v1";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/tomb.v1";
-      rev = "dd632973f1e7";
-      sha256 = "1lqmq1ag7s4b3gc3ddvr792c5xb5k6sfn0cchr3i2s7f1c231zjv";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/yaml.v2";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/yaml.v2";
-      rev = "v2.2.7";
-      sha256 = "0k5xcwkd3wmcx54isk7ck9cwp8fapfhyqdz3f13kxp77cxqizazj";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/yaml.v3";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/yaml.v3";
-      rev = "4206685974f2";
-      sha256 = "1ff5fd8x45cay9100ds63hxd32s7czsrric0ql6a1jrxczsgqk1g";
-    };
-  }
-  {
-    goPackagePath = "k8s.io/apimachinery";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kubernetes/apimachinery";
-      rev = "v0.17.0";
-      sha256 = "1418y3p2fx7zsf1anpwcma1fqnaymal12d6x33j600jf1y0j9g8i";
-    };
-  }
-  {
-    goPackagePath = "k8s.io/gengo";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kubernetes/gengo";
-      rev = "0689ccc1d7d6";
-      sha256 = "10c0kbm07pzxwdxpsmcgqkcxqxaijyywvwj1rciw6ssfcgx7kdc5";
-    };
-  }
-  {
-    goPackagePath = "k8s.io/klog";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kubernetes/klog";
-      rev = "v1.0.0";
-      sha256 = "1cgannfmldcrcksb2wqdn2b5qabqyxl9r25w9y4qbljw24hhnlvn";
-    };
-  }
-  {
-    goPackagePath = "k8s.io/kube-openapi";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kubernetes/kube-openapi";
-      rev = "30be4d16710a";
-      sha256 = "13pksn2xzyhrz569zihqy78y9ckn4sf4f4x31w1czfwbs87n00gf";
-    };
-  }
-  {
-    goPackagePath = "sigs.k8s.io/structured-merge-diff";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kubernetes-sigs/structured-merge-diff";
-      rev = "15d366b2352e";
-      sha256 = "1anrx09ksgrwjwmbrcrk3hx8wyzjaakzmmn36nd23if36nv1xg11";
-    };
-  }
-  {
-    goPackagePath = "sigs.k8s.io/yaml";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kubernetes-sigs/yaml";
-      rev = "v1.1.0";
-      sha256 = "1p7hvjdr5jsyk7nys1g1pmgnf3ys6n320i6hds85afppk81k01kb";
-    };
-  }
-]
diff --git a/pkgs/development/tools/ocaml/ocamlformat/default.nix b/pkgs/development/tools/ocaml/ocamlformat/default.nix
index 9a034a2b0473..c79f65b47a80 100644
--- a/pkgs/development/tools/ocaml/ocamlformat/default.nix
+++ b/pkgs/development/tools/ocaml/ocamlformat/default.nix
@@ -2,7 +2,7 @@
 
 with ocamlPackages; buildDunePackage rec {
   pname = "ocamlformat";
-  version = "0.14.1";
+  version = "0.14.2";
 
   minimumOCamlVersion = "4.06";
 
@@ -10,7 +10,7 @@ with ocamlPackages; buildDunePackage rec {
 
   src = fetchurl {
     url = "https://github.com/ocaml-ppx/ocamlformat/releases/download/${version}/ocamlformat-${version}.tbz";
-    sha256 = "03wn46xib63748157xchj7gflkw5000fcjw6n89h9g82q9slazaa";
+    sha256 = "16phz1sg9b070p6fm8d42j0piizg05vghdjmw8aj7xm82b1pm7sz";
   };
 
   buildInputs = [
diff --git a/pkgs/development/tools/skopeo/default.nix b/pkgs/development/tools/skopeo/default.nix
index f7e1478bbecf..1d4afc0a4ec2 100644
--- a/pkgs/development/tools/skopeo/default.nix
+++ b/pkgs/development/tools/skopeo/default.nix
@@ -10,6 +10,8 @@
 , libselinux
 , go-md2man
 , installShellFiles
+, makeWrapper
+, fuse-overlayfs
 }:
 
 let
@@ -38,7 +40,7 @@ buildGoPackage {
 
   excludedPackages = [ "integration" ];
 
-  nativeBuildInputs = [ pkg-config go-md2man installShellFiles ];
+  nativeBuildInputs = [ pkg-config go-md2man installShellFiles makeWrapper ];
   buildInputs = [ gpgme ]
   ++ stdenv.lib.optionals stdenv.isLinux [ libgpgerror lvm2 btrfs-progs libselinux ];
 
@@ -56,6 +58,11 @@ buildGoPackage {
     popd
   '';
 
+  postInstall = stdenv.lib.optionals stdenv.isLinux ''
+    wrapProgram $out/bin/skopeo \
+      --prefix PATH : ${stdenv.lib.makeBinPath [ fuse-overlayfs ]}
+  '';
+
   meta = with stdenv.lib; {
     description = "A command line utility for various operations on container images and image repositories";
     homepage = "https://github.com/containers/skopeo";
diff --git a/pkgs/development/tools/vultr/default.nix b/pkgs/development/tools/vultr/default.nix
index d59ff0c1ec52..8bd8a55bce8d 100644
--- a/pkgs/development/tools/vultr/default.nix
+++ b/pkgs/development/tools/vultr/default.nix
@@ -2,14 +2,14 @@
 
 buildGoPackage rec {
   pname = "vultr";
-  version = "1.15.0";
+  version = "2.0.1";
   goPackagePath = "github.com/JamesClonk/vultr";
 
   src = fetchFromGitHub {
     owner = "JamesClonk";
     repo = "vultr";
-    rev = version;
-    sha256 = "1bx2x17aa6wfn4qy9lxk8sh7shs3x5ppz2z49s0xm8qq0rs1qi92";
+    rev = "v${version}";
+    sha256 = "16wlncf0wax5jhpbfif5k16knigxy89vcby0b821klv6hlm6cc58";
   };
 
   meta = {
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 118998a605b2..76d27e295081 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -1,18 +1,18 @@
 {
     "4.14": {
-        "name": "linux-hardened-4.14.179.a.patch",
-        "sha256": "0vdcg8713vhraqp04b6lw15qdrvg4iw646d54x6ic0421nxp9zmj",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.179.a/linux-hardened-4.14.179.a.patch"
+        "name": "linux-hardened-4.14.180.a.patch",
+        "sha256": "0rpk5lq947i4v48d6jv75rgwpncayr4agc3f2iich3hlkh5p72p3",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.180.a/linux-hardened-4.14.180.a.patch"
     },
     "4.19": {
-        "name": "linux-hardened-4.19.121.a.patch",
-        "sha256": "0bwjx7qbzd50607kr1abx3rd19iciry3p1y3a8sz5w3vb62j8m6z",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.121.a/linux-hardened-4.19.121.a.patch"
+        "name": "linux-hardened-4.19.122.a.patch",
+        "sha256": "0jh5wyrwrmm9rqqi8fn6d6bd8lzkhj1aylnphsajyyx5v28hn1b2",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.122.a/linux-hardened-4.19.122.a.patch"
     },
     "5.4": {
-        "name": "linux-hardened-5.4.39.a.patch",
+        "name": "linux-hardened-5.4.40.a.patch",
         "sha256": "1w9yc0j8vshjyvb2qgxjvrdgwiy5lmjn3s1rmlch649vqp97j9w7",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.39.a/linux-hardened-5.4.39.a.patch"
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.40.a/linux-hardened-5.4.40.a.patch"
     },
     "5.5": {
         "name": "linux-hardened-5.5.19.a.patch",
@@ -20,8 +20,8 @@
         "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.5.19.a/linux-hardened-5.5.19.a.patch"
     },
     "5.6": {
-        "name": "linux-hardened-5.6.11.a.patch",
+        "name": "linux-hardened-5.6.12.a.patch",
         "sha256": "1b6cwffb2b21h9xh2acm9q9j55cay87zbv9jjayv69znry4mzsx3",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.6.11.a/linux-hardened-5.6.11.a.patch"
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.6.12.a/linux-hardened-5.6.12.a.patch"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/hardened/update.py b/pkgs/os-specific/linux/kernel/hardened/update.py
index 3958c85fe206..d6443d2e7511 100755
--- a/pkgs/os-specific/linux/kernel/hardened/update.py
+++ b/pkgs/os-specific/linux/kernel/hardened/update.py
@@ -184,11 +184,10 @@ for filename in os.listdir(NIXPKGS_KERNEL_PATH):
             with import {NIXPKGS_PATH} {{}};
             (callPackage {NIXPKGS_KERNEL_PATH / filename} {{}}).version
         """
-        kernel_version = parse_version(
-            run(
-                "nix", "eval", "--impure", "--raw", "--expr", nix_version_expr,
-            ).stdout
-        )
+        kernel_version_json = run(
+            "nix-instantiate", "--eval", "--json", "--expr", nix_version_expr,
+        ).stdout
+        kernel_version = parse_version(json.loads(kernel_version_json))
         if kernel_version < MIN_KERNEL_VERSION:
             continue
         kernel_key = major_kernel_version_key(kernel_version)
diff --git a/pkgs/os-specific/linux/kernel/linux-rpi.nix b/pkgs/os-specific/linux/kernel/linux-rpi.nix
index 6f5f2524276b..31a2cc2aa157 100644
--- a/pkgs/os-specific/linux/kernel/linux-rpi.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rpi.nix
@@ -18,7 +18,7 @@ lib.overrideDerivation (buildLinux (args // {
   defconfig = {
     "1" = "bcmrpi_defconfig";
     "2" = "bcm2709_defconfig";
-    "3" = "bcmrpi3_defconfig";
+    "3" = if stdenv.hostPlatform.isAarch64 then "bcmrpi3_defconfig" else "bcm2709_defconfig";
     "4" = "bcm2711_defconfig";
   }.${toString rpiVersion};
 
diff --git a/pkgs/os-specific/linux/nvidia-x11/builder.sh b/pkgs/os-specific/linux/nvidia-x11/builder.sh
index 30e5d16b60f3..dbe18ace40a2 100755
--- a/pkgs/os-specific/linux/nvidia-x11/builder.sh
+++ b/pkgs/os-specific/linux/nvidia-x11/builder.sh
@@ -45,6 +45,17 @@ installPhase() {
         cp -prd tls "$out/lib/"
     fi
 
+    # Install systemd power management executables
+    if [ -e nvidia-sleep.sh ]; then
+        sed -E 's#(PATH=).*#\1"$PATH"#' nvidia-sleep.sh > nvidia-sleep.sh.fixed
+        install -Dm755 nvidia-sleep.sh.fixed $out/bin/nvidia-sleep.sh
+    fi
+
+    if [ -e nvidia ]; then
+        sed -E "s#/usr(/bin/nvidia-sleep.sh)#$out\\1#" nvidia > nvidia.fixed
+        install -Dm755 nvidia.fixed $out/lib/systemd/system-sleep/nvidia
+    fi
+
     for i in $lib32 $out; do
         rm -f $i/lib/lib{glx,nvidia-wfb}.so.* # handled separately
         rm -f $i/lib/libnvidia-gtk* # built from source
@@ -91,7 +102,6 @@ installPhase() {
 
     done
 
-
     if [ -n "$bin" ]; then
         # Install the X drivers.
         mkdir -p $bin/lib/xorg/modules
@@ -167,5 +177,4 @@ installPhase() {
     fi
 }
 
-
 genericBuild
diff --git a/pkgs/servers/blockbook/default.nix b/pkgs/servers/blockbook/default.nix
index b6a1887bf807..9bc10989efdb 100644
--- a/pkgs/servers/blockbook/default.nix
+++ b/pkgs/servers/blockbook/default.nix
@@ -1,5 +1,5 @@
 { stdenv
-, buildGoPackage
+, buildGoModule
 , lib
 , fetchFromGitHub
 , rocksdb
@@ -12,25 +12,31 @@
 , lz4
 }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "blockbook";
-  version = "0.3.2";
-
-  goPackagePath = "blockbook";
+  version = "0.3.3";
+  commit = "b6961ca";
 
   src = fetchFromGitHub {
     owner = "trezor";
     repo = "blockbook";
     rev = "v${version}";
-    sha256 = "0hcgz4b7k8ia4dnjg6bbii95sqg3clc40ybwwc4qz3jv21ikc54x";
+    sha256 = "01nb4if2dix2h95xvqvafil325jjw2a4v1izb9mad0cjqcf8rk6n";
   };
 
-  goDeps = ./deps.nix;
+  modSha256 = "1zp06mpkxaxykw8pr679fg9dd7039qj13j5lknxp7hr8dga0jvpy";
 
   buildInputs = [ bzip2 zlib snappy zeromq lz4 ];
 
   nativeBuildInputs = [ pkg-config packr ];
 
+  buildFlagsArray = ''
+    -ldflags=
+       -X github.com/trezor/blockbook/common.version=${version}
+       -X github.com/trezor/blockbook/common.gitcommit=${commit}
+       -X github.com/trezor/blockbook/common.buildDate=unknown
+  '';
+
   preBuild = lib.optionalString stdenv.isDarwin ''
     ulimit -n 8192
   '' + ''
@@ -45,7 +51,7 @@ buildGoPackage rec {
     description = "Trezor address/account balance backend";
     homepage = "https://github.com/trezor/blockbook";
     license = licenses.agpl3;
-    maintainers = with maintainers; [ mmahut ];
-    platforms = platforms.all;
+    maintainers = with maintainers; [ mmahut maintainers."1000101" ];
+    platforms = remove "aarch64-linux" platforms.unix;
   };
 }
diff --git a/pkgs/servers/blockbook/deps.nix b/pkgs/servers/blockbook/deps.nix
deleted file mode 100644
index 9f9ae0a4704d..000000000000
--- a/pkgs/servers/blockbook/deps.nix
+++ /dev/null
@@ -1,372 +0,0 @@
-# file generated from Gopkg.lock using dep2nix (https://github.com/nixcloud/dep2nix)
-[
-  {
-    goPackagePath  = "github.com/Groestlcoin/go-groestl-hash";
-    fetch = {
-      type = "git";
-      url = "https://github.com/Groestlcoin/go-groestl-hash";
-      rev =  "790653ac190c4029ee200e82a8f21b5d1afaf7d6";
-      sha256 = "02davg672v9sz8l7a8s0b8m87154p42hkm5r6pavf4gqziw8bmr4";
-    };
-  }
-  {
-    goPackagePath  = "github.com/allegro/bigcache";
-    fetch = {
-      type = "git";
-      url = "https://github.com/allegro/bigcache";
-      rev =  "69ea0af04088faa57adb9ac683934277141e92a5";
-      sha256 = "0ac9pgzgi9lhklkqmc5f5x3d0cbyxjfpadc6mdbd7hdr7rfrjmxf";
-    };
-  }
-  {
-    goPackagePath  = "github.com/aristanetworks/goarista";
-    fetch = {
-      type = "git";
-      url = "https://github.com/aristanetworks/goarista";
-      rev =  "8e7d5b18fe7ad671e07097d5445dbc70422663b2";
-      sha256 = "1jbjviz8qi8izhvdvnbc5d9nqyxfww75ffcvxyhw5yxw9r1v0sn2";
-    };
-  }
-  {
-    goPackagePath  = "github.com/agl/ed25519";
-    fetch = {
-      type = "git";
-      url = "https://github.com/agl/ed25519";
-      rev =  "5312a61534124124185d41f09206b9fef1d88403";
-      sha256 = "1v8mhkf1m3ga5262s75vabskxvsw5rpqvi5nwhxwiv7gfk6h823i";
-    };
-  }
-  {
-    goPackagePath  = "github.com/beorn7/perks";
-    fetch = {
-      type = "git";
-      url = "https://github.com/beorn7/perks";
-      rev =  "3a771d992973f24aa725d07868b467d1ddfceafb";
-      sha256 = "1l2lns4f5jabp61201sh88zf3b0q793w4zdgp9nll7mmfcxxjif3";
-    };
-  }
-  {
-    goPackagePath  = "github.com/bsm/go-vlq";
-    fetch = {
-      type = "git";
-      url = "https://github.com/bsm/go-vlq";
-      rev =  "ec6e8d4f5f4ec0f6e808ffc7f4dcc7516d4d7d49";
-      sha256 = "13nhgpigaqdvcksi6jrav0rqr5mzqkx3wrsans9ql89nva51r9sz";
-    };
-  }
-  {
-    goPackagePath  = "github.com/martinboehm/btcd";
-    fetch = {
-      type = "git";
-      url = "https://github.com/martinboehm/btcd";
-      rev =  "8e7c0427fee5d4778c5d4eb987150369e3ca1d0e";
-      sha256 = "10fwzl8hzqpsq1rk5iz3xs8hbn3wqans12hszvlxlmm2xb0f6z9b";
-    };
-  }
-  {
-    goPackagePath  = "github.com/btcsuite/btclog";
-    fetch = {
-      type = "git";
-      url = "https://github.com/btcsuite/btclog";
-      rev =  "84c8d2346e9fc8c7b947e243b9c24e6df9fd206a";
-      sha256 = "02dl46wcnfpg9sqvg0ipipkpnd7lrf4fnvb9zy56jqa7mfcwc7wk";
-    };
-  }
-  {
-    goPackagePath  = "github.com/dchest/blake256";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dchest/blake256";
-      rev =  "dee3fe6eb0e98dc774a94fc231f85baf7c29d360";
-      sha256 = "18hkfm1zlkf6fsjzljiz5cjxxcf3kl5p9617si8xjggb33adzhyg";
-    };
-  }
-  {
-    goPackagePath  = "github.com/deckarep/golang-set";
-    fetch = {
-      type = "git";
-      url = "https://github.com/deckarep/golang-set";
-      rev =  "1d4478f51bed434f1dadf96dcd9b43aabac66795";
-      sha256 = "01kaqrc5ywbwa46b6lz3db7kkg8q6v383h4lnxds4z3kjglkqaff";
-    };
-  }
-  {
-    goPackagePath  = "github.com/decred/base58";
-    fetch = {
-      type = "git";
-      url = "https://github.com/decred/base58";
-      rev =  "dbeddd8aab76c31eb2ea98351a63fa2c6bf46888";
-      sha256 = "0fm0gsz5myin4n15gx3fhi9pk82p6v0sxza945yvny7n13q44ns5";
-    };
-  }
-  {
-    goPackagePath  = "github.com/decred/dcrd";
-    fetch = {
-      type = "git";
-      url = "https://github.com/decred/dcrd";
-      rev =  "e3e8c47c68b010dbddeb783ebad32a3a4993dd71";
-      sha256 = "0zifsxhrjx282kvsqj80qr3v4af8hx4g6dqvrb6xggpkcaski8b4";
-    };
-  }
-  {
-    goPackagePath  = "github.com/decred/slog";
-    fetch = {
-      type = "git";
-      url = "https://github.com/decred/slog";
-      rev =  "fbd821ef791ba2b8ae945f5d44f4e49396d230c5";
-      sha256 = "0n3c7saiv4j22kjc1pf3771n6khx4g99n8vn4qvvv0i5vv04585n";
-    };
-  }
-  {
-    goPackagePath  = "github.com/ethereum/go-ethereum";
-    fetch = {
-      type = "git";
-      url = "https://github.com/ethereum/go-ethereum";
-      rev =  "24d727b6d6e2c0cde222fa12155c4a6db5caaf2e";
-      sha256 = "0vrhwfavx3gciihf406f2qfrhvhnygvlj2icbswq0d01dx3s566m";
-    };
-  }
-  {
-    goPackagePath  = "github.com/go-stack/stack";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-stack/stack";
-      rev =  "259ab82a6cad3992b4e21ff5cac294ccb06474bc";
-      sha256 = "0irkqifyj84cbnq4n66ax2r591id2285diw5hzcz2k3bga8d8lqr";
-    };
-  }
-  {
-    goPackagePath  = "github.com/gobuffalo/packr";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gobuffalo/packr";
-      rev =  "5a2cbb54c4e7d482e3f518c56f1f86f133d5204f";
-      sha256 = "0hs62w1bv96zzfqqmnq18w71v0kmh4qrqpkf2y8qngvwgan761gd";
-    };
-  }
-  {
-    goPackagePath  = "github.com/gogo/protobuf";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gogo/protobuf";
-      rev =  "1adfc126b41513cc696b209667c8656ea7aac67c";
-      sha256 = "1j7azzlnihcvnd1apw5zr0bz30h7n0gyimqqkgc76vzb1n5dpi7m";
-    };
-  }
-  {
-    goPackagePath  = "github.com/golang/glog";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/glog";
-      rev =  "23def4e6c14b4da8ac2ed8007337bc5eb5007998";
-      sha256 = "0jb2834rw5sykfr937fxi8hxi2zy80sj2bdn9b3jb4b26ksqng30";
-    };
-  }
-  {
-    goPackagePath  = "github.com/golang/protobuf";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/protobuf";
-      rev =  "925541529c1fa6821df4e44ce2723319eb2be768";
-      sha256 = "1d3zjvhl115l23xakj0014qpjchivlg098h10v5nfirkk1i9f9sa";
-    };
-  }
-  {
-    goPackagePath  = "github.com/golang/snappy";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/snappy";
-      rev =  "553a641470496b2327abcac10b36396bd98e45c9";
-      sha256 = "0kssxnih1l722hx9219c7javganjqkqhvl3i0hp0hif6xm6chvqk";
-    };
-  }
-  {
-    goPackagePath  = "github.com/gorilla/websocket";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gorilla/websocket";
-      rev =  "ea4d1f681babbce9545c9c5f3d5194a789c89f5b";
-      sha256 = "1bhgs2542qs49p1dafybqxfs2qc072xv41w5nswyrknwyjxxs2a1";
-    };
-  }
-  {
-    goPackagePath  = "github.com/martinboehm/bchutil";
-    fetch = {
-      type = "git";
-      url = "https://github.com/martinboehm/bchutil";
-      rev =  "6373f11b6efe1ea81e8713b8788a695b2c144d38";
-      sha256 = "1wp7ixa0n0jj7y9phxm6p3fymc2555fb2k71s91jhis14fil2jim";
-    };
-  }
-  {
-    goPackagePath  = "github.com/martinboehm/btcutil";
-    fetch = {
-      type = "git";
-      url = "https://github.com/martinboehm/btcutil";
-      rev =  "a3d2b8457b77d37c3813742d4030e199b6e09111";
-      sha256 = "0152cyabklv9l39dm1g30jb7hzdv9rj45mp3v9x4kvaza58nz0x4";
-    };
-  }
-  {
-    goPackagePath  = "github.com/juju/errors";
-    fetch = {
-      type = "git";
-      url = "https://github.com/juju/errors";
-      rev =  "c7d06af17c68cd34c835053720b21f6549d9b0ee";
-      sha256 = "1dmj8wkpmkw4z4c7wmnscs4ykrcv7p8lgwb75g5akahwqjaf9zcp";
-    };
-  }
-  {
-    goPackagePath  = "github.com/martinboehm/golang-socketio";
-    fetch = {
-      type = "git";
-      url = "https://github.com/martinboehm/golang-socketio";
-      rev =  "f60b0a8befde091474a624a8ffd81ee9912957b3";
-      sha256 = "1zln03qgzzbkr7zwm7ah1iikjdnipacp60bbg9lzkxsdcw2h1vd5";
-    };
-  }
-  {
-    goPackagePath  = "github.com/matttproud/golang_protobuf_extensions";
-    fetch = {
-      type = "git";
-      url = "https://github.com/matttproud/golang_protobuf_extensions";
-      rev =  "3247c84500bff8d9fb6d579d800f20b3e091582c";
-      sha256 = "12hcych25wf725zxdkpnyx4wa0gyxl8v4m8xmhdmmaki9bbmqd0d";
-    };
-  }
-  {
-    goPackagePath  = "github.com/mr-tron/base58";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mr-tron/base58";
-      rev =  "c1bdf7c52f59d6685ca597b9955a443ff95eeee6";
-      sha256 = "1dq6i8619manxdhb0fwhdm9ar23kx88pc2xwl1pjla9djrgql6a8";
-    };
-  }
-  {
-    goPackagePath  = "github.com/pebbe/zmq4";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pebbe/zmq4";
-      rev =  "5b443b6471cea4b4f9f85025530c04c93233f76a";
-      sha256 = "0vnwlabrlrzszqyfbw4vypalhsxi4l4ywcbjhfhwl1fpvcph5dar";
-    };
-  }
-  {
-    goPackagePath  = "github.com/pkg/errors";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pkg/errors";
-      rev =  "645ef00459ed84a119197bfb8d8205042c6df63d";
-      sha256 = "001i6n71ghp2l6kdl3qq1v2vmghcz3kicv9a5wgcihrzigm75pp5";
-    };
-  }
-  {
-    goPackagePath  = "github.com/prometheus/client_golang";
-    fetch = {
-      type = "git";
-      url = "https://github.com/prometheus/client_golang";
-      rev =  "c5b7fccd204277076155f10851dad72b76a49317";
-      sha256 = "1xqny3147g12n4j03kxm8s9mvdbs3ln6i56c655mybrn9jjy48kd";
-    };
-  }
-  {
-    goPackagePath  = "github.com/prometheus/client_model";
-    fetch = {
-      type = "git";
-      url = "https://github.com/prometheus/client_model";
-      rev =  "99fa1f4be8e564e8a6b613da7fa6f46c9edafc6c";
-      sha256 = "19y4ywsivhpxj7ikf2j0gm9k3cmyw37qcbfi78n526jxcc7kw998";
-    };
-  }
-  {
-    goPackagePath  = "github.com/prometheus/common";
-    fetch = {
-      type = "git";
-      url = "https://github.com/prometheus/common";
-      rev =  "d0f7cd64bda49e08b22ae8a730aa57aa0db125d6";
-      sha256 = "1d4hfbb66xsf0wq317fwhgrwakqzhvryw4d7ip851lwrpql5fqcx";
-    };
-  }
-  {
-    goPackagePath  = "github.com/prometheus/procfs";
-    fetch = {
-      type = "git";
-      url = "https://github.com/prometheus/procfs";
-      rev =  "8b1c2da0d56deffdbb9e48d4414b4e674bd8083e";
-      sha256 = "0x128p15h35mgwqxkigfkk1lfrcz9g697ahl8v6xp9kwvcqvjrrf";
-    };
-  }
-  {
-    goPackagePath  = "github.com/rs/cors";
-    fetch = {
-      type = "git";
-      url = "https://github.com/rs/cors";
-      rev =  "feef513b9575b32f84bafa580aad89b011259019";
-      sha256 = "0wjm0yjsnxhnp6924mq8v04srqa8sxrlnd7rkb19h4j6b9zagsik";
-    };
-  }
-  {
-    goPackagePath  = "github.com/schancel/cashaddr-converter";
-    fetch = {
-      type = "git";
-      url = "https://github.com/schancel/cashaddr-converter";
-      rev =  "0a38f5822f795dc3727b4caacc298e02938d9eb1";
-      sha256 = "0d0dsn029yckgjp26vkmg7r476hb6b9ayf2njcgdi648ln8rrad8";
-    };
-  }
-  {
-    goPackagePath  = "github.com/syndtr/goleveldb";
-    fetch = {
-      type = "git";
-      url = "https://github.com/syndtr/goleveldb";
-      rev =  "714f901b98fdb3aa954b4193d8cbd64a28d80cad";
-      sha256 = "0fn70vzqmww5v2xy0lamc319vrmfpza085d196cffhfw0jzw9i18";
-    };
-  }
-  {
-    goPackagePath  = "github.com/tecbot/gorocksdb";
-    fetch = {
-      type = "git";
-      url = "https://github.com/tecbot/gorocksdb";
-      rev =  "214b6b7bc0f06812ab5602fdc502a3e619916f38";
-      sha256 = "1mqpp14z4igr9jip39flpd7nf4rhr3z85y8mg74jjl1yrnwrwsld";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/crypto";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/crypto";
-      rev =  "a832865fa7ada6126f4c6124ac49f71be71bff2a";
-      sha256 = "0bikp74pdi9fsvfdgy0k0r8ipzz96hy28zm8qpky0vdbwqci0a8p";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/net";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/net";
-      rev =  "61147c48b25b599e5b561d2e9c4f3e1ef489ca41";
-      sha256 = "1520pdlw9a9s41ad1cf1z6y2ff4j96zbn82qffrxqk02bqlr9f5w";
-    };
-  }
-  {
-    goPackagePath  = "gopkg.in/karalabe/cookiejar.v2";
-    fetch = {
-      type = "git";
-      url = "https://github.com/karalabe/cookiejar";
-      rev =  "8dcd6a7f4951f6ff3ee9cbb919a06d8925822e57";
-      sha256 = "1dbizcklsfn6b5i182nf9pgkk4ac8jnmq8zix73si7x2n53wyb3b";
-    };
-  }
-  {
-    goPackagePath  = "gopkg.in/natefinch/npipe.v2";
-    fetch = {
-      type = "git";
-      url = "https://github.com/natefinch/npipe";
-      rev =  "c1b8fa8bdccecb0b8db834ee0b92fdbcfa606dd6";
-      sha256 = "1qplrvhks05pay169d9lph3hl7apdam4vj1kx3yzik7cphx6b24f";
-    };
-  }
-]
\ No newline at end of file
diff --git a/pkgs/servers/http/nginx/modules.nix b/pkgs/servers/http/nginx/modules.nix
index 167829669440..1111990435a5 100644
--- a/pkgs/servers/http/nginx/modules.nix
+++ b/pkgs/servers/http/nginx/modules.nix
@@ -140,6 +140,7 @@ in
       export LUAJIT_LIB="${pkgs.luajit}/lib"
       export LUAJIT_INC="${pkgs.luajit}/include/luajit-2.0"
     '';
+    allowMemoryWriteExecute = true;
   };
 
   lua-upstream = {
@@ -150,6 +151,7 @@ in
       sha256 = "1gqccg8airli3i9103zv1zfwbjm27h235qjabfbfqk503rjamkpk";
     };
     inputs = [ pkgs.luajit ];
+    allowMemoryWriteExecute = true;
   };
 
   modsecurity = {
@@ -246,6 +248,7 @@ in
     in {
       src = ngx_pagespeed;
       inputs = [ pkgs.zlib pkgs.libuuid ]; # psol deps
+      allowMemoryWriteExecute = true;
     };
 
   pam = {
diff --git a/pkgs/servers/misc/airsonic/default.nix b/pkgs/servers/misc/airsonic/default.nix
index be7480354305..852b5350bbae 100644
--- a/pkgs/servers/misc/airsonic/default.nix
+++ b/pkgs/servers/misc/airsonic/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "airsonic";
-  version = "10.6.1";
+  version = "10.6.2";
 
   src = fetchurl {
     url = "https://github.com/airsonic/airsonic/releases/download/v${version}/airsonic.war";
-    sha256 = "0dgk9i7981wydp44zax21y48psybcsd4i68cmlp9izl8aa5gk2vb";
+    sha256 = "0q3qnqymj3gaa6n79pvbyidn1ga99lpngp5wvhlw1aarg1m7vccl";
   };
 
   buildCommand = ''
diff --git a/pkgs/servers/monitoring/sensu-go/default.nix b/pkgs/servers/monitoring/sensu-go/default.nix
index f109b08d1a6f..cef5367159e1 100644
--- a/pkgs/servers/monitoring/sensu-go/default.nix
+++ b/pkgs/servers/monitoring/sensu-go/default.nix
@@ -4,8 +4,8 @@ let
   generic = { subPackages, pname, postInstall ? "" }:
     buildGoModule rec {
       inherit pname;
-      version = "5.18.1";
-      shortRev = "1f6d16b"; # for internal version info
+      version = "5.20.0";
+      shortRev = "3a1ac58"; # for internal version info
 
       goPackagePath = "github.com/sensu/sensu-go";
 
@@ -13,7 +13,7 @@ let
         owner = "sensu";
         repo = "sensu-go";
         rev = "v${version}";
-        sha256 = "1iwlkm7ac7brap45r6ly0blywgq6f28r1nws3yf0ybydv30brfj4";
+        sha256 = "0hnsgd6ryrl1y2prkavm7psqjnppkkfd891xkzbdfzblxsafs8cw";
       };
 
       inherit subPackages postInstall;
diff --git a/pkgs/servers/monitoring/zabbix/agent.nix b/pkgs/servers/monitoring/zabbix/agent.nix
index f112598da6a5..184d7e6aea7a 100644
--- a/pkgs/servers/monitoring/zabbix/agent.nix
+++ b/pkgs/servers/monitoring/zabbix/agent.nix
@@ -6,7 +6,7 @@ import ./versions.nix ({ version, sha256 }:
     inherit version;
 
     src = fetchurl {
-      url = "https://cdn.zabbix.com/stable/${version}/zabbix-${version}.tar.gz";
+      url = "https://cdn.zabbix.com/zabbix/sources/stable/${stdenv.lib.versions.majorMinor version}/zabbix-${version}.tar.gz";
       inherit sha256;
     };
 
diff --git a/pkgs/servers/monitoring/zabbix/proxy.nix b/pkgs/servers/monitoring/zabbix/proxy.nix
index b8f8ca33b0e7..4179cf52c7a9 100644
--- a/pkgs/servers/monitoring/zabbix/proxy.nix
+++ b/pkgs/servers/monitoring/zabbix/proxy.nix
@@ -21,7 +21,7 @@ in
       inherit version;
 
       src = fetchurl {
-        url = "https://cdn.zabbix.com/stable/${version}/zabbix-${version}.tar.gz";
+        url = "https://cdn.zabbix.com/zabbix/sources/stable/${stdenv.lib.versions.majorMinor version}/zabbix-${version}.tar.gz";
         inherit sha256;
       };
 
diff --git a/pkgs/servers/monitoring/zabbix/server.nix b/pkgs/servers/monitoring/zabbix/server.nix
index 25b7325bba22..fdf3fd476df1 100644
--- a/pkgs/servers/monitoring/zabbix/server.nix
+++ b/pkgs/servers/monitoring/zabbix/server.nix
@@ -21,7 +21,7 @@ in
       inherit version;
 
       src = fetchurl {
-        url = "https://cdn.zabbix.com/stable/${version}/zabbix-${version}.tar.gz";
+        url = "https://cdn.zabbix.com/zabbix/sources/stable/${stdenv.lib.versions.majorMinor version}/zabbix-${version}.tar.gz";
         inherit sha256;
       };
 
diff --git a/pkgs/servers/monitoring/zabbix/web.nix b/pkgs/servers/monitoring/zabbix/web.nix
index ca48a72d9fe8..a75deff3db27 100644
--- a/pkgs/servers/monitoring/zabbix/web.nix
+++ b/pkgs/servers/monitoring/zabbix/web.nix
@@ -6,7 +6,7 @@ import ./versions.nix ({ version, sha256 }:
     inherit version;
 
     src = fetchurl {
-      url = "https://cdn.zabbix.com/stable/${version}/zabbix-${version}.tar.gz";
+      url = "https://cdn.zabbix.com/zabbix/sources/stable/${stdenv.lib.versions.majorMinor version}/zabbix-${version}.tar.gz";
       inherit sha256;
     };
 
diff --git a/pkgs/servers/serviio/default.nix b/pkgs/servers/serviio/default.nix
index 006c2fdff3e4..769ed5e72728 100644
--- a/pkgs/servers/serviio/default.nix
+++ b/pkgs/servers/serviio/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "serviio";
-  version = "2.0";
+  version = "2.1";
 
   src = fetchurl {
     url = "http://download.serviio.org/releases/${pname}-${version}-linux.tar.gz";
-    sha256 = "1zq1ax0pdxfn0nw0vm7s23ik47w8nwh1n83a7yka8dnknxjf5nng";
+    sha256 = "0mxpdyhjf4w83q8ssmvpxm95hw4x7lfkh48vvdablccfndh82x2i";
   };
 
   phases = ["unpackPhase" "installPhase"];
diff --git a/pkgs/servers/sip/freeswitch/default.nix b/pkgs/servers/sip/freeswitch/default.nix
index 04ad685403b7..46ef6bcfac5e 100644
--- a/pkgs/servers/sip/freeswitch/default.nix
+++ b/pkgs/servers/sip/freeswitch/default.nix
@@ -8,6 +8,7 @@
 , SystemConfiguration
 
 , modules ? null
+, nixosTests
 }:
 
 let
@@ -89,12 +90,12 @@ in
 
 stdenv.mkDerivation rec {
   pname = "freeswitch";
-  version = "1.10.2";
+  version = "1.10.3";
   src = fetchFromGitHub {
     owner = "signalwire";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1fmrm51zgrasjbmhs0pzb1lyca3ddx0wd35shvxnkjnifi8qd1h7";
+    sha256 = "0rp4sxqxd2wsb5iyv0mh11l16zxvh7rbgfg0vcgns823gvh8lqai";
   };
   postPatch = ''
     patchShebangs     libs/libvpx/build/make/rtcd.pl
@@ -129,6 +130,8 @@ stdenv.mkDerivation rec {
     cp -r conf $out/share/freeswitch/
   '';
 
+  passthru.tests.freeswitch = nixosTests.freeswitch;
+
   meta = {
     description = "Cross-Platform Scalable FREE Multi-Protocol Soft Switch";
     homepage = "https://freeswitch.org/";
diff --git a/pkgs/servers/tautulli/default.nix b/pkgs/servers/tautulli/default.nix
index 73b0a57b694a..27a627dd4823 100644
--- a/pkgs/servers/tautulli/default.nix
+++ b/pkgs/servers/tautulli/default.nix
@@ -1,7 +1,7 @@
 {stdenv, fetchFromGitHub, python }:
 
 stdenv.mkDerivation rec {
-  version = "2.2.1";
+  version = "2.2.3";
   pname = "Tautulli";
 
   pythonPath = [ python.pkgs.setuptools ];
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     owner = "Tautulli";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0vcm9xjywy0c8lb37vdrn9payn80isij09lqkam37j08v5y64ln7";
+    sha256 = "0ni3dg5ly1xdyj1g931y2by3w17f0q031mpnrw2slhy6i792r5bp";
   };
 
   buildPhase = ":";
diff --git a/pkgs/shells/nushell/default.nix b/pkgs/shells/nushell/default.nix
index 9dbce58d0935..ecef2fc436e5 100644
--- a/pkgs/shells/nushell/default.nix
+++ b/pkgs/shells/nushell/default.nix
@@ -15,16 +15,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nushell";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "1n92wcd3f6p38iwp9sc4bfhmaxb61ff6vvn0zvy3h4q8wmvxpiky";
+    sha256 = "1g289zma19mh85xl5ffq1f3cv76piqavbhzs9m55mkg9wrhmgljd";
   };
 
-  cargoSha256 = "0dyszvy0nmbjill3wfyqprqkh911r070rvkxc1ls9s3yhxhwlhzq";
+  cargoSha256 = "16a32q2la7f4628m947dwif3j3wszsy603sj29ch6l2vdab40i3p";
 
   nativeBuildInputs = [ pkg-config ]
     ++ lib.optionals (withStableFeatures && stdenv.isLinux) [ python3 ];
diff --git a/pkgs/shells/zsh/oh-my-zsh/default.nix b/pkgs/shells/zsh/oh-my-zsh/default.nix
index 87ef5ecbde52..27add8e1d7c6 100644
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@@ -4,13 +4,13 @@
 { stdenv, fetchgit }:
 
 stdenv.mkDerivation rec {
-  version = "2020-05-07";
+  version = "2020-05-11";
   pname = "oh-my-zsh";
-  rev = "b876198575cbf23d589ddc8da6b22254d3d5358b";
+  rev = "fd786291bab7468c7cdd5066ac436218a1fba9e2";
 
   src = fetchgit { inherit rev;
     url = "https://github.com/ohmyzsh/ohmyzsh";
-    sha256 = "0vx3pi9wk9crmwgkpd3nwp88ci6ly0savj6v2md7qazmimgffsfi";
+    sha256 = "197478z13m2ian2qfwn0bjz5nhv233w74vw4271a2r0kihbp6pp5";
   };
 
   pathsToLink = [ "/share/oh-my-zsh" ];
diff --git a/pkgs/tools/X11/wpgtk/default.nix b/pkgs/tools/X11/wpgtk/default.nix
index 4125229237ae..2aa05935991e 100644
--- a/pkgs/tools/X11/wpgtk/default.nix
+++ b/pkgs/tools/X11/wpgtk/default.nix
@@ -3,13 +3,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "wpgtk";
-  version = "6.0.13";
+  version = "6.1.0";
 
   src = fetchFromGitHub {
     owner = "deviantfero";
     repo = "wpgtk";
     rev = version;
-    sha256 = "1fphv6k2hqfi3fzazjqmvip7sz9fhy5ccsgpqv68vfylrf8g1f92";
+    sha256 = "06z6qbfd9l3acp3wm28rq4vx3m5cxi4lpxgzc2nxvxmiz8rnnmh1";
   };
 
   buildInputs = [
diff --git a/pkgs/tools/X11/xpra/default.nix b/pkgs/tools/X11/xpra/default.nix
index 1f9efc31061a..b33ca52146ca 100644
--- a/pkgs/tools/X11/xpra/default.nix
+++ b/pkgs/tools/X11/xpra/default.nix
@@ -30,11 +30,11 @@ let
 
 in buildPythonApplication rec {
   pname = "xpra";
-  version = "3.0.8";
+  version = "3.0.9";
 
   src = fetchurl {
     url = "https://xpra.org/src/${pname}-${version}.tar.xz";
-    sha256 = "0d78bn7s03nwnyc4ryznxaivbg55kvsb26q75p8747j3562s9p2b";
+    sha256 = "04qskz1x1pvbdfirpxk58d3dfnf1n6dc69q2rdkak0avzl1nlzi7";
   };
 
   patches = [
diff --git a/pkgs/tools/admin/eksctl/default.nix b/pkgs/tools/admin/eksctl/default.nix
index 9fec8ec90472..233538083e94 100644
--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.18.0";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    sha256 = "15dzivnndzsiw7g6qzccpk1hqb5amfn0zba1rzkvcslhl1y9gsfi";
+    sha256 = "0xlr7hsncih4nzydi6sphp7j7k82cbhmi7jb0sd954i8kzl3sc1q";
   };
 
-  modSha256 = "13gqvr1y1b2yi2iar0p8y9hpajgy5w9xp4az5n6b5xhzcbn19f2k";
+  modSha256 = "0iw5za1fc9hsbc3fhhj3l276064vfdjqsad9c3c54y7b9rjgcqrv";
 
   subPackages = [ "cmd/eksctl" ];
 
diff --git a/pkgs/tools/admin/exoscale-cli/default.nix b/pkgs/tools/admin/exoscale-cli/default.nix
new file mode 100644
index 000000000000..a408746c7fd0
--- /dev/null
+++ b/pkgs/tools/admin/exoscale-cli/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, buildGo114Package, fetchFromGitHub }:
+
+buildGo114Package rec {
+  pname = "exoscale-cli";
+  version = "1.12.0";
+
+  src = fetchFromGitHub {
+    owner  = "exoscale";
+    repo   = "cli";
+    rev    = "v${version}";
+    sha256 = "04ym7mfv565icj3lmd2nrvq9asawwmmzg09681pj9py61ws56bxr";
+  };
+
+  goPackagePath = "github.com/exoscale/cli";
+  goDeps = ./deps.nix;
+
+  # ensures only the cli binary is built and we don't clutter bin/ with submodules
+  subPackages = [ "." ];
+
+  # we need to rename the resulting binary but can't use buildFlags with -o here
+  # because these are passed to "go install" which does not recognize -o
+  postBuild = ''
+    mv go/bin/cli go/bin/exo
+  '';
+
+  meta = {
+    description = "Command-line tool for everything at Exoscale: compute, storage, dns";
+    homepage    = "https://github.com/exoscale/cli";
+    license     = stdenv.lib.licenses.asl20;
+    maintainers = with stdenv.lib.maintainers; [ dramaturg ];
+  };
+}
diff --git a/pkgs/tools/admin/exoscale-cli/deps.nix b/pkgs/tools/admin/exoscale-cli/deps.nix
new file mode 100644
index 000000000000..a67ee93a8514
--- /dev/null
+++ b/pkgs/tools/admin/exoscale-cli/deps.nix
@@ -0,0 +1,876 @@
+# file generated from go.mod using vgo2nix (https://github.com/adisbladis/vgo2nix)
+[
+  {
+    goPackagePath = "github.com/BurntSushi/toml";
+    fetch = {
+      type = "git";
+      url = "https://github.com/BurntSushi/toml";
+      rev = "v0.3.1";
+      sha256 = "1fjdwwfzyzllgiwydknf1pwjvy49qxfsczqx5gz3y0izs7as99j6";
+    };
+  }
+  {
+    goPackagePath = "github.com/VividCortex/ewma";
+    fetch = {
+      type = "git";
+      url = "https://github.com/VividCortex/ewma";
+      rev = "v1.1.1";
+      sha256 = "14v2dy5gqchjn7k0sd6cx59ms42v681r6xz7cb1kspp4b28a74rw";
+    };
+  }
+  {
+    goPackagePath = "github.com/alecthomas/assert";
+    fetch = {
+      type = "git";
+      url = "https://github.com/alecthomas/assert";
+      rev = "405dbfeb8e38";
+      sha256 = "1l567pi17k593nrd1qlbmiq8z9jy3qs60px2a16fdpzjsizwqx8l";
+    };
+  }
+  {
+    goPackagePath = "github.com/alecthomas/chroma";
+    fetch = {
+      type = "git";
+      url = "https://github.com/alecthomas/chroma";
+      rev = "v0.6.2";
+      sha256 = "1bcppy1s148iikr78qjm0akahn01ywh83a8pw544prr9yc16jvmz";
+    };
+  }
+  {
+    goPackagePath = "github.com/alecthomas/colour";
+    fetch = {
+      type = "git";
+      url = "https://github.com/alecthomas/colour";
+      rev = "60882d9e2721";
+      sha256 = "0iq566534gbzkd16ixg7fk298wd766821vvs80838yifx9yml5vs";
+    };
+  }
+  {
+    goPackagePath = "github.com/alecthomas/gometalinter";
+    fetch = {
+      type = "git";
+      url = "https://github.com/alecthomas/gometalinter";
+      rev = "v2.0.11";
+      sha256 = "08p7bwvhpgizif8qi59m8mm3mcny70x9msbk8m8vjpphsq55wha4";
+    };
+  }
+  {
+    goPackagePath = "github.com/alecthomas/kong";
+    fetch = {
+      type = "git";
+      url = "https://github.com/alecthomas/kong";
+      rev = "v0.1.15";
+      sha256 = "1llxabcdzlb2hard0h931knqkdnyjyz8dp3k0nli0m0mags7l31b";
+    };
+  }
+  {
+    goPackagePath = "github.com/alecthomas/repr";
+    fetch = {
+      type = "git";
+      url = "https://github.com/alecthomas/repr";
+      rev = "117648cd9897";
+      sha256 = "05v1rgzdqc8razf702laagrvhvx68xd9yxxmzd3dyz0d6425pdrp";
+    };
+  }
+  {
+    goPackagePath = "github.com/alecthomas/units";
+    fetch = {
+      type = "git";
+      url = "https://github.com/alecthomas/units";
+      rev = "2efee857e7cf";
+      sha256 = "1j65b91qb9sbrml9cpabfrcf07wmgzzghrl7809hjjhrmbzri5bl";
+    };
+  }
+  {
+    goPackagePath = "github.com/armon/consul-api";
+    fetch = {
+      type = "git";
+      url = "https://github.com/armon/consul-api";
+      rev = "eb2c6b5be1b6";
+      sha256 = "1j6fdr1sg36qy4n4xjl7brq739fpm5npq98cmvklzjc9qrx98nk9";
+    };
+  }
+  {
+    goPackagePath = "github.com/blang/semver";
+    fetch = {
+      type = "git";
+      url = "https://github.com/blang/semver";
+      rev = "v3.5.1";
+      sha256 = "13ws259bwcibkclbr82ilhk6zadm63kxklxhk12wayklj8ghhsmy";
+    };
+  }
+  {
+    goPackagePath = "github.com/cenkalti/backoff";
+    fetch = {
+      type = "git";
+      url = "https://github.com/cenkalti/backoff";
+      rev = "v2.0.0";
+      sha256 = "0k4899ifpir6kmfxli8a2xfj5zdh0xb2jd0fq2r38wzd4pk25ipr";
+    };
+  }
+  {
+    goPackagePath = "github.com/chzyer/logex";
+    fetch = {
+      type = "git";
+      url = "https://github.com/chzyer/logex";
+      rev = "v1.1.10";
+      sha256 = "08pbjj3wx9acavlwyr055isa8a5hnmllgdv5k6ra60l5y1brmlq4";
+    };
+  }
+  {
+    goPackagePath = "github.com/chzyer/readline";
+    fetch = {
+      type = "git";
+      url = "https://github.com/chzyer/readline";
+      rev = "2972be24d48e";
+      sha256 = "104q8dazj8yf6b089jjr82fy9h1g80zyyzvp3g8b44a7d8ngjj6r";
+    };
+  }
+  {
+    goPackagePath = "github.com/chzyer/test";
+    fetch = {
+      type = "git";
+      url = "https://github.com/chzyer/test";
+      rev = "a1ea475d72b1";
+      sha256 = "0rns2aqk22i9xsgyap0pq8wi4cfaxsri4d9q6xxhhyma8jjsnj2k";
+    };
+  }
+  {
+    goPackagePath = "github.com/client9/misspell";
+    fetch = {
+      type = "git";
+      url = "https://github.com/client9/misspell";
+      rev = "v0.3.4";
+      sha256 = "1vwf33wsc4la25zk9nylpbp9px3svlmldkm0bha4hp56jws4q9cs";
+    };
+  }
+  {
+    goPackagePath = "github.com/coreos/etcd";
+    fetch = {
+      type = "git";
+      url = "https://github.com/coreos/etcd";
+      rev = "v3.3.10";
+      sha256 = "1x2ii1hj8jraba8rbxz6dmc03y3sjxdnzipdvg6fywnlq1f3l3wl";
+    };
+  }
+  {
+    goPackagePath = "github.com/coreos/go-etcd";
+    fetch = {
+      type = "git";
+      url = "https://github.com/coreos/go-etcd";
+      rev = "v2.0.0";
+      sha256 = "1xb34hzaa1lkbq5vkzy9vcz6gqwj7hp6cdbvyack2bf28dwn33jj";
+    };
+  }
+  {
+    goPackagePath = "github.com/coreos/go-semver";
+    fetch = {
+      type = "git";
+      url = "https://github.com/coreos/go-semver";
+      rev = "v0.2.0";
+      sha256 = "1gghi5bnqj50hfxhqc1cxmynqmh2yk9ii7ab9gsm75y5cp94ymk0";
+    };
+  }
+  {
+    goPackagePath = "github.com/cpuguy83/go-md2man";
+    fetch = {
+      type = "git";
+      url = "https://github.com/cpuguy83/go-md2man";
+      rev = "v1.0.8";
+      sha256 = "1w22dfdamsq63b5rvalh9k2y7rbwfkkjs7vm9vd4a13h2ql70lg2";
+    };
+  }
+  {
+    goPackagePath = "github.com/cyberdelia/templates";
+    fetch = {
+      type = "git";
+      url = "https://github.com/cyberdelia/templates";
+      rev = "ca7fffd4298c";
+      sha256 = "1miakwci9pz95p0jps4i3pyv5ws713ks1wwir5bzrl0yg8klrgw1";
+    };
+  }
+  {
+    goPackagePath = "github.com/danwakefield/fnmatch";
+    fetch = {
+      type = "git";
+      url = "https://github.com/danwakefield/fnmatch";
+      rev = "cbb64ac3d964";
+      sha256 = "0cbf511ppsa6hf59mdl7nbyn2b2n71y0bpkzbmfkdqjhanqh1lqz";
+    };
+  }
+  {
+    goPackagePath = "github.com/davecgh/go-spew";
+    fetch = {
+      type = "git";
+      url = "https://github.com/davecgh/go-spew";
+      rev = "v1.1.1";
+      sha256 = "0hka6hmyvp701adzag2g26cxdj47g21x6jz4sc6jjz1mn59d474y";
+    };
+  }
+  {
+    goPackagePath = "github.com/deepmap/oapi-codegen";
+    fetch = {
+      type = "git";
+      url = "https://github.com/deepmap/oapi-codegen";
+      rev = "ee90a3f9f1ae";
+      sha256 = "199nb6aqhllkk891x24h1jffin1x9fx8jdsav9pbc2ki0z8mlji3";
+    };
+  }
+  {
+    goPackagePath = "github.com/dgrijalva/jwt-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/dgrijalva/jwt-go";
+      rev = "v3.2.0";
+      sha256 = "08m27vlms74pfy5z79w67f9lk9zkx6a9jd68k3c4msxy75ry36mp";
+    };
+  }
+  {
+    goPackagePath = "github.com/dlclark/regexp2";
+    fetch = {
+      type = "git";
+      url = "https://github.com/dlclark/regexp2";
+      rev = "v1.1.6";
+      sha256 = "144s81ndviwhyy20ipxvvfvap8phv5p762glxrz6aqxprkxfarj5";
+    };
+  }
+  {
+    goPackagePath = "github.com/dustin/go-humanize";
+    fetch = {
+      type = "git";
+      url = "https://github.com/dustin/go-humanize";
+      rev = "v1.0.0";
+      sha256 = "1kqf1kavdyvjk7f8kx62pnm7fbypn9z1vbf8v2qdh3y7z7a0cbl3";
+    };
+  }
+  {
+    goPackagePath = "github.com/exoscale/egoscale";
+    fetch = {
+      type = "git";
+      url = "https://github.com/exoscale/egoscale";
+      rev = "v0.24.0";
+      sha256 = "1ls7blpmhwqxz9cfjc5799q4047pawfda1v1mhyicjdlp3b1z1zi";
+    };
+  }
+  {
+    goPackagePath = "github.com/fatih/camelcase";
+    fetch = {
+      type = "git";
+      url = "https://github.com/fatih/camelcase";
+      rev = "v1.0.0";
+      sha256 = "0z7rw6f5j97dkzqya257dqlxf3cm8zl508081gmnr4bsjhkwpz2l";
+    };
+  }
+  {
+    goPackagePath = "github.com/fsnotify/fsnotify";
+    fetch = {
+      type = "git";
+      url = "https://github.com/fsnotify/fsnotify";
+      rev = "v1.4.7";
+      sha256 = "07va9crci0ijlivbb7q57d2rz9h27zgn2fsm60spjsqpdbvyrx4g";
+    };
+  }
+  {
+    goPackagePath = "github.com/getkin/kin-openapi";
+    fetch = {
+      type = "git";
+      url = "https://github.com/getkin/kin-openapi";
+      rev = "v0.2.0";
+      sha256 = "0slv4k55yiqgv5cv51mvfdcckl95wsbvhvrrpmh4wf7q9rk0jkf6";
+    };
+  }
+  {
+    goPackagePath = "github.com/ghodss/yaml";
+    fetch = {
+      type = "git";
+      url = "https://github.com/ghodss/yaml";
+      rev = "v1.0.0";
+      sha256 = "0skwmimpy7hlh7pva2slpcplnm912rp3igs98xnqmn859kwa5v8g";
+    };
+  }
+  {
+    goPackagePath = "github.com/go-chi/chi";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-chi/chi";
+      rev = "v4.0.2";
+      sha256 = "1ay9yxzj60l21h4wayrq9sv5ajaqaryy5yyf27z7v2k4a83b5qr6";
+    };
+  }
+  {
+    goPackagePath = "github.com/go-ini/ini";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-ini/ini";
+      rev = "v1.42.0";
+      sha256 = "18ywm8zyv091j1pp5mvx8szl7928chk8lw02br6jy568d7rk4xal";
+    };
+  }
+  {
+    goPackagePath = "github.com/gofrs/uuid";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gofrs/uuid";
+      rev = "v3.2.0";
+      sha256 = "1q63mp7bznhfgyw133c0wc0hpcj1cq9bcf7w1f8r6inkcrils1fz";
+    };
+  }
+  {
+    goPackagePath = "github.com/golang/lint";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golang/lint";
+      rev = "c67002cb31c3";
+      sha256 = "0gymbggskjmphqxqcx4s0vnlcz7mygbix0vhwcwv5r67c0bf6765";
+    };
+  }
+  {
+    goPackagePath = "github.com/golangci/lint-1";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golangci/lint-1";
+      rev = "d2cdd8c08219";
+      sha256 = "0viib12a61338411ng4nnd4na4fscsknghk397jdfn00sigyy4ls";
+    };
+  }
+  {
+    goPackagePath = "github.com/google/shlex";
+    fetch = {
+      type = "git";
+      url = "https://github.com/google/shlex";
+      rev = "c34317bd91bf";
+      sha256 = "00qivza4hkllfkar2vpqmyxybi0fwqipgijv61dgapq4xddxdq0r";
+    };
+  }
+  {
+    goPackagePath = "github.com/gopherjs/gopherjs";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gopherjs/gopherjs";
+      rev = "d547d1d9531e";
+      sha256 = "0rhgxfh8b3qq4imkw6dmv0hxsmflm9pkax8i7a9z8q464z1ixrz7";
+    };
+  }
+  {
+    goPackagePath = "github.com/gordonklaus/ineffassign";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gordonklaus/ineffassign";
+      rev = "1003c8bd00dc";
+      sha256 = "1rkzqvd3z03vq8q8qi9cghvgggsf02ammj9wq8jvpnx6b2sd16nd";
+    };
+  }
+  {
+    goPackagePath = "github.com/hashicorp/hcl";
+    fetch = {
+      type = "git";
+      url = "https://github.com/hashicorp/hcl";
+      rev = "v1.0.0";
+      sha256 = "0q6ml0qqs0yil76mpn4mdx4lp94id8vbv575qm60jzl1ijcl5i66";
+    };
+  }
+  {
+    goPackagePath = "github.com/inconshreveable/mousetrap";
+    fetch = {
+      type = "git";
+      url = "https://github.com/inconshreveable/mousetrap";
+      rev = "v1.0.0";
+      sha256 = "1mn0kg48xkd74brf48qf5hzp0bc6g8cf5a77w895rl3qnlpfw152";
+    };
+  }
+  {
+    goPackagePath = "github.com/jtolds/gls";
+    fetch = {
+      type = "git";
+      url = "https://github.com/jtolds/gls";
+      rev = "v4.20.0";
+      sha256 = "1k7xd2q2ysv2xsh373qs801v6f359240kx0vrl0ydh7731lngvk6";
+    };
+  }
+  {
+    goPackagePath = "github.com/juju/ansiterm";
+    fetch = {
+      type = "git";
+      url = "https://github.com/juju/ansiterm";
+      rev = "720a0952cc2a";
+      sha256 = "0n6j0y7xhashp8gdkdl0r7vlbkdrkymrzxn9hxrx522k2isggs7h";
+    };
+  }
+  {
+    goPackagePath = "github.com/konsorten/go-windows-terminal-sequences";
+    fetch = {
+      type = "git";
+      url = "https://github.com/konsorten/go-windows-terminal-sequences";
+      rev = "v1.0.1";
+      sha256 = "1lchgf27n276vma6iyxa0v1xds68n2g8lih5lavqnx5x6q5pw2ip";
+    };
+  }
+  {
+    goPackagePath = "github.com/kr/pretty";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kr/pretty";
+      rev = "v0.1.0";
+      sha256 = "18m4pwg2abd0j9cn5v3k2ksk9ig4vlwxmlw9rrglanziv9l967qp";
+    };
+  }
+  {
+    goPackagePath = "github.com/kr/pty";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kr/pty";
+      rev = "v1.1.1";
+      sha256 = "0383f0mb9kqjvncqrfpidsf8y6ns5zlrc91c6a74xpyxjwvzl2y6";
+    };
+  }
+  {
+    goPackagePath = "github.com/kr/text";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kr/text";
+      rev = "v0.1.0";
+      sha256 = "1gm5bsl01apvc84bw06hasawyqm4q84vx1pm32wr9jnd7a8vjgj1";
+    };
+  }
+  {
+    goPackagePath = "github.com/labstack/echo";
+    fetch = {
+      type = "git";
+      url = "https://github.com/labstack/echo";
+      rev = "v4.1.11";
+      sha256 = "0b14vgwzznn7wzyjb98xdmq4wjg16l3y62njiwfz4qsm4pwzk405";
+    };
+  }
+  {
+    goPackagePath = "github.com/labstack/gommon";
+    fetch = {
+      type = "git";
+      url = "https://github.com/labstack/gommon";
+      rev = "v0.3.0";
+      sha256 = "18z7akyzm75p6anm4b8qkqgm4iivx50z07hi5wf50w1pbsvbcdi0";
+    };
+  }
+  {
+    goPackagePath = "github.com/lunixbochs/vtclean";
+    fetch = {
+      type = "git";
+      url = "https://github.com/lunixbochs/vtclean";
+      rev = "2d01aacdc34a";
+      sha256 = "1ss88dyx5hr4imvpg5lixvp0cf7c2qm4x9m8mdgshjpm92g5rqmf";
+    };
+  }
+  {
+    goPackagePath = "github.com/magiconair/properties";
+    fetch = {
+      type = "git";
+      url = "https://github.com/magiconair/properties";
+      rev = "v1.8.0";
+      sha256 = "1a10362wv8a8qwb818wygn2z48lgzch940hvpv81hv8gc747ajxn";
+    };
+  }
+  {
+    goPackagePath = "github.com/manifoldco/promptui";
+    fetch = {
+      type = "git";
+      url = "https://github.com/manifoldco/promptui";
+      rev = "v0.3.2";
+      sha256 = "185h0lqm14l9j0yvdsn9njq7jw3j6x3l21jvvczzbcbbrj44q0pl";
+    };
+  }
+  {
+    goPackagePath = "github.com/matryer/moq";
+    fetch = {
+      type = "git";
+      url = "https://github.com/matryer/moq";
+      rev = "6cfb0558e1bd";
+      sha256 = "0x7ss68cvq2aljyw4765iy7divmp8rghpyzlas3nb95qzsfmmpzl";
+    };
+  }
+  {
+    goPackagePath = "github.com/mattn/go-colorable";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mattn/go-colorable";
+      rev = "v0.1.4";
+      sha256 = "1yxcz08kminqr1221zxpibnbzfcgs3fafin0z9zqb3gqvf74jywz";
+    };
+  }
+  {
+    goPackagePath = "github.com/mattn/go-isatty";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mattn/go-isatty";
+      rev = "v0.0.10";
+      sha256 = "0jf4hwfwd2cpxrlyv0jzcia809q2bjw7y1m3ciaj2s8lj2jqyf6r";
+    };
+  }
+  {
+    goPackagePath = "github.com/mattn/go-runewidth";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mattn/go-runewidth";
+      rev = "v0.0.3";
+      sha256 = "0lc39b6xrxv7h3v3y1kgz49cgi5qxwlygs715aam6ba35m48yi7g";
+    };
+  }
+  {
+    goPackagePath = "github.com/minio/minio-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/minio/minio-go";
+      rev = "v6.0.44";
+      sha256 = "0sfmd2lf24f7ds16imk63mas6izhjnmprbxad0sil9abvk8r23mk";
+    };
+  }
+  {
+    goPackagePath = "github.com/minio/sha256-simd";
+    fetch = {
+      type = "git";
+      url = "https://github.com/minio/sha256-simd";
+      rev = "v0.1.1";
+      sha256 = "1j0iqsckm97g4l79vd4mc7apbmkdar23jpzqpnpdhwpfd834j8lp";
+    };
+  }
+  {
+    goPackagePath = "github.com/mitchellh/go-homedir";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mitchellh/go-homedir";
+      rev = "v1.1.0";
+      sha256 = "0ydzkipf28hwj2bfxqmwlww47khyk6d152xax4bnyh60f4lq3nx1";
+    };
+  }
+  {
+    goPackagePath = "github.com/mitchellh/mapstructure";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mitchellh/mapstructure";
+      rev = "v1.1.2";
+      sha256 = "03bpv28jz9zhn4947saqwi328ydj7f6g6pf1m2d4m5zdh5jlfkrr";
+    };
+  }
+  {
+    goPackagePath = "github.com/nicksnyder/go-i18n";
+    fetch = {
+      type = "git";
+      url = "https://github.com/nicksnyder/go-i18n";
+      rev = "v1.10.0";
+      sha256 = "1nlvq85c232z5yjs86pxpmkv7hk6gb5pa6j4hhzgdz85adk2ma04";
+    };
+  }
+  {
+    goPackagePath = "github.com/olekukonko/tablewriter";
+    fetch = {
+      type = "git";
+      url = "https://github.com/olekukonko/tablewriter";
+      rev = "be2c049b30cc";
+      sha256 = "1fr996vpmh6v5q13kfgf0fbi0hksxqg0fnbvj2nqhlsyfp5s8f4w";
+    };
+  }
+  {
+    goPackagePath = "github.com/pelletier/go-toml";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pelletier/go-toml";
+      rev = "v1.2.0";
+      sha256 = "1fjzpcjng60mc3a4b2ql5a00d5gah84wj740dabv9kq67mpg8fxy";
+    };
+  }
+  {
+    goPackagePath = "github.com/pkg/errors";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pkg/errors";
+      rev = "v0.9.1";
+      sha256 = "1761pybhc2kqr6v5fm8faj08x9bql8427yqg6vnfv6nhrasx1mwq";
+    };
+  }
+  {
+    goPackagePath = "github.com/pmezard/go-difflib";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pmezard/go-difflib";
+      rev = "v1.0.0";
+      sha256 = "0c1cn55m4rypmscgf0rrb88pn58j3ysvc2d0432dp3c6fqg6cnzw";
+    };
+  }
+  {
+    goPackagePath = "github.com/russross/blackfriday";
+    fetch = {
+      type = "git";
+      url = "https://github.com/russross/blackfriday";
+      rev = "v1.5.2";
+      sha256 = "0jzbfzcywqcrnym4gxlz6nphmm1grg6wsl4f0r9x384rn83wkj7c";
+    };
+  }
+  {
+    goPackagePath = "github.com/sergi/go-diff";
+    fetch = {
+      type = "git";
+      url = "https://github.com/sergi/go-diff";
+      rev = "v1.0.0";
+      sha256 = "0swiazj8wphs2zmk1qgq75xza6m19snif94h2m6fi8dqkwqdl7c7";
+    };
+  }
+  {
+    goPackagePath = "github.com/sirupsen/logrus";
+    fetch = {
+      type = "git";
+      url = "https://github.com/sirupsen/logrus";
+      rev = "v1.4.2";
+      sha256 = "087k2lxrr9p9dh68yw71d05h5g9p5v26zbwd6j7lghinjfaw334x";
+    };
+  }
+  {
+    goPackagePath = "github.com/smartystreets/assertions";
+    fetch = {
+      type = "git";
+      url = "https://github.com/smartystreets/assertions";
+      rev = "b2de0cb4f26d";
+      sha256 = "1i7ldgavgl35c7gk25p7bvdr282ckng090zr4ch9mk1705akx09y";
+    };
+  }
+  {
+    goPackagePath = "github.com/smartystreets/goconvey";
+    fetch = {
+      type = "git";
+      url = "https://github.com/smartystreets/goconvey";
+      rev = "68dc04aab96a";
+      sha256 = "1kas5v95fzhr88hg4rjy0vp03y4pzvy3pwwgkfz2yhn5nlj29nk6";
+    };
+  }
+  {
+    goPackagePath = "github.com/spf13/afero";
+    fetch = {
+      type = "git";
+      url = "https://github.com/spf13/afero";
+      rev = "v1.1.2";
+      sha256 = "0miv4faf5ihjfifb1zv6aia6f6ik7h1s4954kcb8n6ixzhx9ck6k";
+    };
+  }
+  {
+    goPackagePath = "github.com/spf13/cast";
+    fetch = {
+      type = "git";
+      url = "https://github.com/spf13/cast";
+      rev = "v1.3.0";
+      sha256 = "0xq1ffqj8y8h7dcnm0m9lfrh0ga7pssnn2c1dnr09chqbpn4bdc5";
+    };
+  }
+  {
+    goPackagePath = "github.com/spf13/cobra";
+    fetch = {
+      type = "git";
+      url = "https://github.com/spf13/cobra";
+      rev = "v0.0.3";
+      sha256 = "1q1nsx05svyv9fv3fy6xv6gs9ffimkyzsfm49flvl3wnvf1ncrkd";
+    };
+  }
+  {
+    goPackagePath = "github.com/spf13/jwalterweatherman";
+    fetch = {
+      type = "git";
+      url = "https://github.com/spf13/jwalterweatherman";
+      rev = "v1.0.0";
+      sha256 = "093fmmvavv84pv4q84hav7ph3fmrq87bvspjj899q0qsx37yvdr8";
+    };
+  }
+  {
+    goPackagePath = "github.com/spf13/pflag";
+    fetch = {
+      type = "git";
+      url = "https://github.com/spf13/pflag";
+      rev = "v1.0.3";
+      sha256 = "1cj3cjm7d3zk0mf1xdybh0jywkbbw7a6yr3y22x9sis31scprswd";
+    };
+  }
+  {
+    goPackagePath = "github.com/spf13/viper";
+    fetch = {
+      type = "git";
+      url = "https://github.com/spf13/viper";
+      rev = "v1.3.1";
+      sha256 = "1190mg04718r03qriav99sf4kx2n7wdgr8vdni15f74bpbzrdjrl";
+    };
+  }
+  {
+    goPackagePath = "github.com/stretchr/objx";
+    fetch = {
+      type = "git";
+      url = "https://github.com/stretchr/objx";
+      rev = "v0.1.1";
+      sha256 = "0iph0qmpyqg4kwv8jsx6a56a7hhqq8swrazv40ycxk9rzr0s8yls";
+    };
+  }
+  {
+    goPackagePath = "github.com/stretchr/testify";
+    fetch = {
+      type = "git";
+      url = "https://github.com/stretchr/testify";
+      rev = "v1.4.0";
+      sha256 = "187i5g88sxfy4vxpm7dw1gwv29pa2qaq475lxrdh5livh69wqfjb";
+    };
+  }
+  {
+    goPackagePath = "github.com/tsenart/deadcode";
+    fetch = {
+      type = "git";
+      url = "https://github.com/tsenart/deadcode";
+      rev = "210d2dc333e9";
+      sha256 = "05kif593f4wygnrq2fdjhn7kkcpdmgjnykcila85d0gqlb1f36g0";
+    };
+  }
+  {
+    goPackagePath = "github.com/ugorji/go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/ugorji/go";
+      rev = "d75b2dcb6bc8";
+      sha256 = "0di1k35gpq9bp958ywranpbskx2vdwlb38s22vl9rybm3wa5g3ps";
+    };
+  }
+  {
+    goPackagePath = "github.com/valyala/bytebufferpool";
+    fetch = {
+      type = "git";
+      url = "https://github.com/valyala/bytebufferpool";
+      rev = "v1.0.0";
+      sha256 = "01lqzjddq6kz9v41nkky7wbgk7f1cw036sa7ldz10d82g5klzl93";
+    };
+  }
+  {
+    goPackagePath = "github.com/valyala/fasttemplate";
+    fetch = {
+      type = "git";
+      url = "https://github.com/valyala/fasttemplate";
+      rev = "v1.1.0";
+      sha256 = "089wm839lqmw9knr3ifbi82iykaybk0zxzp3c02lsh31wax4f8a2";
+    };
+  }
+  {
+    goPackagePath = "github.com/vbauerster/mpb";
+    fetch = {
+      type = "git";
+      url = "https://github.com/vbauerster/mpb";
+      rev = "v4.8.4";
+      sha256 = "0ifz1hp1a5xjxx7x9km5pb0x6p60lcpzwmhnxlg5x4ls6hrs8wd9";
+    };
+  }
+  {
+    goPackagePath = "github.com/xordataexchange/crypt";
+    fetch = {
+      type = "git";
+      url = "https://github.com/xordataexchange/crypt";
+      rev = "b2862e3d0a77";
+      sha256 = "04q3856anpzl4gdfgmg7pbp9cx231nkz3ymq2xp27rnmmwhfxr8y";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/crypto";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/crypto";
+      rev = "e1110fd1c708";
+      sha256 = "0n5n7dzlr87mvk3mbcx400al4pa1i85jbbdhbx4s1rhr0rs3kh9a";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/lint";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/lint";
+      rev = "c67002cb31c3";
+      sha256 = "0gymbggskjmphqxqcx4s0vnlcz7mygbix0vhwcwv5r67c0bf6765";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/net";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/net";
+      rev = "2180aed22343";
+      sha256 = "0hl3pgi8rzij5m6alq4xqfvyvidy7jnf5y85031jv4y1bj85r6pl";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/sync";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/sync";
+      rev = "112230192c58";
+      sha256 = "05i2k43j2d0llq768hg5pf3hb2yhfzp9la1w5wp0rsnnzblr0lfn";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/sys";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/sys";
+      rev = "52ab43148777";
+      sha256 = "1kakxbqrb1w2vwg7r1896z68qcx2lfvimsl8cs2niiipbgpi6imx";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/text";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/text";
+      rev = "v0.3.2";
+      sha256 = "0flv9idw0jm5nm8lx25xqanbkqgfiym6619w575p7nrdh0riqwqh";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/tools";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/tools";
+      rev = "a911d9008d1f";
+      sha256 = "118vsliq2a9xfp6rckc310mf9lydfgah6hgiggd88cm3zch4626m";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/xerrors";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/xerrors";
+      rev = "a985d3407aa7";
+      sha256 = "00wzr5w8aadipgc3rkk8f11i41znskfj9ix5nhhaxyg7isrslgcj";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/alecthomas/kingpin.v3-unstable";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/alecthomas/kingpin.v3-unstable";
+      rev = "df19058c872c";
+      sha256 = "0nb6925fixs6brdwpmwi32b38acn1s8dv4g0syjy3kpq0wasljy9";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/check.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/check.v1";
+      rev = "788fd7840127";
+      sha256 = "0v3bim0j375z81zrpr5qv42knqs0y2qv2vkjiqi5axvb78slki1a";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/ini.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/ini.v1";
+      rev = "v1.42.0";
+      sha256 = "18ywm8zyv091j1pp5mvx8szl7928chk8lw02br6jy568d7rk4xal";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/yaml.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/yaml.v2";
+      rev = "v2.2.5";
+      sha256 = "08smz8dfyxp02ha74my9iszqa5qzgl3ksi28ilyp8lqipssiq6fg";
+    };
+  }
+]
diff --git a/pkgs/tools/admin/lego/default.nix b/pkgs/tools/admin/lego/default.nix
index b2d3ebfa5829..05cab814ecfb 100644
--- a/pkgs/tools/admin/lego/default.nix
+++ b/pkgs/tools/admin/lego/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "lego";
-  version = "3.6.0";
+  version = "3.7.0";
 
   src = fetchFromGitHub {
     owner = "go-acme";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0jqq1ricy8971a27zcc6qm61cv6pjk4984dab1cgz86qzama7nil";
+    hash = "sha256-hjH1TBw6GHYNI9JSBOzdyEtJmp8NhlwNYydGZwsjAg0=";
   };
 
-  modSha256 = "0a3d7snnchxk5n4m0v725689pwqjgwz7g94yzh9akc55nwy33sfj";
+  modSha256 = "sha256-+PJRaDdZqVO6D9SXojlr8JXn++pL18HOHFdaiUEalw8=";
   subPackages = [ "cmd/lego" ];
 
   buildFlagsArray = [
diff --git a/pkgs/tools/admin/procs/default.nix b/pkgs/tools/admin/procs/default.nix
index a4998d8546b6..5bfbb6d8c64d 100644
--- a/pkgs/tools/admin/procs/default.nix
+++ b/pkgs/tools/admin/procs/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "procs";
-  version = "0.10.1";
+  version = "0.10.3";
 
   src = fetchFromGitHub {
     owner = "dalance";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0waqkb1l66yk2gbqzybrh3yzf72gvyjsrvv3zyxpxzsgawrcx85g";
+    sha256 = "0lg4v32jx0fxcjz6cj6cxxlg7rhj75k4p75izpkk4l11xpxqhgjm";
   };
 
-  cargoSha256 = "0z4m7aslgwvbfm6af03d8ql6c4w83h0kwgbgy6sfsx1gf7kv6q6z";
+  cargoSha256 = "05qqy6l28ihn7hykkkh1x7z3q58cdrwv76fc22xjcg20985ac2nx";
 
   buildInputs = stdenv.lib.optional stdenv.isDarwin Security;
 
diff --git a/pkgs/tools/admin/salt/default.nix b/pkgs/tools/admin/salt/default.nix
index b378f0828659..f3c375a99660 100644
--- a/pkgs/tools/admin/salt/default.nix
+++ b/pkgs/tools/admin/salt/default.nix
@@ -25,11 +25,11 @@ let
 in
 py.pkgs.buildPythonApplication rec {
   pname = "salt";
-  version = "3000.2";
+  version = "3000.3";
 
   src = py.pkgs.fetchPypi {
     inherit pname version;
-    sha256 = "1n90qqhsvbf4pc4pcbya3rjfkblbccf4np4mxpghjqaa16fl4cqf";
+    sha256 = "19yfjhidx93rl9s03lvrfz7kp0xxigyv4d3zb9792zb9bsc4kjpw";
   };
 
   propagatedBuildInputs = with py.pkgs; [
diff --git a/pkgs/tools/backup/monolith/default.nix b/pkgs/tools/backup/monolith/default.nix
index 046fe130ffb8..f3bcf82e5457 100644
--- a/pkgs/tools/backup/monolith/default.nix
+++ b/pkgs/tools/backup/monolith/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "monolith";
-  version = "2.2.4";
+  version = "2.2.5";
 
   src = fetchFromGitHub {
     owner = "Y2Z";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0am992dhqv0vpk4zsc9wwnbzhpdx98wm9dxi89bq2yr3l77lml3d";
+    sha256 = "0w19szxzhwxbgnv4k618p8v29dhbar1fn433bsz1cr1apnrahmkn";
   };
 
-  cargoSha256 = "03nd8pzrd66rv12l7qr9i4kdrdr8hk1mz8ihvd982cjd2dlisipd";
+  cargoSha256 = "06gc3cpx1m2f6fwrm8brw5nidg1v02q1qwqfxvv3xzmmczbw4345";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ];
diff --git a/pkgs/tools/filesystems/fuse-overlayfs/default.nix b/pkgs/tools/filesystems/fuse-overlayfs/default.nix
index 4c8012de4f14..c3b694c85554 100644
--- a/pkgs/tools/filesystems/fuse-overlayfs/default.nix
+++ b/pkgs/tools/filesystems/fuse-overlayfs/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     longDescription = "An implementation of overlay+shiftfs in FUSE for rootless containers.";
     license = licenses.gpl3;
     maintainers = with maintainers; [ ma9e ] ++ teams.podman.members;
-    platforms = platforms.unix;
+    platforms = platforms.linux;
     inherit (src.meta) homepage;
   };
 }
diff --git a/pkgs/tools/misc/bat/default.nix b/pkgs/tools/misc/bat/default.nix
index d08a609735f2..95bc44dcce06 100644
--- a/pkgs/tools/misc/bat/default.nix
+++ b/pkgs/tools/misc/bat/default.nix
@@ -4,17 +4,22 @@
 
 rustPlatform.buildRustPackage rec {
   pname   = "bat";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner  = "sharkdp";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "07yng5bwhin7yqj1hihmxgi8w0n45nks05a8795zwsw92k373ib4";
+    sha256 = "10cs94ja1dmn0f24gqkcy8rf68b3b43k6qpbb5njbg0hcx3x6cyj";
     fetchSubmodules = true;
   };
 
-  cargoSha256 = "1xqbpij6lr0bqyi0cfwgp3d4hcjhibpdc4dfm9gb39mmbgradrzf";
+  cargoSha256 = "13cphi08bp6lg054acgliir8dx2jajll4m3c4xxy04skmx555zr8";
+
+  # Disable test that's broken on macOS.
+  # This should probably be removed on the next release.
+  # https://github.com/sharkdp/bat/issues/983
+  patches = [ ./macos.patch ];
 
   nativeBuildInputs = [ pkgconfig llvmPackages.libclang installShellFiles makeWrapper ];
 
diff --git a/pkgs/tools/misc/bat/macos.patch b/pkgs/tools/misc/bat/macos.patch
new file mode 100644
index 000000000000..549782f0c91b
--- /dev/null
+++ b/pkgs/tools/misc/bat/macos.patch
@@ -0,0 +1,13 @@
+diff --git a/src/assets.rs b/src/assets.rs
+index 4f8556f..222abc2 100644
+--- a/src/assets.rs
++++ b/src/assets.rs
+@@ -336,7 +336,7 @@ mod tests {
+         assert_eq!(test.syntax_for_file("Makefile"), "Makefile");
+     }
+ 
+-    #[cfg(unix)]
++    #[cfg(all(unix,not(target_os = "macos")))]
+     #[test]
+     fn syntax_detection_invalid_utf8() {
+         use std::os::unix::ffi::OsStrExt;
diff --git a/pkgs/tools/misc/clipman/default.nix b/pkgs/tools/misc/clipman/default.nix
index 581cb6cb7836..8d84adbddada 100644
--- a/pkgs/tools/misc/clipman/default.nix
+++ b/pkgs/tools/misc/clipman/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "clipman";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "yory8";
     repo = pname;
     rev = "v${version}";
-    sha256 = "09qvd7p63y7kh2i22pc89kr5wdnsbkraj5az9ds3bp3yj4q2mfyn";
+    sha256 = "1lf5fbzplyc1mpdqgfwbrn8m5568vhjf48580fvvfgbhz6zcil8n";
   };
 
   modSha256 = "1sim3x794kj3wdw0g432zbgh1cimdmmg1hjgynh9jgm3y8w9q7ij";
diff --git a/pkgs/tools/misc/ffsend/default.nix b/pkgs/tools/misc/ffsend/default.nix
index 62c2aa36dc19..fc4c44e01cd4 100644
--- a/pkgs/tools/misc/ffsend/default.nix
+++ b/pkgs/tools/misc/ffsend/default.nix
@@ -16,16 +16,16 @@ with rustPlatform;
 
 buildRustPackage rec {
   pname = "ffsend";
-  version = "0.2.59";
+  version = "0.2.61";
 
   src = fetchFromGitLab {
     owner = "timvisee";
     repo = "ffsend";
     rev = "v${version}";
-    sha256 = "14a7mb1a1s74hi124v4jscc72m09zq2bd8xrhq5agz9z27plqm2c";
+    sha256 = "1d0rx5gcp9z06kxjknqa1r2b4m5c4vrhp4a9spkawvgiky5a9x07";
   };
 
-  cargoSha256 = "1945s3ajpy55fzh5wbl7fchqck0fh69shl18lxni9hvg04smq39i";
+  cargoSha256 = "1bmyhg1y4gz719nsfdfjf4y73f9l6aag17dx9iazfzwnwwaq46m9";
 
   nativeBuildInputs = [ cmake pkgconfig installShellFiles ];
   buildInputs = [ openssl ]
diff --git a/pkgs/tools/misc/vttest/default.nix b/pkgs/tools/misc/vttest/default.nix
index 38fedbbf0992..6a9a12b2a07a 100644
--- a/pkgs/tools/misc/vttest/default.nix
+++ b/pkgs/tools/misc/vttest/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "vttest";
-  version = "20200303";
+  version = "20200420";
 
   src = fetchurl {
     urls = [
       "https://invisible-mirror.net/archives/${pname}/${pname}-${version}.tgz"
       "ftp://ftp.invisible-island.net/${pname}/${pname}-${version}.tgz"
     ];
-    sha256 = "1g27yp37kh57hmwicw3ndnsapsbqzk2cnjccmvyj4zw2z0l5iaj9";
+    sha256 = "03li63v9mbsqn4cw6d769r1a6iaixi80m2c32y32vc9i5k3ik43c";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/networking/aria2/default.nix b/pkgs/tools/networking/aria2/default.nix
index 6c596e77af88..5ede0db598c9 100644
--- a/pkgs/tools/networking/aria2/default.nix
+++ b/pkgs/tools/networking/aria2/default.nix
@@ -20,7 +20,12 @@ stdenv.mkDerivation rec {
   buildInputs = [ openssl c-ares libxml2 sqlite zlib libssh2 ] ++
     stdenv.lib.optional stdenv.isDarwin Security;
 
-  configureFlags = [ "--with-ca-bundle=/etc/ssl/certs/ca-certificates.crt" ];
+  outputs = [ "bin" "dev" "out" "doc" "man" ];
+
+  configureFlags = [
+    "--with-ca-bundle=/etc/ssl/certs/ca-certificates.crt"
+    "--enable-libaria2"
+  ];
 
   prePatch = ''
     patchShebangs doc/manual-src/en/mkapiref.py
diff --git a/pkgs/tools/networking/urlwatch/default.nix b/pkgs/tools/networking/urlwatch/default.nix
index e7cbaa73cce1..639bea38f0ac 100644
--- a/pkgs/tools/networking/urlwatch/default.nix
+++ b/pkgs/tools/networking/urlwatch/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   name = "urlwatch-${version}";
-  version = "2.17";
+  version = "2.18";
 
   src = fetchFromGitHub {
     owner  = "thp";
     repo   = "urlwatch";
     rev    = version;
-    sha256 = "1865p3yczgpq8gvgh4cpgbx2ibc1fwycd7pagga9sj8r3q0giqyk";
+    sha256 = "14dmyk95v3kajhn1w2lpil3rjs78y0wxylsxclv6zjxgjcc1xsi3";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/tools/nix/nixos-generators/default.nix b/pkgs/tools/nix/nixos-generators/default.nix
index 4e51b9b46dd3..c1e844946094 100644
--- a/pkgs/tools/nix/nixos-generators/default.nix
+++ b/pkgs/tools/nix/nixos-generators/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "nixos-generators";
-  version = "1.0.0";
+  version = "1.1.0";
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "nixos-generators";
     rev = version;
-    sha256 = "10xncifdfhilxclxyf72h7dcfn8yn1h34qbkvdq9l76ghv5qjniq";
+    sha256 = "04cfhj42c2m7lafir9ksh36n3nhx3x20lhamyk4zc5p3pm1xdbs6";
   };
   nativeBuildInputs = [ makeWrapper ];
   installFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/tools/package-management/home-manager/default.nix b/pkgs/tools/package-management/home-manager/default.nix
index d82664ff903d..e569d5a3de9b 100644
--- a/pkgs/tools/package-management/home-manager/default.nix
+++ b/pkgs/tools/package-management/home-manager/default.nix
@@ -36,7 +36,6 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "A user environment configurator";
     homepage = "https://rycee.gitlab.io/home-manager/";
-    maintainers = with maintainers; [ rycee ];
     platforms = platforms.unix;
     license = licenses.mit;
   };
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 62192485391f..c44c7d4c96dc 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -14,6 +14,8 @@ common =
   , pkgconfig, boehmgc, perlPackages, libsodium, brotli, boost, editline, nlohmann_json
   , autoreconfHook, autoconf-archive, bison, flex, libxml2, libxslt, docbook5, docbook_xsl_ns
   , jq, libarchive, rustc, cargo
+  # Used by tests
+  , gmock
   , busybox-sandbox-shell
   , storeDir
   , stateDir
@@ -39,7 +41,8 @@ common =
 
       nativeBuildInputs =
         [ pkgconfig ]
-        ++ lib.optionals is24 [ autoreconfHook autoconf-archive bison flex libxml2 libxslt docbook5 docbook_xsl_ns jq ];
+        ++ lib.optionals is24 [ autoreconfHook autoconf-archive bison flex libxml2 libxslt
+                                docbook5 docbook_xsl_ns jq gmock ];
 
       buildInputs =
         [ curl openssl sqlite xz bzip2 nlohmann_json
@@ -188,18 +191,18 @@ in rec {
 
   nixUnstable = lib.lowPrio (callPackage common rec {
     name = "nix-2.4${suffix}";
-    suffix = "pre7346_5e7ccdc9";
+    suffix = "pre7534_b92f58f6";
 
     src = fetchFromGitHub {
       owner = "NixOS";
       repo = "nix";
-      rev = "5e7ccdc9e3ddd61dc85e20c898001345bfb497a5";
-      sha256 = "10jg0rq92xbigbbri7harn4b75blqaf6rjgq4hhvlnggf2w9iprg";
+      rev = "b92f58f6d9e44f97002d1722bd77bad939824c1c";
+      sha256 = "1p791961y5v04kpz37g6hm98f1ig7i34inxl9dcj3pbqhf5kicxg";
     };
 
     crates = fetchurl {
-      url = "https://hydra.nixos.org/build/115942497/download/1/nix-vendored-crates-2.4pre20200403_3473b19.tar.xz";
-      sha256 = "a83785553bb4bc5b28220562153e201ec555a00171466ac08b716f0c97aee45a";
+      url = "https://hydra.nixos.org/build/118797694/download/1/nix-vendored-crates-2.4pre7534_b92f58f6.tar.xz";
+      sha256 = "a4c2612bbd81732bbb899bc0c230e07b16f6b6150ffbb19c4907dedbbc2bf9fc";
     };
 
     inherit storeDir stateDir confDir boehmgc;
diff --git a/pkgs/tools/system/syslog-ng/default.nix b/pkgs/tools/system/syslog-ng/default.nix
index ed104f3a9ba1..238c9ac1f689 100644
--- a/pkgs/tools/system/syslog-ng/default.nix
+++ b/pkgs/tools/system/syslog-ng/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "syslog-ng";
-  version = "3.26.1";
+  version = "3.27.1";
 
   src = fetchurl {
     url = "https://github.com/${pname}/${pname}/releases/download/${pname}-${version}/${pname}-${version}.tar.gz";
-    sha256 = "1kb2rdhfw4vcdxpvr7rcpg5ysr14ib43bfqdm3755wjdhqil48ch";
+    sha256 = "1cv1kn4jpqyhlhx8w5v557jyc4b2ly2dgkv1hbb8vzgpjwy66k65";
   };
 
   nativeBuildInputs = [ pkgconfig which ];
diff --git a/pkgs/tools/system/uefitool/variants.nix b/pkgs/tools/system/uefitool/variants.nix
index cced17e6ddd4..470c8a0ca4d5 100644
--- a/pkgs/tools/system/uefitool/variants.nix
+++ b/pkgs/tools/system/uefitool/variants.nix
@@ -3,13 +3,13 @@ let
   common = opts: libsForQt5.callPackage (import ./common.nix opts) {};
 in rec {
   new-engine = common rec {
-    version = "A56";
-    sha256 = "0sxmjkrwcchxg2qmcjsw2vr42s7cdcg2fxkwb8axq2r2z23465gp";
+    version = "A57";
+    sha256 = "0algfdlxfjs582hsqmagbcmw06p8qlh0k5xczfkscs3prdn2vm7n";
     installFiles = [ "UEFITool/UEFITool" "UEFIFind/UEFIFind" "UEFIExtract/UEFIExtract" ];
   };
   old-engine = common rec {
-    version = "0.27.0";
-    sha256 = "1i1p823qld927p4f1wcphqcnivb9mq7fi5xmzibxc3g9zzgnyc2h";
+    version = "0.28.0";
+    sha256 = "1n2hd2dysi5bv2iyq40phh1jxc48gdwzs414vfbxvcharcwapnja";
     installFiles = [ "UEFITool" "UEFIReplace/UEFIReplace" "UEFIPatch/UEFIPatch" ];
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5e92a41ea292..23bd5ffd7718 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -173,6 +173,8 @@ in
 
   colorz = callPackage ../tools/misc/colorz { };
 
+  cpu-x = callPackage ../applications/misc/cpu-x { };
+
   dhallToNix = callPackage ../build-support/dhall-to-nix.nix {
     inherit dhall-nix;
   };
@@ -778,6 +780,8 @@ in
 
   ec2-utils = callPackage ../tools/virtualization/ec2-utils { };
 
+  exoscale-cli = callPackage ../tools/admin/exoscale-cli { };
+
   altermime = callPackage ../tools/networking/altermime {};
 
   alttab = callPackage ../tools/X11/alttab { };
@@ -881,6 +885,8 @@ in
 
   crc32c = callPackage ../development/libraries/crc32c { };
 
+  cudd = callPackage ../development/libraries/cudd { };
+
   cue = callPackage ../development/tools/cue { };
 
   deltachat-electron = callPackage
@@ -1968,6 +1974,8 @@ in
 
   linuxptp = callPackage ../os-specific/linux/linuxptp { };
 
+  lite = callPackage ../applications/editors/lite { };
+
   loadwatch = callPackage ../tools/system/loadwatch { };
 
   loccount = callPackage ../development/tools/misc/loccount { };
@@ -5606,6 +5614,9 @@ in
   openapi-generator-cli = callPackage ../tools/networking/openapi-generator-cli { };
   openapi-generator-cli-unstable = callPackage ../tools/networking/openapi-generator-cli/unstable.nix { };
 
+  openbazaar = callPackage ../applications/networking/openbazaar { };
+  openbazaar-client = callPackage ../applications/networking/openbazaar/client.nix { };
+
   opencc = callPackage ../tools/text/opencc { };
 
   opencl-info = callPackage ../tools/system/opencl-info { };
@@ -7201,6 +7212,8 @@ in
 
   unrtf = callPackage ../tools/text/unrtf { };
 
+  unrpa = with python3Packages; toPythonApplication unrpa;
+
   untex = callPackage ../tools/text/untex { };
 
   untrunc = callPackage ../tools/video/untrunc { };
@@ -19301,6 +19314,8 @@ in
 
   gpg-mdp = callPackage ../applications/misc/gpg-mdp { };
 
+  gspeech = callPackage ../applications/audio/gspeech { };
+
   icesl = callPackage ../applications/misc/icesl { };
 
   keepassx = callPackage ../applications/misc/keepassx { };
@@ -22289,6 +22304,8 @@ in
 
   trayer = callPackage ../applications/window-managers/trayer { };
 
+  tinywm = callPackage ../applications/window-managers/tinywm { };
+
   tree-from-tags = callPackage ../applications/audio/tree-from-tags { };
 
   tdrop = callPackage ../applications/misc/tdrop { };
@@ -25434,6 +25451,8 @@ in
 
   helmfile = callPackage ../applications/networking/cluster/helmfile { };
 
+  helmsman = callPackage ../applications/networking/cluster/helmsman { };
+
   heptio-ark = callPackage ../applications/networking/cluster/heptio-ark { };
 
   hplip = callPackage ../misc/drivers/hplip { };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index aadd51e6294e..071d1612b6c4 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -267,6 +267,8 @@ let
 
     farfadet = callPackage ../development/ocaml-modules/farfadet { };
 
+    fiat-p256 = callPackage ../development/ocaml-modules/fiat-p256 { };
+
     fieldslib_p4 = callPackage ../development/ocaml-modules/fieldslib { };
 
     fileutils = callPackage ../development/ocaml-modules/fileutils { };
@@ -295,10 +297,14 @@ let
       inherit (pkgs) gnuplot;
     };
 
+    hacl_x25519 = callPackage ../development/ocaml-modules/hacl_x25519 { };
+
     herelib = callPackage ../development/ocaml-modules/herelib { };
 
     higlo = callPackage ../development/ocaml-modules/higlo { };
 
+    hkdf = callPackage ../development/ocaml-modules/hkdf { };
+
     hmap = callPackage ../development/ocaml-modules/hmap { };
 
     imagelib = callPackage ../development/ocaml-modules/imagelib { };
@@ -732,8 +738,6 @@ let
 
     ptime = callPackage ../development/ocaml-modules/ptime { };
 
-    re2_p4 = callPackage ../development/ocaml-modules/re2 { };
-
     resource-pooling = callPackage ../development/ocaml-modules/resource-pooling { };
 
     result = callPackage ../development/ocaml-modules/ocaml-result { };
@@ -1168,13 +1172,6 @@ let
       then callPackage ../development/ocaml-modules/janestreet/core.nix {}
       else core_p4;
 
-    re2 =
-      if lib.versionOlder "4.03" ocaml.version
-      then janeStreet.re2
-      else if lib.versionOlder "4.02" ocaml.version
-      then callPackage ../development/ocaml-modules/janestreet/re2.nix {}
-      else re2_p4;
-
     textutils =
       if lib.versionOlder "4.03" ocaml.version
       then janeStreet.textutils
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index b27d41b64942..f405d879c347 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -3114,6 +3114,19 @@ let
     };
   };
 
+  ConfigProperties = buildPerlPackage {
+    pname = "Config-Properties";
+    version = "1.80";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/S/SA/SALVA/Config-Properties-1.80.tar.gz";
+      sha256 = "5d04395be7e14e970a03ea952fb7629ae304d97c031f90cc1c29bd0a6a62fc40";
+    };
+    meta = {
+      description = "Read and write property files";
+      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
   ConfigSimple = buildPerlPackage {
     pname = "Config-Simple";
     version = "4.58";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 4bd65c8944cb..4d08e66c809b 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2935,6 +2935,8 @@ in {
 
   hglib = callPackage ../development/python-modules/hglib {};
 
+  huey = callPackage ../development/python-modules/huey { };
+
   humanize = callPackage ../development/python-modules/humanize { };
 
   humanfriendly = callPackage ../development/python-modules/humanfriendly { };
@@ -3235,6 +3237,9 @@ in {
 
   priority = callPackage ../development/python-modules/priority { };
 
+  privacyidea = callPackage ../development/python-modules/privacyidea { };
+  privacyidea-ldap-proxy = callPackage ../development/python-modules/privacyidea/ldap-proxy.nix { };
+
   prov = callPackage ../development/python-modules/prov { };
 
   pudb = callPackage ../development/python-modules/pudb { };
@@ -3755,6 +3760,8 @@ in {
 
   flask_testing = callPackage ../development/python-modules/flask-testing { };
 
+  flask-versioned = callPackage ../development/python-modules/flask-versioned { };
+
   flask_wtf = callPackage ../development/python-modules/flask-wtf { };
 
   wtforms = callPackage ../development/python-modules/wtforms { };
@@ -4076,6 +4083,8 @@ in {
 
   uncompyle6 = callPackage ../development/python-modules/uncompyle6 { };
 
+  unrpa = callPackage ../development/python-modules/unrpa { };
+
   lsi = callPackage ../development/python-modules/lsi { };
 
   hkdf = callPackage ../development/python-modules/hkdf { };
@@ -5241,6 +5250,8 @@ in {
 
   pyrabbit2 = callPackage ../development/python-modules/pyrabbit2 { };
 
+  pyrad = callPackage ../development/python-modules/pyrad { };
+
   pyrr = callPackage ../development/python-modules/pyrr { };
 
   pysha3 = callPackage ../development/python-modules/pysha3 { };
@@ -5851,6 +5862,8 @@ in {
 
   sqlalchemy-utils = callPackage ../development/python-modules/sqlalchemy-utils { };
 
+  sqlsoup = callPackage ../development/python-modules/sqlsoup { };
+
   staticjinja = callPackage ../development/python-modules/staticjinja { };
 
   statsmodels = callPackage ../development/python-modules/statsmodels { };
@@ -6263,6 +6276,8 @@ in {
 
   smartdc = callPackage ../development/python-modules/smartdc { };
 
+  smpplib = callPackage ../development/python-modules/smpplib { };
+
   socksipy-branch = callPackage ../development/python-modules/socksipy-branch { };
 
   sockjs-tornado = callPackage ../development/python-modules/sockjs-tornado { };