about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/languages-frameworks/agda.section.md64
-rw-r--r--doc/languages-frameworks/dotnet.section.md7
-rw-r--r--maintainers/maintainer-list.nix16
-rw-r--r--nixos/doc/manual/from_md/release-notes/rl-2111.section.xml32
-rw-r--r--nixos/doc/manual/release-notes/rl-2111.section.md5
-rw-r--r--nixos/lib/make-options-doc/default.nix8
-rw-r--r--nixos/lib/make-options-doc/sortXML.py28
-rw-r--r--nixos/modules/services/network-filesystems/samba.nix16
-rw-r--r--nixos/modules/services/security/privacyidea.nix2
-rw-r--r--nixos/modules/virtualisation/libvirtd.nix239
-rw-r--r--nixos/tests/samba.nix3
-rw-r--r--pkgs/applications/blockchains/electrs/default.nix6
-rwxr-xr-xpkgs/applications/blockchains/electrs/update.sh39
-rw-r--r--pkgs/applications/blockchains/wasabiwallet/default.nix5
-rw-r--r--pkgs/applications/networking/flexget/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix92
-rw-r--r--pkgs/applications/version-management/git-and-tools/glitter/default.nix6
-rw-r--r--pkgs/build-support/agda/default.nix5
-rw-r--r--pkgs/build-support/agda/lib.nix5
-rw-r--r--pkgs/build-support/build-dotnet-module/default.nix2
-rw-r--r--pkgs/development/compilers/dotnet/build-dotnet.nix10
-rw-r--r--pkgs/development/compilers/dotnet/combine-packages.nix2
-rw-r--r--pkgs/development/compilers/dotnet/default.nix82
-rw-r--r--pkgs/development/compilers/graalvm/community-edition/default.nix2
-rw-r--r--pkgs/development/compilers/graalvm/community-edition/repository.nix147
-rw-r--r--pkgs/development/libraries/capnproto/default.nix11
-rw-r--r--pkgs/development/ocaml-modules/bistro/default.nix8
-rw-r--r--pkgs/development/ocaml-modules/janestreet/0.14.nix10
-rw-r--r--pkgs/development/ocaml-modules/ppx_deriving_yaml/default.nix29
-rw-r--r--pkgs/development/ocaml-modules/ppxlib/default.nix6
-rw-r--r--pkgs/development/python-modules/aiomusiccast/default.nix4
-rw-r--r--pkgs/development/python-modules/auth0-python/default.nix5
-rw-r--r--pkgs/development/python-modules/azure-mgmt-containerservice/default.nix6
-rw-r--r--pkgs/development/python-modules/cbor2/default.nix22
-rw-r--r--pkgs/development/python-modules/debian/default.nix4
-rw-r--r--pkgs/development/python-modules/deezer-python/default.nix4
-rw-r--r--pkgs/development/python-modules/ecoaliface/default.nix4
-rw-r--r--pkgs/development/python-modules/flufl/bounce.nix4
-rw-r--r--pkgs/development/python-modules/flufl/i18n.nix4
-rw-r--r--pkgs/development/python-modules/flufl/lock.nix4
-rw-r--r--pkgs/development/python-modules/flux-led/default.nix37
-rw-r--r--pkgs/development/python-modules/hatasmota/default.nix4
-rw-r--r--pkgs/development/python-modules/mypy-boto3-s3/default.nix4
-rw-r--r--pkgs/development/python-modules/open-garage/default.nix9
-rw-r--r--pkgs/development/python-modules/privacyidea-ldap-proxy/default.nix (renamed from pkgs/development/python-modules/privacyidea/ldap-proxy.nix)14
-rw-r--r--pkgs/development/python-modules/pychromecast/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-httpserver/default.nix4
-rw-r--r--pkgs/development/python-modules/python-ironicclient/default.nix4
-rw-r--r--pkgs/development/python-modules/pytile/default.nix4
-rw-r--r--pkgs/development/python-modules/qualysclient/default.nix4
-rw-r--r--pkgs/development/python-modules/sendgrid/default.nix6
-rw-r--r--pkgs/development/python-modules/simple-rest-client/default.nix4
-rw-r--r--pkgs/development/python-modules/soco/default.nix4
-rw-r--r--pkgs/development/python-modules/spacy-transformers/default.nix4
-rw-r--r--pkgs/development/python-modules/starkbank-ecdsa/default.nix23
-rw-r--r--pkgs/development/python-modules/teslajsonpy/default.nix7
-rw-r--r--pkgs/development/python-modules/velbus-aio/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/ekam/default.nix67
-rw-r--r--pkgs/development/tools/build-managers/msbuild/default.nix4
-rw-r--r--pkgs/development/tools/continuous-integration/drone-cli/default.nix1
-rw-r--r--pkgs/development/tools/electron/default.nix16
-rw-r--r--pkgs/development/tools/omnisharp-roslyn/default.nix4
-rw-r--r--pkgs/games/osu-lazer/default.nix4
-rw-r--r--pkgs/misc/vscode-extensions/default.nix12
-rw-r--r--pkgs/misc/vscode-extensions/ms-toolsai-jupyter/default.nix42
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.14.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.19.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.4.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.9.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.10.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.14.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.4.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-5.10.nix6
-rw-r--r--pkgs/servers/jellyfin/default.nix6
-rw-r--r--pkgs/servers/mattermost/default.nix17
-rw-r--r--pkgs/servers/monitoring/telegraf/default.nix6
-rw-r--r--pkgs/servers/nosql/eventstore/default.nix4
-rw-r--r--pkgs/servers/prowlarr/default.nix2
-rw-r--r--pkgs/servers/radarr/default.nix2
-rw-r--r--pkgs/shells/hilbish/default.nix14
-rw-r--r--pkgs/tools/X11/opentabletdriver/default.nix13
-rw-r--r--pkgs/tools/backup/discordchatexporter-cli/default.nix2
-rw-r--r--pkgs/tools/graphics/hobbits/default.nix34
-rw-r--r--pkgs/tools/inputmethods/evscript/default.nix12
-rw-r--r--pkgs/tools/misc/steampipe/default.nix40
-rw-r--r--pkgs/tools/misc/synth/default.nix6
-rw-r--r--pkgs/tools/misc/zoxide/default.nix6
-rw-r--r--pkgs/tools/security/kubescape/default.nix6
-rw-r--r--pkgs/tools/text/tidy-viewer/default.nix6
-rw-r--r--pkgs/top-level/agda-packages.nix5
-rw-r--r--pkgs/top-level/aliases.nix1
-rw-r--r--pkgs/top-level/all-packages.nix27
-rw-r--r--pkgs/top-level/ocaml-packages.nix2
-rw-r--r--pkgs/top-level/python-packages.nix2
-rw-r--r--pkgs/top-level/python2-packages.nix2
95 files changed, 1055 insertions, 436 deletions
diff --git a/doc/languages-frameworks/agda.section.md b/doc/languages-frameworks/agda.section.md
index 2b7c35f68d3b..775a7a1a6429 100644
--- a/doc/languages-frameworks/agda.section.md
+++ b/doc/languages-frameworks/agda.section.md
@@ -158,7 +158,23 @@ This can be overridden.
 
 By default, Agda sources are files ending on `.agda`, or literate Agda files ending on `.lagda`, `.lagda.tex`, `.lagda.org`, `.lagda.md`, `.lagda.rst`. The list of recognised Agda source extensions can be extended by setting the `extraExtensions` config variable.
 
-## Adding Agda packages to Nixpkgs {#adding-agda-packages-to-nixpkgs}
+## Maintaining the Agda package set on Nixpkgs {#maintaining-the-agda-package-set-on-nixpkgs}
+
+We are aiming at providing all common Agda libraries as packages on `nixpkgs`,
+and keeping them up to date.
+Contributions and maintenance help is always appreciated,
+but the maintenance effort is typically low since the Agda ecosystem is quite small.
+
+The `nixpkgs` Agda package set tries to take up a role similar to that of [Stackage](https://www.stackage.org/) in the Haskell world.
+It is a curated set of libraries that:
+
+1. Always work together.
+2. Are as up-to-date as possible.
+
+While the Haskell ecosystem is huge, and Stackage is highly automatised,
+the Agda package set is small and can (still) be maintained by hand.
+
+### Adding Agda packages to Nixpkgs {#adding-agda-packages-to-nixpkgs}
 
 To add an Agda package to `nixpkgs`, the derivation should be written to `pkgs/development/libraries/agda/${library-name}/` and an entry should be added to `pkgs/top-level/agda-packages.nix`. Here it is called in a scope with access to all other Agda libraries, so the top line of the `default.nix` can look like:
 
@@ -192,3 +208,49 @@ mkDerivation {
 This library has a file called `.agda-lib`, and so we give an empty string to `libraryFile` as nothing precedes `.agda-lib` in the filename. This file contains `name: IAL-1.3`, and so we let `libraryName =  "IAL-1.3"`. This library does not use an `Everything.agda` file and instead has a Makefile, so there is no need to set `everythingFile` and we set a custom `buildPhase`.
 
 When writing an Agda package it is essential to make sure that no `.agda-lib` file gets added to the store as a single file (for example by using `writeText`). This causes Agda to think that the nix store is a Agda library and it will attempt to write to it whenever it typechecks something. See [https://github.com/agda/agda/issues/4613](https://github.com/agda/agda/issues/4613).
+
+In the pull request adding this library,
+you can test whether it builds correctly by writing in a comment:
+
+```
+@ofborg build agdaPackages.iowa-stdlib
+```
+
+### Maintaining Agda packages
+
+As mentioned before, the aim is to have a compatible, and up-to-date package set.
+These two conditions sometimes exclude each other:
+For example, if we update `agdaPackages.standard-library` because there was an upstream release,
+this will typically break many reverse dependencies,
+i.e. downstream Agda libraries that depend on the standard library.
+In `nixpkgs` we are typically among the first to notice this,
+since we have build tests in place to check this.
+
+In a pull request updating e.g. the standard library, you should write the following comment:
+
+```
+@ofborg build agdaPackages.standard-library.passthru.tests
+```
+
+This will build all reverse dependencies of the standard library,
+for example `agdaPackages.agda-categories`, or `agdaPackages.generic`.
+
+In some cases it is useful to build _all_ Agda packages.
+This can be done with the following Github comment:
+
+```
+@ofborg build agda.passthru.tests.allPackages
+```
+
+Sometimes, the builds of the reverse dependencies fail because they have not yet been updated and released.
+You should drop the maintainers a quick issue notifying them of the breakage,
+citing the build error (which you can get from the ofborg logs).
+If you are motivated, you might even send a pull request that fixes it.
+Usually, the maintainers will answer within a week or two with a new release.
+Bumping the version of that reverse dependency should be a further commit on your PR.
+
+In the rare case that a new release is not to be expected within an acceptable time,
+simply mark the broken package as broken by setting `meta.broken = true;`.
+This will exclude it from the build test.
+It can be added later when it is fixed,
+and does not hinder the advancement of the whole package set in the meantime.
diff --git a/doc/languages-frameworks/dotnet.section.md b/doc/languages-frameworks/dotnet.section.md
index 738d7bad271e..9bf96f3198a1 100644
--- a/doc/languages-frameworks/dotnet.section.md
+++ b/doc/languages-frameworks/dotnet.section.md
@@ -28,8 +28,7 @@ mkShell {
   packages = [
     (with dotnetCorePackages; combinePackages [
       sdk_3_1
-      sdk_3_0
-      sdk_2_1
+      sdk_5_0
     ])
   ];
 }
@@ -64,9 +63,9 @@ $ dotnet --info
 
 The `dotnetCorePackages.sdk_X_Y` is preferred over the old dotnet-sdk as both major and minor version are very important for a dotnet environment. If a given minor version isn't present (or was changed), then this will likely break your ability to build a project.
 
-## dotnetCorePackages.sdk vs dotnetCorePackages.net vs dotnetCorePackages.netcore vs dotnetCorePackages.aspnetcore {#dotnetcorepackages.sdk-vs-dotnetcorepackages.net-vs-dotnetcorepackages.netcore-vs-dotnetcorepackages.aspnetcore}
+## dotnetCorePackages.sdk vs dotnetCorePackages.runtime vs dotnetCorePackages.aspnetcore {#dotnetcorepackages.sdk-vs-dotnetcorepackages.runtime-vs-dotnetcorepackages.aspnetcore}
 
-The `dotnetCorePackages.sdk` contains both a runtime and the full sdk of a given version. The `net`, `netcore` and `aspnetcore` packages are meant to serve as minimal runtimes to deploy alongside already built applications. For runtime versions >= .NET 5 `net` is used while `netcore` is used for older .NET Core runtime version.
+The `dotnetCorePackages.sdk` contains both a runtime and the full sdk of a given version. The `runtime` and `aspnetcore` packages are meant to serve as minimal runtimes to deploy alongside already built applications.
 
 ## Packaging a Dotnet Application {#packaging-a-dotnet-application}
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index e75ec5686580..a3724a3b4211 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -4094,6 +4094,12 @@
     githubId = 16470252;
     name = "Gemini Lasswell";
   };
+  gbtb = {
+    email = "goodbetterthebeast3@gmail.com";
+    github = "gbtb";
+    githubId = 37017396;
+    name = "gbtb";
+  };
   gebner = {
     email = "gebner@gebner.org";
     github = "gebner";
@@ -4421,6 +4427,16 @@
     githubId = 54728477;
     name = "Happy River";
   };
+  hardselius = {
+    email = "martin@hardselius.dev";
+    github = "hardselius";
+    githubId = 1422583;
+    name = "Martin Hardselius";
+    keys = [{
+      longkeyid = "rsa4096/0x03A6E6F786936619";
+      fingerprint = "3F35 E4CA CBF4 2DE1 2E90  53E5 03A6 E6F7 8693 6619";
+    }];
+  };
   haslersn = {
     email = "haslersn@fius.informatik.uni-stuttgart.de";
     github = "haslersn";
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
index d3046b88bfec..f3a5db5fb1c8 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@@ -1563,6 +1563,38 @@ Superuser created successfully.
           when they are socket-activated.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The <literal>virtualisation.libvirtd</literal> module has been
+          refactored and updated with new options:
+        </para>
+        <itemizedlist spacing="compact">
+          <listitem>
+            <para>
+              <literal>virtualisation.libvirtd.qemu*</literal> options
+              (e.g.:
+              <literal>virtualisation.libvirtd.qemuRunAsRoot</literal>)
+              were moved to
+              <link xlink:href="options.html#opt-virtualisation.libvirtd.qemu"><literal>virtualisation.libvirtd.qemu</literal></link>
+              submodule,
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              software TPM1/TPM2 support (e.g.: Windows 11 guests)
+              (<link xlink:href="options.html#opt-virtualisation.libvirtd.qemu.swtpm"><literal>virtualisation.libvirtd.qemu.swtpm</literal></link>),
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              custom OVMF package (e.g.:
+              <literal>pkgs.OVMFFull</literal> with HTTP, CSM and Secure
+              Boot support)
+              (<link xlink:href="options.html#opt-virtualisation.libvirtd.qemu.ovmf.package"><literal>virtualisation.libvirtd.qemu.ovmf.package</literal></link>).
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
     </itemizedlist>
   </section>
 </section>
diff --git a/nixos/doc/manual/release-notes/rl-2111.section.md b/nixos/doc/manual/release-notes/rl-2111.section.md
index e84ca7ed8cc9..c1958b3a6bd4 100644
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@@ -451,3 +451,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 - `networking.sits` now supports Foo-over-UDP encapsulation.
 
 - Changing systemd `.socket` units now restarts them and stops the service that is activated by them. Additionally, services with `stopOnChange = false` don't break anymore when they are socket-activated.
+
+-  The `virtualisation.libvirtd` module has been refactored and updated with new options:
+    - `virtualisation.libvirtd.qemu*` options (e.g.: `virtualisation.libvirtd.qemuRunAsRoot`) were moved to [`virtualisation.libvirtd.qemu`](options.html#opt-virtualisation.libvirtd.qemu) submodule,
+    - software TPM1/TPM2 support (e.g.: Windows 11 guests) ([`virtualisation.libvirtd.qemu.swtpm`](options.html#opt-virtualisation.libvirtd.qemu.swtpm)),
+    - custom OVMF package (e.g.: `pkgs.OVMFFull` with HTTP, CSM and Secure Boot support) ([`virtualisation.libvirtd.qemu.ovmf.package`](options.html#opt-virtualisation.libvirtd.qemu.ovmf.package)).
diff --git a/nixos/lib/make-options-doc/default.nix b/nixos/lib/make-options-doc/default.nix
index 14015ab64abb..e058e70f3888 100644
--- a/nixos/lib/make-options-doc/default.nix
+++ b/nixos/lib/make-options-doc/default.nix
@@ -83,10 +83,13 @@ let
   optionsListVisible = lib.filter (opt: opt.visible && !opt.internal) (lib.optionAttrSetToDocList options);
 
   # Customly sort option list for the man page.
+  # Always ensure that the sort order matches sortXML.py!
   optionsList = lib.sort optionLess optionsListDesc;
 
   # Convert the list of options into an XML file.
-  optionsXML = builtins.toFile "options.xml" (builtins.toXML optionsList);
+  # This file is *not* sorted sorted to save on eval time, since the docbook XML
+  # and the manpage depend on it and thus we evaluate this on every system rebuild.
+  optionsXML = builtins.toFile "options.xml" (builtins.toXML optionsListDesc);
 
   optionsNix = builtins.listToAttrs (map (o: { name = o.name; value = removeAttrs o ["name" "visible" "internal"]; }) optionsList);
 
@@ -185,9 +188,10 @@ in {
       exit 1
     fi
 
+    ${pkgs.python3Minimal}/bin/python ${./sortXML.py} $optionsXML sorted.xml
     ${pkgs.libxslt.bin}/bin/xsltproc \
       --stringparam revision '${revision}' \
-      -o intermediate.xml ${./options-to-docbook.xsl} $optionsXML
+      -o intermediate.xml ${./options-to-docbook.xsl} sorted.xml
     ${pkgs.libxslt.bin}/bin/xsltproc \
       -o "$out" ${./postprocess-option-descriptions.xsl} intermediate.xml
   '';
diff --git a/nixos/lib/make-options-doc/sortXML.py b/nixos/lib/make-options-doc/sortXML.py
new file mode 100644
index 000000000000..717820788c94
--- /dev/null
+++ b/nixos/lib/make-options-doc/sortXML.py
@@ -0,0 +1,28 @@
+import xml.etree.ElementTree as ET
+import sys
+
+tree = ET.parse(sys.argv[1])
+# the xml tree is of the form
+# <expr><list> {all options, each an attrs} </list></expr>
+options = list(tree.getroot().find('list'))
+
+def sortKey(opt):
+    def order(s):
+        if s.startswith("enable"):
+            return 0
+        if s.startswith("package"):
+            return 1
+        return 2
+
+    return [
+        (order(p.attrib['value']), p.attrib['value'])
+        for p in opt.findall('attr[@name="loc"]/list/string')
+    ]
+
+# always ensure that the sort order matches the order used in the nix expression!
+options.sort(key=sortKey)
+
+doc = ET.Element("expr")
+newOptions = ET.SubElement(doc, "list")
+newOptions.extend(options)
+ET.ElementTree(doc).write(sys.argv[2], encoding='utf-8')
diff --git a/nixos/modules/services/network-filesystems/samba.nix b/nixos/modules/services/network-filesystems/samba.nix
index 3fedaeb49529..9ed755d0465c 100644
--- a/nixos/modules/services/network-filesystems/samba.nix
+++ b/nixos/modules/services/network-filesystems/samba.nix
@@ -87,13 +87,20 @@ in
           <note>
             <para>If you use the firewall consider adding the following:</para>
           <programlisting>
-            networking.firewall.allowedTCPPorts = [ 139 445 ];
-            networking.firewall.allowedUDPPorts = [ 137 138 ];
+            services.samba.openFirewall = true;
           </programlisting>
           </note>
         '';
       };
 
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to automatically open the necessary ports in the firewall.
+        '';
+      };
+
       enableNmbd = mkOption {
         type = types.bool;
         default = true;
@@ -235,7 +242,10 @@ in
         };
 
         security.pam.services.samba = {};
-        environment.systemPackages = [ config.services.samba.package ];
+        environment.systemPackages = [ cfg.package ];
+
+        networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ 139 445 ];
+        networking.firewall.allowedUDPPorts = mkIf cfg.openFirewall [ 137 138 ];
       })
     ];
 
diff --git a/nixos/modules/services/security/privacyidea.nix b/nixos/modules/services/security/privacyidea.nix
index e78c4383e4ba..05f4995cc416 100644
--- a/nixos/modules/services/security/privacyidea.nix
+++ b/nixos/modules/services/security/privacyidea.nix
@@ -272,7 +272,7 @@ in
     (mkIf cfg.ldap-proxy.enable {
 
       systemd.services.privacyidea-ldap-proxy = let
-        ldap-proxy-env = pkgs.python2.withPackages (ps: [ ps.privacyidea-ldap-proxy ]);
+        ldap-proxy-env = pkgs.python3.withPackages (ps: [ ps.privacyidea-ldap-proxy ]);
       in {
         description = "privacyIDEA LDAP proxy";
         wantedBy = [ "multi-user.target" ];
diff --git a/nixos/modules/virtualisation/libvirtd.nix b/nixos/modules/virtualisation/libvirtd.nix
index aef04a510ab1..121e7286bc13 100644
--- a/nixos/modules/virtualisation/libvirtd.nix
+++ b/nixos/modules/virtualisation/libvirtd.nix
@@ -13,23 +13,140 @@ let
   '';
   ovmfFilePrefix = if pkgs.stdenv.isAarch64 then "AAVMF" else "OVMF";
   qemuConfigFile = pkgs.writeText "qemu.conf" ''
-    ${optionalString cfg.qemuOvmf ''
+    ${optionalString cfg.qemu.ovmf.enable ''
       nvram = [ "/run/libvirt/nix-ovmf/${ovmfFilePrefix}_CODE.fd:/run/libvirt/nix-ovmf/${ovmfFilePrefix}_VARS.fd" ]
     ''}
-    ${optionalString (!cfg.qemuRunAsRoot) ''
+    ${optionalString (!cfg.qemu.runAsRoot) ''
       user = "qemu-libvirtd"
       group = "qemu-libvirtd"
     ''}
-    ${cfg.qemuVerbatimConfig}
+    ${cfg.qemu.verbatimConfig}
   '';
   dirName = "libvirt";
   subDirs = list: [ dirName ] ++ map (e: "${dirName}/${e}") list;
 
-in {
+  ovmfModule = types.submodule {
+    options = {
+      enable = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Allows libvirtd to take advantage of OVMF when creating new
+          QEMU VMs with UEFI boot.
+        '';
+      };
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.OVMF;
+        defaultText = literalExpression "pkgs.OVMF";
+        example = literalExpression "pkgs.OVMFFull";
+        description = ''
+          OVMF package to use.
+        '';
+      };
+    };
+  };
+
+  swtpmModule = types.submodule {
+    options = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Allows libvirtd to use swtpm to create an emulated TPM.
+        '';
+      };
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.swtpm;
+        defaultText = literalExpression "pkgs.swtpm";
+        description = ''
+          swtpm package to use.
+        '';
+      };
+    };
+  };
+
+  qemuModule = types.submodule {
+    options = {
+      package = mkOption {
+        type = types.package;
+        default = pkgs.qemu;
+        defaultText = literalExpression "pkgs.qemu";
+        description = ''
+          Qemu package to use with libvirt.
+          `pkgs.qemu` can emulate alien architectures (e.g. aarch64 on x86)
+          `pkgs.qemu_kvm` saves disk space allowing to emulate only host architectures.
+        '';
+      };
+
+      runAsRoot = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          If true,  libvirtd runs qemu as root.
+          If false, libvirtd runs qemu as unprivileged user qemu-libvirtd.
+          Changing this option to false may cause file permission issues
+          for existing guests. To fix these, manually change ownership
+          of affected files in /var/lib/libvirt/qemu to qemu-libvirtd.
+        '';
+      };
+
+      verbatimConfig = mkOption {
+        type = types.lines;
+        default = ''
+          namespaces = []
+        '';
+        description = ''
+          Contents written to the qemu configuration file, qemu.conf.
+          Make sure to include a proper namespace configuration when
+          supplying custom configuration.
+        '';
+      };
+
+      ovmf = mkOption {
+        type = ovmfModule;
+        default = { };
+        description = ''
+          QEMU's OVMF options.
+        '';
+      };
+
+      swtpm = mkOption {
+        type = swtpmModule;
+        default = { };
+        description = ''
+          QEMU's swtpm options.
+        '';
+      };
+    };
+  };
+in
+{
 
   imports = [
     (mkRemovedOptionModule [ "virtualisation" "libvirtd" "enableKVM" ]
-      "Set the option `virtualisation.libvirtd.qemuPackage' instead.")
+      "Set the option `virtualisation.libvirtd.qemu.package' instead.")
+    (mkRenamedOptionModule
+      [ "virtualisation" "libvirtd" "qemuPackage" ]
+      [ "virtualisation" "libvirtd" "qemu" "package" ])
+    (mkRenamedOptionModule
+      [ "virtualisation" "libvirtd" "qemuRunAsRoot" ]
+      [ "virtualisation" "libvirtd" "qemu" "runAsRoot" ])
+    (mkRenamedOptionModule
+      [ "virtualisation" "libvirtd" "qemuVerbatimConfig" ]
+      [ "virtualisation" "libvirtd" "qemu" "verbatimConfig" ])
+    (mkRenamedOptionModule
+      [ "virtualisation" "libvirtd" "qemuOvmf" ]
+      [ "virtualisation" "libvirtd" "qemu" "ovmf" "enable" ])
+    (mkRenamedOptionModule
+      [ "virtualisation" "libvirtd" "qemuOvmfPackage" ]
+      [ "virtualisation" "libvirtd" "qemu" "ovmf" "package" ])
+    (mkRenamedOptionModule
+      [ "virtualisation" "libvirtd" "qemuSwtpm" ]
+      [ "virtualisation" "libvirtd" "qemu" "swtpm" "enable" ])
   ];
 
   ###### interface
@@ -56,17 +173,6 @@ in {
       '';
     };
 
-    qemuPackage = mkOption {
-      type = types.package;
-      default = pkgs.qemu;
-      defaultText = literalExpression "pkgs.qemu";
-      description = ''
-        Qemu package to use with libvirt.
-        `pkgs.qemu` can emulate alien architectures (e.g. aarch64 on x86)
-        `pkgs.qemu_kvm` saves disk space allowing to emulate only host architectures.
-      '';
-    };
-
     extraConfig = mkOption {
       type = types.lines;
       default = "";
@@ -76,56 +182,6 @@ in {
       '';
     };
 
-    qemuRunAsRoot = mkOption {
-      type = types.bool;
-      default = true;
-      description = ''
-        If true,  libvirtd runs qemu as root.
-        If false, libvirtd runs qemu as unprivileged user qemu-libvirtd.
-        Changing this option to false may cause file permission issues
-        for existing guests. To fix these, manually change ownership
-        of affected files in /var/lib/libvirt/qemu to qemu-libvirtd.
-      '';
-    };
-
-    qemuVerbatimConfig = mkOption {
-      type = types.lines;
-      default = ''
-        namespaces = []
-      '';
-      description = ''
-        Contents written to the qemu configuration file, qemu.conf.
-        Make sure to include a proper namespace configuration when
-        supplying custom configuration.
-      '';
-    };
-
-    qemuOvmf = mkOption {
-      type = types.bool;
-      default = true;
-      description = ''
-        Allows libvirtd to take advantage of OVMF when creating new
-        QEMU VMs with UEFI boot.
-      '';
-    };
-
-    qemuOvmfPackage = mkOption {
-      type = types.package;
-      default = pkgs.OVMF;
-      defaultText = literalExpression "pkgs.OVMF";
-      example = literalExpression "pkgs.OVMFFull";
-      description = ''
-        OVMF package to use.
-      '';
-    };
-    qemuSwtpm = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-        Allows libvirtd to use swtpm to create an emulated TPM.
-      '';
-    };
-
     extraOptions = mkOption {
       type = types.listOf types.str;
       default = [ ];
@@ -136,7 +192,7 @@ in {
     };
 
     onBoot = mkOption {
-      type = types.enum ["start" "ignore" ];
+      type = types.enum [ "start" "ignore" ];
       default = "start";
       description = ''
         Specifies the action to be done to / on the guests when the host boots.
@@ -148,7 +204,7 @@ in {
     };
 
     onShutdown = mkOption {
-      type = types.enum ["shutdown" "suspend" ];
+      type = types.enum [ "shutdown" "suspend" ];
       default = "suspend";
       description = ''
         When shutting down / restarting the host what method should
@@ -166,6 +222,13 @@ in {
       '';
     };
 
+    qemu = mkOption {
+      type = qemuModule;
+      default = { };
+      description = ''
+        QEMU related options.
+      '';
+    };
   };
 
 
@@ -179,16 +242,18 @@ in {
         message = "The libvirtd module currently requires Polkit to be enabled ('security.polkit.enable = true').";
       }
       {
-        assertion = builtins.elem "fd" cfg.qemuOvmfPackage.outputs;
+        assertion = builtins.elem "fd" cfg.qemu.ovmf.package.outputs;
         message = "The option 'virtualisation.libvirtd.qemuOvmfPackage' needs a package that has an 'fd' output.";
       }
     ];
 
     environment = {
       # this file is expected in /etc/qemu and not sysconfdir (/var/lib)
-      etc."qemu/bridge.conf".text = lib.concatMapStringsSep "\n" (e:
-        "allow ${e}") cfg.allowedBridges;
-      systemPackages = with pkgs; [ libressl.nc iptables cfg.package cfg.qemuPackage ];
+      etc."qemu/bridge.conf".text = lib.concatMapStringsSep "\n"
+        (e:
+          "allow ${e}")
+        cfg.allowedBridges;
+      systemPackages = with pkgs; [ libressl.nc iptables cfg.package cfg.qemu.package ];
       etc.ethertypes.source = "${pkgs.ebtables}/etc/ethertypes";
     };
 
@@ -230,17 +295,17 @@ in {
         cp -f ${qemuConfigFile} /var/lib/${dirName}/qemu.conf
 
         # stable (not GC'able as in /nix/store) paths for using in <emulator> section of xml configs
-        for emulator in ${cfg.package}/libexec/libvirt_lxc ${cfg.qemuPackage}/bin/qemu-kvm ${cfg.qemuPackage}/bin/qemu-system-*; do
+        for emulator in ${cfg.package}/libexec/libvirt_lxc ${cfg.qemu.package}/bin/qemu-kvm ${cfg.qemu.package}/bin/qemu-system-*; do
           ln -s --force "$emulator" /run/${dirName}/nix-emulators/
         done
 
         for helper in libexec/qemu-bridge-helper bin/qemu-pr-helper; do
-          ln -s --force ${cfg.qemuPackage}/$helper /run/${dirName}/nix-helpers/
+          ln -s --force ${cfg.qemu.package}/$helper /run/${dirName}/nix-helpers/
         done
 
-        ${optionalString cfg.qemuOvmf ''
-          ln -s --force ${cfg.qemuOvmfPackage.fd}/FV/${ovmfFilePrefix}_CODE.fd /run/${dirName}/nix-ovmf/
-          ln -s --force ${cfg.qemuOvmfPackage.fd}/FV/${ovmfFilePrefix}_VARS.fd /run/${dirName}/nix-ovmf/
+        ${optionalString cfg.qemu.ovmf.enable ''
+          ln -s --force ${cfg.qemu.ovmf.package.fd}/FV/${ovmfFilePrefix}_CODE.fd /run/${dirName}/nix-ovmf/
+          ln -s --force ${cfg.qemu.ovmf.package.fd}/FV/${ovmfFilePrefix}_VARS.fd /run/${dirName}/nix-ovmf/
         ''}
       '';
 
@@ -256,16 +321,20 @@ in {
     systemd.services.libvirtd = {
       requires = [ "libvirtd-config.service" ];
       after = [ "libvirtd-config.service" ]
-              ++ optional vswitch.enable "ovs-vswitchd.service";
+        ++ optional vswitch.enable "ovs-vswitchd.service";
 
       environment.LIBVIRTD_ARGS = escapeShellArgs (
-        [ "--config" configFile
-          "--timeout" "120"     # from ${libvirt}/var/lib/sysconfig/libvirtd
-        ] ++ cfg.extraOptions);
-
-      path = [ cfg.qemuPackage ] # libvirtd requires qemu-img to manage disk images
-             ++ optional vswitch.enable vswitch.package
-             ++ optional cfg.qemuSwtpm pkgs.swtpm;
+        [
+          "--config"
+          configFile
+          "--timeout"
+          "120" # from ${libvirt}/var/lib/sysconfig/libvirtd
+        ] ++ cfg.extraOptions
+      );
+
+      path = [ cfg.qemu.package ] # libvirtd requires qemu-img to manage disk images
+        ++ optional vswitch.enable vswitch.package
+        ++ optional cfg.qemu.swtpm.enable cfg.qemu.swtpm.package;
 
       serviceConfig = {
         Type = "notify";
diff --git a/nixos/tests/samba.nix b/nixos/tests/samba.nix
index d1d50caabfa5..252c3dd9c76e 100644
--- a/nixos/tests/samba.nix
+++ b/nixos/tests/samba.nix
@@ -20,6 +20,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
       server =
         { ... }:
         { services.samba.enable = true;
+          services.samba.openFirewall = true;
           services.samba.shares.public =
             { path = "/public";
               "read only" = true;
@@ -27,8 +28,6 @@ import ./make-test-python.nix ({ pkgs, ... }:
               "guest ok" = "yes";
               comment = "Public samba share.";
             };
-          networking.firewall.allowedTCPPorts = [ 139 445 ];
-          networking.firewall.allowedUDPPorts = [ 137 138 ];
         };
     };
 
diff --git a/pkgs/applications/blockchains/electrs/default.nix b/pkgs/applications/blockchains/electrs/default.nix
index ae06fe7ff2ba..d37ace710734 100644
--- a/pkgs/applications/blockchains/electrs/default.nix
+++ b/pkgs/applications/blockchains/electrs/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "electrs";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "romanz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "04dqbn2nfzllxfcn3v9vkfy2hn2syihijr575621r1pj65pcgf8y";
+    hash = "sha256-GDO8iGntQncvdJiDMBJk9GrGF9JToasbLRzju3S0TS0=";
   };
 
-  cargoSha256 = "0hl8q62lankrab8gq9vxmkn68drs0hw5pk0q6aiq8fxsb63dzsw0";
+  cargoHash = "sha256-Ms785+3Z4xEUW8FRRu1FIHk7HSWYLBThKlJDFjW6j0I=";
 
   # needed for librocksdb-sys
   nativeBuildInputs = [ llvmPackages.clang ];
diff --git a/pkgs/applications/blockchains/electrs/update.sh b/pkgs/applications/blockchains/electrs/update.sh
new file mode 100755
index 000000000000..3e4d90db59de
--- /dev/null
+++ b/pkgs/applications/blockchains/electrs/update.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p coreutils curl jq git gnupg common-updater-scripts
+set -euo pipefail
+
+# Fetch latest release, GPG-verify the tag, update derivation
+
+scriptDir=$(cd "${BASH_SOURCE[0]%/*}" && pwd)
+nixpkgs=$(realpath "$scriptDir"/../../../..)
+
+oldVersion=$(nix-instantiate --eval -E "(import \"$nixpkgs\" { config = {}; overlays = []; }).electrs.version" | tr -d '"')
+version=$(curl -s --show-error "https://api.github.com/repos/romanz/electrs/releases/latest" | jq -r '.tag_name' | tail -c +2)
+
+if [[ $version == $oldVersion ]]; then
+  echo "Already at latest version $version"
+  exit 0
+fi
+echo "New version: $version"
+
+tmpdir=$(mktemp -d /tmp/electrs-verify-gpg.XXX)
+repo=$tmpdir/repo
+trap "rm -rf $tmpdir" EXIT
+
+git clone --depth 1 --branch v${version} -c advice.detachedHead=false https://github.com/romanz/electrs $repo
+
+export GNUPGHOME=$tmpdir
+echo
+echo "Fetching romanz's key"
+gpg --keyserver hkps://keys.openpgp.org --recv-keys 15c8c3574ae4f1e25f3f35c587cae5fa46917cbb 2> /dev/null
+echo
+echo "Verifying commit"
+git -C $repo verify-tag v${version}
+
+rm -rf $repo/.git
+hash=$(nix hash path $repo)
+
+(cd "$nixpkgs" && update-source-version electrs "$version" "$hash")
+sed -i 's|cargoHash = .*|cargoHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";|' "$scriptDir/default.nix"
+echo
+echo "electrs: $oldVersion -> $version"
diff --git a/pkgs/applications/blockchains/wasabiwallet/default.nix b/pkgs/applications/blockchains/wasabiwallet/default.nix
index 2fe128f1d294..0b90fc10bbc1 100644
--- a/pkgs/applications/blockchains/wasabiwallet/default.nix
+++ b/pkgs/applications/blockchains/wasabiwallet/default.nix
@@ -2,7 +2,7 @@
 , fetchurl
 , makeDesktopItem
 , curl
-, dotnet-netcore
+, dotnetCorePackages
 , fontconfig
 , krb5
 , openssl
@@ -11,9 +11,10 @@
 }:
 
 let
+  dotnet-runtime = dotnetCorePackages.runtime_5_0;
   libPath = lib.makeLibraryPath [
     curl
-    dotnet-netcore
+    dotnet-runtime
     fontconfig.lib
     krb5
     openssl
diff --git a/pkgs/applications/networking/flexget/default.nix b/pkgs/applications/networking/flexget/default.nix
index e9c85450f409..96ed5a86a169 100644
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@@ -2,14 +2,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.1.139";
+  version = "3.1.140";
 
   # Fetch from GitHub in order to use `requirements.in`
   src = fetchFromGitHub {
     owner = "flexget";
     repo = "flexget";
     rev = "v${version}";
-    sha256 = "0gnj89q5mv5qiy6zsp85sswmwzm0y73nffjj3vrccx5lmxd955nv";
+    sha256 = "15ngmpqqx902l7gxg2lb6h8q8vmjk247jbqhc92l1apr1imjqcc5";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix b/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix
new file mode 100644
index 000000000000..0c62fc60d299
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix
@@ -0,0 +1,92 @@
+{ lib, stdenv, pkgs, fetchurl }:
+let
+  libPathNative = { packages }: lib.makeLibraryPath packages;
+in
+stdenv.mkDerivation rec {
+  pname = "rocketchat-desktop";
+  version = "3.5.7";
+
+  src = fetchurl {
+    url = "https://github.com/RocketChat/Rocket.Chat.Electron/releases/download/${version}/rocketchat_${version}_amd64.deb";
+    sha256 = "1ri8a60fsbqgq83f8wkyfnd59nqk4d0gpz1vanj54769zflpl71s";
+  };
+
+  buildInputs = with pkgs; [
+    gtk3
+    stdenv.cc.cc
+    zlib
+    glib
+    dbus
+    atk
+    pango
+    freetype
+    libgnome-keyring3
+    fontconfig
+    gdk-pixbuf
+    cairo
+    cups
+    expat
+    libgpgerror
+    alsa-lib
+    nspr
+    nss
+    xorg.libXrender
+    xorg.libX11
+    xorg.libXext
+    xorg.libXdamage
+    xorg.libXtst
+    xorg.libXcomposite
+    xorg.libXi
+    xorg.libXfixes
+    xorg.libXrandr
+    xorg.libXcursor
+    xorg.libxkbfile
+    xorg.libXScrnSaver
+    systemd
+    libnotify
+    xorg.libxcb
+    at-spi2-atk
+    at-spi2-core
+    libdbusmenu
+    libdrm
+    mesa
+    xorg.libxshmfence
+    libxkbcommon
+  ];
+
+  dontBuild = true;
+  dontConfigure = true;
+
+  unpackPhase = ''
+    ar p $src data.tar.xz | tar xJ ./opt/ ./usr/
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    mv opt $out
+    mv usr/share $out
+    ln -s $out/opt/Rocket.Chat/rocketchat-desktop $out/bin/rocketchat-desktop
+    runHook postInstall
+  '';
+
+  postFixup =
+    let
+      libpath = libPathNative { packages = buildInputs; };
+    in
+    ''
+      app=$out/opt/Rocket.Chat
+      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        --set-rpath "${libpath}:$app" \
+        $app/rocketchat-desktop
+      sed -i -e "s|Exec=.*$|Exec=$out/bin/rocketchat-desktop|" $out/share/applications/rocketchat-desktop.desktop
+    '';
+
+  meta = with lib; {
+    description = "Official Desktop client for Rocket.Chat";
+    homepage = "https://github.com/RocketChat/Rocket.Chat.Electron";
+    license = licenses.mit;
+    maintainers = with maintainers; [ gbtb ];
+    platforms = platforms.x86_64;
+  };
+}
diff --git a/pkgs/applications/version-management/git-and-tools/glitter/default.nix b/pkgs/applications/version-management/git-and-tools/glitter/default.nix
index 484491bcf788..d256e212ecae 100644
--- a/pkgs/applications/version-management/git-and-tools/glitter/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/glitter/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "glitter";
-  version = "1.4.4";
+  version = "1.4.10";
 
   src = fetchFromGitHub {
     owner = "milo123459";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1hj1md4h4m1g7cx41sjihlr8xq0zhkikci4cp2gbldqcq5x8iws4";
+    sha256 = "sha256-5yv0RZfGLS/cxOxettHQHSPldcq+xa+TNj6dDIAmzOM=";
   };
 
-  cargoSha256 = "sha256-2QgL8iH0FNlUR/863YML3PLad8lRkYjfSmbl49LTfWw=";
+  cargoSha256 = "sha256-xG7aic7NCcltz9YmQ4V40/h3OR8Vt5IgApp4yoDbPuc=";
 
   # tests require it to be in a git repository
   preCheck = ''
diff --git a/pkgs/build-support/agda/default.nix b/pkgs/build-support/agda/default.nix
index 5df02fbd5c17..9fe9aa457987 100644
--- a/pkgs/build-support/agda/default.nix
+++ b/pkgs/build-support/agda/default.nix
@@ -79,7 +79,12 @@ let
           find -not \( -path ${everythingFile} -or -path ${lib.interfaceFile everythingFile} \) -and \( ${concatMapStringsSep " -or " (p: "-name '*.${p}'") (extensions ++ extraExtensions)} \) -exec cp -p --parents -t "$out" {} +
           runHook postInstall
         '';
+
         meta = if meta.broken or false then meta // { hydraPlatforms = lib.platforms.none; } else meta;
+
+        # Retrieve all packages from the finished package set that have the current package as a dependency and build them
+        passthru.tests = with builtins;
+          lib.filterAttrs (name: pkg: self.lib.isUnbrokenAgdaPackage pkg && elem pname (map (pkg: pkg.pname) pkg.buildInputs)) self;
       };
 in
 {
diff --git a/pkgs/build-support/agda/lib.nix b/pkgs/build-support/agda/lib.nix
index 976151a8283c..80a0974192bb 100644
--- a/pkgs/build-support/agda/lib.nix
+++ b/pkgs/build-support/agda/lib.nix
@@ -7,4 +7,9 @@
   * interfaceFile "src/Everything.lagda.tex" == "src/Everything.agdai"
   */
   interfaceFile = agdaFile: lib.head (builtins.match ''(.*\.)l?agda(\.(md|org|rst|tex))?'' agdaFile) + "agdai";
+
+  /* Takes an arbitrary derivation and says whether it is an agda library package
+  *  that is not marked as broken.
+  */
+  isUnbrokenAgdaPackage = pkg: pkg.isAgdaDerivation or false && !pkg.meta.broken;
 }
diff --git a/pkgs/build-support/build-dotnet-module/default.nix b/pkgs/build-support/build-dotnet-module/default.nix
index 0c1a1f686e7e..0161c101e5bf 100644
--- a/pkgs/build-support/build-dotnet-module/default.nix
+++ b/pkgs/build-support/build-dotnet-module/default.nix
@@ -32,7 +32,7 @@
 # The dotnet SDK to use.
 , dotnet-sdk ? dotnetCorePackages.sdk_5_0
 # The dotnet runtime to use.
-, dotnet-runtime ? dotnetCorePackages.net_5_0
+, dotnet-runtime ? dotnetCorePackages.runtime_5_0
 , ... } @ args:
 
 assert projectFile == null -> throw "Defining the `projectFile` attribute is required. This is usually an `.csproj`, or `.sln` file.";
diff --git a/pkgs/development/compilers/dotnet/build-dotnet.nix b/pkgs/development/compilers/dotnet/build-dotnet.nix
index 56880826a19c..38c2fae60347 100644
--- a/pkgs/development/compilers/dotnet/build-dotnet.nix
+++ b/pkgs/development/compilers/dotnet/build-dotnet.nix
@@ -3,7 +3,7 @@
 , sha512
 }:
 
-assert builtins.elem type [ "aspnetcore" "netcore" "sdk"];
+assert builtins.elem type [ "aspnetcore" "runtime" "sdk"];
 { lib, stdenv
 , fetchurl
 , libunwind
@@ -17,7 +17,7 @@ assert builtins.elem type [ "aspnetcore" "netcore" "sdk"];
 let
   pname = if type == "aspnetcore" then
     "aspnetcore-runtime"
-  else if type == "netcore" then
+  else if type == "runtime" then
     "dotnet-runtime"
   else
     "dotnet-sdk";
@@ -30,12 +30,12 @@ let
     "Unsupported system: ${stdenv.hostPlatform.system}");
   urls = {
     aspnetcore = "https://dotnetcli.azureedge.net/dotnet/aspnetcore/Runtime/${version}/${pname}-${version}-${platform}-${suffix}.tar.gz";
-    netcore = "https://dotnetcli.azureedge.net/dotnet/Runtime/${version}/${pname}-${version}-${platform}-${suffix}.tar.gz";
+    runtime = "https://dotnetcli.azureedge.net/dotnet/Runtime/${version}/${pname}-${version}-${platform}-${suffix}.tar.gz";
     sdk = "https://dotnetcli.azureedge.net/dotnet/Sdk/${version}/${pname}-${version}-${platform}-${suffix}.tar.gz";
   };
   descriptions = {
-    aspnetcore = "ASP .NET Core runtime ${version}";
-    netcore = ".NET Core runtime ${version}";
+    aspnetcore = "ASP.NET Core Runtime ${version}";
+    runtime = ".NET Runtime ${version}";
     sdk = ".NET SDK ${version}";
   };
 in stdenv.mkDerivation rec {
diff --git a/pkgs/development/compilers/dotnet/combine-packages.nix b/pkgs/development/compilers/dotnet/combine-packages.nix
index a38d44e37efa..c99af4e62ae5 100644
--- a/pkgs/development/compilers/dotnet/combine-packages.nix
+++ b/pkgs/development/compilers/dotnet/combine-packages.nix
@@ -5,7 +5,7 @@ in
 assert lib.assertMsg ((builtins.length packages) != 0)
     ''You must include at least one package, e.g
       `with dotnetCorePackages; combinePackages [
-          sdk_3_0 aspnetcore_2_1
+          sdk_3_1 aspnetcore_5_0
        ];`'' ;
   buildEnv {
     name = "dotnet-core-combined";
diff --git a/pkgs/development/compilers/dotnet/default.nix b/pkgs/development/compilers/dotnet/default.nix
index 89d7f4c7d922..5b4740c22e51 100644
--- a/pkgs/development/compilers/dotnet/default.nix
+++ b/pkgs/development/compilers/dotnet/default.nix
@@ -1,6 +1,6 @@
 /*
 How to combine packages for use in development:
-dotnetCombined = with dotnetCorePackages; combinePackages [ sdk_3_1 sdk_2_2 sdk_3_0 sdk aspnetcore_2_1 ];
+dotnetCombined = with dotnetCorePackages; combinePackages [ sdk_3_1 sdk_5_0 aspnetcore_5_0 ];
 
 Hashes below are retrived from:
 https://dotnet.microsoft.com/download/dotnet
@@ -9,75 +9,19 @@ https://dotnet.microsoft.com/download/dotnet
 let
   buildDotnet = attrs: callPackage (import ./build-dotnet.nix attrs) {};
   buildAspNetCore = attrs: buildDotnet (attrs // { type = "aspnetcore"; });
-  buildNetCore = attrs: buildDotnet (attrs // { type = "netcore"; });
-  buildNetCoreSdk = attrs: buildDotnet (attrs // { type = "sdk"; });
+  buildNetRuntime = attrs: buildDotnet (attrs // { type = "runtime"; });
+  buildNetSdk = attrs: buildDotnet (attrs // { type = "sdk"; });
 in
 rec {
   combinePackages = attrs: callPackage (import ./combine-packages.nix attrs) {};
 
-  # v2.1.22 (LTS)
+  # EOL
 
-  aspnetcore_2_1 = buildAspNetCore {
-    version = "2.1.22";
-    sha512 = {
-      x86_64-linux = "27v3a69dgnnb4lz5p2dn2qwadb8vpnqwdy6mnnqfp1dl4kgg3izvriz2268if272sy6flcz5lckjlmn0i0i1jci5zypc7x9kykj991l";
-      aarch64-linux = null; # no aarch64 version of this package is available
-      x86_64-darwin = "0xh06jmzx2cfq51hv9l4h72hbfyh3r0wlla217821gi0hlw6xcc0gb3b4xmqcs240fllqnwrnrwz0axi3xi21wacgn3xbcmzpbi6jml";
-    };
-  };
-
-  netcore_2_1 = buildNetCore {
-    version = "2.1.22";
-    sha512 = {
-      x86_64-linux = "0c2b31l59izcxbhz5wzjpjkdl550s5p3aid4vyghq468vyf67pm0npjny50c172b63vw0ikfbps2b2hj16hpifp116gj4b5llmqjhyc";
-      aarch64-linux = "3llai3d2xpgbr7a4ndg9wqfpnb5zb8k07dicc57a6cmniiqyqigyxinhpx2k0l45mbnihjsr5k1rih3r6bwlj241v67iwd2i0dpqd8a";
-      x86_64-darwin = "106mx6a4rwcvq41v54c1yx89156s43n889im9g0q2pvm7054q8b6xm6qrnymzmj5i2i6awyk0z02j5pfiyh35sw9afxb3695ymsb3v8";
-    };
-  };
-
-  sdk_2_1 = buildNetCoreSdk {
-    version = "2.1.810";
-    sha512 = {
-      x86_64-linux = "388nrba5f7z9syq23xh3k45rzy3iys58s32ya7a0q9mwdf1y3haw7yvbq79cn08741hhqdi73mip8jf50f4s64mbr62ay1p76zsrkj5";
-      aarch64-linux = "2vs8bhk63cjrqkm5n164ahc6bdz58aq9vmhaiyy27krp7wlkz4gpiva9153h7mywhk709l1qc7cddj99qsh2ygv6axjfigbhgrzslqi";
-      x86_64-darwin = "3qxlgbd0np0w8wmp98mhp4cqgva4zglqf7k9kzqbwxfwr5s795kap7rs5w0cy7h0bsvj0ygx3d5nzyn9hp3fsswx4jl4mkvillnvjzy";
-    };
-  };
-
-  # v2.2
-
-  sdk_2_2 = throw "Dotnet SDK 2.2 is EOL, please use 3.1";
-
-  # v3.0.2 (Maintenance)
-
-  aspnetcore_3_0 = buildAspNetCore {
-    version = "3.0.3";
-    sha512 = {
-      x86_64-linux = "342v6kxxbxky09d1c392vvr9rm30lf75wccka1bk2h4advlcga5nlgv93g7vrq48bsyxfi5gc36r3b0dlwl1g409g5mlk1042n6d0yq";
-      aarch64-linux = "2xkg4q88q5jw6jdz6cxj8vsjr475nd0fcvifkv1shdm2j9dsjy233hwpxbr140m5n5ggyh6z99238z9j4kp2az977y8y8irz8m8ppvf";
-      x86_64-darwin = "2p04j6p4j93pan71ih13hv57zxalcirh0n3vfjq0cfb80pbhf1f5cgxl24pw6kifh6hhh38rj62c4mr69lxzlqc8sfcfaws8dyz2avm";
-    };
-  };
-
-  netcore_3_0 = buildNetCore {
-    version = "3.0.3";
-    sha512 = {
-      x86_64-linux = "32ykpcw2xx708r2lxcwcbxnmy4sk159rlfjfvkw990qh7n79pm3lm2qwa3zhqcslznmpg18kwxz8qb5fgsa0h49g843xx4kyai0n7rx";
-      aarch64-linux = "1lp8din7d5jv5fkyq1a7m01i1xg9jwpiljvam1kcyzsnwzvi0cb4ji336cfx4lqrn95gvc75gkzi6q8b4fz0h21gvk6z6kmlcr63nyg";
-      x86_64-darwin = "0s20k7xawwd09xhy4xdcxp1rw6jd418ibrvhb509dnj480g48xryda2203g4mpswd24v2kx0n9qzxgbrbq9lvasfglkxi84bbqayp83";
-    };
-  };
-
-  sdk_3_0 = buildNetCoreSdk {
-    version = "3.0.103";
-    sha512 = {
-      x86_64-linux = "2diiplgxs92fkb6ym68b02d79z4qn63x5qlky5lvr757c1zkh0vfpk3khawdg94kdn4qkn6dmyqr0msxqgmiqyhp63cadzqq4vx7b12";
-      aarch64-linux = "32843q2lj7dgciq62g9v1q31vwfjyv5vaxrz712d942mcg5lyzjygwri106bv4naq3a22131ldzwnsifbdn2vq1iz60raqdb7ss9vnf";
-      x86_64-darwin = "3apswk2bhalgi0hm7h2j9p152jvp39h4xilxxzix5j1n36b442l1pwk7lj7019lxafjqkz5y850xkfcp14ks5wcvs33xs2c0aqwxvcn";
-    };
-  };
+  sdk_2_1 = throw "Dotnet SDK 2.1 is EOL, please use 3.1 (LTS) or 5.0 (Current)";
+  sdk_2_2 = throw "Dotnet SDK 2.2 is EOL, please use 3.1 (LTS) or 5.0 (Current)";
+  sdk_3_0 = throw "Dotnet SDK 3.0 is EOL, please use 3.1 (LTS) or 5.0 (Current)";
 
-  # v3.1.1 (LTS)
+  # v3.1 (LTS)
 
   aspnetcore_3_1 = buildAspNetCore {
     version = "3.1.19";
@@ -88,7 +32,7 @@ rec {
     };
   };
 
-  netcore_3_1 = buildNetCore {
+  runtime_3_1 = buildNetRuntime {
     version = "3.1.19";
     sha512 = {
       x86_64-linux = "2cf268cc13bb4739203a18a9160aac58f2088e8ec275b1f7ef2fe2b74bc16edfdfbeb886a74fc9421edbf2899fa9e3ee7ea2734a83b1800b4a9848fb7e10bbbe";
@@ -97,7 +41,7 @@ rec {
     };
   };
 
-  sdk_3_1 = buildNetCoreSdk {
+  sdk_3_1 = buildNetSdk {
     version = "3.1.413";
     sha512 = {
       x86_64-linux = "2a0824f11aba0b79d3f9a36af0395649bc9b4137e61b240a48dccb671df0a5b8c2086054f8e495430b7ed6c344bb3f27ac3dfda5967d863718a6dadeca951a83";
@@ -106,7 +50,7 @@ rec {
     };
   };
 
-  # v5.0.0
+  # v5.0 (Current)
 
   aspnetcore_5_0 = buildAspNetCore {
     version = "5.0.10";
@@ -117,7 +61,7 @@ rec {
     };
   };
 
-  net_5_0 = buildNetCore {
+  runtime_5_0 = buildNetRuntime {
     version = "5.0.10";
     sha512 = {
       x86_64-linux = "421b00d5751381e6bf829dcba8fa0d781f0efd065be492739d60a4bef2b7b362dbec77fa3289e2ee45cab40616f95318fc214699ffe2f33aa15e77c2d163841c";
@@ -126,7 +70,7 @@ rec {
     };
   };
 
-  sdk_5_0 = buildNetCoreSdk {
+  sdk_5_0 = buildNetSdk {
     version = "5.0.401";
     sha512 = {
       x86_64-linux = "a444d44007709ceb68d8f72dec0531e17f85f800efc0007ace4fa66ba27f095066930e6c6defcd2f85cdedea2fec25e163f5da461c1c2b8563e5cd7cb47091e0";
diff --git a/pkgs/development/compilers/graalvm/community-edition/default.nix b/pkgs/development/compilers/graalvm/community-edition/default.nix
index 54cc917a5be0..1aa1fbc11775 100644
--- a/pkgs/development/compilers/graalvm/community-edition/default.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/default.nix
@@ -16,6 +16,6 @@ in {
   graalvm11-ce = mkGraal rec {
     version = "21.2.0";
     javaVersion = "11";
-    platforms = ["x86_64-linux" "x86_64-darwin"];
+    platforms = ["x86_64-linux" "aarch64-linux" "x86_64-darwin"];
   };
 }
diff --git a/pkgs/development/compilers/graalvm/community-edition/repository.nix b/pkgs/development/compilers/graalvm/community-edition/repository.nix
index b532fe8cb5d3..5b3cdf75bc5b 100644
--- a/pkgs/development/compilers/graalvm/community-edition/repository.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/repository.nix
@@ -10,17 +10,26 @@
 , gtkSupport ? true, cairo, glib, gtk3 }:
 
 let
-  platform = if stdenv.isDarwin then "darwin-amd64" else "linux-amd64";
+  platform = {
+    aarch64-linux = "linux-aarch64";
+    x86_64-linux = "linux-amd64";
+    x86_64-darwin = "darwin-amd64";
+  }.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
+
   runtimeDependencies = [ cups ]
     ++ lib.optionals gtkSupport [ cairo glib gtk3 ];
+
   runtimeLibraryPath = lib.makeLibraryPath runtimeDependencies;
+
   javaVersionPlatform = "${javaVersion}-${platform}";
+
   graalvmXXX-ce = stdenv.mkDerivation rec {
     name = "graalvm${javaVersion}-ce";
     srcs = [
       (fetchurl {
         sha256 = {
           "8-linux-amd64" = "01gyxjmfp7wpcyn7x8b184fn0lp3xryfw619bqch120pzvr6z88f";
+          "11-linux-aarch64" = "sha256-u9841eaHH347JHCrm5u3YGZ9RSTuKiDq368TY2otAYw=";
           "11-linux-amd64" = "0w7lhvxm4nggqdcl4xrhdd3y6dqw9jhyca9adjkp508n4lqf1lxv";
           "11-darwin-amd64" = "0dnahicdl0vhrbiml9z9nbb7k75hbsjj8rs246i1lwril12dqb7n";
         }.${javaVersionPlatform};
@@ -29,6 +38,7 @@ let
       (fetchurl {
         sha256 = {
           "8-linux-amd64" = "1jlvrxdlbsmlk3ia43h9m29kmmdn83h6zdlnf8qb7bm38c84nhsc";
+          "11-linux-aarch64" = "sha256-7W5gkhj2kON2ocrGpyH/OL/phOyHkjNDId2CtyUAEWY=";
           "11-linux-amd64" = "1ybd7a6ii6582skr0nkxx7bccsa7gkg0yriql2h1lcz0rfzcdi3g";
           "11-darwin-amd64" = "1jdy845vanmz05zx5b9227gb1msh9wdrz2kf3fx9z54ssd9qgdhm";
         }.${javaVersionPlatform};
@@ -37,6 +47,7 @@ let
       (fetchurl {
         sha256 = {
           "8-linux-amd64" = "18ip0ay06q1pryqs8ja988mvk9vw475c0nfjcznnsd1zp296p6jc";
+          "11-linux-aarch64" = "sha256-i9ysgqbI52PiXofZQ5AnPSzs2TeR8An5CIYzcwhx28o=";
           "11-linux-amd64" = "1jszz97mkqavxzyhx5jxhi43kqjxk9c36j5l5hy3kn8sdfmbplm4";
           "11-darwin-amd64" = "1767ryhv2cn5anlys63ysax1p8ag79bykac1xfrjfan8yv6d8ybl";
         }.${javaVersionPlatform};
@@ -44,20 +55,23 @@ let
       })
       (fetchurl {
         sha256 = {
-          "8-linux-amd64" = "0il15438qnikqsxdsl7fcdg0c8zs3cbm4ry7pys7fxxr1ckd8szq";
-          "11-linux-amd64" = "07759sr8nijvqm8aqn69x9vq7lyppns7a6l6xribv43jvfmwpfkl";
-          "11-darwin-amd64" = "01l3as8dihc7xqy5sdkrpxmpzrqbcvvg84m2s6j1j8y2db1khf2s";
-        }.${javaVersionPlatform};
-        url = "https://github.com/graalvm/graalpython/releases/download/vm-${version}/python-installable-svm-java${javaVersionPlatform}-${version}.jar";
-      })
-      (fetchurl {
-        sha256 = {
           "8-linux-amd64" = "08s36rjy5irg25b7lqx0m4v2wpywin3cqyhdrywhvq14f7zshsd5";
+          "11-linux-aarch64" = "sha256-Lkc/mq1w18+PQ5McvLGyQBSOz/TMSUgwioRZ0Dtyhm4=";
           "11-linux-amd64" = "1ybjaknmbsdg8qzb986x39fq0h7fyiymdcigc7y86swk8dd916hv";
           "11-darwin-amd64" = "02dwlb62kqr4rjjmvkhn2xk9l1p47ahg9xyyfkw7im1jwlqmqnzf";
         }.${javaVersionPlatform};
         url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${version}/wasm-installable-svm-java${javaVersionPlatform}-${version}.jar";
       })
+    ] ++ lib.optionals (platform == "amd64") [
+      # graalpython is not available on aarch64 platforms yet
+      (fetchurl {
+        sha256 = {
+          "8-linux-amd64" = "0il15438qnikqsxdsl7fcdg0c8zs3cbm4ry7pys7fxxr1ckd8szq";
+          "11-linux-amd64" = "07759sr8nijvqm8aqn69x9vq7lyppns7a6l6xribv43jvfmwpfkl";
+          "11-darwin-amd64" = "01l3as8dihc7xqy5sdkrpxmpzrqbcvvg84m2s6j1j8y2db1khf2s";
+        }.${javaVersionPlatform};
+        url = "https://github.com/graalvm/graalpython/releases/download/vm-${version}/python-installable-svm-java${javaVersionPlatform}-${version}.jar";
+      })
     ];
 
     buildInputs = lib.optionals stdenv.isLinux [
@@ -124,10 +138,9 @@ let
          exit 1
       fi
 
-      unpack_jar ''${arr[1]}
-      unpack_jar ''${arr[2]}
-      unpack_jar ''${arr[3]}
-      unpack_jar ''${arr[4]}
+      for jar in "''${arr[@]:1}"; do
+        unpack_jar "$jar"
+      done
     '';
 
     outputs = [ "out" "lib" ];
@@ -145,7 +158,6 @@ let
           ln -s $f ${basepath}/${platform}/$(basename $f)
         done
       '';
-
       copyClibrariesToLib = ''
         # add those libraries to $lib output too, so we can use them with
         # `native-image -H:CLibraryPath=''${graalvm11-ce.lib}/lib ...` and reduce
@@ -173,6 +185,13 @@ let
 
         ${copyClibrariesToLib}
       '';
+      "11-linux-aarch64" = ''
+        ${nativePRNGWorkaround "$out/conf/security/java.security"}
+
+        ${copyClibrariesToOut "$out/lib/svm/clibraries"}
+
+        ${copyClibrariesToLib}
+      '';
       "11-darwin-amd64" = ''
         # create empty $lib/lib to avoid breaking builds
         mkdir -p $lib/lib
@@ -219,53 +238,60 @@ let
 
     doInstallCheck = true;
     installCheckPhase = ''
-        echo ${
-          lib.escapeShellArg ''
-            public class HelloWorld {
-              public static void main(String[] args) {
-                System.out.println("Hello World");
-              }
+      echo ${
+        lib.escapeShellArg ''
+          public class HelloWorld {
+            public static void main(String[] args) {
+              System.out.println("Hello World");
             }
-          ''
-        } > HelloWorld.java
-        $out/bin/javac HelloWorld.java
-
-        # run on JVM with Graal Compiler
-        $out/bin/java -XX:+UnlockExperimentalVMOptions -XX:+EnableJVMCI -XX:+UseJVMCICompiler HelloWorld | fgrep 'Hello World'
-
-        # Ahead-Of-Time compilation
-        $out/bin/native-image -H:-CheckToolchain -H:+ReportExceptionStackTraces --no-server HelloWorld
-        ./helloworld | fgrep 'Hello World'
-
-        ${
-          lib.optionalString stdenv.isLinux ''
-            # Ahead-Of-Time compilation with --static
-            # --static flag doesn't work for darwin
-            $out/bin/native-image --no-server --static HelloWorld
-            ./helloworld | fgrep 'Hello World'
-          ''
-        }
-
-        echo "Testing interpreted languages"
-        $out/bin/graalpython -c 'print(1 + 1)'
-        $out/bin/ruby -e 'puts(1 + 1)'
-
-        echo '1 + 1' | $out/bin/graalpython
-
-        ${
-          lib.optionalString stdenv.isLinux ''
-            # TODO: `irb` on MacOS gives an error saying "Could not find OpenSSL
-            # headers, install via Homebrew or MacPorts or set OPENSSL_PREFIX", even
-            # though `openssl` is in `propagatedBuildInputs`. For more details see:
-            # https://github.com/NixOS/nixpkgs/pull/105815
-            echo '1 + 1' | $out/bin/irb
-          ''
-        }
-
-      ${lib.optionalString (javaVersion == "11" && stdenv.isLinux) ''
-        # Doesn't work on MacOS, we have this error: "Launching JShell execution engine threw: Operation not permitted (Bind failed)"
-        echo '1 + 1' | $out/bin/jshell
-      ''}'';
+          }
+        ''
+      } > HelloWorld.java
+      $out/bin/javac HelloWorld.java
+
+      # run on JVM with Graal Compiler
+      $out/bin/java -XX:+UnlockExperimentalVMOptions -XX:+EnableJVMCI -XX:+UseJVMCICompiler HelloWorld | fgrep 'Hello World'
+
+      # Ahead-Of-Time compilation
+      $out/bin/native-image -H:-CheckToolchain -H:+ReportExceptionStackTraces --no-server HelloWorld
+      ./helloworld | fgrep 'Hello World'
+
+      ${
+        lib.optionalString stdenv.isLinux ''
+          # Ahead-Of-Time compilation with --static
+          # --static flag doesn't work for darwin
+          $out/bin/native-image --no-server --static HelloWorld
+          ./helloworld | fgrep 'Hello World'
+        ''
+      }
+
+      ${
+        lib.optionalString (platform == "amd64") ''
+          echo "Testing interpreted languages"
+          $out/bin/graalpython -c 'print(1 + 1)'
+          $out/bin/ruby -e 'puts(1 + 1)'
+
+          echo '1 + 1' | $out/bin/graalpython
+        ''
+      }
+
+      ${# TODO: `irb` on MacOS gives an error saying "Could not find OpenSSL
+        # headers, install via Homebrew or MacPorts or set OPENSSL_PREFIX", even
+        # though `openssl` is in `propagatedBuildInputs`. For more details see:
+        # https://github.com/NixOS/nixpkgs/pull/105815
+        # TODO: "truffleruby: an internal exception escaped out of the interpreter"
+        # error on linux-aarch64
+        lib.optionalString (platform == "linux-amd64") ''
+          echo '1 + 1' | $out/bin/irb
+        ''
+      }
+
+      ${# TODO: Doesn't work on MacOS, we have this error:
+        # "Launching JShell execution engine threw: Operation not permitted (Bind failed)"
+        lib.optionalString (javaVersion == "11" && stdenv.isLinux) ''
+          echo '1 + 1' | $out/bin/jshell
+        ''
+      }'';
 
     passthru.home = graalvmXXX-ce;
 
@@ -280,6 +306,7 @@ let
         glittershark
         babariviere
         ericdallo
+        thiagokokada
       ];
       platforms = platforms;
     };
diff --git a/pkgs/development/libraries/capnproto/default.nix b/pkgs/development/libraries/capnproto/default.nix
index 713a49dbaa6c..0eaf6eda07a5 100644
--- a/pkgs/development/libraries/capnproto/default.nix
+++ b/pkgs/development/libraries/capnproto/default.nix
@@ -1,12 +1,15 @@
-{ lib, stdenv, fetchurl, capnproto, cmake }:
+{ lib, stdenv, fetchFromGitHub, capnproto, cmake }:
 
 stdenv.mkDerivation rec {
   pname = "capnproto";
   version = "0.9.0";
 
-  src = fetchurl {
-    url = "https://capnproto.org/capnproto-c++-${version}.tar.gz";
-    sha256 = "sha256-soBUp6K/6kK/w5LI0AljDZTXLozoaiOtbxi15yV0Bk8=";
+  # release tarballs are missing some ekam rules
+  src = fetchFromGitHub {
+    owner = "capnproto";
+    repo = "capnproto";
+    rev = "v${version}";
+    sha256 = "038i40apywn8sg95kwld4mg9p9m08izcw5xj7mwkmshycmqw65na";
   };
 
   nativeBuildInputs = [ cmake ]
diff --git a/pkgs/development/ocaml-modules/bistro/default.nix b/pkgs/development/ocaml-modules/bistro/default.nix
index 197a3eaf69dd..c63f3f796ae7 100644
--- a/pkgs/development/ocaml-modules/bistro/default.nix
+++ b/pkgs/development/ocaml-modules/bistro/default.nix
@@ -28,9 +28,15 @@ buildDunePackage rec {
   })
   ];
 
+  # Fix build with ppxlib 0.23
+  postPatch = ''
+    substituteInPlace ppx/ppx_bistro.ml \
+      --replace 'Parser.parse_expression' 'Ocaml_common.Parser.parse_expression'
+  '';
+
   propagatedBuildInputs = [ base64 bos core lwt_react ocamlgraph rresult tyxml ];
 
-  minimumOCamlVersion = "4.08";
+  minimalOCamlVersion = "4.12";
 
   meta = {
     inherit (src.meta) homepage;
diff --git a/pkgs/development/ocaml-modules/janestreet/0.14.nix b/pkgs/development/ocaml-modules/janestreet/0.14.nix
index 8f7262b47760..116349746bf3 100644
--- a/pkgs/development/ocaml-modules/janestreet/0.14.nix
+++ b/pkgs/development/ocaml-modules/janestreet/0.14.nix
@@ -41,7 +41,7 @@ with self;
     version = "0.14.1";
     hash = "1cdkv34m6czhacivpbb2sasj83fgcid6gnqk30ig9i84z8nh2gw2";
     meta.description = "Accessors for Core types, for use with the Accessor library";
-    meta.broken = lib.versionAtLeast ocaml.version "4.12";
+    meta.broken = true; # Not compatible with ppxlib ≥ 0.23
     propagatedBuildInputs = [ accessor_base core_kernel ];
   };
 
@@ -375,9 +375,9 @@ with self;
 
   ppx_accessor = janePackage {
     pname = "ppx_accessor";
-    version = "0.14.2";
+    version = "0.14.3";
     minimumOCamlVersion = "4.09";
-    hash = "01nifsh7gap28cpvff6i569lqr1gmyhrklkisgri538cp4pf1wq1";
+    hash = "sha256:1c8blzh2f34vbm1z3mnvh670c6vda70chw805n2hmkd9j46l0cll";
     meta.description = "[@@deriving] plugin to generate accessors for use with the Accessor libraries";
     propagatedBuildInputs = [ accessor ];
   };
@@ -633,9 +633,9 @@ with self;
 
   ppx_variants_conv = janePackage {
     pname = "ppx_variants_conv";
-    version = "0.14.1";
+    version = "0.14.2";
     minimumOCamlVersion = "4.04.2";
-    hash = "0q6a43zrwqzdz7aja0k44a2llyjjj5xzi2kigwhsnww3g0r5ig84";
+    hash = "1p11fiz4m160hs0xzg4g9rxchp053sz3s3d1lyciqixad1xi47a4";
     meta.description = "Generation of accessor and iteration functions for ocaml variant types";
     propagatedBuildInputs = [ variantslib ppxlib ];
   };
diff --git a/pkgs/development/ocaml-modules/ppx_deriving_yaml/default.nix b/pkgs/development/ocaml-modules/ppx_deriving_yaml/default.nix
new file mode 100644
index 000000000000..0dfd8edd5736
--- /dev/null
+++ b/pkgs/development/ocaml-modules/ppx_deriving_yaml/default.nix
@@ -0,0 +1,29 @@
+{ lib, buildDunePackage, fetchurl, ppxlib, alcotest
+, ppx_deriving, yaml
+}:
+
+buildDunePackage rec {
+  pname = "ppx_deriving_yaml";
+  version = "0.1.0";
+
+  useDune2 = true;
+
+  minimalOCamlVersion = "4.08";
+
+  src = fetchurl {
+    url = "https://github.com/patricoferris/ppx_deriving_yaml/releases/download/v${version}/ppx_deriving_yaml-v${version}.tbz";
+    sha256 = "kdonUD4Y8QhVSAFAafIpXBFPkS4pSScYwJbaWMn/6pA=";
+  };
+
+  propagatedBuildInputs = [ ppxlib ppx_deriving yaml ];
+
+  doCheck = true;
+  checkInputs = [ alcotest ];
+
+  meta = {
+    description = "A YAML codec generator for OCaml";
+    homepage = "https://github.com/patricoferris/ppx_deriving_yaml";
+    license = lib.licenses.isc;
+    maintainers = [ ];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/ppxlib/default.nix b/pkgs/development/ocaml-modules/ppxlib/default.nix
index c4591927e075..faae96764bc5 100644
--- a/pkgs/development/ocaml-modules/ppxlib/default.nix
+++ b/pkgs/development/ocaml-modules/ppxlib/default.nix
@@ -2,7 +2,7 @@
 , version ?
   if lib.versionAtLeast ocaml.version "4.07"
   then if lib.versionAtLeast ocaml.version "4.08"
-  then "0.22.2" else "0.15.0" else "0.13.0"
+  then "0.23.0" else "0.15.0" else "0.13.0"
 , ocaml-compiler-libs, ocaml-migrate-parsetree, ppx_derivers, stdio
 , stdlib-shims, ocaml-migrate-parsetree-2
 }:
@@ -38,6 +38,10 @@ let param = {
     sha256 = "0fysjqcpv281n52wl3h0dy2lzf9d61wdzk90ldv3p63a4i3mr1j2";
     min_version = "4.07";
   };
+  "0.23.0" = {
+    sha256 = "0jg5v4pssbl66hn5davpin1i57a0r3r54l96vpz5y99xk5w70xi1";
+    min_version = "4.07";
+  };
 }."${version}"; in
 
 if param ? max_version && lib.versionAtLeast ocaml.version param.max_version
diff --git a/pkgs/development/python-modules/aiomusiccast/default.nix b/pkgs/development/python-modules/aiomusiccast/default.nix
index d64f936ef1d6..55b5d4215135 100644
--- a/pkgs/development/python-modules/aiomusiccast/default.nix
+++ b/pkgs/development/python-modules/aiomusiccast/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "aiomusiccast";
-  version = "0.10.0";
+  version = "0.11.0";
 
   format = "pyproject";
 
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "vigonotion";
     repo = "aiomusiccast";
     rev = version;
-    sha256 = "sha256-UdWZLthpCuKLjASVwi4GTkrHY+K9c1xrNYVLezC/NGM=";
+    sha256 = "sha256-58l9bmGmSRFHqiKwHtGcAu2H+JnKjsZZg+fxbLW5xBg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/auth0-python/default.nix b/pkgs/development/python-modules/auth0-python/default.nix
index 41e0ede31c5d..224b8bec4015 100644
--- a/pkgs/development/python-modules/auth0-python/default.nix
+++ b/pkgs/development/python-modules/auth0-python/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "auth0-python";
-  version = "3.18.0";
+  version = "3.19.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-jitJF+puXaLv3qyJOjLFetzxRpnlbi4BKS0TzDmCRe8=";
+    sha256 = "ed33557f252cf8b022b788ebd2b851c681979f200171498acde2b92d760db026";
   };
 
   propagatedBuildInputs = [
@@ -23,7 +23,6 @@ buildPythonPackage rec {
 
   checkInputs = [
     mock
-    pyjwt
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix b/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix
index 1f4c78ed1bed..69ca3c63391b 100644
--- a/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-containerservice";
-  version = "16.2.0";
+  version = "16.3.0";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "ee40fa76d84b82e37e1d8a364649de25bb1e0c6c07f182f145a3ade44ec43711";
+    sha256 = "87f06525c6cc47de86d7886ed35f04140ddaf1b0c59482ba578fdb3f5d143b1c";
   };
 
   propagatedBuildInputs = [
@@ -31,6 +31,8 @@ buildPythonPackage rec {
   # has no tests
   doCheck = false;
 
+  pythonImportsCheck = [ "azure.mgmt.containerservice" ];
+
   meta = with lib; {
     description = "This is the Microsoft Azure Container Service Management Client Library";
     homepage = "https://github.com/Azure/azure-sdk-for-python";
diff --git a/pkgs/development/python-modules/cbor2/default.nix b/pkgs/development/python-modules/cbor2/default.nix
index ef7b79989c45..cf4813a9d908 100644
--- a/pkgs/development/python-modules/cbor2/default.nix
+++ b/pkgs/development/python-modules/cbor2/default.nix
@@ -3,33 +3,43 @@
 , buildPythonPackage
 , fetchPypi
 , pytestCheckHook
-, pytest-cov
+, pythonOlder
 , setuptools-scm
 }:
 
 buildPythonPackage rec {
   pname = "cbor2";
-  version = "5.4.1";
+  version = "5.4.2";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1jga5wj3kalf6zj5gyrmy6kwmxxkld52mvcgxc5gb5dmdhpl7gx8";
+    sha256 = "sha256-4oPnC1WgSf82TMXmSP3lh+TZsOh+SyZkxp5jkTXms7g=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
 
   checkInputs = [
-    pytest-cov
     pytestCheckHook
   ];
 
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace "--cov" ""
+  '';
+
   # https://github.com/agronholm/cbor2/issues/99
   disabledTests = lib.optionals stdenv.is32bit [
     "test_huge_truncated_bytes"
     "test_huge_truncated_string"
   ];
 
-  pythonImportsCheck = [ "cbor2" ];
+  pythonImportsCheck = [
+    "cbor2"
+  ];
 
   meta = with lib; {
     description = "Python CBOR (de)serializer with extensive tag support";
diff --git a/pkgs/development/python-modules/debian/default.nix b/pkgs/development/python-modules/debian/default.nix
index 48b5b015b11a..569e2b29631e 100644
--- a/pkgs/development/python-modules/debian/default.nix
+++ b/pkgs/development/python-modules/debian/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "python-debian";
-  version = "0.1.40";
+  version = "0.1.42";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "385dfb965eca75164d256486c7cf9bae772d24144249fd18b9d15d3cffb70eea";
+    sha256 = "a794f4c4ee2318ae7260c2e32dac252b833bdaf6686efc2a1afbc6ecf3f0931f";
   };
 
   propagatedBuildInputs = [ chardet six ];
diff --git a/pkgs/development/python-modules/deezer-python/default.nix b/pkgs/development/python-modules/deezer-python/default.nix
index 79460324e4da..bbbf813557b5 100644
--- a/pkgs/development/python-modules/deezer-python/default.nix
+++ b/pkgs/development/python-modules/deezer-python/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "deezer-python";
-  version = "3.2.0";
+  version = "4.0.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "browniebroke";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-NwG/VbTHoQl3c//vrrhKQ//gyVIGLY2148mgDToiKks=";
+    sha256 = "sha256-eza0bu4CcKvDMEq/8y6fW5qXtEFbeB5zk0w75+3Hx4Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ecoaliface/default.nix b/pkgs/development/python-modules/ecoaliface/default.nix
index e3001d7fa46c..f37a85da7d01 100644
--- a/pkgs/development/python-modules/ecoaliface/default.nix
+++ b/pkgs/development/python-modules/ecoaliface/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "ecoaliface";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1hzx0r3311f952jik3pgmrg74xp5m6w9c5v6snfrb8w2m19vs6qy";
+    sha256 = "f17b3452cfd31bb8c3509d59b846889c81db5fb85082c061c32703162cbe9083";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/flufl/bounce.nix b/pkgs/development/python-modules/flufl/bounce.nix
index 301b16035396..d44c8841f923 100644
--- a/pkgs/development/python-modules/flufl/bounce.nix
+++ b/pkgs/development/python-modules/flufl/bounce.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "flufl.bounce";
-  version = "3.0.2";
+  version = "4.0";
 
   buildInputs = [ nose2 ];
   propagatedBuildInputs = [ atpublic zope_interface ];
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5014b23248fce72b13143c32da30073e6abc655b963e7739575608280c52c9a7";
+    sha256 = "25504aeb976ec0fe5a19cd6c413a3410cb514fdcdbdca9f9b5d8d343a8603831";
   };
 }
diff --git a/pkgs/development/python-modules/flufl/i18n.nix b/pkgs/development/python-modules/flufl/i18n.nix
index b757585e40d7..f9c5c8f1efe8 100644
--- a/pkgs/development/python-modules/flufl/i18n.nix
+++ b/pkgs/development/python-modules/flufl/i18n.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "flufl.i18n";
-  version = "3.1.5";
+  version = "3.2";
 
   propagatedBuildInputs = [ atpublic ];
 
@@ -12,6 +12,6 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b7016000a4d9d366866e776947b777dbe2b1532c990efeef58922b3e7bcab36e";
+    sha256 = "c35c8f8eab66adb7fd64a1420860105066d2b36cb655b33ffb14afe8e223ed62";
   };
 }
diff --git a/pkgs/development/python-modules/flufl/lock.nix b/pkgs/development/python-modules/flufl/lock.nix
index 792af5a6c725..e63af005de31 100644
--- a/pkgs/development/python-modules/flufl/lock.nix
+++ b/pkgs/development/python-modules/flufl/lock.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "flufl.lock";
-  version = "5.1";
+  version = "6.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ylahys50vaj7iw6dhlx3gg7vs8cms9sbyvscd06clnk6lqk78ad";
+    sha256 = "fc748ee609ec864b4838ef649dbd1170fa79deb0c213c2fd51151bee6a7fc242";
   };
 
   propagatedBuildInputs = [ atpublic psutil ];
diff --git a/pkgs/development/python-modules/flux-led/default.nix b/pkgs/development/python-modules/flux-led/default.nix
index 64eafed6c198..92c1d0c1d269 100644
--- a/pkgs/development/python-modules/flux-led/default.nix
+++ b/pkgs/development/python-modules/flux-led/default.nix
@@ -1,23 +1,44 @@
-{ lib, buildPythonPackage, fetchFromGitHub
-, aiohttp, zigpy
-, pytest, isPy27 }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, webcolors
+, pythonOlder
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "flux_led";
-  version = "0.22";
-  disabled = isPy27;
+  version = "0.24.8";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "Danielhiversen";
     repo = "flux_led";
     rev = version;
-    sha256 = "1zgajlkhclyrqhkmivna4ha2lyvfpk5929s042gy59p7mzpkvjx7";
+    sha256 = "sha256-A4Duwa4IRDrxpPUb0yyfgoR0GsXD0ewO0cr+1bvl7/4=";
   };
 
+  propagatedBuildInputs = [
+    webcolors
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [
+    "tests.py"
+  ];
+
+  pythonImportsCheck = [
+    "flux_led"
+  ];
+
   meta = with lib; {
-    description = "A Python library to communicate with the flux_led smart bulbs";
+    description = "Python library to communicate with the flux_led smart bulbs";
     homepage = "https://github.com/Danielhiversen/flux_led";
-    license = licenses.lgpl3;
+    license = licenses.lgpl3Plus;
     maintainers = with maintainers; [ colemickens ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/development/python-modules/hatasmota/default.nix b/pkgs/development/python-modules/hatasmota/default.nix
index b3165a7e3c02..e746c4c24850 100644
--- a/pkgs/development/python-modules/hatasmota/default.nix
+++ b/pkgs/development/python-modules/hatasmota/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "hatasmota";
-  version = "0.2.20";
+  version = "0.2.21";
 
   src = fetchFromGitHub {
     owner = "emontnemery";
     repo = pname;
     rev = version;
-    sha256 = "1qdvm1bnn7x2mf4fq997gvq6a5901ndhd2s75h92zsgmlcp7rc77";
+    sha256 = "sha256-mtn/r6pvHeGMLkvUP4w6CT+2+viLna4Vvn9RFMEmqts=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mypy-boto3-s3/default.nix b/pkgs/development/python-modules/mypy-boto3-s3/default.nix
index 31b29364a7b8..5bbdb332f87a 100644
--- a/pkgs/development/python-modules/mypy-boto3-s3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3-s3/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "mypy-boto3-s3";
-  version = "1.18.63";
+  version = "1.18.64";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cf676b3d36677382429a3ed29e17edfdd342c1879db37868723b2a0761640d62";
+    sha256 = "c1640be24881b174b318888d6a0bfc7fc25d51ec9b263c60c6c5bac1e3295b70";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/open-garage/default.nix b/pkgs/development/python-modules/open-garage/default.nix
index cbf9ee308713..87d524845751 100644
--- a/pkgs/development/python-modules/open-garage/default.nix
+++ b/pkgs/development/python-modules/open-garage/default.nix
@@ -8,14 +8,15 @@
 
 buildPythonPackage rec {
   pname = "open-garage";
-  version = "0.1.5";
+  version = "0.1.6";
+
   disabled = pythonOlder "3.5";
 
   src = fetchFromGitHub {
     owner = "Danielhiversen";
     repo = "pyOpenGarage";
     rev = version;
-    sha256 = "1iqcqkbb1ik5lmsvwgy6i780x6y3wlm1gx257anxyvp1b21gm24p";
+    sha256 = "sha256-vm51Fjej0OQ7LftisS/tsnxZxa5c/j7eGIROMsEcXNE=";
   };
 
   propagatedBuildInputs = [
@@ -26,7 +27,9 @@ buildPythonPackage rec {
   # Project has no tests
   doCheck = false;
 
-  pythonImportsCheck = [ "opengarage" ];
+  pythonImportsCheck = [
+    "opengarage"
+  ];
 
   meta = with lib; {
     description = "Python module to communicate with opengarage.io";
diff --git a/pkgs/development/python-modules/privacyidea/ldap-proxy.nix b/pkgs/development/python-modules/privacyidea-ldap-proxy/default.nix
index 25a81510c7dc..aa44e1396a00 100644
--- a/pkgs/development/python-modules/privacyidea/ldap-proxy.nix
+++ b/pkgs/development/python-modules/privacyidea-ldap-proxy/default.nix
@@ -1,30 +1,24 @@
-{ lib, buildPythonPackage, isPy3k, fetchFromGitHub, twisted, ldaptor, configobj }:
+{ lib, buildPythonPackage, fetchFromGitHub, twisted, ldaptor, configobj }:
 
 buildPythonPackage rec {
   pname = "privacyidea-ldap-proxy";
-  version = "0.6.1";
-
-  # https://github.com/privacyidea/privacyidea-ldap-proxy/issues/50
-  disabled = isPy3k;
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "privacyidea";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1kc1n9wr1a66xd5zvl6dq78xnkqkn5574jpzashc99pvm62dr24j";
+    sha256 = "sha256-U2lg4zDQKn9FQ7O0zSLaijIkXKVjg8wi2ItueF4ACDU=";
   };
 
   propagatedBuildInputs = [ twisted ldaptor configobj ];
 
-  # python 2 zope.interface test import path issues
-  doCheck = false;
-
   pythonImportsCheck = [ "pi_ldapproxy" ];
 
   meta = with lib; {
     description = "LDAP Proxy to intercept LDAP binds and authenticate against privacyIDEA";
     homepage = "https://github.com/privacyidea/privacyidea-ldap-proxy";
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
     maintainers = [ maintainers.globin ];
   };
 }
diff --git a/pkgs/development/python-modules/pychromecast/default.nix b/pkgs/development/python-modules/pychromecast/default.nix
index e01c5e181981..c9a2103ccf7f 100644
--- a/pkgs/development/python-modules/pychromecast/default.nix
+++ b/pkgs/development/python-modules/pychromecast/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "PyChromecast";
-  version = "9.2.1";
+  version = "9.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-iD1ug2/18QaKi9ADZKFbTJhUKTCGSV6f2crNm01UwL8=";
+    sha256 = "sha256-VN3TWbfk0Bm+LJ05/Cx1zRbiFYKafqca99GEobAxlhw=";
   };
 
   disabled = !isPy3k;
diff --git a/pkgs/development/python-modules/pytest-httpserver/default.nix b/pkgs/development/python-modules/pytest-httpserver/default.nix
index 79d10f8cf743..5a5c3b1449f2 100644
--- a/pkgs/development/python-modules/pytest-httpserver/default.nix
+++ b/pkgs/development/python-modules/pytest-httpserver/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "pytest-httpserver";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchPypi {
     pname = "pytest_httpserver";
     inherit version;
-    sha256 = "12b0028vp5rh9bg712klgjzm4vl4biyza1j6iyv3pgg25ircang3";
+    sha256 = "sha256-JwH9HZgU1YVR+dEETbM1xrqYcxaTZsWDSVI6WM907UA=";
   };
 
   propagatedBuildInputs = [ werkzeug ];
diff --git a/pkgs/development/python-modules/python-ironicclient/default.nix b/pkgs/development/python-modules/python-ironicclient/default.nix
index a09a65a2b4d0..fb4840753df6 100644
--- a/pkgs/development/python-modules/python-ironicclient/default.nix
+++ b/pkgs/development/python-modules/python-ironicclient/default.nix
@@ -20,11 +20,11 @@
 
 buildPythonApplication rec {
   pname = "python-ironicclient";
-  version = "4.8.0";
+  version = "4.9.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b55516a72b995f92fb434619cbc1e2effa604c7fcaa6ac4afb8f5af1ea8193a4";
+    sha256 = "99d45e914b2845731ac44fbfc63ae3e1bd52211396748797b588f2adc4b3f341";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pytile/default.nix b/pkgs/development/python-modules/pytile/default.nix
index 779703723eeb..93197e1c2bad 100644
--- a/pkgs/development/python-modules/pytile/default.nix
+++ b/pkgs/development/python-modules/pytile/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "pytile";
-  version = "5.2.3";
+  version = "5.2.4";
   format = "pyproject";
   disabled = pythonOlder "3.7";
 
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "bachya";
     repo = pname;
     rev = version;
-    sha256 = "01gxq6dbqjmsqndjcbqv79wd2wgs7krm0rn47k883gh2xg9sn606";
+    sha256 = "sha256-9FbcGhRmXULJgfJOmy6mhiZwQUDNmvxZI/WxjJIbnc8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/qualysclient/default.nix b/pkgs/development/python-modules/qualysclient/default.nix
index 21708dd8e563..6556187c44bf 100644
--- a/pkgs/development/python-modules/qualysclient/default.nix
+++ b/pkgs/development/python-modules/qualysclient/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "qualysclient";
-  version = "0.0.4.8.1";
+  version = "0.0.4.8.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "woodtechie1428";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1fdcmspjm1cy53x9gm7frfq175saskcwn565zqprgxzfcigip1n3";
+    sha256 = "0hrbp5ci1l06j709k5y3z3ad9dryvrkvmc2wyb4a01gw7qzry7ys";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sendgrid/default.nix b/pkgs/development/python-modules/sendgrid/default.nix
index a9492c3e8fdf..c77bcfee3384 100644
--- a/pkgs/development/python-modules/sendgrid/default.nix
+++ b/pkgs/development/python-modules/sendgrid/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "sendgrid";
-  version = "6.8.2";
+  version = "6.8.3";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = "sendgrid-python";
     rev = version;
-    sha256 = "sha256-TaewVBWQ6D5TH1TGXlXVBnW7K4HS/cFxJ6bcMv2DB+c=";
+    sha256 = "sha256-kJbpYLM+GpyAHEnO2mqULOYyxIpOrmGeSMd4wJccz/8=";
   };
 
   propagatedBuildInputs = [
@@ -45,5 +45,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/sendgrid/sendgrid-python";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
+    # No support for new starkbank-ecdsa releases
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/simple-rest-client/default.nix b/pkgs/development/python-modules/simple-rest-client/default.nix
index 014f5d6ffa16..757acf32e516 100644
--- a/pkgs/development/python-modules/simple-rest-client/default.nix
+++ b/pkgs/development/python-modules/simple-rest-client/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "simple-rest-client";
-  version = "1.1.0";
+  version = "1.1.1";
 
   disabled = pythonOlder "3.8";
 
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "allisson";
     repo = "python-simple-rest-client";
     rev = version;
-    sha256 = "sha256-i+wUc9qxyei+Jbch8vyIrm9ElClnOIKp+YK6jIDkbTA=";
+    sha256 = "sha256-oJXP2/lChlzzKyNiTgJMHkcNkFyy92kTPxgDkon54g8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/soco/default.nix b/pkgs/development/python-modules/soco/default.nix
index 624ef4e30fc9..c5a06ee8f202 100644
--- a/pkgs/development/python-modules/soco/default.nix
+++ b/pkgs/development/python-modules/soco/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "soco";
-  version = "0.24.0";
+  version = "0.24.1";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "SoCo";
     repo = "SoCo";
     rev = "v${version}";
-    sha256 = "sha256-3VL2JFlukfQdjTP65X40OOsuCUVsY9kuvRKUZ3qEd+s=";
+    sha256 = "sha256-78JYetA6msGiLMHNTdTN2b5lOiXaY+TQA9ID8qtPmM0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/spacy-transformers/default.nix b/pkgs/development/python-modules/spacy-transformers/default.nix
index 94e7410d6c79..3e92dc97f96d 100644
--- a/pkgs/development/python-modules/spacy-transformers/default.nix
+++ b/pkgs/development/python-modules/spacy-transformers/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "spacy-transformers";
-  version = "1.0.6";
+  version = "1.1.0";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-zkpSaiqb0wUTugmbeREVJyZzv5qxXXw4YFBpXzdSUXE=";
+    sha256 = "17c5d821834726d3cad010d07bc9951cdf57b0a703e3727520f817286809591e";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/starkbank-ecdsa/default.nix b/pkgs/development/python-modules/starkbank-ecdsa/default.nix
index 9d935444339a..df45883b9b05 100644
--- a/pkgs/development/python-modules/starkbank-ecdsa/default.nix
+++ b/pkgs/development/python-modules/starkbank-ecdsa/default.nix
@@ -6,18 +6,31 @@
 
 buildPythonPackage rec {
   pname = "starkbank-ecdsa";
-  version = "1.1.1";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "starkbank";
     repo = "ecdsa-python";
     rev = "v${version}";
-    sha256 = "1x86ia0385c76nzqa00qyrvnn4j174n6piq85m7ar5i0ij7qky9a";
+    sha256 = "sha256-MTd9aeX6UavRua0hnuy5qY5kltzSoyvv+LcL5EvU5Sc=";
   };
 
-  checkInputs = [ pytestCheckHook ];
-  pytestFlagsArray = [ "-v tests/*.py" ];
-  pythonImportsCheck = [ "ellipticcurve" ];
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    cd tests
+  '';
+
+  pytestFlagsArray = [
+    "-v"
+    "*.py"
+  ];
+
+  pythonImportsCheck = [
+    "ellipticcurve"
+  ];
 
   meta = with lib; {
     description = "Python ECDSA library";
diff --git a/pkgs/development/python-modules/teslajsonpy/default.nix b/pkgs/development/python-modules/teslajsonpy/default.nix
index ba90946a9744..96017e364b3e 100644
--- a/pkgs/development/python-modules/teslajsonpy/default.nix
+++ b/pkgs/development/python-modules/teslajsonpy/default.nix
@@ -10,19 +10,22 @@
 , poetry-core
 , pytest-asyncio
 , pytestCheckHook
+, pythonOlder
 , wrapt
 }:
 
 buildPythonPackage rec {
   pname = "teslajsonpy";
-  version = "1.1.0";
+  version = "1.1.2";
   format = "pyproject";
 
+  disabled = pythonOlder "3.6";
+
   src = fetchFromGitHub {
     owner = "zabuldon";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1f6gbv6pczr5nhk8jmqpskvlffjd4ai4bkrmcj171mwq45vig6xr";
+    sha256 = "sha256-i1p36qy3UF9dKzFBHaW5w0s75z/mgQ8tlYWe6qLxAKk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/velbus-aio/default.nix b/pkgs/development/python-modules/velbus-aio/default.nix
index 603aae8585de..17ed9f4eb02f 100644
--- a/pkgs/development/python-modules/velbus-aio/default.nix
+++ b/pkgs/development/python-modules/velbus-aio/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "velbus-aio";
-  version = "2021.10.1";
+  version = "2021.10.2";
 
   disabled = pythonOlder "3.7";
 
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "Cereal2nd";
     repo = pname;
     rev = version;
-    sha256 = "sha256-vE25b95tWxsB+uJNVpXtY5AcJZo5qsBm6Jug1ckhz7k=";
+    sha256 = "sha256-zamFDlahHQGo5g0dlGF6uWG53K/IkEjP0dA8cWYrhtI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/build-managers/ekam/default.nix b/pkgs/development/tools/build-managers/ekam/default.nix
new file mode 100644
index 000000000000..9247a2b21302
--- /dev/null
+++ b/pkgs/development/tools/build-managers/ekam/default.nix
@@ -0,0 +1,67 @@
+{ lib, stdenv, fetchFromGitHub, capnproto }:
+
+stdenv.mkDerivation {
+  pname = "ekam";
+  version = "unstable-2021-09-18";
+
+  src = fetchFromGitHub {
+    owner = "capnproto";
+    repo = "ekam";
+    rev = "77c338f8bd8f4a2ce1e6199b2a52363f1fccf388";
+    sha256 = "0q4bizlb1ykzdp4ca0kld6xm5ml9q866xrj3ijffcnyiyqr51qr8";
+  };
+
+  # The capnproto *source* is required to build ekam.
+  # https://github.com/capnproto/ekam/issues/5
+  #
+  # Specifically, the git version of the source is required, as
+  # capnproto release tarballs do not include ekam rule files.
+  postUnpack = ''
+    mkdir -p $sourceRoot/deps
+    cp -r ${capnproto.src} $sourceRoot/deps/capnproto
+  '';
+
+  postPatch = ''
+    # A single capnproto test file expects to be able to write to
+    # /var/tmp.  We change it to use /tmp because /var is not available
+    # under nix-build.
+    substituteInPlace deps/capnproto/c++/src/kj/filesystem-disk-test.c++ \
+      --replace "/var/tmp" "/tmp"
+  '';
+
+  # NIX_ENFORCE_PURITY prevents ld from linking against anything outside
+  # of the nix store -- but ekam builds capnp locally and links against it,
+  # so that causes the build to fail. So, we turn this off.
+  #
+  # See: https://nixos.wiki/wiki/Development_environment_with_nix-shell#Troubleshooting
+  preBuild = ''
+    unset NIX_ENFORCE_PURITY
+  '';
+
+  makeFlags = [
+    "PARALLEL=$(NIX_BUILD_CORES)"
+  ];
+
+  installPhase = ''
+    mkdir $out
+    cp -r bin $out
+
+    # Remove capnproto tools; there's a separate nix package for that.
+    rm $out/bin/capnp*
+    # Don't distribute ekam-bootstrap, which is not needed outside this build.
+    rm $out/bin/ekam-bootstrap
+  '';
+
+  meta = with lib; {
+    description = ''Build system ("make" in reverse)'';
+    longDescription = ''
+      Ekam ("make" spelled backwards) is a build system which automatically
+      figures out what to build and how to build it purely based on the
+      source code. No separate "makefile" is needed.
+    '';
+    homepage = "https://github.com/capnproto/ekam";
+    license = licenses.asl20;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.garrison ];
+  };
+}
diff --git a/pkgs/development/tools/build-managers/msbuild/default.nix b/pkgs/development/tools/build-managers/msbuild/default.nix
index b214f89eac98..5c3225c683f7 100644
--- a/pkgs/development/tools/build-managers/msbuild/default.nix
+++ b/pkgs/development/tools/build-managers/msbuild/default.nix
@@ -1,7 +1,9 @@
-{ lib, stdenv, fetchurl, fetchpatch, makeWrapper, glibcLocales, mono, dotnetPackages, unzip, dotnet-sdk, writeText, roslyn }:
+{ lib, stdenv, fetchurl, fetchpatch, makeWrapper, glibcLocales, mono, dotnetPackages, unzip, dotnetCorePackages, writeText, roslyn }:
 
 let
 
+  dotnet-sdk = dotnetCorePackages.sdk_5_0;
+
   xplat = fetchurl {
     url = "https://github.com/mono/msbuild/releases/download/v16.9.0/mono_msbuild_6.12.0.137.zip";
     sha256 = "1wnzbdpk4s9bmawlh359ak2b8zi0sgx1qvcjnvfncr1wsck53v7q";
diff --git a/pkgs/development/tools/continuous-integration/drone-cli/default.nix b/pkgs/development/tools/continuous-integration/drone-cli/default.nix
index a95f9914fe71..38382ea43474 100644
--- a/pkgs/development/tools/continuous-integration/drone-cli/default.nix
+++ b/pkgs/development/tools/continuous-integration/drone-cli/default.nix
@@ -21,6 +21,7 @@ buildGoModule rec {
   };
 
   meta = with lib; {
+    mainProgram = "drone";
     maintainers = with maintainers; [ ];
     license = licenses.asl20;
     description = "Command line client for the Drone continuous integration server";
diff --git a/pkgs/development/tools/electron/default.nix b/pkgs/development/tools/electron/default.nix
index 5a70d57045ce..2134c8e033f7 100644
--- a/pkgs/development/tools/electron/default.nix
+++ b/pkgs/development/tools/electron/default.nix
@@ -135,13 +135,13 @@ rec {
     headers = "1pw67w9l63xgkwp78wmnxfjgyzlrmij27bapd2yjrvj6ag7j9xgy";
   };
 
-  electron_15 = mkElectron "15.1.2" {
-    armv7l-linux = "fd176f658478c56355adb0ee81949f1b1bd073a86afba54ebb703923b99ff5f0";
-    aarch64-linux = "9493f410e983cb6a11f24375ea7959cc3e8ccab3b805b6095f4dafc9fa548e67";
-    x86_64-linux = "7acb839f6bf9bc95ae7ce26722fb6c5e9fd09bb9d58b674415bf92bded3b808e";
-    i686-linux = "018a5546baff524a649fe34957eddb88c30811dae6bd2c3bd110d15b41bc8554";
-    x86_64-darwin = "f95f70790fa689684ec2d4822451e45968a2307ccd674a4378a89667f1e2c50d";
-    aarch64-darwin = "edcfb7e83c5edad21b05d9babb4a2840157e68dbe4278c3ab3b609ece22e1372";
-    headers = "093ndqsqxk0k13rpdnpsjajf9a9599crzhhb412xlvzf8kzdzhxy";
+  electron_15 = mkElectron "15.2.0" {
+    armv7l-linux = "b682f5adca133673c8a7488c0d7e0dab8bddf0028218a2b4b842c85c12393aea";
+    aarch64-linux = "dea4ebd0583f149909acb6fe3168e225e4f6cb5470c1d0eb6c86cb58db0fb623";
+    x86_64-linux = "35d1c7e02fde920664ca245ad694cae82e3acfdac0175a1d32345497eb455673";
+    i686-linux = "52d48fbd6a6d8cae565a0d3f7574305c6313c42cac96bbdde39621b201df0082";
+    x86_64-darwin = "32d3d4e5f7dbb8fe035a7b91dc64c042eb930461424784d4c450e06768e7162d";
+    aarch64-darwin = "a7982607416ca2d30d7f48fbc3b16ab072c46170b117123a5e9763f85227a5cb";
+    headers = "0l9hbvikkw5qd1zp4kwa5w1pj80m466skdlz6j474jzqk1qz2nzm";
   };
 }
diff --git a/pkgs/development/tools/omnisharp-roslyn/default.nix b/pkgs/development/tools/omnisharp-roslyn/default.nix
index da15f47b6a2c..25f7ce4e7aa6 100644
--- a/pkgs/development/tools/omnisharp-roslyn/default.nix
+++ b/pkgs/development/tools/omnisharp-roslyn/default.nix
@@ -3,7 +3,7 @@
 , fetchurl
 , mono6
 , msbuild
-, dotnet-sdk
+, dotnetCorePackages
 , makeWrapper
 , unzip
 , writeText
@@ -11,6 +11,8 @@
 
 let
 
+  dotnet-sdk = dotnetCorePackages.sdk_5_0;
+
   deps = map (package: stdenv.mkDerivation (with package; {
     pname = name;
     inherit version src;
diff --git a/pkgs/games/osu-lazer/default.nix b/pkgs/games/osu-lazer/default.nix
index dda34a113a0f..93641a1651f6 100644
--- a/pkgs/games/osu-lazer/default.nix
+++ b/pkgs/games/osu-lazer/default.nix
@@ -9,7 +9,7 @@ let
   ];
 
   dotnet-sdk = dotnetCorePackages.sdk_5_0;
-  dotnet-net = dotnetCorePackages.net_5_0;
+  dotnet-runtime = dotnetCorePackages.runtime_5_0;
 
   # https://docs.microsoft.com/en-us/dotnet/core/rid-catalog#using-rids
   runtimeId = "linux-x64";
@@ -79,7 +79,7 @@ in stdenv.mkDerivation rec {
       --output $out/lib/osu
 
     makeWrapper $out/lib/osu/osu\! $out/bin/osu\! \
-      --set DOTNET_ROOT "${dotnet-net}" \
+      --set DOTNET_ROOT "${dotnet-runtime}" \
       --suffix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeDeps}"
     for i in 16 32 48 64 96 128 256 512 1024; do
       install -D ./assets/lazer.png $out/share/icons/hicolor/''${i}x$i/apps/osu\!.png
diff --git a/pkgs/misc/vscode-extensions/default.nix b/pkgs/misc/vscode-extensions/default.nix
index d464e735b8be..c000bb71bdd9 100644
--- a/pkgs/misc/vscode-extensions/default.nix
+++ b/pkgs/misc/vscode-extensions/default.nix
@@ -1176,17 +1176,7 @@ let
         };
       };
 
-      ms-toolsai.jupyter = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "jupyter";
-          publisher = "ms-toolsai";
-          version = "2021.5.745244803";
-          sha256 = "0gjpsp61l8daqa87mpmxcrvsvb0pc2vwg7xbkvwn0f13c1739w9p";
-        };
-        meta = {
-          license = lib.licenses.unfree;
-        };
-      };
+      ms-toolsai.jupyter = callPackage ./ms-toolsai-jupyter {};
 
       mvllow.rose-pine = buildVscodeMarketplaceExtension {
         mktplcRef = {
diff --git a/pkgs/misc/vscode-extensions/ms-toolsai-jupyter/default.nix b/pkgs/misc/vscode-extensions/ms-toolsai-jupyter/default.nix
new file mode 100644
index 000000000000..6be5e225fa38
--- /dev/null
+++ b/pkgs/misc/vscode-extensions/ms-toolsai-jupyter/default.nix
@@ -0,0 +1,42 @@
+{ lib, vscode-utils, jq, moreutils }:
+
+let
+  inherit (vscode-utils) buildVscodeMarketplaceExtension;
+
+in buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "jupyter";
+    publisher = "ms-toolsai";
+    version = "2021.9.1101343141";
+    sha256 = "1c5dgkk5yn6a8k3blbqakqdy8ppwgfbm0ciki7ix696bvlksbpdg";
+  };
+
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+
+  postPatch = ''
+    # Patch 'packages.json' so that the expected '__metadata' field exists.
+    # This works around observed extension load failure on vscode's attempt
+    # to rewrite 'packages.json' with this new information.
+    print_jq_query() {
+        cat <<"EOF"
+    .__metadata = {
+      "id": "6c2f1801-1e7f-45b2-9b5c-7782f1e076e8",
+      "publisherId": "ac8eb7c9-3e59-4b39-8040-f0484d8170ce",
+      "publisherDisplayName": "Microsoft",
+      "installedTimestamp": 0
+    }
+    EOF
+    }
+    jq "$(print_jq_query)" ./package.json | sponge ./package.json
+  '';
+
+  meta = with lib; {
+    description = "Jupyter extension for vscode";
+    homepage = "https://github.com/microsoft/vscode-jupyter";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jraygauthier ];
+  };
+}
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 69ca1d3e2541..6044967eaf69 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.14.250";
+  version = "4.14.251";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0zbf6gxm8iwf7cra310gfd0zyj8l9ckdahky9w6wb9wlznwkvd54";
+    sha256 = "08g1i6wylwi50rns2grdi9f0m8np64qvfqb28drafy772m2klinp";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index 5ee2a08f5ad6..3cb9fb7009f4 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.19.211";
+  version = "4.19.212";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1m3y5gsf5s8bb4jxkri20dlxi8aiqabzaijj2h1svz4r19ca8j7v";
+    sha256 = "0hxn3mzxh4hpnrkyjv9gipb81k6p0zd07a3xvb6fb6njvmwdpvsw";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 8f52d3af51de..a0d6115a856b 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,12 +1,12 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.288";
+  version = "4.4.289";
   extraMeta.branch = "4.4";
   extraMeta.broken = stdenv.isAarch64;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "028w3yzmzymy7l1nf3n1pfbg95hfi4ilphkyl00ddgj8sfm542c7";
+    sha256 = "1g77kf0yzwvpdxs3kw7wdvb07mmk3zm6ydjcw5dnsza8q2inl69k";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 4c00580a8aa5..b4952dcb9277 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,12 +1,12 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.286";
+  version = "4.9.287";
   extraMeta.branch = "4.9";
   extraMeta.broken = stdenv.isAarch64;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0id62p43dmkl9ir278p0dsfg3q7m1d8rlxv0c9qi1pzalkygv8p2";
+    sha256 = "1hlpxnlz0y5vxcmkavsirk2kfb2l34fcvmhlcb99slh28xkjhhfl";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
index 0da279cfc591..a16c96b9eb83 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.73";
+  version = "5.10.74";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0xhf0g5pra27hnavpy0y3mn05m5hqn5rd3d6fx0a3vr35c1jicpd";
+    sha256 = "1c717mn47mg43k7xfwydygwv14r67aksn1c24c99hf8qf14acmap";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.14.nix b/pkgs/os-specific/linux/kernel/linux-5.14.nix
index 5722faf3bdcb..ec19fa2357f2 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.14.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.14.12";
+  version = "5.14.13";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0dswxf1qk70lms5lph15i7nz3ybwiia58v8zzrmi71ajviwjc9wd";
+    sha256 = "0kcn9g5jyd043f75wk3k34j430callzhw5jh1if9zacqq2s7haw3";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index 1ff0803114b9..4b02d19d1cca 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.4.153";
+  version = "5.4.154";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0jaz57sd51xqc7w8k3f43bfc5mdsh1413mdngqqsgr8isv4hg7vd";
+    sha256 = "01iwbz1ncakw90yykdw3cx04wnclwf1qa8nmlis08svbcvs99285";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
index daa3c67da962..6ef781f6095c 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.10.65-rt53"; # updated by ./update-rt.sh
+  version = "5.10.73-rt54"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -18,14 +18,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "0riyq1gdm18642fpnhpcw8hspcjqzprzhqnygjxabjjvrvdxxlzd";
+    sha256 = "0xhf0g5pra27hnavpy0y3mn05m5hqn5rd3d6fx0a3vr35c1jicpd";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1sxyic3895dch3x7cabiip5lxv9wqypn22hcy02jg9825260cmd3";
+      sha256 = "0szqm9f939p9z701i5hj881nf5bhfa0a6037bbcz974y0x8g9nmk";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/servers/jellyfin/default.nix b/pkgs/servers/jellyfin/default.nix
index c2c9df4b814b..b9924c69e857 100644
--- a/pkgs/servers/jellyfin/default.nix
+++ b/pkgs/servers/jellyfin/default.nix
@@ -15,6 +15,8 @@
 }:
 
 let
+  dotnet-sdk = dotnetCorePackages.sdk_5_0;
+  dotnet-aspnetcore = dotnetCorePackages.aspnetcore_5_0;
   runtimeDeps = [
     ffmpeg
     fontconfig
@@ -34,10 +36,6 @@ let
       "musl-");
   # https://docs.microsoft.com/en-us/dotnet/core/rid-catalog#using-rids
   runtimeId = "${os}-${musl}${arch}";
-
-  dotnet-sdk = dotnetCorePackages.sdk_5_0;
-  dotnet-net = dotnetCorePackages.net_5_0;
-  dotnet-aspnetcore = dotnetCorePackages.aspnetcore_5_0;
 in
 stdenv.mkDerivation rec {
   pname = "jellyfin";
diff --git a/pkgs/servers/mattermost/default.nix b/pkgs/servers/mattermost/default.nix
index 14996cecc659..4bf4a41234c8 100644
--- a/pkgs/servers/mattermost/default.nix
+++ b/pkgs/servers/mattermost/default.nix
@@ -1,23 +1,24 @@
-{ lib, stdenv, fetchurl, fetchFromGitHub, buildGoPackage, buildEnv }:
+{ lib, stdenv, fetchurl, fetchFromGitHub, buildGoModule, buildEnv }:
 
 let
-  version = "5.32.1";
+  version = "5.37.2";
 
-  mattermost-server = buildGoPackage rec {
+  mattermost-server = buildGoModule rec {
     pname = "mattermost-server";
     inherit version;
 
     src = fetchFromGitHub {
       owner = "mattermost";
-      repo = "mattermost-server";
+      repo = pname;
       rev = "v${version}";
-      sha256 = "BssrTfkIxUbXYXIfz9i+5b4rEYSzBim+/riK78m8Bxo=";
+      sha256 = "sha256-kO5wSj/ApPhS2k9a9VjS3Qk55azNZeiFmevAxSkdGe0=";
     };
 
-    goPackagePath = "github.com/mattermost/mattermost-server";
+    vendorSha256 = null;
+    doCheck = false;
 
     ldflags = [
-      "-X ${goPackagePath}/model.BuildNumber=nixpkgs-${version}"
+      "-s" "-w" "-X github.com/mattermost/mattermost-server/v${lib.versions.major version}/model.BuildNumber=${version}"
     ];
 
   };
@@ -28,7 +29,7 @@ let
 
     src = fetchurl {
       url = "https://releases.mattermost.com/${version}/mattermost-${version}-linux-amd64.tar.gz";
-      sha256 = "kRerl3fYRTrotj86AIFSor3GpjhABkCmego1ms9HmkQ=";
+      sha256 = "sha256-BzQVkOPo/f6O2ncQ0taS3cZkglOL+D+zBcfNYrpMgTM=";
     };
 
     installPhase = ''
diff --git a/pkgs/servers/monitoring/telegraf/default.nix b/pkgs/servers/monitoring/telegraf/default.nix
index a830cfe3427b..918aea224305 100644
--- a/pkgs/servers/monitoring/telegraf/default.nix
+++ b/pkgs/servers/monitoring/telegraf/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "telegraf";
-  version = "1.20.0";
+  version = "1.20.2";
 
   excludedPackages = "test";
 
@@ -12,10 +12,10 @@ buildGoModule rec {
     owner = "influxdata";
     repo = "telegraf";
     rev = "v${version}";
-    sha256 = "sha256-whsPXevnN/Kg09hcjEAeAduLZsYbo7IvUm5z4HodwrQ=";
+    sha256 = "sha256-6XPdqTW5dP5nOfV9fdnXkyzWPYEILEx4AF61u691b6c=";
   };
 
-  vendorSha256 = "sha256-VywVlCcdOV/TdXQBa88oU9V8U4EbuYMId4aT4YAY1Wk=";
+  vendorSha256 = "sha256-7Crf2mQy0C7Fw6S7KY3bQj4Cu8GceFxoB7D2Vkv6X9U=";
   proxyVendor = true;
 
   ldflags = [
diff --git a/pkgs/servers/nosql/eventstore/default.nix b/pkgs/servers/nosql/eventstore/default.nix
index 4a6db24bc4c4..769c45ffc6c5 100644
--- a/pkgs/servers/nosql/eventstore/default.nix
+++ b/pkgs/servers/nosql/eventstore/default.nix
@@ -2,13 +2,15 @@
 , fetchFromGitHub
 , fetchurl
 , makeWrapper
-, dotnet-sdk
+, dotnetCorePackages
 , mono
 , Nuget
 }:
 
 let
 
+  dotnet-sdk = dotnetCorePackages.sdk_5_0;
+
   deps = import ./deps.nix { inherit fetchurl; };
 
 in
diff --git a/pkgs/servers/prowlarr/default.nix b/pkgs/servers/prowlarr/default.nix
index 511217a48f18..9cfc26925cc6 100644
--- a/pkgs/servers/prowlarr/default.nix
+++ b/pkgs/servers/prowlarr/default.nix
@@ -38,7 +38,7 @@ in stdenv.mkDerivation rec {
     mkdir -p $out/{bin,share/${pname}-${version}}
     cp -r * $out/share/${pname}-${version}/.
 
-    makeWrapper "${dotnetCorePackages.netcore_3_1}/bin/dotnet" $out/bin/Prowlarr \
+    makeWrapper "${dotnetCorePackages.runtime_3_1}/bin/dotnet" $out/bin/Prowlarr \
       --add-flags "$out/share/${pname}-${version}/Prowlarr.dll" \
       --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [
         curl sqlite libmediainfo mono openssl icu ]}
diff --git a/pkgs/servers/radarr/default.nix b/pkgs/servers/radarr/default.nix
index dd2480de2e66..acb3ba82a4ac 100644
--- a/pkgs/servers/radarr/default.nix
+++ b/pkgs/servers/radarr/default.nix
@@ -31,7 +31,7 @@ in stdenv.mkDerivation rec {
     mkdir -p $out/{bin,share/${pname}-${version}}
     cp -r * $out/share/${pname}-${version}/.
 
-    makeWrapper "${dotnetCorePackages.netcore_3_1}/bin/dotnet" $out/bin/Radarr \
+    makeWrapper "${dotnetCorePackages.runtime_3_1}/bin/dotnet" $out/bin/Radarr \
       --add-flags "$out/share/${pname}-${version}/Radarr.dll" \
       --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [
         curl sqlite libmediainfo mono openssl icu ]}
diff --git a/pkgs/shells/hilbish/default.nix b/pkgs/shells/hilbish/default.nix
index be2bdf318f40..a4a54e45c636 100644
--- a/pkgs/shells/hilbish/default.nix
+++ b/pkgs/shells/hilbish/default.nix
@@ -2,25 +2,24 @@
 
 buildGoModule rec {
   pname = "hilbish";
-  version = "0.5.1";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "Rosettea";
     repo = "Hilbish";
     rev = "v${version}";
-    sha256 = "sha256-557Je9KeBpkZxVAxcjWAhybIJJYlzhtbnIyZh0rCRUc=";
+    sha256 = "sha256-ACHHHGT3VGnvZVi1UZb57+g/slcld5e3bh+DDhUVVpQ=";
     fetchSubmodules = true;
   };
 
-  vendorSha256 = "sha256-8l+Kb1ADMLwv0Hf/ikok8eUcEEST07rhk8BjHxJI0lc=";
+  vendorSha256 = "sha256-SVGPMFpQjVOWCfiPpEmqhp6MEO0wqeyAZVyeNmTuXl0=";
 
   buildInputs = [ readline ];
 
   ldflags = [ "-s" "-w" ];
 
   postPatch = ''
-    # in master vars.go is called vars_linux.go
-    substituteInPlace vars.go \
+    substituteInPlace vars_linux.go \
       --replace "/usr/share" "${placeholder "out"}/share/"
   '';
 
@@ -28,8 +27,13 @@ buildGoModule rec {
     mkdir -p "$out/share/hilbish"
 
     cp .hilbishrc.lua $out/share/hilbish/
+    cp -r docs -t $out/share/hilbish
     cp -r libs -t $out/share/hilbish/
     cp preload.lua $out/share/hilbish/
+
+    # segfaults and it's already been generated upstream
+    # we copy the docs over with the above cp command
+    rm $out/bin/docgen
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/X11/opentabletdriver/default.nix b/pkgs/tools/X11/opentabletdriver/default.nix
index 5bffa1077647..b205f959ee35 100644
--- a/pkgs/tools/X11/opentabletdriver/default.nix
+++ b/pkgs/tools/X11/opentabletdriver/default.nix
@@ -3,8 +3,7 @@
 , fetchFromGitHub
 , fetchurl
 , linkFarmFromDrvs
-, dotnet-netcore
-, dotnet-sdk
+, dotnetCorePackages
 , dotnetPackages
 , dpkg
 , gtk3
@@ -21,6 +20,10 @@
 , wrapGAppsHook
 }:
 
+let
+  dotnet-sdk = dotnetCorePackages.sdk_5_0;
+  dotnet-runtime = dotnetCorePackages.runtime_5_0;
+in
 stdenv.mkDerivation rec {
   pname = "OpenTabletDriver";
   version = "0.5.3.3";
@@ -114,19 +117,19 @@ stdenv.mkDerivation rec {
     makeWrapper $out/lib/OpenTabletDriver.Console $out/bin/otd \
         "''${gappsWrapperArgs[@]}" \
         --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}/" \
-        --set DOTNET_ROOT "${dotnet-netcore}" \
+        --set DOTNET_ROOT "${dotnet-runtime}" \
         --suffix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeDeps}"
 
     makeWrapper $out/lib/OpenTabletDriver.Daemon $out/bin/otd-daemon \
         "''${gappsWrapperArgs[@]}" \
         --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}/" \
-        --set DOTNET_ROOT "${dotnet-netcore}" \
+        --set DOTNET_ROOT "${dotnet-runtime}" \
         --suffix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeDeps}"
 
     makeWrapper $out/lib/OpenTabletDriver.UX.Gtk $out/bin/otd-gui \
         "''${gappsWrapperArgs[@]}" \
         --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}/" \
-        --set DOTNET_ROOT "${dotnet-netcore}" \
+        --set DOTNET_ROOT "${dotnet-runtime}" \
         --suffix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeDeps}"
 
     mkdir -p $out/lib/OpenTabletDriver
diff --git a/pkgs/tools/backup/discordchatexporter-cli/default.nix b/pkgs/tools/backup/discordchatexporter-cli/default.nix
index 60437403e5a2..38dfd55783de 100644
--- a/pkgs/tools/backup/discordchatexporter-cli/default.nix
+++ b/pkgs/tools/backup/discordchatexporter-cli/default.nix
@@ -18,7 +18,7 @@ buildDotnetModule rec {
   };
 
   projectFile = "DiscordChatExporter.Cli/DiscordChatExporter.Cli.csproj";
-  dotnet-runtime = dotnetCorePackages.netcore_3_1;
+  dotnet-runtime = dotnetCorePackages.runtime_3_1;
   nugetDeps = ./deps.nix;
 
   nativeBuildInputs = [ autoPatchelfHook ];
diff --git a/pkgs/tools/graphics/hobbits/default.nix b/pkgs/tools/graphics/hobbits/default.nix
new file mode 100644
index 000000000000..477c6bea249a
--- /dev/null
+++ b/pkgs/tools/graphics/hobbits/default.nix
@@ -0,0 +1,34 @@
+{ lib, stdenv, mkDerivation, fetchFromGitHub
+, cmake, pkg-config, fftw, libpcap, libusb1, python3
+}:
+
+mkDerivation rec {
+  pname = "hobbits";
+  version = "0.52.0";
+
+  src = fetchFromGitHub {
+    owner = "Mahlet-Inc";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-GZHBkBRt1ySItV+h5rdvey7KwdUWh5+rgztXh6HW3Js=";
+  };
+
+  postPatch = ''
+    substituteInPlace src/hobbits-core/settingsdata.cpp \
+      --replace "pythonHome = \"/usr\"" "pythonHome = \"${python3}\""
+    substituteInPlace cmake/gitversion.cmake \
+      --replace "[Mystery Build]" "${version}"
+  '';
+
+  buildInputs = [ fftw libpcap libusb1 python3 ];
+
+  nativeBuildInputs = [ cmake pkg-config ];
+
+  meta = with lib; {
+    description = "A multi-platform GUI for bit-based analysis, processing, and visualization";
+    homepage = "https://github.com/Mahlet-Inc/hobbits";
+    license = licenses.mit;
+    maintainers = with maintainers; [ sikmir ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/inputmethods/evscript/default.nix b/pkgs/tools/inputmethods/evscript/default.nix
index b8e91a741978..8afd4804e0ed 100644
--- a/pkgs/tools/inputmethods/evscript/default.nix
+++ b/pkgs/tools/inputmethods/evscript/default.nix
@@ -2,19 +2,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "evscript";
-  version = "git-${builtins.substring 0 7 src.rev}";
+  version = "unstable-2021-06-16";
 
   src = fetchFromGitHub {
-    owner = "myfreeweb";
+    owner = "unrelentingtech";
     repo = pname;
-    rev = "47f86f0d15add2af785ea1ff47f24d130026d1b4";
-    sha256 = "1xm8297k0d8d0aq7fxgmibr4qva4d02cb6gnnlzq77jcmnknxv14";
+    rev = "25912c0b6446f31b0f64485af3fa4aa8a93b33df";
+    sha256 = "sha256-apq3kHipEX6zOTNwqpIQR46JqmeE7EKVSOGrNNSkyu8=";
   };
 
-  cargoSha256 = "1z0xxbjnhhzn1fnc3zhvy727l88qyyfqdayj5yvf3nh23m7sr87l";
+  cargoSha256 = "sha256-1aR9/fhJQ+keRIxSG2cpY1HTalE6nM+MTb1Za3Tot28=";
 
   meta = with lib; {
-    homepage = "https://github.com/myfreeweb/${pname}";
+    homepage = "https://github.com/unrelentingtech/evscript";
     description = "A tiny sandboxed Dyon scripting environment for evdev input devices";
     license = licenses.unlicense;
     maintainers = with maintainers; [ milesbreslin ];
diff --git a/pkgs/tools/misc/steampipe/default.nix b/pkgs/tools/misc/steampipe/default.nix
new file mode 100644
index 000000000000..691351c89b08
--- /dev/null
+++ b/pkgs/tools/misc/steampipe/default.nix
@@ -0,0 +1,40 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+
+buildGoModule rec {
+  pname = "steampipe";
+  version = "0.8.5";
+
+  src = fetchFromGitHub {
+    owner = "turbot";
+    repo = "steampipe";
+    rev = "v${version}";
+    sha256 = "sha256-3vetSUJwCeaBzKj+635siskfcDPs/kkgCH954cg/REA=";
+  };
+
+  vendorSha256 = "sha256-TGDFNHWWbEy1cD7b2yPqAN7rRrLvL0ZX/R3BWGRWjjw=";
+
+  # tests are failing for no obvious reasons
+  doCheck = false;
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  postInstall = ''
+    INSTALL_DIR=$(mktemp -d)
+    installShellCompletion --cmd steampipe \
+      --bash <($out/bin/steampipe --install-dir $INSTALL_DIR completion bash) \
+      --fish <($out/bin/steampipe --install-dir $INSTALL_DIR completion fish) \
+      --zsh <($out/bin/steampipe --install-dir $INSTALL_DIR completion zsh)
+  '';
+
+  meta = with lib; {
+    homepage = "https://steampipe.io/";
+    description = "select * from cloud;";
+    license = licenses.agpl3;
+    maintainers = with maintainers; [ hardselius ];
+  };
+}
diff --git a/pkgs/tools/misc/synth/default.nix b/pkgs/tools/misc/synth/default.nix
index 31d0b6e7d32f..0249491fbde6 100644
--- a/pkgs/tools/misc/synth/default.nix
+++ b/pkgs/tools/misc/synth/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "synth";
-  version = "0.5.6";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "getsynth";
     repo = pname;
     rev = "v${version}";
-    sha256 = "06kgzaja04553gaxrfz6d1rqi3xwa6ijl0q6425fg0mqq9ifv7xk";
+    sha256 = "sha256-i5X2HUOCgY2znH4rDzhFpsPXsFeM7GR4soAO/rFDjjo=";
   };
 
-  cargoSha256 = "sha256-bjda4uE5K+cJkS2TsTv7FN3H6q3cElRr674FTKaIexA=";
+  cargoSha256 = "sha256-47i46Y6JjTGWC7mfMd2x2k8v0SY1o2UHdEU4rF0VrsY=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/tools/misc/zoxide/default.nix b/pkgs/tools/misc/zoxide/default.nix
index c2eba8c01b46..5fa6e849ac1e 100644
--- a/pkgs/tools/misc/zoxide/default.nix
+++ b/pkgs/tools/misc/zoxide/default.nix
@@ -10,13 +10,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "zoxide";
-  version = "0.7.5";
+  version = "0.7.7";
 
   src = fetchFromGitHub {
     owner = "ajeetdsouza";
     repo = "zoxide";
     rev = "v${version}";
-    sha256 = "sha256-DcfWNp9fELRzLfNAU2qGXfLDkSbWGrsfW/Wy0t2ISXU=";
+    sha256 = "18sm7smp0r7rmbq6ajl905947l5vni7hb4dfd0hhnrqjxwlkynds";
   };
 
   nativeBuildInputs = [ installShellFiles ];
@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage rec {
       --replace '"fzf"' '"${fzf}/bin/fzf"'
   '';
 
-  cargoSha256 = "sha256-O2IPmb9LH0ct0O2kR581Hfxl1sdb8himfq5U733JwGk=";
+  cargoSha256 = "0km4bgdl03m5ri4wzy0fsvvwlifx99m9x2j599x58ryq6lx2kkyc";
 
   postInstall = ''
     installManPage man/*
diff --git a/pkgs/tools/security/kubescape/default.nix b/pkgs/tools/security/kubescape/default.nix
index 00780306d905..612e14b52498 100644
--- a/pkgs/tools/security/kubescape/default.nix
+++ b/pkgs/tools/security/kubescape/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "kubescape";
-  version = "1.0.120";
+  version = "1.0.123";
 
   src = fetchFromGitHub {
     owner = "armosec";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-aFFJAib0/FTOaPtSLYXIFV3+QfIpzy8fC7rWAQW5yh0=";
+    sha256 = "sha256-mrpQXIcV1KxOLDhWAS9Og76k18jsey7vPAcbhGe+cN4=";
   };
 
-  vendorSha256 = "sha256-vN+ci2vCbtDuEEVzZQiFkdi1QkMgnnbbJgD9g6DS7qs=";
+  vendorSha256 = "sha256-4v/7JrSGZKOyLwU6U3+hc9P+kzxGGj4aXG/wXmNdo+M=";
 
   # One test is failing, disabling for now
   doCheck = false;
diff --git a/pkgs/tools/text/tidy-viewer/default.nix b/pkgs/tools/text/tidy-viewer/default.nix
index efa1784e7bf6..4cb99ca26cea 100644
--- a/pkgs/tools/text/tidy-viewer/default.nix
+++ b/pkgs/tools/text/tidy-viewer/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tidy-viewer";
-  version = "0.0.21";
+  version = "0.0.22";
 
   src = fetchFromGitHub {
     owner = "alexhallam";
     repo = "tv";
     rev = version;
-    sha256 = "1zjnc2b9y2f6x114svp31r1lzkak4xfn71qrxch30mq2aj4yzd2l";
+    sha256 = "sha256-OuNpp9EKiU+fQSZZO7zpI36nCiZBXK6OznJGY4KMftU=";
   };
 
-  cargoSha256 = "sha256-M6HInLevKvF4zBNe+Sg8fQK6koefRaO0l5AcrFhH+vI=";
+  cargoSha256 = "sha256-LRoNGDOrbCjmZJRe+EUKxkDJjC92bQRRwP48jqDp9PU=";
 
   # this test parses command line arguments
   # error: Found argument '--test-threads' which wasn't expected, or isn't valid in this context
diff --git a/pkgs/top-level/agda-packages.nix b/pkgs/top-level/agda-packages.nix
index e38819cfcb02..18c32b9a9d92 100644
--- a/pkgs/top-level/agda-packages.nix
+++ b/pkgs/top-level/agda-packages.nix
@@ -13,7 +13,10 @@ let
 
     lib = lib.extend (final: prev: import ../build-support/agda/lib.nix { lib = prev; });
 
-    agda = withPackages [] // { inherit withPackages; };
+    agda = withPackages [] // {
+      inherit withPackages;
+      passthru.tests.allPackages = withPackages (lib.filter (pkg: self.lib.isUnbrokenAgdaPackage pkg) (lib.attrValues self));
+    };
 
     standard-library = callPackage ../development/libraries/agda/standard-library {
       inherit (pkgs.haskellPackages) ghcWithPackages;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 862fa6dbbab8..128ee0312cd2 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -204,6 +204,7 @@ mapAliases ({
   dnnl = oneDNN; # added 2020-04-22
   docbook5_xsl = docbook_xsl_ns; # added 2018-04-25
   docbook_xml_xslt = docbook_xsl; # added 2018-04-25
+  dotnet-netcore = dotnet-runtime; # added 2021-10-07
   double_conversion = double-conversion; # 2017-11-22
   docker_compose = docker-compose; # 2018-11-10
   draftsight = throw "draftsight has been removed, no longer available as freeware"; # added 2020-08-14
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 79fd08c847c0..2876e328f0e2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -405,17 +405,13 @@ with pkgs;
 
   dotnetCorePackages = recurseIntoAttrs (callPackage ../development/compilers/dotnet {});
 
-  dotnet-sdk = dotnetCorePackages.sdk_2_1;
-
   dotnet-sdk_2 = dotnetCorePackages.sdk_2_1;
-
   dotnet-sdk_3 = dotnetCorePackages.sdk_3_1;
-
   dotnet-sdk_5 = dotnetCorePackages.sdk_5_0;
 
-  dotnet-netcore = dotnetCorePackages.netcore_2_1;
-
-  dotnet-aspnetcore = dotnetCorePackages.aspnetcore_2_1;
+  dotnet-sdk = dotnetCorePackages.sdk_5_0;
+  dotnet-runtime = dotnetCorePackages.runtime_5_0;
+  dotnet-aspnetcore = dotnetCorePackages.aspnetcore_5_0;
 
   dumb-init = callPackage ../applications/virtualization/dumb-init {};
 
@@ -2751,6 +2747,8 @@ with pkgs;
 
   eggdrop = callPackage ../tools/networking/eggdrop { };
 
+  ekam = callPackage ../development/tools/build-managers/ekam { };
+
   eksctl = callPackage ../tools/admin/eksctl { };
 
   electronplayer = callPackage ../applications/video/electronplayer/electronplayer.nix { };
@@ -3452,6 +3450,8 @@ with pkgs;
 
   statserial = callPackage ../tools/misc/statserial { };
 
+  steampipe = callPackage ../tools/misc/steampipe { };
+
   step-ca = callPackage ../tools/security/step-ca {
     inherit (darwin.apple_sdk.frameworks) PCSC;
   };
@@ -6130,6 +6130,8 @@ with pkgs;
 
   hivemind = callPackage ../applications/misc/hivemind { };
 
+  hobbits = libsForQt5.callPackage ../tools/graphics/hobbits { };
+
   hfsprogs = callPackage ../tools/filesystems/hfsprogs { };
 
   highlight = callPackage ../tools/text/highlight ({
@@ -12399,7 +12401,7 @@ with pkgs;
 
   roslyn = callPackage ../development/compilers/roslyn { };
 
-  msbuild = callPackage ../development/tools/build-managers/msbuild { dotnet-sdk = dotnet-sdk_5; };
+  msbuild = callPackage ../development/tools/build-managers/msbuild { };
 
   mosml = callPackage ../development/compilers/mosml { };
 
@@ -26927,10 +26929,7 @@ with pkgs;
     libtiff = callPackage ../applications/graphics/opentoonz/libtiff.nix { };
   })).callPackage ../applications/graphics/opentoonz { };
 
-  opentabletdriver = callPackage ../tools/X11/opentabletdriver {
-    dotnet-sdk = dotnetCorePackages.sdk_5_0;
-    dotnet-netcore = dotnetCorePackages.net_5_0;
-  };
+  opentabletdriver = callPackage ../tools/X11/opentabletdriver { };
 
   opentx = libsForQt5.callPackage ../applications/misc/opentx { };
 
@@ -27510,6 +27509,8 @@ with pkgs;
 
   rkdeveloptool = callPackage ../misc/rkdeveloptool { };
 
+  rocketchat-desktop = callPackage ../applications/networking/instant-messengers/rocketchat-desktop { };
+
   rofi-unwrapped = callPackage ../applications/misc/rofi {
     autoreconfHook = buildPackages.autoreconfHook269;
   };
@@ -33203,7 +33204,7 @@ with pkgs;
     stdenv = crossLibcStdenv;
   };
 
-  omnisharp-roslyn = callPackage ../development/tools/omnisharp-roslyn { dotnet-sdk = dotnet-sdk_5; };
+  omnisharp-roslyn = callPackage ../development/tools/omnisharp-roslyn { };
 
   wasmtime = callPackage ../development/interpreters/wasmtime {};
 
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 329d49323c87..417ce76331f9 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1156,6 +1156,8 @@ let
 
     ppx_deriving_yojson = callPackage ../development/ocaml-modules/ppx_deriving_yojson {};
 
+    ppx_deriving_yaml = callPackage ../development/ocaml-modules/ppx_deriving_yaml {};
+
     ppx_deriving_cmdliner = callPackage ../development/ocaml-modules/ppx_deriving_cmdliner {};
 
     ppx_gen_rec = callPackage ../development/ocaml-modules/ppx_gen_rec {};
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index dd01245a1798..6f248b01f04c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5872,6 +5872,8 @@ in {
 
   prison = callPackage ../development/python-modules/prison { };
 
+  privacyidea-ldap-proxy = callPackage ../development/python-modules/privacyidea-ldap-proxy { };
+
   pyjwt1 = callPackage ../development/python-modules/pyjwt/1.nix { };
 
   proboscis = callPackage ../development/python-modules/proboscis { };
diff --git a/pkgs/top-level/python2-packages.nix b/pkgs/top-level/python2-packages.nix
index 99189a534df5..033bc4dc7c0d 100644
--- a/pkgs/top-level/python2-packages.nix
+++ b/pkgs/top-level/python2-packages.nix
@@ -407,8 +407,6 @@ with self; with super; {
 
   prettytable = callPackage ../development/python-modules/prettytable/1.nix { };
 
-  privacyidea-ldap-proxy = callPackage ../development/python-modules/privacyidea/ldap-proxy.nix { };
-
   ldaptor = callPackage ../development/python-modules/ldaptor/19.nix { };
 
   progressbar231 = callPackage ../development/python-modules/progressbar231 { };