about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--.github/PULL_REQUEST_TEMPLATE.md2
-rw-r--r--doc/contributing/quick-start.xml2
-rw-r--r--doc/languages-frameworks/android.section.md2
-rw-r--r--doc/languages-frameworks/index.xml1
-rw-r--r--doc/languages-frameworks/ios.section.md2
-rw-r--r--doc/languages-frameworks/php.section.md34
-rw-r--r--doc/preface.chapter.md2
-rw-r--r--doc/release-notes.xml4
-rw-r--r--maintainers/maintainer-list.nix24
-rwxr-xr-xmaintainers/scripts/hydra-eval-failures.py2
-rw-r--r--nixos/README2
-rw-r--r--nixos/doc/manual/configuration/adding-custom-packages.xml2
-rw-r--r--nixos/doc/manual/configuration/config-syntax.xml2
-rw-r--r--nixos/doc/manual/configuration/summary.xml2
-rwxr-xr-xnixos/doc/manual/development/releases.xml2
-rw-r--r--nixos/doc/manual/development/replace-modules.xml2
-rw-r--r--nixos/doc/manual/installation/obtaining.xml4
-rw-r--r--nixos/doc/manual/release-notes/rl-1404.xml2
-rw-r--r--nixos/doc/manual/release-notes/rl-1509.xml4
-rw-r--r--nixos/doc/manual/release-notes/rl-1603.xml2
-rw-r--r--nixos/doc/manual/release-notes/rl-2009.xml6
-rw-r--r--nixos/modules/module-list.nix2
-rw-r--r--nixos/modules/programs/venus.nix2
-rw-r--r--nixos/modules/security/acme.nix10
-rw-r--r--nixos/modules/security/acme.xml247
-rw-r--r--nixos/modules/services/editors/emacs.xml2
-rw-r--r--nixos/modules/services/misc/nix-daemon.nix2
-rw-r--r--nixos/modules/services/misc/octoprint.nix9
-rw-r--r--nixos/modules/services/networking/prosody.nix13
-rw-r--r--nixos/modules/services/torrent/deluge.nix4
-rw-r--r--nixos/modules/system/boot/initrd-ssh.nix8
-rw-r--r--nixos/modules/virtualisation/cri-o.nix29
-rw-r--r--nixos/modules/virtualisation/oci-containers.nix (renamed from nixos/modules/virtualisation/docker-containers.nix)124
-rw-r--r--nixos/modules/virtualisation/podman.nix20
-rw-r--r--nixos/tests/all-tests.nix2
-rw-r--r--nixos/tests/chromium.nix2
-rw-r--r--nixos/tests/docker-containers.nix27
-rw-r--r--nixos/tests/ec2.nix2
-rw-r--r--nixos/tests/minio.nix2
-rw-r--r--nixos/tests/oci-containers.nix43
-rw-r--r--nixos/tests/udisks2.nix2
-rw-r--r--nixos/tests/xmpp/prosody-mysql.nix15
-rw-r--r--pkgs/applications/audio/ft2-clone/default.nix4
-rw-r--r--pkgs/applications/audio/gpodder/default.nix4
-rw-r--r--pkgs/applications/audio/orca-c/default.nix31
-rw-r--r--pkgs/applications/audio/pt2-clone/default.nix4
-rw-r--r--pkgs/applications/audio/rofi-mpd/default.nix4
-rw-r--r--pkgs/applications/audio/schismtracker/default.nix29
-rw-r--r--pkgs/applications/audio/strawberry/default.nix4
-rw-r--r--pkgs/applications/blockchains/bitcoin-abc.nix4
-rw-r--r--pkgs/applications/blockchains/clightning.nix4
-rw-r--r--pkgs/applications/blockchains/lnd.nix6
-rw-r--r--pkgs/applications/editors/jetbrains/common.nix4
-rw-r--r--pkgs/applications/editors/vim/macvim.nix40
-rw-r--r--pkgs/applications/editors/vim/macvim.patch50
-rw-r--r--pkgs/applications/graphics/apitrace/default.nix45
-rw-r--r--pkgs/applications/graphics/drawio/default.nix4
-rw-r--r--pkgs/applications/graphics/fstl/default.nix4
-rw-r--r--pkgs/applications/kde/ark/default.nix4
-rw-r--r--pkgs/applications/misc/1password/default.nix8
-rw-r--r--pkgs/applications/misc/alacritty/default.nix2
-rw-r--r--pkgs/applications/misc/cherrytree/default.nix4
-rw-r--r--pkgs/applications/misc/ddgr/default.nix9
-rw-r--r--pkgs/applications/misc/latte-dock/default.nix4
-rw-r--r--pkgs/applications/misc/notable/default.nix25
-rw-r--r--pkgs/applications/misc/octoprint/default.nix141
-rw-r--r--pkgs/applications/misc/octoprint/plugins.nix490
-rw-r--r--pkgs/applications/misc/osmium-tool/default.nix4
-rw-r--r--pkgs/applications/misc/pdfarranger/default.nix4
-rw-r--r--pkgs/applications/misc/pdfsam-basic/default.nix4
-rw-r--r--pkgs/applications/misc/pueue/default.nix6
-rw-r--r--pkgs/applications/misc/redshift/default.nix5
-rw-r--r--pkgs/applications/misc/sweethome3d/default.nix6
-rw-r--r--pkgs/applications/misc/toot/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/ephemeral/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/atlantis/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/chronos/default.nix2
-rw-r--r--pkgs/applications/networking/cluster/helmfile/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/k9s/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/luigi/default.nix4
-rw-r--r--pkgs/applications/networking/feedreaders/rssguard/default.nix4
-rw-r--r--pkgs/applications/networking/gmailctl/default.nix6
-rw-r--r--pkgs/applications/networking/instant-messengers/qtox/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-cli/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix9
-rw-r--r--pkgs/applications/networking/instant-messengers/vacuum/default.nix2
-rw-r--r--pkgs/applications/networking/mailreaders/mutt/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/neomutt/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/notmuch/default.nix2
-rw-r--r--pkgs/applications/networking/onionshare/default.nix113
-rw-r--r--pkgs/applications/networking/onionshare/fix-paths.patch134
-rw-r--r--pkgs/applications/networking/p2p/tribler/default.nix5
-rw-r--r--pkgs/applications/networking/pjsip/default.nix21
-rw-r--r--pkgs/applications/networking/sniffers/kismet/default.nix31
-rw-r--r--pkgs/applications/networking/sniffers/whsniff/default.nix25
-rw-r--r--pkgs/applications/networking/ssb/patchwork/default.nix4
-rw-r--r--pkgs/applications/office/aesop/default.nix4
-rw-r--r--pkgs/applications/office/elementary-planner/default.nix4
-rw-r--r--pkgs/applications/science/biology/dcm2niix/default.nix4
-rw-r--r--pkgs/applications/science/biology/picard-tools/default.nix4
-rw-r--r--pkgs/applications/science/electronics/magic-vlsi/0001-strip-bin-prefix.patch10
-rw-r--r--pkgs/applications/science/electronics/magic-vlsi/0002-fix-format-security.patch19
-rw-r--r--pkgs/applications/science/electronics/magic-vlsi/default.nix36
-rw-r--r--pkgs/applications/science/logic/cryptominisat/default.nix4
-rw-r--r--pkgs/applications/science/logic/lean/default.nix4
-rw-r--r--pkgs/applications/science/math/mxnet/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-workspace/default.nix6
-rw-r--r--pkgs/applications/version-management/git-and-tools/gitui/default.nix24
-rw-r--r--pkgs/applications/version-management/git-lfs/default.nix20
-rw-r--r--pkgs/applications/video/plex-mpv-shim/default.nix4
-rw-r--r--pkgs/applications/video/shotcut/default.nix4
-rw-r--r--pkgs/applications/video/streamlink/default.nix4
-rw-r--r--pkgs/applications/virtualization/OVMF/default.nix2
-rw-r--r--pkgs/applications/virtualization/podman/wrapper.nix26
-rw-r--r--pkgs/applications/virtualization/tini/default.nix4
-rw-r--r--pkgs/applications/window-managers/i3/gaps.nix4
-rw-r--r--pkgs/build-support/docker/default.nix55
-rwxr-xr-xpkgs/build-support/fetchgit/nix-prefetch-git1
-rw-r--r--pkgs/build-support/fetchurl/default.nix2
-rw-r--r--pkgs/data/icons/papirus-icon-theme/default.nix4
-rw-r--r--pkgs/data/icons/pop-icon-theme/default.nix45
-rw-r--r--pkgs/desktops/deepin/deepin-anything/default.nix12
-rw-r--r--pkgs/desktops/lxqt/libqtxdg/default.nix2
-rw-r--r--pkgs/desktops/xfce/core/xfce4-panel/default.nix4
-rw-r--r--pkgs/development/compilers/binaryen/default.nix4
-rw-r--r--pkgs/development/compilers/edk2/default.nix41
-rw-r--r--pkgs/development/compilers/elm/default.nix2
-rw-r--r--pkgs/development/compilers/kotlin/default.nix4
-rw-r--r--pkgs/development/compilers/llvm/10/llvm.nix1
-rw-r--r--pkgs/development/compilers/llvm/7/llvm.nix1
-rw-r--r--pkgs/development/compilers/llvm/8/llvm.nix1
-rw-r--r--pkgs/development/compilers/llvm/9/llvm.nix1
-rw-r--r--pkgs/development/haskell-modules/configuration-common.nix2
-rw-r--r--pkgs/development/interpreters/bats/default.nix12
-rw-r--r--pkgs/development/interpreters/jelly/default.nix28
-rw-r--r--pkgs/development/interpreters/picoc/default.nix2
-rw-r--r--pkgs/development/interpreters/rakudo/zef.nix4
-rw-r--r--pkgs/development/interpreters/wasmtime/default.nix10
-rw-r--r--pkgs/development/libraries/armadillo/default.nix4
-rw-r--r--pkgs/development/libraries/audio/libbass/default.nix2
-rw-r--r--pkgs/development/libraries/aws-sdk-cpp/cmake-dirs.patch75
-rw-r--r--pkgs/development/libraries/aws-sdk-cpp/default.nix7
-rw-r--r--pkgs/development/libraries/boost/cmake-paths.patch21
-rw-r--r--pkgs/development/libraries/boost/generic.nix3
-rw-r--r--pkgs/development/libraries/boringssl/default.nix15
-rw-r--r--pkgs/development/libraries/catch2/default.nix4
-rw-r--r--pkgs/development/libraries/check/default.nix2
-rw-r--r--pkgs/development/libraries/exiv2/default.nix5
-rw-r--r--pkgs/development/libraries/gmp/5.1.x.nix2
-rw-r--r--pkgs/development/libraries/gmp/6.x.nix2
-rw-r--r--pkgs/development/libraries/gnutls-kdh/generic.nix2
-rw-r--r--pkgs/development/libraries/gnutls/default.nix2
-rw-r--r--pkgs/development/libraries/icu/67.nix4
-rw-r--r--pkgs/development/libraries/jsoncpp/default.nix4
-rw-r--r--pkgs/development/libraries/leatherman/default.nix4
-rw-r--r--pkgs/development/libraries/libcec/default.nix4
-rw-r--r--pkgs/development/libraries/libgpg-error/default.nix2
-rw-r--r--pkgs/development/libraries/libmypaint/default.nix8
-rw-r--r--pkgs/development/libraries/libosmium/default.nix4
-rw-r--r--pkgs/development/libraries/ndi/default.nix4
-rw-r--r--pkgs/development/ocaml-modules/async_find/default.nix22
-rw-r--r--pkgs/development/python-modules/autopep8/default.nix4
-rw-r--r--pkgs/development/python-modules/binwalk/default.nix3
-rw-r--r--pkgs/development/python-modules/eggdeps/default.nix2
-rw-r--r--pkgs/development/python-modules/kombu/default.nix8
-rw-r--r--pkgs/development/python-modules/langcodes/default.nix7
-rw-r--r--pkgs/development/python-modules/pylibftdi/default.nix4
-rw-r--r--pkgs/development/python-modules/pyopenssl/default.nix2
-rw-r--r--pkgs/development/python-modules/python-gitlab/default.nix16
-rw-r--r--pkgs/development/python-modules/python-telegram-bot/default.nix26
-rw-r--r--pkgs/development/python-modules/secure/default.nix3
-rw-r--r--pkgs/development/python-modules/wordfreq/default.nix27
-rw-r--r--pkgs/development/tools/analysis/checkstyle/default.nix4
-rw-r--r--pkgs/development/tools/analysis/codeql/default.nix4
-rw-r--r--pkgs/development/tools/azcopy/default.nix6
-rw-r--r--pkgs/development/tools/cmake-format/default.nix4
-rw-r--r--pkgs/development/tools/conftest/default.nix6
-rw-r--r--pkgs/development/tools/database/dbmate/default.nix6
-rw-r--r--pkgs/development/tools/database/liquibase/default.nix4
-rw-r--r--pkgs/development/tools/git-quick-stats/default.nix4
-rw-r--r--pkgs/development/tools/gotestsum/default.nix6
-rw-r--r--pkgs/development/tools/misc/ccls/default.nix4
-rw-r--r--pkgs/development/tools/misc/circleci-cli/default.nix6
-rw-r--r--pkgs/development/tools/misc/clojure-lsp/default.nix4
-rw-r--r--pkgs/development/tools/misc/strace/default.nix2
-rw-r--r--pkgs/development/tools/misc/sysbench/default.nix4
-rw-r--r--pkgs/development/tools/mod/default.nix6
-rw-r--r--pkgs/development/tools/packer/default.nix4
-rw-r--r--pkgs/development/tools/rust/cargo-udeps/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-xbuild/default.nix6
-rw-r--r--pkgs/development/tools/rust/cbindgen/default.nix6
-rw-r--r--pkgs/development/tools/wasm-bindgen-cli/0001-Add-cargo.lock.patch72
-rw-r--r--pkgs/development/tools/wasm-bindgen-cli/default.nix6
-rw-r--r--pkgs/development/web/flyctl/default.nix6
-rw-r--r--pkgs/games/dwarf-fortress/df_permission2
-rw-r--r--pkgs/games/endless-sky/default.nix4
-rw-r--r--pkgs/games/ezquake/default.nix4
-rw-r--r--pkgs/games/hyperrogue/default.nix4
-rw-r--r--pkgs/misc/apulse/default.nix4
-rw-r--r--pkgs/os-specific/darwin/skhd/default.nix8
-rw-r--r--pkgs/os-specific/darwin/yabai/default.nix6
-rw-r--r--pkgs/os-specific/linux/bcc/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix3
-rw-r--r--pkgs/os-specific/linux/kernel/hardened-patches.json24
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.14.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.19.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.4.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.9.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.4.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.6.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-testing.nix4
-rw-r--r--pkgs/os-specific/linux/setools/default.nix4
-rw-r--r--pkgs/os-specific/linux/syslinux/default.nix25
-rw-r--r--pkgs/os-specific/linux/wireguard/default.nix4
-rw-r--r--pkgs/servers/caddy/v2.nix11
-rw-r--r--pkgs/servers/coturn/default.nix9
-rw-r--r--pkgs/servers/http/jetty/default.nix4
-rw-r--r--pkgs/servers/imgproxy/default.nix6
-rw-r--r--pkgs/servers/jellyfin/default.nix4
-rw-r--r--pkgs/servers/minio/default.nix12
-rw-r--r--pkgs/servers/misc/airsonic/default.nix4
-rw-r--r--pkgs/servers/monitoring/thanos/default.nix6
-rw-r--r--pkgs/servers/sql/dolt/default.nix6
-rw-r--r--pkgs/servers/traefik/default.nix6
-rw-r--r--pkgs/shells/fish/default.nix68
-rw-r--r--pkgs/shells/powershell/default.nix47
-rw-r--r--pkgs/shells/zsh/oh-my-zsh/default.nix6
-rw-r--r--pkgs/tools/admin/lego/default.nix6
-rw-r--r--pkgs/tools/admin/lxd/default.nix7
-rw-r--r--pkgs/tools/admin/salt/default.nix39
-rw-r--r--pkgs/tools/archivers/afio/default.nix12
-rw-r--r--pkgs/tools/archivers/unar/default.nix59
-rw-r--r--pkgs/tools/compression/hactool/default.nix30
-rw-r--r--pkgs/tools/filesystems/catcli/default.nix4
-rw-r--r--pkgs/tools/filesystems/fuseiso/default.nix65
-rw-r--r--pkgs/tools/graphics/scrot/default.nix4
-rw-r--r--pkgs/tools/misc/autorandr/default.nix4
-rw-r--r--pkgs/tools/misc/bat-extras/default.nix147
-rw-r--r--pkgs/tools/misc/blsd/default.nix29
-rw-r--r--pkgs/tools/misc/blsd/deps.nix12
-rw-r--r--pkgs/tools/misc/chafa/default.nix4
-rw-r--r--pkgs/tools/misc/clipman/default.nix4
-rw-r--r--pkgs/tools/misc/dmg2img/default.nix17
-rw-r--r--pkgs/tools/misc/entr/default.nix4
-rw-r--r--pkgs/tools/misc/fluent-bit/default.nix4
-rw-r--r--pkgs/tools/misc/hpcg/default.nix35
-rw-r--r--pkgs/tools/misc/kak-lsp/default.nix6
-rw-r--r--pkgs/tools/misc/memtest86-efi/default.nix33
-rw-r--r--pkgs/tools/misc/pistol/default.nix7
-rw-r--r--pkgs/tools/misc/pspg/default.nix4
-rw-r--r--pkgs/tools/misc/silicon/default.nix6
-rw-r--r--pkgs/tools/misc/tmux/default.nix4
-rw-r--r--pkgs/tools/misc/woeusb/default.nix4
-rw-r--r--pkgs/tools/misc/youtube-dl/default.nix4
-rw-r--r--pkgs/tools/misc/zoxide/default.nix6
-rw-r--r--pkgs/tools/networking/amass/default.nix6
-rw-r--r--pkgs/tools/networking/bandwhich/default.nix6
-rw-r--r--pkgs/tools/networking/croc/default.nix6
-rw-r--r--pkgs/tools/networking/dnsproxy/default.nix6
-rw-r--r--pkgs/tools/networking/drill/default.nix30
-rw-r--r--pkgs/tools/networking/inadyn/default.nix4
-rw-r--r--pkgs/tools/networking/minio-client/default.nix10
-rw-r--r--pkgs/tools/networking/tendermint/default.nix6
-rw-r--r--pkgs/tools/nix/cached-nix-shell/default.nix2
-rw-r--r--pkgs/tools/nix/nixpkgs-fmt/default.nix11
-rw-r--r--pkgs/tools/package-management/nix/default.nix2
-rw-r--r--pkgs/tools/package-management/nixops/nixops-v1_6_1.nix2
-rw-r--r--pkgs/tools/security/bitwarden_rs/default.nix6
-rw-r--r--pkgs/tools/security/bitwarden_rs/vault.nix4
-rw-r--r--pkgs/tools/security/doas/default.nix14
-rw-r--r--pkgs/tools/security/hcxtools/default.nix4
-rw-r--r--pkgs/tools/security/keybase/default.nix6
-rw-r--r--pkgs/tools/security/keybase/gui.nix8
-rw-r--r--pkgs/tools/security/keybase/kbfs.nix2
-rw-r--r--pkgs/tools/system/bfs/default.nix4
-rw-r--r--pkgs/tools/system/kmon/default.nix6
-rw-r--r--pkgs/tools/typesetting/tex/texlive/default.nix2
-rw-r--r--pkgs/tools/virtualization/linode-cli/default.nix4
-rw-r--r--pkgs/tools/virtualization/vpsfree-client/Gemfile5
-rw-r--r--pkgs/tools/virtualization/vpsfree-client/Gemfile.lock75
-rw-r--r--pkgs/tools/virtualization/vpsfree-client/default.nix17
-rw-r--r--pkgs/tools/virtualization/vpsfree-client/gemset.nix316
-rw-r--r--pkgs/top-level/all-packages.nix44
-rw-r--r--pkgs/top-level/ocaml-packages.nix5
-rw-r--r--pkgs/top-level/perl-packages.nix13
-rw-r--r--pkgs/top-level/php-packages.nix8
287 files changed, 3108 insertions, 1345 deletions
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index f44338078097..48b84f8c36ce 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -15,7 +15,7 @@ Reviewing guidelines: https://hydra.nixos.org/job/nixpkgs/trunk/manual/latest/do
 
 <!-- Please check what applies. Note that these are not hard requirements but merely serve as information for reviewers. -->
 
-- [ ] Tested using sandboxing ([nix.useSandbox](http://nixos.org/nixos/manual/options.html#opt-nix.useSandbox) on NixOS, or option `sandbox` in [`nix.conf`](http://nixos.org/nix/manual/#sec-conf-file) on non-NixOS linux)
+- [ ] Tested using sandboxing ([nix.useSandbox](https://nixos.org/nixos/manual/options.html#opt-nix.useSandbox) on NixOS, or option `sandbox` in [`nix.conf`](https://nixos.org/nix/manual/#sec-conf-file) on non-NixOS linux)
 - Built on platform(s)
    - [ ] NixOS
    - [ ] macOS
diff --git a/doc/contributing/quick-start.xml b/doc/contributing/quick-start.xml
index 8e4e914d4511..09d60834ec29 100644
--- a/doc/contributing/quick-start.xml
+++ b/doc/contributing/quick-start.xml
@@ -111,7 +111,7 @@
     </para>
     <para>
      The exact syntax and semantics of the Nix expression language, including the built-in function, are described in the Nix manual in the <link
-    xlink:href="http://hydra.nixos.org/job/nix/trunk/tarball/latest/download-by-type/doc/manual/#chap-writing-nix-expressions">chapter on writing Nix expressions</link>.
+    xlink:href="https://hydra.nixos.org/job/nix/trunk/tarball/latest/download-by-type/doc/manual/#chap-writing-nix-expressions">chapter on writing Nix expressions</link>.
     </para>
    </listitem>
    <listitem>
diff --git a/doc/languages-frameworks/android.section.md b/doc/languages-frameworks/android.section.md
index 6ee450eeb59f..1a8924082bfb 100644
--- a/doc/languages-frameworks/android.section.md
+++ b/doc/languages-frameworks/android.section.md
@@ -167,7 +167,7 @@ parameters that the SDK composition function (the function shown in the
 previous section) supports.
 
 This build function is particularly useful when it is desired to use
-[Hydra](http://nixos.org/hydra): the Nix-based continuous integration solution
+[Hydra](https://nixos.org/hydra): the Nix-based continuous integration solution
 to build Android apps. An Android APK gets exposed as a build product and can be
 installed on any Android device with a web browser by navigating to the build
 result page.
diff --git a/doc/languages-frameworks/index.xml b/doc/languages-frameworks/index.xml
index 9364c764bbf9..a6f56d791c54 100644
--- a/doc/languages-frameworks/index.xml
+++ b/doc/languages-frameworks/index.xml
@@ -21,6 +21,7 @@
  <xi:include href="node.section.xml" />
  <xi:include href="ocaml.xml" />
  <xi:include href="perl.xml" />
+ <xi:include href="php.section.xml" />
  <xi:include href="python.section.xml" />
  <xi:include href="qt.xml" />
  <xi:include href="r.section.xml" />
diff --git a/doc/languages-frameworks/ios.section.md b/doc/languages-frameworks/ios.section.md
index 5a81795c004a..768e0690b962 100644
--- a/doc/languages-frameworks/ios.section.md
+++ b/doc/languages-frameworks/ios.section.md
@@ -18,7 +18,7 @@ The primary objective of this project is to use the Nix expression language to
 specify how iOS apps can be built from source code, and to automatically spawn
 iOS simulator instances for testing.
 
-This component also makes it possible to use [Hydra](http://nixos.org/hydra),
+This component also makes it possible to use [Hydra](https://nixos.org/hydra),
 the Nix-based continuous integration server to regularly build iOS apps and to
 do wireless ad-hoc installations of enterprise IPAs on iOS devices through
 Hydra.
diff --git a/doc/languages-frameworks/php.section.md b/doc/languages-frameworks/php.section.md
index 101f7b043fff..763beeb59358 100644
--- a/doc/languages-frameworks/php.section.md
+++ b/doc/languages-frameworks/php.section.md
@@ -1,10 +1,8 @@
-# PHP
+# PHP {#sec-php}
 
-## User Guide
+## User Guide {#ssec-php-user-guide}
 
-### Using PHP
-
-#### Overview
+### Overview {#ssec-php-user-guide-overview}
 
 Several versions of PHP are available on Nix, each of which having a
 wide variety of extensions and libraries available.
@@ -36,7 +34,7 @@ opcache extension shipped with PHP is available at
 `php.extensions.opcache` and the third-party ImageMagick extension at
 `php.extensions.imagick`.
 
-#### Installing PHP with extensions
+### Installing PHP with extensions {#ssec-php-user-guide-installing-with-extensions}
 
 A PHP package with specific extensions enabled can be built using
 `php.withExtensions`. This is a function which accepts an anonymous
@@ -64,7 +62,7 @@ To build your list of extensions from the ground up, you can simply
 ignore `enabled`:
 
 ```nix
-php.withExtensions ({ all, ... }: with all; [ opcache imagick ])
+php.withExtensions ({ all, ... }: with all; [ imagick opcache ])
 ```
 
 `php.withExtensions` provides extensions by wrapping a minimal php
@@ -89,14 +87,14 @@ php.buildEnv {
 }
 ```
 
-##### Example setup for `phpfpm`
+#### Example setup for `phpfpm` {#ssec-php-user-guide-installing-with-extensions-phpfpm}
 
 You can use the previous examples in a `phpfpm` pool called `foo` as
 follows:
 
 ```nix
 let
-  myPhp = php.withExtensions ({ all, ... }: with all; [ opcache imagick ]);
+  myPhp = php.withExtensions ({ all, ... }: with all; [ imagick opcache ]);
 in {
   services.phpfpm.pools."foo".phpPackage = myPhp;
 };
@@ -113,7 +111,7 @@ in {
 };
 ```
 
-##### Example usage with `nix-shell`
+#### Example usage with `nix-shell` {#ssec-php-user-guide-installing-with-extensions-nix-shell}
 
 This brings up a temporary environment that contains a PHP interpreter
 with the extensions `imagick` and `opcache` enabled:
@@ -121,3 +119,19 @@ with the extensions `imagick` and `opcache` enabled:
 ```sh
 nix-shell -p 'php.withExtensions ({ all, ... }: with all; [ imagick opcache ])'
 ```
+
+### Installing PHP packages with extensions {#ssec-php-user-guide-installing-packages-with-extensions}
+
+All interactive tools use the PHP package you get them from, so all
+packages at `php.packages.*` use the `php` package with its default
+extensions. Sometimes this default set of extensions isn't enough and
+you may want to extend it. A common case of this is the `composer`
+package: a project may depend on certain extensions and `composer`
+won't work with that project unless those extensions are loaded.
+
+Example of building `composer` with additional extensions:
+```nix
+(php.withExtensions ({ all, enabled }:
+  enabled ++ (with all; [ imagick redis ]))
+).packages.composer
+```
diff --git a/doc/preface.chapter.md b/doc/preface.chapter.md
index 7fa65ab11021..549e42de7aa0 100644
--- a/doc/preface.chapter.md
+++ b/doc/preface.chapter.md
@@ -42,7 +42,7 @@ distributed as soon as all tests for that channel pass, e.g.
 [this table](https://hydra.nixos.org/job/nixpkgs/trunk/unstable#tabs-constituents)
 shows the status of tests for the `nixpkgs` channel.
 
-The tests are conducted by a cluster called [Hydra](http://nixos.org/hydra/),
+The tests are conducted by a cluster called [Hydra](https://nixos.org/hydra/),
 which also builds binary packages from the Nix expressions in Nixpkgs for
 `x86_64-linux`, `i686-linux` and `x86_64-darwin`.
 The binaries are made available via a [binary cache](https://cache.nixos.org).
diff --git a/doc/release-notes.xml b/doc/release-notes.xml
index 7575289e7559..a15f54667290 100644
--- a/doc/release-notes.xml
+++ b/doc/release-notes.xml
@@ -286,7 +286,7 @@ export NIX_MIRRORS_sourceforge=http://osdn.dl.sourceforge.net/sourceforge/</prog
   <note>
    <para>
     This release of Nixpkgs requires <link
-xlink:href='http://nixos.org/releases/nix/nix-0.10/'>Nix 0.10</link> or higher.
+xlink:href='https://nixos.org/releases/nix/nix-0.10/'>Nix 0.10</link> or higher.
    </para>
   </note>
 
@@ -436,7 +436,7 @@ stdenv.mkDerivation {
    <listitem>
     <para>
      Distribution files have been moved to <link
-  xlink:href="http://nixos.org/" />.
+  xlink:href="https://nixos.org/" />.
     </para>
    </listitem>
    <listitem>
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 02114a9f0049..b4552bd874f1 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -758,7 +758,7 @@
     name = "Jonathan Glines";
   };
   avaq = {
-    email = "avaq+nixos@xs4all.nl";
+    email = "nixpkgs@account.avaq.it";
     github = "avaq";
     githubId = 1217745;
     name = "Aldwin Vlasblom";
@@ -4084,6 +4084,12 @@
     githubId = 6346418;
     name = "Kolby Crouch";
   };
+  kolloch = {
+    email = "info@eigenvalue.net";
+    github = "kolloch";
+    githubId = 339354;
+    name = "Peter Kolloch";
+  };
   konimex = {
     email = "herdiansyah@netc.eu";
     github = "konimex";
@@ -4423,6 +4429,16 @@
       fingerprint = "74F5 E5CC 19D3 B5CB 608F  6124 68FF 81E6 A785 0F49";
     }];
   };
+  lourkeur = {
+    name = "Louis Bettens";
+    email = "louis@bettens.info";
+    github = "lourkeur";
+    githubId = 15657735;
+    keys = [{
+      longkeyid = "ed25519/0xDFE1D4A017337E2A";
+      fingerprint = "5B93 9CFA E8FC 4D8F E07A  3AEA DFE1 D4A0 1733 7E2A";
+    }];
+  };
   luis = {
     email = "luis.nixos@gmail.com";
     github = "Luis-Hebendanz";
@@ -7130,6 +7146,12 @@
     githubId = 602439;
     name = "Serguei Narojnyi";
   };
+  snicket2100 = {
+    email = "57048005+snicket2100@users.noreply.github.com";
+    github = "snicket2100";
+    githubId = 57048005;
+    name = "snicket2100";
+  };
   snyh = {
     email = "snyh@snyh.org";
     github = "snyh";
diff --git a/maintainers/scripts/hydra-eval-failures.py b/maintainers/scripts/hydra-eval-failures.py
index 6e7ec2dbc002..0f738c5427bd 100755
--- a/maintainers/scripts/hydra-eval-failures.py
+++ b/maintainers/scripts/hydra-eval-failures.py
@@ -79,7 +79,7 @@ def cli(jobset):
     and print a summary of failed builds
     """
 
-    url = "http://hydra.nixos.org/jobset/{}".format(jobset)
+    url = "https://hydra.nixos.org/jobset/{}".format(jobset)
 
     # get the last evaluation
     click.echo(click.style(
diff --git a/nixos/README b/nixos/README
index 4ecf648a9302..ce4dd1988d2d 100644
--- a/nixos/README
+++ b/nixos/README
@@ -2,4 +2,4 @@
 
 NixOS is a Linux distribution based on the purely functional package
 management system Nix.  More information can be found at
-http://nixos.org/nixos and in the manual in doc/manual.
+https://nixos.org/nixos and in the manual in doc/manual.
diff --git a/nixos/doc/manual/configuration/adding-custom-packages.xml b/nixos/doc/manual/configuration/adding-custom-packages.xml
index 182641055e4d..02cb78f47e8b 100644
--- a/nixos/doc/manual/configuration/adding-custom-packages.xml
+++ b/nixos/doc/manual/configuration/adding-custom-packages.xml
@@ -11,7 +11,7 @@
   the package to your clone, and (optionally) submit a patch or pull request to
   have it accepted into the main Nixpkgs repository. This is described in
   detail in the <link
-xlink:href="http://nixos.org/nixpkgs/manual">Nixpkgs
+xlink:href="https://nixos.org/nixpkgs/manual">Nixpkgs
   manual</link>. In short, you clone Nixpkgs:
 <screen>
 <prompt>$ </prompt>git clone https://github.com/NixOS/nixpkgs
diff --git a/nixos/doc/manual/configuration/config-syntax.xml b/nixos/doc/manual/configuration/config-syntax.xml
index 5ef498cf9ae3..5526dea247c0 100644
--- a/nixos/doc/manual/configuration/config-syntax.xml
+++ b/nixos/doc/manual/configuration/config-syntax.xml
@@ -14,7 +14,7 @@
   when managing complex systems. The syntax and semantics of the Nix language
   are fully described in the
   <link
-xlink:href="http://nixos.org/nix/manual/#chap-writing-nix-expressions">Nix
+xlink:href="https://nixos.org/nix/manual/#chap-writing-nix-expressions">Nix
   manual</link>, but here we give a short overview of the most important
   constructs useful in NixOS configuration files.
  </para>
diff --git a/nixos/doc/manual/configuration/summary.xml b/nixos/doc/manual/configuration/summary.xml
index ea980254a8fc..289face16de9 100644
--- a/nixos/doc/manual/configuration/summary.xml
+++ b/nixos/doc/manual/configuration/summary.xml
@@ -10,7 +10,7 @@
   expression language. It’s not complete. In particular, there are many other
   built-in functions. See the
   <link
-xlink:href="http://nixos.org/nix/manual/#chap-writing-nix-expressions">Nix
+xlink:href="https://nixos.org/nix/manual/#chap-writing-nix-expressions">Nix
   manual</link> for the rest.
  </para>
 
diff --git a/nixos/doc/manual/development/releases.xml b/nixos/doc/manual/development/releases.xml
index cc0ec78cc74e..8abc66dfec19 100755
--- a/nixos/doc/manual/development/releases.xml
+++ b/nixos/doc/manual/development/releases.xml
@@ -57,7 +57,7 @@
     <listitem>
      <para>
       <link xlink:href="https://github.com/NixOS/nixos-org-configurations/pull/18">
-      Make sure a channel is created at http://nixos.org/channels/. </link>
+      Make sure a channel is created at https://nixos.org/channels/. </link>
      </para>
     </listitem>
     <listitem>
diff --git a/nixos/doc/manual/development/replace-modules.xml b/nixos/doc/manual/development/replace-modules.xml
index b4a466e22942..9fc5678ca1b3 100644
--- a/nixos/doc/manual/development/replace-modules.xml
+++ b/nixos/doc/manual/development/replace-modules.xml
@@ -37,7 +37,7 @@
 
   imports =
     [ # Use postgresql service from nixos-unstable channel.
-      # sudo nix-channel --add http://nixos.org/channels/nixos-unstable nixos-unstable
+      # sudo nix-channel --add https://nixos.org/channels/nixos-unstable nixos-unstable
       &lt;nixos-unstable/nixos/modules/services/databases/postgresql.nix&gt;
     ];
 
diff --git a/nixos/doc/manual/installation/obtaining.xml b/nixos/doc/manual/installation/obtaining.xml
index 56af5c0e25a0..3b8671782ded 100644
--- a/nixos/doc/manual/installation/obtaining.xml
+++ b/nixos/doc/manual/installation/obtaining.xml
@@ -7,7 +7,7 @@
  <para>
   NixOS ISO images can be downloaded from the
   <link
-xlink:href="http://nixos.org/nixos/download.html">NixOS download
+xlink:href="https://nixos.org/nixos/download.html">NixOS download
   page</link>. There are a number of installation options. If you happen to
   have an optical drive and a spare CD, burning the image to CD and booting
   from that is probably the easiest option. Most people will need to prepare a
@@ -26,7 +26,7 @@ xlink:href="https://nixos.wiki/wiki/NixOS_Installation_Guide#Making_the_installa
     <para>
      Using virtual appliances in Open Virtualization Format (OVF) that can be
      imported into VirtualBox. These are available from the
-     <link xlink:href="http://nixos.org/nixos/download.html">NixOS download
+     <link xlink:href="https://nixos.org/nixos/download.html">NixOS download
      page</link>.
     </para>
    </listitem>
diff --git a/nixos/doc/manual/release-notes/rl-1404.xml b/nixos/doc/manual/release-notes/rl-1404.xml
index 8d8cea4303a3..56dbb74a71d5 100644
--- a/nixos/doc/manual/release-notes/rl-1404.xml
+++ b/nixos/doc/manual/release-notes/rl-1404.xml
@@ -49,7 +49,7 @@
     <para>
      Nix has been updated to 1.7
      (<link
-  xlink:href="http://nixos.org/nix/manual/#ssec-relnotes-1.7">details</link>).
+  xlink:href="https://nixos.org/nix/manual/#ssec-relnotes-1.7">details</link>).
     </para>
    </listitem>
    <listitem>
diff --git a/nixos/doc/manual/release-notes/rl-1509.xml b/nixos/doc/manual/release-notes/rl-1509.xml
index 5c4d99701785..098c8c5095b2 100644
--- a/nixos/doc/manual/release-notes/rl-1509.xml
+++ b/nixos/doc/manual/release-notes/rl-1509.xml
@@ -22,7 +22,7 @@
     in excess of 8,000 Haskell packages. Detailed instructions on how to use
     that infrastructure can be found in the
     <link
-    xlink:href="http://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure">User's
+    xlink:href="https://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure">User's
     Guide to the Haskell Infrastructure</link>. Users migrating from an earlier
     release may find helpful information below, in the list of
     backwards-incompatible changes. Furthermore, we distribute 51(!) additional
@@ -555,7 +555,7 @@ nix-env -f &quot;&lt;nixpkgs&gt;&quot; -iA haskellPackages.pandoc
      the compiler now is the <literal>haskellPackages.ghcWithPackages</literal>
      function. The
      <link
-    xlink:href="http://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure">User's
+    xlink:href="https://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure">User's
      Guide to the Haskell Infrastructure</link> provides more information about
      this subject.
     </para>
diff --git a/nixos/doc/manual/release-notes/rl-1603.xml b/nixos/doc/manual/release-notes/rl-1603.xml
index 9b512c4b1e58..6d4b28825fa9 100644
--- a/nixos/doc/manual/release-notes/rl-1603.xml
+++ b/nixos/doc/manual/release-notes/rl-1603.xml
@@ -54,7 +54,7 @@
     xlink:href="https://reproducible-builds.org/specs/source-date-epoch/">SOURCE_DATE_EPOCH</envar>
     to a deterministic value, and Nix has
     <link
-    xlink:href="http://nixos.org/nix/manual/#ssec-relnotes-1.11">gained
+    xlink:href="https://nixos.org/nix/manual/#ssec-relnotes-1.11">gained
     an option</link> to repeat a build a number of times to test determinism.
     An ongoing project, the goal of exact reproducibility is to allow binaries
     to be verified independently (e.g., a user might only trust binaries that
diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml
index 78b8eee47efe..c6a766cc045a 100644
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@@ -55,6 +55,12 @@
      The new <varname>virtualisation.containers</varname> module manages configuration shared by the CRI-O and Podman modules.
     </para>
    </listitem>
+   <listitem>
+    <para>
+      Declarative Docker containers are renamed from <varname>docker-containers</varname> to <varname>virtualisation.oci-containers.containers</varname>.
+      This is to make it possible to use <literal>podman</literal> instead of <literal>docker</literal>.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 0cd17775e516..28f536056bf1 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -984,9 +984,9 @@
   ./virtualisation/container-config.nix
   ./virtualisation/containers.nix
   ./virtualisation/nixos-containers.nix
+  ./virtualisation/oci-containers.nix
   ./virtualisation/cri-o.nix
   ./virtualisation/docker.nix
-  ./virtualisation/docker-containers.nix
   ./virtualisation/ecs-agent.nix
   ./virtualisation/libvirtd.nix
   ./virtualisation/lxc.nix
diff --git a/nixos/modules/programs/venus.nix b/nixos/modules/programs/venus.nix
index 110570ac3f06..58faf38777d0 100644
--- a/nixos/modules/programs/venus.nix
+++ b/nixos/modules/programs/venus.nix
@@ -75,7 +75,7 @@ in
       };
 
       link = mkOption {
-        default = "http://planet.nixos.org";
+        default = "https://planet.nixos.org";
         type = types.str;
         description = ''
           Link to the main page.
diff --git a/nixos/modules/security/acme.nix b/nixos/modules/security/acme.nix
index 36f91529265e..776ef07d716c 100644
--- a/nixos/modules/security/acme.nix
+++ b/nixos/modules/security/acme.nix
@@ -87,19 +87,19 @@ let
         default = {};
         example = literalExample ''
           {
-            "example.org" = "/srv/http/nginx";
+            "example.org" = null;
             "mydomain.org" = null;
           }
         '';
         description = ''
-          A list of extra domain names, which are included in the one certificate to be issued, with their
-          own server roots if needed.
+          A list of extra domain names, which are included in the one certificate to be issued.
+          Setting a distinct server root is deprecated and not functional in 20.03+
         '';
       };
 
       keyType = mkOption {
         type = types.str;
-        default = "ec384";
+        default = "ec256";
         description = ''
           Key type to use for private keys.
           For an up to date list of supported values check the --key-type option
@@ -250,7 +250,7 @@ in
             "example.com" = {
               webroot = "/var/www/challenges/";
               email = "foo@example.com";
-              extraDomains = { "www.example.com" = null; "foo.example.com" = "/var/www/foo/"; };
+              extraDomains = { "www.example.com" = null; "foo.example.com" = null; };
             };
             "bar.example.com" = {
               webroot = "/var/www/challenges/";
diff --git a/nixos/modules/security/acme.xml b/nixos/modules/security/acme.xml
index 2b29c1174845..f802faee9749 100644
--- a/nixos/modules/security/acme.xml
+++ b/nixos/modules/security/acme.xml
@@ -6,92 +6,249 @@
  <title>SSL/TLS Certificates with ACME</title>
  <para>
   NixOS supports automatic domain validation &amp; certificate retrieval and
-  renewal using the ACME protocol. This is currently only implemented by and
-  for Let's Encrypt. The alternative ACME client <literal>lego</literal> is
-  used under the hood.
+  renewal using the ACME protocol. Any provider can be used, but by default
+  NixOS uses Let's Encrypt. The alternative ACME client <literal>lego</literal>
+  is used under the hood.
+ </para>
+ <para>
+  Automatic cert validation and configuration for Apache and Nginx virtual
+  hosts is included in NixOS, however if you would like to generate a wildcard
+  cert or you are not using a web server you will have to configure DNS
+  based validation.
  </para>
  <section xml:id="module-security-acme-prerequisites">
   <title>Prerequisites</title>
 
   <para>
-   You need to have a running HTTP server for verification. The server must
-   have a webroot defined that can serve
+   To use the ACME module, you must accept the provider's terms of service
+   by setting <literal><xref linkend="opt-security.acme.acceptTerms" /></literal>
+   to <literal>true</literal>. The Let's Encrypt ToS can be found
+   <link xlink:href="https://letsencrypt.org/repository/">here</link>.
+  </para>
+
+  <para>
+   You must also set an email address to be used when creating accounts with
+   Let's Encrypt. You can set this for all certs with
+   <literal><xref linkend="opt-security.acme.email" /></literal>
+   and/or on a per-cert basis with
+   <literal><xref linkend="opt-security.acme.certs._name_.email" /></literal>.
+   This address is only used for registration and renewal reminders,
+   and cannot be used to administer the certificates in any way.
+  </para>
+
+  <para>
+   Alternatively, you can use a different ACME server by changing the
+   <literal><xref linkend="opt-security.acme.server" /></literal> option
+   to a provider of your choosing, or just change the server for one cert with
+   <literal><xref linkend="opt-security.acme.certs._name_.server" /></literal>.
+  </para>
+
+  <para>
+   You will need an HTTP server or DNS server for verification. For HTTP,
+   the server must have a webroot defined that can serve
    <filename>.well-known/acme-challenge</filename>. This directory must be
-   writeable by the user that will run the ACME client.
+   writeable by the user that will run the ACME client. For DNS, you must
+   set up credentials with your provider/server for use with lego.
   </para>
+ </section>
+ <section xml:id="module-security-acme-nginx">
+  <title>Using ACME certificates in Nginx</title>
 
   <para>
-   For instance, this generic snippet could be used for Nginx:
+   NixOS supports fetching ACME certificates for you by setting
+   <literal><link linkend="opt-services.nginx.virtualHosts._name_.enableACME">enableACME</link>
+   = true;</literal> in a virtualHost config. We first create self-signed
+   placeholder certificates in place of the real ACME certs. The placeholder
+   certs are overwritten when the ACME certs arrive. For
+   <literal>foo.example.com</literal> the config would look like.
+  </para>
+
 <programlisting>
-http {
-  server {
-    server_name _;
-    listen 80;
-    listen [::]:80;
-
-    location /.well-known/acme-challenge {
-      root /var/www/challenges;
-    }
+<xref linkend="opt-security.acme.acceptTerms" /> = true;
+<xref linkend="opt-security.acme.email" /> = "admin+acme@example.com";
+services.nginx = {
+  <link linkend="opt-services.nginx.enable">enable</link> = true;
+  <link linkend="opt-services.nginx.virtualHosts">virtualHosts</link> = {
+    "foo.example.com" = {
+      <link linkend="opt-services.nginx.virtualHosts._name_.forceSSL">forceSSL</link> = true;
+      <link linkend="opt-services.nginx.virtualHosts._name_.enableACME">enableACME</link> = true;
+      # All serverAliases will be added as <link linkend="opt-security.acme.certs._name_.extraDomains">extra domains</link> on the certificate.
+      <link linkend="opt-services.nginx.virtualHosts._name_.serverAliases">serverAliases</link> = [ "bar.example.com" ];
+      locations."/" = {
+        <link linkend="opt-services.nginx.virtualHosts._name_.locations._name_.root">root</link> = "/var/www";
+      };
+    };
 
-    location / {
-      return 301 https://$host$request_uri;
-    }
-  }
+    # We can also add a different vhost and reuse the same certificate
+    # but we have to append extraDomains manually.
+    <link linkend="opt-security.acme.certs._name_.extraDomains">security.acme.certs."foo.example.com".extraDomains."baz.example.com"</link> = null;
+    "baz.example.com" = {
+      <link linkend="opt-services.nginx.virtualHosts._name_.forceSSL">forceSSL</link> = true;
+      <link linkend="opt-services.nginx.virtualHosts._name_.useACMEHost">useACMEHost</link> = "foo.example.com";
+      locations."/" = {
+        <link linkend="opt-services.nginx.virtualHosts._name_.locations._name_.root">root</link> = "/var/www";
+      };
+    };
+  };
 }
 </programlisting>
+ </section>
+ <section xml:id="module-security-acme-httpd">
+  <title>Using ACME certificates in Apache/httpd</title>
+
+  <para>
+   Using ACME certificates with Apache virtual hosts is identical
+   to using them with Nginx. The attribute names are all the same, just replace
+   "nginx" with "httpd" where appropriate.
   </para>
  </section>
  <section xml:id="module-security-acme-configuring">
-  <title>Configuring</title>
+  <title>Manual configuration of HTTP-01 validation</title>
 
   <para>
-   To enable ACME certificate retrieval &amp; renewal for a certificate for
-   <literal>foo.example.com</literal>, add the following in your
-   <filename>configuration.nix</filename>:
+   First off you will need to set up a virtual host to serve the challenges.
+   This example uses a vhost called <literal>certs.example.com</literal>, with
+   the intent that you will generate certs for all your vhosts and redirect
+   everyone to HTTPS.
+  </para>
+
+<programlisting>
+<xref linkend="opt-security.acme.acceptTerms" /> = true;
+<xref linkend="opt-security.acme.email" /> = "admin+acme@example.com";
+services.nginx = {
+  <link linkend="opt-services.nginx.enable">enable</link> = true;
+  <link linkend="opt-services.nginx.virtualHosts">virtualHosts</link> = {
+    "acmechallenge.example.com" = {
+      # Catchall vhost, will redirect users to HTTPS for all vhosts
+      <link linkend="opt-services.nginx.virtualHosts._name_.serverAliases">serverAliases</link> = [ "*.example.com" ];
+      # /var/lib/acme/.challenges must be writable by the ACME user
+      # and readable by the Nginx user.
+      # By default, this is the case.
+      locations."/.well-known/acme-challenge" = {
+        <link linkend="opt-services.nginx.virtualHosts._name_.locations._name_.root">root</link> = "/var/lib/acme/.challenges";
+      };
+      locations."/" = {
+        <link linkend="opt-services.nginx.virtualHosts._name_.locations._name_.return">return</link> = "301 https://$host$request_uri";
+      };
+    };
+  };
+}
+# Alternative config for Apache
+services.httpd = {
+  <link linkend="opt-services.httpd.enable">enable = true;</link>
+  <link linkend="opt-services.httpd.virtualHosts">virtualHosts</link> = {
+    "acmechallenge.example.com" = {
+      # Catchall vhost, will redirect users to HTTPS for all vhosts
+      <link linkend="opt-services.httpd.virtualHosts._name_.serverAliases">serverAliases</link> = [ "*.example.com" ];
+      # /var/lib/acme/.challenges must be writable by the ACME user and readable by the Apache user.
+      # By default, this is the case.
+      <link linkend="opt-services.httpd.virtualHosts._name_.documentRoot">documentRoot</link> = "/var/lib/acme/.challenges";
+      <link linkend="opt-services.httpd.virtualHosts._name_.extraConfig">extraConfig</link> = ''
+        RewriteEngine On
+        RewriteCond %{HTTPS} off
+        RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge [NC]
+        RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301]
+      '';
+    };
+  };
+}
+</programlisting>
+
+  <para>
+   Now you need to configure ACME to generate a certificate.
+  </para>
+
 <programlisting>
 <xref linkend="opt-security.acme.certs"/>."foo.example.com" = {
-  <link linkend="opt-security.acme.certs._name_.webroot">webroot</link> = "/var/www/challenges";
+  <link linkend="opt-security.acme.certs._name_.webroot">webroot</link> = "/var/lib/acme/.challenges";
   <link linkend="opt-security.acme.certs._name_.email">email</link> = "foo@example.com";
+  # Since we have a wildcard vhost to handle port 80,
+  # we can generate certs for anything!
+  # Just make sure your DNS resolves them.
+  <link linkend="opt-security.acme.certs._name_.extraDomains">extraDomains</link> = [ "mail.example.com" ];
 };
 </programlisting>
-  </para>
 
   <para>
    The private key <filename>key.pem</filename> and certificate
    <filename>fullchain.pem</filename> will be put into
    <filename>/var/lib/acme/foo.example.com</filename>.
   </para>
+
   <para>
    Refer to <xref linkend="ch-options" /> for all available configuration
    options for the <link linkend="opt-security.acme.certs">security.acme</link>
    module.
   </para>
  </section>
- <section xml:id="module-security-acme-nginx">
-  <title>Using ACME certificates in Nginx</title>
+ <section xml:id="module-security-acme-config-dns">
+  <title>Configuring ACME for DNS validation</title>
 
   <para>
-   NixOS supports fetching ACME certificates for you by setting
-   <literal><link linkend="opt-services.nginx.virtualHosts._name_.enableACME">enableACME</link>
-   = true;</literal> in a virtualHost config. We first create self-signed
-   placeholder certificates in place of the real ACME certs. The placeholder
-   certs are overwritten when the ACME certs arrive. For
-   <literal>foo.example.com</literal> the config would look like.
+   This is useful if you want to generate a wildcard certificate, since
+   ACME servers will only hand out wildcard certs over DNS validation.
+   There a number of supported DNS providers and servers you can utilise,
+   see the <link xlink:href="https://go-acme.github.io/lego/dns/">lego docs</link>
+   for provider/server specific configuration values. For the sake of these
+   docs, we will provide a fully self-hosted example using bind.
   </para>
 
 <programlisting>
-services.nginx = {
-  <link linkend="opt-services.nginx.enable">enable = true;</link>
-  <link linkend="opt-services.nginx.virtualHosts">virtualHosts</link> = {
-    "foo.example.com" = {
-      <link linkend="opt-services.nginx.virtualHosts._name_.forceSSL">forceSSL</link> = true;
-      <link linkend="opt-services.nginx.virtualHosts._name_.enableACME">enableACME</link> = true;
-      locations."/" = {
-        <link linkend="opt-services.nginx.virtualHosts._name_.locations._name_.root">root</link> = "/var/www";
-      };
-    };
-  };
+services.bind = {
+  <link linkend="opt-services.bind.enable">enable</link> = true;
+  <link linkend="opt-services.bind.extraConfig">extraConfig</link> = ''
+    include "/var/lib/secrets/dnskeys.conf";
+  '';
+  <link linkend="opt-services.bind.zones">zones</link> = [
+    rec {
+      name = "example.com";
+      file = "/var/db/bind/${name}";
+      master = true;
+      extraConfig = "allow-update { key rfc2136key.example.com.; };";
+    }
+  ];
 }
+
+# Now we can configure ACME
+<xref linkend="opt-security.acme.acceptTerms" /> = true;
+<xref linkend="opt-security.acme.email" /> = "admin+acme@example.com";
+<xref linkend="opt-security.acme.certs" />."example.com" = {
+  <link linkend="opt-security.acme.certs._name_.domain">domain</link> = "*.example.com";
+  <link linkend="opt-security.acme.certs._name_.dnsProvider">dnsProvider</link> = "rfc2136";
+  <link linkend="opt-security.acme.certs._name_.credentialsFile">credentialsFile</link> = "/var/lib/secrets/certs.secret";
+  # We don't need to wait for propagation since this is a local DNS server
+  <link linkend="opt-security.acme.certs._name_.dnsPropagationCheck">dnsPropagationCheck</link> = false;
+};
 </programlisting>
+
+  <para>
+   The <filename>dnskeys.conf</filename> and <filename>certs.secret</filename>
+   must be kept secure and thus you should not keep their contents in your
+   Nix config. Instead, generate them one time with these commands:
+  </para>
+
+<programlisting>
+mkdir -p /var/lib/secrets
+tsig-keygen rfc2136key.example.com &gt; /var/lib/secrets/dnskeys.conf
+chown named:root /var/lib/secrets/dnskeys.conf
+chmod 400 /var/lib/secrets/dnskeys.conf
+
+# Copy the secret value from the dnskeys.conf, and put it in
+# RFC2136_TSIG_SECRET below
+
+cat &gt; /var/lib/secrets/certs.secret &lt;&lt; EOF
+RFC2136_NAMESERVER='127.0.0.1:53'
+RFC2136_TSIG_ALGORITHM='hmac-sha256.'
+RFC2136_TSIG_KEY='rfc2136key.example.com'
+RFC2136_TSIG_SECRET='your secret key'
+EOF
+chmod 400 /var/lib/secrets/certs.secret
+</programlisting>
+
+  <para>
+   Now you're all set to generate certs! You should monitor the first invokation
+   by running <literal>systemctl start acme-example.com.service &amp;
+   journalctl -fu acme-example.com.service</literal> and watching its log output.
+  </para>
  </section>
 </chapter>
diff --git a/nixos/modules/services/editors/emacs.xml b/nixos/modules/services/editors/emacs.xml
index 03483f69fa2f..74c60014dcea 100644
--- a/nixos/modules/services/editors/emacs.xml
+++ b/nixos/modules/services/editors/emacs.xml
@@ -294,7 +294,7 @@ https://nixos.org/nixpkgs/manual/#sec-modify-via-packageOverrides
     If you are not on NixOS or want to install this particular Emacs only for
     yourself, you can do so by adding it to your
     <filename>~/.config/nixpkgs/config.nix</filename> (see
-    <link xlink:href="http://nixos.org/nixpkgs/manual/#sec-modify-via-packageOverrides">Nixpkgs
+    <link xlink:href="https://nixos.org/nixpkgs/manual/#sec-modify-via-packageOverrides">Nixpkgs
     manual</link>):
     <example xml:id="module-services-emacs-config-nix">
      <title>Custom Emacs in <filename>~/.config/nixpkgs/config.nix</filename></title>
diff --git a/nixos/modules/services/misc/nix-daemon.nix b/nixos/modules/services/misc/nix-daemon.nix
index 0c2407e1dd2f..b28e3679d1c7 100644
--- a/nixos/modules/services/misc/nix-daemon.nix
+++ b/nixos/modules/services/misc/nix-daemon.nix
@@ -283,7 +283,7 @@ in
       trustedBinaryCaches = mkOption {
         type = types.listOf types.str;
         default = [ ];
-        example = [ "http://hydra.nixos.org/" ];
+        example = [ "https://hydra.nixos.org/" ];
         description = ''
           List of binary cache URLs that non-root users can use (in
           addition to those specified using
diff --git a/nixos/modules/services/misc/octoprint.nix b/nixos/modules/services/misc/octoprint.nix
index 651ed3743884..7a71d2c8c6aa 100644
--- a/nixos/modules/services/misc/octoprint.nix
+++ b/nixos/modules/services/misc/octoprint.nix
@@ -17,9 +17,9 @@ let
 
   cfgUpdate = pkgs.writeText "octoprint-config.yaml" (builtins.toJSON fullConfig);
 
-  pluginsEnv = pkgs.python.buildEnv.override {
-    extraLibs = cfg.plugins pkgs.octoprint-plugins;
-  };
+  pluginsEnv = package.python.withPackages (ps: [ps.octoprint] ++ (cfg.plugins ps));
+
+  package = pkgs.octoprint;
 
 in
 {
@@ -106,7 +106,6 @@ in
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
       path = [ pluginsEnv ];
-      environment.PYTHONPATH = makeSearchPathOutput "lib" pkgs.python.sitePackages [ pluginsEnv ];
 
       preStart = ''
         if [ -e "${cfg.stateDir}/config.yaml" ]; then
@@ -119,7 +118,7 @@ in
       '';
 
       serviceConfig = {
-        ExecStart = "${pkgs.octoprint}/bin/octoprint serve -b ${cfg.stateDir}";
+        ExecStart = "${pluginsEnv}/bin/octoprint serve -b ${cfg.stateDir}";
         User = cfg.user;
         Group = cfg.group;
       };
diff --git a/nixos/modules/services/networking/prosody.nix b/nixos/modules/services/networking/prosody.nix
index 9825613d809f..cdd341c9fb62 100644
--- a/nixos/modules/services/networking/prosody.nix
+++ b/nixos/modules/services/networking/prosody.nix
@@ -382,6 +382,11 @@ let
         default = "en";
         description = "Default room language.";
       };
+      extraConfig = mkOption {
+        type = types.lines;
+        default = "";
+        description = "Additional MUC specific configuration";
+      };
     };
   };
 
@@ -792,6 +797,8 @@ in
 
       https_ports = ${toLua cfg.httpsPorts}
 
+      ${ cfg.extraConfig }
+
       ${lib.concatMapStrings (muc: ''
         Component ${toLua muc.domain} "muc"
             modules_enabled = { "muc_mam"; ${optionalString muc.vcard_muc ''"vcard_muc";'' } }
@@ -809,8 +816,8 @@ in
             muc_room_default_change_subject = ${toLua muc.roomDefaultChangeSubject}
             muc_room_default_history_length = ${toLua muc.roomDefaultHistoryLength}
             muc_room_default_language = ${toLua muc.roomDefaultLanguage}
-
-          '') cfg.muc}
+            ${ muc.extraConfig }
+        '') cfg.muc}
 
       ${ lib.optionalString (cfg.uploadHttp != null) ''
         Component ${toLua cfg.uploadHttp.domain} "http_upload"
@@ -820,8 +827,6 @@ in
             http_upload_path = ${toLua cfg.uploadHttp.httpUploadPath}
       ''}
 
-      ${ cfg.extraConfig }
-
       ${ lib.concatStringsSep "\n" (lib.mapAttrsToList (n: v: ''
         VirtualHost "${v.domain}"
           enabled = ${boolToString v.enabled};
diff --git a/nixos/modules/services/torrent/deluge.nix b/nixos/modules/services/torrent/deluge.nix
index 2f1e7300ca38..45398cb26138 100644
--- a/nixos/modules/services/torrent/deluge.nix
+++ b/nixos/modules/services/torrent/deluge.nix
@@ -142,7 +142,7 @@ in {
           description = ''
             Extra packages available at runtime to enable Deluge's plugins. For example,
             extraction utilities are required for the built-in "Extractor" plugin.
-            This always contains unzip, gnutar, xz, p7zip and bzip2.
+            This always contains unzip, gnutar, xz and bzip2.
           '';
         };
 
@@ -187,7 +187,7 @@ in {
     );
 
     # Provide a default set of `extraPackages`.
-    services.deluge.extraPackages = with pkgs; [ unzip gnutar xz p7zip bzip2 ];
+    services.deluge.extraPackages = with pkgs; [ unzip gnutar xz bzip2 ];
 
     systemd.tmpfiles.rules = [
       "d '${cfg.dataDir}' 0770 ${cfg.user} ${cfg.group}"
diff --git a/nixos/modules/system/boot/initrd-ssh.nix b/nixos/modules/system/boot/initrd-ssh.nix
index 60760487a1d2..f7ef26103709 100644
--- a/nixos/modules/system/boot/initrd-ssh.nix
+++ b/nixos/modules/system/boot/initrd-ssh.nix
@@ -83,6 +83,12 @@ in
         Authorized keys for the root user on initrd.
       '';
     };
+
+    extraConfig = mkOption {
+      type = types.lines;
+      default = "";
+      description = "Verbatim contents of <filename>sshd_config</filename>.";
+    };
   };
 
   imports =
@@ -126,6 +132,8 @@ in
       '' else ''
         UseDNS no
       ''}
+
+      ${cfg.extraConfig}
     '';
   in mkIf (config.boot.initrd.network.enable && cfg.enable) {
     assertions = [
diff --git a/nixos/modules/virtualisation/cri-o.nix b/nixos/modules/virtualisation/cri-o.nix
index 89ba9c3c6636..2af4214302d6 100644
--- a/nixos/modules/virtualisation/cri-o.nix
+++ b/nixos/modules/virtualisation/cri-o.nix
@@ -4,6 +4,11 @@ with lib;
 
 let
   cfg = config.virtualisation.cri-o;
+
+  # Copy configuration files to avoid having the entire sources in the system closure
+  copyFile = filePath: pkgs.runCommandNoCC (builtins.unsafeDiscardStringContext (builtins.baseNameOf filePath)) {} ''
+    cp ${filePath} $out
+  '';
 in
 {
   imports = [
@@ -45,9 +50,9 @@ in
   config = mkIf cfg.enable {
     environment.systemPackages = with pkgs;
       [ cri-o cri-tools conmon iptables runc utillinux ];
-    environment.etc."crictl.yaml".text = ''
-      runtime-endpoint: unix:///var/run/crio/crio.sock
-    '';
+
+    environment.etc."crictl.yaml".source = copyFile "${pkgs.cri-o.src}/crictl.yaml";
+
     environment.etc."crio/crio.conf".text = ''
       [crio]
       storage_driver = "${cfg.storageDriver}"
@@ -66,23 +71,7 @@ in
       manage_network_ns_lifecycle = true
     '';
 
-    environment.etc."cni/net.d/20-cri-o-bridge.conf".text = ''
-      {
-        "cniVersion": "0.3.1",
-        "name": "crio-bridge",
-        "type": "bridge",
-        "bridge": "cni0",
-        "isGateway": true,
-        "ipMasq": true,
-        "ipam": {
-          "type": "host-local",
-          "subnet": "10.88.0.0/16",
-          "routes": [
-              { "dst": "0.0.0.0/0" }
-          ]
-        }
-      }
-    '';
+    environment.etc."cni/net.d/10-crio-bridge.conf".source = copyFile "${pkgs.cri-o.src}/contrib/cni/10-crio-bridge.conf";
 
     # Enable common /etc/containers configuration
     virtualisation.containers.enable = true;
diff --git a/nixos/modules/virtualisation/docker-containers.nix b/nixos/modules/virtualisation/oci-containers.nix
index 5ab990a3d7cc..a46dd65eb491 100644
--- a/nixos/modules/virtualisation/docker-containers.nix
+++ b/nixos/modules/virtualisation/oci-containers.nix
@@ -1,17 +1,20 @@
-{ config, lib, pkgs, ... }:
+{ config, options, lib, pkgs, ... }:
 
 with lib;
 let
-  cfg = config.docker-containers;
+  cfg = config.virtualisation.oci-containers;
+  proxy_env = config.networking.proxy.envVars;
 
-  dockerContainer =
+  defaultBackend = options.virtualisation.oci-containers.backend.default;
+
+  containerOptions =
     { ... }: {
 
       options = {
 
         image = mkOption {
           type = with types; str;
-          description = "Docker image to run.";
+          description = "OCI image to run.";
           example = "library/hello-world";
         };
 
@@ -58,18 +61,19 @@ let
 
         log-driver = mkOption {
           type = types.str;
-          default = "none";
+          default = "journald";
           description = ''
             Logging driver for the container.  The default of
-            <literal>"none"</literal> means that the container's logs will be
-            handled as part of the systemd unit.  Setting this to
-            <literal>"journald"</literal> will result in duplicate logging, but
-            the container's logs will be visible to the <command>docker
-            logs</command> command.
-
-            For more details and a full list of logging drivers, refer to the
-            <link xlink:href="https://docs.docker.com/engine/reference/run/#logging-drivers---log-driver">
-            Docker engine documentation</link>
+            <literal>"journald"</literal> means that the container's logs will be
+            handled as part of the systemd unit.
+
+            For more details and a full list of logging drivers, refer to respective backends documentation.
+
+            For Docker:
+            <link xlink:href="https://docs.docker.com/engine/reference/run/#logging-drivers---log-driver">Docker engine documentation</link>
+
+            For Podman:
+            Refer to the docker-run(1) man page.
           '';
         };
 
@@ -172,10 +176,10 @@ let
           description = ''
             Define which other containers this one depends on. They will be added to both After and Requires for the unit.
 
-            Use the same name as the attribute under <literal>services.docker-containers</literal>.
+            Use the same name as the attribute under <literal>virtualisation.oci-containers</literal>.
           '';
           example = literalExample ''
-            services.docker-containers = {
+            virtualisation.oci-containers = {
               node1 = {};
               node2 = {
                 dependsOn = [ "node1" ];
@@ -184,10 +188,10 @@ let
           '';
         };
 
-        extraDockerOptions = mkOption {
+        extraOptions = mkOption {
           type = with types; listOf str;
           default = [];
-          description = "Extra options for <command>docker run</command>.";
+          description = "Extra options for <command>${defaultBackend} run</command>.";
           example = literalExample ''
             ["--network=host"]
           '';
@@ -205,24 +209,31 @@ let
     };
 
   mkService = name: container: let
-    mkAfter = map (x: "docker-${x}.service") container.dependsOn;
-  in rec {
+    dependsOn = map (x: "${cfg.backend}-${x}.service") container.dependsOn;
+  in {
     wantedBy = [] ++ optional (container.autoStart) "multi-user.target";
-    after = [ "docker.service" "docker.socket" ] ++ mkAfter;
-    requires = after;
-    path = [ pkgs.docker ];
+    after = lib.optionals (cfg.backend == "docker") [ "docker.service" "docker.socket" ] ++ dependsOn;
+    requires = dependsOn;
+    environment = proxy_env;
+
+    path =
+      if cfg.backend == "docker" then [ pkgs.docker ]
+      else if cfg.backend == "podman" then [ config.virtualisation.podman.package ]
+      else throw "Unhandled backend: ${cfg.backend}";
 
     preStart = ''
-      docker rm -f ${name} || true
+      ${cfg.backend} rm -f ${name} || true
       ${optionalString (container.imageFile != null) ''
-        docker load -i ${container.imageFile}
+        ${cfg.backend} load -i ${container.imageFile}
         ''}
       '';
-    postStop = "docker rm -f ${name} || true";
-        
+    postStop = "${cfg.backend} rm -f ${name} || true";
+
     serviceConfig = {
+      StandardOutput = "null";
+      StandardError = "null";
       ExecStart = concatStringsSep " \\\n  " ([
-        "${pkgs.docker}/bin/docker run"
+        "${config.system.path}/bin/${cfg.backend} run"
         "--rm"
         "--name=${name}"
         "--log-driver=${container.log-driver}"
@@ -233,12 +244,12 @@ let
         ++ optional (container.user != null) "-u ${escapeShellArg container.user}"
         ++ map (v: "-v ${escapeShellArg v}") container.volumes
         ++ optional (container.workdir != null) "-w ${escapeShellArg container.workdir}"
-        ++ map escapeShellArg container.extraDockerOptions
+        ++ map escapeShellArg container.extraOptions
         ++ [container.image]
         ++ map escapeShellArg container.cmd
       );
 
-      ExecStop = ''${pkgs.bash}/bin/sh -c "[ $SERVICE_RESULT = success ] || docker stop ${name}"'';
+      ExecStop = ''${pkgs.bash}/bin/sh -c "[ $SERVICE_RESULT = success ] || ${cfg.backend} stop ${name}"'';
 
       ### There is no generalized way of supporting `reload` for docker
       ### containers. Some containers may respond well to SIGHUP sent to their
@@ -263,19 +274,50 @@ let
   };
 
 in {
+  imports = [
+    (
+      lib.mkChangedOptionModule
+      [ "docker-containers"  ]
+      [ "virtualisation" "oci-containers" ]
+      (oldcfg: {
+        backend = "docker";
+        containers = lib.mapAttrs (n: v: builtins.removeAttrs (v // {
+          extraOptions = v.extraDockerOptions or [];
+        }) [ "extraDockerOptions" ]) oldcfg.docker-containers;
+      })
+    )
+  ];
+
+  options.virtualisation.oci-containers = {
+
+    backend = mkOption {
+      type = types.enum [ "podman" "docker" ];
+      default =
+        # TODO: Once https://github.com/NixOS/nixpkgs/issues/77925 is resolved default to podman
+        # if versionAtLeast config.system.stateVersion "20.09" then "podman"
+        # else "docker";
+        "docker";
+      description = "The underlying Docker implementation to use.";
+    };
 
-  options.docker-containers = mkOption {
-    default = {};
-    type = types.attrsOf (types.submodule dockerContainer);
-    description = "Docker containers to run as systemd services.";
-  };
-
-  config = mkIf (cfg != {}) {
-
-    systemd.services = mapAttrs' (n: v: nameValuePair "docker-${n}" (mkService n v)) cfg;
-
-    virtualisation.docker.enable = true;
+    containers = mkOption {
+      default = {};
+      type = types.attrsOf (types.submodule containerOptions);
+      description = "OCI (Docker) containers to run as systemd services.";
+    };
 
   };
 
+  config = lib.mkIf (cfg.containers != {}) (lib.mkMerge [
+    {
+      systemd.services = mapAttrs' (n: v: nameValuePair "${cfg.backend}-${n}" (mkService n v)) cfg.containers;
+    }
+    (lib.mkIf (cfg.backend == "podman") {
+      virtualisation.podman.enable = true;
+    })
+    (lib.mkIf (cfg.backend == "docker") {
+      virtualisation.docker.enable = true;
+    })
+  ]);
+
 }
diff --git a/nixos/modules/virtualisation/podman.nix b/nixos/modules/virtualisation/podman.nix
index 1dc79272ccb6..652850bf5006 100644
--- a/nixos/modules/virtualisation/podman.nix
+++ b/nixos/modules/virtualisation/podman.nix
@@ -8,13 +8,11 @@ let
 
   # Provides a fake "docker" binary mapping to podman
   dockerCompat = pkgs.runCommandNoCC "${podmanPackage.pname}-docker-compat-${podmanPackage.version}" {
-    outputs = [ "out" "bin" "man" ];
+    outputs = [ "out" "man" ];
     inherit (podmanPackage) meta;
   } ''
-    mkdir $out
-
-    mkdir -p $bin/bin
-    ln -s ${podmanPackage.bin}/bin/podman $bin/bin/docker
+    mkdir -p $out/bin
+    ln -s ${podmanPackage}/bin/podman $out/bin/docker
 
     mkdir -p $man/share/man/man1
     for f in ${podmanPackage.man}/share/man/man1/*; do
@@ -88,11 +86,21 @@ in
       };
     };
 
+    package = lib.mkOption {
+      type = types.package;
+      default = podmanPackage;
+      internal = true;
+      description = ''
+        The final Podman package (including extra packages).
+      '';
+    };
+
+
   };
 
   config = lib.mkIf cfg.enable {
 
-    environment.systemPackages = [ podmanPackage ]
+    environment.systemPackages = [ cfg.package ]
       ++ lib.optional cfg.dockerCompat dockerCompat;
 
     environment.etc."containers/libpod.conf".text = ''
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index eff1752bbbf8..ebb0dfef15ac 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -70,7 +70,7 @@ in
   dhparams = handleTest ./dhparams.nix {};
   dnscrypt-proxy2 = handleTestOn ["x86_64-linux"] ./dnscrypt-proxy2.nix {};
   docker = handleTestOn ["x86_64-linux"] ./docker.nix {};
-  docker-containers = handleTestOn ["x86_64-linux"] ./docker-containers.nix {};
+  oci-containers = handleTestOn ["x86_64-linux"] ./oci-containers.nix {};
   docker-edge = handleTestOn ["x86_64-linux"] ./docker-edge.nix {};
   docker-preloader = handleTestOn ["x86_64-linux"] ./docker-preloader.nix {};
   docker-registry = handleTest ./docker-registry.nix {};
diff --git a/nixos/tests/chromium.nix b/nixos/tests/chromium.nix
index fc5d3a5c52fe..795b93f6f54e 100644
--- a/nixos/tests/chromium.nix
+++ b/nixos/tests/chromium.nix
@@ -37,7 +37,7 @@ mapAttrs (channel: chromiumPkg: makeTest rec {
     </head>
     <body onload="javascript:document.title='startup done'">
       <img src="file://${pkgs.fetchurl {
-        url = "http://nixos.org/logo/nixos-hex.svg";
+        url = "https://nixos.org/logo/nixos-hex.svg";
         sha256 = "07ymq6nw8kc22m7kzxjxldhiq8gzmc7f45kq2bvhbdm0w5s112s4";
       }}" />
     </body>
diff --git a/nixos/tests/docker-containers.nix b/nixos/tests/docker-containers.nix
deleted file mode 100644
index 0e318a52d9f1..000000000000
--- a/nixos/tests/docker-containers.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-# Test Docker containers as systemd units
-
-import ./make-test-python.nix ({ pkgs, lib, ... }: {
-  name = "docker-containers";
-  meta = {
-    maintainers = with lib.maintainers; [ benley mkaito ];
-  };
-
-  nodes = {
-    docker = { pkgs, ... }: {
-      virtualisation.docker.enable = true;
-
-      docker-containers.nginx = {
-        image = "nginx-container";
-        imageFile = pkgs.dockerTools.examples.nginx;
-        ports = ["8181:80"];
-      };
-    };
-  };
-
-  testScript = ''
-    start_all()
-    docker.wait_for_unit("docker-nginx.service")
-    docker.wait_for_open_port(8181)
-    docker.wait_until_succeeds("curl http://localhost:8181 | grep Hello")
-  '';
-})
diff --git a/nixos/tests/ec2.nix b/nixos/tests/ec2.nix
index 6aeeb17ba31a..5a59d65e6026 100644
--- a/nixos/tests/ec2.nix
+++ b/nixos/tests/ec2.nix
@@ -108,7 +108,7 @@ in {
     inherit image;
     sshPublicKey = snakeOilPublicKey;
 
-    # ### http://nixos.org/channels/nixos-unstable nixos
+    # ### https://nixos.org/channels/nixos-unstable nixos
     userData = ''
       { pkgs, ... }:
 
diff --git a/nixos/tests/minio.nix b/nixos/tests/minio.nix
index 3b0619742671..02d1f7aa6c20 100644
--- a/nixos/tests/minio.nix
+++ b/nixos/tests/minio.nix
@@ -44,7 +44,7 @@ in {
 
     # Create a test bucket on the server
     machine.succeed(
-        "mc config host add minio http://localhost:9000 ${accessKey} ${secretKey} S3v4"
+        "mc config host add minio http://localhost:9000 ${accessKey} ${secretKey} --api s3v4"
     )
     machine.succeed("mc mb minio/test-bucket")
     machine.succeed("${minioPythonScript}")
diff --git a/nixos/tests/oci-containers.nix b/nixos/tests/oci-containers.nix
new file mode 100644
index 000000000000..bb6c019f07c9
--- /dev/null
+++ b/nixos/tests/oci-containers.nix
@@ -0,0 +1,43 @@
+{ system ? builtins.currentSystem
+, config ? {}
+, pkgs ? import ../.. { inherit system config; }
+, lib ? pkgs.lib
+}:
+
+let
+
+  inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
+
+  mkOCITest = backend: makeTest {
+    name = "oci-containers-${backend}";
+
+    meta = {
+      maintainers = with lib.maintainers; [ adisbladis benley mkaito ];
+    };
+
+    nodes = {
+      ${backend} = { pkgs, ... }: {
+        virtualisation.oci-containers = {
+          inherit backend;
+          containers.nginx = {
+            image = "nginx-container";
+            imageFile = pkgs.dockerTools.examples.nginx;
+            ports = ["8181:80"];
+          };
+        };
+      };
+    };
+
+    testScript = ''
+      start_all()
+      ${backend}.wait_for_unit("${backend}-nginx.service")
+      ${backend}.wait_for_open_port(8181)
+      ${backend}.wait_until_succeeds("curl http://localhost:8181 | grep Hello")
+    '';
+  };
+
+in
+lib.foldl' (attrs: backend: attrs // { ${backend} = mkOCITest backend; }) {} [
+  "docker"
+  "podman"
+]
diff --git a/nixos/tests/udisks2.nix b/nixos/tests/udisks2.nix
index 64f5b6c40d20..50a023968918 100644
--- a/nixos/tests/udisks2.nix
+++ b/nixos/tests/udisks2.nix
@@ -3,7 +3,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
 let
 
   stick = pkgs.fetchurl {
-    url = "http://nixos.org/~eelco/nix/udisks-test.img.xz";
+    url = "https://nixos.org/~eelco/nix/udisks-test.img.xz";
     sha256 = "0was1xgjkjad91nipzclaz5biv3m4b2nk029ga6nk7iklwi19l8b";
   };
 
diff --git a/nixos/tests/xmpp/prosody-mysql.nix b/nixos/tests/xmpp/prosody-mysql.nix
index 0507227021b2..9a00bcabf389 100644
--- a/nixos/tests/xmpp/prosody-mysql.nix
+++ b/nixos/tests/xmpp/prosody-mysql.nix
@@ -6,6 +6,11 @@ import ../make-test-python.nix {
       environment.systemPackages = [
         (pkgs.callPackage ./xmpp-sendmessage.nix { connectTo = nodes.server.config.networking.primaryIPAddress; })
       ];
+      networking.extraHosts = ''
+        ${nodes.server.config.networking.primaryIPAddress} example.com
+        ${nodes.server.config.networking.primaryIPAddress} conference.example.com
+        ${nodes.server.config.networking.primaryIPAddress} uploads.example.com
+      '';
     };
     server = { config, pkgs, ... }: {
       nixpkgs.overlays = [
@@ -18,6 +23,8 @@ import ../make-test-python.nix {
       ];
       networking.extraHosts = ''
         ${config.networking.primaryIPAddress} example.com
+        ${config.networking.primaryIPAddress} conference.example.com
+        ${config.networking.primaryIPAddress} uploads.example.com
       '';
       networking.firewall.enable = false;
       services.prosody = {
@@ -39,6 +46,14 @@ import ../make-test-python.nix {
           domain = "example.com";
           enabled = true;
         };
+        muc = [
+          {
+            domain = "conference.example.com";
+          }
+        ];
+        uploadHttp = {
+          domain = "uploads.example.com";
+        };
       };
     };
     mysql = { config, pkgs, ... }: {
diff --git a/pkgs/applications/audio/ft2-clone/default.nix b/pkgs/applications/audio/ft2-clone/default.nix
index e80239553f1b..3acf8ea1c0c8 100644
--- a/pkgs/applications/audio/ft2-clone/default.nix
+++ b/pkgs/applications/audio/ft2-clone/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ft2-clone";
-  version = "1.15";
+  version = "1.23";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "ft2-clone";
     rev = "v${version}";
-    sha256 = "19xgdaij71gpvq216zjlp60zmfdl2a8kf8sc3bpk8a4d4xh4n151";
+    sha256 = "03prdifc2nz7smmzdy19flp33m927vb7j5bhdc46gak753pikw7d";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/audio/gpodder/default.nix b/pkgs/applications/audio/gpodder/default.nix
index 1905699e516c..933c9ac02035 100644
--- a/pkgs/applications/audio/gpodder/default.nix
+++ b/pkgs/applications/audio/gpodder/default.nix
@@ -5,14 +5,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "gpodder";
-  version = "3.10.13";
+  version = "3.10.15";
   format = "other";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "1h542syaxsx1hslfzlk3fx1nbp190zjw35kigw7a1kx1jwvfwapg";
+    sha256 = "0ghbanj142n0hgydzfjmnkdgri2kswsjal3mn10c723kih4ir4yr";
   };
 
   patches = [
diff --git a/pkgs/applications/audio/orca-c/default.nix b/pkgs/applications/audio/orca-c/default.nix
new file mode 100644
index 000000000000..3a4f4b2ce2b8
--- /dev/null
+++ b/pkgs/applications/audio/orca-c/default.nix
@@ -0,0 +1,31 @@
+{ stdenv, fetchFromGitHub, ncurses, portmidi }:
+stdenv.mkDerivation {
+  pname = "orca-c";
+
+  version = "git-2020-05-01";
+
+  src = fetchFromGitHub {
+    owner = "hundredrabbits";
+    repo = "Orca-c";
+    rev = "d7a3b169c5ed0b06a9ad0fdb3057704da9a0b6ce";
+    sha256 = "101y617a295hzwr98ykvza1sycxlk29kzxn2ybjwc718r0alkbzz";
+  };
+
+  buildInputs = [ ncurses portmidi ];
+
+  patchPhase = ''
+    patchShebangs tool
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    install build/orca $out/bin/orca
+  '';
+
+  meta = with stdenv.lib; {
+    description = "An esoteric programming language designed to quickly create procedural sequencers.";
+    homepage = "https://github.com/hundredrabbits/Orca-c";
+    license = licenses.mit;
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/applications/audio/pt2-clone/default.nix b/pkgs/applications/audio/pt2-clone/default.nix
index 2f21e3ea56b6..5284c8af6824 100644
--- a/pkgs/applications/audio/pt2-clone/default.nix
+++ b/pkgs/applications/audio/pt2-clone/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pt2-clone";
-  version = "1.07";
+  version = "1.12";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "pt2-clone";
     rev = "v${version}";
-    sha256 = "0g2bp9n05ng2fvqw86pb941zamcqnfz1l066wvh5j3av1w22khi8";
+    sha256 = "1y7kv889rm3nvaigcda4bglvwm799f3gp0zrivkvrg1lrlygs89f";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/audio/rofi-mpd/default.nix b/pkgs/applications/audio/rofi-mpd/default.nix
index ef57466ec84f..8f9819bd913b 100644
--- a/pkgs/applications/audio/rofi-mpd/default.nix
+++ b/pkgs/applications/audio/rofi-mpd/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "rofi-mpd";
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "JakeStanger";
     repo = "Rofi_MPD";
     rev = "v${version}";
-    sha256 = "1b0y8706mmrxhiyz8g6znisllc35j8g7sz8gfjll9svysjmvb6lc";
+    sha256 = "0jabyn6gqh8ychn2a06xws3avz0lqdnx3qvqkavfd2xr6sp2q7lg";
   };
 
   propagatedBuildInputs = with python3Packages; [ mutagen mpd2 toml appdirs ];
diff --git a/pkgs/applications/audio/schismtracker/default.nix b/pkgs/applications/audio/schismtracker/default.nix
index b50dd78ff1ac..36125489e3a2 100644
--- a/pkgs/applications/audio/schismtracker/default.nix
+++ b/pkgs/applications/audio/schismtracker/default.nix
@@ -1,30 +1,29 @@
-{ stdenv, fetchurl, alsaLib, python, SDL }:
+{ stdenv, fetchFromGitHub
+, autoreconfHook
+, alsaLib, python, SDL }:
 
 stdenv.mkDerivation rec {
-  version = "20120105";
   pname = "schismtracker";
+  version = "20190805";
 
-  src = fetchurl {
-    url = "http://schismtracker.org/dl/${pname}-${version}.tar.bz2";
-    sha256 = "1ny7wv2wxm1av299wvpskall6438wjjpadphmqc7c0h6d0zg5kii";
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = version;
+    sha256 = "0qqps20vvn3rgpg8174bjrrm38gqcci2z5z4c1r1vhbccclahgsd";
   };
 
-  preConfigure = ''
-    # Build fails on Linux with windres.
-    export ac_cv_prog_ac_ct_WINDRES=
-  '';
-
   configureFlags = [ "--enable-dependency-tracking" ];
 
-  buildInputs = [ alsaLib python SDL ];
+  nativeBuildInputs = [ autoreconfHook python ];
 
-  enableParallelBuilding = true;
+  buildInputs = [ alsaLib SDL ];
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Music tracker application, free reimplementation of Impulse Tracker";
     homepage = "http://schismtracker.org/";
-    license = stdenv.lib.licenses.gpl2;
+    license = licenses.gpl2;
     platforms = [ "x86_64-linux" "i686-linux" ];
-    maintainers = [ stdenv.lib.maintainers.ftrvxmtrx ];
+    maintainers = with maintainers; [ ftrvxmtrx ];
   };
 }
diff --git a/pkgs/applications/audio/strawberry/default.nix b/pkgs/applications/audio/strawberry/default.nix
index 6c565911eb44..dce73c386707 100644
--- a/pkgs/applications/audio/strawberry/default.nix
+++ b/pkgs/applications/audio/strawberry/default.nix
@@ -35,13 +35,13 @@
 
 mkDerivation rec {
   pname = "strawberry";
-  version = "0.6.9";
+  version = "0.6.10";
 
   src = fetchFromGitHub {
     owner = "jonaski";
     repo = pname;
     rev = version;
-    sha256 = "0ssyqa14j54sja2dzhzrznbf1bbl0nc62p4jh2pd6fhinpw8y6dk";
+    sha256 = "0qf510hlxbndqzwq62mdzfclqxr3caf1a34kd770k84x8vrb4pld";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/blockchains/bitcoin-abc.nix b/pkgs/applications/blockchains/bitcoin-abc.nix
index afc5b40f9db5..aee73cecdfc7 100644
--- a/pkgs/applications/blockchains/bitcoin-abc.nix
+++ b/pkgs/applications/blockchains/bitcoin-abc.nix
@@ -7,13 +7,13 @@ with stdenv.lib;
 mkDerivation rec {
 
   name = "bitcoin" + (toString (optional (!withGui) "d")) + "-abc-" + version;
-  version = "0.21.3";
+  version = "0.21.5";
 
   src = fetchFromGitHub {
     owner = "bitcoin-ABC";
     repo = "bitcoin-abc";
     rev = "v${version}";
-    sha256 = "1pzdgghbsss2qjfgl42lvkbs5yc5q6jnzqnp24lljmrh341g2zn4";
+    sha256 = "1jx33n8dhn16iaxvmc56cxw0i5qk0ga5nf7qf9frwwq6zkglknga";
   };
 
   patches = [ ./fix-bitcoin-qt-build.patch ];
diff --git a/pkgs/applications/blockchains/clightning.nix b/pkgs/applications/blockchains/clightning.nix
index 61765913464f..371bf11064de 100644
--- a/pkgs/applications/blockchains/clightning.nix
+++ b/pkgs/applications/blockchains/clightning.nix
@@ -4,11 +4,11 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "clightning";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchurl {
     url = "https://github.com/ElementsProject/lightning/releases/download/v${version}/clightning-v${version}.zip";
-    sha256 = "079d3yx7yr7qrilqgaayvn18lxl8h6a1gwwbsgm5xsyxj4vdlz7r";
+    sha256 = "1w5l3r3pnhnwz3x7mjgd69cw9a18fpyjwj7kmfka7cf9hdgcwp9x";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/blockchains/lnd.nix b/pkgs/applications/blockchains/lnd.nix
index 0aa087e20afc..aff38e242f81 100644
--- a/pkgs/applications/blockchains/lnd.nix
+++ b/pkgs/applications/blockchains/lnd.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "lnd";
-  version = "0.9.2-beta";
+  version = "0.10.0-beta";
 
   src = fetchFromGitHub {
     owner = "lightningnetwork";
     repo = "lnd";
     rev = "v${version}";
-    sha256 = "0gm33z89fiqv231ks2mkpsblskcsijipq8fcmip6m6jy8g06b1gb";
+    sha256 = "1amciz924s2h6qhy7w34jpv1jc25p5ayfxzvjph6hhx0bccrm88w";
   };
 
-  modSha256 = "1khxplvyaqgaddrx1nna1fw0nb1xz9bmqpxpfifif4f5nmx90gbr";
+  modSha256 = "15i4h3pkvyav9qsbfinzifram0knkylg24j6j0mxs4bnj80j4ycm";
 
   subPackages = ["cmd/lncli" "cmd/lnd"];
 
diff --git a/pkgs/applications/editors/jetbrains/common.nix b/pkgs/applications/editors/jetbrains/common.nix
index cb732d076f2a..07776bebe425 100644
--- a/pkgs/applications/editors/jetbrains/common.nix
+++ b/pkgs/applications/editors/jetbrains/common.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, makeDesktopItem, makeWrapper, patchelf, p7zip
+{ stdenv, lib, makeDesktopItem, makeWrapper, patchelf
 , coreutils, gnugrep, which, git, unzip, libsecret, libnotify
 }:
 
@@ -26,7 +26,7 @@ with stdenv; lib.makeOverridable mkDerivation rec {
     '';
   };
 
-  nativeBuildInputs = [ makeWrapper patchelf p7zip unzip ];
+  nativeBuildInputs = [ makeWrapper patchelf unzip ];
 
   patchPhase = lib.optionalString (!stdenv.isDarwin) ''
       get_file_size() {
diff --git a/pkgs/applications/editors/vim/macvim.nix b/pkgs/applications/editors/vim/macvim.nix
index 9eabadae3b05..93ec48e54e0d 100644
--- a/pkgs/applications/editors/vim/macvim.nix
+++ b/pkgs/applications/editors/vim/macvim.nix
@@ -27,13 +27,13 @@ in
 stdenv.mkDerivation {
   pname = "macvim";
 
-  version = "8.2.319";
+  version = "8.2.539";
 
   src = fetchFromGitHub {
     owner = "macvim-dev";
     repo = "macvim";
-    rev = "snapshot-162";
-    sha256 = "1mg55jlrz533wlqrx028fyv86rfhdzvm5kdi8xlf67flc5hh9vrp";
+    rev = "snapshot-163";
+    sha256 = "0ibc6h7zmk81dygkxd8a2rcq72zbqmr9kh64xhsm9h0p70505cdk";
   };
 
   enableParallelBuilding = true;
@@ -66,7 +66,6 @@ stdenv.mkDerivation {
       "--with-tlib=ncurses"
       "--with-compiledby=Nix"
       "--disable-sparkle"
-      "LDFLAGS=-headerpad_max_install_names"
   ];
 
   makeFlags = ''PREFIX=$(out) CPPFLAGS="-Wno-error"'';
@@ -81,11 +80,6 @@ stdenv.mkDerivation {
 
   # This is unfortunate, but we need to use the same compiler as Xcode,
   # but Xcode doesn't provide a way to configure the compiler.
-  #
-  # If you're willing to modify the system files, you can do this:
-  #   http://hamelot.co.uk/programming/add-gcc-compiler-to-xcode-6/
-  #
-  # But we don't have that option.
   preConfigure = ''
     CC=/usr/bin/clang
 
@@ -101,8 +95,34 @@ stdenv.mkDerivation {
   ''
   ;
 
+  # Because we're building with system clang, this means we're building against Xcode's SDK and
+  # linking against system libraries. The configure script is picking up Nix Libsystem (via ruby)
+  # so we need to patch that out or we'll get linker issues. The MacVim binary built by Xcode links
+  # against the system anyway so it doesn't really matter that the Vim binary will too. If we
+  # decide that matters, we can always patch it back to the Nix libsystem post-build.
+  # It also picks up libiconv, libunwind, and objc4 from Nix. These seem relatively harmless but
+  # let's strip them out too.
+  #
+  # Note: If we do add a post-build install_name_tool patch, we need to add the
+  # "LDFLAGS=-headerpad_max_install_names" flag to configureFlags and either patch it into the
+  # Xcode project or pass it as a flag to xcodebuild as well.
   postConfigure = ''
-    substituteInPlace src/auto/config.mk --replace "PERL_CFLAGS	=" "PERL_CFLAGS	= -I${darwin.libutil}/include"
+    substituteInPlace src/auto/config.mk \
+      --replace "PERL_CFLAGS	=" "PERL_CFLAGS	= -I${darwin.libutil}/include" \
+      --replace " -L${stdenv.cc.libc}/lib" "" \
+      --replace " -L${darwin.libobjc}/lib" "" \
+      --replace " -L${darwin.libunwind}/lib" "" \
+      --replace " -L${darwin.libiconv}/lib" ""
+
+    # All the libraries we stripped have -osx- in their name as of this time.
+    # Assert now that this pattern no longer appears in config.mk.
+    ( # scope variable
+      while IFS="" read -r line; do
+        if [[ "$line" == LDFLAGS*-osx-* ]]; then
+          echo "WARNING: src/auto/config.mk contains reference to Nix osx library" >&2
+        fi
+      done <src/auto/config.mk
+    )
 
     substituteInPlace src/MacVim/vimrc --subst-var-by CSCOPE ${cscope}/bin/cscope
   '';
diff --git a/pkgs/applications/editors/vim/macvim.patch b/pkgs/applications/editors/vim/macvim.patch
index 9d5dbded26a1..6b90b623cb68 100644
--- a/pkgs/applications/editors/vim/macvim.patch
+++ b/pkgs/applications/editors/vim/macvim.patch
@@ -1,25 +1,5 @@
-diff --git a/src/MacVim/MacVim.xcodeproj/project.pbxproj b/src/MacVim/MacVim.xcodeproj/project.pbxproj
-index e519018de..556a4127d 100644
---- a/src/MacVim/MacVim.xcodeproj/project.pbxproj
-+++ b/src/MacVim/MacVim.xcodeproj/project.pbxproj
-@@ -1007,6 +1007,7 @@
- 				LD_RUNPATH_SEARCH_PATHS = "@loader_path/../Frameworks";
- 				MACOSX_DEPLOYMENT_TARGET = "";
- 				ONLY_ACTIVE_ARCH = YES;
-+				OTHER_LDFLAGS = "-headerpad_max_install_names";
- 				PRODUCT_BUNDLE_IDENTIFIER = org.vim.MacVim;
- 				PRODUCT_NAME = MacVim;
- 				VERSIONING_SYSTEM = "apple-generic";
-@@ -1039,6 +1040,7 @@
- 				LD_RUNPATH_SEARCH_PATHS = "@loader_path/../Frameworks";
- 				MACOSX_DEPLOYMENT_TARGET = "";
- 				ONLY_ACTIVE_ARCH = YES;
-+				OTHER_LDFLAGS = "-headerpad_max_install_names";
- 				PRODUCT_BUNDLE_IDENTIFIER = org.vim.MacVim;
- 				PRODUCT_NAME = MacVim;
- 				VERSIONING_SYSTEM = "apple-generic";
 diff --git a/src/MacVim/vimrc b/src/MacVim/vimrc
-index 23a06bf37..dfb10fe94 100644
+index 23a06bf..dfb10fe 100644
 --- a/src/MacVim/vimrc
 +++ b/src/MacVim/vimrc
 @@ -14,35 +14,5 @@ set backspace+=indent,eol,start
@@ -61,10 +41,10 @@ index 23a06bf37..dfb10fe94 100644
 +" Default cscopeprg to the Nix-installed path
 +set cscopeprg=@CSCOPE@
 diff --git a/src/Makefile b/src/Makefile
-index 32810d0a7..13a05f349 100644
+index 24c6934..d0f094e 100644
 --- a/src/Makefile
 +++ b/src/Makefile
-@@ -1385,7 +1385,7 @@ MACVIMGUI_SRC	= gui.c gui_beval.c MacVim/gui_macvim.m MacVim/MMBackend.m \
+@@ -1407,7 +1407,7 @@ MACVIMGUI_SRC	= gui.c gui_beval.c MacVim/gui_macvim.m MacVim/MMBackend.m \
  		  MacVim/MacVim.m
  MACVIMGUI_OBJ	= objects/gui.o objects/gui_beval.o \
  		  objects/gui_macvim.o objects/MMBackend.o objects/MacVim.o
@@ -74,10 +54,10 @@ index 32810d0a7..13a05f349 100644
  MACVIMGUI_LIBS_DIR =
  MACVIMGUI_LIBS1	= -framework Cocoa -framework Carbon
 diff --git a/src/auto/configure b/src/auto/configure
-index 9e6a82f4a..3c6d1a89b 100755
+index 730d6d5..0259112 100755
 --- a/src/auto/configure
 +++ b/src/auto/configure
-@@ -5829,10 +5829,7 @@ $as_echo "not found" >&6; }
+@@ -5859,10 +5859,7 @@ $as_echo "not found" >&6; }
  
      for path in "${vi_cv_path_mzscheme_pfx}/lib" "${SCHEME_LIB}"; do
        if test "X$path" != "X"; then
@@ -89,7 +69,7 @@ index 9e6a82f4a..3c6d1a89b 100755
  	  MZSCHEME_LIBS="${path}/libmzscheme3m.a"
  	  MZSCHEME_CFLAGS="-DMZ_PRECISE_GC"
  	elif test -f "${path}/libracket3m.a"; then
-@@ -6217,23 +6214,6 @@ $as_echo ">>> too old; need Perl version 5.003_01 or later <<<" >&6; }
+@@ -6247,23 +6244,6 @@ $as_echo ">>> too old; need Perl version 5.003_01 or later <<<" >&6; }
    fi
  
    if test "x$MACOS_X" = "xyes"; then
@@ -113,7 +93,7 @@ index 9e6a82f4a..3c6d1a89b 100755
                  PERL_LIBS=`echo "$PERL_LIBS" | sed -e 's/-arch\ ppc//' -e 's/-arch\ i386//' -e 's/-arch\ x86_64//'`
      PERL_CFLAGS=`echo "$PERL_CFLAGS" | sed -e 's/-arch\ ppc//' -e 's/-arch\ i386//' -e 's/-arch\ x86_64//'`
    fi
-@@ -6456,13 +6436,7 @@ __:
+@@ -6486,13 +6466,7 @@ __:
  eof
  	    	    eval "`cd ${PYTHON_CONFDIR} && make -f "${tmp_mkf}" __ | sed '/ directory /d'`"
  	    rm -f -- "${tmp_mkf}"
@@ -128,7 +108,7 @@ index 9e6a82f4a..3c6d1a89b 100755
  	      vi_cv_path_python_plibs="-L${PYTHON_CONFDIR} -lpython${vi_cv_var_python_version}"
  	      	      	      	      if test -n "${python_LINKFORSHARED}" && test -n "${python_PYTHONFRAMEWORKPREFIX}"; then
  	        python_link_symbol=`echo ${python_LINKFORSHARED} | sed 's/\([^ \t][^ \t]*[ \t][ \t]*[^ \t][^ \t]*\)[ \t].*/\1/'`
-@@ -6477,7 +6451,6 @@ eof
+@@ -6507,7 +6481,6 @@ eof
  	      fi
  	      vi_cv_path_python_plibs="${vi_cv_path_python_plibs} ${python_BASEMODLIBS} ${python_LIBS} ${python_SYSLIBS} ${python_LINKFORSHARED}"
  	      	      vi_cv_path_python_plibs=`echo $vi_cv_path_python_plibs | sed s/-ltermcap//`
@@ -136,7 +116,7 @@ index 9e6a82f4a..3c6d1a89b 100755
  
  fi
  
-@@ -6556,13 +6529,6 @@ rm -f core conftest.err conftest.$ac_objext \
+@@ -6586,13 +6559,6 @@ rm -f core conftest.err conftest.$ac_objext \
  $as_echo "no" >&6; }
  	fi
  
@@ -150,7 +130,7 @@ index 9e6a82f4a..3c6d1a89b 100755
  			{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if compile and link flags for Python are sane" >&5
  $as_echo_n "checking if compile and link flags for Python are sane... " >&6; }
  	cflags_save=$CFLAGS
-@@ -7456,11 +7422,7 @@ $as_echo "$tclver - OK" >&6; };
+@@ -7486,11 +7452,7 @@ $as_echo "$tclver - OK" >&6; };
  
        { $as_echo "$as_me:${as_lineno-$LINENO}: checking for location of Tcl include" >&5
  $as_echo_n "checking for location of Tcl include... " >&6; }
@@ -162,7 +142,7 @@ index 9e6a82f4a..3c6d1a89b 100755
        TCL_INC=
        for try in $tclinc; do
  	if test -f "$try/tcl.h"; then
-@@ -7478,12 +7440,8 @@ $as_echo "<not found>" >&6; }
+@@ -7508,12 +7470,8 @@ $as_echo "<not found>" >&6; }
        if test -z "$SKIP_TCL"; then
  	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for location of tclConfig.sh script" >&5
  $as_echo_n "checking for location of tclConfig.sh script... " >&6; }
@@ -175,7 +155,7 @@ index 9e6a82f4a..3c6d1a89b 100755
  	for try in $tclcnf; do
  	  if test -f "$try/tclConfig.sh"; then
  	    { $as_echo "$as_me:${as_lineno-$LINENO}: result: $try/tclConfig.sh" >&5
-@@ -7673,10 +7631,6 @@ $as_echo "$rubyhdrdir" >&6; }
+@@ -7703,10 +7661,6 @@ $as_echo "$rubyhdrdir" >&6; }
  	if test -f "$rubylibdir/$librubya"; then
  	  librubyarg="$librubyarg"
  	  RUBY_LIBS="$RUBY_LIBS -L$rubylibdir"
@@ -187,10 +167,10 @@ index 9e6a82f4a..3c6d1a89b 100755
  
  	if test "X$librubyarg" != "X"; then
 diff --git a/src/vim.h b/src/vim.h
-index f158aab..a714da9 100644
+index 87d1c92..8a7d5a5 100644
 --- a/src/vim.h
 +++ b/src/vim.h
-@@ -243,17 +243,6 @@
+@@ -250,17 +250,6 @@
  # define SUN_SYSTEM
  #endif
  
@@ -209,7 +189,7 @@ index f158aab..a714da9 100644
  # include "os_amiga.h"
  #endif
 diff --git a/src/vimtutor b/src/vimtutor
-index 1e8769b25..47078b0e7 100755
+index 1e8769b..47078b0 100755
 --- a/src/vimtutor
 +++ b/src/vimtutor
 @@ -16,7 +16,7 @@ seq="vim vim81 vim80 vim8 vim74 vim73 vim72 vim71 vim70 vim7 vim6 vi"
diff --git a/pkgs/applications/graphics/apitrace/default.nix b/pkgs/applications/graphics/apitrace/default.nix
index f6f9cb281a77..e6865d2d8f07 100644
--- a/pkgs/applications/graphics/apitrace/default.nix
+++ b/pkgs/applications/graphics/apitrace/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, libX11, procps, python2, libdwarf, qtbase, qtwebkit }:
+{ stdenv, fetchFromGitHub, cmake, libX11, procps, python2, libdwarf, qtbase, qtwebkit, wrapQtAppsHook, libglvnd }:
 
 stdenv.mkDerivation rec {
   pname = "apitrace";
@@ -15,7 +15,48 @@ stdenv.mkDerivation rec {
   # of games -- so it's fine to use e.g. bundled snappy.
   buildInputs = [ libX11 procps python2 libdwarf qtbase qtwebkit ];
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake wrapQtAppsHook ];
+
+  # Don't automatically wrap all binaries, I prefer to explicitly only wrap
+  # `qapitrace`.
+  dontWrapQtApps = true;
+
+  postFixup = ''
+
+    # Since https://github.com/NixOS/nixpkgs/pull/60985, we add `/run-opengl-driver[-32]`
+    # to the `RUNPATH` of dispatcher libraries `dlopen()` ing OpenGL drivers.
+    # `RUNPATH` doesn't propagate throughout the whole application, but only
+    # from the module performing the `dlopen()`.
+    # 
+    # Apitrace wraps programs by running them with `LD_PRELOAD` pointing to `.so`
+    # files in $out/lib/apitrace/wrappers.
+    # 
+    # Theses wrappers effectively wrap the `dlopen()` calls from `libglvnd`
+    # and other dispatcher libraries, and run `dlopen()`  by themselves.
+    # 
+    # As `RUNPATH` doesn't propagate through the whole library, and they're now the
+    # library doing the real `dlopen()`, they also need to have
+    # `/run-opengl-driver[-32]` added to their `RUNPATH`.
+    #
+    # To stay simple, we add paths for 32 and 64 bits unconditionally.
+    # This doesn't have an impact on closure size, and if the 32 bit drivers
+    # are not available, that folder is ignored.
+    for i in $out/lib/apitrace/wrappers/*.so
+    do
+      echo "Patching OpenGL driver path for $i"
+      patchelf --set-rpath "/run/opengl-driver/lib:/run/opengl-driver-32/lib:$(patchelf --print-rpath $i)" $i
+    done
+
+    # Theses open the OpenGL driver at runtime, but it is not listed as NEEDED libraries. They need
+    # a reference to libglvnd.
+    for i in $out/bin/eglretrace $out/bin/glretrace
+    do
+      echo "Patching RPath for $i"
+      patchelf --set-rpath "${stdenv.lib.makeLibraryPath [libglvnd]}:$(patchelf --print-rpath $i)" $i
+    done
+
+    wrapQtApp $out/bin/qapitrace
+  '';
 
   meta = with stdenv.lib; {
     homepage = "https://apitrace.github.io";
diff --git a/pkgs/applications/graphics/drawio/default.nix b/pkgs/applications/graphics/drawio/default.nix
index aa1ac0f26208..8281596374cc 100644
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "drawio";
-  version = "12.9.9";
+  version = "13.0.3";
 
   src = fetchurl {
     url = "https://github.com/jgraph/drawio-desktop/releases/download/v${version}/draw.io-x86_64-${version}.rpm";
-    sha256 = "07lx99fd4vkgdhagshzawrh8ncbv19hvxjpzgd3yjdj0nalvmxin";
+    sha256 = "104pfwipm8ch9xqlsz1gh18icr1p6i3n4c77bbdjakxcy4s5n7sg";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/fstl/default.nix b/pkgs/applications/graphics/fstl/default.nix
index 1d712a63fbdf..c96ea765d43f 100644
--- a/pkgs/applications/graphics/fstl/default.nix
+++ b/pkgs/applications/graphics/fstl/default.nix
@@ -2,7 +2,7 @@
 
 mkDerivation rec {
   pname = "fstl";
-  version = "0.9.3";
+  version = "0.9.4";
 
   buildInputs = [qtbase mesa_glu];
 
@@ -23,7 +23,7 @@ mkDerivation rec {
     owner = "mkeeter";
     repo = "fstl";
     rev = "v" + version;
-    sha256 = "1j0y9xbf0ybrrnsmfzgpyyz6bi98xgzn9ivani424j01vffns892";
+    sha256 = "028hzdv11hgvcpc36q5scf4nw1256qswh37xhfn5a0iv7wycmnif";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/kde/ark/default.nix b/pkgs/applications/kde/ark/default.nix
index 76cc423f5460..dbbfcf80c6b0 100644
--- a/pkgs/applications/kde/ark/default.nix
+++ b/pkgs/applications/kde/ark/default.nix
@@ -9,14 +9,14 @@
   libarchive, libzip,
 
   # Archive tools
-  p7zip, lrzip,
+  lrzip,
 
   # Unfree tools
   unfreeEnableUnrar ? false, unrar,
 }:
 
 let
-  extraTools = [ p7zip lrzip ] ++ lib.optional unfreeEnableUnrar unrar;
+  extraTools = [ lrzip ] ++ lib.optional unfreeEnableUnrar unrar;
 in
 
 mkDerivation {
diff --git a/pkgs/applications/misc/1password/default.nix b/pkgs/applications/misc/1password/default.nix
index b27569a8a30c..010e9ae7a502 100644
--- a/pkgs/applications/misc/1password/default.nix
+++ b/pkgs/applications/misc/1password/default.nix
@@ -2,24 +2,24 @@
 
 stdenv.mkDerivation rec {
   pname = "1password";
-  version = "0.9.4";
+  version = "0.10.0";
   src =
     if stdenv.hostPlatform.system == "i686-linux" then
       fetchzip {
         url = "https://cache.agilebits.com/dist/1P/op/pkg/v${version}/op_linux_386_v${version}.zip";
-        sha256 = "0hgvcm42035fs2qhhvycppcrqgya98rmkk347j3hyj1m6kqxi99c";
+        sha256 = "07j11ikd0rzsj4d8rv74rfy497svq6l2q94ndf3b0a0mr8riyazj";
         stripRoot = false;
       }
     else if stdenv.hostPlatform.system == "x86_64-linux" then
       fetchzip {
         url = "https://cache.agilebits.com/dist/1P/op/pkg/v${version}/op_linux_amd64_v${version}.zip";
-        sha256 = "1fvl078kgpvzjr3jfp8zbajzsiwrcm33b7lqksxgcy30paqw6737";
+        sha256 = "177cl4x7rj3d74kzrpmiwps5n31axmlhqdwrdpkmay2gk9inswbs";
         stripRoot = false;
       }
     else if stdenv.hostPlatform.system == "x86_64-darwin" then
       fetchurl {
         url = "https://cache.agilebits.com/dist/1P/op/pkg/v${version}/op_darwin_amd64_v${version}.pkg";
-        sha256 = "0fzbfxsgf0s93kg647zla9n9k5adnfb57dcwwnibs6lq5k63h8mj";
+        sha256 = "13yxmnh77g6zvl2gqf77m5i3v5706p2plgbgsn5hqrrf3g8ql63b";
       }
     else throw "Architecture not supported";
 
diff --git a/pkgs/applications/misc/alacritty/default.nix b/pkgs/applications/misc/alacritty/default.nix
index 19f0790fea30..3135c1f88312 100644
--- a/pkgs/applications/misc/alacritty/default.nix
+++ b/pkgs/applications/misc/alacritty/default.nix
@@ -100,7 +100,7 @@ rustPlatform.buildRustPackage rec {
   '' + (
     if stdenv.isDarwin then ''
       mkdir $out/Applications
-      cp -r target/release/osx/Alacritty.app $out/Applications/Alacritty.app
+      cp -r $releaseDir/osx/Alacritty.app $out/Applications/Alacritty.app
     '' else ''
       install -D extra/linux/Alacritty.desktop -t $out/share/applications/
       install -D extra/logo/alacritty-term.svg $out/share/icons/hicolor/scalable/apps/Alacritty.svg
diff --git a/pkgs/applications/misc/cherrytree/default.nix b/pkgs/applications/misc/cherrytree/default.nix
index 7c00add77971..d2ade055d6fd 100644
--- a/pkgs/applications/misc/cherrytree/default.nix
+++ b/pkgs/applications/misc/cherrytree/default.nix
@@ -2,13 +2,13 @@
 
 pythonPackages.buildPythonApplication rec {
   pname = "cherrytree";
-  version = "0.39.2";
+  version = "0.39.3";
 
   src = fetchFromGitHub {
     owner = "giuspen";
     repo = "cherrytree";
     rev = version;
-    sha256 = "1l6wh24bhp4yhmsfmc0r4n2n10nlilkv4cmv5sfl80i250fiw7xa";
+    sha256 = "1k9i7acpphx0if6ij2p9fkmj638ry6hcyr1rdr039a8zi8hq98gz";
 
   };
 
diff --git a/pkgs/applications/misc/ddgr/default.nix b/pkgs/applications/misc/ddgr/default.nix
index c4639150dd4b..82730842baca 100644
--- a/pkgs/applications/misc/ddgr/default.nix
+++ b/pkgs/applications/misc/ddgr/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, python3, installShellFiles }:
 
 stdenv.mkDerivation rec {
-  version = "1.8";
+  version = "1.8.1";
   pname = "ddgr";
 
   src = fetchFromGitHub {
     owner = "jarun";
     repo = "ddgr";
     rev = "v${version}";
-    sha256 = "1cyaindcg2vc3ij0p6b35inr01c6ys04izxsn1h70ixhsz46qg8z";
+    sha256 = "0668wzh1gqin0xscy3fly9hz370n2ny175f3kya9bsld0x0jkd5p";
   };
 
   nativeBuildInputs = [ installShellFiles ];
@@ -17,11 +17,6 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
-  # Version 1.8 was released as 1.7
-  postPatch = ''
-    substituteInPlace ddgr --replace "_VERSION_ = '1.7'" "_VERSION_ = '${version}'"
-  '';
-
   postInstall = ''
     installShellCompletion --bash --name ddgr.bash auto-completion/bash/ddgr-completion.bash
     installShellCompletion --fish auto-completion/fish/ddgr.fish
diff --git a/pkgs/applications/misc/latte-dock/default.nix b/pkgs/applications/misc/latte-dock/default.nix
index 3fc5099acc2c..424da3ad3605 100644
--- a/pkgs/applications/misc/latte-dock/default.nix
+++ b/pkgs/applications/misc/latte-dock/default.nix
@@ -3,11 +3,11 @@
 
 mkDerivation rec {
   pname = "latte-dock";
-  version = "0.9.10";
+  version = "0.9.11";
 
   src = fetchurl {
     url = "https://download.kde.org/stable/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "11s9fslr33h3ic14ifr43jphf68jpny8jmhvmrrwcz6w0p3falzw";
+    sha256 = "0x7a93a7axsa0fzpbkkv1z722k9za4p51xcpzdpnh5ih1zij0csi";
     name = "${pname}-${version}.tar.xz";
   };
 
diff --git a/pkgs/applications/misc/notable/default.nix b/pkgs/applications/misc/notable/default.nix
index 9a00959de020..923f5fb4528e 100644
--- a/pkgs/applications/misc/notable/default.nix
+++ b/pkgs/applications/misc/notable/default.nix
@@ -3,14 +3,24 @@
 let
   pname = "notable";
   version = "1.8.4";
-in
-appimageTools.wrapType2 rec {
+  sha256 = "0rvz8zwsi62kiq89pv8n2wh9h5yb030kvdr1vf65xwqkhqcrzrby";
+
   name = "${pname}-${version}";
+
   src = fetchurl {
     url = "https://github.com/notable/notable/releases/download/v${version}/Notable-${version}.AppImage";
-    sha256 = "0rvz8zwsi62kiq89pv8n2wh9h5yb030kvdr1vf65xwqkhqcrzrby";
+    inherit sha256;
+  };
+
+  appimageContents = appimageTools.extract {
+    inherit name src;
   };
 
+in
+appimageTools.wrapType2 rec {
+
+  inherit name src;
+
   profile = ''
     export LC_ALL=C.UTF-8
     export XDG_DATA_DIRS=${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_DATA_DIRS
@@ -18,7 +28,14 @@ appimageTools.wrapType2 rec {
 
   multiPkgs = null; # no 32bit needed
   extraPkgs = p: (appimageTools.defaultFhsEnvArgs.multiPkgs p) ++ [ p.at-spi2-atk p.at-spi2-core ];
-  extraInstallCommands = "mv $out/bin/{${name},${pname}}";
+  extraInstallCommands = ''
+    mv $out/bin/{${name},${pname}}
+    install -m 444 -D ${appimageContents}/notable.desktop $out/share/applications/notable.desktop
+    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/1024x1024/apps/notable.png \
+      $out/share/icons/hicolor/1024x1024/apps/notable.png
+    substituteInPlace $out/share/applications/notable.desktop \
+      --replace 'Exec=AppRun' 'Exec=${pname}'
+  '';
 
   meta = with lib; {
     description = "The markdown-based note-taking app that doesn't suck";
diff --git a/pkgs/applications/misc/octoprint/default.nix b/pkgs/applications/misc/octoprint/default.nix
index b9951b666296..3c192c124cbe 100644
--- a/pkgs/applications/misc/octoprint/default.nix
+++ b/pkgs/applications/misc/octoprint/default.nix
@@ -1,5 +1,7 @@
-{ stdenv, lib, fetchFromGitHub, python2 }:
-
+{ pkgs, stdenv, lib, fetchFromGitHub, python3
+# To include additional plugins, pass them here as an overlay.
+, packageOverrides ? self: super: {}
+}:
 let
   mkOverride = attrname: version: sha256:
     self: super: {
@@ -11,17 +13,19 @@ let
       });
     };
 
-  py = python2.override {
+  py = python3.override {
+    self = py;
     packageOverrides = lib.foldr lib.composeExtensions (self: super: { }) ([
-      (mkOverride "flask"       "0.10.1" "0wrkavjdjndknhp8ya8j850jq7a1cli4g5a93mg8nh1xz2gq50sc")
-      (mkOverride "flask_login" "0.2.11" "1rg3rsjs1gwi2pw6vr9jmhaqm9b3vc9c4hfcsvp4y8agbh7g3mc3")
+      (mkOverride "flask"       "0.12.5" "fac2b9d443e49f7e7358a444a3db5950bdd0324674d92ba67f8f1f15f876b14f")
+      (mkOverride "flaskbabel"  "0.12.2" "11jwp8vvq1gnm31qh6ihy2h393hy18yn9yjp569g60r0wj1x2sii")
       (mkOverride "tornado"     "4.5.3"  "02jzd23l4r6fswmwxaica9ldlyc2p6q8dk6dyff7j58fmdzf853d")
+      (mkOverride "psutil"      "5.6.7"  "ffad8eb2ac614518bbe3c0b8eb9dffdb3a8d2e3a7d5da51c5b974fb723a5c5aa")
 
       # Octoprint holds back jinja2 to 2.8.1 due to breaking changes.
       # This old version does not have updated test config for pytest 4,
       # and pypi tarball doesn't contain tests dir anyways.
-      (pself: psuper: {
-        jinja2 = psuper.jinja2.overridePythonAttrs (oldAttrs: rec {
+      (self: super: {
+        jinja2 = super.jinja2.overridePythonAttrs (oldAttrs: rec {
           version = "2.8.1";
           src = oldAttrs.src.override {
             inherit version;
@@ -29,74 +33,75 @@ let
           };
           doCheck = false;
         });
+
+        httpretty = super.httpretty.overridePythonAttrs (oldAttrs: rec {
+          doCheck = false;
+        });
+
+        celery = super.celery.overridePythonAttrs (oldAttrs: rec {
+          doCheck = false;
+        });
       })
-    ]);
-  };
+      (self: super: {
+        octoprint = self.buildPythonPackage rec {
+          pname = "OctoPrint";
+          version = "1.4.0";
+
+          src = fetchFromGitHub {
+            owner  = "foosel";
+            repo   = "OctoPrint";
+            rev    = version;
+            sha256 = "0387228544v28d69dcdg2zr5gp6qavkfr6dydpjgj5awxv3w25d5";
+          };
 
-  ignoreVersionConstraints = [
-    "Click"
-    "Flask-Assets"
-    "Flask-Babel"
-    "Flask-Principal"
-    "emoji"
-    "flask"
-    "future"
-    "futures"
-    "monotonic"
-    "markdown"
-    "pkginfo"
-    "psutil"
-    "pyserial"
-    "requests"
-    "rsa"
-    "sarge"
-    "scandir"
-    "semantic_version"
-    "watchdog"
-    "websocket-client"
-    "wrapt"
-    "sentry-sdk"
-    "werkzeug" # 0.16 just deprecates some stuff
-  ];
+          propagatedBuildInputs = with super; [
+            awesome-slugify flask flask_assets rsa requests pkginfo watchdog
+            semantic-version werkzeug flaskbabel tornado
+            psutil pyserial flask_login netaddr markdown
+            pylru pyyaml sarge feedparser netifaces click websocket_client
+            scandir chainmap future wrapt monotonic emoji jinja2
+            frozendict cachelib sentry-sdk filetype markupsafe
+          ] ++ lib.optionals stdenv.isDarwin [ py.pkgs.appdirs ];
 
-in py.pkgs.buildPythonApplication rec {
-  pname = "OctoPrint";
-  version = "1.3.12";
+          checkInputs = with super; [ pytestCheckHook mock ddt ];
 
-  src = fetchFromGitHub {
-    owner  = "foosel";
-    repo   = "OctoPrint";
-    rev    = version;
-    sha256 = "1lmqssgwjyhknjf3x58g7cr0fqz7fs5a3rl07r69wfpch63ranyd";
-  };
+          postPatch = let
+            ignoreVersionConstraints = [
+              "sentry-sdk"
+            ];
+          in ''
+            sed -r -i \
+              ${lib.concatStringsSep "\n" (map (e:
+                ''-e 's@${e}[<>=]+.*@${e}",@g' \''
+              ) ignoreVersionConstraints)}
+              setup.py
+          '';
 
-  propagatedBuildInputs = with py.pkgs; [
-    awesome-slugify flask_assets rsa requests pkginfo watchdog
-    semantic-version flask_principal werkzeug flaskbabel tornado
-    psutil pyserial flask_login netaddr markdown sockjs-tornado
-    pylru pyyaml sarge feedparser netifaces click websocket_client
-    scandir chainmap future futures wrapt monotonic emoji
-    frozendict cachelib sentry-sdk typing filetype
-  ] ++ lib.optionals stdenv.isDarwin [ py.pkgs.appdirs ];
+          dontUseSetuptoolsCheck = true;
 
-  checkInputs = with py.pkgs; [ nose mock ddt ];
+          preCheck = ''
+            export HOME=$(mktemp -d)
+            rm pytest.ini
+          '';
 
-  postPatch = ''
-    sed -r -i \
-      ${lib.concatStringsSep "\n" (map (e:
-        ''-e 's@${e}[<>=]+.*@${e}",@g' \''
-      ) ignoreVersionConstraints)}
-      setup.py
-  '';
+          disabledTests = [
+            "test_check_setup" # Why should it be able to call pip?
+          ] ++ lib.optionals stdenv.isDarwin [
+            "test_set_external_modification"
+          ];
 
-  checkPhase = ''
-    HOME=$(mktemp -d) nosetests ${lib.optionalString stdenv.isDarwin "--exclude=test_set_external_modification"}
-  '';
+          passthru.python = self.python;
 
-  meta = with stdenv.lib; {
-    homepage = "https://octoprint.org/";
-    description = "The snappy web interface for your 3D printer";
-    license = licenses.agpl3;
-    maintainers = with maintainers; [ abbradar gebner ];
+          meta = with stdenv.lib; {
+            homepage = "https://octoprint.org/";
+            description = "The snappy web interface for your 3D printer";
+            license = licenses.agpl3;
+            maintainers = with maintainers; [ abbradar gebner WhittlesJr ];
+          };
+        };
+      })
+      (import ./plugins.nix {inherit pkgs;})
+      packageOverrides
+    ]);
   };
-}
+in with py.pkgs; toPythonApplication octoprint
diff --git a/pkgs/applications/misc/octoprint/plugins.nix b/pkgs/applications/misc/octoprint/plugins.nix
index 69eb313238bd..b5d52f5e5f89 100644
--- a/pkgs/applications/misc/octoprint/plugins.nix
+++ b/pkgs/applications/misc/octoprint/plugins.nix
@@ -1,255 +1,255 @@
-{ stdenv, fetchgit, fetchFromGitHub, octoprint, python2Packages, marlin-calc }:
+{ pkgs }:
 
-let
-  buildPlugin = args: python2Packages.buildPythonPackage (args // {
+with pkgs;
+
+self: super: let
+  buildPlugin = args: self.buildPythonPackage (args // {
     pname = "OctoPrintPlugin-${args.pname}";
     inherit (args) version;
-    propagatedBuildInputs = (args.propagatedBuildInputs or []) ++ [ octoprint ];
+    propagatedBuildInputs = (args.propagatedBuildInputs or []) ++ [ super.octoprint ];
     # none of the following have tests
     doCheck = false;
   });
+in {
+  inherit buildPlugin;
+
+  # Deprecated alias
+  m3d-fio = self.m33-fio; # added 2016-08-13
+
+  m33-fio = buildPlugin rec {
+    pname = "M33-Fio";
+    version = "1.21";
+
+    src = fetchFromGitHub {
+      owner = "donovan6000";
+      repo = "M33-Fio";
+      rev = "V${version}";
+      sha256 = "1la3611kkqn8yiwjn6cizc45ri8pnk6ckld1na4nk6mqk88jvjq7";
+    };
+
+    patches = [
+      ./m33-fio-one-library.patch
+    ];
+
+    postPatch = ''
+      rm -rf octoprint_m33fio/static/libraries/*
+      (
+        cd 'shared library source'
+        make
+      )
+    '';
+
+    meta = with stdenv.lib; {
+      description = "OctoPrint plugin for the Micro 3D printer";
+      homepage = "https://github.com/donovan6000/M33-Fio";
+      license = licenses.gpl3;
+      maintainers = with maintainers; [ abbradar ];
+    };
+  };
+
+  mqtt = buildPlugin rec {
+    pname = "MQTT";
+    version = "0.8.6";
+
+    src = fetchFromGitHub {
+      owner = "OctoPrint";
+      repo = "OctoPrint-MQTT";
+      rev = version;
+      sha256 = "0y1jnfplcy8mh3szrfbbvngl02j49cbdizglrfsry4fvqg50zjxd";
+    };
+
+    propagatedBuildInputs = with super; [ paho-mqtt ];
+
+    meta = with stdenv.lib; {
+      description = "Publish printer status MQTT";
+      homepage = "https://github.com/OctoPrint/OctoPrint-MQTT";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ peterhoeg ];
+    };
+  };
+
+  titlestatus = buildPlugin rec {
+    pname = "TitleStatus";
+    version = "0.0.4";
+
+    src = fetchFromGitHub {
+      owner = "MoonshineSG";
+      repo = "OctoPrint-TitleStatus";
+      rev = version;
+      sha256 = "1l78xrabn5hcly2mgxwi17nwgnp2s6jxi9iy4wnw8k8icv74ag7k";
+    };
+
+    meta = with stdenv.lib; {
+      description = "Show printers status in window title";
+      homepage = "https://github.com/MoonshineSG/OctoPrint-TitleStatus";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ abbradar ];
+    };
+  };
+
+  stlviewer = buildPlugin rec {
+    pname = "STLViewer";
+    version = "0.4.2";
+
+    src = fetchFromGitHub {
+      owner = "jneilliii";
+      repo = "OctoPrint-STLViewer";
+      rev = version;
+      sha256 = "0mkvh44fn2ch4z2avsdjwi1rp353ylmk9j5fln4x7rx8ph8y7g2b";
+    };
+
+    meta = with stdenv.lib; {
+      description = "A simple stl viewer tab for OctoPrint";
+      homepage = "https://github.com/jneilliii/Octoprint-STLViewer";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ abbradar ];
+    };
+  };
+
+  curaenginelegacy = buildPlugin rec {
+    pname = "CuraEngineLegacy";
+    version = "1.0.2";
+
+    src = fetchFromGitHub {
+      owner = "OctoPrint";
+      repo = "OctoPrint-${pname}";
+      rev = version;
+      sha256 = "1cdb276wfyf3wcfj5g3migd6b6aqmkrxncrqjfcfx4j4k3xac965";
+    };
+
+    meta = with stdenv.lib; {
+      description = "Plugin for slicing via Cura Legacy from within OctoPrint";
+      homepage = "https://github.com/OctoPrint/OctoPrint-CuraEngineLegacy";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ gebner ];
+    };
+  };
 
-  self = {
-
-    # Deprecated alias
-    m3d-fio = self.m33-fio; # added 2016-08-13
-
-    m33-fio = buildPlugin rec {
-      pname = "M33-Fio";
-      version = "1.21";
-
-      src = fetchFromGitHub {
-        owner = "donovan6000";
-        repo = "M33-Fio";
-        rev = "V${version}";
-        sha256 = "1la3611kkqn8yiwjn6cizc45ri8pnk6ckld1na4nk6mqk88jvjq7";
-      };
-
-      patches = [
-        ./m33-fio-one-library.patch
-      ];
-
-      postPatch = ''
-        rm -rf octoprint_m33fio/static/libraries/*
-        (
-          cd 'shared library source'
-          make
-        )
-      '';
-
-      meta = with stdenv.lib; {
-        description = "OctoPrint plugin for the Micro 3D printer";
-        homepage = "https://github.com/donovan6000/M33-Fio";
-        license = licenses.gpl3;
-        maintainers = with maintainers; [ abbradar ];
-      };
-    };
-
-    mqtt = buildPlugin rec {
-      pname = "MQTT";
-      version = "0.8.6";
-
-      src = fetchFromGitHub {
-        owner = "OctoPrint";
-        repo = "OctoPrint-MQTT";
-        rev = version;
-        sha256 = "0y1jnfplcy8mh3szrfbbvngl02j49cbdizglrfsry4fvqg50zjxd";
-      };
-
-      propagatedBuildInputs = with python2Packages; [ paho-mqtt ];
-
-      meta = with stdenv.lib; {
-        description = "Publish printer status MQTT";
-        homepage = "https://github.com/OctoPrint/OctoPrint-MQTT";
-        license = licenses.agpl3;
-        maintainers = with maintainers; [ peterhoeg ];
-      };
-    };
-
-    titlestatus = buildPlugin rec {
-      pname = "TitleStatus";
-      version = "0.0.4";
-
-      src = fetchFromGitHub {
-        owner = "MoonshineSG";
-        repo = "OctoPrint-TitleStatus";
-        rev = version;
-        sha256 = "1l78xrabn5hcly2mgxwi17nwgnp2s6jxi9iy4wnw8k8icv74ag7k";
-      };
-
-      meta = with stdenv.lib; {
-        description = "Show printers status in window title";
-        homepage = "https://github.com/MoonshineSG/OctoPrint-TitleStatus";
-        license = licenses.agpl3;
-        maintainers = with maintainers; [ abbradar ];
-      };
-    };
-
-    stlviewer = buildPlugin rec {
-      pname = "STLViewer";
-      version = "0.4.2";
-
-      src = fetchFromGitHub {
-        owner = "jneilliii";
-        repo = "OctoPrint-STLViewer";
-        rev = version;
-        sha256 = "0mkvh44fn2ch4z2avsdjwi1rp353ylmk9j5fln4x7rx8ph8y7g2b";
-      };
-
-      meta = with stdenv.lib; {
-        description = "A simple stl viewer tab for OctoPrint";
-        homepage = "https://github.com/jneilliii/Octoprint-STLViewer";
-        license = licenses.agpl3;
-        maintainers = with maintainers; [ abbradar ];
-      };
-    };
-
-    curaenginelegacy = buildPlugin rec {
-      pname = "CuraEngineLegacy";
-      version = "1.0.2";
-
-      src = fetchFromGitHub {
-        owner = "OctoPrint";
-        repo = "OctoPrint-${pname}";
-        rev = version;
-        sha256 = "1cdb276wfyf3wcfj5g3migd6b6aqmkrxncrqjfcfx4j4k3xac965";
-      };
-
-      meta = with stdenv.lib; {
-        description = "Plugin for slicing via Cura Legacy from within OctoPrint";
-        homepage = "https://github.com/OctoPrint/OctoPrint-CuraEngineLegacy";
-        license = licenses.agpl3;
-        maintainers = with maintainers; [ gebner ];
-      };
-    };
-
-    touchui = buildPlugin rec {
-      pname = "TouchUI";
-      version = "0.3.13";
-
-      src = fetchFromGitHub {
-        owner = "BillyBlaze";
-        repo = "OctoPrint-${pname}";
-        rev = version;
-        sha256 = "0qk12ysabdzy6cna3l4f8v3qcnppppwxxsjx2i0xn1nd0cv6yzwh";
-      };
-
-      meta = with stdenv.lib; {
-        description = "Touch friendly interface for a small TFT module or phone for OctoPrint";
-        homepage = "https://github.com/BillyBlaze/OctoPrint-TouchUI";
-        license = licenses.agpl3;
-        maintainers = with maintainers; [ gebner ];
-      };
-    };
-
-    psucontrol = buildPlugin rec {
-      pname = "PSUControl";
-      version = "0.1.8";
-
-      src = fetchFromGitHub {
-        owner = "kantlivelong";
-        repo = "OctoPrint-${pname}";
-        rev = version;
-        sha256 = "0aj38d7b7d5pzmzq841pip18cpg18wy2vrxq2nd13875597y54b8";
-      };
-
-      preConfigure = ''
-        # optional; RPi.GPIO is broken on vanilla kernels
-        sed /RPi.GPIO/d -i requirements.txt
-      '';
-
-      meta = with stdenv.lib; {
-        description = "OctoPrint plugin to control ATX/AUX power supply";
-        homepage = "https://github.com/kantlivelong/OctoPrint-PSUControl";
-        license = licenses.agpl3;
-        maintainers = with maintainers; [ gebner ];
-      };
-    };
-
-    printtimegenius = buildPlugin rec {
-      pname = "PrintTimeGenius";
-      version = "2.2.1";
-
-      src = fetchFromGitHub {
-        owner = "eyal0";
-        repo = "OctoPrint-${pname}";
-        rev = version;
-        sha256 = "1dr93vbpxgxw3b1q4rwam8f4dmiwr5vnfr9796g6jx8xkpfzzy1h";
-      };
-
-      preConfigure = ''
-        # PrintTimeGenius ships with marlin-calc binaries for multiple architectures
-        rm */analyzers/marlin-calc*
-        sed 's@"{}.{}".format(binary_base_name, machine)@"${marlin-calc}/bin/marlin-calc"@' -i */analyzers/analyze_progress.py
-      '';
-
-      patches = [
-        ./printtimegenius-logging.patch
-      ];
-
-      meta = with stdenv.lib; {
-        description = "Better print time estimation for OctoPrint";
-        homepage = "https://github.com/eyal0/OctoPrint-PrintTimeGenius";
-        license = licenses.agpl3;
-        maintainers = with maintainers; [ gebner ];
-      };
-    };
-
-    abl-expert = buildPlugin rec {
-      pname = "ABL_Expert";
-      version = "2019-12-21";
-
-      src = fetchgit {
-        url = "https://framagit.org/razer/Octoprint_ABL_Expert/";
-        rev = "f11fbe05088ad618bfd9d064ac3881faec223f33";
-        sha256 = "026r4prkyvwzxag5pv36455q7s3gaig37nmr2nbvhwq3d2lbi5s4";
-      };
-
-      meta = with stdenv.lib; {
-        description = "Marlin auto bed leveling control, mesh correction, and z probe handling";
-        homepage = "https://framagit.org/razer/Octoprint_ABL_Expert/";
-        license = licenses.agpl3;
-        maintainers = with maintainers; [ WhittlesJr ];
-      };
-    };
-
-    gcodeeditor = buildPlugin rec {
-      pname = "GcodeEditor";
-      version = "0.2.6";
-
-      src = fetchFromGitHub {
-        owner = "ieatacid";
-        repo = "OctoPrint-${pname}";
-        rev = version;
-        sha256 = "0c6p78r3vd6ys3kld308pyln09zjbr9yif1ljvcx6wlml2i5l1vh";
-      };
-
-      meta = with stdenv.lib; {
-        description = "Edit gcode on OctoPrint";
-        homepage = "https://github.com/Sebclem/OctoPrint-SimpleEmergencyStop";
-        license = licenses.agpl3;
-        maintainers = with maintainers; [ WhittlesJr ];
-      };
-    };
-
-    simpleemergencystop = buildPlugin rec {
-      pname = "SimpleEmergencyStop";
-      version = "0.2.5";
-
-      src = fetchFromGitHub {
-        owner = "Sebclem";
-        repo = "OctoPrint-${pname}";
-        rev = version;
-        sha256 = "10wadv09wv2h96igvq3byw9hz1si82n3c7v5y0ii3j7hm2d06y8p";
-      };
-
-      meta = with stdenv.lib; {
-        description = "A simple plugin that add an emergency stop buton on NavBar of OctoPrint";
-        homepage = "https://github.com/ieatacid/OctoPrint-GcodeEditor";
-        license = licenses.agpl3;
-        maintainers = with maintainers; [ WhittlesJr ];
-      };
+  touchui = buildPlugin rec {
+    pname = "TouchUI";
+    version = "0.3.14";
+
+    src = fetchFromGitHub {
+      owner = "BillyBlaze";
+      repo = "OctoPrint-${pname}";
+      rev = version;
+      sha256 = "033b9nk3kpnmjw9nggcaxy39hcgfviykcy2cx0j6m411agvmqbzf";
+    };
+
+    meta = with stdenv.lib; {
+      description = "Touch friendly interface for a small TFT module or phone for OctoPrint";
+      homepage = "https://github.com/BillyBlaze/OctoPrint-TouchUI";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ gebner ];
     };
   };
 
-in self
+  psucontrol = buildPlugin rec {
+    pname = "PSUControl";
+    version = "0.1.9";
+
+    src = fetchFromGitHub {
+      owner = "kantlivelong";
+      repo = "OctoPrint-${pname}";
+      rev = version;
+      sha256 = "1cn009bdgn6c9ba9an5wfj8z02wi0xcsmbhkqggiqlnqy1fq45ca";
+    };
+
+    preConfigure = ''
+      # optional; RPi.GPIO is broken on vanilla kernels
+      sed /RPi.GPIO/d -i requirements.txt
+    '';
+
+    meta = with stdenv.lib; {
+      description = "OctoPrint plugin to control ATX/AUX power supply";
+      homepage = "https://github.com/kantlivelong/OctoPrint-PSUControl";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ gebner ];
+    };
+  };
+
+  printtimegenius = buildPlugin rec {
+    pname = "PrintTimeGenius";
+    version = "2.2.1";
+
+    src = fetchFromGitHub {
+      owner = "eyal0";
+      repo = "OctoPrint-${pname}";
+      rev = version;
+      sha256 = "1dr93vbpxgxw3b1q4rwam8f4dmiwr5vnfr9796g6jx8xkpfzzy1h";
+    };
+
+    preConfigure = ''
+      # PrintTimeGenius ships with marlin-calc binaries for multiple architectures
+      rm */analyzers/marlin-calc*
+      sed 's@"{}.{}".format(binary_base_name, machine)@"${pkgs.marlin-calc}/bin/marlin-calc"@' -i */analyzers/analyze_progress.py
+    '';
+
+    patches = [
+      ./printtimegenius-logging.patch
+    ];
+
+    meta = with stdenv.lib; {
+      description = "Better print time estimation for OctoPrint";
+      homepage = "https://github.com/eyal0/OctoPrint-PrintTimeGenius";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ gebner ];
+    };
+  };
+
+  abl-expert = buildPlugin rec {
+    pname = "ABL_Expert";
+    version = "2019-12-21";
+
+    src = fetchgit {
+      url = "https://framagit.org/razer/Octoprint_ABL_Expert/";
+      rev = "f11fbe05088ad618bfd9d064ac3881faec223f33";
+      sha256 = "026r4prkyvwzxag5pv36455q7s3gaig37nmr2nbvhwq3d2lbi5s4";
+    };
+
+    meta = with stdenv.lib; {
+      description = "Marlin auto bed leveling control, mesh correction, and z probe handling";
+      homepage = "https://framagit.org/razer/Octoprint_ABL_Expert/";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ WhittlesJr ];
+    };
+  };
+
+  gcodeeditor = buildPlugin rec {
+    pname = "GcodeEditor";
+    version = "0.2.6";
+
+    src = fetchFromGitHub {
+      owner = "ieatacid";
+      repo = "OctoPrint-${pname}";
+      rev = version;
+      sha256 = "0c6p78r3vd6ys3kld308pyln09zjbr9yif1ljvcx6wlml2i5l1vh";
+    };
+
+    meta = with stdenv.lib; {
+      description = "Edit gcode on OctoPrint";
+      homepage = "https://github.com/ieatacid/OctoPrint-GcodeEditor";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ WhittlesJr ];
+    };
+  };
+
+  simpleemergencystop = buildPlugin rec {
+    pname = "SimpleEmergencyStop";
+    version = "0.2.5";
+
+    src = fetchFromGitHub {
+      owner = "Sebclem";
+      repo = "OctoPrint-${pname}";
+      rev = version;
+      sha256 = "10wadv09wv2h96igvq3byw9hz1si82n3c7v5y0ii3j7hm2d06y8p";
+    };
+
+    meta = with stdenv.lib; {
+      description = "A simple plugin that add an emergency stop buton on NavBar of OctoPrint";
+      homepage = "https://github.com/Sebclem/OctoPrint-SimpleEmergencyStop";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ WhittlesJr ];
+    };
+  };
+}
diff --git a/pkgs/applications/misc/osmium-tool/default.nix b/pkgs/applications/misc/osmium-tool/default.nix
index 82144e9689f8..c0d20c14f7ce 100644
--- a/pkgs/applications/misc/osmium-tool/default.nix
+++ b/pkgs/applications/misc/osmium-tool/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "osmium-tool";
-  version = "1.11.1";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "osmcode";
     repo = "osmium-tool";
     rev = "v${version}";
-    sha256 = "199dvajik5d56nybk2061vdjyxwakngfd7frxj99wr2vsrp4aw2b";
+    sha256 = "18afn5qzdjpip176kk5pr04mj0p7dv70dbz1n36qmqnq3gyms10q";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/misc/pdfarranger/default.nix b/pkgs/applications/misc/pdfarranger/default.nix
index 58d889484d6f..4d2576aaadce 100644
--- a/pkgs/applications/misc/pdfarranger/default.nix
+++ b/pkgs/applications/misc/pdfarranger/default.nix
@@ -5,13 +5,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pdfarranger";
-  version = "1.4.2";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "jeromerobert";
     repo = pname;
     rev = version;
-    sha256 = "11q14pxyp5z4y3gabjnis3ip3xss6n94zjl42akwf27dxgxlpcjk";
+    sha256 = "0n4jw0dsqw929a34ff077kz8w89vkjkqf8dy4c356zh6gf23cdxr";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/pdfsam-basic/default.nix b/pkgs/applications/misc/pdfsam-basic/default.nix
index abf49f936845..d18923527851 100644
--- a/pkgs/applications/misc/pdfsam-basic/default.nix
+++ b/pkgs/applications/misc/pdfsam-basic/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pdfsam-basic";
-  version = "4.1.2";
+  version = "4.1.3";
 
   src = fetchurl {
     url = "https://github.com/torakiki/pdfsam/releases/download/v${version}/pdfsam_${version}-1_amd64.deb";
-    sha256 = "1k1azxz92vkb4hylk4ki0szfn47ids0lwg01zfs54yc89j0c6142";
+    sha256 = "1rhv6mf6pr9aaa8516i3b7v6h622qb1p8c4jsy3j0s5wrdry5l9l";
   };
 
   unpackPhase = ''
diff --git a/pkgs/applications/misc/pueue/default.nix b/pkgs/applications/misc/pueue/default.nix
index e90a86f225bf..0498419910f6 100644
--- a/pkgs/applications/misc/pueue/default.nix
+++ b/pkgs/applications/misc/pueue/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pueue";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "Nukesor";
     repo = pname;
     rev = "v${version}";
-    sha256 = "11x4y3ah9f7mv9jssws95sw7rd20fxwdh11mrhcb4vwk59cmqsjz";
+    sha256 = "1v3fphx71hyv7fq09slhyzchw362swzhmhn7wmbazfdrj6fjhcki";
   };
 
-  cargoSha256 = "06zv3li14sg4a8bgj38zzx576ggm32ss0djmys1g0h5a0nxaaqfx";
+  cargoSha256 = "04vi9la17pabz1spfw1fzgy4c2ifnis6am5m4ck3lhccnn6j8bd3";
 
   checkPhase = "cargo test -- --skip test_single_huge_payload";
 
diff --git a/pkgs/applications/misc/redshift/default.nix b/pkgs/applications/misc/redshift/default.nix
index 81fbcc8b4838..43393478ec4a 100644
--- a/pkgs/applications/misc/redshift/default.nix
+++ b/pkgs/applications/misc/redshift/default.nix
@@ -101,12 +101,13 @@ rec {
 
   redshift-wlr = mkRedshift {
     pname = "redshift-wlr";
-    version = "2019-04-17";
+    # upstream rebases so this is the push date
+    version = "2019-08-24";
 
     src = fetchFromGitHub {
       owner = "minus7";
       repo = "redshift";
-      rev = "eecbfedac48f827e96ad5e151de8f41f6cd3af66";
+      rev = "7da875d34854a6a34612d5ce4bd8718c32bec804";
       sha256 = "0rs9bxxrw4wscf4a8yl776a8g880m5gcm75q06yx2cn3lw2b7v22";
     };
 
diff --git a/pkgs/applications/misc/sweethome3d/default.nix b/pkgs/applications/misc/sweethome3d/default.nix
index 7f094607859c..926db03652d6 100644
--- a/pkgs/applications/misc/sweethome3d/default.nix
+++ b/pkgs/applications/misc/sweethome3d/default.nix
@@ -73,14 +73,14 @@ in {
 
   application = mkSweetHome3D rec {
     pname = stdenv.lib.toLower module + "-application";
-    version = "6.2";
+    version = "6.3";
     module = "SweetHome3D";
     description = "Design and visualize your future home";
     license = stdenv.lib.licenses.gpl2Plus;
     src = fetchsvn {
       url = "https://svn.code.sf.net/p/sweethome3d/code/tags/V_" + d2u version + "/SweetHome3D/";
-      sha256 = "0a514a1zmipykvawil46v826ivkw9c00vdkyggyl6m41giay15zf";
-      rev = "6822";
+      sha256 = "1c13g0f73jgbzmjhdm9knqq1kh3vdl04zl3xlp30g9a1n0jkr38i";
+      rev = "6896";
     };
     desktopName = "Sweet Home 3D";
     icons = {
diff --git a/pkgs/applications/misc/toot/default.nix b/pkgs/applications/misc/toot/default.nix
index 7f1c3648f245..5ce35f3292bd 100644
--- a/pkgs/applications/misc/toot/default.nix
+++ b/pkgs/applications/misc/toot/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, python3Packages }:
 
 python3Packages.buildPythonApplication rec {
-  version = "0.25.2";
+  version = "0.26.0";
   name    = "toot-${version}";
 
   src = fetchFromGitHub {
     owner  = "ihabunek";
     repo   = "toot";
     rev    = version;
-    sha256 = "0g18x8pbwhk2d3aphah6dqqbhz62k48pwx63flsnqd4brccd0jkh";
+    sha256 = "146jj83jixahgxwh12bbkfvci2wrz398h5x01kgppdy59m4pa4pl";
   };
 
   checkInputs = with python3Packages; [ pytest ];
diff --git a/pkgs/applications/networking/browsers/ephemeral/default.nix b/pkgs/applications/networking/browsers/ephemeral/default.nix
index 53d0ffb4c193..ead9555c3a6b 100644
--- a/pkgs/applications/networking/browsers/ephemeral/default.nix
+++ b/pkgs/applications/networking/browsers/ephemeral/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ephemeral";
-  version = "6.3.3";
+  version = "6.4.1";
 
   src = fetchFromGitHub {
     owner = "cassidyjames";
     repo = "ephemeral";
     rev = version;
-    sha256 = "093bqc40p4s8jc1s5rg49363x24vnwwjayvgzmi4xag28f1x6kn8";
+    sha256 = "1lzcwaczh601kwbx7fzg32nrzlg67asby7p86qy10qz86xf4g608";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/cluster/atlantis/default.nix b/pkgs/applications/networking/cluster/atlantis/default.nix
index cb846060a3de..7d04595d3feb 100644
--- a/pkgs/applications/networking/cluster/atlantis/default.nix
+++ b/pkgs/applications/networking/cluster/atlantis/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "atlantis";
-  version = "0.11.1";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "runatlantis";
     repo = "atlantis";
     rev = "v${version}";
-    sha256 = "1ylk6n13ln6yaq4nc4n7fm00wfiyqi2x33sca5avzsvd1b387kk6";
+    sha256 = "16zz4xwpqipdmszbz93xxw31hbh7s8pfa9dm64ybyni7wc4lvdy6";
   };
 
-  modSha256 = "1bhplk3p780llpj9l0fwcyli74879968d6j582mvjwvf2winbqzq";
+  modSha256 = "18f7cf61yn5jkji5a4v6xw6c7xl40nj32n5w34xmcmszzf64cwkn";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/applications/networking/cluster/chronos/default.nix b/pkgs/applications/networking/cluster/chronos/default.nix
index e2452b2b4411..e0cc780841bf 100644
--- a/pkgs/applications/networking/cluster/chronos/default.nix
+++ b/pkgs/applications/networking/cluster/chronos/default.nix
@@ -34,6 +34,6 @@ stdenv.mkDerivation rec {
     description = "Fault tolerant job scheduler for Mesos which handles dependencies and ISO8601 based schedules";
     maintainers = with maintainers; [ offline ];
     platforms   = platforms.unix;
-    broken = true; # doesn't build http://hydra.nixos.org/build/25768319
+    broken = true; # doesn't build https://hydra.nixos.org/build/25768319
   };
 }
diff --git a/pkgs/applications/networking/cluster/helmfile/default.nix b/pkgs/applications/networking/cluster/helmfile/default.nix
index 1318ff003de3..628ae10f11b7 100644
--- a/pkgs/applications/networking/cluster/helmfile/default.nix
+++ b/pkgs/applications/networking/cluster/helmfile/default.nix
@@ -1,6 +1,6 @@
 { lib, buildGoModule, fetchFromGitHub, makeWrapper, kubernetes-helm, ... }:
 
-let version = "0.106.3"; in
+let version = "0.114.0"; in
 
 buildGoModule {
   pname = "helmfile";
@@ -10,12 +10,12 @@ buildGoModule {
     owner = "roboll";
     repo = "helmfile";
     rev = "v${version}";
-    sha256 = "0pwkkgdcj9vx6nk574iaqwn074qfpgqd1c44d3kr3xdbac89yfyf";
+    sha256 = "0486wcfizi8xljr29mznc4p11ggz4rvk5n53qvb30f7ry4ncc8n5";
   };
 
   goPackagePath = "github.com/roboll/helmfile";
 
-  modSha256 = "1yv2b44qac0rms66v0qg13wsga0di6hwxa4dh2l0b1xvaf75ysay";
+  modSha256 = "0j7w12rrnsv2h5v0bqh6sjq9anm51zs0p3nzlhwsksw9c98r9avk";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/applications/networking/cluster/k9s/default.nix b/pkgs/applications/networking/cluster/k9s/default.nix
index 1cf76e1cff30..a51d1afb3674 100644
--- a/pkgs/applications/networking/cluster/k9s/default.nix
+++ b/pkgs/applications/networking/cluster/k9s/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "k9s";
-  version = "0.18.1";
+  version = "0.19.4";
 
   src = fetchFromGitHub {
     owner  = "derailed";
     repo   = "k9s";
     rev    = "v${version}";
-    sha256 = "0a5x4yamvx2qlwngfvainbhplwp0hqwgvdqlj2jbrbz4hfhr1l59";
+    sha256 = "1ya3lrw31pxd1rxzf88l5hzilaxwrng1a3ibawgn57my333hrmf6";
   };
 
   buildFlagsArray = ''
@@ -18,7 +18,7 @@ buildGoModule rec {
       -X github.com/derailed/k9s/cmd.commit=${src.rev}
   '';
 
-  modSha256 = "0wpf6iyq6p3a8azdkn17gdp01wq9khyzr1bab6qgvsnsnhnjzcky";
+  modSha256 = "11jxyzajlk6b5j19sg1kjr7qdzpxkwjwrvyhx9mwy6jb5sgqbzv8";
 
   meta = with stdenv.lib; {
     description = "Kubernetes CLI To Manage Your Clusters In Style.";
diff --git a/pkgs/applications/networking/cluster/luigi/default.nix b/pkgs/applications/networking/cluster/luigi/default.nix
index 010d8cf4d215..ced4c45d059d 100644
--- a/pkgs/applications/networking/cluster/luigi/default.nix
+++ b/pkgs/applications/networking/cluster/luigi/default.nix
@@ -2,11 +2,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "luigi";
-  version = "2.8.12";
+  version = "2.8.13";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "1p83mxqs7w5v27a58ps7wji5mlyfz66cpkbyrndix0pv9hdyzpxn";
+    sha256 = "0x14549iwj7r1knc0hmic9ny9hp960yjjqi4mxl78jb69gd3bhmf";
   };
 
   propagatedBuildInputs = with python3Packages; [ dateutil tornado_4 python-daemon boto3 ];
diff --git a/pkgs/applications/networking/feedreaders/rssguard/default.nix b/pkgs/applications/networking/feedreaders/rssguard/default.nix
index d0825404f017..5ee80250dde1 100644
--- a/pkgs/applications/networking/feedreaders/rssguard/default.nix
+++ b/pkgs/applications/networking/feedreaders/rssguard/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rssguard";
-  version = "3.5.9";
+  version = "3.6.0";
 
   src = fetchFromGitHub {
     owner = "martinrotter";
     repo = pname;
     rev = version;
-    sha256 = "0dvjcazvrgxfxg1gvznxj8kx569v4ivns0brq00cn2yxyd4wx43s";
+    sha256 = "0nlvhcvd3bbvd3dapqix7h29pchbd9gv5n3hmrig9yi98yv8q53r";
   };
 
   buildInputs =  [ qtwebengine qttools ];
diff --git a/pkgs/applications/networking/gmailctl/default.nix b/pkgs/applications/networking/gmailctl/default.nix
index ea387dad4243..a7dc6fe1550d 100644
--- a/pkgs/applications/networking/gmailctl/default.nix
+++ b/pkgs/applications/networking/gmailctl/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "gmailctl";
-  version = "0.6.0";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "mbrt";
     repo = "gmailctl";
     rev = "v${version}";
-    sha256 = "0g581gdkib7bj86blpm8skjvbnivmzh9ddikxai9hr5qq231j1pb";
+    sha256 = "08q4yjfbwlldirf3j5db18l8kn6sf288wd364s50jlcx2ka8w50j";
   };
 
-  modSha256 = "0pv3lhzl96ygzh9y01hi9klrrk403ii92imr9yrbimaf7rsvyvjp";
+  modSha256 = "1c7dk6l8lkq2j04cp5g97hwkwfmmyn5r0vpr5zpavvalxgjidsf4";
 
   meta = with stdenv.lib; {
     description = "Declarative configuration for Gmail filters";
diff --git a/pkgs/applications/networking/instant-messengers/qtox/default.nix b/pkgs/applications/networking/instant-messengers/qtox/default.nix
index e3fc384f0f08..58d6230f26ae 100644
--- a/pkgs/applications/networking/instant-messengers/qtox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/qtox/default.nix
@@ -7,7 +7,7 @@
 , AVFoundation ? null }:
 
 let
-  version = "1.16.3";
+  version = "1.17.2";
   rev = "v${version}";
 
 in mkDerivation {
@@ -17,7 +17,7 @@ in mkDerivation {
   src = fetchFromGitHub {
     owner  = "qTox";
     repo   = "qTox";
-    sha256 = "0qd4nvbrjnnfnk8ghsxq3cd1n1qf1ck5zg6ib11ij2pg03s146pa";
+    sha256 = "04pbv1zsxy8dph2v0r9xc8lcm5g6604pwnppi3la5w46ihbwxlb9";
     inherit rev;
   };
 
diff --git a/pkgs/applications/networking/instant-messengers/signal-cli/default.nix b/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
index a062d679f7fa..a4594a20caf7 100644
--- a/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "signal-cli";
-  version = "0.6.6";
+  version = "0.6.7";
 
   # Building from source would be preferred, but is much more involved.
   src = fetchurl {
     url = "https://github.com/AsamK/signal-cli/releases/download/v${version}/signal-cli-${version}.tar.gz";
-    sha256 = "1r0w9knxa2kx5my9xgmcnhq14287ixwbqxqip5ispj78d27g4zfq";
+    sha256 = "13wz2c0n89aglqjfqlma1z4jr5xnp2qlg8cqng3v9axpkkynk996";
   };
 
   buildInputs = lib.optionals stdenv.isLinux [ libmatthew_java dbus dbus_java ];
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
index 6f4099c1d8d5..319f400d95db 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@@ -2,7 +2,7 @@
 , pkgconfig, cmake, ninja, python3, wrapGAppsHook, wrapQtAppsHook
 , qtbase, qtimageformats, gtk3, libsForQt5, enchant2, lz4, xxHash
 , dee, ffmpeg_4, openalSoft, minizip, libopus, alsaLib, libpulseaudio, range-v3
-, tl-expected, microsoft_gsl, hunspell
+, tl-expected, hunspell
 # TODO: Shouldn't be required:
 , pcre, xorg, utillinux, libselinux, libsepol, epoxy, at-spi2-core, libXtst
 , xdg_utils
@@ -19,12 +19,12 @@ with lib;
 
 mkDerivation rec {
   pname = "telegram-desktop";
-  version = "2.1.0";
+  version = "2.1.1";
 
   # Telegram-Desktop with submodules
   src = fetchurl {
     url = "https://github.com/telegramdesktop/tdesktop/releases/download/v${version}/tdesktop-${version}-full.tar.gz";
-    sha256 = "0l5917w90z9pg1al1hzcycb4yxv03vc88jg958ifl9nlvz1arll6";
+    sha256 = "0032csgzwfby5a8q8w9iks7ggv1dcqli3qyhksbzly2xzxmfzqaj";
   };
 
   postPatch = ''
@@ -43,7 +43,7 @@ mkDerivation rec {
   buildInputs = [
     qtbase qtimageformats gtk3 libsForQt5.libdbusmenu enchant2 lz4 xxHash
     dee ffmpeg_4 openalSoft minizip libopus alsaLib libpulseaudio range-v3
-    tl-expected microsoft_gsl hunspell
+    tl-expected hunspell
     # TODO: Shouldn't be required:
     pcre xorg.libpthreadstubs xorg.libXdmcp utillinux libselinux libsepol epoxy at-spi2-core libXtst
   ];
@@ -57,6 +57,7 @@ mkDerivation rec {
     "-DTDESKTOP_API_TEST=ON"
     "-DDESKTOP_APP_USE_PACKAGED_RLOTTIE=OFF"
     "-DDESKTOP_APP_USE_PACKAGED_VARIANT=OFF"
+    "-DDESKTOP_APP_USE_PACKAGED_GSL=OFF"
     "-DTDESKTOP_DISABLE_REGISTER_CUSTOM_SCHEME=ON"
     "-DTDESKTOP_USE_PACKAGED_TGVOIP=OFF"
     #"-DDESKTOP_APP_SPECIAL_TARGET=\"\"" # TODO: Error when set to "": Bad special target '""'
diff --git a/pkgs/applications/networking/instant-messengers/vacuum/default.nix b/pkgs/applications/networking/instant-messengers/vacuum/default.nix
index cbd32347c4e2..ed320d9679d6 100644
--- a/pkgs/applications/networking/instant-messengers/vacuum/default.nix
+++ b/pkgs/applications/networking/instant-messengers/vacuum/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
   ];
 
   # hack: needed to fix build issues in
-  # http://hydra.nixos.org/build/38322959/nixlog/1
+  # https://hydra.nixos.org/build/38322959/nixlog/1
   # should be an upstream issue but it's easy to fix
   NIX_LDFLAGS = "-lz";
 
diff --git a/pkgs/applications/networking/mailreaders/mutt/default.nix b/pkgs/applications/networking/mailreaders/mutt/default.nix
index 81b2fcf62bc3..e1eb8863a084 100644
--- a/pkgs/applications/networking/mailreaders/mutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/mutt/default.nix
@@ -27,11 +27,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "mutt";
-  version = "1.13.5";
+  version = "1.14.0";
 
   src = fetchurl {
     url = "http://ftp.mutt.org/pub/mutt/${pname}-${version}.tar.gz";
-    sha256 = "0lx65a44b03rbvcrz0y9syrik67fx3hvblxyyvz5l9bb7rdipmvc";
+    sha256 = "1y7racrhz06k9mwxw5qspfjfyvbj5fmwai3gsfgrm36k7al84bnz";
   };
 
   patches = optional smimeSupport (fetchpatch {
diff --git a/pkgs/applications/networking/mailreaders/neomutt/default.nix b/pkgs/applications/networking/mailreaders/neomutt/default.nix
index 73aef9d17c77..ad7b4debd3f2 100644
--- a/pkgs/applications/networking/mailreaders/neomutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/neomutt/default.nix
@@ -5,14 +5,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "20200424";
+  version = "20200501";
   pname = "neomutt";
 
   src = fetchFromGitHub {
     owner  = "neomutt";
     repo   = "neomutt";
     rev    = version;
-    sha256 = "055hxlfrpn5a50vnh31faskcdkcjyzzr02gj5x2dizpf7vd67162";
+    sha256 = "1xrs2bagrcg489zp7g39l3rrpgz8n1ji9cbr21wrnasfbhqcsmnx";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/networking/mailreaders/notmuch/default.nix b/pkgs/applications/networking/mailreaders/notmuch/default.nix
index d9ed62bb94da..f6bf60166caf 100644
--- a/pkgs/applications/networking/mailreaders/notmuch/default.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch/default.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--zshcompletiondir=${placeholder "out"}/share/zsh/site-functions"
     "--bashcompletiondir=${placeholder "out"}/share/bash-completion/completions"
-    "--infodir=${placeholder "info"}"
+    "--infodir=${placeholder "info"}/share/info"
   ] ++ optional (!withEmacs) "--without-emacs"
     ++ optional (withEmacs) "--emacslispdir=${placeholder "emacs"}/share/emacs/site-lisp"
     ++ optional (isNull ruby) "--without-ruby";
diff --git a/pkgs/applications/networking/onionshare/default.nix b/pkgs/applications/networking/onionshare/default.nix
new file mode 100644
index 000000000000..77d08692f625
--- /dev/null
+++ b/pkgs/applications/networking/onionshare/default.nix
@@ -0,0 +1,113 @@
+{
+  lib,
+  buildPythonApplication,
+  stdenv,
+  substituteAll,
+  fetchFromGitHub,
+  isPy3k,
+  flask,
+  flask-httpauth,
+  stem,
+  pyqt5,
+  pycrypto,
+  pysocks,
+  pytest,
+  qt5,
+  requests,
+  tor,
+  obfs4,
+}:
+
+let
+  version = "2.2";
+  src = fetchFromGitHub {
+    owner = "micahflee";
+    repo = "onionshare";
+    rev = "v${version}";
+    sha256 = "0m8ygxcyp3nfzzhxs2dfnpqwh1vx0aws44lszpnnczz4fks3a5j4";
+  };
+  meta = with lib; {
+    description = "Securely and anonymously send and receive files";
+    longDescription = ''
+    OnionShare is an open source tool for securely and anonymously sending
+    and receiving files using Tor onion services. It works by starting a web
+    server directly on your computer and making it accessible as an
+    unguessable Tor web address that others can load in Tor Browser to
+    download files from you, or upload files to you. It doesn't require
+    setting up a separate server, using a third party file-sharing service,
+    or even logging into an account.
+
+    Unlike services like email, Google Drive, DropBox, WeTransfer, or nearly
+    any other way people typically send files to each other, when you use
+    OnionShare you don't give any companies access to the files that you're
+    sharing. So long as you share the unguessable web address in a secure way
+    (like pasting it in an encrypted messaging app), no one but you and the
+    person you're sharing with can access the files.
+    '';
+
+    homepage = "https://onionshare.org/";
+
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ lourkeur ];
+  };
+
+  common = buildPythonApplication {
+    pname = "onionshare-common";
+    inherit version meta src;
+
+    disable = !isPy3k;
+    propagatedBuildInputs = [
+      flask
+      flask-httpauth
+      stem
+      pyqt5
+      pycrypto
+      pysocks
+      requests
+    ];
+    buildInputs = [
+      tor
+      obfs4
+    ];
+
+    patches = [
+      (substituteAll {
+        src = ./fix-paths.patch;
+        inherit tor obfs4;
+        inherit (tor) geoip;
+      })
+    ];
+    postPatch = "substituteInPlace onionshare/common.py --subst-var-by common $out";
+
+    doCheck = false;
+  };
+in
+{
+  onionshare = stdenv.mkDerivation {
+    pname = "onionshare";
+    inherit version meta;
+
+    dontUnpack = true;
+
+    inherit common;
+    installPhase = ''
+      mkdir -p $out/bin
+      cp $common/bin/onionshare -t $out/bin
+    '';
+  };
+  onionshare-gui = stdenv.mkDerivation {
+    pname = "onionshare-gui";
+    inherit version meta;
+
+    nativeBuildInputs = [ qt5.wrapQtAppsHook ];
+
+    dontUnpack = true;
+
+    inherit common;
+    installPhase = ''
+      mkdir -p $out/bin
+      cp $common/bin/onionshare-gui -t $out/bin
+      wrapQtApp $out/bin/onionshare-gui
+    '';
+  };
+}
diff --git a/pkgs/applications/networking/onionshare/fix-paths.patch b/pkgs/applications/networking/onionshare/fix-paths.patch
new file mode 100644
index 000000000000..ddd0c75334bb
--- /dev/null
+++ b/pkgs/applications/networking/onionshare/fix-paths.patch
@@ -0,0 +1,134 @@
+diff --git a/onionshare/common.py b/onionshare/common.py
+index 3373462..7fd245b 100644
+--- a/onionshare/common.py
++++ b/onionshare/common.py
+@@ -87,66 +87,16 @@ class Common(object):
+                 ),
+                 "share",
+             )
+-            if not os.path.exists(prefix):
+-                # While running tests during stdeb bdist_deb, look 3 directories up for the share folder
+-                prefix = os.path.join(
+-                    os.path.dirname(
+-                        os.path.dirname(os.path.dirname(os.path.dirname(prefix)))
+-                    ),
+-                    "share",
+-                )
+-
+-        elif self.platform == "BSD" or self.platform == "Linux":
+-            # Assume OnionShare is installed systemwide in Linux, since we're not running in dev mode
+-            prefix = os.path.join(sys.prefix, "share/onionshare")
+-
+-        elif getattr(sys, "frozen", False):
+-            # Check if app is "frozen"
+-            # https://pythonhosted.org/PyInstaller/#run-time-information
+-            if self.platform == "Darwin":
+-                prefix = os.path.join(sys._MEIPASS, "share")
+-            elif self.platform == "Windows":
+-                prefix = os.path.join(os.path.dirname(sys.executable), "share")
++        else:
++            prefix = "@common@/share/onionshare"
+
+         return os.path.join(prefix, filename)
+
+     def get_tor_paths(self):
+-        if self.platform == "Linux":
+-            tor_path = "/usr/bin/tor"
+-            tor_geo_ip_file_path = "/usr/share/tor/geoip"
+-            tor_geo_ipv6_file_path = "/usr/share/tor/geoip6"
+-            obfs4proxy_file_path = "/usr/bin/obfs4proxy"
+-        elif self.platform == "Windows":
+-            base_path = os.path.join(
+-                os.path.dirname(os.path.dirname(self.get_resource_path(""))), "tor"
+-            )
+-            tor_path = os.path.join(os.path.join(base_path, "Tor"), "tor.exe")
+-            obfs4proxy_file_path = os.path.join(
+-                os.path.join(base_path, "Tor"), "obfs4proxy.exe"
+-            )
+-            tor_geo_ip_file_path = os.path.join(
+-                os.path.join(os.path.join(base_path, "Data"), "Tor"), "geoip"
+-            )
+-            tor_geo_ipv6_file_path = os.path.join(
+-                os.path.join(os.path.join(base_path, "Data"), "Tor"), "geoip6"
+-            )
+-        elif self.platform == "Darwin":
+-            base_path = os.path.dirname(
+-                os.path.dirname(os.path.dirname(self.get_resource_path("")))
+-            )
+-            tor_path = os.path.join(base_path, "Resources", "Tor", "tor")
+-            tor_geo_ip_file_path = os.path.join(base_path, "Resources", "Tor", "geoip")
+-            tor_geo_ipv6_file_path = os.path.join(
+-                base_path, "Resources", "Tor", "geoip6"
+-            )
+-            obfs4proxy_file_path = os.path.join(
+-                base_path, "Resources", "Tor", "obfs4proxy"
+-            )
+-        elif self.platform == "BSD":
+-            tor_path = "/usr/local/bin/tor"
+-            tor_geo_ip_file_path = "/usr/local/share/tor/geoip"
+-            tor_geo_ipv6_file_path = "/usr/local/share/tor/geoip6"
+-            obfs4proxy_file_path = "/usr/local/bin/obfs4proxy"
++        tor_path = "@tor@/bin/tor"
++        tor_geo_ip_file_path = "@geoip@/share/tor/geoip"
++        tor_geo_ipv6_file_path = "@geoip@/share/tor/geoip6"
++        obfs4proxy_file_path = "@obfs4@/bin/obfs4proxy"
+
+         return (
+             tor_path,
+diff --git a/setup.py b/setup.py
+index 9af72fc..53ca47b 100644
+--- a/setup.py
++++ b/setup.py
+@@ -70,41 +70,41 @@ classifiers = [
+ ]
+ data_files = [
+     (
+-        os.path.join(sys.prefix, "share/applications"),
++        "share/applications",
+         ["install/org.onionshare.OnionShare.desktop"],
+     ),
+     (
+-        os.path.join(sys.prefix, "share/icons/hicolor/scalable/apps"),
++        "share/icons/hicolor/scalable/apps",
+         ["install/org.onionshare.OnionShare.svg"],
+     ),
+     (
+-        os.path.join(sys.prefix, "share/metainfo"),
++        "share/metainfo",
+         ["install/org.onionshare.OnionShare.appdata.xml"],
+     ),
+-    (os.path.join(sys.prefix, "share/onionshare"), file_list("share")),
+-    (os.path.join(sys.prefix, "share/onionshare/images"), file_list("share/images")),
+-    (os.path.join(sys.prefix, "share/onionshare/locale"), file_list("share/locale")),
++    ( "share/onionshare", file_list("share")),
++    ( "share/onionshare/images", file_list("share/images")),
++    ( "share/onionshare/locale", file_list("share/locale")),
+     (
+-        os.path.join(sys.prefix, "share/onionshare/templates"),
++        "share/onionshare/templates",
+         file_list("share/templates"),
+     ),
+     (
+-        os.path.join(sys.prefix, "share/onionshare/static/css"),
++        "share/onionshare/static/css",
+         file_list("share/static/css"),
+     ),
+     (
+-        os.path.join(sys.prefix, "share/onionshare/static/img"),
++        "share/onionshare/static/img",
+         file_list("share/static/img"),
+     ),
+     (
+-        os.path.join(sys.prefix, "share/onionshare/static/js"),
++        "share/onionshare/static/js",
+         file_list("share/static/js"),
+     ),
+ ]
+ if not platform.system().endswith("BSD") and platform.system() != "DragonFly":
+     data_files.append(
+         (
+-            "/usr/share/nautilus-python/extensions/",
++            "share/nautilus-python/extensions/",
+             ["install/scripts/onionshare-nautilus.py"],
+         )
+     )
diff --git a/pkgs/applications/networking/p2p/tribler/default.nix b/pkgs/applications/networking/p2p/tribler/default.nix
index e9c5f2741432..ed1129b238ac 100644
--- a/pkgs/applications/networking/p2p/tribler/default.nix
+++ b/pkgs/applications/networking/p2p/tribler/default.nix
@@ -71,6 +71,11 @@ stdenv.mkDerivation rec {
         ${stdenv.lib.optionalString enablePlayer ''
           --prefix LD_LIBRARY_PATH : ${vlc}/lib
         ''}
+
+    mkdir -p $out/share/applications $out/share/icons $out/share/man/man1
+    cp $out/Tribler/Main/Build/Ubuntu/tribler.desktop $out/share/applications/tribler.desktop
+    cp $out/Tribler/Main/Build/Ubuntu/tribler_big.xpm $out/share/icons/tribler.xpm
+    cp $out/Tribler/Main/Build/Ubuntu/tribler.1 $out/share/man/man1/tribler.1
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/networking/pjsip/default.nix b/pkgs/applications/networking/pjsip/default.nix
index 6ac2e89cf40e..7319dd4a44fa 100644
--- a/pkgs/applications/networking/pjsip/default.nix
+++ b/pkgs/applications/networking/pjsip/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, openssl, libsamplerate, alsaLib }:
+{ stdenv, fetchFromGitHub, openssl, libsamplerate, alsaLib, AppKit }:
 
 stdenv.mkDerivation rec {
   pname = "pjsip";
@@ -11,12 +11,19 @@ stdenv.mkDerivation rec {
     sha256 = "1aklicpgwc88578k03i5d5cm5h8mfm7hmx8vfprchbmaa2p8f4z0";
   };
 
-  patches = [ ./fix-aarch64.patch ];
+  patches = [
+    ./fix-aarch64.patch
+  ];
 
-  buildInputs = [ openssl libsamplerate alsaLib ];
+  buildInputs = [ openssl libsamplerate ]
+    ++ stdenv.lib.optional stdenv.isLinux alsaLib
+    ++ stdenv.lib.optional stdenv.isDarwin AppKit;
 
   preConfigure = ''
     export LD=$CC
+  '' # Fixed on master, remove with 2.11
+     + stdenv.lib.optionalString stdenv.isDarwin ''
+    NIX_CFLAGS_COMPILE+=" -framework Security"
   '';
 
   postInstall = ''
@@ -29,11 +36,11 @@ stdenv.mkDerivation rec {
   # We need the libgcc_s.so.1 loadable (for pthread_cancel to work)
   dontPatchELF = true;
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "A multimedia communication library written in C, implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE";
     homepage = "https://pjsip.org/";
-    license = stdenv.lib.licenses.gpl2Plus;
-    maintainers = with stdenv.lib.maintainers; [olynch];
-    platforms = with stdenv.lib.platforms; linux;
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ olynch ];
+    platforms = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/pkgs/applications/networking/sniffers/kismet/default.nix b/pkgs/applications/networking/sniffers/kismet/default.nix
index 9775486c156a..93ccf254a3a4 100644
--- a/pkgs/applications/networking/sniffers/kismet/default.nix
+++ b/pkgs/applications/networking/sniffers/kismet/default.nix
@@ -1,16 +1,37 @@
-{ stdenv, fetchurl, pkgconfig, libpcap, ncurses, expat, pcre, libnl }:
+{ stdenv, fetchurl, pkgconfig, libpcap, pcre, libnl, zlib, libmicrohttpd
+, sqlite, protobuf, protobufc, libusb1, libcap, binutils, elfutils
+, withNetworkManager ? false, glib, networkmanager
+, withPython ? false, python3
+, withSensors ? false, lm_sensors}:
+
+# couldn't get python modules to build correctly,
+# waiting for some other volunteer to fix it
+assert !withPython;
 
 stdenv.mkDerivation rec {
   pname = "kismet";
-  version = "2016-07-R1";
+  version = "2020-04-R2";
 
   src = fetchurl {
     url = "https://www.kismetwireless.net/code/${pname}-${version}.tar.xz";
-    sha256 = "0dz28y4ay4lskhl0lawqy2dkcrhgfkbg06v22qxzzw8i6caizcmx";
+    sha256 = "0hxmaln0y6bk9m1rshr4swmg0sqy3ic693vfk8haj7f5gnph96cm";
   };
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ libpcap ncurses expat pcre libnl ];
+
+  buildInputs = [
+    libpcap pcre libmicrohttpd libnl zlib sqlite protobuf protobufc
+    libusb1 libcap binutils elfutils
+  ] ++ stdenv.lib.optionals withNetworkManager [ networkmanager glib ]
+    ++ stdenv.lib.optional withSensors lm_sensors
+    ++ stdenv.lib.optional withPython (python3.withPackages(ps: [ ps.setuptools ps.protobuf
+                                                                  ps.numpy ps.pyserial ]));
+
+  configureFlags = []
+    ++ stdenv.lib.optional (!withNetworkManager) "--disable-libnm"
+    ++ stdenv.lib.optional (!withPython) "--disable-python-tools"
+    ++ stdenv.lib.optional (!withSensors) "--disable-lmsensors";
+
   postConfigure = ''
     sed -e 's/-o $(INSTUSR)//' \
         -e 's/-g $(INSTGRP)//' \
@@ -19,6 +40,8 @@ stdenv.mkDerivation rec {
         -i Makefile
   '';
 
+  enableParallelBuilding = true;
+
   meta = with stdenv.lib; {
     description = "Wireless network sniffer";
     homepage = "https://www.kismetwireless.net/";
diff --git a/pkgs/applications/networking/sniffers/whsniff/default.nix b/pkgs/applications/networking/sniffers/whsniff/default.nix
new file mode 100644
index 000000000000..d2e5803d58a1
--- /dev/null
+++ b/pkgs/applications/networking/sniffers/whsniff/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, fetchFromGitHub, libusb1 }:
+
+stdenv.mkDerivation rec {
+  pname = "whsniff";
+  version = "1.3";
+
+  src = fetchFromGitHub {
+    owner = "homewsn";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "000l5vk9c0332m35lndk8892ivdr445lgg25hmq1lajn24cash5w";
+  };
+
+  buildInputs = [ libusb1 ];
+
+  installFlags = [ "PREFIX=$(out)" ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/homewsn/whsniff";
+    description = "Packet sniffer for 802.15.4 wireless networks";
+    maintainers = with maintainers; [ snicket2100 ];
+    platforms = platforms.linux;
+    license = licenses.gpl2;
+  };
+}
diff --git a/pkgs/applications/networking/ssb/patchwork/default.nix b/pkgs/applications/networking/ssb/patchwork/default.nix
index c7766889f502..db33e7e6bb21 100644
--- a/pkgs/applications/networking/ssb/patchwork/default.nix
+++ b/pkgs/applications/networking/ssb/patchwork/default.nix
@@ -2,12 +2,12 @@
 
 let
   pname = "ssb-patchwork";
-  version = "3.17.6";
+  version = "3.17.7";
   name = "Patchwork-${version}";
 
   src = fetchurl {
     url = "https://github.com/ssbc/patchwork/releases/download/v${version}/${name}.AppImage";
-    sha256 = "0bq4pi0rmfsyiiapnhkkhikg2a2jzqlna4gvk6gw7wl0r8a111cs";
+    sha256 = "1xj2aqy7daf4r3ypch6hkvk1s0jnx70qwh0p63c7rzm16vh8kb2f";
   };
 
   binary = appimageTools.wrapType2 {
diff --git a/pkgs/applications/office/aesop/default.nix b/pkgs/applications/office/aesop/default.nix
index 1e1f686ab194..4f8c115600af 100644
--- a/pkgs/applications/office/aesop/default.nix
+++ b/pkgs/applications/office/aesop/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aesop";
-  version = "1.2.4";
+  version = "1.2.5";
 
   src = fetchFromGitHub {
     owner = "lainsce";
     repo = pname;
     rev = version;
-    sha256 = "1bqykr1mwanfm55w1v9ipqcqgzj8kbjvlm4d5b2swvhng77gnf3d";
+    sha256 = "1zxyyxl959rqhyz871dyyccqga2ydybkfcpyjq4vmvdn2g9mvmb0";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/office/elementary-planner/default.nix b/pkgs/applications/office/elementary-planner/default.nix
index 3e3765ca77f6..28a470162cef 100644
--- a/pkgs/applications/office/elementary-planner/default.nix
+++ b/pkgs/applications/office/elementary-planner/default.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-planner";
-  version = "2.3.3";
+  version = "2.3.5";
 
   src = fetchFromGitHub {
     owner = "alainm23";
     repo = "planner";
     rev = version;
-    sha256 = "1jc668hg26vb1q50abm6k566v9qimgs9skkwmlgi5h37vxm3ai1x";
+    sha256 = "15d51sqb3k59jjishsw1fq5ib50jmhlk194y3nga329damfv8bmy";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/biology/dcm2niix/default.nix b/pkgs/applications/science/biology/dcm2niix/default.nix
index 8ea3588fa8ca..59b173ac98cd 100644
--- a/pkgs/applications/science/biology/dcm2niix/default.nix
+++ b/pkgs/applications/science/biology/dcm2niix/default.nix
@@ -6,14 +6,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.0.20190902";
+  version = "1.0.20200331";
   pname = "dcm2niix";
 
   src = fetchFromGitHub {
     owner = "rordenlab";
     repo = "dcm2niix";
     rev = "v${version}";
-    sha256 = "0h8jsadgv831lqb0jhnaxm7lldirmnp5agrhgg5bcxvn860fl15b";
+    sha256 = "1cncfwhyhmg18n970lkn6yvp0i74ajznsl8dqz00asqfzmg681n1";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/science/biology/picard-tools/default.nix b/pkgs/applications/science/biology/picard-tools/default.nix
index 246c98768101..5073d0f0f324 100644
--- a/pkgs/applications/science/biology/picard-tools/default.nix
+++ b/pkgs/applications/science/biology/picard-tools/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "picard-tools";
-  version = "2.22.2";
+  version = "2.22.4";
 
   src = fetchurl {
     url = "https://github.com/broadinstitute/picard/releases/download/${version}/picard.jar";
-    sha256 = "11mzz483f89pb2s8jmwhl12d0m6k41kmi4xh0i6hq69rxrqi8l4s";
+    sha256 = "0gzna5df8nk42l7mc0qbp9h73gwr1030jnw10fawjp6ql6213kdd";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/science/electronics/magic-vlsi/0001-strip-bin-prefix.patch b/pkgs/applications/science/electronics/magic-vlsi/0001-strip-bin-prefix.patch
new file mode 100644
index 000000000000..1cef96ea1408
--- /dev/null
+++ b/pkgs/applications/science/electronics/magic-vlsi/0001-strip-bin-prefix.patch
@@ -0,0 +1,10 @@
+diff --git a/scripts/makedbh b/scripts/makedbh
+index 01e4fa5..d6299c6 100755
+--- a/scripts/makedbh
++++ b/scripts/makedbh
+@@ -1,4 +1,4 @@
+-#!/bin/csh -f
++#!/usr/bin/env tcsh
+ #
+ # makes the "database.h" (1st argument, $1) file from "database.h.in"
+ # (2nd argument, $2), setting various mask operation definitions
diff --git a/pkgs/applications/science/electronics/magic-vlsi/0002-fix-format-security.patch b/pkgs/applications/science/electronics/magic-vlsi/0002-fix-format-security.patch
new file mode 100644
index 000000000000..37ae35195503
--- /dev/null
+++ b/pkgs/applications/science/electronics/magic-vlsi/0002-fix-format-security.patch
@@ -0,0 +1,19 @@
+diff --git a/database/DBio.c b/database/DBio.c
+index 93c4b0b..292ea5f 100644
+--- a/database/DBio.c
++++ b/database/DBio.c
+@@ -2378,12 +2378,12 @@ DBCellWriteFile(cellDef, f)
+ 
+ #define FPRINTF(f,s)\
+ {\
+-     if (fprintf(f,s) == EOF) goto ioerror;\
++     if (fprintf(f,"%s",s) == EOF) goto ioerror;\
+      DBFileOffset += strlen(s);\
+ }
+ #define FPRINTR(f,s)\
+ {\
+-     if (fprintf(f,s) == EOF) return 1;\
++     if (fprintf(f,"%s",s) == EOF) return 1;\
+      DBFileOffset += strlen(s);\
+ }
+ 
diff --git a/pkgs/applications/science/electronics/magic-vlsi/default.nix b/pkgs/applications/science/electronics/magic-vlsi/default.nix
new file mode 100644
index 000000000000..62b830547e53
--- /dev/null
+++ b/pkgs/applications/science/electronics/magic-vlsi/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, fetchurl, m4, tcsh, libX11, tcl, tk, cairo, ncurses, mesa_glu, python3 }:
+
+stdenv.mkDerivation {
+  pname = "magic-vlsi";
+  version = "8.3.5";
+
+  src = fetchurl {
+    url = "http://opencircuitdesign.com/magic/archive/magic-8.3.5.tgz";
+    sha256 = "0wv4zmxlqjfaakgp802icn0cd9f8ylkz2sppix83axq8p5cg90yq";
+  };
+
+  buildInputs = [ m4 tcsh libX11 tcl tk cairo ncurses mesa_glu ];
+  nativeBuildInputs = [ python3 ];
+
+  configureFlags = [
+    "--with-tcl=${tcl}"
+    "--with-tk=${tk}"
+    "--disable-werror"
+  ];
+
+  postPatch = ''
+    patchShebangs scripts/*
+  '';
+
+  patches = [
+    ./0001-strip-bin-prefix.patch
+    ./0002-fix-format-security.patch
+  ];
+
+  meta = with stdenv.lib; {
+    description = "VLSI layout tool written in Tcl";
+    homepage = "http://opencircuitdesign.com/magic/";
+    license = licenses.mit;
+    maintainers = [ maintainers.dkudriavtsev ];
+  };
+}
diff --git a/pkgs/applications/science/logic/cryptominisat/default.nix b/pkgs/applications/science/logic/cryptominisat/default.nix
index 113c6307c40b..8c1b3bd03694 100644
--- a/pkgs/applications/science/logic/cryptominisat/default.nix
+++ b/pkgs/applications/science/logic/cryptominisat/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cryptominisat";
-  version = "5.6.8";
+  version = "5.7.0";
 
   src = fetchFromGitHub {
     owner  = "msoos";
     repo   = "cryptominisat";
     rev    = version;
-    sha256 = "0csimmy1nvkfcsxjra9bm4mlcyxa3ac8zarm88zfb7640ca0d0wv";
+    sha256 = "0ny5ln8fc0irprs04qw01c9mppps8q27lkx01a549zazwhj4b5rm";
   };
 
   buildInputs = [ python3 boost ];
diff --git a/pkgs/applications/science/logic/lean/default.nix b/pkgs/applications/science/logic/lean/default.nix
index 36df6ae0658f..c80c163562be 100644
--- a/pkgs/applications/science/logic/lean/default.nix
+++ b/pkgs/applications/science/logic/lean/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lean";
-  version = "3.9.0";
+  version = "3.10.0";
 
   src = fetchFromGitHub {
     owner  = "leanprover-community";
     repo   = "lean";
     rev    = "v${version}";
-    sha256 = "0sklw211cmqp4y0c6nycfavpdxdpfwhq9a4sbwdlqd5agyf85h1j";
+    sha256 = "0nmh09x3scfqg0bg1qf8b7z67s11hbfd7kr1h6k1zw94fyn2mg8q";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/science/math/mxnet/default.nix b/pkgs/applications/science/math/mxnet/default.nix
index 87d46850f140..b006a9dd18d1 100644
--- a/pkgs/applications/science/math/mxnet/default.nix
+++ b/pkgs/applications/science/math/mxnet/default.nix
@@ -8,11 +8,11 @@ assert cudnnSupport -> cudaSupport;
 
 stdenv.mkDerivation rec {
   pname = "mxnet";
-  version = "1.4.1";
+  version = "1.6.0";
 
   src = fetchurl {
     url = "https://github.com/apache/incubator-mxnet/releases/download/${version}/apache-mxnet-src-${version}-incubating.tar.gz";
-    sha256 = "1d0lhlpdaxycjzpwwrpgjd3v2q2ka89v5rr13ddxayy7ld2hxiaj";
+    sha256 = "1vvdb7pfh63kb9fzs6gqp95q550a3ck4cj9mqxlk9wwhkh30dsq1";
   };
 
   nativeBuildInputs = [ cmake perl ];
diff --git a/pkgs/applications/version-management/git-and-tools/default.nix b/pkgs/applications/version-management/git-and-tools/default.nix
index 4d6b0511a2ab..c591ef554ee4 100644
--- a/pkgs/applications/version-management/git-and-tools/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/default.nix
@@ -173,6 +173,10 @@ let
 
   gitstatus = callPackage ./gitstatus { };
 
+  gitui = callPackage ./gitui {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
   grv = callPackage ./grv { };
 
   hub = callPackage ./hub { };
diff --git a/pkgs/applications/version-management/git-and-tools/git-workspace/default.nix b/pkgs/applications/version-management/git-and-tools/git-workspace/default.nix
index b93163e239ad..8894c4f0f7ad 100644
--- a/pkgs/applications/version-management/git-and-tools/git-workspace/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-workspace/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-workspace";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "orf";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0pl5z0gx2ypkrgq7vj1cxj5iwj06vcd06x3b3nh0g7w7q7nl8pr4";
+    sha256 = "0n025bnisg724d9pjcindxagj1ry63sxr0pplpkh2f2qffzm78pi";
   };
 
-  cargoSha256 = "1z4cb7rcb7ldj16xxynrjh4hg872rj39rbbp0vy15kdp3ifyi466";
+  cargoSha256 = "0ikyp6pdlw2c1gr1n1snjbdmblm0fs5swx5awy36jskii99q6kr1";
 
   buildInputs = with stdenv; lib.optional isDarwin Security;
 
diff --git a/pkgs/applications/version-management/git-and-tools/gitui/default.nix b/pkgs/applications/version-management/git-and-tools/gitui/default.nix
new file mode 100644
index 000000000000..f215b7986f89
--- /dev/null
+++ b/pkgs/applications/version-management/git-and-tools/gitui/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, rustPlatform, fetchFromGitHub, libiconv, Security }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "gitui";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "extrawurst";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "06x4a7ynq6vznjwdm0dhzlj9353skxz65xabwr5xxa85zp2a7vcm";
+  };
+
+  cargoSha256 = "08z3z1m0ik62gzj146a4imk4xx5n8sbvjs0w7gkclvlsvm9dp8q4";
+
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ libiconv Security ];
+
+  meta = with stdenv.lib; {
+    description = "Blazing fast terminal-ui for git written in rust";
+    homepage = "https://github.com/extrawurst/gitui";
+    license = licenses.mit;
+    maintainers = with maintainers; [ filalex77 ];
+  };
+}
diff --git a/pkgs/applications/version-management/git-lfs/default.nix b/pkgs/applications/version-management/git-lfs/default.nix
index eca841350deb..cdd7cd01d066 100644
--- a/pkgs/applications/version-management/git-lfs/default.nix
+++ b/pkgs/applications/version-management/git-lfs/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoPackage, fetchFromGitHub, ronn, installShellFiles }:
 
-buildGoModule rec {
+buildGoPackage rec {
   pname = "git-lfs";
   version = "2.10.0";
 
@@ -11,14 +11,26 @@ buildGoModule rec {
     sha256 = "1y5ryk0iz5g5sqaw79ml6fr5kvjgzcah481pk5qmnb2ipb1xlng9";
   };
 
-  modSha256 = "1rvvgyg4gqbli4pwfnmyz59gf14k7925mdqj6ykp542gwnsjgjp2";
+  goPackagePath = "github.com/git-lfs/git-lfs";
+
+  nativeBuildInputs = [ ronn installShellFiles ];
+
+  buildFlagsArray = [ "-ldflags=-s -w -X ${goPackagePath}/config.Vendor=${version} -X ${goPackagePath}/config.GitCommit=${src.rev}" ];
 
   subPackages = [ "." ];
 
+  postBuild = ''
+    make -C go/src/${goPackagePath} man
+  '';
+
+  postInstall = ''
+    installManPage go/src/${goPackagePath}/man/*.{1,5}
+  '';
+
   meta = with stdenv.lib; {
     description = "Git extension for versioning large files";
     homepage    = "https://git-lfs.github.com/";
     license     = [ licenses.mit ];
-    maintainers = [ maintainers.twey ];
+    maintainers = [ maintainers.twey maintainers.marsam ];
   };
 }
diff --git a/pkgs/applications/video/plex-mpv-shim/default.nix b/pkgs/applications/video/plex-mpv-shim/default.nix
index df72e200e62a..268905e3a4c0 100644
--- a/pkgs/applications/video/plex-mpv-shim/default.nix
+++ b/pkgs/applications/video/plex-mpv-shim/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonApplication rec {
   pname = "plex-mpv-shim";
-  version = "1.7.14";
+  version = "1.7.16";
 
   src = fetchFromGitHub {
     owner = "iwalton3";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1rjifqvs59w2aacfird02myqfd34qadhacj9zpy5xjz25x410zza";
+    sha256 = "1pnbdxaqnliwqfvv08gi7gdcvflg5vcbgk4g0fw75prgw54vnd9a";
   };
 
   propagatedBuildInputs = [ mpv requests python-mpv-jsonipc ];
diff --git a/pkgs/applications/video/shotcut/default.nix b/pkgs/applications/video/shotcut/default.nix
index b3c058186382..9c0435a351c8 100644
--- a/pkgs/applications/video/shotcut/default.nix
+++ b/pkgs/applications/video/shotcut/default.nix
@@ -8,13 +8,13 @@ assert stdenv.lib.versionAtLeast mlt.version "6.18.0";
 
 mkDerivation rec {
   pname = "shotcut";
-  version = "20.04.01";
+  version = "20.04.12";
 
   src = fetchFromGitHub {
     owner = "mltframework";
     repo = "shotcut";
     rev = "v${version}";
-    sha256 = "10svbhsd5q8z1k055kcfibil97qifwzn3xmnf5b9sxa7ky4bkmqr";
+    sha256 = "05yyv9192f722j8fhfjrphxadgp3crvbq4pi23ln560zh9s1m8r4";
   };
 
   patches = [ ./0001-encodedock.cpp-connect-to-VAAPI-via-DRM-not-X11.patch ];
diff --git a/pkgs/applications/video/streamlink/default.nix b/pkgs/applications/video/streamlink/default.nix
index a12d08458901..782b81cc2380 100644
--- a/pkgs/applications/video/streamlink/default.nix
+++ b/pkgs/applications/video/streamlink/default.nix
@@ -1,14 +1,14 @@
 { stdenv, pythonPackages, fetchFromGitHub, rtmpdump, ffmpeg }:
 
 pythonPackages.buildPythonApplication rec {
-  version = "1.3.1";
+  version = "1.4.1";
   pname = "streamlink";
 
   src = fetchFromGitHub {
     owner = "streamlink";
     repo = "streamlink";
     rev = version;
-    sha256 = "0scc0mzvy56b1l6iyvrzb28l8vzrxpfkn4lcwr8nnyjb7ams2xms";
+    sha256 = "1q3h48qwf7vs2wnbkwv0xnm6s65mkcyqdz7z6z3vrsmif2sb19l2";
   };
 
   checkInputs = with pythonPackages; [ pytest mock requests-mock freezegun ];
diff --git a/pkgs/applications/virtualization/OVMF/default.nix b/pkgs/applications/virtualization/OVMF/default.nix
index 310d41df36da..19ba8ced4973 100644
--- a/pkgs/applications/virtualization/OVMF/default.nix
+++ b/pkgs/applications/virtualization/OVMF/default.nix
@@ -57,6 +57,6 @@ edk2.mkDerivation projectDscPath {
     description = "Sample UEFI firmware for QEMU and KVM";
     homepage = "https://github.com/tianocore/tianocore.github.io/wiki/OVMF";
     license = stdenv.lib.licenses.bsd2;
-    platforms = ["x86_64-linux" "i686-linux" "aarch64-linux"];
+    platforms = ["x86_64-linux" "i686-linux" "aarch64-linux" "x86_64-darwin"];
   };
 }
diff --git a/pkgs/applications/virtualization/podman/wrapper.nix b/pkgs/applications/virtualization/podman/wrapper.nix
index 0b905c0c709e..99233696b3ed 100644
--- a/pkgs/applications/virtualization/podman/wrapper.nix
+++ b/pkgs/applications/virtualization/podman/wrapper.nix
@@ -28,21 +28,25 @@ let
   ] ++ extraPackages);
 
 in runCommand podman.name {
-  inherit (podman) name pname version meta outputs;
+  name = "${podman.pname}-wrapper-${podman.version}";
+  inherit (podman) pname version;
+
+  meta = builtins.removeAttrs podman.meta [ "outputsToInstall" ];
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
   nativeBuildInputs = [
     makeWrapper
   ];
 
 } ''
-  # Symlink everything but $bin from podman-unwrapped
-  ${
-    lib.concatMapStringsSep "\n"
-    (o: "ln -s ${podman.${o}} ${placeholder o}")
-    (builtins.filter (o: o != "bin")
-    podman.outputs)}
-
-  mkdir -p $bin/bin
-  ln -s ${podman-unwrapped}/share $bin/share
-  makeWrapper ${podman-unwrapped}/bin/podman $bin/bin/podman \
+  ln -s ${podman.man} $man
+
+  mkdir -p $out/bin
+  ln -s ${podman-unwrapped}/share $out/share
+  makeWrapper ${podman-unwrapped}/bin/podman $out/bin/podman \
     --prefix PATH : ${binPath}
 ''
diff --git a/pkgs/applications/virtualization/tini/default.nix b/pkgs/applications/virtualization/tini/default.nix
index e3e6bae6cfe8..db3fb1c96eb3 100644
--- a/pkgs/applications/virtualization/tini/default.nix
+++ b/pkgs/applications/virtualization/tini/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, cmake, glibc }:
 
 stdenv.mkDerivation rec {
-  version = "0.18.0";
+  version = "0.19.0";
   pname = "tini";
 
   src = fetchFromGitHub {
     owner = "krallin";
     repo = "tini";
     rev = "v${version}";
-    sha256 ="1h20i3wwlbd8x4jr2gz68hgklh0lb0jj7y5xk1wvr8y58fip1rdn";
+    sha256 ="1hnnvjydg7gi5gx6nibjjdnfipblh84qcpajc08nvr44rkzswck4";
   };
 
   patchPhase = "sed -i /tini-static/d CMakeLists.txt";
diff --git a/pkgs/applications/window-managers/i3/gaps.nix b/pkgs/applications/window-managers/i3/gaps.nix
index 731555ce9f8c..b124ba0ea0ce 100644
--- a/pkgs/applications/window-managers/i3/gaps.nix
+++ b/pkgs/applications/window-managers/i3/gaps.nix
@@ -3,12 +3,12 @@
 i3.overrideAttrs (oldAttrs : rec {
 
   name = "i3-gaps-${version}";
-  version = "4.18";
+  version = "4.18.1";
   releaseDate = "2019-01-27";
 
   src = fetchurl {
     url = "https://github.com/Airblader/i3/archive/${version}.tar.gz";
-    sha256 = "04sq2sik7j09kgnn1k87yg3vzy56pk4688bmxh49l6drl0wr1m2v";
+    sha256 = "07gk5m90v0ih7c18vcwx7p7innsccd09j2vkr99a33wk71xrww1z";
   };
 
   nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [ autoreconfHook ];
diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix
index 28c0d2dfcae1..bee6e37cccbb 100644
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@@ -32,7 +32,29 @@
 }:
 
 # WARNING: this API is unstable and may be subject to backwards-incompatible changes in the future.
+let
+
+  mkDbExtraCommand = contents: let
+    contentsList = if builtins.isList contents then contents else [ contents ];
+  in ''
+    echo "Generating the nix database..."
+    echo "Warning: only the database of the deepest Nix layer is loaded."
+    echo "         If you want to use nix commands in the container, it would"
+    echo "         be better to only have one layer that contains a nix store."
+
+    export NIX_REMOTE=local?root=$PWD
+    # A user is required by nix
+    # https://github.com/NixOS/nix/blob/9348f9291e5d9e4ba3c4347ea1b235640f54fd79/src/libutil/util.cc#L478
+    export USER=nobody
+    ${nix}/bin/nix-store --load-db < ${closureInfo {rootPaths = contentsList;}}/registration
+
+    mkdir -p nix/var/nix/gcroots/docker/
+    for i in ${lib.concatStringsSep " " contentsList}; do
+    ln -s $i nix/var/nix/gcroots/docker/$(basename $i)
+    done;
+  '';
 
+in
 rec {
 
   examples = callPackage ./examples.nix {
@@ -874,25 +896,16 @@ rec {
   # contents. The main purpose is to be able to use nix commands in
   # the container.
   # Be careful since this doesn't work well with multilayer.
-  buildImageWithNixDb = args@{ contents ? null, extraCommands ? "", ... }:
-    let contentsList = if builtins.isList contents then contents else [ contents ];
-    in buildImage (args // {
-      extraCommands = ''
-        echo "Generating the nix database..."
-        echo "Warning: only the database of the deepest Nix layer is loaded."
-        echo "         If you want to use nix commands in the container, it would"
-        echo "         be better to only have one layer that contains a nix store."
-
-        export NIX_REMOTE=local?root=$PWD
-        # A user is required by nix
-        # https://github.com/NixOS/nix/blob/9348f9291e5d9e4ba3c4347ea1b235640f54fd79/src/libutil/util.cc#L478
-        export USER=nobody
-        ${nix}/bin/nix-store --load-db < ${closureInfo {rootPaths = contentsList;}}/registration
-
-        mkdir -p nix/var/nix/gcroots/docker/
-        for i in ${lib.concatStringsSep " " contentsList}; do
-          ln -s $i nix/var/nix/gcroots/docker/$(basename $i)
-        done;
-      '' + extraCommands;
-    });
+  buildImageWithNixDb = args@{ contents ? null, extraCommands ? "", ... }: (
+    buildImage (args // {
+      extraCommands = (mkDbExtraCommand contents) + extraCommands;
+    })
+  );
+
+  buildLayeredImageWithNixDb = args@{ contents ? null, extraCommands ? "", ... }: (
+    buildLayeredImage (args // {
+      extraCommands = (mkDbExtraCommand contents) + extraCommands;
+    })
+  );
+
 }
diff --git a/pkgs/build-support/fetchgit/nix-prefetch-git b/pkgs/build-support/fetchgit/nix-prefetch-git
index abba76bd1ac9..43f7c5acd5ad 100755
--- a/pkgs/build-support/fetchgit/nix-prefetch-git
+++ b/pkgs/build-support/fetchgit/nix-prefetch-git
@@ -373,6 +373,7 @@ print_results() {
   "url": "$(json_escape "$url")",
   "rev": "$(json_escape "$fullRev")",
   "date": "$(json_escape "$commitDateStrict8601")",
+  "path": "$(json_escape "$finalPath")",
   "$(json_escape "$hashType")": "$(json_escape "$hash")",
   "fetchSubmodules": $([[ -n "$fetchSubmodules" ]] && echo true || echo false),
   "deepClone": $([[ -n "$deepClone" ]] && echo true || echo false),
diff --git a/pkgs/build-support/fetchurl/default.nix b/pkgs/build-support/fetchurl/default.nix
index 7d23a3a7f8f1..a0c48468dfac 100644
--- a/pkgs/build-support/fetchurl/default.nix
+++ b/pkgs/build-support/fetchurl/default.nix
@@ -65,7 +65,7 @@ in
 , # Shell code to build a netrc file for BASIC auth
   netrcPhase ? null
 
-, # Impure env vars (http://nixos.org/nix/manual/#sec-advanced-attributes)
+, # Impure env vars (https://nixos.org/nix/manual/#sec-advanced-attributes)
   # needed for netrcPhase
   netrcImpureEnvVars ? []
 
diff --git a/pkgs/data/icons/papirus-icon-theme/default.nix b/pkgs/data/icons/papirus-icon-theme/default.nix
index b47c01d973eb..a39a87206354 100644
--- a/pkgs/data/icons/papirus-icon-theme/default.nix
+++ b/pkgs/data/icons/papirus-icon-theme/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "papirus-icon-theme";
-  version = "20200405";
+  version = "20200430";
 
   src = fetchFromGitHub {
     owner = "PapirusDevelopmentTeam";
     repo = pname;
     rev = version;
-    sha256 = "0qv4340avm5s0640r8aznbfwjzvm6k64840qggyg9jfcy6223pdy";
+    sha256 = "1dgxf3fi4x5iy504xncj1jba8cd51axkn2j1cfb220rpc6mzv25l";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/data/icons/pop-icon-theme/default.nix b/pkgs/data/icons/pop-icon-theme/default.nix
new file mode 100644
index 000000000000..76b393dcf791
--- /dev/null
+++ b/pkgs/data/icons/pop-icon-theme/default.nix
@@ -0,0 +1,45 @@
+{ stdenv
+, fetchFromGitHub
+, meson
+, ninja
+, gtk3
+, breeze-icons
+, gnome3
+, pantheon
+, hicolor-icon-theme
+}:
+
+stdenv.mkDerivation rec {
+  pname = "pop-icon-theme";
+  version = "2020-03-04";
+
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = "icon-theme";
+    rev = "11f18cb48455b47b6535018f1968777100471be1";
+    sha256 = "1s4pjwv2ynw400gnzgzczlxzw3gxh5s8cxxbi9zpxq4wzjg6jqyv";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    gtk3
+  ];
+
+  propagatedBuildInputs = [
+    breeze-icons
+    gnome3.adwaita-icon-theme
+    pantheon.elementary-icon-theme
+    hicolor-icon-theme
+  ];
+
+  dontDropIconThemeCache = true;
+
+  meta = with stdenv.lib; {
+    description = "Icon theme for Pop!_OS with a semi-flat design and raised 3D motifs";
+    homepage = "https://github.com/pop-os/icon-theme";
+    license = with licenses; [ cc-by-sa-40 gpl3 ];
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ romildo ];
+  };
+}
diff --git a/pkgs/desktops/deepin/deepin-anything/default.nix b/pkgs/desktops/deepin/deepin-anything/default.nix
index 7697c23ae141..be7fe818e5c1 100644
--- a/pkgs/desktops/deepin/deepin-anything/default.nix
+++ b/pkgs/desktops/deepin/deepin-anything/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, mkDerivation, fetchFromGitHub, pkgconfig, qtbase, udisks2-qt5, utillinux,
+{ stdenv, mkDerivation, fetchFromGitHub, fetchpatch, pkgconfig, qtbase, udisks2-qt5, utillinux,
   dtkcore, deepin }:
 
 mkDerivation rec {
@@ -12,6 +12,16 @@ mkDerivation rec {
     sha256 = "1kvyffrii4b012f6ld1ih14qrn7gg5cxbdpbkac0wxb22hnz0azm";
   };
 
+  patches = [
+    # fix compilation error and add support to kernel 5.6
+    # https://github.com/linuxdeepin/deepin-anything/pull/27
+    (fetchpatch {
+      name = "linux-5.6.patch";
+      url = "https://github.com/linuxdeepin/deepin-anything/commit/764b820c2bcd7248993349b32f91043fc58ee958.patch";
+      sha256 = "1ww4xllxc2s04px6fy8wp5cyw54xaz155ry30sqz21vl8awfr36h";
+    })
+  ];
+
   outputs = [ "out" "modsrc" ];
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/lxqt/libqtxdg/default.nix b/pkgs/desktops/lxqt/libqtxdg/default.nix
index 526da0d84a4d..f5da7a4b2356 100644
--- a/pkgs/desktops/lxqt/libqtxdg/default.nix
+++ b/pkgs/desktops/lxqt/libqtxdg/default.nix
@@ -32,6 +32,8 @@ mkDerivation rec {
   preConfigure = ''
     cmakeFlagsArray+=(
       "-DQTXDGX_ICONENGINEPLUGIN_INSTALL_PATH=$out/$qtPluginPrefix/iconengines"
+      "-DCMAKE_INSTALL_INCLUDEDIR=include"
+      "-DCMAKE_INSTALL_LIBDIR=lib"
     )
   '';
 
diff --git a/pkgs/desktops/xfce/core/xfce4-panel/default.nix b/pkgs/desktops/xfce/core/xfce4-panel/default.nix
index ffd42e4a2c5b..b7bede9e27bb 100644
--- a/pkgs/desktops/xfce/core/xfce4-panel/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-panel/default.nix
@@ -3,9 +3,9 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "xfce4-panel";
-  version = "4.14.3";
+  version = "4.14.4";
 
-  sha256 = "0h8cqs2bghmyp0jihjm2wc7j14k271j178vllin271xrl7kzmvzv";
+  sha256 = "1srzgb9vsvfrbhym74zkz9hdhxcrvbffxpfgv5vprhlwxw3vk3fq";
 
   nativeBuildInputs = [ gobject-introspection ];
   buildInputs = [ exo garcon gtk2 gtk3 glib glib-networking libxfce4ui libxfce4util libwnck3 xfconf ];
diff --git a/pkgs/development/compilers/binaryen/default.nix b/pkgs/development/compilers/binaryen/default.nix
index 023c567638fd..3a03f633ff0d 100644
--- a/pkgs/development/compilers/binaryen/default.nix
+++ b/pkgs/development/compilers/binaryen/default.nix
@@ -1,11 +1,11 @@
 { stdenv, cmake, python3, fetchFromGitHub, emscriptenRev ? null, substituteAll }:
 
 let
-  defaultVersion = "91";
+  defaultVersion = "93";
 
   # Map from git revs to SHA256 hashes
   sha256s = {
-    version_91 = "1qsjqnzc5w9ny9v01bxkdvhh4kgbsia01x5vvac72m075v4mpgs4";
+    version_93 = "15y3703ha6mxcq168br0wlydas5rq66msrcsd650zrjz0ndxwsfx";
     "1.39.1" = "0ygm9m5322h4vfpf3j63q32qxk2l26yk62hh7dkb49j51zwl1y3y";
   };
 in
diff --git a/pkgs/development/compilers/edk2/default.nix b/pkgs/development/compilers/edk2/default.nix
index 703ff4fa083b..8a18b6306c27 100644
--- a/pkgs/development/compilers/edk2/default.nix
+++ b/pkgs/development/compilers/edk2/default.nix
@@ -1,4 +1,17 @@
-{ stdenv, fetchgit, fetchpatch, libuuid, python3, iasl, bc }:
+{
+  stdenv,
+  clangStdenv,
+  fetchgit,
+  fetchpatch,
+  libuuid,
+  python3,
+  iasl,
+  bc,
+  clang_9,
+  llvmPackages_9,
+  overrideCC,
+  lib,
+}:
 
 let
   pythonEnv = python3.withPackages (ps: [ps.tkinter]);
@@ -12,7 +25,17 @@ else if stdenv.isAarch64 then
 else
   throw "Unsupported architecture";
 
-edk2 = stdenv.mkDerivation {
+buildStdenv = if stdenv.isDarwin then
+  overrideCC clangStdenv [ clang_9 llvmPackages_9.llvm llvmPackages_9.lld ]
+else
+  stdenv;
+
+buildType = if stdenv.isDarwin then
+    "CLANGPDB"
+  else
+    "GCC5";
+
+edk2 = buildStdenv.mkDerivation {
   pname = "edk2";
   version = "201911";
 
@@ -25,8 +48,10 @@ edk2 = stdenv.mkDerivation {
 
   buildInputs = [ libuuid pythonEnv ];
 
-  makeFlags = [ "-C BaseTools" ];
-  NIX_CFLAGS_COMPILE = "-Wno-return-type -Wno-error=stringop-truncation";
+  makeFlags = [ "-C BaseTools" ]
+    ++ lib.optional (stdenv.cc.isClang) [ "BUILD_CC=clang BUILD_CXX=clang++ BUILD_AS=clang" ];
+
+  NIX_CFLAGS_COMPILE = "-Wno-return-type" + lib.optionalString (stdenv.cc.isGNU) " -Wno-error=stringop-truncation";
 
   hardeningDisable = [ "format" "fortify" ];
 
@@ -38,15 +63,15 @@ edk2 = stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Intel EFI development kit";
     homepage = "https://sourceforge.net/projects/edk2/";
     license = licenses.bsd2;
-    platforms = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];
+    platforms = [ "x86_64-linux" "i686-linux" "aarch64-linux" "x86_64-darwin" ];
   };
 
   passthru = {
-    mkDerivation = projectDscPath: attrs: stdenv.mkDerivation ({
+    mkDerivation = projectDscPath: attrs: buildStdenv.mkDerivation ({
       inherit (edk2) src;
 
       buildInputs = [ bc pythonEnv ] ++ attrs.buildInputs or [];
@@ -65,7 +90,7 @@ edk2 = stdenv.mkDerivation {
 
       buildPhase = ''
         runHook preBuild
-        build -a ${targetArch} -b RELEASE -t GCC5 -p ${projectDscPath} -n $NIX_BUILD_CORES $buildFlags
+        build -a ${targetArch} -b RELEASE -t ${buildType} -p ${projectDscPath} -n $NIX_BUILD_CORES $buildFlags
         runHook postBuild
       '';
 
diff --git a/pkgs/development/compilers/elm/default.nix b/pkgs/development/compilers/elm/default.nix
index 069769dbd5ea..625d7adab411 100644
--- a/pkgs/development/compilers/elm/default.nix
+++ b/pkgs/development/compilers/elm/default.nix
@@ -39,7 +39,7 @@ let
               # Tests are failing after upgrade to ghc881.
               # Cause is probably just a minor change in stdout output
               # see https://github.com/avh4/elm-format/pull/640
-              # doCheck = false;
+              doCheck = false;
               jailbreak = true;
             }));
 
diff --git a/pkgs/development/compilers/kotlin/default.nix b/pkgs/development/compilers/kotlin/default.nix
index d4f37d4f5cce..4e2810fa893c 100644
--- a/pkgs/development/compilers/kotlin/default.nix
+++ b/pkgs/development/compilers/kotlin/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl, makeWrapper, jre, unzip }:
 
 let
-  version = "1.3.71";
+  version = "1.3.72";
 in stdenv.mkDerivation {
   inherit version;
   pname = "kotlin";
 
   src = fetchurl {
     url = "https://github.com/JetBrains/kotlin/releases/download/v${version}/kotlin-compiler-${version}.zip";
-    sha256 = "0jp7z2lys02d0wmycdlfg9c08ji4qvjaz2wzvrxjyvcwv7d7gnvs";
+    sha256 = "0v6c4vjiflwbjjc1lmiyzrilxwbqcz5ll6ls40zhw70zk23xpl6c";
   };
 
   propagatedBuildInputs = [ jre ] ;
diff --git a/pkgs/development/compilers/llvm/10/llvm.nix b/pkgs/development/compilers/llvm/10/llvm.nix
index 648c9fdefc34..18c25f51815c 100644
--- a/pkgs/development/compilers/llvm/10/llvm.nix
+++ b/pkgs/development/compilers/llvm/10/llvm.nix
@@ -16,6 +16,7 @@
 , enableSharedLibraries ? true
 , enablePFM ? !(stdenv.isDarwin
   || stdenv.isAarch64 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
+  || stdenv.isAarch32 # broken for the armv7l builder
 )
 , enablePolly ? true
 }:
diff --git a/pkgs/development/compilers/llvm/7/llvm.nix b/pkgs/development/compilers/llvm/7/llvm.nix
index 55485418e4f1..702a0edb6636 100644
--- a/pkgs/development/compilers/llvm/7/llvm.nix
+++ b/pkgs/development/compilers/llvm/7/llvm.nix
@@ -17,6 +17,7 @@
 , enableSharedLibraries ? true
 , enablePFM ? !(stdenv.isDarwin
   || stdenv.isAarch64 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
+  || stdenv.isAarch32 # broken for the armv7l builder
   )
 , enablePolly ? false
 }:
diff --git a/pkgs/development/compilers/llvm/8/llvm.nix b/pkgs/development/compilers/llvm/8/llvm.nix
index 43615fc675dc..2d996f0dd4c7 100644
--- a/pkgs/development/compilers/llvm/8/llvm.nix
+++ b/pkgs/development/compilers/llvm/8/llvm.nix
@@ -16,6 +16,7 @@
 , enableSharedLibraries ? true
 , enablePFM ? !(stdenv.isDarwin
   || stdenv.isAarch64 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
+  || stdenv.isAarch32 # broken for the armv7l builder
 )
 , enablePolly ? false
 }:
diff --git a/pkgs/development/compilers/llvm/9/llvm.nix b/pkgs/development/compilers/llvm/9/llvm.nix
index f69f45b858b7..aa58503a77ff 100644
--- a/pkgs/development/compilers/llvm/9/llvm.nix
+++ b/pkgs/development/compilers/llvm/9/llvm.nix
@@ -16,6 +16,7 @@
 , enableSharedLibraries ? true
 , enablePFM ? !(stdenv.isDarwin
   || stdenv.isAarch64 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
+  || stdenv.isAarch32 # broken for the armv7l builder
 )
 , enablePolly ? false
 }:
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index b14c26c69478..8638c32262e0 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -371,7 +371,7 @@ self: super: {
   static-resources = dontCheck super.static-resources;
   strive = dontCheck super.strive;                      # fails its own hlint test with tons of warnings
   svndump = dontCheck super.svndump;
-  tar = dontCheck super.tar; #http://hydra.nixos.org/build/25088435/nixlog/2 (fails only on 32-bit)
+  tar = dontCheck super.tar; #https://hydra.nixos.org/build/25088435/nixlog/2 (fails only on 32-bit)
   th-printf = dontCheck super.th-printf;
   thumbnail-plus = dontCheck super.thumbnail-plus;
   tickle = dontCheck super.tickle;
diff --git a/pkgs/development/interpreters/bats/default.nix b/pkgs/development/interpreters/bats/default.nix
index 35672116ca06..bbc38e515424 100644
--- a/pkgs/development/interpreters/bats/default.nix
+++ b/pkgs/development/interpreters/bats/default.nix
@@ -1,17 +1,21 @@
-{ stdenv, fetchzip, gnugrep }:
+{ stdenv, fetchzip, coreutils, gnugrep }:
 
 stdenv.mkDerivation rec {
   pname = "bats";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchzip {
     url = "https://github.com/bats-core/bats-core/archive/v${version}.tar.gz";
-    sha256 = "1kkh0j2alql3xiyhw9wsvcc3xclv52g0ivgyk8h85q9fn3qdqakz";
+    sha256 = "0f59zh4d4pa1a7ybs5zl6h0csbqqv11lbnq0jl1dgwm1s6p49bsq";
   };
 
   patchPhase = ''
     patchShebangs ./install.sh
-    substituteInPlace ./libexec/bats-core/bats-format-tap-stream --replace grep ${gnugrep}/bin/grep
+
+    substituteInPlace ./libexec/bats-core/bats \
+        --replace 'type -p greadlink readlink' 'type -p ${coreutils}/bin/readlink'
+    substituteInPlace ./libexec/bats-core/bats-format-tap-stream \
+        --replace grep ${gnugrep}/bin/grep
   '';
 
   installPhase = "./install.sh $out";
diff --git a/pkgs/development/interpreters/jelly/default.nix b/pkgs/development/interpreters/jelly/default.nix
new file mode 100644
index 000000000000..a317f35d2a78
--- /dev/null
+++ b/pkgs/development/interpreters/jelly/default.nix
@@ -0,0 +1,28 @@
+{ lib, python3Packages, fetchFromGitHub }:
+
+python3Packages.buildPythonApplication {
+  pname = "jelly";
+  version = "0.1.31";
+
+  src = fetchFromGitHub {
+    owner = "DennisMitchell";
+    repo = "jellylanguage";
+    rev = "70c9fd93ab009c05dc396f8cc091f72b212fb188";
+    sha256 = "1rpclqagvigp5qhvgnjavvy463f1drshnc1mfxm6z7ygzs0l0yz6";
+  };
+
+  propagatedBuildInputs = [ python3Packages.sympy ];
+
+  # checks are disabled because jelly has no tests, and the default is to run
+  # the output binary with no arguments, which exits with status 1 and causes
+  # the build to fail
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A recreational programming language inspired by J";
+    homepage    = https://github.com/DennisMitchell/jellylanguage;
+    license     = licenses.mit;
+    maintainers = [ maintainers.tckmn ];
+    platforms   = platforms.all;
+  };
+}
diff --git a/pkgs/development/interpreters/picoc/default.nix b/pkgs/development/interpreters/picoc/default.nix
index 00e77033575f..f7343f6e4d60 100644
--- a/pkgs/development/interpreters/picoc/default.nix
+++ b/pkgs/development/interpreters/picoc/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   # Tests are currently broken on i686 see
-  # http://hydra.nixos.org/build/24003763/nixlog/1
+  # https://hydra.nixos.org/build/24003763/nixlog/1
   doCheck = if stdenv.isi686 then false else true;
   checkTarget = "test";
 
diff --git a/pkgs/development/interpreters/rakudo/zef.nix b/pkgs/development/interpreters/rakudo/zef.nix
index 9a8c11324a21..5c8fe16408b4 100644
--- a/pkgs/development/interpreters/rakudo/zef.nix
+++ b/pkgs/development/interpreters/rakudo/zef.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zef";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "ugexe";
     repo = "zef";
     rev = "v${version}";
-    sha256 = "1fscv8fbaa5l8dcwclmq3hvg3c59l4dvyjqb316mgnc5anxpzy2f";
+    sha256 = "02a3awnjr1mgb9275xvp3xms80vcxkq55ffi8sbjzxpwyadj5y5k";
   };
 
   buildInputs = [ rakudo makeWrapper ];
diff --git a/pkgs/development/interpreters/wasmtime/default.nix b/pkgs/development/interpreters/wasmtime/default.nix
index 79222749dc4b..67d54af7bb2a 100644
--- a/pkgs/development/interpreters/wasmtime/default.nix
+++ b/pkgs/development/interpreters/wasmtime/default.nix
@@ -2,24 +2,26 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasmtime";
-  version = "0.12.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "${pname}";
     rev = "v${version}";
-    sha256 = "08dhk5s8rv41mjqbwfqwqmp6p6p9y7qc5yc76ljjd9l7j1phl7mr";
+    sha256 = "1df99iak0psydlg9m8f8qq4zyh4wbi5l4qgsdjr2lm74ci3483xy";
     fetchSubmodules = true;
   };
 
-  cargoSha256 = "0vyxp74jlnrisk0kblsbj9d9a54wcgzbyjm7iqav1k4ns3syrnmh";
+  cargoSha256 = "170bz48jrc1k2ylfmd3bcry0xpcxx8p3rzzv9mprlfmrfpb0b28r";
 
   nativeBuildInputs = [ python cmake clang ];
   buildInputs = [ llvmPackages.libclang ] ++
    lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
   LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
 
-  doCheck = false; # https://github.com/bytecodealliance/wasmtime/issues/1197
+  # no test on darwin due to
+  # https://github.com/bytecodealliance/wasmtime/issues/1556
+  doCheck = !stdenv.isDarwin;
 
   meta = with lib; {
     description = "Standalone JIT-style runtime for WebAssembly, using Cranelift";
diff --git a/pkgs/development/libraries/armadillo/default.nix b/pkgs/development/libraries/armadillo/default.nix
index 3251b1c9e0d2..9b32d46b3b2f 100644
--- a/pkgs/development/libraries/armadillo/default.nix
+++ b/pkgs/development/libraries/armadillo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "armadillo";
-  version = "9.860.1";
+  version = "9.870.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    sha256 = "1ab5y4ll6js2w4p9dabj2dmzzc3f8dja8dqsvy40azrvny58h0qn";
+    sha256 = "0mpp1iq4ws9yhcv0bnn0czzyim7whcan34c7a052sh8w9kp5y6sl";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/audio/libbass/default.nix b/pkgs/development/libraries/audio/libbass/default.nix
index 84fa46eed273..593854bb280d 100644
--- a/pkgs/development/libraries/audio/libbass/default.nix
+++ b/pkgs/development/libraries/audio/libbass/default.nix
@@ -9,7 +9,7 @@ let
   allBass = {
     bass = {
       h = "bass.h";
-      version = "2.4.14";
+      version = "2.4.15";
       so = {
         i686_linux = "libbass.so";
         x86_64-linux = "x64/libbass.so";
diff --git a/pkgs/development/libraries/aws-sdk-cpp/cmake-dirs.patch b/pkgs/development/libraries/aws-sdk-cpp/cmake-dirs.patch
new file mode 100644
index 000000000000..6e4cad9e73cf
--- /dev/null
+++ b/pkgs/development/libraries/aws-sdk-cpp/cmake-dirs.patch
@@ -0,0 +1,75 @@
+diff --git a/cmake/AWSSDKConfig.cmake b/cmake/AWSSDKConfig.cmake
+index e87252123e..5457bd5910 100644
+--- a/cmake/AWSSDKConfig.cmake
++++ b/cmake/AWSSDKConfig.cmake
+@@ -82,6 +82,7 @@ if (AWSSDK_ROOT_DIR)
+             )
+ else()
+     find_file(AWSSDK_CORE_HEADER_FILE Aws.h
++        "/${AWSSDK_INSTALL_INCLUDEDIR}/aws/core"
+         "/usr/${AWSSDK_INSTALL_INCLUDEDIR}/aws/core"
+         "/usr/local/${AWSSDK_INSTALL_INCLUDEDIR}/aws/core"
+         "C:/Progra~1/AWSSDK/${AWSSDK_INSTALL_INCLUDEDIR}/aws/core"
+@@ -97,14 +98,18 @@ if (NOT AWSSDK_CORE_HEADER_FILE)
+     message(FATAL_ERROR "AWS SDK for C++ is missing, please install it first")
+ endif()
+ 
+-# based on core header file path, inspects the actual AWSSDK_ROOT_DIR
+-get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_CORE_HEADER_FILE}" PATH)
+-get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_ROOT_DIR}" PATH)
+-get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_ROOT_DIR}" PATH)
+-get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_ROOT_DIR}" PATH)
+-
+-if (NOT AWSSDK_ROOT_DIR)
+-    message(FATAL_ERROR "AWSSDK_ROOT_DIR is not set or can't be calculated from the path of core header file")
++if (IS_ABSOLUTE ${AWSSDK_INSTALL_LIBDIR})
++    set(AWSSDK_ROOT_DIR "")
++else()
++    # based on core header file path, inspects the actual AWSSDK_ROOT_DIR
++    get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_CORE_HEADER_FILE}" PATH)
++    get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_ROOT_DIR}" PATH)
++    get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_ROOT_DIR}" PATH)
++    get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_ROOT_DIR}" PATH)
++
++    if (NOT AWSSDK_ROOT_DIR)
++	message(FATAL_ERROR "AWSSDK_ROOT_DIR is not set or can't be calculated from the path of core header file")
++    endif()
+ endif()
+ 
+ 
+diff --git a/cmake/utilities.cmake b/cmake/utilities.cmake
+index 283a14a138..646aea1da3 100644
+--- a/cmake/utilities.cmake
++++ b/cmake/utilities.cmake
+@@ -43,7 +43,8 @@ macro(setup_install)
+                 EXPORT "${PROJECT_NAME}-targets"
+                 ARCHIVE DESTINATION ${ARCHIVE_DIRECTORY}
+                 LIBRARY DESTINATION ${LIBRARY_DIRECTORY}
+-                RUNTIME DESTINATION ${BINARY_DIRECTORY} )
++                RUNTIME DESTINATION ${BINARY_DIRECTORY}
++                INCLUDES DESTINATION ${INCLUDE_DIRECTORY} )
+ 
+         if (BUILD_SHARED_LIBS)
+             install(
+@@ -57,7 +58,8 @@ macro(setup_install)
+             install (TARGETS ${PROJECT_NAME}
+                      ARCHIVE DESTINATION ${ARCHIVE_DIRECTORY}/${SDK_INSTALL_BINARY_PREFIX}/${PLATFORM_INSTALL_QUALIFIER}/\${CMAKE_INSTALL_CONFIG_NAME}
+                      LIBRARY DESTINATION ${LIBRARY_DIRECTORY}/${SDK_INSTALL_BINARY_PREFIX}/${PLATFORM_INSTALL_QUALIFIER}/\${CMAKE_INSTALL_CONFIG_NAME}
+-                     RUNTIME DESTINATION ${BINARY_DIRECTORY}/${SDK_INSTALL_BINARY_PREFIX}/${PLATFORM_INSTALL_QUALIFIER}/\${CMAKE_INSTALL_CONFIG_NAME})
++                     RUNTIME DESTINATION ${BINARY_DIRECTORY}/${SDK_INSTALL_BINARY_PREFIX}/${PLATFORM_INSTALL_QUALIFIER}/\${CMAKE_INSTALL_CONFIG_NAME}
++                     INCLUDES DESTINATION ${INCLUDE_DIRECTORY}/${SDK_INSTALL_BINARY_PREFIX}/${PLATFORM_INSTALL_QUALIFIER}/\${CMAKE_INSTALL_CONFIG_NAME})
+         endif()
+     endif()
+ endmacro()
+diff --git a/toolchains/pkg-config.pc.in b/toolchains/pkg-config.pc.in
+index 9b519d2772..a61069225c 100644
+--- a/toolchains/pkg-config.pc.in
++++ b/toolchains/pkg-config.pc.in
+@@ -1,5 +1,5 @@
+-includedir=@CMAKE_INSTALL_PREFIX@/@INCLUDE_DIRECTORY@
+-libdir=@CMAKE_INSTALL_PREFIX@/@LIBRARY_DIRECTORY@
++includedir=@INCLUDE_DIRECTORY@
++libdir=@LIBRARY_DIRECTORY@
+ 
+ Name: @PROJECT_NAME@
+ Description: @PROJECT_DESCRIPTION@
diff --git a/pkgs/development/libraries/aws-sdk-cpp/default.nix b/pkgs/development/libraries/aws-sdk-cpp/default.nix
index f6878cd9396e..94827743bf3d 100644
--- a/pkgs/development/libraries/aws-sdk-cpp/default.nix
+++ b/pkgs/development/libraries/aws-sdk-cpp/default.nix
@@ -50,6 +50,12 @@ stdenv.mkDerivation rec {
       rm aws-cpp-sdk-core-tests/aws/auth/AWSCredentialsProviderTest.cpp
     '';
 
+  postFixupHooks = [
+    # This bodge is necessary so that the file that the generated -config.cmake file
+    # points to an existing directory.
+    ''mkdir -p $out/include''
+  ];
+
   __darwinAllowLocalNetworking = true;
 
   patches = [
@@ -57,6 +63,7 @@ stdenv.mkDerivation rec {
       url = "https://github.com/aws/aws-sdk-cpp/commit/42991ab549087c81cb630e5d3d2413e8a9cf8a97.patch";
       sha256 = "0myq5cm3lvl5r56hg0sc0zyn1clbkd9ys0wr95ghw6bhwpvfv8gr";
     })
+    ./cmake-dirs.patch
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/boost/cmake-paths.patch b/pkgs/development/libraries/boost/cmake-paths.patch
new file mode 100644
index 000000000000..b7f90148f9dc
--- /dev/null
+++ b/pkgs/development/libraries/boost/cmake-paths.patch
@@ -0,0 +1,21 @@
+diff --git a/tools/boost_install/boost-install.jam b/tools/boost_install/boost-install.jam
+index ad19f7b55..ec6bf57ff 100644
+--- a/tools/boost_install/boost-install.jam
++++ b/tools/boost_install/boost-install.jam
+@@ -587,6 +587,7 @@ rule generate-cmake-config- ( target : sources * : properties * )
+         "# Compute the include and library directories relative to this file."
+         ""
+         "get_filename_component(_BOOST_CMAKEDIR \"${CMAKE_CURRENT_LIST_DIR}/../\" ABSOLUTE)"
++        "get_filename_component(_BOOST_REAL_CMAKEDIR \"${CMAKE_CURRENT_LIST_DIR}/../\" ABSOLUTE)"
+         : true ;
+ 
+     if [ path.is-rooted $(cmakedir) ]
+@@ -607,6 +608,8 @@ rule generate-cmake-config- ( target : sources * : properties * )
+             "  unset(_BOOST_CMAKEDIR_ORIGINAL)"
+             "endif()"
+             ""
++	    "# Assume that the installer actually did know where the libs were to be installed"
++            "get_filename_component(_BOOST_CMAKEDIR \"$(cmakedir-native)\" REALPATH)"
+             : true ;
+     }
+ 
diff --git a/pkgs/development/libraries/boost/generic.nix b/pkgs/development/libraries/boost/generic.nix
index 7fe3c185c04a..6d1c20f323d3 100644
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@@ -112,7 +112,8 @@ stdenv.mkDerivation {
   ++ optional stdenv.isDarwin (
     if version == "1.55.0"
     then ./darwin-1.55-no-system-python.patch
-    else ./darwin-no-system-python.patch);
+    else ./darwin-no-system-python.patch)
+  ++ optional (versionAtLeast version "1.70") ./cmake-paths.patch;
 
   meta = {
     homepage = "http://boost.org/";
diff --git a/pkgs/development/libraries/boringssl/default.nix b/pkgs/development/libraries/boringssl/default.nix
index 67e2794c8a29..20524cf179cf 100644
--- a/pkgs/development/libraries/boringssl/default.nix
+++ b/pkgs/development/libraries/boringssl/default.nix
@@ -3,24 +3,23 @@
 # reference: https://boringssl.googlesource.com/boringssl/+/2661/BUILDING.md
 stdenv.mkDerivation {
   pname = "boringssl";
-  version = "2017-02-23";
+  version = "2019-12-04";
 
   src = fetchgit {
     url    = "https://boringssl.googlesource.com/boringssl";
-    rev    = "be2ee342d3781ddb954f91f8a7e660c6f59e87e5";
-    sha256 = "022zq7wlkhrg6al7drr3555lam3zw5bb10ylf9mznp83s854f975";
+    rev    = "243b5cc9e33979ae2afa79eaa4e4c8d59db161d4";
+    sha256 = "1ak27dln0zqy2vj4llqsb99g03sk0sg25wlp09b58cymrh3gccvl";
   };
 
-  buildInputs = [ cmake perl go ];
+  nativeBuildInputs = [ cmake perl go ];
   enableParallelBuilding = true;
-  NIX_CFLAGS_COMPILE = "-Wno-error";
 
   makeFlags = [ "GOCACHE=$(TMPDIR)/go-cache" ];
 
   installPhase = ''
-    mkdir -p $out/bin $out/include $out/lib
+    mkdir -p $bin/bin $out/include $out/lib
 
-    mv tool/bssl $out/bin
+    mv tool/bssl $bin/bin
 
     mv ssl/libssl.a           $out/lib
     mv crypto/libcrypto.a     $out/lib
@@ -29,6 +28,8 @@ stdenv.mkDerivation {
     mv ../include/openssl $out/include
   '';
 
+  outputs = [ "out" "bin" ];
+
   meta = with stdenv.lib; {
     description = "Free TLS/SSL implementation";
     homepage    = "https://boringssl.googlesource.com";
diff --git a/pkgs/development/libraries/catch2/default.nix b/pkgs/development/libraries/catch2/default.nix
index a2b65c9bbb41..960c07e29df4 100644
--- a/pkgs/development/libraries/catch2/default.nix
+++ b/pkgs/development/libraries/catch2/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "catch2";
-  version = "2.11.3";
+  version = "2.12.1";
 
   src = fetchFromGitHub {
     owner = "catchorg";
     repo = "Catch2";
     rev = "v${version}";
-    sha256="012j7fnlsdyvg6d7gwdab7yzllkv4wqb164lfg4ixahx9l9schmp";
+    sha256="163198lizcr84ify34xjj1955rcgsqhwn87dwifiwyamnggn445f";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/check/default.nix b/pkgs/development/libraries/check/default.nix
index 193bdda3445d..0a51e7e592b1 100644
--- a/pkgs/development/libraries/check/default.nix
+++ b/pkgs/development/libraries/check/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "02zkfiyklckmivrfvdsrlzvzphkdsgjrz3igncw05dv5pshhq3xx";
   };
 
-  # Test can randomly fail: http://hydra.nixos.org/build/7243912
+  # Test can randomly fail: https://hydra.nixos.org/build/7243912
   doCheck = false;
 
   buildInputs = stdenv.lib.optional stdenv.isDarwin CoreServices;
diff --git a/pkgs/development/libraries/exiv2/default.nix b/pkgs/development/libraries/exiv2/default.nix
index a192a4c2cab6..8a6dfd1983ef 100644
--- a/pkgs/development/libraries/exiv2/default.nix
+++ b/pkgs/development/libraries/exiv2/default.nix
@@ -79,8 +79,9 @@ stdenv.mkDerivation rec {
     mkdir ../test/tmp
     export LD_LIBRARY_PATH="$(realpath ../build/lib)"
 
-    # Fix tests on Aarch64
-    ${stdenv.lib.optionalString stdenv.isAarch64 ''
+    ${stdenv.lib.optionalString (stdenv.isAarch64 || stdenv.isAarch32) ''
+      # Fix tests on arm
+      # https://github.com/Exiv2/exiv2/issues/933
       rm -f ../tests/bugfixes/github/test_CVE_2018_12265.py
     ''}
 
diff --git a/pkgs/development/libraries/gmp/5.1.x.nix b/pkgs/development/libraries/gmp/5.1.x.nix
index 78cfa40d1966..a027d58de396 100644
--- a/pkgs/development/libraries/gmp/5.1.x.nix
+++ b/pkgs/development/libraries/gmp/5.1.x.nix
@@ -25,7 +25,7 @@ let self = stdenv.mkDerivation rec {
     (stdenv.lib.enableFeature cxx "cxx")
     # Build a "fat binary", with routines for several sub-architectures
     # (x86), except on Solaris where some tests crash with "Memory fault".
-    # See <http://hydra.nixos.org/build/2760931>, for instance.
+    # See <https://hydra.nixos.org/build/2760931>, for instance.
     #
     # no darwin because gmp uses ASM that clang doesn't like
     (stdenv.lib.enableFeature (!stdenv.isSunOS && stdenv.hostPlatform.isx86) "fat")
diff --git a/pkgs/development/libraries/gmp/6.x.nix b/pkgs/development/libraries/gmp/6.x.nix
index cca0f8d68e14..c5fffa09bf0b 100644
--- a/pkgs/development/libraries/gmp/6.x.nix
+++ b/pkgs/development/libraries/gmp/6.x.nix
@@ -27,7 +27,7 @@ let self = stdenv.mkDerivation rec {
     (stdenv.lib.enableFeature cxx "cxx")
     # Build a "fat binary", with routines for several sub-architectures
     # (x86), except on Solaris where some tests crash with "Memory fault".
-    # See <http://hydra.nixos.org/build/2760931>, for instance.
+    # See <https://hydra.nixos.org/build/2760931>, for instance.
     #
     # no darwin because gmp uses ASM that clang doesn't like
     (stdenv.lib.enableFeature (!stdenv.isSunOS && stdenv.hostPlatform.isx86) "fat")
diff --git a/pkgs/development/libraries/gnutls-kdh/generic.nix b/pkgs/development/libraries/gnutls-kdh/generic.nix
index 90e863760e92..c6d35b682360 100644
--- a/pkgs/development/libraries/gnutls-kdh/generic.nix
+++ b/pkgs/development/libraries/gnutls-kdh/generic.nix
@@ -11,7 +11,7 @@
 assert guileBindings -> guile != null;
 let
   # XXX: Gnulib's `test-select' fails on FreeBSD:
-  # http://hydra.nixos.org/build/2962084/nixlog/1/raw .
+  # https://hydra.nixos.org/build/2962084/nixlog/1/raw .
   doCheck = !stdenv.isFreeBSD && !stdenv.isDarwin && lib.versionAtLeast version "3.4";
 in
 stdenv.mkDerivation {
diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index 4e7e19d9ff04..cffd5459b3a6 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -11,7 +11,7 @@ let
   version = "3.6.13";
 
   # XXX: Gnulib's `test-select' fails on FreeBSD:
-  # http://hydra.nixos.org/build/2962084/nixlog/1/raw .
+  # https://hydra.nixos.org/build/2962084/nixlog/1/raw .
   doCheck = !stdenv.isFreeBSD && !stdenv.isDarwin && lib.versionAtLeast version "3.4"
       && stdenv.buildPlatform == stdenv.hostPlatform;
 
diff --git a/pkgs/development/libraries/icu/67.nix b/pkgs/development/libraries/icu/67.nix
new file mode 100644
index 000000000000..23a1069ea14f
--- /dev/null
+++ b/pkgs/development/libraries/icu/67.nix
@@ -0,0 +1,4 @@
+import ./base.nix {
+  version = "67.1";
+  sha256 = "1p6mhvxl0xr2n0g6xdps3mwzwlv6mjsz3xlpm793p9aiybb0ra4l";
+}
diff --git a/pkgs/development/libraries/jsoncpp/default.nix b/pkgs/development/libraries/jsoncpp/default.nix
index aa72aeb0d36c..155103af3c4e 100644
--- a/pkgs/development/libraries/jsoncpp/default.nix
+++ b/pkgs/development/libraries/jsoncpp/default.nix
@@ -30,8 +30,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake python ];
 
-  # fix inverted sense in isAnyCharRequiredQuoting on aarch64. See: https://github.com/open-source-parsers/jsoncpp/pull/1120
-  patches = stdenv.lib.optionals stdenv.isAarch64 [
+  # fix inverted sense in isAnyCharRequiredQuoting on arm. See: https://github.com/open-source-parsers/jsoncpp/pull/1120
+  patches = stdenv.lib.optionals (stdenv.isAarch64 || stdenv.isAarch32) [
     (fetchpatch {
       url = "https://github.com/open-source-parsers/jsoncpp/commit/9093358efae9e5981aa60013487fc7215f040a59.patch";
       sha256 = "1wiqp70sck2md14sfc0zdkblqk9750cl55ykf9d6b9vs1ifzzzq5";
diff --git a/pkgs/development/libraries/leatherman/default.nix b/pkgs/development/libraries/leatherman/default.nix
index 1fab7ee28a8a..8a34f05f6cf0 100644
--- a/pkgs/development/libraries/leatherman/default.nix
+++ b/pkgs/development/libraries/leatherman/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "leatherman";
-  version = "1.11.0";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
-    sha256 = "1kp35gnph9myqxdxzyj1871ay19nfajxglzwai1gvsnh5840xnxy";
+    sha256 = "00qigglp67a14ki4dhjxd3j540a80rkmzhysx7hra8v2rgbsqgj8";
     rev = version;
     repo = "leatherman";
     owner = "puppetlabs";
diff --git a/pkgs/development/libraries/libcec/default.nix b/pkgs/development/libraries/libcec/default.nix
index 09ebac93869b..a1c2967dde73 100644
--- a/pkgs/development/libraries/libcec/default.nix
+++ b/pkgs/development/libraries/libcec/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, cmake, pkgconfig, udev, libcec_platform, libraspberrypi ? null }:
 
-let version = "4.0.4"; in
+let version = "4.0.5"; in
 
 stdenv.mkDerivation {
   pname = "libcec";
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://github.com/Pulse-Eight/libcec/archive/libcec-${version}.tar.gz";
-    sha256 = "02j09y06csaic4m0fyb4dr9l3hl15nxbbniwq0i1qlccpxjak0j3";
+    sha256 = "0hvp33mq0kg544hw20aq3vy5lxf5zid6gxm3qdga7wxw1r1lkmz4";
   };
 
   nativeBuildInputs = [ pkgconfig cmake ];
diff --git a/pkgs/development/libraries/libgpg-error/default.nix b/pkgs/development/libraries/libgpg-error/default.nix
index 0b2e7341513e..e170e4931b83 100644
--- a/pkgs/development/libraries/libgpg-error/default.nix
+++ b/pkgs/development/libraries/libgpg-error/default.nix
@@ -60,7 +60,7 @@ in stdenv.mkDerivation (rec {
     # For some reason, /bin/sh on OpenIndiana leads to this at the end of the
     # `config.status' run:
     #   ./config.status[1401]: shift: (null): bad number
-    # (See <http://hydra.nixos.org/build/2931046/nixlog/1/raw>.)
+    # (See <https://hydra.nixos.org/build/2931046/nixlog/1/raw>.)
     # Thus, re-run it with Bash.
       "${stdenv.shell} config.status";
 
diff --git a/pkgs/development/libraries/libmypaint/default.nix b/pkgs/development/libraries/libmypaint/default.nix
index 409867695fc0..5cb971f5db89 100644
--- a/pkgs/development/libraries/libmypaint/default.nix
+++ b/pkgs/development/libraries/libmypaint/default.nix
@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libmypaint";
-  version = "1.5.1";
+  version = "1.6.0";
 
   outputs = [ "out" "dev" ];
 
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     owner = "mypaint";
     repo = "libmypaint";
     rev = "v${version}";
-    sha256 = "1pxx8fjdabcindxhzgbhg4p7yanl4ihbd8kq71y2nyi9dqsjr2fw";
+    sha256 = "1fdyywm915mmilfmzp7lz4rnmm05kkw0adrdqpqi4n8icp4d530g";
   };
 
   nativeBuildInputs = [
@@ -43,10 +43,6 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  postPatch = ''
-    sed 's|python2|python|' -i autogen.sh
-  '';
-
   preConfigure = "./autogen.sh";
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/libosmium/default.nix b/pkgs/development/libraries/libosmium/default.nix
index e6abe620aaf0..29edf37d80ef 100644
--- a/pkgs/development/libraries/libosmium/default.nix
+++ b/pkgs/development/libraries/libosmium/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libosmium";
-  version = "2.15.4";
+  version = "2.15.5";
 
   src = fetchFromGitHub {
     owner = "osmcode";
     repo = "libosmium";
     rev = "v${version}";
-    sha256 = "0mlcvqrhp40bzj5r5j9nfc5vbis8hmzcq9xi8jylkciyydaynhz4";
+    sha256 = "1f21dzzkxzi74hv17fs9kb2w6indqvvm4lkxclz4j4x98k8q3n59";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/ndi/default.nix b/pkgs/development/libraries/ndi/default.nix
index 7a4407a17f0d..ec39bbd65937 100644
--- a/pkgs/development/libraries/ndi/default.nix
+++ b/pkgs/development/libraries/ndi/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "ndi";
-  fullVersion = "4.1.6";
+  fullVersion = "4.5.1";
   version = builtins.head (builtins.splitVersion fullVersion);
 
   src = requireFile rec {
     name    = "InstallNDISDK_v${version}_Linux.tar.gz";
-    sha256  = "0hki805j3hlci6w5ca2cajm5q0y9yihgvpsykkn8dzx8chw4pmsk";
+    sha256  = "04l57cfc88cdqa9015h5g1csr7xfjxp75x8qz8bsqk1dizp9ir6r";
     message = ''
       In order to use NDI SDK version ${fullVersion}, you need to comply with
       NewTek's license and download the appropriate Linux tarball from:
diff --git a/pkgs/development/ocaml-modules/async_find/default.nix b/pkgs/development/ocaml-modules/async_find/default.nix
deleted file mode 100644
index aa797cdace35..000000000000
--- a/pkgs/development/ocaml-modules/async_find/default.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{stdenv, buildOcaml, fetchurl, async_p4, core_p4, sexplib_p4}:
-
-buildOcaml rec {
-  name = "async_find";
-  version = "111.28.00";
-
-  minimumSupportedOcamlVersion = "4.02";
-
-  src = fetchurl {
-    url = "https://github.com/janestreet/async_find/archive/${version}.tar.gz";
-    sha256 = "4e3fda72f50174f05d96a5a09323f236c041b1a685890c155822956f3deb8803";
-  };
-
-  propagatedBuildInputs = [ async_p4 core_p4 sexplib_p4 ];
-
-  meta = with stdenv.lib; {
-    homepage = "https://github.com/janestreet/async_find";
-    description = "Directory traversal with Async";
-    license = licenses.asl20;
-    maintainers = [ maintainers.ericbmerritt ];
-  };
-}
diff --git a/pkgs/development/python-modules/autopep8/default.nix b/pkgs/development/python-modules/autopep8/default.nix
index ccefe60ea089..715e4da8f44e 100644
--- a/pkgs/development/python-modules/autopep8/default.nix
+++ b/pkgs/development/python-modules/autopep8/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "autopep8";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1swr8ccm3mafcm3zpbwyn22kjs39lbqmg8w41sh7yb3gskgy2syc";
+    sha256 = "0m29ndgrcgrzi3y1fsxmdl421x6n4gn02l70hsz8486h8zzdhbqm";
   };
 
   propagatedBuildInputs = [ pycodestyle ];
diff --git a/pkgs/development/python-modules/binwalk/default.nix b/pkgs/development/python-modules/binwalk/default.nix
index 97c6b957a437..e8a20b6df47d 100644
--- a/pkgs/development/python-modules/binwalk/default.nix
+++ b/pkgs/development/python-modules/binwalk/default.nix
@@ -7,7 +7,6 @@
 , gzip
 , bzip2
 , gnutar
-, p7zip
 , cabextract
 , lzma
 , nose
@@ -29,7 +28,7 @@ buildPythonPackage {
     sha256 = "1bxgj569fzwv6jhcbl864nmlsi9x1k1r20aywjxc8b9b1zgqrlvc";
   };
 
-  propagatedBuildInputs = [ zlib xz ncompress gzip bzip2 gnutar p7zip cabextract lzma pycrypto ]
+  propagatedBuildInputs = [ zlib xz ncompress gzip bzip2 gnutar cabextract lzma pycrypto ]
   ++ stdenv.lib.optional visualizationSupport pyqtgraph;
 
   # setup.py only installs version.py during install, not test
diff --git a/pkgs/development/python-modules/eggdeps/default.nix b/pkgs/development/python-modules/eggdeps/default.nix
index d10c1a0be654..8c7d7679005e 100644
--- a/pkgs/development/python-modules/eggdeps/default.nix
+++ b/pkgs/development/python-modules/eggdeps/default.nix
@@ -17,7 +17,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ zope_interface zope_testing ];
 
-  # tests fail, see http://hydra.nixos.org/build/4316603/log/raw
+  # tests fail, see https://hydra.nixos.org/build/4316603/log/raw
   doCheck = false;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/kombu/default.nix b/pkgs/development/python-modules/kombu/default.nix
index 6fcb31a94589..437f03276708 100644
--- a/pkgs/development/python-modules/kombu/default.nix
+++ b/pkgs/development/python-modules/kombu/default.nix
@@ -5,6 +5,8 @@
 , pytest
 , pytz
 , sqlalchemy
+, importlib-metadata
+, pythonOlder
 }:
 
 buildPythonPackage rec {
@@ -23,7 +25,11 @@ buildPythonPackage rec {
       --replace "amqp==2.5.1" "amqp~=2.5"
   '';
 
-  propagatedBuildInputs = [ amqp ];
+  propagatedBuildInputs = [
+    amqp
+  ] ++ lib.optionals (pythonOlder "3.8") [
+    importlib-metadata
+  ];
 
   checkInputs = [ pytest case pytz Pyro4 sqlalchemy ];
   # test_redis requires fakeredis, which isn't trivial to package
diff --git a/pkgs/development/python-modules/langcodes/default.nix b/pkgs/development/python-modules/langcodes/default.nix
index 4426e9cb9a88..f5686c1afb40 100644
--- a/pkgs/development/python-modules/langcodes/default.nix
+++ b/pkgs/development/python-modules/langcodes/default.nix
@@ -8,17 +8,16 @@
 
 buildPythonPackage rec {
   pname = "langcodes";
-  version = "1.4.1";
+  version = "2.0.0";
+  disabled = pythonOlder "3.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1axdiva2qglsjmnx2ak7i6hm0yhp6kbc4lcsgn8ckwy0nq1z3kr2";
+    sha256 = "0xszgmydymzhb0dhx5qvdn3x5z477ld0paw17lwwhlrxffkq5jxz";
   };
 
   propagatedBuildInputs = [ marisa-trie ];
 
-  disabled = pythonOlder "3.3";
-
   checkInputs = [ nose ];
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/pylibftdi/default.nix b/pkgs/development/python-modules/pylibftdi/default.nix
index 9e8f96665d0b..54058ae1982d 100644
--- a/pkgs/development/python-modules/pylibftdi/default.nix
+++ b/pkgs/development/python-modules/pylibftdi/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, httpserver
 , libftdi1
 , libusb1
 }:
@@ -16,14 +15,13 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [
-    httpserver
     libftdi1
     libusb1
   ];
 
   postPatch = ''
     substituteInPlace pylibftdi/driver.py \
-      --replace "self._load_library('libusb')" "cdll.LoadLibrary('${libusb1.out}/lib/libusb1.so')" \
+      --replace "self._load_library('libusb')" "cdll.LoadLibrary('${libusb1.out}/lib/libusb-1.0.so')" \
       --replace "self._load_library('libftdi')" "cdll.LoadLibrary('${libftdi1.out}/lib/libftdi1.so')"
   '';
 
diff --git a/pkgs/development/python-modules/pyopenssl/default.nix b/pkgs/development/python-modules/pyopenssl/default.nix
index 4305487b6564..33fd3c6e10d4 100644
--- a/pkgs/development/python-modules/pyopenssl/default.nix
+++ b/pkgs/development/python-modules/pyopenssl/default.nix
@@ -102,7 +102,7 @@ buildPythonPackage rec {
     })
   ];
 
-  # Seems to fail unpredictably on Darwin. See http://hydra.nixos.org/build/49877419/nixlog/1
+  # Seems to fail unpredictably on Darwin. See https://hydra.nixos.org/build/49877419/nixlog/1
   # for one example, but I've also seen ContextTests.test_set_verify_callback_exception fail.
   doCheck = !stdenv.isDarwin;
 
diff --git a/pkgs/development/python-modules/python-gitlab/default.nix b/pkgs/development/python-modules/python-gitlab/default.nix
index d2b1a6570b12..0c1f7c67e3df 100644
--- a/pkgs/development/python-modules/python-gitlab/default.nix
+++ b/pkgs/development/python-modules/python-gitlab/default.nix
@@ -1,22 +1,24 @@
-{ stdenv, buildPythonPackage, fetchPypi, requests, six, mock, httmock }:
+{ stdenv, buildPythonPackage, fetchPypi, requests, mock, httmock, pythonOlder }:
 
 buildPythonPackage rec {
-  pname   = "python-gitlab";
-  version = "1.15.0";
+  pname = "python-gitlab";
+  version = "2.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "45125a0ed4d0027d4317bdbd71ca02fc52b0ac160b9d2c3c5be131b4d19f867e";
+    sha256 = "4c4ea60c8303f4214522b18038df017cae35afda7474efa0b4e19c2e73bc3ae2";
   };
 
-  propagatedBuildInputs = [ requests six ];
+  propagatedBuildInputs = [ requests ];
 
   checkInputs = [ mock httmock ];
 
+  disabled = pythonOlder "3.6";
+
   meta = with stdenv.lib; {
     description = "Interact with GitLab API";
-    homepage    = "https://github.com/python-gitlab/python-gitlab";
-    license     = licenses.lgpl3;
+    homepage = "https://github.com/python-gitlab/python-gitlab";
+    license = licenses.lgpl3;
     maintainers = with maintainers; [ nyanloutre ];
   };
 }
diff --git a/pkgs/development/python-modules/python-telegram-bot/default.nix b/pkgs/development/python-modules/python-telegram-bot/default.nix
index 5b921e326678..f36f82395685 100644
--- a/pkgs/development/python-modules/python-telegram-bot/default.nix
+++ b/pkgs/development/python-modules/python-telegram-bot/default.nix
@@ -2,38 +2,36 @@
 , fetchPypi
 , buildPythonPackage
 , certifi
+, decorator
 , future
 , urllib3
 , tornado
 , pytest
+, isPy3k
 }:
 
 buildPythonPackage rec {
   pname = "python-telegram-bot";
-  version = "12.3.0";
+  version = "12.7";
+  disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0yrg5342zz0hpf2pc85ffwx57msa6jpcmvvjfkzh8nh2lc98aq21";
+    sha256 = "1vwf4pgjrg9a6w51ds9wmzq31bmi3f7xs79gdzzfxfmqmy1hb2r1";
   };
 
-  prePatch = ''
-    rm -rf telegram/vendor
-    substituteInPlace telegram/utils/request.py \
-      --replace "import telegram.vendor.ptb_urllib3.urllib3 as urllib3" "import urllib3 as urllib3" \
-      --replace "import telegram.vendor.ptb_urllib3.urllib3.contrib.appengine as appengine" "import urllib3.contrib.appengine as appengine" \
-      --replace "from telegram.vendor.ptb_urllib3.urllib3.connection import HTTPConnection" "from urllib3.connection import HTTPConnection" \
-      --replace "from telegram.vendor.ptb_urllib3.urllib3.util.timeout import Timeout" "from urllib3.util.timeout import Timeout" \
-      --replace "from telegram.vendor.ptb_urllib3.urllib3.fields import RequestField" "from urllib3.fields import RequestField"
+  checkInputs = [ pytest ];
+  propagatedBuildInputs = [ certifi future urllib3 tornado decorator ];
 
-    touch LICENSE.dual
+  # --with-upstream-urllib3 is not working properly
+  postPatch = ''
+    rm -rf telegram/vendor
   '';
-
-  checkInputs = [ pytest ];
-  propagatedBuildInputs = [ certifi future urllib3 tornado ];
+  setupPyGlobalFlags = "--with-upstream-urllib3";
 
   # tests not included with release
   doCheck = false;
+  pythonImportsCheck = [ "telegram" ];
 
   meta = with stdenv.lib; {
     description = "This library provides a pure Python interface for the Telegram Bot API.";
diff --git a/pkgs/development/python-modules/secure/default.nix b/pkgs/development/python-modules/secure/default.nix
index 6d2f2871ec2d..49fcb52a154f 100644
--- a/pkgs/development/python-modules/secure/default.nix
+++ b/pkgs/development/python-modules/secure/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchFromGitHub
+{ lib, buildPythonPackage, fetchFromGitHub, isPy27
 , maya
 , requests
 }:
@@ -6,6 +6,7 @@
 buildPythonPackage rec {
   version = "0.2.1";
   pname = "secure";
+  disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "typeerror";
diff --git a/pkgs/development/python-modules/wordfreq/default.nix b/pkgs/development/python-modules/wordfreq/default.nix
index 0dab52348604..d687ffd2d0b9 100644
--- a/pkgs/development/python-modules/wordfreq/default.nix
+++ b/pkgs/development/python-modules/wordfreq/default.nix
@@ -11,34 +11,33 @@
 , fetchFromGitHub
 }:
 
-buildPythonPackage {
+buildPythonPackage rec {
   pname = "wordfreq";
-  version = "2.2.0";
+  version = "2.3.2";
+  disabled = pythonOlder "3";
 
    src = fetchFromGitHub {
     owner = "LuminosoInsight";
     repo = "wordfreq";
     # upstream don't tag by version
-    rev = "bc12599010c8181a725ec97d0b3990758a48da36";
-    sha256 = "195794vkzq5wsq3mg1dgfhlnz2f7vi1xajlifq6wkg4lzwyq262m";
+    rev = "v${version}";
+    sha256 = "078657iiksrqzcc2wvwhiilf3xxq5vlinsv0kz03qzqr1qyvbmas";
    };
 
-  checkInputs = [ pytest ];
-
-  checkPhase = ''
-    # These languages require additional dictionaries
-    pytest tests -k 'not test_japanese and not test_korean and not test_languages and not test_french_and_related'
-  '';
-   
   propagatedBuildInputs = [ regex langcodes ftfy msgpack mecab-python3 jieba ];
-  
+
   # patch to relax version requirements for regex
   # dependency to prevent break in upgrade
   postPatch = ''
     substituteInPlace setup.py --replace "regex ==" "regex >="
   '';
-    
-  disabled = pythonOlder "3";
+
+  checkInputs = [ pytest ];
+
+  checkPhase = ''
+    # These languages require additional dictionaries
+    pytest tests -k 'not test_japanese and not test_korean and not test_languages and not test_french_and_related'
+  '';
 
   meta = with lib; {
     description = "A library for looking up the frequencies of words in many languages, based on many sources of data";
diff --git a/pkgs/development/tools/analysis/checkstyle/default.nix b/pkgs/development/tools/analysis/checkstyle/default.nix
index 539c2f7d1910..3367588bb3b9 100644
--- a/pkgs/development/tools/analysis/checkstyle/default.nix
+++ b/pkgs/development/tools/analysis/checkstyle/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, makeWrapper, jre }:
 
 stdenv.mkDerivation rec {
-  version = "8.31";
+  version = "8.32";
   pname = "checkstyle";
 
   src = fetchurl {
     url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-${version}/checkstyle-${version}-all.jar";
-    sha256 = "03dn07lissr2dkhi44wlkrbsby4zfvwai8gykc3xjgs46jy05rf8";
+    sha256 = "18ahdphxfcfi2vghl11kmj089hyh9iawll3cwxrqsdqak0748ijs";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/analysis/codeql/default.nix b/pkgs/development/tools/analysis/codeql/default.nix
index f722a155086f..c6b97f21bded 100644
--- a/pkgs/development/tools/analysis/codeql/default.nix
+++ b/pkgs/development/tools/analysis/codeql/default.nix
@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation rec {
   pname = "codeql";
-  version = "2.1.0";
+  version = "2.1.1";
 
   dontConfigure = true;
   dontBuild = true;
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   src = fetchzip {
     url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    sha256 = "1vp4f5kwmxc4j59cdzwj0jh0n4c05hkvssvv9ii6w88phzblzpjk";
+    sha256 = "0yaxv89p5pdj1qymc5bnz0mphrypil9dnijvp3ml9hk1vxw6lfvb";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/azcopy/default.nix b/pkgs/development/tools/azcopy/default.nix
index 328092feafc5..87e732e8dc70 100644
--- a/pkgs/development/tools/azcopy/default.nix
+++ b/pkgs/development/tools/azcopy/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "azure-storage-azcopy";
-  version = "10.3.4";
+  version = "10.4.3";
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "azure-storage-azcopy";
     rev = version;
-    sha256 = "16pdvcgy1d5dfqk3as23j45rkwfrv232n384cj5wfz9qwijkcy5g";
+    sha256 = "0yl7iznjyng1i3d994qrryllni702gga7h45sx8i3sgpy8544yjf";
   };
 
   subPackages = [ "." ];
 
-  modSha256 = "07cy2zi7m2pkbfdcy659x4k5j2w60cmjy8kxv1dcii3dc6ls4bvb";
+  modSha256 = "02c668bp1pfrd994lhg6z3hm1qg3530nk9aw1cahiwj549vxxfhm";
 
   postInstall = ''
     ln -rs "$out/bin/azure-storage-azcopy" "$out/bin/azcopy"
diff --git a/pkgs/development/tools/cmake-format/default.nix b/pkgs/development/tools/cmake-format/default.nix
index cdf15f3ad707..394dc7b2f514 100644
--- a/pkgs/development/tools/cmake-format/default.nix
+++ b/pkgs/development/tools/cmake-format/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonApplication rec {
   pname = "cmake-format";
-  version = "0.6.9";
+  version = "0.6.10";
 
   src = fetchPypi {
     inherit version;
     pname = "cmake_format";
-    sha256 = "082d7949gsk5v72ap7k4p3vgmc126a0bfm195xpi4lb6khpbzy5j";
+    sha256 = "14ypplkjah4hcb1ad8978xip4vvzxy1nkysvyi1wn9b24cbfzw42";
   };
 
   propagatedBuildInputs = [ autopep8 flake8 jinja2 pylint pyyaml ];
diff --git a/pkgs/development/tools/conftest/default.nix b/pkgs/development/tools/conftest/default.nix
index 133526c569a0..2d7c2c03cea8 100644
--- a/pkgs/development/tools/conftest/default.nix
+++ b/pkgs/development/tools/conftest/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "conftest";
-  version = "0.18.1";
+  version = "0.18.2";
 
   src = fetchFromGitHub {
     owner = "instrumenta";
     repo = "conftest";
     rev = "v${version}";
-    sha256 = "0ial1zs5aqcwza813ny6zqn9ybq6ibrqjmaccwbbam1k9f5rplqv";
+    sha256 = "15xzldcmnpfg1hd5zr5i7x2zjrgkwnp4nylxbn9kfic2dpjp1a38";
   };
 
-  modSha256 = "17j5fhgwfpyg9r7a5g9rmvkaz510xx9s4mbl1cmyzysvddc6f5wp";
+  modSha256 = "0nwmxmh1pmism5r9zzghfrzizr1fbyc8d4jljrbzjjq1l449r2ja";
 
   buildFlagsArray = ''
     -ldflags=
diff --git a/pkgs/development/tools/database/dbmate/default.nix b/pkgs/development/tools/database/dbmate/default.nix
index 14673cb40c81..c710aeaa5167 100644
--- a/pkgs/development/tools/database/dbmate/default.nix
+++ b/pkgs/development/tools/database/dbmate/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dbmate";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "amacneil";
     repo = "dbmate";
     rev = "v${version}";
-    sha256 = "0jvizj616rsh3aw9z3bijk7ixpbnqmm3xqmdxznjzqd46avr54c3";
+    sha256 = "16grd03r41n0vj5fs7j6jk395zs2q0i878p9nh1ycicy64nzmxky";
   };
 
-  modSha256 = "12x3m5bjyx3blh5i51pd99phv73m96pmm6i3ir4vf2kms3viif9i";
+  modSha256 = "1ky6cxpmw93nrk26vyrxz8kqa7247axzaxilm6ciypxf30ad0vdq";
 
   meta = with stdenv.lib; {
     description = "Database migration tool";
diff --git a/pkgs/development/tools/database/liquibase/default.nix b/pkgs/development/tools/database/liquibase/default.nix
index d66d54ef45bb..f246a0a806df 100644
--- a/pkgs/development/tools/database/liquibase/default.nix
+++ b/pkgs/development/tools/database/liquibase/default.nix
@@ -10,11 +10,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "liquibase";
-  version = "3.8.8";
+  version = "3.8.9";
 
   src = fetchurl {
     url = "https://github.com/liquibase/liquibase/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "1pl9wgnwykvbnis0ndym0lbsj6a7lvpghrc98cw2hdnp5dglxjjl";
+    sha256 = "13qpva81y98gp84zbcx6b4wsfgpsbv18aj5ihkw6l9ndbxfcrxdl";
   };
 
   buildInputs = [ jre makeWrapper ];
diff --git a/pkgs/development/tools/git-quick-stats/default.nix b/pkgs/development/tools/git-quick-stats/default.nix
index 2681b2705ef4..1532f64c2462 100644
--- a/pkgs/development/tools/git-quick-stats/default.nix
+++ b/pkgs/development/tools/git-quick-stats/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchFromGitHub }:
 stdenv.mkDerivation rec {
   pname = "git-quick-stats";
-  version = "2.0.15";
+  version = "2.0.16";
   src = fetchFromGitHub {
     repo = "git-quick-stats";
     owner = "arzzen";
     rev = version;
-    sha256 = "1m8b0bskhpwjbs0qjp0rdzrjj613639pn92isv1cg0srj8grjcai";
+    sha256 = "03v06r6gbn8bhya1ig9wdc92hh2ip7072syxkam3sjv150ld80cn";
   };
   PREFIX = builtins.placeholder "out";
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/gotestsum/default.nix b/pkgs/development/tools/gotestsum/default.nix
index 45629338d9ea..3dd7fb9e3523 100644
--- a/pkgs/development/tools/gotestsum/default.nix
+++ b/pkgs/development/tools/gotestsum/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gotestsum";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "gotestyourself";
     repo = "gotestsum";
     rev = "v${version}";
-    sha256 = "1wllcmc2c8ch2ggknhxwgdm6g70ppmxr492kbxvlbwif9p6ms0ci";
+    sha256 = "0zifha3mj7386q2accrdmd8qniingadxz1v8vg4mciwi723msr44";
   };
 
-  modSha256 = "08vil1jb7dpkld59b6qhsfh9cx450vbgfaji7777immzsd1azf4m";
+  modSha256 = "10zkk4zqla5yqs5sq2qc7x1vhadfyd1l7s29xyjmg4grs8iimk2j";
 
   buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
 
diff --git a/pkgs/development/tools/misc/ccls/default.nix b/pkgs/development/tools/misc/ccls/default.nix
index cb5653583fd7..ba57ef561f3e 100644
--- a/pkgs/development/tools/misc/ccls/default.nix
+++ b/pkgs/development/tools/misc/ccls/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ccls";
-  version = "0.20190823.5";
+  version = "0.20190823.6";
 
   src = fetchFromGitHub {
     owner = "MaskRay";
     repo = "ccls";
     rev = version;
-    sha256 = "0b2pkpzn576b92zcxpwchpkyw2fww6s69818rx4g9z34kzm35zy5";
+    sha256 = "11h5nwk4qqshf3i8yr4bxpnvmidrhkzd0zxhf1xqv8cv6r08k47f";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/tools/misc/circleci-cli/default.nix b/pkgs/development/tools/misc/circleci-cli/default.nix
index fde1c68d34d0..5b3b728ea986 100644
--- a/pkgs/development/tools/misc/circleci-cli/default.nix
+++ b/pkgs/development/tools/misc/circleci-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "circleci-cli";
-  version = "0.1.6949";
+  version = "0.1.7179";
 
   src = fetchFromGitHub {
     owner = "CircleCI-Public";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0r64m4lcm9w0rzi61rsi3sm719ydwiv5axxnikwhzmvkdz0rd7dq";
+    sha256 = "0md6y2rnzhkpxc2pm3c46jrhwicrswy9qlr6a4mmvpjq1imj1hjq";
   };
 
-  modSha256 = "199ai38knp50mjjhddjd70qfwx63c69rf7ddw4hpzgx5cm5a04q2";
+  modSha256 = "169d0mm52l6w6jln5ak6zkh97q65m9jpg3bm8qll6sfrmrnfncfi";
 
   buildFlagsArray = [ "-ldflags=-s -w -X github.com/CircleCI-Public/circleci-cli/version.Version=${version}" ];
 
diff --git a/pkgs/development/tools/misc/clojure-lsp/default.nix b/pkgs/development/tools/misc/clojure-lsp/default.nix
index cd805069df56..a29af8b60ebc 100644
--- a/pkgs/development/tools/misc/clojure-lsp/default.nix
+++ b/pkgs/development/tools/misc/clojure-lsp/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "clojure-lsp";
-  version = "20200412T033138";
+  version = "20200413T141742";
 
   src = fetchurl {
     url = "https://github.com/snoe/clojure-lsp/releases/download/release-${version}/${pname}";
-    sha256 = "19i6sikg5x5qzcbakzbiqbcy5q2srqk6ihpmb3l90n1p4jn4605c";
+    sha256 = "0bgyl791l8qaja9p22p77llis39kgdm8x1djz1dm8iy6qn22hm1y";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/tools/misc/strace/default.nix b/pkgs/development/tools/misc/strace/default.nix
index e547fef46c4c..75a960c80c50 100644
--- a/pkgs/development/tools/misc/strace/default.nix
+++ b/pkgs/development/tools/misc/strace/default.nix
@@ -14,6 +14,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = stdenv.lib.optional libunwind.supportsHost libunwind; # support -k
 
+  postPatch = "patchShebangs strace-graph";
+
   configureFlags = stdenv.lib.optional (!stdenv.hostPlatform.isx86) "--enable-mpers=check";
 
   # fails 1 out of 523 tests with
diff --git a/pkgs/development/tools/misc/sysbench/default.nix b/pkgs/development/tools/misc/sysbench/default.nix
index 10748d751595..616a1cbc3fbd 100644
--- a/pkgs/development/tools/misc/sysbench/default.nix
+++ b/pkgs/development/tools/misc/sysbench/default.nix
@@ -4,7 +4,7 @@
 
 stdenv.mkDerivation rec {
   pname = "sysbench";
-  version = "1.0.19";
+  version = "1.0.20";
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
   buildInputs = [ libmysqlclient libaio ];
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     owner = "akopytov";
     repo = pname;
     rev = version;
-    sha256 = "1zgqb9cr7ld3vw4a3jhq1mlszhcyjlpr0c8q1jcp1d27l9dcvd1w";
+    sha256 = "1sanvl2a52ff4shj62nw395zzgdgywplqvwip74ky8q7s6qjf5qy";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/tools/mod/default.nix b/pkgs/development/tools/mod/default.nix
index 3261c8af2024..5237d131af02 100644
--- a/pkgs/development/tools/mod/default.nix
+++ b/pkgs/development/tools/mod/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "mod";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "marwan-at-work";
     repo = "mod";
     rev = "v${version}";
-    sha256 = "1kcsdi9qls9kgklj96ycyrq5fsz5m2qj3ij63d2rwqjggqk0cab6";
+    sha256 = "1n0pipbq4fjban8hsxhyl5w8xrl4ai1pvgd02i1j1awmm2l3ykzl";
   };
 
-  modSha256 = "0famjypv5qg9lgzw4pz2kz70l50cn6n6nbjyk7jrzmd6bjzd0ypl";
+  modSha256 = "1nl7d00prw1663xrl1nvj1xbs7wzkbqn75i92al821pz12dybdif";
 
   subPackages = [ "cmd/mod" ];
 
diff --git a/pkgs/development/tools/packer/default.nix b/pkgs/development/tools/packer/default.nix
index d158f3bf1558..32ac95cff6a4 100644
--- a/pkgs/development/tools/packer/default.nix
+++ b/pkgs/development/tools/packer/default.nix
@@ -1,7 +1,7 @@
 { stdenv, buildGoPackage, fetchFromGitHub }:
 buildGoPackage rec {
   pname = "packer";
-  version = "1.5.5";
+  version = "1.5.6";
 
   goPackagePath = "github.com/hashicorp/packer";
 
@@ -11,7 +11,7 @@ buildGoPackage rec {
     owner = "hashicorp";
     repo = "packer";
     rev = "v${version}";
-    sha256 = "1l5n6s4fg6rgb7k845hsxgrs44y9bs2hmdxqzfbayiv8nz1qg286";
+    sha256 = "0pwygrh6pjmx8a1jc12929x0slj7w3b8p3pzswnbk7klyhj4jkp8";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/rust/cargo-udeps/default.nix b/pkgs/development/tools/rust/cargo-udeps/default.nix
index ca347ca22dee..a6089ffeac2d 100644
--- a/pkgs/development/tools/rust/cargo-udeps/default.nix
+++ b/pkgs/development/tools/rust/cargo-udeps/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-udeps";
-  version = "0.1.10";
+  version = "0.1.11";
 
   src = fetchFromGitHub {
     owner = "est31";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1xmlpn4j5lhbzd9icb3nga5irfknmxfml9sn677d9z6fwfjfpa0l";
+    sha256 = "1drz0slv33p4spm52sb5lnmpb83q8l7k3cvp0zcsinbjv8glvvnv";
   };
 
-  cargoSha256 = "1si95pdhbi6pa94gh9vip95n37im6kcfsgslpnibck2157pg4la6";
+  cargoSha256 = "13ynab3s563n2xwkls7nmksis0ngx5klw9wc9bpnxgc5na9k84ll";
 
   nativeBuildInputs = [ pkgconfig ];
 
diff --git a/pkgs/development/tools/rust/cargo-xbuild/default.nix b/pkgs/development/tools/rust/cargo-xbuild/default.nix
index 4ae2b55f015f..6af944e9c5d6 100644
--- a/pkgs/development/tools/rust/cargo-xbuild/default.nix
+++ b/pkgs/development/tools/rust/cargo-xbuild/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-xbuild";
-  version = "0.5.28";
+  version = "0.5.29";
 
   src = fetchFromGitHub {
     owner = "rust-osdev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1rczflf6fllxkag5nah195shwqvqmlna9a1gkcwp9ljlgxlr9zvq";
+    sha256 = "05wg1xx2mcwb9cplmrpg13jimddlzmv7hf5g3vjppjp8kz2gb7zj";
   };
 
-  cargoSha256 = "0xr8wpcw3x0343hm6clygsbikhrp6gcqb8vh7g7h9nijjrbnzxxb";
+  cargoSha256 = "1s2xsfld29shvjzyp16y263hnbqxrq8i2557y0g09xmfm5x0jhix";
 
   meta = with stdenv.lib; {
     description = "Automatically cross-compiles the sysroot crates core, compiler_builtins, and alloc";
diff --git a/pkgs/development/tools/rust/cbindgen/default.nix b/pkgs/development/tools/rust/cbindgen/default.nix
index 87e8e081a931..bc0ae5d33fe2 100644
--- a/pkgs/development/tools/rust/cbindgen/default.nix
+++ b/pkgs/development/tools/rust/cbindgen/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-cbindgen";
-  version = "0.13.2";
+  version = "0.14.2";
 
   src = fetchFromGitHub {
     owner = "eqrion";
     repo = "cbindgen";
     rev = "v${version}";
-    sha256 = "100ls8p8w6jwcjh3ligly5alg8fzp21aj7b1qbndn9fm0y1nmjam";
+    sha256 = "15mk7q89rs723c7i9wwq4rrvakwh834wvrsmsnayji5k1kwaj351";
   };
 
-  cargoSha256 = "0d9sz46yzh01dx973q10xzw4k7r7ylvg82s5pkp3zpwcin8smaiw";
+  cargoSha256 = "03irndd48ck62chm4vmlcnfm98gwd86xm1ssq9glw3b3y0n6x845";
 
   buildInputs = stdenv.lib.optional stdenv.isDarwin Security;
 
diff --git a/pkgs/development/tools/wasm-bindgen-cli/0001-Add-cargo.lock.patch b/pkgs/development/tools/wasm-bindgen-cli/0001-Add-cargo.lock.patch
index b4fa5a8353cd..86fbb81de054 100644
--- a/pkgs/development/tools/wasm-bindgen-cli/0001-Add-cargo.lock.patch
+++ b/pkgs/development/tools/wasm-bindgen-cli/0001-Add-cargo.lock.patch
@@ -1,6 +1,6 @@
-From b0d7b8b348adba8131b12f99be7a9a30a1cca867 Mon Sep 17 00:00:00 2001
+From a13aff157f899a6388b3c9e621680049f329a028 Mon Sep 17 00:00:00 2001
 From: Maximilian Bosch <maximilian@mbosch.me>
-Date: Thu, 30 Apr 2020 00:24:57 +0200
+Date: Fri, 1 May 2020 23:44:08 +0200
 Subject: [PATCH] Add cargo.lock
 
 ---
@@ -10,7 +10,7 @@ Subject: [PATCH] Add cargo.lock
 
 diff --git a/Cargo.lock b/Cargo.lock
 new file mode 100644
-index 00000000..8ae15438
+index 00000000..4822cea1
 --- /dev/null
 +++ b/Cargo.lock
 @@ -0,0 +1,2527 @@
@@ -605,7 +605,7 @@ index 00000000..8ae15438
 +dependencies = [
 + "proc-macro-hack",
 + "proc-macro2 1.0.10",
-+ "quote 1.0.3",
++ "quote 1.0.4",
 + "syn 1.0.18",
 +]
 +
@@ -782,7 +782,7 @@ index 00000000..8ae15438
 +
 +[[package]]
 +name = "js-sys"
-+version = "0.3.38"
++version = "0.3.39"
 +dependencies = [
 + "wasm-bindgen",
 + "wasm-bindgen-futures",
@@ -1173,7 +1173,7 @@ index 00000000..8ae15438
 +dependencies = [
 + "proc-macro-error-attr",
 + "proc-macro2 1.0.10",
-+ "quote 1.0.3",
++ "quote 1.0.4",
 + "syn 1.0.18",
 + "version_check 0.9.1",
 +]
@@ -1185,7 +1185,7 @@ index 00000000..8ae15438
 +checksum = "4f5444ead4e9935abd7f27dc51f7e852a0569ac888096d5ec2499470794e2e53"
 +dependencies = [
 + "proc-macro2 1.0.10",
-+ "quote 1.0.3",
++ "quote 1.0.4",
 + "syn 1.0.18",
 + "syn-mid",
 + "version_check 0.9.1",
@@ -1238,9 +1238,9 @@ index 00000000..8ae15438
 +
 +[[package]]
 +name = "quote"
-+version = "1.0.3"
++version = "1.0.4"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "2bdc6c187c65bca4260c9011c9e3132efe4909da44726bad24cf7572ae338d7f"
++checksum = "4c1f4b0efa5fc5e8ceb705136bfee52cfdb6a4e3509f770b478cd6ed434232a7"
 +dependencies = [
 + "proc-macro2 1.0.10",
 +]
@@ -1642,7 +1642,7 @@ index 00000000..8ae15438
 +checksum = "9e549e3abf4fb8621bd1609f11dfc9f5e50320802273b12f3811a67e6716ea6c"
 +dependencies = [
 + "proc-macro2 1.0.10",
-+ "quote 1.0.3",
++ "quote 1.0.4",
 + "syn 1.0.18",
 +]
 +
@@ -1731,7 +1731,7 @@ index 00000000..8ae15438
 + "heck",
 + "proc-macro-error",
 + "proc-macro2 1.0.10",
-+ "quote 1.0.3",
++ "quote 1.0.4",
 + "syn 1.0.18",
 +]
 +
@@ -1753,7 +1753,7 @@ index 00000000..8ae15438
 +checksum = "410a7488c0a728c7ceb4ad59b9567eb4053d02e8cc7f5c0e0eeeb39518369213"
 +dependencies = [
 + "proc-macro2 1.0.10",
-+ "quote 1.0.3",
++ "quote 1.0.4",
 + "unicode-xid 0.2.0",
 +]
 +
@@ -1764,7 +1764,7 @@ index 00000000..8ae15438
 +checksum = "7be3539f6c128a931cf19dcee741c1af532c7fd387baa739c03dd2e96479338a"
 +dependencies = [
 + "proc-macro2 1.0.10",
-+ "quote 1.0.3",
++ "quote 1.0.4",
 + "syn 1.0.18",
 +]
 +
@@ -2038,7 +2038,7 @@ index 00000000..8ae15438
 +dependencies = [
 + "heck",
 + "proc-macro2 1.0.10",
-+ "quote 1.0.3",
++ "quote 1.0.4",
 + "syn 1.0.18",
 +]
 +
@@ -2050,7 +2050,7 @@ index 00000000..8ae15438
 +
 +[[package]]
 +name = "wasm-bindgen"
-+version = "0.2.61"
++version = "0.2.62"
 +dependencies = [
 + "cfg-if",
 + "js-sys",
@@ -2066,7 +2066,7 @@ index 00000000..8ae15438
 +
 +[[package]]
 +name = "wasm-bindgen-anyref-xform"
-+version = "0.2.61"
++version = "0.2.62"
 +dependencies = [
 + "anyhow",
 + "rayon",
@@ -2078,13 +2078,13 @@ index 00000000..8ae15438
 +
 +[[package]]
 +name = "wasm-bindgen-backend"
-+version = "0.2.61"
++version = "0.2.62"
 +dependencies = [
 + "bumpalo",
 + "lazy_static",
 + "log 0.4.8",
 + "proc-macro2 1.0.10",
-+ "quote 1.0.3",
++ "quote 1.0.4",
 + "syn 1.0.18",
 + "wasm-bindgen-shared",
 +]
@@ -2099,7 +2099,7 @@ index 00000000..8ae15438
 +
 +[[package]]
 +name = "wasm-bindgen-cli"
-+version = "0.2.61"
++version = "0.2.62"
 +dependencies = [
 + "anyhow",
 + "assert_cmd",
@@ -2127,7 +2127,7 @@ index 00000000..8ae15438
 +
 +[[package]]
 +name = "wasm-bindgen-cli-support"
-+version = "0.2.61"
++version = "0.2.62"
 +dependencies = [
 + "anyhow",
 + "base64 0.9.3",
@@ -2149,7 +2149,7 @@ index 00000000..8ae15438
 +
 +[[package]]
 +name = "wasm-bindgen-futures"
-+version = "0.4.11"
++version = "0.4.12"
 +dependencies = [
 + "cfg-if",
 + "futures-channel-preview",
@@ -2161,9 +2161,9 @@ index 00000000..8ae15438
 +
 +[[package]]
 +name = "wasm-bindgen-macro"
-+version = "0.2.61"
++version = "0.2.62"
 +dependencies = [
-+ "quote 1.0.3",
++ "quote 1.0.4",
 + "trybuild",
 + "wasm-bindgen",
 + "wasm-bindgen-futures",
@@ -2172,10 +2172,10 @@ index 00000000..8ae15438
 +
 +[[package]]
 +name = "wasm-bindgen-macro-support"
-+version = "0.2.61"
++version = "0.2.62"
 +dependencies = [
 + "proc-macro2 1.0.10",
-+ "quote 1.0.3",
++ "quote 1.0.4",
 + "syn 1.0.18",
 + "wasm-bindgen-backend",
 + "wasm-bindgen-shared",
@@ -2183,7 +2183,7 @@ index 00000000..8ae15438
 +
 +[[package]]
 +name = "wasm-bindgen-multi-value-xform"
-+version = "0.2.61"
++version = "0.2.62"
 +dependencies = [
 + "anyhow",
 + "rayon",
@@ -2204,11 +2204,11 @@ index 00000000..8ae15438
 +
 +[[package]]
 +name = "wasm-bindgen-shared"
-+version = "0.2.61"
++version = "0.2.62"
 +
 +[[package]]
 +name = "wasm-bindgen-test"
-+version = "0.3.11"
++version = "0.3.12"
 +dependencies = [
 + "console_error_panic_hook",
 + "js-sys",
@@ -2234,15 +2234,15 @@ index 00000000..8ae15438
 +
 +[[package]]
 +name = "wasm-bindgen-test-macro"
-+version = "0.3.11"
++version = "0.3.12"
 +dependencies = [
 + "proc-macro2 1.0.10",
-+ "quote 1.0.3",
++ "quote 1.0.4",
 +]
 +
 +[[package]]
 +name = "wasm-bindgen-threads-xform"
-+version = "0.2.61"
++version = "0.2.62"
 +dependencies = [
 + "anyhow",
 + "walrus",
@@ -2251,7 +2251,7 @@ index 00000000..8ae15438
 +
 +[[package]]
 +name = "wasm-bindgen-wasm-conventions"
-+version = "0.2.61"
++version = "0.2.62"
 +dependencies = [
 + "anyhow",
 + "walrus",
@@ -2259,7 +2259,7 @@ index 00000000..8ae15438
 +
 +[[package]]
 +name = "wasm-bindgen-wasm-interpreter"
-+version = "0.2.61"
++version = "0.2.62"
 +dependencies = [
 + "anyhow",
 + "log 0.4.8",
@@ -2270,7 +2270,7 @@ index 00000000..8ae15438
 +
 +[[package]]
 +name = "wasm-bindgen-webidl"
-+version = "0.2.61"
++version = "0.2.62"
 +dependencies = [
 + "anyhow",
 + "env_logger",
@@ -2278,7 +2278,7 @@ index 00000000..8ae15438
 + "lazy_static",
 + "log 0.4.8",
 + "proc-macro2 1.0.10",
-+ "quote 1.0.3",
++ "quote 1.0.4",
 + "sourcefile",
 + "structopt",
 + "syn 1.0.18",
@@ -2353,7 +2353,7 @@ index 00000000..8ae15438
 +
 +[[package]]
 +name = "web-sys"
-+version = "0.3.38"
++version = "0.3.39"
 +dependencies = [
 + "js-sys",
 + "wasm-bindgen",
diff --git a/pkgs/development/tools/wasm-bindgen-cli/default.nix b/pkgs/development/tools/wasm-bindgen-cli/default.nix
index 0385ba79d7fc..9adabeb573fd 100644
--- a/pkgs/development/tools/wasm-bindgen-cli/default.nix
+++ b/pkgs/development/tools/wasm-bindgen-cli/default.nix
@@ -2,19 +2,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasm-bindgen-cli";
-  version = "0.2.61";
+  version = "0.2.62";
 
   src = fetchFromGitHub {
     owner = "rustwasm";
     repo = "wasm-bindgen";
     rev = version;
-    sha256 = "1lz4yscs17vix96isqpwwjhjcgj46zh2ljiwvfsk44wky8vwkyb7";
+    sha256 = "0d3ph3g220nvzwxa71rch03j5c0w06v8z4lmlyp5kky6p86r37hz";
   };
 
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security curl ];
   nativeBuildInputs = [ pkgconfig ];
 
-  cargoSha256 = "1vblvajhx5gn08rinv6bnw61zah62il015rzm0d4vs2b9p0iaann";
+  cargoSha256 = "13lj2yx2bcwac1b4gpwcgiwqvy178zis6r1pidn4pgwqv7zxa7p2";
   cargoPatches = [ ./0001-Add-cargo.lock.patch ];
   cargoBuildFlags = [ "-p" pname ];
 
diff --git a/pkgs/development/web/flyctl/default.nix b/pkgs/development/web/flyctl/default.nix
index 965a53dcdbda..22da8cd75189 100644
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.0.110";
+  version = "0.0.117";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    sha256 = "1fvvanyzrai41fq98msjwzgwsidxbaly6f6knma6lwmicv4f9svg";
+    sha256 = "0i9azvhlwp5g699yagfbd5rnsr5kdnbw6lsz28nz1dzvmrj9xp7w";
   };
 
   preBuild = ''
@@ -20,7 +20,7 @@ buildGoModule rec {
     rm $out/bin/helpgen
   '';
 
-  modSha256 = "0lnk2g5msqhhshh99s32sqd793rdlzmp7vhqdb1fd6qafrrrxm5w";
+  modSha256 = "0d0hfmdk81apha3r7zspam8wqadpy6qmqkgbq0sbiwrji4155hrh";
 
   meta = with lib; {
     description = "Command line tools for fly.io services";
diff --git a/pkgs/games/dwarf-fortress/df_permission b/pkgs/games/dwarf-fortress/df_permission
index b0121bb3fa37..dc1c0c151e0b 100644
--- a/pkgs/games/dwarf-fortress/df_permission
+++ b/pkgs/games/dwarf-fortress/df_permission
@@ -12,7 +12,7 @@ Tarn
 On Fri, Oct 29, 2010 at 6:56 AM,  <roconnor@theorem.ca> wrote:
 > I'd like to distribute a *slightly* modified version of Dwarf Fortress which
 > is needed to run it under the NixOS distribution of Linux (see
-> <http://nixos.org/>
+> <https://nixos.org/>
 >
 > Modification: The interpreter location /lib/ld-linux.so.2 in
 > lib/Dwarf_Fortress is replaced with the location of ld-linux.so.2 under the
diff --git a/pkgs/games/endless-sky/default.nix b/pkgs/games/endless-sky/default.nix
index f0950cf4d349..76ab6542a7f3 100644
--- a/pkgs/games/endless-sky/default.nix
+++ b/pkgs/games/endless-sky/default.nix
@@ -3,7 +3,7 @@
 }:
 
 let
-  version = "0.9.11";
+  version = "0.9.12";
 
 in
 stdenv.mkDerivation {
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
     owner = "endless-sky";
     repo = "endless-sky";
     rev = "v${version}";
-    sha256 = "0f4svg448bg8qx49f8fr8l4yzks7an6673jwgva15p3zzfxy6w03";
+    sha256 = "1hly68ljm7yv01jfxyr7g6jivhj0igg6xx7vi92zqymick0hlh7a";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/games/ezquake/default.nix b/pkgs/games/ezquake/default.nix
index 86db4a3209e8..83dadb7192cb 100644
--- a/pkgs/games/ezquake/default.nix
+++ b/pkgs/games/ezquake/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ezquake";
-  version = "3.1";
+  version = "3.2";
 
   src = fetchFromGitHub {
     owner = "ezQuake";
     repo = pname + "-source";
     rev = version;
-    sha256 = "0375jndynhkl59m80fhmq12v5g24zy16c7ly08h004cmjzqsikn4";
+    sha256 = "11kyrqpc8w393kvfz2p2h2m7k8rm4w644m86w733b8w157f2fsk0";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/games/hyperrogue/default.nix b/pkgs/games/hyperrogue/default.nix
index 24ea0e8c5c0a..1ef0fd147d87 100644
--- a/pkgs/games/hyperrogue/default.nix
+++ b/pkgs/games/hyperrogue/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hyperrogue";
-  version = "11.3f";
+  version = "11.3l";
 
   src = fetchFromGitHub {
     owner = "zenorogue";
     repo = "hyperrogue";
     rev = "v${version}";
-    sha256 = "0i6dksxx33xga4pq41qsfllqras1hzk14ffqhnk11aj5lrfg98rm";
+    sha256 = "0fniyaf9mgg99s03wbdc36zg909kshpdfk9pn8pkai0x99lghkwb";
   };
 
   CPPFLAGS = "-I${SDL.dev}/include/SDL";
diff --git a/pkgs/misc/apulse/default.nix b/pkgs/misc/apulse/default.nix
index 273e358184d3..33ba0bf86761 100644
--- a/pkgs/misc/apulse/default.nix
+++ b/pkgs/misc/apulse/default.nix
@@ -5,13 +5,13 @@ let oz = x: if x then "1" else "0"; in
 
 stdenv.mkDerivation rec {
   pname = "apulse";
-  version = "0.1.12";
+  version = "0.1.13";
 
   src = fetchFromGitHub {
     owner = "i-rinat";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0yk9vgb4aws8xnkhdhgpxp5c0rri8yq61yxk85j99j8ax806i3r8";
+    sha256 = "1p6fh6ah5v3qz7dxhcsixx38bxg44ypbim4m03bxk3ls5i9xslmn";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/os-specific/darwin/skhd/default.nix b/pkgs/os-specific/darwin/skhd/default.nix
index f4a9991f8ee2..d145c0d75d09 100644
--- a/pkgs/os-specific/darwin/skhd/default.nix
+++ b/pkgs/os-specific/darwin/skhd/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "skhd";
-  version = "0.3.0";
+  version = "0.3.5";
 
   src = fetchFromGitHub {
     owner = "koekeishiya";
-    repo = "skhd";
+    repo = pname;
     rev = "v${version}";
-    sha256 = "13pqnassmzppy2ipv995rh8lzw9rraxvi0ph6zgy63cbsdfzbhgl";
+    sha256 = "0x099979kgpim18r0vi9vd821qnv0rl3rkj0nd1nx3wljxgf7mrg";
   };
 
   buildInputs = [ Carbon ];
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     description = "Simple hotkey daemon for macOS";
     homepage = "https://github.com/koekeishiya/skhd";
     platforms = platforms.darwin;
-    maintainers = with maintainers; [ lnl7 periklis ];
+    maintainers = with maintainers; [ cmacrae lnl7 periklis ];
     license = licenses.mit;
   };
 }
diff --git a/pkgs/os-specific/darwin/yabai/default.nix b/pkgs/os-specific/darwin/yabai/default.nix
index aa10a3a20f74..7103c7825ccc 100644
--- a/pkgs/os-specific/darwin/yabai/default.nix
+++ b/pkgs/os-specific/darwin/yabai/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "yabai";
-  version = "2.4.3";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "koekeishiya";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1a6pqms5kwdsvr9vcshfa000xf2f5a2qbp5qapx0b3wzclnchjbn";
+    sha256 = "0ajsh85p2vx18h3s4nicasyhdbh82zg97b1ryhi6l5lkbjpdl4ah";
   };
 
   buildInputs = [ Carbon Cocoa ScriptingBridge ];
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     description = ''
       A tiling window manager for macOS based on binary space partitioning
     '';
-    homepage = https://github.com/koekeishiya/yabai;
+    homepage = "https://github.com/koekeishiya/yabai";
     platforms = platforms.darwin;
     maintainers = [ maintainers.cmacrae ];
     license = licenses.mit;
diff --git a/pkgs/os-specific/linux/bcc/default.nix b/pkgs/os-specific/linux/bcc/default.nix
index 79e32a05f463..7f95ef47ee9c 100644
--- a/pkgs/os-specific/linux/bcc/default.nix
+++ b/pkgs/os-specific/linux/bcc/default.nix
@@ -5,11 +5,11 @@
 
 python.pkgs.buildPythonApplication rec {
   pname = "bcc";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchurl {
     url = "https://github.com/iovisor/bcc/releases/download/v${version}/bcc-src-with-submodule.tar.gz";
-    sha256 = "15xpwf17x2j1c1wcb84cgfs35dp5w0rjd9mllmddmdjvn303wffx";
+    sha256 = "1hw02bib06fjyw61as5pmhf0qxy0wv0nw8fff2i8a9d1zcd8xf3p";
   };
   format = "other";
 
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 0a58ed87e6ce..e254891b0017 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -609,6 +609,9 @@ let
 
     misc = {
       HID_BATTERY_STRENGTH = yes;
+      # enabled by default in x86_64 but not arm64, so we do that here
+      HIDRAW               = yes;
+
       MODULE_COMPRESS    = yes;
       MODULE_COMPRESS_XZ = yes;
       KERNEL_XZ          = yes;
diff --git a/pkgs/os-specific/linux/kernel/hardened-patches.json b/pkgs/os-specific/linux/kernel/hardened-patches.json
index aa0650138cce..d2f6f4b3e83e 100644
--- a/pkgs/os-specific/linux/kernel/hardened-patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened-patches.json
@@ -1,18 +1,18 @@
 {
     "4.14": {
-        "name": "linux-hardened-4.14.177.a.patch",
-        "sha256": "0wiapq4nj16m5ywnz0k7k0fr5hpw2gjy68mjlk6x866rf8vhndrq",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.177.a/linux-hardened-4.14.177.a.patch"
+        "name": "linux-hardened-4.14.178.a.patch",
+        "sha256": "1klwymsd19y2sifbny5ikgry9rx9q2cbb13h1xqy42573add6q8c",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.178.a/linux-hardened-4.14.178.a.patch"
     },
     "4.19": {
-        "name": "linux-hardened-4.19.119.a.patch",
-        "sha256": "1arm4833lkgsd27fhgrxbdxisvn20fsk6250x5yh6c8svjr759jx",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.119.a/linux-hardened-4.19.119.a.patch"
+        "name": "linux-hardened-4.19.120.a.patch",
+        "sha256": "14l30127nd8d2q72k51alwmh8h57fyam0q6sggdljh16qlqilirl",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.120.a/linux-hardened-4.19.120.a.patch"
     },
     "5.4": {
-        "name": "linux-hardened-5.4.36.a.patch",
-        "sha256": "00bmpzrma0nrgwwari6072g11cwhdk2riqmphlnkpxbarh7dwf4z",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.36.a/linux-hardened-5.4.36.a.patch"
+        "name": "linux-hardened-5.4.38.a.patch",
+        "sha256": "1aaky36azfagk0nf5k92glil3f7ymijcvx03g8rnlinlsm3i2614",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.38.a/linux-hardened-5.4.38.a.patch"
     },
     "5.5": {
         "name": "linux-hardened-5.5.19.a.patch",
@@ -20,8 +20,8 @@
         "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.5.19.a/linux-hardened-5.5.19.a.patch"
     },
     "5.6": {
-        "name": "linux-hardened-5.6.8.a.patch",
-        "sha256": "06nrjv1v3m3phgcahpmf228jcgr496n9rlvvmbklc307q6w0g8f6",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.6.8.a/linux-hardened-5.6.8.a.patch"
+        "name": "linux-hardened-5.6.10.a.patch",
+        "sha256": "0jmyk7pl9ddbyhskzadd1z9svhm18v8gdv6kgb0ca6dbhf6ggsgy",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.6.10.a/linux-hardened-5.6.10.a.patch"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 6c5d86a0e69e..013893c1cddb 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.177";
+  version = "4.14.178";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "04hq0i06mg2yc09jj2xk0vhf5q9yigzjzm55a5bvfy2a6j43r9rk";
+    sha256 = "1pcqxmq9ir4f963aiw5bab9w2mp4vfiwaq2bk7nksbl2bs3k6b7x";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index b3073ac17794..4edc8359c51e 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.19.119";
+  version = "4.19.120";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1klvdzz8sndg2zsr1anfy9p5fc1aapjqvc249myrbndyf55bk91b";
+    sha256 = "03mjng5ws9y56id99619ysarz73qqyylgc3mlknga1yphbhh16qb";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index d846a015477f..09b34e26a476 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.220";
+  version = "4.4.221";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1knj3qsl7x3fysdz1h0s980ddbafs3658z2y67w6sn79wp7d8blg";
+    sha256 = "06rpjnvrdp71flz948mfmx7jv8x2vmdg54zz1xpkb2458mwh5hbq";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index b05a3685c276..0db1d2908e32 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.220";
+  version = "4.9.221";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0bhbkybzbdsbmrjmb5m7hxxl8b3v6n79zhh86cbr95kzg1hcgnfs";
+    sha256 = "1gh1x73xblxkb927igc3shrqnn49lcscwrq2fixmk9n7jb7q2hp6";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index 2672a239e3bb..31d485877b76 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.4.36";
+  version = "5.4.38";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "13avfvimjyg4lhj9micgib9bb5qpx11cja5liypid0rf2acfmymr";
+    sha256 = "03pks3jx5kk0wnhjkm92wxdbgw8qbdg93sfwchnx88m2wfj9yaz7";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.6.nix b/pkgs/os-specific/linux/kernel/linux-5.6.nix
index c5bd84abf168..eb60cfd94972 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.6.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.6.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.6.8";
+  version = "5.6.10";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1pw2q9509jzp84b6qasaais2ws25v2wrjh072q0x3j520zzl5q8r";
+    sha256 = "1f81b0icn0r9gww95rckyxs5d4g8bwf4mmqkrmwxxf4xga19dp3v";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 05617f869174..8b5f1e58d142 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.7-rc3";
+  version = "5.7-rc4";
   extraMeta.branch = "5.7";
 
   # modDirVersion needs to be x.y.z, will always add .0
@@ -11,7 +11,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "0gq4bdzz2px85l3fa9dq3jh3lp4c9kgph4njq6yxf9g3h0ifq7c6";
+    sha256 = "1mnknjiax24iaj9n5k0s55vp6fvmb40s931qxj24v5p1lc5fznvb";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/os-specific/linux/setools/default.nix b/pkgs/os-specific/linux/setools/default.nix
index ae632c072cb3..c0ed4102aaf1 100644
--- a/pkgs/os-specific/linux/setools/default.nix
+++ b/pkgs/os-specific/linux/setools/default.nix
@@ -8,13 +8,13 @@ with python3.pkgs;
 
 buildPythonApplication rec {
   pname = "setools";
-  version = "4.2.2";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "SELinuxProject";
     repo = pname;
     rev = version;
-    sha256 = "18kklv26dwm2fdjjzfflvxsq83b2svnwf4g18xq7wsfsri121a90";
+    sha256 = "0vr20bi8w147z5lclqz1l0j1b34137zg2r04pkafkgqqk7qbyjk6";
   };
 
   nativeBuildInputs = [ cython ];
diff --git a/pkgs/os-specific/linux/syslinux/default.nix b/pkgs/os-specific/linux/syslinux/default.nix
index 94df0649ad4a..06b31302eb8e 100644
--- a/pkgs/os-specific/linux/syslinux/default.nix
+++ b/pkgs/os-specific/linux/syslinux/default.nix
@@ -1,14 +1,16 @@
-{ stdenv, fetchFromRepoOrCz, fetchurl, nasm, perl, python3, libuuid, mtools, makeWrapper }:
+{ stdenv, fetchgit, fetchurl, fetchpatch, nasm, perl, python3, libuuid, mtools, makeWrapper }:
 
 stdenv.mkDerivation {
-  name = "syslinux-2019-02-07";
+  pname = "syslinux";
+  version = "unstable-20190207";
 
   # This is syslinux-6.04-pre3^1; syslinux-6.04-pre3 fails to run.
   # Same issue here https://www.syslinux.org/archives/2019-February/026330.html
-  src = fetchFromRepoOrCz {
-    repo = "syslinux";
+  src = fetchgit {
+    url = "https://repo.or.cz/syslinux";
     rev = "b40487005223a78c3bb4c300ef6c436b3f6ec1f7";
-    sha256 = "1qrxl1114sr2i2791z9rf8v53g200aq30f08808d7i8qnmgvxl2w";
+    sha256 = "1acf6byx7i6vz8hq6mra526g8mf7fmfhid211y8nq0v6px7d3aqs";
+    fetchSubmodules = true;
   };
 
   patches = let
@@ -20,9 +22,9 @@ stdenv.mkDerivation {
       url = mkURL "fa1349f1" "0002-gfxboot-menu-label.patch";
       sha256 = "06ifgzbpjj4picpj17zgprsfi501zf4pp85qjjgn29i5rs291zni";
     })
-    (fetchurl {
-      url = mkURL "477e56d2" "0005-gnu-efi-version-compatibility.patch";
-      sha256 = "041568b4abb79wynyps1n04lg4fr26rc3sbjncz99pp0mbz0ajlm";
+    (fetchpatch {
+      url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/0005-gnu-efi-version-compatibility.patch?h=packages/syslinux";
+      sha256 = "0fbqz56hj8az8ws26m39hyp3l5fvcbzvzdddqz3x6n56hzdpz1p6";
     })
     (fetchurl {
       # mbr.bin: too big (452 > 440)
@@ -48,6 +50,10 @@ stdenv.mkDerivation {
     # fix tests
     substituteInPlace tests/unittest/include/unittest/unittest.h \
       --replace /usr/include/ ""
+
+    # Hack to get `gcc -m32' to work without having 32-bit Glibc headers.
+    mkdir gnu-efi/inc/ia32/gnu
+    touch gnu-efi/inc/ia32/gnu/stubs-32.h
   '';
 
   nativeBuildInputs = [ nasm perl python3 ];
@@ -61,12 +67,9 @@ stdenv.mkDerivation {
   makeFlags = [
     "BINDIR=$(out)/bin"
     "SBINDIR=$(out)/sbin"
-    "LIBDIR=$(out)/lib"
-    "INCDIR=$(out)/include"
     "DATADIR=$(out)/share"
     "MANDIR=$(out)/share/man"
     "PERL=perl"
-    "bios"
   ];
 
   doCheck = false; # fails. some fail in a sandbox, others require qemu
diff --git a/pkgs/os-specific/linux/wireguard/default.nix b/pkgs/os-specific/linux/wireguard/default.nix
index 8c3f489753df..63487733605a 100644
--- a/pkgs/os-specific/linux/wireguard/default.nix
+++ b/pkgs/os-specific/linux/wireguard/default.nix
@@ -7,11 +7,11 @@ assert stdenv.lib.versionOlder kernel.version "5.6";
 
 stdenv.mkDerivation rec {
   pname = "wireguard";
-  version = "1.0.20200426";
+  version = "1.0.20200429";
 
   src = fetchzip {
     url = "https://git.zx2c4.com/wireguard-linux-compat/snapshot/wireguard-linux-compat-${version}.tar.xz";
-    sha256 = "0j343xk9qgmzn0j6kgvydfqjqslf2rv6r4ikfc59982xxny6f6l5";
+    sha256 = "161srq06qa6ag2lycqz19mfms4ha2pmwn778jhvi96729rmivjkd";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/servers/caddy/v2.nix b/pkgs/servers/caddy/v2.nix
index 35c1f497850a..599e2e8c9066 100644
--- a/pkgs/servers/caddy/v2.nix
+++ b/pkgs/servers/caddy/v2.nix
@@ -1,10 +1,8 @@
-{ stdenv, callPackage, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "caddy";
-  version = "2.0.0-rc.1";
-
-  goPackagePath = "github.com/caddyserver/caddy";
+  version = "2.0.0-rc.3";
 
   subPackages = [ "cmd/caddy" ];
 
@@ -12,9 +10,10 @@ buildGoModule rec {
     owner = "caddyserver";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0ir394nmdrqvslghqky4d2py65ff77fqsp0nmxdlsdps49szwh7h";
+    sha256 = "1jsjh8q5wsnp7j7r1rlnw0w4alihpcmpmlpqncmhik10f6v7xm3y";
   };
-  modSha256 = "0sqnw81l73gssnpd4dsl3vd10584riq0417z4dvbhjnc8b3z4xwv";
+
+  modSha256 = "0n0k0w9y2z87z6m6j3sxsgqn9sm82rdcqpdck236fxj23k4akyp6";
 
   meta = with stdenv.lib; {
     homepage = "https://caddyserver.com";
diff --git a/pkgs/servers/coturn/default.nix b/pkgs/servers/coturn/default.nix
index 51502c3fd97f..f50a5afa81e7 100644
--- a/pkgs/servers/coturn/default.nix
+++ b/pkgs/servers/coturn/default.nix
@@ -2,24 +2,19 @@
 
 stdenv.mkDerivation rec {
   pname = "coturn";
-  version = "4.5.1.1";
+  version = "4.5.1.2";
 
   src = fetchFromGitHub {
     owner = "coturn";
     repo = "coturn";
     rev = version;
-    sha256 = "12x604lgva1d3g4wvl3f66rdj6lkjk5cqr0l3xas33xgzgm13pwr";
+    sha256 = "01y65az8qyv2kjnb4fj7rgl4zq5pc2b286gfn727x3hfhksx9zp2";
   };
 
   buildInputs = [ openssl libevent ];
 
   patches = [
     ./pure-configure.patch
-    (fetchpatch {
-      name = "CVE-2020-6061+6062.patch";
-      url = "https://sources.debian.org/data/main/c/coturn/4.5.1.1-1.2/debian/patches/CVE-2020-6061+6062.patch";
-      sha256 = "0fcy1wp91bb4hlhnp96sf9bs0d9hf3pwx5f7b1r9cfvr3l5c1bk2";
-    })
   ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/servers/http/jetty/default.nix b/pkgs/servers/http/jetty/default.nix
index 4a3a3f2da016..49c11bf462e6 100644
--- a/pkgs/servers/http/jetty/default.nix
+++ b/pkgs/servers/http/jetty/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "jetty";
-  version = "9.4.25.v20191220";
+  version = "9.4.26.v20200117";
   src = fetchurl {
     url = "https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-distribution/${version}/jetty-distribution-${version}.tar.gz";
     name = "jetty-distribution-${version}.tar.gz";
-    sha256 = "1jnx4hnvd2krsdisqwpws1qd1r0f8gm9a4sx4a8c7zqrmfd2zx1a";
+    sha256 = "0wgh7vap0h6gkz6pk8iycvhwmybyxv25ssinwxxrnzk8jg25g89i";
   };
 
   phases = [ "unpackPhase" "installPhase" ];
diff --git a/pkgs/servers/imgproxy/default.nix b/pkgs/servers/imgproxy/default.nix
index faaad1ac7a71..21caebec0f37 100644
--- a/pkgs/servers/imgproxy/default.nix
+++ b/pkgs/servers/imgproxy/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "imgproxy";
-  version = "2.11.0";
+  version = "2.13.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    sha256 = "1n91snf5sxsiy2r8y2nksw4ah70f70nxamy7k0ylgkpfxp4dxwb8";
+    sha256 = "0lzk9nv7fbyc0jbsigw54310pvpwfrvji58z7a08j03vypc0v3x4";
     rev = "v${version}";
   };
 
-  modSha256 = "1fm3s1ksah0w86xv8xjhrbf5ia0ynfg2qgajnldy3dpdbxa3yh7s";
+  modSha256 = "02pj8ryis89dl4wjp2mvx6h5d0xdvskxdxiwarg7q0x23m9r7kpg";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/servers/jellyfin/default.nix b/pkgs/servers/jellyfin/default.nix
index 932081ad22fe..35476db92152 100644
--- a/pkgs/servers/jellyfin/default.nix
+++ b/pkgs/servers/jellyfin/default.nix
@@ -18,12 +18,12 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "jellyfin";
-  version = "10.5.4";
+  version = "10.5.5";
 
   # Impossible to build anything offline with dotnet
   src = fetchurl {
     url = "https://github.com/jellyfin/jellyfin/releases/download/v${version}/jellyfin_${version}_portable.tar.gz";
-    sha256 = "0jfqkbr5n5l7k3dpmjsy0bhvy4y1s6sccwcmcx239r6dhc7x0f9y";
+    sha256 = "1s3hva1j5w74qc9wyqnmr5clk4smzfi7wvx8qrzrwy81mx7r5w27";
   };
 
   buildInputs = [
diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix
index 953cc9fb77cd..8b30d7dbbc88 100644
--- a/pkgs/servers/minio/default.nix
+++ b/pkgs/servers/minio/default.nix
@@ -1,24 +1,26 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, nixosTests }:
 
 buildGoModule rec {
   pname = "minio";
-  version = "2020-03-25T07-03-04Z";
+  version = "2020-05-01T22-19-14Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "minio";
     rev = "RELEASE.${version}";
-    sha256 = "0xdflc7pfx1misbh695x8kmqpysi5iydsarr9mwmjragf5b1kbl5";
+    sha256 = "0yyq5j82rcl8yhn2jg8sjfxii6kzbrbmxvb05yiwv7p0q42ag5rn";
   };
 
-  modSha256 = "09kbibsfa7qq55paqr7wcs4gpwk6g5pknc5fjssmd12nm2cji96k";
+  modSha256 = "1g5vwllxpiy4qlfhn3v5k6sn4g4qpbv0hpg32y1vi2q342lag116";
 
   subPackages = [ "." ];
 
   buildFlagsArray = [''-ldflags=
-    -X github.com/minio/minio/cmd.Version=${version}
+    -s -w -X github.com/minio/minio/cmd.Version=${version}
   ''];
 
+  passthru.tests.minio = nixosTests.minio;
+
   meta = with stdenv.lib; {
     homepage = "https://www.minio.io/";
     description = "An S3-compatible object storage server";
diff --git a/pkgs/servers/misc/airsonic/default.nix b/pkgs/servers/misc/airsonic/default.nix
index 2c529ef7b32b..be7480354305 100644
--- a/pkgs/servers/misc/airsonic/default.nix
+++ b/pkgs/servers/misc/airsonic/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "airsonic";
-  version = "10.5.0";
+  version = "10.6.1";
 
   src = fetchurl {
     url = "https://github.com/airsonic/airsonic/releases/download/v${version}/airsonic.war";
-    sha256 = "0nja33x3qh8zylqc7dn6x8j1wyxf7pzf9vdg9rzaq1hl6mi573jq";
+    sha256 = "0dgk9i7981wydp44zax21y48psybcsd4i68cmlp9izl8aa5gk2vb";
   };
 
   buildCommand = ''
diff --git a/pkgs/servers/monitoring/thanos/default.nix b/pkgs/servers/monitoring/thanos/default.nix
index f307032f4141..a6122b317535 100644
--- a/pkgs/servers/monitoring/thanos/default.nix
+++ b/pkgs/servers/monitoring/thanos/default.nix
@@ -1,16 +1,16 @@
 { stdenv, buildGoModule, fetchFromGitHub }:
 buildGoModule rec {
   pname = "thanos";
-  version = "0.11.0";
+  version = "0.12.2";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "thanos-io";
     repo = "thanos";
-    sha256 = "152ic9pga0wjg4r7b66hdnbsj9wrzfzbbps7wjas3rcbcv1f2i90";
+    sha256 = "10xscm9h2krha66v96v2q85fynnxfizjcc47h7yz4xhjwvb5dgz2";
   };
 
-  modSha256 = "1pdypyyy352l6wy5lr94fv8j890lh863h8zg2hxchiymrs5pgq1c";
+  modSha256 = "0c8gc4qzdazxxnabfms63df8vlf2iy6iy0jrm710x76m4vm6mrbj";
 
   subPackages = "cmd/thanos";
 
diff --git a/pkgs/servers/sql/dolt/default.nix b/pkgs/servers/sql/dolt/default.nix
index 6f7f81f23780..4015e2097ee0 100644
--- a/pkgs/servers/sql/dolt/default.nix
+++ b/pkgs/servers/sql/dolt/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
     pname = "dolt";
-    version = "0.15.2";
+    version = "0.16.3";
 
     src = fetchFromGitHub {
         owner = "liquidata-inc";
         repo = "dolt";
         rev = "v${version}";
-        sha256 = "0av21czfxpwy4y7n9x6hy6m2fliqcazjx7ww0rwm6kdwxipq1xsz";
+        sha256 = "141wv5av7hms4wa3s4md7mnb77bbyn3854d7gj7fy6f6jvzghdny";
     };
 
     modRoot = "./go";
     subPackages = [ "cmd/dolt" "cmd/git-dolt" "cmd/git-dolt-smudge" ];
-    modSha256 = "0c120gkkswg0cqvvhjkxvalr4fsjv81khwg0x0fm8fr6lipkfksn";
+    modSha256 = "1fx830dif9cq2rvigdbqbc3vmmq01ywj9b095adbrwddvay8m8si";
 
     meta = with lib; {
         description = "Relational database with version control and CLI a-la Git.";
diff --git a/pkgs/servers/traefik/default.nix b/pkgs/servers/traefik/default.nix
index 0487ed177d04..40b85fc949e1 100644
--- a/pkgs/servers/traefik/default.nix
+++ b/pkgs/servers/traefik/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "traefik";
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "containous";
     repo = "traefik";
     rev = "v${version}";
-    sha256 = "1dcazssabqxr9wv3dds3z7ks3y628qa07vgnn3hpdwxzm2b2ma92";
+    sha256 = "0byi2h1lma95l77sdj8jkidmwb12ryjqwxa0zz6vwjg07p5ps3k4";
   };
 
-  modSha256 = "0w3ssxvsmq8i6hbfmn4ig2x13i2nlqy5q1khcblf9pq5vhk202qx";
+  modSha256 = "17imp24abfgh75g8161daknzqzk2m19q9d1mij6487046lk75hqz";
   subPackages = [ "cmd/traefik" ];
 
   nativeBuildInputs = [ go-bindata ];
diff --git a/pkgs/shells/fish/default.nix b/pkgs/shells/fish/default.nix
index 0f18eb79d2d8..11d9e48008fa 100644
--- a/pkgs/shells/fish/default.nix
+++ b/pkgs/shells/fish/default.nix
@@ -16,6 +16,7 @@
 , python3
 , cmake
 
+, runCommand
 , writeText
 , nixosTests
 , useOperatingSystemEtc ? true
@@ -202,38 +203,41 @@ let
 
     passthru = {
       shellPath = "/bin/fish";
-      tests.nixos = nixosTests.fish;
+      tests = {
+        nixos = nixosTests.fish;
+
+        # Test the fish_config tool by checking the generated splash page.
+        # Since the webserver requires a port to run, it is not started.
+        fishConfig =
+          let fishScript = writeText "test.fish" ''
+            set -x __fish_bin_dir ${fish}/bin
+            echo $__fish_bin_dir
+            cp -r ${fish}/share/fish/tools/web_config/* .
+            chmod -R +w *
+
+            # if we don't set `delete=False`, the file will get cleaned up
+            # automatically (leading the test to fail because there's no
+            # tempfile to check)
+            sed -e "s@, mode='w'@, mode='w', delete=False@" -i webconfig.py
+
+            # we delete everything after the fileurl is assigned
+            sed -e '/fileurl =/q' -i webconfig.py
+            echo "print(fileurl)" >> webconfig.py
+
+            # and check whether the message appears on the page
+            cat (${python3}/bin/python ./webconfig.py \
+              | tail -n1 | sed -ne 's|.*\(/build/.*\)|\1|p' \
+            ) | grep 'a href="http://localhost.*Start the Fish Web config'
+
+            # cannot test the http server because it needs a localhost port
+          '';
+          in
+          runCommand "test-web-config" { } ''
+            HOME=$(mktemp -d)
+            ${fish}/bin/fish ${fishScript} && touch $out
+          '';
+      };
     };
   };
-
-  tests = {
-
-    # Test the fish_config tool by checking the generated splash page.
-    # Since the webserver requires a port to run, it is not started.
-    fishConfig =
-      let
-        fishScript = writeText "test.fish" ''
-          set -x __fish_bin_dir ${fish}/bin
-          echo $__fish_bin_dir
-          cp -r ${fish}/share/fish/tools/web_config/* .
-          chmod -R +w *
-          # we delete everything after the fileurl is assigned
-          sed -e '/fileurl =/q' -i webconfig.py
-          echo "print(fileurl)" >> webconfig.py
-          # and check whether the message appears on the page
-          cat (${python3}/bin/python ./webconfig.py \
-            | tail -n1 | sed -ne 's|.*\(/tmp/.*\)|\1|p' \
-          ) | grep 'a href="http://localhost.*Start the Fish Web config'
-
-          # cannot test the http server because it needs a localhost port
-        '';
-      in ''
-        HOME=$(mktemp -d)
-        ${fish}/bin/fish ${fishScript}
-      '';
-  };
-
-  # FIXME(Profpatsch) replace withTests stub
-  withTests = with lib; flip const;
 in
-withTests tests fish
+fish
diff --git a/pkgs/shells/powershell/default.nix b/pkgs/shells/powershell/default.nix
index d4c18f9f5815..a5c22d125afb 100644
--- a/pkgs/shells/powershell/default.nix
+++ b/pkgs/shells/powershell/default.nix
@@ -1,21 +1,21 @@
-{ stdenv, autoPatchelfHook, fetchzip, libunwind, libuuid, icu, curl
-, darwin, makeWrapper, less, openssl_1_0_2, pam, lttng-ust }:
+{ stdenv, lib, autoPatchelfHook, fetchzip, libunwind, libuuid, icu, curl
+, darwin, makeWrapper, less, openssl_1_1, pam, lttng-ust }:
 
 let platformString = if stdenv.isDarwin then "osx"
                      else if stdenv.isLinux then "linux"
                      else throw "unsupported platform";
-    platformSha = if stdenv.isDarwin then "0jb2xm79m3m14zk7v730ai1zvxcb5a13jbkkya0qy7332k6gn6bl"
-                     else if stdenv.isLinux then "0s0jvc9ha6fw8qy7f5n0v6zf043rawsjdlm5wvqxq1q2idz7xcw1"
+    platformSha = if stdenv.isDarwin then "0c71w6z6sc86si07i6vy4w3069jal7476wyiizyr7qjm9m22963f"
+                     else if stdenv.isLinux then "0m13y66a6w64s31qbi3j5x8jll6dfrin890jah8kyncsvlyisqg3"
                      else throw "unsupported platform";
     platformLdLibraryPath = if stdenv.isDarwin then "DYLD_FALLBACK_LIBRARY_PATH"
                      else if stdenv.isLinux then "LD_LIBRARY_PATH"
                      else throw "unsupported platform";
-                     libraries = [ libunwind libuuid icu curl openssl_1_0_2 ] ++
+                     libraries = [ libunwind libuuid icu curl openssl_1_1 ] ++
                        (if stdenv.isLinux then [ pam lttng-ust ] else [ darwin.Libsystem ]);
 in
 stdenv.mkDerivation rec {
   pname = "powershell";
-  version = "6.2.3";
+  version = "7.0.0";
 
   src = fetchzip {
     url = "https://github.com/PowerShell/PowerShell/releases/download/v${version}/powershell-${version}-${platformString}-x64.tar.gz";
@@ -26,21 +26,42 @@ stdenv.mkDerivation rec {
   buildInputs = [ less ] ++ libraries;
   nativeBuildInputs = [ autoPatchelfHook makeWrapper ];
 
-  installPhase = ''
+  installPhase =
+  let
+    ext = stdenv.hostPlatform.extensions.sharedLibrary;
+  in ''
+    pslibs=$out/share/powershell
+    mkdir -p $pslibs
+
+    cp -r * $pslibs
+
+    rm -f $pslibs/libcrypto${ext}.1.0.0
+    rm -f $pslibs/libssl${ext}.1.0.0
+
+    ls $pslibs
+  '' + lib.optionalString (!stdenv.isDarwin) ''
+    patchelf --replace-needed libcrypto${ext}.1.0.0 libcrypto${ext}.1.1 $pslibs/libmi.so
+    patchelf --replace-needed libssl${ext}.1.0.0 libssl${ext}.1.1 $pslibs/libmi.so
+  '' + ''
+
     mkdir -p $out/bin
-    mkdir -p $out/share/powershell
-    cp -r * $out/share/powershell
-    makeWrapper $out/share/powershell/pwsh $out/bin/pwsh \
+
+    makeWrapper $pslibs/pwsh $out/bin/pwsh \
       --prefix ${platformLdLibraryPath} : "${stdenv.lib.makeLibraryPath libraries}" \
       --set TERM xterm --set POWERSHELL_TELEMETRY_OPTOUT 1 --set DOTNET_CLI_TELEMETRY_OPTOUT 1
   '';
 
   dontStrip = true;
 
-  meta = with stdenv.lib; {
-    description = "Cross-platform (Windows, Linux, and macOS) automation and configuration tool/framework";
+  doInstallCheck = true;
+  installCheck = ''
+    $out/bin/pwsh --help > /dev/null
+  '';
+
+  meta = with lib; {
+    description = "Powerful cross-platform (Windows, Linux, and macOS) shell and scripting language based on .NET";
     homepage = "https://github.com/PowerShell/PowerShell";
-    maintainers = [ maintainers.yrashk ];
+    maintainers = with maintainers; [ yrashk srgom ];
     platforms = [ "x86_64-darwin" "x86_64-linux" ];
     license = with licenses; [ mit ];
   };
diff --git a/pkgs/shells/zsh/oh-my-zsh/default.nix b/pkgs/shells/zsh/oh-my-zsh/default.nix
index 6e679f16e304..fe30a6f9e9aa 100644
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@@ -4,13 +4,13 @@
 { stdenv, fetchgit }:
 
 stdenv.mkDerivation rec {
-  version = "2020-04-30";
+  version = "2020-05-01";
   pname = "oh-my-zsh";
-  rev = "06b0276675e978d80535259915fbb44011e10101";
+  rev = "173d4ca68f1ff4b04e9f3fd783244c309d848092";
 
   src = fetchgit { inherit rev;
     url = "https://github.com/ohmyzsh/ohmyzsh";
-    sha256 = "1y1c8v2akxwffrmcq8lmxvdnirqkxbxbrhcws76dlcgp2m3drvgq";
+    sha256 = "0k8w5cf5fyz69bji947i1yd7pd49bpkg82k2wlx9964lgl21bip5";
   };
 
   pathsToLink = [ "/share/oh-my-zsh" ];
diff --git a/pkgs/tools/admin/lego/default.nix b/pkgs/tools/admin/lego/default.nix
index ce250d33e946..b2d3ebfa5829 100644
--- a/pkgs/tools/admin/lego/default.nix
+++ b/pkgs/tools/admin/lego/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "lego";
-  version = "3.5.0";
+  version = "3.6.0";
 
   src = fetchFromGitHub {
     owner = "go-acme";
     repo = pname;
     rev = "v${version}";
-    sha256 = "08mh2q426gmhcaz578lw08jbxfqb7qm37cd00ap937dymi1zs9qw";
+    sha256 = "0jqq1ricy8971a27zcc6qm61cv6pjk4984dab1cgz86qzama7nil";
   };
 
-  modSha256 = "10n8pcbmzlnk63gzsjb1xnmjwxfhxsqx8ffpcbwdzq9fc5yvjiii";
+  modSha256 = "0a3d7snnchxk5n4m0v725689pwqjgwz7g94yzh9akc55nwy33sfj";
   subPackages = [ "cmd/lego" ];
 
   buildFlagsArray = [
diff --git a/pkgs/tools/admin/lxd/default.nix b/pkgs/tools/admin/lxd/default.nix
index 6051c16e91e1..11929b337635 100644
--- a/pkgs/tools/admin/lxd/default.nix
+++ b/pkgs/tools/admin/lxd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, pkgconfig, lxc, buildGoPackage, fetchurl
+{ stdenv, hwdata, pkgconfig, lxc, buildGoPackage, fetchurl
 , makeWrapper, acl, rsync, gnutar, xz, btrfs-progs, gzip, dnsmasq
 , squashfsTools, iproute, iptables, ebtables, libcap, libco-canonical, dqlite
 , raft-canonical, sqlite-replication, udev
@@ -19,6 +19,11 @@ buildGoPackage rec {
     sha256 = "0sxkyjayn7yyiy9kvbdlpkl58lwsl2rhlxnncg628f2kad2zgkdx";
   };
 
+  postPatch = ''
+    substituteInPlace shared/usbid/load.go \
+      --replace "/usr/share/misc/usb.ids" "${hwdata}/share/hwdata/usb.ids"
+  '';
+
   preBuild = ''
     # unpack vendor
     pushd go/src/github.com/lxc/lxd
diff --git a/pkgs/tools/admin/salt/default.nix b/pkgs/tools/admin/salt/default.nix
index b648cdb25124..b378f0828659 100644
--- a/pkgs/tools/admin/salt/default.nix
+++ b/pkgs/tools/admin/salt/default.nix
@@ -1,21 +1,38 @@
-{
-  stdenv, pythonPackages, openssl,
-
+{ lib
+, python3
+, openssl
   # Many Salt modules require various Python modules to be installed,
   # passing them in this array enables Salt to find them.
-  extraInputs ? []
+, extraInputs ? []
 }:
+let
+
+  py = python3.override {
+    packageOverrides = self: super: {
+      # Can be unpinned once https://github.com/saltstack/salt/issues/56007 is resolved
+      msgpack = super.msgpack.overridePythonAttrs (
+        oldAttrs: rec {
+          version = "0.6.2";
+          src = oldAttrs.src.override {
+            inherit version;
+            sha256 = "0c0q3vx0x137567msgs5dnizghnr059qi5kfqigxbz26jf2jyg7a";
+          };
+        }
+      );
+    };
+  };
 
-pythonPackages.buildPythonApplication rec {
+in
+py.pkgs.buildPythonApplication rec {
   pname = "salt";
-  version = "2019.2.0";
+  version = "3000.2";
 
-  src = pythonPackages.fetchPypi {
+  src = py.pkgs.fetchPypi {
     inherit pname version;
-    sha256 = "1kgn3lway0zwwysyzpphv05j4xgxk92dk4rv1vybr2527wmvp5an";
+    sha256 = "1n90qqhsvbf4pc4pcbya3rjfkblbccf4np4mxpghjqaa16fl4cqf";
   };
 
-  propagatedBuildInputs = with pythonPackages; [
+  propagatedBuildInputs = with py.pkgs; [
     jinja2
     markupsafe
     msgpack
@@ -24,8 +41,6 @@ pythonPackages.buildPythonApplication rec {
     pyzmq
     requests
     tornado_4
-  ] ++ stdenv.lib.optionals (!pythonPackages.isPy3k) [
-    futures
   ] ++ extraInputs;
 
   patches = [ ./fix-libcrypto-loading.patch ];
@@ -40,7 +55,7 @@ pythonPackages.buildPythonApplication rec {
   # as is it rather long.
   doCheck = false;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://saltstack.com/";
     description = "Portable, distributed, remote execution and configuration management system";
     maintainers = with maintainers; [ aneeshusa ];
diff --git a/pkgs/tools/archivers/afio/default.nix b/pkgs/tools/archivers/afio/default.nix
index e2fe3d90ee6c..3b4eb6a5ea56 100644
--- a/pkgs/tools/archivers/afio/default.nix
+++ b/pkgs/tools/archivers/afio/default.nix
@@ -1,12 +1,14 @@
-{ stdenv, fetchurl } :
+{ stdenv, fetchFromGitHub } :
 
 stdenv.mkDerivation rec {
   version = "2.5.2";
   pname = "afio";
 
-  src = fetchurl {
-    url = "http://members.chello.nl/~k.holtman/${pname}-${version}.tgz";
-    sha256 = "1fa29wlqv76hzf8bxp1qpza1r23pm2f3m7rcf0jpwm6z150s2k66";
+  src = fetchFromGitHub {
+    owner = "kholtman";
+    repo = "afio";
+    rev = "v${version}";
+    sha256 = "1vbxl66r5rp5a1qssjrkfsjqjjgld1cq57c871gd0m4qiq9rmcfy";
   };
 
   /*
@@ -18,7 +20,7 @@ stdenv.mkDerivation rec {
   installFlags = [ "DESTDIR=$(out)" ];
 
   meta = {
-    homepage = "http://members.chello.nl/~k.holtman/afio.html";
+    homepage = "https://github.com/kholtman/afio";
     description = "Fault tolerant cpio archiver targeting backups";
     platforms = stdenv.lib.platforms.all;
     /*
diff --git a/pkgs/tools/archivers/unar/default.nix b/pkgs/tools/archivers/unar/default.nix
index 259238cdec5e..9fdbada9ab8d 100644
--- a/pkgs/tools/archivers/unar/default.nix
+++ b/pkgs/tools/archivers/unar/default.nix
@@ -1,52 +1,54 @@
-{ stdenv, fetchurl, gnustep, unzip, bzip2, zlib, icu, openssl }:
+{ stdenv, fetchFromGitHub, installShellFiles, gnustep, bzip2, zlib, icu, openssl, wavpack }:
 
-let
+stdenv.mkDerivation rec {
   pname = "unar";
+  version = "1.10.7";
 
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
-  version = "1.10.1";
-
-  src = fetchurl {
-    url = "http://unarchiver.c3.cx/downloads/${pname}${version}_src.zip";
-    sha256 = "0aq9zlar5vzr5qxphws8dm7ax60bsfsw77f4ciwa5dq5lla715j0";
+  src = fetchFromGitHub {
+    owner = "MacPaw";
+    # the unar repo contains a shallow clone of both XADMaster and universal-detector
+    repo = "unar";
+    rev = "v${version}";
+    sha256 = "0p846q1l66k3rnd512sncp26zpv411b8ahi145sghfcsz9w8abc4";
   };
 
-  buildInputs = [ gnustep.base bzip2 icu openssl zlib ];
-
-  nativeBuildInputs = [ gnustep.make unzip ];
-
-  enableParallelBuilding = true;
-
   postPatch = ''
     for f in Makefile.linux ../UniversalDetector/Makefile.linux ; do
       substituteInPlace $f \
-        --replace "CC = gcc"     "CC=cc" \
-        --replace "CXX = g++"    "CXX=c++" \
-        --replace "OBJCC = gcc"  "OBJCC=cc" \
-        --replace "OBJCXX = g++" "OBJCXX=c++"
+        --replace "= gcc" "=cc" \
+        --replace "= g++" "=c++"
     done
+
+    # we need to build inside this directory as well, so we have to make it writeable
+    chmod +w ../UniversalDetector -R
   '';
 
+  buildInputs = [ gnustep.base bzip2 icu openssl wavpack zlib ];
+
+  nativeBuildInputs = [ gnustep.make installShellFiles ];
+
+  enableParallelBuilding = true;
+
+  dontConfigure = true;
+
   makefile = "Makefile.linux";
 
-  sourceRoot = "./The Unarchiver/XADMaster";
+  sourceRoot = "./source/XADMaster";
 
   installPhase = ''
     runHook preInstall
 
-    install -Dm755 -t $out/bin lsar unar
-    install -Dm644 -t $out/share/man/man1 ../Extra/{lsar,unar}.1
-
-    mkdir -p $out/etc/bash_completion.d
-    cp ../Extra/lsar.bash_completion $out/etc/bash_completion.d/lsar
-    cp ../Extra/unar.bash_completion $out/etc/bash_completion.d/unar
+    install -Dm555 -t $out/bin lsar unar
+    for f in lsar unar; do
+      installManPage ./Extra/$f.?
+      installShellCompletion --bash --name $f ./Extra/$f.bash_completion
+    done
 
     runHook postInstall
   '';
 
   meta = with stdenv.lib; {
-    homepage = "http://unarchiver.c3.cx/unarchiver";
+    homepage = "https://theunarchiver.com";
     description = "An archive unpacker program";
     longDescription = ''
       The Unarchiver is an archive unpacker program with support for the popular \
@@ -55,7 +57,8 @@ in stdenv.mkDerivation rec {
       Compact Pro, Packit, cpio, compress (.Z), ARJ, ARC, PAK, ACE, ZOO, LZH, \
       ADF, DMS, LZX, PowerPacker, LBR, Squeeze, Crunch, and other old formats.
     '';
-    license = with licenses; [ lgpl21Plus ];
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ peterhoeg ];
     platforms = with platforms; linux;
   };
 }
diff --git a/pkgs/tools/compression/hactool/default.nix b/pkgs/tools/compression/hactool/default.nix
new file mode 100644
index 000000000000..77382d980e54
--- /dev/null
+++ b/pkgs/tools/compression/hactool/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation {
+  pname = "hactool";
+  version = "1.3.3";
+
+  src = fetchFromGitHub {
+    owner = "SciresM";
+    repo = "hactool";
+    rev = "1.3.3";
+    sha256 = "1qb51fck7liqc1ridms8wdlzgbdbvp6iv4an8jvmzhcj5p5xq631";
+  };
+
+  preBuild = ''
+    mv config.mk.template config.mk
+  '';
+
+  installPhase = ''
+    install -D hactool $out/bin/hactool
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/SciresM/hactool";
+    description = "A tool to manipulate common file formats for the Nintendo Switch";
+    longDescription = "A tool to view information about, decrypt, and extract common file formats for the Nintendo Switch, especially Nintendo Content Archives";
+    license = licenses.isc;
+    maintainers = with maintainers; [ ivar ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/tools/filesystems/catcli/default.nix b/pkgs/tools/filesystems/catcli/default.nix
index 4ac6c1d5b21e..25de04467ef9 100644
--- a/pkgs/tools/filesystems/catcli/default.nix
+++ b/pkgs/tools/filesystems/catcli/default.nix
@@ -7,13 +7,13 @@
 buildPythonApplication rec {
 
   pname = "catcli";
-  version = "0.5.13";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "deadc0de6";
     repo = pname;
     rev = "v${version}";
-    sha256 = "04mrkqmm2c8fhi1h1hddc4yh3dqhcvkmcwzhj0ggn34v7wavgb5i";
+    sha256 = "0myhvflph4fayl2bg8m9a7prh5pcnvnb75p0jb4jpmbx7jyn7ihp";
   };
 
   propagatedBuildInputs = [ docopt anytree ];
diff --git a/pkgs/tools/filesystems/fuseiso/default.nix b/pkgs/tools/filesystems/fuseiso/default.nix
index 2d24cb71bbed..ded1fac65f88 100644
--- a/pkgs/tools/filesystems/fuseiso/default.nix
+++ b/pkgs/tools/filesystems/fuseiso/default.nix
@@ -1,40 +1,55 @@
-{ stdenv, fetchurl, fetchpatch, pkgconfig, fuse, zlib, glib }:
+{ stdenv, fetchurl, fetchpatch, autoreconfHook, pkgconfig, fuse, glib, zlib }:
 
-stdenv.mkDerivation {
-  name = "fuseiso-20070708";
+stdenv.mkDerivation rec {
+  pname = "fuseiso";
+  version = "20070708";
 
   src = fetchurl {
-    url = "mirror://sourceforge/project/fuseiso/fuseiso/20070708/fuseiso-20070708.tar.bz2";
+    url = "mirror://sourceforge/project/fuseiso/fuseiso/${version}/fuseiso-${version}.tar.bz2";
     sha256 = "127xql52dcdhmh7s5m9xc6q39jdlj3zhbjar1j821kb6gl3jw94b";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ fuse zlib glib ];
-
-  patches = let fetchPatchFromDebian = { patch, sha256 }:
+  patches = map (p:
     fetchpatch {
-      inherit sha256;
-      url = "https://sources.debian.net/data/main/f/fuseiso/20070708-3.2/debian/patches/${patch}";
-    };
-  in [
-    (fetchPatchFromDebian {
-      patch = "00-support_large_iso.patch";
+      inherit (p) name sha256;
+      url = "https://sources.debian.net/data/main/f/fuseiso/${version}-3.2/debian/patches/${p.name}";
+    }) [
+    {
+      name = "00-support_large_iso.patch";
       sha256 = "1lmclb1qwzz5f4wlq693g83bblwnjjl73qhgfxbsaac5hnn2shjw";
-    })
-    (fetchPatchFromDebian { # CVE-2015-8837
-      patch = "02-prevent-buffer-overflow.patch";
+    }
+    {
+      name = "01-fix_typo.patch";
+      sha256 = "14rpxp0yylzsgqv0r19l4wx1h5hvqp617gpv1yg0w48amr9drasa";
+    }
+    { # CVE-2015-8837
+      name = "02-prevent-buffer-overflow.patch";
       sha256 = "1ls2pp3mh91pdb51qz1fsd8pwhbky6988bpd156bn7wgfxqzh8ig";
-    })
-    (fetchPatchFromDebian { # CVE-2015-8836
-      patch = "03-prevent-integer-overflow.patch";
+    }
+    { # CVE-2015-8836
+      name = "03-prevent-integer-overflow.patch";
       sha256 = "100cw07fk4sa3hl7a1gk2hgz4qsxdw99y20r7wpidwwwzy463zcv";
-    })
+    }
   ];
 
-  meta = {
-    homepage = "https://sourceforge.net/projects/fuseiso";
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+
+  buildInputs = [ fuse glib zlib ];
+
+  # after autoreconfHook, glib and zlib are not found, so force link against
+  # them
+  NIX_LDFLAGS = "-lglib-2.0 -lz";
+
+  enableParallelBuilding = true;
+
+  postInstall = ''
+    install -Dm444 -t $out/share/doc/${pname} NEWS README
+  '';
+
+  meta = with stdenv.lib; {
     description = "FUSE module to mount ISO filesystem images";
-    platforms = stdenv.lib.platforms.linux;
-    license = stdenv.lib.licenses.gpl2;
+    homepage = "https://sourceforge.net/projects/fuseiso";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/graphics/scrot/default.nix b/pkgs/tools/graphics/scrot/default.nix
index 56df615e5750..f9042645be0b 100644
--- a/pkgs/tools/graphics/scrot/default.nix
+++ b/pkgs/tools/graphics/scrot/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "scrot";
-  version = "1.2";
+  version = "1.3";
 
   src = fetchFromGitHub {
     owner = "resurrecting-open-source-projects";
     repo = pname;
     rev = version;
-    sha256 = "08gkdby0ysx2mki57z81zlm7vfnq9c1gq692xw67cg5vv2p3320w";
+    sha256 = "0x70hd59ik37kqd8xqpwrz46np01jv324iz28x2s0kk36d7sblsj";
   };
 
   nativeBuildInputs = [ autoreconfHook autoconf-archive ];
diff --git a/pkgs/tools/misc/autorandr/default.nix b/pkgs/tools/misc/autorandr/default.nix
index c6f664a10086..9588d0ae9486 100644
--- a/pkgs/tools/misc/autorandr/default.nix
+++ b/pkgs/tools/misc/autorandr/default.nix
@@ -6,7 +6,7 @@
 
 let
   python = python3Packages.python;
-  version = "1.9";
+  version = "1.10";
 in
   stdenv.mkDerivation {
     pname = "autorandr";
@@ -49,7 +49,7 @@ in
       owner = "phillipberndt";
       repo = "autorandr";
       rev = version;
-      sha256 = "1bb0l7fcm5lcx9y02zdxv7pfdqf4v4gsc5br3v1x9gzjvqj64l7n";
+      sha256 = "0rcgs1n09p0p16lr5y239s0yrw7bch0x2cqwgc2dyh7rz7d9qmwn";
     };
 
     meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/bat-extras/default.nix b/pkgs/tools/misc/bat-extras/default.nix
new file mode 100644
index 000000000000..0f98b819b0f7
--- /dev/null
+++ b/pkgs/tools/misc/bat-extras/default.nix
@@ -0,0 +1,147 @@
+{ stdenv, callPackage, fetchFromGitHub, bash, makeWrapper, ncurses, bat
+# batgrep and batwatch
+, less
+# batgrep
+, ripgrep
+# prettybat
+, withShFmt ? shfmt != null, shfmt ? null
+, withPrettier ? nodePackages?prettier, nodePackages ? null
+, withClangTools ? clang-tools != null, clang-tools ? null
+, withRustFmt ? rustfmt != null, rustfmt ? null
+# batwatch
+, withEntr ? entr != null, entr ? null
+ }:
+
+let
+  # Core derivation that all the others are based on.
+  # This includes the complete source so the per-script derivations can run the tests.
+  core = stdenv.mkDerivation rec {
+    pname   = "bat-extras";
+    version = "20200408";
+
+    src = fetchFromGitHub {
+      owner  = "eth-p";
+      repo   = pname;
+      rev    = "v${version}";
+      sha256 = "184d5rwasfpgbj2k98alg3wy8jmzna2dgfik98w2a297ky67s51v";
+      fetchSubmodules = true;
+    };
+
+    nativeBuildInputs = [ bash makeWrapper ];
+
+    dontConfigure = true;
+
+    postPatch = ''
+      substituteInPlace lib/constants.sh \
+        --replace 'EXECUTABLE_BAT="bat"' 'EXECUTABLE_BAT="${bat}/bin/bat"'
+
+      patchShebangs --build test.sh test/shimexec .test-framework/bin/best.sh
+      wrapProgram .test-framework/bin/best.sh \
+        --prefix PATH : "${ncurses}/bin"
+    '';
+
+    buildPhase = ''
+      runHook preBuild
+      bash ./build.sh --minify=none --no-verify
+      runHook postBuild
+    '';
+
+    # Run the library tests as they don't have external dependencies
+    doCheck = true;
+    checkPhase = ''
+      runHook preCheck
+      # test list repeats suites. Unique them
+      declare -A test_suites
+      while read -r action arg _; do
+        [[ "$action" == "test_suite" && "$arg" == lib_* ]] &&
+        test_suites+=(["$arg"]=1)
+      done <<<"$(bash ./test.sh --compiled --list --porcelain)"
+      (( ''${#test_suites[@]} != 0 )) || {
+        echo "Couldn't find any library test suites"
+        exit 1
+      }
+      bash ./test.sh --compiled $(printf -- "--suite %q\n" "''${!test_suites[@]}")
+      runHook postCheck
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      cp -a . $out
+      runHook postInstall
+    '';
+
+    # A few random files have shebangs. Don't patch them, they don't make it into the final output.
+    # The per-script derivations will go ahead and patch the files they actually install.
+    dontPatchShebangs = true;
+
+    meta = with stdenv.lib; {
+      description = "Bash scripts that integrate bat with various command line tools";
+      homepage    = "https://github.com/eth-p/bat-extras";
+      license     = with licenses; [ mit ];
+      maintainers = with maintainers; [ bbigras lilyball ];
+      platforms   = platforms.all;
+    };
+  };
+  script =
+    name: # the name of the script
+    dependencies: # the tools we need to prefix onto PATH
+    stdenv.mkDerivation {
+      pname = "${core.pname}-${name}";
+      inherit (core) version;
+
+      src = core;
+
+      nativeBuildInputs = [ bash makeWrapper ];
+      # Make the dependencies available to the tests.
+      buildInputs = dependencies;
+
+      # Patch shebangs now because our tests rely on them
+      postPatch = ''
+        patchShebangs --host bin/${name}
+      '';
+
+      dontConfigure = true;
+      dontBuild = true; # we've already built
+
+      doCheck = true;
+      checkPhase = ''
+        runHook preCheck
+        bash ./test.sh --compiled --suite ${name}
+        runHook postCheck
+      '';
+
+      installPhase = ''
+        runHook preInstall
+        mkdir -p $out/bin
+        cp -p bin/${name} $out/bin/${name}
+      '' + stdenv.lib.optionalString (dependencies != []) ''
+        wrapProgram $out/bin/${name} \
+          --prefix PATH : ${stdenv.lib.makeBinPath dependencies}
+      '' + ''
+        runHook postInstall
+      '';
+
+      # We already patched
+      dontPatchShebangs = true;
+
+      inherit (core) meta;
+    };
+  optionalDep = cond: dep:
+    assert cond -> dep != null;
+    stdenv.lib.optional cond dep;
+in
+{
+  batgrep = script "batgrep" [ less ripgrep ];
+  batman = (script "batman" []).overrideAttrs (drv: {
+    doCheck = stdenv.isDarwin; # test fails on Linux due to SIGPIPE (eth-p/bat-extras#19)
+  });
+  batwatch = script "batwatch" ([ less ] ++ optionalDep withEntr entr);
+  prettybat = (script "prettybat" ([]
+    ++ optionalDep withShFmt shfmt
+    ++ optionalDep withPrettier nodePackages.prettier
+    ++ optionalDep withClangTools clang-tools
+    ++ optionalDep withRustFmt rustfmt)
+  ).overrideAttrs (drv: {
+    doCheck = stdenv.isDarwin; # test fails on Linux due to SIGPIPE (eth-p/bat-extras#19)
+  });
+}
diff --git a/pkgs/tools/misc/blsd/default.nix b/pkgs/tools/misc/blsd/default.nix
deleted file mode 100644
index 6e6a9b7c5abd..000000000000
--- a/pkgs/tools/misc/blsd/default.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{ stdenv, buildGoPackage, fetchFromGitHub, pkgconfig, libgit2 }:
-
-buildGoPackage {
-  pname = "blsd";
-  version = "2017-07-27";
-
-  goPackagePath = "github.com/junegunn/blsd";
-
-  src = fetchFromGitHub {
-    owner = "junegunn";
-    repo = "blsd";
-    rev = "a2ac619821e502452abdeae9ebab45026893b9e8";
-    sha256 = "0b0q6i4i28cjqgxqmwxbps22gp9rcd3jz562q5wvxrwlpbzlls2h";
-  };
-
-  goDeps = ./deps.nix;
-
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ libgit2 ];
-
-  meta = with stdenv.lib; {
-    homepage = "https://github.com/junegunn/blsd";
-    description = "List directories in breadth-first order";
-    license = licenses.mit;
-    maintainers = [ maintainers.magnetophon ];
-    platforms = platforms.unix;
-    broken = true; # since 2020-02-08, libgit2 is incompatible upstream is dead.
-  };
-}
diff --git a/pkgs/tools/misc/blsd/deps.nix b/pkgs/tools/misc/blsd/deps.nix
deleted file mode 100644
index d212f213a60e..000000000000
--- a/pkgs/tools/misc/blsd/deps.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
-[
-  {
-    goPackagePath = "github.com/libgit2/git2go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/libgit2/git2go";
-      rev = "14280de4da0f392935854a7cbdd67b2a5505c3a8";
-      sha256 = "17ppd7byzir8rhdk645dmggi700scb8f401yiwx8zy81q41dk1qi";
-    };
-  }
-]
diff --git a/pkgs/tools/misc/chafa/default.nix b/pkgs/tools/misc/chafa/default.nix
index e63ad0e42af5..9e1671aec9de 100644
--- a/pkgs/tools/misc/chafa/default.nix
+++ b/pkgs/tools/misc/chafa/default.nix
@@ -2,14 +2,14 @@
 
 
 stdenv.mkDerivation rec{
-  version = "1.4.0";
+  version = "1.4.1";
   pname = "chafa";
 
   src = fetchFromGitHub {
     owner = "hpjansson";
     repo = "chafa";
     rev = version;
-    sha256 = "0vf658dd9sb2d3yh65c8nals9z0z7rykqqigmxq2h92x2ysjbg6x";
+    sha256 = "13vv2xmfh0dr949bh75448lidvzwxks6f1mjawdg1q8qwzxhzry4";
   };
 
   nativeBuildInputs = [ autoconf
diff --git a/pkgs/tools/misc/clipman/default.nix b/pkgs/tools/misc/clipman/default.nix
index 15eeb8b7b86d..e75ddaa5bab2 100644
--- a/pkgs/tools/misc/clipman/default.nix
+++ b/pkgs/tools/misc/clipman/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "clipman";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "yory8";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0d5w94cylrzhwyb4zfgidh6rr1h82dx5y7cxfa37wx5xxcjyyja1";
+    sha256 = "15s7np57pvh7mqmq016mvhz34f189wd1vrfiamzmps37mdz2nq9i";
   };
 
   modSha256 = "1sim3x794kj3wdw0g432zbgh1cimdmmg1hjgynh9jgm3y8w9q7ij";
diff --git a/pkgs/tools/misc/dmg2img/default.nix b/pkgs/tools/misc/dmg2img/default.nix
index df084579b79a..267983dd432c 100644
--- a/pkgs/tools/misc/dmg2img/default.nix
+++ b/pkgs/tools/misc/dmg2img/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, zlib, bzip2, openssl }:
+{ stdenv, fetchurl, zlib, bzip2, openssl, fetchpatch }:
 
 stdenv.mkDerivation rec {
   name = "dmg2img-1.6.7";
@@ -8,11 +8,20 @@ stdenv.mkDerivation rec {
     sha256 = "066hqhg7k90xcw5aq86pgr4l7apzvnb4559vj5s010avbk8adbh2";
   };
 
-  buildInputs = [zlib bzip2 openssl];
+  buildInputs = [ zlib bzip2 openssl ];
+
+  patches = [
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/Homebrew/formula-patches/85fa66a9/dmg2img/openssl-1.1.diff";
+      sha256 = "076sz69hf3ryylplg025vl8sj991cb81g3yazsmrf8anrd7ffmxx";
+    })
+  ];
+
+  patchFlags = [ "-p0" ];
 
   installPhase = ''
-    mkdir -p $out/bin
-    cp dmg2img $out/bin
+    install -D dmg2img $out/bin/dmg2img
+    install -D vfdecrypt $out/bin/vfdecrypt
   '';
 
   meta = {
diff --git a/pkgs/tools/misc/entr/default.nix b/pkgs/tools/misc/entr/default.nix
index aeb88d0c68b1..be8134a92a33 100644
--- a/pkgs/tools/misc/entr/default.nix
+++ b/pkgs/tools/misc/entr/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "entr";
-  version = "4.4";
+  version = "4.5";
 
   src = fetchurl {
     url = "http://entrproject.org/code/${pname}-${version}.tar.gz";
-    sha256 = "1x2hyc8vc5dz6k7b3291vxz36wllhinvqrb0d8zx9bv0ydj6qmjl";
+    sha256 = "08gsd99w20fdi0apppmzsh06z29ga8y89nfcizidil2hkl8b7jyn";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/misc/fluent-bit/default.nix b/pkgs/tools/misc/fluent-bit/default.nix
index 0933e6eae900..38f2145df44a 100644
--- a/pkgs/tools/misc/fluent-bit/default.nix
+++ b/pkgs/tools/misc/fluent-bit/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fluent-bit";
-  version = "1.4.1";
+  version = "1.4.3";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     rev = "v${version}";
-    sha256 = "1xfbghaylzsh48ag4aw77nmzm1cds4nx53m4s1fiy0r31sm8vqwl";
+    sha256 = "1x5izsm0b3514i2vl1b3x40chjlzidr5zssn5cpgrw9a8w4jpv6h";
   };
 
   nativeBuildInputs = [ cmake flex bison ];
diff --git a/pkgs/tools/misc/hpcg/default.nix b/pkgs/tools/misc/hpcg/default.nix
new file mode 100644
index 000000000000..6274178c266a
--- /dev/null
+++ b/pkgs/tools/misc/hpcg/default.nix
@@ -0,0 +1,35 @@
+{ stdenv, fetchurl, openmpi } :
+
+stdenv.mkDerivation rec {
+  pname = "hpcg";
+  version = "3.1";
+
+  src = fetchurl {
+    url = "http://www.hpcg-benchmark.org/downloads/${pname}-${version}.tar.gz";
+    sha256 = "197lw2nwmzsmfsbvgvi8z7kj69n374kgfzzp8pkmk7mp2vkk991k";
+  };
+
+  dontConfigure = true;
+
+  enableParallelBuilding = true;
+
+  buildInputs = [ openmpi ];
+
+  makeFlags = [ "arch=Linux_MPI" ];
+
+  installPhase = ''
+    mkdir -p $out/bin $out/share/hpcg
+
+    cp bin/xhpcg $out/bin
+    cp bin/hpcg.dat $out/share/hpcg
+  '';
+
+  meta = with stdenv.lib; {
+    description = "HPC conjugate gradient benchmark";
+    homepage = "https://www.hpcg-benchmark.org";
+    platforms = platforms.linux;
+    license = licenses.bsd3;
+    maintainers = [ maintainers.markuskowa ];
+  };
+}
+
diff --git a/pkgs/tools/misc/kak-lsp/default.nix b/pkgs/tools/misc/kak-lsp/default.nix
index 3048b4c93960..2f63eaf43806 100644
--- a/pkgs/tools/misc/kak-lsp/default.nix
+++ b/pkgs/tools/misc/kak-lsp/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kak-lsp";
-  version = "7.0.0";
+  version = "8.0.0";
 
   src = fetchFromGitHub {
     owner = "ul";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1b9v417g0z9q1sqgnms5vy740xggg4fcz0fdwbc4hfvfj6jkyaad";
+    sha256 = "0nka51szivwhlfkimjiyzj67nxh75m784c28ass6ihlfax631w9m";
   };
 
-  cargoSha256 = "1cmms8kvh24sjb0w77i1bwl09wkx3x65p49pkg1j0lipwic3apm3";
+  cargoSha256 = "174qy50m9487vv151vm8q6sby79dq3gbqjbz6h4326jwsc9wwi8c";
 
   buildInputs = lib.optional stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
 
diff --git a/pkgs/tools/misc/memtest86-efi/default.nix b/pkgs/tools/misc/memtest86-efi/default.nix
index f2adadc0840b..c33aa074404f 100644
--- a/pkgs/tools/misc/memtest86-efi/default.nix
+++ b/pkgs/tools/misc/memtest86-efi/default.nix
@@ -1,4 +1,10 @@
-{ fetchzip, lib, stdenv, mtools }:
+{ stdenv
+, lib
+, fetchzip
+, utillinux
+, jq
+, mtools
+}:
 
 stdenv.mkDerivation rec {
   pname = "memtest86-efi";
@@ -22,19 +28,28 @@ stdenv.mkDerivation rec {
     stripRoot = false;
   };
 
-  nativeBuildInputs = [ mtools ];
+  nativeBuildInputs = [
+    utillinux
+    jq
+    mtools
+  ];
 
   installPhase = ''
-    mkdir -p $out $TEMP/memtest86-files
-
     # memtest86 is distributed as a bootable USB image.  It contains the actual
     # memtest86 EFI app.
     #
-    # The following uses dd and mcopy to extract the actual EFI app from the
-    # usb image so that it can be installed directly on the hard drive.
-    dd if=$src/memtest86-usb.img of=$TEMP/ESP.img skip=2048
-    mcopy -i $TEMP/ESP.img ::/EFI/BOOT/ $TEMP/memtest86-files/
-    mv $TEMP/memtest86-files/BOOT/* $out/
+    # The following uses sfdisk to calculate the offset of the FAT EFI System
+    # Partition in the disk image, and mcopy to extract the actual EFI app from
+    # the filesystem so that it can be installed directly on the hard drive.
+    IMG=$src/memtest86-usb.img
+    ESP_OFFSET=$(sfdisk --json $IMG | jq -r '
+      # Partition type GUID identifying EFI System Partitions
+      def ESP_GUID: "C12A7328-F81F-11D2-BA4B-00A0C93EC93B";
+      .partitiontable |
+      .sectorsize * (.partitions[] | select(.type == ESP_GUID) | .start)
+    ')
+    mkdir $out
+    mcopy -vsi $IMG@@$ESP_OFFSET ::'/EFI/BOOT/*' $out/
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/misc/pistol/default.nix b/pkgs/tools/misc/pistol/default.nix
index 17e9dcbc33a1..1a244cd41039 100644
--- a/pkgs/tools/misc/pistol/default.nix
+++ b/pkgs/tools/misc/pistol/default.nix
@@ -6,16 +6,17 @@
 
 buildGoModule rec {
   pname = "pistol";
-  version = "0.0.5";
+  version = "0.1.1";
 
   src = fetchFromGitHub {
     owner = "doronbehar";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1zxvpmy6c26dhg5wpk5cgaqipw5372crkhm1vaghm8jkiw7sjwvw";
+    sha256 = "1d9c1bhidh781dis4427wramfrla4avqw9y2bmpjp81cqq3nc27d";
   };
 
-  modSha256 = "13yxcfd29ziprjsjl2ji7w5i2506hwwl3y0ycaphj2wlcd75rdxs";
+  modSha256 = "0r062nka72ah2nb2gf8dfrrj4sxadkykcqjzkp4c9vwk93mhw41k";
+  buildFlagsArray = [ "-ldflags=-s -w -X main.Version=${version}" ];
 
   subPackages = [ "cmd/pistol" ];
 
diff --git a/pkgs/tools/misc/pspg/default.nix b/pkgs/tools/misc/pspg/default.nix
index 1bd2fc259eea..1bb7f9582c42 100644
--- a/pkgs/tools/misc/pspg/default.nix
+++ b/pkgs/tools/misc/pspg/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pspg";
-  version = "2.7.1";
+  version = "3.0.7";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = pname;
     rev = version;
-    sha256 = "1fq8n5naicfv0lsyzfb52c84w40zrsks0x9rrvyyzih4vkhic4vm";
+    sha256 = "10w47hbi6y92imzh1rlwkh5bfj1pnlkfxhbi8lhmy6ggxa62xmf7";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/misc/silicon/default.nix b/pkgs/tools/misc/silicon/default.nix
index 7fc1a63c5abc..a59a14d4b901 100644
--- a/pkgs/tools/misc/silicon/default.nix
+++ b/pkgs/tools/misc/silicon/default.nix
@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "silicon";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "Aloxaf";
     repo = "silicon";
     rev = "v${version}";
-    sha256 = "0j211qrkwgll7rm15dk4fcazmxkcqk2zah0qg2s3y0k7cx65bcxy";
+    sha256 = "1avdzs3v6k4jhkadm8i8dlwg0iffqd99xqpi53smd0zgwks744l5";
   };
 
-  cargoSha256 = "1i0y3x5rmg27gxrr2lv04sqq7qyiv1bnazfy24l5zgb4akvdg3r5";
+  cargoSha256 = "0bdb4nadrms5jq3s8pby2qfky7112ynd7vd6mw720mshqklk5zyb";
 
   buildInputs = [ llvmPackages.libclang expat freetype ]
     ++ lib.optionals stdenv.isLinux [ libxcb ]
diff --git a/pkgs/tools/misc/tmux/default.nix b/pkgs/tools/misc/tmux/default.nix
index 4d17768b8dcd..12ea456b9f7e 100644
--- a/pkgs/tools/misc/tmux/default.nix
+++ b/pkgs/tools/misc/tmux/default.nix
@@ -21,7 +21,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "tmux";
-  version = "3.1a";
+  version = "3.1b";
 
   outputs = [ "out" "man" ];
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     owner = "tmux";
     repo = "tmux";
     rev = version;
-    sha256 = "1j85d5mj7zf3k17wsrm45m79ygc6dljc4as3crvp12r45k8xg9k6";
+    sha256 = "0jvyq4r691bn0wsr8i6c0q0lzss25vm9nx8sv3fhw9cs63ncq04y";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/woeusb/default.nix b/pkgs/tools/misc/woeusb/default.nix
index 4c235b4866f2..991ab6224907 100644
--- a/pkgs/tools/misc/woeusb/default.nix
+++ b/pkgs/tools/misc/woeusb/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, autoreconfHook, makeWrapper
-, coreutils, dosfstools, findutils, gawk, gnugrep, grub2_light, ncurses, ntfs3g, parted, p7zip, utillinux, wget
+, coreutils, dosfstools, findutils, gawk, gnugrep, grub2_light, ncurses, ntfs3g, parted, utillinux, wget
 , wxGTK30 }:
 
 stdenv.mkDerivation rec {
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     # should be patched with a less useless default PATH, but for now
     # we add everything we need manually.
     wrapProgram "$out/bin/woeusb" \
-      --set PATH '${stdenv.lib.makeBinPath [ coreutils dosfstools findutils gawk gnugrep grub2_light ncurses ntfs3g parted utillinux wget p7zip ]}'
+      --set PATH '${stdenv.lib.makeBinPath [ coreutils dosfstools findutils gawk gnugrep grub2_light ncurses ntfs3g parted utillinux wget ]}'
   '';
 
   doInstallCheck = true;
diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix
index 7b58ccfa8531..0a45c27a7a8d 100644
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@@ -18,11 +18,11 @@ buildPythonPackage rec {
   # The websites youtube-dl deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2020.03.24";
+  version = "2020.05.03";
 
   src = fetchurl {
     url = "https://yt-dl.org/downloads/${version}/${pname}-${version}.tar.gz";
-    sha256 = "05l4asakakxn53wrvxn6c03fd80zdizdbj6r2cj8c1ja3sj9i8s5";
+    sha256 = "0qigk1bml6vkck4rs0wnmr46j5gkz04zn30jvnw1r4czjs7vnpal";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
diff --git a/pkgs/tools/misc/zoxide/default.nix b/pkgs/tools/misc/zoxide/default.nix
index a43d41637b10..d2abd143ce45 100644
--- a/pkgs/tools/misc/zoxide/default.nix
+++ b/pkgs/tools/misc/zoxide/default.nix
@@ -6,20 +6,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "zoxide";
-  version = "0.3.1";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "ajeetdsouza";
     repo = "zoxide";
     rev = "v${version}";
-    sha256 = "1sad18d0pxfdy9gvjmixzgdskg1l7djvzp0aipx7pz0lyi6gs23z";
+    sha256 = "1qkvmjrkcivfzbm6swl5lgvpqz9av9jxcn9i8ms3wz4vfsibmlxv";
   };
 
   buildInputs = [
     fzf
   ];
 
-  cargoSha256 = "1sx3s1jnfxylbjr3x6v6j8a6zkl7hfyj4alzlyrsw36b1b64pwqm";
+  cargoSha256 = "1w921f7b6kzc1mjzff1bcs3mg4cp9h48698w2zlv5jzjs7nwgb8n";
 
   meta = with lib; {
     description = "A fast cd command that learns your habits";
diff --git a/pkgs/tools/networking/amass/default.nix b/pkgs/tools/networking/amass/default.nix
index 6398c4b91f13..be6d05ef4269 100644
--- a/pkgs/tools/networking/amass/default.nix
+++ b/pkgs/tools/networking/amass/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "amass";
-  version = "3.5.4";
+  version = "3.5.5";
 
   src = fetchFromGitHub {
     owner = "OWASP";
     repo = "Amass";
     rev = "v${version}";
-    sha256 = "0sxcyrlgqajmlsicr4j2b8hq2fzw8ai1xsq176bz0f33q9m9wvhf";
+    sha256 = "1w93ia9jr2afgkbaklx2rj0ccd0ghg1qbdg363aqqvyw40ccya1r";
   };
 
-  modSha256 = "1yjvwkm2zaf017lai5xl088x1z1ifwsbw56dagyf8z9jk9lhkcj7";
+  modSha256 = "051fxfh7lwrj3hzsgr2c2ga6hksz56673lg35y36sz4d93yldj6f";
 
   outputs = [ "out" "wordlists" ];
 
diff --git a/pkgs/tools/networking/bandwhich/default.nix b/pkgs/tools/networking/bandwhich/default.nix
index 7522b1629cc4..1a52a7f8987c 100644
--- a/pkgs/tools/networking/bandwhich/default.nix
+++ b/pkgs/tools/networking/bandwhich/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "bandwhich";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "imsnif";
     repo = pname;
     rev = version;
-    sha256 = "0xcn65j2q2pmbvrd5dkjg8anw1r12vizazr1wz4cinhrpsxx8p1p";
+    sha256 = "09lyl9cpb5li7kyh0y78lhgvvb24ssfjmkz65xzbgm5jyrz8rmr4";
   };
 
-  cargoSha256 = "16nkmmkla3dlz40qhy04sknm3p2f5qik0ijczcw5ibg5w1jsydfr";
+  cargoSha256 = "0m57cdbghzzjyxr6c0diyrfsjqip1dnqsh0zlapv8myizxy4rrzy";
 
   buildInputs = stdenv.lib.optional stdenv.isDarwin Security;
 
diff --git a/pkgs/tools/networking/croc/default.nix b/pkgs/tools/networking/croc/default.nix
index b4a74b620035..a0ee38031390 100644
--- a/pkgs/tools/networking/croc/default.nix
+++ b/pkgs/tools/networking/croc/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "croc";
-  version = "8.0.7";
+  version = "8.0.9";
 
   src = fetchFromGitHub {
     owner = "schollz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "06iwb2wm9wwcwl88rqhwbrky2ab0kbcyzmcv89vw533glknycw04";
+    sha256 = "0kwpn1nv93f8swzc70j8srddqz7qb33pxc9nhqrd92jhcl4cc7iv";
   };
 
-  modSha256 = "1gjigbc9511h3qd12j9ypdnmb5ia4x9f2mk7mxasy9p2xkcfyhpg";
+  modSha256 = "1wcnf3sd4hkfm38q2z03ixys1hbscay5rsac49ng4kabqjh7rxhg";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/tools/networking/dnsproxy/default.nix b/pkgs/tools/networking/dnsproxy/default.nix
index 6f57e9812397..3877e6f0e1ac 100644
--- a/pkgs/tools/networking/dnsproxy/default.nix
+++ b/pkgs/tools/networking/dnsproxy/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dnsproxy";
-  version = "0.24.0";
+  version = "0.27.1";
 
   src = fetchFromGitHub {
     owner = "AdguardTeam";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1jwy2qi99ks6zcas6h1n0zq3b0k47036ayas0mprdips60azw0hg";
+    sha256 = "0nsj75aw5dym1pzn18p6fzh17vcryz1xs4xly6ga79dkpyijr9j8";
   };
 
-  modSha256 = "0kba3jay6m9ir1pc7i833p7ylbs610g0lkp8kc3gm47xnxy7j4gz";
+  modSha256 = "1m8565hkn981b6xld8jyrbxay48ww8lzr94kgakx0rg5548kd7v5";
 
   meta = with stdenv.lib; {
     description = "Simple DNS proxy with DoH, DoT, and DNSCrypt support";
diff --git a/pkgs/tools/networking/drill/default.nix b/pkgs/tools/networking/drill/default.nix
new file mode 100644
index 000000000000..7636bd44d2db
--- /dev/null
+++ b/pkgs/tools/networking/drill/default.nix
@@ -0,0 +1,30 @@
+{ stdenv
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, openssl
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "drill";
+  version = "0.5.0";
+
+  src = fetchFromGitHub {
+    owner = "fcsonline";
+    repo = pname;
+    rev = version;
+    sha256 = "0aqd709fg0ha0lzri2p4pgraxvif7z8zcm8rx7sk6s2n605sc4gn";
+  };
+
+  cargoSha256 = "1c8vmyf388kbbs56h8b62nxgxvgy9yj9cnmvax6ycnslkcwmvld0";
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ openssl ];
+
+  meta = with stdenv.lib; {
+    description = "HTTP load testing application inspired by Ansible syntax";
+    homepage = "https://github.com/fcsonline/drill";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ filalex77 ];
+  };
+}
diff --git a/pkgs/tools/networking/inadyn/default.nix b/pkgs/tools/networking/inadyn/default.nix
index 9f7d79bdd88c..2a551c56768c 100644
--- a/pkgs/tools/networking/inadyn/default.nix
+++ b/pkgs/tools/networking/inadyn/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "inadyn";
-  version = "2.6";
+  version = "2.7";
 
   src = fetchFromGitHub {
     owner = "troglobit";
     repo = "inadyn";
     rev = "v${version}";
-    sha256 = "013kxlglxliajv3lrsix4w88w40g709rvycajb6ad6gbh8giqv47";
+    sha256 = "00jhayx0hfl9dw78d58bdxa5390bvxq73lz26q9h1gg1xw76adan";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/tools/networking/minio-client/default.nix b/pkgs/tools/networking/minio-client/default.nix
index 3bd03f385646..0649eb021720 100644
--- a/pkgs/tools/networking/minio-client/default.nix
+++ b/pkgs/tools/networking/minio-client/default.nix
@@ -2,22 +2,20 @@
 
 buildGoModule rec {
   pname = "minio-client";
-  version = "2020-04-04T05-28-55Z";
+  version = "2020-04-25T00-43-23Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "mc";
     rev = "RELEASE.${version}";
-    sha256 = "09z28fq492d4l0089d1knq4zah9p2b212pkz777vznw9lzfqqip8";
+    sha256 = "0ff2fyr3787zp0lpgbph064am33py2wzjikzmxd3zwp3y0dic770";
   };
 
-  modSha256 = "0cv824ar5ifsg93sylrfjmax6zqm5073y95hqqfcc1dfp0mv2ki3";
+  modSha256 = "1bcz7jchfnglypr2md9hhqbvcbghic2yp6njdrx3m5nqhylypzfx";
 
   subPackages = [ "." ];
 
-  preBuild = ''
-    buildFlagsArray+=("-ldflags=-X github.com/minio/mc/cmd.Version=${version}")
-  '';
+  buildFlagsArray = [ "-ldflags=-s -w -X github.com/minio/mc/cmd.Version=${version}" ];
 
   meta = with stdenv.lib; {
     homepage = "https://github.com/minio/mc";
diff --git a/pkgs/tools/networking/tendermint/default.nix b/pkgs/tools/networking/tendermint/default.nix
index 2bf907380e06..90b16e37ed78 100644
--- a/pkgs/tools/networking/tendermint/default.nix
+++ b/pkgs/tools/networking/tendermint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tendermint";
-  version = "0.32.10";
+  version = "0.32.11";
 
   src = fetchFromGitHub {
     owner = "tendermint";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0rf00fqbf8xvxbxnhki93knwdp4bqjvv548ia8c0w6cryj07plyg";
+    sha256 = "17p7khfiv5aflpl4imbqp8v7gignd6v6a7g80xlnzgix5ismh84l";
   };
 
-  modSha256 = "08f03haxzpi57gaxymsbzs0nbbgnf6z4gmpal476xy3gvc0dyi3r";
+  modSha256 = "1sdjzj52gkqk51ml29hijzv64clmi38km5z7j7paf28dla2brfxq";
 
   meta = with stdenv.lib; {
     description = "Byzantine-Fault Tolerant State Machines. Or Blockchain, for short.";
diff --git a/pkgs/tools/nix/cached-nix-shell/default.nix b/pkgs/tools/nix/cached-nix-shell/default.nix
index dc69d3f030d7..03f6bc2b1171 100644
--- a/pkgs/tools/nix/cached-nix-shell/default.nix
+++ b/pkgs/tools/nix/cached-nix-shell/default.nix
@@ -34,7 +34,7 @@ in rustPlatform.buildRustPackage rec {
 
   postInstall = ''
     mkdir -p $out/lib $out/share/cached-nix-shell $out/share/man/man1 $out/var/empty
-    cp target/release/build/cached-nix-shell-*/out/trace-nix.so $out/lib
+    cp $releaseDir/build/cached-nix-shell-*/out/trace-nix.so $out/lib
     cp rcfile.sh $out/share/cached-nix-shell/rcfile.sh
     cp cached-nix-shell.1 $out/share/man/man1
   '';
diff --git a/pkgs/tools/nix/nixpkgs-fmt/default.nix b/pkgs/tools/nix/nixpkgs-fmt/default.nix
index b95bb46a8440..b55ac647b35b 100644
--- a/pkgs/tools/nix/nixpkgs-fmt/default.nix
+++ b/pkgs/tools/nix/nixpkgs-fmt/default.nix
@@ -1,4 +1,4 @@
-{ lib, rustPlatform, fetchFromGitHub }:
+{ lib, rustPlatform, fetchFromGitHub, fetchpatch }:
 rustPlatform.buildRustPackage rec {
   pname = "nixpkgs-fmt";
   version = "0.8.0";
@@ -10,6 +10,15 @@ rustPlatform.buildRustPackage rec {
     sha256 = "09lhi8aidw9qf94n07mgs2nfac32a96wkx50glj35dhn06iwzwqr";
   };
 
+  patches = [
+    # Fixes debug output on stdout mangling some files. Fixed in next release.
+    # https://github.com/nix-community/nixpkgs-fmt/issues/201
+    (fetchpatch {
+      url = "https://github.com/nix-community/nixpkgs-fmt/commit/648f46e1d5507592b246311618f467da282bf1b5.patch";
+      sha256 = "18n4criyl0lydxmjqfkcmwx0pniyqzfgfxcjwz6czqwmx5y7b4rb";
+    })
+  ];
+
   cargoSha256 = "15m40d9354412h51zn806pxsqjai48xiw8chf8slbi0cjxd268j9";
 
   meta = with lib; {
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 96fd1bebdd45..baeae0ef52b9 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -177,7 +177,7 @@ in rec {
   nixStable = callPackage common (rec {
     name = "nix-2.3.4";
     src = fetchurl {
-      url = "http://nixos.org/releases/nix/${name}/${name}.tar.xz";
+      url = "https://nixos.org/releases/nix/${name}/${name}.tar.xz";
       sha256 = "1c626a0de0acc69830b1891ec4d3c96aabe673b2a9fd04cef84f2304d05ad00d";
     };
 
diff --git a/pkgs/tools/package-management/nixops/nixops-v1_6_1.nix b/pkgs/tools/package-management/nixops/nixops-v1_6_1.nix
index e6e30b26240f..dc0c733ca7b1 100644
--- a/pkgs/tools/package-management/nixops/nixops-v1_6_1.nix
+++ b/pkgs/tools/package-management/nixops/nixops-v1_6_1.nix
@@ -3,7 +3,7 @@
 callPackage ./generic.nix (rec {
   version = "1.6.1";
   src = fetchurl {
-    url = "http://nixos.org/releases/nixops/nixops-${version}/nixops-${version}.tar.bz2";
+    url = "https://nixos.org/releases/nixops/nixops-${version}/nixops-${version}.tar.bz2";
     sha256 = "0lfx5fhyg3z6725ydsk0ibg5qqzp5s0x9nbdww02k8s307axiah3";
   };
   nixopsAzurePackages = with python2Packages; [
diff --git a/pkgs/tools/security/bitwarden_rs/default.nix b/pkgs/tools/security/bitwarden_rs/default.nix
index 6accefa58a4f..6d3c4bccef9f 100644
--- a/pkgs/tools/security/bitwarden_rs/default.nix
+++ b/pkgs/tools/security/bitwarden_rs/default.nix
@@ -8,13 +8,13 @@ let
 
 in rustPlatform.buildRustPackage rec {
   pname = "bitwarden_rs";
-  version = "1.14.1";
+  version = "1.14.2";
 
   src = fetchFromGitHub {
     owner = "dani-garcia";
     repo = pname;
     rev = version;
-    sha256 = "10fi5vvckmdbjvlg6mlaqh2dsm33sbkq1z1b6gmz8qjbijc8i7gw";
+    sha256 = "0413yjbnj4k917x48h1gnj64kygbr6c1n55f23qkvj0hgbxpgssz";
   };
 
   nativeBuildInputs = [ pkgconfig ];
@@ -25,7 +25,7 @@ in rustPlatform.buildRustPackage rec {
 
   RUSTC_BOOTSTRAP = 1;
 
-  cargoSha256 = "1p8wpndj1aydhcjl15z3xhjf52a0l5rh5cy9qs6w4776crya2jjr";
+  cargoSha256 = "09747f9g7yyq9c8wbfdb3hwxii5xq23ynhba0vc01nhjpjyn0ksd";
   cargoBuildFlags = [ featuresFlag ];
 
   checkPhase = ''
diff --git a/pkgs/tools/security/bitwarden_rs/vault.nix b/pkgs/tools/security/bitwarden_rs/vault.nix
index 43d8d3a9b118..0c60ab621063 100644
--- a/pkgs/tools/security/bitwarden_rs/vault.nix
+++ b/pkgs/tools/security/bitwarden_rs/vault.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bitwarden_rs-vault";
-  version = "2.13.2";
+  version = "2.13.2b";
 
   src = fetchurl {
     url = "https://github.com/dani-garcia/bw_web_builds/releases/download/v${version}/bw_web_v${version}.tar.gz";
-    sha256 = "1000iqjr670imm1dlw9r003d8psp5sq0m0p62sjnll7wnycd805r";
+    sha256 = "1pba3d04gfnviv8r98anpv7m8r9r417s352r5fz8qzg8lr070540";
   };
 
   buildCommand = ''
diff --git a/pkgs/tools/security/doas/default.nix b/pkgs/tools/security/doas/default.nix
index ce8b5825647c..58ada1086bcf 100644
--- a/pkgs/tools/security/doas/default.nix
+++ b/pkgs/tools/security/doas/default.nix
@@ -1,15 +1,19 @@
-{ stdenv, lib, fetchFromGitHub, bison, pam }:
+{ stdenv
+, lib
+, fetchFromGitHub
+, bison
+, pam
+}:
 
 stdenv.mkDerivation rec {
   pname = "doas";
-
-  version = "6.0";
+  version = "6.6.1";
 
   src = fetchFromGitHub {
     owner = "Duncaen";
     repo = "OpenDoas";
     rev = "v${version}";
-    sha256 = "1j50l3jvbgvg8vmp1nx6vrjxkbj5bvfh3m01bymzfn25lkwwhz1x";
+    sha256 = "07kkc5729p654jrgfsc8zyhiwicgmq38yacmwfvay2b3gmy728zn";
   };
 
   # otherwise confuses ./configure
@@ -26,6 +30,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/Duncaen/OpenDoas";
     license = licenses.isc;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ cstrahan ];
+    maintainers = with maintainers; [ cole-h cstrahan ];
   };
 }
diff --git a/pkgs/tools/security/hcxtools/default.nix b/pkgs/tools/security/hcxtools/default.nix
index 84517ce2bd8b..5634ee6cff06 100644
--- a/pkgs/tools/security/hcxtools/default.nix
+++ b/pkgs/tools/security/hcxtools/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hcxtools";
-  version = "6.0.1";
+  version = "6.0.2";
 
   src = fetchFromGitHub {
     owner = "ZerBea";
     repo = pname;
     rev = version;
-    sha256 = "0r7pjz89chgb7zl2pqgw3zb1z8cgwp0nxmqvmkv0jn1m9dw3f44f";
+    sha256 = "0a36184igdgs2h83zr4zihc5acps91ipmgph37jakvzwrsn64ma6";
   };
 
   buildInputs = [ curl openssl zlib ];
diff --git a/pkgs/tools/security/keybase/default.nix b/pkgs/tools/security/keybase/default.nix
index 2d8957a9d540..bbc99c2ac410 100644
--- a/pkgs/tools/security/keybase/default.nix
+++ b/pkgs/tools/security/keybase/default.nix
@@ -6,7 +6,7 @@
 
 buildGoPackage rec {
   pname = "keybase";
-  version = "5.3.1";
+  version = "5.4.2";
 
   goPackagePath = "github.com/keybase/client";
   subPackages = [ "go/kbnm" "go/keybase" ];
@@ -17,7 +17,7 @@ buildGoPackage rec {
     owner = "keybase";
     repo = "client";
     rev = "v${version}";
-    sha256 = "1a1h2c8jr4r20w4gyvyrpsslmh69bl8syl3jbr0fcr2kka7vqnzg";
+    sha256 = "08lw5aw962f75xi42bwbgba94hiql2n2jnsxrkx84czi0ijs1wlr";
   };
 
   patches = [
@@ -35,7 +35,7 @@ buildGoPackage rec {
     homepage = "https://www.keybase.io/";
     description = "The Keybase official command-line utility and service.";
     platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ carlsverre np rvolosatovs filalex77 ];
+    maintainers = with maintainers; [ avaq carlsverre np rvolosatovs filalex77 ];
     license = licenses.bsd3;
   };
 }
diff --git a/pkgs/tools/security/keybase/gui.nix b/pkgs/tools/security/keybase/gui.nix
index 9c34d78aee8e..054907843909 100644
--- a/pkgs/tools/security/keybase/gui.nix
+++ b/pkgs/tools/security/keybase/gui.nix
@@ -4,16 +4,16 @@
 , runtimeShell, gsettings-desktop-schemas }:
 
 let
-  versionSuffix = "20200320154633.3e235215b3";
+  versionSuffix = "20200424214931.7b0bbf1e3c";
 in
 
 stdenv.mkDerivation rec {
   pname = "keybase-gui";
-  version = "5.3.1"; # Find latest version from https://prerelease.keybase.io/deb/dists/stable/main/binary-amd64/Packages
+  version = "5.4.2"; # Find latest version from https://prerelease.keybase.io/deb/dists/stable/main/binary-amd64/Packages
 
   src = fetchurl {
     url = "https://s3.amazonaws.com/prerelease.keybase.io/linux_binaries/deb/keybase_${version + "-" + versionSuffix}_amd64.deb";
-    sha256 = "00k1xg27arbqpa836c55fhkxjvjbhjgkf6jqzprjzz76zksfdcx4";
+    sha256 = "06iksmrr959mlzxc3nwd70apmvhij1xarxvvflys5qa31vravizs";
   };
 
   nativeBuildInputs = [
@@ -108,7 +108,7 @@ stdenv.mkDerivation rec {
     homepage = "https://www.keybase.io/";
     description = "The Keybase official GUI";
     platforms = platforms.linux;
-    maintainers = with maintainers; [ rvolosatovs puffnfresh np filalex77 ];
+    maintainers = with maintainers; [ avaq rvolosatovs puffnfresh np filalex77 ];
     license = licenses.bsd3;
   };
 }
diff --git a/pkgs/tools/security/keybase/kbfs.nix b/pkgs/tools/security/keybase/kbfs.nix
index 20fadee6a40e..e9284e7230fb 100644
--- a/pkgs/tools/security/keybase/kbfs.nix
+++ b/pkgs/tools/security/keybase/kbfs.nix
@@ -16,7 +16,7 @@ buildGoPackage {
     homepage = "https://keybase.io/docs/kbfs";
     description = "The Keybase filesystem";
     platforms = platforms.unix;
-    maintainers = with maintainers; [ rvolosatovs bennofs np ];
+    maintainers = with maintainers; [ avaq rvolosatovs bennofs np ];
     license = licenses.bsd3;
   };
 }
diff --git a/pkgs/tools/system/bfs/default.nix b/pkgs/tools/system/bfs/default.nix
index 50146f0aad31..78e92e01c6ea 100644
--- a/pkgs/tools/system/bfs/default.nix
+++ b/pkgs/tools/system/bfs/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bfs";
-  version = "1.6";
+  version = "1.7";
 
   src = fetchFromGitHub {
     repo = "bfs";
     owner = "tavianator";
     rev = version;
-    sha256 = "0qrxd1vdz2crk7jf7cdda5bhm1f841hjvin7fn497wymwr5qyjah";
+    sha256 = "1jkz99i10y6dwc4dyh2vp3p549jscgwjdp6x17mcw561bnam2287";
   };
 
   buildInputs = stdenv.lib.optionals stdenv.isLinux [ libcap acl ];
diff --git a/pkgs/tools/system/kmon/default.nix b/pkgs/tools/system/kmon/default.nix
index 1a4cdb9acdfe..afb59b25059e 100644
--- a/pkgs/tools/system/kmon/default.nix
+++ b/pkgs/tools/system/kmon/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kmon";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0lpwp5fzlf037bn03x1dldw8nfa5pyqi4qsqbscwn42idvs94mhx";
+    sha256 = "1l2zdp5f9spkfx1dhxyj32791kgvc8hqjr1kk75vds4c1wgwq8gk";
   };
 
-  cargoSha256 = "1g5k6dkv0zznh8q359n7sg9wf0gcix6m36pg9ql8wi5hnlsvg1s1";
+  cargoSha256 = "08a7gr70a3rh7a52gglck16qlwngb6ap723lg3b3mxmkyigdf6i6";
 
   nativeBuildInputs = [ python3 ];
 
diff --git a/pkgs/tools/typesetting/tex/texlive/default.nix b/pkgs/tools/typesetting/tex/texlive/default.nix
index 52a107118753..bb6432fc3e61 100644
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@@ -1,6 +1,6 @@
 /* TeX Live user docs
   - source: ../../../../../doc/languages-frameworks/texlive.xml
-  - current html: http://nixos.org/nixpkgs/manual/#sec-language-texlive
+  - current html: https://nixos.org/nixpkgs/manual/#sec-language-texlive
 */
 { stdenv, lib, fetchurl, runCommand, writeText, buildEnv
 , callPackage, ghostscriptX, harfbuzz, poppler_min
diff --git a/pkgs/tools/virtualization/linode-cli/default.nix b/pkgs/tools/virtualization/linode-cli/default.nix
index bcb0c545d455..c16eb003d8d4 100644
--- a/pkgs/tools/virtualization/linode-cli/default.nix
+++ b/pkgs/tools/virtualization/linode-cli/default.nix
@@ -13,8 +13,8 @@
 let
 
   spec = fetchurl {
-    url = "https://developers.linode.com/api/docs/v4/openapi.yaml";
-    sha256 = "1l2fahdcmv7sp1qkwr5nv2vls8fypvlybwylqfzhyjmn7jqkw4hq";
+    url = "https://raw.githubusercontent.com/linode/linode-api-docs/v4.63.1/openapi.yaml";
+    sha256 = "03ngzbq24zazfqmfd7xjmxixkcb9vv1jgamplsj633j7sjj708s0";
   };
 
 in
diff --git a/pkgs/tools/virtualization/vpsfree-client/Gemfile b/pkgs/tools/virtualization/vpsfree-client/Gemfile
new file mode 100644
index 000000000000..87c9aeebb90c
--- /dev/null
+++ b/pkgs/tools/virtualization/vpsfree-client/Gemfile
@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+source "https://rubygems.org"
+
+gem "vpsfree-client"
diff --git a/pkgs/tools/virtualization/vpsfree-client/Gemfile.lock b/pkgs/tools/virtualization/vpsfree-client/Gemfile.lock
new file mode 100644
index 000000000000..9b8fd4b918a3
--- /dev/null
+++ b/pkgs/tools/virtualization/vpsfree-client/Gemfile.lock
@@ -0,0 +1,75 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    activesupport (6.0.2.2)
+      concurrent-ruby (~> 1.0, >= 1.0.2)
+      i18n (>= 0.7, < 2)
+      minitest (~> 5.1)
+      tzinfo (~> 1.1)
+      zeitwerk (~> 2.2)
+    addressable (2.7.0)
+      public_suffix (>= 2.0.2, < 5.0)
+    concurrent-ruby (1.1.6)
+    cookiejar (0.3.3)
+    curses (1.3.2)
+    domain_name (0.5.20190701)
+      unf (>= 0.0.5, < 1.0.0)
+    em-http-request (1.1.5)
+      addressable (>= 2.3.4)
+      cookiejar (!= 0.3.1)
+      em-socksify (>= 0.3)
+      eventmachine (>= 1.0.3)
+      http_parser.rb (>= 0.6.0)
+    em-socksify (0.3.2)
+      eventmachine (>= 1.0.0.beta.4)
+    eventmachine (1.0.9.1)
+    haveapi-client (0.13.2)
+      activesupport (>= 4.0)
+      highline (~> 1.7.8)
+      json
+      require_all (~> 2.0.0)
+      rest-client (~> 2.0.2)
+      ruby-progressbar (~> 1.7.5)
+    highline (1.7.10)
+    http-cookie (1.0.3)
+      domain_name (~> 0.5)
+    http_parser.rb (0.6.0)
+    i18n (1.8.2)
+      concurrent-ruby (~> 1.0)
+    json (2.3.0)
+    mime-types (3.3.1)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2020.0425)
+    minitest (5.14.0)
+    netrc (0.11.0)
+    public_suffix (4.0.4)
+    require_all (2.0.0)
+    rest-client (2.0.2)
+      http-cookie (>= 1.0.2, < 2.0)
+      mime-types (>= 1.16, < 4.0)
+      netrc (~> 0.8)
+    ruby-progressbar (1.7.5)
+    thread_safe (0.3.6)
+    tzinfo (1.2.7)
+      thread_safe (~> 0.1)
+    unf (0.1.4)
+      unf_ext
+    unf_ext (0.0.7.7)
+    vpsadmin-client (3.0.0.master.20190517.pre.0.3ab5ddfe)
+      curses
+      em-http-request (~> 1.1.3)
+      eventmachine (~> 1.0.3)
+      haveapi-client (~> 0.13.0)
+      json
+    vpsfree-client (0.11.0)
+      vpsadmin-client (= 3.0.0.master.20190517.pre.0.3ab5ddfe)
+    zeitwerk (2.3.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  vpsfree-client
+
+BUNDLED WITH
+   2.1.4
diff --git a/pkgs/tools/virtualization/vpsfree-client/default.nix b/pkgs/tools/virtualization/vpsfree-client/default.nix
new file mode 100644
index 000000000000..17d570414882
--- /dev/null
+++ b/pkgs/tools/virtualization/vpsfree-client/default.nix
@@ -0,0 +1,17 @@
+{ lib, bundlerApp, bundlerUpdateScript }:
+
+bundlerApp {
+  pname = "vpsfree-client";
+  gemdir = ./.;
+  exes = [ "vpsfreectl" ];
+
+  passthru.updateScript = bundlerUpdateScript "vpsfree-client";
+
+  meta = with lib; {
+    description = "Ruby API and CLI for the vpsFree.cz API";
+    homepage = "https://github.com/vpsfreecz/vpsfree-client";
+    maintainers = with maintainers; [ zimbatm ];
+    license = licenses.gpl3;
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/tools/virtualization/vpsfree-client/gemset.nix b/pkgs/tools/virtualization/vpsfree-client/gemset.nix
new file mode 100644
index 000000000000..366c5836bd3a
--- /dev/null
+++ b/pkgs/tools/virtualization/vpsfree-client/gemset.nix
@@ -0,0 +1,316 @@
+{
+  activesupport = {
+    dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo" "zeitwerk"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1md98dkbirc8mq5nbz1vqq3hwqjiv7b54q7180w8wyxgd4k1awwb";
+      type = "gem";
+    };
+    version = "6.0.2.2";
+  };
+  addressable = {
+    dependencies = ["public_suffix"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1fvchp2rhp2rmigx7qglf69xvjqvzq7x0g49naliw29r2bz656sy";
+      type = "gem";
+    };
+    version = "2.7.0";
+  };
+  concurrent-ruby = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "094387x4yasb797mv07cs3g6f08y56virc2rjcpb1k79rzaj3nhl";
+      type = "gem";
+    };
+    version = "1.1.6";
+  };
+  cookiejar = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0q0kmbks9l3hl0wdq744hzy97ssq9dvlzywyqv9k9y1p3qc9va2a";
+      type = "gem";
+    };
+    version = "0.3.3";
+  };
+  curses = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0hic9kq09dhh8jqjx3k1991rnqhlj3glz82w0g7ndcri52m1hgqg";
+      type = "gem";
+    };
+    version = "1.3.2";
+  };
+  domain_name = {
+    dependencies = ["unf"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0lcqjsmixjp52bnlgzh4lg9ppsk52x9hpwdjd53k8jnbah2602h0";
+      type = "gem";
+    };
+    version = "0.5.20190701";
+  };
+  em-http-request = {
+    dependencies = ["addressable" "cookiejar" "em-socksify" "eventmachine" "http_parser.rb"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "13rxmbi0fv91n4sg300v3i9iiwd0jxv0i6xd0sp81dx3jlx7kasx";
+      type = "gem";
+    };
+    version = "1.1.5";
+  };
+  em-socksify = {
+    dependencies = ["eventmachine"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0rk43ywaanfrd8180d98287xv2pxyl7llj291cwy87g1s735d5nk";
+      type = "gem";
+    };
+    version = "0.3.2";
+  };
+  eventmachine = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "17jr1caa3ggg696dd02g2zqzdjqj9x9q2nl7va82l36f7c5v6k4z";
+      type = "gem";
+    };
+    version = "1.0.9.1";
+  };
+  haveapi-client = {
+    dependencies = ["activesupport" "highline" "json" "require_all" "rest-client" "ruby-progressbar"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1wn5zvyy3w3q74m2fsb4jwxfdbdnpyyzxdf9iklpggcdmjhb78z0";
+      type = "gem";
+    };
+    version = "0.13.2";
+  };
+  highline = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "01ib7jp85xjc4gh4jg0wyzllm46hwv8p0w1m4c75pbgi41fps50y";
+      type = "gem";
+    };
+    version = "1.7.10";
+  };
+  http-cookie = {
+    dependencies = ["domain_name"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "004cgs4xg5n6byjs7qld0xhsjq3n6ydfh897myr2mibvh6fjc49g";
+      type = "gem";
+    };
+    version = "1.0.3";
+  };
+  "http_parser.rb" = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "15nidriy0v5yqfjsgsra51wmknxci2n2grliz78sf9pga3n0l7gi";
+      type = "gem";
+    };
+    version = "0.6.0";
+  };
+  i18n = {
+    dependencies = ["concurrent-ruby"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0jwrd1l4mxz06iyx6053lr6hz2zy7ah2k3ranfzisvych5q19kwm";
+      type = "gem";
+    };
+    version = "1.8.2";
+  };
+  json = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0nrmw2r4nfxlfgprfgki3hjifgrcrs3l5zvm3ca3gb4743yr25mn";
+      type = "gem";
+    };
+    version = "2.3.0";
+  };
+  mime-types = {
+    dependencies = ["mime-types-data"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1zj12l9qk62anvk9bjvandpa6vy4xslil15wl6wlivyf51z773vh";
+      type = "gem";
+    };
+    version = "3.3.1";
+  };
+  mime-types-data = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1zin0q26wc5p7zb7glpwary7ms60s676vcq987yv22jgm6hnlwlh";
+      type = "gem";
+    };
+    version = "3.2020.0425";
+  };
+  minitest = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0g73x65hmjph8dg1h3rkzfg7ys3ffxm35hj35grw75fixmq53qyz";
+      type = "gem";
+    };
+    version = "5.14.0";
+  };
+  netrc = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0gzfmcywp1da8nzfqsql2zqi648mfnx6qwkig3cv36n9m0yy676y";
+      type = "gem";
+    };
+    version = "0.11.0";
+  };
+  public_suffix = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1l1kqw75asziwmzrig8rywxswxz8l91sc3pvns02ffsqac1a3wiz";
+      type = "gem";
+    };
+    version = "4.0.4";
+  };
+  require_all = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0sjf2vigdg4wq7z0xlw14zyhcz4992s05wgr2s58kjgin12bkmv8";
+      type = "gem";
+    };
+    version = "2.0.0";
+  };
+  rest-client = {
+    dependencies = ["http-cookie" "mime-types" "netrc"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1hzcs2r7b5bjkf2x2z3n8z6082maz0j8vqjiciwgg3hzb63f958j";
+      type = "gem";
+    };
+    version = "2.0.2";
+  };
+  ruby-progressbar = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0hynaavnqzld17qdx9r7hfw00y16ybldwq730zrqfszjwgi59ivi";
+      type = "gem";
+    };
+    version = "1.7.5";
+  };
+  thread_safe = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0nmhcgq6cgz44srylra07bmaw99f5271l0dpsvl5f75m44l0gmwy";
+      type = "gem";
+    };
+    version = "0.3.6";
+  };
+  tzinfo = {
+    dependencies = ["thread_safe"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1i3jh086w1kbdj3k5l60lc3nwbanmzdf8yjj3mlrx9b2gjjxhi9r";
+      type = "gem";
+    };
+    version = "1.2.7";
+  };
+  unf = {
+    dependencies = ["unf_ext"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0bh2cf73i2ffh4fcpdn9ir4mhq8zi50ik0zqa1braahzadx536a9";
+      type = "gem";
+    };
+    version = "0.1.4";
+  };
+  unf_ext = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0wc47r23h063l8ysws8sy24gzh74mks81cak3lkzlrw4qkqb3sg4";
+      type = "gem";
+    };
+    version = "0.0.7.7";
+  };
+  vpsadmin-client = {
+    dependencies = ["curses" "em-http-request" "eventmachine" "haveapi-client" "json"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0ki3204pkg3f9wk9plbq5n9lrnsmc364smfxyrbq32gi8ag2y2s8";
+      type = "gem";
+    };
+    version = "3.0.0.master.20190517.pre.0.3ab5ddfe";
+  };
+  vpsfree-client = {
+    dependencies = ["vpsadmin-client"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0cs2ibl9kl39hnpzyhyczaqv4i58pn106vx2m6lds9p3av5mcbxs";
+      type = "gem";
+    };
+    version = "0.11.0";
+  };
+  zeitwerk = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1akpm3pwvyiack2zk6giv9yn3cqb8pw6g40p4394pdc3xmy3s4k0";
+      type = "gem";
+    };
+    version = "2.3.0";
+  };
+}
\ No newline at end of file
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 831aa2e45f0c..fb7de0545f31 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1174,6 +1174,8 @@ in
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
+  bat-extras = recurseIntoAttrs (callPackages ../tools/misc/bat-extras { });
+
   bc = callPackage ../tools/misc/bc { };
 
   bdf2psf = callPackage ../tools/misc/bdf2psf { };
@@ -1268,8 +1270,6 @@ in
 
   blockdiag = with python3Packages; toPythonApplication blockdiag;
 
-  blsd = callPackage ../tools/misc/blsd { };
-
   bluez-alsa = callPackage ../tools/bluetooth/bluez-alsa { };
 
   bluez-tools = callPackage ../tools/bluetooth/bluez-tools { };
@@ -2927,9 +2927,7 @@ in
 
   dmd = callPackage ../development/compilers/dmd { };
 
-  dmg2img = callPackage ../tools/misc/dmg2img {
-    openssl = openssl_1_0_2;
-  };
+  dmg2img = callPackage ../tools/misc/dmg2img { };
 
   docbook2odf = callPackage ../tools/typesetting/docbook2odf { };
 
@@ -2974,6 +2972,8 @@ in
 
   driftnet = callPackage ../tools/networking/driftnet {};
 
+  drill = callPackage ../tools/networking/drill { };
+
   drone = callPackage ../development/tools/continuous-integration/drone { };
 
   drone-cli = callPackage ../development/tools/continuous-integration/drone-cli { };
@@ -3064,6 +3064,8 @@ in
 
   kramdown-asciidoc = callPackage ../tools/typesetting/kramdown-asciidoc { };
 
+  magic-vlsi = callPackage ../applications/science/electronics/magic-vlsi { };
+
   mcrcon = callPackage ../tools/networking/mcrcon {};
 
   rage = callPackage ../tools/security/rage {
@@ -3118,6 +3120,8 @@ in
 
   wob = callPackage ../tools/misc/wob { };
 
+  xkcdpass = with pythonPackages; toPythonApplication xkcdpass;
+
   xob = callPackage ../tools/X11/xob { };
 
   z-lua = callPackage ../tools/misc/z-lua { };
@@ -7589,6 +7593,8 @@ in
 
   which = callPackage ../tools/system/which { };
 
+  whsniff = callPackage ../applications/networking/sniffers/whsniff { };
+
   woeusb = callPackage ../tools/misc/woeusb { };
 
   chase = callPackage ../tools/system/chase { };
@@ -9350,6 +9356,8 @@ in
 
   janet = callPackage ../development/interpreters/janet {};
 
+  jelly = callPackage ../development/interpreters/jelly {};
+
   jimtcl = callPackage ../development/interpreters/jimtcl {};
 
   jmeter = callPackage ../applications/networking/jmeter {};
@@ -12201,6 +12209,11 @@ in
     nativeBuildRoot = buildPackages.icu66.override { buildRootOnly = true; };
   } // (stdenv.lib.optionalAttrs (stdenv.hostPlatform.isi686 && stdenv.cc.isGNU) {
       stdenv = gcc6Stdenv; # with gcc-7: undefined reference to `__divmoddi4'
+  }));
+  icu67 = callPackage ../development/libraries/icu/67.nix ({
+    nativeBuildRoot = buildPackages.icu67.override { buildRootOnly = true; };
+  } // (stdenv.lib.optionalAttrs (stdenv.hostPlatform.isi686 && stdenv.cc.isGNU) {
+      stdenv = gcc6Stdenv; # with gcc-7: undefined reference to `__divmoddi4'
     }));
 
   icu = icu64;
@@ -18085,6 +18098,8 @@ in
 
   pop-gtk-theme = callPackage ../data/themes/pop-gtk { };
 
+  pop-icon-theme = callPackage ../data/icons/pop-icon-theme { };
+
   posix_man_pages = callPackage ../data/documentation/man-pages-posix { };
 
   powerline-fonts = callPackage ../data/fonts/powerline-fonts { };
@@ -19789,6 +19804,8 @@ in
 
   hashit = callPackage ../tools/misc/hashit { };
 
+  hactool = callPackage ../tools/compression/hactool { };
+
   heimer = libsForQt5.callPackage ../applications/misc/heimer { };
 
   hello = callPackage ../applications/misc/hello { };
@@ -19828,6 +19845,8 @@ in
 
   howl = callPackage ../applications/editors/howl { };
 
+  hpcg = callPackage ../tools/misc/hpcg/default.nix { };
+
   hpl = callPackage ../tools/misc/hpl { mpi = openmpi; };
 
   hpmyroom = libsForQt5.callPackage ../applications/networking/hpmyroom { };
@@ -21047,7 +21066,7 @@ in
 
   octoprint = callPackage ../applications/misc/octoprint { };
 
-  octoprint-plugins = callPackage ../applications/misc/octoprint/plugins.nix { };
+  octoprint-plugins = throw ''octoprint-plugins are now part of the octoprint.python.pkgs package set.'';
 
   ocrad = callPackage ../applications/graphics/ocrad { };
 
@@ -21059,6 +21078,8 @@ in
 
   omxplayer = callPackage ../applications/video/omxplayer { };
 
+  inherit (python3Packages.callPackage ../applications/networking/onionshare { }) onionshare onionshare-gui;
+
   openbox = callPackage ../applications/window-managers/openbox { };
 
   openbox-menu = callPackage ../applications/misc/openbox-menu {
@@ -21091,6 +21112,8 @@ in
     inherit (pkgs) pkgconfig;
   };
 
+  orca-c = callPackage ../applications/audio/orca-c {};
+
   osm2xmap = callPackage ../applications/misc/osm2xmap {
     libyamlcpp = libyamlcpp_0_3;
   };
@@ -25711,7 +25734,9 @@ in
 
   physlock = callPackage ../misc/screensavers/physlock { };
 
-  pjsip = callPackage ../applications/networking/pjsip { };
+  pjsip = callPackage ../applications/networking/pjsip {
+    inherit (darwin.apple_sdk.frameworks) AppKit;
+  };
 
   pounce = callPackage ../servers/pounce { };
 
@@ -25927,7 +25952,7 @@ in
 
   texFunctions = callPackage ../tools/typesetting/tex/nix pkgs;
 
-  # TeX Live; see http://nixos.org/nixpkgs/manual/#sec-language-texlive
+  # TeX Live; see https://nixos.org/nixpkgs/manual/#sec-language-texlive
   texlive = recurseIntoAttrs
     (callPackage ../tools/typesetting/tex/texlive { });
 
@@ -26444,4 +26469,7 @@ in
   jitsi-meet-electron = callPackage ../applications/networking/instant-messengers/jitsi-meet-electron { };
 
   zenstates = callPackage ../os-specific/linux/zenstates {};
+
+  vpsfree-client = callPackage ../tools/virtualization/vpsfree-client {};
+
 }
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 9517769f7b38..44b90219606e 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -38,11 +38,6 @@ let
 
     async_extra_p4 = callPackage ../development/ocaml-modules/async_extra { };
 
-    async_find =
-      if lib.versionOlder "4.03" ocaml.version
-      then janeStreet.async_find
-      else callPackage ../development/ocaml-modules/async_find { };
-
     async_kernel_p4 = callPackage ../development/ocaml-modules/async_kernel { };
 
     async_unix_p4 = callPackage ../development/ocaml-modules/async_unix { };
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 2f933eeff1f5..daec9dacbe67 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -3224,6 +3224,19 @@ let
     };
   };
 
+  ConvertBencode = buildPerlPackage rec {
+    pname = "Convert-Bencode";
+    version = "1.03";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/O/OR/ORCLEV/${pname}-${version}.tar.gz";
+      sha256 = "0v2ywj18px67mg97xnrdq9mnlzgqvj92pr2g47g9c9b9cpw3v7r6";
+    };
+    meta = {
+      description = "Functions for converting to/from bencoded strings";
+      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
   ConvertColor = buildPerlModule {
     pname = "Convert-Color";
     version = "0.11";
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index 43c4e5fc90d9..9532f113ae3d 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -580,10 +580,10 @@ in
     };
 
     pdo_sqlsrv = buildPecl {
-      version = "5.8.0";
+      version = "5.8.1";
       pname = "pdo_sqlsrv";
 
-      sha256 = "0z4vbyd851b4jr6p69l2ylk91iihndsm2qjb429pxcv8g6dqzqll";
+      sha256 = "06ba4x34fgs092qq9w62y2afsm1nyasqiprirk4951ax9v5vcir0";
 
       internalDeps = [ php.extensions.pdo ];
 
@@ -691,10 +691,10 @@ in
     };
 
     sqlsrv = buildPecl {
-      version = "5.8.0";
+      version = "5.8.1";
       pname = "sqlsrv";
 
-      sha256 = "1kv4krk1w4hri99b0sdgwgy9c4y0yh217wx2y3irhkfi46kdrjnw";
+      sha256 = "0c9a6ghch2537vi0274vx0mn6nb1xg2qv7nprnf3xdfqi5ww1i9r";
 
       buildInputs = [ pkgs.unixODBC ] ++ pkgs.lib.optionals pkgs.stdenv.isDarwin [ pkgs.libiconv ];