about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/languages-frameworks/python.section.md2
-rw-r--r--doc/languages-frameworks/rust.section.md66
-rw-r--r--nixos/doc/manual/installation/installing-from-other-distro.xml2
-rw-r--r--nixos/doc/manual/release-notes/rl-2009.xml39
-rw-r--r--nixos/lib/make-iso9660-image.sh2
-rw-r--r--nixos/modules/installer/cd-dvd/sd-image.nix2
-rw-r--r--nixos/modules/misc/ids.nix2
-rw-r--r--nixos/modules/module-list.nix2
-rw-r--r--nixos/modules/rename.nix6
-rw-r--r--nixos/modules/services/hardware/u2f.nix23
-rw-r--r--nixos/modules/services/networking/corerad.nix45
-rw-r--r--nixos/modules/services/networking/dnschain.nix184
-rw-r--r--nixos/modules/services/networking/namecoind.nix5
-rw-r--r--nixos/modules/system/boot/networkd.nix10
-rw-r--r--nixos/modules/system/boot/resolved.nix1
-rw-r--r--nixos/modules/system/boot/timesyncd.nix1
-rw-r--r--nixos/tests/corerad.nix35
-rw-r--r--pkgs/applications/audio/amarok/default.nix14
-rw-r--r--pkgs/applications/audio/clementine/clementine-spotify-blob-remove-from-build.patch21
-rw-r--r--pkgs/applications/audio/clementine/default.nix41
-rw-r--r--pkgs/applications/audio/dragonfly-reverb/default.nix4
-rw-r--r--pkgs/applications/audio/munt/default.nix8
-rw-r--r--pkgs/applications/audio/sonic-pi/default.nix43
-rw-r--r--pkgs/applications/blockchains/ergo/default.nix4
-rw-r--r--pkgs/applications/editors/neovim/gnvim/default.nix4
-rw-r--r--pkgs/applications/editors/notepadqq/default.nix2
-rw-r--r--pkgs/applications/editors/vscode/vscode.nix6
-rw-r--r--pkgs/applications/editors/vscode/vscodium.nix6
-rw-r--r--pkgs/applications/graphics/drawio/default.nix4
-rw-r--r--pkgs/applications/graphics/yeetgif/default.nix4
-rw-r--r--pkgs/applications/misc/ArchiSteamFarm/default.nix42
-rw-r--r--pkgs/applications/misc/alacritty/default.nix2
-rw-r--r--pkgs/applications/misc/blender/default.nix4
-rw-r--r--pkgs/applications/misc/cointop/default.nix4
-rw-r--r--pkgs/applications/misc/cpu-x/default.nix4
-rw-r--r--pkgs/applications/misc/lyx/default.nix4
-rw-r--r--pkgs/applications/misc/pueue/default.nix6
-rw-r--r--pkgs/applications/misc/qmapshack/default.nix4
-rw-r--r--pkgs/applications/misc/remarkable/remarkable-mouse/default.nix20
-rw-r--r--pkgs/applications/networking/browsers/chromium/plugins.nix4
-rw-r--r--pkgs/applications/networking/browsers/firefox/common.nix6
-rw-r--r--pkgs/applications/networking/browsers/firefox/packages.nix4
-rw-r--r--pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix10
-rw-r--r--pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix6
-rw-r--r--pkgs/applications/networking/cluster/argo/default.nix17
-rw-r--r--pkgs/applications/networking/cluster/helmsman/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/luigi/default.nix7
-rw-r--r--pkgs/applications/networking/cluster/minishift/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/qbec/default.nix6
-rw-r--r--pkgs/applications/networking/dnscontrol/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/bluejeans/default.nix7
-rw-r--r--pkgs/applications/networking/instant-messengers/discord/base.nix1
-rw-r--r--pkgs/applications/networking/mailreaders/mutt/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/thunderbird/default.nix7
-rw-r--r--pkgs/applications/networking/nym/default.nix16
-rw-r--r--pkgs/applications/networking/remote/wayvnc/add-missing-librt.patch20
-rw-r--r--pkgs/applications/networking/remote/wayvnc/default.nix2
-rw-r--r--pkgs/applications/networking/sync/onedrive/default.nix28
-rw-r--r--pkgs/applications/science/biology/picard-tools/default.nix4
-rw-r--r--pkgs/applications/science/logic/lean/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/git/default.nix9
-rw-r--r--pkgs/applications/window-managers/sway/contrib.nix107
-rw-r--r--pkgs/build-support/rust/default.nix50
-rw-r--r--pkgs/data/fonts/fira-code/default.nix5
-rw-r--r--pkgs/development/compilers/binaryen/default.nix4
-rw-r--r--pkgs/development/compilers/rust/cargo.nix3
-rw-r--r--pkgs/development/compilers/rust/clippy.nix3
-rw-r--r--pkgs/development/compilers/rust/rls/default.nix5
-rw-r--r--pkgs/development/compilers/rust/rustfmt.nix9
-rw-r--r--pkgs/development/coq-modules/flocq/default.nix10
-rw-r--r--pkgs/development/interpreters/perl/default.nix16
-rw-r--r--pkgs/development/interpreters/php/default.nix16
-rw-r--r--pkgs/development/interpreters/python/cpython/2.7/default.nix14
-rw-r--r--pkgs/development/interpreters/python/cpython/2.7/profile-task.patch21
-rw-r--r--pkgs/development/interpreters/python/cpython/3.5/profile-task.patch21
-rw-r--r--pkgs/development/interpreters/python/cpython/3.6/profile-task.patch21
-rw-r--r--pkgs/development/interpreters/python/cpython/default.nix22
-rw-r--r--pkgs/development/interpreters/python/default.nix3
-rw-r--r--pkgs/development/interpreters/python/hooks/pip-build-hook.sh3
-rw-r--r--pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh3
-rw-r--r--pkgs/development/libraries/audio/libgme/default.nix12
-rw-r--r--pkgs/development/libraries/dbus/default.nix4
-rw-r--r--pkgs/development/libraries/glibc/2.30-cve-2020-1752.patch62
-rw-r--r--pkgs/development/libraries/glibc/common.nix4
-rw-r--r--pkgs/development/libraries/gnutls/default.nix4
-rw-r--r--pkgs/development/libraries/intel-media-driver/default.nix18
-rw-r--r--pkgs/development/libraries/jbig2dec/default.nix11
-rw-r--r--pkgs/development/libraries/libarchive/default.nix4
-rw-r--r--pkgs/development/libraries/libdap/default.nix4
-rw-r--r--pkgs/development/libraries/libexif/default.nix47
-rw-r--r--pkgs/development/libraries/libgpg-error/default.nix17
-rw-r--r--pkgs/development/libraries/libheif/default.nix4
-rw-r--r--pkgs/development/libraries/liblastfm/default.nix34
-rw-r--r--pkgs/development/libraries/libpcap/default.nix6
-rw-r--r--pkgs/development/libraries/librealsense/default.nix4
-rw-r--r--pkgs/development/libraries/libssh2/CVE-2019-17498.patch210
-rw-r--r--pkgs/development/libraries/libssh2/default.nix8
-rw-r--r--pkgs/development/libraries/libu2f-host/default.nix4
-rw-r--r--pkgs/development/libraries/libxslt/default.nix11
-rw-r--r--pkgs/development/libraries/mesa/default.nix46
-rw-r--r--pkgs/development/libraries/nss/default.nix4
-rw-r--r--pkgs/development/libraries/openh264/default.nix4
-rw-r--r--pkgs/development/libraries/pcre2/default.nix4
-rw-r--r--pkgs/development/libraries/physics/geant4/default.nix25
-rw-r--r--pkgs/development/libraries/physics/geant4/g4py/default.nix65
-rw-r--r--pkgs/development/libraries/physics/geant4/g4py/setup-hook.sh1
-rw-r--r--pkgs/development/libraries/readline/6.3.nix4
-rw-r--r--pkgs/development/libraries/readline/7.0.nix4
-rw-r--r--pkgs/development/libraries/readline/8.0.nix4
-rw-r--r--pkgs/development/libraries/sqlite/analyzer.nix4
-rw-r--r--pkgs/development/libraries/sqlite/default.nix4
-rw-r--r--pkgs/development/libraries/trompeloeil/default.nix4
-rw-r--r--pkgs/development/libraries/uriparser/default.nix12
-rw-r--r--pkgs/development/node-packages/default.nix8
-rw-r--r--pkgs/development/node-packages/node-packages.json1
-rw-r--r--pkgs/development/ocaml-modules/dns/client.nix10
-rw-r--r--pkgs/development/ocaml-modules/dns/default.nix8
-rw-r--r--pkgs/development/ocaml-modules/ocsigen-start/default.nix4
-rw-r--r--pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix4
-rw-r--r--pkgs/development/ocaml-modules/tls/default.nix4
-rw-r--r--pkgs/development/python-modules/Cython/default.nix4
-rw-r--r--pkgs/development/python-modules/GitPython/default.nix4
-rw-r--r--pkgs/development/python-modules/JPype1/default.nix4
-rw-r--r--pkgs/development/python-modules/Mako/default.nix4
-rw-r--r--pkgs/development/python-modules/aioharmony/default.nix4
-rw-r--r--pkgs/development/python-modules/aiohttp/default.nix45
-rw-r--r--pkgs/development/python-modules/aiolifx/default.nix4
-rw-r--r--pkgs/development/python-modules/aioresponses/default.nix4
-rw-r--r--pkgs/development/python-modules/appdirs/default.nix4
-rwxr-xr-xpkgs/development/python-modules/atlassian-python-api/default.nix4
-rw-r--r--pkgs/development/python-modules/autopep8/default.nix4
-rw-r--r--pkgs/development/python-modules/awkward1/default.nix4
-rw-r--r--pkgs/development/python-modules/bids-validator/default.nix4
-rw-r--r--pkgs/development/python-modules/bleak/default.nix4
-rw-r--r--pkgs/development/python-modules/block-io/default.nix4
-rw-r--r--pkgs/development/python-modules/boto3/default.nix4
-rw-r--r--pkgs/development/python-modules/bugsnag/default.nix4
-rw-r--r--pkgs/development/python-modules/buildbot/default.nix4
-rw-r--r--pkgs/development/python-modules/buildbot/pkg.nix2
-rw-r--r--pkgs/development/python-modules/buildbot/plugins.nix10
-rw-r--r--pkgs/development/python-modules/buildbot/worker.nix2
-rw-r--r--pkgs/development/python-modules/can/default.nix4
-rw-r--r--pkgs/development/python-modules/cnvkit/default.nix4
-rw-r--r--pkgs/development/python-modules/coverage/default.nix4
-rw-r--r--pkgs/development/python-modules/croniter/default.nix4
-rw-r--r--pkgs/development/python-modules/django-mailman3/default.nix4
-rw-r--r--pkgs/development/python-modules/django_modelcluster/default.nix4
-rw-r--r--pkgs/development/python-modules/dnslib/default.nix4
-rw-r--r--pkgs/development/python-modules/doc8/default.nix4
-rw-r--r--pkgs/development/python-modules/docker/default.nix4
-rw-r--r--pkgs/development/python-modules/dockerfile-parse/default.nix4
-rw-r--r--pkgs/development/python-modules/dot2tex/default.nix24
-rw-r--r--pkgs/development/python-modules/dot2tex/path.patch104
-rw-r--r--pkgs/development/python-modules/dot2tex/test.patch12
-rw-r--r--pkgs/development/python-modules/elasticsearch-dsl/default.nix4
-rw-r--r--pkgs/development/python-modules/elasticsearch/default.nix4
-rw-r--r--pkgs/development/python-modules/eve/default.nix4
-rw-r--r--pkgs/development/python-modules/fake-useragent/default.nix22
-rw-r--r--pkgs/development/python-modules/flask-sqlalchemy/default.nix4
-rw-r--r--pkgs/development/python-modules/geoalchemy2/default.nix4
-rw-r--r--pkgs/development/python-modules/google_cloud_resource_manager/default.nix4
-rw-r--r--pkgs/development/python-modules/google_resumable_media/default.nix4
-rw-r--r--pkgs/development/python-modules/greenlet/default.nix4
-rw-r--r--pkgs/development/python-modules/hsaudiotag3k/default.nix4
-rw-r--r--pkgs/development/python-modules/httplib2/default.nix4
-rw-r--r--pkgs/development/python-modules/hvac/default.nix4
-rw-r--r--pkgs/development/python-modules/identify/default.nix4
-rw-r--r--pkgs/development/python-modules/importlib-metadata/default.nix6
-rw-r--r--pkgs/development/python-modules/importlib-resources/default.nix14
-rw-r--r--pkgs/development/python-modules/ipython/7.9.nix2
-rw-r--r--pkgs/development/python-modules/ipython/default.nix4
-rw-r--r--pkgs/development/python-modules/isbnlib/default.nix4
-rw-r--r--pkgs/development/python-modules/jupyter_client/5.nix2
-rw-r--r--pkgs/development/python-modules/jupyterlab/default.nix4
-rw-r--r--pkgs/development/python-modules/jupyterlab_server/default.nix4
-rw-r--r--pkgs/development/python-modules/keras-preprocessing/default.nix4
-rw-r--r--pkgs/development/python-modules/kombu/default.nix4
-rw-r--r--pkgs/development/python-modules/libevdev/default.nix21
-rw-r--r--pkgs/development/python-modules/mailmanclient/default.nix8
-rw-r--r--pkgs/development/python-modules/meinheld/default.nix4
-rw-r--r--pkgs/development/python-modules/msgpack-numpy/default.nix4
-rw-r--r--pkgs/development/python-modules/multidict/default.nix4
-rw-r--r--pkgs/development/python-modules/nbformat/2.nix2
-rw-r--r--pkgs/development/python-modules/notebook/2.nix2
-rw-r--r--pkgs/development/python-modules/numpy/default.nix4
-rw-r--r--pkgs/development/python-modules/pandas/default.nix4
-rw-r--r--pkgs/development/python-modules/phik/default.nix4
-rw-r--r--pkgs/development/python-modules/phonenumbers/default.nix2
-rw-r--r--pkgs/development/python-modules/pyenchant/default.nix4
-rw-r--r--pkgs/development/python-modules/pyhomematic/default.nix4
-rw-r--r--pkgs/development/python-modules/pynput/default.nix25
-rw-r--r--pkgs/development/python-modules/pysonos/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-flake8/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest/default.nix4
-rw-r--r--pkgs/development/python-modules/python-miio/default.nix4
-rw-r--r--pkgs/development/python-modules/pytrends/default.nix4
-rw-r--r--pkgs/development/python-modules/readthedocs-sphinx-ext/default.nix4
-rw-r--r--pkgs/development/python-modules/restructuredtext_lint/default.nix4
-rw-r--r--pkgs/development/python-modules/rethinkdb/default.nix4
-rw-r--r--pkgs/development/python-modules/scrapy-deltafetch/default.nix22
-rw-r--r--pkgs/development/python-modules/scrapy-fake-useragent/default.nix21
-rw-r--r--pkgs/development/python-modules/scrapy-splash/default.nix20
-rw-r--r--pkgs/development/python-modules/screeninfo/default.nix35
-rw-r--r--pkgs/development/python-modules/setuptools-lint/default.nix21
-rw-r--r--pkgs/development/python-modules/snapcast/default.nix4
-rw-r--r--pkgs/development/python-modules/snowflake-connector-python/default.nix4
-rw-r--r--pkgs/development/python-modules/snscrape/default.nix4
-rw-r--r--pkgs/development/python-modules/somajo/default.nix4
-rw-r--r--pkgs/development/python-modules/soupsieve/default.nix4
-rw-r--r--pkgs/development/python-modules/sphinxcontrib-katex/default.nix4
-rw-r--r--pkgs/development/python-modules/sqlalchemy/default.nix4
-rw-r--r--pkgs/development/python-modules/sqlmap/default.nix4
-rw-r--r--pkgs/development/python-modules/stytra/default.nix4
-rw-r--r--pkgs/development/python-modules/toml/default.nix4
-rw-r--r--pkgs/development/python-modules/tqdm/default.nix4
-rw-r--r--pkgs/development/python-modules/trimesh/default.nix4
-rw-r--r--pkgs/development/python-modules/txdbus/default.nix4
-rw-r--r--pkgs/development/python-modules/uproot/default.nix4
-rw-r--r--pkgs/development/python-modules/vertica-python/default.nix4
-rw-r--r--pkgs/development/python-modules/zeroc-ice/default.nix4
-rw-r--r--pkgs/development/python-modules/zeroconf/default.nix4
-rw-r--r--pkgs/development/python-modules/zope_interface/default.nix8
-rw-r--r--pkgs/development/python-modules/zstd/default.nix4
-rw-r--r--pkgs/development/tools/analysis/flow/default.nix4
-rw-r--r--pkgs/development/tools/analysis/tfsec/default.nix4
-rw-r--r--pkgs/development/tools/cloudfoundry-cli/default.nix4
-rw-r--r--pkgs/development/tools/continuous-integration/buildkite-cli/default.nix26
-rw-r--r--pkgs/development/tools/continuous-integration/fly/default.nix6
-rw-r--r--pkgs/development/tools/dapper/default.nix4
-rw-r--r--pkgs/development/tools/delve/default.nix4
-rw-r--r--pkgs/development/tools/doctl/default.nix4
-rw-r--r--pkgs/development/tools/gauge/default.nix4
-rw-r--r--pkgs/development/tools/lazygit/default.nix4
-rw-r--r--pkgs/development/tools/misc/autogen/default.nix62
-rw-r--r--pkgs/development/tools/misc/autogen/pkg-config-use-var.patch13
-rw-r--r--pkgs/development/tools/misc/circleci-cli/default.nix4
-rw-r--r--pkgs/development/tools/misc/gdb/default.nix4
-rw-r--r--pkgs/development/tools/misc/libtool/libtool2.nix4
-rw-r--r--pkgs/development/tools/misc/pkgconf/default.nix4
-rw-r--r--pkgs/development/tools/ocaml/js_of_ocaml/3.0.nix18
-rw-r--r--pkgs/development/tools/ocaml/js_of_ocaml/default.nix42
-rw-r--r--pkgs/development/tools/ocaml/merlin/default.nix4
-rw-r--r--pkgs/development/tools/rust/rust-analyzer/generic.nix4
-rw-r--r--pkgs/development/tools/skaffold/default.nix4
-rw-r--r--pkgs/development/web/cypress/default.nix4
-rw-r--r--pkgs/games/steam/runtime.nix19
-rw-r--r--pkgs/misc/ghostscript/0001-Bug-702364-Fix-missing-echogs-dependencies.patch105
-rw-r--r--pkgs/misc/ghostscript/default.nix9
-rw-r--r--pkgs/misc/vim-plugins/generated.nix330
-rw-r--r--pkgs/os-specific/darwin/yabai/default.nix4
-rw-r--r--pkgs/os-specific/linux/fscrypt/default.nix4
-rw-r--r--pkgs/os-specific/linux/fuse/default.nix4
-rw-r--r--pkgs/os-specific/linux/iproute/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix5
-rw-r--r--pkgs/os-specific/linux/kernel/hardened/patches.json24
-rw-r--r--pkgs/os-specific/linux/kernel/linux-testing.nix6
-rw-r--r--pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix3
-rw-r--r--pkgs/servers/consul/default.nix4
-rw-r--r--pkgs/servers/mail/mailman/default.nix4
-rw-r--r--pkgs/servers/mail/mailman/hyperkitty.nix4
-rw-r--r--pkgs/servers/mail/mailman/postorius.nix4
-rw-r--r--pkgs/servers/mail/postfix/default.nix4
-rw-r--r--pkgs/servers/sql/postgresql/default.nix20
-rw-r--r--pkgs/shells/fish/default.nix4
-rw-r--r--pkgs/tools/audio/video2midi/default.nix4
-rw-r--r--pkgs/tools/compression/zstd/default.nix6
-rw-r--r--pkgs/tools/filesystems/btrfs-progs/default.nix4
-rw-r--r--pkgs/tools/misc/chezmoi/default.nix6
-rw-r--r--pkgs/tools/misc/diffoscope/default.nix14
-rw-r--r--pkgs/tools/misc/fontforge/default.nix35
-rw-r--r--pkgs/tools/misc/hexyl/default.nix6
-rw-r--r--pkgs/tools/misc/lazydocker/default.nix4
-rw-r--r--pkgs/tools/misc/pistol/default.nix6
-rw-r--r--pkgs/tools/misc/rmlint/default.nix4
-rw-r--r--pkgs/tools/misc/topgrade/default.nix6
-rw-r--r--pkgs/tools/misc/ttwatch/default.nix14
-rw-r--r--pkgs/tools/networking/amass/default.nix6
-rw-r--r--pkgs/tools/networking/cassowary/default.nix6
-rw-r--r--pkgs/tools/networking/findomain/default.nix6
-rw-r--r--pkgs/tools/package-management/cargo-deb/default.nix11
-rw-r--r--pkgs/tools/package-management/nix-universal-prefetch/default.nix4
-rw-r--r--pkgs/tools/package-management/rpm/default.nix8
-rw-r--r--pkgs/tools/security/bundler-audit/Gemfile.lock6
-rw-r--r--pkgs/tools/security/bundler-audit/default.nix1
-rw-r--r--pkgs/tools/security/bundler-audit/gemset.nix12
-rw-r--r--pkgs/tools/security/chipsec/default.nix4
-rw-r--r--pkgs/tools/security/keybase/default.nix4
-rw-r--r--pkgs/tools/security/keycard-cli/default.nix4
-rw-r--r--pkgs/tools/security/ripasso/cursive.nix2
-rw-r--r--pkgs/tools/security/ripasso/fix-tests.patch35
-rw-r--r--pkgs/tools/security/saml2aws/default.nix4
-rw-r--r--pkgs/tools/system/gotop/default.nix6
-rw-r--r--pkgs/tools/system/inxi/default.nix4
-rw-r--r--pkgs/tools/text/highlight/default.nix4
-rw-r--r--pkgs/tools/typesetting/scdoc/default.nix5
-rw-r--r--pkgs/tools/video/rav1e/default.nix32
-rw-r--r--pkgs/top-level/aliases.nix2
-rw-r--r--pkgs/top-level/all-packages.nix50
-rw-r--r--pkgs/top-level/ocaml-packages.nix10
-rw-r--r--pkgs/top-level/perl-packages.nix16
-rw-r--r--pkgs/top-level/python-packages.nix27
-rw-r--r--pkgs/top-level/release-lib.nix2
303 files changed, 2291 insertions, 1513 deletions
diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 838426afa04f..7da839ee4826 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -643,7 +643,7 @@ and in this case the `python38` interpreter is automatically used.
 Versions 2.7, 3.5, 3.6, 3.7 and 3.8 of the CPython interpreter are available as
 respectively `python27`, `python35`, `python36`, `python37` and `python38`. The
 aliases `python2` and `python3` correspond to respectively `python27` and
-`python37`. The default interpreter, `python`, maps to `python2`. The PyPy
+`python38`. The default interpreter, `python`, maps to `python2`. The PyPy
 interpreters compatible with Python 2.7 and 3 are available as `pypy27` and
 `pypy3`, with aliases `pypy2` mapping to `pypy27` and `pypy` mapping to `pypy2`.
 The Nix expressions for the interpreters can be found in
diff --git a/doc/languages-frameworks/rust.section.md b/doc/languages-frameworks/rust.section.md
index f56bc5285b93..ec418c563359 100644
--- a/doc/languages-frameworks/rust.section.md
+++ b/doc/languages-frameworks/rust.section.md
@@ -75,6 +75,72 @@ pkgs.rustPlatform.buildRustPackage {
 }
 ```
 
+### Running package tests
+
+When using `buildRustPackage`, the `checkPhase` is enabled by default and runs
+`cargo test` on the package to build. To make sure that we don't compile the
+sources twice and to actually test the artifacts that will be used at runtime, 
+the tests will be ran in the `release` mode by default.
+
+However, in some cases the test-suite of a package doesn't work properly in the
+`release` mode. For these situations, the mode for `checkPhase` can be changed like
+so:
+
+```nix
+rustPlatform.buildRustPackage {
+  /* ... */
+  checkType = "debug";
+}
+```
+
+Please note that the code will be compiled twice here: once in `release` mode
+for the `buildPhase`, and again in `debug` mode for the `checkPhase`.
+
+#### Tests relying on the structure of the `target/` directory
+
+Some tests may rely on the structure of the `target/` directory. Those tests
+are likely to fail because we use `cargo --target` during the build. This means that
+the artifacts
+[are stored in `target/<architecture>/release/`](https://doc.rust-lang.org/cargo/guide/build-cache.html),
+rather than in `target/release/`.
+
+This can only be worked around by patching the affected tests accordingly.
+
+#### Disabling package-tests
+
+In some instances, it may be necessary to disable testing altogether (with `doCheck = false;`):
+
+* If no tests exist -- the `checkPhase` should be explicitly disabled to skip
+  unnecessary build steps to speed up the build.
+* If tests are highly impure (e.g. due to network usage).
+
+There will obviously be some corner-cases not listed above where it's sensible to disable tests.
+The above are just guidelines, and exceptions may be granted on a case-by-case basis.
+
+However, please check if it's possible to disable a problematic subset of the
+test suite and leave a comment explaining your reasoning.
+
+### Building a package in `debug` mode
+
+By default, `buildRustPackage` will use `release` mode for builds. If a package
+should be built in `debug` mode, it can be configured like so:
+
+```nix
+rustPlatform.buildRustPackage {
+  /* ... */
+  buildType = "debug";
+}
+```
+
+In this scenario, the `checkPhase` will be ran in `debug` mode as well.
+
+### Custom `build`/`install`-procedures
+
+Some packages may use custom scripts for building/installing, e.g. with a `Makefile`.
+In these cases, it's recommended to override the `buildPhase`/`installPhase`/`checkPhase`.
+
+Otherwise, some steps may fail because of the modified directory structure of `target/`.
+
 ### Building a crate with an absent or out-of-date Cargo.lock file
 
 `buildRustPackage` needs a `Cargo.lock` file to get all dependencies in the
diff --git a/nixos/doc/manual/installation/installing-from-other-distro.xml b/nixos/doc/manual/installation/installing-from-other-distro.xml
index 8ed45899fd7f..45d68f8787f1 100644
--- a/nixos/doc/manual/installation/installing-from-other-distro.xml
+++ b/nixos/doc/manual/installation/installing-from-other-distro.xml
@@ -89,7 +89,7 @@ nixpkgs https://nixos.org/channels/nixpkgs-unstable</screen>
     NixOS partition. They are installed by default on NixOS, but you don't have
     NixOS yet..
    </para>
-<screen><prompt>$ </prompt>nix-env -iE "_: with import &lt;nixpkgs/nixos&gt; { configuration = {}; }; with config.system.build; [ nixos-generate-config nixos-install nixos-enter manual.manpages ]"</screen>
+<screen><prompt>$ </prompt>nix-env -f '&lt;nixpkgs/nixos&gt;' --arg configuration {} -iA config.system.build.{nixos-generate-config,nixos-install,nixos-enter,manual.manpages}</screen>
   </listitem>
   <listitem>
    <note>
diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml
index be7f176614c9..a8a16bcc14fd 100644
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@@ -44,6 +44,11 @@
    </listitem>
    <listitem>
     <para>
+     Python 3 now defaults to Python 3.8 instead of 3.7.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
      Two new options, <link linkend="opt-services.openssh.authorizedKeysCommand">authorizedKeysCommand</link>
      and <link linkend="opt-services.openssh.authorizedKeysCommandUser">authorizedKeysCommandUser</link>, have
      been added to the <literal>openssh</literal> module. If you have <literal>AuthorizedKeysCommand</literal>
@@ -461,6 +466,14 @@ systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
      initrd file has not been deleted.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     The <link xlink:href="https://github.com/okTurtles/dnschain">DNSChain</link>
+     package and NixOS module have been removed from Nixpkgs as the software is
+     unmaintained and can't be built. For more information see issue
+     <link xlink:href="https://github.com/NixOS/nixpkgs/issues/89205">#89205</link>.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 
@@ -473,7 +486,7 @@ systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
 
   <itemizedlist>
    <listitem>
-     <para>SD and ISO images are now compressed by default using <literal>zstd</literal>.</para>
+    <para>SD images are now compressed by default using <literal>zstd</literal>. The compression for ISO images has also been changed to <literal>zstd</literal>, but ISO images are still not compressed by default.</para>
    </listitem>
    <listitem>
     <para>
@@ -492,9 +505,21 @@ systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
     </para>
    </listitem>
    <listitem>
-   <para>
-     The default output of <literal>buildGoPackage</literal> is now <literal>$out</literal> instead of <literal>$bin</literal>.
-   </para>
+    <para>
+      The default output of <literal>buildGoPackage</literal> is now <literal>$out</literal> instead of <literal>$bin</literal>.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     Packages built using <literal>buildRustPackage</literal> now use <literal>release</literal>
+     mode for the <literal>checkPhase</literal> by default.
+    </para>
+    <para>
+     Please note that Rust packages utilizing a custom build/install procedure
+     (e.g. by using a <filename>Makefile</filename>) or test suites that rely on the
+     structure of the <filename>target/</filename> directory may break due to those assumptions.
+     For further information, please read the Rust section in the Nixpkgs manual.
+    </para>
    </listitem>
    <listitem>
    <para>
@@ -535,6 +560,12 @@ systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
      <link xlink:href="https://grafana.com/docs/grafana/latest/installation/upgrading/#upgrading-to-v7-0">in the Grafana documentation</link>.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     The <literal>hardware.u2f</literal> module, which was installing udev rules
+     was removed, as udev gained native support to handle FIDO security tokens.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 </section>
diff --git a/nixos/lib/make-iso9660-image.sh b/nixos/lib/make-iso9660-image.sh
index eb9edcd70269..d64fe9a365e7 100644
--- a/nixos/lib/make-iso9660-image.sh
+++ b/nixos/lib/make-iso9660-image.sh
@@ -129,7 +129,7 @@ fi
 
 if test -n "$compressImage"; then
     echo "Compressing image..."
-    zstd -T$NIX_BUILD_CORES $out/iso/$isoName
+    zstd -T$NIX_BUILD_CORES --rm $out/iso/$isoName
 fi
 
 mkdir -p $out/nix-support
diff --git a/nixos/modules/installer/cd-dvd/sd-image.nix b/nixos/modules/installer/cd-dvd/sd-image.nix
index 589bf74263b9..98c12e30633c 100644
--- a/nixos/modules/installer/cd-dvd/sd-image.nix
+++ b/nixos/modules/installer/cd-dvd/sd-image.nix
@@ -190,7 +190,7 @@ in
         fsck.vfat -vn firmware_part.img
         dd conv=notrunc if=firmware_part.img of=$img seek=$START count=$SECTORS
         if test -n "$compressImage"; then
-            zstd -T$NIX_BUILD_CORES $img
+            zstd -T$NIX_BUILD_CORES --rm $img
         fi
       '';
     }) {};
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index 85e5534e906f..3409e7ba22ea 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -239,7 +239,6 @@ in
       shout = 206;
       gateone = 207;
       namecoin = 208;
-      dnschain = 209;
       #lxd = 210; # unused
       kibana = 211;
       xtreemfs = 212;
@@ -549,7 +548,6 @@ in
       #shout = 206; #unused
       gateone = 207;
       namecoin = 208;
-      #dnschain = 209; #unused
       lxd = 210; # unused
       #kibana = 211;
       xtreemfs = 212;
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 5c5281b730f3..8a517314429f 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -362,7 +362,6 @@
   ./services/hardware/throttled.nix
   ./services/hardware/trezord.nix
   ./services/hardware/triggerhappy.nix
-  ./services/hardware/u2f.nix
   ./services/hardware/udev.nix
   ./services/hardware/udisks2.nix
   ./services/hardware/upower.nix
@@ -602,7 +601,6 @@
   ./services/networking/dhcpcd.nix
   ./services/networking/dhcpd.nix
   ./services/networking/dnscache.nix
-  ./services/networking/dnschain.nix
   ./services/networking/dnscrypt-proxy2.nix
   ./services/networking/dnscrypt-wrapper.nix
   ./services/networking/dnsdist.nix
diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix
index c91febdb710f..1dc7f8533176 100644
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -55,6 +55,12 @@ with lib;
       prey-bash-client is deprecated upstream
     '')
 
+    (mkRemovedOptionModule ["hardware" "u2f" ] ''
+      The U2F modules module was removed, as all it did was adding the
+      udev rules from libu2f-host to the system. Udev gained native support
+      to handle FIDO security tokens, so this isn't necessary anymore.
+    '')
+
     # Do NOT add any option renames here, see top of the file
   ];
 }
diff --git a/nixos/modules/services/hardware/u2f.nix b/nixos/modules/services/hardware/u2f.nix
deleted file mode 100644
index bb4b2f05f890..000000000000
--- a/nixos/modules/services/hardware/u2f.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-let
-  cfg = config.hardware.u2f;
-in {
-  options = {
-    hardware.u2f = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Enable U2F hardware support.
-        '';
-      };
-    };
-  };
-
-  config = mkIf cfg.enable {
-    services.udev.packages = [ pkgs.libu2f-host ];
-  };
-}
-
diff --git a/nixos/modules/services/networking/corerad.nix b/nixos/modules/services/networking/corerad.nix
index 1a2c4aec6651..5d73c0a0d779 100644
--- a/nixos/modules/services/networking/corerad.nix
+++ b/nixos/modules/services/networking/corerad.nix
@@ -4,14 +4,50 @@ with lib;
 
 let
   cfg = config.services.corerad;
+
+  writeTOML = name: x:
+    pkgs.runCommandNoCCLocal name {
+      passAsFile = ["config"];
+      config = builtins.toJSON x;
+      buildInputs = [ pkgs.go-toml ];
+    } "jsontoml < $configPath > $out";
+
 in {
-  meta = {
-    maintainers = with maintainers; [ mdlayher ];
-  };
+  meta.maintainers = with maintainers; [ mdlayher ];
 
   options.services.corerad = {
     enable = mkEnableOption "CoreRAD IPv6 NDP RA daemon";
 
+    settings = mkOption {
+      type = types.uniq types.attrs;
+      example = literalExample ''
+        {
+          interfaces = [
+            # eth0 is an upstream interface monitoring for IPv6 router advertisements.
+            {
+              name = "eth0";
+              monitor = true;
+            }
+            # eth1 is a downstream interface advertising IPv6 prefixes for SLAAC.
+            {
+              name = "eth1";
+              advertise = true;
+              prefix = [{ prefix = "::/64"; }];
+            }
+          ];
+          # Optionally enable Prometheus metrics.
+          debug = {
+            address = "localhost:9430";
+            prometheus = true;
+          };
+        }
+      '';
+      description = ''
+        Configuration for CoreRAD, see <link xlink:href="https://github.com/mdlayher/corerad/blob/master/internal/config/default.toml"/>
+        for supported values. Ignored if configFile is set.
+      '';
+    };
+
     configFile = mkOption {
       type = types.path;
       example = literalExample "\"\${pkgs.corerad}/etc/corerad/corerad.toml\"";
@@ -27,6 +63,9 @@ in {
   };
 
   config = mkIf cfg.enable {
+    # Prefer the config file over settings if both are set.
+    services.corerad.configFile = mkDefault (writeTOML "corerad.toml" cfg.settings);
+
     systemd.services.corerad = {
       description = "CoreRAD IPv6 NDP RA daemon";
       after = [ "network.target" ];
diff --git a/nixos/modules/services/networking/dnschain.nix b/nixos/modules/services/networking/dnschain.nix
deleted file mode 100644
index 003609ea7054..000000000000
--- a/nixos/modules/services/networking/dnschain.nix
+++ /dev/null
@@ -1,184 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  cfgs = config.services;
-  cfg  = cfgs.dnschain;
-
-  dataDir  = "/var/lib/dnschain";
-  username = "dnschain";
-
-  configFile = pkgs.writeText "dnschain.conf" ''
-    [log]
-    level = info
-
-    [dns]
-    host = ${cfg.dns.address}
-    port = ${toString cfg.dns.port}
-    oldDNSMethod = NO_OLD_DNS
-    externalIP = ${cfg.dns.externalAddress}
-
-    [http]
-    host = ${cfg.api.hostname}
-    port = ${toString cfg.api.port}
-    tlsPort = ${toString cfg.api.tlsPort}
-
-    ${cfg.extraConfig}
-  '';
-
-in
-
-{
-
-  ###### interface
-
-  options = {
-
-    services.dnschain = {
-
-      enable = mkEnableOption ''
-        DNSChain, a blockchain based DNS + HTTP server.
-        To resolve .bit domains set <literal>services.namecoind.enable = true;</literal>
-        and an RPC username/password.
-      '';
-
-      dns.address = mkOption {
-        type = types.str;
-        default = "127.0.0.1";
-        description = ''
-          The IP address the DNSChain resolver will bind to.
-          Leave this unchanged if you do not wish to directly expose the resolver.
-        '';
-      };
-
-      dns.externalAddress = mkOption {
-        type = types.str;
-        default = cfg.dns.address;
-        description = ''
-           The IP address used by clients to reach the resolver and the value of
-           the <literal>namecoin.dns</literal> record. Set this in case the bind address
-           is not the actual IP address (e.g. the machine is behind a NAT).
-        '';
-      };
-
-      dns.port = mkOption {
-        type = types.int;
-        default = 5333;
-        description = ''
-          The port the DNSChain resolver will bind to.
-        '';
-      };
-
-      api.hostname = mkOption {
-        type = types.str;
-        default = "0.0.0.0";
-        description = ''
-          The hostname (or IP address) the DNSChain API server will bind to.
-        '';
-      };
-
-      api.port = mkOption {
-        type = types.int;
-        default = 8080;
-        description = ''
-          The port the DNSChain API server (HTTP) will bind to.
-        '';
-      };
-
-      api.tlsPort = mkOption {
-        type = types.int;
-        default = 4433;
-        description = ''
-          The port the DNSChain API server (HTTPS) will bind to.
-        '';
-      };
-
-      extraConfig = mkOption {
-        type = types.lines;
-        default = "";
-        example = ''
-          [log]
-          level = debug
-        '';
-        description = ''
-          Additional options that will be appended to the configuration file.
-        '';
-      };
-
-    };
-
-    services.dnsmasq.resolveDNSChainQueries = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-        Resolve <literal>.bit</literal> top-level domains using DNSChain and namecoin.
-      '';
-    };
-
-    services.pdns-recursor.resolveDNSChainQueries = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-        Resolve <literal>.bit</literal> top-level domains using DNSChain and namecoin.
-      '';
-    };
-
-  };
-
-
-  ###### implementation
-
-  config = mkIf cfg.enable {
-
-    services.dnsmasq.servers = optionals cfgs.dnsmasq.resolveDNSChainQueries
-      [ "/.bit/127.0.0.1#${toString cfg.dns.port}"
-        "/.dns/127.0.0.1#${toString cfg.dns.port}"
-      ];
-
-    services.pdns-recursor = mkIf cfgs.pdns-recursor.resolveDNSChainQueries {
-      forwardZonesRecurse =
-        { bit = "127.0.0.1:${toString cfg.dns.port}";
-          dns = "127.0.0.1:${toString cfg.dns.port}";
-        };
-      luaConfig =''
-        addNTA("bit", "namecoin doesn't support DNSSEC")
-        addNTA("dns", "namecoin doesn't support DNSSEC")
-      '';
-    };
-
-    users.users.${username} = {
-      description = "DNSChain daemon user";
-      home = dataDir;
-      createHome = true;
-      uid = config.ids.uids.dnschain;
-      extraGroups = optional cfgs.namecoind.enable "namecoin";
-    };
-
-    systemd.services.dnschain = {
-      description = "DNSChain daemon";
-      after    = optional cfgs.namecoind.enable "namecoind.target";
-      wantedBy = [ "multi-user.target" ];
-
-      serviceConfig = {
-        User = "dnschain";
-        Restart = "on-failure";
-        ExecStart = "${pkgs.nodePackages.dnschain}/bin/dnschain";
-      };
-
-      preStart = ''
-        # Link configuration file into dnschain home directory
-        configPath=${dataDir}/.dnschain/dnschain.conf
-        mkdir -p ${dataDir}/.dnschain
-        if [ "$(realpath $configPath)" != "${configFile}" ]; then
-          rm -f $configPath
-          ln -s ${configFile} $configPath
-        fi
-      '';
-    };
-
-  };
-
-  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
-
-}
diff --git a/nixos/modules/services/networking/namecoind.nix b/nixos/modules/services/networking/namecoind.nix
index ead7f0859434..6ca99e1321bd 100644
--- a/nixos/modules/services/networking/namecoind.nix
+++ b/nixos/modules/services/networking/namecoind.nix
@@ -149,11 +149,6 @@ in
 
   config = mkIf cfg.enable {
 
-    services.dnschain.extraConfig = ''
-      [namecoin]
-      config = ${configFile}
-    '';
-
     users.users.namecoin = {
       uid  = config.ids.uids.namecoin;
       description = "Namecoin daemon user";
diff --git a/nixos/modules/system/boot/networkd.nix b/nixos/modules/system/boot/networkd.nix
index 9b34b12e73a5..b0545363b330 100644
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@@ -1178,14 +1178,22 @@ in
       users.users.systemd-network.group = "systemd-network";
 
       systemd.additionalUpstreamSystemUnits = [
-        "systemd-networkd.service" "systemd-networkd-wait-online.service"
+        "systemd-networkd-wait-online.service"
+        "systemd-networkd.service"
+        "systemd-networkd.socket"
       ];
 
       systemd.network.units = mapAttrs' (n: v: nameValuePair "${n}.netdev" (netdevToUnit n v)) cfg.netdevs
         // mapAttrs' (n: v: nameValuePair "${n}.network" (networkToUnit n v)) cfg.networks;
 
+      # systemd-networkd is socket-activated by kernel netlink route change
+      # messages. It is important to have systemd buffer those on behalf of
+      # networkd.
+      systemd.sockets.systemd-networkd.wantedBy = [ "sockets.target" ];
+
       systemd.services.systemd-networkd = {
         wantedBy = [ "multi-user.target" ];
+        aliases = [ "dbus-org.freedesktop.network1.service" ];
         restartTriggers = map (x: x.source) (attrValues unitFiles);
         # prevent race condition with interface renaming (#39069)
         requires = [ "systemd-udev-settle.service" ];
diff --git a/nixos/modules/system/boot/resolved.nix b/nixos/modules/system/boot/resolved.nix
index b7aaef575ac1..b024f9cf5ee9 100644
--- a/nixos/modules/system/boot/resolved.nix
+++ b/nixos/modules/system/boot/resolved.nix
@@ -148,6 +148,7 @@ in
 
     systemd.services.systemd-resolved = {
       wantedBy = [ "multi-user.target" ];
+      aliases = [ "dbus-org.freedesktop.resolve1.service" ];
       restartTriggers = [ config.environment.etc."systemd/resolved.conf".source ];
     };
 
diff --git a/nixos/modules/system/boot/timesyncd.nix b/nixos/modules/system/boot/timesyncd.nix
index 9e2f36ca01f8..35fb5578b070 100644
--- a/nixos/modules/system/boot/timesyncd.nix
+++ b/nixos/modules/system/boot/timesyncd.nix
@@ -41,6 +41,7 @@ with lib;
 
     systemd.services.systemd-timesyncd = {
       wantedBy = [ "sysinit.target" ];
+      aliases = [ "dbus-org.freedesktop.timesync1.service" ];
       restartTriggers = [ config.environment.etc."systemd/timesyncd.conf".source ];
     };
 
diff --git a/nixos/tests/corerad.nix b/nixos/tests/corerad.nix
index 741fa448f680..72ab255b1916 100644
--- a/nixos/tests/corerad.nix
+++ b/nixos/tests/corerad.nix
@@ -3,7 +3,7 @@ import ./make-test-python.nix (
     nodes = {
       router = {config, pkgs, ...}: { 
         config = {
-          # This machines simulates a router with IPv6 forwarding and a static IPv6 address.
+          # This machine simulates a router with IPv6 forwarding and a static IPv6 address.
           boot.kernel.sysctl = {
             "net.ipv6.conf.all.forwarding" = true;
           };
@@ -14,13 +14,25 @@ import ./make-test-python.nix (
             enable = true;
             # Serve router advertisements to the client machine with prefix information matching
             # any IPv6 /64 prefixes configured on this interface.
-            configFile = pkgs.writeText "corerad.toml" ''
-              [[interfaces]]
-              name = "eth1"
-              advertise = true
-                [[interfaces.prefix]]
-                prefix = "::/64"
-            '';
+            #
+            # This configuration is identical to the example in the CoreRAD NixOS module.
+            settings = {
+              interfaces = [
+                {
+                  name = "eth0";
+                  monitor = true;
+                }
+                {
+                  name = "eth1";
+                  advertise = true;
+                  prefix = [{ prefix = "::/64"; }];
+                }
+              ];
+              debug = {
+                address = "localhost:9430";
+                prometheus = true;
+              };
+            };
           };
         };
       };
@@ -66,5 +78,12 @@ import ./make-test-python.nix (
           assert (
               "/64 scope global temporary" in addrs
           ), "SLAAC temporary address was not configured on client after router advertisement"
+
+      with subtest("Verify HTTP debug server is configured"):
+          out = router.succeed("curl localhost:9430/metrics")
+
+          assert (
+              "corerad_build_info" in out
+          ), "Build info metric was not found in Prometheus output"
     '';
   })
diff --git a/pkgs/applications/audio/amarok/default.nix b/pkgs/applications/audio/amarok/default.nix
index 29d97d8bc8ab..063cfcaa9fae 100644
--- a/pkgs/applications/audio/amarok/default.nix
+++ b/pkgs/applications/audio/amarok/default.nix
@@ -3,21 +3,21 @@
 , qca-qt5, qjson, qtquickcontrols2, qtscript, qtwebengine
 , karchive, kcmutils, kconfig, kdnssd, kguiaddons, kinit, kirigami2, knewstuff, knotifyconfig, ktexteditor, kwindowsystem
 , fftw, phonon, plasma-framework, threadweaver
-, curl, ffmpeg_3, gdk-pixbuf, libaio, libmtp, loudmouth, lzo, lz4, mysql57, pcre, snappy, taglib, taglib_extras
+, curl, ffmpeg_3, gdk-pixbuf, libaio, liblastfm, libmtp, loudmouth, lzo, lz4, mysql57, pcre, snappy, taglib, taglib_extras
 }:
 
 mkDerivation rec {
-  pname = "amarok";
-  version = "2.9.0-20190824";
+  pname = "amarok-unstable";
+  version = "2020-06-12";
 
   src = fetchgit {
     # master has the Qt5 version as of April 2018 but a formal release has not
     # yet been made so change this back to the proper upstream when such a
     # release is out
-    url    = "git://anongit.kde.org/amarok.git";
+    url    = "https://invent.kde.org/multimedia/amarok.git";
     # url = "mirror://kde/stable/${pname}/${version}/src/${name}.tar.xz";
-    rev    = "457fbda25a85a102bfda92aa7137e7ef5e4c8b00";
-    sha256 = "1ig2mg8pqany6m2zplkrvldcv4ibxwsypnyv5igm7nz7ax82cd5j";
+    rev    = "fece39b0e81db310b6a6e08f93d83b0d498cd02b";
+    sha256 = "12casnq6w5yp2jlvnr466pjpkn0vriry8jzfq2qkjl564y0vhy9x";
   };
 
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
@@ -26,7 +26,7 @@ mkDerivation rec {
     qca-qt5 qjson qtquickcontrols2 qtscript qtwebengine
     karchive kcmutils kconfig kdnssd kguiaddons kinit kirigami2 knewstuff knotifyconfig ktexteditor kwindowsystem
     phonon plasma-framework threadweaver
-    curl fftw ffmpeg_3 gdk-pixbuf libaio libmtp loudmouth lz4 lzo mysql57.server mysql57.server.static
+    curl fftw ffmpeg_3 gdk-pixbuf libaio liblastfm libmtp loudmouth lz4 lzo mysql57.server mysql57.server.static
     pcre snappy taglib taglib_extras
   ];
 
diff --git a/pkgs/applications/audio/clementine/clementine-spotify-blob-remove-from-build.patch b/pkgs/applications/audio/clementine/clementine-spotify-blob-remove-from-build.patch
deleted file mode 100644
index 226536a13ba7..000000000000
--- a/pkgs/applications/audio/clementine/clementine-spotify-blob-remove-from-build.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 23070d9..83b6772 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -275,8 +275,6 @@ optional_component(LIBPULSE ON "Pulse audio integration"
- optional_component(VISUALISATIONS ON "Visualisations")
- 
- if(NOT HAVE_SPOTIFY_BLOB AND NOT CRYPTOPP_FOUND)
--  message(FATAL_ERROR "Either crypto++ must be available or the non-GPL Spotify "
--          "code must be compiled in")
- elseif(CRYPTOPP_FOUND)
-   set(HAVE_CRYPTOPP ON)
-   set(HAVE_SPOTIFY_DOWNLOADER ON)
-@@ -434,7 +432,6 @@ if(HAVE_BREAKPAD)
- endif(HAVE_BREAKPAD)
- 
- if(HAVE_SPOTIFY_BLOB)
--  add_subdirectory(ext/clementine-spotifyblob)
- endif(HAVE_SPOTIFY_BLOB)
- 
- if(HAVE_MOODBAR)
diff --git a/pkgs/applications/audio/clementine/default.nix b/pkgs/applications/audio/clementine/default.nix
index 15d0f92b76aa..0c1690f1462a 100644
--- a/pkgs/applications/audio/clementine/default.nix
+++ b/pkgs/applications/audio/clementine/default.nix
@@ -1,4 +1,5 @@
-{ stdenv, fetchFromGitHub, fetchpatch, boost, cmake, chromaprint, gettext, gst_all_1, liblastfm
+{ stdenv, mkDerivation, fetchFromGitHub, fetchpatch, boost, cmake, chromaprint, gettext, gst_all_1, liblastfm
+, qtbase, qtx11extras
 , taglib, fftw, glew, qjson, sqlite, libgpod, libplist, usbmuxd, libmtp
 , libpulseaudio, gvfs, libcdio, libechonest, libspotify, pcre, projectm, protobuf
 , qca2, pkgconfig, sparsehash, config, makeWrapper, gst_plugins }:
@@ -9,30 +10,17 @@ let
   withCD = config.clementine.cd or true;
   withCloud = config.clementine.cloud or true;
 
-  version = "1.3.1";
+  version = "1.4.0rc1";
 
   src = fetchFromGitHub {
     owner = "clementine-player";
     repo = "Clementine";
     rev = version;
-    sha256 = "0i3jkfs8dbfkh47jq3cnx7pip47naqg7w66vmfszk4d8vj37j62j";
+    sha256 = "1rqk0hrsn8f8bjk0j0vq1af0ygy6xx7qi9fw0jjw2cmj6kzckyi2";
   };
 
   patches = [
     ./clementine-spotify-blob.patch
-    # Required so as to avoid adding libspotify as a build dependency (as it is
-    # unfree and thus would prevent us from having a free package).
-    ./clementine-spotify-blob-remove-from-build.patch
-    (fetchpatch {
-      # Fix w/gcc7
-      url = "https://github.com/clementine-player/Clementine/pull/5630.patch";
-      sha256 = "0px7xp1m4nvrncx8sga1qlxppk562wrk2qqk19iiry84nxg20mk4";
-    })
-    (fetchpatch {
-      # Fixes compilation with chromaprint >= 1.4
-      url = "https://github.com/clementine-player/Clementine/commit/d3ea0c8482dfd3f6264a30cfceb456076d76e6cd.patch";
-      sha256 = "1ifrs5aqdzw16jbnf0z1ilir20chdnr9k5n21r99miq9hzjpbh12";
-    })
   ];
 
   nativeBuildInputs = [ cmake pkgconfig ];
@@ -54,6 +42,8 @@ let
     protobuf
     qca2
     qjson
+    qtbase
+    qtx11extras
     sqlite
     taglib
   ]
@@ -71,7 +61,7 @@ let
       -e 's,libprotobuf.a,protobuf,g'
   '';
 
-  free = stdenv.mkDerivation {
+  free = mkDerivation {
     pname = "clementine-free";
     inherit version;
     inherit src patches nativeBuildInputs postPatch;
@@ -79,7 +69,14 @@ let
     # gst_plugins needed for setup-hooks
     buildInputs = buildInputs ++ [ makeWrapper ] ++ gst_plugins;
 
-    cmakeFlags = [ "-DUSE_SYSTEM_PROJECTM=ON" ];
+    preConfigure = ''
+      rm -rf ext/{,lib}clementine-spotifyblob
+    '';
+
+    cmakeFlags = [
+      "-DUSE_SYSTEM_PROJECTM=ON"
+      "-DSPOTIFY_BLOB=OFF"
+    ];
 
     enableParallelBuilding = true;
 
@@ -100,15 +97,11 @@ let
   };
 
   # Unfree Spotify blob for Clementine
-  unfree = stdenv.mkDerivation {
+  unfree = mkDerivation {
     pname = "clementine-blob";
     inherit version;
     # Use the same patches and sources as Clementine
-    inherit src nativeBuildInputs postPatch;
-
-    patches = [
-      ./clementine-spotify-blob.patch
-    ];
+    inherit src nativeBuildInputs patches postPatch;
 
     buildInputs = buildInputs ++ [ libspotify makeWrapper ];
     # Only build and install the Spotify blob
diff --git a/pkgs/applications/audio/dragonfly-reverb/default.nix b/pkgs/applications/audio/dragonfly-reverb/default.nix
index 99c07ba8f5fe..b42929ff2040 100644
--- a/pkgs/applications/audio/dragonfly-reverb/default.nix
+++ b/pkgs/applications/audio/dragonfly-reverb/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dragonfly-reverb";
-  version = "3.0.0";
+  version = "3.1.1";
 
   src = fetchFromGitHub {
     owner = "michaelwillis";
     repo = "dragonfly-reverb";
     rev = version;
-    sha256 = "1z2x33lzpd26dv1p29ca7vy8mjfzkfpin35iq46spwd9k3sqn1ja";
+    sha256 = "188cm45hr0i33m4h2irql1wrsmsfis65s706wjiid0z59q47rf9p";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/audio/munt/default.nix b/pkgs/applications/audio/munt/default.nix
index c9a1e9bea808..bf9710fb17ee 100644
--- a/pkgs/applications/audio/munt/default.nix
+++ b/pkgs/applications/audio/munt/default.nix
@@ -9,14 +9,14 @@ let
     categories = "Audio;AudioVideo;";
   };
 in mkDerivation rec {
-  version = "2.3.0";
+  version = "2.4.0";
   pname = "munt";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = with stdenv.lib.versions; "${pname}_${major version}_${minor version}_${patch version}";
-    sha256 = "0fjhshs4w942rlfksalalqshflbq83pyz1z0hcq53falh9v54cyw";
+    rev = with stdenv.lib.versions; "libmt32emu_${major version}_${minor version}_${patch version}";
+    sha256 = "0521i7js5imlsxj6n7181w5szfjikam0k4vq1d2ilkqgcwrkg6ln";
   };
 
   postInstall = ''
@@ -31,7 +31,7 @@ in mkDerivation rec {
   meta = with stdenv.lib; {
     description = "Multi-platform software synthesiser emulating Roland MT-32, CM-32L, CM-64 and LAPC-I devices";
     homepage = "http://munt.sourceforge.net/";
-    license = licenses.gpl2;
+    license = with licenses; [ lgpl21 gpl3 ];
     platforms = platforms.linux;
     maintainers = with maintainers; [ gnidorah ];
   };
diff --git a/pkgs/applications/audio/sonic-pi/default.nix b/pkgs/applications/audio/sonic-pi/default.nix
index 534ea1358803..d80632a08f59 100644
--- a/pkgs/applications/audio/sonic-pi/default.nix
+++ b/pkgs/applications/audio/sonic-pi/default.nix
@@ -4,7 +4,6 @@
 , fetchFromGitHub
 , fftwSinglePrec
 , ruby
-, libffi
 , aubio
 , cmake
 , pkgconfig
@@ -12,7 +11,6 @@
 , bash
 , jack2Full
 , supercollider
-, qscintilla
 , qwt
 , osmid
 }:
@@ -24,14 +22,14 @@ let
 in
 
 mkDerivation rec {
-  version = "3.1.0";
+  version = "3.2.2";
   pname = "sonic-pi";
 
   src = fetchFromGitHub {
     owner = "samaaron";
     repo = "sonic-pi";
     rev = "v${version}";
-    sha256 = "0gi4a73szaa8iz5q1gxgpsnyvhhghcfqm6bfwwxbix4m5csbfgh9";
+    sha256 = "1nlkpkpg9iz2hvf5pymvk6lqhpdpjbdrvr0hrnkc3ymj7llvf1cm";
   };
 
   buildInputs = [
@@ -39,10 +37,8 @@ mkDerivation rec {
     cmake
     pkgconfig
     qtbase
-    qscintilla
     qwt
     ruby
-    libffi
     aubio
     supercollider_single_prec
     boost
@@ -71,23 +67,34 @@ mkDerivation rec {
     popd
 
     pushd app/gui/qt
-      cp -f ruby_help.tmpl ruby_help.h
-      ../../server/ruby/bin/qt-doc.rb -o ruby_help.h
+      cp -f utils/ruby_help.tmpl utils/ruby_help.h
+      ../../server/ruby/bin/qt-doc.rb -o utils/ruby_help.h
 
-      substituteInPlace SonicPi.pro \
-        --replace "LIBS += -lrt -lqt5scintilla2" \
-                  "LIBS += -lrt -lqscintilla2 -lqwt"
+      lrelease lang/*.ts
 
-      lrelease SonicPi.pro
-      qmake SonicPi.pro
-
-      make
+      mkdir build
+      pushd build
+        cmake -G "Unix Makefiles" ..
+        make
+      popd
     popd
   '';
 
   installPhase = ''
     runHook preInstall
-    cp -r . $out
+
+    mkdir $out
+    cp -r {bin,etc} $out/
+
+    # Copy server whole.
+    mkdir -p $out/app
+    cp -r app/server $out/app/
+
+    # Copy only necessary files for the gui app.
+    mkdir -p $out/app/gui/qt/build
+    cp -r app/gui/qt/{book,fonts,help,html,images,image_source,info,lang,theme} $out/app/gui/qt/
+    cp app/gui/qt/build/sonic-pi $out/app/gui/qt/build/sonic-pi
+
     runHook postInstall
   '';
 
@@ -103,9 +110,7 @@ mkDerivation rec {
     homepage = "https://sonic-pi.net/";
     description = "Free live coding synth for everyone originally designed to support computing and music lessons within schools";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ Phlogistique kamilchm ];
+    maintainers = with lib.maintainers; [ Phlogistique kamilchm c0deaddict ];
     platforms = lib.platforms.linux;
-    # sonic-pi depends on ruby 2.4 which we don't support anymore
-    broken = true;
   };
 }
diff --git a/pkgs/applications/blockchains/ergo/default.nix b/pkgs/applications/blockchains/ergo/default.nix
index bae7326c2554..29990dae4049 100644
--- a/pkgs/applications/blockchains/ergo/default.nix
+++ b/pkgs/applications/blockchains/ergo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ergo";
-  version = "3.2.5";
+  version = "3.2.6";
 
   src = fetchurl {
     url = "https://github.com/ergoplatform/ergo/releases/download/v${version}/ergo-${version}.jar";
-    sha256 = "0vaq6cqz03ps0fg3rvk298jnbf8mazvmyfcj7zsf1cgw41xdjjcf";
+    sha256 = "1a38j7dy6ax9xvcjbdkiz0z33ln4rlmgrxznvqhdf11j70g1sr6x";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/editors/neovim/gnvim/default.nix b/pkgs/applications/editors/neovim/gnvim/default.nix
index e9f42d2b9b5e..3693ff322338 100644
--- a/pkgs/applications/editors/neovim/gnvim/default.nix
+++ b/pkgs/applications/editors/neovim/gnvim/default.nix
@@ -33,6 +33,10 @@ rustPlatform.buildRustPackage rec {
     EOF
   '';
 
+  buildPhase = ''
+    make build
+  '';
+
   installPhase = ''
     make install PREFIX="${placeholder "out"}"
   '';
diff --git a/pkgs/applications/editors/notepadqq/default.nix b/pkgs/applications/editors/notepadqq/default.nix
index a51f5106930e..cd4fe34ef33b 100644
--- a/pkgs/applications/editors/notepadqq/default.nix
+++ b/pkgs/applications/editors/notepadqq/default.nix
@@ -3,12 +3,12 @@
 mkDerivation rec {
   pname = "notepadqq";
   version = "1.4.8";
+
   src = fetchFromGitHub {
     owner = "notepadqq";
     repo = "notepadqq";
     rev = "v${version}";
     sha256 = "0lbv4s7ng31dkznzbkmp2cvkqglmfj6lv4mbg3r410fif2nrva7k";
-    fetchSubmodules = true;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix
index e6e767c7db22..7ca981b2958d 100644
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -11,8 +11,8 @@ let
   archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "0zdg6z6h0h8vvwdrnihwd76bik41spv6xbw7cdh7hz97sjsh15zq";
-    x86_64-darwin = "1c5c24vj8nqsxx8hwfj04as7vsl9gnl97yniw36pdfgv88v8qzin";
+    x86_64-linux = "0hmmqdamsjhjy1q8m85bs081cwmskpsp57rkj7vc2wj918wgissm";
+    x86_64-darwin = "00xwvi53h9rnwyba12jmsp6grkymmn6vjibypaxb96q7q7p894gh";
   }.${system};
 in
   callPackage ./generic.nix rec {
@@ -21,7 +21,7 @@ in
 
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.45.1";
+    version = "1.46.0";
     pname = "vscode";
 
     executableName = "code" + lib.optionalString isInsiders "-insiders";
diff --git a/pkgs/applications/editors/vscode/vscodium.nix b/pkgs/applications/editors/vscode/vscodium.nix
index 8a191e157fa0..fd48a4b1084e 100644
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@@ -11,8 +11,8 @@ let
   archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "1m965d8ggg2ffbhyrgadfrgikcavyjszc3sgbsd930b8pxrmqlxp";
-    x86_64-darwin = "017fj7imjxa0n3r7c9kcz7192rxkw18bry6rfkv2hycfja70j5qj";
+    x86_64-linux = "088nsflscak315704vqnh8m4q7601fczglbhdz5i70kfyg89ar4w";
+    x86_64-darwin = "0fxpx1ydsag4gyn2kq5ddq55lpw15w176p3fypk80fyfix4kziqf";
   }.${system};
 
   sourceRoot = {
@@ -27,7 +27,7 @@ in
 
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.45.1";
+    version = "1.46.0";
     pname = "vscodium";
 
     executableName = "codium";
diff --git a/pkgs/applications/graphics/drawio/default.nix b/pkgs/applications/graphics/drawio/default.nix
index 8281596374cc..7026d133658f 100644
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "drawio";
-  version = "13.0.3";
+  version = "13.2.2";
 
   src = fetchurl {
     url = "https://github.com/jgraph/drawio-desktop/releases/download/v${version}/draw.io-x86_64-${version}.rpm";
-    sha256 = "104pfwipm8ch9xqlsz1gh18icr1p6i3n4c77bbdjakxcy4s5n7sg";
+    sha256 = "0npqw4ih047d9s1yyllcvcih2r61fgji4rvzsw88r02mj5q5rgdn";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/yeetgif/default.nix b/pkgs/applications/graphics/yeetgif/default.nix
index 157ef3753e08..3ae1b98661a6 100644
--- a/pkgs/applications/graphics/yeetgif/default.nix
+++ b/pkgs/applications/graphics/yeetgif/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "yeetgif";
-  version = "1.23.5";
+  version = "1.23.6";
 
   goPackagePath = "github.com/sgreben/yeetgif";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "sgreben";
     repo = pname;
     rev = version;
-    sha256 = "1yz4pps8g378lvmi92cnci6msjj7fprp9bxqmnsyn6lqw7s2wb47";
+    sha256 = "05z1ylsra60bb4cvr383g9im94zsph1dgicqbv5p73qgs634ckk7";
   };
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/ArchiSteamFarm/default.nix b/pkgs/applications/misc/ArchiSteamFarm/default.nix
index c165003d8f8c..6201d881a882 100644
--- a/pkgs/applications/misc/ArchiSteamFarm/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/default.nix
@@ -1,27 +1,15 @@
-{ stdenv, fetchurl, unzip, makeWrapper, autoPatchelfHook
-, zlib, lttng-ust, curl, icu, openssl }:
+{ stdenv, fetchurl, unzip, makeWrapper, dotnetCorePackages, jq }:
 
 stdenv.mkDerivation rec {
   pname = "ArchiSteamFarm";
-  version = "4.2.0.6";
-
-  src = {
-    x86_64-linux = fetchurl {
-      url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-linux-x64.zip";
-      sha256 = "05hx6q1lkbjbqhwi9xxvm7ycnsnpl1cnqzyy2yn0q4x27im399cn";
-    };
-    armv7l-linux = fetchurl {
-      url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-linux-arm.zip";
-      sha256 = "0l8irqrpl5vbjj84k4makj2ph2z6kpny7qz51zrzbgwhrlw0w4vg";
-    };
-    aarch64-linux = fetchurl {
-      url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-linux-arm64.zip";
-      sha256 = "0hg2g4i8sj3fxqfy4imz1iarby1d9f8dh59j266lbbdf2vfz2cml";
-    };
-  }.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
-
-  nativeBuildInputs = [ unzip makeWrapper autoPatchelfHook ];
-  buildInputs = [ stdenv.cc.cc zlib lttng-ust curl ];
+  version = "4.2.2.1";
+
+  src = fetchurl {
+    url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-generic.zip";
+    sha256 = "0pr9rrhi44yl99c2i12rimmc4mhbh0ma9jn17cgsh8p0kbj8sq94";
+  };
+
+  nativeBuildInputs = [ unzip makeWrapper jq ];
 
   sourceRoot = ".";
 
@@ -29,23 +17,25 @@ stdenv.mkDerivation rec {
     dist=$out/opt/asf
     mkdir -p $dist
     cp -r * $dist
-    chmod +x $dist/ArchiSteamFarm
-    makeWrapper $dist/ArchiSteamFarm $out/bin/ArchiSteamFarm \
-      --prefix LD_LIBRARY_PATH : "${stdenv.lib.makeLibraryPath [ icu openssl ] }" \
+
+    jq "del(.runtimeOptions.framework.version)" ArchiSteamFarm.runtimeconfig.json > $dist/ArchiSteamFarm.runtimeconfig.json
+
+    makeWrapper ${dotnetCorePackages.aspnetcore_3_1}/bin/dotnet $out/bin/ArchiSteamFarm \
+      --add-flags $dist/ArchiSteamFarm.dll \
       --add-flags "--path ~/.config/asf" \
       --run "mkdir -p ~/.config/asf" \
       --run "cd ~/.config/asf" \
       --run "[ -d config ] || cp --no-preserve=mode -r $dist/config ." \
       --run "[ -d logs ] || cp --no-preserve=mode -r $dist/logs ." \
       --run "[ -d plugins ] || cp --no-preserve=mode -r $dist/plugins ." \
-      --run "[ -d www ] || cp --no-preserve=mode -r $dist/www ." \
+      --run "[ -d www ] || ln -sf $dist/www ."
   '';
 
   meta = with stdenv.lib; {
     description = "Application with primary purpose of idling Steam cards from multiple accounts simultaneously";
     homepage = "https://github.com/JustArchiNET/ArchiSteamFarm";
     license = licenses.asl20;
-    platforms = [ "x86_64-linux" "armv7l-linux" "aarch64-linux" ];
+    platforms = dotnetCorePackages.aspnetcore_3_1.meta.platforms;
     maintainers = with maintainers; [ gnidorah ];
     hydraPlatforms = [];
   };
diff --git a/pkgs/applications/misc/alacritty/default.nix b/pkgs/applications/misc/alacritty/default.nix
index 9e04a738db30..6bd35bd51eb3 100644
--- a/pkgs/applications/misc/alacritty/default.nix
+++ b/pkgs/applications/misc/alacritty/default.nix
@@ -121,6 +121,8 @@ rustPlatform.buildRustPackage rec {
     install -dm 755 "$out/share/man/man1"
     gzip -c extra/alacritty.man > "$out/share/man/man1/alacritty.1.gz"
 
+    install -Dm 644 alacritty.yml $out/share/doc/alacritty.yml
+
     install -dm 755 "$terminfo/share/terminfo/a/"
     tic -xe alacritty,alacritty-direct -o "$terminfo/share/terminfo" extra/alacritty.info
     mkdir -p $out/nix-support
diff --git a/pkgs/applications/misc/blender/default.nix b/pkgs/applications/misc/blender/default.nix
index 9a868d1699a1..bf2a89ade559 100644
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@@ -86,9 +86,9 @@ stdenv.mkDerivation rec {
       "-DWITH_SDL=OFF"
       "-DWITH_OPENCOLORIO=ON"
       "-DWITH_OPENSUBDIV=ON"
-      "-DPYTHON_LIBRARY=${python.libPrefix}m"
+      "-DPYTHON_LIBRARY=${python.libPrefix}"
       "-DPYTHON_LIBPATH=${python}/lib"
-      "-DPYTHON_INCLUDE_DIR=${python}/include/${python.libPrefix}m"
+      "-DPYTHON_INCLUDE_DIR=${python}/include/${python.libPrefix}"
       "-DPYTHON_VERSION=${python.pythonVersion}"
       "-DWITH_PYTHON_INSTALL=OFF"
       "-DWITH_PYTHON_INSTALL_NUMPY=OFF"
diff --git a/pkgs/applications/misc/cointop/default.nix b/pkgs/applications/misc/cointop/default.nix
index ef897d2ea598..8d91531dd1f8 100644
--- a/pkgs/applications/misc/cointop/default.nix
+++ b/pkgs/applications/misc/cointop/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "cointop";
-  version = "1.4.4";
+  version = "1.4.6";
 
   src = fetchFromGitHub {
     owner = "miguelmota";
     repo = pname;
     rev = version;
-    sha256 = "12yi1lmyd5y4cgcjclkczf93jj7wd6k8aqnhq21dd1mx65l77swv";
+    sha256 = "1mkb97x73vzxnbvhnxx3msicr1z0b3sjmydx257ax3nscrmf1l5z";
   };
 
   goPackagePath = "github.com/miguelmota/cointop";
diff --git a/pkgs/applications/misc/cpu-x/default.nix b/pkgs/applications/misc/cpu-x/default.nix
index fb81bbdd40c7..a92ca30c5d80 100644
--- a/pkgs/applications/misc/cpu-x/default.nix
+++ b/pkgs/applications/misc/cpu-x/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cpu-x";
-  version = "4.0.0";
+  version = "4.0.1";
 
   src = fetchFromGitHub {
     owner = "X0rg";
     repo = "CPU-X";
     rev = "v${version}";
-    sha256 = "00xngmlayblvkg3l0rcfpxmnkkdz49ydh4smlhpii23gqii0rds3";
+    sha256 = "191zkkswlbbsw492yygc3idf7wh3bxs97drrqvqqw0mqvrzykxm3";
   };
 
   nativeBuildInputs = [ cmake pkgconfig wrapGAppsHook nasm makeWrapper ];
diff --git a/pkgs/applications/misc/lyx/default.nix b/pkgs/applications/misc/lyx/default.nix
index b96e6b2a02d5..4f6b73d592c2 100644
--- a/pkgs/applications/misc/lyx/default.nix
+++ b/pkgs/applications/misc/lyx/default.nix
@@ -3,12 +3,12 @@
 }:
 
 mkDerivation rec {
-  version = "2.3.4.3";
+  version = "2.3.5.1";
   pname = "lyx";
 
   src = fetchurl {
     url = "ftp://ftp.lyx.org/pub/lyx/stable/2.3.x/${pname}-${version}.tar.xz";
-    sha256 = "1rpp6wq0dc0bxwc0pipajv98vi7cpg391nq10d3c4pmpq38m08wx";
+    sha256 = "0mv32s26igm0pd8vs7d2mk1240dpr83y0a2wyh3xz6b67ph0w157";
   };
 
   # LaTeX is used from $PATH, as people often want to have it with extra pkgs
diff --git a/pkgs/applications/misc/pueue/default.nix b/pkgs/applications/misc/pueue/default.nix
index a51cd75e7990..db84f5fbb9bf 100644
--- a/pkgs/applications/misc/pueue/default.nix
+++ b/pkgs/applications/misc/pueue/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pueue";
-  version = "0.5.1";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "Nukesor";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1n85b41kvx7x7qdizdnq1p0zrkap4gkwnnvhh4pz6j9njxj8d9ir";
+    sha256 = "06jxj89ya91grrwxfs7l1ahy46y993kxsc8gpkxajc0j5ihax2al";
   };
 
-  cargoSha256 = "0hkkz74hllc5dzmgls6bgdxsdr871df2fn51sa3shv68ah0avxff";
+  cargoSha256 = "191j3lpd24ycissw0y2hv65i1cjzf24draamq3sxv7hv0sxcjw4d";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/misc/qmapshack/default.nix b/pkgs/applications/misc/qmapshack/default.nix
index edb5a9b37889..1a8758955cef 100644
--- a/pkgs/applications/misc/qmapshack/default.nix
+++ b/pkgs/applications/misc/qmapshack/default.nix
@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "qmapshack";
-  version = "1.14.1";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "Maproom";
     repo = pname;
     rev = "V_${version}";
-    sha256 = "0hghynb4ac98fg1pwc645zriqkghxwp8mr3jhr87pa6fh0y848py";
+    sha256 = "157bssrbwcc1w58b0v60jb3wrjf2ig4z6z6crjnpvflkqj5p8vwy";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/misc/remarkable/remarkable-mouse/default.nix b/pkgs/applications/misc/remarkable/remarkable-mouse/default.nix
new file mode 100644
index 000000000000..8d668f7a38d1
--- /dev/null
+++ b/pkgs/applications/misc/remarkable/remarkable-mouse/default.nix
@@ -0,0 +1,20 @@
+{ stdenv, buildPythonApplication, fetchPypi, python3Packages }:
+
+buildPythonApplication rec {
+  pname = "remarkable-mouse";
+  version = "5.2.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0k2wjfcgnvb8yqn4c4ddfyyhrvl6hj61kn1ddnyp6ay9vklnw160";
+  };
+
+  propagatedBuildInputs = with python3Packages; [ screeninfo paramiko pynput libevdev ];
+
+  meta = with stdenv.lib; {
+    description = "A program to use a reMarkable as a graphics tablet";
+    homepage = "https://github.com/evidlo/remarkable_mouse";
+    license = licenses.gpl3;
+    maintainers = [ maintainers.nickhu ];
+  };
+}
diff --git a/pkgs/applications/networking/browsers/chromium/plugins.nix b/pkgs/applications/networking/browsers/chromium/plugins.nix
index d45a3c9f864a..707bf2056f0e 100644
--- a/pkgs/applications/networking/browsers/chromium/plugins.nix
+++ b/pkgs/applications/networking/browsers/chromium/plugins.nix
@@ -45,11 +45,11 @@ let
 
   flash = stdenv.mkDerivation rec {
     pname = "flashplayer-ppapi";
-    version = "32.0.0.371";
+    version = "32.0.0.387";
 
     src = fetchzip {
       url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/${version}/flash_player_ppapi_linux.x86_64.tar.gz";
-      sha256 = "1nks2wx74b21hv0l7bnrzkxn7c6p6r8zgwbqvy3cqpi8famyr5v9";
+      sha256 = "1igs8nh3zpfcps97ahzh7kknx3rddh6yliig8lxf6jskbpf0qgzf";
       stripRoot = false;
     };
 
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 817d17e8fad0..8060895a2e0f 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -94,11 +94,6 @@ stdenv.mkDerivation ({
 
   patches = [
     ./env_var_for_system_dir.patch
-    # Fix for NSS 3.52 (add missing CK_GCM_PARMS field)
-    (fetchpatch {
-      url = "https://hg.mozilla.org/mozilla-central/raw-rev/463069687b3d";
-      sha256 = "00yhz67flnkww3rbry0kqn6z6bm7vxfb2sgf7qikgbjcm3ysvpsm";
-    })
   ]
   ++ patches;
 
@@ -143,7 +138,6 @@ stdenv.mkDerivation ({
     "-Wno-error=format-security");
 
   postPatch = ''
-    substituteInPlace third_party/prio/prio/rand.c --replace 'nspr/prinit.h' 'prinit.h'
     rm -rf obj-x86_64-pc-linux-gnu
   '';
 
diff --git a/pkgs/applications/networking/browsers/firefox/packages.nix b/pkgs/applications/networking/browsers/firefox/packages.nix
index 753791be07c5..f0ca1c7cd154 100644
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@@ -7,10 +7,10 @@ in
 rec {
   firefox = common rec {
     pname = "firefox";
-    ffversion = "76.0.1";
+    ffversion = "77.0.1";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "0gnhfcgrz6022xf3vqia3s3639xa5pjp13h343d3c09mn8r919cmm6s38vzj1v3734fm25zb68acyarsp72xqq8z1420rh02b2pv38q";
+      sha512 = "ngLihC0YuclLJEV3iPEX+tRzDKIdBe+CCOuFxvWNo7DnX8royOvTj2m4YyWyZoTQ5UCbPTQYmP4otgfovZSe8g==";
     };
 
     patches = [
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
index a9f05ba1da9a..e967578a7cef 100644
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
@@ -74,7 +74,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "flashplayer";
-  version = "32.0.0.371";
+  version = "32.0.0.387";
 
   src = fetchurl {
     url =
@@ -85,14 +85,14 @@ stdenv.mkDerivation rec {
     sha256 =
       if debug then
         if arch == "x86_64" then
-          "1zrl7cxcl9hkafji15br8wp5vf9a5lb88xcpz6vi9q73j45mhzjd"
+          "1wmk60lnlrj9f8dvk4b6j7pqyl00w00qbzbdw4awzx91wmgfc4x0"
         else
-          "0cgnsn9zanadbacb660mj4k103cdyb2cak7ixnp1varqklss83n6"
+          "1afjxhi5jzn8zbkva940i9fayzxj1r3n6rqsiny02fpnv0waypfy"
       else
         if arch == "x86_64" then
-          "1zc90gjixfhjng7pbx8vci1l69wf5m40149178zwzs6kz4ma5hb2"
+          "0si8rx955kyfsprk5465hfzafxvrdm7g686q7p5xykmh88nck6k2"
         else
-          "0fqgas1g52a0zir2cxz3anizk3lkmwl68nbcn5rihgvjfqykbhn8";
+          "02pw2knvgdkahyp7lmy7fmynmplaz5wswdz48h3sdj6ibr066h97";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
index 3015d506427d..9d7d6eeeee86 100644
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
@@ -50,7 +50,7 @@
 
 stdenv.mkDerivation {
   pname = "flashplayer-standalone";
-  version = "32.0.0.371";
+  version = "32.0.0.387";
 
   src = fetchurl {
     url =
@@ -60,9 +60,9 @@ stdenv.mkDerivation {
         "https://fpdownload.macromedia.com/pub/flashplayer/updaters/32/flash_player_sa_linux.x86_64.tar.gz";
     sha256 =
       if debug then
-        "0n3bk2y1djaqrdygnr81n8lsnj2k60kaziffl41zpdvzi1jc7wgn"
+        "1yxdwmm2gz162rmc9hwlccqgq613gnrihjicnzgan4vk7hjlga5y"
       else
-        "18ll9rnfhbnz54q4d7q9fb13lix4i62zr6z6n574qvwngrvbrr8a";
+        "0hm5is3giz45a4v9m77q0i1dgyhpqqkagpjndbnynsnl9a61r0ly";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/applications/networking/cluster/argo/default.nix b/pkgs/applications/networking/cluster/argo/default.nix
index 7179a2915434..3ef2412a9f5c 100644
--- a/pkgs/applications/networking/cluster/argo/default.nix
+++ b/pkgs/applications/networking/cluster/argo/default.nix
@@ -19,16 +19,16 @@ let
 in
 buildGoModule rec {
   pname = "argo";
-  version = "2.6.1";
+  version = "2.8.1";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo";
     rev = "v${version}";
-    sha256 = "12wq79h4m8wlzf18r66965mbbjjb62kvnxdj50ra7nxa8jjxpsmf";
+    sha256 = "193nxc27fh37wf035mclvwwwxjjfc8nnbncg009fg19ycqmvmgvc";
   };
 
-  vendorSha256 = "0dhzr62x2lzf3w0j2r496cr7jvkdcavfqaqr2xh972k3qqc9caky";
+  vendorSha256 = "1p9b2m20gxc7iyq08mvllf5dpi4m06aw233sb45d05d624kw4aps";
 
   subPackages = [ "cmd/argo" ];
 
@@ -39,6 +39,15 @@ buildGoModule rec {
     ${staticfiles}/bin/staticfiles -o server/static/files.go ui/dist/app
   '';
 
+  buildFlagsArray = ''
+    -ldflags=
+      -s -w
+      -X github.com/argoproj/argo.version=${version}
+      -X github.com/argoproj/argo.gitCommit=${src.rev}
+      -X github.com/argoproj/argo.gitTreeState=clean
+      -X github.com/argoproj/argo.gitTag=${version}
+  '';
+
   meta = with lib; {
     description = "Container native workflow engine for Kubernetes";
     homepage = "https://github.com/argoproj/argo";
@@ -46,4 +55,4 @@ buildGoModule rec {
     maintainers = with maintainers; [ groodt ];
     platforms = platforms.unix;
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/applications/networking/cluster/helmsman/default.nix b/pkgs/applications/networking/cluster/helmsman/default.nix
index 097213568065..5fb0b3658851 100644
--- a/pkgs/applications/networking/cluster/helmsman/default.nix
+++ b/pkgs/applications/networking/cluster/helmsman/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "helmsman";
-  version = "3.4.1";
+  version = "3.4.3";
 
   src = fetchFromGitHub {
     owner = "Praqma";
     repo = "helmsman";
     rev = "v${version}";
-    sha256 = "0h89lgp3n7nd7dy8nq4bfxg938imdjsvs1k6yg8j37vgdmi24sa6";
+    sha256 = "0jbinnzdw32l7zh02k81gnw9rnqi8f5k5sp2qv8p9l9kgziaycvn";
   };
 
   vendorSha256 = "05vnysr5r3hbayss1pyifgp989kjw81h95iack8ady62k6ys5njl";
diff --git a/pkgs/applications/networking/cluster/luigi/default.nix b/pkgs/applications/networking/cluster/luigi/default.nix
index ced4c45d059d..c6e2b7d85598 100644
--- a/pkgs/applications/networking/cluster/luigi/default.nix
+++ b/pkgs/applications/networking/cluster/luigi/default.nix
@@ -2,11 +2,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "luigi";
-  version = "2.8.13";
+  version = "3.0.0";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "0x14549iwj7r1knc0hmic9ny9hp960yjjqi4mxl78jb69gd3bhmf";
+    sha256 = "1km9fnq4pf0iqqcmz94idm0zb3l92zinz0bn6ip86xqhchafd4vf";
   };
 
   propagatedBuildInputs = with python3Packages; [ dateutil tornado_4 python-daemon boto3 ];
@@ -18,12 +18,13 @@ python3Packages.buildPythonApplication rec {
   makeWrapperArgs = ["--prefix PYTHONPATH . :"];
 
   meta = with lib; {
-    homepage = "https://github.com/spotify/luigi";
     description = "Python package that helps you build complex pipelines of batch jobs";
     longDescription = ''
       Luigi handles dependency resolution, workflow management, visualization,
       handling failures, command line integration, and much more.
     '';
+    homepage = "https://github.com/spotify/luigi";
+    changelog = "https://github.com/spotify/luigi/releases/tag/${version}";
     license =  [ licenses.asl20 ];
     maintainers = [ maintainers.bhipple ];
   };
diff --git a/pkgs/applications/networking/cluster/minishift/default.nix b/pkgs/applications/networking/cluster/minishift/default.nix
index 0c932396e9e2..cd11bcbb431c 100644
--- a/pkgs/applications/networking/cluster/minishift/default.nix
+++ b/pkgs/applications/networking/cluster/minishift/default.nix
@@ -4,7 +4,7 @@
 }:
 
 let
-  version = "1.34.0";
+  version = "1.34.2";
 
   # Update these on version bumps according to Makefile
   centOsIsoVersion = "v1.15.0";
@@ -18,7 +18,7 @@ in buildGoPackage rec {
     owner = "minishift";
     repo = "minishift";
     rev = "v${version}";
-    sha256 = "0nc1g4lmz5ww6rjyyanp9vq4sj6fvi9zf9qjc4lpsmapddhjkdy7";
+    sha256 = "1xzjzmjs2ijg7zzw53v02lgrg1j82jd7ljcn6lprg01hhvfrwgg7";
   };
 
   nativeBuildInputs = [ pkgconfig go-bindata makeWrapper ];
diff --git a/pkgs/applications/networking/cluster/qbec/default.nix b/pkgs/applications/networking/cluster/qbec/default.nix
index a48016d5069c..0689fd096b3b 100644
--- a/pkgs/applications/networking/cluster/qbec/default.nix
+++ b/pkgs/applications/networking/cluster/qbec/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "qbec";
-  version = "0.11.2";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "splunk";
     repo = "qbec";
     rev = "v${version}";
-    sha256 = "1lf9srkmi7r6p3him19akzag13hj8arwlkm9mdy8a8fg1ascqbm4";
+    sha256 = "0vy1cqqyga68qjbvyhsgl281qkbsvhvmwbxc93hygsxzm9kczy4p";
   };
 
-  vendorSha256 = "1cyr621fb6hxwswz9lf75brc9qjy1n9rqjkwi6r8s3y6nhw20db6";
+  vendorSha256 = "15hbjghi2ifylg7nr85qlk0alsy97h9zj6hf5w84m76dla2bcjf3";
 
   meta = with lib; {
     description = "Configure kubernetes objects on multiple clusters using jsonnet https://qbec.io";
diff --git a/pkgs/applications/networking/dnscontrol/default.nix b/pkgs/applications/networking/dnscontrol/default.nix
index e8500872d52c..70e107c063fb 100644
--- a/pkgs/applications/networking/dnscontrol/default.nix
+++ b/pkgs/applications/networking/dnscontrol/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "dnscontrol";
-  version = "3.0.0";
+  version = "3.2.0";
 
   goPackagePath = "github.com/StackExchange/dnscontrol";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "StackExchange";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1j8i4k7bqkqmi6dmc9fxfab49a7qigig72rlbga902lw336p6cc7";
+    sha256 = "1lrn1whmx9zkyvs505zxrsmnr5s6kpj3kjkr6rblfwdlnadkgfj7";
   };
 
   subPackages = [ "." ];
diff --git a/pkgs/applications/networking/instant-messengers/bluejeans/default.nix b/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
index 14fbd4db1a00..bd71166be222 100644
--- a/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
+++ b/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
@@ -40,11 +40,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bluejeans";
-  version = "2.1.0";
+  version = "2.3.0";
 
   src = fetchurl {
     url = "https://swdl.bluejeans.com/desktop-app/linux/${version}/BlueJeans.rpm";
-    sha256 = "1zhh0pla5gk75p8x84va9flvnk456pbcm1n6x8l82c9682fwr7dd";
+    sha256 = "06lcpkga8h0zpl2wlysj6n979f0yg361frp3zr0vwzln3fiil2a7";
   };
 
   nativeBuildInputs = [ rpmextract makeWrapper ];
@@ -110,6 +110,9 @@ stdenv.mkDerivation rec {
       --set LD_LIBRARY_PATH "${libPath}":"${placeholder "out"}"/opt/BlueJeans \
       --set LD_PRELOAD "$out"/opt/BlueJeans/liblocaltime64_stub.so
 
+    substituteInPlace "$out"/share/applications/bluejeans-v2.desktop \
+      --replace "/opt/BlueJeans/bluejeans-v2" "$out/bin/bluejeans"
+
     patchShebangs "$out"
   '';
 
diff --git a/pkgs/applications/networking/instant-messengers/discord/base.nix b/pkgs/applications/networking/instant-messengers/discord/base.nix
index 653da669d386..c2af3e4d3e7d 100644
--- a/pkgs/applications/networking/instant-messengers/discord/base.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/base.nix
@@ -17,6 +17,7 @@ in stdenv.mkDerivation rec {
     autoPatchelfHook
     cups
     libdrm
+    libuuid
     libX11
     libXScrnSaver
     libXtst
diff --git a/pkgs/applications/networking/mailreaders/mutt/default.nix b/pkgs/applications/networking/mailreaders/mutt/default.nix
index c188e46d0076..30b3194d590b 100644
--- a/pkgs/applications/networking/mailreaders/mutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/mutt/default.nix
@@ -27,11 +27,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "mutt";
-  version = "1.14.2";
+  version = "1.14.3";
 
   src = fetchurl {
     url = "http://ftp.mutt.org/pub/mutt/${pname}-${version}.tar.gz";
-    sha256 = "0cdcls0x6f2w99hkjz48hxhnx86w3bnyxzibchdc9yspih770bz2";
+    sha256 = "0wd4cv1c9hqymvml979g607nh3xxmlyx1ifc4r4qf39v6grnsmdi";
   };
 
   patches = optional smimeSupport (fetchpatch {
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/default.nix b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
index e36d99886e21..73536ae5fc1b 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
@@ -43,6 +43,7 @@
 , rustc
 , sqlite
 , stdenv
+, systemd
 , unzip
 , which
 , writeScript
@@ -305,11 +306,11 @@ stdenv.mkDerivation rec {
     )
   '';
 
-  # FIXME: This can probably be removed as soon as we package a
-  # Thunderbird >=71.0 since XUL shouldn't be anymore (in use)?
+  # FIXME: The XUL portion of this can probably be removed as soon as we
+  # package a Thunderbird >=71.0 since XUL shouldn't be anymore (in use)?
   postFixup = ''
     local xul="$out/lib/thunderbird/libxul.so"
-    patchelf --set-rpath "${libnotify}/lib:$(patchelf --print-rpath $xul)" $xul
+    patchelf --set-rpath "${libnotify}/lib:${systemd.lib}/lib:$(patchelf --print-rpath $xul)" $xul
   '';
 
   doInstallCheck = true;
diff --git a/pkgs/applications/networking/nym/default.nix b/pkgs/applications/networking/nym/default.nix
index 4a4f5c54f6b6..4dfe1dc54929 100644
--- a/pkgs/applications/networking/nym/default.nix
+++ b/pkgs/applications/networking/nym/default.nix
@@ -24,8 +24,20 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = [ openssl ];
 
-  # tests disabled until a release with https://github.com/nymtech/nym/pull/260 is available
-  doCheck = false;
+  checkType = "debug";
+
+  /*
+  Nym's test presence::converting_mixnode_presence_into_topology_mixnode::it_returns_resolved_ip_on_resolvable_hostname tries to resolve nymtech.net.
+  Since there is no external DNS resolution available in the build sandbox, we point cargo and its children (that's what we remove the 'unsetenv' call for) to a hosts file in which we statically resolve nymtech.net.
+  */
+  preCheck = ''
+    export LD_PRELOAD=${libredirect.overrideAttrs (drv: {
+      postPatch = "sed -i -e /unsetenv/d libredirect.c";
+    })}/lib/libredirect.so
+    export NIX_REDIRECTS=/etc/hosts=${writeText "nym_resolve_test_hosts" "127.0.0.1 nymtech.net"}
+  '';
+
+  postCheck = "unset NIX_REDIRECTS LD_PRELOAD";
 
 
   passthru.updateScript = ./update.sh;
diff --git a/pkgs/applications/networking/remote/wayvnc/add-missing-librt.patch b/pkgs/applications/networking/remote/wayvnc/add-missing-librt.patch
new file mode 100644
index 000000000000..e2d617bcc7ca
--- /dev/null
+++ b/pkgs/applications/networking/remote/wayvnc/add-missing-librt.patch
@@ -0,0 +1,20 @@
+diff --git a/meson.build b/meson.build
+index cc6fa03..7c2b280 100644
+--- a/meson.build
++++ b/meson.build
+@@ -24,6 +24,7 @@ add_project_arguments(c_args, language: 'c')
+ cc = meson.get_compiler('c')
+ 
+ libm = cc.find_library('m', required: false)
++librt = cc.find_library('rt', required: false)
+ 
+ pixman = dependency('pixman-1')
+ libuv = dependency('libuv')
+@@ -65,6 +66,7 @@ sources = [
+ 
+ dependencies = [
+ 	libm,
++	librt,
+ 	pixman,
+ 	libuv,
+ 	egl,
diff --git a/pkgs/applications/networking/remote/wayvnc/default.nix b/pkgs/applications/networking/remote/wayvnc/default.nix
index 865710184f93..4ca6ae952580 100644
--- a/pkgs/applications/networking/remote/wayvnc/default.nix
+++ b/pkgs/applications/networking/remote/wayvnc/default.nix
@@ -13,6 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "0aa12fkbwhzs0g2pqw1b27l33nn5dpbcvsf1z8h88kwsf9xdvb2r";
   };
 
+  patches = [ ./add-missing-librt.patch ];
+
   postPatch = ''
     substituteInPlace meson.build \
       --replace "version: '0.1.0'" "version: '${version}'"
diff --git a/pkgs/applications/networking/sync/onedrive/default.nix b/pkgs/applications/networking/sync/onedrive/default.nix
index 636761d2aaff..be255a6c1465 100644
--- a/pkgs/applications/networking/sync/onedrive/default.nix
+++ b/pkgs/applications/networking/sync/onedrive/default.nix
@@ -1,21 +1,37 @@
-{ stdenv, fetchFromGitHub, dmd, pkgconfig, curl, sqlite, libnotify }:
+{ stdenv, lib, fetchFromGitHub, autoreconfHook, ldc, installShellFiles, pkgconfig
+, curl, sqlite, libnotify
+, withSystemd ? stdenv.isLinux, systemd ? null }:
 
 stdenv.mkDerivation rec {
   pname = "onedrive";
-  version = "2.3.13";
+  version = "2.4.2";
 
   src = fetchFromGitHub {
     owner = "abraunegg";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0bcsrfh1g7bdlcp0zjn6np88qzpn5frv61lzxz9b2ayxf7wyybvi";
+    sha256 = "10s33p1xzq9c5n1bxv9n7n31afxgx9i6c17w0xgxdrma75micm3a";
   };
 
-  nativeBuildInputs = [ dmd pkgconfig ];
+  nativeBuildInputs = [ autoreconfHook ldc installShellFiles pkgconfig ];
 
-  buildInputs = [ curl sqlite libnotify ];
+  buildInputs = [
+    curl sqlite libnotify
+  ] ++ lib.optional withSystemd systemd;
 
-  configureFlags = [ "--enable-notifications" ];
+  configureFlags = [
+    "--enable-notifications"
+  ] ++ lib.optionals withSystemd [
+    "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
+    "--with-systemduserunitdir=${placeholder "out"}/lib/systemd/user"
+  ];
+
+  # we could also pass --enable-completions to configure but we would then have to
+  # figure out the paths manually and pass those along.
+  postInstall = ''
+    installShellCompletion --bash --name ${pname}  contrib/completions/complete.bash
+    installShellCompletion --zsh  --name _${pname} contrib/completions/complete.zsh
+  '';
 
   meta = with stdenv.lib; {
     description = "A complete tool to interact with OneDrive on Linux";
diff --git a/pkgs/applications/science/biology/picard-tools/default.nix b/pkgs/applications/science/biology/picard-tools/default.nix
index a1616774d5d7..85d92d3af843 100644
--- a/pkgs/applications/science/biology/picard-tools/default.nix
+++ b/pkgs/applications/science/biology/picard-tools/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "picard-tools";
-  version = "2.22.9";
+  version = "2.23.0";
 
   src = fetchurl {
     url = "https://github.com/broadinstitute/picard/releases/download/${version}/picard.jar";
-    sha256 = "0qm32a58b2asiw8rnw1r6vz3bi61vfdan6wyr9f78fj4d07q7n53";
+    sha256 = "0yhgfz5jjw55ipgdb32wjdcb01xx2g9ikgvwinnfwswx50iscf5a";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/science/logic/lean/default.nix b/pkgs/applications/science/logic/lean/default.nix
index 451aab6c049a..7fcc4cdd062e 100644
--- a/pkgs/applications/science/logic/lean/default.nix
+++ b/pkgs/applications/science/logic/lean/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lean";
-  version = "3.15.0";
+  version = "3.16.2";
 
   src = fetchFromGitHub {
     owner  = "leanprover-community";
     repo   = "lean";
     rev    = "v${version}";
-    sha256 = "0fl8v8n53fr5qdnabici1mj3zpmjrkssx970y3q4m48s68q665v6";
+    sha256 = "0fvm7gvbr5kn258sqpnxa7dvzz84iv1dx1n066vih5gz80plz4lh";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 78981ef9ad0f..5686b1c6f3f5 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -21,7 +21,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.26.2";
+  version = "2.27.0";
   svn = subversionClient.override { perlBindings = perlSupport; };
 
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "0j685w6pzkn926z5nf5r8fij4ziipvw4c9yb0wc577nzf4j16rbd";
+    sha256 = "1ybk39ylvs32lywq7ra4l2kdr5izc80r9461hwfnw8pssxs9gjkk";
   };
 
   outputs = [ "out" ] ++ stdenv.lib.optional withManual "doc";
@@ -286,13 +286,14 @@ stdenv.mkDerivation {
         mv t/{,skip-}$test.sh || true
       else
         sed -i t/$test.sh \
-          -e "/^ *test_expect_.*$pattern/,/^ *' *\$/{s/^/#/}"
+          -e "/^\s*test_expect_.*$pattern/,/^\s*' *\$/{s/^/: #/}"
       fi
     }
 
     # Shared permissions are forbidden in sandbox builds.
     disable_test t0001-init shared
     disable_test t1301-shared-repo
+    disable_test t5324-split-commit-graph 'split commit-graph respects core.sharedrepository'
 
     # Our patched gettext never fallbacks
     disable_test t0201-gettext-fallbacks
@@ -343,6 +344,6 @@ stdenv.mkDerivation {
     '';
 
     platforms = stdenv.lib.platforms.all;
-    maintainers = with stdenv.lib.maintainers; [ peti wmertens globin ];
+    maintainers = with stdenv.lib.maintainers; [ primeos peti wmertens globin ];
   };
 }
diff --git a/pkgs/applications/window-managers/sway/contrib.nix b/pkgs/applications/window-managers/sway/contrib.nix
new file mode 100644
index 000000000000..e2c27fb470f7
--- /dev/null
+++ b/pkgs/applications/window-managers/sway/contrib.nix
@@ -0,0 +1,107 @@
+{ stdenv
+
+, fetchurl
+, coreutils
+, makeWrapper
+, sway-unwrapped
+, installShellFiles
+, wl-clipboard
+, libnotify
+, slurp
+, grim
+, jq
+
+, python3Packages
+}:
+
+{
+
+grimshot = stdenv.mkDerivation rec {
+  pname = "grimshot";
+  version = "2020-05-08";
+  rev = "b1d08db5f5112ab562f89564825e3e791b0682c4";
+
+  # master has new fixes and features, and a man page
+  # after sway-1.5 these may be switched to sway-unwrapped.src
+  bsrc = fetchurl {
+    url = "https://raw.githubusercontent.com/swaywm/sway/${rev}/contrib/grimshot";
+    sha256 = "1awzmzkib8a7q5s78xyh8za03lplqfpbasqp3lidqqmjqs882jq9";
+  };
+
+  msrc = fetchurl {
+    url = "https://raw.githubusercontent.com/swaywm/sway/${rev}/contrib/grimshot.1";
+    sha256 = "191xxjfhf61gkxl3b0f694h0nrwd7vfnyp5afk8snhhr6q7ia4jz";
+  };
+
+  dontBuild = true;
+  dontUnpack = true;
+  dontConfigure = true;
+
+  outputs = [ "out" "man" ];
+
+  nativeBuildInputs = [ makeWrapper installShellFiles ];
+
+  installPhase = ''
+    installManPage ${msrc}
+
+    install -Dm 0755 ${bsrc} $out/bin/grimshot
+    wrapProgram $out/bin/grimshot --set PATH \
+      "${stdenv.lib.makeBinPath [
+        sway-unwrapped
+        wl-clipboard
+        coreutils
+        libnotify
+        slurp
+        grim
+        jq
+        ] }"
+  '';
+
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    # check always returns 0
+    if [[ $($out/bin/grimshot check | grep "NOT FOUND") ]]; then false
+    else
+      echo "grimshot check passed"
+    fi
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A helper for screenshots within sway";
+    homepage = "https://github.com/swaywm/sway/tree/master/contrib";
+    license = licenses.mit;
+    platforms = platforms.all;
+    maintainers = with maintainers; [
+      sway-unwrapped.meta.maintainers
+      evils
+    ];
+  };
+};
+
+
+inactive-windows-transparency = python3Packages.buildPythonApplication rec {
+  # long name is long
+  lname = "inactive-windows-transparency";
+  pname = "sway-${lname}";
+  version = sway-unwrapped.version;
+
+  src = sway-unwrapped.src;
+
+  format = "other";
+  dontBuild = true;
+  dontConfigure = true;
+
+  propagatedBuildInputs = [ python3Packages.i3ipc ];
+
+  installPhase = ''
+    install -Dm 0755 $src/contrib/${lname}.py $out/bin/${lname}.py
+  '';
+
+  meta = sway-unwrapped.meta // {
+    description = "It makes inactive sway windows transparent";
+    homepage    = "https://github.com/swaywm/sway/tree/${sway-unwrapped.version}/contrib";
+  };
+};
+
+}
diff --git a/pkgs/build-support/rust/default.nix b/pkgs/build-support/rust/default.nix
index 770a6d1042e7..8d3a7ba6929c 100644
--- a/pkgs/build-support/rust/default.nix
+++ b/pkgs/build-support/rust/default.nix
@@ -28,6 +28,13 @@
 , meta ? {}
 , target ? null
 , cargoVendorDir ? null
+, checkType ? buildType
+
+# Needed to `pushd`/`popd` into a subdir of a tarball if this subdir
+# contains a Cargo.toml, but isn't part of a workspace (which is e.g. the
+# case for `rustfmt`/etc from the `rust-sources).
+# Otherwise, everything from the tarball would've been built/tested.
+, buildAndTestSubdir ? null
 , ... } @ args:
 
 assert cargoVendorDir == null -> cargoSha256 != "unset";
@@ -163,6 +170,7 @@ stdenv.mkDerivation (args // {
   '';
 
   buildPhase = with builtins; args.buildPhase or ''
+    ${stdenv.lib.optionalString (buildAndTestSubdir != null) "pushd ${buildAndTestSubdir}"}
     runHook preBuild
 
     (
@@ -178,22 +186,29 @@ stdenv.mkDerivation (args // {
         --frozen ${concatStringsSep " " cargoBuildFlags}
     )
 
-    # rename the output dir to a architecture independent one
-    mapfile -t targets < <(find "$NIX_BUILD_TOP" -type d | grep '${releaseDir}$')
-    for target in "''${targets[@]}"; do
-      rm -rf "$target/../../${buildType}"
-      ln -srf "$target" "$target/../../"
-    done
-
     runHook postBuild
+
+    ${stdenv.lib.optionalString (buildAndTestSubdir != null) "popd"}
+
+    # This needs to be done after postBuild: packages like `cargo` do a pushd/popd in
+    # the pre/postBuild-hooks that need to be taken into account before gathering
+    # all binaries to install.
+    bins=$(find $releaseDir \
+      -maxdepth 1 \
+      -type f \
+      -executable ! \( -regex ".*\.\(so.[0-9.]+\|so\|a\|dylib\)" \))
   '';
 
-  checkPhase = args.checkPhase or ''
+  checkPhase = args.checkPhase or (let
+    argstr = "${stdenv.lib.optionalString (checkType == "release") "--release"} --target ${rustTarget} --frozen";
+  in ''
+    ${stdenv.lib.optionalString (buildAndTestSubdir != null) "pushd ${buildAndTestSubdir}"}
     runHook preCheck
-    echo "Running cargo cargo test -- ''${checkFlags} ''${checkFlagsArray+''${checkFlagsArray[@]}}"
-    cargo test -- ''${checkFlags} ''${checkFlagsArray+"''${checkFlagsArray[@]}"}
+    echo "Running cargo test ${argstr} -- ''${checkFlags} ''${checkFlagsArray+''${checkFlagsArray[@]}}"
+    cargo test ${argstr} -- ''${checkFlags} ''${checkFlagsArray+"''${checkFlagsArray[@]}"}
     runHook postCheck
-  '';
+    ${stdenv.lib.optionalString (buildAndTestSubdir != null) "popd"}
+  '');
 
   doCheck = args.doCheck or true;
 
@@ -203,13 +218,16 @@ stdenv.mkDerivation (args // {
 
   installPhase = args.installPhase or ''
     runHook preInstall
+
+    # rename the output dir to a architecture independent one
+    mapfile -t targets < <(find "$NIX_BUILD_TOP" -type d | grep '${releaseDir}$')
+    for target in "''${targets[@]}"; do
+      rm -rf "$target/../../${buildType}"
+      ln -srf "$target" "$target/../../"
+    done
     mkdir -p $out/bin $out/lib
 
-    find $releaseDir \
-      -maxdepth 1 \
-      -type f \
-      -executable ! \( -regex ".*\.\(so.[0-9.]+\|so\|a\|dylib\)" \) \
-      -print0 | xargs -r -0 cp -t $out/bin
+    xargs -r cp -t $out/bin <<< $bins
     find $releaseDir \
       -maxdepth 1 \
       -regex ".*\.\(so.[0-9.]+\|so\|a\|dylib\)" \
diff --git a/pkgs/data/fonts/fira-code/default.nix b/pkgs/data/fonts/fira-code/default.nix
index 2048bc797c9b..4f0fb1e81c16 100644
--- a/pkgs/data/fonts/fira-code/default.nix
+++ b/pkgs/data/fonts/fira-code/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchzip }:
 
 let
-  version = "4";
+  version = "5.2";
 in fetchzip {
   name = "fira-code-${version}";
 
@@ -9,11 +9,10 @@ in fetchzip {
 
   postFetch = ''
     mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
     unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
   '';
 
-  sha256 = "0n9qkng31ydvpdjc1an4ylpfy4x883c6czhyzvhjsmavd7bv4j9a";
+  sha256 = "16v62wj872ba4w7qxn4l6zjgqh7lrpwh1xax1bp1x9dpz08mnq06";
 
   meta = with stdenv.lib; {
     homepage = "https://github.com/tonsky/FiraCode";
diff --git a/pkgs/development/compilers/binaryen/default.nix b/pkgs/development/compilers/binaryen/default.nix
index 3a03f633ff0d..651c88704da3 100644
--- a/pkgs/development/compilers/binaryen/default.nix
+++ b/pkgs/development/compilers/binaryen/default.nix
@@ -1,11 +1,11 @@
 { stdenv, cmake, python3, fetchFromGitHub, emscriptenRev ? null, substituteAll }:
 
 let
-  defaultVersion = "93";
+  defaultVersion = "94";
 
   # Map from git revs to SHA256 hashes
   sha256s = {
-    version_93 = "15y3703ha6mxcq168br0wlydas5rq66msrcsd650zrjz0ndxwsfx";
+    version_94 = "1wk20fhyppb2ljni7ifqnsx9kl1kcl6c0svc0qljf0bs6rvr9qdm";
     "1.39.1" = "0ygm9m5322h4vfpf3j63q32qxk2l26yk62hh7dkb49j51zwl1y3y";
   };
 in
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index 65614b9480e7..dfea7f6c8ef6 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -9,8 +9,7 @@ rustPlatform.buildRustPackage {
 
   # the rust source tarball already has all the dependencies vendored, no need to fetch them again
   cargoVendorDir = "vendor";
-  preBuild = "pushd src/tools/cargo";
-  postBuild = "popd";
+  buildAndTestSubdir = "src/tools/cargo";
 
   passthru.rustc = rustc;
 
diff --git a/pkgs/development/compilers/rust/clippy.nix b/pkgs/development/compilers/rust/clippy.nix
index 4857b587847e..0546ad9bac1a 100644
--- a/pkgs/development/compilers/rust/clippy.nix
+++ b/pkgs/development/compilers/rust/clippy.nix
@@ -5,8 +5,7 @@ rustPlatform.buildRustPackage {
 
   # the rust source tarball already has all the dependencies vendored, no need to fetch them again
   cargoVendorDir = "vendor";
-  preBuild = "pushd src/tools/clippy";
-  postBuild = "popd";
+  buildAndTestSubdir = "src/tools/clippy";
 
   # changes hash of vendor directory otherwise
   dontUpdateAutotoolsGnuConfigScripts = true;
diff --git a/pkgs/development/compilers/rust/rls/default.nix b/pkgs/development/compilers/rust/rls/default.nix
index 05a9d5049a4f..63a3c96a8f92 100644
--- a/pkgs/development/compilers/rust/rls/default.nix
+++ b/pkgs/development/compilers/rust/rls/default.nix
@@ -10,8 +10,9 @@ rustPlatform.buildRustPackage {
   dontUpdateAutotoolsGnuConfigScripts = true;
 
   cargoVendorDir = "vendor";
+  buildAndTestSubdir = "src/tools/rls";
+
   preBuild = ''
-    pushd src/tools/rls
     # client tests are flaky
     rm tests/client.rs
   '';
@@ -28,8 +29,6 @@ rustPlatform.buildRustPackage {
 
   doCheck = true;
 
-  preInstall = "popd";
-
   doInstallCheck = true;
   installCheckPhase = ''
     $out/bin/rls --version
diff --git a/pkgs/development/compilers/rust/rustfmt.nix b/pkgs/development/compilers/rust/rustfmt.nix
index f8ed0bce2e0d..66a18f40ad42 100644
--- a/pkgs/development/compilers/rust/rustfmt.nix
+++ b/pkgs/development/compilers/rust/rustfmt.nix
@@ -6,8 +6,7 @@ rustPlatform.buildRustPackage rec {
 
   # the rust source tarball already has all the dependencies vendored, no need to fetch them again
   cargoVendorDir = "vendor";
-  preBuild = "pushd src/tools/rustfmt";
-  preInstall = "popd";
+  buildAndTestSubdir = "src/tools/rustfmt";
 
   # changes hash of vendor directory otherwise
   dontUpdateAutotoolsGnuConfigScripts = true;
@@ -17,12 +16,6 @@ rustPlatform.buildRustPackage rec {
   # As of 1.0.0 and rustc 1.30 rustfmt requires a nightly compiler
   RUSTC_BOOTSTRAP = 1;
 
-  # we run tests in debug mode so tests look for a debug build of
-  # rustfmt. Anyway this adds nearly no compilation time.
-  preCheck = ''
-    cargo build
-  '';
-
   meta = with stdenv.lib; {
     description = "A tool for formatting Rust code according to style guidelines";
     homepage = "https://github.com/rust-lang-nursery/rustfmt";
diff --git a/pkgs/development/coq-modules/flocq/default.nix b/pkgs/development/coq-modules/flocq/default.nix
index e0c32bc430ed..c5d3a295f2bc 100644
--- a/pkgs/development/coq-modules/flocq/default.nix
+++ b/pkgs/development/coq-modules/flocq/default.nix
@@ -2,11 +2,11 @@
 
 let params =
   if stdenv.lib.versionAtLeast coq.coq-version "8.7" then {
-    version = "3.2.0";
-    sha256 = "15bi36x7zj0glsb3s2gwqd4wswhfzh36rbp7imbyff53a7nna95l";
+    version = "3.3.1";
+    sha256 = "0k1nfgiszmai5dihhpfa5mgq9rwigl0n38dw10jn79x89xbdpyh5";
   } else {
     version = "2.6.1";
-    sha256 = "1y4czkfrd8p37vwv198nns4hz1brfv71na17pxsidwpxy7qnyfw1";
+    sha256 = "0q5a038ww5dn72yvwn5298d3ridkcngb1dik8hdyr3xh7gr5qibj";
   }
 ; in
 
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   ]);
 
   buildPhase = ''
-    ${bash}/bin/bash autogen.sh
+    ${bash}/bin/bash autogen.sh || autoconf
     ${bash}/bin/bash configure --libdir=$out/lib/coq/${coq.coq-version}/user-contrib/Flocq
     ./remake
   '';
@@ -44,6 +44,6 @@ stdenv.mkDerivation rec {
   };
 
   passthru = {
-    compatibleCoqVersions = v: builtins.elem v [ "8.5" "8.6" "8.7" "8.8" "8.9" "8.10" ];
+    compatibleCoqVersions = v: builtins.elem v [ "8.5" "8.6" "8.7" "8.8" "8.9" "8.10" "8.11" "8.12" ];
   };
 }
diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index cc43a7d2f858..9690dfac2f20 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -170,11 +170,11 @@ let
       priority = 6; # in `buildEnv' (including the one inside `perl.withPackages') the library files will have priority over files in `perl`
     };
   } // optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
-    crossVersion = "1.3.2"; # Mar 21, 2020
+    crossVersion = "1.3.4"; # Jun 2, 2020
 
     perl-cross-src = fetchurl {
       url = "https://github.com/arsv/perl-cross/archive/${crossVersion}.tar.gz";
-      sha256 = "1283crdjsyi45mgdiak4jmy907mqn09frxzxp21b18hvxmfn4smq";
+      sha256 = "15wvlafhpsh9h66s3vazhx46hf8ik75473acrvf6722ijd1wpz45";
     };
 
     depsBuildBuild = [ buildPackages.stdenv.cc makeWrapper ];
@@ -194,23 +194,23 @@ in {
   perl528 = common {
     perl = pkgs.perl528;
     buildPerl = buildPackages.perl528;
-    version = "5.28.2";
-    sha256 = "1iynpsxdym4h76kgndmn3ykvwxhqz444xvaz8z2irsxkvmnlb5da";
+    version = "5.28.3";
+    sha256 = "052if351m81yhaab429i1kv77v9b15qm0g48kr6y2yjrc7bc3jdg";
   };
 
   # Maint version
   perl530 = common {
     perl = pkgs.perl530;
     buildPerl = buildPackages.perl530;
-    version = "5.30.2";
-    sha256 = "128nfdxcvxfn5kq55qcfrx2851ys8hv794dcdxbyny8rm7w7vnv6";
+    version = "5.30.3";
+    sha256 = "0vs0wwwlw47sswxaflkk4hw0y45cmc7arxx788kwpbminy5lrq1j";
   };
 
   # the latest Devel version
   perldevel = common {
     perl = pkgs.perldevel;
     buildPerl = buildPackages.perldevel;
-    version = "5.31.10";
-    sha256 = "1gvv5zs54gzb947x7ryjkaalm9rbqf8l8hwjwdm9lbfgkpg07kny";
+    version = "5.32.0-RC0";
+    sha256 = "02i6n1xa4j0ksp014yy8q0j7scjcy5mr0yd4iash2ryrrfv5yw5k";
   };
 }
diff --git a/pkgs/development/interpreters/php/default.nix b/pkgs/development/interpreters/php/default.nix
index 6ab682d97e6c..b56824c77238 100644
--- a/pkgs/development/interpreters/php/default.nix
+++ b/pkgs/development/interpreters/php/default.nix
@@ -195,9 +195,10 @@ let
 
           hardeningDisable = [ "bindnow" ];
 
-          preConfigure = ''
-            # Don't record the configure flags since this causes unnecessary
-            # runtime dependencies
+          preConfigure =
+          # Don't record the configure flags since this causes unnecessary
+          # runtime dependencies
+          ''
             for i in main/build-defs.h.in scripts/php-config.in; do
               substituteInPlace $i \
                 --replace '@CONFIGURE_COMMAND@' '(omitted)' \
@@ -206,7 +207,14 @@ let
             done
 
             export EXTENSION_DIR=$out/lib/php/extensions
-
+          ''
+          # PKG_CONFIG need not be a relative path
+          + lib.optionalString (! lib.versionAtLeast version "7.4") ''
+            for i in $(find . -type f -name "*.m4"); do
+              substituteInPlace $i \
+                --replace 'test -x "$PKG_CONFIG"' 'type -P "$PKG_CONFIG" >/dev/null'
+            done
+          '' + ''
             ./buildconf --copy --force
 
             if test -f $src/genfiles; then
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index 696be2136ecc..62aae7b22129 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -12,6 +12,7 @@
 , zlib
 , self
 , configd, coreutils
+, autoreconfHook
 , python-setup-hook
 # Some proprietary libs assume UCS2 unicode, especially on darwin :(
 , ucsEncoding ? 4
@@ -22,6 +23,7 @@
 , sha256
 , passthruFun
 , static ? false
+, enableOptimizations ? (!stdenv.isDarwin)
 }:
 
 assert x11Support -> tcl != null
@@ -85,6 +87,9 @@ let
       # backported in debian since 2013.
       # https://bugs.python.org/issue13146
       ./atomic_pyc.patch
+
+      # Backport from CPython 3.8 of a good list of tests to run for PGO.
+      ./profile-task.patch
     ] ++ optionals (x11Support && stdenv.isDarwin) [
       ./use-correct-tcl-tk-on-darwin.patch
     ] ++ optionals stdenv.isLinux [
@@ -134,7 +139,9 @@ let
         --replace 'os.popen(comm)' 'os.popen("${coreutils}/bin/nproc")'
     '';
 
-  configureFlags = [
+  configureFlags = optionals enableOptimizations [
+    "--enable-optimizations"
+  ] ++ [
     "--enable-shared"
     "--with-threads"
     "--enable-unicode=ucs${toString ucsEncoding}"
@@ -182,8 +189,9 @@ let
     ++ optionals x11Support [ tcl tk xlibsWrapper libX11 ]
     ++ optional (stdenv.isDarwin && configd != null) configd;
   nativeBuildInputs =
-    optionals (stdenv.hostPlatform != stdenv.buildPlatform)
-    [ buildPackages.stdenv.cc buildPackages.python ];
+    [ autoreconfHook ]
+    ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform)
+      [ buildPackages.stdenv.cc buildPackages.python ];
 
   mkPaths = paths: {
     C_INCLUDE_PATH = makeSearchPathOutput "dev" "include" paths;
diff --git a/pkgs/development/interpreters/python/cpython/2.7/profile-task.patch b/pkgs/development/interpreters/python/cpython/2.7/profile-task.patch
new file mode 100644
index 000000000000..9c085657ac9d
--- /dev/null
+++ b/pkgs/development/interpreters/python/cpython/2.7/profile-task.patch
@@ -0,0 +1,21 @@
+Backport from CPython 3.8 of a good list of tests to run for PGO.
+
+Upstream commit:
+  https://github.com/python/cpython/commit/4e16a4a31
+
+Upstream discussion:
+  https://bugs.python.org/issue36044
+
+diff --git a/Makefile.pre.in b/Makefile.pre.in
+index 00fdd21ce..713dc1e53 100644
+--- a/Makefile.pre.in
++++ b/Makefile.pre.in
+@@ -259,7 +259,7 @@ TCLTK_LIBS=
+ # The task to run while instrumented when building the profile-opt target.
+ # We exclude unittests with -x that take a rediculious amount of time to
+ # run in the instrumented training build or do not provide much value.
+-PROFILE_TASK=-m test.regrtest --pgo -x test_asyncore test_gdb test_multiprocessing test_subprocess
++PROFILE_TASK=-m test.regrtest --pgo test_array test_base64 test_binascii test_binop test_bisect test_bytes test_bz2 test_cmath test_codecs test_collections test_complex test_dataclasses test_datetime test_decimal test_difflib test_embed test_float test_fstring test_functools test_generators test_hashlib test_heapq test_int test_itertools test_json test_long test_lzma test_math test_memoryview test_operator test_ordered_dict test_pickle test_pprint test_re test_set test_sqlite test_statistics test_struct test_tabnanny test_time test_unicode test_xml_etree test_xml_etree_c
+ 
+ # report files for gcov / lcov coverage report
+ COVERAGE_INFO= $(abs_builddir)/coverage.info
diff --git a/pkgs/development/interpreters/python/cpython/3.5/profile-task.patch b/pkgs/development/interpreters/python/cpython/3.5/profile-task.patch
new file mode 100644
index 000000000000..39d5587379ca
--- /dev/null
+++ b/pkgs/development/interpreters/python/cpython/3.5/profile-task.patch
@@ -0,0 +1,21 @@
+Backport from CPython 3.8 of a good list of tests to run for PGO.
+
+Upstream commit:
+  https://github.com/python/cpython/commit/4e16a4a31
+
+Upstream discussion:
+  https://bugs.python.org/issue36044
+
+diff --git a/Makefile.pre.in b/Makefile.pre.in
+index 00fdd21ce..713dc1e53 100644
+--- a/Makefile.pre.in
++++ b/Makefile.pre.in
+@@ -259,7 +259,7 @@ TCLTK_LIBS=
+ # The task to run while instrumented when building the profile-opt target.
+ # We exclude unittests with -x that take a rediculious amount of time to
+ # run in the instrumented training build or do not provide much value.
+-PROFILE_TASK=-m test.regrtest --pgo -x test_asyncore test_gdb test_multiprocessing_fork test_multiprocessing_forkserver test_multiprocessing_main_handling test_multiprocessing_spawn test_subprocess
++PROFILE_TASK=-m test.regrtest --pgo test_array test_base64 test_binascii test_binop test_bisect test_bytes test_bz2 test_cmath test_codecs test_collections test_complex test_dataclasses test_datetime test_decimal test_difflib test_embed test_float test_fstring test_functools test_generators test_hashlib test_heapq test_int test_itertools test_json test_long test_lzma test_math test_memoryview test_operator test_ordered_dict test_pickle test_pprint test_re test_set test_sqlite test_statistics test_struct test_tabnanny test_time test_unicode test_xml_etree test_xml_etree_c
+ 
+ # report files for gcov / lcov coverage report
+ COVERAGE_INFO= $(abs_builddir)/coverage.info
diff --git a/pkgs/development/interpreters/python/cpython/3.6/profile-task.patch b/pkgs/development/interpreters/python/cpython/3.6/profile-task.patch
new file mode 100644
index 000000000000..df55da3a4132
--- /dev/null
+++ b/pkgs/development/interpreters/python/cpython/3.6/profile-task.patch
@@ -0,0 +1,21 @@
+Backport from CPython 3.8 of a good list of tests to run for PGO.
+
+Upstream commit:
+  https://github.com/python/cpython/commit/4e16a4a31
+
+Upstream discussion:
+  https://bugs.python.org/issue36044
+
+diff --git a/Makefile.pre.in b/Makefile.pre.in
+index 00fdd21ce..713dc1e53 100644
+--- a/Makefile.pre.in
++++ b/Makefile.pre.in
+@@ -259,7 +259,7 @@ TCLTK_LIBS=
+ # The task to run while instrumented when building the profile-opt target.
+ # We exclude unittests with -x that take a rediculious amount of time to
+ # run in the instrumented training build or do not provide much value.
+-PROFILE_TASK=-m test.regrtest --pgo
++PROFILE_TASK=-m test.regrtest --pgo test_array test_base64 test_binascii test_binop test_bisect test_bytes test_bz2 test_cmath test_codecs test_collections test_complex test_dataclasses test_datetime test_decimal test_difflib test_embed test_float test_fstring test_functools test_generators test_hashlib test_heapq test_int test_itertools test_json test_long test_lzma test_math test_memoryview test_operator test_ordered_dict test_pickle test_pprint test_re test_set test_sqlite test_statistics test_struct test_tabnanny test_time test_unicode test_xml_etree test_xml_etree_c
+ 
+ # report files for gcov / lcov coverage report
+ COVERAGE_INFO= $(abs_builddir)/coverage.info
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 32fc65368623..694f661a9669 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -12,6 +12,7 @@
 , zlib
 , self
 , configd
+, autoreconfHook
 , python-setup-hook
 , nukeReferences
 # For the Python package set
@@ -30,6 +31,9 @@
 , stripBytecode ? false
 , includeSiteCustomize ? true
 , static ? false
+# Not using optimizations on Darwin
+# configure: error: llvm-profdata is required for a --enable-optimizations build but could not be found.
+, enableOptimizations ? (!stdenv.isDarwin)
 }:
 
 assert x11Support -> tcl != null
@@ -52,7 +56,9 @@ let
 
   version = with sourceVersion; "${major}.${minor}.${patch}${suffix}";
 
-  nativeBuildInputs = [
+  nativeBuildInputs = optionals (!stdenv.isDarwin) [
+    autoreconfHook
+  ] ++ [
     nukeReferences
   ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     buildPackages.stdenv.cc
@@ -110,6 +116,14 @@ in with passthru; stdenv.mkDerivation {
   ] ++ optionals (isPy37 || isPy38 || isPy39) [
     # Fix darwin build https://bugs.python.org/issue34027
     ./3.7/darwin-libutil.patch
+  ] ++ optionals (pythonOlder "3.8") [
+    # Backport from CPython 3.8 of a good list of tests to run for PGO.
+    (
+      if isPy36 || isPy37 then
+        ./3.6/profile-task.patch
+      else
+        ./3.5/profile-task.patch
+    )
   ] ++ optionals (isPy3k && hasDistutilsCxxPatch) [
     # Fix for http://bugs.python.org/issue1222585
     # Upstream distutils is calling C compiler to compile C++ code, which
@@ -142,10 +156,14 @@ in with passthru; stdenv.mkDerivation {
 
   configureFlags = [
     "--enable-shared"
-    "--with-threads"
     "--without-ensurepip"
     "--with-system-expat"
     "--with-system-ffi"
+  ] ++ optionals enableOptimizations [
+    "--enable-optimizations"
+  ] ++ optionals (pythonOlder "3.7") [
+    # This is unconditionally true starting in CPython 3.7.
+    "--with-threads"
   ] ++ optionals (sqlite != null && isPy3k) [
     "--enable-loadable-sqlite-extensions"
   ] ++ optionals (openssl != null) [
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index a3ba72a27b27..b05f989714a5 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -129,7 +129,7 @@ in {
   };
 
   # Minimal versions of Python (built without optional dependencies)
-  python3Minimal = (python37.override {
+  python3Minimal = (python38.override {
     self = python3Minimal;
     pythonForBuild = pkgs.buildPackages.python3Minimal;
     # strip down that python version as much as possible
@@ -146,6 +146,7 @@ in {
     rebuildBytecode = false;
     stripBytecode = true;
     includeSiteCustomize = false;
+    enableOptimizations = false;
   }).overrideAttrs(old: {
     pname = "python3-minimal";
     meta = old.meta // {
diff --git a/pkgs/development/interpreters/python/hooks/pip-build-hook.sh b/pkgs/development/interpreters/python/hooks/pip-build-hook.sh
index 292f13d30154..6dd384b4847f 100644
--- a/pkgs/development/interpreters/python/hooks/pip-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/pip-build-hook.sh
@@ -24,7 +24,8 @@ pipShellHook() {
       export PATH="$tmp_path/bin:$PATH"
       export PYTHONPATH="$tmp_path/@pythonSitePackages@:$PYTHONPATH"
       mkdir -p "$tmp_path/@pythonSitePackages@"
-      @pythonInterpreter@ -m pip install -e . --prefix "$tmp_path" >&2
+      @pythonInterpreter@ -m pip install -e . --prefix "$tmp_path" \
+         --no-build-isolation >&2
     fi
 
     runHook postShellHook
diff --git a/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh b/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
index 2aec92793825..311590425e68 100644
--- a/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
@@ -29,7 +29,8 @@ setuptoolsShellHook() {
         export PATH="$tmp_path/bin:$PATH"
         export PYTHONPATH="$tmp_path/@pythonSitePackages@:$PYTHONPATH"
         mkdir -p "$tmp_path/@pythonSitePackages@"
-        eval "@pythonInterpreter@ -m pip install -e . --prefix $tmp_path >&2"
+        eval "@pythonInterpreter@ -m pip install -e . --prefix $tmp_path \
+          --no-build-isolation >&2"
     fi
 
     runHook postShellHook
diff --git a/pkgs/development/libraries/audio/libgme/default.nix b/pkgs/development/libraries/audio/libgme/default.nix
index bcd6070831bb..3ac8293986d8 100644
--- a/pkgs/development/libraries/audio/libgme/default.nix
+++ b/pkgs/development/libraries/audio/libgme/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromBitbucket, cmake }:
+{ stdenv, fetchFromBitbucket, cmake, removeReferencesTo }:
 let
   version = "0.6.3";
 in stdenv.mkDerivation {
@@ -21,4 +21,14 @@ in stdenv.mkDerivation {
   };
 
   buildInputs = [ cmake ];
+
+  nativeBuildInputs = [ removeReferencesTo ];
+
+  # It used to reference it, in the past, but thanks to the postFixup hook, now
+  # it doesn't.
+  disallowedReferences = [ stdenv.cc.cc ];
+
+  postFixup = stdenv.lib.optionalString stdenv.isLinux ''
+    remove-references-to -t ${stdenv.cc.cc} "$(readlink -f $out/lib/libgme.so)"
+  '';
 }
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index a3e3c4ebd89a..049623d3d911 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -20,11 +20,11 @@ assert enableSystemd -> systemd != null;
 
 stdenv.mkDerivation rec {
   pname = "dbus";
-  version = "1.12.16";
+  version = "1.12.18";
 
   src = fetchurl {
     url = "https://dbus.freedesktop.org/releases/dbus/dbus-${version}.tar.gz";
-    sha256 = "107ckxaff1cv4q6kmfdi2fb1nlsv03312a7kf6lb4biglhpjv8jl";
+    sha256 = "01jkm6shm76bl3cflmnn37dv6nkph0w1akbqpklyac02hiq4vkv4";
   };
 
   patches = lib.optional stdenv.isSunOS ./implement-getgrouplist.patch;
diff --git a/pkgs/development/libraries/glibc/2.30-cve-2020-1752.patch b/pkgs/development/libraries/glibc/2.30-cve-2020-1752.patch
new file mode 100644
index 000000000000..75d874b93d09
--- /dev/null
+++ b/pkgs/development/libraries/glibc/2.30-cve-2020-1752.patch
@@ -0,0 +1,62 @@
+From: Andreas Schwab <schwab@suse.de>
+Date: Wed, 19 Feb 2020 16:21:46 +0000 (+0100)
+Subject: Fix use-after-free in glob when expanding ~user (bug 25414)
+X-Git-Url: https://sourceware.org/git/?p=glibc.git;a=commitdiff_plain;h=da97c6b88eb03fb834e92964b0895c2ac8d61f63;hp=dd34bce38c822b67fcc42e73969bf6699d6874b6
+
+Fix use-after-free in glob when expanding ~user (bug 25414)
+
+The value of `end_name' points into the value of `dirname', thus don't
+deallocate the latter before the last use of the former.
+
+(cherry picked from commit ddc650e9b3dc916eab417ce9f79e67337b05035c)
+---
+
+diff --git a/posix/glob.c b/posix/glob.c
+index e73e35c510..c6cbd0eb43 100644
+--- a/posix/glob.c
++++ b/posix/glob.c
+@@ -827,31 +827,32 @@ __glob (const char *pattern, int flags, int (*errfunc) (const char *, int),
+ 	      {
+ 		size_t home_len = strlen (p->pw_dir);
+ 		size_t rest_len = end_name == NULL ? 0 : strlen (end_name);
+-		char *d;
++		char *d, *newp;
++		bool use_alloca = glob_use_alloca (alloca_used,
++						   home_len + rest_len + 1);
+ 
+-		if (__glibc_unlikely (malloc_dirname))
+-		  free (dirname);
+-		malloc_dirname = 0;
+-
+-		if (glob_use_alloca (alloca_used, home_len + rest_len + 1))
+-		  dirname = alloca_account (home_len + rest_len + 1,
+-					    alloca_used);
++		if (use_alloca)
++		  newp = alloca_account (home_len + rest_len + 1, alloca_used);
+ 		else
+ 		  {
+-		    dirname = malloc (home_len + rest_len + 1);
+-		    if (dirname == NULL)
++		    newp = malloc (home_len + rest_len + 1);
++		    if (newp == NULL)
+ 		      {
+ 			scratch_buffer_free (&pwtmpbuf);
+ 			retval = GLOB_NOSPACE;
+ 			goto out;
+ 		      }
+-		    malloc_dirname = 1;
+ 		  }
+-		d = mempcpy (dirname, p->pw_dir, home_len);
++		d = mempcpy (newp, p->pw_dir, home_len);
+ 		if (end_name != NULL)
+ 		  d = mempcpy (d, end_name, rest_len);
+ 		*d = '\0';
+ 
++		if (__glibc_unlikely (malloc_dirname))
++		  free (dirname);
++		dirname = newp;
++		malloc_dirname = !use_alloca;
++
+ 		dirlen = home_len + rest_len;
+ 		dirname_modified = 1;
+ 	      }
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 0429c7295fb8..36b6bea61cd4 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -106,10 +106,10 @@ stdenv.mkDerivation ({
         url = "https://salsa.debian.org/glibc-team/glibc/raw/49767c9f7de4828220b691b29de0baf60d8a54ec/debian/patches/localedata/locale-C.diff";
         sha256 = "0irj60hs2i91ilwg5w7sqrxb695c93xg0ik7yhhq9irprd7fidn4";
       })
-    ]
-    ++ lib.optionals stdenv.isx86_64 [
+
       ./fix-x64-abi.patch
       ./2.27-CVE-2019-19126.patch
+      ./2.30-cve-2020-1752.patch
     ]
     ++ lib.optional stdenv.hostPlatform.isMusl ./fix-rpc-types-musl-conflicts.patch
     ++ lib.optional stdenv.buildPlatform.isDarwin ./darwin-cross-build.patch;
diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index 6d0faa03a888..f75d107718da 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -8,7 +8,7 @@
 
 assert guileBindings -> guile != null;
 let
-  version = "3.6.13";
+  version = "3.6.14";
 
   # XXX: Gnulib's `test-select' fails on FreeBSD:
   # https://hydra.nixos.org/build/2962084/nixlog/1/raw .
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://gnupg/gnutls/v3.6/gnutls-${version}.tar.xz";
-    sha256 = "0f1gnm0756qms5cpx6yn6xb8d3imc2gkqmygf12n9x6r8zs1s11j";
+    sha256 = "0qwxsfizynly0ns537vnhnlm5lh03la4vbsmz675n0n7vqd7ac2n";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
diff --git a/pkgs/development/libraries/intel-media-driver/default.nix b/pkgs/development/libraries/intel-media-driver/default.nix
index ac4bdb4b14c9..366e34ddf4d9 100644
--- a/pkgs/development/libraries/intel-media-driver/default.nix
+++ b/pkgs/development/libraries/intel-media-driver/default.nix
@@ -1,17 +1,17 @@
 { stdenv, fetchFromGitHub
-, cmake, pkgconfig
+, cmake, pkg-config
 , libva, libpciaccess, intel-gmmlib, libX11
 }:
 
 stdenv.mkDerivation rec {
   pname = "intel-media-driver";
-  version = "19.4.0r";
+  version = "20.1.1";
 
   src = fetchFromGitHub {
     owner  = "intel";
     repo   = "media-driver";
     rev    = "intel-media-${version}";
-    sha256 = "0gnd82z0wgiw5my1hnqlk9hcjjqpsgasqq5xcdrbkfa40wpb132a";
+    sha256 = "1mww20c9r7a57njqa2835ayjvk46lrv2yks9a2y8i0s5qzdi8m1i";
   };
 
   cmakeFlags = [
@@ -21,15 +21,21 @@ stdenv.mkDerivation rec {
     "-DMEDIA_RUN_TEST_SUITE=OFF"
   ];
 
-  nativeBuildInputs = [ cmake pkgconfig ];
+  nativeBuildInputs = [ cmake pkg-config ];
 
   buildInputs = [ libva libpciaccess intel-gmmlib libX11 ];
 
   meta = with stdenv.lib; {
+    description = "Intel Media Driver for VAAPI — Broadwell+ iGPUs";
+    longDescription = ''
+      The Intel Media Driver for VAAPI is a new VA-API (Video Acceleration API)
+      user mode driver supporting hardware accelerated decoding, encoding, and
+      video post processing for GEN based graphics hardware.
+    '';
     homepage = "https://github.com/intel/media-driver";
+    changelog = "https://github.com/intel/media-driver/releases/tag/intel-media-${version}";
     license = with licenses; [ bsd3 mit ];
-    description = "Intel Media Driver for VAAPI — Broadwell+ iGPUs";
     platforms = platforms.linux;
-    maintainers = with maintainers; [ jfrankenau ];
+    maintainers = with maintainers; [ primeos jfrankenau ];
   };
 }
diff --git a/pkgs/development/libraries/jbig2dec/default.nix b/pkgs/development/libraries/jbig2dec/default.nix
index 8cc2ce008716..22d38a080cab 100644
--- a/pkgs/development/libraries/jbig2dec/default.nix
+++ b/pkgs/development/libraries/jbig2dec/default.nix
@@ -1,18 +1,19 @@
-{ stdenv, fetchurl, python3, autoconf }:
+{ stdenv, fetchurl, python3, autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  name = "jbig2dec-0.17";
+  pname = "jbig2dec";
+  version = "0.18";
 
   src = fetchurl {
-    url = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs950/${name}.tar.gz";
-    sha256 = "0wpvslmwazia3z8gyk343kbq6yj47pxr4x5yjvx332v309qssazp";
+    url = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs952/${pname}-${version}.tar.gz";
+    sha256 = "0pigfw2v0ppvr0lbysm69gx0zsa5q2q92yrb8af2j3im6x97f6cy";
   };
 
   postPatch = ''
     patchShebangs test_jbig2dec.py
   '';
 
-  buildInputs = [ autoconf ];
+  buildInputs = [ autoreconfHook ];
 
   checkInputs = [ python3 ];
   doCheck = true;
diff --git a/pkgs/development/libraries/libarchive/default.nix b/pkgs/development/libraries/libarchive/default.nix
index 118adc61623a..d1917de37d6a 100644
--- a/pkgs/development/libraries/libarchive/default.nix
+++ b/pkgs/development/libraries/libarchive/default.nix
@@ -1,6 +1,6 @@
 {
   fetchFromGitHub, stdenv, pkgconfig, autoreconfHook,
-  acl, attr, bzip2, e2fsprogs, libxml2, lzo, openssl, sharutils, xz, zlib,
+  acl, attr, bzip2, e2fsprogs, libxml2, lzo, openssl, sharutils, xz, zlib, zstd,
 
   # Optional but increases closure only negligibly.
   xarSupport ? true,
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "lib" "dev" ];
 
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
-  buildInputs = [ sharutils zlib bzip2 openssl xz lzo ]
+  buildInputs = [ sharutils zlib bzip2 openssl xz lzo zstd ]
     ++ stdenv.lib.optionals stdenv.isLinux [ e2fsprogs attr acl ]
     ++ stdenv.lib.optional xarSupport libxml2;
 
diff --git a/pkgs/development/libraries/libdap/default.nix b/pkgs/development/libraries/libdap/default.nix
index 27084e54a827..bc05e774cd86 100644
--- a/pkgs/development/libraries/libdap/default.nix
+++ b/pkgs/development/libraries/libdap/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, bison, libuuid, curl, libxml2, flex }:
 
 stdenv.mkDerivation rec {
-  version = "3.20.5";
+  version = "3.20.6";
   pname = "libdap";
 
   nativeBuildInputs = [ bison flex ];
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://www.opendap.org/pub/source/${pname}-${version}.tar.gz";
-    sha256 = "15jysnsmdjs7q4iafb4qzq4b76cfyvmbxgcxnqg4sr0x4bplwfnb";
+    sha256 = "0jn5bi8k2lq6mmrsw7r1r5aviyf8gb39b2iy20v4kpkj5napzk1m";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/libexif/default.nix b/pkgs/development/libraries/libexif/default.nix
index 090c6a2fff34..fd2ed39e34a4 100644
--- a/pkgs/development/libraries/libexif/default.nix
+++ b/pkgs/development/libraries/libexif/default.nix
@@ -1,45 +1,24 @@
-{ stdenv, fetchurl, fetchpatch, gettext }:
+{ stdenv, fetchFromGitHub, autoreconfHook, gettext }:
 
 stdenv.mkDerivation rec {
-  name = "libexif-0.6.21";
+  pname = "libexif";
+  version = "0.6.22";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/libexif/${name}.tar.bz2";
-    sha256 = "06nlsibr3ylfwp28w8f5466l6drgrnydgxrm4jmxzrmk5svaxk8n";
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = "${pname}-${builtins.replaceStrings ["."] ["_"] version}-release";
+    sha256 = "0mzndakdi816zcs13z7yzp7hj031p2dcyfq2p391r63d9z21jmy1";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2017-7544.patch";
-      url = "https://github.com/libexif/libexif/commit/c39acd1692023b26290778a02a9232c873f9d71a.patch";
-      sha256 = "0xgx6ly2i4q05shb61mfx6njwf1yp347jkznm0ka4m85i41xm6sd";
-    })
-    (fetchpatch {
-      name = "CVE-2018-20030-1.patch";
-      url = "https://github.com/libexif/libexif/commit/5d28011c40ec86cf52cffad541093d37c263898a.patch";
-      sha256 = "1wv8s962wmbn2m2xypgirf12g6msrbplpsmd5bh86irfwhkcppj3";
-    })
-    (fetchpatch {
-      name = "CVE-2018-20030-2.patch";
-      url = "https://github.com/libexif/libexif/commit/6aa11df549114ebda520dde4cdaea2f9357b2c89.patch";
-      sha256 = "01aqvz63glwq6wg0wr7ykqqghb4abgq77ghvhizbzadg1k4h7drx";
-      excludes = [ "NEWS" ];
-    })
-    (fetchpatch {
-      name = "CVE-2019-9278.patch";
-      url = "https://github.com/libexif/libexif/commit/75aa73267fdb1e0ebfbc00369e7312bac43d0566.patch";
-      sha256 = "10ikg33mips5zq9as7l9xqnyzbg1wwr4sw17517nzf4hafjpasrj";
-    })
-  ];
+  nativeBuildInputs = [ autoreconfHook gettext ];
 
-  buildInputs = [ gettext ];
-
-  meta = {
+  meta = with stdenv.lib; {
     homepage = "https://libexif.github.io/";
     description = "A library to read and manipulate EXIF data in digital photographs";
-    license = stdenv.lib.licenses.lgpl21;
-    platforms = stdenv.lib.platforms.unix;
-    maintainers = [ stdenv.lib.maintainers.erictapen ];
+    license = licenses.lgpl21;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ erictapen ];
   };
 
 }
diff --git a/pkgs/development/libraries/libgpg-error/default.nix b/pkgs/development/libraries/libgpg-error/default.nix
index e170e4931b83..1e49a72096a3 100644
--- a/pkgs/development/libraries/libgpg-error/default.nix
+++ b/pkgs/development/libraries/libgpg-error/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, buildPackages, fetchurl, gettext, fetchpatch
+{ stdenv, lib, buildPackages, fetchurl, gettext
 , genPosixLockObjOnly ? false
 }: let
   genPosixLockObjOnlyAttrs = lib.optionalAttrs genPosixLockObjOnly {
@@ -17,25 +17,14 @@
   };
 in stdenv.mkDerivation (rec {
   pname = "libgpg-error";
-  version = "1.36";
+  version = "1.38";
 
   src = fetchurl {
     url = "mirror://gnupg/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "0z696dmhfxm2n6pmr8b857wwljq9h633yi99bhbn7h88f91rigds";
+    sha256 = "00px79xzyc5lj8aig7i4fhk29h1lkqp4840wjfgi9mv9m9sq566q";
   };
 
-  # Remove gawk buildfix on > 1.36
-  patches = [
-    (fetchpatch {
-      url = "https://dev.gnupg.org/rE7865041c77f4f7005282f10f9b6666b19072fbdf?diff=1";
-      sha256 = "0hs4rpwqq2afpsbqliq451jjaysq2iyzxvd9sx3992b4vnllgqqq";
-    })
-  ];
-
   postPatch = ''
-    # Remove on > 1.36 release: gawk upgrade fix didn't include Makefile regeneration
-    sed 's/-v namespace=errnos_/-v pkg_namespace=errnos_/' -i src/Makefile.in
-
     sed '/BUILD_TIMESTAMP=/s/=.*/=1970-01-01T00:01+0000/' -i ./configure
   '' + lib.optionalString (stdenv.hostPlatform.isAarch32 && stdenv.buildPlatform != stdenv.hostPlatform) ''
     ln -s lock-obj-pub.arm-unknown-linux-gnueabi.h src/syscfg/lock-obj-pub.linux-gnueabihf.h
diff --git a/pkgs/development/libraries/libheif/default.nix b/pkgs/development/libraries/libheif/default.nix
index b5717034da0e..d147820cff1c 100644
--- a/pkgs/development/libraries/libheif/default.nix
+++ b/pkgs/development/libraries/libheif/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libheif";
-  version = "1.6.2";
+  version = "1.7.0";
 
   outputs = [ "bin" "out" "dev" "man" ];
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     owner = "strukturag";
     repo = "libheif";
     rev = "v${version}";
-    sha256 = "0ngbzban585hsgs6fb6fkhccc91kxn1n59qvqjp8bw41l24i3nr2";
+    sha256 = "0alri5h486ck9b5z6wwrmlpzydhz58l223z3zxkizqrzxlllhr6p";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/development/libraries/liblastfm/default.nix b/pkgs/development/libraries/liblastfm/default.nix
index 62409bb7f649..830e125685e7 100644
--- a/pkgs/development/libraries/liblastfm/default.nix
+++ b/pkgs/development/libraries/liblastfm/default.nix
@@ -1,30 +1,34 @@
-{ stdenv, fetchurl, qt4, pkgconfig, libsamplerate, fftwSinglePrec, which, cmake
+{ stdenv, fetchFromGitHub, fetchpatch, pkgconfig, which, cmake
+, fftwSinglePrec, libsamplerate, qtbase
 , darwin }:
 
-let version = "1.1.0"; in
-
 stdenv.mkDerivation rec {
-  pname = "liblastfm";
-  inherit version;
+  pname = "liblastfm-unstable";
+  version = "2019-08-23";
 
-  # Upstream does not package git tags as tarballs. Get tarball from github.
-  src = fetchurl {
-    url = "https://github.com/lastfm/liblastfm/tarball/${version}";
-    name = "${pname}-${version}.tar.gz";
-    sha256 = "1j34xc30vg7sfszm2jx9mlz9hy7p1l929fka9wnfcpbib8gfi43x";
+  src = fetchFromGitHub {
+    owner = "lastfm";
+    repo = "liblastfm";
+    rev = "2ce2bfe1879227af8ffafddb82b218faff813db9";
+    sha256 = "1crih9xxf3rb109aqw12bjqv47z28lvlk2dpvyym5shf82nz6yd0";
   };
 
-  prefixKey = "--prefix ";
-  propagatedBuildInputs = [ qt4 libsamplerate fftwSinglePrec ];
+  patches = [(fetchpatch {
+    url = "https://github.com/lastfm/liblastfm/commit/9c5d072b55f2863310e40291677e6397e9cbc3c2.patch";
+    name = "0001-Remove-deprecated-staging-server-and-fix-test-for-QT5-at-Ubuntu-19.10.patch";
+    sha256 = "04r14prydxshjgfws3pjajjmp2msszhjjs1mjh8s66yg29vq620l";
+  })];
+
   nativeBuildInputs = [ pkgconfig which cmake ];
-  buildInputs = stdenv.lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.SystemConfiguration;
+  buildInputs = [ fftwSinglePrec libsamplerate qtbase ]
+    ++ stdenv.lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.SystemConfiguration;
 
   meta = with stdenv.lib; {
     homepage = "https://github.com/lastfm/liblastfm";
     repositories.git = "git://github.com/lastfm/liblastfm.git";
     description = "Official LastFM library";
-    inherit (qt4.meta) platforms;
-    maintainers =  [ maintainers.phreedom ];
+    platforms = platforms.unix;
+    maintainers = [ maintainers.phreedom ];
     license = licenses.gpl3;
   };
 }
diff --git a/pkgs/development/libraries/libpcap/default.nix b/pkgs/development/libraries/libpcap/default.nix
index 35cf4485f72e..d9cb91e4fb3b 100644
--- a/pkgs/development/libraries/libpcap/default.nix
+++ b/pkgs/development/libraries/libpcap/default.nix
@@ -24,12 +24,14 @@ stdenv.mkDerivation rec {
   ] ++ optionals (stdenv.hostPlatform == stdenv.buildPlatform)
     [ "ac_cv_linux_vers=2" ];
 
-  dontStrip = stdenv.hostPlatform != stdenv.buildPlatform;
-
   prePatch = optionalString stdenv.isDarwin ''
     substituteInPlace configure --replace " -arch i386" ""
   '';
 
+  postInstall = ''
+    rm -f $out/lib/libpcap.a
+  '';
+
   meta = {
     homepage = "https://www.tcpdump.org";
     description = "Packet Capture Library";
diff --git a/pkgs/development/libraries/librealsense/default.nix b/pkgs/development/libraries/librealsense/default.nix
index 8fd90c60bdad..21f80f80efa0 100644
--- a/pkgs/development/libraries/librealsense/default.nix
+++ b/pkgs/development/libraries/librealsense/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "librealsense";
-  version = "2.34.0";
+  version = "2.35.2";
 
   outputs = [ "out" "dev" ];
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     owner = "IntelRealSense";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0bi7pszrryz18aqna0z73mb1hzz2vqdb0m00pf93hnwc2hba7hwm";
+    sha256 = "14vf76vlyhh7b4yjzsnqpg1x3wdhwxrf1syvgf8wyxbjwb9plw82";
   };
 
   buildInputs = [
diff --git a/pkgs/development/libraries/libssh2/CVE-2019-17498.patch b/pkgs/development/libraries/libssh2/CVE-2019-17498.patch
new file mode 100644
index 000000000000..8681c3ef6091
--- /dev/null
+++ b/pkgs/development/libraries/libssh2/CVE-2019-17498.patch
@@ -0,0 +1,210 @@
+From b9aa7c2495694d0527e4e7fd560a3f0f18556c72 Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will@panic.com>
+Date: Thu, 29 Aug 2019 15:14:19 -0700
+Subject: [PATCH 1/5] packet.c: improve parsing of packets
+
+file: packet.c
+
+notes:
+Use _libssh2_get_string API in SSH_MSG_DEBUG, additional uint32 bounds check in SSH_MSG_GLOBAL_REQUEST
+---
+ src/packet.c | 30 +++++++++++++++---------------
+ 1 file changed, 15 insertions(+), 15 deletions(-)
+
+diff --git a/src/packet.c b/src/packet.c
+index 38ab62944..ac69768cd 100644
+--- a/src/packet.c
++++ b/src/packet.c
+@@ -537,26 +537,26 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+         case SSH_MSG_DEBUG:
+             if(datalen >= 2) {
+                 int always_display = data[1];
+-
++            
+                 if(datalen >= 6) {
+-                    message_len = _libssh2_ntohu32(data + 2);
+-
+-                    if(message_len <= (datalen - 10)) {
+-                        /* 6 = packet_type(1) + display(1) + message_len(4) */
+-                        message = (char *) data + 6;
+-                        language_len = _libssh2_ntohu32(data + 6 +
+-                                                        message_len);
+-
+-                        if(language_len <= (datalen - 10 - message_len))
+-                            language = (char *) data + 10 + message_len;
+-                    }
++                    struct string_buf buf;
++                    buf.data = (unsigned char *)data;
++                    buf.dataptr = buf.data;
++                    buf.len = datalen;
++                    buf.dataptr += 2; /* advance past type & always display */
++
++                    _libssh2_get_string(&buf, &message, &message_len);
++                    _libssh2_get_string(&buf, &language, &language_len);
+                 }
+ 
+                 if(session->ssh_msg_debug) {
+-                    LIBSSH2_DEBUG(session, always_display, message,
+-                                  message_len, language, language_len);
++                    LIBSSH2_DEBUG(session, always_display,
++                                  (const char *)message,
++                                  message_len, (const char *)language,
++                                  language_len);
+                 }
+             }
++
+             /*
+              * _libssh2_debug will actually truncate this for us so
+              * that it's not an inordinate about of data
+@@ -579,7 +579,7 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+                 uint32_t len = 0;
+                 unsigned char want_reply = 0;
+                 len = _libssh2_ntohu32(data + 1);
+-                if(datalen >= (6 + len)) {
++                if((len <= (UINT_MAX - 6) && (datalen >= (6 + len))) {
+                     want_reply = data[5 + len];
+                     _libssh2_debug(session,
+                                    LIBSSH2_TRACE_CONN,
+
+From 8b3cf0b17c1b84a138bed9423a9e0743452b4de9 Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will@panic.com>
+Date: Thu, 29 Aug 2019 15:15:33 -0700
+Subject: [PATCH 2/5] stray whitespace
+
+---
+ src/packet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/packet.c b/src/packet.c
+index ac69768cd..8908b2c5a 100644
+--- a/src/packet.c
++++ b/src/packet.c
+@@ -537,7 +537,7 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+         case SSH_MSG_DEBUG:
+             if(datalen >= 2) {
+                 int always_display = data[1];
+-            
++
+                 if(datalen >= 6) {
+                     struct string_buf buf;
+                     buf.data = (unsigned char *)data;
+
+From 1c6fa92b77e34d089493fe6d3e2c6c8775858b94 Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will@panic.com>
+Date: Thu, 29 Aug 2019 15:24:22 -0700
+Subject: [PATCH 3/5] fixed type issue, updated SSH_MSG_DISCONNECT
+
+SSH_MSG_DISCONNECT now also uses  _libssh2_get API.
+---
+ src/packet.c | 40 +++++++++++++++-------------------------
+ 1 file changed, 15 insertions(+), 25 deletions(-)
+
+diff --git a/src/packet.c b/src/packet.c
+index 8908b2c5a..97f0cdd4b 100644
+--- a/src/packet.c
++++ b/src/packet.c
+@@ -419,8 +419,8 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+                     size_t datalen, int macstate)
+ {
+     int rc = 0;
+-    char *message = NULL;
+-    char *language = NULL;
++    unsigned char *message = NULL;
++    unsigned char *language = NULL;
+     size_t message_len = 0;
+     size_t language_len = 0;
+     LIBSSH2_CHANNEL *channelp = NULL;
+@@ -472,33 +472,23 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+ 
+         case SSH_MSG_DISCONNECT:
+             if(datalen >= 5) {
+-                size_t reason = _libssh2_ntohu32(data + 1);
++                uint32_t reason = 0;
++                struct string_buf buf;
++                buf.data = (unsigned char *)data;
++                buf.dataptr = buf.data;
++                buf.len = datalen;
++                buf.dataptr++; /* advance past type */
+ 
+-                if(datalen >= 9) {
+-                    message_len = _libssh2_ntohu32(data + 5);
++                _libssh2_get_u32(&buf, &reason);
++                _libssh2_get_string(&buf, &message, &message_len);
++                _libssh2_get_string(&buf, &language, &language_len);
+ 
+-                    if(message_len < datalen-13) {
+-                        /* 9 = packet_type(1) + reason(4) + message_len(4) */
+-                        message = (char *) data + 9;
+-
+-                        language_len =
+-                            _libssh2_ntohu32(data + 9 + message_len);
+-                        language = (char *) data + 9 + message_len + 4;
+-
+-                        if(language_len > (datalen-13-message_len)) {
+-                            /* bad input, clear info */
+-                            language = message = NULL;
+-                            language_len = message_len = 0;
+-                        }
+-                    }
+-                    else
+-                        /* bad size, clear it */
+-                        message_len = 0;
+-                }
+                 if(session->ssh_msg_disconnect) {
+-                    LIBSSH2_DISCONNECT(session, reason, message,
+-                                       message_len, language, language_len);
++                    LIBSSH2_DISCONNECT(session, reason, (const char *)message,
++                                       message_len, (const char *)language,
++                                       language_len);
+                 }
++
+                 _libssh2_debug(session, LIBSSH2_TRACE_TRANS,
+                                "Disconnect(%d): %s(%s)", reason,
+                                message, language);
+
+From 77616117cc9dbbdd0fe1157098435bff73a83a0f Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will@panic.com>
+Date: Thu, 29 Aug 2019 15:26:32 -0700
+Subject: [PATCH 4/5] fixed stray (
+
+bad paste
+---
+ src/packet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/packet.c b/src/packet.c
+index 97f0cdd4b..bd4c39e46 100644
+--- a/src/packet.c
++++ b/src/packet.c
+@@ -569,7 +569,7 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+                 uint32_t len = 0;
+                 unsigned char want_reply = 0;
+                 len = _libssh2_ntohu32(data + 1);
+-                if((len <= (UINT_MAX - 6) && (datalen >= (6 + len))) {
++                if(len <= (UINT_MAX - 6) && datalen >= (6 + len)) {
+                     want_reply = data[5 + len];
+                     _libssh2_debug(session,
+                                    LIBSSH2_TRACE_CONN,
+
+From 436c45dc143cadc8c59afac6c4255be332856581 Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will@panic.com>
+Date: Thu, 29 Aug 2019 15:29:00 -0700
+Subject: [PATCH 5/5] added additional parentheses for clarity
+
+---
+ src/packet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/packet.c b/src/packet.c
+index bd4c39e46..2e01bfc5d 100644
+--- a/src/packet.c
++++ b/src/packet.c
+@@ -569,7 +569,7 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+                 uint32_t len = 0;
+                 unsigned char want_reply = 0;
+                 len = _libssh2_ntohu32(data + 1);
+-                if(len <= (UINT_MAX - 6) && datalen >= (6 + len)) {
++                if((len <= (UINT_MAX - 6)) && (datalen >= (6 + len))) {
+                     want_reply = data[5 + len];
+                     _libssh2_debug(session,
+                                    LIBSSH2_TRACE_CONN,
diff --git a/pkgs/development/libraries/libssh2/default.nix b/pkgs/development/libraries/libssh2/default.nix
index 5cc0232e17de..8ce9c814df05 100644
--- a/pkgs/development/libraries/libssh2/default.nix
+++ b/pkgs/development/libraries/libssh2/default.nix
@@ -15,12 +15,8 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional stdenv.hostPlatform.isMinGW windows.mingw_w64;
 
   patches = [
-    # not able to use fetchpatch here: infinite recursion
-    (fetchurl {
-      name = "CVE-2019-17498.patch";
-      url = "https://github.com/libssh2/libssh2/pull/402.patch";
-      sha256 = "1n9s2mcz5dkw0xpm3c5x4hzj8bar4i6z0pr1rmqjplhfg888vdvc";
-    })
+    # Not able to use fetchpatch here: infinite recursion
+    ./CVE-2019-17498.patch
   ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/libu2f-host/default.nix b/pkgs/development/libraries/libu2f-host/default.nix
index 3becd075b255..f033aa9f610f 100644
--- a/pkgs/development/libraries/libu2f-host/default.nix
+++ b/pkgs/development/libraries/libu2f-host/default.nix
@@ -14,10 +14,6 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  postInstall = ''
-    install -D -t $out/lib/udev/rules.d 70-u2f.rules
-  '';
-
   meta = with stdenv.lib; {
     homepage = "https://developers.yubico.com/libu2f-host";
     description = "A C library and command-line tool that implements the host-side of the U2F protocol";
diff --git a/pkgs/development/libraries/libxslt/default.nix b/pkgs/development/libraries/libxslt/default.nix
index a03fca12581f..cf91d7656bf0 100644
--- a/pkgs/development/libraries/libxslt/default.nix
+++ b/pkgs/development/libraries/libxslt/default.nix
@@ -1,10 +1,8 @@
-{ stdenv, fetchurl, fetchpatch, libxml2, findXMLCatalogs, python, libgcrypt
+{ stdenv, fetchurl, fetchpatch, libxml2, findXMLCatalogs, gettext, python, libgcrypt
 , cryptoSupport ? false
 , pythonSupport ? stdenv.buildPlatform == stdenv.hostPlatform
 }:
 
-with stdenv.lib;
-
 stdenv.mkDerivation rec {
   pname = "libxslt";
   version = "1.1.34";
@@ -17,6 +15,7 @@ stdenv.mkDerivation rec {
   outputs = [ "bin" "dev" "out" "man" "doc" ] ++ stdenv.lib.optional pythonSupport "py";
 
   buildInputs = [ libxml2.dev ]
+    ++ stdenv.lib.optional stdenv.isDarwin gettext
     ++ stdenv.lib.optionals pythonSupport [ libxml2.py python ]
     ++ stdenv.lib.optionals cryptoSupport [ libgcrypt ];
 
@@ -27,14 +26,14 @@ stdenv.mkDerivation rec {
     "--without-debug"
     "--without-mem-debug"
     "--without-debugger"
-  ] ++ optional pythonSupport "--with-python=${python}"
-    ++ optional (!cryptoSupport) "--without-crypto";
+  ] ++ stdenv.lib.optional pythonSupport "--with-python=${python}"
+    ++ stdenv.lib.optional (!cryptoSupport) "--without-crypto";
 
   postFixup = ''
     moveToOutput bin/xslt-config "$dev"
     moveToOutput lib/xsltConf.sh "$dev"
     moveToOutput share/man/man1 "$bin"
-  '' + optionalString pythonSupport ''
+  '' + stdenv.lib.optionalString pythonSupport ''
     mkdir -p $py/nix-support
     echo ${libxml2.py} >> $py/nix-support/propagated-build-inputs
     moveToOutput ${python.libPrefix} "$py"
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index aa70e9e5a549..03977c74f11d 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -11,6 +11,8 @@
 , eglPlatforms ? [ "x11" "surfaceless" ] ++ lib.optionals stdenv.isLinux [ "wayland" "drm" ]
 , OpenGL, Xplugin
 , withValgrind ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAarch32, valgrind-light
+, enableGalliumNine ? stdenv.isLinux
+, enableOSMesa ? stdenv.isLinux
 }:
 
 /** Packaging design:
@@ -27,7 +29,9 @@
 with stdenv.lib;
 
 let
-  version = "20.0.2";
+  # Release calendar: https://www.mesa3d.org/release-calendar.html
+  # Release frequency: https://www.mesa3d.org/releasing.html#schedule
+  version = "20.0.7"; # Update only to the final (last planned) release (i.e. X.Y.MAX)?
   branch  = versions.major version;
 in
 
@@ -37,12 +41,12 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     urls = [
+      "https://mesa.freedesktop.org/archive/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
-      "https://mesa.freedesktop.org/archive/mesa-${version}.tar.xz"
     ];
-    sha256 = "0vz8k07d23qdwy67fnna9y0ynnni0m8lgswcmdm60l4mcv5z2m5a";
+    sha256 = "0y517qpdg6v6dsdgzb365p03m30511sbyh8pq0mcvhvjwy7javpy";
   };
 
   prePatch = "patchShebangs .";
@@ -79,7 +83,7 @@ stdenv.mkDerivation {
       "find_program('${buildPackages.pkg-config.targetPrefix}pkg-config')"
   '';
 
-  outputs = [ "out" "dev" "drivers" "osmesa" ];
+  outputs = [ "out" "dev" "drivers" ] ++ lib.optional enableOSMesa "osmesa";
 
   # TODO: Figure out how to enable opencl without having a runtime dependency on clang
   mesonFlags = [
@@ -103,10 +107,10 @@ stdenv.mkDerivation {
     "-Domx-libs-path=${placeholder "drivers"}/lib/bellagio"
     "-Dva-libs-path=${placeholder "drivers"}/lib/dri"
     "-Dd3d-drivers-path=${placeholder "drivers"}/lib/d3d"
+    "-Dgallium-nine=${if enableGalliumNine then "true" else "false"}" # Direct3D in Wine
+    "-Dosmesa=${if enableOSMesa then "gallium" else "none"}" # used by wine
   ] ++ optionals stdenv.isLinux [
     "-Dglvnd=true"
-    "-Dosmesa=gallium" # used by wine
-    "-Dgallium-nine=true" # Direct3D in Wine
   ];
 
   buildInputs = with xorg; [
@@ -142,17 +146,17 @@ stdenv.mkDerivation {
   '' + optionalString stdenv.isLinux ''
     mkdir -p $drivers/lib
 
-    # move gallium-related stuff to $drivers, so $out doesn't depend on LLVM
-    mv -t $drivers/lib       \
-      $out/lib/libxatracker* \
-      $out/lib/libvulkan_*
-
-    # Move other drivers to a separate output
-    mv $out/lib/lib*_mesa* $drivers/lib
+    if [ -n "$(shopt -s nullglob; echo "$out/lib/libxatracker"*)" -o -n "$(shopt -s nullglob; echo "$out/lib/libvulkan_"*)" ]; then
+      # move gallium-related stuff to $drivers, so $out doesn't depend on LLVM
+      mv -t $drivers/lib       \
+        $out/lib/libxatracker* \
+        $out/lib/libvulkan_*
+    fi
 
-    # move libOSMesa to $osmesa, as it's relatively big
-    mkdir -p $osmesa/lib
-    mv -t $osmesa/lib/ $out/lib/libOSMesa*
+    if [ -n "$(shopt -s nullglob; echo "$out"/lib/lib*_mesa*)" ]; then
+      # Move other drivers to a separate output
+      mv $out/lib/lib*_mesa* $drivers/lib
+    fi
 
     # move vendor files
     mv $out/share/ $drivers/
@@ -167,6 +171,10 @@ stdenv.mkDerivation {
     for js in $drivers/share/vulkan/icd.d/*.json; do
       substituteInPlace "$js" --replace "$out" "$drivers"
     done
+  '' + lib.optionalString enableOSMesa ''
+    # move libOSMesa to $osmesa, as it's relatively big
+    mkdir -p $osmesa/lib
+    mv -t $osmesa/lib/ $out/lib/libOSMesa*
   '';
 
   # TODO:
@@ -181,7 +189,9 @@ stdenv.mkDerivation {
 
     # Update search path used by pkg-config
     for pc in $dev/lib/pkgconfig/{d3d,dri,xatracker}.pc; do
-      substituteInPlace "$pc" --replace $out $drivers
+      if [ -f "$pc" ]; then
+        substituteInPlace "$pc" --replace $out $drivers
+      fi
     done
 
     # add RPATH so the drivers can find the moved libgallium and libdricore9
@@ -215,6 +225,6 @@ stdenv.mkDerivation {
     changelog = "https://www.mesa3d.org/relnotes/${version}.html";
     license = licenses.mit; # X11 variant, in most files
     platforms = platforms.mesaPlatforms;
-    maintainers = with maintainers; [ vcunat ];
+    maintainers = with maintainers; [ primeos vcunat ]; # Help is welcome :)
   };
 }
diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index 622d11c31605..4ec5518008a1 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -5,7 +5,7 @@ let
     url = "http://dev.gentoo.org/~polynomial-c/mozilla/nss-3.15.4-pem-support-20140109.patch.xz";
     sha256 = "10ibz6y0hknac15zr6dw4gv9nb5r5z9ym6gq18j3xqx7v7n3vpdw";
   };
-  version = "3.52";
+  version = "3.52.1";
   underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
 
 in stdenv.mkDerivation rec {
@@ -14,7 +14,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/${pname}-${version}.tar.gz";
-    sha256 = "0q8m9jf6zgkbhx71myjb7y0gcl5ib3gj6qkl9yvdqpd6vl6fn2ha";
+    sha256 = "0y4jb9095f7bbgw7d7kvzm4c3g4p5i6y68fwhb8wlkpb7b1imj5w";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
diff --git a/pkgs/development/libraries/openh264/default.nix b/pkgs/development/libraries/openh264/default.nix
index e038bb7f66de..ee430f800dd3 100644
--- a/pkgs/development/libraries/openh264/default.nix
+++ b/pkgs/development/libraries/openh264/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openh264";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "cisco";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1wba260n1932vafd5ni2jqv9kzc7lj6a1asm1cqk8jv690m6zvpi";
+    sha256 = "0ffav46pz3sbj92nipd62z03fibyqgclfq9w8lgr80s6za6zdk5s";
   };
 
   nativeBuildInputs = [ nasm ];
diff --git a/pkgs/development/libraries/pcre2/default.nix b/pkgs/development/libraries/pcre2/default.nix
index 6c5d526d523b..d39b91355b98 100644
--- a/pkgs/development/libraries/pcre2/default.nix
+++ b/pkgs/development/libraries/pcre2/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "pcre2";
-  version = "10.34";
+  version = "10.35";
   src = fetchurl {
     url = "https://ftp.pcre.org/pub/pcre/${pname}-${version}.tar.bz2";
-    sha256 = "1jlqnzcz2yi70dm40wyfa9w8is9z2kh4dl8zjnv3vqd9mgzp7i3l";
+    sha256 = "04s6kmk9qdd4rjz477h547j4bx7hfz0yalpvrm381rqc5ghaijww";
   };
 
   configureFlags = [
diff --git a/pkgs/development/libraries/physics/geant4/default.nix b/pkgs/development/libraries/physics/geant4/default.nix
index 2e44a7136df8..97822d769dd5 100644
--- a/pkgs/development/libraries/physics/geant4/default.nix
+++ b/pkgs/development/libraries/physics/geant4/default.nix
@@ -5,6 +5,7 @@
 , enableQT             ? false
 , enableXM             ? false
 , enableOpenGLX11      ? true
+, enablePython         ? false
 , enableRaytracerX11   ? false
 
 # Standard build environment with cmake.
@@ -33,8 +34,16 @@
 , libGLU, libGL
 , xlibsWrapper
 , libXmu
+
+# For enablePython
+, boost
+, python3
 }:
 
+let
+  boost_python = boost.override { enablePython = true; python = python3; };
+in
+
 stdenv.mkDerivation rec {
   version = "10.6.2";
   pname = "geant4";
@@ -44,6 +53,16 @@ stdenv.mkDerivation rec {
     sha256 = "0vznm3pjlbihjy1wsxc4gj229k0dzc283wvil2xghyl08vwdpnpc";
   };
 
+  boost_python_lib = "python${builtins.replaceStrings ["."] [""] python3.pythonVersion}";
+  postPatch = ''
+    # Fix for boost 1.67+
+    substituteInPlace environments/g4py/CMakeLists.txt \
+      --replace "find_package(Boost REQUIRED python)" \
+                "find_package(Boost REQUIRED COMPONENTS $boost_python_lib)"
+    substituteInPlace environments/g4py/G4PythonHelpers.cmake \
+      --replace "Boost::python" "Boost::$boost_python_lib"
+  '';
+
   cmakeFlags = [
     "-DGEANT4_INSTALL_DATA=OFF"
     "-DGEANT4_USE_GDML=${if enableGDML then "ON" else "OFF"}"
@@ -52,11 +71,14 @@ stdenv.mkDerivation rec {
     "-DGEANT4_USE_XM=${if enableXM then "ON" else "OFF"}"
     "-DGEANT4_USE_OPENGL_X11=${if enableOpenGLX11 then "ON" else "OFF"}"
     "-DGEANT4_USE_INVENTOR=${if enableInventor then "ON" else "OFF"}"
+    "-DGEANT4_USE_PYTHON=${if enablePython then "ON" else "OFF"}"
     "-DGEANT4_USE_RAYTRACER_X11=${if enableRaytracerX11 then "ON" else "OFF"}"
     "-DGEANT4_USE_SYSTEM_CLHEP=${if clhep != null then "ON" else "OFF"}"
     "-DGEANT4_USE_SYSTEM_EXPAT=${if expat != null then "ON" else "OFF"}"
     "-DGEANT4_USE_SYSTEM_ZLIB=${if zlib != null then "ON" else "OFF"}"
     "-DGEANT4_BUILD_MULTITHREADED=${if enableMultiThreading then "ON" else "OFF"}"
+  ] ++ stdenv.lib.optionals (enableMultiThreading && enablePython) [
+    "-DGEANT4_BUILD_TLS_MODEL=global-dynamic"
   ] ++ stdenv.lib.optionals enableInventor [
     "-DINVENTOR_INCLUDE_DIR=${coin3d}/include"
     "-DINVENTOR_LIBRARY_RELEASE=${coin3d}/lib/libCoin.so"
@@ -66,7 +88,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs =  [ cmake ];
 
   buildInputs = [ libGLU xlibsWrapper libXmu ]
-    ++ stdenv.lib.optionals enableInventor [ libXpm coin3d soxt motif ];
+    ++ stdenv.lib.optionals enableInventor [ libXpm coin3d soxt motif ]
+    ++ stdenv.lib.optionals enablePython [ boost_python python3 ];
 
   propagatedBuildInputs = [ clhep expat zlib libGL ]
     ++ stdenv.lib.optionals enableGDML [ xercesc ]
diff --git a/pkgs/development/libraries/physics/geant4/g4py/default.nix b/pkgs/development/libraries/physics/geant4/g4py/default.nix
deleted file mode 100644
index 4937cc0eca93..000000000000
--- a/pkgs/development/libraries/physics/geant4/g4py/default.nix
+++ /dev/null
@@ -1,65 +0,0 @@
-{ stdenv, cmake, xercesc
-
-# The target version of Geant4
-, geant4
-
-# Python (obviously) and boost::python for wrapping.
-, python
-, boost
-}:
-
-let
-  # g4py does not support MT and will fail to build against MT geant
-  geant4_nomt = geant4.override { enableMultiThreading = false; };
-  boost_python = boost.override { enablePython = true; inherit python; };
-in
-
-stdenv.mkDerivation {
-  inherit (geant4_nomt) version src;
-  pname = "g4py";
-
-  nativeBuildInputs = [ cmake ];
-  buildInputs = [ geant4_nomt xercesc boost_python python ];
-
-  GEANT4_INSTALL = geant4_nomt;
-
-  postPatch = ''
-    cd environments/g4py
-  '';
-
-  preConfigure = ''
-    # Fix for boost 1.67+
-    substituteInPlace CMakeLists.txt \
-    --replace "find_package(Boost)" "find_package(Boost 1.40 REQUIRED COMPONENTS python${builtins.replaceStrings ["."] [""] python.pythonVersion})"
-    for f in `find . -name CMakeLists.txt`; do
-      substituteInPlace "$f" \
-        --replace "boost_python" "\''${Boost_LIBRARIES}"
-    done
-  '';
-
-  enableParallelBuilding = true;
-
-  setupHook = ./setup-hook.sh;
-
-  # Make sure we set PYTHONPATH
-  shellHook = ''
-    source $out/nix-support/setup-hook
-  '';
-
-  meta = {
-    description = "Python bindings and utilities for Geant4";
-    longDescription = ''
-      Geant4 is a toolkit for the simulation of the passage of particles
-      through matter.  Its areas of application include high energy,
-      nuclear and accelerator physics, as well as studies in medical and
-      space science.  The two main reference papers for Geant4 are
-      published in Nuclear Instruments and Methods in Physics Research A
-      506 (2003) 250-303, and IEEE Transactions on Nuclear Science 53 No. 1
-      (2006) 270-278.
-    '';
-    homepage = "http://www.geant4.org";
-    license = stdenv.lib.licenses.g4sl;
-    maintainers = [ ];
-    platforms = stdenv.lib.platforms.all;
-  };
-}
diff --git a/pkgs/development/libraries/physics/geant4/g4py/setup-hook.sh b/pkgs/development/libraries/physics/geant4/g4py/setup-hook.sh
deleted file mode 100644
index 8abfb461fc0f..000000000000
--- a/pkgs/development/libraries/physics/geant4/g4py/setup-hook.sh
+++ /dev/null
@@ -1 +0,0 @@
-export PYTHONPATH=$PYTHONPATH:@out@/lib
diff --git a/pkgs/development/libraries/readline/6.3.nix b/pkgs/development/libraries/readline/6.3.nix
index 3f3503bb2ba6..2b0cf978d43e 100644
--- a/pkgs/development/libraries/readline/6.3.nix
+++ b/pkgs/development/libraries/readline/6.3.nix
@@ -32,10 +32,6 @@ stdenv.mkDerivation {
      in
        import ./readline-6.3-patches.nix patch);
 
-  # Don't run the native `strip' when cross-compiling.
-  dontStrip = stdenv.hostPlatform != stdenv.buildPlatform;
-  bash_cv_func_sigsetjmp = if stdenv.isCygwin then "missing" else null;
-
   meta = with stdenv.lib; {
     description = "Library for interactive line editing";
 
diff --git a/pkgs/development/libraries/readline/7.0.nix b/pkgs/development/libraries/readline/7.0.nix
index c4bcda0110a4..248ef55cce88 100644
--- a/pkgs/development/libraries/readline/7.0.nix
+++ b/pkgs/development/libraries/readline/7.0.nix
@@ -32,10 +32,6 @@ stdenv.mkDerivation rec {
     ]
     ++ upstreamPatches;
 
-  # Don't run the native `strip' when cross-compiling.
-  dontStrip = stdenv.hostPlatform != stdenv.buildPlatform;
-  bash_cv_func_sigsetjmp = if stdenv.isCygwin then "missing" else null;
-
   meta = with stdenv.lib; {
     description = "Library for interactive line editing";
 
diff --git a/pkgs/development/libraries/readline/8.0.nix b/pkgs/development/libraries/readline/8.0.nix
index 23075abd6f2e..6e1182647c29 100644
--- a/pkgs/development/libraries/readline/8.0.nix
+++ b/pkgs/development/libraries/readline/8.0.nix
@@ -32,10 +32,6 @@ stdenv.mkDerivation rec {
     ]
     ++ upstreamPatches;
 
-  # Don't run the native `strip' when cross-compiling.
-  dontStrip = stdenv.hostPlatform != stdenv.buildPlatform;
-  bash_cv_func_sigsetjmp = if stdenv.isCygwin then "missing" else null;
-
   meta = with stdenv.lib; {
     description = "Library for interactive line editing";
 
diff --git a/pkgs/development/libraries/sqlite/analyzer.nix b/pkgs/development/libraries/sqlite/analyzer.nix
index 4e37febbe756..cf8a9aaa7326 100644
--- a/pkgs/development/libraries/sqlite/analyzer.nix
+++ b/pkgs/development/libraries/sqlite/analyzer.nix
@@ -6,11 +6,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite-analyzer";
-  version = "3.31.1";
+  version = "3.32.2";
 
   src = assert version == sqlite.version; fetchurl {
     url = "https://sqlite.org/2020/sqlite-src-${archiveVersion version}.zip";
-    sha256 = "0n7f3w59gr80s6k4l5a9bp2s97dlfapfbhb3qdhak6axhn127p7j";
+    sha256 = "1jqhs896cvp9l399mjpbv1x2qbfvq875l1vrgnl3zc4ffdjxs9z0";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 245c55e9ea88..35d3d062ab78 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -10,12 +10,12 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite";
-  version = "3.31.1";
+  version = "3.32.2";
 
   # NB! Make sure to update analyzer.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2020/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    sha256 = "1bj936svd8i5g25xd1bj52hj4zca01fgl3sqkj86z9q5pkz4wa32";
+    sha256 = "1130bcd70s2vlsq0d638pb5qrw9kwqvjswnp2dfypghx9hjz3gid";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/libraries/trompeloeil/default.nix b/pkgs/development/libraries/trompeloeil/default.nix
index 782af4ab0331..625b16cc99a0 100644
--- a/pkgs/development/libraries/trompeloeil/default.nix
+++ b/pkgs/development/libraries/trompeloeil/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "trompeloeil";
-  version = "37";
+  version = "38";
 
   src = fetchFromGitHub {
     owner = "rollbear";
     repo = "trompeloeil";
     rev = "v${version}";
-    sha256 = "04f9vpzh4fc15w4ynirzs9ipm9r31dbggb2zilmk0fj4qr79am42";
+    sha256 = "068q4xx09vwjs7i89w47qzymdb4l6jqi27gx2jmd3yb6fp2k7nsb";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/uriparser/default.nix b/pkgs/development/libraries/uriparser/default.nix
index de621b30e247..a12f040bf49c 100644
--- a/pkgs/development/libraries/uriparser/default.nix
+++ b/pkgs/development/libraries/uriparser/default.nix
@@ -2,22 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "uriparser";
-  version = "0.9.3";
+  version = "0.9.4";
 
   # Release tarball differs from source tarball
   src = fetchurl {
     url = "https://github.com/uriparser/uriparser/releases/download/${pname}-${version}/${pname}-${version}.tar.bz2";
-    sha256 = "13z234jdaqs9jj7i66gcv4q1rgsypjz6cighnlm1j4g80pdlmbr8";
+    sha256 = "0yzqp1j6sglyrmwcasgn7zlwg841p3nbxy0h78ngq20lc7jspkdp";
   };
 
-  patches = [
-    # fixes tests
-    (fetchpatch {
-      url = "https://github.com/uriparser/uriparser/commit/f870e6c68696a6018702caa5c8a2feba9b0f99fa.diff";
-      sha256 = "1nd6bhys9hwy6ippa42vm95zhw6hldm1s4xbdzmdjswc96as1ff5";
-    })
-  ];
-
   nativeBuildInputs = [ cmake ];
 
   cmakeFlags = [
diff --git a/pkgs/development/node-packages/default.nix b/pkgs/development/node-packages/default.nix
index 4b0d4ac92cae..2ceef0f477f2 100644
--- a/pkgs/development/node-packages/default.nix
+++ b/pkgs/development/node-packages/default.nix
@@ -39,14 +39,6 @@ let
       meta.broken = since "12";
     };
 
-    dnschain = super.dnschain.override {
-      buildInputs = [ pkgs.makeWrapper super.coffee-script ];
-      postInstall = ''
-        wrapProgram $out/bin/dnschain --suffix PATH : ${pkgs.openssl.bin}/bin
-      '';
-      meta.broken = since "14";
-    };
-
     bitwarden-cli = pkgs.lib.overrideDerivation super."@bitwarden/cli" (drv: {
       name = "bitwarden-cli-${drv.version}";
     });
diff --git a/pkgs/development/node-packages/node-packages.json b/pkgs/development/node-packages/node-packages.json
index 5beb8dc7c6a1..f26c7885dfb6 100644
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@@ -60,7 +60,6 @@
 , "csslint"
 , "dat"
 , "dhcp"
-, "dnschain"
 , "dockerfile-language-server-nodejs"
 , "elasticdump"
 , "elm-oracle"
diff --git a/pkgs/development/ocaml-modules/dns/client.nix b/pkgs/development/ocaml-modules/dns/client.nix
index 0dd0541138c8..a6dc40de24ea 100644
--- a/pkgs/development/ocaml-modules/dns/client.nix
+++ b/pkgs/development/ocaml-modules/dns/client.nix
@@ -1,5 +1,6 @@
 { lib, buildDunePackage, dns, ocaml_lwt, mirage-clock, mirage-time
-, mirage-random, mirage-stack, mirage-crypto-rng, mtime, randomconv }:
+, mirage-random, mirage-stack, mirage-crypto-rng, mtime, randomconv
+, cstruct, fmt, logs, rresult, domain-name, ipaddr, alcotest }:
 
 buildDunePackage {
   pname = "dns-client";
@@ -7,8 +8,11 @@ buildDunePackage {
 
   useDune2 = true;
 
-  propagatedBuildInputs = [ dns mtime ocaml_lwt randomconv mirage-clock mirage-time
-                            mirage-random mirage-stack mirage-crypto-rng ];
+  propagatedBuildInputs = [ cstruct fmt logs dns rresult randomconv domain-name ipaddr
+                            ocaml_lwt mirage-stack mirage-random mirage-time mirage-clock
+                            mtime mirage-crypto-rng ];
+  checkInputs = [ alcotest ];
+  doCheck = true;
 
   meta = dns.meta // {
     description = "Pure DNS resolver API";
diff --git a/pkgs/development/ocaml-modules/dns/default.nix b/pkgs/development/ocaml-modules/dns/default.nix
index 01bbffd40b94..68a8ad8da4ed 100644
--- a/pkgs/development/ocaml-modules/dns/default.nix
+++ b/pkgs/development/ocaml-modules/dns/default.nix
@@ -1,19 +1,19 @@
 { lib, buildDunePackage, fetchurl, alcotest
-, cstruct, domain-name, duration, gmap, ipaddr, logs, lru, metrics, ptime, rresult
+, cstruct, domain-name, duration, gmap, ipaddr, logs, lru, metrics, ptime, rresult, astring, fmt
 }:
 
 buildDunePackage rec {
   pname = "dns";
-  version = "4.5.0";
+  version = "4.6.0";
 
   minimumOCamlVersion = "4.07";
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-dns/releases/download/v${version}/dns-v${version}.tbz";
-    sha256 = "10jrnnxvp06rvzk285wibyi9hn15qhjnqjy9xsfbwl8yhmzzqnq0";
+    sha256 = "1gkswpc91j4ps60bp52ggg4qwj5g88f49x6p6d619p4x8vmhjylv";
   };
 
-  propagatedBuildInputs = [ cstruct domain-name duration gmap ipaddr logs lru metrics ptime rresult ];
+  propagatedBuildInputs = [ rresult astring fmt logs ptime domain-name gmap cstruct ipaddr lru duration metrics ];
 
   doCheck = true;
   checkInputs = lib.optional doCheck alcotest;
diff --git a/pkgs/development/ocaml-modules/ocsigen-start/default.nix b/pkgs/development/ocaml-modules/ocsigen-start/default.nix
index cc6650df1578..637c06e98dcf 100644
--- a/pkgs/development/ocaml-modules/ocsigen-start/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-start/default.nix
@@ -5,7 +5,7 @@
 
 stdenv.mkDerivation rec {
   name = "ocaml${ocaml.version}-ocsigen-start-${version}";
-  version = "2.16.1";
+  version = "2.18.0";
 
   buildInputs = [ ocaml findlib ];
   propagatedBuildInputs = [ pgocaml_ppx safepass ocsigen-toolkit yojson resource-pooling cohttp-lwt-unix ];
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     owner = "ocsigen";
     repo = "ocsigen-start";
     rev = version;
-    sha256 = "1pzpyrd3vbhc7zvzh6bv44793ikx5bglpd5p4wk5jj65v1w39jwd";
+    sha256 = "0wvh4c26g6qd6i1fryilcqz9giz7v6pnhc90sknhxh6jmwrbjl50";
   };
 
   meta = {
diff --git a/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix b/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix
index 4dfca784dfa3..a0f3136de22b 100644
--- a/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix
@@ -5,7 +5,7 @@
 stdenv.mkDerivation rec {
  pname = "ocsigen-toolkit";
  name = "ocaml${ocaml.version}-${pname}-${version}";
- version = "2.5.0";
+ version = "2.7.0";
 
  propagatedBuildInputs = [ calendar js_of_ocaml-ppx_deriving_json eliom ];
  buildInputs = [ ocaml findlib opaline ];
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     owner = "ocsigen";
     repo = pname;
     rev = version;
-    sha256 = "0hll8qr363pbb65jnr2w36zcbplbwn08xb7826ayiwigakj783p9";
+    sha256 = "0jan5779nc0jf993hmvfii15ralcs20sm4mcnqwqrnhjbq6f6zpk";
   };
 
   createFindlibDestdir = true;
diff --git a/pkgs/development/ocaml-modules/tls/default.nix b/pkgs/development/ocaml-modules/tls/default.nix
index dea03f2b38a7..0c3eaf33e782 100644
--- a/pkgs/development/ocaml-modules/tls/default.nix
+++ b/pkgs/development/ocaml-modules/tls/default.nix
@@ -6,12 +6,12 @@
 buildDunePackage rec {
   minimumOCamlVersion = "4.07";
 
-  version = "0.12.0";
+  version = "0.12.1";
   pname = "tls";
 
   src = fetchurl {
     url = "https://github.com/mirleft/ocaml-tls/releases/download/v${version}/tls-v${version}.tbz";
-    sha256 = "0fy38qmy7rcld1b4qzz4ycl1fr0v1wa7qd24125lpd6hly86fn57";
+    sha256 = "09jhzjhni3il5bmy2c6gylmg9s45ppckjc7nm5nyg5dbm699cwxg";
   };
 
   useDune2 = true;
diff --git a/pkgs/development/python-modules/Cython/default.nix b/pkgs/development/python-modules/Cython/default.nix
index f0b8a5dd560d..3d5afd52abdd 100644
--- a/pkgs/development/python-modules/Cython/default.nix
+++ b/pkgs/development/python-modules/Cython/default.nix
@@ -26,11 +26,11 @@ let
 
 in buildPythonPackage rec {
   pname = "Cython";
-  version = "0.29.14";
+  version = "0.29.19";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e4d6bb8703d0319eb04b7319b12ea41580df44fd84d83ccda13ea463c6801414";
+    sha256 = "0n2j87nka8cs772qc60d0c7lrpvsw0y8p3qzvhrsi3nmq1yqmycp";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/GitPython/default.nix b/pkgs/development/python-modules/GitPython/default.nix
index b5ffacae2964..7b39ebb7a390 100644
--- a/pkgs/development/python-modules/GitPython/default.nix
+++ b/pkgs/development/python-modules/GitPython/default.nix
@@ -1,13 +1,13 @@
 { lib, buildPythonPackage, fetchPypi, isPy27, substituteAll, git, gitdb, mock, nose, ddt }:
 
 buildPythonPackage rec {
-  version = "3.1.2";
+  version = "3.1.3";
   pname = "GitPython";
   disabled = isPy27; # no longer supported
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "864a47472548f3ba716ca202e034c1900f197c0fb3a08f641c20c3cafd15ed94";
+    sha256 = "e107af4d873daed64648b4f4beb89f89f0cfbe3ef558fc7821ed2331c2f8da1a";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/JPype1/default.nix b/pkgs/development/python-modules/JPype1/default.nix
index c43b2a05a519..b70879952f4e 100644
--- a/pkgs/development/python-modules/JPype1/default.nix
+++ b/pkgs/development/python-modules/JPype1/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "JPype1";
-  version = "0.7.4";
+  version = "0.7.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "92f24b0fe11e90b57343494ce38699043d9e6828a22a99dddbcf99c0adb4c1f7";
+    sha256 = "7bbd25453dc04704d77d854c80acb5537ecb18b9de8a5572e5f22649a2160aaf";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/Mako/default.nix b/pkgs/development/python-modules/Mako/default.nix
index 597a4695c0cb..375a02968646 100644
--- a/pkgs/development/python-modules/Mako/default.nix
+++ b/pkgs/development/python-modules/Mako/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "Mako";
-  version = "1.1.2";
+  version = "1.1.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3139c5d64aa5d175dbafb95027057128b5fbd05a40c53999f3905ceb53366d9d";
+    sha256 = "8195c8c1400ceb53496064314c6736719c6f25e7479cd24c77be3d9361cddc27";
   };
 
   checkInputs = [ markupsafe nose mock ];
diff --git a/pkgs/development/python-modules/aioharmony/default.nix b/pkgs/development/python-modules/aioharmony/default.nix
index 13769bbeaed3..09b6919495de 100644
--- a/pkgs/development/python-modules/aioharmony/default.nix
+++ b/pkgs/development/python-modules/aioharmony/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "aioharmony";
-  version = "0.2.1";
+  version = "0.2.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8c8f6e3b776e4e7eba5a1d2ae739aac6a1dd558a7f15951c34ffe0ee28f7f538";
+    sha256 = "445323810978454ba3b32be53ba6b43cf9948586de3f9734b8743b55858b3cc7";
   };
 
   disabled = !isPy3k;
diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index 7d164cf5e4f0..2f623dd0f0ef 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -12,7 +12,7 @@
 , idna-ssl
 , typing-extensions
 , pytestrunner
-, pytest
+, pytestCheckHook
 , gunicorn
 , pytest-timeout
 , async_generator
@@ -22,13 +22,14 @@
 , trustme
 , brotlipy
 , freezegun
+, isPy38
 }:
 
 buildPythonPackage rec {
   pname = "aiohttp";
   version = "3.6.2";
   # https://github.com/aio-libs/aiohttp/issues/4525 python3.8 failures
-  disabled = pythonOlder "3.5" || pythonAtLeast "3.8";
+  disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
@@ -36,28 +37,38 @@ buildPythonPackage rec {
   };
 
   checkInputs = [
-    pytestrunner pytest gunicorn async_generator pytest_xdist
+    pytestrunner pytestCheckHook gunicorn async_generator pytest_xdist
     pytest-mock pytestcov trustme brotlipy freezegun
   ];
 
   propagatedBuildInputs = [ attrs chardet multidict async-timeout yarl ]
     ++ lib.optionals (pythonOlder "3.7") [ idna-ssl typing-extensions ];
 
-  # disable tests which attempt to do loopback connections
-  checkPhase = ''
+  disabledTests = [
+    # disable tests which attempt to do loopback connections
+    "get_valid_log_format_exc"
+    "test_access_logger_atoms"
+    "aiohttp_request_coroutine"
+    "server_close_keepalive_connection"
+    "connector"
+    "client_disconnect"
+    "handle_keepalive_on_closed_connection"
+    "proxy_https_bad_response"
+    "partially_applied_handler"
+    "middleware"
+  ] ++ lib.optionals stdenv.is32bit [
+    "test_cookiejar"
+  ] ++ lib.optionals isPy38 [
+    # Python 3.8  https://github.com/aio-libs/aiohttp/issues/4525
+    "test_read_boundary_with_incomplete_chunk"
+    "test_read_incomplete_chunk"
+    "test_request_tracing_exception"
+  ];
+
+  # aiohttp in current folder shadows installed version
+  # Probably because we run `python -m pytest` instead of `pytest` in the hook.
+  preCheck = ''
     cd tests
-    pytest -k "not get_valid_log_format_exc \
-               and not test_access_logger_atoms \
-               and not aiohttp_request_coroutine \
-               and not server_close_keepalive_connection \
-               and not connector \
-               and not client_disconnect \
-               and not handle_keepalive_on_closed_connection \
-               and not proxy_https_bad_response \
-               and not partially_applied_handler \
-               ${lib.optionalString stdenv.is32bit "and not test_cookiejar"} \
-               and not middleware" \
-      --ignore=test_connector.py
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/aiolifx/default.nix b/pkgs/development/python-modules/aiolifx/default.nix
index c40f8d3b4471..7b33b1c508f8 100644
--- a/pkgs/development/python-modules/aiolifx/default.nix
+++ b/pkgs/development/python-modules/aiolifx/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "aiolifx";
-  version = "0.6.7";
+  version = "0.6.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cf53c9faea6eee25a466e73eef1753b82a75c7497648149c19c15342df2678f2";
+    sha256 = "9f9055bc2a9a72c5eab17e0ce5522edecd6de07e21cf347bf0cffabdabe5570e";
   };
 
   # tests are not implemented
diff --git a/pkgs/development/python-modules/aioresponses/default.nix b/pkgs/development/python-modules/aioresponses/default.nix
index bbeca1c31507..9034e6a67316 100644
--- a/pkgs/development/python-modules/aioresponses/default.nix
+++ b/pkgs/development/python-modules/aioresponses/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "aioresponses";
-  version = "0.6.3";
+  version = "0.6.4";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "06w15iyr07s861hkzqfdclzxkpvgg83sx8f235mz8k2490hnyqvv";
+    sha256 = "4397ca736238a1ada8c7f47e557dda05e9ecfdd467b9f6b83871efd365af7e9f";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/appdirs/default.nix b/pkgs/development/python-modules/appdirs/default.nix
index 2f7f2ae0281b..22fa3dc98fb0 100644
--- a/pkgs/development/python-modules/appdirs/default.nix
+++ b/pkgs/development/python-modules/appdirs/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "appdirs";
-  version = "1.4.3";
+  version = "1.4.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9e5896d1372858f8dd3344faf4e5014d21849c756c8d5701f78f8a103b372d92";
+    sha256 = "7d5d0167b2b1ba821647616af46a749d1c653740dd0d2415100fe26e27afdf41";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/atlassian-python-api/default.nix b/pkgs/development/python-modules/atlassian-python-api/default.nix
index f9462c5b0a50..5f124cc09434 100755
--- a/pkgs/development/python-modules/atlassian-python-api/default.nix
+++ b/pkgs/development/python-modules/atlassian-python-api/default.nix
@@ -16,11 +16,11 @@
 
 buildPythonPackage rec {
   pname = "atlassian-python-api";
-  version = "1.15.7";
+  version = "1.15.9";
   
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b54cce1ca4bea838a949b4362410b1d717597951e5b7efbfa34ce89bc5df805e";
+    sha256 = "c6a3125ee68ecf4d11947497c1f891b6436df9d8453f8865cabf595813504cc1";
   };
   
   checkInputs = [ pytestrunner pytest ];
diff --git a/pkgs/development/python-modules/autopep8/default.nix b/pkgs/development/python-modules/autopep8/default.nix
index 715e4da8f44e..7b7131f2a7fc 100644
--- a/pkgs/development/python-modules/autopep8/default.nix
+++ b/pkgs/development/python-modules/autopep8/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "autopep8";
-  version = "1.5.2";
+  version = "1.5.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0m29ndgrcgrzi3y1fsxmdl421x6n4gn02l70hsz8486h8zzdhbqm";
+    sha256 = "60fd8c4341bab59963dafd5d2a566e94f547e660b9b396f772afe67d8481dbf0";
   };
 
   propagatedBuildInputs = [ pycodestyle ];
diff --git a/pkgs/development/python-modules/awkward1/default.nix b/pkgs/development/python-modules/awkward1/default.nix
index 3e2b08061d92..0c2b3338690f 100644
--- a/pkgs/development/python-modules/awkward1/default.nix
+++ b/pkgs/development/python-modules/awkward1/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "awkward1";
-  version = "0.2.19";
+  version = "0.2.22";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "23446eacdf52cad1fb0b5bb0f2ed16c1ae8bb5a282d667ad37ab69494e1ef27f";
+    sha256 = "c64a8ad0204743d49cf2f8775f92d9c23dd9d7eb6996a61f4a9de57a53d429f9";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/bids-validator/default.nix b/pkgs/development/python-modules/bids-validator/default.nix
index 56a941e60e09..036f54346144 100644
--- a/pkgs/development/python-modules/bids-validator/default.nix
+++ b/pkgs/development/python-modules/bids-validator/default.nix
@@ -4,12 +4,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.5.1";
+  version = "1.5.2";
   pname = "bids-validator";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1fy8w56m0x546zjk3is1xp83jm19fkn4y15g5jgmq29sfzc8n3y3";
+    sha256 = "6f3bd0402d41ee9be03637d74f34a7db279d00cb9c6386b0597cbbac16ee8f4e";
   };
 
   propagatedBuildInputs = [ ];
diff --git a/pkgs/development/python-modules/bleak/default.nix b/pkgs/development/python-modules/bleak/default.nix
index 559fd33e8eb0..b7ebca9eb034 100644
--- a/pkgs/development/python-modules/bleak/default.nix
+++ b/pkgs/development/python-modules/bleak/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "bleak";
-  version = "0.6.2";
+  version = "0.6.4";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1kmq2z3dhq6dd20i5w71gshjrfvyw0pkpnld8iib9ai2rz6a8aj0";
+    sha256 = "1dc32899d0700c5b5ed9abf642dfee28ac62b1fb5d7be5fa5a6db104dec9a03c";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/block-io/default.nix b/pkgs/development/python-modules/block-io/default.nix
index f80c8a8c145f..505d3ffe149c 100644
--- a/pkgs/development/python-modules/block-io/default.nix
+++ b/pkgs/development/python-modules/block-io/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "block-io";
-  version = "1.1.10";
+  version = "1.1.13";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ba2e750085d9da4d1567932f3f719974fdc3f02649ee0d5c2f85fce592208723";
+    sha256 = "a45e31361d17ce272a0d563a689d6b87b65cc16e9348f8cd3a6460c93359b1bd";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/boto3/default.nix b/pkgs/development/python-modules/boto3/default.nix
index 2903b8ae7c66..1baa668d3c89 100644
--- a/pkgs/development/python-modules/boto3/default.nix
+++ b/pkgs/development/python-modules/boto3/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname =  "boto3";
-  version = "1.13.6"; # N.B: if you change this, change botocore too
+  version = "1.13.23"; # N.B: if you change this, change botocore too
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f1ac7eb23ff8b1d7e314123668ff1e93b874dd396ac5424adc443d68bd8a6fbf";
+    sha256 = "bcaa88b2f81b88741c47da52f3414c876236700441df87b6198f860e6a200d6f";
   };
 
   propagatedBuildInputs = [ botocore jmespath s3transfer ] ++ lib.optionals (!isPy3k) [ futures ];
diff --git a/pkgs/development/python-modules/bugsnag/default.nix b/pkgs/development/python-modules/bugsnag/default.nix
index 2f0e67683d9a..612ab13c1934 100644
--- a/pkgs/development/python-modules/bugsnag/default.nix
+++ b/pkgs/development/python-modules/bugsnag/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "bugsnag";
-  version = "3.6.0";
+  version = "3.6.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "17cjh7g8gbr0gb22nzybkw7vq9x5wfa5ln94hhzijbz934bw1f37";
+    sha256 = "8878437aa44ec485cecb255742035b3b98a6c7e7d167a943b5fbe597b2f8f7f9";
   };
 
   propagatedBuildInputs = [ six webob ];
diff --git a/pkgs/development/python-modules/buildbot/default.nix b/pkgs/development/python-modules/buildbot/default.nix
index 2b2e703026d8..c5a12c997d9d 100644
--- a/pkgs/development/python-modules/buildbot/default.nix
+++ b/pkgs/development/python-modules/buildbot/default.nix
@@ -25,11 +25,11 @@ let
 
   package = buildPythonPackage rec {
     pname = "buildbot";
-    version = "2.8.1";
+    version = "2.8.2";
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "1nrbn8a2c56l5j0axmn9ijaviw0a6nrd34sg81r5j05mzzpb69is";
+      sha256 = "0rdrz2zkd6xaf9kb5l41xmbfzq618sz498w23irshih4c802pdv5";
     };
 
     propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/buildbot/pkg.nix b/pkgs/development/python-modules/buildbot/pkg.nix
index ebf8fb9c94e7..4bb8613afeab 100644
--- a/pkgs/development/python-modules/buildbot/pkg.nix
+++ b/pkgs/development/python-modules/buildbot/pkg.nix
@@ -6,7 +6,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "03ppmrnpyd77azylv1c673cffk6x53j9flx4i99k33bljmdy8iv4";
+    sha256 = "1yz3k6dg15q4911x8kjy396dccfgrs50mjz278l09p6zmm71llax";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/buildbot/plugins.nix b/pkgs/development/python-modules/buildbot/plugins.nix
index 302615dc469c..4c5aa374562a 100644
--- a/pkgs/development/python-modules/buildbot/plugins.nix
+++ b/pkgs/development/python-modules/buildbot/plugins.nix
@@ -7,7 +7,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "051y4z70dq0j343rb02wn3a1vkdbi8khjfib2msa80vdld3nxcyv";
+      sha256 = "19qwr0h6qavznx8rfjq6zjccyd2y7x4nc8asldvay3b44xfsr385";
     };
 
     # Remove unneccessary circular dependency on buildbot
@@ -34,7 +34,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "0chw111j2c6ybvbb09x39zg7ghjz4ysw67wbpcmzd1v5jnwbaqdi";
+      sha256 = "1wfhwmb1d32k8isk7k8525pmkfih8hlvy53zsj19l3gvjm0da9gw";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -56,7 +56,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "14v2lj65ccgmijxqrr61vpgba30q6w5vnisz78y3hbf3qpxmmd7g";
+      sha256 = "0g62v0maz3b9bmjvvjcin6ayg0f5k0n8m93zk75lagyr69g5vaka";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -78,7 +78,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "03q9am237f2r8ivqm1dfkyzm3bmns4xjn99c27ps6dw9an15f73a";
+      sha256 = "0dlq8pchgccc66gfdlssydacisia5fbwc8b4gd8f9gcbish8jmf7";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -100,7 +100,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "0wv5ghsfmhkbk96zimihcwn16rxjz1q1g5ppahb8gfrclmzhdynl";
+      sha256 = "193nni55py6yzw730yyp5va2n4313sjf6a7jmi0xs9bivvvzg5w9";
     };
 
     buildInputs = [ buildbot-pkg ];
diff --git a/pkgs/development/python-modules/buildbot/worker.nix b/pkgs/development/python-modules/buildbot/worker.nix
index 936ef661eeee..05938e43ad69 100644
--- a/pkgs/development/python-modules/buildbot/worker.nix
+++ b/pkgs/development/python-modules/buildbot/worker.nix
@@ -7,7 +7,7 @@ buildPythonPackage (rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1cba1zmm3gfw3ikax7q4vbrxnvjxlby79x5lc4fg9c3igbm0nmwj";
+    sha256 = "0p1w6ailp6xpa6ckl5prj413ilxx5s3lga5mzqxj9nn00vni8ik2";
   };
 
   propagatedBuildInputs = [ twisted future ];
diff --git a/pkgs/development/python-modules/can/default.nix b/pkgs/development/python-modules/can/default.nix
index 3629e0097eda..0a7e58ac8006 100644
--- a/pkgs/development/python-modules/can/default.nix
+++ b/pkgs/development/python-modules/can/default.nix
@@ -16,11 +16,11 @@
 
 buildPythonPackage rec {
   pname = "python-can";
-  version = "3.3.2";
+  version = "3.3.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5fefb5c1e7e7f07faefc02c6eac79f9b58376f007048a04d8e7f325d48ec6b2e";
+    sha256 = "ecd69cf6b2f0235345ebe607a15325cf1384c85b24ffbe1d68c3754357f87488";
   };
 
   propagatedBuildInputs = [ wrapt pyserial aenum ] ++ lib.optional (pythonOlder "3.5") typing;
diff --git a/pkgs/development/python-modules/cnvkit/default.nix b/pkgs/development/python-modules/cnvkit/default.nix
index 054e302dfe76..f4f46f2dff0f 100644
--- a/pkgs/development/python-modules/cnvkit/default.nix
+++ b/pkgs/development/python-modules/cnvkit/default.nix
@@ -18,11 +18,11 @@
 
 buildPythonPackage rec {
   pname = "CNVkit";
-  version = "0.9.6";
+  version = "0.9.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1hj8c98s538i0hg5mrz4bw4v07qmcl51rhxq611rj2nglnc9r25y";
+    sha256 = "d68adc0121e17c61a3aa28c0a9ba6526510a5a0df0f0a6eb1818bab71b7e927a";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/coverage/default.nix b/pkgs/development/python-modules/coverage/default.nix
index 04c469204d78..a22009ac9db1 100644
--- a/pkgs/development/python-modules/coverage/default.nix
+++ b/pkgs/development/python-modules/coverage/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "coverage";
-  version = "4.5.4";
+  version = "5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e07d9f1a23e9e93ab5c62902833bf3e4b1f65502927379148b6622686223125c";
+    sha256 = "0ll0hr8g3szbxa4al6khhzi6l92a3vwyldj0085whl44s55gq2zr";
   };
 
   # No tests in archive
diff --git a/pkgs/development/python-modules/croniter/default.nix b/pkgs/development/python-modules/croniter/default.nix
index 90334fd42250..15aaf97d15c0 100644
--- a/pkgs/development/python-modules/croniter/default.nix
+++ b/pkgs/development/python-modules/croniter/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "croniter";
-  version = "0.3.31";
+  version = "0.3.32";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "15riw8sl8jzzkvvjlz3i3p7jcx423zipxhff5ddvki6zgnrb9149";
+    sha256 = "0d5bf45f12861c1b718c51bd6e2ab056da94e651bf22900658421cdde0ff7088";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/django-mailman3/default.nix b/pkgs/development/python-modules/django-mailman3/default.nix
index bcb39633f7ea..c8fdd57c98e1 100644
--- a/pkgs/development/python-modules/django-mailman3/default.nix
+++ b/pkgs/development/python-modules/django-mailman3/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "django-mailman3";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1vq5qa136h4rz4hjznnk6y8l443i41yh4w4wxg20f9b059xrsld1";
+    sha256 = "1q9ciy2yawgvbha5kwlzwdmdqvas287dc0i60ygp2799jnfr5dr6";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/django_modelcluster/default.nix b/pkgs/development/python-modules/django_modelcluster/default.nix
index 27060e18ae27..4ded69bc3256 100644
--- a/pkgs/development/python-modules/django_modelcluster/default.nix
+++ b/pkgs/development/python-modules/django_modelcluster/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "django-modelcluster";
-  version = "5.0.1";
+  version = "5.0.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1fk7fh30i0fzi0hjd841vxh25iryvgp4lirmxfpq428w4nq7p1bg";
+    sha256 = "c7a42cf9b93d1161a10bf59919f7ee52d996a523a4134b2a136f6fe1eba7a2fa";
   };
 
   disabled = pythonOlder "3.5";
diff --git a/pkgs/development/python-modules/dnslib/default.nix b/pkgs/development/python-modules/dnslib/default.nix
index fafa4c5cbf57..df9843893238 100644
--- a/pkgs/development/python-modules/dnslib/default.nix
+++ b/pkgs/development/python-modules/dnslib/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "dnslib";
-  version = "0.9.12";
+  version = "0.9.13";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c206f09948f3ad17884adffdb552b700072c6022fa59744a0f0606114c475e19";
+    sha256 = "a0fed3e139c12ee4884b19bcde1d4a170745bcabb6026397876e3236ce38b9db";
   };
 
   checkPhase = "VERSIONS=${python.interpreter} ./run_tests.sh";
diff --git a/pkgs/development/python-modules/doc8/default.nix b/pkgs/development/python-modules/doc8/default.nix
index f7e620f491cb..c2a7df098f4b 100644
--- a/pkgs/development/python-modules/doc8/default.nix
+++ b/pkgs/development/python-modules/doc8/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "doc8";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2df89f9c1a5abfb98ab55d0175fed633cae0cf45025b8b1e0ee5ea772be28543";
+    sha256 = "4d1df12598807cf08ffa9a1d5ef42d229ee0de42519da01b768ff27211082c12";
   };
 
   buildInputs = [ pbr ];
diff --git a/pkgs/development/python-modules/docker/default.nix b/pkgs/development/python-modules/docker/default.nix
index a31ba7c69c03..9c788bde123d 100644
--- a/pkgs/development/python-modules/docker/default.nix
+++ b/pkgs/development/python-modules/docker/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "docker";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0bkj1xfp6mnvk1i9hl5awsmwi07q6iwwsjznd7kvrx5m19i6dbnx";
+    sha256 = "380a20d38fbfaa872e96ee4d0d23ad9beb0f9ed57ff1c30653cbeb0c9c0964f2";
   };
 
   nativeBuildInputs = lib.optional isPy27 mock;
diff --git a/pkgs/development/python-modules/dockerfile-parse/default.nix b/pkgs/development/python-modules/dockerfile-parse/default.nix
index ffed5fb170d4..580945656b4c 100644
--- a/pkgs/development/python-modules/dockerfile-parse/default.nix
+++ b/pkgs/development/python-modules/dockerfile-parse/default.nix
@@ -1,12 +1,12 @@
 { stdenv, buildPythonPackage, fetchPypi, six, pytestcov, pytest }:
 
 buildPythonPackage rec {
-  version = "0.0.17";
+  version = "0.0.18";
   pname = "dockerfile-parse";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a69d4ed44c4a890c16437327009ae59ec3a3afeb1abc3819d0c1b14a46099220";
+    sha256 = "a09eae6871b7b314f8a8bddb67b6c5002708b22247511906cf2a9a45564b83db";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/dot2tex/default.nix b/pkgs/development/python-modules/dot2tex/default.nix
index f671cdc9642a..03445f79117f 100644
--- a/pkgs/development/python-modules/dot2tex/default.nix
+++ b/pkgs/development/python-modules/dot2tex/default.nix
@@ -1,8 +1,11 @@
 { stdenv
+, python
 , buildPythonPackage
 , fetchPypi
-, isPy3k
+, substituteAll
 , pyparsing
+, graphviz
+, texlive
 }:
 
 buildPythonPackage rec {
@@ -14,11 +17,26 @@ buildPythonPackage rec {
     sha256 = "1kp77wiv7b5qib82i3y3sn9r49rym43aaqm5aw1bwnzfbbq2m6i9";
   };
 
-  # Tests fail with 3.x. Furthermore, package is no longer maintained.
-  disabled = isPy3k;
+  patches = [
+    (substituteAll {
+      src = ./path.patch;
+      inherit graphviz;
+    })
+    ./test.patch # https://github.com/kjellmf/dot2tex/issues/5
+  ];
 
   propagatedBuildInputs = [ pyparsing ];
 
+  checkInputs = [
+    (texlive.combine {
+      inherit (texlive) scheme-small preview pstricks;
+    })
+  ];
+
+  checkPhase = ''
+    ${python.interpreter} tests/test_dot2tex.py
+  '';
+
   meta = with stdenv.lib; {
     description = "Convert graphs generated by Graphviz to LaTeX friendly formats";
     homepage = "https://github.com/kjellmf/dot2tex";
diff --git a/pkgs/development/python-modules/dot2tex/path.patch b/pkgs/development/python-modules/dot2tex/path.patch
new file mode 100644
index 000000000000..4e05b7a8dff3
--- /dev/null
+++ b/pkgs/development/python-modules/dot2tex/path.patch
@@ -0,0 +1,104 @@
+diff --git a/dot2tex/dotparsing.py b/dot2tex/dotparsing.py
+index 391b5dc..6dc77a3 100644
+--- a/dot2tex/dotparsing.py
++++ b/dot2tex/dotparsing.py
+@@ -180,18 +180,8 @@ def __find_executables(path):
+ def find_graphviz():
+     """Locate Graphviz's executables in the system.
+ 
+-    Tries three methods:
+-
+-    First: Windows Registry (Windows only)
+-    This requires Mark Hammond's pywin32 is installed.
+-
+-    Secondly: Search the path
+-    It will look for 'dot', 'twopi' and 'neato' in all the directories
+-    specified in the PATH environment variable.
+-
+-    Thirdly: Default install location (Windows only)
+-    It will look for 'dot', 'twopi' and 'neato' in the default install
+-    location under the "Program Files" directory.
++    It will look for 'dot', 'twopi' and 'neato' in
++    @graphviz@/bin.
+ 
+     It will return a dictionary containing the program names as keys
+     and their paths as values.
+@@ -199,75 +189,9 @@ def find_graphviz():
+     If this fails, it returns None.
+     """
+ 
+-    # Method 1 (Windows only)
+-    #
+-    if os.sys.platform == 'win32':
+-        try:
+-            import win32api, win32con
+-
+-            # Get the GraphViz install path from the registry
+-            #
+-            hkey = win32api.RegOpenKeyEx(win32con.HKEY_LOCAL_MACHINE,
+-                                         "SOFTWARE\AT&T Research Labs\Graphviz", 0, win32con.KEY_QUERY_VALUE)
+-
+-            path = win32api.RegQueryValueEx(hkey, "InstallPath")[0]
+-            win32api.RegCloseKey(hkey)
+-
+-            # Now append the "bin" subdirectory:
+-            #
+-            path = os.path.join(path, "bin")
+-            progs = __find_executables(path)
+-            if progs is not None:
+-                # print("Used Windows registry")
+-                return progs
+-
+-        except ImportError:
+-            # Print a messaged suggesting they install these?
+-            #
+-            log.debug('The win32api is not installed')
+-            pass
+-        except:
+-            log.debug('Failed to access the registry key')
+-
+-    # Method 2 (Linux, Windows etc)
+-    #
+-    if 'PATH' in os.environ:
+-        for path in os.environ['PATH'].split(os.pathsep):
+-            progs = __find_executables(path)
+-            if progs is not None:
+-                return progs
+-
+-    # Method 3 (Windows only)
+-    #
+-    if os.sys.platform == 'win32':
+-        # Try and work out the equivalent of "C:\Program Files" on this
+-        # machine (might be on drive D:, or in a different language)
+-        #
+-        if 'PROGRAMFILES' in os.environ:
+-            # Note, we could also use the win32api to get this
+-            # information, but win32api may not be installed.
+-
+-            path = os.path.join(os.environ['PROGRAMFILES'], 'ATT', 'GraphViz', 'bin')
+-
+-        else:
+-            # Just in case, try the default...
+-            path = r"C:\Program Files\att\Graphviz\bin"
+-
+-        progs = __find_executables(path)
+-
+-        if progs is not None:
+-            # print("Used default install location")
+-            return progs
+-
+-    for path in (
+-            '/usr/bin', '/usr/local/bin',
+-            '/opt/local/bin',
+-            '/opt/bin', '/sw/bin', '/usr/share',
+-            '/Applications/Graphviz.app/Contents/MacOS/'):
+-        progs = __find_executables(path)
+-        if progs is not None:
+-            # print("Used path")
+-            return progs
++    progs = __find_executables('@graphviz@/bin')
++    if progs is not None:
++        return progs
+ 
+     # Failed to find GraphViz
+     #
diff --git a/pkgs/development/python-modules/dot2tex/test.patch b/pkgs/development/python-modules/dot2tex/test.patch
new file mode 100644
index 000000000000..9ead8ac5ee5c
--- /dev/null
+++ b/pkgs/development/python-modules/dot2tex/test.patch
@@ -0,0 +1,12 @@
+diff --git a/tests/test_dot2tex.py b/tests/test_dot2tex.py
+index 74b01ed..7be9aba 100644
+--- a/tests/test_dot2tex.py
++++ b/tests/test_dot2tex.py
+@@ -147,6 +147,7 @@ class NeedsQuotesTests(unittest.TestCase):
+ 
+ class MultipleStatements(unittest.TestCase):
+     # https://github.com/kjellmf/dot2tex/issues/5
++    @unittest.skip('fails upstream')
+     def test_semicolon(self):
+         """Test for issue 5"""
+         testgraph1 = """
diff --git a/pkgs/development/python-modules/elasticsearch-dsl/default.nix b/pkgs/development/python-modules/elasticsearch-dsl/default.nix
index 712766fa58e2..68d658f4989e 100644
--- a/pkgs/development/python-modules/elasticsearch-dsl/default.nix
+++ b/pkgs/development/python-modules/elasticsearch-dsl/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "elasticsearch-dsl";
-  version = "7.2.0";
+  version = "7.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "19q91srlcvfrk5rnk18c0mzvki9l893g7rqgymfg0p8abb9c05a0";
+    sha256 = "1e345535164cb684de4b825e1d0daf81b75554b30d3905446584a9e4af0cc3e7";
   };
 
   propagatedBuildInputs = [ elasticsearch python-dateutil six ]
diff --git a/pkgs/development/python-modules/elasticsearch/default.nix b/pkgs/development/python-modules/elasticsearch/default.nix
index 821a890346fc..b04bc9069f71 100644
--- a/pkgs/development/python-modules/elasticsearch/default.nix
+++ b/pkgs/development/python-modules/elasticsearch/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage (rec {
   pname = "elasticsearch";
-  version = "7.7.0";
+  version = "7.7.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1fm6lalyiy4ayj0mp400dvy629j2av5cqww72w4cg8bqifb83pim";
+    sha256 = "9bfcb2bd137d6d7ca123e252b9d7261cfe4f7723f7b749a99c52b47766cf387c";
   };
 
   # Check is disabled because running them destroy the content of the local cluster!
diff --git a/pkgs/development/python-modules/eve/default.nix b/pkgs/development/python-modules/eve/default.nix
index 7a74de03d522..062d6e3bedb8 100644
--- a/pkgs/development/python-modules/eve/default.nix
+++ b/pkgs/development/python-modules/eve/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "Eve";
-  version = "1.1";
+  version = "1.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1a7i7x77p5wjqfzmgn30m9sz2mcz06k4qf5af6a45109lafcq0bv";
+    sha256 = "dbb409c481ffd5100a5ab13177f6ef6284257e33ac8e5090cd50e42533607ebd";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/fake-useragent/default.nix b/pkgs/development/python-modules/fake-useragent/default.nix
new file mode 100644
index 000000000000..fb85408dd3d2
--- /dev/null
+++ b/pkgs/development/python-modules/fake-useragent/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, fetchPypi, buildPythonPackage, six, pytest }:
+
+buildPythonPackage rec {
+  pname = "fake-useragent";
+  version = "0.1.11";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0dfz3bpmjmaxlhda6hfgsac7afb65pljibi8zkp9gc0ffn5rj161";
+  };
+
+  propagatedBuildInputs = [ six ];
+
+  checkInputs = [ pytest ];
+
+  meta = with stdenv.lib; {
+    description = "Up to date simple useragent faker with real world database";
+    homepage = "https://github.com/hellysmile/fake-useragent";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ evanjs ];
+  };
+}
diff --git a/pkgs/development/python-modules/flask-sqlalchemy/default.nix b/pkgs/development/python-modules/flask-sqlalchemy/default.nix
index 2453bb50766d..594af9f74bf4 100644
--- a/pkgs/development/python-modules/flask-sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/flask-sqlalchemy/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "Flask-SQLAlchemy";
-  version = "2.4.1";
+  version = "2.4.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6974785d913666587949f7c2946f7001e4fa2cb2d19f4e69ead02e4b8f50b33d";
+    sha256 = "0b656fbf87c5f24109d859bafa791d29751fabbda2302b606881ae5485b557a5";
   };
 
   propagatedBuildInputs = [ flask sqlalchemy ];
diff --git a/pkgs/development/python-modules/geoalchemy2/default.nix b/pkgs/development/python-modules/geoalchemy2/default.nix
index e4fbb37c966e..892b373f065c 100644
--- a/pkgs/development/python-modules/geoalchemy2/default.nix
+++ b/pkgs/development/python-modules/geoalchemy2/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "GeoAlchemy2";
-  version = "0.8.0";
+  version = "0.8.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0kqxm9imqjbhjj5imvf2kl57di454xmnnsr3i0cs66ibq90nx5m8";
+    sha256 = "a5a2444d90ce7f2c6b2d7bd7346c8aed16fd32c3e190e631576a51814e8f7ee9";
   };
 
   propagatedBuildInputs = [ sqlalchemy shapely ];
diff --git a/pkgs/development/python-modules/google_cloud_resource_manager/default.nix b/pkgs/development/python-modules/google_cloud_resource_manager/default.nix
index d1d4217b3ccc..84fac88bcfa9 100644
--- a/pkgs/development/python-modules/google_cloud_resource_manager/default.nix
+++ b/pkgs/development/python-modules/google_cloud_resource_manager/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-resource-manager";
-  version = "0.30.1";
+  version = "0.30.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "03n9ahf4qiyamblh217m5bjc8n57gh09xz87l2iw84c81xxdfcpg";
+    sha256 = "de7eba5235df61deee2291a2fe70b904154df613a334109488afdea7a4c0011f";
   };
 
   checkInputs = [ pytest mock ];
diff --git a/pkgs/development/python-modules/google_resumable_media/default.nix b/pkgs/development/python-modules/google_resumable_media/default.nix
index e9c7eecbc3a7..40c8f2596bb1 100644
--- a/pkgs/development/python-modules/google_resumable_media/default.nix
+++ b/pkgs/development/python-modules/google_resumable_media/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "google-resumable-media";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2a8fd188afe1cbfd5998bf20602f76b0336aa892de88fe842a806b9a3ed78d2a";
+    sha256 = "97155236971970382b738921f978a6f86a7b5a0b0311703d991e065d3cb55773";
   };
 
   checkInputs = [ pytest mock ];
diff --git a/pkgs/development/python-modules/greenlet/default.nix b/pkgs/development/python-modules/greenlet/default.nix
index f6cff7411d21..c325c9652491 100644
--- a/pkgs/development/python-modules/greenlet/default.nix
+++ b/pkgs/development/python-modules/greenlet/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "greenlet";
-  version = "0.4.15";
+  version = "0.4.16";
   disabled = isPyPy;  # builtin for pypy
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9416443e219356e3c31f1f918a91badf2e37acf297e2fa13d24d1cc2380f8fbc";
+    sha256 = "6e06eac722676797e8fce4adb8ad3dc57a1bb3adfb0dd3fdf8306c055a38456c";
   };
 
   propagatedBuildInputs = [ six ];
diff --git a/pkgs/development/python-modules/hsaudiotag3k/default.nix b/pkgs/development/python-modules/hsaudiotag3k/default.nix
index 28fa42b70f04..d12d3bc8c832 100644
--- a/pkgs/development/python-modules/hsaudiotag3k/default.nix
+++ b/pkgs/development/python-modules/hsaudiotag3k/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "hsaudiotag3k";
-  version = "1.1.3";
+  version = "1.1.3.post1";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0bv5k5594byr2bmhh77xv10fkdpckcmxg3w380yp30aqf83rcsx3";
+    sha256 = "ef60e9210d4727e82f0095a686cb07b676d055918f0c59c5bfa8598da03e59d1";
   };
 
   # no tests
diff --git a/pkgs/development/python-modules/httplib2/default.nix b/pkgs/development/python-modules/httplib2/default.nix
index f0191ad8226c..5495c806dc0f 100644
--- a/pkgs/development/python-modules/httplib2/default.nix
+++ b/pkgs/development/python-modules/httplib2/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "httplib2";
-  version = "0.17.3";
+  version = "0.17.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "39dd15a333f67bfb70798faa9de8a6e99c819da6ad82b77f9a259a5c7b1225a2";
+    sha256 = "1e9340ecf0187a621bdcfb407c32e04e8e09fc6ab28b050efa38f20eae0e975f";
   };
 
   # Needs setting up
diff --git a/pkgs/development/python-modules/hvac/default.nix b/pkgs/development/python-modules/hvac/default.nix
index a783246ee5c3..d68e12b37732 100644
--- a/pkgs/development/python-modules/hvac/default.nix
+++ b/pkgs/development/python-modules/hvac/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "hvac";
-  version = "0.10.1";
+  version = "0.10.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1fcd2psvkfsqy45iygm59rzhb7qkbgv3c1dk3x3jvhy6a1ls4kkq";
+    sha256 = "391b558a465d1919a2862926ab9a7c6bef1f2ac2c46daf8dd5115080c42978e4";
   };
 
   propagatedBuildInputs = [ requests six ];
diff --git a/pkgs/development/python-modules/identify/default.nix b/pkgs/development/python-modules/identify/default.nix
index 19ad7317ce41..9f78298a3f3a 100644
--- a/pkgs/development/python-modules/identify/default.nix
+++ b/pkgs/development/python-modules/identify/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "identify";
-  version = "1.4.16";
+  version = "1.4.19";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "19zk3qmcf0afbcbfnj7cmmgr47pxhjqwa1bfdc3fp60yy10kvbgr";
+    sha256 = "249ebc7e2066d6393d27c1b1be3b70433f824a120b1d8274d362f1eb419e3b52";
   };
 
   # Tests not included in PyPI tarball
diff --git a/pkgs/development/python-modules/importlib-metadata/default.nix b/pkgs/development/python-modules/importlib-metadata/default.nix
index 76545edcbeba..5a3137922475 100644
--- a/pkgs/development/python-modules/importlib-metadata/default.nix
+++ b/pkgs/development/python-modules/importlib-metadata/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage rec {
   pname = "importlib-metadata";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchPypi {
     pname = "importlib_metadata";
     inherit version;
-    sha256 = "00ikdj4gjhankdljnz7g5ggak4k9lql2926x0x117ir9j2lv7x86";
+    sha256 = "07icyggasn38yv2swdrd8z6i0plazmc9adavsdkbqqj91j53ll9l";
   };
 
   nativeBuildInputs = [ setuptools_scm ];
@@ -26,7 +26,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [ zipp ]
     ++ lib.optionals (!isPy3k) [ pathlib2 contextlib2 configparser ];
 
-  checkInputs = [ importlib-resources packaging ];
+  doCheck = false; # Cyclic dependencies.
 
   # removing test_main.py - it requires 'pyflakefs'
   # and adding `pyflakefs` to `checkInputs` causes infinite recursion.
diff --git a/pkgs/development/python-modules/importlib-resources/default.nix b/pkgs/development/python-modules/importlib-resources/default.nix
index 6fba0a703e16..7faefd4c0e1e 100644
--- a/pkgs/development/python-modules/importlib-resources/default.nix
+++ b/pkgs/development/python-modules/importlib-resources/default.nix
@@ -1,24 +1,28 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pathlib2
+, setuptools_scm
+, toml
+, importlib-metadata
 , typing
-, isPy3k
+, singledispatch
 , pythonOlder
 , python
 }:
 
 buildPythonPackage rec {
   pname = "importlib_resources";
-  version = "1.0.2";
+  version = "1.5.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d3279fd0f6f847cced9f7acc19bd3e5df54d34f93a2e7bb5f238f81545787078";
+    sha256 = "1jilyxyb2z7hzcjhx1ddni52mq00i728wqh8f5k4469yhdkdz1vg";
   };
 
+  nativeBuildInputs = [ setuptools_scm toml ];
   propagatedBuildInputs = [
-  ] ++ lib.optional (!isPy3k) pathlib2
+    importlib-metadata
+  ] ++ lib.optional (pythonOlder "3.4") singledispatch
     ++ lib.optional (pythonOlder "3.5") typing
   ;
 
diff --git a/pkgs/development/python-modules/ipython/7.9.nix b/pkgs/development/python-modules/ipython/7.9.nix
index 4c8086def330..9953868df5f3 100644
--- a/pkgs/development/python-modules/ipython/7.9.nix
+++ b/pkgs/development/python-modules/ipython/7.9.nix
@@ -64,6 +64,6 @@ buildPythonPackage rec {
     description = "IPython: Productive Interactive Computing";
     homepage = "http://ipython.org/";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ bjornfor fridh ];
+    maintainers = with maintainers; [ bjornfor ];
   };
 }
diff --git a/pkgs/development/python-modules/ipython/default.nix b/pkgs/development/python-modules/ipython/default.nix
index 69fe73eb3423..692daa7b2f38 100644
--- a/pkgs/development/python-modules/ipython/default.nix
+++ b/pkgs/development/python-modules/ipython/default.nix
@@ -22,12 +22,12 @@
 
 buildPythonPackage rec {
   pname = "ipython";
-  version = "7.14.0";
+  version = "7.15.0";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f0126781d0f959da852fb3089e170ed807388e986a8dd4e6ac44855845b0fb1c";
+    sha256 = "0ef1433879816a960cd3ae1ae1dc82c64732ca75cec8dab5a4e29783fb571d0e";
   };
 
   prePatch = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/python-modules/isbnlib/default.nix b/pkgs/development/python-modules/isbnlib/default.nix
index 11ae3157615a..2c454fd9ce0c 100644
--- a/pkgs/development/python-modules/isbnlib/default.nix
+++ b/pkgs/development/python-modules/isbnlib/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "isbnlib";
-  version = "3.10.1";
+  version = "3.10.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ky5ynb8p580y2x3vpib6yrvdjgjb0wpqmdfnq5pqi3qzjyzsqra";
+    sha256 = "2295c01465fe19776b1f9432fd99fd24e61230d146ded2752e0d980ef6f4101f";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/jupyter_client/5.nix b/pkgs/development/python-modules/jupyter_client/5.nix
index 4855663ebc7d..8ce8150cbd47 100644
--- a/pkgs/development/python-modules/jupyter_client/5.nix
+++ b/pkgs/development/python-modules/jupyter_client/5.nix
@@ -34,6 +34,6 @@ buildPythonPackage rec {
     description = "Jupyter protocol implementation and client libraries";
     homepage = "https://jupyter.org/";
     license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ fridh ];
+    maintainers = with lib.maintainers; [  ];
   };
 }
diff --git a/pkgs/development/python-modules/jupyterlab/default.nix b/pkgs/development/python-modules/jupyterlab/default.nix
index a8057ed06ae5..8d08fec6f5d9 100644
--- a/pkgs/development/python-modules/jupyterlab/default.nix
+++ b/pkgs/development/python-modules/jupyterlab/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "jupyterlab";
-  version = "2.1.2";
+  version = "2.1.4";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "380c29d674f6dcf8e380615334c7813bb4feb7bbb6222baf1d4c9f8318f4b104";
+    sha256 = "7b5bd4a05330a01c8522ee7f1cda5cb2e0d96412d9e1e879a19b3afb63d4ac69";
   };
 
   propagatedBuildInputs = [ jupyterlab_server notebook ];
diff --git a/pkgs/development/python-modules/jupyterlab_server/default.nix b/pkgs/development/python-modules/jupyterlab_server/default.nix
index cd166b2d801e..9185c2940060 100644
--- a/pkgs/development/python-modules/jupyterlab_server/default.nix
+++ b/pkgs/development/python-modules/jupyterlab_server/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "jupyterlab_server";
-  version = "1.1.3";
+  version = "1.1.5";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "17eac20af10167abebbeca72e7e390b9c19a400b8fffa158b5cfdcac344253d4";
+    sha256 = "3398e401b95da868bc96bdaa44fa61252bf3e68fc9dd1645bd93293cce095f6c";
   };
 
   checkInputs = [ requests pytest ];
diff --git a/pkgs/development/python-modules/keras-preprocessing/default.nix b/pkgs/development/python-modules/keras-preprocessing/default.nix
index cb4b6d249b60..d62a179136f4 100644
--- a/pkgs/development/python-modules/keras-preprocessing/default.nix
+++ b/pkgs/development/python-modules/keras-preprocessing/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "Keras_Preprocessing";
-  version = "1.1.0";
+  version = "1.1.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1r98nm4k1svsqjyaqkfk23i31bl1kcfcyp7094yyj3c43phfp3as";
+    sha256 = "add82567c50c8bc648c14195bf544a5ce7c1f76761536956c3d2978970179ef3";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/kombu/default.nix b/pkgs/development/python-modules/kombu/default.nix
index 437f03276708..27d225c6f7cf 100644
--- a/pkgs/development/python-modules/kombu/default.nix
+++ b/pkgs/development/python-modules/kombu/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "kombu";
-  version = "4.6.8";
+  version = "4.6.10";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0xlv1rsfc3vn22l35csaj939zygd15nzmxbz3bcl981685vxl71d";
+    sha256 = "437b9cdea193cc2ed0b8044c85fd0f126bb3615ca2f4d4a35b39de7cacfa3c1a";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/libevdev/default.nix b/pkgs/development/python-modules/libevdev/default.nix
new file mode 100644
index 000000000000..ab00340cfe19
--- /dev/null
+++ b/pkgs/development/python-modules/libevdev/default.nix
@@ -0,0 +1,21 @@
+{ stdenv, buildPythonPackage, isPy27, fetchPypi }:
+
+buildPythonPackage rec {
+  pname = "libevdev";
+  version = "0.7";
+  disabled = isPy27;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "10gwj08kn2rs4waq7807mq34cbavgkpg8fpir8mvnba601b8q4r4";
+  };
+
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "Python wrapper around the libevdev C library";
+    homepage = "https://gitlab.freedesktop.org/libevdev/python-libevdev";
+    license = licenses.mit;
+    maintainers = with maintainers; [ nickhu ];
+  };
+}
diff --git a/pkgs/development/python-modules/mailmanclient/default.nix b/pkgs/development/python-modules/mailmanclient/default.nix
index 247a7ed1b004..45dfc55ae9a8 100644
--- a/pkgs/development/python-modules/mailmanclient/default.nix
+++ b/pkgs/development/python-modules/mailmanclient/default.nix
@@ -2,20 +2,16 @@
 
 buildPythonPackage rec {
   pname = "mailmanclient";
-  version = "3.3.0";
+  version = "3.3.1";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c8736cbe152ae1bd58b46ccfbcafb6a1e301513530772e7fda89f91d1e5c1ae9";
+    sha256 = "0pjgzpvhdb6ql8asb20xr8d01m646zpghmcp9fmscks0n1k4di4g";
   };
 
   propagatedBuildInputs = [ six httplib2 requests ];
 
-  # no tests with Pypi tar ball, checkPhase removes setup.py which invalidates import check
-  doCheck = false;
-  pythonImportsCheck = [ "mailmanclient" ];
-
   meta = with stdenv.lib; {
     homepage = "https://www.gnu.org/software/mailman/";
     description = "REST client for driving Mailman 3";
diff --git a/pkgs/development/python-modules/meinheld/default.nix b/pkgs/development/python-modules/meinheld/default.nix
index 247523a9a830..2941505184de 100644
--- a/pkgs/development/python-modules/meinheld/default.nix
+++ b/pkgs/development/python-modules/meinheld/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "meinheld";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "447de7189e4dc9c1f425aa1b9c8210aab492fda4d86f73a24059264e7d8b0134";
+    sha256 = "008c76937ac2117cc69e032dc69cea9f85fc605de9bac1417f447c41c16a56d6";
   };
 
   propagatedBuildInputs = [ greenlet ];
diff --git a/pkgs/development/python-modules/msgpack-numpy/default.nix b/pkgs/development/python-modules/msgpack-numpy/default.nix
index d646c1ed15f2..9be30fff5383 100644
--- a/pkgs/development/python-modules/msgpack-numpy/default.nix
+++ b/pkgs/development/python-modules/msgpack-numpy/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "msgpack-numpy";
-  version = "0.4.5";
+  version = "0.4.6.post0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0z3ls52iamqv6fbn1ljnd5nnnzaiakczciry5c3vym5r77wgc9mg";
+    sha256 = "dfcb0c9cb5850e656344ac464a260e7b8b9b1c62d77c2e1d3d9ef15a88f1df6b";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/multidict/default.nix b/pkgs/development/python-modules/multidict/default.nix
index 155395efa4ad..d818a63cd5d0 100644
--- a/pkgs/development/python-modules/multidict/default.nix
+++ b/pkgs/development/python-modules/multidict/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "multidict";
-  version = "4.7.5";
+  version = "4.7.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "aee283c49601fa4c13adc64c09c978838a7e812f85377ae130a24d7198c0331e";
+    sha256 = "fbb77a75e529021e7c4a8d4e823d88ef4d23674a202be4f5addffc72cbb91430";
   };
 
   checkInputs = [ pytest pytestrunner pytestcov ];
diff --git a/pkgs/development/python-modules/nbformat/2.nix b/pkgs/development/python-modules/nbformat/2.nix
index faf2cee2b008..06d02520b20d 100644
--- a/pkgs/development/python-modules/nbformat/2.nix
+++ b/pkgs/development/python-modules/nbformat/2.nix
@@ -36,6 +36,6 @@ buildPythonPackage rec {
     description = "The Jupyter Notebook format";
     homepage = "https://jupyter.org/";
     license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ fridh globin ];
+    maintainers = with lib.maintainers; [ globin ];
   };
 }
diff --git a/pkgs/development/python-modules/notebook/2.nix b/pkgs/development/python-modules/notebook/2.nix
index 8b8cce2f8245..37f39c44967c 100644
--- a/pkgs/development/python-modules/notebook/2.nix
+++ b/pkgs/development/python-modules/notebook/2.nix
@@ -71,6 +71,6 @@ buildPythonPackage rec {
     description = "The Jupyter HTML notebook is a web-based notebook environment for interactive computing";
     homepage = "https://jupyter.org/";
     license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ fridh ];
+    maintainers = with lib.maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/default.nix
index 62a871fda092..0c9bac973203 100644
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/default.nix
@@ -35,13 +35,13 @@ let
   };
 in buildPythonPackage rec {
   pname = "numpy";
-  version = "1.18.4";
+  version = "1.18.5";
   format = "pyproject.toml";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "bbcc85aaf4cd84ba057decaead058f43191cc0e30d6bc5d44fe336dc3d3f4509";
+    sha256 = "34e96e9dae65c4839bd80012023aadd6ee2ccb73ce7fdf3074c62f301e63120b";
   };
 
   nativeBuildInputs = [ gfortran pytest cython setuptoolsBuildHook ];
diff --git a/pkgs/development/python-modules/pandas/default.nix b/pkgs/development/python-modules/pandas/default.nix
index 0f4a35420865..5d7bb4a6d696 100644
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@@ -30,11 +30,11 @@ let
 
 in buildPythonPackage rec {
   pname = "pandas";
-  version = "1.0.3";
+  version = "1.0.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "11j5s6hz29yh3rwa2rjgric0knbhp9shphd4i7hx00xr5wr2xx1j";
+    sha256 = "b35d625282baa7b51e82e52622c300a1ca9f786711b2af7cbe64f1e6831f4126";
   };
 
   checkInputs = [ pytest glibcLocales moto hypothesis ];
diff --git a/pkgs/development/python-modules/phik/default.nix b/pkgs/development/python-modules/phik/default.nix
index e09182d5e714..ca1b5ba65da7 100644
--- a/pkgs/development/python-modules/phik/default.nix
+++ b/pkgs/development/python-modules/phik/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "phik";
-  version = "0.9.11";
+  version = "0.9.12";
   format = "wheel";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version format;
     python = "py3";
-    sha256 = "b8c36dc50265d8c0626b34e3bc74cd0edd342d9d8ecc3d78c06817200bb31d10";
+    sha256 = "c4f86e5587e5b456e69bf69d95d07fe7aafc341c40f8f3a21dd5b52272e9ae7b";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/phonenumbers/default.nix b/pkgs/development/python-modules/phonenumbers/default.nix
index e9f50420ca9e..2ba64faad31e 100644
--- a/pkgs/development/python-modules/phonenumbers/default.nix
+++ b/pkgs/development/python-modules/phonenumbers/default.nix
@@ -6,7 +6,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "09kww3fzn85gbj4lw8kqrppm9kq7nmy7b96p76sscamrpsdg31im";
+    sha256 = "3586f19abeb92aa6b539d7a4757cb507cf54efcd78224e895caf20fbdde07c26";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/pyenchant/default.nix b/pkgs/development/python-modules/pyenchant/default.nix
index 1d2686ec2992..1c82f7c9d630 100644
--- a/pkgs/development/python-modules/pyenchant/default.nix
+++ b/pkgs/development/python-modules/pyenchant/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "pyenchant";
-  version = "3.1.0";
+  version = "3.1.1";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "14is5p40f516plzccwg6yf51zkja38abw46kybzwgyy94phr8i9b";
+    sha256 = "ce0915d7acd771fde6e8c2dce8ad0cb0e6f7c4fa8430cc96e3e7134e99aeb12f";
   };
 
   propagatedBuildInputs = [ enchant2 ];
diff --git a/pkgs/development/python-modules/pyhomematic/default.nix b/pkgs/development/python-modules/pyhomematic/default.nix
index 5349ea994a44..14bf1cfe7be0 100644
--- a/pkgs/development/python-modules/pyhomematic/default.nix
+++ b/pkgs/development/python-modules/pyhomematic/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "pyhomematic";
-  version = "0.1.66";
+  version = "0.1.67";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f046db8406ee8a1aea6f6b05de8a133d3459b990c065c3f66446050e9aad5d79";
+    sha256 = "2d18e0059367e9e32d6472023322113fce431bcc72187b4a6eb7402fe5d2794b";
   };
 
   # PyPI tarball does not include tests/ directory
diff --git a/pkgs/development/python-modules/pynput/default.nix b/pkgs/development/python-modules/pynput/default.nix
new file mode 100644
index 000000000000..2b83f4c1223b
--- /dev/null
+++ b/pkgs/development/python-modules/pynput/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, buildPythonPackage, fetchPypi, sphinx, setuptools-lint, xlib }:
+
+buildPythonPackage rec {
+  pname = "pynput";
+  version = "1.6.8";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "16h4wn7f54rw30jrya7rmqkx3f51pxn8cplid95v880md8yqdhb8";
+  };
+
+  nativeBuildInputs = [ sphinx ];
+
+  propagatedBuildInputs = [ setuptools-lint xlib ];
+
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "A library to control and monitor input devices";
+    homepage = "https://github.com/moses-palmer/pynput";
+    license = licenses.lgpl3;
+    maintainers = with maintainers; [ nickhu ];
+  };
+}
+
diff --git a/pkgs/development/python-modules/pysonos/default.nix b/pkgs/development/python-modules/pysonos/default.nix
index 67e8e5573d7f..427c42545c5a 100644
--- a/pkgs/development/python-modules/pysonos/default.nix
+++ b/pkgs/development/python-modules/pysonos/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "pysonos";
-  version = "0.0.28";
+  version = "0.0.31";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "09852c0bfe07e3529f8665527381f586c7ea3beabcd7291311e679d56459069d";
+    sha256 = "03f21d2fb27cd938bd2c47f8582c0737eb7426a0cd59e5a60171fabe5e963e62";
   };
 
   propagatedBuildInputs = [ xmltodict requests ifaddr ];
diff --git a/pkgs/development/python-modules/pytest-flake8/default.nix b/pkgs/development/python-modules/pytest-flake8/default.nix
index af1cbb2add51..a5ed447aceac 100644
--- a/pkgs/development/python-modules/pytest-flake8/default.nix
+++ b/pkgs/development/python-modules/pytest-flake8/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-flake8";
-  version = "1.0.5";
+  version = "1.0.6";
 
   # although pytest is a runtime dependency, do not add it as
   # propagatedBuildInputs in order to allow packages depend on another version
@@ -12,7 +12,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d85efaafbdb9580791cfa8671799dd40d482fc30bd4476c1ca5efd661e751333";
+    sha256 = "1b82bb58c88eb1db40524018d3fcfd0424575029703b4e2d8e3ee873f2b17027";
   };
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/pytest/default.nix b/pkgs/development/python-modules/pytest/default.nix
index 9e0cd88cf0a4..daf43961ea67 100644
--- a/pkgs/development/python-modules/pytest/default.nix
+++ b/pkgs/development/python-modules/pytest/default.nix
@@ -19,7 +19,7 @@
 }:
 
 buildPythonPackage rec {
-  version = "5.4.2";
+  version = "5.4.3";
   pname = "pytest";
 
   disabled = !isPy3k;
@@ -31,7 +31,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "eb2b5e935f6a019317e455b6da83dd8650ac9ffd2ee73a7b657a30873d67a698";
+    sha256 = "7979331bfcba207414f5e1263b5a0f8f521d0f457318836a7355531ed1a4c7d8";
   };
 
   checkInputs = [ hypothesis pygments ];
diff --git a/pkgs/development/python-modules/python-miio/default.nix b/pkgs/development/python-modules/python-miio/default.nix
index 5b8c140df67e..a18645697089 100644
--- a/pkgs/development/python-modules/python-miio/default.nix
+++ b/pkgs/development/python-modules/python-miio/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "python-miio";
-  version = "0.5.0.1";
+  version = "0.5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "fa9c318256945ad4a8623fdf921ce81c466a7aea18b04a6711efb662f520b195";
+    sha256 = "8d23caf4906f2112dc88b9a6d5e1767877744cae016cd71c2bf75592a4be3b79";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/pytrends/default.nix b/pkgs/development/python-modules/pytrends/default.nix
index db7f781c5bf4..0b0bad801e12 100644
--- a/pkgs/development/python-modules/pytrends/default.nix
+++ b/pkgs/development/python-modules/pytrends/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "pytrends";
-  version = "4.7.2";
+  version = "4.7.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1cf80573276b3a93c4fb2ff296c260fa86e7ab43709473ce34f3bad3841f06df";
+    sha256 = "8ccb06c57c31fa157b978a0d810de7718ee46583d28cf818250d45f36abd2faa";
   };
 
   doCheck = false;
diff --git a/pkgs/development/python-modules/readthedocs-sphinx-ext/default.nix b/pkgs/development/python-modules/readthedocs-sphinx-ext/default.nix
index efadd4337126..68ccf676f292 100644
--- a/pkgs/development/python-modules/readthedocs-sphinx-ext/default.nix
+++ b/pkgs/development/python-modules/readthedocs-sphinx-ext/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "readthedocs-sphinx-ext";
-  version = "1.0.3";
+  version = "1.0.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "faccf1c52aab34b1fdfd672ec4ce4321975453b05741e32a94b33cc682d045b2";
+    sha256 = "33dbb135373d539233f7fbdb5e8dcfa07d41254300ee23719eb9caa8c68a40ae";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/pkgs/development/python-modules/restructuredtext_lint/default.nix b/pkgs/development/python-modules/restructuredtext_lint/default.nix
index 4f62d232ab5e..17bf5fbf2974 100644
--- a/pkgs/development/python-modules/restructuredtext_lint/default.nix
+++ b/pkgs/development/python-modules/restructuredtext_lint/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "restructuredtext_lint";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "97b3da356d5b3a8514d8f1f9098febd8b41463bed6a1d9f126cf0a048b6fd908";
+    sha256 = "470e53b64817211a42805c3a104d2216f6f5834b22fe7adb637d1de4d6501fb8";
   };
 
   checkInputs = [ nose testtools ];
diff --git a/pkgs/development/python-modules/rethinkdb/default.nix b/pkgs/development/python-modules/rethinkdb/default.nix
index fc33d7206e76..f1239b75d481 100644
--- a/pkgs/development/python-modules/rethinkdb/default.nix
+++ b/pkgs/development/python-modules/rethinkdb/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "rethinkdb";
-  version = "2.4.6";
+  version = "2.4.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4eb4252b498af3f5d01e07d7870eb35f78b96bccc45812d313c14c5184789d74";
+    sha256 = "945b5efdc10f468fc056bd53a4e4224ec4c2fe1a7e83ae47443bbb6e7c7a1f7d";
   };
 
   doCheck = false;
diff --git a/pkgs/development/python-modules/scrapy-deltafetch/default.nix b/pkgs/development/python-modules/scrapy-deltafetch/default.nix
new file mode 100644
index 000000000000..cf6f8a010714
--- /dev/null
+++ b/pkgs/development/python-modules/scrapy-deltafetch/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, fetchPypi, buildPythonPackage, pytest, scrapy, bsddb3 }:
+
+buildPythonPackage rec {
+  pname = "scrapy-deltafetch";
+  version = "1.2.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1m511psddvlapg492ny36l8rzy7z4i39yx6a1agxzfz6s9b83fq8";
+  };
+
+  propagatedBuildInputs = [ bsddb3 scrapy ];
+
+  checkInputs = [ pytest ];
+
+  meta = with stdenv.lib; {
+    description = "Scrapy spider middleware to ignore requests to pages containing items seen in previous crawls";
+    homepage = "https://github.com/scrapy-plugins/scrapy-deltafetch";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ evanjs ];
+  };
+}
diff --git a/pkgs/development/python-modules/scrapy-fake-useragent/default.nix b/pkgs/development/python-modules/scrapy-fake-useragent/default.nix
new file mode 100644
index 000000000000..26e142434c59
--- /dev/null
+++ b/pkgs/development/python-modules/scrapy-fake-useragent/default.nix
@@ -0,0 +1,21 @@
+{ stdenv, fetchPypi, buildPythonPackage, pytest, fake-useragent, scrapy }:
+
+buildPythonPackage rec {
+  pname = "scrapy-fake-useragent";
+  version = "1.2.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "02mayk804vdl15wjpx7jcjkc4zgrra4izf6iv00mcxq4fd4ck03l";
+  };
+
+  propagatedBuildInputs = [ fake-useragent ];
+
+  checkInputs = [ pytest scrapy ];
+
+  meta = with stdenv.lib; {
+    description = "Random User-Agent middleware based on fake-useragent";
+    homepage = "https://github.com/alecxe/scrapy-fake-useragent";
+    license = licenses.bsd3;
+  };
+}
diff --git a/pkgs/development/python-modules/scrapy-splash/default.nix b/pkgs/development/python-modules/scrapy-splash/default.nix
new file mode 100644
index 000000000000..7799186d6216
--- /dev/null
+++ b/pkgs/development/python-modules/scrapy-splash/default.nix
@@ -0,0 +1,20 @@
+{ stdenv, fetchPypi, buildPythonPackage, pytest, hypothesis, scrapy }:
+
+buildPythonPackage rec {
+  pname = "scrapy-splash";
+  version = "0.7.2";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1dg7csdza2hzqskd9b9gx0v3saqsch4f0fwdp0a3p0822aqqi488";
+  };
+
+  checkInputs = [ pytest hypothesis scrapy ];
+
+  meta = with stdenv.lib; {
+    description = "Scrapy+Splash for JavaScript integration";
+    homepage = "https://github.com/scrapy-plugins/scrapy-splash";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ evanjs ];
+  };
+}
diff --git a/pkgs/development/python-modules/screeninfo/default.nix b/pkgs/development/python-modules/screeninfo/default.nix
new file mode 100644
index 000000000000..9ee04cb50a82
--- /dev/null
+++ b/pkgs/development/python-modules/screeninfo/default.nix
@@ -0,0 +1,35 @@
+{ stdenv, buildPythonApplication, fetchPypi, isPy36, dataclasses, libX11, libXinerama, libXrandr }:
+
+buildPythonApplication rec {
+  pname = "screeninfo";
+  version = "0.6.5";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0vcw54crdgmbzwlrfg80kd1a8p9i10yks8k0szzi0k5q80zhp8xz";
+  };
+
+  # dataclasses is a compatibility shim for python 3.6 ONLY
+  patchPhase = if isPy36 then "" else ''
+    substituteInPlace setup.py \
+      --replace "\"dataclasses\"," ""
+  '' + ''
+    substituteInPlace screeninfo/enumerators/xinerama.py \
+      --replace "load_library(\"X11\")" "ctypes.cdll.LoadLibrary(\"${libX11}/lib/libX11.so\")" \
+      --replace "load_library(\"Xinerama\")" "ctypes.cdll.LoadLibrary(\"${libXinerama}/lib/libXinerama.so\")"
+    substituteInPlace screeninfo/enumerators/xrandr.py \
+      --replace "load_library(\"X11\")" "ctypes.cdll.LoadLibrary(\"${libX11}/lib/libX11.so\")" \
+      --replace "load_library(\"Xrandr\")" "ctypes.cdll.LoadLibrary(\"${libXrandr}/lib/libXrandr.so\")"
+  '';
+
+  propagatedBuildInputs = stdenv.lib.optional isPy36 dataclasses;
+
+  buildInputs = [ libX11 libXinerama libXrandr];
+
+  meta = with stdenv.lib; {
+    description = "Fetch location and size of physical screens";
+    homepage = "https://github.com/rr-/screeninfo";
+    license = licenses.mit;
+    maintainers = [ maintainers.nickhu ];
+  };
+}
diff --git a/pkgs/development/python-modules/setuptools-lint/default.nix b/pkgs/development/python-modules/setuptools-lint/default.nix
new file mode 100644
index 000000000000..fbe1528c4c3b
--- /dev/null
+++ b/pkgs/development/python-modules/setuptools-lint/default.nix
@@ -0,0 +1,21 @@
+{ stdenv, buildPythonPackage, fetchPypi, pylint }:
+
+buildPythonPackage rec {
+  pname = "setuptools-lint";
+  version = "0.6.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "16a1ac5n7k7sx15cnk03gw3fmslab3a7m74dc45rgpldgiff3577";
+  };
+
+  propagatedBuildInputs = [ pylint ];
+
+  meta = with stdenv.lib; {
+    description = "Package to expose pylint as a lint command into setup.py";
+    homepage = "https://github.com/johnnoone/setuptools-pylint";
+    license = licenses.bsdOriginal;
+    maintainers = with maintainers; [ nickhu ];
+  };
+}
+
diff --git a/pkgs/development/python-modules/snapcast/default.nix b/pkgs/development/python-modules/snapcast/default.nix
index 6e319a183418..93d7d1d9d9cf 100644
--- a/pkgs/development/python-modules/snapcast/default.nix
+++ b/pkgs/development/python-modules/snapcast/default.nix
@@ -3,13 +3,13 @@
 
 buildPythonPackage rec {
   pname = "snapcast";
-  version = "2.1.0";
+  version = "2.1.1";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1z3c9p22pm3823jzh917c3rryv02mhigrjkjf9wlhzmjwx5vmjqf";
+    sha256 = "c3ecd63d997fbcf6e5322dc47c1f02615f1d9611cba01ec18e9c9f8c14ed824b";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/snowflake-connector-python/default.nix b/pkgs/development/python-modules/snowflake-connector-python/default.nix
index 0b14a97b647f..1d8389d80640 100644
--- a/pkgs/development/python-modules/snowflake-connector-python/default.nix
+++ b/pkgs/development/python-modules/snowflake-connector-python/default.nix
@@ -25,12 +25,12 @@
 
 buildPythonPackage rec {
   pname = "snowflake-connector-python";
-  version = "2.2.5";
+  version = "2.2.7";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2f720c4989b2ad92c1fc3c221f049102155f2d8006527daa15f2b54ecfdaf652";
+    sha256 = "84974778dd8d1efd4ff87d8404d71241f90e02044b1b94a52eea567080f93ac4";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/snscrape/default.nix b/pkgs/development/python-modules/snscrape/default.nix
index 9f0b805a19da..4370388959d0 100644
--- a/pkgs/development/python-modules/snscrape/default.nix
+++ b/pkgs/development/python-modules/snscrape/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "snscrape";
-  version = "0.3.1";
+  version = "0.3.2";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "11jv5mv3l11qjlsjihd74gc1jafq0i7360cksqjkx1wv2hcc32rf";
+    sha256 = "ea038827afe439577eb109ebd1b5c481d516d489c624fc3fe6e92ec71ef42be9";
   };
 
   # There are no tests; make sure the executable works.
diff --git a/pkgs/development/python-modules/somajo/default.nix b/pkgs/development/python-modules/somajo/default.nix
index 306737c40028..958c9ab82662 100644
--- a/pkgs/development/python-modules/somajo/default.nix
+++ b/pkgs/development/python-modules/somajo/default.nix
@@ -2,14 +2,14 @@
 
 buildPythonPackage rec {
   pname = "SoMaJo";
-  version = "2.0.5";
+  version = "2.0.6";
   disabled = !isPy3k;
 
   src = fetchFromGitHub {
     owner = "tsproisl";
     repo = pname;
     rev = "v${version}";
-    sha256 = "01zvmqilnndh2b257z7bhcc7av5vhjm1g8gmdiiw15gcd2xfmqjs";
+    sha256 = "08nicj3nj6pi6djli26gf0kf3s2da9ysn1cpkyw7j88v8vav0p7s";
   };
 
   propagatedBuildInputs = [ regex ];
diff --git a/pkgs/development/python-modules/soupsieve/default.nix b/pkgs/development/python-modules/soupsieve/default.nix
index b8cdd63cbde5..bb5ecbc839c2 100644
--- a/pkgs/development/python-modules/soupsieve/default.nix
+++ b/pkgs/development/python-modules/soupsieve/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "soupsieve";
-  version = "1.9.5";
+  version = "1.9.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e2c1c5dee4a1c36bcb790e0fabd5492d874b8ebd4617622c4f6a731701060dda";
+    sha256 = "7985bacc98c34923a439967c1a602dc4f1e15f923b6fcf02344184f86cc7efaa";
   };
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/sphinxcontrib-katex/default.nix b/pkgs/development/python-modules/sphinxcontrib-katex/default.nix
index d3c9fe152806..95bd4b592010 100644
--- a/pkgs/development/python-modules/sphinxcontrib-katex/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-katex/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "sphinxcontrib-katex";
-  version = "0.6.0";
+  version = "0.6.1";
 
   # pkgutil namespaces are broken in nixpkgs (because they can't scan multiple
   # directories). But python2 is EOL, so not supporting it should be ok.
@@ -10,7 +10,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1692q3f3z1rsd3nyxd8wrv0vscwcq2gqjbv79c8ws402y3m7y5ni";
+    sha256 = "88320b2780f350d67f84a5424973ce24aee65701e8e163a7f5856c5df3353188";
   };
 
   propagatedBuildInputs = [ sphinx ];
diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index 9be357fbed33..cd2b00021e7b 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "SQLAlchemy";
-  version = "1.3.16";
+  version = "1.3.17";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0w1xfy7j1h0dyfwk6zc6lfbv2m77lmxk7g17sbgpi08bq0kf293j";
+    sha256 = "156a27548ba4e1fed944ff9fcdc150633e61d350d673ae7baaf6c25c04ac1f71";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/sqlmap/default.nix b/pkgs/development/python-modules/sqlmap/default.nix
index bc94ad50861a..81aede240eeb 100644
--- a/pkgs/development/python-modules/sqlmap/default.nix
+++ b/pkgs/development/python-modules/sqlmap/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "sqlmap";
-  version = "1.4.5";
+  version = "1.4.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ec0d320aca95be3ba53d1af0faefc047864dfe6328622ae10e33a6ed9446ca8";
+    sha256 = "0da3a6700a370fcd671265502c7c4aca39a1d055de9a1dcc8b9b751c9ad3efa8";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/stytra/default.nix b/pkgs/development/python-modules/stytra/default.nix
index 8a1154d66c88..9fba92ca12f7 100644
--- a/pkgs/development/python-modules/stytra/default.nix
+++ b/pkgs/development/python-modules/stytra/default.nix
@@ -30,12 +30,12 @@
 
 buildPythonPackage rec {
   pname = "stytra";
-  version = "0.8.27";
+  version = "0.8.33";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8fc1ca5f75f47ec1eeb3d62722437bed4ddf598e130b3dd22f0e663f61857df5";
+    sha256 = "b0aacc8e2c1bba33c337ebc76c0d8f2971c113d298aea2a375d84a5eeff5d83e";
   };
   doCheck = false;
   checkInputs = [
diff --git a/pkgs/development/python-modules/toml/default.nix b/pkgs/development/python-modules/toml/default.nix
index 29d0a4c692f3..8e96efcdf444 100644
--- a/pkgs/development/python-modules/toml/default.nix
+++ b/pkgs/development/python-modules/toml/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "toml";
-  version = "0.10.0";
+  version = "0.10.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0p1xww2mzkhqvxkfvmfzm58bbfj812zhdz4rwdjiv94ifz2q37r2";
+    sha256 = "926b612be1e5ce0634a2ca03470f95169cf16f939018233a670519cb4ac58b0f";
   };
 
   # This package has a test script (built for Travis) that involves a)
diff --git a/pkgs/development/python-modules/tqdm/default.nix b/pkgs/development/python-modules/tqdm/default.nix
index af72dc6b8a5f..138c24ebbe3c 100644
--- a/pkgs/development/python-modules/tqdm/default.nix
+++ b/pkgs/development/python-modules/tqdm/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "tqdm";
-  version = "4.46.0";
+  version = "4.46.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4733c4a10d0f2a4d098d801464bdaf5240c7dadd2a7fde4ee93b0a0efd9fb25e";
+    sha256 = "cd140979c2bebd2311dfb14781d8f19bd5a9debb92dcab9f6ef899c987fcf71f";
   };
 
   checkInputs = [ nose coverage glibcLocales flake8 ];
diff --git a/pkgs/development/python-modules/trimesh/default.nix b/pkgs/development/python-modules/trimesh/default.nix
index be135f651213..c6d1ba00a850 100644
--- a/pkgs/development/python-modules/trimesh/default.nix
+++ b/pkgs/development/python-modules/trimesh/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "trimesh";
-  version = "3.6.38";
+  version = "3.6.43";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0rdffk6a1jlfanb4i0prvy68qya8waa390yyw2kix4ja8fk7y6sx";
+    sha256 = "f62dbaf4739858148fe4889f3b4dff93da281982b6592f211c4d33c2e00678eb";
   };
 
   propagatedBuildInputs = [ numpy ];
diff --git a/pkgs/development/python-modules/txdbus/default.nix b/pkgs/development/python-modules/txdbus/default.nix
index 0fbe4900f9e5..8ef694d34ff2 100644
--- a/pkgs/development/python-modules/txdbus/default.nix
+++ b/pkgs/development/python-modules/txdbus/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "txdbus";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0z41n1ikpdvk0nm8dbyh6g9bg781q4j6hg2b09b5k4wdqm17zxbg";
+    sha256 = "eefcffa4efbf82ba11222f17f5989fe1b2b6ef57226ef896c4a7084c990ba217";
   };
 
   propagatedBuildInputs = [ six twisted ];
diff --git a/pkgs/development/python-modules/uproot/default.nix b/pkgs/development/python-modules/uproot/default.nix
index 55c215ac75a3..3d472a604d64 100644
--- a/pkgs/development/python-modules/uproot/default.nix
+++ b/pkgs/development/python-modules/uproot/default.nix
@@ -16,11 +16,11 @@
 
 buildPythonPackage rec {
   pname = "uproot";
-  version = "3.11.5";
+  version = "3.11.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "05bb55d0576813bb7bf252654cf854fcbabe34e30eb99beb70eff6abc4d3f121";
+    sha256 = "3fbf9dfe5ce996ffda3a49d16eba804b95fb05bc041fc4e7bc05317a03bf6cba";
   };
 
   nativeBuildInputs = [ pytestrunner ];
diff --git a/pkgs/development/python-modules/vertica-python/default.nix b/pkgs/development/python-modules/vertica-python/default.nix
index cfbfcde6fd50..8beb39b26d9e 100644
--- a/pkgs/development/python-modules/vertica-python/default.nix
+++ b/pkgs/development/python-modules/vertica-python/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "vertica-python";
-  version = "0.10.3";
+  version = "0.10.4";
   
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0de23c0a09f0d849db626569207d52d324ffd51c69b4f7f3650f167c3c2c9de9";
+    sha256 = "570525d0371806993874bd2ee0f47cc5d68994abb5aa382e964e53e0b81160b2";
   };
   
   propagatedBuildInputs = [ future dateutil six ];
diff --git a/pkgs/development/python-modules/zeroc-ice/default.nix b/pkgs/development/python-modules/zeroc-ice/default.nix
index ccc34b42afb4..16bf5b7855c5 100644
--- a/pkgs/development/python-modules/zeroc-ice/default.nix
+++ b/pkgs/development/python-modules/zeroc-ice/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "zeroc-ice";
-  version = "3.7.3";
+  version = "3.7.4";
 
   src = fetchPypi {
     inherit version pname;
-    sha256 = "1adec3b54c77c46acfc8a99d6336ce9a0223a7016852666358133cbe37d99744";
+    sha256 = "dc79a1eaad1d1cd1cf8cfe636e1bc413c60645e3e87a5a8e9b97ce882690e0e4";
   };
 
   buildInputs = [ openssl bzip2 ];
diff --git a/pkgs/development/python-modules/zeroconf/default.nix b/pkgs/development/python-modules/zeroconf/default.nix
index d293ae449c1d..e9d3c6e038ea 100644
--- a/pkgs/development/python-modules/zeroconf/default.nix
+++ b/pkgs/development/python-modules/zeroconf/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "zeroconf";
-  version = "0.26.1";
+  version = "0.26.3";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "09rvliph7phvgzwmmdv1kwcp3andpiiqfpkrwq1vkxvwqa3mgwji";
+    sha256 = "43ad5006c00be2040cdca1fe768206f4a25356d3cc87eff8b66bd7ead2a82440";
   };
 
   propagatedBuildInputs = [ ifaddr ]
diff --git a/pkgs/development/python-modules/zope_interface/default.nix b/pkgs/development/python-modules/zope_interface/default.nix
index 9214c0badf0a..5e7086191cce 100644
--- a/pkgs/development/python-modules/zope_interface/default.nix
+++ b/pkgs/development/python-modules/zope_interface/default.nix
@@ -6,15 +6,17 @@
 
 buildPythonPackage rec {
   pname = "zope.interface";
-  version = "4.7.2";
-  
+  version = "5.1.0";
+
   src = fetchPypi {
     inherit pname version;
-    sha256 = "fd1101bd3fcb4f4cf3485bb20d6cb0b56909b94d3bd2a53a6cb9d381c3da3365";
+    sha256 = "03nrl6b8cb600dnnh46y149awvrm0gxyqgwq5hdw3lvys8mw9r20";
   };
 
   propagatedBuildInputs = [ zope_event ];
 
+  doCheck = false; # Circular deps.
+
   meta = with stdenv.lib; {
     description = "Zope.Interface";
     homepage = "http://zope.org/Products/ZopeInterface";
diff --git a/pkgs/development/python-modules/zstd/default.nix b/pkgs/development/python-modules/zstd/default.nix
index c96e08ccb513..8f61f2ffc66e 100644
--- a/pkgs/development/python-modules/zstd/default.nix
+++ b/pkgs/development/python-modules/zstd/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "zstd";
-  version = "1.4.4.0";
+  version = "1.4.5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "33f2c1fd8d3f9ac8e35fb3e199896afc54cceb68878570c6d4b72985dc6584a5";
+    sha256 = "2a1806d625bd2d8944ead4b3018fc6444a31467fa09935e9c1d4296275f024c6";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/analysis/flow/default.nix b/pkgs/development/tools/analysis/flow/default.nix
index 8df10222a88e..aed991dab30a 100644
--- a/pkgs/development/tools/analysis/flow/default.nix
+++ b/pkgs/development/tools/analysis/flow/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flow";
-  version = "0.126.1";
+  version = "0.127.0";
 
   src = fetchFromGitHub {
     owner  = "facebook";
     repo   = "flow";
     rev    = "refs/tags/v${version}";
-    sha256 = "1acmhyhbl4s2c907nj8jwgg9fjjrfr306vagwkcx2lza4clb2aan";
+    sha256 = "0daacbb4il3mm8fkbk5qlpvzp3pmrqagq2hr1gsjaf8vnmissvvm";
   };
 
   installPhase = ''
diff --git a/pkgs/development/tools/analysis/tfsec/default.nix b/pkgs/development/tools/analysis/tfsec/default.nix
index 49009570e57b..251162efd8f7 100644
--- a/pkgs/development/tools/analysis/tfsec/default.nix
+++ b/pkgs/development/tools/analysis/tfsec/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "tfsec";
-  version = "0.19.0";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "liamg";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1ddyvkv0949p0b6m1rwai5r87mca5xwyjwsjq7gbyqz9h10bv7nf";
+    sha256 = "0mmh161zwrkjwpw01zcgh7hsap7lgdxhg191bajzig6vlq287jyh";
   };
 
   goPackagePath = "github.com/liamg/tfsec";
diff --git a/pkgs/development/tools/cloudfoundry-cli/default.nix b/pkgs/development/tools/cloudfoundry-cli/default.nix
index 1fa45a32c05f..9d0c1ab92ff4 100644
--- a/pkgs/development/tools/cloudfoundry-cli/default.nix
+++ b/pkgs/development/tools/cloudfoundry-cli/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "cloudfoundry-cli";
-  version = "6.46.1";
+  version = "6.51.0";
 
   goPackagePath = "code.cloudfoundry.org/cli";
 
@@ -12,7 +12,7 @@ buildGoPackage rec {
     owner = "cloudfoundry";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "0dqrkimwhw016icgyf4cyipzy6vdz5jgickm33xxd9018dh3ibwq";
+    sha256 = "189cqng7y12knqm4n1bfajbc2lx027rwb44wddmj5iya27i7fv8f";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/development/tools/continuous-integration/buildkite-cli/default.nix b/pkgs/development/tools/continuous-integration/buildkite-cli/default.nix
new file mode 100644
index 000000000000..06d69c152bad
--- /dev/null
+++ b/pkgs/development/tools/continuous-integration/buildkite-cli/default.nix
@@ -0,0 +1,26 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "buildkite-cli";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "buildkite";
+    repo = "cli";
+    rev = "v${version}";
+    sha256 = "05hz59qzadkk4ji5icv5sxih31pnn0abnmiwcyfa2mr3l5jaqjnd";
+  };
+
+  vendorSha256 = "0jxh3yhh0sdvaykhinxngpipk369hw8z1y3g2z4c1115m5rjp2bb";
+
+  subPackages = [ "cmd/bk" ];
+
+  buildFlagsArray = [ "-ldflags=-s -w -X main.VERSION=${version}" ];
+
+  meta = with lib; {
+    description = "A command line interface for Buildkite";
+    homepage = "https://github.com/buildkite/cli";
+    license = licenses.mit;
+    maintainers = with maintainers; [ groodt ];
+  };
+}
diff --git a/pkgs/development/tools/continuous-integration/fly/default.nix b/pkgs/development/tools/continuous-integration/fly/default.nix
index 3bf48084bbd8..bdad33dee742 100644
--- a/pkgs/development/tools/continuous-integration/fly/default.nix
+++ b/pkgs/development/tools/continuous-integration/fly/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "fly";
-  version = "6.1.0";
+  version = "6.3.0";
 
   src = fetchFromGitHub {
     owner = "concourse";
     repo = "concourse";
     rev = "v${version}";
-    sha256 = "14sm3xwhm6pfln18i9f9dyj7s2wcri43rxj4s1cja7nwqr5sqb3x";
+    sha256 = "006qkg661hzbc2gpcnpxm09bp1kbb98y0bgdr49bjlnapcmdgr1b";
   };
 
-  vendorSha256 = "1c099sn5rrvj805va1lyjlbv7i2g1z5bxyaisv5l9365z0lv1cwm";
+  vendorSha256 = "03az7l9rf2syw837zliny82xhkqlad16z0vfcg5h21m3bhz6v6jy";
 
   subPackages = [ "fly" ];
 
diff --git a/pkgs/development/tools/dapper/default.nix b/pkgs/development/tools/dapper/default.nix
index d5c7d309e98d..c2dadeb6a933 100644
--- a/pkgs/development/tools/dapper/default.nix
+++ b/pkgs/development/tools/dapper/default.nix
@@ -5,7 +5,7 @@
 
 buildGoPackage rec {
   pname = "dapper";
-  version = "0.4.1";
+  version = "0.5.1";
 
   goPackagePath = "github.com/rancher/dapper";
 
@@ -13,7 +13,7 @@ buildGoPackage rec {
     owner = "rancher";
     repo = "dapper";
     rev = "v${version}";
-    sha256 = "03rmkmlvhmfwcln5v1rqww1kirxm0d1p58h6pj8f5fnhk9spb162";
+    sha256 = "0sf56ii4sn2wdq5kiyl02sgvq0lvynzgiq8v5wrkkabj5107fiqw";
   };
    patchPhase = ''
      substituteInPlace main.go --replace 0.0.0 ${version}
diff --git a/pkgs/development/tools/delve/default.nix b/pkgs/development/tools/delve/default.nix
index 33eda13b6044..b990fe10b05c 100644
--- a/pkgs/development/tools/delve/default.nix
+++ b/pkgs/development/tools/delve/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "delve";
-  version = "1.2.0";
+  version = "1.4.1";
 
   goPackagePath = "github.com/go-delve/delve";
   excludedPackages = "\\(_fixtures\\|scripts\\|service/test\\)";
@@ -11,7 +11,7 @@ buildGoPackage rec {
     owner = "go-delve";
     repo = "delve";
     rev = "v${version}";
-    sha256 = "1xz1xm0lb1arwm3w2ydq5y5xglq60fc0q46x9xndr3i9j0rm8bxh";
+    sha256 = "007bc69r26w0sv6v9mbjdnmnkahpfk5998isx81ma7cinqdhi1cj";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/doctl/default.nix b/pkgs/development/tools/doctl/default.nix
index 5fe7ca69b036..e65fb4a64b73 100644
--- a/pkgs/development/tools/doctl/default.nix
+++ b/pkgs/development/tools/doctl/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "doctl";
-  version = "1.45.0";
+  version = "1.45.1";
 
   vendorSha256 = null;
 
@@ -30,7 +30,7 @@ buildGoModule rec {
     owner = "digitalocean";
     repo = "doctl";
     rev = "v${version}";
-    sha256 = "1wnrvswysms8p26d8hnxpimx12bhi3sa9k4kwd2dbxg74569gq6d";
+    sha256 = "1zzdjpbag23kr6j3c7zkgqaavlna1q792qhs6s234vxm85zmwh4j";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/tools/gauge/default.nix b/pkgs/development/tools/gauge/default.nix
index c9df63cabb78..c9a462f1832e 100644
--- a/pkgs/development/tools/gauge/default.nix
+++ b/pkgs/development/tools/gauge/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "gauge";
-  version = "1.0.4";
+  version = "1.1.1";
 
   goPackagePath = "github.com/getgauge/gauge";
   excludedPackages = ''\(build\|man\)'';
@@ -11,7 +11,7 @@ buildGoPackage rec {
     owner = "getgauge";
     repo = "gauge";
     rev = "v${version}";
-    sha256 = "1b52kpv5561pyjvqi8xmidarqp6lcyyy4sjsl4qjx4cr7hmk8kc7";
+    sha256 = "01x4838jljhhhcwfh6zbhy3g7l7nqvypv3g0ch9n2amsf2s16s3l";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/lazygit/default.nix b/pkgs/development/tools/lazygit/default.nix
index d08c9057c0fe..c3ae1eb30e87 100644
--- a/pkgs/development/tools/lazygit/default.nix
+++ b/pkgs/development/tools/lazygit/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "lazygit";
-  version = "0.20.3";
+  version = "0.20.4";
 
   goPackagePath = "github.com/jesseduffield/lazygit";
 
@@ -12,7 +12,7 @@ buildGoPackage rec {
     owner = "jesseduffield";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1p05lfm74g28ci5575vr22q5db50h19fcvc3lzddp0vyiw570isl";
+    sha256 = "134f04ybzgghm7ghyxair111aflmkjrbfj0bkxfp1w0a3jm6sfsk";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/misc/autogen/default.nix b/pkgs/development/tools/misc/autogen/default.nix
index 65c4f3174051..3e634bedfd19 100644
--- a/pkgs/development/tools/misc/autogen/default.nix
+++ b/pkgs/development/tools/misc/autogen/default.nix
@@ -1,34 +1,39 @@
-{ stdenv, buildPackages, fetchurl, which, pkgconfig, perl, guile, libxml2 }:
+{ stdenv, buildPackages, fetchurl, autoreconfHook, which, pkgconfig, perl, guile, libxml2 }:
 
 stdenv.mkDerivation rec {
   pname = "autogen";
-  version = "5.18.12";
+  version = "5.18.16";
 
   src = fetchurl {
     url = "mirror://gnu/autogen/rel${version}/autogen-${version}.tar.xz";
-    sha256 = "1n5zq4872sakvz9c7ncsdcfp0z8rsybsxvbmhkpbd19ii0pacfxy";
+    sha256 = "16mlbdys8q4ckxlvxyhwkdnh1ay9f6g0cyp1kylkpalgnik398gq";
   };
 
-  outputs = [ "bin" "dev" "lib" "out" "man" "info" ];
-
-  patches = [
-    # Temporary, so builds with a prefixed pkg-config (like cross builds) work.
-    #
-    # https://savannah.gnu.org/support/?109050 was supposed to fix this, but
-    # the generated configure script mysteriously still contained hard-coded
-    # pkg-config. I tried regenerating it, but that didn't help. Only
-    # https://git.savannah.gnu.org/cgit/autogen.git/commit/?h=5cbe233387d7f7b36752736338d1cd4f71287daa,
-    # in the next release, finally fixes this, by getting rid of some
-    # metaprogramming of the autoconf m4 metaprogram! There evidentally was
-    # some sort escaping error such that the `PKG_CONFIG` check got evaluated
-    # before `configure` was generated.
-    #
-    # Remove this when the version is bumped
-    ./pkg-config-use-var.patch
+  patches = let
+    dp = { ver ? "1%255.18.16-4", pname, name ? (pname + ".diff"), sha256 }: fetchurl {
+      url = "https://salsa.debian.org/debian/autogen/-/raw/debian/${ver}"
+          + "/debian/patches/${pname}.diff?inline=false";
+      inherit name sha256;
+    };
+  in [
+    (dp {
+      pname = "20_no_Werror";
+      sha256 = "08z4s2ifiqyaacjpd9pzr59w8m4j3548kkaq1bwvp2gjn29m680x";
+    })
+    (dp {
+      pname = "30_ag_macros.m4_syntax_error";
+      sha256 = "1z8vmbwbkz3505wd33i2xx91mlf8rwsa7klndq37nw821skxwyh3";
+    })
+    (dp {
+      pname = "31_allow_overriding_AGexe_for_crossbuild";
+      sha256 = "0h9wkc9bqb509knh8mymi43hg6n6sxg2lixvjlchcx7z0j7p8xkf";
+    })
   ];
 
+  outputs = [ "bin" "dev" "lib" "out" "man" "info" ];
+
   nativeBuildInputs = [
-    which pkgconfig perl
+    which pkgconfig perl autoreconfHook/*patches applied*/
   ] ++ stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     # autogen needs a build autogen when cross-compiling
     buildPackages.buildPackages.autogen buildPackages.texinfo
@@ -45,13 +50,7 @@ stdenv.mkDerivation rec {
     #"MAKEINFO=${buildPackages.texinfo}/bin/makeinfo"
   ];
 
-  postPatch = ''
-    # Fix a broken sed expression used for detecting the minor
-    # version of guile we are using
-    sed -i "s,sed '.*-I.*',sed 's/\\\(^\\\| \\\)-I/\\\1/g',g" configure
-
-    substituteInPlace pkg/libopts/mklibsrc.sh --replace /tmp $TMPDIR
-  '';
+  #doCheck = true; # not reliable
 
   postInstall = ''
     mkdir -p $dev/bin
@@ -62,9 +61,14 @@ stdenv.mkDerivation rec {
       sed -e "s|$bin/bin|/no-such-autogen-bin-path|" -i $f
       sed -e "s|$lib/lib|/no-such-autogen-lib-path|" -i $f
     done
-  '';
 
-  #doCheck = true; # 2 tests fail because of missing /dev/tty
+  '' + stdenv.lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
+    # remove /build/** from RPATHs
+    for f in "$bin"/bin/*; do
+      local nrp="$(patchelf --print-rpath "$f" | sed -E 's@(:|^)/build/[^:]*:@\1@g')"
+      patchelf --set-rpath "$nrp" "$f"
+    done
+  '';
 
   meta = with stdenv.lib; {
     description = "Automated text and program generation tool";
diff --git a/pkgs/development/tools/misc/autogen/pkg-config-use-var.patch b/pkgs/development/tools/misc/autogen/pkg-config-use-var.patch
deleted file mode 100644
index 69476f62c6db..000000000000
--- a/pkgs/development/tools/misc/autogen/pkg-config-use-var.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/configure b/configure
-index c3f761d1c3f..14b101f67c1
---- a/configure
-+++ b/configure
-@@ -16683,7 +16683,7 @@ fi
- 
- 
- 
--  ag_gv=`gdir=\`pkg-config --cflags-only-I \
-+  ag_gv=`gdir=\`${PKG_CONFIG} --cflags-only-I \
-   guile-${GUILE_EFFECTIVE_VERSION} | \
-   sed 's/\(^\| \)-I/\1/g'\`
-   for d in $gdir
diff --git a/pkgs/development/tools/misc/circleci-cli/default.nix b/pkgs/development/tools/misc/circleci-cli/default.nix
index 7144c2bd0ae5..8c87e1642df3 100644
--- a/pkgs/development/tools/misc/circleci-cli/default.nix
+++ b/pkgs/development/tools/misc/circleci-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "circleci-cli";
-  version = "0.1.7868";
+  version = "0.1.7971";
 
   src = fetchFromGitHub {
     owner = "CircleCI-Public";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1a9gnqrkvifrwr8wpv5f6zv8xs8myzbzlhn5w72xxzh2gxdaflwg";
+    sha256 = "0nrmdql3h9jnfgmp8898c9v07f5h5r9dvabaqhk98r6a77g3rr98";
   };
 
   vendorSha256 = "0y35ps2pw9z7gi4z50byd1py87bf2jdvj7l7w2gxpppmhi83myc9";
diff --git a/pkgs/development/tools/misc/gdb/default.nix b/pkgs/development/tools/misc/gdb/default.nix
index f6a001e488c3..7702df423bb5 100644
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@@ -18,7 +18,7 @@
 
 let
   basename = "gdb-${version}";
-  version = "9.1";
+  version = "9.2";
 in
 
 assert pythonSupport -> python3 != null;
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnu/gdb/${basename}.tar.xz";
-    sha256 = "0dqp1p7w836iwijg1zb4a784n0j4pyjiw5v6h8fg5lpx6b40x7k9";
+    sha256 = "0mf5fn8v937qwnal4ykn3ji1y2sxk0fa1yfqi679hxmpg6pdf31n";
   };
 
   postPatch = if stdenv.isDarwin then ''
diff --git a/pkgs/development/tools/misc/libtool/libtool2.nix b/pkgs/development/tools/misc/libtool/libtool2.nix
index 4bf637c0eba8..fbe49dc68b2a 100644
--- a/pkgs/development/tools/misc/libtool/libtool2.nix
+++ b/pkgs/development/tools/misc/libtool/libtool2.nix
@@ -26,10 +26,6 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  # Don't run the native `strip' when cross-compiling.  This breaks at least
-  # with `.a' files for MinGW.
-  dontStrip = stdenv.hostPlatform != stdenv.buildPlatform;
-
   meta = with stdenv.lib; {
     description = "GNU Libtool, a generic library support script";
     longDescription = ''
diff --git a/pkgs/development/tools/misc/pkgconf/default.nix b/pkgs/development/tools/misc/pkgconf/default.nix
index 153257c85ae1..6fca02ad788b 100644
--- a/pkgs/development/tools/misc/pkgconf/default.nix
+++ b/pkgs/development/tools/misc/pkgconf/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "pkgconf";
-  version = "1.7.0";
+  version = "1.7.3";
 
   nativeBuildInputs = [ removeReferencesTo ];
 
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://distfiles.dereferenced.org/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0sb1a2lgiqaninv5s3zq09ilrkpsamcl68dyhqyz7yi9vsgb0vhy";
+    sha256 = "1h7rf5cch0cbxp8nmjkkf272zrz2jgpqpr8a58ww75pn3jjswimq";
   };
 
   # Debian has outputs like these too:
diff --git a/pkgs/development/tools/ocaml/js_of_ocaml/3.0.nix b/pkgs/development/tools/ocaml/js_of_ocaml/3.0.nix
deleted file mode 100644
index 9ca6ca67421f..000000000000
--- a/pkgs/development/tools/ocaml/js_of_ocaml/3.0.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ stdenv, ocaml, findlib, dune, js_of_ocaml-compiler
-, ocaml-migrate-parsetree, ppx_tools_versioned, uchar
-}:
-
-stdenv.mkDerivation {
-  pname = "js_of_ocaml"; 
-
-  inherit (js_of_ocaml-compiler) version src installPhase meta;
-
-  buildInputs = [ findlib ocaml-migrate-parsetree ppx_tools_versioned ];
-  nativeBuildInputs = [ ocaml findlib dune ];
-
-  postPatch = "patchShebangs lib/generate_stubs.sh";
-
-	propagatedBuildInputs = [ js_of_ocaml-compiler uchar ];
-
-	buildPhase = "dune build -p js_of_ocaml";
-}
diff --git a/pkgs/development/tools/ocaml/js_of_ocaml/default.nix b/pkgs/development/tools/ocaml/js_of_ocaml/default.nix
index 7f6426c9610d..9ca6ca67421f 100644
--- a/pkgs/development/tools/ocaml/js_of_ocaml/default.nix
+++ b/pkgs/development/tools/ocaml/js_of_ocaml/default.nix
@@ -1,40 +1,18 @@
-{ stdenv, fetchurl, ocaml, findlib, lwt, menhir, ocsigen_deriving, ppx_deriving, camlp4, ocamlbuild
-, cmdliner, tyxml, reactivedata, cppo, which, base64, uchar, yojson
+{ stdenv, ocaml, findlib, dune, js_of_ocaml-compiler
+, ocaml-migrate-parsetree, ppx_tools_versioned, uchar
 }:
 
-let version = if stdenv.lib.versionAtLeast ocaml.version "4.02"
-  then "2.8.4" else "2.7";
-in
-
 stdenv.mkDerivation {
-  pname = "js_of_ocaml";
-  inherit version;
-  src = fetchurl {
-    url = "https://github.com/ocsigen/js_of_ocaml/archive/${version}.tar.gz";
-    sha256 = {
-      "2.7" = "1dali1akyd4zmkwav0d957ynxq2jj6cc94r4xiaql7ca89ajz4jj";
-      "2.8.4" = "098ph50s9kqw6rc3qjn39zv9b5swdf4qr44afwqfkkjgjs5d7vbl";
-    }.${version};
-  };
+  pname = "js_of_ocaml"; 
+
+  inherit (js_of_ocaml-compiler) version src installPhase meta;
 
-  buildInputs = [ ocaml findlib menhir ocsigen_deriving ocamlbuild
-                 cmdliner reactivedata cppo which base64 ]
-  ++ stdenv.lib.optionals (stdenv.lib.versionAtLeast ocaml.version "4.02") [ yojson tyxml ];
-  propagatedBuildInputs = [ lwt camlp4 ppx_deriving ]
-  ++ stdenv.lib.optional (version == "2.8.4") uchar;
+  buildInputs = [ findlib ocaml-migrate-parsetree ppx_tools_versioned ];
+  nativeBuildInputs = [ ocaml findlib dune ];
 
-  patches = [ ./Makefile.conf.diff ];
+  postPatch = "patchShebangs lib/generate_stubs.sh";
 
-  createFindlibDestdir = true;
+	propagatedBuildInputs = [ js_of_ocaml-compiler uchar ];
 
-  meta = with stdenv.lib; {
-    homepage = "http://ocsigen.org/js_of_ocaml/";
-    description = "Compiler of OCaml bytecode to Javascript. It makes it possible to run Ocaml programs in a Web browser";
-    license = licenses.lgpl2;
-    platforms = ocaml.meta.platforms or [];
-    maintainers = [
-      maintainers.gal_bolle
-    ];
-    broken = versionAtLeast ocaml.version "4.05";
-  };
+	buildPhase = "dune build -p js_of_ocaml";
 }
diff --git a/pkgs/development/tools/ocaml/merlin/default.nix b/pkgs/development/tools/ocaml/merlin/default.nix
index fa78e47951f3..4b11dd13983d 100644
--- a/pkgs/development/tools/ocaml/merlin/default.nix
+++ b/pkgs/development/tools/ocaml/merlin/default.nix
@@ -2,13 +2,13 @@
 
 buildDunePackage rec {
   pname = "merlin";
-  version = "3.3.4";
+  version = "3.3.6";
 
   minimumOCamlVersion = "4.02.1";
 
   src = fetchurl {
     url = "https://github.com/ocaml/merlin/releases/download/v${version}/merlin-v${version}.tbz";
-    sha256 = "12wxric6n3rmsn0w16xm8vjd8p5aw24cj76zw2x87qfwwgmy1kdd";
+    sha256 = "1360cm0jkn2v2y5p3yzdyw9661a1vpddcibkbfblmk95qafx4civ";
   };
 
   buildInputs = [ yojson ];
diff --git a/pkgs/development/tools/rust/rust-analyzer/generic.nix b/pkgs/development/tools/rust/rust-analyzer/generic.nix
index de755ec17ff5..ae6ad80cdd9a 100644
--- a/pkgs/development/tools/rust/rust-analyzer/generic.nix
+++ b/pkgs/development/tools/rust/rust-analyzer/generic.nix
@@ -15,9 +15,7 @@ rustPlatform.buildRustPackage {
     inherit rev sha256;
   };
 
-  preBuild = "pushd crates/rust-analyzer";
-  # Do not checking other crates in checkPhase.
-  preInstall = "popd";
+  buildAndTestSubdir = "crates/rust-analyzer";
 
   cargoBuildFlags = lib.optional useJemalloc "--features=jemalloc";
 
diff --git a/pkgs/development/tools/skaffold/default.nix b/pkgs/development/tools/skaffold/default.nix
index 2d87c490452b..e104784fbe8f 100644
--- a/pkgs/development/tools/skaffold/default.nix
+++ b/pkgs/development/tools/skaffold/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "skaffold";
-  version = "1.10.1";
+  version = "1.11.0";
   # rev is the ${version} commit, mainly for skaffold version command output
   rev = "931a70a6334436735bfc4ff7633232dd5fc73cc1";
 
@@ -20,7 +20,7 @@ buildGoPackage rec {
     owner = "GoogleContainerTools";
     repo = "skaffold";
     rev = "v${version}";
-    sha256 = "1qi4b0304jjpv5npa5yfrrfg7yv5p838qqql3sgx4f47ysyyq0as";
+    sha256 = "035xp34m8kzb75mivgf3kw026n2h6g2a7j2mi32nxl1a794w36zi";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/development/web/cypress/default.nix b/pkgs/development/web/cypress/default.nix
index 9c8c14bab651..3b38d86b45b4 100644
--- a/pkgs/development/web/cypress/default.nix
+++ b/pkgs/development/web/cypress/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cypress";
-  version = "4.5.0";
+  version = "4.8.0";
 
   src = fetchzip {
     url = "https://cdn.cypress.io/desktop/${version}/linux-x64/cypress.zip";
-    sha256 = "0pr9b36s63xplmyjgjdifw5pgas7bxwbnsckjix7djyln0j5ja3q";
+    sha256 = "0wivvh3fhyhxx9f6vp0kgqkjj4957hj0b15r2igbxnyqvahwxgx7";
   };
 
   # don't remove runtime deps
diff --git a/pkgs/games/steam/runtime.nix b/pkgs/games/steam/runtime.nix
index 44d80c0d7948..6d81d6c775e2 100644
--- a/pkgs/games/steam/runtime.nix
+++ b/pkgs/games/steam/runtime.nix
@@ -1,4 +1,4 @@
-{ stdenv, steamArch, fetchurl, }:
+{ stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
 
@@ -6,20 +6,15 @@ stdenv.mkDerivation rec {
   # from https://repo.steampowered.com/steamrt-images-scout/snapshots/
   version = "0.20200417.0";
 
-  src =
-    if steamArch == "amd64" then fetchurl {
-      url = "https://repo.steampowered.com/steamrt-images-scout/snapshots/${version}/com.valvesoftware.SteamRuntime.Platform-amd64,i386-scout-runtime.tar.gz";
-      sha256 = "0kps8i5v23sycqm69xz389n8k831jd7ncsmlrkky7nib2q91rbvj";
-      name = "scout-runtime-${version}.tar.gz";
-    } else fetchurl {
-      url = "https://repo.steampowered.com/steamrt-images-scout/snapshots/${version}/com.valvesoftware.SteamRuntime.Platform-i386-scout-runtime.tar.gz";
-      sha256 = "03fhac1r25xf7ia2pd35wjw360v5pa9h4870yrhhygp9h7v4klzf";
-      name = "scout-runtime-i386-${version}.tar.gz";
-    };
+  src = fetchurl {
+    url = "https://repo.steampowered.com/steamrt-images-scout/snapshots/${version}/steam-runtime.tar.xz";
+    sha256 = "0d4dfl6i31i8187wj8rr9yvmrg32bx96bsgs2ya21b00czf070sy";
+    name = "scout-runtime-${version}.tar.gz";
+  };
 
   buildCommand = ''
     mkdir -p $out
-    tar -C $out -x --strip=1 -f $src files/
+    tar -C $out --strip=1 -x -f $src
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/misc/ghostscript/0001-Bug-702364-Fix-missing-echogs-dependencies.patch b/pkgs/misc/ghostscript/0001-Bug-702364-Fix-missing-echogs-dependencies.patch
index c914634f579c..dd31260302c6 100644
--- a/pkgs/misc/ghostscript/0001-Bug-702364-Fix-missing-echogs-dependencies.patch
+++ b/pkgs/misc/ghostscript/0001-Bug-702364-Fix-missing-echogs-dependencies.patch
@@ -1,18 +1,5 @@
-From 9f56e78d111d726ca95a59b2d64e5c3298451505 Mon Sep 17 00:00:00 2001
-From: Chris Liddell <chris.liddell@artifex.com>
-Date: Mon, 27 Apr 2020 11:04:57 +0100
-Subject: [PATCH] Bug 702364: Fix missing echogs dependencies
-
-Rebased version of http://git.ghostscript.com/?p=ghostpdl.git;a=patch;h=1b4c3669a20c
-to fix parallel build
----
- contrib/contrib.mak | 281 ++++++++++++++++++++++----------------------
- 1 file changed, 143 insertions(+), 138 deletions(-)
-
-diff --git a/contrib/contrib.mak b/contrib/contrib.mak
-index 5411ae902..7dd9822a9 100644
---- a/contrib/contrib.mak
-+++ b/contrib/contrib.mak
+--- a/contrib/contrib.mak	2020-03-19 09:21:42.000000000 +0100
++++ b/contrib/contrib.mak	2020-05-14 13:41:03.202258445 +0200
 @@ -22,6 +22,10 @@
  CONTRIB_MAK=$(CONTRIBDIR)$(D)contrib.mak $(TOP_MAKEFILES)
  CONTRIBSRC=$(CONTRIBDIR)$(D)
@@ -24,7 +11,7 @@ index 5411ae902..7dd9822a9 100644
  ###### --------------------------- Catalog -------------------------- ######
  
  # The following drivers are user-contributed, and maintained (if at all) by
-@@ -161,19 +165,19 @@ $(DEVOBJ)gdevbjca.$(OBJ) : $(CONTRIBSRC)gdevbjca.c $(PDEVH) $(bjc_h) \
+@@ -185,19 +189,19 @@
  	$(DEVCC) $(DEVO_)gdevbjca.$(OBJ) $(C_) $(CONTRIBSRC)gdevbjca.c
  
  $(DD)bjcmono.dev : $(bjc_) $(DD)page.dev \
@@ -48,7 +35,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)bjccolor $(bjc_)
  
  
-@@ -184,25 +188,25 @@ cdeskjet8_=$(DEVOBJ)gdevcd8.$(OBJ) $(HPPCL)
+@@ -208,25 +212,25 @@
  # Author: Uli Wortmann (uliw@erdw.ethz.ch), Martin Gerbershagen (ger@ulm.temic.de)
  # Printer: HP 670
  $(DD)cdj670.dev : $(cdeskjet8_) $(DD)page.dev \
@@ -78,7 +65,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV2) $(DD)cdj1600 $(cdeskjet8_)
  
  $(DEVOBJ)gdevcd8.$(OBJ) : $(CONTRIBSRC)gdevcd8.c $(PDEVH) $(math__h)\
-@@ -220,7 +224,8 @@ $(DEVOBJ)gdevcd8.$(OBJ) : $(CONTRIBSRC)gdevcd8.c $(PDEVH) $(math__h)\
+@@ -244,7 +248,8 @@
  
  # Author: Matthew Gelhaus (mgelhaus@proaxis.com)
  # Printer: HP 880c
@@ -88,7 +75,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV2) $(DD)cdj880 $(cdeskjet8_)
  
  
-@@ -231,7 +236,7 @@ cdeskjet9_=$(DEVOBJ)gdevdj9.$(OBJ) $(HPPCL)
+@@ -255,7 +260,7 @@
  # Author: Rene Harsch (rene@harsch.net)
  # Printer: HP 970Cxi
  $(DD)cdj970.dev : $(cdeskjet9_) $(DD)page.dev \
@@ -97,7 +84,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV2) $(DD)cdj970 $(cdeskjet9_)
  
  $(DEVOBJ)gdevdj9.$(OBJ) : $(CONTRIBSRC)gdevdj9.c $(PDEVH) $(math__h) $(string__h)\
-@@ -244,7 +249,7 @@ $(DEVOBJ)gdevdj9.$(OBJ) : $(CONTRIBSRC)gdevdj9.c $(PDEVH) $(math__h) $(string__h
+@@ -268,7 +273,7 @@
  ### NOTE:  Same as chp2200 (some PJL and CRD changes).
  
  $(DD)cdnj500.dev : $(cdeskjet8_) $(DD)page.dev \
@@ -106,7 +93,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV2) $(DD)cdnj500 $(cdeskjet8_)
  
  
-@@ -253,7 +258,7 @@ $(DD)cdnj500.dev : $(cdeskjet8_) $(DD)page.dev \
+@@ -277,7 +282,7 @@
  ### NOTE:  Depends on the presence of the cdj850 section.
  
  $(DD)chp2200.dev : $(cdeskjet8_) $(DD)page.dev \
@@ -115,7 +102,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV2) $(DD)chp2200 $(cdeskjet8_)
  
  
-@@ -264,11 +269,11 @@ $(DD)chp2200.dev : $(cdeskjet8_) $(DD)page.dev \
+@@ -288,11 +293,11 @@
  GDIMONO=$(DEVOBJ)gdevgdi.$(OBJ) $(HPPCL)
  
  $(DD)gdi.dev : $(GDIMONO) $(DD)page.dev \
@@ -129,7 +116,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)samsunggdi $(GDIMONO)
  
  $(DEVOBJ)gdevgdi.$(OBJ) : $(CONTRIBSRC)gdevgdi.c $(PDEVH) $(gdevpcl_h) \
-@@ -282,17 +287,17 @@ $(DEVOBJ)gdevgdi.$(OBJ) : $(CONTRIBSRC)gdevgdi.c $(PDEVH) $(gdevpcl_h) \
+@@ -306,17 +311,17 @@
  
  hl1250_=$(DEVOBJ)gdevhl12.$(OBJ) $(HPDLJM)
  $(DD)hl1250.dev : $(hl1250_) $(DD)page.dev \
@@ -150,7 +137,7 @@ index 5411ae902..7dd9822a9 100644
  	$(DEVCC) $(DEVO_)gdevhl12.$(OBJ) $(C_) $(CONTRIBSRC)gdevhl12.c
  
  
-@@ -303,37 +308,37 @@ ln03_=$(DEVOBJ)gdevln03.$(OBJ)
+@@ -327,37 +332,37 @@
  # Author: Ulrich Mueller (ulm@vsnhd1.cern.ch)
  # Printer: DEC LN03
  $(DD)ln03.dev : $(ln03_) $(DD)page.dev \
@@ -194,7 +181,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)la75plus $(ln03_)
  
  $(DEVOBJ)gdevln03.$(OBJ) : $(CONTRIBSRC)gdevln03.c $(PDEVH) \
-@@ -356,27 +361,27 @@ $(DEVOBJ)gdevescv.$(OBJ) : $(ESCV_SRC)gdevescv.c $(ESCV_SRC)gdevescv.h $(PDEVH)
+@@ -380,233 +385,233 @@
  	$(DEVCC) -DA4 $(DEVO_)gdevescv.$(OBJ) $(C_) $(escv_opts) $(ESCV_SRC)gdevescv.c
  
  $(DD)alc1900.dev : $(escv_) $(DD)page.dev \
@@ -228,7 +215,8 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)alc8600 $(escv_)
  
  $(DD)alc9100.dev : $(escv_) $(DD)page.dev \
-@@ -384,11 +389,11 @@ $(DD)alc9100.dev : $(escv_) $(DD)page.dev \
+-                           $(CONTRIB_MAK) $(MAKEDIRS)
++                           $(CONTDEV) $(CONTRIB_MAK) $(MAKEDIRS)
  	$(SETPDEV) $(DD)alc9100 $(escv_)
  
  $(DD)lp3000c.dev : $(escv_) $(DD)page.dev \
@@ -242,7 +230,8 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)lp8000c $(escv_)
  
  $(DD)lp8200c.dev : $(escv_) $(DD)page.dev \
-@@ -396,15 +401,15 @@ $(DD)lp8200c.dev : $(escv_) $(DD)page.dev \
+-                           $(CONTRIB_MAK) $(MAKEDIRS)
++                           $(CONTDEV) $(CONTRIB_MAK) $(MAKEDIRS)
  	$(SETPDEV) $(DD)lp8200c $(escv_)
  
  $(DD)lp8300c.dev : $(escv_) $(DD)page.dev \
@@ -261,7 +250,8 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)lp8800c $(escv_)
  
  $(DD)lp9000c.dev : $(escv_) $(DD)page.dev \
-@@ -412,177 +417,177 @@ $(DD)lp9000c.dev : $(escv_) $(DD)page.dev \
+-                           $(CONTRIB_MAK) $(MAKEDIRS)
++                           $(CONTDEV) $(CONTRIB_MAK) $(MAKEDIRS)
  	$(SETPDEV) $(DD)lp9000c $(escv_)
  
  $(DD)lp9200c.dev : $(escv_) $(DD)page.dev \
@@ -481,7 +471,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)lex2050 $(lex2050_)
  
  $(DEVOBJ)gdevlx7.$(OBJ) : $(CONTRIBSRC)gdevlx7.c $(PDEVH) \
-@@ -599,7 +604,7 @@ $(DEVOBJ)gdevlx32.$(OBJ) : $(CONTRIBSRC)gdevlx32.c $(PDEVH) $(gsparam_h) \
+@@ -623,7 +628,7 @@
  	$(DEVCC) $(DEVO_)gdevlx32.$(OBJ) $(C_) $(CONTRIBSRC)gdevlx32.c
  
  $(DD)lxm3200.dev : $(lxm3200_) $(DD)page.dev \
@@ -490,7 +480,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)lxm3200 $(lxm3200_)
  
  
-@@ -625,13 +630,13 @@ $(DEVOBJ)gdevlips.$(OBJ) : $(GX) $(LIPS_SRC)gdevlips.c $(std_h) \
+@@ -649,13 +654,13 @@
  	$(DEVCC) $(DEVO_)gdevlips.$(OBJ) $(LIPS_OPT) $(C_) $(LIPS_SRC)gdevlips.c
  
  $(DD)lips4.dev : $(lipsr_) $(DD)page.dev \
@@ -506,7 +496,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETDEV) $(DD)lips4v $(lipsv_)
  	$(ADDMOD) $(DD)lips4v -include $(GLD)vector
  
-@@ -644,11 +649,11 @@ $(DEVOBJ)gdevl4v.$(OBJ) : $(LIPS_SRC)gdevl4v.c $(LIPS_SRC)gdevlips.h $(GDEV)\
+@@ -668,11 +673,11 @@
  ### --------------- Some extra devices: lips2p, bjc880j ---------------- ###
  
  $(DD)lips2p.dev : $(lipsr_) $(DD)page.dev \
@@ -520,7 +510,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)bjc880j $(lipsr_)
  
  
-@@ -657,15 +662,15 @@ $(DD)bjc880j.dev : $(lipsr_) $(DD)page.dev \
+@@ -681,15 +686,15 @@
  md2k_=$(DEVOBJ)gdevmd2k.$(OBJ)
  
  $(DD)md2k.dev : $(md2k_) $(DD)page.dev \
@@ -539,7 +529,7 @@ index 5411ae902..7dd9822a9 100644
  	$(DEVCC) $(DEVO_)gdevmd2k.$(OBJ) $(C_) $(CONTRIBSRC)gdevmd2k.c
   
  
-@@ -673,7 +678,7 @@ $(DEVOBJ)gdevmd2k.$(OBJ) : $(CONTRIBSRC)gdevmd2k.c $(PDEVH) $(gsparam_h) \
+@@ -697,7 +702,7 @@
  
  oki4w_=$(DEVOBJ)gdevop4w.$(OBJ)
  $(DD)oki4w.dev : $(oki4w_) $(DD)page.dev \
@@ -548,7 +538,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)oki4w $(oki4w_)
  
  # Author: Ivan Schreter (ivan@shadow.sk)
-@@ -696,11 +701,11 @@ $(DEVOBJ)gdevopvp.$(OBJ) : $(OPVP_SRC)gdevopvp.c $(OPVP_SRC)opvp_common.h\
+@@ -720,11 +725,11 @@
  	$(DEVCC) $(DEVO_)gdevopvp.$(OBJ) $(OPVP_OPT) $(C_) $(OPVP_SRC)gdevopvp.c
  
  $(DD)opvp.dev : $(opvp_) $(DD)page.dev \
@@ -562,7 +552,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)oprp $(opvp_)
  
  
-@@ -877,78 +882,78 @@ $(DEVOBJ)pclcomp.$(OBJ) : $(pcl3_src)pclcomp.c $(pcl3_src)pclgen.h \
+@@ -901,78 +906,78 @@
  
  # The generic pcl3 device with selectable subdevices
  $(DD)pcl3.dev : $(pcl3_) $(DD)page.dev \
@@ -665,7 +655,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)hpdj1120c $(pcl3_)
  
  #------------------------------------------------------------------------------
-@@ -985,7 +990,7 @@ pcl3-install:
+@@ -1009,7 +1014,7 @@
  
  xes_=$(DEVOBJ)gdevxes.$(OBJ)
  $(DD)xes.dev : $(xes_) $(DD)page.dev \
@@ -674,7 +664,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)xes $(xes_)
  
  # Author: Peter Flass (flass@lbdrscs.bitnet)
-@@ -1005,16 +1010,16 @@ JAPSRC=$(JAPDIR)$(D)
+@@ -1029,16 +1034,16 @@
  
  pr201_=$(DEVOBJ)gdevp201.$(OBJ) $(DEVOBJ)gdevprn.$(OBJ)
  
@@ -695,7 +685,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)pr1000_4 $(pr201_)
  
  $(DEVOBJ)gdevp201.$(OBJ) : $(JAPSRC)gdevp201.c $(PDEVH) \
-@@ -1025,7 +1030,7 @@ $(DEVOBJ)gdevp201.$(OBJ) : $(JAPSRC)gdevp201.c $(PDEVH) \
+@@ -1049,7 +1054,7 @@
  
  jj100_=$(DEVOBJ)gdevj100.$(OBJ) $(DEVOBJ)gdevprn.$(OBJ)
  
@@ -704,7 +694,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)jj100 $(jj100_)
  
  $(DEVOBJ)gdevj100.$(OBJ) : $(JAPSRC)gdevj100.c $(PDEVH) \
-@@ -1037,11 +1042,11 @@ $(DEVOBJ)gdevj100.$(OBJ) : $(JAPSRC)gdevj100.c $(PDEVH) \
+@@ -1061,11 +1066,11 @@
  bj10v_=$(DEVOBJ)gdev10v.$(OBJ) $(DEVOBJ)gdevprn.$(OBJ)
  
  $(DD)bj10v.dev : $(bj10v_) \
@@ -718,7 +708,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)bj10vh $(bj10v_)
  
  # Uncomment the following line if you are using MS-DOS on PC9801 series.
-@@ -1056,7 +1061,7 @@ $(DEVOBJ)gdev10v.$(OBJ) : $(JAPSRC)gdev10v.c $(PDEVH) \
+@@ -1080,7 +1085,7 @@
  dmprt_=$(DEVOBJ)gdevdmpr.$(OBJ) $(DEVOBJ)dviprlib.$(OBJ) $(DEVOBJ)gdevprn.$(OBJ)
  
  $(DD)dmprt.dev : $(dmprt_) $(DD)page.dev \
@@ -727,7 +717,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETDEV) $(DD)dmprt $(dmprt_)
  	$(ADDMOD) $(DD)dmprt -ps dmp_init
  
-@@ -1086,19 +1091,19 @@ $(DEVOBJ)gdevmjc.$(OBJ) : $(JAPSRC)gdevmjc.c $(JAPSRC)gdevmjc.h $(PDEVH) $(gdevp
+@@ -1110,19 +1115,19 @@
  	$(DEVCC) -DA4 $(DEVO_)gdevmjc.$(OBJ) $(C_) $(JAPSRC)gdevmjc.c
  
  $(DD)mj700v2c.dev : $(mj700v2c_) $(DD)page.dev \
@@ -751,7 +741,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)mj8000c $(mj700v2c_)
  
  ### ----------------- The Fujitsu FMPR printer device ----------------- ###
-@@ -1106,7 +1111,7 @@ $(DD)mj8000c.dev : $(mj700v2c_) $(DD)page.dev \
+@@ -1130,7 +1135,7 @@
  fmpr_=$(DEVOBJ)gdevfmpr.$(OBJ) $(DEVOBJ)gdevprn.$(OBJ)
  
  $(DD)fmpr.dev : $(fmpr_) $(DD)page.dev \
@@ -760,7 +750,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)fmpr $(fmpr_)
  
  $(DEVOBJ)gdevfmpr.$(OBJ) : $(JAPSRC)gdevfmpr.c $(PDEVH) \
-@@ -1118,7 +1123,7 @@ $(DEVOBJ)gdevfmpr.$(OBJ) : $(JAPSRC)gdevfmpr.c $(PDEVH) \
+@@ -1142,7 +1147,7 @@
  fmlbp_=$(DEVOBJ)gdevfmlbp.$(OBJ) $(DEVOBJ)gdevprn.$(OBJ)
  
  $(DD)fmlbp.dev : $(fmlbp_) $(DD)page.dev \
@@ -769,7 +759,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)fmlbp $(fmlbp_)
  
  $(DEVOBJ)gdevfmlbp.$(OBJ) : $(JAPSRC)gdevfmlbp.c $(PDEVH) \
-@@ -1135,7 +1140,7 @@ $(DEVOBJ)gdevfmlbp.$(OBJ) : $(JAPSRC)gdevfmlbp.c $(PDEVH) \
+@@ -1159,7 +1164,7 @@
  ml6_=$(DEVOBJ)gdevml6.$(OBJ) $(DEVOBJ)gdevprn.$(OBJ)
  
  $(DD)ml600.dev : $(ml6_) $(DD)page.dev \
@@ -778,7 +768,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)ml600 $(ml6_)
  
  $(DEVOBJ)gdevml6.$(OBJ) : $(JAPSRC)gdevml6.c $(PDEVH) \
-@@ -1148,11 +1153,11 @@ $(DEVOBJ)gdevml6.$(OBJ) : $(JAPSRC)gdevml6.c $(PDEVH) \
+@@ -1172,11 +1177,11 @@
  lbp3x0_=$(DEVOBJ)gdevlbp3.$(OBJ)
  
  $(DD)lbp310.dev :$(lbp3x0_) $(DD)page.dev \
@@ -792,7 +782,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)lbp320 $(lbp3x0_)
  
  $(DEVOBJ)gdevlbp3.$(OBJ) : $(JAPSRC)gdevlbp3.c $(PDEVH)
-@@ -1167,7 +1172,7 @@ $(DEVOBJ)gdevnpdl.$(OBJ) : $(JAPSRC)gdevnpdl.c $(LIPS_SRC)gdevlprn.h $(PDEVH) \
+@@ -1191,7 +1196,7 @@
  	$(DEVCC) -DA4 $(DEVO_)gdevnpdl.$(OBJ) $(LIPS_OPT) $(C_) $(JAPSRC)gdevnpdl.c
  
  $(DD)npdl.dev : $(npdl_) $(DD)page.dev \
@@ -801,7 +791,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)npdl $(npdl_)
  
  ### ------- EPSON ESC/Page printer device ----------------- ###
-@@ -1179,11 +1184,11 @@ $(DEVOBJ)gdevespg.$(OBJ) : $(JAPSRC)gdevespg.c $(LIPS_SRC)gdevlprn.h $(PDEVH) \
+@@ -1203,11 +1208,11 @@
  	$(DEVCC) -DA4 $(DEVO_)gdevespg.$(OBJ) $(LIPS_OPT) $(C_) $(JAPSRC)gdevespg.c
  
  $(DD)escpage.dev : $(escpage_) $(DD)page.dev \
@@ -815,7 +805,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)lp2000 $(escpage_)
  
  ### --- The RICOH RPDL language printer device ------ ###
-@@ -1194,7 +1199,7 @@ $(DEVOBJ)gdevrpdl.$(OBJ) : $(JAPSRC)gdevrpdl.c $(LIPS_SRC)gdevlprn.h $(PDEVH) \
+@@ -1218,7 +1223,7 @@
  	$(DEVCC) $(DEVO_)gdevrpdl.$(OBJ) $(LIPS_OPT) $(C_) $(JAPSRC)gdevrpdl.c
  
  $(DD)rpdl.dev : $(rpdl_) $(DD)page.dev \
@@ -824,21 +814,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)rpdl $(rpdl_)
  
  ### ---------- RICOH RPDL IV(600dpi) printer devices ---------- ###
-@@ -1204,11 +1209,11 @@ $(DD)rpdl.dev : $(rpdl_) $(DD)page.dev \
- #	$(DEVCC) $(DEVO_)gdevrpdl.$(OBJ) $(C_) $(JAPSRC)gdevrpdl.c
- #
- #$(DD)nx100f.dev : $(rpdl_) $(DD)page.dev \
--                           $(CONTRIB_MAK) $(MAKEDIRS)
-+                           $(CONTDEV) $(CONTRIB_MAK) $(MAKEDIRS)
- #	$(SETPDEV2) $(DD)nx100f $(rpdl_)
- #
- #$(DD)nx100v.dev : $(rpdl_) $(DD)page.dev \
--                           $(CONTRIB_MAK) $(MAKEDIRS)
-+                           $(CONTDEV) $(CONTRIB_MAK) $(MAKEDIRS)
- #	$(SETPDEV2) $(DD)nx100v $(rpdl_)
- 
- ### ------------ The ALPS Micro Dry printer devices ------------ ###
-@@ -1216,15 +1221,15 @@ $(DD)rpdl.dev : $(rpdl_) $(DD)page.dev \
+@@ -1240,15 +1245,15 @@
  alps_=$(DEVOBJ)gdevalps.$(OBJ)
  
  $(DD)md50Mono.dev : $(alps_) $(DD)page.dev \
@@ -857,6 +833,3 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)md1xMono $(alps_)
  
  $(DEVOBJ)gdevalps.$(OBJ) : $(JAPSRC)gdevalps.c $(PDEVH) \
--- 
-2.26.2
-
diff --git a/pkgs/misc/ghostscript/default.nix b/pkgs/misc/ghostscript/default.nix
index 7f6766cf4624..a10595591875 100644
--- a/pkgs/misc/ghostscript/default.nix
+++ b/pkgs/misc/ghostscript/default.nix
@@ -10,8 +10,8 @@ assert cupsSupport -> cups != null;
 
 let
   version = "9.${ver_min}";
-  ver_min = "50";
-  sha512 = "3p46kzn6kh7z4qqnqydmmvdlgzy5730z3yyvyxv6i4yb22mgihzrwqmhmvfn3b7lypwf6fdkkndarzv7ly3zndqpyvg89x436sms7iw";
+  ver_min = "52";
+  sha512 = "1ksm3v4nw8acc4j817n44l1c65ijk0mr3mp4kryy17jz41bmzzql5d8vr40h59n9dmf8b2wmnbq45bj3an1zrpfagavlf0i9s436jjc";
 
   fonts = stdenv.mkDerivation {
     name = "ghostscript-fonts";
@@ -47,11 +47,6 @@ stdenv.mkDerivation rec {
   patches = [
     ./urw-font-files.patch
     ./doc-no-ref.diff
-    (fetchpatch {
-      name = "CVE-2019-14869.patch";
-      url = "https://git.ghostscript.com/?p=ghostpdl.git;a=patch;h=485904772c5f0aa1140032746e5a0abfc40f4cef";
-      sha256 = "0z5gnvgpp0dlzgvpw9a1yan7qyycv3mf88l93fvb1kyay893rshp";
-    })
     # rebased version of upstream http://git.ghostscript.com/?p=ghostpdl.git;a=patch;h=1b4c3669a20c,
     # Remove on update to version > 9.52
     ./0001-Bug-702364-Fix-missing-echogs-dependencies.patch
diff --git a/pkgs/misc/vim-plugins/generated.nix b/pkgs/misc/vim-plugins/generated.nix
index 4ecfa222de74..e3714edc0aef 100644
--- a/pkgs/misc/vim-plugins/generated.nix
+++ b/pkgs/misc/vim-plugins/generated.nix
@@ -65,12 +65,12 @@ let
 
   ale = buildVimPluginFrom2Nix {
     pname = "ale";
-    version = "2020-05-22";
+    version = "2020-06-11";
     src = fetchFromGitHub {
       owner = "dense-analysis";
       repo = "ale";
-      rev = "7265ceb6d050d1a4642741d248f11e4f2abd37e1";
-      sha256 = "172ip0wbrmrwxhv5nvpgb0g982w9smyzlwg16gphrjiwnxllj1w7";
+      rev = "1428c7b29e50af56f53ee1d587679d97a027dd72";
+      sha256 = "0zhrgfsk7fvs8wabgdp5ps73ggsghsw19cnjvlbw4cnib6p9176a";
     };
     meta.homepage = "https://github.com/dense-analysis/ale/";
   };
@@ -269,12 +269,12 @@ let
 
   calendar-vim = buildVimPluginFrom2Nix {
     pname = "calendar-vim";
-    version = "2020-05-24";
+    version = "2020-06-09";
     src = fetchFromGitHub {
       owner = "itchyny";
       repo = "calendar.vim";
-      rev = "b2e7a69945c2b452598a1d4fa25d8fc94aa8b02c";
-      sha256 = "03fx03pdw4bwqyd4jyk0ixb5fhv900x0lg615ig0i4qg9nqjnc8n";
+      rev = "932648c890d27b3a1f0e5f5f63e4564384dfdb63";
+      sha256 = "1p1lrxk45qphpmnkszhaks7li0h3y3biif9427n6mjckl860g5c7";
     };
     meta.homepage = "https://github.com/itchyny/calendar.vim/";
   };
@@ -401,36 +401,36 @@ let
 
   coc-fzf = buildVimPluginFrom2Nix {
     pname = "coc-fzf";
-    version = "2020-06-02";
+    version = "2020-06-13";
     src = fetchFromGitHub {
       owner = "antoinemadec";
       repo = "coc-fzf";
-      rev = "8c89226acc29fe2695e8f86355c04ce1587f0fda";
-      sha256 = "04616lzpch9r5cj6nh4dw4b666iyi314n95mi62n5qcaibr6r85s";
+      rev = "2c98c9f34718f5f639bfaae1c193fbe39749f7fc";
+      sha256 = "126yqr53y4y30p4sp7942nic6lql6lfx0a1wb0psrrvrc8ccbbpp";
     };
     meta.homepage = "https://github.com/antoinemadec/coc-fzf/";
   };
 
   coc-git = buildVimPluginFrom2Nix {
     pname = "coc-git";
-    version = "2020-05-12";
+    version = "2020-06-11";
     src = fetchFromGitHub {
       owner = "neoclide";
       repo = "coc-git";
-      rev = "b45372104d2234612f89658570887c55e6efea83";
-      sha256 = "1p7ah0dr31h0pllx00ms46fd5pmkp604zlkk08z40w54hzhr5qhh";
+      rev = "bbddf4a9447848cdd18a693268bffcc0fe523c08";
+      sha256 = "11c5rnlf45wz0slvl0gcqcdc9xb859pxy44xynfbbsl0ii1l8zc1";
     };
     meta.homepage = "https://github.com/neoclide/coc-git/";
   };
 
   coc-go = buildVimPluginFrom2Nix {
     pname = "coc-go";
-    version = "2020-05-25";
+    version = "2020-06-10";
     src = fetchFromGitHub {
       owner = "josa42";
       repo = "coc-go";
-      rev = "d9756fd65dc1d6740e797fa22d3f6f4fdb2b00d5";
-      sha256 = "14qc9ny12y52rbxn0gcwh6cpqc2zpwgb4jlla5p72w9pfh9gfh6z";
+      rev = "38b0b30355f85a7952a2e6602fdb1cdf9141a501";
+      sha256 = "0wmdfcglvixfqahjg3lc5q7y36wk6lzczr5nhnwixh9cis1nybx6";
     };
     meta.homepage = "https://github.com/josa42/coc-go/";
   };
@@ -521,12 +521,12 @@ let
 
   coc-metals = buildVimPluginFrom2Nix {
     pname = "coc-metals";
-    version = "2020-06-01";
+    version = "2020-06-12";
     src = fetchFromGitHub {
       owner = "ckipp01";
       repo = "coc-metals";
-      rev = "0286d7f11647dca4a63d84fe4101dbabc7731c04";
-      sha256 = "068aqynvzsnrz2dh68zdy40h342nfrf8kvv9234qdr91mhbvrxv4";
+      rev = "b6ed6dad8c9f57e2ee84b60c0cf69c88c5ccf3bc";
+      sha256 = "0abvls1vxyzxzsrlmm5javahsxxslgli43b1ffbrk7cz8cbhgdsy";
     };
     meta.homepage = "https://github.com/ckipp01/coc-metals/";
   };
@@ -605,12 +605,12 @@ let
 
   coc-rust-analyzer = buildVimPluginFrom2Nix {
     pname = "coc-rust-analyzer";
-    version = "2020-06-04";
+    version = "2020-06-11";
     src = fetchFromGitHub {
       owner = "fannheyward";
       repo = "coc-rust-analyzer";
-      rev = "acd5e7fca38dbc8ad8bfe9f187f1f4e6ee64ea88";
-      sha256 = "14qyszmyzykibdkdv38cypc8gmhaz0301prirjbpf2gijryk922b";
+      rev = "a2e98801bcbe88d100f2fcb23087ba61203ad101";
+      sha256 = "0a2a6pjvbb29syhh796z3gfrgjx4vpkbjirsgzdfb12icigbjdz7";
     };
     meta.homepage = "https://github.com/fannheyward/coc-rust-analyzer/";
   };
@@ -629,12 +629,12 @@ let
 
   coc-snippets = buildVimPluginFrom2Nix {
     pname = "coc-snippets";
-    version = "2020-05-20";
+    version = "2020-06-10";
     src = fetchFromGitHub {
       owner = "neoclide";
       repo = "coc-snippets";
-      rev = "f5e7a3575a04ee9cacd659380d0d0118fa4bb5cd";
-      sha256 = "0zrllqqdgf1ckzgaxhk7459cbkv7x1vkfgwsvilcjspxaww1s1bv";
+      rev = "a36f36afe7094562756202d1bb88c1f80597393e";
+      sha256 = "117idj29gk8psj27zmwazanwxf4br08mlkcpnkxyw6blm5aibzpp";
     };
     meta.homepage = "https://github.com/neoclide/coc-snippets/";
   };
@@ -785,12 +785,12 @@ let
 
   coc-nvim = buildVimPluginFrom2Nix {
     pname = "coc-nvim";
-    version = "2020-06-04";
+    version = "2020-06-13";
     src = fetchFromGitHub {
       owner = "neoclide";
       repo = "coc.nvim";
-      rev = "d992e129997d9bda225a4e59ed5e5a57fca1896a";
-      sha256 = "0f4vsg2fbwn4jpfj8lv8ib8i8adzvr9inw4q861w87zssk65bi8g";
+      rev = "d66250193333f786b0706d4f1aebbd3e17505c43";
+      sha256 = "0k4f0xf9h6v5xhvkzklg233x6y15bn22yg07g3nkgh10b8mpspbs";
     };
     meta.homepage = "https://github.com/neoclide/coc.nvim/";
   };
@@ -1014,12 +1014,12 @@ let
 
   defx-nvim = buildVimPluginFrom2Nix {
     pname = "defx-nvim";
-    version = "2020-05-30";
+    version = "2020-06-09";
     src = fetchFromGitHub {
       owner = "Shougo";
       repo = "defx.nvim";
-      rev = "5d8133aba89acaab3b532b15eed8e6cba77b1cd2";
-      sha256 = "1gw73cybp1qxgnqfa6hn6g2ky30canhmrchf550kp5j8nflqa887";
+      rev = "bc2a3fcbe9db21623dcc7c2d5c4c1b1289283dfc";
+      sha256 = "00gyrfhz7mf93swqzi4n459vbk9rpcqsc9qfzgnv38myh800s2ih";
     };
     meta.homepage = "https://github.com/Shougo/defx.nvim/";
   };
@@ -1062,12 +1062,12 @@ let
 
   denite-nvim = buildVimPluginFrom2Nix {
     pname = "denite-nvim";
-    version = "2020-06-01";
+    version = "2020-06-11";
     src = fetchFromGitHub {
       owner = "Shougo";
       repo = "denite.nvim";
-      rev = "7c971aa2e40853b21f7967788e9ea3baa4e97ab2";
-      sha256 = "04v3v14g7nnmc6rhz5vpppqgkk8z67am4nc6k8jwbrv61sq1ga6b";
+      rev = "6139d4cd2d6944be8b713766f92f521eaa056c18";
+      sha256 = "0v64fj9jjq51h2cr1haih4ac4kffvzp6g0gli2vs4vjcbjbcil5r";
     };
     meta.homepage = "https://github.com/Shougo/denite.nvim/";
   };
@@ -1209,12 +1209,12 @@ let
 
   deoplete-lsp = buildVimPluginFrom2Nix {
     pname = "deoplete-lsp";
-    version = "2020-05-30";
+    version = "2020-06-11";
     src = fetchFromGitHub {
       owner = "Shougo";
       repo = "deoplete-lsp";
-      rev = "2994bf57fed476a5b9878e842b14b5b5c5b22211";
-      sha256 = "0y22nay6qkn0sl74hlhhri3hjw5r3fwmmxby3j9q0avszlmq7352";
+      rev = "64a8663e529686fc43390942672ff2b33beda0e3";
+      sha256 = "1z8axvcrzip4bgmnn62p3q7rr3y7avkf7l4k2r266bkxwgsmh50k";
     };
     meta.homepage = "https://github.com/Shougo/deoplete-lsp/";
   };
@@ -1293,12 +1293,12 @@ let
 
   deoplete-nvim = buildVimPluginFrom2Nix {
     pname = "deoplete-nvim";
-    version = "2020-06-02";
+    version = "2020-06-11";
     src = fetchFromGitHub {
       owner = "Shougo";
       repo = "deoplete.nvim";
-      rev = "921688d72168e436c82f3d413a5de7d78369a0c7";
-      sha256 = "01wpq4majnhh4lxmai0ix5dqvfxrbdsj2pic785x3kaqn4all31w";
+      rev = "e04bfc18b604c54ebc319d2eebf8fe3a830a9212";
+      sha256 = "01bf55zbw2v2qzbpk0jm5j4dhq8rs78m2pbljsnl2772vll4iv38";
     };
     meta.homepage = "https://github.com/Shougo/deoplete.nvim/";
   };
@@ -1341,12 +1341,12 @@ let
 
   echodoc-vim = buildVimPluginFrom2Nix {
     pname = "echodoc-vim";
-    version = "2020-04-08";
+    version = "2020-06-08";
     src = fetchFromGitHub {
       owner = "Shougo";
       repo = "echodoc.vim";
-      rev = "31533d9c6c2723dfb4cf5691c83f330a3a0ccddd";
-      sha256 = "1ygm4g90zv009iqv8k8n4930a7gpij5jxbz7dqq2dfyj4jn37rkf";
+      rev = "4719626bfd477f1189dd9992614ff452d3ea3caf";
+      sha256 = "0bpaav7yf06wlzfiyx6iylxan8a9hici041pnmlw7kgf176h6w7b";
     };
     meta.homepage = "https://github.com/Shougo/echodoc.vim/";
   };
@@ -1548,12 +1548,12 @@ let
 
   fzf-vim = buildVimPluginFrom2Nix {
     pname = "fzf-vim";
-    version = "2020-06-01";
+    version = "2020-06-07";
     src = fetchFromGitHub {
       owner = "junegunn";
       repo = "fzf.vim";
-      rev = "5aa5977d744d1183806079d307f023b0c5ceaaef";
-      sha256 = "0b7lgdr66q99dfc73iwgb11pd4b465qmslfzqypsp8jamckk1jii";
+      rev = "8f1e73b598d27d78dfb5843be19a73b6a3b222b1";
+      sha256 = "0zdimx6q2fivimdvh0cnm6w718vjxj0abv67869ijh1d4mfrmvyf";
     };
     meta.homepage = "https://github.com/junegunn/fzf.vim/";
   };
@@ -1572,24 +1572,24 @@ let
 
   gentoo-syntax = buildVimPluginFrom2Nix {
     pname = "gentoo-syntax";
-    version = "2020-06-04";
+    version = "2020-06-05";
     src = fetchFromGitHub {
       owner = "gentoo";
       repo = "gentoo-syntax";
-      rev = "632d0a72c83cd0ccf7f40cb64470dc84f51bdce2";
-      sha256 = "0q5cj2zpcdxmwm8dcj0nbyffjs1a075fgqbang4s0ikangbhx586";
+      rev = "47b6900c425614d4ba22223c13a23920f0618d9f";
+      sha256 = "0agswv1r5nxbnw0nddhw9vqvrfsvsgh18nwrg83c01sj97075qmv";
     };
     meta.homepage = "https://github.com/gentoo/gentoo-syntax/";
   };
 
   ghcid = buildVimPluginFrom2Nix {
     pname = "ghcid";
-    version = "2020-05-17";
+    version = "2020-06-06";
     src = fetchFromGitHub {
       owner = "ndmitchell";
       repo = "ghcid";
-      rev = "64f693f6581c3acdee71897eaba7c4e793eaa946";
-      sha256 = "194njs7nfdmpnv1bkadamvicp735834kq0ijha5s41i492hb589i";
+      rev = "bddd18ffabbdb10ca1fadf25e7d7d1201470f444";
+      sha256 = "1sxh3zdrwajz0nabqbzg24sxlc8kwiqrwh4mvrwavwyh7xr29jxd";
     };
     meta.homepage = "https://github.com/ndmitchell/ghcid/";
   };
@@ -1632,12 +1632,12 @@ let
 
   goyo-vim = buildVimPluginFrom2Nix {
     pname = "goyo-vim";
-    version = "2019-06-13";
+    version = "2020-06-08";
     src = fetchFromGitHub {
       owner = "junegunn";
       repo = "goyo.vim";
-      rev = "6b6ed2734084fdbb6315357ddcaecf9c8e6f143d";
-      sha256 = "1ywlz1hn54kxyp5q0angriaarimq7ys7m6sk6l4x8jr1g2yh0afz";
+      rev = "3e129198bba7d6b50406902002ad7d213a6cccaa";
+      sha256 = "1b2wsxbg27nmwxrncwddkl2ck8hbiqdqi821vl9d1fl5nx042y2b";
     };
     meta.homepage = "https://github.com/junegunn/goyo.vim/";
   };
@@ -1897,12 +1897,12 @@ let
 
   Jenkinsfile-vim-syntax = buildVimPluginFrom2Nix {
     pname = "Jenkinsfile-vim-syntax";
-    version = "2019-12-31";
+    version = "2020-06-05";
     src = fetchFromGitHub {
       owner = "martinda";
       repo = "Jenkinsfile-vim-syntax";
-      rev = "164b457d87b65c6ca9e5998b69c6cd24248f62ac";
-      sha256 = "14s26hlsdqys7br84l9wiyvhcy17s6966mhgr9n6sdqmhz6lc4nm";
+      rev = "a701341879c6db93f5dffa37f4589eef3c4ded85";
+      sha256 = "0nm3lf37l1g8lpa4yz1va0s6vw0vw99zghy3dzq933j0kqmspgvp";
     };
     meta.homepage = "https://github.com/martinda/Jenkinsfile-vim-syntax/";
   };
@@ -1921,12 +1921,12 @@ let
 
   julia-vim = buildVimPluginFrom2Nix {
     pname = "julia-vim";
-    version = "2020-05-21";
+    version = "2020-06-06";
     src = fetchFromGitHub {
       owner = "JuliaEditorSupport";
       repo = "julia-vim";
-      rev = "2d0b6e4018d6cc01b96ab326ff6495876200866d";
-      sha256 = "1ijmxxw63mraa5afddahfvwbh9acrf11q7g6hf32k6923rfccrnq";
+      rev = "f0fab9a2df5223815f7dc46f44f69566aa9e51d1";
+      sha256 = "145wxlv5rifk93lvai17625r1c94lnbi8rnda0vidr0dhhgcl7v7";
     };
     meta.homepage = "https://github.com/JuliaEditorSupport/julia-vim/";
   };
@@ -2029,12 +2029,12 @@ let
 
   lf-vim = buildVimPluginFrom2Nix {
     pname = "lf-vim";
-    version = "2020-05-12";
+    version = "2020-06-11";
     src = fetchFromGitHub {
       owner = "ptzz";
       repo = "lf.vim";
-      rev = "8dbdb135f3704790f9e66a141d2785d4b65c238d";
-      sha256 = "0phfqg6ax79vsz1sy6pvjflz1929x58k7nifiqki9bzp2m6knls9";
+      rev = "8eef4095f0ca4ec37b6877b7b01047146e987c6b";
+      sha256 = "17clfc8shmv485r6anpkkcq88x6n2pm54ir1pjy852spzykycika";
     };
     meta.homepage = "https://github.com/ptzz/lf.vim/";
   };
@@ -2245,12 +2245,12 @@ let
 
   neco-ghc = buildVimPluginFrom2Nix {
     pname = "neco-ghc";
-    version = "2018-05-13";
+    version = "2020-06-06";
     src = fetchFromGitHub {
       owner = "eagletmt";
       repo = "neco-ghc";
-      rev = "682869aca5dd0bde71a09ba952acb59c543adf7d";
-      sha256 = "1v7ibi4fp99s4lswz3v0gf4i0h5i5gpj05xpsf4cixwj2zgh206h";
+      rev = "b4ea02c537975a5a2bf00cb5f24cd784b2b6f5ad";
+      sha256 = "13la3slqkljn7y8y9p8ic3majnvjf7pnrwr16cdpacklmz733x1f";
     };
     meta.homepage = "https://github.com/eagletmt/neco-ghc/";
   };
@@ -2317,12 +2317,12 @@ let
 
   neoformat = buildVimPluginFrom2Nix {
     pname = "neoformat";
-    version = "2020-05-17";
+    version = "2020-06-12";
     src = fetchFromGitHub {
       owner = "sbdchd";
       repo = "neoformat";
-      rev = "a3561bf2032a162bc9f53d96fa4e5a2ada98854c";
-      sha256 = "15lsxwf4f1mg5h716zikwv1hbb0i41d24hrvyrqhwqlnqbwizlbi";
+      rev = "1cee66fe6219f8cc698eb244ba4001bdad1d09cb";
+      sha256 = "0w5hw5qc5n0i2hal91nilmxazskixv6c1rcszgqar4dfh951kazy";
     };
     meta.homepage = "https://github.com/sbdchd/neoformat/";
   };
@@ -2377,12 +2377,12 @@ let
 
   neosnippet-vim = buildVimPluginFrom2Nix {
     pname = "neosnippet-vim";
-    version = "2020-05-12";
+    version = "2020-06-13";
     src = fetchFromGitHub {
       owner = "Shougo";
       repo = "neosnippet.vim";
-      rev = "70f855d93c4bc727873c42111432660cf6929cdc";
-      sha256 = "1gh7vh3qc9k8xhpmcvhdn5nfff81y7hkfky0mgs75a97mkd8qhnz";
+      rev = "a52edf794bae0174a682131333c891717633994b";
+      sha256 = "1k3ncjlikdbsjk33fi14y88yqywrpzdfz8kwzjfxjlidbzzlzk0w";
     };
     meta.homepage = "https://github.com/Shougo/neosnippet.vim/";
   };
@@ -2449,12 +2449,12 @@ let
 
   nerdcommenter = buildVimPluginFrom2Nix {
     pname = "nerdcommenter";
-    version = "2020-02-19";
+    version = "2020-06-08";
     src = fetchFromGitHub {
       owner = "preservim";
       repo = "nerdcommenter";
-      rev = "c62e618a1ab5a50a4028e3296500ba29d9b033d8";
-      sha256 = "0w4bxj423dxxkcxnfmipf8x5jfm058rq4g3m98wzcz5zbambv3qs";
+      rev = "fade3d4b26f5a0d58f256a06ba7b0a04d9fb4f3b";
+      sha256 = "1vb5n4g5x3hpnc013gjf8frxxdrcq1zdcm3mpx90b0cjxi252cn3";
     };
     meta.homepage = "https://github.com/preservim/nerdcommenter/";
   };
@@ -2569,12 +2569,12 @@ let
 
   nvim-lsp = buildVimPluginFrom2Nix {
     pname = "nvim-lsp";
-    version = "2020-06-02";
+    version = "2020-06-13";
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "nvim-lsp";
-      rev = "a7fdf268b1c51f6395900e437060728701aa8b77";
-      sha256 = "04v1g4sa6dccaffrlkmyh410ppza5zlrnrapf9c3sfj6bmsr4jd3";
+      rev = "9ec118cdc7ce6442bf8beba903ab395b2f60190f";
+      sha256 = "1idam76jwvs82c2384y4az4rqp5cg29qhic12fnpy8m74b3rqla8";
     };
     meta.homepage = "https://github.com/neovim/nvim-lsp/";
   };
@@ -2617,12 +2617,12 @@ let
 
   onehalf = buildVimPluginFrom2Nix {
     pname = "onehalf";
-    version = "2020-05-06";
+    version = "2020-06-11";
     src = fetchFromGitHub {
       owner = "sonph";
       repo = "onehalf";
-      rev = "970abdf26b399100cbb59c6b6e693c4ff877c59d";
-      sha256 = "1v34n0cz7jkx0wlbl6kv693qgifs0frcw4mv32ll36pmqfyb4m0h";
+      rev = "3aa42a39ed3cddde0c53976a700b81b8a7067890";
+      sha256 = "0x01c7930hlzvjac3r2wbkdha8j6mmhyk7nwgdazh1z4sxqjyj1l";
     };
     meta.homepage = "https://github.com/sonph/onehalf/";
   };
@@ -2965,12 +2965,12 @@ let
 
   rust-vim = buildVimPluginFrom2Nix {
     pname = "rust-vim";
-    version = "2020-05-13";
+    version = "2020-06-11";
     src = fetchFromGitHub {
       owner = "rust-lang";
       repo = "rust.vim";
-      rev = "953b10061f595496b35aec84b75c413ee5751a23";
-      sha256 = "1abacayriz439lj4r3s1x92pp3wwxqav3kqsanxq9k6f6p2b2fyb";
+      rev = "0d8ce07aaa3b95e61bf319b25bb3b1a4ecc780c2";
+      sha256 = "0bwj60zvafv5z61yy66ab6ng1ilnj20k3xnxl6myzvfn70rsp5yd";
     };
     meta.homepage = "https://github.com/rust-lang/rust.vim/";
   };
@@ -3169,12 +3169,12 @@ let
 
   splitjoin-vim = buildVimPluginFrom2Nix {
     pname = "splitjoin-vim";
-    version = "2020-05-16";
+    version = "2020-06-11";
     src = fetchFromGitHub {
       owner = "AndrewRadev";
       repo = "splitjoin.vim";
-      rev = "99d12007112b63b8e3fd0fcf435471ac63ccf030";
-      sha256 = "1mar7v4sp3zbvbczs54n8zj17bh042g0384ichwvqkamfcfxgdid";
+      rev = "03dc38772d59e78de3d87b27438fecab70dd6688";
+      sha256 = "0xn972gppr87lx37p01x1ikh2nwn56szhgnikw1v269vnysic15m";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/AndrewRadev/splitjoin.vim/";
@@ -3278,12 +3278,12 @@ let
 
   tagbar = buildVimPluginFrom2Nix {
     pname = "tagbar";
-    version = "2020-05-30";
+    version = "2020-06-11";
     src = fetchFromGitHub {
       owner = "majutsushi";
       repo = "tagbar";
-      rev = "a36880be2217814b7034f05eb0f402e8183befc9";
-      sha256 = "16rj8pv8b9knbxi2967h96kgwp4r631kmpxdy74xsf938z4cya0j";
+      rev = "56399f446c64d187c106e112afa4d97985508eba";
+      sha256 = "1bmfv09lxwq9b8hp4v2avmd979178lm60xxf5g0qiifrr4ym2gqk";
     };
     meta.homepage = "https://github.com/majutsushi/tagbar/";
   };
@@ -3483,12 +3483,12 @@ let
 
   unicode-vim = buildVimPluginFrom2Nix {
     pname = "unicode-vim";
-    version = "2020-04-20";
+    version = "2020-06-09";
     src = fetchFromGitHub {
       owner = "chrisbra";
       repo = "unicode.vim";
-      rev = "ce061819e4304a9ff2f82779e12e5a30363ab47c";
-      sha256 = "0k9gmf2rdvnlfqqhjlk206wimlh5di3smmrr9cgz0djq5pd3r5jz";
+      rev = "76e95c6f8c863f5079cd103b18990684bb02d525";
+      sha256 = "0v3w117bimd74r9i209hgqy75x83hdd3za26l8g729w56kqgq5r8";
     };
     meta.homepage = "https://github.com/chrisbra/unicode.vim/";
   };
@@ -3543,12 +3543,12 @@ let
 
   verilog_systemverilog-vim = buildVimPluginFrom2Nix {
     pname = "verilog_systemverilog-vim";
-    version = "2020-05-24";
+    version = "2020-06-12";
     src = fetchFromGitHub {
       owner = "vhda";
       repo = "verilog_systemverilog.vim";
-      rev = "e2449daa3272a6d5ad33e433cca3208bf68607a7";
-      sha256 = "16w1nskfxsfs9dhk1yxmk16i5vjg0wq8l3fsqwa0904rh5wnakjn";
+      rev = "c37bcf010fcb73599d690d8da6ac966dac02a07e";
+      sha256 = "1f4kicgr7wv0dprvr91wi4lmk0d9bb9f4wcng4rfkq1cdwfkqdw4";
     };
     meta.homepage = "https://github.com/vhda/verilog_systemverilog.vim/";
   };
@@ -3807,12 +3807,12 @@ let
 
   vim-airline = buildVimPluginFrom2Nix {
     pname = "vim-airline";
-    version = "2020-05-31";
+    version = "2020-06-11";
     src = fetchFromGitHub {
       owner = "vim-airline";
       repo = "vim-airline";
-      rev = "d221dc531298f467a6901861b0360741c2a387b0";
-      sha256 = "0w4lwpynn5cj9si3apyfmxb8x8hv0acggsyfvmhpi41638sz2310";
+      rev = "ee85ed4c673b859cf8c3626a6669b8e3cd2392fa";
+      sha256 = "1wayink1n9l590kfi28xp37kw186g7j0dr5kgfr7xz8mk2g0wg0k";
     };
     meta.homepage = "https://github.com/vim-airline/vim-airline/";
   };
@@ -3843,12 +3843,12 @@ let
 
   vim-anzu = buildVimPluginFrom2Nix {
     pname = "vim-anzu";
-    version = "2018-02-28";
+    version = "2020-06-10";
     src = fetchFromGitHub {
       owner = "osyo-manga";
       repo = "vim-anzu";
-      rev = "45b60d37cb9de90f6c89f7ddeacb7ae430ebcae2";
-      sha256 = "1p5lh4xsv9xsl8kx0h1bg6iy0if4a69hvairq69p50ffka83pv00";
+      rev = "1b95ec384487e559f0ee70e0f46c33683ff533ac";
+      sha256 = "0q6s9bb1yv7ir2al4gv69vv4c8m09j1ax47qbhchgz23iwka3vmz";
     };
     meta.homepage = "https://github.com/osyo-manga/vim-anzu/";
   };
@@ -4023,12 +4023,12 @@ let
 
   vim-codefmt = buildVimPluginFrom2Nix {
     pname = "vim-codefmt";
-    version = "2020-06-02";
+    version = "2020-06-08";
     src = fetchFromGitHub {
       owner = "google";
       repo = "vim-codefmt";
-      rev = "e083709f482332e5ff765f4d7b7901d51ddc9ef4";
-      sha256 = "0d46h4jx01mib4wyj60qx4r34y201gaj1vpkb48pkw9qlsaqs31i";
+      rev = "90335990808167d910671a625f3ee9de9aac1058";
+      sha256 = "1rq0ivynsq35h5kpzpd963bgkbx9lb26wlxrb2l8xha0zzzsmhpz";
     };
     meta.homepage = "https://github.com/google/vim-codefmt/";
   };
@@ -4215,12 +4215,12 @@ let
 
   vim-devicons = buildVimPluginFrom2Nix {
     pname = "vim-devicons";
-    version = "2020-05-30";
+    version = "2020-06-12";
     src = fetchFromGitHub {
       owner = "ryanoasis";
       repo = "vim-devicons";
-      rev = "15b532ebd4455d9d099e9ccebab09915e0562754";
-      sha256 = "0cfiwdaj43fx2gq7916i98iyn3ky79d359ylgpznczn88k37s1wi";
+      rev = "84ec4562c21882dfe80b779cd645c607ec9d9727";
+      sha256 = "1nv7aivnrxa91b2ylxzfiss46r9m2qf13v8wlhav85mgd51nhj99";
     };
     meta.homepage = "https://github.com/ryanoasis/vim-devicons/";
   };
@@ -4371,12 +4371,12 @@ let
 
   vim-elm-syntax = buildVimPluginFrom2Nix {
     pname = "vim-elm-syntax";
-    version = "2020-01-25";
+    version = "2020-06-10";
     src = fetchFromGitHub {
       owner = "andys8";
       repo = "vim-elm-syntax";
-      rev = "846a5929bff5795256fbca96707e451dbc755e36";
-      sha256 = "05jkx4dbkb646wy0igqpwc55iamm0a030dswhirg6nyl3x6qzgym";
+      rev = "68cd8988fe9eaa190052fadaee0fea2c21338d4c";
+      sha256 = "0yhvx8k83xfzmgy10r9mz0rjagbyzx5rrmn8123vw49ncksvw49q";
     };
     meta.homepage = "https://github.com/andys8/vim-elm-syntax/";
   };
@@ -4455,12 +4455,12 @@ let
 
   vim-fireplace = buildVimPluginFrom2Nix {
     pname = "vim-fireplace";
-    version = "2020-04-18";
+    version = "2020-06-08";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-fireplace";
-      rev = "6c968f26f0bd3dd04b18fad8761e0e9e1220a3da";
-      sha256 = "1x74j3gghfmqh1mxswzhb6d0zdll735r5lrgn4g3z580y15h37w5";
+      rev = "15fcf3db308ce34a12c1e41a88178c7cccea0d96";
+      sha256 = "148qjhln1v4cv15idsn36n82g0g7bjq2vhf0il9a6djwycf374kb";
     };
     meta.homepage = "https://github.com/tpope/vim-fireplace/";
   };
@@ -4611,12 +4611,12 @@ let
 
   vim-gitgutter = buildVimPluginFrom2Nix {
     pname = "vim-gitgutter";
-    version = "2020-05-29";
+    version = "2020-06-10";
     src = fetchFromGitHub {
       owner = "airblade";
       repo = "vim-gitgutter";
-      rev = "9784226ba766662d298554a5c66fd938497f2233";
-      sha256 = "19f28c3wasgck78xqdygsyiwv17qqh69nkn9n1gajcbmbr55lhzn";
+      rev = "e31e9bb35f7346caab4fcf972d44449bdfd3230a";
+      sha256 = "1mmasjz0d6nyjjrlgwiz9kd420l16q90mhscwz3i65xw0zqlmcgj";
     };
     meta.homepage = "https://github.com/airblade/vim-gitgutter/";
   };
@@ -4647,12 +4647,12 @@ let
 
   vim-go = buildVimPluginFrom2Nix {
     pname = "vim-go";
-    version = "2020-05-31";
+    version = "2020-06-09";
     src = fetchFromGitHub {
       owner = "fatih";
       repo = "vim-go";
-      rev = "8e72eef0b35839db0a028a37bd28debc20c1201b";
-      sha256 = "0rpay08m3q0syvw9ks45b3cvggghi1350h7dp87bx24jd3dqvdvf";
+      rev = "354774cd7aea891cf553c34d79582be3346c1615";
+      sha256 = "0pqmm6s50vxs9788f6avgwrdp1vi5mv3lzrxi2nxqdxvrcxngk93";
     };
     meta.homepage = "https://github.com/fatih/vim-go/";
   };
@@ -4887,12 +4887,12 @@ let
 
   vim-illuminate = buildVimPluginFrom2Nix {
     pname = "vim-illuminate";
-    version = "2020-02-21";
+    version = "2020-06-09";
     src = fetchFromGitHub {
       owner = "RRethy";
       repo = "vim-illuminate";
-      rev = "80dafb9b0e7b9f4ce7c843d4104f455c8c5b1f42";
-      sha256 = "1yijaj1dqfmw4dsdmgj01sxizyraisxwjqh2hhbq93pdln4lm51f";
+      rev = "0778289e391c419f7a3af9de8229f798ee292013";
+      sha256 = "1l5s5f4fw96w437rdf85lym7g75hnz8sb2fdj9hygyg0sp42r0cf";
     };
     meta.homepage = "https://github.com/RRethy/vim-illuminate/";
   };
@@ -5044,12 +5044,12 @@ let
 
   vim-jsdoc = buildVimPluginFrom2Nix {
     pname = "vim-jsdoc";
-    version = "2020-05-16";
+    version = "2020-06-09";
     src = fetchFromGitHub {
       owner = "heavenshell";
       repo = "vim-jsdoc";
-      rev = "5e8eac9d8e38c273cc05c359730a2a74a1578f2b";
-      sha256 = "0biyf2vzvnqzzdykq0agf1hzs2ynbbly4fxfwrfablznbdgsm0pz";
+      rev = "3b88595805ac7c0499dc05bc8aa5cc7909c6f5b7";
+      sha256 = "04yjjcfmaby466krqzmvwg0cb2ydri6pj49x48z15h4s9ac47p66";
     };
     meta.homepage = "https://github.com/heavenshell/vim-jsdoc/";
   };
@@ -5164,12 +5164,12 @@ let
 
   vim-ledger = buildVimPluginFrom2Nix {
     pname = "vim-ledger";
-    version = "2020-05-25";
+    version = "2020-06-08";
     src = fetchFromGitHub {
       owner = "ledger";
       repo = "vim-ledger";
-      rev = "b3e6f3dfaa922cda7771a4db20d3ae0267e08133";
-      sha256 = "1jx814sqs0n0mrdi2lrh6xa3d2cmgyc78176gd5c1n8k5q7qkp40";
+      rev = "d5f2af4883351aa437ca1c3157d21917dc2bb1b0";
+      sha256 = "0bdyhbablays384gssfdfavkxcrwcj89y8vn5kdk11xs0r78b5wr";
     };
     meta.homepage = "https://github.com/ledger/vim-ledger/";
   };
@@ -5224,24 +5224,24 @@ let
 
   vim-lsc = buildVimPluginFrom2Nix {
     pname = "vim-lsc";
-    version = "2020-06-02";
+    version = "2020-06-10";
     src = fetchFromGitHub {
       owner = "natebosch";
       repo = "vim-lsc";
-      rev = "baa44d450043cc020e1d6f0609d0e081bbcc6f9e";
-      sha256 = "07m2wqich31pxp9jgh3fzjqqdm7vdjh8rjf67d4l6kkf13dw89yh";
+      rev = "b34ad0fdd1223e5c1c39d23c01f13954ca2ad500";
+      sha256 = "1zqk0zimq2qyqhhfb5693zkcxz16vyrd7k2wd488avqi1jbhiffc";
     };
     meta.homepage = "https://github.com/natebosch/vim-lsc/";
   };
 
   vim-maktaba = buildVimPluginFrom2Nix {
     pname = "vim-maktaba";
-    version = "2020-05-29";
+    version = "2020-06-13";
     src = fetchFromGitHub {
       owner = "google";
       repo = "vim-maktaba";
-      rev = "2636a0fabaae80e3bebdb3c571220aebf875dfcf";
-      sha256 = "1vcc8gaikbgdq1k4f3jdjrmlwad1z44g3biifgqyp0sgd7bjd9lp";
+      rev = "5c49c44be62e595d3d1d81a15259cd1bfc722825";
+      sha256 = "0nr7hbwpwzzzxinpjfdlaia3ys6vrw10i3wbjhr41iga6gkg6w2v";
     };
     meta.homepage = "https://github.com/google/vim-maktaba/";
   };
@@ -5644,12 +5644,12 @@ let
 
   vim-plug = buildVimPluginFrom2Nix {
     pname = "vim-plug";
-    version = "2020-06-03";
+    version = "2020-06-08";
     src = fetchFromGitHub {
       owner = "junegunn";
       repo = "vim-plug";
-      rev = "6583b990321f03500505dc43a3f62cbbc7369862";
-      sha256 = "1k9y119xwb84fgsyyp1npjh5z1wlbbm1922n411h70cfa4928rfh";
+      rev = "01aab60adef47c6606aa68c8783f5b994fda9fc4";
+      sha256 = "1x5m98k20ncvhz6sngzxwhh74s2ll3d119p1g0di4vr59rkx8szq";
     };
     meta.homepage = "https://github.com/junegunn/vim-plug/";
   };
@@ -5668,12 +5668,12 @@ let
 
   vim-polyglot = buildVimPluginFrom2Nix {
     pname = "vim-polyglot";
-    version = "2020-06-01";
+    version = "2020-06-13";
     src = fetchFromGitHub {
       owner = "sheerun";
       repo = "vim-polyglot";
-      rev = "5b3866302755da9e5a917ca42a38a4a03fb5f3e5";
-      sha256 = "0v6ll98j44hgmczhl6cp4rw734x582iz7942cw5jmbp7wg83nz88";
+      rev = "a86c0179ebc99b15d403e3f1d4a4cfff83b47de8";
+      sha256 = "0bsq2nvzxb6j0zn6c9hvrsz47ahcp3iki5acz4l1y841xgd880zm";
     };
     meta.homepage = "https://github.com/sheerun/vim-polyglot/";
   };
@@ -5992,12 +5992,12 @@ let
 
   vim-signify = buildVimPluginFrom2Nix {
     pname = "vim-signify";
-    version = "2020-05-18";
+    version = "2020-06-08";
     src = fetchFromGitHub {
       owner = "mhinz";
       repo = "vim-signify";
-      rev = "dfa1e55fe1c7f309f8cce4db0243f14f6edb2d4c";
-      sha256 = "0p1hnjwhqmrczwns7h8gsmdl95yxcb6sqw59xshz7ji0b80h45mf";
+      rev = "c3d450eb5f5e76d99d23b10493d4e08c5bb1ae71";
+      sha256 = "0ms0c36zsqqpxrq4mx9k5viblcapw9kpjm9cdrs8fnldlz6i0yhh";
     };
     meta.homepage = "https://github.com/mhinz/vim-signify/";
   };
@@ -6148,12 +6148,12 @@ let
 
   vim-spirv = buildVimPluginFrom2Nix {
     pname = "vim-spirv";
-    version = "2019-11-20";
+    version = "2020-06-12";
     src = fetchFromGitHub {
       owner = "kbenzie";
       repo = "vim-spirv";
-      rev = "e71404f92990aa4718925ade568427c0d8631469";
-      sha256 = "0aimpcz6vvrkcfgsj0xp12xdy1l83n387rsy74dzk23a220d59na";
+      rev = "9b005a0569fa5e18f71fcccbacda227c1cef7eaa";
+      sha256 = "0qby4bfjav2xijh732l7d2jli0adnv6cc8kcalbh5315vi4mpnfk";
     };
     meta.homepage = "https://github.com/kbenzie/vim-spirv/";
   };
@@ -6292,12 +6292,12 @@ let
 
   vim-test = buildVimPluginFrom2Nix {
     pname = "vim-test";
-    version = "2020-06-03";
+    version = "2020-06-08";
     src = fetchFromGitHub {
       owner = "vim-test";
       repo = "vim-test";
-      rev = "e819de903fe10fdcbb3714f3e96bafd918e4d117";
-      sha256 = "05jh89rgd4p6mkryv5dm83jhxfmg1k77rk4zq35i8dy8i6cvi41z";
+      rev = "2f185e0e5b0e7344c1e391045dc33a2e7a41d8eb";
+      sha256 = "1djl6phjc7vzhwbaxsc70mqp1f83iz99bcfyghphs9fhgdg46jiz";
     };
     meta.homepage = "https://github.com/vim-test/vim-test/";
   };
@@ -6532,12 +6532,12 @@ let
 
   vim-visual-multi = buildVimPluginFrom2Nix {
     pname = "vim-visual-multi";
-    version = "2020-05-30";
+    version = "2020-06-08";
     src = fetchFromGitHub {
       owner = "mg979";
       repo = "vim-visual-multi";
-      rev = "40991d51a6a3b22d56eefe9f6145602dfe1d494b";
-      sha256 = "0kawg12w7ssk58lv6ppv85c75x4af7dbkw9ngx7n91y1f1wkinjj";
+      rev = "f972b5357af0e5c9b840f8e82eceb313891ef8b2";
+      sha256 = "0ngvl4ikd45d1nhfpnpp003mfwx9mv5ywgk9mi5fjn2bc9a2y4l7";
     };
     meta.homepage = "https://github.com/mg979/vim-visual-multi/";
   };
@@ -6592,12 +6592,12 @@ let
 
   vim-which-key = buildVimPluginFrom2Nix {
     pname = "vim-which-key";
-    version = "2020-05-25";
+    version = "2020-06-10";
     src = fetchFromGitHub {
       owner = "liuchengxu";
       repo = "vim-which-key";
-      rev = "786dceaab0987e164dcee125b8ff6111851df625";
-      sha256 = "01afdf37fqz6i9g9371yh0ymv9lsw81z52vcpnwyysbj8n7qswwc";
+      rev = "dffbb044f7974bf4615960689a3ff64e63daeab3";
+      sha256 = "0ggnz2bz6mh9i38cgpkf87j27bhr8klk9a4ws57rkwfz3qppd4lj";
     };
     meta.homepage = "https://github.com/liuchengxu/vim-which-key/";
   };
@@ -6784,12 +6784,12 @@ let
 
   vimtex = buildVimPluginFrom2Nix {
     pname = "vimtex";
-    version = "2020-06-02";
+    version = "2020-06-09";
     src = fetchFromGitHub {
       owner = "lervag";
       repo = "vimtex";
-      rev = "7ef9c50aaf110debb54a8b1f4bafcb34ec86a623";
-      sha256 = "1i9phcxb29x14n202971vflqlwd9y2wa74v8aic4xhvqb5rli8as";
+      rev = "49bc335fffa40a7b7b84b6110b57ebcbaaf019ea";
+      sha256 = "06zdj0pgr6d8vddx87rk36lb00nngydl367g06zi8jkx4673rzz8";
     };
     meta.homepage = "https://github.com/lervag/vimtex/";
   };
@@ -6832,12 +6832,12 @@ let
 
   vista-vim = buildVimPluginFrom2Nix {
     pname = "vista-vim";
-    version = "2020-05-23";
+    version = "2020-06-06";
     src = fetchFromGitHub {
       owner = "liuchengxu";
       repo = "vista.vim";
-      rev = "dab956b05534359fd4e498b45e518f63f097ae9c";
-      sha256 = "1wf7plybcrrdx459f0g2rzzl9drik7w264y0i1jxf43y7nlm138n";
+      rev = "bfd70f620d30dc756d8ae57056b7a67a3fbbff22";
+      sha256 = "1a60qbswwdl58pqg6d9llj4l96h9vz7vp99s7ji0zjg8vzzklyxm";
     };
     meta.homepage = "https://github.com/liuchengxu/vista.vim/";
   };
@@ -6965,12 +6965,12 @@ let
 
   YouCompleteMe = buildVimPluginFrom2Nix {
     pname = "YouCompleteMe";
-    version = "2020-05-25";
+    version = "2020-06-12";
     src = fetchFromGitHub {
       owner = "ycm-core";
       repo = "YouCompleteMe";
-      rev = "27362f850ceca80e5369f46512fdd3ba042de4d7";
-      sha256 = "1gm8z7rshn2ffc3hdwif2910ckbz01x6aysp0yk8nfmqb7iacnjc";
+      rev = "8bc02ee4877bfe07ed92cc4d471c353f1ab84ef6";
+      sha256 = "1m1qhyqax7pdrsw9zdwy64d8rg5hcvmbyl8fqmbhz22lxdg5bvzv";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/ycm-core/YouCompleteMe/";
diff --git a/pkgs/os-specific/darwin/yabai/default.nix b/pkgs/os-specific/darwin/yabai/default.nix
index b4a7fc4c695c..5d8c8f60aec6 100644
--- a/pkgs/os-specific/darwin/yabai/default.nix
+++ b/pkgs/os-specific/darwin/yabai/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "yabai";
-  version = "3.1.2";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "koekeishiya";
     repo = pname;
     rev = "v${version}";
-    sha256 = "01vkx8nqds4f7nnzml4qf976xm89w6psxbpswkn98r5k03zfa8r0";
+    sha256 = "1iq5p4k6klffglxfhmzc2jvlilwn0w97vb5v4b91spiyp39nqcfw";
   };
 
   buildInputs = [ Carbon Cocoa ScriptingBridge ];
diff --git a/pkgs/os-specific/linux/fscrypt/default.nix b/pkgs/os-specific/linux/fscrypt/default.nix
index 608a6d5fa70a..aee406b03f0c 100644
--- a/pkgs/os-specific/linux/fscrypt/default.nix
+++ b/pkgs/os-specific/linux/fscrypt/default.nix
@@ -4,13 +4,13 @@
 
 buildGoModule rec {
   pname = "fscrypt";
-  version = "0.2.8";
+  version = "0.2.9";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "fscrypt";
     rev = "v${version}";
-    sha256 = "0433f9kx43842ic8dydxhz8plyyrrxvqqwg7kd5ghn599ix28avy";
+    sha256 = "020hhdarbn3bwlc2j2g89868v8nfx8562z1a778ihpvvsa4ykr31";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/fuse/default.nix b/pkgs/os-specific/linux/fuse/default.nix
index 415226509b7b..4d2e12367de7 100644
--- a/pkgs/os-specific/linux/fuse/default.nix
+++ b/pkgs/os-specific/linux/fuse/default.nix
@@ -11,7 +11,7 @@ in {
   };
 
   fuse_3 = mkFuse {
-    version = "3.9.1";
-    sha256Hash = "1i3f4h3vnjxls8hdi6w2n2ksrgbs7brbzj65rvxginyxicykh857";
+    version = "3.9.2";
+    sha256Hash = "10xsbly7rv895c9zv4fqmnrxbdc0kd1qhlk75x4m9cv95f93k843";
   };
 }
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index 46312a637dab..3ac79464ac4b 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "5.6.0";
+  version = "5.7.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "14j6n1bc09xhq8lxs40vfsx8bb8lx12a07ga4rsxl8vfrqjhwnqv";
+    sha256 = "088gs56iqhdlpw1iqjwrss4zxd4zbl2wl8s2implrrdajjxcfpbj";
   };
 
   preConfigure = ''
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index b1193c7fa734..36fb39fd1308 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -206,8 +206,8 @@ let
       B43_PHY_HT            = option yes;
       BCMA_HOST_PCI         = option yes;
       RTW88                 = whenAtLeast "5.2" module;
-      RTW88_8822BE          = whenAtLeast "5.2" yes;
-      RTW88_8822CE          = whenAtLeast "5.2" yes;
+      RTW88_8822BE          = mkMerge [ (whenBetween "5.2" "5.8" yes) (whenAtLeast "5.8" module) ];
+      RTW88_8822CE          = mkMerge [ (whenBetween "5.2" "5.8" yes) (whenAtLeast "5.8" module) ];
     };
 
     fb = {
@@ -727,6 +727,7 @@ let
       PSI = whenAtLeast "4.20" yes;
 
       MODVERSIONS        = whenOlder "4.9" yes;
+      MOUSE_ELAN_I2C_SMBUS = yes;
       MOUSE_PS2_ELANTECH = yes; # Elantech PS/2 protocol extension
       MTRR_SANITIZER     = yes;
       NET_FC             = yes; # Fibre Channel driver support
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 2e4ea7478065..654615ebe500 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -1,22 +1,22 @@
 {
     "4.14": {
-        "name": "linux-hardened-4.14.183.a.patch",
-        "sha256": "0k9dg37q3hcm13iyw662indwy23aylc03ldqfn7613c7ymqmbzj7",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.183.a/linux-hardened-4.14.183.a.patch"
+        "name": "linux-hardened-4.14.184.a.patch",
+        "sha256": "1g12kz6ikdwp6b7000pfy3myga90mvxyl04b9267fk88jwih6yhk",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.184.a/linux-hardened-4.14.184.a.patch"
     },
     "4.19": {
-        "name": "linux-hardened-4.19.127.a.patch",
-        "sha256": "00nfcs5yn2a70an3ygzzv4s3qa3hf7pni4ad70aw87vyvrqlyx3k",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.127.a/linux-hardened-4.19.127.a.patch"
+        "name": "linux-hardened-4.19.128.a.patch",
+        "sha256": "19ayzx9rf4j31ypavxwamd290lm95wmi7v165avxslahnx6pdsxs",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.128.a/linux-hardened-4.19.128.a.patch"
     },
     "5.4": {
-        "name": "linux-hardened-5.4.45.a.patch",
-        "sha256": "0gihrcxqg3hax20xhvna4lmgsivari6wwsyqz09w34v8p1fhd5nx",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.45.a/linux-hardened-5.4.45.a.patch"
+        "name": "linux-hardened-5.4.46.a.patch",
+        "sha256": "0f2d53na7g6dhiba2ym09lm4fp3hwm6kw6mpm5jk46jmb6j7iwk5",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.46.a/linux-hardened-5.4.46.a.patch"
     },
     "5.6": {
-        "name": "linux-hardened-5.6.17.a.patch",
-        "sha256": "0nci30k7xh56b6454cd0hkpvpkfqb98cqdpvjaamlnmiphz4sk1f",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.6.17.a/linux-hardened-5.6.17.a.patch"
+        "name": "linux-hardened-5.6.18.a.patch",
+        "sha256": "0idvgjg7kji4w3341acfqywi0qqn3pvxcmiz70cd7inhlqaqrw63",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.6.18.a/linux-hardened-5.6.18.a.patch"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index f2f0fac3b7dd..2a7a1fa93425 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,15 +3,15 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.7-rc6";
-  extraMeta.branch = "5.7";
+  version = "5.8-rc1";
+  extraMeta.branch = "5.1";
 
   # modDirVersion needs to be x.y.z, will always add .0
   modDirVersion = if (modDirVersionArg == null) then builtins.replaceStrings ["-"] [".0-"] version else modDirVersionArg;
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "0g04zwdxks7pa5q6shl5xl2rml1w95rxq7sqkkadj11mpk2k89w4";
+    sha256 = "1gb7g2vrgg0zz281lv1ir1r0535spc40j65p0azmdxlk24fkfxfc";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch b/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
index 23aa893362b5..a9b60cbb2e20 100644
--- a/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
+++ b/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
@@ -24,8 +24,8 @@ index 8331832c7a..bedb97115d 100644
  systemduserconfdir=${sysconfdir}/systemd/user
 -systemdsystemunitpath=${systemdsystemconfdir}:/etc/systemd/system:/run/systemd/system:/usr/local/lib/systemd/system:${systemdsystemunitdir}:/usr/lib/systemd/system:/lib/systemd/system
 -systemduserunitpath=${systemduserconfdir}:/etc/systemd/user:/run/systemd/user:/usr/local/lib/systemd/user:/usr/local/share/systemd/user:${systemduserunitdir}:/usr/lib/systemd/user:/usr/share/systemd/user
-+systemdsystemunitpath=${systemdsystemconfdir}:/etc/systemd/system:/etc/systemd-mutable/system:/nix/var/nix/profiles/default/lib/systemd/user:/run/systemd/system:${systemdsystemunitdir}
-+systemduserunitpath=${systemduserconfdir}:/etc/systemd/user:/etc/systemd-mutable/user:/nix/var/nix/profiles/default/lib/systemd/system:/run/systemd/user:${systemduserunitdir}
++systemdsystemunitpath=${systemdsystemconfdir}:/etc/systemd/system:/etc/systemd-mutable/system:/nix/var/nix/profiles/default/lib/systemd/system:/run/systemd/system:${systemdsystemunitdir}
++systemduserunitpath=${systemduserconfdir}:/etc/systemd/user:/etc/systemd-mutable/user:/nix/var/nix/profiles/default/lib/systemd/user:/run/systemd/user:${systemduserunitdir}
  systemdsystemgeneratordir=${rootprefix}/lib/systemd/system-generators
  systemdusergeneratordir=${prefix}/lib/systemd/user-generators
  systemdsystemgeneratorpath=/run/systemd/system-generators:/etc/systemd/system-generators:/usr/local/lib/systemd/system-generators:${systemdsystemgeneratordir}
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 722b4db9a80a..3235fb3b95cd 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -66,9 +66,6 @@ in stdenv.mkDerivation {
 
   postPatch = ''
     substituteInPlace src/basic/path-util.h --replace "@defaultPathNormal@" "${placeholder "out"}/bin/"
-  ''
-    # TODO: unconditionalize on the next rebuild
-  + stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
     substituteInPlace src/boot/efi/meson.build \
       --replace \
       "find_program('ld'" \
diff --git a/pkgs/servers/consul/default.nix b/pkgs/servers/consul/default.nix
index a702626e1c14..d550a5cb699e 100644
--- a/pkgs/servers/consul/default.nix
+++ b/pkgs/servers/consul/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "consul";
-  version = "1.7.3";
+  version = "1.7.4";
   rev = "v${version}";
 
   # Note: Currently only release tags are supported, because they have the Consul UI
@@ -17,7 +17,7 @@ buildGoModule rec {
     owner = "hashicorp";
     repo = pname;
     inherit rev;
-    sha256 = "05p893mfdrlf5fy9ywwnqb7blw1ffidgviyyh6a3bp82wk49f8ph";
+    sha256 = "0yx0ry8gwgvw1mkz3nv4rn2pwslm0q7jxlk70gaw6386mxxmj0sk";
   };
 
   passthru.tests.consul = nixosTests.consul;
diff --git a/pkgs/servers/mail/mailman/default.nix b/pkgs/servers/mail/mailman/default.nix
index 8443a1968fdf..37b4d29eeb16 100644
--- a/pkgs/servers/mail/mailman/default.nix
+++ b/pkgs/servers/mail/mailman/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "mailman";
-  version = "3.3.0";
+  version = "3.3.1";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1qph9i93ndahfxi3bb2sd0kjm2c0pkh844ai6zacfmvihl1k3pvy";
+    sha256 = "0idfiv48jjgc0jq4731094ddhraqq8bxnwmjk6sg5ask0jss9kxq";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/servers/mail/mailman/hyperkitty.nix b/pkgs/servers/mail/mailman/hyperkitty.nix
index 57c1b355bf26..5ed5b74d309a 100644
--- a/pkgs/servers/mail/mailman/hyperkitty.nix
+++ b/pkgs/servers/mail/mailman/hyperkitty.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "HyperKitty";
-  version = "1.3.2";
+  version = "1.3.3";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "092fkv0xyf5vgj33xwq0mh9h5c5d56ifwimaqbfpx5cwc6yivb88";
+    sha256 = "0p85r9q6mn5as5b39xp9hkkipnk0156acx540n2ygk3qb3jd4a5n";
   };
 
   nativeBuildInputs = [ isort ];
diff --git a/pkgs/servers/mail/mailman/postorius.nix b/pkgs/servers/mail/mailman/postorius.nix
index 5f542b9036ea..ae797fa6cbc7 100644
--- a/pkgs/servers/mail/mailman/postorius.nix
+++ b/pkgs/servers/mail/mailman/postorius.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "postorius";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0wrm0hda7ym9qaygxirqaaii66ndmgyy7gx8wqdg07pfx14zcyja";
+    sha256 = "08jn23gblbkfl09qlykbpsmp39mmach3sl69h1j5cd5kkx839rwa";
   };
 
   propagatedBuildInputs = [ django-mailman3 readme_renderer ];
diff --git a/pkgs/servers/mail/postfix/default.nix b/pkgs/servers/mail/postfix/default.nix
index 3b14fab68753..585a6196831b 100644
--- a/pkgs/servers/mail/postfix/default.nix
+++ b/pkgs/servers/mail/postfix/default.nix
@@ -26,11 +26,11 @@ in stdenv.mkDerivation rec {
 
   pname = "postfix";
 
-  version = "3.5.2";
+  version = "3.5.3";
 
   src = fetchurl {
     url = "ftp://ftp.cs.uu.nl/mirror/postfix/postfix-release/official/${pname}-${version}.tar.gz";
-    sha256 = "1hxy9458apnzfg4n0alncsdgy5dwzn5dbn4xm46iv15xynbj9gz3";
+    sha256 = "0xcd9pmv2p4znn6bqvka19h5h2lw90inyxrm5020acd0yaf0i0g3";
   };
 
   nativeBuildInputs = [ makeWrapper m4 ];
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 8ba7e9c96cfc..2b440f78e99d 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -182,41 +182,41 @@ let
 in self: {
 
   postgresql_9_5 = self.callPackage generic {
-    version = "9.5.21";
+    version = "9.5.22";
     psqlSchema = "9.5";
-    sha256 = "0b3kzc0431bvp55jns42q9h1119gy075mp4aywnkq93pm17nxdby";
+    sha256 = "03v4d4nr9f86y0i1j5jmvfan5w8y4ga1mar59lhcnj3jl5q58ma8";
     this = self.postgresql_9_5;
     inherit self;
   };
 
   postgresql_9_6 = self.callPackage generic {
-    version = "9.6.17";
+    version = "9.6.18";
     psqlSchema = "9.6";
-    sha256 = "1hm0w6n988n9qn2wylhjq02i5ayzb16rzhgkcv09fpsl68ny7qgn";
+    sha256 = "16crr2a1sl97aiacqzd0bk56yl1abq6blc0c6qpx5rl5ny1c4zji";
     this = self.postgresql_9_6;
     inherit self;
   };
 
   postgresql_10 = self.callPackage generic {
-    version = "10.12";
+    version = "10.13";
     psqlSchema = "10.0"; # should be 10, but changing it is invasive
-    sha256 = "1rsab4zf4rx7pvvhlwhb04kb95aiad9cwazc4ksbvg2gij47z3rq";
+    sha256 = "1qal0yp7a90yzya7hl56gsmw5fvacplrdhpn7h9gnbyr1i2iyw2d";
     this = self.postgresql_10;
     inherit self;
   };
 
   postgresql_11 = self.callPackage generic {
-    version = "11.7";
+    version = "11.8";
     psqlSchema = "11.1"; # should be 11, but changing it is invasive
-    sha256 = "04x343i4v0w4jf1v5ial8rwsizs1qhdjfbanbnibdys6i0xfjjij";
+    sha256 = "1qksqyayxmnccmbapg3ajsw9pjgqva0inxjhx64rqd6ckhrg9wpa";
     this = self.postgresql_11;
     inherit self;
   };
 
   postgresql_12 = self.callPackage generic {
-    version = "12.2";
+    version = "12.3";
     psqlSchema = "12";
-    sha256 = "1pmmd59pvfs50gsi728bw9f1jl59xghsjdanfimph0659x6cq7dd";
+    sha256 = "0hfg3n7rlz96579cj3z1dh2idl15rh3wfvn8jl31jj4h2yk69vcl";
     this = self.postgresql_12;
     inherit self;
   };
diff --git a/pkgs/shells/fish/default.nix b/pkgs/shells/fish/default.nix
index 11d9e48008fa..420aac7607e4 100644
--- a/pkgs/shells/fish/default.nix
+++ b/pkgs/shells/fish/default.nix
@@ -125,6 +125,10 @@ let
       pcre2
     ];
 
+    cmakeFlags = [
+      "-DCMAKE_INSTALL_DOCDIR=${placeholder "out"}/share/doc/fish"
+    ];
+
     preConfigure = ''
       patchShebangs ./build_tools/git_version_gen.sh
     '';
diff --git a/pkgs/tools/audio/video2midi/default.nix b/pkgs/tools/audio/video2midi/default.nix
index dca8a0610da8..cf9297119e9f 100644
--- a/pkgs/tools/audio/video2midi/default.nix
+++ b/pkgs/tools/audio/video2midi/default.nix
@@ -8,7 +8,7 @@ let
   });
 in pythonPackages.buildPythonApplication rec {
   pname = "video2midi";
-  version = "0.4.0.1";
+  version = "0.4.0.2";
 
   format = "other";
 
@@ -16,7 +16,7 @@ in pythonPackages.buildPythonApplication rec {
     owner = "svsdval";
     repo = pname;
     rev = version;
-    sha256 = "1869w60kprjdikqk4iwx058zri2jg4aznzlg668w9myka4mp01r9";
+    sha256 = "174ijn8bc306529scd23szvgx1apanm2qmwk4lwmi64rhkm6dapx";
   };
 
   propagatedBuildInputs = with pythonPackages; [ opencv3_ midiutil pygame pyopengl ];
diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index eb42fdbaff4f..f919fb92ed1d 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -51,14 +51,16 @@ stdenv.mkDerivation rec {
   preInstall = ''
     substituteInPlace ../programs/zstdgrep \
       --replace ":-grep" ":-${gnugrep}/bin/grep" \
-      --replace ":-zstdcat" ":-$out/bin/zstdcat"
+      --replace ":-zstdcat" ":-$bin/bin/zstdcat"
 
     substituteInPlace ../programs/zstdless \
-      --replace "zstdcat" "$out/bin/zstdcat"
+      --replace "zstdcat" "$bin/bin/zstdcat"
   '';
   # Don't duplicate the library code in runtime closures.
   postInstall = stdenv.lib.optionalString enableShared ''rm "$out"/lib/libzstd.a'';
 
+  outputs = [ "bin" "dev" "man" "out" ];
+
   meta = with stdenv.lib; {
     description = "Zstandard real-time compression algorithm";
     longDescription = ''
diff --git a/pkgs/tools/filesystems/btrfs-progs/default.nix b/pkgs/tools/filesystems/btrfs-progs/default.nix
index 5c73ee945c79..5a6dafae2980 100644
--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "btrfs-progs";
-  version = "5.6";
+  version = "5.6.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    sha256 = "0srg276yccfmqz0skmmga3vbqx4wiqsk1l6h86n6ryhxa9viqcm1";
+    sha256 = "1nwnvjdnr9fjj2q2p2vpjabfdhcrwykgj9knjcsqy0c7p1bgbk2h";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/chezmoi/default.nix b/pkgs/tools/misc/chezmoi/default.nix
index 75b10bc32ca7..eb372b6b5671 100644
--- a/pkgs/tools/misc/chezmoi/default.nix
+++ b/pkgs/tools/misc/chezmoi/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "chezmoi";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "twpayne";
     repo = "chezmoi";
     rev = "v${version}";
-    sha256 = "1b8y0wq3myhvjdnwl0i4x85iil7i7kmsjajvbw1a47afm83jkbaw";
+    sha256 = "0s2a0q3lgrdz7w69sacn23k4dybw6wrk63xxnylj88wss7mqnpj8";
   };
 
-  vendorSha256 = "1za47n08iamhfl4ky928rixgadflmz86vnmnwbczd167bdndh5rq";
+  vendorSha256 = "0hpjvpai2i9jn8hlxhx4pvvawjh6lfmlz7ffi320pp7vanzqhch1";
 
   buildFlagsArray = [
     "-ldflags=-s -w -X main.version=${version} -X main.builtBy=nixpkgs"
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index c98ca9cc1661..dfd227f917ed 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, runCommand, makeWrapper, python3Packages, docutils, help2man
+{ lib, stdenv, fetchurl, fetchpatch, runCommand, makeWrapper, python3Packages, docutils, help2man
 , abootimg, acl, apktool, binutils-unwrapped, build-tools, bzip2, cbfstool, cdrkit, colord, colordiff, coreutils, cpio, db, diffutils, dtc
 , e2fsprogs, file, findutils, fontforge-fonttools, ffmpeg_4, fpc, gettext, ghc, ghostscriptX, giflib, gnumeric, gnupg, gnutar
 , gzip, hdf5, imagemagick, jdk, libarchive, libcaca, llvm, lz4, mono, openssh, openssl, pdftk, pgpdump, poppler_utils, qemu, R
@@ -16,11 +16,11 @@ let
 in
 python3Packages.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "146";
+  version = "147";
 
   src = fetchurl {
     url    = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    sha256 = "1iy4f05ws7qsd5p7hadc1979l77543pwi2c5zx1yr5zc674kwb3y";
+    sha256 = "1pichn3l10401cqk08zrys2ya9b6cjznk7ra28awnmvlg6l1cypj";
   };
 
   outputs = [ "out" "man" ];
@@ -28,6 +28,12 @@ python3Packages.buildPythonApplication rec {
   patches = [
     ./ignore_links.patch
     ./skip-failing-test.patch
+
+    # Fix for CBFS comparator
+    (fetchpatch {
+      url = "https://salsa.debian.org/reproducible-builds/diffoscope/-/commit/39ec527371c469d61e4afc04b3ee6ae3563f7b4c.patch";
+      sha256 = "1mzdcbxg3ad5ynpf79phvif5hzckmhf7vzd82l1sffhlqxh0v4h3";
+    })
   ];
 
   postPatch = ''
@@ -82,7 +88,7 @@ python3Packages.buildPythonApplication rec {
     '';
     homepage    = "https://diffoscope.org/";
     license     = licenses.gpl3Plus;
-    maintainers = with maintainers; [ dezgeg ma27 ];
+    maintainers = with maintainers; [ dezgeg ma27 danielfullmer ];
     platforms   = platforms.unix;
   };
 }
diff --git a/pkgs/tools/misc/fontforge/default.nix b/pkgs/tools/misc/fontforge/default.nix
index 67ab7b2d6917..82fd5c8210dd 100644
--- a/pkgs/tools/misc/fontforge/default.nix
+++ b/pkgs/tools/misc/fontforge/default.nix
@@ -1,21 +1,24 @@
 { stdenv, fetchurl, lib
-, autoconf, automake, gnum4, libtool, perl, uthash, pkgconfig, gettext
+, cmake, perl, uthash, pkgconfig, gettext
 , python, freetype, zlib, glib, libungif, libpng, libjpeg, libtiff, libxml2, cairo, pango
 , readline, woff2, zeromq, libuninameslist
 , withSpiro ? false, libspiro
-, withGTK ? false, gtk2
+, withGTK ? false, gtk3
+, withGUI ? withGTK
 , withPython ? true
 , withExtras ? true
 , Carbon ? null, Cocoa ? null
 }:
 
+assert withGTK -> withGUI;
+
 stdenv.mkDerivation rec {
   pname = "fontforge";
-  version = "20190801";
+  version = "20200314";
 
   src = fetchurl {
-    url = "https://github.com/${pname}/${pname}/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "0lh8yx01asbzxm6car5cfi64njh5p4lxc7iv8dldr5rwg357a86r";
+    url = "https://github.com/${pname}/${pname}/releases/download/${version}/${pname}-${version}.tar.xz";
+    sha256 = "0qf88wd6riycq56d24brybyc93ns74s0nyyavm43zp2kfcihn6fd";
   };
 
   # use $SOURCE_DATE_EPOCH instead of non-deterministic timestamps
@@ -30,41 +33,33 @@ stdenv.mkDerivation rec {
   # do not use x87's 80-bit arithmetic, rouding errors result in very different font binaries
   NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isi686 "-msse2 -mfpmath=sse";
 
-  nativeBuildInputs = [ pkgconfig autoconf automake gnum4 libtool perl gettext ];
+  nativeBuildInputs = [ pkgconfig cmake ];
   buildInputs = [
     readline uthash woff2 zeromq libuninameslist
     python freetype zlib glib libungif libpng libjpeg libtiff libxml2
   ]
     ++ lib.optionals withSpiro [libspiro]
-    ++ lib.optionals withGTK [ gtk2 cairo pango ]
+    ++ lib.optionals withGUI [ gtk3 cairo pango ]
     ++ lib.optionals stdenv.isDarwin [ Carbon Cocoa ];
 
-    configureFlags = [ "--enable-woff2" ]
-    ++ lib.optionals (!withPython) [ "--disable-python-scripting" "--disable-python-extension" ]
-    ++ lib.optional withGTK "--enable-gtk2-use"
-    ++ lib.optional (!withGTK) "--without-x"
-    ++ lib.optional withExtras "--enable-fontforge-extras";
+  cmakeFlags = [ "-DCMAKE_BUILD_WITH_INSTALL_RPATH=ON" ]
+    ++ lib.optional (!withSpiro) "-DENABLE_LIBSPIRO=OFF"
+    ++ lib.optional (!withGUI) "-DENABLE_GUI=OFF"
+    ++ lib.optional (!withGTK) "-DENABLE_X11=ON"
+    ++ lib.optional withExtras "-DENABLE_FONTFORGE_EXTRAS=ON";
 
   # work-around: git isn't really used, but configuration fails without it
   preConfigure = ''
     # The way $version propagates to $version of .pe-scripts (https://github.com/dejavu-fonts/dejavu-fonts/blob/358190f/scripts/generate.pe#L19)
     export SOURCE_DATE_EPOCH=$(date -d ${version} +%s)
-
-    export GIT="$(type -P true)"
-    ./bootstrap --skip-git --force
   '';
 
-  doCheck = false; # tries to wget some fonts
-  doInstallCheck = doCheck;
-
   postInstall =
     # get rid of the runtime dependency on python
     lib.optionalString (!withPython) ''
       rm -r "$out/share/fontforge/python"
     '';
 
-  enableParallelBuilding = true;
-
   meta = {
     description = "A font editor";
     homepage = "http://fontforge.github.io";
diff --git a/pkgs/tools/misc/hexyl/default.nix b/pkgs/tools/misc/hexyl/default.nix
index e67b0116df16..d9bed8c607d0 100644
--- a/pkgs/tools/misc/hexyl/default.nix
+++ b/pkgs/tools/misc/hexyl/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname   = "hexyl";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner  = "sharkdp";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "0blq81zpmzldngk9ymcg56syspjp1g1ziap4z69idv05mfkf6sp3";
+    sha256 = "0aj2sysl0spf5zlcd5kfzlw97w7dzf9x93pv0d1v9blnbd1rz7lm";
   };
 
-  cargoSha256 = "09kccd1brcbvzimm05dyybwrkganqxdkjrvzgcf1l93xs1z2h94b";
+  cargoSha256 = "1am9vs7l2wzgwqakrsl27x1y7jpn9xaqa4kr48wwqzka401h6j4m";
 
   meta = with stdenv.lib; {
     changelog = "https://github.com/sharkdp/hexyl/releases/tag/v${version}";
diff --git a/pkgs/tools/misc/lazydocker/default.nix b/pkgs/tools/misc/lazydocker/default.nix
index b63892178d91..d0c4d71c58a6 100644
--- a/pkgs/tools/misc/lazydocker/default.nix
+++ b/pkgs/tools/misc/lazydocker/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "lazydocker";
-  version = "0.8";
+  version = "0.9";
 
   src = fetchFromGitHub {
     owner = "jesseduffield";
     repo = "lazydocker";
     rev = "v${version}";
-    sha256 = "02x03nmkbj0133bziaqmqlh3x515w3n01iqvg7q6b55r7nan7hv7";
+    sha256 = "08j2qp632fdmswnb92wxa9lhnal4mrmq6gmxaxngnxiqgkfx37zy";
   };
 
   goPackagePath = "github.com/jesseduffield/lazydocker";
diff --git a/pkgs/tools/misc/pistol/default.nix b/pkgs/tools/misc/pistol/default.nix
index eeb392606edd..5c92b70c0983 100644
--- a/pkgs/tools/misc/pistol/default.nix
+++ b/pkgs/tools/misc/pistol/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "pistol";
-  version = "0.1.1";
+  version = "0.1.2";
 
   src = fetchFromGitHub {
     owner = "doronbehar";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1d9c1bhidh781dis4427wramfrla4avqw9y2bmpjp81cqq3nc27d";
+    sha256 = "1ar8c7s8ihcwrwfspmqw7cb5560wkbdc5qyvddkx8lj03cjhcslj";
   };
 
-  vendorSha256 = "1f780vhxw0brvnr8hhah4sf6ms8spar29rqmy1kcqf9m75n94g56";
+  vendorSha256 = "1mhxb72fzpa2n88i9h154aci346dgcs2njznkjxchivz28crbqr8";
 
   subPackages = [ "cmd/pistol" ];
 
diff --git a/pkgs/tools/misc/rmlint/default.nix b/pkgs/tools/misc/rmlint/default.nix
index 4dd440850120..2ea1668409a5 100644
--- a/pkgs/tools/misc/rmlint/default.nix
+++ b/pkgs/tools/misc/rmlint/default.nix
@@ -5,13 +5,13 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "rmlint";
-  version = "2.10.0";
+  version = "2.10.1";
 
   src = fetchFromGitHub {
     owner = "sahib";
     repo = "rmlint";
     rev = "v${version}";
-    sha256 = "1r7j1bmm83p6wdw0jhvkm4sa568r534zsy45bvas7qq4433jl019";
+    sha256 = "15xfkcw1bkfyf3z8kl23k3rlv702m0h7ghqxvhniynvlwbgh6j2x";
   };
 
   CFLAGS="-I${stdenv.lib.getDev utillinux}/include";
diff --git a/pkgs/tools/misc/topgrade/default.nix b/pkgs/tools/misc/topgrade/default.nix
index 529252901a4a..21e464c6d29e 100644
--- a/pkgs/tools/misc/topgrade/default.nix
+++ b/pkgs/tools/misc/topgrade/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "topgrade";
-  version = "4.5.0";
+  version = "4.7.0";
 
   src = fetchFromGitHub {
     owner = "r-darwish";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0df79vlbclv1qx4zwir728c6ggqfawxh2x1py16m5q0ga1hd799j";
+    sha256 = "1hg03mj3rd778hq1856139nwz7y5gykwvg7xhxlsiabv7gr06m2m";
   };
 
-  cargoSha256 = "0wwxh71i94h68sryckbvrr43gd19qjcs0cgcpycnimkhdcdy8nlj";
+  cargoSha256 = "14qv2157jhj7hilvqi3c00p11rzv0vvimr4d34nyspgzxz2si6sm";
 
   buildInputs = lib.optional stdenv.isDarwin Foundation;
 
diff --git a/pkgs/tools/misc/ttwatch/default.nix b/pkgs/tools/misc/ttwatch/default.nix
index afd5139565c8..8788608876ea 100644
--- a/pkgs/tools/misc/ttwatch/default.nix
+++ b/pkgs/tools/misc/ttwatch/default.nix
@@ -1,19 +1,21 @@
-{ stdenv, fetchFromGitHub, cmake, perl, openssl, curl, libusb1
+{ stdenv, fetchFromGitHub
+, cmake, perl, pkgconfig
+, openssl, curl, libusb1, protobufc
 , enableUnsafe ? false }:
 
 stdenv.mkDerivation {
   pname = "ttwatch";
-  version = "2018-12-04";
+  version = "2020-02-05";
 
   src = fetchFromGitHub {
     owner = "ryanbinns";
     repo = "ttwatch";
-    rev = "eeb4e19bf7ca7ca2cee7f5fbeb483b27198d86a1";
-    sha256 = "18384apdkq35120cgmda686d293354aibwcq2hwhvvjmnq49fnzr";
+    rev = "bfdf1372515574e1fb3871dc1039f8d8a5dbdada";
+    sha256 = "07nd4dbkchxy8js1h1f6pzn63pls2afww97wyiiw6zid43mpqyg4";
   };
 
-  nativeBuildInputs = [ cmake perl ];
-  buildInputs = [ openssl curl libusb1 ];
+  nativeBuildInputs = [ cmake perl pkgconfig ];
+  buildInputs = [ openssl curl libusb1 protobufc ];
 
   cmakeFlags = stdenv.lib.optional enableUnsafe [ "-Dunsafe=on" ];
 
diff --git a/pkgs/tools/networking/amass/default.nix b/pkgs/tools/networking/amass/default.nix
index ebe67b27e7c7..e2bc592f7a8f 100644
--- a/pkgs/tools/networking/amass/default.nix
+++ b/pkgs/tools/networking/amass/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "amass";
-  version = "3.6.2";
+  version = "3.7.2";
 
   src = fetchFromGitHub {
     owner = "OWASP";
     repo = "Amass";
     rev = "v${version}";
-    sha256 = "1ih681790sp0lqfbsl153dpr5vzxp1jjza28pajrqjzs7zyjmkgs";
+    sha256 = "1acjqpa9xg9ji2mzxag57yq589cdq3rh78a8vz8wnkkkp7b8why8";
   };
 
-  vendorSha256 = "1f8za3z5pv1pznbd91fk5j4y8qg93qk5zvnchjl7inyirciawdf6";
+  vendorSha256 = "1s8g0qqg3m6hdvc5v3s86l3ba5grmyhx0lf2ymi39k5dpcg8l19s";
 
   outputs = [ "out" "wordlists" ];
 
diff --git a/pkgs/tools/networking/cassowary/default.nix b/pkgs/tools/networking/cassowary/default.nix
index be1df3394396..e76a505fe9d7 100644
--- a/pkgs/tools/networking/cassowary/default.nix
+++ b/pkgs/tools/networking/cassowary/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "cassowary";
-  version = "0.7.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "rogerwelin";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0p5vcs25h5nj36dm9yjmdjymcq0zldm3zlqfppxcjx862h48k8zj";
+    sha256 = "161wzcdq7kpny6fzxsqk2ivnah0xwmh2knv37jn0x18lclga1k9s";
   };
 
-  vendorSha256 = "1m5jaqf5jrib415k0i7w6rf5bjjwfn572wk94jwfpwjcbbvh8fck";
+  vendorSha256 = "1qgilmkai9isbbg4pzqic6i8v5z8cay0ilw1gb69z4a6f2q4zhkp";
 
   buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
 
diff --git a/pkgs/tools/networking/findomain/default.nix b/pkgs/tools/networking/findomain/default.nix
index e19442576988..69e09b60d02a 100644
--- a/pkgs/tools/networking/findomain/default.nix
+++ b/pkgs/tools/networking/findomain/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "findomain";
-  version = "1.5.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "Edu4rdSHL";
     repo = pname;
     rev = version;
-    sha256 = "1w3parmk3836v5ghn3cgcxyk0alk05r5ljl3j1fpnly5xvl131rd";
+    sha256 = "1q8yxl4y8f787a0q87gxgj1p9lgzhhfk3fgysq9xj8yfvwm8abji";
   };
 
-  cargoSha256 = "1cs076cgkzjan6y78a3bhriv2q2s83hp5vzhkjwz4dqn83r6b8hx";
+  cargoSha256 = "02d538j13v3f1dc99vpzhby42ps7lig000idwdsxa1mwkjxrf2z2";
 
   nativeBuildInputs = [ installShellFiles perl ];
   buildInputs = lib.optional stdenv.isDarwin Security;
diff --git a/pkgs/tools/package-management/cargo-deb/default.nix b/pkgs/tools/package-management/cargo-deb/default.nix
index c6e8b4803ccf..96ef0eef8c5a 100644
--- a/pkgs/tools/package-management/cargo-deb/default.nix
+++ b/pkgs/tools/package-management/cargo-deb/default.nix
@@ -2,7 +2,9 @@
 , lib
 , fetchFromGitHub
 , rustPlatform
-, Security }:
+, rust
+, Security
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-deb";
@@ -19,6 +21,13 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "1vqnnqn6rzkdi239bh3lk7gaxr7w6v3c4ws4ya1ah04g6v9hkzlw";
 
+  checkType = "debug";
+
+  preCheck = ''
+    substituteInPlace tests/command.rs \
+      --replace 'target/debug' "target/${rust.toRustTarget stdenv.buildPlatform}/debug"
+  '';
+
   meta = with lib; {
     description = "Generate Debian packages from information in Cargo.toml";
     homepage = "https://github.com/mmstick/cargo-deb";
diff --git a/pkgs/tools/package-management/nix-universal-prefetch/default.nix b/pkgs/tools/package-management/nix-universal-prefetch/default.nix
index 7079904735d7..224ccd1cd9ed 100644
--- a/pkgs/tools/package-management/nix-universal-prefetch/default.nix
+++ b/pkgs/tools/package-management/nix-universal-prefetch/default.nix
@@ -6,13 +6,13 @@
 # No gems used, so mkDerivation is fine.
 stdenv.mkDerivation rec {
   pname = "nix-universal-prefetch";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "samueldr";
     repo = "nix-universal-prefetch";
     rev = "v${version}";
-    sha256 = "1id9iaibrm2d3fa9dkcxnb3sd0j1vh502181gdd199a1cfsmzh1i";
+    sha256 = "1nmxp6846ip2x3mibys3ymgi0813g18p9szqnsciiib3dbis4kwf";
   };
 
   installPhase = ''
diff --git a/pkgs/tools/package-management/rpm/default.nix b/pkgs/tools/package-management/rpm/default.nix
index fdcf9832e667..fee282de52fc 100644
--- a/pkgs/tools/package-management/rpm/default.nix
+++ b/pkgs/tools/package-management/rpm/default.nix
@@ -1,15 +1,15 @@
-{ stdenv
+{ stdenv, lib
 , pkgconfig, autoreconfHook
 , fetchurl, cpio, zlib, bzip2, file, elfutils, libbfd, libarchive, nspr, nss, popt, db, xz, python, lua
 }:
 
 stdenv.mkDerivation rec {
   pname = "rpm";
-  version = "4.14.2.1";
+  version = "4.15.1";
 
   src = fetchurl {
-    url = "http://ftp.rpm.org/releases/rpm-4.14.x/rpm-${version}.tar.bz2";
-    sha256 = "1nmck2fq9h85fgs3zhh6w1avlw5y16cbz5khd459ry3jfd5w4f8i";
+    url = "http://ftp.rpm.org/releases/rpm-${lib.versions.majorMinor version}.x/rpm-${version}.tar.bz2";
+    sha256 = "0c6jwail90fhha3bpx70w4a2i8ycxwvnx6zwxm121l8wc3wlbvyx";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/tools/security/bundler-audit/Gemfile.lock b/pkgs/tools/security/bundler-audit/Gemfile.lock
index 107e425bc579..f130b57912b4 100644
--- a/pkgs/tools/security/bundler-audit/Gemfile.lock
+++ b/pkgs/tools/security/bundler-audit/Gemfile.lock
@@ -1,10 +1,10 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    bundler-audit (0.6.1)
+    bundler-audit (0.7.0.1)
       bundler (>= 1.2.0, < 3)
-      thor (~> 0.18)
-    thor (0.20.3)
+      thor (>= 0.18, < 2)
+    thor (1.0.1)
 
 PLATFORMS
   ruby
diff --git a/pkgs/tools/security/bundler-audit/default.nix b/pkgs/tools/security/bundler-audit/default.nix
index 6bcb341a8343..c24831f26b06 100644
--- a/pkgs/tools/security/bundler-audit/default.nix
+++ b/pkgs/tools/security/bundler-audit/default.nix
@@ -21,6 +21,7 @@ bundlerEnv rec {
       - Does not require a network connection.
     '';
     homepage    = "https://github.com/rubysec/bundler-audit";
+    changelog   = "https://github.com/rubysec/bundler-audit/blob/v${version}/ChangeLog.md";
     license     = licenses.gpl3Plus;
     maintainers = with maintainers; [ primeos nicknovitski ];
     platforms   = platforms.unix;
diff --git a/pkgs/tools/security/bundler-audit/gemset.nix b/pkgs/tools/security/bundler-audit/gemset.nix
index 56d78b3e8f16..2121a3c08e55 100644
--- a/pkgs/tools/security/bundler-audit/gemset.nix
+++ b/pkgs/tools/security/bundler-audit/gemset.nix
@@ -1,19 +1,23 @@
 {
   bundler-audit = {
     dependencies = ["thor"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0pm22xpn3xyymsainixnrk8v3l3xi9bzwkjkspx00cfzp84xvxbq";
+      sha256 = "04l9rs56rlvihbr2ybkrigjajgd3swa98lxvmdl8iylj1g5m7n0j";
       type = "gem";
     };
-    version = "0.6.1";
+    version = "0.7.0.1";
   };
   thor = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1yhrnp9x8qcy5vc7g438amd5j9sw83ih7c30dr6g6slgw9zj3g29";
+      sha256 = "1xbhkmyhlxwzshaqa7swy2bx6vd64mm0wrr8g3jywvxy7hg0cwkm";
       type = "gem";
     };
-    version = "0.20.3";
+    version = "1.0.1";
   };
 }
\ No newline at end of file
diff --git a/pkgs/tools/security/chipsec/default.nix b/pkgs/tools/security/chipsec/default.nix
index 387fa4d750bd..5dccf295065c 100644
--- a/pkgs/tools/security/chipsec/default.nix
+++ b/pkgs/tools/security/chipsec/default.nix
@@ -2,13 +2,13 @@
 , kernel ? null, withDriver ? false }:
 pythonPackages.buildPythonApplication rec {
   pname = "chipsec";
-  version = "1.4.9";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "chipsec";
     repo = "chipsec";
     rev = version;
-    sha256 = "1p6w8294w5z2f4jwc22mqaggv5qajvmf9iifv7fl7wdz3wsvskrk";
+    sha256 = "1rxr9i08a22m15slvlkrhnki30jixi2ds096kmmc2nqzfr9yibmb";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/keybase/default.nix b/pkgs/tools/security/keybase/default.nix
index bbc99c2ac410..ee1cfa9d2a41 100644
--- a/pkgs/tools/security/keybase/default.nix
+++ b/pkgs/tools/security/keybase/default.nix
@@ -6,7 +6,7 @@
 
 buildGoPackage rec {
   pname = "keybase";
-  version = "5.4.2";
+  version = "5.5.1";
 
   goPackagePath = "github.com/keybase/client";
   subPackages = [ "go/kbnm" "go/keybase" ];
@@ -17,7 +17,7 @@ buildGoPackage rec {
     owner = "keybase";
     repo = "client";
     rev = "v${version}";
-    sha256 = "08lw5aw962f75xi42bwbgba94hiql2n2jnsxrkx84czi0ijs1wlr";
+    sha256 = "03y69zmzbnfay173xkbzvnhh8zjjd2rfnqmpgr0wvh1psn7mgpsh";
   };
 
   patches = [
diff --git a/pkgs/tools/security/keycard-cli/default.nix b/pkgs/tools/security/keycard-cli/default.nix
index a76c102b2bb9..73eab6c3dec9 100644
--- a/pkgs/tools/security/keycard-cli/default.nix
+++ b/pkgs/tools/security/keycard-cli/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "keycard-cli";
-  version = "0.0.12";
+  version = "0.4.0";
 
   goPackagePath = "github.com/status-im/keycard-cli";
   subPackages = [ "." ];
@@ -14,7 +14,7 @@ buildGoPackage rec {
     owner = "status-im";
     repo = pname;
     rev = version;
-    sha256 = "1jnbaq57i6i9bad1hcvd28mxfqq6v8rv806c6l74vlb79ff4v1wb";
+    sha256 = "0917vl5lw8wgvyn5l8q6xa8bqh342fibaa38syr8hmz8b09qkh38";
   };
 
   buildFlagsArray = [
diff --git a/pkgs/tools/security/ripasso/cursive.nix b/pkgs/tools/security/ripasso/cursive.nix
index c8a55d3f397f..29229bff0028 100644
--- a/pkgs/tools/security/ripasso/cursive.nix
+++ b/pkgs/tools/security/ripasso/cursive.nix
@@ -12,6 +12,8 @@ buildRustPackage rec {
     sha256 = "164da20j727p8l7hh37j2r8pai9sj402nhswvg0nrlgj53nr6083";
   };
 
+  patches = [ ./fix-tests.patch ];
+
   cargoSha256 = "1wpn67v0xmxhn1dgzhh1pwz1yc3cizmfxhpb7qv9b27ynx4486ji";
 
   cargoBuildFlags = [ "-p ripasso-cursive -p ripasso-man" ];
diff --git a/pkgs/tools/security/ripasso/fix-tests.patch b/pkgs/tools/security/ripasso/fix-tests.patch
new file mode 100644
index 000000000000..433ff933b1f7
--- /dev/null
+++ b/pkgs/tools/security/ripasso/fix-tests.patch
@@ -0,0 +1,35 @@
+diff --git a/src/pass/test.rs b/src/pass/test.rs
+index c980a2f..2e6c8cc 100644
+--- a/src/pass/test.rs
++++ b/src/pass/test.rs
+@@ -56,6 +56,7 @@ fn populate_password_list_small_repo() {
+     base_path.pop();
+     base_path.pop();
+     base_path.pop();
++    base_path.pop();
+     base_path.push("testres");
+ 
+     let mut password_dir: PathBuf = base_path.clone();
+@@ -84,6 +85,7 @@ fn populate_password_list_repo_with_deleted_files() {
+     base_path.pop();
+     base_path.pop();
+     base_path.pop();
++    base_path.pop();
+     base_path.push("testres");
+ 
+     let mut password_dir: PathBuf = base_path.clone();
+@@ -112,6 +114,7 @@ fn populate_password_list_directory_without_git() {
+     base_path.pop();
+     base_path.pop();
+     base_path.pop();
++    base_path.pop();
+     base_path.push("testres");
+ 
+     let mut password_dir: PathBuf = base_path.clone();
+@@ -149,4 +152,4 @@ fn parse_signing_keys_empty() {
+     let result = PasswordStore::parse_signing_keys(&None).unwrap();
+ 
+     assert_eq!(result.len(), 0);
+-}
+\ No newline at end of file
++}
diff --git a/pkgs/tools/security/saml2aws/default.nix b/pkgs/tools/security/saml2aws/default.nix
index 42845705ff6b..d3157529215b 100644
--- a/pkgs/tools/security/saml2aws/default.nix
+++ b/pkgs/tools/security/saml2aws/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "saml2aws";
-  version = "2.25.0";
+  version = "2.26.1";
 
   src = fetchFromGitHub {
     owner = "Versent";
     repo = "saml2aws";
     rev = "v${version}";
-    sha256 = "12aidylamrq4rvy2cfdz669lr1p20yqrshigcc5x1hrlhh9y64xc";
+    sha256 = "09b217x10mn3y244rwym0fcqr4ly6n83wnykb77488kn960b0pqb";
   };
 
   hid = fetchFromGitHub {
diff --git a/pkgs/tools/system/gotop/default.nix b/pkgs/tools/system/gotop/default.nix
index bc6d24cf9175..0d8deb11b9e1 100644
--- a/pkgs/tools/system/gotop/default.nix
+++ b/pkgs/tools/system/gotop/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gotop";
-  version = "3.5.3";
+  version = "4.0.1";
 
   src = fetchFromGitHub {
     owner = "xxxserxxx";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0m1a5bdqjgsm9fy3d2c6r4nil013cizqyqf19k6r4p9bq8rajnzp";
+    sha256 = "10qfzmq1wdgpvv319khzicalix1x4fqava0wry3bzz84k5c9dabs";
   };
 
-  vendorSha256 = "1pxp0a1hldkdmh174adhq8q0wyz005g7wm8yxknchvp7krxi9r0v";
+  vendorSha256 = "1crphp41bfivfmfp3cl7pjca3ypds6mr3847msd4wvfq4g6imk55";
 
   meta = with stdenv.lib; {
     description = "A terminal based graphical activity monitor inspired by gtop and vtop";
diff --git a/pkgs/tools/system/inxi/default.nix b/pkgs/tools/system/inxi/default.nix
index df2e1b229f7b..bb3ba6ec3713 100644
--- a/pkgs/tools/system/inxi/default.nix
+++ b/pkgs/tools/system/inxi/default.nix
@@ -22,13 +22,13 @@ let
     ++ recommendedDisplayInformationPrograms;
 in stdenv.mkDerivation rec {
   pname = "inxi";
-  version = "3.1.01-1";
+  version = "3.1.03-1";
 
   src = fetchFromGitHub {
     owner = "smxi";
     repo = "inxi";
     rev = version;
-    sha256 = "0r204w0r06ibdr4dck7yw2nmvj7xq68bjr7xwwiy7liqdml0n0yc";
+    sha256 = "0539hvlq021wxhbwzdp7qliiq1jgw60mxlwrwx0z2x8qi1zqdzg6";
   };
 
   buildInputs = [ perl makeWrapper ];
diff --git a/pkgs/tools/text/highlight/default.nix b/pkgs/tools/text/highlight/default.nix
index bc32a60c6727..a918770aa7b9 100644
--- a/pkgs/tools/text/highlight/default.nix
+++ b/pkgs/tools/text/highlight/default.nix
@@ -5,13 +5,13 @@ with stdenv.lib;
 let
   self = stdenv.mkDerivation rec {
     pname = "highlight";
-    version = "3.56";
+    version = "3.57";
 
     src = fetchFromGitLab {
       owner = "saalen";
       repo = "highlight";
       rev = "v${version}";
-      sha256 = "1pilx58dg96zm0yx7i6k92vibwpvpj8ir39f2akrsyjgijnv3sx4";
+      sha256 = "1xrk7c7akjiwh3wh9bll0qh4g0kqvbzjz9ancpadnk0k7bqi0kxf";
     };
 
     enableParallelBuilding = true;
diff --git a/pkgs/tools/typesetting/scdoc/default.nix b/pkgs/tools/typesetting/scdoc/default.nix
index 356433bac41c..5b6cf5e22f21 100644
--- a/pkgs/tools/typesetting/scdoc/default.nix
+++ b/pkgs/tools/typesetting/scdoc/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "scdoc";
-  version = "1.10.1";
+  version = "1.11.0";
 
   src = fetchurl {
     url = "https://git.sr.ht/~sircmpwn/scdoc/archive/${version}.tar.gz";
-    sha256 = "13x7g1r56bshvfmlvapvz35ywnbgsh337kywb5kcv8nc6b3j3q40";
+    sha256 = "17cjh3lcfppyl2mzpanylla93gdgdv5spc8jldshvayzizhfghwa";
   };
 
   postPatch = ''
@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
       C99.
     '';
     homepage = "https://git.sr.ht/~sircmpwn/scdoc";
+    changelog = "https://git.sr.ht/~sircmpwn/scdoc/refs/${version}";
     license = licenses.mit;
     platforms = platforms.unix;
     maintainers = with maintainers; [ primeos ];
diff --git a/pkgs/tools/video/rav1e/default.nix b/pkgs/tools/video/rav1e/default.nix
index 02f6d12278a4..b8e43fe4f10f 100644
--- a/pkgs/tools/video/rav1e/default.nix
+++ b/pkgs/tools/video/rav1e/default.nix
@@ -1,31 +1,17 @@
-{ rustPlatform, fetchFromGitHub, fetchurl, stdenv, lib, nasm }:
+{ rustPlatform, fetchFromGitHub, lib, nasm }:
 
 rustPlatform.buildRustPackage rec {
   pname = "rav1e";
-  version = "0.3.2";
+  version = "0.3.3";
 
-  src = stdenv.mkDerivation rec {
-    name = "${pname}-${version}-source";
-
-    src = fetchFromGitHub {
-      owner = "xiph";
-      repo = "rav1e";
-      rev = "v${version}";
-      sha256 = "0qqw397yfglwj9kg45imhx1p5bb0nsx2gkaxj4lcc9i1hav6ia43";
-    };
-    cargoLock = fetchurl {
-      url = "https://github.com/xiph/rav1e/releases/download/v${version}/Cargo.lock";
-      sha256 = "1kdr3q97vq3mip1h7iv2iy9qzlgb69y6nwjzbw9nfi7dl7ip6q3l";
-    };
-
-    installPhase = ''
-      mkdir -p $out
-      cp -R ./* $out/
-      cp ${cargoLock} $out/Cargo.lock
-    '';
+  src = fetchFromGitHub {
+    owner = "xiph";
+    repo = "rav1e";
+    rev = "v${version}";
+    sha256 = "0a9dryag4x35a2c45qiq1j5xk9ydcpw1g6kici85d2yrc2z3hwrx";
   };
 
-  cargoSha256 = "03zsvavk7wskz843qxwwcymhclarcp6nfxwa1mwna3nmzvlm1hwb";
+  cargoSha256 = "1xaincrmpicp0skf9788w5631x1hxvifvq06hh5ribdz79zclzx3";
 
   nativeBuildInputs = [ nasm ];
 
@@ -37,7 +23,7 @@ rustPlatform.buildRustPackage rec {
       libaom (the reference encoder) is too slow.
       Features: https://github.com/xiph/rav1e#features
     '';
-    inherit (src.src.meta) homepage;
+    inherit (src.meta) homepage;
     changelog = "https://github.com/xiph/rav1e/releases/tag/v${version}";
     license = licenses.bsd2;
     maintainers = [ maintainers.primeos ];
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 33b2c84f327a..2212c49c715f 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -154,6 +154,7 @@ mapAliases ({
   fuseki = apache-jena-fuseki; # added 2018-04-25
   fusesmb = throw "fusesmb is abandoned by upstream"; # added 2019-10-15
   fwupdate = throw "fwupdate was merged into fwupd"; # added 2020-05-19
+  g4py = python3Packages.geant4; # added 2020-06-06
   gccApple = throw "gccApple is no longer supported"; # added 2018-04-25
   gdb-multitarget = gdb; # added 2017-11-13
   gdk_pixbuf = gdk-pixbuf; # added 2019-05-22
@@ -251,6 +252,7 @@ mapAliases ({
   libjpeg_drop = libjpeg_original; # added 2020-06-05
   libjson_rpc_cpp = libjson-rpc-cpp; # added 2017-02-28
   liblapackWithoutAtlas = lapack-reference; # added 2018-11-05
+  liblastfm = libsForQt5.liblastfm; # added 2020-06-14
   liblrdf = lrdf; # added 2018-04-25
   libqrencode = qrencode;  # added 2019-01-01
   librdf = lrdf; # added 2020-03-22
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 26a5e269629a..a2d8893f2060 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -624,7 +624,7 @@ in
 
   airfield = callPackage ../tools/networking/airfield { };
 
-  apache-airflow = with python3.pkgs; toPythonApplication apache-airflow;
+  apache-airflow = with python37.pkgs; toPythonApplication apache-airflow;
 
   airsonic = callPackage ../servers/misc/airsonic { };
 
@@ -777,7 +777,7 @@ in
 
   iamy = callPackage ../tools/admin/iamy { };
 
-  azure-cli = callPackage ../tools/admin/azure-cli { python = python3; };
+  azure-cli = callPackage ../tools/admin/azure-cli { python = python37; };
 
   azure-storage-azcopy = callPackage ../development/tools/azcopy { };
 
@@ -1133,9 +1133,7 @@ in
 
   atftp = callPackage ../tools/networking/atftp { };
 
-  autogen = callPackage ../development/tools/misc/autogen {
-    guile = guile_2_0;
-  };
+  autogen = callPackage ../development/tools/misc/autogen { };
 
   autojump = callPackage ../tools/misc/autojump { };
 
@@ -2174,6 +2172,8 @@ in
 
   rmapi = callPackage ../applications/misc/remarkable/rmapi { };
 
+  remarkable-mouse = python3Packages.callPackage ../applications/misc/remarkable/remarkable-mouse { };
+
   scour = with python3Packages; toPythonApplication scour;
 
   s2png = callPackage ../tools/graphics/s2png { };
@@ -3527,7 +3527,7 @@ in
   fontforge-gtk = fontforge.override {
     withSpiro = true;
     withGTK = true;
-    gtk2 = gtk2-x11;
+    gtk3 = gtk3-x11;
     inherit (darwin.apple_sdk.frameworks) Carbon Cocoa;
   };
 
@@ -5232,7 +5232,9 @@ in
 
   mirrorbits = callPackage ../servers/mirrorbits { };
 
-  mitmproxy = callPackage ../tools/networking/mitmproxy { };
+  mitmproxy = callPackage ../tools/networking/mitmproxy {
+    python3Packages = python37Packages;
+  };
 
   mjpegtools = callPackage ../tools/video/mjpegtools { };
 
@@ -6399,7 +6401,9 @@ in
 
   rpiboot-unstable = callPackage ../development/misc/rpiboot/unstable.nix { };
 
-  rpm = callPackage ../tools/package-management/rpm { };
+  rpm = callPackage ../tools/package-management/rpm {
+    python = python3;
+  };
 
   rpm-ostree = callPackage ../tools/misc/rpm-ostree {
     gperf = gperf_3_0;
@@ -7914,7 +7918,11 @@ in
 
   zssh = callPackage ../tools/networking/zssh { };
 
-  zstd = callPackage ../tools/compression/zstd { };
+  zstd = callPackage ../tools/compression/zstd {
+    cmake = cmake.override {
+      libarchive = libarchive.override { zstd = null; };
+    };
+  };
 
   zsync = callPackage ../tools/compression/zsync { };
 
@@ -9656,7 +9664,7 @@ in
   # When switching these sets, please update docs at ../../doc/languages-frameworks/python.md
   python = python2;
   python2 = python27;
-  python3 = python37;
+  python3 = python38;
   pypy = pypy2;
   pypy2 = pypy27;
   pypy3 = pypy36;
@@ -10139,6 +10147,8 @@ in
   buildkite-agent2 = throw "pkgs.buildkite-agent2 has been discontinued. Please use pkgs.buildkite-agent (v3.x)";
   buildkite-agent3 = callPackage ../development/tools/continuous-integration/buildkite-agent { };
 
+  buildkite-cli = callPackage ../development/tools/continuous-integration/buildkite-cli { };
+
   libbpf = callPackage ../os-specific/linux/libbpf { };
 
   bpftool = callPackage ../os-specific/linux/bpftool { };
@@ -10375,7 +10385,7 @@ in
 
   dolt = callPackage ../servers/sql/dolt { };
 
-  dot2tex = pythonPackages.dot2tex;
+  dot2tex = with python3.pkgs; toPythonApplication dot2tex;
 
   doxygen = callPackage ../development/tools/documentation/doxygen {
     qt4 = null;
@@ -11136,7 +11146,9 @@ in
 
   vultr-cli = callPackage ../development/tools/vultr-cli { };
 
-  vulnix = callPackage ../tools/security/vulnix { };
+  vulnix = callPackage ../tools/security/vulnix {
+    python3Packages = python37Packages;
+  };
 
   vtable-dumper = callPackage ../development/tools/misc/vtable-dumper { };
 
@@ -13072,8 +13084,6 @@ in
 
   liblastfmSF = callPackage ../development/libraries/liblastfmSF { };
 
-  liblastfm = callPackage ../development/libraries/liblastfm { };
-
   liblcf = callPackage ../development/libraries/liblcf { };
 
   liblqr1 = callPackage ../development/libraries/liblqr-1 { };
@@ -14347,6 +14357,8 @@ in
 
     libktorrent = callPackage ../development/libraries/libktorrent { };
 
+    liblastfm = callPackage ../development/libraries/liblastfm { };
+
     libopenshot = callPackage ../applications/video/openshot-qt/libopenshot.nix { };
 
     libopenshot-audio = callPackage ../applications/video/openshot-qt/libopenshot-audio.nix { };
@@ -15743,7 +15755,9 @@ in
 
   hiawatha = callPackage ../servers/http/hiawatha {};
 
-  home-assistant = callPackage ../servers/home-assistant { };
+  home-assistant = callPackage ../servers/home-assistant { 
+    python3 = python37;
+  };
 
   home-assistant-cli = callPackage ../servers/home-assistant/cli.nix { };
 
@@ -16251,8 +16265,9 @@ in
     libtool = darwin.cctools;
   };
 
+  # Fails to compile with boost >= 1.72
   rippled = callPackage ../servers/rippled {
-    boost = boost17x;
+    boost = boost171;
   };
 
   rippled-validator-keys-tool = callPackage ../servers/rippled/validator-keys-tool.nix {
@@ -20194,6 +20209,7 @@ in
   swaybg = callPackage ../applications/window-managers/sway/bg.nix { };
   swayidle = callPackage ../applications/window-managers/sway/idle.nix { };
   swaylock = callPackage ../applications/window-managers/sway/lock.nix { };
+  sway-contrib = recurseIntoAttrs (callPackages ../applications/window-managers/sway/contrib.nix { });
 
   swaylock-fancy = callPackage ../applications/window-managers/sway/lock-fancy.nix { };
 
@@ -25410,8 +25426,6 @@ in
 
   cernlib = callPackage ../development/libraries/physics/cernlib { };
 
-  g4py = callPackage ../development/libraries/physics/geant4/g4py { };
-
   hepmc2 = callPackage ../development/libraries/physics/hepmc2 { };
 
   hepmc3 = callPackage ../development/libraries/physics/hepmc3 {
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 602e131ad9e6..4be489c76ebb 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -401,15 +401,7 @@ let
 
     jingoo = callPackage ../development/ocaml-modules/jingoo { };
 
-    js_of_ocaml =
-    if lib.versionOlder "4.02" ocaml.version
-    then callPackage ../development/tools/ocaml/js_of_ocaml/3.0.nix { }
-    else js_of_ocaml_2;
-
-    js_of_ocaml_2 = callPackage ../development/tools/ocaml/js_of_ocaml {
-      base64 = base64_2;
-      lwt = lwt2;
-    };
+    js_of_ocaml = callPackage ../development/tools/ocaml/js_of_ocaml { };
 
     js_of_ocaml-camlp4 = callPackage ../development/tools/ocaml/js_of_ocaml/camlp4.nix {};
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index bbc5277cd648..89bf25c15908 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -13858,6 +13858,22 @@ let
     };
   };
 
+  NetIPLite = buildPerlPackage {
+    pname = "Net-IP-Lite";
+    version = "0.03";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/A/AL/ALEXKOM/Net-IP-Lite-0.03.tar.gz";
+      sha256 = "c9916e6cfaa53be275379ce4b2a550ae176ddfab50dad43b43ed43e8267802a9";
+    };
+    buildInputs = [ TestException ];
+    meta = {
+      homepage = "https://metacpan.org/pod/Net::IP::Lite";
+      description = "Perl extension for manipulating IPv4/IPv6 addresses";
+      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
+      maintainers = [ maintainers.sgo ];
+    };
+  };
+
   NetIPv4Addr = buildPerlPackage {
     pname = "Net-IPv4Addr";
     version = "0.10";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 1ea7ee183549..5e7e70563526 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1256,6 +1256,8 @@ in {
 
   pynisher = callPackage ../development/python-modules/pynisher { };
 
+  pynput = callPackage ../development/python-modules/pynput { };
+
   pyparser = callPackage ../development/python-modules/pyparser { };
 
   pyres = callPackage ../development/python-modules/pyres { };
@@ -2622,6 +2624,8 @@ in {
 
   libais = callPackage ../development/python-modules/libais { };
 
+  libevdev = callPackage ../development/python-modules/libevdev { };
+
   libfdt = toPythonModule (pkgs.dtc.override {
     inherit python;
     pythonSupport = true;
@@ -2808,6 +2812,8 @@ in {
 
   fake_factory = callPackage ../development/python-modules/fake_factory { };
 
+  fake-useragent = callPackage ../development/python-modules/fake-useragent { };
+
   factory_boy = callPackage ../development/python-modules/factory_boy { };
 
   Fabric = callPackage ../development/python-modules/Fabric { };
@@ -3452,6 +3458,8 @@ in {
 
   samplerate = callPackage ../development/python-modules/samplerate { };
 
+  screeninfo = callPackage ../development/python-modules/screeninfo { };
+
   ssdeep = callPackage ../development/python-modules/ssdeep { };
 
   ssdp = callPackage ../development/python-modules/ssdp { };
@@ -3474,6 +3482,8 @@ in {
 
   setuptools-git = callPackage ../development/python-modules/setuptools-git { };
 
+  setuptools-lint = callPackage ../development/python-modules/setuptools-lint { };
+
   sievelib = callPackage ../development/python-modules/sievelib { };
 
   watchdog = callPackage ../development/python-modules/watchdog { };
@@ -3894,6 +3904,11 @@ in {
 
   gdrivefs = callPackage ../development/python-modules/gdrivefs { };
 
+  geant4 = disabledIf (!isPy3k) (toPythonModule (pkgs.geant4.override {
+    enablePython = true;
+    python3 = python;
+  }));
+
   genshi = callPackage ../development/python-modules/genshi { };
 
   gentools = callPackage ../development/python-modules/gentools { };
@@ -5703,7 +5718,7 @@ in {
 
   rply = callPackage ../development/python-modules/rply {};
 
-  rpm = toPythonModule (pkgs.rpm.override{inherit python;});
+  rpm = disabledIf (!isPy3k) (toPythonModule (pkgs.rpm.override{ inherit python; }));
 
   rpmfluff = callPackage ../development/python-modules/rpmfluff {};
 
@@ -6788,7 +6803,9 @@ in {
 
   jenkins-job-builder = callPackage ../development/python-modules/jenkins-job-builder { };
 
-  dot2tex = callPackage ../development/python-modules/dot2tex { };
+  dot2tex = callPackage ../development/python-modules/dot2tex {
+    inherit (pkgs) graphviz;
+  };
 
   poezio = callPackage ../applications/networking/instant-messengers/poezio {
     inherit (pkgs) pkgconfig;
@@ -6900,6 +6917,12 @@ in {
 
   scrapy = callPackage ../development/python-modules/scrapy { };
 
+  scrapy-fake-useragent = callPackage ../development/python-modules/scrapy-fake-useragent { };
+
+  scrapy-deltafetch = callPackage ../development/python-modules/scrapy-deltafetch { };
+
+  scrapy-splash = callPackage ../development/python-modules/scrapy-splash { };
+
   pandocfilters = callPackage ../development/python-modules/pandocfilters { };
 
   pandoc-attributes = callPackage ../development/python-modules/pandoc-attributes { };
diff --git a/pkgs/top-level/release-lib.nix b/pkgs/top-level/release-lib.nix
index 9dff0503d23a..1e33c7b0585b 100644
--- a/pkgs/top-level/release-lib.nix
+++ b/pkgs/top-level/release-lib.nix
@@ -145,7 +145,7 @@ rec {
     let res = builtins.tryEval (
       if isDerivation value then
         value.meta.hydraPlatforms
-          or (supportedMatches (value.meta.platforms or [ "x86_64-linux" ]))
+          or (value.meta.platforms or [ "x86_64-linux" ])
       else if value.recurseForDerivations or false || value.recurseForRelease or false then
         packagePlatforms value
       else